diff --git a/.ci/Jenkinsfile b/.ci/Jenkinsfile index b16071e8c3c..fa13f663739 100644 --- a/.ci/Jenkinsfile +++ b/.ci/Jenkinsfile @@ -14,8 +14,8 @@ pipeline { AWS_ACCOUNT_SECRET = "secret/observability-team/ci/elastic-observability-aws-account-auth" HOME = "${env.WORKSPACE}" DOCKER_COMPOSE_VERSION = "v2.17.2" - KIND_VERSION = "v0.17.0" - K8S_VERSION = "v1.26.0" + KIND_VERSION = "v0.20.0" + K8S_VERSION = "v1.27.3" JOB_GCS_BUCKET = 'fleet-ci-temp' JOB_GCS_BUCKET_INTERNAL = 'fleet-ci-temp-internal' JOB_GCS_CREDENTIALS = 'fleet-ci-gcs-plugin' @@ -46,9 +46,12 @@ pipeline { ELASTIC_PACKAGE_COMPOSE_DISABLE_PULL_PROGRESS_INFORMATION = 'true' // links definitions ELASTIC_PACKAGE_LINKS_FILE_PATH = "${env.HOME}/${env.BASE_DIR}/links_table.yml" + + // Default license to use by `elastic-package build` + ELASTIC_PACKAGE_REPOSITORY_LICENSE = "licenses/Elastic-2.0.txt" } options { - timeout(time: 4, unit: 'HOURS') + timeout(time: 6, unit: 'HOURS') buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20', daysToKeepStr: '30')) timestamps() ansiColor('xterm') diff --git a/.ci/schedule-daily.groovy b/.ci/schedule-daily.groovy index 7a49bc6cbdc..7467de0d8c9 100644 --- a/.ci/schedule-daily.groovy +++ b/.ci/schedule-daily.groovy @@ -39,12 +39,12 @@ pipeline { ) } } - stage('with stack v8.9') { + stage('with stack v8.10') { steps { build( job: env.INTEGRATION_JOB, parameters: [ - stringParam(name: 'stackVersion', value: '8.9-SNAPSHOT'), + stringParam(name: 'stackVersion', value: '8.10-SNAPSHOT'), booleanParam(name: 'force_check_all', value: true), booleanParam(name: 'skip_publishing', value: true), ], diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index d6fc289ff21..527d2988246 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -11,6 +11,7 @@ /packages/activemq @elastic/obs-infraobs-integrations /packages/airflow @elastic/obs-infraobs-integrations /packages/akamai @elastic/security-external-integrations +/packages/amazon_security_lake @elastic/security-external-integrations /packages/apache @elastic/obs-infraobs-integrations /packages/apache_spark @elastic/obs-infraobs-integrations /packages/apache_tomcat @elastic/obs-infraobs-integrations @@ -22,13 +23,22 @@ /packages/auditd_manager @elastic/security-external-integrations /packages/auth0 @elastic/security-external-integrations /packages/aws @elastic/obs-cloud-monitoring +/packages/aws/changelog.yml @elastic/obs-cloud-monitoring @elastic/security-external-integrations +/packages/aws/data_stream/guardduty @elastic/security-external-integrations +/packages/aws/data_stream/securityhub_findings @elastic/security-external-integrations +/packages/aws/data_stream/securityhub_insights @elastic/security-external-integrations /packages/aws/kibana @elastic/obs-cloud-monitoring @elastic/kibana-visualizations +/packages/aws/manifest.yml @elastic/obs-cloud-monitoring @elastic/security-external-integrations /packages/aws_logs @elastic/obs-cloud-monitoring /packages/awsfargate @elastic/obs-cloud-monitoring +/packages/awsfirehose @elastic/obs-cloud-monitoring /packages/azure @elastic/obs-cloud-monitoring +/packages/azure_app_service @elastic/obs-infraobs-integrations /packages/azure_application_insights @elastic/obs-cloud-monitoring /packages/azure_billing @elastic/obs-cloud-monitoring /packages/azure_blob_storage @elastic/security-external-integrations +/packages/azure @elastic/obs-cloud-monitoring +/packages/azure_functions @elastic/obs-infraobs-integrations /packages/azure_frontdoor @elastic/security-external-integrations /packages/azure_metrics @elastic/obs-cloud-monitoring /packages/barracuda @elastic/security-external-integrations @@ -45,7 +55,6 @@ /packages/cel @elastic/security-external-integrations /packages/ceph @elastic/obs-infraobs-integrations /packages/checkpoint @elastic/security-external-integrations -/packages/cisco @elastic/security-external-integrations /packages/cisco_aironet @elastic/security-external-integrations /packages/cisco_asa @elastic/security-external-integrations /packages/cisco_duo @elastic/security-external-integrations @@ -69,7 +78,6 @@ /packages/couchbase @elastic/obs-infraobs-integrations /packages/couchdb @elastic/obs-infraobs-integrations /packages/crowdstrike @elastic/security-external-integrations -/packages/cyberark @elastic/security-external-integrations /packages/cyberark_pta @elastic/security-external-integrations /packages/cyberarkpas @elastic/security-external-integrations /packages/cylance @elastic/security-external-integrations @@ -81,6 +89,8 @@ /packages/elastic_package_registry @elastic/ecosystem /packages/elasticsearch @elastic/infra-monitoring-ui /packages/enterprisesearch @elastic/infra-monitoring-ui +/packages/entityanalytics_entra_id @elastic/security-external-integrations +/packages/entityanalytics_okta @elastic/security-external-integrations /packages/etcd @elastic/obs-infraobs-integrations /packages/f5 @elastic/security-external-integrations /packages/f5_bigip @elastic/security-external-integrations @@ -89,18 +99,23 @@ /packages/fleet_server @elastic/elastic-agent-control-plane /packages/forcepoint_web @elastic/security-external-integrations /packages/forgerock @elastic/security-external-integrations -/packages/fortinet @elastic/security-external-integrations /packages/fortinet_forticlient @elastic/security-external-integrations /packages/fortinet_fortiedr @elastic/security-external-integrations /packages/fortinet_fortigate @elastic/security-external-integrations /packages/fortinet_fortimail @elastic/security-external-integrations /packages/fortinet_fortimanager @elastic/security-external-integrations /packages/gcp @elastic/security-external-integrations @elastic/obs-cloud-monitoring +/packages/gcp/data_stream @elastic/obs-cloud-monitoring +/packages/gcp/data_stream/audit @elastic/security-external-integrations +/packages/gcp/data_stream/dns @elastic/security-external-integrations +/packages/gcp/data_stream/firewall @elastic/security-external-integrations +/packages/gcp/data_stream/vpcflow @elastic/security-external-integrations /packages/gcp_metrics @elastic/obs-cloud-monitoring /packages/gcp_pubsub @elastic/security-external-integrations /packages/github @elastic/security-external-integrations /packages/golang @elastic/obs-infraobs-integrations /packages/google_cloud_storage @elastic/security-external-integrations +/packages/google_scc @elastic/security-external-integrations /packages/google_workspace @elastic/security-external-integrations /packages/hadoop @elastic/obs-infraobs-integrations /packages/haproxy @elastic/obs-infraobs-integrations @@ -121,7 +136,6 @@ /packages/jolokia_input @elastic/obs-infraobs-integrations /packages/journald @elastic/elastic-agent-data-plane /packages/jumpcloud @elastic/security-external-integrations -/packages/juniper @elastic/security-external-integrations /packages/juniper_junos @elastic/security-external-integrations /packages/juniper_netscreen @elastic/security-external-integrations /packages/juniper_srx @elastic/security-external-integrations @@ -140,7 +154,7 @@ /packages/m365_defender @elastic/security-external-integrations /packages/mattermost @elastic/security-external-integrations /packages/memcached @elastic/obs-infraobs-integrations -/packages/microsoft @elastic/security-external-integrations +/packages/microsoft_defender_cloud @elastic/security-external-integrations /packages/microsoft_defender_endpoint @elastic/security-external-integrations /packages/microsoft_dhcp @elastic/security-external-integrations /packages/microsoft_exchange_online_message_trace @elastic/security-external-integrations @@ -174,9 +188,9 @@ /packages/problemchild @elastic/ml-ui @elastic/sec-applied-ml /packages/prometheus @elastic/obs-cloudnative-monitoring /packages/prometheus_input @elastic/obs-infraobs-integrations -/packages/proofpoint @elastic/security-external-integrations /packages/proofpoint_tap @elastic/security-external-integrations /packages/pulse_connect_secure @elastic/security-external-integrations +/packages/qualys_vmdr @elastic/security-external-integrations /packages/qnap_nas @elastic/security-external-integrations /packages/rabbitmq @elastic/obs-infraobs-integrations /packages/radware @elastic/security-external-integrations @@ -191,7 +205,6 @@ /packages/slack @elastic/security-external-integrations /packages/snort @elastic/security-external-integrations /packages/snyk @elastic/security-external-integrations -/packages/sonicwall @elastic/security-external-integrations /packages/sonicwall_firewall @elastic/security-external-integrations /packages/sophos @elastic/security-external-integrations /packages/sophos_central @elastic/security-external-integrations @@ -205,7 +218,11 @@ /packages/synthetics @elastic/uptime /packages/sysmon_linux @elastic/security-external-integrations /packages/system @elastic/obs-infraobs-integrations +/packages/system/changelog.yml @elastic/obs-infraobs-integrations @elastic/security-external-integrations +/packages/system/data_stream/auth @elastic/security-external-integrations +/packages/system/data_stream/security @elastic/security-external-integrations /packages/system/kibana @elastic/elastic-agent-data-plane @elastic/kibana-visualizations +/packages/system/manifest.yml @elastic/obs-infraobs-integrations @elastic/security-external-integrations /packages/system_audit @elastic/security-external-integrations /packages/tanium @elastic/security-external-integrations /packages/tcp @elastic/security-external-integrations @@ -216,6 +233,7 @@ /packages/ti_anomali @elastic/security-external-integrations /packages/ti_cif3 @elastic/security-external-integrations /packages/ti_cybersixgill @elastic/security-external-integrations +/packages/ti_maltiverse @elastic/security-external-integrations /packages/ti_misp @elastic/security-external-integrations /packages/ti_otx @elastic/security-external-integrations /packages/ti_rapid7_threat_command @elastic/security-external-integrations @@ -225,6 +243,7 @@ /packages/tines @elastic/security-external-integrations /packages/tomcat @elastic/obs-infraobs-integrations /packages/traefik @elastic/obs-infraobs-integrations +/packages/trellix_edr_cloud @elastic/security-external-integrations /packages/trellix_epo_cloud @elastic/security-external-integrations /packages/trend_micro_vision_one @elastic/security-external-integrations /packages/trendmicro @elastic/security-external-integrations @@ -237,12 +256,21 @@ /packages/vsphere @elastic/obs-infraobs-integrations /packages/websphere_application_server @elastic/obs-infraobs-integrations /packages/windows @elastic/elastic-agent-data-plane @elastic/security-external-integrations +/packages/windows/data_stream/applocker_exe_and_dll @elastic/security-external-integrations +/packages/windows/data_stream/applocker_msi_and_script @elastic/security-external-integrations +/packages/windows/data_stream/applocker_packaged_app_deployment @elastic/security-external-integrations +/packages/windows/data_stream/applocker_packaged_app_execution @elastic/security-external-integrations +/packages/windows/data_stream/forwarded @elastic/security-external-integrations +/packages/windows/data_stream/perfmon @elastic/elastic-agent-data-plane +/packages/windows/data_stream/powershell @elastic/security-external-integrations +/packages/windows/data_stream/powershell_operational @elastic/security-external-integrations +/packages/windows/data_stream/service @elastic/elastic-agent-data-plane +/packages/windows/data_stream/sysmon_operational @elastic/security-external-integrations /packages/winlog @elastic/security-external-integrations /packages/zeek @elastic/security-external-integrations /packages/zerofox @elastic/security-external-integrations /packages/zeronetworks @elastic/security-external-integrations /packages/zookeeper @elastic/obs-infraobs-integrations /packages/zoom @elastic/security-external-integrations -/packages/zscaler @elastic/security-external-integrations /packages/zscaler_zia @elastic/security-external-integrations /packages/zscaler_zpa @elastic/security-external-integrations diff --git a/.go-version b/.go-version index 66e2ae6c25c..2844977405c 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.19.1 +1.21.1 diff --git a/LICENSE.txt b/LICENSE.txt index 809108b857f..367352ffbd7 100644 --- a/LICENSE.txt +++ b/LICENSE.txt @@ -1,93 +1,9 @@ -Elastic License 2.0 +Source code in this repository is licensed under multiple licenses. +Source code in a given file is licensed under the Elastic License +Version 2.0, unless otherwise noted at the beginning of the file or +a LICENSE.txt file present in the directory subtree declares another +license. -URL: https://www.elastic.co/licensing/elastic-license +Built packages include a copy of the applicable license. -## Acceptance - -By using the software, you agree to all of the terms and conditions below. - -## Copyright License - -The licensor grants you a non-exclusive, royalty-free, worldwide, -non-sublicensable, non-transferable license to use, copy, distribute, make -available, and prepare derivative works of the software, in each case subject to -the limitations and conditions below. - -## Limitations - -You may not provide the software to third parties as a hosted or managed -service, where the service provides users with access to any substantial set of -the features or functionality of the software. - -You may not move, change, disable, or circumvent the license key functionality -in the software, and you may not remove or obscure any functionality in the -software that is protected by the license key. - -You may not alter, remove, or obscure any licensing, copyright, or other notices -of the licensor in the software. Any use of the licensor’s trademarks is subject -to applicable law. - -## Patents - -The licensor grants you a license, under any patent claims the licensor can -license, or becomes able to license, to make, have made, use, sell, offer for -sale, import and have imported the software, in each case subject to the -limitations and conditions in this license. This license does not cover any -patent claims that you cause to be infringed by modifications or additions to -the software. If you or your company make any written claim that the software -infringes or contributes to infringement of any patent, your patent license for -the software granted under these terms ends immediately. If your company makes -such a claim, your patent license ends immediately for work on behalf of your -company. - -## Notices - -You must ensure that anyone who gets a copy of any part of the software from you -also gets a copy of these terms. - -If you modify the software, you must include in any modified copies of the -software prominent notices stating that you have modified the software. - -## No Other Rights - -These terms do not imply any licenses other than those expressly granted in -these terms. - -## Termination - -If you use the software in violation of these terms, such use is not licensed, -and your licenses will automatically terminate. If the licensor provides you -with a notice of your violation, and you cease all violation of this license no -later than 30 days after you receive that notice, your licenses will be -reinstated retroactively. However, if you violate these terms after such -reinstatement, any additional violation of these terms will cause your licenses -to terminate automatically and permanently. - -## No Liability - -*As far as the law allows, the software comes as is, without any warranty or -condition, and the licensor will not be liable to you for any damages arising -out of these terms or the use or nature of the software, under any kind of -legal claim.* - -## Definitions - -The **licensor** is the entity offering these terms, and the **software** is the -software the licensor makes available under these terms, including any portion -of it. - -**you** refers to the individual or entity agreeing to these terms. - -**your company** is any legal entity, sole proprietorship, or other kind of -organization that you work for, plus all organizations that have control over, -are under the control of, or are under common control with that -organization. **control** means ownership of substantially all the assets of an -entity, or the power to direct its management and policies by vote, contract, or -otherwise. Control can be direct or indirect. - -**your licenses** are all the licenses granted to you for the software under -these terms. - -**use** means anything you do with the software requiring one of your licenses. - -**trademark** means trademarks, service marks, and similar rights. +Full text of licenses can be found in the licenses directory. diff --git a/docs/developer_tsdb_migration_guidelines.md b/docs/developer_tsdb_migration_guidelines.md index 1017a156227..21bcef9a1d4 100644 --- a/docs/developer_tsdb_migration_guidelines.md +++ b/docs/developer_tsdb_migration_guidelines.md @@ -1,12 +1,17 @@ # TSDB Guideline for Integration Developers +Important related resources: + +- Meta [issue](https://github.com/elastic/integrations/issues/5233) with all migrated packages +- TSDB [test](https://github.com/elastic/TSDB-migration-test-kit) migration kit. + +In this document you can find: + * [Background](#background) * [Steps for migrating an existing package](#migration-steps) * [Testing](#testing) * [Best practices](#best-practices) * [Troubleshooting](#troubleshooting) -* [Known issues](#known-issues) -* [Reference to existing package already migrated](#existing-migrated-packages) # Background @@ -19,94 +24,117 @@ Integration is one of the biggest sources of input data to elasticsearch. Enabli # Steps for migrating an existing package -1. **Datastream having type `logs` can be excluded from TSDB migration.** -2. **Add the changes to the manifest.yml file of the datastream as below to enable the timeseries index mode** - ``` - elasticsearch: - index_mode: "time_series" - ``` - If your datastream has more number of dimension fields, you can modify this limit by modifying index.mapping.dimension_fields.limit value as below - ``` - elasticsearch: - index_mode: "time_series" - index_template: - settings: - # Defaults to 16 - index.mapping.dimension_fields.limit: 32 - ``` -3. **Identifying the dimensions in the datastream.** - - Read about dimension fields [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#time-series-dimension). It is important that dimensions or a set of dimensions that are part of a datastream uniquely identify a timeseries. Dimensions are used to form _tsid which then is used for routing and index sorting. Read about the ways to add field a dimension [here](https://github.com/elastic/integrations/blob/main/docs/generic_guidelines.md#specify-dimensions]) +> **Warning**: Datastream having type `logs` are excluded from TSDB migration. - A field having type [flattened](https://www.elastic.co/guide/en/elasticsearch/reference/current/flattened.html) cannot be selected as a dimension field. If the field that you are choosing as a dimension is too long or is of type flattened , consider the option of hashing the value of this field, creating a new dimension field to hold this value . [Fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) can be used for this purpose. - Reference : [Oracle Integration TSDB Enablement Example](https://github.com/elastic/integrations/blob/8a57d6ba96d391afc33da20c80ec51280d22f009/packages/oracle/data_stream/performance/elasticsearch/ingest_pipeline/default.yml#LL127C4-L131C29) - -3. **Annotating the ECS fields as dimension.** - - From the context of integrations that are related to products that are deployed on-premise, there exist certain fields that are part of every package and they are potential candidates of becoming dimension fields - - * host.ip - * service.address - * agent.id +### Step 1: Set the dimension fields + +Each field belonging to the set of fields that uniquely identify a document is a dimension. You can read more details about dimensions [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#time-series-dimension). + +To set a field as dimension simply add `dimension: true` to its mapping: + +```yaml +- name: ApiId + type: keyword + dimension: true +``` + +> **Note**: A field having type [flattened](https://www.elastic.co/guide/en/elasticsearch/reference/current/flattened.html) cannot be selected as a dimension field. If the field that you are choosing as a dimension is too long or is of type flattened, consider hashing the value of this field and using the result as a dimension. [Fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) can be used for this purpose. +> +> You can find an example in [Oracle Integration TSDB Enablement Example](https://github.com/elastic/integrations/blob/8a57d6ba96d391afc33da20c80ec51280d22f009/packages/oracle/data_stream/performance/elasticsearch/ingest_pipeline/default.yml#LL127C4-L131C29) + +Important considerations: +- There is a limit on how many dimension fields a datastream can have. By default, this value is [21](https://github.com/elastic/elasticsearch/blob/6417a4f80f32ace48b8ad682ad46b19b57e49d60/server/src/main/java/org/elasticsearch/index/mapper/MapperService.java#L114)). You can adjust this restriction by altering the `index.mapping.dimension_fields.limit`: +```yaml +elasticsearch: + index_template: + settings: + index.mapping.dimension_fields.limit: 32 # Defaults to 21 +``` +- Dimension _keys_ have a hard limit of 512b. Documents are rejected if this limit is reached. +- Dimension _values_ have a hard limit of 1024b. Documents are rejected if this limit is reached. + +#### ECS fiels +There are fields that are part of every package, and they are potential candidates of becoming dimension fields: + +* `host.name` +* `service.address` +* `agent.id` +* `container.id` + +For products that are capable of running both on-premise and in a public cloud environment (by being deployed on public cloud virtual machines), it is recommended to annotate the ECS fields listed below as dimension fields: +* `host.name` +* `service.address` +* `container.id` +* `cloud.account.id` +* `cloud.provider` +* `cloud.region` +* `cloud.availability_zone` +* `agent.id` +* `cloud.instance.id` + +For products operating as managed services within cloud providers like AWS, Azure, and GCP, it is advised to label the fields listed below as dimension fields. +* `cloud.account.id` +* `cloud.region` +* `cloud.availability_zone` +* `cloud.provider` +* `agent.id ` + +Note that for some packages some of these fields do not hold any value, so make sure to only use the needed ones. - When metrics are collected from a resource running in the cloud or in a container, certain fields are potential candidates of becoming dimension fields - - * host.ip - * service.address - * agent.id - * cloud.project.id - * cloud.instance.id - * cloud.provider - * container.id - - *Warning: Choosing an insufficient number of dimension fields may lead to data loss* - - *Hint: Fields having type [keyword](https://www.elastic.co/guide/en/elasticsearch/reference/current/keyword.html#keyword-field-type) in your datastream are very good candidates of becoming dimension fields* +#### Integration specific fields -4. **Annotating the integration specific fields as dimension** +`files.yml` file has the field mappings specific to a datastream of an integration. Some of these fields might need to be set as dimension if the set of dimension fields in ECS is not enough to create a unique [_tsid](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#tsid). - `files.yml` file has the field mappings specific to a datastream of an integration. This step is needed when the dimension fields in ECS is not sufficient enough to create a unique [_tsid](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#tsid) value for the documents stored in elasticsearch. Annotate the field with `dimension: true` to tag the field as dimension field. +Adding an inline comment prior to the dimension annotation is advised, detailing the rationale behind the choice of a particular field as a dimension field. ``` - name: wait_class type: keyword - description: Every wait event belongs to a class of wait events. + # Multiple events are generated based on the values of wait_class. Hence, it is a dimension dimension: true + description: Every wait event belongs to a class of wait events. ``` - *Notes:* - * *There exists a limit on how many dimension fields can have. By default this value is 16. Out of this, 8 are reserved for ecs fields.* - * *Dimension keys have a hard limit of 512b. Documents are rejected if this limit is reached.* - * *Dimension values have a hard limit of 1024b. Documents are rejected if this limit is reached* +### Step 2: Set type for metric fields -5. **Annotating Metric Types values for all applicable fields** +Metrics are fields that contain numeric measurements, as well as aggregations and/or down sampling values based off of those measurements. Annotate each metric with the correct metric type. The [currently supported](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#time-series-metric) values are `gauge`, `counter` and `null`. - Metrics are fields that contain numeric measurements, as well as aggregations and/or downsampling values based off of those measurements. +Example of adding a metric type to a field: - Annotate fields using appropriate metric_type wherever applicable. `counter` and `gauge` are the currently supported values for [metric_type](https://www.elastic.co/guide/en/elasticsearch/reference/master/mapping-field-meta.html). +```yaml +- name: compactions_failed + type: double + metric_type: counter + description: | + Counter of TSM compactions by level that have failed due to error. +``` +> **Note**: Some of the aggregation functions are not supported for certain metric_type. In such a scenario, please revisit to see if the selection of metric_type you made is indeed correct for that field. If valid, please create an issue under elastic/elasticsearch explaining the use case. - More details regarding metric_type can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html#time-series-metric) +### Step 3: Update Kibana version - Example on adding metric_type to field mapping. +Modify the `kibana.version` to at least `8.8.0` within the `manifest.yml` file of the package: +```yaml +conditions: + kibana.version: "^8.8.0" +``` - ``` - - name: compactions_failed - type: double - metric_type: counter - description: | - Counter of TSM compactions by level that have failed due to error. - ``` - *Note: It may be possible that some of the aggregation functions are not supported for certain metric_type. In such a scenario, please revisit to see if the selection of metric_type you made is indeed correct for that field. If valid, please create an issue under elastic/elasticsearch explaining the use case.* +### Step 4: Enable `time_series` index mode -# Testing - -- After migration, verify if the dashboard is rendering the data properly. If certain visualisation do not work, consider migrating to [Lens](https://www.elastic.co/guide/en/kibana/current/lens.html) +Add the changes to the `manifest.yml` file of the datastream as below to enable the timeseries index mode: +```yaml +elasticsearch: + index_mode: "time_series" +``` - Certain aggregation functions are not supported when a field is having a metric_type ‘counter’. Example avg(). Replace such aggregation functions with a supported aggregation type such as max(). -- It is recommended to compare the number of documents within a certain time frame before enabling the TSDB and after enabling TSDB index mode. If the count differs, please check if there exists a field that is not annotated as dimension field. + +# Testing + +- If the number of dimensions is insufficient, we will have loss of data. Consider testing this using the [TSDB migration test kit](https://github.com/elastic/TSDB-migration-test-kit). + +- Verify the dashboard is rendering the data properly. If certain visualisation do not work, consider migrating to [Lens](https://www.elastic.co/guide/en/kibana/current/lens.html). Remember that certain aggregation functions are not supported when a field has metric type `counter`. Example `avg()`. Replace such aggregation functions with a supported aggregation type such as `max()` or `min()`. # Best practices @@ -115,33 +143,42 @@ Integration is one of the biggest sources of input data to elasticsearch. Enabli - Always assess the number of unique values the field that is selected to be dimension would hold, especially if it is a numeric field. A field that holds millions of unique values may not be an ideal candidate for becoming a dimension field. + - If the dimension field value length is very long (max limit is 1024B), consider transforming the value to hash value representation. [Fingerprint processor](https://www.elastic.co/guide/en/elasticsearch/reference/current/fingerprint-processor.html) can be used for this purpose. -- In the field mapping files above each dimension field, add in-line comments stating the reason for selecting the field as a dimension field, especially when the field description does not cover enough details that explains the reason why the field must be a dimension field. -- As part of TSDB migration testing, you may discover other errors which may be un-related to TSDB migration. Keep the PR for TSDB migration free from such changes. This helps in obtaining quick PR approval. +- In the field mapping files above each dimension field, add in-line comments stating the reason for selecting the field as a dimension field. -# Troubleshooting +- As part of TSDB migration testing, you may discover other errors which may be unrelated to TSDB migration. Keep the PR for TSDB migration free from such changes. This helps in obtaining quick PR approval. -**Identification of Write Index**: When mappings are modified for a datastream, index rollover happens and a new index is created under the datastream. Even if there exists a new index, the data continues to go to the old index until the timestamp matches `index.time_series.start_time` of the newly created index. -**Automatic Rollover**: Automatic datastream rollover does not happen when fields are tagged and untagged as dimensional fields. Also, automatic datastream rollover does not happen when the value of index.mapping.dimension_fields.limit is modified. +# Troubleshooting -When a package upgrade with the above mentiond change is applied, the changes are made only on the index template. This means, the user need to wait until `index.time_series.end_time` of the current write index before seeing the change, following a package upgrade. +### Conflicting field type -An enhancement [request](https://github.com/elastic/kibana/issues/150549) for Kibana is created to indicate the write index. Until then, refer to the index.time_series.start_time of indices and compare with the current time to identify the write index. +Fields having conflicting field type will not be considered as dimension. Resolve the field type ambiguity before defining a field as dimension field. -*Hint: In the Index Management UI, against a specific index, if the docs count column values regularly increase for an Index, it can be considered as the write index* +### Identification of write index -**Conflicting Field Type** : Fields having conflicting field type will not be considered as dimension. Resolve the field type ambiguity before defining a field as dimension field. +When mappings are modified for a datastream, index rollover happens and a new index is created under the datastream. Even if there exists a new index, the data continues to go to the old index until the timestamp matches `index.time_series.start_time` of the newly created index. -# Known issues +An enhancement [request](https://github.com/elastic/kibana/issues/150549) for Kibana is created to indicate the write index. Until then, refer to the `index.time_series.start_time` of indices and compare with the current time to identify the write index. -- Lens visualization fails if a field is having a metric_type value as ‘counter’ and certain aggregation functions are applied over it. -Reference : https://github.com/elastic/elasticsearch/issues/93539 +If you find this error (references [this issue](https://github.com/elastic/integrations/issues/7345) and [this PR](https://github.com/elastic/elasticsearch/pull/98518)): -- Currently, there are several limits around the number of dimensions. - Reference : https://github.com/elastic/elasticsearch/issues/93564 +```console +... (status=400): {"type":"illegal_argument_exception","reason":"the document timestamp [2023-08-07T00:00:00.000Z] is outside of ranges of currently writable indices [[2023-08-07T08:55:38.000Z,2023-08-07T12:55:38.000Z]]"}, dropping event! +``` -# Reference to existing package already migrated +Consider: +1. Defining the `look_ahead` or `look_back_time` for each data stream. Example: +```yaml +elasticsearch: + index_mode: "time_series" + index_template: + settings: + index.look_ahead_time: "10h" +``` +> **Note**: Updating the package with this does not cause an automatic rollover on the data stream. You have to do that manually. +2. Updating the `timestamp` of the document being rejected. +3. Finding a fix to receive the document without a delay. -Oracle integration TSDB enablement: [PR Link](https://github.com/elastic/integrations/pull/5307) diff --git a/docs/developer_workflow_bug_fix_older_package_version.md b/docs/developer_workflow_bug_fix_older_package_version.md index f9fa85da2d4..7f9f97b9860 100644 --- a/docs/developer_workflow_bug_fix_older_package_version.md +++ b/docs/developer_workflow_bug_fix_older_package_version.md @@ -1,10 +1,10 @@ -# Developer workflow: release a bug fix for supporting older package version? +# Developer workflow: release a bug fix for supporting older package version In some cases, when we drop the support for an older version of the stack and later on find out needing to add a bug fix to the some old package version, we have to make some manual changes to release the bug fix to users. For example: in this [PR](https://github.com/elastic/integrations/pull/3688) -(AWS package version 1.23.4), it was dropped support -for Kibana version 7.x and bumped the AWS package version from 1.19.5 to 1.20.0. But we found +(AWS package version 1.23.4), support for Kibana version 7.x was dropped +and bumped the AWS package version from 1.19.5 to 1.20.0. But we found a bug in the EC2 dashboard that needs to be fixed with Kibana version 7.x. So instead of adding a new AWS package version 1.23.5, we need to fix it between 1.19.5 and 1.20.0. @@ -60,9 +60,16 @@ Follow these detailed steps to release a fix for a given package version: Create a branch out of the commit from the previous step (8cb321075afb9b77ea965e1373a03a603d9c9796) and name it following this pattern: `backport--.`. For example: `backport-aws-1.19`. + This branch must be pushed to the upstream repository https://github.com/elastic/integrations.git in order to run the required CI pipelines. + 3. **Create a PR for the bug fix** - Apply bugfixes and open a PR against the `backport--.` branch created above. + Create a new branch in your own remote (it is advised **not using** a branch name starting with `backport-`), and apply bugfixes there. + Remember to update the version in the package manifest (update patch version like `1.19.`) and add a new changelog entry for this patch version. + + Once ready, open a PR selecting as a base branch the one created above: `backport--.` (e.g. `backport-aws-1.19`). + Once this PR is merged, this new version of the package is going to be published automatically following the usual CI/CD jobs. -Once this PR is merged, this new version of the package is going to be published automatically following the usual CI/CD jobs. + If it is needed to release a new fix for that version, there is no need to create a new branch. Just create a new PR to merge a + new branch onto the same backport branch created previously. diff --git a/docs/developer_workflow_design_build_test_integration.md b/docs/developer_workflow_design_build_test_integration.md index 91ddeba5777..6db228c5b5d 100644 --- a/docs/developer_workflow_design_build_test_integration.md +++ b/docs/developer_workflow_design_build_test_integration.md @@ -141,42 +141,50 @@ When you are ready for your changes in the integration to be released, remember It is up to you, as the package developer, to decide how many changes you want to release in a single version. For example, you could implement a change in a PR and bump up the package version in the same PR. Or you could implement several changes across multiple PRs and then bump up the package version in the last of these PRs -or in a separate follow up PR. As an example, it could be followed this procedure: - -1. Add a new version entry in the changelog with the prerelease tag `next`. Example: `2.6.0-next` - ```yaml - - version: "2.6.0-next" - changes: - - description: First PR - type: enhancement - link: https://github.com/elastic/integrations/pull/1 - - version: "2.5.0" - ``` -2. Add the required Pull Requests under this entry: - ```yaml - - version: "2.6.0-next" - changes: - - description: First PR - type: enhancement - link: https://github.com/elastic/integrations/pull/1 - - description: Second PR - type: enhancement - link: https://github.com/elastic/integrations/pull/2 - - description: Third PR - type: enhancement - link: https://github.com/elastic/integrations/pull/3 - ``` +or in a separate follow up PR. For example, you can apply the following procedure for a package whose latest published version is `2.5.0`: + +1. Add a new version entry in the changelog with the prerelease tag `next`: + - Keep same version in package manifest: `2.5.0` + - Update changelog with a new entry with the prerelease tag (e.g. `2.6.0-next`): + ```yaml + - version: "2.6.0-next" + changes: + - description: First PR + type: enhancement + link: https://github.com/elastic/integrations/pull/1 + - version: "2.5.0" + ``` +2. Add the required Pull Requests under this new changelog entry: + - Keep same version in package manifest: `2.5.0` + - Changelog: + ```yaml + - version: "2.6.0-next" + changes: + - description: First PR + type: enhancement + link: https://github.com/elastic/integrations/pull/1 + - description: Second PR + type: enhancement + link: https://github.com/elastic/integrations/pull/2 + - description: Third PR + type: enhancement + link: https://github.com/elastic/integrations/pull/3 + - version: "2.5.0" + ``` 3. Once everything is merged, another PR is required to bump up the manifest version and replace the changelog entry to be `2.6.0`: - ```yaml - - version: "2.6.0" - changes: - - description: First PR - type: enhancement - link: https://github.com/elastic/integrations/pull/1 - - description: Second PR - type: enhancement - link: https://github.com/elastic/integrations/pull/2 - - description: Third PR - type: enhancement - link: https://github.com/elastic/integrations/pull/3 - ``` + - Update version in package manifest: `2.6.0` + - Update changelog entry to `2.6.0`: + ```yaml + - version: "2.6.0" + changes: + - description: First PR + type: enhancement + link: https://github.com/elastic/integrations/pull/1 + - description: Second PR + type: enhancement + link: https://github.com/elastic/integrations/pull/2 + - description: Third PR + type: enhancement + link: https://github.com/elastic/integrations/pull/3 + - version: "2.5.0" + ``` diff --git a/go.mod b/go.mod index 5c8e9757050..344521e86e7 100644 --- a/go.mod +++ b/go.mod @@ -1,26 +1,26 @@ module github.com/elastic/integrations -go 1.19 +go 1.21.0 require ( github.com/blang/semver v3.5.1+incompatible - github.com/elastic/elastic-package v0.83.2 + github.com/elastic/elastic-package v0.87.1 github.com/elastic/go-licenser v0.4.1 - github.com/elastic/package-registry v1.20.0 + github.com/elastic/package-registry v1.21.0 github.com/magefile/mage v1.15.0 github.com/pkg/errors v0.9.1 github.com/stretchr/testify v1.8.4 - golang.org/x/tools v0.10.0 + golang.org/x/tools v0.13.0 gopkg.in/yaml.v2 v2.4.0 ) require ( - cloud.google.com/go v0.110.0 // indirect - cloud.google.com/go/compute v1.19.0 // indirect + cloud.google.com/go v0.110.4 // indirect + cloud.google.com/go/compute v1.20.1 // indirect cloud.google.com/go/compute/metadata v0.2.3 // indirect - cloud.google.com/go/iam v0.13.0 // indirect - cloud.google.com/go/pubsub v1.30.0 // indirect - cloud.google.com/go/storage v1.30.1 // indirect + cloud.google.com/go/iam v1.1.1 // indirect + cloud.google.com/go/pubsub v1.33.0 // indirect + cloud.google.com/go/storage v1.32.0 // indirect github.com/AlecAivazis/survey/v2 v2.3.7 // indirect github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect github.com/MakeNowJust/heredoc v1.0.0 // indirect @@ -30,14 +30,15 @@ require ( github.com/PaesslerAG/gval v1.2.1 // indirect github.com/PaesslerAG/jsonpath v0.1.1 // indirect github.com/Pallinder/go-randomdata v1.2.0 // indirect - github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 // indirect + github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f // indirect - github.com/ProtonMail/gopenpgp/v2 v2.7.1 // indirect + github.com/ProtonMail/gopenpgp/v2 v2.7.3 // indirect github.com/andybalholm/brotli v1.0.4 // indirect github.com/armon/go-radix v1.0.0 // indirect github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect github.com/aymerick/raymond v2.0.2+incompatible // indirect github.com/beorn7/perks v1.0.1 // indirect + github.com/cbroglie/mustache v1.4.0 // indirect github.com/cespare/xxhash/v2 v2.2.0 // indirect github.com/chai2010/gettext-go v1.0.2 // indirect github.com/cloudflare/circl v1.3.3 // indirect @@ -52,20 +53,20 @@ require ( github.com/elastic/go-ucfg v0.8.6 // indirect github.com/elastic/go-windows v1.0.1 // indirect github.com/elastic/gojsonschema v1.2.1 // indirect - github.com/elastic/package-spec/v2 v2.9.0 // indirect + github.com/elastic/package-spec/v2 v2.11.0 // indirect github.com/emicklei/go-restful/v3 v3.10.1 // indirect github.com/evanphx/json-patch v5.6.0+incompatible // indirect - github.com/evanphx/json-patch/v5 v5.6.0 // indirect + github.com/evanphx/json-patch/v5 v5.7.0 // indirect github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect github.com/fatih/color v1.15.0 // indirect github.com/felixge/httpsnoop v1.0.3 // indirect - github.com/fsouza/fake-gcs-server v1.44.2 // indirect + github.com/fsouza/fake-gcs-server v1.47.4 // indirect github.com/go-errors/errors v1.4.2 // indirect - github.com/go-logr/logr v1.2.3 // indirect + github.com/go-logr/logr v1.2.4 // indirect github.com/go-ole/go-ole v1.2.6 // indirect github.com/go-openapi/errors v0.20.3 // indirect github.com/go-openapi/jsonpointer v0.19.6 // indirect - github.com/go-openapi/jsonreference v0.20.1 // indirect + github.com/go-openapi/jsonreference v0.20.2 // indirect github.com/go-openapi/strfmt v0.21.3 // indirect github.com/go-openapi/swag v0.22.3 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -73,40 +74,40 @@ require ( github.com/golang/protobuf v1.5.3 // indirect github.com/golang/snappy v0.0.4 // indirect github.com/google/btree v1.1.2 // indirect - github.com/google/gnostic v0.6.9 // indirect + github.com/google/gnostic-models v0.6.8 // indirect github.com/google/go-cmp v0.5.9 // indirect github.com/google/go-github/v32 v32.1.0 // indirect github.com/google/go-querystring v1.1.0 // indirect github.com/google/gofuzz v1.2.0 // indirect github.com/google/renameio/v2 v2.0.0 // indirect + github.com/google/s2a-go v0.1.4 // indirect github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect - github.com/google/uuid v1.3.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect - github.com/googleapis/gax-go/v2 v2.8.0 // indirect + github.com/google/uuid v1.3.1 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect + github.com/googleapis/gax-go/v2 v2.12.0 // indirect github.com/gorilla/handlers v1.5.1 // indirect github.com/gorilla/mux v1.8.0 // indirect github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect - github.com/hashicorp/go-retryablehttp v0.7.2 // indirect + github.com/hashicorp/go-retryablehttp v0.7.4 // indirect github.com/huandu/xstrings v1.4.0 // indirect github.com/imdario/mergo v0.3.15 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/jcchavezs/porto v0.3.0 // indirect github.com/jedib0t/go-pretty v4.3.0+incompatible // indirect github.com/joeshaw/multierror v0.0.0-20140124173710-69b34d4ec901 // indirect github.com/josharian/intern v1.0.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect - github.com/klauspost/compress v1.16.0 // indirect + github.com/klauspost/compress v1.16.7 // indirect github.com/klauspost/pgzip v1.2.5 // indirect github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect github.com/lithammer/shortuuid/v3 v3.0.7 // indirect github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect github.com/mailru/easyjson v0.7.7 // indirect github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-isatty v0.0.17 // indirect + github.com/mattn/go-isatty v0.0.19 // indirect github.com/mattn/go-runewidth v0.0.14 // indirect github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect @@ -129,71 +130,72 @@ require ( github.com/pkg/xattr v0.4.9 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect - github.com/prometheus/client_golang v1.15.1 // indirect - github.com/prometheus/client_model v0.3.0 // indirect - github.com/prometheus/common v0.42.0 // indirect - github.com/prometheus/procfs v0.9.0 // indirect + github.com/prometheus/client_golang v1.16.0 // indirect + github.com/prometheus/client_model v0.4.0 // indirect + github.com/prometheus/common v0.44.0 // indirect + github.com/prometheus/procfs v0.10.1 // indirect github.com/rivo/uniseg v0.4.3 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect - github.com/shirou/gopsutil/v3 v3.23.5 // indirect + github.com/shirou/gopsutil/v3 v3.23.8 // indirect github.com/shoenig/go-m1cpu v0.1.6 // indirect github.com/shopspring/decimal v1.3.1 // indirect - github.com/sirupsen/logrus v1.9.0 // indirect + github.com/sirupsen/logrus v1.9.3 // indirect github.com/spf13/cast v1.5.0 // indirect github.com/spf13/cobra v1.7.0 // indirect github.com/spf13/pflag v1.0.5 // indirect - github.com/tklauser/go-sysconf v0.3.11 // indirect - github.com/tklauser/numcpus v0.6.0 // indirect + github.com/tklauser/go-sysconf v0.3.12 // indirect + github.com/tklauser/numcpus v0.6.1 // indirect github.com/ulikunitz/xz v0.5.11 // indirect github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 // indirect - github.com/xlab/treeprint v1.1.0 // indirect + github.com/xlab/treeprint v1.2.0 // indirect github.com/yusufpapurcu/wmi v1.2.3 // indirect - go.elastic.co/apm/module/apmgorilla/v2 v2.4.1 // indirect - go.elastic.co/apm/module/apmhttp/v2 v2.4.1 // indirect - go.elastic.co/apm/module/apmzap/v2 v2.4.1 // indirect - go.elastic.co/apm/v2 v2.4.1 // indirect + go.elastic.co/apm/module/apmgorilla/v2 v2.4.3 // indirect + go.elastic.co/apm/module/apmhttp/v2 v2.4.3 // indirect + go.elastic.co/apm/module/apmzap/v2 v2.4.3 // indirect + go.elastic.co/apm/v2 v2.4.3 // indirect go.elastic.co/ecszap v1.0.1 // indirect go.elastic.co/fastjson v1.1.0 // indirect go.mongodb.org/mongo-driver v1.11.1 // indirect go.opencensus.io v0.24.0 // indirect - go.starlark.net v0.0.0-20221205180719-3fd0dac74452 // indirect - go.uber.org/atomic v1.7.0 // indirect - go.uber.org/multierr v1.10.0 // indirect - go.uber.org/zap v1.24.0 // indirect - golang.org/x/crypto v0.10.0 // indirect - golang.org/x/mod v0.11.0 // indirect - golang.org/x/net v0.11.0 // indirect - golang.org/x/oauth2 v0.6.0 // indirect + go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect + go.uber.org/multierr v1.11.0 // indirect + go.uber.org/zap v1.25.0 // indirect + golang.org/x/crypto v0.13.0 // indirect + golang.org/x/mod v0.12.0 // indirect + golang.org/x/net v0.15.0 // indirect + golang.org/x/oauth2 v0.10.0 // indirect golang.org/x/sync v0.3.0 // indirect - golang.org/x/sys v0.9.0 // indirect - golang.org/x/term v0.9.0 // indirect - golang.org/x/text v0.10.0 // indirect + golang.org/x/sys v0.12.0 // indirect + golang.org/x/term v0.12.0 // indirect + golang.org/x/text v0.13.0 // indirect golang.org/x/time v0.3.0 // indirect golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect - google.golang.org/api v0.116.0 // indirect + google.golang.org/api v0.134.0 // indirect google.golang.org/appengine v1.6.7 // indirect - google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633 // indirect - google.golang.org/grpc v1.54.0 // indirect - google.golang.org/protobuf v1.30.0 // indirect + google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771 // indirect + google.golang.org/grpc v1.57.0 // indirect + google.golang.org/protobuf v1.31.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - helm.sh/helm/v3 v3.12.1 // indirect + helm.sh/helm/v3 v3.12.3 // indirect howett.net/plist v1.0.0 // indirect - k8s.io/api v0.27.3 // indirect - k8s.io/apiextensions-apiserver v0.27.2 // indirect - k8s.io/apimachinery v0.27.3 // indirect - k8s.io/cli-runtime v0.27.3 // indirect - k8s.io/client-go v0.27.3 // indirect - k8s.io/component-base v0.27.2 // indirect - k8s.io/klog/v2 v2.90.1 // indirect - k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f // indirect - k8s.io/kubectl v0.27.2 // indirect - k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 // indirect + k8s.io/api v0.28.2 // indirect + k8s.io/apiextensions-apiserver v0.27.3 // indirect + k8s.io/apimachinery v0.28.2 // indirect + k8s.io/cli-runtime v0.28.2 // indirect + k8s.io/client-go v0.28.2 // indirect + k8s.io/component-base v0.28.0 // indirect + k8s.io/klog/v2 v2.100.1 // indirect + k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect + k8s.io/kubectl v0.28.0 // indirect + k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect - sigs.k8s.io/kustomize/api v0.13.2 // indirect - sigs.k8s.io/kustomize/kyaml v0.14.1 // indirect + sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect + sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect sigs.k8s.io/yaml v1.3.0 // indirect ) diff --git a/go.sum b/go.sum index 11646ca44c8..1ebba04a789 100644 --- a/go.sum +++ b/go.sum @@ -1,19 +1,19 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -cloud.google.com/go v0.110.0 h1:Zc8gqp3+a9/Eyph2KDmcGaPtbKRIoqq4YTlL4NMD0Ys= -cloud.google.com/go v0.110.0/go.mod h1:SJnCLqQ0FCFGSZMUNUf84MV3Aia54kn7pi8st7tMzaY= -cloud.google.com/go/compute v1.19.0 h1:+9zda3WGgW1ZSTlVppLCYFIr48Pa35q1uG2N1itbCEQ= -cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU= +cloud.google.com/go v0.110.4 h1:1JYyxKMN9hd5dR2MYTPWkGUgcoxVVhg0LKNKEo0qvmk= +cloud.google.com/go v0.110.4/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI= +cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg= +cloud.google.com/go/compute v1.20.1/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA= -cloud.google.com/go/iam v0.13.0 h1:+CmB+K0J/33d0zSQ9SlFWUeCCEn5XJA0ZMZ3pHE9u8k= -cloud.google.com/go/iam v0.13.0/go.mod h1:ljOg+rcNfzZ5d6f1nAUJ8ZIxOaZUVoS14bKCtaLZ/D0= -cloud.google.com/go/kms v1.10.0 h1:Imrtp8792uqNP9bdfPrjtUkjjqOMBcAJ2bdFaAnLhnk= -cloud.google.com/go/longrunning v0.4.1 h1:v+yFJOfKC3yZdY6ZUI933pIYdhyhV8S3NpWrXWmg7jM= -cloud.google.com/go/pubsub v1.30.0 h1:vCge8m7aUKBJYOgrZp7EsNDf6QMd2CAlXZqWTn3yq6s= -cloud.google.com/go/pubsub v1.30.0/go.mod h1:qWi1OPS0B+b5L+Sg6Gmc9zD1Y+HaM0MdUr7LsupY1P4= -cloud.google.com/go/storage v1.30.1 h1:uOdMxAs8HExqBlnLtnQyP0YkvbiDpdGShGKtx6U/oNM= -cloud.google.com/go/storage v1.30.1/go.mod h1:NfxhC0UJE1aXSx7CIIbCf7y9HKT7BiccwkR7+P7gN8E= +cloud.google.com/go/iam v1.1.1 h1:lW7fzj15aVIXYHREOqjRBV9PsH0Z6u8Y46a1YGvQP4Y= +cloud.google.com/go/iam v1.1.1/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU= +cloud.google.com/go/kms v1.12.1 h1:xZmZuwy2cwzsocmKDOPu4BL7umg8QXagQx6fKVmf45U= +cloud.google.com/go/kms v1.12.1/go.mod h1:c9J991h5DTl+kg7gi3MYomh12YEENGrf48ee/N/2CDM= +cloud.google.com/go/pubsub v1.33.0 h1:6SPCPvWav64tj0sVX/+npCBKhUi/UjJehy9op/V3p2g= +cloud.google.com/go/pubsub v1.33.0/go.mod h1:f+w71I33OMyxf9VpMVcZbnG5KSUkCOUHYpFd5U1GdRc= +cloud.google.com/go/storage v1.32.0 h1:5w6DxEGOnktmJHarxAOUywxVW9lbNWIzlzzUltG/3+o= +cloud.google.com/go/storage v1.32.0/go.mod h1:Hhh/dogNRGca7IWv1RC2YqEn0c0G77ctA/OxflYkiD8= github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ= github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo= github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 h1:UQHMgLO+TxOElx5B5HZ4hJQsoJ/PvUvKRhJHDQXO8P8= @@ -30,7 +30,6 @@ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM= github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s= github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w= -github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/PaesslerAG/gval v1.0.0/go.mod h1:y/nm5yEyTeX6av0OfKJNp9rBNj2XrGhAf5+v24IBN1I= github.com/PaesslerAG/gval v1.2.1 h1:Ggwtej1xCyt1994VuDCSjycybIDo3duDCDghK/xc/A0= github.com/PaesslerAG/gval v1.2.1/go.mod h1:XRFLwvmkTEdYziLdaCeCa5ImcGVrfQbeNUbVR+C6xac= @@ -39,13 +38,13 @@ github.com/PaesslerAG/jsonpath v0.1.1 h1:c1/AToHQMVsduPAa4Vh6xp2U0evy4t8SWp8imEs github.com/PaesslerAG/jsonpath v0.1.1/go.mod h1:lVboNxFGal/VwW6d9JzIy56bUsYAP6tH/x80vjnCseY= github.com/Pallinder/go-randomdata v1.2.0 h1:DZ41wBchNRb/0GfsePLiSwb0PHZmT67XY00lCDlaYPg= github.com/Pallinder/go-randomdata v1.2.0/go.mod h1:yHmJgulpD2Nfrm0cR9tI/+oAgRqCQQixsA8HyRZfV9Y= -github.com/ProtonMail/go-crypto v0.0.0-20230321155629-9a39f2531310/go.mod h1:8TI4H3IbrackdNgv+92dI+rhpCaLqM0IfpgCgenFvRE= -github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903 h1:ZK3C5DtzV2nVAQTx5S5jQvMeDqWtD1By5mOoyY/xJek= -github.com/ProtonMail/go-crypto v0.0.0-20230518184743-7afd39499903/go.mod h1:8TI4H3IbrackdNgv+92dI+rhpCaLqM0IfpgCgenFvRE= +github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0= +github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg= +github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0= github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k= github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw= -github.com/ProtonMail/gopenpgp/v2 v2.7.1 h1:Awsg7MPc2gD3I7IFac2qE3Gdls0lZW8SzrFZ3k1oz0s= -github.com/ProtonMail/gopenpgp/v2 v2.7.1/go.mod h1:/BU5gfAVwqyd8EfC3Eu7zmuhwYQpKs+cGD8M//iiaxs= +github.com/ProtonMail/gopenpgp/v2 v2.7.3 h1:AJu1OI/1UWVYZl6QcCLKGu9OTngS2r52618uGlje84I= +github.com/ProtonMail/gopenpgp/v2 v2.7.3/go.mod h1:IhkNEDaxec6NyzSI0PlxapinnwPVIESk8/76da3Ct3g= github.com/andybalholm/brotli v1.0.1/go.mod h1:loMXtMfwqflxFJPmdbJO0a3KNoPuLBgiu3qAvBg8x/Y= github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY3JY= github.com/andybalholm/brotli v1.0.4/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig= @@ -53,21 +52,24 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI= github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= +github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= github.com/asaskevich/govalidator v0.0.0-20200907205600-7a23bdc65eef/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ= github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= github.com/aymerick/raymond v2.0.2+incompatible h1:VEp3GpgdAnv9B2GFyTvqgcKvY+mfKMjPOA3SbKLtnU0= github.com/aymerick/raymond v2.0.2+incompatible/go.mod h1:osfaiScAUVup+UC9Nfq76eWqDhXlp+4UYaA8uhTBO6g= -github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLju8= github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= +github.com/benbjohnson/clock v1.3.0 h1:ip6w0uFQkncKQ979AypyG0ER7mqUSBdKLOgAle/AT8A= +github.com/benbjohnson/clock v1.3.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ= github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk= -github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= -github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0= +github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0= +github.com/cbroglie/mustache v1.4.0 h1:Azg0dVhxTml5me+7PsZ7WPrQq1Gkf3WApcHMjMprYoU= +github.com/cbroglie/mustache v1.4.0/go.mod h1:SS1FTIghy0sjse4DUVGV1k/40B1qE1XkD9DtDsHo9iM= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= -github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= +github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44= github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk= @@ -76,22 +78,24 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= -github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I= github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs= github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA= github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk= -github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI= +github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= +github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs= github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= +github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= github.com/creasty/defaults v1.7.0 h1:eNdqZvc5B509z18lD8yc212CAqJNvfT1Jq6L8WowdBA= github.com/creasty/defaults v1.7.0/go.mod h1:iGzKe6pbEHnpMPtfDXZEr0NVxWnPTjb1bbDy08fPzYM= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE= github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5 h1:iFaUwBSo5Svw6L7HYpRu/0lE3e0BaElwnNO1qkNQxBY= github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s= github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY= @@ -99,41 +103,38 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto= github.com/elastic/elastic-integration-corpus-generator-tool v0.5.0 h1:Me2T3/O4nASmdjmfaKYaiJaGq8zVhasjfZi3il5p/gs= github.com/elastic/elastic-integration-corpus-generator-tool v0.5.0/go.mod h1:uf9N86y+UACGybdEhZLpwZ93XHWVhsYZAA4c2T2v6YM= -github.com/elastic/elastic-package v0.83.2 h1:XEJZd6XeV1zds34gsFSZnwz06K8B/6k/NL58hBGnXuM= -github.com/elastic/elastic-package v0.83.2/go.mod h1:gcJ1Gy2P4DY1ww4T4PHhlNIgUwMP+IPlqIbAhcm9ixo= +github.com/elastic/elastic-package v0.87.1 h1:vU8vQ7Lz3qLiEldmrgkhbKvVbeXAzG9wTZZnHzvprBc= +github.com/elastic/elastic-package v0.87.1/go.mod h1:R1tiLc38SNOvF6iVFk4C4S7kZX7s7BwxjDr+xJvqj84= github.com/elastic/go-elasticsearch/v7 v7.17.10 h1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo= github.com/elastic/go-elasticsearch/v7 v7.17.10/go.mod h1:OJ4wdbtDNk5g503kvlHLyErCgQwwzmDtaFC4XyOxXA4= -github.com/elastic/go-licenser v0.4.0/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU= github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN48x4= github.com/elastic/go-licenser v0.4.1/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU= github.com/elastic/go-resource v0.1.1 h1:vM173uhPoaZ7C64rKrYbbBn5kxOhstE1+YcGFteAKh8= github.com/elastic/go-resource v0.1.1/go.mod h1:7F1Wjs6eSFX0i/235yAK/x9bvPNd9/ML92AiULa4XYA= -github.com/elastic/go-sysinfo v1.7.1/go.mod h1:i1ZYdU10oLNfRzq4vq62BEwD2fH8KaWh6eh0ikPT9F0= github.com/elastic/go-sysinfo v1.9.0 h1:usICqY/Nw4Mpn9f4LdtpFrKxXroJDe81GaxxUlCckIo= github.com/elastic/go-sysinfo v1.9.0/go.mod h1:eBD1wEGVaRnRLGecc9iG1z8eOv5HnEdz9+nWd8UAxcE= github.com/elastic/go-ucfg v0.8.6 h1:stUeyh2goTgGX+/wb9gzKvTv0YB0231LTpKUgCKj4U0= github.com/elastic/go-ucfg v0.8.6/go.mod h1:4E8mPOLSUV9hQ7sgLEJ4bvt0KhMuDJa8joDT2QGAEKA= -github.com/elastic/go-windows v1.0.0/go.mod h1:TsU0Nrp7/y3+VwE82FoZF8gC/XFg/Elz6CcloAxnPgU= github.com/elastic/go-windows v1.0.1 h1:AlYZOldA+UJ0/2nBuqWdo90GFCgG9xuyw9SYzGUtJm0= github.com/elastic/go-windows v1.0.1/go.mod h1:FoVvqWSun28vaDQPbj2Elfc0JahhPB7WQEGa3c814Ss= github.com/elastic/gojsonschema v1.2.1 h1:cUMbgsz0wyEB4x7xf3zUEvUVDl6WCz2RKcQPul8OsQc= github.com/elastic/gojsonschema v1.2.1/go.mod h1:biw5eBS2Z4T02wjATMRSfecfjCmwaDPvuaqf844gLrg= -github.com/elastic/package-registry v1.20.0 h1:zBK0EDEeXkIEVj/jKm+/LR7IyGYqu0TjJxD5qyeN0Uc= -github.com/elastic/package-registry v1.20.0/go.mod h1:bfGHXtS6sTMHBOp5DKCMjf6koq1Gm3Mp+ysYS+IX7YU= -github.com/elastic/package-spec/v2 v2.9.0 h1:B9Xxuxg3bWASr8nlYw9Srtyyz6aCANQ9GTgrE9FtNY8= -github.com/elastic/package-spec/v2 v2.9.0/go.mod h1:6OP9m1tMTUNougppizuwKkr67blhGOHBrYwaAwVPaqI= +github.com/elastic/package-registry v1.21.0 h1:yl2LCXVvRrUI5sOuBHKyZr0N1+8hwLCWEynmj91yQJw= +github.com/elastic/package-registry v1.21.0/go.mod h1:KMaIWgFlxMKRd1I8W8NMCLrQLKOvYwDxp1F9KioneU4= +github.com/elastic/package-spec/v2 v2.11.0 h1:lnK9pU1PA8YP22SxB7AVEqC57C4dUOnk85VMGAIYWcY= +github.com/elastic/package-spec/v2 v2.11.0/go.mod h1:kpyMzRsaoFTSzV5C1clD0U/ek0FZ7imALGCYEZU8z24= github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKfrDac4bSQ= github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk= -github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ= +github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0= github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U= github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk= -github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJCLunww= -github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= +github.com/evanphx/json-patch/v5 v5.7.0 h1:nJqP7uwL84RJInrohHfW0Fx3awjbm8qZeFv0nW9SYGc= +github.com/evanphx/json-patch/v5 v5.7.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ= github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4= github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc= github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs= @@ -141,16 +142,16 @@ github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBD github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/felixge/httpsnoop v1.0.3 h1:s/nj+GCswXYzN5v2DpNMuMQYe+0DDwt5WVCU6CWBdXk= github.com/felixge/httpsnoop v1.0.3/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/flowstack/go-jsonschema v0.1.1/go.mod h1:yL7fNggx1o8rm9RlgXv7hTBWxdBM0rVwpMwimd3F3N0= github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= -github.com/fsouza/fake-gcs-server v1.44.2 h1:i0SFjrC3ALr5FmxWdUgeQQ5myXFY+VMCPGVDj25XXXo= -github.com/fsouza/fake-gcs-server v1.44.2/go.mod h1:eKmKIfPvl24wxEWVng4Hsh/+BwUTMhrFtQkNJxLAgSI= +github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps= +github.com/fsouza/fake-gcs-server v1.47.4 h1:gfBhBxEra20/Om02cvcyL8EnekV8KDb01Yffjat6AKQ= +github.com/fsouza/fake-gcs-server v1.47.4/go.mod h1:vqUZbI12uy9IkRQ54Q4p5AniQsSiUq8alO9Nv2egMmA= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA= github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0= -github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= +github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ= +github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY= github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0= github.com/go-openapi/errors v0.20.2/go.mod h1:cM//ZKUKyO06HSwqAelJ5NsEMMcpa6VpXe8DOa1Mi1M= @@ -158,13 +159,14 @@ github.com/go-openapi/errors v0.20.3 h1:rz6kiC84sqNQoqrtulzaL/VERgkoCyB6WdEkc2uj github.com/go-openapi/errors v0.20.3/go.mod h1:Z3FlZ4I8jEGxjUK+bugx3on2mIAk4txuAOhlsB1FSgk= github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE= github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs= -github.com/go-openapi/jsonreference v0.20.1 h1:FBLnyygC4/IZZr893oiomc9XaghoveYTrLC1F86HID8= -github.com/go-openapi/jsonreference v0.20.1/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= +github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE= +github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k= github.com/go-openapi/strfmt v0.21.3 h1:xwhj5X6CjXEZZHMWy1zKJxvW9AfHC9pkyUjLvHtKG7o= github.com/go-openapi/strfmt v0.21.3/go.mod h1:k+RzNO0Da+k3FrrynSNN8F7n/peCmQQqbbXjtDfvmGg= github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g= github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14= -github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI= +github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= @@ -176,7 +178,6 @@ github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= -github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk= github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= @@ -195,8 +196,8 @@ github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM= github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q= github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU= github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4= -github.com/google/gnostic v0.6.9 h1:ZK/5VhkoX835RikCHpSUJV9a+S3e1zLh59YnyWeBW+0= -github.com/google/gnostic v0.6.9/go.mod h1:Nm8234We1lq6iB9OmlgNv3nH91XLLVZHCDayfA3xq+E= +github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I= +github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U= github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= @@ -205,7 +206,6 @@ github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/ github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38= @@ -219,24 +219,26 @@ github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/ github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/martian/v3 v3.3.2 h1:IqNFLAmvJOgVlpdEBiQbDc2EwKW77amAycfTuWKdfvw= +github.com/google/martian/v3 v3.3.2/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk= github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec= +github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg= github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4= +github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc= +github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4= github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ= github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I= -github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.2.3 h1:yk9/cqRKtT9wXZSsRH9aurXEpJX+U6FLtpYTdC3R06k= -github.com/googleapis/enterprise-certificate-proxy v0.2.3/go.mod h1:AwSRAtLfXpU5Nm3pW+v7rGDHp09LsPtGY9MduiEsR9k= -github.com/googleapis/gax-go/v2 v2.8.0 h1:UBtEZqx1bjXtOQ5BVTkuYghXrr3N4V123VKJK67vJZc= -github.com/googleapis/gax-go/v2 v2.8.0/go.mod h1:4orTrqY6hXxxaUL4LHIPl6lGo8vAE38/qKbhSAKP6QI= -github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg= +github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4= +github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM= +github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w= +github.com/googleapis/gax-go/v2 v2.12.0 h1:A+gCJKdRfqXkr+BIRGtZLibNXf0m1f9E4HG56etFpas= +github.com/googleapis/gax-go/v2 v2.12.0/go.mod h1:y+aIqrI5eb1YGMVJfuV3185Ts/D7qKpsEkdD5+I6QGU= github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4= github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q= -github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs= github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI= github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So= github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= @@ -252,8 +254,8 @@ github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxC github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= -github.com/hashicorp/go-retryablehttp v0.7.2 h1:AcYqCvkpalPnPF2pn0KamgwamS42TqUDDYFRKq/RAd0= -github.com/hashicorp/go-retryablehttp v0.7.2/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= +github.com/hashicorp/go-retryablehttp v0.7.4 h1:ZQgVdpTdAL7WpMIwLzCfbalOcSUdkDZnpUv3/+BxzFA= +github.com/hashicorp/go-retryablehttp v0.7.4/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog= github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68= github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= @@ -264,9 +266,6 @@ github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM= github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/jcchavezs/porto v0.1.0/go.mod h1:fESH0gzDHiutHRdX2hv27ojnOVFco37hg1W6E9EZF4A= -github.com/jcchavezs/porto v0.3.0 h1:JSKeMsqexngzHUpiv4NPPADSNBF9bDyavGRDWedzNeM= -github.com/jcchavezs/porto v0.3.0/go.mod h1:fESH0gzDHiutHRdX2hv27ojnOVFco37hg1W6E9EZF4A= github.com/jedib0t/go-pretty v4.3.0+incompatible h1:CGs8AVhEKg/n9YbUenWmNStRW2PHJzaeDodcfvRAbIo= github.com/jedib0t/go-pretty v4.3.0+incompatible/go.mod h1:XemHduiw8R651AF9Pt4FwCTKeG3oo7hrHJAoznj9nag= github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI= @@ -283,15 +282,18 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A= github.com/klauspost/compress v1.11.4/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs= github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= -github.com/klauspost/compress v1.16.0 h1:iULayQNOReoYUe+1qtKOqw9CwJv3aNQu8ivo7lw1HU4= -github.com/klauspost/compress v1.16.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/compress v1.16.7 h1:2mk3MPGNzKyxErAw8YaohYh69+pa4sIQSC0fPGCFR9I= +github.com/klauspost/compress v1.16.7/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE= +github.com/klauspost/cpuid v1.2.0 h1:NMpwD2G9JSFOE1/TJjGSo5zG7Yb2bTe7eq1jH+irmeE= github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= +github.com/klauspost/cpuid/v2 v2.2.5 h1:0E5MSMDEoAulmXNFquVs//DdoomxaoTY1kUhbc/qbZg= +github.com/klauspost/cpuid/v2 v2.2.5/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws= github.com/klauspost/pgzip v1.2.5 h1:qnWYvvKqedOF2ulHpMG72XQol4ILEJ8k2wwRl/Km8oE= github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= -github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -312,8 +314,8 @@ github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxec github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= -github.com/mattn/go-isatty v0.0.17 h1:BTarxUcIeDqL27Mc+vyvdWYSL28zpIhv3RoTdsLMPng= -github.com/mattn/go-isatty v0.0.17/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA= +github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU= github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= @@ -324,6 +326,12 @@ github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQ github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/mholt/archiver/v3 v3.5.1 h1:rDjOBX9JSF5BvoJGvjqK479aL70qh9DIpZCl+k7Clwo= github.com/mholt/archiver/v3 v3.5.1/go.mod h1:e3dqJ7H78uzsRSEACH1joayhuSyhnonssnDhppzS1L4= +github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34= +github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM= +github.com/minio/minio-go/v7 v7.0.61 h1:87c+x8J3jxQ5VUGimV9oHdpjsAvy3fhneEBKuoKEVUI= +github.com/minio/minio-go/v7 v7.0.61/go.mod h1:BTu8FcrEw+HidY0zd/0eny43QnVNkXRPXrLXFuQBHXg= +github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM= +github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8= github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw= github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= @@ -357,9 +365,12 @@ github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4= github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U= github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec= github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6HuIJcUGPhkA7kY= -github.com/onsi/ginkgo/v2 v2.9.1 h1:zie5Ly042PD3bsCvsSOPvRnFwyo3rKe64TJlD6nu0mk= -github.com/onsi/gomega v1.27.4 h1:Z2AnStgsdSayCMDiCU42qIz+HLqEPcgiOCXjAU/w+8E= +github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE= +github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM= +github.com/onsi/gomega v1.27.6 h1:ENqfyGeS5AX/rlXDd/ETokDz93u0YufY1Pgxuy/PvWE= +github.com/onsi/gomega v1.27.6/go.mod h1:PIQNjfQwkP3aQAH7lf7j87O/5FiNr+ZR8+ipb+qQlhg= github.com/otiai10/copy v1.12.0 h1:cLMgSQnXBs1eehF0Wy/FAGsgDTDmAqFR7rQylBb1nDY= +github.com/otiai10/copy v1.12.0/go.mod h1:rSaLseMUsZFFbsFGc7wCJnnkTAvdc5L6VWxPE4308Ww= github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/pierrec/lz4/v4 v4.1.2/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= @@ -375,27 +386,29 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw= github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE= -github.com/prometheus/client_golang v1.15.1 h1:8tXpTmJbyH5lydzFPoxSIJ0J46jdh3tylbvM1xCv0LI= -github.com/prometheus/client_golang v1.15.1/go.mod h1:e9yaBhRPU2pPNsZwE+JdQl0KEt1N9XgF6zxWmaC0xOk= +github.com/prometheus/client_golang v1.16.0 h1:yk/hx9hDbrGHovbci4BY+pRMfSuuat626eFsHb7tmT8= +github.com/prometheus/client_golang v1.16.0/go.mod h1:Zsulrv/L9oM40tJ7T815tM89lFEugiJ9HzIqaAx4LKc= github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= -github.com/prometheus/client_model v0.3.0 h1:UBgGFHqYdG/TPFD1B1ogZywDqEkwp3fBMvqdiQ7Xew4= -github.com/prometheus/client_model v0.3.0/go.mod h1:LDGWKZIo7rky3hgvBe+caln+Dr3dPggB5dvjtD7w9+w= -github.com/prometheus/common v0.42.0 h1:EKsfXEYo4JpWMHH5cg+KOUWeuJSov1Id8zGR8eeI1YM= -github.com/prometheus/common v0.42.0/go.mod h1:xBwqVerjNdUDjgODMpudtOMwlOwf2SaTr1yjz4b7Zbc= -github.com/prometheus/procfs v0.0.0-20190425082905-87a4384529e0/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= -github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= -github.com/prometheus/procfs v0.9.0 h1:wzCHvIvM5SxWqYvwgVL7yJY8Lz3PKn49KQtpgMYJfhI= -github.com/prometheus/procfs v0.9.0/go.mod h1:+pB4zwohETzFnmlpe6yd2lSc+0/46IYZRB/chUwxUZY= +github.com/prometheus/client_model v0.4.0 h1:5lQXD3cAg1OXBf4Wq03gTrXHeaV0TQvGfUooCfx1yqY= +github.com/prometheus/client_model v0.4.0/go.mod h1:oMQmHW1/JoDwqLtg57MGgP/Fb1CJEYF2imWWhWtMkYU= +github.com/prometheus/common v0.44.0 h1:+5BrQJwiBB9xsMygAB3TNvpQKOwlkc25LbISbrdOOfY= +github.com/prometheus/common v0.44.0/go.mod h1:ofAIvZbQ1e/nugmZGz4/qCb9Ap1VoSTIO7x0VV9VvuY= +github.com/prometheus/procfs v0.10.1 h1:kYK1Va/YMlutzCGazswoHKo//tZVlFpKYh+PymziUAg= +github.com/prometheus/procfs v0.10.1/go.mod h1:nwNm2aOCAYw8uTR/9bWRREkZFxAUcWzPHWJq+XBB/FM= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw= github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ= github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ= +github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog= +github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc= +github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ= -github.com/shirou/gopsutil/v3 v3.23.5 h1:5SgDCeQ0KW0S4N0znjeM/eFHXXOKyv2dVNgRq/c9P6Y= -github.com/shirou/gopsutil/v3 v3.23.5/go.mod h1:Ng3Maa27Q2KARVJ0SPZF5NdrQSC3XHKP8IIWrHgMeLY= +github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= +github.com/shirou/gopsutil/v3 v3.23.8 h1:xnATPiybo6GgdRoC4YoGnxXZFRc3dqQTGi73oLvvBrE= +github.com/shirou/gopsutil/v3 v3.23.8/go.mod h1:7hmCaBn+2ZwaZOr6jmPBZDfawwMGuo1id3C6aM8EDqQ= github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM= github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ= github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU= @@ -403,9 +416,8 @@ github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnj github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8= github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o= -github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0= -github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA= +github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= +github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w= github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU= @@ -413,7 +425,6 @@ github.com/spf13/cobra v1.7.0 h1:hyqWnYt1ZQShIddO5kBpj3vu05/++x6tJ6dg8EC572I= github.com/spf13/cobra v1.7.0/go.mod h1:uLxZILRyS/50WlhOIKD7W6V5bgeIt+4sICxh6uRMrb0= github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw= github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c= @@ -427,15 +438,14 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4= github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk= -github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM= -github.com/tklauser/go-sysconf v0.3.11/go.mod h1:GqXfhXY3kiPa0nAXPDIQIWzJbMCB7AmcWpGR8lSZfqI= -github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms= -github.com/tklauser/numcpus v0.6.0/go.mod h1:FEZLMke0lhOUG6w2JadTzp0a+Nl8PF/GFkQ5UVIcaL4= +github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU= +github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI= +github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk= +github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY= github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= github.com/ulikunitz/xz v0.5.9/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= github.com/ulikunitz/xz v0.5.11 h1:kpFauv27b6ynzBNT/Xy+1k+fK4WswhN/6PN5WhFAGw8= @@ -448,28 +458,26 @@ github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMc github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0= github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= -github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8 h1:nIPpBwaJSVYIxUFsDv3M8ofmx9yWTog9BfvIu0q41lo= github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8/go.mod h1:HUYIGzjTL3rfEspMxjDjgmT5uz5wzYJKVo23qUhYTos= -github.com/xlab/treeprint v1.1.0 h1:G/1DjNkPpfZCFt9CSh6b5/nY4VimlbHF3Rh4obvtzDk= -github.com/xlab/treeprint v1.1.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= +github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ= +github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= github.com/yuin/goldmark v1.4.0/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= -github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw= github.com/yusufpapurcu/wmi v1.2.3/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0= -go.elastic.co/apm/module/apmgorilla/v2 v2.4.1 h1:oZV/B5LNJXp9PYVZYZT1+MRxDc7XirUGM2k1Z9JKp/c= -go.elastic.co/apm/module/apmgorilla/v2 v2.4.1/go.mod h1:7UNkg3NsOwG7iPxI1zWAODQnCtu9KL85tEEaymxtr1w= -go.elastic.co/apm/module/apmhttp/v2 v2.4.1 h1:4jIuTNh14opEIwf+zMru1jGW3MuNj6vtI0dsx+6QMt0= -go.elastic.co/apm/module/apmhttp/v2 v2.4.1/go.mod h1:pJ2sd5b4YCX1YX9VzhvFO6AXpqCPiP3dP5U9qBD4s+8= -go.elastic.co/apm/module/apmzap/v2 v2.4.1 h1:vv5ZbrDvBrF0H7D+tuhSQ+NOrqbCH7d+hZNxrP/omRM= -go.elastic.co/apm/module/apmzap/v2 v2.4.1/go.mod h1:OZs/UznopxCb8Ax/P1va0AhReViu+61D84/4W5wj9Oc= -go.elastic.co/apm/v2 v2.4.1 h1:tMxAtHh5TXTYdFG0pTmmUOn/PTI3k/1T1ptb+3O+hYI= -go.elastic.co/apm/v2 v2.4.1/go.mod h1:HdwVuAeoJMmoqAZZBNN2YVzj3UVLebtqoRCCydyCP+Q= +go.elastic.co/apm/module/apmgorilla/v2 v2.4.3 h1:Dpu57OU2Ao9EBlQ7cxszgUCGMz48LfEWDgoY45h46ic= +go.elastic.co/apm/module/apmgorilla/v2 v2.4.3/go.mod h1:lwJCWmbuRSyrsCiQrQ0G4+7F+BjyyIf0MVdceyOvMJM= +go.elastic.co/apm/module/apmhttp/v2 v2.4.3 h1:bBqbbtQSEL+uVpH5CS656E9x6pXha8kkZ468/G0T5Eo= +go.elastic.co/apm/module/apmhttp/v2 v2.4.3/go.mod h1:PsafA29/iwRva1ouV+70Lfu6RyAJHh6Zcc+jL6eZ83E= +go.elastic.co/apm/module/apmzap/v2 v2.4.3 h1:7jsuiJLP5BHQ9tpHRGu9oiiDqYdIBE24WF0P5te8sOk= +go.elastic.co/apm/module/apmzap/v2 v2.4.3/go.mod h1:f9qtIFTU/dCnUqoDeuNrRevCR3fMJe6YMw9SelFjzbY= +go.elastic.co/apm/v2 v2.4.3 h1:k6mj63O7IIyqqn3S52C2vBXvaSK9M5FHp0aZHpPH/as= +go.elastic.co/apm/v2 v2.4.3/go.mod h1:+CiBUdrrAGnGCL9TNx7tQz3BrfYV23L8Ljvotoc87so= go.elastic.co/ecszap v1.0.1 h1:mBxqEJAEXBlpi5+scXdzL7LTFGogbuxipJC0KTZicyA= go.elastic.co/ecszap v1.0.1/go.mod h1:SVjazT+QgNeHSGOCUHvRgN+ZRj5FkB7IXQQsncdF57A= go.elastic.co/fastjson v1.1.0 h1:3MrGBWWVIxe/xvsbpghtkFoPciPhOCmjsR/HfwEeQR4= @@ -480,30 +488,29 @@ go.mongodb.org/mongo-driver v1.11.1/go.mod h1:s7p5vEtfbeR1gYi6pnj3c3/urpbLv2T5Sf go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0= go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo= go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= -go.starlark.net v0.0.0-20221205180719-3fd0dac74452 h1:JZtNuL6LPB+scU5yaQ6hqRlJFRiddZm2FwRt2AQqtHA= -go.starlark.net v0.0.0-20221205180719-3fd0dac74452/go.mod h1:kIVgS18CjmEC3PqMd5kaJSGEifyV/CeB9x506ZJ1Vbk= -go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE= -go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw= +go.starlark.net v0.0.0-20230525235612-a134d8f9ddca h1:VdD38733bfYv5tUZwEIskMM93VanwNIi5bIKnDrJdEY= +go.starlark.net v0.0.0-20230525235612-a134d8f9ddca/go.mod h1:jxU+3+j+71eXOW14274+SmmuW82qJzl6iZSeqEtTGds= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/goleak v1.1.11/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ= go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A= -go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0= +go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4= go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= -go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ= -go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= -go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q= +go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= +go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.uber.org/zap v1.21.0/go.mod h1:wjWOCqI0f2ZZrJF/UufIOkiC8ii6tm1iqIsLo76RfJw= -go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60= -go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg= +go.uber.org/zap v1.25.0 h1:4Hvk6GtkucQ790dqmj7l1eEnRdKm3k3ZUrUMS2d5+5c= +go.uber.org/zap v1.25.0/go.mod h1:JIAUzQIH94IC4fOJQm7gMmBJP5k7wQfdcnYdPoEXJYk= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= +golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4= golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= -golang.org/x/crypto v0.10.0 h1:LKqV2xt9+kDzSTfOhx4FrkEBcMrAgHSYgzywV9zcGmM= -golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= +golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck= +golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= @@ -517,8 +524,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.5.1/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/mod v0.11.0 h1:bUO06HqtnRcc/7l71XBe4WcqTZ+3AH1J59zWDDwLKgU= -golang.org/x/mod v0.11.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc= +golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -534,25 +541,23 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= -golang.org/x/net v0.11.0 h1:Gi2tvZIJyBtO9SDr1q9h5hEQCp/4L2RQ+ar0qjx2oNU= -golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ= +golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8= +golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= -golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw= -golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw= +golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8= +golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -564,52 +569,49 @@ golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5h golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191025021431-6c3a3bfe00ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20211102192858-4dd72447c267/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220209214540-3681064d5158/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s= -golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o= +golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= -golang.org/x/term v0.9.0 h1:GRRCnKYhdQrD8kfRAdQ6Zcw1P0OcELxGLKJvtjVMZ28= -golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo= +golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU= +golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.10.0 h1:UpjohKhiEgNc0CSauXmwYftY1+LlaC75SJwh0SgCX58= -golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= +golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= @@ -624,19 +626,18 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.7/go.mod h1:LGqMHiF4EqQNHR1JncWGqT5BVaXmza+X+BDGol+dOxo= -golang.org/x/tools v0.1.9/go.mod h1:nABZi5QlRsZVlzPpHl034qft6wpY4eDcsTt5AaioBiU= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/tools v0.10.0 h1:tvDr/iQoUqNdohiYm0LmmKcBk+q86lb9EprIUFhHHGg= -golang.org/x/tools v0.10.0/go.mod h1:UJwyiVBsOA2uwvK/e5OY3GTpDUJriEd+/YlqAwLPmyM= +golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ= +golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk= golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8= -google.golang.org/api v0.116.0 h1:09tOPVufPwfm5W4aA8EizGHJ7BcoRDsIareM2a15gO4= -google.golang.org/api v0.116.0/go.mod h1:9cD4/t6uvd9naoEJFA+M96d0IuB6BqFuyhpw68+mRGg= +google.golang.org/api v0.134.0 h1:ktL4Goua+UBgoP1eL1/60LwZJqa1sIzkLmvoR3hR6Gw= +google.golang.org/api v0.134.0/go.mod h1:sjRL3UnjTx5UqNQS9EWr9N8p7xbHpy1k0XGRLCf3Spk= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c= @@ -645,9 +646,12 @@ google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoA google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= -google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc= -google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633 h1:0BOZf6qNozI3pkN3fJLwNubheHJYHhMh91GRFOWWK08= -google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOlWu4KYeJZffbWgBkS1YFobzKbLVfK69pe0Ak= +google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 h1:Au6te5hbKUV8pIYWHqOUZ1pva5qK/rwbIhoXEUB9Lu8= +google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y= +google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 h1:XVeBY8d/FaK4848myy41HBqnDwvxeV3zMZhwN1TvAMU= +google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:mPBs5jNgx2GuQGvFwUvVKqtn6HsUw9nP64BedgvqEsQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771 h1:Z8qdAF9GFsmcUuWQ5KVYIpP3PCKydn/YKORnghIalu4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20230720185612-659f7aaaa771/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= @@ -655,9 +659,9 @@ google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0= google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc= google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU= -google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34= -google.golang.org/grpc v1.54.0 h1:EhTqbhiYeixwWQtAEZAxmV9MGqcjEU2mFx52xCzNyag= -google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g= +google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ= +google.golang.org/grpc v1.57.0 h1:kfzNeI/klCGD2YPMUlaGNT3pxvYfga7smW3Vth8Zsiw= +google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= @@ -669,20 +673,19 @@ google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpAD google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= -google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng= -google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= +google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8= +google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= gopkg.in/hjson/hjson-go.v3 v3.0.1/go.mod h1:X6zrTSVeImfwfZLfgQdInl9mWjqPqgH90jom9nym/lw= gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA= +gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg= -gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= @@ -691,43 +694,41 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -helm.sh/helm/v3 v3.12.1 h1:lzU7etZX24A6BTMXYQF3bFq0ECfD8s+fKlNBBL8AbEc= -helm.sh/helm/v3 v3.12.1/go.mod h1:qhmSY9kcX7yH1xebe+FDMZa7E5NAeZ+LvK5j1gSln48= +helm.sh/helm/v3 v3.12.3 h1:5y1+Sbty12t48T/t/CGNYUIME5BJ0WKfmW/sobYqkFg= +helm.sh/helm/v3 v3.12.3/go.mod h1:KPKQiX9IP5HX7o5YnnhViMnNuKiL/lJBVQ47GHe1R0k= honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= -howett.net/plist v0.0.0-20181124034731-591f970eefbb/go.mod h1:vMygbs4qMhSZSc4lCUl2OEE+rDiIIJAIdR4m7MiMcm0= howett.net/plist v1.0.0 h1:7CrbWYbPPO/PyNy38b2EB/+gYbjCe2DXBxgtOOZbSQM= howett.net/plist v1.0.0/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g= -k8s.io/api v0.27.3 h1:yR6oQXXnUEBWEWcvPWS0jQL575KoAboQPfJAuKNrw5Y= -k8s.io/api v0.27.3/go.mod h1:C4BNvZnQOF7JA/0Xed2S+aUyJSfTGkGFxLXz9MnpIpg= -k8s.io/apiextensions-apiserver v0.27.2 h1:iwhyoeS4xj9Y7v8YExhUwbVuBhMr3Q4bd/laClBV6Bo= -k8s.io/apiextensions-apiserver v0.27.2/go.mod h1:Oz9UdvGguL3ULgRdY9QMUzL2RZImotgxvGjdWRq6ZXQ= -k8s.io/apimachinery v0.27.3 h1:Ubye8oBufD04l9QnNtW05idcOe9Z3GQN8+7PqmuVcUM= -k8s.io/apimachinery v0.27.3/go.mod h1:XNfZ6xklnMCOGGFNqXG7bUrQCoR04dh/E7FprV6pb+E= -k8s.io/cli-runtime v0.27.3 h1:h592I+2eJfXj/4jVYM+tu9Rv8FEc/dyCoD80UJlMW2Y= -k8s.io/cli-runtime v0.27.3/go.mod h1:LzXud3vFFuDFXn2LIrWnscPgUiEj7gQQcYZE2UPn9Kw= -k8s.io/client-go v0.27.3 h1:7dnEGHZEJld3lYwxvLl7WoehK6lAq7GvgjxpA3nv1E8= -k8s.io/client-go v0.27.3/go.mod h1:2MBEKuTo6V1lbKy3z1euEGnhPfGZLKTS9tiJ2xodM48= -k8s.io/component-base v0.27.2 h1:neju+7s/r5O4x4/txeUONNTS9r1HsPbyoPBAtHsDCpo= -k8s.io/component-base v0.27.2/go.mod h1:5UPk7EjfgrfgRIuDBFtsEFAe4DAvP3U+M8RTzoSJkpo= -k8s.io/klog/v2 v2.90.1 h1:m4bYOKall2MmOiRaR1J+We67Do7vm9KiQVlT96lnHUw= -k8s.io/klog/v2 v2.90.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= -k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f h1:2kWPakN3i/k81b0gvD5C5FJ2kxm1WrQFanWchyKuqGg= -k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f/go.mod h1:byini6yhqGC14c3ebc/QwanvYwhuMWF6yz2F8uwW8eg= -k8s.io/kubectl v0.27.2 h1:sSBM2j94MHBFRWfHIWtEXWCicViQzZsb177rNsKBhZg= -k8s.io/kubectl v0.27.2/go.mod h1:GCOODtxPcrjh+EC611MqREkU8RjYBh10ldQCQ6zpFKw= -k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 h1:kmDqav+P+/5e1i9tFfHq1qcF3sOrDp+YEkVDAHu7Jwk= -k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= +k8s.io/api v0.28.2 h1:9mpl5mOb6vXZvqbQmankOfPIGiudghwCoLl1EYfUZbw= +k8s.io/api v0.28.2/go.mod h1:RVnJBsjU8tcMq7C3iaRSGMeaKt2TWEUXcpIt/90fjEg= +k8s.io/apiextensions-apiserver v0.27.3 h1:xAwC1iYabi+TDfpRhxh4Eapl14Hs2OftM2DN5MpgKX4= +k8s.io/apiextensions-apiserver v0.27.3/go.mod h1:BH3wJ5NsB9XE1w+R6SSVpKmYNyIiyIz9xAmBl8Mb+84= +k8s.io/apimachinery v0.28.2 h1:KCOJLrc6gu+wV1BYgwik4AF4vXOlVJPdiqn0yAWWwXQ= +k8s.io/apimachinery v0.28.2/go.mod h1:RdzF87y/ngqk9H4z3EL2Rppv5jj95vGS/HaFXrLDApU= +k8s.io/cli-runtime v0.28.2 h1:64meB2fDj10/ThIMEJLO29a1oujSm0GQmKzh1RtA/uk= +k8s.io/cli-runtime v0.28.2/go.mod h1:bTpGOvpdsPtDKoyfG4EG041WIyFZLV9qq4rPlkyYfDA= +k8s.io/client-go v0.28.2 h1:DNoYI1vGq0slMBN/SWKMZMw0Rq+0EQW6/AK4v9+3VeY= +k8s.io/client-go v0.28.2/go.mod h1:sMkApowspLuc7omj1FOSUxSoqjr+d5Q0Yc0LOFnYFJY= +k8s.io/component-base v0.28.0 h1:HQKy1enJrOeJlTlN4a6dU09wtmXaUvThC0irImfqyxI= +k8s.io/component-base v0.28.0/go.mod h1:Yyf3+ZypLfMydVzuLBqJ5V7Kx6WwDr/5cN+dFjw1FNk= +k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg= +k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0= +k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ= +k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM= +k8s.io/kubectl v0.28.0 h1:qhfju0OaU+JGeBlToPeeIg2UJUWP++QwTkpio6nlPKg= +k8s.io/kubectl v0.28.0/go.mod h1:1We+E5nSX3/TVoSQ6y5Bzld5OhTBHZHlKEYl7g/NaTk= +k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk= +k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo= sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0= -sigs.k8s.io/kustomize/api v0.13.2 h1:kejWfLeJhUsTGioDoFNJET5LQe/ajzXhJGYoU+pJsiA= -sigs.k8s.io/kustomize/api v0.13.2/go.mod h1:DUp325VVMFVcQSq+ZxyDisA8wtldwHxLZbr1g94UHsw= -sigs.k8s.io/kustomize/kyaml v0.14.1 h1:c8iibius7l24G2wVAGZn/Va2wNys03GXLjYVIcFVxKA= -sigs.k8s.io/kustomize/kyaml v0.14.1/go.mod h1:AN1/IpawKilWD7V+YvQwRGUvuUOOWpjsHu6uHwonSF4= +sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 h1:XX3Ajgzov2RKUdc5jW3t5jwY7Bo7dcRm+tFxT+NfgY0= +sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3/go.mod h1:9n16EZKMhXBNSiUC5kSdFQJkdH3zbxS/JoO619G1VAY= +sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 h1:W6cLQc5pnqM7vh3b7HvGNfXrJ/xL6BDMS0v1V/HHg5U= +sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3/go.mod h1:JWP1Fj0VWGHyw3YUPjXSQnRnrwezrZSrApfX5S0nIag= sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE= sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E= sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo= diff --git a/licenses/Elastic-2.0.txt b/licenses/Elastic-2.0.txt new file mode 100644 index 00000000000..809108b857f --- /dev/null +++ b/licenses/Elastic-2.0.txt @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. diff --git a/packages/1password/_dev/build/build.yml b/packages/1password/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/1password/_dev/build/build.yml +++ b/packages/1password/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/1password/changelog.yml b/packages/1password/changelog.yml index 62fbcc6bc6a..44714e6cebf 100644 --- a/packages/1password/changelog.yml +++ b/packages/1password/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.0" + changes: + - description: Add user detail fields to actor, object, and aux_info. + type: enhancement + link: https://github.com/elastic/integrations/pull/6851 +- version: "1.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.16.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.15.0" changes: - description: Convert dashboard to lens. diff --git a/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json b/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json index 1b27c94392e..8fedde28219 100644 --- a/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json +++ b/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json @@ -2,11 +2,11 @@ "events": [ { "@timestamp": "2022-10-24T21:16:62.827288935Z", - "message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}" + "message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"actor_details\":{\"uuid\":\"GLF6WUEKS5CSNDJ2OG6TCZD3M4\", \"name\":\"Test Actor\", \"email\":\"test.actor@domain.com\"},\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}" }, { "@timestamp": "2022-10-24T21:16:62.827288935Z", - "message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}" + "message": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"actor_details\":{\"uuid\":\"GLF6WUEKS5CSNDJ2OG6TCZD3M4\", \"name\":\"Test Actor\", \"email\":\"test.actor@domain.com\"},\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}" } ] } \ No newline at end of file diff --git a/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-expected.json b/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-expected.json index a240ab67eff..d2a9081a454 100644 --- a/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-expected.json +++ b/packages/1password/data_stream/audit_events/_dev/test/pipeline/test-auditevents.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-24T21:16:52.827Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "suspend", @@ -12,12 +12,15 @@ ], "created": "2022-10-24T21:16:62.827288935Z", "kind": "event", - "original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}", + "original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"actor_details\":{\"uuid\":\"GLF6WUEKS5CSNDJ2OG6TCZD3M4\", \"name\":\"Test Actor\", \"email\":\"test.actor@domain.com\"},\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"},\"location\":{\"country\":\"Canada\",\"region\": \"Ontario\",\"city\": \"Toronto\",\"latitude\": 43.64,\"longitude\": -79.433}}", "type": [ "access" ] }, "onepassword": { + "actor_details": { + "uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4" + }, "object_type": "user", "object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", "session": { @@ -61,13 +64,15 @@ "preserve_original_event" ], "user": { - "id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4" + "email": "test.actor@domain.com", + "id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "name": "Test Actor" } }, { "@timestamp": "2022-10-24T21:16:52.827Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "suspend", @@ -76,12 +81,15 @@ ], "created": "2022-10-24T21:16:62.827288935Z", "kind": "event", - "original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}", + "original": "{\"uuid\": \"3UQOGUC7DVOCN4OZP2MDKHFLSG\",\"timestamp\": \"2022-10-24T21:16:52.827288935Z\",\"actor_uuid\": \"GLF6WUEKS5CSNDJ2OG6TCZD3M4\",\"actor_details\":{\"uuid\":\"GLF6WUEKS5CSNDJ2OG6TCZD3M4\", \"name\":\"Test Actor\", \"email\":\"test.actor@domain.com\"},\"action\": \"suspend\",\"object_type\": \"user\",\"object_uuid\":\"ZRQCUD6A65AKHFETOUFO7NL4OM\",\"session\":{\"uuid\": \"ODOHXUYQCJBUJKRGZNNPBJURPE\",\"login_time\": \"2022-10-24T21:07:34.703106271Z\",\"device_uuid\":\"rqtd557fn2husnstp5nc66w2xa\",\"ip\":\"89.160.20.156\"}}", "type": [ "access" ] }, "onepassword": { + "actor_details": { + "uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4" + }, "object_type": "user", "object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", "session": { @@ -125,7 +133,9 @@ "preserve_original_event" ], "user": { - "id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4" + "email": "test.actor@domain.com", + "id": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "name": "Test Actor" } } ] diff --git a/packages/1password/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml b/packages/1password/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml index 1831bb1f72e..160a8c3867c 100644 --- a/packages/1password/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/1password/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml @@ -16,7 +16,7 @@ processors: ####################### - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: field: event.created @@ -76,6 +76,14 @@ processors: field: onepassword.actor_uuid target_field: user.id ignore_missing: true + - rename: + field: onepassword.actor_details.name + target_field: user.name + ignore_missing: true + - rename: + field: onepassword.actor_details.email + target_field: user.email + ignore_missing: true ######################## ## ECS Source Mapping ## diff --git a/packages/1password/data_stream/audit_events/fields/ecs.yml b/packages/1password/data_stream/audit_events/fields/ecs.yml index ccb221d275b..c8cee87db6b 100644 --- a/packages/1password/data_stream/audit_events/fields/ecs.yml +++ b/packages/1password/data_stream/audit_events/fields/ecs.yml @@ -16,6 +16,10 @@ name: event.action - external: ecs name: user.id +- external: ecs + name: user.name +- external: ecs + name: user.email - external: ecs name: source.as.number - external: ecs diff --git a/packages/1password/data_stream/audit_events/fields/fields.yml b/packages/1password/data_stream/audit_events/fields/fields.yml index 32d5fa60501..7ac1319e3c3 100644 --- a/packages/1password/data_stream/audit_events/fields/fields.yml +++ b/packages/1password/data_stream/audit_events/fields/fields.yml @@ -4,18 +4,57 @@ - name: uuid type: keyword description: The UUID of the event. + - name: actor_uuid + type: keyword + description: The UUID of the actor. + - name: actor_details + type: group + fields: + - name: uuid + type: keyword + description: The UUID of the actor. + - name: name + type: keyword + description: The name of the actor. + - name: email + type: keyword + description: The email of the actor. - name: object_type type: keyword description: The type of object changed by the event. - name: object_uuid type: keyword description: The UUID of the object changed by the event. + - name: object_details + type: group + fields: + - name: uuid + type: keyword + description: The UUID of the object. + - name: name + type: keyword + description: The name of the object. + - name: email + type: keyword + description: The email of the object. - name: aux_id type: long description: Any auxilary id related to the event. - name: aux_uuid type: keyword description: Any auxilary uuid related to the event. + - name: aux_details + type: group + fields: + - name: uuid + type: keyword + description: The UUID of the aux resource. + - name: name + type: keyword + description: The name of the aux resource. + - name: email + type: keyword + description: The email of the aux resource. - name: aux_info type: text description: Any auxilary info related to the event. diff --git a/packages/1password/data_stream/audit_events/sample_event.json b/packages/1password/data_stream/audit_events/sample_event.json index 4ed12b45145..550c520344e 100644 --- a/packages/1password/data_stream/audit_events/sample_event.json +++ b/packages/1password/data_stream/audit_events/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-10-24T21:16:52.827Z", "agent": { - "ephemeral_id": "26875e28-ac90-42f2-bcc9-5969510c2882", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.audit_events", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "suspend", @@ -26,9 +26,9 @@ "category": [ "configuration" ], - "created": "2023-05-30T15:57:13.805Z", + "created": "2023-07-06T16:28:01.807Z", "dataset": "1password.audit_events", - "ingested": "2023-05-30T15:57:17Z", + "ingested": "2023-07-06T16:28:02Z", "kind": "event", "type": [ "access" @@ -38,8 +38,19 @@ "type": "httpjson" }, "onepassword": { + "actor_uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "actor_details": { + "uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "name": "Test Actor", + "email": "test.actor@domain.com" + }, "object_type": "user", "object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", + "object_details": { + "uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", + "name": "Test Object", + "email": "test.object@domain.com" + }, "session": { "device_uuid": "rqtd557fn2husnstp5nc66w2xa", "login_time": "2022-10-24T21:07:34.703106271Z", diff --git a/packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json b/packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json index 0e1dc04c455..544fae42768 100644 --- a/packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json +++ b/packages/1password/data_stream/item_usages/_dev/test/pipeline/test-itemusages.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-08-30T18:57:42.484Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reveal", @@ -76,7 +76,7 @@ { "@timestamp": "2021-08-30T19:10:00.123Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml b/packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml index 1d57554f4f7..8b230b89b3c 100644 --- a/packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml +++ b/packages/1password/data_stream/item_usages/elasticsearch/ingest_pipeline/default.yml @@ -16,7 +16,7 @@ processors: ####################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: field: event.created diff --git a/packages/1password/data_stream/item_usages/sample_event.json b/packages/1password/data_stream/item_usages/sample_event.json index 6b1c52bae98..c4e920fcdb2 100644 --- a/packages/1password/data_stream/item_usages/sample_event.json +++ b/packages/1password/data_stream/item_usages/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-08-30T18:57:42.484Z", "agent": { - "ephemeral_id": "cb0f64dc-e67b-4c05-abab-c76b645f5d31", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.item_usages", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "reveal", @@ -26,9 +26,9 @@ "category": [ "file" ], - "created": "2023-05-30T15:57:58.916Z", + "created": "2023-07-06T16:28:36.877Z", "dataset": "1password.item_usages", - "ingested": "2023-05-30T15:57:59Z", + "ingested": "2023-07-06T16:28:37Z", "kind": "event", "type": [ "access" diff --git a/packages/1password/data_stream/signin_attempts/_dev/test/pipeline/test-signinattempts.json-expected.json b/packages/1password/data_stream/signin_attempts/_dev/test/pipeline/test-signinattempts.json-expected.json index 4860ebe51b8..18073acd013 100644 --- a/packages/1password/data_stream/signin_attempts/_dev/test/pipeline/test-signinattempts.json-expected.json +++ b/packages/1password/data_stream/signin_attempts/_dev/test/pipeline/test-signinattempts.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-08-11T14:28:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success", @@ -78,7 +78,7 @@ { "@timestamp": "2021-08-11T15:04:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "credentials_failed", diff --git a/packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml b/packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml index 1f002325800..065ee3bef28 100644 --- a/packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/1password/data_stream/signin_attempts/elasticsearch/ingest_pipeline/default.yml @@ -16,7 +16,7 @@ processors: ####################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: field: event.created diff --git a/packages/1password/data_stream/signin_attempts/sample_event.json b/packages/1password/data_stream/signin_attempts/sample_event.json index b28f772cb35..4a1878f2c0a 100644 --- a/packages/1password/data_stream/signin_attempts/sample_event.json +++ b/packages/1password/data_stream/signin_attempts/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-08-11T14:28:03.000Z", "agent": { - "ephemeral_id": "a8a828b3-bb8a-4339-8bad-78fe5093d055", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.signin_attempts", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "success", @@ -26,9 +26,9 @@ "category": [ "authentication" ], - "created": "2023-05-30T15:58:35.089Z", + "created": "2023-07-06T16:29:08.915Z", "dataset": "1password.signin_attempts", - "ingested": "2023-05-30T15:58:38Z", + "ingested": "2023-07-06T16:29:09Z", "kind": "event", "outcome": "success", "type": [ diff --git a/packages/1password/docs/README.md b/packages/1password/docs/README.md index f36c1c4f47a..5c3e0b77129 100644 --- a/packages/1password/docs/README.md +++ b/packages/1password/docs/README.md @@ -34,9 +34,9 @@ Use the 1Password Events API to retrieve information about sign-in attempts. Eve | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -79,11 +79,11 @@ An example event for `signin_attempts` looks as following: { "@timestamp": "2021-08-11T14:28:03.000Z", "agent": { - "ephemeral_id": "a8a828b3-bb8a-4339-8bad-78fe5093d055", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.signin_attempts", @@ -91,12 +91,12 @@ An example event for `signin_attempts` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "success", @@ -104,9 +104,9 @@ An example event for `signin_attempts` looks as following: "category": [ "authentication" ], - "created": "2023-05-30T15:58:35.089Z", + "created": "2023-07-06T16:29:08.915Z", "dataset": "1password.signin_attempts", - "ingested": "2023-05-30T15:58:38Z", + "ingested": "2023-07-06T16:29:09Z", "kind": "event", "outcome": "success", "type": [ @@ -175,9 +175,9 @@ This uses the 1Password Events API to retrieve information about items in shared | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | input.type | Input type | keyword | @@ -218,11 +218,11 @@ An example event for `item_usages` looks as following: { "@timestamp": "2021-08-30T18:57:42.484Z", "agent": { - "ephemeral_id": "cb0f64dc-e67b-4c05-abab-c76b645f5d31", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.item_usages", @@ -230,12 +230,12 @@ An example event for `item_usages` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "reveal", @@ -243,9 +243,9 @@ An example event for `item_usages` looks as following: "category": [ "file" ], - "created": "2023-05-30T15:57:58.916Z", + "created": "2023-07-06T16:28:36.877Z", "dataset": "1password.item_usages", - "ingested": "2023-05-30T15:57:59Z", + "ingested": "2023-07-06T16:28:37Z", "kind": "event", "type": [ "access" @@ -313,15 +313,25 @@ This uses the 1Password Events API to retrieve information about audit events. E | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | input.type | Input type | keyword | +| onepassword.actor_details.email | The email of the actor. | keyword | +| onepassword.actor_details.name | The name of the actor. | keyword | +| onepassword.actor_details.uuid | The UUID of the actor. | keyword | +| onepassword.actor_uuid | The UUID of the actor. | keyword | +| onepassword.aux_details.email | The email of the aux resource. | keyword | +| onepassword.aux_details.name | The name of the aux resource. | keyword | +| onepassword.aux_details.uuid | The UUID of the aux resource. | keyword | | onepassword.aux_id | Any auxilary id related to the event. | long | | onepassword.aux_info | Any auxilary info related to the event. | text | | onepassword.aux_uuid | Any auxilary uuid related to the event. | keyword | +| onepassword.object_details.email | The email of the object. | keyword | +| onepassword.object_details.name | The name of the object. | keyword | +| onepassword.object_details.uuid | The UUID of the object. | keyword | | onepassword.object_type | The type of object changed by the event. | keyword | | onepassword.object_uuid | The UUID of the object changed by the event. | keyword | | onepassword.session.device_uuid | The device uuid of the session used to create the event. | keyword | @@ -342,7 +352,10 @@ This uses the 1Password Events API to retrieve information about audit events. E | source.geo.region_name | Region name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | tags | List of keywords used to tag each event. | keyword | +| user.email | User email address. | keyword | | user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | An example event for `audit_events` looks as following: @@ -351,11 +364,11 @@ An example event for `audit_events` looks as following: { "@timestamp": "2022-10-24T21:16:52.827Z", "agent": { - "ephemeral_id": "26875e28-ac90-42f2-bcc9-5969510c2882", - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "ephemeral_id": "9bb571f6-a939-462a-8ade-8e81db645f4c", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.7.1" }, "data_stream": { "dataset": "1password.audit_events", @@ -363,12 +376,12 @@ An example event for `audit_events` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "437fe922-4551-429d-a49f-0a4ad40bf297", + "id": "d7b99bc0-ce95-4664-af6f-80d525d96e77", "snapshot": false, - "version": "8.8.0" + "version": "8.7.1" }, "event": { "action": "suspend", @@ -376,9 +389,9 @@ An example event for `audit_events` looks as following: "category": [ "configuration" ], - "created": "2023-05-30T15:57:13.805Z", + "created": "2023-07-06T16:28:01.807Z", "dataset": "1password.audit_events", - "ingested": "2023-05-30T15:57:17Z", + "ingested": "2023-07-06T16:28:02Z", "kind": "event", "type": [ "access" @@ -388,8 +401,19 @@ An example event for `audit_events` looks as following: "type": "httpjson" }, "onepassword": { + "actor_uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "actor_details": { + "uuid": "GLF6WUEKS5CSNDJ2OG6TCZD3M4", + "name": "Test Actor", + "email": "test.actor@domain.com" + }, "object_type": "user", "object_uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", + "object_details": { + "uuid": "ZRQCUD6A65AKHFETOUFO7NL4OM", + "name": "Test Object", + "email": "test.object@domain.com" + }, "session": { "device_uuid": "rqtd557fn2husnstp5nc66w2xa", "login_time": "2022-10-24T21:07:34.703106271Z", diff --git a/packages/1password/kibana/tags.yml b/packages/1password/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/1password/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/1password/manifest.yml b/packages/1password/manifest.yml index 597b1285dcd..497c458d6ff 100644 --- a/packages/1password/manifest.yml +++ b/packages/1password/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: 1password title: "1Password" -version: "1.15.0" +version: "1.19.0" description: Collect logs from 1Password with Elastic Agent. type: integration categories: @@ -57,6 +57,7 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true diff --git a/packages/airflow/changelog.yml b/packages/airflow/changelog.yml index a40f439b551..7025ab3d3de 100644 --- a/packages/airflow/changelog.yml +++ b/packages/airflow/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "0.4.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6776 +- version: "0.3.1" + changes: + - description: Remove metric_type mapping for 'airflow.scheduler.heartbeat' field and adjust the dashboard to visualize this field using 'last_value'. + type: bugfix + link: https://github.com/elastic/integrations/pull/7554 +- version: "0.3.0" + changes: + - description: Revert metrics field definition to the format used before introducing metric_type. + type: enhancement + link: https://github.com/elastic/integrations/pull/7469 - version: "0.2.0" changes: - description: Add metric_type mapping for the fields of `statsd` datastream. diff --git a/packages/airflow/data_stream/statsd/fields/fields.yml b/packages/airflow/data_stream/statsd/fields/fields.yml index ebcb21de8d7..00bfdfe5a24 100644 --- a/packages/airflow/data_stream/statsd/fields/fields.yml +++ b/packages/airflow/data_stream/statsd/fields/fields.yml @@ -2,9 +2,14 @@ type: group fields: - name: '*.count' - type: double + type: object + object_type: double + object_type_mapping_type: "*" metric_type: counter description: Airflow counters + - name: scheduler_heartbeat.count + type: double + description: Airflow scheduler heartbeat - name: '*.max' type: object object_type: double @@ -36,7 +41,9 @@ object_type_mapping_type: "*" description: Airflow standard deviation timers metric - name: '*.value' - type: double + type: object + object_type: double + object_type_mapping_type: "*" metric_type: gauge description: Airflow gauges - name: 'dag_file' diff --git a/packages/airflow/data_stream/statsd/manifest.yml b/packages/airflow/data_stream/statsd/manifest.yml index ae5c2cd427a..23f50d6375d 100644 --- a/packages/airflow/data_stream/statsd/manifest.yml +++ b/packages/airflow/data_stream/statsd/manifest.yml @@ -6,3 +6,5 @@ streams: enabled: true title: Airflow metrics description: Collect Airflow metrics +elasticsearch: + index_mode: "time_series" diff --git a/packages/airflow/docs/README.md b/packages/airflow/docs/README.md index 25fddda4e44..9b8beaebb00 100644 --- a/packages/airflow/docs/README.md +++ b/packages/airflow/docs/README.md @@ -29,19 +29,20 @@ statsd_prefix = |---|---|---|---| | @timestamp | Event timestamp. | date | | | agent.id | | keyword | | -| airflow.\*.count | Airflow counters | double | counter | +| airflow.\*.count | Airflow counters | object | counter | | airflow.\*.max | Airflow max timers metric | object | | | airflow.\*.mean | Airflow mean timers metric | object | | | airflow.\*.mean_rate | Airflow mean rate timers metric | object | | | airflow.\*.median | Airflow median timers metric | object | | | airflow.\*.min | Airflow min timers metric | object | | | airflow.\*.stddev | Airflow standard deviation timers metric | object | | -| airflow.\*.value | Airflow gauges | double | gauge | +| airflow.\*.value | Airflow gauges | object | gauge | | airflow.dag_file | Airflow dag file metadata | keyword | | | airflow.dag_id | Airflow dag id metadata | keyword | | | airflow.job_name | Airflow job name metadata | keyword | | | airflow.operator_name | Airflow operator name metadata | keyword | | | airflow.pool_name | Airflow pool name metadata | keyword | | +| airflow.scheduler_heartbeat.count | Airflow scheduler heartbeat | double | | | airflow.status | Airflow status metadata | keyword | | | airflow.task_id | Airflow task id metadata | keyword | | | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | diff --git a/packages/airflow/kibana/dashboard/airflow-a3aa42d0-a465-11ed-9ff0-ab4dd59e4c75.json b/packages/airflow/kibana/dashboard/airflow-a3aa42d0-a465-11ed-9ff0-ab4dd59e4c75.json index b1ddbc8f1a3..dfb8d882bf5 100644 --- a/packages/airflow/kibana/dashboard/airflow-a3aa42d0-a465-11ed-9ff0-ab4dd59e4c75.json +++ b/packages/airflow/kibana/dashboard/airflow-a3aa42d0-a465-11ed-9ff0-ab4dd59e4c75.json @@ -433,17 +433,21 @@ "048f8624-04ff-4967-8515-011f90aae3ab": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "airflow.scheduler_heartbeat.count: *" + }, "isBucketed": false, "label": "Scheduler Heartbeat", - "operationType": "sum", + "operationType": "last_value", "params": { - "emptyAsNull": true, "format": { "id": "number", "params": { "decimals": 0 } - } + }, + "sortField": "@timestamp" }, "scale": "ratio", "sourceField": "airflow.scheduler_heartbeat.count" @@ -944,16 +948,6 @@ "id": "metrics-*", "name": "1582880b-fb1a-4969-800d-bd594057a5ac:indexpattern-datasource-layer-a12d3d3c-3859-4532-a639-fdb7ba3fd1eb", "type": "index-pattern" - }, - { - "id": "airflow-fleet-managed-default", - "name": "tag-fleet-managed-default", - "type": "tag" - }, - { - "id": "airflow-fleet-pkg-airflow-default", - "name": "tag-fleet-pkg-airflow-default", - "type": "tag" } ], "type": "dashboard" diff --git a/packages/airflow/manifest.yml b/packages/airflow/manifest.yml index fc69c7c3b8d..48136adec8e 100644 --- a/packages/airflow/manifest.yml +++ b/packages/airflow/manifest.yml @@ -1,6 +1,6 @@ name: airflow title: Airflow -version: "0.2.0" +version: "0.4.0" description: Airflow Integration. type: integration format_version: 1.0.0 @@ -8,7 +8,7 @@ license: basic categories: - observability conditions: - kibana.version: "^8.5.0" + kibana.version: "^8.9.0" icons: - src: /img/airflow.svg title: Airflow logo diff --git a/packages/akamai/_dev/build/build.yml b/packages/akamai/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/akamai/_dev/build/build.yml +++ b/packages/akamai/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/akamai/changelog.yml b/packages/akamai/changelog.yml index 59302252a88..7b4a5ab68d3 100644 --- a/packages/akamai/changelog.yml +++ b/packages/akamai/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 2.16.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "2.13.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "2.12.0" + changes: + - description: Add event limit parameter to REST endpoint stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7132 +- version: "2.11.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "2.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json b/packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json index 9a5feb12cde..f07aee92629 100644 --- a/packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json +++ b/packages/akamai/data_stream/siem/_dev/test/pipeline/test-http-json.log-expected.json @@ -107,7 +107,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -272,7 +272,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs b/packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs index 4c04047189e..e1db00567d8 100644 --- a/packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs +++ b/packages/akamai/data_stream/siem/agent/stream/httpjson.yml.hbs @@ -27,6 +27,11 @@ request.transforms: target: url.params.offset value: >- [[ if (index .cursor "last_offset") ]][[ .cursor.last_offset ]][[ end ]] +{{#if event_limit}} + - set: + target: url.params.limit + value: '{{event_limit}}' +{{/if}} - set: target: header.XTimestamp value: '[[ formatDate (now) "20060102T15:04:05-0700" ]]' diff --git a/packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml b/packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml index a46333eb209..80f340d8b90 100644 --- a/packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml +++ b/packages/akamai/data_stream/siem/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Akamai logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/akamai/data_stream/siem/manifest.yml b/packages/akamai/data_stream/siem/manifest.yml index a762ec6b8a5..1de85ac81b0 100644 --- a/packages/akamai/data_stream/siem/manifest.yml +++ b/packages/akamai/data_stream/siem/manifest.yml @@ -46,6 +46,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -56,7 +57,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -65,7 +66,14 @@ streams: required: true show_user: true default: 24h - description: Initial interval to poll for events. Default is 24 hours. + description: Initial interval to poll for events. Default is 24 hours. Supported units for this parameter are h/m/s. + - name: event_limit + type: integer + multi: false + required: false + show_user: false + title: Event Limit + description: Defines the approximate maximum number of security events each fetch returns, in both offset and time-based modes. The default limit is 10000 and the maximum limit available is 600000. Listing an unlimited number of logs isn't possible. Expect requests to return a slightly higher number of security events than you set in the limit parameter, because data is stored in different buckets. - name: proxy_url type: text title: Proxy URL @@ -170,7 +178,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/akamai/data_stream/siem/sample_event.json b/packages/akamai/data_stream/siem/sample_event.json index 645ff12c0eb..605cf79c4d3 100644 --- a/packages/akamai/data_stream/siem/sample_event.json +++ b/packages/akamai/data_stream/siem/sample_event.json @@ -107,7 +107,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/akamai/docs/README.md b/packages/akamai/docs/README.md index f0aa0991374..ae3dab85261 100644 --- a/packages/akamai/docs/README.md +++ b/packages/akamai/docs/README.md @@ -73,14 +73,14 @@ See [Akamai API get started](https://techdocs.akamai.com/siem-integration/refere | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -257,7 +257,7 @@ An example event for `siem` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/akamai/kibana/tags.yml b/packages/akamai/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/akamai/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/akamai/manifest.yml b/packages/akamai/manifest.yml index bb13c97ea23..49ddc804ce2 100644 --- a/packages/akamai/manifest.yml +++ b/packages/akamai/manifest.yml @@ -1,12 +1,13 @@ name: akamai title: Akamai -version: "2.10.0" +version: "2.16.0" description: Collect logs from Akamai with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: [security, cdn_security] conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/akamai_logo.svg title: Akamai @@ -25,3 +26,4 @@ policy_templates: description: "Collecting SIEM logs from Akamai via Google Cloud Storage" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/amazon_security_lake/_dev/build/build.yml b/packages/amazon_security_lake/_dev/build/build.yml new file mode 100644 index 00000000000..0757a6edf35 --- /dev/null +++ b/packages/amazon_security_lake/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.10.0 + import_mappings: true diff --git a/packages/amazon_security_lake/_dev/build/docs/README.md b/packages/amazon_security_lake/_dev/build/docs/README.md new file mode 100644 index 00000000000..c1d2e8795a6 --- /dev/null +++ b/packages/amazon_security_lake/_dev/build/docs/README.md @@ -0,0 +1,109 @@ +# Amazon Security Lake + +This [Amazon Security Lake](https://aws.amazon.com/security-lake/) integration helps you analyze security data, so you can get a more complete understanding of your security posture across the entire organization. With Security Lake, you can also improve the protection of your workloads, applications, and data. + +Security Lake automates the collection of security-related log and event data from integrated AWS services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF). With OCSF support, Security Lake normalizes and combines security data from AWS and a broad range of enterprise security data sources. + +The Amazon Security Lake integration can be used in two different modes to collect data: +- AWS S3 polling mode: Amazon Security Lake writes data to S3, and Elastic Agent polls the S3 bucket by listing its contents and reading new files. +- AWS S3 SQS mode: Amazon Security Lake writes data to S3, S3 sends a notification of a new object to SQS, the Elastic Agent receives the notification from SQS, and then reads the S3 object. Multiple agents can be used in this mode. + +## Compatibility + +This module follows the latest OCSF Schema Version **v1.0.0-rc.3**. + +## Data streams + +The Amazon Security Lake integration collects logs for the below [AWS services](https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html) combined in a data stream named event: + +| Source | Class Name | +|-------------------------------------|-----------------------------------------------------| +| CloudTrail Lambda Data Events | API Activity | +| CloudTrail Management Events | API Activity, Authentication, or Account Change | +| CloudTrail S3 Data Events | API Activity | +| Route 53 | DNS Activity | +| Security Hub | Security Finding | +| VPC Flow Logs | Network Activity | + +### **NOTE**: +- The Amazon Security Lake integration supports events collected from [AWS services](https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html). + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the S3 bucket and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.11.0**. + +## Setup + +### To collect data from an AWS S3 bucket or AWS SQS, follow the below steps: + +1. To enable and start Amazon Security Lake, follow the steps mentioned here: `https://docs.aws.amazon.com/security-lake/latest/userguide/getting-started.html`. +2. Above steps will create AWS S3 bucket and AWS SQS queue. +3. Please follow below steps to create [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html#roles-creatingrole-user-console): + 1. Sign in to the AWS Management Console and open the [IAM console](https://console.aws.amazon.com/iam/). + 2. In the navigation panel, choose Roles and then click on Create role. + 3. Choose **AWS account** role type. + ![Role Type](../img/role_type.png) + 4. To create a role user have two options, + - To create a role for your account, choose **This account**. + ![This Account](../img/this_account.png) + - To create a role for another account, choose **Another AWS account** and enter the Account ID to which you want to grant access to your resources. + ![Another AWS Account](../img/another_aws_account.png) + 5. If you are granting permissions to users from an account that you don't control, and the users will assume this role programmatically, select **Require external ID**. The external ID can be any phrase or number that is agreed upon between you and the administrator of the third party account. Then Click Next. + ![External ID](../img/external_id.png) + 6. Select **AmazonS3FullAccess** and **AmazonSQSFullAccess** from Permissions policies. Then Click Next. + ![AmazonS3FullAccess](../img/s3_full_access.png) + ![AmazonSQSFullAccess](../img/sqs_full_access.png) + 7. For Role name, enter a name for your role. Role name must be unique within your AWS account. + 8. Preview the role and then choose Create role. + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations. +2. In "Search for integrations" search bar, type Amazon Security Lake. +3. Click on the "Amazon Security Lake" integration from the search results. +4. Click on the Add Amazon Security Lake Integration button to add the integration. +5. By default collect logs via S3 Bucket toggle will be off and collect logs for AWS SQS. +6. While adding the integration, if you want to collect logs via AWS SQS, then you have to put the following details: + - queue url + - collect logs via S3 Bucket toggled off + - Shared Credential File Path and Credential Profile Name / Access Key Id and Secret Access Key + + or if you want to collect logs via AWS S3, then you have to put the following details: + - bucket arn + - collect logs via S3 Bucket toggled on + - Shared Credential File Path and Credential Profile Name / Access Key Id and Secret Access Key +7. If user wants to access security lake by Assuming Role then add Role ARN or if user want to access resources of another account using Role ARN then add Role ARN and external ID. + +**NOTE**: There are other input combination options available, please check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html). + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +{{fields "event"}} \ No newline at end of file diff --git a/packages/amazon_security_lake/changelog.yml b/packages/amazon_security_lake/changelog.yml new file mode 100644 index 00000000000..38784b5ade4 --- /dev/null +++ b/packages/amazon_security_lake/changelog.yml @@ -0,0 +1,26 @@ +# newer versions go on top +- version: 0.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.2.1" + changes: + - description: Readme indentation fixing. + type: bugfix + link: https://github.com/elastic/integrations/pull/7838 +- version: "0.2.0" + changes: + - description: Add External ID parameter and Update User guide. + type: enhancement + link: https://github.com/elastic/integrations/pull/7833 +- version: "0.1.0" + changes: + - description: Initial release. + type: enhancement + link: https://github.com/elastic/integrations/pull/7176 diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log new file mode 100644 index 00000000000..baeb516ae1b --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log @@ -0,0 +1 @@ +{"activity_id":1,"activity_name":"Create","actor":{"idp":{},"session":{"created_time":1679071437000,"issuer":"arn:aws:iam::112233445566:role/Admin","mfa":false},"user":{"account":{"uid": "112233445566"},"credential_uid":"ASIA2W7SOKHDHBO4U2HE","type":"AssumedRole","uid":"AROA2W7SOKHDLNCOKZNPS:Admin-user"}},"api":{"operation":"CreateUser","request":{"uid":"c99bf9da-e0bd-4bf7-bb32-c8be25618afc"},"response":{},"service":{"name":"iam.amazonaws.com"}},"category_name":"Audit Activity","category_uid":3,"class_name":"Account Change","class_uid":3001,"cloud":{"provider":"AWS","region":"us-east-1"},"http_request":{"user_agent":"AWS Internal"},"metadata":{"product":{"feature":{"name":"Management"},"name":"CloudTrail","vendor_name":"AWS","version":"1.08"},"profiles":["cloud"],"uid":"7dd15a89-ae0f-4340-8e6c-d6981246c71b","version":"1.0.0-rc.2"},"severity":"Informational","severity_id":1,"src_endpoint":{"ip":"1.128.0.0"},"status":"Success","status_id":1,"time":1679072879000,"type_name":"Account Change: Create","type_uid":300101,"unmapped":{"eventType":"AwsApiCall","managementEvent":"true","readOnly":"false","recipientAccountId":"112233445566","responseElements.user.arn":"arn:aws:iam::112233445566:user/test_user2","responseElements.user.createDate":"Mar 17, 2023 5:07:59 PM","responseElements.user.path":"/","sessionCredentialFromConsole":"true","userIdentity.sessionContext.sessionIssuer.accountId":"112233445566","userIdentity.sessionContext.sessionIssuer.principalId":"AROA2W7SOKHDLNCOKZNPS","userIdentity.sessionContext.sessionIssuer.type":"Role","userIdentity.sessionContext.sessionIssuer.userName":"Admin"},"user":{"name":"test_user2","uid":"AIDA2W7SOKHDM47UMJRTX"}} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log-expected.json new file mode 100644 index 00000000000..f1c4bf9ef6c --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-account-change.log-expected.json @@ -0,0 +1,144 @@ +{ + "expected": [ + { + "@timestamp": "2023-03-17T17:07:59.000Z", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "create", + "category": [ + "iam" + ], + "id": "7dd15a89-ae0f-4340-8e6c-d6981246c71b", + "kind": "event", + "original": "{\"activity_id\":1,\"activity_name\":\"Create\",\"actor\":{\"idp\":{},\"session\":{\"created_time\":1679071437000,\"issuer\":\"arn:aws:iam::112233445566:role/Admin\",\"mfa\":false},\"user\":{\"account\":{\"uid\": \"112233445566\"},\"credential_uid\":\"ASIA2W7SOKHDHBO4U2HE\",\"type\":\"AssumedRole\",\"uid\":\"AROA2W7SOKHDLNCOKZNPS:Admin-user\"}},\"api\":{\"operation\":\"CreateUser\",\"request\":{\"uid\":\"c99bf9da-e0bd-4bf7-bb32-c8be25618afc\"},\"response\":{},\"service\":{\"name\":\"iam.amazonaws.com\"}},\"category_name\":\"Audit Activity\",\"category_uid\":3,\"class_name\":\"Account Change\",\"class_uid\":3001,\"cloud\":{\"provider\":\"AWS\",\"region\":\"us-east-1\"},\"http_request\":{\"user_agent\":\"AWS Internal\"},\"metadata\":{\"product\":{\"feature\":{\"name\":\"Management\"},\"name\":\"CloudTrail\",\"vendor_name\":\"AWS\",\"version\":\"1.08\"},\"profiles\":[\"cloud\"],\"uid\":\"7dd15a89-ae0f-4340-8e6c-d6981246c71b\",\"version\":\"1.0.0-rc.2\"},\"severity\":\"Informational\",\"severity_id\":1,\"src_endpoint\":{\"ip\":\"1.128.0.0\"},\"status\":\"Success\",\"status_id\":1,\"time\":1679072879000,\"type_name\":\"Account Change: Create\",\"type_uid\":300101,\"unmapped\":{\"eventType\":\"AwsApiCall\",\"managementEvent\":\"true\",\"readOnly\":\"false\",\"recipientAccountId\":\"112233445566\",\"responseElements.user.arn\":\"arn:aws:iam::112233445566:user/test_user2\",\"responseElements.user.createDate\":\"Mar 17, 2023 5:07:59 PM\",\"responseElements.user.path\":\"/\",\"sessionCredentialFromConsole\":\"true\",\"userIdentity.sessionContext.sessionIssuer.accountId\":\"112233445566\",\"userIdentity.sessionContext.sessionIssuer.principalId\":\"AROA2W7SOKHDLNCOKZNPS\",\"userIdentity.sessionContext.sessionIssuer.type\":\"Role\",\"userIdentity.sessionContext.sessionIssuer.userName\":\"Admin\"},\"user\":{\"name\":\"test_user2\",\"uid\":\"AIDA2W7SOKHDM47UMJRTX\"}}", + "outcome": "success", + "provider": "AWS", + "severity": 1, + "type": [ + "info", + "user", + "creation" + ] + }, + "ocsf": { + "activity_id": "1", + "activity_name": "Create", + "actor": { + "session": { + "created_time": "2023-03-17T16:43:57.000Z", + "issuer": "arn:aws:iam::112233445566:role/Admin", + "mfa": false + }, + "user": { + "account": { + "uid": "112233445566" + }, + "credential_uid": "ASIA2W7SOKHDHBO4U2HE", + "type": "AssumedRole", + "uid": "AROA2W7SOKHDLNCOKZNPS:Admin-user" + } + }, + "api": { + "operation": "CreateUser", + "request": { + "uid": "c99bf9da-e0bd-4bf7-bb32-c8be25618afc" + }, + "service": { + "name": "iam.amazonaws.com" + } + }, + "category_name": "Audit Activity", + "category_uid": "3", + "class_name": "Account Change", + "class_uid": "3001", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "http_request": { + "user_agent": "AWS Internal" + }, + "metadata": { + "product": { + "feature": { + "name": "Management" + }, + "name": "CloudTrail", + "vendor_name": "AWS", + "version": "1.08" + }, + "profiles": [ + "cloud" + ], + "uid": "7dd15a89-ae0f-4340-8e6c-d6981246c71b", + "version": "1.0.0-rc.2" + }, + "severity": "Informational", + "severity_id": 1, + "src_endpoint": { + "ip": "1.128.0.0" + }, + "status": "Success", + "status_id": "1", + "time": "2023-03-17T17:07:59.000Z", + "type_name": "Account Change: Create", + "type_uid": "300101", + "unmapped": { + "eventType": "AwsApiCall", + "managementEvent": "true", + "readOnly": "false", + "recipientAccountId": "112233445566", + "responseElements.user.arn": "arn:aws:iam::112233445566:user/test_user2", + "responseElements.user.createDate": "Mar 17, 2023 5:07:59 PM", + "responseElements.user.path": "/", + "sessionCredentialFromConsole": "true", + "userIdentity.sessionContext.sessionIssuer.accountId": "112233445566", + "userIdentity.sessionContext.sessionIssuer.principalId": "AROA2W7SOKHDLNCOKZNPS", + "userIdentity.sessionContext.sessionIssuer.type": "Role", + "userIdentity.sessionContext.sessionIssuer.userName": "Admin" + }, + "user": { + "name": "test_user2", + "uid": "AIDA2W7SOKHDM47UMJRTX" + } + }, + "related": { + "ip": [ + "1.128.0.0" + ], + "user": [ + "AROA2W7SOKHDLNCOKZNPS:Admin-user", + "AIDA2W7SOKHDM47UMJRTX", + "test_user2" + ] + }, + "source": { + "ip": "1.128.0.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "id": "AROA2W7SOKHDLNCOKZNPS:Admin-user", + "target": { + "id": "AIDA2W7SOKHDM47UMJRTX", + "name": "test_user2" + } + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "AWS Internal" + } + } + ] +} \ No newline at end of file diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log new file mode 100644 index 00000000000..ef2d7fb6e06 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log @@ -0,0 +1 @@ +{"activity_id":2,"activity_name":"Read","actor":{"idp":{},"session":{},"user":{"account":{"uid": "811596193553"},"credential_uid":"AKIA3Z2XBVUDFQ9TU4MD","name":"Level6","type":"IAMUser","uid":"AIDADO2GQD0K8TEF7KW1V"}},"api":{"operation":"DescribeDirectConnectGateways","request":{"uid":"1c8a6220-4263-4763-b526-20c1d1dd012c"},"response":{},"service":{"name":"directconnect.amazonaws.com"}},"category_name":"Application Activity","category_uid":6,"class_name":"API Activity","class_uid":6003,"cloud":{"provider":"AWS","region":"us-east-1"},"http_request":{"user_agent":"Boto3/1.15.2 Python/3.8.2 Linux/5.6.3-arch1-1 Botocore/1.18.2"},"metadata":{"product":{"feature":{"name":"Management, Data, and Insights"},"name":"CloudTrail","vendor_name":"AWS","version":"1.05"},"profiles":["cloud"],"uid":"71c88be9-ea5c-43c7-8c82-02ecb5ec7f09","version":"1.0.0-rc.2"},"severity":"Informational","severity_id":1,"src_endpoint":{"ip":"1.128.0.0"},"status":"Success","status_id":1,"time":1600726972000,"type_name":"API Activity: Read","type_uid":300502,"unmapped":{"eventType":"AwsApiCall","recipientAccountId":"811596193553"}} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log-expected.json new file mode 100644 index 00000000000..fed7e9f90ad --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-api-activity.log-expected.json @@ -0,0 +1,126 @@ +{ + "expected": [ + { + "@timestamp": "2020-09-21T22:22:52.000Z", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "read", + "category": [ + "web" + ], + "id": "71c88be9-ea5c-43c7-8c82-02ecb5ec7f09", + "kind": "event", + "original": "{\"activity_id\":2,\"activity_name\":\"Read\",\"actor\":{\"idp\":{},\"session\":{},\"user\":{\"account\":{\"uid\": \"811596193553\"},\"credential_uid\":\"AKIA3Z2XBVUDFQ9TU4MD\",\"name\":\"Level6\",\"type\":\"IAMUser\",\"uid\":\"AIDADO2GQD0K8TEF7KW1V\"}},\"api\":{\"operation\":\"DescribeDirectConnectGateways\",\"request\":{\"uid\":\"1c8a6220-4263-4763-b526-20c1d1dd012c\"},\"response\":{},\"service\":{\"name\":\"directconnect.amazonaws.com\"}},\"category_name\":\"Application Activity\",\"category_uid\":6,\"class_name\":\"API Activity\",\"class_uid\":6003,\"cloud\":{\"provider\":\"AWS\",\"region\":\"us-east-1\"},\"http_request\":{\"user_agent\":\"Boto3/1.15.2 Python/3.8.2 Linux/5.6.3-arch1-1 Botocore/1.18.2\"},\"metadata\":{\"product\":{\"feature\":{\"name\":\"Management, Data, and Insights\"},\"name\":\"CloudTrail\",\"vendor_name\":\"AWS\",\"version\":\"1.05\"},\"profiles\":[\"cloud\"],\"uid\":\"71c88be9-ea5c-43c7-8c82-02ecb5ec7f09\",\"version\":\"1.0.0-rc.2\"},\"severity\":\"Informational\",\"severity_id\":1,\"src_endpoint\":{\"ip\":\"1.128.0.0\"},\"status\":\"Success\",\"status_id\":1,\"time\":1600726972000,\"type_name\":\"API Activity: Read\",\"type_uid\":300502,\"unmapped\":{\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"811596193553\"}}", + "outcome": "success", + "provider": "AWS", + "severity": 1, + "type": [ + "info" + ] + }, + "ocsf": { + "activity_id": "2", + "activity_name": "Read", + "actor": { + "user": { + "account": { + "uid": "811596193553" + }, + "credential_uid": "AKIA3Z2XBVUDFQ9TU4MD", + "name": "Level6", + "type": "IAMUser", + "uid": "AIDADO2GQD0K8TEF7KW1V" + } + }, + "api": { + "operation": "DescribeDirectConnectGateways", + "request": { + "uid": "1c8a6220-4263-4763-b526-20c1d1dd012c" + }, + "service": { + "name": "directconnect.amazonaws.com" + } + }, + "category_name": "Application Activity", + "category_uid": "6", + "class_name": "API Activity", + "class_uid": "6003", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "http_request": { + "user_agent": "Boto3/1.15.2 Python/3.8.2 Linux/5.6.3-arch1-1 Botocore/1.18.2" + }, + "metadata": { + "product": { + "feature": { + "name": "Management, Data, and Insights" + }, + "name": "CloudTrail", + "vendor_name": "AWS", + "version": "1.05" + }, + "profiles": [ + "cloud" + ], + "uid": "71c88be9-ea5c-43c7-8c82-02ecb5ec7f09", + "version": "1.0.0-rc.2" + }, + "severity": "Informational", + "severity_id": 1, + "src_endpoint": { + "ip": "1.128.0.0" + }, + "status": "Success", + "status_id": "1", + "time": "2020-09-21T22:22:52.000Z", + "type_name": "API Activity: Read", + "type_uid": "300502", + "unmapped": { + "eventType": "AwsApiCall", + "recipientAccountId": "811596193553" + } + }, + "related": { + "ip": [ + "1.128.0.0" + ], + "user": [ + "AIDADO2GQD0K8TEF7KW1V", + "Level6" + ] + }, + "source": { + "ip": "1.128.0.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "id": "AIDADO2GQD0K8TEF7KW1V", + "name": "Level6" + }, + "user_agent": { + "device": { + "name": "Spider" + }, + "name": "Boto3", + "original": "Boto3/1.15.2 Python/3.8.2 Linux/5.6.3-arch1-1 Botocore/1.18.2", + "os": { + "full": "Linux 5.6.3", + "name": "Linux", + "version": "5.6.3" + }, + "version": "1.15.2" + } + } + ] +} \ No newline at end of file diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log new file mode 100644 index 00000000000..a08b923212c --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log @@ -0,0 +1 @@ +{"activity_id":1,"activity_name":"Logon","actor":{"idp":{},"session":{},"user":{"account":{"uid": "112233445566"},"name":"anaya","type":"IAMUser","uid":"AIDACKCEVSQ6C2EXAMPLE"}},"api":{"operation":"ConsoleLogin","request":{"uid":"''"},"response":{},"service":{"name":"signin.amazonaws.com"}},"category_name":"Audit Activity","category_uid":3,"class_name":"Authentication","class_uid":3002,"cloud":{"provider":"AWS","region":"us-east-1"},"dst_endpoint":{"svc_name":"https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true"},"http_request":{"user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36"},"metadata":{"product":{"feature":{"name":"Management"},"name":"CloudTrail","vendor_name":"AWS","version":"1.08"},"profiles":["cloud"],"uid":"fed06f42-cb12-4764-8c69-121063dc79b9","version":"1.0.0-rc.2"},"severity":"Informational","severity_id":1,"src_endpoint":{"ip":"1.128.0.0"},"status":"Success","status_id":1,"time":1668097474000,"type_name":"Authentication: Logon","type_uid":300201,"unmapped":{"additionalEventData.MFAIdentifier":"arn:aws:iam::111122223333:u2f/user/anaya/default-AAAAAAAABBBBBBBBCCCCCCCCDD","additionalEventData.MobileVersion":"No","eventType":"AwsConsoleSignIn","recipientAccountId":"111122223333"},"user":{"uid":"AIDACKCEVSQ6C2EXAMPLE"}} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log-expected.json new file mode 100644 index 00000000000..269c175cdcc --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-authentication.log-expected.json @@ -0,0 +1,142 @@ +{ + "expected": [ + { + "@timestamp": "2022-11-10T16:24:34.000Z", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "logon", + "category": [ + "authentication" + ], + "id": "fed06f42-cb12-4764-8c69-121063dc79b9", + "kind": "event", + "original": "{\"activity_id\":1,\"activity_name\":\"Logon\",\"actor\":{\"idp\":{},\"session\":{},\"user\":{\"account\":{\"uid\": \"112233445566\"},\"name\":\"anaya\",\"type\":\"IAMUser\",\"uid\":\"AIDACKCEVSQ6C2EXAMPLE\"}},\"api\":{\"operation\":\"ConsoleLogin\",\"request\":{\"uid\":\"''\"},\"response\":{},\"service\":{\"name\":\"signin.amazonaws.com\"}},\"category_name\":\"Audit Activity\",\"category_uid\":3,\"class_name\":\"Authentication\",\"class_uid\":3002,\"cloud\":{\"provider\":\"AWS\",\"region\":\"us-east-1\"},\"dst_endpoint\":{\"svc_name\":\"https://console.aws.amazon.com/console/home?state=hashArgs%23\u0026isauthcode=true\"},\"http_request\":{\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36\"},\"metadata\":{\"product\":{\"feature\":{\"name\":\"Management\"},\"name\":\"CloudTrail\",\"vendor_name\":\"AWS\",\"version\":\"1.08\"},\"profiles\":[\"cloud\"],\"uid\":\"fed06f42-cb12-4764-8c69-121063dc79b9\",\"version\":\"1.0.0-rc.2\"},\"severity\":\"Informational\",\"severity_id\":1,\"src_endpoint\":{\"ip\":\"1.128.0.0\"},\"status\":\"Success\",\"status_id\":1,\"time\":1668097474000,\"type_name\":\"Authentication: Logon\",\"type_uid\":300201,\"unmapped\":{\"additionalEventData.MFAIdentifier\":\"arn:aws:iam::111122223333:u2f/user/anaya/default-AAAAAAAABBBBBBBBCCCCCCCCDD\",\"additionalEventData.MobileVersion\":\"No\",\"eventType\":\"AwsConsoleSignIn\",\"recipientAccountId\":\"111122223333\"},\"user\":{\"uid\":\"AIDACKCEVSQ6C2EXAMPLE\"}}", + "outcome": "success", + "provider": "AWS", + "severity": 1, + "type": [ + "info", + "start" + ] + }, + "network": { + "application": [ + "https://console.aws.amazon.com/console/home?state=hashargs%23\u0026isauthcode=true" + ] + }, + "ocsf": { + "activity_id": "1", + "activity_name": "Logon", + "actor": { + "user": { + "account": { + "uid": "112233445566" + }, + "name": "anaya", + "type": "IAMUser", + "uid": "AIDACKCEVSQ6C2EXAMPLE" + } + }, + "api": { + "operation": "ConsoleLogin", + "request": { + "uid": "''" + }, + "service": { + "name": "signin.amazonaws.com" + } + }, + "category_name": "Audit Activity", + "category_uid": "3", + "class_name": "Authentication", + "class_uid": "3002", + "cloud": { + "provider": "AWS", + "region": "us-east-1" + }, + "dst_endpoint": { + "svc_name": "https://console.aws.amazon.com/console/home?state=hashArgs%23\u0026isauthcode=true" + }, + "http_request": { + "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36" + }, + "metadata": { + "product": { + "feature": { + "name": "Management" + }, + "name": "CloudTrail", + "vendor_name": "AWS", + "version": "1.08" + }, + "profiles": [ + "cloud" + ], + "uid": "fed06f42-cb12-4764-8c69-121063dc79b9", + "version": "1.0.0-rc.2" + }, + "severity": "Informational", + "severity_id": 1, + "src_endpoint": { + "ip": "1.128.0.0" + }, + "status": "Success", + "status_id": "1", + "time": "2022-11-10T16:24:34.000Z", + "type_name": "Authentication: Logon", + "type_uid": "300201", + "unmapped": { + "additionalEventData.MFAIdentifier": "arn:aws:iam::111122223333:u2f/user/anaya/default-AAAAAAAABBBBBBBBCCCCCCCCDD", + "additionalEventData.MobileVersion": "No", + "eventType": "AwsConsoleSignIn", + "recipientAccountId": "111122223333" + }, + "user": { + "uid": "AIDACKCEVSQ6C2EXAMPLE" + } + }, + "related": { + "ip": [ + "1.128.0.0" + ], + "user": [ + "AIDACKCEVSQ6C2EXAMPLE", + "anaya" + ] + }, + "source": { + "ip": "1.128.0.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "id": "AIDACKCEVSQ6C2EXAMPLE", + "name": "anaya", + "target": { + "id": "AIDACKCEVSQ6C2EXAMPLE" + } + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", + "os": { + "full": "Mac OS X 10.11.6", + "name": "Mac OS X", + "version": "10.11.6" + }, + "version": "67.0.3396.99" + } + } + ] +} \ No newline at end of file diff --git a/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-common-config.yml b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-common-config.yml old mode 100755 new mode 100644 similarity index 100% rename from packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-common-config.yml rename to packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-common-config.yml diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log new file mode 100644 index 00000000000..13194e00419 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log @@ -0,0 +1 @@ +{"metadata":{"product":{"version":"1.100000","name":"Route 53","feature":{"name":"Resolver Query Logs"},"vendor_name":"AWS"},"profiles":["cloud","security_control"],"version":"1.0.0-rc.2"},"cloud":{"account":{"uid":"123456789012"},"region":"us-east-1","provider":"AWS"},"src_endpoint":{"vpc_uid":"vpc-00000000000000000","ip":"10.200.21.100","port":15083},"time":1665694956000,"query":{"hostname":"ip-127-0-0-62.alert.firewall.canary.","type":"A","class":"IN"},"answers":[{"type":"A","rdata":"127.0.0.62","class":"IN"}],"connection_info":{"protocol_name":"UDP","direction":"Unknown","direction_id":0},"dst_endpoint":{"instance_uid":"rslvr-in-0000000000000000","interface_uid":"rni-0000000000000000"},"severity_id":1,"severity":"Informational","class_name":"DNS Activity","class_uid":4003,"category_name":"Network Activity","category_uid":4,"disposition":"No Action","disposition_id":16,"rcode_id":0,"rcode":"NoError","activity_id":2,"activity_name":"Response","type_name":"DNS Activity: Response","type_uid":400302,"unmapped":{"firewall_rule_group_id":"rslvr-frg-000000000000000","firewall_domain_list_id":"rslvr-fdl-0000000000000"}} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log-expected.json new file mode 100644 index 00000000000..2b823320eb4 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-dns-activity.log-expected.json @@ -0,0 +1,143 @@ +{ + "expected": [ + { + "@timestamp": "2022-10-13T21:02:36.000Z", + "cloud": { + "account": { + "id": "123456789012" + }, + "provider": "AWS", + "region": "us-east-1" + }, + "dns": { + "answers": { + "class": [ + "IN" + ], + "data": [ + "127.0.0.62" + ], + "type": [ + "A" + ] + }, + "header_flags": [], + "question": { + "class": [ + "IN" + ], + "name": "ip-127-0-0-62.alert.firewall.canary.", + "type": [ + "A" + ] + }, + "response_code": "NoError" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "response", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"metadata\":{\"product\":{\"version\":\"1.100000\",\"name\":\"Route 53\",\"feature\":{\"name\":\"Resolver Query Logs\"},\"vendor_name\":\"AWS\"},\"profiles\":[\"cloud\",\"security_control\"],\"version\":\"1.0.0-rc.2\"},\"cloud\":{\"account\":{\"uid\":\"123456789012\"},\"region\":\"us-east-1\",\"provider\":\"AWS\"},\"src_endpoint\":{\"vpc_uid\":\"vpc-00000000000000000\",\"ip\":\"10.200.21.100\",\"port\":15083},\"time\":1665694956000,\"query\":{\"hostname\":\"ip-127-0-0-62.alert.firewall.canary.\",\"type\":\"A\",\"class\":\"IN\"},\"answers\":[{\"type\":\"A\",\"rdata\":\"127.0.0.62\",\"class\":\"IN\"}],\"connection_info\":{\"protocol_name\":\"UDP\",\"direction\":\"Unknown\",\"direction_id\":0},\"dst_endpoint\":{\"instance_uid\":\"rslvr-in-0000000000000000\",\"interface_uid\":\"rni-0000000000000000\"},\"severity_id\":1,\"severity\":\"Informational\",\"class_name\":\"DNS Activity\",\"class_uid\":4003,\"category_name\":\"Network Activity\",\"category_uid\":4,\"disposition\":\"No Action\",\"disposition_id\":16,\"rcode_id\":0,\"rcode\":\"NoError\",\"activity_id\":2,\"activity_name\":\"Response\",\"type_name\":\"DNS Activity: Response\",\"type_uid\":400302,\"unmapped\":{\"firewall_rule_group_id\":\"rslvr-frg-000000000000000\",\"firewall_domain_list_id\":\"rslvr-fdl-0000000000000\"}}", + "provider": "AWS", + "severity": 1, + "type": [ + "info", + "protocol" + ] + }, + "network": { + "direction": [ + "unknown" + ], + "transport": "udp" + }, + "ocsf": { + "activity_id": "2", + "activity_name": "Response", + "answers": [ + { + "class": "IN", + "rdata": "127.0.0.62", + "type": "A" + } + ], + "category_name": "Network Activity", + "category_uid": "4", + "class_name": "DNS Activity", + "class_uid": "4003", + "cloud": { + "account": { + "uid": "123456789012" + }, + "provider": "AWS", + "region": "us-east-1" + }, + "connection_info": { + "direction": "Unknown", + "direction_id": "0", + "protocol_name": "UDP" + }, + "disposition": "No Action", + "disposition_id": "16", + "dst_endpoint": { + "instance_uid": "rslvr-in-0000000000000000", + "interface_uid": "rni-0000000000000000" + }, + "metadata": { + "product": { + "feature": { + "name": "Resolver Query Logs" + }, + "name": "Route 53", + "vendor_name": "AWS", + "version": "1.100000" + }, + "profiles": [ + "cloud", + "security_control" + ], + "version": "1.0.0-rc.2" + }, + "query": { + "class": "IN", + "hostname": "ip-127-0-0-62.alert.firewall.canary.", + "type": "A" + }, + "rcode": "NoError", + "rcode_id": "0", + "severity": "Informational", + "severity_id": 1, + "src_endpoint": { + "ip": "10.200.21.100", + "port": 15083, + "vpc_uid": "vpc-00000000000000000" + }, + "time": "2022-10-13T21:02:36.000Z", + "type_name": "DNS Activity: Response", + "type_uid": "400302", + "unmapped": { + "firewall_domain_list_id": "rslvr-fdl-0000000000000", + "firewall_rule_group_id": "rslvr-frg-000000000000000" + } + }, + "related": { + "ip": [ + "10.200.21.100" + ] + }, + "source": { + "ip": "10.200.21.100", + "port": 15083 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + } + ] +} \ No newline at end of file diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log new file mode 100644 index 00000000000..91748f35854 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log @@ -0,0 +1 @@ +{"metadata":{"product":{"version":"5","name":"Amazon VPC","feature":{"name":"Flowlogs"},"vendor_name":"AWS"},"profiles":["cloud","security_control"],"version":"1.0.0-rc.2"},"cloud":{"account":{"uid":"123456789012"},"region":"us-east-1","zone":"use1-az1","provider":"AWS"},"src_endpoint":{"port":56858,"svc_name":"-","ip":"1.128.0.0"},"dst_endpoint":{"port":39938,"svc_name":"-","ip":"172.31.2.52","interface_uid":"eni-000000000000000000","vpc_uid":"vpc-00000000","instance_uid":"i-000000000000000000","subnet_uid":"subnet-000000000000000000"},"connection_info":{"protocol_num":6,"tcp_flags":2,"protocol_ver":"IPv4","boundary_id":99,"boundary":"-","direction_id":1,"direction":"Inbound"},"traffic":{"packets":1,"bytes":40},"time":1649721732000,"start_time":1649721732000,"end_time":1649721788000,"status_code":"OK","severity_id":1,"severity":"Informational","class_name":"Network Activity","class_uid":4001,"category_name":"Network Activity","category_uid":4,"activity_name":"Refuse","activity_id":5,"disposition":"Blocked","disposition_id":2,"type_uid":400105,"type_name":"Network Activity: Refuse","unmapped":{"sublocation_id":"-","sublocation_type":"-"}} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log-expected.json new file mode 100644 index 00000000000..25baa70c153 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-network-activity.log-expected.json @@ -0,0 +1,136 @@ +{ + "expected": [ + { + "@timestamp": "2022-04-12T00:02:12.000Z", + "cloud": { + "account": { + "id": "123456789012" + }, + "availability_zone": "use1-az1", + "provider": "AWS", + "region": "us-east-1" + }, + "destination": { + "ip": "172.31.2.52", + "port": 39938 + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "refuse", + "category": [ + "network" + ], + "end": "2022-04-12T00:03:08.000Z", + "kind": "event", + "original": "{\"metadata\":{\"product\":{\"version\":\"5\",\"name\":\"Amazon VPC\",\"feature\":{\"name\":\"Flowlogs\"},\"vendor_name\":\"AWS\"},\"profiles\":[\"cloud\",\"security_control\"],\"version\":\"1.0.0-rc.2\"},\"cloud\":{\"account\":{\"uid\":\"123456789012\"},\"region\":\"us-east-1\",\"zone\":\"use1-az1\",\"provider\":\"AWS\"},\"src_endpoint\":{\"port\":56858,\"svc_name\":\"-\",\"ip\":\"1.128.0.0\"},\"dst_endpoint\":{\"port\":39938,\"svc_name\":\"-\",\"ip\":\"172.31.2.52\",\"interface_uid\":\"eni-000000000000000000\",\"vpc_uid\":\"vpc-00000000\",\"instance_uid\":\"i-000000000000000000\",\"subnet_uid\":\"subnet-000000000000000000\"},\"connection_info\":{\"protocol_num\":6,\"tcp_flags\":2,\"protocol_ver\":\"IPv4\",\"boundary_id\":99,\"boundary\":\"-\",\"direction_id\":1,\"direction\":\"Inbound\"},\"traffic\":{\"packets\":1,\"bytes\":40},\"time\":1649721732000,\"start_time\":1649721732000,\"end_time\":1649721788000,\"status_code\":\"OK\",\"severity_id\":1,\"severity\":\"Informational\",\"class_name\":\"Network Activity\",\"class_uid\":4001,\"category_name\":\"Network Activity\",\"category_uid\":4,\"activity_name\":\"Refuse\",\"activity_id\":5,\"disposition\":\"Blocked\",\"disposition_id\":2,\"type_uid\":400105,\"type_name\":\"Network Activity: Refuse\",\"unmapped\":{\"sublocation_id\":\"-\",\"sublocation_type\":\"-\"}}", + "provider": "AWS", + "severity": 1, + "start": "2022-04-12T00:02:12.000Z", + "type": [ + "info", + "denied" + ] + }, + "network": { + "application": [ + "-" + ], + "bytes": 40, + "direction": [ + "inbound" + ], + "iana_number": "6", + "packets": 1, + "type": "ipv4" + }, + "ocsf": { + "activity_id": "5", + "activity_name": "Refuse", + "category_name": "Network Activity", + "category_uid": "4", + "class_name": "Network Activity", + "class_uid": "4001", + "cloud": { + "account": { + "uid": "123456789012" + }, + "provider": "AWS", + "region": "us-east-1", + "zone": "use1-az1" + }, + "connection_info": { + "boundary": "-", + "boundary_id": "99", + "direction": "Inbound", + "direction_id": "1", + "protocol_num": "6", + "protocol_ver": "IPv4", + "tcp_flags": 2 + }, + "disposition": "Blocked", + "disposition_id": "2", + "dst_endpoint": { + "instance_uid": "i-000000000000000000", + "interface_uid": "eni-000000000000000000", + "ip": "172.31.2.52", + "port": 39938, + "subnet_uid": "subnet-000000000000000000", + "svc_name": "-", + "vpc_uid": "vpc-00000000" + }, + "end_time": "2022-04-12T00:03:08.000Z", + "metadata": { + "product": { + "feature": { + "name": "Flowlogs" + }, + "name": "Amazon VPC", + "vendor_name": "AWS", + "version": "5" + }, + "profiles": [ + "cloud", + "security_control" + ], + "version": "1.0.0-rc.2" + }, + "severity": "Informational", + "severity_id": 1, + "src_endpoint": { + "ip": "1.128.0.0", + "port": 56858, + "svc_name": "-" + }, + "start_time": "2022-04-12T00:02:12.000Z", + "status_code": "OK", + "time": "2022-04-12T00:02:12.000Z", + "traffic": { + "bytes": 40, + "packets": 1 + }, + "type_name": "Network Activity: Refuse", + "type_uid": "400105", + "unmapped": { + "sublocation_id": "-", + "sublocation_type": "-" + } + }, + "related": { + "ip": [ + "1.128.0.0", + "172.31.2.52" + ] + }, + "source": { + "ip": "1.128.0.0", + "port": 56858 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + } + ] +} \ No newline at end of file diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log new file mode 100644 index 00000000000..f9f5b6041db --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log @@ -0,0 +1 @@ +{"activity_id":2,"activity_name":"Update","category_name":"Findings","category_uid":2,"class_name":"Security Finding","class_uid":2001,"cloud":{"account":{"uid": "522536594833"},"provider":"AWS","region":"us-east-1"},"compliance":{"requirements":["PCI1.2"],"status":"PASSED","status_detail":"CloudWatch alarms do not exist in the account"},"finding":{"created_time":1635449619417,"desc":"This control checks whether unrestricted incoming traffic for the security groups is accessible to the specified ports [3389, 20, 23, 110, 143, 3306, 8080, 1433, 9200, 9300, 25, 445, 135, 21, 1434, 4333, 5432, 5500, 5601, 22, 3000, 5000, 8088, 8888] that have the highest risk. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 for the listed ports.","first_seen_time":1635449619417,"last_seen_time":1659636565316,"modified_time":1659636559100,"related_events":[{"product_uid":"arn:aws:securityhub:us-west-2::product/aws/guardduty","uid":"123e4567-e89b-12d3-a456-426655440000"},{"product_uid":"arn:aws:securityhub:us-west-2::product/aws/guardduty","uid":"AcmeNerfHerder-111111111111-x189dx7824"}],"remediation":{"desc":"For directions on how to fix this issue, consult the AWS Security Hub Foundational Security Best Practices documentation.","kb_articles":["https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation"]},"title":"EC2.19 Security groups should not allow unrestricted access to ports with high risk","types":["Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"],"uid":"test"},"malware":[{"classification_ids":[1],"classifications":["Adware"],"name":"Stringler","path":"/usr/sbin/stringler"}],"metadata":{"product":{"feature":{"name":"Security Hub","uid":"aws-foundational-security-best-practices/v/1.0.0/EC2.19"},"name":"Security Hub","uid":"arn:aws:securityhub:us-east-1::product/aws/securityhub","vendor_name":"AWS","version":"2018-10-08"},"profiles":["cloud"],"version":"1.0.0-rc.2"},"process":{"created_time":1538087851000,"file":{"name":"''","path":"/usr/sbin/syslogd","type_id":0},"name":"syslogd","parent_process":{"pid":56789},"pid":12345,"terminated_time":1538091451000},"resources":[{"cloud_partition":"aws","details":"{\"AwsEc2SecurityGroup\":{\"GroupName\":\"eks-cluster-sg-detective-test-486840310\",\"GroupId\":\"sg-0daf160f08dfed499\",\"OwnerId\":\"522536594833\",\"VpcId\":\"vpc-0ccabdde7ace9327a\",\"IpPermissions\":[{\"IpProtocol\":\"-1\",\"UserIdGroupPairs\":[{\"GroupId\":\"sg-0daf160f08dfed499\",\"UserId\":\"522536594833\"},{\"GroupId\":\"sg-0e92935097ad2f657\",\"UserId\":\"522536594833\"}]}],\"IpPermissionsEgress\":[{\"IpProtocol\":\"-1\",\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]}}","labels":["billingCode=Lotus-1-2-3","needsPatching=true"],"region":"us-east-1","type":"AwsEc2SecurityGroup","uid":"arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499"}],"severity":"Informational","severity_id":1,"state":"Resolved","state_id":4,"time":1659636559100,"type_name":"Security Finding: Update","type_uid":200102,"unmapped":{"CompanyName":"AWS","Compliance.StatusReasons[].ReasonCode":"CW_ALARMS_NOT_PRESENT","FindingProviderFields.Severity.Label":"INFORMATIONAL","FindingProviderFields.Severity.Original":"INFORMATIONAL","FindingProviderFields.Types[]":"Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices","Malware[].State":"OBSERVED","ProductFields.ControlId":"EC2.19","ProductFields.RecommendationUrl":"https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation","ProductFields.RelatedAWSResources:0/name":"securityhub-vpc-sg-restricted-common-ports-2af29baf","ProductFields.RelatedAWSResources:0/type":"AWS::Config::ConfigRule","ProductFields.Resources:0/Id":"arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499","ProductFields.StandardsArn":"arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0","ProductFields.StandardsControlArn":"arn:aws:securityhub:us-east-1:522536594833:control/aws-foundational-security-best-practices/v/1.0.0/EC2.19","ProductFields.StandardsSubscriptionArn":"arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0","ProductFields.aws/securityhub/CompanyName":"AWS","ProductFields.aws/securityhub/FindingId":"arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.19/finding/bf428107-eee0-4d19-a013-92748ed69eef","ProductFields.aws/securityhub/ProductName":"Security Hub","RecordState":"ACTIVE","Severity.Normalized":"0","Severity.Original":"INFORMATIONAL","Severity.Product":"0","Vulnerabilities[].Cvss[].BaseScore":"4.7,1.0","Vulnerabilities[].Cvss[].BaseVector":"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,AV:L/AC:M/Au:N/C:C/I:N/A:N","Vulnerabilities[].Cvss[].Version":"V3,V2","Vulnerabilities[].Vendor.VendorSeverity":"Medium","WorkflowState":"NEW"},"vulnerabilities":[{"cve":{"created_time":1579132903000,"cvss":{"base_score":4.7,"vector_string":"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"V3"},"modified_time":1579132903000,"uid":"CVE-2020-12345"},"kb_articles":["https://alas.aws.amazon.com/ALAS-2020-1337.html"],"packages":[{"architecture":"x86_64","epoch":1,"name":"openssl","release":"16.amzn2.0.3","version":"1.0.2k"},{"architecture":"x86_64","epoch":3,"name":"yaml","release":"16.amzn2.0.3","version":"4.3.2"}],"references":["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418"],"related_vulnerabilities":["CVE-2020-12345"],"vendor_name":"Alas"}]} diff --git a/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log-expected.json b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log-expected.json new file mode 100644 index 00000000000..1c57891c400 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/_dev/test/pipeline/test-security-findings.log-expected.json @@ -0,0 +1,250 @@ +{ + "expected": [ + { + "@timestamp": "2022-08-04T18:09:19.100Z", + "cloud": { + "account": { + "id": "522536594833" + }, + "provider": "AWS", + "region": "us-east-1" + }, + "ecs": { + "version": "8.10.0" + }, + "event": { + "action": "update", + "category": [ + "malware", + "vulnerability" + ], + "created": "2021-10-28T19:33:39.417Z", + "kind": "alert", + "original": "{\"activity_id\":2,\"activity_name\":\"Update\",\"category_name\":\"Findings\",\"category_uid\":2,\"class_name\":\"Security Finding\",\"class_uid\":2001,\"cloud\":{\"account\":{\"uid\": \"522536594833\"},\"provider\":\"AWS\",\"region\":\"us-east-1\"},\"compliance\":{\"requirements\":[\"PCI1.2\"],\"status\":\"PASSED\",\"status_detail\":\"CloudWatch alarms do not exist in the account\"},\"finding\":{\"created_time\":1635449619417,\"desc\":\"This control checks whether unrestricted incoming traffic for the security groups is accessible to the specified ports [3389, 20, 23, 110, 143, 3306, 8080, 1433, 9200, 9300, 25, 445, 135, 21, 1434, 4333, 5432, 5500, 5601, 22, 3000, 5000, 8088, 8888] that have the highest risk. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 for the listed ports.\",\"first_seen_time\":1635449619417,\"last_seen_time\":1659636565316,\"modified_time\":1659636559100,\"related_events\":[{\"product_uid\":\"arn:aws:securityhub:us-west-2::product/aws/guardduty\",\"uid\":\"123e4567-e89b-12d3-a456-426655440000\"},{\"product_uid\":\"arn:aws:securityhub:us-west-2::product/aws/guardduty\",\"uid\":\"AcmeNerfHerder-111111111111-x189dx7824\"}],\"remediation\":{\"desc\":\"For directions on how to fix this issue, consult the AWS Security Hub Foundational Security Best Practices documentation.\",\"kb_articles\":[\"https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation\"]},\"title\":\"EC2.19 Security groups should not allow unrestricted access to ports with high risk\",\"types\":[\"Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices\"],\"uid\":\"test\"},\"malware\":[{\"classification_ids\":[1],\"classifications\":[\"Adware\"],\"name\":\"Stringler\",\"path\":\"/usr/sbin/stringler\"}],\"metadata\":{\"product\":{\"feature\":{\"name\":\"Security Hub\",\"uid\":\"aws-foundational-security-best-practices/v/1.0.0/EC2.19\"},\"name\":\"Security Hub\",\"uid\":\"arn:aws:securityhub:us-east-1::product/aws/securityhub\",\"vendor_name\":\"AWS\",\"version\":\"2018-10-08\"},\"profiles\":[\"cloud\"],\"version\":\"1.0.0-rc.2\"},\"process\":{\"created_time\":1538087851000,\"file\":{\"name\":\"''\",\"path\":\"/usr/sbin/syslogd\",\"type_id\":0},\"name\":\"syslogd\",\"parent_process\":{\"pid\":56789},\"pid\":12345,\"terminated_time\":1538091451000},\"resources\":[{\"cloud_partition\":\"aws\",\"details\":\"{\\\"AwsEc2SecurityGroup\\\":{\\\"GroupName\\\":\\\"eks-cluster-sg-detective-test-486840310\\\",\\\"GroupId\\\":\\\"sg-0daf160f08dfed499\\\",\\\"OwnerId\\\":\\\"522536594833\\\",\\\"VpcId\\\":\\\"vpc-0ccabdde7ace9327a\\\",\\\"IpPermissions\\\":[{\\\"IpProtocol\\\":\\\"-1\\\",\\\"UserIdGroupPairs\\\":[{\\\"GroupId\\\":\\\"sg-0daf160f08dfed499\\\",\\\"UserId\\\":\\\"522536594833\\\"},{\\\"GroupId\\\":\\\"sg-0e92935097ad2f657\\\",\\\"UserId\\\":\\\"522536594833\\\"}]}],\\\"IpPermissionsEgress\\\":[{\\\"IpProtocol\\\":\\\"-1\\\",\\\"IpRanges\\\":[{\\\"CidrIp\\\":\\\"0.0.0.0/0\\\"}]}]}}\",\"labels\":[\"billingCode=Lotus-1-2-3\",\"needsPatching=true\"],\"region\":\"us-east-1\",\"type\":\"AwsEc2SecurityGroup\",\"uid\":\"arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499\"}],\"severity\":\"Informational\",\"severity_id\":1,\"state\":\"Resolved\",\"state_id\":4,\"time\":1659636559100,\"type_name\":\"Security Finding: Update\",\"type_uid\":200102,\"unmapped\":{\"CompanyName\":\"AWS\",\"Compliance.StatusReasons[].ReasonCode\":\"CW_ALARMS_NOT_PRESENT\",\"FindingProviderFields.Severity.Label\":\"INFORMATIONAL\",\"FindingProviderFields.Severity.Original\":\"INFORMATIONAL\",\"FindingProviderFields.Types[]\":\"Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices\",\"Malware[].State\":\"OBSERVED\",\"ProductFields.ControlId\":\"EC2.19\",\"ProductFields.RecommendationUrl\":\"https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation\",\"ProductFields.RelatedAWSResources:0/name\":\"securityhub-vpc-sg-restricted-common-ports-2af29baf\",\"ProductFields.RelatedAWSResources:0/type\":\"AWS::Config::ConfigRule\",\"ProductFields.Resources:0/Id\":\"arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499\",\"ProductFields.StandardsArn\":\"arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0\",\"ProductFields.StandardsControlArn\":\"arn:aws:securityhub:us-east-1:522536594833:control/aws-foundational-security-best-practices/v/1.0.0/EC2.19\",\"ProductFields.StandardsSubscriptionArn\":\"arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0\",\"ProductFields.aws/securityhub/CompanyName\":\"AWS\",\"ProductFields.aws/securityhub/FindingId\":\"arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.19/finding/bf428107-eee0-4d19-a013-92748ed69eef\",\"ProductFields.aws/securityhub/ProductName\":\"Security Hub\",\"RecordState\":\"ACTIVE\",\"Severity.Normalized\":\"0\",\"Severity.Original\":\"INFORMATIONAL\",\"Severity.Product\":\"0\",\"Vulnerabilities[].Cvss[].BaseScore\":\"4.7,1.0\",\"Vulnerabilities[].Cvss[].BaseVector\":\"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,AV:L/AC:M/Au:N/C:C/I:N/A:N\",\"Vulnerabilities[].Cvss[].Version\":\"V3,V2\",\"Vulnerabilities[].Vendor.VendorSeverity\":\"Medium\",\"WorkflowState\":\"NEW\"},\"vulnerabilities\":[{\"cve\":{\"created_time\":1579132903000,\"cvss\":{\"base_score\":4.7,\"vector_string\":\"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"version\":\"V3\"},\"modified_time\":1579132903000,\"uid\":\"CVE-2020-12345\"},\"kb_articles\":[\"https://alas.aws.amazon.com/ALAS-2020-1337.html\"],\"packages\":[{\"architecture\":\"x86_64\",\"epoch\":1,\"name\":\"openssl\",\"release\":\"16.amzn2.0.3\",\"version\":\"1.0.2k\"},{\"architecture\":\"x86_64\",\"epoch\":3,\"name\":\"yaml\",\"release\":\"16.amzn2.0.3\",\"version\":\"4.3.2\"}],\"references\":[\"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418\"],\"related_vulnerabilities\":[\"CVE-2020-12345\"],\"vendor_name\":\"Alas\"}]}", + "provider": "AWS", + "severity": 1, + "type": [ + "info" + ] + }, + "file": { + "name": "''", + "path": "/usr/sbin/syslogd" + }, + "ocsf": { + "activity_id": "2", + "activity_name": "Update", + "category_name": "Findings", + "category_uid": "2", + "class_name": "Security Finding", + "class_uid": "2001", + "cloud": { + "account": { + "uid": "522536594833" + }, + "provider": "AWS", + "region": "us-east-1" + }, + "compliance": { + "requirements": [ + "PCI1.2" + ], + "status": "PASSED", + "status_detail": "CloudWatch alarms do not exist in the account" + }, + "finding": { + "created_time": "2021-10-28T19:33:39.417Z", + "desc": "This control checks whether unrestricted incoming traffic for the security groups is accessible to the specified ports [3389, 20, 23, 110, 143, 3306, 8080, 1433, 9200, 9300, 25, 445, 135, 21, 1434, 4333, 5432, 5500, 5601, 22, 3000, 5000, 8088, 8888] that have the highest risk. This control passes when none of the rules in a security group allow ingress traffic from 0.0.0.0/0 for the listed ports.", + "first_seen_time": "2021-10-28T19:33:39.417Z", + "last_seen_time": "2022-08-04T18:09:25.316Z", + "modified_time": "2022-08-04T18:09:19.100Z", + "related_events": [ + { + "product_uid": "arn:aws:securityhub:us-west-2::product/aws/guardduty", + "uid": "123e4567-e89b-12d3-a456-426655440000" + }, + { + "product_uid": "arn:aws:securityhub:us-west-2::product/aws/guardduty", + "uid": "AcmeNerfHerder-111111111111-x189dx7824" + } + ], + "remediation": { + "desc": "For directions on how to fix this issue, consult the AWS Security Hub Foundational Security Best Practices documentation.", + "kb_articles": [ + "https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation" + ] + }, + "title": "EC2.19 Security groups should not allow unrestricted access to ports with high risk", + "types": [ + "Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices" + ], + "uid": "test" + }, + "malware": [ + { + "classification_ids": [ + "1" + ], + "classifications": [ + "Adware" + ], + "name": "Stringler", + "path": "/usr/sbin/stringler" + } + ], + "metadata": { + "product": { + "feature": { + "name": "Security Hub", + "uid": "aws-foundational-security-best-practices/v/1.0.0/EC2.19" + }, + "name": "Security Hub", + "uid": "arn:aws:securityhub:us-east-1::product/aws/securityhub", + "vendor_name": "AWS", + "version": "2018-10-08" + }, + "profiles": [ + "cloud" + ], + "version": "1.0.0-rc.2" + }, + "process": { + "created_time": "2018-09-27T22:37:31.000Z", + "file": { + "name": "''", + "path": "/usr/sbin/syslogd", + "type_id": "0" + }, + "name": "syslogd", + "parent_process": { + "pid": 56789 + }, + "pid": 12345, + "terminated_time": "2018-09-27T23:37:31.000Z" + }, + "resources": [ + { + "cloud_partition": "aws", + "details": "{\"AwsEc2SecurityGroup\":{\"GroupName\":\"eks-cluster-sg-detective-test-486840310\",\"GroupId\":\"sg-0daf160f08dfed499\",\"OwnerId\":\"522536594833\",\"VpcId\":\"vpc-0ccabdde7ace9327a\",\"IpPermissions\":[{\"IpProtocol\":\"-1\",\"UserIdGroupPairs\":[{\"GroupId\":\"sg-0daf160f08dfed499\",\"UserId\":\"522536594833\"},{\"GroupId\":\"sg-0e92935097ad2f657\",\"UserId\":\"522536594833\"}]}],\"IpPermissionsEgress\":[{\"IpProtocol\":\"-1\",\"IpRanges\":[{\"CidrIp\":\"0.0.0.0/0\"}]}]}}", + "labels": [ + "billingCode=Lotus-1-2-3", + "needsPatching=true" + ], + "region": "us-east-1", + "type": "AwsEc2SecurityGroup", + "uid": "arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499" + } + ], + "severity": "Informational", + "severity_id": 1, + "state": "Resolved", + "state_id": "4", + "time": "2022-08-04T18:09:19.100Z", + "type_name": "Security Finding: Update", + "type_uid": "200102", + "unmapped": { + "CompanyName": "AWS", + "Compliance.StatusReasons[].ReasonCode": "CW_ALARMS_NOT_PRESENT", + "FindingProviderFields.Severity.Label": "INFORMATIONAL", + "FindingProviderFields.Severity.Original": "INFORMATIONAL", + "FindingProviderFields.Types[]": "Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices", + "Malware[].State": "OBSERVED", + "ProductFields.ControlId": "EC2.19", + "ProductFields.RecommendationUrl": "https://docs.aws.amazon.com/console/securityhub/EC2.19/remediation", + "ProductFields.RelatedAWSResources:0/name": "securityhub-vpc-sg-restricted-common-ports-2af29baf", + "ProductFields.RelatedAWSResources:0/type": "AWS::Config::ConfigRule", + "ProductFields.Resources:0/Id": "arn:aws:ec2:us-east-1:522536594833:security-group/sg-0daf160f08dfed499", + "ProductFields.StandardsArn": "arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0", + "ProductFields.StandardsControlArn": "arn:aws:securityhub:us-east-1:522536594833:control/aws-foundational-security-best-practices/v/1.0.0/EC2.19", + "ProductFields.StandardsSubscriptionArn": "arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0", + "ProductFields.aws/securityhub/CompanyName": "AWS", + "ProductFields.aws/securityhub/FindingId": "arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:522536594833:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.19/finding/bf428107-eee0-4d19-a013-92748ed69eef", + "ProductFields.aws/securityhub/ProductName": "Security Hub", + "RecordState": "ACTIVE", + "Severity.Normalized": "0", + "Severity.Original": "INFORMATIONAL", + "Severity.Product": "0", + "Vulnerabilities[].Cvss[].BaseScore": "4.7,1.0", + "Vulnerabilities[].Cvss[].BaseVector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N,AV:L/AC:M/Au:N/C:C/I:N/A:N", + "Vulnerabilities[].Cvss[].Version": "V3,V2", + "Vulnerabilities[].Vendor.VendorSeverity": "Medium", + "WorkflowState": "NEW" + }, + "vulnerabilities": [ + { + "cve": { + "created_time": 1579132903000, + "cvss": { + "base_score": 4.7, + "vector_string": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "version": "V3" + }, + "modified_time": 1579132903000, + "uid": "CVE-2020-12345" + }, + "kb_articles": [ + "https://alas.aws.amazon.com/ALAS-2020-1337.html" + ], + "packages": [ + { + "architecture": "x86_64", + "epoch": 1, + "name": "openssl", + "release": "16.amzn2.0.3", + "version": "1.0.2k" + }, + { + "architecture": "x86_64", + "epoch": 3, + "name": "yaml", + "release": "16.amzn2.0.3", + "version": "4.3.2" + } + ], + "references": [ + "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418" + ], + "related_vulnerabilities": [ + "CVE-2020-12345" + ], + "vendor_name": "Alas" + } + ] + }, + "process": { + "end": "2018-09-27T23:37:31.000Z", + "name": "syslogd", + "parent": { + "pid": 56789 + }, + "pid": 12345, + "start": "2018-09-27T22:37:31.000Z" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "vulnerability": { + "id": [ + "CVE-2020-12345" + ], + "reference": [ + "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418" + ], + "scanner": { + "vendor": [ + "Alas" + ] + }, + "score": { + "base": [ + 4.7 + ], + "version": [ + "V3" + ] + } + } + } + ] +} \ No newline at end of file diff --git a/packages/amazon_security_lake/data_stream/event/agent/stream/aws-s3.yml.hbs b/packages/amazon_security_lake/data_stream/event/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..505f3090f38 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,101 @@ +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{#if file_selectors}} +file_selectors: +{{file_selectors}} +{{/if}} + +{{/if}} + +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if external_id}} +external_id: {{external_id}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +decoding.codec.parquet.enabled: true +{{#if decoding_batch_size}} +decoding.codec.parquet.batch_size: {{decoding_batch_size}} +{{/if}} +{{#if decoding_process_parallel}} +decoding.codec.parquet.process_parallel: {{decoding_process_parallel}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url}} +proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +ssl: {{ssl}} +{{/if}} +tags: +{{#if collect_s3_logs}} + - collect_s3_logs +{{else}} + - collect_sqs_logs +{{/if}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..f4d5f88317a --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,1165 @@ +--- +description: Pipeline for processing Amazon Security Lake Events. +# Base Event docs: https://schema.ocsf.io/1.0.0-rc.3/base_event +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.10.0 + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - json: + field: event.original + tag: json_decoding + target_field: ocsf + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.class_uid + tag: convert_class_uid_to_string + type: string + ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + if: ctx.ocsf?.class_uid != null && ['3001','3002','4001','4003','6003'].contains(ctx.ocsf.class_uid) + value: event + - set: + field: event.kind + tag: set_event_kind + if: ctx.ocsf?.class_uid != null && ['2001'].contains(ctx.ocsf.class_uid) + value: alert + - append: + field: event.category + tag: append_malware_into_event_category + value: malware + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['2001'].contains(ctx.ocsf.class_uid) && ctx.ocsf.malware != null + - append: + field: event.category + tag: append_vulnerability_into_event_category + value: vulnerability + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['2001'].contains(ctx.ocsf.class_uid) && ctx.ocsf.vulnerabilities != null + - append: + field: event.category + tag: append_iam_into_event_category + value: iam + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3001'].contains(ctx.ocsf.class_uid) + - append: + field: event.category + tag: append_authentication_into_event_category + value: authentication + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3002'].contains(ctx.ocsf.class_uid) + - append: + field: event.category + tag: append_network_into_event_category + value: network + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) + - append: + field: event.category + tag: append_web_into_event_category + value: web + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['6003'].contains(ctx.ocsf.class_uid) + - append: + field: event.type + tag: append_info_into_event_type + value: info + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['2001','3001','3002','4001','4003','6003'].contains(ctx.ocsf.class_uid) + - append: + field: event.type + tag: append_user_into_event_type + value: user + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3001'].contains(ctx.ocsf.class_uid) + - append: + field: event.type + tag: append_protocol_into_event_type + value: protocol + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['4003'].contains(ctx.ocsf.class_uid) + - append: + field: event.type + tag: append_creation_into_event_type + value: creation + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3001'].contains(ctx.ocsf.class_uid) && ctx.ocsf.activity_name == 'Create' + - append: + field: event.type + tag: append_deletion_into_event_type + value: deletion + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3001'].contains(ctx.ocsf.class_uid) && ctx.ocsf.activity_name == 'Delete' + - append: + field: event.type + tag: append_start_into_event_type + value: start + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3002','4001'].contains(ctx.ocsf.class_uid) && ['Logon','Open'].contains(ctx.ocsf.activity_name) + - append: + field: event.type + tag: append_end_into_event_type + value: end + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['3002','4001'].contains(ctx.ocsf.class_uid) && ['Logoff','Close'].contains(ctx.ocsf.activity_name) + - append: + field: event.type + tag: append_denied_into_event_type + value: denied + allow_duplicates: false + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) && ['Refuse'].contains(ctx.ocsf.activity_name) + - set: + field: cloud.account.id + tag: set_cloud_account_uid + copy_from: ocsf.cloud.account.uid + ignore_empty_value: true + - set: + field: cloud.account.name + tag: set_cloud_account_name + copy_from: ocsf.cloud.account.name + ignore_empty_value: true + - set: + field: cloud.availability_zone + tag: set_cloud_availability_zone + copy_from: ocsf.cloud.zone + ignore_empty_value: true + - set: + field: cloud.project.id + tag: set_cloud_project_id + copy_from: ocsf.cloud.project_uid + ignore_empty_value: true + - set: + field: cloud.provider + tag: set_cloud_provider + copy_from: ocsf.cloud.provider + ignore_empty_value: true + - set: + field: cloud.region + tag: set_cloud_region + copy_from: ocsf.cloud.region + ignore_empty_value: true + - lowercase: + field: ocsf.activity_name + tag: lowercase_event_action + target_field: event.action + ignore_missing: true + on_failure: + - remove: + field: ocsf.activity_name + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - gsub: + field: event.action + pattern: '[: ]' + replacement: '-' + tag: gsub_event_action + ignore_missing: true + on_failure: + - remove: + field: event.action + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.code + tag: set_event_code + copy_from: ocsf.metadata.event_code + ignore_empty_value: true + - convert: + field: ocsf.duration + tag: convert_duration_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.duration + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Convert duration from milliseconds to nanoseconds. + tag: script_duration_ms_to_ns + lang: painless + if: ctx.ocsf?.duration != null + source: >- + ctx.event.duration = ctx.ocsf.duration * 1000000; + - set: + field: event.id + tag: set_event_id + copy_from: ocsf.metadata.uid + ignore_empty_value: true + - set: + field: event.provider + tag: set_event_provider_from_metadata_log_provider + copy_from: ocsf.metadata.log_provider + ignore_empty_value: true + - set: + field: event.provider + tag: set_event_provider_from_metadata_product_vendor_name + copy_from: ocsf.metadata.product.vendor_name + ignore_empty_value: true + if: ctx.ocsf?.metadata?.log_provider == null + - convert: + field: ocsf.metadata.sequence + tag: convert_metadata_sequence_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.metadata.sequence + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.sequence + tag: set_event_sequence + copy_from: ocsf.metadata.sequence + ignore_empty_value: true + - set: + field: message + tag: set_message + copy_from: ocsf.message + ignore_empty_value: true + - foreach: + field: ocsf.metadata.labels + if: ctx.ocsf?.metadata?.labels instanceof List + ignore_failure: true + processor: + append: + field: tags + tag: append_metadata_labels_to_tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: ocsf.api.response.code + tag: convert_api_response_code_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.api.response.code + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.activity_id + tag: convert_activity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.category_uid + tag: convert_category_uid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.cloud.account.type_id + tag: convert_cloud_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.count + tag: convert_count_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.count + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.end_time_dt + tag: date_end_time_dt + target_field: ocsf.end_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.end_time_dt != null && ctx.ocsf.end_time_dt != '' + on_failure: + - remove: + field: ocsf.end_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end_from_end_time_dt + copy_from: ocsf.end_time_dt + ignore_empty_value: true + - date: + field: ocsf.end_time + tag: date_end_time + target_field: ocsf.end_time + formats: + - UNIX_MS + if: ctx.ocsf?.end_time != null && ctx.ocsf.end_time != '' + on_failure: + - remove: + field: ocsf.end_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + tag: set_event_end_from_end_time + copy_from: ocsf.end_time + ignore_empty_value: true + - date: + field: ocsf.time_dt + tag: date_timestamp_from_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.time_dt != null && ctx.ocsf.time_dt != '' + on_failure: + - remove: + field: ocsf.time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.time + tag: date_timestamp_from_time + formats: + - UNIX_MS + if: ctx.ocsf?.time != null && ctx.ocsf.time != '' + on_failure: + - remove: + field: ocsf.time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.time_dt + tag: date_time_dt + target_field: ocsf.time_dt + formats: + - ISO8601 + if: ctx.ocsf?.time_dt != null && ctx.ocsf.time_dt != '' + on_failure: + - remove: + field: ocsf.time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.time + tag: date_time + target_field: ocsf.time + formats: + - UNIX_MS + if: ctx.ocsf?.time != null && ctx.ocsf.time != '' + on_failure: + - remove: + field: ocsf.time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.logged_time_dt + tag: date_metadata_logged_time_dt + target_field: ocsf.metadata.logged_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.metadata?.logged_time_dt != null && ctx.ocsf.metadata.logged_time_dt != '' + on_failure: + - remove: + field: ocsf.metadata.logged_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.logged_time + tag: date_metadata_logged_time + target_field: ocsf.metadata.logged_time + formats: + - UNIX_MS + if: ctx.ocsf?.metadata?.logged_time != null && ctx.ocsf.metadata.logged_time != '' + on_failure: + - remove: + field: ocsf.metadata.logged_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.modified_time_dt + tag: date_metadata_modified_time_dt + target_field: ocsf.metadata.modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.metadata?.modified_time_dt != null && ctx.ocsf.metadata.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.metadata.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.modified_time + tag: date_metadata_modified_time + target_field: ocsf.metadata.modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.metadata?.modified_time != null && ctx.ocsf.metadata.modified_time != '' + on_failure: + - remove: + field: ocsf.metadata.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.processed_time_dt + tag: date_metadata_processed_time_dt + target_field: ocsf.metadata.processed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.metadata?.processed_time_dt != null && ctx.ocsf.metadata.processed_time_dt != '' + on_failure: + - remove: + field: ocsf.metadata.processed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.metadata.processed_time + tag: date_metadata_processed_time + target_field: ocsf.metadata.processed_time + formats: + - UNIX_MS + if: ctx.ocsf?.metadata?.processed_time != null && ctx.ocsf.metadata.processed_time != '' + on_failure: + - remove: + field: ocsf.metadata.processed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.observables + if: ctx.ocsf?.observables instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.reputation.base_score + tag: convert_reputation_base_score_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.reputation.base_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.observables + if: ctx.ocsf?.observables instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.reputation.score_id + tag: convert_reputation_score_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.observables + if: ctx.ocsf?.observables instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.type_id + tag: convert_type_id_to_string + type: string + ignore_missing: true + - script: + lang: painless + tag: script_to_map_observables_into_key_value_pair + description: Map observables into key value pair. + if: ctx.ocsf?.observables != null && ctx.ocsf.observables instanceof List + source: > + for (int i = 0; i < ctx.ocsf.observables.length; ++i) { + if (ctx['ocsf']['observables'][i]['value'] != null) { + ctx.ocsf.observables[i][ctx['ocsf']['observables'][i]['name']] = ctx['ocsf']['observables'][i]['value']; + } + } + - convert: + field: ocsf.severity_id + tag: convert_severity_id_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.severity_id + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.severity + tag: set_event_severity + copy_from: ocsf.severity_id + ignore_empty_value: true + - date: + field: ocsf.start_time_dt + tag: date_start_time_dt + target_field: ocsf.start_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.start_time_dt != null && ctx.ocsf.start_time_dt != '' + on_failure: + - remove: + field: ocsf.start_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start_from_start_time_dt + copy_from: ocsf.start_time_dt + ignore_empty_value: true + - date: + field: ocsf.start_time + tag: date_start_time + target_field: ocsf.start_time + formats: + - UNIX_MS + if: ctx.ocsf?.start_time != null && ctx.ocsf.start_time != '' + on_failure: + - remove: + field: ocsf.start_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + tag: set_event_start_from_start_time + copy_from: ocsf.start_time + ignore_empty_value: true + - convert: + field: ocsf.status_id + tag: convert_status_id_to_string + type: string + ignore_missing: true + - set: + field: event.outcome + value: unknown + if: ctx.ocsf?.status_id == '0' + - set: + field: event.outcome + value: success + if: ctx.ocsf?.status_id == '1' + - set: + field: event.outcome + value: failure + if: ctx.ocsf?.status_id == '2' + - convert: + field: ocsf.timezone_offset + tag: convert_timezone_offset_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.timezone_offset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.type_uid + tag: convert_type_uid_to_string + type: string + ignore_missing: true + - json: + field: ocsf.raw_data + if: ctx.ocsf?.raw_data instanceof String + tag: json_decoding_raw_data + on_failure: + - rename: + field: ocsf.raw_data + target_field: ocsf.raw_data_keyword + ignore_missing: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_actor" }}' + if: ctx.ocsf?.class_uid != null && ['3001','3002','4001','4003','6003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.actor != null + tag: pipeline_object_actor + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_attack" }}' + if: ctx.ocsf?.class_uid != null && ['2001','4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.attacks != null + tag: pipeline_object_attack + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_network_connection_info" }}' + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.connection_info != null + tag: pipeline_object_network_connection_info + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_device" }}' + if: ctx.ocsf?.class_uid != null && ['3001','3002','4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.device != null + tag: pipeline_object_device + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_http_request" }}' + if: ctx.ocsf?.class_uid != null && ['3001','3002','6003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.http_request != null + tag: pipeline_object_http_request + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_malware" }}' + if: ctx.ocsf?.class_uid != null && ['2001','4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.malware != null + tag: pipeline_object_malware + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_network_endpoint" }}' + if: ctx.ocsf?.class_uid != null && ['3001','3002','4001','4003','6003'].contains(ctx.ocsf.class_uid) && (ctx.ocsf.dst_endpoint != null || ctx.ocsf.src_endpoint != null) + tag: pipeline_object_network_endpoint + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_process" }}' + if: ctx.ocsf?.class_uid != null && ['2001'].contains(ctx.ocsf.class_uid) && ctx.ocsf.process != null + tag: pipeline_object_process + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_proxy" }}' + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.proxy != null + tag: pipeline_object_proxy + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_tls" }}' + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.tls != null + tag: pipeline_object_tls + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_traffic" }}' + if: ctx.ocsf?.class_uid != null && ['4001','4003'].contains(ctx.ocsf.class_uid) && ctx.ocsf.traffic != null + tag: pipeline_object_traffic + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_object_user" }}' + if: ctx.ocsf?.class_uid != null && ['3001','3002'].contains(ctx.ocsf.class_uid) && ctx.ocsf.user != null + tag: pipeline_object_user + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_category_findings" }}' + if: ctx.ocsf?.category_uid != null && ctx.ocsf.category_uid == '2' + tag: pipeline_category_findings + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_category_identity_and_access_management" }}' + if: ctx.ocsf?.category_uid != null && ctx.ocsf.category_uid == '3' + tag: pipeline_category_identity_and_access_management + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_category_network_activity" }}' + if: ctx.ocsf?.category_uid != null && ctx.ocsf.category_uid == '4' + tag: pipeline_category_network_activity + ignore_missing_pipeline: true + - pipeline: + name: '{{ IngestPipeline "pipeline_category_application_activity" }}' + if: ctx.ocsf?.category_uid != null && ctx.ocsf.category_uid == '6' + tag: pipeline_category_application_activity + ignore_missing_pipeline: true + - foreach: + field: ocsf.process.user.groups + if: ctx.ocsf?.process?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_process_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.actor.process.user.groups + if: ctx.ocsf?.actor?.process?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_actor_process_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.process.parent_process.user.groups + if: ctx.ocsf?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_process_parent_process_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.actor.process.parent_process.user.groups + if: ctx.ocsf?.actor?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_actor_process_parent_process_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.actor.user.groups + if: ctx.ocsf?.actor?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_actor_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.user.groups + if: ctx.ocsf?.user?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_user_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.user_result.groups + if: ctx.ocsf?.user_result?.groups instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_user_result_groups_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.tls.sans + if: ctx.ocsf?.tls?.sans instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_tls_sans_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.technique.uid + - _ingest._value.technique.name + tag: remove_duplicate_custom_fields_from_attacks_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.tactics + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uid + - _ingest._value.name + tag: remove_duplicate_custom_fields_from_attacks_tactics_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.desc + - _ingest._value.cve.uid + - _ingest._value.references + - _ingest._value.vendor_name + - _ingest._value.cve.cvss.base_score + - _ingest._value.cve.cvss.version + - _ingest._value.severity + tag: remove_duplicate_custom_fields_from_vulnerabilities_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.rdata + - _ingest._value.packet_uid + - _ingest._value.class + - _ingest._value.type + - _ingest._value.ttl + tag: remove_duplicate_custom_fields_from_answers_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + remove: + field: + - _ingest._value.cvss.base_score + - _ingest._value.cvss.version + - _ingest._value.uid + tag: remove_duplicate_custom_fields_from_malware_cves_array + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: + - ocsf.time + - ocsf.cloud.account.uid + - ocsf.cloud.account.name + - ocsf.cloud.zone + - ocsf.cloud.project_uid + - ocsf.cloud.provider + - ocsf.cloud.region + - ocsf.metadata.event_code + - ocsf.end_time + - ocsf.metadata.uid + - ocsf.metadata.log_provider + - ocsf.metadata.sequence + - ocsf.severity_id + - ocsf.message + - ocsf.metadata.labels + - ocsf.process.container.uid + - ocsf.process.container.image.name + - ocsf.process.container.image.tag + - ocsf.process.container.image.labels + - ocsf.process.container.name + - ocsf.process.container.runtime + - ocsf.finding.created_time + - ocsf.finding.src_url + - ocsf.risk_score + - ocsf.process.file.accessed_time + - ocsf.process.file.created_time + - ocsf.process.file.parent_folder + - ocsf.process.file.uid + - ocsf.process.file.mime_type + - ocsf.process.file.modified_time + - ocsf.process.file.name + - ocsf.process.file.owner.name + - ocsf.process.file.path + - ocsf.process.file.size + - ocsf.process.file.type + - ocsf.process.file.owner.uid + - ocsf.process.file.signature.certificate.issuer + - ocsf.process.file.signature.certificate.expiration_time + - ocsf.process.file.signature.certificate.serial_number + - ocsf.process.file.signature.certificate.subject + - ocsf.process.file.signature.certificate.version + - ocsf.process.container.orchestrator + - ocsf.process.cmd_line + - ocsf.process.terminated_time + - ocsf.process.uid + - ocsf.process.egid + - ocsf.process.group.uid + - ocsf.process.group.name + - ocsf.process.name + - ocsf.process.pid + - ocsf.process.created_time + - ocsf.process.tid + - ocsf.process.user.domain + - ocsf.process.user.email_addr + - ocsf.process.user.full_name + - ocsf.process.euid + - ocsf.process.user.uid + - ocsf.process.user.name + - ocsf.process.parent_process.cmd_line + - ocsf.process.parent_process.terminated_time + - ocsf.process.parent_process.uid + - ocsf.process.parent_process.egid + - ocsf.process.parent_process.group.uid + - ocsf.process.parent_process.group.name + - ocsf.process.parent_process.name + - ocsf.process.parent_process.pid + - ocsf.process.parent_process.created_time + - ocsf.process.parent_process.tid + - ocsf.process.parent_process.user.domain + - ocsf.process.parent_process.user.email_addr + - ocsf.process.parent_process.user.full_name + - ocsf.process.parent_process.euid + - ocsf.process.parent_process.user.uid + - ocsf.process.parent_process.user.name + - ocsf.actor.process.cmd_line + - ocsf.actor.process.container.image.labels + - ocsf.actor.process.container.image.name + - ocsf.actor.process.container.image.tag + - ocsf.actor.process.container.name + - ocsf.actor.process.container.orchestrator + - ocsf.actor.process.container.runtime + - ocsf.actor.process.container.uid + - ocsf.actor.process.created_time + - ocsf.actor.process.egid + - ocsf.actor.process.euid + - ocsf.actor.process.file.accessed_time + - ocsf.actor.process.file.created_time + - ocsf.actor.process.file.mime_type + - ocsf.actor.process.file.modified_time + - ocsf.actor.process.file.name + - ocsf.actor.process.file.owner.name + - ocsf.actor.process.file.owner.uid + - ocsf.actor.process.file.parent_folder + - ocsf.actor.process.file.path + - ocsf.actor.process.file.signature.certificate.expiration_time + - ocsf.actor.process.file.signature.certificate.issuer + - ocsf.actor.process.file.signature.certificate.serial_number + - ocsf.actor.process.file.signature.certificate.subject + - ocsf.actor.process.file.signature.certificate.version + - ocsf.actor.process.file.size + - ocsf.actor.process.file.type + - ocsf.actor.process.file.uid + - ocsf.actor.process.group.name + - ocsf.actor.process.group.uid + - ocsf.actor.process.name + - ocsf.actor.process.pid + - ocsf.actor.process.terminated_time + - ocsf.actor.process.tid + - ocsf.actor.process.uid + - ocsf.actor.process.user.domain + - ocsf.actor.process.user.email_addr + - ocsf.actor.process.user.full_name + - ocsf.actor.process.user.name + - ocsf.actor.process.user.uid + - ocsf.actor.process.parent_process.cmd_line + - ocsf.actor.process.parent_process.created_time + - ocsf.actor.process.parent_process.egid + - ocsf.actor.process.parent_process.euid + - ocsf.actor.process.parent_process.group.name + - ocsf.actor.process.parent_process.group.uid + - ocsf.actor.process.parent_process.name + - ocsf.actor.process.parent_process.pid + - ocsf.actor.process.parent_process.terminated_time + - ocsf.actor.process.parent_process.tid + - ocsf.actor.process.parent_process.uid + - ocsf.actor.process.parent_process.user.domain + - ocsf.actor.process.parent_process.user.email_addr + - ocsf.actor.process.parent_process.user.full_name + - ocsf.actor.process.parent_process.user.name + - ocsf.actor.process.parent_process.user.uid + - ocsf.actor.user.domain + - ocsf.actor.user.email_addr + - ocsf.actor.user.full_name + - ocsf.actor.user.name + - ocsf.actor.user.uid + - ocsf.user.domain + - ocsf.user.email_addr + - ocsf.user.full_name + - ocsf.user.name + - ocsf.user.uid + - ocsf.user_result.domain + - ocsf.user_result.email_addr + - ocsf.user_result.full_name + - ocsf.user_result.name + - ocsf.user_result.uid + - ocsf.traffic.bytes + - ocsf.traffic.bytes_in + - ocsf.traffic.bytes_out + - ocsf.traffic.packets + - ocsf.traffic.packets_in + - ocsf.traffic.packets_out + - ocsf.tls.certificate.expiration_time + - ocsf.tls.certificate.issuer + - ocsf.tls.certificate.serial_number + - ocsf.tls.certificate.subject + - ocsf.tls.certificate.version + - ocsf.tls.cipher + - ocsf.tls.client_ciphers + - ocsf.tls.ja3_hash.value + - ocsf.tls.ja3s_hash.value + - ocsf.tls.sni + - ocsf.tls.version + - ocsf.start_time + - ocsf.src_endpoint.domain + - ocsf.src_endpoint.hostname + - ocsf.src_endpoint.ip + - ocsf.src_endpoint.location.city + - ocsf.src_endpoint.location.continent + - ocsf.src_endpoint.location.coordinates + - ocsf.src_endpoint.location.country + - ocsf.src_endpoint.location.desc + - ocsf.src_endpoint.location.postal_code + - ocsf.src_endpoint.location.region + - ocsf.src_endpoint.mac + - ocsf.src_endpoint.port + - ocsf.src_endpoint.svc_name + - ocsf.dst_endpoint.domain + - ocsf.dst_endpoint.hostname + - ocsf.dst_endpoint.ip + - ocsf.dst_endpoint.location.city + - ocsf.dst_endpoint.location.continent + - ocsf.dst_endpoint.location.coordinates + - ocsf.dst_endpoint.location.country + - ocsf.dst_endpoint.location.desc + - ocsf.dst_endpoint.location.postal_code + - ocsf.dst_endpoint.location.region + - ocsf.dst_endpoint.mac + - ocsf.dst_endpoint.port + - ocsf.dst_endpoint.svc_name + - ocsf.connection_info.protocol_name + - ocsf.connection_info.protocol_num + - ocsf.connection_info.protocol_ver + - ocsf.device.domain + - ocsf.device.hostname + - ocsf.device.ip + - ocsf.device.location.city + - ocsf.device.location.continent + - ocsf.device.location.coordinates + - ocsf.device.location.country + - ocsf.device.location.desc + - ocsf.device.location.postal_code + - ocsf.device.location.region + - ocsf.device.mac + - ocsf.device.name + - ocsf.device.os.build + - ocsf.device.os.name + - ocsf.device.risk_level + - ocsf.device.risk_score + - ocsf.device.type + - ocsf.device.uid + - ocsf.device.vlan_uid + - ocsf.http_request.http_method + - ocsf.http_request.referrer + - ocsf.http_request.uid + - ocsf.http_request.url.hostname + - ocsf.http_request.url.path + - ocsf.http_request.url.port + - ocsf.http_request.url.query_string + - ocsf.http_request.url.scheme + - ocsf.http_request.url.subdomain + - ocsf.http_request.url.url_string + - ocsf.http_request.user_agent + - ocsf.http_request.version + - ocsf.query.hostname + - ocsf.query.packet_uid + - ocsf.query.class + - ocsf.query.type + - ocsf.rcode + - ocsf.service.name + - ocsf.service.uid + - ocsf.service.version + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: event.original + tag: remove_event_original + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - foreach: + field: dns.answers.ttl + if: ctx.dns?.answers?.ttl instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_dns_answers_ttl_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: vulnerability.score.base + if: ctx.vulnerability?.score?.base instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_vulnerability_score_base_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_application_activity.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_application_activity.yml new file mode 100644 index 00000000000..91265cea003 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_application_activity.yml @@ -0,0 +1,81 @@ +--- +description: Pipeline for processing API Activity category. +# API Activity class docs: https://schema.ocsf.io/1.0.0-rc.3/class/graph/api_activity +processors: + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.owner.account.type_id + tag: convert_resources_owner_account_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.owner.type_id + tag: convert_resources_owner_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_uid_alt_into_related_user + value: '{{{_ingest._value.owner.uid_alt}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_email_addr_into_related_user + value: '{{{_ingest._value.owner.email_addr}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_full_name_into_related_user + value: '{{{_ingest._value.owner.full_name}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_name_into_related_user + value: '{{{_ingest._value.owner.name}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_uid_into_related_user + value: '{{{_ingest._value.owner.uid}}}' + allow_duplicates: false +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_findings.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_findings.yml new file mode 100644 index 00000000000..2e6e9e118e1 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_findings.yml @@ -0,0 +1,541 @@ +--- +description: Pipeline for processing Findings category. +# Security Findings Class docs: https://schema.ocsf.io/1.0.0-rc.3/classes/security_finding +processors: + - set: + field: event.reference + tag: set_event_reference + copy_from: ocsf.finding.src_url + ignore_empty_value: true + - uri_parts: + field: ocsf.finding.src_url + tag: uri_parts_finding_src_url + if: ctx.ocsf?.finding?.src_url != null + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.analytic.type_id + tag: convert_analytic_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.confidence_id + tag: convert_confidence_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.confidence_score + tag: convert_confidence_score_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.confidence_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.created_time_dt + tag: date_finding_created_time_dt + target_field: event.created + formats: + - ISO8601 + if: ctx.ocsf?.finding?.created_time_dt != null && ctx.ocsf.finding.created_time_dt != '' + on_failure: + - remove: + field: ocsf.finding.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.created_time + tag: date_finding_created_time + target_field: event.created + formats: + - UNIX_MS + if: ctx.ocsf?.finding?.created_time != null && ctx.ocsf.finding.created_time != '' + on_failure: + - remove: + field: ocsf.finding.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.created_time_dt + tag: date_finding_created_time_dt + target_field: ocsf.finding.created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.finding?.created_time_dt != null && ctx.ocsf.finding.created_time_dt != '' + on_failure: + - remove: + field: ocsf.finding.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.created_time + tag: date_finding_created_time + target_field: ocsf.finding.created_time + formats: + - UNIX_MS + if: ctx.ocsf?.finding?.created_time != null && ctx.ocsf.finding.created_time != '' + on_failure: + - remove: + field: ocsf.finding.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.first_seen_time_dt + tag: date_finding_first_seen_time_dt + target_field: ocsf.finding.first_seen_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.finding?.first_seen_time_dt != null && ctx.ocsf.finding.first_seen_time_dt != '' + on_failure: + - remove: + field: ocsf.finding.first_seen_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.first_seen_time + tag: date_finding_first_seen_time + target_field: ocsf.finding.first_seen_time + formats: + - UNIX_MS + if: ctx.ocsf?.finding?.first_seen_time != null && ctx.ocsf.finding.first_seen_time != '' + on_failure: + - remove: + field: ocsf.finding.first_seen_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.last_seen_time_dt + tag: date_finding_last_seen_time_dt + target_field: ocsf.finding.last_seen_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.finding?.last_seen_time_dt != null && ctx.ocsf.finding.last_seen_time_dt != '' + on_failure: + - remove: + field: ocsf.finding.last_seen_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.last_seen_time + tag: date_finding_last_seen_time + target_field: ocsf.finding.last_seen_time + formats: + - UNIX_MS + if: ctx.ocsf?.finding?.last_seen_time != null && ctx.ocsf.finding.last_seen_time != '' + on_failure: + - remove: + field: ocsf.finding.last_seen_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.modified_time_dt + tag: date_finding_modified_time_dt + target_field: ocsf.finding.modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.finding?.modified_time_dt != null && ctx.ocsf.finding.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.finding.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.finding.modified_time + tag: date_finding_modified_time + target_field: ocsf.finding.modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.finding?.modified_time != null && ctx.ocsf.finding.modified_time != '' + on_failure: + - remove: + field: ocsf.finding.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.finding.related_events + if: ctx.ocsf?.finding?.related_events instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.type_uid + tag: convert_finding_related_events_type_uid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.impact_score + tag: convert_impact_score_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.impact_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.state_id + tag: convert_state_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.impact_id + tag: convert_impact_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.kill_chain + if: ctx.ocsf?.kill_chain instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.phase_id + tag: convert_kill_chain_phase_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.risk_level_id + tag: convert_risk_level_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.risk_score + tag: convert_risk_score_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.risk_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.risk_score + tag: set_event_risk_score + copy_from: ocsf.risk_score + ignore_empty_value: true + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.id + value: '{{{_ingest._value.cve.uid}}}' + tag: append_vulnerabilities_cve_uid_into_vulnerability_id + allow_duplicates: false + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.score.version + value: '{{{_ingest._value.cve.cvss.version}}}' + tag: append_vulnerabilities_cve_cvss_version_into_vulnerability_score_version + allow_duplicates: false + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.description + value: '{{{_ingest._value.desc}}}' + tag: append_vulnerabilities_desc_into_vulnerability_description + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.references + ignore_failure: true + processor: + append: + field: vulnerability.reference + value: '{{{_ingest._value}}}' + tag: append_vulnerabilities_references_into_vulnerability_references + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.cve.cvss.base_score + tag: convert_vulnerabilities_cve_cvss_base_score_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.cve.cvss.base_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.score.base + value: '{{{_ingest._value.cve.cvss.base_score}}}' + tag: append_vulnerabilities_cve_cvss_base_score_into_vulnerability_score_base + allow_duplicates: false + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.severity + value: '{{{_ingest._value.severity}}}' + tag: append_vulnerabilities_severity_into_vulnerability_severity + allow_duplicates: false + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + append: + field: vulnerability.scanner.vendor + value: '{{{_ingest._value.vendor_name}}}' + tag: append_vulnerabilities_vendor_name_into_vulnerability_scanner_vendor + allow_duplicates: false + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.cve.cvss.overall_score + tag: convert_vulnerabilities_cve_cvss_overall_score_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.cve.cvss.overall_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.cve.cvss.severity + tag: convert_vulnerabilities_cve_cvss_severity_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.cve.cvss.severity + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.cve.created_time_dt + target_field: _ingest.cve.created_time_dt + tag: date_vulnerabilities_cve_created_time_dt + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.cve.created_time_dt + ignore_missing: true + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.cve.created_time + target_field: _ingest.cve.created_time + tag: date_vulnerabilities_cve_created_time + formats: + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.cve.created_time + ignore_missing: true + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.cve.modified_time_dt + target_field: _ingest.cve.modified_time_dt + tag: date_vulnerabilities_cve_modified_time_dt + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.cve.modified_time_dt + ignore_missing: true + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.cve.modified_time + target_field: _ingest.cve.modified_time + tag: date_vulnerabilities_cve_modified_time + formats: + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.cve.modified_time + ignore_missing: true + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.fix_available + tag: convert_vulnerabilities_fix_available_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.fix_available + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.vulnerabilities + if: ctx.ocsf?.vulnerabilities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.packages + ignore_failure: true + processor: + convert: + field: _ingest._value.epoch + tag: convert_vulnerabilities_packages_epoch_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.epoch + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_email_addr_into_related_user + value: '{{{_ingest._value.owner.email_addr}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_full_name_into_related_user + value: '{{{_ingest._value.owner.full_name}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_uid_into_related_user + value: '{{{_ingest._value.owner.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_name_into_related_user + value: '{{{_ingest._value.owner.name}}}' + allow_duplicates: false + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.owner.account.type_id + tag: convert_resources_owner_account_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.owner.type_id + tag: convert_resources_owner_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.resources + if: ctx.ocsf?.resources instanceof List + ignore_failure: true + processor: + append: + field: related.user + tag: append_resources_owner_uid_alt_into_related_user + value: '{{{_ingest._value.owner.uid_alt}}}' + allow_duplicates: false +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_identity_and_access_management.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_identity_and_access_management.yml new file mode 100644 index 00000000000..afef15df447 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_identity_and_access_management.yml @@ -0,0 +1,1734 @@ +--- +description: Pipeline for processing Identity & Access Management category. +# Account Change Class docs: https://schema.ocsf.io/1.0.0-rc.3/classes/account_change +# Authentication Class docs: https://schema.ocsf.io/1.0.0-rc.3/classes/authentication +processors: + - set: + field: user.changes.domain + tag: set_user_changes_domain + copy_from: ocsf.user_result.domain + ignore_empty_value: true + - set: + field: user.changes.email + tag: set_user_changes_email + copy_from: ocsf.user_result.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_user_result_email_addr_into_related_user + value: '{{{ocsf.user_result.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.user_result?.email_addr != null + - set: + field: user.changes.full_name + tag: set_user_changes_full_name + copy_from: ocsf.user_result.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_result_full_name_into_related_user + value: '{{{ocsf.user_result.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.user_result?.full_name != null + - foreach: + field: ocsf.user_result.groups + if: ctx.ocsf?.user_result?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.changes.group.id + value: '{{{_ingest._value.uid}}}' + tag: append_user_result_groups_uid_into_user_changes_group_id + allow_duplicates: false + - foreach: + field: ocsf.user_result.groups + if: ctx.ocsf?.user_result?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.changes.group.name + value: '{{{_ingest._value.name}}}' + tag: append_user_result_groups_name_into_user_changes_group_name + allow_duplicates: false + - set: + field: user.changes.id + tag: set_user_changes_id + copy_from: ocsf.user_result.uid + ignore_empty_value: true + - append: + field: related.user + tag: append_user_result_uid_into_related_user + value: '{{{ocsf.user_result.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.user_result?.uid != null + - set: + field: user.changes.name + tag: set_user_changes_name + copy_from: ocsf.user_result.name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_result_name_into_related_user + value: '{{{ocsf.user_result.name}}}' + allow_duplicates: false + if: ctx.ocsf?.user_result?.name != null + - convert: + field: ocsf.user_result.account.type_id + tag: convert_user_result_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.user_result.type_id + tag: convert_user_result_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_user_result_uid_alt_into_related_user + value: '{{{ocsf.user_result.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.user_result?.uid_alt != null + - convert: + field: ocsf.auth_protocol_id + tag: convert_auth_protocol_id_to_string + type: string + ignore_missing: true + - date: + field: ocsf.certificate.created_time_dt + tag: date_certificate_created_time_dt + target_field: ocsf.certificate.created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.certificate?.created_time_dt != null && ctx.ocsf.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.certificate.created_time + tag: date_certificate_created_time + target_field: ocsf.certificate.created_time + formats: + - UNIX_MS + if: ctx.ocsf?.certificate?.created_time != null && ctx.ocsf.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.certificate.expiration_time_dt + tag: date_certificate_expiration_time_dt + target_field: ocsf.certificate.expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.certificate?.expiration_time_dt != null && ctx.ocsf.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.certificate.expiration_time + tag: date_certificate_expiration_time + target_field: ocsf.certificate.expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.certificate?.expiration_time != null && ctx.ocsf.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.certificate.fingerprints + if: ctx.ocsf?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + value: '{{{_ingest._value.value}}}' + tag: append_certificate_fingerprints_value_into_related_hash + allow_duplicates: false + - convert: + field: ocsf.is_cleartext + tag: convert_is_cleartext_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.is_cleartext + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_logon_process_container_hash_value_into_related_hash + value: '{{{ocsf.logon_process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.container?.hash?.value != null + - date: + field: ocsf.logon_process.file.accessed_time_dt + target_field: ocsf.logon_process.file.accessed_time_dt + tag: date_logon_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.accessed_time_dt != null && ctx.ocsf.logon_process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.accessed_time + target_field: ocsf.logon_process.file.accessed_time + tag: date_logon_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.accessed_time != null && ctx.ocsf.logon_process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.created_time_dt + target_field: ocsf.logon_process.file.created_time_dt + tag: date_logon_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.created_time_dt != null && ctx.ocsf.logon_process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.created_time + target_field: ocsf.logon_process.file.created_time + tag: date_logon_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.created_time != null && ctx.ocsf.logon_process.file.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.logon_process.file.hashes + if: ctx.ocsf?.logon_process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_logon_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - date: + field: ocsf.logon_process.file.modified_time_dt + target_field: ocsf.logon_process.file.modified_time_dt + tag: date_logon_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.modified_time_dt != null && ctx.ocsf.logon_process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.modified_time + target_field: ocsf.logon_process.file.modified_time + tag: date_logon_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.modified_time != null && ctx.ocsf.logon_process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_file_owner_name_into_related_user + value: '{{{ocsf.logon_process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.owner?.name != null + - convert: + field: ocsf.logon_process.file.size + tag: convert_logon_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_file_owner_uid_into_related_user + value: '{{{ocsf.logon_process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.owner?.uid != null + - date: + field: ocsf.logon_process.file.signature.certificate.expiration_time_dt + target_field: ocsf.logon_process.file.signature.certificate.expiration_time_dt + tag: date_logon_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.logon_process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.signature.certificate.expiration_time + target_field: ocsf.logon_process.file.signature.certificate.expiration_time + tag: date_logon_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.logon_process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.terminated_time_dt + target_field: ocsf.logon_process.terminated_time_dt + tag: date_logon_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.terminated_time_dt != null && ctx.ocsf.logon_process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.terminated_time + target_field: ocsf.logon_process.terminated_time + tag: date_logon_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.terminated_time != null && ctx.ocsf.logon_process.terminated_time != '' + on_failure: + - remove: + field: ocsf.logon_process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.egid + tag: convert_logon_process_egid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.pid + tag: convert_logon_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.created_time_dt + target_field: ocsf.logon_process.created_time_dt + tag: date_logon_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.created_time_dt != null && ctx.ocsf.logon_process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.created_time + target_field: ocsf.logon_process.created_time + tag: date_logon_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.created_time != null && ctx.ocsf.logon_process.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.tid + tag: convert_logon_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_user_email_addr_into_related_user + value: '{{{ocsf.logon_process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.user?.email_addr != null + - append: + field: related.user + tag: append_logon_process_user_full_name_into_related_user + value: '{{{ocsf.logon_process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.user?.full_name != null + - convert: + field: ocsf.logon_process.euid + tag: convert_logon_process_euid_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_euid_into_related_user + value: '{{{ocsf.logon_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.euid != null + - append: + field: related.user + tag: append_logon_process_uid_into_related_user + value: '{{{ocsf.logon_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.user?.uid != null + - append: + field: related.user + tag: append_logon_process_user_name_into_related_user + value: '{{{ocsf.logon_process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.user?.name != null + - convert: + field: ocsf.logon_process.container.hash.algorithm_id + tag: convert_logon_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.auid + tag: convert_logon_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.container.size + tag: convert_logon_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.file.accessor.account.type_id + tag: convert_logon_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.logon_process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.logon_process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_logon_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.logon_process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_logon_process_file_accessor_name_into_related_user + value: '{{{ocsf.logon_process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_logon_process_file_accessor_uid_into_related_user + value: '{{{ocsf.logon_process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.accessor?.uid != null + - convert: + field: ocsf.logon_process.file.accessor.type_id + tag: convert_logon_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.attributes + tag: convert_logon_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.file.confidentiality_id + tag: convert_logon_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.creator.account.type_id + tag: convert_logon_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.creator.type_id + tag: convert_logon_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.logon_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_logon_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.logon_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_logon_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.logon_process.file.signature.algorithm_id + tag: convert_logon_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_logon_process_file_signature_value_into_related_hash + value: '{{{ocsf.logon_process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.signature?.value != null + - date: + field: ocsf.logon_process.file.signature.certificate.created_time_dt + target_field: ocsf.logon_process.file.signature.certificate.created_time_dt + tag: date_logon_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.logon_process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.signature.certificate.created_time + target_field: ocsf.logon_process.file.signature.certificate.created_time + tag: date_logon_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.logon_process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.signature.created_time_dt + target_field: ocsf.logon_process.file.signature.created_time_dt + tag: date_logon_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.file?.signature?.created_time_dt != null && ctx.ocsf.logon_process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.file.signature.created_time + target_field: ocsf.logon_process.file.signature.created_time + tag: date_logon_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.file?.signature?.created_time != null && ctx.ocsf.logon_process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.file.signature.digest.algorithm_id + tag: convert_logon_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_logon_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.logon_process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.logon_process.file.hashes + if: ctx.ocsf?.logon_process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_logon_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.modifier.account.type_id + tag: convert_logon_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.modifier.type_id + tag: convert_logon_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.owner.account.type_id + tag: convert_logon_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.owner.type_id + tag: convert_logon_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.file.is_system + tag: convert_logon_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.file.type_id + tag: convert_logon_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.integrity_id + tag: convert_logon_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.namespace_pid + tag: convert_logon_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Stringify the parent_process object if its depth_limit is greater than 20. + if: ctx.ocsf?.logon_process?.parent_process != null + tag: script_logon_process_parent_process_stringify + lang: painless + source: |- + def process = ctx.ocsf.logon_process.parent_process; + def count = 0; + while (true) { + if (process != null && process.parent_process != null) { + count += 1; + process = process.parent_process; + } else { + break; + } + } + if (count >= 15) { + ctx.ocsf.logon_process.parent_process.put("parent_process_keyword", ctx.ocsf.logon_process.parent_process.parent_process.toString()); + ctx.ocsf.logon_process.parent_process.remove("parent_process"); + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_logon_process_parent_process_container_hash_value_into_related_hash + value: '{{{ocsf.logon_process.parent_process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.container?.hash?.value != null + - date: + field: ocsf.logon_process.parent_process.file.accessed_time_dt + target_field: ocsf.logon_process.parent_process.file.accessed_time_dt + tag: date_logon_process_parent_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessed_time_dt != null && ctx.ocsf.logon_process.parent_process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.accessed_time + target_field: ocsf.logon_process.parent_process.file.accessed_time + tag: date_logon_process_parent_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessed_time != null && ctx.ocsf.logon_process.parent_process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.created_time_dt + target_field: ocsf.logon_process.parent_process.file.created_time_dt + tag: date_logon_process_parent_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.created_time_dt != null && ctx.ocsf.logon_process.parent_process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.created_time + target_field: ocsf.logon_process.parent_process.file.created_time + tag: date_logon_process_parent_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.created_time != null && ctx.ocsf.logon_process.parent_process.file.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.logon_process.parent_process.file.hashes + if: ctx.ocsf?.logon_process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_logon_process_parent_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - date: + field: ocsf.logon_process.parent_process.file.modified_time_dt + target_field: ocsf.logon_process.parent_process.file.modified_time_dt + tag: date_logon_process_parent_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.modified_time_dt != null && ctx.ocsf.logon_process.parent_process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.modified_time + target_field: ocsf.logon_process.parent_process.file.modified_time + tag: date_logon_process_parent_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.modified_time != null && ctx.ocsf.logon_process.parent_process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_parent_process_file_owner_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.owner?.name != null + - convert: + field: ocsf.logon_process.parent_process.file.size + tag: convert_logon_process_parent_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_parent_process_file_owner_uid_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.owner?.uid != null + - date: + field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time_dt + target_field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time_dt + tag: date_logon_process_parent_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.logon_process.parent_process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time + target_field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time + tag: date_logon_process_parent_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.logon_process.parent_process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.terminated_time_dt + target_field: ocsf.logon_process.parent_process.terminated_time_dt + tag: date_logon_process_parent_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.terminated_time_dt != null && ctx.ocsf.logon_process.parent_process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.terminated_time + target_field: ocsf.logon_process.parent_process.terminated_time + tag: date_logon_process_parent_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.terminated_time != null && ctx.ocsf.logon_process.parent_process.terminated_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.egid + tag: convert_logon_process_parent_process_egid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.pid + tag: convert_logon_process_parent_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.created_time_dt + target_field: ocsf.logon_process.parent_process.created_time_dt + tag: date_logon_process_parent_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.created_time_dt != null && ctx.ocsf.logon_process.parent_process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.created_time + target_field: ocsf.logon_process.parent_process.created_time + tag: date_logon_process_parent_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.created_time != null && ctx.ocsf.logon_process.parent_process.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.tid + tag: convert_logon_process_parent_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_logon_process_parent_process_user_email_addr_into_related_user + value: '{{{ocsf.logon_process.parent_process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.user?.email_addr != null + - append: + field: related.user + tag: append_logon_process_parent_process_user_full_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.user?.full_name != null + - convert: + field: ocsf.logon_process.parent_process.euid + tag: convert_logon_process_parent_process_euid_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_parent_process_euid_into_related_user + value: '{{{ocsf.logon_process.parent_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.euid != null + - append: + field: related.user + tag: append_logon_process_parent_process_uid_into_related_user + value: '{{{ocsf.logon_process.parent_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.user?.uid != null + - append: + field: related.user + tag: append_logon_process_parent_process_user_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.user?.name != null + - convert: + field: ocsf.logon_process.parent_process.container.hash.algorithm_id + tag: convert_logon_process_parent_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.auid + tag: convert_logon_process_parent_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.container.size + tag: convert_logon_process_parent_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.file.accessor.account.type_id + tag: convert_logon_process_parent_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_parent_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_accessor_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_accessor_uid_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.accessor?.uid != null + - convert: + field: ocsf.logon_process.parent_process.file.accessor.type_id + tag: convert_logon_process_parent_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.attributes + tag: convert_logon_process_parent_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.file.confidentiality_id + tag: convert_logon_process_parent_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.creator.account.type_id + tag: convert_logon_process_parent_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.creator.type_id + tag: convert_logon_process_parent_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.logon_process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_logon_process_parent_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.logon_process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_logon_process_parent_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.logon_process.parent_process.file.signature.algorithm_id + tag: convert_logon_process_parent_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_logon_process_parent_process_file_signature_value_into_related_hash + value: '{{{ocsf.logon_process.parent_process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.value != null + - date: + field: ocsf.logon_process.parent_process.file.signature.certificate.created_time_dt + target_field: ocsf.logon_process.parent_process.file.signature.certificate.created_time_dt + tag: date_logon_process_parent_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.logon_process.parent_process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.signature.certificate.created_time + target_field: ocsf.logon_process.parent_process.file.signature.certificate.created_time + tag: date_logon_process_parent_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.logon_process.parent_process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.signature.created_time_dt + target_field: ocsf.logon_process.parent_process.file.signature.created_time_dt + tag: date_logon_process_parent_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.created_time_dt != null && ctx.ocsf.logon_process.parent_process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.file.signature.created_time + target_field: ocsf.logon_process.parent_process.file.signature.created_time + tag: date_logon_process_parent_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.created_time != null && ctx.ocsf.logon_process.parent_process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.file.signature.digest.algorithm_id + tag: convert_logon_process_parent_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_logon_process_parent_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.logon_process.parent_process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.logon_process.parent_process.file.hashes + if: ctx.ocsf?.logon_process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_logon_process_parent_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.modifier.account.type_id + tag: convert_logon_process_parent_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.modifier.type_id + tag: convert_logon_process_parent_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.owner.account.type_id + tag: convert_logon_process_parent_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.owner.type_id + tag: convert_logon_process_parent_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.file.is_system + tag: convert_logon_process_parent_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.file.type_id + tag: convert_logon_process_parent_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.integrity_id + tag: convert_logon_process_parent_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.namespace_pid + tag: convert_logon_process_parent_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.session.created_time_dt + target_field: ocsf.logon_process.parent_process.session.created_time_dt + tag: date_logon_process_parent_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.session?.created_time_dt != null && ctx.ocsf.logon_process.parent_process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.session.created_time + target_field: ocsf.logon_process.parent_process.session.created_time + tag: date_logon_process_parent_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.session?.created_time != null && ctx.ocsf.logon_process.parent_process.session.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.session.expiration_time_dt + target_field: ocsf.logon_process.parent_process.session.expiration_time_dt + tag: date_logon_process_parent_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.parent_process?.session?.expiration_time_dt != null && ctx.ocsf.logon_process.parent_process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.parent_process.session.expiration_time + target_field: ocsf.logon_process.parent_process.session.expiration_time + tag: date_logon_process_parent_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.parent_process?.session?.expiration_time != null && ctx.ocsf.logon_process.parent_process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.session.mfa + tag: convert_logon_process_parent_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.session.is_remote + tag: convert_logon_process_parent_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.parent_process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.parent_process.user.account.type_id + tag: convert_logon_process_parent_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.parent_process.user.type_id + tag: convert_logon_process_parent_process_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_parent_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_creator_full_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_creator_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.creator?.name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_creator_uid_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_modifier_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_modifier_uid_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_logon_process_parent_process_file_owner_full_name_into_related_user + value: '{{{ocsf.logon_process.parent_process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_logon_process_parent_process_user_uid_alt_into_related_user + value: '{{{ocsf.logon_process.parent_process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.parent_process?.user?.uid_alt != null + - date: + field: ocsf.logon_process.session.created_time_dt + target_field: ocsf.logon_process.session.created_time_dt + tag: date_logon_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.session?.created_time_dt != null && ctx.ocsf.logon_process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.session.created_time + target_field: ocsf.logon_process.session.created_time + tag: date_logon_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.session?.created_time != null && ctx.ocsf.logon_process.session.created_time != '' + on_failure: + - remove: + field: ocsf.logon_process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.session.expiration_time_dt + target_field: ocsf.logon_process.session.expiration_time_dt + tag: date_logon_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.logon_process?.session?.expiration_time_dt != null && ctx.ocsf.logon_process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.logon_process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.logon_process.session.expiration_time + target_field: ocsf.logon_process.session.expiration_time + tag: date_logon_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.logon_process?.session?.expiration_time != null && ctx.ocsf.logon_process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.logon_process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.session.mfa + tag: convert_logon_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.session.is_remote + tag: convert_logon_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.logon_process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.logon_process.user.account.type_id + tag: convert_logon_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.logon_process.user.type_id + tag: convert_logon_process_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_logon_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.logon_process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.logon_process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_logon_process_file_creator_full_name_into_related_user + value: '{{{ocsf.logon_process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_logon_process_file_creator_name_into_related_user + value: '{{{ocsf.logon_process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.creator?.name != null + - append: + field: related.user + tag: append_logon_process_file_creator_uid_into_related_user + value: '{{{ocsf.logon_process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_logon_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.logon_process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.logon_process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_logon_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.logon_process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_logon_process_file_modifier_name_into_related_user + value: '{{{ocsf.logon_process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_logon_process_file_modifier_uid_into_related_user + value: '{{{ocsf.logon_process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_logon_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.logon_process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_logon_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.logon_process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_logon_process_file_owner_full_name_into_related_user + value: '{{{ocsf.logon_process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_logon_process_user_uid_alt_into_related_user + value: '{{{ocsf.logon_process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.logon_process?.user?.uid_alt != null + - convert: + field: ocsf.logon_type_id + tag: convert_logon_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.is_mfa + tag: convert_is_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.is_mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.is_new_logon + tag: convert_is_new_logon_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.is_new_logon + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.is_remote + tag: convert_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: service.name + tag: set_service_name + copy_from: ocsf.service.name + ignore_empty_value: true + - set: + field: service.id + tag: set_service_id + copy_from: ocsf.service.uid + ignore_empty_value: true + - set: + field: service.version + tag: set_service_version + copy_from: ocsf.service.version + ignore_empty_value: true + - date: + field: ocsf.session.created_time_dt + tag: date_session_created_time_dt + target_field: ocsf.session.created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.session?.created_time_dt != null && ctx.ocsf.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.session.created_time + tag: date_session_created_time + target_field: ocsf.session.created_time + formats: + - UNIX_MS + if: ctx.ocsf?.session?.created_time != null && ctx.ocsf.session.created_time != '' + on_failure: + - remove: + field: ocsf.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.session.expiration_time_dt + tag: date_session_expiration_time_dt + target_field: ocsf.session.expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.session?.expiration_time_dt != null && ctx.ocsf.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.session.expiration_time + tag: date_session_expiration_time + target_field: ocsf.session.expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.session?.expiration_time != null && ctx.ocsf.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.session.is_remote + tag: convert_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.session.mfa + tag: convert_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_network_activity.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_network_activity.yml new file mode 100644 index 00000000000..ea4d3455eae --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_category_network_activity.yml @@ -0,0 +1,238 @@ +--- +description: Pipeline for processing Network Activity category. +# Network Activity Class docs: https://schema.ocsf.io/1.0.0-rc.3/categories/network +processors: + - convert: + field: ocsf.disposition_id + tag: convert_disposition_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.flag_ids + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_answers_flag_ids_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.packet_uid + tag: convert_answers_packet_uid_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.ttl + tag: convert_answers_ttl_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.ttl + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + append: + field: dns.answers.data + tag: append_answers_data_into_dns_answer_data + value: '{{{_ingest._value.rdata}}}' + allow_duplicates: false + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + append: + field: dns.id + tag: append_answers_packet_uid_into_dns_id + value: '{{{_ingest._value.packet_uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + append: + field: dns.answers.class + tag: append_answers_class_into_dns_answer_class + value: '{{{_ingest._value.class}}}' + allow_duplicates: false + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + append: + field: dns.answers.type + tag: append_answers_type_into_dns_answer_type + value: '{{{_ingest._value.type}}}' + allow_duplicates: false + - foreach: + field: ocsf.answers + if: ctx.ocsf?.answers instanceof List + ignore_failure: true + processor: + append: + field: dns.answers.ttl + tag: append_answers_ttl_into_dns_answer_ttl + value: '{{{_ingest._value.ttl}}}' + allow_duplicates: false + - convert: + field: ocsf.query.opcode_id + tag: convert_query_opcode_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.query.packet_uid + tag: convert_query_packet_uid_to_string + type: string + ignore_missing: true + - set: + field: dns.question.name + tag: set_dns_question_name + copy_from: ocsf.query.hostname + ignore_empty_value: true + - append: + field: dns.id + tag: append_query_packet_uid_into_dns_id + value: '{{{ocsf.query.packet_uid}}}' + allow_duplicates: false + if: ctx.ocsf?.query?.packet_uid != null + - append: + field: dns.question.class + tag: append_query_class_into_dns_question_class + value: '{{{ocsf.query.class}}}' + allow_duplicates: false + if: ctx.ocsf?.query?.class != null + - append: + field: dns.question.type + tag: append_query_type_into_dns_question_type + value: '{{{ocsf.query.type}}}' + allow_duplicates: false + if: ctx.ocsf?.query?.type != null + - date: + field: ocsf.query_time_dt + tag: date_query_time_dt + target_field: ocsf.query_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.query_time_dt != null && ctx.ocsf.query_time_dt != '' + on_failure: + - remove: + field: ocsf.query_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.query_time + tag: date_query_time + target_field: ocsf.query_time + formats: + - UNIX_MS + if: ctx.ocsf?.query_time != null && ctx.ocsf.query_time != '' + on_failure: + - remove: + field: ocsf.query_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: dns.response_code + tag: set_dns_response_code + copy_from: ocsf.rcode + ignore_empty_value: true + - convert: + field: ocsf.rcode_id + tag: convert_rcode_id_to_string + type: string + ignore_missing: true + - date: + field: ocsf.response_time_dt + tag: date_response_time_dt + target_field: ocsf.response_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.response_time_dt != null && ctx.ocsf.response_time_dt != '' + on_failure: + - remove: + field: ocsf.response_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.response_time + tag: date_response_time + target_field: ocsf.response_time + formats: + - UNIX_MS + if: ctx.ocsf?.response_time != null && ctx.ocsf.response_time != '' + on_failure: + - remove: + field: ocsf.response_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + tag: script_dns_header_flags + if: ctx.ocsf?.answers instanceof List + params: + 'Authoritative Answer': 'AA' + 'Authentic Data': 'AD' + 'Recursion Desired': 'RD' + 'Recursion Available': 'RA' + 'Checking Disabled': 'CD' + source: >- + if (ctx.dns == null) { + ctx.dns = new HashMap(); + } + def list = new HashSet(); + for (def answer : ctx.ocsf.answers) { + if (answer.flags != null) + { + for (int i = 0; i < answer.flags.length; i++) { + def flag = answer.flags[i]; + if(params.containsKey(flag)) + { + list.add(params.get(flag)); + } + } + } + } + ctx.dns.put('header_flags', list); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_actor.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_actor.yml new file mode 100644 index 00000000000..a5d00d6ea70 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_actor.yml @@ -0,0 +1,2035 @@ +--- +description: Pipeline for processing Actor object. +# Actor object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/actor +processors: + - set: + field: container.id + tag: set_container_id + copy_from: ocsf.actor.process.container.uid + ignore_empty_value: true + - script: + description: Set value for container.image.hash.all. + if: ctx.ocsf?.actor?.process?.container?.hash?.value != null + tag: script_container_image_hash_all + lang: painless + params: + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + SHA-512: sha512 + CTPH: ssdeep + TLSH: tlsh + source: |- + if (params.get(ctx.ocsf.actor.process.container.hash.algorithm) == null) { + return; + } + if (ctx.container == null) { + ctx.container = new HashMap(); + } + if (ctx.container.image == null) { + ctx.container.image = new HashMap(); + } + if (ctx.container.image.hash == null) { + ctx.container.image.hash = new HashMap(); + } + def list = new ArrayList(); + def value = params.get(ctx.ocsf.actor.process.container.hash.algorithm) + ':' + ctx.ocsf.actor.process.container.hash.value; + list.add(value); + ctx.container.image.hash.all = list; + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_actor_process_container_hash_value_into_related_hash + value: '{{{ocsf.actor.process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.container?.hash?.value != null + - set: + field: container.image.name + tag: set_container_image_name + copy_from: ocsf.actor.process.container.image.name + ignore_empty_value: true + - append: + field: container.image.tag + tag: append_actor_process_container_image_tag_into_container_image_tag + value: '{{{ocsf.actor.process.container.image.tag}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.container?.image?.tag != null + - set: + field: container.labels + tag: set_container_labels + copy_from: ocsf.actor.process.container.image.labels + ignore_empty_value: true + - set: + field: orchestrator.type + tag: set_orchestrator_type + copy_from: ocsf.actor.process.container.orchestrator + ignore_empty_value: true + - set: + field: container.name + tag: set_container_name + copy_from: ocsf.actor.process.container.name + ignore_empty_value: true + - set: + field: container.runtime + tag: set_container_runtime + copy_from: ocsf.actor.process.container.runtime + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.accessed_time_dt + target_field: ocsf.actor.process.file.accessed_time_dt + tag: date_actor_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.accessed_time_dt != null && ctx.ocsf.actor.process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.accessed + tag: set_file_accessed_from_actor_process_file_accessed_time_dt + copy_from: ocsf.actor.process.file.accessed_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.accessed_time + target_field: ocsf.actor.process.file.accessed_time + tag: date_actor_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.accessed_time != null && ctx.ocsf.actor.process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.accessed + tag: set_file_accessed_from_actor_process_file_accessed_time + copy_from: ocsf.actor.process.file.accessed_time + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.created_time_dt + target_field: ocsf.actor.process.file.created_time_dt + tag: date_actor_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.created_time_dt != null && ctx.ocsf.actor.process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created_actor_process_file_created_time_dt + copy_from: ocsf.actor.process.file.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.created_time + target_field: ocsf.actor.process.file.created_time + tag: date_actor_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.created_time != null && ctx.ocsf.actor.process.file.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created_actor_process_file_created_time + copy_from: ocsf.actor.process.file.created_time + ignore_empty_value: true + - set: + field: file.directory + tag: set_file_directory + copy_from: ocsf.actor.process.file.parent_folder + ignore_empty_value: true + - script: + description: Set value for file.hash.*. + if: ctx.ocsf?.actor?.process?.file?.hashes != null + tag: script_file_hash_* + lang: painless + params: + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + SHA-512: sha512 + CTPH: ssdeep + TLSH: tlsh + source: |- + if (ctx.file == null) { + ctx.file = new HashMap(); + } + if (ctx.file.hash == null) { + ctx.file.hash = new HashMap(); + } + Map map = new HashMap(); + def hashes = ctx.ocsf.actor.process.file.get('hashes'); + for (def hash: hashes) { + def hashAlgorithm = params.get(hash.get('algorithm')); + if (hashAlgorithm == null) { + continue; + } + if (map.containsKey(hashAlgorithm)) { + map[hashAlgorithm].add(hash.get('value')); + } else { + Set set = new HashSet(); + set.add(hash.get('value')); + map.put(hashAlgorithm, set); + } + } + ctx.file.hash = map; + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.actor.process.file.hashes + if: ctx.ocsf?.actor?.process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_actor_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - set: + field: file.inode + tag: set_file_inode + copy_from: ocsf.actor.process.file.uid + ignore_empty_value: true + - set: + field: file.mime_type + tag: set_file_mime_type + copy_from: ocsf.actor.process.file.mime_type + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.modified_time_dt + target_field: ocsf.actor.process.file.modified_time_dt + tag: date_actor_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.modified_time_dt != null && ctx.ocsf.actor.process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime_from_actor_process_file_modified_time_dt + copy_from: ocsf.actor.process.file.modified_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.modified_time + target_field: ocsf.actor.process.file.modified_time + tag: date_actor_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.modified_time != null && ctx.ocsf.actor.process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime_from_actor_process_file_modified_time + copy_from: ocsf.actor.process.file.modified_time + ignore_empty_value: true + - set: + field: file.name + tag: set_file_name + copy_from: ocsf.actor.process.file.name + ignore_empty_value: true + - set: + field: file.owner + tag: set_file_owner + copy_from: ocsf.actor.process.file.owner.name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_file_owner_name_into_related_user + value: '{{{ocsf.actor.process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.owner?.name != null + - set: + field: file.path + tag: set_file_path + copy_from: ocsf.actor.process.file.path + ignore_empty_value: true + - convert: + field: ocsf.actor.process.file.size + tag: convert_actor_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.size + tag: set_file_size + copy_from: ocsf.actor.process.file.size + ignore_empty_value: true + - set: + field: file.type + tag: set_file_type + copy_from: ocsf.actor.process.file.type + ignore_empty_value: true + - set: + field: file.uid + tag: set_file_uid + copy_from: ocsf.actor.process.file.owner.uid + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_file_owner_uid_into_related_user + value: '{{{ocsf.actor.process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.owner?.uid != null + - set: + field: file.x509.issuer.distinguished_name + tag: set_file_x509_issuer_distinguished_name + copy_from: ocsf.actor.process.file.signature.certificate.issuer + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.signature.certificate.expiration_time_dt + target_field: ocsf.actor.process.file.signature.certificate.expiration_time_dt + tag: date_actor_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.actor.process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_after + tag: set_file_x509_not_after_from_actor_process_file_signature_certificate_expiration_time_dt + copy_from: ocsf.actor.process.file.signature.certificate.expiration_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.file.signature.certificate.expiration_time + target_field: ocsf.actor.process.file.signature.certificate.expiration_time + tag: date_actor_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.actor.process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_after + tag: set_file_x509_not_after_from_actor_process_file_signature_certificate_expiration_time + copy_from: ocsf.actor.process.file.signature.certificate.expiration_time + ignore_empty_value: true + - set: + field: file.x509.serial_number + tag: set_file_x509_serial_number + copy_from: ocsf.actor.process.file.signature.certificate.serial_number + ignore_empty_value: true + - set: + field: file.x509.subject.distinguished_name + tag: set_file_x509_subject_distinguished_name + copy_from: ocsf.actor.process.file.signature.certificate.subject + ignore_empty_value: true + - set: + field: file.x509.version_number + tag: set_file_x509_version_number + copy_from: ocsf.actor.process.file.signature.certificate.version + ignore_empty_value: true + - set: + field: process.command_line + tag: set_process_command_line + copy_from: ocsf.actor.process.cmd_line + ignore_empty_value: true + - date: + field: ocsf.actor.process.terminated_time_dt + target_field: ocsf.actor.process.terminated_time_dt + tag: date_actor_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.terminated_time_dt != null && ctx.ocsf.actor.process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end_from_actor_process_terminated_time_dt + copy_from: ocsf.actor.process.terminated_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.terminated_time + target_field: ocsf.actor.process.terminated_time + tag: date_actor_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.terminated_time != null && ctx.ocsf.actor.process.terminated_time != '' + on_failure: + - remove: + field: ocsf.actor.process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end_from_actor_process_terminated_time + copy_from: ocsf.actor.process.terminated_time + ignore_empty_value: true + - convert: + field: ocsf.actor.process.egid + tag: convert_actor_process_egid_to_string + type: string + ignore_missing: true + - append: + field: process.group.id + tag: append_process_group_id_from_actor_process_egid + value: '{{{ocsf.actor.process.egid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.egid != null + - append: + field: process.group.id + tag: append_process_group_id_from_actor_process_group_uid + value: '{{{ocsf.actor.process.group.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.group?.uid != null + - set: + field: process.group.name + tag: set_process_group_name + copy_from: ocsf.actor.process.group.name + ignore_empty_value: true + - set: + field: process.name + tag: set_process_name + copy_from: ocsf.actor.process.name + ignore_empty_value: true + - convert: + field: ocsf.actor.process.pid + tag: convert_actor_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.pid + tag: set_process_pid + copy_from: ocsf.actor.process.pid + ignore_empty_value: true + - date: + field: ocsf.actor.process.created_time_dt + target_field: ocsf.actor.process.created_time_dt + tag: date_actor_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.created_time_dt != null && ctx.ocsf.actor.process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start_from_actor_process_created_time_dt + copy_from: ocsf.actor.process.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.created_time + target_field: ocsf.actor.process.created_time + tag: date_actor_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.created_time != null && ctx.ocsf.actor.process.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start_from_actor_process_created_time + copy_from: ocsf.actor.process.created_time + ignore_empty_value: true + - convert: + field: ocsf.actor.process.tid + tag: convert_actor_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.thread.id + tag: set_process_thread_id + copy_from: ocsf.actor.process.tid + ignore_empty_value: true + - set: + field: process.entity_id + tag: set_process_entity_id + copy_from: ocsf.actor.process.uid + ignore_empty_value: true + - set: + field: process.user.domain + tag: set_process_user_domain + copy_from: ocsf.actor.process.user.domain + ignore_empty_value: true + - set: + field: process.user.email + tag: set_process_user_email + copy_from: ocsf.actor.process.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_user_email_addr_into_related_user + value: '{{{ocsf.actor.process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.email_addr != null + - set: + field: process.user.full_name + tag: set_process_user_full_name + copy_from: ocsf.actor.process.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_user_full_name_into_related_user + value: '{{{ocsf.actor.process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.full_name != null + - foreach: + field: ocsf.actor.process.user.groups + if: ctx.ocsf?.actor?.process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.user.group.id + tag: append_process_user_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.actor.process.user.groups + if: ctx.ocsf?.actor?.process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.user.group.name + tag: append_process_user_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - convert: + field: ocsf.actor.process.euid + tag: convert_actor_process_euid_to_string + type: string + ignore_missing: true + - append: + field: process.user.id + tag: append_process_user_id_from_actor_process_euid + value: '{{{ocsf.actor.process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.euid != null + - append: + field: related.user + tag: append_actor_process_euid_into_related_user + value: '{{{ocsf.actor.process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.euid != null + - append: + field: process.user.id + tag: append_process_user_id_from_actor_process_uid + value: '{{{ocsf.actor.process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.uid != null + - append: + field: related.user + tag: append_actor_process_uid_into_related_user + value: '{{{ocsf.actor.process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.uid != null + - set: + field: process.user.name + tag: set_process_user_name + copy_from: ocsf.actor.process.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_user_name_into_related_user + value: '{{{ocsf.actor.process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.name != null + - set: + field: user.domain + tag: set_user_domain + copy_from: ocsf.actor.user.domain + ignore_empty_value: true + - set: + field: user.email + tag: set_user_email + copy_from: ocsf.actor.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_user_email_addr_into_related_user + value: '{{{ocsf.actor.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.user?.email_addr != null + - set: + field: user.full_name + tag: set_user_full_name + copy_from: ocsf.actor.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_user_full_name_into_related_user + value: '{{{ocsf.actor.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.user?.full_name != null + - foreach: + field: ocsf.actor.user.groups + if: ctx.ocsf?.actor?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.group.id + tag: append_user_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.actor.user.groups + if: ctx.ocsf?.actor?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.group.name + tag: append_user_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - set: + field: user.id + tag: set_user_id + copy_from: ocsf.actor.user.uid + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_user_uid_into_related_user + value: '{{{ocsf.actor.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.user?.uid != null + - set: + field: user.name + tag: set_user_name + copy_from: ocsf.actor.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_user_name_into_related_user + value: '{{{ocsf.actor.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.user?.name != null + - convert: + field: ocsf.actor.process.container.hash.algorithm_id + tag: convert_actor_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.auid + tag: convert_actor_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.container.size + tag: convert_actor_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.file.accessor.account.type_id + tag: convert_actor_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_actor_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.actor.process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.actor.process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_actor_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.actor.process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_actor_process_file_accessor_name_into_related_user + value: '{{{ocsf.actor.process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_actor_process_file_accessor_uid_into_related_user + value: '{{{ocsf.actor.process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.accessor?.uid != null + - convert: + field: ocsf.actor.process.file.accessor.type_id + tag: convert_actor_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.attributes + tag: convert_actor_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.file.confidentiality_id + tag: convert_actor_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.creator.account.type_id + tag: convert_actor_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.creator.type_id + tag: convert_actor_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.actor.process.file.signature.certificate.fingerprints + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_actor_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.actor.process.file.signature.certificate.fingerprints + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_actor_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.actor.process.file.signature.algorithm_id + tag: convert_actor_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_actor_process_file_signature_value_into_related_hash + value: '{{{ocsf.actor.process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.signature?.value != null + - date: + field: ocsf.actor.process.file.signature.certificate.created_time_dt + target_field: ocsf.actor.process.file.signature.certificate.created_time_dt + tag: date_actor_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.actor.process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.file.signature.certificate.created_time + target_field: ocsf.actor.process.file.signature.certificate.created_time + tag: date_actor_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.actor.process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.file.signature.created_time_dt + target_field: ocsf.actor.process.file.signature.created_time_dt + tag: date_actor_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.file?.signature?.created_time_dt != null && ctx.ocsf.actor.process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.file.signature.created_time + target_field: ocsf.actor.process.file.signature.created_time + tag: date_actor_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.file?.signature?.created_time != null && ctx.ocsf.actor.process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.file.signature.digest.algorithm_id + tag: convert_actor_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_actor_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.actor.process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.actor.process.file.hashes + if: ctx.ocsf?.actor?.process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_actor_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.modifier.account.type_id + tag: convert_actor_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.modifier.type_id + tag: convert_actor_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.owner.account.type_id + tag: convert_actor_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.owner.type_id + tag: convert_actor_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.file.is_system + tag: convert_actor_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.file.type_id + tag: convert_actor_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.integrity_id + tag: convert_actor_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.namespace_pid + tag: convert_actor_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Stringify the parent_process object if its depth_limit is greater than 20. + if: ctx.ocsf?.actor?.process?.parent_process != null + tag: script_actor_process_parent_process_stringify + lang: painless + source: |- + def process = ctx.ocsf.actor.process.parent_process; + def count = 0; + while (true) { + if (process != null && process.parent_process != null) { + count += 1; + process = process.parent_process; + } else { + break; + } + } + if (count >= 15) { + ctx.ocsf.actor.process.parent_process.put("parent_process_keyword", ctx.ocsf.actor.process.parent_process.parent_process.toString()); + ctx.ocsf.actor.process.parent_process.remove("parent_process"); + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_actor_process_parent_process_container_hash_value_into_related_hash + value: '{{{ocsf.actor.process.parent_process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.container?.hash?.value != null + - date: + field: ocsf.actor.process.parent_process.file.accessed_time_dt + target_field: ocsf.actor.process.parent_process.file.accessed_time_dt + tag: date_actor_process_parent_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessed_time_dt != null && ctx.ocsf.actor.process.parent_process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.accessed_time + target_field: ocsf.actor.process.parent_process.file.accessed_time + tag: date_actor_process_parent_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessed_time != null && ctx.ocsf.actor.process.parent_process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.created_time_dt + target_field: ocsf.actor.process.parent_process.file.created_time_dt + tag: date_actor_process_parent_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.created_time_dt != null && ctx.ocsf.actor.process.parent_process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.created_time + target_field: ocsf.actor.process.parent_process.file.created_time + tag: date_actor_process_parent_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.created_time != null && ctx.ocsf.actor.process.parent_process.file.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.actor.process.parent_process.file.hashes + if: ctx.ocsf?.actor?.process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_actor_process_parent_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - date: + field: ocsf.actor.process.parent_process.file.modified_time_dt + target_field: ocsf.actor.process.parent_process.file.modified_time_dt + tag: date_actor_process_parent_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modified_time_dt != null && ctx.ocsf.actor.process.parent_process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.modified_time + target_field: ocsf.actor.process.parent_process.file.modified_time + tag: date_actor_process_parent_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modified_time != null && ctx.ocsf.actor.process.parent_process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_actor_process_parent_process_file_owner_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.owner?.name != null + - convert: + field: ocsf.actor.process.parent_process.file.size + tag: convert_actor_process_parent_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_actor_process_parent_process_file_owner_uid_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.owner?.uid != null + - date: + field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time_dt + target_field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time_dt + tag: date_actor_process_parent_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.actor.process.parent_process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time + target_field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time + tag: date_actor_process_parent_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.actor.process.parent_process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.command_line + tag: set_process_parent_command_line + copy_from: ocsf.actor.process.parent_process.cmd_line + ignore_empty_value: true + - date: + field: ocsf.actor.process.parent_process.terminated_time_dt + target_field: ocsf.actor.process.parent_process.terminated_time_dt + tag: date_actor_process_parent_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.terminated_time_dt != null && ctx.ocsf.actor.process.parent_process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.end + tag: set_process_parent_end_from_actor_process_parent_process_terminated_time_dt + copy_from: ocsf.actor.process.parent_process.terminated_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.parent_process.terminated_time + target_field: ocsf.actor.process.parent_process.terminated_time + tag: date_actor_process_parent_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.terminated_time != null && ctx.ocsf.actor.process.parent_process.terminated_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.end + tag: set_process_parent_process_end_from_actor_process_terminated_time + copy_from: ocsf.actor.process.parent_process.terminated_time + ignore_empty_value: true + - convert: + field: ocsf.actor.process.parent_process.egid + tag: convert_actor_process_parent_process_egid_to_string + type: string + ignore_missing: true + - append: + field: process.parent.group.id + tag: append_process_parent_group_id_from_actor_process_parent_process_egid + value: '{{{ocsf.actor.process.parent_process.egid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.egid != null + - append: + field: process.parent.group.id + tag: append_process_parent_group_id_from_actor_process_parent_process_group_uid + value: '{{{ocsf.actor.process.parent_process.group.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.group?.uid != null + - set: + field: process.parent.group.name + tag: set_process_parent_group_name + copy_from: ocsf.actor.process.parent_process.group.name + ignore_empty_value: true + - set: + field: process.parent.name + tag: set_process_parent_name + copy_from: ocsf.actor.process.parent_process.name + ignore_empty_value: true + - convert: + field: ocsf.actor.process.parent_process.pid + tag: convert_actor_process_parent_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.pid + tag: set_process_parent_pid + copy_from: ocsf.actor.process.parent_process.pid + ignore_empty_value: true + - date: + field: ocsf.actor.process.parent_process.created_time_dt + target_field: ocsf.actor.process.parent_process.created_time_dt + tag: date_actor_process_parent_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.created_time_dt != null && ctx.ocsf.actor.process.parent_process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.start + tag: set_process_parent_start_from_actor_process_parent_process_created_time_dt + copy_from: ocsf.actor.process.parent_process.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.actor.process.parent_process.created_time + target_field: ocsf.actor.process.parent_process.created_time + tag: date_actor_process_parent_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.created_time != null && ctx.ocsf.actor.process.parent_process.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.start + tag: set_process_parent_process_start_from_actor_process_created_time + copy_from: ocsf.actor.process.parent_process.created_time + ignore_empty_value: true + - convert: + field: ocsf.actor.process.parent_process.tid + tag: convert_actor_process_parent_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.thread.id + tag: set_process_parent_thread_id + copy_from: ocsf.actor.process.parent_process.tid + ignore_empty_value: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id + copy_from: ocsf.actor.process.parent_process.uid + ignore_empty_value: true + - set: + field: process.parent.user.domain + tag: set_process_parent_user_domain + copy_from: ocsf.actor.process.parent_process.user.domain + ignore_empty_value: true + - set: + field: process.parent.user.email + tag: set_process_parent_user_email + copy_from: ocsf.actor.process.parent_process.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_parent_process_user_email_addr_into_related_user + value: '{{{ocsf.actor.process.parent_process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.email_addr != null + - set: + field: process.parent.user.full_name + tag: set_process_parent_user_full_name + copy_from: ocsf.actor.process.parent_process.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_parent_process_user_full_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.full_name != null + - foreach: + field: ocsf.actor.process.parent_process.user.groups + if: ctx.ocsf?.actor?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.parent.user.group.id + tag: append_process_parent_user_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.actor.process.parent_process.user.groups + if: ctx.ocsf?.actor?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.parent.user.group.name + tag: append_process_parent_user_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - convert: + field: ocsf.actor.process.parent_process.euid + tag: convert_actor_process_parent_process_euid_to_string + type: string + ignore_missing: true + - append: + field: process.parent.user.id + tag: append_process_parent_user_id_from_actor_process_parent_process_euid + value: '{{{ocsf.actor.process.parent_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.euid != null + - append: + field: related.user + tag: append_actor_process_parent_process_euid_into_related_user + value: '{{{ocsf.actor.process.parent_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.euid != null + - append: + field: process.parent.user.id + tag: append_process_parent_user_id_from_actor_process_parent_process_uid + value: '{{{ocsf.actor.process.parent_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.uid != null + - append: + field: related.user + tag: append_actor_process_parent_process_uid_into_related_user + value: '{{{ocsf.actor.process.parent_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.uid != null + - set: + field: process.parent.user.name + tag: set_process_parnt_user_name + copy_from: ocsf.actor.process.parent_process.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_actor_process_parent_process_user_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.name != null + - convert: + field: ocsf.actor.process.parent_process.container.hash.algorithm_id + tag: convert_actor_process_parent_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.auid + tag: convert_actor_process_parent_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.container.size + tag: convert_actor_process_parent_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.file.accessor.account.type_id + tag: convert_actor_process_parent_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_actor_process_parent_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_accessor_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_accessor_uid_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.accessor?.uid != null + - convert: + field: ocsf.actor.process.parent_process.file.accessor.type_id + tag: convert_actor_process_parent_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.attributes + tag: convert_actor_process_parent_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.file.confidentiality_id + tag: convert_actor_process_parent_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.creator.account.type_id + tag: convert_actor_process_parent_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.creator.type_id + tag: convert_actor_process_parent_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.actor.process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_actor_process_parent_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.actor.process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_actor_process_parent_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.actor.process.parent_process.file.signature.algorithm_id + tag: convert_actor_process_parent_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_actor_process_parent_process_file_signature_value_into_related_hash + value: '{{{ocsf.actor.process.parent_process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.value != null + - date: + field: ocsf.actor.process.parent_process.file.signature.certificate.created_time_dt + target_field: ocsf.actor.process.parent_process.file.signature.certificate.created_time_dt + tag: date_actor_process_parent_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.actor.process.parent_process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.signature.certificate.created_time + target_field: ocsf.actor.process.parent_process.file.signature.certificate.created_time + tag: date_actor_process_parent_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.actor.process.parent_process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.signature.created_time_dt + target_field: ocsf.actor.process.parent_process.file.signature.created_time_dt + tag: date_actor_process_parent_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.created_time_dt != null && ctx.ocsf.actor.process.parent_process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.file.signature.created_time + target_field: ocsf.actor.process.parent_process.file.signature.created_time + tag: date_actor_process_parent_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.created_time != null && ctx.ocsf.actor.process.parent_process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.file.signature.digest.algorithm_id + tag: convert_actor_process_parent_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_actor_process_parent_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.actor.process.parent_process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.actor.process.parent_process.file.hashes + if: ctx.ocsf?.actor?.process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_actor_process_parent_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.modifier.account.type_id + tag: convert_actor_process_parent_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.modifier.type_id + tag: convert_actor_process_parent_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.owner.account.type_id + tag: convert_actor_process_parent_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.owner.type_id + tag: convert_actor_process_parent_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.file.is_system + tag: convert_actor_process_parent_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.file.type_id + tag: convert_actor_process_parent_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.integrity_id + tag: convert_actor_process_parent_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.namespace_pid + tag: convert_actor_process_parent_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.session.created_time_dt + target_field: ocsf.actor.process.parent_process.session.created_time_dt + tag: date_actor_process_parent_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.session?.created_time_dt != null && ctx.ocsf.actor.process.parent_process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.session.created_time + target_field: ocsf.actor.process.parent_process.session.created_time + tag: date_actor_process_parent_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.session?.created_time != null && ctx.ocsf.actor.process.parent_process.session.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.session.expiration_time_dt + target_field: ocsf.actor.process.parent_process.session.expiration_time_dt + tag: date_actor_process_parent_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.parent_process?.session?.expiration_time_dt != null && ctx.ocsf.actor.process.parent_process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.parent_process.session.expiration_time + target_field: ocsf.actor.process.parent_process.session.expiration_time + tag: date_actor_process_parent_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.parent_process?.session?.expiration_time != null && ctx.ocsf.actor.process.parent_process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.session.mfa + tag: convert_actor_process_parent_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.session.is_remote + tag: convert_actor_process_parent_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.parent_process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.parent_process.user.account.type_id + tag: convert_actor_process_parent_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.parent_process.user.type_id + tag: convert_actor_process_parent_process_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_actor_process_parent_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_creator_full_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_creator_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.creator?.name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_creator_uid_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_modifier_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_modifier_uid_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_actor_process_parent_process_file_owner_full_name_into_related_user + value: '{{{ocsf.actor.process.parent_process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_actor_process_parent_process_user_uid_alt_into_related_user + value: '{{{ocsf.actor.process.parent_process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.parent_process?.user?.uid_alt != null + - date: + field: ocsf.actor.process.session.created_time_dt + target_field: ocsf.actor.process.session.created_time_dt + tag: date_actor_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.session?.created_time_dt != null && ctx.ocsf.actor.process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.session.created_time + target_field: ocsf.actor.process.session.created_time + tag: date_actor_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.session?.created_time != null && ctx.ocsf.actor.process.session.created_time != '' + on_failure: + - remove: + field: ocsf.actor.process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.session.expiration_time_dt + target_field: ocsf.actor.process.session.expiration_time_dt + tag: date_actor_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.process?.session?.expiration_time_dt != null && ctx.ocsf.actor.process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.process.session.expiration_time + target_field: ocsf.actor.process.session.expiration_time + tag: date_actor_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.process?.session?.expiration_time != null && ctx.ocsf.actor.process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.actor.process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.session.mfa + tag: convert_actor_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.session.is_remote + tag: convert_actor_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.process.user.account.type_id + tag: convert_actor_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.process.user.type_id + tag: convert_actor_process_user_type_id_to_string + type: string + ignore_missing: true + - date: + field: ocsf.actor.session.created_time_dt + target_field: ocsf.actor.session.created_time_dt + tag: date_actor_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.session?.created_time_dt != null && ctx.ocsf.actor.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.session.created_time + target_field: ocsf.actor.session.created_time + tag: date_actor_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.session?.created_time != null && ctx.ocsf.actor.session.created_time != '' + on_failure: + - remove: + field: ocsf.actor.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.session.expiration_time_dt + target_field: ocsf.actor.session.expiration_time_dt + tag: date_actor_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.actor?.session?.expiration_time_dt != null && ctx.ocsf.actor.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.actor.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.actor.session.expiration_time + target_field: ocsf.actor.session.expiration_time + tag: date_actor_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.actor?.session?.expiration_time != null && ctx.ocsf.actor.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.actor.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.session.mfa + tag: convert_actor_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.session.is_remote + tag: convert_actor_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.actor.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.actor.user.account.type_id + tag: convert_actor_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.actor.user.type_id + tag: convert_actor_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_actor_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.actor.process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.actor.process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_actor_process_file_creator_full_name_into_related_user + value: '{{{ocsf.actor.process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_actor_process_file_creator_name_into_related_user + value: '{{{ocsf.actor.process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.creator?.name != null + - append: + field: related.user + tag: append_actor_process_file_creator_uid_into_related_user + value: '{{{ocsf.actor.process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_actor_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.actor.process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.actor.process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_actor_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.actor.process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_actor_process_file_modifier_name_into_related_user + value: '{{{ocsf.actor.process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_actor_process_file_modifier_uid_into_related_user + value: '{{{ocsf.actor.process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_actor_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.actor.process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_actor_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.actor.process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_actor_process_file_owner_full_name_into_related_user + value: '{{{ocsf.actor.process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_actor_process_user_uid_alt_into_related_user + value: '{{{ocsf.actor.process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.process?.user?.uid_alt != null + - append: + field: related.user + tag: append_actor_user_uid_alt_into_related_user + value: '{{{ocsf.actor.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.actor?.user?.uid_alt != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_attack.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_attack.yml new file mode 100644 index 00000000000..2776f5f575d --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_attack.yml @@ -0,0 +1,59 @@ +--- +description: Pipeline for processing Attack object. +# Attack object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/attack +processors: + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.tactics + ignore_failure: true + processor: + append: + field: threat.tactic.id + value: '{{{_ingest._value.uid}}}' + tag: append_attacks_tactics_uid_into_threat_tactic_id + allow_duplicates: false + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.tactics + ignore_failure: true + processor: + append: + field: threat.tactic.name + value: '{{{_ingest._value.name}}}' + tag: append_attacks_tactics_name_into_threat_tactic_name + allow_duplicates: false + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + append: + field: threat.technique.name + value: '{{{_ingest._value.technique.name}}}' + tag: append_attacks_technique_name_into_threat_technique_name + allow_duplicates: false + - foreach: + field: ocsf.attacks + if: ctx.ocsf?.attacks instanceof List + ignore_failure: true + processor: + append: + field: threat.technique.id + value: '{{{_ingest._value.technique.uid}}}' + tag: append_attacks_technique_uid_into_threat_technique_id + allow_duplicates: false +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_device.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_device.yml new file mode 100644 index 00000000000..5964cbeb6b4 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_device.yml @@ -0,0 +1,649 @@ +--- +description: Pipeline for processing Device object. +# Device object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/device +processors: + - set: + field: host.domain + copy_from: ocsf.device.domain + tag: set_host_domain + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{ocsf.device.domain}}}' + tag: append_device_domain_into_related_hosts + allow_duplicates: false + if: ctx.ocsf?.device?.domain != null + - set: + field: host.geo.city_name + copy_from: ocsf.device.location.city + tag: set_host_geo_city_name + ignore_empty_value: true + - set: + field: host.geo.continent_name + copy_from: ocsf.device.location.continent + tag: set_host_geo_continent_name + ignore_empty_value: true + - set: + field: host.geo.country_iso_code + copy_from: ocsf.device.location.country + tag: set_host_geo_country_iso_code + ignore_empty_value: true + - convert: + field: ocsf.device.location.coordinates + tag: convert_device_location_coordinates_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.location.coordinates + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.geo.location + copy_from: ocsf.device.location.coordinates + tag: set_host_geo_location + ignore_empty_value: true + - set: + field: host.geo.name + copy_from: ocsf.device.location.desc + tag: set_host_geo_name + ignore_empty_value: true + - set: + field: host.geo.postal_code + copy_from: ocsf.device.location.postal_code + tag: set_host_geo_postal_code + ignore_empty_value: true + - set: + field: host.geo.region_iso_code + copy_from: ocsf.device.location.region + tag: set_host_geo_region_iso_code + ignore_empty_value: true + - set: + field: host.hostname + copy_from: ocsf.device.hostname + tag: set_host_hostname + ignore_empty_value: true + - append: + field: related.hosts + value: '{{{ocsf.device.hostname}}}' + tag: append_device_hostname_into_related_hosts + allow_duplicates: false + if: ctx.ocsf?.device?.hostname != null + - set: + field: host.id + copy_from: ocsf.device.uid + tag: set_host_id + ignore_empty_value: true + - convert: + field: ocsf.device.ip + tag: convert_device_ip_to_ip + type: ip + ignore_missing: true + if: ctx.ocsf?.device?.ip != '' || ctx.ocsf.device.ip != '-' + on_failure: + - remove: + field: ocsf.device.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: host.ip + value: '{{{ocsf.device.ip}}}' + tag: append_device_ip_into_host_ip + allow_duplicates: false + if: ctx.ocsf?.device?.ip != null + - append: + field: related.ip + value: '{{{ocsf.device.ip}}}' + tag: append_device_ip_into_related_ip + allow_duplicates: false + if: ctx.ocsf?.device?.ip != null + - gsub: + field: ocsf.device.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_device_mac + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: ocsf.device.mac + tag: uppercase_device_mac + ignore_missing: true + if: ctx.ocsf?.device?.mac != '' + on_failure: + - remove: + field: ocsf.device.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: host.mac + value: '{{{ocsf.device.mac}}}' + tag: append_device_ip_into_host_mac + allow_duplicates: false + if: ctx.ocsf?.device?.mac != null + - lowercase: + field: ocsf.device.name + target_field: host.name + tag: lowercase_host_name + ignore_missing: true + if: ctx.ocsf?.device?.name != '' + on_failure: + - remove: + field: ocsf.device.name + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hosts + value: '{{{ocsf.device.name}}}' + tag: append_device_name_into_related_hosts + allow_duplicates: false + if: ctx.ocsf?.device?.name != null + - set: + field: host.os.name + copy_from: ocsf.device.os.name + tag: set_host_os_name + ignore_empty_value: true + - set: + field: host.os.type + copy_from: ocsf.device.os.type + tag: set_host_os_type + ignore_empty_value: true + if: ctx.ocsf?.device?.os?.type != null && ['Linux','Windows','Android','macOS','iOS'].contains(ctx.ocsf.device.os.type) + - lowercase: + field: host.os.type + tag: lowercase_host_os_type + ignore_missing: true + if: ctx.host?.os?.type != '' + on_failure: + - remove: + field: host.os.type + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.os.version + copy_from: ocsf.device.os.build + tag: set_host_os_version + ignore_empty_value: true + - set: + field: host.risk.static_level + copy_from: ocsf.device.risk_level + tag: set_host_risk_static_level + ignore_empty_value: true + - convert: + field: ocsf.device.risk_score + tag: convert_device_risk_score_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.risk_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: host.risk.static_score + copy_from: ocsf.device.risk_score + tag: set_host_risk_static_score + ignore_empty_value: true + - set: + field: host.type + copy_from: ocsf.device.type + tag: set_host_type + ignore_empty_value: true + - set: + field: network.vlan.id + copy_from: ocsf.device.vlan_uid + tag: set_network_vlan_id + ignore_empty_value: true + - date: + field: ocsf.device.created_time_dt + tag: date_device_created_time_dt + target_field: ocsf.device.created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.device?.created_time_dt != null && ctx.ocsf.device.created_time_dt != '' + on_failure: + - remove: + field: ocsf.device.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.created_time + tag: date_device_created_time + target_field: ocsf.device.created_time + formats: + - UNIX_MS + if: ctx.ocsf?.device?.created_time != null && ctx.ocsf.device.created_time != '' + on_failure: + - remove: + field: ocsf.device.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.first_seen_time_dt + tag: date_device_first_seen_time_dt + target_field: ocsf.device.first_seen_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.device?.first_seen_time_dt != null && ctx.ocsf.device.first_seen_time_dt != '' + on_failure: + - remove: + field: ocsf.device.first_seen_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.first_seen_time + tag: date_device_first_seen_time + target_field: ocsf.device.first_seen_time + formats: + - UNIX_MS + if: ctx.ocsf?.device?.first_seen_time != null && ctx.ocsf.device.first_seen_time != '' + on_failure: + - remove: + field: ocsf.device.first_seen_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.cpu_bits + tag: convert_device_hw_info_cpu_bits_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.cpu_bits + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.cpu_cores + tag: convert_device_hw_info_cpu_cores_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.cpu_cores + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.cpu_count + tag: convert_device_hw_info_cpu_count_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.cpu_count + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.cpu_speed + tag: convert_device_hw_info_cpu_speed_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.cpu_speed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.desktop_display.color_depth + tag: convert_device_hw_info_desktop_display_color_depth_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.desktop_display.color_depth + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.desktop_display.physical_height + tag: convert_device_hw_info_desktop_display_physical_height_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.desktop_display.physical_height + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.desktop_display.physical_orientation + tag: convert_device_hw_info_desktop_display_physical_orientation_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.desktop_display.physical_orientation + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.desktop_display.physical_width + tag: convert_device_hw_info_desktop_display_physical_width_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.desktop_display.physical_width + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.desktop_display.scale_factor + tag: convert_device_hw_info_desktop_display_scale_factor_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.desktop_display.scale_factor + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.keyboard_info.function_keys + tag: convert_device_hw_info_keyboard_info_function_keys_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.keyboard_info.function_keys + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.keyboard_info.keyboard_subtype + tag: convert_device_hw_info_keyboard_info_keyboard_subtype_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.keyboard_info.keyboard_subtype + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.hw_info.ram_size + tag: convert_device_hw_info_ram_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.hw_info.ram_size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.is_compliant + tag: convert_device_is_compliant_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.is_compliant + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.is_managed + tag: convert_device_is_managed_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.is_managed + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.is_personal + tag: convert_device_is_personal_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.is_personal + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.is_trusted + tag: convert_device_is_trusted_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.is_trusted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.last_seen_time_dt + tag: date_device_last_seen_time_dt + target_field: ocsf.device.last_seen_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.device?.last_seen_time_dt != null && ctx.ocsf.device.last_seen_time_dt != '' + on_failure: + - remove: + field: ocsf.device.last_seen_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.last_seen_time + tag: date_device_last_seen_time + target_field: ocsf.device.last_seen_time + formats: + - UNIX_MS + if: ctx.ocsf?.device?.last_seen_time != null && ctx.ocsf.device.last_seen_time != '' + on_failure: + - remove: + field: ocsf.device.last_seen_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.location.is_on_premises + tag: convert_device_location_is_on_premises_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.location.is_on_premises + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.modified_time_dt + tag: date_device_modified_time_dt + target_field: ocsf.device.modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.device?.modified_time_dt != null && ctx.ocsf.device.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.device.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.device.modified_time + tag: date_device_modified_time + target_field: ocsf.device.modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.device?.modified_time != null && ctx.ocsf.device.modified_time != '' + on_failure: + - remove: + field: ocsf.device.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + append: + field: related.hosts + value: '{{{_ingest._value.hostname}}}' + tag: append_device_network_interfaces_hostname_into_related_hosts + allow_duplicates: false + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.ip + tag: convert_device_network_interfaces_ip_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + append: + field: related.ip + value: '{{{_ingest._value.ip}}}' + tag: append_device_network_interfaces_ip_into_related_ip + allow_duplicates: false + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + gsub: + field: _ingest._value.mac + pattern: '[:.]' + replacement: '-' + tag: gsub_device_network_interfaces_mac + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + uppercase: + field: _ingest._value.mac + tag: uppercase_device_network_interfaces_mac + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.device.network_interfaces + if: ctx.ocsf?.device?.network_interfaces instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.type_id + tag: convert_device_network_interfaces_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.device.os.cpu_bits + tag: convert_device_os_cpu_bits_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.device.os.cpu_bits + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.device.os.sp_ver + tag: convert_device_os_sp_ver_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.device.os.type_id + tag: convert_device_os_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.device.risk_level_id + tag: convert_device_risk_level_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.device.type_id + tag: convert_device_type_id_to_string + type: string + ignore_missing: true +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_http_request.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_http_request.yml new file mode 100644 index 00000000000..a3aea6c0b5e --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_http_request.yml @@ -0,0 +1,131 @@ +--- +description: Pipeline for processing Http Request object. +# Http Request object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/http_request +processors: + - set: + field: http.request.id + tag: set_http_request_id + copy_from: ocsf.http_request.uid + ignore_empty_value: true + - set: + field: http.request.method + tag: set_http_request_method + copy_from: ocsf.http_request.http_method + ignore_empty_value: true + - set: + field: http.request.referrer + tag: set_http_request_referrer + copy_from: ocsf.http_request.referrer + ignore_empty_value: true + - set: + field: http.version + tag: set_http_version + copy_from: ocsf.http_request.version + ignore_empty_value: true + - set: + field: url.domain + tag: set_url_domain + copy_from: ocsf.http_request.url.hostname + ignore_empty_value: true + - append: + field: related.hosts + tag: append_url_domain_into_related_hosts + value: '{{{url.domain}}}' + allow_duplicates: false + if: ctx.url?.domain != null + - set: + field: url.original + tag: set_url_original + copy_from: ocsf.http_request.url.url_string + ignore_empty_value: true + - set: + field: url.path + tag: set_url_path + copy_from: ocsf.http_request.url.path + ignore_empty_value: true + - convert: + field: ocsf.http_request.url.port + tag: convert_http_request_url_port_to_long + type: long + ignore_missing: true + if: ctx.ocsf?.http_request?.url?.port != '' + on_failure: + - remove: + field: ocsf.http_request.url.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + allow_duplicates: false + - set: + field: url.port + tag: set_url_port + copy_from: ocsf.http_request.url.port + ignore_empty_value: true + - set: + field: url.query + tag: set_url_query + copy_from: ocsf.http_request.url.query_string + ignore_empty_value: true + - set: + field: url.scheme + tag: set_url_scheme + copy_from: ocsf.http_request.url.scheme + ignore_empty_value: true + - set: + field: url.subdomain + tag: set_url_subdomain + copy_from: ocsf.http_request.url.subdomain + ignore_empty_value: true + - user_agent: + field: ocsf.http_request.user_agent + ignore_missing: true + - set: + field: user_agent.original + tag: set_user_agent_original + copy_from: ocsf.http_request.user_agent + ignore_empty_value: true + - foreach: + field: ocsf.http_request.x_forwarded_for + if: ctx.ocsf?.http_request?.x_forwarded_for instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_http_request_x_forwarded_for_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.http_request.url.category_ids + if: ctx.ocsf?.http_request?.url?.category_ids instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_http_request_url_category_ids_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.http_request.x_forwarded_for + if: ctx.ocsf?.http_request?.x_forwarded_for instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_http_request_x_forwarded_for_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_malware.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_malware.yml new file mode 100644 index 00000000000..2e01c17422e --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_malware.yml @@ -0,0 +1,185 @@ +--- +description: Pipeline for processing Malware object. +# Malware object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/malware +processors: + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + date: + field: _ingest._value.created_time_dt + tag: date_malware_cves_created_time_dt + target_field: _ingest._value.created_time_dt + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.created_time_dt + ignore_missing: true + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + date: + field: _ingest._value.created_time + tag: date_malware_cves_created_time + target_field: _ingest._value.created_time + formats: + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.created_time + ignore_missing: true + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + convert: + field: _ingest._value.cvss.base_score + tag: convert_malware_cves_base_score_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.cvss.base_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.classification_ids + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_malware_classification_ids_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List && ctx.ocsf.class_uid != '2001' + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + append: + field: vulnerability.score.base + tag: append_malware_cves_cvss_base_score_into_vulnerability_score_base + value: '{{{_ingest._value.cvss.base_score}}}' + allow_duplicates: false + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + convert: + field: _ingest._value.cvss.overall_score + tag: convert_malware_cves_cvss_overall_score_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.cvss.overall_score + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List && ctx.ocsf.class_uid != '2001' + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + append: + field: vulnerability.score.version + tag: append_malware_cves_cvss_version_into_vulnerability_score_version + value: '{{{_ingest._value.cvss.version}}}' + allow_duplicates: false + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + date: + field: _ingest._value.modified_time_dt + tag: date_malware_cves_modified_time_dt + target_field: _ingest._value.modified_time_dt + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.modified_time_dt + ignore_missing: true + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + date: + field: _ingest._value.modified_time + tag: date_malware_cves_modified_time + target_field: _ingest._value.modified_time + formats: + - UNIX_MS + on_failure: + - remove: + field: _ingest._value.modified_time + ignore_missing: true + - foreach: + field: ocsf.malware + if: ctx.ocsf?.malware instanceof List && ctx.ocsf.class_uid != '2001' + ignore_failure: true + processor: + foreach: + field: _ingest._value.cves + ignore_failure: true + processor: + append: + field: vulnerability.id + tag: append_malware_cves_uid_into_vulnerability_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_connection_info.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_connection_info.yml new file mode 100644 index 00000000000..692e69d8fe7 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_connection_info.yml @@ -0,0 +1,105 @@ +--- +description: Pipeline for processing Network Connection object. +# Network Connection object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/network_connection_info +processors: + - convert: + field: ocsf.connection_info.boundary_id + tag: convert_connection_info_boundary_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.connection_info.direction_id + tag: convert_connection_info_direction_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.connection_info.protocol_ver_id + tag: convert_connection_info_protocol_ver_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.connection_info.protocol_num + tag: convert_connection_info_protocol_num_to_long + type: string + ignore_missing: true + - convert: + field: ocsf.connection_info.tcp_flags + tag: convert_connection_info_tcp_flags_to_long + type: long + ignore_missing: true + if: ctx.ocsf?.connection_info?.tcp_flags != '' + on_failure: + - remove: + field: ocsf.connection_info.tcp_flags + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - lowercase: + field: ocsf.connection_info.protocol_ver + tag: lowercase_ocsf_connection_info_protocol_ver + target_field: network.type + ignore_missing: true + if: ctx.ocsf?.connection_info?.protocol_ver != '' + on_failure: + - remove: + field: ocsf.connection_info.protocol_ver + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - lowercase: + field: ocsf.connection_info.protocol_name + tag: lowercase_ocsf_connection_info_protocol_name + target_field: network.transport + ignore_missing: true + if: ctx.ocsf?.connection_info?.protocol_name != '' + on_failure: + - remove: + field: ocsf.connection_info.protocol_name + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.iana_number + tag: set_network_iana_number + copy_from: ocsf.connection_info.protocol_num + ignore_empty_value: true + - append: + field: network.direction + tag: append_connection_info_boundary_into_network_direction + value: internal + allow_duplicates: false + if: ctx.ocsf?.connection_info?.boundary != null && ctx.ocsf.connection_info.boundary == 'Internal' + - append: + field: network.direction + tag: append_connection_info_boundary_into_network_direction + value: external + allow_duplicates: false + if: ctx.ocsf?.connection_info?.boundary != null && ctx.ocsf.connection_info.boundary == 'External' + - append: + field: network.direction + tag: append_connection_info_direction_into_network_direction + value: inbound + allow_duplicates: false + if: ctx.ocsf?.connection_info?.direction != null && ctx.ocsf.connection_info.direction == 'Inbound' + - append: + field: network.direction + tag: append_connection_info_direction_into_network_direction + value: outbound + allow_duplicates: false + if: ctx.ocsf?.connection_info?.direction != null && ctx.ocsf.connection_info.direction == 'Outbound' + - append: + field: network.direction + tag: append_unknown_value_into_network_direction + value: unknown + allow_duplicates: false + if: (ctx.ocsf?.connection_info?.direction != null && ctx.ocsf.connection_info.direction == 'Unknown') || (ctx.ocsf?.connection_info?.boundary != null && ctx.ocsf.connection_info.boundary == 'Unknown') +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_endpoint.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_endpoint.yml new file mode 100644 index 00000000000..fab55380e74 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_network_endpoint.yml @@ -0,0 +1,397 @@ +--- +description: Pipeline for processing Network Endpoint object. +# Network Endpoint object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/network_endpoint +processors: + - append: + field: source.domain + tag: append_src_endpoint_domain_into_source_domain + value: '{{{ocsf.src_endpoint.domain}}}' + allow_duplicates: false + if: ctx.ocsf?.src_endpoint?.domain != null + - set: + field: source.geo.city_name + tag: set_source_geo_city_name + copy_from: ocsf.src_endpoint.location.city + ignore_empty_value: true + - set: + field: source.geo.continent_name + tag: set_source_geo_continent_name + copy_from: ocsf.src_endpoint.location.continent + ignore_empty_value: true + - foreach: + field: ocsf.src_endpoint.location.coordinates + if: ctx.ocsf?.src_endpoint?.location?.coordinates instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_src_endpoint_location_coordinates_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.geo.location + tag: set_source_geo_location + copy_from: ocsf.src_endpoint.location.coordinates + ignore_empty_value: true + - set: + field: source.geo.country_iso_code + tag: set_source_geo_country_iso_code + copy_from: ocsf.src_endpoint.location.country + ignore_empty_value: true + - set: + field: source.geo.name + tag: set_source_geo_name + copy_from: ocsf.src_endpoint.location.desc + ignore_empty_value: true + - convert: + field: ocsf.src_endpoint.location.is_on_premises + tag: convert_src_endpoint_location_is_on_premises_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.src_endpoint.location.is_on_premises + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.geo.postal_code + tag: set_source_geo_postal_code + copy_from: ocsf.src_endpoint.location.postal_code + ignore_empty_value: true + - set: + field: source.geo.region_iso_code + tag: set_source_geo_region_iso_code + copy_from: ocsf.src_endpoint.location.region + ignore_empty_value: true + - append: + field: source.domain + tag: append_src_endpoint_hostname_into_source_domain + value: '{{{ocsf.src_endpoint.hostname}}}' + allow_duplicates: false + if: ctx.ocsf?.src_endpoint?.hostname != null + - foreach: + field: source.domain + if: ctx.source?.domain instanceof List + ignore_failure: true + processor: + append: + field: related.hosts + tag: append_source_domain_into_related_hosts + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: ocsf.src_endpoint.ip + tag: convert_src_endpoint_ip_to_ip + type: ip + ignore_missing: true + if: ctx.ocsf?.src_endpoint?.ip != '' || ctx.ocsf.src_endpoint.ip != '-' + on_failure: + - remove: + field: ocsf.src_endpoint.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_src_endpoint_ip_into_related_ip + value: '{{{ocsf.src_endpoint.ip}}}' + allow_duplicates: false + if: ctx.ocsf?.src_endpoint?.ip != null + - set: + field: source.ip + tag: set_source_ip + copy_from: ocsf.src_endpoint.ip + ignore_empty_value: true + - foreach: + field: ocsf.src_endpoint.intermediate_ips + if: ctx.ocsf?.src_endpoint?.intermediate_ips instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_src_endpoint_intermediate_ips_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.src_endpoint.intermediate_ips + if: ctx.ocsf?.src_endpoint?.intermediate_ips instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_src_endpoint_intermediate_ips_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - gsub: + field: ocsf.src_endpoint.mac + tag: gsub_src_endpoint_mac + pattern: '[-:.]' + replacement: '-' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: ocsf.src_endpoint.mac + tag: uppercase_src_endpoint_mac + ignore_missing: true + if: ctx.ocsf?.src_endpoint?.mac != '' + on_failure: + - remove: + field: ocsf.src_endpoint.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.mac + tag: set_source_mac + copy_from: ocsf.src_endpoint.mac + ignore_empty_value: true + - convert: + field: ocsf.src_endpoint.port + tag: convert_src_endpoint_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.src_endpoint.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.port + tag: set_source_port + copy_from: ocsf.src_endpoint.port + ignore_empty_value: true + - append: + field: network.application + tag: append_src_endpoint_svc_name_into_network_application + value: '{{{ocsf.src_endpoint.svc_name}}}' + allow_duplicates: false + if: ctx.ocsf?.src_endpoint?.svc_name != null + - append: + field: destination.domain + tag: append_dst_endpoint_domain_into_destination_domain + value: '{{{ocsf.dst_endpoint.domain}}}' + allow_duplicates: false + if: ctx.ocsf?.dst_endpoint?.domain != null + - set: + field: destination.geo.city_name + tag: set_destination_geo_city_name + copy_from: ocsf.dst_endpoint.location.city + ignore_empty_value: true + - set: + field: destination.geo.continent_name + tag: set_destination_geo_continent_name + copy_from: ocsf.dst_endpoint.location.continent + ignore_empty_value: true + - foreach: + field: ocsf.dst_endpoint.location.coordinates + if: ctx.ocsf?.dst_endpoint?.location?.coordinates instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_dst_endpoint_location_coordinates_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.geo.location + tag: set_destination_geo_location + copy_from: ocsf.dst_endpoint.location.coordinates + ignore_empty_value: true + - set: + field: destination.geo.country_iso_code + tag: set_destination_geo_country_iso_code + copy_from: ocsf.dst_endpoint.location.country + ignore_empty_value: true + - set: + field: destination.geo.name + tag: set_destination_geo_name + copy_from: ocsf.dst_endpoint.location.desc + ignore_empty_value: true + - convert: + field: ocsf.dst_endpoint.location.is_on_premises + tag: convert_dst_endpoint_location_is_on_premises_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.dst_endpoint.location.is_on_premises + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.geo.postal_code + tag: set_destination_geo_postal_code + copy_from: ocsf.dst_endpoint.location.postal_code + ignore_empty_value: true + - set: + field: destination.geo.region_iso_code + tag: set_destination_geo_region_iso_code + copy_from: ocsf.dst_endpoint.location.region + ignore_empty_value: true + - append: + field: destination.domain + tag: append_dst_endpoint_hostname_into_destination_domain + value: '{{{ocsf.dst_endpoint.hostname}}}' + allow_duplicates: false + if: ctx.ocsf?.dst_endpoint?.hostname != null + - foreach: + field: destination.domain + if: ctx.destination?.domain instanceof List + ignore_failure: true + processor: + append: + field: related.hosts + tag: append_destination_domain_into_related_hosts + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: ocsf.dst_endpoint.ip + tag: convert_dst_endpoint_ip_to_ip + type: ip + ignore_missing: true + if: ctx.ocsf?.dst_endpoint?.ip != '' || ctx.ocsf.dst_endpoint.ip != '-' + on_failure: + - remove: + field: ocsf.dst_endpoint.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_dst_endpoint_ip_into_related_ip + value: '{{{ocsf.dst_endpoint.ip}}}' + allow_duplicates: false + if: ctx.ocsf?.dst_endpoint?.ip != null + - set: + field: destination.ip + tag: set_destination_ip + copy_from: ocsf.dst_endpoint.ip + ignore_empty_value: true + - foreach: + field: ocsf.dst_endpoint.intermediate_ips + if: ctx.ocsf?.dst_endpoint?.intermediate_ips instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_dst_endpoint_intermediate_ips_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.dst_endpoint.intermediate_ips + if: ctx.ocsf?.dst_endpoint?.intermediate_ips instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_dst_endpoint_intermediate_ips_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - gsub: + field: ocsf.dst_endpoint.mac + tag: gsub_dst_endpoint_mac + pattern: '[-:.]' + replacement: '-' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: ocsf.dst_endpoint.mac + tag: uppercase_dst_endpoint_mac + ignore_missing: true + if: ctx.ocsf?.dst_endpoint?.mac != '' + on_failure: + - remove: + field: ocsf.dst_endpoint.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.mac + tag: set_destination_mac + copy_from: ocsf.dst_endpoint.mac + ignore_empty_value: true + - convert: + field: ocsf.dst_endpoint.port + tag: convert_dst_endpoint_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.dst_endpoint.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.port + tag: set_destination_port + copy_from: ocsf.dst_endpoint.port + ignore_empty_value: true + - append: + field: network.application + tag: append_dst_endpoint_domain_svc_name_into_network_application + value: '{{{ocsf.dst_endpoint.svc_name}}}' + allow_duplicates: false + if: ctx.ocsf?.dst_endpoint?.svc_name != null + - lowercase: + field: network.application + tag: lowercase_network_application + ignore_missing: true + if: ctx.network?.application != '' + on_failure: + - remove: + field: network.application + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_process.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_process.yml new file mode 100644 index 00000000000..c8b24af6957 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_process.yml @@ -0,0 +1,1877 @@ +--- +description: Pipeline for processing Process object. +# Process object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/process +processors: + - set: + field: container.id + tag: set_container_id + copy_from: ocsf.process.container.uid + ignore_empty_value: true + - script: + description: Set value for container.image.hash.all. + if: ctx.ocsf?.process?.container?.hash?.value != null + tag: script_container_image_hash_all + lang: painless + params: + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + SHA-512: sha512 + CTPH: ssdeep + TLSH: tlsh + source: |- + if (params.get(ctx.ocsf.process.container.hash.algorithm) == null) { + return; + } + if (ctx.container == null) { + ctx.container = new HashMap(); + } + if (ctx.container.image == null) { + ctx.container.image = new HashMap(); + } + if (ctx.container.image.hash == null) { + ctx.container.image.hash = new HashMap(); + } + def list = new ArrayList(); + def value = params.get(ctx.ocsf.process.container.hash.algorithm) + ':' + ctx.ocsf.process.container.hash.value; + list.add(value); + ctx.container.image.hash.all = list; + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_process_container_hash_value_into_related_hash + value: '{{{ocsf.process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.container?.hash?.value != null + - set: + field: container.image.name + tag: set_container_image_name + copy_from: ocsf.process.container.image.name + ignore_empty_value: true + - append: + field: container.image.tag + tag: append_process_container_image_tag_into_container_image_tag + value: '{{{ocsf.process.container.image.tag}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.container?.image?.tag != null + - set: + field: container.labels + tag: set_container_labels + copy_from: ocsf.process.container.image.labels + ignore_empty_value: true + - set: + field: orchestrator.type + tag: set_orchestrator_type + copy_from: ocsf.process.container.orchestrator + ignore_empty_value: true + - set: + field: container.name + tag: set_container_name + copy_from: ocsf.process.container.name + ignore_empty_value: true + - set: + field: container.runtime + tag: set_container_runtime + copy_from: ocsf.process.container.runtime + ignore_empty_value: true + - date: + field: ocsf.process.file.accessed_time_dt + target_field: ocsf.process.file.accessed_time_dt + tag: date_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.accessed_time_dt != null && ctx.ocsf.process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.accessed + tag: set_file_accessed_from_process_file_accessed_time_dt + copy_from: ocsf.process.file.accessed_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.file.accessed_time + target_field: ocsf.process.file.accessed_time + tag: date_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.accessed_time != null && ctx.ocsf.process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.accessed + tag: set_file_accessed_from_process_file_accessed_time + copy_from: ocsf.process.file.accessed_time + ignore_empty_value: true + - date: + field: ocsf.process.file.created_time_dt + target_field: ocsf.process.file.created_time_dt + tag: date_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.created_time_dt != null && ctx.ocsf.process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created_process_file_created_time_dt + copy_from: ocsf.process.file.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.file.created_time + target_field: ocsf.process.file.created_time + tag: date_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.created_time != null && ctx.ocsf.process.file.created_time != '' + on_failure: + - remove: + field: ocsf.process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created_process_file_created_time + copy_from: ocsf.process.file.created_time + ignore_empty_value: true + - set: + field: file.directory + tag: set_file_directory + copy_from: ocsf.process.file.parent_folder + ignore_empty_value: true + - script: + description: Set value for file.hash.*. + if: ctx.ocsf?.process?.file?.hashes != null + tag: script_file_hash_* + lang: painless + params: + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + SHA-512: sha512 + CTPH: ssdeep + TLSH: tlsh + source: |- + if (ctx.file == null) { + ctx.file = new HashMap(); + } + if (ctx.file.hash == null) { + ctx.file.hash = new HashMap(); + } + Map map = new HashMap(); + def hashes = ctx.ocsf.process.file.get('hashes'); + for (def hash: hashes) { + def hashAlgorithm = params.get(hash.get('algorithm')); + if (hashAlgorithm == null) { + continue; + } + if (map.containsKey(hashAlgorithm)) { + map[hashAlgorithm].add(hash.get('value')); + } else { + Set set = new HashSet(); + set.add(hash.get('value')); + map.put(hashAlgorithm, set); + } + } + ctx.file.hash = map; + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.process.file.hashes + if: ctx.ocsf?.process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - set: + field: file.inode + tag: set_file_inode + copy_from: ocsf.process.file.uid + ignore_empty_value: true + - set: + field: file.mime_type + tag: set_file_mime_type + copy_from: ocsf.process.file.mime_type + ignore_empty_value: true + - date: + field: ocsf.process.file.modified_time_dt + target_field: ocsf.process.file.modified_time_dt + tag: date_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.modified_time_dt != null && ctx.ocsf.process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime_from_process_file_modified_time_dt + copy_from: ocsf.process.file.modified_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.file.modified_time + target_field: ocsf.process.file.modified_time + tag: date_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.modified_time != null && ctx.ocsf.process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime_from_process_file_modified_time + copy_from: ocsf.process.file.modified_time + ignore_empty_value: true + - set: + field: file.name + tag: set_file_name + copy_from: ocsf.process.file.name + ignore_empty_value: true + - set: + field: file.owner + tag: set_file_owner + copy_from: ocsf.process.file.owner.name + ignore_empty_value: true + - append: + field: related.user + tag: append_process_file_owner_name_into_related_user + value: '{{{ocsf.process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.owner?.name != null + - set: + field: file.path + tag: set_file_path + copy_from: ocsf.process.file.path + ignore_empty_value: true + - convert: + field: ocsf.process.file.size + tag: convert_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.size + tag: set_file_size + copy_from: ocsf.process.file.size + ignore_empty_value: true + - set: + field: file.type + tag: set_file_type + copy_from: ocsf.process.file.type + ignore_empty_value: true + - set: + field: file.uid + tag: set_file_uid + copy_from: ocsf.process.file.owner.uid + ignore_empty_value: true + - append: + field: related.user + tag: append_process_file_owner_uid_into_related_user + value: '{{{ocsf.process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.owner?.uid != null + - set: + field: file.x509.issuer.distinguished_name + tag: set_file_x509_issuer_distinguished_name + copy_from: ocsf.process.file.signature.certificate.issuer + ignore_empty_value: true + - date: + field: ocsf.process.file.signature.certificate.expiration_time_dt + target_field: ocsf.process.file.signature.certificate.expiration_time_dt + tag: date_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_after + tag: set_file_x509_not_after_from_process_file_signature_certificate_expiration_time_dt + copy_from: ocsf.process.file.signature.certificate.expiration_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.file.signature.certificate.expiration_time + target_field: ocsf.process.file.signature.certificate.expiration_time + tag: date_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.x509.not_after + tag: set_file_x509_not_after_from_process_file_signature_certificate_expiration_time + copy_from: ocsf.process.file.signature.certificate.expiration_time + ignore_empty_value: true + - set: + field: file.x509.serial_number + tag: set_file_x509_serial_number + copy_from: ocsf.process.file.signature.certificate.serial_number + ignore_empty_value: true + - set: + field: file.x509.subject.distinguished_name + tag: set_file_x509_subject_distinguished_name + copy_from: ocsf.process.file.signature.certificate.subject + ignore_empty_value: true + - set: + field: file.x509.version_number + tag: set_file_x509_version_number + copy_from: ocsf.process.file.signature.certificate.version + ignore_empty_value: true + - set: + field: process.command_line + tag: set_process_command_line + copy_from: ocsf.process.cmd_line + ignore_empty_value: true + - date: + field: ocsf.process.terminated_time_dt + target_field: ocsf.process.terminated_time_dt + tag: date_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.terminated_time_dt != null && ctx.ocsf.process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end_from_process_terminated_time_dt + copy_from: ocsf.process.terminated_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.terminated_time + target_field: ocsf.process.terminated_time + tag: date_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.terminated_time != null && ctx.ocsf.process.terminated_time != '' + on_failure: + - remove: + field: ocsf.process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.end + tag: set_process_end_from_process_terminated_time + copy_from: ocsf.process.terminated_time + ignore_empty_value: true + - convert: + field: ocsf.process.egid + tag: convert_process_egid_to_string + type: string + ignore_missing: true + - append: + field: process.group.id + tag: append_process_group_id_from_process_egid + value: '{{{ocsf.process.egid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.egid != null + - append: + field: process.group.id + tag: append_process_group_id_from_process_group_uid + value: '{{{ocsf.process.group.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.group?.uid != null + - set: + field: process.group.name + tag: set_process_group_name + copy_from: ocsf.process.group.name + ignore_empty_value: true + - set: + field: process.name + tag: set_process_name + copy_from: ocsf.process.name + ignore_empty_value: true + - convert: + field: ocsf.process.pid + tag: convert_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.pid + tag: set_process_pid + copy_from: ocsf.process.pid + ignore_empty_value: true + - date: + field: ocsf.process.created_time_dt + target_field: ocsf.process.created_time_dt + tag: date_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.created_time_dt != null && ctx.ocsf.process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start_from_process_created_time_dt + copy_from: ocsf.process.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.created_time + target_field: ocsf.process.created_time + tag: date_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.created_time != null && ctx.ocsf.process.created_time != '' + on_failure: + - remove: + field: ocsf.process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.start + tag: set_process_start_from_process_created_time + copy_from: ocsf.process.created_time + ignore_empty_value: true + - convert: + field: ocsf.process.tid + tag: convert_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.thread.id + tag: set_process_thread_id + copy_from: ocsf.process.tid + ignore_empty_value: true + - set: + field: process.entity_id + tag: set_process_entity_id + copy_from: ocsf.process.uid + ignore_empty_value: true + - set: + field: process.user.domain + tag: set_process_user_domain + copy_from: ocsf.process.user.domain + ignore_empty_value: true + - set: + field: process.user.email + tag: set_process_user_email + copy_from: ocsf.process.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_process_user_email_addr_into_related_user + value: '{{{ocsf.process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.email_addr != null + - set: + field: process.user.full_name + tag: set_process_user_full_name + copy_from: ocsf.process.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_process_user_full_name_into_related_user + value: '{{{ocsf.process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.full_name != null + - foreach: + field: ocsf.process.user.groups + if: ctx.ocsf?.process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.user.group.id + tag: append_process_user_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.process.user.groups + if: ctx.ocsf?.process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.user.group.name + tag: append_process_user_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - convert: + field: ocsf.process.euid + tag: convert_process_euid_to_string + type: string + ignore_missing: true + - append: + field: process.user.id + tag: append_process_user_id_from_process_euid + value: '{{{ocsf.process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.euid != null + - append: + field: related.user + tag: append_process_euid_into_related_user + value: '{{{ocsf.process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.euid != null + - append: + field: process.user.id + tag: append_process_user_id_from_process_uid + value: '{{{ocsf.process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.uid != null + - append: + field: related.user + tag: append_process_uid_into_related_user + value: '{{{ocsf.process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.uid != null + - set: + field: process.user.name + tag: set_process_user_name + copy_from: ocsf.process.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_process_user_name_into_related_user + value: '{{{ocsf.process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.name != null + - convert: + field: ocsf.process.container.hash.algorithm_id + tag: convert_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.auid + tag: convert_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.container.size + tag: convert_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.file.accessor.account.type_id + tag: convert_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_process_file_accessor_name_into_related_user + value: '{{{ocsf.process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_process_file_accessor_uid_into_related_user + value: '{{{ocsf.process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.accessor?.uid != null + - convert: + field: ocsf.process.file.accessor.type_id + tag: convert_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.attributes + tag: convert_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.file.confidentiality_id + tag: convert_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.creator.account.type_id + tag: convert_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.creator.type_id + tag: convert_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.process.file.signature.certificate.fingerprints + if: ctx.ocsf?.process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.process.file.signature.certificate.fingerprints + if: ctx.ocsf?.process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.process.file.signature.algorithm_id + tag: convert_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_process_file_signature_value_into_related_hash + value: '{{{ocsf.process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.signature?.value != null + - date: + field: ocsf.process.file.signature.certificate.created_time_dt + target_field: ocsf.process.file.signature.certificate.created_time_dt + tag: date_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.file.signature.certificate.created_time + target_field: ocsf.process.file.signature.certificate.created_time + tag: date_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.file.signature.created_time_dt + target_field: ocsf.process.file.signature.created_time_dt + tag: date_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.file?.signature?.created_time_dt != null && ctx.ocsf.process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.file.signature.created_time + target_field: ocsf.process.file.signature.created_time + tag: date_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.file?.signature?.created_time != null && ctx.ocsf.process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.file.signature.digest.algorithm_id + tag: convert_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.process.file.hashes + if: ctx.ocsf?.process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.modifier.account.type_id + tag: convert_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.file.modifier.account.type_id + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.file.modifier.type_id + tag: convert_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.owner.account.type_id + tag: convert_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.owner.type_id + tag: convert_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.file.is_system + tag: convert_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.file.type_id + tag: convert_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.integrity_id + tag: convert_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.namespace_pid + tag: convert_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Stringify the parent_process object if its depth_limit is greater than 20. + if: ctx.ocsf?.process?.parent_process != null + tag: script_process_parent_process_stringify + lang: painless + source: |- + def process = ctx.ocsf.process.parent_process; + def count = 0; + while (true) { + if (process != null && process.parent_process != null) { + count += 1; + process = process.parent_process; + } else { + break; + } + } + if (count >= 15) { + ctx.ocsf.process.parent_process.put("parent_process_keyword", ctx.ocsf.process.parent_process.parent_process.toString()); + ctx.ocsf.process.parent_process.remove("parent_process"); + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hash + tag: append_process_parent_process_container_hash_value_into_related_hash + value: '{{{ocsf.process.parent_process.container.hash.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.container?.hash?.value != null + - date: + field: ocsf.process.parent_process.file.accessed_time_dt + target_field: ocsf.process.parent_process.file.accessed_time_dt + tag: date_process_parent_process_file_accessed_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.accessed_time_dt != null && ctx.ocsf.process.parent_process.file.accessed_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.accessed_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.accessed_time + target_field: ocsf.process.parent_process.file.accessed_time + tag: date_process_parent_process_file_accessed_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.accessed_time != null && ctx.ocsf.process.parent_process.file.accessed_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.accessed_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.created_time_dt + target_field: ocsf.process.parent_process.file.created_time_dt + tag: date_process_parent_process_file_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.created_time_dt != null && ctx.ocsf.process.parent_process.file.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.created_time + target_field: ocsf.process.parent_process.file.created_time + tag: date_process_parent_process_file_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.created_time != null && ctx.ocsf.process.parent_process.file.created_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.process.parent_process.file.hashes + if: ctx.ocsf?.process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_process_parent_process_file_hashes_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - date: + field: ocsf.process.parent_process.file.modified_time_dt + target_field: ocsf.process.parent_process.file.modified_time_dt + tag: date_process_parent_process_file_modified_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.modified_time_dt != null && ctx.ocsf.process.parent_process.file.modified_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.modified_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.modified_time + target_field: ocsf.process.parent_process.file.modified_time + tag: date_process_parent_process_file_modified_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.modified_time != null && ctx.ocsf.process.parent_process.file.modified_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.modified_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_process_parent_process_file_owner_name_into_related_user + value: '{{{ocsf.process.parent_process.file.owner.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.owner?.name != null + - convert: + field: ocsf.process.parent_process.file.size + tag: convert_process_parent_process_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.file.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.user + tag: append_process_parent_process_file_owner_uid_into_related_user + value: '{{{ocsf.process.parent_process.file.owner.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.owner?.uid != null + - date: + field: ocsf.process.parent_process.file.signature.certificate.expiration_time_dt + target_field: ocsf.process.parent_process.file.signature.certificate.expiration_time_dt + tag: date_process_parent_process_file_signature_certificate_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.expiration_time_dt != null && ctx.ocsf.process.parent_process.file.signature.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.signature.certificate.expiration_time + target_field: ocsf.process.parent_process.file.signature.certificate.expiration_time + tag: date_process_parent_process_file_signature_certificate_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.expiration_time != null && ctx.ocsf.process.parent_process.file.signature.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.command_line + tag: set_process_parent_command_line + copy_from: ocsf.process.parent_process.cmd_line + ignore_empty_value: true + - date: + field: ocsf.process.parent_process.terminated_time_dt + target_field: ocsf.process.parent_process.terminated_time_dt + tag: date_process_parent_process_terminated_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.terminated_time_dt != null && ctx.ocsf.process.parent_process.terminated_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.terminated_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.end + tag: set_process_parent_end_from_process_parent_process_terminated_time_dt + copy_from: ocsf.process.parent_process.terminated_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.parent_process.terminated_time + target_field: ocsf.process.parent_process.terminated_time + tag: date_process_parent_process_terminated_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.terminated_time != null && ctx.ocsf.process.parent_process.terminated_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.terminated_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.end + tag: set_process_parent_process_end_from_process_terminated_time + copy_from: ocsf.process.parent_process.terminated_time + ignore_empty_value: true + - convert: + field: ocsf.process.parent_process.egid + tag: convert_process_parent_process_egid_to_string + type: string + ignore_missing: true + - append: + field: process.parent.group.id + tag: append_process_parent_group_id_from_process_parent_process_egid + value: '{{{ocsf.process.parent_process.egid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.egid != null + - append: + field: process.parent.group.id + tag: append_process_parent_group_id_from_process_parent_process_group_uid + value: '{{{ocsf.process.parent_process.group.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.group?.uid != null + - set: + field: process.parent.group.name + tag: set_process_parent_group_name + copy_from: ocsf.process.parent_process.group.name + ignore_empty_value: true + - set: + field: process.parent.name + tag: set_process_parent_name + copy_from: ocsf.process.parent_process.name + ignore_empty_value: true + - convert: + field: ocsf.process.parent_process.pid + tag: convert_process_parent_process_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.pid + tag: set_process_parent_pid + copy_from: ocsf.process.parent_process.pid + ignore_empty_value: true + - date: + field: ocsf.process.parent_process.created_time_dt + target_field: ocsf.process.parent_process.created_time_dt + tag: date_process_parent_process_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.created_time_dt != null && ctx.ocsf.process.parent_process.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.start + tag: set_process_parent_start_from_process_parent_process_created_time_dt + copy_from: ocsf.process.parent_process.created_time_dt + ignore_empty_value: true + - date: + field: ocsf.process.parent_process.created_time + target_field: ocsf.process.parent_process.created_time + tag: date_process_parent_process_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.created_time != null && ctx.ocsf.process.parent_process.created_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.start + tag: set_process_parent_process_start_from_process_created_time + copy_from: ocsf.process.parent_process.created_time + ignore_empty_value: true + - convert: + field: ocsf.process.parent_process.tid + tag: convert_process_parent_process_tid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.tid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.parent.thread.id + tag: set_process_parent_thread_id + copy_from: ocsf.process.parent_process.tid + ignore_empty_value: true + - set: + field: process.parent.entity_id + tag: set_process_parent_entity_id + copy_from: ocsf.process.parent_process.uid + ignore_empty_value: true + - set: + field: process.parent.user.domain + tag: set_process_parent_user_domain + copy_from: ocsf.process.parent_process.user.domain + ignore_empty_value: true + - set: + field: process.parent.user.email + tag: set_process_parent_user_email + copy_from: ocsf.process.parent_process.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_process_parent_process_user_email_addr_into_related_user + value: '{{{ocsf.process.parent_process.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.email_addr != null + - set: + field: process.parent.user.full_name + tag: set_process_parent_user_full_name + copy_from: ocsf.process.parent_process.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_process_parent_process_user_full_name_into_related_user + value: '{{{ocsf.process.parent_process.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.full_name != null + - foreach: + field: ocsf.process.parent_process.user.groups + if: ctx.ocsf?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.parent.user.group.id + tag: append_process_parent_user_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.process.parent_process.user.groups + if: ctx.ocsf?.process?.parent_process?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: process.parent.user.group.name + tag: append_process_parent_user_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - convert: + field: ocsf.process.parent_process.euid + tag: convert_process_parent_process_euid_to_string + type: string + ignore_missing: true + - append: + field: process.parent.user.id + tag: append_process_parent_user_id_from_process_parent_process_euid + value: '{{{ocsf.process.parent_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.euid != null + - append: + field: related.user + tag: append_process_parent_process_euid_into_related_user + value: '{{{ocsf.process.parent_process.euid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.euid != null + - append: + field: process.parent.user.id + tag: append_process_parent_user_id_from_process_parent_process_uid + value: '{{{ocsf.process.parent_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.uid != null + - append: + field: related.user + tag: append_process_parent_process_uid_into_related_user + value: '{{{ocsf.process.parent_process.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.uid != null + - set: + field: process.parent.user.name + tag: set_process_parnt_user_name + copy_from: ocsf.process.parent_process.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_process_parent_process_user_name_into_related_user + value: '{{{ocsf.process.parent_process.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.name != null + - convert: + field: ocsf.process.parent_process.container.hash.algorithm_id + tag: convert_process_parent_process_container_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.auid + tag: convert_process_parent_process_auid_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.container.size + tag: convert_process_parent_process_container_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.container.size + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.file.accessor.account.type_id + tag: convert_process_parent_process_file_accessor_account_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_process_parent_process_file_accessor_uid_alt_into_related_user + value: '{{{ocsf.process.parent_process.file.accessor.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.accessor?.uid_alt != null + - append: + field: related.user + tag: append_process_parent_process_file_accessor_email_addr_into_related_user + value: '{{{ocsf.process.parent_process.file.accessor.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.accessor?.email_addr != null + - append: + field: related.user + tag: append_process_parent_process_file_accessor_full_name_into_related_user + value: '{{{ocsf.process.parent_process.file.accessor.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.accessor?.full_name != null + - append: + field: related.user + tag: append_process_parent_process_file_accessor_name_into_related_user + value: '{{{ocsf.process.parent_process.file.accessor.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.accessor?.name != null + - append: + field: related.user + tag: append_process_parent_process_file_accessor_uid_into_related_user + value: '{{{ocsf.process.parent_process.file.accessor.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.accessor?.uid != null + - convert: + field: ocsf.process.parent_process.file.accessor.type_id + tag: convert_process_parent_process_file_accessor_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.attributes + tag: convert_process_parent_process_file_attributes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.file.attributes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.file.confidentiality_id + tag: convert_process_parent_process_file_confidentiality_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.creator.account.type_id + tag: convert_process_parent_process_file_creator_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.creator.type_id + tag: convert_process_parent_process_file_creator_type_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_process_parent_process_file_signature_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.process.parent_process.file.signature.certificate.fingerprints + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_process_parent_process_file_signature_certificate_fingerprints_value_into_related_hash + value: '{{{_ingest._value.value}}}' + allow_duplicates: false + - convert: + field: ocsf.process.parent_process.file.signature.algorithm_id + tag: convert_process_parent_process_file_signature_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_process_parent_process_file_signature_value_into_related_hash + value: '{{{ocsf.process.parent_process.file.signature.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.signature?.value != null + - date: + field: ocsf.process.parent_process.file.signature.certificate.created_time_dt + target_field: ocsf.process.parent_process.file.signature.certificate.created_time_dt + tag: date_process_parent_process_file_signature_certificate_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.created_time_dt != null && ctx.ocsf.process.parent_process.file.signature.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.signature.certificate.created_time + target_field: ocsf.process.parent_process.file.signature.certificate.created_time + tag: date_process_parent_process_file_signature_certificate_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.signature?.certificate?.created_time != null && ctx.ocsf.process.parent_process.file.signature.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.signature.created_time_dt + target_field: ocsf.process.parent_process.file.signature.created_time_dt + tag: date_process_parent_process_file_signature_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.file?.signature?.created_time_dt != null && ctx.ocsf.process.parent_process.file.signature.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.file.signature.created_time + target_field: ocsf.process.parent_process.file.signature.created_time + tag: date_process_parent_process_file_signature_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.file?.signature?.created_time != null && ctx.ocsf.process.parent_process.file.signature.created_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.file.signature.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.file.signature.digest.algorithm_id + tag: convert_process_parent_process_file_signature_digest_algorithm_id_to_string + type: string + ignore_missing: true + - append: + field: related.hash + tag: append_process_parent_process_file_signature_digest_value_into_related_hash + value: '{{{ocsf.process.parent_process.file.signature.digest.value}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.signature?.digest?.value != null + - foreach: + field: ocsf.process.parent_process.file.hashes + if: ctx.ocsf?.process?.parent_process?.file?.hashes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_process_parent_process_file_hashes_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.modifier.account.type_id + tag: convert_process_parent_process_file_modifier_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.modifier.type_id + tag: convert_process_parent_process_file_modifier_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.owner.account.type_id + tag: convert_process_parent_process_file_owner_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.owner.type_id + tag: convert_process_parent_process_file_owner_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.file.is_system + tag: convert_process_parent_process_file_is_system_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.file.is_system + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.file.type_id + tag: convert_process_parent_process_file_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.integrity_id + tag: convert_process_parent_process_integrity_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.namespace_pid + tag: convert_process_parent_process_namespace_pid_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.namespace_pid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.session.created_time_dt + target_field: ocsf.process.parent_process.session.created_time_dt + tag: date_process_parent_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.session?.created_time_dt != null && ctx.ocsf.process.parent_process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.session.created_time + target_field: ocsf.process.parent_process.session.created_time + tag: date_process_parent_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.session?.created_time != null && ctx.ocsf.process.parent_process.session.created_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.session.expiration_time_dt + target_field: ocsf.process.parent_process.session.expiration_time_dt + tag: date_process_parent_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.parent_process?.session?.expiration_time_dt != null && ctx.ocsf.process.parent_process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.process.parent_process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.parent_process.session.expiration_time + target_field: ocsf.process.parent_process.session.expiration_time + tag: date_process_parent_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.parent_process?.session?.expiration_time != null && ctx.ocsf.process.parent_process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.process.parent_process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.session.mfa + tag: convert_process_parent_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.session.is_remote + tag: convert_process_parent_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.parent_process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.parent_process.user.account.type_id + tag: convert_process_parent_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.parent_process.user.type_id + tag: convert_process_parent_process_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_process_parent_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.process.parent_process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_process_parent_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.process.parent_process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_process_parent_process_file_creator_full_name_into_related_user + value: '{{{ocsf.process.parent_process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_process_parent_process_file_creator_name_into_related_user + value: '{{{ocsf.process.parent_process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.creator?.name != null + - append: + field: related.user + tag: append_process_parent_process_file_creator_uid_into_related_user + value: '{{{ocsf.process.parent_process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_process_parent_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.process.parent_process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_process_parent_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.process.parent_process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_process_parent_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.process.parent_process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_process_parent_process_file_modifier_name_into_related_user + value: '{{{ocsf.process.parent_process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_process_parent_process_file_modifier_uid_into_related_user + value: '{{{ocsf.process.parent_process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_process_parent_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.process.parent_process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_process_parent_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.process.parent_process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_process_parent_process_file_owner_full_name_into_related_user + value: '{{{ocsf.process.parent_process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_process_parent_process_user_uid_alt_into_related_user + value: '{{{ocsf.process.parent_process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.parent_process?.user?.uid_alt != null + - date: + field: ocsf.process.session.created_time_dt + target_field: ocsf.process.session.created_time_dt + tag: date_process_session_created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.session?.created_time_dt != null && ctx.ocsf.process.session.created_time_dt != '' + on_failure: + - remove: + field: ocsf.process.session.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.session.created_time + target_field: ocsf.process.session.created_time + tag: date_process_session_created_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.session?.created_time != null && ctx.ocsf.process.session.created_time != '' + on_failure: + - remove: + field: ocsf.process.session.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.session.expiration_time_dt + target_field: ocsf.process.session.expiration_time_dt + tag: date_process_session_expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.process?.session?.expiration_time_dt != null && ctx.ocsf.process.session.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.process.session.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.process.session.expiration_time + target_field: ocsf.process.session.expiration_time + tag: date_process_session_expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.process?.session?.expiration_time != null && ctx.ocsf.process.session.expiration_time != '' + on_failure: + - remove: + field: ocsf.process.session.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.session.mfa + tag: convert_process_session_mfa_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.session.mfa + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.session.is_remote + tag: convert_process_session_is_remote_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.process.session.is_remote + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.process.user.account.type_id + tag: convert_process_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.process.user.type_id + tag: convert_process_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_process_file_creator_uid_alt_into_related_user + value: '{{{ocsf.process.file.creator.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.creator?.uid_alt != null + - append: + field: related.user + tag: append_process_file_creator_email_addr_into_related_user + value: '{{{ocsf.process.file.creator.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.creator?.email_addr != null + - append: + field: related.user + tag: append_process_file_creator_full_name_into_related_user + value: '{{{ocsf.process.file.creator.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.creator?.full_name != null + - append: + field: related.user + tag: append_process_file_creator_name_into_related_user + value: '{{{ocsf.process.file.creator.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.creator?.name != null + - append: + field: related.user + tag: append_process_file_creator_uid_into_related_user + value: '{{{ocsf.process.file.creator.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.creator?.uid != null + - append: + field: related.user + tag: append_process_file_modifier_uid_alt_into_related_user + value: '{{{ocsf.process.file.modifier.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.modifier?.uid_alt != null + - append: + field: related.user + tag: append_process_file_modifier_email_addr_into_related_user + value: '{{{ocsf.process.file.modifier.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.modifier?.email_addr != null + - append: + field: related.user + tag: append_process_file_modifier_full_name_into_related_user + value: '{{{ocsf.process.file.modifier.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.modifier?.full_name != null + - append: + field: related.user + tag: append_process_file_modifier_name_into_related_user + value: '{{{ocsf.process.file.modifier.name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.modifier?.name != null + - append: + field: related.user + tag: append_process_file_modifier_uid_into_related_user + value: '{{{ocsf.process.file.modifier.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.modifier?.uid != null + - append: + field: related.user + tag: append_process_file_owner_uid_alt_into_related_user + value: '{{{ocsf.process.file.owner.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.owner?.uid_alt != null + - append: + field: related.user + tag: append_process_file_owner_email_addr_into_related_user + value: '{{{ocsf.process.file.owner.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.owner?.email_addr != null + - append: + field: related.user + tag: append_process_file_owner_full_name_into_related_user + value: '{{{ocsf.process.file.owner.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.file?.owner?.full_name != null + - append: + field: related.user + tag: append_process_user_uid_alt_into_related_user + value: '{{{ocsf.process.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.process?.user?.uid_alt != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_proxy.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_proxy.yml new file mode 100644 index 00000000000..f63c7baf5d3 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_proxy.yml @@ -0,0 +1,132 @@ +--- +description: Pipeline for processing Network Proxy object. +# Network Proxy object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/network_proxy +processors: + - convert: + field: ocsf.proxy.location.is_on_premises + tag: convert_proxy_location_is_on_premises_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: ocsf.proxy.location.is_on_premises + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.proxy.ip + tag: convert_proxy_ip_to_ip + type: ip + ignore_missing: true + if: ctx.ocsf?.proxy?.ip != '' || ctx.ocsf.proxy.ip != '-' + on_failure: + - remove: + field: ocsf.proxy.ip + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_proxy_ip_into_related_ip + value: '{{{ocsf.proxy.ip}}}' + allow_duplicates: false + if: ctx.ocsf?.proxy?.ip != null + - foreach: + field: ocsf.proxy.location.coordinates + if: ctx.ocsf?.proxy?.location?.coordinates instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_proxy_location_coordinates_to_double + type: double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.proxy.port + tag: convert_proxy_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.proxy.port + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.proxy.intermediate_ips + if: ctx.ocsf?.proxy?.intermediate_ips instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_proxy_intermediate_ips_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.proxy.intermediate_ips + if: ctx.ocsf?.proxy?.intermediate_ips instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_proxy_intermediate_ips_into_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - gsub: + field: ocsf.proxy.mac + tag: gsub_proxy_mac + pattern: '[-:.]' + replacement: '-' + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - uppercase: + field: ocsf.proxy.mac + tag: uppercase_proxy_mac + ignore_missing: true + if: ctx.ocsf?.proxy?.mac != '' + on_failure: + - remove: + field: ocsf.proxy.mac + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.hosts + tag: append_proxy_domain_into_related_hosts + value: '{{{ocsf.proxy.domain}}}' + allow_duplicates: false + if: ctx.ocsf?.proxy?.domain != null + - append: + field: related.hosts + tag: append_proxy_hostname_into_related_hosts + value: '{{{ocsf.proxy.hostname}}}' + allow_duplicates: false + if: ctx.ocsf?.proxy?.hostname != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_tls.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_tls.yml new file mode 100644 index 00000000000..575803b7cdf --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_tls.yml @@ -0,0 +1,306 @@ +--- +description: Pipeline for processing TLS object. +# TLS object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/tls +processors: + - set: + field: tls.cipher + tag: set_tls_cipher + copy_from: ocsf.tls.cipher + ignore_empty_value: true + - set: + field: tls.client.ja3 + tag: set_tls_client_ja3 + copy_from: ocsf.tls.ja3_hash.value + ignore_empty_value: true + - append: + field: related.hash + tag: append_tls_client_ja3_into_related_hash + value: '{{{tls.client.ja3}}}' + allow_duplicates: false + if: ctx.tls?.client?.ja3 != null + - set: + field: tls.client.server_name + tag: set_tls_client_server_name + copy_from: ocsf.tls.sni + ignore_empty_value: true + - append: + field: related.hosts + tag: append_tls_client_server_name_into_related_hosts + value: '{{{tls.client.server_name}}}' + allow_duplicates: false + if: ctx.tls?.client?.server_name != null + - foreach: + field: ocsf.tls.client_ciphers + if: ctx.ocsf?.tls?.client_ciphers instanceof List + ignore_failure: true + processor: + append: + field: tls.client.supported_ciphers + tag: append_tls_client_ciphers_into_tls_client_supported_ciphers + value: '{{{_ingest._value}}}' + allow_duplicates: false + - foreach: + field: ocsf.tls.sans + if: ctx.ocsf?.tls?.sans instanceof List + ignore_failure: true + processor: + append: + field: tls.client.x509.alternative_names + tag: append_tls_sans_name_into_tls_client_x509_alternative_names + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: json.tls.sans + if: ctx.json?.tls?.sans instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.name + type: ip + target_field: _ingest._value.name_ips + ignore_missing: true + on_failure: + - append: + field: related.hosts + tag: append_tls_sans_name_into_related_hosts + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: json.tls.sans + if: ctx.json?.tls?.sans instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_tls_sans_name_ips_into_related_ip + value: '{{{_ingest._value.name_ips}}}' + allow_duplicates: false + - foreach: + field: json.tls.sans + if: ctx.json?.tls?.sans instanceof List + ignore_failure: true + processor: + remove: + field: _ingest._value.name_ips + tag: remove_tls_sans_name_ips + ignore_missing: true + - set: + field: tls.client.x509.issuer.distinguished_name + tag: set_tls_client_x509_issuer_distinguished_name + copy_from: ocsf.tls.certificate.issuer + ignore_empty_value: true + - date: + field: ocsf.tls.certificate.expiration_time_dt + tag: date_tls_certificate_expiration_time_dt + target_field: ocsf.tls.certificate.expiration_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.tls?.certificate?.expiration_time_dt != null && ctx.ocsf.tls.certificate.expiration_time_dt != '' + on_failure: + - remove: + field: ocsf.tls.certificate.expiration_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: ocsf.tls.extension_list + if: ctx.ocsf?.tls?.extension_list instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.type_id + tag: convert_tls_extension_list_type_id_to_string + type: string + ignore_missing: true + - set: + field: tls.client.x509.not_after + tag: set_tls_client_x509_not_after_from_tls_certificate_expiration_time_dt + copy_from: ocsf.tls.certificate.expiration_time_dt + ignore_empty_value: true + - date: + field: ocsf.tls.certificate.expiration_time + tag: date_tls_certificate_expiration_time + target_field: ocsf.tls.certificate.expiration_time + formats: + - UNIX_MS + if: ctx.ocsf?.tls?.certificate?.expiration_time != null && ctx.ocsf.tls.certificate.expiration_time != '' + on_failure: + - remove: + field: ocsf.tls.certificate.expiration_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: tls.client.x509.not_after + tag: set_tls_client_x509_not_after_from_tls_certificate_expiration_time + copy_from: ocsf.tls.certificate.expiration_time + ignore_empty_value: true + - set: + field: tls.client.x509.serial_number + tag: set_tls_client_x509_serial_number + copy_from: ocsf.tls.certificate.serial_number + ignore_empty_value: true + - set: + field: tls.client.x509.subject.distinguished_name + tag: set_tls_client_x509_subject_distinguished_name + copy_from: ocsf.tls.certificate.subject + ignore_empty_value: true + - set: + field: tls.client.x509.version_number + tag: set_tls_client_x509_version_number + copy_from: ocsf.tls.certificate.version + ignore_empty_value: true + - set: + field: tls.server.ja3s + tag: set_tls_server_ja3s + copy_from: ocsf.tls.ja3s_hash.value + ignore_empty_value: true + - append: + field: related.hash + tag: append_tls_server_ja3s_into_related_hash + value: '{{{tls.server.ja3s}}}' + allow_duplicates: false + if: ctx.tls?.server?.ja3s != null + - set: + field: tls.version + tag: set_tls_version + copy_from: ocsf.tls.version + ignore_empty_value: true + - date: + field: ocsf.tls.certificate.created_time_dt + tag: date_tls_certificate_created_time_dt + target_field: ocsf.tls.certificate.created_time_dt + formats: + - ISO8601 + if: ctx.ocsf?.tls?.certificate?.created_time_dt != null && ctx.ocsf.tls.certificate.created_time_dt != '' + on_failure: + - remove: + field: ocsf.tls.certificate.created_time_dt + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: ocsf.tls.certificate.created_time + tag: date_tls_certificate_created_time + target_field: ocsf.tls.certificate.created_time + formats: + - UNIX_MS + if: ctx.ocsf?.tls?.certificate?.created_time != null && ctx.ocsf.tls.certificate.created_time != '' + on_failure: + - remove: + field: ocsf.tls.certificate.created_time + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.tls.alert + tag: convert_tls_alert_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.tls.alert + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.tls.handshake_dur + tag: convert_tls_handshake_dur_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.tls.handshake_dur + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + description: Set value for tls.client.hash.*. + tag: script_tls_client_hash_* + if: ctx.ocsf?.tls?.certificate?.fingerprints != null + lang: painless + params: + MD5: md5 + SHA-1: sha1 + SHA-256: sha256 + source: |- + if (ctx.tls == null) { + ctx.tls = new HashMap(); + } + if (ctx.tls.client == null) { + ctx.tls.client = new HashMap(); + } + if (ctx.tls.client.hash == null) { + ctx.tls.client.hash = new HashMap(); + } + Map map = new HashMap(); + def hashes = ctx.ocsf.tls.certificate.get('fingerprints'); + for (def hash: hashes) { + def hashAlgorithm = params.get(hash.get('algorithm')); + if (hashAlgorithm == null) { + continue; + } + if (map.containsKey(hashAlgorithm)) { + map[hashAlgorithm].add(hash.get('value')); + } else { + Set set = new HashSet(); + set.add(hash.get('value')); + map.put(hashAlgorithm, set); + } + } + ctx.tls.client.hash = map; + - foreach: + field: tls.client.hash + if: ctx.tls?.client?.hash instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_tls_client_hash_into_related_hash + value: '{{{_ingest._value}}}' + allow_duplicates: false + - convert: + field: ocsf.tls.key_length + tag: convert_tls_key_length_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.tls.key_length + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: ocsf.tls.ja3_hash.algorithm_id + tag: convert_tls_ja3_hash_algorithm_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.tls.ja3s_hash.algorithm_id + tag: convert_tls_ja3s_hash_algorithm_id_to_string + type: string + ignore_missing: true + - foreach: + field: ocsf.tls.certificate.fingerprints + if: ctx.ocsf?.tls?.certificate?.fingerprints instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.algorithm_id + tag: convert_tls_certificate_fingerprints_algorithm_id_to_string + type: string + ignore_missing: true +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_traffic.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_traffic.yml new file mode 100644 index 00000000000..551a2502c4a --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_traffic.yml @@ -0,0 +1,113 @@ +--- +description: Pipeline for processing Network Traffic object. +# Network Traffic object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/network_traffic +processors: + - convert: + field: ocsf.traffic.bytes_in + tag: convert_traffic_bytes_in_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.bytes_in + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.bytes + tag: set_destination_bytes + copy_from: ocsf.traffic.bytes_in + ignore_empty_value: true + - convert: + field: ocsf.traffic.bytes_out + tag: convert_traffic_bytes_out_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.bytes_out + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.bytes + tag: set_source_bytes + copy_from: ocsf.traffic.bytes_out + ignore_empty_value: true + - convert: + field: ocsf.traffic.packets_in + tag: convert_traffic_packets_in_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.packets_in + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.packets + tag: set_destination_packets + copy_from: ocsf.traffic.packets_in + ignore_empty_value: true + - convert: + field: ocsf.traffic.packets_out + tag: convert_traffic_packets_out_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.packets_out + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.packets + tag: set_source_packets + copy_from: ocsf.traffic.packets_out + ignore_empty_value: true + - convert: + field: ocsf.traffic.bytes + tag: convert_traffic_bytes_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.bytes + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.bytes + tag: set_network_bytes + copy_from: ocsf.traffic.bytes + ignore_empty_value: true + - convert: + field: ocsf.traffic.packets + tag: convert_traffic_packets_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: ocsf.traffic.packets + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: network.packets + tag: set_network_packets + copy_from: ocsf.traffic.packets + ignore_empty_value: true +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_user.yml b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_user.yml new file mode 100644 index 00000000000..de5fdd2219e --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/elasticsearch/ingest_pipeline/pipeline_object_user.yml @@ -0,0 +1,96 @@ +--- +description: Pipeline for processing User object. +# User object docs: https://schema.ocsf.io/1.0.0-rc.3/objects/user +processors: + - set: + field: user.target.domain + tag: set_user_target_domain + copy_from: ocsf.user.domain + ignore_empty_value: true + - set: + field: user.target.email + tag: set_user_target_email + copy_from: ocsf.user.email_addr + ignore_empty_value: true + - append: + field: related.user + tag: append_user_email_addr_into_related_user + value: '{{{ocsf.user.email_addr}}}' + allow_duplicates: false + if: ctx.ocsf?.user?.email_addr != null + - set: + field: user.target.full_name + tag: set_user_target_full_name + copy_from: ocsf.user.full_name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_full_name_into_related_user + value: '{{{ocsf.user.full_name}}}' + allow_duplicates: false + if: ctx.ocsf?.user?.full_name != null + - foreach: + field: ocsf.user.groups + if: ctx.ocsf?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.target.group.id + tag: append_user_target_group_id + value: '{{{_ingest._value.uid}}}' + allow_duplicates: false + - foreach: + field: ocsf.user.groups + if: ctx.ocsf?.user?.groups instanceof List + ignore_failure: true + processor: + append: + field: user.target.group.name + tag: append_user_target_group_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - set: + field: user.target.id + tag: set_user_target_id + copy_from: ocsf.user.uid + ignore_empty_value: true + - append: + field: related.user + tag: append_user_uid_into_related_user + value: '{{{ocsf.user.uid}}}' + allow_duplicates: false + if: ctx.ocsf?.user?.uid != null + - set: + field: user.target.name + tag: set_user_target_name + copy_from: ocsf.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_name_into_related_user + value: '{{{ocsf.user.name}}}' + allow_duplicates: false + if: ctx.ocsf?.user?.name != null + - convert: + field: ocsf.user.account.type_id + tag: convert_user_account_type_id_to_string + type: string + ignore_missing: true + - convert: + field: ocsf.user.type_id + tag: convert_user_type_id_to_string + type: string + ignore_missing: true + - append: + field: related.user + tag: append_user_uid_alt_into_related_user + value: '{{{ocsf.user.uid_alt}}}' + allow_duplicates: false + if: ctx.ocsf?.user?.uid_alt != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/amazon_security_lake/data_stream/event/fields/base-fields.yml b/packages/amazon_security_lake/data_stream/event/fields/base-fields.yml new file mode 100644 index 00000000000..c034c1b6dbb --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: amazon_security_lake +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: amazon_security_lake.event +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/amazon_security_lake/data_stream/event/fields/beats.yml b/packages/amazon_security_lake/data_stream/event/fields/beats.yml new file mode 100644 index 00000000000..b3701b581cf --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/amazon_security_lake/data_stream/event/fields/ecs.yml b/packages/amazon_security_lake/data_stream/event/fields/ecs.yml new file mode 100644 index 00000000000..0e00918bb29 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/fields/ecs.yml @@ -0,0 +1,24 @@ +- name: process.group.id + type: keyword +- name: process.group.name + type: keyword +- name: process.parent.user.domain + type: keyword +- name: process.parent.user.email + type: keyword +- name: process.parent.user.full_name + type: keyword +- name: process.parent.user.group.id + type: keyword +- name: process.parent.user.group.name + type: keyword +- name: process.user.domain + type: keyword +- name: process.user.email + type: keyword +- name: process.user.full_name + type: keyword +- name: process.user.group.id + type: keyword +- name: process.user.group.name + type: keyword diff --git a/packages/amazon_security_lake/data_stream/event/fields/fields.yml b/packages/amazon_security_lake/data_stream/event/fields/fields.yml new file mode 100644 index 00000000000..466c3649b26 --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/fields/fields.yml @@ -0,0 +1,6700 @@ +- name: ocsf + type: group + fields: + - name: activity_id + type: keyword + description: The normalized identifier of the activity that triggered the event. + - name: activity_name + type: keyword + description: The event activity name, as defined by the activity_id. + - name: actor + type: group + fields: + - name: authorizations + type: group + fields: + - name: decision + type: keyword + description: Authorization Result/outcome, e.g. allowed, denied. + - name: policy + type: group + fields: + - name: desc + type: keyword + description: The description of the policy. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: 'The policy name. For example: IAM Policy.' + - name: uid + type: keyword + description: A unique identifier of the policy instance. + - name: version + type: keyword + description: The policy version number. + - name: idp + type: group + fields: + - name: name + type: keyword + description: The name of the identity provider. + - name: uid + type: keyword + description: The unique identifier of the identity provider. + - name: invoked_by + type: keyword + description: The name of the service that invoked the activity as described in the event. + - name: process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: The full command line used to launch an application, service, process, or job. + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: The image name. + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: The unique image ID. + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: The full container unique identifier for this instantiation of the container. + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The name of the city. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: 'The image name. For example: elixir.' + - name: full_name + type: keyword + description: The user's email address. + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The event occurred on a personal device.The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the feature. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: The full command line used to launch an application, service, process, or job. + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: The image name. + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: The unique image ID. + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: The full container unique identifier for this instantiation of the container. + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The name of the city. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: 'The image name. For example: elixir.' + - name: full_name + type: keyword + description: The user's email address. + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The event occurred on a personal device.The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the feature. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: flattened + description: The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting. + - name: parent_process_keyword + type: keyword + ignore_above: 1024 + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: analytic + type: group + fields: + - name: category + type: keyword + description: The analytic category. + - name: desc + type: keyword + description: The description of the analytic that generated the finding. + - name: name + type: keyword + description: The name of the analytic that generated the finding. + - name: related_analytics + type: group + fields: + - name: category + type: keyword + description: The analytic category. + - name: desc + type: keyword + description: The description of the analytic that generated the finding. + - name: name + type: keyword + description: The name of the analytic that generated the finding. + - name: related_analytics + type: flattened + - name: type + type: keyword + description: The analytic type. + - name: type_id + type: keyword + description: The analytic type ID. + - name: uid + type: keyword + description: The unique identifier of the analytic that generated the finding. + - name: version + type: keyword + description: 'The analytic version. For example: 1.1.' + - name: type + type: keyword + description: The analytic type. + - name: type_id + type: keyword + description: The analytic type ID. + - name: uid + type: keyword + description: The unique identifier of the analytic that generated the finding. + - name: version + type: keyword + description: 'The analytic version. For example: 1.1.' + - name: answers + type: group + fields: + - name: class + type: keyword + description: 'The class of DNS data contained in this resource record. See RFC1035. For example: IN.' + - name: flag_ids + type: keyword + description: The list of DNS answer header flag IDs. + - name: flags + type: keyword + description: The list of DNS answer header flags. + - name: packet_uid + type: keyword + description: The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. + - name: rdata + type: keyword + description: The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record. + - name: ttl + type: long + description: The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached. + - name: type + type: keyword + description: 'The type of data contained in this resource record. See RFC1035. For example: CNAME.' + - name: api + type: group + fields: + - name: operation + type: keyword + description: Verb/Operation associated with the request. + - name: request + type: group + fields: + - name: flags + type: keyword + description: The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source. + - name: uid + type: keyword + description: The unique request identifier. + - name: response + type: group + fields: + - name: code + type: long + description: The numeric response sent to a request. + - name: error + type: keyword + description: Error Code. + - name: error_message + type: keyword + description: Error Message. + - name: flags + type: keyword + description: The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source. + - name: message + type: keyword + description: The description of the event, as defined by the event source. + - name: service + type: group + fields: + - name: labels + type: keyword + description: The list of labels associated with the service. + - name: name + type: keyword + description: The name of the service. + - name: uid + type: keyword + description: The unique identifier of the service. + - name: version + type: keyword + description: The version of the service. + - name: version + type: keyword + description: The version of the API service. + - name: app_name + type: keyword + description: The name of the application that is associated with the event or object. + - name: attacks + type: group + fields: + - name: tactics + type: group + fields: + - name: name + type: keyword + description: The tactic name that is associated with the attack technique, as defined by ATT&CK MatrixTM. + - name: uid + type: keyword + description: The tactic ID that is associated with the attack technique, as defined by ATT&CK MatrixTM. + - name: technique + type: group + fields: + - name: name + type: keyword + description: 'The name of the attack technique, as defined by ATT&CK MatrixTM. For example: Drive-by Compromise.' + - name: uid + type: keyword + description: 'The unique identifier of the attack technique, as defined by ATT&CK MatrixTM. For example: T1189.' + - name: version + type: keyword + description: The ATT&CK Matrix version. + - name: auth_protocol + type: keyword + description: The authentication protocol as defined by the caption of 'auth_protocol_id'. In the case of 'Other', it is defined by the event source. + - name: auth_protocol_id + type: keyword + description: The normalized identifier of the authentication protocol used to create the user session. + - name: category_name + type: keyword + description: 'The event category name, as defined by category_uid value: Identity & Access Management.' + - name: category_uid + type: keyword + description: The category unique identifier of the event.3 Identity & Access ManagementIdentity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: cis_csc + type: group + fields: + - name: control + type: keyword + description: The CIS critical security control. + - name: version + type: keyword + description: The CIS critical security control version. + - name: class_name + type: keyword + description: 'The event class name, as defined by class_uid value: Security Finding.' + - name: class_uid + type: keyword + description: The unique identifier of a class. A Class describes the attributes available in an event.2001 Security FindingSecurity Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products. + - name: cloud + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: project_uid + type: keyword + description: The unique identifier of a Cloud project. + - name: provider + type: keyword + description: The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. + - name: region + type: keyword + description: The name of the cloud region, as defined by the cloud provider. + - name: zone + type: keyword + description: The availability zone in the cloud region, as defined by the cloud provider. + - name: compliance + type: group + fields: + - name: status_detail + type: keyword + description: The status details contains additional information about the event outcome. + - name: requirements + type: keyword + description: A list of applicable compliance requirements for which this finding is related to. + - name: status + type: keyword + description: The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. + - name: confidence + type: keyword + description: The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source. + - name: confidence_id + type: keyword + description: The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature. + - name: confidence_score + type: long + description: The confidence score as reported by the event source. + - name: connection_info + type: group + fields: + - name: boundary + type: keyword + description: The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source.For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External. + - name: boundary_id + type: keyword + description: The normalized identifier of the boundary of the connection. For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External. + - name: direction + type: keyword + description: The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source. + - name: direction_id + type: keyword + description: The normalized identifier of the direction of the initiated connection, traffic, or email. + - name: protocol_name + type: keyword + description: 'The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). See Protocol Numbers. For example: tcp or udp.' + - name: protocol_num + type: keyword + description: 'The TCP/IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). Use -1 if the protocol is not defined by IANA. See Protocol Numbers. For example: 6 for TCP and 17 for UDP.' + - name: protocol_ver + type: keyword + description: The Internet Protocol version. + - name: protocol_ver_id + type: keyword + description: The Internet Protocol version identifier. + - name: tcp_flags + type: long + description: The network connection TCP header flags (i.e., control bits). + - name: uid + type: keyword + description: The unique identifier of the connection. + - name: count + type: long + description: The number of times that events in the same logical group occurred during the event Start Time to End Time period. + - name: data_sources + type: keyword + description: The data sources for the finding. + - name: device + type: group + fields: + - name: autoscale_uid + type: keyword + description: The unique identifier of the cloud autoscale configuration. + - name: created_time + type: date + description: The time when the device was known to have been created. + - name: created_time_dt + type: date + description: TThe time when the device was known to have been created. + - name: desc + type: keyword + description: The description of the device, ordinarily as reported by the operating system. + - name: domain + type: keyword + description: 'The network domain where the device resides. For example: work.example.com.' + - name: first_seen_time + type: date + description: The initial discovery time of the device. + - name: first_seen_time_dt + type: date + description: The initial discovery time of the device. + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: hostname + type: keyword + description: The devicename. + - name: hw_info + type: group + fields: + - name: bios_date + type: keyword + description: 'The BIOS date. For example: 03/31/16.' + - name: bios_manufacturer + type: keyword + description: 'The BIOS manufacturer. For example: LENOVO.' + - name: bios_ver + type: keyword + description: 'The BIOS version. For example: LENOVO G5ETA2WW (2.62).' + - name: chassis + type: keyword + description: The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows Windows Chassis Types. + - name: cpu_bits + type: long + description: 'The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64.' + - name: cpu_cores + type: long + description: 'The number of processor cores in all installed processors. For Example: 42.' + - name: cpu_count + type: long + description: 'The number of physical processors on a system. For example: 1.' + - name: cpu_speed + type: long + description: 'The speed of the processor in Mhz. For Example: 4200.' + - name: cpu_type + type: keyword + description: 'The processor type. For example: x86 Family 6 Model 37 Stepping 5.' + - name: desktop_display + type: group + fields: + - name: color_depth + type: long + description: The numeric color depth. + - name: physical_height + type: long + description: The numeric physical height of display. + - name: physical_orientation + type: long + description: The numeric physical orientation of display. + - name: physical_width + type: long + description: The numeric physical width of display. + - name: scale_factor + type: long + description: The numeric scale factor of display. + - name: keyboard_info + type: group + fields: + - name: function_keys + type: long + description: The number of function keys on client keyboard. + - name: ime + type: keyword + description: The Input Method Editor (IME) file name. + - name: keyboard_layout + type: keyword + description: The keyboard locale identifier name (e.g., en-US). + - name: keyboard_subtype + type: long + description: The keyboard numeric code. + - name: keyboard_type + type: keyword + description: The keyboard type (e.g., xt, ico). + - name: ram_size + type: long + description: 'The total amount of installed RAM, in Megabytes. For example: 2048.' + - name: serial_number + type: keyword + description: The device manufacturer serial number. + - name: hypervisor + type: keyword + description: The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: 'The image name. For example: elixir.' + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: 'The image tag. For example: 1.11-alpine.' + - name: uid + type: keyword + description: 'The unique image ID. For example: 77af4d6b9913.' + - name: imei + type: keyword + description: The International Mobile Station Equipment Identifier that is associated with the device. + - name: instance_uid + type: keyword + description: The unique identifier of a VM instance. + - name: interface_name + type: keyword + description: The name of the network interface (e.g. eth2). + - name: interface_uid + type: keyword + description: The unique identifier of the network interface. + - name: ip + type: ip + description: The device IP address, in either IPv4 or IPv6 format. + - name: is_compliant + type: boolean + description: The event occurred on a compliant device. + - name: is_managed + type: boolean + description: The event occurred on a managed device. + - name: is_personal + type: boolean + description: The event occurred on a personal device. + - name: is_trusted + type: boolean + description: The event occurred on a trusted device. + - name: last_seen_time + type: date + description: The most recent discovery time of the device. + - name: last_seen_time_dt + type: date + description: The most recent discovery time of the device. + - name: location + type: group + fields: + - name: city + type: keyword + description: The name of the city. + - name: continent + type: keyword + description: The name of the continent. + - name: coordinates + type: geo_point + description: A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. + - name: country + type: keyword + description: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. + - name: desc + type: keyword + description: The description of the geographical location. + - name: is_on_premises + type: boolean + description: The indication of whether the location is on premises. + - name: isp + type: keyword + description: The name of the Internet Service Provider (ISP). + - name: postal_code + type: keyword + description: The postal code of the location. + - name: provider + type: keyword + description: The provider of the geographical location data. + - name: region + type: keyword + description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. + - name: mac + type: keyword + description: The device Media Access Control (MAC) address. + - name: modified_time + type: date + description: The time when the device was last known to have been modified. + - name: modified_time_dt + type: date + description: The time when the device was last known to have been modified. + - name: name + type: keyword + description: The alternate device name, ordinarily as assigned by an administrator. The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234. + - name: network_interfaces + type: group + fields: + - name: hostname + type: keyword + description: The hostname associated with the network interface. + - name: ip + type: ip + description: The IP address associated with the network interface. + - name: mac + type: keyword + description: The MAC address of the network interface. + - name: name + type: keyword + description: The name of the network interface. + - name: namespace + type: keyword + description: The namespace is useful in merger or acquisition situations. For example, when similar entities exists that you need to keep separate. + - name: type + type: keyword + description: The type of network interface. + - name: type_id + type: keyword + description: The network interface type identifier. + - name: uid + type: keyword + description: The unique identifier for the network interface. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: os + type: group + fields: + - name: build + type: keyword + description: The operating system build number. + - name: country + type: keyword + description: The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see ISO 3166-1 alpha-2 codes. + - name: cpu_bits + type: long + description: The cpu architecture, the number of bits used for addressing in memory. For example, 32 or 64. + - name: edition + type: keyword + description: The operating system edition. For example, Professional. + - name: lang + type: keyword + description: The two letter lower case language codes, as defined by ISO 639-1. + - name: name + type: keyword + description: The operating system name. + - name: sp_name + type: keyword + description: The name of the latest Service Pack. + - name: sp_ver + type: keyword + description: The version number of the latest Service Pack. + - name: type + type: keyword + description: The type of the operating system. + - name: type_id + type: keyword + description: The type identifier of the operating system. + - name: version + type: keyword + description: The version of the OS running on the device that originated the event. For example, "Windows 10", "OS X 10.7", or "iOS 9". + - name: region + type: keyword + description: The region where the virtual machine is located. For example, an AWS Region. + - name: risk_level + type: keyword + description: The risk level, normalized to the caption of the risk_level_id value. In the case of 'Other', it is defined by the event source. + - name: risk_level_id + type: keyword + description: The normalized risk level id. + - name: risk_score + type: long + description: The risk score as reported by the event source. + - name: subnet + type: ip_range + description: The subnet mask. + - name: subnet_uid + type: keyword + description: The unique identifier of a virtual subnet. + - name: type + type: keyword + description: The device type. For example, unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other. + - name: type_id + type: keyword + description: The device type ID. + - name: uid + type: keyword + description: The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: vlan_uid + type: keyword + description: The Virtual LAN identifier. + - name: vpc_uid + type: keyword + description: The unique identifier of the Virtual Private Cloud (VPC). + - name: disposition + type: keyword + description: The event disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source. + - name: disposition_id + type: keyword + description: When security issues, such as malware or policy violations, are detected and possibly corrected, then disposition_id describes the action taken by the security product. + - name: dst_endpoint + type: group + fields: + - name: domain + type: keyword + description: The name of the domain. + - name: hostname + type: keyword + description: The fully qualified name of the endpoint. + - name: instance_uid + type: keyword + description: The unique identifier of a VM instance. + - name: interface_name + type: keyword + description: The name of the network interface (e.g. eth2). + - name: interface_uid + type: keyword + description: The unique identifier of the network interface. + - name: intermediate_ips + type: ip + description: The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. + - name: ip + type: ip + description: The IP address of the endpoint, in either IPv4 or IPv6 format. + - name: location + type: group + fields: + - name: city + type: keyword + description: The name of the city. + - name: continent + type: keyword + description: The name of the continent. + - name: coordinates + type: geo_point + description: A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. + - name: country + type: keyword + description: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. + - name: desc + type: keyword + description: The description of the geographical location. + - name: is_on_premises + type: boolean + description: The indication of whether the location is on premises. + - name: isp + type: keyword + description: The name of the Internet Service Provider (ISP). + - name: postal_code + type: keyword + description: The postal code of the location. + - name: provider + type: keyword + description: The provider of the geographical location data. + - name: region + type: keyword + description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. + - name: mac + type: keyword + description: The Media Access Control (MAC) address of the endpoint. + - name: name + type: keyword + description: The short name of the endpoint. + - name: port + type: long + description: The port used for communication within the network connection. + - name: subnet_uid + type: keyword + description: The unique identifier of a virtual subnet. + - name: svc_name + type: keyword + description: The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. + - name: uid + type: keyword + description: The unique identifier of the endpoint. + - name: vlan_uid + type: keyword + description: The Virtual LAN identifier. + - name: vpc_uid + type: keyword + description: The unique identifier of the Virtual Private Cloud (VPC). + - name: duration + type: long + description: The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds. + - name: end_time + type: date + description: The end time of a time period, or the time of the most recent event included in the aggregate event. + - name: end_time_dt + type: date + description: The end time of a time period, or the time of the most recent event included in the aggregate event. + - name: enrichments + type: group + fields: + - name: data + type: flattened + description: The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. + - name: name + type: keyword + description: The name of the attribute to which the enriched data pertains. + - name: provider + type: keyword + description: The enrichment data provider name. + - name: type + type: keyword + description: The enrichment type. For example, location. + - name: value + type: keyword + description: The value of the attribute to which the enriched data pertains. + - name: evidence + type: flattened + description: The data the finding exposes to the analyst. + - name: finding + type: group + fields: + - name: created_time + type: date + description: The time when the finding was created. + - name: created_time_dt + type: date + description: The time when the finding was created. + - name: desc + type: keyword + description: The description of the reported finding. + - name: first_seen_time + type: date + description: The time when the finding was first observed. + - name: first_seen_time_dt + type: date + description: The time when the finding was first observed. + - name: last_seen_time + type: date + description: The time when the finding was most recently observed. + - name: last_seen_time_dt + type: date + description: The time when the finding was most recently observed. + - name: modified_time + type: date + description: The time when the finding was last modified. + - name: modified_time_dt + type: date + description: The time when the finding was last modified. + - name: product_uid + type: keyword + description: The unique identifier of the product that reported the finding. + - name: related_events + type: group + fields: + - name: product_uid + type: keyword + description: The unique identifier of the product that reported the related event. + - name: type + type: keyword + description: 'The type of the related event. For example: Process Activity: Launch.' + - name: type_uid + type: keyword + description: 'The unique identifier of the related event type. For example: 100701.' + - name: uid + type: keyword + description: The unique identifier of the related event. + - name: remediation + type: group + fields: + - name: desc + type: keyword + description: The description of the remediation strategy. + - name: kb_articles + type: keyword + description: The KB article/s related to the entity. + - name: src_url + type: keyword + description: The URL pointing to the source of the finding. + - name: supporting_data + type: flattened + description: Additional data supporting a finding as provided by security tool. + - name: title + type: keyword + description: The title of the reported finding. + - name: types + type: keyword + description: One or more types of the reported finding. + - name: uid + type: keyword + description: The unique identifier of the reported finding. + - name: http_request + type: group + fields: + - name: args + type: keyword + description: The arguments sent along with the HTTP request. + - name: http_headers + type: group + fields: + - name: name + type: keyword + description: The name of the header. + - name: value + type: keyword + description: The value of the header. + - name: http_method + type: keyword + description: The HTTP request method indicates the desired action to be performed for a given resource. + - name: referrer + type: keyword + description: The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested. + - name: uid + type: keyword + description: The unique identifier of the http request. + - name: url + type: group + fields: + - name: categories + type: keyword + description: The Website categorization names, as defined by category_ids enum values. + - name: category_ids + type: keyword + description: The Website categorization identifies. + - name: hostname + type: keyword + description: The URL host as extracted from the URL. For example, www.example.com from www.example.com/download/trouble. + - name: path + type: keyword + description: The URL path as extracted from the URL. For example, /download/trouble from www.example.com/download/trouble. + - name: port + type: long + description: The URL port. For example, 80. + - name: query_string + type: keyword + description: The query portion of the URL. For example, the query portion of the URL http://www.example.com/search?q=bad&sort=date is q=bad&sort=date. + - name: resource_type + type: keyword + description: The context in which a resource was retrieved in a web request. + - name: scheme + type: keyword + description: The scheme portion of the URL. For example, http, https, ftp, or sftp. + - name: subdomain + type: keyword + description: The subdomain portion of the URL. For example, sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com. + - name: url_string + type: keyword + description: The URL string. See RFC 1738. For example, http://www.example.com/download/trouble.exe. + - name: user_agent + type: keyword + description: The request header that identifies the operating system and web browser. + - name: version + type: keyword + description: The Hypertext Transfer Protocol (HTTP) version. + - name: x_forwarded_for + type: ip + description: The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer. + - name: impact + type: keyword + description: The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source. + - name: impact_id + type: keyword + description: The normalized impact of the finding. + - name: impact_score + type: long + description: The impact of the finding, valid range 0-100. + - name: is_cleartext + type: boolean + description: 'Indicates whether the credentials were passed in clear text.Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user''s logon password was passed to the authentication package in clear text.' + - name: is_mfa + type: boolean + description: Indicates whether Multi Factor Authentication was used during authentication. + - name: is_new_logon + type: boolean + description: Indicates logon is from a device not seen before or a first time account logon. + - name: is_remote + type: boolean + description: The attempted authentication is over a remote connection. + - name: kill_chain + type: group + fields: + - name: phase + type: keyword + description: The cyber kill chain phase. + - name: phase_id + type: keyword + description: The cyber kill chain phase identifier. + - name: logon_process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: 'The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '''' is to be used.' + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: 'The image name. For example: elixir.' + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: 'The image tag. For example: 1.11-alpine.' + - name: uid + type: keyword + description: 'The unique image ID. For example: 77af4d6b9913.' + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: 'The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf.' + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: 'The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '''' is to be used.' + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: 'The image name. For example: elixir.' + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: 'The image tag. For example: 1.11-alpine.' + - name: uid + type: keyword + description: 'The unique image ID. For example: 77af4d6b9913.' + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: 'The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf.' + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: flattened + description: The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting. + - name: parent_process_keyword + type: keyword + ignore_above: 1024 + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: logon_type + type: keyword + description: The logon type, normalized to the caption of the logon_type_id value. In the case of 'Other', it is defined by the event source. + - name: logon_type_id + type: keyword + description: The normalized logon type identifier + - name: malware + type: group + fields: + - name: classification_ids + type: keyword + description: The list of normalized identifiers of the malware classifications. + - name: classifications + type: keyword + description: The list of malware classifications, normalized to the captions of the classification_id values. In the case of 'Other', they are defined by the event source. + - name: cves + type: group + fields: + - name: created_time + type: date + description: The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. + - name: created_time_dt + type: date + description: The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. + - name: cvss + type: group + fields: + - name: base_score + type: double + description: The CVSS base score. + - name: depth + type: keyword + description: The CVSS depth represents a depth of the equation used to calculate CVSS score. + - name: metrics + type: group + fields: + - name: name + type: keyword + description: The name of the metric. + - name: value + type: keyword + description: The value of the metric. + - name: overall_score + type: double + description: The CVSS overall score, impacted by base, temporal, and environmental metrics. + - name: severity + type: keyword + description: The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. + - name: vector_string + type: keyword + description: 'The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.' + - name: version + type: keyword + description: The CVSS version. + - name: cwe_uid + type: keyword + description: 'The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.' + - name: cwe_url + type: keyword + description: Common Weakness Enumeration (CWE) definition URL. + - name: modified_time + type: date + description: The Record Modified Date identifies when the CVE record was last updated. + - name: modified_time_dt + type: date + description: The Record Modified Date identifies when the CVE record was last updated. + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: The two letter lower case language codes, as defined by ISO 639-1. + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: type + type: keyword + description: The vulnerability type as selected from a large dropdown menu during CVE refinement. + - name: uid + type: keyword + description: 'The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: CVE-2021-12345.' + - name: name + type: keyword + description: The malware name, as reported by the detection engine. + - name: path + type: keyword + description: The filesystem path of the malware that was observed. + - name: provider + type: keyword + description: The provider of the malware information. + - name: uid + type: keyword + description: The malware unique identifier, as reported by the detection engine. For example a virus id or an IPS signature id. + - name: message + type: keyword + description: The description of the event, as defined by the event source. + - name: metadata + type: group + fields: + - name: correlation_uid + type: keyword + description: The unique identifier used to correlate events. + - name: event_code + type: keyword + description: The Event ID or Code that the product uses to describe the event. + - name: extension + type: group + fields: + - name: name + type: keyword + description: 'The schema extension name. For example: dev.' + - name: uid + type: keyword + description: 'The schema extension unique identifier. For example: 999.' + - name: version + type: keyword + description: 'The schema extension version. For example: 1.0.0-alpha.2.' + - name: labels + type: keyword + description: The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time. + - name: log_name + type: keyword + description: 'The event log name. For example, syslog file name or Windows logging subsystem: Security.' + - name: log_provider + type: keyword + description: The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing. + - name: log_version + type: keyword + description: The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version. + - name: logged_time + type: date + description: The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different. + - name: logged_time_dt + type: date + description: The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different. + - name: modified_time + type: date + description: The time when the event was last modified or enriched. + - name: modified_time_dt + type: date + description: The time when the event was last modified or enriched. + - name: original_time + type: keyword + description: The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs. + - name: processed_time + type: date + description: The event processed time, such as an ETL operation. + - name: processed_time_dt + type: date + description: The event processed time, such as an ETL operation. + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lowercase language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: profiles + type: keyword + description: The list of profiles used to create the event. + - name: sequence + type: long + description: Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision. + - name: uid + type: keyword + description: The logging system-assigned unique identifier of an event instance. + - name: version + type: keyword + description: 'The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes.' + - name: nist + type: keyword + description: The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk. + - name: observables + type: group + fields: + - name: name + type: keyword + description: 'The full name of the observable attribute. The name is a pointer/reference to an attribute within the event data. For example: file.name.' + - name: reputation + type: group + fields: + - name: base_score + type: double + description: The reputation score as reported by the event source. + - name: provider + type: keyword + description: The provider of the reputation information. + - name: score + type: keyword + description: The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source. + - name: score_id + type: keyword + description: The normalized reputation score identifier. + - name: type + type: keyword + description: The observable value type name. + - name: type_id + type: keyword + description: The observable value type identifier. + - name: value + type: keyword + description: The value associated with the observable attribute. + - name: process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: 'The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '''' is to be used.' + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: 'The image name. For example: elixir.' + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: 'The image tag. For example: 1.11-alpine.' + - name: uid + type: keyword + description: 'The unique image ID. For example: 77af4d6b9913.' + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: 'The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf.' + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: group + fields: + - name: auid + type: keyword + description: The audit user assigned at login by the audit subsystem. + - name: cmd_line + type: keyword + description: 'The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '''' is to be used.' + - name: container + type: group + fields: + - name: hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: image + type: group + fields: + - name: labels + type: keyword + description: The image labels. + - name: name + type: keyword + description: 'The image name. For example: elixir.' + - name: path + type: keyword + description: The full path to the image file. + - name: tag + type: keyword + description: 'The image tag. For example: 1.11-alpine.' + - name: uid + type: keyword + description: 'The unique image ID. For example: 77af4d6b9913.' + - name: name + type: keyword + description: The container name. + - name: network_driver + type: keyword + description: The network driver used by the container. For example, bridge, overlay, host, none, etc. + - name: orchestrator + type: keyword + description: The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. + - name: pod_uuid + type: keyword + description: The unique identifier of the pod (or equivalent) that the container is executing on. + - name: runtime + type: keyword + description: The backend running the container, such as containerd or cri-o. + - name: size + type: long + description: The size of the container image. + - name: tag + type: keyword + description: The tag used by the container. It can indicate version, format, OS. + - name: uid + type: keyword + description: 'The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf.' + - name: created_time + type: date + description: The time when the process was created/started. + - name: created_time_dt + type: date + description: The time when the process was created/started. + - name: egid + type: keyword + description: The effective group under which this process is running. + - name: euid + type: keyword + description: The effective user under which this process is running. + - name: file + type: group + fields: + - name: accessed_time + type: date + description: The time when the file was last accessed. + - name: accessed_time_dt + type: date + description: The time when the file was last accessed. + - name: accessor + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: attributes + type: long + description: The Bitmask value that represents the file attributes. + - name: company_name + type: keyword + description: 'The name of the company that published the file. For example: Microsoft Corporation.' + - name: confidentiality + type: keyword + description: The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. + - name: confidentiality_id + type: keyword + description: The normalized identifier of the file content confidentiality indicator. + - name: created_time + type: date + description: The time when the file was created. + - name: created_time_dt + type: date + description: The time when the file was created. + - name: creator + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: desc + type: keyword + description: 'The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type.' + - name: hashes + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: is_system + type: boolean + description: The indication of whether the object is part of the operating system. + - name: mime_type + type: keyword + description: The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. + - name: modified_time + type: date + description: The time when the file was last modified. + - name: modified_time_dt + type: date + description: The time when the file was last modified. + - name: modifier + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: name + type: keyword + description: 'The name of the file. For example: svchost.exe.' + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: parent_folder + type: keyword + description: 'The parent folder in which the file resides. For example: c:\windows\system32.' + - name: path + type: keyword + description: 'The full path to the file. For example: c:\windows\system32\svchost.exe.' + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: security_descriptor + type: keyword + description: The object security descriptor. + - name: signature + type: group + fields: + - name: algorithm + type: keyword + description: The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized digital signature algorithm. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: created_time + type: date + description: The time when the digital signature was created. + - name: created_time_dt + type: date + description: The time when the digital signature was created. + - name: developer_uid + type: keyword + description: The developer ID on the certificate that signed the file. + - name: digest + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: size + type: long + description: The size of data, in bytes. + - name: type + type: keyword + description: The file type. + - name: type_id + type: keyword + description: The file type ID. + - name: uid + type: keyword + description: The unique identifier of the file as defined by the storage system, such the file system file ID. + - name: version + type: keyword + description: 'The file version. For example: 8.0.7601.17514.' + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: integrity + type: keyword + description: The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). + - name: integrity_id + type: keyword + description: The normalized identifier of the process integrity level (Windows only). + - name: lineage + type: keyword + description: 'The lineage of the process, represented by a list of paths for each ancestor process. For example: [''/usr/sbin/sshd'', ''/usr/bin/bash'', ''/usr/bin/whoami''].' + - name: loaded_modules + type: keyword + description: The list of loaded module names. + - name: name + type: keyword + description: 'The friendly name of the process, for example: Notepad++.' + - name: namespace_pid + type: long + description: If running under a process namespace (such as in a container), the process identifier within that process namespace. + - name: parent_process + type: flattened + description: The parent process of this process object. + - name: parent_process_keyword + type: keyword + ignore_above: 1024 + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The short name of the endpoint. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The name of the network interface (e.g. eth2). + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: pid + type: long + description: The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. + - name: sandbox + type: keyword + description: The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The short name of the endpoint. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The name of the network interface (e.g. eth2). + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: terminated_time + type: date + description: The time when the process was terminated. + - name: terminated_time_dt + type: date + description: The time when the process was terminated. + - name: tid + type: long + description: The Identifier of the thread associated with the event, as returned by the operating system. + - name: uid + type: keyword + description: A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: xattributes + type: flattened + description: An unordered collection of zero or more name/value pairs that represent a process extended attribute. + - name: proxy + type: group + fields: + - name: domain + type: keyword + description: The name of the domain. + - name: hostname + type: keyword + description: The fully qualified name of the endpoint. + - name: instance_uid + type: keyword + description: The unique identifier of a VM instance. + - name: interface_name + type: keyword + description: The name of the network interface (e.g. eth2). + - name: interface_uid + type: keyword + description: The unique identifier of the network interface. + - name: intermediate_ips + type: ip + description: The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. + - name: ip + type: ip + description: The IP address of the endpoint, in either IPv4 or IPv6 format. + - name: location + type: group + fields: + - name: city + type: keyword + description: The name of the city. + - name: continent + type: keyword + description: The name of the continent. + - name: coordinates + type: geo_point + description: A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. + - name: country + type: keyword + description: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. + - name: desc + type: keyword + description: The description of the geographical location. + - name: is_on_premises + type: boolean + description: The indication of whether the location is on premises. + - name: isp + type: keyword + description: The name of the Internet Service Provider (ISP). + - name: postal_code + type: keyword + description: The postal code of the location. + - name: provider + type: keyword + description: The provider of the geographical location data. + - name: region + type: keyword + description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. + - name: mac + type: keyword + description: The Media Access Control (MAC) address of the endpoint. + - name: name + type: keyword + description: The short name of the endpoint. + - name: port + type: long + description: The port used for communication within the network connection. + - name: subnet_uid + type: keyword + description: The unique identifier of a virtual subnet. + - name: svc_name + type: keyword + description: The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. + - name: uid + type: keyword + description: The unique identifier of the endpoint. + - name: vlan_uid + type: keyword + description: The Virtual LAN identifier. + - name: vpc_uid + type: keyword + description: The unique identifier of the Virtual Private Cloud (VPC). + - name: query + type: group + fields: + - name: class + type: keyword + description: 'The class of resource records being queried. See RFC1035. For example: IN.' + - name: hostname + type: keyword + description: 'The hostname or domain being queried. For example: www.example.com' + - name: opcode + type: keyword + description: The DNS opcode specifies the type of the query message. + - name: opcode_id + type: keyword + description: The DNS opcode ID specifies the normalized query message type. + - name: packet_uid + type: keyword + description: The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. + - name: type + type: keyword + description: 'The type of resource records being queried. See RFC1035. For example: A, AAAA, CNAME, MX, and NS.' + - name: query_time + type: date + description: The Domain Name System (DNS) query time. + - name: query_time_dt + type: date + description: The Domain Name System (DNS) query time. + - name: raw_data + type: flattened + description: The event data as received from the event source. + - name: raw_data_keyword + type: keyword + - name: rcode + type: keyword + description: The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source. + - name: rcode_id + type: keyword + description: The normalized identifier of the DNS server response code. + - name: resources + type: group + fields: + - name: cloud_partition + type: keyword + description: 'The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov).' + - name: criticality + type: keyword + description: The criticality of the resource as defined by the event source. + - name: data + type: flattened + description: Additional data describing the resource. + - name: group + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: labels + type: keyword + description: The list of labels/tags associated to a resource. + - name: name + type: keyword + description: The name of the resource. + - name: owner + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: region + type: keyword + description: The cloud region of the resource. + - name: type + type: keyword + description: The resource type as defined by the event source. + - name: uid + type: keyword + description: The unique identifier of the resource. + - name: version + type: keyword + description: The version of the resource. For example 1.2.3. + - name: response_time + type: date + description: The Domain Name System (DNS) response time. + - name: response_time_dt + type: date + description: The Domain Name System (DNS) response time. + - name: risk_level + type: keyword + description: The risk level, normalized to the caption of the risk_level_id value. In the case of 'Other', it is defined by the event source. + - name: risk_level_id + type: keyword + description: The normalized risk level id. + - name: risk_score + type: long + description: The risk score as reported by the event source. + - name: service + type: group + fields: + - name: labels + type: keyword + description: The list of labels associated with the service. + - name: name + type: keyword + description: The name of the service. + - name: uid + type: keyword + description: The unique identifier of the service. + - name: version + type: keyword + description: The version of the service. + - name: session + type: group + fields: + - name: created_time + type: date + description: The time when the session was created. + - name: created_time_dt + type: date + description: The time when the session was created. + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: expiration_time + type: date + description: The session expiration time. + - name: expiration_time_dt + type: date + description: The session expiration time. + - name: is_remote + type: boolean + description: The indication of whether the session is remote. + - name: issuer + type: keyword + description: The identifier of the session issuer. + - name: mfa + type: boolean + - name: uid + type: keyword + description: The unique identifier of the session. + - name: uuid + type: keyword + description: The universally unique identifier of the session. + - name: severity + type: keyword + description: The event severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the event source. + - name: severity_id + type: long + description: The normalized identifier of the event severity. The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events. + - name: src_endpoint + type: group + fields: + - name: domain + type: keyword + description: The name of the domain. + - name: hostname + type: keyword + description: The fully qualified name of the endpoint. + - name: instance_uid + type: keyword + description: The unique identifier of a VM instance. + - name: interface_name + type: keyword + description: The name of the network interface (e.g. eth2). + - name: interface_uid + type: keyword + description: The unique identifier of the network interface. + - name: intermediate_ips + type: ip + description: The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. + - name: ip + type: ip + description: The IP address of the endpoint, in either IPv4 or IPv6 format. + - name: location + type: group + fields: + - name: city + type: keyword + description: The name of the city. + - name: continent + type: keyword + description: The name of the continent. + - name: coordinates + type: geo_point + description: A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. + - name: country + type: keyword + description: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. + - name: desc + type: keyword + description: The description of the geographical location. + - name: is_on_premises + type: boolean + description: The indication of whether the location is on premises. + - name: isp + type: keyword + description: The name of the Internet Service Provider (ISP). + - name: postal_code + type: keyword + description: The postal code of the location. + - name: provider + type: keyword + description: The provider of the geographical location data. + - name: region + type: keyword + description: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. + - name: mac + type: keyword + description: The Media Access Control (MAC) address of the endpoint. + - name: name + type: keyword + description: The short name of the endpoint. + - name: port + type: long + description: The port used for communication within the network connection. + - name: subnet_uid + type: keyword + description: The unique identifier of a virtual subnet. + - name: svc_name + type: keyword + description: The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. + - name: uid + type: keyword + description: The unique identifier of the endpoint. + - name: vlan_uid + type: keyword + description: The Virtual LAN identifier. + - name: vpc_uid + type: keyword + description: The unique identifier of the Virtual Private Cloud (VPC). + - name: start_time + type: date + description: The start time of a time period, or the time of the least recent event included in the aggregate event. + - name: start_time_dt + type: date + description: The start time of a time period, or the time of the least recent event included in the aggregate event. + - name: state + type: keyword + description: The normalized state of a security finding. + - name: state_id + type: keyword + description: The normalized state identifier of a security finding. + - name: status + type: keyword + description: The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. + - name: status_code + type: keyword + description: The event status code, as reported by the event source. For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18. + - name: status_detail + type: keyword + description: The status details contains additional information about the event outcome. + - name: status_id + type: keyword + description: The normalized identifier of the event status. + - name: time + type: date + description: The normalized event occurrence time. + - name: time_dt + type: date + description: The normalized event occurrence time. + - name: timezone_offset + type: long + description: The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080. + - name: tls + type: group + fields: + - name: alert + type: long + description: The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246. + - name: certificate + type: group + fields: + - name: created_time + type: date + description: The time when the certificate was created. + - name: created_time_dt + type: date + description: The time when the certificate was created. + - name: expiration_time + type: date + description: The expiration time of the certificate. + - name: expiration_time_dt + type: date + description: The expiration time of the certificate. + - name: fingerprints + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: issuer + type: keyword + description: The certificate issuer distinguished name. + - name: serial_number + type: keyword + description: The serial number of the certificate used to create the digital signature. + - name: subject + type: keyword + description: The certificate subject distinguished name. + - name: version + type: keyword + description: The certificate version. + - name: certificate_chain + type: keyword + description: The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer. + - name: cipher + type: keyword + description: The negotiated cipher suite. + - name: client_ciphers + type: keyword + description: The client cipher suites that were exchanged during the TLS handshake negotiation. + - name: extension_list + type: group + fields: + - name: data + type: flattened + description: The data contains information specific to the particular extension type. + - name: type + type: keyword + description: 'The TLS extension type. For example: Server Name.' + - name: type_id + type: keyword + description: The TLS extension type identifier. See The Transport Layer Security (TLS) extension page. + - name: handshake_dur + type: long + description: The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds. + - name: ja3_hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: ja3s_hash + type: group + fields: + - name: algorithm + type: keyword + description: The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. + - name: algorithm_id + type: keyword + description: The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. + - name: value + type: keyword + description: The digital fingerprint value. + - name: key_length + type: long + description: The length of the encryption key. + - name: sans + type: group + fields: + - name: name + type: keyword + description: Name of SAN (e.g. The actual IP Address or domain.) + - name: type + type: keyword + description: Type descriptor of SAN (e.g. IP Address/domain/etc.) + - name: server_ciphers + type: keyword + description: The server cipher suites that were exchanged during the TLS handshake negotiation. + - name: sni + type: keyword + description: The Server Name Indication (SNI) extension sent by the client. + - name: version + type: keyword + description: The TLS protocol version. + - name: traffic + type: group + fields: + - name: bytes + type: long + description: The total number of bytes (in and out). + - name: bytes_in + type: long + description: The number of bytes sent from the destination to the source. + - name: bytes_out + type: long + description: The number of bytes sent from the source to the destination. + - name: packets + type: long + description: The total number of packets (in and out). + - name: packets_in + type: long + description: The number of packets sent from the destination to the source. + - name: packets_out + type: long + description: The number of packets sent from the source to the destination. + - name: type_name + type: keyword + description: The event type name, as defined by the type_uid. + - name: type_uid + type: keyword + description: 'The event type ID. It identifies the events semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.' + - name: unmapped + type: flattened + description: The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. + - name: user + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: user_result + type: group + fields: + - name: account + type: group + fields: + - name: name + type: keyword + description: The name of the account (e.g. GCP Account Name). + - name: type + type: keyword + description: The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. + - name: type_id + type: keyword + description: The normalized account type identifier. + - name: uid + type: keyword + description: The unique identifier of the account (e.g. AWS Account ID). + - name: credential_uid + type: keyword + description: The unique identifier of the user's credential. For example, AWS Access Key ID. + - name: domain + type: keyword + description: 'The domain where the user is defined. For example: the LDAP or Active Directory domain.' + - name: email_addr + type: keyword + description: The user's email address. + - name: full_name + type: keyword + description: The full name of the person, as per the LDAP Common Name attribute (cn). + - name: groups + type: group + fields: + - name: desc + type: keyword + description: The group description. + - name: name + type: keyword + description: The group name. + - name: privileges + type: keyword + description: The group privileges. + - name: type + type: keyword + description: The type of the group or account. + - name: uid + type: keyword + description: The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. + - name: name + type: keyword + description: The username. For example, janedoe1. + - name: org + type: group + fields: + - name: name + type: keyword + description: The name of the organization. For example, Widget, Inc. + - name: ou_name + type: keyword + description: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. + - name: ou_uid + type: keyword + description: The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. + - name: uid + type: keyword + description: The unique identifier of the organization. For example, its Active Directory or AWS Org ID. + - name: type + type: keyword + description: The type of the user. For example, System, AWS IAM User, etc. + - name: type_id + type: keyword + description: The account type identifier. + - name: uid + type: keyword + description: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. + - name: uid_alt + type: keyword + description: The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. + - name: vulnerabilities + type: group + fields: + - name: cve + type: group + fields: + - name: created_time + type: date + description: The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. + - name: created_time_dt + type: date + description: The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. + - name: cvss + type: group + fields: + - name: base_score + type: double + description: 'The CVSS base score. For example: 9.1.' + - name: depth + type: keyword + description: The CVSS depth represents a depth of the equation used to calculate CVSS score. + - name: metrics + type: group + fields: + - name: name + type: keyword + description: The name of the metric. + - name: value + type: keyword + description: The value of the metric. + - name: overall_score + type: double + description: 'The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1.' + - name: severity + type: keyword + description: The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. + - name: vector_string + type: keyword + description: 'The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H.' + - name: version + type: keyword + description: 'The CVSS version. For example: 3.1.' + - name: cwe_uid + type: keyword + description: 'The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787.' + - name: cwe_url + type: keyword + description: 'Common Weakness Enumeration (CWE) definition URL. For example: https://cwe.mitre.org/data/definitions/787.html.' + - name: modified_time + type: date + description: The Record Modified Date identifies when the CVE record was last updated. + - name: modified_time_dt + type: date + description: The Record Modified Date identifies when the CVE record was last updated. + - name: product + type: group + fields: + - name: feature + type: group + fields: + - name: name + type: keyword + description: The name of the feature. + - name: uid + type: keyword + description: The unique identifier of the feature. + - name: version + type: keyword + description: The version of the feature. + - name: lang + type: keyword + description: 'The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French).' + - name: name + type: keyword + description: The name of the product. + - name: path + type: keyword + description: The installation path of the product. + - name: uid + type: keyword + description: The unique identifier of the product. + - name: vendor_name + type: keyword + description: The name of the vendor of the product. + - name: version + type: keyword + description: 'The version of the product, as defined by the event source. For example: 2013.1.3-beta.' + - name: type + type: keyword + description: The vulnerability type as selected from a large dropdown menu during CVE refinement. + - name: uid + type: keyword + description: 'The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: CVE-2021-12345.' + - name: desc + type: keyword + description: The description of the vulnerability. + - name: fix_available + type: boolean + description: Indicates if a fix is available for the reported vulnerability. + - name: kb_articles + type: keyword + description: The KB article/s related to the entity. + - name: packages + type: group + fields: + - name: architecture + type: keyword + description: Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on. + - name: epoch + type: long + description: The software package epoch. Epoch is a way to define weighted dependencies based on version numbers. + - name: license + type: keyword + description: The software license applied to this package. + - name: name + type: keyword + description: The software package name. + - name: release + type: keyword + description: Release is the number of times a version of the software has been packaged. + - name: version + type: keyword + description: The software package version. + - name: references + type: keyword + description: Supporting reference URLs. + - name: related_vulnerabilities + type: keyword + description: List of vulnerabilities that are related to this vulnerability. + - name: severity + type: keyword + description: The event severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the event source. + - name: title + type: keyword + description: The title of the vulnerability. + - name: vendor_name + type: keyword + description: The vendor who identified the vulnerability. diff --git a/packages/amazon_security_lake/data_stream/event/manifest.yml b/packages/amazon_security_lake/data_stream/event/manifest.yml new file mode 100644 index 00000000000..ab3f0c7aa2b --- /dev/null +++ b/packages/amazon_security_lake/data_stream/event/manifest.yml @@ -0,0 +1,240 @@ +title: Collect Amazon Security Lake Events +type: logs +streams: + - input: aws-s3 + title: Amazon Security Lake Events + description: Collect Amazon Security Lake Events via AWS S3 input. + template_path: aws-s3.yml.hbs + vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: access_key_id + type: password + title: Access Key ID + multi: false + required: false + show_user: true + description: First part of access key. + - name: secret_access_key + type: password + title: Secret Access Key + multi: false + required: false + show_user: true + description: Second part of access key. + - name: session_token + type: text + title: Session Token + multi: false + required: false + show_user: true + description: Required when using temporary security credentials. + - name: decoding_batch_size + type: integer + title: Batch Size of Parquet Decoding + multi: false + required: false + show_user: false + default: 1 + description: The batch_size attribute can be used to specify the number of records to read from the parquet stream at a time. + - name: decoding_process_parallel + required: false + show_user: false + title: Process Parellel of Parquet Decoding + type: bool + multi: false + default: false + description: If the process_parallel attribute is set to true then functions which read multiple columns will read those columns in parallel from the parquet stream with a number of readers equal to the number of columns. + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: true + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: true + default: 6m + description: Time interval for polling listing of the S3 bucket. It should be greater than 5m. Supported units are h/m/s. + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: true + default: 5 + description: Number of workers that will process the S3 objects listed. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + description: URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS. + - name: visibility_timeout + type: text + title: "[SQS] Visibility Timeout" + multi: false + required: false + show_user: true + default: 300s + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. + - name: api_timeout + type: text + title: "[SQS] API Timeout" + multi: false + required: false + show_user: true + default: 120s + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. + - name: max_number_of_messages + type: integer + title: "[SQS] Maximum Concurrent SQS Messages" + required: false + show_user: true + default: 5 + description: The maximum number of SQS messages that can be inflight at any time. + - name: file_selectors + type: yaml + title: "[SQS] File Selectors" + multi: false + required: false + show_user: false + description: If the SQS queue will have events that correspond to files that this integration shouldn't process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed. + - name: region + type: text + title: "[SQS] Region" + multi: false + required: false + show_user: true + description: The name of the AWS region of the end point. If this option is given it takes precedence over the region name obtained from the queue_url value. + - name: fips_enabled + type: bool + title: Enable S3 FIPS + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: shared_credential_file + type: text + title: Shared Credential File + multi: false + required: false + show_user: false + description: Directory of the shared credentials file + - name: credential_profile_name + type: text + title: Credential Profile Name + multi: false + required: false + show_user: false + description: Profile name in shared credentials file. + - name: role_arn + type: text + title: Role ARN + multi: false + required: false + show_user: false + description: AWS IAM Role to assume. + - name: external_id + type: text + title: External ID + multi: false + required: false + show_user: false + description: External ID to use when assuming a role in another account. + - name: default_region + type: text + title: Default AWS Region + multi: false + required: false + show_user: false + default: "" + description: Default region to use prior to connecting to region specific services/endpoints if no AWS region is set from environment variable, credentials or instance profile. If none of the above are set and no default region is set as well, `us-east-1` is used. A region, either from environment variable, credentials or instance profile or from this default region setting, needs to be set when using regions in non-regular AWS environments such as AWS China or US Government Isolated. + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http\[s\]://:@: + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - amazon_security_lake-event + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: false + show_user: false + title: Preserve duplicate custom fields + description: Preserve ocsf fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- diff --git a/packages/amazon_security_lake/docs/README.md b/packages/amazon_security_lake/docs/README.md new file mode 100644 index 00000000000..3f726ab2de1 --- /dev/null +++ b/packages/amazon_security_lake/docs/README.md @@ -0,0 +1,2068 @@ +# Amazon Security Lake + +This [Amazon Security Lake](https://aws.amazon.com/security-lake/) integration helps you analyze security data, so you can get a more complete understanding of your security posture across the entire organization. With Security Lake, you can also improve the protection of your workloads, applications, and data. + +Security Lake automates the collection of security-related log and event data from integrated AWS services and third-party services. It also helps you manage the lifecycle of data with customizable retention and replication settings. Security Lake converts ingested data into Apache Parquet format and a standard open-source schema called the Open Cybersecurity Schema Framework (OCSF). With OCSF support, Security Lake normalizes and combines security data from AWS and a broad range of enterprise security data sources. + +The Amazon Security Lake integration can be used in two different modes to collect data: +- AWS S3 polling mode: Amazon Security Lake writes data to S3, and Elastic Agent polls the S3 bucket by listing its contents and reading new files. +- AWS S3 SQS mode: Amazon Security Lake writes data to S3, S3 sends a notification of a new object to SQS, the Elastic Agent receives the notification from SQS, and then reads the S3 object. Multiple agents can be used in this mode. + +## Compatibility + +This module follows the latest OCSF Schema Version **v1.0.0-rc.3**. + +## Data streams + +The Amazon Security Lake integration collects logs for the below [AWS services](https://docs.aws.amazon.com/security-lake/latest/userguide/open-cybersecurity-schema-framework.html) combined in a data stream named event: + +| Source | Class Name | +|-------------------------------------|-----------------------------------------------------| +| CloudTrail Lambda Data Events | API Activity | +| CloudTrail Management Events | API Activity, Authentication, or Account Change | +| CloudTrail S3 Data Events | API Activity | +| Route 53 | DNS Activity | +| Security Hub | Security Finding | +| VPC Flow Logs | Network Activity | + +### **NOTE**: +- The Amazon Security Lake integration supports events collected from [AWS services](https://docs.aws.amazon.com/security-lake/latest/userguide/internal-sources.html). + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the S3 bucket and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.11.0**. + +## Setup + +### To collect data from an AWS S3 bucket or AWS SQS, follow the below steps: + +1. To enable and start Amazon Security Lake, follow the steps mentioned here: `https://docs.aws.amazon.com/security-lake/latest/userguide/getting-started.html`. +2. Above steps will create AWS S3 bucket and AWS SQS queue. +3. Please follow below steps to create [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html#roles-creatingrole-user-console): + 1. Sign in to the AWS Management Console and open the [IAM console](https://console.aws.amazon.com/iam/). + 2. In the navigation panel, choose Roles and then click on Create role. + 3. Choose **AWS account** role type. + ![Role Type](../img/role_type.png) + 4. To create a role user have two options, + - To create a role for your account, choose **This account**. + ![This Account](../img/this_account.png) + - To create a role for another account, choose **Another AWS account** and enter the Account ID to which you want to grant access to your resources. + ![Another AWS Account](../img/another_aws_account.png) + 5. If you are granting permissions to users from an account that you don't control, and the users will assume this role programmatically, select **Require external ID**. The external ID can be any phrase or number that is agreed upon between you and the administrator of the third party account. Then Click Next. + ![External ID](../img/external_id.png) + 6. Select **AmazonS3FullAccess** and **AmazonSQSFullAccess** from Permissions policies. Then Click Next. + ![AmazonS3FullAccess](../img/s3_full_access.png) + ![AmazonSQSFullAccess](../img/sqs_full_access.png) + 7. For Role name, enter a name for your role. Role name must be unique within your AWS account. + 8. Preview the role and then choose Create role. + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations. +2. In "Search for integrations" search bar, type Amazon Security Lake. +3. Click on the "Amazon Security Lake" integration from the search results. +4. Click on the Add Amazon Security Lake Integration button to add the integration. +5. By default collect logs via S3 Bucket toggle will be off and collect logs for AWS SQS. +6. While adding the integration, if you want to collect logs via AWS SQS, then you have to put the following details: + - queue url + - collect logs via S3 Bucket toggled off + - Shared Credential File Path and Credential Profile Name / Access Key Id and Secret Access Key + + or if you want to collect logs via AWS S3, then you have to put the following details: + - bucket arn + - collect logs via S3 Bucket toggled on + - Shared Credential File Path and Credential Profile Name / Access Key Id and Secret Access Key +7. If user wants to access security lake by Assuming Role then add Role ARN or if user want to access resources of another account using Role ARN then add Role ARN and external ID. + +**NOTE**: There are other input combination options available, please check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html). + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| ocsf.activity_id | The normalized identifier of the activity that triggered the event. | keyword | +| ocsf.activity_name | The event activity name, as defined by the activity_id. | keyword | +| ocsf.actor.authorizations.decision | Authorization Result/outcome, e.g. allowed, denied. | keyword | +| ocsf.actor.authorizations.policy.desc | The description of the policy. | keyword | +| ocsf.actor.authorizations.policy.group.desc | The group description. | keyword | +| ocsf.actor.authorizations.policy.group.name | The group name. | keyword | +| ocsf.actor.authorizations.policy.group.privileges | The group privileges. | keyword | +| ocsf.actor.authorizations.policy.group.type | The type of the group or account. | keyword | +| ocsf.actor.authorizations.policy.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.authorizations.policy.name | The policy name. For example: IAM Policy. | keyword | +| ocsf.actor.authorizations.policy.uid | A unique identifier of the policy instance. | keyword | +| ocsf.actor.authorizations.policy.version | The policy version number. | keyword | +| ocsf.actor.idp.name | The name of the identity provider. | keyword | +| ocsf.actor.idp.uid | The unique identifier of the identity provider. | keyword | +| ocsf.actor.invoked_by | The name of the service that invoked the activity as described in the event. | keyword | +| ocsf.actor.process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.actor.process.cmd_line | The full command line used to launch an application, service, process, or job. | keyword | +| ocsf.actor.process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.container.image.labels | The image labels. | keyword | +| ocsf.actor.process.container.image.name | The image name. | keyword | +| ocsf.actor.process.container.image.path | The full path to the image file. | keyword | +| ocsf.actor.process.container.image.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.actor.process.container.image.uid | The unique image ID. | keyword | +| ocsf.actor.process.container.name | The container name. | keyword | +| ocsf.actor.process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.actor.process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.actor.process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.actor.process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.actor.process.container.size | The size of the container image. | long | +| ocsf.actor.process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.actor.process.container.uid | The full container unique identifier for this instantiation of the container. | keyword | +| ocsf.actor.process.created_time | The time when the process was created/started. | date | +| ocsf.actor.process.created_time_dt | The time when the process was created/started. | date | +| ocsf.actor.process.egid | The effective group under which this process is running. | keyword | +| ocsf.actor.process.euid | The effective user under which this process is running. | keyword | +| ocsf.actor.process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.actor.process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.actor.process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.actor.process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.actor.process.file.accessor.groups.name | The group name. | keyword | +| ocsf.actor.process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.actor.process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.actor.process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.actor.process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.actor.process.file.created_time | The time when the file was created. | date | +| ocsf.actor.process.file.created_time_dt | The time when the file was created. | date | +| ocsf.actor.process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.actor.process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.file.creator.groups.desc | The group description. | keyword | +| ocsf.actor.process.file.creator.groups.name | The group name. | keyword | +| ocsf.actor.process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.file.creator.name | The name of the city. | keyword | +| ocsf.actor.process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.actor.process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.actor.process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.actor.process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.actor.process.file.modified_time | The time when the file was last modified. | date | +| ocsf.actor.process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.actor.process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.file.modifier.email_addr | The image name. For example: elixir. | keyword | +| ocsf.actor.process.file.modifier.full_name | The user's email address. | keyword | +| ocsf.actor.process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.actor.process.file.modifier.groups.name | The group name. | keyword | +| ocsf.actor.process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.actor.process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.actor.process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.actor.process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.file.owner.groups.desc | The group description. | keyword | +| ocsf.actor.process.file.owner.groups.name | The group name. | keyword | +| ocsf.actor.process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.file.owner.type | The event occurred on a personal device.The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.actor.process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.actor.process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.actor.process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.actor.process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.actor.process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.actor.process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.actor.process.file.product.name | The name of the feature. | keyword | +| ocsf.actor.process.file.product.path | The installation path of the product. | keyword | +| ocsf.actor.process.file.product.uid | The unique identifier of the feature. | keyword | +| ocsf.actor.process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.actor.process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.actor.process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.actor.process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.actor.process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.actor.process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.actor.process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.actor.process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.actor.process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.actor.process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.actor.process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.actor.process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.actor.process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.actor.process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.actor.process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.actor.process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.file.size | The size of data, in bytes. | long | +| ocsf.actor.process.file.type | The file type. | keyword | +| ocsf.actor.process.file.type_id | The file type ID. | keyword | +| ocsf.actor.process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.actor.process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.actor.process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.actor.process.group.desc | The group description. | keyword | +| ocsf.actor.process.group.name | The group name. | keyword | +| ocsf.actor.process.group.privileges | The group privileges. | keyword | +| ocsf.actor.process.group.type | The type of the group or account. | keyword | +| ocsf.actor.process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.actor.process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.actor.process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.actor.process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.actor.process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.actor.process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.actor.process.parent_process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.actor.process.parent_process.cmd_line | The full command line used to launch an application, service, process, or job. | keyword | +| ocsf.actor.process.parent_process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.parent_process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.parent_process.container.image.labels | The image labels. | keyword | +| ocsf.actor.process.parent_process.container.image.name | The image name. | keyword | +| ocsf.actor.process.parent_process.container.image.path | The full path to the image file. | keyword | +| ocsf.actor.process.parent_process.container.image.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.actor.process.parent_process.container.image.uid | The unique image ID. | keyword | +| ocsf.actor.process.parent_process.container.name | The container name. | keyword | +| ocsf.actor.process.parent_process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.actor.process.parent_process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.actor.process.parent_process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.actor.process.parent_process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.actor.process.parent_process.container.size | The size of the container image. | long | +| ocsf.actor.process.parent_process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.actor.process.parent_process.container.uid | The full container unique identifier for this instantiation of the container. | keyword | +| ocsf.actor.process.parent_process.created_time | The time when the process was created/started. | date | +| ocsf.actor.process.parent_process.created_time_dt | The time when the process was created/started. | date | +| ocsf.actor.process.parent_process.egid | The effective group under which this process is running. | keyword | +| ocsf.actor.process.parent_process.euid | The effective user under which this process is running. | keyword | +| ocsf.actor.process.parent_process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.actor.process.parent_process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.actor.process.parent_process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.parent_process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.parent_process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.parent_process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.actor.process.parent_process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.parent_process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.file.accessor.groups.name | The group name. | keyword | +| ocsf.actor.process.parent_process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.parent_process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.parent_process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.parent_process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.parent_process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.parent_process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.parent_process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.parent_process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.parent_process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.actor.process.parent_process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.actor.process.parent_process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.actor.process.parent_process.file.created_time | The time when the file was created. | date | +| ocsf.actor.process.parent_process.file.created_time_dt | The time when the file was created. | date | +| ocsf.actor.process.parent_process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.parent_process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.parent_process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.parent_process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.actor.process.parent_process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.parent_process.file.creator.groups.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.file.creator.groups.name | The group name. | keyword | +| ocsf.actor.process.parent_process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.file.creator.name | The name of the city. | keyword | +| ocsf.actor.process.parent_process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.parent_process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.parent_process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.parent_process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.parent_process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.parent_process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.parent_process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.parent_process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.actor.process.parent_process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.parent_process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.parent_process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.actor.process.parent_process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.actor.process.parent_process.file.modified_time | The time when the file was last modified. | date | +| ocsf.actor.process.parent_process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.actor.process.parent_process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.parent_process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.parent_process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.parent_process.file.modifier.email_addr | The image name. For example: elixir. | keyword | +| ocsf.actor.process.parent_process.file.modifier.full_name | The user's email address. | keyword | +| ocsf.actor.process.parent_process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.file.modifier.groups.name | The group name. | keyword | +| ocsf.actor.process.parent_process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.parent_process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.parent_process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.parent_process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.parent_process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.parent_process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.parent_process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.parent_process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.parent_process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.actor.process.parent_process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.parent_process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.parent_process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.parent_process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.actor.process.parent_process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.parent_process.file.owner.groups.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.file.owner.groups.name | The group name. | keyword | +| ocsf.actor.process.parent_process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.parent_process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.parent_process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.parent_process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.parent_process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.parent_process.file.owner.type | The event occurred on a personal device.The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.parent_process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.actor.process.parent_process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.parent_process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.parent_process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.actor.process.parent_process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.actor.process.parent_process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.actor.process.parent_process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.actor.process.parent_process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.actor.process.parent_process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.actor.process.parent_process.file.product.name | The name of the feature. | keyword | +| ocsf.actor.process.parent_process.file.product.path | The installation path of the product. | keyword | +| ocsf.actor.process.parent_process.file.product.uid | The unique identifier of the feature. | keyword | +| ocsf.actor.process.parent_process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.actor.process.parent_process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.actor.process.parent_process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.actor.process.parent_process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.actor.process.parent_process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.actor.process.parent_process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.actor.process.parent_process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.actor.process.parent_process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.actor.process.parent_process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.actor.process.parent_process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.actor.process.parent_process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.actor.process.parent_process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.actor.process.parent_process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.actor.process.parent_process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.actor.process.parent_process.file.size | The size of data, in bytes. | long | +| ocsf.actor.process.parent_process.file.type | The file type. | keyword | +| ocsf.actor.process.parent_process.file.type_id | The file type ID. | keyword | +| ocsf.actor.process.parent_process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.actor.process.parent_process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.actor.process.parent_process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.actor.process.parent_process.group.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.group.name | The group name. | keyword | +| ocsf.actor.process.parent_process.group.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.group.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.actor.process.parent_process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.actor.process.parent_process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.actor.process.parent_process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.actor.process.parent_process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.actor.process.parent_process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.actor.process.parent_process.parent_process | The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting. | flattened | +| ocsf.actor.process.parent_process.parent_process_keyword | | keyword | +| ocsf.actor.process.parent_process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.actor.process.parent_process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.actor.process.parent_process.session.created_time | The time when the session was created. | date | +| ocsf.actor.process.parent_process.session.created_time_dt | The time when the session was created. | date | +| ocsf.actor.process.parent_process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.session.expiration_time | The session expiration time. | date | +| ocsf.actor.process.parent_process.session.expiration_time_dt | The session expiration time. | date | +| ocsf.actor.process.parent_process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.actor.process.parent_process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.actor.process.parent_process.session.mfa | | boolean | +| ocsf.actor.process.parent_process.session.uid | The unique identifier of the session. | keyword | +| ocsf.actor.process.parent_process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.actor.process.parent_process.terminated_time | The time when the process was terminated. | date | +| ocsf.actor.process.parent_process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.actor.process.parent_process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.actor.process.parent_process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.actor.process.parent_process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.parent_process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.parent_process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.parent_process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.parent_process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.parent_process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.parent_process.user.email_addr | The user's email address. | keyword | +| ocsf.actor.process.parent_process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.parent_process.user.groups.desc | The group description. | keyword | +| ocsf.actor.process.parent_process.user.groups.name | The group name. | keyword | +| ocsf.actor.process.parent_process.user.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.parent_process.user.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.parent_process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.parent_process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.parent_process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.parent_process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.parent_process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.parent_process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.parent_process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.parent_process.user.type_id | The account type identifier. | keyword | +| ocsf.actor.process.parent_process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.parent_process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.parent_process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.actor.process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.actor.process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.actor.process.session.created_time | The time when the session was created. | date | +| ocsf.actor.process.session.created_time_dt | The time when the session was created. | date | +| ocsf.actor.process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.session.expiration_time | The session expiration time. | date | +| ocsf.actor.process.session.expiration_time_dt | The session expiration time. | date | +| ocsf.actor.process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.actor.process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.actor.process.session.mfa | | boolean | +| ocsf.actor.process.session.uid | The unique identifier of the session. | keyword | +| ocsf.actor.process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.actor.process.terminated_time | The time when the process was terminated. | date | +| ocsf.actor.process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.actor.process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.actor.process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.actor.process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.process.user.email_addr | The user's email address. | keyword | +| ocsf.actor.process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.process.user.groups.desc | The group description. | keyword | +| ocsf.actor.process.user.groups.name | The group name. | keyword | +| ocsf.actor.process.user.groups.privileges | The group privileges. | keyword | +| ocsf.actor.process.user.groups.type | The type of the group or account. | keyword | +| ocsf.actor.process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.process.user.type_id | The account type identifier. | keyword | +| ocsf.actor.process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.actor.process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.actor.session.created_time | The time when the session was created. | date | +| ocsf.actor.session.created_time_dt | The time when the session was created. | date | +| ocsf.actor.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.session.expiration_time | The session expiration time. | date | +| ocsf.actor.session.expiration_time_dt | The session expiration time. | date | +| ocsf.actor.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.actor.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.actor.session.mfa | | boolean | +| ocsf.actor.session.uid | The unique identifier of the session. | keyword | +| ocsf.actor.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.actor.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.actor.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.actor.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.actor.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.actor.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.actor.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.actor.user.email_addr | The user's email address. | keyword | +| ocsf.actor.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.actor.user.groups.desc | The group description. | keyword | +| ocsf.actor.user.groups.name | The group name. | keyword | +| ocsf.actor.user.groups.privileges | The group privileges. | keyword | +| ocsf.actor.user.groups.type | The type of the group or account. | keyword | +| ocsf.actor.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.actor.user.name | The username. For example, janedoe1. | keyword | +| ocsf.actor.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.actor.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.actor.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.actor.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.actor.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.actor.user.type_id | The account type identifier. | keyword | +| ocsf.actor.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.actor.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.analytic.category | The analytic category. | keyword | +| ocsf.analytic.desc | The description of the analytic that generated the finding. | keyword | +| ocsf.analytic.name | The name of the analytic that generated the finding. | keyword | +| ocsf.analytic.related_analytics.category | The analytic category. | keyword | +| ocsf.analytic.related_analytics.desc | The description of the analytic that generated the finding. | keyword | +| ocsf.analytic.related_analytics.name | The name of the analytic that generated the finding. | keyword | +| ocsf.analytic.related_analytics.related_analytics | | flattened | +| ocsf.analytic.related_analytics.type | The analytic type. | keyword | +| ocsf.analytic.related_analytics.type_id | The analytic type ID. | keyword | +| ocsf.analytic.related_analytics.uid | The unique identifier of the analytic that generated the finding. | keyword | +| ocsf.analytic.related_analytics.version | The analytic version. For example: 1.1. | keyword | +| ocsf.analytic.type | The analytic type. | keyword | +| ocsf.analytic.type_id | The analytic type ID. | keyword | +| ocsf.analytic.uid | The unique identifier of the analytic that generated the finding. | keyword | +| ocsf.analytic.version | The analytic version. For example: 1.1. | keyword | +| ocsf.answers.class | The class of DNS data contained in this resource record. See RFC1035. For example: IN. | keyword | +| ocsf.answers.flag_ids | The list of DNS answer header flag IDs. | keyword | +| ocsf.answers.flags | The list of DNS answer header flags. | keyword | +| ocsf.answers.packet_uid | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | +| ocsf.answers.rdata | The data describing the DNS resource. The meaning of this data depends on the type and class of the resource record. | keyword | +| ocsf.answers.ttl | The time interval that the resource record may be cached. Zero value means that the resource record can only be used for the transaction in progress, and should not be cached. | long | +| ocsf.answers.type | The type of data contained in this resource record. See RFC1035. For example: CNAME. | keyword | +| ocsf.api.operation | Verb/Operation associated with the request. | keyword | +| ocsf.api.request.flags | The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source. | keyword | +| ocsf.api.request.uid | The unique request identifier. | keyword | +| ocsf.api.response.code | The numeric response sent to a request. | long | +| ocsf.api.response.error | Error Code. | keyword | +| ocsf.api.response.error_message | Error Message. | keyword | +| ocsf.api.response.flags | The list of communication flags, normalized to the captions of the flag_ids values. In the case of 'Other', they are defined by the event source. | keyword | +| ocsf.api.response.message | The description of the event, as defined by the event source. | keyword | +| ocsf.api.service.labels | The list of labels associated with the service. | keyword | +| ocsf.api.service.name | The name of the service. | keyword | +| ocsf.api.service.uid | The unique identifier of the service. | keyword | +| ocsf.api.service.version | The version of the service. | keyword | +| ocsf.api.version | The version of the API service. | keyword | +| ocsf.app_name | The name of the application that is associated with the event or object. | keyword | +| ocsf.attacks.tactics.name | The tactic name that is associated with the attack technique, as defined by ATT&CK MatrixTM. | keyword | +| ocsf.attacks.tactics.uid | The tactic ID that is associated with the attack technique, as defined by ATT&CK MatrixTM. | keyword | +| ocsf.attacks.technique.name | The name of the attack technique, as defined by ATT&CK MatrixTM. For example: Drive-by Compromise. | keyword | +| ocsf.attacks.technique.uid | The unique identifier of the attack technique, as defined by ATT&CK MatrixTM. For example: T1189. | keyword | +| ocsf.attacks.version | The ATT&CK Matrix version. | keyword | +| ocsf.auth_protocol | The authentication protocol as defined by the caption of 'auth_protocol_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.auth_protocol_id | The normalized identifier of the authentication protocol used to create the user session. | keyword | +| ocsf.category_name | The event category name, as defined by category_uid value: Identity & Access Management. | keyword | +| ocsf.category_uid | The category unique identifier of the event.3 Identity & Access ManagementIdentity & Access Management (IAM) events relate to the supervision of the system's authentication and access control model. Examples of such events are the success or failure of authentication, granting of authority, password change, entity change, privileged use etc. | keyword | +| ocsf.certificate.created_time | The time when the certificate was created. | date | +| ocsf.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.certificate.version | The certificate version. | keyword | +| ocsf.cis_csc.control | The CIS critical security control. | keyword | +| ocsf.cis_csc.version | The CIS critical security control version. | keyword | +| ocsf.class_name | The event class name, as defined by class_uid value: Security Finding. | keyword | +| ocsf.class_uid | The unique identifier of a class. A Class describes the attributes available in an event.2001 Security FindingSecurity Finding events describe findings, detections, anomalies, alerts and/or actions performed by security products. | keyword | +| ocsf.cloud.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.cloud.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.cloud.account.type_id | The normalized account type identifier. | keyword | +| ocsf.cloud.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.cloud.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.cloud.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.cloud.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.cloud.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.cloud.project_uid | The unique identifier of a Cloud project. | keyword | +| ocsf.cloud.provider | The unique name of the Cloud services provider, such as AWS, MS Azure, GCP, etc. | keyword | +| ocsf.cloud.region | The name of the cloud region, as defined by the cloud provider. | keyword | +| ocsf.cloud.zone | The availability zone in the cloud region, as defined by the cloud provider. | keyword | +| ocsf.compliance.requirements | A list of applicable compliance requirements for which this finding is related to. | keyword | +| ocsf.compliance.status | The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.compliance.status_detail | The status details contains additional information about the event outcome. | keyword | +| ocsf.confidence | The confidence, normalized to the caption of the confidence_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.confidence_id | The normalized confidence refers to the accuracy of the rule that created the finding. A rule with a low confidence means that the finding scope is wide and may create finding reports that may not be malicious in nature. | keyword | +| ocsf.confidence_score | The confidence score as reported by the event source. | long | +| ocsf.connection_info.boundary | The boundary of the connection, normalized to the caption of 'boundary_id'. In the case of 'Other', it is defined by the event source.For cloud connections, this translates to the traffic-boundary(same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External. | keyword | +| ocsf.connection_info.boundary_id | The normalized identifier of the boundary of the connection. For cloud connections, this translates to the traffic-boundary (same VPC, through IGW, etc.). For traditional networks, this is described as Local, Internal, or External. | keyword | +| ocsf.connection_info.direction | The direction of the initiated connection, traffic, or email, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.connection_info.direction_id | The normalized identifier of the direction of the initiated connection, traffic, or email. | keyword | +| ocsf.connection_info.protocol_name | The TCP/IP protocol name in lowercase, as defined by the Internet Assigned Numbers Authority (IANA). See Protocol Numbers. For example: tcp or udp. | keyword | +| ocsf.connection_info.protocol_num | The TCP/IP protocol number, as defined by the Internet Assigned Numbers Authority (IANA). Use -1 if the protocol is not defined by IANA. See Protocol Numbers. For example: 6 for TCP and 17 for UDP. | keyword | +| ocsf.connection_info.protocol_ver | The Internet Protocol version. | keyword | +| ocsf.connection_info.protocol_ver_id | The Internet Protocol version identifier. | keyword | +| ocsf.connection_info.tcp_flags | The network connection TCP header flags (i.e., control bits). | long | +| ocsf.connection_info.uid | The unique identifier of the connection. | keyword | +| ocsf.count | The number of times that events in the same logical group occurred during the event Start Time to End Time period. | long | +| ocsf.data_sources | The data sources for the finding. | keyword | +| ocsf.device.autoscale_uid | The unique identifier of the cloud autoscale configuration. | keyword | +| ocsf.device.created_time | The time when the device was known to have been created. | date | +| ocsf.device.created_time_dt | TThe time when the device was known to have been created. | date | +| ocsf.device.desc | The description of the device, ordinarily as reported by the operating system. | keyword | +| ocsf.device.domain | The network domain where the device resides. For example: work.example.com. | keyword | +| ocsf.device.first_seen_time | The initial discovery time of the device. | date | +| ocsf.device.first_seen_time_dt | The initial discovery time of the device. | date | +| ocsf.device.groups.desc | The group description. | keyword | +| ocsf.device.groups.name | The group name. | keyword | +| ocsf.device.groups.privileges | The group privileges. | keyword | +| ocsf.device.groups.type | The type of the group or account. | keyword | +| ocsf.device.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.device.hostname | The devicename. | keyword | +| ocsf.device.hw_info.bios_date | The BIOS date. For example: 03/31/16. | keyword | +| ocsf.device.hw_info.bios_manufacturer | The BIOS manufacturer. For example: LENOVO. | keyword | +| ocsf.device.hw_info.bios_ver | The BIOS version. For example: LENOVO G5ETA2WW (2.62). | keyword | +| ocsf.device.hw_info.chassis | The chassis type describes the system enclosure or physical form factor. Such as the following examples for Windows Windows Chassis Types. | keyword | +| ocsf.device.hw_info.cpu_bits | The cpu architecture, the number of bits used for addressing in memory. For example: 32 or 64. | long | +| ocsf.device.hw_info.cpu_cores | The number of processor cores in all installed processors. For Example: 42. | long | +| ocsf.device.hw_info.cpu_count | The number of physical processors on a system. For example: 1. | long | +| ocsf.device.hw_info.cpu_speed | The speed of the processor in Mhz. For Example: 4200. | long | +| ocsf.device.hw_info.cpu_type | The processor type. For example: x86 Family 6 Model 37 Stepping 5. | keyword | +| ocsf.device.hw_info.desktop_display.color_depth | The numeric color depth. | long | +| ocsf.device.hw_info.desktop_display.physical_height | The numeric physical height of display. | long | +| ocsf.device.hw_info.desktop_display.physical_orientation | The numeric physical orientation of display. | long | +| ocsf.device.hw_info.desktop_display.physical_width | The numeric physical width of display. | long | +| ocsf.device.hw_info.desktop_display.scale_factor | The numeric scale factor of display. | long | +| ocsf.device.hw_info.keyboard_info.function_keys | The number of function keys on client keyboard. | long | +| ocsf.device.hw_info.keyboard_info.ime | The Input Method Editor (IME) file name. | keyword | +| ocsf.device.hw_info.keyboard_info.keyboard_layout | The keyboard locale identifier name (e.g., en-US). | keyword | +| ocsf.device.hw_info.keyboard_info.keyboard_subtype | The keyboard numeric code. | long | +| ocsf.device.hw_info.keyboard_info.keyboard_type | The keyboard type (e.g., xt, ico). | keyword | +| ocsf.device.hw_info.ram_size | The total amount of installed RAM, in Megabytes. For example: 2048. | long | +| ocsf.device.hw_info.serial_number | The device manufacturer serial number. | keyword | +| ocsf.device.hypervisor | The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc. | keyword | +| ocsf.device.image.labels | The image labels. | keyword | +| ocsf.device.image.name | The image name. For example: elixir. | keyword | +| ocsf.device.image.path | The full path to the image file. | keyword | +| ocsf.device.image.tag | The image tag. For example: 1.11-alpine. | keyword | +| ocsf.device.image.uid | The unique image ID. For example: 77af4d6b9913. | keyword | +| ocsf.device.imei | The International Mobile Station Equipment Identifier that is associated with the device. | keyword | +| ocsf.device.instance_uid | The unique identifier of a VM instance. | keyword | +| ocsf.device.interface_name | The name of the network interface (e.g. eth2). | keyword | +| ocsf.device.interface_uid | The unique identifier of the network interface. | keyword | +| ocsf.device.ip | The device IP address, in either IPv4 or IPv6 format. | ip | +| ocsf.device.is_compliant | The event occurred on a compliant device. | boolean | +| ocsf.device.is_managed | The event occurred on a managed device. | boolean | +| ocsf.device.is_personal | The event occurred on a personal device. | boolean | +| ocsf.device.is_trusted | The event occurred on a trusted device. | boolean | +| ocsf.device.last_seen_time | The most recent discovery time of the device. | date | +| ocsf.device.last_seen_time_dt | The most recent discovery time of the device. | date | +| ocsf.device.location.city | The name of the city. | keyword | +| ocsf.device.location.continent | The name of the continent. | keyword | +| ocsf.device.location.coordinates | A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. | geo_point | +| ocsf.device.location.country | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. | keyword | +| ocsf.device.location.desc | The description of the geographical location. | keyword | +| ocsf.device.location.is_on_premises | The indication of whether the location is on premises. | boolean | +| ocsf.device.location.isp | The name of the Internet Service Provider (ISP). | keyword | +| ocsf.device.location.postal_code | The postal code of the location. | keyword | +| ocsf.device.location.provider | The provider of the geographical location data. | keyword | +| ocsf.device.location.region | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. | keyword | +| ocsf.device.mac | The device Media Access Control (MAC) address. | keyword | +| ocsf.device.modified_time | The time when the device was last known to have been modified. | date | +| ocsf.device.modified_time_dt | The time when the device was last known to have been modified. | date | +| ocsf.device.name | The alternate device name, ordinarily as assigned by an administrator. The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234. | keyword | +| ocsf.device.network_interfaces.hostname | The hostname associated with the network interface. | keyword | +| ocsf.device.network_interfaces.ip | The IP address associated with the network interface. | ip | +| ocsf.device.network_interfaces.mac | The MAC address of the network interface. | keyword | +| ocsf.device.network_interfaces.name | The name of the network interface. | keyword | +| ocsf.device.network_interfaces.namespace | The namespace is useful in merger or acquisition situations. For example, when similar entities exists that you need to keep separate. | keyword | +| ocsf.device.network_interfaces.type | The type of network interface. | keyword | +| ocsf.device.network_interfaces.type_id | The network interface type identifier. | keyword | +| ocsf.device.network_interfaces.uid | The unique identifier for the network interface. | keyword | +| ocsf.device.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.device.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.device.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.device.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.device.os.build | The operating system build number. | keyword | +| ocsf.device.os.country | The operating system country code, as defined by the ISO 3166-1 standard (Alpha-2 code). For the complete list of country codes, see ISO 3166-1 alpha-2 codes. | keyword | +| ocsf.device.os.cpu_bits | The cpu architecture, the number of bits used for addressing in memory. For example, 32 or 64. | long | +| ocsf.device.os.edition | The operating system edition. For example, Professional. | keyword | +| ocsf.device.os.lang | The two letter lower case language codes, as defined by ISO 639-1. | keyword | +| ocsf.device.os.name | The operating system name. | keyword | +| ocsf.device.os.sp_name | The name of the latest Service Pack. | keyword | +| ocsf.device.os.sp_ver | The version number of the latest Service Pack. | keyword | +| ocsf.device.os.type | The type of the operating system. | keyword | +| ocsf.device.os.type_id | The type identifier of the operating system. | keyword | +| ocsf.device.os.version | The version of the OS running on the device that originated the event. For example, "Windows 10", "OS X 10.7", or "iOS 9". | keyword | +| ocsf.device.region | The region where the virtual machine is located. For example, an AWS Region. | keyword | +| ocsf.device.risk_level | The risk level, normalized to the caption of the risk_level_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.device.risk_level_id | The normalized risk level id. | keyword | +| ocsf.device.risk_score | The risk score as reported by the event source. | long | +| ocsf.device.subnet | The subnet mask. | ip_range | +| ocsf.device.subnet_uid | The unique identifier of a virtual subnet. | keyword | +| ocsf.device.type | The device type. For example, unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other. | keyword | +| ocsf.device.type_id | The device type ID. | keyword | +| ocsf.device.uid | The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN. | keyword | +| ocsf.device.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.device.vlan_uid | The Virtual LAN identifier. | keyword | +| ocsf.device.vpc_uid | The unique identifier of the Virtual Private Cloud (VPC). | keyword | +| ocsf.disposition | The event disposition name, normalized to the caption of the disposition_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.disposition_id | When security issues, such as malware or policy violations, are detected and possibly corrected, then disposition_id describes the action taken by the security product. | keyword | +| ocsf.dst_endpoint.domain | The name of the domain. | keyword | +| ocsf.dst_endpoint.hostname | The fully qualified name of the endpoint. | keyword | +| ocsf.dst_endpoint.instance_uid | The unique identifier of a VM instance. | keyword | +| ocsf.dst_endpoint.interface_name | The name of the network interface (e.g. eth2). | keyword | +| ocsf.dst_endpoint.interface_uid | The unique identifier of the network interface. | keyword | +| ocsf.dst_endpoint.intermediate_ips | The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. | ip | +| ocsf.dst_endpoint.ip | The IP address of the endpoint, in either IPv4 or IPv6 format. | ip | +| ocsf.dst_endpoint.location.city | The name of the city. | keyword | +| ocsf.dst_endpoint.location.continent | The name of the continent. | keyword | +| ocsf.dst_endpoint.location.coordinates | A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. | geo_point | +| ocsf.dst_endpoint.location.country | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. | keyword | +| ocsf.dst_endpoint.location.desc | The description of the geographical location. | keyword | +| ocsf.dst_endpoint.location.is_on_premises | The indication of whether the location is on premises. | boolean | +| ocsf.dst_endpoint.location.isp | The name of the Internet Service Provider (ISP). | keyword | +| ocsf.dst_endpoint.location.postal_code | The postal code of the location. | keyword | +| ocsf.dst_endpoint.location.provider | The provider of the geographical location data. | keyword | +| ocsf.dst_endpoint.location.region | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. | keyword | +| ocsf.dst_endpoint.mac | The Media Access Control (MAC) address of the endpoint. | keyword | +| ocsf.dst_endpoint.name | The short name of the endpoint. | keyword | +| ocsf.dst_endpoint.port | The port used for communication within the network connection. | long | +| ocsf.dst_endpoint.subnet_uid | The unique identifier of a virtual subnet. | keyword | +| ocsf.dst_endpoint.svc_name | The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. | keyword | +| ocsf.dst_endpoint.uid | The unique identifier of the endpoint. | keyword | +| ocsf.dst_endpoint.vlan_uid | The Virtual LAN identifier. | keyword | +| ocsf.dst_endpoint.vpc_uid | The unique identifier of the Virtual Private Cloud (VPC). | keyword | +| ocsf.duration | The event duration or aggregate time, the amount of time the event covers from start_time to end_time in milliseconds. | long | +| ocsf.end_time | The end time of a time period, or the time of the most recent event included in the aggregate event. | date | +| ocsf.end_time_dt | The end time of a time period, or the time of the most recent event included in the aggregate event. | date | +| ocsf.enrichments.data | The enrichment data associated with the attribute and value. The meaning of this data depends on the type the enrichment record. | flattened | +| ocsf.enrichments.name | The name of the attribute to which the enriched data pertains. | keyword | +| ocsf.enrichments.provider | The enrichment data provider name. | keyword | +| ocsf.enrichments.type | The enrichment type. For example, location. | keyword | +| ocsf.enrichments.value | The value of the attribute to which the enriched data pertains. | keyword | +| ocsf.evidence | The data the finding exposes to the analyst. | flattened | +| ocsf.finding.created_time | The time when the finding was created. | date | +| ocsf.finding.created_time_dt | The time when the finding was created. | date | +| ocsf.finding.desc | The description of the reported finding. | keyword | +| ocsf.finding.first_seen_time | The time when the finding was first observed. | date | +| ocsf.finding.first_seen_time_dt | The time when the finding was first observed. | date | +| ocsf.finding.last_seen_time | The time when the finding was most recently observed. | date | +| ocsf.finding.last_seen_time_dt | The time when the finding was most recently observed. | date | +| ocsf.finding.modified_time | The time when the finding was last modified. | date | +| ocsf.finding.modified_time_dt | The time when the finding was last modified. | date | +| ocsf.finding.product_uid | The unique identifier of the product that reported the finding. | keyword | +| ocsf.finding.related_events.product_uid | The unique identifier of the product that reported the related event. | keyword | +| ocsf.finding.related_events.type | The type of the related event. For example: Process Activity: Launch. | keyword | +| ocsf.finding.related_events.type_uid | The unique identifier of the related event type. For example: 100701. | keyword | +| ocsf.finding.related_events.uid | The unique identifier of the related event. | keyword | +| ocsf.finding.remediation.desc | The description of the remediation strategy. | keyword | +| ocsf.finding.remediation.kb_articles | The KB article/s related to the entity. | keyword | +| ocsf.finding.src_url | The URL pointing to the source of the finding. | keyword | +| ocsf.finding.supporting_data | Additional data supporting a finding as provided by security tool. | flattened | +| ocsf.finding.title | The title of the reported finding. | keyword | +| ocsf.finding.types | One or more types of the reported finding. | keyword | +| ocsf.finding.uid | The unique identifier of the reported finding. | keyword | +| ocsf.http_request.args | The arguments sent along with the HTTP request. | keyword | +| ocsf.http_request.http_headers.name | The name of the header. | keyword | +| ocsf.http_request.http_headers.value | The value of the header. | keyword | +| ocsf.http_request.http_method | The HTTP request method indicates the desired action to be performed for a given resource. | keyword | +| ocsf.http_request.referrer | The request header that identifies the address of the previous web page, which is linked to the current web page or resource being requested. | keyword | +| ocsf.http_request.uid | The unique identifier of the http request. | keyword | +| ocsf.http_request.url.categories | The Website categorization names, as defined by category_ids enum values. | keyword | +| ocsf.http_request.url.category_ids | The Website categorization identifies. | keyword | +| ocsf.http_request.url.hostname | The URL host as extracted from the URL. For example, www.example.com from www.example.com/download/trouble. | keyword | +| ocsf.http_request.url.path | The URL path as extracted from the URL. For example, /download/trouble from www.example.com/download/trouble. | keyword | +| ocsf.http_request.url.port | The URL port. For example, 80. | long | +| ocsf.http_request.url.query_string | The query portion of the URL. For example, the query portion of the URL http://www.example.com/search?q=bad&sort=date is q=bad&sort=date. | keyword | +| ocsf.http_request.url.resource_type | The context in which a resource was retrieved in a web request. | keyword | +| ocsf.http_request.url.scheme | The scheme portion of the URL. For example, http, https, ftp, or sftp. | keyword | +| ocsf.http_request.url.subdomain | The subdomain portion of the URL. For example, sub in https://sub.example.com or sub2.sub1 in https://sub2.sub1.example.com. | keyword | +| ocsf.http_request.url.url_string | The URL string. See RFC 1738. For example, http://www.example.com/download/trouble.exe. | keyword | +| ocsf.http_request.user_agent | The request header that identifies the operating system and web browser. | keyword | +| ocsf.http_request.version | The Hypertext Transfer Protocol (HTTP) version. | keyword | +| ocsf.http_request.x_forwarded_for | The X-Forwarded-For header identifying the originating IP address(es) of a client connecting to a web server through an HTTP proxy or a load balancer. | ip | +| ocsf.impact | The impact , normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.impact_id | The normalized impact of the finding. | keyword | +| ocsf.impact_score | The impact of the finding, valid range 0-100. | long | +| ocsf.is_cleartext | Indicates whether the credentials were passed in clear text.Note: True if the credentials were passed in a clear text protocol such as FTP or TELNET, or if Windows detected that a user's logon password was passed to the authentication package in clear text. | boolean | +| ocsf.is_mfa | Indicates whether Multi Factor Authentication was used during authentication. | boolean | +| ocsf.is_new_logon | Indicates logon is from a device not seen before or a first time account logon. | boolean | +| ocsf.is_remote | The attempted authentication is over a remote connection. | boolean | +| ocsf.kill_chain.phase | The cyber kill chain phase. | keyword | +| ocsf.kill_chain.phase_id | The cyber kill chain phase identifier. | keyword | +| ocsf.logon_process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.logon_process.cmd_line | The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used. | keyword | +| ocsf.logon_process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.container.image.labels | The image labels. | keyword | +| ocsf.logon_process.container.image.name | The image name. For example: elixir. | keyword | +| ocsf.logon_process.container.image.path | The full path to the image file. | keyword | +| ocsf.logon_process.container.image.tag | The image tag. For example: 1.11-alpine. | keyword | +| ocsf.logon_process.container.image.uid | The unique image ID. For example: 77af4d6b9913. | keyword | +| ocsf.logon_process.container.name | The container name. | keyword | +| ocsf.logon_process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.logon_process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.logon_process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.logon_process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.logon_process.container.size | The size of the container image. | long | +| ocsf.logon_process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.logon_process.container.uid | The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf. | keyword | +| ocsf.logon_process.created_time | The time when the process was created/started. | date | +| ocsf.logon_process.created_time_dt | The time when the process was created/started. | date | +| ocsf.logon_process.egid | The effective group under which this process is running. | keyword | +| ocsf.logon_process.euid | The effective user under which this process is running. | keyword | +| ocsf.logon_process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.logon_process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.logon_process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.logon_process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.logon_process.file.accessor.groups.name | The group name. | keyword | +| ocsf.logon_process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.logon_process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.logon_process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.logon_process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.logon_process.file.created_time | The time when the file was created. | date | +| ocsf.logon_process.file.created_time_dt | The time when the file was created. | date | +| ocsf.logon_process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.logon_process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.file.creator.groups.desc | The group description. | keyword | +| ocsf.logon_process.file.creator.groups.name | The group name. | keyword | +| ocsf.logon_process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.file.creator.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.logon_process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.logon_process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.logon_process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.logon_process.file.modified_time | The time when the file was last modified. | date | +| ocsf.logon_process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.logon_process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.file.modifier.email_addr | The user's email address. | keyword | +| ocsf.logon_process.file.modifier.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.logon_process.file.modifier.groups.name | The group name. | keyword | +| ocsf.logon_process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.logon_process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.logon_process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.logon_process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.file.owner.groups.desc | The group description. | keyword | +| ocsf.logon_process.file.owner.groups.name | The group name. | keyword | +| ocsf.logon_process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.file.owner.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.logon_process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.logon_process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.logon_process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.logon_process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.logon_process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.logon_process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.logon_process.file.product.name | The name of the product. | keyword | +| ocsf.logon_process.file.product.path | The installation path of the product. | keyword | +| ocsf.logon_process.file.product.uid | The unique identifier of the product. | keyword | +| ocsf.logon_process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.logon_process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.logon_process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.logon_process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.logon_process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.logon_process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.logon_process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.logon_process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.logon_process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.logon_process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.logon_process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.logon_process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.logon_process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.logon_process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.logon_process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.logon_process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.file.size | The size of data, in bytes. | long | +| ocsf.logon_process.file.type | The file type. | keyword | +| ocsf.logon_process.file.type_id | The file type ID. | keyword | +| ocsf.logon_process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.logon_process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.logon_process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.logon_process.group.desc | The group description. | keyword | +| ocsf.logon_process.group.name | The group name. | keyword | +| ocsf.logon_process.group.privileges | The group privileges. | keyword | +| ocsf.logon_process.group.type | The type of the group or account. | keyword | +| ocsf.logon_process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.logon_process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.logon_process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.logon_process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.logon_process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.logon_process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.logon_process.parent_process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.logon_process.parent_process.cmd_line | The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used. | keyword | +| ocsf.logon_process.parent_process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.parent_process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.parent_process.container.image.labels | The image labels. | keyword | +| ocsf.logon_process.parent_process.container.image.name | The image name. For example: elixir. | keyword | +| ocsf.logon_process.parent_process.container.image.path | The full path to the image file. | keyword | +| ocsf.logon_process.parent_process.container.image.tag | The image tag. For example: 1.11-alpine. | keyword | +| ocsf.logon_process.parent_process.container.image.uid | The unique image ID. For example: 77af4d6b9913. | keyword | +| ocsf.logon_process.parent_process.container.name | The container name. | keyword | +| ocsf.logon_process.parent_process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.logon_process.parent_process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.logon_process.parent_process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.logon_process.parent_process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.logon_process.parent_process.container.size | The size of the container image. | long | +| ocsf.logon_process.parent_process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.logon_process.parent_process.container.uid | The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf. | keyword | +| ocsf.logon_process.parent_process.created_time | The time when the process was created/started. | date | +| ocsf.logon_process.parent_process.created_time_dt | The time when the process was created/started. | date | +| ocsf.logon_process.parent_process.egid | The effective group under which this process is running. | keyword | +| ocsf.logon_process.parent_process.euid | The effective user under which this process is running. | keyword | +| ocsf.logon_process.parent_process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.logon_process.parent_process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.logon_process.parent_process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.parent_process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.parent_process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.parent_process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.logon_process.parent_process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.parent_process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.file.accessor.groups.name | The group name. | keyword | +| ocsf.logon_process.parent_process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.parent_process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.parent_process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.parent_process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.parent_process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.parent_process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.parent_process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.parent_process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.parent_process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.logon_process.parent_process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.logon_process.parent_process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.logon_process.parent_process.file.created_time | The time when the file was created. | date | +| ocsf.logon_process.parent_process.file.created_time_dt | The time when the file was created. | date | +| ocsf.logon_process.parent_process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.parent_process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.parent_process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.parent_process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.logon_process.parent_process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.parent_process.file.creator.groups.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.file.creator.groups.name | The group name. | keyword | +| ocsf.logon_process.parent_process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.file.creator.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.parent_process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.parent_process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.parent_process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.parent_process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.parent_process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.parent_process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.parent_process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.parent_process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.logon_process.parent_process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.parent_process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.parent_process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.logon_process.parent_process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.logon_process.parent_process.file.modified_time | The time when the file was last modified. | date | +| ocsf.logon_process.parent_process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.logon_process.parent_process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.parent_process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.parent_process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.parent_process.file.modifier.email_addr | The user's email address. | keyword | +| ocsf.logon_process.parent_process.file.modifier.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.parent_process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.file.modifier.groups.name | The group name. | keyword | +| ocsf.logon_process.parent_process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.parent_process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.parent_process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.parent_process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.parent_process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.parent_process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.parent_process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.parent_process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.parent_process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.logon_process.parent_process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.parent_process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.parent_process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.parent_process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.logon_process.parent_process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.parent_process.file.owner.groups.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.file.owner.groups.name | The group name. | keyword | +| ocsf.logon_process.parent_process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.parent_process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.parent_process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.parent_process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.parent_process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.parent_process.file.owner.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.parent_process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.logon_process.parent_process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.parent_process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.parent_process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.logon_process.parent_process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.logon_process.parent_process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.logon_process.parent_process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.logon_process.parent_process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.logon_process.parent_process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.logon_process.parent_process.file.product.name | The name of the product. | keyword | +| ocsf.logon_process.parent_process.file.product.path | The installation path of the product. | keyword | +| ocsf.logon_process.parent_process.file.product.uid | The unique identifier of the product. | keyword | +| ocsf.logon_process.parent_process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.logon_process.parent_process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.logon_process.parent_process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.logon_process.parent_process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.logon_process.parent_process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.logon_process.parent_process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.logon_process.parent_process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.logon_process.parent_process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.logon_process.parent_process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.logon_process.parent_process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.logon_process.parent_process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.logon_process.parent_process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.logon_process.parent_process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.logon_process.parent_process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.logon_process.parent_process.file.size | The size of data, in bytes. | long | +| ocsf.logon_process.parent_process.file.type | The file type. | keyword | +| ocsf.logon_process.parent_process.file.type_id | The file type ID. | keyword | +| ocsf.logon_process.parent_process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.logon_process.parent_process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.logon_process.parent_process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.logon_process.parent_process.group.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.group.name | The group name. | keyword | +| ocsf.logon_process.parent_process.group.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.group.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.logon_process.parent_process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.logon_process.parent_process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.logon_process.parent_process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.logon_process.parent_process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.logon_process.parent_process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.logon_process.parent_process.parent_process | The parent process of this process object. It is recommended to only populate this field for the first process object, to prevent deep nesting. | flattened | +| ocsf.logon_process.parent_process.parent_process_keyword | | keyword | +| ocsf.logon_process.parent_process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.logon_process.parent_process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.logon_process.parent_process.session.created_time | The time when the session was created. | date | +| ocsf.logon_process.parent_process.session.created_time_dt | The time when the session was created. | date | +| ocsf.logon_process.parent_process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.session.expiration_time | The session expiration time. | date | +| ocsf.logon_process.parent_process.session.expiration_time_dt | The session expiration time. | date | +| ocsf.logon_process.parent_process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.logon_process.parent_process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.logon_process.parent_process.session.mfa | | boolean | +| ocsf.logon_process.parent_process.session.uid | The unique identifier of the session. | keyword | +| ocsf.logon_process.parent_process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.logon_process.parent_process.terminated_time | The time when the process was terminated. | date | +| ocsf.logon_process.parent_process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.logon_process.parent_process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.logon_process.parent_process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.logon_process.parent_process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.parent_process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.parent_process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.parent_process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.parent_process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.parent_process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.parent_process.user.email_addr | The user's email address. | keyword | +| ocsf.logon_process.parent_process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.parent_process.user.groups.desc | The group description. | keyword | +| ocsf.logon_process.parent_process.user.groups.name | The group name. | keyword | +| ocsf.logon_process.parent_process.user.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.parent_process.user.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.parent_process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.parent_process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.parent_process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.parent_process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.parent_process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.parent_process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.parent_process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.parent_process.user.type_id | The account type identifier. | keyword | +| ocsf.logon_process.parent_process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.parent_process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.parent_process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.logon_process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.logon_process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.logon_process.session.created_time | The time when the session was created. | date | +| ocsf.logon_process.session.created_time_dt | The time when the session was created. | date | +| ocsf.logon_process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.session.expiration_time | The session expiration time. | date | +| ocsf.logon_process.session.expiration_time_dt | The session expiration time. | date | +| ocsf.logon_process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.logon_process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.logon_process.session.mfa | | boolean | +| ocsf.logon_process.session.uid | The unique identifier of the session. | keyword | +| ocsf.logon_process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.logon_process.terminated_time | The time when the process was terminated. | date | +| ocsf.logon_process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.logon_process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.logon_process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.logon_process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.logon_process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.logon_process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.logon_process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.logon_process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.logon_process.user.email_addr | The user's email address. | keyword | +| ocsf.logon_process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.logon_process.user.groups.desc | The group description. | keyword | +| ocsf.logon_process.user.groups.name | The group name. | keyword | +| ocsf.logon_process.user.groups.privileges | The group privileges. | keyword | +| ocsf.logon_process.user.groups.type | The type of the group or account. | keyword | +| ocsf.logon_process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.logon_process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.logon_process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.logon_process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.logon_process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.logon_process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.logon_process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.logon_process.user.type_id | The account type identifier. | keyword | +| ocsf.logon_process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.logon_process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.logon_process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.logon_type | The logon type, normalized to the caption of the logon_type_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.logon_type_id | The normalized logon type identifier | keyword | +| ocsf.malware.classification_ids | The list of normalized identifiers of the malware classifications. | keyword | +| ocsf.malware.classifications | The list of malware classifications, normalized to the captions of the classification_id values. In the case of 'Other', they are defined by the event source. | keyword | +| ocsf.malware.cves.created_time | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | date | +| ocsf.malware.cves.created_time_dt | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | date | +| ocsf.malware.cves.cvss.base_score | The CVSS base score. | double | +| ocsf.malware.cves.cvss.depth | The CVSS depth represents a depth of the equation used to calculate CVSS score. | keyword | +| ocsf.malware.cves.cvss.metrics.name | The name of the metric. | keyword | +| ocsf.malware.cves.cvss.metrics.value | The value of the metric. | keyword | +| ocsf.malware.cves.cvss.overall_score | The CVSS overall score, impacted by base, temporal, and environmental metrics. | double | +| ocsf.malware.cves.cvss.severity | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. | keyword | +| ocsf.malware.cves.cvss.vector_string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. | keyword | +| ocsf.malware.cves.cvss.version | The CVSS version. | keyword | +| ocsf.malware.cves.cwe_uid | The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787. | keyword | +| ocsf.malware.cves.cwe_url | Common Weakness Enumeration (CWE) definition URL. | keyword | +| ocsf.malware.cves.modified_time | The Record Modified Date identifies when the CVE record was last updated. | date | +| ocsf.malware.cves.modified_time_dt | The Record Modified Date identifies when the CVE record was last updated. | date | +| ocsf.malware.cves.product.feature.name | The name of the feature. | keyword | +| ocsf.malware.cves.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.malware.cves.product.feature.version | The version of the feature. | keyword | +| ocsf.malware.cves.product.lang | The two letter lower case language codes, as defined by ISO 639-1. | keyword | +| ocsf.malware.cves.product.name | The name of the product. | keyword | +| ocsf.malware.cves.product.path | The installation path of the product. | keyword | +| ocsf.malware.cves.product.uid | The unique identifier of the product. | keyword | +| ocsf.malware.cves.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.malware.cves.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.malware.cves.type | The vulnerability type as selected from a large dropdown menu during CVE refinement. | keyword | +| ocsf.malware.cves.uid | The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: CVE-2021-12345. | keyword | +| ocsf.malware.name | The malware name, as reported by the detection engine. | keyword | +| ocsf.malware.path | The filesystem path of the malware that was observed. | keyword | +| ocsf.malware.provider | The provider of the malware information. | keyword | +| ocsf.malware.uid | The malware unique identifier, as reported by the detection engine. For example a virus id or an IPS signature id. | keyword | +| ocsf.message | The description of the event, as defined by the event source. | keyword | +| ocsf.metadata.correlation_uid | The unique identifier used to correlate events. | keyword | +| ocsf.metadata.event_code | The Event ID or Code that the product uses to describe the event. | keyword | +| ocsf.metadata.extension.name | The schema extension name. For example: dev. | keyword | +| ocsf.metadata.extension.uid | The schema extension unique identifier. For example: 999. | keyword | +| ocsf.metadata.extension.version | The schema extension version. For example: 1.0.0-alpha.2. | keyword | +| ocsf.metadata.labels | The list of category labels attached to the event or specific attributes. Labels are user defined tags or aliases added at normalization time. | keyword | +| ocsf.metadata.log_name | The event log name. For example, syslog file name or Windows logging subsystem: Security. | keyword | +| ocsf.metadata.log_provider | The logging provider or logging service that logged the event. For example, Microsoft-Windows-Security-Auditing. | keyword | +| ocsf.metadata.log_version | The event log schema version that specifies the format of the original event. For example syslog version or Cisco Log Schema Version. | keyword | +| ocsf.metadata.logged_time | The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different. | date | +| ocsf.metadata.logged_time_dt | The time when the logging system collected and logged the event. This attribute is distinct from the event time in that event time typically contain the time extracted from the original event. Most of the time, these two times will be different. | date | +| ocsf.metadata.modified_time | The time when the event was last modified or enriched. | date | +| ocsf.metadata.modified_time_dt | The time when the event was last modified or enriched. | date | +| ocsf.metadata.original_time | The original event time as reported by the event source. For example, the time in the original format from system event log such as Syslog on Unix/Linux and the System event file on Windows. Omit if event is generated instead of collected via logs. | keyword | +| ocsf.metadata.processed_time | The event processed time, such as an ETL operation. | date | +| ocsf.metadata.processed_time_dt | The event processed time, such as an ETL operation. | date | +| ocsf.metadata.product.feature.name | The name of the feature. | keyword | +| ocsf.metadata.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.metadata.product.feature.version | The version of the feature. | keyword | +| ocsf.metadata.product.lang | The two letter lowercase language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.metadata.product.name | The name of the product. | keyword | +| ocsf.metadata.product.path | The installation path of the product. | keyword | +| ocsf.metadata.product.uid | The unique identifier of the product. | keyword | +| ocsf.metadata.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.metadata.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.metadata.profiles | The list of profiles used to create the event. | keyword | +| ocsf.metadata.sequence | Sequence number of the event. The sequence number is a value available in some events, to make the exact ordering of events unambiguous, regardless of the event time precision. | long | +| ocsf.metadata.uid | The logging system-assigned unique identifier of an event instance. | keyword | +| ocsf.metadata.version | The version of the OCSF schema, using Semantic Versioning Specification (SemVer). For example: 1.0.0. Event consumers use the version to determine the available event attributes. | keyword | +| ocsf.nist | The NIST Cybersecurity Framework recommendations for managing the cybersecurity risk. | keyword | +| ocsf.observables.name | The full name of the observable attribute. The name is a pointer/reference to an attribute within the event data. For example: file.name. | keyword | +| ocsf.observables.reputation.base_score | The reputation score as reported by the event source. | double | +| ocsf.observables.reputation.provider | The provider of the reputation information. | keyword | +| ocsf.observables.reputation.score | The reputation score, normalized to the caption of the score_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.observables.reputation.score_id | The normalized reputation score identifier. | keyword | +| ocsf.observables.type | The observable value type name. | keyword | +| ocsf.observables.type_id | The observable value type identifier. | keyword | +| ocsf.observables.value | The value associated with the observable attribute. | keyword | +| ocsf.process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.process.cmd_line | The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used. | keyword | +| ocsf.process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.process.container.image.labels | The image labels. | keyword | +| ocsf.process.container.image.name | The image name. For example: elixir. | keyword | +| ocsf.process.container.image.path | The full path to the image file. | keyword | +| ocsf.process.container.image.tag | The image tag. For example: 1.11-alpine. | keyword | +| ocsf.process.container.image.uid | The unique image ID. For example: 77af4d6b9913. | keyword | +| ocsf.process.container.name | The container name. | keyword | +| ocsf.process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.process.container.size | The size of the container image. | long | +| ocsf.process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.process.container.uid | The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf. | keyword | +| ocsf.process.created_time | The time when the process was created/started. | date | +| ocsf.process.created_time_dt | The time when the process was created/started. | date | +| ocsf.process.egid | The effective group under which this process is running. | keyword | +| ocsf.process.euid | The effective user under which this process is running. | keyword | +| ocsf.process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.process.file.accessor.groups.name | The group name. | keyword | +| ocsf.process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.process.file.created_time | The time when the file was created. | date | +| ocsf.process.file.created_time_dt | The time when the file was created. | date | +| ocsf.process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.file.creator.groups.desc | The group description. | keyword | +| ocsf.process.file.creator.groups.name | The group name. | keyword | +| ocsf.process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.file.creator.name | The username. For example, janedoe1. | keyword | +| ocsf.process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.process.file.modified_time | The time when the file was last modified. | date | +| ocsf.process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.file.modifier.email_addr | The user's email address. | keyword | +| ocsf.process.file.modifier.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.process.file.modifier.groups.name | The group name. | keyword | +| ocsf.process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.file.owner.groups.desc | The group description. | keyword | +| ocsf.process.file.owner.groups.name | The group name. | keyword | +| ocsf.process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.file.owner.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.process.file.product.name | The name of the product. | keyword | +| ocsf.process.file.product.path | The installation path of the product. | keyword | +| ocsf.process.file.product.uid | The unique identifier of the product. | keyword | +| ocsf.process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.process.file.size | The size of data, in bytes. | long | +| ocsf.process.file.type | The file type. | keyword | +| ocsf.process.file.type_id | The file type ID. | keyword | +| ocsf.process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.process.group.desc | The group description. | keyword | +| ocsf.process.group.name | The group name. | keyword | +| ocsf.process.group.privileges | The group privileges. | keyword | +| ocsf.process.group.type | The type of the group or account. | keyword | +| ocsf.process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.process.parent_process.auid | The audit user assigned at login by the audit subsystem. | keyword | +| ocsf.process.parent_process.cmd_line | The full command line used to launch an application, service, process, or job. For example: ssh user@10.0.0.10. If the command line is unavailable or missing, the empty string '' is to be used. | keyword | +| ocsf.process.parent_process.container.hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.container.hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.parent_process.container.hash.value | The digital fingerprint value. | keyword | +| ocsf.process.parent_process.container.image.labels | The image labels. | keyword | +| ocsf.process.parent_process.container.image.name | The image name. For example: elixir. | keyword | +| ocsf.process.parent_process.container.image.path | The full path to the image file. | keyword | +| ocsf.process.parent_process.container.image.tag | The image tag. For example: 1.11-alpine. | keyword | +| ocsf.process.parent_process.container.image.uid | The unique image ID. For example: 77af4d6b9913. | keyword | +| ocsf.process.parent_process.container.name | The container name. | keyword | +| ocsf.process.parent_process.container.network_driver | The network driver used by the container. For example, bridge, overlay, host, none, etc. | keyword | +| ocsf.process.parent_process.container.orchestrator | The orchestrator managing the container, such as ECS, EKS, K8s, or OpenShift. | keyword | +| ocsf.process.parent_process.container.pod_uuid | The unique identifier of the pod (or equivalent) that the container is executing on. | keyword | +| ocsf.process.parent_process.container.runtime | The backend running the container, such as containerd or cri-o. | keyword | +| ocsf.process.parent_process.container.size | The size of the container image. | long | +| ocsf.process.parent_process.container.tag | The tag used by the container. It can indicate version, format, OS. | keyword | +| ocsf.process.parent_process.container.uid | The full container unique identifier for this instantiation of the container. For example: ac2ea168264a08f9aaca0dfc82ff3551418dfd22d02b713142a6843caa2f61bf. | keyword | +| ocsf.process.parent_process.created_time | The time when the process was created/started. | date | +| ocsf.process.parent_process.created_time_dt | The time when the process was created/started. | date | +| ocsf.process.parent_process.egid | The effective group under which this process is running. | keyword | +| ocsf.process.parent_process.euid | The effective user under which this process is running. | keyword | +| ocsf.process.parent_process.file.accessed_time | The time when the file was last accessed. | date | +| ocsf.process.parent_process.file.accessed_time_dt | The time when the file was last accessed. | date | +| ocsf.process.parent_process.file.accessor.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.parent_process.file.accessor.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.accessor.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.parent_process.file.accessor.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.parent_process.file.accessor.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.file.accessor.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.parent_process.file.accessor.email_addr | The user's email address. | keyword | +| ocsf.process.parent_process.file.accessor.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.parent_process.file.accessor.groups.desc | The group description. | keyword | +| ocsf.process.parent_process.file.accessor.groups.name | The group name. | keyword | +| ocsf.process.parent_process.file.accessor.groups.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.file.accessor.groups.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.file.accessor.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.file.accessor.name | The username. For example, janedoe1. | keyword | +| ocsf.process.parent_process.file.accessor.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.parent_process.file.accessor.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.parent_process.file.accessor.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.parent_process.file.accessor.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.parent_process.file.accessor.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.parent_process.file.accessor.type_id | The account type identifier. | keyword | +| ocsf.process.parent_process.file.accessor.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.parent_process.file.accessor.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.parent_process.file.attributes | The Bitmask value that represents the file attributes. | long | +| ocsf.process.parent_process.file.company_name | The name of the company that published the file. For example: Microsoft Corporation. | keyword | +| ocsf.process.parent_process.file.confidentiality | The file content confidentiality, normalized to the confidentiality_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.confidentiality_id | The normalized identifier of the file content confidentiality indicator. | keyword | +| ocsf.process.parent_process.file.created_time | The time when the file was created. | date | +| ocsf.process.parent_process.file.created_time_dt | The time when the file was created. | date | +| ocsf.process.parent_process.file.creator.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.parent_process.file.creator.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.creator.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.parent_process.file.creator.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.parent_process.file.creator.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.file.creator.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.parent_process.file.creator.email_addr | The user's email address. | keyword | +| ocsf.process.parent_process.file.creator.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.parent_process.file.creator.groups.desc | The group description. | keyword | +| ocsf.process.parent_process.file.creator.groups.name | The group name. | keyword | +| ocsf.process.parent_process.file.creator.groups.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.file.creator.groups.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.file.creator.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.file.creator.name | The username. For example, janedoe1. | keyword | +| ocsf.process.parent_process.file.creator.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.parent_process.file.creator.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.parent_process.file.creator.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.parent_process.file.creator.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.parent_process.file.creator.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.parent_process.file.creator.type_id | The account type identifier. | keyword | +| ocsf.process.parent_process.file.creator.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.parent_process.file.creator.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.parent_process.file.desc | The description of the file, as returned by file system. For example: the description as returned by the Unix file command or the Windows file type. | keyword | +| ocsf.process.parent_process.file.hashes.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.hashes.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.parent_process.file.hashes.value | The digital fingerprint value. | keyword | +| ocsf.process.parent_process.file.is_system | The indication of whether the object is part of the operating system. | boolean | +| ocsf.process.parent_process.file.mime_type | The Multipurpose Internet Mail Extensions (MIME) type of the file, if applicable. | keyword | +| ocsf.process.parent_process.file.modified_time | The time when the file was last modified. | date | +| ocsf.process.parent_process.file.modified_time_dt | The time when the file was last modified. | date | +| ocsf.process.parent_process.file.modifier.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.parent_process.file.modifier.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.modifier.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.parent_process.file.modifier.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.parent_process.file.modifier.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.file.modifier.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.parent_process.file.modifier.email_addr | The user's email address. | keyword | +| ocsf.process.parent_process.file.modifier.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.parent_process.file.modifier.groups.desc | The group description. | keyword | +| ocsf.process.parent_process.file.modifier.groups.name | The group name. | keyword | +| ocsf.process.parent_process.file.modifier.groups.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.file.modifier.groups.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.file.modifier.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.file.modifier.name | The username. For example, janedoe1. | keyword | +| ocsf.process.parent_process.file.modifier.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.parent_process.file.modifier.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.parent_process.file.modifier.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.parent_process.file.modifier.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.parent_process.file.modifier.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.parent_process.file.modifier.type_id | The account type identifier. | keyword | +| ocsf.process.parent_process.file.modifier.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.parent_process.file.modifier.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.parent_process.file.name | The name of the file. For example: svchost.exe. | keyword | +| ocsf.process.parent_process.file.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.parent_process.file.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.parent_process.file.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.parent_process.file.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.file.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.parent_process.file.owner.email_addr | The user's email address. | keyword | +| ocsf.process.parent_process.file.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.parent_process.file.owner.groups.desc | The group description. | keyword | +| ocsf.process.parent_process.file.owner.groups.name | The group name. | keyword | +| ocsf.process.parent_process.file.owner.groups.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.file.owner.groups.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.file.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.file.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.process.parent_process.file.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.parent_process.file.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.parent_process.file.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.parent_process.file.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.parent_process.file.owner.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.parent_process.file.owner.type_id | The account type identifier. | keyword | +| ocsf.process.parent_process.file.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.parent_process.file.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.parent_process.file.parent_folder | The parent folder in which the file resides. For example: c:\windows\system32. | keyword | +| ocsf.process.parent_process.file.path | The full path to the file. For example: c:\windows\system32\svchost.exe. | keyword | +| ocsf.process.parent_process.file.product.feature.name | The name of the feature. | keyword | +| ocsf.process.parent_process.file.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.process.parent_process.file.product.feature.version | The version of the feature. | keyword | +| ocsf.process.parent_process.file.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.process.parent_process.file.product.name | The name of the product. | keyword | +| ocsf.process.parent_process.file.product.path | The installation path of the product. | keyword | +| ocsf.process.parent_process.file.product.uid | The unique identifier of the product. | keyword | +| ocsf.process.parent_process.file.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.process.parent_process.file.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.process.parent_process.file.security_descriptor | The object security descriptor. | keyword | +| ocsf.process.parent_process.file.signature.algorithm | The digital signature algorithm used to create the signature, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.signature.algorithm_id | The identifier of the normalized digital signature algorithm. | keyword | +| ocsf.process.parent_process.file.signature.certificate.created_time | The time when the certificate was created. | date | +| ocsf.process.parent_process.file.signature.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.process.parent_process.file.signature.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.process.parent_process.file.signature.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.process.parent_process.file.signature.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.signature.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.parent_process.file.signature.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.process.parent_process.file.signature.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.process.parent_process.file.signature.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.process.parent_process.file.signature.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.process.parent_process.file.signature.certificate.version | The certificate version. | keyword | +| ocsf.process.parent_process.file.signature.created_time | The time when the digital signature was created. | date | +| ocsf.process.parent_process.file.signature.created_time_dt | The time when the digital signature was created. | date | +| ocsf.process.parent_process.file.signature.developer_uid | The developer ID on the certificate that signed the file. | keyword | +| ocsf.process.parent_process.file.signature.digest.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.file.signature.digest.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.process.parent_process.file.signature.digest.value | The digital fingerprint value. | keyword | +| ocsf.process.parent_process.file.size | The size of data, in bytes. | long | +| ocsf.process.parent_process.file.type | The file type. | keyword | +| ocsf.process.parent_process.file.type_id | The file type ID. | keyword | +| ocsf.process.parent_process.file.uid | The unique identifier of the file as defined by the storage system, such the file system file ID. | keyword | +| ocsf.process.parent_process.file.version | The file version. For example: 8.0.7601.17514. | keyword | +| ocsf.process.parent_process.file.xattributes | An unordered collection of zero or more name/value pairs where each pair represents a file or folder extended attribute. | flattened | +| ocsf.process.parent_process.group.desc | The group description. | keyword | +| ocsf.process.parent_process.group.name | The group name. | keyword | +| ocsf.process.parent_process.group.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.group.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.integrity | The process integrity level, normalized to the caption of the direction_id value. In the case of 'Other', it is defined by the event source (Windows only). | keyword | +| ocsf.process.parent_process.integrity_id | The normalized identifier of the process integrity level (Windows only). | keyword | +| ocsf.process.parent_process.lineage | The lineage of the process, represented by a list of paths for each ancestor process. For example: ['/usr/sbin/sshd', '/usr/bin/bash', '/usr/bin/whoami']. | keyword | +| ocsf.process.parent_process.loaded_modules | The list of loaded module names. | keyword | +| ocsf.process.parent_process.name | The friendly name of the process, for example: Notepad++. | keyword | +| ocsf.process.parent_process.namespace_pid | If running under a process namespace (such as in a container), the process identifier within that process namespace. | long | +| ocsf.process.parent_process.parent_process | The parent process of this process object. | flattened | +| ocsf.process.parent_process.parent_process_keyword | | keyword | +| ocsf.process.parent_process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.process.parent_process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.process.parent_process.session.created_time | The time when the session was created. | date | +| ocsf.process.parent_process.session.created_time_dt | The short name of the endpoint. | date | +| ocsf.process.parent_process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.session.expiration_time | The session expiration time. | date | +| ocsf.process.parent_process.session.expiration_time_dt | The name of the network interface (e.g. eth2). | date | +| ocsf.process.parent_process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.process.parent_process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.process.parent_process.session.uid | The unique identifier of the session. | keyword | +| ocsf.process.parent_process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.process.parent_process.terminated_time | The time when the process was terminated. | date | +| ocsf.process.parent_process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.process.parent_process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.process.parent_process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.process.parent_process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.parent_process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.parent_process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.parent_process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.parent_process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.parent_process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.parent_process.user.email_addr | The user's email address. | keyword | +| ocsf.process.parent_process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.parent_process.user.groups.desc | The group description. | keyword | +| ocsf.process.parent_process.user.groups.name | The group name. | keyword | +| ocsf.process.parent_process.user.groups.privileges | The group privileges. | keyword | +| ocsf.process.parent_process.user.groups.type | The type of the group or account. | keyword | +| ocsf.process.parent_process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.parent_process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.process.parent_process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.parent_process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.parent_process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.parent_process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.parent_process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.parent_process.user.type_id | The account type identifier. | keyword | +| ocsf.process.parent_process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.parent_process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.parent_process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.process.pid | The process identifier, as reported by the operating system. Process ID (PID) is a number used by the operating system to uniquely identify an active process. | long | +| ocsf.process.sandbox | The name of the containment jail (i.e., sandbox). For example, hardened_ps, high_security_ps, oracle_ps, netsvcs_ps, or default_ps. | keyword | +| ocsf.process.session.created_time | The time when the session was created. | date | +| ocsf.process.session.created_time_dt | The short name of the endpoint. | date | +| ocsf.process.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.session.expiration_time | The session expiration time. | date | +| ocsf.process.session.expiration_time_dt | The name of the network interface (e.g. eth2). | date | +| ocsf.process.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.process.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.process.session.uid | The unique identifier of the session. | keyword | +| ocsf.process.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.process.terminated_time | The time when the process was terminated. | date | +| ocsf.process.terminated_time_dt | The time when the process was terminated. | date | +| ocsf.process.tid | The Identifier of the thread associated with the event, as returned by the operating system. | long | +| ocsf.process.uid | A unique identifier for this process assigned by the producer (tool). Facilitates correlation of a process event with other events for that process. | keyword | +| ocsf.process.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.process.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.process.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.process.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.process.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.process.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.process.user.email_addr | The user's email address. | keyword | +| ocsf.process.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.process.user.groups.desc | The group description. | keyword | +| ocsf.process.user.groups.name | The group name. | keyword | +| ocsf.process.user.groups.privileges | The group privileges. | keyword | +| ocsf.process.user.groups.type | The type of the group or account. | keyword | +| ocsf.process.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.process.user.name | The username. For example, janedoe1. | keyword | +| ocsf.process.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.process.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.process.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.process.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.process.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.process.user.type_id | The account type identifier. | keyword | +| ocsf.process.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.process.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.process.xattributes | An unordered collection of zero or more name/value pairs that represent a process extended attribute. | flattened | +| ocsf.proxy.domain | The name of the domain. | keyword | +| ocsf.proxy.hostname | The fully qualified name of the endpoint. | keyword | +| ocsf.proxy.instance_uid | The unique identifier of a VM instance. | keyword | +| ocsf.proxy.interface_name | The name of the network interface (e.g. eth2). | keyword | +| ocsf.proxy.interface_uid | The unique identifier of the network interface. | keyword | +| ocsf.proxy.intermediate_ips | The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. | ip | +| ocsf.proxy.ip | The IP address of the endpoint, in either IPv4 or IPv6 format. | ip | +| ocsf.proxy.location.city | The name of the city. | keyword | +| ocsf.proxy.location.continent | The name of the continent. | keyword | +| ocsf.proxy.location.coordinates | A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. | geo_point | +| ocsf.proxy.location.country | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. | keyword | +| ocsf.proxy.location.desc | The description of the geographical location. | keyword | +| ocsf.proxy.location.is_on_premises | The indication of whether the location is on premises. | boolean | +| ocsf.proxy.location.isp | The name of the Internet Service Provider (ISP). | keyword | +| ocsf.proxy.location.postal_code | The postal code of the location. | keyword | +| ocsf.proxy.location.provider | The provider of the geographical location data. | keyword | +| ocsf.proxy.location.region | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. | keyword | +| ocsf.proxy.mac | The Media Access Control (MAC) address of the endpoint. | keyword | +| ocsf.proxy.name | The short name of the endpoint. | keyword | +| ocsf.proxy.port | The port used for communication within the network connection. | long | +| ocsf.proxy.subnet_uid | The unique identifier of a virtual subnet. | keyword | +| ocsf.proxy.svc_name | The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. | keyword | +| ocsf.proxy.uid | The unique identifier of the endpoint. | keyword | +| ocsf.proxy.vlan_uid | The Virtual LAN identifier. | keyword | +| ocsf.proxy.vpc_uid | The unique identifier of the Virtual Private Cloud (VPC). | keyword | +| ocsf.query.class | The class of resource records being queried. See RFC1035. For example: IN. | keyword | +| ocsf.query.hostname | The hostname or domain being queried. For example: www.example.com | keyword | +| ocsf.query.opcode | The DNS opcode specifies the type of the query message. | keyword | +| ocsf.query.opcode_id | The DNS opcode ID specifies the normalized query message type. | keyword | +| ocsf.query.packet_uid | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | +| ocsf.query.type | The type of resource records being queried. See RFC1035. For example: A, AAAA, CNAME, MX, and NS. | keyword | +| ocsf.query_time | The Domain Name System (DNS) query time. | date | +| ocsf.query_time_dt | The Domain Name System (DNS) query time. | date | +| ocsf.raw_data | The event data as received from the event source. | flattened | +| ocsf.raw_data_keyword | | keyword | +| ocsf.rcode | The DNS server response code, normalized to the caption of the rcode_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.rcode_id | The normalized identifier of the DNS server response code. | keyword | +| ocsf.resources.cloud_partition | The canonical cloud partition name to which the region is assigned (e.g. AWS Partitions: aws, aws-cn, aws-us-gov). | keyword | +| ocsf.resources.criticality | The criticality of the resource as defined by the event source. | keyword | +| ocsf.resources.data | Additional data describing the resource. | flattened | +| ocsf.resources.group.desc | The group description. | keyword | +| ocsf.resources.group.name | The group name. | keyword | +| ocsf.resources.group.privileges | The group privileges. | keyword | +| ocsf.resources.group.type | The type of the group or account. | keyword | +| ocsf.resources.group.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.resources.labels | The list of labels/tags associated to a resource. | keyword | +| ocsf.resources.name | The name of the resource. | keyword | +| ocsf.resources.owner.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.resources.owner.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.resources.owner.account.type_id | The normalized account type identifier. | keyword | +| ocsf.resources.owner.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.resources.owner.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.resources.owner.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.resources.owner.email_addr | The user's email address. | keyword | +| ocsf.resources.owner.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.resources.owner.groups.desc | The group description. | keyword | +| ocsf.resources.owner.groups.name | The group name. | keyword | +| ocsf.resources.owner.groups.privileges | The group privileges. | keyword | +| ocsf.resources.owner.groups.type | The type of the group or account. | keyword | +| ocsf.resources.owner.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.resources.owner.name | The username. For example, janedoe1. | keyword | +| ocsf.resources.owner.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.resources.owner.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.resources.owner.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.resources.owner.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.resources.owner.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.resources.owner.type_id | The account type identifier. | keyword | +| ocsf.resources.owner.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.resources.owner.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.resources.region | The cloud region of the resource. | keyword | +| ocsf.resources.type | The resource type as defined by the event source. | keyword | +| ocsf.resources.uid | The unique identifier of the resource. | keyword | +| ocsf.resources.version | The version of the resource. For example 1.2.3. | keyword | +| ocsf.response_time | The Domain Name System (DNS) response time. | date | +| ocsf.response_time_dt | The Domain Name System (DNS) response time. | date | +| ocsf.risk_level | The risk level, normalized to the caption of the risk_level_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.risk_level_id | The normalized risk level id. | keyword | +| ocsf.risk_score | The risk score as reported by the event source. | long | +| ocsf.service.labels | The list of labels associated with the service. | keyword | +| ocsf.service.name | The name of the service. | keyword | +| ocsf.service.uid | The unique identifier of the service. | keyword | +| ocsf.service.version | The version of the service. | keyword | +| ocsf.session.created_time | The time when the session was created. | date | +| ocsf.session.created_time_dt | The time when the session was created. | date | +| ocsf.session.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.session.expiration_time | The session expiration time. | date | +| ocsf.session.expiration_time_dt | The session expiration time. | date | +| ocsf.session.is_remote | The indication of whether the session is remote. | boolean | +| ocsf.session.issuer | The identifier of the session issuer. | keyword | +| ocsf.session.mfa | | boolean | +| ocsf.session.uid | The unique identifier of the session. | keyword | +| ocsf.session.uuid | The universally unique identifier of the session. | keyword | +| ocsf.severity | The event severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.severity_id | The normalized identifier of the event severity. The normalized severity is a measurement the effort and expense required to manage and resolve an event or incident. Smaller numerical values represent lower impact events, and larger numerical values represent higher impact events. | long | +| ocsf.src_endpoint.domain | The name of the domain. | keyword | +| ocsf.src_endpoint.hostname | The fully qualified name of the endpoint. | keyword | +| ocsf.src_endpoint.instance_uid | The unique identifier of a VM instance. | keyword | +| ocsf.src_endpoint.interface_name | The name of the network interface (e.g. eth2). | keyword | +| ocsf.src_endpoint.interface_uid | The unique identifier of the network interface. | keyword | +| ocsf.src_endpoint.intermediate_ips | The intermediate IP Addresses. For example, the IP addresses in the HTTP X-Forwarded-For header. | ip | +| ocsf.src_endpoint.ip | The IP address of the endpoint, in either IPv4 or IPv6 format. | ip | +| ocsf.src_endpoint.location.city | The name of the city. | keyword | +| ocsf.src_endpoint.location.continent | The name of the continent. | keyword | +| ocsf.src_endpoint.location.coordinates | A two-element array, containing a longitude/latitude pair. The format conforms with GeoJSON. | geo_point | +| ocsf.src_endpoint.location.country | The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see ISO 3166-1 alpha-2 codes. The two letter country code should be capitalized. | keyword | +| ocsf.src_endpoint.location.desc | The description of the geographical location. | keyword | +| ocsf.src_endpoint.location.is_on_premises | The indication of whether the location is on premises. | boolean | +| ocsf.src_endpoint.location.isp | The name of the Internet Service Provider (ISP). | keyword | +| ocsf.src_endpoint.location.postal_code | The postal code of the location. | keyword | +| ocsf.src_endpoint.location.provider | The provider of the geographical location data. | keyword | +| ocsf.src_endpoint.location.region | The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. Region codes are defined at ISO 3166-2 and have a limit of three characters. For example, see the region codes for the US. | keyword | +| ocsf.src_endpoint.mac | The Media Access Control (MAC) address of the endpoint. | keyword | +| ocsf.src_endpoint.name | The short name of the endpoint. | keyword | +| ocsf.src_endpoint.port | The port used for communication within the network connection. | long | +| ocsf.src_endpoint.subnet_uid | The unique identifier of a virtual subnet. | keyword | +| ocsf.src_endpoint.svc_name | The service name in service-to-service connections. For example, AWS VPC logs the pkt-src-aws-service and pkt-dst-aws-service fields identify the connection is coming from or going to an AWS service. | keyword | +| ocsf.src_endpoint.uid | The unique identifier of the endpoint. | keyword | +| ocsf.src_endpoint.vlan_uid | The Virtual LAN identifier. | keyword | +| ocsf.src_endpoint.vpc_uid | The unique identifier of the Virtual Private Cloud (VPC). | keyword | +| ocsf.start_time | The start time of a time period, or the time of the least recent event included in the aggregate event. | date | +| ocsf.start_time_dt | The start time of a time period, or the time of the least recent event included in the aggregate event. | date | +| ocsf.state | The normalized state of a security finding. | keyword | +| ocsf.state_id | The normalized state identifier of a security finding. | keyword | +| ocsf.status | The event status, normalized to the caption of the status_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.status_code | The event status code, as reported by the event source. For example, in a Windows Failed Authentication event, this would be the value of 'Failure Code', e.g. 0x18. | keyword | +| ocsf.status_detail | The status details contains additional information about the event outcome. | keyword | +| ocsf.status_id | The normalized identifier of the event status. | keyword | +| ocsf.time | The normalized event occurrence time. | date | +| ocsf.time_dt | The normalized event occurrence time. | date | +| ocsf.timezone_offset | The number of minutes that the reported event time is ahead or behind UTC, in the range -1,080 to +1,080. | long | +| ocsf.tls.alert | The integer value of TLS alert if present. The alerts are defined in the TLS specification in RFC-2246. | long | +| ocsf.tls.certificate.created_time | The time when the certificate was created. | date | +| ocsf.tls.certificate.created_time_dt | The time when the certificate was created. | date | +| ocsf.tls.certificate.expiration_time | The expiration time of the certificate. | date | +| ocsf.tls.certificate.expiration_time_dt | The expiration time of the certificate. | date | +| ocsf.tls.certificate.fingerprints.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.tls.certificate.fingerprints.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.tls.certificate.fingerprints.value | The digital fingerprint value. | keyword | +| ocsf.tls.certificate.issuer | The certificate issuer distinguished name. | keyword | +| ocsf.tls.certificate.serial_number | The serial number of the certificate used to create the digital signature. | keyword | +| ocsf.tls.certificate.subject | The certificate subject distinguished name. | keyword | +| ocsf.tls.certificate.version | The certificate version. | keyword | +| ocsf.tls.certificate_chain | The Chain of Certificate Serial Numbers field provides a chain of Certificate Issuer Serial Numbers leading to the Root Certificate Issuer. | keyword | +| ocsf.tls.cipher | The negotiated cipher suite. | keyword | +| ocsf.tls.client_ciphers | The client cipher suites that were exchanged during the TLS handshake negotiation. | keyword | +| ocsf.tls.extension_list.data | The data contains information specific to the particular extension type. | flattened | +| ocsf.tls.extension_list.type | The TLS extension type. For example: Server Name. | keyword | +| ocsf.tls.extension_list.type_id | The TLS extension type identifier. See The Transport Layer Security (TLS) extension page. | keyword | +| ocsf.tls.handshake_dur | The amount of total time for the TLS handshake to complete after the TCP connection is established, including client-side delays, in milliseconds. | long | +| ocsf.tls.ja3_hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.tls.ja3_hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.tls.ja3_hash.value | The digital fingerprint value. | keyword | +| ocsf.tls.ja3s_hash.algorithm | The hash algorithm used to create the digital fingerprint, normalized to the caption of 'algorithm_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.tls.ja3s_hash.algorithm_id | The identifier of the normalized hash algorithm, which was used to create the digital fingerprint. | keyword | +| ocsf.tls.ja3s_hash.value | The digital fingerprint value. | keyword | +| ocsf.tls.key_length | The length of the encryption key. | long | +| ocsf.tls.sans.name | Name of SAN (e.g. The actual IP Address or domain.) | keyword | +| ocsf.tls.sans.type | Type descriptor of SAN (e.g. IP Address/domain/etc.) | keyword | +| ocsf.tls.server_ciphers | The server cipher suites that were exchanged during the TLS handshake negotiation. | keyword | +| ocsf.tls.sni | The Server Name Indication (SNI) extension sent by the client. | keyword | +| ocsf.tls.version | The TLS protocol version. | keyword | +| ocsf.traffic.bytes | The total number of bytes (in and out). | long | +| ocsf.traffic.bytes_in | The number of bytes sent from the destination to the source. | long | +| ocsf.traffic.bytes_out | The number of bytes sent from the source to the destination. | long | +| ocsf.traffic.packets | The total number of packets (in and out). | long | +| ocsf.traffic.packets_in | The number of packets sent from the destination to the source. | long | +| ocsf.traffic.packets_out | The number of packets sent from the source to the destination. | long | +| ocsf.type_name | The event type name, as defined by the type_uid. | keyword | +| ocsf.type_uid | The event type ID. It identifies the events semantics and structure. The value is calculated by the logging system as: class_uid \* 100 + activity_id. | keyword | +| ocsf.unmapped | The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source. | flattened | +| ocsf.user.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.user.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.user.account.type_id | The normalized account type identifier. | keyword | +| ocsf.user.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.user.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.user.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.user.email_addr | The user's email address. | keyword | +| ocsf.user.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.user.groups.desc | The group description. | keyword | +| ocsf.user.groups.name | The group name. | keyword | +| ocsf.user.groups.privileges | The group privileges. | keyword | +| ocsf.user.groups.type | The type of the group or account. | keyword | +| ocsf.user.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.user.name | The username. For example, janedoe1. | keyword | +| ocsf.user.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.user.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.user.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.user.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.user.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.user.type_id | The account type identifier. | keyword | +| ocsf.user.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.user.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.user_result.account.name | The name of the account (e.g. GCP Account Name). | keyword | +| ocsf.user_result.account.type | The account type, normalized to the caption of 'account_type_id'. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.user_result.account.type_id | The normalized account type identifier. | keyword | +| ocsf.user_result.account.uid | The unique identifier of the account (e.g. AWS Account ID). | keyword | +| ocsf.user_result.credential_uid | The unique identifier of the user's credential. For example, AWS Access Key ID. | keyword | +| ocsf.user_result.domain | The domain where the user is defined. For example: the LDAP or Active Directory domain. | keyword | +| ocsf.user_result.email_addr | The user's email address. | keyword | +| ocsf.user_result.full_name | The full name of the person, as per the LDAP Common Name attribute (cn). | keyword | +| ocsf.user_result.groups.desc | The group description. | keyword | +| ocsf.user_result.groups.name | The group name. | keyword | +| ocsf.user_result.groups.privileges | The group privileges. | keyword | +| ocsf.user_result.groups.type | The type of the group or account. | keyword | +| ocsf.user_result.groups.uid | The unique identifier of the group. For example, for Windows events this is the security identifier (SID) of the group. | keyword | +| ocsf.user_result.name | The username. For example, janedoe1. | keyword | +| ocsf.user_result.org.name | The name of the organization. For example, Widget, Inc. | keyword | +| ocsf.user_result.org.ou_name | The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | keyword | +| ocsf.user_result.org.ou_uid | The alternate identifier for an entity's unique identifier. For example, its Active Directory OU DN or AWS OU ID. | keyword | +| ocsf.user_result.org.uid | The unique identifier of the organization. For example, its Active Directory or AWS Org ID. | keyword | +| ocsf.user_result.type | The type of the user. For example, System, AWS IAM User, etc. | keyword | +| ocsf.user_result.type_id | The account type identifier. | keyword | +| ocsf.user_result.uid | The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. | keyword | +| ocsf.user_result.uid_alt | The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID. | keyword | +| ocsf.vulnerabilities.cve.created_time | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | date | +| ocsf.vulnerabilities.cve.created_time_dt | The Record Creation Date identifies when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List. Note that the Record Creation Date does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. | date | +| ocsf.vulnerabilities.cve.cvss.base_score | The CVSS base score. For example: 9.1. | double | +| ocsf.vulnerabilities.cve.cvss.depth | The CVSS depth represents a depth of the equation used to calculate CVSS score. | keyword | +| ocsf.vulnerabilities.cve.cvss.metrics.name | The name of the metric. | keyword | +| ocsf.vulnerabilities.cve.cvss.metrics.value | The value of the metric. | keyword | +| ocsf.vulnerabilities.cve.cvss.overall_score | The CVSS overall score, impacted by base, temporal, and environmental metrics. For example: 9.1. | double | +| ocsf.vulnerabilities.cve.cvss.severity | The Common Vulnerability Scoring System (CVSS) Qualitative Severity Rating. A textual representation of the numeric score. | keyword | +| ocsf.vulnerabilities.cve.cvss.vector_string | The CVSS vector string is a text representation of a set of CVSS metrics. It is commonly used to record or transfer CVSS metric information in a concise form. For example: 3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. | keyword | +| ocsf.vulnerabilities.cve.cvss.version | The CVSS version. For example: 3.1. | keyword | +| ocsf.vulnerabilities.cve.cwe_uid | The Common Weakness Enumeration (CWE) unique identifier. For example: CWE-787. | keyword | +| ocsf.vulnerabilities.cve.cwe_url | Common Weakness Enumeration (CWE) definition URL. For example: https://cwe.mitre.org/data/definitions/787.html. | keyword | +| ocsf.vulnerabilities.cve.modified_time | The Record Modified Date identifies when the CVE record was last updated. | date | +| ocsf.vulnerabilities.cve.modified_time_dt | The Record Modified Date identifies when the CVE record was last updated. | date | +| ocsf.vulnerabilities.cve.product.feature.name | The name of the feature. | keyword | +| ocsf.vulnerabilities.cve.product.feature.uid | The unique identifier of the feature. | keyword | +| ocsf.vulnerabilities.cve.product.feature.version | The version of the feature. | keyword | +| ocsf.vulnerabilities.cve.product.lang | The two letter lower case language codes, as defined by ISO 639-1. For example: en (English), de (German), or fr (French). | keyword | +| ocsf.vulnerabilities.cve.product.name | The name of the product. | keyword | +| ocsf.vulnerabilities.cve.product.path | The installation path of the product. | keyword | +| ocsf.vulnerabilities.cve.product.uid | The unique identifier of the product. | keyword | +| ocsf.vulnerabilities.cve.product.vendor_name | The name of the vendor of the product. | keyword | +| ocsf.vulnerabilities.cve.product.version | The version of the product, as defined by the event source. For example: 2013.1.3-beta. | keyword | +| ocsf.vulnerabilities.cve.type | The vulnerability type as selected from a large dropdown menu during CVE refinement. | keyword | +| ocsf.vulnerabilities.cve.uid | The Common Vulnerabilities and Exposures unique number assigned to a specific computer vulnerability. A CVE Identifier begins with 4 digits representing the year followed by a sequence of digits that acts as a unique identifier. For example: CVE-2021-12345. | keyword | +| ocsf.vulnerabilities.desc | The description of the vulnerability. | keyword | +| ocsf.vulnerabilities.fix_available | Indicates if a fix is available for the reported vulnerability. | boolean | +| ocsf.vulnerabilities.kb_articles | The KB article/s related to the entity. | keyword | +| ocsf.vulnerabilities.packages.architecture | Architecture is a shorthand name describing the type of computer hardware the packaged software is meant to run on. | keyword | +| ocsf.vulnerabilities.packages.epoch | The software package epoch. Epoch is a way to define weighted dependencies based on version numbers. | long | +| ocsf.vulnerabilities.packages.license | The software license applied to this package. | keyword | +| ocsf.vulnerabilities.packages.name | The software package name. | keyword | +| ocsf.vulnerabilities.packages.release | Release is the number of times a version of the software has been packaged. | keyword | +| ocsf.vulnerabilities.packages.version | The software package version. | keyword | +| ocsf.vulnerabilities.references | Supporting reference URLs. | keyword | +| ocsf.vulnerabilities.related_vulnerabilities | List of vulnerabilities that are related to this vulnerability. | keyword | +| ocsf.vulnerabilities.severity | The event severity, normalized to the caption of the severity_id value. In the case of 'Other', it is defined by the event source. | keyword | +| ocsf.vulnerabilities.title | The title of the vulnerability. | keyword | +| ocsf.vulnerabilities.vendor_name | The vendor who identified the vulnerability. | keyword | +| process.group.id | | keyword | +| process.group.name | | keyword | +| process.parent.user.domain | | keyword | +| process.parent.user.email | | keyword | +| process.parent.user.full_name | | keyword | +| process.parent.user.group.id | | keyword | +| process.parent.user.group.name | | keyword | +| process.user.domain | | keyword | +| process.user.email | | keyword | +| process.user.full_name | | keyword | +| process.user.group.id | | keyword | +| process.user.group.name | | keyword | +| tags | User defined tags. | keyword | diff --git a/packages/amazon_security_lake/img/amazon-security-lake-application-activity-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-application-activity-dashboard.png new file mode 100644 index 00000000000..f0982c4e4fd Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-application-activity-dashboard.png differ diff --git a/packages/amazon_security_lake/img/amazon-security-lake-dns-activity-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-dns-activity-dashboard.png new file mode 100644 index 00000000000..c5111c2eebd Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-dns-activity-dashboard.png differ diff --git a/packages/amazon_security_lake/img/amazon-security-lake-findings-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-findings-dashboard.png new file mode 100644 index 00000000000..d7ec67d9038 Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-findings-dashboard.png differ diff --git a/packages/amazon_security_lake/img/amazon-security-lake-identity-and-access-management-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-identity-and-access-management-dashboard.png new file mode 100644 index 00000000000..110b74ef6e1 Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-identity-and-access-management-dashboard.png differ diff --git a/packages/amazon_security_lake/img/amazon-security-lake-logo.svg b/packages/amazon_security_lake/img/amazon-security-lake-logo.svg new file mode 100644 index 00000000000..4717f407c0d --- /dev/null +++ b/packages/amazon_security_lake/img/amazon-security-lake-logo.svg @@ -0,0 +1,18 @@ + + + Icon-Architecture/64/Arch_Amazon-Security-Lake_64 + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/packages/amazon_security_lake/img/amazon-security-lake-network-activity-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-network-activity-dashboard.png new file mode 100644 index 00000000000..5e3863509bd Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-network-activity-dashboard.png differ diff --git a/packages/amazon_security_lake/img/amazon-security-lake-overview-dashboard.png b/packages/amazon_security_lake/img/amazon-security-lake-overview-dashboard.png new file mode 100644 index 00000000000..0d357a308d6 Binary files /dev/null and b/packages/amazon_security_lake/img/amazon-security-lake-overview-dashboard.png differ diff --git a/packages/amazon_security_lake/img/another_aws_account.png b/packages/amazon_security_lake/img/another_aws_account.png new file mode 100644 index 00000000000..784f52d5826 Binary files /dev/null and b/packages/amazon_security_lake/img/another_aws_account.png differ diff --git a/packages/amazon_security_lake/img/external_id.png b/packages/amazon_security_lake/img/external_id.png new file mode 100644 index 00000000000..66252032cf5 Binary files /dev/null and b/packages/amazon_security_lake/img/external_id.png differ diff --git a/packages/amazon_security_lake/img/role_type.png b/packages/amazon_security_lake/img/role_type.png new file mode 100644 index 00000000000..1cf77954789 Binary files /dev/null and b/packages/amazon_security_lake/img/role_type.png differ diff --git a/packages/amazon_security_lake/img/s3_full_access.png b/packages/amazon_security_lake/img/s3_full_access.png new file mode 100644 index 00000000000..7b5f11eee20 Binary files /dev/null and b/packages/amazon_security_lake/img/s3_full_access.png differ diff --git a/packages/amazon_security_lake/img/sqs_full_access.png b/packages/amazon_security_lake/img/sqs_full_access.png new file mode 100644 index 00000000000..64651a70631 Binary files /dev/null and b/packages/amazon_security_lake/img/sqs_full_access.png differ diff --git a/packages/amazon_security_lake/img/this_account.png b/packages/amazon_security_lake/img/this_account.png new file mode 100644 index 00000000000..6ee07ccd07b Binary files /dev/null and b/packages/amazon_security_lake/img/this_account.png differ diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1.json new file mode 100644 index 00000000000..8f415fb059f --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1.json @@ -0,0 +1,1698 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ce6530d2-da12-4a80-a1c5-6d8db59eb0e7\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ce6530d2-da12-4a80-a1c5-6d8db59eb0e7\",\"fieldName\":\"ocsf.class_name\",\"title\":\"Class Name\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"086e84d6-0fef-4a48-b5ab-690f9d0ccc53\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"086e84d6-0fef-4a48-b5ab-690f9d0ccc53\",\"fieldName\":\"ocsf.severity\",\"title\":\"Severity\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"eb892b38-5d66-4b4d-899a-61337d4d983d\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"eb892b38-5d66-4b4d-899a-61337d4d983d\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"e6d7989a-5bfc-4660-9454-bac14f584348\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e6d7989a-5bfc-4660-9454-bac14f584348\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"18f85de7-81ed-410e-85d9-eda519256b5d\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"18f85de7-81ed-410e-85d9-eda519256b5d\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"medium\",\"exclude\":false,\"enhancements\":{}}},\"bb3d6e74-dbc2-4bd4-934f-08f26d059205\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"bb3d6e74-dbc2-4bd4-934f-08f26d059205\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Overview of Application Activity logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3) \n- [Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c) \n- [Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d) \n- Network Activity\n - [Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15) \n - [DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386) \n- **[Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)**\n \n\n**Overview**\n\nThis dashboard shows an overview of detailed information about the behavior of applications and services.\n\nPlease visit the [Application Activity](https://schema.ocsf.io/1.0.0-rc.3/categories/application) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 32, + "i": "f5b306a1-0dfb-40a3-8f01-897f41098d59", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "f5b306a1-0dfb-40a3-8f01-897f41098d59", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-60d0347c-d5be-4865-b28a-e7e734fcf811", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "01adfe37-b391-4468-9121-51b8760cf148", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "60d0347c-d5be-4865-b28a-e7e734fcf811": { + "columnOrder": [ + "6df2881f-6923-4191-a978-7756f616bc53", + "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb" + ], + "columns": { + "6df2881f-6923-4191-a978-7756f616bc53": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "01adfe37-b391-4468-9121-51b8760cf148", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "6df2881f-6923-4191-a978-7756f616bc53", + "isTransposed": false + }, + { + "columnId": "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb", + "isTransposed": false + } + ], + "layerId": "60d0347c-d5be-4865-b28a-e7e734fcf811", + "layerType": "data", + "paging": { + "enabled": false, + "size": 10 + }, + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "efb41cd8-6a78-461f-8787-a61e80618115", + "w": 19, + "x": 10, + "y": 0 + }, + "panelIndex": "efb41cd8-6a78-461f-8787-a61e80618115", + "title": "Top 10 Source IP [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-60d0347c-d5be-4865-b28a-e7e734fcf811", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ff4c9e45-12ea-4b80-a278-9d94f71f2e68", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "60d0347c-d5be-4865-b28a-e7e734fcf811": { + "columnOrder": [ + "6df2881f-6923-4191-a978-7756f616bc53", + "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb" + ], + "columns": { + "6df2881f-6923-4191-a978-7756f616bc53": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ff4c9e45-12ea-4b80-a278-9d94f71f2e68", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "6df2881f-6923-4191-a978-7756f616bc53", + "isTransposed": false + }, + { + "columnId": "9d8fa6fa-5a2c-4b5d-bb7c-c21b2e2ef0bb", + "isTransposed": false + } + ], + "layerId": "60d0347c-d5be-4865-b28a-e7e734fcf811", + "layerType": "data", + "paging": { + "enabled": false, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "da28d9c3-198a-4986-aee2-f9dd5979d8b2", + "w": 19, + "x": 29, + "y": 0 + }, + "panelIndex": "da28d9c3-198a-4986-aee2-f9dd5979d8b2", + "title": "Top 10 Destination IP [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e287bc8c-5332-41e7-ab33-a29f5a2cdcdf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f045fe67-6d01-40b4-91a6-e7f5b558e029", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e287bc8c-5332-41e7-ab33-a29f5a2cdcdf": { + "columnOrder": [ + "35b3e177-74e8-460b-aea5-8ac2d04fb4ef", + "b8da9cc8-03a8-4415-96ac-b080dd624e36" + ], + "columns": { + "35b3e177-74e8-460b-aea5-8ac2d04fb4ef": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resources Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b8da9cc8-03a8-4415-96ac-b080dd624e36", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.resources.name" + }, + "b8da9cc8-03a8-4415-96ac-b080dd624e36": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f045fe67-6d01-40b4-91a6-e7f5b558e029", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "35b3e177-74e8-460b-aea5-8ac2d04fb4ef" + }, + { + "columnId": "b8da9cc8-03a8-4415-96ac-b080dd624e36" + } + ], + "layerId": "e287bc8c-5332-41e7-ab33-a29f5a2cdcdf", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "91e008ad-1307-4cf7-b0d7-b201141160e2", + "w": 19, + "x": 10, + "y": 16 + }, + "panelIndex": "91e008ad-1307-4cf7-b0d7-b201141160e2", + "title": "Top 10 Affected Resources [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5da09b6f-a373-4644-a8af-e4ebf0bf185b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1d4ea350-d347-42ec-9119-1e0927bdf7f7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5da09b6f-a373-4644-a8af-e4ebf0bf185b": { + "columnOrder": [ + "b17bc406-4b46-453c-8cf0-e9bb12a213de", + "5fe67885-e1f2-494d-8fc3-ee1d3fba9978" + ], + "columns": { + "5fe67885-e1f2-494d-8fc3-ee1d3fba9978": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b17bc406-4b46-453c-8cf0-e9bb12a213de": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5fe67885-e1f2-494d-8fc3-ee1d3fba9978", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.activity_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1d4ea350-d347-42ec-9119-1e0927bdf7f7", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "5fe67885-e1f2-494d-8fc3-ee1d3fba9978" + ], + "layerId": "5da09b6f-a373-4644-a8af-e4ebf0bf185b", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "b17bc406-4b46-453c-8cf0-e9bb12a213de" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "1b312846-0250-4c85-b330-35bfbf3daf0a", + "w": 19, + "x": 29, + "y": 16 + }, + "panelIndex": "1b312846-0250-4c85-b330-35bfbf3daf0a", + "title": "Events by Activity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ff268b38-ca7f-414f-a28d-52dc545a0273", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5f19bee-ce3a-4213-a865-c257292fce4a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ff268b38-ca7f-414f-a28d-52dc545a0273": { + "columnOrder": [ + "25109996-00b3-4602-a3c3-8d0becb6579f", + "8031ca52-3058-465b-a173-b9dd340eed7a", + "22ab8cfc-6ee9-4279-bc6b-24316e35d212" + ], + "columns": { + "22ab8cfc-6ee9-4279-bc6b-24316e35d212": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "25109996-00b3-4602-a3c3-8d0becb6579f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Service Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "22ab8cfc-6ee9-4279-bc6b-24316e35d212", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.api.service.name" + }, + "8031ca52-3058-465b-a173-b9dd340eed7a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a5f19bee-ce3a-4213-a865-c257292fce4a", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "22ab8cfc-6ee9-4279-bc6b-24316e35d212" + ], + "layerId": "ff268b38-ca7f-414f-a28d-52dc545a0273", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "25109996-00b3-4602-a3c3-8d0becb6579f", + "xAccessor": "8031ca52-3058-465b-a173-b9dd340eed7a" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "45eebc37-b634-45c6-8e06-5c2dca8d2da4", + "w": 24, + "x": 0, + "y": 32 + }, + "panelIndex": "45eebc37-b634-45c6-8e06-5c2dca8d2da4", + "title": "API Activity by Service over Time [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-be4dcc14-4ee0-44ec-9115-16b830d6edc3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "096e7c99-543a-40d0-8b19-7ca246d3fd16", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "be4dcc14-4ee0-44ec-9115-16b830d6edc3": { + "columnOrder": [ + "f3c33145-44b3-4ac3-93b6-9579190515a2", + "264d5daa-5e07-43dc-a551-fb3e09b3042c", + "bfd62117-1ec7-4913-8137-762c04c3c716" + ], + "columns": { + "264d5daa-5e07-43dc-a551-fb3e09b3042c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Operation", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bfd62117-1ec7-4913-8137-762c04c3c716", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.api.operation" + }, + "bfd62117-1ec7-4913-8137-762c04c3c716": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f3c33145-44b3-4ac3-93b6-9579190515a2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Actor Account UID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bfd62117-1ec7-4913-8137-762c04c3c716", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.actor.user.account.uid" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "096e7c99-543a-40d0-8b19-7ca246d3fd16", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "bfd62117-1ec7-4913-8137-762c04c3c716" + ], + "layerId": "be4dcc14-4ee0-44ec-9115-16b830d6edc3", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "264d5daa-5e07-43dc-a551-fb3e09b3042c", + "xAccessor": "f3c33145-44b3-4ac3-93b6-9579190515a2" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7047cace-d1ab-4132-b446-80309dcf6563", + "w": 24, + "x": 24, + "y": 32 + }, + "panelIndex": "7047cace-d1ab-4132-b446-80309dcf6563", + "title": "API Operation by Account ID [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f1794c60-78b6-41a2-9c74-bf7f932f4710", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db62012c-71c0-4550-83aa-d7c1e151921c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f1794c60-78b6-41a2-9c74-bf7f932f4710": { + "columnOrder": [ + "53fbc38e-ce20-4d9b-b5ee-b716f04ce5b6", + "66f7a12f-a5c2-4328-a33f-ea61a931e5fd", + "2b254dfb-8e44-465c-8964-cd450f301aab" + ], + "columns": { + "2b254dfb-8e44-465c-8964-cd450f301aab": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "53fbc38e-ce20-4d9b-b5ee-b716f04ce5b6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Operation", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2b254dfb-8e44-465c-8964-cd450f301aab", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.api.operation" + }, + "66f7a12f-a5c2-4328-a33f-ea61a931e5fd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Service Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2b254dfb-8e44-465c-8964-cd450f301aab", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.api.service.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "db62012c-71c0-4550-83aa-d7c1e151921c", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": true, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": false, + "type": "heatmap_grid", + "xTitle": "" + }, + "layerId": "f1794c60-78b6-41a2-9c74-bf7f932f4710", + "layerType": "data", + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "type": "heatmap_legend" + }, + "palette": { + "accessor": "2b254dfb-8e44-465c-8964-cd450f301aab", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#6092c0", + "stop": 0 + }, + { + "color": "#a8bfda", + "stop": 10 + }, + { + "color": "#ebeff5", + "stop": 20 + }, + { + "color": "#ecb385", + "stop": 30 + }, + { + "color": "#e7664c", + "stop": 40 + }, + { + "color": "#e7664c", + "stop": 50 + }, + { + "color": "#e7664c", + "stop": 60 + }, + { + "color": "#e7664c", + "stop": 70 + }, + { + "color": "#e7664c", + "stop": 80 + }, + { + "color": "#e7664c", + "stop": 90 + } + ], + "continuity": "above", + "name": "custom", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "percent", + "steps": 5, + "stops": [ + { + "color": "#6092c0", + "stop": 10 + }, + { + "color": "#a8bfda", + "stop": 20 + }, + { + "color": "#ebeff5", + "stop": 30 + }, + { + "color": "#ecb385", + "stop": 40 + }, + { + "color": "#e7664c", + "stop": 50 + }, + { + "color": "#e7664c", + "stop": 60 + }, + { + "color": "#e7664c", + "stop": 70 + }, + { + "color": "#e7664c", + "stop": 80 + }, + { + "color": "#e7664c", + "stop": 90 + }, + { + "color": "#e7664c", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "2b254dfb-8e44-465c-8964-cd450f301aab", + "xAccessor": "53fbc38e-ce20-4d9b-b5ee-b716f04ce5b6", + "yAccessor": "66f7a12f-a5c2-4328-a33f-ea61a931e5fd" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "96e95a12-c91a-4ecb-aa52-52884e5af866", + "w": 48, + "x": 0, + "y": 47 + }, + "panelIndex": "96e95a12-c91a-4ecb-aa52-52884e5af866", + "title": "API Operation by Service [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "bafa4a84-cd88-474c-b184-abf585029430", + "w": 48, + "x": 0, + "y": 62 + }, + "panelIndex": "bafa4a84-cd88-474c-b184-abf585029430", + "panelRefName": "panel_bafa4a84-cd88-474c-b184-abf585029430", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] Application Activity", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T12:38:16.057Z", + "id": "amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "efb41cd8-6a78-461f-8787-a61e80618115:indexpattern-datasource-layer-60d0347c-d5be-4865-b28a-e7e734fcf811", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efb41cd8-6a78-461f-8787-a61e80618115:01adfe37-b391-4468-9121-51b8760cf148", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da28d9c3-198a-4986-aee2-f9dd5979d8b2:indexpattern-datasource-layer-60d0347c-d5be-4865-b28a-e7e734fcf811", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da28d9c3-198a-4986-aee2-f9dd5979d8b2:ff4c9e45-12ea-4b80-a278-9d94f71f2e68", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91e008ad-1307-4cf7-b0d7-b201141160e2:indexpattern-datasource-layer-e287bc8c-5332-41e7-ab33-a29f5a2cdcdf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91e008ad-1307-4cf7-b0d7-b201141160e2:f045fe67-6d01-40b4-91a6-e7f5b558e029", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1b312846-0250-4c85-b330-35bfbf3daf0a:indexpattern-datasource-layer-5da09b6f-a373-4644-a8af-e4ebf0bf185b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1b312846-0250-4c85-b330-35bfbf3daf0a:1d4ea350-d347-42ec-9119-1e0927bdf7f7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45eebc37-b634-45c6-8e06-5c2dca8d2da4:indexpattern-datasource-layer-ff268b38-ca7f-414f-a28d-52dc545a0273", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45eebc37-b634-45c6-8e06-5c2dca8d2da4:a5f19bee-ce3a-4213-a865-c257292fce4a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7047cace-d1ab-4132-b446-80309dcf6563:indexpattern-datasource-layer-be4dcc14-4ee0-44ec-9115-16b830d6edc3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7047cace-d1ab-4132-b446-80309dcf6563:096e7c99-543a-40d0-8b19-7ca246d3fd16", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "96e95a12-c91a-4ecb-aa52-52884e5af866:indexpattern-datasource-layer-f1794c60-78b6-41a2-9c74-bf7f932f4710", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "96e95a12-c91a-4ecb-aa52-52884e5af866:db62012c-71c0-4550-83aa-d7c1e151921c", + "type": "index-pattern" + }, + { + "id": "amazon_security_lake-81902d50-2538-11ee-9f72-193490b86197", + "name": "bafa4a84-cd88-474c-b184-abf585029430:panel_bafa4a84-cd88-474c-b184-abf585029430", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_ce6530d2-da12-4a80-a1c5-6d8db59eb0e7:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_086e84d6-0fef-4a48-b5ab-690f9d0ccc53:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_eb892b38-5d66-4b4d-899a-61337d4d983d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e6d7989a-5bfc-4660-9454-bac14f584348:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_18f85de7-81ed-410e-85d9-eda519256b5d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_bb3d6e74-dbc2-4bd4-934f-08f26d059205:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386.json new file mode 100644 index 00000000000..140c0d3ac01 --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386.json @@ -0,0 +1,2029 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"146b8dc5-7437-4acc-93e1-c568a105be16\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"146b8dc5-7437-4acc-93e1-c568a105be16\",\"fieldName\":\"network.direction\",\"title\":\"Network Direction\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"1fe50755-27ba-41f0-b672-dce437b98557\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1fe50755-27ba-41f0-b672-dce437b98557\",\"fieldName\":\"ocsf.disposition\",\"title\":\"Disposition\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"5ab63202-e00a-43b6-81df-496939c0007b\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"5ab63202-e00a-43b6-81df-496939c0007b\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"ddd4bf99-1fba-45a6-9e55-6cefd4b269ee\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ddd4bf99-1fba-45a6-9e55-6cefd4b269ee\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"c949847f-4ef3-4f46-b1a9-1c3130e3e86e\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c949847f-4ef3-4f46-b1a9-1c3130e3e86e\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Overview of DNS Activity logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3) \n- [Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c) \n- [Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d) \n- Network Activity\n - [Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15) \n - **[DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386)** \n- [Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)\n \n\n**Overview**\n\nThis dashboard shows an overview of DNS queries and answers as seen on the network.\n\nPlease visit the [DNS Activity](https://schema.ocsf.io/1.0.0-rc.3/classes/dns_activity) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 38, + "i": "47b3e796-92a7-4d88-beee-c24d88d89c9c", + "w": 9, + "x": 0, + "y": 0 + }, + "panelIndex": "47b3e796-92a7-4d88-beee-c24d88d89c9c", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d15ef038-24a3-4b9a-8cf9-c7b2b9b0ab71", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DNS Events", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "compact": true, + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d15ef038-24a3-4b9a-8cf9-c7b2b9b0ab71", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "7fd8f250-f076-4e19-b90f-3c6674fe3764", + "w": 13, + "x": 9, + "y": 0 + }, + "panelIndex": "7fd8f250-f076-4e19-b90f-3c6674fe3764", + "title": "DNS Events [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b2080fa-08dd-4bf5-bb82-ab43d5066168", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Source Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "source.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7b2080fa-08dd-4bf5-bb82-ab43d5066168", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "414d0a8c-750b-4dec-9c89-64a0715c0c12", + "w": 13, + "x": 22, + "y": 0 + }, + "panelIndex": "414d0a8c-750b-4dec-9c89-64a0715c0c12", + "title": "Source Bytes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f43fcaf6-a153-427f-8cea-276d6bc15a26", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Destination Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "destination.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f43fcaf6-a153-427f-8cea-276d6bc15a26", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "6251f24e-1f8f-4202-84d5-72c52c0c14bb", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "6251f24e-1f8f-4202-84d5-72c52c0c14bb", + "title": "Destination Bytes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d0942f3c-2022-40eb-a036-8af6cb29ec3e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Response Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "dns.response_code" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d0942f3c-2022-40eb-a036-8af6cb29ec3e", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "seriesType": "bar", + "xAccessor": "d305cb44-9e31-4421-9e8f-167a2e389d7d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "1173f95a-d30e-4c70-81e3-9dd38693df3e", + "w": 39, + "x": 9, + "y": 6 + }, + "panelIndex": "1173f95a-d30e-4c70-81e3-9dd38693df3e", + "title": "Events by DNS Response Code [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3b2db439-6ae3-4106-add5-8042eac63aec", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "dns.question.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3b2db439-6ae3-4106-add5-8042eac63aec", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "width": 556 + }, + { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a" + } + ], + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "paging": { + "enabled": false, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06", + "w": 20, + "x": 28, + "y": 23 + }, + "panelIndex": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06", + "title": "Top DNS Name [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da18e980-dcb6-43ae-adfc-bd3906c315b6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "7ce3e25e-ff5b-4dc0-9e2c-ce748b332d2e", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7ce3e25e-ff5b-4dc0-9e2c-ce748b332d2e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS OP Code", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"0\"" + }, + "label": "Query" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"1\" " + }, + "label": "Inverse Query" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"2\" " + }, + "label": "Status" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"3\" " + }, + "label": "Reserved" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"4\" " + }, + "label": "Notify" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"5\" " + }, + "label": "Update" + }, + { + "input": { + "language": "kuery", + "query": "ocsf.query.opcode_id : \"6\" " + }, + "label": "DSO Message" + } + ] + }, + "scale": "ordinal" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "da18e980-dcb6-43ae-adfc-bd3906c315b6", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7ce3e25e-ff5b-4dc0-9e2c-ce748b332d2e" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "da2d1627-177e-41fe-8de3-5e3401259543", + "w": 19, + "x": 9, + "y": 22 + }, + "panelIndex": "da2d1627-177e-41fe-8de3-5e3401259543", + "title": "Events by DNS OP Codes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dfc51bb8-dbf1-42fc-b464-374b0f921691", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Question Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "dns.question.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "dfc51bb8-dbf1-42fc-b464-374b0f921691", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "ca0538b6-d0ee-4105-8dc6-5268799b7ac8", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "ca0538b6-d0ee-4105-8dc6-5268799b7ac8", + "title": "Events by DNS Question Types [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2af5f3cf-6cca-4c14-a4d1-d84b97ba300f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Question Class", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "dns.question.class" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "2af5f3cf-6cca-4c14-a4d1-d84b97ba300f", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "6d496e8d-e114-4e71-86a8-864641f166ef", + "w": 24, + "x": 24, + "y": 39 + }, + "panelIndex": "6d496e8d-e114-4e71-86a8-864641f166ef", + "title": "Events by DNS Question Classes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "02cdedec-71ea-4ed7-a85e-da7aa584f65f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Answers Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "dns.answers.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "02cdedec-71ea-4ed7-a85e-da7aa584f65f", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "003c1e21-610c-4837-8ee3-629d002477a9", + "w": 24, + "x": 0, + "y": 54 + }, + "panelIndex": "003c1e21-610c-4837-8ee3-629d002477a9", + "title": "Events by DNS Answer Types [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "05afc905-71b4-4dbc-ac86-13dbc81adbc1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d305cb44-9e31-4421-9e8f-167a2e389d7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Answers Class", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "dns.answers.class" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "05afc905-71b4-4dbc-ac86-13dbc81adbc1", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d305cb44-9e31-4421-9e8f-167a2e389d7d" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "b420b9ce-6b5e-44f8-afee-a99582a0c17e", + "w": 24, + "x": 24, + "y": 55 + }, + "panelIndex": "b420b9ce-6b5e-44f8-afee-a99582a0c17e", + "title": "Events by DNS Answer Classes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "30811950-e17a-44f3-a7f7-7eb0c25c5b8e", + "w": 48, + "x": 0, + "y": 71 + }, + "panelIndex": "30811950-e17a-44f3-a7f7-7eb0c25c5b8e", + "panelRefName": "panel_30811950-e17a-44f3-a7f7-7eb0c25c5b8e", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] DNS Activity", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T12:23:53.235Z", + "id": "amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "7fd8f250-f076-4e19-b90f-3c6674fe3764:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7fd8f250-f076-4e19-b90f-3c6674fe3764:d15ef038-24a3-4b9a-8cf9-c7b2b9b0ab71", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "414d0a8c-750b-4dec-9c89-64a0715c0c12:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "414d0a8c-750b-4dec-9c89-64a0715c0c12:7b2080fa-08dd-4bf5-bb82-ab43d5066168", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6251f24e-1f8f-4202-84d5-72c52c0c14bb:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6251f24e-1f8f-4202-84d5-72c52c0c14bb:f43fcaf6-a153-427f-8cea-276d6bc15a26", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1173f95a-d30e-4c70-81e3-9dd38693df3e:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1173f95a-d30e-4c70-81e3-9dd38693df3e:d0942f3c-2022-40eb-a036-8af6cb29ec3e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06:3b2db439-6ae3-4106-add5-8042eac63aec", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da2d1627-177e-41fe-8de3-5e3401259543:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da2d1627-177e-41fe-8de3-5e3401259543:da18e980-dcb6-43ae-adfc-bd3906c315b6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ca0538b6-d0ee-4105-8dc6-5268799b7ac8:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ca0538b6-d0ee-4105-8dc6-5268799b7ac8:dfc51bb8-dbf1-42fc-b464-374b0f921691", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6d496e8d-e114-4e71-86a8-864641f166ef:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6d496e8d-e114-4e71-86a8-864641f166ef:2af5f3cf-6cca-4c14-a4d1-d84b97ba300f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "003c1e21-610c-4837-8ee3-629d002477a9:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "003c1e21-610c-4837-8ee3-629d002477a9:02cdedec-71ea-4ed7-a85e-da7aa584f65f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b420b9ce-6b5e-44f8-afee-a99582a0c17e:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b420b9ce-6b5e-44f8-afee-a99582a0c17e:05afc905-71b4-4dbc-ac86-13dbc81adbc1", + "type": "index-pattern" + }, + { + "id": "amazon_security_lake-c2472e60-262e-11ee-a94e-bfa24df19b15", + "name": "30811950-e17a-44f3-a7f7-7eb0c25c5b8e:panel_30811950-e17a-44f3-a7f7-7eb0c25c5b8e", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_146b8dc5-7437-4acc-93e1-c568a105be16:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_1fe50755-27ba-41f0-b672-dce437b98557:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5ab63202-e00a-43b6-81df-496939c0007b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ddd4bf99-1fba-45a6-9e55-6cefd4b269ee:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c949847f-4ef3-4f46-b1a9-1c3130e3e86e:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15.json new file mode 100644 index 00000000000..5ee322fcb46 --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15.json @@ -0,0 +1,2438 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"146b8dc5-7437-4acc-93e1-c568a105be16\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"146b8dc5-7437-4acc-93e1-c568a105be16\",\"fieldName\":\"network.direction\",\"title\":\"Network Direction\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"1fe50755-27ba-41f0-b672-dce437b98557\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1fe50755-27ba-41f0-b672-dce437b98557\",\"fieldName\":\"ocsf.disposition\",\"title\":\"Disposition\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"5ab63202-e00a-43b6-81df-496939c0007b\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"5ab63202-e00a-43b6-81df-496939c0007b\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"ddd4bf99-1fba-45a6-9e55-6cefd4b269ee\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ddd4bf99-1fba-45a6-9e55-6cefd4b269ee\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"c949847f-4ef3-4f46-b1a9-1c3130e3e86e\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c949847f-4ef3-4f46-b1a9-1c3130e3e86e\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Overview of Network Activity logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3) \n- [Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c) \n- [Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d) \n- Network Activity\n - **[Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15)** \n - [DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386) \n- [Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)\n \n\n**Overview**\n\nThis dashboard shows an overview of Network connections and traffic activity.\n\nPlease visit the [Network Activity](https://schema.ocsf.io/1.0.0-rc.3/classes/network_activity) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 38, + "i": "47b3e796-92a7-4d88-beee-c24d88d89c9c", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "47b3e796-92a7-4d88-beee-c24d88d89c9c", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4726e072-a199-415e-a4b0-73bcd5479824", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Source Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "source.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4726e072-a199-415e-a4b0-73bcd5479824", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "414d0a8c-750b-4dec-9c89-64a0715c0c12", + "w": 10, + "x": 8, + "y": 0 + }, + "panelIndex": "414d0a8c-750b-4dec-9c89-64a0715c0c12", + "title": "Source Bytes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "689e71ca-13a6-4664-aeb4-6dadb7b930c1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Destination Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "destination.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "689e71ca-13a6-4664-aeb4-6dadb7b930c1", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "6251f24e-1f8f-4202-84d5-72c52c0c14bb", + "w": 10, + "x": 18, + "y": 0 + }, + "panelIndex": "6251f24e-1f8f-4202-84d5-72c52c0c14bb", + "title": "Destination Bytes [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f056e4a-3845-420f-9773-04239028f55d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Source Packets", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "source.packets" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7f056e4a-3845-420f-9773-04239028f55d", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "87ff7323-e049-494e-bd85-72c1f19ddca2", + "w": 10, + "x": 28, + "y": 0 + }, + "panelIndex": "87ff7323-e049-494e-bd85-72c1f19ddca2", + "title": "Source Packets [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f0d6d8db-0cb9-4fa6-81bf-e2bbcec1d9f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc30d965-b92e-4e6e-b5b3-6ed82b7644db": { + "columnOrder": [ + "f624a888-8bf5-419c-926d-1173ea5d4724" + ], + "columns": { + "f624a888-8bf5-419c-926d-1173ea5d4724": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Destination Packets", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "destination.packets" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f0d6d8db-0cb9-4fa6-81bf-e2bbcec1d9f8", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "layerType": "data", + "metricAccessor": "f624a888-8bf5-419c-926d-1173ea5d4724" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "e1759cdd-d734-408e-a4c4-798d7246ca76", + "w": 10, + "x": 38, + "y": 0 + }, + "panelIndex": "e1759cdd-d734-408e-a4c4-798d7246ca76", + "title": "Destination Packets [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dcddf672-7d9c-4bb4-95bc-b1cee460e3eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7d18b53-ccdb-4f96-b270-3dea624b82d0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dcddf672-7d9c-4bb4-95bc-b1cee460e3eb": { + "columnOrder": [ + "baed034e-c9b5-4fad-bc05-6095befed0c8", + "283330d2-8238-4361-af3c-87a6f2b3f083" + ], + "columns": { + "283330d2-8238-4361-af3c-87a6f2b3f083": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "baed034e-c9b5-4fad-bc05-6095befed0c8": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f7d18b53-ccdb-4f96-b270-3dea624b82d0", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "emphasizeFitting": false, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "283330d2-8238-4361-af3c-87a6f2b3f083" + ], + "layerId": "dcddf672-7d9c-4bb4-95bc-b1cee460e3eb", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "baed034e-c9b5-4fad-bc05-6095befed0c8" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "27f78538-3a3c-4f67-a868-94e915a7ddd1", + "w": 40, + "x": 8, + "y": 6 + }, + "panelIndex": "27f78538-3a3c-4f67-a868-94e915a7ddd1", + "title": "Network Activity Transactions [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a1f4e021-bbc3-4fe1-8107-80cfacfa768b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "cd86cdd6-64e8-4813-aac4-e40dbe64b79d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cd86cdd6-64e8-4813-aac4-e40dbe64b79d": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a1f4e021-bbc3-4fe1-8107-80cfacfa768b", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a" + }, + { + "columnId": "cd86cdd6-64e8-4813-aac4-e40dbe64b79d", + "isTransposed": false + } + ], + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06", + "w": 20, + "x": 8, + "y": 21 + }, + "panelIndex": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06", + "title": "Top 10 Source IP [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6a453c9-2e74-48a0-89c6-9c4b90542e87", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "cd86cdd6-64e8-4813-aac4-e40dbe64b79d", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cd86cdd6-64e8-4813-aac4-e40dbe64b79d": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f6a453c9-2e74-48a0-89c6-9c4b90542e87", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a" + }, + { + "columnId": "cd86cdd6-64e8-4813-aac4-e40dbe64b79d", + "isTransposed": false + } + ], + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "f239088f-f933-4408-aa56-1c63a2700bfb", + "w": 20, + "x": 28, + "y": 21 + }, + "panelIndex": "f239088f-f933-4408-aa56-1c63a2700bfb", + "title": "Top 10 Destination IP [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6483fca1-8635-4c75-9e85-14e885d0bd1a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d237115c-7152-49ea-adbb-b88322cab4ef": { + "columnOrder": [ + "a2cd27f4-1b52-479b-b5e6-6935e7d3bbd1", + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "columns": { + "6bf88690-ee2c-418f-9c0b-afafaa27320a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a2cd27f4-1b52-479b-b5e6-6935e7d3bbd1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Network Direction", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6bf88690-ee2c-418f-9c0b-afafaa27320a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "6483fca1-8635-4c75-9e85-14e885d0bd1a", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d237115c-7152-49ea-adbb-b88322cab4ef", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6bf88690-ee2c-418f-9c0b-afafaa27320a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "a2cd27f4-1b52-479b-b5e6-6935e7d3bbd1" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "da2d1627-177e-41fe-8de3-5e3401259543", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "da2d1627-177e-41fe-8de3-5e3401259543", + "title": "Events by Connection Direction [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0bcd3589-641f-4fec-aff9-d7138901e1d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d2c2da55-77b9-4b98-aa04-f28206c5177a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0bcd3589-641f-4fec-aff9-d7138901e1d8": { + "columnOrder": [ + "7d21f980-098d-4c12-900b-67f4c3a075b5", + "35cbe380-eab7-4697-88db-313c43fa1b19" + ], + "columns": { + "35cbe380-eab7-4697-88db-313c43fa1b19": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7d21f980-098d-4c12-900b-67f4c3a075b5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "35cbe380-eab7-4697-88db-313c43fa1b19", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.activity_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d2c2da55-77b9-4b98-aa04-f28206c5177a", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "35cbe380-eab7-4697-88db-313c43fa1b19" + ], + "layerId": "0bcd3589-641f-4fec-aff9-d7138901e1d8", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "7d21f980-098d-4c12-900b-67f4c3a075b5" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "dd7bc155-8793-4e0c-9055-5a08ea8b55a8", + "w": 24, + "x": 24, + "y": 38 + }, + "panelIndex": "dd7bc155-8793-4e0c-9055-5a08ea8b55a8", + "title": "Events by Activity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84427391-beb7-4e36-9ad5-e415813653a1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45b3157b-6ad2-4c80-8fda-4aada20a1b0f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45b2322c-7045-4e41-95dc-ab1d8e03a1f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "93c08461-9faa-450d-b39e-540a5067f5cf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c": { + "columnOrder": [ + "769ade19-445d-43b3-92ee-03e9e00d5599", + "4dfa916c-3452-4ea3-8522-85fea4da5aac", + "872b5f40-2242-4b5b-889b-e91f0ef40c1e" + ], + "columns": { + "4dfa916c-3452-4ea3-8522-85fea4da5aac": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "External Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "769ade19-445d-43b3-92ee-03e9e00d5599": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Internal Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "872b5f40-2242-4b5b-889b-e91f0ef40c1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Network Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {} + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "84427391-beb7-4e36-9ad5-e415813653a1", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "45b3157b-6ad2-4c80-8fda-4aada20a1b0f", + "key": "destination.ip", + "negate": true, + "params": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + }, + "type": "range", + "value": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + } + }, + "query": { + "range": { + "destination.ip": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "45b2322c-7045-4e41-95dc-ab1d8e03a1f1", + "key": "destination.ip", + "negate": true, + "params": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + }, + "type": "range", + "value": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + } + }, + "query": { + "range": { + "destination.ip": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "destination.ip", + "index": "93c08461-9faa-450d-b39e-540a5067f5cf", + "key": "destination.ip", + "negate": true, + "params": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + }, + "type": "range", + "value": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + } + }, + "query": { + "range": { + "destination.ip": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "summaryRow": "none" + }, + { + "alignment": "left", + "columnId": "769ade19-445d-43b3-92ee-03e9e00d5599" + }, + { + "alignment": "left", + "columnId": "4dfa916c-3452-4ea3-8522-85fea4da5aac" + } + ], + "headerRowHeight": "single", + "headerRowHeightLines": 1, + "layerId": "ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Data table visualization (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "d7123b4f-9621-4b62-8588-fd9641b45354", + "w": 24, + "x": 0, + "y": 53 + }, + "panelIndex": "d7123b4f-9621-4b62-8588-fd9641b45354", + "title": "Top Egress Connections [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0ea702d6-08c8-45df-87a2-25c2a90de131", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6680ebc8-d677-487b-b668-2bac02935a0b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8aca3960-04da-495f-8e6f-1b72b6baa52b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8bd70c79-212b-4e09-a7b3-b01d5f278650", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c": { + "columnOrder": [ + "769ade19-445d-43b3-92ee-03e9e00d5599", + "4dfa916c-3452-4ea3-8522-85fea4da5aac", + "872b5f40-2242-4b5b-889b-e91f0ef40c1e" + ], + "columns": { + "4dfa916c-3452-4ea3-8522-85fea4da5aac": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Internal Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "769ade19-445d-43b3-92ee-03e9e00d5599": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "External Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "872b5f40-2242-4b5b-889b-e91f0ef40c1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Network Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {} + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0ea702d6-08c8-45df-87a2-25c2a90de131", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "6680ebc8-d677-487b-b668-2bac02935a0b", + "key": "source.ip", + "negate": true, + "params": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + }, + "type": "range", + "value": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + } + }, + "query": { + "range": { + "source.ip": { + "gte": "10.0.0.0", + "lt": "10.255.255.255" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "8aca3960-04da-495f-8e6f-1b72b6baa52b", + "key": "source.ip", + "negate": true, + "params": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + }, + "type": "range", + "value": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + } + }, + "query": { + "range": { + "source.ip": { + "gte": "172.16.0.0", + "lt": "172.31.255.255" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "source.ip", + "index": "8bd70c79-212b-4e09-a7b3-b01d5f278650", + "key": "source.ip", + "negate": true, + "params": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + }, + "type": "range", + "value": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + } + }, + "query": { + "range": { + "source.ip": { + "gte": "192.168.0.0", + "lt": "192.168.255.255" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "872b5f40-2242-4b5b-889b-e91f0ef40c1e", + "summaryRow": "none" + }, + { + "alignment": "left", + "columnId": "769ade19-445d-43b3-92ee-03e9e00d5599" + }, + { + "alignment": "left", + "columnId": "4dfa916c-3452-4ea3-8522-85fea4da5aac" + } + ], + "headerRowHeight": "single", + "headerRowHeightLines": 1, + "layerId": "ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Data table visualization (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9c1e245f-3704-4715-8cfc-b4be7258e8ff", + "w": 24, + "x": 24, + "y": 53 + }, + "panelIndex": "9c1e245f-3704-4715-8cfc-b4be7258e8ff", + "title": "Top Ingress Connections [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "0d000a88-cc8f-4bca-b86b-364df39c5496", + "w": 48, + "x": 0, + "y": 68 + }, + "panelIndex": "0d000a88-cc8f-4bca-b86b-364df39c5496", + "panelRefName": "panel_0d000a88-cc8f-4bca-b86b-364df39c5496", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] Network Activity", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T12:28:16.666Z", + "id": "amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "414d0a8c-750b-4dec-9c89-64a0715c0c12:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "414d0a8c-750b-4dec-9c89-64a0715c0c12:4726e072-a199-415e-a4b0-73bcd5479824", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6251f24e-1f8f-4202-84d5-72c52c0c14bb:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6251f24e-1f8f-4202-84d5-72c52c0c14bb:689e71ca-13a6-4664-aeb4-6dadb7b930c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "87ff7323-e049-494e-bd85-72c1f19ddca2:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "87ff7323-e049-494e-bd85-72c1f19ddca2:7f056e4a-3845-420f-9773-04239028f55d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e1759cdd-d734-408e-a4c4-798d7246ca76:indexpattern-datasource-layer-fc30d965-b92e-4e6e-b5b3-6ed82b7644db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e1759cdd-d734-408e-a4c4-798d7246ca76:f0d6d8db-0cb9-4fa6-81bf-e2bbcec1d9f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27f78538-3a3c-4f67-a868-94e915a7ddd1:indexpattern-datasource-layer-dcddf672-7d9c-4bb4-95bc-b1cee460e3eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27f78538-3a3c-4f67-a868-94e915a7ddd1:f7d18b53-ccdb-4f96-b270-3dea624b82d0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7a8891-cbcb-4c47-855f-5a87fbaecf06:a1f4e021-bbc3-4fe1-8107-80cfacfa768b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f239088f-f933-4408-aa56-1c63a2700bfb:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f239088f-f933-4408-aa56-1c63a2700bfb:f6a453c9-2e74-48a0-89c6-9c4b90542e87", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da2d1627-177e-41fe-8de3-5e3401259543:indexpattern-datasource-layer-d237115c-7152-49ea-adbb-b88322cab4ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da2d1627-177e-41fe-8de3-5e3401259543:6483fca1-8635-4c75-9e85-14e885d0bd1a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dd7bc155-8793-4e0c-9055-5a08ea8b55a8:indexpattern-datasource-layer-0bcd3589-641f-4fec-aff9-d7138901e1d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dd7bc155-8793-4e0c-9055-5a08ea8b55a8:d2c2da55-77b9-4b98-aa04-f28206c5177a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7123b4f-9621-4b62-8588-fd9641b45354:indexpattern-datasource-layer-ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7123b4f-9621-4b62-8588-fd9641b45354:84427391-beb7-4e36-9ad5-e415813653a1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7123b4f-9621-4b62-8588-fd9641b45354:45b3157b-6ad2-4c80-8fda-4aada20a1b0f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7123b4f-9621-4b62-8588-fd9641b45354:45b2322c-7045-4e41-95dc-ab1d8e03a1f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7123b4f-9621-4b62-8588-fd9641b45354:93c08461-9faa-450d-b39e-540a5067f5cf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c1e245f-3704-4715-8cfc-b4be7258e8ff:indexpattern-datasource-layer-ad4ac4f0-9cc2-4a77-bacf-8cc7f99ec77c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c1e245f-3704-4715-8cfc-b4be7258e8ff:0ea702d6-08c8-45df-87a2-25c2a90de131", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c1e245f-3704-4715-8cfc-b4be7258e8ff:6680ebc8-d677-487b-b668-2bac02935a0b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c1e245f-3704-4715-8cfc-b4be7258e8ff:8aca3960-04da-495f-8e6f-1b72b6baa52b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c1e245f-3704-4715-8cfc-b4be7258e8ff:8bd70c79-212b-4e09-a7b3-b01d5f278650", + "type": "index-pattern" + }, + { + "id": "amazon_security_lake-16a0aa00-26dd-11ee-a94e-bfa24df19b15", + "name": "0d000a88-cc8f-4bca-b86b-364df39c5496:panel_0d000a88-cc8f-4bca-b86b-364df39c5496", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_146b8dc5-7437-4acc-93e1-c568a105be16:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_1fe50755-27ba-41f0-b672-dce437b98557:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5ab63202-e00a-43b6-81df-496939c0007b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_324bcb80-53e2-4ae0-8b7d-d6ec8ca2de3d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ddd4bf99-1fba-45a6-9e55-6cefd4b269ee:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c949847f-4ef3-4f46-b1a9-1c3130e3e86e:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d.json new file mode 100644 index 00000000000..79e2e14cb94 --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d.json @@ -0,0 +1,1140 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"7074e9a5-6114-4da7-bcda-8104441487c1\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"7074e9a5-6114-4da7-bcda-8104441487c1\",\"fieldName\":\"user.target.name\",\"title\":\"User Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"c55accdc-ba5b-467d-8886-4e095c3541b6\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c55accdc-ba5b-467d-8886-4e095c3541b6\",\"fieldName\":\"ocsf.class_name\",\"title\":\"Class Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"382759ba-4df2-4ebe-91f9-3f918bdb35b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"382759ba-4df2-4ebe-91f9-3f918bdb35b0\",\"fieldName\":\"ocsf.severity\",\"title\":\"Severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"e6b905d7-7f36-4536-8dd5-5e9e9c6fcf1b\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"e6b905d7-7f36-4536-8dd5-5e9e9c6fcf1b\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"ad220c7a-d5af-4662-9bcd-cbbbfa82013e\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"ad220c7a-d5af-4662-9bcd-cbbbfa82013e\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"cc433e72-f5b3-4144-b157-465bcb175e1c\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"cc433e72-f5b3-4144-b157-465bcb175e1c\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"03a40e7b-86e7-4ad3-8cd8-798446df8edd\":{\"type\":\"optionsListControl\",\"order\":6,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"03a40e7b-86e7-4ad3-8cd8-798446df8edd\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}}}" + }, + "description": "Overview of Identity and Access Management logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3) \n- [Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c) \n- **[Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d)** \n- Network Activity\n - [Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15) \n - [DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386) \n- [Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)\n \n\n**Overview**\n\nThis dashboard shows an overview of Identity \u0026 Access Management (IAM) events relate to the supervision of the system's authentication and access control model.\n\nPlease visit the [Identity \u0026 Access Management](https://schema.ocsf.io/1.0.0-rc.3/categories/iam) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 30, + "i": "3c7ec6ae-1f85-408e-9ec9-57348929b969", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "3c7ec6ae-1f85-408e-9ec9-57348929b969", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-85721088-ba45-4ce1-8f35-b09e86a17c40", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "10120f61-06a4-45bf-9045-5ee5ce0ccd5c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "85721088-ba45-4ce1-8f35-b09e86a17c40": { + "columnOrder": [ + "1487a391-8797-4ff1-ab46-710549b79947", + "53f1d56e-ca59-46f1-af85-db2d3df0226a" + ], + "columns": { + "1487a391-8797-4ff1-ab46-710549b79947": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Authentication Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "53f1d56e-ca59-46f1-af85-db2d3df0226a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.auth_protocol" + }, + "53f1d56e-ca59-46f1-af85-db2d3df0226a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "10120f61-06a4-45bf-9045-5ee5ce0ccd5c", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "53f1d56e-ca59-46f1-af85-db2d3df0226a" + ], + "layerId": "85721088-ba45-4ce1-8f35-b09e86a17c40", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "1487a391-8797-4ff1-ab46-710549b79947" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "07aab5df-fd5d-41f2-ba49-82e794b27574", + "w": 38, + "x": 10, + "y": 0 + }, + "panelIndex": "07aab5df-fd5d-41f2-ba49-82e794b27574", + "title": "Events by Authentication Protocol [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9b1aa845-a88e-4092-8729-a888ef1bfb5c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "321c2663-d5ba-4081-b623-c3424f9e114f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9b1aa845-a88e-4092-8729-a888ef1bfb5c": { + "columnOrder": [ + "919992f5-c733-4740-9723-0ab9c2eed664", + "a9433bf4-96af-41e8-a33d-3730fe5e5b1d" + ], + "columns": { + "919992f5-c733-4740-9723-0ab9c2eed664": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Logon Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9433bf4-96af-41e8-a33d-3730fe5e5b1d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.logon_type" + }, + "a9433bf4-96af-41e8-a33d-3730fe5e5b1d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "321c2663-d5ba-4081-b623-c3424f9e114f", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "a9433bf4-96af-41e8-a33d-3730fe5e5b1d" + ], + "layerId": "9b1aa845-a88e-4092-8729-a888ef1bfb5c", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "919992f5-c733-4740-9723-0ab9c2eed664" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "307724f4-f08c-4693-8c11-d2a9db738c41", + "w": 19, + "x": 10, + "y": 15 + }, + "panelIndex": "307724f4-f08c-4693-8c11-d2a9db738c41", + "title": "Events by Logon Type [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-43f8e5cc-a2cc-478d-bb00-102e930acc3e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "28cb6047-5cc1-4786-9107-2457f6decd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5936baf9-7cdc-4350-9be0-56d5142e5872", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "43f8e5cc-a2cc-478d-bb00-102e930acc3e": { + "columnOrder": [ + "b2f78e94-f4c5-47a8-8ae9-98dc74f0ba7a", + "6df69c86-c6c4-4a3f-a7c5-bbcfc47c794c" + ], + "columns": { + "6df69c86-c6c4-4a3f-a7c5-bbcfc47c794c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b2f78e94-f4c5-47a8-8ae9-98dc74f0ba7a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Actor User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6df69c86-c6c4-4a3f-a7c5-bbcfc47c794c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "28cb6047-5cc1-4786-9107-2457f6decd9c", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.status_id", + "index": "5936baf9-7cdc-4350-9be0-56d5142e5872", + "key": "ocsf.status_id", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.status_id": "2" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "b2f78e94-f4c5-47a8-8ae9-98dc74f0ba7a" + }, + { + "columnId": "6df69c86-c6c4-4a3f-a7c5-bbcfc47c794c" + } + ], + "layerId": "43f8e5cc-a2cc-478d-bb00-102e930acc3e", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "60af478a-8172-44f1-9e32-411ab20c6c3c", + "w": 19, + "x": 29, + "y": 15 + }, + "panelIndex": "60af478a-8172-44f1-9e32-411ab20c6c3c", + "title": "Top 10 Users with Highest Failure Status [Logs Amazon Security Lake] ", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-954220ab-66ee-407c-9f6c-65c6e2866f7a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1ecfd15e-c038-4d1e-a1fa-572363c5af4d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "954220ab-66ee-407c-9f6c-65c6e2866f7a": { + "columnOrder": [ + "315efd6e-70ab-4329-8d9d-28695f5c75b3", + "ea5d2adc-1cca-4b2a-b409-88bfc1debe64" + ], + "columns": { + "315efd6e-70ab-4329-8d9d-28695f5c75b3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ea5d2adc-1cca-4b2a-b409-88bfc1debe64", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.activity_name" + }, + "ea5d2adc-1cca-4b2a-b409-88bfc1debe64": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1ecfd15e-c038-4d1e-a1fa-572363c5af4d", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "ea5d2adc-1cca-4b2a-b409-88bfc1debe64" + ], + "layerId": "954220ab-66ee-407c-9f6c-65c6e2866f7a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "315efd6e-70ab-4329-8d9d-28695f5c75b3" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "6f832beb-50cc-4016-832e-01ba7c570a69", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "6f832beb-50cc-4016-832e-01ba7c570a69", + "title": "Events by Activity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a38a7754-5b7a-4f8c-8676-dd49954f62ae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9490fb53-2671-499e-9c59-43d01e3bc769", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a38a7754-5b7a-4f8c-8676-dd49954f62ae": { + "columnOrder": [ + "dc9db0f0-9199-40b5-bc0c-6454523be55f", + "2f05a408-67f3-47af-8169-232ff383bb6b" + ], + "columns": { + "2f05a408-67f3-47af-8169-232ff383bb6b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "dc9db0f0-9199-40b5-bc0c-6454523be55f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2f05a408-67f3-47af-8169-232ff383bb6b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9490fb53-2671-499e-9c59-43d01e3bc769", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "dc9db0f0-9199-40b5-bc0c-6454523be55f" + }, + { + "columnId": "2f05a408-67f3-47af-8169-232ff383bb6b", + "isTransposed": false + } + ], + "layerId": "a38a7754-5b7a-4f8c-8676-dd49954f62ae", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cf249bbf-1849-4f71-884d-95044132d36c", + "w": 24, + "x": 24, + "y": 30 + }, + "panelIndex": "cf249bbf-1849-4f71-884d-95044132d36c", + "title": "Top Users [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "55cf65c6-d2f7-4303-9a7f-cc3976475ef1", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "55cf65c6-d2f7-4303-9a7f-cc3976475ef1", + "panelRefName": "panel_55cf65c6-d2f7-4303-9a7f-cc3976475ef1", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] Identity and Access Management", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T12:29:58.878Z", + "id": "amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "07aab5df-fd5d-41f2-ba49-82e794b27574:indexpattern-datasource-layer-85721088-ba45-4ce1-8f35-b09e86a17c40", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07aab5df-fd5d-41f2-ba49-82e794b27574:10120f61-06a4-45bf-9045-5ee5ce0ccd5c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "307724f4-f08c-4693-8c11-d2a9db738c41:indexpattern-datasource-layer-9b1aa845-a88e-4092-8729-a888ef1bfb5c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "307724f4-f08c-4693-8c11-d2a9db738c41:321c2663-d5ba-4081-b623-c3424f9e114f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60af478a-8172-44f1-9e32-411ab20c6c3c:indexpattern-datasource-layer-43f8e5cc-a2cc-478d-bb00-102e930acc3e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60af478a-8172-44f1-9e32-411ab20c6c3c:28cb6047-5cc1-4786-9107-2457f6decd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60af478a-8172-44f1-9e32-411ab20c6c3c:5936baf9-7cdc-4350-9be0-56d5142e5872", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6f832beb-50cc-4016-832e-01ba7c570a69:indexpattern-datasource-layer-954220ab-66ee-407c-9f6c-65c6e2866f7a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6f832beb-50cc-4016-832e-01ba7c570a69:1ecfd15e-c038-4d1e-a1fa-572363c5af4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cf249bbf-1849-4f71-884d-95044132d36c:indexpattern-datasource-layer-a38a7754-5b7a-4f8c-8676-dd49954f62ae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cf249bbf-1849-4f71-884d-95044132d36c:9490fb53-2671-499e-9c59-43d01e3bc769", + "type": "index-pattern" + }, + { + "id": "amazon_security_lake-ab4090f0-2618-11ee-983a-17fb20a3b25d", + "name": "55cf65c6-d2f7-4303-9a7f-cc3976475ef1:panel_55cf65c6-d2f7-4303-9a7f-cc3976475ef1", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_7074e9a5-6114-4da7-bcda-8104441487c1:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c55accdc-ba5b-467d-8886-4e095c3541b6:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_382759ba-4df2-4ebe-91f9-3f918bdb35b0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e6b905d7-7f36-4536-8dd5-5e9e9c6fcf1b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ad220c7a-d5af-4662-9bcd-cbbbfa82013e:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_cc433e72-f5b3-4144-b157-465bcb175e1c:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_03a40e7b-86e7-4ad3-8cd8-798446df8edd:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c.json new file mode 100644 index 00000000000..de5a625ae67 --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c.json @@ -0,0 +1,2194 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"a9902929-fb15-4000-a8f5-68d5e9589426\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"a9902929-fb15-4000-a8f5-68d5e9589426\",\"fieldName\":\"ocsf.confidence\",\"title\":\"Confidence\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"a8bbda91-8b1d-44a3-b504-842dfb9e77ed\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"a8bbda91-8b1d-44a3-b504-842dfb9e77ed\",\"fieldName\":\"ocsf.risk_level\",\"title\":\"Risk Level\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"e62b5356-0c7e-4273-ba74-1a792810bdea\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"e62b5356-0c7e-4273-ba74-1a792810bdea\",\"fieldName\":\"ocsf.impact\",\"title\":\"Impact\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"65ce75bf-9eab-49d7-9232-e44895885e97\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"65ce75bf-9eab-49d7-9232-e44895885e97\",\"fieldName\":\"ocsf.severity\",\"title\":\"Severity\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"dd9a9c7e-b17b-40aa-98b0-5275105b2c91\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"dd9a9c7e-b17b-40aa-98b0-5275105b2c91\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"65c05770-1197-4f82-8a0b-577316a13f82\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"65c05770-1197-4f82-8a0b-577316a13f82\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"a4235b9e-98ae-4992-93eb-5e65aefd93d5\":{\"type\":\"optionsListControl\",\"order\":6,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"a4235b9e-98ae-4992-93eb-5e65aefd93d5\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"061d39e5-3fba-405c-a829-83a8adf60717\":{\"type\":\"optionsListControl\",\"order\":7,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"061d39e5-3fba-405c-a829-83a8adf60717\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}}}" + }, + "description": "Overview of Findings logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3) \n- **[Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c)** \n- [Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d) \n- Network Activity\n - [Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15) \n - [DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386) \n- [Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)\n \n\n**Overview**\n\nThis dashboard shows an overview of findings, detections, anomalies, alerts, and/or actions performed by security products.\n\nPlease visit the [Findings](https://schema.ocsf.io/1.0.0-rc.3/categories/findings) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 31, + "i": "be886af6-e16e-4285-8b9e-58d56630a7af", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "be886af6-e16e-4285-8b9e-58d56630a7af", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1cc05391-c5a8-4a13-9ae4-bcffba57b040", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e8db665-7da4-405f-8076-08ae60909d36", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1cc05391-c5a8-4a13-9ae4-bcffba57b040": { + "columnOrder": [ + "c7504c19-f6a6-4e3c-a2ca-f3a1afa2c521", + "4b66482a-d909-4317-aaab-f1d131268af3" + ], + "columns": { + "4b66482a-d909-4317-aaab-f1d131268af3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c7504c19-f6a6-4e3c-a2ca-f3a1afa2c521": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "State", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4b66482a-d909-4317-aaab-f1d131268af3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.state" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0e8db665-7da4-405f-8076-08ae60909d36", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "1cc05391-c5a8-4a13-9ae4-bcffba57b040", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "4b66482a-d909-4317-aaab-f1d131268af3" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "c7504c19-f6a6-4e3c-a2ca-f3a1afa2c521" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "772e49a3-3da9-4d70-a2b4-922375ec283a", + "w": 19, + "x": 10, + "y": 0 + }, + "panelIndex": "772e49a3-3da9-4d70-a2b4-922375ec283a", + "title": "Events by State [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4cab14b9-ca69-44a2-b928-bbf788e859d4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f81d806-50ec-4aae-a5c5-1a96e22561bb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4cab14b9-ca69-44a2-b928-bbf788e859d4": { + "columnOrder": [ + "4964978d-8bad-4415-8d52-e68606f0866c", + "75df3c1f-63fa-4154-8ffb-e33403d73d8a" + ], + "columns": { + "4964978d-8bad-4415-8d52-e68606f0866c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Analytic Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "75df3c1f-63fa-4154-8ffb-e33403d73d8a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.analytic.type" + }, + "75df3c1f-63fa-4154-8ffb-e33403d73d8a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "2f81d806-50ec-4aae-a5c5-1a96e22561bb", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "4cab14b9-ca69-44a2-b928-bbf788e859d4", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "75df3c1f-63fa-4154-8ffb-e33403d73d8a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "4964978d-8bad-4415-8d52-e68606f0866c" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "2d578ef5-4712-46cd-8842-a90f12288a1d", + "w": 19, + "x": 29, + "y": 0 + }, + "panelIndex": "2d578ef5-4712-46cd-8842-a90f12288a1d", + "title": "Events by Analytic Type [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-03e5b96c-3c7c-4bf5-98ba-ac874f18dced", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e20f26ba-9f98-4116-94fa-dbf5ed7c8739", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "03e5b96c-3c7c-4bf5-98ba-ac874f18dced": { + "columnOrder": [ + "6d21bef0-4a0f-4ddd-a88f-23b07c100590", + "861909a0-1abb-4831-b221-d1728d466409" + ], + "columns": { + "6d21bef0-4a0f-4ddd-a88f-23b07c100590": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Activity Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "861909a0-1abb-4831-b221-d1728d466409", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.activity_name" + }, + "861909a0-1abb-4831-b221-d1728d466409": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e20f26ba-9f98-4116-94fa-dbf5ed7c8739", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "03e5b96c-3c7c-4bf5-98ba-ac874f18dced", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "861909a0-1abb-4831-b221-d1728d466409" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "6d21bef0-4a0f-4ddd-a88f-23b07c100590" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3f93abe8-88a9-499c-bbf7-51cc6c456e36", + "w": 19, + "x": 10, + "y": 16 + }, + "panelIndex": "3f93abe8-88a9-499c-bbf7-51cc6c456e36", + "title": "Events by Activity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7b40bda7-e96b-4f46-af23-82c8b35481e5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "75fa021c-a616-4c39-8617-ef9350fc8a86", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7b40bda7-e96b-4f46-af23-82c8b35481e5": { + "columnOrder": [ + "cb691458-f06d-482c-87ca-7ebba38d657d", + "eb5950df-594f-4fcf-a8b1-def70b139c4b" + ], + "columns": { + "cb691458-f06d-482c-87ca-7ebba38d657d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Kill Chain Phase", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "eb5950df-594f-4fcf-a8b1-def70b139c4b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.kill_chain.phase" + }, + "eb5950df-594f-4fcf-a8b1-def70b139c4b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "75fa021c-a616-4c39-8617-ef9350fc8a86", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "eb5950df-594f-4fcf-a8b1-def70b139c4b" + ], + "layerId": "7b40bda7-e96b-4f46-af23-82c8b35481e5", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "cb691458-f06d-482c-87ca-7ebba38d657d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "5a0e7a0d-1249-496b-b456-72a0e57a9080", + "w": 19, + "x": 29, + "y": 16 + }, + "panelIndex": "5a0e7a0d-1249-496b-b456-72a0e57a9080", + "title": "Events by Kill Chain Phase [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8d1be711-df84-4131-a3d0-2cbfac4ce2e8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f8df874-baea-4394-9200-3a264719221e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8d1be711-df84-4131-a3d0-2cbfac4ce2e8": { + "columnOrder": [ + "58df9e1c-3bb4-4f47-9600-688928abb95d", + "88f2a237-e273-4828-952a-eab7af8cb20d" + ], + "columns": { + "58df9e1c-3bb4-4f47-9600-688928abb95d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Malware Classifications", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "88f2a237-e273-4828-952a-eab7af8cb20d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.malware.classifications" + }, + "88f2a237-e273-4828-952a-eab7af8cb20d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4f8df874-baea-4394-9200-3a264719221e", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "88f2a237-e273-4828-952a-eab7af8cb20d" + ], + "layerId": "8d1be711-df84-4131-a3d0-2cbfac4ce2e8", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "58df9e1c-3bb4-4f47-9600-688928abb95d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f335dc96-f388-4d5d-824f-8e14299f9dcc", + "w": 24, + "x": 0, + "y": 31 + }, + "panelIndex": "f335dc96-f388-4d5d-824f-8e14299f9dcc", + "title": "Events by Malware Classifications [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-00561990-40f2-4bd6-9f56-01dc3268bfbe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dcb866bc-4afa-4d14-9bb7-80b558e51559", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "00561990-40f2-4bd6-9f56-01dc3268bfbe": { + "columnOrder": [ + "db406e7a-d0e7-4520-96f6-8d8220cda8c9", + "2839ca48-f92b-4f9f-9e93-f6dbb03f2632" + ], + "columns": { + "2839ca48-f92b-4f9f-9e93-f6dbb03f2632": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "db406e7a-d0e7-4520-96f6-8d8220cda8c9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Attack Technique", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2839ca48-f92b-4f9f-9e93-f6dbb03f2632", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "dcb866bc-4afa-4d14-9bb7-80b558e51559", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "db406e7a-d0e7-4520-96f6-8d8220cda8c9" + }, + { + "columnId": "2839ca48-f92b-4f9f-9e93-f6dbb03f2632" + } + ], + "layerId": "00561990-40f2-4bd6-9f56-01dc3268bfbe", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b51f48f2-8da0-455f-93dc-7aef69af3ca6", + "w": 24, + "x": 24, + "y": 31 + }, + "panelIndex": "b51f48f2-8da0-455f-93dc-7aef69af3ca6", + "title": "Top 10 Attack Technique [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9042038b-e077-42e1-8eb2-7331495c85b4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0b8edcc7-e63e-471c-a19a-875842640bc0": { + "columnOrder": [ + "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "9c8a74e7-0d42-4a62-9601-37db83720f7f" + ], + "columns": { + "0f13fd06-5d7f-49a6-9e34-700539b531f5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Finding Title", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Confidence Score", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "ocsf.confidence_score" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.finding.title" + }, + "9c8a74e7-0d42-4a62-9601-37db83720f7f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Confidence Score", + "operationType": "max", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "ocsf.confidence_score" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9042038b-e077-42e1-8eb2-7331495c85b4", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c8a74e7-0d42-4a62-9601-37db83720f7f", + "hidden": false, + "isTransposed": false + }, + { + "columnId": "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "isTransposed": false + } + ], + "headerRowHeight": "single", + "headerRowHeightLines": 1, + "layerId": "0b8edcc7-e63e-471c-a19a-875842640bc0", + "layerType": "data", + "rowHeight": "auto" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "dfc70cec-b8c7-4263-a735-135278f215d8", + "w": 24, + "x": 0, + "y": 46 + }, + "panelIndex": "dfc70cec-b8c7-4263-a735-135278f215d8", + "title": "Top 10 Events with Highest Confidence Score [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3025cb0b-f49f-460c-8f69-a69072a5f112", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0b8edcc7-e63e-471c-a19a-875842640bc0": { + "columnOrder": [ + "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "9c8a74e7-0d42-4a62-9601-37db83720f7f" + ], + "columns": { + "0f13fd06-5d7f-49a6-9e34-700539b531f5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Finding Title", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Impact Score", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "ocsf.impact_score" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.finding.title" + }, + "9c8a74e7-0d42-4a62-9601-37db83720f7f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Impact Score", + "operationType": "max", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "ocsf.impact_score" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3025cb0b-f49f-460c-8f69-a69072a5f112", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c8a74e7-0d42-4a62-9601-37db83720f7f", + "hidden": false, + "isTransposed": false + }, + { + "columnId": "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "isTransposed": false + } + ], + "layerId": "0b8edcc7-e63e-471c-a19a-875842640bc0", + "layerType": "data", + "rowHeight": "auto" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "88c216cd-f675-4243-90a1-fd05521f0d17", + "w": 24, + "x": 24, + "y": 46 + }, + "panelIndex": "88c216cd-f675-4243-90a1-fd05521f0d17", + "title": "Top 10 Events with Impact Score [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "337c6ebc-8c54-45ad-bc04-b083782b66f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0b8edcc7-e63e-471c-a19a-875842640bc0": { + "columnOrder": [ + "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "9c8a74e7-0d42-4a62-9601-37db83720f7f" + ], + "columns": { + "0f13fd06-5d7f-49a6-9e34-700539b531f5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Finding Title", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Risk Score", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.risk_score" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.finding.title" + }, + "9c8a74e7-0d42-4a62-9601-37db83720f7f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Risk Score", + "operationType": "max", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "event.risk_score" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "337c6ebc-8c54-45ad-bc04-b083782b66f8", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c8a74e7-0d42-4a62-9601-37db83720f7f", + "hidden": false, + "isTransposed": false + }, + { + "columnId": "0f13fd06-5d7f-49a6-9e34-700539b531f5", + "isTransposed": false + } + ], + "layerId": "0b8edcc7-e63e-471c-a19a-875842640bc0", + "layerType": "data", + "rowHeight": "auto" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "45763df1-6737-4d5d-92fb-0658c0c1604d", + "w": 24, + "x": 0, + "y": 61 + }, + "panelIndex": "45763df1-6737-4d5d-92fb-0658c0c1604d", + "title": "Top 10 Events with Highest Risk Score [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a380a187-be4b-4aa2-9240-ebe38efee4a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c7b51d06-7002-4c01-889f-22b4cd8d34d8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a380a187-be4b-4aa2-9240-ebe38efee4a5": { + "columnOrder": [ + "3fd213b5-2550-41db-8249-acb0f7d50513", + "361ff57f-e19c-4758-8ae4-979ab68be335", + "431fbb35-8304-4803-b9fe-ad1a04335b93" + ], + "columns": { + "361ff57f-e19c-4758-8ae4-979ab68be335": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "3fd213b5-2550-41db-8249-acb0f7d50513": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "431fbb35-8304-4803-b9fe-ad1a04335b93", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.severity" + }, + "431fbb35-8304-4803-b9fe-ad1a04335b93": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c7b51d06-7002-4c01-889f-22b4cd8d34d8", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "431fbb35-8304-4803-b9fe-ad1a04335b93" + ], + "layerId": "a380a187-be4b-4aa2-9240-ebe38efee4a5", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "3fd213b5-2550-41db-8249-acb0f7d50513", + "xAccessor": "361ff57f-e19c-4758-8ae4-979ab68be335" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "086e7a53-619c-456e-ac59-46479173bb49", + "w": 24, + "x": 24, + "y": 61 + }, + "panelIndex": "086e7a53-619c-456e-ac59-46479173bb49", + "title": "Finding Velocity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "d116dfa1-b873-42f7-8a58-b4d789a9b6c0", + "w": 48, + "x": 0, + "y": 76 + }, + "panelIndex": "d116dfa1-b873-42f7-8a58-b4d789a9b6c0", + "panelRefName": "panel_d116dfa1-b873-42f7-8a58-b4d789a9b6c0", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] Findings", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "772e49a3-3da9-4d70-a2b4-922375ec283a:indexpattern-datasource-layer-1cc05391-c5a8-4a13-9ae4-bcffba57b040", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "772e49a3-3da9-4d70-a2b4-922375ec283a:0e8db665-7da4-405f-8076-08ae60909d36", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d578ef5-4712-46cd-8842-a90f12288a1d:indexpattern-datasource-layer-4cab14b9-ca69-44a2-b928-bbf788e859d4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d578ef5-4712-46cd-8842-a90f12288a1d:2f81d806-50ec-4aae-a5c5-1a96e22561bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3f93abe8-88a9-499c-bbf7-51cc6c456e36:indexpattern-datasource-layer-03e5b96c-3c7c-4bf5-98ba-ac874f18dced", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3f93abe8-88a9-499c-bbf7-51cc6c456e36:e20f26ba-9f98-4116-94fa-dbf5ed7c8739", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a0e7a0d-1249-496b-b456-72a0e57a9080:indexpattern-datasource-layer-7b40bda7-e96b-4f46-af23-82c8b35481e5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a0e7a0d-1249-496b-b456-72a0e57a9080:75fa021c-a616-4c39-8617-ef9350fc8a86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f335dc96-f388-4d5d-824f-8e14299f9dcc:indexpattern-datasource-layer-8d1be711-df84-4131-a3d0-2cbfac4ce2e8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f335dc96-f388-4d5d-824f-8e14299f9dcc:4f8df874-baea-4394-9200-3a264719221e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b51f48f2-8da0-455f-93dc-7aef69af3ca6:indexpattern-datasource-layer-00561990-40f2-4bd6-9f56-01dc3268bfbe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b51f48f2-8da0-455f-93dc-7aef69af3ca6:dcb866bc-4afa-4d14-9bb7-80b558e51559", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dfc70cec-b8c7-4263-a735-135278f215d8:indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dfc70cec-b8c7-4263-a735-135278f215d8:9042038b-e077-42e1-8eb2-7331495c85b4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88c216cd-f675-4243-90a1-fd05521f0d17:indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88c216cd-f675-4243-90a1-fd05521f0d17:3025cb0b-f49f-460c-8f69-a69072a5f112", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45763df1-6737-4d5d-92fb-0658c0c1604d:indexpattern-datasource-layer-0b8edcc7-e63e-471c-a19a-875842640bc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45763df1-6737-4d5d-92fb-0658c0c1604d:337c6ebc-8c54-45ad-bc04-b083782b66f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "086e7a53-619c-456e-ac59-46479173bb49:indexpattern-datasource-layer-a380a187-be4b-4aa2-9240-ebe38efee4a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "086e7a53-619c-456e-ac59-46479173bb49:c7b51d06-7002-4c01-889f-22b4cd8d34d8", + "type": "index-pattern" + }, + { + "id": "amazon_security_lake-93f1c2f0-262e-11ee-abb4-f9698f7e351e", + "name": "d116dfa1-b873-42f7-8a58-b4d789a9b6c0:panel_d116dfa1-b873-42f7-8a58-b4d789a9b6c0", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_a9902929-fb15-4000-a8f5-68d5e9589426:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_a8bbda91-8b1d-44a3-b504-842dfb9e77ed:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e62b5356-0c7e-4273-ba74-1a792810bdea:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_65ce75bf-9eab-49d7-9232-e44895885e97:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_dd9a9c7e-b17b-40aa-98b0-5275105b2c91:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_65c05770-1197-4f82-8a0b-577316a13f82:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_a4235b9e-98ae-4992-93eb-5e65aefd93d5:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_061d39e5-3fba-405c-a829-83a8adf60717:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3.json b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3.json new file mode 100644 index 00000000000..9d71c7d47a7 --- /dev/null +++ b/packages/amazon_security_lake/kibana/dashboard/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3.json @@ -0,0 +1,1495 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"bc4f37e3-7f39-4c78-89e5-00c3355c0a97\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"bc4f37e3-7f39-4c78-89e5-00c3355c0a97\",\"fieldName\":\"ocsf.severity\",\"title\":\"Severity\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"179b8bc1-c0bc-44be-a77c-ebfadc226dff\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"179b8bc1-c0bc-44be-a77c-ebfadc226dff\",\"fieldName\":\"ocsf.metadata.product.vendor_name\",\"title\":\"Vendor Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"65707c2f-975e-4c11-96b6-09026317154b\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"65707c2f-975e-4c11-96b6-09026317154b\",\"fieldName\":\"ocsf.class_name\",\"title\":\"Class Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"f94c69b8-73e1-44d1-a047-8d1764098ba4\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"f94c69b8-73e1-44d1-a047-8d1764098ba4\",\"fieldName\":\"ocsf.category_name\",\"title\":\"Category Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"b436c427-201d-4cbf-90d4-e9673cfff751\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"b436c427-201d-4cbf-90d4-e9673cfff751\",\"fieldName\":\"ocsf.activity_name\",\"title\":\"Activity Name\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"e0dfa34d-a3b8-49ca-a268-d14ad744d247\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e0dfa34d-a3b8-49ca-a268-d14ad744d247\",\"fieldName\":\"ocsf.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"small\",\"enhancements\":{}}},\"ab4227c9-7e6e-40be-9da0-44fc88056434\":{\"type\":\"optionsListControl\",\"order\":6,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ab4227c9-7e6e-40be-9da0-44fc88056434\",\"fieldName\":\"cloud.account.id\",\"title\":\"Cloud Account ID\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Overview of the Common logs collected by the Amazon Security Lake Integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Amazon Security Lake** \n\n**[Overview Dashboard](/app/dashboards#/view/amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3)** \n- [Findings](/app/dashboards#/view/amazon_security_lake-ed18e3a0-2565-11ee-be5c-17edc959116c) \n- [Identity \u0026 Access Management](/app/dashboards#/view/amazon_security_lake-41b73270-25fe-11ee-983a-17fb20a3b25d) \n- Network Activity\n - [Network Activity (4001)](/app/dashboards#/view/amazon_security_lake-1bbac7b0-2632-11ee-a94e-bfa24df19b15) \n - [DNS Activity (4003)](/app/dashboards#/view/amazon_security_lake-15b6e140-24a3-11ee-bb84-975fc16e8386) \n- [Application Activity](/app/dashboards#/view/amazon_security_lake-0d2d7a60-2472-11ee-8d80-89e82659e0f1)\n \n\n**Overview**\n\nThis dashboard shows an overview of the most common data collected from the Amazon Security Lake Integration.\n\nPlease visit the [Base Event](https://schema.ocsf.io/1.0.0-rc.3/base_event) documentation for more information.\n\n[**Integration Page**](/app/integrations/detail/amazon_security_lake/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 29, + "i": "9acdbabc-b3a8-47e3-b782-4fe29dce3841", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "9acdbabc-b3a8-47e3-b782-4fe29dce3841", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5f1e575-9bb5-4d72-be62-dbcddc036f2e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0fd35359-5773-43b7-9d2f-bb71ad7320d9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5f1e575-9bb5-4d72-be62-dbcddc036f2e": { + "columnOrder": [ + "a797d927-a6a1-4fae-bfcf-6157f0cc0613", + "96c905f6-8a2e-4952-9604-61620306f3ef" + ], + "columns": { + "96c905f6-8a2e-4952-9604-61620306f3ef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a797d927-a6a1-4fae-bfcf-6157f0cc0613": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "96c905f6-8a2e-4952-9604-61620306f3ef", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 6 + }, + "scale": "ordinal", + "sourceField": "ocsf.category_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0fd35359-5773-43b7-9d2f-bb71ad7320d9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "a797d927-a6a1-4fae-bfcf-6157f0cc0613", + "color": "#6092C0", + "layerId": "b5f1e575-9bb5-4d72-be62-dbcddc036f2e", + "layerType": "data", + "metricAccessor": "96c905f6-8a2e-4952-9604-61620306f3ef" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 14, + "i": "6d129c0e-ddf1-48df-b38a-bee772e29a0b", + "w": 38, + "x": 10, + "y": 0 + }, + "panelIndex": "6d129c0e-ddf1-48df-b38a-bee772e29a0b", + "title": "Categories Count[Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-04f0a6f8-2d59-4409-ba3c-f1b1814185e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a153c59a-bae3-4045-96d3-9265c8e4a648", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "04f0a6f8-2d59-4409-ba3c-f1b1814185e4": { + "columnOrder": [ + "7eaccd01-7b5e-4a7f-bf61-9fc877afe06a", + "0fff782a-739d-4a55-89fd-9e16ac51e40c" + ], + "columns": { + "0fff782a-739d-4a55-89fd-9e16ac51e40c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7eaccd01-7b5e-4a7f-bf61-9fc877afe06a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0fff782a-739d-4a55-89fd-9e16ac51e40c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.status" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a153c59a-bae3-4045-96d3-9265c8e4a648", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "04f0a6f8-2d59-4409-ba3c-f1b1814185e4", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "0fff782a-739d-4a55-89fd-9e16ac51e40c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7eaccd01-7b5e-4a7f-bf61-9fc877afe06a" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "efb10252-f73d-4f0d-ac12-55b3bf39eb87", + "w": 19, + "x": 10, + "y": 14 + }, + "panelIndex": "efb10252-f73d-4f0d-ac12-55b3bf39eb87", + "title": "Events by Status [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f065b90d-7ae8-4374-a54b-6785aa58a121", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7c57946-d81e-407a-b5f7-5102816358ca", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f065b90d-7ae8-4374-a54b-6785aa58a121": { + "columnOrder": [ + "db7af86c-8092-4292-8aea-b70d74d8dbcc", + "7e8c977f-0dc3-4a84-a9e7-40954d748abe" + ], + "columns": { + "7e8c977f-0dc3-4a84-a9e7-40954d748abe": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "db7af86c-8092-4292-8aea-b70d74d8dbcc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Region", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7e8c977f-0dc3-4a84-a9e7-40954d748abe", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.region" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f7c57946-d81e-407a-b5f7-5102816358ca", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "f065b90d-7ae8-4374-a54b-6785aa58a121", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "7e8c977f-0dc3-4a84-a9e7-40954d748abe" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "db7af86c-8092-4292-8aea-b70d74d8dbcc" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f6b60a1b-9416-4066-8037-5c31282c5c09", + "w": 19, + "x": 29, + "y": 14 + }, + "panelIndex": "f6b60a1b-9416-4066-8037-5c31282c5c09", + "title": "Events by Region [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f065b90d-7ae8-4374-a54b-6785aa58a121", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "333d085b-3a28-43ce-a5ed-ceafa5fdf8d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f065b90d-7ae8-4374-a54b-6785aa58a121": { + "columnOrder": [ + "db7af86c-8092-4292-8aea-b70d74d8dbcc", + "7e8c977f-0dc3-4a84-a9e7-40954d748abe" + ], + "columns": { + "7e8c977f-0dc3-4a84-a9e7-40954d748abe": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "db7af86c-8092-4292-8aea-b70d74d8dbcc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7e8c977f-0dc3-4a84-a9e7-40954d748abe", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "ocsf.severity" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "333d085b-3a28-43ce-a5ed-ceafa5fdf8d2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "f065b90d-7ae8-4374-a54b-6785aa58a121", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "7e8c977f-0dc3-4a84-a9e7-40954d748abe" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "db7af86c-8092-4292-8aea-b70d74d8dbcc" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "877cc6e8-0997-4702-9ce7-4e61b34e1afa", + "w": 24, + "x": 0, + "y": 29 + }, + "panelIndex": "877cc6e8-0997-4702-9ce7-4e61b34e1afa", + "title": "Events by Severity [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7a67e08-43b4-4787-923b-c30dc8121335", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d647d4c-4aee-4028-9af5-09b89aa5f5f1": { + "columnOrder": [ + "13cf2d87-bd9a-455d-8e36-77d27aa3023d", + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "columns": { + "13cf2d87-bd9a-455d-8e36-77d27aa3023d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vendor Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "370f6166-ad3a-4d17-8a58-bcddc0efc314", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.metadata.product.vendor_name" + }, + "370f6166-ad3a-4d17-8a58-bcddc0efc314": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b7a67e08-43b4-4787-923b-c30dc8121335", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "layerId": "0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "13cf2d87-bd9a-455d-8e36-77d27aa3023d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0835ddad-4601-411b-b5c1-1e838c0608c5", + "w": 24, + "x": 24, + "y": 29 + }, + "panelIndex": "0835ddad-4601-411b-b5c1-1e838c0608c5", + "title": "Events by Vendor Name [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33c483e8-7b7f-4e20-87cd-6e599a8fcbe9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d647d4c-4aee-4028-9af5-09b89aa5f5f1": { + "columnOrder": [ + "13cf2d87-bd9a-455d-8e36-77d27aa3023d", + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "columns": { + "13cf2d87-bd9a-455d-8e36-77d27aa3023d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Class Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "370f6166-ad3a-4d17-8a58-bcddc0efc314", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 33 + }, + "scale": "ordinal", + "sourceField": "ocsf.class_name" + }, + "370f6166-ad3a-4d17-8a58-bcddc0efc314": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "33c483e8-7b7f-4e20-87cd-6e599a8fcbe9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "layerId": "0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "13cf2d87-bd9a-455d-8e36-77d27aa3023d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3875494b-7f90-4064-896e-76ac9391edbc", + "w": 24, + "x": 0, + "y": 44 + }, + "panelIndex": "3875494b-7f90-4064-896e-76ac9391edbc", + "title": "Events by Class [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6b1180a-fa24-41ac-88ee-2f3d20d4ad89", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d647d4c-4aee-4028-9af5-09b89aa5f5f1": { + "columnOrder": [ + "13cf2d87-bd9a-455d-8e36-77d27aa3023d", + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "columns": { + "13cf2d87-bd9a-455d-8e36-77d27aa3023d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Product Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "370f6166-ad3a-4d17-8a58-bcddc0efc314", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "ocsf.metadata.product.name" + }, + "370f6166-ad3a-4d17-8a58-bcddc0efc314": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f6b1180a-fa24-41ac-88ee-2f3d20d4ad89", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "370f6166-ad3a-4d17-8a58-bcddc0efc314" + ], + "layerId": "0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "13cf2d87-bd9a-455d-8e36-77d27aa3023d" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "fd7315e0-aa9b-4ea6-a415-6547f732c14a", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "fd7315e0-aa9b-4ea6-a415-6547f732c14a", + "title": "Events by Product Name [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b7a523aa-06c7-4aa3-8848-3dc27db9afc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63d76fe7-4cd2-43cd-a69d-3d0fef0e3cde", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b7a523aa-06c7-4aa3-8848-3dc27db9afc6": { + "columnOrder": [ + "78eaa4ae-a5f4-4b9e-9b30-6c5fa16fedbf", + "b082e6e3-bd9e-4697-997d-c0b02016bf0e" + ], + "columns": { + "78eaa4ae-a5f4-4b9e-9b30-6c5fa16fedbf": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b082e6e3-bd9e-4697-997d-c0b02016bf0e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Severity", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "event.severity" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "63d76fe7-4cd2-43cd-a69d-3d0fef0e3cde", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b082e6e3-bd9e-4697-997d-c0b02016bf0e" + ], + "layerId": "b7a523aa-06c7-4aa3-8848-3dc27db9afc6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "78eaa4ae-a5f4-4b9e-9b30-6c5fa16fedbf" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "5a5c0ff1-5286-445e-b95d-6ca234e09614", + "w": 48, + "x": 0, + "y": 59 + }, + "panelIndex": "5a5c0ff1-5286-445e-b95d-6ca234e09614", + "title": "Severity over Time [Logs Amazon Security Lake]", + "type": "lens", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Amazon Security Lake] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-f21df8e0-249d-11ee-aa05-4dd9349682f3", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "6d129c0e-ddf1-48df-b38a-bee772e29a0b:indexpattern-datasource-layer-b5f1e575-9bb5-4d72-be62-dbcddc036f2e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6d129c0e-ddf1-48df-b38a-bee772e29a0b:0fd35359-5773-43b7-9d2f-bb71ad7320d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efb10252-f73d-4f0d-ac12-55b3bf39eb87:indexpattern-datasource-layer-04f0a6f8-2d59-4409-ba3c-f1b1814185e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efb10252-f73d-4f0d-ac12-55b3bf39eb87:a153c59a-bae3-4045-96d3-9265c8e4a648", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6b60a1b-9416-4066-8037-5c31282c5c09:indexpattern-datasource-layer-f065b90d-7ae8-4374-a54b-6785aa58a121", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6b60a1b-9416-4066-8037-5c31282c5c09:f7c57946-d81e-407a-b5f7-5102816358ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "877cc6e8-0997-4702-9ce7-4e61b34e1afa:indexpattern-datasource-layer-f065b90d-7ae8-4374-a54b-6785aa58a121", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "877cc6e8-0997-4702-9ce7-4e61b34e1afa:333d085b-3a28-43ce-a5ed-ceafa5fdf8d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0835ddad-4601-411b-b5c1-1e838c0608c5:indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0835ddad-4601-411b-b5c1-1e838c0608c5:b7a67e08-43b4-4787-923b-c30dc8121335", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3875494b-7f90-4064-896e-76ac9391edbc:indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3875494b-7f90-4064-896e-76ac9391edbc:33c483e8-7b7f-4e20-87cd-6e599a8fcbe9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7315e0-aa9b-4ea6-a415-6547f732c14a:indexpattern-datasource-layer-0d647d4c-4aee-4028-9af5-09b89aa5f5f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd7315e0-aa9b-4ea6-a415-6547f732c14a:f6b1180a-fa24-41ac-88ee-2f3d20d4ad89", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a5c0ff1-5286-445e-b95d-6ca234e09614:indexpattern-datasource-layer-b7a523aa-06c7-4aa3-8848-3dc27db9afc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a5c0ff1-5286-445e-b95d-6ca234e09614:63d76fe7-4cd2-43cd-a69d-3d0fef0e3cde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_bc4f37e3-7f39-4c78-89e5-00c3355c0a97:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_179b8bc1-c0bc-44be-a77c-ebfadc226dff:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_65707c2f-975e-4c11-96b6-09026317154b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f94c69b8-73e1-44d1-a047-8d1764098ba4:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_b436c427-201d-4cbf-90d4-e9673cfff751:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e0dfa34d-a3b8-49ca-a268-d14ad744d247:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ab4227c9-7e6e-40be-9da0-44fc88056434:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/search/amazon_security_lake-16a0aa00-26dd-11ee-a94e-bfa24df19b15.json b/packages/amazon_security_lake/kibana/search/amazon_security_lake-16a0aa00-26dd-11ee-a94e-bfa24df19b15.json new file mode 100644 index 00000000000..fb788c4177b --- /dev/null +++ b/packages/amazon_security_lake/kibana/search/amazon_security_lake-16a0aa00-26dd-11ee-a94e-bfa24df19b15.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "columns": [ + "ocsf.activity_name", + "cloud.account.id", + "source.ip", + "destination.ip", + "event.outcome", + "network.iana_number" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4001" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4001" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Network Activity Essential Details [Logs Amazon Security Lake]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-16a0aa00-26dd-11ee-a94e-bfa24df19b15", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "7.9.3" +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/search/amazon_security_lake-81902d50-2538-11ee-9f72-193490b86197.json b/packages/amazon_security_lake/kibana/search/amazon_security_lake-81902d50-2538-11ee-9f72-193490b86197.json new file mode 100644 index 00000000000..08fe38e3bbd --- /dev/null +++ b/packages/amazon_security_lake/kibana/search/amazon_security_lake-81902d50-2538-11ee-9f72-193490b86197.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "columns": [ + "ocsf.actor.user.account.uid", + "ocsf.api.service.name", + "ocsf.api.request.uid", + "ocsf.api.operation", + "ocsf.api.response.code", + "ocsf.api.response.message" + ], + "description": "", + "grid": { + "columns": { + "ocsf.actor.user.account.uid": { + "width": 193 + }, + "ocsf.api.operation": { + "width": 170 + }, + "ocsf.api.request.uid": { + "width": 154 + }, + "ocsf.api.response.code": { + "width": 169 + }, + "ocsf.api.response.message": { + "width": 195 + }, + "ocsf.api.service.name": { + "width": 169 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "6" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Application Activity Essential Details [Logs Amazon Security Lake]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-81902d50-2538-11ee-9f72-193490b86197", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "7.9.3" +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/search/amazon_security_lake-93f1c2f0-262e-11ee-abb4-f9698f7e351e.json b/packages/amazon_security_lake/kibana/search/amazon_security_lake-93f1c2f0-262e-11ee-abb4-f9698f7e351e.json new file mode 100644 index 00000000000..1fe76f5f387 --- /dev/null +++ b/packages/amazon_security_lake/kibana/search/amazon_security_lake-93f1c2f0-262e-11ee-abb4-f9698f7e351e.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "columns": [ + "ocsf.severity", + "ocsf.compliance.status", + "ocsf.state", + "ocsf.finding.title", + "ocsf.finding.types", + "ocsf.activity_name" + ], + "description": "", + "grid": { + "columns": { + "ocsf.compliance.status": { + "width": 170 + }, + "ocsf.severity": { + "width": 128 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "2" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "2" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Finding Essential Details [Logs Amazon Security Lake]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-93f1c2f0-262e-11ee-abb4-f9698f7e351e", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "7.9.3" +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/search/amazon_security_lake-ab4090f0-2618-11ee-983a-17fb20a3b25d.json b/packages/amazon_security_lake/kibana/search/amazon_security_lake-ab4090f0-2618-11ee-983a-17fb20a3b25d.json new file mode 100644 index 00000000000..0950bae299e --- /dev/null +++ b/packages/amazon_security_lake/kibana/search/amazon_security_lake-ab4090f0-2618-11ee-983a-17fb20a3b25d.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "columns": [ + "ocsf.class_name", + "user.name", + "ocsf.auth_protocol", + "ocsf.logon_type", + "ocsf.activity_name" + ], + "description": "", + "grid": { + "columns": { + "ocsf.activity_name": { + "width": 211 + }, + "ocsf.api.operation": { + "width": 155 + }, + "ocsf.auth_protocol": { + "width": 236 + }, + "ocsf.category_name": { + "width": 141 + }, + "ocsf.class_name": { + "width": 187 + }, + "ocsf.logon_type": { + "width": 261 + }, + "user.name": { + "width": 163 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.category_uid", + "index": "logs-*", + "key": "ocsf.category_uid", + "negate": false, + "params": { + "query": "3" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.category_uid": "3" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Identity \u0026 Access Management Essential Details [Logs Amazon Security Lake]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-ab4090f0-2618-11ee-983a-17fb20a3b25d", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "7.9.3" +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/search/amazon_security_lake-c2472e60-262e-11ee-a94e-bfa24df19b15.json b/packages/amazon_security_lake/kibana/search/amazon_security_lake-c2472e60-262e-11ee-a94e-bfa24df19b15.json new file mode 100644 index 00000000000..21ea09655ba --- /dev/null +++ b/packages/amazon_security_lake/kibana/search/amazon_security_lake-c2472e60-262e-11ee-a94e-bfa24df19b15.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "columns": [ + "ocsf.activity_name", + "dns.question.name", + "message", + "dns.response_code", + "event.outcome" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "amazon_security_lake.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "amazon_security_lake.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "ocsf.class_uid", + "index": "logs-*", + "key": "ocsf.class_uid", + "negate": false, + "params": { + "query": "4003" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "ocsf.class_uid": "4003" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "DNS Activity Essential Details [Logs Amazon Security Lake]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-25T11:49:14.212Z", + "id": "amazon_security_lake-c2472e60-262e-11ee-a94e-bfa24df19b15", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "7.9.3" +} \ No newline at end of file diff --git a/packages/amazon_security_lake/kibana/tags.yml b/packages/amazon_security_lake/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/amazon_security_lake/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/amazon_security_lake/manifest.yml b/packages/amazon_security_lake/manifest.yml new file mode 100644 index 00000000000..9a2e8217c18 --- /dev/null +++ b/packages/amazon_security_lake/manifest.yml @@ -0,0 +1,53 @@ +format_version: "3.0.0" +name: amazon_security_lake +title: Amazon Security Lake +version: "0.4.0" +description: Collect logs from Amazon Security Lake with Elastic Agent. +type: integration +categories: ["aws", "security"] +conditions: + kibana: + version: ^8.11.0 + elastic: + subscription: basic +screenshots: + - src: /img/amazon-security-lake-overview-dashboard.png + title: Amazon Security Lake Overview Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/amazon-security-lake-findings-dashboard.png + title: Amazon Security Lake Findings Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/amazon-security-lake-identity-and-access-management-dashboard.png + title: Amazon Security Lake Identity And Access Management Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/amazon-security-lake-network-activity-dashboard.png + title: Amazon Security Lake Network Activity Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/amazon-security-lake-dns-activity-dashboard.png + title: Amazon Security Lake DNS Activity Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/amazon-security-lake-application-activity-dashboard.png + title: Amazon Security Lake Application Activity Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/amazon-security-lake-logo.svg + title: Amazon Security Lake Logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: amazon_security_lake + title: Amazon Security Lake logs + description: Collect logs from Amazon Security Lake instances. + inputs: + - type: aws-s3 + title: Collect Amazon Security Lake logs via AWS S3 or AWS SQS + description: Collecting logs from Amazon Security Lake via AWS S3 or AWS SQS. +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/apache/changelog.yml b/packages/apache/changelog.yml index bbb53b87efc..0c9405edc13 100644 --- a/packages/apache/changelog.yml +++ b/packages/apache/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.15.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.15.0" + changes: + - description: Add ability to set condition for logs and metrics. + type: enhancement + link: https://github.com/elastic/integrations/pull/7372 - version: "1.14.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/apache/data_stream/access/agent/stream/log.yml.hbs b/packages/apache/data_stream/access/agent/stream/log.yml.hbs index c6e5ed4c737..de5eea39419 100644 --- a/packages/apache/data_stream/access/agent/stream/log.yml.hbs +++ b/packages/apache/data_stream/access/agent/stream/log.yml.hbs @@ -16,4 +16,7 @@ exclude_files: [".gz$"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 574d5cbdbff..556390d4a14 100644 --- a/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -13,6 +13,8 @@ processors: - rename: field: message target_field: event.original + ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/apache/data_stream/error/agent/stream/log.yml.hbs b/packages/apache/data_stream/error/agent/stream/log.yml.hbs index 781c90981a4..38b2da9e4d2 100644 --- a/packages/apache/data_stream/error/agent/stream/log.yml.hbs +++ b/packages/apache/data_stream/error/agent/stream/log.yml.hbs @@ -17,4 +17,7 @@ processors: - add_locale: ~ {{#if processors}} {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/apache/data_stream/status/agent/stream/stream.yml.hbs b/packages/apache/data_stream/status/agent/stream/stream.yml.hbs index 9c7975244ba..0ec9932f4f9 100644 --- a/packages/apache/data_stream/status/agent/stream/stream.yml.hbs +++ b/packages/apache/data_stream/status/agent/stream/stream.yml.hbs @@ -7,3 +7,6 @@ period: {{period}} {{#if server_status_path}} server_status_path: {{server_status_path}} {{/if}} +{{#if condition}} +condition: {{ condition }} +{{/if}} \ No newline at end of file diff --git a/packages/apache/manifest.yml b/packages/apache/manifest.yml index c06d14aec76..d399ce20c8f 100644 --- a/packages/apache/manifest.yml +++ b/packages/apache/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: apache title: Apache HTTP Server -version: "1.14.0" +version: "1.15.1" license: basic source: license: Elastic-2.0 @@ -36,6 +36,14 @@ policy_templates: - type: logfile title: Collect logs from Apache instances description: Collecting Apache access and error logs + vars: + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false - type: httpjson title: Collect logs from third-party REST API (experimental) description: Collect logs from third-party REST API (experimental) @@ -107,5 +115,12 @@ policy_templates: show_user: true default: - http://127.0.0.1 + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false owner: github: elastic/obs-infraobs-integrations diff --git a/packages/apache_spark/_dev/build/docs/README.md b/packages/apache_spark/_dev/build/docs/README.md index fe027d37b1e..32b8147a622 100644 --- a/packages/apache_spark/_dev/build/docs/README.md +++ b/packages/apache_spark/_dev/build/docs/README.md @@ -63,6 +63,10 @@ Restart Spark master. Follow the same set of steps for Spark Worker, Driver and Executor. +### Troubleshooting + +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Application``, ``Driver``, ``Executor`` and ``Node`` data stream's indices. + ## Metrics ### Application diff --git a/packages/apache_spark/changelog.yml b/packages/apache_spark/changelog.yml index 5155c3d6367..9529381cc10 100644 --- a/packages/apache_spark/changelog.yml +++ b/packages/apache_spark/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "0.6.3" + changes: + - description: Update Apache Spark logo. + type: enhancement + link: https://github.com/elastic/integrations/pull/7830 +- version: "0.6.2" + changes: + - description: Resolve the conflicts in host.ip field + type: bugfix + link: https://github.com/elastic/integrations/pull/7468 +- version: "0.6.1" + changes: + - description: Remove incorrect filter from the visualizations + type: bugfix + link: https://github.com/elastic/integrations/pull/7467 - version: "0.6.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/apache_spark/data_stream/application/fields/ecs.yml b/packages/apache_spark/data_stream/application/fields/ecs.yml index ded177ab1a7..280e296f9e9 100644 --- a/packages/apache_spark/data_stream/application/fields/ecs.yml +++ b/packages/apache_spark/data_stream/application/fields/ecs.yml @@ -1,12 +1,20 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.dataset - external: ecs name: event.kind - external: ecs - name: event.type + name: event.module - external: ecs - name: ecs.version + name: event.type - external: ecs - name: tags + name: host.ip - external: ecs name: service.address - external: ecs name: service.type +- external: ecs + name: tags diff --git a/packages/apache_spark/data_stream/driver/fields/ecs.yml b/packages/apache_spark/data_stream/driver/fields/ecs.yml index ded177ab1a7..280e296f9e9 100644 --- a/packages/apache_spark/data_stream/driver/fields/ecs.yml +++ b/packages/apache_spark/data_stream/driver/fields/ecs.yml @@ -1,12 +1,20 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.dataset - external: ecs name: event.kind - external: ecs - name: event.type + name: event.module - external: ecs - name: ecs.version + name: event.type - external: ecs - name: tags + name: host.ip - external: ecs name: service.address - external: ecs name: service.type +- external: ecs + name: tags diff --git a/packages/apache_spark/data_stream/executor/fields/ecs.yml b/packages/apache_spark/data_stream/executor/fields/ecs.yml index ded177ab1a7..280e296f9e9 100644 --- a/packages/apache_spark/data_stream/executor/fields/ecs.yml +++ b/packages/apache_spark/data_stream/executor/fields/ecs.yml @@ -1,12 +1,20 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.dataset - external: ecs name: event.kind - external: ecs - name: event.type + name: event.module - external: ecs - name: ecs.version + name: event.type - external: ecs - name: tags + name: host.ip - external: ecs name: service.address - external: ecs name: service.type +- external: ecs + name: tags diff --git a/packages/apache_spark/data_stream/node/fields/ecs.yml b/packages/apache_spark/data_stream/node/fields/ecs.yml index ded177ab1a7..280e296f9e9 100644 --- a/packages/apache_spark/data_stream/node/fields/ecs.yml +++ b/packages/apache_spark/data_stream/node/fields/ecs.yml @@ -1,12 +1,20 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.dataset - external: ecs name: event.kind - external: ecs - name: event.type + name: event.module - external: ecs - name: ecs.version + name: event.type - external: ecs - name: tags + name: host.ip - external: ecs name: service.address - external: ecs name: service.type +- external: ecs + name: tags diff --git a/packages/apache_spark/docs/README.md b/packages/apache_spark/docs/README.md index 35b69abb1de..4dd6d17c2e4 100644 --- a/packages/apache_spark/docs/README.md +++ b/packages/apache_spark/docs/README.md @@ -63,6 +63,10 @@ Restart Spark master. Follow the same set of steps for Spark Worker, Driver and Executor. +### Troubleshooting + +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Application``, ``Driver``, ``Executor`` and ``Node`` data stream's indices. + ## Metrics ### Application @@ -156,8 +160,12 @@ An example event for `application` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.ip | Host ip addresses. | ip | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | tags | List of keywords used to tag each event. | keyword | @@ -325,8 +333,12 @@ An example event for `driver` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.ip | Host ip addresses. | ip | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | tags | List of keywords used to tag each event. | keyword | @@ -491,8 +503,12 @@ An example event for `executor` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.ip | Host ip addresses. | ip | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | tags | List of keywords used to tag each event. | keyword | @@ -600,8 +616,12 @@ An example event for `node` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.ip | Host ip addresses. | ip | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | tags | List of keywords used to tag each event. | keyword | diff --git a/packages/apache_spark/img/apache_spark-logo.svg b/packages/apache_spark/img/apache_spark-logo.svg index b70fe9f2238..5f7f6f460cd 100644 --- a/packages/apache_spark/img/apache_spark-logo.svg +++ b/packages/apache_spark/img/apache_spark-logo.svg @@ -1,123 +1 @@ - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/packages/apache_spark/kibana/dashboard/apache_spark-b22dc960-a06c-11ec-8d4f-4fe3367a4156.json b/packages/apache_spark/kibana/dashboard/apache_spark-b22dc960-a06c-11ec-8d4f-4fe3367a4156.json index f440b9f3a39..197c1863e79 100644 --- a/packages/apache_spark/kibana/dashboard/apache_spark-b22dc960-a06c-11ec-8d4f-4fe3367a4156.json +++ b/packages/apache_spark/kibana/dashboard/apache_spark-b22dc960-a06c-11ec-8d4f-4fe3367a4156.json @@ -597,12 +597,7 @@ }, { "id": "metrics-*", - "name": "dc8a3118-0580-4875-a323-3e5a8e12e731", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "74dfc7a8-6d13-4ca1-92dd-3ecd9dfc5a41", + "name": "cd121fe6-bb0a-4217-b691-dd52c2100256", "type": "index-pattern" } ], @@ -671,7 +666,7 @@ "meta": { "alias": null, "disabled": false, - "index": "dc8a3118-0580-4875-a323-3e5a8e12e731", + "index": "cd121fe6-bb0a-4217-b691-dd52c2100256", "key": "event.dataset", "negate": false, "params": { @@ -684,25 +679,6 @@ "event.dataset": "apache_spark.driver" } } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "74dfc7a8-6d13-4ca1-92dd-3ecd9dfc5a41", - "key": "apache_spark.driver.tasks.completed", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "apache_spark.driver.tasks.completed" - } - } } ], "query": { @@ -1181,12 +1157,7 @@ }, { "id": "metrics-*", - "name": "5db88011-6682-4806-b1f1-f0d738dd193b", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "9c84d414-1f94-4ad0-ac80-fa876871f52e", + "name": "c5b4b675-16d1-4ea2-8bdf-6645d970eed2", "type": "index-pattern" } ], @@ -1255,7 +1226,7 @@ "meta": { "alias": null, "disabled": false, - "index": "5db88011-6682-4806-b1f1-f0d738dd193b", + "index": "c5b4b675-16d1-4ea2-8bdf-6645d970eed2", "key": "event.dataset", "negate": false, "params": { @@ -1268,25 +1239,6 @@ "event.dataset": "apache_spark.executor" } } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "9c84d414-1f94-4ad0-ac80-fa876871f52e", - "key": "apache_spark.executor.threadpool.complete_tasks", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "apache_spark.executor.threadpool.complete_tasks" - } - } } ], "query": { @@ -1545,12 +1497,12 @@ }, { "id": "metrics-*", - "name": "e5897d1f-1cbe-4c21-8839-2febca793277", + "name": "b972e024-53b4-4a9f-8b87-25082e082b47", "type": "index-pattern" }, { "id": "metrics-*", - "name": "121f59c6-c392-4e47-9cad-3ca03bdc50b1", + "name": "975ed76d-8b6a-4f8d-9dc8-bc4e74001665", "type": "index-pattern" } ], @@ -1568,7 +1520,10 @@ "dataType": "number", "isBucketed": false, "label": "Records Read", - "operationType": "max", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "apache_spark.executor.records.read" } @@ -1586,7 +1541,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e5897d1f-1cbe-4c21-8839-2febca793277", + "index": "b972e024-53b4-4a9f-8b87-25082e082b47", "key": "event.dataset", "negate": false, "params": { @@ -1607,7 +1562,7 @@ "meta": { "alias": null, "disabled": false, - "index": "121f59c6-c392-4e47-9cad-3ca03bdc50b1", + "index": "975ed76d-8b6a-4f8d-9dc8-bc4e74001665", "key": "apache_spark.executor.records.read", "negate": false, "type": "exists", @@ -1665,12 +1620,12 @@ }, { "id": "metrics-*", - "name": "76c995fa-3bfc-41c5-8b5d-91d5414c75df", + "name": "cffd3ad8-723b-4694-bf3e-9d8a826ce05e", "type": "index-pattern" }, { "id": "metrics-*", - "name": "bbb8e53b-72ff-4438-b4ae-c13c943a4887", + "name": "a3034e1f-cb79-4ef6-91f1-ff8b1f2510c8", "type": "index-pattern" } ], @@ -1688,7 +1643,10 @@ "dataType": "number", "isBucketed": false, "label": "Records Written", - "operationType": "max", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "apache_spark.executor.records.written" } @@ -1706,7 +1664,7 @@ "meta": { "alias": null, "disabled": false, - "index": "76c995fa-3bfc-41c5-8b5d-91d5414c75df", + "index": "cffd3ad8-723b-4694-bf3e-9d8a826ce05e", "key": "event.dataset", "negate": false, "params": { @@ -1727,7 +1685,7 @@ "meta": { "alias": null, "disabled": false, - "index": "bbb8e53b-72ff-4438-b4ae-c13c943a4887", + "index": "a3034e1f-cb79-4ef6-91f1-ff8b1f2510c8", "key": "apache_spark.executor.records.written", "negate": false, "type": "exists", @@ -2173,7 +2131,7 @@ }, { "id": "metrics-*", - "name": "3c4d7129-299a-435c-ac1d-8c7088a33ef8", + "name": "c5d1d4ff-3497-4067-96b3-8dedc2f58de8", "type": "index-pattern" } ], @@ -2191,7 +2149,10 @@ "dataType": "number", "isBucketed": false, "label": "Number of Cores Used", - "operationType": "max", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "apache_spark.node.worker.cores.used" } @@ -2209,7 +2170,7 @@ "meta": { "alias": null, "disabled": false, - "index": "3c4d7129-299a-435c-ac1d-8c7088a33ef8", + "index": "c5d1d4ff-3497-4067-96b3-8dedc2f58de8", "key": "event.dataset", "negate": false, "params": { @@ -2270,7 +2231,7 @@ }, { "id": "metrics-*", - "name": "f8d47e84-2b01-4c09-b2b2-4a1d2d4c6e5f", + "name": "c413b9be-9a11-47d9-8d15-8059ff9a02ad", "type": "index-pattern" } ], @@ -2288,7 +2249,10 @@ "dataType": "number", "isBucketed": false, "label": "Memory Used (MB)", - "operationType": "max", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "apache_spark.node.worker.memory.used" } @@ -2306,7 +2270,7 @@ "meta": { "alias": null, "disabled": false, - "index": "f8d47e84-2b01-4c09-b2b2-4a1d2d4c6e5f", + "index": "c413b9be-9a11-47d9-8d15-8059ff9a02ad", "key": "event.dataset", "negate": false, "params": { @@ -2581,12 +2545,7 @@ }, { "id": "metrics-*", - "name": "f84a1cd9-1b4b-484e-87f7-953c2f645570:dc8a3118-0580-4875-a323-3e5a8e12e731", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "f84a1cd9-1b4b-484e-87f7-953c2f645570:74dfc7a8-6d13-4ca1-92dd-3ecd9dfc5a41", + "name": "f84a1cd9-1b4b-484e-87f7-953c2f645570:cd121fe6-bb0a-4217-b691-dd52c2100256", "type": "index-pattern" }, { @@ -2661,12 +2620,7 @@ }, { "id": "metrics-*", - "name": "b5caa5d1-221e-400d-a11a-ea539f1f4546:5db88011-6682-4806-b1f1-f0d738dd193b", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "b5caa5d1-221e-400d-a11a-ea539f1f4546:9c84d414-1f94-4ad0-ac80-fa876871f52e", + "name": "b5caa5d1-221e-400d-a11a-ea539f1f4546:c5b4b675-16d1-4ea2-8bdf-6645d970eed2", "type": "index-pattern" }, { @@ -2711,12 +2665,12 @@ }, { "id": "metrics-*", - "name": "75c23769-a2bd-4825-b20a-d140aeb36175:e5897d1f-1cbe-4c21-8839-2febca793277", + "name": "75c23769-a2bd-4825-b20a-d140aeb36175:b972e024-53b4-4a9f-8b87-25082e082b47", "type": "index-pattern" }, { "id": "metrics-*", - "name": "75c23769-a2bd-4825-b20a-d140aeb36175:121f59c6-c392-4e47-9cad-3ca03bdc50b1", + "name": "75c23769-a2bd-4825-b20a-d140aeb36175:975ed76d-8b6a-4f8d-9dc8-bc4e74001665", "type": "index-pattern" }, { @@ -2731,12 +2685,12 @@ }, { "id": "metrics-*", - "name": "ab9316b5-5728-4b03-aadb-a93e22da9257:76c995fa-3bfc-41c5-8b5d-91d5414c75df", + "name": "ab9316b5-5728-4b03-aadb-a93e22da9257:cffd3ad8-723b-4694-bf3e-9d8a826ce05e", "type": "index-pattern" }, { "id": "metrics-*", - "name": "ab9316b5-5728-4b03-aadb-a93e22da9257:bbb8e53b-72ff-4438-b4ae-c13c943a4887", + "name": "ab9316b5-5728-4b03-aadb-a93e22da9257:a3034e1f-cb79-4ef6-91f1-ff8b1f2510c8", "type": "index-pattern" }, { @@ -2806,7 +2760,7 @@ }, { "id": "metrics-*", - "name": "fa3bca1d-df9c-4e2b-8785-cfe9211a7843:3c4d7129-299a-435c-ac1d-8c7088a33ef8", + "name": "fa3bca1d-df9c-4e2b-8785-cfe9211a7843:c5d1d4ff-3497-4067-96b3-8dedc2f58de8", "type": "index-pattern" }, { @@ -2821,7 +2775,7 @@ }, { "id": "metrics-*", - "name": "18c0d3d3-912f-42e4-a322-a5fcaa9002b0:f8d47e84-2b01-4c09-b2b2-4a1d2d4c6e5f", + "name": "18c0d3d3-912f-42e4-a322-a5fcaa9002b0:c413b9be-9a11-47d9-8d15-8059ff9a02ad", "type": "index-pattern" }, { diff --git a/packages/apache_spark/kibana/lens/apache_spark-114428e0-c165-11ec-97dc-abb2b7efe8a8.json b/packages/apache_spark/kibana/lens/apache_spark-114428e0-c165-11ec-97dc-abb2b7efe8a8.json index 1c44a23c8de..dae40f1aa87 100644 --- a/packages/apache_spark/kibana/lens/apache_spark-114428e0-c165-11ec-97dc-abb2b7efe8a8.json +++ b/packages/apache_spark/kibana/lens/apache_spark-114428e0-c165-11ec-97dc-abb2b7efe8a8.json @@ -19,14 +19,15 @@ }, "isBucketed": false, "label": "Bytes Read", - "operationType": "max", + "operationType": "last_value", "params": { "format": { "id": "bytes", "params": { "decimals": 2 } - } + }, + "sortField": "@timestamp" }, "scale": "ratio", "sourceField": "apache_spark.executor.bytes.read" diff --git a/packages/apache_spark/kibana/lens/apache_spark-478726a0-c165-11ec-97dc-abb2b7efe8a8.json b/packages/apache_spark/kibana/lens/apache_spark-478726a0-c165-11ec-97dc-abb2b7efe8a8.json index d82c7b90980..9171bc4c9c5 100644 --- a/packages/apache_spark/kibana/lens/apache_spark-478726a0-c165-11ec-97dc-abb2b7efe8a8.json +++ b/packages/apache_spark/kibana/lens/apache_spark-478726a0-c165-11ec-97dc-abb2b7efe8a8.json @@ -19,14 +19,15 @@ }, "isBucketed": false, "label": "Bytes Written", - "operationType": "max", + "operationType": "last_value", "params": { "format": { "id": "bytes", "params": { "decimals": 2 } - } + }, + "sortField": "@timestamp" }, "scale": "ratio", "sourceField": "apache_spark.executor.bytes.written" diff --git a/packages/apache_spark/manifest.yml b/packages/apache_spark/manifest.yml index 9403f579ac2..65dd3121cc2 100644 --- a/packages/apache_spark/manifest.yml +++ b/packages/apache_spark/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: apache_spark title: Apache Spark -version: "0.6.0" +version: "0.6.3" license: basic description: Collect metrics from Apache Spark with Elastic Agent. type: integration diff --git a/packages/apache_tomcat/_dev/build/docs/README.md b/packages/apache_tomcat/_dev/build/docs/README.md index b4833abc80d..9b0933ee5a3 100644 --- a/packages/apache_tomcat/_dev/build/docs/README.md +++ b/packages/apache_tomcat/_dev/build/docs/README.md @@ -6,7 +6,7 @@ Use the Apache Tomcat integration to: -- Collect metrics related to the cache and request and collect logs related to access, catalina, and localhost. +- Collect metrics related to the cache, connection pool, memory, request, session and thread pool and collect logs related to access, catalina, and localhost. - Create visualizations to monitor, measure and analyze the usage trend and key data, and derive business insights. - Create alerts to reduce the MTTD and also the MTTR by referencing relevant logs when troubleshooting an issue. @@ -16,14 +16,18 @@ The Apache Tomcat integration collects logs and metrics data. Logs help you keep a record of events that happen on your machine. The `Log` data streams collected by Apache Tomcat integration are `access`, `catalina`, and `localhost`, so that users can keep track of the IP addresses of the clients, bytes returned to the client or sent by clients, etc., so that users could monitor and troubleshoot the performance of Java applications. -Metrics give you insight into the statistics of the Apache Tomcat. The `Metric` data streams collected by the Apache Tomcat integration are `cache` and `request`, so that the user can monitor and troubleshoot the performance of the Apache Tomcat instance. +Metrics give you insight into the statistics of the Apache Tomcat. The `Metric` data streams collected by the Apache Tomcat integration are `cache`, `connection pool`, `memory`, `request`, `session` and `thread pool`, so that the user can monitor and troubleshoot the performance of the Apache Tomcat instance. Data streams: - `access`: Collects information related to overall performance of Java applications. +- `cache`: Collects information related to the overall cache of the Apache Tomcat instance. - `catalina`: Collects information related to the startup and shutdown of the Apache Tomcat application server, the deployment of new applications, or the failure of one or more subsystems. +- `connection pool`: Collects information related to connection pool such as number of active and idle connections. - `localhost`: Collects information related to Web application activity which is related to HTTP transactions between the application server and the client. -- `cache`: Collects information related to the overall cache of the Apache Tomcat instance. +- `memory`: Collects information related to heap memory, non-heap memory and garbage collection of the Tomcat instance. - `request`: Collects information related to requests of the Apache Tomcat instance. +- `thread pool`: Collects information related to the overall states of the threads, CPU time and processing termination time of the threads in the Tomcat instance. +- `session`: Collects information related to overall created, active and expired sessions of the Tomcat instance. Note: - Users can monitor and see the log inside the ingested documents for Apache Tomcat in the `logs-*` index pattern from `Discover`, and for metrics, the index pattern is `metrics-*`. @@ -48,14 +52,14 @@ For step-by-step instructions on how to set up an integration, see the [Getting Here are the steps to configure Prometheus in Apache Tomcat instance: -1. Go to `/webapps` from Apache Tomcat instance. +1. Go to `/webapps` from Apache Tomcat instance. 2. Please find latest [Prometheus version](https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/), replace in below command and perform from Apache Tomcat instance: - ``` wget https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent//jmx_prometheus_javaagent-.jar ``` -3. Create `config.yml` file in `/webapps` and paste the following content in `config.yml` file: - +3. Create `config.yml` file in `/webapps` and paste the following content in `config.yml` file: - ``` rules: @@ -64,7 +68,7 @@ rules: 4. Go to `/etc/systemd/system` and add the following content in `tomcat.service` file: - ``` -Environment='JAVA_OPTS=-javaagent:/webapps/jmx_prometheus_javaagent-.jar=:/opt/tomcat/webapps/config.yml' +Environment='JAVA_OPTS=-javaagent:/webapps/jmx_prometheus_javaagent-.jar=:/opt/tomcat/webapps/config.yml' ``` 5. Run the following commands to reload demon and restart Apache Tomcat instance: - @@ -78,7 +82,7 @@ systemctl restart tomcat Here are the steps to configure Log format in Apache Tomcat instance: -1. Go to `/conf/server.xml` from Apache Tomcat instance. +1. Go to `/conf/server.xml` from Apache Tomcat instance. 2. The user can update the log format in the pattern field of the class `org.apache.catalina.valves.AccessLogValve`. Here is an example of the `org.apache.catalina.valves.AccessLogValve` class. @@ -101,6 +105,18 @@ Combined Log Format + X-Forwarded-For header :- '%h %l %u %t "%r" %s %b %A %X %T systemctl restart tomcat ``` +## Supported log formats for Catalina and Localhost logs: + +- With error stack trace: +``` +dd-MMM-yyyy HH:mm:ss.SSS [Severity] [Subsystem] [Message Text] [Error Stack Trace] +``` + +- Without error stack trace: +``` +dd-MMM-yyyy HH:mm:ss.SSS [Severity] [Subsystem] [Message Text] +``` + Note: - Restarting Apache Tomcat does not affect the virtual desktops that are currently running. It will only prevent new users from logging in for the duration of the restart process (typically several seconds). @@ -165,10 +181,42 @@ This is the `Cache` data stream. This data stream collects metrics related to th {{fields "cache"}} +### Connection Pool + +This is the `connection pool` data stream. This data stream collects metrics related to connection pool such as number of active and idle connections. + +{{event "connection_pool"}} + +{{fields "connection_pool"}} + +### Memory + +This is the `memory` data stream. This data stream collects metrics related to the heap memory, non-heap memory, garbage collection time and count. + +{{event "memory"}} + +{{fields "memory"}} + ### Request This is the `Request` data stream. This data stream collects metrics related to request count, and amount of data received and sent. {{event "request"}} -{{fields "request"}} \ No newline at end of file +{{fields "request"}} + +### Session + +This is the `session` data stream. This data stream collects metrics related to created, active, expired and rejected sessions, alive and processing time for sessions. + +{{event "session"}} + +{{fields "session"}} + +### Thread Pool + +This is the `thread pool` data stream. This data stream collects metrics related to the total, active, current, daemon, busy and peak threads, CPU time and processing termination time of the threads. + +{{event "thread_pool"}} + +{{fields "thread_pool"}} diff --git a/packages/apache_tomcat/_dev/deploy/docker/configs/context.xml b/packages/apache_tomcat/_dev/deploy/docker/configs/context.xml new file mode 100644 index 00000000000..8babf2395e2 --- /dev/null +++ b/packages/apache_tomcat/_dev/deploy/docker/configs/context.xml @@ -0,0 +1,22 @@ + + + WEB-INF/web.xml + WEB-INF/tomcat-web.xml + ${catalina.base}/conf/web.xml + + + diff --git a/packages/apache_tomcat/_dev/deploy/docker/docker-compose.yml b/packages/apache_tomcat/_dev/deploy/docker/docker-compose.yml index 442b6587f14..ca1e60a414f 100644 --- a/packages/apache_tomcat/_dev/deploy/docker/docker-compose.yml +++ b/packages/apache_tomcat/_dev/deploy/docker/docker-compose.yml @@ -7,6 +7,7 @@ services: volumes: - ./setup/:/usr/local/tomcat/webapps/:rw - ${SERVICE_LOGS_DIR}:/usr/local/tomcat/logs + - ./configs/context.xml:/usr/local/tomcat/conf/context.xml healthcheck: test: ["CMD", "curl", "-f", "http://localhost:8080"] interval: 30s diff --git a/packages/apache_tomcat/changelog.yml b/packages/apache_tomcat/changelog.yml index 26004d121a6..2ea70c4f228 100644 --- a/packages/apache_tomcat/changelog.yml +++ b/packages/apache_tomcat/changelog.yml @@ -1,4 +1,49 @@ # newer versions go on top +- version: "0.12.3" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "0.12.2" + changes: + - description: Remove forwarded tag from metrics data streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/7824 +- version: "0.12.1" + changes: + - description: Add supported log formats for Catalina and Localhost logs in README. + type: enhancement + link: https://github.com/elastic/integrations/pull/7099 +- version: "0.12.0" + changes: + - description: Add overview dashboards for logs and metrics. + type: enhancement + link: https://github.com/elastic/integrations/pull/6982 +- version: "0.11.0" + changes: + - description: Apache Tomcat integration package with "connection_pool" data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6596 +- version: "0.10.0" + changes: + - description: Apache Tomcat integration package with "thread_pool" data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6609 +- version: "0.9.0" + changes: + - description: Apache Tomcat integration package with "memory" data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6527 +- version: "0.8.0" + changes: + - description: Update the processor description link. + type: enhancement + link: https://github.com/elastic/integrations/pull/6891 +- version: "0.7.0" + changes: + - description: Apache Tomcat integration package with "session" data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6573 - version: "0.6.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/apache_tomcat/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 8c658a5bdbc..cc55c87ff41 100644 --- a/packages/apache_tomcat/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/apache_tomcat/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original tag: 'grok_parse_log' diff --git a/packages/apache_tomcat/data_stream/access/manifest.yml b/packages/apache_tomcat/data_stream/access/manifest.yml index 1b589c94ae5..2670a5d0aa7 100644 --- a/packages/apache_tomcat/data_stream/access/manifest.yml +++ b/packages/apache_tomcat/data_stream/access/manifest.yml @@ -35,7 +35,7 @@ streams: multi: false required: false show_user: false - description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: filestream.yml.hbs title: Apache Tomcat Access logs description: Collect Apache Tomcat Access logs. diff --git a/packages/apache_tomcat/data_stream/cache/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/cache/agent/stream/stream.yml.hbs index 304de45e30c..67aaa7d5002 100644 --- a/packages/apache_tomcat/data_stream/cache/agent/stream/stream.yml.hbs +++ b/packages/apache_tomcat/data_stream/cache/agent/stream/stream.yml.hbs @@ -19,9 +19,6 @@ tags: {{#each tags as |tag|}} - {{tag}} {{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} {{#if processors}} processors: {{processors}} diff --git a/packages/apache_tomcat/data_stream/cache/manifest.yml b/packages/apache_tomcat/data_stream/cache/manifest.yml index daafc421825..2ff0625d09c 100644 --- a/packages/apache_tomcat/data_stream/cache/manifest.yml +++ b/packages/apache_tomcat/data_stream/cache/manifest.yml @@ -17,7 +17,6 @@ streams: required: true show_user: false default: - - forwarded - apache_tomcat-cache - name: processors type: yaml @@ -25,7 +24,7 @@ streams: multi: false required: false show_user: false - description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: stream.yml.hbs title: Apache Tomcat Cache metrics description: Collect Apache Tomcat Cache metrics. diff --git a/packages/apache_tomcat/data_stream/cache/sample_event.json b/packages/apache_tomcat/data_stream/cache/sample_event.json index 7ec6458dd4a..20ecbd3dcc3 100644 --- a/packages/apache_tomcat/data_stream/cache/sample_event.json +++ b/packages/apache_tomcat/data_stream/cache/sample_event.json @@ -94,7 +94,6 @@ "type": "prometheus" }, "tags": [ - "forwarded", "apache_tomcat-cache" ] } \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/catalina/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/catalina/elasticsearch/ingest_pipeline/default.yml index aa1a5784d7c..5b7a0ca1434 100644 --- a/packages/apache_tomcat/data_stream/catalina/elasticsearch/ingest_pipeline/default.yml +++ b/packages/apache_tomcat/data_stream/catalina/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original tag: 'grok_parse_log' diff --git a/packages/apache_tomcat/data_stream/catalina/manifest.yml b/packages/apache_tomcat/data_stream/catalina/manifest.yml index 81d13003012..6cf28aa119c 100644 --- a/packages/apache_tomcat/data_stream/catalina/manifest.yml +++ b/packages/apache_tomcat/data_stream/catalina/manifest.yml @@ -44,7 +44,7 @@ streams: multi: false required: false show_user: false - description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: filestream.yml.hbs title: Apache Tomcat Catalina logs description: Collect Apache Tomcat Catalina logs. diff --git a/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-common-config.yml b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json new file mode 100644 index 00000000000..b2df19f8dfa --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json @@ -0,0 +1,52 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "host": "localhost", + "context": "/sample", + "name": "jdbc/MyDB", + "instance": "127.0.0.1:9090", + "job": "prometheus" + }, + "metrics": { + "Catalina_DataSource_accessToUnderlyingConnectionAllowed": 0, + "Catalina_DataSource_cacheState": 1, + "Catalina_DataSource_removeAbandonedOnBorrow": 0, + "Catalina_DataSource_abandonedUsageTracking": 0, + "Catalina_DataSource_autoCommitOnReturn": 1, + "Catalina_DataSource_closed": 0, + "Catalina_DataSource_numActive": 0, + "Catalina_DataSource_defaultTransactionIsolation": -1, + "Catalina_DataSource_enableAutoCommitOnReturn": 1, + "Catalina_DataSource_fastFailValidation": 0, + "Catalina_DataSource_numIdle": 0, + "Catalina_DataSource_logAbandoned": 0, + "Catalina_DataSource_maxOpenPreparedStatements": 0, + "Catalina_DataSource_maxIdle": 20, + "Catalina_DataSource_minIdle": 5, + "Catalina_DataSource_softMinEvictableIdleTimeMillis": -1, + "Catalina_DataSource_numTestsPerEvictionRun": 3, + "Catalina_DataSource_initialSize": 0, + "Catalina_DataSource_maxConnLifetimeMillis": -1, + "Catalina_DataSource_maxWaitMillis": -1, + "Catalina_DataSource_logExpiredConnections": 1, + "Catalina_DataSource_minEvictableIdleTimeMillis": 1800000, + "Catalina_DataSource_removeAbandonedOnMaintenance": 0, + "Catalina_DataSource_removeAbandonedTimeout": 300, + "Catalina_DataSource_rollbackOnReturn": 1, + "Catalina_DataSource_testOnReturn": 0, + "Catalina_DataSource_testWhileIdle": 0, + "Catalina_DataSource_timeBetweenEvictionRunsMillis": -1, + "Catalina_DataSource_validationQueryTimeout": -1, + "Catalina_DataSource_clearStatementPoolOnReturn": 0, + "Catalina_DataSource_lifo": 1, + "Catalina_DataSource_maxTotal": 8, + "Catalina_DataSource_poolPreparedStatements": 0, + "Catalina_DataSource_testOnBorrow": 1, + "Catalina_DataSource_testOnCreate": 0 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json-expected.json b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json-expected.json new file mode 100644 index 00000000000..27f7a1d90ab --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/pipeline/test-conection-pool-metrics.json-expected.json @@ -0,0 +1,95 @@ +{ + "expected": [ + { + "apache_tomcat": { + "connection_pool": { + "access_to_underlying_connection_allowed": false, + "application_name": "/sample", + "cache": { + "state": 1 + }, + "connection": { + "abandoned_usage_tracking": false, + "active": { + "count": 0 + }, + "autocommit_on_return": true, + "clear_statement_pool_on_return": false, + "closed": false, + "database": { + "time": { + "max": { + "ms": -1 + } + } + }, + "default_transaction_isolation": -1, + "enable_autocommit_on_return": true, + "fast_fail_validation": false, + "idle": { + "count": 0, + "exists": false, + "max": { + "count": 20, + "size": 0, + "time": { + "ms": 3 + } + }, + "min": { + "size": 5, + "time": { + "ms": -1 + } + } + }, + "initial_size": { + "count": 0 + }, + "lifetime": { + "max": { + "ms": -1 + } + }, + "log_expired": true, + "min_evictable_idle": { + "time": 1800000 + }, + "remove_abandoned_on_borrow": false, + "remove_abandoned_on_maintenance": false, + "remove_abandoned_timeout": 300, + "rollback_on_return": true, + "test_on_return": false, + "test_while_idle": false, + "time_betwen_eviction_run": { + "time": { + "ms": -1 + } + }, + "validate": -1 + }, + "lifo": true, + "max": { + "total": 8 + }, + "prepared_statements": false, + "test_on_borrow": true, + "test_on_create": false + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/connection_pool/_dev/test/system/test-default-config.yml b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..74e3dda05e3 --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/_dev/test/system/test-default-config.yml @@ -0,0 +1,5 @@ +vars: + hosts: + - http://{{Hostname}}:{{Port}}/metrics +input: prometheus/metrics +service: apache_tomcat diff --git a/packages/apache_tomcat/data_stream/connection_pool/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/connection_pool/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..7e205c7f24f --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/agent/stream/stream.yml.hbs @@ -0,0 +1,25 @@ +metricsets: ["collector"] +hosts: +{{#each hosts}} + - {{this}} +{{/each}} +metrics_filters: + include: ["Catalina_DataSource_*"] +period: {{period}} +{{#if username}} +username: "{{username}}" +{{/if}} +{{#if password}} +password: "{{password}}" +{{/if}} +{{#if ssl}} +{{ssl}} +{{/if}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/apache_tomcat/data_stream/connection_pool/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/connection_pool/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..1db13f68794 --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,267 @@ +--- +description: Pipeline for processing Connection Pool metrics. +processors: + - set: + field: ecs.version + value: 8.7.0 + - set: + field: event.kind + value: metric + - set: + field: event.module + value: apache_tomcat + - set: + field: event.type + value: [info] + - set: + field: event.category + value: [web] + - rename: + field: prometheus.labels.context + target_field: apache_tomcat.connection_pool.application_name + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.access_to_underlying_connection_allowed + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_accessToUnderlyingConnectionAllowed == 1 + - set: + field: apache_tomcat.connection_pool.access_to_underlying_connection_allowed + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_accessToUnderlyingConnectionAllowed == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_cacheState + target_field: apache_tomcat.connection_pool.cache.state + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.remove_abandoned_on_borrow + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_removeAbandonedOnBorrow == 1 + - set: + field: apache_tomcat.connection_pool.connection.remove_abandoned_on_borrow + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_removeAbandonedOnBorrow == 0 + - set: + field: apache_tomcat.connection_pool.connection.abandoned_usage_tracking + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_abandonedUsageTracking == 1 + - set: + field: apache_tomcat.connection_pool.connection.abandoned_usage_tracking + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_abandonedUsageTracking == 0 + - set: + field: apache_tomcat.connection_pool.connection.autocommit_on_return + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_autoCommitOnReturn == 1 + - set: + field: apache_tomcat.connection_pool.connection.autocommit_on_return + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_autoCommitOnReturn == 0 + - set: + field: apache_tomcat.connection_pool.connection.closed + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_closed == 1 + - set: + field: apache_tomcat.connection_pool.connection.closed + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_closed == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_numActive + target_field: apache_tomcat.connection_pool.connection.active.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_defaultTransactionIsolation + target_field: apache_tomcat.connection_pool.connection.default_transaction_isolation + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.enable_autocommit_on_return + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_enableAutoCommitOnReturn == 1 + - set: + field: apache_tomcat.connection_pool.connection.enable_autocommit_on_return + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_enableAutoCommitOnReturn == 0 + - set: + field: apache_tomcat.connection_pool.connection.fast_fail_validation + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_fastFailValidation == 1 + - set: + field: apache_tomcat.connection_pool.connection.fast_fail_validation + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_fastFailValidation == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_numIdle + target_field: apache_tomcat.connection_pool.connection.idle.count + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.idle.exists + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_logAbandoned == 1 + - set: + field: apache_tomcat.connection_pool.connection.idle.exists + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_logAbandoned == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_maxOpenPreparedStatements + target_field: apache_tomcat.connection_pool.connection.idle.max.size + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_maxIdle + target_field: apache_tomcat.connection_pool.connection.idle.max.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_minIdle + target_field: apache_tomcat.connection_pool.connection.idle.min.size + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_softMinEvictableIdleTimeMillis + target_field: apache_tomcat.connection_pool.connection.idle.min.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_numTestsPerEvictionRun + target_field: apache_tomcat.connection_pool.connection.idle.max.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_initialSize + target_field: apache_tomcat.connection_pool.connection.initial_size.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_maxConnLifetimeMillis + target_field: apache_tomcat.connection_pool.connection.lifetime.max.ms + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_maxWaitMillis + target_field: apache_tomcat.connection_pool.connection.database.time.max.ms + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.log_expired + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_logExpiredConnections == 1 + - set: + field: apache_tomcat.connection_pool.connection.log_expired + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_logExpiredConnections == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_minEvictableIdleTimeMillis + target_field: apache_tomcat.connection_pool.connection.min_evictable_idle.time + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.remove_abandoned_on_maintenance + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_removeAbandonedOnMaintenance == 1 + - set: + field: apache_tomcat.connection_pool.connection.remove_abandoned_on_maintenance + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_removeAbandonedOnMaintenance == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_removeAbandonedTimeout + target_field: apache_tomcat.connection_pool.connection.remove_abandoned_timeout + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.rollback_on_return + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_rollbackOnReturn == 1 + - set: + field: apache_tomcat.connection_pool.connection.rollback_on_return + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_rollbackOnReturn == 0 + - set: + field: apache_tomcat.connection_pool.connection.test_on_return + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnReturn == 1 + - set: + field: apache_tomcat.connection_pool.connection.test_on_return + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnReturn == 0 + - set: + field: apache_tomcat.connection_pool.connection.test_while_idle + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_testWhileIdle == 1 + - set: + field: apache_tomcat.connection_pool.connection.test_while_idle + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_testWhileIdle == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_timeBetweenEvictionRunsMillis + target_field: apache_tomcat.connection_pool.connection.time_betwen_eviction_run.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_DataSource_validationQueryTimeout + target_field: apache_tomcat.connection_pool.connection.validate + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.connection.clear_statement_pool_on_return + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_clearStatementPoolOnReturn == 1 + - set: + field: apache_tomcat.connection_pool.connection.clear_statement_pool_on_return + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_clearStatementPoolOnReturn == 0 + - set: + field: apache_tomcat.connection_pool.lifo + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_lifo == 1 + - set: + field: apache_tomcat.connection_pool.lifo + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_lifo == 0 + - rename: + field: prometheus.metrics.Catalina_DataSource_maxTotal + target_field: apache_tomcat.connection_pool.max.total + ignore_missing: true + - set: + field: apache_tomcat.connection_pool.prepared_statements + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_poolPreparedStatements == 1 + - set: + field: apache_tomcat.connection_pool.prepared_statements + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_poolPreparedStatements == 0 + - set: + field: apache_tomcat.connection_pool.test_on_borrow + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnBorrow == 1 + - set: + field: apache_tomcat.connection_pool.test_on_borrow + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnBorrow == 0 + - set: + field: apache_tomcat.connection_pool.test_on_create + value: true + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnCreate == 1 + - set: + field: apache_tomcat.connection_pool.test_on_create + value: false + if: ctx.prometheus?.metrics?.Catalina_DataSource_testOnCreate == 0 + - remove: + field: + - prometheus + ignore_missing: true + - script: + description: Drops null/empty values recursively. + lang: painless + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + if: ctx.error?.message != null +on_failure: + - set: + field: error.message + value: "{{{_ingest.on_failure_message}}}" + - append: + field: event.kind + value: pipeline_error + allow_duplicates: false \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/connection_pool/fields/base-fields.yml b/packages/apache_tomcat/data_stream/connection_pool/fields/base-fields.yml new file mode 100644 index 00000000000..7c798f4534c --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/fields/base-fields.yml @@ -0,0 +1,12 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/apache_tomcat/data_stream/connection_pool/fields/ecs.yml b/packages/apache_tomcat/data_stream/connection_pool/fields/ecs.yml new file mode 100644 index 00000000000..034a05db03d --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/fields/ecs.yml @@ -0,0 +1,39 @@ +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.kind +- external: ecs + name: event.module +- external: ecs + name: host.name + dimension: true +- external: ecs + name: service.address + dimension: true diff --git a/packages/apache_tomcat/data_stream/connection_pool/fields/fields.yml b/packages/apache_tomcat/data_stream/connection_pool/fields/fields.yml new file mode 100644 index 00000000000..525e3596bce --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/fields/fields.yml @@ -0,0 +1,192 @@ +- name: apache_tomcat + type: group + fields: + - name: connection_pool + type: group + fields: + - name: application_name + type: keyword + # Reason to add as a dimension field: There can be many different applications in Apache Tomcat instance. + dimension: true + description: Name of the Apache Tomcat application. + - name: access_to_underlying_connection_allowed + type: boolean + description: Returns the state of connections that will be established when the connection pool is started. + - name: cache + type: group + fields: + - name: state + type: double + description: Cache state of connection pool. + metric_type: gauge + - name: connection + type: group + fields: + - name: abandoned_usage_tracking + type: boolean + description: Indicates if full stack traces are required when logAbandoned is true. + - name: active + type: group + fields: + - name: count + type: double + description: Number of active connection in pool. + metric_type: gauge + - name: autocommit_on_return + type: boolean + description: Connections being returned to the pool. + - name: clear_statement_pool_on_return + type: boolean + description: Keeps track of statements associated with a connection. + - name: closed + type: boolean + description: Random Connection Closed Exceptions. + - name: database + type: group + fields: + - name: time + type: group + fields: + - name: max + type: group + fields: + - name: ms + type: double + description: Maximum time to wait for a database connection to become available in ms. + unit: ms + metric_type: gauge + - name: default_transaction_isolation + type: double + description: TransactionIsolation state of connections created by this pool + metric_type: gauge + - name: enable_autocommit_on_return + type: boolean + description: Connections being returned to the pool will be checked and configured with Connection. + - name: fast_fail_validation + type: boolean + description: Timeout before a connection validation queries fail. + - name: idle + type: group + fields: + - name: count + type: double + description: Idle number of connection pool. + metric_type: gauge + - name: exists + type: boolean + description: logAbandoned to figure out the connection is idle. + - name: max + type: group + fields: + - name: count + type: double + description: Maximum idle connections. + metric_type: gauge + - name: size + type: double + description: Returns the maximum number of connections that can remain idle in the pool. + metric_type: gauge + - name: time + type: group + fields: + - name: ms + type: double + description: It represents the maximum number of objects that the pool will examine during each run of the idle object evictor thread. + unit: ms + metric_type: gauge + - name: min + type: group + fields: + - name: size + type: double + description: The minimum number of established connections that should be kept in the pool at all times. + metric_type: gauge + - name: time + type: group + fields: + - name: ms + type: double + description: An attribute of the Tomcat DataSource object that sets the minimum time an object may sit idle in the pool before it is eligable for eviction by the idle object evictor. + unit: ms + metric_type: gauge + - name: initial_size + type: group + fields: + - name: count + type: double + description: The initial number of connections that are created when the pool is started. + metric_type: gauge + - name: lifetime + type: group + fields: + - name: max + type: group + fields: + - name: ms + type: double + description: The maximum lifetime in milliseconds of a connection. + unit: ms + metric_type: gauge + - name: log_expired + type: boolean + description: Log expired connection in pool. + - name: min_evictable_idle + type: group + fields: + - name: time + type: double + description: The minimum amount of time an object may sit idle in the pool before it is eligible for eviction. + metric_type: gauge + - name: remove_abandoned_on_borrow + type: boolean + description: Remove abandoned connections from the pool when a connection is borrowed. + - name: remove_abandoned_on_maintenance + type: boolean + description: The commons dbcp parameters which are unique from the Tomcat JDBC connection pool parameters are not being accepted. + - name: remove_abandoned_timeout + type: double + description: Timeout in seconds before an abandoned (in use) connection can be removed. + metric_type: gauge + - name: rollback_on_return + type: boolean + description: The pool can terminate the transaction by calling rollback on the connection. + - name: test_on_return + type: boolean + description: The indication of whether objects will be validated before being returned to the pool. + - name: test_while_idle + type: boolean + description: Introspected attribute testWhileIdle. + - name: time_betwen_eviction_run + type: group + fields: + - name: time + type: group + fields: + - name: ms + type: double + description: The number of milliseconds to sleep between runs of the idle connection validation/cleaner thread. + unit: ms + metric_type: gauge + - name: validate + type: double + description: Validate connections from this pool. + metric_type: gauge + - name: lifo + type: boolean + description: Last In First Out connections. + - name: max + type: group + fields: + - name: total + type: double + description: Maximum total of connection pool. + metric_type: gauge + - name: prepared_statements + type: boolean + description: Validate connections from this pool. + - name: test_on_borrow + type: boolean + description: The indication of whether objects will be validated before being borrowed from the pool. + - name: test_on_create + type: boolean + description: Property determines whether or not the pool will validate objects immediately after they are created by the pool. diff --git a/packages/apache_tomcat/data_stream/connection_pool/manifest.yml b/packages/apache_tomcat/data_stream/connection_pool/manifest.yml new file mode 100644 index 00000000000..74604d6d307 --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/manifest.yml @@ -0,0 +1,32 @@ +type: metrics +title: Apache Tomcat Connection Pool metrics +streams: + - input: prometheus/metrics + vars: + - name: period + type: text + required: true + title: Period + default: 10s + show_user: true + description: Period of fetching metrics, i.e. 1s/1m/1h. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - apache_tomcat-connection_pool + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: stream.yml.hbs + title: Apache Tomcat Connection Pool metrics + description: Collect Apache Tomcat Connection Pool metrics. +elasticsearch: + index_mode: "time_series" diff --git a/packages/apache_tomcat/data_stream/connection_pool/sample_event.json b/packages/apache_tomcat/data_stream/connection_pool/sample_event.json new file mode 100644 index 00000000000..871bcc4e8b2 --- /dev/null +++ b/packages/apache_tomcat/data_stream/connection_pool/sample_event.json @@ -0,0 +1,146 @@ +{ + "@timestamp": "2023-07-06T06:16:33.972Z", + "agent": { + "ephemeral_id": "f5813425-689c-4d7c-97d5-b549c3948d9d", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "connection_pool": { + "access_to_underlying_connection_allowed": false, + "application_name": "/", + "cache": { + "state": 1 + }, + "connection": { + "abandoned_usage_tracking": false, + "active": { + "count": 0 + }, + "autocommit_on_return": true, + "clear_statement_pool_on_return": false, + "closed": false, + "database": { + "time": { + "max": { + "ms": -1 + } + } + }, + "default_transaction_isolation": -1, + "enable_autocommit_on_return": true, + "fast_fail_validation": false, + "idle": { + "count": 0, + "exists": false, + "max": { + "count": 20, + "size": -1, + "time": { + "ms": 3 + } + }, + "min": { + "size": 5, + "time": { + "ms": -1 + } + } + }, + "initial_size": { + "count": 0 + }, + "lifetime": { + "max": { + "ms": -1 + } + }, + "log_expired": true, + "min_evictable_idle": { + "time": 1800000 + }, + "remove_abandoned_on_borrow": false, + "remove_abandoned_on_maintenance": false, + "remove_abandoned_timeout": 300, + "rollback_on_return": true, + "test_on_return": false, + "test_while_idle": false, + "time_betwen_eviction_run": { + "time": { + "ms": -1 + } + }, + "validate": -1 + }, + "lifo": true, + "max": { + "total": 8 + }, + "prepared_statements": false, + "test_on_borrow": true, + "test_on_create": false + } + }, + "data_stream": { + "dataset": "apache_tomcat.connection_pool", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.connection_pool", + "duration": 252065272, + "ingested": "2023-07-06T06:16:37Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-connection_pool" + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/localhost/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/localhost/elasticsearch/ingest_pipeline/default.yml index fff7b1e9b1b..7fd6e1afdeb 100644 --- a/packages/apache_tomcat/data_stream/localhost/elasticsearch/ingest_pipeline/default.yml +++ b/packages/apache_tomcat/data_stream/localhost/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original tag: 'grok_parse_log' diff --git a/packages/apache_tomcat/data_stream/localhost/manifest.yml b/packages/apache_tomcat/data_stream/localhost/manifest.yml index 8e90707cb27..de5054f0e36 100644 --- a/packages/apache_tomcat/data_stream/localhost/manifest.yml +++ b/packages/apache_tomcat/data_stream/localhost/manifest.yml @@ -44,7 +44,7 @@ streams: multi: false required: false show_user: false - description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: filestream.yml.hbs title: Apache Tomcat Localhost logs description: Collect Apache Tomcat Localhost logs. diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-common-config.yml b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json new file mode 100644 index 00000000000..e9d7c55be77 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json @@ -0,0 +1,19 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "host": "localhost", + "name": "GarbageCollector", + "instance": "127.0.0.1:9090", + "job": "prometheus" + }, + "metrics": { + "java_lang_G1_Old_Generation_CollectionCount": 0, + "java_lang_G1_Old_Generation_Valid": 1, + "java_lang_G1_Old_Generation_CollectionTime": 0 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json-expected.json b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json-expected.json new file mode 100644 index 00000000000..1f5b0cab2b2 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-gc-metrics.json-expected.json @@ -0,0 +1,33 @@ +{ + "expected": [ + { + "apache_tomcat": { + "memory": { + "doc_type": "gc", + "gc": { + "collection": { + "count": 0, + "time": { + "ms": 0 + } + }, + "valid": 1 + } + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json new file mode 100644 index 00000000000..6a747d2efe5 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json @@ -0,0 +1,26 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "host": "localhost", + "name": "Memory", + "instance": "127.0.0.1:9090", + "job": "prometheus" + }, + "metrics": { + "java_lang_Memory_ObjectPendingFinalizationCount": 0, + "java_lang_Memory_HeapMemoryUsage_used": 4.5216344e+07, + "java_lang_Memory_NonHeapMemoryUsage_used": 3.6318104e+07, + "java_lang_Memory_Verbose": 1, + "java_lang_Memory_NonHeapMemoryUsage_init": 7.667712e+06, + "java_lang_Memory_HeapMemoryUsage_committed": 5.38968064e+08, + "java_lang_Memory_NonHeapMemoryUsage_max": -1, + "java_lang_Memory_HeapMemoryUsage_max": 1.073741824e+09, + "java_lang_Memory_HeapMemoryUsage_init": 5.36870912e+08, + "java_lang_Memory_NonHeapMemoryUsage_committed": 3.9518208e+07 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json-expected.json b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json-expected.json new file mode 100644 index 00000000000..4659bd299ce --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/pipeline/test-memory-metrics.json-expected.json @@ -0,0 +1,56 @@ +{ + "expected": [ + { + "apache_tomcat": { + "memory": { + "doc_type": "memory", + "heap": { + "committed": { + "bytes": 5.38968064E8 + }, + "init": { + "bytes": 5.36870912E8 + }, + "max": { + "bytes": 1.073741824E9 + }, + "used": { + "bytes": 4.5216344E7 + } + }, + "non_heap": { + "committed": { + "bytes": 3.9518208E7 + }, + "init": { + "bytes": 7667712.0 + }, + "max": { + "bytes": -1 + }, + "used": { + "bytes": 3.6318104E7 + } + }, + "object_pending_finalization": { + "count": 0 + }, + "verbose": true + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/_dev/test/system/test-default-config.yml b/packages/apache_tomcat/data_stream/memory/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..a6a09ba07de --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/_dev/test/system/test-default-config.yml @@ -0,0 +1,4 @@ +vars: + hosts: + - http://{{Hostname}}:{{Port}}/metrics +input: prometheus/metrics diff --git a/packages/apache_tomcat/data_stream/memory/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/memory/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..5b18650f441 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/agent/stream/stream.yml.hbs @@ -0,0 +1,25 @@ +metricsets: ["collector"] +hosts: +{{#each hosts}} + - {{this}} +{{/each}} +metrics_filters: + include: ["java_lang_Memory_*","java_lang_G1_Old_Generation_*"] +period: {{period}} +{{#if username}} +username: "{{username}}" +{{/if}} +{{#if password}} +password: "{{password}}" +{{/if}} +{{#if ssl}} +{{ssl}} +{{/if}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/memory/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..b7c859d90a9 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,111 @@ +--- +description: Pipeline for processing Apache Tomcat Memory metrics. +processors: + - set: + field: ecs.version + value: 8.7.0 + - set: + field: event.kind + value: metric + - set: + field: event.module + value: apache_tomcat + - set: + field: event.type + value: [info] + - set: + field: event.category + value: [web] + - set: + field: apache_tomcat.memory.verbose + value: true + if: ctx.prometheus?.metrics?.java_lang_Memory_Verbose == 1 + - set: + field: apache_tomcat.memory.verbose + value: false + if: ctx.prometheus?.metrics?.java_lang_Memory_Verbose == 0 + - rename: + field: prometheus.metrics.java_lang_Memory_HeapMemoryUsage_max + target_field: apache_tomcat.memory.heap.max.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_HeapMemoryUsage_init + target_field: apache_tomcat.memory.heap.init.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_HeapMemoryUsage_used + target_field: apache_tomcat.memory.heap.used.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_HeapMemoryUsage_committed + target_field: apache_tomcat.memory.heap.committed.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_NonHeapMemoryUsage_max + target_field: apache_tomcat.memory.non_heap.max.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_NonHeapMemoryUsage_init + target_field: apache_tomcat.memory.non_heap.init.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_NonHeapMemoryUsage_used + target_field: apache_tomcat.memory.non_heap.used.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_NonHeapMemoryUsage_committed + target_field: apache_tomcat.memory.non_heap.committed.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Memory_ObjectPendingFinalizationCount + target_field: apache_tomcat.memory.object_pending_finalization.count + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_G1_Old_Generation_CollectionCount + target_field: apache_tomcat.memory.gc.collection.count + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_G1_Old_Generation_CollectionTime + target_field: apache_tomcat.memory.gc.collection.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_G1_Old_Generation_Valid + target_field: apache_tomcat.memory.gc.valid + ignore_missing: true + - set: + field: apache_tomcat.memory.doc_type + value: memory + if: ctx.apache_tomcat?.memory?.heap != null || ctx.apache_tomcat?.memory?.non_heap != null + - set: + field: apache_tomcat.memory.doc_type + value: gc + if: ctx.apache_tomcat?.memory?.gc != null + - remove: + field: + - prometheus + ignore_missing: true + - script: + description: Drops null/empty values recursively. + lang: painless + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); +on_failure: + - set: + field: error.message + value: "{{{_ingest.on_failure_message}}}" + - append: + field: event.kind + value: pipeline_error + allow_duplicates: false \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/memory/fields/base-fields.yml b/packages/apache_tomcat/data_stream/memory/fields/base-fields.yml new file mode 100644 index 00000000000..909e7ff859a --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/fields/base-fields.yml @@ -0,0 +1,15 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: tags + type: keyword + description: List of keywords used to tag each event. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/apache_tomcat/data_stream/memory/fields/ecs.yml b/packages/apache_tomcat/data_stream/memory/fields/ecs.yml new file mode 100644 index 00000000000..034a05db03d --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/fields/ecs.yml @@ -0,0 +1,39 @@ +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.kind +- external: ecs + name: event.module +- external: ecs + name: host.name + dimension: true +- external: ecs + name: service.address + dimension: true diff --git a/packages/apache_tomcat/data_stream/memory/fields/fields.yml b/packages/apache_tomcat/data_stream/memory/fields/fields.yml new file mode 100644 index 00000000000..34c24ebf69f --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/fields/fields.yml @@ -0,0 +1,82 @@ +- name: apache_tomcat + type: group + fields: + - name: memory + type: group + fields: + - name: doc_type + type: keyword + description: Document type of the event. This should be either "memory" or "gc". + dimension: true + - name: gc + type: group + fields: + - name: collection + type: group + fields: + - name: count + type: long + description: The cumulative number of invoked garbage collections since the start of the server. + metric_type: counter + - name: time.ms + type: long + description: The time (in milliseconds) taken by garbage collection during the collection interval. + metric_type: gauge + unit: ms + - name: valid + type: long + description: The garbage collection process in G1 is considered valid even if the old GC JMX counter remains at 0 while old space is gradually reclaimed by the young collections. + metric_type: gauge + - name: heap + type: group + fields: + - name: committed.bytes + type: double + description: Committed heap memory usage. + metric_type: gauge + unit: byte + - name: init.bytes + type: double + description: Initial heap memory usage. + metric_type: gauge + unit: byte + - name: max.bytes + type: double + description: Max heap memory usage. When the value for the maximum memory size (in bytes) is set to -1 for heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation. + metric_type: gauge + unit: byte + - name: used.bytes + type: double + description: Used heap memory usage. + metric_type: gauge + unit: byte + - name: non_heap + type: group + fields: + - name: committed.bytes + type: double + description: Committed non-heap memory usage. + metric_type: gauge + unit: byte + - name: init.bytes + type: double + description: Initial non-heap memory usage. + metric_type: gauge + unit: byte + - name: max.bytes + type: double + description: Max non-heap memory usage. When the value for the maximum memory size (in bytes) is set to -1 for non-heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation. + metric_type: gauge + unit: byte + - name: used.bytes + type: double + description: Used non-heap memory usage. + metric_type: gauge + unit: byte + - name: object_pending_finalization.count + type: double + description: Count of object pending finalization. + metric_type: gauge + - name: verbose + type: boolean + description: When set to true, will cause the memory manager to print messages to the console whenever it performs certain memory-related operations.(1.0-true, 0.0-false). diff --git a/packages/apache_tomcat/data_stream/memory/manifest.yml b/packages/apache_tomcat/data_stream/memory/manifest.yml new file mode 100644 index 00000000000..87264ba4170 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/manifest.yml @@ -0,0 +1,32 @@ +type: metrics +title: Apache Tomcat Memory metrics +streams: + - input: prometheus/metrics + vars: + - name: period + type: text + title: Period + required: true + default: 10s + show_user: true + description: Period of fetching metrics, i.e. 1s/1m/1h. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - apache_tomcat-memory + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: stream.yml.hbs + title: Apache Tomcat Memory metrics + description: Collect Apache Tomcat Memory and Garbage collection metrics. +elasticsearch: + index_mode: "time_series" diff --git a/packages/apache_tomcat/data_stream/memory/sample_event.json b/packages/apache_tomcat/data_stream/memory/sample_event.json new file mode 100644 index 00000000000..4666ae700a0 --- /dev/null +++ b/packages/apache_tomcat/data_stream/memory/sample_event.json @@ -0,0 +1,107 @@ +{ + "@timestamp": "2023-07-11T13:20:12.035Z", + "agent": { + "ephemeral_id": "d25b802e-38e7-44c1-82d3-ef14a3522214", + "id": "fe5945f5-4d47-4726-8da8-5f694a655519", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "memory": { + "doc_type": "memory", + "heap": { + "committed": { + "bytes": 77594624 + }, + "init": { + "bytes": 195035136 + }, + "max": { + "bytes": 3103784960 + }, + "used": { + "bytes": 35204712 + } + }, + "non_heap": { + "committed": { + "bytes": 44695552 + }, + "init": { + "bytes": 7667712 + }, + "max": { + "bytes": -1 + }, + "used": { + "bytes": 42286456 + } + }, + "object_pending_finalization": { + "count": 0 + }, + "verbose": false + } + }, + "data_stream": { + "dataset": "apache_tomcat.memory", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "fe5945f5-4d47-4726-8da8-5f694a655519", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.memory", + "duration": 281008420, + "ingested": "2023-07-11T13:20:15Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "192.168.64.7" + ], + "mac": [ + "02-42-C0-A8-40-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-memory" + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/request/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/request/agent/stream/stream.yml.hbs index d4368ab82d5..73dd43d6f08 100644 --- a/packages/apache_tomcat/data_stream/request/agent/stream/stream.yml.hbs +++ b/packages/apache_tomcat/data_stream/request/agent/stream/stream.yml.hbs @@ -19,9 +19,6 @@ tags: {{#each tags as |tag|}} - {{tag}} {{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} {{#if processors}} processors: {{processors}} diff --git a/packages/apache_tomcat/data_stream/request/manifest.yml b/packages/apache_tomcat/data_stream/request/manifest.yml index c42137de2f2..4c211e97bbb 100644 --- a/packages/apache_tomcat/data_stream/request/manifest.yml +++ b/packages/apache_tomcat/data_stream/request/manifest.yml @@ -17,7 +17,6 @@ streams: required: true show_user: false default: - - forwarded - apache_tomcat-request - name: processors type: yaml @@ -25,7 +24,7 @@ streams: multi: false required: false show_user: false - description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: stream.yml.hbs title: Apache Tomcat Request metrics description: Collect Apache Tomcat Request metrics. diff --git a/packages/apache_tomcat/data_stream/request/sample_event.json b/packages/apache_tomcat/data_stream/request/sample_event.json index ed8e5b55ed4..f37fd4ae1c4 100644 --- a/packages/apache_tomcat/data_stream/request/sample_event.json +++ b/packages/apache_tomcat/data_stream/request/sample_event.json @@ -84,7 +84,6 @@ "type": "prometheus" }, "tags": [ - "forwarded", "apache_tomcat-request" ] } \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-common-config.yml b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json new file mode 100644 index 00000000000..9cebb2c0fdc --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json @@ -0,0 +1,31 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "host": "localhost", + "context": "/sample", + "instance": "localhost:9409", + "job": "prometheus" + }, + "metrics": { + "Catalina_Manager_rejectedSessions": 1, + "Catalina_Manager_sessionCounter": 3, + "Catalina_Manager_sessionMaxAliveTime": 0, + "Catalina_Manager_activeSessions": 1, + "Catalina_Manager_expiredSessions": 1, + "Catalina_Manager_sessionCreateRate": 1, + "Catalina_Manager_processingTime": 2, + "Catalina_Manager_processExpiresFrequency": 6, + "Catalina_Manager_persistAuthentication": 1, + "Catalina_Manager_warnOnSessionAttributeFilterFailure": 1, + "Catalina_Manager_duplicates": 1, + "Catalina_Manager_sessionExpireRate": 1, + "Catalina_Manager_maxActive": 1, + "Catalina_Manager_maxActiveSessions": -1, + "Catalina_Manager_sessionAverageAliveTime": 1 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json-expected.json b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json-expected.json new file mode 100644 index 00000000000..c8803fc4aa6 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/_dev/test/pipeline/test-session-metrics.json-expected.json @@ -0,0 +1,54 @@ +{ + "expected": [ + { + "apache_tomcat": { + "session": { + "active": { + "allowed": { + "max": -1 + }, + "max": 1, + "total": 1 + }, + "alive_time": { + "avg": 1, + "max": 0 + }, + "application_name": "/sample", + "create": { + "rate": 1, + "total": 3 + }, + "duplicate_ids": { + "count": 1 + }, + "expire": { + "rate": 1, + "total": 1 + }, + "persist_authentication": true, + "process_expires_frequency": { + "count": 6 + }, + "processing_time": 2, + "rejected": { + "count": 1 + } + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/session/_dev/test/system/test-default-config.yml b/packages/apache_tomcat/data_stream/session/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..a6a09ba07de --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/_dev/test/system/test-default-config.yml @@ -0,0 +1,4 @@ +vars: + hosts: + - http://{{Hostname}}:{{Port}}/metrics +input: prometheus/metrics diff --git a/packages/apache_tomcat/data_stream/session/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/session/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..af01a5f4fa8 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/agent/stream/stream.yml.hbs @@ -0,0 +1,25 @@ +metricsets: ["collector"] +hosts: +{{#each hosts}} + - {{this}} +{{/each}} +metrics_filters: + include: ["Catalina_Manager_*"] +period: {{period}} +{{#if username}} +username: "{{username}}" +{{/if}} +{{#if password}} +password: "{{password}}" +{{/if}} +{{#if ssl}} +{{ssl}} +{{/if}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/apache_tomcat/data_stream/session/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/session/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..c1a19e9f318 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,111 @@ +--- +description: Pipeline for processing Apache Tomcat Session metrics. +processors: + - set: + field: ecs.version + value: 8.7.0 + - set: + field: event.kind + value: metric + - set: + field: event.module + value: apache_tomcat + - set: + field: event.type + value: [info] + - set: + field: event.category + value: [web] + - set: + field: apache_tomcat.session.persist_authentication + value: true + if: ctx.prometheus?.metrics?.Catalina_Manager_persistAuthentication == 1 + - set: + field: apache_tomcat.session.persist_authentication + value: false + if: ctx.prometheus?.metrics?.Catalina_Manager_persistAuthentication == 0 + - rename: + field: prometheus.labels.context + target_field: apache_tomcat.session.application_name + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_maxActiveSessions + target_field: apache_tomcat.session.active.allowed.max + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_maxActive + target_field: apache_tomcat.session.active.max + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_activeSessions + target_field: apache_tomcat.session.active.total + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_sessionAverageAliveTime + target_field: apache_tomcat.session.alive_time.avg + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_sessionMaxAliveTime + target_field: apache_tomcat.session.alive_time.max + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_sessionCreateRate + target_field: apache_tomcat.session.create.rate + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_sessionCounter + target_field: apache_tomcat.session.create.total + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_duplicates + target_field: apache_tomcat.session.duplicate_ids.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_sessionExpireRate + target_field: apache_tomcat.session.expire.rate + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_expiredSessions + target_field: apache_tomcat.session.expire.total + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_rejectedSessions + target_field: apache_tomcat.session.rejected.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_processExpiresFrequency + target_field: apache_tomcat.session.process_expires_frequency.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_Manager_processingTime + target_field: apache_tomcat.session.processing_time + ignore_missing: true + - remove: + field: + - prometheus + ignore_missing: true + - script: + description: Drops null/empty values recursively. + lang: painless + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); +on_failure: + - set: + field: error.message + value: "{{{_ingest.on_failure_message}}}" + - append: + field: event.kind + value: pipeline_error + allow_duplicates: false \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/session/fields/base-fields.yml b/packages/apache_tomcat/data_stream/session/fields/base-fields.yml new file mode 100644 index 00000000000..909e7ff859a --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/fields/base-fields.yml @@ -0,0 +1,15 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: tags + type: keyword + description: List of keywords used to tag each event. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/apache_tomcat/data_stream/session/fields/ecs.yml b/packages/apache_tomcat/data_stream/session/fields/ecs.yml new file mode 100644 index 00000000000..55dcbb1de8a --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/fields/ecs.yml @@ -0,0 +1,33 @@ +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.project.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.kind +- external: ecs + name: event.module +- external: ecs + name: host.name + dimension: true +- external: ecs + name: service.address + dimension: true diff --git a/packages/apache_tomcat/data_stream/session/fields/fields.yml b/packages/apache_tomcat/data_stream/session/fields/fields.yml new file mode 100644 index 00000000000..ffe64ef659f --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/fields/fields.yml @@ -0,0 +1,79 @@ +- name: apache_tomcat + type: group + fields: + - name: session + type: group + fields: + - name: active + type: group + fields: + - name: allowed.max + type: double + description: The maximum number of active sessions allowed, or -1 for no limit. + metric_type: gauge + - name: max + type: double + description: Maximum number of active sessions so far. + metric_type: counter + - name: total + type: double + description: Number of active sessions at this moment. + metric_type: gauge + - name: alive_time + type: group + fields: + - name: avg + type: double + description: Average time an expired session had been alive. + metric_type: gauge + - name: max + type: double + description: Longest time an expired session had been alive. + metric_type: counter + - name: application_name + type: keyword + description: Name of the Apache Tomcat application. + # Reason to add as a dimension field: Users can deploy many different Applications in Apache Tomcat instance. + dimension: true + - name: create + type: group + fields: + - name: rate + type: double + description: Session creation rate in sessions per minute. + metric_type: gauge + - name: total + type: double + description: Total number of sessions created by the manager. + metric_type: counter + - name: duplicate_ids.count + type: double + description: Number of duplicated session ids generated. + metric_type: gauge + - name: expire + type: group + fields: + - name: rate + type: double + description: Session expiration rate in sessions per minute. + metric_type: gauge + - name: total + type: double + description: Number of sessions that expired (doesn't include explicit invalidations). + metric_type: gauge + - name: persist_authentication + type: boolean + description: Indicates whether sessions shall persist authentication information when being persisted (e.g. across application restarts). + - name: process_expires_frequency.count + type: double + description: The frequency of the manager checks (expiration and passivation). + metric_type: gauge + - name: processing_time + type: double + description: Time spent doing housekeeping and expiration. + metric_type: gauge + unit: ms + - name: rejected.count + type: double + description: Number of sessions we rejected due to maxActive being reached. + metric_type: gauge diff --git a/packages/apache_tomcat/data_stream/session/manifest.yml b/packages/apache_tomcat/data_stream/session/manifest.yml new file mode 100644 index 00000000000..bfe5b257a07 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/manifest.yml @@ -0,0 +1,32 @@ +type: metrics +title: Apache Tomcat Session metrics +elasticsearch: + index_mode: "time_series" +streams: + - input: prometheus/metrics + vars: + - name: period + type: text + required: true + title: Period + default: 10s + show_user: true + description: Period of fetching metrics, i.e. 1s/1m/1h. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - apache_tomcat-session + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: stream.yml.hbs + title: Apache Tomcat Session metrics + description: Collect Apache Tomcat Session metrics. diff --git a/packages/apache_tomcat/data_stream/session/sample_event.json b/packages/apache_tomcat/data_stream/session/sample_event.json new file mode 100644 index 00000000000..daa8eb717d5 --- /dev/null +++ b/packages/apache_tomcat/data_stream/session/sample_event.json @@ -0,0 +1,105 @@ +{ + "@timestamp": "2023-07-06T06:11:01.712Z", + "agent": { + "ephemeral_id": "27d03e29-cf11-4c0e-a36d-502210fff5f6", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "session": { + "active": { + "allowed": { + "max": -1 + }, + "max": 0, + "total": 0 + }, + "alive_time": { + "avg": 0, + "max": 0 + }, + "application_name": "/", + "create": { + "rate": 0, + "total": 0 + }, + "duplicate_ids": { + "count": 0 + }, + "expire": { + "rate": 0, + "total": 0 + }, + "persist_authentication": false, + "process_expires_frequency": { + "count": 6 + }, + "processing_time": 0, + "rejected": { + "count": 0 + } + } + }, + "data_stream": { + "dataset": "apache_tomcat.session", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.session", + "duration": 259368511, + "ingested": "2023-07-06T06:11:05Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-session" + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-common-config.yml b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..c39dc386179 --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,2 @@ +dynamic_fields: + event.ingested: ".*" diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json new file mode 100644 index 00000000000..15a11ecbaca --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json @@ -0,0 +1,45 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "instance": "127.0.0.1:9090", + "job": "prometheus", + "name": "\"http-nio-8080\"" + }, + "metrics": { + "Catalina_ThreadPool_maxConnections": 8192, + "Catalina_ThreadPool_minSpareThreads": 10, + "Catalina_ThreadPool_currentThreadsBusy": 0, + "Catalina_ThreadPool_pollerThreadPriority": 5, + "Catalina_ThreadPool_connectionLinger": -1, + "Catalina_ThreadPool_acceptorThreadPriority": 5, + "Catalina_ThreadPool_daemon": 1, + "Catalina_ThreadPool_portWithOffset": 8080, + "Catalina_ThreadPool_port": 8080, + "Catalina_ThreadPool_keepAliveCount": 0, + "Catalina_ThreadPool_sniParseLimit": 65536, + "Catalina_ThreadPool_sSLEnabled": 0, + "Catalina_ThreadPool_running": 1, + "Catalina_ThreadPool_connectionTimeout": 20000, + "Catalina_ThreadPool_useInheritedChannel": 0, + "Catalina_ThreadPool_acceptCount": 100, + "Catalina_ThreadPool_keepAliveTimeout": 20000, + "Catalina_ThreadPool_maxThreads": 200, + "Catalina_ThreadPool_threadPriority": 5, + "Catalina_ThreadPool_localPort": 8080, + "Catalina_ThreadPool_connectionCount": 1, + "Catalina_ThreadPool_paused": 0, + "Catalina_ThreadPool_portOffset": 0, + "Catalina_ThreadPool_bindOnInit": 1, + "Catalina_ThreadPool_tcpNoDelay": 1, + "Catalina_ThreadPool_useSendfile": 1, + "Catalina_ThreadPool_currentThreadCount": 10, + "Catalina_ThreadPool_maxKeepAliveRequests": 100, + "Catalina_ThreadPool_executorTerminationTimeoutMillis": 5000, + "Catalina_ThreadPool_selectorTimeout": 1000 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json-expected.json b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json-expected.json new file mode 100644 index 00000000000..a9bdcf4c983 --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-metrics.json-expected.json @@ -0,0 +1,82 @@ +{ + "expected": [ + { + "apache_tomcat": { + "thread_pool": { + "connection": { + "count": 1, + "linger": -1, + "max": 8192, + "timeout": 20000 + }, + "executor_termination": { + "timeout": { + "ms": 5000 + } + }, + "initiated_connector": { + "state": true + }, + "keep_alive": { + "count": 0, + "max_requests": 100, + "timeout": 20000 + }, + "nio_connector": "http-nio-8080", + "ssl_enabled": false, + "tcp_no_delay": true, + "thread": { + "accept": { + "count": 100 + }, + "current": { + "busy": 0, + "count": 10 + }, + "daemon": { + "status": true + }, + "paused": false, + "port": { + "default": 8080, + "offset": 0, + "value": 8080, + "with_offset": 8080 + }, + "priority": { + "acceptor": 5, + "count": 5, + "poller": 5 + }, + "requests": { + "max": 200 + }, + "running": { + "min": 10, + "value": true + }, + "selector": { + "timeout": 1000 + }, + "sni_parse_limit": 65536 + }, + "use_inherited_channel": false, + "use_send_file": true + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json new file mode 100644 index 00000000000..307314765b1 --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json @@ -0,0 +1,31 @@ +{ + "events": [ + { + "prometheus": { + "labels": { + "instance": "127.0.0.1:9090", + "job": "prometheus", + "name": "\"http-nio-8080\"" + }, + "metrics": { + "java_lang_Threading_ThreadCount": 25, + "java_lang_Threading_CurrentThreadCpuTimeSupported": 1, + "java_lang_Threading_ThreadContentionMonitoringEnabled": 0, + "java_lang_Threading_ThreadContentionMonitoringSupported": 1, + "java_lang_Threading_ThreadCpuTimeSupported": 1, + "java_lang_Threading_CurrentThreadAllocatedBytes": 2.159124728832e+12, + "java_lang_Threading_ThreadCpuTimeEnabled": 1, + "java_lang_Threading_TotalStartedThreadCount": 50, + "java_lang_Threading_CurrentThreadCpuTime": 3.048293149766e+12, + "java_lang_Threading_DaemonThreadCount": 22, + "java_lang_Threading_SynchronizerUsageSupported": 1, + "java_lang_Threading_PeakThreadCount": 26, + "java_lang_Threading_ThreadAllocatedMemorySupported": 1, + "java_lang_Threading_CurrentThreadUserTime": 2.97763e+12, + "java_lang_Threading_ObjectMonitorUsageSupported": 1, + "java_lang_Threading_ThreadAllocatedMemoryEnabled": 1 + } + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json-expected.json b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json-expected.json new file mode 100644 index 00000000000..846a9af645a --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/pipeline/test-thread-pool-threading-metrics.json-expected.json @@ -0,0 +1,71 @@ +{ + "expected": [ + { + "apache_tomcat": { + "thread_pool": { + "contention": { + "monitoring_enabled": false + }, + "nio_connector": "http-nio-8080", + "thread": { + "active": { + "count": 25 + }, + "allocated_memory": { + "enabled": true, + "supported": true + }, + "current": { + "allocated": { + "bytes": 2.159124728832E12 + }, + "cpu": { + "time": { + "enabled": true, + "ms": 3.048293149766E12 + } + }, + "user": { + "time": { + "ms": 2.97763E12 + } + } + }, + "daemon": { + "count": 22 + }, + "peak": { + "count": 26 + }, + "supported": { + "contention_monitoring": true, + "cpu": { + "current": { + "time": true + } + }, + "usage": { + "object_monitor": true, + "synchronizer": true + } + }, + "total": 50 + } + } + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/_dev/test/system/test-default-config.yml b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..a6a09ba07de --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/_dev/test/system/test-default-config.yml @@ -0,0 +1,4 @@ +vars: + hosts: + - http://{{Hostname}}:{{Port}}/metrics +input: prometheus/metrics diff --git a/packages/apache_tomcat/data_stream/thread_pool/agent/stream/stream.yml.hbs b/packages/apache_tomcat/data_stream/thread_pool/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..4d6bedf6f5a --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/agent/stream/stream.yml.hbs @@ -0,0 +1,25 @@ +metricsets: ["collector"] +hosts: +{{#each hosts}} + - {{this}} +{{/each}} +metrics_filters: + include: ["Catalina_ThreadPool_*","java_lang_Threading_*"] +period: {{period}} +{{#if username}} +username: "{{username}}" +{{/if}} +{{#if password}} +password: "{{password}}" +{{/if}} +{{#if ssl}} +{{ssl}} +{{/if}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/elasticsearch/ingest_pipeline/default.yml b/packages/apache_tomcat/data_stream/thread_pool/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..29683590b7d --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,308 @@ +--- +description: Pipeline for processing Apache Tomcat Thread Pool metrics. +processors: + - set: + field: ecs.version + value: 8.7.0 + - set: + field: event.kind + value: metric + - set: + field: event.module + value: apache_tomcat + - set: + field: event.type + value: [info] + - set: + field: event.category + value: [web] + - dissect: + field: prometheus.labels.name + tag: 'dissect_nio_connector' + pattern: "\"%{apache_tomcat.thread_pool.nio_connector}\"" + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: prometheus.metrics.Catalina_ThreadPool_acceptCount + target_field: apache_tomcat.thread_pool.thread.accept.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_currentThreadsBusy + target_field: apache_tomcat.thread_pool.thread.current.busy + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_connectionCount + target_field: apache_tomcat.thread_pool.connection.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_connectionLinger + target_field: apache_tomcat.thread_pool.connection.linger + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_maxConnections + target_field: apache_tomcat.thread_pool.connection.max + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_connectionTimeout + target_field: apache_tomcat.thread_pool.connection.timeout + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_currentThreadCount + target_field: apache_tomcat.thread_pool.thread.current.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_executorTerminationTimeoutMillis + target_field: apache_tomcat.thread_pool.executor_termination.timeout.ms + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_keepAliveCount + target_field: apache_tomcat.thread_pool.keep_alive.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_maxKeepAliveRequests + target_field: apache_tomcat.thread_pool.keep_alive.max_requests + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_keepAliveTimeout + target_field: apache_tomcat.thread_pool.keep_alive.timeout + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_maxThreads + target_field: apache_tomcat.thread_pool.thread.requests.max + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_localPort + target_field: apache_tomcat.thread_pool.thread.port.default + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_portOffset + target_field: apache_tomcat.thread_pool.thread.port.offset + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_port + target_field: apache_tomcat.thread_pool.thread.port.value + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_portWithOffset + target_field: apache_tomcat.thread_pool.thread.port.with_offset + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_acceptorThreadPriority + target_field: apache_tomcat.thread_pool.thread.priority.acceptor + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_pollerThreadPriority + target_field: apache_tomcat.thread_pool.thread.priority.poller + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_threadPriority + target_field: apache_tomcat.thread_pool.thread.priority.count + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_selectorTimeout + target_field: apache_tomcat.thread_pool.thread.selector.timeout + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_sniParseLimit + target_field: apache_tomcat.thread_pool.thread.sni_parse_limit + ignore_missing: true + - rename: + field: prometheus.metrics.Catalina_ThreadPool_minSpareThreads + target_field: apache_tomcat.thread_pool.thread.running.min + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_CurrentThreadAllocatedBytes + target_field: apache_tomcat.thread_pool.thread.current.allocated.bytes + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_CurrentThreadCpuTime + target_field: apache_tomcat.thread_pool.thread.current.cpu.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_CurrentThreadUserTime + target_field: apache_tomcat.thread_pool.thread.current.user.time.ms + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_DaemonThreadCount + target_field: apache_tomcat.thread_pool.thread.daemon.count + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_PeakThreadCount + target_field: apache_tomcat.thread_pool.thread.peak.count + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_ThreadCount + target_field: apache_tomcat.thread_pool.thread.active.count + ignore_missing: true + - rename: + field: prometheus.metrics.java_lang_Threading_TotalStartedThreadCount + target_field: apache_tomcat.thread_pool.thread.total + ignore_missing: true + - set: + field: apache_tomcat.thread_pool.thread.running.value + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_running == 1 + - set: + field: apache_tomcat.thread_pool.thread.running.value + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_running == 0 + - set: + field: apache_tomcat.thread_pool.ssl_enabled + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_sSLEnabled == 1 + - set: + field: apache_tomcat.thread_pool.ssl_enabled + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_sSLEnabled == 0 + - set: + field: apache_tomcat.thread_pool.tcp_no_delay + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_tcpNoDelay == 1 + - set: + field: apache_tomcat.thread_pool.tcp_no_delay + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_tcpNoDelay == 0 + - set: + field: apache_tomcat.thread_pool.use_inherited_channel + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_useInheritedChannel == 1 + - set: + field: apache_tomcat.thread_pool.use_inherited_channel + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_useInheritedChannel == 0 + - set: + field: apache_tomcat.thread_pool.use_send_file + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_useSendfile == 1 + - set: + field: apache_tomcat.thread_pool.use_send_file + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_useSendfile == 0 + - set: + field: apache_tomcat.thread_pool.thread.allocated_memory.enabled + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadAllocatedMemoryEnabled == 1 + - set: + field: apache_tomcat.thread_pool.thread.allocated_memory.enabled + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadAllocatedMemoryEnabled == 0 + - set: + field: apache_tomcat.thread_pool.thread.allocated_memory.supported + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadAllocatedMemorySupported == 1 + - set: + field: apache_tomcat.thread_pool.thread.allocated_memory.supported + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadAllocatedMemorySupported == 0 + - set: + field: apache_tomcat.thread_pool.contention.monitoring_enabled + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadContentionMonitoringEnabled == 1 + - set: + field: apache_tomcat.thread_pool.contention.monitoring_enabled + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadContentionMonitoringEnabled == 0 + - set: + field: apache_tomcat.thread_pool.initiated_connector.state + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_bindOnInit == 1 + - set: + field: apache_tomcat.thread_pool.initiated_connector.state + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_bindOnInit == 0 + - set: + field: apache_tomcat.thread_pool.thread.daemon.status + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_daemon == 1 + - set: + field: apache_tomcat.thread_pool.thread.daemon.status + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_daemon == 0 + - set: + field: apache_tomcat.thread_pool.thread.paused + value: true + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_paused == 1 + - set: + field: apache_tomcat.thread_pool.thread.paused + value: false + if: ctx.prometheus?.metrics?.Catalina_ThreadPool_paused == 0 + - set: + field: apache_tomcat.thread_pool.thread.current.cpu.time.enabled + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadCpuTimeEnabled == 1 + - set: + field: apache_tomcat.thread_pool.thread.current.cpu.time.enabled + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadCpuTimeEnabled == 0 + - set: + field: apache_tomcat.thread_pool.thread.supported.contention_monitoring + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadContentionMonitoringSupported == 1 + - set: + field: apache_tomcat.thread_pool.thread.supported.contention_monitoring + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ThreadContentionMonitoringSupported == 0 + - set: + field: apache_tomcat.thread_pool.thread.supported.usage.object_monitor + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_ObjectMonitorUsageSupported == 1 + - set: + field: apache_tomcat.thread_pool.thread.supported.usage.object_monitor + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_ObjectMonitorUsageSupported == 0 + - set: + field: apache_tomcat.thread_pool.thread.supported.usage.synchronizer + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_SynchronizerUsageSupported == 1 + - set: + field: apache_tomcat.thread_pool.thread.supported.usage.synchronizer + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_SynchronizerUsageSupported == 0 + - set: + field: apache_tomcat.thread_pool.thread.supported.cpu.current.time + value: true + if: ctx.prometheus?.metrics?.java_lang_Threading_CurrentThreadCpuTimeSupported == 1 + - set: + field: apache_tomcat.thread_pool.thread.supported.cpu.current.time + value: false + if: ctx.prometheus?.metrics?.java_lang_Threading_CurrentThreadCpuTimeSupported == 0 + - set: + field: apache_tomcat.thread_pool.persist_authentication + value: true + if: ctx.prometheus?.metrics?.Catalina_Manager_persistAuthentication == 1 + - set: + field: apache_tomcat.thread_pool.persist_authentication + value: false + if: ctx.prometheus?.metrics?.Catalina_Manager_persistAuthentication == 0 + - remove: + field: + - prometheus + ignore_missing: true + - script: + description: Drops null/empty values recursively. + lang: painless + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); +on_failure: + - set: + field: error.message + value: "{{{_ingest.on_failure_message}}}" + - append: + field: event.kind + value: pipeline_error + allow_duplicates: false \ No newline at end of file diff --git a/packages/apache_tomcat/data_stream/thread_pool/fields/base-fields.yml b/packages/apache_tomcat/data_stream/thread_pool/fields/base-fields.yml new file mode 100644 index 00000000000..909e7ff859a --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/fields/base-fields.yml @@ -0,0 +1,15 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: tags + type: keyword + description: List of keywords used to tag each event. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/apache_tomcat/data_stream/thread_pool/fields/ecs.yml b/packages/apache_tomcat/data_stream/thread_pool/fields/ecs.yml new file mode 100644 index 00000000000..bddafc20650 --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/fields/ecs.yml @@ -0,0 +1,41 @@ +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.kind +- external: ecs + name: event.module +- external: ecs + name: host.name + dimension: true +- external: ecs + name: service.address + dimension: true +- external: ecs + name: service.type diff --git a/packages/apache_tomcat/data_stream/thread_pool/fields/fields.yml b/packages/apache_tomcat/data_stream/thread_pool/fields/fields.yml new file mode 100644 index 00000000000..5c11fded17f --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/fields/fields.yml @@ -0,0 +1,216 @@ +- name: apache_tomcat + type: group + fields: + - name: thread_pool + type: group + fields: + - name: connection + type: group + fields: + - name: count + type: double + description: Count of all connections. + metric_type: counter + - name: linger + type: double + description: The number of seconds during which the sockets used by this connector will linger when they are closed. + metric_type: gauge + unit: s + - name: max + type: double + description: The total number of concurrent connections that the server will accept and process. + metric_type: gauge + - name: timeout + type: double + description: Thread connection timeout. + metric_type: counter + - name: contention.monitoring_enabled + type: boolean + description: This is used to determine if a Java virtual machine enables thread contention monitoring. + - name: executor_termination.timeout.ms + type: double + description: The time that the private internal executor will wait for request processing threads to terminate before continuing with the process of stopping the connector. If not set, the default is 5000 (5 seconds). + metric_type: gauge + unit: ms + - name: initiated_connector.state + type: boolean + description: State of bound when the connector is initiated. + - name: keep_alive + type: group + fields: + - name: count + type: double + description: Total keep alive on the ThreadPool. + metric_type: gauge + - name: max_requests + type: double + description: Maximum number of request keep alive in ThreadPool. + metric_type: gauge + - name: timeout + type: double + description: Keep alive timeout on the ThreadPool. + metric_type: gauge + - name: nio_connector + type: keyword + description: Name of NIO Connector. + # Reason to add as a dimension field: Users can configure many different NIO Connector in Apache Tomcat instance. + dimension: true + - name: ssl_enabled + type: boolean + description: SSL enable status. + - name: tcp_no_delay + type: boolean + description: Status of tcp no delay option used to improves performance under most circumstances. + - name: thread + type: group + fields: + - name: accept.count + type: double + description: Count of all threads accepted. + metric_type: counter + - name: active.count + type: double + description: Current active threads at JVM level (from java.lang:type=Threading). + metric_type: gauge + - name: allocated_memory + type: group + fields: + - name: enabled + type: boolean + description: Allocated memory enabled in thread. + - name: supported + type: boolean + description: Allocated memory supported in thread. + - name: current + type: group + fields: + - name: allocated.bytes + type: double + description: Allocated bytes in current thread. + metric_type: counter + unit: byte + - name: busy + type: double + description: Current busy threads from the ThreadPool. + metric_type: gauge + - name: count + type: double + description: Current number of threads, taken from the ThreadPool. + metric_type: gauge + - name: cpu.time + type: group + fields: + - name: enabled + type: boolean + description: CPU time for the current thread. + - name: ms + type: double + description: CPU time in milliseconds. + metric_type: gauge + unit: ms + - name: user.time.ms + type: double + description: User time in milliseconds. + metric_type: gauge + unit: ms + - name: daemon + type: group + fields: + - name: count + type: double + description: Daemon count for the current thread. + metric_type: gauge + - name: status + type: boolean + description: The status which states whether the thread is daemon or not. + - name: paused + type: boolean + description: Pause state of Thread. + - name: peak.count + type: double + description: Peak number of threads at JVM level (from java.lang:type=Threading). + metric_type: gauge + - name: port + type: group + fields: + - name: default + type: long + description: Default port of thread in Apache Tomcat. + metric_type: gauge + - name: offset + type: long + description: The offset to apply to port of thread. + metric_type: gauge + - name: value + type: long + description: Port of thread. + metric_type: gauge + - name: with_offset + type: long + description: Port of thread with offset. + metric_type: gauge + - name: priority + type: group + fields: + - name: acceptor + type: double + description: The priority of the acceptor thread. + metric_type: gauge + - name: count + type: double + description: Priority of thread. + metric_type: gauge + - name: poller + type: double + description: The priority of the poller threads. + metric_type: gauge + - name: requests.max + type: double + description: Max threads from the ThreadPool, to be created by the connector and made available for requests. + metric_type: counter + - name: running + type: group + fields: + - name: min + type: double + description: The minimum number of threads always kept running. + metric_type: gauge + - name: value + type: boolean + description: The status which states whether the thread is running or not. + - name: selector.timeout + type: double + description: Selector thread's timeout. + metric_type: gauge + - name: sni_parse_limit + type: double + description: SNI parsing limit of thread. + metric_type: gauge + - name: supported + type: group + fields: + - name: contention_monitoring + type: boolean + description: This is used to determine if a Java virtual machine supports thread contention monitoring. + - name: cpu.current.time + type: boolean + description: CPU time that the current thread has executed in user mode is supported or not. + - name: usage + type: group + fields: + - name: object_monitor + type: boolean + description: Support of object monitor usage of thread. + - name: synchronizer + type: boolean + description: Support of synchronizer usage. + - name: total + type: double + description: Total threads at the JVM level (from java.lang:type=Threading). + metric_type: gauge + - name: use_inherited_channel + type: boolean + description: Returns the channel inherited from the entity that created this Java virtual machine. + - name: use_send_file + type: boolean + description: Use of sendfile will disable any compression that Tomcat may otherwise have performed on the response. diff --git a/packages/apache_tomcat/data_stream/thread_pool/manifest.yml b/packages/apache_tomcat/data_stream/thread_pool/manifest.yml new file mode 100644 index 00000000000..1e23c1003ff --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/manifest.yml @@ -0,0 +1,32 @@ +type: metrics +title: Apache Tomcat Thread Pool metrics +streams: + - input: prometheus/metrics + vars: + - name: period + type: text + title: Period + required: true + default: 10s + show_user: true + description: Period of fetching metrics, i.e. 1s/1m/1h. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - apache_tomcat-thread_pool + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: stream.yml.hbs + title: Apache Tomcat Thread Pool metrics + description: Collect Apache Tomcat Thread Pool and Threading metrics. +elasticsearch: + index_mode: "time_series" diff --git a/packages/apache_tomcat/data_stream/thread_pool/sample_event.json b/packages/apache_tomcat/data_stream/thread_pool/sample_event.json new file mode 100644 index 00000000000..4c6f52562c8 --- /dev/null +++ b/packages/apache_tomcat/data_stream/thread_pool/sample_event.json @@ -0,0 +1,121 @@ +{ + "@timestamp": "2023-07-06T06:13:12.777Z", + "agent": { + "ephemeral_id": "5209fee4-2cae-4498-bf4b-c295a793454b", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "thread_pool": { + "contention": { + "monitoring_enabled": false + }, + "thread": { + "active": { + "count": 26 + }, + "allocated_memory": { + "enabled": true, + "supported": true + }, + "current": { + "allocated": { + "bytes": 2835120 + }, + "cpu": { + "time": { + "enabled": true, + "ms": 31925017 + } + }, + "user": { + "time": { + "ms": 30000000 + } + } + }, + "daemon": { + "count": 23 + }, + "peak": { + "count": 26 + }, + "supported": { + "contention_monitoring": true, + "cpu": { + "current": { + "time": true + } + }, + "usage": { + "object_monitor": true, + "synchronizer": true + } + }, + "total": 27 + } + } + }, + "data_stream": { + "dataset": "apache_tomcat.thread_pool", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.thread_pool", + "duration": 256268755, + "ingested": "2023-07-06T06:13:16Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-thread_pool" + ] +} \ No newline at end of file diff --git a/packages/apache_tomcat/docs/README.md b/packages/apache_tomcat/docs/README.md index 6850de66654..6ccc1081188 100644 --- a/packages/apache_tomcat/docs/README.md +++ b/packages/apache_tomcat/docs/README.md @@ -6,7 +6,7 @@ Use the Apache Tomcat integration to: -- Collect metrics related to the cache and request and collect logs related to access, catalina, and localhost. +- Collect metrics related to the cache, connection pool, memory, request, session and thread pool and collect logs related to access, catalina, and localhost. - Create visualizations to monitor, measure and analyze the usage trend and key data, and derive business insights. - Create alerts to reduce the MTTD and also the MTTR by referencing relevant logs when troubleshooting an issue. @@ -16,14 +16,18 @@ The Apache Tomcat integration collects logs and metrics data. Logs help you keep a record of events that happen on your machine. The `Log` data streams collected by Apache Tomcat integration are `access`, `catalina`, and `localhost`, so that users can keep track of the IP addresses of the clients, bytes returned to the client or sent by clients, etc., so that users could monitor and troubleshoot the performance of Java applications. -Metrics give you insight into the statistics of the Apache Tomcat. The `Metric` data streams collected by the Apache Tomcat integration are `cache` and `request`, so that the user can monitor and troubleshoot the performance of the Apache Tomcat instance. +Metrics give you insight into the statistics of the Apache Tomcat. The `Metric` data streams collected by the Apache Tomcat integration are `cache`, `connection pool`, `memory`, `request`, `session` and `thread pool`, so that the user can monitor and troubleshoot the performance of the Apache Tomcat instance. Data streams: - `access`: Collects information related to overall performance of Java applications. +- `cache`: Collects information related to the overall cache of the Apache Tomcat instance. - `catalina`: Collects information related to the startup and shutdown of the Apache Tomcat application server, the deployment of new applications, or the failure of one or more subsystems. +- `connection pool`: Collects information related to connection pool such as number of active and idle connections. - `localhost`: Collects information related to Web application activity which is related to HTTP transactions between the application server and the client. -- `cache`: Collects information related to the overall cache of the Apache Tomcat instance. +- `memory`: Collects information related to heap memory, non-heap memory and garbage collection of the Tomcat instance. - `request`: Collects information related to requests of the Apache Tomcat instance. +- `thread pool`: Collects information related to the overall states of the threads, CPU time and processing termination time of the threads in the Tomcat instance. +- `session`: Collects information related to overall created, active and expired sessions of the Tomcat instance. Note: - Users can monitor and see the log inside the ingested documents for Apache Tomcat in the `logs-*` index pattern from `Discover`, and for metrics, the index pattern is `metrics-*`. @@ -48,14 +52,14 @@ For step-by-step instructions on how to set up an integration, see the [Getting Here are the steps to configure Prometheus in Apache Tomcat instance: -1. Go to `/webapps` from Apache Tomcat instance. +1. Go to `/webapps` from Apache Tomcat instance. 2. Please find latest [Prometheus version](https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent/), replace in below command and perform from Apache Tomcat instance: - ``` wget https://repo1.maven.org/maven2/io/prometheus/jmx/jmx_prometheus_javaagent//jmx_prometheus_javaagent-.jar ``` -3. Create `config.yml` file in `/webapps` and paste the following content in `config.yml` file: - +3. Create `config.yml` file in `/webapps` and paste the following content in `config.yml` file: - ``` rules: @@ -64,7 +68,7 @@ rules: 4. Go to `/etc/systemd/system` and add the following content in `tomcat.service` file: - ``` -Environment='JAVA_OPTS=-javaagent:/webapps/jmx_prometheus_javaagent-.jar=:/opt/tomcat/webapps/config.yml' +Environment='JAVA_OPTS=-javaagent:/webapps/jmx_prometheus_javaagent-.jar=:/opt/tomcat/webapps/config.yml' ``` 5. Run the following commands to reload demon and restart Apache Tomcat instance: - @@ -78,7 +82,7 @@ systemctl restart tomcat Here are the steps to configure Log format in Apache Tomcat instance: -1. Go to `/conf/server.xml` from Apache Tomcat instance. +1. Go to `/conf/server.xml` from Apache Tomcat instance. 2. The user can update the log format in the pattern field of the class `org.apache.catalina.valves.AccessLogValve`. Here is an example of the `org.apache.catalina.valves.AccessLogValve` class. @@ -101,6 +105,18 @@ Combined Log Format + X-Forwarded-For header :- '%h %l %u %t "%r" %s %b %A %X %T systemctl restart tomcat ``` +## Supported log formats for Catalina and Localhost logs: + +- With error stack trace: +``` +dd-MMM-yyyy HH:mm:ss.SSS [Severity] [Subsystem] [Message Text] [Error Stack Trace] +``` + +- Without error stack trace: +``` +dd-MMM-yyyy HH:mm:ss.SSS [Severity] [Subsystem] [Message Text] +``` + Note: - Restarting Apache Tomcat does not affect the virtual desktops that are currently running. It will only prevent new users from logging in for the duration of the restart process (typically several seconds). @@ -565,7 +581,6 @@ An example event for `cache` looks as following: "type": "prometheus" }, "tags": [ - "forwarded", "apache_tomcat-cache" ] } @@ -602,6 +617,378 @@ An example event for `cache` looks as following: | tags | List of keywords used to tag each event. | keyword | | | +### Connection Pool + +This is the `connection pool` data stream. This data stream collects metrics related to connection pool such as number of active and idle connections. + +An example event for `connection_pool` looks as following: + +```json +{ + "@timestamp": "2023-07-06T06:16:33.972Z", + "agent": { + "ephemeral_id": "f5813425-689c-4d7c-97d5-b549c3948d9d", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "connection_pool": { + "access_to_underlying_connection_allowed": false, + "application_name": "/", + "cache": { + "state": 1 + }, + "connection": { + "abandoned_usage_tracking": false, + "active": { + "count": 0 + }, + "autocommit_on_return": true, + "clear_statement_pool_on_return": false, + "closed": false, + "database": { + "time": { + "max": { + "ms": -1 + } + } + }, + "default_transaction_isolation": -1, + "enable_autocommit_on_return": true, + "fast_fail_validation": false, + "idle": { + "count": 0, + "exists": false, + "max": { + "count": 20, + "size": -1, + "time": { + "ms": 3 + } + }, + "min": { + "size": 5, + "time": { + "ms": -1 + } + } + }, + "initial_size": { + "count": 0 + }, + "lifetime": { + "max": { + "ms": -1 + } + }, + "log_expired": true, + "min_evictable_idle": { + "time": 1800000 + }, + "remove_abandoned_on_borrow": false, + "remove_abandoned_on_maintenance": false, + "remove_abandoned_timeout": 300, + "rollback_on_return": true, + "test_on_return": false, + "test_while_idle": false, + "time_betwen_eviction_run": { + "time": { + "ms": -1 + } + }, + "validate": -1 + }, + "lifo": true, + "max": { + "total": 8 + }, + "prepared_statements": false, + "test_on_borrow": true, + "test_on_create": false + } + }, + "data_stream": { + "dataset": "apache_tomcat.connection_pool", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.connection_pool", + "duration": 252065272, + "ingested": "2023-07-06T06:16:37Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-connection_pool" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| apache_tomcat.connection_pool.access_to_underlying_connection_allowed | Returns the state of connections that will be established when the connection pool is started. | boolean | | | +| apache_tomcat.connection_pool.application_name | Name of the Apache Tomcat application. | keyword | | | +| apache_tomcat.connection_pool.cache.state | Cache state of connection pool. | double | | gauge | +| apache_tomcat.connection_pool.connection.abandoned_usage_tracking | Indicates if full stack traces are required when logAbandoned is true. | boolean | | | +| apache_tomcat.connection_pool.connection.active.count | Number of active connection in pool. | double | | gauge | +| apache_tomcat.connection_pool.connection.autocommit_on_return | Connections being returned to the pool. | boolean | | | +| apache_tomcat.connection_pool.connection.clear_statement_pool_on_return | Keeps track of statements associated with a connection. | boolean | | | +| apache_tomcat.connection_pool.connection.closed | Random Connection Closed Exceptions. | boolean | | | +| apache_tomcat.connection_pool.connection.database.time.max.ms | Maximum time to wait for a database connection to become available in ms. | double | ms | gauge | +| apache_tomcat.connection_pool.connection.default_transaction_isolation | TransactionIsolation state of connections created by this pool | double | | gauge | +| apache_tomcat.connection_pool.connection.enable_autocommit_on_return | Connections being returned to the pool will be checked and configured with Connection. | boolean | | | +| apache_tomcat.connection_pool.connection.fast_fail_validation | Timeout before a connection validation queries fail. | boolean | | | +| apache_tomcat.connection_pool.connection.idle.count | Idle number of connection pool. | double | | gauge | +| apache_tomcat.connection_pool.connection.idle.exists | logAbandoned to figure out the connection is idle. | boolean | | | +| apache_tomcat.connection_pool.connection.idle.max.count | Maximum idle connections. | double | | gauge | +| apache_tomcat.connection_pool.connection.idle.max.size | Returns the maximum number of connections that can remain idle in the pool. | double | | gauge | +| apache_tomcat.connection_pool.connection.idle.max.time.ms | It represents the maximum number of objects that the pool will examine during each run of the idle object evictor thread. | double | ms | gauge | +| apache_tomcat.connection_pool.connection.idle.min.size | The minimum number of established connections that should be kept in the pool at all times. | double | | gauge | +| apache_tomcat.connection_pool.connection.idle.min.time.ms | An attribute of the Tomcat DataSource object that sets the minimum time an object may sit idle in the pool before it is eligable for eviction by the idle object evictor. | double | ms | gauge | +| apache_tomcat.connection_pool.connection.initial_size.count | The initial number of connections that are created when the pool is started. | double | | gauge | +| apache_tomcat.connection_pool.connection.lifetime.max.ms | The maximum lifetime in milliseconds of a connection. | double | ms | gauge | +| apache_tomcat.connection_pool.connection.log_expired | Log expired connection in pool. | boolean | | | +| apache_tomcat.connection_pool.connection.min_evictable_idle.time | The minimum amount of time an object may sit idle in the pool before it is eligible for eviction. | double | | gauge | +| apache_tomcat.connection_pool.connection.remove_abandoned_on_borrow | Remove abandoned connections from the pool when a connection is borrowed. | boolean | | | +| apache_tomcat.connection_pool.connection.remove_abandoned_on_maintenance | The commons dbcp parameters which are unique from the Tomcat JDBC connection pool parameters are not being accepted. | boolean | | | +| apache_tomcat.connection_pool.connection.remove_abandoned_timeout | Timeout in seconds before an abandoned (in use) connection can be removed. | double | | gauge | +| apache_tomcat.connection_pool.connection.rollback_on_return | The pool can terminate the transaction by calling rollback on the connection. | boolean | | | +| apache_tomcat.connection_pool.connection.test_on_return | The indication of whether objects will be validated before being returned to the pool. | boolean | | | +| apache_tomcat.connection_pool.connection.test_while_idle | Introspected attribute testWhileIdle. | boolean | | | +| apache_tomcat.connection_pool.connection.time_betwen_eviction_run.time.ms | The number of milliseconds to sleep between runs of the idle connection validation/cleaner thread. | double | ms | gauge | +| apache_tomcat.connection_pool.connection.validate | Validate connections from this pool. | double | | gauge | +| apache_tomcat.connection_pool.lifo | Last In First Out connections. | boolean | | | +| apache_tomcat.connection_pool.max.total | Maximum total of connection pool. | double | | gauge | +| apache_tomcat.connection_pool.prepared_statements | Validate connections from this pool. | boolean | | | +| apache_tomcat.connection_pool.test_on_borrow | The indication of whether objects will be validated before being borrowed from the pool. | boolean | | | +| apache_tomcat.connection_pool.test_on_create | Property determines whether or not the pool will validate objects immediately after they are created by the pool. | boolean | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error.message | Error message. | match_only_text | | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | + + +### Memory + +This is the `memory` data stream. This data stream collects metrics related to the heap memory, non-heap memory, garbage collection time and count. + +An example event for `memory` looks as following: + +```json +{ + "@timestamp": "2023-07-11T13:20:12.035Z", + "agent": { + "ephemeral_id": "d25b802e-38e7-44c1-82d3-ef14a3522214", + "id": "fe5945f5-4d47-4726-8da8-5f694a655519", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "memory": { + "doc_type": "memory", + "heap": { + "committed": { + "bytes": 77594624 + }, + "init": { + "bytes": 195035136 + }, + "max": { + "bytes": 3103784960 + }, + "used": { + "bytes": 35204712 + } + }, + "non_heap": { + "committed": { + "bytes": 44695552 + }, + "init": { + "bytes": 7667712 + }, + "max": { + "bytes": -1 + }, + "used": { + "bytes": 42286456 + } + }, + "object_pending_finalization": { + "count": 0 + }, + "verbose": false + } + }, + "data_stream": { + "dataset": "apache_tomcat.memory", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "fe5945f5-4d47-4726-8da8-5f694a655519", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.memory", + "duration": 281008420, + "ingested": "2023-07-11T13:20:15Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "192.168.64.7" + ], + "mac": [ + "02-42-C0-A8-40-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-memory" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| apache_tomcat.memory.doc_type | Document type of the event. This should be either "memory" or "gc". | keyword | | | +| apache_tomcat.memory.gc.collection.count | The cumulative number of invoked garbage collections since the start of the server. | long | | counter | +| apache_tomcat.memory.gc.collection.time.ms | The time (in milliseconds) taken by garbage collection during the collection interval. | long | ms | gauge | +| apache_tomcat.memory.gc.valid | The garbage collection process in G1 is considered valid even if the old GC JMX counter remains at 0 while old space is gradually reclaimed by the young collections. | long | | gauge | +| apache_tomcat.memory.heap.committed.bytes | Committed heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.heap.init.bytes | Initial heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.heap.max.bytes | Max heap memory usage. When the value for the maximum memory size (in bytes) is set to -1 for heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation. | double | byte | gauge | +| apache_tomcat.memory.heap.used.bytes | Used heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.non_heap.committed.bytes | Committed non-heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.non_heap.init.bytes | Initial non-heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.non_heap.max.bytes | Max non-heap memory usage. When the value for the maximum memory size (in bytes) is set to -1 for non-heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation. | double | byte | gauge | +| apache_tomcat.memory.non_heap.used.bytes | Used non-heap memory usage. | double | byte | gauge | +| apache_tomcat.memory.object_pending_finalization.count | Count of object pending finalization. | double | | gauge | +| apache_tomcat.memory.verbose | When set to true, will cause the memory manager to print messages to the console whenever it performs certain memory-related operations.(1.0-true, 0.0-false). | boolean | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error.message | Error message. | match_only_text | | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | +| tags | List of keywords used to tag each event. | keyword | | | + + ### Request This is the `Request` data stream. This data stream collects metrics related to request count, and amount of data received and sent. @@ -695,7 +1082,6 @@ An example event for `request` looks as following: "type": "prometheus" }, "tags": [ - "forwarded", "apache_tomcat-request" ] } @@ -730,3 +1116,360 @@ An example event for `request` looks as following: | host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | + + +### Session + +This is the `session` data stream. This data stream collects metrics related to created, active, expired and rejected sessions, alive and processing time for sessions. + +An example event for `session` looks as following: + +```json +{ + "@timestamp": "2023-07-06T06:11:01.712Z", + "agent": { + "ephemeral_id": "27d03e29-cf11-4c0e-a36d-502210fff5f6", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "session": { + "active": { + "allowed": { + "max": -1 + }, + "max": 0, + "total": 0 + }, + "alive_time": { + "avg": 0, + "max": 0 + }, + "application_name": "/", + "create": { + "rate": 0, + "total": 0 + }, + "duplicate_ids": { + "count": 0 + }, + "expire": { + "rate": 0, + "total": 0 + }, + "persist_authentication": false, + "process_expires_frequency": { + "count": 6 + }, + "processing_time": 0, + "rejected": { + "count": 0 + } + } + }, + "data_stream": { + "dataset": "apache_tomcat.session", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.session", + "duration": 259368511, + "ingested": "2023-07-06T06:11:05Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-session" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| apache_tomcat.session.active.allowed.max | The maximum number of active sessions allowed, or -1 for no limit. | double | | gauge | +| apache_tomcat.session.active.max | Maximum number of active sessions so far. | double | | counter | +| apache_tomcat.session.active.total | Number of active sessions at this moment. | double | | gauge | +| apache_tomcat.session.alive_time.avg | Average time an expired session had been alive. | double | | gauge | +| apache_tomcat.session.alive_time.max | Longest time an expired session had been alive. | double | | counter | +| apache_tomcat.session.application_name | Name of the Apache Tomcat application. | keyword | | | +| apache_tomcat.session.create.rate | Session creation rate in sessions per minute. | double | | gauge | +| apache_tomcat.session.create.total | Total number of sessions created by the manager. | double | | counter | +| apache_tomcat.session.duplicate_ids.count | Number of duplicated session ids generated. | double | | gauge | +| apache_tomcat.session.expire.rate | Session expiration rate in sessions per minute. | double | | gauge | +| apache_tomcat.session.expire.total | Number of sessions that expired (doesn't include explicit invalidations). | double | | gauge | +| apache_tomcat.session.persist_authentication | Indicates whether sessions shall persist authentication information when being persisted (e.g. across application restarts). | boolean | | | +| apache_tomcat.session.process_expires_frequency.count | The frequency of the manager checks (expiration and passivation). | double | | gauge | +| apache_tomcat.session.processing_time | Time spent doing housekeeping and expiration. | double | ms | gauge | +| apache_tomcat.session.rejected.count | Number of sessions we rejected due to maxActive being reached. | double | | gauge | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| container.id | Unique container id. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error.message | Error message. | match_only_text | | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | +| tags | List of keywords used to tag each event. | keyword | | | + + +### Thread Pool + +This is the `thread pool` data stream. This data stream collects metrics related to the total, active, current, daemon, busy and peak threads, CPU time and processing termination time of the threads. + +An example event for `thread_pool` looks as following: + +```json +{ + "@timestamp": "2023-07-06T06:13:12.777Z", + "agent": { + "ephemeral_id": "5209fee4-2cae-4498-bf4b-c295a793454b", + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "apache_tomcat": { + "thread_pool": { + "contention": { + "monitoring_enabled": false + }, + "thread": { + "active": { + "count": 26 + }, + "allocated_memory": { + "enabled": true, + "supported": true + }, + "current": { + "allocated": { + "bytes": 2835120 + }, + "cpu": { + "time": { + "enabled": true, + "ms": 31925017 + } + }, + "user": { + "time": { + "ms": 30000000 + } + } + }, + "daemon": { + "count": 23 + }, + "peak": { + "count": 26 + }, + "supported": { + "contention_monitoring": true, + "cpu": { + "current": { + "time": true + } + }, + "usage": { + "object_monitor": true, + "synchronizer": true + } + }, + "total": 27 + } + } + }, + "data_stream": { + "dataset": "apache_tomcat.thread_pool", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "c78eadae-edd0-4b88-ab24-f2fb84a98229", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "apache_tomcat.thread_pool", + "duration": 256268755, + "ingested": "2023-07-06T06:13:16Z", + "kind": "metric", + "module": "apache_tomcat", + "type": [ + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e8978f2086c14e13b7a0af9ed0011d19", + "ip": [ + "172.27.0.7" + ], + "mac": [ + "02-42-AC-1B-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "3.10.0-1160.90.1.el7.x86_64", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "collector", + "period": 10000 + }, + "service": { + "address": "http://elastic-package-service_apache_tomcat_1:9090/metrics", + "type": "prometheus" + }, + "tags": [ + "apache_tomcat-thread_pool" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| apache_tomcat.thread_pool.connection.count | Count of all connections. | double | | counter | +| apache_tomcat.thread_pool.connection.linger | The number of seconds during which the sockets used by this connector will linger when they are closed. | double | s | gauge | +| apache_tomcat.thread_pool.connection.max | The total number of concurrent connections that the server will accept and process. | double | | gauge | +| apache_tomcat.thread_pool.connection.timeout | Thread connection timeout. | double | | counter | +| apache_tomcat.thread_pool.contention.monitoring_enabled | This is used to determine if a Java virtual machine enables thread contention monitoring. | boolean | | | +| apache_tomcat.thread_pool.executor_termination.timeout.ms | The time that the private internal executor will wait for request processing threads to terminate before continuing with the process of stopping the connector. If not set, the default is 5000 (5 seconds). | double | ms | gauge | +| apache_tomcat.thread_pool.initiated_connector.state | State of bound when the connector is initiated. | boolean | | | +| apache_tomcat.thread_pool.keep_alive.count | Total keep alive on the ThreadPool. | double | | gauge | +| apache_tomcat.thread_pool.keep_alive.max_requests | Maximum number of request keep alive in ThreadPool. | double | | gauge | +| apache_tomcat.thread_pool.keep_alive.timeout | Keep alive timeout on the ThreadPool. | double | | gauge | +| apache_tomcat.thread_pool.nio_connector | Name of NIO Connector. | keyword | | | +| apache_tomcat.thread_pool.ssl_enabled | SSL enable status. | boolean | | | +| apache_tomcat.thread_pool.tcp_no_delay | Status of tcp no delay option used to improves performance under most circumstances. | boolean | | | +| apache_tomcat.thread_pool.thread.accept.count | Count of all threads accepted. | double | | counter | +| apache_tomcat.thread_pool.thread.active.count | Current active threads at JVM level (from java.lang:type=Threading). | double | | gauge | +| apache_tomcat.thread_pool.thread.allocated_memory.enabled | Allocated memory enabled in thread. | boolean | | | +| apache_tomcat.thread_pool.thread.allocated_memory.supported | Allocated memory supported in thread. | boolean | | | +| apache_tomcat.thread_pool.thread.current.allocated.bytes | Allocated bytes in current thread. | double | byte | counter | +| apache_tomcat.thread_pool.thread.current.busy | Current busy threads from the ThreadPool. | double | | gauge | +| apache_tomcat.thread_pool.thread.current.count | Current number of threads, taken from the ThreadPool. | double | | gauge | +| apache_tomcat.thread_pool.thread.current.cpu.time.enabled | CPU time for the current thread. | boolean | | | +| apache_tomcat.thread_pool.thread.current.cpu.time.ms | CPU time in milliseconds. | double | ms | gauge | +| apache_tomcat.thread_pool.thread.current.user.time.ms | User time in milliseconds. | double | ms | gauge | +| apache_tomcat.thread_pool.thread.daemon.count | Daemon count for the current thread. | double | | gauge | +| apache_tomcat.thread_pool.thread.daemon.status | The status which states whether the thread is daemon or not. | boolean | | | +| apache_tomcat.thread_pool.thread.paused | Pause state of Thread. | boolean | | | +| apache_tomcat.thread_pool.thread.peak.count | Peak number of threads at JVM level (from java.lang:type=Threading). | double | | gauge | +| apache_tomcat.thread_pool.thread.port.default | Default port of thread in Apache Tomcat. | long | | gauge | +| apache_tomcat.thread_pool.thread.port.offset | The offset to apply to port of thread. | long | | gauge | +| apache_tomcat.thread_pool.thread.port.value | Port of thread. | long | | gauge | +| apache_tomcat.thread_pool.thread.port.with_offset | Port of thread with offset. | long | | gauge | +| apache_tomcat.thread_pool.thread.priority.acceptor | The priority of the acceptor thread. | double | | gauge | +| apache_tomcat.thread_pool.thread.priority.count | Priority of thread. | double | | gauge | +| apache_tomcat.thread_pool.thread.priority.poller | The priority of the poller threads. | double | | gauge | +| apache_tomcat.thread_pool.thread.requests.max | Max threads from the ThreadPool, to be created by the connector and made available for requests. | double | | counter | +| apache_tomcat.thread_pool.thread.running.min | The minimum number of threads always kept running. | double | | gauge | +| apache_tomcat.thread_pool.thread.running.value | The status which states whether the thread is running or not. | boolean | | | +| apache_tomcat.thread_pool.thread.selector.timeout | Selector thread's timeout. | double | | gauge | +| apache_tomcat.thread_pool.thread.sni_parse_limit | SNI parsing limit of thread. | double | | gauge | +| apache_tomcat.thread_pool.thread.supported.contention_monitoring | This is used to determine if a Java virtual machine supports thread contention monitoring. | boolean | | | +| apache_tomcat.thread_pool.thread.supported.cpu.current.time | CPU time that the current thread has executed in user mode is supported or not. | boolean | | | +| apache_tomcat.thread_pool.thread.supported.usage.object_monitor | Support of object monitor usage of thread. | boolean | | | +| apache_tomcat.thread_pool.thread.supported.usage.synchronizer | Support of synchronizer usage. | boolean | | | +| apache_tomcat.thread_pool.thread.total | Total threads at the JVM level (from java.lang:type=Threading). | double | | gauge | +| apache_tomcat.thread_pool.use_inherited_channel | Returns the channel inherited from the entity that created this Java virtual machine. | boolean | | | +| apache_tomcat.thread_pool.use_send_file | Use of sendfile will disable any compression that Tomcat may otherwise have performed on the response. | boolean | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error.message | Error message. | match_only_text | | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | +| tags | List of keywords used to tag each event. | keyword | | | + diff --git a/packages/apache_tomcat/img/apache_tomcat-access-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-access-dashboard.png index a7d0fca78c3..1f36b73bc55 100644 Binary files a/packages/apache_tomcat/img/apache_tomcat-access-dashboard.png and b/packages/apache_tomcat/img/apache_tomcat-access-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-catalina-localhost-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-catalina-localhost-dashboard.png index 410ce2a1c80..5ebaf349b40 100644 Binary files a/packages/apache_tomcat/img/apache_tomcat-catalina-localhost-dashboard.png and b/packages/apache_tomcat/img/apache_tomcat-catalina-localhost-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-connection-pool-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-connection-pool-dashboard.png new file mode 100644 index 00000000000..c93a50f81e8 Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-connection-pool-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-logs-overview-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-logs-overview-dashboard.png new file mode 100644 index 00000000000..c089d2c42f7 Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-logs-overview-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-memory-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-memory-dashboard.png new file mode 100644 index 00000000000..3b9a3ab2388 Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-memory-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-metrics-overview-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-metrics-overview-dashboard.png new file mode 100644 index 00000000000..323359faa53 Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-metrics-overview-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-session-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-session-dashboard.png new file mode 100644 index 00000000000..123c813b889 Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-session-dashboard.png differ diff --git a/packages/apache_tomcat/img/apache_tomcat-thread-pool-dashboard.png b/packages/apache_tomcat/img/apache_tomcat-thread-pool-dashboard.png new file mode 100644 index 00000000000..b3c2faab75d Binary files /dev/null and b/packages/apache_tomcat/img/apache_tomcat-thread-pool-dashboard.png differ diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-2a331270-b8cd-11ed-a099-3791d000f969.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-2a331270-b8cd-11ed-a099-3791d000f969.json new file mode 100644 index 00000000000..1bc2443c451 --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-2a331270-b8cd-11ed-a099-3791d000f969.json @@ -0,0 +1,1070 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"48036e6b-bb5f-4779-8ff2-a0affc20a119\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"id\":\"48036e6b-bb5f-4779-8ff2-a0affc20a119\",\"existsSelected\":false,\"selectedOptions\":[],\"enhancements\":{}}},\"b59436ce-764c-468d-ab13-0eb522f11c5c\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"apache_tomcat.session.application_name\",\"title\":\"Application Name\",\"id\":\"b59436ce-764c-468d-ab13-0eb522f11c5c\",\"selectedOptions\":[],\"enhancements\":{},\"exclude\":true}}}" + }, + "description": "This Apache Tomcat dashboard visualizes session data stream metrics.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0175242f-2671-474a-a828-deff61e43fb6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "34b8c32b-1aaf-45de-bdb4-09081617f0c8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0175242f-2671-474a-a828-deff61e43fb6": { + "columnOrder": [ + "83b48f4e-37fd-4965-a277-7fbc36cd10c4", + "227ea4ce-b872-4b6d-a4d6-b010fd3b7525", + "ebf4eedd-4933-4ed5-b63c-251ad89ce456" + ], + "columns": { + "227ea4ce-b872-4b6d-a4d6-b010fd3b7525": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "83b48f4e-37fd-4965-a277-7fbc36cd10c4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ebf4eedd-4933-4ed5-b63c-251ad89ce456", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.session.application_name" + }, + "ebf4eedd-4933-4ed5-b63c-251ad89ce456": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.create.total: *" + }, + "isBucketed": false, + "label": "Created", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.create.total" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "34b8c32b-1aaf-45de-bdb4-09081617f0c8", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "ebf4eedd-4933-4ed5-b63c-251ad89ce456" + ], + "layerId": "0175242f-2671-474a-a828-deff61e43fb6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "83b48f4e-37fd-4965-a277-7fbc36cd10c4", + "xAccessor": "227ea4ce-b872-4b6d-a4d6-b010fd3b7525" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Sessions" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "a39adf70-8e40-4d80-a127-a1747a75be1f", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "a39adf70-8e40-4d80-a127-a1747a75be1f", + "title": "Created sessions over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-85bb5555-4581-4120-ab66-6ce66aeb4066", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "fa5f9b9a-65b0-452a-bcd0-1df3a33b1b3e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "85bb5555-4581-4120-ab66-6ce66aeb4066": { + "columnOrder": [ + "a97f3cfc-2145-4883-9f87-11126379918d", + "763d5a9f-ee92-4166-806c-8b25ee913968", + "1eebd32f-91cc-4ea3-83d7-4802a2b9d79c" + ], + "columns": { + "1eebd32f-91cc-4ea3-83d7-4802a2b9d79c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.expire.total: *" + }, + "isBucketed": false, + "label": "Expired", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.expire.total" + }, + "763d5a9f-ee92-4166-806c-8b25ee913968": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a97f3cfc-2145-4883-9f87-11126379918d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1eebd32f-91cc-4ea3-83d7-4802a2b9d79c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.session.application_name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fa5f9b9a-65b0-452a-bcd0-1df3a33b1b3e", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1eebd32f-91cc-4ea3-83d7-4802a2b9d79c" + ], + "layerId": "85bb5555-4581-4120-ab66-6ce66aeb4066", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "a97f3cfc-2145-4883-9f87-11126379918d", + "xAccessor": "763d5a9f-ee92-4166-806c-8b25ee913968", + "yConfig": [ + { + "axisMode": "auto", + "color": "#54b399", + "forAccessor": "1eebd32f-91cc-4ea3-83d7-4802a2b9d79c" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show", + "valuesInLegend": true, + "yTitle": "Sessions" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "91d26f64-351f-420e-a37b-88a882ecba0e", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "91d26f64-351f-420e-a37b-88a882ecba0e", + "title": "Expired sessions per application [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-57b12f03-6995-4072-8994-d512e5700ee4", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "de6b5c32-5630-4877-8b24-be30c47ee9c1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "57b12f03-6995-4072-8994-d512e5700ee4": { + "columnOrder": [ + "7d7e1358-c253-4d02-bb79-fff128597de4", + "d2e27628-e345-4f9e-b06e-2543268355c1", + "0d2a1caf-d316-462a-b8bd-a05a6d058d77" + ], + "columns": { + "0d2a1caf-d316-462a-b8bd-a05a6d058d77": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.active.total: *" + }, + "isBucketed": false, + "label": "Current active", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.active.total" + }, + "7d7e1358-c253-4d02-bb79-fff128597de4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0d2a1caf-d316-462a-b8bd-a05a6d058d77", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.session.application_name" + }, + "d2e27628-e345-4f9e-b06e-2543268355c1": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "de6b5c32-5630-4877-8b24-be30c47ee9c1", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0d2a1caf-d316-462a-b8bd-a05a6d058d77" + ], + "layerId": "57b12f03-6995-4072-8994-d512e5700ee4", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "7d7e1358-c253-4d02-bb79-fff128597de4", + "xAccessor": "d2e27628-e345-4f9e-b06e-2543268355c1" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Sessions" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "5922510e-e6a2-4f9c-aceb-83715cc3b539", + "w": 24, + "x": 0, + "y": 14 + }, + "panelIndex": "5922510e-e6a2-4f9c-aceb-83715cc3b539", + "title": "Current active sessions over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Time spent doing housekeeping and expiration for sessions", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-9b0dd57c-eb2b-434c-a7d6-21a8e5e83e8b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "efe32f1b-651c-4ce4-a1e9-06cb0cf2d5af", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9b0dd57c-eb2b-434c-a7d6-21a8e5e83e8b": { + "columnOrder": [ + "110a6317-3f6c-4522-9c5a-f66baf19cd30", + "5b3ec5bb-5905-4cac-bb0e-5f830e4d63cd" + ], + "columns": { + "110a6317-3f6c-4522-9c5a-f66baf19cd30": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5b3ec5bb-5905-4cac-bb0e-5f830e4d63cd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.session.application_name" + }, + "5b3ec5bb-5905-4cac-bb0e-5f830e4d63cd": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.processing_time: *" + }, + "isBucketed": false, + "label": "Processing time(ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.processing_time" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "efe32f1b-651c-4ce4-a1e9-06cb0cf2d5af", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "5b3ec5bb-5905-4cac-bb0e-5f830e4d63cd" + ], + "layerId": "9b0dd57c-eb2b-434c-a7d6-21a8e5e83e8b", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "110a6317-3f6c-4522-9c5a-f66baf19cd30" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "2d408e1c-da52-4aed-b760-812f89f48184", + "w": 24, + "x": 24, + "y": 14 + }, + "panelIndex": "2d408e1c-da52-4aed-b760-812f89f48184", + "title": "Session expiration processing time [Metric Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-8533f30a-f59a-4f19-8a60-2231660778cf", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1df29502-1178-4b06-b0c8-3009d0c3271b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8533f30a-f59a-4f19-8a60-2231660778cf": { + "columnOrder": [ + "da9f5c00-8752-45b3-8ecc-d8260b2f9522", + "ede9710d-b7f7-40ca-91ac-4532bf0f9c26", + "e5699bbc-30d5-4eca-a198-bc9e0d08819b", + "8622a6d6-5901-49e2-a998-285029bdc82b", + "b90571b5-4b61-4a20-996a-f27afcf022e2" + ], + "columns": { + "8622a6d6-5901-49e2-a998-285029bdc82b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.expire.total: *" + }, + "isBucketed": false, + "label": "Expired", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.expire.total" + }, + "b90571b5-4b61-4a20-996a-f27afcf022e2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.rejected.count: *" + }, + "isBucketed": false, + "label": "Rejected", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.rejected.count" + }, + "da9f5c00-8752-45b3-8ecc-d8260b2f9522": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ede9710d-b7f7-40ca-91ac-4532bf0f9c26", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.session.application_name" + }, + "e5699bbc-30d5-4eca-a198-bc9e0d08819b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.active.total: *" + }, + "isBucketed": false, + "label": "Current active", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.active.total" + }, + "ede9710d-b7f7-40ca-91ac-4532bf0f9c26": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.session.create.total: *" + }, + "isBucketed": false, + "label": "Created", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.create.total" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1df29502-1178-4b06-b0c8-3009d0c3271b", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "da9f5c00-8752-45b3-8ecc-d8260b2f9522", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "e5699bbc-30d5-4eca-a198-bc9e0d08819b", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "ede9710d-b7f7-40ca-91ac-4532bf0f9c26", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "8622a6d6-5901-49e2-a998-285029bdc82b", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "b90571b5-4b61-4a20-996a-f27afcf022e2", + "isTransposed": false + } + ], + "headerRowHeight": "auto", + "layerId": "8533f30a-f59a-4f19-8a60-2231660778cf", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "auto" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "8ce83532-0623-4974-9280-b6c56c6b0c27", + "w": 48, + "x": 0, + "y": 28 + }, + "panelIndex": "8ce83532-0623-4974-9280-b6c56c6b0c27", + "title": "Sessions overview [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Metrics Apache Tomcat] Session", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-06-09T11:27:22.150Z", + "id": "apache_tomcat-2a331270-b8cd-11ed-a099-3791d000f969", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a39adf70-8e40-4d80-a127-a1747a75be1f:indexpattern-datasource-layer-0175242f-2671-474a-a828-deff61e43fb6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a39adf70-8e40-4d80-a127-a1747a75be1f:34b8c32b-1aaf-45de-bdb4-09081617f0c8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "91d26f64-351f-420e-a37b-88a882ecba0e:indexpattern-datasource-layer-85bb5555-4581-4120-ab66-6ce66aeb4066", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "91d26f64-351f-420e-a37b-88a882ecba0e:fa5f9b9a-65b0-452a-bcd0-1df3a33b1b3e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5922510e-e6a2-4f9c-aceb-83715cc3b539:indexpattern-datasource-layer-57b12f03-6995-4072-8994-d512e5700ee4", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5922510e-e6a2-4f9c-aceb-83715cc3b539:de6b5c32-5630-4877-8b24-be30c47ee9c1", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2d408e1c-da52-4aed-b760-812f89f48184:indexpattern-datasource-layer-9b0dd57c-eb2b-434c-a7d6-21a8e5e83e8b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2d408e1c-da52-4aed-b760-812f89f48184:efe32f1b-651c-4ce4-a1e9-06cb0cf2d5af", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8ce83532-0623-4974-9280-b6c56c6b0c27:indexpattern-datasource-layer-8533f30a-f59a-4f19-8a60-2231660778cf", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8ce83532-0623-4974-9280-b6c56c6b0c27:1df29502-1178-4b06-b0c8-3009d0c3271b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_48036e6b-bb5f-4779-8ff2-a0affc20a119:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_b59436ce-764c-468d-ab13-0eb522f11c5c:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-44a8e0d0-b8f5-11ed-ac9b-cb6bcd97d223.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-44a8e0d0-b8f5-11ed-ac9b-cb6bcd97d223.json index 8601541b992..171f69ec4b9 100644 --- a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-44a8e0d0-b8f5-11ed-ac9b-cb6bcd97d223.json +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-44a8e0d0-b8f5-11ed-ac9b-cb6bcd97d223.json @@ -52,12 +52,12 @@ }, { "id": "logs-*", - "name": "ea2ab93a-4a2f-433e-81ea-74069ab85ae2", + "name": "167c0497-503a-417c-a30c-768525e8b8dc", "type": "index-pattern" }, { "id": "logs-*", - "name": "6325ecc7-745a-4885-8e55-673da3cc467f", + "name": "8c6e9f3c-a1db-4cf0-8b30-1d860be11d98", "type": "index-pattern" } ], @@ -132,7 +132,7 @@ "meta": { "alias": null, "disabled": false, - "index": "ea2ab93a-4a2f-433e-81ea-74069ab85ae2", + "index": "167c0497-503a-417c-a30c-768525e8b8dc", "key": "event.dataset", "negate": false, "params": { @@ -154,7 +154,7 @@ "alias": null, "disabled": false, "field": "http.response.status_code", - "index": "6325ecc7-745a-4885-8e55-673da3cc467f", + "index": "8c6e9f3c-a1db-4cf0-8b30-1d860be11d98", "key": "http.response.status_code", "negate": false, "params": { @@ -791,6 +791,7 @@ { "embeddableConfig": { "attributes": { + "description": "", "references": [ { "id": "logs-*", @@ -799,7 +800,12 @@ }, { "id": "logs-*", - "name": "1f241a4d-3837-4d53-a4e2-d6b3b23f0966", + "name": "4b8a9e86-71d4-4b03-9049-bf28ec63ac90", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d346bac-67c0-4aed-ad35-3a5693fc2836", "type": "index-pattern" } ], @@ -845,7 +851,7 @@ "dataType": "number", "filter": { "language": "kuery", - "query": "http.response.status_code \u003e= 400 and http.response.status_code \u003c600" + "query": "" }, "isBucketed": false, "label": "Count", @@ -874,7 +880,7 @@ "meta": { "alias": null, "disabled": false, - "index": "1f241a4d-3837-4d53-a4e2-d6b3b23f0966", + "index": "4b8a9e86-71d4-4b03-9049-bf28ec63ac90", "key": "event.dataset", "negate": false, "params": { @@ -887,6 +893,36 @@ "event.dataset": "apache_tomcat.access" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "http.response.status_code", + "index": "8d346bac-67c0-4aed-ad35-3a5693fc2836", + "key": "http.response.status_code", + "negate": false, + "params": { + "gte": "400", + "lt": "599" + }, + "type": "range", + "value": { + "gte": "400", + "lt": "599" + } + }, + "query": { + "range": { + "http.response.status_code": { + "gte": "400", + "lt": "599" + } + } + } } ], "internalReferences": [], @@ -930,7 +966,7 @@ "y": 30 }, "panelIndex": "911f0638-46a9-4967-b588-a05fddc3ed62", - "title": "Distribution by HTTP Client and Server error status code [Logs Apache Tomcat]", + "title": "Distribution by HTTP Client(4xx) and Server(5xx) error status code [Logs Apache Tomcat]", "type": "lens", "version": "8.7.0" }, @@ -1204,7 +1240,8 @@ }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1224,7 +1261,7 @@ "version": 1 }, "coreMigrationVersion": "8.7.0", - "created_at": "2023-05-08T13:43:13.601Z", + "created_at": "2023-07-24T12:48:07.116Z", "id": "apache_tomcat-44a8e0d0-b8f5-11ed-ac9b-cb6bcd97d223", "migrationVersion": { "dashboard": "8.7.0" @@ -1242,12 +1279,12 @@ }, { "id": "logs-*", - "name": "af3cd65d-02e9-477c-8b3b-45f4b717a982:ea2ab93a-4a2f-433e-81ea-74069ab85ae2", + "name": "af3cd65d-02e9-477c-8b3b-45f4b717a982:167c0497-503a-417c-a30c-768525e8b8dc", "type": "index-pattern" }, { "id": "logs-*", - "name": "af3cd65d-02e9-477c-8b3b-45f4b717a982:6325ecc7-745a-4885-8e55-673da3cc467f", + "name": "af3cd65d-02e9-477c-8b3b-45f4b717a982:8c6e9f3c-a1db-4cf0-8b30-1d860be11d98", "type": "index-pattern" }, { @@ -1297,7 +1334,12 @@ }, { "id": "logs-*", - "name": "911f0638-46a9-4967-b588-a05fddc3ed62:1f241a4d-3837-4d53-a4e2-d6b3b23f0966", + "name": "911f0638-46a9-4967-b588-a05fddc3ed62:4b8a9e86-71d4-4b03-9049-bf28ec63ac90", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "911f0638-46a9-4967-b588-a05fddc3ed62:8d346bac-67c0-4aed-ad35-3a5693fc2836", "type": "index-pattern" }, { diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-5b24a9c0-0e86-11ee-8c11-879004e1a267.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-5b24a9c0-0e86-11ee-8c11-879004e1a267.json new file mode 100644 index 00000000000..9bb4ee02c9c --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-5b24a9c0-0e86-11ee-8c11-879004e1a267.json @@ -0,0 +1,982 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"77e2e883-4872-4992-80ef-ad4bce414173\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"77e2e883-4872-4992-80ef-ad4bce414173\",\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"enhancements\":{},\"singleSelect\":true}},\"1d674dc5-5d99-4ffc-80ab-8d55f3c9961b\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1d674dc5-5d99-4ffc-80ab-8d55f3c9961b\",\"fieldName\":\"apache_tomcat.thread_pool.nio_connector\",\"title\":\"Nio Connector\",\"enhancements\":{},\"singleSelect\":true}}}" + }, + "description": "This Apache Tomcat dashboard visualizes Thread Pool data stream metrics.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-05b7c993-53aa-433b-9754-7c1d297dbbad", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "37c53ea7-8de0-4acb-955f-38c67bd51b0a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "05b7c993-53aa-433b-9754-7c1d297dbbad": { + "columnOrder": [ + "959d96eb-d216-4f84-8c5c-4cafd358cb48" + ], + "columns": { + "959d96eb-d216-4f84-8c5c-4cafd358cb48": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.total: *" + }, + "isBucketed": false, + "label": "Total threads", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.total" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "37c53ea7-8de0-4acb-955f-38c67bd51b0a", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFF", + "layerId": "05b7c993-53aa-433b-9754-7c1d297dbbad", + "layerType": "data", + "metricAccessor": "959d96eb-d216-4f84-8c5c-4cafd358cb48", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "description": "Total number of created or started threads at JVM level (from java.lang:type=Threading).", + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 10, + "i": "f9c94977-dd52-43b4-922f-4341aacacf07", + "w": 9, + "x": 0, + "y": 0 + }, + "panelIndex": "f9c94977-dd52-43b4-922f-4341aacacf07", + "title": "Total threads [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-a6c3093d-5a17-4f06-831e-4bc8428628cf", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5b583af7-2a44-43ac-b787-9d6fc93f6374", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a6c3093d-5a17-4f06-831e-4bc8428628cf": { + "columnOrder": [ + "8b8f505d-9584-47f2-a09c-f5f0ba2c2bca", + "954c993d-42e0-4b02-8b56-fcfd5cbcab88", + "8471118f-6052-464a-9837-55cd8d147d9e", + "be178c96-9061-49bc-84af-9e82883a5dcf", + "27fb64e4-2a65-4aff-944e-0ae665894c3c", + "bbd32239-3193-47dd-913d-272d1040ef26" + ], + "columns": { + "27fb64e4-2a65-4aff-944e-0ae665894c3c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.active.count: *" + }, + "isBucketed": false, + "label": "Active", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.active.count" + }, + "8471118f-6052-464a-9837-55cd8d147d9e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.current.busy: *" + }, + "isBucketed": false, + "label": "Busy", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.current.busy" + }, + "8b8f505d-9584-47f2-a09c-f5f0ba2c2bca": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "954c993d-42e0-4b02-8b56-fcfd5cbcab88": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.current.count: *" + }, + "isBucketed": false, + "label": "Current", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.current.count" + }, + "bbd32239-3193-47dd-913d-272d1040ef26": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.peak.count: *" + }, + "isBucketed": false, + "label": "Peak", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.peak.count" + }, + "be178c96-9061-49bc-84af-9e82883a5dcf": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.daemon.count: *" + }, + "isBucketed": false, + "label": "Daemon", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.daemon.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "5b583af7-2a44-43ac-b787-9d6fc93f6374", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "954c993d-42e0-4b02-8b56-fcfd5cbcab88", + "be178c96-9061-49bc-84af-9e82883a5dcf", + "8471118f-6052-464a-9837-55cd8d147d9e", + "27fb64e4-2a65-4aff-944e-0ae665894c3c", + "bbd32239-3193-47dd-913d-272d1040ef26" + ], + "layerId": "a6c3093d-5a17-4f06-831e-4bc8428628cf", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "8b8f505d-9584-47f2-a09c-f5f0ba2c2bca" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "Active threads represent Current active threads at the JVM level (from java.lang:type=Threading), Current threads represent Current number of threads that are taken from the ThreadPool and Peak threads represent Peak threads at the JVM level (from java.lang:type=Threading)", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "29239466-a1a0-456b-a1f8-5209e6c26339", + "w": 39, + "x": 9, + "y": 4 + }, + "panelIndex": "29239466-a1a0-456b-a1f8-5209e6c26339", + "title": "Threads count by state over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1f96fdb7-93b8-4ced-9765-f891869c6b47", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e1e0cfc0-ff9f-4f4c-924a-a4d5ebc4d2ee", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2a8c013c-a759-4b11-81f2-65a7797491c7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1f96fdb7-93b8-4ced-9765-f891869c6b47": { + "columnOrder": [ + "252c4f53-feef-4ec8-a461-c51904bfb922", + "eecc178b-3354-4d0f-a1b8-6c9f310c0435" + ], + "columns": { + "252c4f53-feef-4ec8-a461-c51904bfb922": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "eecc178b-3354-4d0f-a1b8-6c9f310c0435": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.connection.count: *" + }, + "isBucketed": false, + "label": "Count", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.connection.count" + } + }, + "incompleteColumns": {}, + "linkToLayers": [], + "sampling": 1 + }, + "e1e0cfc0-ff9f-4f4c-924a-a4d5ebc4d2ee": { + "columnOrder": [ + "f4bd05a0-a4cc-4750-8410-005076687bcd", + "c721065e-935e-481e-8a3e-abd99147d6d4" + ], + "columns": { + "c721065e-935e-481e-8a3e-abd99147d6d4": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.connection.max: *" + }, + "isBucketed": false, + "label": "Max", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.connection.max" + }, + "f4bd05a0-a4cc-4750-8410-005076687bcd": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "2a8c013c-a759-4b11-81f2-65a7797491c7", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c721065e-935e-481e-8a3e-abd99147d6d4" + ], + "layerId": "e1e0cfc0-ff9f-4f4c-924a-a4d5ebc4d2ee", + "layerType": "data", + "seriesType": "line", + "xAccessor": "f4bd05a0-a4cc-4750-8410-005076687bcd", + "yConfig": [ + { + "color": "#e7664c", + "forAccessor": "c721065e-935e-481e-8a3e-abd99147d6d4" + } + ] + }, + { + "accessors": [ + "eecc178b-3354-4d0f-a1b8-6c9f310c0435" + ], + "layerId": "1f96fdb7-93b8-4ced-9765-f891869c6b47", + "layerType": "data", + "seriesType": "area", + "xAccessor": "252c4f53-feef-4ec8-a461-c51904bfb922", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "eecc178b-3354-4d0f-a1b8-6c9f310c0435" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Connections" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "a4b1a059-57c5-469a-9c83-936263c4c73c", + "w": 48, + "x": 0, + "y": 11 + }, + "panelIndex": "a4b1a059-57c5-469a-9c83-936263c4c73c", + "title": "Number of connections over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-76459985-8ced-4307-8994-b36fcde849cc", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "d2a87cd7-ddfb-45b0-81cd-64a63f6b2290", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "76459985-8ced-4307-8994-b36fcde849cc": { + "columnOrder": [ + "c1982a59-1a97-48a0-b4ca-e19acaf9dac4", + "ec31966f-73dd-41db-b36b-c9a378fd3c37" + ], + "columns": { + "c1982a59-1a97-48a0-b4ca-e19acaf9dac4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec31966f-73dd-41db-b36b-c9a378fd3c37": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.current.allocated.bytes: *" + }, + "isBucketed": false, + "label": "Allocated bytes in current threads", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.current.allocated.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d2a87cd7-ddfb-45b0-81cd-64a63f6b2290", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ec31966f-73dd-41db-b36b-c9a378fd3c37" + ], + "layerId": "76459985-8ced-4307-8994-b36fcde849cc", + "layerType": "data", + "seriesType": "line", + "xAccessor": "c1982a59-1a97-48a0-b4ca-e19acaf9dac4" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yTitle": "Bytes" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "31540e97-068b-4767-b7bd-373d35f8c6fe", + "w": 48, + "x": 0, + "y": 22 + }, + "panelIndex": "31540e97-068b-4767-b7bd-373d35f8c6fe", + "title": "Allocated bytes in current threads over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Time that the private internal executor will wait for request processing threads to terminate before continuing with the process of stopping the connector.", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b6e6d14b-5440-4a1c-882f-a698d66eacfb", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9bb893c7-c116-49ed-99b8-2e35efd24bf3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b6e6d14b-5440-4a1c-882f-a698d66eacfb": { + "columnOrder": [ + "20c1d4cc-f690-485c-93ef-5dd9c3e7e245", + "396ec4b2-d505-431b-8598-239292105dfa" + ], + "columns": { + "20c1d4cc-f690-485c-93ef-5dd9c3e7e245": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "396ec4b2-d505-431b-8598-239292105dfa": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.executor_termination.timeout.ms: *" + }, + "isBucketed": false, + "label": "Time (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.executor_termination.timeout.ms" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9bb893c7-c116-49ed-99b8-2e35efd24bf3", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "396ec4b2-d505-431b-8598-239292105dfa" + ], + "layerId": "b6e6d14b-5440-4a1c-882f-a698d66eacfb", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "20c1d4cc-f690-485c-93ef-5dd9c3e7e245" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "Time that the private internal executor will wait for request processing threads to terminate before continuing with the process of stopping the connector.", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "5756b1ad-a32f-4248-8337-9cce4fb74b3e", + "w": 48, + "x": 0, + "y": 33 + }, + "panelIndex": "5756b1ad-a32f-4248-8337-9cce4fb74b3e", + "title": "Processing threads termination time over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Metrics Apache Tomcat] Thread Pool", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-19T08:01:33.946Z", + "id": "apache_tomcat-5b24a9c0-0e86-11ee-8c11-879004e1a267", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f9c94977-dd52-43b4-922f-4341aacacf07:indexpattern-datasource-layer-05b7c993-53aa-433b-9754-7c1d297dbbad", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f9c94977-dd52-43b4-922f-4341aacacf07:37c53ea7-8de0-4acb-955f-38c67bd51b0a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "29239466-a1a0-456b-a1f8-5209e6c26339:indexpattern-datasource-layer-a6c3093d-5a17-4f06-831e-4bc8428628cf", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "29239466-a1a0-456b-a1f8-5209e6c26339:5b583af7-2a44-43ac-b787-9d6fc93f6374", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a4b1a059-57c5-469a-9c83-936263c4c73c:indexpattern-datasource-layer-1f96fdb7-93b8-4ced-9765-f891869c6b47", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a4b1a059-57c5-469a-9c83-936263c4c73c:indexpattern-datasource-layer-e1e0cfc0-ff9f-4f4c-924a-a4d5ebc4d2ee", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a4b1a059-57c5-469a-9c83-936263c4c73c:2a8c013c-a759-4b11-81f2-65a7797491c7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "31540e97-068b-4767-b7bd-373d35f8c6fe:indexpattern-datasource-layer-76459985-8ced-4307-8994-b36fcde849cc", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "31540e97-068b-4767-b7bd-373d35f8c6fe:d2a87cd7-ddfb-45b0-81cd-64a63f6b2290", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5756b1ad-a32f-4248-8337-9cce4fb74b3e:indexpattern-datasource-layer-b6e6d14b-5440-4a1c-882f-a698d66eacfb", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5756b1ad-a32f-4248-8337-9cce4fb74b3e:9bb893c7-c116-49ed-99b8-2e35efd24bf3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_77e2e883-4872-4992-80ef-ad4bce414173:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_1d674dc5-5d99-4ffc-80ab-8d55f3c9961b:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-8fd54a20-1f0d-11ee-9d6b-bb41d08322c8.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-8fd54a20-1f0d-11ee-9d6b-bb41d08322c8.json new file mode 100644 index 00000000000..71bf9e6dd49 --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-8fd54a20-1f0d-11ee-9d6b-bb41d08322c8.json @@ -0,0 +1,702 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"fc0ca4ed-ecfc-4255-a799-24675b4a1206\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fc0ca4ed-ecfc-4255-a799-24675b4a1206\",\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"singleSelect\":false,\"enhancements\":{}}}}" + }, + "description": "This Apache Tomcat dashboard visualizes all logs data streams.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.module", + "negate": false, + "params": { + "query": "apache_tomcat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "apache_tomcat" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b6532743-79d3-4ab0-bdfa-fff8aa69c7a9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "55ba9c87-2de6-468b-ae00-ab24cdb6c2d7": { + "columnOrder": [ + "932c5d98-32f4-4a94-9051-563bcd1931fa", + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff" + ], + "columns": { + "932c5d98-32f4-4a94-9051-563bcd1931fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "HTTP Status Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9fb85e3f-ca9d-47db-b236-88d3e03e5fff", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + }, + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b6532743-79d3-4ab0-bdfa-fff8aa69c7a9", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.access" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.access" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "932c5d98-32f4-4a94-9051-563bcd1931fa" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b089289a-38be-4f6f-8519-ef9b20a77409", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "b089289a-38be-4f6f-8519-ef9b20a77409", + "title": "Distribution by HTTP status code [Logs Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "25ce66fb-534d-42a3-9baf-e3c7768ee2d6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "adb3c9a7-d289-4c05-9c2b-0791a5c482ff", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "55ba9c87-2de6-468b-ae00-ab24cdb6c2d7": { + "columnOrder": [ + "932c5d98-32f4-4a94-9051-563bcd1931fa", + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff" + ], + "columns": { + "932c5d98-32f4-4a94-9051-563bcd1931fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "HTTP Status Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9fb85e3f-ca9d-47db-b236-88d3e03e5fff", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + }, + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "25ce66fb-534d-42a3-9baf-e3c7768ee2d6", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.access" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.access" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "http.response.status_code", + "index": "adb3c9a7-d289-4c05-9c2b-0791a5c482ff", + "key": "http.response.status_code", + "negate": false, + "params": { + "gte": "400", + "lt": "599" + }, + "type": "range", + "value": { + "gte": "400", + "lt": "599" + } + }, + "query": { + "range": { + "http.response.status_code": { + "gte": "400", + "lt": "599" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "9fb85e3f-ca9d-47db-b236-88d3e03e5fff" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "932c5d98-32f4-4a94-9051-563bcd1931fa" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2f7de9ea-b38c-4a20-9f50-2c50f76f450d", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "2f7de9ea-b38c-4a20-9f50-2c50f76f450d", + "title": "Distribution by HTTP Client(4xx) and Server(5xx) error status code [Logs Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d30a1b56-5918-4732-850a-381fab2c59fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "44d71f68-2675-4ed4-adb5-9f2bdce23a3a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfb45038-17c1-40f9-b31e-916d1eefc5c6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d30a1b56-5918-4732-850a-381fab2c59fb": { + "columnOrder": [ + "daff9bcb-6674-42f0-a1eb-2d9cada6a05f", + "cfc457cd-293c-4d73-8513-899d7d32f03d", + "10a85224-53f8-4655-9305-57d024227f99" + ], + "columns": { + "10a85224-53f8-4655-9305-57d024227f99": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Error count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cfc457cd-293c-4d73-8513-899d7d32f03d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "URLs", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "10a85224-53f8-4655-9305-57d024227f99", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "daff9bcb-6674-42f0-a1eb-2d9cada6a05f": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Host", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "10a85224-53f8-4655-9305-57d024227f99", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "44d71f68-2675-4ed4-adb5-9f2bdce23a3a", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.access" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.access" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "http.response.status_code", + "index": "cfb45038-17c1-40f9-b31e-916d1eefc5c6", + "key": "http.response.status_code", + "negate": false, + "params": { + "gte": "400", + "lt": "600" + }, + "type": "range", + "value": { + "gte": "400", + "lt": "600" + } + }, + "query": { + "range": { + "http.response.status_code": { + "gte": "400", + "lt": "600" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "center", + "columnId": "10a85224-53f8-4655-9305-57d024227f99", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "daff9bcb-6674-42f0-a1eb-2d9cada6a05f", + "isTransposed": false, + "oneClickFilter": false + }, + { + "alignment": "left", + "columnId": "cfc457cd-293c-4d73-8513-899d7d32f03d", + "isTransposed": false, + "oneClickFilter": true + } + ], + "headerRowHeight": "auto", + "layerId": "d30a1b56-5918-4732-850a-381fab2c59fb", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "auto" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e87fc489-df1a-4f67-9d91-7b3383fcb8c7", + "w": 48, + "x": 0, + "y": 15 + }, + "panelIndex": "e87fc489-df1a-4f67-9d91-7b3383fcb8c7", + "title": "Top error causing URLs with hosts [Logs Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f02e494c-1b62-407e-a402-7799e9fab580", + "w": 48, + "x": 0, + "y": 30 + }, + "panelIndex": "f02e494c-1b62-407e-a402-7799e9fab580", + "panelRefName": "panel_f02e494c-1b62-407e-a402-7799e9fab580", + "title": "Catalina Logs overview [Logs Apache Tomcat]", + "type": "search", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9940557b-4932-4f76-8aec-029ddac34539", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "9940557b-4932-4f76-8aec-029ddac34539", + "panelRefName": "panel_9940557b-4932-4f76-8aec-029ddac34539", + "title": "Localhost Logs overview [Logs Apache Tomcat]", + "type": "search", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Logs Apache Tomcat] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-24T12:48:07.116Z", + "id": "apache_tomcat-8fd54a20-1f0d-11ee-9d6b-bb41d08322c8", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b089289a-38be-4f6f-8519-ef9b20a77409:indexpattern-datasource-layer-55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b089289a-38be-4f6f-8519-ef9b20a77409:b6532743-79d3-4ab0-bdfa-fff8aa69c7a9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f7de9ea-b38c-4a20-9f50-2c50f76f450d:indexpattern-datasource-layer-55ba9c87-2de6-468b-ae00-ab24cdb6c2d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f7de9ea-b38c-4a20-9f50-2c50f76f450d:25ce66fb-534d-42a3-9baf-e3c7768ee2d6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f7de9ea-b38c-4a20-9f50-2c50f76f450d:adb3c9a7-d289-4c05-9c2b-0791a5c482ff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e87fc489-df1a-4f67-9d91-7b3383fcb8c7:indexpattern-datasource-layer-d30a1b56-5918-4732-850a-381fab2c59fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e87fc489-df1a-4f67-9d91-7b3383fcb8c7:44d71f68-2675-4ed4-adb5-9f2bdce23a3a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e87fc489-df1a-4f67-9d91-7b3383fcb8c7:cfb45038-17c1-40f9-b31e-916d1eefc5c6", + "type": "index-pattern" + }, + { + "id": "apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195", + "name": "f02e494c-1b62-407e-a402-7799e9fab580:panel_f02e494c-1b62-407e-a402-7799e9fab580", + "type": "search" + }, + { + "id": "apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c", + "name": "9940557b-4932-4f76-8aec-029ddac34539:panel_9940557b-4932-4f76-8aec-029ddac34539", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_fc0ca4ed-ecfc-4255-a799-24675b4a1206:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-9c66eb10-dd0c-11ed-9f4f-d97c9f37d195.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-9c66eb10-dd0c-11ed-9f4f-d97c9f37d195.json index b837b64fbc1..3e2812e7449 100644 --- a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-9c66eb10-dd0c-11ed-9f4f-d97c9f37d195.json +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-9c66eb10-dd0c-11ed-9f4f-d97c9f37d195.json @@ -205,9 +205,9 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 14, "i": "ce217a0a-1038-4867-b22b-c51765d12c99", - "w": 17, + "w": 24, "x": 0, "y": 0 }, @@ -216,27 +216,10 @@ "type": "lens", "version": "8.7.0" }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "8901474e-f646-4eb9-b734-667804d70207", - "w": 31, - "x": 17, - "y": 15 - }, - "panelIndex": "8901474e-f646-4eb9-b734-667804d70207", - "panelRefName": "panel_8901474e-f646-4eb9-b734-667804d70207", - "title": "Localhost Logs overview [Logs Apache Tomcat]", - "type": "search", - "version": "8.7.0" - }, { "embeddableConfig": { "attributes": { + "description": "", "references": [ { "id": "logs-*", @@ -245,7 +228,7 @@ }, { "id": "logs-*", - "name": "3cff818b-98f7-499c-bb64-5feae903ac17", + "name": "1fb283e4-af20-4f0b-b875-baaaacd84281", "type": "index-pattern" } ], @@ -317,7 +300,7 @@ "alias": null, "disabled": false, "field": "event.dataset", - "index": "3cff818b-98f7-499c-bb64-5feae903ac17", + "index": "1fb283e4-af20-4f0b-b875-baaaacd84281", "key": "event.dataset", "negate": false, "params": { @@ -344,7 +327,6 @@ "layerId": "996302ea-5ca4-458a-b92b-8b1c8e76adf6", "layerType": "data", "legendDisplay": "show", - "legendSize": "small", "metrics": [ "0ef3cc80-154a-4270-a59b-e47e5916cba5" ], @@ -367,11 +349,11 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 14, "i": "e48f4633-1502-44e1-b093-2b9bc378d24c", - "w": 17, - "x": 0, - "y": 15 + "w": 24, + "x": 24, + "y": 0 }, "panelIndex": "e48f4633-1502-44e1-b093-2b9bc378d24c", "title": "Distribution of Localhost events by log level [Logs Apache Tomcat]", @@ -384,17 +366,35 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 14, "i": "e9897b3c-32b2-4c12-9510-4e1685ecb611", - "w": 31, - "x": 17, - "y": 0 + "w": 48, + "x": 0, + "y": 14 }, "panelIndex": "e9897b3c-32b2-4c12-9510-4e1685ecb611", "panelRefName": "panel_e9897b3c-32b2-4c12-9510-4e1685ecb611", "title": "Catalina Logs overview [Logs Apache Tomcat]", "type": "search", "version": "8.7.0" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "8901474e-f646-4eb9-b734-667804d70207", + "w": 48, + "x": 0, + "y": 28 + }, + "panelIndex": "8901474e-f646-4eb9-b734-667804d70207", + "panelRefName": "panel_8901474e-f646-4eb9-b734-667804d70207", + "title": "Localhost Logs overview [Logs Apache Tomcat]", + "type": "search", + "version": "8.7.0" } ], "timeRestore": false, @@ -402,7 +402,7 @@ "version": 1 }, "coreMigrationVersion": "8.7.0", - "created_at": "2023-05-09T09:59:39.804Z", + "created_at": "2023-07-24T10:47:18.401Z", "id": "apache_tomcat-9c66eb10-dd0c-11ed-9f4f-d97c9f37d195", "migrationVersion": { "dashboard": "8.7.0" @@ -423,11 +423,6 @@ "name": "ce217a0a-1038-4867-b22b-c51765d12c99:be7a31fc-fdbf-4791-81bc-e7c6f7fd4e72", "type": "index-pattern" }, - { - "id": "apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c", - "name": "8901474e-f646-4eb9-b734-667804d70207:panel_8901474e-f646-4eb9-b734-667804d70207", - "type": "search" - }, { "id": "logs-*", "name": "e48f4633-1502-44e1-b093-2b9bc378d24c:indexpattern-datasource-layer-996302ea-5ca4-458a-b92b-8b1c8e76adf6", @@ -435,13 +430,18 @@ }, { "id": "logs-*", - "name": "e48f4633-1502-44e1-b093-2b9bc378d24c:3cff818b-98f7-499c-bb64-5feae903ac17", + "name": "e48f4633-1502-44e1-b093-2b9bc378d24c:1fb283e4-af20-4f0b-b875-baaaacd84281", "type": "index-pattern" }, { "id": "apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195", "name": "e9897b3c-32b2-4c12-9510-4e1685ecb611:panel_e9897b3c-32b2-4c12-9510-4e1685ecb611", "type": "search" + }, + { + "id": "apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c", + "name": "8901474e-f646-4eb9-b734-667804d70207:panel_8901474e-f646-4eb9-b734-667804d70207", + "type": "search" } ], "type": "dashboard" diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-af7759b0-0a75-11ee-a8d8-d15950a587f6.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-af7759b0-0a75-11ee-a8d8-d15950a587f6.json new file mode 100644 index 00000000000..dde26173ef3 --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-af7759b0-0a75-11ee-a8d8-d15950a587f6.json @@ -0,0 +1,499 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"3503af0f-80d1-487e-8fa3-e470f20f9f8b\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"3503af0f-80d1-487e-8fa3-e470f20f9f8b\",\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"enhancements\":{},\"singleSelect\":true}},\"80f0e8b9-8077-4aec-bcea-2cc806ff57ed\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"80f0e8b9-8077-4aec-bcea-2cc806ff57ed\",\"fieldName\":\"apache_tomcat.connection_pool.application_name\",\"title\":\"Application Name\",\"enhancements\":{},\"selectedOptions\":[],\"singleSelect\":true}}}" + }, + "description": "This Apache Tomcat dashboard visualizes connection pool data stream metrics.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.connection_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.connection_pool" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e325a4cc-4f13-45e6-ad1d-ab520a86078f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "d754c647-0a3e-4949-b974-ae09a1bc847d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e325a4cc-4f13-45e6-ad1d-ab520a86078f": { + "columnOrder": [ + "85eeb55f-dc5a-4e6a-95be-bae70a4539b4", + "a595aca1-c1f6-4115-b83f-5624fefff173", + "ffa09b26-9189-492d-8e79-da9b5f6183b8" + ], + "columns": { + "85eeb55f-dc5a-4e6a-95be-bae70a4539b4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a595aca1-c1f6-4115-b83f-5624fefff173": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.active.count: *" + }, + "isBucketed": false, + "label": "Active connections", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.active.count" + }, + "ffa09b26-9189-492d-8e79-da9b5f6183b8": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.idle.count: *" + }, + "isBucketed": false, + "label": "Idle connections", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.idle.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "d754c647-0a3e-4949-b974-ae09a1bc847d", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.connection_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.connection_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a595aca1-c1f6-4115-b83f-5624fefff173", + "ffa09b26-9189-492d-8e79-da9b5f6183b8" + ], + "layerId": "e325a4cc-4f13-45e6-ad1d-ab520a86078f", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "85eeb55f-dc5a-4e6a-95be-bae70a4539b4" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 20, + "i": "8379c1c8-9392-4af4-a7f4-e625811a8f12", + "w": 38, + "x": 0, + "y": 0 + }, + "panelIndex": "8379c1c8-9392-4af4-a7f4-e625811a8f12", + "title": "Connections over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-bf37fdfd-568b-4d88-8698-f487013d0e7a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c82a919f-342a-40fb-b752-e7d04fed8ff7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bf37fdfd-568b-4d88-8698-f487013d0e7a": { + "columnOrder": [ + "d8899acf-91a6-4a42-9f2b-2c4724b59a49" + ], + "columns": { + "d8899acf-91a6-4a42-9f2b-2c4724b59a49": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.active.count: *" + }, + "isBucketed": false, + "label": "Active connections", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.active.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "c82a919f-342a-40fb-b752-e7d04fed8ff7", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.connection_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.connection_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFF", + "layerId": "bf37fdfd-568b-4d88-8698-f487013d0e7a", + "layerType": "data", + "metricAccessor": "d8899acf-91a6-4a42-9f2b-2c4724b59a49", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 10, + "i": "f170f694-3b15-4d7f-8d02-93721b07841a", + "w": 10, + "x": 38, + "y": 0 + }, + "panelIndex": "f170f694-3b15-4d7f-8d02-93721b07841a", + "title": "Active connections [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-bf37fdfd-568b-4d88-8698-f487013d0e7a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "18d6b810-b483-4c38-8003-439a9795566e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bf37fdfd-568b-4d88-8698-f487013d0e7a": { + "columnOrder": [ + "37ab7957-367f-4788-8d40-2bb3abf57bb8" + ], + "columns": { + "37ab7957-367f-4788-8d40-2bb3abf57bb8": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.idle.count: *" + }, + "isBucketed": false, + "label": "Idle connections", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.idle.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "18d6b810-b483-4c38-8003-439a9795566e", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.connection_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.connection_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFF", + "layerId": "bf37fdfd-568b-4d88-8698-f487013d0e7a", + "layerType": "data", + "metricAccessor": "37ab7957-367f-4788-8d40-2bb3abf57bb8", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 10, + "i": "4ba1c352-1167-4214-a1e0-a8acb13e59aa", + "w": 10, + "x": 38, + "y": 10 + }, + "panelIndex": "4ba1c352-1167-4214-a1e0-a8acb13e59aa", + "title": "Idle connections [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Metrics Apache Tomcat] Connection Pool", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-06-30T05:14:49.407Z", + "id": "apache_tomcat-af7759b0-0a75-11ee-a8d8-d15950a587f6", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8379c1c8-9392-4af4-a7f4-e625811a8f12:indexpattern-datasource-layer-e325a4cc-4f13-45e6-ad1d-ab520a86078f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8379c1c8-9392-4af4-a7f4-e625811a8f12:d754c647-0a3e-4949-b974-ae09a1bc847d", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f170f694-3b15-4d7f-8d02-93721b07841a:indexpattern-datasource-layer-bf37fdfd-568b-4d88-8698-f487013d0e7a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f170f694-3b15-4d7f-8d02-93721b07841a:c82a919f-342a-40fb-b752-e7d04fed8ff7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "4ba1c352-1167-4214-a1e0-a8acb13e59aa:indexpattern-datasource-layer-bf37fdfd-568b-4d88-8698-f487013d0e7a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "4ba1c352-1167-4214-a1e0-a8acb13e59aa:18d6b810-b483-4c38-8003-439a9795566e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_3503af0f-80d1-487e-8fa3-e470f20f9f8b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_80f0e8b9-8077-4aec-bcea-2cc806ff57ed:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c2e71320-bccb-11ed-8065-19219c0d55ab.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c2e71320-bccb-11ed-8065-19219c0d55ab.json new file mode 100644 index 00000000000..30ac4e11b58 --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c2e71320-bccb-11ed-8065-19219c0d55ab.json @@ -0,0 +1,1246 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"40090461-b167-4b82-8ae3-e1326133b845\":{\"order\":0,\"width\":\"medium\",\"grow\":false,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"service.address\",\"title\":\"Hostname\",\"id\":\"40090461-b167-4b82-8ae3-e1326133b845\",\"selectedOptions\":[],\"enhancements\":{},\"singleSelect\":true}}}" + }, + "description": "This Apache Tomcat dashboard visualizes memory data stream metrics.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "apache_tomcat.memory" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7a97f25c-2c29-43be-a9d9-227e78aa4824", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "424f182e-1baf-4bc9-a7a6-74f1ca6881ef", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "603b89be-e03d-4ed5-83b6-4ca7c19f41aa": { + "columnOrder": [ + "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac" + ], + "columns": { + "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Heap memory usage", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.used.bytes" + } + }, + "incompleteColumns": {} + }, + "7a97f25c-2c29-43be-a9d9-227e78aa4824": { + "columnOrder": [ + "5a75a03a-9d36-44d3-8ff9-66d3de324ce5", + "f610bbb4-2cd9-45b1-b9a1-b61d89b32ee8" + ], + "columns": { + "5a75a03a-9d36-44d3-8ff9-66d3de324ce5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f610bbb4-2cd9-45b1-b9a1-b61d89b32ee8": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Heap memory usage", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.used.bytes" + } + }, + "incompleteColumns": {}, + "linkToLayers": [ + "603b89be-e03d-4ed5-83b6-4ca7c19f41aa" + ], + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "424f182e-1baf-4bc9-a7a6-74f1ca6881ef", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFF", + "icon": "empty", + "layerId": "603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "layerType": "data", + "metricAccessor": "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac", + "showBar": false, + "trendlineLayerId": "7a97f25c-2c29-43be-a9d9-227e78aa4824", + "trendlineLayerType": "metricTrendline", + "trendlineMetricAccessor": "f610bbb4-2cd9-45b1-b9a1-b61d89b32ee8", + "trendlineTimeAccessor": "5a75a03a-9d36-44d3-8ff9-66d3de324ce5" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 11, + "i": "7249a3d9-803b-4ddd-952f-0021fcfe7f58", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "7249a3d9-803b-4ddd-952f-0021fcfe7f58", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1be63b2a-edae-4674-a21f-4cc44d7ef2a4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b": { + "columnOrder": [ + "0dd778b3-8804-4a74-9807-284a48c0f474", + "cbcd07a6-0246-46f5-b746-22c186e60d4d" + ], + "columns": { + "0dd778b3-8804-4a74-9807-284a48c0f474": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cbcd07a6-0246-46f5-b746-22c186e60d4d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Used", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.used.bytes" + } + }, + "incompleteColumns": {} + }, + "ce5c86d1-5778-457d-a66f-8d2be35fdd09": { + "columnOrder": [ + "73ecedb4-176f-4c0d-aa3c-c0861634ecf3", + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6", + "9b37895d-2df4-48a1-8044-cbcd95046198", + "019aef94-5186-4949-8172-fd656fb1c550" + ], + "columns": { + "019aef94-5186-4949-8172-fd656fb1c550": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.max.bytes: *" + }, + "isBucketed": false, + "label": "Max", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.max.bytes" + }, + "73ecedb4-176f-4c0d-aa3c-c0861634ecf3": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.init.bytes: *" + }, + "isBucketed": false, + "label": "Init", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.init.bytes" + }, + "9b37895d-2df4-48a1-8044-cbcd95046198": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.committed.bytes: *" + }, + "isBucketed": false, + "label": "Commited", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.committed.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1be63b2a-edae-4674-a21f-4cc44d7ef2a4", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6", + "9b37895d-2df4-48a1-8044-cbcd95046198", + "019aef94-5186-4949-8172-fd656fb1c550" + ], + "layerId": "ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "73ecedb4-176f-4c0d-aa3c-c0861634ecf3", + "yConfig": [ + { + "color": "#8143ca", + "forAccessor": "7e8653c8-9ed6-465d-8288-9f6dc4c909f6" + }, + { + "color": "#d41515", + "forAccessor": "019aef94-5186-4949-8172-fd656fb1c550" + }, + { + "color": "#d6bf57", + "forAccessor": "9b37895d-2df4-48a1-8044-cbcd95046198" + } + ] + }, + { + "accessors": [ + "cbcd07a6-0246-46f5-b746-22c186e60d4d" + ], + "layerId": "832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "layerType": "data", + "seriesType": "bar", + "xAccessor": "0dd778b3-8804-4a74-9807-284a48c0f474", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "cbcd07a6-0246-46f5-b746-22c186e60d4d" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Memory" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "When the value for the maximum memory size (in bytes) is set to -1 for heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "ff461eaa-d936-4fbd-af56-72a528fdf515", + "w": 38, + "x": 10, + "y": 0 + }, + "panelIndex": "ff461eaa-d936-4fbd-af56-72a528fdf515", + "title": "Heap memory over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b9cb687d-7e05-469a-bc47-e9b07685a0d8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8708baa5-febb-4d77-9857-ba124b9c91f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "603b89be-e03d-4ed5-83b6-4ca7c19f41aa": { + "columnOrder": [ + "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac" + ], + "columns": { + "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Non-heap memory usage", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.used.bytes" + } + }, + "incompleteColumns": {} + }, + "b9cb687d-7e05-469a-bc47-e9b07685a0d8": { + "columnOrder": [ + "1b77df70-bf4a-4f5e-90e7-72fd4d33e42d", + "641fc5ee-3abf-4790-9d21-f5995f257dff" + ], + "columns": { + "1b77df70-bf4a-4f5e-90e7-72fd4d33e42d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "641fc5ee-3abf-4790-9d21-f5995f257dff": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Non-heap memory usage", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.used.bytes" + } + }, + "incompleteColumns": {}, + "linkToLayers": [ + "603b89be-e03d-4ed5-83b6-4ca7c19f41aa" + ], + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8708baa5-febb-4d77-9857-ba124b9c91f8", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "FFFFFF", + "layerId": "603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "layerType": "data", + "metricAccessor": "6d6a63fb-4d3d-49ce-bad9-f199c1b2f9ac", + "showBar": false, + "trendlineLayerId": "b9cb687d-7e05-469a-bc47-e9b07685a0d8", + "trendlineLayerType": "metricTrendline", + "trendlineMetricAccessor": "641fc5ee-3abf-4790-9d21-f5995f257dff", + "trendlineTimeAccessor": "1b77df70-bf4a-4f5e-90e7-72fd4d33e42d" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 11, + "i": "3b18802f-5ac5-48f1-8ba3-c46d37f86d47", + "w": 10, + "x": 0, + "y": 11 + }, + "panelIndex": "3b18802f-5ac5-48f1-8ba3-c46d37f86d47", + "title": "", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "4fba9f55-18c8-458c-9ee5-83936d0402ac", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b": { + "columnOrder": [ + "0dd778b3-8804-4a74-9807-284a48c0f474", + "cbcd07a6-0246-46f5-b746-22c186e60d4d" + ], + "columns": { + "0dd778b3-8804-4a74-9807-284a48c0f474": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cbcd07a6-0246-46f5-b746-22c186e60d4d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Used", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.used.bytes" + } + }, + "incompleteColumns": {} + }, + "ce5c86d1-5778-457d-a66f-8d2be35fdd09": { + "columnOrder": [ + "73ecedb4-176f-4c0d-aa3c-c0861634ecf3", + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6", + "9b37895d-2df4-48a1-8044-cbcd95046198", + "1a8d3154-9b7f-41e9-af52-64e4f0935387" + ], + "columns": { + "1a8d3154-9b7f-41e9-af52-64e4f0935387": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.max.bytes: *" + }, + "isBucketed": false, + "label": "Max", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.max.bytes" + }, + "73ecedb4-176f-4c0d-aa3c-c0861634ecf3": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.init.bytes: *" + }, + "isBucketed": false, + "label": "Init", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.init.bytes" + }, + "9b37895d-2df4-48a1-8044-cbcd95046198": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.committed.bytes: *" + }, + "isBucketed": false, + "label": "Commited", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.committed.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4fba9f55-18c8-458c-9ee5-83936d0402ac", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "7e8653c8-9ed6-465d-8288-9f6dc4c909f6", + "9b37895d-2df4-48a1-8044-cbcd95046198", + "1a8d3154-9b7f-41e9-af52-64e4f0935387" + ], + "layerId": "ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "73ecedb4-176f-4c0d-aa3c-c0861634ecf3", + "yConfig": [ + { + "color": "#8143ca", + "forAccessor": "7e8653c8-9ed6-465d-8288-9f6dc4c909f6" + }, + { + "color": "#e01212", + "forAccessor": "1a8d3154-9b7f-41e9-af52-64e4f0935387" + }, + { + "color": "#d6bf57", + "forAccessor": "9b37895d-2df4-48a1-8044-cbcd95046198" + } + ] + }, + { + "accessors": [ + "cbcd07a6-0246-46f5-b746-22c186e60d4d" + ], + "layerId": "832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "layerType": "data", + "seriesType": "bar", + "xAccessor": "0dd778b3-8804-4a74-9807-284a48c0f474", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "cbcd07a6-0246-46f5-b746-22c186e60d4d" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Memory" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "When the value for the maximum memory size (in bytes) is set to -1 for non-heap memory configurations, it indicates that the user has not specified a predefined size for the memory allocation", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "1c7a5509-3841-40a3-9b00-fd11ee6db933", + "w": 38, + "x": 10, + "y": 11 + }, + "panelIndex": "1c7a5509-3841-40a3-9b00-fd11ee6db933", + "title": "Non-heap memory over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-88daef46-ca28-45c1-b7cc-8f7ccff4842d", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-9664f1c8-ab27-4919-9805-e22529ee1f2c", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f7dd40ff-6ab5-4c72-9c14-3d9a3a1459c0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "88daef46-ca28-45c1-b7cc-8f7ccff4842d": { + "columnOrder": [ + "11293177-6826-46e6-a6f5-365beee20933", + "7da790e2-9037-4e7d-af92-513305d139e2" + ], + "columns": { + "11293177-6826-46e6-a6f5-365beee20933": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7da790e2-9037-4e7d-af92-513305d139e2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.gc.collection.time.ms: *" + }, + "isBucketed": false, + "label": "GC time(ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.gc.collection.time.ms" + } + }, + "incompleteColumns": {} + }, + "9664f1c8-ab27-4919-9805-e22529ee1f2c": { + "columnOrder": [ + "f5806bac-f641-4bfb-8be9-c3fb8728ee6d", + "78f1082b-f1fc-4ed4-98fd-fdb3b92bac32" + ], + "columns": { + "78f1082b-f1fc-4ed4-98fd-fdb3b92bac32": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.gc.collection.count: *" + }, + "isBucketed": false, + "label": "GC count", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.gc.collection.count" + }, + "f5806bac-f641-4bfb-8be9-c3fb8728ee6d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f7dd40ff-6ab5-4c72-9c14-3d9a3a1459c0", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "78f1082b-f1fc-4ed4-98fd-fdb3b92bac32" + ], + "layerId": "9664f1c8-ab27-4919-9805-e22529ee1f2c", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "xAccessor": "f5806bac-f641-4bfb-8be9-c3fb8728ee6d", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "78f1082b-f1fc-4ed4-98fd-fdb3b92bac32" + } + ] + }, + { + "accessors": [ + "7da790e2-9037-4e7d-af92-513305d139e2" + ], + "layerId": "88daef46-ca28-45c1-b7cc-8f7ccff4842d", + "layerType": "data", + "seriesType": "line", + "xAccessor": "11293177-6826-46e6-a6f5-365beee20933", + "yConfig": [ + { + "color": "#d6bf57", + "forAccessor": "7da790e2-9037-4e7d-af92-513305d139e2" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Garbage Collection" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "af80afbb-07f6-4f69-b475-2e5f19cfa60d", + "w": 48, + "x": 0, + "y": 22 + }, + "panelIndex": "af80afbb-07f6-4f69-b475-2e5f19cfa60d", + "title": "Garbage collection over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Metrics Apache Tomcat] Memory", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T10:55:22.442Z", + "id": "apache_tomcat-c2e71320-bccb-11ed-8065-19219c0d55ab", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7249a3d9-803b-4ddd-952f-0021fcfe7f58:indexpattern-datasource-layer-603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7249a3d9-803b-4ddd-952f-0021fcfe7f58:indexpattern-datasource-layer-7a97f25c-2c29-43be-a9d9-227e78aa4824", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7249a3d9-803b-4ddd-952f-0021fcfe7f58:424f182e-1baf-4bc9-a7a6-74f1ca6881ef", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ff461eaa-d936-4fbd-af56-72a528fdf515:indexpattern-datasource-layer-832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ff461eaa-d936-4fbd-af56-72a528fdf515:indexpattern-datasource-layer-ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ff461eaa-d936-4fbd-af56-72a528fdf515:1be63b2a-edae-4674-a21f-4cc44d7ef2a4", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3b18802f-5ac5-48f1-8ba3-c46d37f86d47:indexpattern-datasource-layer-603b89be-e03d-4ed5-83b6-4ca7c19f41aa", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3b18802f-5ac5-48f1-8ba3-c46d37f86d47:indexpattern-datasource-layer-b9cb687d-7e05-469a-bc47-e9b07685a0d8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3b18802f-5ac5-48f1-8ba3-c46d37f86d47:8708baa5-febb-4d77-9857-ba124b9c91f8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1c7a5509-3841-40a3-9b00-fd11ee6db933:indexpattern-datasource-layer-832a1cf4-a2fb-4da0-a1a9-e2e4ad75cf0b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1c7a5509-3841-40a3-9b00-fd11ee6db933:indexpattern-datasource-layer-ce5c86d1-5778-457d-a66f-8d2be35fdd09", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1c7a5509-3841-40a3-9b00-fd11ee6db933:4fba9f55-18c8-458c-9ee5-83936d0402ac", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "af80afbb-07f6-4f69-b475-2e5f19cfa60d:indexpattern-datasource-layer-88daef46-ca28-45c1-b7cc-8f7ccff4842d", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "af80afbb-07f6-4f69-b475-2e5f19cfa60d:indexpattern-datasource-layer-9664f1c8-ab27-4919-9805-e22529ee1f2c", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "af80afbb-07f6-4f69-b475-2e5f19cfa60d:f7dd40ff-6ab5-4c72-9c14-3d9a3a1459c0", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_40090461-b167-4b82-8ae3-e1326133b845:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c8ec7280-1a57-11ee-8c1a-099fb2bcb823.json b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c8ec7280-1a57-11ee-8c1a-099fb2bcb823.json new file mode 100644 index 00000000000..ab28ff8c7f7 --- /dev/null +++ b/packages/apache_tomcat/kibana/dashboard/apache_tomcat-c8ec7280-1a57-11ee-8c1a-099fb2bcb823.json @@ -0,0 +1,1509 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"389cb789-1fc8-43c8-b276-08d02bae4cee\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"389cb789-1fc8-43c8-b276-08d02bae4cee\",\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"singleSelect\":true,\"selectedOptions\":[],\"enhancements\":{}}}}" + }, + "description": "This Apache Tomcat dashboard visualizes all metrics data streams.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.module", + "negate": false, + "params": { + "query": "apache_tomcat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "apache_tomcat" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-99998251-2f00-4a88-bf98-07e7d8e3ac81", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-207a8774-23b1-43df-831f-56cb6d093dc0", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f3e87a81-2a03-49e7-b465-ae2e5540cfd7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "207a8774-23b1-43df-831f-56cb6d093dc0": { + "columnOrder": [ + "ecb80070-fb11-4e81-a168-fce13b5c6e79", + "9aee1c62-a8bb-4f94-8e6b-35914633c7bf" + ], + "columns": { + "9aee1c62-a8bb-4f94-8e6b-35914633c7bf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Applications", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.application_name" + }, + "ecb80070-fb11-4e81-a168-fce13b5c6e79": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "linkToLayers": [ + "99998251-2f00-4a88-bf98-07e7d8e3ac81" + ], + "sampling": 1 + }, + "99998251-2f00-4a88-bf98-07e7d8e3ac81": { + "columnOrder": [ + "403632df-7fa6-4f1b-8d06-d1a5c50081b5" + ], + "columns": { + "403632df-7fa6-4f1b-8d06-d1a5c50081b5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Applications", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "apache_tomcat.session.application_name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "f3e87a81-2a03-49e7-b465-ae2e5540cfd7", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.session" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.session" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "99998251-2f00-4a88-bf98-07e7d8e3ac81", + "layerType": "data", + "metricAccessor": "403632df-7fa6-4f1b-8d06-d1a5c50081b5", + "showBar": false, + "trendlineLayerId": "207a8774-23b1-43df-831f-56cb6d093dc0", + "trendlineLayerType": "metricTrendline", + "trendlineMetricAccessor": "9aee1c62-a8bb-4f94-8e6b-35914633c7bf", + "trendlineTimeAccessor": "ecb80070-fb11-4e81-a168-fce13b5c6e79" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 8, + "i": "06854553-1f37-41b0-972c-380acf5cb39f", + "w": 12, + "x": 0, + "y": 0 + }, + "panelIndex": "06854553-1f37-41b0-972c-380acf5cb39f", + "title": "Number of Applications [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e6ec4f57-529c-490f-86c3-5ae4140dc908", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "791b20c2-6ace-42e3-a393-51b4f378bd2a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e6ec4f57-529c-490f-86c3-5ae4140dc908": { + "columnOrder": [ + "db6bdb81-fe6d-4c67-ade9-705e6a94b3f5", + "8b4f3972-938e-4f87-bbef-54e1b639a222", + "cdcf84af-9e79-4e24-9514-2f4c82adfd58" + ], + "columns": { + "8b4f3972-938e-4f87-bbef-54e1b639a222": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cdcf84af-9e79-4e24-9514-2f4c82adfd58": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.cache.lookup.count: *" + }, + "isBucketed": false, + "label": "Requests", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.cache.lookup.count" + }, + "db6bdb81-fe6d-4c67-ade9-705e6a94b3f5": { + "customLabel": false, + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of apache_tomcat.cache.application_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cdcf84af-9e79-4e24-9514-2f4c82adfd58", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "apache_tomcat.cache.application_name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "791b20c2-6ace-42e3-a393-51b4f378bd2a", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.cache" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.cache" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "cdcf84af-9e79-4e24-9514-2f4c82adfd58" + ], + "layerId": "e6ec4f57-529c-490f-86c3-5ae4140dc908", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "db6bdb81-fe6d-4c67-ade9-705e6a94b3f5", + "xAccessor": "8b4f3972-938e-4f87-bbef-54e1b639a222" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show", + "valuesInLegend": true, + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "b8716edd-6941-4cba-9f1a-b3a08c7fc647", + "w": 36, + "x": 12, + "y": 0 + }, + "panelIndex": "b8716edd-6941-4cba-9f1a-b3a08c7fc647", + "title": "Top 5 requests per application over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-041c5a9d-e816-4c77-ae9f-e31b81d15a8a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e4ff0e97-e884-4a2e-859a-f16a579acd75", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e03e36e7-2153-4e6b-ad73-0b3f58c89969", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "041c5a9d-e816-4c77-ae9f-e31b81d15a8a": { + "columnOrder": [ + "9b579883-49f8-440c-adaf-bf72a16efdcd", + "2dc00ae2-0844-423c-b259-b597618dc7e7", + "2dc00ae2-0844-423c-b259-b597618dc7e7X0", + "2dc00ae2-0844-423c-b259-b597618dc7e7X1", + "2dc00ae2-0844-423c-b259-b597618dc7e7X2" + ], + "columns": { + "2dc00ae2-0844-423c-b259-b597618dc7e7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average request processing time (ms)", + "operationType": "formula", + "params": { + "formula": "(last_value(apache_tomcat.request.time.total, kql='apache_tomcat.request.time.total: *')) / (last_value(apache_tomcat.request.count, kql='apache_tomcat.request.count: *'))", + "isFormulaBroken": false + }, + "references": [ + "2dc00ae2-0844-423c-b259-b597618dc7e7X2" + ], + "scale": "ratio" + }, + "2dc00ae2-0844-423c-b259-b597618dc7e7X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.time.total: *" + }, + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.time.total" + }, + "2dc00ae2-0844-423c-b259-b597618dc7e7X1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.count: *" + }, + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.count" + }, + "2dc00ae2-0844-423c-b259-b597618dc7e7X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "2dc00ae2-0844-423c-b259-b597618dc7e7X0", + "2dc00ae2-0844-423c-b259-b597618dc7e7X1" + ], + "location": { + "max": 171, + "min": 0 + }, + "name": "divide", + "text": "(last_value(apache_tomcat.request.time.total, kql='apache_tomcat.request.time.total: *')) / (last_value(apache_tomcat.request.count, kql='apache_tomcat.request.count: *'))", + "type": "function" + } + }, + "references": [ + "2dc00ae2-0844-423c-b259-b597618dc7e7X0", + "2dc00ae2-0844-423c-b259-b597618dc7e7X1" + ], + "scale": "ratio" + }, + "9b579883-49f8-440c-adaf-bf72a16efdcd": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "linkToLayers": [ + "e4ff0e97-e884-4a2e-859a-f16a579acd75" + ], + "sampling": 1 + }, + "e4ff0e97-e884-4a2e-859a-f16a579acd75": { + "columnOrder": [ + "637d48c2-7443-454d-a1a8-beb47046c833", + "637d48c2-7443-454d-a1a8-beb47046c833X0", + "637d48c2-7443-454d-a1a8-beb47046c833X1", + "637d48c2-7443-454d-a1a8-beb47046c833X2" + ], + "columns": { + "637d48c2-7443-454d-a1a8-beb47046c833": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average request processing time (ms)", + "operationType": "formula", + "params": { + "formula": "(last_value(apache_tomcat.request.time.total, kql='apache_tomcat.request.time.total: *')) / (last_value(apache_tomcat.request.count, kql='apache_tomcat.request.count: *'))", + "isFormulaBroken": false + }, + "references": [ + "637d48c2-7443-454d-a1a8-beb47046c833X2" + ], + "scale": "ratio" + }, + "637d48c2-7443-454d-a1a8-beb47046c833X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.time.total: *" + }, + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.time.total" + }, + "637d48c2-7443-454d-a1a8-beb47046c833X1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.count: *" + }, + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.count" + }, + "637d48c2-7443-454d-a1a8-beb47046c833X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Average request processing time (ms)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "637d48c2-7443-454d-a1a8-beb47046c833X0", + "637d48c2-7443-454d-a1a8-beb47046c833X1" + ], + "location": { + "max": 171, + "min": 0 + }, + "name": "divide", + "text": "(last_value(apache_tomcat.request.time.total, kql='apache_tomcat.request.time.total: *')) / (last_value(apache_tomcat.request.count, kql='apache_tomcat.request.count: *'))", + "type": "function" + } + }, + "references": [ + "637d48c2-7443-454d-a1a8-beb47046c833X0", + "637d48c2-7443-454d-a1a8-beb47046c833X1" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "e03e36e7-2153-4e6b-ad73-0b3f58c89969", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.request" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.request" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "e4ff0e97-e884-4a2e-859a-f16a579acd75", + "layerType": "data", + "metricAccessor": "637d48c2-7443-454d-a1a8-beb47046c833", + "showBar": false, + "trendlineLayerId": "041c5a9d-e816-4c77-ae9f-e31b81d15a8a", + "trendlineLayerType": "metricTrendline", + "trendlineMetricAccessor": "2dc00ae2-0844-423c-b259-b597618dc7e7", + "trendlineTimeAccessor": "9b579883-49f8-440c-adaf-bf72a16efdcd" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 8, + "i": "9e8b29e7-3679-4e44-a585-f4cf7f17044f", + "w": 12, + "x": 0, + "y": 8 + }, + "panelIndex": "9e8b29e7-3679-4e44-a585-f4cf7f17044f", + "title": "Average request processing time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7c4da97e-7d47-4847-87ae-0fbdcc983343", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "38cc0910-5849-444d-ba26-a9dab625f549", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c4da97e-7d47-4847-87ae-0fbdcc983343": { + "columnOrder": [ + "47ab8662-6f73-47d4-927c-535c57fa4a64", + "c1f42f1c-d4c1-486c-afd8-e1c2f02ecd31", + "1b360833-8c28-4ee2-8b0c-ecb3595f83de" + ], + "columns": { + "1b360833-8c28-4ee2-8b0c-ecb3595f83de": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.idle.count: *" + }, + "isBucketed": false, + "label": "Idle", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.idle.count" + }, + "47ab8662-6f73-47d4-927c-535c57fa4a64": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c1f42f1c-d4c1-486c-afd8-e1c2f02ecd31": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.connection_pool.connection.active.count: *" + }, + "isBucketed": false, + "label": "Active", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.connection_pool.connection.active.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "38cc0910-5849-444d-ba26-a9dab625f549", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.connection_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.connection_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c1f42f1c-d4c1-486c-afd8-e1c2f02ecd31", + "1b360833-8c28-4ee2-8b0c-ecb3595f83de" + ], + "layerId": "7c4da97e-7d47-4847-87ae-0fbdcc983343", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "47ab8662-6f73-47d4-927c-535c57fa4a64" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "ba5d9b2e-689c-4472-aa89-bc355a5cc780", + "w": 24, + "x": 0, + "y": 16 + }, + "panelIndex": "ba5d9b2e-689c-4472-aa89-bc355a5cc780", + "title": "Connections over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b09c20e6-d7d3-4fe2-8490-2c6feedb02c9", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "44b26cb6-1625-4950-9cd5-a079004b991b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b09c20e6-d7d3-4fe2-8490-2c6feedb02c9": { + "columnOrder": [ + "97565d74-9071-4fe2-9bdf-b78c4747a99f", + "1074de52-890c-4177-9341-1679cec0988d", + "cd855517-672f-4dc1-ad08-b0c254681134" + ], + "columns": { + "1074de52-890c-4177-9341-1679cec0988d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.non_heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Heap", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.non_heap.used.bytes" + }, + "97565d74-9071-4fe2-9bdf-b78c4747a99f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cd855517-672f-4dc1-ad08-b0c254681134": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.memory.heap.used.bytes: *" + }, + "isBucketed": false, + "label": "Non-heap", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.memory.heap.used.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "44b26cb6-1625-4950-9cd5-a079004b991b", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.memory" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.memory" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "1074de52-890c-4177-9341-1679cec0988d", + "cd855517-672f-4dc1-ad08-b0c254681134" + ], + "layerId": "b09c20e6-d7d3-4fe2-8490-2c6feedb02c9", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "97565d74-9071-4fe2-9bdf-b78c4747a99f" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Memory" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "38423062-d16c-4911-a9e9-dfdfba9d19b5", + "w": 24, + "x": 24, + "y": 16 + }, + "panelIndex": "38423062-d16c-4911-a9e9-dfdfba9d19b5", + "title": "Memory usage over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-365e11cb-9eed-4fd4-a335-2b8ee3f454c5", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c9861b14-6ccb-4a1a-b38f-4d7c01febfc8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "365e11cb-9eed-4fd4-a335-2b8ee3f454c5": { + "columnOrder": [ + "56bfcf1f-366d-489d-aeaf-823125dba18d", + "9406fdc5-199c-48f2-8193-2be17f9170bd", + "715c511c-e362-4e96-96df-00acc3ef605b" + ], + "columns": { + "56bfcf1f-366d-489d-aeaf-823125dba18d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "715c511c-e362-4e96-96df-00acc3ef605b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.received.bytes: *" + }, + "isBucketed": false, + "label": "Received", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.received.bytes" + }, + "9406fdc5-199c-48f2-8193-2be17f9170bd": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.request.sent.bytes: *" + }, + "isBucketed": false, + "label": "Sent", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.request.sent.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "c9861b14-6ccb-4a1a-b38f-4d7c01febfc8", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.request" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.request" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "9406fdc5-199c-48f2-8193-2be17f9170bd", + "715c511c-e362-4e96-96df-00acc3ef605b" + ], + "layerId": "365e11cb-9eed-4fd4-a335-2b8ee3f454c5", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "56bfcf1f-366d-489d-aeaf-823125dba18d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Data units" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "5862d24f-ecf5-41fd-93b4-3d214e834361", + "w": 24, + "x": 24, + "y": 28 + }, + "panelIndex": "5862d24f-ecf5-41fd-93b4-3d214e834361", + "title": "Throughput over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-bdd64b4a-4147-4624-8e56-78dbbddd5986", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1a9a387d-da2b-46c0-9d67-d84642c4450d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bdd64b4a-4147-4624-8e56-78dbbddd5986": { + "columnOrder": [ + "c3eb8cac-6126-4ab5-b117-4f56c8085e53", + "29cd7eae-c51a-4725-9c89-7cbd2ba12ac1", + "d9b2dfee-a55c-4ec7-8bd3-6be711987fa7", + "b0e681ca-4edb-4fde-b59f-23f6aeba18df", + "8eaaccf2-0bcd-4bcc-b7d1-8e92c419da33", + "a43ca53b-6d71-48a4-8e43-ad363aded28d" + ], + "columns": { + "29cd7eae-c51a-4725-9c89-7cbd2ba12ac1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.current.count: *" + }, + "isBucketed": false, + "label": "Current", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.current.count" + }, + "8eaaccf2-0bcd-4bcc-b7d1-8e92c419da33": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.active.count: *" + }, + "isBucketed": false, + "label": "Active", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.active.count" + }, + "a43ca53b-6d71-48a4-8e43-ad363aded28d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.current.busy: *" + }, + "isBucketed": false, + "label": "Busy", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.current.busy" + }, + "b0e681ca-4edb-4fde-b59f-23f6aeba18df": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.peak.count: *" + }, + "isBucketed": false, + "label": "Peak", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.peak.count" + }, + "c3eb8cac-6126-4ab5-b117-4f56c8085e53": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d9b2dfee-a55c-4ec7-8bd3-6be711987fa7": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "apache_tomcat.thread_pool.thread.daemon.count: *" + }, + "isBucketed": false, + "label": "Daemon", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "apache_tomcat.thread_pool.thread.daemon.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "1a9a387d-da2b-46c0-9d67-d84642c4450d", + "key": "event.dataset", + "negate": false, + "params": { + "query": "apache_tomcat.thread_pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "apache_tomcat.thread_pool" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "29cd7eae-c51a-4725-9c89-7cbd2ba12ac1", + "d9b2dfee-a55c-4ec7-8bd3-6be711987fa7", + "b0e681ca-4edb-4fde-b59f-23f6aeba18df", + "8eaaccf2-0bcd-4bcc-b7d1-8e92c419da33", + "a43ca53b-6d71-48a4-8e43-ad363aded28d" + ], + "layerId": "bdd64b4a-4147-4624-8e56-78dbbddd5986", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "c3eb8cac-6126-4ab5-b117-4f56c8085e53" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "Active threads represent Current active threads at the JVM level (from java.lang:type=Threading), Current threads represent Current number of threads that are taken from the ThreadPool and Peak threads represent Peak threads at the JVM level (from java.lang:type=Threading)", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "8d71c0de-16f1-4231-97ff-0bf7e1af5db0", + "w": 24, + "x": 0, + "y": 34 + }, + "panelIndex": "8d71c0de-16f1-4231-97ff-0bf7e1af5db0", + "title": "Thread distribution by server over time [Metrics Apache Tomcat]", + "type": "lens", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Metrics Apache Tomcat] Overview ", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-19T08:01:33.946Z", + "id": "apache_tomcat-c8ec7280-1a57-11ee-8c1a-099fb2bcb823", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "06854553-1f37-41b0-972c-380acf5cb39f:indexpattern-datasource-layer-99998251-2f00-4a88-bf98-07e7d8e3ac81", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "06854553-1f37-41b0-972c-380acf5cb39f:indexpattern-datasource-layer-207a8774-23b1-43df-831f-56cb6d093dc0", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "06854553-1f37-41b0-972c-380acf5cb39f:f3e87a81-2a03-49e7-b465-ae2e5540cfd7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b8716edd-6941-4cba-9f1a-b3a08c7fc647:indexpattern-datasource-layer-e6ec4f57-529c-490f-86c3-5ae4140dc908", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b8716edd-6941-4cba-9f1a-b3a08c7fc647:791b20c2-6ace-42e3-a393-51b4f378bd2a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9e8b29e7-3679-4e44-a585-f4cf7f17044f:indexpattern-datasource-layer-041c5a9d-e816-4c77-ae9f-e31b81d15a8a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9e8b29e7-3679-4e44-a585-f4cf7f17044f:indexpattern-datasource-layer-e4ff0e97-e884-4a2e-859a-f16a579acd75", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9e8b29e7-3679-4e44-a585-f4cf7f17044f:e03e36e7-2153-4e6b-ad73-0b3f58c89969", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ba5d9b2e-689c-4472-aa89-bc355a5cc780:indexpattern-datasource-layer-7c4da97e-7d47-4847-87ae-0fbdcc983343", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ba5d9b2e-689c-4472-aa89-bc355a5cc780:38cc0910-5849-444d-ba26-a9dab625f549", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "38423062-d16c-4911-a9e9-dfdfba9d19b5:indexpattern-datasource-layer-b09c20e6-d7d3-4fe2-8490-2c6feedb02c9", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "38423062-d16c-4911-a9e9-dfdfba9d19b5:44b26cb6-1625-4950-9cd5-a079004b991b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5862d24f-ecf5-41fd-93b4-3d214e834361:indexpattern-datasource-layer-365e11cb-9eed-4fd4-a335-2b8ee3f454c5", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5862d24f-ecf5-41fd-93b4-3d214e834361:c9861b14-6ccb-4a1a-b38f-4d7c01febfc8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8d71c0de-16f1-4231-97ff-0bf7e1af5db0:indexpattern-datasource-layer-bdd64b4a-4147-4624-8e56-78dbbddd5986", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8d71c0de-16f1-4231-97ff-0bf7e1af5db0:1a9a387d-da2b-46c0-9d67-d84642c4450d", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_389cb789-1fc8-43c8-b276-08d02bae4cee:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/apache_tomcat/kibana/search/apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195.json b/packages/apache_tomcat/kibana/search/apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195.json index 41b2acec5a2..422f73d8e2c 100644 --- a/packages/apache_tomcat/kibana/search/apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195.json +++ b/packages/apache_tomcat/kibana/search/apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195.json @@ -42,6 +42,28 @@ "event.dataset": "apache_tomcat.catalina" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "log.level", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "log.level", + "negate": true, + "params": { + "query": "info" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.level": "info" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -62,9 +84,10 @@ "usesAdHocDataView": false }, "coreMigrationVersion": "8.7.0", - "created_at": "2023-05-09T09:47:42.878Z", + "created_at": "2023-07-24T12:48:07.116Z", "id": "apache_tomcat-1f3c6e30-dd11-11ed-9f4f-d97c9f37d195", "migrationVersion": { + "dashboard": "8.0.0", "search": "8.0.0" }, "references": [ @@ -77,6 +100,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/apache_tomcat/kibana/search/apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c.json b/packages/apache_tomcat/kibana/search/apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c.json index 9b772256163..8109ba8161e 100644 --- a/packages/apache_tomcat/kibana/search/apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c.json +++ b/packages/apache_tomcat/kibana/search/apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c.json @@ -42,6 +42,28 @@ "event.dataset": "apache_tomcat.localhost" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "log.level", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "log.level", + "negate": true, + "params": { + "query": "info" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.level": "info" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -62,9 +84,10 @@ "usesAdHocDataView": false }, "coreMigrationVersion": "8.7.0", - "created_at": "2023-05-09T09:47:42.878Z", + "created_at": "2023-07-24T12:48:07.116Z", "id": "apache_tomcat-4d39c820-ddcd-11ed-8080-ddad81fe2c3c", "migrationVersion": { + "dashboard": "8.0.0", "search": "8.0.0" }, "references": [ @@ -77,6 +100,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/apache_tomcat/kibana/search/apache_tomcat-d0957a70-eda4-11ed-909a-2baec7270d1f.json b/packages/apache_tomcat/kibana/search/apache_tomcat-d0957a70-eda4-11ed-909a-2baec7270d1f.json index 98d38d561cf..d43d4ec6699 100644 --- a/packages/apache_tomcat/kibana/search/apache_tomcat-d0957a70-eda4-11ed-909a-2baec7270d1f.json +++ b/packages/apache_tomcat/kibana/search/apache_tomcat-d0957a70-eda4-11ed-909a-2baec7270d1f.json @@ -91,9 +91,10 @@ "usesAdHocDataView": false }, "coreMigrationVersion": "8.7.0", - "created_at": "2023-05-08T13:32:44.823Z", + "created_at": "2023-07-24T12:48:07.116Z", "id": "apache_tomcat-d0957a70-eda4-11ed-909a-2baec7270d1f", "migrationVersion": { + "dashboard": "8.0.0", "search": "8.0.0" }, "references": [ diff --git a/packages/apache_tomcat/manifest.yml b/packages/apache_tomcat/manifest.yml index c48fdf9ef2d..b4a6c304393 100644 --- a/packages/apache_tomcat/manifest.yml +++ b/packages/apache_tomcat/manifest.yml @@ -1,12 +1,12 @@ format_version: 2.3.0 name: apache_tomcat title: Apache Tomcat -version: "0.6.0" +version: "0.12.3" description: Collect and parse logs and metrics from Apache Tomcat servers with Elastic Agent. categories: ["web", "observability"] type: integration conditions: - kibana.version: "^8.7.0" + kibana.version: "^8.8.0" policy_templates: - name: Apache Tomcat title: Apache Tomcat @@ -79,6 +79,14 @@ icons: size: 32x32 type: image/svg+xml screenshots: + - src: /img/apache_tomcat-logs-overview-dashboard.png + title: Apache Tomcat Logs Overview dashboard + size: 600x600 + type: image/png + - src: /img/apache_tomcat-metrics-overview-dashboard.png + title: Apache Tomcat Metrics Overview dashboard + size: 600x600 + type: image/png - src: /img/apache_tomcat-access-dashboard.png title: Apache Tomcat access dashboard size: 600x600 @@ -95,5 +103,21 @@ screenshots: title: Apache Tomcat Catalina and Localhost dashboard size: 600x600 type: image/png + - src: /img/apache_tomcat-session-dashboard.png + title: Apache Tomcat Session dashboard + size: 600x600 + type: image/png + - src: /img/apache_tomcat-memory-dashboard.png + title: Apache Tomcat Memory dashboard + size: 600x600 + type: image/png + - src: /img/apache_tomcat-thread-pool-dashboard.png + title: Apache Tomcat Thread Pool dashboard + size: 600x600 + type: image/png + - src: /img/apache_tomcat-connection-pool-dashboard.png + title: Apache Tomcat Connection Pool dashboard + size: 600x600 + type: image/png owner: github: elastic/obs-infraobs-integrations diff --git a/packages/arista_ngfw/_dev/build/build.yml b/packages/arista_ngfw/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100755 --- a/packages/arista_ngfw/_dev/build/build.yml +++ b/packages/arista_ngfw/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/arista_ngfw/_dev/build/docs/README.md b/packages/arista_ngfw/_dev/build/docs/README.md index 361b286afc5..7cde1f70e36 100755 --- a/packages/arista_ngfw/_dev/build/docs/README.md +++ b/packages/arista_ngfw/_dev/build/docs/README.md @@ -15,6 +15,7 @@ Arista NG Firewall supports several syslog output rules that may be configured o * Interface Stat Event * Intrusion Prevention Log Event * Session Event +* Session Stats Event * System Stat Event * Web Filter Event diff --git a/packages/arista_ngfw/changelog.yml b/packages/arista_ngfw/changelog.yml index 39035d39499..9df41393279 100755 --- a/packages/arista_ngfw/changelog.yml +++ b/packages/arista_ngfw/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 0.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.3.0" + changes: + - description: Add parsing for network.bytes and network.packets + type: enhancement + link: https://github.com/elastic/integrations/pull/7353 +- version: "0.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "0.1.2" + changes: + - description: Fix interface variables in manifest, and correct duplicate `_conf` fields + type: bugfix + link: https://github.com/elastic/integrations/pull/6854 +- version: "0.1.1" + changes: + - description: Fix bugs in default ingest pipeline + type: bugfix + link: https://github.com/elastic/integrations/pull/6878 +- version: "0.1.0" + changes: + - description: Add support for session stats events + type: enhancement + link: https://github.com/elastic/integrations/pull/6881 - version: "0.0.1" changes: - description: Initial draft of the package diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-admin-login.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-admin-login.log-expected.json index af569cffce7..db0efe8ff2c 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-admin-login.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-admin-login.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-05-24T13:09:53.477-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -60,7 +60,7 @@ { "@timestamp": "2023-05-23T10:06:57.518-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -117,7 +117,7 @@ { "@timestamp": "2023-05-23T13:35:42.611-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -174,7 +174,7 @@ { "@timestamp": "2023-05-22T13:47:59.495-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -231,7 +231,7 @@ { "@timestamp": "2023-05-21T09:58:40.250-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -288,7 +288,7 @@ { "@timestamp": "2023-05-20T08:12:47.018-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -346,7 +346,7 @@ { "@timestamp": "2023-05-18T15:08:14.224-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -403,7 +403,7 @@ { "@timestamp": "2023-05-18T06:58:38.360-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -460,7 +460,7 @@ { "@timestamp": "2023-05-17T15:04:03.772-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -517,7 +517,7 @@ { "@timestamp": "2023-05-12T09:09:40.787-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-firewall-event.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-firewall-event.log-expected.json index 528a1b689d4..48d233dff76 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-firewall-event.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-firewall-event.log-expected.json @@ -6,13 +6,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377229, + "id": "110221865377229", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:28 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:28.771\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377229,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -55,13 +55,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377228, + "id": "110221865377228", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:28 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:28.194\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377228,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -104,13 +104,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377227, + "id": "110221865377227", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:27 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:27.875\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377227,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -153,13 +153,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377226, + "id": "110221865377226", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:26 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:26.743\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377226,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -202,13 +202,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377225, + "id": "110221865377225", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:26 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:26.686\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377225,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -251,13 +251,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865377221, + "id": "110221865377221", "kind": "event", "original": "\u003c174\u003eMay 22 16:32:25 INFO uvm[0]: {\"timeStamp\":\"2023-05-22 16:32:25.504\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865377221,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -300,13 +300,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772671, + "id": "110221865772671", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:15 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:15.43\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772671,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -349,13 +349,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772670, + "id": "110221865772670", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:14 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:14.164\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772670,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -398,13 +398,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772669, + "id": "110221865772669", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:12 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:12.916\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772669,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -447,13 +447,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772668, + "id": "110221865772668", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.806\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772668,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -496,13 +496,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772667, + "id": "110221865772667", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.718\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772667,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -545,13 +545,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772666, + "id": "110221865772666", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.699\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772666,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -594,13 +594,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772664, + "id": "110221865772664", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.348\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772664,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -643,13 +643,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772663, + "id": "110221865772663", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.214\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772663,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -692,13 +692,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772662, + "id": "110221865772662", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:11.123\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772662,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -741,13 +741,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772661, + "id": "110221865772661", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:10 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:10.907\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772661,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -790,13 +790,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772657, + "id": "110221865772657", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:10 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:10.382\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772657,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -839,13 +839,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772656, + "id": "110221865772656", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:09 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:09.861\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772656,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -888,13 +888,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772655, + "id": "110221865772655", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:09 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:09.807\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772655,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", @@ -937,13 +937,13 @@ "flagged": false }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "id": 110221865772654, + "id": "110221865772654", "kind": "event", "original": "\u003c174\u003eMay 23 15:17:09 INFO uvm[0]: {\"timeStamp\":\"2023-05-23 15:17:09.738\",\"flagged\":false,\"blocked\":false,\"sessionId\":110221865772654,\"ruleId\":0,\"class\":\"class com.untangle.app.firewall.FirewallEvent\"}", "outcome": "success", diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-request.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-request.log-expected.json index 97aab8e6853..e3a68c8a7cd 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-request.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-request.log-expected.json @@ -31,14 +31,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487132, + "id": "110221866487132", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:44 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:44.093\",\"method\":\"GET\",\"requestId\":110221859354811,\"domain\":\"amer.ng.msg.teams.microsoft.com\",\"host\":\"amer.ng.msg.teams.microsoft.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"D23613W10\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.3388,\"localAddr\":\"192.168.201.21\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.21\",\"serverCountry\":\"US\",\"sessionId\":110221866487132,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":59560,\"timeStamp\":\"2023-05-25 09:07:44.062\",\"serverLongitude\":-121.8914,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":13485,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"username\":\"johndoe\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -48,6 +48,9 @@ "start" ] }, + "host": { + "name": "D23613W10" + }, "http": { "request": { "bytes": 0, @@ -94,6 +97,7 @@ }, "related": { "hosts": [ + "D23613W10", "amer.ng.msg.teams.microsoft.com" ], "ip": [ @@ -158,14 +162,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487106, + "id": "110221866487106", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:34 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:34.395\",\"method\":\"GET\",\"requestId\":110221859354809,\"domain\":\"mozilla.cloudflare-dns.com\",\"host\":\"mozilla.cloudflare-dns.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"RemoteApp1\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.200.50\",\"SServerAddr\":\"81.2.69.142\",\"remoteAddr\":\"81.2.69.142\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.50\",\"serverCountry\":\"US\",\"sessionId\":110221866487106,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":16040,\"timeStamp\":\"2023-05-25 09:07:34.386\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":15128,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.142\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -175,6 +179,9 @@ "start" ] }, + "host": { + "name": "RemoteApp1" + }, "http": { "request": { "bytes": 0, @@ -221,6 +228,7 @@ }, "related": { "hosts": [ + "RemoteApp1", "mozilla.cloudflare-dns.com" ], "ip": [ @@ -279,14 +287,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487103, + "id": "110221866487103", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:33 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:33.314\",\"method\":\"GET\",\"requestId\":110221859354806,\"domain\":\"sb.scorecardresearch.com\",\"host\":\"sb.scorecardresearch.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487103,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":51598,\"timeStamp\":\"2023-05-25 09:07:33.273\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":45333,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -296,6 +304,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -342,6 +353,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "sb.scorecardresearch.com" ], "ip": [ @@ -400,14 +412,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487093, + "id": "110221866487093", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:30 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:30.333\",\"method\":\"GET\",\"requestId\":110221859354805,\"domain\":\"www.gstatic.com\",\"host\":\"www.gstatic.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487093,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":50548,\"timeStamp\":\"2023-05-25 09:07:30.316\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":39662,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -417,6 +429,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -463,6 +478,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "www.gstatic.com" ], "ip": [ @@ -521,14 +537,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487086, + "id": "110221866487086", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:30 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:30.118\",\"method\":\"GET\",\"requestId\":110221859354804,\"domain\":\"inapps.appsflyer.com\",\"host\":\"inapps.appsflyer.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487086,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36398,\"timeStamp\":\"2023-05-25 09:07:30.072\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":40425,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -538,6 +554,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -584,6 +603,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "inapps.appsflyer.com" ], "ip": [ @@ -642,14 +662,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487071, + "id": "110221866487071", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:29 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:29.775\",\"method\":\"GET\",\"requestId\":110221859354791,\"domain\":\"data.pendo.io\",\"host\":\"data.pendo.io\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.1028,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487071,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":40596,\"timeStamp\":\"2023-05-25 09:07:29.763\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":32984,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -659,6 +679,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -705,6 +728,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "data.pendo.io" ], "ip": [ @@ -763,14 +787,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487052, + "id": "110221866487052", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:28 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:28.758\",\"method\":\"GET\",\"requestId\":110221859354783,\"domain\":\"telemetry.elastic.co\",\"host\":\"telemetry.elastic.co\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Elastic\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.1028,\"localAddr\":\"192.168.200.15\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.15\",\"serverCountry\":\"US\",\"sessionId\":110221866487052,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":52762,\"timeStamp\":\"2023-05-25 09:07:28.754\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":30035,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -780,6 +804,9 @@ "start" ] }, + "host": { + "name": "Elastic" + }, "http": { "request": { "bytes": 0, @@ -826,6 +853,7 @@ }, "related": { "hosts": [ + "Elastic", "telemetry.elastic.co" ], "ip": [ @@ -884,14 +912,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487028, + "id": "110221866487028", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:28 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:28.187\",\"method\":\"GET\",\"requestId\":110221859354760,\"domain\":\"wn0.rumble.com\",\"host\":\"wn0.rumble.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"XU\",\"sessionId\":110221866487028,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":57482,\"timeStamp\":\"2023-05-25 09:07:28.157\",\"clientIntf\":2,\"policyId\":1,\"SClientPort\":13556,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -901,6 +929,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -947,6 +978,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "wn0.rumble.com" ], "ip": [ @@ -1005,14 +1037,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487026, + "id": "110221866487026", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:27 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:27.517\",\"method\":\"GET\",\"requestId\":110221859354759,\"domain\":\"play-fe.googleapis.com\",\"host\":\"play-fe.googleapis.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487026,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":60308,\"timeStamp\":\"2023-05-25 09:07:27.498\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":21706,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -1022,6 +1054,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -1068,6 +1103,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "play-fe.googleapis.com" ], "ip": [ @@ -1126,14 +1162,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866487024, + "id": "110221866487024", "kind": "event", "original": "\u003c174\u003eMay 25 09:07:27 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:07:27.295\",\"method\":\"GET\",\"requestId\":110221859354758,\"domain\":\"api.accuweather.com\",\"host\":\"api.accuweather.com\",\"contentLength\":0,\"requestUri\":\"/\",\"class\":\"class com.untangle.app.http.HttpRequestEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.12\",\"remoteAddr\":\"67.43.156.12\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866487024,\"SClientAddr\":\"1.128.0.1\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":48988,\"timeStamp\":\"2023-05-25 09:07:27.284\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":48278,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.12\",\"tagsString\":\"\"}}", "provider": "http_request", @@ -1143,6 +1179,9 @@ "start" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "bytes": 0, @@ -1189,6 +1228,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "api.accuweather.com" ], "ip": [ diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-response.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-response.log-expected.json index 9f0f459609c..05be611c33f 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-response.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-http-response.log-expected.json @@ -32,14 +32,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866602155, + "id": "110221866602155", "kind": "event", "original": "\u003c174\u003eMay 25 13:59:11 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:59:11.622\",\"contentLength\":8,\"requestLine\":\"GET http://detectportal.firefox.com/success.txt?ipv4\",\"contentType\":\"text/plain\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:59:11.613\",\"method\":\"GET\",\"requestId\":110221859378971,\"domain\":\"detectportal.firefox.com\",\"host\":\"detectportal.firefox.com\",\"contentLength\":0,\"requestUri\":\"/success.txt?ipv4\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":39.1028,\"localAddr\":\"192.168.200.25\",\"SServerAddr\":\"67.43.156.91\",\"remoteAddr\":\"67.43.156.91\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.25\",\"serverCountry\":\"US\",\"sessionId\":110221866602155,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":41968,\"timeStamp\":\"2023-05-25 13:55:24.843\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":47164,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.91\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -49,6 +49,9 @@ "end" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "GET" @@ -97,6 +100,7 @@ }, "related": { "hosts": [ + "ubuntu", "detectportal.firefox.com" ], "ip": [ @@ -162,14 +166,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866590454, + "id": "110221866590454", "kind": "event", "original": "\u003c174\u003eMay 25 13:28:56 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:28:56.752\",\"contentLength\":0,\"requestLine\":\"GET http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEHHvVXSvNVTDWixp9m9La80%3D\",\"contentType\":\"application/ocsp-response\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:28:56.741\",\"method\":\"GET\",\"requestId\":110221859376527,\"domain\":\"ocsp.entrust.net\",\"host\":\"ocsp.entrust.net\",\"contentLength\":0,\"requestUri\":\"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEHHvVXSvNVTDWixp9m9La80%3D\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"D23613W10\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.21\",\"SServerAddr\":\"67.43.156.17\",\"remoteAddr\":\"67.43.156.17\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.21\",\"serverCountry\":\"US\",\"sessionId\":110221866590454,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":62349,\"timeStamp\":\"2023-05-25 13:28:56.735\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":15108,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.17\",\"username\":\"eric\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -179,6 +183,9 @@ "end" ] }, + "host": { + "name": "D23613W10" + }, "http": { "request": { "method": "GET" @@ -227,6 +234,7 @@ }, "related": { "hosts": [ + "D23613W10", "ocsp.entrust.net" ], "ip": [ @@ -296,14 +304,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866590452, + "id": "110221866590452", "kind": "event", "original": "\u003c174\u003eMay 25 13:28:56 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:28:56.693\",\"contentLength\":0,\"requestLine\":\"GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9d222919ed61d6da\",\"contentType\":\"application/vnd.ms-cab-compressed\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:28:56.684\",\"method\":\"GET\",\"requestId\":110221859376526,\"domain\":\"ctldl.windowsupdate.com\",\"host\":\"ctldl.windowsupdate.com\",\"contentLength\":0,\"requestUri\":\"/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?9d222919ed61d6da\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"D23613W10\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.21\",\"SServerAddr\":\"67.43.156.52\",\"remoteAddr\":\"67.43.156.52\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.21\",\"serverCountry\":\"US\",\"sessionId\":110221866590452,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":62348,\"timeStamp\":\"2023-05-25 13:28:56.656\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":19844,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.52\",\"username\":\"eric\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -313,6 +321,9 @@ "end" ] }, + "host": { + "name": "D23613W10" + }, "http": { "request": { "method": "GET" @@ -361,6 +372,7 @@ }, "related": { "hosts": [ + "D23613W10", "ctldl.windowsupdate.com" ], "ip": [ @@ -432,14 +444,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866589634, + "id": "110221866589634", "kind": "event", "original": "\u003c174\u003eMay 25 13:28:17 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:28:17.055\",\"contentLength\":1736,\"requestLine\":\"POST http://dmd.metaservices.microsoft.com/metadata.svc\",\"contentType\":\"text/xml\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:28:17.019\",\"method\":\"POST\",\"requestId\":110221859376508,\"domain\":\"dmd.metaservices.microsoft.com\",\"host\":\"dmd.metaservices.microsoft.com\",\"contentLength\":1270,\"requestUri\":\"/metadata.svc\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"RemoteApp1\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.3388,\"localAddr\":\"192.168.200.50\",\"SServerAddr\":\"67.43.156.7\",\"remoteAddr\":\"67.43.156.7\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.50\",\"serverCountry\":\"US\",\"sessionId\":110221866589634,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":19486,\"timeStamp\":\"2023-05-25 13:28:11.523\",\"serverLongitude\":-121.8914,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":31487,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.7\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -449,6 +461,9 @@ "end" ] }, + "host": { + "name": "RemoteApp1" + }, "http": { "request": { "method": "POST" @@ -497,6 +512,7 @@ }, "related": { "hosts": [ + "RemoteApp1", "dmd.metaservices.microsoft.com" ], "ip": [ @@ -561,14 +577,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866589745, + "id": "110221866589745", "kind": "event", "original": "\u003c174\u003eMay 25 13:28:17 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:28:17.015\",\"contentLength\":0,\"requestLine\":\"POST http://go.microsoft.com/fwlink/?LinkID=252669\u0026clcid=0x409\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:28:17.007\",\"method\":\"POST\",\"requestId\":110221859376507,\"domain\":\"go.microsoft.com\",\"host\":\"go.microsoft.com\",\"contentLength\":1270,\"requestUri\":\"/fwlink/?LinkID=252669\u0026clcid=0x409\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"RemoteApp1\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.200.50\",\"SServerAddr\":\"67.43.156.101\",\"remoteAddr\":\"67.43.156.101\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.50\",\"serverCountry\":\"US\",\"sessionId\":110221866589745,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":19498,\"timeStamp\":\"2023-05-25 13:28:17.002\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":48711,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.101\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -578,6 +594,9 @@ "end" ] }, + "host": { + "name": "RemoteApp1" + }, "http": { "request": { "method": "POST" @@ -626,6 +645,7 @@ }, "related": { "hosts": [ + "RemoteApp1", "go.microsoft.com" ], "ip": [ @@ -690,14 +710,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866586859, + "id": "110221866586859", "kind": "event", "original": "\u003c174\u003eMay 25 13:20:58 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:20:58.327\",\"contentLength\":0,\"requestLine\":\"GET http://connectivitycheck.gstatic.com/generate_204\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:20:58.316\",\"method\":\"GET\",\"requestId\":110221859376191,\"domain\":\"connectivitycheck.gstatic.com\",\"host\":\"connectivitycheck.gstatic.com\",\"contentLength\":0,\"requestUri\":\"/generate_204\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.6\",\"SServerAddr\":\"67.43.156.56\",\"remoteAddr\":\"67.43.156.56\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.6\",\"serverCountry\":\"US\",\"sessionId\":110221866586859,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":44148,\"timeStamp\":\"2023-05-25 13:20:57.995\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":31260,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.56\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -707,6 +727,9 @@ "end" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "method": "GET" @@ -755,6 +778,7 @@ }, "related": { "hosts": [ + "Galaxy-S22", "connectivitycheck.gstatic.com" ], "ip": [ @@ -818,14 +842,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866586366, + "id": "110221866586366", "kind": "event", "original": "\u003c174\u003eMay 25 13:18:39 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 13:18:39.717\",\"contentLength\":471,\"requestLine\":\"POST http://ocsp.digicert.com/\",\"contentType\":\"application/ocsp-response\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 13:18:39.707\",\"method\":\"POST\",\"requestId\":110221859376170,\"domain\":\"ocsp.digicert.com\",\"host\":\"ocsp.digicert.com\",\"contentLength\":83,\"requestUri\":\"/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"RemoteApp1\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.200.50\",\"SServerAddr\":\"67.43.156.35\",\"remoteAddr\":\"67.43.156.35\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.50\",\"serverCountry\":\"US\",\"sessionId\":110221866586366,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":19427,\"timeStamp\":\"2023-05-25 13:18:39.704\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":43090,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.35\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -835,6 +859,9 @@ "end" ] }, + "host": { + "name": "RemoteApp1" + }, "http": { "request": { "method": "POST" @@ -883,6 +910,7 @@ }, "related": { "hosts": [ + "RemoteApp1", "ocsp.digicert.com" ], "ip": [ @@ -946,14 +974,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866571317, + "id": "110221866571317", "kind": "event", "original": "\u003c174\u003eMay 25 12:20:36 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 12:20:36.57\",\"contentLength\":1048576,\"contentFilename\":\"microsoft.bingweather_4.53.51361.0_neutral_~_8wekyb3d8bbwe.appxbundle\",\"requestLine\":\"GET http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/39e27d1a-be46-4e95-be41-1fc48d1ba686?P1=1685040131\u0026P2=404\u0026P3=2\u0026P4=Vf%2fpxph%2fQJH7%2bPZqc3Xz67gngLpb9rnmPKNOcGPYlicP6iPXjtm%2fbGOxnQU8ZrFgGnsw8Ipj14OS%2fVkJglNd6A%3d%3d\",\"contentType\":\"application/octet-stream\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 12:20:36.509\",\"method\":\"GET\",\"requestId\":110221859374271,\"domain\":\"2.tlu.dl.delivery.mp.microsoft.com\",\"host\":\"2.tlu.dl.delivery.mp.microsoft.com\",\"contentLength\":0,\"requestUri\":\"/filestreamingservice/files/39e27d1a-be46-4e95-be41-1fc48d1ba686?P1=1685040131\u0026P2=404\u0026P3=2\u0026P4=Vf%2fpxph%2fQJH7%2bPZqc3Xz67gngLpb9rnmPKNOcGPYlicP6iPXjtm%2fbGOxnQU8ZrFgGnsw8Ipj14OS%2fVkJglNd6A%3d%3d\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"D23613W10\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.21\",\"SServerAddr\":\"67.43.156.172\",\"remoteAddr\":\"67.43.156.172\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.21\",\"serverCountry\":\"US\",\"sessionId\":110221866571317,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":54631,\"timeStamp\":\"2023-05-25 12:20:36.113\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":49992,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.172\",\"username\":\"eric\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -966,6 +994,9 @@ "file": { "name": "microsoft.bingweather_4.53.51361.0_neutral_~_8wekyb3d8bbwe.appxbundle" }, + "host": { + "name": "D23613W10" + }, "http": { "request": { "method": "GET" @@ -1014,6 +1045,7 @@ }, "related": { "hosts": [ + "D23613W10", "2.tlu.dl.delivery.mp.microsoft.com" ], "ip": [ @@ -1084,14 +1116,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866571313, + "id": "110221866571313", "kind": "event", "original": "\u003c174\u003eMay 25 12:20:35 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 12:20:35.953\",\"contentLength\":1048576,\"contentFilename\":\"microsoft.microsoftofficehub_18.2304.1202.0_neutral_~_8wekyb3d8bbwe.appxbundle\",\"requestLine\":\"GET http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/faa30c4e-450f-45b5-9ba8-d999d270c123?P1=1685039689\u0026P2=404\u0026P3=2\u0026P4=J5KXMJWKulWN6iU7zXXnBHsN5grFqq4jTLeBolgTSTDCAvNAorpE%2fWRUlfYgNfcHUzyzDSl9S5jMYOK%2fY9Gqjg%3d%3d\",\"contentType\":\"application/octet-stream\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 12:20:35.738\",\"method\":\"GET\",\"requestId\":110221859374261,\"domain\":\"2.tlu.dl.delivery.mp.microsoft.com\",\"host\":\"2.tlu.dl.delivery.mp.microsoft.com\",\"contentLength\":0,\"requestUri\":\"/filestreamingservice/files/faa30c4e-450f-45b5-9ba8-d999d270c123?P1=1685039689\u0026P2=404\u0026P3=2\u0026P4=J5KXMJWKulWN6iU7zXXnBHsN5grFqq4jTLeBolgTSTDCAvNAorpE%2fWRUlfYgNfcHUzyzDSl9S5jMYOK%2fY9Gqjg%3d%3d\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"D23613W10\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.201.21\",\"SServerAddr\":\"67.43.156.173\",\"remoteAddr\":\"67.43.156.173\",\"serverIntf\":1,\"CClientAddr\":\"192.168.201.21\",\"serverCountry\":\"US\",\"sessionId\":110221866571313,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":54628,\"timeStamp\":\"2023-05-25 12:20:35.702\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":26442,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.173\",\"username\":\"eric\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -1104,6 +1136,9 @@ "file": { "name": "microsoft.microsoftofficehub_18.2304.1202.0_neutral_~_8wekyb3d8bbwe.appxbundle" }, + "host": { + "name": "D23613W10" + }, "http": { "request": { "method": "GET" @@ -1152,6 +1187,7 @@ }, "related": { "hosts": [ + "D23613W10", "2.tlu.dl.delivery.mp.microsoft.com" ], "ip": [ @@ -1222,14 +1258,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866498840, + "id": "110221866498840", "kind": "event", "original": "\u003c174\u003eMay 25 09:28:51 INFO uvm[0]: {\"timeStamp\":\"2023-05-25 09:28:51.57\",\"contentLength\":1551,\"requestLine\":\"GET http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CECnEX2U8xxBTGE6%2BVZZgJjI%3D\",\"contentType\":\"application/ocsp-response\",\"class\":\"class com.untangle.app.http.HttpResponseEvent\",\"httpRequestEvent\":{\"timeStamp\":\"2023-05-25 09:28:51.333\",\"method\":\"GET\",\"requestId\":110221859359026,\"domain\":\"ocsp.verisign.com\",\"host\":\"ocsp.verisign.com\",\"contentLength\":0,\"requestUri\":\"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTSqZMG5M8TA9rdzkbCnNwuMAd5VgQUz5mp6nsm9EvJjo%2FX8AUm7%2BPSp50CECnEX2U8xxBTGE6%2BVZZgJjI%3D\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"RemoteApp1\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"192.168.200.50\",\"SServerAddr\":\"67.43.156.128\",\"remoteAddr\":\"67.43.156.128\",\"serverIntf\":1,\"CClientAddr\":\"192.168.200.50\",\"serverCountry\":\"US\",\"sessionId\":110221866498840,\"SClientAddr\":\"1.128.0.10\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":17824,\"timeStamp\":\"2023-05-25 09:28:51.329\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":10848,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"67.43.156.128\",\"tagsString\":\"\"}}}", "provider": "http_response", @@ -1239,6 +1275,9 @@ "end" ] }, + "host": { + "name": "RemoteApp1" + }, "http": { "request": { "method": "GET" @@ -1287,6 +1326,7 @@ }, "related": { "hosts": [ + "RemoteApp1", "ocsp.verisign.com" ], "ip": [ diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-interface-stats.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-interface-stats.log-expected.json index a1a9f4afd42..792d5031c3a 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-interface-stats.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-interface-stats.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -69,7 +69,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -122,7 +122,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -175,7 +175,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -228,7 +228,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -281,7 +281,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -334,7 +334,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -387,7 +387,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -440,7 +440,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -493,7 +493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -546,7 +546,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -599,7 +599,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -652,7 +652,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -705,7 +705,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -758,7 +758,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -811,7 +811,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -864,7 +864,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -917,7 +917,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -970,7 +970,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1023,7 +1023,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-intrusion-detection.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-intrusion-detection.log-expected.json index 788389aa5db..a291587dd78 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-intrusion-detection.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-intrusion-detection.log-expected.json @@ -12,7 +12,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -24,7 +24,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -97,7 +96,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -109,7 +108,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -179,7 +177,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -191,7 +189,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -267,7 +264,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -279,7 +276,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -355,7 +351,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -367,7 +363,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -443,7 +438,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -455,7 +450,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -531,7 +525,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -543,7 +537,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -619,7 +612,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -631,7 +624,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -707,7 +699,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -719,7 +711,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, @@ -795,7 +786,7 @@ "ip": "1.128.0.72" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -807,7 +798,6 @@ "provider": "intrusion_prevention", "timezone": "America/Denver", "type": [ - "denied", "denied" ] }, diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-event.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-event.log-expected.json index 1ea8e94a93a..13d2d932eb3 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-event.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-event.log-expected.json @@ -33,14 +33,14 @@ "port": 9930 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221863965041, + "id": "110221863965041", "kind": "alert", "original": "\u003c174\u003eMay 19 11:52:37 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"Host1\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":36.551,\"localAddr\":\"10.0.0.21\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"216.160.83.56\",\"remoteAddr\":\"216.160.83.56\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.0\",\"serverCountry\":\"US\",\"sessionId\":110221863965041,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":59881,\"timeStamp\":\"2023-05-19 11:52:37.962\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":59881,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"216.160.83.56\",\"tagsString\":\"\"}", "provider": "session_event", @@ -49,6 +49,9 @@ "info" ] }, + "host": { + "name": "Host1" + }, "log": { "syslog": { "facility": { @@ -88,6 +91,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "Host1" + ], "ip": [ "216.160.83.56", "10.0.0.0", @@ -140,14 +146,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221863965040, + "id": "110221863965040", "kind": "alert", "original": "\u003c174\u003eMay 19 11:52:36 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"hp_printer\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":36.551,\"localAddr\":\"10.0.0.6\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"81.2.69.207\",\"remoteAddr\":\"81.2.69.207\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.6\",\"serverCountry\":\"US\",\"sessionId\":110221863965040,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":45028,\"timeStamp\":\"2023-05-19 11:52:36.589\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":45028,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.207\",\"tagsString\":\"\"}", "provider": "session_event", @@ -156,6 +162,9 @@ "info" ] }, + "host": { + "name": "hp_printer" + }, "log": { "syslog": { "facility": { @@ -195,6 +204,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "hp_printer" + ], "ip": [ "81.2.69.207", "10.0.0.6", @@ -247,14 +259,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221863965038, + "id": "110221863965038", "kind": "alert", "original": "\u003c174\u003eMay 19 11:52:35 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"LAPTOP1\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":36.551,\"localAddr\":\"10.0.0.17\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.121\",\"remoteAddr\":\"67.43.156.121\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.17\",\"serverCountry\":\"US\",\"sessionId\":110221863965038,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":63136,\"timeStamp\":\"2023-05-19 11:52:35.486\",\"serverLongitude\":-91.0329,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":63136,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.121\",\"username\":\"john\",\"tagsString\":\"\"}", "provider": "session_event", @@ -263,6 +275,9 @@ "info" ] }, + "host": { + "name": "LAPTOP1" + }, "log": { "syslog": { "facility": { @@ -302,6 +317,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "LAPTOP1" + ], "ip": [ "67.43.156.121", "10.0.0.17", @@ -348,14 +366,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865374876, + "id": "110221865374876", "kind": "alert", "original": "\u003c174\u003eMay 22 16:25:58 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"169.254.169.254\",\"remoteAddr\":\"169.254.169.254\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"XU\",\"sessionId\":110221865374876,\"SClientAddr\":\"89.160.20.112\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":33646,\"timeStamp\":\"2023-05-22 16:25:58.947\",\"clientIntf\":2,\"policyId\":1,\"SClientPort\":33646,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"169.254.169.254\",\"tagsString\":\"\"}", "provider": "session_event", @@ -364,6 +382,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -403,6 +424,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "169.254.169.254", "10.0.0.25", @@ -455,14 +479,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865374875, + "id": "110221865374875", "kind": "alert", "original": "\u003c174\u003eMay 22 16:25:58 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"iPhone\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.10\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"81.2.69.192\",\"remoteAddr\":\"81.2.69.192\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.10\",\"serverCountry\":\"US\",\"sessionId\":110221865374875,\"SClientAddr\":\"89.160.20.112\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":58377,\"timeStamp\":\"2023-05-22 16:25:58.908\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":58377,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.192\",\"username\":\"jane\",\"tagsString\":\"\"}", "provider": "session_event", @@ -471,6 +495,9 @@ "info" ] }, + "host": { + "name": "iPhone" + }, "log": { "syslog": { "facility": { @@ -510,6 +537,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "iPhone" + ], "ip": [ "81.2.69.192", "10.0.0.10", @@ -556,14 +586,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865374869, + "id": "110221865374869", "kind": "alert", "original": "\u003c174\u003eMay 22 16:25:58 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"169.254.169.254\",\"remoteAddr\":\"169.254.169.254\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"XU\",\"sessionId\":110221865374869,\"SClientAddr\":\"89.160.20.112\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":44558,\"timeStamp\":\"2023-05-22 16:25:58.889\",\"clientIntf\":2,\"policyId\":1,\"SClientPort\":12495,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"169.254.169.254\",\"tagsString\":\"\"}", "provider": "session_event", @@ -572,6 +602,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -611,6 +644,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "169.254.169.254", "10.0.0.25", @@ -651,14 +687,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865374868, + "id": "110221865374868", "kind": "alert", "original": "\u003c174\u003eMay 22 16:25:58 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"169.254.169.254\",\"remoteAddr\":\"169.254.169.254\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"XU\",\"sessionId\":110221865374868,\"SClientAddr\":\"89.160.20.112\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":33586,\"timeStamp\":\"2023-05-22 16:25:58.888\",\"clientIntf\":2,\"policyId\":1,\"SClientPort\":30896,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"169.254.169.254\",\"tagsString\":\"\"}", "provider": "session_event", @@ -667,6 +703,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -706,6 +745,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "169.254.169.254", "10.0.0.25", @@ -758,14 +800,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771938, + "id": "110221865771938", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:14 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771938,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36050,\"timeStamp\":\"2023-05-23 15:11:14.323\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36050,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -774,6 +816,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -813,6 +858,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -865,14 +913,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771937, + "id": "110221865771937", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:13 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771937,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36048,\"timeStamp\":\"2023-05-23 15:11:13.104\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":34178,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -881,6 +929,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -920,6 +971,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -972,14 +1026,14 @@ "port": 9930 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771936, + "id": "110221865771936", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:12 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"hp_printer\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":39.0481,\"localAddr\":\"10.0.0.0\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"175.16.199.25\",\"remoteAddr\":\"175.16.199.25\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.0\",\"serverCountry\":\"US\",\"sessionId\":110221865771936,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":37004,\"timeStamp\":\"2023-05-23 15:11:12.179\",\"serverLongitude\":-77.4728,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":37004,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"175.16.199.25\",\"tagsString\":\"\"}", "provider": "session_event", @@ -988,6 +1042,9 @@ "info" ] }, + "host": { + "name": "hp_printer" + }, "log": { "syslog": { "facility": { @@ -1027,6 +1084,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "hp_printer" + ], "ip": [ "175.16.199.25", "10.0.0.0", @@ -1079,14 +1139,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771935, + "id": "110221865771935", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:11 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771935,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36038,\"timeStamp\":\"2023-05-23 15:11:11.892\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36038,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1095,6 +1155,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1134,6 +1197,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1186,14 +1252,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771933, + "id": "110221865771933", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:10 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771933,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36026,\"timeStamp\":\"2023-05-23 15:11:10.669\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36026,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1202,6 +1268,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1241,6 +1310,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1293,14 +1365,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771929, + "id": "110221865771929", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:09 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771929,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36330,\"timeStamp\":\"2023-05-23 15:11:09.425\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36330,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1309,6 +1381,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1348,6 +1423,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1400,14 +1478,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771928, + "id": "110221865771928", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:08 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771928,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36322,\"timeStamp\":\"2023-05-23 15:11:08.187\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36322,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1416,6 +1494,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1455,6 +1536,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1507,14 +1591,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771927, + "id": "110221865771927", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:06 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771927,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36308,\"timeStamp\":\"2023-05-23 15:11:06.92\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":46905,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1523,6 +1607,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1562,6 +1649,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1614,14 +1704,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771926, + "id": "110221865771926", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:05 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771926,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36296,\"timeStamp\":\"2023-05-23 15:11:05.679\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":29004,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1630,6 +1720,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1669,6 +1762,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1721,14 +1817,14 @@ "port": 9930 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771922, + "id": "110221865771922", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:05 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"hp_printer\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":39.0481,\"localAddr\":\"10.0.0.0\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"175.16.199.25\",\"remoteAddr\":\"175.16.199.25\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.0\",\"serverCountry\":\"US\",\"sessionId\":110221865771922,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":59969,\"timeStamp\":\"2023-05-23 15:11:05.128\",\"serverLongitude\":-77.4728,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":59969,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"175.16.199.25\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1737,6 +1833,9 @@ "info" ] }, + "host": { + "name": "hp_printer" + }, "log": { "syslog": { "facility": { @@ -1776,6 +1875,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "hp_printer" + ], "ip": [ "175.16.199.25", "10.0.0.0", @@ -1828,14 +1930,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771920, + "id": "110221865771920", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:04 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771920,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36286,\"timeStamp\":\"2023-05-23 15:11:04.435\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":41723,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1844,6 +1946,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1883,6 +1988,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", @@ -1923,14 +2031,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771919, + "id": "110221865771919", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:04 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"169.254.169.254\",\"remoteAddr\":\"169.254.169.254\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"XU\",\"sessionId\":110221865771919,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":54494,\"timeStamp\":\"2023-05-23 15:11:04.104\",\"clientIntf\":2,\"policyId\":1,\"SClientPort\":54494,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"169.254.169.254\",\"tagsString\":\"\"}", "provider": "session_event", @@ -1939,6 +2047,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -1978,6 +2089,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "169.254.169.254", "10.0.0.25", @@ -2030,14 +2144,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "id": 110221865771918, + "id": "110221865771918", "kind": "alert", "original": "\u003c174\u003eMay 23 15:11:03 INFO uvm[0]: {\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"67.43.156.1\",\"remoteAddr\":\"67.43.156.1\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865771918,\"SClientAddr\":\"1.128.0.172\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":36274,\"timeStamp\":\"2023-05-23 15:11:03.201\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":36274,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.1\",\"tagsString\":\"\"}", "provider": "session_event", @@ -2046,6 +2160,9 @@ "info" ] }, + "host": { + "name": "ubuntu" + }, "log": { "syslog": { "facility": { @@ -2085,6 +2202,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "67.43.156.1", "10.0.0.25", diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log new file mode 100755 index 00000000000..a2bc8e55fbd --- /dev/null +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log @@ -0,0 +1,10 @@ +<174>Jul 8 08:58:34 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:34.93","s2pBytes":0,"p2sBytes":95,"endTime":1688828314930,"sessionId":110556429407325,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":17,"hostname":"HP2A4366","CServerPort":9930,"protocolName":"UDP","serverLatitude":39.0469,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407325,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":49825,"timeStamp":"2023-07-08 08:58:33.93","serverLongitude":-77.4903,"clientIntf":2,"policyId":1,"SClientPort":49825,"bypassed":false,"SServerPort":9930,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":95,"p2cBytes":0} +<174>Jul 8 08:58:33 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:33.214","s2pBytes":0,"p2sBytes":0,"endTime":1688828313214,"sessionId":110556429407324,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":17,"hostname":"Laptop","CServerPort":443,"protocolName":"UDP","serverLatitude":39.1027,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407324,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":58830,"timeStamp":"2023-07-08 08:58:33.213","serverLongitude":-94.5778,"clientIntf":2,"policyId":1,"SClientPort":58830,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":0,"p2cBytes":0} +<174>Jul 8 08:58:28 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:28.079","s2pBytes":0,"p2sBytes":0,"endTime":1688828308079,"sessionId":110556429407319,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":6,"hostname":"CAM_Nursery","CServerPort":443,"protocolName":"TCP","serverLatitude":39.0469,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407319,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":1,"CClientPort":48365,"timeStamp":"2023-07-08 08:58:28.079","serverLongitude":-77.4903,"clientIntf":2,"policyId":4,"SClientPort":48365,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":0,"p2cBytes":0} +<174>Jul 8 08:58:26 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:26.448","s2pBytes":7503,"p2sBytes":1433,"endTime":1688828306448,"sessionId":110556429407312,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":6,"hostname":"Laptop","CServerPort":443,"protocolName":"TCP","serverLatitude":37.1835,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407312,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":10758,"timeStamp":"2023-07-08 08:58:25.9","serverLongitude":-121.7714,"clientIntf":2,"policyId":1,"SClientPort":47467,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":1433,"p2cBytes":7503} +<174>Jul 8 08:58:25 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:25.448","s2pBytes":2686,"p2sBytes":6680,"endTime":1688828305448,"sessionId":110556429405867,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":6,"hostname":"Laptop","CServerPort":443,"protocolName":"TCP","serverLatitude":39.1027,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429405867,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":10708,"timeStamp":"2023-07-08 08:55:31.672","serverLongitude":-94.5778,"clientIntf":2,"policyId":1,"SClientPort":46641,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":6680,"p2cBytes":2686} +<174>Jul 8 08:58:24 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:24.781","s2pBytes":0,"p2sBytes":95,"endTime":1688828304781,"sessionId":110556429407307,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":17,"hostname":"HP2A4366","CServerPort":9930,"protocolName":"UDP","serverLatitude":39.0469,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407307,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":57132,"timeStamp":"2023-07-08 08:58:23.78","serverLongitude":-77.4903,"clientIntf":2,"policyId":1,"SClientPort":57132,"bypassed":false,"SServerPort":9930,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":95,"p2cBytes":0} +<174>Jul 8 08:58:23 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:23.591","s2pBytes":0,"p2sBytes":0,"endTime":1688828303591,"sessionId":110556429407306,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":17,"hostname":"Laptop","CServerPort":443,"protocolName":"UDP","serverLatitude":39.1027,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407306,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":58830,"timeStamp":"2023-07-08 08:58:23.591","serverLongitude":-94.5778,"clientIntf":2,"policyId":1,"SClientPort":58830,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":0,"p2cBytes":0} +<174>Jul 8 08:58:23 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:23.588","s2pBytes":0,"p2sBytes":0,"endTime":1688828303588,"sessionId":110556429407305,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":17,"hostname":"Laptop","CServerPort":443,"protocolName":"UDP","serverLatitude":39.1027,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429407305,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":58830,"timeStamp":"2023-07-08 08:58:23.588","serverLongitude":-94.5778,"clientIntf":2,"policyId":1,"SClientPort":58830,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":0,"p2cBytes":0} +<174>Jul 8 08:58:22 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:22.406","s2pBytes":1444,"p2sBytes":2144,"endTime":1688828302406,"sessionId":110556429405872,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":6,"hostname":"Laptop","CServerPort":443,"protocolName":"TCP","serverLatitude":39.1027,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429405872,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":10709,"timeStamp":"2023-07-08 08:55:32.106","serverLongitude":-94.5778,"clientIntf":2,"policyId":1,"SClientPort":43055,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":2144,"p2cBytes":1444} +<174>Jul 8 08:58:18 INFO uvm[0]: {"timeStamp":"2023-07-08 08:58:18.857","s2pBytes":17504157,"p2sBytes":110454,"endTime":1688828298857,"sessionId":110556429396427,"class":"class com.untangle.uvm.app.SessionStatsEvent","sessionEvent":{"entitled":true,"protocol":6,"hostname":"Galaxy-S22","CServerPort":443,"protocolName":"TCP","serverLatitude":37.751,"localAddr":"81.2.69.144","SServerAddr":"81.2.69.144","remoteAddr":"81.2.69.144","serverIntf":1,"CClientAddr":"81.2.69.144","serverCountry":"US","sessionId":110556429396427,"SClientAddr":"81.2.69.144","clientCountry":"XL","policyRuleId":0,"CClientPort":41980,"timeStamp":"2023-07-08 08:36:07.431","serverLongitude":-97.822,"clientIntf":2,"policyId":1,"SClientPort":48414,"bypassed":false,"SServerPort":443,"CServerAddr":"81.2.69.144","tagsString":""},"c2pBytes":110454,"p2cBytes":17504157} \ No newline at end of file diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log-expected.json new file mode 100644 index 00000000000..12c0a957bb3 --- /dev/null +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-session-stats.log-expected.json @@ -0,0 +1,1294 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-08T08:58:34.930-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 9930 + }, + "port": 9930 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 1000000000, + "end": "2023-07-08T08:58:34.930-06:00", + "id": "110556429407325", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:34 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:34.93\",\"s2pBytes\":0,\"p2sBytes\":95,\"endTime\":1688828314930,\"sessionId\":110556429407325,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":17,\"hostname\":\"HP2A4366\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":39.0469,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407325,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":49825,\"timeStamp\":\"2023-07-08 08:58:33.93\",\"serverLongitude\":-77.4903,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":49825,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":95,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:33.930-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "HP2A4366" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 95, + "community_id": "1:MjgsceM+lYT714SKocJeB44Yb7I=", + "direction": "external", + "iana_number": "17", + "transport": "UDP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "HP2A4366" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 95, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 49825 + }, + "port": 49825 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:33.214-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 1000000, + "end": "2023-07-08T08:58:33.214-06:00", + "id": "110556429407324", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:33 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:33.214\",\"s2pBytes\":0,\"p2sBytes\":0,\"endTime\":1688828313214,\"sessionId\":110556429407324,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":17,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":39.1027,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407324,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":58830,\"timeStamp\":\"2023-07-08 08:58:33.213\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":58830,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":0,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:33.213-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 0, + "community_id": "1:L2ZTBSYSCrjkKdAg3CgEbEZIM+c=", + "direction": "external", + "iana_number": "17", + "transport": "UDP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 58830 + }, + "port": 58830 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:28.079-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 1 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 0, + "end": "2023-07-08T08:58:28.079-06:00", + "id": "110556429407319", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:28 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:28.079\",\"s2pBytes\":0,\"p2sBytes\":0,\"endTime\":1688828308079,\"sessionId\":110556429407319,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"CAM_Nursery\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.0469,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407319,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":1,\"CClientPort\":48365,\"timeStamp\":\"2023-07-08 08:58:28.079\",\"serverLongitude\":-77.4903,\"clientIntf\":2,\"policyId\":4,\"SClientPort\":48365,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":0,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:28.079-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "CAM_Nursery" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 0, + "community_id": "1:EIV++4SQGArmFP8PDRoA9GAWCmc=", + "direction": "external", + "iana_number": "6", + "transport": "TCP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "CAM_Nursery" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "4" + }, + "source": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 48365 + }, + "port": 48365 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:26.448-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 7503, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 548000000, + "end": "2023-07-08T08:58:26.448-06:00", + "id": "110556429407312", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:26 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:26.448\",\"s2pBytes\":7503,\"p2sBytes\":1433,\"endTime\":1688828306448,\"sessionId\":110556429407312,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.1835,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407312,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":10758,\"timeStamp\":\"2023-07-08 08:58:25.9\",\"serverLongitude\":-121.7714,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":47467,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":1433,\"p2cBytes\":7503}", + "provider": "session_stats", + "start": "2023-07-08T08:58:25.900-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 8936, + "community_id": "1:CHm3MlzLk/kmu3QOjAxbM+pYdj0=", + "direction": "external", + "iana_number": "6", + "transport": "TCP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 1433, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 47467 + }, + "port": 10758 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:25.448-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 2686, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 173776000000, + "end": "2023-07-08T08:58:25.448-06:00", + "id": "110556429405867", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:25 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:25.448\",\"s2pBytes\":2686,\"p2sBytes\":6680,\"endTime\":1688828305448,\"sessionId\":110556429405867,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.1027,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429405867,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":10708,\"timeStamp\":\"2023-07-08 08:55:31.672\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":46641,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":6680,\"p2cBytes\":2686}", + "provider": "session_stats", + "start": "2023-07-08T08:55:31.672-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 9366, + "community_id": "1:Zg2gKaUijKav5E48UMHCE4dFK+U=", + "direction": "external", + "iana_number": "6", + "transport": "TCP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 6680, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 46641 + }, + "port": 10708 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:24.781-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 9930 + }, + "port": 9930 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 1001000000, + "end": "2023-07-08T08:58:24.781-06:00", + "id": "110556429407307", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:24 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:24.781\",\"s2pBytes\":0,\"p2sBytes\":95,\"endTime\":1688828304781,\"sessionId\":110556429407307,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":17,\"hostname\":\"HP2A4366\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":39.0469,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407307,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":57132,\"timeStamp\":\"2023-07-08 08:58:23.78\",\"serverLongitude\":-77.4903,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":57132,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":95,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:23.780-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "HP2A4366" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 95, + "community_id": "1:RDKlgJTejFXsP2FWm646KKiJ0YM=", + "direction": "external", + "iana_number": "17", + "transport": "UDP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "HP2A4366" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 95, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 57132 + }, + "port": 57132 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:23.591-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 0, + "end": "2023-07-08T08:58:23.591-06:00", + "id": "110556429407306", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:23 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:23.591\",\"s2pBytes\":0,\"p2sBytes\":0,\"endTime\":1688828303591,\"sessionId\":110556429407306,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":17,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":39.1027,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407306,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":58830,\"timeStamp\":\"2023-07-08 08:58:23.591\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":58830,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":0,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:23.591-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 0, + "community_id": "1:L2ZTBSYSCrjkKdAg3CgEbEZIM+c=", + "direction": "external", + "iana_number": "17", + "transport": "UDP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 58830 + }, + "port": 58830 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:23.588-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 0, + "end": "2023-07-08T08:58:23.588-06:00", + "id": "110556429407305", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:23 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:23.588\",\"s2pBytes\":0,\"p2sBytes\":0,\"endTime\":1688828303588,\"sessionId\":110556429407305,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":17,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"UDP\",\"serverLatitude\":39.1027,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429407305,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":58830,\"timeStamp\":\"2023-07-08 08:58:23.588\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":58830,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":0,\"p2cBytes\":0}", + "provider": "session_stats", + "start": "2023-07-08T08:58:23.588-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 0, + "community_id": "1:L2ZTBSYSCrjkKdAg3CgEbEZIM+c=", + "direction": "external", + "iana_number": "17", + "transport": "UDP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 0, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 58830 + }, + "port": 58830 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:22.406-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 1444, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 170300000000, + "end": "2023-07-08T08:58:22.406-06:00", + "id": "110556429405872", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:22 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:22.406\",\"s2pBytes\":1444,\"p2sBytes\":2144,\"endTime\":1688828302406,\"sessionId\":110556429405872,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Laptop\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.1027,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429405872,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":10709,\"timeStamp\":\"2023-07-08 08:55:32.106\",\"serverLongitude\":-94.5778,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":43055,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":2144,\"p2cBytes\":1444}", + "provider": "session_stats", + "start": "2023-07-08T08:55:32.106-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Laptop" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 3588, + "community_id": "1:KPWIpUdgM6sUAxhqAtvgL2SUxyg=", + "direction": "external", + "iana_number": "6", + "transport": "TCP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Laptop" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 2144, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 43055 + }, + "port": 10709 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-08T08:58:18.857-06:00", + "arista": { + "bypassed": false, + "entitled": true, + "policy": { + "rule_id": 0 + } + }, + "destination": { + "bytes": 17504157, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 443 + }, + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "duration": 1331426000000, + "end": "2023-07-08T08:58:18.857-06:00", + "id": "110556429396427", + "kind": "event", + "original": "\u003c174\u003eJul 8 08:58:18 INFO uvm[0]: {\"timeStamp\":\"2023-07-08 08:58:18.857\",\"s2pBytes\":17504157,\"p2sBytes\":110454,\"endTime\":1688828298857,\"sessionId\":110556429396427,\"class\":\"class com.untangle.uvm.app.SessionStatsEvent\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"81.2.69.144\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"81.2.69.144\",\"serverCountry\":\"US\",\"sessionId\":110556429396427,\"SClientAddr\":\"81.2.69.144\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":41980,\"timeStamp\":\"2023-07-08 08:36:07.431\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":48414,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"c2pBytes\":110454,\"p2cBytes\":17504157}", + "provider": "session_stats", + "start": "2023-07-08T08:36:07.431-06:00", + "timezone": "America/Denver", + "type": [ + "info" + ] + }, + "host": { + "name": "Galaxy-S22" + }, + "log": { + "syslog": { + "facility": { + "code": 21, + "name": "Local 5" + }, + "priority": 174, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "network": { + "bytes": 17614611, + "community_id": "1:UhoFSXFG4S2rRhOBUufP8nAvtvc=", + "direction": "external", + "iana_number": "6", + "transport": "TCP" + }, + "observer": { + "egress": { + "interface": { + "alias": "External", + "id": "1", + "name": "eth0" + } + }, + "ingress": { + "interface": { + "alias": "Internal", + "id": "2", + "name": "eth1" + } + }, + "product": "Arista NG Firewall", + "type": "firewall", + "vendor": "Arista" + }, + "related": { + "hosts": [ + "Galaxy-S22" + ], + "ip": [ + "81.2.69.144" + ] + }, + "rule": { + "ruleset": "1" + }, + "source": { + "bytes": 110454, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "nat": { + "ip": "81.2.69.144", + "port": 48414 + }, + "port": 41980 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-system-stats.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-system-stats.log-expected.json index 5e9957ba3f3..ca913425ef7 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-system-stats.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-system-stats.log-expected.json @@ -67,7 +67,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -171,7 +171,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -275,7 +275,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -379,7 +379,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -483,7 +483,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -587,7 +587,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -691,7 +691,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -795,7 +795,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -899,7 +899,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1003,7 +1003,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1107,7 +1107,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1211,7 +1211,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1315,7 +1315,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1419,7 +1419,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1523,7 +1523,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1627,7 +1627,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1731,7 +1731,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1835,7 +1835,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1939,7 +1939,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2043,7 +2043,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-web-filter.log-expected.json b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-web-filter.log-expected.json index 00fc4acee2d..9d3accf5b2e 100755 --- a/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-web-filter.log-expected.json +++ b/packages/arista_ngfw/data_stream/log/_dev/test/pipeline/test-web-filter.log-expected.json @@ -31,14 +31,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792041, + "id": "110221865792041", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:28 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://sync.hydra.opendns.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"M31525W10\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.3313,\"localAddr\":\"10.0.1.17\",\"SServerAddr\":\"81.2.69.199\",\"remoteAddr\":\"81.2.69.199\",\"serverIntf\":1,\"CClientAddr\":\"10.0.1.17\",\"serverCountry\":\"US\",\"sessionId\":110221865792041,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":53010,\"timeStamp\":\"2023-05-23 16:34:28.7\",\"serverLongitude\":-121.8401,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":28113,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.199\",\"username\":\"johndoe\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:28.737\",\"flagged\":false,\"blocked\":false,\"category\":\"Computer and Internet Security\",\"ruleId\":2,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":2}", "outcome": "success", @@ -51,6 +51,9 @@ "allowed" ] }, + "host": { + "name": "M31525W10" + }, "http": { "request": { "method": "GET" @@ -95,6 +98,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "M31525W10" + ], "ip": [ "81.2.69.199", "10.0.1.17", @@ -163,14 +169,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792037, + "id": "110221865792037", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:28 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://api.github.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865792037,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":32836,\"timeStamp\":\"2023-05-23 16:34:28.64\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":23625,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:28.682\",\"flagged\":false,\"blocked\":false,\"category\":\"Computer and Internet Info\",\"ruleId\":5,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":5}", "outcome": "success", @@ -183,6 +189,9 @@ "allowed" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "GET" @@ -227,6 +236,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "81.2.69.144", "10.0.0.25", @@ -289,14 +301,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792030, + "id": "110221865792030", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:27 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://graph-fallback.instagram.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"iPhone\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.1.10\",\"SServerAddr\":\"175.16.199.37\",\"remoteAddr\":\"175.16.199.37\",\"serverIntf\":1,\"CClientAddr\":\"10.0.1.10\",\"serverCountry\":\"US\",\"sessionId\":110221865792030,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":51495,\"timeStamp\":\"2023-05-23 16:34:27.742\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":32934,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"175.16.199.37\",\"username\":\"janedoe\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:27.768\",\"flagged\":false,\"blocked\":false,\"category\":\"Image and Video Search\",\"ruleId\":78,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":78}", "outcome": "success", @@ -309,6 +321,9 @@ "allowed" ] }, + "host": { + "name": "iPhone" + }, "http": { "request": { "method": "GET" @@ -353,6 +368,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "iPhone" + ], "ip": [ "175.16.199.37", "10.0.1.10", @@ -421,14 +439,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792017, + "id": "110221865792017", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:25 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://api.github.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865792017,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":32808,\"timeStamp\":\"2023-05-23 16:34:25.022\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":38426,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:25.065\",\"flagged\":false,\"blocked\":false,\"category\":\"Computer and Internet Info\",\"ruleId\":5,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":5}", "outcome": "success", @@ -441,6 +459,9 @@ "allowed" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "GET" @@ -485,6 +506,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "81.2.69.144", "10.0.0.25", @@ -541,14 +565,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792015, + "id": "110221865792015", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:24 INFO uvm[0]: {\"reason\":\"BLOCK_CATEGORY\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://mozilla.cloudflare-dns.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"SServerAddr\":\"1.128.0.0\",\"remoteAddr\":\"1.128.0.0\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865792015,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":49260,\"timeStamp\":\"2023-05-23 16:34:24.38\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":10240,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"1.128.0.0\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:24.393\",\"flagged\":true,\"blocked\":true,\"category\":\"Proxy Avoidance and Anonymizers\",\"ruleId\":58,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":58}", "outcome": "failure", @@ -561,6 +585,9 @@ "denied" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "GET" @@ -605,6 +632,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "1.128.0.0", "10.0.0.25", @@ -667,14 +697,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865792014, + "id": "110221865792014", "kind": "event", "original": "\u003c174\u003eMay 23 16:34:23 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://api.github.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"SServerAddr\":\"81.2.69.144\",\"remoteAddr\":\"81.2.69.144\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865792014,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":32794,\"timeStamp\":\"2023-05-23 16:34:23.812\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":16885,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"81.2.69.144\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-23 16:34:23.856\",\"flagged\":false,\"blocked\":false,\"category\":\"Computer and Internet Info\",\"ruleId\":5,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":5}", "outcome": "success", @@ -687,6 +717,9 @@ "allowed" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "GET" @@ -731,6 +764,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "81.2.69.144", "10.0.0.25", @@ -793,14 +829,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865971300, + "id": "110221865971300", "kind": "event", "original": "\u003c174\u003eMay 24 08:27:39 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"POST http://[81.2.69.142:80]/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php\",\"sessionEvent\":{\"entitled\":true,\"clientLongitude\":9.491,\"protocol\":6,\"hostname\":\"Proxy\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"localAddr\":\"10.0.0.55\",\"SServerAddr\":\"10.0.0.55\",\"remoteAddr\":\"67.43.156.27\",\"serverIntf\":2,\"CClientAddr\":\"67.43.156.27\",\"serverCountry\":\"XL\",\"sessionId\":110221865971300,\"SClientAddr\":\"67.43.156.27\",\"clientLatitude\":51.2993,\"clientCountry\":\"DE\",\"policyRuleId\":0,\"CClientPort\":41146,\"timeStamp\":\"2023-05-24 08:27:39.499\",\"clientIntf\":1,\"policyId\":1,\"SClientPort\":41146,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"81.2.69.142\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-24 08:27:39.666\",\"flagged\":false,\"blocked\":false,\"category\":\"Entertainment and Arts\",\"ruleId\":21,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":21}", "outcome": "success", @@ -813,6 +849,9 @@ "allowed" ] }, + "host": { + "name": "Proxy" + }, "http": { "request": { "method": "POST" @@ -857,6 +896,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "Proxy" + ], "ip": [ "81.2.69.142", "10.0.0.55", @@ -927,14 +969,14 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221865956519, + "id": "110221865956519", "kind": "event", "original": "\u003c174\u003eMay 24 07:58:28 INFO uvm[0]: {\"reason\":\"DEFAULT\",\"appName\":\"web_filter\",\"requestLine\":\"POST http://ocsp.digicert.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"ubuntu\",\"CServerPort\":80,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.25\",\"SServerAddr\":\"175.16.199.20\",\"remoteAddr\":\"175.16.199.20\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.25\",\"serverCountry\":\"US\",\"sessionId\":110221865956519,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":55862,\"timeStamp\":\"2023-05-24 07:58:28.456\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":19642,\"bypassed\":false,\"SServerPort\":80,\"CServerAddr\":\"175.16.199.20\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-24 07:58:28.473\",\"flagged\":false,\"blocked\":false,\"category\":\"Computer and Internet Security\",\"ruleId\":2,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":2}", "outcome": "success", @@ -947,6 +989,9 @@ "allowed" ] }, + "host": { + "name": "ubuntu" + }, "http": { "request": { "method": "POST" @@ -991,6 +1036,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "ubuntu" + ], "ip": [ "175.16.199.20", "10.0.0.25", @@ -1053,14 +1101,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866049740, + "id": "110221866049740", "kind": "event", "original": "\u003c174\u003eMay 24 11:41:00 INFO uvm[0]: {\"reason\":\"BLOCK_URL\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://ssl.google-analytics.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"Galaxy-S22\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.1.6\",\"SServerAddr\":\"67.43.156.22\",\"remoteAddr\":\"67.43.156.22\",\"serverIntf\":1,\"CClientAddr\":\"10.0.1.6\",\"serverCountry\":\"US\",\"sessionId\":110221866049740,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":39554,\"timeStamp\":\"2023-05-24 11:41:00.11\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":21617,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.22\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-24 11:41:00.14\",\"flagged\":true,\"blocked\":true,\"ruleId\":1662,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":5}", "outcome": "failure", @@ -1073,6 +1121,9 @@ "denied" ] }, + "host": { + "name": "Galaxy-S22" + }, "http": { "request": { "method": "GET" @@ -1117,6 +1168,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "Galaxy-S22" + ], "ip": [ "67.43.156.22", "10.0.1.6", @@ -1178,14 +1232,14 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network", "web" ], - "id": 110221866046822, + "id": "110221866046822", "kind": "event", "original": "\u003c174\u003eMay 24 11:31:05 INFO uvm[0]: {\"reason\":\"BLOCK_URL\",\"appName\":\"web_filter\",\"requestLine\":\"GET http://config.ads.vungle.com/\",\"sessionEvent\":{\"entitled\":true,\"protocol\":6,\"hostname\":\"iPhone\",\"CServerPort\":443,\"protocolName\":\"TCP\",\"serverLatitude\":39.0481,\"localAddr\":\"10.0.1.10\",\"SServerAddr\":\"67.43.156.0\",\"remoteAddr\":\"67.43.156.0\",\"serverIntf\":1,\"CClientAddr\":\"10.0.1.10\",\"serverCountry\":\"US\",\"sessionId\":110221866046822,\"SClientAddr\":\"81.2.69.142\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":54996,\"timeStamp\":\"2023-05-24 11:31:05.591\",\"serverLongitude\":-77.4728,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":22100,\"bypassed\":false,\"SServerPort\":443,\"CServerAddr\":\"67.43.156.0\",\"username\":\"janedoe\",\"tagsString\":\"\"},\"timeStamp\":\"2023-05-24 11:31:05.645\",\"flagged\":true,\"blocked\":true,\"category\":\"vungle.com\",\"ruleId\":2883,\"class\":\"class com.untangle.app.web_filter.WebFilterEvent\",\"categoryId\":52}", "outcome": "failure", @@ -1198,6 +1252,9 @@ "denied" ] }, + "host": { + "name": "iPhone" + }, "http": { "request": { "method": "GET" @@ -1242,6 +1299,9 @@ "vendor": "Arista" }, "related": { + "hosts": [ + "iPhone" + ], "ip": [ "67.43.156.0", "10.0.1.10", diff --git a/packages/arista_ngfw/data_stream/log/agent/stream/tcp.yml.hbs b/packages/arista_ngfw/data_stream/log/agent/stream/tcp.yml.hbs index 1a4bc0a1f01..5c72e476ba7 100755 --- a/packages/arista_ngfw/data_stream/log/agent/stream/tcp.yml.hbs +++ b/packages/arista_ngfw/data_stream/log/agent/stream/tcp.yml.hbs @@ -11,24 +11,20 @@ publisher_pipeline.disable_host: true {{/contains}} fields_under_root: true fields: -{{#if tz_offset}} _conf: +{{#if tz_offset}} tz_offset: "{{tz_offset}}" {{/if}} {{#if interface_id_1_name}} - _conf: interface_id_1_name: "{{interface_id_1_name}}" {{/if}} {{#if interface_id_1_alias}} - _conf: interface_id_1_alias: "{{interface_id_1_alias}}" {{/if}} {{#if interface_id_2_name}} - _conf: interface_id_2_name: "{{interface_id_2_name}}" {{/if}} {{#if interface_id_2_alias}} - _conf: interface_id_2_alias: "{{interface_id_2_alias}}" {{/if}} processors: diff --git a/packages/arista_ngfw/data_stream/log/agent/stream/udp.yml.hbs b/packages/arista_ngfw/data_stream/log/agent/stream/udp.yml.hbs index 8a8c232deed..6456a0ac64d 100755 --- a/packages/arista_ngfw/data_stream/log/agent/stream/udp.yml.hbs +++ b/packages/arista_ngfw/data_stream/log/agent/stream/udp.yml.hbs @@ -14,24 +14,20 @@ publisher_pipeline.disable_host: true {{/contains}} fields_under_root: true fields: -{{#if tz_offset}} _conf: +{{#if tz_offset}} tz_offset: "{{tz_offset}}" {{/if}} {{#if interface_id_1_name}} - _conf: interface_id_1_name: "{{interface_id_1_name}}" {{/if}} {{#if interface_id_1_alias}} - _conf: interface_id_1_alias: "{{interface_id_1_alias}}" {{/if}} {{#if interface_id_2_name}} - _conf: interface_id_2_name: "{{interface_id_2_name}}" {{/if}} {{#if interface_id_2_alias}} - _conf: interface_id_2_alias: "{{interface_id_2_alias}}" {{/if}} processors: diff --git a/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 15d227654bd..eb7146edfa1 100755 --- a/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -10,7 +10,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: event.original patterns: @@ -77,6 +77,14 @@ processors: return; } ctx.log.syslog.severity.name = params[(ctx.log.syslog.severity.code).toString()]; + + # Remove port number from syslog source, and put to ECS log.syslog.hostname + - gsub: + if: ctx.log?.source?.address != null && ctx.log.source.address != '' + field: log.source.address + pattern: :.* + replacement: '' + target_field: log.syslog.hostname # Parse the JSON message to arista.* - json: @@ -96,6 +104,7 @@ processors: 'class com.untangle.uvm.logging.InterfaceStatEvent', 'class com.untangle.app.intrusion_prevention.IntrusionPreventionLogEvent', 'class com.untangle.uvm.app.SessionEvent', + 'class com.untangle.uvm.app.SessionStatsEvent', 'class com.untangle.uvm.logging.SystemStatEvent', 'class com.untangle.app.web_filter.WebFilterEvent' ]; @@ -139,6 +148,11 @@ processors: if: ctx.arista?.class == 'class com.untangle.app.http.HttpRequestEvent' || ctx.arista?.class == 'class com.untangle.app.http.HttpResponseEvent' name: '{{ IngestPipeline "http_event" }}' ignore_missing_pipeline: true + - pipeline: + description: Use a separate pipeline for SessionStatsEvent events + if: ctx.arista?.class == 'class com.untangle.uvm.app.SessionStatsEvent' + name: '{{ IngestPipeline "session_stats" }}' + ignore_missing_pipeline: true ############################ ## ECS @timestamp Mapping ## @@ -170,6 +184,7 @@ processors: - "ISO8601" - "yyyy-MM-dd HH:mm:ss.SSS" - "yyyy-MM-dd HH:mm:ss.SS" + - "yyyy-MM-dd HH:mm:ss.S" on_failure: # Try to re-parse as UTC to catch when TZ is invalid or unknown. - remove: @@ -182,6 +197,7 @@ processors: - "ISO8601" - "yyyy-MM-dd HH:mm:ss.SSS" - "yyyy-MM-dd HH:mm:ss.SS" + - "yyyy-MM-dd HH:mm:ss.S" on_failure: - append: field: error.message @@ -206,6 +222,7 @@ processors: - "ISO8601" - "yyyy-MM-dd HH:mm:ss.SSS" - "yyyy-MM-dd HH:mm:ss.SS" + - "yyyy-MM-dd HH:mm:ss.S" on_failure: - append: field: error.message @@ -360,6 +377,10 @@ processors: field: arista.sessionId target_field: event.id ignore_missing: true + - convert: + field: event.id + type: string + ignore_missing: true - script: lang: painless source: | @@ -388,6 +409,70 @@ processors: ctx.event.type = 'denied'; } } + # Parse event.start + - date: + if: ctx.event?.start != null + timezone: "{{{ event.timezone }}}" + field: event.start + target_field: event.start + formats: + - "ISO8601" + - "yyyy-MM-dd HH:mm:ss.SSS" + - "yyyy-MM-dd HH:mm:ss.SS" + - "yyyy-MM-dd HH:mm:ss.S" + on_failure: + # Try to re-parse as UTC to catch when TZ is invalid or unknown. + - remove: + field: event.timezone + ignore_missing: true + - date: + if: ctx.event?.start != null + field: event.start + target_field: event.start + formats: + - "ISO8601" + - "yyyy-MM-dd HH:mm:ss.SSS" + - "yyyy-MM-dd HH:mm:ss.SS" + - "yyyy-MM-dd HH:mm:ss.S" + on_failure: + - append: + field: error.message + value: "Error parsing date from field `event.start`. Value of field: {{{ event.start }}}: {{{ _ingest.on_failure_message }}}" + - remove: + field: event.end + # Parse event.end from Unix MS + - date: + if: ctx.event?.end != null + timezone: "{{{ event.timezone }}}" + field: event.end + target_field: event.end + formats: + - "UNIX_MS" + on_failure: + # Try to re-parse as UTC to catch when TZ is invalid or unknown. + - remove: + field: event.timezone + ignore_missing: true + - date: + if: ctx.event?.end != null + field: event.end + target_field: event.end + formats: + - "UNIX_MS" + on_failure: + - append: + field: error.message + value: "Error parsing date from field `event.end`. Value of field: {{{ event.end }}}: {{{ _ingest.on_failure_message }}}" + - remove: + field: event.end + # Calculate event.duration from event.start and event.end + - script: + lang: painless + if: ctx.event?.start != null && ctx.event?.end != null + source: >- + Instant eventstart = ZonedDateTime.parse(ctx.event?.start).toInstant(); + Instant eventend = ZonedDateTime.parse(ctx.event?.end).toInstant(); + ctx.event['duration'] = ChronoUnit.NANOS.between(eventstart, eventend); # Enrich event fields based on arista.class - script: lang: painless @@ -456,7 +541,6 @@ processors: - session type: - info - - change provider: session_stats "class com.untangle.uvm.DeviceTableEvent": kind: event @@ -500,10 +584,14 @@ processors: } if (ctx.event.category.contains('network') || ctx.event.category.contains('intrusion_detection')) { if (ctx.event.outcome == 'success') { - ctx.event.type.add('allowed'); + if (ctx.event?.type == null || !ctx.event.type.contains('allowed')) { + ctx.event.type.add('allowed'); + } } if (ctx.event.outcome == 'failure') { - ctx.event.type.add('denied'); + if (ctx.event?.type == null || !ctx.event.type.contains('denied')) { + ctx.event.type.add('denied'); + } } } @@ -522,6 +610,38 @@ processors: field: arista.protocolName target_field: network.transport ignore_missing: true + - script: + description: Calculate network.bytes + if: (ctx.source?.bytes != null || ctx.destination?.bytes != null) && ctx.network?.bytes == null + ignore_failure: true + lang: painless + source: | + if (ctx.network == null) { + ctx.network = new HashMap(); + } + if (ctx.source.bytes != null && ctx.destination.bytes != null) { + ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes + } else if (ctx.source.bytes == null && ctx.destination.bytes != null) { + ctx.network.bytes = ctx.destination.bytes + } else if (ctx.source.bytes != null && ctx.destination.bytes == null) { + ctx.network.bytes = ctx.source.bytes + } + - script: + description: Calculate network.packets + if: (ctx.source?.packets != null || ctx.destination?.packets != null) && ctx.network?.packets == null + ignore_failure: true + lang: painless + source: | + if (ctx.network == null) { + ctx.network = new HashMap(); + } + if (ctx.source.packets != null && ctx.destination.packets != null) { + ctx.network.packets = ctx.source.packets + ctx.destination.packets + } else if (ctx.source.packets == null && ctx.destination.packets != null) { + ctx.network.packets = ctx.destination.packets + } else if (ctx.source.packets != null && ctx.destination.packets == null) { + ctx.network.packets = ctx.source.packets + } - script: description: Calculate network.direction if zones are not configured lang: painless @@ -717,10 +837,23 @@ processors: target_field: user.name ignore_missing: true + ###################### + ## ECS Host Mapping ## + ###################### + - rename: + field: arista.hostname + target_field: host.name + ignore_missing: true + ######################### ## ECS Related Mapping ## ######################### # Hosts + - append: + if: ctx.host?.name != null + field: related.hosts + value: '{{{host.name}}}' + allow_duplicates: false - append: if: ctx.destination?.domain != null field: related.hosts @@ -789,7 +922,6 @@ processors: - arista.clientLatitude - arista.clientLongitude - arista.filterPrefix - - arista.hostname - arista.localAddr - arista.remoteAddr - arista.httpRequestEvent.sessionEvent diff --git a/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/session_stats.yml b/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/session_stats.yml new file mode 100755 index 00000000000..c2c8e9bb48c --- /dev/null +++ b/packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/session_stats.yml @@ -0,0 +1,32 @@ +--- +description: Pipeline for processing Arista NG Firewall session stats +processors: + ######################## + ## Session Statistics ## + ######################## + - rename: + field: arista.endTime + target_field: event.end + ignore_missing: true + - rename: + field: arista.sessionEvent.timeStamp + target_field: event.start + ignore_missing: true + + ############## + ## Clean Up ## + ############## + - remove: + description: Remove Arista fields that are not necessary after parsing to ECS + field: + - arista.p2cBytes + - arista.p2sBytes + - arista.sessionEvent.sessionId + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/arista_ngfw/data_stream/log/fields/ecs.yml b/packages/arista_ngfw/data_stream/log/fields/ecs.yml index 376b8ff4da4..232889bbf3b 100755 --- a/packages/arista_ngfw/data_stream/log/fields/ecs.yml +++ b/packages/arista_ngfw/data_stream/log/fields/ecs.yml @@ -78,6 +78,8 @@ name: event.duration - external: ecs name: event.end +- external: ecs + name: event.id - external: ecs name: event.ingested - external: ecs @@ -128,6 +130,8 @@ name: log.syslog.facility.code - external: ecs name: log.syslog.facility.name +- external: ecs + name: log.syslog.hostname - external: ecs name: log.syslog.severity.code - external: ecs @@ -230,6 +234,8 @@ name: source.domain - external: ecs name: source.geo.city_name +- external: ecs + name: source.geo.continent_code - external: ecs name: source.geo.continent_name - external: ecs @@ -238,10 +244,14 @@ name: source.geo.country_name - external: ecs name: source.geo.location +- external: ecs + name: source.geo.postal_code - external: ecs name: source.geo.region_iso_code - external: ecs name: source.geo.region_name +- external: ecs + name: source.geo.timezone - external: ecs name: source.ip - external: ecs diff --git a/packages/arista_ngfw/data_stream/log/fields/fields.yml b/packages/arista_ngfw/data_stream/log/fields/fields.yml index 3bc0f00d2e0..83476a4a247 100755 --- a/packages/arista_ngfw/data_stream/log/fields/fields.yml +++ b/packages/arista_ngfw/data_stream/log/fields/fields.yml @@ -107,30 +107,30 @@ - name: swap type: group fields: - - name: free - type: group - fields: - - name: bytes - type: integer - description: Swap memory free in bytes - - name: pct - type: float - description: Percentage of swap memory free - - name: total - type: group - fields: - - name: bytes - type: integer - description: Total swap memory in bytes - - name: used - type: group - fields: - - name: bytes - type: integer - description: Swap memory used in bytes - - name: pct - type: float - description: Percentage of swap memory used + - name: free + type: group + fields: + - name: bytes + type: integer + description: Swap memory free in bytes + - name: pct + type: float + description: Percentage of swap memory free + - name: total + type: group + fields: + - name: bytes + type: integer + description: Total swap memory in bytes + - name: used + type: group + fields: + - name: bytes + type: integer + description: Swap memory used in bytes + - name: pct + type: float + description: Percentage of swap memory used - name: total type: group fields: diff --git a/packages/arista_ngfw/data_stream/log/manifest.yml b/packages/arista_ngfw/data_stream/log/manifest.yml index 49829778814..f17d34c24a6 100755 --- a/packages/arista_ngfw/data_stream/log/manifest.yml +++ b/packages/arista_ngfw/data_stream/log/manifest.yml @@ -45,6 +45,7 @@ streams: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: tz_offset type: text title: Timezone @@ -53,34 +54,34 @@ streams: show_user: false default: UTC description: IANA time zone or time offset (e.g. `America/Denver` or `-06:00`) to use when interpreting syslog timestamps without a time zone. - - name: interface_id_0_name + - name: interface_id_1_name type: text - title: Device name for interface ID 0 + title: Device name for interface ID 1 multi: false required: false show_user: false - description: Optional device name of the firewall's interface with ID 0 (e.g. `eth0`). - - name: interface_id_0_alias + description: Optional device name of the firewall's interface with ID 1 (e.g. `eth0`). + - name: interface_id_1_alias type: text - title: Alias for interface ID 0 + title: Alias for interface ID 1 multi: false required: false show_user: false - description: Optional alias of the firewall's interface with ID 0 (e.g. `External`). - - name: interface_id_1_name + description: Optional alias of the firewall's interface with ID 1 (e.g. `External` or `WAN`). + - name: interface_id_2_name type: text - title: Device name for interface ID 1 + title: Device name for interface ID 2 multi: false required: false show_user: false - description: Optional device name of the firewall's interface with ID 0 (e.g. `eth1`). - - name: interface_id_1_alias + description: Optional device name of the firewall's interface with ID 2 (e.g. `eth1`). + - name: interface_id_2_alias type: text - title: Alias for interface ID 1 + title: Alias for interface ID 2 multi: false required: false show_user: false - description: Optional alias of the firewall's interface with ID 0 (e.g. `Internal`). + description: Optional alias of the firewall's interface with ID 2 (e.g. `Internal` or `LAN`). - input: udp title: Arista NG Firewall logs description: Collect Arista NG Firewall logs via UDP @@ -125,6 +126,7 @@ streams: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: tz_offset type: text title: Timezone @@ -146,7 +148,7 @@ streams: multi: false required: false show_user: false - description: Optional alias of the firewall's interface with ID 1 (e.g. `External`). + description: Optional alias of the firewall's interface with ID 1 (e.g. `External` or `WAN`). - name: interface_id_2_name type: text title: Device name for interface ID 2 @@ -160,4 +162,4 @@ streams: multi: false required: false show_user: false - description: Optional alias of the firewall's interface with ID 2 (e.g. `Internal`). + description: Optional alias of the firewall's interface with ID 2 (e.g. `Internal` or `LAN`). diff --git a/packages/arista_ngfw/data_stream/log/sample_event.json b/packages/arista_ngfw/data_stream/log/sample_event.json index b177398b364..6c09aaf72bd 100755 --- a/packages/arista_ngfw/data_stream/log/sample_event.json +++ b/packages/arista_ngfw/data_stream/log/sample_event.json @@ -11,8 +11,10 @@ }, "event": { "entitled": true, - "category": ["session"], - "original": "<174>May 19 11:52:37 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"Host1\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.10\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"18.214.195.29\",\"remoteAddr\":\"18.214.195.29\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.10\",\"serverCountry\":\"US\",\"sessionId\":110221863965041,\"SClientAddr\":\"66.113.13.6\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":59881,\"timeStamp\":\"2023-05-19 11:52:37.962\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":59881,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"18.214.195.29\",\"tagsString\":\"\"}", + "category": [ + "session" + ], + "original": "\u003c174\u003eMay 19 11:52:37 INFO uvm[0]: {\"entitled\":true,\"protocol\":17,\"hostname\":\"Host1\",\"CServerPort\":9930,\"protocolName\":\"UDP\",\"serverLatitude\":37.751,\"localAddr\":\"10.0.0.10\",\"class\":\"class com.untangle.uvm.app.SessionEvent\",\"SServerAddr\":\"18.214.195.29\",\"remoteAddr\":\"18.214.195.29\",\"serverIntf\":1,\"CClientAddr\":\"10.0.0.10\",\"serverCountry\":\"US\",\"sessionId\":110221863965041,\"SClientAddr\":\"66.113.13.6\",\"clientCountry\":\"XL\",\"policyRuleId\":0,\"CClientPort\":59881,\"timeStamp\":\"2023-05-19 11:52:37.962\",\"serverLongitude\":-97.822,\"clientIntf\":2,\"policyId\":1,\"SClientPort\":59881,\"bypassed\":false,\"SServerPort\":9930,\"CServerAddr\":\"18.214.195.29\",\"tagsString\":\"\"}", "module": "arista_ngfw", "kind": "event", "dataset": "arista_ngfw.log", diff --git a/packages/arista_ngfw/docs/README.md b/packages/arista_ngfw/docs/README.md index 58de4478900..5d3939681b8 100755 --- a/packages/arista_ngfw/docs/README.md +++ b/packages/arista_ngfw/docs/README.md @@ -15,6 +15,7 @@ Arista NG Firewall supports several syslog output rules that may be configured o * Interface Stat Event * Intrusion Prevention Log Event * Session Event +* Session Stats Event * System Stat Event * Web Filter Event @@ -206,19 +207,20 @@ An example event for `log` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.sha256 | SHA256 hash. | keyword | @@ -256,6 +258,7 @@ An example event for `log` looks as following: | log.source.address | Source address from which the log event was read / sent from. | keyword | | log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | | log.syslog.facility.name | The Syslog text-based facility of the log event, if available. | keyword | +| log.syslog.hostname | The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector. | keyword | | log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | | log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | | log.syslog.severity.name | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different severity value (e.g. firewall, IDS), your source's text severity should go to `log.level`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `log.level`. | keyword | @@ -311,12 +314,15 @@ An example event for `log` looks as following: | source.bytes | Bytes sent from the source to the destination. | long | | source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | +| source.geo.continent_code | Two-letter code representing continent's name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | source.geo.region_iso_code | Region ISO code. | keyword | | source.geo.region_name | Region name. | keyword | +| source.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | | source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | diff --git a/packages/arista_ngfw/kibana/tags.yml b/packages/arista_ngfw/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/arista_ngfw/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/arista_ngfw/manifest.yml b/packages/arista_ngfw/manifest.yml index 8bcea8ab559..585352a58c2 100755 --- a/packages/arista_ngfw/manifest.yml +++ b/packages/arista_ngfw/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.5.1 +format_version: "3.0.0" name: arista_ngfw title: "Arista NG Firewall" -version: 0.0.1 +version: "0.5.0" source: license: "Elastic-2.0" description: "Collect logs and metrics from Arista NG Firewall." @@ -9,8 +9,10 @@ type: integration categories: - network conditions: - kibana.version: "^8.6.2" - elastic.subscription: "basic" + kibana: + version: "^8.6.2" + elastic: + subscription: "basic" icons: - src: /img/arista-logo.svg title: Arista logo @@ -29,3 +31,4 @@ policy_templates: description: Collects logs from Arista NG Firewall via UDP owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/atlassian_bitbucket/_dev/build/build.yml b/packages/atlassian_bitbucket/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/atlassian_bitbucket/_dev/build/build.yml +++ b/packages/atlassian_bitbucket/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/atlassian_bitbucket/changelog.yml b/packages/atlassian_bitbucket/changelog.yml index 38b44257b86..e76286778ee 100644 --- a/packages/atlassian_bitbucket/changelog.yml +++ b/packages/atlassian_bitbucket/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.0" + changes: + - description: Add ability to set condition for logfile logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/7371 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.13.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.12.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json b/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json index 6ccb8b5e14e..aac3580bb75 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json +++ b/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json @@ -27,7 +27,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.userdeleted", @@ -112,7 +112,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.userrenamed", @@ -189,7 +189,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercredentialupdated", @@ -264,7 +264,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupdeleted", @@ -352,7 +352,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipdeleted", @@ -445,7 +445,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -523,7 +523,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupcreated", @@ -611,7 +611,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -688,7 +688,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercreated", @@ -768,7 +768,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -837,7 +837,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -892,7 +892,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -954,7 +954,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1016,7 +1016,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1078,7 +1078,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1140,7 +1140,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1202,7 +1202,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1264,7 +1264,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1326,7 +1326,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1401,7 +1401,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1470,7 +1470,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1539,7 +1539,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1608,7 +1608,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1675,7 +1675,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.search.audit.action.elasticsearchconfigurationchange", @@ -1728,7 +1728,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.applicationconfiguration.audit.action.applicationsetup", @@ -1801,7 +1801,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.globalpermissiongranted", @@ -1874,7 +1874,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.globalpermissiongrantrequested", @@ -1953,7 +1953,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -2031,7 +2031,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercreated", @@ -2097,7 +2097,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.license.audit.action.licensechanged", @@ -2164,7 +2164,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.applicationconfiguration.audit.action.baseurlchanged", @@ -2230,7 +2230,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2283,7 +2283,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2336,7 +2336,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2389,7 +2389,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2442,7 +2442,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2495,7 +2495,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2548,7 +2548,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2601,7 +2601,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2654,7 +2654,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2707,7 +2707,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2760,7 +2760,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2813,7 +2813,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2866,7 +2866,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2919,7 +2919,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -2972,7 +2972,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3025,7 +3025,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3078,7 +3078,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3131,7 +3131,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3184,7 +3184,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3237,7 +3237,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3290,7 +3290,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3343,7 +3343,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3396,7 +3396,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3449,7 +3449,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3502,7 +3502,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3555,7 +3555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3608,7 +3608,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3661,7 +3661,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3714,7 +3714,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3767,7 +3767,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3820,7 +3820,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3873,7 +3873,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3926,7 +3926,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -3979,7 +3979,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4032,7 +4032,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4085,7 +4085,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4138,7 +4138,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4191,7 +4191,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4244,7 +4244,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4297,7 +4297,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4350,7 +4350,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4403,7 +4403,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4456,7 +4456,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4509,7 +4509,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4562,7 +4562,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4615,7 +4615,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4668,7 +4668,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4721,7 +4721,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4774,7 +4774,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4827,7 +4827,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4880,7 +4880,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4933,7 +4933,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -4986,7 +4986,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5039,7 +5039,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5092,7 +5092,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5145,7 +5145,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5198,7 +5198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5251,7 +5251,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5304,7 +5304,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5357,7 +5357,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5410,7 +5410,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5463,7 +5463,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5516,7 +5516,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5569,7 +5569,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5622,7 +5622,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5675,7 +5675,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5728,7 +5728,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5781,7 +5781,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5834,7 +5834,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5887,7 +5887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5940,7 +5940,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -5993,7 +5993,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6046,7 +6046,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6099,7 +6099,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6152,7 +6152,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6205,7 +6205,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6258,7 +6258,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6311,7 +6311,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6364,7 +6364,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6417,7 +6417,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6470,7 +6470,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6523,7 +6523,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6576,7 +6576,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6629,7 +6629,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6682,7 +6682,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6735,7 +6735,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6788,7 +6788,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6841,7 +6841,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6894,7 +6894,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -6947,7 +6947,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7000,7 +7000,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7053,7 +7053,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7106,7 +7106,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7159,7 +7159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7212,7 +7212,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7265,7 +7265,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7318,7 +7318,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7371,7 +7371,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7424,7 +7424,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7477,7 +7477,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7530,7 +7530,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7583,7 +7583,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7636,7 +7636,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7689,7 +7689,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7742,7 +7742,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7795,7 +7795,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7848,7 +7848,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7901,7 +7901,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -7954,7 +7954,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8007,7 +8007,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8060,7 +8060,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8113,7 +8113,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8166,7 +8166,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8219,7 +8219,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8272,7 +8272,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8325,7 +8325,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8378,7 +8378,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8431,7 +8431,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8484,7 +8484,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8537,7 +8537,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8590,7 +8590,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8643,7 +8643,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8696,7 +8696,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8749,7 +8749,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8802,7 +8802,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8855,7 +8855,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8908,7 +8908,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -8961,7 +8961,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9014,7 +9014,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9067,7 +9067,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9120,7 +9120,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9173,7 +9173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9226,7 +9226,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9279,7 +9279,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9332,7 +9332,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9385,7 +9385,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9438,7 +9438,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9491,7 +9491,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9544,7 +9544,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9597,7 +9597,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9650,7 +9650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9703,7 +9703,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9756,7 +9756,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.plugin.audit.action.pluginenabled", @@ -9810,7 +9810,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.applicationconfiguration.audit.action.displaynamechanged", @@ -9860,7 +9860,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupcreated", @@ -9917,7 +9917,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.directorycreated", diff --git a/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json b/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json index de8c7fe8a32..e860c167c7c 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json +++ b/packages/atlassian_bitbucket/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json @@ -45,7 +45,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -134,7 +134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.globalpermissiongrantrequested", @@ -208,7 +208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.globalpermissiongranted", @@ -270,7 +270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.applicationconfiguration.audit.action.applicationsetup", @@ -339,7 +339,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.search.audit.action.elasticsearchconfigurationchange", @@ -403,7 +403,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -474,7 +474,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -545,7 +545,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -616,7 +616,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -674,7 +674,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -738,7 +738,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -802,7 +802,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -866,7 +866,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -930,7 +930,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -994,7 +994,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1058,7 +1058,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1121,7 +1121,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -1198,7 +1198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1269,7 +1269,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -1333,7 +1333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercreated", @@ -1423,7 +1423,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -1502,7 +1502,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupcreated", @@ -1591,7 +1591,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipscreated.user", @@ -1685,7 +1685,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupmembershipdeleted", @@ -1764,7 +1764,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.groupdeleted", @@ -1838,7 +1838,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercredentialupdated", @@ -1927,7 +1927,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.userrenamed", @@ -2005,7 +2005,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.userdeleted", @@ -2077,7 +2077,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -2154,7 +2154,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -2233,7 +2233,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.projectpermissiongranted", @@ -2304,7 +2304,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectcreated", @@ -2393,7 +2393,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokencreated.personal", @@ -2481,7 +2481,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokenmodified.personal", @@ -2569,7 +2569,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokenmodified.personal", @@ -2659,7 +2659,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokendeleted.personal", @@ -2727,7 +2727,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -2804,7 +2804,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -2854,7 +2854,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.web.audit.action.logoutsuccess", @@ -2926,7 +2926,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationfailure", @@ -2994,7 +2994,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -3062,7 +3062,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -3139,7 +3139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -3203,7 +3203,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.usercredentialupdated", @@ -3298,7 +3298,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshkeycreated", @@ -3398,7 +3398,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.plugins.gpg.audit.action.gpgevent.created", @@ -3498,7 +3498,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.plugins.gpg.audit.action.gpgevent.deleted", @@ -3588,7 +3588,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshkeydeleted", @@ -3661,7 +3661,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationfailure", @@ -3729,7 +3729,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -3806,7 +3806,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -3856,7 +3856,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.scm.git.lfs.audit.action.gitlfsfeatureenabled", @@ -3920,7 +3920,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectcreationrequested", @@ -3999,7 +3999,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.projectpermissiongranted", @@ -4070,7 +4070,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectcreated", @@ -4164,7 +4164,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.branch.audit.action.projectbranchmodelconfigurationcreated", @@ -4233,7 +4233,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorycreationrequested", @@ -4307,7 +4307,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorycreated", @@ -4376,7 +4376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -4450,7 +4450,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -4524,7 +4524,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -4603,7 +4603,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorymodificationrequested", @@ -4682,7 +4682,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorymodified", @@ -4756,7 +4756,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -4845,7 +4845,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissiongrantrequested", @@ -4936,7 +4936,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissiongranted", @@ -5027,7 +5027,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshkeycreated", @@ -5132,7 +5132,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshaccesskeygranted.repository", @@ -5222,7 +5222,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissiongrantrequested", @@ -5313,7 +5313,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissiongranted", @@ -5404,7 +5404,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokencreated.repository", @@ -5494,7 +5494,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokenmodified.repository", @@ -5584,7 +5584,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.access.tokens.audit.action.accesstokendeleted.repository", @@ -5674,7 +5674,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissionrevocationrequested", @@ -5765,7 +5765,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.repositorypermissionrevoked", @@ -5856,7 +5856,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshkeydeleted", @@ -5961,7 +5961,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.ssh.audit.action.sshaccesskeyrevoked.repository", @@ -6036,7 +6036,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -6103,7 +6103,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -6180,7 +6180,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -6244,7 +6244,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectcreationrequested", @@ -6323,7 +6323,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.projectpermissiongranted", @@ -6394,7 +6394,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectcreated", @@ -6488,7 +6488,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.branch.audit.action.projectbranchmodelconfigurationcreated", @@ -6557,7 +6557,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -6644,7 +6644,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorymodificationrequested", @@ -6731,7 +6731,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorymodified", @@ -6805,7 +6805,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositoryaccessed", @@ -6872,7 +6872,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -6949,7 +6949,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -7018,7 +7018,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorydeletionrequested", @@ -7092,7 +7092,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.repository.audit.action.repositorydeleted", @@ -7159,7 +7159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -7236,7 +7236,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -7300,7 +7300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectdeletionrequested", @@ -7369,7 +7369,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectdeleted", @@ -7436,7 +7436,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -7513,7 +7513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -7577,7 +7577,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectmodificationrequested", @@ -7664,7 +7664,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.project.audit.action.projectmodified", @@ -7731,7 +7731,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bitbucket.service.user.audit.action.authenticationsuccess", @@ -7808,7 +7808,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", diff --git a/packages/atlassian_bitbucket/data_stream/audit/agent/stream/stream.yml.hbs b/packages/atlassian_bitbucket/data_stream/audit/agent/stream/stream.yml.hbs index c6e5ed4c737..de5eea39419 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/agent/stream/stream.yml.hbs +++ b/packages/atlassian_bitbucket/data_stream/audit/agent/stream/stream.yml.hbs @@ -16,4 +16,7 @@ exclude_files: [".gz$"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/atlassian_bitbucket/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/atlassian_bitbucket/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 9e382ff921a..cf3b186dfbe 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/atlassian_bitbucket/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing sample logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/atlassian_bitbucket/data_stream/audit/manifest.yml b/packages/atlassian_bitbucket/data_stream/audit/manifest.yml index 8db8b796cb2..9ac09bca15d 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/manifest.yml +++ b/packages/atlassian_bitbucket/data_stream/audit/manifest.yml @@ -39,6 +39,13 @@ streams: description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false - input: httpjson title: Bitbucket audit logs via Bitbucket audit API description: Collect Bitbucket audit logs via Bitbucket audit API @@ -83,6 +90,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -100,7 +108,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -108,7 +116,7 @@ streams: multi: false required: true show_user: false - description: Initial interval for the first API call. Defaults to 24 hours. + description: Initial interval for the first API call. Defaults to 24 hours. Supported units for this parameter are h/m/s. default: 24h - name: ssl type: yaml diff --git a/packages/atlassian_bitbucket/data_stream/audit/sample_event.json b/packages/atlassian_bitbucket/data_stream/audit/sample_event.json index cb39dfd7155..14d71545721 100644 --- a/packages/atlassian_bitbucket/data_stream/audit/sample_event.json +++ b/packages/atlassian_bitbucket/data_stream/audit/sample_event.json @@ -38,7 +38,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7", diff --git a/packages/atlassian_bitbucket/docs/README.md b/packages/atlassian_bitbucket/docs/README.md index 054a28b9b70..c1c2e294c4b 100644 --- a/packages/atlassian_bitbucket/docs/README.md +++ b/packages/atlassian_bitbucket/docs/README.md @@ -43,7 +43,7 @@ The Bitbucket integration collects audit logs from the audit log files or the au | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | group.id | Unique identifier for the group on the system/platform. | keyword | @@ -149,7 +149,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "82d0dfd8-3946-4ac0-a092-a9146a71e3f7", diff --git a/packages/atlassian_bitbucket/kibana/tags.yml b/packages/atlassian_bitbucket/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/atlassian_bitbucket/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/atlassian_bitbucket/manifest.yml b/packages/atlassian_bitbucket/manifest.yml index ba7bb253fb6..6e894ba5aaa 100644 --- a/packages/atlassian_bitbucket/manifest.yml +++ b/packages/atlassian_bitbucket/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: atlassian_bitbucket title: Atlassian Bitbucket -version: "1.11.0" +version: "1.17.0" description: Collect logs from Atlassian Bitbucket with Elastic Agent. type: integration categories: - security - productivity_security conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/bitbucket-logo.svg title: Bitbucket Logo @@ -27,3 +28,4 @@ policy_templates: description: "Collecting audit logs from Bitbucket via API" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/atlassian_confluence/_dev/build/build.yml b/packages/atlassian_confluence/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/atlassian_confluence/_dev/build/build.yml +++ b/packages/atlassian_confluence/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/atlassian_confluence/_dev/deploy/docker/files/config.yml b/packages/atlassian_confluence/_dev/deploy/docker/files/config.yml index a97c2d8b674..24cf78ba397 100644 --- a/packages/atlassian_confluence/_dev/deploy/docker/files/config.yml +++ b/packages/atlassian_confluence/_dev/deploy/docker/files/config.yml @@ -17,8 +17,10 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - from: "{from:.*}" - to: "{to:.*}" + from: >- + {from:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} + to: >- + {to:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} limit: "2" responses: - status_code: 200 @@ -30,8 +32,8 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - startDate: "{startDate:.*}" - endDate: "{endDate:.*}" + startDate: "{startDate:[0-9]+}" + endDate: "{endDate:[0-9]+}" start: "2" limit: "2" responses: @@ -43,8 +45,8 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - startDate: "{startDate:.*}" - endDate: "{endDate:.*}" + startDate: "{startDate:[0-9]+}" + endDate: "{endDate:[0-9]+}" limit: "2" start: "0" responses: diff --git a/packages/atlassian_confluence/_dev/deploy/docker/files/test-audit.log b/packages/atlassian_confluence/_dev/deploy/docker/files/test-audit.log index 3e67c696e76..bbe87e110fb 100644 --- a/packages/atlassian_confluence/_dev/deploy/docker/files/test-audit.log +++ b/packages/atlassian_confluence/_dev/deploy/docker/files/test-audit.log @@ -4,4 +4,4 @@ {"affectedObjects":[{"id":"2c9580827d4a06e8017d4a0e9dda0001","name":"Another User","type":"User"}],"auditType":{"action":"User created","actionI18nKey":"audit.logging.summary.user.created","area":"USER_MANAGEMENT","category":"Users and groups","categoryI18nKey":"audit.logging.category.user.management","level":"BASE"},"author":{"id":"2c9580827d4a06e8017d4a07c3e10000","name":"test.user","type":"user"},"changedValues":[{"i18nKey":"Display name","key":"Display name","to":"Another User"},{"i18nKey":"Email","key":"Email","to":"another.user@example.como"},{"i18nKey":"Username","key":"Username","to":"another.user"},{"i18nKey":"Active","key":"Active","to":"Yes"}],"extraAttributes":[],"method":"Browser","source":"81.2.69.143","system":"http://confluence.internal:8090","timestamp":{"epochSecond":1637625013,"nano":842000000},"version":"1.0"} {"affectedObjects":[{"id":"confluence-users","name":"confluence-users","type":"Group"},{"id":"2c9580827d4a06e8017d4a0e9dda0001","name":"another.user","type":"User"}],"auditType":{"action":"User added to group","actionI18nKey":"audit.logging.summary.group.membership.added","area":"USER_MANAGEMENT","category":"Users and groups","categoryI18nKey":"audit.logging.category.user.management","level":"BASE"},"author":{"id":"2c9580827d4a06e8017d4a07c3e10000","name":"test.user","type":"user"},"changedValues":[],"extraAttributes":[],"method":"Browser","source":"81.2.69.143","system":"http://confluence.internal:8090","timestamp":{"epochSecond":1637625013,"nano":966000000},"version":"1.0"} {"affectedObjects":[{"id":"confluence-administrators","name":"confluence-administrators","type":"Group"},{"id":"2c9580827d4a06e8017d4a0e9dda0001","name":"another.user","type":"User"}],"auditType":{"action":"User added to group","actionI18nKey":"audit.logging.summary.group.membership.added","area":"USER_MANAGEMENT","category":"Users and groups","categoryI18nKey":"audit.logging.category.user.management","level":"BASE"},"author":{"id":"2c9580827d4a06e8017d4a07c3e10000","name":"test.user","type":"user"},"changedValues":[],"extraAttributes":[],"method":"Browser","source":"81.2.69.143","system":"http://confluence.internal:8090","timestamp":{"epochSecond":1637625032,"nano":205000000},"version":"1.0"} -{"affectedObjects":[],"auditType":{"action":"Audit Log search performed","actionI18nKey":"atlassian.audit.event.action.audit.search","area":"AUDIT_LOG","category":"Auditing","categoryI18nKey":"atlassian.audit.event.category.audit","level":"BASE"},"author":{"id":"2c9580827d4a06e8017d4a07c3e10000","name":"test.user","type":"user"},"changedValues":[],"extraAttributes":[{"name":"Results returned","nameI18nKey":"atlassian.audit.event.attribute.results","value":"63"},{"name":"Query","nameI18nKey":"atlassian.audit.event.attribute.query","value":""},{"name":"ID Range","nameI18nKey":"atlassian.audit.event.attribute.id","value":"1 - 63"},{"name":"Timestamp Range","nameI18nKey":"atlassian.audit.event.attribute.timestamp","value":"2021-11-22T23:42:45.791Z - 2021-11-22T23:50:32.205Z"}],"method":"Browser","source":"81.2.69.143","system":"http://confluence.internal:8090","timestamp":{"epochSecond":1637625035,"nano":770000000},"version":"1.0"} \ No newline at end of file +{"affectedObjects":[],"auditType":{"action":"Audit Log search performed","actionI18nKey":"atlassian.audit.event.action.audit.search","area":"AUDIT_LOG","category":"Auditing","categoryI18nKey":"atlassian.audit.event.category.audit","level":"BASE"},"author":{"id":"2c9580827d4a06e8017d4a07c3e10000","name":"test.user","type":"user"},"changedValues":[],"extraAttributes":[{"name":"Results returned","nameI18nKey":"atlassian.audit.event.attribute.results","value":"63"},{"name":"Query","nameI18nKey":"atlassian.audit.event.attribute.query","value":""},{"name":"ID Range","nameI18nKey":"atlassian.audit.event.attribute.id","value":"1 - 63"},{"name":"Timestamp Range","nameI18nKey":"atlassian.audit.event.attribute.timestamp","value":"2021-11-22T23:42:45.791Z - 2021-11-22T23:50:32.205Z"}],"method":"Browser","source":"81.2.69.143","system":"http://confluence.internal:8090","timestamp":{"epochSecond":1637625035,"nano":770000000},"version":"1.0"} diff --git a/packages/atlassian_confluence/changelog.yml b/packages/atlassian_confluence/changelog.yml index b88e89768e7..973e4580169 100644 --- a/packages/atlassian_confluence/changelog.yml +++ b/packages/atlassian_confluence/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.18.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.2" + changes: + - description: Ensure pagination request timestamps are properly encoded. + type: bugfix + link: https://github.com/elastic/integrations/pull/7802 +- version: "1.16.1" + changes: + - description: Fixed cursor timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/7647 +- version: "1.16.0" + changes: + - description: Add ability to set condition for logfile logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/7370 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.14.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.13.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json index 7f9f40c77f1..6abb40531aa 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -119,7 +119,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -203,7 +203,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -287,7 +287,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -371,7 +371,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -455,7 +455,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -539,7 +539,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -623,7 +623,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -707,7 +707,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -801,7 +801,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -899,7 +899,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -997,7 +997,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1088,7 +1088,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1186,7 +1186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1284,7 +1284,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1382,7 +1382,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1473,7 +1473,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1571,7 +1571,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1669,7 +1669,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1767,7 +1767,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1858,7 +1858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1956,7 +1956,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2054,7 +2054,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2152,7 +2152,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2243,7 +2243,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2341,7 +2341,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2439,7 +2439,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2537,7 +2537,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2628,7 +2628,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2726,7 +2726,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2824,7 +2824,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2922,7 +2922,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3013,7 +3013,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3111,7 +3111,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3209,7 +3209,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3307,7 +3307,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3398,7 +3398,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3496,7 +3496,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3594,7 +3594,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3692,7 +3692,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3783,7 +3783,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3881,7 +3881,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3979,7 +3979,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4077,7 +4077,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4175,7 +4175,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4273,7 +4273,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4364,7 +4364,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4462,7 +4462,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4560,7 +4560,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4658,7 +4658,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4749,7 +4749,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4847,7 +4847,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4945,7 +4945,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5043,7 +5043,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5134,7 +5134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5232,7 +5232,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5330,7 +5330,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5428,7 +5428,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5519,7 +5519,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5617,7 +5617,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5715,7 +5715,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5813,7 +5813,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5906,7 +5906,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -5995,7 +5995,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6084,7 +6084,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6173,7 +6173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6262,7 +6262,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6351,7 +6351,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6440,7 +6440,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6522,7 +6522,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6611,7 +6611,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6700,7 +6700,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6789,7 +6789,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6878,7 +6878,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -6967,7 +6967,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7049,7 +7049,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7138,7 +7138,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7227,7 +7227,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7316,7 +7316,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7398,7 +7398,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7487,7 +7487,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7576,7 +7576,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7665,7 +7665,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7747,7 +7747,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7836,7 +7836,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -7925,7 +7925,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8014,7 +8014,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8096,7 +8096,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8185,7 +8185,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8274,7 +8274,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8363,7 +8363,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8445,7 +8445,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8534,7 +8534,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8623,7 +8623,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8712,7 +8712,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8794,7 +8794,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8883,7 +8883,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -8972,7 +8972,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9061,7 +9061,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9143,7 +9143,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9225,7 +9225,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9314,7 +9314,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9403,7 +9403,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9492,7 +9492,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9574,7 +9574,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9663,7 +9663,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9752,7 +9752,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9841,7 +9841,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -9930,7 +9930,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10019,7 +10019,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10101,7 +10101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10190,7 +10190,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10279,7 +10279,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10368,7 +10368,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10450,7 +10450,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.removed", @@ -10552,7 +10552,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.config.updated", @@ -10626,7 +10626,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.import", @@ -10711,7 +10711,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -10796,7 +10796,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -10881,7 +10881,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -10966,7 +10966,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -11051,7 +11051,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -11121,7 +11121,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -11195,7 +11195,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11289,7 +11289,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11376,7 +11376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11470,7 +11470,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11564,7 +11564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11651,7 +11651,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11745,7 +11745,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11839,7 +11839,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -11926,7 +11926,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12020,7 +12020,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12114,7 +12114,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12201,7 +12201,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12295,7 +12295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12389,7 +12389,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12476,7 +12476,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12570,7 +12570,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12664,7 +12664,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12751,7 +12751,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12845,7 +12845,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -12939,7 +12939,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13026,7 +13026,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13120,7 +13120,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13214,7 +13214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13301,7 +13301,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13395,7 +13395,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13489,7 +13489,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13583,7 +13583,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13670,7 +13670,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13764,7 +13764,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13858,7 +13858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -13945,7 +13945,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14039,7 +14039,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14133,7 +14133,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14220,7 +14220,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14314,7 +14314,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14408,7 +14408,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14495,7 +14495,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14589,7 +14589,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14683,7 +14683,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -14760,7 +14760,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -14848,7 +14848,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -14952,7 +14952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.created", @@ -15049,7 +15049,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15132,7 +15132,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15215,7 +15215,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15298,7 +15298,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15381,7 +15381,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15464,7 +15464,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15547,7 +15547,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15630,7 +15630,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -15701,7 +15701,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.created", @@ -15776,7 +15776,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.created", @@ -15941,7 +15941,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.directory.added", @@ -16008,7 +16008,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.import", @@ -16073,7 +16073,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.plugin.enabled", @@ -16138,7 +16138,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.plugin.enabled", @@ -16213,7 +16213,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.renamed", @@ -16284,7 +16284,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.updated", @@ -16361,7 +16361,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.updated", diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json index d1972212414..9c7f80b16f2 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space logo uploaded", @@ -75,7 +75,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space logo uploaded", @@ -132,7 +132,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space logo uploaded", @@ -211,7 +211,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space configuration updated", @@ -290,7 +290,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space created", @@ -374,7 +374,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space configuration updated", @@ -458,7 +458,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space created", @@ -519,7 +519,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -593,7 +593,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -680,7 +680,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -748,7 +748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -834,7 +834,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -901,7 +901,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -975,7 +975,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1049,7 +1049,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1123,7 +1123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1193,7 +1193,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Group created", @@ -1261,7 +1261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1335,7 +1335,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1409,7 +1409,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1479,7 +1479,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Group created", @@ -1547,7 +1547,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1621,7 +1621,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1695,7 +1695,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1769,7 +1769,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1839,7 +1839,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Group created", @@ -1925,7 +1925,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space configuration updated", @@ -2004,7 +2004,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Space created", @@ -2065,7 +2065,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -2139,7 +2139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -2226,7 +2226,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -2294,7 +2294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -2372,7 +2372,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User details updated", @@ -2429,7 +2429,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User deactivated", @@ -2497,7 +2497,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Page archived", @@ -2562,7 +2562,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User details updated", @@ -2619,7 +2619,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User deactivated", diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json index c8bbb132b5b..0e61db4174b 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json @@ -22,7 +22,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.plugin.enabled", @@ -89,7 +89,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.plugin.enabled", @@ -157,7 +157,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.import", @@ -316,7 +316,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.directory.added", @@ -384,7 +384,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.created", @@ -460,7 +460,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.created", @@ -548,7 +548,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -632,7 +632,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -716,7 +716,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -800,7 +800,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -884,7 +884,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -968,7 +968,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -1052,7 +1052,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -1136,7 +1136,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.permission.added", @@ -1230,7 +1230,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.created", @@ -1321,7 +1321,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -1409,7 +1409,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -1514,7 +1514,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1608,7 +1608,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1696,7 +1696,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1790,7 +1790,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1884,7 +1884,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -1972,7 +1972,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2066,7 +2066,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2160,7 +2160,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2248,7 +2248,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2342,7 +2342,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2436,7 +2436,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2524,7 +2524,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2618,7 +2618,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2712,7 +2712,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2806,7 +2806,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2894,7 +2894,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -2988,7 +2988,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3082,7 +3082,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3170,7 +3170,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3264,7 +3264,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3358,7 +3358,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3446,7 +3446,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3540,7 +3540,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3634,7 +3634,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3722,7 +3722,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3816,7 +3816,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3910,7 +3910,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -3998,7 +3998,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4092,7 +4092,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4186,7 +4186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4274,7 +4274,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4368,7 +4368,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4462,7 +4462,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4550,7 +4550,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4644,7 +4644,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4738,7 +4738,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4826,7 +4826,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -4920,7 +4920,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5014,7 +5014,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.space.permission.added", @@ -5086,7 +5086,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.config.updated", @@ -5152,7 +5152,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -5235,7 +5235,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -5309,7 +5309,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.global.settings.edited", @@ -5402,7 +5402,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.user.created", @@ -5493,7 +5493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -5581,7 +5581,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit.logging.summary.group.membership.added", @@ -5678,7 +5678,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-cloud-config.yml b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-cloud-config.yml index db15df6d8e1..88bf262f0a1 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-cloud-config.yml +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-cloud-config.yml @@ -12,3 +12,5 @@ data_stream: verification_mode: none atlassian_cloud: true enable_request_tracer: true +assert: + hit_count: 4 diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-config.yml b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-config.yml index eea4c31f5b4..6935a554b04 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-config.yml +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-api-config.yml @@ -11,3 +11,5 @@ data_stream: ssl: |- verification_mode: none enable_request_tracer: true +assert: + hit_count: 4 diff --git a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-files-config.yml b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-files-config.yml index ff9fef0ba62..93d752173f0 100644 --- a/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-files-config.yml +++ b/packages/atlassian_confluence/data_stream/audit/_dev/test/system/test-files-config.yml @@ -6,3 +6,5 @@ data_stream: - "{{SERVICE_LOGS_DIR}}/*.log" preserve_original_event: true enable_request_tracer: true +assert: + hit_count: 7 diff --git a/packages/atlassian_confluence/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/atlassian_confluence/data_stream/audit/agent/stream/httpjson.yml.hbs index 1c347fb6371..f7a60434f49 100644 --- a/packages/atlassian_confluence/data_stream/audit/agent/stream/httpjson.yml.hbs +++ b/packages/atlassian_confluence/data_stream/audit/agent/stream/httpjson.yml.hbs @@ -50,19 +50,20 @@ response.split: response.pagination: - set: - target: url.value - value: > - [[sprintf "%s/wiki/rest/api/audit?endDate=%s&startDate=%s&start=%d&limit=%s" - "{{api_url}}" - (.last_response.url.params.Get "endDate") - (.last_response.url.params.Get "startDate") - (add (toInt .last_response.body.start) (toInt .last_response.body.limit)) - "{{ limit }}"]] - fail_on_template_error: true - + target: url.params.endDate + value: '[[.last_response.url.params.Get "endDate"]]' + - set: + target: url.params.startDate + value: '[[.last_response.url.params.Get "startDate"]]' + - set: + target: url.params.start + value: '[[add (toInt .last_response.body.start) (toInt .last_response.body.limit)]]' + - set: + target: url.params.limit + value: '{{limit}}' cursor: last_timestamp: - value: '[[.first_event.creationDate]]' + value: '[[(toInt .first_event.creationDate)]]' fields_under_root: true fields: diff --git a/packages/atlassian_confluence/data_stream/audit/agent/stream/stream.yml.hbs b/packages/atlassian_confluence/data_stream/audit/agent/stream/stream.yml.hbs index c6e5ed4c737..de5eea39419 100644 --- a/packages/atlassian_confluence/data_stream/audit/agent/stream/stream.yml.hbs +++ b/packages/atlassian_confluence/data_stream/audit/agent/stream/stream.yml.hbs @@ -16,4 +16,7 @@ exclude_files: [".gz$"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/atlassian_confluence/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/atlassian_confluence/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index dc470649e8a..34fbe017856 100644 --- a/packages/atlassian_confluence/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/atlassian_confluence/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Atlassian Confluence audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/atlassian_confluence/data_stream/audit/manifest.yml b/packages/atlassian_confluence/data_stream/audit/manifest.yml index 3f8a438cee5..f713df4dd04 100644 --- a/packages/atlassian_confluence/data_stream/audit/manifest.yml +++ b/packages/atlassian_confluence/data_stream/audit/manifest.yml @@ -39,6 +39,13 @@ streams: description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false - input: httpjson title: Confluence audit logs via Confluence audit API description: Collect Confluence audit logs via Confluence audit API @@ -91,6 +98,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -108,7 +116,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -116,7 +124,7 @@ streams: multi: false required: true show_user: false - description: Initial interval for the first API call. Defaults to 24 hours. + description: Initial interval for the first API call. Defaults to 24 hours. Supported units for this parameter are h/m/s. default: 24h - name: ssl type: yaml diff --git a/packages/atlassian_confluence/data_stream/audit/sample_event.json b/packages/atlassian_confluence/data_stream/audit/sample_event.json index 8bc3b9bd90d..6ac6837fb7b 100644 --- a/packages/atlassian_confluence/data_stream/audit/sample_event.json +++ b/packages/atlassian_confluence/data_stream/audit/sample_event.json @@ -47,7 +47,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/atlassian_confluence/docs/README.md b/packages/atlassian_confluence/docs/README.md index 8fc58e3bbf4..4879445c029 100644 --- a/packages/atlassian_confluence/docs/README.md +++ b/packages/atlassian_confluence/docs/README.md @@ -50,9 +50,9 @@ The Confluence integration collects audit logs from the audit log files or the a | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -170,7 +170,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/atlassian_confluence/kibana/tags.yml b/packages/atlassian_confluence/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/atlassian_confluence/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/atlassian_confluence/manifest.yml b/packages/atlassian_confluence/manifest.yml index 3607716abac..54a03d67898 100644 --- a/packages/atlassian_confluence/manifest.yml +++ b/packages/atlassian_confluence/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: atlassian_confluence title: Atlassian Confluence -version: "1.12.0" +version: "1.18.0" description: Collect logs from Atlassian Confluence with Elastic Agent. type: integration categories: - security - productivity_security conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/confluence-logo.svg title: Confluence Logo @@ -27,3 +28,4 @@ policy_templates: description: "Collecting audit logs from Confluence via API" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/atlassian_jira/_dev/build/build.yml b/packages/atlassian_jira/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/atlassian_jira/_dev/build/build.yml +++ b/packages/atlassian_jira/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/atlassian_jira/_dev/deploy/docker/files/config.yml b/packages/atlassian_jira/_dev/deploy/docker/files/config.yml index f8e5c104b55..b8c137ab436 100644 --- a/packages/atlassian_jira/_dev/deploy/docker/files/config.yml +++ b/packages/atlassian_jira/_dev/deploy/docker/files/config.yml @@ -17,8 +17,10 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - from: "{from:.*}" - to: "{to:.*}" + from: >- + {from:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} + to: >- + {to:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} limit: "2" responses: - status_code: 200 @@ -30,8 +32,10 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - from: "{from:.*}" - to: "{to:.*}" + from: >- + {from:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} + to: >- + {to:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} offset: "2" limit: "2" responses: @@ -43,8 +47,10 @@ rules: request_headers: authorization: Basic dGVzdC51c2VyOmFiYzEyMw== query_params: - from: "{from:.*}" - to: "{to:.*}" + from: >- + {from:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} + to: >- + {to:[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\.[0-9]{1,3})?(?:(?:[+-][0-9]{4})|Z)?} limit: "2" offset: "0" responses: diff --git a/packages/atlassian_jira/changelog.yml b/packages/atlassian_jira/changelog.yml index 36ee1964f06..94a9f86cba2 100644 --- a/packages/atlassian_jira/changelog.yml +++ b/packages/atlassian_jira/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 1.18.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.1" + changes: + - description: Ensure from/to timestamps are properly encoded. + type: bugfix + link: https://github.com/elastic/integrations/pull/7759 +- version: "1.16.0" + changes: + - description: Add ability to set condition for logfile logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/7369 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.14.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.13.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json index a77a4ca60f3..89ea0586859 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-api.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-22T00:34:47.536Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -86,7 +86,7 @@ { "@timestamp": "2021-11-22T00:34:40.008Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -169,7 +169,7 @@ { "@timestamp": "2021-11-22T00:34:23.154Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "personal.access.tokens.audit.log.summary.token.created", @@ -238,7 +238,7 @@ { "@timestamp": "2021-11-22T00:32:20.234Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -309,7 +309,7 @@ { "@timestamp": "2021-11-22T00:31:52.991Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -380,7 +380,7 @@ { "@timestamp": "2021-11-22T00:31:37.412Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -451,7 +451,7 @@ { "@timestamp": "2021-11-22T00:31:26.455Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -522,7 +522,7 @@ { "@timestamp": "2021-11-22T00:30:59.449Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -593,7 +593,7 @@ { "@timestamp": "2021-11-22T00:26:03.206Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -664,7 +664,7 @@ { "@timestamp": "2021-11-22T00:12:02.856Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -735,7 +735,7 @@ { "@timestamp": "2021-11-22T00:08:34.545Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -806,7 +806,7 @@ { "@timestamp": "2021-11-22T00:08:34.543Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -882,7 +882,7 @@ { "@timestamp": "2021-11-22T00:08:34.535Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.released", @@ -946,7 +946,7 @@ { "@timestamp": "2021-11-22T00:08:34.521Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -1022,7 +1022,7 @@ { "@timestamp": "2021-11-22T00:08:34.506Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.project.roles.changed", @@ -1092,7 +1092,7 @@ { "@timestamp": "2021-11-22T00:08:34.297Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.project.created", @@ -1185,7 +1185,7 @@ { "@timestamp": "2021-11-22T00:08:34.266Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.added.to.project", @@ -1249,7 +1249,7 @@ { "@timestamp": "2021-11-22T00:08:34.249Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.removed.from.project", @@ -1317,7 +1317,7 @@ { "@timestamp": "2021-11-22T00:08:34.243Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1387,7 +1387,7 @@ { "@timestamp": "2021-11-22T00:08:34.241Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1457,7 +1457,7 @@ { "@timestamp": "2021-11-22T00:08:34.239Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1527,7 +1527,7 @@ { "@timestamp": "2021-11-22T00:08:34.236Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1597,7 +1597,7 @@ { "@timestamp": "2021-11-22T00:08:34.235Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1667,7 +1667,7 @@ { "@timestamp": "2021-11-22T00:08:34.233Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1737,7 +1737,7 @@ { "@timestamp": "2021-11-22T00:08:34.231Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1812,7 +1812,7 @@ { "@timestamp": "2021-11-22T00:08:34.229Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1882,7 +1882,7 @@ { "@timestamp": "2021-11-22T00:08:34.227Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1957,7 +1957,7 @@ { "@timestamp": "2021-11-22T00:08:34.225Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2027,7 +2027,7 @@ { "@timestamp": "2021-11-22T00:08:34.223Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2097,7 +2097,7 @@ { "@timestamp": "2021-11-22T00:08:34.221Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2172,7 +2172,7 @@ { "@timestamp": "2021-11-22T00:08:34.219Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2242,7 +2242,7 @@ { "@timestamp": "2021-11-22T00:08:34.217Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2317,7 +2317,7 @@ { "@timestamp": "2021-11-22T00:08:34.215Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2387,7 +2387,7 @@ { "@timestamp": "2021-11-22T00:08:34.212Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2462,7 +2462,7 @@ { "@timestamp": "2021-11-22T00:08:34.210Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2537,7 +2537,7 @@ { "@timestamp": "2021-11-22T00:08:34.208Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2607,7 +2607,7 @@ { "@timestamp": "2021-11-22T00:08:34.204Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2682,7 +2682,7 @@ { "@timestamp": "2021-11-22T00:08:34.190Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2752,7 +2752,7 @@ { "@timestamp": "2021-11-22T00:08:34.187Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2822,7 +2822,7 @@ { "@timestamp": "2021-11-22T00:08:34.184Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2897,7 +2897,7 @@ { "@timestamp": "2021-11-22T00:08:34.182Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -2967,7 +2967,7 @@ { "@timestamp": "2021-11-22T00:08:34.180Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3037,7 +3037,7 @@ { "@timestamp": "2021-11-22T00:08:34.178Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3107,7 +3107,7 @@ { "@timestamp": "2021-11-22T00:08:34.176Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3177,7 +3177,7 @@ { "@timestamp": "2021-11-22T00:08:34.174Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3247,7 +3247,7 @@ { "@timestamp": "2021-11-22T00:08:34.173Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3322,7 +3322,7 @@ { "@timestamp": "2021-11-22T00:08:34.171Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3392,7 +3392,7 @@ { "@timestamp": "2021-11-22T00:08:34.168Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3462,7 +3462,7 @@ { "@timestamp": "2021-11-22T00:08:34.166Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3532,7 +3532,7 @@ { "@timestamp": "2021-11-22T00:08:34.165Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3602,7 +3602,7 @@ { "@timestamp": "2021-11-22T00:08:34.163Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3672,7 +3672,7 @@ { "@timestamp": "2021-11-22T00:08:34.151Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3742,7 +3742,7 @@ { "@timestamp": "2021-11-22T00:08:34.142Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.created", @@ -3812,7 +3812,7 @@ { "@timestamp": "2021-11-22T00:08:34.072Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Board created", @@ -3876,7 +3876,7 @@ { "@timestamp": "2021-11-22T00:08:33.887Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.filter.created", @@ -3973,7 +3973,7 @@ { "@timestamp": "2021-11-22T00:08:33.746Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.scheme.added.to.project", @@ -4037,7 +4037,7 @@ { "@timestamp": "2021-11-22T00:08:33.732Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.scheme.created", @@ -4107,7 +4107,7 @@ { "@timestamp": "2021-11-22T00:08:33.710Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.created", @@ -4187,7 +4187,7 @@ { "@timestamp": "2021-11-22T00:08:33.537Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -4252,7 +4252,7 @@ { "@timestamp": "2021-11-22T00:08:33.536Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -4317,7 +4317,7 @@ { "@timestamp": "2021-11-22T00:08:33.535Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -4382,7 +4382,7 @@ { "@timestamp": "2021-11-22T00:08:33.534Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -4447,7 +4447,7 @@ { "@timestamp": "2021-11-22T00:07:09.088Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4522,7 +4522,7 @@ { "@timestamp": "2021-11-22T00:07:09.037Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.issue.type.created", @@ -4582,7 +4582,7 @@ { "@timestamp": "2021-11-22T00:07:02.794Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4657,7 +4657,7 @@ { "@timestamp": "2021-11-22T00:07:02.725Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4732,7 +4732,7 @@ { "@timestamp": "2021-11-22T00:07:02.694Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4807,7 +4807,7 @@ { "@timestamp": "2021-11-22T00:07:01.669Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4882,7 +4882,7 @@ { "@timestamp": "2021-11-22T00:07:01.644Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -4957,7 +4957,7 @@ { "@timestamp": "2021-11-22T00:06:59.522Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5032,7 +5032,7 @@ { "@timestamp": "2021-11-22T00:06:59.485Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.issue.type.created", @@ -5092,7 +5092,7 @@ { "@timestamp": "2021-11-22T00:06:59.340Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -5150,7 +5150,7 @@ { "@timestamp": "2021-11-22T00:06:59.332Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -5208,7 +5208,7 @@ { "@timestamp": "2021-11-22T00:06:59.313Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5278,7 +5278,7 @@ { "@timestamp": "2021-11-22T00:06:59.266Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5353,7 +5353,7 @@ { "@timestamp": "2021-11-22T00:06:59.224Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5428,7 +5428,7 @@ { "@timestamp": "2021-11-22T00:06:58.990Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -5486,7 +5486,7 @@ { "@timestamp": "2021-11-22T00:06:58.974Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5556,7 +5556,7 @@ { "@timestamp": "2021-11-22T00:06:58.318Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -5626,7 +5626,7 @@ { "@timestamp": "2021-11-22T00:06:57.162Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5701,7 +5701,7 @@ { "@timestamp": "2021-11-22T00:06:57.158Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5776,7 +5776,7 @@ { "@timestamp": "2021-11-22T00:06:57.138Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5851,7 +5851,7 @@ { "@timestamp": "2021-11-22T00:06:49.756Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.added.to.group", @@ -5926,7 +5926,7 @@ { "@timestamp": "2021-11-22T00:06:49.754Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -5999,7 +5999,7 @@ { "@timestamp": "2021-11-22T00:06:49.752Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6072,7 +6072,7 @@ { "@timestamp": "2021-11-22T00:06:49.751Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6145,7 +6145,7 @@ { "@timestamp": "2021-11-22T00:06:49.750Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6218,7 +6218,7 @@ { "@timestamp": "2021-11-22T00:06:49.734Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.added.to.group", @@ -6293,7 +6293,7 @@ { "@timestamp": "2021-11-22T00:06:49.600Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.created", @@ -6387,7 +6387,7 @@ { "@timestamp": "2021-11-22T00:05:08.596Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.system.license.added", @@ -6481,7 +6481,7 @@ { "@timestamp": "2021-11-22T00:05:08.584Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6554,7 +6554,7 @@ { "@timestamp": "2021-11-22T00:05:08.583Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6627,7 +6627,7 @@ { "@timestamp": "2021-11-22T00:05:08.581Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6700,7 +6700,7 @@ { "@timestamp": "2021-11-22T00:05:08.579Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -6773,7 +6773,7 @@ { "@timestamp": "2021-11-22T00:05:08.514Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.group.created", @@ -6837,7 +6837,7 @@ { "@timestamp": "2021-11-28T18:18:26.076Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.renamed", @@ -6910,7 +6910,7 @@ { "@timestamp": "2021-11-28T18:23:20.278Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.updated", @@ -6988,7 +6988,7 @@ { "@timestamp": "2021-11-28T18:23:13.741Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.updated", diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json index 78b43c90019..3577ec78b28 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-cloud.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-01-24T08:48:05.645Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project deleted", @@ -36,7 +36,7 @@ { "@timestamp": "2022-01-24T08:48:05.316Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme deleted", @@ -69,7 +69,7 @@ { "@timestamp": "2022-01-24T08:48:05.097Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -114,7 +114,7 @@ { "@timestamp": "2022-01-24T08:48:04.939Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -159,7 +159,7 @@ { "@timestamp": "2022-01-24T08:48:04.716Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -204,7 +204,7 @@ { "@timestamp": "2022-01-24T08:48:04.530Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -249,7 +249,7 @@ { "@timestamp": "2022-01-24T08:48:04.167Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -294,7 +294,7 @@ { "@timestamp": "2022-01-24T08:48:04.020Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow scheme deleted", @@ -327,7 +327,7 @@ { "@timestamp": "2022-01-24T08:48:03.965Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow deleted", @@ -360,7 +360,7 @@ { "@timestamp": "2022-01-24T08:48:03.371Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Notification scheme deleted", @@ -393,7 +393,7 @@ { "@timestamp": "2022-01-24T08:48:03.355Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project role deleted", @@ -426,7 +426,7 @@ { "@timestamp": "2022-01-24T08:48:03.339Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project role deleted", @@ -459,7 +459,7 @@ { "@timestamp": "2022-01-24T08:48:03.322Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project role deleted", @@ -492,7 +492,7 @@ { "@timestamp": "2022-01-24T08:48:03.305Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project role deleted", @@ -525,7 +525,7 @@ { "@timestamp": "2022-01-24T08:48:03.259Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Issue Security scheme deleted", @@ -558,7 +558,7 @@ { "@timestamp": "2022-01-24T08:48:03.223Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Permission scheme deleted", @@ -591,7 +591,7 @@ { "@timestamp": "2022-01-18T08:43:02.838Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -650,7 +650,7 @@ { "@timestamp": "2022-01-18T08:43:02.768Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -709,7 +709,7 @@ { "@timestamp": "2022-01-18T08:43:02.602Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -766,7 +766,7 @@ { "@timestamp": "2022-01-14T16:37:07.126Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -825,7 +825,7 @@ { "@timestamp": "2022-01-14T16:37:07.019Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -882,7 +882,7 @@ { "@timestamp": "2022-01-10T12:44:41.065Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User's password changed", @@ -938,7 +938,7 @@ { "@timestamp": "2022-01-06T09:49:07.418Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -983,7 +983,7 @@ { "@timestamp": "2022-01-05T07:23:49.369Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -1019,7 +1019,7 @@ { "@timestamp": "2022-01-05T07:23:49.162Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -1064,7 +1064,7 @@ { "@timestamp": "2021-12-13T14:10:35.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -1109,7 +1109,7 @@ { "@timestamp": "2021-12-10T11:57:29.971Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User's password changed", @@ -1165,7 +1165,7 @@ { "@timestamp": "2021-12-10T11:53:37.982Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -1242,7 +1242,7 @@ { "@timestamp": "2021-12-10T11:52:39.940Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Customer invited notification changed", @@ -1307,7 +1307,7 @@ { "@timestamp": "2021-12-07T17:15:05.069Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User created", @@ -1384,7 +1384,7 @@ { "@timestamp": "2021-12-07T17:03:54.188Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Customer permissions changed", @@ -1449,7 +1449,7 @@ { "@timestamp": "2021-12-07T16:56:48.122Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Request type deleted", @@ -1533,7 +1533,7 @@ { "@timestamp": "2021-12-07T16:56:24.940Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Request type deleted", @@ -1617,7 +1617,7 @@ { "@timestamp": "2021-12-07T16:56:07.861Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Request type deleted", @@ -1701,7 +1701,7 @@ { "@timestamp": "2021-12-07T16:54:03.906Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Request type deleted", @@ -1785,7 +1785,7 @@ { "@timestamp": "2021-12-07T16:46:02.950Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1844,7 +1844,7 @@ { "@timestamp": "2021-12-07T16:46:02.944Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1903,7 +1903,7 @@ { "@timestamp": "2021-12-07T16:46:02.939Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -1962,7 +1962,7 @@ { "@timestamp": "2021-12-07T16:46:02.932Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User added to group", @@ -2021,7 +2021,7 @@ { "@timestamp": "2021-12-07T16:45:24.007Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Group created", @@ -2062,7 +2062,7 @@ { "@timestamp": "2021-12-07T16:29:41.490Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project created", @@ -2155,7 +2155,7 @@ { "@timestamp": "2021-12-07T16:29:38.789Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Custom email channel turned on", @@ -2223,7 +2223,7 @@ { "@timestamp": "2021-12-07T16:29:38.773Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud Email settings created", @@ -2281,7 +2281,7 @@ { "@timestamp": "2021-12-07T16:29:38.426Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud email channel turned on", @@ -2349,7 +2349,7 @@ { "@timestamp": "2021-12-07T16:29:36.956Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2440,7 +2440,7 @@ { "@timestamp": "2021-12-07T16:29:36.930Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2531,7 +2531,7 @@ { "@timestamp": "2021-12-07T16:29:36.903Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2622,7 +2622,7 @@ { "@timestamp": "2021-12-07T16:29:36.877Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2713,7 +2713,7 @@ { "@timestamp": "2021-12-07T16:29:36.849Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2804,7 +2804,7 @@ { "@timestamp": "2021-12-07T16:29:36.823Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2895,7 +2895,7 @@ { "@timestamp": "2021-12-07T16:29:36.797Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -2986,7 +2986,7 @@ { "@timestamp": "2021-12-07T16:29:36.770Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3077,7 +3077,7 @@ { "@timestamp": "2021-12-07T16:29:36.743Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3168,7 +3168,7 @@ { "@timestamp": "2021-12-07T16:29:36.717Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3259,7 +3259,7 @@ { "@timestamp": "2021-12-07T16:29:36.691Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3350,7 +3350,7 @@ { "@timestamp": "2021-12-07T16:29:36.664Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3441,7 +3441,7 @@ { "@timestamp": "2021-12-07T16:29:36.637Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3532,7 +3532,7 @@ { "@timestamp": "2021-12-07T16:29:36.609Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3623,7 +3623,7 @@ { "@timestamp": "2021-12-07T16:29:36.561Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3714,7 +3714,7 @@ { "@timestamp": "2021-12-07T16:29:36.529Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Project component created", @@ -3805,7 +3805,7 @@ { "@timestamp": "2021-12-07T16:29:36.499Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow scheme added to project", @@ -3867,7 +3867,7 @@ { "@timestamp": "2021-12-07T16:29:36.468Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -3931,7 +3931,7 @@ { "@timestamp": "2021-12-07T16:29:36.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -3988,7 +3988,7 @@ { "@timestamp": "2021-12-07T16:29:36.421Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow created", @@ -4056,7 +4056,7 @@ { "@timestamp": "2021-12-07T16:29:36.329Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -4120,7 +4120,7 @@ { "@timestamp": "2021-12-07T16:29:36.310Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -4177,7 +4177,7 @@ { "@timestamp": "2021-12-07T16:29:36.283Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow created", @@ -4245,7 +4245,7 @@ { "@timestamp": "2021-12-07T16:29:36.186Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow updated", @@ -4309,7 +4309,7 @@ { "@timestamp": "2021-11-18T10:58:11.410Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -4378,7 +4378,7 @@ { "@timestamp": "2021-11-18T10:58:11.132Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -4447,7 +4447,7 @@ { "@timestamp": "2021-11-18T10:58:10.771Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow scheme added to project", @@ -4509,7 +4509,7 @@ { "@timestamp": "2021-11-18T10:58:10.754Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow scheme created", @@ -4577,7 +4577,7 @@ { "@timestamp": "2021-11-18T10:58:10.744Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Workflow created", @@ -4641,7 +4641,7 @@ { "@timestamp": "2021-11-18T10:58:10.473Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -4710,7 +4710,7 @@ { "@timestamp": "2021-11-18T10:58:10.265Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme updated", @@ -4781,7 +4781,7 @@ { "@timestamp": "2021-11-18T10:58:10.174Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme added to project", @@ -4843,7 +4843,7 @@ { "@timestamp": "2021-11-18T10:58:10.146Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Field Configuration scheme created", @@ -4912,7 +4912,7 @@ { "@timestamp": "2021-11-18T10:58:10.114Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Issue Security scheme added to project", @@ -4974,7 +4974,7 @@ { "@timestamp": "2021-11-18T10:58:10.062Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Permission scheme added to project", @@ -5036,7 +5036,7 @@ { "@timestamp": "2021-11-17T16:00:37.374Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User updated", @@ -5083,7 +5083,7 @@ { "@timestamp": "2021-11-16T09:25:56.725Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "User updated", @@ -5130,7 +5130,7 @@ { "@timestamp": "2021-11-16T08:48:05.867Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Custom field created", diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json index 68f2e2256a0..18bfd08f362 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/pipeline/test-audit-files.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-22T00:05:08.514Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.group.created", @@ -68,7 +68,7 @@ { "@timestamp": "2021-11-22T00:05:08.579Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -143,7 +143,7 @@ { "@timestamp": "2021-11-22T00:05:08.581Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -218,7 +218,7 @@ { "@timestamp": "2021-11-22T00:05:08.583Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -293,7 +293,7 @@ { "@timestamp": "2021-11-22T00:05:08.584Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -368,7 +368,7 @@ { "@timestamp": "2021-11-22T00:05:08.596Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.system.license.added", @@ -464,7 +464,7 @@ { "@timestamp": "2021-11-22T00:06:49.600Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.created", @@ -559,7 +559,7 @@ { "@timestamp": "2021-11-22T00:06:49.734Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.added.to.group", @@ -634,7 +634,7 @@ { "@timestamp": "2021-11-22T00:06:49.750Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -709,7 +709,7 @@ { "@timestamp": "2021-11-22T00:06:49.751Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -784,7 +784,7 @@ { "@timestamp": "2021-11-22T00:06:49.752Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -859,7 +859,7 @@ { "@timestamp": "2021-11-22T00:06:49.754Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.global.permission.added", @@ -934,7 +934,7 @@ { "@timestamp": "2021-11-22T00:06:49.756Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.added.to.group", @@ -1009,7 +1009,7 @@ { "@timestamp": "2021-11-22T00:06:57.138Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1085,7 +1085,7 @@ { "@timestamp": "2021-11-22T00:06:57.158Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1161,7 +1161,7 @@ { "@timestamp": "2021-11-22T00:06:57.162Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -1237,7 +1237,7 @@ { "@timestamp": "2021-11-22T00:06:58.318Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1308,7 +1308,7 @@ { "@timestamp": "2021-11-22T00:06:58.974Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1379,7 +1379,7 @@ { "@timestamp": "2021-11-22T00:06:58.990Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -1438,7 +1438,7 @@ { "@timestamp": "2021-11-22T00:06:59.224Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1514,7 +1514,7 @@ { "@timestamp": "2021-11-22T00:06:59.266Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1590,7 +1590,7 @@ { "@timestamp": "2021-11-22T00:06:59.313Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1661,7 +1661,7 @@ { "@timestamp": "2021-11-22T00:06:59.332Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -1720,7 +1720,7 @@ { "@timestamp": "2021-11-22T00:06:59.340Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.updated", @@ -1779,7 +1779,7 @@ { "@timestamp": "2021-11-22T00:06:59.485Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.issue.type.created", @@ -1841,7 +1841,7 @@ { "@timestamp": "2021-11-22T00:06:59.522Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1917,7 +1917,7 @@ { "@timestamp": "2021-11-22T00:07:01.644Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -1993,7 +1993,7 @@ { "@timestamp": "2021-11-22T00:07:01.669Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -2069,7 +2069,7 @@ { "@timestamp": "2021-11-22T00:07:02.694Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -2145,7 +2145,7 @@ { "@timestamp": "2021-11-22T00:07:02.725Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -2221,7 +2221,7 @@ { "@timestamp": "2021-11-22T00:07:02.794Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -2297,7 +2297,7 @@ { "@timestamp": "2021-11-22T00:07:09.370Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.issue.type.created", @@ -2359,7 +2359,7 @@ { "@timestamp": "2021-11-22T00:07:09.880Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.customfield.created", @@ -2435,7 +2435,7 @@ { "@timestamp": "2021-11-22T00:08:33.534Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -2501,7 +2501,7 @@ { "@timestamp": "2021-11-22T00:08:33.535Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -2567,7 +2567,7 @@ { "@timestamp": "2021-11-22T00:08:33.536Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -2633,7 +2633,7 @@ { "@timestamp": "2021-11-22T00:08:33.537Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.resolutions.created", @@ -2699,7 +2699,7 @@ { "@timestamp": "2021-11-22T00:08:33.710Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.created", @@ -2780,7 +2780,7 @@ { "@timestamp": "2021-11-22T00:08:33.732Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.scheme.created", @@ -2851,7 +2851,7 @@ { "@timestamp": "2021-11-22T00:08:33.746Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.workflow.scheme.added.to.project", @@ -2915,7 +2915,7 @@ { "@timestamp": "2021-11-22T00:08:33.887Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.filter.created", @@ -3011,7 +3011,7 @@ { "@timestamp": "2021-11-22T00:08:34.720Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Board created", @@ -3075,7 +3075,7 @@ { "@timestamp": "2021-11-22T00:08:34.142Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.created", @@ -3146,7 +3146,7 @@ { "@timestamp": "2021-11-22T00:08:34.151Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3217,7 +3217,7 @@ { "@timestamp": "2021-11-22T00:08:34.163Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3288,7 +3288,7 @@ { "@timestamp": "2021-11-22T00:08:34.165Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3359,7 +3359,7 @@ { "@timestamp": "2021-11-22T00:08:34.166Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3430,7 +3430,7 @@ { "@timestamp": "2021-11-22T00:08:34.168Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3501,7 +3501,7 @@ { "@timestamp": "2021-11-22T00:08:34.171Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3572,7 +3572,7 @@ { "@timestamp": "2021-11-22T00:08:34.173Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3648,7 +3648,7 @@ { "@timestamp": "2021-11-22T00:08:34.174Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3719,7 +3719,7 @@ { "@timestamp": "2021-11-22T00:08:34.176Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3790,7 +3790,7 @@ { "@timestamp": "2021-11-22T00:08:34.178Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3861,7 +3861,7 @@ { "@timestamp": "2021-11-22T00:08:34.180Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -3932,7 +3932,7 @@ { "@timestamp": "2021-11-22T00:08:34.182Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4003,7 +4003,7 @@ { "@timestamp": "2021-11-22T00:08:34.184Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4079,7 +4079,7 @@ { "@timestamp": "2021-11-22T00:08:34.187Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4150,7 +4150,7 @@ { "@timestamp": "2021-11-22T00:08:34.190Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4221,7 +4221,7 @@ { "@timestamp": "2021-11-22T00:08:34.204Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4297,7 +4297,7 @@ { "@timestamp": "2021-11-22T00:08:34.208Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4368,7 +4368,7 @@ { "@timestamp": "2021-11-22T00:08:34.210Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4444,7 +4444,7 @@ { "@timestamp": "2021-11-22T00:08:34.212Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4520,7 +4520,7 @@ { "@timestamp": "2021-11-22T00:08:34.215Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4591,7 +4591,7 @@ { "@timestamp": "2021-11-22T00:08:34.217Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4667,7 +4667,7 @@ { "@timestamp": "2021-11-22T00:08:34.219Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4738,7 +4738,7 @@ { "@timestamp": "2021-11-22T00:08:34.221Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4814,7 +4814,7 @@ { "@timestamp": "2021-11-22T00:08:34.223Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4885,7 +4885,7 @@ { "@timestamp": "2021-11-22T00:08:34.225Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -4956,7 +4956,7 @@ { "@timestamp": "2021-11-22T00:08:34.227Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5032,7 +5032,7 @@ { "@timestamp": "2021-11-22T00:08:34.229Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5103,7 +5103,7 @@ { "@timestamp": "2021-11-22T00:08:34.231Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5179,7 +5179,7 @@ { "@timestamp": "2021-11-22T00:08:34.233Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5250,7 +5250,7 @@ { "@timestamp": "2021-11-22T00:08:34.235Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5321,7 +5321,7 @@ { "@timestamp": "2021-11-22T00:08:34.236Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5392,7 +5392,7 @@ { "@timestamp": "2021-11-22T00:08:34.239Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5463,7 +5463,7 @@ { "@timestamp": "2021-11-22T00:08:34.241Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5534,7 +5534,7 @@ { "@timestamp": "2021-11-22T00:08:34.243Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.updated", @@ -5605,7 +5605,7 @@ { "@timestamp": "2021-11-22T00:08:34.249Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.removed.from.project", @@ -5685,7 +5685,7 @@ { "@timestamp": "2021-11-22T00:08:34.266Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.permission.scheme.added.to.project", @@ -5749,7 +5749,7 @@ { "@timestamp": "2021-11-22T00:08:34.297Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.project.created", @@ -5842,7 +5842,7 @@ { "@timestamp": "2021-11-22T00:08:34.506Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.project.roles.changed", @@ -5913,7 +5913,7 @@ { "@timestamp": "2021-11-22T00:08:34.521Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -5989,7 +5989,7 @@ { "@timestamp": "2021-11-22T00:08:34.535Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.released", @@ -6065,7 +6065,7 @@ { "@timestamp": "2021-11-22T00:08:34.543Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -6141,7 +6141,7 @@ { "@timestamp": "2021-11-22T00:08:34.545Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.version.created", @@ -6212,7 +6212,7 @@ { "@timestamp": "2021-11-22T00:12:02.856Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "atlassian.audit.event.action.audit.search", @@ -6285,7 +6285,7 @@ { "@timestamp": "2021-11-26T19:35:10.718Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.login.failed", @@ -6360,7 +6360,7 @@ { "@timestamp": "2021-11-26T19:33:29.363Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "jira.auditing.user.logged.in", diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-cloud-config.yml b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-cloud-config.yml index d9246e659ab..758ef91207b 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-cloud-config.yml +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-cloud-config.yml @@ -12,3 +12,5 @@ data_stream: verification_mode: none atlassian_cloud: true enable_request_tracer: true +assert: + hit_count: 4 diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-config.yml b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-config.yml index 484e30156e9..2b92134c930 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-config.yml +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-api-config.yml @@ -11,3 +11,5 @@ data_stream: ssl: |- verification_mode: none enable_request_tracer: true +assert: + hit_count: 4 diff --git a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-files-config.yml b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-files-config.yml index e23566788c6..e8e49f812b5 100644 --- a/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-files-config.yml +++ b/packages/atlassian_jira/data_stream/audit/_dev/test/system/test-files-config.yml @@ -6,3 +6,5 @@ data_stream: - "{{SERVICE_LOGS_DIR}}/*.log" preserve_original_event: true enable_request_tracer: true +assert: + hit_count: 7 diff --git a/packages/atlassian_jira/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/atlassian_jira/data_stream/audit/agent/stream/httpjson.yml.hbs index d114d3d0b2b..2311e670025 100644 --- a/packages/atlassian_jira/data_stream/audit/agent/stream/httpjson.yml.hbs +++ b/packages/atlassian_jira/data_stream/audit/agent/stream/httpjson.yml.hbs @@ -47,9 +47,17 @@ response.split: ignore_empty_value: true response.pagination: - set: - target: url.value - value: '[[sprintf "%s/rest/api/3/auditing/record?from=%s&to=%s&offset=%d&limit=%s" "{{api_url}}" (.last_response.url.params.Get "from") (.last_response.url.params.Get "to") (add (toInt .last_response.body.offset) (toInt "{{ limit }}")) "{{ limit }}"]]' - fail_on_template_error: true + target: url.params.from + value: '[[.last_response.url.params.Get "from"]]' + - set: + target: url.params.to + value: '[[.last_response.url.params.Get "to"]]' + - set: + target: url.params.offset + value: '[[add (toInt .last_response.body.offset) (toInt "{{ limit }}")]]' + - set: + target: url.params.limit + value: '{{limit}}' cursor: last_timestamp: value: "[[.first_event.created]]" diff --git a/packages/atlassian_jira/data_stream/audit/agent/stream/stream.yml.hbs b/packages/atlassian_jira/data_stream/audit/agent/stream/stream.yml.hbs index c6e5ed4c737..de5eea39419 100644 --- a/packages/atlassian_jira/data_stream/audit/agent/stream/stream.yml.hbs +++ b/packages/atlassian_jira/data_stream/audit/agent/stream/stream.yml.hbs @@ -16,4 +16,7 @@ exclude_files: [".gz$"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/atlassian_jira/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/atlassian_jira/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 5589776a268..4d1d2c8bc1c 100644 --- a/packages/atlassian_jira/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/atlassian_jira/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Atlassian Jira audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/atlassian_jira/data_stream/audit/manifest.yml b/packages/atlassian_jira/data_stream/audit/manifest.yml index 4d6214a9666..bca38d19d60 100644 --- a/packages/atlassian_jira/data_stream/audit/manifest.yml +++ b/packages/atlassian_jira/data_stream/audit/manifest.yml @@ -39,6 +39,13 @@ streams: description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false - input: httpjson title: Jira audit logs via Jira audit API description: Collect Jira audit logs via Jira audit API @@ -91,6 +98,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -108,7 +116,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -116,7 +124,7 @@ streams: multi: false required: true show_user: false - description: Initial interval for the first API call. Defaults to 24 hours. + description: Initial interval for the first API call. Defaults to 24 hours. Supported units for this parameter are h/m/s. default: 24h - name: ssl type: yaml diff --git a/packages/atlassian_jira/data_stream/audit/sample_event.json b/packages/atlassian_jira/data_stream/audit/sample_event.json index 938e33cf94d..ff59b5e9ee8 100644 --- a/packages/atlassian_jira/data_stream/audit/sample_event.json +++ b/packages/atlassian_jira/data_stream/audit/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/atlassian_jira/docs/README.md b/packages/atlassian_jira/docs/README.md index 32863e6cc8e..90e27bcbae2 100644 --- a/packages/atlassian_jira/docs/README.md +++ b/packages/atlassian_jira/docs/README.md @@ -39,10 +39,10 @@ The Jira integration collects audit logs from the audit log files or the audit A | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -135,7 +135,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/atlassian_jira/kibana/tags.yml b/packages/atlassian_jira/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/atlassian_jira/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/atlassian_jira/manifest.yml b/packages/atlassian_jira/manifest.yml index 45bccdc7309..42732a978c6 100644 --- a/packages/atlassian_jira/manifest.yml +++ b/packages/atlassian_jira/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: atlassian_jira title: Atlassian Jira -version: "1.12.0" +version: "1.18.0" description: Collect logs from Atlassian Jira with Elastic Agent. type: integration categories: - security - productivity_security conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/jira-software-logo.svg title: Jira Software Logo @@ -27,3 +28,4 @@ policy_templates: description: "Collecting audit logs from Jira via API" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/auditd/_dev/build/build.yml b/packages/auditd/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/auditd/_dev/build/build.yml +++ b/packages/auditd/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/auditd/changelog.yml b/packages/auditd/changelog.yml index 78b862e781b..a3e168e841e 100644 --- a/packages/auditd/changelog.yml +++ b/packages/auditd/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 3.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "3.13.1" + changes: + - description: Remove the unnecessary permission for the package to write to arbitrary `logs-*` data streams. + type: bugfix + link: https://github.com/elastic/integrations/pull/7800 +- version: "3.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "3.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "3.11.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6912 - version: "3.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json index 425b78ab455..3ec15e03621 100644 --- a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json +++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json @@ -15,7 +15,7 @@ "address": "192.168.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mac_ipsec_event", @@ -50,7 +50,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "syscall", @@ -119,7 +119,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -175,7 +175,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -243,7 +243,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -275,7 +275,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proctitle", @@ -295,7 +295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proctitle", @@ -322,7 +322,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -364,7 +364,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -402,7 +402,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -437,7 +437,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "execve", @@ -465,7 +465,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -497,7 +497,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -545,7 +545,7 @@ "runtime": "kvm" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -587,7 +587,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -630,7 +630,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -669,7 +669,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -712,7 +712,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -751,7 +751,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -797,7 +797,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -843,7 +843,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -889,7 +889,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -937,7 +937,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -982,7 +982,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1049,7 +1049,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1118,7 +1118,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1165,7 +1165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1208,7 +1208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1251,7 +1251,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1284,7 +1284,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1335,7 +1335,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1386,7 +1386,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1436,7 +1436,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1481,7 +1481,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1529,7 +1529,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1573,7 +1573,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1635,7 +1635,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1705,7 +1705,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1752,7 +1752,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1786,7 +1786,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cwd", @@ -1816,7 +1816,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "path", @@ -1840,7 +1840,7 @@ "log": {} }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown[1329]", @@ -1870,7 +1870,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bprm_fcaps", @@ -1890,7 +1890,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sockaddr", @@ -1910,7 +1910,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ckaddr", @@ -1930,7 +1930,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1962,7 +1962,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-useradd.log-expected.json b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-useradd.log-expected.json index 4d8095ad3d5..bfec757c6fe 100644 --- a/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-useradd.log-expected.json +++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-useradd.log-expected.json @@ -14,7 +14,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -70,7 +70,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -125,7 +125,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -181,7 +181,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -239,7 +239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -287,7 +287,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -343,7 +343,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -395,7 +395,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ diff --git a/packages/auditd/data_stream/log/_dev/test/pipeline/test-truncated-execve.log-expected.json b/packages/auditd/data_stream/log/_dev/test/pipeline/test-truncated-execve.log-expected.json index ac31b0356d7..08762875b18 100644 --- a/packages/auditd/data_stream/log/_dev/test/pipeline/test-truncated-execve.log-expected.json +++ b/packages/auditd/data_stream/log/_dev/test/pipeline/test-truncated-execve.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "execve", @@ -36,7 +36,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "execve", @@ -131,7 +131,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "execve", @@ -226,7 +226,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "execve", diff --git a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 234cf9e9541..3585d8ebd89 100644 --- a/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Linux auditd logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/auditd/data_stream/log/manifest.yml b/packages/auditd/data_stream/log/manifest.yml index cd819a63321..285926867fe 100644 --- a/packages/auditd/data_stream/log/manifest.yml +++ b/packages/auditd/data_stream/log/manifest.yml @@ -39,6 +39,3 @@ streams: template_path: log.yml.hbs title: Auditd logs description: Collect Auditd logs using log input -# Ensures agents have permissions to write data to `logs-*-*` -elasticsearch.dynamic_dataset: true -elasticsearch.dynamic_namespace: true diff --git a/packages/auditd/data_stream/log/sample_event.json b/packages/auditd/data_stream/log/sample_event.json index 834bcbe4c7b..62d9eeeb32c 100644 --- a/packages/auditd/data_stream/log/sample_event.json +++ b/packages/auditd/data_stream/log/sample_event.json @@ -19,7 +19,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "0e729d36-7ce3-4bd5-885c-ec10bc843703", diff --git a/packages/auditd/docs/README.md b/packages/auditd/docs/README.md index 4bb5b7dfa19..3a7ceef58e7 100644 --- a/packages/auditd/docs/README.md +++ b/packages/auditd/docs/README.md @@ -34,7 +34,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "0e729d36-7ce3-4bd5-885c-ec10bc843703", diff --git a/packages/auditd/img/kibana-audit-auditd.png b/packages/auditd/img/kibana-audit-auditd.png index 732afa18dc1..992d2050bc6 100644 Binary files a/packages/auditd/img/kibana-audit-auditd.png and b/packages/auditd/img/kibana-audit-auditd.png differ diff --git a/packages/auditd/kibana/dashboard/auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json b/packages/auditd/kibana/dashboard/auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json index 954f6e65b68..59e8b2d7d72 100644 --- a/packages/auditd/kibana/dashboard/auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json +++ b/packages/auditd/kibana/dashboard/auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb.json @@ -1,80 +1,163 @@ { - "id": "auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-18T19:35:54.269Z", - "version": "WzU4MSwxXQ==", "attributes": { "description": "Dashboard for the Auditd Logs integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", - "query": "data_stream.dataset:auditd.log" - }, - "version": true + "query": "" + } } }, "optionsJSON": { - "darkTheme": false + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event types breakdown [Logs Auditd]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-268abb75-6a25-4d15-98a8-cd383cfa56ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4e83c50a-a580-4fbf-92e4-5cb6d8c23040", + "type": "index-pattern" } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "268abb75-6a25-4d15-98a8-cd383cfa56ad": { + "columnOrder": [ + "b6aac333-e1f1-4d1e-a276-0129ed3f0a47", + "44687592-390d-4ef9-9aaa-f16d11611ab3" + ], + "columns": { + "44687592-390d-4ef9-9aaa-f16d11611ab3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b6aac333-e1f1-4d1e-a276-0129ed3f0a47": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44687592-390d-4ef9-9aaa-f16d11611ab3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "order": "desc", - "orderBy": "1", - "size": 50 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4e83c50a-a580-4fbf-92e4-5cb6d8c23040", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd.log" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "auditd.log" + } + } } ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "268abb75-6a25-4d15-98a8-cd383cfa56ad", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "44687592-390d-4ef9-9aaa-f16d11611ab3" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "b6aac333-e1f1-4d1e-a276-0129ed3f0a47" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" } - } - } + }, + "title": "Event types breakdown [Logs Auditd] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -84,79 +167,183 @@ "y": 0 }, "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" + "title": "Event types breakdown [Logs Auditd]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-28cee599-81fc-4a20-90b4-b2c4eaae2ab5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7c3dfc7-b3d1-48d7-89e5-04f017ef19db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "92347886-7ba3-4991-a1fb-336f02f3a957", + "type": "index-pattern" } - } - }, - "savedVis": { - "title": "Top Exec Commands [Logs Auditd]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "28cee599-81fc-4a20-90b4-b2c4eaae2ab5": { + "columnOrder": [ + "a068bc18-290a-449e-8c30-5f15e8649ee9", + "dcf733cc-7a35-4a3d-807d-8fc643778a56" + ], + "columns": { + "a068bc18-290a-449e-8c30-5f15e8649ee9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Command (arg 0)", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dcf733cc-7a35-4a3d-807d-8fc643778a56", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 30 + }, + "scale": "ordinal", + "sourceField": "auditd.log.a0" + }, + "dcf733cc-7a35-4a3d-807d-8fc643778a56": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f7c3dfc7-b3d1-48d7-89e5-04f017ef19db", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auditd.log" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Command (arg 0)", - "field": "auditd.log.a0", - "order": "desc", - "orderBy": "1", - "size": 30 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.action", + "index": "92347886-7ba3-4991-a1fb-336f02f3a957", + "key": "event.action", + "negate": false, + "params": [ + "execve", + "EXECVE" + ], + "type": "phrases", + "value": [ + "execve", + "EXECVE" + ] }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.action": "execve" + } + }, + { + "match_phrase": { + "event.action": "EXECVE" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "event.action:\"EXECVE\" or event.action:\"execve\"" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "dcf733cc-7a35-4a3d-807d-8fc643778a56" + }, + { + "alignment": "left", + "columnId": "a068bc18-290a-449e-8c30-5f15e8649ee9" + } + ], + "headerRowHeight": "single", + "layerId": "28cee599-81fc-4a20-90b4-b2c4eaae2ab5", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Top Exec Commands [Logs Auditd] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -166,142 +353,348 @@ "y": 0 }, "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" + "title": "Top Exec Commands [Logs Auditd]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { + "columns": [ + "event.action", + "auditd.log.sequence", + "user.name" + ], "enhancements": {}, - "savedVis": { - "title": "Event Results [Logs Auditd]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(q=\"data_stream.dataset:auditd.log NOT event.outcome:failure\").label(\"Success\"), .es(q=\"event.outcome:failed\").label(\"Failure\").title(\"Audit Event Results\")", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": {} - } - } + "sort": [ + "@timestamp", + "desc" + ] }, "gridData": { - "h": 12, - "i": "3", - "w": 24, + "h": 20, + "i": "7", + "w": 48, "x": 0, - "y": 16 + "y": 28 }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" + "panelIndex": "7", + "panelRefName": "panel_7", + "type": "search", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event Account Tag Cloud [Logs Auditd]", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 42, - "minFontSize": 15, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ae879eb4-2960-4017-8f6b-c197afeee50a", + "type": "index-pattern" }, - "scale": "linear" - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "95a20581-c922-4ed5-bc68-41fffa8f54fd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ae879eb4-2960-4017-8f6b-c197afeee50a": { + "columnOrder": [ + "5eea746e-b928-417f-8c8f-1f67e8fd20f3", + "e35805cb-5fd3-40ee-9b3d-db265c90b083" + ], + "columns": { + "5eea746e-b928-417f-8c8f-1f67e8fd20f3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e35805cb-5fd3-40ee-9b3d-db265c90b083", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "e35805cb-5fd3-40ee-9b3d-db265c90b083": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "user.name", - "order": "desc", - "orderBy": "1", - "size": 15 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "95a20581-c922-4ed5-bc68-41fffa8f54fd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd.log" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "auditd.log" + } + } } ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e35805cb-5fd3-40ee-9b3d-db265c90b083", + "isTransposed": false + }, + { + "columnId": "5eea746e-b928-417f-8c8f-1f67e8fd20f3", + "isTransposed": false + } + ], + "layerId": "ae879eb4-2960-4017-8f6b-c197afeee50a", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 } } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, - "i": "6", + "i": "d84a9a87-e40f-465c-9114-4d343ffb6481", "w": 16, "x": 16, "y": 0 }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" + "panelIndex": "d84a9a87-e40f-465c-9114-4d343ffb6481", + "title": "Event Account Tag Cloud [Logs Auditd]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "columns": [ - "event.action", - "auditd.log.sequence", - "user.name" - ], + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bf383f3b-ce0d-4140-b125-6ae874b33d64", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2ff77656-7170-48ea-8bfa-af5bc71685c7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bf383f3b-ce0d-4140-b125-6ae874b33d64": { + "columnOrder": [ + "5bff5789-d6a7-4386-9bd8-e338b7a42795", + "07fcd4be-419b-4b7e-8a75-977124eb980a", + "99a27a3b-e672-4c17-a8c2-3518a907cedc" + ], + "columns": { + "07fcd4be-419b-4b7e-8a75-977124eb980a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.outcome : \"success\" " + }, + "isBucketed": false, + "label": "Success", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5bff5789-d6a7-4386-9bd8-e338b7a42795": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "99a27a3b-e672-4c17-a8c2-3518a907cedc": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.outcome : \"failure\"" + }, + "isBucketed": false, + "label": "Failure", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2ff77656-7170-48ea-8bfa-af5bc71685c7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auditd.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "07fcd4be-419b-4b7e-8a75-977124eb980a", + "99a27a3b-e672-4c17-a8c2-3518a907cedc" + ], + "layerId": "bf383f3b-ce0d-4140-b125-6ae874b33d64", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "5bff5789-d6a7-4386-9bd8-e338b7a42795", + "yConfig": [ + { + "color": "#e7664c", + "forAccessor": "99a27a3b-e672-4c17-a8c2-3518a907cedc" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, - "sort": [ - "@timestamp", - "desc" - ] + "hidePanelTitles": false }, "gridData": { "h": 12, - "i": "7", - "w": 48, + "i": "e1817f83-5b41-4dd8-8108-ffe725dc9cd2", + "w": 24, "x": 0, - "y": 28 + "y": 16 }, - "panelIndex": "7", - "panelRefName": "panel_7", - "type": "search", - "version": "8.0.0" + "panelIndex": "e1817f83-5b41-4dd8-8108-ffe725dc9cd2", + "title": "Event Results [Logs Auditd]", + "type": "lens", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 12, - "i": "09f4ba02-a62c-410f-8d43-31e9e5278826", - "w": 24, - "x": 24, - "y": 16 - }, - "panelIndex": "09f4ba02-a62c-410f-8d43-31e9e5278826", "embeddableConfig": { "attributes": { "description": "", "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"623a62b9-8745-4fec-8738-bbe6fb8c16aa\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"efef3e71-f9ce-4a8e-8c27-68ad0d047d9b\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Event Address Geo Location [Logs Auditd]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"source.geo.location\",\"id\":\"8155deb8-6760-42ad-b14a-dd20958bcb52\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1,\"center\":{\"lon\":63.63073,\"lat\":33.13755},\"timeFilters\":{\"from\":\"now-10y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"auditd.log\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"auditd.log\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "Event Address Geo Location [Logs Auditd]", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" }, @@ -309,26 +702,66 @@ "hiddenLayers": [], "isLayerTOCOpen": true, "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 + "maxLat": 85.05113, + "maxLon": 360, + "minLat": 0, + "minLon": -180 }, "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 + "lat": 48.14226, + "lon": 63.63073, + "zoom": 1 }, - "openTOCDetails": [], - "type": "map" - } + "openTOCDetails": [] + }, + "gridData": { + "h": 12, + "i": "09f4ba02-a62c-410f-8d43-31e9e5278826", + "w": 24, + "x": 24, + "y": 16 + }, + "panelIndex": "09f4ba02-a62c-410f-8d43-31e9e5278826", + "type": "map", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Auditd] Audit Events", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T08:18:32.283Z", + "id": "auditd-dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ + { + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-268abb75-6a25-4d15-98a8-cd383cfa56ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1:4e83c50a-a580-4fbf-92e4-5cb6d8c23040", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-28cee599-81fc-4a20-90b4-b2c4eaae2ab5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:f7c3dfc7-b3d1-48d7-89e5-04f017ef19db", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:92347886-7ba3-4991-a1fb-336f02f3a957", + "type": "index-pattern" + }, { "id": "auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27", "name": "7:panel_7", @@ -336,27 +769,29 @@ }, { "id": "logs-*", - "name": "09f4ba02-a62c-410f-8d43-31e9e5278826:layer_1_source_index_pattern", + "name": "d84a9a87-e40f-465c-9114-4d343ffb6481:indexpattern-datasource-layer-ae879eb4-2960-4017-8f6b-c197afeee50a", "type": "index-pattern" }, { - "type": "index-pattern", - "name": "1:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "d84a9a87-e40f-465c-9114-4d343ffb6481:95a20581-c922-4ed5-bc68-41fffa8f54fd", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "e1817f83-5b41-4dd8-8108-ffe725dc9cd2:indexpattern-datasource-layer-bf383f3b-ce0d-4140-b125-6ae874b33d64", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e1817f83-5b41-4dd8-8108-ffe725dc9cd2:2ff77656-7170-48ea-8bfa-af5bc71685c7", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "6:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "09f4ba02-a62c-410f-8d43-31e9e5278826:layer_1_source_index_pattern", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/auditd/kibana/search/auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27.json b/packages/auditd/kibana/search/auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27.json index 730335ce1c4..758d69e9d4a 100644 --- a/packages/auditd/kibana/search/auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27.json +++ b/packages/auditd/kibana/search/auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27.json @@ -6,15 +6,41 @@ "user.name" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auditd.log" + } + } + } + ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "data_stream.dataset:auditd.log" + "query": "" }, "version": true } @@ -25,10 +51,13 @@ "desc" ] ], + "timeRestore": false, "title": "Audit Events [Logs Auditd]", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T08:06:38.981Z", "id": "auditd-4ac0a370-0a11-11e7-8b04-eb22a5669f27", "migrationVersion": { "search": "8.0.0" @@ -38,6 +67,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/auditd/kibana/tags.yml b/packages/auditd/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/auditd/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/auditd/manifest.yml b/packages/auditd/manifest.yml index 2d82e245199..c1234416c31 100644 --- a/packages/auditd/manifest.yml +++ b/packages/auditd/manifest.yml @@ -1,6 +1,6 @@ name: auditd title: Auditd Logs -version: "3.10.0" +version: "3.14.0" description: Collect logs from Linux audit daemon with Elastic Agent. type: integration icons: @@ -8,12 +8,13 @@ icons: title: linux size: 299x354 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" categories: - security - auditd conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - src: /img/kibana-audit-auditd.png title: Auditd Kibana Dashboard @@ -29,3 +30,4 @@ policy_templates: description: "Collecting application logs from Auditd instances (input: logfile)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/auditd_manager/_dev/build/build.yml b/packages/auditd_manager/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/auditd_manager/_dev/build/build.yml +++ b/packages/auditd_manager/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/auditd_manager/changelog.yml b/packages/auditd_manager/changelog.yml index 707d2d084d6..ebaa4330f0b 100644 --- a/packages/auditd_manager/changelog.yml +++ b/packages/auditd_manager/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.11.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6884 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-auditlogin-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-auditlogin-events.json-expected.json index 3c730ab1109..e1d00a37d07 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-auditlogin-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-auditlogin-events.json-expected.json @@ -30,7 +30,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-login-id-to", @@ -100,7 +100,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-login-id-to", @@ -171,7 +171,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-login-id-to", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-centos7-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-centos7-events.json-expected.json index 4ed0612dbc2..f99ecccdedd 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-centos7-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-centos7-events.json-expected.json @@ -42,7 +42,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started-session", @@ -124,7 +124,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-group-account-to", @@ -209,7 +209,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-user-account", @@ -296,7 +296,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", @@ -383,7 +383,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", @@ -470,7 +470,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", @@ -557,7 +557,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", @@ -644,7 +644,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-chown-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-chown-events.json-expected.json index 5296a3b7732..e8a09dfd0b5 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-chown-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-chown-events.json-expected.json @@ -92,7 +92,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-file-ownership-of", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-passwd-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-passwd-events.json-expected.json index 6eb8e2f97cf..c50f5bc87f4 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-passwd-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-passwd-events.json-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-password", @@ -115,7 +115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-password", @@ -195,7 +195,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-password", @@ -276,7 +276,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-setuid-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-setuid-events.json-expected.json index 910ff6b683b..82334b5b207 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-setuid-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-setuid-events.json-expected.json @@ -60,7 +60,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-identity-of", @@ -167,7 +167,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-identity-of", @@ -266,7 +266,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-identity-of", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-asuser-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-asuser-events.json-expected.json index 147b8b96e32..706e76e2b02 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-asuser-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-asuser-events.json-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -110,7 +110,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", @@ -180,7 +180,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ran-command", @@ -245,7 +245,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "refreshed-credentials", @@ -319,7 +319,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started-session", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-events.json-expected.json index b96cbf1d7fd..f4e2b24d4ea 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-sudo-events.json-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -110,7 +110,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", @@ -180,7 +180,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ran-command", @@ -245,7 +245,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "refreshed-credentials", @@ -319,7 +319,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started-session", @@ -400,7 +400,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -475,7 +475,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "acquired-credentials", @@ -550,7 +550,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", @@ -625,7 +625,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -699,7 +699,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started-session", @@ -780,7 +780,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "refreshed-credentials", @@ -850,7 +850,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ran-command", @@ -915,7 +915,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", @@ -990,7 +990,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -1066,7 +1066,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-role-to", @@ -1125,7 +1125,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started-session", @@ -1206,7 +1206,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "disposed-credentials", @@ -1281,7 +1281,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ended-session", @@ -1356,7 +1356,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "disposed-credentials", @@ -1431,7 +1431,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ended-session", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-useradd-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-useradd-events.json-expected.json index b221c3cfb91..985573c5979 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-useradd-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-useradd-events.json-expected.json @@ -33,7 +33,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-group-account-to", @@ -112,7 +112,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-group-account-to", @@ -190,7 +190,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-group-account-to", @@ -269,7 +269,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-user-account", @@ -350,7 +350,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", @@ -425,7 +425,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-password", @@ -506,7 +506,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -581,7 +581,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "was-authorized", diff --git a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-userlogin-events.json-expected.json b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-userlogin-events.json-expected.json index 62d208b7b85..96f61b2fa07 100644 --- a/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-userlogin-events.json-expected.json +++ b/packages/auditd_manager/data_stream/auditd/_dev/test/pipeline/test-userlogin-events.json-expected.json @@ -27,7 +27,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -101,7 +101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -172,7 +172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authenticated", @@ -247,7 +247,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "acquired-credentials", diff --git a/packages/auditd_manager/data_stream/auditd/elasticsearch/ingest_pipeline/default.yml b/packages/auditd_manager/data_stream/auditd/elasticsearch/ingest_pipeline/default.yml index d55b7ef47e7..40b9f318b42 100644 --- a/packages/auditd_manager/data_stream/auditd/elasticsearch/ingest_pipeline/default.yml +++ b/packages/auditd_manager/data_stream/auditd/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Linux auditd logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: event.original target_field: auditd.messages diff --git a/packages/auditd_manager/data_stream/auditd/sample_event.json b/packages/auditd_manager/data_stream/auditd/sample_event.json index b79ec4a4362..4a6319657b3 100644 --- a/packages/auditd_manager/data_stream/auditd/sample_event.json +++ b/packages/auditd_manager/data_stream/auditd/sample_event.json @@ -72,7 +72,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1", diff --git a/packages/auditd_manager/docs/README.md b/packages/auditd_manager/docs/README.md index 9cb90af8408..cc4349b52a2 100644 --- a/packages/auditd_manager/docs/README.md +++ b/packages/auditd_manager/docs/README.md @@ -184,7 +184,7 @@ An example event for `auditd` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "753ce520-4f32-45b1-9212-c4dcc9d575a1", diff --git a/packages/auditd_manager/kibana/dashboard/auditd_manager-693a5f40-c243-11e7-8692-232bd1143e8a.json b/packages/auditd_manager/kibana/dashboard/auditd_manager-693a5f40-c243-11e7-8692-232bd1143e8a.json index fa68cd21aaf..aab685a1abe 100644 --- a/packages/auditd_manager/kibana/dashboard/auditd_manager-693a5f40-c243-11e7-8692-232bd1143e8a.json +++ b/packages/auditd_manager/kibana/dashboard/auditd_manager-693a5f40-c243-11e7-8692-232bd1143e8a.json @@ -1,20 +1,20 @@ { "attributes": { "description": "Summary of socket related syscall events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "data_stream.dataset:auditd_manager.auditd" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false, + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": false }, "panelsJSON": [ @@ -54,84 +54,187 @@ }, "panelIndex": "2b0bfe71-70d5-431c-a7ae-45b965ce1b16", "type": "visualization", - "version": "8.2.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": {} - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "95b603d0-c252-11e7-8a68-93ffe9ec5950" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" } - ], - "bar_color_rules": [ - { - "id": "2cebb0c0-c252-11e7-8a68-93ffe9ec5950" - } - ], - "drop_last_bucket": 1, - "filter": { - "language": "lucene", - "query": "auditd.summary.object.type:socket" }, - "gauge_color_rules": [ - { - "id": "6c891740-c252-11e7-8a68-93ffe9ec5950" + "datasourceStates": { + "formBased": { + "layers": { + "6f2c7b9b-b7cc-420e-8c6c-25dd321bb34e": { + "columnOrder": [ + "f8f13e30-c28f-4a15-a981-e89f47681039", + "8ea7b083-c77b-482d-b2d9-0bb0ac129f9a", + "3153da94-1835-4467-9c24-22b676fc2c3b" + ], + "columns": { + "3153da94-1835-4467-9c24-22b676fc2c3b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "syscall", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8ea7b083-c77b-482d-b2d9-0bb0ac129f9a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of auditd.data.syscall", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.data.syscall" + }, + "f8f13e30-c28f-4a15-a981-e89f47681039": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "auto", - "legend_position": "left", - "max_lines_legend": 1, - "series": [ + }, + "filters": [], + "internalReferences": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "syscall", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "auditd.data.syscall" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-6f2c7b9b-b7cc-420e-8c6c-25dd321bb34e", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": false + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3153da94-1835-4467-9c24-22b676fc2c3b" + ], + "layerId": "6f2c7b9b-b7cc-420e-8c6c-25dd321bb34e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "8ea7b083-c77b-482d-b2d9-0bb0ac129f9a", + "xAccessor": "f8f13e30-c28f-4a15-a981-e89f47681039", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "3153da94-1835-4467-9c24-22b676fc2c3b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "left", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "type": "metrics", - "uiState": {} - } + "title": "[Auditd Manager] Socket Syscalls Time Series", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -142,97 +245,149 @@ }, "panelIndex": "a9f3b71d-3b8f-44c0-b581-ba208c117e05", "title": "[Auditd Manager] Socket Syscalls Time Series", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Socket Family", - "field": "auditd.data.socket.family", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7df070bc-ffd5-4146-857b-10eab8abf204", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7df070bc-ffd5-4146-857b-10eab8abf204": { + "columnOrder": [ + "4faacaea-2366-4cb6-8be7-d9edb52d62c5", + "47ced22f-c64f-4725-a6c0-1eba33893788", + "5f6e3d3a-1c74-45fd-a64a-bd706ee2affc" + ], + "columns": { + "47ced22f-c64f-4725-a6c0-1eba33893788": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Syscall", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5f6e3d3a-1c74-45fd-a64a-bd706ee2affc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.data.syscall" + }, + "4faacaea-2366-4cb6-8be7-d9edb52d62c5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Socket Family", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5f6e3d3a-1c74-45fd-a64a-bd706ee2affc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.data.socket.family" + }, + "5f6e3d3a-1c74-45fd-a64a-bd706ee2affc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Syscall", - "field": "auditd.data.syscall", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "textBased": { + "layers": {} } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "percent" }, - "legendDisplay": "show", - "legendPosition": "left", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "truncateLegend": true, - "type": "pie" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "7df070bc-ffd5-4146-857b-10eab8abf204", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "left", + "legendSize": "auto", + "metrics": [ + "5f6e3d3a-1c74-45fd-a64a-bd706ee2affc" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "4faacaea-2366-4cb6-8be7-d9edb52d62c5", + "47ced22f-c64f-4725-a6c0-1eba33893788" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "pie", - "uiState": {} - } + "title": "[Auditd Manager] Socket Families", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -243,139 +398,232 @@ }, "panelIndex": "843ccc25-3963-4bd5-838e-b40019bcf3c5", "title": "[Auditd Manager] Socket Families", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0fdad548-2d4c-4f5f-bb7b-10ceec531d12", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5053b104-b820-4440-8e9a-51f20ee17734", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cda5582e-d10c-46ac-acd7-fc3cdde53507", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0fdad548-2d4c-4f5f-bb7b-10ceec531d12": { + "columnOrder": [ + "2bed2077-cd1c-4ac6-b471-39eac0fb4046", + "5146916b-1de1-49fa-b097-25a5e1a2e5bd", + "acb67a19-dfc2-41f3-8b76-a8ab913dad88", + "99e1868f-199d-430f-8bbc-e8fcac542e72" + ], + "columns": { + "2bed2077-cd1c-4ac6-b471-39eac0fb4046": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Exe", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.how" + }, + "5146916b-1de1-49fa-b097-25a5e1a2e5bd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.object.primary" + }, + "99e1868f-199d-430f-8bbc-e8fcac542e72": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "acb67a19-dfc2-41f3-8b76-a8ab913dad88": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.object.secondary" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Exe", - "field": "auditd.summary.how", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Address", - "field": "auditd.summary.object.primary", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "meta": { + "alias": null, + "disabled": false, + "index": "5053b104-b820-4440-8e9a-51f20ee17734", + "key": "auditd.data.syscall", + "negate": false, + "params": { + "query": "bind", + "type": "phrase" + }, + "type": "phrase", + "value": "bind" }, - "schema": "bucket", - "type": "terms" + "query": { + "match": { + "auditd.data.syscall": { + "query": "bind", + "type": "phrase" + } + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Port", - "field": "auditd.summary.object.secondary", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "cda5582e-d10c-46ac-acd7-fc3cdde53507", + "key": "auditd.data.socket.family", + "negate": true, + "params": { + "query": "netlink", + "type": "phrase" }, - "meta": { - "alias": null, - "apply": true, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "auditd.summary.object.secondary", - "negate": true, - "params": { - "query": "0", + "type": "phrase", + "value": "netlink" + }, + "query": { + "match": { + "auditd.data.socket.family": { + "query": "netlink", "type": "phrase" - }, - "type": "phrase", - "value": "0" - }, - "query": { - "match": { - "auditd.summary.object.secondary": { - "query": "0", - "type": "phrase" - } } } } - ], - "query": { - "language": "kuery", - "query": "" } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "99e1868f-199d-430f-8bbc-e8fcac542e72" + }, + { + "alignment": "left", + "columnId": "2bed2077-cd1c-4ac6-b471-39eac0fb4046" + }, + { + "alignment": "left", + "columnId": "5146916b-1de1-49fa-b097-25a5e1a2e5bd" + }, + { + "alignment": "left", + "columnId": "acb67a19-dfc2-41f3-8b76-a8ab913dad88" } - } + ], + "headerRowHeight": "single", + "layerId": "0fdad548-2d4c-4f5f-bb7b-10ceec531d12", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "[Auditd Manager] Bind (non-ephemeral)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -386,111 +634,226 @@ }, "panelIndex": "1e9272d7-090a-443b-bc0c-3d8afae53e76", "title": "[Auditd Manager] Bind (non-ephemeral)", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-36e6b76b-a5bb-4186-a272-36155591b7df", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ac0926a-dbce-486b-8dd5-5404260d49dd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a62d3b3a-edf4-4401-9cda-b808f971a34b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "36e6b76b-a5bb-4186-a272-36155591b7df": { + "columnOrder": [ + "82686a61-388e-4090-9774-92a0674e6002", + "3105082a-3ef9-449f-b5a1-f70ddf3dc5a3", + "8a6a27cd-21ec-4de3-b80d-fcc88f6733b8", + "9b2b05a9-c5a5-4113-b19c-0277064071b7" + ], + "columns": { + "3105082a-3ef9-449f-b5a1-f70ddf3dc5a3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9b2b05a9-c5a5-4113-b19c-0277064071b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.object.primary" + }, + "82686a61-388e-4090-9774-92a0674e6002": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Exe", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9b2b05a9-c5a5-4113-b19c-0277064071b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "process.executable" + }, + "8a6a27cd-21ec-4de3-b80d-fcc88f6733b8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9b2b05a9-c5a5-4113-b19c-0277064071b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.object.secondary" + }, + "9b2b05a9-c5a5-4113-b19c-0277064071b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Exe", - "field": "process.executable", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Address", - "field": "auditd.summary.object.primary", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "meta": { + "alias": null, + "disabled": false, + "index": "8ac0926a-dbce-486b-8dd5-5404260d49dd", + "key": "event.action", + "negate": false, + "params": { + "query": "connected-to", + "type": "phrase" + }, + "type": "phrase", + "value": "connected-to" }, - "schema": "bucket", - "type": "terms" + "query": { + "match": { + "event.action": { + "query": "connected-to", + "type": "phrase" + } + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Port", - "field": "auditd.summary.object.secondary", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "exists": { + "field": "auditd.summary.object.primary" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a62d3b3a-edf4-4401-9cda-b808f971a34b", + "key": "auditd.summary.object.primary", + "negate": false, + "type": "exists", + "value": "exists" + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "9b2b05a9-c5a5-4113-b19c-0277064071b7" + }, + { + "alignment": "left", + "columnId": "82686a61-388e-4090-9774-92a0674e6002" + }, + { + "alignment": "left", + "columnId": "3105082a-3ef9-449f-b5a1-f70ddf3dc5a3" + }, + { + "alignment": "left", + "columnId": "8a6a27cd-21ec-4de3-b80d-fcc88f6733b8" } - } + ], + "headerRowHeight": "single", + "layerId": "36e6b76b-a5bb-4186-a272-36155591b7df", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "[Auditd Manager] Connect", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -501,102 +864,224 @@ }, "panelIndex": "d91afd3e-4c8e-41d9-b038-78bcffbe1e0e", "title": "[Auditd Manager] Connect", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8ea6aeca-6215-4465-81a7-bd46429d4cc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8fdaf811-0e78-4077-8678-4c9f3fbb16b5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "621fda46-21b3-4491-8fca-6c05b2e17f21", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c67db52e-5701-4331-bc5b-a59b4609c07f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8ea6aeca-6215-4465-81a7-bd46429d4cc6": { + "columnOrder": [ + "cc83fa51-52f9-4d6c-ade2-24b45d3e08e2", + "8044abd2-b585-418b-9bdc-7dbbdf43fb6c", + "ac149086-2751-4279-8b0f-a5f24c9580cc" + ], + "columns": { + "8044abd2-b585-418b-9bdc-7dbbdf43fb6c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Syscall", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ac149086-2751-4279-8b0f-a5f24c9580cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "auditd.data.syscall" + }, + "ac149086-2751-4279-8b0f-a5f24c9580cc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique Addresses", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "auditd.summary.object.primary" + }, + "cc83fa51-52f9-4d6c-ade2-24b45d3e08e2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Exe", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ac149086-2751-4279-8b0f-a5f24c9580cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "process.executable" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Unique Addresses", - "emptyAsNull": false, - "field": "auditd.summary.object.primary" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8fdaf811-0e78-4077-8678-4c9f3fbb16b5", + "key": "auditd.summary.object.type", + "negate": false, + "params": { + "query": "socket", + "type": "phrase" + }, + "type": "phrase", + "value": "socket" }, - "schema": "metric", - "type": "cardinality" + "query": { + "match": { + "auditd.summary.object.type": { + "query": "socket", + "type": "phrase" + } + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Exe", - "field": "process.executable", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 + "$state": { + "store": "appState" + }, + "exists": { + "field": "auditd.summary.object.primary" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "621fda46-21b3-4491-8fca-6c05b2e17f21", + "key": "auditd.summary.object.primary", + "negate": false, + "type": "exists", + "value": "exists" + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Syscall", - "field": "auditd.data.syscall", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c67db52e-5701-4331-bc5b-a59b4609c07f", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"terms\":{\"auditd.data.syscall\":[\"accept\",\"accept4\",\"recvfrom\",\"recvmsg\"]}}" }, - "schema": "bucket", - "type": "terms" + "query": { + "terms": { + "auditd.data.syscall": [ + "accept", + "accept4", + "recvfrom", + "recvmsg" + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "spy": { - "mode": { - "fill": false, - "name": null - } - }, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ac149086-2751-4279-8b0f-a5f24c9580cc" + }, + { + "alignment": "left", + "columnId": "cc83fa51-52f9-4d6c-ade2-24b45d3e08e2" + }, + { + "alignment": "left", + "columnId": "8044abd2-b585-418b-9bdc-7dbbdf43fb6c" } - } + ], + "headerRowHeight": "single", + "layerId": "8ea6aeca-6215-4465-81a7-bd46429d4cc6", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "[Auditd Manager] Accept / Recvfrom Unique Address Table", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -607,44 +1092,75 @@ }, "panelIndex": "cd08c022-92e5-4012-a94d-6e459948c42c", "title": "[Auditd Manager] Accept / Recvfrom Unique Address Table", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Auditd Manager] Sockets", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:29:32.917Z", "id": "auditd_manager-693a5f40-c243-11e7-8692-232bd1143e8a", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "843ccc25-3963-4bd5-838e-b40019bcf3c5:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "843ccc25-3963-4bd5-838e-b40019bcf3c5:indexpattern-datasource-layer-7df070bc-ffd5-4146-857b-10eab8abf204", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1e9272d7-090a-443b-bc0c-3d8afae53e76:indexpattern-datasource-layer-0fdad548-2d4c-4f5f-bb7b-10ceec531d12", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1e9272d7-090a-443b-bc0c-3d8afae53e76:5053b104-b820-4440-8e9a-51f20ee17734", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1e9272d7-090a-443b-bc0c-3d8afae53e76:cda5582e-d10c-46ac-acd7-fc3cdde53507", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d91afd3e-4c8e-41d9-b038-78bcffbe1e0e:indexpattern-datasource-layer-36e6b76b-a5bb-4186-a272-36155591b7df", "type": "index-pattern" }, { - "id": "auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a", - "name": "1e9272d7-090a-443b-bc0c-3d8afae53e76:search_0", - "type": "search" + "id": "logs-*", + "name": "d91afd3e-4c8e-41d9-b038-78bcffbe1e0e:8ac0926a-dbce-486b-8dd5-5404260d49dd", + "type": "index-pattern" }, { "id": "logs-*", - "name": "1e9272d7-090a-443b-bc0c-3d8afae53e76:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "d91afd3e-4c8e-41d9-b038-78bcffbe1e0e:a62d3b3a-edf4-4401-9cda-b808f971a34b", "type": "index-pattern" }, { - "id": "auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a", - "name": "d91afd3e-4c8e-41d9-b038-78bcffbe1e0e:search_0", - "type": "search" + "id": "logs-*", + "name": "cd08c022-92e5-4012-a94d-6e459948c42c:indexpattern-datasource-layer-8ea6aeca-6215-4465-81a7-bd46429d4cc6", + "type": "index-pattern" }, { - "id": "auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a", - "name": "cd08c022-92e5-4012-a94d-6e459948c42c:search_0", - "type": "search" + "id": "logs-*", + "name": "cd08c022-92e5-4012-a94d-6e459948c42c:8fdaf811-0e78-4077-8678-4c9f3fbb16b5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd08c022-92e5-4012-a94d-6e459948c42c:621fda46-21b3-4491-8fca-6c05b2e17f21", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd08c022-92e5-4012-a94d-6e459948c42c:c67db52e-5701-4331-bc5b-a59b4609c07f", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/auditd_manager/kibana/dashboard/auditd_manager-7de391b0-c1ca-11e7-8995-936807a28b16.json b/packages/auditd_manager/kibana/dashboard/auditd_manager-7de391b0-c1ca-11e7-8995-936807a28b16.json index da1deead6e9..419a40211ff 100644 --- a/packages/auditd_manager/kibana/dashboard/auditd_manager-7de391b0-c1ca-11e7-8995-936807a28b16.json +++ b/packages/auditd_manager/kibana/dashboard/auditd_manager-7de391b0-c1ca-11e7-8995-936807a28b16.json @@ -1,20 +1,20 @@ { "attributes": { "description": "Overview of kernel executions", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "data_stream.dataset:auditd_manager.auditd" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false, + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": false }, "panelsJSON": [ @@ -27,12 +27,12 @@ "i": "6", "w": 48, "x": 0, - "y": 16 + "y": 20 }, "panelIndex": "6", "panelRefName": "panel_6", "type": "search", - "version": "8.2.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -70,236 +70,503 @@ }, "panelIndex": "f2ce7c72-d0f9-41a5-8738-11d4820c0774", "type": "visualization", - "version": "8.2.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d97ac597-b722-44d2-b31b-c15ab798a8cb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f007de01-b77c-4903-a874-bbaa7cc89c0d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d97ac597-b722-44d2-b31b-c15ab798a8cb": { + "columnOrder": [ + "e48d9f60-ccd8-4d20-92f0-c66e88f5741c", + "b588dcef-329b-4a6c-b68b-d28efcce9864" + ], + "columns": { + "b588dcef-329b-4a6c-b68b-d28efcce9864": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e48d9f60-ccd8-4d20-92f0-c66e88f5741c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process Executions", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b588dcef-329b-4a6c-b68b-d28efcce9864", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "process.executable" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "auditd.summary.actor.primary", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f007de01-b77c-4903-a874-bbaa7cc89c0d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd_manager.auditd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auditd_manager.auditd" + } + } } ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "maxFontSize": 45, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "scale": "linear", - "showLabel": true + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b588dcef-329b-4a6c-b68b-d28efcce9864" + ], + "layerId": "d97ac597-b722-44d2-b31b-c15ab798a8cb", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "e48d9f60-ccd8-4d20-92f0-c66e88f5741c" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "type": "tagcloud", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 12, - "i": "4dd0c4a9-2eeb-4bba-bcdb-ca6c2e389e67", + "h": 16, + "i": "c0882fb9-803b-4285-9905-a199040ae307", "w": 16, - "x": 32, + "x": 0, "y": 4 }, - "panelIndex": "4dd0c4a9-2eeb-4bba-bcdb-ca6c2e389e67", - "title": "[Auditd Manager] Primary Username Tag Cloud", - "type": "visualization", - "version": "8.2.0" + "panelIndex": "c0882fb9-803b-4285-9905-a199040ae307", + "title": "[Auditd Manager] Executable Name", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bfebf24f-1a17-4ded-88bb-a27e6498e08d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54f4f0d0-7e6c-4427-bb4b-d34f9e1c869f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bfebf24f-1a17-4ded-88bb-a27e6498e08d": { + "columnOrder": [ + "f21b9a77-984a-42c2-bed7-5a38cf476967", + "bf0c85a3-f3ea-48b0-b26d-01f9501cb7ed" + ], + "columns": { + "bf0c85a3-f3ea-48b0-b26d-01f9501cb7ed": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f21b9a77-984a-42c2-bed7-5a38cf476967": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "auditd.data.exit: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf0c85a3-f3ea-48b0-b26d-01f9501cb7ed", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.data.exit" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "process.executable", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "54f4f0d0-7e6c-4427-bb4b-d34f9e1c869f", + "key": "event.action", + "negate": false, + "params": { + "query": "executed", + "type": "phrase" + }, + "type": "phrase", + "value": "executed" + }, + "query": { + "match": { + "event.action": { + "query": "executed", + "type": "phrase" + } + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "maxFontSize": 45, - "minFontSize": 14, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "scale": "linear", - "showLabel": true + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "bfebf24f-1a17-4ded-88bb-a27e6498e08d", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "bf0c85a3-f3ea-48b0-b26d-01f9501cb7ed" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "f21b9a77-984a-42c2-bed7-5a38cf476967" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "tagcloud", - "uiState": {} - } + "title": "[Auditd Manager] Error Codes", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 12, - "i": "459f779e-e668-4048-a1d5-fa5806262646", + "h": 16, + "i": "b65a07a2-a0d7-4dab-921a-8afbe066d025", "w": 16, - "x": 0, + "x": 16, "y": 4 }, - "panelIndex": "459f779e-e668-4048-a1d5-fa5806262646", - "title": "[Auditd Manager] Executable Name Tag Cloud", - "type": "visualization", - "version": "8.2.0" + "panelIndex": "b65a07a2-a0d7-4dab-921a-8afbe066d025", + "title": "[Auditd Manager] Error Codes", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d97ac597-b722-44d2-b31b-c15ab798a8cb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "303edb2f-7535-49c8-925e-36c703ee4af2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d97ac597-b722-44d2-b31b-c15ab798a8cb": { + "columnOrder": [ + "d5693408-d1ac-4064-99c9-35224ca28799", + "cbc38c21-1f20-4e63-a246-4e432b56e401" + ], + "columns": { + "cbc38c21-1f20-4e63-a246-4e432b56e401": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d5693408-d1ac-4064-99c9-35224ca28799": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Primary Username", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cbc38c21-1f20-4e63-a246-4e432b56e401", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auditd.summary.actor.primary" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "auditd.data.exit", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "303edb2f-7535-49c8-925e-36c703ee4af2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auditd_manager.auditd" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "auditd_manager.auditd" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "Command executions", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "percent" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "legendDisplay": "show", - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "truncateLegend": true, - "type": "pie" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "cbc38c21-1f20-4e63-a246-4e432b56e401" + ], + "layerId": "d97ac597-b722-44d2-b31b-c15ab798a8cb", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "d5693408-d1ac-4064-99c9-35224ca28799" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "type": "pie", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 12, - "i": "b65a07a2-a0d7-4dab-921a-8afbe066d025", + "h": 16, + "i": "12f23f3b-9f6b-4a8f-8ad4-24961fe39077", "w": 16, - "x": 16, + "x": 32, "y": 4 }, - "panelIndex": "b65a07a2-a0d7-4dab-921a-8afbe066d025", - "title": "[Auditd Manager] Error Codes", - "type": "visualization", - "version": "8.2.0" + "panelIndex": "12f23f3b-9f6b-4a8f-8ad4-24961fe39077", + "title": "[Auditd Manager] Primary Username", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Auditd Manager] Executions", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:43:45.113Z", "id": "auditd_manager-7de391b0-c1ca-11e7-8995-936807a28b16", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { @@ -309,18 +576,33 @@ }, { "id": "logs-*", - "name": "4dd0c4a9-2eeb-4bba-bcdb-ca6c2e389e67:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "c0882fb9-803b-4285-9905-a199040ae307:indexpattern-datasource-layer-d97ac597-b722-44d2-b31b-c15ab798a8cb", "type": "index-pattern" }, { - "id": "auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16", - "name": "459f779e-e668-4048-a1d5-fa5806262646:search_0", - "type": "search" + "id": "logs-*", + "name": "c0882fb9-803b-4285-9905-a199040ae307:f007de01-b77c-4903-a874-bbaa7cc89c0d", + "type": "index-pattern" }, { - "id": "auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16", - "name": "b65a07a2-a0d7-4dab-921a-8afbe066d025:search_0", - "type": "search" + "id": "logs-*", + "name": "b65a07a2-a0d7-4dab-921a-8afbe066d025:indexpattern-datasource-layer-bfebf24f-1a17-4ded-88bb-a27e6498e08d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b65a07a2-a0d7-4dab-921a-8afbe066d025:54f4f0d0-7e6c-4427-bb4b-d34f9e1c869f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12f23f3b-9f6b-4a8f-8ad4-24961fe39077:indexpattern-datasource-layer-d97ac597-b722-44d2-b31b-c15ab798a8cb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12f23f3b-9f6b-4a8f-8ad4-24961fe39077:303edb2f-7535-49c8-925e-36c703ee4af2", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/auditd_manager/kibana/dashboard/auditd_manager-c0ac2c00-c1c0-11e7-8995-936807a28b16.json b/packages/auditd_manager/kibana/dashboard/auditd_manager-c0ac2c00-c1c0-11e7-8995-936807a28b16.json index 0a6c0b20a2b..ff9ee8e3ee6 100644 --- a/packages/auditd_manager/kibana/dashboard/auditd_manager-c0ac2c00-c1c0-11e7-8995-936807a28b16.json +++ b/packages/auditd_manager/kibana/dashboard/auditd_manager-c0ac2c00-c1c0-11e7-8995-936807a28b16.json @@ -1,20 +1,20 @@ { "attributes": { "description": "Summary of Linux kernel audit events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "data_stream.dataset:auditd_manager.auditd" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false, + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": false }, "panelsJSON": [ @@ -32,7 +32,7 @@ "panelIndex": "5", "panelRefName": "panel_5", "type": "search", - "version": "8.2.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -70,84 +70,187 @@ }, "panelIndex": "7969164a-3810-485c-b3ad-948b1930f6d0", "type": "visualization", - "version": "8.2.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": {} - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "58c95a20-c1bd-11e7-938f-ab0645b6c431" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" } - ], - "bar_color_rules": [ - { - "id": "5bfc71a0-c1bd-11e7-938f-ab0645b6c431" - } - ], - "drop_last_bucket": 1, - "filter": { - "language": "lucene", - "query": "" }, - "gauge_color_rules": [ - { - "id": "5d20a650-c1bd-11e7-938f-ab0645b6c431" + "datasourceStates": { + "formBased": { + "layers": { + "9c301e87-19cd-4dd1-8b91-7c4ad341f32b": { + "columnOrder": [ + "ac0c48ae-49a1-4780-8f35-4673ef2b3b98", + "aeef965a-7948-4d1a-95f6-eac67d8eddbf", + "6e7ab90b-eb12-4f1b-b84e-da769dcb16ea" + ], + "columns": { + "6e7ab90b-eb12-4f1b-b84e-da769dcb16ea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Actions", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ac0c48ae-49a1-4780-8f35-4673ef2b3b98": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "aeef965a-7948-4d1a-95f6-eac67d8eddbf": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of event.action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "auto", - "legend_position": "left", - "max_lines_legend": 1, - "series": [ + }, + "filters": [], + "internalReferences": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Actions", - "line_width": 1, - "metrics": [ - { - "id": "6b9fb2d0-c1bc-11e7-938f-ab0645b6c431", - "type": "count" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "event.action" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-9c301e87-19cd-4dd1-8b91-7c4ad341f32b", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": false + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6e7ab90b-eb12-4f1b-b84e-da769dcb16ea" + ], + "layerId": "9c301e87-19cd-4dd1-8b91-7c4ad341f32b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "aeef965a-7948-4d1a-95f6-eac67d8eddbf", + "xAccessor": "ac0c48ae-49a1-4780-8f35-4673ef2b3b98", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "6e7ab90b-eb12-4f1b-b84e-da769dcb16ea" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "left", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "type": "metrics", - "uiState": {} - } + "title": "[Auditd Manager] Event Actions", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -158,97 +261,149 @@ }, "panelIndex": "c89b1ae9-3f74-4088-bb68-a0fdcf3aad94", "title": "[Auditd Manager] Event Actions", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Category", - "field": "event.category", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cf8a8037-9889-427c-ab8a-5d12f51f6c6b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cf8a8037-9889-427c-ab8a-5d12f51f6c6b": { + "columnOrder": [ + "382ebc96-7f8b-4bf8-b2be-ff648ea5e6b5", + "b9b47b41-dcd0-4d8b-afb6-d3747c69f983", + "cd9af377-634d-4d78-98bb-19cbb156bbe9" + ], + "columns": { + "382ebc96-7f8b-4bf8-b2be-ff648ea5e6b5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cd9af377-634d-4d78-98bb-19cbb156bbe9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.category" + }, + "b9b47b41-dcd0-4d8b-afb6-d3747c69f983": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cd9af377-634d-4d78-98bb-19cbb156bbe9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "cd9af377-634d-4d78-98bb-19cbb156bbe9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Action", - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" + "textBased": { + "layers": {} } - } - }, - "description": "", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "percent" }, - "legendDisplay": "show", - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "truncateLegend": true, - "type": "pie" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "cf8a8037-9889-427c-ab8a-5d12f51f6c6b", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "cd9af377-634d-4d78-98bb-19cbb156bbe9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "382ebc96-7f8b-4bf8-b2be-ff648ea5e6b5", + "b9b47b41-dcd0-4d8b-afb6-d3747c69f983" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "pie", - "uiState": {} - } + "title": "[Auditd Manager] Event Categories", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -259,18 +414,19 @@ }, "panelIndex": "af0b3b3c-90d5-4490-a2d0-9c0050d2adf5", "title": "[Auditd Manager] Event Categories", - "type": "visualization", - "version": "8.2.0" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Auditd Manager] Overview", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:45:19.714Z", "id": "auditd_manager-c0ac2c00-c1c0-11e7-8995-936807a28b16", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { @@ -278,14 +434,9 @@ "name": "5:panel_5", "type": "search" }, - { - "id": "auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16", - "name": "af0b3b3c-90d5-4490-a2d0-9c0050d2adf5:search_0", - "type": "search" - }, { "id": "logs-*", - "name": "af0b3b3c-90d5-4490-a2d0-9c0050d2adf5:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "af0b3b3c-90d5-4490-a2d0-9c0050d2adf5:indexpattern-datasource-layer-cf8a8037-9889-427c-ab8a-5d12f51f6c6b", "type": "index-pattern" } ], diff --git a/packages/auditd_manager/kibana/search/auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16.json b/packages/auditd_manager/kibana/search/auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16.json index 0121ff18569..2bf4e80f681 100644 --- a/packages/auditd_manager/kibana/search/auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16.json +++ b/packages/auditd_manager/kibana/search/auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16.json @@ -34,7 +34,8 @@ "title": "[Auditd Manager] Audit Event Table", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:37:41.847Z", "id": "auditd_manager-0f10c430-c1c3-11e7-8995-936807a28b16", "migrationVersion": { "search": "8.0.0" diff --git a/packages/auditd_manager/kibana/search/auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a.json b/packages/auditd_manager/kibana/search/auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a.json index 44c728a25cf..e1cf6c440b8 100644 --- a/packages/auditd_manager/kibana/search/auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a.json +++ b/packages/auditd_manager/kibana/search/auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a.json @@ -76,7 +76,8 @@ "title": "[Auditd Manager] Socket Connects", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:14:23.255Z", "id": "auditd_manager-5438b030-c246-11e7-8692-232bd1143e8a", "migrationVersion": { "search": "8.0.0" diff --git a/packages/auditd_manager/kibana/search/auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a.json b/packages/auditd_manager/kibana/search/auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a.json index cf533f1ec4a..47f9b990755 100644 --- a/packages/auditd_manager/kibana/search/auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a.json +++ b/packages/auditd_manager/kibana/search/auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a.json @@ -84,7 +84,8 @@ "title": "[Auditd Manager] Socket Binds", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:14:23.255Z", "id": "auditd_manager-b4c93470-c240-11e7-8692-232bd1143e8a", "migrationVersion": { "search": "8.0.0" diff --git a/packages/auditd_manager/kibana/search/auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16.json b/packages/auditd_manager/kibana/search/auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16.json index 7aed260733d..14d7a68d00c 100644 --- a/packages/auditd_manager/kibana/search/auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16.json +++ b/packages/auditd_manager/kibana/search/auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16.json @@ -57,7 +57,8 @@ "title": "[Auditd Manager] Process Executions", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:37:41.847Z", "id": "auditd_manager-d382f5b0-c1c6-11e7-8995-936807a28b16", "migrationVersion": { "search": "8.0.0" diff --git a/packages/auditd_manager/kibana/search/auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a.json b/packages/auditd_manager/kibana/search/auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a.json index 0553a811b95..c81a159b25a 100644 --- a/packages/auditd_manager/kibana/search/auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a.json +++ b/packages/auditd_manager/kibana/search/auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a.json @@ -99,7 +99,8 @@ "title": "[Auditd Manager] Socket Accept / Recvfrom", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T02:14:23.255Z", "id": "auditd_manager-e8734160-c24c-11e7-8692-232bd1143e8a", "migrationVersion": { "search": "8.0.0" diff --git a/packages/auditd_manager/kibana/tags.yml b/packages/auditd_manager/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/auditd_manager/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/auditd_manager/manifest.yml b/packages/auditd_manager/manifest.yml index 336bd6cee4f..6261ef94dc1 100644 --- a/packages/auditd_manager/manifest.yml +++ b/packages/auditd_manager/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: auditd_manager title: "Auditd Manager" -version: "1.10.0" +version: "1.14.0" description: "The Auditd Manager Integration receives audit events from the Linux Audit Framework that is a part of the Linux kernel." type: integration categories: - security - auditd conditions: - kibana.version: "^8.4.0" + kibana: + version: "^8.7.1" screenshots: - src: /img/overview.png title: Overview Dashboard @@ -37,3 +38,4 @@ policy_templates: description: Collecting auditd events owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/auth0/_dev/build/build.yml b/packages/auth0/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/auth0/_dev/build/build.yml +++ b/packages/auth0/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/auth0/changelog.yml b/packages/auth0/changelog.yml index 9ab0d4aa51d..da3b27f647b 100644 --- a/packages/auth0/changelog.yml +++ b/packages/auth0/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.9.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6905 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-failure.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-failure.json-expected.json index 9f5d16c7e8d..a38c678fe44 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-failure.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-failure.json-expected.json @@ -38,7 +38,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-login", @@ -124,7 +124,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-login", @@ -211,7 +211,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-login", @@ -284,7 +284,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "invalid-username-or-email", @@ -360,7 +360,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "incorrect-password", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-success.json-expected.json index 7cd3f4ea058..7c878204610 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-login-success.json-expected.json @@ -61,7 +61,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -189,7 +189,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -264,7 +264,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -390,7 +390,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -516,7 +516,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -630,7 +630,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -744,7 +744,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -858,7 +858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -935,7 +935,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1051,7 +1051,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1179,7 +1179,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1295,7 +1295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1411,7 +1411,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1527,7 +1527,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1643,7 +1643,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1759,7 +1759,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1875,7 +1875,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -1991,7 +1991,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -2107,7 +2107,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -2223,7 +2223,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -2351,7 +2351,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", @@ -2479,7 +2479,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "successful-login", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-logout-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-logout-success.json-expected.json index 48d6a1cc95a..8bbdfc971b6 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-logout-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-logout-success.json-expected.json @@ -24,7 +24,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logout-successful", @@ -101,7 +101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logout-successful", @@ -178,7 +178,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logout-successful", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-mgmt-api-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-mgmt-api-success.json-expected.json index 08afe6741f9..d51598365ba 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-mgmt-api-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-mgmt-api-success.json-expected.json @@ -54,7 +54,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -169,7 +169,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -309,7 +309,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -680,7 +680,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -780,7 +780,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -939,7 +939,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1178,7 +1178,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1280,7 +1280,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1519,7 +1519,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1623,7 +1623,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1733,7 +1733,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -1972,7 +1972,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2211,7 +2211,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2320,7 +2320,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2435,7 +2435,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2544,7 +2544,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2646,7 +2646,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2761,7 +2761,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2870,7 +2870,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -2972,7 +2972,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3065,7 +3065,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3175,7 +3175,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3284,7 +3284,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3377,7 +3377,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3487,7 +3487,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3580,7 +3580,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3690,7 +3690,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3805,7 +3805,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -3907,7 +3907,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4006,7 +4006,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4122,7 +4122,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4361,7 +4361,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4459,7 +4459,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4688,7 +4688,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -4913,7 +4913,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5013,7 +5013,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5115,7 +5115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5223,7 +5223,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5331,7 +5331,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5433,7 +5433,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op", @@ -5538,7 +5538,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op-secrets-returned", @@ -5639,7 +5639,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-mgmt-api-op-secrets-returned", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-failure.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-failure.json-expected.json index 0bf766e285d..6a12e41843e 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-failure.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-failure.json-expected.json @@ -72,7 +72,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-signup-failed", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-success.json-expected.json index 7eab71d7e1f..d8539054136 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-signup-success.json-expected.json @@ -27,7 +27,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-signup", @@ -101,7 +101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-signup", @@ -181,7 +181,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-signup", @@ -255,7 +255,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-signup", @@ -329,7 +329,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-signup", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-token-xchg-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-token-xchg-success.json-expected.json index 6dc8107163e..a3c94a50578 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-token-xchg-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-token-xchg-success.json-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -88,7 +88,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -158,7 +158,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -228,7 +228,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -298,7 +298,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -368,7 +368,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -438,7 +438,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -508,7 +508,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -578,7 +578,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -648,7 +648,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -718,7 +718,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -788,7 +788,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -858,7 +858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -928,7 +928,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -998,7 +998,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1068,7 +1068,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1138,7 +1138,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1208,7 +1208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1278,7 +1278,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1348,7 +1348,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", @@ -1418,7 +1418,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "success-exchange-auth-code-for-access-token", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-fail.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-fail.json-expected.json index 0bc84a8b1a1..a6955d0532d 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-fail.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-fail.json-expected.json @@ -20,7 +20,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-to-send-email-notification", @@ -58,7 +58,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-to-send-email-notification", diff --git a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-success.json-expected.json b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-success.json-expected.json index 6c37a218a24..96e55201cf5 100644 --- a/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-success.json-expected.json +++ b/packages/auth0/data_stream/logs/_dev/test/pipeline/test-user-behaviour-success.json-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sent-verification-email", diff --git a/packages/auth0/data_stream/logs/elasticsearch/ingest_pipeline/default.yml b/packages/auth0/data_stream/logs/elasticsearch/ingest_pipeline/default.yml index 76bf031abd1..36dc17865b2 100644 --- a/packages/auth0/data_stream/logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/auth0/data_stream/logs/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Auth0 log stream events processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: auth0.logs.data copy_from: json.data diff --git a/packages/auth0/data_stream/logs/sample_event.json b/packages/auth0/data_stream/logs/sample_event.json index 4c5d9bef9f1..5f2add17204 100644 --- a/packages/auth0/data_stream/logs/sample_event.json +++ b/packages/auth0/data_stream/logs/sample_event.json @@ -83,7 +83,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2c778b7a-e0be-4a84-8c7c-e0142f3690df", diff --git a/packages/auth0/docs/README.md b/packages/auth0/docs/README.md index c10c1192bb1..cba81cf1c25 100644 --- a/packages/auth0/docs/README.md +++ b/packages/auth0/docs/README.md @@ -95,11 +95,11 @@ The Auth0 logs dataset provides events from Auth0 log stream. All Auth0 log even | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event timestamp. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event timestamp. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -256,7 +256,7 @@ An example event for `logs` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2c778b7a-e0be-4a84-8c7c-e0142f3690df", diff --git a/packages/auth0/kibana/dashboard/auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf.json b/packages/auth0/kibana/dashboard/auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf.json index 24a20bd5d71..5fdc17c4d40 100644 --- a/packages/auth0/kibana/dashboard/auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf.json +++ b/packages/auth0/kibana/dashboard/auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf.json @@ -1,14 +1,6 @@ { - "id": "auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-18T20:58:16.014Z", - "version": "WzU3NCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -21,20 +13,12 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "lens", - "gridData": { - "h": 10, - "i": "1a13814d-17bf-42cf-8ef9-2dc599fb6766", - "w": 15, - "x": 0, - "y": 0 - }, - "panelIndex": "1a13814d-17bf-42cf-8ef9-2dc599fb6766", "embeddableConfig": { "attributes": { "references": [ @@ -56,7 +40,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c9215ac0-57f7-4fbb-af81-9f5bb365a238": { "columnOrder": [ @@ -104,13 +88,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { "query": "auth0.logs" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -127,15 +111,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ad18389f-67bd-47ae-bd5e-7a0a8a74ef31" - ], "layerId": "c9215ac0-57f7-4fbb-af81-9f5bb365a238", "layerType": "data", "legendDisplay": "default", - "metric": "becf928d-1e95-4cf0-a37f-e4eb735dcc27", + "legendSize": "auto", + "metrics": [ + "becf928d-1e95-4cf0-a37f-e4eb735dcc27" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ad18389f-67bd-47ae-bd5e-7a0a8a74ef31" + ] } ], "shape": "pie" @@ -146,22 +133,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Auth0 Log Stream Event Types" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 10, - "i": "6089a77e-3c96-4414-9932-eda55ced3d07", - "w": 14, - "x": 15, + "i": "1a13814d-17bf-42cf-8ef9-2dc599fb6766", + "w": 15, + "x": 0, "y": 0 }, - "panelIndex": "6089a77e-3c96-4414-9932-eda55ced3d07", + "panelIndex": "1a13814d-17bf-42cf-8ef9-2dc599fb6766", + "title": "Auth0 Log Stream Event Types", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -183,7 +169,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1f92a60a-ed7e-42e4-b03c-4a3fb37e1a35": { "columnOrder": [ @@ -197,6 +183,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -224,13 +211,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { "query": "auth0.logs" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -259,6 +246,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -277,250 +265,269 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Rate of events" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { "h": 10, - "i": "5124c723-8890-477e-aad5-bc4fd529bd46", - "w": 9, - "x": 29, + "i": "6089a77e-3c96-4414-9932-eda55ced3d07", + "w": 14, + "x": 15, "y": 0 }, - "panelIndex": "5124c723-8890-477e-aad5-bc4fd529bd46", + "panelIndex": "6089a77e-3c96-4414-9932-eda55ced3d07", + "title": "Rate of events", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "auth0.logs" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f4e91fff-3766-4adf-bcbf-f0ceb8ea19fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3b88d295-b9e0-412b-9bff-d6e5893a485a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "335cb626-370d-4e95-9a6c-4f231edeb186", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f4e91fff-3766-4adf-bcbf-f0ceb8ea19fa": { + "columnOrder": [ + "7c1be01f-a2e6-41e3-80e6-088855e73800" + ], + "columns": { + "7c1be01f-a2e6-41e3-80e6-088855e73800": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "auth0.logs" - } + "incompleteColumns": {} } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "3b88d295-b9e0-412b-9bff-d6e5893a485a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auth0.logs" }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "event.category", - "negate": false, - "params": { - "query": "Login - Failure" - }, - "type": "phrase" + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auth0.logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "335cb626-370d-4e95-9a6c-4f231edeb186", + "key": "event.category", + "negate": false, + "params": { + "query": "Login - Failure" }, - "query": { - "match_phrase": { - "event.category": "Login - Failure" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "Login - Failure" } } - ], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" } - } - }, - "description": "", - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "type": "metric" + "visualization": { + "layerId": "f4e91fff-3766-4adf-bcbf-f0ceb8ea19fa", + "layerType": "data", + "metricAccessor": "7c1be01f-a2e6-41e3-80e6-088855e73800" + } }, - "title": "", - "type": "metric", - "uiState": {} + "title": "Number of Failed Logins", + "type": "lens", + "visualizationType": "lnsMetric" }, - "type": "visualization" + "enhancements": {}, + "hidePanelTitles": false }, - "title": "Number of Failed Logins" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { "h": 10, - "i": "cb337534-d263-480b-b6a3-80cc4f14d73b", - "w": 10, - "x": 38, + "i": "5124c723-8890-477e-aad5-bc4fd529bd46", + "w": 9, + "x": 29, "y": 0 }, - "panelIndex": "cb337534-d263-480b-b6a3-80cc4f14d73b", + "panelIndex": "5124c723-8890-477e-aad5-bc4fd529bd46", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "auth0.logs" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f637aea7-1a8a-4c6f-bea3-83b1910bd16d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5f62b07-86eb-481b-b6b5-308fdf2ee125", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fefc1a3f-fa1c-455f-9f0e-836cb58b93b4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f637aea7-1a8a-4c6f-bea3-83b1910bd16d": { + "columnOrder": [ + "07d7e830-73dc-4cc0-9426-892fc45589d4" + ], + "columns": { + "07d7e830-73dc-4cc0-9426-892fc45589d4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "auth0.logs" - } + "incompleteColumns": {} } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "f5f62b07-86eb-481b-b6b5-308fdf2ee125", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "auth0.logs" }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "event.category", - "negate": false, - "params": { - "query": "Signup - Success" - }, - "type": "phrase" + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "auth0.logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fefc1a3f-fa1c-455f-9f0e-836cb58b93b4", + "key": "event.category", + "negate": false, + "params": { + "query": "Signup - Success" }, - "query": { - "match_phrase": { - "event.category": "Signup - Success" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "Signup - Success" } } - ], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" } - } - }, - "description": "", - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "type": "metric" + "visualization": { + "layerId": "f637aea7-1a8a-4c6f-bea3-83b1910bd16d", + "layerType": "data", + "metricAccessor": "07d7e830-73dc-4cc0-9426-892fc45589d4" + } }, - "title": "", - "type": "metric", - "uiState": {} + "title": "Number of Successful Signups", + "type": "lens", + "visualizationType": "lnsMetric" }, - "type": "visualization" + "enhancements": {}, + "hidePanelTitles": false }, - "title": "Number of Successful Signups" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 12, - "i": "d00429d4-502f-41d8-8a2b-7300859930ea", - "w": 15, - "x": 0, - "y": 10 + "h": 10, + "i": "cb337534-d263-480b-b6a3-80cc4f14d73b", + "w": 10, + "x": 38, + "y": 0 }, - "panelIndex": "d00429d4-502f-41d8-8a2b-7300859930ea", + "panelIndex": "cb337534-d263-480b-b6a3-80cc4f14d73b", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -547,7 +554,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e7270679-c5d0-496a-9fd2-7409b402bdb0": { "columnOrder": [ @@ -569,6 +576,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -588,13 +596,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { "query": "auth0.logs" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -609,13 +617,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-1", "key": "event.category", "negate": false, "params": { "query": "Login - Success" }, - "type": "phrase", - "index": "filter-index-pattern-1" + "type": "phrase" }, "query": { "match_phrase": { @@ -660,6 +668,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -682,22 +691,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Rate of Successful Logins" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 12, - "i": "c1a1b718-c5f1-4029-9fda-0cd7ed38b3a8", - "w": 14, - "x": 15, + "i": "d00429d4-502f-41d8-8a2b-7300859930ea", + "w": 15, + "x": 0, "y": 10 }, - "panelIndex": "c1a1b718-c5f1-4029-9fda-0cd7ed38b3a8", + "panelIndex": "d00429d4-502f-41d8-8a2b-7300859930ea", + "title": "Rate of Successful Logins", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -724,7 +732,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4fc38bcd-1242-43bb-a213-0c6fe6e7a26e": { "columnOrder": [ @@ -738,6 +746,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -765,13 +774,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { "query": "auth0.logs" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -786,13 +795,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-1", "key": "event.category", "negate": false, "params": { "query": "Login - Failure" }, - "type": "phrase", - "index": "filter-index-pattern-1" + "type": "phrase" }, "query": { "match_phrase": { @@ -821,6 +830,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -839,120 +849,155 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Rate of Failed Logins" + "gridData": { + "h": 12, + "i": "c1a1b718-c5f1-4029-9fda-0cd7ed38b3a8", + "w": 14, + "x": 15, + "y": 10 + }, + "panelIndex": "c1a1b718-c5f1-4029-9fda-0cd7ed38b3a8", + "title": "Rate of Failed Logins", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "IP Addresses of failed logins", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "auth0.logs.data.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "auth0.logs" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e62e3521-0ee8-4488-931d-4474a54c10a7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e62e3521-0ee8-4488-931d-4474a54c10a7": { + "columnOrder": [ + "80cab385-f007-47be-80af-a825f0381d20", + "9b47063f-6502-47ca-80be-f0b98869fc5e" + ], + "columns": { + "80cab385-f007-47be-80af-a825f0381d20": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "IP Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9b47063f-6502-47ca-80be-f0b98869fc5e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "auth0.logs.data.ip" + }, + "9b47063f-6502-47ca-80be-f0b98869fc5e": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "auth0.logs" - } + "incompleteColumns": {}, + "sampling": 1 } - }, + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "event.category", - "negate": false, - "params": { - "query": "Login - Failure" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "Login - Failure" - } - } + "accessors": [ + "9b47063f-6502-47ca-80be-f0b98869fc5e" + ], + "layerId": "e62e3521-0ee8-4488-931d-4474a54c10a7", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "80cab385-f007-47be-80af-a825f0381d20" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, - "i": "d6323397-e8a4-4869-ad2b-d48ee5b5a70a", + "i": "7f0587d4-ef04-4913-9ccb-cd2c93f470df", "w": 19, "x": 29, "y": 10 }, - "panelIndex": "d6323397-e8a4-4869-ad2b-d48ee5b5a70a", - "type": "visualization", - "version": "8.0.0" + "panelIndex": "7f0587d4-ef04-4913-9ccb-cd2c93f470df", + "title": "IP Addresses of failed logins", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -968,13 +1013,19 @@ "panelIndex": "253f1007-1537-4012-a663-48bccf233f4c", "panelRefName": "panel_253f1007-1537-4012-a663-48bccf233f4c", "type": "search", - "version": "7.15.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "Auth0", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T05:13:37.961Z", + "id": "auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "logs-*", @@ -1008,32 +1059,32 @@ }, { "id": "logs-*", - "name": "5124c723-8890-477e-aad5-bc4fd529bd46:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "5124c723-8890-477e-aad5-bc4fd529bd46:indexpattern-datasource-layer-f4e91fff-3766-4adf-bcbf-f0ceb8ea19fa", "type": "index-pattern" }, { "id": "logs-*", - "name": "5124c723-8890-477e-aad5-bc4fd529bd46:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "5124c723-8890-477e-aad5-bc4fd529bd46:3b88d295-b9e0-412b-9bff-d6e5893a485a", "type": "index-pattern" }, { "id": "logs-*", - "name": "5124c723-8890-477e-aad5-bc4fd529bd46:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "5124c723-8890-477e-aad5-bc4fd529bd46:335cb626-370d-4e95-9a6c-4f231edeb186", "type": "index-pattern" }, { "id": "logs-*", - "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:indexpattern-datasource-layer-f637aea7-1a8a-4c6f-bea3-83b1910bd16d", "type": "index-pattern" }, { "id": "logs-*", - "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:f5f62b07-86eb-481b-b6b5-308fdf2ee125", "type": "index-pattern" }, { "id": "logs-*", - "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "cb337534-d263-480b-b6a3-80cc4f14d73b:fefc1a3f-fa1c-455f-9f0e-836cb58b93b4", "type": "index-pattern" }, { @@ -1076,29 +1127,16 @@ "name": "c1a1b718-c5f1-4029-9fda-0cd7ed38b3a8:filter-index-pattern-1", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "7f0587d4-ef04-4913-9ccb-cd2c93f470df:indexpattern-datasource-layer-e62e3521-0ee8-4488-931d-4474a54c10a7", + "type": "index-pattern" + }, { "id": "auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf", "name": "253f1007-1537-4012-a663-48bccf233f4c:panel_253f1007-1537-4012-a663-48bccf233f4c", "type": "search" - }, - { - "type": "index-pattern", - "name": "d6323397-e8a4-4869-ad2b-d48ee5b5a70a:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "d6323397-e8a4-4869-ad2b-d48ee5b5a70a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "d6323397-e8a4-4869-ad2b-d48ee5b5a70a:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/auth0/kibana/search/auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf.json b/packages/auth0/kibana/search/auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf.json index a8e0f8b2f4b..d504b9c6981 100644 --- a/packages/auth0/kibana/search/auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf.json +++ b/packages/auth0/kibana/search/auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf.json @@ -40,10 +40,11 @@ "title": "Auth0 logs", "version": 1 }, - "coreMigrationVersion": "7.15.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T05:07:28.181Z", "id": "auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/auth0/kibana/tags.yml b/packages/auth0/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/auth0/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/auth0/manifest.yml b/packages/auth0/manifest.yml index 9568b2786e3..e94bab3dab8 100644 --- a/packages/auth0/manifest.yml +++ b/packages/auth0/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: auth0 title: "Auth0" -version: "1.8.0" +version: "1.12.0" description: Collect logs from Auth0 with Elastic Agent. type: integration categories: - security - iam conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - src: /img/auth0-screenshot.png title: Auth0 Dashboard @@ -29,3 +30,4 @@ policy_templates: description: Collecting Auth0 log stream events via Webhooks. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/aws/_dev/build/docs/apigateway.md b/packages/aws/_dev/build/docs/apigateway.md index 92b5ea98ccf..241a73692f1 100644 --- a/packages/aws/_dev/build/docs/apigateway.md +++ b/packages/aws/_dev/build/docs/apigateway.md @@ -2,7 +2,7 @@ The AWS API Gateway integration allows you to monitor [API Gateway](https://aws.amazon.com/api-gateway/) — a centralized API management service. -Use the AWS API Gateway integration to collect metrics related to your HTTP, REST or WebSockets APIs. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue. +Use the AWS API Gateway integration to collect metrics and logs related to your HTTP, REST or WebSockets APIs. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue. For example, you could use this integration to examine metrics related to error rates, response codes, and latency. You can pinpoint problematic areas, identify error-prone API endpoints, and troubleshoot performance issues. @@ -10,7 +10,29 @@ For example, you could use this integration to examine metrics related to error ## Data streams -The API Gateway integration collects one type of data: metrics. +The API Gateway integration collects two types of data: metrics and logs. + +**Logs** help you keep a record of events happening in Amazon API Gateway. +Logs collected by the Amazon API Gateway integration include the HTTP method, status code, request details and more. + +AWS API Gateway allows you to set up Custom Access Logging to gain deeper insights into the requests and responses through your API by making use of context variables ([HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging-variables.html), [WebSockets](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-logging.html)), input, stage and util variables ([REST](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html)). + +The Elastic integration for AWS API Gateway supports the following Log Format by API type: + +HTTP: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","requestTime": "$context.requestTime","httpMethod": "$context.httpMethod","routeKey": "$context.routeKey","status": "$context.status","protocol": "$context.protocol","responseLength": "$context.responseLength",apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +REST: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","caller": "$context.identity.caller","user": "$context.identity.user""requestTime": "$context.requestTime","httpMethod": "$context.httpMethod","resourcePath": "$context.resourcePath","status": "$context.status","protocol": "$context.protocol","responseLength": "$context.responseLength",apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +WebSockets: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","caller": "$context.identity.caller","user": "$context.identity.user","requestTime": "$context.requestTime","eventType": "$context.eventType","routeKey": "$context.routeKey","status": "$context.status","connectionId": "$context.connectionId", apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +Beyond the standard Log Formats we provide, you can use a wide range of fields for each API type when enabling Custom Access Logging. + +To utilize these fields in the integration, create custom pipelines. These pipelines will process field names or values. You'll also need to create a custom mapping to store your data efficiently. For more information on how to do this, check out our [official documentation](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + +See more details in the [Logs reference](#logs-reference). **Metrics** give you insight into the state of API Gateway. Metrics collected by the AWS API Gateway integration include the number of client and server errors, request and error counts and cache counts. @@ -43,4 +65,10 @@ For step-by-step instructions on how to set up an integration, see the {{event "apigateway_metrics"}} -{{fields "apigateway_metrics"}} \ No newline at end of file +{{fields "apigateway_metrics"}} + +## Logs reference + +{{event "apigateway_logs"}} + +{{fields "apigateway_logs"}} \ No newline at end of file diff --git a/packages/aws/_dev/build/docs/emr.md b/packages/aws/_dev/build/docs/emr.md index 831b28f6489..4c88fa8b1d5 100644 --- a/packages/aws/_dev/build/docs/emr.md +++ b/packages/aws/_dev/build/docs/emr.md @@ -10,11 +10,14 @@ For example, you could use this data to track Amazon EMR cluster progress and cl ## Data streams -The Amazon EMR integration collects one type of data: metrics. +The Amazon EMR integration collects two types of data: metrics and logs. **Metrics** give you insight into the state of Amazon EMR. The metrics collected by the Amazon EMR integration include cluster progress, cluster state, cluster or node storage, and more. See more details in the [Metrics reference](#metrics-reference) +**Logs** help you keep a record of events happening in Amazon EMR. +Logs collected by the Amazon EMR integration include the cluster status, node status details and more. + ## Requirements You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. @@ -41,4 +44,10 @@ For step-by-step instructions on how to set up an integration, see the {{event "emr_metrics"}} -{{fields "emr_metrics"}} \ No newline at end of file +{{fields "emr_metrics"}} + +## Logs reference + +{{event "emr_logs"}} + +{{fields "emr_logs"}} \ No newline at end of file diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index 3585a4070df..4127f05d915 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,7 +1,187 @@ # newer versions go on top +- version: "2.2.1" + changes: + - description: Fix GuardDuty API call parameter. + type: bugfix + link: https://github.com/elastic/integrations/pull/7785 +- version: "2.2.0" + changes: + - description: Add AWS API Gateway metrics dashboard Stage filter, control groups and clean up + type: enhancement + link: https://github.com/elastic/integrations/pull/7702 +- version: "2.1.2" + changes: + - description: Fix AWS API Gateway metrics dashboard + type: bugfix + link: https://github.com/elastic/integrations/pull/7675 +- version: "2.1.1" + changes: + - description: Improve AWS API Gateway dashboard + type: enhancement + link: https://github.com/elastic/integrations/pull/7541 +- version: "2.1.0" + changes: + - description: Enable TSDB by default for EC2 metrics data stream. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7497 +- version: "2.0.0" + changes: + - description: Remove deprecated option for "Cloudwatch via S3"from the AWS CloudWatch integration. If you are using it take note that logs WON'T BE ingested via this route anymore once you update. + type: enhancement + link: https://github.com/elastic/integrations/pull/6247 +- version: "1.53.5" + changes: + - description: Set metric type in EC2 data stream fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/7490 +- version: "1.53.4" + changes: + - description: Add dimension fields to EC2 data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7487 +- version: "1.53.3" + changes: + - description: Add missing fields definition for ec2 + type: enhancement + link: https://github.com/elastic/integrations/pull/7425 +- version: "1.53.2" + changes: + - description: Remove the remove processor since rename processor removes old field already. + type: bugfix + link: https://github.com/elastic/integrations/pull/7331 +- version: "1.53.1" + changes: + - description: Disable TSDB on AWS Billing. + type: enhancement + link: https://github.com/elastic/integrations/pull/7435 +- version: "1.53.0" + changes: + - description: Add AWS API Gateway custom acccess logging fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/7151 +- version: "1.52.1" + changes: + - description: Use default color for AWS dashboards metric charts. + type: enhancement + link: https://github.com/elastic/integrations/pull/7129 +- version: "1.52.0" + changes: + - description: Enable TSDB by default for cloudwatch metrics data stream. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7262 +- version: "1.51.1" + changes: + - description: Use object metric type for the cloudwatch metrics + type: enhancement + link: https://github.com/elastic/integrations/pull/7327 +- version: "1.51.0" + changes: + - description: Add standalone S3 option for vpcflow + type: enhancement + link: https://github.com/elastic/integrations/pull/6936 +- version: "1.50.6" + changes: + - description: Add metric_type metadata to the cloudwatch data_stream + type: enhancement + link: https://github.com/elastic/integrations/pull/6999 +- version: "1.50.5" + changes: + - description: Migrate AWS Security Hub dashboards to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6871 +- version: "1.50.4" + changes: + - description: Migrate AWS VPC dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6962 +- version: "1.50.3" + changes: + - description: Add EMR logs dashboard. + type: enhancement + link: https://github.com/elastic/integrations/pull/7075 +- version: "1.50.2" + changes: + - description: Migrate AWS Billing dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6644 +- version: "1.50.1" + changes: + - description: Add AWS API Gateway logs dashboard. + type: enhancement + link: https://github.com/elastic/integrations/pull/6683 +- version: "1.50.0" + changes: + - description: Add EMR logs data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6895 +- version: "1.49.0" + changes: + - description: Add API Gateway logs datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/6530 +- version: "1.48.0" + changes: + - description: Adding missing fields for the CloudTrail datastream - add option for standalone S3 bucket + type: enhancement + link: https://github.com/elastic/integrations/pull/6915 +- version: "1.47.1" + changes: + - description: Migrate AWS Redshift dashboard input controls. + type: enhancement + link: https://github.com/elastic/integrations/pull/6865 +- version: "1.47.0" + changes: + - description: Migrate AWS S3 Server Access Log Overview dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6487 +- version: "1.46.9" + changes: + - description: Migrate AWS Network Firewall dashboard input controls. + type: enhancement + link: https://github.com/elastic/integrations/pull/6995 +- version: "1.46.8" + changes: + - description: Add dimensions metadata to the cloudwatch data_stream + type: enhancement + link: https://github.com/elastic/integrations/pull/6827 +- version: "1.46.7" + changes: + - description: Enable time series data streams for the API Gateway and EMR data streams. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6969 +- version: "1.46.6" + changes: + - description: Update metric type and set dimension fields for AWS EMR data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6964 +- version: "1.46.5" + changes: + - description: Fix metric type for API Gateway metric fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/6952 +- version: "1.46.4" + changes: + - description: Set dimensions fields for API Gateway data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6950 +- version: "1.46.3" + changes: + - description: Add missing S3 fields for vpcflow + type: enhancement + link: https://github.com/elastic/integrations/pull/6916 +- version: "1.46.2" + changes: + - description: Enable time series data streams for the S3 daily storage and S3 request datasets. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6887 +- version: "1.46.1" + changes: + - description: Enable time series data streams for the Usage dataset. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6886 - version: "1.46.0" changes: - - description: Enable time series data streams for the metrics datasets Billing, DynamoDB, EBS, ECS, ELB, Firewall, Kinesis, Lambda, NAT gateway, RDS, Redshift, S3 Storage Lens, SNS, SQS, Transit Gateway and VPN. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html + - description: Enable time series data streams for the metrics datasets Billing, DynamoDB, EBS, ECS, ELB, Firewall, Kinesis, Lambda, NAT gateway, RDS, Redshift, S3 Storage Lens, SNS, SQS, Transit Gateway and VPN. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. type: enhancement link: https://github.com/elastic/integrations/pull/6782 - version: "1.45.9" diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log new file mode 100644 index 00000000000..34973d45612 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log @@ -0,0 +1,5 @@ +{"requestId":"GQIVriFLIAMEMsA=","ip":"1.128.0.0","requestTime":"09/Jun/2023:12:54:08 +0000","httpMethod":"GET","routeKey":"GET /","status":"200","protocol":"HTTP/1.1","responseLength":"47140"} +{"requestId": "IWeTChtboAMEVUQ=","ip": "1.128.0.0","requestTime": "20/Jul/2023:07:09:32 +0000","httpMethod": "GET","routeKey": "GET /","status": "200","protocol": "HTTP/1.1","responseLength": "51880"} +{"requestId": "IWvN1jOkoAMEVpg=","ip": "1.128.0.0","requestTime": "20/Jul/2023:09:05:02 +0000","httpMethod": "GET","routeKey": "GET /","status": "200","protocol": "HTTP/1.1","responseLength": "51898"} +{"requestId":"Iq8dHhlwIAMEV_g=","ip":"1.128.0.0","requestTime":"26/Jul/2023:12:13:33 +0000","httpMethod":"GET","routeKey":"GET /","status":"200","protocol":"HTTP/1.1","responseLength":"51243","stage":"$default","apiId":"1ax3mj7iqf","domainName":"1ax3mj7iqf.execute-api.us-east-1.amazonaws.com"} +{"requestId":"Iq8dXiijIAMEV8Q=","ip":"1.128.0.0","requestTime":"26/Jul/2023:12:13:34 +0000","httpMethod":"GET","routeKey":"GET /","status":"200","protocol":"HTTP/1.1","responseLength":"51205","stage":"$default","apiId":"1ax3mj7iqf","domainName":"1ax3mj7iqf.execute-api.us-east-1.amazonaws.com"} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log-expected.json b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log-expected.json new file mode 100644 index 00000000000..fabbc92b67a --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-http.log-expected.json @@ -0,0 +1,125 @@ +{ + "expected": [ + { + "aws": { + "apigateway": { + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "GQIVriFLIAMEMsA=", + "request_time": "2023-06-09T12:54:08.000Z", + "response_length": 47140, + "route_key": "GET /", + "status": 200 + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"GQIVriFLIAMEMsA=\",\"ip\":\"1.128.0.0\",\"requestTime\":\"09/Jun/2023:12:54:08 +0000\",\"httpMethod\":\"GET\",\"routeKey\":\"GET /\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"47140\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "IWeTChtboAMEVUQ=", + "request_time": "2023-07-20T07:09:32.000Z", + "response_length": 51880, + "route_key": "GET /", + "status": 200 + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"IWeTChtboAMEVUQ=\",\"ip\": \"1.128.0.0\",\"requestTime\": \"20/Jul/2023:07:09:32 +0000\",\"httpMethod\": \"GET\",\"routeKey\": \"GET /\",\"status\": \"200\",\"protocol\": \"HTTP/1.1\",\"responseLength\": \"51880\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "IWvN1jOkoAMEVpg=", + "request_time": "2023-07-20T09:05:02.000Z", + "response_length": 51898, + "route_key": "GET /", + "status": 200 + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"IWvN1jOkoAMEVpg=\",\"ip\": \"1.128.0.0\",\"requestTime\": \"20/Jul/2023:09:05:02 +0000\",\"httpMethod\": \"GET\",\"routeKey\": \"GET /\",\"status\": \"200\",\"protocol\": \"HTTP/1.1\",\"responseLength\": \"51898\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "1ax3mj7iqf", + "domain_name": "1ax3mj7iqf.execute-api.us-east-1.amazonaws.com", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "Iq8dHhlwIAMEV_g=", + "request_time": "2023-07-26T12:13:33.000Z", + "response_length": 51243, + "route_key": "GET /", + "stage": "$default", + "status": 200 + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"Iq8dHhlwIAMEV_g=\",\"ip\":\"1.128.0.0\",\"requestTime\":\"26/Jul/2023:12:13:33 +0000\",\"httpMethod\":\"GET\",\"routeKey\":\"GET /\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"51243\",\"stage\":\"$default\",\"apiId\":\"1ax3mj7iqf\",\"domainName\":\"1ax3mj7iqf.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "1ax3mj7iqf", + "domain_name": "1ax3mj7iqf.execute-api.us-east-1.amazonaws.com", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "Iq8dXiijIAMEV8Q=", + "request_time": "2023-07-26T12:13:34.000Z", + "response_length": 51205, + "route_key": "GET /", + "stage": "$default", + "status": 200 + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"Iq8dXiijIAMEV8Q=\",\"ip\":\"1.128.0.0\",\"requestTime\":\"26/Jul/2023:12:13:34 +0000\",\"httpMethod\":\"GET\",\"routeKey\":\"GET /\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"51205\",\"stage\":\"$default\",\"apiId\":\"1ax3mj7iqf\",\"domainName\":\"1ax3mj7iqf.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log new file mode 100644 index 00000000000..a2c6fef1847 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log @@ -0,0 +1,5 @@ +{"requestId":"48752d0f-c99d-4cfa-a5a7-f3c6834d19e5","ip":"1.128.0.0","caller":"-","user":"-","requestTime":"10/Jun/2023:15:36:28 +0000","httpMethod":"GET","resourcePath":"/pets","status":"200","protocol":"HTTP/1.1","responseLength":"184"} +{"requestId": "caa4a500-2651-4476-aa1f-a639b858819b","ip": "1.128.0.0","caller": "-","user": "-","requestTime": "19/Jul/2023:16:15:46 +0000","httpMethod": "GET","resourcePath": "/pets/{petId}","status": "200","protocol": "HTTP/1.1","responseLength": "49"} +{"requestId": "c5a56ba0-fd42-4425-b7d2-5e8836563270","ip": "1.128.0.0","caller": "-","user": "-","requestTime": "19/Jul/2023:16:15:44 +0000","httpMethod": "GET","resourcePath": "/pets/{petId}","status": "200","protocol": "HTTP/1.1","responseLength": "49"} +{"requestId":"c12d1542-b79e-4e79-a158-fdf36452a81b","ip":"1.128.0.0","caller":"-","user":"-","requestTime":"26/Jul/2023:12:07:03 +0000","httpMethod":"GET","resourcePath":"/pets/{petId}","status":"200","protocol":"HTTP/1.1","responseLength":"48","stage":"prod","apiId":"asad15n3p0","domainName":"asad15n3p0.execute-api.us-east-1.amazonaws.com"} +{"requestId":"868ee022-bc3a-4acf-97e7-acb7472b3235","ip":"1.128.0.0","caller":"-","user":"-","requestTime":"26/Jul/2023:12:06:57 +0000","httpMethod":"GET","resourcePath":"/","status":"200","protocol":"HTTP/1.1","responseLength":"1310","stage":"prod","apiId":"asad15n3p0","domainName":"asad15n3p0.execute-api.us-east-1.amazonaws.com"} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log-expected.json b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log-expected.json new file mode 100644 index 00000000000..01cb89ce7bb --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-rest.log-expected.json @@ -0,0 +1,135 @@ +{ + "expected": [ + { + "aws": { + "apigateway": { + "caller": "-", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "48752d0f-c99d-4cfa-a5a7-f3c6834d19e5", + "request_time": "2023-06-10T15:36:28.000Z", + "resource_path": "/pets", + "response_length": 184, + "status": 200, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"48752d0f-c99d-4cfa-a5a7-f3c6834d19e5\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"10/Jun/2023:15:36:28 +0000\",\"httpMethod\":\"GET\",\"resourcePath\":\"/pets\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"184\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "caller": "-", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "caa4a500-2651-4476-aa1f-a639b858819b", + "request_time": "2023-07-19T16:15:46.000Z", + "resource_path": "/pets/{petId}", + "response_length": 49, + "status": 200, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"caa4a500-2651-4476-aa1f-a639b858819b\",\"ip\": \"1.128.0.0\",\"caller\": \"-\",\"user\": \"-\",\"requestTime\": \"19/Jul/2023:16:15:46 +0000\",\"httpMethod\": \"GET\",\"resourcePath\": \"/pets/{petId}\",\"status\": \"200\",\"protocol\": \"HTTP/1.1\",\"responseLength\": \"49\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "caller": "-", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "c5a56ba0-fd42-4425-b7d2-5e8836563270", + "request_time": "2023-07-19T16:15:44.000Z", + "resource_path": "/pets/{petId}", + "response_length": 49, + "status": 200, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"c5a56ba0-fd42-4425-b7d2-5e8836563270\",\"ip\": \"1.128.0.0\",\"caller\": \"-\",\"user\": \"-\",\"requestTime\": \"19/Jul/2023:16:15:44 +0000\",\"httpMethod\": \"GET\",\"resourcePath\": \"/pets/{petId}\",\"status\": \"200\",\"protocol\": \"HTTP/1.1\",\"responseLength\": \"49\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "asad15n3p0", + "caller": "-", + "domain_name": "asad15n3p0.execute-api.us-east-1.amazonaws.com", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "c12d1542-b79e-4e79-a158-fdf36452a81b", + "request_time": "2023-07-26T12:07:03.000Z", + "resource_path": "/pets/{petId}", + "response_length": 48, + "stage": "prod", + "status": 200, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"c12d1542-b79e-4e79-a158-fdf36452a81b\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:07:03 +0000\",\"httpMethod\":\"GET\",\"resourcePath\":\"/pets/{petId}\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"48\",\"stage\":\"prod\",\"apiId\":\"asad15n3p0\",\"domainName\":\"asad15n3p0.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "asad15n3p0", + "caller": "-", + "domain_name": "asad15n3p0.execute-api.us-east-1.amazonaws.com", + "http_method": "GET", + "ip_address": "1.128.0.0", + "protocol": "HTTP/1.1", + "request_id": "868ee022-bc3a-4acf-97e7-acb7472b3235", + "request_time": "2023-07-26T12:06:57.000Z", + "resource_path": "/", + "response_length": 1310, + "stage": "prod", + "status": 200, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"868ee022-bc3a-4acf-97e7-acb7472b3235\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:06:57 +0000\",\"httpMethod\":\"GET\",\"resourcePath\":\"/\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"1310\",\"stage\":\"prod\",\"apiId\":\"asad15n3p0\",\"domainName\":\"asad15n3p0.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log new file mode 100644 index 00000000000..f74976184de --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log @@ -0,0 +1,4 @@ +{"requestId": "REDACTED","ip": "1.128.0.0","caller": "-","user": "-","requestTime": "25/Jul/2023:16:26:02 +0000","eventType": "CONNECT","routeKey": "$connect","status": "500","connectionId": "REDACTED"} +{"requestId": "177a5660-9b20-4614-b620-51dd4d56fb4c","ip": "1.128.0.0","caller": "-","user": "-","requestTime": "19/Jul/2023:16:17:17 +0000","eventType": "-","routeKey": "-","status": "403","connectionId": "-"} +{"requestId":"Iq9gwFDNoAMFo1A=","ip":"1.128.0.0","caller":"-","user":"-","requestTime":"26/Jul/2023:12:20:46 +0000","eventType":"CONNECT","routeKey":"$connect","status":"500","connectionId":"Iq8gj1UmIAMCKpA=","apiId":"z1ctxygne5","stage":"production","domainName":"z1ctxygne5.execute-api.us-east-1.amazonaws.com"} +{"requestId":"Iq9gjE_aIAMFZTg=","ip":"1.128.0.0","caller":"-","user":"-","requestTime":"26/Jul/2023:12:20:44 +0000","eventType":"CONNECT","routeKey":"$connect","status":"500","connectionId":"Iq8gj1UmIAMCKpA=","apiId":"z1ctxygne5","stage":"production","domainName":"z1ctxygne5.execute-api.us-east-1.amazonaws.com"} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log-expected.json b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log-expected.json new file mode 100644 index 00000000000..ba720fad1b2 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-apigateway-websocket.log-expected.json @@ -0,0 +1,106 @@ +{ + "expected": [ + { + "aws": { + "apigateway": { + "caller": "-", + "connection_id": "REDACTED", + "event_type": "CONNECT", + "ip_address": "1.128.0.0", + "request_id": "REDACTED", + "request_time": "2023-07-25T16:26:02.000Z", + "route_key": "$connect", + "status": 500, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"REDACTED\",\"ip\": \"1.128.0.0\",\"caller\": \"-\",\"user\": \"-\",\"requestTime\": \"25/Jul/2023:16:26:02 +0000\",\"eventType\": \"CONNECT\",\"routeKey\": \"$connect\",\"status\": \"500\",\"connectionId\": \"REDACTED\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "caller": "-", + "connection_id": "-", + "event_type": "-", + "ip_address": "1.128.0.0", + "request_id": "177a5660-9b20-4614-b620-51dd4d56fb4c", + "request_time": "2023-07-19T16:17:17.000Z", + "route_key": "-", + "status": 403, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\": \"177a5660-9b20-4614-b620-51dd4d56fb4c\",\"ip\": \"1.128.0.0\",\"caller\": \"-\",\"user\": \"-\",\"requestTime\": \"19/Jul/2023:16:17:17 +0000\",\"eventType\": \"-\",\"routeKey\": \"-\",\"status\": \"403\",\"connectionId\": \"-\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "z1ctxygne5", + "caller": "-", + "connection_id": "Iq8gj1UmIAMCKpA=", + "domain_name": "z1ctxygne5.execute-api.us-east-1.amazonaws.com", + "event_type": "CONNECT", + "ip_address": "1.128.0.0", + "request_id": "Iq9gwFDNoAMFo1A=", + "request_time": "2023-07-26T12:20:46.000Z", + "route_key": "$connect", + "stage": "production", + "status": 500, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"Iq9gwFDNoAMFo1A=\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:20:46 +0000\",\"eventType\":\"CONNECT\",\"routeKey\":\"$connect\",\"status\":\"500\",\"connectionId\":\"Iq8gj1UmIAMCKpA=\",\"apiId\":\"z1ctxygne5\",\"stage\":\"production\",\"domainName\":\"z1ctxygne5.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "aws": { + "apigateway": { + "api_id": "z1ctxygne5", + "caller": "-", + "connection_id": "Iq8gj1UmIAMCKpA=", + "domain_name": "z1ctxygne5.execute-api.us-east-1.amazonaws.com", + "event_type": "CONNECT", + "ip_address": "1.128.0.0", + "request_id": "Iq9gjE_aIAMFZTg=", + "request_time": "2023-07-26T12:20:44.000Z", + "route_key": "$connect", + "stage": "production", + "status": 500, + "user": "-" + } + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "{\"requestId\":\"Iq9gjE_aIAMFZTg=\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:20:44 +0000\",\"eventType\":\"CONNECT\",\"routeKey\":\"$connect\",\"status\":\"500\",\"connectionId\":\"Iq8gj1UmIAMCKpA=\",\"apiId\":\"z1ctxygne5\",\"stage\":\"production\",\"domainName\":\"z1ctxygne5.execute-api.us-east-1.amazonaws.com\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-common-config.yml b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/aws/data_stream/apigateway_logs/agent/stream/aws-cloudwatch.yml.hbs b/packages/aws/data_stream/apigateway_logs/agent/stream/aws-cloudwatch.yml.hbs new file mode 100644 index 00000000000..934f97a44c3 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/agent/stream/aws-cloudwatch.yml.hbs @@ -0,0 +1,100 @@ +{{#unless log_group_name}} +{{#unless log_group_name_prefix}} +{{#if log_group_arn }} +log_group_arn: {{ log_group_arn }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +{{#unless log_group_name}} +{{#if log_group_name_prefix }} +log_group_name_prefix: {{ log_group_name_prefix }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +{{#unless log_group_name_prefix}} +{{#if log_group_name }} +log_group_name: {{ log_group_name }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +region_name: {{ region_name }} +{{/unless}} + +{{#unless log_stream_prefix}} +{{#if log_streams }} +log_streams: {{ log_streams }} +{{/if}} +{{/unless}} + +{{#unless log_streams}} +{{#if log_stream_prefix }} +log_stream_prefix: {{ log_stream_prefix }} +{{/if}} +{{/unless}} + +{{#if start_position }} +start_position: {{ start_position }} +{{/if}} + +{{#if scan_frequency }} +scan_frequency: {{ scan_frequency }} +{{/if}} + +{{#if api_sleep }} +api_sleep: {{ api_sleep }} +{{/if}} + +{{#if latency }} +latency: {{ latency }} +{{/if}} +{{#if number_of_workers }} +number_of_workers: {{ number_of_workers }} +{{/if}} + +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if proxy_url }} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/aws/data_stream/apigateway_logs/agent/stream/aws-s3.yml.hbs b/packages/aws/data_stream/apigateway_logs/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..dfdf91c9e58 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,72 @@ +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} + +{{/if}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url }} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/apigateway_logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..18b911d11cc --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,98 @@ +--- +description: "Pipeline for API Gateway logs in CloudWatch" + +processors: + - set: + field: ecs.version + value: '8.0.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' + - json: + field: event.original + target_field: aws.apigateway + ignore_failure: true + - rename: + field: aws.apigateway.requestId + target_field: aws.apigateway.request_id + ignore_missing: true + - rename: + field: aws.apigateway.responseLength + target_field: aws.apigateway.response_length + ignore_missing: true + - rename: + field: aws.apigateway.requestTime + target_field: aws.apigateway.request_time + ignore_missing: true + - rename: + field: aws.apigateway.httpMethod + target_field: aws.apigateway.http_method + ignore_missing: true + - rename: + field: aws.apigateway.routeKey + target_field: aws.apigateway.route_key + ignore_missing: true + - rename: + field: aws.apigateway.ip + target_field: aws.apigateway.ip_address + ignore_missing: true + - rename: + field: aws.apigateway.resourcePath + target_field: aws.apigateway.resource_path + ignore_missing: true + - rename: + field: aws.apigateway.connectionId + target_field: aws.apigateway.connection_id + ignore_missing: true + - rename: + field: aws.apigateway.eventType + target_field: aws.apigateway.event_type + ignore_missing: true + - rename: + field: aws.apigateway.apiId + target_field: aws.apigateway.api_id + ignore_missing: true + - rename: + field: aws.apigateway.domainName + target_field: aws.apigateway.domain_name + ignore_missing: true + - grok: + field: aws.apigateway.ip_address + patterns: + - '%{IPORHOST:aws.apigateway.ip_address}' + ignore_failure: true + - convert: + field: aws.apigateway.ip_address + type: ip + ignore_missing: true + - convert: + field: aws.apigateway.response_length + type: long + ignore_missing: true + - convert: + field: aws.apigateway.status + type: long + ignore_missing: true + - remove: + field: event.original + if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true + - date: + field: aws.apigateway.request_time + target_field: "aws.apigateway.request_time" + formats: + - dd/MMM/yyyy:H:m:s Z + ignore_failure: true +on_failure: + - set: + field: 'error.message' + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/aws/data_stream/apigateway_logs/fields/agent.yml b/packages/aws/data_stream/apigateway_logs/fields/agent.yml new file mode 100644 index 00000000000..13e13903cc4 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/fields/agent.yml @@ -0,0 +1,35 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/aws/data_stream/apigateway_logs/fields/base-fields.yml b/packages/aws/data_stream/apigateway_logs/fields/base-fields.yml new file mode 100644 index 00000000000..258138e694e --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: aws +- name: event.dataset + type: constant_keyword + description: Event dataset + value: aws.apigateway_logs diff --git a/packages/aws/data_stream/apigateway_logs/fields/ecs.yml b/packages/aws/data_stream/apigateway_logs/fields/ecs.yml new file mode 100644 index 00000000000..89d1713b818 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/fields/ecs.yml @@ -0,0 +1,58 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: message +- external: ecs + name: tags +- external: ecs + name: host.architecture +- external: ecs + name: host.domain +- external: ecs + name: host.hostname +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: host.os.family +- external: ecs + name: host.os.kernel +- external: ecs + name: host.os.name +- external: ecs + name: host.os.platform +- external: ecs + name: host.os.version +- external: ecs + name: host.type +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.instance.name +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: cloud.project.id +- external: ecs + name: container.id +- external: ecs + name: container.image.name +- external: ecs + name: container.labels +- external: ecs + name: container.name diff --git a/packages/aws/data_stream/apigateway_logs/fields/fields.yml b/packages/aws/data_stream/apigateway_logs/fields/fields.yml new file mode 100644 index 00000000000..26557e30116 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/fields/fields.yml @@ -0,0 +1,86 @@ +- name: aws.s3 + type: group + fields: + - name: bucket.name + type: keyword + description: | + Name of a S3 bucket. + - name: bucket.arn + type: keyword + description: | + ARN of the S3 bucket that this log retrieved from. + - name: object.key + type: keyword + description: | + Name of the S3 object that this log retrieved from. + - name: metadata + type: flattened + description: | + AWS S3 object metadata values. +- name: aws.apigateway + type: group + fields: + - name: ip_address + type: ip + description: | + The internet address of the requester. + - name: request_id + type: keyword + description: | + An ID for the request. Clients can override this request ID. + - name: http_method + type: keyword + description: | + The HTTP method used. Valid values include: DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT. + - name: protocol + type: keyword + description: | + API Gateway APIs can accept HTTP/2 requests, but API Gateway sends requests to backend integrations using HTTP/1.1. + - name: request_time + type: date + description: | + The CLF-formatted request time (dd/MMM/yyyy:HH:mm:ss +-hhmm). + - name: response_length + type: long + description: | + The response payload length in bytes. + - name: route_key + type: keyword + description: | + The selected route key. + - name: status + type: long + description: | + The response status. + - name: caller + type: keyword + description: | + The principal identifier of the caller making the request. + - name: user + type: keyword + description: | + The principal identifier of the user making the request. + - name: resource_path + type: keyword + description: | + The path to your resource. + - name: connection_id + type: keyword + description: | + A unique ID for the connection that can be used to make a callback to the client. + - name: event_type + type: keyword + description: | + The event type: CONNECT, MESSAGE, or DISCONNECT. + - name: api_id + type: keyword + description: | + The identifier API Gateway assigns to your API. + - name: domain_name + type: keyword + description: | + The full domain name used to invoke the API. + - name: stage + type: keyword + description: | + The deployment stage of the API call (for example, beta or prod). \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_logs/manifest.yml b/packages/aws/data_stream/apigateway_logs/manifest.yml new file mode 100644 index 00000000000..9a46702de0d --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/manifest.yml @@ -0,0 +1,227 @@ +title: AWS API Gateway logs +type: logs +streams: + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: AWS API Gateway Logs via S3 + description: Collect AWS API Gateway logs using S3 input + enabled: false + vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is off. URL of the AWS SQS queue that messages will be received from. + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: false + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: false + default: 1m + description: "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s." + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: false + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: visibility_timeout + type: text + title: "[SQS] Visibility Timeout" + multi: false + required: false + show_user: false + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + - name: api_timeout + type: text + title: "[SQS] API Timeout" + multi: false + required: false + show_user: false + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + - name: max_number_of_messages + type: integer + title: "[SQS] Maximum Concurrent SQS Messages" + description: The maximum number of SQS messages that can be inflight at any time. + default: 5 + required: false + show_user: false + - name: fips_enabled + type: bool + title: Enable S3 FIPS + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - aws-apigateway-logs + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - input: aws-cloudwatch + template_path: aws-cloudwatch.yml.hbs + title: AWS API Gateway Logs via CloudWatch + description: Collect AWS API Gateway logs using CloudWatch input. + vars: + - name: log_group_arn + type: text + title: Log Group ARN + multi: false + required: false + show_user: true + description: ARN of the log group to collect logs from. + - name: log_group_name + type: text + title: Log Group Name + multi: false + required: false + show_user: false + description: Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given. + - name: log_group_name_prefix + type: text + title: Log Group Name Prefix + multi: false + required: false + show_user: false + description: The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time. + - name: region_name + type: text + title: Region Name + multi: false + required: false + show_user: false + description: Region that the specified log group or log group prefix belongs to. + - name: log_streams + type: text + title: Log Streams + multi: true + required: false + show_user: false + description: A list of strings of log streams names that Filebeat collect log events from. + - name: log_stream_prefix + type: text + title: Log Stream Prefix + multi: false + required: false + show_user: false + description: A string to filter the results to include only log events from log streams that have names starting with this prefix. + - name: start_position + type: text + title: Start Position + multi: false + required: false + default: beginning + show_user: true + description: Allows user to specify if this input should read log files from the beginning or from the end. + - name: scan_frequency + type: text + title: Scan Frequency + multi: false + required: false + show_user: false + default: 1m + description: This config parameter sets how often Filebeat checks for new log events from the specified log group. + - name: api_timeput + type: text + title: API Timeout + multi: false + required: false + show_user: false + default: 120s + description: The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted. + - name: api_sleep + type: text + title: API Sleep + multi: false + required: false + show_user: false + default: 200ms + description: This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account. + - name: latency + type: text + title: Latency + multi: false + required: false + show_user: false + description: "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago." + - name: number_of_workers + type: integer + title: Number of workers + required: false + show_user: false + description: The number of workers assigned to reading from log groups. Each worker will read log events from one of the log groups matching `log_group_name_prefix`. For example, if `log_group_name_prefix` matches five log groups, then `number_of_workers` should be set to `5`. The default value is `1`. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - aws-apigateway-logs + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false diff --git a/packages/aws/data_stream/apigateway_logs/sample_event.json b/packages/aws/data_stream/apigateway_logs/sample_event.json new file mode 100644 index 00000000000..99e20527650 --- /dev/null +++ b/packages/aws/data_stream/apigateway_logs/sample_event.json @@ -0,0 +1,24 @@ +{ + "data_stream": { + "namespace": "default", + "type": "logs", + "dataset": "aws.apigateway_logs" + }, + "@timestamp": "2020-02-20T07:01:01.000Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "ingested": "2021-07-19T21:47:04.871450600Z", + "original": "2020-02-20T07:01:01.000Z Feb 20 07:01:01 ip-172-31-81-156 systemd: Stopping User Slice of root." + }, + "aws": { + "apigateway": { + "ip_address": "172.31.81.156" + } + }, + "message": "Stopping User Slice of root.", + "tags": [ + "preserve_original_event" + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/apigateway_metrics/fields/ecs.yml b/packages/aws/data_stream/apigateway_metrics/fields/ecs.yml index 20f154e37bd..8e6c369edfc 100644 --- a/packages/aws/data_stream/apigateway_metrics/fields/ecs.yml +++ b/packages/aws/data_stream/apigateway_metrics/fields/ecs.yml @@ -2,6 +2,7 @@ name: cloud - external: ecs name: cloud.account.id + dimension: true - external: ecs name: cloud.account.name - external: ecs @@ -14,6 +15,7 @@ name: cloud.provider - external: ecs name: cloud.region + dimension: true - external: ecs name: ecs.version - external: ecs @@ -60,3 +62,6 @@ name: container.labels - external: ecs name: container.name +- name: agent.id + external: ecs + dimension: true diff --git a/packages/aws/data_stream/apigateway_metrics/fields/fields.yml b/packages/aws/data_stream/apigateway_metrics/fields/fields.yml index 680d3e6b685..225cd9522ab 100644 --- a/packages/aws/data_stream/apigateway_metrics/fields/fields.yml +++ b/packages/aws/data_stream/apigateway_metrics/fields/fields.yml @@ -10,23 +10,23 @@ - name: 4XXError.sum type: long description: The number of client-side errors captured in a given period. - metric_type: counter + metric_type: gauge - name: 4xx.sum type: long description: The number of client-side errors captured in a given period. - metric_type: counter + metric_type: gauge - name: 5XXError.sum type: long description: The number of server-side errors captured in a given period. - metric_type: counter + metric_type: gauge - name: 5xx.sum type: long description: The number of server-side errors captured in a given period. - metric_type: counter + metric_type: gauge - name: Count.sum type: long description: The total number API requests in a given period. - metric_type: counter + metric_type: gauge - name: IntegrationLatency.avg type: long description: The time between when API Gateway relays a request to the backend and when it receives a response from the backend. @@ -45,55 +45,61 @@ - name: CacheHitCount.sum type: long description: The number of requests served from the API cache in a given period. - metric_type: counter + metric_type: gauge - name: CacheMissCount.sum type: long description: The number of requests served from the backend in a given period, when API caching is enabled. - metric_type: counter + metric_type: gauge - name: Count.sum type: long description: The total number of API requests in a given period. - metric_type: counter + metric_type: gauge - name: ConnectCount.sum type: long description: The number of messages sent to the connect route integration. - metric_type: counter + metric_type: gauge - name: MessageCount.sum type: long description: The number of messages sent to the WebSocket API, either from or to the client. - metric_type: counter + metric_type: gauge - name: IntegrationError.sum type: long description: The number of requests that return a 4XX/5XX response from the integration. - metric_type: counter + metric_type: gauge - name: ClientError.sum type: long description: The number of requests that have a 4XX response returned by API Gateway before the integration is invoked. - metric_type: counter + metric_type: gauge - name: ExecutionError.sum type: long description: Errors that occurred when calling the integration. - metric_type: counter + metric_type: gauge - name: dimensions type: group fields: - name: ApiId type: keyword + dimension: true description: Each API created in API Gateway is assigned a unique ApiId, which is used to distinguish and reference that specific API within the system. - name: Stage type: keyword + dimension: true description: It represents a specific version of the API that is accessible to clients. A stage allows you to manage different environments or versions of your API, such as development, testing, and production. - name: Route type: keyword + dimension: true description: Routes define the path and HTTP methods that clients can use to access different functionalities of the API. - name: ApiName type: keyword + dimension: true description: It represents a human-readable name that helps identify and differentiate the API within the API Gateway service. - name: Method type: keyword + dimension: true description: It represents the HTTP method which defines the action that can be performed on a resource, such as retrieving, creating, updating, or deleting data. - name: Resource type: keyword + dimension: true description: It represents an endpoint within the API that corresponds to a specific functionality, typically associated with a URL path segment. - name: cloudwatch type: group diff --git a/packages/aws/data_stream/apigateway_metrics/manifest.yml b/packages/aws/data_stream/apigateway_metrics/manifest.yml index 349ed1ee8c2..73dda6a92ba 100644 --- a/packages/aws/data_stream/apigateway_metrics/manifest.yml +++ b/packages/aws/data_stream/apigateway_metrics/manifest.yml @@ -1,5 +1,7 @@ title: AWS API Gateway metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/billing/manifest.yml b/packages/aws/data_stream/billing/manifest.yml index 4684f7d3c85..0dd00eb98f8 100644 --- a/packages/aws/data_stream/billing/manifest.yml +++ b/packages/aws/data_stream/billing/manifest.yml @@ -1,7 +1,5 @@ title: AWS Billing Metrics type: metrics -elasticsearch: - index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/cloudtrail/agent/stream/aws-s3.yml.hbs b/packages/aws/data_stream/cloudtrail/agent/stream/aws-s3.yml.hbs index 39d17cc88ef..b54c36bb530 100644 --- a/packages/aws/data_stream/cloudtrail/agent/stream/aws-s3.yml.hbs +++ b/packages/aws/data_stream/cloudtrail/agent/stream/aws-s3.yml.hbs @@ -1,4 +1,35 @@ +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} queue_url: {{queue_url}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} + +{{/if}} + file_selectors: {{#if cloudtrail_regex}} - regex: {{cloudtrail_regex}} @@ -18,15 +49,8 @@ credential_profile_name: {{credential_profile_name}} {{#if shared_credential_file}} shared_credential_file: {{shared_credential_file}} {{/if}} -{{#if visibility_timeout}} -visibility_timeout: {{visibility_timeout}} -{{/if}} -{{#if api_timeout}} -api_timeout: {{api_timeout}} -{{/if}} -{{#if max_number_of_messages}} -max_number_of_messages: {{max_number_of_messages}} -{{/if}} + + {{#if default_region}} default_region: {{default_region}} {{/if}} diff --git a/packages/aws/data_stream/cloudtrail/fields/fields.yml b/packages/aws/data_stream/cloudtrail/fields/fields.yml index 5b59153c9bf..68fbc0ee8ce 100644 --- a/packages/aws/data_stream/cloudtrail/fields/fields.yml +++ b/packages/aws/data_stream/cloudtrail/fields/fields.yml @@ -1,3 +1,22 @@ +- name: aws.s3 + type: group + fields: + - name: bucket.name + type: keyword + description: | + Name of a S3 bucket. + - name: bucket.arn + type: keyword + description: | + ARN of the S3 bucket that this log retrieved from. + - name: object.key + type: keyword + description: | + Name of the S3 object that this log retrieved from. + - name: metadata + type: flattened + description: | + AWS S3 object metadata values. - name: aws.cloudtrail type: group fields: diff --git a/packages/aws/data_stream/cloudtrail/manifest.yml b/packages/aws/data_stream/cloudtrail/manifest.yml index e6bd6a284ec..132031cfece 100644 --- a/packages/aws/data_stream/cloudtrail/manifest.yml +++ b/packages/aws/data_stream/cloudtrail/manifest.yml @@ -6,27 +6,65 @@ streams: title: AWS CloudTrail Logs description: Collect AWS CloudTrail logs using s3 input vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is off. URL of the AWS SQS queue that messages will be received from. + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: false + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: false + default: 1m + description: "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s." + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: false + default: 5 + description: Number of workers that will process the S3 objects listed. - name: visibility_timeout type: text - title: Visibility Timeout + title: "[SQS] Visibility Timeout" multi: false required: false show_user: false description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. - name: api_timeout type: text - title: API Timeout + title: "[SQS] API Timeout" multi: false required: false show_user: false description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. - - name: queue_url - type: text - title: Queue URL - multi: false - required: true - show_user: true - description: URL of the AWS SQS queue that messages will be received from. - name: fips_enabled type: bool title: Enable S3 FIPS @@ -89,7 +127,7 @@ streams: blank CloudTrail Insight logs will be skipped. - name: max_number_of_messages type: integer - title: Maximum Concurrent SQS Messages + title: "[SQS] Maximum Concurrent SQS Messages" description: The maximum number of SQS messages that can be inflight at any time. default: 5 required: false diff --git a/packages/aws/data_stream/cloudwatch_logs/agent/stream/aws-s3.yml.hbs b/packages/aws/data_stream/cloudwatch_logs/agent/stream/aws-s3.yml.hbs deleted file mode 100644 index 77fae5d0dc8..00000000000 --- a/packages/aws/data_stream/cloudwatch_logs/agent/stream/aws-s3.yml.hbs +++ /dev/null @@ -1,51 +0,0 @@ -queue_url: {{queue_url}} -{{#if credential_profile_name}} -credential_profile_name: {{credential_profile_name}} -{{/if}} -{{#if shared_credential_file}} -shared_credential_file: {{shared_credential_file}} -{{/if}} -{{#if visibility_timeout}} -visibility_timeout: {{visibility_timeout}} -{{/if}} -{{#if api_timeout}} -api_timeout: {{api_timeout}} -{{/if}} -{{#if max_number_of_messages}} -max_number_of_messages: {{max_number_of_messages}} -{{/if}} -{{#if default_region}} -default_region: {{default_region}} -{{/if}} -{{#if access_key_id}} -access_key_id: {{access_key_id}} -{{/if}} -{{#if secret_access_key}} -secret_access_key: {{secret_access_key}} -{{/if}} -{{#if session_token}} -session_token: {{session_token}} -{{/if}} -{{#if role_arn}} -role_arn: {{role_arn}} -{{/if}} -{{#if fips_enabled}} -fips_enabled: {{fips_enabled}} -{{/if}} -{{#if proxy_url }} -proxy_url: {{proxy_url}} -{{/if}} -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} \ No newline at end of file diff --git a/packages/aws/data_stream/cloudwatch_logs/manifest.yml b/packages/aws/data_stream/cloudwatch_logs/manifest.yml index 2eb4e4266e5..80391fbb4d9 100644 --- a/packages/aws/data_stream/cloudwatch_logs/manifest.yml +++ b/packages/aws/data_stream/cloudwatch_logs/manifest.yml @@ -1,74 +1,6 @@ title: AWS CloudWatch logs type: logs streams: - - input: aws-s3 - template_path: aws-s3.yml.hbs - title: AWS CloudWatch logs via S3 (Deprecated) - enabled: false - description: (Deprecated) Please use Custom AWS Logs integration instead - vars: - - name: visibility_timeout - type: text - title: Visibility Timeout - multi: false - required: false - show_user: false - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. - - name: api_timeout - type: text - title: API Timeout - multi: false - required: false - show_user: false - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. - - name: queue_url - type: text - title: Queue URL - multi: false - required: true - show_user: true - description: URL of the AWS SQS queue that messages will be received from. - - name: fips_enabled - type: bool - title: Enable S3 FIPS - default: false - multi: false - required: false - show_user: false - description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - aws-cloudwatch-logs - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: max_number_of_messages - type: integer - title: Maximum Concurrent SQS Messages - description: The maximum number of SQS messages that can be inflight at any time. - default: 5 - required: false - show_user: false - input: aws-cloudwatch enabled: false template_path: aws-cloudwatch.yml.hbs diff --git a/packages/aws/data_stream/cloudwatch_metrics/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/cloudwatch_metrics/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..8da84149a46 --- /dev/null +++ b/packages/aws/data_stream/cloudwatch_metrics/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,11 @@ +--- +description: "Pipeline for AWS CloudWatch metrics" +processors: + - fingerprint: + fields: ["aws.dimensions"] + target_field: 'aws.dimensions.fingerprint' + ignore_missing: true +on_failure: + - set: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/aws/data_stream/cloudwatch_metrics/fields/ecs.yml b/packages/aws/data_stream/cloudwatch_metrics/fields/ecs.yml index 20f154e37bd..8e6c369edfc 100644 --- a/packages/aws/data_stream/cloudwatch_metrics/fields/ecs.yml +++ b/packages/aws/data_stream/cloudwatch_metrics/fields/ecs.yml @@ -2,6 +2,7 @@ name: cloud - external: ecs name: cloud.account.id + dimension: true - external: ecs name: cloud.account.name - external: ecs @@ -14,6 +15,7 @@ name: cloud.provider - external: ecs name: cloud.region + dimension: true - external: ecs name: ecs.version - external: ecs @@ -60,3 +62,6 @@ name: container.labels - external: ecs name: container.name +- name: agent.id + external: ecs + dimension: true diff --git a/packages/aws/data_stream/cloudwatch_metrics/fields/package-fields.yml b/packages/aws/data_stream/cloudwatch_metrics/fields/package-fields.yml index a8a7ee8dcce..d8459a124e4 100644 --- a/packages/aws/data_stream/cloudwatch_metrics/fields/package-fields.yml +++ b/packages/aws/data_stream/cloudwatch_metrics/fields/package-fields.yml @@ -5,15 +5,19 @@ type: object description: | Tag key value pairs from aws resources. - - name: s3.bucket.name - type: keyword - description: | - Name of a S3 bucket. - name: dimensions.* type: object description: | Metric dimensions. - - name: '*.metrics.*.*' - type: object + - name: dimensions.fingerprint + type: keyword description: | - Metrics that returned from Cloudwatch API query. + Autogenerated ID representing the fingerprint of the aws.dimensions object + dimension: true +- name: 'aws.*.metrics.*.*' + type: object + object_type: double + object_type_mapping_type: "*" + metric_type: gauge + description: | + Metrics that returned from Cloudwatch API query. diff --git a/packages/aws/data_stream/cloudwatch_metrics/manifest.yml b/packages/aws/data_stream/cloudwatch_metrics/manifest.yml index 9e45991ba68..a18e5da0e77 100644 --- a/packages/aws/data_stream/cloudwatch_metrics/manifest.yml +++ b/packages/aws/data_stream/cloudwatch_metrics/manifest.yml @@ -1,5 +1,7 @@ title: AWS CloudWatch metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics enabled: false diff --git a/packages/aws/data_stream/ec2_metrics/fields/ecs.yml b/packages/aws/data_stream/ec2_metrics/fields/ecs.yml index a70d08feee0..3126856d0a4 100644 --- a/packages/aws/data_stream/ec2_metrics/fields/ecs.yml +++ b/packages/aws/data_stream/ec2_metrics/fields/ecs.yml @@ -2,6 +2,7 @@ name: cloud - external: ecs name: cloud.account.id + dimension: true - external: ecs name: cloud.account.name - external: ecs @@ -14,6 +15,7 @@ name: cloud.provider - external: ecs name: cloud.region + dimension: true - external: ecs name: ecs.version - external: ecs @@ -36,3 +38,6 @@ name: host.network.ingress.bytes - external: ecs name: host.network.ingress.packets +- name: agent.id + external: ecs + dimension: true diff --git a/packages/aws/data_stream/ec2_metrics/fields/fields.yml b/packages/aws/data_stream/ec2_metrics/fields/fields.yml index d051d8ac5e7..834a283a93f 100644 --- a/packages/aws/data_stream/ec2_metrics/fields/fields.yml +++ b/packages/aws/data_stream/ec2_metrics/fields/fields.yml @@ -6,79 +6,146 @@ fields: - name: AutoScalingGroupName type: keyword + dimension: true description: An Auto Scaling group is a collection of instances you define if you're using Auto Scaling. - name: ImageId type: keyword + dimension: true description: This dimension filters the data you request for all instances running this Amazon EC2 Amazon Machine Image (AMI) - name: InstanceId type: keyword + dimension: true description: Amazon EC2 instance ID - name: InstanceType type: keyword + dimension: true description: This dimension filters the data you request for all instances running with this specified instance type. - name: ec2 type: group fields: - - name: cpu.credit_usage - type: long - description: | - The number of CPU credits spent by the instance for CPU utilization. - - name: cpu.credit_balance - type: long - description: | - The number of earned CPU credits that an instance has accrued since it was launched or started. - - name: cpu.surplus_credit_balance - type: long - description: | - The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero. - - name: cpu.surplus_credits_charged - type: long - description: | - The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge. - - name: network.in.packets_per_sec - type: long - description: | - The number of packets per second sent out on all network interfaces by the instance. - - name: network.out.packets_per_sec - type: long - description: | - The number of packets per second sent out on all network interfaces by the instance. - - name: network.in.bytes_per_sec - type: long - description: | - The number of bytes per second received on all network interfaces by the instance. - - name: network.out.bytes_per_sec - type: long - description: | - The number of bytes per second sent out on all network interfaces by the instance. - - name: diskio.read.bytes_per_sec - type: long - description: | - Bytes read per second from all instance store volumes available to the instance. - - name: diskio.write.bytes_per_sec - type: long - description: | - Bytes written per second to all instance store volumes available to the instance. - - name: diskio.read.count_per_sec - type: long - description: | - Completed read operations per second from all instance store volumes available to the instance in a specified period of time. - - name: diskio.write.count_per_sec - type: long - description: | - Completed write operations per second to all instance store volumes available to the instance in a specified period of time. - - name: status.check_failed - type: long - description: | - Reports whether the instance has passed both the instance status check and the system status check in the last minute. - - name: status.check_failed_system - type: long - description: | - Reports whether the instance has passed the system status check in the last minute. - - name: status.check_failed_instance - type: long - description: | - Reports whether the instance has passed the instance status check in the last minute. + - name: metrics + type: group + fields: + - name: CPUCreditUsage.avg + type: long + metric_type: gauge + description: | + The number of CPU credits spent by the instance for CPU utilization. + - name: CPUCreditBalance.avg + type: long + metric_type: gauge + description: | + The number of earned CPU credits that an instance has accrued since it was launched or started. + - name: CPUSurplusCreditBalance.avg + type: long + metric_type: gauge + description: | + The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero. + - name: CPUSurplusCreditsCharged.avg + type: long + metric_type: gauge + description: | + The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge. + - name: CPUUtilization.avg + type: long + metric_type: gauge + description: | + The average percentage of physical CPU time that Amazon EC2 uses to run the EC2 instance. + - name: NetworkPacketsIn.rate + type: long + metric_type: gauge + description: | + The number of packets per second sent out on all network interfaces by the instance. + - name: NetworkPacketsIn.sum + type: long + metric_type: gauge + description: | + The number of packets total sent out on all network interfaces by the instance. + - name: NetworkPacketsOut.rate + type: long + metric_type: gauge + description: | + The number of packets per second sent out on all network interfaces by the instance. + - name: NetworkPacketsOut.sum + type: long + metric_type: gauge + description: | + The number of packets total sent out on all network interfaces by the instance. + - name: NetworkIn.rate + type: long + metric_type: gauge + description: | + The number of bytes per second received on all network interfaces by the instance. + - name: NetworkIn.sum + type: long + metric_type: gauge + description: | + The number of bytes total received on all network interfaces by the instance. + - name: NetworkOut.rate + type: long + metric_type: gauge + description: | + The number of bytes per second sent out on all network interfaces by the instance. + - name: NetworkOut.sum + type: long + metric_type: gauge + description: | + The number of bytes total sent out on all network interfaces by the instance. + - name: DiskReadBytes.rate + type: long + metric_type: gauge + description: | + Bytes read per second from all instance store volumes available to the instance. + - name: DiskReadBytes.sum + type: long + metric_type: gauge + description: | + Total bytes read from all instance store volumes available to the instance. + - name: DiskWriteBytes.rate + type: long + metric_type: gauge + description: | + Bytes written per second to all instance store volumes available to the instance. + - name: DiskWriteBytes.sum + type: long + metric_type: gauge + description: | + Total bytes written to all instance store volumes available to the instance. + - name: DiskReadOps.rate + type: long + metric_type: gauge + description: | + Completed read operations per second from all instance store volumes available to the instance in a specified period of time. + - name: DiskReadOps.sum + type: long + metric_type: gauge + description: | + Total completed read operations from all instance store volumes available to the instance in a specified period of time. + - name: DiskWriteOps.rate + type: long + metric_type: gauge + description: | + Completed write operations per second to all instance store volumes available to the instance in a specified period of time. + - name: DiskWriteOps.sum + type: long + metric_type: gauge + description: | + Total completed write operations to all instance store volumes available to the instance in a specified period of time. + - name: StatusCheckFailed.avg + type: long + metric_type: gauge + description: | + Reports whether the instance has passed both the instance status check and the system status check in the last minute. + - name: StatusCheckFailed_System.avg + type: long + metric_type: gauge + description: | + Reports whether the instance has passed the system status check in the last minute. + - name: StatusCheckFailed_Instance.avg + type: long + metric_type: gauge + description: | + Reports whether the instance has passed the instance status check in the last minute. - name: instance.core.count type: integer description: | diff --git a/packages/aws/data_stream/ec2_metrics/fields/package-fields.yml b/packages/aws/data_stream/ec2_metrics/fields/package-fields.yml index 888286fa7ab..7d6aebd7964 100644 --- a/packages/aws/data_stream/ec2_metrics/fields/package-fields.yml +++ b/packages/aws/data_stream/ec2_metrics/fields/package-fields.yml @@ -9,7 +9,3 @@ type: keyword description: | Name of a S3 bucket. - - name: '*.metrics.*.*' - type: object - description: | - Metrics that returned from Cloudwatch API query. diff --git a/packages/aws/data_stream/ec2_metrics/manifest.yml b/packages/aws/data_stream/ec2_metrics/manifest.yml index 1e4ca21c1c3..c3e00bc017e 100644 --- a/packages/aws/data_stream/ec2_metrics/manifest.yml +++ b/packages/aws/data_stream/ec2_metrics/manifest.yml @@ -1,5 +1,7 @@ title: AWS EC2 metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/ec2_metrics/sample_event.json b/packages/aws/data_stream/ec2_metrics/sample_event.json index e36f596d510..050d1461100 100644 --- a/packages/aws/data_stream/ec2_metrics/sample_event.json +++ b/packages/aws/data_stream/ec2_metrics/sample_event.json @@ -1,33 +1,27 @@ { - "@timestamp": "2022-05-26T12:40:00.000Z", - "agent": { - "name": "docker-fleet-agent", - "id": "24d50340-a9d0-4d5d-9f42-fe9cb4b8c95d", - "type": "metricbeat", - "ephemeral_id": "f8282deb-ebc7-4d1f-9386-207f56657244", - "version": "8.2.0" - }, - "elastic_agent": { - "id": "24d50340-a9d0-4d5d-9f42-fe9cb4b8c95d", - "version": "8.2.0", - "snapshot": false - }, + "@timestamp": "2023-08-07T18:35:00.000Z", "cloud": { - "availability_zone": "us-east-1c", + "availability_zone": "eu-north-1c", "instance": { - "name": "elastic-package-test-33138", - "id": "i-0de58890d94dda2e3" + "id": "i-0c08512debca266ab" }, "provider": "aws", "machine": { - "type": "t1.micro" + "type": "t3.medium" }, - "region": "us-east-1", + "region": "eu-north-1", "account": { - "name": "elastic-beats", - "id": "428152502467" + "name": "MonitoringAccount", + "id": "627286350134" } }, + "agent": { + "name": "docker-fleet-agent", + "id": "72314f01-98f2-477f-978a-e98d109c640c", + "type": "metricbeat", + "ephemeral_id": "b8cd4414-f528-43f4-b43f-0edbcc69b46f", + "version": "8.8.1" + }, "ecs": { "version": "8.0.0" }, @@ -41,107 +35,121 @@ }, "host": { "hostname": "docker-fleet-agent", - "disk": { - "read": { - "bytes": 0 - }, - "write": { - "bytes": 0 - } - }, "os": { - "kernel": "5.10.47-linuxkit", + "kernel": "5.15.49-linuxkit-pr", "codename": "focal", "name": "Ubuntu", "type": "linux", "family": "debian", - "version": "20.04.4 LTS (Focal Fossa)", + "version": "20.04.6 LTS (Focal Fossa)", "platform": "ubuntu" }, - "containerized": true, + "containerized": false, "ip": [ - "192.168.80.7" + "172.20.0.7" ], - "name": "elastic-package-test-33138", + "name": "docker-fleet-agent", "cpu": { - "usage": 0.08265027322397175 + "usage": 2.8849988898518673 }, - "id": "i-0de58890d94dda2e3", + "id": "d08b346fbb8f49f5a2bb1a477f8ceb54", "mac": [ - "02:42:c0:a8:50:07" + "02-42-AC-14-00-07" ], - "architecture": "x86_64", + "architecture": "aarch64", "network": { "ingress": { - "bytes": 1992 + "bytes": 1608959, + "packets": 5334 }, "egress": { - "bytes": 1800 + "bytes": 626755, + "packets": 4977 } } }, + "elastic_agent": { + "id": "72314f01-98f2-477f-978a-e98d109c640c", + "version": "8.8.1", + "snapshot": false + }, "metricset": { "period": 300000, "name": "cloudwatch" }, "event": { - "duration": 15936070000, + "duration": 5858967919, "agent_id_status": "verified", - "ingested": "2022-05-26T12:44:52Z", + "ingested": "2023-08-07T18:41:31Z", "module": "aws", "dataset": "aws.ec2_metrics" }, "aws": { "ec2": { - "diskio": { - "read": { - "count_per_sec": 0, - "bytes_per_sec": 0 - }, - "write": { - "count_per_sec": 0, - "bytes_per_sec": 0 - } - }, "instance": { "image": { - "id": "ami-0ff900168d0231cd3" + "id": "ami-00b8290583a865359" }, "core": { "count": 1 }, "private": { - "ip": "172.31.16.45", - "dns_name": "ip-172-31-16-45.ec2.internal" + "ip": "172.31.13.154", + "dns_name": "ip-172-31-13-154.eu-north-1.compute.internal" }, - "threads_per_core": 1, + "threads_per_core": 2, "public": { - "ip": "54.90.153.147", - "dns_name": "ec2-54-90-153-147.compute-1.amazonaws.com" + "ip": "16.16.138.5", + "dns_name": "ec2-16-16-138-5.eu-north-1.compute.amazonaws.com" }, "state": { "code": 16, "name": "running" }, "monitoring": { - "state": "enabled" + "state": "disabled" } }, - "cpu": { - "credit_balance": 144, - "credit_usage": 0.004121 - }, - "status": { - "check_failed": 0, - "check_failed_instance": 0, - "check_failed_system": 0 - }, - "network": { - "in": { - "bytes_per_sec": 33.2 + "metrics": { + "NetworkOut": { + "rate": 10445.916666666666, + "sum": 626755 + }, + "CPUUtilization": { + "avg": 2.8849988898518673 + }, + "StatusCheckFailed_Instance": { + "avg": 0 + }, + "CPUCreditUsage": { + "avg": 0.29100543333333334 + }, + "CPUCreditBalance": { + "avg": 576 + }, + "NetworkPacketsOut": { + "rate": 82.95, + "sum": 4977 + }, + "NetworkPacketsIn": { + "rate": 88.9, + "sum": 5334 + }, + "NetworkIn": { + "rate": 26815.983333333334, + "sum": 1608959 + }, + "StatusCheckFailed": { + "avg": 0 + }, + "CPUSurplusCreditsCharged": { + "avg": 0 + }, + "CPUSurplusCreditBalance": { + "avg": 0 }, - "out": { - "bytes_per_sec": 30 + "StatusCheckFailed_System": { + "avg": 0 } } }, @@ -149,10 +157,12 @@ "namespace": "AWS/EC2" }, "dimensions": { - "InstanceId": "i-0de58890d94dda2e3" + "InstanceId": "i-0c08512debca266ab" }, "tags": { - "Name": "elastic-package-test-33138" + "aws:autoscaling:groupName": "eks-firehose-50c386d7-c8b1-bde8-5d42-d3841ca7ecfe", + "aws:ec2launchtemplate:version": "1", + "aws:ec2launchtemplate:id": "lt-09e1cdf590e35c687" } } } \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-common-config.yml b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..7780f71c7be --- /dev/null +++ b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,7 @@ +fields: + tags: + - preserve_original_event +multiline: + first_line_pattern: '^[0-9]' + negate: true + match: after \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log new file mode 100644 index 00000000000..c4c3d07ded6 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log @@ -0,0 +1,92 @@ +2023-06-26 13:45:49,685 INFO namenode.NameNode: STARTUP_MSG: +/************************************************************ +STARTUP_MSG: Starting NameNode +STARTUP_MSG: host = ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102 +STARTUP_MSG: args = [-format, -nonInteractive] +STARTUP_MSG: version = 3.3.3-amzn-3 +STARTUP_MSG: classpath = /etc/hadoop/conf:/usr/lib/hadoop/lib/jetty-security-9.4.48.v20220622.jar:/usr/lib/hadoop/lib/accessors-smart-2.4.7.jar:/usr/lib/hadoop/lib/jersey-core-1.19.jar:/usr/lib/hadoop/lib/animal-sniffer-annotations-1.17.jar +STARTUP_MSG: build = Unknown -r Unknown; compiled by 'release' on 2023-05-31T03:49Z +STARTUP_MSG: java = 1.8.0_372 +************************************************************/ +2023-06-26 13:45:49,697 INFO namenode.NameNode: registered UNIX signal handlers for [TERM, HUP, INT] +2023-06-26 13:45:49,823 INFO namenode.NameNode: createNameNode [-format, -nonInteractive] +2023-06-26 13:45:50,318 INFO common.Util: Assuming 'file' scheme for path /mnt/namenode in configuration. +2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt1/namenode in configuration. +2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt/namenode in configuration. +2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt1/namenode in configuration. +2023-06-26 13:45:50,330 INFO namenode.NameNode: Formatting using clusterid: CID-1b3b14b6-5518-47c3-b981-e5cb6b0ce38c +2023-06-26 13:45:50,394 INFO namenode.FSEditLog (main): Edit logging is async:true +2023-06-26 13:45:50,484 INFO namenode.FSNamesystem: KeyProvider: KeyProviderCryptoExtension: org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider@a530d0a +2023-06-26 13:45:50,486 INFO namenode.FSNamesystem: fsLock is fair: true +2023-06-26 13:45:50,486 INFO namenode.FSNamesystem: Detailed lock hold time metrics enabled: false +2023-06-26 13:45:50,492 INFO namenode.FSNamesystem: fsOwner = hdfs (auth:SIMPLE) +2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: supergroup = hdfsadmingroup +2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: isPermissionEnabled = true +2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: isStoragePolicyEnabled = true +2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: HA Enabled: false +2023-06-26 13:45:50,566 INFO common.Util: dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling +2023-06-26 13:45:50,601 INFO blockmanagement.DatanodeManager: dfs.block.invalidate.limit: configured=1000, counted=60, effected=1000 +2023-06-26 13:45:50,601 INFO blockmanagement.DatanodeManager: dfs.namenode.datanode.registration.ip-hostname-check=true +2023-06-26 13:45:50,610 INFO blockmanagement.BlockManager: dfs.namenode.startup.delay.block.deletion.sec is set to 000:00:00:00.000 +2023-06-26 13:45:50,611 INFO blockmanagement.BlockManager: The block deletion will start around 2023 Jun 26 13:45:50 +2023-06-26 13:45:50,612 INFO util.GSet: Computing capacity for map BlocksMap +2023-06-26 13:45:50,613 INFO util.GSet: VM type = 64-bit +2023-06-26 13:45:50,614 INFO util.GSet: 2.0% max memory 864 MB = 17.3 MB +2023-06-26 13:45:50,614 INFO util.GSet: capacity = 2^21 = 2097152 entries +2023-06-26 13:45:50,623 INFO blockmanagement.BlockManager: Storage policy satisfier is disabled +2023-06-26 13:45:50,623 INFO blockmanagement.BlockManager: dfs.block.access.token.enable = false +2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.threshold-pct = 0.999 +2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.min.datanodes = 0 +2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.extension = 5000 +2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: defaultReplication = 1 +2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: maxReplication = 512 +2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: minReplication = 1 +2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: maxReplicationStreams = 100 +2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: redundancyRecheckInterval = 3000ms +2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: encryptDataTransfer = false +2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: maxNumBlocksToLog = 1000 +2023-06-26 13:45:50,670 INFO namenode.FSDirectory: GLOBAL serial map: bits=29 maxEntries=536870911 +2023-06-26 13:45:50,671 INFO namenode.FSDirectory: USER serial map: bits=24 maxEntries=16777215 +2023-06-26 13:45:50,671 INFO namenode.FSDirectory: GROUP serial map: bits=24 maxEntries=16777215 +2023-06-26 13:45:50,671 INFO namenode.FSDirectory: XATTR serial map: bits=24 maxEntries=16777215 +2023-06-26 13:45:50,696 INFO util.GSet: Computing capacity for map INodeMap +2023-06-26 13:45:50,696 INFO util.GSet: VM type = 64-bit +2023-06-26 13:45:50,697 INFO util.GSet: 1.0% max memory 864 MB = 8.6 MB +2023-06-26 13:45:50,697 INFO util.GSet: capacity = 2^20 = 1048576 entries +2023-06-26 13:45:50,699 INFO namenode.FSDirectory: ACLs enabled? true +2023-06-26 13:45:50,699 INFO namenode.FSDirectory: POSIX ACL inheritance enabled? true +2023-06-26 13:45:50,699 INFO namenode.FSDirectory: XAttrs enabled? true +2023-06-26 13:45:50,700 INFO namenode.NameNode: Caching file names occurring more than 10 times +2023-06-26 13:45:50,708 INFO namenode.ReencryptionHandler: Configured throttleLimitHandlerRatio=1.0 for re-encryption +2023-06-26 13:45:50,717 INFO snapshot.SnapshotManager: Loaded config captureOpenFiles: false, skipCaptureAccessTimeOnlyChange: false, snapshotDiffAllowSnapRootDescendant: true, maxSnapshotLimit: 65536 +2023-06-26 13:45:50,720 INFO snapshot.SnapshotManager: SkipList is disabled +2023-06-26 13:45:50,748 INFO util.GSet: Computing capacity for map cachedBlocks +2023-06-26 13:45:50,748 INFO util.GSet: VM type = 64-bit +2023-06-26 13:45:50,748 INFO util.GSet: 0.25% max memory 864 MB = 2.2 MB +2023-06-26 13:45:50,749 INFO util.GSet: capacity = 2^18 = 262144 entries +2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.window.num.buckets = 10 +2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.num.users = 10 +2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.windows.minutes = 1,5,25 +2023-06-26 13:45:50,768 INFO namenode.FSNamesystem: Retry cache on namenode is enabled +2023-06-26 13:45:50,768 INFO namenode.FSNamesystem: Retry cache will use 0.03 of total heap and retry cache entry expiry time is 600000 millis +2023-06-26 13:45:50,771 INFO util.GSet: Computing capacity for map NameNodeRetryCache +2023-06-26 13:45:50,771 INFO util.GSet: VM type = 64-bit +2023-06-26 13:45:50,771 INFO util.GSet: 0.029999999329447746% max memory 864 MB = 265.4 KB +2023-06-26 13:45:50,771 INFO util.GSet: capacity = 2^15 = 32768 entries +2023-06-26 13:45:50,774 INFO namenode.FSNamesystem: Removal of Expired Lease on Open Files is enabled +2023-06-26 13:45:50,811 INFO namenode.FSImage: Allocated new BlockPoolId: BP-1979673447-172.31.25.102-1687787150800 +2023-06-26 13:45:50,824 INFO common.Storage: Storage directory /mnt/namenode has been successfully formatted. +2023-06-26 13:45:50,826 INFO common.Storage: Storage directory /mnt1/namenode has been successfully formatted. +2023-06-26 13:45:50,868 INFO namenode.FSImageFormatProtobuf: Saving image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 using no compression +2023-06-26 13:45:50,868 INFO namenode.FSImageFormatProtobuf: Saving image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 using no compression +2023-06-26 13:45:51,228 INFO namenode.FSImageFormatProtobuf: Image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds . +2023-06-26 13:45:51,230 INFO namenode.FSImageFormatProtobuf: Image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds . +2023-06-26 13:45:51,244 INFO namenode.NNStorageRetentionManager: Going to retain 1 images with txid >= 0 +2023-06-26 13:45:51,301 INFO namenode.FSNamesystem: Stopping services started for active state +2023-06-26 13:45:51,301 INFO namenode.FSNamesystem: Stopping services started for standby state +2023-06-26 13:45:51,305 INFO namenode.FSImage: FSImageSaver clean checkpoint: txid=0 when meet shutdown. +2023-06-26 13:45:51,306 INFO namenode.FSImage: FSImageSaver clean checkpoint: txid=0 when meet shutdown. +2023-06-26 13:45:51,306 INFO namenode.NameNode: SHUTDOWN_MSG: +/************************************************************ +SHUTDOWN_MSG: Shutting down NameNode at ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102 +************************************************************/ \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log-expected.json b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log-expected.json new file mode 100644 index 00000000000..25994a1ff2f --- /dev/null +++ b/packages/aws/data_stream/emr_logs/_dev/test/pipeline/test-emr-hadoop.log-expected.json @@ -0,0 +1,1526 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-26T13:45:49.685Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:49,685 INFO namenode.NameNode: STARTUP_MSG: \n/************************************************************\nSTARTUP_MSG: Starting NameNode\nSTARTUP_MSG: host = ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102\nSTARTUP_MSG: args = [-format, -nonInteractive]\nSTARTUP_MSG: version = 3.3.3-amzn-3\nSTARTUP_MSG: classpath = /etc/hadoop/conf:/usr/lib/hadoop/lib/jetty-security-9.4.48.v20220622.jar:/usr/lib/hadoop/lib/accessors-smart-2.4.7.jar:/usr/lib/hadoop/lib/jersey-core-1.19.jar:/usr/lib/hadoop/lib/animal-sniffer-annotations-1.17.jar\nSTARTUP_MSG: build = Unknown -r Unknown; compiled by 'release' on 2023-05-31T03:49Z\nSTARTUP_MSG: java = 1.8.0_372\n************************************************************/" + }, + "log": { + "level": "INFO" + }, + "message": "STARTUP_MSG: ", + "process": { + "message": "/************************************************************\nSTARTUP_MSG: Starting NameNode\nSTARTUP_MSG: host = ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102\nSTARTUP_MSG: args = [-format, -nonInteractive]\nSTARTUP_MSG: version = 3.3.3-amzn-3\nSTARTUP_MSG: classpath = /etc/hadoop/conf:/usr/lib/hadoop/lib/jetty-security-9.4.48.v20220622.jar:/usr/lib/hadoop/lib/accessors-smart-2.4.7.jar:/usr/lib/hadoop/lib/jersey-core-1.19.jar:/usr/lib/hadoop/lib/animal-sniffer-annotations-1.17.jar\nSTARTUP_MSG: build = Unknown -r Unknown; compiled by 'release' on 2023-05-31T03:49Z\nSTARTUP_MSG: java = 1.8.0_372\n************************************************************/", + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:49.697Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:49,697 INFO namenode.NameNode: registered UNIX signal handlers for [TERM, HUP, INT]" + }, + "log": { + "level": "INFO" + }, + "message": "registered UNIX signal handlers for [TERM, HUP, INT]", + "process": { + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:49.823Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:49,823 INFO namenode.NameNode: createNameNode [-format, -nonInteractive]" + }, + "log": { + "level": "INFO" + }, + "message": "createNameNode [-format, -nonInteractive]", + "process": { + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.318Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,318 INFO common.Util: Assuming 'file' scheme for path /mnt/namenode in configuration." + }, + "log": { + "level": "INFO" + }, + "message": "Assuming 'file' scheme for path /mnt/namenode in configuration.", + "process": { + "name": "common.Util" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.319Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt1/namenode in configuration." + }, + "log": { + "level": "INFO" + }, + "message": "Assuming 'file' scheme for path /mnt1/namenode in configuration.", + "process": { + "name": "common.Util" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.319Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt/namenode in configuration." + }, + "log": { + "level": "INFO" + }, + "message": "Assuming 'file' scheme for path /mnt/namenode in configuration.", + "process": { + "name": "common.Util" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.319Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,319 INFO common.Util: Assuming 'file' scheme for path /mnt1/namenode in configuration." + }, + "log": { + "level": "INFO" + }, + "message": "Assuming 'file' scheme for path /mnt1/namenode in configuration.", + "process": { + "name": "common.Util" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.330Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,330 INFO namenode.NameNode: Formatting using clusterid: CID-1b3b14b6-5518-47c3-b981-e5cb6b0ce38c" + }, + "log": { + "level": "INFO" + }, + "message": "Formatting using clusterid: CID-1b3b14b6-5518-47c3-b981-e5cb6b0ce38c", + "process": { + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.394Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,394 INFO namenode.FSEditLog (main): Edit logging is async:true" + }, + "log": { + "level": "INFO" + }, + "message": "Edit logging is async:true", + "process": { + "name": "namenode.FSEditLog (main)" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.484Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,484 INFO namenode.FSNamesystem: KeyProvider: KeyProviderCryptoExtension: org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider@a530d0a" + }, + "log": { + "level": "INFO" + }, + "message": "KeyProvider: KeyProviderCryptoExtension: org.apache.hadoop.crypto.key.kms.LoadBalancingKMSClientProvider@a530d0a", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.486Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,486 INFO namenode.FSNamesystem: fsLock is fair: true" + }, + "log": { + "level": "INFO" + }, + "message": "fsLock is fair: true", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.486Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,486 INFO namenode.FSNamesystem: Detailed lock hold time metrics enabled: false" + }, + "log": { + "level": "INFO" + }, + "message": "Detailed lock hold time metrics enabled: false", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.492Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,492 INFO namenode.FSNamesystem: fsOwner = hdfs (auth:SIMPLE)" + }, + "log": { + "level": "INFO" + }, + "message": "fsOwner = hdfs (auth:SIMPLE)", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.493Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: supergroup = hdfsadmingroup" + }, + "log": { + "level": "INFO" + }, + "message": "supergroup = hdfsadmingroup", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.493Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: isPermissionEnabled = true" + }, + "log": { + "level": "INFO" + }, + "message": "isPermissionEnabled = true", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.493Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: isStoragePolicyEnabled = true" + }, + "log": { + "level": "INFO" + }, + "message": "isStoragePolicyEnabled = true", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.493Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,493 INFO namenode.FSNamesystem: HA Enabled: false" + }, + "log": { + "level": "INFO" + }, + "message": "HA Enabled: false", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.566Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,566 INFO common.Util: dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling", + "process": { + "name": "common.Util" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.601Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,601 INFO blockmanagement.DatanodeManager: dfs.block.invalidate.limit: configured=1000, counted=60, effected=1000" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.block.invalidate.limit: configured=1000, counted=60, effected=1000", + "process": { + "name": "blockmanagement.DatanodeManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.601Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,601 INFO blockmanagement.DatanodeManager: dfs.namenode.datanode.registration.ip-hostname-check=true" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.namenode.datanode.registration.ip-hostname-check=true", + "process": { + "name": "blockmanagement.DatanodeManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.610Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,610 INFO blockmanagement.BlockManager: dfs.namenode.startup.delay.block.deletion.sec is set to 000:00:00:00.000" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.namenode.startup.delay.block.deletion.sec is set to 000:00:00:00.000", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.611Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,611 INFO blockmanagement.BlockManager: The block deletion will start around 2023 Jun 26 13:45:50" + }, + "log": { + "level": "INFO" + }, + "message": "The block deletion will start around 2023 Jun 26 13:45:50", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.612Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,612 INFO util.GSet: Computing capacity for map BlocksMap" + }, + "log": { + "level": "INFO" + }, + "message": "Computing capacity for map BlocksMap", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.613Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,613 INFO util.GSet: VM type = 64-bit" + }, + "log": { + "level": "INFO" + }, + "message": "VM type = 64-bit", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.614Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,614 INFO util.GSet: 2.0% max memory 864 MB = 17.3 MB" + }, + "log": { + "level": "INFO" + }, + "message": "2.0% max memory 864 MB = 17.3 MB", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.614Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,614 INFO util.GSet: capacity = 2^21 = 2097152 entries" + }, + "log": { + "level": "INFO" + }, + "message": "capacity = 2^21 = 2097152 entries", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.623Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,623 INFO blockmanagement.BlockManager: Storage policy satisfier is disabled" + }, + "log": { + "level": "INFO" + }, + "message": "Storage policy satisfier is disabled", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.623Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,623 INFO blockmanagement.BlockManager: dfs.block.access.token.enable = false" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.block.access.token.enable = false", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.631Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.threshold-pct = 0.999" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.namenode.safemode.threshold-pct = 0.999", + "process": { + "name": "blockmanagement.BlockManagerSafeMode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.631Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.min.datanodes = 0" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.namenode.safemode.min.datanodes = 0", + "process": { + "name": "blockmanagement.BlockManagerSafeMode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.631Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,631 INFO blockmanagement.BlockManagerSafeMode: dfs.namenode.safemode.extension = 5000" + }, + "log": { + "level": "INFO" + }, + "message": "dfs.namenode.safemode.extension = 5000", + "process": { + "name": "blockmanagement.BlockManagerSafeMode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.632Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: defaultReplication = 1" + }, + "log": { + "level": "INFO" + }, + "message": "defaultReplication = 1", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.632Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: maxReplication = 512" + }, + "log": { + "level": "INFO" + }, + "message": "maxReplication = 512", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.632Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: minReplication = 1" + }, + "log": { + "level": "INFO" + }, + "message": "minReplication = 1", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.632Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,632 INFO blockmanagement.BlockManager: maxReplicationStreams = 100" + }, + "log": { + "level": "INFO" + }, + "message": "maxReplicationStreams = 100", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.633Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: redundancyRecheckInterval = 3000ms" + }, + "log": { + "level": "INFO" + }, + "message": "redundancyRecheckInterval = 3000ms", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.633Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: encryptDataTransfer = false" + }, + "log": { + "level": "INFO" + }, + "message": "encryptDataTransfer = false", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.633Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,633 INFO blockmanagement.BlockManager: maxNumBlocksToLog = 1000" + }, + "log": { + "level": "INFO" + }, + "message": "maxNumBlocksToLog = 1000", + "process": { + "name": "blockmanagement.BlockManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.670Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,670 INFO namenode.FSDirectory: GLOBAL serial map: bits=29 maxEntries=536870911" + }, + "log": { + "level": "INFO" + }, + "message": "GLOBAL serial map: bits=29 maxEntries=536870911", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.671Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,671 INFO namenode.FSDirectory: USER serial map: bits=24 maxEntries=16777215" + }, + "log": { + "level": "INFO" + }, + "message": "USER serial map: bits=24 maxEntries=16777215", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.671Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,671 INFO namenode.FSDirectory: GROUP serial map: bits=24 maxEntries=16777215" + }, + "log": { + "level": "INFO" + }, + "message": "GROUP serial map: bits=24 maxEntries=16777215", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.671Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,671 INFO namenode.FSDirectory: XATTR serial map: bits=24 maxEntries=16777215" + }, + "log": { + "level": "INFO" + }, + "message": "XATTR serial map: bits=24 maxEntries=16777215", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.696Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,696 INFO util.GSet: Computing capacity for map INodeMap" + }, + "log": { + "level": "INFO" + }, + "message": "Computing capacity for map INodeMap", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.696Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,696 INFO util.GSet: VM type = 64-bit" + }, + "log": { + "level": "INFO" + }, + "message": "VM type = 64-bit", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.697Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,697 INFO util.GSet: 1.0% max memory 864 MB = 8.6 MB" + }, + "log": { + "level": "INFO" + }, + "message": "1.0% max memory 864 MB = 8.6 MB", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.697Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,697 INFO util.GSet: capacity = 2^20 = 1048576 entries" + }, + "log": { + "level": "INFO" + }, + "message": "capacity = 2^20 = 1048576 entries", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.699Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,699 INFO namenode.FSDirectory: ACLs enabled? true" + }, + "log": { + "level": "INFO" + }, + "message": "ACLs enabled? true", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.699Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,699 INFO namenode.FSDirectory: POSIX ACL inheritance enabled? true" + }, + "log": { + "level": "INFO" + }, + "message": "POSIX ACL inheritance enabled? true", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.699Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,699 INFO namenode.FSDirectory: XAttrs enabled? true" + }, + "log": { + "level": "INFO" + }, + "message": "XAttrs enabled? true", + "process": { + "name": "namenode.FSDirectory" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.700Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,700 INFO namenode.NameNode: Caching file names occurring more than 10 times" + }, + "log": { + "level": "INFO" + }, + "message": "Caching file names occurring more than 10 times", + "process": { + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.708Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,708 INFO namenode.ReencryptionHandler: Configured throttleLimitHandlerRatio=1.0 for re-encryption" + }, + "log": { + "level": "INFO" + }, + "message": "Configured throttleLimitHandlerRatio=1.0 for re-encryption", + "process": { + "name": "namenode.ReencryptionHandler" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.717Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,717 INFO snapshot.SnapshotManager: Loaded config captureOpenFiles: false, skipCaptureAccessTimeOnlyChange: false, snapshotDiffAllowSnapRootDescendant: true, maxSnapshotLimit: 65536" + }, + "log": { + "level": "INFO" + }, + "message": "Loaded config captureOpenFiles: false, skipCaptureAccessTimeOnlyChange: false, snapshotDiffAllowSnapRootDescendant: true, maxSnapshotLimit: 65536", + "process": { + "name": "snapshot.SnapshotManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.720Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,720 INFO snapshot.SnapshotManager: SkipList is disabled" + }, + "log": { + "level": "INFO" + }, + "message": "SkipList is disabled", + "process": { + "name": "snapshot.SnapshotManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.748Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,748 INFO util.GSet: Computing capacity for map cachedBlocks" + }, + "log": { + "level": "INFO" + }, + "message": "Computing capacity for map cachedBlocks", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.748Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,748 INFO util.GSet: VM type = 64-bit" + }, + "log": { + "level": "INFO" + }, + "message": "VM type = 64-bit", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.748Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,748 INFO util.GSet: 0.25% max memory 864 MB = 2.2 MB" + }, + "log": { + "level": "INFO" + }, + "message": "0.25% max memory 864 MB = 2.2 MB", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.749Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,749 INFO util.GSet: capacity = 2^18 = 262144 entries" + }, + "log": { + "level": "INFO" + }, + "message": "capacity = 2^18 = 262144 entries", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.764Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.window.num.buckets = 10" + }, + "log": { + "level": "INFO" + }, + "message": "NNTop conf: dfs.namenode.top.window.num.buckets = 10", + "process": { + "name": "metrics.TopMetrics" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.764Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.num.users = 10" + }, + "log": { + "level": "INFO" + }, + "message": "NNTop conf: dfs.namenode.top.num.users = 10", + "process": { + "name": "metrics.TopMetrics" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.764Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,764 INFO metrics.TopMetrics: NNTop conf: dfs.namenode.top.windows.minutes = 1,5,25" + }, + "log": { + "level": "INFO" + }, + "message": "NNTop conf: dfs.namenode.top.windows.minutes = 1,5,25", + "process": { + "name": "metrics.TopMetrics" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.768Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,768 INFO namenode.FSNamesystem: Retry cache on namenode is enabled" + }, + "log": { + "level": "INFO" + }, + "message": "Retry cache on namenode is enabled", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.768Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,768 INFO namenode.FSNamesystem: Retry cache will use 0.03 of total heap and retry cache entry expiry time is 600000 millis" + }, + "log": { + "level": "INFO" + }, + "message": "Retry cache will use 0.03 of total heap and retry cache entry expiry time is 600000 millis", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.771Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,771 INFO util.GSet: Computing capacity for map NameNodeRetryCache" + }, + "log": { + "level": "INFO" + }, + "message": "Computing capacity for map NameNodeRetryCache", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.771Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,771 INFO util.GSet: VM type = 64-bit" + }, + "log": { + "level": "INFO" + }, + "message": "VM type = 64-bit", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.771Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,771 INFO util.GSet: 0.029999999329447746% max memory 864 MB = 265.4 KB" + }, + "log": { + "level": "INFO" + }, + "message": "0.029999999329447746% max memory 864 MB = 265.4 KB", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.771Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,771 INFO util.GSet: capacity = 2^15 = 32768 entries" + }, + "log": { + "level": "INFO" + }, + "message": "capacity = 2^15 = 32768 entries", + "process": { + "name": "util.GSet" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.774Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,774 INFO namenode.FSNamesystem: Removal of Expired Lease on Open Files is enabled" + }, + "log": { + "level": "INFO" + }, + "message": "Removal of Expired Lease on Open Files is enabled", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.811Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,811 INFO namenode.FSImage: Allocated new BlockPoolId: BP-1979673447-172.31.25.102-1687787150800" + }, + "log": { + "level": "INFO" + }, + "message": "Allocated new BlockPoolId: BP-1979673447-172.31.25.102-1687787150800", + "process": { + "name": "namenode.FSImage" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.824Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,824 INFO common.Storage: Storage directory /mnt/namenode has been successfully formatted." + }, + "log": { + "level": "INFO" + }, + "message": "Storage directory /mnt/namenode has been successfully formatted.", + "process": { + "name": "common.Storage" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.826Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,826 INFO common.Storage: Storage directory /mnt1/namenode has been successfully formatted." + }, + "log": { + "level": "INFO" + }, + "message": "Storage directory /mnt1/namenode has been successfully formatted.", + "process": { + "name": "common.Storage" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.868Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,868 INFO namenode.FSImageFormatProtobuf: Saving image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 using no compression" + }, + "log": { + "level": "INFO" + }, + "message": "Saving image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 using no compression", + "process": { + "name": "namenode.FSImageFormatProtobuf" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:50.868Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:50,868 INFO namenode.FSImageFormatProtobuf: Saving image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 using no compression" + }, + "log": { + "level": "INFO" + }, + "message": "Saving image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 using no compression", + "process": { + "name": "namenode.FSImageFormatProtobuf" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.228Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,228 INFO namenode.FSImageFormatProtobuf: Image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds ." + }, + "log": { + "level": "INFO" + }, + "message": "Image file /mnt1/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds .", + "process": { + "name": "namenode.FSImageFormatProtobuf" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.230Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,230 INFO namenode.FSImageFormatProtobuf: Image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds ." + }, + "log": { + "level": "INFO" + }, + "message": "Image file /mnt/namenode/current/fsimage.ckpt_0000000000000000000 of size 403 bytes saved in 0 seconds .", + "process": { + "name": "namenode.FSImageFormatProtobuf" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.244Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,244 INFO namenode.NNStorageRetentionManager: Going to retain 1 images with txid \u003e= 0" + }, + "log": { + "level": "INFO" + }, + "message": "Going to retain 1 images with txid \u003e= 0", + "process": { + "name": "namenode.NNStorageRetentionManager" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.301Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,301 INFO namenode.FSNamesystem: Stopping services started for active state" + }, + "log": { + "level": "INFO" + }, + "message": "Stopping services started for active state", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.301Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,301 INFO namenode.FSNamesystem: Stopping services started for standby state" + }, + "log": { + "level": "INFO" + }, + "message": "Stopping services started for standby state", + "process": { + "name": "namenode.FSNamesystem" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.305Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,305 INFO namenode.FSImage: FSImageSaver clean checkpoint: txid=0 when meet shutdown." + }, + "log": { + "level": "INFO" + }, + "message": "FSImageSaver clean checkpoint: txid=0 when meet shutdown.", + "process": { + "name": "namenode.FSImage" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.306Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,306 INFO namenode.FSImage: FSImageSaver clean checkpoint: txid=0 when meet shutdown." + }, + "log": { + "level": "INFO" + }, + "message": "FSImageSaver clean checkpoint: txid=0 when meet shutdown.", + "process": { + "name": "namenode.FSImage" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-26T13:45:51.306Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "original": "2023-06-26 13:45:51,306 INFO namenode.NameNode: SHUTDOWN_MSG: \n/************************************************************\nSHUTDOWN_MSG: Shutting down NameNode at ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102\n************************************************************/" + }, + "log": { + "level": "INFO" + }, + "message": "SHUTDOWN_MSG: ", + "process": { + "message": "/************************************************************\nSHUTDOWN_MSG: Shutting down NameNode at ip-172-31-25-102.eu-central-1.compute.internal/172.31.25.102\n************************************************************/", + "name": "namenode.NameNode" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/agent/stream/aws-cloudwatch.yml.hbs b/packages/aws/data_stream/emr_logs/agent/stream/aws-cloudwatch.yml.hbs new file mode 100644 index 00000000000..934f97a44c3 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/agent/stream/aws-cloudwatch.yml.hbs @@ -0,0 +1,100 @@ +{{#unless log_group_name}} +{{#unless log_group_name_prefix}} +{{#if log_group_arn }} +log_group_arn: {{ log_group_arn }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +{{#unless log_group_name}} +{{#if log_group_name_prefix }} +log_group_name_prefix: {{ log_group_name_prefix }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +{{#unless log_group_name_prefix}} +{{#if log_group_name }} +log_group_name: {{ log_group_name }} +{{/if}} +{{/unless}} +{{/unless}} + +{{#unless log_group_arn}} +region_name: {{ region_name }} +{{/unless}} + +{{#unless log_stream_prefix}} +{{#if log_streams }} +log_streams: {{ log_streams }} +{{/if}} +{{/unless}} + +{{#unless log_streams}} +{{#if log_stream_prefix }} +log_stream_prefix: {{ log_stream_prefix }} +{{/if}} +{{/unless}} + +{{#if start_position }} +start_position: {{ start_position }} +{{/if}} + +{{#if scan_frequency }} +scan_frequency: {{ scan_frequency }} +{{/if}} + +{{#if api_sleep }} +api_sleep: {{ api_sleep }} +{{/if}} + +{{#if latency }} +latency: {{ latency }} +{{/if}} +{{#if number_of_workers }} +number_of_workers: {{ number_of_workers }} +{{/if}} + +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if proxy_url }} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/aws/data_stream/emr_logs/agent/stream/aws-s3.yml.hbs b/packages/aws/data_stream/emr_logs/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..c479d4b6dd0 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,78 @@ +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{#if file_selectors}} +file_selectors: +{{file_selectors}} +{{/if}} + +{{/if}} + + +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url }} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/emr_logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..55b24bc86c4 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,62 @@ +--- +description: "Pipeline for EMR logs" +processors: + - set: + field: ecs.version + value: '8.0.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' + - grok: + field: event.original + pattern_definitions: + GREEDYMULTILINE: "(.|\\n)*" + patterns: + - '%{TIMESTAMP_ISO8601:_tmp.timestamp}%{SPACE}%{LOGLEVEL:log.level}%{SPACE}%{DATA:process.name}(?:\\[%{GREEDYDATA:process.entrypoint}\\])?:%{SPACE}%{GREEDYDATA:message}%{SPACE}%{GREEDYMULTILINE:process.message}' + ignore_missing: true + - date: + field: _tmp.timestamp + target_field: '@timestamp' + ignore_failure: true + formats: + - ISO8601 + - yyyy-MM-dd HH:mm:ss,SSS + - remove: + field: + - _tmp + ignore_missing: true + - script: + description: Drops null/empty values recursively + lang: painless + ignore_failure: true + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); + - remove: + field: event.original + if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true +on_failure: + - set: + field: 'error.message' + value: '{{ _ingest.on_failure_message }}' \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/fields/agent.yml b/packages/aws/data_stream/emr_logs/fields/agent.yml new file mode 100644 index 00000000000..13e13903cc4 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/fields/agent.yml @@ -0,0 +1,35 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/aws/data_stream/emr_logs/fields/base-fields.yml b/packages/aws/data_stream/emr_logs/fields/base-fields.yml new file mode 100644 index 00000000000..ae928a4e452 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: aws +- name: event.dataset + type: constant_keyword + description: Event dataset + value: aws.emr_logs diff --git a/packages/aws/data_stream/emr_logs/fields/ecs.yml b/packages/aws/data_stream/emr_logs/fields/ecs.yml new file mode 100644 index 00000000000..249a3bb663a --- /dev/null +++ b/packages/aws/data_stream/emr_logs/fields/ecs.yml @@ -0,0 +1,60 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: message +- external: ecs + name: tags +- external: ecs + name: host.architecture +- external: ecs + name: host.domain +- external: ecs + name: host.hostname +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.mac +- external: ecs + name: host.name +- external: ecs + name: host.os.family +- external: ecs + name: host.os.kernel +- external: ecs + name: host.os.name +- external: ecs + name: host.os.platform +- external: ecs + name: host.os.version +- external: ecs + name: host.type +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.instance.name +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: cloud.project.id +- external: ecs + name: container.id +- external: ecs + name: container.image.name +- external: ecs + name: container.labels +- external: ecs + name: container.name +- external: ecs + name: log.level \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/fields/fields.yml b/packages/aws/data_stream/emr_logs/fields/fields.yml new file mode 100644 index 00000000000..d25df0d5191 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/fields/fields.yml @@ -0,0 +1,28 @@ +- name: aws.s3 + type: group + fields: + - name: bucket.name + type: keyword + description: | + Name of a S3 bucket. + - name: bucket.arn + type: keyword + description: | + ARN of the S3 bucket that this log retrieved from. + - name: object.key + type: keyword + description: | + Name of the S3 object that this log retrieved from. + - name: metadata + type: flattened + description: | + AWS S3 object metadata values. +- name: process.name + type: keyword + description: Process name. +- name: process.entrypoint + type: keyword + description: Process entrypoint. +- name: process.message + type: keyword + description: Process message. \ No newline at end of file diff --git a/packages/aws/data_stream/emr_logs/manifest.yml b/packages/aws/data_stream/emr_logs/manifest.yml new file mode 100644 index 00000000000..68dade863cc --- /dev/null +++ b/packages/aws/data_stream/emr_logs/manifest.yml @@ -0,0 +1,232 @@ +title: AWS EMR logs +type: logs +streams: + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: AWS EMR Logs via S3 + description: Collect AWS EMR logs using s3 input + enabled: true + vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To Collect logs via S3 bucket enable the toggle switch. + type: bool + multi: false + default: true + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + default: false + description: Mandatory if the "Collect logs via S3 Bucket" switch is off. URL of the AWS SQS queue that messages will be received from. + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: false + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: false + default: 1m + description: "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s." + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: false + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: visibility_timeout + type: text + title: "[SQS] Visibility Timeout" + multi: false + required: false + show_user: false + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + - name: api_timeout + type: text + title: "[SQS] API Timeout" + multi: false + required: false + show_user: false + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + - name: max_number_of_messages + type: integer + title: "[SQS] Maximum Concurrent SQS Messages" + description: The maximum number of SQS messages that can be inflight at any time. + default: 5 + required: false + show_user: false + - name: fips_enabled + type: bool + title: Enable S3 FIPS + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - aws-emr-logs + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - input: aws-cloudwatch + template_path: aws-cloudwatch.yml.hbs + title: AWS EMR Logs via CloudWatch + description: Collect AWS EMR logs using cloudwatch input. + enabled: false + vars: + - name: log_group_arn + type: text + title: Log Group ARN + multi: false + required: false + show_user: true + description: ARN of the log group to collect logs from. + - name: log_group_name + type: text + title: Log Group Name + multi: false + required: false + show_user: false + description: Name of the log group to collect logs from. `region_name` is required when `log_group_name` is given. + - name: log_group_name_prefix + type: text + title: Log Group Name Prefix + multi: false + required: false + show_user: false + description: The prefix for a group of log group names. `region_name` is required when `log_group_name_prefix` is given. `log_group_name` and `log_group_name_prefix` cannot be given at the same time. + - name: region_name + type: text + title: Region Name + multi: false + required: false + show_user: false + description: Region that the specified log group or log group prefix belongs to. + - name: log_streams + type: text + title: Log Streams + multi: true + required: false + show_user: false + description: A list of strings of log streams names that Filebeat collect log events from. + - name: log_stream_prefix + type: text + title: Log Stream Prefix + multi: false + required: false + show_user: false + description: A string to filter the results to include only log events from log streams that have names starting with this prefix. + - name: start_position + type: text + title: Start Position + multi: false + required: false + default: beginning + show_user: true + description: Allows user to specify if this input should read log files from the beginning or from the end. + - name: scan_frequency + type: text + title: Scan Frequency + multi: false + required: false + show_user: false + default: 1m + description: This config parameter sets how often Filebeat checks for new log events from the specified log group. + - name: api_timeput + type: text + title: API Timeout + multi: false + required: false + show_user: false + default: 120s + description: The maximum duration of AWS API can take. If it exceeds the timeout, AWS API will be interrupted. + - name: api_sleep + type: text + title: API Sleep + multi: false + required: false + show_user: false + default: 200ms + description: This is used to sleep between AWS FilterLogEvents API calls inside the same collection period. `FilterLogEvents` API has a quota of 5 transactions per second (TPS)/account/Region. This value should only be adjusted when there are multiple Filebeats or multiple Filebeat inputs collecting logs from the same region and AWS account. + - name: latency + type: text + title: Latency + multi: false + required: false + show_user: false + description: "The amount of time required for the logs to be available to CloudWatch Logs. Sample values, `1m` or `5m` — see Golang [time.ParseDuration](https://pkg.go.dev/time#ParseDuration) for more details. Latency translates the query's time range to consider the CloudWatch Logs latency. Example: `5m` means that the integration will query CloudWatch to search for logs available 5 minutes ago." + - name: number_of_workers + type: integer + title: Number of workers + required: false + show_user: false + description: The number of workers assigned to reading from log groups. Each worker will read log events from one of the log groups matching `log_group_name_prefix`. For example, if `log_group_name_prefix` matches five log groups, then `number_of_workers` should be set to `5`. The default value is `1`. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - aws-emr-logs + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false +# Ensures agents have permissions to write data to `logs-*-*` +elasticsearch.dynamic_dataset: true +elasticsearch.dynamic_namespace: true diff --git a/packages/aws/data_stream/emr_logs/sample_event.json b/packages/aws/data_stream/emr_logs/sample_event.json new file mode 100644 index 00000000000..e5506058298 --- /dev/null +++ b/packages/aws/data_stream/emr_logs/sample_event.json @@ -0,0 +1,24 @@ +{ + "data_stream": { + "namespace": "default", + "type": "logs", + "dataset": "aws.emr_logs" + }, + "@timestamp": "2020-02-20T07:01:01.000Z", + "ecs": { + "version": "8.0.0" + }, + "log": { + "level": "INFO" + }, + "event": { + "original": "2023-06-26 13:45:50,566 INFO common.Util: dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling" + }, + "process": { + "name": "blockmanagement.BlockManager" + }, + "message": "dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling", + "tags": [ + "preserve_original_event" + ] +} \ No newline at end of file diff --git a/packages/aws/data_stream/emr_metrics/fields/ecs.yml b/packages/aws/data_stream/emr_metrics/fields/ecs.yml index c31e930d1f0..17aba4ca24e 100644 --- a/packages/aws/data_stream/emr_metrics/fields/ecs.yml +++ b/packages/aws/data_stream/emr_metrics/fields/ecs.yml @@ -2,6 +2,7 @@ name: cloud - external: ecs name: cloud.account.id + dimension: true - external: ecs name: cloud.account.name - external: ecs @@ -18,6 +19,7 @@ name: cloud.provider - external: ecs name: cloud.region + dimension: true - external: ecs name: ecs.version - external: ecs @@ -60,3 +62,6 @@ name: container.labels - external: ecs name: container.name +- name: agent.id + external: ecs + dimension: true diff --git a/packages/aws/data_stream/emr_metrics/fields/fields.yml b/packages/aws/data_stream/emr_metrics/fields/fields.yml index 5edbbf69638..da72d8b1215 100644 --- a/packages/aws/data_stream/emr_metrics/fields/fields.yml +++ b/packages/aws/data_stream/emr_metrics/fields/fields.yml @@ -16,15 +16,15 @@ - name: ContainerAllocated.sum type: long description: The number of resource containers allocated by the ResourceManager. - metric_type: counter + metric_type: gauge - name: ContainerReserved.sum type: long description: The number of containers reserved. - metric_type: counter + metric_type: gauge - name: ContainerPending.sum type: long description: The number of containers in the queue that have not yet been allocated. - metric_type: counter + metric_type: gauge - name: ContainerPendingRatio.avg type: long description: The ratio of pending containers to containers allocated @@ -33,31 +33,31 @@ - name: AppsCompleted.sum type: long description: The number of applications submitted to YARN that have completed. - metric_type: counter + metric_type: gauge - name: AppsFailed.sum type: long description: The number of applications submitted to YARN that have failed to complete. - metric_type: counter + metric_type: gauge - name: AppsKilled.sum type: long description: The number of applications submitted to YARN that have been killed. - metric_type: counter + metric_type: gauge - name: AppsPending.sum type: long description: The number of applications submitted to YARN that are in a pending state. - metric_type: counter + metric_type: gauge - name: AppsRunning.sum type: long description: The number of applications submitted to YARN that are running. - metric_type: counter + metric_type: gauge - name: AppsSubmitted.sum type: long description: The number of applications submitted to YARN. - metric_type: counter + metric_type: gauge - name: CoreNodesPending.sum type: long description: The number of core nodes waiting to be assigned. - metric_type: counter + metric_type: gauge - name: LiveDataNodes.avg type: double description: The percentage of data nodes that are receiving work from Hadoop. @@ -66,31 +66,31 @@ - name: MRTotalNodes.sum type: long description: The number of nodes presently available to MapReduce jobs. - metric_type: counter + metric_type: gauge - name: MRActiveNodes.sum type: long description: The number of nodes presently running MapReduce tasks or jobs. - metric_type: counter + metric_type: gauge - name: MRLostNodes.sum type: long description: The number of nodes allocated to MapReduce that have been marked in a LOST state. - metric_type: counter + metric_type: gauge - name: MRUnhealthyNodes.sum type: long description: The number of nodes available to MapReduce jobs marked in an UNHEALTHY state. - metric_type: counter + metric_type: gauge - name: MRDecommissionedNodes.sum type: long description: The number of nodes allocated to MapReduce applications that have been marked in a DECOMMISSIONED state. - metric_type: counter + metric_type: gauge - name: MRRebootedNodes.sum type: long description: The number of nodes available to MapReduce that have been rebooted and marked in a REBOOTED state. - metric_type: counter + metric_type: gauge - name: MultiMasterInstanceGroupNodesRunning.sum type: long description: The number of running master nodes. - metric_type: counter + metric_type: gauge - name: MultiMasterInstanceGroupNodesRunningPercentage.avg type: double description: The percentage of master nodes that are running over the requested master node instance count. @@ -99,16 +99,16 @@ - name: MultiMasterInstanceGroupNodesRequested.sum type: long description: The number of requested master nodes. - metric_type: counter + metric_type: gauge - name: S3BytesWritten.sum type: long description: The number of bytes written to Amazon S3. - metric_type: counter + metric_type: gauge unit: byte - name: S3BytesRead.sum type: long description: The number of bytes read from Amazon S3. - metric_type: counter + metric_type: gauge unit: byte - name: HDFSUtilization.avg type: double @@ -118,12 +118,12 @@ - name: HDFSBytesRead.sum type: long description: The number of bytes read from HDFS. - metric_type: counter + metric_type: gauge unit: byte - name: HDFSBytesWritten.sum type: long description: The number of bytes written to HDFS. - metric_type: counter + metric_type: gauge unit: byte - name: MissingBlocks.max type: long @@ -136,21 +136,21 @@ - name: TotalLoad.sum type: long description: The total number of concurrent data transfers. - metric_type: counter + metric_type: gauge - name: MemoryTotalMB.sum type: long description: The total amount of memory in the cluster. - metric_type: counter + metric_type: gauge unit: byte - name: MemoryReservedMB.sum type: long description: The amount of memory reserved. - metric_type: counter + metric_type: gauge unit: byte - name: MemoryAvailableMB.sum type: long description: The amount of memory available to be allocated. - metric_type: counter + metric_type: gauge unit: byte - name: YARNMemoryAvailablePercentage.avg type: double @@ -160,24 +160,24 @@ - name: MemoryAllocatedMB.sum type: long description: The amount of memory allocated to the cluster. - metric_type: counter + metric_type: gauge unit: byte - name: PendingDeletionBlocks.sum type: long description: The number of blocks marked for deletion. - metric_type: counter + metric_type: gauge - name: UnderReplicatedBlocks.sum type: long description: The number of blocks that need to be replicated one or more times. - metric_type: counter + metric_type: gauge - name: DfsPendingReplicationBlocks.sum type: long description: The status of block replication - blocks being replicated, age of replication requests, and unsuccessful replication requests. - metric_type: counter + metric_type: gauge - name: CapacityRemainingGB.sum type: long description: The amount of remaining HDFS disk capacity. - metric_type: counter + metric_type: gauge unit: byte - name: TotalUnitsRequested.max type: long @@ -254,7 +254,7 @@ - name: TotalNotebookKernels.sum type: long description: The total number of running and idle notebook kernels on the cluster. - metric_type: counter + metric_type: gauge - name: AutoTerminationIsClusterIdle.avg type: long description: Indicates whether the cluster is in use. diff --git a/packages/aws/data_stream/emr_metrics/manifest.yml b/packages/aws/data_stream/emr_metrics/manifest.yml index 8fd5519bfe2..d46f18d08cb 100644 --- a/packages/aws/data_stream/emr_metrics/manifest.yml +++ b/packages/aws/data_stream/emr_metrics/manifest.yml @@ -1,6 +1,8 @@ title: AWS EMR metrics type: metrics release: beta +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/guardduty/_dev/test/system/test-default-config.yml b/packages/aws/data_stream/guardduty/_dev/test/system/test-default-config.yml index 7da8e062aa2..213c98db1dd 100644 --- a/packages/aws/data_stream/guardduty/_dev/test/system/test-default-config.yml +++ b/packages/aws/data_stream/guardduty/_dev/test/system/test-default-config.yml @@ -1,7 +1,4 @@ input: httpjson -skip: - reason: "Support backward compatibility of Current AWS package." - link: https://github.com/elastic/integrations/issues/4911 service: guardduty vars: secret_access_key: xxxx diff --git a/packages/aws/data_stream/guardduty/agent/stream/httpjson.yml.hbs b/packages/aws/data_stream/guardduty/agent/stream/httpjson.yml.hbs index 644f4c094b5..479b6d1f697 100644 --- a/packages/aws/data_stream/guardduty/agent/stream/httpjson.yml.hbs +++ b/packages/aws/data_stream/guardduty/agent/stream/httpjson.yml.hbs @@ -19,7 +19,7 @@ request.transforms: target: header.X-Amz-Date value: '[[formatDate (now) "20060102T150405Z"]]' - set: - target: body.MaxResults + target: body.maxResults value: 50 value_type: int - set: diff --git a/packages/aws/data_stream/rds/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/rds/elasticsearch/ingest_pipeline/default.yml index 51fce7d0714..d07c2b30dbe 100644 --- a/packages/aws/data_stream/rds/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/rds/elasticsearch/ingest_pipeline/default.yml @@ -278,74 +278,3 @@ processors: field: aws.rds.metrics.AuroraVolumeBytesLeftTotal.avg target_field: aws.rds.aurora_volume_left_total.bytes ignore_missing: true - - remove: - field: - - aws.rds.metrics.BurstBalance - - aws.rds.metrics.CPUUtilization - - aws.rds.metrics.CPUCreditUsage - - aws.rds.metrics.CPUCreditBalance - - aws.rds.metrics.DatabaseConnections - - aws.rds.metrics.DiskQueueDepth - - aws.rds.metrics.FailedSQLServerAgentJobsCount - - aws.rds.metrics.FreeableMemory - - aws.rds.metrics.FreeStorageSpace - - aws.rds.metrics.MaximumUsedTransactionIDs - - aws.rds.metrics.OldestReplicationSlotLag - - aws.rds.metrics.ReadIOPS.avg - - aws.rds.metrics.CommitThroughput - - aws.rds.metrics.DeleteThroughput - - aws.rds.metrics.DDLThroughput - - aws.rds.metrics.DMLThroughput - - aws.rds.metrics.InsertThroughput - - aws.rds.metrics.NetworkThroughput - - aws.rds.metrics.NetworkReceiveThroughput - - aws.rds.metrics.NetworkTransmitThroughput - - aws.rds.metrics.ReadThroughput - - aws.rds.metrics.SelectThroughput - - aws.rds.metrics.UpdateThroughput - - aws.rds.metrics.WriteThroughput - - aws.rds.metrics.CommitLatency - - aws.rds.metrics.DDLLatency - - aws.rds.metrics.DMLLatency - - aws.rds.metrics.InsertLatency - - aws.rds.metrics.ReadLatency - - aws.rds.metrics.SelectLatency - - aws.rds.metrics.UpdateLatency - - aws.rds.metrics.WriteLatency - - aws.rds.metrics.DeleteLatency - - aws.rds.metrics.ReplicaLag - - aws.rds.metrics.BinLogDiskUsage - - aws.rds.metrics.ReplicationSlotDiskUsage - - aws.rds.metrics.TransactionLogsDiskUsage - - aws.rds.metrics.SwapUsage - - aws.rds.metrics.TransactionLogsGeneration - - aws.rds.metrics.WriteIOPS - - aws.rds.metrics.Queries - - aws.rds.metrics.Deadlocks - - aws.rds.metrics.VolumeBytesUsed - - aws.rds.metrics.FreeLocalStorage - - aws.rds.metrics.ActiveTransactions - - aws.rds.metrics.BlockedTransactions - - aws.rds.metrics.LoginFailures - - aws.rds.metrics.AuroraBinlogReplicaLag - - aws.rds.metrics.aurora_bin_log_replica_lag - - aws.rds.metrics.AuroraGlobalDBDataTransferBytes - - aws.rds.metrics.AuroraGlobalDBReplicationLag - - aws.rds.metrics.AuroraReplicaLag - - aws.rds.metrics.AuroraReplicaLagMaximum - - aws.rds.metrics.AuroraReplicaLagMinimum - - aws.rds.metrics.BacktrackChangeRecordsCreationRate - - aws.rds.metrics.BacktrackChangeRecordsStored - - aws.rds.metrics.BacktrackWindowActual - - aws.rds.metrics.BacktrackWindowAlert - - aws.rds.metrics.BackupRetentionPeriodStorageUsed - - aws.rds.metrics.SnapshotStorageUsed - - aws.rds.metrics.BufferCacheHitRatio - - aws.rds.metrics.ResultSetCacheHitRatio - - aws.rds.metrics.EngineUptime - - aws.rds.metrics.VolumeReadIOPs - - aws.rds.metrics.VolumeWriteIOPs - - aws.rds.metrics.RDSToAuroraPostgreSQLReplicaLag - - aws.rds.metrics.TotalBackupStorageBilled - - aws.rds.metrics.AuroraVolumeBytesLeftTotal - ignore_missing: true \ No newline at end of file diff --git a/packages/aws/data_stream/s3_daily_storage/manifest.yml b/packages/aws/data_stream/s3_daily_storage/manifest.yml index 4768bbf65ca..028b41325cf 100644 --- a/packages/aws/data_stream/s3_daily_storage/manifest.yml +++ b/packages/aws/data_stream/s3_daily_storage/manifest.yml @@ -1,5 +1,7 @@ title: AWS S3 daily storage metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/s3_request/manifest.yml b/packages/aws/data_stream/s3_request/manifest.yml index 1070acd093d..3c8def48812 100644 --- a/packages/aws/data_stream/s3_request/manifest.yml +++ b/packages/aws/data_stream/s3_request/manifest.yml @@ -1,5 +1,7 @@ title: AWS S3 request metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/usage/manifest.yml b/packages/aws/data_stream/usage/manifest.yml index ed871e37a93..963e3e6d92a 100644 --- a/packages/aws/data_stream/usage/manifest.yml +++ b/packages/aws/data_stream/usage/manifest.yml @@ -1,5 +1,7 @@ title: AWS usage metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: aws/metrics vars: diff --git a/packages/aws/data_stream/vpcflow/agent/stream/aws-s3.yml.hbs b/packages/aws/data_stream/vpcflow/agent/stream/aws-s3.yml.hbs index 77fae5d0dc8..64796e6215f 100644 --- a/packages/aws/data_stream/vpcflow/agent/stream/aws-s3.yml.hbs +++ b/packages/aws/data_stream/vpcflow/agent/stream/aws-s3.yml.hbs @@ -1,9 +1,22 @@ -queue_url: {{queue_url}} -{{#if credential_profile_name}} -credential_profile_name: {{credential_profile_name}} +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} {{/if}} -{{#if shared_credential_file}} -shared_credential_file: {{shared_credential_file}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} +queue_url: {{queue_url}} {{/if}} {{#if visibility_timeout}} visibility_timeout: {{visibility_timeout}} @@ -14,6 +27,15 @@ api_timeout: {{api_timeout}} {{#if max_number_of_messages}} max_number_of_messages: {{max_number_of_messages}} {{/if}} + +{{/if}} + +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} {{#if default_region}} default_region: {{default_region}} {{/if}} diff --git a/packages/aws/data_stream/vpcflow/fields/fields.yml b/packages/aws/data_stream/vpcflow/fields/fields.yml index 1f2779983f2..0d85135f5d3 100644 --- a/packages/aws/data_stream/vpcflow/fields/fields.yml +++ b/packages/aws/data_stream/vpcflow/fields/fields.yml @@ -1,3 +1,22 @@ +- name: aws.s3 + type: group + fields: + - name: bucket.name + type: keyword + description: | + Name of a S3 bucket. + - name: bucket.arn + type: keyword + description: | + ARN of the S3 bucket that this log retrieved from. + - name: object.key + type: keyword + description: | + Name of the S3 object that this log retrieved from. + - name: metadata + type: flattened + description: | + AWS S3 object metadata values. - name: aws.vpcflow type: group fields: @@ -74,3 +93,4 @@ type: keyword description: | The ID of the sublocation that contains the network interface for which traffic is recorded. If the traffic is not from a sublocation, the field is removed. + diff --git a/packages/aws/data_stream/vpcflow/manifest.yml b/packages/aws/data_stream/vpcflow/manifest.yml index 73a6daa68bd..a8117ff5a00 100644 --- a/packages/aws/data_stream/vpcflow/manifest.yml +++ b/packages/aws/data_stream/vpcflow/manifest.yml @@ -7,27 +7,72 @@ streams: description: Collect AWS vpcflow logs using s3 input enabled: false vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + description: Mandatory if the "Collect logs via S3 Bucket" switch is off. URL of the AWS SQS queue that messages will be received from. + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: false + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: false + default: 1m + description: "Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s." + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: false + default: 5 + description: Number of workers that will process the S3 objects listed. - name: visibility_timeout type: text - title: Visibility Timeout + title: "[SQS] Visibility Timeout" multi: false required: false show_user: false description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. - name: api_timeout type: text - title: API Timeout + title: "[SQS] API Timeout" multi: false required: false show_user: false description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. - - name: queue_url - type: text - title: Queue URL - multi: false - required: true - show_user: true - description: URL of the AWS SQS queue that messages will be received from. + - name: max_number_of_messages + type: integer + title: "[SQS] Maximum Concurrent SQS Messages" + description: The maximum number of SQS messages that can be inflight at any time. + default: 5 + required: false + show_user: false - name: fips_enabled type: bool title: Enable S3 FIPS @@ -62,13 +107,6 @@ streams: type: bool multi: false default: false - - name: max_number_of_messages - type: integer - title: Maximum Concurrent SQS Messages - description: The maximum number of SQS messages that can be inflight at any time. - default: 5 - required: false - show_user: false - input: aws-cloudwatch template_path: aws-cloudwatch.yml.hbs title: AWS VPC Flow Logs via CloudWatch diff --git a/packages/aws/docs/apigateway.md b/packages/aws/docs/apigateway.md index 4f940fc08e5..6a45a52aa60 100644 --- a/packages/aws/docs/apigateway.md +++ b/packages/aws/docs/apigateway.md @@ -2,7 +2,7 @@ The AWS API Gateway integration allows you to monitor [API Gateway](https://aws.amazon.com/api-gateway/) — a centralized API management service. -Use the AWS API Gateway integration to collect metrics related to your HTTP, REST or WebSockets APIs. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue. +Use the AWS API Gateway integration to collect metrics and logs related to your HTTP, REST or WebSockets APIs. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference metrics when troubleshooting an issue. For example, you could use this integration to examine metrics related to error rates, response codes, and latency. You can pinpoint problematic areas, identify error-prone API endpoints, and troubleshoot performance issues. @@ -10,7 +10,29 @@ For example, you could use this integration to examine metrics related to error ## Data streams -The API Gateway integration collects one type of data: metrics. +The API Gateway integration collects two types of data: metrics and logs. + +**Logs** help you keep a record of events happening in Amazon API Gateway. +Logs collected by the Amazon API Gateway integration include the HTTP method, status code, request details and more. + +AWS API Gateway allows you to set up Custom Access Logging to gain deeper insights into the requests and responses through your API by making use of context variables ([HTTP](https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-logging-variables.html), [WebSockets](https://docs.aws.amazon.com/apigateway/latest/developerguide/websocket-api-logging.html)), input, stage and util variables ([REST](https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-mapping-template-reference.html)). + +The Elastic integration for AWS API Gateway supports the following Log Format by API type: + +HTTP: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","requestTime": "$context.requestTime","httpMethod": "$context.httpMethod","routeKey": "$context.routeKey","status": "$context.status","protocol": "$context.protocol","responseLength": "$context.responseLength",apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +REST: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","caller": "$context.identity.caller","user": "$context.identity.user""requestTime": "$context.requestTime","httpMethod": "$context.httpMethod","resourcePath": "$context.resourcePath","status": "$context.status","protocol": "$context.protocol","responseLength": "$context.responseLength",apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +WebSockets: +```{"requestId": "$context.requestId","ip": "$context.identity.sourceIp","caller": "$context.identity.caller","user": "$context.identity.user","requestTime": "$context.requestTime","eventType": "$context.eventType","routeKey": "$context.routeKey","status": "$context.status","connectionId": "$context.connectionId", apiId": "$context.apiId", "domainName": "$context.domainName", "stage": "$context.stage"}``` + +Beyond the standard Log Formats we provide, you can use a wide range of fields for each API type when enabling Custom Access Logging. + +To utilize these fields in the integration, create custom pipelines. These pipelines will process field names or values. You'll also need to create a custom mapping to store your data efficiently. For more information on how to do this, check out our [official documentation](https://www.elastic.co/guide/en/fleet/current/data-streams-pipeline-tutorial.html). + +See more details in the [Logs reference](#logs-reference). **Metrics** give you insight into the state of API Gateway. Metrics collected by the AWS API Gateway integration include the number of client and server errors, request and error counts and cache counts. @@ -140,21 +162,22 @@ An example event for `apigateway` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | -| aws.apigateway.metrics.4XXError.sum | The number of client-side errors captured in a given period. | long | | counter | -| aws.apigateway.metrics.4xx.sum | The number of client-side errors captured in a given period. | long | | counter | -| aws.apigateway.metrics.5XXError.sum | The number of server-side errors captured in a given period. | long | | counter | -| aws.apigateway.metrics.5xx.sum | The number of server-side errors captured in a given period. | long | | counter | -| aws.apigateway.metrics.CacheHitCount.sum | The number of requests served from the API cache in a given period. | long | | counter | -| aws.apigateway.metrics.CacheMissCount.sum | The number of requests served from the backend in a given period, when API caching is enabled. | long | | counter | -| aws.apigateway.metrics.ClientError.sum | The number of requests that have a 4XX response returned by API Gateway before the integration is invoked. | long | | counter | -| aws.apigateway.metrics.ConnectCount.sum | The number of messages sent to the connect route integration. | long | | counter | -| aws.apigateway.metrics.Count.sum | The total number of API requests in a given period. | long | | counter | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| aws.apigateway.metrics.4XXError.sum | The number of client-side errors captured in a given period. | long | | gauge | +| aws.apigateway.metrics.4xx.sum | The number of client-side errors captured in a given period. | long | | gauge | +| aws.apigateway.metrics.5XXError.sum | The number of server-side errors captured in a given period. | long | | gauge | +| aws.apigateway.metrics.5xx.sum | The number of server-side errors captured in a given period. | long | | gauge | +| aws.apigateway.metrics.CacheHitCount.sum | The number of requests served from the API cache in a given period. | long | | gauge | +| aws.apigateway.metrics.CacheMissCount.sum | The number of requests served from the backend in a given period, when API caching is enabled. | long | | gauge | +| aws.apigateway.metrics.ClientError.sum | The number of requests that have a 4XX response returned by API Gateway before the integration is invoked. | long | | gauge | +| aws.apigateway.metrics.ConnectCount.sum | The number of messages sent to the connect route integration. | long | | gauge | +| aws.apigateway.metrics.Count.sum | The total number of API requests in a given period. | long | | gauge | | aws.apigateway.metrics.DataProcessed.avg | The amount of data processed in bytes. | long | byte | gauge | -| aws.apigateway.metrics.ExecutionError.sum | Errors that occurred when calling the integration. | long | | counter | -| aws.apigateway.metrics.IntegrationError.sum | The number of requests that return a 4XX/5XX response from the integration. | long | | counter | +| aws.apigateway.metrics.ExecutionError.sum | Errors that occurred when calling the integration. | long | | gauge | +| aws.apigateway.metrics.IntegrationError.sum | The number of requests that return a 4XX/5XX response from the integration. | long | | gauge | | aws.apigateway.metrics.IntegrationLatency.avg | The time between when API Gateway relays a request to the backend and when it receives a response from the backend. | long | ms | gauge | | aws.apigateway.metrics.Latency.avg | The time between when API Gateway receives a request from a client and when it returns a response to the client. | long | ms | gauge | -| aws.apigateway.metrics.MessageCount.sum | The number of messages sent to the WebSocket API, either from or to the client. | long | | counter | +| aws.apigateway.metrics.MessageCount.sum | The number of messages sent to the WebSocket API, either from or to the client. | long | | gauge | | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | | | | aws.dimensions.ApiId | Each API created in API Gateway is assigned a unique ApiId, which is used to distinguish and reference that specific API within the system. | keyword | | | | aws.dimensions.ApiName | It represents a human-readable name that helps identify and differentiate the API within the API Gateway service. | keyword | | | @@ -205,3 +228,100 @@ An example event for `apigateway` looks as following: | host.os.version | Operating system version as a raw string. | keyword | | | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + + +## Logs reference + +An example event for `apigateway` looks as following: + +```json +{ + "data_stream": { + "namespace": "default", + "type": "logs", + "dataset": "aws.apigateway_logs" + }, + "@timestamp": "2020-02-20T07:01:01.000Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "ingested": "2021-07-19T21:47:04.871450600Z", + "original": "2020-02-20T07:01:01.000Z Feb 20 07:01:01 ip-172-31-81-156 systemd: Stopping User Slice of root." + }, + "aws": { + "apigateway": { + "ip_address": "172.31.81.156" + } + }, + "message": "Stopping User Slice of root.", + "tags": [ + "preserve_original_event" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| aws.apigateway.api_id | The identifier API Gateway assigns to your API. | keyword | +| aws.apigateway.caller | The principal identifier of the caller making the request. | keyword | +| aws.apigateway.connection_id | A unique ID for the connection that can be used to make a callback to the client. | keyword | +| aws.apigateway.domain_name | The full domain name used to invoke the API. | keyword | +| aws.apigateway.event_type | The event type: CONNECT, MESSAGE, or DISCONNECT. | keyword | +| aws.apigateway.http_method | The HTTP method used. Valid values include: DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT. | keyword | +| aws.apigateway.ip_address | The internet address of the requester. | ip | +| aws.apigateway.protocol | API Gateway APIs can accept HTTP/2 requests, but API Gateway sends requests to backend integrations using HTTP/1.1. | keyword | +| aws.apigateway.request_id | An ID for the request. Clients can override this request ID. | keyword | +| aws.apigateway.request_time | The CLF-formatted request time (dd/MMM/yyyy:HH:mm:ss +-hhmm). | date | +| aws.apigateway.resource_path | The path to your resource. | keyword | +| aws.apigateway.response_length | The response payload length in bytes. | long | +| aws.apigateway.route_key | The selected route key. | keyword | +| aws.apigateway.stage | The deployment stage of the API call (for example, beta or prod). | keyword | +| aws.apigateway.status | The response status. | long | +| aws.apigateway.user | The principal identifier of the user making the request. | keyword | +| aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword | +| aws.s3.bucket.name | Name of a S3 bucket. | keyword | +| aws.s3.metadata | AWS S3 object metadata values. | flattened | +| aws.s3.object.key | Name of the S3 object that this log retrieved from. | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host, resource, or service is located. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Event dataset | constant_keyword | +| event.module | Event module | constant_keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| tags | List of keywords used to tag each event. | keyword | diff --git a/packages/aws/docs/cloudtrail.md b/packages/aws/docs/cloudtrail.md index 4a29fbccfab..ff2f854432f 100644 --- a/packages/aws/docs/cloudtrail.md +++ b/packages/aws/docs/cloudtrail.md @@ -115,6 +115,10 @@ If blank, CloudTrail Digest logs will be skipped. | aws.cloudtrail.user_identity.session_context.session_issuer.type | The source of the temporary security credentials, such as Root, IAMUser, or Role. | keyword | | aws.cloudtrail.user_identity.type | The type of the identity | keyword | | aws.cloudtrail.vpc_endpoint_id | Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon S3. | keyword | +| aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword | +| aws.s3.bucket.name | Name of a S3 bucket. | keyword | +| aws.s3.metadata | AWS S3 object metadata values. | flattened | +| aws.s3.object.key | Name of the S3 object that this log retrieved from. | keyword | | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | cloud.image.id | Image ID for the cloud instance. | keyword | diff --git a/packages/aws/docs/cloudwatch.md b/packages/aws/docs/cloudwatch.md index b9bc24ba49f..96304d19f4c 100644 --- a/packages/aws/docs/cloudwatch.md +++ b/packages/aws/docs/cloudwatch.md @@ -201,53 +201,54 @@ An example event for `cloudwatch` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object | -| aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | -| aws.dimensions.\* | Metric dimensions. | object | -| aws.s3.bucket.name | Name of a S3 bucket. | keyword | -| aws.tags.\* | Tag key value pairs from aws resources. | object | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object | gauge | +| aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | | +| aws.dimensions.\* | Metric dimensions. | object | | +| aws.dimensions.fingerprint | Autogenerated ID representing the fingerprint of the aws.dimensions object | keyword | | +| aws.tags.\* | Tag key value pairs from aws resources. | object | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/aws/docs/ec2.md b/packages/aws/docs/ec2.md index f76cb0fb848..4471f034a8d 100644 --- a/packages/aws/docs/ec2.md +++ b/packages/aws/docs/ec2.md @@ -152,35 +152,29 @@ An example event for `ec2` looks as following: ```json { - "@timestamp": "2022-05-26T12:40:00.000Z", - "agent": { - "name": "docker-fleet-agent", - "id": "24d50340-a9d0-4d5d-9f42-fe9cb4b8c95d", - "type": "metricbeat", - "ephemeral_id": "f8282deb-ebc7-4d1f-9386-207f56657244", - "version": "8.2.0" - }, - "elastic_agent": { - "id": "24d50340-a9d0-4d5d-9f42-fe9cb4b8c95d", - "version": "8.2.0", - "snapshot": false - }, + "@timestamp": "2023-08-07T18:35:00.000Z", "cloud": { - "availability_zone": "us-east-1c", + "availability_zone": "eu-north-1c", "instance": { - "name": "elastic-package-test-33138", - "id": "i-0de58890d94dda2e3" + "id": "i-0c08512debca266ab" }, "provider": "aws", "machine": { - "type": "t1.micro" + "type": "t3.medium" }, - "region": "us-east-1", + "region": "eu-north-1", "account": { - "name": "elastic-beats", - "id": "428152502467" + "name": "MonitoringAccount", + "id": "627286350134" } }, + "agent": { + "name": "docker-fleet-agent", + "id": "72314f01-98f2-477f-978a-e98d109c640c", + "type": "metricbeat", + "ephemeral_id": "b8cd4414-f528-43f4-b43f-0edbcc69b46f", + "version": "8.8.1" + }, "ecs": { "version": "8.0.0" }, @@ -194,107 +188,121 @@ An example event for `ec2` looks as following: }, "host": { "hostname": "docker-fleet-agent", - "disk": { - "read": { - "bytes": 0 - }, - "write": { - "bytes": 0 - } - }, "os": { - "kernel": "5.10.47-linuxkit", + "kernel": "5.15.49-linuxkit-pr", "codename": "focal", "name": "Ubuntu", "type": "linux", "family": "debian", - "version": "20.04.4 LTS (Focal Fossa)", + "version": "20.04.6 LTS (Focal Fossa)", "platform": "ubuntu" }, - "containerized": true, + "containerized": false, "ip": [ - "192.168.80.7" + "172.20.0.7" ], - "name": "elastic-package-test-33138", + "name": "docker-fleet-agent", "cpu": { - "usage": 0.08265027322397175 + "usage": 2.8849988898518673 }, - "id": "i-0de58890d94dda2e3", + "id": "d08b346fbb8f49f5a2bb1a477f8ceb54", "mac": [ - "02:42:c0:a8:50:07" + "02-42-AC-14-00-07" ], - "architecture": "x86_64", + "architecture": "aarch64", "network": { "ingress": { - "bytes": 1992 + "bytes": 1608959, + "packets": 5334 }, "egress": { - "bytes": 1800 + "bytes": 626755, + "packets": 4977 } } }, + "elastic_agent": { + "id": "72314f01-98f2-477f-978a-e98d109c640c", + "version": "8.8.1", + "snapshot": false + }, "metricset": { "period": 300000, "name": "cloudwatch" }, "event": { - "duration": 15936070000, + "duration": 5858967919, "agent_id_status": "verified", - "ingested": "2022-05-26T12:44:52Z", + "ingested": "2023-08-07T18:41:31Z", "module": "aws", "dataset": "aws.ec2_metrics" }, "aws": { "ec2": { - "diskio": { - "read": { - "count_per_sec": 0, - "bytes_per_sec": 0 - }, - "write": { - "count_per_sec": 0, - "bytes_per_sec": 0 - } - }, "instance": { "image": { - "id": "ami-0ff900168d0231cd3" + "id": "ami-00b8290583a865359" }, "core": { "count": 1 }, "private": { - "ip": "172.31.16.45", - "dns_name": "ip-172-31-16-45.ec2.internal" + "ip": "172.31.13.154", + "dns_name": "ip-172-31-13-154.eu-north-1.compute.internal" }, - "threads_per_core": 1, + "threads_per_core": 2, "public": { - "ip": "54.90.153.147", - "dns_name": "ec2-54-90-153-147.compute-1.amazonaws.com" + "ip": "16.16.138.5", + "dns_name": "ec2-16-16-138-5.eu-north-1.compute.amazonaws.com" }, "state": { "code": 16, "name": "running" }, "monitoring": { - "state": "enabled" + "state": "disabled" } }, - "cpu": { - "credit_balance": 144, - "credit_usage": 0.004121 - }, - "status": { - "check_failed": 0, - "check_failed_instance": 0, - "check_failed_system": 0 - }, - "network": { - "in": { - "bytes_per_sec": 33.2 + "metrics": { + "NetworkOut": { + "rate": 10445.916666666666, + "sum": 626755 + }, + "CPUUtilization": { + "avg": 2.8849988898518673 + }, + "StatusCheckFailed_Instance": { + "avg": 0 + }, + "CPUCreditUsage": { + "avg": 0.29100543333333334 + }, + "CPUCreditBalance": { + "avg": 576 }, - "out": { - "bytes_per_sec": 30 + "NetworkPacketsOut": { + "rate": 82.95, + "sum": 4977 + }, + "NetworkPacketsIn": { + "rate": 88.9, + "sum": 5334 + }, + "NetworkIn": { + "rate": 26815.983333333334, + "sum": 1608959 + }, + "StatusCheckFailed": { + "avg": 0 + }, + "CPUSurplusCreditsCharged": { + "avg": 0 + }, + "CPUSurplusCreditBalance": { + "avg": 0 + }, + "StatusCheckFailed_System": { + "avg": 0 } } }, @@ -302,10 +310,12 @@ An example event for `ec2` looks as following: "namespace": "AWS/EC2" }, "dimensions": { - "InstanceId": "i-0de58890d94dda2e3" + "InstanceId": "i-0c08512debca266ab" }, "tags": { - "Name": "elastic-package-test-33138" + "aws:autoscaling:groupName": "eks-firehose-50c386d7-c8b1-bde8-5d42-d3841ca7ecfe", + "aws:ec2launchtemplate:version": "1", + "aws:ec2launchtemplate:id": "lt-09e1cdf590e35c687" } } } @@ -313,67 +323,76 @@ An example event for `ec2` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object | -| aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | -| aws.dimensions.AutoScalingGroupName | An Auto Scaling group is a collection of instances you define if you're using Auto Scaling. | keyword | -| aws.dimensions.ImageId | This dimension filters the data you request for all instances running this Amazon EC2 Amazon Machine Image (AMI) | keyword | -| aws.dimensions.InstanceId | Amazon EC2 instance ID | keyword | -| aws.dimensions.InstanceType | This dimension filters the data you request for all instances running with this specified instance type. | keyword | -| aws.ec2.cpu.credit_balance | The number of earned CPU credits that an instance has accrued since it was launched or started. | long | -| aws.ec2.cpu.credit_usage | The number of CPU credits spent by the instance for CPU utilization. | long | -| aws.ec2.cpu.surplus_credit_balance | The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero. | long | -| aws.ec2.cpu.surplus_credits_charged | The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge. | long | -| aws.ec2.diskio.read.bytes_per_sec | Bytes read per second from all instance store volumes available to the instance. | long | -| aws.ec2.diskio.read.count_per_sec | Completed read operations per second from all instance store volumes available to the instance in a specified period of time. | long | -| aws.ec2.diskio.write.bytes_per_sec | Bytes written per second to all instance store volumes available to the instance. | long | -| aws.ec2.diskio.write.count_per_sec | Completed write operations per second to all instance store volumes available to the instance in a specified period of time. | long | -| aws.ec2.instance.core.count | The number of CPU cores for the instance. | integer | -| aws.ec2.instance.image.id | The ID of the image used to launch the instance. | keyword | -| aws.ec2.instance.monitoring.state | Indicates whether detailed monitoring is enabled. | keyword | -| aws.ec2.instance.private.dns_name | The private DNS name of the network interface. | keyword | -| aws.ec2.instance.private.ip | The private IPv4 address associated with the network interface. | ip | -| aws.ec2.instance.public.dns_name | The public DNS name of the instance. | keyword | -| aws.ec2.instance.public.ip | The address of the Elastic IP address (IPv4) bound to the network interface. | ip | -| aws.ec2.instance.state.code | The state of the instance, as a 16-bit unsigned integer. | integer | -| aws.ec2.instance.state.name | The state of the instance (pending | running | shutting-down | terminated | stopping | stopped). | keyword | -| aws.ec2.instance.threads_per_core | The number of threads per CPU core. | integer | -| aws.ec2.network.in.bytes_per_sec | The number of bytes per second received on all network interfaces by the instance. | long | -| aws.ec2.network.in.packets_per_sec | The number of packets per second sent out on all network interfaces by the instance. | long | -| aws.ec2.network.out.bytes_per_sec | The number of bytes per second sent out on all network interfaces by the instance. | long | -| aws.ec2.network.out.packets_per_sec | The number of packets per second sent out on all network interfaces by the instance. | long | -| aws.ec2.status.check_failed | Reports whether the instance has passed both the instance status check and the system status check in the last minute. | long | -| aws.ec2.status.check_failed_instance | Reports whether the instance has passed the instance status check in the last minute. | long | -| aws.ec2.status.check_failed_system | Reports whether the instance has passed the system status check in the last minute. | long | -| aws.s3.bucket.name | Name of a S3 bucket. | keyword | -| aws.tags.\* | Tag key value pairs from aws resources. | object | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.containerized | If the host is a container. | boolean | -| host.cpu.usage | Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. For example: For a two core host, this value should be the average of the two cores, between 0 and 1. | scaled_float | -| host.disk.read.bytes | The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. | long | -| host.disk.write.bytes | The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. | long | -| host.network.egress.bytes | The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection. | long | -| host.network.egress.packets | The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection. | long | -| host.network.ingress.bytes | The number of bytes received (gauge) on all network interfaces by the host since the last metric collection. | long | -| host.network.ingress.packets | The number of packets (gauge) received on all network interfaces by the host since the last metric collection. | long | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | | +| aws.dimensions.AutoScalingGroupName | An Auto Scaling group is a collection of instances you define if you're using Auto Scaling. | keyword | | +| aws.dimensions.ImageId | This dimension filters the data you request for all instances running this Amazon EC2 Amazon Machine Image (AMI) | keyword | | +| aws.dimensions.InstanceId | Amazon EC2 instance ID | keyword | | +| aws.dimensions.InstanceType | This dimension filters the data you request for all instances running with this specified instance type. | keyword | | +| aws.ec2.instance.core.count | The number of CPU cores for the instance. | integer | | +| aws.ec2.instance.image.id | The ID of the image used to launch the instance. | keyword | | +| aws.ec2.instance.monitoring.state | Indicates whether detailed monitoring is enabled. | keyword | | +| aws.ec2.instance.private.dns_name | The private DNS name of the network interface. | keyword | | +| aws.ec2.instance.private.ip | The private IPv4 address associated with the network interface. | ip | | +| aws.ec2.instance.public.dns_name | The public DNS name of the instance. | keyword | | +| aws.ec2.instance.public.ip | The address of the Elastic IP address (IPv4) bound to the network interface. | ip | | +| aws.ec2.instance.state.code | The state of the instance, as a 16-bit unsigned integer. | integer | | +| aws.ec2.instance.state.name | The state of the instance (pending | running | shutting-down | terminated | stopping | stopped). | keyword | | +| aws.ec2.instance.threads_per_core | The number of threads per CPU core. | integer | | +| aws.ec2.metrics.CPUCreditBalance.avg | The number of earned CPU credits that an instance has accrued since it was launched or started. | long | gauge | +| aws.ec2.metrics.CPUCreditUsage.avg | The number of CPU credits spent by the instance for CPU utilization. | long | gauge | +| aws.ec2.metrics.CPUSurplusCreditBalance.avg | The number of surplus credits that have been spent by an unlimited instance when its CPUCreditBalance value is zero. | long | gauge | +| aws.ec2.metrics.CPUSurplusCreditsCharged.avg | The number of spent surplus credits that are not paid down by earned CPU credits, and which thus incur an additional charge. | long | gauge | +| aws.ec2.metrics.CPUUtilization.avg | The average percentage of physical CPU time that Amazon EC2 uses to run the EC2 instance. | long | gauge | +| aws.ec2.metrics.DiskReadBytes.rate | Bytes read per second from all instance store volumes available to the instance. | long | gauge | +| aws.ec2.metrics.DiskReadBytes.sum | Total bytes read from all instance store volumes available to the instance. | long | gauge | +| aws.ec2.metrics.DiskReadOps.rate | Completed read operations per second from all instance store volumes available to the instance in a specified period of time. | long | gauge | +| aws.ec2.metrics.DiskReadOps.sum | Total completed read operations from all instance store volumes available to the instance in a specified period of time. | long | gauge | +| aws.ec2.metrics.DiskWriteBytes.rate | Bytes written per second to all instance store volumes available to the instance. | long | gauge | +| aws.ec2.metrics.DiskWriteBytes.sum | Total bytes written to all instance store volumes available to the instance. | long | gauge | +| aws.ec2.metrics.DiskWriteOps.rate | Completed write operations per second to all instance store volumes available to the instance in a specified period of time. | long | gauge | +| aws.ec2.metrics.DiskWriteOps.sum | Total completed write operations to all instance store volumes available to the instance in a specified period of time. | long | gauge | +| aws.ec2.metrics.NetworkIn.rate | The number of bytes per second received on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkIn.sum | The number of bytes total received on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkOut.rate | The number of bytes per second sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkOut.sum | The number of bytes total sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkPacketsIn.rate | The number of packets per second sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkPacketsIn.sum | The number of packets total sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkPacketsOut.rate | The number of packets per second sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.NetworkPacketsOut.sum | The number of packets total sent out on all network interfaces by the instance. | long | gauge | +| aws.ec2.metrics.StatusCheckFailed.avg | Reports whether the instance has passed both the instance status check and the system status check in the last minute. | long | gauge | +| aws.ec2.metrics.StatusCheckFailed_Instance.avg | Reports whether the instance has passed the instance status check in the last minute. | long | gauge | +| aws.ec2.metrics.StatusCheckFailed_System.avg | Reports whether the instance has passed the system status check in the last minute. | long | gauge | +| aws.s3.bucket.name | Name of a S3 bucket. | keyword | | +| aws.tags.\* | Tag key value pairs from aws resources. | object | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.cpu.usage | Percent CPU used which is normalized by the number of CPU cores and it ranges from 0 to 1. Scaling factor: 1000. For example: For a two core host, this value should be the average of the two cores, between 0 and 1. | scaled_float | | +| host.disk.read.bytes | The total number of bytes (gauge) read successfully (aggregated from all disks) since the last metric collection. | long | | +| host.disk.write.bytes | The total number of bytes (gauge) written successfully (aggregated from all disks) since the last metric collection. | long | | +| host.network.egress.bytes | The number of bytes (gauge) sent out on all network interfaces by the host since the last metric collection. | long | | +| host.network.egress.packets | The number of packets (gauge) sent out on all network interfaces by the host since the last metric collection. | long | | +| host.network.ingress.bytes | The number of bytes received (gauge) on all network interfaces by the host since the last metric collection. | long | | +| host.network.ingress.packets | The number of packets (gauge) received on all network interfaces by the host since the last metric collection. | long | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/aws/docs/emr.md b/packages/aws/docs/emr.md index 24698fd5813..ce6167d337c 100644 --- a/packages/aws/docs/emr.md +++ b/packages/aws/docs/emr.md @@ -10,11 +10,14 @@ For example, you could use this data to track Amazon EMR cluster progress and cl ## Data streams -The Amazon EMR integration collects one type of data: metrics. +The Amazon EMR integration collects two types of data: metrics and logs. **Metrics** give you insight into the state of Amazon EMR. The metrics collected by the Amazon EMR integration include cluster progress, cluster state, cluster or node storage, and more. See more details in the [Metrics reference](#metrics-reference) +**Logs** help you keep a record of events happening in Amazon EMR. +Logs collected by the Amazon EMR integration include the cluster status, node status details and more. + ## Requirements You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. @@ -109,21 +112,22 @@ An example event for `emr` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword | | | | aws.dimensions.JobFlowId | Filters metrics by cluster ID. | keyword | | | -| aws.elasticmapreduce.metrics.AppsCompleted.sum | The number of applications submitted to YARN that have completed. | long | | counter | -| aws.elasticmapreduce.metrics.AppsFailed.sum | The number of applications submitted to YARN that have failed to complete. | long | | counter | -| aws.elasticmapreduce.metrics.AppsKilled.sum | The number of applications submitted to YARN that have been killed. | long | | counter | -| aws.elasticmapreduce.metrics.AppsPending.sum | The number of applications submitted to YARN that are in a pending state. | long | | counter | -| aws.elasticmapreduce.metrics.AppsRunning.sum | The number of applications submitted to YARN that are running. | long | | counter | -| aws.elasticmapreduce.metrics.AppsSubmitted.sum | The number of applications submitted to YARN. | long | | counter | +| aws.elasticmapreduce.metrics.AppsCompleted.sum | The number of applications submitted to YARN that have completed. | long | | gauge | +| aws.elasticmapreduce.metrics.AppsFailed.sum | The number of applications submitted to YARN that have failed to complete. | long | | gauge | +| aws.elasticmapreduce.metrics.AppsKilled.sum | The number of applications submitted to YARN that have been killed. | long | | gauge | +| aws.elasticmapreduce.metrics.AppsPending.sum | The number of applications submitted to YARN that are in a pending state. | long | | gauge | +| aws.elasticmapreduce.metrics.AppsRunning.sum | The number of applications submitted to YARN that are running. | long | | gauge | +| aws.elasticmapreduce.metrics.AppsSubmitted.sum | The number of applications submitted to YARN. | long | | gauge | | aws.elasticmapreduce.metrics.AutoTerminationIsClusterIdle.avg | Indicates whether the cluster is in use. | long | percent | gauge | -| aws.elasticmapreduce.metrics.CapacityRemainingGB.sum | The amount of remaining HDFS disk capacity. | long | byte | counter | -| aws.elasticmapreduce.metrics.ContainerAllocated.sum | The number of resource containers allocated by the ResourceManager. | long | | counter | -| aws.elasticmapreduce.metrics.ContainerPending.sum | The number of containers in the queue that have not yet been allocated. | long | | counter | +| aws.elasticmapreduce.metrics.CapacityRemainingGB.sum | The amount of remaining HDFS disk capacity. | long | byte | gauge | +| aws.elasticmapreduce.metrics.ContainerAllocated.sum | The number of resource containers allocated by the ResourceManager. | long | | gauge | +| aws.elasticmapreduce.metrics.ContainerPending.sum | The number of containers in the queue that have not yet been allocated. | long | | gauge | | aws.elasticmapreduce.metrics.ContainerPendingRatio.avg | The ratio of pending containers to containers allocated | long | percent | gauge | -| aws.elasticmapreduce.metrics.ContainerReserved.sum | The number of containers reserved. | long | | counter | -| aws.elasticmapreduce.metrics.CoreNodesPending.sum | The number of core nodes waiting to be assigned. | long | | counter | +| aws.elasticmapreduce.metrics.ContainerReserved.sum | The number of containers reserved. | long | | gauge | +| aws.elasticmapreduce.metrics.CoreNodesPending.sum | The number of core nodes waiting to be assigned. | long | | gauge | | aws.elasticmapreduce.metrics.CoreNodesRequested.max | The target number of CORE nodes in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.CoreNodesRunning.avg | The current number of CORE nodes running in a cluster. | long | | gauge | | aws.elasticmapreduce.metrics.CoreUnitsRequested.max | The target number of CORE units in a cluster as determined by managed scaling. | long | | gauge | @@ -131,44 +135,44 @@ An example event for `emr` looks as following: | aws.elasticmapreduce.metrics.CoreVCPURequested.max | The target number of CORE vCPUs in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.CoreVCPURunning.avg | The current number of CORE vCPUs running in a cluster. | long | | gauge | | aws.elasticmapreduce.metrics.CorruptBlocks.max | The number of blocks that HDFS reports as corrupted. | long | | gauge | -| aws.elasticmapreduce.metrics.DfsPendingReplicationBlocks.sum | The status of block replication - blocks being replicated, age of replication requests, and unsuccessful replication requests. | long | | counter | -| aws.elasticmapreduce.metrics.HDFSBytesRead.sum | The number of bytes read from HDFS. | long | byte | counter | -| aws.elasticmapreduce.metrics.HDFSBytesWritten.sum | The number of bytes written to HDFS. | long | byte | counter | +| aws.elasticmapreduce.metrics.DfsPendingReplicationBlocks.sum | The status of block replication - blocks being replicated, age of replication requests, and unsuccessful replication requests. | long | | gauge | +| aws.elasticmapreduce.metrics.HDFSBytesRead.sum | The number of bytes read from HDFS. | long | byte | gauge | +| aws.elasticmapreduce.metrics.HDFSBytesWritten.sum | The number of bytes written to HDFS. | long | byte | gauge | | aws.elasticmapreduce.metrics.HDFSUtilization.avg | The percentage of HDFS storage currently used. | double | percent | gauge | | aws.elasticmapreduce.metrics.IsIdle.avg | Indicates that a cluster is no longer performing work, but is still alive and accruing charges. | long | percent | gauge | | aws.elasticmapreduce.metrics.LiveDataNodes.avg | The percentage of data nodes that are receiving work from Hadoop. | double | percent | gauge | -| aws.elasticmapreduce.metrics.MRActiveNodes.sum | The number of nodes presently running MapReduce tasks or jobs. | long | | counter | -| aws.elasticmapreduce.metrics.MRDecommissionedNodes.sum | The number of nodes allocated to MapReduce applications that have been marked in a DECOMMISSIONED state. | long | | counter | -| aws.elasticmapreduce.metrics.MRLostNodes.sum | The number of nodes allocated to MapReduce that have been marked in a LOST state. | long | | counter | -| aws.elasticmapreduce.metrics.MRRebootedNodes.sum | The number of nodes available to MapReduce that have been rebooted and marked in a REBOOTED state. | long | | counter | -| aws.elasticmapreduce.metrics.MRTotalNodes.sum | The number of nodes presently available to MapReduce jobs. | long | | counter | -| aws.elasticmapreduce.metrics.MRUnhealthyNodes.sum | The number of nodes available to MapReduce jobs marked in an UNHEALTHY state. | long | | counter | -| aws.elasticmapreduce.metrics.MemoryAllocatedMB.sum | The amount of memory allocated to the cluster. | long | byte | counter | -| aws.elasticmapreduce.metrics.MemoryAvailableMB.sum | The amount of memory available to be allocated. | long | byte | counter | -| aws.elasticmapreduce.metrics.MemoryReservedMB.sum | The amount of memory reserved. | long | byte | counter | -| aws.elasticmapreduce.metrics.MemoryTotalMB.sum | The total amount of memory in the cluster. | long | byte | counter | +| aws.elasticmapreduce.metrics.MRActiveNodes.sum | The number of nodes presently running MapReduce tasks or jobs. | long | | gauge | +| aws.elasticmapreduce.metrics.MRDecommissionedNodes.sum | The number of nodes allocated to MapReduce applications that have been marked in a DECOMMISSIONED state. | long | | gauge | +| aws.elasticmapreduce.metrics.MRLostNodes.sum | The number of nodes allocated to MapReduce that have been marked in a LOST state. | long | | gauge | +| aws.elasticmapreduce.metrics.MRRebootedNodes.sum | The number of nodes available to MapReduce that have been rebooted and marked in a REBOOTED state. | long | | gauge | +| aws.elasticmapreduce.metrics.MRTotalNodes.sum | The number of nodes presently available to MapReduce jobs. | long | | gauge | +| aws.elasticmapreduce.metrics.MRUnhealthyNodes.sum | The number of nodes available to MapReduce jobs marked in an UNHEALTHY state. | long | | gauge | +| aws.elasticmapreduce.metrics.MemoryAllocatedMB.sum | The amount of memory allocated to the cluster. | long | byte | gauge | +| aws.elasticmapreduce.metrics.MemoryAvailableMB.sum | The amount of memory available to be allocated. | long | byte | gauge | +| aws.elasticmapreduce.metrics.MemoryReservedMB.sum | The amount of memory reserved. | long | byte | gauge | +| aws.elasticmapreduce.metrics.MemoryTotalMB.sum | The total amount of memory in the cluster. | long | byte | gauge | | aws.elasticmapreduce.metrics.MissingBlocks.max | The number of blocks in which HDFS has no replicas. | long | | gauge | -| aws.elasticmapreduce.metrics.MultiMasterInstanceGroupNodesRequested.sum | The number of requested master nodes. | long | | counter | -| aws.elasticmapreduce.metrics.MultiMasterInstanceGroupNodesRunning.sum | The number of running master nodes. | long | | counter | +| aws.elasticmapreduce.metrics.MultiMasterInstanceGroupNodesRequested.sum | The number of requested master nodes. | long | | gauge | +| aws.elasticmapreduce.metrics.MultiMasterInstanceGroupNodesRunning.sum | The number of running master nodes. | long | | gauge | | aws.elasticmapreduce.metrics.MultiMasterInstanceGroupNodesRunningPercentage.avg | The percentage of master nodes that are running over the requested master node instance count. | double | percent | gauge | -| aws.elasticmapreduce.metrics.PendingDeletionBlocks.sum | The number of blocks marked for deletion. | long | | counter | -| aws.elasticmapreduce.metrics.S3BytesRead.sum | The number of bytes read from Amazon S3. | long | byte | counter | -| aws.elasticmapreduce.metrics.S3BytesWritten.sum | The number of bytes written to Amazon S3. | long | byte | counter | +| aws.elasticmapreduce.metrics.PendingDeletionBlocks.sum | The number of blocks marked for deletion. | long | | gauge | +| aws.elasticmapreduce.metrics.S3BytesRead.sum | The number of bytes read from Amazon S3. | long | byte | gauge | +| aws.elasticmapreduce.metrics.S3BytesWritten.sum | The number of bytes written to Amazon S3. | long | byte | gauge | | aws.elasticmapreduce.metrics.TaskNodesRequested.max | The target number of TASK nodes in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TaskNodesRunning.avg | The current number of TASK nodes running in a cluster. | long | | gauge | | aws.elasticmapreduce.metrics.TaskUnitsRequested.max | The target number of TASK units in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TaskUnitsRunning.avg | The current number of TASK units running in a cluster. | long | | gauge | | aws.elasticmapreduce.metrics.TaskVCPURequested.max | The target number of TASK vCPUs in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TaskVCPURunning.avg | The current number of TASK vCPUs running in a cluster. | long | | gauge | -| aws.elasticmapreduce.metrics.TotalLoad.sum | The total number of concurrent data transfers. | long | | counter | +| aws.elasticmapreduce.metrics.TotalLoad.sum | The total number of concurrent data transfers. | long | | gauge | | aws.elasticmapreduce.metrics.TotalNodesRequested.max | The target total number of nodes in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TotalNodesRunning.avg | The current total number of nodes available in a running cluster. | long | | gauge | -| aws.elasticmapreduce.metrics.TotalNotebookKernels.sum | The total number of running and idle notebook kernels on the cluster. | long | | counter | +| aws.elasticmapreduce.metrics.TotalNotebookKernels.sum | The total number of running and idle notebook kernels on the cluster. | long | | gauge | | aws.elasticmapreduce.metrics.TotalUnitsRequested.max | The target total number of units in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TotalUnitsRunning.avg | The current total number of units available in a running cluster. | long | | gauge | | aws.elasticmapreduce.metrics.TotalVCPURequested.max | The target total number of vCPUs in a cluster as determined by managed scaling. | long | | gauge | | aws.elasticmapreduce.metrics.TotalVCPURunning.avg | The current total number of vCPUs available in a running cluster. | long | | gauge | -| aws.elasticmapreduce.metrics.UnderReplicatedBlocks.sum | The number of blocks that need to be replicated one or more times. | long | | counter | +| aws.elasticmapreduce.metrics.UnderReplicatedBlocks.sum | The number of blocks that need to be replicated one or more times. | long | | gauge | | aws.elasticmapreduce.metrics.YARNMemoryAvailablePercentage.avg | The percentage of remaining memory available to YARN | double | percent | gauge | | aws.s3.bucket.name | Name of a S3 bucket. | keyword | | | | aws.tags.\* | Tag key value pairs from aws resources. | object | | | @@ -213,3 +217,88 @@ An example event for `emr` looks as following: | host.os.version | Operating system version as a raw string. | keyword | | | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + + +## Logs reference + +An example event for `emr` looks as following: + +```json +{ + "data_stream": { + "namespace": "default", + "type": "logs", + "dataset": "aws.emr_logs" + }, + "@timestamp": "2020-02-20T07:01:01.000Z", + "ecs": { + "version": "8.0.0" + }, + "log": { + "level": "INFO" + }, + "event": { + "original": "2023-06-26 13:45:50,566 INFO common.Util: dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling" + }, + "process": { + "name": "blockmanagement.BlockManager" + }, + "message": "dfs.datanode.fileio.profiling.sampling.percentage set to 0. Disabling file IO profiling", + "tags": [ + "preserve_original_event" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword | +| aws.s3.bucket.name | Name of a S3 bucket. | keyword | +| aws.s3.metadata | AWS S3 object metadata values. | flattened | +| aws.s3.object.key | Name of the S3 object that this log retrieved from. | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host, resource, or service is located. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.dataset | Event dataset | constant_keyword | +| event.module | Event module | constant_keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| process.entrypoint | Process entrypoint. | keyword | +| process.message | Process message. | keyword | +| process.name | Process name. | keyword | +| tags | List of keywords used to tag each event. | keyword | diff --git a/packages/aws/docs/vpcflow.md b/packages/aws/docs/vpcflow.md index cd358707f70..26ad7a89ef3 100644 --- a/packages/aws/docs/vpcflow.md +++ b/packages/aws/docs/vpcflow.md @@ -85,6 +85,10 @@ The `number_of_workers` setting defines the number of workers assigned to readin | Field | Description | Type | |---|---|---| | @timestamp | Event timestamp. | date | +| aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword | +| aws.s3.bucket.name | Name of a S3 bucket. | keyword | +| aws.s3.metadata | AWS S3 object metadata values. | flattened | +| aws.s3.object.key | Name of the S3 object that this log retrieved from. | keyword | | aws.vpcflow.account_id | The AWS account ID for the flow log. | keyword | | aws.vpcflow.action | The action that is associated with the traffic, ACCEPT or REJECT. | keyword | | aws.vpcflow.instance_id | The ID of the instance that's associated with network interface for which the traffic is recorded, if the instance is owned by you. | keyword | diff --git a/packages/aws/img/filebeat-aws-apigateway-overview.png b/packages/aws/img/filebeat-aws-apigateway-overview.png new file mode 100644 index 00000000000..efdd4d382e0 Binary files /dev/null and b/packages/aws/img/filebeat-aws-apigateway-overview.png differ diff --git a/packages/aws/img/filebeat-aws-emr-overview.png b/packages/aws/img/filebeat-aws-emr-overview.png new file mode 100644 index 00000000000..6e27933a4a0 Binary files /dev/null and b/packages/aws/img/filebeat-aws-emr-overview.png differ diff --git a/packages/aws/img/filebeat-aws-firewall-alerts.png b/packages/aws/img/filebeat-aws-firewall-alerts.png index 3c478366d1c..195be257e05 100644 Binary files a/packages/aws/img/filebeat-aws-firewall-alerts.png and b/packages/aws/img/filebeat-aws-firewall-alerts.png differ diff --git a/packages/aws/img/filebeat-aws-firewall-flows.png b/packages/aws/img/filebeat-aws-firewall-flows.png index 9c2337ac549..5e3c1961e57 100644 Binary files a/packages/aws/img/filebeat-aws-firewall-flows.png and b/packages/aws/img/filebeat-aws-firewall-flows.png differ diff --git a/packages/aws/img/filebeat-aws-firewall-overview.png b/packages/aws/img/filebeat-aws-firewall-overview.png index b868846151c..048bdd0fe8f 100644 Binary files a/packages/aws/img/filebeat-aws-firewall-overview.png and b/packages/aws/img/filebeat-aws-firewall-overview.png differ diff --git a/packages/aws/img/filebeat-aws-s3access-overview.png b/packages/aws/img/filebeat-aws-s3access-overview.png index ed5f9c42fd0..10201f334a3 100644 Binary files a/packages/aws/img/filebeat-aws-s3access-overview.png and b/packages/aws/img/filebeat-aws-s3access-overview.png differ diff --git a/packages/aws/img/filebeat-aws-vpcflow-overview.png b/packages/aws/img/filebeat-aws-vpcflow-overview.png index 15eee187641..85da48705e7 100644 Binary files a/packages/aws/img/filebeat-aws-vpcflow-overview.png and b/packages/aws/img/filebeat-aws-vpcflow-overview.png differ diff --git a/packages/aws/img/metricbeat-aws-billing-overview.png b/packages/aws/img/metricbeat-aws-billing-overview.png index fc7bf1c664f..298f970839f 100644 Binary files a/packages/aws/img/metricbeat-aws-billing-overview.png and b/packages/aws/img/metricbeat-aws-billing-overview.png differ diff --git a/packages/aws/img/metricbeat-aws-redshift-overview.png b/packages/aws/img/metricbeat-aws-redshift-overview.png index 3f9cda8fa78..265f1a75570 100644 Binary files a/packages/aws/img/metricbeat-aws-redshift-overview.png and b/packages/aws/img/metricbeat-aws-redshift-overview.png differ diff --git a/packages/aws/img/securityhub_summary_dashboard.png b/packages/aws/img/securityhub_summary_dashboard.png index 4d066916bba..e8930944ffd 100644 Binary files a/packages/aws/img/securityhub_summary_dashboard.png and b/packages/aws/img/securityhub_summary_dashboard.png differ diff --git a/packages/aws/kibana/dashboard/aws-15503340-4488-11ea-ad63-791a5dc86f10.json b/packages/aws/kibana/dashboard/aws-15503340-4488-11ea-ad63-791a5dc86f10.json index 1fb9acec837..f87decc844e 100644 --- a/packages/aws/kibana/dashboard/aws-15503340-4488-11ea-ad63-791a5dc86f10.json +++ b/packages/aws/kibana/dashboard/aws-15503340-4488-11ea-ad63-791a5dc86f10.json @@ -1,14 +1,12 @@ { - "id": "aws-15503340-4488-11ea-ad63-791a5dc86f10", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg0NSwxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"646957e1-54a2-4461-b862-eebe7b8d6bcc\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"646957e1-54a2-4461-b862-eebe7b8d6bcc\",\"fieldName\":\"aws.s3.bucket.name\",\"title\":\"S3 Bucket Names\",\"enhancements\":{}}}}" + }, "description": "Logs AWS VPC Flow Log Overview Dashboard", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,80 +18,196 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "title": "S3 Bucket Filter", - "savedVis": { - "title": "S3 Bucket Name Filter [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "controls": [ + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "86cfaa02-f45b-4de6-9017-0e0cdd3b274b": { + "columnOrder": [ + "841feb22-9e6e-46da-86fb-4060376ac1a0", + "cbf8de11-c02e-4e2f-948f-265d60459706" + ], + "columns": { + "841feb22-9e6e-46da-86fb-4060376ac1a0": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 10 values of source.ip", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cbf8de11-c02e-4e2f-948f-265d60459706", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "cbf8de11-c02e-4e2f-948f-265d60459706": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.vpcflow\" " + }, + "isBucketed": false, + "label": "IP address", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "reducedTimeRange": "", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ { - "fieldName": "aws.s3.bucket.name", - "id": "1565034367477", - "indexPatternRefName": "control_0_index_pattern", - "label": "S3 Bucket Names", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-86cfaa02-f45b-4de6-9017-0e0cdd3b274b", + "type": "index-pattern" } ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": true - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "cbf8de11-c02e-4e2f-948f-265d60459706" + ], + "layerId": "86cfaa02-f45b-4de6-9017-0e0cdd3b274b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "xAccessor": "841feb22-9e6e-46da-86fb-4060376ac1a0", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(115,216,255,1)", + "forAccessor": "cbf8de11-c02e-4e2f-948f-265d60459706" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": false + }, + "valueLabels": "show" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 5, - "i": "c802177f-038c-4a35-a82d-0fa42c857d02", + "h": 17, + "i": "3dde08df-2d7e-464e-825d-03179e43e175", "w": 18, "x": 0, "y": 0 }, - "panelIndex": "c802177f-038c-4a35-a82d-0fa42c857d02", - "title": "S3 Bucket Filter", - "version": "8.0.0", - "type": "visualization" + "panelIndex": "3dde08df-2d7e-464e-825d-03179e43e175", + "title": "VPC Flow Top IP Addresses", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"alpha\":1,\"id\":\"842c201e-96d7-413d-8688-de5ee4f8a1e0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"401944dd-a371-4698-be17-bc4542e9a5d4\",\"label\":\"vpc flow action accept\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"aws.vpcflow.action : \\\"ACCEPT\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"destination.geo.location\",\"id\":\"97903038-e08d-4451-bbd2-eb92c894bdf5\",\"scalingType\":\"LIMIT\",\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#1EA593\"},\"type\":\"STATIC\"},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":5},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#167a6d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true},{\"alpha\":0.75,\"id\":\"b1d44a5c-3a04-4c80-8080-57585b02fd48\",\"label\":\"vpc flow action reject\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"aws.vpcflow.action : \\\"REJECT\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"9c0e7cce-4f21-4bcd-bb50-ae36c0fffffb\",\"scalingType\":\"LIMIT\",\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\",\"indexPatternRefName\":\"layer_2_source_index_pattern\"},\"style\":{\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#f00f0b\"},\"type\":\"STATIC\"},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":5},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#7a1a18\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"center\":{\"lat\":0,\"lon\":-108.92402},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"now-15d\",\"to\":\"now\"},\"zoom\":0.47,\"settings\":{\"autoFitToDataBounds\":false}}", + "title": "VPC Flow Action Geo Location[Logs AWS]", + "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], "isLayerTOCOpen": true, "mapCenter": { "lat": 12.09237, "lon": 60.11722, "zoom": 0.47 }, - "openTOCDetails": [], - "title": "VPC Flow Action Geo Location", - "attributes": { - "title": "VPC Flow Action Geo Location[Logs AWS]", - "description": "", - "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}", - "mapStateJSON": "{\"center\":{\"lat\":0,\"lon\":-108.92402},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"now-15d\",\"to\":\"now\"},\"zoom\":0.47,\"settings\":{\"autoFitToDataBounds\":false}}", - "layerListJSON": "[{\"alpha\":1,\"id\":\"842c201e-96d7-413d-8688-de5ee4f8a1e0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"401944dd-a371-4698-be17-bc4542e9a5d4\",\"label\":\"vpc flow action accept\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"aws.vpcflow.action : \\\"ACCEPT\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"destination.geo.location\",\"id\":\"97903038-e08d-4451-bbd2-eb92c894bdf5\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#1EA593\"},\"type\":\"STATIC\"},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":5},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#167a6d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true},{\"alpha\":0.75,\"id\":\"b1d44a5c-3a04-4c80-8080-57585b02fd48\",\"label\":\"vpc flow action reject\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"aws.vpcflow.action : \\\"REJECT\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"9c0e7cce-4f21-4bcd-bb50-ae36c0fffffb\",\"indexPatternRefName\":\"layer_2_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"@timestamp\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#f00f0b\"},\"type\":\"STATIC\"},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":5},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#7a1a18\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]" - } + "openTOCDetails": [] }, "gridData": { "h": 17, @@ -104,277 +218,347 @@ }, "panelIndex": "380eed85-225b-4d5d-88bc-1c70a3643ddb", "title": "VPC Flow Action Geo Location", - "version": "8.1.0", - "type": "map" + "type": "map", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "VPC Flow Top IP Addresses", - "savedVis": { - "title": "VPC Flow Top IP Addresses [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_min": "0", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "29527130-3e86-11ea-9067-cf383a4ea3b3" - } - ], - "bar_color_rules": [ - { - "id": "cc6d5070-3e85-11ea-9067-cf383a4ea3b3" - } - ], - "gauge_color_rules": [ - { - "id": "2b29c940-3e86-11ea-9067-cf383a4ea3b3" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "legend_position": "bottom", - "pivot_id": "user_agent.original", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(115,216,255,1)", - "color_rules": [ - { - "id": "42e14220-3e86-11ea-9067-cf383a4ea3b3" - } - ], - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.vpcflow\" " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "IP address", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" + }, + "datasourceStates": { + "formBased": { + "layers": { + "3a3d34c2-5e9f-40a0-8c76-8d98046bdb0a": { + "columnOrder": [ + "70e9ae97-07d7-4c12-baa5-046451c4c111", + "96fa67a4-29c8-47a5-9b80-e33b59e74db1" + ], + "columns": { + "70e9ae97-07d7-4c12-baa5-046451c4c111": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "96fa67a4-29c8-47a5-9b80-e33b59e74db1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.vpcflow\"" + }, + "isBucketed": false, + "label": "Total Requests", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + }, + "50e2716e-87bd-4221-a6ad-ca3af32d3391": { + "columnOrder": [ + "8d4086ff-105d-4c5a-99ee-322d8f76915c", + "becfb4b6-83cb-43aa-b34a-fb594d89f39b" + ], + "columns": { + "8d4086ff-105d-4c5a-99ee-322d8f76915c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "becfb4b6-83cb-43aa-b34a-fb594d89f39b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"-\" " + }, + "isBucketed": false, + "label": "-", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + }, + "e967d5d6-33cd-4795-b409-aacf9e3c5e53": { + "columnOrder": [ + "24c316fc-f587-40a5-b4ab-1e783b930024", + "844187f7-6228-4e42-b9c0-812008499e60" + ], + "columns": { + "24c316fc-f587-40a5-b4ab-1e783b930024": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "844187f7-6228-4e42-b9c0-812008499e60": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"ACCEPT\" " + }, + "isBucketed": false, + "label": "ACCEPT", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "40c52370-3e87-11ea-9067-cf383a4ea3b3", - "type": "cumulative_sum" + "f4910fcb-12d5-46bf-980a-f68dde0f12d2": { + "columnOrder": [ + "ebc79e52-2cb8-4014-a32e-f840aef9f647", + "f3b4e399-2bbb-4767-999d-8b4b952732b6" + ], + "columns": { + "ebc79e52-2cb8-4014-a32e-f840aef9f647": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3b4e399-2bbb-4767-999d-8b4b952732b6": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"REJECT\" " + }, + "isBucketed": false, + "label": "REJECT", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} } - ], - "override_index_pattern": 1, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": "logs-*", - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "source.ip", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "top_n", - "use_kibana_indexes": false, - "hide_last_value_indicator": true, - "drop_last_bucket": 1 - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "gridData": { - "h": 12, - "i": "3dde08df-2d7e-464e-825d-03179e43e175", - "w": 18, - "x": 0, - "y": 5 - }, - "panelIndex": "3dde08df-2d7e-464e-825d-03179e43e175", - "title": "VPC Flow Top IP Addresses", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "title": "VPC Flow Total Requests", - "savedVis": { - "title": "VPC Flow Total Requests [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_min": "0", - "axis_position": "left", - "axis_scale": "normal", - "background_color": "rgba(255,255,255,1)", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "legend_position": "right", - "series": [ + }, + "filters": [], + "internalReferences": [ { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(211,49,21,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"REJECT\" " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "REJECT", - "line_width": "2", - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "override_index_pattern": 1, - "point_size": "3", - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": "logs-*", - "series_time_field": "@timestamp", - "split_color_mode": "rainbow", - "split_mode": "everything", - "stacked": "none", - "terms_field": "aws.vpcflow.action", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-3a3d34c2-5e9f-40a0-8c76-8d98046bdb0a", + "type": "index-pattern" }, { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,188,0,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"ACCEPT\" " - }, - "formatter": "number", - "id": "7ec99260-4485-11ea-9ee9-2d27e9149ae8", - "label": "ACCEPT", - "line_width": "2", - "metrics": [ - { - "id": "7ec99261-4485-11ea-9ee9-2d27e9149ae8", - "type": "count" - } - ], - "override_index_pattern": 1, - "point_size": "3", - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": "logs-*", - "series_time_field": "@timestamp", - "split_color_mode": "rainbow", - "split_mode": "everything", - "stacked": "none", - "terms_field": "aws.vpcflow.action", - "terms_order_by": "7ec99261-4485-11ea-9ee9-2d27e9149ae8", - "type": "timeseries" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-50e2716e-87bd-4221-a6ad-ca3af32d3391", + "type": "index-pattern" }, { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.vpcflow\" and aws.vpcflow.action : \"-\" " - }, - "formatter": "number", - "id": "8d550580-4485-11ea-9ee9-2d27e9149ae8", - "label": "-", - "line_width": "2", - "metrics": [ - { - "id": "8d552c90-4485-11ea-9ee9-2d27e9149ae8", - "type": "count" - } - ], - "override_index_pattern": 1, - "point_size": "3", - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": "logs-*", - "series_time_field": "@timestamp", - "split_color_mode": "rainbow", - "split_mode": "everything", - "stacked": "none", - "terms_field": "aws.vpcflow.action", - "terms_order_by": "8d552c90-4485-11ea-9ee9-2d27e9149ae8", - "type": "timeseries" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-e967d5d6-33cd-4795-b409-aacf9e3c5e53", + "type": "index-pattern" }, { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(115,216,255,1)", - "fill": "0.5", - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.vpcflow\"" - }, - "formatter": "number", - "id": "c8c27df0-4485-11ea-9ee9-2d27e9149ae8", - "label": "Total Requests", - "line_width": "2", - "metrics": [ - { - "id": "c8c27df1-4485-11ea-9ee9-2d27e9149ae8", - "type": "count" - } - ], - "override_index_pattern": 1, - "point_size": "3", - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": "logs-*", - "series_time_field": "@timestamp", - "split_color_mode": "rainbow", - "split_mode": "everything", - "stacked": "none", - "terms_field": "aws.vpcflow.action", - "terms_order_by": "c8c27df1-4485-11ea-9ee9-2d27e9149ae8", - "type": "timeseries" + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-f4910fcb-12d5-46bf-980a-f68dde0f12d2", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f3b4e399-2bbb-4767-999d-8b4b952732b6" + ], + "layerId": "f4910fcb-12d5-46bf-980a-f68dde0f12d2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "ebc79e52-2cb8-4014-a32e-f840aef9f647", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(211,49,21,1)", + "forAccessor": "f3b4e399-2bbb-4767-999d-8b4b952732b6" + } + ] + }, + { + "accessors": [ + "844187f7-6228-4e42-b9c0-812008499e60" + ], + "layerId": "e967d5d6-33cd-4795-b409-aacf9e3c5e53", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "24c316fc-f587-40a5-b4ab-1e783b930024", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "844187f7-6228-4e42-b9c0-812008499e60" + } + ] + }, + { + "accessors": [ + "becfb4b6-83cb-43aa-b34a-fb594d89f39b" + ], + "layerId": "50e2716e-87bd-4221-a6ad-ca3af32d3391", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "8d4086ff-105d-4c5a-99ee-322d8f76915c", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "becfb4b6-83cb-43aa-b34a-fb594d89f39b" + } + ] + }, + { + "accessors": [ + "96fa67a4-29c8-47a5-9b80-e33b59e74db1" + ], + "layerId": "3a3d34c2-5e9f-40a0-8c76-8d98046bdb0a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "70e9ae97-07d7-4c12-baa5-046451c4c111", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(115,216,255,1)", + "forAccessor": "96fa67a4-29c8-47a5-9b80-e33b59e74db1" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "Count" + } }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -385,12 +569,12 @@ }, "panelIndex": "f7c6de04-c771-47ff-a32d-00a7940e414a", "title": "VPC Flow Total Requests", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "VPC Flow Reject Logs" + "enhancements": {} }, "gridData": { "h": 15, @@ -400,39 +584,43 @@ "y": 29 }, "panelIndex": "b4dbbe72-0dc0-428b-b21e-91c6cc82745c", - "panelRefName": "panel_4", + "panelRefName": "panel_b4dbbe72-0dc0-428b-b21e-91c6cc82745c", "title": "VPC Flow Reject Logs", - "version": "7.4.0" + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs AWS] VPC Flow Log Overview", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-05-30T07:31:18.993Z", + "id": "aws-15503340-4488-11ea-ad63-791a5dc86f10", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "aws-c1aee600-4487-11ea-ad63-791a5dc86f10", - "name": "panel_4", - "type": "search" + "id": "logs-*", + "name": "380eed85-225b-4d5d-88bc-1c70a3643ddb:layer_1_source_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c802177f-038c-4a35-a82d-0fa42c857d02:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "380eed85-225b-4d5d-88bc-1c70a3643ddb:layer_2_source_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "380eed85-225b-4d5d-88bc-1c70a3643ddb:layer_1_source_index_pattern", - "id": "logs-*" + "id": "aws-c1aee600-4487-11ea-ad63-791a5dc86f10", + "name": "b4dbbe72-0dc0-428b-b21e-91c6cc82745c:panel_b4dbbe72-0dc0-428b-b21e-91c6cc82745c", + "type": "search" }, { - "type": "index-pattern", - "name": "380eed85-225b-4d5d-88bc-1c70a3643ddb:layer_2_source_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_646957e1-54a2-4461-b862-eebe7b8d6bcc:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc.json b/packages/aws/kibana/dashboard/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc.json index da713bde764..d24704d6e24 100644 --- a/packages/aws/kibana/dashboard/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc.json +++ b/packages/aws/kibana/dashboard/aws-2ba11b50-4b9d-11ec-8282-5342b8988acc.json @@ -1,14 +1,12 @@ { - "id": "aws-2ba11b50-4b9d-11ec-8282-5342b8988acc", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg0NywxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"475e2e65-d0a0-4f8e-ae71-2b5c71c68ed1\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"475e2e65-d0a0-4f8e-ae71-2b5c71c68ed1\",\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"enhancements\":{}}},\"e91b2714-66a3-4048-80b1-c440d4fc6070\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e91b2714-66a3-4048-80b1-c440d4fc6070\",\"fieldName\":\"cloud.availability_zone\",\"title\":\"Availability Zone\",\"enhancements\":{}}},\"e9da20a5-4e9e-4c81-a47c-193773c72f34\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e9da20a5-4e9e-4c81-a47c-193773c72f34\",\"fieldName\":\"observer.name\",\"title\":\"Firewall\",\"enhancements\":{}}}}" + }, "description": "Dashboard providing an overall view of the AWS Network Firewall integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -43,20 +41,12 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", - "w": 13, - "x": 0, - "y": 0 - }, - "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "embeddableConfig": { "enhancements": {}, "savedVis": { @@ -80,106 +70,20 @@ "title": "", "type": "markdown", "uiState": {} - }, - "type": "visualization" - } - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Firewall Filters [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1637591016076", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "cloud.availability_zone", - "id": "1637591029629", - "indexPatternRefName": "control_1_index_pattern", - "label": "Availability Zone", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "observer.name", - "id": "1637591118622", - "indexPatternRefName": "control_2_index_pattern", - "label": "Firewall", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } } }, "gridData": { - "h": 7, - "i": "2ece3b2b-326d-4856-b537-4de075cb5d5d", - "w": 35, - "x": 13, + "h": 16, + "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", + "w": 18, + "x": 0, "y": 0 }, - "panelIndex": "2ece3b2b-326d-4856-b537-4de075cb5d5d", - "title": "Firewall Filters", + "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "type": "visualization", - "version": "8.0.0" + "version": "8.8.1" }, { - "version": "8.1.0", - "type": "lens", - "gridData": { - "h": 8, - "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", - "w": 5, - "x": 13, - "y": 7 - }, - "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", "embeddableConfig": { "attributes": { "references": [ @@ -201,7 +105,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -212,10 +116,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Total Alerts", - "operationType": "count", + "label": "Unique Destination IPs", + "operationType": "unique_count", "scale": "ratio", - "sourceField": "___records___" + "sourceField": "destination.ip" } }, "incompleteColumns": {} @@ -231,13 +135,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { "query": "alert" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -253,30 +157,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Alerts" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3", - "w": 5, + "i": "b9d7f8b6-deb6-4d46-ad11-7793dd783012", + "w": 10, "x": 18, - "y": 7 + "y": 0 }, - "panelIndex": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3", + "panelIndex": "b9d7f8b6-deb6-4d46-ad11-7793dd783012", + "title": "Unique Destination IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -298,7 +204,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -309,10 +215,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Total Flows", - "operationType": "count", + "label": "Unique Source IPs", + "operationType": "unique_count", "scale": "ratio", - "sourceField": "___records___" + "sourceField": "source.ip" } }, "incompleteColumns": {} @@ -328,17 +234,17 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { - "query": "event" + "query": "alert" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { - "event.kind": "event" + "event.kind": "alert" } } } @@ -350,30 +256,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Flows" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "b9d7f8b6-deb6-4d46-ad11-7793dd783012", - "w": 5, - "x": 23, - "y": 7 + "i": "54c39a08-c881-4c64-af1a-8e48867947c3", + "w": 10, + "x": 28, + "y": 0 }, - "panelIndex": "b9d7f8b6-deb6-4d46-ad11-7793dd783012", + "panelIndex": "54c39a08-c881-4c64-af1a-8e48867947c3", + "title": "Unique Source IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -395,10 +303,11 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ + "b6504f22-c6eb-439d-bb4d-a3acc2b5de34", "775a9e84-2203-42bf-a775-f60ad2cd84ae" ], "columns": { @@ -406,10 +315,18 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Destination IPs", + "label": "Unique Network Protocols", "operationType": "unique_count", "scale": "ratio", - "sourceField": "destination.ip" + "sourceField": "network.protocol" + }, + "b6504f22-c6eb-439d-bb4d-a3acc2b5de34": { + "dataType": "number", + "isBucketed": false, + "label": "Unique count of network.protocol", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "network.protocol" } }, "incompleteColumns": {} @@ -425,17 +342,17 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { - "query": "alert" + "query": "event" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { - "event.kind": "alert" + "event.kind": "event" } } } @@ -447,30 +364,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Destination IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "54c39a08-c881-4c64-af1a-8e48867947c3", - "w": 5, - "x": 28, - "y": 7 + "i": "83dde1a0-0605-4c05-9bd2-1f2686cd7007", + "w": 10, + "x": 38, + "y": 0 }, - "panelIndex": "54c39a08-c881-4c64-af1a-8e48867947c3", + "panelIndex": "83dde1a0-0605-4c05-9bd2-1f2686cd7007", + "title": "Unique Network Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -492,7 +411,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -503,10 +422,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Source IPs", - "operationType": "unique_count", + "label": "Total Flows", + "operationType": "count", "scale": "ratio", - "sourceField": "source.ip" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -522,17 +441,17 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { - "query": "alert" + "query": "event" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { - "event.kind": "alert" + "event.kind": "event" } } } @@ -544,30 +463,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Source IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "83dde1a0-0605-4c05-9bd2-1f2686cd7007", - "w": 5, - "x": 33, - "y": 7 + "i": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3", + "w": 8, + "x": 18, + "y": 8 }, - "panelIndex": "83dde1a0-0605-4c05-9bd2-1f2686cd7007", + "panelIndex": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3", + "title": "Total Flows", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -589,11 +510,10 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ - "b6504f22-c6eb-439d-bb4d-a3acc2b5de34", "775a9e84-2203-42bf-a775-f60ad2cd84ae" ], "columns": { @@ -601,18 +521,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Network Protocols", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "network.protocol" - }, - "b6504f22-c6eb-439d-bb4d-a3acc2b5de34": { - "dataType": "number", - "isBucketed": false, - "label": "Unique count of network.protocol", - "operationType": "unique_count", + "label": "Total Alerts", + "operationType": "count", "scale": "ratio", - "sourceField": "network.protocol" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -628,17 +540,17 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { - "query": "event" + "query": "alert" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { - "event.kind": "event" + "event.kind": "alert" } } } @@ -650,30 +562,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Network Protocols" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "649add0f-9eb6-4cc8-be29-b0911e29827c", - "w": 5, - "x": 38, - "y": 7 + "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "w": 8, + "x": 26, + "y": 8 }, - "panelIndex": "649add0f-9eb6-4cc8-be29-b0911e29827c", + "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "title": "Total Alerts", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -695,7 +609,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -742,13 +656,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { "query": "event" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -764,30 +678,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Bytes" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "c070e106-ce00-4096-be3d-b528119f0828", - "w": 5, - "x": 43, - "y": 7 + "i": "649add0f-9eb6-4cc8-be29-b0911e29827c", + "w": 7, + "x": 34, + "y": 8 }, - "panelIndex": "c070e106-ce00-4096-be3d-b528119f0828", + "panelIndex": "649add0f-9eb6-4cc8-be29-b0911e29827c", + "title": "Total Bytes", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -809,7 +725,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -849,13 +765,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.kind", "negate": false, "params": { "query": "event" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -871,30 +787,32 @@ "visualization": { "accessor": "775a9e84-2203-42bf-a775-f60ad2cd84ae", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Bytes" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 16, - "i": "f933435c-1f7d-4cb0-87eb-6c23c6ad6dbb", - "w": 28, - "x": 0, - "y": 15 + "h": 8, + "i": "c070e106-ce00-4096-be3d-b528119f0828", + "w": 7, + "x": 41, + "y": 8 }, - "panelIndex": "f933435c-1f7d-4cb0-87eb-6c23c6ad6dbb", + "panelIndex": "c070e106-ce00-4096-be3d-b528119f0828", + "title": "Total Bytes", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -911,7 +829,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8c1d8a18-0da5-431f-8faf-f72f028b10de": { "columnOrder": [ @@ -944,6 +862,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -1001,6 +920,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1023,22 +943,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Events" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 16, - "i": "bcfbc5f5-fd40-48e3-937d-965fcb8a5585", - "w": 20, - "x": 28, - "y": 15 + "i": "f933435c-1f7d-4cb0-87eb-6c23c6ad6dbb", + "w": 28, + "x": 0, + "y": 16 }, - "panelIndex": "bcfbc5f5-fd40-48e3-937d-965fcb8a5585", + "panelIndex": "f933435c-1f7d-4cb0-87eb-6c23c6ad6dbb", + "title": "Events", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1055,7 +974,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b2bc813b-af38-4aac-bf1f-7d3b6f3aa51c": { "columnOrder": [ @@ -1153,6 +1072,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_horizontal", @@ -1175,10 +1095,19 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Events by Firewall" + "gridData": { + "h": 16, + "i": "bcfbc5f5-fd40-48e3-937d-965fcb8a5585", + "w": 20, + "x": 28, + "y": 16 + }, + "panelIndex": "bcfbc5f5-fd40-48e3-937d-965fcb8a5585", + "title": "Total Events by Firewall", + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { @@ -1199,19 +1128,25 @@ "i": "fc5a3028-fdfc-4c3c-ab04-f43123af380b", "w": 48, "x": 0, - "y": 31 + "y": 32 }, "panelIndex": "fc5a3028-fdfc-4c3c-ab04-f43123af380b", "panelRefName": "panel_fc5a3028-fdfc-4c3c-ab04-f43123af380b", "title": "Firewall Logs", "type": "search", - "version": "7.15.1" + "version": "8.8.1" } ], "timeRestore": false, "title": "[Logs AWS] Firewall Overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T09:17:37.345Z", + "id": "aws-2ba11b50-4b9d-11ec-8282-5342b8988acc", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "logs-*", @@ -1220,77 +1155,77 @@ }, { "id": "logs-*", - "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-current-indexpattern", + "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:filter-index-pattern-0", + "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:indexpattern-datasource-current-indexpattern", + "name": "54c39a08-c881-4c64-af1a-8e48867947c3:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "54c39a08-c881-4c64-af1a-8e48867947c3:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:filter-index-pattern-0", + "name": "54c39a08-c881-4c64-af1a-8e48867947c3:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:indexpattern-datasource-current-indexpattern", + "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "b9d7f8b6-deb6-4d46-ad11-7793dd783012:filter-index-pattern-0", + "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "54c39a08-c881-4c64-af1a-8e48867947c3:indexpattern-datasource-current-indexpattern", + "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "54c39a08-c881-4c64-af1a-8e48867947c3:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "54c39a08-c881-4c64-af1a-8e48867947c3:filter-index-pattern-0", + "name": "e8d2a7be-bc2a-4ca5-ae71-5273156084b3:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:indexpattern-datasource-current-indexpattern", + "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "83dde1a0-0605-4c05-9bd2-1f2686cd7007:filter-index-pattern-0", + "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:filter-index-pattern-0", "type": "index-pattern" }, { @@ -1349,23 +1284,20 @@ "type": "search" }, { - "type": "index-pattern", - "name": "2ece3b2b-326d-4856-b537-4de075cb5d5d:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_475e2e65-d0a0-4f8e-ae71-2b5c71c68ed1:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "2ece3b2b-326d-4856-b537-4de075cb5d5d:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_e91b2714-66a3-4048-80b1-c440d4fc6070:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "2ece3b2b-326d-4856-b537-4de075cb5d5d:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_e9da20a5-4e9e-4c81-a47c-193773c72f34:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-3abffe60-4ba9-11ec-8282-5342b8988acc.json b/packages/aws/kibana/dashboard/aws-3abffe60-4ba9-11ec-8282-5342b8988acc.json index d9a9b6afaee..36122db6406 100644 --- a/packages/aws/kibana/dashboard/aws-3abffe60-4ba9-11ec-8282-5342b8988acc.json +++ b/packages/aws/kibana/dashboard/aws-3abffe60-4ba9-11ec-8282-5342b8988acc.json @@ -123,7 +123,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "32700201-1770-46bd-9ee6-64cad8904bdc", "layerType": "data", "metricAccessor": "120709bf-e5a1-4646-9ee7-ae2d5d5f144d" @@ -190,7 +189,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "32700201-1770-46bd-9ee6-64cad8904bdc", "layerType": "data", "metricAccessor": "120709bf-e5a1-4646-9ee7-ae2d5d5f144d" @@ -257,7 +255,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "layerType": "data", "metricAccessor": "9fc78ba7-ca2c-41da-8723-8f7c14623b98" @@ -324,7 +321,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "32700201-1770-46bd-9ee6-64cad8904bdc", "layerType": "data", "metricAccessor": "120709bf-e5a1-4646-9ee7-ae2d5d5f144d" @@ -391,7 +387,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "layerType": "data", "metricAccessor": "9f99f66f-4762-4030-9704-d215568cce9c" @@ -458,7 +453,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "layerType": "data", "metricAccessor": "9fc78ba7-ca2c-41da-8723-8f7c14623b98" diff --git a/packages/aws/kibana/dashboard/aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb.json b/packages/aws/kibana/dashboard/aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb.json index 8d5c0b41c8c..4fe55589e44 100644 --- a/packages/aws/kibana/dashboard/aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb.json +++ b/packages/aws/kibana/dashboard/aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb.json @@ -1,14 +1,6 @@ { - "id": "aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg1MiwxXQ==", "attributes": { "description": "Logs AWS S3 Server Access Log Overview Dashboard", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,136 +12,169 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "title": "Top URLs", - "savedVis": { - "title": "Top URLs [Logs AWS]", - "description": "", - "uiState": { - "vis": { - "colors": { - "404": "#EAB839" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e3977136-863c-4101-afdb-25130f0263b8", + "type": "index-pattern" } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 2, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "number", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } - }, - "params": {} + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e3977136-863c-4101-afdb-25130f0263b8": { + "columnOrder": [ + "3739613d-707c-44c0-92f6-d5b116591386", + "f8aa313c-7316-4d09-bdac-b3983b1db338", + "04d38e1e-d320-47b2-9088-16d241a5bb07" + ], + "columns": { + "04d38e1e-d320-47b2-9088-16d241a5bb07": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "3739613d-707c-44c0-92f6-d5b116591386": { + "customLabel": false, + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of aws.s3access.request_uri", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "04d38e1e-d320-47b2-9088-16d241a5bb07", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "aws.s3access.request_uri" + }, + "f8aa313c-7316-4d09-bdac-b3983b1db338": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "HTTP Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "04d38e1e-d320-47b2-9088-16d241a5bb07", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "aws.s3access.http_status" + } + }, + "incompleteColumns": {} + } } - ], - "metric": { - "accessor": 3, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} }, - "splitColumn": [ + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } + "accessors": [ + "04d38e1e-d320-47b2-9088-16d241a5bb07" + ], + "layerId": "e3977136-863c-4101-afdb-25130f0263b8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "params": {} + "seriesType": "bar_horizontal_stacked", + "splitAccessor": "f8aa313c-7316-4d09-bdac-b3983b1db338", + "xAccessor": "3739613d-707c-44c0-92f6-d5b116591386" } - ] - }, - "isDonut": false, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "row": false, - "palette": { - "type": "palette", - "name": "kibana_palette" - }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + ], + "legend": { + "isVisible": true, + "position": "right" }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Request Uri", - "field": "aws.s3access.request_uri", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "split", - "type": "terms" + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "HTTP Status", - "field": "aws.s3access.http_status", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" + "valueLabels": "show", + "yLeftExtent": { + "mode": "full", + "niceValues": true } } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -160,104 +185,200 @@ }, "panelIndex": "1", "title": "Top URLs", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "Http Status over time", - "savedVis": { - "title": "Http Status over time [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "lucene", - "query": "data_stream.dataset:aws.s3access" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "auto", - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Http Status", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "aws.s3access.http_status \u003c 300 and aws.s3access.http_status \u003e= 200" - }, - "id": "5acdc750-a29d-11e7-a062-a1c3587f4874", - "label": "200s" - }, - { - "color": "rgba(252,196,0,1)", - "filter": { - "language": "kuery", - "query": "aws.s3access.http_status \u003c 400 and aws.s3access.http_status \u003e= 300" + "datasourceStates": { + "formBased": { + "layers": { + "61669f3c-1aff-44c6-ad13-61e6a9ab3296": { + "columnOrder": [ + "293fa4d1-b5cb-4af3-b3f4-09c7194987e5", + "b5cbcf41-77b1-4436-bda0-6a65f91b9fcd", + "d3270734-6fa1-4c88-affb-f0b6707a242b" + ], + "columns": { + "293fa4d1-b5cb-4af3-b3f4-09c7194987e5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b5cbcf41-77b1-4436-bda0-6a65f91b9fcd": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "aws.s3access.http_status \u003c 300 and aws.s3access.http_status \u003e= 200" + }, + "label": "200s" + }, + { + "input": { + "language": "kuery", + "query": "aws.s3access.http_status \u003c 400 and aws.s3access.http_status \u003e= 300" + }, + "label": "300s" + }, + { + "input": { + "language": "kuery", + "query": "aws.s3access.http_status \u003c 500 and aws.s3access.http_status \u003e= 400" + }, + "label": "400s" + }, + { + "input": { + "language": "kuery", + "query": "aws.s3access.http_status \u003c 600 and aws.s3access.http_status \u003e= 500" + }, + "label": "500s" + } + ] + }, + "scale": "ordinal" + }, + "d3270734-6fa1-4c88-affb-f0b6707a242b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Http Status", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "id": "6efd2ae0-a29d-11e7-a062-a1c3587f4874", - "label": "300s" - }, - { - "color": "rgba(211,49,21,1)", - "filter": { - "language": "kuery", - "query": "aws.s3access.http_status \u003c 500 and aws.s3access.http_status \u003e= 400" - }, - "id": "76089a90-a29d-11e7-a062-a1c3587f4874", - "label": "400s" - }, - { - "color": "rgba(171,20,158,1)", - "filter": { - "language": "kuery", - "query": "aws.s3access.http_status \u003c 600 and aws.s3access.http_status \u003e= 500" - }, - "id": "7c7929d0-a29d-11e7-a062-a1c3587f4874", - "label": "500s" + "incompleteColumns": {} } - ], - "split_mode": "filters", - "stacked": "stacked", - "terms_field": "http.response.status_code", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417" + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-61669f3c-1aff-44c6-ad13-61e6a9ab3296", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d3270734-6fa1-4c88-affb-f0b6707a242b" + ], + "layerId": "61669f3c-1aff-44c6-ad13-61e6a9ab3296", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "splitAccessor": "b5cbcf41-77b1-4436-bda0-6a65f91b9fcd", + "xAccessor": "293fa4d1-b5cb-4af3-b3f4-09c7194987e5", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "d3270734-6fa1-4c88-affb-f0b6707a242b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -268,12 +389,12 @@ }, "panelIndex": "2", "title": "Http Status over time", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "Error Logs" + "enhancements": {} }, "gridData": { "h": 15, @@ -283,29 +404,33 @@ "y": 15 }, "panelIndex": "3", - "panelRefName": "panel_2", + "panelRefName": "panel_3", "title": "Error Logs", - "version": "7.4.0" + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs AWS] S3 Server Access Log Overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", + "id": "aws-4746e000-bacd-11e9-9f70-1f7bda85a5eb", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb", - "name": "panel_2", - "type": "search" + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-e3977136-863c-4101-afdb-25130f0263b8", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "1:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb", + "name": "3:panel_3", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-4c404390-2724-11ee-a3cb-33de1feb08f6.json b/packages/aws/kibana/dashboard/aws-4c404390-2724-11ee-a3cb-33de1feb08f6.json new file mode 100644 index 00000000000..7fbbef07bf0 --- /dev/null +++ b/packages/aws/kibana/dashboard/aws-4c404390-2724-11ee-a3cb-33de1feb08f6.json @@ -0,0 +1,319 @@ +{ + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "aws.emr_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "aws.emr_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-063f2b19-5cf4-4a39-a699-f00d4ab5aeae", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "063f2b19-5cf4-4a39-a699-f00d4ab5aeae": { + "columnOrder": [ + "82883b46-c5bf-426b-8145-8512134d9e46", + "5071a31f-c22c-4521-a95a-b091d815210f" + ], + "columns": { + "5071a31f-c22c-4521-a95a-b091d815210f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "82883b46-c5bf-426b-8145-8512134d9e46": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5071a31f-c22c-4521-a95a-b091d815210f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "process.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "82883b46-c5bf-426b-8145-8512134d9e46", + "isTransposed": false + }, + { + "columnId": "5071a31f-c22c-4521-a95a-b091d815210f", + "isTransposed": false + } + ], + "layerId": "063f2b19-5cf4-4a39-a699-f00d4ab5aeae", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "67059371-5528-45be-b6e0-1525e0e215cc", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "67059371-5528-45be-b6e0-1525e0e215cc", + "title": "Top Process Names", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c96dc367-7669-4582-8b49-d5dfaf453256", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c96dc367-7669-4582-8b49-d5dfaf453256": { + "columnOrder": [ + "ecb84283-f29f-4ad8-a24d-004dc1f78612", + "ce1a3d48-fcab-4c38-ada6-6330fbd87ffa" + ], + "columns": { + "ce1a3d48-fcab-4c38-ada6-6330fbd87ffa": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ecb84283-f29f-4ad8-a24d-004dc1f78612": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of log.level", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ce1a3d48-fcab-4c38-ada6-6330fbd87ffa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c96dc367-7669-4582-8b49-d5dfaf453256", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ce1a3d48-fcab-4c38-ada6-6330fbd87ffa" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ecb84283-f29f-4ad8-a24d-004dc1f78612" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "94471afc-1bf7-4bbc-8e33-1d234b4631a8", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "94471afc-1bf7-4bbc-8e33-1d234b4631a8", + "title": "Log Level", + "type": "lens", + "version": "8.8.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9d6500f1-b8a2-4b8a-a78b-32267bda7e45", + "w": 48, + "x": 0, + "y": 15 + }, + "panelIndex": "9d6500f1-b8a2-4b8a-a78b-32267bda7e45", + "panelRefName": "panel_9d6500f1-b8a2-4b8a-a78b-32267bda7e45", + "title": "EMR Logs", + "type": "search", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Logs AWS] EMR Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-20T17:49:07.190Z", + "id": "aws-4c404390-2724-11ee-a3cb-33de1feb08f6", + "managed": false, + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67059371-5528-45be-b6e0-1525e0e215cc:indexpattern-datasource-layer-063f2b19-5cf4-4a39-a699-f00d4ab5aeae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "94471afc-1bf7-4bbc-8e33-1d234b4631a8:indexpattern-datasource-layer-c96dc367-7669-4582-8b49-d5dfaf453256", + "type": "index-pattern" + }, + { + "id": "aws-c1543010-2724-11ee-a3cb-33de1feb08f6", + "name": "9d6500f1-b8a2-4b8a-a78b-32267bda7e45:panel_9d6500f1-b8a2-4b8a-a78b-32267bda7e45", + "type": "search" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-5465f0f0-26e4-11ee-9051-011d57d86fe2.json b/packages/aws/kibana/dashboard/aws-5465f0f0-26e4-11ee-9051-011d57d86fe2.json new file mode 100644 index 00000000000..5b36cae7216 --- /dev/null +++ b/packages/aws/kibana/dashboard/aws-5465f0f0-26e4-11ee-9051-011d57d86fe2.json @@ -0,0 +1,1046 @@ +{ + "attributes": { + "description": "Overview of AWS API Gateway Logs", + "controlGroupInput": { + "controlStyle": "oneLine", + "chainingSystem": "HIERARCHICAL", + "panelsJSON": "{\"8f39f203-e0d6-4567-bcae-8b2f875cf442\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"8f39f203-e0d6-4567-bcae-8b2f875cf442\",\"fieldName\":\"aws.apigateway.api_id\",\"title\":\"API ID\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"7acb90a0-4fc1-4ed9-bf45-2a00e082c705\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"7acb90a0-4fc1-4ed9-bf45-2a00e082c705\",\"fieldName\":\"aws.apigateway.domain_name\",\"title\":\"Domain Name\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"a9bf185b-ff91-4165-8584-6075e830a2b0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"a9bf185b-ff91-4165-8584-6075e830a2b0\",\"fieldName\":\"aws.apigateway.stage\",\"title\":\"Stage\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"14595511-24be-417b-af74-625ad0e7319a\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"14595511-24be-417b-af74-625ad0e7319a\",\"fieldName\":\"cloud.region\",\"title\":\"AWS Region\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}}}", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}" + }, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filter\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"aws.apigateway_logs\"},\"type\":\"phrase\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"aws.apigateway_logs\"}},\"$state\":{\"store\":\"appState\"}}]}" + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 0, + "y": 0, + "w": 16, + "h": 15, + "i": "124faec6-fedf-4a5c-b060-ab3f03a8cdbe" + }, + "panelIndex": "124faec6-fedf-4a5c-b060-ab3f03a8cdbe", + "embeddableConfig": { + "attributes": { + "title": "", + "description": "", + "visualizationType": "lnsPie", + "type": "lens", + "references": [ + { + "type": "index-pattern", + "id": "logs-*", + "name": "indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + } + ], + "state": { + "visualization": { + "shape": "treemap", + "layers": [ + { + "categoryDisplay": "default", + "layerId": "06dccdd0-c0b9-4519-a299-53546adbc735", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead" + ] + } + ] + }, + "query": { + "language": "kuery", + "query": "" + }, + "filters": [], + "datasourceStates": { + "formBased": { + "layers": { + "06dccdd0-c0b9-4519-a299-53546adbc735": { + "columnOrder": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead", + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "columns": { + "03ad11f6-344c-43a3-91fe-b70024c79ead": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of aws.apigateway.http_method", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "850d3e92-043f-4460-9290-10ca1311dc97", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.http_method" + }, + "850d3e92-043f-4460-9290-10ca1311dc97": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "internalReferences": [], + "adHocDataViews": {} + } + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "HTTP Method" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 32, + "y": 0, + "w": 16, + "h": 15, + "i": "9a82e092-0e19-4f51-8879-680d1ed0ba44" + }, + "panelIndex": "9a82e092-0e19-4f51-8879-680d1ed0ba44", + "embeddableConfig": { + "attributes": { + "title": "", + "description": "", + "visualizationType": "lnsPie", + "type": "lens", + "references": [ + { + "type": "index-pattern", + "id": "logs-*", + "name": "indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + } + ], + "state": { + "visualization": { + "shape": "treemap", + "layers": [ + { + "categoryDisplay": "default", + "layerId": "06dccdd0-c0b9-4519-a299-53546adbc735", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead" + ] + } + ] + }, + "query": { + "language": "kuery", + "query": "" + }, + "filters": [], + "datasourceStates": { + "formBased": { + "layers": { + "06dccdd0-c0b9-4519-a299-53546adbc735": { + "columnOrder": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead", + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "columns": { + "03ad11f6-344c-43a3-91fe-b70024c79ead": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of aws.apigateway.event_type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "850d3e92-043f-4460-9290-10ca1311dc97", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.event_type" + }, + "850d3e92-043f-4460-9290-10ca1311dc97": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "internalReferences": [], + "adHocDataViews": {} + } + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "[WebSocket] Event Type" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 0, + "y": 15, + "w": 16, + "h": 15, + "i": "245be50a-a099-4712-bbf5-2b6ce1368ec7" + }, + "panelIndex": "245be50a-a099-4712-bbf5-2b6ce1368ec7", + "embeddableConfig": { + "attributes": { + "references": [ + { + "name": "indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e0c50ea5-82ba-4ee6-be31-497faf705f15": { + "columnOrder": [ + "56bc0501-4f72-4b55-8998-f3aeceed9834", + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b" + ], + "columns": { + "56bc0501-4f72-4b55-8998-f3aeceed9834": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Path", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.resource_path" + }, + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "56bc0501-4f72-4b55-8998-f3aeceed9834" + }, + { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "isTransposed": false + } + ], + "layerId": "e0c50ea5-82ba-4ee6-be31-497faf705f15", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Top Accessed Resource Paths" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 16, + "y": 0, + "w": 16, + "h": 15, + "i": "92abd08c-7a30-4df3-bfae-31f101cd3f02" + }, + "panelIndex": "92abd08c-7a30-4df3-bfae-31f101cd3f02", + "embeddableConfig": { + "attributes": { + "title": "", + "description": "", + "visualizationType": "lnsPie", + "type": "lens", + "references": [ + { + "type": "index-pattern", + "id": "logs-*", + "name": "indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + } + ], + "state": { + "visualization": { + "shape": "treemap", + "layers": [ + { + "categoryDisplay": "default", + "layerId": "06dccdd0-c0b9-4519-a299-53546adbc735", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead" + ] + } + ] + }, + "query": { + "language": "kuery", + "query": "" + }, + "filters": [], + "datasourceStates": { + "formBased": { + "layers": { + "06dccdd0-c0b9-4519-a299-53546adbc735": { + "columnOrder": [ + "03ad11f6-344c-43a3-91fe-b70024c79ead", + "850d3e92-043f-4460-9290-10ca1311dc97" + ], + "columns": { + "03ad11f6-344c-43a3-91fe-b70024c79ead": { + "dataType": "number", + "isBucketed": true, + "label": "Top 10 values of aws.apigateway.status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "850d3e92-043f-4460-9290-10ca1311dc97", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.status" + }, + "850d3e92-043f-4460-9290-10ca1311dc97": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "internalReferences": [], + "adHocDataViews": {} + } + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Status Code" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 32, + "y": 15, + "w": 16, + "h": 15, + "i": "4df6f1a3-5307-4b0d-8e77-d2d1c1cfe423" + }, + "panelIndex": "4df6f1a3-5307-4b0d-8e77-d2d1c1cfe423", + "embeddableConfig": { + "attributes": { + "references": [ + { + "name": "indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e0c50ea5-82ba-4ee6-be31-497faf705f15": { + "columnOrder": [ + "56bc0501-4f72-4b55-8998-f3aeceed9834", + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b" + ], + "columns": { + "56bc0501-4f72-4b55-8998-f3aeceed9834": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "IP Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.ip_address" + }, + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "56bc0501-4f72-4b55-8998-f3aeceed9834" + }, + { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "isTransposed": false + } + ], + "layerId": "e0c50ea5-82ba-4ee6-be31-497faf705f15", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Top IP Addresses" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 16, + "y": 15, + "w": 16, + "h": 15, + "i": "e779f254-8384-4e2f-aea1-0dc375931e25" + }, + "panelIndex": "e779f254-8384-4e2f-aea1-0dc375931e25", + "embeddableConfig": { + "attributes": { + "references": [ + { + "name": "indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e0c50ea5-82ba-4ee6-be31-497faf705f15": { + "columnOrder": [ + "56bc0501-4f72-4b55-8998-f3aeceed9834", + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b" + ], + "columns": { + "56bc0501-4f72-4b55-8998-f3aeceed9834": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Route Key", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.apigateway.route_key" + }, + "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "56bc0501-4f72-4b55-8998-f3aeceed9834" + }, + { + "columnId": "9afd9da3-ed66-4c33-a4a6-d9dc7f89119b", + "isTransposed": false + } + ], + "layerId": "e0c50ea5-82ba-4ee6-be31-497faf705f15", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Top Accessed Route Keys" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 0, + "y": 30, + "w": 24, + "h": 15, + "i": "df1c2d17-abc3-4e03-999b-4e8a082cb302" + }, + "panelIndex": "df1c2d17-abc3-4e03-999b-4e8a082cb302", + "embeddableConfig": { + "attributes": { + "references": [ + { + "name": "indexpattern-datasource-layer-c7dca2ac-c8e3-48eb-b604-609a2a808cae", + "id": "logs-*", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c7dca2ac-c8e3-48eb-b604-609a2a808cae": { + "columnOrder": [ + "557d1ba6-226e-488e-a132-6ec8f52d67b8", + "fb83df49-4a4a-4e31-90cc-e79176cc0359" + ], + "columns": { + "557d1ba6-226e-488e-a132-6ec8f52d67b8": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fb83df49-4a4a-4e31-90cc-e79176cc0359": { + "dataType": "number", + "isBucketed": false, + "label": "Average of aws.apigateway.response_length", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2, + "suffix": "ms" + } + } + }, + "scale": "ratio", + "sourceField": "aws.apigateway.response_length" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "fb83df49-4a4a-4e31-90cc-e79176cc0359" + ], + "layerId": "c7dca2ac-c8e3-48eb-b604-609a2a808cae", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "557d1ba6-226e-488e-a132-6ec8f52d67b8" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Request Time" + }, + { + "version": "8.7.1", + "type": "lens", + "gridData": { + "x": 24, + "y": 30, + "w": 24, + "h": 15, + "i": "cfe1a0fc-f948-4dce-bb6f-41ae6b018f0d" + }, + "panelIndex": "cfe1a0fc-f948-4dce-bb6f-41ae6b018f0d", + "embeddableConfig": { + "attributes": { + "references": [ + { + "name": "indexpattern-datasource-layer-8fb38a54-10e3-47e3-83c5-8853e0afe9da", + "id": "logs-*", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8fb38a54-10e3-47e3-83c5-8853e0afe9da": { + "columnOrder": [ + "9d3e6d3a-28ff-4ccd-9fc2-c4e6ef6355b7", + "8fa54c3a-d913-4266-bf1d-8047e35b8a16" + ], + "columns": { + "8fa54c3a-d913-4266-bf1d-8047e35b8a16": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Average of aws.apigateway.response_length", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "aws.apigateway.response_length" + }, + "9d3e6d3a-28ff-4ccd-9fc2-c4e6ef6355b7": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8fa54c3a-d913-4266-bf1d-8047e35b8a16" + ], + "layerId": "8fb38a54-10e3-47e3-83c5-8853e0afe9da", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "9d3e6d3a-28ff-4ccd-9fc2-c4e6ef6355b7" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "title": "Response Length" + }, + { + "version": "8.7.1", + "type": "search", + "gridData": { + "x": 0, + "y": 45, + "w": 48, + "h": 15, + "i": "4bbea79e-625f-4803-8050-25d55e530dee" + }, + "panelIndex": "4bbea79e-625f-4803-8050-25d55e530dee", + "embeddableConfig": { + "enhancements": {} + }, + "panelRefName": "panel_4bbea79e-625f-4803-8050-25d55e530dee" + } + ], + "timeRestore": false, + "title": "[Logs AWS] API Gateway Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-20T14:05:48.227Z", + "id": "aws-5465f0f0-26e4-11ee-9051-011d57d86fe2", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "id": "logs-*", + "name": "124faec6-fedf-4a5c-b060-ab3f03a8cdbe:indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + }, + { + "type": "index-pattern", + "id": "logs-*", + "name": "9a82e092-0e19-4f51-8879-680d1ed0ba44:indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + }, + { + "name": "245be50a-a099-4712-bbf5-2b6ce1368ec7:indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + }, + { + "type": "index-pattern", + "id": "logs-*", + "name": "92abd08c-7a30-4df3-bfae-31f101cd3f02:indexpattern-datasource-layer-06dccdd0-c0b9-4519-a299-53546adbc735" + }, + { + "name": "4df6f1a3-5307-4b0d-8e77-d2d1c1cfe423:indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + }, + { + "name": "e779f254-8384-4e2f-aea1-0dc375931e25:indexpattern-datasource-layer-e0c50ea5-82ba-4ee6-be31-497faf705f15", + "id": "logs-*", + "type": "index-pattern" + }, + { + "name": "df1c2d17-abc3-4e03-999b-4e8a082cb302:indexpattern-datasource-layer-c7dca2ac-c8e3-48eb-b604-609a2a808cae", + "id": "logs-*", + "type": "index-pattern" + }, + { + "name": "cfe1a0fc-f948-4dce-bb6f-41ae6b018f0d:indexpattern-datasource-layer-8fb38a54-10e3-47e3-83c5-8853e0afe9da", + "id": "logs-*", + "type": "index-pattern" + }, + { + "name": "4bbea79e-625f-4803-8050-25d55e530dee:panel_4bbea79e-625f-4803-8050-25d55e530dee", + "type": "search", + "id": "aws-4f41d150-2704-11ee-81f9-fdf97c8e03a6" + }, + { + "name": "controlGroup_8f39f203-e0d6-4567-bcae-8b2f875cf442:optionsListDataView", + "type": "index-pattern", + "id": "logs-*" + }, + { + "name": "controlGroup_7acb90a0-4fc1-4ed9-bf45-2a00e082c705:optionsListDataView", + "type": "index-pattern", + "id": "logs-*" + }, + { + "name": "controlGroup_a9bf185b-ff91-4165-8584-6075e830a2b0:optionsListDataView", + "type": "index-pattern", + "id": "logs-*" + }, + { + "name": "controlGroup_14595511-24be-417b-af74-625ad0e7319a:optionsListDataView", + "type": "index-pattern", + "id": "logs-*" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-562bdea0-4ba7-11ec-8282-5342b8988acc.json b/packages/aws/kibana/dashboard/aws-562bdea0-4ba7-11ec-8282-5342b8988acc.json index b3b06e32338..e3d6f7368e3 100644 --- a/packages/aws/kibana/dashboard/aws-562bdea0-4ba7-11ec-8282-5342b8988acc.json +++ b/packages/aws/kibana/dashboard/aws-562bdea0-4ba7-11ec-8282-5342b8988acc.json @@ -1,14 +1,12 @@ { - "id": "aws-562bdea0-4ba7-11ec-8282-5342b8988acc", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg1MywxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"93146885-2c36-40c3-8245-14518519f97e\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"93146885-2c36-40c3-8245-14518519f97e\",\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"enhancements\":{}}},\"6a637a29-9089-4826-aa65-088a3bbeb98f\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"6a637a29-9089-4826-aa65-088a3bbeb98f\",\"fieldName\":\"cloud.availability_zone\",\"title\":\"Availability Zone\",\"enhancements\":{}}},\"fdc8cb1e-fc15-4f63-8ce7-0027c9d10ad3\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fdc8cb1e-fc15-4f63-8ce7-0027c9d10ad3\",\"fieldName\":\"observer.name\",\"title\":\"Firewall\",\"enhancements\":{}}}}" + }, "description": "Dashboard providing statistics about flows ingested from the AWS Network Firewall integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -64,20 +62,12 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", - "w": 12, - "x": 0, - "y": 0 - }, - "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "embeddableConfig": { "enhancements": {}, "savedVis": { @@ -101,106 +91,20 @@ "title": "", "type": "markdown", "uiState": {} - }, - "type": "visualization" - } - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Firewall Filters [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1637591016076", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "cloud.availability_zone", - "id": "1637591029629", - "indexPatternRefName": "control_1_index_pattern", - "label": "Availability Zone", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "observer.name", - "id": "1637591118622", - "indexPatternRefName": "control_2_index_pattern", - "label": "Firewall", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } } }, "gridData": { - "h": 7, - "i": "9acd5716-4bce-498a-9a4e-4d4fd81dfdc2", - "w": 36, - "x": 12, + "h": 16, + "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", + "w": 18, + "x": 0, "y": 0 }, - "panelIndex": "9acd5716-4bce-498a-9a4e-4d4fd81dfdc2", - "title": "Firewall Filters", + "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "type": "visualization", - "version": "8.0.0" + "version": "8.8.1" }, { - "version": "8.1.0", - "type": "lens", - "gridData": { - "h": 8, - "i": "09caeba8-1f98-4937-b1b8-60debe3e3728", - "w": 6, - "x": 12, - "y": 7 - }, - "panelIndex": "09caeba8-1f98-4937-b1b8-60debe3e3728", "embeddableConfig": { "attributes": { "references": [ @@ -217,7 +121,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -263,30 +167,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Flows" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "4c85d573-baea-49ca-bb9e-4013a0373da7", - "w": 6, + "i": "09caeba8-1f98-4937-b1b8-60debe3e3728", + "w": 10, "x": 18, - "y": 7 + "y": 0 }, - "panelIndex": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "panelIndex": "09caeba8-1f98-4937-b1b8-60debe3e3728", + "title": "Unique Flows", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -303,7 +209,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -349,30 +255,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Destination IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", - "w": 6, - "x": 24, - "y": 7 + "i": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "w": 10, + "x": 28, + "y": 0 }, - "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "panelIndex": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "title": "Unique Destination IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -389,7 +297,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -401,10 +309,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Source IPs", + "label": "Unique Network Protocols", "operationType": "formula", "params": { - "formula": "unique_count(source.ip)", + "formula": "unique_count(network.protocol)", "isFormulaBroken": false }, "references": [ @@ -416,10 +324,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of unique_count(source.ip)", + "label": "Part of Unique Rules", "operationType": "unique_count", "scale": "ratio", - "sourceField": "source.ip" + "sourceField": "network.protocol" } }, "incompleteColumns": {} @@ -435,30 +343,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Source IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "6d617b1a-a973-4136-8d93-15e5c72c43f2", - "w": 6, - "x": 30, - "y": 7 + "i": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "w": 10, + "x": 38, + "y": 0 }, - "panelIndex": "6d617b1a-a973-4136-8d93-15e5c72c43f2", + "panelIndex": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "title": "Unique Network Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -475,7 +385,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -487,10 +397,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Transport Protocols", + "label": "Unique Source IPs", "operationType": "formula", "params": { - "formula": "unique_count(network.transport)", + "formula": "unique_count(source.ip)", "isFormulaBroken": false }, "references": [ @@ -502,10 +412,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of Unique Network Protocols", + "label": "Part of unique_count(source.ip)", "operationType": "unique_count", "scale": "ratio", - "sourceField": "network.transport" + "sourceField": "source.ip" } }, "incompleteColumns": {} @@ -521,30 +431,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Network Protocols" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "673dd2b3-e271-4ad9-9b86-83e4e1070647", - "w": 6, - "x": 36, - "y": 7 + "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "w": 10, + "x": 18, + "y": 8 }, - "panelIndex": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "title": "Unique Source IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -561,7 +473,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -573,10 +485,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Unique Network Protocols", + "label": "Unique Transport Protocols", "operationType": "formula", "params": { - "formula": "unique_count(network.protocol)", + "formula": "unique_count(network.transport)", "isFormulaBroken": false }, "references": [ @@ -588,10 +500,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of Unique Rules", + "label": "Part of Unique Network Protocols", "operationType": "unique_count", "scale": "ratio", - "sourceField": "network.protocol" + "sourceField": "network.transport" } }, "incompleteColumns": {} @@ -607,30 +519,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Network Protocols" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 8, - "i": "77a70f50-9523-45f0-bbf6-cd6628d2ef53", - "w": 6, - "x": 42, - "y": 7 + "i": "6d617b1a-a973-4136-8d93-15e5c72c43f2", + "w": 10, + "x": 28, + "y": 8 }, - "panelIndex": "77a70f50-9523-45f0-bbf6-cd6628d2ef53", + "panelIndex": "6d617b1a-a973-4136-8d93-15e5c72c43f2", + "title": "Unique Network Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -647,7 +561,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -685,30 +599,32 @@ "visualization": { "accessor": "fe2e527e-c274-42c2-8d95-0c5955356eb8", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Total Bytes" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 15, - "i": "227abb53-ab6c-40f9-af63-6c6ac41d6855", - "w": 12, - "x": 0, - "y": 15 + "h": 8, + "i": "77a70f50-9523-45f0-bbf6-cd6628d2ef53", + "w": 10, + "x": 38, + "y": 8 }, - "panelIndex": "227abb53-ab6c-40f9-af63-6c6ac41d6855", + "panelIndex": "77a70f50-9523-45f0-bbf6-cd6628d2ef53", + "title": "Total Bytes", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -725,7 +641,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -793,16 +709,19 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "4c3d3741-afe6-403d-bc83-7f90196c291a", - "1d64873d-37af-48f4-b6ec-911b6e0243cd" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "4c3d3741-afe6-403d-bc83-7f90196c291a", + "1d64873d-37af-48f4-b6ec-911b6e0243cd" + ] } ], "shape": "donut" @@ -813,22 +732,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Protocols" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "2148efa5-f130-4751-909d-6a79eed2e16b", + "i": "227abb53-ab6c-40f9-af63-6c6ac41d6855", "w": 12, - "x": 12, - "y": 15 + "x": 0, + "y": 16 }, - "panelIndex": "2148efa5-f130-4751-909d-6a79eed2e16b", + "panelIndex": "227abb53-ab6c-40f9-af63-6c6ac41d6855", + "title": "Top Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -845,7 +763,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -894,15 +812,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f49ff962-9e8a-4170-a0d8-54cee9438651" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f49ff962-9e8a-4170-a0d8-54cee9438651" + ] } ], "shape": "pie" @@ -913,22 +834,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Source Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "i": "2148efa5-f130-4751-909d-6a79eed2e16b", "w": 12, - "x": 24, - "y": 15 + "x": 12, + "y": 16 }, - "panelIndex": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "panelIndex": "2148efa5-f130-4751-909d-6a79eed2e16b", + "title": "Top Source Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -945,7 +865,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -994,15 +914,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f49ff962-9e8a-4170-a0d8-54cee9438651" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f49ff962-9e8a-4170-a0d8-54cee9438651" + ] } ], "shape": "pie" @@ -1013,22 +936,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Destination Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "cdab9d28-4b3b-4228-8e3a-6e3d29022815", + "i": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", "w": 12, - "x": 36, - "y": 15 + "x": 24, + "y": 16 }, - "panelIndex": "cdab9d28-4b3b-4228-8e3a-6e3d29022815", + "panelIndex": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "title": "Top Destination Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1045,7 +967,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -1094,15 +1016,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b6083b5e-5207-4632-9f23-e76872d504e4" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b6083b5e-5207-4632-9f23-e76872d504e4" + ] } ], "shape": "pie" @@ -1113,22 +1038,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Firewalls" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 11, - "i": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "h": 15, + "i": "cdab9d28-4b3b-4228-8e3a-6e3d29022815", "w": 12, - "x": 12, - "y": 30 + "x": 36, + "y": 16 }, - "panelIndex": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "panelIndex": "cdab9d28-4b3b-4228-8e3a-6e3d29022815", + "title": "Top Firewalls", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1145,7 +1069,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1155,7 +1079,7 @@ "columns": { "63e483b4-0ce2-4f05-92a2-8e699650d64c": { "customLabel": true, - "dataType": "ip", + "dataType": "string", "isBucketed": true, "label": "Source IP", "operationType": "terms", @@ -1170,7 +1094,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "source.ip" + "sourceField": "network.protocol" }, "915adad5-4455-40d4-a9cd-0702da79189c": { "dataType": "number", @@ -1203,7 +1127,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1211,22 +1137,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Source IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "dae8d2e7-7949-4023-9926-58af14895e11", + "i": "29627829-7a4d-4fc3-9ee4-c9af667dd941", "w": 12, - "x": 24, - "y": 30 + "x": 0, + "y": 31 }, - "panelIndex": "dae8d2e7-7949-4023-9926-58af14895e11", + "panelIndex": "29627829-7a4d-4fc3-9ee4-c9af667dd941", + "title": "Top Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1243,7 +1168,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1255,7 +1180,7 @@ "customLabel": true, "dataType": "ip", "isBucketed": true, - "label": "Destination IP", + "label": "Source IP", "operationType": "terms", "params": { "missingBucket": false, @@ -1268,7 +1193,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "destination.ip" + "sourceField": "source.ip" }, "915adad5-4455-40d4-a9cd-0702da79189c": { "dataType": "number", @@ -1301,7 +1226,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1309,22 +1236,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Destination IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "i": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", "w": 12, - "x": 36, - "y": 30 + "x": 12, + "y": 31 }, - "panelIndex": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "panelIndex": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "title": "Top Source IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1341,27 +1267,19 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ - "bcad6771-9620-48eb-b728-c5548423a150", + "63e483b4-0ce2-4f05-92a2-8e699650d64c", "915adad5-4455-40d4-a9cd-0702da79189c" ], "columns": { - "915adad5-4455-40d4-a9cd-0702da79189c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - }, - "bcad6771-9620-48eb-b728-c5548423a150": { + "63e483b4-0ce2-4f05-92a2-8e699650d64c": { "customLabel": true, - "dataType": "string", + "dataType": "ip", "isBucketed": true, - "label": "Firewalls", + "label": "Destination IP", "operationType": "terms", "params": { "missingBucket": false, @@ -1374,7 +1292,15 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "observer.name" + "sourceField": "destination.ip" + }, + "915adad5-4455-40d4-a9cd-0702da79189c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1390,16 +1316,18 @@ "visualization": { "columns": [ { - "columnId": "bcad6771-9620-48eb-b728-c5548423a150", + "columnId": "915adad5-4455-40d4-a9cd-0702da79189c", "isTransposed": false }, { - "columnId": "915adad5-4455-40d4-a9cd-0702da79189c", + "columnId": "63e483b4-0ce2-4f05-92a2-8e699650d64c", "isTransposed": false } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1407,22 +1335,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Firewalls" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "29627829-7a4d-4fc3-9ee4-c9af667dd941", + "i": "dae8d2e7-7949-4023-9926-58af14895e11", "w": 12, - "x": 0, - "y": 30 + "x": 24, + "y": 31 }, - "panelIndex": "29627829-7a4d-4fc3-9ee4-c9af667dd941", + "panelIndex": "dae8d2e7-7949-4023-9926-58af14895e11", + "title": "Top Destination IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1439,19 +1366,27 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ - "63e483b4-0ce2-4f05-92a2-8e699650d64c", + "bcad6771-9620-48eb-b728-c5548423a150", "915adad5-4455-40d4-a9cd-0702da79189c" ], "columns": { - "63e483b4-0ce2-4f05-92a2-8e699650d64c": { + "915adad5-4455-40d4-a9cd-0702da79189c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "bcad6771-9620-48eb-b728-c5548423a150": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Source IP", + "label": "Firewalls", "operationType": "terms", "params": { "missingBucket": false, @@ -1464,15 +1399,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "network.protocol" - }, - "915adad5-4455-40d4-a9cd-0702da79189c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" + "sourceField": "observer.name" } }, "incompleteColumns": {} @@ -1488,16 +1415,18 @@ "visualization": { "columns": [ { - "columnId": "915adad5-4455-40d4-a9cd-0702da79189c", + "columnId": "bcad6771-9620-48eb-b728-c5548423a150", "isTransposed": false }, { - "columnId": "63e483b4-0ce2-4f05-92a2-8e699650d64c", + "columnId": "915adad5-4455-40d4-a9cd-0702da79189c", "isTransposed": false } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1505,10 +1434,19 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Protocols" + "gridData": { + "h": 11, + "i": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "w": 12, + "x": 36, + "y": 31 + }, + "panelIndex": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "title": "Top Firewalls", + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { @@ -1530,19 +1468,25 @@ "i": "0de2176d-e3ab-4911-933e-fb0f46ca6700", "w": 48, "x": 0, - "y": 41 + "y": 42 }, "panelIndex": "0de2176d-e3ab-4911-933e-fb0f46ca6700", "panelRefName": "panel_0de2176d-e3ab-4911-933e-fb0f46ca6700", "title": "Firewall Logs", "type": "search", - "version": "7.15.1" + "version": "8.8.1" } ], "timeRestore": false, "title": "[Logs AWS] Firewall Flows", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T09:17:37.345Z", + "id": "aws-562bdea0-4ba7-11ec-8282-5342b8988acc", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "logs-*", @@ -1576,32 +1520,32 @@ }, { "id": "logs-*", - "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-current-indexpattern", + "name": "673dd2b3-e271-4ad9-9b86-83e4e1070647:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "673dd2b3-e271-4ad9-9b86-83e4e1070647:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "6d617b1a-a973-4136-8d93-15e5c72c43f2:indexpattern-datasource-current-indexpattern", + "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "6d617b1a-a973-4136-8d93-15e5c72c43f2:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { "id": "logs-*", - "name": "673dd2b3-e271-4ad9-9b86-83e4e1070647:indexpattern-datasource-current-indexpattern", + "name": "6d617b1a-a973-4136-8d93-15e5c72c43f2:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "673dd2b3-e271-4ad9-9b86-83e4e1070647:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", + "name": "6d617b1a-a973-4136-8d93-15e5c72c43f2:indexpattern-datasource-layer-454630b2-cff5-45ab-9cfc-ec19c5aeb97a", "type": "index-pattern" }, { @@ -1656,42 +1600,42 @@ }, { "id": "logs-*", - "name": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb:indexpattern-datasource-current-indexpattern", + "name": "29627829-7a4d-4fc3-9ee4-c9af667dd941:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", + "name": "29627829-7a4d-4fc3-9ee4-c9af667dd941:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", "type": "index-pattern" }, { "id": "logs-*", - "name": "dae8d2e7-7949-4023-9926-58af14895e11:indexpattern-datasource-current-indexpattern", + "name": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "dae8d2e7-7949-4023-9926-58af14895e11:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", + "name": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", "type": "index-pattern" }, { "id": "logs-*", - "name": "ce8caf3c-c830-4500-a4bf-66a9f354cd49:indexpattern-datasource-current-indexpattern", + "name": "dae8d2e7-7949-4023-9926-58af14895e11:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "ce8caf3c-c830-4500-a4bf-66a9f354cd49:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", + "name": "dae8d2e7-7949-4023-9926-58af14895e11:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", "type": "index-pattern" }, { "id": "logs-*", - "name": "29627829-7a4d-4fc3-9ee4-c9af667dd941:indexpattern-datasource-current-indexpattern", + "name": "ce8caf3c-c830-4500-a4bf-66a9f354cd49:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "29627829-7a4d-4fc3-9ee4-c9af667dd941:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", + "name": "ce8caf3c-c830-4500-a4bf-66a9f354cd49:indexpattern-datasource-layer-a5c93c96-5038-49e1-acca-2e876257c059", "type": "index-pattern" }, { @@ -1700,23 +1644,20 @@ "type": "search" }, { - "type": "index-pattern", - "name": "9acd5716-4bce-498a-9a4e-4d4fd81dfdc2:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_93146885-2c36-40c3-8245-14518519f97e:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "9acd5716-4bce-498a-9a4e-4d4fd81dfdc2:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_6a637a29-9089-4826-aa65-088a3bbeb98f:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "9acd5716-4bce-498a-9a4e-4d4fd81dfdc2:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_fdc8cb1e-fc15-4f63-8ce7-0027c9d10ad3:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-81f2c980-e743-11ec-93f6-9b98f71110cd.json b/packages/aws/kibana/dashboard/aws-81f2c980-e743-11ec-93f6-9b98f71110cd.json index fbc8f507a99..b76afe0f19b 100644 --- a/packages/aws/kibana/dashboard/aws-81f2c980-e743-11ec-93f6-9b98f71110cd.json +++ b/packages/aws/kibana/dashboard/aws-81f2c980-e743-11ec-93f6-9b98f71110cd.json @@ -1,14 +1,12 @@ { - "id": "aws-81f2c980-e743-11ec-93f6-9b98f71110cd", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg1OCwxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"8e87fad0-fc18-4bf8-862b-e015f6b6588b\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"8e87fad0-fc18-4bf8-862b-e015f6b6588b\",\"fieldName\":\"cloud.account.name\",\"title\":\"Account Name\",\"enhancements\":{}}},\"8606570c-7081-4ba2-94e9-c553d33c2acf\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"8606570c-7081-4ba2-94e9-c553d33c2acf\",\"fieldName\":\"aws.dimensions.ClusterIdentifier\",\"title\":\"Cluster Identifier\",\"enhancements\":{}}}}" + }, "description": "Overview of Amazon Redshift metrics", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -43,23 +41,15 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": true, + "syncCursor": true, + "syncTooltips": false, "useMargins": false }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 6, - "i": "88b83992-1fc4-4509-b89d-2de22163f92c", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "88b83992-1fc4-4509-b89d-2de22163f92c", "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": false, + "hidePanelTitles": true, "savedVis": { "data": { "aggs": [], @@ -72,54 +62,17 @@ } }, "description": "", + "id": "", "params": { - "controls": [ - { - "fieldName": "cloud.account.name", - "id": "1549397251041", - "indexPatternRefName": "control_88b83992-1fc4-4509-b89d-2de22163f92c_0_index_pattern", - "label": "account name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "aws.dimensions.ClusterIdentifier", - "id": "1655371342369", - "indexPatternRefName": "control_88b83992-1fc4-4509-b89d-2de22163f92c_1_index_pattern", - "label": "cluster identifier", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false + "fontSize": 12, + "markdown": "## Cluster monitoring", + "openLinksInNewTab": false }, "title": "", - "type": "input_control_vis", + "type": "markdown", "uiState": {} - }, - "type": "visualization" + } }, - "title": "AWS Account and Redshift Cluster Filters" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { "h": 5, "i": "dffd1329-1668-441d-907d-c04a5cee3fcc", @@ -128,45 +81,10 @@ "y": 6 }, "panelIndex": "dffd1329-1668-441d-907d-c04a5cee3fcc", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "## Cluster monitoring", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - }, - "type": "visualization" - } + "type": "visualization", + "version": "8.8.1" }, { - "version": "8.1.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "500e407a-5b1e-4963-b229-f14024f7678d", - "w": 24, - "x": 0, - "y": 11 - }, - "panelIndex": "500e407a-5b1e-4963-b229-f14024f7678d", "embeddableConfig": { "attributes": { "references": [ @@ -183,7 +101,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f26f3fa9-c910-4463-917a-a5190e20d8cc": { "columnOrder": [ @@ -258,6 +176,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -274,22 +193,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Health Status" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "cdb8dc8b-e920-459d-b55e-462059dd148c", + "i": "500e407a-5b1e-4963-b229-f14024f7678d", "w": 24, - "x": 24, + "x": 0, "y": 11 }, - "panelIndex": "cdb8dc8b-e920-459d-b55e-462059dd148c", + "panelIndex": "500e407a-5b1e-4963-b229-f14024f7678d", + "title": "Health Status", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -306,7 +224,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "63ac4267-da50-47f2-a95d-f210ac96e7be": { "columnOrder": [ @@ -382,6 +300,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -403,22 +322,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Maintenance mode" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 12, - "i": "e1952ece-22a7-4d9e-a96d-035e49e48e89", - "w": 15, - "x": 0, - "y": 26 + "h": 15, + "i": "cdb8dc8b-e920-459d-b55e-462059dd148c", + "w": 24, + "x": 24, + "y": 11 }, - "panelIndex": "e1952ece-22a7-4d9e-a96d-035e49e48e89", + "panelIndex": "cdb8dc8b-e920-459d-b55e-462059dd148c", + "title": "Maintenance mode", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -435,7 +353,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "07d0e5df-2cdd-4f7d-89a5-79cd6faf96d2": { "columnOrder": [ @@ -474,29 +392,31 @@ "visualization": { "accessor": "9dc06753-8051-4a65-8122-bd693491cf43", "layerId": "07d0e5df-2cdd-4f7d-89a5-79cd6faf96d2", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" - } - }, - { - "version": "8.1.0", - "type": "lens", + "hidePanelTitles": true + }, "gridData": { "h": 12, - "i": "a2c1cf3b-86a2-4a9f-9f5f-99c51d536a5a", - "w": 33, - "x": 15, + "i": "e1952ece-22a7-4d9e-a96d-035e49e48e89", + "w": 15, + "x": 0, "y": 26 }, - "panelIndex": "a2c1cf3b-86a2-4a9f-9f5f-99c51d536a5a", + "panelIndex": "e1952ece-22a7-4d9e-a96d-035e49e48e89", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -513,7 +433,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "95dadc13-e250-40e4-8ae8-9c612d40d8b5": { "columnOrder": [ @@ -590,6 +510,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -606,22 +527,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Database connections" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { - "h": 5, - "i": "c150200d-1645-49be-a3f6-103da488bc4e", - "w": 48, - "x": 0, - "y": 38 + "h": 12, + "i": "a2c1cf3b-86a2-4a9f-9f5f-99c51d536a5a", + "w": 33, + "x": 15, + "y": 26 }, - "panelIndex": "c150200d-1645-49be-a3f6-103da488bc4e", + "panelIndex": "a2c1cf3b-86a2-4a9f-9f5f-99c51d536a5a", + "title": "Database connections", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "enhancements": {}, "hidePanelTitles": true, @@ -646,21 +566,20 @@ "title": "", "type": "markdown", "uiState": {} - }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "lens", + } + }, "gridData": { - "h": 14, - "i": "818689c7-efe0-4c41-9fa7-640b9281d4d8", - "w": 15, + "h": 5, + "i": "c150200d-1645-49be-a3f6-103da488bc4e", + "w": 48, "x": 0, - "y": 43 + "y": 38 }, - "panelIndex": "818689c7-efe0-4c41-9fa7-640b9281d4d8", + "panelIndex": "c150200d-1645-49be-a3f6-103da488bc4e", + "type": "visualization", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -677,7 +596,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e8f1122f-78fe-4db5-b05e-e87553c61237": { "columnOrder": [ @@ -761,29 +680,31 @@ ] }, "type": "palette" - } + }, + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" - } - }, - { - "version": "8.1.0", - "type": "lens", + "hidePanelTitles": true + }, "gridData": { "h": 14, - "i": "860dc77f-8d28-4af7-8c04-baf0ad10e402", - "w": 33, - "x": 15, + "i": "818689c7-efe0-4c41-9fa7-640b9281d4d8", + "w": 15, + "x": 0, "y": 43 }, - "panelIndex": "860dc77f-8d28-4af7-8c04-baf0ad10e402", + "panelIndex": "818689c7-efe0-4c41-9fa7-640b9281d4d8", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -800,7 +721,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "27acbd7b-a2c6-4116-989a-ec58fc9d0e29": { "columnOrder": [ @@ -908,6 +829,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right", "showSingleSeries": false }, @@ -929,22 +851,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "CPU Utilization per Node" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 15, - "i": "2ce96451-53a0-4fb7-90a4-0ef0d09b9aa3", - "w": 24, - "x": 0, - "y": 57 + "h": 14, + "i": "860dc77f-8d28-4af7-8c04-baf0ad10e402", + "w": 33, + "x": 15, + "y": 43 }, - "panelIndex": "2ce96451-53a0-4fb7-90a4-0ef0d09b9aa3", + "panelIndex": "860dc77f-8d28-4af7-8c04-baf0ad10e402", + "title": "CPU Utilization per Node", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -961,7 +882,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2a63294f-c73c-4822-bf57-5ceebef529f4": { "columnOrder": [ @@ -1038,6 +959,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1054,22 +976,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Disk Read Throughput" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "1289046b-48c1-4506-a473-cebc26cc5a1c", + "i": "2ce96451-53a0-4fb7-90a4-0ef0d09b9aa3", "w": 24, - "x": 24, + "x": 0, "y": 57 }, - "panelIndex": "1289046b-48c1-4506-a473-cebc26cc5a1c", + "panelIndex": "2ce96451-53a0-4fb7-90a4-0ef0d09b9aa3", + "title": "Disk Read Throughput", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1086,7 +1007,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "115b9c0c-4ad8-44df-b8ed-2771d89a23d2": { "columnOrder": [ @@ -1163,6 +1084,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1179,22 +1101,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Storage Write Throughput" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "464712cc-51aa-4e6f-a520-f7b528c17793", + "i": "1289046b-48c1-4506-a473-cebc26cc5a1c", "w": 24, - "x": 0, - "y": 72 + "x": 24, + "y": 57 }, - "panelIndex": "464712cc-51aa-4e6f-a520-f7b528c17793", + "panelIndex": "1289046b-48c1-4506-a473-cebc26cc5a1c", + "title": "Storage Write Throughput", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1211,7 +1132,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4ebcdab6-4f10-4f42-9f61-e4aec03c380e": { "columnOrder": [ @@ -1287,6 +1208,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1303,22 +1225,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Storage Read Latency" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "fd92a37e-9ba8-4134-ac5d-71c1a0d1d0bc", + "i": "464712cc-51aa-4e6f-a520-f7b528c17793", "w": 24, - "x": 24, + "x": 0, "y": 72 }, - "panelIndex": "fd92a37e-9ba8-4134-ac5d-71c1a0d1d0bc", + "panelIndex": "464712cc-51aa-4e6f-a520-f7b528c17793", + "title": "Storage Read Latency", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1335,7 +1256,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9b073139-c687-4094-aa13-d20f79b9f550": { "columnOrder": [ @@ -1411,6 +1332,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1427,22 +1349,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Storage Write Latency" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "aa0f68cd-7a8e-4b27-9ec1-b8e288039cca", - "w": 15, - "x": 0, - "y": 102 + "i": "fd92a37e-9ba8-4134-ac5d-71c1a0d1d0bc", + "w": 24, + "x": 24, + "y": 72 }, - "panelIndex": "aa0f68cd-7a8e-4b27-9ec1-b8e288039cca", + "panelIndex": "fd92a37e-9ba8-4134-ac5d-71c1a0d1d0bc", + "title": "Storage Write Latency", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1459,7 +1380,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1fddbb42-ef13-4a93-8b4a-d4e28866916e": { "columnOrder": [ @@ -1543,29 +1464,31 @@ ] }, "type": "palette" - } + }, + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" - } - }, - { - "version": "8.1.0", - "type": "lens", + "hidePanelTitles": true + }, "gridData": { "h": 15, - "i": "9c5ba303-08c6-455c-a1e0-9a85327682ca", - "w": 33, - "x": 15, + "i": "aa0f68cd-7a8e-4b27-9ec1-b8e288039cca", + "w": 15, + "x": 0, "y": 102 }, - "panelIndex": "9c5ba303-08c6-455c-a1e0-9a85327682ca", + "panelIndex": "aa0f68cd-7a8e-4b27-9ec1-b8e288039cca", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1582,7 +1505,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "84cfb763-392e-4bb7-9c83-ee13166710ef": { "columnOrder": [ @@ -1666,6 +1589,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1685,22 +1609,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Percentage of disk space used" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { - "h": 5, - "i": "be4f09e7-c419-435e-987f-98c491928001", - "w": 48, - "x": 0, - "y": 117 + "h": 15, + "i": "9c5ba303-08c6-455c-a1e0-9a85327682ca", + "w": 33, + "x": 15, + "y": 102 }, - "panelIndex": "be4f09e7-c419-435e-987f-98c491928001", + "panelIndex": "9c5ba303-08c6-455c-a1e0-9a85327682ca", + "title": "Percentage of disk space used", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "enhancements": {}, "hidePanelTitles": true, @@ -1725,21 +1648,20 @@ "title": "", "type": "markdown", "uiState": {} - }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "lens", + } + }, "gridData": { - "h": 15, - "i": "3a0afa56-f307-4f5f-9668-81ed9c6de56f", - "w": 24, + "h": 5, + "i": "be4f09e7-c419-435e-987f-98c491928001", + "w": 48, "x": 0, - "y": 122 + "y": 117 }, - "panelIndex": "3a0afa56-f307-4f5f-9668-81ed9c6de56f", + "panelIndex": "be4f09e7-c419-435e-987f-98c491928001", + "type": "visualization", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1756,7 +1678,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "58906b59-5f5e-431d-a8a1-61210e31d56c": { "columnOrder": [ @@ -1856,6 +1778,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1872,22 +1795,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Query Duration by latency range" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "8f853d89-2901-48a8-823d-affb864f1078", + "i": "3a0afa56-f307-4f5f-9668-81ed9c6de56f", "w": 24, - "x": 24, + "x": 0, "y": 122 }, - "panelIndex": "8f853d89-2901-48a8-823d-affb864f1078", + "panelIndex": "3a0afa56-f307-4f5f-9668-81ed9c6de56f", + "title": "Query Duration by latency range", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1904,7 +1826,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "98a1fb8e-6416-4a46-9545-176a7b58e607": { "columnOrder": [ @@ -2001,6 +1923,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -2017,22 +1940,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Query duration by WLM queue" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "90e8066a-f9fb-405f-85ba-c0456fcd055a", + "i": "8f853d89-2901-48a8-823d-affb864f1078", "w": 24, - "x": 0, - "y": 87 + "x": 24, + "y": 122 }, - "panelIndex": "90e8066a-f9fb-405f-85ba-c0456fcd055a", + "panelIndex": "8f853d89-2901-48a8-823d-affb864f1078", + "title": "Query duration by WLM queue", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -2049,7 +1971,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0a5a3c92-22e8-4794-b07c-78477920697f": { "columnOrder": [ @@ -2126,6 +2048,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -2142,22 +2065,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Network Receive Throughput" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "83d380db-07a5-45e7-bd97-661c06da0455", + "i": "90e8066a-f9fb-405f-85ba-c0456fcd055a", "w": 24, - "x": 24, + "x": 0, "y": 87 }, - "panelIndex": "83d380db-07a5-45e7-bd97-661c06da0455", + "panelIndex": "90e8066a-f9fb-405f-85ba-c0456fcd055a", + "title": "Network Receive Throughput", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -2174,7 +2096,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b5db7d5d-7e7c-413c-b691-4481bc1ec5e3": { "columnOrder": [ @@ -2251,6 +2173,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -2267,32 +2190,37 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Network Transmit Throughput" + "gridData": { + "h": 15, + "i": "83d380db-07a5-45e7-bd97-661c06da0455", + "w": 24, + "x": 24, + "y": 87 + }, + "panelIndex": "83d380db-07a5-45e7-bd97-661c06da0455", + "title": "Network Transmit Throughput", + "type": "lens", + "version": "8.8.1" } ], "timeRestore": false, "title": "[Metrics AWS] Redshift metrics overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", + "id": "aws-81f2c980-e743-11ec-93f6-9b98f71110cd", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "metrics-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "88b83992-1fc4-4509-b89d-2de22163f92c:control_88b83992-1fc4-4509-b89d-2de22163f92c_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "88b83992-1fc4-4509-b89d-2de22163f92c:control_88b83992-1fc4-4509-b89d-2de22163f92c_1_index_pattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "500e407a-5b1e-4963-b229-f14024f7678d:indexpattern-datasource-current-indexpattern", @@ -2452,10 +2380,17 @@ "id": "metrics-*", "name": "83d380db-07a5-45e7-bd97-661c06da0455:indexpattern-datasource-layer-b5db7d5d-7e7c-413c-b691-4481bc1ec5e3", "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_8e87fad0-fc18-4bf8-862b-e015f6b6588b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_8606570c-7081-4ba2-94e9-c553d33c2acf:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-a4482820-03aa-11ee-84d4-7f15bab18041.json b/packages/aws/kibana/dashboard/aws-a4482820-03aa-11ee-84d4-7f15bab18041.json index e4f79abd49c..3d7c2156f1b 100644 --- a/packages/aws/kibana/dashboard/aws-a4482820-03aa-11ee-84d4-7f15bab18041.json +++ b/packages/aws/kibana/dashboard/aws-a4482820-03aa-11ee-84d4-7f15bab18041.json @@ -4,16 +4,36 @@ "chainingSystem": "HIERARCHICAL", "controlStyle": "oneLine", "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"9edfaf7a-7867-4413-84df-4648537b365a\":{\"order\":0,\"width\":\"medium\",\"grow\":false,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"AWS Region\",\"id\":\"9edfaf7a-7867-4413-84df-4648537b365a\",\"enhancements\":{}}}}" + "panelsJSON": "{\"9edfaf7a-7867-4413-84df-4648537b365a\":{\"order\":3,\"width\":\"medium\",\"grow\":false,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"AWS Region\",\"id\":\"9edfaf7a-7867-4413-84df-4648537b365a\",\"enhancements\":{}}},\"f72aa0d1-b9b2-4817-951d-60259a5f9bb0\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"f72aa0d1-b9b2-4817-951d-60259a5f9bb0\",\"fieldName\":\"aws.dimensions.ApiId\",\"title\":\"API ID\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"729df68e-b651-4e0a-8b7b-d025a3d7fb05\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"729df68e-b651-4e0a-8b7b-d025a3d7fb05\",\"fieldName\":\"aws.dimensions.ApiName\",\"title\":\"API Name\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}},\"fd2f10f0-1233-42e4-8dcf-af0a9676ea7c\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fd2f10f0-1233-42e4-8dcf-af0a9676ea7c\",\"fieldName\":\"aws.dimensions.Stage\",\"title\":\"Stage\",\"grow\":false,\"width\":\"medium\",\"enhancements\":{}}}}" }, "description": "Overview of AWS API Gateway Metrics", "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], "query": { - "language": "kuery", - "query": "" - } + "query": "", + "language": "kuery" + }, + "filter": [ + { + "meta": { + "disabled": false, + "negate": false, + "alias": null, + "key": "aws.dimensions.Stage", + "field": "aws.dimensions.Stage", + "type": "exists", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index" + }, + "query": { + "exists": { + "field": "aws.dimensions.Stage" + } + }, + "$state": { + "store": "appState" + } + } + ] } }, "optionsJSON": { @@ -25,12 +45,22 @@ }, "panelsJSON": [ { + "version": "8.9.0", + "type": "lens", + "gridData": { + "x": 0, + "y": 0, + "w": 16, + "h": 13, + "i": "36a3594d-c18b-4d09-ae87-7561750822ae" + }, + "panelIndex": "36a3594d-c18b-4d09-ae87-7561750822ae", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", + "id": "metrics-*", "type": "index-pattern" } ], @@ -49,8 +79,8 @@ "11242c77-c1e8-482f-a8ab-d14342367450": { "dataType": "number", "isBucketed": false, - "label": "Count of aws.apigateway.metrics.Count.sum", - "operationType": "count", + "label": "Sum of aws.apigateway.metrics.Count.sum", + "operationType": "sum", "params": { "emptyAsNull": true }, @@ -148,25 +178,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "36a3594d-c18b-4d09-ae87-7561750822ae", + "x": 16, + "y": 0, "w": 16, - "x": 0, - "y": 0 + "h": 13, + "i": "b2ece1d0-652f-481e-9dec-ae411c897a44" }, - "panelIndex": "36a3594d-c18b-4d09-ae87-7561750822ae", - "title": "[REST] Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "b2ece1d0-652f-481e-9dec-ae411c897a44", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-f9ae930c-999d-4b82-a9ce-01d6237fa03c", + "id": "metrics-*", "type": "index-pattern" } ], @@ -286,25 +316,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] 4XX Error" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "b2ece1d0-652f-481e-9dec-ae411c897a44", + "x": 32, + "y": 0, "w": 16, - "x": 16, - "y": 0 + "h": 13, + "i": "e970e1a1-b243-46e0-b200-2cf787f26561" }, - "panelIndex": "b2ece1d0-652f-481e-9dec-ae411c897a44", - "title": "[REST] 4XX Error", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "e970e1a1-b243-46e0-b200-2cf787f26561", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-48d7bfc9-ad80-47ac-974e-a265b9c3af45", + "id": "metrics-*", "type": "index-pattern" } ], @@ -336,8 +366,8 @@ "90c328ce-f5c8-48a0-8545-57ea1ec6d7fe": { "dataType": "number", "isBucketed": false, - "label": "Median of aws.apigateway.metrics.5XXError.sum", - "operationType": "median", + "label": "Sum of aws.apigateway.metrics.5XXError.sum", + "operationType": "sum", "params": { "emptyAsNull": true }, @@ -422,25 +452,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] 5XX Error" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { + "x": 0, + "y": 13, + "w": 24, "h": 13, - "i": "e970e1a1-b243-46e0-b200-2cf787f26561", - "w": 16, - "x": 32, - "y": 0 + "i": "8b56a477-3e09-4bb0-94c3-9add2e443772" }, - "panelIndex": "e970e1a1-b243-46e0-b200-2cf787f26561", - "title": "[REST] 5XX Error", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "8b56a477-3e09-4bb0-94c3-9add2e443772", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -564,25 +594,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] Latency" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "8b56a477-3e09-4bb0-94c3-9add2e443772", + "x": 24, + "y": 13, "w": 24, - "x": 0, - "y": 13 + "h": 13, + "i": "51e609da-7bb4-4579-843f-88e9748e0982" }, - "panelIndex": "8b56a477-3e09-4bb0-94c3-9add2e443772", - "title": "[REST] Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "51e609da-7bb4-4579-843f-88e9748e0982", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -706,25 +736,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] Integration Latency" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "51e609da-7bb4-4579-843f-88e9748e0982", + "x": 0, + "y": 26, "w": 24, - "x": 24, - "y": 13 + "h": 13, + "i": "eb48842e-d380-4291-aa03-47960594babd" }, - "panelIndex": "51e609da-7bb4-4579-843f-88e9748e0982", - "title": "[REST] Integration Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "eb48842e-d380-4291-aa03-47960594babd", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -841,25 +871,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] Cache Hit Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "eb48842e-d380-4291-aa03-47960594babd", + "x": 24, + "y": 26, "w": 24, - "x": 0, - "y": 26 + "h": 13, + "i": "a1ef019a-60b1-41d9-845c-cecc5f0450c5" }, - "panelIndex": "eb48842e-d380-4291-aa03-47960594babd", - "title": "[REST] Cache Hit Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "a1ef019a-60b1-41d9-845c-cecc5f0450c5", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -976,25 +1006,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[REST] Cache Miss Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "a1ef019a-60b1-41d9-845c-cecc5f0450c5", + "x": 0, + "y": 39, "w": 24, - "x": 24, - "y": 26 + "h": 12, + "i": "070fab3f-bc1d-4ac3-830a-97a86f9a277f" }, - "panelIndex": "a1ef019a-60b1-41d9-845c-cecc5f0450c5", - "title": "[REST] Cache Miss Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "070fab3f-bc1d-4ac3-830a-97a86f9a277f", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1013,8 +1043,8 @@ "11242c77-c1e8-482f-a8ab-d14342367450": { "dataType": "number", "isBucketed": false, - "label": "Count of aws.apigateway.metrics.Count.sum", - "operationType": "count", + "label": "Sum of aws.apigateway.metrics.Count.sum", + "operationType": "sum", "params": { "emptyAsNull": true }, @@ -1111,25 +1141,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 12, - "i": "070fab3f-bc1d-4ac3-830a-97a86f9a277f", + "x": 24, + "y": 39, "w": 24, - "x": 0, - "y": 39 + "h": 12, + "i": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5" }, - "panelIndex": "070fab3f-bc1d-4ac3-830a-97a86f9a277f", - "title": "[HTTP] Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1247,25 +1277,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] Data Processed" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 12, - "i": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5", + "x": 0, + "y": 51, "w": 24, - "x": 24, - "y": 39 + "h": 13, + "i": "4979b1bc-45c5-4164-9887-498b4f893513" }, - "panelIndex": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5", - "title": "[HTTP] Data Processed", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "4979b1bc-45c5-4164-9887-498b4f893513", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1389,25 +1419,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] Latency" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "4979b1bc-45c5-4164-9887-498b4f893513", + "x": 24, + "y": 51, "w": 24, - "x": 0, - "y": 51 + "h": 13, + "i": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e" }, - "panelIndex": "4979b1bc-45c5-4164-9887-498b4f893513", - "title": "[HTTP] Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1531,25 +1561,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] Integration Latency" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e", + "x": 0, + "y": 64, "w": 24, - "x": 24, - "y": 51 + "h": 13, + "i": "dc9f0691-ccda-4403-8158-c6191d5090eb" }, - "panelIndex": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e", - "title": "[HTTP] Integration Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "dc9f0691-ccda-4403-8158-c6191d5090eb", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-5e9706cb-90ee-4f08-af6a-f2a8048628af", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1607,8 +1637,8 @@ "cd10361b-ce2e-454c-8612-6be186ffefac": { "dataType": "number", "isBucketed": false, - "label": "Median of aws.apigateway.metrics.4xx.sum", - "operationType": "median", + "label": "Sum of aws.apigateway.metrics.4xx.sum", + "operationType": "sum", "params": { "emptyAsNull": true }, @@ -1668,25 +1698,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] 4XX Error" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "dc9f0691-ccda-4403-8158-c6191d5090eb", + "x": 24, + "y": 64, "w": 24, - "x": 0, - "y": 64 + "h": 13, + "i": "98f24465-f278-4e2c-93db-9112014a449e" }, - "panelIndex": "dc9f0691-ccda-4403-8158-c6191d5090eb", - "title": "[HTTP] 4XX Error", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "98f24465-f278-4e2c-93db-9112014a449e", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1705,8 +1735,8 @@ "53bb15bf-1d19-4aaa-be68-5015b194e60b": { "dataType": "number", "isBucketed": false, - "label": "Median of aws.apigateway.metrics.5xx.sum", - "operationType": "median", + "label": "Sum of aws.apigateway.metrics.5xx.sum", + "operationType": "sum", "params": { "emptyAsNull": true }, @@ -1804,25 +1834,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[HTTP] 5XX Error" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "98f24465-f278-4e2c-93db-9112014a449e", + "x": 0, + "y": 77, "w": 24, - "x": 24, - "y": 64 + "h": 12, + "i": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72" }, - "panelIndex": "98f24465-f278-4e2c-93db-9112014a449e", - "title": "[HTTP] 5XX Error", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -1940,25 +1970,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[WebSocket] Connect Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 12, - "i": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72", + "x": 24, + "y": 77, "w": 24, - "x": 0, - "y": 77 + "h": 12, + "i": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99" }, - "panelIndex": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72", - "title": "[WebSocket] Connect Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -2076,25 +2106,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[WebSocket] Message Count" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 12, - "i": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99", + "x": 0, + "y": 89, "w": 24, - "x": 24, - "y": 77 + "h": 13, + "i": "8773ffcd-1b64-4784-8271-ba54e73eb63d" }, - "panelIndex": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99", - "title": "[WebSocket] Message Count", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "8773ffcd-1b64-4784-8271-ba54e73eb63d", "embeddableConfig": { "attributes": { "references": [ { + "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "indexpattern-datasource-layer-56b0bb53-472a-48f9-bc07-b3c340f5a74e", "type": "index-pattern" } ], @@ -2103,49 +2133,18 @@ "datasourceStates": { "formBased": { "layers": { - "56b0bb53-472a-48f9-bc07-b3c340f5a74e": { + "2cfef95f-fa80-4a29-b211-9874dba1c2bb": { "columnOrder": [ - "dc78b53d-e3d1-442e-a751-07556c6f9656", - "57b02865-fe07-4419-b48a-2f1d42a80e75", - "10f58695-52de-4d25-ba4b-71441b986e85" + "23c27e1f-f9a4-4abb-9732-aeca6f42070d", + "3d7acb77-f3cc-4fea-bf5a-f1975f3be254", + "88f0a2a6-8f91-47a7-8b7d-ae008db08c21" ], "columns": { - "10f58695-52de-4d25-ba4b-71441b986e85": { - "dataType": "number", - "isBucketed": false, - "label": "Average of aws.apigateway.metrics.Latency.avg", - "operationType": "average", - "params": { - "emptyAsNull": true, - "format": { - "id": "number", - "params": { - "decimals": 2, - "suffix": "ms" - } - } - }, - "scale": "ratio", - "sourceField": "aws.apigateway.metrics.Latency.avg" - }, - "57b02865-fe07-4419-b48a-2f1d42a80e75": { - "dataType": "date", + "23c27e1f-f9a4-4abb-9732-aeca6f42070d": { + "dataType": "string", "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "60m" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "dc78b53d-e3d1-442e-a751-07556c6f9656": { - "dataType": "string", - "isBucketed": true, - "label": "Top 10 values of aws.dimensions.ApiId", - "operationType": "terms", + "label": "Top 10 values of aws.dimensions.ApiId", + "operationType": "terms", "params": { "exclude": [], "excludeIsRegex": false, @@ -2153,7 +2152,7 @@ "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "10f58695-52de-4d25-ba4b-71441b986e85", + "columnId": "88f0a2a6-8f91-47a7-8b7d-ae008db08c21", "type": "column" }, "orderDirection": "desc", @@ -2161,10 +2160,42 @@ "parentFormat": { "id": "terms" }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", "sourceField": "aws.dimensions.ApiId" + }, + "3d7acb77-f3cc-4fea-bf5a-f1975f3be254": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "88f0a2a6-8f91-47a7-8b7d-ae008db08c21": { + "dataType": "number", + "isBucketed": false, + "label": "Average of aws.apigateway.metrics.IntegrationLatency.avg", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2, + "suffix": "ms" + } + } + }, + "scale": "ratio", + "sourceField": "aws.apigateway.metrics.IntegrationLatency.avg" } }, "incompleteColumns": {}, @@ -2191,25 +2222,24 @@ "layers": [ { "accessors": [ - "10f58695-52de-4d25-ba4b-71441b986e85" + "88f0a2a6-8f91-47a7-8b7d-ae008db08c21" ], - "layerId": "56b0bb53-472a-48f9-bc07-b3c340f5a74e", + "layerId": "2cfef95f-fa80-4a29-b211-9874dba1c2bb", "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "dc78b53d-e3d1-442e-a751-07556c6f9656", - "xAccessor": "57b02865-fe07-4419-b48a-2f1d42a80e75" + "splitAccessor": "23c27e1f-f9a4-4abb-9732-aeca6f42070d", + "xAccessor": "3d7acb77-f3cc-4fea-bf5a-f1975f3be254" } ], "legend": { "isVisible": true, "position": "right" }, - "preferredSeriesType": "bar_stacked", + "preferredSeriesType": "line", "title": "Empty XY chart", - "valueLabels": "hide", - "yTitle": "" + "valueLabels": "hide" } }, "title": "", @@ -2219,25 +2249,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[WebSocket] Integration Latency" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "8aa530e9-cf48-4966-b829-6e856d749ef9", + "x": 24, + "y": 89, "w": 24, - "x": 0, - "y": 89 + "h": 13, + "i": "55f916cb-6995-4565-98d0-d88b442fe88e" }, - "panelIndex": "8aa530e9-cf48-4966-b829-6e856d749ef9", - "title": "[WebSocket] Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "55f916cb-6995-4565-98d0-d88b442fe88e", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -2295,20 +2325,13 @@ "88f0a2a6-8f91-47a7-8b7d-ae008db08c21": { "dataType": "number", "isBucketed": false, - "label": "Average of aws.apigateway.metrics.IntegrationLatency.avg", - "operationType": "average", + "label": "Sum of aws.apigateway.metrics.IntegrationError.sum", + "operationType": "sum", "params": { - "emptyAsNull": true, - "format": { - "id": "number", - "params": { - "decimals": 2, - "suffix": "ms" - } - } + "emptyAsNull": true }, "scale": "ratio", - "sourceField": "aws.apigateway.metrics.IntegrationLatency.avg" + "sourceField": "aws.apigateway.metrics.IntegrationError.sum" } }, "incompleteColumns": {}, @@ -2362,25 +2385,25 @@ "enhancements": {}, "hidePanelTitles": false }, + "title": "[WebSocket] Integration Error" + }, + { + "version": "8.9.0", + "type": "lens", "gridData": { - "h": 13, - "i": "8773ffcd-1b64-4784-8271-ba54e73eb63d", + "x": 0, + "y": 102, "w": 24, - "x": 24, - "y": 89 + "h": 13, + "i": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1" }, - "panelIndex": "8773ffcd-1b64-4784-8271-ba54e73eb63d", - "title": "[WebSocket] Integration Latency", - "type": "lens", - "version": "8.7.1" - }, - { + "panelIndex": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1", "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-8e802b8a-241a-42a9-b6fe-64d720488b94", + "id": "metrics-*", "type": "index-pattern" } ], @@ -2498,161 +2521,25 @@ "enhancements": {}, "hidePanelTitles": false }, - "gridData": { - "h": 13, - "i": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1", - "w": 16, - "x": 0, - "y": 102 - }, - "panelIndex": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1", - "title": "[WebSocket] Client Error", - "type": "lens", - "version": "8.7.1" + "title": "[WebSocket] Client Error" }, { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "2cfef95f-fa80-4a29-b211-9874dba1c2bb": { - "columnOrder": [ - "23c27e1f-f9a4-4abb-9732-aeca6f42070d", - "3d7acb77-f3cc-4fea-bf5a-f1975f3be254", - "88f0a2a6-8f91-47a7-8b7d-ae008db08c21" - ], - "columns": { - "23c27e1f-f9a4-4abb-9732-aeca6f42070d": { - "dataType": "string", - "isBucketed": true, - "label": "Top 10 values of aws.dimensions.ApiId", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "88f0a2a6-8f91-47a7-8b7d-ae008db08c21", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "aws.dimensions.ApiId" - }, - "3d7acb77-f3cc-4fea-bf5a-f1975f3be254": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "60s" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "88f0a2a6-8f91-47a7-8b7d-ae008db08c21": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of aws.apigateway.metrics.ExecutionError.sum", - "operationType": "sum", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "aws.apigateway.metrics.ExecutionError.sum" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": false, - "yRight": true - }, - "layers": [ - { - "accessors": [ - "88f0a2a6-8f91-47a7-8b7d-ae008db08c21" - ], - "layerId": "2cfef95f-fa80-4a29-b211-9874dba1c2bb", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "23c27e1f-f9a4-4abb-9732-aeca6f42070d", - "xAccessor": "3d7acb77-f3cc-4fea-bf5a-f1975f3be254" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "title": "Empty XY chart", - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, + "version": "8.9.0", + "type": "lens", "gridData": { + "x": 24, + "y": 102, + "w": 24, "h": 13, - "i": "c2039848-87fc-4336-8f9c-c1f3195029d1", - "w": 16, - "x": 16, - "y": 102 + "i": "c2039848-87fc-4336-8f9c-c1f3195029d1" }, "panelIndex": "c2039848-87fc-4336-8f9c-c1f3195029d1", - "title": "[WebSocket] Execution Error", - "type": "lens", - "version": "8.7.1" - }, - { "embeddableConfig": { "attributes": { "references": [ { - "id": "metrics-*", "name": "indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" } ], @@ -2710,13 +2597,13 @@ "88f0a2a6-8f91-47a7-8b7d-ae008db08c21": { "dataType": "number", "isBucketed": false, - "label": "Sum of aws.apigateway.metrics.IntegrationError.sum", + "label": "Sum of aws.apigateway.metrics.ExecutionError.sum", "operationType": "sum", "params": { "emptyAsNull": true }, "scale": "ratio", - "sourceField": "aws.apigateway.metrics.IntegrationError.sum" + "sourceField": "aws.apigateway.metrics.ExecutionError.sum" } }, "incompleteColumns": {}, @@ -2770,17 +2657,7 @@ "enhancements": {}, "hidePanelTitles": false }, - "gridData": { - "h": 13, - "i": "55f916cb-6995-4565-98d0-d88b442fe88e", - "w": 16, - "x": 32, - "y": 102 - }, - "panelIndex": "55f916cb-6995-4565-98d0-d88b442fe88e", - "title": "[WebSocket] Integration Error", - "type": "lens", - "version": "8.7.1" + "title": "[WebSocket] Execution Error" } ], "timeRestore": false, @@ -2795,109 +2672,124 @@ }, "references": [ { - "id": "metrics-*", - "name": "36a3594d-c18b-4d09-ae87-7561750822ae:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", - "type": "index-pattern" + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern", + "id": "metrics-*" }, { + "name": "36a3594d-c18b-4d09-ae87-7561750822ae:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "id": "metrics-*", - "name": "b2ece1d0-652f-481e-9dec-ae411c897a44:indexpattern-datasource-layer-f9ae930c-999d-4b82-a9ce-01d6237fa03c", "type": "index-pattern" }, { + "name": "b2ece1d0-652f-481e-9dec-ae411c897a44:indexpattern-datasource-layer-f9ae930c-999d-4b82-a9ce-01d6237fa03c", "id": "metrics-*", - "name": "e970e1a1-b243-46e0-b200-2cf787f26561:indexpattern-datasource-layer-48d7bfc9-ad80-47ac-974e-a265b9c3af45", "type": "index-pattern" }, { + "name": "e970e1a1-b243-46e0-b200-2cf787f26561:indexpattern-datasource-layer-48d7bfc9-ad80-47ac-974e-a265b9c3af45", "id": "metrics-*", - "name": "8b56a477-3e09-4bb0-94c3-9add2e443772:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "8b56a477-3e09-4bb0-94c3-9add2e443772:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "51e609da-7bb4-4579-843f-88e9748e0982:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "51e609da-7bb4-4579-843f-88e9748e0982:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "eb48842e-d380-4291-aa03-47960594babd:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "eb48842e-d380-4291-aa03-47960594babd:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "a1ef019a-60b1-41d9-845c-cecc5f0450c5:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "a1ef019a-60b1-41d9-845c-cecc5f0450c5:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "070fab3f-bc1d-4ac3-830a-97a86f9a277f:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "type": "index-pattern" }, { + "name": "070fab3f-bc1d-4ac3-830a-97a86f9a277f:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "id": "metrics-*", - "name": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5:indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", "type": "index-pattern" }, { + "name": "de3fd32b-c351-4b26-8c9d-84ce99ed24b5:indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", "id": "metrics-*", - "name": "4979b1bc-45c5-4164-9887-498b4f893513:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "type": "index-pattern" }, { + "name": "4979b1bc-45c5-4164-9887-498b4f893513:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "id": "metrics-*", - "name": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "type": "index-pattern" }, { + "name": "3aa94e06-0dfe-4ae2-93e8-be0627ab841e:indexpattern-datasource-layer-ff2c6fd1-df0b-409d-a7e7-033a129edba3", "id": "metrics-*", - "name": "dc9f0691-ccda-4403-8158-c6191d5090eb:indexpattern-datasource-layer-5e9706cb-90ee-4f08-af6a-f2a8048628af", "type": "index-pattern" }, { + "name": "dc9f0691-ccda-4403-8158-c6191d5090eb:indexpattern-datasource-layer-5e9706cb-90ee-4f08-af6a-f2a8048628af", "id": "metrics-*", - "name": "98f24465-f278-4e2c-93db-9112014a449e:indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", "type": "index-pattern" }, { + "name": "98f24465-f278-4e2c-93db-9112014a449e:indexpattern-datasource-layer-da960427-d6bb-4f17-a5ac-9be25356186a", "id": "metrics-*", - "name": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "bfa3b44b-89ba-43e4-99b7-02ab03bd0a72:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "bf18dbe6-4dcb-4145-a699-bdd859a7ba99:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "8aa530e9-cf48-4966-b829-6e856d749ef9:indexpattern-datasource-layer-56b0bb53-472a-48f9-bc07-b3c340f5a74e", "type": "index-pattern" }, { - "id": "metrics-*", "name": "8773ffcd-1b64-4784-8271-ba54e73eb63d:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", + "id": "metrics-*", "type": "index-pattern" }, { + "name": "55f916cb-6995-4565-98d0-d88b442fe88e:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1:indexpattern-datasource-layer-8e802b8a-241a-42a9-b6fe-64d720488b94", "type": "index-pattern" }, { + "name": "1f4e10e2-b08d-4ad1-9991-9e76c0485cc1:indexpattern-datasource-layer-8e802b8a-241a-42a9-b6fe-64d720488b94", "id": "metrics-*", - "name": "c2039848-87fc-4336-8f9c-c1f3195029d1:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { + "name": "c2039848-87fc-4336-8f9c-c1f3195029d1:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "id": "metrics-*", - "name": "55f916cb-6995-4565-98d0-d88b442fe88e:indexpattern-datasource-layer-2cfef95f-fa80-4a29-b211-9874dba1c2bb", "type": "index-pattern" }, { - "id": "metrics-*", "name": "controlGroup_9edfaf7a-7867-4413-84df-4648537b365a:optionsListDataView", - "type": "index-pattern" + "type": "index-pattern", + "id": "metrics-*" + }, + { + "name": "controlGroup_f72aa0d1-b9b2-4817-951d-60259a5f9bb0:optionsListDataView", + "type": "index-pattern", + "id": "metrics-*" + }, + { + "name": "controlGroup_729df68e-b651-4e0a-8b7b-d025a3d7fb05:optionsListDataView", + "type": "index-pattern", + "id": "metrics-*" + }, + { + "name": "controlGroup_fd2f10f0-1233-42e4-8dcf-af0a9676ea7c:optionsListDataView", + "type": "index-pattern", + "id": "metrics-*" } ], "type": "dashboard" diff --git a/packages/aws/kibana/dashboard/aws-c2b1cbc0-6891-11ea-b0ac-95d4ecb1fecd.json b/packages/aws/kibana/dashboard/aws-c2b1cbc0-6891-11ea-b0ac-95d4ecb1fecd.json index 5178c69b2e3..abdc7e108d4 100644 --- a/packages/aws/kibana/dashboard/aws-c2b1cbc0-6891-11ea-b0ac-95d4ecb1fecd.json +++ b/packages/aws/kibana/dashboard/aws-c2b1cbc0-6891-11ea-b0ac-95d4ecb1fecd.json @@ -90,7 +90,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "2be82836-3227-41d5-8ad2-f7b666330f2e", "layerType": "data", "metricAccessor": "921ab0b9-2a39-4b9a-9a9f-fc9cf0db58ac" @@ -305,7 +304,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "c49d4404-7e1d-47b8-a6f7-0c5c67eddc0d", "layerType": "data", "metricAccessor": "b09057e6-1cb6-40b0-b671-fa5f75f49c88" @@ -377,7 +375,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "daa7ca03-5ead-495d-8eac-80aa3d03f95f", "layerType": "data", "metricAccessor": "00722a15-cbac-4ddb-a505-b60f4003070c", diff --git a/packages/aws/kibana/dashboard/aws-c5846400-f7fb-11e8-af03-c999c9dea608.json b/packages/aws/kibana/dashboard/aws-c5846400-f7fb-11e8-af03-c999c9dea608.json index 134f66e5dc5..f06105b7103 100644 --- a/packages/aws/kibana/dashboard/aws-c5846400-f7fb-11e8-af03-c999c9dea608.json +++ b/packages/aws/kibana/dashboard/aws-c5846400-f7fb-11e8-af03-c999c9dea608.json @@ -231,7 +231,7 @@ } }, "scale": "ratio", - "sourceField": "aws.ec2.status.check_failed" + "sourceField": "aws.ec2.metrics.StatusCheckFailed.avg" } }, "incompleteColumns": {} @@ -249,7 +249,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "9c4853fc-7664-4b48-97c4-856bc94b6889", "layerType": "data", "metricAccessor": "ec85ba57-c17c-417d-9d1d-2b84ad163643" diff --git a/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json b/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json index b3db2c6fbd4..7459927808c 100644 --- a/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json +++ b/packages/aws/kibana/dashboard/aws-c9f103d0-5f63-11ed-bd69-473ce047ef30.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"d620f0d7-381f-456f-8660-a6e6838e34fc\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"data_stream.dataset\",\"title\":\"Integrations\",\"id\":\"d620f0d7-381f-456f-8660-a6e6838e34fc\",\"enhancements\":{},\"selectedOptions\":[]}},\"f7d8c037-280e-4387-84e2-fa76ee6124da\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"aws.securityhub_findings.region\",\"title\":\"Region\",\"id\":\"f7d8c037-280e-4387-84e2-fa76ee6124da\",\"enhancements\":{},\"selectedOptions\":[]}},\"c819da49-49e8-4460-8329-8521d7f8ac8a\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.account.id\",\"title\":\"Account\",\"id\":\"c819da49-49e8-4460-8329-8521d7f8ac8a\",\"enhancements\":{},\"selectedOptions\":[]}}}" }, "description": "AWS Security Hub Findings Summary", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -41,6 +40,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,7 +81,7 @@ }, "panelIndex": "cc027475-1e31-4ccf-bdd7-9655809a1c30", "type": "visualization", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -93,7 +95,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4b9a3fe3-f262-48c5-97cd-3f32f2264fdb": { "columnOrder": [ @@ -150,15 +152,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "fb8cd887-3cd0-45c3-8aed-262a64d6b8b3" - ], "layerId": "4b9a3fe3-f262-48c5-97cd-3f32f2264fdb", "layerType": "data", "legendDisplay": "default", - "metric": "7bcad210-7a5d-4afe-94ea-942f04dc5e68", + "metrics": [ + "7bcad210-7a5d-4afe-94ea-942f04dc5e68" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "fb8cd887-3cd0-45c3-8aed-262a64d6b8b3" + ] } ], "shape": "donut" @@ -181,7 +185,7 @@ "panelIndex": "146c2ac6-d83d-4fcb-808a-d24c2762f45c", "title": "Distribution of Events by Account [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -195,7 +199,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "45c33cba-b3b0-45a4-91f3-a13600dbfdcc": { "columnOrder": [ @@ -251,15 +255,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6d202975-b109-4e8b-a047-019162160e00" - ], "layerId": "45c33cba-b3b0-45a4-91f3-a13600dbfdcc", "layerType": "data", "legendDisplay": "default", - "metric": "25539159-d53b-4507-9e4b-e5aa60e46960", + "metrics": [ + "25539159-d53b-4507-9e4b-e5aa60e46960" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6d202975-b109-4e8b-a047-019162160e00" + ] } ], "shape": "donut" @@ -282,7 +288,7 @@ "panelIndex": "2aeb6bda-8e7f-40bf-a8b3-ea8fdee8dea7", "title": "Distribution of Events by Region [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -296,7 +302,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "abc2e8dc-c832-4535-bdf4-d39175c25d2e": { "columnOrder": [ @@ -358,7 +364,7 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetricNew" + "visualizationType": "lnsMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -373,7 +379,7 @@ "panelIndex": "7a319626-d1c2-4728-9611-3bbea3c850d4", "title": "Count by Severity [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -387,7 +393,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cc8f028d-adf1-46a8-a162-aa6ba2cb8406": { "columnOrder": [ @@ -449,7 +455,7 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetricNew" + "visualizationType": "lnsMetric" }, "enhancements": {} }, @@ -462,7 +468,7 @@ }, "panelIndex": "7cb13a54-c41f-4653-be22-340b99b6d83c", "type": "lens", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -477,7 +483,7 @@ "state": { "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "abc2e8dc-c832-4535-bdf4-d39175c25d2e": { "columnOrder": [ @@ -602,83 +608,110 @@ "panelIndex": "7c5505a3-f4e0-43af-8e25-260e9e7e8473", "title": "Distribution of Finding's Severity Over Time [Logs AWS]", "type": "lens", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "emptyAsNull": false, - "field": "event.id" - }, - "schema": "metric", - "type": "cardinality" + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b6d482c4-5861-4768-a01d-df114f2df10c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b6d482c4-5861-4768-a01d-df114f2df10c": { + "columnOrder": [ + "d0ce7a75-18da-4c6d-a7a4-f3731fc2c804", + "0ca8af2e-f100-4b02-a31d-73cdbbcfef3c" + ], + "columns": { + "0ca8af2e-f100-4b02-a31d-73cdbbcfef3c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "d0ce7a75-18da-4c6d-a7a4-f3731fc2c804": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Instance ID ", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0ca8af2e-f100-4b02-a31d-73cdbbcfef3c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "cloud.instance.id" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Instance ID ", - "excludeIsRegex": true, - "field": "cloud.instance.id", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + "textBased": { + "layers": {} } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "0ca8af2e-f100-4b02-a31d-73cdbbcfef3c" + }, + { + "alignment": "left", + "columnId": "d0ce7a75-18da-4c6d-a7a4-f3731fc2c804" } - } + ], + "headerRowHeight": "single", + "layerId": "b6d482c4-5861-4768-a01d-df114f2df10c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Security Hub - Affected Instance ID [Logs AWS] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 8, @@ -689,110 +722,142 @@ }, "panelIndex": "d296bb5b-a63d-4931-84aa-d3a2d0fa754d", "title": "Security Hub - Affected Instance ID [Logs AWS]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Finding Type", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.types", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Severity Label", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.severity.label", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 100 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " - } - } - }, + "attributes": { "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 0, - "width": 650 - }, - { - "colIndex": 1, - "width": 556 + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-82d08903-c849-4c8d-b8b8-8fd454fc4ff3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "82d08903-c849-4c8d-b8b8-8fd454fc4ff3": { + "columnOrder": [ + "ecd5aae0-fa34-4c2d-ae22-1e66e2ddb9cf", + "b70803d5-0f60-490c-afb3-b4e00ee6d46c", + "b1c7d6c3-1538-4e39-ab0d-0aef9be0b526" + ], + "columns": { + "b1c7d6c3-1538-4e39-ab0d-0aef9be0b526": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b70803d5-0f60-490c-afb3-b4e00ee6d46c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity Label", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b1c7d6c3-1538-4e39-ab0d-0aef9be0b526", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.severity.label" + }, + "ecd5aae0-fa34-4c2d-ae22-1e66e2ddb9cf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Finding Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b1c7d6c3-1538-4e39-ab0d-0aef9be0b526", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.types" + } + }, + "incompleteColumns": {} } - ], - "sort": { - "columnIndex": 2, - "direction": "desc" } + }, + "textBased": { + "layers": {} } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "b1c7d6c3-1538-4e39-ab0d-0aef9be0b526" + }, + { + "alignment": "left", + "columnId": "ecd5aae0-fa34-4c2d-ae22-1e66e2ddb9cf" + }, + { + "alignment": "left", + "columnId": "b70803d5-0f60-490c-afb3-b4e00ee6d46c" + } + ], + "headerRowHeight": "single", + "layerId": "82d08903-c849-4c8d-b8b8-8fd454fc4ff3", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Security Hub - Finding Types [Logs AWS] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -803,293 +868,419 @@ }, "panelIndex": "933df910-8ae4-4a4b-9af7-87b30a92d952", "title": "Security Hub - Finding Types [Logs AWS]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "emptyAsNull": false, - "field": "event.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "excludeIsRegex": true, - "field": "network.direction", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 6 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " - } - } - }, + "attributes": { "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9ef8c19c-b6ff-405a-9d42-514495ccd36c", + "type": "index-pattern" } - } - } - }, - "gridData": { - "h": 8, - "i": "a4cba719-5f51-4090-910f-12e39dc01239", - "w": 11, - "x": 0, - "y": 47 - }, - "panelIndex": "a4cba719-5f51-4090-910f-12e39dc01239", - "title": "Security Hub - Network Direction [Logs AWS]", - "type": "visualization", - "version": "8.4.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Workflow", - "field": "aws.securityhub_findings.workflow.status", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9ef8c19c-b6ff-405a-9d42-514495ccd36c": { + "columnOrder": [ + "819379b0-1a98-4be5-a471-55ac44fbf024", + "368eb4c9-51ae-4aef-a439-a8547fbfe987" + ], + "columns": { + "368eb4c9-51ae-4aef-a439-a8547fbfe987": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "819379b0-1a98-4be5-a471-55ac44fbf024": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.direction: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "368eb4c9-51ae-4aef-a439-a8547fbfe987", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 6 + }, + "scale": "ordinal", + "sourceField": "network.direction" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Severity", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.severity.normalized", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "368eb4c9-51ae-4aef-a439-a8547fbfe987" }, - "schema": "bucket", - "type": "terms" - }, - { + { + "alignment": "left", + "columnId": "819379b0-1a98-4be5-a471-55ac44fbf024" + } + ], + "headerRowHeight": "single", + "layerId": "9ef8c19c-b6ff-405a-9d42-514495ccd36c", + "layerType": "data", + "paging": { "enabled": true, - "id": "6", - "params": { - "customLabel": "Label", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.severity.label", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "size": 10 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Account", - "excludeIsRegex": true, - "field": "cloud.account.id", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "rowHeight": "single" + } + }, + "title": "Security Hub - Network Direction [Logs AWS] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "a4cba719-5f51-4090-910f-12e39dc01239", + "w": 11, + "x": 0, + "y": 47 + }, + "panelIndex": "a4cba719-5f51-4090-910f-12e39dc01239", + "title": "Security Hub - Network Direction [Logs AWS]", + "type": "lens", + "version": "8.8.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-62cff437-61bd-46d9-91ce-412aa336de04", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "62cff437-61bd-46d9-91ce-412aa336de04": { + "columnOrder": [ + "dcdef06d-44d3-453e-a7f1-88523373c0f6", + "cd0e385c-2a0e-4908-918a-385e195dad32", + "126df109-06ba-4d0c-bdb5-dff16bad0c16", + "44d316f6-eb70-4230-b17a-d84c9773e7b7", + "f5f7e973-6d86-44f5-b402-cd291a158d30", + "899a4a7e-919a-429b-8035-0b8cd268c5cf", + "bf150044-adc1-4873-a60d-684a9d1c3d20", + "31bff37d-ab4d-4730-a9ad-79e9d7c22de9", + "edd7ce3d-69ca-4079-81ba-c03ac8f70f21" + ], + "columns": { + "126df109-06ba-4d0c-bdb5-dff16bad0c16": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Account", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "cloud.account.id" + }, + "31bff37d-ab4d-4730-a9ad-79e9d7c22de9": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "aws.securityhub_findings.record_state: *" + }, + "isBucketed": false, + "label": "Record State", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.record_state" + }, + "44d316f6-eb70-4230-b17a-d84c9773e7b7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Region", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.region" + }, + "899a4a7e-919a-429b-8035-0b8cd268c5cf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "event.id" + }, + "bf150044-adc1-4873-a60d-684a9d1c3d20": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "aws.securityhub_findings.workflow.status: *" + }, + "isBucketed": false, + "label": "Workflow", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.workflow.status" + }, + "cd0e385c-2a0e-4908-918a-385e195dad32": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Label", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.severity.label" + }, + "dcdef06d-44d3-453e-a7f1-88523373c0f6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.severity.normalized" + }, + "edd7ce3d-69ca-4079-81ba-c03ac8f70f21": { + "customLabel": true, + "dataType": "date", + "isBucketed": false, + "label": "Timestamp", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "@timestamp" + }, + "f5f7e973-6d86-44f5-b402-cd291a158d30": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Product", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.product.name" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Region", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.region", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "bf150044-adc1-4873-a60d-684a9d1c3d20" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Product", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.product.name", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + { + "alignment": "left", + "columnId": "31bff37d-ab4d-4730-a9ad-79e9d7c22de9" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "7", - "params": { - "aggregate": "concat", - "customLabel": "Record State", - "field": "aws.securityhub_findings.record_state", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" + { + "alignment": "left", + "columnId": "dcdef06d-44d3-453e-a7f1-88523373c0f6" }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "8", - "params": { - "customLabel": "Timestamp", - "field": "@timestamp" + { + "alignment": "left", + "columnId": "cd0e385c-2a0e-4908-918a-385e195dad32" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "10", - "params": { - "customLabel": "ID", - "excludeIsRegex": true, - "field": "event.id", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "-", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + { + "alignment": "left", + "columnId": "126df109-06ba-4d0c-bdb5-dff16bad0c16" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " - } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 20, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + { + "alignment": "left", + "columnId": "44d316f6-eb70-4230-b17a-d84c9773e7b7" + }, + { + "alignment": "left", + "columnId": "f5f7e973-6d86-44f5-b402-cd291a158d30" + }, + { + "alignment": "left", + "columnId": "899a4a7e-919a-429b-8035-0b8cd268c5cf" + }, + { + "columnId": "edd7ce3d-69ca-4079-81ba-c03ac8f70f21", + "isTransposed": false } - } + ], + "headerRowHeight": "single", + "layerId": "62cff437-61bd-46d9-91ce-412aa336de04", + "layerType": "data", + "paging": { + "enabled": true, + "size": 20 + }, + "rowHeight": "single" } - } - } + }, + "title": "Security Hub - Findings [Logs AWS] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -1100,8 +1291,8 @@ }, "panelIndex": "5c3b2b5f-b097-4b2e-adae-a4d9149e808f", "title": "Security Hub - Findings [Logs AWS]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { @@ -1137,189 +1328,274 @@ "panelIndex": "7a8bdb96-e4c4-4e63-bc80-14fbd4b97c2f", "title": "", "type": "visualization", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Workflow", - "field": "aws.securityhub_findings.workflow.status", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Account", - "excludeIsRegex": true, - "field": "cloud.account.id", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderAgg": { - "enabled": true, - "id": "2-orderAgg", - "params": { - "emptyAsNull": false + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-946ff939-5488-4f22-9b9c-f96707dd1e6a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "946ff939-5488-4f22-9b9c-f96707dd1e6a": { + "columnOrder": [ + "2e4c0553-5188-4999-b833-39de963396a9", + "440bc381-b954-4fb5-b0dd-8445f16fd495", + "e4aa3ccd-813f-4021-95f5-476c643bf49c", + "10ef0679-7a1e-49ee-926e-572f24e60f8c", + "5c861f3b-9f9c-44e8-a2d8-90f6b315460f", + "cb8daec8-89a8-4f60-aae2-df7f72f8e2e0", + "b19f4eb7-2ec2-4460-bf0a-388680b3347b", + "006be8f8-7a9c-444b-9368-ff77309d1f40" + ], + "columns": { + "006be8f8-7a9c-444b-9368-ff77309d1f40": { + "customLabel": true, + "dataType": "date", + "isBucketed": false, + "label": "Timestamp", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "@timestamp" + }, + "10ef0679-7a1e-49ee-926e-572f24e60f8c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.id" + }, + "2e4c0553-5188-4999-b833-39de963396a9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Account", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "cloud.account.id" + }, + "440bc381-b954-4fb5-b0dd-8445f16fd495": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Region", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.region" + }, + "5c861f3b-9f9c-44e8-a2d8-90f6b315460f": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "aws.securityhub_findings.workflow.status: *" + }, + "isBucketed": false, + "label": "Workflow", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.workflow.status" + }, + "b19f4eb7-2ec2-4460-bf0a-388680b3347b": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "aws.securityhub_findings.record_state: *" + }, + "isBucketed": false, + "label": "Record State", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.record_state" + }, + "cb8daec8-89a8-4f60-aae2-df7f72f8e2e0": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "aws.securityhub_findings.compliance.status: *" + }, + "isBucketed": false, + "label": "Compliance", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.compliance.status" + }, + "e4aa3ccd-813f-4021-95f5-476c643bf49c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Generator Id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "aws.securityhub_findings.generator.id" + } }, - "schema": "orderAgg", - "type": "count" - }, - "orderBy": "custom", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Region", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.region", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "5c861f3b-9f9c-44e8-a2d8-90f6b315460f" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "7", - "params": { - "customLabel": "Generator Id", - "excludeIsRegex": true, - "field": "aws.securityhub_findings.generator.id", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "asc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + { + "alignment": "left", + "columnId": "cb8daec8-89a8-4f60-aae2-df7f72f8e2e0" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Id", - "excludeIsRegex": true, - "field": "event.id", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + { + "alignment": "left", + "columnId": "b19f4eb7-2ec2-4460-bf0a-388680b3347b" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "aggregate": "concat", - "customLabel": "Compliance", - "field": "aws.securityhub_findings.compliance.status", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" + { + "alignment": "left", + "columnId": "2e4c0553-5188-4999-b833-39de963396a9" }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "6", - "params": { - "aggregate": "concat", - "customLabel": "Record State", - "field": "aws.securityhub_findings.record_state", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" + { + "alignment": "left", + "columnId": "440bc381-b954-4fb5-b0dd-8445f16fd495" }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "8", - "params": { - "customLabel": "Timestamp", - "field": "@timestamp" + { + "alignment": "left", + "columnId": "e4aa3ccd-813f-4021-95f5-476c643bf49c" }, - "schema": "metric", - "type": "max" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"aws.securityhub_findings\" or data_stream.dataset : \"aws.securityhub_insights\" " - } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + { + "alignment": "left", + "columnId": "10ef0679-7a1e-49ee-926e-572f24e60f8c" + }, + { + "columnId": "006be8f8-7a9c-444b-9368-ff77309d1f40", + "isTransposed": false } - } + ], + "headerRowHeight": "single", + "layerId": "946ff939-5488-4f22-9b9c-f96707dd1e6a", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Data table visualization (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -1330,8 +1606,8 @@ }, "panelIndex": "9c9ea523-c04c-4783-9737-494bb8a1d068", "title": "", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { @@ -1367,7 +1643,7 @@ "panelIndex": "a22c199d-3314-4dc0-9c99-79d7dad12c6c", "title": "", "type": "visualization", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -1383,7 +1659,7 @@ "panelIndex": "7fad8ba7-c80b-45f5-ace4-0757caa63766", "panelRefName": "panel_7fad8ba7-c80b-45f5-ace4-0757caa63766", "type": "search", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -1399,7 +1675,7 @@ "panelIndex": "d730fda4-95c3-4c8f-9236-6dd187a9f63c", "panelRefName": "panel_d730fda4-95c3-4c8f-9236-6dd187a9f63c", "type": "search", - "version": "8.4.0" + "version": "8.8.1" }, { "embeddableConfig": { @@ -1436,17 +1712,18 @@ "panelIndex": "d5280fe0-536d-45b0-87c4-1fb9c41065fd", "title": "Dashboards [Logs AWS]", "type": "visualization", - "version": "8.4.0" + "version": "8.8.1" } ], "timeRestore": false, "title": "[Logs AWS] Security Hub Summary Dashboard", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", "id": "aws-c9f103d0-5f63-11ed-bd69-473ce047ef30", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1481,27 +1758,27 @@ }, { "id": "logs-*", - "name": "d296bb5b-a63d-4931-84aa-d3a2d0fa754d:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "d296bb5b-a63d-4931-84aa-d3a2d0fa754d:indexpattern-datasource-layer-b6d482c4-5861-4768-a01d-df114f2df10c", "type": "index-pattern" }, { "id": "logs-*", - "name": "933df910-8ae4-4a4b-9af7-87b30a92d952:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "933df910-8ae4-4a4b-9af7-87b30a92d952:indexpattern-datasource-layer-82d08903-c849-4c8d-b8b8-8fd454fc4ff3", "type": "index-pattern" }, { "id": "logs-*", - "name": "a4cba719-5f51-4090-910f-12e39dc01239:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "a4cba719-5f51-4090-910f-12e39dc01239:indexpattern-datasource-layer-9ef8c19c-b6ff-405a-9d42-514495ccd36c", "type": "index-pattern" }, { "id": "logs-*", - "name": "5c3b2b5f-b097-4b2e-adae-a4d9149e808f:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "5c3b2b5f-b097-4b2e-adae-a4d9149e808f:indexpattern-datasource-layer-62cff437-61bd-46d9-91ce-412aa336de04", "type": "index-pattern" }, { "id": "logs-*", - "name": "9c9ea523-c04c-4783-9737-494bb8a1d068:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "9c9ea523-c04c-4783-9737-494bb8a1d068:indexpattern-datasource-layer-946ff939-5488-4f22-9b9c-f96707dd1e6a", "type": "index-pattern" }, { diff --git a/packages/aws/kibana/dashboard/aws-dfa76470-4ba1-11ec-8282-5342b8988acc.json b/packages/aws/kibana/dashboard/aws-dfa76470-4ba1-11ec-8282-5342b8988acc.json index 384ad3e7f6f..a95c50e470f 100644 --- a/packages/aws/kibana/dashboard/aws-dfa76470-4ba1-11ec-8282-5342b8988acc.json +++ b/packages/aws/kibana/dashboard/aws-dfa76470-4ba1-11ec-8282-5342b8988acc.json @@ -1,14 +1,12 @@ { - "id": "aws-dfa76470-4ba1-11ec-8282-5342b8988acc", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg2NSwxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"95767951-d2dc-41b5-83ab-d7eb4938d076\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"95767951-d2dc-41b5-83ab-d7eb4938d076\",\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"enhancements\":{}}},\"149de20b-7221-43eb-9447-0c3b42aeec24\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"149de20b-7221-43eb-9447-0c3b42aeec24\",\"fieldName\":\"cloud.availability_zone\",\"title\":\"Availability Zone\",\"enhancements\":{}}},\"5384c422-5326-4800-b08d-1c21c2fb3521\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"5384c422-5326-4800-b08d-1c21c2fb3521\",\"fieldName\":\"observer.name\",\"title\":\"Firewall\",\"enhancements\":{}}}}" + }, "description": "Dashboard providing statistics about alerts ingested from the AWS Network Firewall integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -64,20 +62,12 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", - "w": 12, - "x": 0, - "y": 0 - }, - "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "embeddableConfig": { "enhancements": {}, "savedVis": { @@ -101,106 +91,20 @@ "title": "", "type": "markdown", "uiState": {} - }, - "type": "visualization" - } - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Firewall Filters [Logs AWS]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1637591016076", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "cloud.availability_zone", - "id": "1637591029629", - "indexPatternRefName": "control_1_index_pattern", - "label": "Availability Zone", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "observer.name", - "id": "1637591118622", - "indexPatternRefName": "control_2_index_pattern", - "label": "Firewall", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } } }, "gridData": { - "h": 7, - "i": "8bc8eff1-b70e-4f81-b2a1-de0db6742337", - "w": 36, - "x": 12, + "h": 16, + "i": "258f7245-5011-4f03-bcd3-cada0180dc7a", + "w": 18, + "x": 0, "y": 0 }, - "panelIndex": "8bc8eff1-b70e-4f81-b2a1-de0db6742337", - "title": "Firewall Filters", + "panelIndex": "258f7245-5011-4f03-bcd3-cada0180dc7a", "type": "visualization", - "version": "8.0.0" + "version": "8.8.1" }, { - "version": "8.1.0", - "type": "lens", - "gridData": { - "h": 7, - "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", - "w": 6, - "x": 12, - "y": 7 - }, - "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", "embeddableConfig": { "attributes": { "references": [ @@ -217,7 +121,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -263,30 +167,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Source IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 7, - "i": "4c85d573-baea-49ca-bb9e-4013a0373da7", - "w": 6, + "h": 8, + "i": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "w": 10, "x": 18, - "y": 7 + "y": 0 }, - "panelIndex": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "panelIndex": "dfcf4383-4ce2-42a2-b0a9-a48dbf39db64", + "title": "Unique Source IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -303,7 +209,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -349,30 +255,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Destination IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 7, - "i": "b0b8c30c-2096-49ee-95b3-9adbf27808e5", - "w": 6, - "x": 24, - "y": 7 + "h": 8, + "i": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "w": 10, + "x": 28, + "y": 0 }, - "panelIndex": "b0b8c30c-2096-49ee-95b3-9adbf27808e5", + "panelIndex": "4c85d573-baea-49ca-bb9e-4013a0373da7", + "title": "Unique Destination IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -389,7 +297,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -435,30 +343,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Source Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 7, - "i": "e0be3094-1544-4c59-858c-05320b57c3a7", - "w": 6, - "x": 30, - "y": 7 + "h": 8, + "i": "b0b8c30c-2096-49ee-95b3-9adbf27808e5", + "w": 10, + "x": 38, + "y": 0 }, - "panelIndex": "e0be3094-1544-4c59-858c-05320b57c3a7", + "panelIndex": "b0b8c30c-2096-49ee-95b3-9adbf27808e5", + "title": "Unique Source Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -475,7 +385,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -521,30 +431,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Destination Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 7, - "i": "673dd2b3-e271-4ad9-9b86-83e4e1070647", - "w": 6, - "x": 36, - "y": 7 + "h": 8, + "i": "e0be3094-1544-4c59-858c-05320b57c3a7", + "w": 10, + "x": 18, + "y": 8 }, - "panelIndex": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "panelIndex": "e0be3094-1544-4c59-858c-05320b57c3a7", + "title": "Unique Destination Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -561,7 +473,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -607,30 +519,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Network Protocols" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 7, - "i": "09caeba8-1f98-4937-b1b8-60debe3e3728", - "w": 6, - "x": 42, - "y": 7 + "h": 8, + "i": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "w": 10, + "x": 28, + "y": 8 }, - "panelIndex": "09caeba8-1f98-4937-b1b8-60debe3e3728", + "panelIndex": "673dd2b3-e271-4ad9-9b86-83e4e1070647", + "title": "Unique Network Protocols", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -647,7 +561,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "454630b2-cff5-45ab-9cfc-ec19c5aeb97a": { "columnOrder": [ @@ -693,30 +607,32 @@ "visualization": { "accessor": "fe432a5c-5813-4a13-948e-ea6d83ec8c40", "layerId": "454630b2-cff5-45ab-9cfc-ec19c5aeb97a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Unique Rules" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 15, - "i": "0e2449f9-149d-473f-99f6-28e3ef05f2fd", - "w": 12, - "x": 0, - "y": 14 + "h": 8, + "i": "09caeba8-1f98-4937-b1b8-60debe3e3728", + "w": 10, + "x": 38, + "y": 8 }, - "panelIndex": "0e2449f9-149d-473f-99f6-28e3ef05f2fd", + "panelIndex": "09caeba8-1f98-4937-b1b8-60debe3e3728", + "title": "Unique Rules", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -733,7 +649,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1759e92e-4fa4-4b59-ad5b-333b72cc71b2": { "columnOrder": [ @@ -795,6 +711,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_horizontal_stacked", @@ -813,22 +730,21 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Rules" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "2148efa5-f130-4751-909d-6a79eed2e16b", + "i": "0e2449f9-149d-473f-99f6-28e3ef05f2fd", "w": 12, - "x": 12, - "y": 14 + "x": 0, + "y": 16 }, - "panelIndex": "2148efa5-f130-4751-909d-6a79eed2e16b", + "panelIndex": "0e2449f9-149d-473f-99f6-28e3ef05f2fd", + "title": "Top Rules", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -845,7 +761,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -894,15 +810,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f49ff962-9e8a-4170-a0d8-54cee9438651" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f49ff962-9e8a-4170-a0d8-54cee9438651" + ] } ], "shape": "pie" @@ -913,22 +832,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Source Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "i": "2148efa5-f130-4751-909d-6a79eed2e16b", "w": 12, - "x": 24, - "y": 14 + "x": 12, + "y": 16 }, - "panelIndex": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "panelIndex": "2148efa5-f130-4751-909d-6a79eed2e16b", + "title": "Top Source Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -945,7 +863,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -994,15 +912,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f49ff962-9e8a-4170-a0d8-54cee9438651" - ], "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", "layerType": "data", "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f49ff962-9e8a-4170-a0d8-54cee9438651" + ] } ], "shape": "pie" @@ -1013,22 +934,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Destination Countries" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 15, - "i": "f7c1e866-ba0d-45af-95bf-2736901431dc", + "i": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", "w": 12, - "x": 36, - "y": 14 + "x": 24, + "y": 16 }, - "panelIndex": "f7c1e866-ba0d-45af-95bf-2736901431dc", + "panelIndex": "6790d45f-4fa9-4a70-b0e1-a3e10682c852", + "title": "Top Destination Countries", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1045,7 +965,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "77c8c7dc-b073-4d7c-8403-b25ee4647152": { "columnOrder": [ @@ -1113,20 +1033,23 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ + "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ "76f26815-f13c-4273-b52f-7c25247f2b0d", "76f26815-f13c-4273-b52f-7c25247f2b0d", "9367ad41-b48b-438e-b4d8-2c3f85aff052", "76f26815-f13c-4273-b52f-7c25247f2b0d", "76f26815-f13c-4273-b52f-7c25247f2b0d", "76f26815-f13c-4273-b52f-7c25247f2b0d" - ], - "layerId": "77c8c7dc-b073-4d7c-8403-b25ee4647152", - "layerType": "data", - "legendDisplay": "default", - "metric": "0e88e9b7-a2b1-4634-95c1-a7d38dce70a6", - "nestedLegend": false, - "numberDisplay": "percent" + ] } ], "shape": "donut" @@ -1137,22 +1060,21 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Network Protocols and Applications" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { - "h": 11, - "i": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "h": 15, + "i": "f7c1e866-ba0d-45af-95bf-2736901431dc", "w": 12, - "x": 0, - "y": 29 + "x": 36, + "y": 16 }, - "panelIndex": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "panelIndex": "f7c1e866-ba0d-45af-95bf-2736901431dc", + "title": "Network Protocols and Applications", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1169,7 +1091,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1227,7 +1149,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1235,22 +1159,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Event Generating Firewalls" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "i": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", "w": 12, - "x": 12, - "y": 29 + "x": 0, + "y": 31 }, - "panelIndex": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "panelIndex": "ce8caf3c-c830-4500-a4bf-66a9f354cd49", + "title": "Top Event Generating Firewalls", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1267,7 +1190,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1325,7 +1248,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1333,22 +1258,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Event Source IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "8a1bd282-e360-473d-b26d-e73f2b470c81", + "i": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", "w": 12, - "x": 24, - "y": 29 + "x": 12, + "y": 31 }, - "panelIndex": "8a1bd282-e360-473d-b26d-e73f2b470c81", + "panelIndex": "9609e04b-0043-4b3a-a31b-a2461c1e3dcb", + "title": "Top Event Source IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1365,7 +1289,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1423,7 +1347,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1431,22 +1357,21 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Event Destination IPs" - }, - { - "version": "8.1.0", - "type": "lens", "gridData": { "h": 11, - "i": "3b9a2a5f-1226-415c-88d5-21496508d060", + "i": "8a1bd282-e360-473d-b26d-e73f2b470c81", "w": 12, - "x": 36, - "y": 29 + "x": 24, + "y": 31 }, - "panelIndex": "3b9a2a5f-1226-415c-88d5-21496508d060", + "panelIndex": "8a1bd282-e360-473d-b26d-e73f2b470c81", + "title": "Top Event Destination IPs", + "type": "lens", + "version": "8.8.1" + }, + { "embeddableConfig": { "attributes": { "references": [ @@ -1463,7 +1388,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5c93c96-5038-49e1-acca-2e876257c059": { "columnOrder": [ @@ -1521,7 +1446,9 @@ } ], "layerId": "a5c93c96-5038-49e1-acca-2e876257c059", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1529,10 +1456,19 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, - "title": "Top Network Protocols" + "gridData": { + "h": 11, + "i": "3b9a2a5f-1226-415c-88d5-21496508d060", + "w": 12, + "x": 36, + "y": 31 + }, + "panelIndex": "3b9a2a5f-1226-415c-88d5-21496508d060", + "title": "Top Network Protocols", + "type": "lens", + "version": "8.8.1" }, { "embeddableConfig": { @@ -1553,19 +1489,25 @@ "i": "cc6fd495-c70e-4805-b097-e40ac11d2fb8", "w": 48, "x": 0, - "y": 40 + "y": 42 }, "panelIndex": "cc6fd495-c70e-4805-b097-e40ac11d2fb8", "panelRefName": "panel_cc6fd495-c70e-4805-b097-e40ac11d2fb8", "title": "Firewall Logs", "type": "search", - "version": "7.15.1" + "version": "8.8.1" } ], "timeRestore": false, "title": "[Logs AWS] Firewall Alerts", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T09:17:37.345Z", + "id": "aws-dfa76470-4ba1-11ec-8282-5342b8988acc", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "logs-*", @@ -1723,23 +1665,20 @@ "type": "search" }, { - "type": "index-pattern", - "name": "8bc8eff1-b70e-4f81-b2a1-de0db6742337:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_95767951-d2dc-41b5-83ab-d7eb4938d076:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "8bc8eff1-b70e-4f81-b2a1-de0db6742337:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_149de20b-7221-43eb-9447-0c3b42aeec24:optionsListDataView", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "8bc8eff1-b70e-4f81-b2a1-de0db6742337:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "controlGroup_5384c422-5326-4800-b08d-1c21c2fb3521:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-e6776b10-1534-11ea-841c-01bf20a6c8ba.json b/packages/aws/kibana/dashboard/aws-e6776b10-1534-11ea-841c-01bf20a6c8ba.json index b9d82d7c95e..7e7999564e4 100644 --- a/packages/aws/kibana/dashboard/aws-e6776b10-1534-11ea-841c-01bf20a6c8ba.json +++ b/packages/aws/kibana/dashboard/aws-e6776b10-1534-11ea-841c-01bf20a6c8ba.json @@ -1,14 +1,12 @@ { - "id": "aws-e6776b10-1534-11ea-841c-01bf20a6c8ba", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-08-01T13:47:45.463Z", - "version": "Wzg2NiwxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"68e8bd22-884f-4cd1-8483-844cd707bf67\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"68e8bd22-884f-4cd1-8483-844cd707bf67\",\"fieldName\":\"cloud.account.name\",\"title\":\"Account Name\",\"enhancements\":{},\"selectedOptions\":[]}}}" + }, "description": "Overview of AWS Billing Metrics", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -42,174 +40,230 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "title": "AWS Account Filter", - "savedVis": { - "title": "AWS Account Filter [Metrics AWS]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.account.name", - "id": "1549397251041", - "indexPatternRefName": "control_0_index_pattern", - "label": "account name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-fe01457b-2279-4f97-9032-3a29f57e877a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" + }, + "datasourceStates": { + "formBased": { + "layers": { + "fe01457b-2279-4f97-9032-3a29f57e877a": { + "columnOrder": [ + "bc3ef8f7-e93e-4e67-9ff3-3f7aa140c4f7" + ], + "columns": { + "bc3ef8f7-e93e-4e67-9ff3-3f7aa140c4f7": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "aws.billing.EstimatedCharges : * and not aws.billing.ServiceName : *" + }, + "isBucketed": false, + "label": "Total Estimated Charges ($)", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2, + "suffix": "" + } + } + }, + "reducedTimeRange": "12h", + "scale": "ratio", + "sourceField": "aws.billing.EstimatedCharges" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "bc3ef8f7-e93e-4e67-9ff3-3f7aa140c4f7", + "layerId": "fe01457b-2279-4f97-9032-3a29f57e877a", + "layerType": "data", + "size": "l", + "textAlign": "center" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsLegacyMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 5, - "i": "89dccfe8-a25e-44ea-afdb-ff01ab1f05d6", + "h": 16, + "i": "221aab02-2747-4d84-9dde-028ccd51bdce", "w": 16, "x": 0, "y": 0 }, - "panelIndex": "89dccfe8-a25e-44ea-afdb-ff01ab1f05d6", - "title": "AWS Account Filter", - "version": "8.0.0", - "type": "visualization" + "panelIndex": "221aab02-2747-4d84-9dde-028ccd51bdce", + "title": "Total Estimated Charges", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "Estimated Billing Chart", - "savedVis": { - "title": "Estimated Billing Pie Chart [Metrics AWS]", - "description": "", - "uiState": { - "vis": { - "colors": { - "16": "#629E51", - "80": "#E24D42", - "272": "#DEDAF7", - "running": "#7EB26D", - "stopped": "#E24D42" - }, - "legendOpen": true + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7e1a8acb-2b07-4cb4-b0ff-447afa6375d1", + "type": "index-pattern" } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } - }, - "params": {} + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7e1a8acb-2b07-4cb4-b0ff-447afa6375d1": { + "columnOrder": [ + "b9f52cbe-6769-4bf3-b2a7-cabf3239cb8a", + "05b1916d-7ebc-40ae-8a8b-d5a8503d2672" + ], + "columns": { + "05b1916d-7ebc-40ae-8a8b-d5a8503d2672": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of aws.billing.EstimatedCharges", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "aws.billing.EstimatedCharges" + }, + "b9f52cbe-6769-4bf3-b2a7-cabf3239cb8a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of aws.billing.ServiceName", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Average of aws.billing.EstimatedCharges", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "aws.billing.EstimatedCharges" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.billing.ServiceName" + } + }, + "incompleteColumns": {} + } } - ], - "metric": { - "accessor": 1, - "aggType": "sum", - "format": { - "id": "number" - }, - "params": {} + }, + "textBased": { + "layers": {} } }, - "isDonut": false, - "labels": { - "last_level": true, - "show": true, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "", - "field": "aws.billing.EstimatedCharges" - }, - "schema": "metric", - "type": "sum" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "7e1a8acb-2b07-4cb4-b0ff-447afa6375d1", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "05b1916d-7ebc-40ae-8a8b-d5a8503d2672" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "b9f52cbe-6769-4bf3-b2a7-cabf3239cb8a" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "", - "field": "aws.billing.ServiceName", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderAgg": { - "enabled": true, - "id": "2-orderAgg", - "params": { - "field": "aws.billing.EstimatedCharges" - }, - "schema": "orderAgg", - "type": "avg" - }, - "orderBy": "custom", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "shape": "pie" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -220,172 +274,198 @@ }, "panelIndex": "26670498-b079-4447-bbc8-e4ca8215898c", "title": "Estimated Billing Chart", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "title": "Total Estimated Charges", - "savedVis": { - "title": "Total Estimated Charges [Metrics AWS]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "88a80e30-1530-11ea-961e-c1db9cc6166e" - } - ], - "bar_color_rules": [ - { - "id": "ebb52700-1531-11ea-961e-c1db9cc6166e" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" } - ], - "drop_last_bucket": 0, - "gauge_color_rules": [ - { - "id": "e8a045e0-1531-11ea-961e-c1db9cc6166e" + }, + "datasourceStates": { + "formBased": { + "layers": { + "3fc613f6-8db8-4fb4-889e-de4e079f0821": { + "columnOrder": [ + "5a83d040-e3d3-4467-85fe-eb3e6ed95a15", + "1b5242d7-8eab-4fd2-a2c2-6c04031c2ba2", + "3e6b810b-7a82-4574-ab3b-d20480ede81e" + ], + "columns": { + "1b5242d7-8eab-4fd2-a2c2-6c04031c2ba2": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "12h" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "3e6b810b-7a82-4574-ab3b-d20480ede81e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "avg(aws.billing.EstimatedCharges)", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2, + "suffix": "$" + } + } + }, + "scale": "ratio", + "sourceField": "aws.billing.EstimatedCharges", + "timeShift": "" + }, + "5a83d040-e3d3-4467-85fe-eb3e6ed95a15": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of aws.billing.ServiceName", + "operationType": "terms", + "params": { + "accuracyMode": true, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3e6b810b-7a82-4574-ab3b-d20480ede81e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "aws.billing.ServiceName" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "12h", - "isModelInvalid": false, - "series": [ + }, + "filters": [], + "internalReferences": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "not aws.billing.ServiceName : * " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Total Estimated Charges", - "line_width": 1, - "metrics": [ - { - "field": "aws.billing.EstimatedCharges", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "sum" - } - ], - "override_index_pattern": 0, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_interval": "12h", - "split_color_mode": "gradient", - "split_mode": "filter", - "stacked": "none", - "time_range_mode": "last_value", - "value_template": "${{value}}" + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-3fc613f6-8db8-4fb4-889e-de4e079f0821", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "metric", - "use_kibana_indexes": false, - "hide_last_value_indicator": true - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "gridData": { - "h": 11, - "i": "221aab02-2747-4d84-9dde-028ccd51bdce", - "w": 16, - "x": 0, - "y": 5 - }, - "panelIndex": "221aab02-2747-4d84-9dde-028ccd51bdce", - "title": "Total Estimated Charges", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "title": "Top 10 Estimated Billing Per Service Name", - "savedVis": { - "title": "Top 10 Billing per Service Name [Metrics AWS]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { + "query": { "language": "kuery", "query": "" }, - "id": "729af8b0-152a-11ea-ae8f-79fec1a0d4d3", - "index_pattern": "metrics-*", - "interval": "12h", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "729b1fc0-152a-11ea-ae8f-79fec1a0d4d3", - "label": "avg(aws.billing.EstimatedCharges)", - "line_width": 2, - "metrics": [ - { - "field": "aws.billing.EstimatedCharges", - "id": "729b1fc1-152a-11ea-ae8f-79fec1a0d4d3", - "type": "sum" - } - ], - "override_index_pattern": 0, - "point_size": "4", - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "steps": 0, - "terms_field": "aws.billing.ServiceName", - "terms_include": "", - "terms_order_by": "729b1fc1-152a-11ea-ae8f-79fec1a0d4d3", - "terms_size": "10", - "type": "timeseries", - "value_template": "${{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "curveType": "LINEAR", + "emphasizeFitting": false, + "endValue": "Zero", + "fillOpacity": 0, + "fittingFunction": "Linear", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3e6b810b-7a82-4574-ab3b-d20480ede81e" + ], + "layerId": "3fc613f6-8db8-4fb4-889e-de4e079f0821", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "5a83d040-e3d3-4467-85fe-eb3e6ed95a15", + "xAccessor": "1b5242d7-8eab-4fd2-a2c2-6c04031c2ba2", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "3e6b810b-7a82-4574-ab3b-d20480ede81e" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -396,14 +476,20 @@ }, "panelIndex": "21e91e6b-0ff0-42ba-9132-6f30c5c6bbb7", "title": "Top 10 Estimated Billing Per Service Name", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Metrics AWS] Billing Overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", + "id": "aws-e6776b10-1534-11ea-841c-01bf20a6c8ba", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "metrics-*", @@ -411,18 +497,20 @@ "type": "index-pattern" }, { - "type": "index-pattern", - "name": "89dccfe8-a25e-44ea-afdb-ff01ab1f05d6:control_0_index_pattern", - "id": "metrics-*" + "id": "metrics-*", + "name": "221aab02-2747-4d84-9dde-028ccd51bdce:indexpattern-datasource-layer-fe01457b-2279-4f97-9032-3a29f57e877a", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "26670498-b079-4447-bbc8-e4ca8215898c:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "metrics-*" + "id": "metrics-*", + "name": "26670498-b079-4447-bbc8-e4ca8215898c:indexpattern-datasource-layer-7e1a8acb-2b07-4cb4-b0ff-447afa6375d1", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_68e8bd22-884f-4cd1-8483-844cd707bf67:optionsListDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/aws/kibana/dashboard/aws-e74bf320-b3ce-11e9-87a4-078dbbae220d.json b/packages/aws/kibana/dashboard/aws-e74bf320-b3ce-11e9-87a4-078dbbae220d.json index 9e3fb9d25ae..2e7e38bd398 100644 --- a/packages/aws/kibana/dashboard/aws-e74bf320-b3ce-11e9-87a4-078dbbae220d.json +++ b/packages/aws/kibana/dashboard/aws-e74bf320-b3ce-11e9-87a4-078dbbae220d.json @@ -446,7 +446,6 @@ "query": "" }, "visualization": { - "color": "#ffffff", "layerId": "d825a0ad-7b01-4867-b39d-b265fa804a77", "layerType": "data", "metricAccessor": "0459af2a-4945-405a-8b39-3aa3c7387d51" @@ -522,7 +521,6 @@ "query": "" }, "visualization": { - "color": "#FFF", "layerId": "95c74866-a10c-4846-99a6-d4478075f9aa", "layerType": "data", "metricAccessor": "f16d2264-abf6-4a3a-b7e1-be8e69f239de" diff --git a/packages/aws/kibana/search/aws-4f41d150-2704-11ee-81f9-fdf97c8e03a6.json b/packages/aws/kibana/search/aws-4f41d150-2704-11ee-81f9-fdf97c8e03a6.json new file mode 100644 index 00000000000..b05c1395d7d --- /dev/null +++ b/packages/aws/kibana/search/aws-4f41d150-2704-11ee-81f9-fdf97c8e03a6.json @@ -0,0 +1,42 @@ +{ + "attributes": { + "columns": [], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.apigateway_logs\" " + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "API Gateway Logs", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-20T13:49:55.813Z", + "id": "aws-4f41d150-2704-11ee-81f9-fdf97c8e03a6", + "migrationVersion": { + "search": "8.0.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "search" +} \ No newline at end of file diff --git a/packages/aws/kibana/search/aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb.json b/packages/aws/kibana/search/aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb.json index cc40f991b33..ce5257aa644 100644 --- a/packages/aws/kibana/search/aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb.json +++ b/packages/aws/kibana/search/aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb.json @@ -80,7 +80,12 @@ "title": "Error Logs [Logs AWS]", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", "id": "aws-5e5a3c90-bac0-11e9-9f70-1f7bda85a5eb", + "migrationVersion": { + "search": "8.0.0" + }, "references": [ { "id": "logs-*", diff --git a/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json b/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json index cd60efee265..e4dd11b43a5 100644 --- a/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json +++ b/packages/aws/kibana/search/aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5.json @@ -22,7 +22,8 @@ ], "title": "Security Hub - Raw Events [Logs AWS]" }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", "id": "aws-b111d3a0-5f3e-11ed-b2ee-f91fa284c4b5", "migrationVersion": { "search": "8.0.0" diff --git a/packages/aws/kibana/search/aws-c1543010-2724-11ee-a3cb-33de1feb08f6.json b/packages/aws/kibana/search/aws-c1543010-2724-11ee-a3cb-33de1feb08f6.json new file mode 100644 index 00000000000..b3e3b7760fe --- /dev/null +++ b/packages/aws/kibana/search/aws-c1543010-2724-11ee-a3cb-33de1feb08f6.json @@ -0,0 +1,41 @@ +{ + "attributes": { + "columns": [], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"aws.emr_logs\" " + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "[AWS] EMR Logs Search", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-20T17:42:11.089Z", + "id": "aws-c1543010-2724-11ee-a3cb-33de1feb08f6", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "8.0.0" +} \ No newline at end of file diff --git a/packages/aws/kibana/search/aws-c1aee600-4487-11ea-ad63-791a5dc86f10.json b/packages/aws/kibana/search/aws-c1aee600-4487-11ea-ad63-791a5dc86f10.json index 0f814f2ddc0..28c806ae3c5 100644 --- a/packages/aws/kibana/search/aws-c1aee600-4487-11ea-ad63-791a5dc86f10.json +++ b/packages/aws/kibana/search/aws-c1aee600-4487-11ea-ad63-791a5dc86f10.json @@ -79,7 +79,12 @@ "title": "VPC Flow Reject Logs [Logs AWS]", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-05-30T07:18:21.141Z", "id": "aws-c1aee600-4487-11ea-ad63-791a5dc86f10", + "migrationVersion": { + "search": "8.0.0" + }, "references": [ { "id": "logs-*", diff --git a/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json b/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json index aa4e3f96f57..c49bdff5dc0 100644 --- a/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json +++ b/packages/aws/kibana/search/aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5.json @@ -31,7 +31,8 @@ ], "title": "Essential Details - Security Hub [Logs AWS]" }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:47:59.330Z", "id": "aws-cc2e2cf0-5f3f-11ed-b2ee-f91fa284c4b5", "migrationVersion": { "search": "8.0.0" diff --git a/packages/aws/kibana/search/aws-f4856850-4d32-11ec-a678-057fce71e8cd.json b/packages/aws/kibana/search/aws-f4856850-4d32-11ec-a678-057fce71e8cd.json index f5ac0e3875d..c230d9ca975 100644 --- a/packages/aws/kibana/search/aws-f4856850-4d32-11ec-a678-057fce71e8cd.json +++ b/packages/aws/kibana/search/aws-f4856850-4d32-11ec-a678-057fce71e8cd.json @@ -53,10 +53,11 @@ "title": "Firewall Logs [Logs AWS]", "version": 1 }, - "coreMigrationVersion": "7.15.1", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T09:17:37.345Z", "id": "aws-f4856850-4d32-11ec-a678-057fce71e8cd", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index 361afa29c91..9a308134d08 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: aws title: AWS -version: 1.46.0 +version: 2.2.1 license: basic description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration @@ -9,7 +9,7 @@ categories: - aws release: ga conditions: - kibana.version: "^8.8.1" + kibana.version: "^8.9.0" screenshots: - src: /img/metricbeat-aws-overview.png title: metricbeat aws overview @@ -136,10 +136,6 @@ policy_templates: - observability - monitoring inputs: - - type: aws-s3 - title: Collect logs from S3 (Deprecated) - description: Collecting logs using aws-s3 input - input_group: logs - type: aws-cloudwatch title: Collect logs from CloudWatch description: Collecting logs using aws-cloudwatch input @@ -744,6 +740,7 @@ policy_templates: description: Collect logs and metrics for AWS API Gateway with Elastic Agent. data_streams: - apigateway_metrics + - apigateway_logs categories: - observability inputs: @@ -751,6 +748,19 @@ policy_templates: title: Collect API Gateway metrics description: Collect API Gateway metrics using AWS CloudWatch. input_group: metrics + - type: aws-s3 + title: Collect API Gateway logs from S3 + description: Collecting API Gateway logs using aws-s3 input + input_group: logs + - type: aws-cloudwatch + title: Collect API Gateway logs from CloudWatch + description: Collecting API Gateway logs using aws-cloudwatch input + input_group: logs + screenshots: + - src: /img/filebeat-aws-apigateway-overview.png + title: filebeat aws api gateway overview + size: 1280x1431 + type: image/png icons: - src: /img/logo_apigateway.svg title: AWS API Gateway logo @@ -761,6 +771,7 @@ policy_templates: description: Collect logs and metrics for Amazon EMR service with Elastic Agent data_streams: - emr_metrics + - emr_logs categories: - observability inputs: @@ -768,6 +779,19 @@ policy_templates: title: Collect EMR metrics description: Collect EMR metrics using AWS CloudWatch input_group: metrics + - type: aws-s3 + title: Collect EMR logs from S3 + description: Collecting logs from EMR using aws-s3 input + input_group: logs + - type: aws-cloudwatch + title: Collect EMR logs from CloudWatch + description: Collecting logs from EMR using aws-cloudwatch input + input_group: logs + screenshots: + - src: /img/filebeat-aws-emr-overview.png + title: filebeat aws emr overview + size: 1714x893 + type: image/png icons: - src: /img/logo_emr.svg title: AWS EMR logo diff --git a/packages/aws_logs/changelog.yml b/packages/aws_logs/changelog.yml index 631644bf81d..5d1d9a7d2a0 100644 --- a/packages/aws_logs/changelog.yml +++ b/packages/aws_logs/changelog.yml @@ -1,3 +1,8 @@ +- version: "0.5.1" + changes: + - description: Remove duplicated number_of_workers settings + type: enhancement + link: https://github.com/elastic/integrations/pull/7481 - version: "0.5.0" changes: - description: Add permissions to reroute events to logs-*-* for generic datastream diff --git a/packages/aws_logs/data_stream/generic/_dev/deploy/tf/env.yml b/packages/aws_logs/data_stream/generic/_dev/deploy/tf/env.yml new file mode 100644 index 00000000000..b795fcdeb2c --- /dev/null +++ b/packages/aws_logs/data_stream/generic/_dev/deploy/tf/env.yml @@ -0,0 +1,9 @@ +version: '2.3' +services: + terraform: + environment: + - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} + - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} + - AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN} + - AWS_PROFILE=${AWS_PROFILE} + - AWS_REGION=${AWS_REGION:-us-east-1} diff --git a/packages/aws_logs/data_stream/generic/_dev/deploy/tf/main.tf b/packages/aws_logs/data_stream/generic/_dev/deploy/tf/main.tf new file mode 100644 index 00000000000..f7d5618cd35 --- /dev/null +++ b/packages/aws_logs/data_stream/generic/_dev/deploy/tf/main.tf @@ -0,0 +1,64 @@ +variable "TEST_RUN_ID" { + default = "detached" +} + +provider "aws" { + default_tags { + tags = { + environment = var.ENVIRONMENT + repo = var.REPO + branch = var.BRANCH + build = var.BUILD_ID + created_date = var.CREATED_DATE + } + } +} + +resource "aws_s3_bucket" "bucket" { + bucket = "elastic-package-aws-logs-bucket-${var.TEST_RUN_ID}" +} + +resource "aws_sqs_queue" "queue" { + name = "elastic-package-aws-logs-queue-${var.TEST_RUN_ID}" + policy = < Total bytes - name: peak type: long + metric_type: counter format: bytes description: > Peak committed bytes on Windows - name: private_working_set.total type: long + metric_type: gauge format: bytes description: > - private working sets on Windows + Private working sets on Windows - name: fail.count type: scaled_float + metric_type: counter description: | Fail counter. - name: limit type: long + metric_type: gauge format: bytes description: | Memory limit. @@ -231,11 +271,13 @@ fields: - name: total type: long + metric_type: gauge format: bytes description: | Total memory resident set size. - name: pct type: scaled_float + metric_type: gauge format: percent description: | Memory resident set size percentage. @@ -244,16 +286,19 @@ fields: - name: max type: long + metric_type: counter format: bytes description: | Max memory usage. - name: pct type: scaled_float + metric_type: gauge format: percent description: | Memory usage percentage. - name: total type: long + metric_type: gauge format: bytes description: | Total memory usage. @@ -266,16 +311,19 @@ fields: - name: max type: long + metric_type: counter format: bytes description: | Max memory usage. - name: pct type: scaled_float + metric_type: gauge format: percent description: | Memory usage percentage. - name: total type: long + metric_type: gauge format: bytes description: | Total memory usage. @@ -284,19 +332,23 @@ fields: - name: bytes type: long + metric_type: counter format: bytes description: | Total number of incoming bytes. - name: dropped type: long + metric_type: counter description: | Total number of dropped incoming packets. - name: errors type: long + metric_type: counter description: | Total errors on incoming packets. - name: packets type: long + metric_type: counter description: | Total number of incoming packets. - name: network.*.outbound @@ -304,18 +356,22 @@ fields: - name: bytes type: long + metric_type: counter format: bytes description: | Total number of incoming bytes. - name: dropped type: long + metric_type: counter description: | Total number of dropped incoming packets. - name: errors type: long + metric_type: counter description: | Total errors on incoming packets. - name: packets type: long + metric_type: counter description: | Total number of incoming packets. diff --git a/packages/awsfargate/data_stream/task_stats/manifest.yml b/packages/awsfargate/data_stream/task_stats/manifest.yml index 97f6c7e8f51..6aee989ec6b 100644 --- a/packages/awsfargate/data_stream/task_stats/manifest.yml +++ b/packages/awsfargate/data_stream/task_stats/manifest.yml @@ -1,6 +1,8 @@ type: metrics title: AWS Fargate task_stats metrics release: beta +elasticsearch: + index_mode: "time_series" streams: - input: awsfargate/metrics vars: diff --git a/packages/awsfargate/docs/README.md b/packages/awsfargate/docs/README.md index a7bfdd926f9..ac632808f48 100644 --- a/packages/awsfargate/docs/README.md +++ b/packages/awsfargate/docs/README.md @@ -299,96 +299,97 @@ If you want to learn more about Amazon ECS metrics, take a look at the blog post **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| awsfargate.task_stats.cluster_name | Cluster name | keyword | -| awsfargate.task_stats.cpu.core | | object | -| awsfargate.task_stats.cpu.core.\*.norm.pct | Percentage of time per CPU core normalized by the number of CPU cores. | scaled_float | -| awsfargate.task_stats.cpu.core.\*.pct | Percentage of time per CPU core. | scaled_float | -| awsfargate.task_stats.cpu.core.\*.ticks | CPU ticks per CPU core. | long | -| awsfargate.task_stats.cpu.kernel.norm.pct | Percentage of time in kernel space normalized by the number of CPU cores. | scaled_float | -| awsfargate.task_stats.cpu.kernel.pct | Percentage of time in kernel space. | scaled_float | -| awsfargate.task_stats.cpu.kernel.ticks | CPU ticks in kernel space. | long | -| awsfargate.task_stats.cpu.system.norm.pct | Percentage of total CPU time in the system normalized by the number of CPU cores. | scaled_float | -| awsfargate.task_stats.cpu.system.pct | Percentage of total CPU time in the system. | scaled_float | -| awsfargate.task_stats.cpu.system.ticks | CPU system ticks. | long | -| awsfargate.task_stats.cpu.total.norm.pct | Total CPU usage normalized by the number of CPU cores. | scaled_float | -| awsfargate.task_stats.cpu.total.pct | Total CPU usage. | scaled_float | -| awsfargate.task_stats.cpu.user.norm.pct | Percentage of time in user space normalized by the number of CPU cores. | scaled_float | -| awsfargate.task_stats.cpu.user.pct | Percentage of time in user space. | scaled_float | -| awsfargate.task_stats.cpu.user.ticks | CPU ticks in user space. | long | -| awsfargate.task_stats.diskio.read.bytes | Bytes read during the life of the container | long | -| awsfargate.task_stats.diskio.read.ops | Number of reads during the life of the container | long | -| awsfargate.task_stats.diskio.read.queued | Total number of queued requests | long | -| awsfargate.task_stats.diskio.read.rate | Number of current reads per second | long | -| awsfargate.task_stats.diskio.read.service_time | Total time to service IO requests, in nanoseconds | long | -| awsfargate.task_stats.diskio.read.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | -| awsfargate.task_stats.diskio.reads | Number of current reads per second | scaled_float | -| awsfargate.task_stats.diskio.summary.bytes | Bytes read and written during the life of the container | long | -| awsfargate.task_stats.diskio.summary.ops | Number of I/O operations during the life of the container | long | -| awsfargate.task_stats.diskio.summary.queued | Total number of queued requests | long | -| awsfargate.task_stats.diskio.summary.rate | Number of current operations per second | long | -| awsfargate.task_stats.diskio.summary.service_time | Total time to service IO requests, in nanoseconds | long | -| awsfargate.task_stats.diskio.summary.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | -| awsfargate.task_stats.diskio.total | Number of reads and writes per second | scaled_float | -| awsfargate.task_stats.diskio.write.bytes | Bytes written during the life of the container | long | -| awsfargate.task_stats.diskio.write.ops | Number of writes during the life of the container | long | -| awsfargate.task_stats.diskio.write.queued | Total number of queued requests | long | -| awsfargate.task_stats.diskio.write.rate | Number of current writes per second | long | -| awsfargate.task_stats.diskio.write.service_time | Total time to service IO requests, in nanoseconds | long | -| awsfargate.task_stats.diskio.write.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | -| awsfargate.task_stats.diskio.writes | Number of current writes per second | scaled_float | -| awsfargate.task_stats.identifier | Container identifier across tasks and clusters, which equals to container.name + '/' + container.id. | keyword | -| awsfargate.task_stats.memory.commit.peak | Peak committed bytes on Windows | long | -| awsfargate.task_stats.memory.commit.total | Total bytes | long | -| awsfargate.task_stats.memory.fail.count | Fail counter. | scaled_float | -| awsfargate.task_stats.memory.limit | Memory limit. | long | -| awsfargate.task_stats.memory.private_working_set.total | private working sets on Windows | long | -| awsfargate.task_stats.memory.rss.pct | Memory resident set size percentage. | scaled_float | -| awsfargate.task_stats.memory.rss.total | Total memory resident set size. | long | -| awsfargate.task_stats.memory.rss.usage.max | Max memory usage. | long | -| awsfargate.task_stats.memory.rss.usage.pct | Memory usage percentage. | scaled_float | -| awsfargate.task_stats.memory.rss.usage.total | Total memory usage. | long | -| awsfargate.task_stats.memory.stats.\* | Raw memory stats from the cgroups memory.stat interface | object | -| awsfargate.task_stats.memory.usage.max | Max memory usage. | long | -| awsfargate.task_stats.memory.usage.pct | Memory usage percentage. | scaled_float | -| awsfargate.task_stats.memory.usage.total | Total memory usage. | long | -| awsfargate.task_stats.network.\*.inbound.bytes | Total number of incoming bytes. | long | -| awsfargate.task_stats.network.\*.inbound.dropped | Total number of dropped incoming packets. | long | -| awsfargate.task_stats.network.\*.inbound.errors | Total errors on incoming packets. | long | -| awsfargate.task_stats.network.\*.inbound.packets | Total number of incoming packets. | long | -| awsfargate.task_stats.network.\*.outbound.bytes | Total number of incoming bytes. | long | -| awsfargate.task_stats.network.\*.outbound.dropped | Total number of dropped incoming packets. | long | -| awsfargate.task_stats.network.\*.outbound.errors | Total errors on incoming packets. | long | -| awsfargate.task_stats.network.\*.outbound.packets | Total number of incoming packets. | long | -| awsfargate.task_stats.task_desired_status | The desired status for the task from Amazon ECS. | keyword | -| awsfargate.task_stats.task_known_status | The known status for the task from Amazon ECS. | keyword | -| awsfargate.task_stats.task_name | ECS task name | keyword | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container | Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime. | group | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels.com_amazonaws_ecs_cluster | ECS Cluster name | keyword | -| container.labels.com_amazonaws_ecs_container-name | ECS container name | keyword | -| container.labels.com_amazonaws_ecs_task-arn | ECS task ARN | keyword | -| container.labels.com_amazonaws_ecs_task-definition-family | ECS task definition family | keyword | -| container.labels.com_amazonaws_ecs_task-definition-version | ECS task definition version | keyword | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| awsfargate.task_stats.cluster_name | Cluster name | keyword | | +| awsfargate.task_stats.cpu.core | | object | | +| awsfargate.task_stats.cpu.core.\*.norm.pct | Percentage of time per CPU core normalized by the number of CPU cores. | scaled_float | gauge | +| awsfargate.task_stats.cpu.core.\*.pct | Percentage of time per CPU core. | scaled_float | gauge | +| awsfargate.task_stats.cpu.core.\*.ticks | CPU ticks per CPU core. | long | counter | +| awsfargate.task_stats.cpu.kernel.norm.pct | Percentage of time in kernel space normalized by the number of CPU cores. | scaled_float | gauge | +| awsfargate.task_stats.cpu.kernel.pct | Percentage of time in kernel space. | scaled_float | gauge | +| awsfargate.task_stats.cpu.kernel.ticks | CPU ticks in kernel space. | long | counter | +| awsfargate.task_stats.cpu.system.norm.pct | Percentage of total CPU time in the system normalized by the number of CPU cores. | scaled_float | gauge | +| awsfargate.task_stats.cpu.system.pct | Percentage of total CPU time in the system. | scaled_float | gauge | +| awsfargate.task_stats.cpu.system.ticks | CPU system ticks. | long | counter | +| awsfargate.task_stats.cpu.total.norm.pct | Total CPU usage normalized by the number of CPU cores. | scaled_float | gauge | +| awsfargate.task_stats.cpu.total.pct | Total CPU usage. | scaled_float | gauge | +| awsfargate.task_stats.cpu.user.norm.pct | Percentage of time in user space normalized by the number of CPU cores. | scaled_float | gauge | +| awsfargate.task_stats.cpu.user.pct | Percentage of time in user space. | scaled_float | gauge | +| awsfargate.task_stats.cpu.user.ticks | CPU ticks in user space. | long | counter | +| awsfargate.task_stats.diskio.read.bytes | Bytes read during the life of the container | long | counter | +| awsfargate.task_stats.diskio.read.ops | Number of reads during the life of the container | long | counter | +| awsfargate.task_stats.diskio.read.queued | Total number of queued requests | long | counter | +| awsfargate.task_stats.diskio.read.rate | Number of current reads per second | long | gauge | +| awsfargate.task_stats.diskio.read.service_time | Total time to service IO requests, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.read.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.reads | Number of current reads per second | scaled_float | gauge | +| awsfargate.task_stats.diskio.summary.bytes | Bytes read and written during the life of the container | long | counter | +| awsfargate.task_stats.diskio.summary.ops | Number of I/O operations during the life of the container | long | counter | +| awsfargate.task_stats.diskio.summary.queued | Total number of queued requests | long | counter | +| awsfargate.task_stats.diskio.summary.rate | Number of current operations per second | long | gauge | +| awsfargate.task_stats.diskio.summary.service_time | Total time to service IO requests, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.summary.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.total | Number of reads and writes per second | scaled_float | gauge | +| awsfargate.task_stats.diskio.write.bytes | Bytes written during the life of the container | long | counter | +| awsfargate.task_stats.diskio.write.ops | Number of writes during the life of the container | long | counter | +| awsfargate.task_stats.diskio.write.queued | Total number of queued requests | long | counter | +| awsfargate.task_stats.diskio.write.rate | Number of current writes per second | long | gauge | +| awsfargate.task_stats.diskio.write.service_time | Total time to service IO requests, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.write.wait_time | Total time requests spent waiting in queues for service, in nanoseconds | long | counter | +| awsfargate.task_stats.diskio.writes | Number of current writes per second | scaled_float | gauge | +| awsfargate.task_stats.identifier | Container identifier across tasks and clusters, which equals to container.name + '/' + container.id. | keyword | | +| awsfargate.task_stats.memory.commit.peak | Peak committed bytes on Windows | long | counter | +| awsfargate.task_stats.memory.commit.total | Total bytes | long | counter | +| awsfargate.task_stats.memory.fail.count | Fail counter. | scaled_float | counter | +| awsfargate.task_stats.memory.limit | Memory limit. | long | gauge | +| awsfargate.task_stats.memory.private_working_set.total | Private working sets on Windows | long | gauge | +| awsfargate.task_stats.memory.rss.pct | Memory resident set size percentage. | scaled_float | gauge | +| awsfargate.task_stats.memory.rss.total | Total memory resident set size. | long | gauge | +| awsfargate.task_stats.memory.rss.usage.max | Max memory usage. | long | counter | +| awsfargate.task_stats.memory.rss.usage.pct | Memory usage percentage. | scaled_float | gauge | +| awsfargate.task_stats.memory.rss.usage.total | Total memory usage. | long | gauge | +| awsfargate.task_stats.memory.stats.\* | Raw memory stats from the cgroups memory.stat interface | object | | +| awsfargate.task_stats.memory.usage.max | Max memory usage. | long | counter | +| awsfargate.task_stats.memory.usage.pct | Memory usage percentage. | scaled_float | gauge | +| awsfargate.task_stats.memory.usage.total | Total memory usage. | long | gauge | +| awsfargate.task_stats.network.\*.inbound.bytes | Total number of incoming bytes. | long | counter | +| awsfargate.task_stats.network.\*.inbound.dropped | Total number of dropped incoming packets. | long | counter | +| awsfargate.task_stats.network.\*.inbound.errors | Total errors on incoming packets. | long | counter | +| awsfargate.task_stats.network.\*.inbound.packets | Total number of incoming packets. | long | counter | +| awsfargate.task_stats.network.\*.outbound.bytes | Total number of incoming bytes. | long | counter | +| awsfargate.task_stats.network.\*.outbound.dropped | Total number of dropped incoming packets. | long | counter | +| awsfargate.task_stats.network.\*.outbound.errors | Total errors on incoming packets. | long | counter | +| awsfargate.task_stats.network.\*.outbound.packets | Total number of incoming packets. | long | counter | +| awsfargate.task_stats.task_desired_status | The desired status for the task from Amazon ECS. | keyword | | +| awsfargate.task_stats.task_known_status | The known status for the task from Amazon ECS. | keyword | | +| awsfargate.task_stats.task_name | ECS task name | keyword | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container | Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime. | group | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels.com_amazonaws_ecs_cluster | ECS Cluster name | keyword | | +| container.labels.com_amazonaws_ecs_container-name | ECS container name | keyword | | +| container.labels.com_amazonaws_ecs_task-arn | ECS task ARN | keyword | | +| container.labels.com_amazonaws_ecs_task-definition-family | ECS task definition family | keyword | | +| container.labels.com_amazonaws_ecs_task-definition-version | ECS task definition version | keyword | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `task_stats` looks as following: diff --git a/packages/awsfargate/img/awsfargate-integration-overview.png b/packages/awsfargate/img/awsfargate-integration-overview.png index 90a1f7bf5f3..79e79267004 100644 Binary files a/packages/awsfargate/img/awsfargate-integration-overview.png and b/packages/awsfargate/img/awsfargate-integration-overview.png differ diff --git a/packages/awsfargate/kibana/dashboard/awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63.json b/packages/awsfargate/kibana/dashboard/awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63.json index 12ee10a56f1..16271ba9b23 100644 --- a/packages/awsfargate/kibana/dashboard/awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63.json +++ b/packages/awsfargate/kibana/dashboard/awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63.json @@ -1,1194 +1,1107 @@ { - "id": "awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-12-06T18:13:42.072Z", - "version": "WzU5MCwxXQ==", - "attributes": { - "description": "Overview of AWS Fargate Metrics", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "ECS Task Filter [Metrics AWSFargate]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1607442436907", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "awsfargate.task_stats.cluster_name", - "id": "1607442399749", - "indexPatternRefName": "control_1_index_pattern", - "label": "Cluster Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "container.labels.com_amazonaws_ecs_task-definition-family", - "id": "1606248025028", - "indexPatternRefName": "control_2_index_pattern", - "label": "Task Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ee100059-0e56-4e9b-ae09-ff53234bdf8c\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region Name\",\"id\":\"ee100059-0e56-4e9b-ae09-ff53234bdf8c\",\"enhancements\":{}}},\"e967cd1f-7491-4e72-8d63-23fcef40b9cc\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"awsfargate.task_stats.cluster_name\",\"title\":\"Cluster Name\",\"id\":\"e967cd1f-7491-4e72-8d63-23fcef40b9cc\",\"enhancements\":{}}},\"b2adcf17-72de-46e8-87b1-94c16c399bf0\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"container.labels.com_amazonaws_ecs_task-definition-family\",\"title\":\"Task Name\",\"id\":\"b2adcf17-72de-46e8-87b1-94c16c399bf0\",\"enhancements\":{}}}}" + }, + "description": "Overview of AWS Fargate Metrics", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 14, - "i": "2429ae11-ccb3-4016-b18d-c88140e29f67", - "w": 9, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "useMargins": true }, - "panelIndex": "2429ae11-ccb3-4016-b18d-c88140e29f67", - "title": "ECS Task Filter", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "e350c9e6-e6b7-40f1-83ed-94a38ed9467a": { - "columnOrder": [ - "040803fd-23f9-4f4f-95da-e8be99becbc1", - "eb452b61-bf12-46c0-afae-c0f1c776156c", - "b1e08425-6a1e-4db6-bb47-a65167b7e14f", - "09de0d9e-c174-46cf-bdc8-50158475b4a7", - "e0782143-0636-43b4-8fac-b857ea5282b2", - "7626706b-6efa-4fe7-b45c-6e9afa07f982", - "441ceb32-53e7-4408-9638-6dfd38202144" - ], - "columns": { - "040803fd-23f9-4f4f-95da-e8be99becbc1": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Task Name", - "operationType": "terms", - "params": { - "orderBy": { - "type": "alphabetical" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "asc", - "size": 20, - "parentFormat": { - "id": "terms" - } - }, - "scale": "ordinal", - "sourceField": "container.labels.com_amazonaws_ecs_task-definition-family" - }, - "09de0d9e-c174-46cf-bdc8-50158475b4a7": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "CPU", - "operationType": "average", - "params": { - "format": { - "id": "percent", - "params": { - "decimals": 3 - } + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "type": "index-pattern" } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" - }, - "441ceb32-53e7-4408-9638-6dfd38202144": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Memory", - "operationType": "average", - "params": { - "format": { - "id": "percent", - "params": { - "decimals": 3 - } - } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.memory.usage.pct" - }, - "7626706b-6efa-4fe7-b45c-6e9afa07f982": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Memory Usage", - "operationType": "average", - "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e350c9e6-e6b7-40f1-83ed-94a38ed9467a": { + "columnOrder": [ + "040803fd-23f9-4f4f-95da-e8be99becbc1", + "eb452b61-bf12-46c0-afae-c0f1c776156c", + "b1e08425-6a1e-4db6-bb47-a65167b7e14f", + "09de0d9e-c174-46cf-bdc8-50158475b4a7", + "e0782143-0636-43b4-8fac-b857ea5282b2", + "7626706b-6efa-4fe7-b45c-6e9afa07f982", + "441ceb32-53e7-4408-9638-6dfd38202144" + ], + "columns": { + "040803fd-23f9-4f4f-95da-e8be99becbc1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Task Name", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "container.labels.com_amazonaws_ecs_task-definition-family" + }, + "09de0d9e-c174-46cf-bdc8-50158475b4a7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU", + "operationType": "average", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 3 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" + }, + "441ceb32-53e7-4408-9638-6dfd38202144": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory", + "operationType": "average", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 3 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.memory.usage.pct" + }, + "7626706b-6efa-4fe7-b45c-6e9afa07f982": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory Usage", + "operationType": "average", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.memory.usage.total" + }, + "b1e08425-6a1e-4db6-bb47-a65167b7e14f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "ECS Cluster ARN", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "container.labels.com_amazonaws_ecs_cluster" + }, + "e0782143-0636-43b4-8fac-b857ea5282b2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DiskIO", + "operationType": "average", + "scale": "ratio", + "sourceField": "awsfargate.task_stats.diskio.total" + }, + "eb452b61-bf12-46c0-afae-c0f1c776156c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Container Name", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "container.name" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "eb452b61-bf12-46c0-afae-c0f1c776156c" + }, + { + "columnId": "040803fd-23f9-4f4f-95da-e8be99becbc1" + }, + { + "columnId": "b1e08425-6a1e-4db6-bb47-a65167b7e14f" + }, + { + "columnId": "09de0d9e-c174-46cf-bdc8-50158475b4a7" + }, + { + "columnId": "e0782143-0636-43b4-8fac-b857ea5282b2" + }, + { + "columnId": "7626706b-6efa-4fe7-b45c-6e9afa07f982" + }, + { + "columnId": "441ceb32-53e7-4408-9638-6dfd38202144" + } + ], + "layerId": "e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.memory.usage.total" }, - "b1e08425-6a1e-4db6-bb47-a65167b7e14f": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "ECS Cluster ARN", - "operationType": "terms", - "params": { - "orderBy": { - "type": "alphabetical" + "title": "Container Table [Metrics AWSFargate]", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "735a25cb-f781-4a8b-99e6-2adf582f8a37", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "735a25cb-f781-4a8b-99e6-2adf582f8a37", + "title": "Containers", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "asc", - "size": 20, - "parentFormat": { - "id": "terms" + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-450490b7-c7f9-42bf-8e7d-227cbf960e94", + "type": "index-pattern" } - }, - "scale": "ordinal", - "sourceField": "container.labels.com_amazonaws_ecs_cluster" - }, - "e0782143-0636-43b4-8fac-b857ea5282b2": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "DiskIO", - "operationType": "average", - "scale": "ratio", - "sourceField": "awsfargate.task_stats.diskio.total" - }, - "eb452b61-bf12-46c0-afae-c0f1c776156c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Container Name", - "operationType": "terms", - "params": { - "orderBy": { - "type": "alphabetical" + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "450490b7-c7f9-42bf-8e7d-227cbf960e94": { + "columnOrder": [ + "b20aebaf-7126-4b1c-acca-79cfa113b44d", + "915eda3d-00ce-40d0-ada8-4eb372202b42" + ], + "columns": { + "915eda3d-00ce-40d0-ada8-4eb372202b42": { + "dataType": "number", + "isBucketed": false, + "label": "Unique count of container.id", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "container.id" + }, + "b20aebaf-7126-4b1c-acca-79cfa113b44d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "asc", - "size": 20, - "parentFormat": { - "id": "terms" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "915eda3d-00ce-40d0-ada8-4eb372202b42" + ], + "layerId": "450490b7-c7f9-42bf-8e7d-227cbf960e94", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "b20aebaf-7126-4b1c-acca-79cfa113b44d" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } } - }, - "scale": "ordinal", - "sourceField": "container.name" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "eb452b61-bf12-46c0-afae-c0f1c776156c" - }, - { - "columnId": "040803fd-23f9-4f4f-95da-e8be99becbc1" - }, - { - "columnId": "b1e08425-6a1e-4db6-bb47-a65167b7e14f" - }, - { - "columnId": "09de0d9e-c174-46cf-bdc8-50158475b4a7" - }, - { - "columnId": "e0782143-0636-43b4-8fac-b857ea5282b2" - }, - { - "columnId": "7626706b-6efa-4fe7-b45c-6e9afa07f982" - }, - { - "columnId": "441ceb32-53e7-4408-9638-6dfd38202144" - } - ], - "layerId": "e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "layerType": "data" - } - }, - "title": "Container Table [Metrics AWSFargate]", - "visualizationType": "lnsDatatable", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 14, - "i": "735a25cb-f781-4a8b-99e6-2adf582f8a37", - "w": 39, - "x": 9, - "y": 0 - }, - "panelIndex": "735a25cb-f781-4a8b-99e6-2adf582f8a37", - "title": "Containers", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "450490b7-c7f9-42bf-8e7d-227cbf960e94": { - "columnOrder": [ - "b20aebaf-7126-4b1c-acca-79cfa113b44d", - "915eda3d-00ce-40d0-ada8-4eb372202b42" - ], - "columns": { - "915eda3d-00ce-40d0-ada8-4eb372202b42": { - "dataType": "number", - "isBucketed": false, - "label": "Unique count of container.id", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "container.id" }, - "b20aebaf-7126-4b1c-acca-79cfa113b44d": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "Total Number of Containers [Metrics AWSFargate]", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "915eda3d-00ce-40d0-ada8-4eb372202b42" - ], - "layerId": "450490b7-c7f9-42bf-8e7d-227cbf960e94", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "b20aebaf-7126-4b1c-acca-79cfa113b44d", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "5d4537e8-9aee-47e6-8580-1961d8a3a38e", + "w": 24, + "x": 0, + "y": 14 }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } + "panelIndex": "5d4537e8-9aee-47e6-8580-1961d8a3a38e", + "title": "Total Number of Containers", + "type": "lens", + "version": "8.3.0" }, - "title": "Total Number of Containers [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-450490b7-c7f9-42bf-8e7d-227cbf960e94", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 15, - "i": "5d4537e8-9aee-47e6-8580-1961d8a3a38e", - "w": 24, - "x": 0, - "y": 14 - }, - "panelIndex": "5d4537e8-9aee-47e6-8580-1961d8a3a38e", - "title": "Total Number of Containers", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "82f43ff6-6ac1-4f73-b532-61b6b9fe15b0": { - "columnOrder": [ - "e139ccbc-54ff-4921-b345-e3c3ff6a9efc", - "d7b9836e-d606-4aab-b2d8-44cbc726a950" - ], - "columns": { - "d7b9836e-d606-4aab-b2d8-44cbc726a950": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "CPU Utilization", - "operationType": "average", - "params": { - "format": { - "id": "percent", - "params": { - "decimals": 2 - } + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", + "type": "index-pattern" } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" - }, - "e139ccbc-54ff-4921-b345-e3c3ff6a9efc": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Cluster Name", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "d7b9836e-d606-4aab-b2d8-44cbc726a950", - "type": "column" + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "82f43ff6-6ac1-4f73-b532-61b6b9fe15b0": { + "columnOrder": [ + "e139ccbc-54ff-4921-b345-e3c3ff6a9efc", + "d7b9836e-d606-4aab-b2d8-44cbc726a950" + ], + "columns": { + "d7b9836e-d606-4aab-b2d8-44cbc726a950": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU Utilization", + "operationType": "average", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" + }, + "e139ccbc-54ff-4921-b345-e3c3ff6a9efc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cluster Name", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "d7b9836e-d606-4aab-b2d8-44cbc726a950", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "awsfargate.task_stats.cluster_name" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 20, - "parentFormat": { - "id": "terms" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "d7b9836e-d606-4aab-b2d8-44cbc726a950" + ], + "layerId": "82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", + "layerType": "data", + "seriesType": "bar_horizontal", + "xAccessor": "e139ccbc-54ff-4921-b345-e3c3ff6a9efc" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } } - }, - "scale": "ordinal", - "sourceField": "awsfargate.task_stats.cluster_name" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + }, + "title": "CPU Utilization Per Cluster [Metrics AWSFargate]", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "d7b9836e-d606-4aab-b2d8-44cbc726a950" - ], - "layerId": "82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", - "seriesType": "bar_horizontal", - "xAccessor": "e139ccbc-54ff-4921-b345-e3c3ff6a9efc", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "d3c9208e-c699-4514-a091-a731d28ab9af", + "w": 24, + "x": 24, + "y": 14 }, - "preferredSeriesType": "bar_horizontal", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } + "panelIndex": "d3c9208e-c699-4514-a091-a731d28ab9af", + "title": "CPU Utilization Per Cluster", + "type": "lens", + "version": "8.3.0" }, - "title": "CPU Utilization Per Cluster [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 15, - "i": "d3c9208e-c699-4514-a091-a731d28ab9af", - "w": 24, - "x": 24, - "y": 14 - }, - "panelIndex": "d3c9208e-c699-4514-a091-a731d28ab9af", - "title": "CPU Utilization Per Cluster", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "e350c9e6-e6b7-40f1-83ed-94a38ed9467a": { - "columnOrder": [ - "55121be2-80f6-407c-9352-3e13705ac860", - "eb452b61-bf12-46c0-afae-c0f1c776156c", - "5b846eff-5ca7-45b0-b4c2-0346e9986302" - ], - "columns": { - "55121be2-80f6-407c-9352-3e13705ac860": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "10s" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "5b846eff-5ca7-45b0-b4c2-0346e9986302": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Container Memory Usage Pct", - "operationType": "average", - "params": { - "format": { - "id": "percent", - "params": { - "decimals": 2 - } + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "type": "index-pattern" } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.memory.usage.pct" - }, - "eb452b61-bf12-46c0-afae-c0f1c776156c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "container identifier", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "5b846eff-5ca7-45b0-b4c2-0346e9986302", - "type": "column" + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e350c9e6-e6b7-40f1-83ed-94a38ed9467a": { + "columnOrder": [ + "55121be2-80f6-407c-9352-3e13705ac860", + "eb452b61-bf12-46c0-afae-c0f1c776156c", + "5b846eff-5ca7-45b0-b4c2-0346e9986302" + ], + "columns": { + "55121be2-80f6-407c-9352-3e13705ac860": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "10s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "5b846eff-5ca7-45b0-b4c2-0346e9986302": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Memory Usage Pct", + "operationType": "average", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.memory.usage.pct" + }, + "eb452b61-bf12-46c0-afae-c0f1c776156c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "container identifier", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "5b846eff-5ca7-45b0-b4c2-0346e9986302", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "awsfargate.task_stats.identifier" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 20, - "parentFormat": { - "id": "terms" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "5b846eff-5ca7-45b0-b4c2-0346e9986302" + ], + "layerId": "e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "eb452b61-bf12-46c0-afae-c0f1c776156c", + "xAccessor": "55121be2-80f6-407c-9352-3e13705ac860" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } } - }, - "scale": "ordinal", - "sourceField": "awsfargate.task_stats.identifier" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + }, + "title": "Container Memory Usage Pct [Metrics AWSFargate]", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "5b846eff-5ca7-45b0-b4c2-0346e9986302" - ], - "layerId": "e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "eb452b61-bf12-46c0-afae-c0f1c776156c", - "xAccessor": "55121be2-80f6-407c-9352-3e13705ac860", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7", + "w": 24, + "x": 0, + "y": 29 }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } + "panelIndex": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7", + "title": "Container Memory Usage Pct", + "type": "lens", + "version": "8.3.0" }, - "title": "Container Memory Usage Pct [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 15, - "i": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7", - "w": 24, - "x": 0, - "y": 29 - }, - "panelIndex": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7", - "title": "Container Memory Usage Pct", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "c8d70f88-6554-41ca-ac1e-a3cf8b992972": { - "columnOrder": [ - "0505d890-632e-4434-a68f-f019e7893eaf", - "989ce63a-7fcd-4c83-980b-d595a1dd2469", - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" - ], - "columns": { - "0505d890-632e-4434-a68f-f019e7893eaf": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of awsfargate.task_stats.identifier", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 20, - "parentFormat": { - "id": "terms" + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0749cbce-4a88-471d-9715-9f4f54510864", + "type": "index-pattern" } - }, - "scale": "ordinal", - "sourceField": "awsfargate.task_stats.identifier" - }, - "989ce63a-7fcd-4c83-980b-d595a1dd2469": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "DiskIO Write", - "operationType": "average", - "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0749cbce-4a88-471d-9715-9f4f54510864": { + "columnOrder": [ + "35481ca7-cebb-495c-974f-34ede5f3935c", + "33d4857c-800a-4854-9369-dbf019501bdd", + "ec425562-fe79-4326-b753-20b408c806fb" + ], + "columns": { + "33d4857c-800a-4854-9369-dbf019501bdd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Container Identifier", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "ec425562-fe79-4326-b753-20b408c806fb", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "awsfargate.task_stats.identifier" + }, + "35481ca7-cebb-495c-974f-34ede5f3935c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "10s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec425562-fe79-4326-b753-20b408c806fb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container CPU Total Norm Pct", + "operationType": "average", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "ec425562-fe79-4326-b753-20b408c806fb" + ], + "layerId": "0749cbce-4a88-471d-9715-9f4f54510864", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "33d4857c-800a-4854-9369-dbf019501bdd", + "xAccessor": "35481ca7-cebb-495c-974f-34ede5f3935c" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line" } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.diskio.write.bytes" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + }, + "title": "Container CPU Total Norm Pct [Metrics AWSFargate]", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" - ], - "layerId": "c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "0505d890-632e-4434-a68f-f019e7893eaf", - "xAccessor": "989ce63a-7fcd-4c83-980b-d595a1dd2469", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "a7a6e425-98fd-4210-b3d5-005268be6274", + "w": 24, + "x": 24, + "y": 29 }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } + "panelIndex": "a7a6e425-98fd-4210-b3d5-005268be6274", + "title": "Container CPU Total Norm Pct", + "type": "lens", + "version": "8.3.0" }, - "title": "DiskIO Write [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 15, - "i": "89b0cd8b-13d9-4a43-8f93-3410aff125c3", - "w": 24, - "x": 24, - "y": 44 - }, - "panelIndex": "89b0cd8b-13d9-4a43-8f93-3410aff125c3", - "title": "DiskIO Write", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "c8d70f88-6554-41ca-ac1e-a3cf8b992972": { - "columnOrder": [ - "0505d890-632e-4434-a68f-f019e7893eaf", - "989ce63a-7fcd-4c83-980b-d595a1dd2469", - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" - ], - "columns": { - "0505d890-632e-4434-a68f-f019e7893eaf": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of awsfargate.task_stats.identifier", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "c8d70f88-6554-41ca-ac1e-a3cf8b992972": { + "columnOrder": [ + "0505d890-632e-4434-a68f-f019e7893eaf", + "989ce63a-7fcd-4c83-980b-d595a1dd2469", + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" + ], + "columns": { + "0505d890-632e-4434-a68f-f019e7893eaf": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of awsfargate.task_stats.identifier", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "awsfargate.task_stats.identifier" + }, + "989ce63a-7fcd-4c83-980b-d595a1dd2469": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DiskIO Read", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.diskio.read.bytes" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 20, - "parentFormat": { - "id": "terms" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" + ], + "layerId": "c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "0505d890-632e-4434-a68f-f019e7893eaf", + "xAccessor": "989ce63a-7fcd-4c83-980b-d595a1dd2469" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } } - }, - "scale": "ordinal", - "sourceField": "awsfargate.task_stats.identifier" }, - "989ce63a-7fcd-4c83-980b-d595a1dd2469": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "DiskIO Read", - "operationType": "average", - "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } - } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.diskio.read.bytes" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "DiskIO Read [Metrics AWSFargate]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" - ], - "layerId": "c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "0505d890-632e-4434-a68f-f019e7893eaf", - "xAccessor": "989ce63a-7fcd-4c83-980b-d595a1dd2469", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "d7a6623a-14cf-411c-ab73-ded3734a359b", + "w": 24, + "x": 0, + "y": 44 }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } + "panelIndex": "d7a6623a-14cf-411c-ab73-ded3734a359b", + "title": "DiskIO Read", + "type": "lens", + "version": "8.3.0" }, - "title": "DiskIO Read [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 15, - "i": "d7a6623a-14cf-411c-ab73-ded3734a359b", - "w": 24, - "x": 0, - "y": 44 - }, - "panelIndex": "d7a6623a-14cf-411c-ab73-ded3734a359b", - "title": "DiskIO Read", - "type": "lens", - "version": "8.1.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "0749cbce-4a88-471d-9715-9f4f54510864": { - "columnOrder": [ - "35481ca7-cebb-495c-974f-34ede5f3935c", - "33d4857c-800a-4854-9369-dbf019501bdd", - "ec425562-fe79-4326-b753-20b408c806fb" - ], - "columns": { - "33d4857c-800a-4854-9369-dbf019501bdd": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Container Identifier", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "ec425562-fe79-4326-b753-20b408c806fb", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "c8d70f88-6554-41ca-ac1e-a3cf8b992972": { + "columnOrder": [ + "0505d890-632e-4434-a68f-f019e7893eaf", + "989ce63a-7fcd-4c83-980b-d595a1dd2469", + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" + ], + "columns": { + "0505d890-632e-4434-a68f-f019e7893eaf": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of awsfargate.task_stats.identifier", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "awsfargate.task_stats.identifier" + }, + "989ce63a-7fcd-4c83-980b-d595a1dd2469": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DiskIO Write", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "awsfargate.task_stats.diskio.write.bytes" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 20, - "parentFormat": { - "id": "terms" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "ab00dce2-6c01-4a0d-8d7c-71330afbaa3b" + ], + "layerId": "c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "0505d890-632e-4434-a68f-f019e7893eaf", + "xAccessor": "989ce63a-7fcd-4c83-980b-d595a1dd2469" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } } - }, - "scale": "ordinal", - "sourceField": "awsfargate.task_stats.identifier" }, - "35481ca7-cebb-495c-974f-34ede5f3935c": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "10s" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "ec425562-fe79-4326-b753-20b408c806fb": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Container CPU Total Norm Pct", - "operationType": "average", - "params": { - "format": { - "id": "percent", - "params": { - "decimals": 2 - } - } - }, - "scale": "ratio", - "sourceField": "awsfargate.task_stats.cpu.total.norm.pct" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "fittingFunction": "None", - "layers": [ - { - "accessors": [ - "ec425562-fe79-4326-b753-20b408c806fb" - ], - "layerId": "0749cbce-4a88-471d-9715-9f4f54510864", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "33d4857c-800a-4854-9369-dbf019501bdd", - "xAccessor": "35481ca7-cebb-495c-974f-34ede5f3935c", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "title": "DiskIO Write [Metrics AWSFargate]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "preferredSeriesType": "line" - } - }, - "title": "Container CPU Total Norm Pct [Metrics AWSFargate]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-0749cbce-4a88-471d-9715-9f4f54510864", - "type": "index-pattern" - } - ] - } + "gridData": { + "h": 15, + "i": "89b0cd8b-13d9-4a43-8f93-3410aff125c3", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "89b0cd8b-13d9-4a43-8f93-3410aff125c3", + "title": "DiskIO Write", + "type": "lens", + "version": "8.3.0" + } + ], + "timeRestore": false, + "title": "[AWS Fargate] Fargate Overview", + "version": 1 + }, + "coreMigrationVersion": "8.3.0", + "id": "awsfargate-20dc7c50-2e89-11eb-991c-c5fd3b7f5a63", + "migrationVersion": { + "dashboard": "8.3.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "735a25cb-f781-4a8b-99e6-2adf582f8a37:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "735a25cb-f781-4a8b-99e6-2adf582f8a37:indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5d4537e8-9aee-47e6-8580-1961d8a3a38e:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5d4537e8-9aee-47e6-8580-1961d8a3a38e:indexpattern-datasource-layer-450490b7-c7f9-42bf-8e7d-227cbf960e94", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "a7a6e425-98fd-4210-b3d5-005268be6274", - "w": 24, - "x": 24, - "y": 29 + { + "id": "metrics-*", + "name": "d3c9208e-c699-4514-a091-a731d28ab9af:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "panelIndex": "a7a6e425-98fd-4210-b3d5-005268be6274", - "title": "Container CPU Total Norm Pct", - "type": "lens", - "version": "8.1.0" - } + { + "id": "metrics-*", + "name": "d3c9208e-c699-4514-a091-a731d28ab9af:indexpattern-datasource-layer-82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7:indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a7a6e425-98fd-4210-b3d5-005268be6274:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a7a6e425-98fd-4210-b3d5-005268be6274:indexpattern-datasource-layer-0749cbce-4a88-471d-9715-9f4f54510864", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "d7a6623a-14cf-411c-ab73-ded3734a359b:indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "89b0cd8b-13d9-4a43-8f93-3410aff125c3:indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_ee100059-0e56-4e9b-ae09-ff53234bdf8c:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_e967cd1f-7491-4e72-8d63-23fcef40b9cc:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_b2adcf17-72de-46e8-87b1-94c16c399bf0:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[AWS Fargate] Fargate Overview", - "version": 1 - }, - "references": [ - { - "type": "index-pattern", - "name": "2429ae11-ccb3-4016-b18d-c88140e29f67:control_0_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2429ae11-ccb3-4016-b18d-c88140e29f67:control_1_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2429ae11-ccb3-4016-b18d-c88140e29f67:control_2_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "735a25cb-f781-4a8b-99e6-2adf582f8a37:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "735a25cb-f781-4a8b-99e6-2adf582f8a37:indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "5d4537e8-9aee-47e6-8580-1961d8a3a38e:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "5d4537e8-9aee-47e6-8580-1961d8a3a38e:indexpattern-datasource-layer-450490b7-c7f9-42bf-8e7d-227cbf960e94", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "d3c9208e-c699-4514-a091-a731d28ab9af:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "d3c9208e-c699-4514-a091-a731d28ab9af:indexpattern-datasource-layer-82f43ff6-6ac1-4f73-b532-61b6b9fe15b0", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "9dd2b002-5170-49ea-afc2-30b0b46b0fd7:indexpattern-datasource-layer-e350c9e6-e6b7-40f1-83ed-94a38ed9467a", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "89b0cd8b-13d9-4a43-8f93-3410aff125c3:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "89b0cd8b-13d9-4a43-8f93-3410aff125c3:indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "d7a6623a-14cf-411c-ab73-ded3734a359b:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "d7a6623a-14cf-411c-ab73-ded3734a359b:indexpattern-datasource-layer-c8d70f88-6554-41ca-ac1e-a3cf8b992972", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "a7a6e425-98fd-4210-b3d5-005268be6274:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "a7a6e425-98fd-4210-b3d5-005268be6274:indexpattern-datasource-layer-0749cbce-4a88-471d-9715-9f4f54510864", - "id": "metrics-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/awsfargate/manifest.yml b/packages/awsfargate/manifest.yml index 8b80567b747..ce30db10ac3 100644 --- a/packages/awsfargate/manifest.yml +++ b/packages/awsfargate/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: awsfargate title: AWS Fargate -version: 0.2.1 +version: 0.3.0 license: basic description: Collects metrics from containers and tasks running on Amazon ECS clusters with Elastic Agent. type: integration @@ -10,7 +10,7 @@ categories: - aws release: beta conditions: - kibana.version: "^8.1.0" + kibana.version: "^8.8.0" owner: github: elastic/obs-cloud-monitoring screenshots: diff --git a/packages/awsfirehose/_dev/build/build.yml b/packages/awsfirehose/_dev/build/build.yml new file mode 100644 index 00000000000..47cbed9fed8 --- /dev/null +++ b/packages/awsfirehose/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.0.0 diff --git a/packages/awsfirehose/_dev/build/docs/README.md b/packages/awsfirehose/_dev/build/docs/README.md new file mode 100644 index 00000000000..655f3c32885 --- /dev/null +++ b/packages/awsfirehose/_dev/build/docs/README.md @@ -0,0 +1,93 @@ +# Amazon Kinesis Data Firehose +Amazon Kinesis Data Firehose integration offers users a way to stream logs from Firehose to Elastic Cloud. +This integration includes predefined rules that automatically route AWS service logs to the respective integrations, which +include field mappings, ingest pipelines, predefined dashboards and ect. Here is a list of log types that are supported +by this integration: + +| AWS service log | Log destination | +|--------------------|---------------------------| +| API Gateway | CloudWatch | +| CloudTrail | CloudWatch | +| Network Firewall | Firehose, CloudWatch, S3 | +| Route53 Public DNS | CloudWatch | +| Route53 Resolver | Firehose, CloudWatch, S3 | +| VPC Flow | Firehose, CloudWatch, S3 | +| WAF | Firehose, CloudWatch | + +## Limitation +It is not possible to configure a delivery stream to send data to Elastic Cloud via PrivateLink (VPC endpoint). +This is a current limitation in Firehose, which we are working with AWS to resolve. + +## Instructions +1. Install the relevant integrations in Kibana + + In order to make the most of your data, install AWS integrations to load index templates, ingest pipelines, and + dashboards into Kibana. In Kibana, navigate to **Management** > **Integrations** in the sidebar. + Find the **AWS** integration by searching or browsing the catalog. + + ![AWS integration](../img/aws.png) + + Navigate to the **Settings** tab and click **Install AWS assets**. Confirm by clicking **Install AWS** in the popup. + + ![Install AWS assets](../img/install-assets.png) + +2. Create a delivery stream in Amazon Kinesis Data Firehose + + Sign into the AWS console and navigate to Amazon Kinesis. Click **Create delivery stream**. + Configure the delivery stream using the following settings: + + ![Amazon Kinesis Data Firehose](../img/aws-firehose.png) + + **Choose source and destination** + + Unless you are streaming data from Kinesis Data Streams, set source to Direct PUT (see Setup guide for more details on data sources). + + Set destination to **Elastic**. + + **Delivery stream name** + + Provide a meaningful name that will allow you to identify this delivery stream later. + + ![Choose Firehose Source and Destination](../img/source-destination.png) + + **Destination settings** + + 1. Set **Elastic endpoint URL** to point to your Elasticsearch cluster running in Elastic Cloud. + This endpoint can be found in the Elastic Cloud console. An example is https://my-deployment-28u274.es.eu-west-1.aws.found.io. + + 2. **API key** should be a Base64 encoded Elastic API key, which can be created in Kibana by following the + instructions under API Keys. If you are using an API key with “Restrict privileges”, be sure to review the Indices + privileges to provide at least "auto_configure" & "write" permissions for the indices you will be using with this + delivery stream. + + 3. We recommend leaving **Content encoding** set to **GZIP** for improved network efficiency. + + 4. **Retry duration** determines how long Firehose continues retrying the request in the event of an error. + A duration of 60-300s should be suitable for most use cases. + + 5. Elastic requires a **Buffer size** of `1MiB` to avoid exceeding the Elasticsearch `http.max_content_length` + setting (typically 100MB) when the buffer is uncompressed. + + 6. The default **Buffer interval** of `60s` is recommended to ensure data freshness in Elastic. + + 7. **Parameters** + + 1. Elastic recommends setting the `es_datastream_name` parameter to `logs-awsfirehose.logs-default` in order to + leverage the routing rules defined in this integration. If this parameter is not specified, data is sent to the + `logs-generic-default` data stream by default. + ![Firehose Destination Settings](../img/destination-settings.png) + + 2. The **include_cw_extracted_fields** parameter is optional and can be set when using a CloudWatch logs subscription + filter as the Firehose data source. When set to true, extracted fields generated by the filter pattern in the + subscription filter will be collected. Setting this parameter can add many fields into each record and may significantly + increase data volume in Elasticsearch. As such, use of this parameter should be carefully considered and used only when + the extracted fields are required for specific filtering and/or aggregation. + + 3. The **include_event_original** field is optional and should only be used for debugging purposes. When set to `true`, each + log record will contain an additional field named `event.original`, which contains the raw (unprocessed) log message. + This parameter will increase the data volume in Elasticsearch and should be used with care. + +3. Send data to the Firehose delivery stream + + Consult the [AWS documentation](https://docs.aws.amazon.com/firehose/latest/dev/basic-write.html) for details on how to + configure a variety of log sources to send data to Firehose delivery streams. diff --git a/packages/awsfirehose/changelog.yml b/packages/awsfirehose/changelog.yml new file mode 100644 index 00000000000..cb42a8a3062 --- /dev/null +++ b/packages/awsfirehose/changelog.yml @@ -0,0 +1,16 @@ +# newer versions go on top +- version: 0.2.1 + changes: + - description: Route WAF logs based on log format + type: enhancement + link: https://github.com/elastic/integrations/pull/7836 +- version: 0.2.0 + changes: + - description: Add support for routing api gateway logs + type: enhancement + link: https://github.com/elastic/integrations/pull/7701 +- version: 0.1.0 + changes: + - description: initial release + type: enhancement + link: https://github.com/elastic/integrations/pull/7146 diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json new file mode 100644 index 00000000000..510593b2812 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json @@ -0,0 +1,58 @@ +{ + "events": [ + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "message": "{\"requestId\":\"GQIVriFLIAMEMsA=\",\"ip\":\"1.128.0.0\",\"requestTime\":\"09/Jun/2023:12:54:08 +0000\",\"httpMethod\":\"GET\",\"routeKey\":\"GET /\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"47140\"}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.cloudwatch.log_stream": "6am6mj7iqf_.default-2023-07-25-21-04", + "cloud.provider": "aws", + "@timestamp": "2023-07-25T21:04:35Z", + "cloud.account.id": "123456", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "event.id": "37670326805251200781477669690942747782212394134076063744", + "aws.cloudwatch.log_group": "aws/api-gateway/test-HTTP" + }, + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "message": "{\"requestId\":\"Iq9gjE_aIAMFZTg=\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:20:44 +0000\",\"eventType\":\"CONNECT\",\"routeKey\":\"$connect\",\"status\":\"500\",\"connectionId\":\"Iq8gj1UmIAMCKpA=\",\"apiId\":\"z1ctxygne5\",\"stage\":\"production\",\"domainName\":\"z1ctxygne5.execute-api.us-east-1.amazonaws.com\"}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.cloudwatch.log_stream": "640eb3bb5f9b64a78b51fd67d59e53d1", + "cloud.provider": "aws", + "@timestamp": "2023-07-25T21:04:35Z", + "cloud.account.id": "123456", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "event.id": "37670326805251200781477669690942747782212394134076063744", + "aws.cloudwatch.log_group": "aws/api-gateway/test-websocket" + }, + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "message": "{\"requestId\":\"48752d0f-c99d-4cfa-a5a7-f3c6834d19e5\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"10/Jun/2023:15:36:28 +0000\",\"httpMethod\":\"GET\",\"resourcePath\":\"/pets\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"184\"}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.cloudwatch.log_stream": "198fbff89762157ff651566b645c6730", + "cloud.provider": "aws", + "@timestamp": "2023-07-25T21:04:35Z", + "cloud.account.id": "123456", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "event.id": "37670326805251200781477669690942747782212394134076063744", + "aws.cloudwatch.log_group": "aws/api-gateway/test-REST" + } + ] +} diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json-expected.json new file mode 100644 index 00000000000..da13eb2384b --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-apigateway-log.json-expected.json @@ -0,0 +1,76 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-25T21:04:35Z", + "aws.cloudwatch.log_group": "aws/api-gateway/test-HTTP", + "aws.cloudwatch.log_stream": "6am6mj7iqf_.default-2023-07-25-21-04", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.apigateway_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37670326805251200781477669690942747782212394134076063744", + "message": "{\"requestId\":\"GQIVriFLIAMEMsA=\",\"ip\":\"1.128.0.0\",\"requestTime\":\"09/Jun/2023:12:54:08 +0000\",\"httpMethod\":\"GET\",\"routeKey\":\"GET /\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"47140\"}" + }, + { + "@timestamp": "2023-07-25T21:04:35Z", + "aws.cloudwatch.log_group": "aws/api-gateway/test-websocket", + "aws.cloudwatch.log_stream": "640eb3bb5f9b64a78b51fd67d59e53d1", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.apigateway_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37670326805251200781477669690942747782212394134076063744", + "message": "{\"requestId\":\"Iq9gjE_aIAMFZTg=\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"26/Jul/2023:12:20:44 +0000\",\"eventType\":\"CONNECT\",\"routeKey\":\"$connect\",\"status\":\"500\",\"connectionId\":\"Iq8gj1UmIAMCKpA=\",\"apiId\":\"z1ctxygne5\",\"stage\":\"production\",\"domainName\":\"z1ctxygne5.execute-api.us-east-1.amazonaws.com\"}" + }, + { + "@timestamp": "2023-07-25T21:04:35Z", + "aws.cloudwatch.log_group": "aws/api-gateway/test-REST", + "aws.cloudwatch.log_stream": "198fbff89762157ff651566b645c6730", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-apigateway-logs-to-elastic", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.firehose.subscription_filters": "[apigateway-to-firehose]", + "aws.kinesis.name": "firehose-apigateway-logs-to-elastic", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.apigateway_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37670326805251200781477669690942747782212394134076063744", + "message": "{\"requestId\":\"48752d0f-c99d-4cfa-a5a7-f3c6834d19e5\",\"ip\":\"1.128.0.0\",\"caller\":\"-\",\"user\":\"-\",\"requestTime\":\"10/Jun/2023:15:36:28 +0000\",\"httpMethod\":\"GET\",\"resourcePath\":\"/pets\",\"status\":\"200\",\"protocol\":\"HTTP/1.1\",\"responseLength\":\"184\"}" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json new file mode 100644 index 00000000000..5e409d50d56 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json @@ -0,0 +1,22 @@ +{ + "events": [ + { + "cloud.region": "us-east-2", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-cloudtrail-logs-to-elastic", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[cloudtrail-to-firehose]", + "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AWSService\",\"invokedBy\":\"cloudtrail.amazonaws.com\"},\"eventTime\":\"2023-07-17T21:02:26Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"sa-east-1\",\"sourceIPAddress\":\"cloudtrail.amazonaws.com\",\"userAgent\":\"cloudtrail.amazonaws.com\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::123456:role/service-role/aws-cloudtrail-logs-123456-b888baff_Role\",\"roleSessionName\":\"CLOUDWATCH_LOGS_DELIVERY_SESSION\"},\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIAZEDJODE3A5LVGLFB\",\"sessionToken\":\"IQoJb3JpZ2luX2VjEGUaCXNhLWVhc3QtMSJHMEUCIHgHmtcrhwDhosJlQVky+C2zsYDKuR99qVlNjGIp8FLWAiEAsJtTDQ3Arq8iXEOHwv0ImEQdGb5tbgc+fLpoK58Enb4q9AII3v//////////ARAEGgw2MjcyODYzNTAxMzQiDN5gNdfO4ZdSqDmmwSrIAicTBYZg+ZXjwiJTN/Bz2YsMWYU6psw5znG3/Gh3EJ1P3RCmB7d79X6XZzFVi2u2xdrnaY/sTKDfp1jdl8OoAsSKYwJiGbzjoQlv59bB6JqPbKfAKUPAmz6JEMWNFgWTtaQL9rNkdPz23u/1msoUSzxCcxR9f3A2dD4yqnVpNJe8ipuhxpBMzQ61vcGL4G5hQEDM/o8sORP2PXbK4O7QAuWOyuryYkHAPwY9RrL0WHfflGBEBQV6XlidGpsRCtIppZVn025n3DQOypDEaL3fKp0gUsMkDH+frFjxop4o4wRYC3CxXe3XRJ5/Te886rQry7RUfXlQtiCfojZO5ohcLB+z6Y/uCK0IHp3zrfl5shKsQIAFt7p0B8W7PK5yHE4W9HHRiktJ9wTtq1YCTaWECpnjW0bISNgumRmDOAJvVHAjSjfkr4yAlJkw4qm8pQY6vwGbBiuf98AfRFrXMy01hVdE3GNTBrIS68zxUJaOjBLgw8l0nEC00L+LPuqaASFWz65Dnq5JAjXaDD9E3iCi4klp4gZFAcj7uGgeBIPkP7Bpr4SvBfnnqCgE2oyFrWke3NnYtqkL5iHLJeGlOTrvI5ND2H4jurQv0KbiqwHt6DmGF3poZOrtf8R3piNcuCCDLU8RvhRVLHy5rKPzsWgNokBc9XXmgltwvB6rIgdZhBJzupzmy/NSoWZcOeH2ooEELw==\",\"expiration\":\"Jul 12, 2023, 10:02:26 PM\"},\"assumedRoleUser\":{\"assumedRoleId\":\"AROAZEDJODE3NLJAH2FZC:CLOUDWATCH_LOGS_DELIVERY_SESSION\",\"arn\":\"arn:aws:sts::123456:assumed-role/aws-cloudtrail-logs-123456-b888baff_Role/CLOUDWATCH_LOGS_DELIVERY_SESSION\"}},\"requestID\":\"041c9e5f-a031-47d2-a4a0-011bc8d5352c\",\"eventID\":\"3096b662-7aa9-43e6-8bee-541a45686745\",\"readOnly\":true,\"resources\":[{\"accountId\":\"123456\",\"type\":\"AWS::IAM::Role\",\"ARN\":\"arn:aws:iam::123456:role/service-role/aws-cloudtrail-logs-123456-b888baff_Role\"}],\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456\",\"sharedEventID\":\"a1c94275-884f-4c1f-b8dc-2e1bf4c94d29\",\"eventCategory\":\"Management\"}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.cloudwatch.log_stream": "123456_CloudTrail_us-east-2_3", + "cloud.provider": "aws", + "@timestamp": "2023-07-25T21:04:35Z", + "cloud.account.id": "123456", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "firehose-cloudtrail-logs-to-elastic", + "event.id": "37670326805251200781477669690942747782212394134076063744", + "aws.cloudwatch.log_group": "aws-cloudtrail-logs-123456-1c167310" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json-expected.json new file mode 100644 index 00000000000..ff73078498f --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-cloudtrail-log.json-expected.json @@ -0,0 +1,28 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-25T21:04:35Z", + "aws.cloudwatch.log_group": "aws-cloudtrail-logs-123456-1c167310", + "aws.cloudwatch.log_stream": "123456_CloudTrail_us-east-2_3", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:123456:deliverystream/firehose-cloudtrail-logs-to-elastic", + "aws.firehose.request_id": "971ae05f-a128-4a7f-b623-30f9bc513e55", + "aws.firehose.subscription_filters": "[cloudtrail-to-firehose]", + "aws.kinesis.name": "firehose-cloudtrail-logs-to-elastic", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456", + "cloud.provider": "aws", + "cloud.region": "us-east-2", + "data_stream.dataset": "aws.cloudtrail", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37670326805251200781477669690942747782212394134076063744", + "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AWSService\",\"invokedBy\":\"cloudtrail.amazonaws.com\"},\"eventTime\":\"2023-07-17T21:02:26Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"sa-east-1\",\"sourceIPAddress\":\"cloudtrail.amazonaws.com\",\"userAgent\":\"cloudtrail.amazonaws.com\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::123456:role/service-role/aws-cloudtrail-logs-123456-b888baff_Role\",\"roleSessionName\":\"CLOUDWATCH_LOGS_DELIVERY_SESSION\"},\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIAZEDJODE3A5LVGLFB\",\"sessionToken\":\"IQoJb3JpZ2luX2VjEGUaCXNhLWVhc3QtMSJHMEUCIHgHmtcrhwDhosJlQVky+C2zsYDKuR99qVlNjGIp8FLWAiEAsJtTDQ3Arq8iXEOHwv0ImEQdGb5tbgc+fLpoK58Enb4q9AII3v//////////ARAEGgw2MjcyODYzNTAxMzQiDN5gNdfO4ZdSqDmmwSrIAicTBYZg+ZXjwiJTN/Bz2YsMWYU6psw5znG3/Gh3EJ1P3RCmB7d79X6XZzFVi2u2xdrnaY/sTKDfp1jdl8OoAsSKYwJiGbzjoQlv59bB6JqPbKfAKUPAmz6JEMWNFgWTtaQL9rNkdPz23u/1msoUSzxCcxR9f3A2dD4yqnVpNJe8ipuhxpBMzQ61vcGL4G5hQEDM/o8sORP2PXbK4O7QAuWOyuryYkHAPwY9RrL0WHfflGBEBQV6XlidGpsRCtIppZVn025n3DQOypDEaL3fKp0gUsMkDH+frFjxop4o4wRYC3CxXe3XRJ5/Te886rQry7RUfXlQtiCfojZO5ohcLB+z6Y/uCK0IHp3zrfl5shKsQIAFt7p0B8W7PK5yHE4W9HHRiktJ9wTtq1YCTaWECpnjW0bISNgumRmDOAJvVHAjSjfkr4yAlJkw4qm8pQY6vwGbBiuf98AfRFrXMy01hVdE3GNTBrIS68zxUJaOjBLgw8l0nEC00L+LPuqaASFWz65Dnq5JAjXaDD9E3iCi4klp4gZFAcj7uGgeBIPkP7Bpr4SvBfnnqCgE2oyFrWke3NnYtqkL5iHLJeGlOTrvI5ND2H4jurQv0KbiqwHt6DmGF3poZOrtf8R3piNcuCCDLU8RvhRVLHy5rKPzsWgNokBc9XXmgltwvB6rIgdZhBJzupzmy/NSoWZcOeH2ooEELw==\",\"expiration\":\"Jul 12, 2023, 10:02:26 PM\"},\"assumedRoleUser\":{\"assumedRoleId\":\"AROAZEDJODE3NLJAH2FZC:CLOUDWATCH_LOGS_DELIVERY_SESSION\",\"arn\":\"arn:aws:sts::123456:assumed-role/aws-cloudtrail-logs-123456-b888baff_Role/CLOUDWATCH_LOGS_DELIVERY_SESSION\"}},\"requestID\":\"041c9e5f-a031-47d2-a4a0-011bc8d5352c\",\"eventID\":\"3096b662-7aa9-43e6-8bee-541a45686745\",\"readOnly\":true,\"resources\":[{\"accountId\":\"123456\",\"type\":\"AWS::IAM::Role\",\"ARN\":\"arn:aws:iam::123456:role/service-role/aws-cloudtrail-logs-123456-b888baff_Role\"}],\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456\",\"sharedEventID\":\"a1c94275-884f-4c1f-b8dc-2e1bf4c94d29\",\"eventCategory\":\"Management\"}" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json new file mode 100644 index 00000000000..3ac09b242df --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json @@ -0,0 +1,20 @@ +{ + "events": [ + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-firewall-logs", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[test-firewall-logs-to-firehose]", + "message": "{\"firewall_name\":\"AWSNetworkFirewall\",\"availability_zone\":\"us-east-2a\",\"event_timestamp\":\"1636381332\",\"event\":{\"timestamp\":\"2021-11-08T14:22:12.637611+0000\",\"flow_id\":706471429191862,\"event_type\":\"alert\",\"src_ip\":\"81.2.69.143\",\"src_port\":51254,\"dest_ip\":\"216.160.83.57\",\"dest_port\":80,\"proto\":\"TCP\",\"alert\":{\"action\":\"blocked\",\"signature_id\":1000003,\"rev\":1,\"signature\":\"Deny all other TCP traffic\",\"category\":\"\",\"severity\":3},\"http\":{\"hostname\":\"216.160.83.57\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\"}}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "cloud.provider": "aws", + "@timestamp": "2023-08-11T20:01:37Z", + "cloud.account.id": "123456789", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "test-firewall-logs", + "event.id": "37728046078123216000395549868459931814660237705210691585" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json-expected.json new file mode 100644 index 00000000000..677a47d4067 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-firewall-log.json-expected.json @@ -0,0 +1,26 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-11T20:01:37Z", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-firewall-logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.firehose.subscription_filters": "[test-firewall-logs-to-firehose]", + "aws.kinesis.name": "test-firewall-logs", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456789", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.firewall_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37728046078123216000395549868459931814660237705210691585", + "message": "{\"firewall_name\":\"AWSNetworkFirewall\",\"availability_zone\":\"us-east-2a\",\"event_timestamp\":\"1636381332\",\"event\":{\"timestamp\":\"2021-11-08T14:22:12.637611+0000\",\"flow_id\":706471429191862,\"event_type\":\"alert\",\"src_ip\":\"81.2.69.143\",\"src_port\":51254,\"dest_ip\":\"216.160.83.57\",\"dest_port\":80,\"proto\":\"TCP\",\"alert\":{\"action\":\"blocked\",\"signature_id\":1000003,\"rev\":1,\"signature\":\"Deny all other TCP traffic\",\"category\":\"\",\"severity\":3},\"http\":{\"hostname\":\"216.160.83.57\",\"url\":\"/\",\"http_user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"length\":0},\"app_proto\":\"http\"}}" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json new file mode 100644 index 00000000000..e49aa1537aa --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json @@ -0,0 +1,22 @@ +{ + "events": [ + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-route53-public-logs", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[test-route53-public-logs-to-firehose]", + "message": "1.0 2023-08-11T20:01:37Z Z0786514BU8K9GJ587CT filebeat-firehose.com NAPTR NOERROR UDP EWR52-C2 44.199.191.178 -", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.cloudwatch.log_stream": "Z0786514BU8K9GJ587CT/EWR52-C2", + "cloud.provider": "aws", + "@timestamp": "2023-08-11T20:01:37Z", + "cloud.account.id": "123456789", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "test-route53-public-logs", + "event.id": "37728046078123216000395549868459931814660237705210691585", + "aws.cloudwatch.log_group": "/aws/route53/filebeat-firehose.com" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json-expected.json new file mode 100644 index 00000000000..d3308f579c1 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-public-log.json-expected.json @@ -0,0 +1,28 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-11T20:01:37Z", + "aws.cloudwatch.log_group": "/aws/route53/filebeat-firehose.com", + "aws.cloudwatch.log_stream": "Z0786514BU8K9GJ587CT/EWR52-C2", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-route53-public-logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.firehose.subscription_filters": "[test-route53-public-logs-to-firehose]", + "aws.kinesis.name": "test-route53-public-logs", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456789", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.route53_public_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37728046078123216000395549868459931814660237705210691585", + "message": "1.0 2023-08-11T20:01:37Z Z0786514BU8K9GJ587CT filebeat-firehose.com NAPTR NOERROR UDP EWR52-C2 44.199.191.178 -" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json new file mode 100644 index 00000000000..a7368324d78 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json @@ -0,0 +1,22 @@ +{ + "events": [ + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-route53-resolver-logs", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[test-route53-resolver-logs-to-firehose]", + "message": "{\"version\":\"1.100000\",\"account_id\":\"626345947581\",\"region\":\"us-east-1\",\"vpc_id\":\"vpc-01e31a7c\",\"query_timestamp\":\"2021-12-11T22:46:23Z\",\"query_name\":\"does-not-exist.abc.com.\",\"query_type\":\"A\",\"query_class\":\"IN\",\"rcode\":\"NXDOMAIN\",\"answers\":[],\"srcaddr\":\"172.31.86.159\",\"srcport\":\"48701\",\"transport\":\"UDP\",\"srcids\":{}}", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.cloudwatch.log_stream": "Z0786514BU8K9GJ587CT/EWR52-C2", + "cloud.provider": "aws", + "@timestamp": "2023-08-11T20:01:37Z", + "cloud.account.id": "123456789", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "test-route53-resolver-logs", + "event.id": "37728046078123216000395549868459931814660237705210691585", + "aws.cloudwatch.log_group": "/aws/route53/filebeat-firehose.com" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json-expected.json new file mode 100644 index 00000000000..d1838501d88 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-route53-resolver-log.json-expected.json @@ -0,0 +1,28 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-11T20:01:37Z", + "aws.cloudwatch.log_group": "/aws/route53/filebeat-firehose.com", + "aws.cloudwatch.log_stream": "Z0786514BU8K9GJ587CT/EWR52-C2", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-route53-resolver-logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.firehose.subscription_filters": "[test-route53-resolver-logs-to-firehose]", + "aws.kinesis.name": "test-route53-resolver-logs", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456789", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.route53_resolver_logs", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37728046078123216000395549868459931814660237705210691585", + "message": "{\"version\":\"1.100000\",\"account_id\":\"626345947581\",\"region\":\"us-east-1\",\"vpc_id\":\"vpc-01e31a7c\",\"query_timestamp\":\"2021-12-11T22:46:23Z\",\"query_name\":\"does-not-exist.abc.com.\",\"query_type\":\"A\",\"query_class\":\"IN\",\"rcode\":\"NXDOMAIN\",\"answers\":[],\"srcaddr\":\"172.31.86.159\",\"srcport\":\"48701\",\"transport\":\"UDP\",\"srcids\":{}}" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json new file mode 100644 index 00000000000..b8c2a833d8b --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json @@ -0,0 +1,18 @@ +{ + "events": [ + { + "cloud.provider": "aws", + "@timestamp": "2023-08-23T16:47:26Z", + "cloud.region": "us-east-2", + "cloud.account.id": "428152502467", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:428152502467:deliverystream/test-vpcflow-logs", + "data_stream.namespace": "default", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "test-vpcflow-logs", + "message": "{\"message\":\"2 428152502467 eni-0b584e1c714317ac6 176.111.174.91 10.0.0.102 41536 1135 6 1 40 1692809104 1692809162 REJECT OK\"}\n", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "1cfbed13-d631-4b8b-b20a-b7c5bf8fcd00" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json-expected.json new file mode 100644 index 00000000000..1c07807b08a --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-vpcflow-log.json-expected.json @@ -0,0 +1,24 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-23T16:47:26Z", + "aws.firehose.arn": "arn:aws:firehose:us-east-2:428152502467:deliverystream/test-vpcflow-logs", + "aws.firehose.request_id": "1cfbed13-d631-4b8b-b20a-b7c5bf8fcd00", + "aws.kinesis.name": "test-vpcflow-logs", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "428152502467", + "cloud.provider": "aws", + "cloud.region": "us-east-2", + "data_stream.dataset": "aws.vpcflow", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "message": "{\"message\":\"2 428152502467 eni-0b584e1c714317ac6 176.111.174.91 10.0.0.102 41536 1135 6 1 40 1692809104 1692809162 REJECT OK\"}\n" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json new file mode 100644 index 00000000000..893c3a1027f --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json @@ -0,0 +1,36 @@ +{ + "events": [ + { + "cloud.provider": "aws", + "@timestamp": "2023-08-23T16:47:26Z", + "cloud.region": "us-east-1", + "cloud.account.id": "428152502467", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:428152502467:deliverystream/aws-waf-logs-test", + "data_stream.namespace": "default", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "aws-waf-logs-test", + "message": "{\"timestamp\":1576280412771,\"formatVersion\":1,\"webaclId\":\"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\":\"STMTest_SQLi_XSS\",\"terminatingRuleType\":\"REGULAR\",\"action\":\"BLOCK\",\"terminatingRuleMatchDetails\":[{\"conditionType\":\"SQL_INJECTION\",\"location\":\"HEADER\",\"matchedData\":[\"10\",\"AND\",\"1\"]}],\"httpSourceName\":\"-\",\"httpSourceId\":\"-\",\"ruleGroupList\":[],\"rateBasedRuleList\":[],\"nonTerminatingMatchingRules\":[],\"httpRequest\":{\"clientIp\":\"89.160.20.156\",\"country\":\"AU\",\"headers\":[{\"name\":\"Host\",\"value\":\"localhost:1989\"},{\"name\":\"User-Agent\",\"value\":\"curl/7.61.1\"},{\"name\":\"Accept\",\"value\":\"*/*\"},{\"name\":\"x-stm-test\",\"value\":\"10 AND 1=1\"}],\"uri\":\"/foo\",\"args\":\"\",\"httpVersion\":\"HTTP/1.1\",\"httpMethod\":\"GET\",\"requestId\":\"rid\"},\"labels\":[{\"name\":\"value\"}]}\n", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "1cfbed13-d631-4b8b-b20a-b7c5bf8fcd00" + }, + { + "cloud.region": "us-east-1", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-waf-logs", + "data_stream.namespace": "default", + "aws.firehose.subscription_filters": "[test-waf-logs-to-firehose]", + "message": "{\"timestamp\":1576280412771,\"formatVersion\":1,\"webaclId\":\"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\":\"STMTest_SQLi_XSS\",\"terminatingRuleType\":\"REGULAR\",\"action\":\"BLOCK\",\"terminatingRuleMatchDetails\":[{\"conditionType\":\"SQL_INJECTION\",\"location\":\"HEADER\",\"matchedData\":[\"10\",\"AND\",\"1\"]}],\"httpSourceName\":\"-\",\"httpSourceId\":\"-\",\"ruleGroupList\":[],\"rateBasedRuleList\":[],\"nonTerminatingMatchingRules\":[],\"httpRequest\":{\"clientIp\":\"89.160.20.156\",\"country\":\"AU\",\"headers\":[{\"name\":\"Host\",\"value\":\"localhost:1989\"},{\"name\":\"User-Agent\",\"value\":\"curl/7.61.1\"},{\"name\":\"Accept\",\"value\":\"*/*\"},{\"name\":\"x-stm-test\",\"value\":\"10 AND 1=1\"}],\"uri\":\"/foo\",\"args\":\"\",\"httpVersion\":\"HTTP/1.1\",\"httpMethod\":\"GET\",\"requestId\":\"rid\"},\"labels\":[{\"name\":\"value\"}]}\n", + "aws.kinesis.type": "deliverystream", + "data_stream.type": "logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.cloudwatch.log_stream": "us-east-1_web-acl-name_1", + "cloud.provider": "aws", + "@timestamp": "2023-08-23T16:47:26Z", + "cloud.account.id": "123456789", + "data_stream.dataset": "awsfirehose.logs", + "aws.kinesis.name": "test-waf-logs", + "event.id": "37728046078123216000395549868459931814660237705210691585", + "aws.cloudwatch.log_group": "aws-waf-logs-test-firehose" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json-expected.json b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json-expected.json new file mode 100644 index 00000000000..82037490543 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/_dev/test/pipeline/test-waf-log.json-expected.json @@ -0,0 +1,48 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-23T16:47:26Z", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:428152502467:deliverystream/aws-waf-logs-test", + "aws.firehose.request_id": "1cfbed13-d631-4b8b-b20a-b7c5bf8fcd00", + "aws.kinesis.name": "aws-waf-logs-test", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "428152502467", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.waf", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "message": "{\"timestamp\":1576280412771,\"formatVersion\":1,\"webaclId\":\"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\":\"STMTest_SQLi_XSS\",\"terminatingRuleType\":\"REGULAR\",\"action\":\"BLOCK\",\"terminatingRuleMatchDetails\":[{\"conditionType\":\"SQL_INJECTION\",\"location\":\"HEADER\",\"matchedData\":[\"10\",\"AND\",\"1\"]}],\"httpSourceName\":\"-\",\"httpSourceId\":\"-\",\"ruleGroupList\":[],\"rateBasedRuleList\":[],\"nonTerminatingMatchingRules\":[],\"httpRequest\":{\"clientIp\":\"89.160.20.156\",\"country\":\"AU\",\"headers\":[{\"name\":\"Host\",\"value\":\"localhost:1989\"},{\"name\":\"User-Agent\",\"value\":\"curl/7.61.1\"},{\"name\":\"Accept\",\"value\":\"*/*\"},{\"name\":\"x-stm-test\",\"value\":\"10 AND 1=1\"}],\"uri\":\"/foo\",\"args\":\"\",\"httpVersion\":\"HTTP/1.1\",\"httpMethod\":\"GET\",\"requestId\":\"rid\"},\"labels\":[{\"name\":\"value\"}]}\n" + }, + { + "@timestamp": "2023-08-23T16:47:26Z", + "aws.cloudwatch.log_group": "aws-waf-logs-test-firehose", + "aws.cloudwatch.log_stream": "us-east-1_web-acl-name_1", + "aws.firehose.arn": "arn:aws:firehose:us-east-1:123456789:deliverystream/test-waf-logs", + "aws.firehose.request_id": "afa49f89-ad73-4f39-807f-7f4d666b038e", + "aws.firehose.subscription_filters": "[test-waf-logs-to-firehose]", + "aws.kinesis.name": "test-waf-logs", + "aws.kinesis.type": "deliverystream", + "cloud": { + "provider": "aws" + }, + "cloud.account.id": "123456789", + "cloud.provider": "aws", + "cloud.region": "us-east-1", + "data_stream.dataset": "aws.waf", + "data_stream.namespace": "default", + "data_stream.type": "logs", + "ecs": { + "version": "8.0.0" + }, + "event.id": "37728046078123216000395549868459931814660237705210691585", + "message": "{\"timestamp\":1576280412771,\"formatVersion\":1,\"webaclId\":\"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE\",\"terminatingRuleId\":\"STMTest_SQLi_XSS\",\"terminatingRuleType\":\"REGULAR\",\"action\":\"BLOCK\",\"terminatingRuleMatchDetails\":[{\"conditionType\":\"SQL_INJECTION\",\"location\":\"HEADER\",\"matchedData\":[\"10\",\"AND\",\"1\"]}],\"httpSourceName\":\"-\",\"httpSourceId\":\"-\",\"ruleGroupList\":[],\"rateBasedRuleList\":[],\"nonTerminatingMatchingRules\":[],\"httpRequest\":{\"clientIp\":\"89.160.20.156\",\"country\":\"AU\",\"headers\":[{\"name\":\"Host\",\"value\":\"localhost:1989\"},{\"name\":\"User-Agent\",\"value\":\"curl/7.61.1\"},{\"name\":\"Accept\",\"value\":\"*/*\"},{\"name\":\"x-stm-test\",\"value\":\"10 AND 1=1\"}],\"uri\":\"/foo\",\"args\":\"\",\"httpVersion\":\"HTTP/1.1\",\"httpMethod\":\"GET\",\"requestId\":\"rid\"},\"labels\":[{\"name\":\"value\"}]}\n" + } + ] +} \ No newline at end of file diff --git a/packages/awsfirehose/data_stream/logs/elasticsearch/ingest_pipeline/default.yml b/packages/awsfirehose/data_stream/logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..bd196c5bb35 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,13 @@ +--- +description: Pipeline for rerouting logs streams from Amazon Kinesis Data Firehose. +processors: + - set: + field: ecs.version + value: 8.0.0 + - set: + field: cloud.provider + value: aws +on_failure: + - set: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/awsfirehose/data_stream/logs/fields/ecs.yml b/packages/awsfirehose/data_stream/logs/fields/ecs.yml new file mode 100644 index 00000000000..c86ca327c7a --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: data_stream.type +- external: ecs + name: data_stream.dataset +- external: ecs + name: data_stream.namespace +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.id +- external: ecs + name: event.original +- external: ecs + name: message +- external: ecs + name: '@timestamp' diff --git a/packages/awsfirehose/data_stream/logs/fields/fields.yml b/packages/awsfirehose/data_stream/logs/fields/fields.yml new file mode 100644 index 00000000000..be203bcfeb6 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/fields/fields.yml @@ -0,0 +1,44 @@ +- name: aws + type: object + fields: + - name: cloudwatch + type: object + fields: + - name: log_group + type: keyword + description: | + CloudWatch log group name. + - name: log_stream + type: keyword + description: | + CloudWatch log stream name. + - name: firehose + type: object + fields: + - name: arn + type: keyword + description: | + Firehose ARN. + - name: request_id + type: keyword + description: | + Firehose request ID. + - name: subscription_filters + type: keyword + description: | + Firehose request ID. + - name: parameters.* + type: object + description: | + Key-value pairs users set up when creating the Kinesis Data Firehose. These parameters are included in each HTTP call. + - name: kinesis + type: object + fields: + - name: name + type: keyword + description: | + Kinesis name. + - name: type + type: keyword + description: |- + Kinesis type. diff --git a/packages/awsfirehose/data_stream/logs/manifest.yml b/packages/awsfirehose/data_stream/logs/manifest.yml new file mode 100644 index 00000000000..db3cb47aeae --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/manifest.yml @@ -0,0 +1,8 @@ +title: Logs from Amazon Kinesis Data Firehose +type: logs +dataset: awsfirehose.logs +# This integration includes predefined rules that automatically route AWS service logs to the respective integrations. +# Adding these permissions to ensure the agents have permissions to write data to `logs-*-*`. +elasticsearch: + dynamic_dataset: true + dynamic_namespace: true diff --git a/packages/awsfirehose/data_stream/logs/routing_rules.yml b/packages/awsfirehose/data_stream/logs/routing_rules.yml new file mode 100644 index 00000000000..c905a166888 --- /dev/null +++ b/packages/awsfirehose/data_stream/logs/routing_rules.yml @@ -0,0 +1,87 @@ +- source_dataset: awsfirehose.logs + rules: + - target_dataset: aws.firewall_logs + if: ctx.message != null && ctx.message.contains('firewall_name') && ctx.message.contains('availability_zone') && ctx.message.contains('event_timestamp') && ctx.message.contains('event') + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.cloudtrail + if: ctx['aws.cloudwatch.log_stream'] != null && ctx['aws.cloudwatch.log_stream'].contains('CloudTrail') + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.route53_public_logs + if: >- + if (ctx['aws.cloudwatch.log_stream'] == null) { + return false; + } + def split_log_stream_name=ctx['aws.cloudwatch.log_stream'].splitOnToken('/'); + if (split_log_stream_name.length!=2) { + return false; + } + def hosted_zone_id=split_log_stream_name[0]; + def edge_location_id=split_log_stream_name[1]; + if (ctx.message != null && ctx.message.contains(hosted_zone_id) && ctx.message.contains(edge_location_id)){ + return true; + } + return false; + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.route53_resolver_logs + if: >- + ctx.message != null && ctx.message.contains('version') && ctx.message.contains('account_id') && ctx.message.contains('region') && + ctx.message.contains('vpc_id') && ctx.message.contains('query_timestamp') && ctx.message.contains('query_name') + && ctx.message.contains('query_type') && ctx.message.contains('query_class') && ctx.message.contains('rcode') + && ctx.message.contains('answers') && ctx.message.contains('srcaddr') && ctx.message.contains('srcport') + && ctx.message.contains('transport') && ctx.message.contains('srcids') + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.vpcflow + if: >- + if (ctx.message!= null) { + def message_token_count=ctx.message.splitOnToken(" ").length; + if (message_token_count==14) { + return true; + } + } + return false; + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.waf + # Kinesis Data Firehose stream name begins with `aws-waf-logs-` + # CloudWatch log group name begins with `aws-waf-logs-` + # Log fields: + # timestamp formatVersion webaclld terminatingRuleId terminatingRuleType action + # terminatingRuleMatchDetails httpSourceName httpSourceId ruleGroupList rateBasedRuleList + # nonTerminatingMatchingRules httpRequest labels + if: >- + (ctx['aws.kinesis.name'] != null && ctx['aws.kinesis.name'].contains('aws-waf-logs-')) + || (ctx['aws.cloudwatch.log_group'] != null && ctx['aws.cloudwatch.log_group'].contains('aws-waf-logs-')) + || (ctx.message != null && ctx.message.contains('webaclld') && ctx.message.contains('terminatingRule') + && ctx.message.contains('httpSource') && ctx.message.contains('ruleGroupList') && ctx.message.contains('rateBasedRuleList') + && ctx.message.contains('nonTerminatingMatchingRules') && ctx.message.contains('httpRequest') && ctx.message.contains('labels')) + namespace: + - "{{data_stream.namespace}}" + - default + - target_dataset: aws.apigateway_logs + # Supported API Gateway log format by API type + # HTTP: requestId ip requestTime httpMethod routeKey status protocol responseLength + # REST: requestId ip caller user requestTime httpMethod resourcePath status protocol responseLength + # WebSockets: requestId ip caller user requestTime eventType routeKey status connectionId + if: >- + (ctx.message != null && ctx.message.contains('requestId') && ctx.message.contains('ip') + && ctx.message.contains('requestTime') && ctx.message.contains('httpMethod') && ctx.message.contains('routeKey') + && ctx.message.contains('status') && ctx.message.contains('protocol') && ctx.message.contains('responseLength')) + || (ctx.message != null && ctx.message.contains('requestId') && ctx.message.contains('ip') && ctx.message.contains('caller') + && ctx.message.contains('user') && ctx.message.contains('requestTime') && ctx.message.contains('httpMethod') + && ctx.message.contains('resourcePath') && ctx.message.contains('status') && ctx.message.contains('protocol') + && ctx.message.contains('responseLength')) + || (ctx.message != null && ctx.message.contains('requestId') && ctx.message.contains('ip') && ctx.message.contains('caller') + && ctx.message.contains('user') && ctx.message.contains('requestTime') && ctx.message.contains('eventType') + && ctx.message.contains('routeKey') && ctx.message.contains('status') && ctx.message.contains('connectionId')) + namespace: + - "{{data_stream.namespace}}" + - default \ No newline at end of file diff --git a/packages/awsfirehose/docs/README.md b/packages/awsfirehose/docs/README.md new file mode 100644 index 00000000000..655f3c32885 --- /dev/null +++ b/packages/awsfirehose/docs/README.md @@ -0,0 +1,93 @@ +# Amazon Kinesis Data Firehose +Amazon Kinesis Data Firehose integration offers users a way to stream logs from Firehose to Elastic Cloud. +This integration includes predefined rules that automatically route AWS service logs to the respective integrations, which +include field mappings, ingest pipelines, predefined dashboards and ect. Here is a list of log types that are supported +by this integration: + +| AWS service log | Log destination | +|--------------------|---------------------------| +| API Gateway | CloudWatch | +| CloudTrail | CloudWatch | +| Network Firewall | Firehose, CloudWatch, S3 | +| Route53 Public DNS | CloudWatch | +| Route53 Resolver | Firehose, CloudWatch, S3 | +| VPC Flow | Firehose, CloudWatch, S3 | +| WAF | Firehose, CloudWatch | + +## Limitation +It is not possible to configure a delivery stream to send data to Elastic Cloud via PrivateLink (VPC endpoint). +This is a current limitation in Firehose, which we are working with AWS to resolve. + +## Instructions +1. Install the relevant integrations in Kibana + + In order to make the most of your data, install AWS integrations to load index templates, ingest pipelines, and + dashboards into Kibana. In Kibana, navigate to **Management** > **Integrations** in the sidebar. + Find the **AWS** integration by searching or browsing the catalog. + + ![AWS integration](../img/aws.png) + + Navigate to the **Settings** tab and click **Install AWS assets**. Confirm by clicking **Install AWS** in the popup. + + ![Install AWS assets](../img/install-assets.png) + +2. Create a delivery stream in Amazon Kinesis Data Firehose + + Sign into the AWS console and navigate to Amazon Kinesis. Click **Create delivery stream**. + Configure the delivery stream using the following settings: + + ![Amazon Kinesis Data Firehose](../img/aws-firehose.png) + + **Choose source and destination** + + Unless you are streaming data from Kinesis Data Streams, set source to Direct PUT (see Setup guide for more details on data sources). + + Set destination to **Elastic**. + + **Delivery stream name** + + Provide a meaningful name that will allow you to identify this delivery stream later. + + ![Choose Firehose Source and Destination](../img/source-destination.png) + + **Destination settings** + + 1. Set **Elastic endpoint URL** to point to your Elasticsearch cluster running in Elastic Cloud. + This endpoint can be found in the Elastic Cloud console. An example is https://my-deployment-28u274.es.eu-west-1.aws.found.io. + + 2. **API key** should be a Base64 encoded Elastic API key, which can be created in Kibana by following the + instructions under API Keys. If you are using an API key with “Restrict privileges”, be sure to review the Indices + privileges to provide at least "auto_configure" & "write" permissions for the indices you will be using with this + delivery stream. + + 3. We recommend leaving **Content encoding** set to **GZIP** for improved network efficiency. + + 4. **Retry duration** determines how long Firehose continues retrying the request in the event of an error. + A duration of 60-300s should be suitable for most use cases. + + 5. Elastic requires a **Buffer size** of `1MiB` to avoid exceeding the Elasticsearch `http.max_content_length` + setting (typically 100MB) when the buffer is uncompressed. + + 6. The default **Buffer interval** of `60s` is recommended to ensure data freshness in Elastic. + + 7. **Parameters** + + 1. Elastic recommends setting the `es_datastream_name` parameter to `logs-awsfirehose.logs-default` in order to + leverage the routing rules defined in this integration. If this parameter is not specified, data is sent to the + `logs-generic-default` data stream by default. + ![Firehose Destination Settings](../img/destination-settings.png) + + 2. The **include_cw_extracted_fields** parameter is optional and can be set when using a CloudWatch logs subscription + filter as the Firehose data source. When set to true, extracted fields generated by the filter pattern in the + subscription filter will be collected. Setting this parameter can add many fields into each record and may significantly + increase data volume in Elasticsearch. As such, use of this parameter should be carefully considered and used only when + the extracted fields are required for specific filtering and/or aggregation. + + 3. The **include_event_original** field is optional and should only be used for debugging purposes. When set to `true`, each + log record will contain an additional field named `event.original`, which contains the raw (unprocessed) log message. + This parameter will increase the data volume in Elasticsearch and should be used with care. + +3. Send data to the Firehose delivery stream + + Consult the [AWS documentation](https://docs.aws.amazon.com/firehose/latest/dev/basic-write.html) for details on how to + configure a variety of log sources to send data to Firehose delivery streams. diff --git a/packages/awsfirehose/img/aws-firehose.png b/packages/awsfirehose/img/aws-firehose.png new file mode 100644 index 00000000000..b3fb863df1f Binary files /dev/null and b/packages/awsfirehose/img/aws-firehose.png differ diff --git a/packages/awsfirehose/img/aws.png b/packages/awsfirehose/img/aws.png new file mode 100644 index 00000000000..be98056181d Binary files /dev/null and b/packages/awsfirehose/img/aws.png differ diff --git a/packages/awsfirehose/img/destination-settings.png b/packages/awsfirehose/img/destination-settings.png new file mode 100644 index 00000000000..ea933a69da3 Binary files /dev/null and b/packages/awsfirehose/img/destination-settings.png differ diff --git a/packages/awsfirehose/img/install-assets.png b/packages/awsfirehose/img/install-assets.png new file mode 100644 index 00000000000..af67e0a0003 Binary files /dev/null and b/packages/awsfirehose/img/install-assets.png differ diff --git a/packages/awsfirehose/img/logo_firehose.svg b/packages/awsfirehose/img/logo_firehose.svg new file mode 100644 index 00000000000..53739b79bef --- /dev/null +++ b/packages/awsfirehose/img/logo_firehose.svg @@ -0,0 +1,12 @@ + + + Icon-Architecture/16/Arch_Amazon-Kinesis-Data-Firehose_16 + + + + + + + + + \ No newline at end of file diff --git a/packages/awsfirehose/img/source-destination.png b/packages/awsfirehose/img/source-destination.png new file mode 100644 index 00000000000..e52705d91c8 Binary files /dev/null and b/packages/awsfirehose/img/source-destination.png differ diff --git a/packages/awsfirehose/manifest.yml b/packages/awsfirehose/manifest.yml new file mode 100644 index 00000000000..e5a652cb5c1 --- /dev/null +++ b/packages/awsfirehose/manifest.yml @@ -0,0 +1,18 @@ +format_version: 2.9.0 +name: awsfirehose +title: Amazon Kinesis Data Firehose +version: 0.2.1 +description: Stream logs from Amazon Kinesis Data Firehose into Elastic Cloud. +type: integration +categories: + - observability + - aws +conditions: + kibana.version: "^8.10.1" +owner: + github: elastic/obs-cloud-monitoring +icons: + - src: /img/logo_firehose.svg + title: logo aws firehose + size: 64x64 + type: image/svg+xml diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml index 9418e333394..99bb7df0c24 100644 --- a/packages/azure/changelog.yml +++ b/packages/azure/changelog.yml @@ -1,3 +1,38 @@ +- version: "1.5.31" + changes: + - description: Migration of Azure AD Identity Protection dashboard to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7376 +- version: "1.5.30" + changes: + - description: Migration of Azure AD Provisioning Logs dashboard to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7375 +- version: "1.5.29" + changes: + - description: Fix Azure dashboards descriptions and titles. + type: enhancement + link: https://github.com/elastic/integrations/pull/7525 +- version: "1.5.28" + changes: + - description: Migration Alerts Overview dashboard to Lens + type: enhancement + link: https://github.com/elastic/integrations/pull/5954 +- version: "1.5.27" + changes: + - description: Fix in Firewall dashboards + type: bugfix + link: https://github.com/elastic/integrations/pull/6960 +- version: "1.5.26" + changes: + - description: Handle duplicate user_agent.original field in signinlogs logs + type: bugfix + link: https://github.com/elastic/integrations/pull/6867 +- version: "1.5.25" + changes: + - description: Handle duplicate url.path field in application gateway logs + type: bugfix + link: https://github.com/elastic/integrations/pull/6866 - version: "1.5.24" changes: - description: Handle firewall events for DNAT'ed requests with attributes diff --git a/packages/azure/data_stream/application_gateway/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/application_gateway/elasticsearch/ingest_pipeline/default.yml index 4c2380efb89..46f5174345b 100644 --- a/packages/azure/data_stream/application_gateway/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure/data_stream/application_gateway/elasticsearch/ingest_pipeline/default.yml @@ -76,6 +76,13 @@ processors: field: json.properties.requestUri target_field: url.path ignore_missing: true + if: 'ctx.url?.path == null' + description: 'Renames the original `json.properties.requestUri` field to `url.path` to match the ECS field name. The `url.path` field is not touched if the document already has one.' + - remove: + field: json.properties.httpMethod + ignore_missing: true + if: 'ctx.url?.path != null' + description: 'The `json.properties.httpMethod` field is no longer required if the document has a `url.path` field.' - set: field: url.path copy_from: url.original diff --git a/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml index ed2f1d2eee5..d1a21856a02 100644 --- a/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure/data_stream/signinlogs/elasticsearch/ingest_pipeline/default.yml @@ -274,6 +274,13 @@ processors: field: azure.signinlogs.properties.user_agent target_field: user_agent.original ignore_missing: true + if: 'ctx.user_agent?.original == null' + description: 'Renames the original `azure.signinlogs.properties.user_agent` field to `user_agent.original` to match the ECS field name. The `user_agent.original` field is not touched if the document already has one.' + - remove: + field: azure.signinlogs.properties.user_agent + ignore_missing: true + if: 'ctx.user_agent?.original != null' + description: 'The `azure.signinlogs.properties.user_agent` field is no longer required if the document has a `user_agent.original` field.' - user_agent: field: user_agent.original ignore_missing: true diff --git a/packages/azure/kibana/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5.json b/packages/azure/kibana/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5.json index 5eb82f3020a..c14f40b1af3 100644 --- a/packages/azure/kibana/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5.json +++ b/packages/azure/kibana/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5.json @@ -1,481 +1,525 @@ { - "id": "azure-0f559cc0-f0d5-11e9-90ec-112a988266d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2023-03-07T09:38:25.166Z", - "created_at": "2023-03-07T09:38:25.166Z", - "version": "WzExMjc0LDFd", - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"676fd632-a9c1-46ed-829b-ca5b55817379\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"id\":\"676fd632-a9c1-46ed-829b-ca5b55817379\",\"enhancements\":{}}}}" - }, - "description": "This dashboard provides expanded alerts overview for Azure cloud", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "azure.activitylogs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "azure.activitylogs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 4, - "i": "9d1a26e6-2ff0-4d3e-bab3-7bb3c50cd060", - "w": 21, - "x": 0, - "y": 0 + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"676fd632-a9c1-46ed-829b-ca5b55817379\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"id\":\"676fd632-a9c1-46ed-829b-ca5b55817379\",\"enhancements\":{}}}}" }, - "panelIndex": "9d1a26e6-2ff0-4d3e-bab3-7bb3c50cd060", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Navigation Alerts [Logs Azure]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 10, - "markdown": "### Azure Monitoring\n\n[Overview](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [Users](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [**Alerts**](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5) ", - "openLinksInNewTab": false - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { + "description": "This dashboard provides expanded alerts overview for Azure cloud.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "title": "Navigation Alerts" - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "096b4eaa-072e-455f-befa-3076f71be12d", - "w": 27, - "x": 21, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "096b4eaa-072e-455f-befa-3076f71be12d", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Alerts Overview [Logs Azure]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "data_stream.dataset :\"azure.activitylogs\" and azure.activitylogs.event_category : \"Alert\"" - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "azure.activitylogs.result_type: \"Activated\"" - }, - "formatter": "number", - "hide_in_legend": 0, - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "### Azure Monitoring\n\n[Overview](#/dashboard/azure-41e84340-ec20-11e9-90ec-112a988266d5) | [Users](#/dashboard/azure-87095750-f05a-11e9-90ec-112a988266d5) | [**Alerts**](#/dashboard/azure-0f559cc0-f0d5-11e9-90ec-112a988266d5) ", + "openLinksInNewTab": false + }, + "title": "Navigation Alerts [Logs Azure]", + "type": "markdown", + "uiState": {} } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "filter", - "stacked": "none" }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "azure.activitylogs.result_type: \"Resolved\" or azure.activitylogs.result_type: \"Succeeded\"" - }, - "formatter": "number", - "hide_in_legend": 0, - "id": "5a52f170-ec1e-11e9-b6a7-21d19b63822a", - "line_width": 1, - "metrics": [ - { - "id": "5a52f171-ec1e-11e9-b6a7-21d19b63822a", - "type": "count" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "filter", - "stacked": "none" - } - ], - "show_grid": 1, - "show_legend": 0, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Alerts Overview" - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 9, - "i": "162fb43e-fff3-4f50-aa9b-a713418bd651", - "w": 27, - "x": 21, - "y": 15 - }, - "panelIndex": "162fb43e-fff3-4f50-aa9b-a713418bd651", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Alerts Count [Logs Azure]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "dimensions": { - "bucket": { - "accessor": 0, - "format": { - "id": "string", - "params": {} - }, - "type": "vis_dimension" + "gridData": { + "h": 4, + "i": "9d1a26e6-2ff0-4d3e-bab3-7bb3c50cd060", + "w": 21, + "x": 0, + "y": 0 }, - "metrics": [ - { - "accessor": 1, - "format": { - "id": "number", - "params": {} + "panelIndex": "9d1a26e6-2ff0-4d3e-bab3-7bb3c50cd060", + "title": "Navigation Alerts", + "type": "visualization", + "version": "8.6.2" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c0e8cd55-a662-40d4-87f4-a889776f3a75", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c0e8cd55-a662-40d4-87f4-a889776f3a75": { + "columnOrder": [ + "b72d2ce7-da41-406b-9a5a-ff07a74d439a", + "5e01096c-ce58-478d-856a-31852542c710", + "87204ef0-75a9-4d9b-9f9b-7442b1234b2a" + ], + "columns": { + "5e01096c-ce58-478d-856a-31852542c710": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.activitylogs.result_type: \"Activated\"" + }, + "isBucketed": false, + "label": "Activated", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "@timestamp" + }, + "87204ef0-75a9-4d9b-9f9b-7442b1234b2a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.activitylogs.result_type: \"Resolved\" or azure.activitylogs.result_type: \"Succeeded\"" + }, + "isBucketed": false, + "label": "Resolved/Succeeded", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "@timestamp" + }, + "b72d2ce7-da41-406b-9a5a-ff07a74d439a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": " ", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset :\"azure.activitylogs\" and (azure.activitylogs.category : \"Alert\" or azure.activitylogs.event_category: \"Alert\")" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "5e01096c-ce58-478d-856a-31852542c710", + "87204ef0-75a9-4d9b-9f9b-7442b1234b2a" + ], + "layerId": "c0e8cd55-a662-40d4-87f4-a889776f3a75", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "xAccessor": "b72d2ce7-da41-406b-9a5a-ff07a74d439a", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "87204ef0-75a9-4d9b-9f9b-7442b1234b2a" + }, + { + "color": "#d6bf57", + "forAccessor": "5e01096c-ce58-478d-856a-31852542c710" + } + ] + } + ], + "legend": { + "isVisible": false, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "vis_dimension" - } - ] - }, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000, - "type": "range" - } - ], - "invertColors": false, - "labels": { - "show": true + "enhancements": {}, + "hidePanelTitles": false }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" + "gridData": { + "h": 15, + "i": "e5e45365-c81a-4f7f-b58b-8d2d781329a5", + "w": 27, + "x": 21, + "y": 0 }, - "useRanges": false - }, - "type": "metric" + "panelIndex": "e5e45365-c81a-4f7f-b58b-8d2d781329a5", + "title": "Alerts Overview", + "type": "lens", + "version": "8.6.2" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Alerts" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "filters": [ - { - "input": { - "language": "kuery", - "query": "azure.activitylogs.result_type : \"Activated\"" - }, - "label": "Activated" - }, - { - "input": { - "language": "kuery", - "query": "azure.activitylogs.result_type : \"Resolved\"" - }, - "label": "Resolved" - }, - { - "input": { - "language": "kuery", - "query": "azure.activitylogs.result_type : \"Succeeded\"" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-edee18c5-648c-4f00-8293-cd72ff805e62", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "edee18c5-648c-4f00-8293-cd72ff805e62": { + "columnOrder": [ + "5aaf5c65-ba9f-4c98-a049-23758ac0943b", + "12b20199-3021-4ffc-8010-10cd8688ee21", + "03722365-3d88-43ad-bae5-922daf2a7a7d" + ], + "columns": { + "03722365-3d88-43ad-bae5-922daf2a7a7d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "12b20199-3021-4ffc-8010-10cd8688ee21": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resource Group", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "03722365-3d88-43ad-bae5-922daf2a7a7d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.resource.group" + }, + "5aaf5c65-ba9f-4c98-a049-23758ac0943b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Provider", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "03722365-3d88-43ad-bae5-922daf2a7a7d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.resource.provider" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset :\"azure.activitylogs\" and (azure.activitylogs.event_category : \"Alert\" or azure.activitylogs.category : \"Alert\" )" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "heatmap_grid" + }, + "layerId": "edee18c5-648c-4f00-8293-cd72ff805e62", + "layerType": "data", + "legend": { + "position": "right", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "03722365-3d88-43ad-bae5-922daf2a7a7d", + "name": "status", + "params": { + "continuity": "above", + "maxSteps": 5, + "name": "status", + "progression": "fixed", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "percent", + "reverse": false, + "stops": [ + { + "color": "#209280", + "stop": 0 + }, + { + "color": "#54b399", + "stop": 20 + }, + { + "color": "#d6bf57", + "stop": 40 + }, + { + "color": "#e7664c", + "stop": 60 + }, + { + "color": "#cc5642", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "03722365-3d88-43ad-bae5-922daf2a7a7d", + "xAccessor": "5aaf5c65-ba9f-4c98-a049-23758ac0943b", + "yAccessor": "12b20199-3021-4ffc-8010-10cd8688ee21" + } }, - "label": "Succeeded" - } - ] - }, - "schema": "group", - "type": "filters" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset :\"azure.activitylogs\" and azure.activitylogs.event_category : \"Alert\" " - } - } - } - } - }, - "title": "Alerts Count" - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 20, - "i": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8", - "w": 21, - "x": 0, - "y": 4 - }, - "panelIndex": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Alerts Heatmap [Logs Azure]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0": "rgb(247,252,245)" - } - } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Greens", - "colorsNumber": 4, - "colorsRange": [], - "dimensions": { - "x": { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } - }, - "params": {} - }, - "y": [ - { - "accessor": 1, - "aggType": "count", - "format": { - "id": "number" + "title": "Alerts Heatmap [Logs Azure]", + "type": "lens", + "visualizationType": "lnsHeatmap" }, - "params": {} - } - ] - }, - "enableHover": false, - "invertColors": false, - "legendPosition": "right", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ], - "legendSize": "auto" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 20, + "i": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8", + "w": 21, + "x": 0, + "y": 4 + }, + "panelIndex": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8", + "title": "Alerts Heatmap", + "type": "lens", + "version": "8.6.2" }, - "type": "heatmap", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-814d0ae5-ed18-49ad-942d-8cd942a901e9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "814d0ae5-ed18-49ad-942d-8cd942a901e9": { + "columnOrder": [ + "6674f0d1-fc76-4845-80fa-3797c6fcdcbc", + "36d81bee-ff41-4d97-aed5-80a4e06cebd9" + ], + "columns": { + "36d81bee-ff41-4d97-aed5-80a4e06cebd9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Alerts", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "6674f0d1-fc76-4845-80fa-3797c6fcdcbc": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "azure.activitylogs.result_type : \"Activated\"" + }, + "label": "Activated" + }, + { + "input": { + "language": "kuery", + "query": "azure.activitylogs.result_type : \"Resolved\"" + }, + "label": "Resolved" + }, + { + "input": { + "language": "kuery", + "query": "azure.activitylogs.result_type : \"Succeeded\"" + }, + "label": "Succeeded" + } + ] + }, + "scale": "ordinal" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset :\"azure.activitylogs\" and (azure.activitylogs.event_category : \"Alert\" or azure.activitylogs.category : \"Alert\")" + }, + "visualization": { + "breakdownByAccessor": "6674f0d1-fc76-4845-80fa-3797c6fcdcbc", + "layerId": "814d0ae5-ed18-49ad-942d-8cd942a901e9", + "layerType": "data", + "metricAccessor": "36d81bee-ff41-4d97-aed5-80a4e06cebd9" + } + }, + "title": "Alerts Count [Logs Azure]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Provider", - "field": "azure.resource.provider", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 9, + "i": "162fb43e-fff3-4f50-aa9b-a713418bd651", + "w": 27, + "x": 21, + "y": 15 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Resource Group", - "field": "azure.resource.group", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset :\"azure.activitylogs\" and azure.activitylogs.event_category : \"Alert\" " - } - } + "panelIndex": "162fb43e-fff3-4f50-aa9b-a713418bd651", + "title": "Alerts Count", + "type": "lens", + "version": "8.6.2" } - } - }, - "title": "Alerts Heatmap" - } - ], - "timeRestore": false, - "title": "[Logs Azure] Alerts Overview", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "162fb43e-fff3-4f50-aa9b-a713418bd651:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + ], + "timeRestore": false, + "title": "[Logs Azure] Alerts Overview", + "version": 1 }, - { - "type": "index-pattern", - "name": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "coreMigrationVersion": "8.6.2", + "created_at": "2023-06-08T07:33:56.370Z", + "id": "azure-0f559cc0-f0d5-11e9-90ec-112a988266d5", + "migrationVersion": { + "dashboard": "8.6.0" }, - { - "name": "controlGroup_676fd632-a9c1-46ed-829b-ca5b55817379:optionsListDataView", - "type": "index-pattern", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.6.0" - }, - "coreMigrationVersion": "8.6.1" + "references": [ + { + "id": "logs-*", + "name": "e5e45365-c81a-4f7f-b58b-8d2d781329a5:indexpattern-datasource-layer-c0e8cd55-a662-40d4-87f4-a889776f3a75", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "36fb5c08-80d9-4a1c-8fde-9c063381fdd8:indexpattern-datasource-layer-edee18c5-648c-4f00-8293-cd72ff805e62", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "162fb43e-fff3-4f50-aa9b-a713418bd651:indexpattern-datasource-layer-814d0ae5-ed18-49ad-942d-8cd942a901e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_676fd632-a9c1-46ed-829b-ca5b55817379:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" } \ No newline at end of file diff --git a/packages/azure/kibana/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43.json b/packages/azure/kibana/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43.json index f04963239b9..1d196ef4e3a 100644 --- a/packages/azure/kibana/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43.json +++ b/packages/azure/kibana/dashboard/azure-1adf52d0-f50f-11eb-a831-732d3e9bbd43.json @@ -6,7 +6,7 @@ "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", "panelsJSON": "{\"5cbc2c45-1213-4bb9-ab65-8dfc0cfbad8a\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"id\":\"5cbc2c45-1213-4bb9-ab65-8dfc0cfbad8a\",\"enhancements\":{}}},\"35a7fa77-1459-438c-8cb7-28770a0d7374\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.springcloudlogs.category\",\"title\":\"Spring Cloud Logs Type\",\"id\":\"35a7fa77-1459-438c-8cb7-28770a0d7374\",\"enhancements\":{}}}}" }, - "description": "[Logs Azure] Azure Spring cloud Logs System Logs", + "description": "Dashboard providing statistics about System Logs ingested from Azure Spring Cloud.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], diff --git a/packages/azure/kibana/dashboard/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646.json b/packages/azure/kibana/dashboard/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646.json index 6b1fa405615..2d96f804c6b 100644 --- a/packages/azure/kibana/dashboard/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646.json +++ b/packages/azure/kibana/dashboard/azure-1e5c9b50-f24a-11ec-a5a8-bf965bcd5646.json @@ -12,7 +12,7 @@ "chainingSystem": "HIERARCHICAL", "controlStyle": "oneLine", "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Firewall \",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" + "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Firewall \",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" }, "description": "Dashboard providing statistics about alerts ingested from the Azure Firewall Application Rule Log events.", "hits": 0, diff --git a/packages/azure/kibana/dashboard/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646.json b/packages/azure/kibana/dashboard/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646.json index 94d5839535f..961af9dc1bd 100644 --- a/packages/azure/kibana/dashboard/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646.json +++ b/packages/azure/kibana/dashboard/azure-280493a0-f1a1-11ec-a5a8-bf965bcd5646.json @@ -14,7 +14,7 @@ "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", "panelsJSON": "{\"c0dc0cdb-57cb-4bee-9a88-2b680fa911da\":{\"order\":0,\"width\":\"medium\",\"grow\":false,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.account.id\",\"title\":\"Subscription ID\",\"id\":\"c0dc0cdb-57cb-4bee-9a88-2b680fa911da\",\"enhancements\":{}}},\"fb42737f-72dc-4ace-89ac-746160498381\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Firewall\",\"id\":\"fb42737f-72dc-4ace-89ac-746160498381\",\"enhancements\":{}}}}" }, - "description": "Dashboard providing an overall view of the AWS Network Firewall integration.", + "description": "Dashboard providing an overall view of the Azure Firewall integration.", "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { diff --git a/packages/azure/kibana/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762.json b/packages/azure/kibana/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762.json index ae220e9aeb2..e01882a2e8c 100644 --- a/packages/azure/kibana/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762.json +++ b/packages/azure/kibana/dashboard/azure-32aedb00-f524-11eb-b9f3-73fa29f35762.json @@ -6,7 +6,7 @@ "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", "panelsJSON": "{\"92623f66-de82-45c4-b8ef-63131d89c01e\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"id\":\"92623f66-de82-45c4-b8ef-63131d89c01e\",\"enhancements\":{}}},\"bce239d6-6bc4-4bcf-8faa-2024ba2ed657\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.springcloudlogs.category\",\"title\":\"Spring Cloud Logs Type\",\"id\":\"bce239d6-6bc4-4bcf-8faa-2024ba2ed657\",\"enhancements\":{}}}}" }, - "description": "", + "description": "Dashboard providing statistics about Application Console Logs ingested from Azure Spring Cloud.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -1204,7 +1204,7 @@ } ], "timeRestore": false, - "title": "[Logs Azure] Azure Spring Cloud Logs Application Cloud Logs", + "title": "[Logs Azure] Azure Spring Cloud Logs Application Console Logs", "version": 1 }, "coreMigrationVersion": "8.6.0", diff --git a/packages/azure/kibana/dashboard/azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71.json b/packages/azure/kibana/dashboard/azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71.json index 2e203bb0eaa..0fd1066d8cc 100644 --- a/packages/azure/kibana/dashboard/azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71.json +++ b/packages/azure/kibana/dashboard/azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71.json @@ -1,760 +1,787 @@ { - "id": "azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2023-03-07T09:38:25.166Z", - "created_at": "2023-03-07T09:38:25.166Z", - "version": "WzExMjc5LDFd", - "attributes": { - - "description": "Provide an overview and statistics of the provisioning activities on your enterprise applications.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "azure.provisioning" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "azure.provisioning" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 12, - "i": "3e85d806-64f3-4fef-9094-95820e962a59", - "w": 8, - "x": 0, - "y": 0 - }, - "panelIndex": "3e85d806-64f3-4fef-9094-95820e962a59", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "2ac1988b-9f69-439c-8898-0a385bb56434": { - "columnOrder": [ - "bb6d8913-2437-461c-a5cb-95f745f2e061", - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" - ], - "columns": { - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" + "attributes": { + "description": "Provide an overview and statistics of the Azure AD Provisioning activities on your enterprise applications.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" }, - "bb6d8913-2437-461c-a5cb-95f745f2e061": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "System Name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "37aa3be8-a77c-4241-92a7-4d1b58bc0d47", - "type": "column" + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "azure.provisioning" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "azure.provisioning.properties.source_system.name" + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "azure.provisioning" + } } - }, - "incompleteColumns": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.provisioning.category : \"ProvisioningLogs\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "2ac1988b-9f69-439c-8898-0a385bb56434", - "layerType": "data", - "legendDisplay": "default", - "nestedLegend": false, - "numberDisplay": "percent", - "legendSize": "auto", - "primaryGroups": [ - "bb6d8913-2437-461c-a5cb-95f745f2e061" - ], - "metrics": [ - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" - ] - } ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "query": { + "language": "kuery", + "query": "" + } + } }, - "title": "Source Systems" - }, - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 12, - "i": "2f5e0c64-5e96-420c-bc64-afacc08e6170", - "w": 40, - "x": 8, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "2f5e0c64-5e96-420c-bc64-afacc08e6170", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-1f69b72b-c265-4fe1-b20d-88a15cff56f9", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "1f69b72b-c265-4fe1-b20d-88a15cff56f9": { - "columnOrder": [ - "a586c6fb-aa02-42c6-a12b-8a283461a055", - "284e3e1d-c5d0-4e97-ac45-ab7348467727", - "e8e6a775-ed41-4215-9037-a7ee9e4b2b95" - ], - "columns": { - "284e3e1d-c5d0-4e97-ac45-ab7348467727": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Activity Date", - "operationType": "date_histogram", - "params": { - "interval": "auto", - "includeEmptyRows": true - }, - "scale": "interval", - "sourceField": "azure.provisioning.properties.activity_datetime" - }, - "a586c6fb-aa02-42c6-a12b-8a283461a055": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Status", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "e8e6a775-ed41-4215-9037-a7ee9e4b2b95", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "2ac1988b-9f69-439c-8898-0a385bb56434": { + "columnOrder": [ + "bb6d8913-2437-461c-a5cb-95f745f2e061", + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" + ], + "columns": { + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "bb6d8913-2437-461c-a5cb-95f745f2e061": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "System Name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "37aa3be8-a77c-4241-92a7-4d1b58bc0d47", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.source_system.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.provisioning.category : \"ProvisioningLogs\" " }, - "orderDirection": "desc", - "otherBucket": true, - "size": 3 - }, - "scale": "ordinal", - "sourceField": "azure.provisioning.properties.provisioning_status_info.status" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2ac1988b-9f69-439c-8898-0a385bb56434", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "bb6d8913-2437-461c-a5cb-95f745f2e061" + ] + } + ], + "shape": "donut" + } }, - "e8e6a775-ed41-4215-9037-a7ee9e4b2b95": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.provisioning.category : \"ProvisioningLogs\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "e8e6a775-ed41-4215-9037-a7ee9e4b2b95" - ], - "layerId": "1f69b72b-c265-4fe1-b20d-88a15cff56f9", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "a586c6fb-aa02-42c6-a12b-8a283461a055", - "xAccessor": "284e3e1d-c5d0-4e97-ac45-ab7348467727" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "legendSize": "auto" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 12, + "i": "3e85d806-64f3-4fef-9094-95820e962a59", + "w": 8, + "x": 0, + "y": 0 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "3e85d806-64f3-4fef-9094-95820e962a59", + "title": "Source Systems", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" - }, - "title": "Provisioning Timeline" - }, - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 12, - "i": "bbb69b3c-5709-44bf-9fb2-282185863941", - "w": 8, - "x": 0, - "y": 12 - }, - "panelIndex": "bbb69b3c-5709-44bf-9fb2-282185863941", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "2ac1988b-9f69-439c-8898-0a385bb56434": { - "columnOrder": [ - "bb6d8913-2437-461c-a5cb-95f745f2e061", - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" - ], - "columns": { - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - }, - "bb6d8913-2437-461c-a5cb-95f745f2e061": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "System Name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "37aa3be8-a77c-4241-92a7-4d1b58bc0d47", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "azure.provisioning.properties.target_system.name" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.provisioning.category : \"ProvisioningLogs\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "2ac1988b-9f69-439c-8898-0a385bb56434", - "layerType": "data", - "legendDisplay": "default", - "nestedLegend": false, - "numberDisplay": "percent", - "legendSize": "auto", - "primaryGroups": [ - "bb6d8913-2437-461c-a5cb-95f745f2e061" - ], - "metrics": [ - "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" - }, - "title": "Target Systems" - }, - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 12, - "i": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8", - "w": 6, - "x": 8, - "y": 12 - }, - "panelIndex": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-294d1395-9af2-4496-a6a1-0092fe28f2c1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "294d1395-9af2-4496-a6a1-0092fe28f2c1": { - "columnOrder": [ - "c3972110-af8a-4610-9c78-356de76c5b42" - ], - "columns": { - "c3972110-af8a-4610-9c78-356de76c5b42": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Activities", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.provisioning.category : \"ProvisioningLogs\" and azure.provisioning.operation_name : \"Provisioning activity\" " - }, - "visualization": { - "accessor": "c3972110-af8a-4610-9c78-356de76c5b42", - "layerId": "294d1395-9af2-4496-a6a1-0092fe28f2c1", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom", - "size": "xl" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" - }, - "title": "Provisioning Activities" - }, - { - "version": "8.6.0", - "type": "visualization", - "gridData": { - "h": 12, - "i": "357e6699-3227-4674-a833-84c6487dc22e", - "w": 34, - "x": 14, - "y": 12 - }, - "panelIndex": "357e6699-3227-4674-a833-84c6487dc22e", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Date", - "field": "azure.provisioning.properties.activity_datetime", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Name", - "field": "azure.provisioning.properties.source_identity.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 3 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Type", - "field": "azure.provisioning.properties.source_identity.identity_type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Action", - "field": "azure.provisioning.properties.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Source", - "field": "azure.provisioning.properties.source_system.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Target", - "field": "azure.provisioning.properties.target_system.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1f69b72b-c265-4fe1-b20d-88a15cff56f9", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "1f69b72b-c265-4fe1-b20d-88a15cff56f9": { + "columnOrder": [ + "a586c6fb-aa02-42c6-a12b-8a283461a055", + "284e3e1d-c5d0-4e97-ac45-ab7348467727", + "e8e6a775-ed41-4215-9037-a7ee9e4b2b95" + ], + "columns": { + "284e3e1d-c5d0-4e97-ac45-ab7348467727": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Activity Date", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "azure.provisioning.properties.activity_datetime" + }, + "a586c6fb-aa02-42c6-a12b-8a283461a055": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "e8e6a775-ed41-4215-9037-a7ee9e4b2b95", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.provisioning_status_info.status" + }, + "e8e6a775-ed41-4215-9037-a7ee9e4b2b95": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.provisioning.category : \"ProvisioningLogs\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e8e6a775-ed41-4215-9037-a7ee9e4b2b95" + ], + "layerId": "1f69b72b-c265-4fe1-b20d-88a15cff56f9", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "a586c6fb-aa02-42c6-a12b-8a283461a055", + "xAccessor": "284e3e1d-c5d0-4e97-ac45-ab7348467727" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "7", - "params": { - "customLabel": "Status", - "field": "azure.provisioning.properties.provisioning_status_info.status", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + "gridData": { + "h": 12, + "i": "2f5e0c64-5e96-420c-bc64-afacc08e6170", + "w": 40, + "x": 8, + "y": 0 }, - { - "enabled": false, - "id": "8", - "params": { - "customLabel": "Date", - "field": "azure.provisioning.properties.activity_datetime", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - } - ], - "savedSearchId": "azure-a3664560-32ed-11ed-8fa6-3121b5e93ca0", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "azure.provisioning.category : \"ProvisioningLogs\" " - } - } + "panelIndex": "2f5e0c64-5e96-420c-bc64-afacc08e6170", + "title": "Provisioning Timeline", + "type": "lens", + "version": "8.6.0" }, - "description": "", - "id": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": {} - }, - "table": null, - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 1, - "width": 121.42857142857142 - }, - { - "colIndex": 2, - "width": 123.0952380952381 + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "2ac1988b-9f69-439c-8898-0a385bb56434": { + "columnOrder": [ + "bb6d8913-2437-461c-a5cb-95f745f2e061", + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" + ], + "columns": { + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "bb6d8913-2437-461c-a5cb-95f745f2e061": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "System Name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "37aa3be8-a77c-4241-92a7-4d1b58bc0d47", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.target_system.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.provisioning.category : \"ProvisioningLogs\" " + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2ac1988b-9f69-439c-8898-0a385bb56434", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "37aa3be8-a77c-4241-92a7-4d1b58bc0d47" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "bb6d8913-2437-461c-a5cb-95f745f2e061" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "colIndex": 3, - "width": 256.8952380952381 + "gridData": { + "h": 12, + "i": "bbb69b3c-5709-44bf-9fb2-282185863941", + "w": 8, + "x": 0, + "y": 12 }, - { - "colIndex": 4, - "width": 213.89523809523808 + "panelIndex": "bbb69b3c-5709-44bf-9fb2-282185863941", + "title": "Target Systems", + "type": "lens", + "version": "8.6.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-294d1395-9af2-4496-a6a1-0092fe28f2c1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "294d1395-9af2-4496-a6a1-0092fe28f2c1": { + "columnOrder": [ + "c3972110-af8a-4610-9c78-356de76c5b42" + ], + "columns": { + "c3972110-af8a-4610-9c78-356de76c5b42": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Activities", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "azure.provisioning.category : \"ProvisioningLogs\" and azure.provisioning.operation_name : \"Provisioning activity\" " + }, + "visualization": { + "layerId": "294d1395-9af2-4496-a6a1-0092fe28f2c1", + "layerType": "data", + "metricAccessor": "c3972110-af8a-4610-9c78-356de76c5b42" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "colIndex": 5, - "width": 107.2285714285714 + "gridData": { + "h": 12, + "i": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8", + "w": 6, + "x": 8, + "y": 12 }, - { - "colIndex": 0, - "width": 179.22857142857146 + "panelIndex": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8", + "title": "Provisioning Activities", + "type": "lens", + "version": "8.6.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8ba5f9b8-92e5-4fce-ad9a-8d588ff49d8a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8ba5f9b8-92e5-4fce-ad9a-8d588ff49d8a": { + "columnOrder": [ + "4f1630a4-71ec-4bd0-b539-3ab147c30327", + "61e95905-b4ca-4627-8a67-0f8a2fe90afc", + "e8fad825-d394-49b5-b109-c231cedbb231", + "5bb5c164-10f0-4b24-b2d5-eef7d9620559", + "c3d5651d-662b-408d-a06e-8cf0f5b7b341", + "6c44f32b-481b-4940-a6e9-d0fd17408d86", + "128b662b-436d-49c7-9823-a5b500e98311" + ], + "columns": { + "128b662b-436d-49c7-9823-a5b500e98311": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "azure.provisioning.properties.activity_datetime: *" + }, + "isBucketed": false, + "label": "Date", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "azure.provisioning.properties.activity_datetime" + }, + "4f1630a4-71ec-4bd0-b539-3ab147c30327": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.source_identity.name" + }, + "5bb5c164-10f0-4b24-b2d5-eef7d9620559": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.source_system.name" + }, + "61e95905-b4ca-4627-8a67-0f8a2fe90afc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.source_identity.identity_type" + }, + "6c44f32b-481b-4940-a6e9-d0fd17408d86": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.provisioning_status_info.status" + }, + "c3d5651d-662b-408d-a06e-8cf0f5b7b341": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Target", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.target_system.name" + }, + "e8fad825-d394-49b5-b109-c231cedbb231": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.provisioning.properties.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "azure.provisioning.category : \"ProvisioningLogs\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "128b662b-436d-49c7-9823-a5b500e98311" + }, + { + "alignment": "left", + "columnId": "4f1630a4-71ec-4bd0-b539-3ab147c30327" + }, + { + "alignment": "left", + "columnId": "61e95905-b4ca-4627-8a67-0f8a2fe90afc" + }, + { + "alignment": "left", + "columnId": "e8fad825-d394-49b5-b109-c231cedbb231" + }, + { + "alignment": "left", + "columnId": "5bb5c164-10f0-4b24-b2d5-eef7d9620559" + }, + { + "alignment": "left", + "columnId": "c3d5651d-662b-408d-a06e-8cf0f5b7b341" + }, + { + "alignment": "left", + "columnId": "6c44f32b-481b-4940-a6e9-d0fd17408d86" + } + ], + "headerRowHeight": "single", + "layerId": "8ba5f9b8-92e5-4fce-ad9a-8d588ff49d8a", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "colIndex": 6, - "width": 295.61428571428564 + "gridData": { + "h": 12, + "i": "357e6699-3227-4674-a833-84c6487dc22e", + "w": 34, + "x": 14, + "y": 12 }, - { - "colIndex": 7, - "width": 89 - } - ] + "panelIndex": "357e6699-3227-4674-a833-84c6487dc22e", + "title": "Last Activity", + "type": "lens", + "version": "8.6.0" } - }, - "type": "visualization" - }, - "title": "Last Activity" - } - ], - "timeRestore": false, - "title": "[Logs Azure] Azure AD Provisioning Logs", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3e85d806-64f3-4fef-9094-95820e962a59:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3e85d806-64f3-4fef-9094-95820e962a59:indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "2f5e0c64-5e96-420c-bc64-afacc08e6170:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "2f5e0c64-5e96-420c-bc64-afacc08e6170:indexpattern-datasource-layer-1f69b72b-c265-4fe1-b20d-88a15cff56f9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bbb69b3c-5709-44bf-9fb2-282185863941:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bbb69b3c-5709-44bf-9fb2-282185863941:indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" + ], + "timeRestore": false, + "title": "[Logs Azure] Azure AD Provisioning Logs", + "version": 1 }, - { - "id": "logs-*", - "name": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8:indexpattern-datasource-layer-294d1395-9af2-4496-a6a1-0092fe28f2c1", - "type": "index-pattern" + "coreMigrationVersion": "8.6.0", + "created_at": "2023-08-07T12:48:32.302Z", + "id": "azure-3cdf69c0-32d9-11ed-a2e6-916b60bbea71", + "migrationVersion": { + "dashboard": "8.6.0" }, - { - "id": "azure-a3664560-32ed-11ed-8fa6-3121b5e93ca0", - "name": "357e6699-3227-4674-a833-84c6487dc22e:search_0", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "8.6.0" - }, - "coreMigrationVersion": "8.6.1" + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e85d806-64f3-4fef-9094-95820e962a59:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e85d806-64f3-4fef-9094-95820e962a59:indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f5e0c64-5e96-420c-bc64-afacc08e6170:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f5e0c64-5e96-420c-bc64-afacc08e6170:indexpattern-datasource-layer-1f69b72b-c265-4fe1-b20d-88a15cff56f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bbb69b3c-5709-44bf-9fb2-282185863941:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bbb69b3c-5709-44bf-9fb2-282185863941:indexpattern-datasource-layer-2ac1988b-9f69-439c-8898-0a385bb56434", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "30ec913d-7cc6-46e6-aa9a-8fab0c3102e8:indexpattern-datasource-layer-294d1395-9af2-4496-a6a1-0092fe28f2c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "357e6699-3227-4674-a833-84c6487dc22e:indexpattern-datasource-layer-8ba5f9b8-92e5-4fce-ad9a-8d588ff49d8a", + "type": "index-pattern" + } + ], + "type": "dashboard" } \ No newline at end of file diff --git a/packages/azure/kibana/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43.json b/packages/azure/kibana/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43.json index 659f079ea3e..ed07a228e64 100644 --- a/packages/azure/kibana/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43.json +++ b/packages/azure/kibana/dashboard/azure-5ad41d90-f50e-11eb-a831-732d3e9bbd43.json @@ -6,7 +6,7 @@ "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", "panelsJSON": "{\"a71b2a03-663d-4897-a3c2-4a363a5cd13c\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"id\":\"a71b2a03-663d-4897-a3c2-4a363a5cd13c\",\"enhancements\":{}}},\"19286679-ff18-4cb1-b048-e32dd60c3ff9\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.springcloudlogs.category\",\"title\":\"Spring Cloud Logs Type\",\"id\":\"19286679-ff18-4cb1-b048-e32dd60c3ff9\",\"enhancements\":{}}}}" }, - "description": "Logs Azure] Azure Spring Cloud logs Overview", + "description": "Dashboard providing an overall view of the Azure Spring Cloud logs integration.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -997,7 +997,7 @@ } ], "timeRestore": false, - "title": "[Logs Azure] Azure Spring Cloud logs Overview", + "title": "[Logs Azure] Azure Spring Cloud Logs Overview", "version": 1 }, "coreMigrationVersion": "8.6.0", diff --git a/packages/azure/kibana/dashboard/azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71.json b/packages/azure/kibana/dashboard/azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71.json index 32b52c6b3f6..a9b748cedc3 100644 --- a/packages/azure/kibana/dashboard/azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71.json +++ b/packages/azure/kibana/dashboard/azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71.json @@ -1,748 +1,809 @@ { - "id": "azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2023-03-07T09:38:25.166Z", - "created_at": "2023-03-07T09:38:25.166Z", - "version": "WzExMjgyLDFd", - "attributes": { - - "description": "Provide an overview and statistics of the provisioning activities on your enterprise applications.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "azure.identityprotection" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "azure.identityprotection" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 10, - "i": "0705b471-583f-4593-916e-46b213966691", - "w": 8, - "x": 0, - "y": 0 - }, - "panelIndex": "0705b471-583f-4593-916e-46b213966691", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "2b0a18e6-25a6-40ef-ade8-5dddbd897856": { - "columnOrder": [ - "a1c2991d-9586-4c81-893a-e29584070568", - "bd75d029-b44e-4c22-b06e-df0e4da1e694" - ], - "columns": { - "a1c2991d-9586-4c81-893a-e29584070568": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Source", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "bd75d029-b44e-4c22-b06e-df0e4da1e694", - "type": "column" + "attributes": { + "description": "Provide an overview and statistics of the Azure AD Identity Protection activities on your enterprise applications.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "azure.identity_protection" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "azure.identityprotection.properties.source" + "type": "phrase" }, - "bd75d029-b44e-4c22-b06e-df0e4da1e694": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" + "query": { + "match_phrase": { + "data_stream.dataset": "azure.identity_protection" + } } - }, - "incompleteColumns": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.identityprotection.category : \"UserRiskEvents\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "layerType": "data", - "legendDisplay": "default", - "nestedLegend": false, - "numberDisplay": "percent", - "legendSize": "auto", - "primaryGroups": [ - "a1c2991d-9586-4c81-893a-e29584070568" - ], - "metrics": [ - "bd75d029-b44e-4c22-b06e-df0e4da1e694" - ] - } ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" - }, - "title": "Detection Sources" - }, - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 10, - "i": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40", - "w": 8, - "x": 8, - "y": 0 - }, - "panelIndex": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "2b0a18e6-25a6-40ef-ade8-5dddbd897856": { - "columnOrder": [ - "fab280b9-af2c-4256-a89f-19371827be79", - "bd75d029-b44e-4c22-b06e-df0e4da1e694" - ], - "columns": { - "bd75d029-b44e-4c22-b06e-df0e4da1e694": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - }, - "fab280b9-af2c-4256-a89f-19371827be79": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Detected Risk Type", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "bd75d029-b44e-4c22-b06e-df0e4da1e694", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "azure.identityprotection.properties.risk_event_type" - } - }, - "incompleteColumns": {} - } - } + "query": { + "language": "kuery", + "query": "" } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.identityprotection.category : \"UserRiskEvents\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "layerType": "data", - "legendDisplay": "default", - "nestedLegend": false, - "numberDisplay": "percent", - "legendSize": "auto", - "primaryGroups": [ - "fab280b9-af2c-4256-a89f-19371827be79" - ], - "metrics": [ - "bd75d029-b44e-4c22-b06e-df0e4da1e694" - ] - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + } }, - "title": "Detected Risk Type" - }, - { - "version": "8.6.0", - "type": "lens", - "gridData": { - "h": 10, - "i": "854eeccf-1660-4c42-b5c9-23fd59f8546e", - "w": 32, - "x": 16, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "854eeccf-1660-4c42-b5c9-23fd59f8546e", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-88e4665c-0d7e-4529-91b3-d4dd23b4c842", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "formBased": { - "layers": { - "88e4665c-0d7e-4529-91b3-d4dd23b4c842": { - "columnOrder": [ - "3756bebc-5376-45e4-a3b0-5d7d8aed12fb", - "526f2da3-311e-491a-b0d2-46122d1582ee", - "545a5a92-574f-445c-8fc8-c3414408702b" - ], - "columns": { - "3756bebc-5376-45e4-a3b0-5d7d8aed12fb": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Risk Type Event", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "545a5a92-574f-445c-8fc8-c3414408702b", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "azure.identityprotection.properties.risk_event_type" - }, - "526f2da3-311e-491a-b0d2-46122d1582ee": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Detected Date", - "operationType": "date_histogram", - "params": { - "interval": "auto", - "includeEmptyRows": true - }, - "scale": "interval", - "sourceField": "azure.identityprotection.properties.detected_datetime" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "2b0a18e6-25a6-40ef-ade8-5dddbd897856": { + "columnOrder": [ + "a1c2991d-9586-4c81-893a-e29584070568", + "bd75d029-b44e-4c22-b06e-df0e4da1e694" + ], + "columns": { + "a1c2991d-9586-4c81-893a-e29584070568": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "bd75d029-b44e-4c22-b06e-df0e4da1e694", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.source" + }, + "bd75d029-b44e-4c22-b06e-df0e4da1e694": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.identityprotection.category : \"UserRiskEvents\" " + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "bd75d029-b44e-4c22-b06e-df0e4da1e694" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "a1c2991d-9586-4c81-893a-e29584070568" + ] + } + ], + "shape": "donut" + } }, - "545a5a92-574f-445c-8fc8-c3414408702b": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "azure.identityprotection.category : \"UserRiskEvents\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 10, + "i": "0705b471-583f-4593-916e-46b213966691", + "w": 8, + "x": 0, + "y": 0 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "0705b471-583f-4593-916e-46b213966691", + "title": "Detection Sources", + "type": "lens", + "version": "8.6.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "2b0a18e6-25a6-40ef-ade8-5dddbd897856": { + "columnOrder": [ + "fab280b9-af2c-4256-a89f-19371827be79", + "bd75d029-b44e-4c22-b06e-df0e4da1e694" + ], + "columns": { + "bd75d029-b44e-4c22-b06e-df0e4da1e694": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "fab280b9-af2c-4256-a89f-19371827be79": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Detected Risk Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "bd75d029-b44e-4c22-b06e-df0e4da1e694", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.risk_event_type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.identityprotection.category : \"UserRiskEvents\" " + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "bd75d029-b44e-4c22-b06e-df0e4da1e694" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "fab280b9-af2c-4256-a89f-19371827be79" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "545a5a92-574f-445c-8fc8-c3414408702b" - ], - "layerId": "88e4665c-0d7e-4529-91b3-d4dd23b4c842", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "3756bebc-5376-45e4-a3b0-5d7d8aed12fb", - "xAccessor": "526f2da3-311e-491a-b0d2-46122d1582ee" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "legendSize": "auto" + "gridData": { + "h": 10, + "i": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40", + "w": 8, + "x": 8, + "y": 0 }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40", + "title": "Detected Risk Type", + "type": "lens", + "version": "8.6.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-88e4665c-0d7e-4529-91b3-d4dd23b4c842", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "88e4665c-0d7e-4529-91b3-d4dd23b4c842": { + "columnOrder": [ + "3756bebc-5376-45e4-a3b0-5d7d8aed12fb", + "526f2da3-311e-491a-b0d2-46122d1582ee", + "545a5a92-574f-445c-8fc8-c3414408702b" + ], + "columns": { + "3756bebc-5376-45e4-a3b0-5d7d8aed12fb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Risk Type Event", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "545a5a92-574f-445c-8fc8-c3414408702b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.risk_event_type" + }, + "526f2da3-311e-491a-b0d2-46122d1582ee": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Detected Date", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "azure.identityprotection.properties.detected_datetime" + }, + "545a5a92-574f-445c-8fc8-c3414408702b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.identityprotection.category : \"UserRiskEvents\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "545a5a92-574f-445c-8fc8-c3414408702b" + ], + "layerId": "88e4665c-0d7e-4529-91b3-d4dd23b4c842", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "3756bebc-5376-45e4-a3b0-5d7d8aed12fb", + "xAccessor": "526f2da3-311e-491a-b0d2-46122d1582ee" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 10, + "i": "854eeccf-1660-4c42-b5c9-23fd59f8546e", + "w": 32, + "x": 16, + "y": 0 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "854eeccf-1660-4c42-b5c9-23fd59f8546e", + "title": "Detection Timeline", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" - }, - "title": "Detection Timeline" - }, - { - "version": "8.6.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "48157948-c755-4eee-9f28-aa5846bcc8c9", - "w": 16, - "x": 0, - "y": 10 - }, - "panelIndex": "48157948-c755-4eee-9f28-aa5846bcc8c9", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Risk State", - "field": "azure.identityprotection.properties.risk_state", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Name", - "field": "azure.identityprotection.properties.user_display_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ca9b2f0a-f382-4c5e-928e-f5b929162361", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ca9b2f0a-f382-4c5e-928e-f5b929162361": { + "columnOrder": [ + "d2a805b1-61ea-4fac-a13a-763d239d3517", + "ac8788e5-8a4c-4493-982a-9143a6b6bbab" + ], + "columns": { + "ac8788e5-8a4c-4493-982a-9143a6b6bbab": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "azure.identityprotection.properties.risk_state: *" + }, + "isBucketed": false, + "label": "Risk State", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.risk_state" + }, + "d2a805b1-61ea-4fac-a13a-763d239d3517": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.user_display_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "azure.identityprotection.category : \"RiskyUsers\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ac8788e5-8a4c-4493-982a-9143a6b6bbab" + }, + { + "alignment": "left", + "columnId": "d2a805b1-61ea-4fac-a13a-763d239d3517" + } + ], + "headerRowHeight": "single", + "layerId": "ca9b2f0a-f382-4c5e-928e-f5b929162361", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": false, - "id": "4", - "params": { - "customLabel": "Level", - "field": "azure.identityprotection.properties.risk_level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + "gridData": { + "h": 15, + "i": "48157948-c755-4eee-9f28-aa5846bcc8c9", + "w": 16, + "x": 0, + "y": 10 }, - { - "enabled": false, - "id": "5", - "params": { - "customLabel": "State", - "field": "azure.identityprotection.properties.risk_state", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - } - ], - "savedSearchId": "azure-f7cc8d20-32e9-11ed-8fa6-3121b5e93ca0", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" + "panelIndex": "48157948-c755-4eee-9f28-aa5846bcc8c9", + "title": "Risky Users", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "table", - "uiState": {} - }, - "table": null, - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 2, - "width": 188.75 + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a3bd970e-1b56-4145-8614-72b06acc2d71", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a3bd970e-1b56-4145-8614-72b06acc2d71": { + "columnOrder": [ + "7f8e08dc-73bf-435d-bb2b-19940af59614", + "ece34404-7998-4c1b-bdf7-0e33903f43a9", + "dc018907-3f35-484a-88ac-5ef939431a65", + "5b960a06-7df2-4cda-8d09-8dda52ffc428", + "b5510eed-0a15-478a-b879-c12f23bd7180", + "d5041e63-a6b5-4feb-9cb5-78fb0c36d376" + ], + "columns": { + "5b960a06-7df2-4cda-8d09-8dda52ffc428": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Risk Level", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.risk_level" + }, + "7f8e08dc-73bf-435d-bb2b-19940af59614": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.user_display_name" + }, + "b5510eed-0a15-478a-b879-c12f23bd7180": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Detection Timing", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.detection_timing_type" + }, + "d5041e63-a6b5-4feb-9cb5-78fb0c36d376": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "azure.identityprotection.properties.detected_datetime: *" + }, + "isBucketed": false, + "label": "Date", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "azure.identityprotection.properties.detected_datetime" + }, + "dc018907-3f35-484a-88ac-5ef939431a65": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Risk State", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.risk_state" + }, + "ece34404-7998-4c1b-bdf7-0e33903f43a9": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "IP Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.identityprotection.properties.ip_address" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": " azure.identityprotection.category : \"UserRiskEvents\" " + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "d5041e63-a6b5-4feb-9cb5-78fb0c36d376" + }, + { + "alignment": "left", + "columnId": "7f8e08dc-73bf-435d-bb2b-19940af59614" + }, + { + "alignment": "left", + "columnId": "ece34404-7998-4c1b-bdf7-0e33903f43a9" + }, + { + "alignment": "left", + "columnId": "dc018907-3f35-484a-88ac-5ef939431a65" + }, + { + "alignment": "left", + "columnId": "5b960a06-7df2-4cda-8d09-8dda52ffc428" + }, + { + "alignment": "left", + "columnId": "b5510eed-0a15-478a-b879-c12f23bd7180" + } + ], + "headerRowHeight": "single", + "layerId": "a3bd970e-1b56-4145-8614-72b06acc2d71", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "colIndex": 0, - "width": 431.08333333333337 + "gridData": { + "h": 15, + "i": "5d0136d7-0ba1-4054-95ce-218ad42e157e", + "w": 32, + "x": 16, + "y": 10 }, - { - "colIndex": 1, - "width": 160.08333333333331 - } - ] + "panelIndex": "5d0136d7-0ba1-4054-95ce-218ad42e157e", + "title": "Risky Sign-ins", + "type": "lens", + "version": "8.6.0" } - }, - "type": "visualization" + ], + "timeRestore": false, + "title": "[Logs Azure] Azure AD Identity Protection", + "version": 1 + }, + "coreMigrationVersion": "8.6.0", + "created_at": "2023-08-07T12:36:54.602Z", + "id": "azure-5ee36c30-32dc-11ed-a2e6-916b60bbea71", + "migrationVersion": { + "dashboard": "8.6.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "title": "Risky Users" - }, - { - "version": "8.6.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "5d0136d7-0ba1-4054-95ce-218ad42e157e", - "w": 32, - "x": 16, - "y": 10 + { + "id": "logs-*", + "name": "0705b471-583f-4593-916e-46b213966691:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "panelIndex": "5d0136d7-0ba1-4054-95ce-218ad42e157e", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Date", - "field": "azure.identityprotection.properties.detected_datetime", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Name", - "field": "azure.identityprotection.properties.user_display_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "IP Address", - "field": "azure.identityprotection.properties.ip_address", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Risk State", - "field": "azure.identityprotection.properties.risk_state", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Risk Level", - "field": "azure.identityprotection.properties.risk_level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Detection Timing", - "field": "azure.identityprotection.properties.detection_timing_type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - } - ], - "savedSearchId": "azure-813b8ba0-32eb-11ed-8fa6-3121b5e93ca0", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": {} - }, - "vis": { - "params": { - "sort": { - "columnIndex": 5, - "direction": "desc" - } - } - }, - "type": "visualization" + { + "id": "logs-*", + "name": "0705b471-583f-4593-916e-46b213966691:indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40:indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "854eeccf-1660-4c42-b5c9-23fd59f8546e:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "854eeccf-1660-4c42-b5c9-23fd59f8546e:indexpattern-datasource-layer-88e4665c-0d7e-4529-91b3-d4dd23b4c842", + "type": "index-pattern" }, - "title": "Risky Sign-ins" - } + { + "id": "logs-*", + "name": "48157948-c755-4eee-9f28-aa5846bcc8c9:indexpattern-datasource-layer-ca9b2f0a-f382-4c5e-928e-f5b929162361", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5d0136d7-0ba1-4054-95ce-218ad42e157e:indexpattern-datasource-layer-a3bd970e-1b56-4145-8614-72b06acc2d71", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Azure] Azure AD Identity Protection", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0705b471-583f-4593-916e-46b213966691:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0705b471-583f-4593-916e-46b213966691:indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b5e5ace6-ace9-4c70-a6d2-60e2991a1d40:indexpattern-datasource-layer-2b0a18e6-25a6-40ef-ade8-5dddbd897856", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "854eeccf-1660-4c42-b5c9-23fd59f8546e:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "854eeccf-1660-4c42-b5c9-23fd59f8546e:indexpattern-datasource-layer-88e4665c-0d7e-4529-91b3-d4dd23b4c842", - "type": "index-pattern" - }, - { - "id": "azure-f7cc8d20-32e9-11ed-8fa6-3121b5e93ca0", - "name": "48157948-c755-4eee-9f28-aa5846bcc8c9:search_0", - "type": "search" - }, - { - "id": "azure-813b8ba0-32eb-11ed-8fa6-3121b5e93ca0", - "name": "5d0136d7-0ba1-4054-95ce-218ad42e157e:search_0", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "8.6.0" - }, - "coreMigrationVersion": "8.6.1" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/azure/kibana/dashboard/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646.json b/packages/azure/kibana/dashboard/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646.json index 072e5147803..14eb4a96119 100644 --- a/packages/azure/kibana/dashboard/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646.json +++ b/packages/azure/kibana/dashboard/azure-8731b980-f1aa-11ec-a5a8-bf965bcd5646.json @@ -12,7 +12,7 @@ "chainingSystem": "HIERARCHICAL", "controlStyle": "oneLine", "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Firewall \",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" + "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Firewall \",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" }, "description": "Dashboard providing statistics about alerts ingested from the Azure Firewall NAT Rule Log events.", "hits": 0, diff --git a/packages/azure/kibana/dashboard/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646.json b/packages/azure/kibana/dashboard/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646.json index e691817b419..47244bcd7e9 100644 --- a/packages/azure/kibana/dashboard/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646.json +++ b/packages/azure/kibana/dashboard/azure-91224490-f1a6-11ec-a5a8-bf965bcd5646.json @@ -12,9 +12,9 @@ "chainingSystem": "HIERARCHICAL", "controlStyle": "oneLine", "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Observer name\",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" + "panelsJSON": "{\"7cbe886c-4cc4-4fec-beff-7336b0965067\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.account.id\",\"title\":\"Subscription\",\"id\":\"7cbe886c-4cc4-4fec-beff-7336b0965067\",\"enhancements\":{}}},\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.name\",\"title\":\"Observer name\",\"id\":\"3ae71a2b-35ee-4659-b6b5-c2ea9e1ab609\",\"enhancements\":{}}}}" }, - "description": "Dashboard providing statistics about alerts ingested from the AWS Network Firewall integration.", + "description": "Dashboard providing statistics about alerts ingested from Azure Firewall Network Rule Log events.", "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { diff --git a/packages/azure/manifest.yml b/packages/azure/manifest.yml index 652938b4e5d..0fbbc7c0dc7 100644 --- a/packages/azure/manifest.yml +++ b/packages/azure/manifest.yml @@ -1,6 +1,6 @@ name: azure title: Azure Logs -version: 1.5.24 +version: 1.5.31 release: ga description: This Elastic integration collects logs from Azure type: integration diff --git a/packages/azure_app_service/_dev/build/build.yml b/packages/azure_app_service/_dev/build/build.yml new file mode 100644 index 00000000000..47cbed9fed8 --- /dev/null +++ b/packages/azure_app_service/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.0.0 diff --git a/packages/azure_app_service/_dev/build/docs/README.md b/packages/azure_app_service/_dev/build/docs/README.md new file mode 100644 index 00000000000..216a54d87c3 --- /dev/null +++ b/packages/azure_app_service/_dev/build/docs/README.md @@ -0,0 +1,58 @@ +# Azure App Service Integration + +The Azure App Service logs integration retrieves different types of logs categories from Azure App Service. +Azure App Service provides different logging to help you track, monitor, and debug your web application. + +- HTTPLogs help monitor application health, performance and usage patterns. +- AuditLogs provide insights when publishing users successfully log on via one of the App Service publishing protocols. +- IPSecAuditLogs are generated through your application and pushed to Azure Monitoring. +- PlatformLogs are generated through AppService platform for your application. +- ConsoleLogs are generated from application or container. +- AppLogs are generated through your application (ex. logging capabilities) + +## Data streams + +This integration currently collects one data stream: + +- App Service Logs + +## Requirements + +### Credentials + +`eventhub` : +_string_ +Is the fully managed, real-time data ingestion service. + +`consumer_group` : +_string_ +The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string. + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. +Ex: +https://management.chinacloudapi.cn/ for azure ChinaCloud +https://management.microsoftazure.de/ for azure GermanCloud +https://management.azure.com/ for azure PublicCloud +https://management.usgovcloudapi.net/ for azure USGovernmentCloud +Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints. + +## App Service Logs + +{{fields "app_service_logs"}} diff --git a/packages/azure_app_service/changelog.yml b/packages/azure_app_service/changelog.yml new file mode 100644 index 00000000000..7c6f0c0b8e4 --- /dev/null +++ b/packages/azure_app_service/changelog.yml @@ -0,0 +1,6 @@ +# newer versions go on top +- version: "0.0.1" + changes: + - description: Initial release + type: enhancement + link: https://github.com/elastic/integrations/pull/4818 diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log new file mode 100644 index 00000000000..51859aeaeea --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log @@ -0,0 +1,2 @@ +{ "resultDescription": "Exception on /favicon.ico [GET]", "resourceId": "/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86", "category": "AppServiceAppLogs", "time": "2023-02-16 10:18:01Z", "level": "Error", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.51.1.44"} +{ "resultDescription": "hi there", "resourceId": "/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86", "category": "AppServiceAppLogs", "time": "2023-02-16 10:18:46Z", "level": "Informational", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.51.1.44"} diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json new file mode 100644 index 00000000000..b6d6f57bc0b --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json @@ -0,0 +1,56 @@ +{ + "expected": [ + { + "azure": { + "app_service": { + "category": "AppServiceAppLogs", + "event_ip_address": "10.51.1.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Error", + "result_description": "Exception on /favicon.ico [GET]" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"resultDescription\": \"Exception on /favicon.ico [GET]\", \"resourceId\": \"/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86\", \"category\": \"AppServiceAppLogs\", \"time\": \"2023-02-16 10:18:01Z\", \"level\": \"Error\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.51.1.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "azure": { + "app_service": { + "category": "AppServiceAppLogs", + "event_ip_address": "10.51.1.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Informational", + "result_description": "hi there" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"resultDescription\": \"hi there\", \"resourceId\": \"/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86\", \"category\": \"AppServiceAppLogs\", \"time\": \"2023-02-16 10:18:46Z\", \"level\": \"Informational\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.51.1.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log new file mode 100644 index 00000000000..a96ec78bba6 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log @@ -0,0 +1 @@ +{"time":"2022-12-14T12:17:57.2735099Z","ResourceId":"/SUBSCRIPTIONS/12CABCB5-36E8-104F-A3D2-1DC9982F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/USER-TEST-APP","Category":"AppServiceAuditLogs","OperationName":"Authorization","Properties":{"User":"100320021ACECD34","UserDisplayName":"user@elastic.co","UserAddress":"0.0.0.0:5432","Protocol":"AAD"}} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log-expected.json new file mode 100644 index 00000000000..9173be7dc01 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log-expected.json @@ -0,0 +1,32 @@ +{ + "expected": [ + { + "@timestamp": "2022-12-14T12:17:57.273Z", + "azure": { + "app_service": { + "category": "AppServiceAuditLogs", + "operation_name": "Authorization", + "properties": { + "client_ip": "0.0.0.0", + "client_port": 5432, + "protocol": "AAD", + "user": "100320021ACECD34", + "user_display_name": "user@elastic.co" + } + }, + "resource": { + "id": "/SUBSCRIPTIONS/12CABCB5-36E8-104F-A3D2-1DC9982F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/USER-TEST-APP" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{\"time\":\"2022-12-14T12:17:57.2735099Z\",\"ResourceId\":\"/SUBSCRIPTIONS/12CABCB5-36E8-104F-A3D2-1DC9982F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/USER-TEST-APP\",\"Category\":\"AppServiceAuditLogs\",\"OperationName\":\"Authorization\",\"Properties\":{\"User\":\"100320021ACECD34\",\"UserDisplayName\":\"user@elastic.co\",\"UserAddress\":\"0.0.0.0:5432\",\"Protocol\":\"AAD\"}}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log new file mode 100644 index 00000000000..9a48ec156e3 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log @@ -0,0 +1,2 @@ +{ "time": "2023-02-16T08:28:44.834410441Z", "resourceId": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86", "containerId": "01aa4f3e4be4c54ee115d64e99ecb3d4ad3b24a0af64c124f251de2c2a967e2c", "operationName": "Microsoft.Web/sites/log", "category": "AppServiceConsoleLogs", "resultDescription": " Request for index page received\n\n", "level": "Informational", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.61.5.44"} +{ "time": "2023-02-16T08:28:44.834439441Z", "resourceId": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86", "containerId": "01aa4f3e4be4c54ee115d44e99ecb4d4ad3b24a8af64c124f251de2c2a967e2c", "operationName": "Microsoft.Web/sites/log", "category": "AppServiceConsoleLogs", "resultDescription": " 169.254.129.1 - - [16/Feb/2023:08:28:44 +0000] \"GET / HTTP/1.1\" 200 1469 \"https://sandbox-92-3.reactblade.portal.azure.net/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"\n\n", "level": "Informational", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.61.5.44"} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log-expected.json new file mode 100644 index 00000000000..8703a9debbf --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log-expected.json @@ -0,0 +1,62 @@ +{ + "expected": [ + { + "@timestamp": "2023-02-16T08:28:44.834Z", + "azure": { + "app_service": { + "category": "AppServiceConsoleLogs", + "container_id": "01aa4f3e4be4c54ee115d64e99ecb3d4ad3b24a0af64c124f251de2c2a967e2c", + "event_ip_address": "10.61.5.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Informational", + "operation_name": "Microsoft.Web/sites/log", + "result_description": " Request for index page received\n\n" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"time\": \"2023-02-16T08:28:44.834410441Z\", \"resourceId\": \"/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86\", \"containerId\": \"01aa4f3e4be4c54ee115d64e99ecb3d4ad3b24a0af64c124f251de2c2a967e2c\", \"operationName\": \"Microsoft.Web/sites/log\", \"category\": \"AppServiceConsoleLogs\", \"resultDescription\": \" Request for index page received\\n\\n\", \"level\": \"Informational\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.61.5.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-02-16T08:28:44.834Z", + "azure": { + "app_service": { + "category": "AppServiceConsoleLogs", + "container_id": "01aa4f3e4be4c54ee115d44e99ecb4d4ad3b24a8af64c124f251de2c2a967e2c", + "event_ip_address": "10.61.5.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Informational", + "operation_name": "Microsoft.Web/sites/log", + "result_description": " 169.254.129.1 - - [16/Feb/2023:08:28:44 +0000] \"GET / HTTP/1.1\" 200 1469 \"https://sandbox-92-3.reactblade.portal.azure.net/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"\n\n" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"time\": \"2023-02-16T08:28:44.834439441Z\", \"resourceId\": \"/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86\", \"containerId\": \"01aa4f3e4be4c54ee115d44e99ecb4d4ad3b24a8af64c124f251de2c2a967e2c\", \"operationName\": \"Microsoft.Web/sites/log\", \"category\": \"AppServiceConsoleLogs\", \"resultDescription\": \" 169.254.129.1 - - [16/Feb/2023:08:28:44 +0000] \\\"GET / HTTP/1.1\\\" 200 1469 \\\"https://sandbox-92-3.reactblade.portal.azure.net/\\\" \\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\\\"\\n\\n\", \"level\": \"Informational\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.61.5.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log new file mode 100644 index 00000000000..aac839beff0 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log @@ -0,0 +1,2 @@ +{"time": "2022-12-14T12:18:26.4843064Z", "resourceId": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST", "category": "AppServiceHTTPLogs", "properties": {"CsMethod":"POST","CsUriStem":"/api/command","SPort":"443","CIp":"81.2.69.142","UserAgent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36","CsHost":"user-test.scm.azurewebsites.net","ScStatus":200,"ScSubStatus":"0","ScWin32Status":"0","ScBytes":778,"CsBytes":1523,"TimeTaken":1793,"Result":"Success","Cookie":"-","CsUriQuery":"X-ARR-LOG-ID=820d6db3-32ed-4b18-b1d2-2ce575080071","CsUsername":"-","Referer":"-","ComputerName":"WEBWK00000A"}} +{ "time": "2022-12-14T12:18:26.4844541Z", "resourceId": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST", "category": "AppServiceHTTPLogs", "properties": {"CsMethod":"POST","CsUriStem":"/api/command","SPort":"443","CIp":"81.2.69.142","UserAgent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36","CsHost":"user-test.scm.azurewebsites.net","ScStatus":200,"ScSubStatus":"0","ScWin32Status":"0","ScBytes":778,"CsBytes":1523,"TimeTaken":2578,"Result":"Success","Cookie":"-","CsUriQuery":"X-ARR-LOG-ID=3a3ea033-7afc-46fb-8cfc-9d1495fca2f1","CsUsername":"-","Referer":"-","ComputerName":"WEBWK00000A"}} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log-expected.json new file mode 100644 index 00000000000..11c2a6aab7c --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log-expected.json @@ -0,0 +1,84 @@ +{ + "expected": [ + { + "@timestamp": "2022-12-14T12:18:26.484Z", + "azure": { + "app_service": { + "category": "AppServiceHTTPLogs", + "properties": { + "client_ip": "81.2.69.142", + "computer_name": "WEBWK00000A", + "cookie": "-", + "cs_bytes": 1523, + "cs_host": "user-test.scm.azurewebsites.net", + "cs_method": "POST", + "cs_uri_query": "X-ARR-LOG-ID=820d6db3-32ed-4b18-b1d2-2ce575080071", + "cs_uri_stem": "/api/command", + "cs_username": "-", + "referer": "-", + "result": "Success", + "s_port": "443", + "sc_bytes": 778, + "sc_status": 200, + "sc_substatus": "0", + "sc_win32status": "0", + "time_taken": 1793, + "user_agent": "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36" + } + }, + "resource": { + "id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{\"time\": \"2022-12-14T12:18:26.4843064Z\", \"resourceId\": \"/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST\", \"category\": \"AppServiceHTTPLogs\", \"properties\": {\"CsMethod\":\"POST\",\"CsUriStem\":\"/api/command\",\"SPort\":\"443\",\"CIp\":\"81.2.69.142\",\"UserAgent\":\"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36\",\"CsHost\":\"user-test.scm.azurewebsites.net\",\"ScStatus\":200,\"ScSubStatus\":\"0\",\"ScWin32Status\":\"0\",\"ScBytes\":778,\"CsBytes\":1523,\"TimeTaken\":1793,\"Result\":\"Success\",\"Cookie\":\"-\",\"CsUriQuery\":\"X-ARR-LOG-ID=820d6db3-32ed-4b18-b1d2-2ce575080071\",\"CsUsername\":\"-\",\"Referer\":\"-\",\"ComputerName\":\"WEBWK00000A\"}}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2022-12-14T12:18:26.484Z", + "azure": { + "app_service": { + "category": "AppServiceHTTPLogs", + "properties": { + "client_ip": "81.2.69.142", + "computer_name": "WEBWK00000A", + "cookie": "-", + "cs_bytes": 1523, + "cs_host": "user-test.scm.azurewebsites.net", + "cs_method": "POST", + "cs_uri_query": "X-ARR-LOG-ID=3a3ea033-7afc-46fb-8cfc-9d1495fca2f1", + "cs_uri_stem": "/api/command", + "cs_username": "-", + "referer": "-", + "result": "Success", + "s_port": "443", + "sc_bytes": 778, + "sc_status": 200, + "sc_substatus": "0", + "sc_win32status": "0", + "time_taken": 2578, + "user_agent": "Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36" + } + }, + "resource": { + "id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"time\": \"2022-12-14T12:18:26.4844541Z\", \"resourceId\": \"/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST\", \"category\": \"AppServiceHTTPLogs\", \"properties\": {\"CsMethod\":\"POST\",\"CsUriStem\":\"/api/command\",\"SPort\":\"443\",\"CIp\":\"81.2.69.142\",\"UserAgent\":\"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36\",\"CsHost\":\"user-test.scm.azurewebsites.net\",\"ScStatus\":200,\"ScSubStatus\":\"0\",\"ScWin32Status\":\"0\",\"ScBytes\":778,\"CsBytes\":1523,\"TimeTaken\":2578,\"Result\":\"Success\",\"Cookie\":\"-\",\"CsUriQuery\":\"X-ARR-LOG-ID=3a3ea033-7afc-46fb-8cfc-9d1495fca2f1\",\"CsUsername\":\"-\",\"Referer\":\"-\",\"ComputerName\":\"WEBWK00000A\"}}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log new file mode 100644 index 00000000000..415fa13c580 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log @@ -0,0 +1 @@ +{ "time": "2023-02-16T09:54:20.7223739Z", "ResourceId": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86", "Category": "AppServiceIPSecAuditLogs", "OperationName": "Authorization", "Properties": {"Result":"Denied","CsHost":"mango-tree-3004d00656084194b08980b8db637b86.azurewebsites.net","ServiceEndpoint":"False","CIp":"0.0.0.0:52580","XForwardedFor":"","XForwardedHost":"","XAzureFDID":"","XFDHealthProbe":"","Details":"Denied by 0.0.0.0/0 rule."}} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log-expected.json new file mode 100644 index 00000000000..d555efeaa7e --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log-expected.json @@ -0,0 +1,37 @@ +{ + "expected": [ + { + "@timestamp": "2023-02-16T09:54:20.722Z", + "azure": { + "app_service": { + "category": "AppServiceIPSecAuditLogs", + "operation_name": "Authorization", + "properties": { + "client_ip": "0.0.0.0", + "client_port": 52580, + "cs_host": "mango-tree-3004d00656084194b08980b8db637b86.azurewebsites.net", + "details": "Denied by 0.0.0.0/0 rule.", + "result": "Denied", + "service_endpoint": "False", + "xazurefdid": "", + "xfdhealth_probe": "", + "xforwarded_for": "", + "xforwarded_host": "" + } + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"time\": \"2023-02-16T09:54:20.7223739Z\", \"ResourceId\": \"/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86\", \"Category\": \"AppServiceIPSecAuditLogs\", \"OperationName\": \"Authorization\", \"Properties\": {\"Result\":\"Denied\",\"CsHost\":\"mango-tree-3004d00656084194b08980b8db637b86.azurewebsites.net\",\"ServiceEndpoint\":\"False\",\"CIp\":\"0.0.0.0:52580\",\"XForwardedFor\":\"\",\"XForwardedHost\":\"\",\"XAzureFDID\":\"\",\"XFDHealthProbe\":\"\",\"Details\":\"Denied by 0.0.0.0/0 rule.\"}}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log new file mode 100644 index 00000000000..8b8b07e3cb1 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log @@ -0,0 +1,2 @@ +{ "resourceId": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609ACD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D0065608C194C08980B8DB637B86", "operationName": "ContainerLogs", "category": "AppServicePlatformLogs", "time": "2023-02-16T08:28:46.343Z", "level": "Informational", "properties": "{\"message\":\"EventName:SiteStopRequested - Reason:SiteNotStartableDuringChangeNotification - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \"}", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.61.1.44"} +{ "resourceId": "/SUBSCRIPTIONS/0E073EC1-C22F-4438-ADBE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004E00656084194C08980B8DB637B86", "operationName": "ContainerLogs", "category": "AppServicePlatformLogs", "time": "2023-02-16T08:28:46.541Z", "level": "Informational", "properties": "{\"message\":\"EventName:ContainerStopped - Reason: - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \"}", "EventStampType": "Stamp", "EventPrimaryStampName": "waws-prod-blu-219", "EventStampName": "waws-prod-blu-219", "Host": "lw1sdlwk0008EK", "EventIpAddress": "10.61.1.44"} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log-expected.json b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log-expected.json new file mode 100644 index 00000000000..e734676f118 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log-expected.json @@ -0,0 +1,60 @@ +{ + "expected": [ + { + "@timestamp": "2023-02-16T08:28:46.343Z", + "azure": { + "app_service": { + "category": "AppServicePlatformLogs", + "event_ip_address": "10.61.1.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Informational", + "log": "{\"message\":\"EventName:SiteStopRequested - Reason:SiteNotStartableDuringChangeNotification - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \"}", + "operation_name": "ContainerLogs" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609ACD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D0065608C194C08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"resourceId\": \"/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609ACD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D0065608C194C08980B8DB637B86\", \"operationName\": \"ContainerLogs\", \"category\": \"AppServicePlatformLogs\", \"time\": \"2023-02-16T08:28:46.343Z\", \"level\": \"Informational\", \"properties\": \"{\\\"message\\\":\\\"EventName:SiteStopRequested - Reason:SiteNotStartableDuringChangeNotification - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \\\"}\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.61.1.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-02-16T08:28:46.541Z", + "azure": { + "app_service": { + "category": "AppServicePlatformLogs", + "event_ip_address": "10.61.1.44", + "event_primary_stamp_name": "waws-prod-blu-219", + "event_stamp_name": "waws-prod-blu-219", + "event_stamp_type": "Stamp", + "host": "lw1sdlwk0008EK", + "level": "Informational", + "log": "{\"message\":\"EventName:ContainerStopped - Reason: - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \"}", + "operation_name": "ContainerLogs" + }, + "resource": { + "id": "/SUBSCRIPTIONS/0E073EC1-C22F-4438-ADBE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004E00656084194C08980B8DB637B86" + } + }, + "ecs": { + "version": "8.3.0" + }, + "event": { + "original": "{ \"resourceId\": \"/SUBSCRIPTIONS/0E073EC1-C22F-4438-ADBE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004E00656084194C08980B8DB637B86\", \"operationName\": \"ContainerLogs\", \"category\": \"AppServicePlatformLogs\", \"time\": \"2023-02-16T08:28:46.541Z\", \"level\": \"Informational\", \"properties\": \"{\\\"message\\\":\\\"EventName:ContainerStopped - Reason: - Message: - ContainerIDs:01aa4f3e4be4c54ee115d54e91ecb4d4ad3b24a0af64c124f251de2c2a967e2c - AdditionalInfo: \\\"}\", \"EventStampType\": \"Stamp\", \"EventPrimaryStampName\": \"waws-prod-blu-219\", \"EventStampName\": \"waws-prod-blu-219\", \"Host\": \"lw1sdlwk0008EK\", \"EventIpAddress\": \"10.61.1.44\"}" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-common-config.yml b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/azure_app_service/data_stream/app_service_logs/agent/stream/azure-eventhub.yml.hbs b/packages/azure_app_service/data_stream/app_service_logs/agent/stream/azure-eventhub.yml.hbs new file mode 100644 index 00000000000..70a0e582651 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/agent/stream/azure-eventhub.yml.hbs @@ -0,0 +1,46 @@ +{{#if connection_string}} +connection_string: {{connection_string}} +{{/if}} +{{#if storage_account_container }} +storage_account_container: {{storage_account_container}} +{{else}} +{{#if eventhub}} +storage_account_container: app-service-logs-{{eventhub}} +{{/if}} +{{/if}} +{{#if eventhub}} +eventhub: {{eventhub}} +{{/if}} +{{#if consumer_group}} +consumer_group: {{consumer_group}} +{{/if}} +{{#if storage_account}} +storage_account: {{storage_account}} +{{/if}} +{{#if storage_account_key}} +storage_account_key: {{storage_account_key}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} +sanitize_options: +{{#if sanitize_newlines}} + - NEW_LINES +{{/if}} +{{#if sanitize_singlequotes}} + - SINGLE_QUOTES +{{/if}} diff --git a/packages/azure_app_service/data_stream/app_service_logs/agent/stream/log.yml.hbs b/packages/azure_app_service/data_stream/app_service_logs/agent/stream/log.yml.hbs new file mode 100644 index 00000000000..d0bec8af049 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/agent/stream/log.yml.hbs @@ -0,0 +1,19 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-applogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-applogs-inner-pipeline.yml new file mode 100644 index 00000000000..f739af0c5e2 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-applogs-inner-pipeline.yml @@ -0,0 +1,29 @@ +--- +description: Pipeline for processing Azure App Service App logs. +processors: + - rename: + field: azure.app_service.resourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.resultDescription + target_field: azure.app_service.result_description + - rename: + field: azure.app_service.EventStampType + target_field: azure.app_service.event_stamp_type + - rename: + field: azure.app_service.EventPrimaryStampName + target_field: azure.app_service.event_primary_stamp_name + - rename: + field: azure.app_service.EventStampName + target_field: azure.app_service.event_stamp_name + - rename: + field: azure.app_service.Host + target_field: azure.app_service.host + - rename: + field: azure.app_service.EventIpAddress + target_field: azure.app_service.event_ip_address +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-auditlogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-auditlogs-inner-pipeline.yml new file mode 100644 index 00000000000..c85a86f65c2 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-auditlogs-inner-pipeline.yml @@ -0,0 +1,42 @@ +--- +description: Pipeline for processing Azure App Service Console Logs +processors: + - rename: + field: azure.app_service.ResourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.Category + target_field: azure.app_service.category + - rename: + field: azure.app_service.OperationName + target_field: azure.app_service.operation_name + - rename: + field: azure.app_service.Properties + target_field: azure.app_service.properties + ignore_missing: true + - rename: + field: azure.app_service.properties.Protocol + target_field: azure.app_service.properties.protocol + - rename: + field: azure.app_service.properties.User + target_field: azure.app_service.properties.user + - rename: + field: azure.app_service.properties.UserAddress + target_field: azure.app_service.properties.client_ip + - rename: + field: azure.app_service.properties.UserDisplayName + target_field: azure.app_service.properties.user_display_name + - grok: + field: azure.app_service.properties.client_ip + patterns: + - '%{IPORHOST:azure.app_service.properties.client_ip}:%{POSINT:azure.app_service.properties.client_port:long}' + ignore_failure: true + - convert: + field: azure.app_service.properties.client_ip + type: ip + ignore_missing: true +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-consolelogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-consolelogs-inner-pipeline.yml new file mode 100644 index 00000000000..61c98bcd8d3 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-consolelogs-inner-pipeline.yml @@ -0,0 +1,35 @@ +--- +description: Pipeline for processing Azure App Service Audit logs. +processors: + - rename: + field: azure.app_service.resourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.containerId + target_field: azure.app_service.container_id + - rename: + field: azure.app_service.operationName + target_field: azure.app_service.operation_name + - rename: + field: azure.app_service.resultDescription + target_field: azure.app_service.result_description + - rename: + field: azure.app_service.EventStampType + target_field: azure.app_service.event_stamp_type + - rename: + field: azure.app_service.EventPrimaryStampName + target_field: azure.app_service.event_primary_stamp_name + - rename: + field: azure.app_service.EventStampName + target_field: azure.app_service.event_stamp_name + - rename: + field: azure.app_service.Host + target_field: azure.app_service.host + - rename: + field: azure.app_service.EventIpAddress + target_field: azure.app_service.event_ip_address +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-httplogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-httplogs-inner-pipeline.yml new file mode 100644 index 00000000000..126e4c98736 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-httplogs-inner-pipeline.yml @@ -0,0 +1,65 @@ +--- +description: Pipeline for processing Azure App Service HTTP logs. +processors: + - rename: + field: azure.app_service.resourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.properties.CIp + target_field: azure.app_service.properties.client_ip + - rename: + field: azure.app_service.properties.ComputerName + target_field: azure.app_service.properties.computer_name + - rename: + field: azure.app_service.properties.Cookie + target_field: azure.app_service.properties.cookie + - rename: + field: azure.app_service.properties.CsBytes + target_field: azure.app_service.properties.cs_bytes + - rename: + field: azure.app_service.properties.CsHost + target_field: azure.app_service.properties.cs_host + - rename: + field: azure.app_service.properties.CsMethod + target_field: azure.app_service.properties.cs_method + - rename: + field: azure.app_service.properties.CsUriQuery + target_field: azure.app_service.properties.cs_uri_query + - rename: + field: azure.app_service.properties.CsUriStem + target_field: azure.app_service.properties.cs_uri_stem + - rename: + field: azure.app_service.properties.CsUsername + target_field: azure.app_service.properties.cs_username + - rename: + field: azure.app_service.properties.Referer + target_field: azure.app_service.properties.referer + - rename: + field: azure.app_service.properties.Result + target_field: azure.app_service.properties.result + - rename: + field: azure.app_service.properties.SPort + target_field: azure.app_service.properties.s_port + - rename: + field: azure.app_service.properties.ScBytes + target_field: azure.app_service.properties.sc_bytes + - rename: + field: azure.app_service.properties.ScStatus + target_field: azure.app_service.properties.sc_status + - rename: + field: azure.app_service.properties.ScSubStatus + target_field: azure.app_service.properties.sc_substatus + - rename: + field: azure.app_service.properties.ScWin32Status + target_field: azure.app_service.properties.sc_win32status + - rename: + field: azure.app_service.properties.TimeTaken + target_field: azure.app_service.properties.time_taken + - rename: + field: azure.app_service.properties.UserAgent + target_field: azure.app_service.properties.user_agent +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-ipsecauditlogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-ipsecauditlogs-inner-pipeline.yml new file mode 100644 index 00000000000..5bcb306d553 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-ipsecauditlogs-inner-pipeline.yml @@ -0,0 +1,69 @@ +--- +description: Pipeline for processing Azure App Service IPSec Audit logs. +processors: + - rename: + field: azure.app_service.ResourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.Category + target_field: azure.app_service.category + - rename: + field: azure.app_service.OperationName + target_field: azure.app_service.operation_name + - rename: + field: azure.app_service.Properties + target_field: azure.app_service.properties + ignore_missing: true + - rename: + field: azure.app_service.properties.CIp + target_field: azure.app_service.properties.client_ip + - rename: + field: azure.app_service.properties.CsHost + target_field: azure.app_service.properties.cs_host + - rename: + field: azure.app_service.properties.Result + target_field: azure.app_service.properties.result + - rename: + field: azure.app_service.properties.Details + target_field: azure.app_service.properties.details + - rename: + field: azure.app_service.properties.ServiceEndpoint + target_field: azure.app_service.properties.service_endpoint + - rename: + field: azure.app_service.properties.XForwardedFor + target_field: azure.app_service.properties.xforwarded_for + - rename: + field: azure.app_service.properties.XForwardedHost + target_field: azure.app_service.properties.xforwarded_host + - rename: + field: azure.app_service.properties.XAzureFDID + target_field: azure.app_service.properties.xazurefdid + - rename: + field: azure.app_service.properties.XFDHealthProbe + target_field: azure.app_service.properties.xfdhealth_probe + - rename: + field: azure.app_service.properties.Type + target_field: azure.app_service.properties.type + ignore_missing: true + - rename: + field: azure.app_service.properties.TimeGenerated + target_field: azure.app_service.properties.time_generated + ignore_missing: true + - rename: + field: azure.app_service.properties.SourceSystem + target_field: azure.app_service.properties.source_system + ignore_missing: true + - grok: + field: azure.app_service.properties.client_ip + patterns: + - '%{IPORHOST:azure.app_service.properties.client_ip}:%{POSINT:azure.app_service.properties.client_port:long}' + ignore_failure: true + - convert: + field: azure.app_service.properties.client_ip + type: ip + ignore_missing: true +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-platformlogs-inner-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-platformlogs-inner-pipeline.yml new file mode 100644 index 00000000000..277167a2b0c --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-platformlogs-inner-pipeline.yml @@ -0,0 +1,32 @@ +--- +description: Pipeline for processing Azure App Service Platform logs. +processors: + - rename: + field: azure.app_service.resourceId + target_field: azure.resource.id + ignore_missing: true + - rename: + field: azure.app_service.operationName + target_field: azure.app_service.operation_name + - rename: + field: azure.app_service.EventStampType + target_field: azure.app_service.event_stamp_type + - rename: + field: azure.app_service.EventPrimaryStampName + target_field: azure.app_service.event_primary_stamp_name + - rename: + field: azure.app_service.EventStampName + target_field: azure.app_service.event_stamp_name + - rename: + field: azure.app_service.Host + target_field: azure.app_service.host + - rename: + field: azure.app_service.EventIpAddress + target_field: azure.app_service.event_ip_address + - rename: + field: azure.app_service.properties + target_field: azure.app_service.log +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml new file mode 100644 index 00000000000..c4023f3d438 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml @@ -0,0 +1,88 @@ +--- +description: Pipeline for parsing Azure shared log fields. +processors: + - set: + field: cloud.provider + value: azure + - grok: + field: azure.resource_id + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/namespaces/%{NAMESPACE:azure.resource.namespace}/authorizationRules/%{RULE:azure.resource.authorization_rule} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + GROUPID: .+ + PROVIDERNAME: .+ + NAMESPACE: .+ + RULE: .+ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + GROUPID: .+ + PROVIDERNAME: ([A-Za-z])\w+.([A-Za-z])\w+/([A-Za-z])\w+. + NAME: ((?!AUTHORIZATIONRULES).)*$ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + GROUPID: .+ + PROVIDERNAME: ([A-Za-z])\w+.([A-Za-z])\w+\/([A-Za-z][^\/])\w+ + NAME: .+ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/providers/%{PROVIDER:azure.resource.provider} + pattern_definitions: + PROVIDER: .+ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/providers/%{PROVIDERNAME:azure.resource.provider} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + PROVIDERNAME: ([A-Za-z])\w+.([A-Za-z])\w+\/([A-Za-z][^\/])\w+ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + GROUPID: .+ + ignore_failure: true + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + ignore_failure: true + - rename: + field: azure.resource_id + target_field: azure.resource.id + ignore_missing: true + - lowercase: + field: event.outcome + ignore_missing: true + - set: + field: cloud.account.id + copy_from: azure.subscription_id + ignore_empty_value: true +on_failure: + - set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/default.yml b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..b546d755555 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,67 @@ +--- +description: Pipeline for processing Azure App Service logs. +processors: + - set: + field: ecs.version + value: '8.3.0' + - rename: + field: azure + target_field: azure-eventhub + ignore_missing: true + - script: + source: ctx.message = ctx.message.replace(params.empty_field_name, '') + params: + empty_field_name: '"":"",' + ignore_failure: true + - rename: + field: message + target_field: event.original + ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' + - json: + field: event.original + target_field: azure.app_service + ignore_failure: true + - date: + field: azure.app_service.time + target_field: '@timestamp' + ignore_failure: true + formats: + - ISO8601 + - remove: + field: azure.app_service.time + ignore_missing: true + - pipeline: + if: "ctx?.azure?.app_service?.Category == 'AppServiceAuditLogs'" + name: '{{ IngestPipeline "appservice-auditlogs-inner-pipeline" }}' + - pipeline: + if: "ctx?.azure?.app_service?.category == 'AppServiceHTTPLogs'" + name: '{{ IngestPipeline "appservice-httplogs-inner-pipeline" }}' + - pipeline: + if: "ctx?.azure?.app_service?.Category == 'AppServiceIPSecAuditLogs'" + name: '{{ IngestPipeline "appservice-ipsecauditlogs-inner-pipeline" }}' + - pipeline: + if: "ctx?.azure?.app_service?.category == 'AppServiceConsoleLogs'" + name: '{{ IngestPipeline "appservice-consolelogs-inner-pipeline" }}' + - pipeline: + if: "ctx?.azure?.app_service?.category == 'AppServicePlatformLogs'" + name: '{{ IngestPipeline "appservice-platformlogs-inner-pipeline" }}' + - pipeline: + if: "ctx?.azure?.app_service?.category == 'AppServiceAppLogs'" + name: '{{ IngestPipeline "appservice-applogs-inner-pipeline" }}' +on_failure: + - append: + field: "error.message" + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" + - remove: + field: + - json + - _conf + - message + ignore_missing: true \ No newline at end of file diff --git a/packages/azure_app_service/data_stream/app_service_logs/fields/base-fields.yml b/packages/azure_app_service/data_stream/app_service_logs/fields/base-fields.yml new file mode 100644 index 00000000000..a9a65458fc5 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/fields/base-fields.yml @@ -0,0 +1,21 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/azure_app_service/data_stream/app_service_logs/fields/ecs.yml b/packages/azure_app_service/data_stream/app_service_logs/fields/ecs.yml new file mode 100644 index 00000000000..7cf456cbc90 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/fields/ecs.yml @@ -0,0 +1,145 @@ +- name: cloud.account.id + external: ecs +- name: cloud.provider + external: ecs +- name: destination.address + external: ecs +- name: destination.as.number + external: ecs +- name: destination.as.organization.name + external: ecs +- name: destination.domain + external: ecs +- name: destination.geo.city_name + external: ecs +- name: destination.geo.continent_name + external: ecs +- name: destination.geo.country_iso_code + external: ecs +- name: destination.geo.country_name + external: ecs +- name: destination.geo.location + external: ecs +- name: destination.geo.name + external: ecs +- name: destination.geo.region_iso_code + external: ecs +- name: destination.geo.region_name + external: ecs +- name: destination.bytes + external: ecs +- name: destination.ip + external: ecs +- name: destination.port + external: ecs +- name: destination.nat.ip + external: ecs +- name: destination.nat.port + external: ecs +- name: dns.header_flags + external: ecs +- name: dns.question.class + external: ecs +- name: dns.question.name + external: ecs +- name: dns.question.type + external: ecs +- name: dns.response_code +- name: ecs.version + external: ecs +- name: message + external: ecs +- name: event.action + external: ecs +- name: event.category + external: ecs +- name: event.created + external: ecs +- name: event.duration + external: ecs +- name: event.id + external: ecs +- name: event.ingested + external: ecs +- name: event.kind + external: ecs +- name: event.type + external: ecs +- name: network.iana_number + external: ecs +- name: network.protocol + external: ecs +- name: network.transport + external: ecs +- name: observer.name + external: ecs +- name: observer.product + external: ecs +- name: observer.type + external: ecs +- name: observer.vendor + external: ecs +- name: related.hosts + external: ecs +- name: related.ip + external: ecs +- name: related.user + external: ecs +- name: source.address + external: ecs +- name: source.as.number + external: ecs +- name: source.as.organization.name + external: ecs +- name: source.bytes + external: ecs +- name: source.port + external: ecs +- name: geo.continent_name + external: ecs +- name: geo.country_iso_code + external: ecs +- name: geo.country_name + external: ecs +- name: geo.location + external: ecs +- name: geo.city_name + external: ecs +- name: geo.region_name + external: ecs +- name: geo.name + external: ecs +- name: geo.region_iso_code + external: ecs +- name: log.level + external: ecs +- name: rule.id + external: ecs +- name: rule.name + external: ecs +- name: rule.ruleset + external: ecs +- name: rule.category + external: ecs +- name: source.geo.city_name + external: ecs +- name: source.geo.continent_name + external: ecs +- name: source.geo.country_iso_code + external: ecs +- name: source.geo.country_name + external: ecs +- name: source.geo.location + external: ecs +- name: source.geo.name + external: ecs +- name: source.geo.region_iso_code + external: ecs +- name: source.geo.region_name + external: ecs +- name: source.ip + external: ecs +- name: url.original + external: ecs +- name: tags + external: ecs diff --git a/packages/azure_app_service/data_stream/app_service_logs/fields/fields.yml b/packages/azure_app_service/data_stream/app_service_logs/fields/fields.yml new file mode 100644 index 00000000000..6e5f014e767 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/fields/fields.yml @@ -0,0 +1,131 @@ +- name: azure.app_service + type: group + fields: + - name: category + type: keyword + description: The category of the operation. + - name: operation_name + type: keyword + description: The operation name. + - name: properties + type: group + fields: + - name: user_agent + type: keyword + description: User agent on HTTP request. + - name: time_taken + type: long + description: Time taken by HTTP request in milliseconds. + - name: result + type: keyword + description: Success / Failure of HTTP request. + - name: referer + type: keyword + description: The site that the user last visited. This site provided a link to the current site. + - name: client_ip + type: ip + description: IP address of the client. + - name: client_port + type: long + description: IP address of the client. + - name: sc_win32status + type: keyword + description: Windows status code on HTTP request. + - name: sc_substatus + type: keyword + description: Substatus error code on HTTP request. + - name: sc_bytes + type: long + description: Number of bytes sent by server. + - name: sc_status + type: long + description: HTTP status code. + - name: cs_username + type: keyword + description: The name of the authenticated user on HTTP request. + - name: cs_uri_query + type: keyword + description: URI query on HTTP request. + - name: cs_uri_stem + type: keyword + description: The target of the request. + - name: cs_bytes + type: long + description: Number of bytes received by server. + - name: cs_host + type: keyword + description: Host name header on HTTP request. + - name: cs_method + type: keyword + - name: computer_name + type: keyword + description: The name of the server on which the log file entry was generated. + - name: s_port + type: keyword + description: Server port number. + - name: cookie + type: keyword + description: Cookie on HTTP request. + - name: user + type: keyword + description: Username used for publishing access. + - name: user_display_name + type: keyword + description: Email address of a user in case publishing was authorized via AAD authentication. + - name: protocol + type: keyword + description: Authentication protocol. + - name: details + type: keyword + description: Additional information + - name: service_endpoint + type: keyword + description: This indicates whether the access is via Virtual Network Service Endpoint communication + - name: xforwarded_for + type: keyword + description: X-Forwarded-For header of the HTTP request + - name: xforwarded_host + type: keyword + description: X-Forwarded-Host header of the HTTP request + - name: xazurefdid + type: keyword + description: X-Azure-FDID header (Azure Frontdoor Id) of the HTTP request + - name: xfdhealth_probe + type: keyword + description: X-FD-HealthProbe (Azure Frontdoor Health Probe) of the HTTP request + - name: type + type: keyword + description: The name of the table + - name: time_generated + type: keyword + description: Time of the Http Request + - name: source_system + type: keyword + description: The source system + - name: container_id + type: keyword + description: Application container id + - name: host + type: keyword + description: Host where the application is running + - name: level + type: keyword + description: Verbosity level of log + - name: result_description + type: keyword + description: Log message description + - name: event_stamp_type + type: keyword + description: Values that the service supports + - name: event_stamp_name + type: keyword + description: Name of the service + - name: event_primary_stamp_name + type: keyword + description: Primary name of the service + - name: event_ip_address + type: keyword + description: IP address of the event + - name: log + type: keyword + description: Details about the event depending on level diff --git a/packages/azure_app_service/data_stream/app_service_logs/fields/package-fields.yml b/packages/azure_app_service/data_stream/app_service_logs/fields/package-fields.yml new file mode 100644 index 00000000000..3a85154738f --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/fields/package-fields.yml @@ -0,0 +1,42 @@ +- name: azure + type: group + fields: + - name: subscription_id + type: keyword + description: | + Azure subscription ID + - name: correlation_id + type: keyword + description: | + Correlation ID + - name: tenant_id + type: keyword + description: | + tenant ID + - name: resource + type: group + fields: + - name: id + type: keyword + description: | + Resource ID + - name: group + type: keyword + description: | + Resource group + - name: provider + type: keyword + description: | + Resource type/namespace + - name: namespace + type: keyword + description: | + Resource type/namespace + - name: name + type: keyword + description: | + Name + - name: authorization_rule + type: keyword + description: |- + Authorization rule diff --git a/packages/azure_app_service/data_stream/app_service_logs/manifest.yml b/packages/azure_app_service/data_stream/app_service_logs/manifest.yml new file mode 100644 index 00000000000..1de6eaf57c9 --- /dev/null +++ b/packages/azure_app_service/data_stream/app_service_logs/manifest.yml @@ -0,0 +1,60 @@ +title: Collect App Service logs from Azure +type: logs +release: experimental +streams: + - input: "azure-eventhub" + enabled: false + template_path: "azure-eventhub.yml.hbs" + title: Azure App Service logs + description: Collect Azure App Service logs using azure-eventhub input + vars: + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: storage_account_container + type: text + title: Storage Account Container + multi: false + required: false + show_user: false + description: > + The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You MUST use a dedicated storage account container for each Azure log type (activity, sign-in, audit logs, and others). DO NOT REUSE the same container name for more than one Azure log type. See [Container Names](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names) for details on naming rules from Microsoft. The integration generates a default container name if not specified. + + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-appservice + - forwarded + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: sanitize_newlines + type: bool + title: Sanitizes New Lines + description: Removes new lines in logs to ensure proper formatting of JSON data and avoid parsing issues during processing. + multi: false + required: false + show_user: false + default: false + - name: sanitize_singlequotes + required: true + show_user: false + title: Sanitizes Single Quotes + description: Replaces single quotes with double quotes (single quotes inside double quotes are omitted) in logs to ensure proper formatting of JSON data and avoid parsing issues during processing. + type: bool + multi: false + default: false diff --git a/packages/azure_app_service/docs/README.md b/packages/azure_app_service/docs/README.md new file mode 100644 index 00000000000..b5d92aed36a --- /dev/null +++ b/packages/azure_app_service/docs/README.md @@ -0,0 +1,196 @@ +# Azure App Service Integration + +The Azure App Service logs integration retrieves different types of logs categories from Azure App Service. +Azure App Service provides different logging to help you track, monitor, and debug your web application. + +- HTTPLogs help monitor application health, performance and usage patterns. +- AuditLogs provide insights when publishing users successfully log on via one of the App Service publishing protocols. +- IPSecAuditLogs are generated through your application and pushed to Azure Monitoring. +- PlatformLogs are generated through AppService platform for your application. +- ConsoleLogs are generated from application or container. +- AppLogs are generated through your application (ex. logging capabilities) + +## Data streams + +This integration currently collects one data stream: + +- App Service Logs + +## Requirements + +### Credentials + +`eventhub` : +_string_ +Is the fully managed, real-time data ingestion service. + +`consumer_group` : +_string_ +The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string required to communicate with Event Hubs, steps here https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string. + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the filebeat azure module it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different azure environment. +Ex: +https://management.chinacloudapi.cn/ for azure ChinaCloud +https://management.microsoftazure.de/ for azure GermanCloud +https://management.azure.com/ for azure PublicCloud +https://management.usgovcloudapi.net/ for azure USGovernmentCloud +Users can also use this in case of a Hybrid Cloud model, where one may define their own endpoints. + +## App Service Logs + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| azure.app_service.category | The category of the operation. | keyword | +| azure.app_service.container_id | Application container id | keyword | +| azure.app_service.event_ip_address | IP address of the event | keyword | +| azure.app_service.event_primary_stamp_name | Primary name of the service | keyword | +| azure.app_service.event_stamp_name | Name of the service | keyword | +| azure.app_service.event_stamp_type | Values that the service supports | keyword | +| azure.app_service.host | Host where the application is running | keyword | +| azure.app_service.level | Verbosity level of log | keyword | +| azure.app_service.log | Details about the event depending on level | keyword | +| azure.app_service.operation_name | The operation name. | keyword | +| azure.app_service.properties.client_ip | IP address of the client. | ip | +| azure.app_service.properties.client_port | IP address of the client. | long | +| azure.app_service.properties.computer_name | The name of the server on which the log file entry was generated. | keyword | +| azure.app_service.properties.cookie | Cookie on HTTP request. | keyword | +| azure.app_service.properties.cs_bytes | Number of bytes received by server. | long | +| azure.app_service.properties.cs_host | Host name header on HTTP request. | keyword | +| azure.app_service.properties.cs_method | | keyword | +| azure.app_service.properties.cs_uri_query | URI query on HTTP request. | keyword | +| azure.app_service.properties.cs_uri_stem | The target of the request. | keyword | +| azure.app_service.properties.cs_username | The name of the authenticated user on HTTP request. | keyword | +| azure.app_service.properties.details | Additional information | keyword | +| azure.app_service.properties.protocol | Authentication protocol. | keyword | +| azure.app_service.properties.referer | The site that the user last visited. This site provided a link to the current site. | keyword | +| azure.app_service.properties.result | Success / Failure of HTTP request. | keyword | +| azure.app_service.properties.s_port | Server port number. | keyword | +| azure.app_service.properties.sc_bytes | Number of bytes sent by server. | long | +| azure.app_service.properties.sc_status | HTTP status code. | long | +| azure.app_service.properties.sc_substatus | Substatus error code on HTTP request. | keyword | +| azure.app_service.properties.sc_win32status | Windows status code on HTTP request. | keyword | +| azure.app_service.properties.service_endpoint | This indicates whether the access is via Virtual Network Service Endpoint communication | keyword | +| azure.app_service.properties.source_system | The source system | keyword | +| azure.app_service.properties.time_generated | Time of the Http Request | keyword | +| azure.app_service.properties.time_taken | Time taken by HTTP request in milliseconds. | long | +| azure.app_service.properties.type | The name of the table | keyword | +| azure.app_service.properties.user | Username used for publishing access. | keyword | +| azure.app_service.properties.user_agent | User agent on HTTP request. | keyword | +| azure.app_service.properties.user_display_name | Email address of a user in case publishing was authorized via AAD authentication. | keyword | +| azure.app_service.properties.xazurefdid | X-Azure-FDID header (Azure Frontdoor Id) of the HTTP request | keyword | +| azure.app_service.properties.xfdhealth_probe | X-FD-HealthProbe (Azure Frontdoor Health Probe) of the HTTP request | keyword | +| azure.app_service.properties.xforwarded_for | X-Forwarded-For header of the HTTP request | keyword | +| azure.app_service.properties.xforwarded_host | X-Forwarded-Host header of the HTTP request | keyword | +| azure.app_service.result_description | Log message description | keyword | +| azure.correlation_id | Correlation ID | keyword | +| azure.resource.authorization_rule | Authorization rule | keyword | +| azure.resource.group | Resource group | keyword | +| azure.resource.id | Resource ID | keyword | +| azure.resource.name | Name | keyword | +| azure.resource.namespace | Resource type/namespace | keyword | +| azure.resource.provider | Resource type/namespace | keyword | +| azure.subscription_id | Azure subscription ID | keyword | +| azure.tenant_id | tenant ID | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | +| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | +| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | +| destination.port | Port of the destination. | long | +| dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword | +| dns.question.class | The class of records being queried. | keyword | +| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | +| dns.question.type | The type of record being queried. | keyword | +| dns.response_code | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.id | Unique ID to describe the event. | keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| geo.city_name | City name. | keyword | +| geo.continent_name | Name of the continent. | keyword | +| geo.country_iso_code | Country ISO code. | keyword | +| geo.country_name | Country name. | keyword | +| geo.location | Longitude and latitude. | geo_point | +| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| geo.region_iso_code | Region ISO code. | keyword | +| geo.region_name | Region name. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | +| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.bytes | Bytes sent from the source to the destination. | long | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.port | Port of the source. | long | +| tags | List of keywords used to tag each event. | keyword | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | + diff --git a/packages/azure_app_service/img/app-service-logo.svg b/packages/azure_app_service/img/app-service-logo.svg new file mode 100644 index 00000000000..54051fc58f5 --- /dev/null +++ b/packages/azure_app_service/img/app-service-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/azure_app_service/manifest.yml b/packages/azure_app_service/manifest.yml new file mode 100644 index 00000000000..35759dc3edd --- /dev/null +++ b/packages/azure_app_service/manifest.yml @@ -0,0 +1,78 @@ +format_version: 2.8.0 +name: azure_app_service +title: "Azure App Service" +version: 0.0.1 +source: + license: "Elastic-2.0" +description: "Collect logs and metrics from Azure App Service with Elastic Agent." +type: integration +categories: + - azure + - cloud +conditions: + kibana.version: "^8.7.1" + elastic.subscription: "basic" +vars: + - name: eventhub + type: text + title: Event Hub + multi: false + required: true + show_user: true + description: >- + Elastic recommends using one event hub for each integration. Visit [Create an event hub](https://docs.elastic.co/integrations/azure#create-an-event-hub) to learn more. Use event hub names up to 30 characters long to avoid compatibility issues. + - name: consumer_group + type: text + title: Consumer Group + multi: false + required: true + show_user: true + default: $Default + - name: connection_string + type: text + title: Connection String + multi: false + required: true + show_user: true + description: >- + The connection string required to communicate with Event Hubs. See [Get an Event Hubs connection string](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string) to learn more. + - name: storage_account + type: text + title: Storage Account + multi: false + required: true + show_user: true + description: >- + The name of the storage account where the consumer group's state/offsets will be stored and updated. + - name: storage_account_key + type: text + title: Storage Account Key + multi: false + required: true + show_user: true + description: >- + The storage account key, this key will be used to authorize access to data in your storage account. + - name: resource_manager_endpoint + type: text + title: Resource Manager Endpoint + multi: false + required: false + show_user: false +icons: + - src: /img/app-service-logo.svg + title: App Service Logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: app_service_logs + title: Azure App Service logs + description: Azure App Service logs integration + data_streams: + - app_service_logs + inputs: + - type: "azure-eventhub" + title: "Collect Azure App Service logs from Event Hub" + description: "Collecting App Service logs from Azure (input: azure-eventhub)" + input_group: logs +owner: + github: elastic/obs-infraobs-integrations diff --git a/packages/azure_application_insights/changelog.yml b/packages/azure_application_insights/changelog.yml index 57cacc59975..f00ef0e8ba6 100644 --- a/packages/azure_application_insights/changelog.yml +++ b/packages/azure_application_insights/changelog.yml @@ -1,3 +1,13 @@ +- version: "1.1.0" + changes: + - description: Add app_insights dimensions and metric_type for metrics field. + type: enhancement + link: https://github.com/elastic/integrations/pull/7610 +- version: "1.0.6" + changes: + - description: Fix mappings of tags and dimensions + type: enhancement + link: https://github.com/elastic/integrations/pull/6975 - version: "1.0.5" changes: - description: Added categories and/or subcategories. diff --git a/packages/azure_application_insights/data_stream/app_insights/elasticsearch/ingest_pipeline/default.yml b/packages/azure_application_insights/data_stream/app_insights/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..0ad98ca3a31 --- /dev/null +++ b/packages/azure_application_insights/data_stream/app_insights/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,14 @@ +--- +description: Pipeline for parsing azure app_insights metrics. +processors: + - fingerprint: + fields: ["azure.dimensions"] + target_field: 'azure.dimensions.fingerprint' + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - set: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file diff --git a/packages/azure_application_insights/data_stream/app_insights/fields/agent.yml b/packages/azure_application_insights/data_stream/app_insights/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_application_insights/data_stream/app_insights/fields/agent.yml +++ b/packages/azure_application_insights/data_stream/app_insights/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_application_insights/data_stream/app_insights/fields/ecs.yml b/packages/azure_application_insights/data_stream/app_insights/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_application_insights/data_stream/app_insights/fields/ecs.yml +++ b/packages/azure_application_insights/data_stream/app_insights/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_application_insights/data_stream/app_insights/fields/fields.yml b/packages/azure_application_insights/data_stream/app_insights/fields/fields.yml index 48e5fc5e886..a84fb824ecc 100644 --- a/packages/azure_application_insights/data_stream/app_insights/fields/fields.yml +++ b/packages/azure_application_insights/data_stream/app_insights/fields/fields.yml @@ -12,11 +12,4 @@ - name: end_date type: date description: > - The end date - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: >- - The metrics + The end date \ No newline at end of file diff --git a/packages/azure_application_insights/data_stream/app_insights/fields/package-fields.yml b/packages/azure_application_insights/data_stream/app_insights/fields/package-fields.yml index 4ac170ddf8d..05c60170934 100644 --- a/packages/azure_application_insights/data_stream/app_insights/fields/package-fields.yml +++ b/packages/azure_application_insights/data_stream/app_insights/fields/package-fields.yml @@ -4,6 +4,7 @@ fields: - name: timegrain type: keyword + dimension: true description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -33,15 +35,14 @@ description: > The resource group - - name: tags.* + - name: tags type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure resource tags. - name: namespace type: keyword + dimension: true description: > The namespace selected @@ -55,17 +56,22 @@ description: > The application ID - - name: dimensions.* + - name: dimensions type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure metric dimensions. + - name: dimensions.fingerprint + type: keyword + dimension: true + description: | + Autogenerated ID representing the fingerprint of the azure.dimensions object + - name: metrics.*.* type: object object_type: float object_type_mapping_type: "*" + metric_type: gauge description: > Metrics returned. diff --git a/packages/azure_application_insights/data_stream/app_state/fields/agent.yml b/packages/azure_application_insights/data_stream/app_state/fields/agent.yml index da4e652c53b..2db0bb802e6 100644 --- a/packages/azure_application_insights/data_stream/app_state/fields/agent.yml +++ b/packages/azure_application_insights/data_stream/app_state/fields/agent.yml @@ -62,26 +62,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_application_insights/data_stream/app_state/fields/package-fields.yml b/packages/azure_application_insights/data_stream/app_state/fields/package-fields.yml index 4ac170ddf8d..a3671487091 100644 --- a/packages/azure_application_insights/data_stream/app_state/fields/package-fields.yml +++ b/packages/azure_application_insights/data_stream/app_state/fields/package-fields.yml @@ -33,10 +33,8 @@ description: > The resource group - - name: tags.* + - name: tags type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure resource tags. @@ -55,10 +53,8 @@ description: > The application ID - - name: dimensions.* + - name: dimensions type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure metric dimensions. diff --git a/packages/azure_application_insights/docs/README.md b/packages/azure_application_insights/docs/README.md index 31278492cc9..7d853580754 100644 --- a/packages/azure_application_insights/docs/README.md +++ b/packages/azure_application_insights/docs/README.md @@ -171,13 +171,13 @@ An example event for `app_insights` looks as following: | azure.app_state.users_authenticated.unique | Authenticated users count | float | | azure.app_state.users_count.unique | User count | float | | azure.application_id | The application ID | keyword | -| azure.dimensions.\* | Azure metric dimensions. | flattened | +| azure.dimensions | Azure metric dimensions. | flattened | | azure.metrics.\*.\* | Metrics returned. | object | | azure.namespace | The namespace selected | keyword | | azure.resource.group | The resource group | keyword | | azure.resource.id | The id of the resource | keyword | | azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | flattened | +| azure.resource.tags | Azure resource tags. | flattened | | azure.resource.type | The type of the resource | keyword | | azure.subscription_id | The subscription ID | keyword | | azure.timegrain | The Azure metric timegrain | keyword | diff --git a/packages/azure_application_insights/docs/app_state.md b/packages/azure_application_insights/docs/app_state.md index c7845710dd9..dbc8d7acc52 100644 --- a/packages/azure_application_insights/docs/app_state.md +++ b/packages/azure_application_insights/docs/app_state.md @@ -39,13 +39,13 @@ Costs: Metric queries are charged based on the number of standard API calls. Mor | azure.app_state.users_authenticated.unique | Authenticated users count | float | | azure.app_state.users_count.unique | User count | float | | azure.application_id | The application ID | keyword | -| azure.dimensions.\* | Azure metric dimensions. | flattened | +| azure.dimensions | Azure metric dimensions. | flattened | | azure.metrics.\*.\* | Metrics returned. | object | | azure.namespace | The namespace selected | keyword | | azure.resource.group | The resource group | keyword | | azure.resource.id | The id of the resource | keyword | | azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | flattened | +| azure.resource.tags | Azure resource tags. | flattened | | azure.resource.type | The type of the resource | keyword | | azure.subscription_id | The subscription ID | keyword | | azure.timegrain | The Azure metric timegrain | keyword | diff --git a/packages/azure_application_insights/manifest.yml b/packages/azure_application_insights/manifest.yml index d95791f0d5f..baa34fc4748 100644 --- a/packages/azure_application_insights/manifest.yml +++ b/packages/azure_application_insights/manifest.yml @@ -1,7 +1,6 @@ name: azure_application_insights title: Azure Application Insights Metrics Overview -version: 1.0.5 -release: ga +version: 1.1.0 description: Collect application insights metrics from Azure Monitor with Elastic Agent. type: integration icons: @@ -14,13 +13,13 @@ screenshots: title: App State Overview size: 5120x2562 type: image/png -format_version: 1.0.0 -license: basic +format_version: 2.9.0 categories: - azure - observability conditions: - kibana.version: "^7.14.0 || ^8.0.0" + kibana.version: "^8.9.0" + elastic.subscription: "basic" vars: - name: application_id type: text diff --git a/packages/azure_billing/changelog.yml b/packages/azure_billing/changelog.yml index 8d202cd5da2..2d8827d743a 100644 --- a/packages/azure_billing/changelog.yml +++ b/packages/azure_billing/changelog.yml @@ -1,3 +1,13 @@ +- version: "1.2.0" + changes: + - description: Migrate Azure Billing dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7219 +- version: "1.1.3" + changes: + - description: Fix mappings of tags and dimensions + type: enhancement + link: https://github.com/elastic/integrations/pull/6975 - version: "1.1.2" changes: - description: Added categories and/or subcategories. @@ -5,7 +15,7 @@ link: https://github.com/elastic/integrations/pull/5123 - version: "1.1.1" changes: - - description: Fix documentations formatting (remove extra 'Overview' heading) + - description: Fix documentations formatting (remove extra 'Overview' heading) type: enhancement link: https://github.com/elastic/integrations/pull/4383 - version: "1.1.0" diff --git a/packages/azure_billing/data_stream/billing/fields/agent.yml b/packages/azure_billing/data_stream/billing/fields/agent.yml index da4e652c53b..2db0bb802e6 100644 --- a/packages/azure_billing/data_stream/billing/fields/agent.yml +++ b/packages/azure_billing/data_stream/billing/fields/agent.yml @@ -62,26 +62,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_billing/data_stream/billing/fields/package-fields.yml b/packages/azure_billing/data_stream/billing/fields/package-fields.yml index 4ac170ddf8d..a3671487091 100644 --- a/packages/azure_billing/data_stream/billing/fields/package-fields.yml +++ b/packages/azure_billing/data_stream/billing/fields/package-fields.yml @@ -33,10 +33,8 @@ description: > The resource group - - name: tags.* + - name: tags type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure resource tags. @@ -55,10 +53,8 @@ description: > The application ID - - name: dimensions.* + - name: dimensions type: flattened - object_type: keyword - object_type_mapping_type: "*" description: > Azure metric dimensions. diff --git a/packages/azure_billing/docs/README.md b/packages/azure_billing/docs/README.md index 9721976c70f..2788893ce36 100644 --- a/packages/azure_billing/docs/README.md +++ b/packages/azure_billing/docs/README.md @@ -294,13 +294,13 @@ An example event for `billing` looks as following: | azure.billing.usage_date | The usage date | date | | azure.billing.usage_end | The usage end date | date | | azure.billing.usage_start | The usage start date | date | -| azure.dimensions.\* | Azure metric dimensions. | flattened | +| azure.dimensions | Azure metric dimensions. | flattened | | azure.metrics.\*.\* | Metrics returned. | object | | azure.namespace | The namespace selected | keyword | | azure.resource.group | The resource group | keyword | | azure.resource.id | The id of the resource | keyword | | azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | flattened | +| azure.resource.tags | Azure resource tags. | flattened | | azure.resource.type | The type of the resource | keyword | | azure.subscription_id | The subscription ID | keyword | | azure.timegrain | The Azure metric timegrain | keyword | diff --git a/packages/azure_billing/img/azure-billing-overview.png b/packages/azure_billing/img/azure-billing-overview.png index 0dafde72902..76a2335d490 100644 Binary files a/packages/azure_billing/img/azure-billing-overview.png and b/packages/azure_billing/img/azure-billing-overview.png differ diff --git a/packages/azure_billing/kibana/dashboard/azure_billing-d3efeb30-c1c7-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/dashboard/azure_billing-d3efeb30-c1c7-11ea-b7e7-0f48178cdb3c.json index 8f2ac23ba44..94c2ffdcfbf 100644 --- a/packages/azure_billing/kibana/dashboard/azure_billing-d3efeb30-c1c7-11ea-b7e7-0f48178cdb3c.json +++ b/packages/azure_billing/kibana/dashboard/azure_billing-d3efeb30-c1c7-11ea-b7e7-0f48178cdb3c.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"3983c316-b2b5-40cb-8a49-1a4b17e7868b\":{\"order\":0,\"width\":\"small\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.billing.department_name\",\"title\":\"Department\",\"id\":\"3983c316-b2b5-40cb-8a49-1a4b17e7868b\",\"enhancements\":{}}},\"37e30ae0-44c5-406d-8211-429d57e67eff\":{\"order\":1,\"width\":\"small\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.billing.account_name\",\"title\":\"Account\",\"id\":\"37e30ae0-44c5-406d-8211-429d57e67eff\",\"enhancements\":{}}},\"0bf3bd17-49f6-4c1b-b4a9-afe2d4577aed\":{\"order\":2,\"width\":\"small\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"id\":\"0bf3bd17-49f6-4c1b-b4a9-afe2d4577aed\",\"enhancements\":{}}},\"caf9e826-fb3c-47bb-a533-8ede2b34b7b7\":{\"order\":3,\"width\":\"small\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"caf9e826-fb3c-47bb-a533-8ede2b34b7b7\",\"enhancements\":{}}},\"ee85a301-febf-4d9c-90b2-d414fcdb73e5\":{\"order\":4,\"width\":\"small\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"Resource Name\",\"id\":\"ee85a301-febf-4d9c-90b2-d414fcdb73e5\",\"enhancements\":{}}}}" + }, "description": "This dashboard gives an overview of resource costs and forecast", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,149 +24,740 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 5, - "i": "3202a4c8-ed88-4592-9d39-73846426413b", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "3202a4c8-ed88-4592-9d39-73846426413b", - "panelRefName": "panel_3202a4c8-ed88-4592-9d39-73846426413b", - "title": "", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "55c730ae-441d-4ba7-9642-4d559fc71334": { + "columnOrder": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a", + "f925b265-0368-4070-9b44-dfee175035b0" + ], + "columns": { + "6a63eb28-dbd8-406f-83b1-190909e7997a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of azure.subscription_id", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f925b265-0368-4070-9b44-dfee175035b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.subscription_id" + }, + "f925b265-0368-4070-9b44-dfee175035b0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total costs", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.billing.pretax_cost" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "groups": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a" + ], + "layerId": "55c730ae-441d-4ba7-9642-4d559fc71334", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metric": "f925b265-0368-4070-9b44-dfee175035b0", + "nestedLegend": false, + "numberDisplay": "hidden" + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, - "i": "c18f8802-6189-4966-abe5-30bf2c7c6d63", + "i": "85f7953a-8355-4b7d-b429-daf792f0aa00", "w": 15, "x": 0, - "y": 5 + "y": 0 }, - "panelIndex": "c18f8802-6189-4966-abe5-30bf2c7c6d63", - "panelRefName": "panel_c18f8802-6189-4966-abe5-30bf2c7c6d63", + "panelIndex": "85f7953a-8355-4b7d-b429-daf792f0aa00", "title": "Subscriptions", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.3.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "55c730ae-441d-4ba7-9642-4d559fc71334": { + "columnOrder": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a", + "f925b265-0368-4070-9b44-dfee175035b0" + ], + "columns": { + "6a63eb28-dbd8-406f-83b1-190909e7997a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of azure.resource.group", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f925b265-0368-4070-9b44-dfee175035b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.resource.group" + }, + "f925b265-0368-4070-9b44-dfee175035b0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total costs", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.billing.pretax_cost" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "groups": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a" + ], + "layerId": "55c730ae-441d-4ba7-9642-4d559fc71334", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metric": "f925b265-0368-4070-9b44-dfee175035b0", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, - "i": "0a93b125-de04-466e-a1d0-7b56d1b31b52", + "i": "d855962c-ebf7-482c-b66c-8c37f66c479b", "w": 16, "x": 15, - "y": 5 + "y": 0 }, - "panelIndex": "0a93b125-de04-466e-a1d0-7b56d1b31b52", - "panelRefName": "panel_0a93b125-de04-466e-a1d0-7b56d1b31b52", + "panelIndex": "d855962c-ebf7-482c-b66c-8c37f66c479b", "title": "Resource groups", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.3.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "55c730ae-441d-4ba7-9642-4d559fc71334": { + "columnOrder": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a", + "f925b265-0368-4070-9b44-dfee175035b0" + ], + "columns": { + "6a63eb28-dbd8-406f-83b1-190909e7997a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f925b265-0368-4070-9b44-dfee175035b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f925b265-0368-4070-9b44-dfee175035b0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total costs", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.billing.pretax_cost" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "groups": [ + "6a63eb28-dbd8-406f-83b1-190909e7997a" + ], + "layerId": "55c730ae-441d-4ba7-9642-4d559fc71334", + "layerType": "data", + "legendDisplay": "show", + "metric": "f925b265-0368-4070-9b44-dfee175035b0", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, - "i": "f6b54b8f-b9e5-4c20-9e4c-8f83935ca739", + "i": "227b905d-e912-4f72-ae00-bdfde0e180df", "w": 17, "x": 31, - "y": 5 + "y": 0 }, - "panelIndex": "f6b54b8f-b9e5-4c20-9e4c-8f83935ca739", - "panelRefName": "panel_f6b54b8f-b9e5-4c20-9e4c-8f83935ca739", + "panelIndex": "227b905d-e912-4f72-ae00-bdfde0e180df", "title": "Resources", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.3.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0542e158-84da-47c7-aae6-a492f8cd9913", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0dc3a5de-8297-4425-9c43-f5d0f882e5fe", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0542e158-84da-47c7-aae6-a492f8cd9913": { + "columnOrder": [ + "034b7608-d122-4932-9d69-616244bcfbba", + "7fce3008-7471-42ec-8cd2-bb4d8a1ab36d" + ], + "columns": { + "034b7608-d122-4932-9d69-616244bcfbba": { + "dataType": "date", + "isBucketed": true, + "label": "azure.billing.usage_date", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "24h" + }, + "scale": "interval", + "sourceField": "azure.billing.usage_date" + }, + "7fce3008-7471-42ec-8cd2-bb4d8a1ab36d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.billing.actual_cost: *" + }, + "isBucketed": false, + "label": "Actual costs", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "azure.billing.actual_cost" + } + }, + "incompleteColumns": {} + }, + "0dc3a5de-8297-4425-9c43-f5d0f882e5fe": { + "columnOrder": [ + "54788367-b900-4bc6-8cbf-2c2e7cd65a15", + "6912e4d6-f28b-4ece-a495-3fe6972c0499" + ], + "columns": { + "54788367-b900-4bc6-8cbf-2c2e7cd65a15": { + "dataType": "date", + "isBucketed": true, + "label": "azure.billing.usage_date", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "24h" + }, + "scale": "interval", + "sourceField": "azure.billing.usage_date" + }, + "6912e4d6-f28b-4ece-a495-3fe6972c0499": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.billing.forecast_cost: *" + }, + "isBucketed": false, + "label": "Forecast costs", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "azure.billing.forecast_cost" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.7, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "7fce3008-7471-42ec-8cd2-bb4d8a1ab36d" + ], + "layerId": "0542e158-84da-47c7-aae6-a492f8cd9913", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "034b7608-d122-4932-9d69-616244bcfbba", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(25,77,51,1)", + "forAccessor": "7fce3008-7471-42ec-8cd2-bb4d8a1ab36d" + } + ] + }, + { + "accessors": [ + "6912e4d6-f28b-4ece-a495-3fe6972c0499" + ], + "layerId": "0dc3a5de-8297-4425-9c43-f5d0f882e5fe", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "54788367-b900-4bc6-8cbf-2c2e7cd65a15", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "6912e4d6-f28b-4ece-a495-3fe6972c0499" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, "i": "323f890e-c4d6-4c84-a3d8-f3d4277d3c2f", "w": 48, "x": 0, - "y": 21 + "y": 16 }, "panelIndex": "323f890e-c4d6-4c84-a3d8-f3d4277d3c2f", - "panelRefName": "panel_323f890e-c4d6-4c84-a3d8-f3d4277d3c2f", "title": "Forecast", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.3.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-c5eed79c-ba72-464b-bca3-127247296a65", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "c5eed79c-ba72-464b-bca3-127247296a65": { + "columnOrder": [ + "55213fc7-2095-427a-a223-0f6e7c74e41e", + "77c34830-ab51-456f-8e09-e79eb3dd38f1" + ], + "columns": { + "55213fc7-2095-427a-a223-0f6e7c74e41e": { + "dataType": "date", + "isBucketed": true, + "label": "azure.billing.usage_start", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "24h" + }, + "scale": "interval", + "sourceField": "azure.billing.usage_start" + }, + "77c34830-ab51-456f-8e09-e79eb3dd38f1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Usage Details", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.billing.pretax_cost" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "77c34830-ab51-456f-8e09-e79eb3dd38f1" + ], + "layerId": "c5eed79c-ba72-464b-bca3-127247296a65", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "xAccessor": "55213fc7-2095-427a-a223-0f6e7c74e41e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "77c34830-ab51-456f-8e09-e79eb3dd38f1" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "fb121db4-1343-4e4d-b1a3-e3f3531ae045", "w": 48, "x": 0, - "y": 38 + "y": 33 }, "panelIndex": "fb121db4-1343-4e4d-b1a3-e3f3531ae045", - "panelRefName": "panel_fb121db4-1343-4e4d-b1a3-e3f3531ae045", "title": "Daily usage", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.3.0" } ], "timeRestore": false, "title": "[Azure Billing] Billing overview", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.3.0", "id": "azure_billing-d3efeb30-c1c7-11ea-b7e7-0f48178cdb3c", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.3.0" }, "references": [ { - "id": "azure_billing-82a51dd0-c1d7-11ea-b7e7-0f48178cdb3c", - "name": "3202a4c8-ed88-4592-9d39-73846426413b:panel_3202a4c8-ed88-4592-9d39-73846426413b", - "type": "visualization" + "id": "metrics-*", + "name": "85f7953a-8355-4b7d-b429-daf792f0aa00:indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "d855962c-ebf7-482c-b66c-8c37f66c479b:indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "227b905d-e912-4f72-ae00-bdfde0e180df:indexpattern-datasource-layer-55c730ae-441d-4ba7-9642-4d559fc71334", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "323f890e-c4d6-4c84-a3d8-f3d4277d3c2f:indexpattern-datasource-layer-0542e158-84da-47c7-aae6-a492f8cd9913", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "323f890e-c4d6-4c84-a3d8-f3d4277d3c2f:indexpattern-datasource-layer-0dc3a5de-8297-4425-9c43-f5d0f882e5fe", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "fb121db4-1343-4e4d-b1a3-e3f3531ae045:indexpattern-datasource-layer-c5eed79c-ba72-464b-bca3-127247296a65", + "type": "index-pattern" }, { - "id": "azure_billing-6ffa7e20-c1da-11ea-b7e7-0f48178cdb3c", - "name": "c18f8802-6189-4966-abe5-30bf2c7c6d63:panel_c18f8802-6189-4966-abe5-30bf2c7c6d63", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_3983c316-b2b5-40cb-8a49-1a4b17e7868b:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_billing-b18053b0-c1da-11ea-b7e7-0f48178cdb3c", - "name": "0a93b125-de04-466e-a1d0-7b56d1b31b52:panel_0a93b125-de04-466e-a1d0-7b56d1b31b52", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_37e30ae0-44c5-406d-8211-429d57e67eff:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_billing-c8016f70-c1da-11ea-b7e7-0f48178cdb3c", - "name": "f6b54b8f-b9e5-4c20-9e4c-8f83935ca739:panel_f6b54b8f-b9e5-4c20-9e4c-8f83935ca739", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_0bf3bd17-49f6-4c1b-b4a9-afe2d4577aed:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_billing-9142aca0-c1c7-11ea-b7e7-0f48178cdb3c", - "name": "323f890e-c4d6-4c84-a3d8-f3d4277d3c2f:panel_323f890e-c4d6-4c84-a3d8-f3d4277d3c2f", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_caf9e826-fb3c-47bb-a533-8ede2b34b7b7:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_billing-05d5b3e0-c1c9-11ea-b7e7-0f48178cdb3c", - "name": "fb121db4-1343-4e4d-b1a3-e3f3531ae045:panel_fb121db4-1343-4e4d-b1a3-e3f3531ae045", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_ee85a301-febf-4d9c-90b2-d414fcdb73e5:optionsListDataView", + "type": "index-pattern" } ], - "type": "dashboard", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM0OTksMV0=" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-05d5b3e0-c1c9-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-05d5b3e0-c1c9-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index cc5418cd914..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-05d5b3e0-c1c9-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,91 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Usage Details [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "1f64e4e0-c1c7-11ea-879f-d1f118e66220" - } - ], - "bar_color_rules": [ - { - "id": "20dbcd70-c1c7-11ea-879f-d1f118e66220" - } - ], - "drop_last_bucket": 1, - "gauge_color_rules": [ - { - "id": "22692430-c1c7-11ea-879f-d1f118e66220" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "24h", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "rgba(22,165,165,1)", - "fill": "0.5", - "formatter": "number", - "id": "d09632c0-c120-11ea-b262-d3ff1f3885f8", - "label": "Usage Details", - "line_width": "2", - "metrics": [ - { - "agg_with": "sum", - "field": "azure.billing.pretax_cost", - "id": "d09632c1-c120-11ea-b262-d3ff1f3885f8", - "order": "desc", - "order_by": "@timestamp", - "size": 1, - "type": "sum" - } - ], - "offset_time": "", - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "steps": 0, - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "azure.billing.usage_start", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Usage Details [Azure Billing]", - "type": "metrics" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-05d5b3e0-c1c9-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDUsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-6ffa7e20-c1da-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-6ffa7e20-c1da-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index f7d53366d5c..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-6ffa7e20-c1da-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,83 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Billing subscriptions [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total costs", - "field": "azure.billing.pretax_cost" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "azure.subscription_id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "title": "Billing subscriptions [Azure Billing]", - "type": "pie" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-6ffa7e20-c1da-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDEsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-82a51dd0-c1d7-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-82a51dd0-c1d7-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index 6c324c7e55c..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-82a51dd0-c1d7-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,139 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Billing Filters [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "azure.billing.department_name", - "id": "1594294278147", - "indexPatternRefName": "control_0_index_pattern", - "label": "Department", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.billing.account_name", - "id": "1594294329560", - "indexPatternRefName": "control_1_index_pattern", - "label": "Account", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.subscription_id", - "id": "1549397251041", - "indexPatternRefName": "control_2_index_pattern", - "label": "Subscription", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1549512142947", - "indexPatternRefName": "control_3_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.name", - "id": "1578578146383", - "indexPatternRefName": "control_4_index_pattern", - "label": "Resource Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "Billing Filters [Azure Billing]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-82a51dd0-c1d7-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_3_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_4_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDAsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-9142aca0-c1c7-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-9142aca0-c1c7-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index 76a66e5b1b0..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-9142aca0-c1c7-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,123 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Charges Forecast [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "1f64e4e0-c1c7-11ea-879f-d1f118e66220" - } - ], - "bar_color_rules": [ - { - "id": "20dbcd70-c1c7-11ea-879f-d1f118e66220" - } - ], - "drop_last_bucket": 1, - "gauge_color_rules": [ - { - "id": "22692430-c1c7-11ea-879f-d1f118e66220" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "24h", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(25,77,51,1)", - "fill": "0.7", - "formatter": "number", - "hide_in_legend": 0, - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Actual costs", - "line_width": 1, - "metrics": [ - { - "agg_with": "avg", - "field": "azure.billing.actual_cost", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "order": "desc", - "order_by": "@timestamp", - "size": 1, - "type": "top_hit" - } - ], - "override_index_pattern": 0, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "steps": 1, - "terms_field": "azure.billing.usage_date", - "type": "timeseries", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,188,0,1)", - "fill": "0.5", - "formatter": "number", - "id": "d09632c0-c120-11ea-b262-d3ff1f3885f8", - "label": "Forecast costs", - "line_width": "2", - "metrics": [ - { - "agg_with": "avg", - "field": "azure.billing.forecast_cost", - "id": "d09632c1-c120-11ea-b262-d3ff1f3885f8", - "order": "desc", - "order_by": "@timestamp", - "size": 1, - "type": "top_hit" - } - ], - "offset_time": "", - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "steps": 0, - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "azure.billing.usage_date", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Charges Forecast [Azure Billing]", - "type": "metrics" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-9142aca0-c1c7-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDQsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-b18053b0-c1da-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-b18053b0-c1da-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index 85642f61995..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-b18053b0-c1da-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,84 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Billing resource groups [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total costs", - "field": "azure.billing.pretax_cost" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "azure.resource.group", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "row": true, - "type": "pie" - }, - "title": "Billing resource groups [Azure Billing]", - "type": "pie" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-b18053b0-c1da-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDIsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/kibana/visualization/azure_billing-c8016f70-c1da-11ea-b7e7-0f48178cdb3c.json b/packages/azure_billing/kibana/visualization/azure_billing-c8016f70-c1da-11ea-b7e7-0f48178cdb3c.json deleted file mode 100644 index 7106b9032ed..00000000000 --- a/packages/azure_billing/kibana/visualization/azure_billing-c8016f70-c1da-11ea-b7e7-0f48178cdb3c.json +++ /dev/null @@ -1,84 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Billing resource names [Azure Billing]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total costs", - "field": "azure.billing.pretax_cost" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "azure.resource.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "row": true, - "type": "pie" - }, - "title": "Billing resource names [Azure Billing]", - "type": "pie" - } - }, - "coreMigrationVersion": "8.0.0", - "id": "azure_billing-c8016f70-c1da-11ea-b7e7-0f48178cdb3c", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2021-08-04T16:30:43.912Z", - "version": "WzM1MDMsMV0=" -} \ No newline at end of file diff --git a/packages/azure_billing/manifest.yml b/packages/azure_billing/manifest.yml index cd7898e7fd2..63ae560d91d 100644 --- a/packages/azure_billing/manifest.yml +++ b/packages/azure_billing/manifest.yml @@ -1,7 +1,6 @@ name: azure_billing title: Azure Billing Metrics -version: 1.1.2 -release: ga +version: 1.2.0 description: Collect billing metrics with Elastic Agent. type: integration icons: @@ -14,13 +13,13 @@ screenshots: title: App State Overview size: 5120x2562 type: image/png -format_version: 1.0.0 -license: basic +format_version: 2.9.0 categories: - observability - azure conditions: - kibana.version: "^7.15.0 || ^8.0.0" + kibana.version: "^8.3.0" + elastic.subscription: "basic" vars: - name: client_id type: text diff --git a/packages/azure_blob_storage/_dev/build/build.yml b/packages/azure_blob_storage/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/azure_blob_storage/_dev/build/build.yml +++ b/packages/azure_blob_storage/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/azure_blob_storage/changelog.yml b/packages/azure_blob_storage/changelog.yml index 2ed54ad794f..5fca66792cb 100644 --- a/packages/azure_blob_storage/changelog.yml +++ b/packages/azure_blob_storage/changelog.yml @@ -1,3 +1,18 @@ +- version: 0.7.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "0.4.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/azure_blob_storage/kibana/tags.yml b/packages/azure_blob_storage/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/azure_blob_storage/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/azure_blob_storage/manifest.yml b/packages/azure_blob_storage/manifest.yml index a2710b4f928..9b28b2895a5 100644 --- a/packages/azure_blob_storage/manifest.yml +++ b/packages/azure_blob_storage/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: azure_blob_storage title: Custom Azure Blob Storage Input description: Collect JSON data from configured Azure Blob Storage Container with Elastic Agent. type: integration -version: "0.4.0" +version: "0.7.0" conditions: - kibana.version: "^8.6.2" + kibana: + version: "^8.6.2" categories: - custom - cloud @@ -22,3 +23,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/azure_frontdoor/_dev/build/build.yml b/packages/azure_frontdoor/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/azure_frontdoor/_dev/build/build.yml +++ b/packages/azure_frontdoor/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/azure_frontdoor/changelog.yml b/packages/azure_frontdoor/changelog.yml index 93745091b00..4435ceb2ab1 100644 --- a/packages/azure_frontdoor/changelog.yml +++ b/packages/azure_frontdoor/changelog.yml @@ -1,3 +1,13 @@ +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.0.0" changes: - description: Release Azure Frontdoor as GA. diff --git a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json index 13cee92bcfd..514e24805af 100644 --- a/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json +++ b/packages/azure_frontdoor/data_stream/access/_dev/test/pipeline/test-fdaccess.log-expected.json @@ -30,7 +30,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -129,7 +129,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -222,7 +222,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 788b675d01d..350b11f5514 100644 --- a/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing azure frontdoor access logs processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.category value: [network] diff --git a/packages/azure_frontdoor/data_stream/access/sample_event.json b/packages/azure_frontdoor/data_stream/access/sample_event.json index 1ecb1f8fc58..3974ff97482 100644 --- a/packages/azure_frontdoor/data_stream/access/sample_event.json +++ b/packages/azure_frontdoor/data_stream/access/sample_event.json @@ -40,7 +40,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "d7426e8a-1535-4d9a-8f1e-1d5eab23567b", diff --git a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json index 61b72e9de45..ec56e62a852 100644 --- a/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json +++ b/packages/azure_frontdoor/data_stream/waf/_dev/test/pipeline/test-fdwaf.log-expected.json @@ -24,7 +24,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Log", @@ -91,7 +91,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Block", diff --git a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index 977c9d9d553..1059c648071 100644 --- a/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_frontdoor/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing azure frontdoor waf logs processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.category value: [network] diff --git a/packages/azure_frontdoor/data_stream/waf/sample_event.json b/packages/azure_frontdoor/data_stream/waf/sample_event.json index 84d78cafaa0..098db5b58ff 100644 --- a/packages/azure_frontdoor/data_stream/waf/sample_event.json +++ b/packages/azure_frontdoor/data_stream/waf/sample_event.json @@ -34,7 +34,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "96bfc189-b7b0-43a7-8d45-a95fdac6425b", diff --git a/packages/azure_frontdoor/docs/README.md b/packages/azure_frontdoor/docs/README.md index e1cdb166c63..825c50e470a 100644 --- a/packages/azure_frontdoor/docs/README.md +++ b/packages/azure_frontdoor/docs/README.md @@ -109,10 +109,10 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | | file.size | File size in bytes. Only relevant when `file.type` is "file". | long | @@ -241,10 +241,10 @@ Users can also use this in case of a Hybrid Cloud model, where one may define th | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | | file.size | File size in bytes. Only relevant when `file.type` is "file". | long | diff --git a/packages/azure_frontdoor/kibana/tags.yml b/packages/azure_frontdoor/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/azure_frontdoor/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/azure_frontdoor/manifest.yml b/packages/azure_frontdoor/manifest.yml index 25b862bcace..5d08fc3ab1e 100644 --- a/packages/azure_frontdoor/manifest.yml +++ b/packages/azure_frontdoor/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: azure_frontdoor title: "Azure Frontdoor" -version: "1.0.0" +version: "1.2.0" description: "This Elastic integration collects logs from Azure Frontdoor." type: integration categories: diff --git a/packages/azure_functions/LICENSE.txt b/packages/azure_functions/LICENSE.txt new file mode 100644 index 00000000000..809108b857f --- /dev/null +++ b/packages/azure_functions/LICENSE.txt @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. diff --git a/packages/azure_functions/_dev/build/build.yml b/packages/azure_functions/_dev/build/build.yml new file mode 100644 index 00000000000..47cbed9fed8 --- /dev/null +++ b/packages/azure_functions/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.0.0 diff --git a/packages/azure_functions/_dev/build/docs/README.md b/packages/azure_functions/_dev/build/docs/README.md new file mode 100644 index 00000000000..42c03120057 --- /dev/null +++ b/packages/azure_functions/_dev/build/docs/README.md @@ -0,0 +1,204 @@ +# Azure Functions + +The Azure Functions integration allows you to monitor Azure Functions. Azure Functions is an event-driven, serverless compute platform that helps you develop more efficiently using the programming language of your choice. Triggers cause a function to run. A trigger defines how a function is invoked and a function must have exactly one trigger. + +Use this integration to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information. + + +## Data streams +The Azure Functions integration contains two data streams: [Function App Logs](#logs) and [Metrics](#metrics) + +### Logs + +Supported log categories: + +| Log Category | Description | +|:----------------------------:|:------------------------------------------------------------------------------------------------------------------------------------:| +| Functionapplogs | Function app logs. | + + +#### Requirements and setup + +Refer to the [Azure Logs](https://docs.elastic.co/integrations/azure) page for more information about setting up and using this integration. + +#### Configuration options +`eventhub` : + _string_ +An Event Hub is a fully managed, real-time data ingestion service. Elastic recommends using only letters, numbers, and the hyphen (-) character for Event Hub names to maximize compatibility. You can use existing Event Hubs having underscores (_) in the Event Hub name; in this case, the integration will replace underscores with hyphens (-) when it uses the Event Hub name to create dependent Azure resources behind the scenes (e.g., the storage account container to store Event Hub consumer offsets). Elastic also recommends using a separate event hub for each log type as the field mappings of each log type differ. +Default value `insights-operational-logs`. + +`consumer_group` : +_string_ + The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string is required to communicate with Event Hubs, see steps [here](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string). + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the Azure logs package it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account where the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`storage_account_container` : +_string_ +The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You MUST use a dedicated storage account container for each Azure log type (activity, sign-in, audit logs, and others). DO NOT REUSE the same container name for more than one Azure log type. See [Container Names](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names) for details on naming rules from Microsoft. The integration generates a default container name if not specified. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the Azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different Azure environment. + +Resource manager endpoints: + +```text +# Azure ChinaCloud +https://management.chinacloudapi.cn/ + +# Azure GermanCloud +https://management.microsoftazure.de/ + +# Azure PublicCloud +https://management.azure.com/ + +# Azure USGovernmentCloud +https://management.usgovcloudapi.net/ +``` + +{{event "functionapplogs"}} + +{{fields "functionapplogs"}} + +### Metrics +**Metrics** give you insight into the performance of your Azure Function Apps. The integration includes an out-of-the-box dashboard for visualising the monitoring data generated by apps hosted in Azure Functions. + +#### Requirements + +To use this integration you will need: + +* **Azure App Registration**: You need to set up an Azure App Registration to allow the Agent to access the Azure APIs. The App Registration requires the Monitoring Reader role to access to be able to collect metrics from Function Apps. See more details in the Setup section. +* **Elasticsearch and Kibana**: You need Elasticsearch to store and search your data and Kibana to visualize and manage it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, the [Native Azure Integration](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.elasticsearch?tab=Overview), or self-manage the Elastic Stack on your hardware. + +#### Setup + + +```text + ┌────────────────────┐ ┌─────────┐ ┌─-─────────────────────┐ + │ │ │ │ │ azure.functions │ + │ Azure APIs │──────▶│ Agent │──────▶│ <> │ + │ │ │ │ │ │ + └────────────────────┘ └─────────┘ └───-───────────────────┘ +``` + +Elastic Agent needs an App Registration to access Azure on your behalf to collect data using the Azure REST APIs. App Registrations are required to access Azure APIs programmatically. + +To start collecting data with this integration, you need to: + +* Set up a new Azure app registration by registering an app, adding credentials, and assigning an appropriate role. +* Specify integration [settings](#main-options) in Kibana, which will determine how the integration will access the Azure APIs. + +#### Register a new app + +To create a new app registration: + +1. Sign in to the [Azure Portal](https://portal.azure.com/). +2. Search for and select **Azure Active Directory**. +3. Under **Manage**, select **App registrations** > **New registration**. +4. Enter a display _Name_ for your application (for example, "elastic-agent"). +5. Specify who can use the application. +6. Don't enter anything for _Redirect URI_. This is optional and the agent doesn't use it. +7. Select **Register** to complete the initial app registration. + +Take note of the **Application (client) ID**, which you will use later when specifying the **Client ID** in the integration settings. + +#### Add credentials + +Credentials allow your application to access Azure APIs and authenticate itself, requiring no interaction from a user at runtime. + +This integration uses Client Secrets to prove its identity. + +1. In the [Azure Portal](https://portal.azure.com/), select the application you created in the previous section. +2. Select **Certificates & secrets** > **Client secrets** > **New client secret**. +3. Add a description (for example, "Elastic Agent client secrets"). +4. Select an expiration for the secret or specify a custom lifetime. +5. Select **Add**. + +Take note of the content in the **Value** column in the **Client secrets** table, which you will use later when specifying a **Client Secret** in the integration settings. **This secret value is never displayed again after you leave this page.** Record the secret's value in a safe place. + +#### Assign role + +1. In the [Azure Portal](https://portal.azure.com/), search for and select **Subscriptions**. +2. Select the subscription to assign the application. +3. Select **Access control (IAM)**. +4. Select **Add** > **Add role assignment** to open the _Add role assignment page_. +5. In the **Role** tab, search and select the role **Monitoring Reader**. +6. Select the **Next** button to move to the **Members** tab. +7. Select **Assign access to** > **User, group, or service principal**, and select **Select members**. This page does not display Azure AD applications in the available options by default. +8. To find your application, search by name (for example, "elastic-agent") and select it from the list. +9. Click the **Select** button. +10. Then click the **Review + assign** button. + +Take note of the following values, which you will use later when specifying settings. + +* `Subscription ID`: use the content of the "Subscription ID" you selected. +* `Tenant ID`: use the "Tenant ID" from the Azure Active Directory you use. + +Your App Registration is now ready to be used with the Elastic Agent. + +#### Additional Resources + +If you want to learn more about this process, you can read these two general guides from Microsoft: + +* [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app) +* [Use the portal to create an Azure AD application and service principal that can access resources](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) + +#### Main options + +The settings' main section contains all the options needed to access the Azure APIs and collect the Azure Functions metrics data. You will now use all the values from [App registration](#register-a-new-app) including: + +`Client ID` _string_ +: The unique identifier of the App Registration (sometimes referred to as Application ID). + +`Client Secret` _string_ +: The client secret for authentication. + +`Subscription ID` _string_ +: The unique identifier for the Azure subscription. You can provide just one subscription ID. The Agent uses this ID to access Azure APIs. + +`Tenant ID` _string_ +: The unique identifier of the Azure Active Directory's Tenant ID. + +#### Advanced options + +There are two additional advanced options: + +`Resource Manager Endpoint` _string_ +: Optional. By default, the integration uses the Azure public environment. To override, users can provide a specific resource manager endpoint to use a different Azure environment. + +Examples: + +* `https://management.chinacloudapi.cn` for Azure ChinaCloud +* `https://management.microsoftazure.de` for Azure GermanCloud +* `https://management.azure.com` for Azure PublicCloud +* `https://management.usgovcloudapi.net` for Azure USGovernmentCloud + +`Active Directory Endpoint` _string_ +: Optional. By default, the integration uses the associated Active Directory Endpoint. To override, users can provide a specific active directory endpoint to use a different Azure environment. + +Examples: + +* `https://login.chinacloudapi.cn` for Azure ChinaCloud +* `https://login.microsoftonline.de` for Azure GermanCloud +* `https://login.microsoftonline.com` for Azure PublicCloud +* `https://login.microsoftonline.us` for Azure USGovernmentCloud + +#### Metrics Reference + +{{event "metrics"}} + +{{fields "metrics"}} diff --git a/packages/azure_functions/changelog.yml b/packages/azure_functions/changelog.yml new file mode 100644 index 00000000000..b32204fde0b --- /dev/null +++ b/packages/azure_functions/changelog.yml @@ -0,0 +1,11 @@ +# newer versions go on top +- version: "0.1.0" + changes: + - description: Add Azure Functions metrics data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/7130 +- version: "0.0.1" + changes: + - description: Add Azure Functions logs data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/6417 diff --git a/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log new file mode 100644 index 00000000000..b316ff83cd2 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log @@ -0,0 +1 @@ +{"time":"2023-06-07T11:33:11Z","resourceId":"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION","category":"FunctionAppLogs","operationName":"Microsoft.Web/sites/functions/log","level":"Error","location":"East US","properties":{"appName":"mbranca-test-function","roleInstance":"54108609-638217294083255145","message":"Executed Functions.hello (Failed, Id=3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e, Duration=16ms)","category":"Function.hello","hostVersion":"4.21.3.3","functionInvocationId":"3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e","functionName":"Functions.hello","hostInstanceId":"8699ec76-436a-43e2-a811-371c8e1472d7","level":"Error","levelId":4,"processId":64,"exceptionDetails":"Microsoft.Azure.WebJobs.Host.FunctionInvocationException : Exception while executing function: Functions.hello ---> Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException : Result: Failure\nException: Exception: Ka-booom!\nStack: File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 479, in _handle__invocation_request\n call_result = await self._loop.run_in_executor(\n File \"/usr/local/lib/python3.9/concurrent/futures/thread.py\", line 58, in run\n result = self.fn(*self.args, **self.kwargs)\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 752, in _run_sync_func\n return ExtensionManager.get_sync_invocation_wrapper(context,\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\", line 215, in _raw_invocation_wrapper\n result = function(**args)\n File \"/home/site/wwwroot/hello/__init__.py\", line 22, in main\n raise Exception(\"Ka-booom!\")\n\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.WorkerFunctionInvoker.InvokeCore(Object[] parameters,FunctionInvocationContext context) at /src/azure-functions-host/src/WebJobs.Script/Description/Workers/WorkerFunctionInvoker.cs : 101\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionInvokerBase.Invoke(Object[] parameters) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionInvokerBase.cs : 82\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionGenerator.Coerce[T](Task`1 src) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionGenerator.cs : 225\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync[TReflected,TReturnValue](Object instance,Object[] arguments) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionInvoker.cs : 52\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker,ParameterHelper parameterHelper,CancellationTokenSource timeoutTokenSource,CancellationTokenSource functionCancellationTokenSource,Boolean throwOnTimeout,TimeSpan timerInterval,IFunctionInstance instance) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 581\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance,ParameterHelper parameterHelper,ILogger logger,CancellationTokenSource functionCancellationTokenSource) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 527\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 306\n End of inner exception\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 352\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.TryExecuteAsync(IFunctionInstance functionInstance,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 108","exceptionMessage":"Result: Failure\nException: Exception: Ka-booom!\nStack: File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 479, in _handle__invocation_request\n call_result = await self._loop.run_in_executor(\n File \"/usr/local/lib/python3.9/concurrent/futures/thread.py\", line 58, in run\n result = self.fn(*self.args, **self.kwargs)\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 752, in _run_sync_func\n return ExtensionManager.get_sync_invocation_wrapper(context,\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\", line 215, in _raw_invocation_wrapper\n result = function(**args)\n File \"/home/site/wwwroot/hello/__init__.py\", line 22, in main\n raise Exception(\"Ka-booom!\")\n","exceptionType":"Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException","eventId":3,"eventName":"FunctionCompleted"}} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log-expected.json b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log-expected.json new file mode 100644 index 00000000000..6e6ff04875e --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-error-raw.log-expected.json @@ -0,0 +1,56 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-07T11:33:11.000Z", + "azure": { + "category": "FunctionAppLogs", + "function": { + "app_name": "mbranca-test-function", + "category": "Function.hello", + "event_id": 3, + "event_name": "FunctionCompleted", + "exception_details": "Microsoft.Azure.WebJobs.Host.FunctionInvocationException : Exception while executing function: Functions.hello ---\u003e Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException : Result: Failure\nException: Exception: Ka-booom!\nStack: File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 479, in _handle__invocation_request\n call_result = await self._loop.run_in_executor(\n File \"/usr/local/lib/python3.9/concurrent/futures/thread.py\", line 58, in run\n result = self.fn(*self.args, **self.kwargs)\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 752, in _run_sync_func\n return ExtensionManager.get_sync_invocation_wrapper(context,\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\", line 215, in _raw_invocation_wrapper\n result = function(**args)\n File \"/home/site/wwwroot/hello/__init__.py\", line 22, in main\n raise Exception(\"Ka-booom!\")\n\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.WorkerFunctionInvoker.InvokeCore(Object[] parameters,FunctionInvocationContext context) at /src/azure-functions-host/src/WebJobs.Script/Description/Workers/WorkerFunctionInvoker.cs : 101\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionInvokerBase.Invoke(Object[] parameters) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionInvokerBase.cs : 82\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionGenerator.Coerce[T](Task`1 src) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionGenerator.cs : 225\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync[TReflected,TReturnValue](Object instance,Object[] arguments) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionInvoker.cs : 52\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker,ParameterHelper parameterHelper,CancellationTokenSource timeoutTokenSource,CancellationTokenSource functionCancellationTokenSource,Boolean throwOnTimeout,TimeSpan timerInterval,IFunctionInstance instance) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 581\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance,ParameterHelper parameterHelper,ILogger logger,CancellationTokenSource functionCancellationTokenSource) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 527\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 306\n End of inner exception\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 352\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.TryExecuteAsync(IFunctionInstance functionInstance,CancellationToken cancellationToken) at D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs : 108", + "exception_message": "Result: Failure\nException: Exception: Ka-booom!\nStack: File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 479, in _handle__invocation_request\n call_result = await self._loop.run_in_executor(\n File \"/usr/local/lib/python3.9/concurrent/futures/thread.py\", line 58, in run\n result = self.fn(*self.args, **self.kwargs)\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\", line 752, in _run_sync_func\n return ExtensionManager.get_sync_invocation_wrapper(context,\n File \"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\", line 215, in _raw_invocation_wrapper\n result = function(**args)\n File \"/home/site/wwwroot/hello/__init__.py\", line 22, in main\n raise Exception(\"Ka-booom!\")\n", + "exception_type": "Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException", + "host_instance_id": "8699ec76-436a-43e2-a811-371c8e1472d7", + "host_version": "4.21.3.3", + "invocation_id": "3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e", + "level": "Error", + "level_id": 4, + "message": "Executed Functions.hello (Failed, Id=3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e, Duration=16ms)", + "name": "Functions.hello", + "process_id": 64, + "role_instance": "54108609-638217294083255145" + }, + "operation_name": "Microsoft.Web/sites/functions/log", + "resource": { + "group": "TEST-RG", + "id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION", + "name": "TEST-FUNCTION", + "provider": "MICROSOFT.WEB/SITES" + }, + "subscription_id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "cloud": { + "account": { + "id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "provider": "azure" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "original": "{\"time\":\"2023-06-07T11:33:11Z\",\"resourceId\":\"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION\",\"category\":\"FunctionAppLogs\",\"operationName\":\"Microsoft.Web/sites/functions/log\",\"level\":\"Error\",\"location\":\"East US\",\"properties\":{\"appName\":\"mbranca-test-function\",\"roleInstance\":\"54108609-638217294083255145\",\"message\":\"Executed Functions.hello (Failed, Id=3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e, Duration=16ms)\",\"category\":\"Function.hello\",\"hostVersion\":\"4.21.3.3\",\"functionInvocationId\":\"3a4b2e78-0549-4ebc-ba4c-ee9a6bc9a04e\",\"functionName\":\"Functions.hello\",\"hostInstanceId\":\"8699ec76-436a-43e2-a811-371c8e1472d7\",\"level\":\"Error\",\"levelId\":4,\"processId\":64,\"exceptionDetails\":\"Microsoft.Azure.WebJobs.Host.FunctionInvocationException : Exception while executing function: Functions.hello ---\u003e Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException : Result: Failure\\nException: Exception: Ka-booom!\\nStack: File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\\\", line 479, in _handle__invocation_request\\n call_result = await self._loop.run_in_executor(\\n File \\\"/usr/local/lib/python3.9/concurrent/futures/thread.py\\\", line 58, in run\\n result = self.fn(*self.args, **self.kwargs)\\n File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\\\", line 752, in _run_sync_func\\n return ExtensionManager.get_sync_invocation_wrapper(context,\\n File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\\\", line 215, in _raw_invocation_wrapper\\n result = function(**args)\\n File \\\"/home/site/wwwroot/hello/__init__.py\\\", line 22, in main\\n raise Exception(\\\"Ka-booom!\\\")\\n\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Script.Description.WorkerFunctionInvoker.InvokeCore(Object[] parameters,FunctionInvocationContext context) at /src/azure-functions-host/src/WebJobs.Script/Description/Workers/WorkerFunctionInvoker.cs : 101\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionInvokerBase.Invoke(Object[] parameters) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionInvokerBase.cs : 82\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Script.Description.FunctionGenerator.Coerce[T](Task`1 src) at /src/azure-functions-host/src/WebJobs.Script/Description/FunctionGenerator.cs : 225\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync[TReflected,TReturnValue](Object instance,Object[] arguments) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionInvoker.cs : 52\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker,ParameterHelper parameterHelper,CancellationTokenSource timeoutTokenSource,CancellationTokenSource functionCancellationTokenSource,Boolean throwOnTimeout,TimeSpan timerInterval,IFunctionInstance instance) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionExecutor.cs : 581\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance,ParameterHelper parameterHelper,ILogger logger,CancellationTokenSource functionCancellationTokenSource) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionExecutor.cs : 527\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionExecutor.cs : 306\\n End of inner exception\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance,FunctionStartedMessage message,FunctionInstanceLogEntry instanceLogEntry,ParameterHelper parameterHelper,ILogger logger,CancellationToken cancellationToken) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionExecutor.cs : 352\\n at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()\\n at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.TryExecuteAsync(IFunctionInstance functionInstance,CancellationToken cancellationToken) at D:\\\\a\\\\_work\\\\1\\\\s\\\\src\\\\Microsoft.Azure.WebJobs.Host\\\\Executors\\\\FunctionExecutor.cs : 108\",\"exceptionMessage\":\"Result: Failure\\nException: Exception: Ka-booom!\\nStack: File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\\\", line 479, in _handle__invocation_request\\n call_result = await self._loop.run_in_executor(\\n File \\\"/usr/local/lib/python3.9/concurrent/futures/thread.py\\\", line 58, in run\\n result = self.fn(*self.args, **self.kwargs)\\n File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/dispatcher.py\\\", line 752, in _run_sync_func\\n return ExtensionManager.get_sync_invocation_wrapper(context,\\n File \\\"/azure-functions-host/workers/python/3.9/LINUX/X64/azure_functions_worker/extension.py\\\", line 215, in _raw_invocation_wrapper\\n result = function(**args)\\n File \\\"/home/site/wwwroot/hello/__init__.py\\\", line 22, in main\\n raise Exception(\\\"Ka-booom!\\\")\\n\",\"exceptionType\":\"Microsoft.Azure.WebJobs.Script.Workers.Rpc.RpcException\",\"eventId\":3,\"eventName\":\"FunctionCompleted\"}}" + }, + "observer": { + "product": "Azure Functions", + "type": "functions", + "vendor": "Azure" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log new file mode 100644 index 00000000000..775330393e4 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log @@ -0,0 +1 @@ +{"time":"2023-05-23T20:11:59Z","resourceId":"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION","category":"FunctionAppLogs","operationName":"Microsoft.Web/sites/functions/log","level":"Informational","location":"East US","properties":{"appName":"test-function","roleInstance":"54108609-638204200593759681","message":"Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)","category":"Function.hello","hostVersion":"4.19.2.2","functionInvocationId":"d878e365-b3d6-4796-9292-7500acd0c677","functionName":"Functions.hello","hostInstanceId":"bb84c437-4c26-4d0b-a06d-7fc2f16976e3","level":"Information","levelId":2,"processId":67,"eventId":1,"eventName":"FunctionStarted"}} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log-expected.json b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log-expected.json new file mode 100644 index 00000000000..d2d387f78ad --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-azure-functions-raw.log-expected.json @@ -0,0 +1,53 @@ +{ + "expected": [ + { + "@timestamp": "2023-05-23T20:11:59.000Z", + "azure": { + "category": "FunctionAppLogs", + "function": { + "app_name": "test-function", + "category": "Function.hello", + "event_id": 1, + "event_name": "FunctionStarted", + "host_instance_id": "bb84c437-4c26-4d0b-a06d-7fc2f16976e3", + "host_version": "4.19.2.2", + "invocation_id": "d878e365-b3d6-4796-9292-7500acd0c677", + "level": "Information", + "level_id": 2, + "message": "Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)", + "name": "Functions.hello", + "process_id": 67, + "role_instance": "54108609-638204200593759681" + }, + "operation_name": "Microsoft.Web/sites/functions/log", + "resource": { + "group": "TEST-RG", + "id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION", + "name": "TEST-FUNCTION", + "provider": "MICROSOFT.WEB/SITES" + }, + "subscription_id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "cloud": { + "account": { + "id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "provider": "azure" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "original": "{\"time\":\"2023-05-23T20:11:59Z\",\"resourceId\":\"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION\",\"category\":\"FunctionAppLogs\",\"operationName\":\"Microsoft.Web/sites/functions/log\",\"level\":\"Informational\",\"location\":\"East US\",\"properties\":{\"appName\":\"test-function\",\"roleInstance\":\"54108609-638204200593759681\",\"message\":\"Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)\",\"category\":\"Function.hello\",\"hostVersion\":\"4.19.2.2\",\"functionInvocationId\":\"d878e365-b3d6-4796-9292-7500acd0c677\",\"functionName\":\"Functions.hello\",\"hostInstanceId\":\"bb84c437-4c26-4d0b-a06d-7fc2f16976e3\",\"level\":\"Information\",\"levelId\":2,\"processId\":67,\"eventId\":1,\"eventName\":\"FunctionStarted\"}}" + }, + "observer": { + "product": "Azure Functions", + "type": "functions", + "vendor": "Azure" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-common-config.yml b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/azure_functions/data_stream/functionapplogs/agent/stream/azure-eventhub.yml.hbs b/packages/azure_functions/data_stream/functionapplogs/agent/stream/azure-eventhub.yml.hbs new file mode 100644 index 00000000000..c19cad5fd98 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/agent/stream/azure-eventhub.yml.hbs @@ -0,0 +1,46 @@ +{{#if connection_string}} +connection_string: {{connection_string}} +{{/if}} +{{#if storage_account_container }} +storage_account_container: {{storage_account_container}} +{{else}} +{{#if eventhub}} +storage_account_container: filebeat-functionlogs-{{eventhub}} +{{/if}} +{{/if}} +{{#if eventhub}} +eventhub: {{eventhub}} +{{/if}} +{{#if consumer_group}} +consumer_group: {{consumer_group}} +{{/if}} +{{#if storage_account}} +storage_account: {{storage_account}} +{{/if}} +{{#if storage_account_key}} +storage_account_key: {{storage_account_key}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} +sanitize_options: +{{#if sanitize_singlequotes}} + - SINGLE_QUOTES +{{/if}} +{{#if sanitize_newlines}} + - NEW_LINES +{{/if}} diff --git a/packages/azure_functions/data_stream/functionapplogs/agent/stream/stream.yml.hbs b/packages/azure_functions/data_stream/functionapplogs/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..d0bec8af049 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/agent/stream/stream.yml.hbs @@ -0,0 +1,19 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml b/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml new file mode 100644 index 00000000000..4aedfe2d61d --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml @@ -0,0 +1,33 @@ +--- +description: Pipeline for parsing Azure shared log fields. +processors: + - set: + field: cloud.provider + value: azure + - grok: + field: azure.resource_id + if: 'ctx.azure?.subscription_id == null' + patterns: + - (?i)/subscriptions/%{SUBID:azure.subscription_id}/resourceGroups/%{GROUPID:azure.resource.group}/providers/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name} + pattern_definitions: + SUBID: (\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1} + GROUPID: .+ + PROVIDERNAME: ([A-Za-z])\w+.([A-Za-z])\w+/([A-Za-z])\w+. + NAME: .+$ + ignore_failure: false + - rename: + field: azure.resource_id + target_field: azure.resource.id + ignore_missing: true + - lowercase: + field: event.outcome + ignore_missing: true + - set: + field: cloud.account.id + copy_from: azure.subscription_id + ignore_empty_value: true +on_failure: + - set: + field: error.message + value: '{{ _ingest.on_failure_message }}' + diff --git a/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..7f03f972f1e --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,157 @@ +--- +description: Pipeline for processing Azure Function logs. +processors: + - set: + field: ecs.version + value: '8.8.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' + + # Converts the JSON string in the event.original field into a structured JSON object + - json: + field: event.original + target_field: json + on_failure: + - set: + field: error.message + value: 'Received invalid JSON from the Azure Function service. Unable to parse the source log message' + ignore_failure: true + - date: + field: json.time + target_field: '@timestamp' + ignore_failure: true + formats: + - ISO8601 + if: ctx.json?.time != null + - rename: + field: json.category + target_field: azure.category + ignore_missing: true + - rename: + field: json.resourceId + target_field: azure.resource_id + ignore_missing: true + - rename: + field: json.operationName + target_field: azure.operation_name + ignore_missing: true + - rename: + field: json.properties.level + target_field: azure.function.level + ignore_missing: true + - rename: + field: json.properties.levelId + target_field: azure.function.level_id + ignore_missing: true + - rename: + field: json.properties.appName + target_field: azure.function.app_name + ignore_missing: true + - rename: + field: json.properties.category + target_field: azure.function.category + ignore_missing: true + - rename: + field: json.properties.roleInstance + target_field: azure.function.role_instance + ignore_missing: true + - rename: + field: json.properties.hostVersion + target_field: azure.function.host_version + ignore_missing: true + - rename: + field: json.properties.functionInvocationId + target_field: azure.function.invocation_id + ignore_missing: true + - rename: + field: json.properties.functionName + target_field: azure.function.name + ignore_missing: true + - rename: + field: json.properties.hostInstanceId + target_field: azure.function.host_instance_id + ignore_missing: true + - rename: + field: json.properties.processId + target_field: azure.function.process_id + ignore_missing: true + - rename: + field: json.properties.eventName + target_field: azure.function.event_name + ignore_missing: true + - rename: + field: json.properties.eventId + target_field: azure.function.event_id + ignore_missing: true + - rename: + field: json.properties.message + target_field: azure.function.message + ignore_missing: true + - set: + field: observer.type + value: functions + - set: + field: observer.vendor + value: Azure + - set: + field: observer.product + value: "Azure Functions" + - rename: + field: json.properties.exceptionDetails + target_field: azure.function.exception_details + ignore_missing: true + - rename: + field: json.properties.exceptionMessage + target_field: azure.function.exception_message + ignore_missing: true + - rename: + field: json.properties.exceptionType + target_field: azure.function.exception_type + ignore_missing: true + - remove: + field: + - json + ignore_missing: true + - pipeline: + name: '{{ IngestPipeline "azure-shared-pipeline" }}' + - remove: + field: event.original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + ignore_failure: true + ignore_missing: true + - script: + description: Drops null/empty values recursively. + lang: painless + source: | + boolean dropEmptyFields(Object object) { + if (object == null || object == "") { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(value -> dropEmptyFields(value)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(value -> dropEmptyFields(value)); + return (((List) object).length == 0); + } + return false; + } + dropEmptyFields(ctx); +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }} {{ _ingest.on_failure_processor_type }}" + - remove: + field: + - json + - _conf + - message + ignore_missing: true diff --git a/packages/azure_functions/data_stream/functionapplogs/fields/base-fields.yml b/packages/azure_functions/data_stream/functionapplogs/fields/base-fields.yml new file mode 100644 index 00000000000..a9a65458fc5 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/fields/base-fields.yml @@ -0,0 +1,21 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/azure_functions/data_stream/functionapplogs/fields/ecs.yml b/packages/azure_functions/data_stream/functionapplogs/fields/ecs.yml new file mode 100644 index 00000000000..aace162dae1 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/fields/ecs.yml @@ -0,0 +1,40 @@ +- name: cloud.account.id + external: ecs +- name: cloud.provider + external: ecs +- name: ecs.version + external: ecs +- name: observer.product + external: ecs +- name: observer.type + external: ecs +- name: observer.vendor + external: ecs +- name: observer.name + external: ecs +- name: tags + external: ecs +- name: message + external: ecs +- name: event.id + external: ecs +- name: event.duration + external: ecs +- name: event.original + external: ecs +- name: event.type + external: ecs +- name: event.action + external: ecs +- name: event.kind + external: ecs +- name: event.category + external: ecs +- name: event.code + external: ecs +- name: error.message + external: ecs +- name: error.stack_trace + external: ecs +- name: error.type + external: ecs diff --git a/packages/azure_functions/data_stream/functionapplogs/fields/fields.yml b/packages/azure_functions/data_stream/functionapplogs/fields/fields.yml new file mode 100644 index 00000000000..4aa70058c4f --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/fields/fields.yml @@ -0,0 +1,60 @@ +- name: azure + type: group + fields: + - name: category + type: keyword + description: The log category name. + - name: operation_name + type: keyword + description: The operation name. + - name: function + type: group + fields: + - name: app_name + type: keyword + description: The Function application name. + - name: category + type: keyword + description: The category of the operation. + - name: role_instance + type: keyword + description: The role instance ID. + - name: name + type: keyword + description: The name of the function that logged the message. + - name: message + type: keyword + description: The log message. + - name: host_version + type: keyword + description: The Functions host version. + - name: invocation_id + type: keyword + description: The invocation ID that logged the message. + - name: host_instance_id + type: keyword + description: The host instance ID. + - name: process_id + type: long + description: The process ID. + - name: event_id + type: long + description: The event ID. + - name: event_name + type: keyword + description: The event name. + - name: exception_details + type: match_only_text + description: The exception details. This includes the exception type, message, and stack trace. + - name: exception_message + type: match_only_text + description: The exception message. + - name: exception_type + type: keyword + description: The exception type. + - name: level + type: keyword + description: The log level. Valid values are Trace, Debug, Information, Warning, Error, or Critical. + - name: level_id + type: long + description: The integer value of the log level. Valid values are 0 (Trace), 1 (Debug), 2 (Information), 3 (Warning), 4 (Error), or 5 (Critical). diff --git a/packages/azure_functions/data_stream/functionapplogs/fields/package-fields.yml b/packages/azure_functions/data_stream/functionapplogs/fields/package-fields.yml new file mode 100644 index 00000000000..6d9f4ccb2a7 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/fields/package-fields.yml @@ -0,0 +1,30 @@ +- name: azure + type: group + fields: + - name: subscription_id + type: keyword + description: | + Azure subscription ID + - name: tenant_id + type: keyword + description: | + tenant ID + - name: resource + type: group + fields: + - name: id + type: keyword + description: | + Resource ID + - name: group + type: keyword + description: | + Azure Resource group + - name: name + type: keyword + description: | + Name + - name: provider + type: keyword + description: | + Resource type/namespace diff --git a/packages/azure_functions/data_stream/functionapplogs/manifest.yml b/packages/azure_functions/data_stream/functionapplogs/manifest.yml new file mode 100644 index 00000000000..757eec822bd --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/manifest.yml @@ -0,0 +1,98 @@ +title: Collect Azure Functions logs +type: logs +streams: + - input: "azure-eventhub" + enabled: false + template_path: "azure-eventhub.yml.hbs" + title: Azure Functions logs + description: Collect Azure Functions logs using azure-eventhub input + vars: + - name: eventhub + type: text + title: Event Hub + multi: false + required: true + show_user: true + description: >- + Elastic recommends using one event hub for each integration. Visit [Create an event hub](https://docs.elastic.co/integrations/azure#create-an-event-hub) to learn more. Use event hub names up to 30 characters long to avoid compatibility issues. + - name: consumer_group + type: text + title: Consumer Group + multi: false + required: true + show_user: true + default: $Default + - name: connection_string + type: password + title: Connection String + multi: false + required: true + show_user: true + description: >- + The connection string required to communicate with Event Hubs. See [Get an Event Hubs connection string](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string) to learn more. + - name: storage_account + type: text + title: Storage Account + multi: false + required: true + show_user: true + description: >- + The name of the storage account where the consumer group's state/offsets will be stored and updated. + - name: storage_account_key + type: password + title: Storage Account Key + multi: false + required: true + show_user: true + description: >- + The storage account key, this key will be used to authorize access to data in your storage account. + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: storage_account_container + type: text + title: Storage Account Container + multi: false + required: false + show_user: false + description: > + The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You MUST use a dedicated storage account container for each Azure log type (activity, sign-in, audit logs, and others). DO NOT REUSE the same container name for more than one Azure log type. See [Container Names](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names) for details on naming rules from Microsoft. The integration generates a default container name if not specified. + + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - azure-functions + - forwarded + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + - name: sanitize_newlines + title: Sanitize New Lines + description: Removes new lines in logs to ensure proper formatting of JSON data and avoid parsing issues during processing. + type: bool + show_user: false + multi: false + required: false + default: false + - name: sanitize_singlequotes + title: Sanitize Single Quotes + description: Replaces single quotes with double quotes (single quotes inside double quotes are omitted) in logs to ensure proper formatting of JSON data and avoid parsing issues during processing. + type: bool + show_user: false + multi: false + required: false + default: true diff --git a/packages/azure_functions/data_stream/functionapplogs/sample_event.json b/packages/azure_functions/data_stream/functionapplogs/sample_event.json new file mode 100644 index 00000000000..ee4b4de8c87 --- /dev/null +++ b/packages/azure_functions/data_stream/functionapplogs/sample_event.json @@ -0,0 +1,48 @@ +{ + "@timestamp": "2023-05-23T20:11:59.000Z", + "azure": { + "category": "FunctionAppLogs", + "function": { + "app_name": "test-function", + "category": "Function.hello", + "event_name": "FunctionStarted", + "invocation_id": "d878e365-b3d6-4796-9292-7500acd0c677", + "name": "Functions.hello", + "host_instance_id": "bb84c437-4c26-4d0b-a06d-7fc2f16976e3", + "host_version": "4.19.2.2", + "level": "Information", + "level_id": 2, + "message": "Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)", + "process_id": 67, + "role_instance": "54108609-638204200593759681" + }, + "operation_name": "Microsoft.Web/sites/functions/log", + "resource": { + "group": "TEST-RG", + "id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION", + "name": "TEST-FUNCTION", + "provider": "MICROSOFT.WEB/SITES" + }, + "subscription_id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "cloud": { + "account": { + "id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "provider": "azure" + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "original": "{\"time\":\"2023-05-23T20:11:59Z\",\"resourceId\":\"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION\",\"category\":\"FunctionAppLogs\",\"operationName\":\"Microsoft.Web/sites/functions/log\",\"level\":\"Informational\",\"location\":\"East US\",\"properties\":{\"appName\":\"test-function\",\"roleInstance\":\"54108609-638204200593759681\",\"message\":\"Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)\",\"category\":\"Function.hello\",\"hostVersion\":\"4.19.2.2\",\"functionInvocationId\":\"d878e365-b3d6-4796-9292-7500acd0c677\",\"functionName\":\"Functions.hello\",\"hostInstanceId\":\"bb84c437-4c26-4d0b-a06d-7fc2f16976e3\",\"level\":\"Information\",\"levelId\":2,\"processId\":67,\"eventId\":1,\"eventName\":\"FunctionStarted\"}}" + }, + "observer": { + "product": "Azure Functions", + "type": "functions", + "vendor": "Azure" + }, + "tags": [ + "preserve_original_event" + ] +} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/metrics/agent/stream/stream.yml.hbs b/packages/azure_functions/data_stream/metrics/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..00b15b7c114 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/agent/stream/stream.yml.hbs @@ -0,0 +1,70 @@ +metricsets: ["monitor"] +default_resource_type: "Microsoft.Web/sites" +add_cloud_metadata: true +period: {{period}} +{{#if client_id}} +client_id: {{client_id}} +{{/if}} +{{#if client_secret}} +client_secret: {{client_secret}} +{{/if}} +{{#if tenant_id}} +tenant_id: {{tenant_id}} +{{/if}} +{{#if subscription_id}} +subscription_id: {{subscription_id}} +{{/if}} +{{#if refresh_list_interval}} +refresh_list_interval: {{refresh_list_interval}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +{{#if active_directory_endpoint}} +active_directory_endpoint: {{active_directory_endpoint}} +{{/if}} + +resources: +{{#if resource_groups}} +{{#each resource_groups}} + - resource_group: "{{this}}" + resource_type: "Microsoft.Web/sites" + metrics: + - name: ["FunctionExecutionCount", "FunctionExecutionUnits", "AppConnections", "AverageMemoryWorkingSet", "BytesReceived", "BytesSent", "CurrentAssemblies", "Gen0Collections", "Gen1Collections", "Gen2Collections", "Handles", "HealthCheckStatus", "Http2xx", "Http3xx", "Http4xx", "Http5xx", "HttpResponseTime", "IoOtherBytesPerSecond", "IoOtherOperationsPerSecond", "IoReadBytesPerSecond", "IoReadOperationsPerSecond", "IoWriteBytesPerSecond", "IoWriteOperationsPerSecond", "MemoryWorkingSet", "Requests", "RequestsInApplicationQueue", "Threads", "TotalAppDomains", "TotalAppDomainsUnloaded"] + namespace: "Microsoft.Web/sites" + timegrain: "PT5M" + ignore_unsupported: true + - name: ["FileSystemUsage"] + namespace: "Microsoft.Web/sites" + timegrain: "PT6H" + ignore_unsupported: true +{{/each}} +{{/if}} +{{#if resource_ids}} +{{#each resource_ids}} + - resource_id: "{{this}}" + metrics: + - name: ["FunctionExecutionCount", "FunctionExecutionUnits", "AppConnections", "AverageMemoryWorkingSet", "BytesReceived", "BytesSent", "CurrentAssemblies", "Gen0Collections", "Gen1Collections", "Gen2Collections", "Handles", "HealthCheckStatus", "Http2xx", "Http3xx", "Http4xx", "Http5xx", "HttpResponseTime", "IoOtherBytesPerSecond", "IoOtherOperationsPerSecond", "IoReadBytesPerSecond", "IoReadOperationsPerSecond", "IoWriteBytesPerSecond", "IoWriteOperationsPerSecond", "MemoryWorkingSet", "Requests", "RequestsInApplicationQueue", "Threads", "TotalAppDomains", "TotalAppDomainsUnloaded"] + namespace: "Microsoft.Web/sites" + timegrain: "PT5M" + ignore_unsupported: true + - name: ["FileSystemUsage"] + namespace: "Microsoft.Web/sites" + timegrain: "PT6H" + ignore_unsupported: true +{{/each}} +{{/if}} +{{#unless resource_ids }} + {{#unless resource_groups }} + - resource_query: "resourceType eq 'Microsoft.Web/sites'" + metrics: + - name: ["FunctionExecutionCount", "FunctionExecutionUnits", "AppConnections", "AverageMemoryWorkingSet", "BytesReceived", "BytesSent", "CurrentAssemblies", "Gen0Collections", "Gen1Collections", "Gen2Collections", "Handles", "HealthCheckStatus", "Http2xx", "Http3xx", "Http4xx", "Http5xx", "HttpResponseTime", "IoOtherBytesPerSecond", "IoOtherOperationsPerSecond", "IoReadBytesPerSecond", "IoReadOperationsPerSecond", "IoWriteBytesPerSecond", "IoWriteOperationsPerSecond", "MemoryWorkingSet", "Requests", "RequestsInApplicationQueue", "Threads", "TotalAppDomains", "TotalAppDomainsUnloaded"] + namespace: "Microsoft.Web/sites" + timegrain: "PT5M" + ignore_unsupported: true + - name: ["FileSystemUsage"] + namespace: "Microsoft.Web/sites" + timegrain: "PT6H" + ignore_unsupported: true + {{/unless}} +{{/unless}} \ No newline at end of file diff --git a/packages/azure_functions/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml b/packages/azure_functions/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..5a83050ef5c --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,17 @@ +--- +description: Pipeline for parsing Azure Functions metrics. +processors: + - set: + field: ecs.version + value: '8.8.0' + - rename: + field: azure.monitor + target_field: azure.functions + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/packages/azure_functions/data_stream/metrics/fields/agent.yml b/packages/azure_functions/data_stream/metrics/fields/agent.yml new file mode 100644 index 00000000000..2db0bb802e6 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/fields/agent.yml @@ -0,0 +1,183 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/azure_functions/data_stream/metrics/fields/base-fields.yml b/packages/azure_functions/data_stream/metrics/fields/base-fields.yml new file mode 100644 index 00000000000..a9a65458fc5 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/fields/base-fields.yml @@ -0,0 +1,21 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/azure_functions/data_stream/metrics/fields/ecs.yml b/packages/azure_functions/data_stream/metrics/fields/ecs.yml new file mode 100644 index 00000000000..d4e75a6085c --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/fields/ecs.yml @@ -0,0 +1,16 @@ +- name: ecs.version + external: ecs +- name: service.address + external: ecs +- name: service.type + external: ecs +- name: container.id + external: ecs +- name: container.name + external: ecs +- name: container.runtime + external: ecs +- name: container.image.name + external: ecs +- name: host + external: ecs diff --git a/packages/azure_functions/data_stream/metrics/fields/fields.yml b/packages/azure_functions/data_stream/metrics/fields/fields.yml new file mode 100644 index 00000000000..cf3551233a6 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/fields/fields.yml @@ -0,0 +1,134 @@ +- name: azure.functions + type: group + fields: + - name: function_execution_count.total + type: long + description: Function Execution Count. For FunctionApps only. + metric_type: counter + - name: function_execution_units.total + type: long + description: Function Execution Units. For FunctionApps only. + metric_type: counter + - name: average_memory_working_set.avg + type: long + description: The average amount of memory used by the app, in MiB. For WebApps and FunctionApps. + unit: byte + metric_type: gauge + - name: app_connections.avg + type: long + description: The number of bound sockets existing in the sandbox (w3wp.exe and its child processes). A bound socket is created by calling bind()/connect() APIs and remains until said socket is closed with CloseHandle()/closesocket(). For WebApps and FunctionApps.. + metric_type: counter + - name: current_assemblies.avg + type: long + description: The current number of Assemblies loaded across all AppDomains in this application. + metric_type: gauge + - name: bytes_received.total + type: long + description: The amount of incoming bandwidth consumed by the app, in MiB. + unit: byte + metric_type: gauge + - name: bytes_sent.total + type: long + description: The amount of outgoing bandwidth consumed by the app, in MiB. + unit: byte + metric_type: gauge + - name: file_system_usage.avg + type: long + description: Percentage of filesystem quota consumed by the app. + unit: byte + metric_type: gauge + - name: gen_0_collections.total + type: long + description: The number of times the generation 0 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. + metric_type: counter + - name: gen_1_collections.total + type: long + description: The number of times the generation 1 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. + metric_type: counter + - name: gen_2_collections.total + type: long + description: The number of times the generation 2 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. + metric_type: counter + - name: handles.avg + type: long + description: The total number of handles currently open by the app process. + metric_type: counter + - name: health_check_status.avg + type: long + description: Health check status. + metric_type: gauge + - name: http2xx.total + type: long + description: The count of requests resulting in an HTTP status code >= 200 but < 300. + metric_type: counter + - name: http3xx.total + type: long + description: The count of requests resulting in an HTTP status code >= 300 but < 400. + metric_type: counter + - name: http4xx.total + type: long + description: The count of requests resulting in an HTTP status code >= 400 but < 500. + metric_type: counter + - name: http5xx.total + type: long + description: The count of requests resulting in an HTTP status code >= 500 but < 600. + metric_type: counter + - name: io_other_bytes_per_second.total + type: long + description: The rate at which the app process is issuing bytes to I/O operations that don't involve data, such as control operations. Shown as bytespersecond. + metric_type: gauge + - name: io_other_operations_per_second.total + type: long + description: The rate at which the app process is issuing I/O operations that aren't read or write operations. Shown as bytespersecond. + metric_type: gauge + - name: io_read_bytes_per_second.total + type: long + description: The rate at which the app process is reading bytes from I/O operations. Shown as bytespersecond. + metric_type: gauge + - name: io_read_operations_per_second.total + type: long + description: The rate at which the app process is issuing read I/O operations. Shown as bytespersecond. + metric_type: gauge + - name: io_write_bytes_per_second.total + type: long + description: The rate at which the app process is writing bytes to I/O operations. Shown as bytespersecond. + metric_type: gauge + - name: io_write_operations_per_second.total + type: long + description: The rate at which the app process is issuing write I/O operations. Shown as bytespersecond. + metric_type: gauge + - name: memory_working_set.avg + type: long + description: The current amount of memory used by the app, in MiB. + unit: byte + metric_type: gauge + - name: private_bytes.avg + type: long + description: Private Bytes is the current size, in bytes, of memory that the app process has allocated that can't be shared with other processes. + unit: byte + metric_type: gauge + - name: requests.total + type: long + description: The total number of requests regardless of their resulting HTTP status code. + metric_type: counter + - name: http_response_time.avg + type: long + description: The time taken for the app to serve requests, in seconds. + unit: s + metric_type: gauge + - name: requests_inapplication_queue.avg + type: long + description: The number of requests in the application request queue. + metric_type: counter + - name: threads.avg + type: long + description: The number of threads currently active in the app process. + metric_type: gauge + - name: total_app_domains.avg + type: long + description: The current number of AppDomains loaded in this application. + metric_type: gauge + - name: total_app_domains_unloaded.avg + type: long + description: The total number of AppDomains unloaded since the start of the application. + metric_type: gauge diff --git a/packages/azure_functions/data_stream/metrics/fields/package-fields.yml b/packages/azure_functions/data_stream/metrics/fields/package-fields.yml new file mode 100644 index 00000000000..e8e62b31885 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/fields/package-fields.yml @@ -0,0 +1,64 @@ +- name: azure + type: group + description: "" + fields: + - name: timegrain + type: keyword + description: > + The Azure metric timegrain + + - name: resource + type: group + description: > + The resource specified + + fields: + - name: type + type: keyword + description: > + The type of the resource + + - name: name + type: keyword + description: > + The name of the resource + + - name: id + type: keyword + description: > + The id of the resource + + - name: group + type: keyword + description: > + The resource group + + - name: tags.* + type: object + object_type: keyword + object_type_mapping_type: "*" + description: > + Azure resource tags. + + - name: namespace + type: keyword + description: > + The namespace selected + + - name: subscription_id + type: keyword + description: > + The subscription ID + + - name: application_id + type: keyword + description: > + The application ID + + - name: dimensions.* + type: object + object_type: keyword + object_type_mapping_type: "*" + description: > + Azure metric dimensions. + diff --git a/packages/azure_functions/data_stream/metrics/manifest.yml b/packages/azure_functions/data_stream/metrics/manifest.yml new file mode 100644 index 00000000000..c3dd002f4ae --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/manifest.yml @@ -0,0 +1,59 @@ +type: metrics +title: Azure Functions App Metrics +dataset: azure.function +streams: + - input: azure/metrics + title: Azure Functions App + description: Collect Azure Functions App metrics + enabled: false + vars: + - name: client_id + type: text + title: Client ID + multi: false + required: true + show_user: true + - name: client_secret + type: text + title: Client Secret + multi: false + required: true + show_user: true + - name: tenant_id + type: text + title: Tenant ID + multi: false + required: true + show_user: true + - name: subscription_id + type: text + title: Subscription ID + multi: false + required: true + show_user: true + - name: period + type: text + title: Period + multi: false + required: true + show_user: true + default: 300s + - name: resource_groups + type: text + title: Resource Groups + multi: true + required: false + show_user: true + - name: resource_ids + type: text + title: Resource IDs + multi: true + required: false + show_user: true + - name: refresh_list_interval + type: text + title: Refresh list interval + multi: false + required: false + show_user: true + default: 600s diff --git a/packages/azure_functions/data_stream/metrics/sample_event.json b/packages/azure_functions/data_stream/metrics/sample_event.json new file mode 100644 index 00000000000..9e4f76f8bb9 --- /dev/null +++ b/packages/azure_functions/data_stream/metrics/sample_event.json @@ -0,0 +1,144 @@ +{ + "agent": { + "name": "docker-fleet-agent", + "id": "ae16c4cf-2550-452a-860d-cef5e5182e94", + "type": "metricbeat", + "ephemeral_id": "7511408f-f109-4e34-a405-98ad479fc097", + "version": "8.7.1" + }, + "@timestamp": "2023-08-23T12:20:00.000Z", + "ecs": { + "version": "8.0.0" + }, + "data_stream": { + "namespace": "default", + "type": "metrics", + "dataset": "azure.function" + }, + "service": { + "type": "azure" + }, + "host": { + "hostname": "docker-fleet-agent", + "os": { + "kernel": "5.15.49-linuxkit", + "codename": "focal", + "name": "Ubuntu", + "family": "debian", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)", + "platform": "ubuntu" + }, + "containerized": false, + "ip": [ + "172.19.0.9" + ], + "name": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "mac": [ + "02-42-AC-13-00-09" + ], + "architecture": "x86_64" + }, + "elastic_agent": { + "id": "ae16c4cf-2550-452a-860d-cef5e5182e94", + "version": "8.7.1", + "snapshot": false + }, + "metricset": { + "period": 300000, + "name": "monitor" + }, + "event": { + "duration": 42827917228, + "agent_id_status": "verified", + "ingested": "2023-08-23T12:25:34Z", + "module": "azure", + "dataset": "azure.function" + }, + "azure": { + "subscription_id": "12hjkls-78tyu-404f-a3d2-1dc9982f45ds", + "timegrain": "PT5M", + "functions": { + "handles": { + "avg": 0 + }, + "app_connections": { + "avg": 0 + }, + "total_app_domains": { + "avg": 0 + }, + "http_response_time": { + "avg": 0.02796875 + }, + "bytes_received": { + "total": 28804 + }, + "average_memory_working_set": { + "avg": 328533059.5 + }, + "requests": { + "total": 32 + }, + "bytes_sent": { + "total": 8192 + }, + "requests_inapplication_queue": { + "avg": 0 + }, + "memory_working_set": { + "avg": 328533059.5 + }, + "io_write_bytes_per_second": { + "total": 0 + }, + "io_other_bytes_per_second": { + "total": 0 + }, + "total_app_domains_unloaded": { + "avg": 0 + }, + "io_other_operations_per_second": { + "total": 0 + }, + "io_read_bytes_per_second": { + "total": 31879 + }, + "function_execution_units": { + "total": 0 + }, + "io_read_operations_per_second": { + "total": 0 + }, + "http2xx": { + "total": 16 + }, + "http3xx": { + "total": 0 + }, + "http4xx": { + "total": 0 + }, + "io_write_operations_per_second": { + "total": 0 + }, + "function_execution_count": { + "total": 0 + }, + "http5xx": { + "total": 16 + } + }, + "resource": { + "name": "return-of-the-jedi", + "id": "/subscriptions/12hjkls-78tyu-404f-a3d2-1dc9982f45ds/resourceGroups/test-rg/providers/Microsoft.Web/sites/return-of-the-jedi", + "type": "Microsoft.Web/sites", + "group": "test-rg", + "tags": { + "hidden-link: /app-insights-resource-id": "/subscriptions/12hjkls-78tyu-404f-a3d2-1dc9982f45ds/resourceGroups/test-rg/providers/Microsoft.Insights/components/return-of-the-jedi" + } + }, + "namespace": "Microsoft.Web/sites" + } +} \ No newline at end of file diff --git a/packages/azure_functions/docs/README.md b/packages/azure_functions/docs/README.md new file mode 100644 index 00000000000..4b98112820e --- /dev/null +++ b/packages/azure_functions/docs/README.md @@ -0,0 +1,545 @@ +# Azure Functions + +The Azure Functions integration allows you to monitor Azure Functions. Azure Functions is an event-driven, serverless compute platform that helps you develop more efficiently using the programming language of your choice. Triggers cause a function to run. A trigger defines how a function is invoked and a function must have exactly one trigger. + +Use this integration to build web APIs, respond to database changes, process IoT streams, manage message queues, and more. Refer common [Azure Functions scenarios](https://learn.microsoft.com/en-us/azure/azure-functions/functions-scenarios?pivots=programming-language-csharp) for more information. + + +## Data streams +The Azure Functions integration contains two data streams: [Function App Logs](#logs) and [Metrics](#metrics) + +### Logs + +Supported log categories: + +| Log Category | Description | +|:----------------------------:|:------------------------------------------------------------------------------------------------------------------------------------:| +| Functionapplogs | Function app logs. | + + +#### Requirements and setup + +Refer to the [Azure Logs](https://docs.elastic.co/integrations/azure) page for more information about setting up and using this integration. + +#### Configuration options +`eventhub` : + _string_ +An Event Hub is a fully managed, real-time data ingestion service. Elastic recommends using only letters, numbers, and the hyphen (-) character for Event Hub names to maximize compatibility. You can use existing Event Hubs having underscores (_) in the Event Hub name; in this case, the integration will replace underscores with hyphens (-) when it uses the Event Hub name to create dependent Azure resources behind the scenes (e.g., the storage account container to store Event Hub consumer offsets). Elastic also recommends using a separate event hub for each log type as the field mappings of each log type differ. +Default value `insights-operational-logs`. + +`consumer_group` : +_string_ + The publish/subscribe mechanism of Event Hubs is enabled through consumer groups. A consumer group is a view (state, position, or offset) of an entire event hub. Consumer groups enable multiple consuming applications to each have a separate view of the event stream, and to read the stream independently at their own pace and with their own offsets. +Default value: `$Default` + +`connection_string` : +_string_ +The connection string is required to communicate with Event Hubs, see steps [here](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string). + +A Blob Storage account is required in order to store/retrieve/update the offset or state of the eventhub messages. This means that after stopping the Azure logs package it can start back up at the spot that it stopped processing messages. + +`storage_account` : +_string_ +The name of the storage account where the state/offsets will be stored and updated. + +`storage_account_key` : +_string_ +The storage account key, this key will be used to authorize access to data in your storage account. + +`storage_account_container` : +_string_ +The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You MUST use a dedicated storage account container for each Azure log type (activity, sign-in, audit logs, and others). DO NOT REUSE the same container name for more than one Azure log type. See [Container Names](https://docs.microsoft.com/en-us/rest/api/storageservices/naming-and-referencing-containers--blobs--and-metadata#container-names) for details on naming rules from Microsoft. The integration generates a default container name if not specified. + +`resource_manager_endpoint` : +_string_ +Optional, by default we are using the Azure public environment, to override, users can provide a specific resource manager endpoint in order to use a different Azure environment. + +Resource manager endpoints: + +```text +# Azure ChinaCloud +https://management.chinacloudapi.cn/ + +# Azure GermanCloud +https://management.microsoftazure.de/ + +# Azure PublicCloud +https://management.azure.com/ + +# Azure USGovernmentCloud +https://management.usgovcloudapi.net/ +``` + +An example event for `functionapplogs` looks as following: + +```json +{ + "@timestamp": "2023-05-23T20:11:59.000Z", + "azure": { + "category": "FunctionAppLogs", + "function": { + "app_name": "test-function", + "category": "Function.hello", + "event_name": "FunctionStarted", + "invocation_id": "d878e365-b3d6-4796-9292-7500acd0c677", + "name": "Functions.hello", + "host_instance_id": "bb84c437-4c26-4d0b-a06d-7fc2f16976e3", + "host_version": "4.19.2.2", + "level": "Information", + "level_id": 2, + "message": "Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)", + "process_id": 67, + "role_instance": "54108609-638204200593759681" + }, + "operation_name": "Microsoft.Web/sites/functions/log", + "resource": { + "group": "TEST-RG", + "id": "/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION", + "name": "TEST-FUNCTION", + "provider": "MICROSOFT.WEB/SITES" + }, + "subscription_id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "cloud": { + "account": { + "id": "12CABCB4-86E8-404F-A3D2-1DC9982F45CA" + }, + "provider": "azure" + }, + "ecs": { + "version": "8.7.0" + }, + "event": { + "original": "{\"time\":\"2023-05-23T20:11:59Z\",\"resourceId\":\"/SUBSCRIPTIONS/12CABCB4-86E8-404F-A3D2-1DC9982F45CA/RESOURCEGROUPS/TEST-RG/PROVIDERS/MICROSOFT.WEB/SITES/TEST-FUNCTION\",\"category\":\"FunctionAppLogs\",\"operationName\":\"Microsoft.Web/sites/functions/log\",\"level\":\"Informational\",\"location\":\"East US\",\"properties\":{\"appName\":\"test-function\",\"roleInstance\":\"54108609-638204200593759681\",\"message\":\"Executing Functions.hello (Reason=This function was programmatically called via the host APIs., Id=d878e365-b3d6-4796-9292-7500acd0c677)\",\"category\":\"Function.hello\",\"hostVersion\":\"4.19.2.2\",\"functionInvocationId\":\"d878e365-b3d6-4796-9292-7500acd0c677\",\"functionName\":\"Functions.hello\",\"hostInstanceId\":\"bb84c437-4c26-4d0b-a06d-7fc2f16976e3\",\"level\":\"Information\",\"levelId\":2,\"processId\":67,\"eventId\":1,\"eventName\":\"FunctionStarted\"}}" + }, + "observer": { + "product": "Azure Functions", + "type": "functions", + "vendor": "Azure" + }, + "tags": [ + "preserve_original_event" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| azure.category | The log category name. | keyword | +| azure.function.app_name | The Function application name. | keyword | +| azure.function.category | The category of the operation. | keyword | +| azure.function.event_id | The event ID. | long | +| azure.function.event_name | The event name. | keyword | +| azure.function.exception_details | The exception details. This includes the exception type, message, and stack trace. | match_only_text | +| azure.function.exception_message | The exception message. | match_only_text | +| azure.function.exception_type | The exception type. | keyword | +| azure.function.host_instance_id | The host instance ID. | keyword | +| azure.function.host_version | The Functions host version. | keyword | +| azure.function.invocation_id | The invocation ID that logged the message. | keyword | +| azure.function.level | The log level. Valid values are Trace, Debug, Information, Warning, Error, or Critical. | keyword | +| azure.function.level_id | The integer value of the log level. Valid values are 0 (Trace), 1 (Debug), 2 (Information), 3 (Warning), 4 (Error), or 5 (Critical). | long | +| azure.function.message | The log message. | keyword | +| azure.function.name | The name of the function that logged the message. | keyword | +| azure.function.process_id | The process ID. | long | +| azure.function.role_instance | The role instance ID. | keyword | +| azure.operation_name | The operation name. | keyword | +| azure.resource.group | Azure Resource group | keyword | +| azure.resource.id | Resource ID | keyword | +| azure.resource.name | Name | keyword | +| azure.resource.provider | Resource type/namespace | keyword | +| azure.subscription_id | Azure subscription ID | keyword | +| azure.tenant_id | tenant ID | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| error.stack_trace | The stack trace of this error in plain text. | wildcard | +| error.stack_trace.text | Multi-field of `error.stack_trace`. | match_only_text | +| error.type | The type of the error, for example the class name of the exception. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| observer.name | Custom name of the observer. This is a name that can be given to an observer. This can be helpful for example if multiple firewalls of the same model are used in an organization. If no custom name is needed, the field can be left empty. | keyword | +| observer.product | The product name of the observer. | keyword | +| observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | +| observer.vendor | Vendor name of the observer. | keyword | +| tags | List of keywords used to tag each event. | keyword | + + +### Metrics +**Metrics** give you insight into the performance of your Azure Function Apps. The integration includes an out-of-the-box dashboard for visualising the monitoring data generated by apps hosted in Azure Functions. + +#### Requirements + +To use this integration you will need: + +* **Azure App Registration**: You need to set up an Azure App Registration to allow the Agent to access the Azure APIs. The App Registration requires the Monitoring Reader role to access to be able to collect metrics from Function Apps. See more details in the Setup section. +* **Elasticsearch and Kibana**: You need Elasticsearch to store and search your data and Kibana to visualize and manage it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, the [Native Azure Integration](https://azuremarketplace.microsoft.com/en-us/marketplace/apps/elastic.elasticsearch?tab=Overview), or self-manage the Elastic Stack on your hardware. + +#### Setup + + +```text + ┌────────────────────┐ ┌─────────┐ ┌─-─────────────────────┐ + │ │ │ │ │ azure.functions │ + │ Azure APIs │──────▶│ Agent │──────▶│ <> │ + │ │ │ │ │ │ + └────────────────────┘ └─────────┘ └───-───────────────────┘ +``` + +Elastic Agent needs an App Registration to access Azure on your behalf to collect data using the Azure REST APIs. App Registrations are required to access Azure APIs programmatically. + +To start collecting data with this integration, you need to: + +* Set up a new Azure app registration by registering an app, adding credentials, and assigning an appropriate role. +* Specify integration [settings](#main-options) in Kibana, which will determine how the integration will access the Azure APIs. + +#### Register a new app + +To create a new app registration: + +1. Sign in to the [Azure Portal](https://portal.azure.com/). +2. Search for and select **Azure Active Directory**. +3. Under **Manage**, select **App registrations** > **New registration**. +4. Enter a display _Name_ for your application (for example, "elastic-agent"). +5. Specify who can use the application. +6. Don't enter anything for _Redirect URI_. This is optional and the agent doesn't use it. +7. Select **Register** to complete the initial app registration. + +Take note of the **Application (client) ID**, which you will use later when specifying the **Client ID** in the integration settings. + +#### Add credentials + +Credentials allow your application to access Azure APIs and authenticate itself, requiring no interaction from a user at runtime. + +This integration uses Client Secrets to prove its identity. + +1. In the [Azure Portal](https://portal.azure.com/), select the application you created in the previous section. +2. Select **Certificates & secrets** > **Client secrets** > **New client secret**. +3. Add a description (for example, "Elastic Agent client secrets"). +4. Select an expiration for the secret or specify a custom lifetime. +5. Select **Add**. + +Take note of the content in the **Value** column in the **Client secrets** table, which you will use later when specifying a **Client Secret** in the integration settings. **This secret value is never displayed again after you leave this page.** Record the secret's value in a safe place. + +#### Assign role + +1. In the [Azure Portal](https://portal.azure.com/), search for and select **Subscriptions**. +2. Select the subscription to assign the application. +3. Select **Access control (IAM)**. +4. Select **Add** > **Add role assignment** to open the _Add role assignment page_. +5. In the **Role** tab, search and select the role **Monitoring Reader**. +6. Select the **Next** button to move to the **Members** tab. +7. Select **Assign access to** > **User, group, or service principal**, and select **Select members**. This page does not display Azure AD applications in the available options by default. +8. To find your application, search by name (for example, "elastic-agent") and select it from the list. +9. Click the **Select** button. +10. Then click the **Review + assign** button. + +Take note of the following values, which you will use later when specifying settings. + +* `Subscription ID`: use the content of the "Subscription ID" you selected. +* `Tenant ID`: use the "Tenant ID" from the Azure Active Directory you use. + +Your App Registration is now ready to be used with the Elastic Agent. + +#### Additional Resources + +If you want to learn more about this process, you can read these two general guides from Microsoft: + +* [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app) +* [Use the portal to create an Azure AD application and service principal that can access resources](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) + +#### Main options + +The settings' main section contains all the options needed to access the Azure APIs and collect the Azure Functions metrics data. You will now use all the values from [App registration](#register-a-new-app) including: + +`Client ID` _string_ +: The unique identifier of the App Registration (sometimes referred to as Application ID). + +`Client Secret` _string_ +: The client secret for authentication. + +`Subscription ID` _string_ +: The unique identifier for the Azure subscription. You can provide just one subscription ID. The Agent uses this ID to access Azure APIs. + +`Tenant ID` _string_ +: The unique identifier of the Azure Active Directory's Tenant ID. + +#### Advanced options + +There are two additional advanced options: + +`Resource Manager Endpoint` _string_ +: Optional. By default, the integration uses the Azure public environment. To override, users can provide a specific resource manager endpoint to use a different Azure environment. + +Examples: + +* `https://management.chinacloudapi.cn` for Azure ChinaCloud +* `https://management.microsoftazure.de` for Azure GermanCloud +* `https://management.azure.com` for Azure PublicCloud +* `https://management.usgovcloudapi.net` for Azure USGovernmentCloud + +`Active Directory Endpoint` _string_ +: Optional. By default, the integration uses the associated Active Directory Endpoint. To override, users can provide a specific active directory endpoint to use a different Azure environment. + +Examples: + +* `https://login.chinacloudapi.cn` for Azure ChinaCloud +* `https://login.microsoftonline.de` for Azure GermanCloud +* `https://login.microsoftonline.com` for Azure PublicCloud +* `https://login.microsoftonline.us` for Azure USGovernmentCloud + +#### Metrics Reference + +An example event for `metrics` looks as following: + +```json +{ + "agent": { + "name": "docker-fleet-agent", + "id": "ae16c4cf-2550-452a-860d-cef5e5182e94", + "type": "metricbeat", + "ephemeral_id": "7511408f-f109-4e34-a405-98ad479fc097", + "version": "8.7.1" + }, + "@timestamp": "2023-08-23T12:20:00.000Z", + "ecs": { + "version": "8.0.0" + }, + "data_stream": { + "namespace": "default", + "type": "metrics", + "dataset": "azure.function" + }, + "service": { + "type": "azure" + }, + "host": { + "hostname": "docker-fleet-agent", + "os": { + "kernel": "5.15.49-linuxkit", + "codename": "focal", + "name": "Ubuntu", + "family": "debian", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)", + "platform": "ubuntu" + }, + "containerized": false, + "ip": [ + "172.19.0.9" + ], + "name": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "mac": [ + "02-42-AC-13-00-09" + ], + "architecture": "x86_64" + }, + "elastic_agent": { + "id": "ae16c4cf-2550-452a-860d-cef5e5182e94", + "version": "8.7.1", + "snapshot": false + }, + "metricset": { + "period": 300000, + "name": "monitor" + }, + "event": { + "duration": 42827917228, + "agent_id_status": "verified", + "ingested": "2023-08-23T12:25:34Z", + "module": "azure", + "dataset": "azure.function" + }, + "azure": { + "subscription_id": "12hjkls-78tyu-404f-a3d2-1dc9982f45ds", + "timegrain": "PT5M", + "functions": { + "handles": { + "avg": 0 + }, + "app_connections": { + "avg": 0 + }, + "total_app_domains": { + "avg": 0 + }, + "http_response_time": { + "avg": 0.02796875 + }, + "bytes_received": { + "total": 28804 + }, + "average_memory_working_set": { + "avg": 328533059.5 + }, + "requests": { + "total": 32 + }, + "bytes_sent": { + "total": 8192 + }, + "requests_inapplication_queue": { + "avg": 0 + }, + "memory_working_set": { + "avg": 328533059.5 + }, + "io_write_bytes_per_second": { + "total": 0 + }, + "io_other_bytes_per_second": { + "total": 0 + }, + "total_app_domains_unloaded": { + "avg": 0 + }, + "io_other_operations_per_second": { + "total": 0 + }, + "io_read_bytes_per_second": { + "total": 31879 + }, + "function_execution_units": { + "total": 0 + }, + "io_read_operations_per_second": { + "total": 0 + }, + "http2xx": { + "total": 16 + }, + "http3xx": { + "total": 0 + }, + "http4xx": { + "total": 0 + }, + "io_write_operations_per_second": { + "total": 0 + }, + "function_execution_count": { + "total": 0 + }, + "http5xx": { + "total": 16 + } + }, + "resource": { + "name": "return-of-the-jedi", + "id": "/subscriptions/12hjkls-78tyu-404f-a3d2-1dc9982f45ds/resourceGroups/test-rg/providers/Microsoft.Web/sites/return-of-the-jedi", + "type": "Microsoft.Web/sites", + "group": "test-rg", + "tags": { + "hidden-link: /app-insights-resource-id": "/subscriptions/12hjkls-78tyu-404f-a3d2-1dc9982f45ds/resourceGroups/test-rg/providers/Microsoft.Insights/components/return-of-the-jedi" + } + }, + "namespace": "Microsoft.Web/sites" + } +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| azure.application_id | The application ID | keyword | | | +| azure.dimensions.\* | Azure metric dimensions. | object | | | +| azure.functions.app_connections.avg | The number of bound sockets existing in the sandbox (w3wp.exe and its child processes). A bound socket is created by calling bind()/connect() APIs and remains until said socket is closed with CloseHandle()/closesocket(). For WebApps and FunctionApps.. | long | | counter | +| azure.functions.average_memory_working_set.avg | The average amount of memory used by the app, in MiB. For WebApps and FunctionApps. | long | byte | gauge | +| azure.functions.bytes_received.total | The amount of incoming bandwidth consumed by the app, in MiB. | long | byte | gauge | +| azure.functions.bytes_sent.total | The amount of outgoing bandwidth consumed by the app, in MiB. | long | byte | gauge | +| azure.functions.current_assemblies.avg | The current number of Assemblies loaded across all AppDomains in this application. | long | | gauge | +| azure.functions.file_system_usage.avg | Percentage of filesystem quota consumed by the app. | long | byte | gauge | +| azure.functions.function_execution_count.total | Function Execution Count. For FunctionApps only. | long | | counter | +| azure.functions.function_execution_units.total | Function Execution Units. For FunctionApps only. | long | | counter | +| azure.functions.gen_0_collections.total | The number of times the generation 0 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. | long | | counter | +| azure.functions.gen_1_collections.total | The number of times the generation 1 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. | long | | counter | +| azure.functions.gen_2_collections.total | The number of times the generation 2 objects are garbage collected since the start of the app process. Higher generation GCs include all lower generation GCs. | long | | counter | +| azure.functions.handles.avg | The total number of handles currently open by the app process. | long | | counter | +| azure.functions.health_check_status.avg | Health check status. | long | | gauge | +| azure.functions.http2xx.total | The count of requests resulting in an HTTP status code \>= 200 but \< 300. | long | | counter | +| azure.functions.http3xx.total | The count of requests resulting in an HTTP status code \>= 300 but \< 400. | long | | counter | +| azure.functions.http4xx.total | The count of requests resulting in an HTTP status code \>= 400 but \< 500. | long | | counter | +| azure.functions.http5xx.total | The count of requests resulting in an HTTP status code \>= 500 but \< 600. | long | | counter | +| azure.functions.http_response_time.avg | The time taken for the app to serve requests, in seconds. | long | s | gauge | +| azure.functions.io_other_bytes_per_second.total | The rate at which the app process is issuing bytes to I/O operations that don't involve data, such as control operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.io_other_operations_per_second.total | The rate at which the app process is issuing I/O operations that aren't read or write operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.io_read_bytes_per_second.total | The rate at which the app process is reading bytes from I/O operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.io_read_operations_per_second.total | The rate at which the app process is issuing read I/O operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.io_write_bytes_per_second.total | The rate at which the app process is writing bytes to I/O operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.io_write_operations_per_second.total | The rate at which the app process is issuing write I/O operations. Shown as bytespersecond. | long | | gauge | +| azure.functions.memory_working_set.avg | The current amount of memory used by the app, in MiB. | long | byte | gauge | +| azure.functions.private_bytes.avg | Private Bytes is the current size, in bytes, of memory that the app process has allocated that can't be shared with other processes. | long | byte | gauge | +| azure.functions.requests.total | The total number of requests regardless of their resulting HTTP status code. | long | | counter | +| azure.functions.requests_inapplication_queue.avg | The number of requests in the application request queue. | long | | counter | +| azure.functions.threads.avg | The number of threads currently active in the app process. | long | | gauge | +| azure.functions.total_app_domains.avg | The current number of AppDomains loaded in this application. | long | | gauge | +| azure.functions.total_app_domains_unloaded.avg | The total number of AppDomains unloaded since the start of the application. | long | | gauge | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + diff --git a/packages/azure_functions/img/azure-functions-icon.svg b/packages/azure_functions/img/azure-functions-icon.svg new file mode 100644 index 00000000000..9face30fb9e --- /dev/null +++ b/packages/azure_functions/img/azure-functions-icon.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/azure_functions/img/azure-functions-overview1.png b/packages/azure_functions/img/azure-functions-overview1.png new file mode 100644 index 00000000000..47a3d61496b Binary files /dev/null and b/packages/azure_functions/img/azure-functions-overview1.png differ diff --git a/packages/azure_functions/img/azure-functions-overview2.png b/packages/azure_functions/img/azure-functions-overview2.png new file mode 100644 index 00000000000..1dd590be74a Binary files /dev/null and b/packages/azure_functions/img/azure-functions-overview2.png differ diff --git a/packages/azure_functions/img/azure-functions-overview3.png b/packages/azure_functions/img/azure-functions-overview3.png new file mode 100644 index 00000000000..3d22d27980b Binary files /dev/null and b/packages/azure_functions/img/azure-functions-overview3.png differ diff --git a/packages/azure_functions/kibana/dashboard/azure_functions-5b40c9c0-33d4-11ee-8d85-2d7adebebd1b.json b/packages/azure_functions/kibana/dashboard/azure_functions-5b40c9c0-33d4-11ee-8d85-2d7adebebd1b.json new file mode 100644 index 00000000000..8789e027f33 --- /dev/null +++ b/packages/azure_functions/kibana/dashboard/azure_functions-5b40c9c0-33d4-11ee-8d85-2d7adebebd1b.json @@ -0,0 +1,2317 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ff8243f3-9c96-4cb0-b703-0af0107bc8f7\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ff8243f3-9c96-4cb0-b703-0af0107bc8f7\",\"fieldName\":\"azure.resource.name\",\"title\":\"Filter by Function App\",\"enhancements\":{},\"selectedOptions\":[]}},\"bebd2bf5-eb88-4157-b86b-e6fd9e322b13\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"bebd2bf5-eb88-4157-b86b-e6fd9e322b13\",\"fieldName\":\"azure.resource.group\",\"title\":\"Filter by resource group\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-f6c3c469-2e64-4120-b144-997fb70575e2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f6c3c469-2e64-4120-b144-997fb70575e2": { + "columnOrder": [ + "b0f015a9-aab1-4b26-b28f-65ce55f354de" + ], + "columns": { + "b0f015a9-aab1-4b26-b28f-65ce55f354de": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Function Apps", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "f6c3c469-2e64-4120-b144-997fb70575e2", + "layerType": "data", + "metricAccessor": "b0f015a9-aab1-4b26-b28f-65ce55f354de", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 6, + "i": "58a522e8-acf6-4ad1-a5cc-a699ce9c26c0", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "58a522e8-acf6-4ad1-a5cc-a699ce9c26c0", + "title": "Number of Active Function Apps", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Health Check Status indicates if there are any unhealthy instances and if they need replacing. A value of 100 means all instances of the App reported a healthy status. ", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-113434b9-c581-4b79-9344-13864154c598", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "60014cf3-d9b4-46e8-ae69-999d31086fbc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "113434b9-c581-4b79-9344-13864154c598": { + "columnOrder": [ + "68c19ae2-0676-4b4a-90e7-c60d2ca556ac", + "8952901b-a1b3-4bb5-9605-c68a31cef340", + "6439d7ec-458f-4daf-a97a-101e6f025660" + ], + "columns": { + "6439d7ec-458f-4daf-a97a-101e6f025660": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.functions.health_check_status.avg: *" + }, + "isBucketed": false, + "label": "ExecutionCount", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.function_execution_count.total" + }, + "68c19ae2-0676-4b4a-90e7-c60d2ca556ac": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6439d7ec-458f-4daf-a97a-101e6f025660", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "8952901b-a1b3-4bb5-9605-c68a31cef340": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "azure.functions.health_check_status.avg: *", + "disabled": false, + "index": "60014cf3-d9b4-46e8-ae69-999d31086fbc", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"bool\":{\"filter\":[{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"exists\":{\"field\":\"azure.functions.health_check_status.avg\"}}]}}],\"must\":[],\"must_not\":[],\"should\":[]}}" + }, + "query": { + "bool": { + "filter": [ + { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "exists": { + "field": "azure.functions.health_check_status.avg" + } + } + ] + } + } + ], + "must": [], + "must_not": [], + "should": [] + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6439d7ec-458f-4daf-a97a-101e6f025660" + ], + "layerId": "113434b9-c581-4b79-9344-13864154c598", + "layerType": "data", + "seriesType": "line", + "splitAccessor": "68c19ae2-0676-4b4a-90e7-c60d2ca556ac", + "xAccessor": "8952901b-a1b3-4bb5-9605-c68a31cef340" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "Captures the number of execution of the function app. ", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b9d5606f-9607-4c90-a75f-c2857b266bfa", + "w": 15, + "x": 10, + "y": 0 + }, + "panelIndex": "b9d5606f-9607-4c90-a75f-c2857b266bfa", + "title": "Function Execution Count by Function Apps", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-8e323fe9-19c2-405d-bbf6-ba61dc9a190f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8e323fe9-19c2-405d-bbf6-ba61dc9a190f": { + "columnOrder": [ + "c4d0be17-9d74-468d-8e55-a064664300d1", + "2cbcc3e5-5848-4a88-910b-7c845618ae2e", + "b37bb938-9515-453c-a5ff-f384a7351317", + "b37bb938-9515-453c-a5ff-f384a7351317X1", + "b37bb938-9515-453c-a5ff-f384a7351317X0", + "b37bb938-9515-453c-a5ff-f384a7351317X2" + ], + "columns": { + "2cbcc3e5-5848-4a88-910b-7c845618ae2e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total number of invocations", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.requests.total" + }, + "b37bb938-9515-453c-a5ff-f384a7351317": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Success Percentage", + "operationType": "formula", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + }, + "formula": "sum(azure.functions.http2xx.total) / sum(azure.functions.requests.total) ", + "isFormulaBroken": false + }, + "references": [ + "b37bb938-9515-453c-a5ff-f384a7351317X2" + ], + "scale": "ratio" + }, + "b37bb938-9515-453c-a5ff-f384a7351317X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Success Percentage", + "operationType": "sum", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.functions.http2xx.total" + }, + "b37bb938-9515-453c-a5ff-f384a7351317X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Success Percentage", + "operationType": "sum", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.functions.requests.total" + }, + "b37bb938-9515-453c-a5ff-f384a7351317X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Success Percentage", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "b37bb938-9515-453c-a5ff-f384a7351317X0", + "b37bb938-9515-453c-a5ff-f384a7351317X1" + ], + "location": { + "max": 73, + "min": 0 + }, + "name": "divide", + "text": "sum(azure.functions.http2xx.total) / sum(azure.functions.requests.total) ", + "type": "function" + } + }, + "references": [ + "b37bb938-9515-453c-a5ff-f384a7351317X0", + "b37bb938-9515-453c-a5ff-f384a7351317X1" + ], + "scale": "ratio" + }, + "c4d0be17-9d74-468d-8e55-a064664300d1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top 10 Function Apps", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2cbcc3e5-5848-4a88-910b-7c845618ae2e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "c4d0be17-9d74-468d-8e55-a064664300d1", + "isTransposed": false + }, + { + "alignment": "left", + "colorMode": "cell", + "columnId": "2cbcc3e5-5848-4a88-910b-7c845618ae2e", + "isTransposed": false, + "palette": { + "name": "positive", + "params": { + "stops": [ + { + "color": "#d6e9e4", + "stop": 20 + }, + { + "color": "#aed3ca", + "stop": 40 + }, + { + "color": "#85bdb1", + "stop": 60 + }, + { + "color": "#5aa898", + "stop": 80 + }, + { + "color": "#209280", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "summaryRow": "none" + }, + { + "alignment": "left", + "columnId": "b37bb938-9515-453c-a5ff-f384a7351317", + "isTransposed": false + } + ], + "layerId": "8e323fe9-19c2-405d-bbf6-ba61dc9a190f", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "description": "Shows the number of successful invocations as a percentage of the total invocations per function app. ", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "44c459b4-623b-4534-ba78-8904669ae9cb", + "w": 23, + "x": 25, + "y": 0 + }, + "panelIndex": "44c459b4-623b-4534-ba78-8904669ae9cb", + "title": "Success Rate", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b0c25d59-67fb-4970-8b15-1da58db41925", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b0c25d59-67fb-4970-8b15-1da58db41925": { + "columnOrder": [ + "87ec7063-bff9-4d15-87e7-8f1da7b3f12b", + "bf6104e4-667c-4384-b819-842c52698256" + ], + "columns": { + "87ec7063-bff9-4d15-87e7-8f1da7b3f12b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "accuracyMode": false, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf6104e4-667c-4384-b819-842c52698256", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "bf6104e4-667c-4384-b819-842c52698256": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.requests.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.requests.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "b0c25d59-67fb-4970-8b15-1da58db41925", + "layerType": "data", + "legendDisplay": "default", + "legendPosition": "right", + "metrics": [ + "bf6104e4-667c-4384-b819-842c52698256" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "87ec7063-bff9-4d15-87e7-8f1da7b3f12b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "9196bdde-1f73-46f5-97f6-09db15a28b61", + "w": 10, + "x": 0, + "y": 6 + }, + "panelIndex": "9196bdde-1f73-46f5-97f6-09db15a28b61", + "title": "Total Number of Invocations across Function Apps", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Number of Function invocations that resulted in a HTTP 2xx response code", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4689dc73-dc78-4c03-b975-62264d68c33b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4689dc73-dc78-4c03-b975-62264d68c33b": { + "columnOrder": [ + "cb555077-660a-4e41-8974-9ad2d8e3b235", + "a3e51351-a9f0-414d-857e-d908e3919b15", + "a074efc1-3210-40c8-af5b-ba97da2de1ac" + ], + "columns": { + "a074efc1-3210-40c8-af5b-ba97da2de1ac": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.http2xx.total", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.http2xx.total" + }, + "a3e51351-a9f0-414d-857e-d908e3919b15": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cb555077-660a-4e41-8974-9ad2d8e3b235": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a074efc1-3210-40c8-af5b-ba97da2de1ac", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a074efc1-3210-40c8-af5b-ba97da2de1ac" + ], + "layerId": "4689dc73-dc78-4c03-b975-62264d68c33b", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "cb555077-660a-4e41-8974-9ad2d8e3b235", + "xAccessor": "a3e51351-a9f0-414d-857e-d908e3919b15" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "5430e8a9-47ae-4c82-96b7-b0287026409f", + "w": 16, + "x": 0, + "y": 15 + }, + "panelIndex": "5430e8a9-47ae-4c82-96b7-b0287026409f", + "title": "HTTP 2xx Responses", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-54edca01-9fb6-444a-8d98-ddb0ff36f9be", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "54edca01-9fb6-444a-8d98-ddb0ff36f9be": { + "columnOrder": [ + "6eddce7c-5301-479c-ab7b-8c574999c145", + "38a86941-b5ec-4a83-9684-0f70bb14a361", + "94937bdd-d5bb-469e-83b9-89e34f3a4614" + ], + "columns": { + "38a86941-b5ec-4a83-9684-0f70bb14a361": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6eddce7c-5301-479c-ab7b-8c574999c145": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "94937bdd-d5bb-469e-83b9-89e34f3a4614", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "94937bdd-d5bb-469e-83b9-89e34f3a4614": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.http4xx.total", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.http4xx.total" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "94937bdd-d5bb-469e-83b9-89e34f3a4614" + ], + "layerId": "54edca01-9fb6-444a-8d98-ddb0ff36f9be", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "6eddce7c-5301-479c-ab7b-8c574999c145", + "xAccessor": "38a86941-b5ec-4a83-9684-0f70bb14a361" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "Number of Function invocations that resulted in a HTTP 2xx response code", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "7a4bc820-cc0e-40fb-9aee-83ccf7615fa2", + "w": 16, + "x": 16, + "y": 15 + }, + "panelIndex": "7a4bc820-cc0e-40fb-9aee-83ccf7615fa2", + "title": "HTTP 4xx Responses", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Number of server errors or exceptions. ", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-419ba4b9-c54a-4e44-b7dc-475a2b04e4a8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "419ba4b9-c54a-4e44-b7dc-475a2b04e4a8": { + "columnOrder": [ + "ed0b46b6-3210-492d-b67b-027e0b427588", + "f4765a92-4ba2-4936-afa3-7e8648c99a8d", + "8d98f3f5-27bb-4ad2-82ec-277d763ab9cc" + ], + "columns": { + "8d98f3f5-27bb-4ad2-82ec-277d763ab9cc": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.http5xx.total", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.http5xx.total" + }, + "ed0b46b6-3210-492d-b67b-027e0b427588": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8d98f3f5-27bb-4ad2-82ec-277d763ab9cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f4765a92-4ba2-4936-afa3-7e8648c99a8d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8d98f3f5-27bb-4ad2-82ec-277d763ab9cc" + ], + "layerId": "419ba4b9-c54a-4e44-b7dc-475a2b04e4a8", + "layerType": "data", + "seriesType": "bar", + "splitAccessor": "ed0b46b6-3210-492d-b67b-027e0b427588", + "xAccessor": "f4765a92-4ba2-4936-afa3-7e8648c99a8d" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "266a1bc1-c35b-4959-96c1-5d799a98754c", + "w": 16, + "x": 32, + "y": 15 + }, + "panelIndex": "266a1bc1-c35b-4959-96c1-5d799a98754c", + "title": "HTTP 5xx Error Responses", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The time taken for the app to serve requests.", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-8d0f0cfa-b115-4100-ba7e-1cadee108055", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8d0f0cfa-b115-4100-ba7e-1cadee108055": { + "columnOrder": [ + "ae3ff95a-e30f-4e6d-a3c0-d589a984b82f", + "234483e9-2403-442e-bb76-d6315e2517af", + "bde63578-63d7-43ab-ad04-0b810b2f4033" + ], + "columns": { + "234483e9-2403-442e-bb76-d6315e2517af": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ae3ff95a-e30f-4e6d-a3c0-d589a984b82f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bde63578-63d7-43ab-ad04-0b810b2f4033", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "bde63578-63d7-43ab-ad04-0b810b2f4033": { + "dataType": "number", + "isBucketed": false, + "label": "Average of azure.functions.http_response_time.avg", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.http_response_time.avg" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "bde63578-63d7-43ab-ad04-0b810b2f4033" + ], + "layerId": "8d0f0cfa-b115-4100-ba7e-1cadee108055", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ae3ff95a-e30f-4e6d-a3c0-d589a984b82f", + "xAccessor": "234483e9-2403-442e-bb76-d6315e2517af" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The time taken for the app to serve requests.", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "5ef0d281-2eff-415a-ac37-d778985db835", + "w": 24, + "x": 0, + "y": 29 + }, + "panelIndex": "5ef0d281-2eff-415a-ac37-d778985db835", + "title": "Averave Response Time(in seconds)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The current amount of memory used by the app. ", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-750303c4-2d5f-4b67-8018-cba6ccc3e3f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "750303c4-2d5f-4b67-8018-cba6ccc3e3f8": { + "columnOrder": [ + "6a78eb36-cec6-41f4-bda8-c88c3fdabe7f", + "03e43362-ec04-4c0a-8cdf-0bd29107feee", + "1d2a33f9-47f5-4483-bd25-bf258b7fe434" + ], + "columns": { + "03e43362-ec04-4c0a-8cdf-0bd29107feee": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "1d2a33f9-47f5-4483-bd25-bf258b7fe434": { + "dataType": "number", + "isBucketed": false, + "label": "Average of azure.functions.average_memory_working_set.avg", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.average_memory_working_set.avg" + }, + "6a78eb36-cec6-41f4-bda8-c88c3fdabe7f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1d2a33f9-47f5-4483-bd25-bf258b7fe434", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1d2a33f9-47f5-4483-bd25-bf258b7fe434" + ], + "layerId": "750303c4-2d5f-4b67-8018-cba6ccc3e3f8", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "6a78eb36-cec6-41f4-bda8-c88c3fdabe7f", + "xAccessor": "03e43362-ec04-4c0a-8cdf-0bd29107feee" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The current amount of memory used by the app. ", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4f589bdd-7bbf-4b5e-88f7-68272155780d", + "w": 24, + "x": 24, + "y": 29 + }, + "panelIndex": "4f589bdd-7bbf-4b5e-88f7-68272155780d", + "title": "Memory Working Set by Function Apps", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "description": "The amount of incoming bandwidth consumed by the app. ", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "96b12503-3f63-4f80-9419-f8d25b7356fc", + "w": 24, + "x": 0, + "y": 44 + }, + "panelIndex": "96b12503-3f63-4f80-9419-f8d25b7356fc", + "panelRefName": "panel_96b12503-3f63-4f80-9419-f8d25b7356fc", + "title": "Top 10 Function Apps by Bytes Received ", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The amount of outgoing bandwidth sent by the app. ", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-fa95f5df-3ddf-44ed-88b8-793641935e0a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fa95f5df-3ddf-44ed-88b8-793641935e0a": { + "columnOrder": [ + "a3174d15-f56d-4533-b4e8-2006a55c51d4", + "4a76dd12-cd30-4e95-8b20-015379b31cf4", + "6d32a3d7-e8d2-4061-9d93-eeca1d25d957" + ], + "columns": { + "4a76dd12-cd30-4e95-8b20-015379b31cf4": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6d32a3d7-e8d2-4061-9d93-eeca1d25d957": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.bytes_sent.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.bytes_sent.total" + }, + "a3174d15-f56d-4533-b4e8-2006a55c51d4": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6d32a3d7-e8d2-4061-9d93-eeca1d25d957", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6d32a3d7-e8d2-4061-9d93-eeca1d25d957" + ], + "layerId": "fa95f5df-3ddf-44ed-88b8-793641935e0a", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "a3174d15-f56d-4533-b4e8-2006a55c51d4", + "xAccessor": "4a76dd12-cd30-4e95-8b20-015379b31cf4" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The amount of outgoing bandwidth sent by the app. ", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "578f6fe3-6edb-4678-b13c-1e9510f1942b", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "578f6fe3-6edb-4678-b13c-1e9510f1942b", + "title": "Top 10 Function Apps by Bytes Sent ", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The rate at which the app process is reading bytes from I/O operation", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-cc027ebf-f1dc-44ef-8907-7b7a407a7fe0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cc027ebf-f1dc-44ef-8907-7b7a407a7fe0": { + "columnOrder": [ + "d3c92de9-3de0-4478-a4a6-432e2c42c0ab", + "10d4106f-6c96-4dc2-8866-3f1fe7e81898", + "755983df-cc70-41bc-88d7-56ae24060492" + ], + "columns": { + "10d4106f-6c96-4dc2-8866-3f1fe7e81898": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "755983df-cc70-41bc-88d7-56ae24060492": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.io_read_bytes_per_second.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.io_read_bytes_per_second.total" + }, + "d3c92de9-3de0-4478-a4a6-432e2c42c0ab": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "755983df-cc70-41bc-88d7-56ae24060492", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "755983df-cc70-41bc-88d7-56ae24060492" + ], + "layerId": "cc027ebf-f1dc-44ef-8907-7b7a407a7fe0", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "d3c92de9-3de0-4478-a4a6-432e2c42c0ab", + "xAccessor": "10d4106f-6c96-4dc2-8866-3f1fe7e81898" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The rate at which the app process is reading bytes from I/O operation", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f7c59600-cc99-4d51-b8f8-20976818476a", + "w": 24, + "x": 0, + "y": 59 + }, + "panelIndex": "f7c59600-cc99-4d51-b8f8-20976818476a", + "title": "IO Read Bytes Per Second", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The rate at which the app process is writing bytes to I/O operations.", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0efd9b40-6f73-459b-8a6d-22bb9ea9f8f5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0efd9b40-6f73-459b-8a6d-22bb9ea9f8f5": { + "columnOrder": [ + "bf621d88-b10b-4d8b-86fc-33034ed0fdc9", + "e2344323-fc84-49dc-9a63-ff7cc0ac618a", + "017dace0-c878-45e7-8d98-bfba5bdade86" + ], + "columns": { + "017dace0-c878-45e7-8d98-bfba5bdade86": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.io_write_bytes_per_second.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.io_write_bytes_per_second.total" + }, + "bf621d88-b10b-4d8b-86fc-33034ed0fdc9": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "017dace0-c878-45e7-8d98-bfba5bdade86", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "e2344323-fc84-49dc-9a63-ff7cc0ac618a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "017dace0-c878-45e7-8d98-bfba5bdade86" + ], + "layerId": "0efd9b40-6f73-459b-8a6d-22bb9ea9f8f5", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "bf621d88-b10b-4d8b-86fc-33034ed0fdc9", + "xAccessor": "e2344323-fc84-49dc-9a63-ff7cc0ac618a" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The rate at which the app process is writing bytes to I/O operations.", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ba3dfc7e-d929-4dac-ba7e-d979652ec83a", + "w": 24, + "x": 24, + "y": 59 + }, + "panelIndex": "ba3dfc7e-d929-4dac-ba7e-d979652ec83a", + "title": "IO Write Bytes Per Second", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The rate at which the app process is issuing read I/O operations.", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e16f3e88-0dc5-490a-b45d-86b3dbd359a3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e16f3e88-0dc5-490a-b45d-86b3dbd359a3": { + "columnOrder": [ + "c5f39387-452a-4a77-8c48-831ecf41d972", + "d59f84c1-e509-4b82-bb73-8b30500124ec", + "32a41b5b-b737-4fd0-8b22-4a009d9c5555" + ], + "columns": { + "32a41b5b-b737-4fd0-8b22-4a009d9c5555": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.io_read_operations_per_second.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0, + "suffix": "/s" + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.io_read_operations_per_second.total" + }, + "c5f39387-452a-4a77-8c48-831ecf41d972": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "32a41b5b-b737-4fd0-8b22-4a009d9c5555", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "d59f84c1-e509-4b82-bb73-8b30500124ec": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "32a41b5b-b737-4fd0-8b22-4a009d9c5555" + ], + "layerId": "e16f3e88-0dc5-490a-b45d-86b3dbd359a3", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "c5f39387-452a-4a77-8c48-831ecf41d972", + "xAccessor": "d59f84c1-e509-4b82-bb73-8b30500124ec" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The rate at which the app process is issuing read I/O operations.", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "dc27d0ce-7296-4640-8bcd-d23a8f4830ab", + "w": 24, + "x": 0, + "y": 74 + }, + "panelIndex": "dc27d0ce-7296-4640-8bcd-d23a8f4830ab", + "title": "IO Read Operations Per Second", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "The rate at which the app process is issuing wite I/O operations.", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-effd480b-5d45-4c7e-9883-114e91117829", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "effd480b-5d45-4c7e-9883-114e91117829": { + "columnOrder": [ + "62dfa6f9-8995-4b01-8038-0a32c921ce4e", + "fb0c0a99-931d-407b-90e1-a7695f4e877a", + "4ff3447e-d940-4369-8cec-7f6ef83dd20f" + ], + "columns": { + "4ff3447e-d940-4369-8cec-7f6ef83dd20f": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.io_write_operations_per_second.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0, + "suffix": "/s" + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.io_write_operations_per_second.total" + }, + "62dfa6f9-8995-4b01-8038-0a32c921ce4e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4ff3447e-d940-4369-8cec-7f6ef83dd20f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "fb0c0a99-931d-407b-90e1-a7695f4e877a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "4ff3447e-d940-4369-8cec-7f6ef83dd20f" + ], + "layerId": "effd480b-5d45-4c7e-9883-114e91117829", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "62dfa6f9-8995-4b01-8038-0a32c921ce4e", + "xAccessor": "fb0c0a99-931d-407b-90e1-a7695f4e877a" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "description": "The rate at which the app process is issuing wite I/O operations.", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f907a3c8-a7aa-4cb8-8708-e316bb3cdeb6", + "w": 24, + "x": 24, + "y": 74 + }, + "panelIndex": "f907a3c8-a7aa-4cb8-8708-e316bb3cdeb6", + "title": "IO Write Operations Per Second", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Azure Functions] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-25T09:01:59.889Z", + "id": "azure_functions-5b40c9c0-33d4-11ee-8d85-2d7adebebd1b", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "58a522e8-acf6-4ad1-a5cc-a699ce9c26c0:indexpattern-datasource-layer-f6c3c469-2e64-4120-b144-997fb70575e2", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b9d5606f-9607-4c90-a75f-c2857b266bfa:indexpattern-datasource-layer-113434b9-c581-4b79-9344-13864154c598", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b9d5606f-9607-4c90-a75f-c2857b266bfa:60014cf3-d9b4-46e8-ae69-999d31086fbc", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "44c459b4-623b-4534-ba78-8904669ae9cb:indexpattern-datasource-layer-8e323fe9-19c2-405d-bbf6-ba61dc9a190f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9196bdde-1f73-46f5-97f6-09db15a28b61:indexpattern-datasource-layer-b0c25d59-67fb-4970-8b15-1da58db41925", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5430e8a9-47ae-4c82-96b7-b0287026409f:indexpattern-datasource-layer-4689dc73-dc78-4c03-b975-62264d68c33b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7a4bc820-cc0e-40fb-9aee-83ccf7615fa2:indexpattern-datasource-layer-54edca01-9fb6-444a-8d98-ddb0ff36f9be", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "266a1bc1-c35b-4959-96c1-5d799a98754c:indexpattern-datasource-layer-419ba4b9-c54a-4e44-b7dc-475a2b04e4a8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5ef0d281-2eff-415a-ac37-d778985db835:indexpattern-datasource-layer-8d0f0cfa-b115-4100-ba7e-1cadee108055", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "4f589bdd-7bbf-4b5e-88f7-68272155780d:indexpattern-datasource-layer-750303c4-2d5f-4b67-8018-cba6ccc3e3f8", + "type": "index-pattern" + }, + { + "id": "azure_functions-7f0826e0-33b2-11ee-8d85-2d7adebebd1b", + "name": "96b12503-3f63-4f80-9419-f8d25b7356fc:panel_96b12503-3f63-4f80-9419-f8d25b7356fc", + "type": "lens" + }, + { + "id": "metrics-*", + "name": "578f6fe3-6edb-4678-b13c-1e9510f1942b:indexpattern-datasource-layer-fa95f5df-3ddf-44ed-88b8-793641935e0a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f7c59600-cc99-4d51-b8f8-20976818476a:indexpattern-datasource-layer-cc027ebf-f1dc-44ef-8907-7b7a407a7fe0", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ba3dfc7e-d929-4dac-ba7e-d979652ec83a:indexpattern-datasource-layer-0efd9b40-6f73-459b-8a6d-22bb9ea9f8f5", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "dc27d0ce-7296-4640-8bcd-d23a8f4830ab:indexpattern-datasource-layer-e16f3e88-0dc5-490a-b45d-86b3dbd359a3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f907a3c8-a7aa-4cb8-8708-e316bb3cdeb6:indexpattern-datasource-layer-effd480b-5d45-4c7e-9883-114e91117829", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_ff8243f3-9c96-4cb0-b703-0af0107bc8f7:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_bebd2bf5-eb88-4157-b86b-e6fd9e322b13:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/azure_functions/kibana/lens/azure_functions-1e62d580-3491-11ee-8d85-2d7adebebd1b.json b/packages/azure_functions/kibana/lens/azure_functions-1e62d580-3491-11ee-8d85-2d7adebebd1b.json new file mode 100644 index 00000000000..b3216f8e59d --- /dev/null +++ b/packages/azure_functions/kibana/lens/azure_functions-1e62d580-3491-11ee-8d85-2d7adebebd1b.json @@ -0,0 +1,186 @@ +{ + "attributes": { + "description": "", + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "59e32faf-6efe-4b99-806e-0022e95bfe71": { + "columnOrder": [ + "b6caccad-3379-41e0-a011-efd0aa4c0268", + "de1705b8-3559-46ee-be47-0998ab9e9ce0", + "51003b73-f78c-4ed2-8e9a-d5e6d7d23239" + ], + "columns": { + "51003b73-f78c-4ed2-8e9a-d5e6d7d23239": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "azure.metrics.http_response_time.avg: *" + }, + "isBucketed": false, + "label": "Average of azure.functions.http_response_time.avg", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.functions.http_response_time.avg" + }, + "b6caccad-3379-41e0-a011-efd0aa4c0268": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "51003b73-f78c-4ed2-8e9a-d5e6d7d23239", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "de1705b8-3559-46ee-be47-0998ab9e9ce0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "azure.metrics.http_response_time.avg: *", + "disabled": false, + "index": "0b109d13-9358-4287-8292-7924e980f073", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"bool\":{\"filter\":[{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"exists\":{\"field\":\"azure.metrics.http_response_time.avg\"}}]}}],\"must\":[],\"must_not\":[],\"should\":[]}}" + }, + "query": { + "bool": { + "filter": [ + { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "exists": { + "field": "azure.metrics.http_response_time.avg" + } + } + ] + } + } + ], + "must": [], + "must_not": [], + "should": [] + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"azure.function\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "51003b73-f78c-4ed2-8e9a-d5e6d7d23239" + ], + "collapseFn": "", + "layerId": "59e32faf-6efe-4b99-806e-0022e95bfe71", + "layerType": "data", + "seriesType": "line", + "splitAccessor": "b6caccad-3379-41e0-a011-efd0aa4c0268", + "xAccessor": "de1705b8-3559-46ee-be47-0998ab9e9ce0" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Response time", + "visualizationType": "lnsXY" + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-13T19:12:36.830Z", + "id": "azure_functions-1e62d580-3491-11ee-8d85-2d7adebebd1b", + "migrationVersion": { + "lens": "8.6.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-59e32faf-6efe-4b99-806e-0022e95bfe71", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0b109d13-9358-4287-8292-7924e980f073", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_functions/kibana/lens/azure_functions-7f0826e0-33b2-11ee-8d85-2d7adebebd1b.json b/packages/azure_functions/kibana/lens/azure_functions-7f0826e0-33b2-11ee-8d85-2d7adebebd1b.json new file mode 100644 index 00000000000..7540ae1ae4f --- /dev/null +++ b/packages/azure_functions/kibana/lens/azure_functions-7f0826e0-33b2-11ee-8d85-2d7adebebd1b.json @@ -0,0 +1,147 @@ +{ + "attributes": { + "description": "", + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5e26da41-85b9-4f3d-b666-9b027f19f4c0": { + "columnOrder": [ + "e3e826ac-4145-4caa-97c7-0074740c3bde", + "4d55692b-10e3-4d58-8bc0-2973e9d8bd58", + "f807ce10-f26f-4f0a-a838-2baea3bb5ac2" + ], + "columns": { + "4d55692b-10e3-4d58-8bc0-2973e9d8bd58": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e3e826ac-4145-4caa-97c7-0074740c3bde": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f807ce10-f26f-4f0a-a838-2baea3bb5ac2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f807ce10-f26f-4f0a-a838-2baea3bb5ac2": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Sum of azure.functions.bytes_received.total", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.functions.bytes_received.total" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"azure.function\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f807ce10-f26f-4f0a-a838-2baea3bb5ac2" + ], + "layerId": "5e26da41-85b9-4f3d-b666-9b027f19f4c0", + "layerType": "data", + "seriesType": "line", + "splitAccessor": "e3e826ac-4145-4caa-97c7-0074740c3bde", + "xAccessor": "4d55692b-10e3-4d58-8bc0-2973e9d8bd58" + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Bytes Received", + "visualizationType": "lnsXY" + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-25T08:51:40.052Z", + "id": "azure_functions-7f0826e0-33b2-11ee-8d85-2d7adebebd1b", + "migrationVersion": { + "lens": "8.6.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-5e26da41-85b9-4f3d-b666-9b027f19f4c0", + "type": "index-pattern" + } + ], + "type": "lens" +} \ No newline at end of file diff --git a/packages/azure_functions/manifest.yml b/packages/azure_functions/manifest.yml new file mode 100644 index 00000000000..6df9a58e63b --- /dev/null +++ b/packages/azure_functions/manifest.yml @@ -0,0 +1,60 @@ +format_version: 2.5.1 +name: azure_functions +title: "Azure Functions" +version: 0.1.0 +source: + license: "Elastic-2.0" +description: "Get metrics and logs from Azure Functions" +type: integration +categories: + - azure + - cloud +conditions: + kibana.version: "^8.8.1" + elastic.subscription: "basic" +vars: + - name: resource_manager_endpoint + type: text + title: Resource Manager Endpoint + multi: false + required: false + show_user: true +icons: + - src: /img/azure-functions-icon.svg + title: Azure Functions logo + size: 32x32 + type: image/svg+xml +screenshots: + - src: /img/azure-functions-overview1.png + title: Azure Functions Overview dashboard + size: 600x600 + type: image/png + - src: /img/azure-functions-overview2.png + title: Azure Functions Overview dashboard + size: 600x600 + type: image/png + - src: /img/azure-functions-overview3.png + title: Azure Functions Overview dashboard + size: 600x600 + type: image/png +policy_templates: + - name: azure_functions + title: Azure Functions logs and metrics + description: Azure Functions logs and metrics with Elastic Agent. + data_streams: + - functionapplogs + - metrics + categories: + - azure + - cloud + inputs: + - type: "azure-eventhub" + title: "Collect Azure Functions logs from Event Hub" + description: "Collecting Functions logs from Azure (input: azure-eventhub)" + input_group: logs + - type: "azure/metrics" + title: "Collect Azure Functions metrics" + description: "Collecting Azure Functions metrics" + input_group: metrics +owner: + github: elastic/obs-infraobs-integrations diff --git a/packages/azure_metrics/changelog.yml b/packages/azure_metrics/changelog.yml index 8c9732228a1..dc40e1598d4 100644 --- a/packages/azure_metrics/changelog.yml +++ b/packages/azure_metrics/changelog.yml @@ -1,3 +1,138 @@ +- version: "1.0.43" + changes: + - description: Migrate File Storage Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7692 +- version: "1.0.42" + changes: + - description: Migrate Table Storage Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7690 +- version: "1.0.41" + changes: + - description: Migrate Queue Storage Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7662 +- version: "1.0.40" + changes: + - description: Add dimension and metric_type metadata to the database_account datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7503 +- version: "1.0.39" + changes: + - description: Remove region dimension in the database_account datastream + type: bugfix + link: https://github.com/elastic/integrations/pull/7725 +- version: "1.0.38" + changes: + - description: Migrate Compute VMs Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7508 +- version: "1.0.37" + changes: + - description: Migrate Storage Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7691 +- version: "1.0.36" + changes: + - description: Migrate Container Instance Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7638 +- version: "1.0.35" + changes: + - description: Normalize the azure.dimentions.status field value to lowercase. Values from Azure come in lowercase and capitalized versions (e.g., True/true/False/false). + type: bugfix + link: https://github.com/elastic/integrations/pull/7551 +- version: "1.0.34" + changes: + - description: Add dimension and metric_type metadata to the monitor datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7473 +- version: "1.0.33" + changes: + - description: Add missing region dimension, remove outdated azure metrics for the database_account datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7502 +- version: "1.0.32" + changes: + - description: Migrate Container Registry Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7563 +- version: "1.0.31" + changes: + - description: Migrate Compute VM Guest Memory & Process Metrics Compute VM dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7557 +- version: "1.0.30" + changes: + - description: Migrate Compute VM Guest ASP.NET & Sql Server dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7562 +- version: "1.0.29" + changes: + - description: Migrate Compute VM Guest Linux Metrics Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7558 +- version: "1.0.28" + changes: + - description: Add dimension and metric_type metadata to the compute_vm datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7293 +- version: "1.0.27" + changes: + - description: Migrate Container Service Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7529 +- version: "1.0.26" + changes: + - description: Migrate VM Scale Sets Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7496 +- version: "1.0.25" + changes: + - description: Migrate Database Account Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7428 +- version: "1.0.24" + changes: + - description: Fix the metrics field name in the container instance datastream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7445 +- version: "1.0.23" + changes: + - description: Add dimension and metric_type metadata to the compute_vm_scaleset datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7177 +- version: "1.0.22" + changes: + - description: Add dimension and metric_type metadata to the container_registry datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7155 +- version: "1.0.21" + changes: + - description: Migrate the visualizations to by value in dashboards to minimize the saved object clutter and reduce time to load. + type: enhancement + link: https://github.com/elastic/integrations/pull/7320 +- version: "1.0.20" + changes: + - description: Add missing azure dimensions to the container_registry and compute_vm_scaleset datastreams + type: enhancement + link: https://github.com/elastic/integrations/pull/7314 +- version: "1.0.19" + changes: + - description: Add dimension and metric_type metadata to the container_service datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7139 +- version: "1.0.18" + changes: + - description: Add missing azure dimensions to the kube_pod_status_phase and kube_pod_status_ready metrics + type: enhancement + link: https://github.com/elastic/integrations/pull/7245 +- version: "1.0.17" + changes: + - description: Add dimension and metric_type metadata to the container_instance datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7127 - version: "1.0.16" changes: - description: Added categories and/or subcategories. diff --git a/packages/azure_metrics/data_stream/compute_vm/fields/agent.yml b/packages/azure_metrics/data_stream/compute_vm/fields/agent.yml index da4e652c53b..cdfd49b5f89 100644 --- a/packages/azure_metrics/data_stream/compute_vm/fields/agent.yml +++ b/packages/azure_metrics/data_stream/compute_vm/fields/agent.yml @@ -22,6 +22,7 @@ - name: instance.id level: extended type: keyword + dimension: true ignore_above: 1024 description: Instance ID of the host machine. example: i-1234567890abcdef0 @@ -45,6 +46,7 @@ - name: region level: extended type: keyword + dimension: true ignore_above: 1024 description: Region in which this host is running. example: us-east-1 @@ -62,26 +64,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/compute_vm/fields/ecs.yml b/packages/azure_metrics/data_stream/compute_vm/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/compute_vm/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/compute_vm/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/compute_vm/fields/fields.yml b/packages/azure_metrics/data_stream/compute_vm/fields/fields.yml index 57966df6285..f1c3268f59a 100644 --- a/packages/azure_metrics/data_stream/compute_vm/fields/fields.yml +++ b/packages/azure_metrics/data_stream/compute_vm/fields/fields.yml @@ -2,5 +2,6 @@ type: object object_type: float object_type_mapping_type: "*" + metric_type: gauge description: >- - compute_vm + Returned compute_vm metrics diff --git a/packages/azure_metrics/data_stream/compute_vm/fields/package-fields.yml b/packages/azure_metrics/data_stream/compute_vm/fields/package-fields.yml index 28fa99283bd..e8599123a21 100644 --- a/packages/azure_metrics/data_stream/compute_vm/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/compute_vm/fields/package-fields.yml @@ -3,6 +3,7 @@ description: "" fields: - name: timegrain + dimension: true type: keyword description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -41,6 +43,7 @@ Azure resource tags. - name: namespace + dimension: true type: keyword description: > The namespace selected @@ -55,17 +58,26 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: device + type: keyword + dimension: true + description: Name of the device of the linux instance, eg. sda2 + - name: host + type: keyword + dimension: true + description: Name of the linux host + - name: name + type: keyword + dimension: true + description: Name of the device of the linux instance + - name: interface + type: keyword + dimension: true + description: Name of the network interface on the linux instance + - name: cpu + type: keyword + dimension: true + description: Cpu core on the linux instance diff --git a/packages/azure_metrics/data_stream/compute_vm_scaleset/agent/stream/stream.yml.hbs b/packages/azure_metrics/data_stream/compute_vm_scaleset/agent/stream/stream.yml.hbs index 3111686d215..2e1da9624aa 100644 --- a/packages/azure_metrics/data_stream/compute_vm_scaleset/agent/stream/stream.yml.hbs +++ b/packages/azure_metrics/data_stream/compute_vm_scaleset/agent/stream/stream.yml.hbs @@ -34,9 +34,8 @@ resources: namespace: "Microsoft.Compute/virtualMachineScaleSets" timegrain: "PT5M" ignore_unsupported: true - - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Network Out Total", - "Network In Total", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage", - "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", + - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Network Out Total", + "Network In Total", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec"] namespace: "Microsoft.Compute/virtualMachineScaleSets" ignore_unsupported: true @@ -44,6 +43,15 @@ resources: dimensions: - name: "VMName" value: "*" + - name: ["Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "VMName" + value: "*" + - name: "LUN" + value: "*" - name: ["Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"] namespace: "Azure.VM.Windows.GuestMetrics" timegrain: "PT5M" @@ -61,16 +69,24 @@ resources: namespace: "Microsoft.Compute/virtualMachineScaleSets" timegrain: "PT5M" ignore_unsupported: true - - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Network Out Total", - "Network In Total", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage", - "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", - "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec"] + - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Network Out Total", + "Network In Total", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", + "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec"] namespace: "Microsoft.Compute/virtualMachineScaleSets" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "VMName" value: "*" + - name: ["Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "VMName" + value: "*" + - name: "LUN" + value: "*" - name: ["Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"] namespace: "Azure.VM.Windows.GuestMetrics" timegrain: "PT5M" @@ -88,16 +104,24 @@ resources: namespace: "Microsoft.Compute/virtualMachineScaleSets" timegrain: "PT5M" ignore_unsupported: true - - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Network Out Total", - "Network In Total", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage", - "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", - "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec"] + - name: ["Available Memory Bytes", "Percentage CPU", "Disk Read Bytes", "Disk Write Bytes", "Disk Read Operations/Sec", "Disk Write Operations/Sec", "Network Out Total", + "Network In Total", "Outbound Flows Maximum Creation Rate", "Inbound Flows Maximum Creation Rate", "Outbound Flows", "Inbound Flows", + "OS Disk Queue Depth", "OS Disk Write Operations/Sec", "OS Disk Read Operations/Sec", "OS Disk Write Bytes/sec", "OS Disk Read Bytes/sec"] namespace: "Microsoft.Compute/virtualMachineScaleSets" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "VMName" value: "*" + - name: ["Data Disk Read Bytes/sec", "Data Disk Write Bytes/sec", "Data Disk Read Operations/Sec", "Data Disk Write Operations/Sec", "Data Disk Queue Depth", "Data Disk Bandwidth Consumed Percentage"] + namespace: "Microsoft.Compute/virtualMachineScaleSets" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "VMName" + value: "*" + - name: "LUN" + value: "*" - name: ["Memory\\Commit Limit", "Memory\\Committed Bytes", "Memory\\% Committed Bytes In Use", "Memory\\Available Bytes"] namespace: "Azure.VM.Windows.GuestMetrics" timegrain: "PT5M" diff --git a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/agent.yml b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/agent.yml +++ b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/ecs.yml b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/fields.yml b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/fields.yml index f79d4ed50ad..8ab44d8386c 100644 --- a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/fields.yml +++ b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/fields.yml @@ -1,7 +1,128 @@ -- name: azure.compute_vm_scaleset.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - compute_vm_scaleset - +- name: azure.compute_vm_scaleset + type: group + fields: + - name: cpu_credits_remaining.avg + type: float + metric_type: gauge + description: Total number of credits available to burst. Only available on B-series burstable VMs + - name: cpu_credits_consumed.avg + type: float + metric_type: gauge + description: Total number of credits consumed by the Virtual Machine. Only available on B-series burstable VMs + - name: available_memory_bytes.avg + type: float + unit: byte + metric_type: gauge + description: Amount of physical memory, in bytes, immediately available for allocation to a process or for system use in the Virtual Machine + - name: percentage_cpu.avg + type: float + unit: percent + metric_type: gauge + description: The percentage of allocated compute units that are currently in use by the Virtual Machine(s) + - name: disk_read_bytes.total + type: float + unit: byte + metric_type: gauge + description: Bytes read from disk during monitoring period + - name: disk_write_bytes.total + type: float + unit: byte + metric_type: gauge + description: Bytes written to disk during monitoring period + - name: disk_read_operations_per_sec.avg + type: float + metric_type: gauge + description: Disk Read IOPS + - name: disk_write_operations_per_sec.avg + type: float + metric_type: gauge + description: Disk Write IOPS + - name: data_disk_read_bytes_per_sec.avg + type: float + metric_type: gauge + description: Bytes/Sec read from a single disk during monitoring period + - name: data_disk_write_bytes_per_sec.avg + type: float + metric_type: gauge + description: Bytes/Sec written to a single disk during monitoring period + - name: network_out_total.total + type: float + metric_type: gauge + description: The number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic) + - name: network_in_total.total + type: float + metric_type: gauge + description: The number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic) + - name: data_disk_read_operations_per_sec.avg + type: float + metric_type: gauge + description: Read IOPS from a single disk during monitoring period + - name: data_disk_write_operations_per_sec.avg + type: float + metric_type: gauge + description: Write IOPS from a single disk during monitoring period + - name: data_disk_queue_depth.avg + type: float + metric_type: gauge + description: Data Disk Queue Depth(or Queue Length) + - name: data_disk_bandwidth_consumed_percentage.avg + type: float + unit: percent + metric_type: gauge + description: Percentage of data disk bandwidth consumed per minute + - name: outbound_flows_maximum_creation_rate.avg + type: float + metric_type: gauge + description: The maximum creation rate of outbound flows (traffic going out of the VM) + - name: inbound_flows_maximum_creation_rate.avg + type: float + metric_type: gauge + description: The maximum creation rate of inbound flows (traffic going into the VM) + - name: outbound_flows.avg + type: float + metric_type: gauge + description: Outbound Flows are number of current flows in the outbound direction (traffic going out of the VM) + - name: inbound_flows.avg + type: float + metric_type: gauge + description: Inbound Flows are number of current flows in the inbound direction (traffic going into the VM) + - name: os_disk_queue_depth.avg + type: float + metric_type: gauge + description: OS Disk Queue Depth(or Queue Length) + - name: os_disk_write_operations_per_sec.avg + type: float + metric_type: gauge + description: Write IOPS from a single disk during monitoring period for OS disk + - name: os_disk_read_operations_per_sec.avg + type: float + metric_type: gauge + description: Read IOPS from a single disk during monitoring period for OS disk + - name: os_disk_write_bytes_per_sec.avg + type: float + metric_type: gauge + description: Bytes/Sec written to a single disk during monitoring period for OS disk + - name: os_disk_read_bytes_per_sec.avg + type: float + metric_type: gauge + description: Bytes/Sec read from a single disk during monitoring period for OS disk + - name: memory_commit_limit.avg + unit: byte + type: float + metric_type: gauge + description: Memory commit limit + - name: memory_committed_bytes.avg + unit: byte + type: float + metric_type: gauge + description: Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only. + - name: memory_pct_committed_bytes_in_use.avg + type: float + unit: percent + metric_type: gauge + description: Committed Bytes In Use is the ratio of Memory \ Committed Bytes to the Memory \ Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This value displays the current percentage value only. + - name: memory_available_bytes.avg + unit: byte + type: float + metric_type: gauge + description: Available Bytes is the amount of physical memory, in bytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. diff --git a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/package-fields.yml b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/package-fields.yml index 28fa99283bd..02b1fa45f43 100644 --- a/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/compute_vm_scaleset/fields/package-fields.yml @@ -3,6 +3,7 @@ description: "" fields: - name: timegrain + dimension: true type: keyword description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -55,17 +57,18 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: "vmname" + type: keyword + dimension: true + description: The VM name + - name: "virtual_machine" + type: keyword + dimension: true + description: The VM name + - name: "lun" + type: keyword + dimension: true + description: Logical Unit Number is a number that is used to identify a specific storage device diff --git a/packages/azure_metrics/data_stream/container_instance/_dev/test/pipeline/test-azure-metrics-container-instance.json b/packages/azure_metrics/data_stream/container_instance/_dev/test/pipeline/test-azure-metrics-container-instance.json index 1ae15e04e3c..4bb2ad2e279 100644 --- a/packages/azure_metrics/data_stream/container_instance/_dev/test/pipeline/test-azure-metrics-container-instance.json +++ b/packages/azure_metrics/data_stream/container_instance/_dev/test/pipeline/test-azure-metrics-container-instance.json @@ -50,7 +50,7 @@ "azure": { "subscription_id": "70bd6e77-4b1e-4835-8896-db77b8eef364", "timegrain": "PT5M", - "monitor": { + "metrics": { "network_bytes_transmitted_per_second": { "avg": 0 }, diff --git a/packages/azure_metrics/data_stream/container_instance/elasticsearch/ingest_pipeline/default.yml b/packages/azure_metrics/data_stream/container_instance/elasticsearch/ingest_pipeline/default.yml index bfbbac4471d..37126d4a4f5 100644 --- a/packages/azure_metrics/data_stream/container_instance/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_metrics/data_stream/container_instance/elasticsearch/ingest_pipeline/default.yml @@ -5,7 +5,7 @@ processors: field: ecs.version value: "8.0.0" - rename: - field: azure.monitor + field: azure.metrics target_field: azure.container_instance ignore_missing: true on_failure: diff --git a/packages/azure_metrics/data_stream/container_instance/fields/agent.yml b/packages/azure_metrics/data_stream/container_instance/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/container_instance/fields/agent.yml +++ b/packages/azure_metrics/data_stream/container_instance/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/container_instance/fields/ecs.yml b/packages/azure_metrics/data_stream/container_instance/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/container_instance/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/container_instance/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/container_instance/fields/fields.yml b/packages/azure_metrics/data_stream/container_instance/fields/fields.yml index a8b40675349..0aadce33131 100644 --- a/packages/azure_metrics/data_stream/container_instance/fields/fields.yml +++ b/packages/azure_metrics/data_stream/container_instance/fields/fields.yml @@ -1,7 +1,34 @@ -- name: azure.container_instance.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - container instance - +- name: azure.container_instance + type: group + fields: + - name: cpu_usage.avg + type: float + metric_type: gauge + description: CPU usage on all cores in millicores. + - name: memory_usage.avg + type: float + metric_type: gauge + unit: byte + description: Total memory usage in byte. + - name: network_bytes_received_per_second.avg + type: float + metric_type: gauge + unit: byte + description: The network bytes received per second. + - name: network_bytes_transmitted_per_second.avg + type: float + metric_type: gauge + unit: byte + description: The network bytes transmitted per second. +- name: azure.metrics.cpu_usage.avg + type: alias + path: azure.container_instance.cpu_usage.avg +- name: azure.metrics.memory_usage.avg + type: alias + path: azure.container_instance.memory_usage.avg +- name: azure.metrics.network_bytes_received_per_second.avg + type: alias + path: azure.container_instance.network_bytes_received_per_second.avg +- name: azure.metrics.network_bytes_transmitted_per_second.avg + type: alias + path: azure.container_instance.network_bytes_transmitted_per_second.avg diff --git a/packages/azure_metrics/data_stream/container_instance/fields/package-fields.yml b/packages/azure_metrics/data_stream/container_instance/fields/package-fields.yml index 28fa99283bd..6b49881a897 100644 --- a/packages/azure_metrics/data_stream/container_instance/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/container_instance/fields/package-fields.yml @@ -2,7 +2,9 @@ type: group description: "" fields: + # Reason to add as a dimension field: the same metric can be pulled multiple times, but with the different granularity - name: timegrain + dimension: true type: keyword description: > The Azure metric timegrain @@ -23,8 +25,11 @@ description: > The name of the resource + # Reason to add as a dimension field: it is an unique global resource identifier in the region + # format: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName} - name: id type: keyword + dimension: true description: > The id of the resource @@ -55,17 +60,32 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: container_name + type: keyword + dimension: true + description: The container name + - name: metrics + type: group + fields: + - name: cpu_usage.avg + type: float + metric_type: gauge + description: CPU usage on all cores in millicores. + - name: memory_usage.avg + type: float + metric_type: gauge + unit: byte + description: Total memory usage in byte. + - name: network_bytes_received_per_second.avg + type: float + metric_type: gauge + unit: byte + description: The network bytes received per second. + - name: network_bytes_transmitted_per_second.avg + type: float + metric_type: gauge + unit: byte + description: The network bytes transmitted per second. diff --git a/packages/azure_metrics/data_stream/container_registry/agent/stream/stream.yml.hbs b/packages/azure_metrics/data_stream/container_registry/agent/stream/stream.yml.hbs index 620ac99cc75..41f6c868428 100644 --- a/packages/azure_metrics/data_stream/container_registry/agent/stream/stream.yml.hbs +++ b/packages/azure_metrics/data_stream/container_registry/agent/stream/stream.yml.hbs @@ -33,7 +33,10 @@ resources: timegrain: "PT5M" - name: ["StorageUsed"] namespace: "Microsoft.ContainerRegistry/registries" - timegrain: "PT1H" + timegrain: "PT1H" + dimensions: + - name: "Geolocation" + value: "*" {{/each}} {{/if}} {{#if resource_ids}} @@ -47,6 +50,9 @@ resources: - name: ["StorageUsed"] namespace: "Microsoft.ContainerRegistry/registries" timegrain: "PT1H" + dimensions: + - name: "Geolocation" + value: "*" {{/each}} {{/if}} @@ -64,6 +70,9 @@ resources: timegrain: "PT5M" - name: ["StorageUsed"] namespace: "Microsoft.ContainerRegistry/registries" - timegrain: "PT1H" + timegrain: "PT1H" + dimensions: + - name: "Geolocation" + value: "*" {{/unless}} -{{/unless}} \ No newline at end of file +{{/unless}} diff --git a/packages/azure_metrics/data_stream/container_registry/fields/agent.yml b/packages/azure_metrics/data_stream/container_registry/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/container_registry/fields/agent.yml +++ b/packages/azure_metrics/data_stream/container_registry/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/container_registry/fields/ecs.yml b/packages/azure_metrics/data_stream/container_registry/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/container_registry/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/container_registry/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/container_registry/fields/fields.yml b/packages/azure_metrics/data_stream/container_registry/fields/fields.yml index 2126ed6bdbf..9af75a0c2bb 100644 --- a/packages/azure_metrics/data_stream/container_registry/fields/fields.yml +++ b/packages/azure_metrics/data_stream/container_registry/fields/fields.yml @@ -1,7 +1,34 @@ -- name: azure.container_registry.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - container registry - +- name: azure.container_registry + type: group + fields: + - name: successful_pull_count.total + type: float + metric_type: gauge + description: Number of successful image pulls + - name: successful_push_count.total + type: float + metric_type: gauge + description: Number of successful image pushes + - name: total_pull_count.total + type: float + metric_type: gauge + description: Number of image pulls in total + - name: total_push_count.total + type: float + metric_type: gauge + description: Number of image pushes in total + - name: run_duration.total + type: float + metric_type: gauge + unit: ms + description: ACR tasks run duration in milliseconds + - name: agent_pool_cpu_time.total + type: float + metric_type: gauge + unis: s + description: AgentPool CPU Time in seconds + - name: storage_used.avg + type: float + metric_type: gauge + unit: byte + description: The amount of storage used by the container registry. For a registry account, it's the sum of capacity used by all the repositories within a registry. It's sum of capacity used by shared layers, manifest files, and replica copies in each of its repositories. diff --git a/packages/azure_metrics/data_stream/container_registry/fields/package-fields.yml b/packages/azure_metrics/data_stream/container_registry/fields/package-fields.yml index 28fa99283bd..3dc39b31b4b 100644 --- a/packages/azure_metrics/data_stream/container_registry/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/container_registry/fields/package-fields.yml @@ -4,6 +4,7 @@ fields: - name: timegrain type: keyword + dimension: true description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -55,17 +57,10 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: "geolocation" + type: keyword + dimension: true + description: Geolocation of the container registry diff --git a/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json b/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json new file mode 100644 index 00000000000..18c57694440 --- /dev/null +++ b/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json @@ -0,0 +1,109 @@ +{ + "events": [ + { + "cloud": { + "provider": "azure", + "region": "eastus" + }, + "agent": { + "name": "nuc", + "id": "07a32214-3f86-4708-b777-0a6b6704cede", + "ephemeral_id": "31e495a5-0448-493f-9edb-6c6c236821ed", + "type": "metricbeat", + "version": "8.6.2" + }, + "@timestamp": "2023-08-27T17:52:00.000Z", + "ecs": { + "version": "8.0.0" + }, + "service": { + "type": "azure" + }, + "data_stream": { + "namespace": "default", + "type": "metrics", + "dataset": "azure.container_service" + }, + "elastic_agent": { + "id": "07a32214-3f86-4708-b777-0a6b6704cede", + "version": "8.6.2", + "snapshot": false + }, + "host": { + "hostname": "nuc", + "os": { + "kernel": "5.15.0-52-generic", + "codename": "focal", + "name": "Ubuntu", + "type": "linux", + "family": "debian", + "version": "20.04.6 LTS (Focal Fossa)", + "platform": "ubuntu" + }, + "containerized": false, + "ip": [ + "10.0.4.95", + "fd9e:5faf:a45e:4bdc:2569:fc55:7ac4:e2aa", + "fd9e:5faf:a45e:4bdc:f2f7:f043:7ff6:7c1", + "fd9e:5faf:a45e:4bdc:e079:d89c:d3a7:201c", + "fd9e:5faf:a45e:4bdc:a259:581f:d58b:c4fa", + "fd9e:5faf:a45e:4bdc:430e:e01f:a39c:f9df", + "fd9e:5faf:a45e:4bdc:7fc9:94ef:e42f:f37c", + "fd9e:5faf:a45e:4bdc:3408:7540:8aca:3575", + "fd9e:5faf:a45e:4bdc:513b:644e:d740:ecb4", + "fe80::2712:5fda:480a:f33a", + "172.17.0.1", + "fe80::42:81ff:fe96:c5ac", + "172.27.0.1", + "fe80::42:71ff:fe31:ec12", + "fe80::6864:14ff:fec8:2034" + ], + "name": "nuc", + "id": "edc1194d71414665a9facb567d76caea", + "mac": [ + "02-42-71-31-EC-12", + "02-42-81-96-C5-AC", + "6A-64-14-C8-20-34", + "80-86-F2-96-BD-5B", + "C0-3F-D5-69-24-DC" + ], + "architecture": "x86_64" + }, + "metricset": { + "period": 300000, + "name": "monitor" + }, + "event": { + "duration": 6338886808, + "agent_id_status": "verified", + "ingested": "2023-08-27T17:57:19Z", + "module": "azure", + "dataset": "azure.container_service" + }, + "azure": { + "subscription_id": "a2960656-390f-47b5-a154-b048d34ab096", + "timegrain": "PT5M", + "container_service": { + "kube_node_status_condition": { + "avg": 1 + } + }, + "resource": { + "name": "test", + "id": "/subscriptions/a2960656-390f-47b5-a154-b048d34ab096/resourceGroups/test_group/providers/Microsoft.ContainerService/managedClusters/test", + "type": "Microsoft.ContainerService/managedClusters", + "group": "test_group", + "tags": { + "custodian_status": "Resource does not meet policy: delete@2023/09/26" + } + }, + "namespace": "Microsoft.ContainerService/managedClusters", + "dimensions": { + "node": "aks-agentpool-12628255-vmss000002", + "condition": "KubeletProblem", + "status": "False" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json-expected.json b/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json-expected.json new file mode 100644 index 00000000000..b3d6388c9f5 --- /dev/null +++ b/packages/azure_metrics/data_stream/container_service/_dev/test/pipeline/test-azure-container-service.json-expected.json @@ -0,0 +1,109 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-27T17:52:00.000Z", + "agent": { + "ephemeral_id": "31e495a5-0448-493f-9edb-6c6c236821ed", + "id": "07a32214-3f86-4708-b777-0a6b6704cede", + "name": "nuc", + "type": "metricbeat", + "version": "8.6.2" + }, + "azure": { + "container_service": { + "kube_node_status_condition": { + "avg": 1 + } + }, + "dimensions": { + "condition": "KubeletProblem", + "node": "aks-agentpool-12628255-vmss000002", + "status": "false" + }, + "namespace": "Microsoft.ContainerService/managedClusters", + "resource": { + "group": "test_group", + "id": "/subscriptions/a2960656-390f-47b5-a154-b048d34ab096/resourceGroups/test_group/providers/Microsoft.ContainerService/managedClusters/test", + "name": "test", + "tags": { + "custodian_status": "Resource does not meet policy: delete@2023/09/26" + }, + "type": "Microsoft.ContainerService/managedClusters" + }, + "subscription_id": "a2960656-390f-47b5-a154-b048d34ab096", + "timegrain": "PT5M" + }, + "cloud": { + "provider": "azure", + "region": "eastus" + }, + "data_stream": { + "dataset": "azure.container_service", + "namespace": "default", + "type": "metrics" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "07a32214-3f86-4708-b777-0a6b6704cede", + "snapshot": false, + "version": "8.6.2" + }, + "event": { + "agent_id_status": "verified", + "dataset": "azure.container_service", + "duration": 6338886808, + "ingested": "2023-08-27T17:57:19Z", + "module": "azure" + }, + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "nuc", + "id": "edc1194d71414665a9facb567d76caea", + "ip": [ + "10.0.4.95", + "fd9e:5faf:a45e:4bdc:2569:fc55:7ac4:e2aa", + "fd9e:5faf:a45e:4bdc:f2f7:f043:7ff6:7c1", + "fd9e:5faf:a45e:4bdc:e079:d89c:d3a7:201c", + "fd9e:5faf:a45e:4bdc:a259:581f:d58b:c4fa", + "fd9e:5faf:a45e:4bdc:430e:e01f:a39c:f9df", + "fd9e:5faf:a45e:4bdc:7fc9:94ef:e42f:f37c", + "fd9e:5faf:a45e:4bdc:3408:7540:8aca:3575", + "fd9e:5faf:a45e:4bdc:513b:644e:d740:ecb4", + "fe80::2712:5fda:480a:f33a", + "172.17.0.1", + "fe80::42:81ff:fe96:c5ac", + "172.27.0.1", + "fe80::42:71ff:fe31:ec12", + "fe80::6864:14ff:fec8:2034" + ], + "mac": [ + "02-42-71-31-EC-12", + "02-42-81-96-C5-AC", + "6A-64-14-C8-20-34", + "80-86-F2-96-BD-5B", + "C0-3F-D5-69-24-DC" + ], + "name": "nuc", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.0-52-generic", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "monitor", + "period": 300000 + }, + "service": { + "type": "azure" + } + } + ] +} \ No newline at end of file diff --git a/packages/azure_metrics/data_stream/container_service/agent/stream/stream.yml.hbs b/packages/azure_metrics/data_stream/container_service/agent/stream/stream.yml.hbs index 9ac3a4ace24..2f0eda75a2d 100644 --- a/packages/azure_metrics/data_stream/container_service/agent/stream/stream.yml.hbs +++ b/packages/azure_metrics/data_stream/container_service/agent/stream/stream.yml.hbs @@ -43,13 +43,28 @@ resources: namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" - - name: ["kube_pod_status_ready", "kube_pod_status_phase"] + - name: ["kube_pod_status_ready"] namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "pod" - value: "*" + value: "*" + - name: "namespace" + value: "*" + - name: "condition" + value: "*" + - name: ["kube_pod_status_phase"] + namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "pod" + value: "*" + - name: "namespace" + value: "*" + - name: "phase" + value: "*" {{/each}} {{/if}} {{#if resource_ids}} @@ -71,13 +86,28 @@ resources: namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" - - name: ["kube_pod_status_ready", "kube_pod_status_phase"] + - name: ["kube_pod_status_ready"] namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "pod" value: "*" + - name: "namespace" + value: "*" + - name: "condition" + value: "*" + - name: ["kube_pod_status_phase"] + namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "pod" + value: "*" + - name: "namespace" + value: "*" + - name: "phase" + value: "*" {{/each}} {{/if}} @@ -105,12 +135,27 @@ resources: namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" - - name: ["kube_pod_status_ready", "kube_pod_status_phase"] + - name: ["kube_pod_status_ready"] namespace: "Microsoft.ContainerService/managedClusters" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "pod" - value: "*" + value: "*" + - name: "namespace" + value: "*" + - name: "condition" + value: "*" + - name: ["kube_pod_status_phase"] + namespace: "Microsoft.ContainerService/managedClusters" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "pod" + value: "*" + - name: "namespace" + value: "*" + - name: "phase" + value: "*" {{/unless}} -{{/unless}} \ No newline at end of file +{{/unless}} diff --git a/packages/azure_metrics/data_stream/container_service/elasticsearch/ingest_pipeline/default.yml b/packages/azure_metrics/data_stream/container_service/elasticsearch/ingest_pipeline/default.yml index e8f65cbc194..c8ae46bc311 100644 --- a/packages/azure_metrics/data_stream/container_service/elasticsearch/ingest_pipeline/default.yml +++ b/packages/azure_metrics/data_stream/container_service/elasticsearch/ingest_pipeline/default.yml @@ -4,6 +4,10 @@ processors: - set: field: ecs.version value: "8.0.0" + - lowercase: + field: azure.dimensions.status + ignore_missing: true + description: Normalize the `azure.dimentions.status` field value to lowercase. Values from Azure come in lowercase and capitalized versions (e.g., True/true/False/false). - rename: field: azure.metrics target_field: azure.container_service diff --git a/packages/azure_metrics/data_stream/container_service/fields/agent.yml b/packages/azure_metrics/data_stream/container_service/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/container_service/fields/agent.yml +++ b/packages/azure_metrics/data_stream/container_service/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/container_service/fields/ecs.yml b/packages/azure_metrics/data_stream/container_service/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/container_service/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/container_service/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/container_service/fields/fields.yml b/packages/azure_metrics/data_stream/container_service/fields/fields.yml index 00416225f87..85d3cd25f33 100644 --- a/packages/azure_metrics/data_stream/container_service/fields/fields.yml +++ b/packages/azure_metrics/data_stream/container_service/fields/fields.yml @@ -1,7 +1,23 @@ -- name: azure.container_service.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - container service - +- name: azure.container_service + type: group + fields: + - name: kube_node_status_condition.avg + type: float + metric_type: gauge + description: Statuses for various node conditions + - name: kube_node_status_allocatable_cpu_cores.avg + type: float + metric_type: gauge + description: Total number of available cpu cores in a managed cluster + - name: kube_node_status_allocatable_memory_bytes.avg + type: float + metric_type: gauge + description: Total amount of available memory in a managed cluster + - name: kube_pod_status_ready.avg + type: float + metric_type: gauge + description: Number of pods in Ready state + - name: kube_pod_status_phase.avg + type: float + metric_type: gauge + description: Number of pods by phase diff --git a/packages/azure_metrics/data_stream/container_service/fields/package-fields.yml b/packages/azure_metrics/data_stream/container_service/fields/package-fields.yml index 28fa99283bd..052de7832b1 100644 --- a/packages/azure_metrics/data_stream/container_service/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/container_service/fields/package-fields.yml @@ -4,6 +4,7 @@ fields: - name: timegrain type: keyword + dimension: true description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -55,17 +57,29 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: node + type: keyword + dimension: true + description: Node name + - name: status + type: keyword + description: Statuses for various node conditions + - name: condition + type: keyword + dimension: true + description: Pod or Node conditions + - name: pod + type: keyword + dimension: true + description: Pod name + - name: namespace + type: keyword + dimension: true + description: Pod namespace + - name: phase + type: keyword + dimension: true + description: Pod phase diff --git a/packages/azure_metrics/data_stream/database_account/agent/stream/stream.yml.hbs b/packages/azure_metrics/data_stream/database_account/agent/stream/stream.yml.hbs index c53e27efd9d..b0be4ccb8ca 100644 --- a/packages/azure_metrics/data_stream/database_account/agent/stream/stream.yml.hbs +++ b/packages/azure_metrics/data_stream/database_account/agent/stream/stream.yml.hbs @@ -31,14 +31,22 @@ resources: - name: ["AddRegion", "RemoveRegion", "UpdateAccountReplicationSettings", "UpdateAccountNetworkSettings", "UpdateAccountKeys", "ServiceAvailability", "ReplicationLatency", "RegionFailover", "DeleteAccount", "CreateAccount", "UpdateDiagnosticsSettings"] namespace: "Microsoft.DocumentDb/databaseAccounts" - - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "MongoRequests", "MongoRequestsCount", - "MongoRequestsInsert", "MongoRequestsDelete", "MongoRequestsQuery", "MongoRequestsUpdate","ProvisionedThroughput", "NormalizedRUConsumption"] + - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "NormalizedRUConsumption", "ProvisionedThroughput"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" value: "*" + - name: ["MongoRequests"] + namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "DatabaseName" + value: "*" + - name: "CommandName" + value: "*" - name: ["TotalRequestUnits", "TotalRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true @@ -63,9 +71,9 @@ resources: - name: "ClosureReason" value: "*" - name: [ "GremlinDatabaseDelete", "GremlinDatabaseThroughputUpdate", "GremlinDatabaseUpdate", "GremlinGraphDelete","GremlinGraphThroughputUpdate", "GremlinGraphUpdate", - "MongoCollectionDelete", "MongoCollectionThroughputUpdate", "MongoCollectionUpdate", "MongoDBDatabaseUpdate", "MongoDatabaseDelete", "MongoDatabaseThroughputUpdate", - "CassandraKeyspaceDelete", "CassandraKeyspaceThroughputUpdate", "CassandraKeyspaceUpdate","CassandraTableDelete", "CassandraTableThroughputUpdate", "CassandraTableUpdate", - "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", + "MongoCollectionDelete", "MongoCollectionThroughputUpdate", "MongoCollectionUpdate", "MongoDBDatabaseUpdate", "MongoDatabaseDelete", "MongoDatabaseThroughputUpdate", + "CassandraKeyspaceDelete", "CassandraKeyspaceThroughputUpdate", "CassandraKeyspaceUpdate","CassandraTableDelete", "CassandraTableThroughputUpdate", "CassandraTableUpdate", + "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", "TableTableThroughputUpdate","TableTableUpdate"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true @@ -81,14 +89,22 @@ resources: - name: ["AddRegion", "RemoveRegion", "UpdateAccountReplicationSettings", "UpdateAccountNetworkSettings", "UpdateAccountKeys", "ServiceAvailability", "ReplicationLatency", "RegionFailover", "DeleteAccount", "CreateAccount", "UpdateDiagnosticsSettings"] namespace: "Microsoft.DocumentDb/databaseAccounts" - - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "MongoRequests", "MongoRequestsCount", - "MongoRequestsInsert", "MongoRequestsDelete", "MongoRequestsQuery", "MongoRequestsUpdate","ProvisionedThroughput", "NormalizedRUConsumption"] + - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "NormalizedRUConsumption", "ProvisionedThroughput"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" value: "*" + - name: ["MongoRequests"] + namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "DatabaseName" + value: "*" + - name: "CommandName" + value: "*" - name: ["TotalRequestUnits", "TotalRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true @@ -137,14 +153,22 @@ resources: - name: ["AddRegion", "RemoveRegion", "UpdateAccountReplicationSettings", "UpdateAccountNetworkSettings", "UpdateAccountKeys", "ServiceAvailability", "ReplicationLatency", "RegionFailover", "DeleteAccount", "CreateAccount", "UpdateDiagnosticsSettings"] namespace: "Microsoft.DocumentDb/databaseAccounts" - - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "MongoRequests", "MongoRequestsCount", - "MongoRequestsInsert", "MongoRequestsDelete", "MongoRequestsQuery", "MongoRequestsUpdate","ProvisionedThroughput", "NormalizedRUConsumption"] + - name: ["AvailableStorage", "DataUsage","DocumentCount", "DocumentQuota", "IndexUsage", "MetadataRequests", "MongoRequestCharge", "NormalizedRUConsumption", "ProvisionedThroughput"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true timegrain: "PT5M" dimensions: - name: "DatabaseName" value: "*" + - name: ["MongoRequests"] + namespace: "Microsoft.DocumentDb/databaseAccounts" + ignore_unsupported: true + timegrain: "PT5M" + dimensions: + - name: "DatabaseName" + value: "*" + - name: "CommandName" + value: "*" - name: ["TotalRequestUnits", "TotalRequests"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true @@ -169,9 +193,9 @@ resources: - name: "ClosureReason" value: "*" - name: [ "GremlinDatabaseDelete", "GremlinDatabaseThroughputUpdate", "GremlinDatabaseUpdate", "GremlinGraphDelete","GremlinGraphThroughputUpdate", "GremlinGraphUpdate", - "MongoCollectionDelete", "MongoCollectionThroughputUpdate", "MongoCollectionUpdate", "MongoDBDatabaseUpdate", "MongoDatabaseDelete", "MongoDatabaseThroughputUpdate", - "CassandraKeyspaceDelete", "CassandraKeyspaceThroughputUpdate", "CassandraKeyspaceUpdate","CassandraTableDelete", "CassandraTableThroughputUpdate", "CassandraTableUpdate", - "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", + "MongoCollectionDelete", "MongoCollectionThroughputUpdate", "MongoCollectionUpdate", "MongoDBDatabaseUpdate", "MongoDatabaseDelete", "MongoDatabaseThroughputUpdate", + "CassandraKeyspaceDelete", "CassandraKeyspaceThroughputUpdate", "CassandraKeyspaceUpdate","CassandraTableDelete", "CassandraTableThroughputUpdate", "CassandraTableUpdate", + "SqlContainerDelete", "SqlContainerThroughputUpdate", "SqlContainerUpdate", "SqlDatabaseDelete", "SqlDatabaseThroughputUpdate", "SqlDatabaseUpdate", "TableTableDelete", "TableTableThroughputUpdate","TableTableUpdate"] namespace: "Microsoft.DocumentDb/databaseAccounts" ignore_unsupported: true @@ -179,4 +203,4 @@ resources: - name: "ResourceName" value: "*" {{/unless}} -{{/unless}} \ No newline at end of file +{{/unless}} diff --git a/packages/azure_metrics/data_stream/database_account/fields/agent.yml b/packages/azure_metrics/data_stream/database_account/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/database_account/fields/agent.yml +++ b/packages/azure_metrics/data_stream/database_account/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/database_account/fields/ecs.yml b/packages/azure_metrics/data_stream/database_account/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/database_account/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/database_account/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/database_account/fields/fields.yml b/packages/azure_metrics/data_stream/database_account/fields/fields.yml index a8400067249..ad51dd58927 100644 --- a/packages/azure_metrics/data_stream/database_account/fields/fields.yml +++ b/packages/azure_metrics/data_stream/database_account/fields/fields.yml @@ -2,6 +2,7 @@ type: object object_type: float object_type_mapping_type: "*" + metric_type: gauge description: > database account diff --git a/packages/azure_metrics/data_stream/database_account/fields/package-fields.yml b/packages/azure_metrics/data_stream/database_account/fields/package-fields.yml index 28fa99283bd..da50e10ea75 100644 --- a/packages/azure_metrics/data_stream/database_account/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/database_account/fields/package-fields.yml @@ -4,6 +4,7 @@ fields: - name: timegrain type: keyword + dimension: true description: > The Azure metric timegrain @@ -24,6 +25,7 @@ The name of the resource - name: id + dimension: true type: keyword description: > The id of the resource @@ -42,6 +44,7 @@ - name: namespace type: keyword + dimension: true description: > The namespace selected @@ -55,17 +58,24 @@ description: > The application ID - - name: dimensions.* - type: object - object_type: keyword - object_type_mapping_type: "*" - description: > - Azure metric dimensions. - - - name: metrics.*.* - type: object - object_type: float - object_type_mapping_type: "*" - description: > - Metrics returned. - + - name: dimensions + type: group + fields: + - name: database_name + type: keyword + dimension: true + description: Database name + - name: command_name + type: keyword + dimension: true + description: Mongo requests command name + - name: resource_name + type: keyword + dimension: true + description: Name of the resource + - name: closure_reason + type: keyword + description: Reason of the Cassandra Connection Closures + - name: status_code + type: keyword + description: Status code of the made to database requests diff --git a/packages/azure_metrics/data_stream/monitor/elasticsearch/ingest_pipeline/default.yml b/packages/azure_metrics/data_stream/monitor/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..29ef1822ab8 --- /dev/null +++ b/packages/azure_metrics/data_stream/monitor/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,14 @@ +--- +description: Pipeline for parsing azure monitor metrics. +processors: + - fingerprint: + fields: ["azure.dimensions"] + target_field: 'azure.dimensions.fingerprint' + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - set: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/azure_metrics/data_stream/monitor/fields/agent.yml b/packages/azure_metrics/data_stream/monitor/fields/agent.yml index da4e652c53b..ae1966205ad 100644 --- a/packages/azure_metrics/data_stream/monitor/fields/agent.yml +++ b/packages/azure_metrics/data_stream/monitor/fields/agent.yml @@ -48,6 +48,7 @@ ignore_above: 1024 description: Region in which this host is running. example: us-east-1 + dimension: true - name: project.id type: keyword description: Name of the project in Google Cloud. @@ -62,26 +63,11 @@ These fields help correlate data based containers from any runtime.' type: group fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - name: labels level: extended type: object object_type: keyword description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. - name: host title: Host group: 2 diff --git a/packages/azure_metrics/data_stream/monitor/fields/ecs.yml b/packages/azure_metrics/data_stream/monitor/fields/ecs.yml index c9ba9972270..0ef9d19c59d 100644 --- a/packages/azure_metrics/data_stream/monitor/fields/ecs.yml +++ b/packages/azure_metrics/data_stream/monitor/fields/ecs.yml @@ -15,3 +15,6 @@ external: ecs - name: host external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/azure_metrics/data_stream/monitor/fields/fields.yml b/packages/azure_metrics/data_stream/monitor/fields/fields.yml deleted file mode 100644 index 6ca122a221a..00000000000 --- a/packages/azure_metrics/data_stream/monitor/fields/fields.yml +++ /dev/null @@ -1,5 +0,0 @@ -- name: azure.monitor - type: group - description: > - monitor - diff --git a/packages/azure_metrics/data_stream/monitor/fields/package-fields.yml b/packages/azure_metrics/data_stream/monitor/fields/package-fields.yml index 28fa99283bd..c81ec39f1f9 100644 --- a/packages/azure_metrics/data_stream/monitor/fields/package-fields.yml +++ b/packages/azure_metrics/data_stream/monitor/fields/package-fields.yml @@ -4,6 +4,7 @@ fields: - name: timegrain type: keyword + dimension: true description: > The Azure metric timegrain @@ -25,6 +26,7 @@ - name: id type: keyword + dimension: true description: > The id of the resource @@ -42,6 +44,7 @@ - name: namespace type: keyword + dimension: true description: > The namespace selected @@ -62,10 +65,17 @@ description: > Azure metric dimensions. + - name: dimensions.fingerprint + type: keyword + description: | + Autogenerated ID representing the fingerprint of the azure.dimensions object + dimension: true + - name: metrics.*.* type: object object_type: float object_type_mapping_type: "*" + metric_type: gauge description: > Metrics returned. diff --git a/packages/azure_metrics/docs/README.md b/packages/azure_metrics/docs/README.md index 15ef445b01f..282fc407ec3 100644 --- a/packages/azure_metrics/docs/README.md +++ b/packages/azure_metrics/docs/README.md @@ -57,61 +57,63 @@ aggregation list, namespaces and metric dimensions. The monitor metrics will hav **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.dimensions.\* | Azure metric dimensions. | object | | +| azure.dimensions.fingerprint | Autogenerated ID representing the fingerprint of the azure.dimensions object | keyword | | +| azure.metrics.\*.\* | Metrics returned. | object | gauge | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | `compute_vm` @@ -120,62 +122,66 @@ so the `period` for `compute_vm` should be `300s` or multiples of `300s`. **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.compute_vm.\*.\* | compute_vm | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.compute_vm.\*.\* | Returned compute_vm metrics | object | gauge | +| azure.dimensions.cpu | Cpu core on the linux instance | keyword | | +| azure.dimensions.device | Name of the device of the linux instance, eg. sda2 | keyword | | +| azure.dimensions.host | Name of the linux host | keyword | | +| azure.dimensions.interface | Name of the network interface on the linux instance | keyword | | +| azure.dimensions.name | Name of the device of the linux instance | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | `compute_vm_scaleset` @@ -184,62 +190,92 @@ so the `period` for `compute_vm_scaleset` should be `300s` or multiples of `300s **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.compute_vm_scaleset.\*.\* | compute_vm_scaleset | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.compute_vm_scaleset.available_memory_bytes.avg | Amount of physical memory, in bytes, immediately available for allocation to a process or for system use in the Virtual Machine | float | byte | gauge | +| azure.compute_vm_scaleset.cpu_credits_consumed.avg | Total number of credits consumed by the Virtual Machine. Only available on B-series burstable VMs | float | | gauge | +| azure.compute_vm_scaleset.cpu_credits_remaining.avg | Total number of credits available to burst. Only available on B-series burstable VMs | float | | gauge | +| azure.compute_vm_scaleset.data_disk_bandwidth_consumed_percentage.avg | Percentage of data disk bandwidth consumed per minute | float | percent | gauge | +| azure.compute_vm_scaleset.data_disk_queue_depth.avg | Data Disk Queue Depth(or Queue Length) | float | | gauge | +| azure.compute_vm_scaleset.data_disk_read_bytes_per_sec.avg | Bytes/Sec read from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_read_operations_per_sec.avg | Read IOPS from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_write_bytes_per_sec.avg | Bytes/Sec written to a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_write_operations_per_sec.avg | Write IOPS from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.disk_read_bytes.total | Bytes read from disk during monitoring period | float | byte | gauge | +| azure.compute_vm_scaleset.disk_read_operations_per_sec.avg | Disk Read IOPS | float | | gauge | +| azure.compute_vm_scaleset.disk_write_bytes.total | Bytes written to disk during monitoring period | float | byte | gauge | +| azure.compute_vm_scaleset.disk_write_operations_per_sec.avg | Disk Write IOPS | float | | gauge | +| azure.compute_vm_scaleset.inbound_flows.avg | Inbound Flows are number of current flows in the inbound direction (traffic going into the VM) | float | | gauge | +| azure.compute_vm_scaleset.inbound_flows_maximum_creation_rate.avg | The maximum creation rate of inbound flows (traffic going into the VM) | float | | gauge | +| azure.compute_vm_scaleset.memory_available_bytes.avg | Available Bytes is the amount of physical memory, in bytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. | float | byte | gauge | +| azure.compute_vm_scaleset.memory_commit_limit.avg | Memory commit limit | float | byte | gauge | +| azure.compute_vm_scaleset.memory_committed_bytes.avg | Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only. | float | byte | gauge | +| azure.compute_vm_scaleset.memory_pct_committed_bytes_in_use.avg | Committed Bytes In Use is the ratio of Memory \ Committed Bytes to the Memory \ Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This value displays the current percentage value only. | float | percent | gauge | +| azure.compute_vm_scaleset.network_in_total.total | The number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic) | float | | gauge | +| azure.compute_vm_scaleset.network_out_total.total | The number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic) | float | | gauge | +| azure.compute_vm_scaleset.os_disk_queue_depth.avg | OS Disk Queue Depth(or Queue Length) | float | | gauge | +| azure.compute_vm_scaleset.os_disk_read_bytes_per_sec.avg | Bytes/Sec read from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_read_operations_per_sec.avg | Read IOPS from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_write_bytes_per_sec.avg | Bytes/Sec written to a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_write_operations_per_sec.avg | Write IOPS from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.outbound_flows.avg | Outbound Flows are number of current flows in the outbound direction (traffic going out of the VM) | float | | gauge | +| azure.compute_vm_scaleset.outbound_flows_maximum_creation_rate.avg | The maximum creation rate of outbound flows (traffic going out of the VM) | float | | gauge | +| azure.compute_vm_scaleset.percentage_cpu.avg | The percentage of allocated compute units that are currently in use by the Virtual Machine(s) | float | percent | gauge | +| azure.dimensions.lun | Logical Unit Number is a number that is used to identify a specific storage device | keyword | | | +| azure.dimensions.virtual_machine | The VM name | keyword | | | +| azure.dimensions.vmname | The VM name | keyword | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | `storage_account` @@ -312,62 +348,69 @@ so the `period` for `container_instance` should be `300s` or multiples of `300s` **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_instance.\*.\* | container instance | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.container_instance.cpu_usage.avg | CPU usage on all cores in millicores. | float | | gauge | +| azure.container_instance.memory_usage.avg | Total memory usage in byte. | float | byte | gauge | +| azure.container_instance.network_bytes_received_per_second.avg | The network bytes received per second. | float | byte | gauge | +| azure.container_instance.network_bytes_transmitted_per_second.avg | The network bytes transmitted per second. | float | byte | gauge | +| azure.dimensions.container_name | The container name | keyword | | | +| azure.metrics.cpu_usage.avg | CPU usage on all cores in millicores. | float | | gauge | +| azure.metrics.memory_usage.avg | | alias | | | +| azure.metrics.network_bytes_received_per_second.avg | | alias | | | +| azure.metrics.network_bytes_transmitted_per_second.avg | | alias | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | `container_registry` @@ -376,62 +419,68 @@ so the `period` for `container_registry` should be `300s` or multiples of `300s` **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_registry.\*.\* | container registry | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.container_registry.agent_pool_cpu_time.total | AgentPool CPU Time in seconds | float | | gauge | +| azure.container_registry.run_duration.total | ACR tasks run duration in milliseconds | float | ms | gauge | +| azure.container_registry.storage_used.avg | The amount of storage used by the container registry. For a registry account, it's the sum of capacity used by all the repositories within a registry. It's sum of capacity used by shared layers, manifest files, and replica copies in each of its repositories. | float | byte | gauge | +| azure.container_registry.successful_pull_count.total | Number of successful image pulls | float | | gauge | +| azure.container_registry.successful_push_count.total | Number of successful image pushes | float | | gauge | +| azure.container_registry.total_pull_count.total | Number of image pulls in total | float | | gauge | +| azure.container_registry.total_push_count.total | Number of image pushes in total | float | | gauge | +| azure.dimensions.geolocation | Geolocation of the container registry | keyword | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | `container_service` @@ -440,62 +489,71 @@ so the `period` for `container_service` should be `300s` or multiples of `300s`. **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_service.\*.\* | container service | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.container_service.kube_node_status_allocatable_cpu_cores.avg | Total number of available cpu cores in a managed cluster | float | gauge | +| azure.container_service.kube_node_status_allocatable_memory_bytes.avg | Total amount of available memory in a managed cluster | float | gauge | +| azure.container_service.kube_node_status_condition.avg | Statuses for various node conditions | float | gauge | +| azure.container_service.kube_pod_status_phase.avg | Number of pods by phase | float | gauge | +| azure.container_service.kube_pod_status_ready.avg | Number of pods in Ready state | float | gauge | +| azure.dimensions.condition | Pod or Node conditions | keyword | | +| azure.dimensions.namespace | Pod namespace | keyword | | +| azure.dimensions.node | Node name | keyword | | +| azure.dimensions.phase | Pod phase | keyword | | +| azure.dimensions.pod | Pod name | keyword | | +| azure.dimensions.status | Statuses for various node conditions | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | `database_account` @@ -504,62 +562,66 @@ so the `period` for `database_account` should be `300s` or multiples of `300s`. **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.database_account.\*.\* | database account | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.database_account.\*.\* | database account | object | gauge | +| azure.dimensions.closure_reason | Reason of the Cassandra Connection Closures | keyword | | +| azure.dimensions.command_name | Mongo requests command name | keyword | | +| azure.dimensions.database_name | Database name | keyword | | +| azure.dimensions.resource_name | Name of the resource | keyword | | +| azure.dimensions.status_code | Status code of the made to database requests | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | ## Additional notes about metrics and costs diff --git a/packages/azure_metrics/docs/compute_vm.md b/packages/azure_metrics/docs/compute_vm.md index c70b522ffce..2cc28a9d052 100644 --- a/packages/azure_metrics/docs/compute_vm.md +++ b/packages/azure_metrics/docs/compute_vm.md @@ -72,59 +72,63 @@ Authentication: Dedicated authentication token will be created and updated regul **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.compute_vm.\*.\* | compute_vm | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.compute_vm.\*.\* | Returned compute_vm metrics | object | gauge | +| azure.dimensions.cpu | Cpu core on the linux instance | keyword | | +| azure.dimensions.device | Name of the device of the linux instance, eg. sda2 | keyword | | +| azure.dimensions.host | Name of the linux host | keyword | | +| azure.dimensions.interface | Name of the network interface on the linux instance | keyword | | +| azure.dimensions.name | Name of the device of the linux instance | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/azure_metrics/docs/compute_vm_scaleset.md b/packages/azure_metrics/docs/compute_vm_scaleset.md index d1bfef109b7..08eaa281655 100644 --- a/packages/azure_metrics/docs/compute_vm_scaleset.md +++ b/packages/azure_metrics/docs/compute_vm_scaleset.md @@ -69,59 +69,89 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.compute_vm_scaleset.\*.\* | compute_vm_scaleset | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.compute_vm_scaleset.available_memory_bytes.avg | Amount of physical memory, in bytes, immediately available for allocation to a process or for system use in the Virtual Machine | float | byte | gauge | +| azure.compute_vm_scaleset.cpu_credits_consumed.avg | Total number of credits consumed by the Virtual Machine. Only available on B-series burstable VMs | float | | gauge | +| azure.compute_vm_scaleset.cpu_credits_remaining.avg | Total number of credits available to burst. Only available on B-series burstable VMs | float | | gauge | +| azure.compute_vm_scaleset.data_disk_bandwidth_consumed_percentage.avg | Percentage of data disk bandwidth consumed per minute | float | percent | gauge | +| azure.compute_vm_scaleset.data_disk_queue_depth.avg | Data Disk Queue Depth(or Queue Length) | float | | gauge | +| azure.compute_vm_scaleset.data_disk_read_bytes_per_sec.avg | Bytes/Sec read from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_read_operations_per_sec.avg | Read IOPS from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_write_bytes_per_sec.avg | Bytes/Sec written to a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.data_disk_write_operations_per_sec.avg | Write IOPS from a single disk during monitoring period | float | | gauge | +| azure.compute_vm_scaleset.disk_read_bytes.total | Bytes read from disk during monitoring period | float | byte | gauge | +| azure.compute_vm_scaleset.disk_read_operations_per_sec.avg | Disk Read IOPS | float | | gauge | +| azure.compute_vm_scaleset.disk_write_bytes.total | Bytes written to disk during monitoring period | float | byte | gauge | +| azure.compute_vm_scaleset.disk_write_operations_per_sec.avg | Disk Write IOPS | float | | gauge | +| azure.compute_vm_scaleset.inbound_flows.avg | Inbound Flows are number of current flows in the inbound direction (traffic going into the VM) | float | | gauge | +| azure.compute_vm_scaleset.inbound_flows_maximum_creation_rate.avg | The maximum creation rate of inbound flows (traffic going into the VM) | float | | gauge | +| azure.compute_vm_scaleset.memory_available_bytes.avg | Available Bytes is the amount of physical memory, in bytes, immediately available for allocation to a process or for system use. It is equal to the sum of memory assigned to the standby (cached), free and zero page lists. | float | byte | gauge | +| azure.compute_vm_scaleset.memory_commit_limit.avg | Memory commit limit | float | byte | gauge | +| azure.compute_vm_scaleset.memory_committed_bytes.avg | Committed Bytes is the amount of committed virtual memory, in bytes. Committed memory is the physical memory which has space reserved on the disk paging file(s). There can be one or more paging files on each physical drive. This counter displays the last observed value only. | float | byte | gauge | +| azure.compute_vm_scaleset.memory_pct_committed_bytes_in_use.avg | Committed Bytes In Use is the ratio of Memory \ Committed Bytes to the Memory \ Commit Limit. Committed memory is the physical memory in use for which space has been reserved in the paging file should it need to be written to disk. The commit limit is determined by the size of the paging file. If the paging file is enlarged, the commit limit increases, and the ratio is reduced). This value displays the current percentage value only. | float | percent | gauge | +| azure.compute_vm_scaleset.network_in_total.total | The number of bytes received on all network interfaces by the Virtual Machine(s) (Incoming Traffic) | float | | gauge | +| azure.compute_vm_scaleset.network_out_total.total | The number of bytes out on all network interfaces by the Virtual Machine(s) (Outgoing Traffic) | float | | gauge | +| azure.compute_vm_scaleset.os_disk_queue_depth.avg | OS Disk Queue Depth(or Queue Length) | float | | gauge | +| azure.compute_vm_scaleset.os_disk_read_bytes_per_sec.avg | Bytes/Sec read from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_read_operations_per_sec.avg | Read IOPS from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_write_bytes_per_sec.avg | Bytes/Sec written to a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.os_disk_write_operations_per_sec.avg | Write IOPS from a single disk during monitoring period for OS disk | float | | gauge | +| azure.compute_vm_scaleset.outbound_flows.avg | Outbound Flows are number of current flows in the outbound direction (traffic going out of the VM) | float | | gauge | +| azure.compute_vm_scaleset.outbound_flows_maximum_creation_rate.avg | The maximum creation rate of outbound flows (traffic going out of the VM) | float | | gauge | +| azure.compute_vm_scaleset.percentage_cpu.avg | The percentage of allocated compute units that are currently in use by the Virtual Machine(s) | float | percent | gauge | +| azure.dimensions.lun | Logical Unit Number is a number that is used to identify a specific storage device | keyword | | | +| azure.dimensions.virtual_machine | The VM name | keyword | | | +| azure.dimensions.vmname | The VM name | keyword | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | diff --git a/packages/azure_metrics/docs/container_instance.md b/packages/azure_metrics/docs/container_instance.md index d759bccfa21..7ba464af00d 100644 --- a/packages/azure_metrics/docs/container_instance.md +++ b/packages/azure_metrics/docs/container_instance.md @@ -69,59 +69,66 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_instance.\*.\* | container instance | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.container_instance.cpu_usage.avg | CPU usage on all cores in millicores. | float | | gauge | +| azure.container_instance.memory_usage.avg | Total memory usage in byte. | float | byte | gauge | +| azure.container_instance.network_bytes_received_per_second.avg | The network bytes received per second. | float | byte | gauge | +| azure.container_instance.network_bytes_transmitted_per_second.avg | The network bytes transmitted per second. | float | byte | gauge | +| azure.dimensions.container_name | The container name | keyword | | | +| azure.metrics.cpu_usage.avg | CPU usage on all cores in millicores. | float | | gauge | +| azure.metrics.memory_usage.avg | | alias | | | +| azure.metrics.network_bytes_received_per_second.avg | | alias | | | +| azure.metrics.network_bytes_transmitted_per_second.avg | | alias | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | diff --git a/packages/azure_metrics/docs/container_registry.md b/packages/azure_metrics/docs/container_registry.md index 9d5c074915a..e97c3dbf824 100644 --- a/packages/azure_metrics/docs/container_registry.md +++ b/packages/azure_metrics/docs/container_registry.md @@ -69,59 +69,65 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_registry.\*.\* | container registry | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| azure.application_id | The application ID | keyword | | | +| azure.container_registry.agent_pool_cpu_time.total | AgentPool CPU Time in seconds | float | | gauge | +| azure.container_registry.run_duration.total | ACR tasks run duration in milliseconds | float | ms | gauge | +| azure.container_registry.storage_used.avg | The amount of storage used by the container registry. For a registry account, it's the sum of capacity used by all the repositories within a registry. It's sum of capacity used by shared layers, manifest files, and replica copies in each of its repositories. | float | byte | gauge | +| azure.container_registry.successful_pull_count.total | Number of successful image pulls | float | | gauge | +| azure.container_registry.successful_push_count.total | Number of successful image pushes | float | | gauge | +| azure.container_registry.total_pull_count.total | Number of image pulls in total | float | | gauge | +| azure.container_registry.total_push_count.total | Number of image pushes in total | float | | gauge | +| azure.dimensions.geolocation | Geolocation of the container registry | keyword | | | +| azure.namespace | The namespace selected | keyword | | | +| azure.resource.group | The resource group | keyword | | | +| azure.resource.id | The id of the resource | keyword | | | +| azure.resource.name | The name of the resource | keyword | | | +| azure.resource.tags.\* | Azure resource tags. | object | | | +| azure.resource.type | The type of the resource | keyword | | | +| azure.subscription_id | The subscription ID | keyword | | | +| azure.timegrain | The Azure metric timegrain | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host is running. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| container.runtime | Runtime managing this container. | keyword | | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| dataset.name | Dataset name. | constant_keyword | | | +| dataset.namespace | Dataset namespace. | constant_keyword | | | +| dataset.type | Dataset type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.address | Service address | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | diff --git a/packages/azure_metrics/docs/container_service.md b/packages/azure_metrics/docs/container_service.md index f901c38c4a2..2b1ca5a7a9a 100644 --- a/packages/azure_metrics/docs/container_service.md +++ b/packages/azure_metrics/docs/container_service.md @@ -70,59 +70,68 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.container_service.\*.\* | container service | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.container_service.kube_node_status_allocatable_cpu_cores.avg | Total number of available cpu cores in a managed cluster | float | gauge | +| azure.container_service.kube_node_status_allocatable_memory_bytes.avg | Total amount of available memory in a managed cluster | float | gauge | +| azure.container_service.kube_node_status_condition.avg | Statuses for various node conditions | float | gauge | +| azure.container_service.kube_pod_status_phase.avg | Number of pods by phase | float | gauge | +| azure.container_service.kube_pod_status_ready.avg | Number of pods in Ready state | float | gauge | +| azure.dimensions.condition | Pod or Node conditions | keyword | | +| azure.dimensions.namespace | Pod namespace | keyword | | +| azure.dimensions.node | Node name | keyword | | +| azure.dimensions.phase | Pod phase | keyword | | +| azure.dimensions.pod | Pod name | keyword | | +| azure.dimensions.status | Statuses for various node conditions | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/azure_metrics/docs/database_account.md b/packages/azure_metrics/docs/database_account.md index 467d282d334..54a2b2cd460 100644 --- a/packages/azure_metrics/docs/database_account.md +++ b/packages/azure_metrics/docs/database_account.md @@ -68,59 +68,63 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.database_account.\*.\* | database account | object | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.database_account.\*.\* | database account | object | gauge | +| azure.dimensions.closure_reason | Reason of the Cassandra Connection Closures | keyword | | +| azure.dimensions.command_name | Mongo requests command name | keyword | | +| azure.dimensions.database_name | Database name | keyword | | +| azure.dimensions.resource_name | Name of the resource | keyword | | +| azure.dimensions.status_code | Status code of the made to database requests | keyword | | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/azure_metrics/docs/monitor.md b/packages/azure_metrics/docs/monitor.md index cb751809953..606dea19317 100644 --- a/packages/azure_metrics/docs/monitor.md +++ b/packages/azure_metrics/docs/monitor.md @@ -122,58 +122,60 @@ Authentication: we are handling authentication on our side (creating/renewing th **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| azure.application_id | The application ID | keyword | -| azure.dimensions.\* | Azure metric dimensions. | object | -| azure.metrics.\*.\* | Metrics returned. | object | -| azure.namespace | The namespace selected | keyword | -| azure.resource.group | The resource group | keyword | -| azure.resource.id | The id of the resource | keyword | -| azure.resource.name | The name of the resource | keyword | -| azure.resource.tags.\* | Azure resource tags. | object | -| azure.resource.type | The type of the resource | keyword | -| azure.subscription_id | The subscription ID | keyword | -| azure.timegrain | The Azure metric timegrain | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| container.runtime | Runtime managing this container. | keyword | -| data_stream.dataset | Data stream dataset name. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dataset.name | Dataset name. | constant_keyword | -| dataset.namespace | Dataset namespace. | constant_keyword | -| dataset.type | Dataset type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Service address | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| azure.application_id | The application ID | keyword | | +| azure.dimensions.\* | Azure metric dimensions. | object | | +| azure.dimensions.fingerprint | Autogenerated ID representing the fingerprint of the azure.dimensions object | keyword | | +| azure.metrics.\*.\* | Metrics returned. | object | gauge | +| azure.namespace | The namespace selected | keyword | | +| azure.resource.group | The resource group | keyword | | +| azure.resource.id | The id of the resource | keyword | | +| azure.resource.name | The name of the resource | keyword | | +| azure.resource.tags.\* | Azure resource tags. | object | | +| azure.resource.type | The type of the resource | keyword | | +| azure.subscription_id | The subscription ID | keyword | | +| azure.timegrain | The Azure metric timegrain | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| container.runtime | Runtime managing this container. | keyword | | +| data_stream.dataset | Data stream dataset name. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| dataset.name | Dataset name. | constant_keyword | | +| dataset.namespace | Dataset namespace. | constant_keyword | | +| dataset.type | Dataset type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Service address | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/azure_metrics/img/azure_metrics-container-instance-overview.png b/packages/azure_metrics/img/azure_metrics-container-instance-overview.png index 8e27f44add5..181dbff17f4 100644 Binary files a/packages/azure_metrics/img/azure_metrics-container-instance-overview.png and b/packages/azure_metrics/img/azure_metrics-container-instance-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-container-registry-overview.png b/packages/azure_metrics/img/azure_metrics-container-registry-overview.png index cb4d9344a56..23dd803580a 100644 Binary files a/packages/azure_metrics/img/azure_metrics-container-registry-overview.png and b/packages/azure_metrics/img/azure_metrics-container-registry-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-container-service-overview.png b/packages/azure_metrics/img/azure_metrics-container-service-overview.png index 9893bd75aea..1c629e94467 100644 Binary files a/packages/azure_metrics/img/azure_metrics-container-service-overview.png and b/packages/azure_metrics/img/azure_metrics-container-service-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-database-account-overview.png b/packages/azure_metrics/img/azure_metrics-database-account-overview.png index d258af4cb31..e0b06dddbea 100644 Binary files a/packages/azure_metrics/img/azure_metrics-database-account-overview.png and b/packages/azure_metrics/img/azure_metrics-database-account-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-storage-account-overview.png b/packages/azure_metrics/img/azure_metrics-storage-account-overview.png index c815dad06e5..2ac54ab5068 100644 Binary files a/packages/azure_metrics/img/azure_metrics-storage-account-overview.png and b/packages/azure_metrics/img/azure_metrics-storage-account-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-vm-overview.png b/packages/azure_metrics/img/azure_metrics-vm-overview.png index 48c9494ae3a..1b5422120d8 100644 Binary files a/packages/azure_metrics/img/azure_metrics-vm-overview.png and b/packages/azure_metrics/img/azure_metrics-vm-overview.png differ diff --git a/packages/azure_metrics/img/azure_metrics-vmss-overview.png b/packages/azure_metrics/img/azure_metrics-vmss-overview.png index 6b79ebdc128..ec7ac69dc97 100644 Binary files a/packages/azure_metrics/img/azure_metrics-vmss-overview.png and b/packages/azure_metrics/img/azure_metrics-vmss-overview.png differ diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc.json index 78f63ca7f11..43312596159 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc.json @@ -1,7 +1,12 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"13954387-48b2-4103-97e6-1d4ffcf73360\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"13954387-48b2-4103-97e6-1d4ffcf73360\",\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"enhancements\":{}}},\"14bb75a0-6906-4555-9ed2-7bcd4580d596\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"14bb75a0-6906-4555-9ed2-7bcd4580d596\",\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"enhancements\":{}}},\"018c4a7e-7f19-446e-ad9c-445278d027ef\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"018c4a7e-7f19-446e-ad9c-445278d027ef\",\"fieldName\":\"azure.resource.name\",\"title\":\"Resource Name\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for queue storage type in Azure.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,200 +40,1580 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [**Queue**](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", + "openLinksInNewTab": false + }, + "title": "Navigation Queue Storage Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "933a427d-a8b7-48ff-ac53-337f32b340ea", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "933a427d-a8b7-48ff-ac53-337f32b340ea", - "panelRefName": "panel_933a427d-a8b7-48ff-ac53-337f32b340ea", - "type": "visualization", - "version": "7.7.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 9, - "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "w": 5, - "x": 9, - "y": 0 - }, - "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "panelRefName": "panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "title": "Availability", "type": "visualization", - "version": "7.7.0" + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "4a142156-34f2-44ec-b829-5951ecbb5a8b": { + "columnOrder": [ + "487171cd-7adb-4fe6-ac1b-af81610bb835", + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X0", + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X1", + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99" + ], + "columns": { + "487171cd-7adb-4fe6-ac1b-af81610bb835": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Queue Capacity", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_capacity.avg" + }, + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.queue_capacity.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.queue_capacity.avg))", + "isFormulaBroken": false + }, + "references": [ + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X1" + ], + "scale": "ratio" + }, + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_capacity.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_capacity.avg" + }, + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_capacity.avg))", + "operationType": "overall_max", + "references": [ + "9c38f7a6-3d0e-42ea-818e-c7b3503cac99X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4a142156-34f2-44ec-b829-5951ecbb5a8b", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "4a142156-34f2-44ec-b829-5951ecbb5a8b", + "layerType": "data", + "maxAccessor": "9c38f7a6-3d0e-42ea-818e-c7b3503cac99", + "metricAccessor": "487171cd-7adb-4fe6-ac1b-af81610bb835" + } + }, + "title": "Storage Queue Capacity [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "0b4107a7-6a3d-4092-9813-00edb56bc838", "w": 5, - "x": 14, - "y": 0 + "x": 0, + "y": 5 }, "panelIndex": "0b4107a7-6a3d-4092-9813-00edb56bc838", - "panelRefName": "panel_0b4107a7-6a3d-4092-9813-00edb56bc838", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Queue Capacity [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "6809aeba-9935-4a98-91d8-9c78bd0432a1": { + "columnOrder": [ + "72960318-f3b9-47a4-bce5-c75234290760", + "4a919315-6965-4448-b506-d4e41d5e4da2X0", + "4a919315-6965-4448-b506-d4e41d5e4da2X1", + "4a919315-6965-4448-b506-d4e41d5e4da2" + ], + "columns": { + "4a919315-6965-4448-b506-d4e41d5e4da2": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.queue_message_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.queue_message_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "4a919315-6965-4448-b506-d4e41d5e4da2X1" + ], + "scale": "ratio" + }, + "4a919315-6965-4448-b506-d4e41d5e4da2X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_message_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_message_count.avg" + }, + "4a919315-6965-4448-b506-d4e41d5e4da2X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_message_count.avg))", + "operationType": "overall_max", + "references": [ + "4a919315-6965-4448-b506-d4e41d5e4da2X0" + ], + "scale": "ratio" + }, + "72960318-f3b9-47a4-bce5-c75234290760": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Queue Message Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_message_count.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-6809aeba-9935-4a98-91d8-9c78bd0432a1", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "6809aeba-9935-4a98-91d8-9c78bd0432a1", + "layerType": "data", + "maxAccessor": "4a919315-6965-4448-b506-d4e41d5e4da2", + "metricAccessor": "72960318-f3b9-47a4-bce5-c75234290760" + } + }, + "title": "Storage Queue Message Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "cf022a47-2314-4ab6-b397-b1d860944179", "w": 5, - "x": 19, - "y": 0 + "x": 5, + "y": 5 }, "panelIndex": "cf022a47-2314-4ab6-b397-b1d860944179", - "panelRefName": "panel_cf022a47-2314-4ab6-b397-b1d860944179", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Queue Message Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "20a07535-0b51-434a-bf3f-216e2d77c640": { + "columnOrder": [ + "f9be0a93-f211-4823-9f9a-c5162cde988e", + "59f2bee0-1a09-4b55-8016-14ee3cd01079X0", + "59f2bee0-1a09-4b55-8016-14ee3cd01079X1", + "59f2bee0-1a09-4b55-8016-14ee3cd01079" + ], + "columns": { + "59f2bee0-1a09-4b55-8016-14ee3cd01079": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.queue_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.queue_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "59f2bee0-1a09-4b55-8016-14ee3cd01079X1" + ], + "scale": "ratio" + }, + "59f2bee0-1a09-4b55-8016-14ee3cd01079X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_count.avg" + }, + "59f2bee0-1a09-4b55-8016-14ee3cd01079X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.queue_count.avg))", + "operationType": "overall_max", + "references": [ + "59f2bee0-1a09-4b55-8016-14ee3cd01079X0" + ], + "scale": "ratio" + }, + "f9be0a93-f211-4823-9f9a-c5162cde988e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Queue Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.queue_count.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-20a07535-0b51-434a-bf3f-216e2d77c640", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#A4DD00", + "layerId": "20a07535-0b51-434a-bf3f-216e2d77c640", + "layerType": "data", + "maxAccessor": "59f2bee0-1a09-4b55-8016-14ee3cd01079", + "metricAccessor": "f9be0a93-f211-4823-9f9a-c5162cde988e" + } + }, + "title": "Storage Queue Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "9d84188c-5a30-41ac-81cc-fe4fed360dd3", "w": 5, - "x": 24, - "y": 0 + "x": 10, + "y": 5 }, "panelIndex": "9d84188c-5a30-41ac-81cc-fe4fed360dd3", - "panelRefName": "panel_9d84188c-5a30-41ac-81cc-fe4fed360dd3", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Queue Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "336ad6f8-dcaa-4246-ac54-acf8af705e33": { + "columnOrder": [ + "97a06a58-d587-41be-b83d-4a8f9fa857fe", + "d9e64a9b-a0e7-4f70-932d-50c276e132ed" + ], + "columns": { + "97a06a58-d587-41be-b83d-4a8f9fa857fe": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d9e64a9b-a0e7-4f70-932d-50c276e132ed": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Availability", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " %" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.availability.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-336ad6f8-dcaa-4246-ac54-acf8af705e33", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.6, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d9e64a9b-a0e7-4f70-932d-50c276e132ed" + ], + "layerId": "336ad6f8-dcaa-4246-ac54-acf8af705e33", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "97a06a58-d587-41be-b83d-4a8f9fa857fe", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "d9e64a9b-a0e7-4f70-932d-50c276e132ed" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Availability [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "1d623c03-4d02-4a81-b91e-49e82e112016", - "w": 19, - "x": 29, - "y": 0 + "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "w": 14, + "x": 15, + "y": 5 }, - "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", - "panelRefName": "panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "title": "Transactions", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "title": "Availability", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ea8a6797-15f7-4055-8e1c-f4ed94ee47cd": { + "columnOrder": [ + "7891073b-e2e2-42bf-9e04-92898b13d112", + "232990ac-0ffe-4146-a055-bb5e49130275", + "0278faca-0f2b-4d20-b5c0-b99a88b7f5ee" + ], + "columns": { + "0278faca-0f2b-4d20-b5c0-b99a88b7f5ee": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.storage_account.transactions.total)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.storage_account.transactions.total" + }, + "232990ac-0ffe-4146-a055-bb5e49130275": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.response_type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0278faca-0f2b-4d20-b5c0-b99a88b7f5ee", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.response_type" + }, + "7891073b-e2e2-42bf-9e04-92898b13d112": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-ea8a6797-15f7-4055-8e1c-f4ed94ee47cd", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0278faca-0f2b-4d20-b5c0-b99a88b7f5ee" + ], + "layerId": "ea8a6797-15f7-4055-8e1c-f4ed94ee47cd", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "232990ac-0ffe-4146-a055-bb5e49130275", + "xAccessor": "7891073b-e2e2-42bf-9e04-92898b13d112", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "0278faca-0f2b-4d20-b5c0-b99a88b7f5ee" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Transactions [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "w": 9, - "x": 0, + "h": 9, + "i": "1d623c03-4d02-4a81-b91e-49e82e112016", + "w": 19, + "x": 29, "y": 5 }, - "panelIndex": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "panelRefName": "panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", + "title": "Transactions", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "5046ff10-84a8-4c43-b63a-0cfa1cfa8d98": { + "columnOrder": [ + "978ada30-004b-4298-a632-5f45c73f76b1", + "4cca678b-0bc1-4121-827a-36bf6d5ddb3a", + "27084753-0d21-44c4-9cc8-bb1718d840ed" + ], + "columns": { + "27084753-0d21-44c4-9cc8-bb1718d840ed": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SuccessServerLatency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_server_latency.avg" + }, + "4cca678b-0bc1-4121-827a-36bf6d5ddb3a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "978ada30-004b-4298-a632-5f45c73f76b1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "27084753-0d21-44c4-9cc8-bb1718d840ed", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-5046ff10-84a8-4c43-b63a-0cfa1cfa8d98", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "27084753-0d21-44c4-9cc8-bb1718d840ed" + ], + "layerId": "5046ff10-84a8-4c43-b63a-0cfa1cfa8d98", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "978ada30-004b-4298-a632-5f45c73f76b1", + "xAccessor": "4cca678b-0bc1-4121-827a-36bf6d5ddb3a", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "27084753-0d21-44c4-9cc8-bb1718d840ed" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success Server Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "87066244-7840-4555-9d12-026d64977f1a", - "w": 20, - "x": 9, - "y": 9 + "w": 24, + "x": 0, + "y": 14 }, "panelIndex": "87066244-7840-4555-9d12-026d64977f1a", - "panelRefName": "panel_87066244-7840-4555-9d12-026d64977f1a", "title": "Success Server Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "de690d9f-a13b-439c-a945-1d8645c4d058": { + "columnOrder": [ + "e0a385c3-47bd-4871-9279-13d3b48da660", + "79a3444f-d7d9-47f9-a36b-7f5c9a53874c", + "0629be0e-c959-4df4-89b2-cd98578d8eff" + ], + "columns": { + "0629be0e-c959-4df4-89b2-cd98578d8eff": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Success E2E Latency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_e2elatency.avg" + }, + "79a3444f-d7d9-47f9-a36b-7f5c9a53874c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e0a385c3-47bd-4871-9279-13d3b48da660": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0629be0e-c959-4df4-89b2-cd98578d8eff", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-de690d9f-a13b-439c-a945-1d8645c4d058", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0629be0e-c959-4df4-89b2-cd98578d8eff" + ], + "layerId": "de690d9f-a13b-439c-a945-1d8645c4d058", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "e0a385c3-47bd-4871-9279-13d3b48da660", + "xAccessor": "79a3444f-d7d9-47f9-a36b-7f5c9a53874c", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "0629be0e-c959-4df4-89b2-cd98578d8eff" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success E2E Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "756da375-e6a2-4668-af43-0cd294878254", - "w": 19, - "x": 29, - "y": 9 + "w": 24, + "x": 24, + "y": 14 }, "panelIndex": "756da375-e6a2-4668-af43-0cd294878254", - "panelRefName": "panel_756da375-e6a2-4668-af43-0cd294878254", "title": "Success E2E Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "1bff659c-1808-440a-beae-6d47570c7f40": { + "columnOrder": [ + "4e26ba6c-9473-4c9f-ba92-6a1ac9ff04e0", + "908d41f7-b273-433c-a23f-d5d42d3dbf42", + "9ff6d2d4-b8ed-49e9-bf07-2482fdbf2db5" + ], + "columns": { + "4e26ba6c-9473-4c9f-ba92-6a1ac9ff04e0": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9ff6d2d4-b8ed-49e9-bf07-2482fdbf2db5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "908d41f7-b273-433c-a23f-d5d42d3dbf42": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ff6d2d4-b8ed-49e9-bf07-2482fdbf2db5": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Egress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-1bff659c-1808-440a-beae-6d47570c7f40", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "9ff6d2d4-b8ed-49e9-bf07-2482fdbf2db5" + ], + "layerId": "1bff659c-1808-440a-beae-6d47570c7f40", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "4e26ba6c-9473-4c9f-ba92-6a1ac9ff04e0", + "xAccessor": "908d41f7-b273-433c-a23f-d5d42d3dbf42", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,149,177,1)", + "forAccessor": "9ff6d2d4-b8ed-49e9-bf07-2482fdbf2db5" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Egress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "a715fafc-ca38-410c-9253-12ba506eabc0", - "w": 20, - "x": 9, - "y": 24 + "w": 24, + "x": 0, + "y": 29 }, "panelIndex": "a715fafc-ca38-410c-9253-12ba506eabc0", - "panelRefName": "panel_a715fafc-ca38-410c-9253-12ba506eabc0", "title": "Egress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "6695f201-3a69-477d-be45-41b63d483f20": { + "columnOrder": [ + "71fcd84d-98d0-4e88-aec8-6279f7a98146", + "40f33636-88f5-4f0c-a98c-887d40b309d9", + "e3fd0938-bcfa-4e1f-9036-fd34230f3850" + ], + "columns": { + "40f33636-88f5-4f0c-a98c-887d40b309d9": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "71fcd84d-98d0-4e88-aec8-6279f7a98146": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e3fd0938-bcfa-4e1f-9036-fd34230f3850", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "e3fd0938-bcfa-4e1f-9036-fd34230f3850": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Ingress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-6695f201-3a69-477d-be45-41b63d483f20", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e3fd0938-bcfa-4e1f-9036-fd34230f3850" + ], + "layerId": "6695f201-3a69-477d-be45-41b63d483f20", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "71fcd84d-98d0-4e88-aec8-6279f7a98146", + "xAccessor": "40f33636-88f5-4f0c-a98c-887d40b309d9", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "e3fd0938-bcfa-4e1f-9036-fd34230f3850" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Ingress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "75f72920-be71-47a9-a967-f1c862ab2961", - "w": 19, - "x": 29, - "y": 24 + "w": 24, + "x": 24, + "y": 29 }, "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", - "panelRefName": "panel_75f72920-be71-47a9-a967-f1c862ab2961", "title": "Ingress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Azure Metrics] Queue Storage Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-09-01T11:34:52.555Z", "id": "azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, "references": [ { @@ -237,59 +1622,19 @@ "type": "index-pattern" }, { - "id": "azure_metrics-09f05e00-32f7-11ea-a83e-25b8612d00cc", - "name": "933a427d-a8b7-48ff-ac53-337f32b340ea:panel_933a427d-a8b7-48ff-ac53-337f32b340ea", - "type": "visualization" - }, - { - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "name": "a9456b9b-efa6-410d-a56c-4b66aa8c499e:panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "type": "visualization" - }, - { - "id": "azure_metrics-e159b990-339c-11ea-a83e-25b8612d00cc", - "name": "0b4107a7-6a3d-4092-9813-00edb56bc838:panel_0b4107a7-6a3d-4092-9813-00edb56bc838", - "type": "visualization" - }, - { - "id": "azure_metrics-2bedaca0-339d-11ea-a83e-25b8612d00cc", - "name": "cf022a47-2314-4ab6-b397-b1d860944179:panel_cf022a47-2314-4ab6-b397-b1d860944179", - "type": "visualization" - }, - { - "id": "azure_metrics-0241cc10-339d-11ea-a83e-25b8612d00cc", - "name": "9d84188c-5a30-41ac-81cc-fe4fed360dd3:panel_9d84188c-5a30-41ac-81cc-fe4fed360dd3", - "type": "visualization" - }, - { - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "name": "1d623c03-4d02-4a81-b91e-49e82e112016:panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "type": "visualization" - }, - { - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization" - }, - { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "name": "87066244-7840-4555-9d12-026d64977f1a:panel_87066244-7840-4555-9d12-026d64977f1a", - "type": "visualization" - }, - { - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "name": "756da375-e6a2-4668-af43-0cd294878254:panel_756da375-e6a2-4668-af43-0cd294878254", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_13954387-48b2-4103-97e6-1d4ffcf73360:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "name": "a715fafc-ca38-410c-9253-12ba506eabc0:panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_14bb75a0-6906-4555-9ed2-7bcd4580d596:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "name": "75f72920-be71-47a9-a967-f1c862ab2961:panel_75f72920-be71-47a9-a967-f1c862ab2961", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_018c4a7e-7f19-446e-ad9c-445278d027ef:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc.json index 45a4e6d3a26..0f5c44c65cc 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc.json @@ -1,7 +1,12 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"4d6088e2-f470-4c13-b08f-cf6b06b13c6a\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"4d6088e2-f470-4c13-b08f-cf6b06b13c6a\",\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"enhancements\":{}}},\"edac4b55-78e4-4252-97eb-bbf610058b43\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"edac4b55-78e4-4252-97eb-bbf610058b43\",\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"singleSelect\":false,\"enhancements\":{}}},\"2bbcb2bd-697a-45a2-a463-4da14a9a07d4\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"2bbcb2bd-697a-45a2-a463-4da14a9a07d4\",\"fieldName\":\"azure.resource.name\",\"title\":\"Resource Name\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for different storage types in Azure.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -13,278 +18,1769 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "### Azure Storage\n\n[**Overview**](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", + "openLinksInNewTab": false + }, + "title": "Navigation Storage Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "3e05fed8-0edd-4973-a640-3499c62b141d", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "3e05fed8-0edd-4973-a640-3499c62b141d", - "panelRefName": "panel_3e05fed8-0edd-4973-a640-3499c62b141d", "type": "visualization", - "version": "7.5.0" + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 9, - "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "w": 5, - "x": 9, - "y": 0 - }, - "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "panelRefName": "panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "title": "Availability", - "type": "visualization", - "version": "7.5.0" - }, - { - "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e97bc990-7acb-4492-9d3a-10e39fd18b6f": { + "columnOrder": [ + "406fb7d6-7444-44ad-a854-9c6228e79ea9", + "a2063525-bfe8-4af3-a408-3b35113a1481X0", + "a2063525-bfe8-4af3-a408-3b35113a1481X1", + "a2063525-bfe8-4af3-a408-3b35113a1481" + ], + "columns": { + "406fb7d6-7444-44ad-a854-9c6228e79ea9": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Used Capacity", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.used_capacity.avg" + }, + "a2063525-bfe8-4af3-a408-3b35113a1481": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.used_capacity.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.used_capacity.avg))", + "isFormulaBroken": false + }, + "references": [ + "a2063525-bfe8-4af3-a408-3b35113a1481X1" + ], + "scale": "ratio" + }, + "a2063525-bfe8-4af3-a408-3b35113a1481X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.used_capacity.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.used_capacity.avg" + }, + "a2063525-bfe8-4af3-a408-3b35113a1481X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.used_capacity.avg))", + "operationType": "overall_max", + "references": [ + "a2063525-bfe8-4af3-a408-3b35113a1481X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e97bc990-7acb-4492-9d3a-10e39fd18b6f", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "e97bc990-7acb-4492-9d3a-10e39fd18b6f", + "layerType": "data", + "maxAccessor": "a2063525-bfe8-4af3-a408-3b35113a1481", + "metricAccessor": "406fb7d6-7444-44ad-a854-9c6228e79ea9", + "showBar": false + } + }, + "title": "Storage Used Capacity [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "ed66fab5-f4e7-45d9-b27f-2315e0a10850", "w": 5, - "x": 14, - "y": 0 + "x": 0, + "y": 5 }, "panelIndex": "ed66fab5-f4e7-45d9-b27f-2315e0a10850", - "panelRefName": "panel_ed66fab5-f4e7-45d9-b27f-2315e0a10850", - "type": "visualization", - "version": "7.5.0" + "title": "Storage Used Capacity [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "9b84a8c8-c177-442a-b748-ba0ee3954a67": { + "columnOrder": [ + "e03e47e3-0020-4c01-8a84-7bdc2ac2b89a", + "6160382c-270e-42f7-9d4a-f644e4af73a1", + "6160382c-270e-42f7-9d4a-f644e4af73a1X0", + "6160382c-270e-42f7-9d4a-f644e4af73a1X1" + ], + "columns": { + "6160382c-270e-42f7-9d4a-f644e4af73a1": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.ingress.total))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.ingress.total))", + "isFormulaBroken": false + }, + "references": [ + "6160382c-270e-42f7-9d4a-f644e4af73a1X1" + ], + "scale": "ratio" + }, + "6160382c-270e-42f7-9d4a-f644e4af73a1X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.ingress.total))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + }, + "6160382c-270e-42f7-9d4a-f644e4af73a1X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.ingress.total))", + "operationType": "overall_max", + "references": [ + "6160382c-270e-42f7-9d4a-f644e4af73a1X0" + ], + "scale": "ratio" + }, + "e03e47e3-0020-4c01-8a84-7bdc2ac2b89a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Ingress", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-9b84a8c8-c177-442a-b748-ba0ee3954a67", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "9b84a8c8-c177-442a-b748-ba0ee3954a67", + "layerType": "data", + "maxAccessor": "6160382c-270e-42f7-9d4a-f644e4af73a1", + "metricAccessor": "e03e47e3-0020-4c01-8a84-7bdc2ac2b89a", + "showBar": false + } + }, + "title": "Storage Ingress Gauge [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "71f11ae2-b13c-49b5-ae16-3d6d5e1dacec", "w": 5, - "x": 19, - "y": 0 + "x": 5, + "y": 5 }, "panelIndex": "71f11ae2-b13c-49b5-ae16-3d6d5e1dacec", - "panelRefName": "panel_71f11ae2-b13c-49b5-ae16-3d6d5e1dacec", - "type": "visualization", - "version": "7.5.0" + "title": "Storage Ingress Gauge [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "5601d2ea-bb1c-4529-9b94-a0ffb06c76d4": { + "columnOrder": [ + "18860bc9-c1b5-47ca-8377-355028ce4e63", + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X0", + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X1", + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422" + ], + "columns": { + "18860bc9-c1b5-47ca-8377-355028ce4e63": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Egress", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + }, + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.egress.total))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.egress.total))", + "isFormulaBroken": false + }, + "references": [ + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X1" + ], + "scale": "ratio" + }, + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.egress.total))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + }, + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.egress.total))", + "operationType": "overall_max", + "references": [ + "e5b9cf0f-995d-4164-b70b-c3c7d3a28422X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-5601d2ea-bb1c-4529-9b94-a0ffb06c76d4", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "5601d2ea-bb1c-4529-9b94-a0ffb06c76d4", + "layerType": "data", + "maxAccessor": "e5b9cf0f-995d-4164-b70b-c3c7d3a28422", + "metricAccessor": "18860bc9-c1b5-47ca-8377-355028ce4e63" + } + }, + "title": "Storage Egress Gauge [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "dae9895e-c53a-4989-bab1-1b7b7c233c56", "w": 5, - "x": 24, - "y": 0 + "x": 10, + "y": 5 }, "panelIndex": "dae9895e-c53a-4989-bab1-1b7b7c233c56", - "panelRefName": "panel_dae9895e-c53a-4989-bab1-1b7b7c233c56", - "type": "visualization", - "version": "7.5.0" + "title": "Storage Egress Gauge [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "bd22ea55-1fc5-481b-862a-2cd82d75c0d8": { + "columnOrder": [ + "a4707016-e5d1-4f3a-8ba3-6bdefaa9ca69", + "0f3a1d5f-a240-422b-aa08-658f47ba2ac6" + ], + "columns": { + "0f3a1d5f-a240-422b-aa08-658f47ba2ac6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Availability", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": "%" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.availability.avg" + }, + "a4707016-e5d1-4f3a-8ba3-6bdefaa9ca69": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-bd22ea55-1fc5-481b-862a-2cd82d75c0d8", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.6, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0f3a1d5f-a240-422b-aa08-658f47ba2ac6" + ], + "layerId": "bd22ea55-1fc5-481b-862a-2cd82d75c0d8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "a4707016-e5d1-4f3a-8ba3-6bdefaa9ca69", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "0f3a1d5f-a240-422b-aa08-658f47ba2ac6" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Availability [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "1d623c03-4d02-4a81-b91e-49e82e112016", - "w": 19, - "x": 29, - "y": 0 + "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "w": 14, + "x": 15, + "y": 5 }, - "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", - "panelRefName": "panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "title": "Transactions", - "type": "visualization", - "version": "7.5.0" + "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "title": "Availability", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "122d106a-5ebf-4fb4-9eda-76f7e0b8b27c": { + "columnOrder": [ + "0bd251de-d6a1-47a6-9da9-d26ad4ba955e", + "1a1df8e4-d9f5-47b6-8594-0ab0f60e8b07", + "b04428d5-eeb1-4e0e-83bd-fc83c6863ca0" + ], + "columns": { + "0bd251de-d6a1-47a6-9da9-d26ad4ba955e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "1a1df8e4-d9f5-47b6-8594-0ab0f60e8b07": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.response_type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b04428d5-eeb1-4e0e-83bd-fc83c6863ca0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.response_type" + }, + "b04428d5-eeb1-4e0e-83bd-fc83c6863ca0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.storage_account.transactions.total)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.storage_account.transactions.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-122d106a-5ebf-4fb4-9eda-76f7e0b8b27c", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b04428d5-eeb1-4e0e-83bd-fc83c6863ca0" + ], + "layerId": "122d106a-5ebf-4fb4-9eda-76f7e0b8b27c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "1a1df8e4-d9f5-47b6-8594-0ab0f60e8b07", + "xAccessor": "0bd251de-d6a1-47a6-9da9-d26ad4ba955e", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "b04428d5-eeb1-4e0e-83bd-fc83c6863ca0" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Transactions [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "w": 9, - "x": 0, + "h": 9, + "i": "1d623c03-4d02-4a81-b91e-49e82e112016", + "w": 19, + "x": 29, "y": 5 }, - "panelIndex": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "panelRefName": "panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization", - "version": "7.5.0" + "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", + "title": "Transactions", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "7ac323ec-3377-43c3-ba80-c57416ec8fca": { + "columnOrder": [ + "a50e86df-2b20-4f18-9edf-283fe898564a", + "0b6693e2-f028-4cef-ae38-a9e3a712c5d1", + "490543d6-dc11-4696-8261-fa41d4897288" + ], + "columns": { + "0b6693e2-f028-4cef-ae38-a9e3a712c5d1": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "490543d6-dc11-4696-8261-fa41d4897288": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SuccessServerLatency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_server_latency.avg" + }, + "a50e86df-2b20-4f18-9edf-283fe898564a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "490543d6-dc11-4696-8261-fa41d4897288", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-7ac323ec-3377-43c3-ba80-c57416ec8fca", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "490543d6-dc11-4696-8261-fa41d4897288" + ], + "layerId": "7ac323ec-3377-43c3-ba80-c57416ec8fca", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "a50e86df-2b20-4f18-9edf-283fe898564a", + "xAccessor": "0b6693e2-f028-4cef-ae38-a9e3a712c5d1", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "490543d6-dc11-4696-8261-fa41d4897288" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success Server Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "87066244-7840-4555-9d12-026d64977f1a", - "w": 20, - "x": 9, - "y": 9 + "w": 23, + "x": 0, + "y": 14 }, "panelIndex": "87066244-7840-4555-9d12-026d64977f1a", - "panelRefName": "panel_87066244-7840-4555-9d12-026d64977f1a", "title": "Success Server Latency", - "type": "visualization", - "version": "7.5.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "de2c4d17-8208-4db2-9461-f10257c6b86a": { + "columnOrder": [ + "945c1823-c41a-4ce3-b88b-1c013bd20b96", + "b76601bf-1caf-4f61-85f2-796aea0dd43d", + "70e1d63a-137c-4d51-b195-0dce32c673a8" + ], + "columns": { + "70e1d63a-137c-4d51-b195-0dce32c673a8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Success E2E Latency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_e2elatency.avg" + }, + "945c1823-c41a-4ce3-b88b-1c013bd20b96": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "70e1d63a-137c-4d51-b195-0dce32c673a8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "b76601bf-1caf-4f61-85f2-796aea0dd43d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-de2c4d17-8208-4db2-9461-f10257c6b86a", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "70e1d63a-137c-4d51-b195-0dce32c673a8" + ], + "layerId": "de2c4d17-8208-4db2-9461-f10257c6b86a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "945c1823-c41a-4ce3-b88b-1c013bd20b96", + "xAccessor": "b76601bf-1caf-4f61-85f2-796aea0dd43d", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "70e1d63a-137c-4d51-b195-0dce32c673a8" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success E2E Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "756da375-e6a2-4668-af43-0cd294878254", - "w": 19, - "x": 29, - "y": 9 + "w": 25, + "x": 23, + "y": 14 }, "panelIndex": "756da375-e6a2-4668-af43-0cd294878254", - "panelRefName": "panel_756da375-e6a2-4668-af43-0cd294878254", "title": "Success E2E Latency", - "type": "visualization", - "version": "7.5.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "721b6040-2117-44bf-b66b-afb85793d514": { + "columnOrder": [ + "c80cde64-a940-4aa4-8d58-0afde134a141", + "1f16d1af-c76e-4040-8cc5-f57c905e0ea4" + ], + "columns": { + "1f16d1af-c76e-4040-8cc5-f57c905e0ea4": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Used Capacity", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.used_capacity.avg" + }, + "c80cde64-a940-4aa4-8d58-0afde134a141": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1f16d1af-c76e-4040-8cc5-f57c905e0ea4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-721b6040-2117-44bf-b66b-afb85793d514", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "fillOpacity": 1.2, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1f16d1af-c76e-4040-8cc5-f57c905e0ea4" + ], + "layerId": "721b6040-2117-44bf-b66b-afb85793d514", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "xAccessor": "c80cde64-a940-4aa4-8d58-0afde134a141", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "1f16d1af-c76e-4040-8cc5-f57c905e0ea4" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": false + }, + "valueLabels": "show" + } + }, + "title": "Storage Used Capacity Resource Table [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 18, + "h": 14, "i": "bf57aed2-3b69-4c8c-b602-e9054d08deb9", "w": 9, "x": 0, - "y": 20 + "y": 29 }, "panelIndex": "bf57aed2-3b69-4c8c-b602-e9054d08deb9", - "panelRefName": "panel_bf57aed2-3b69-4c8c-b602-e9054d08deb9", "title": "Used Capacity by Resource", - "type": "visualization", - "version": "7.5.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "adc8429d-18aa-496e-ad4d-9b9418ea5157": { + "columnOrder": [ + "cd99d8b6-ed6d-446f-9ae1-72997cab109f", + "1ec9a04a-dd22-4b59-86ce-04be1d525dbc", + "6b619561-5f87-4042-9250-9f07e71d8bb4" + ], + "columns": { + "1ec9a04a-dd22-4b59-86ce-04be1d525dbc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6b619561-5f87-4042-9250-9f07e71d8bb4": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Egress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + }, + "cd99d8b6-ed6d-446f-9ae1-72997cab109f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b619561-5f87-4042-9250-9f07e71d8bb4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-adc8429d-18aa-496e-ad4d-9b9418ea5157", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b619561-5f87-4042-9250-9f07e71d8bb4" + ], + "layerId": "adc8429d-18aa-496e-ad4d-9b9418ea5157", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "cd99d8b6-ed6d-446f-9ae1-72997cab109f", + "xAccessor": "1ec9a04a-dd22-4b59-86ce-04be1d525dbc", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,149,177,1)", + "forAccessor": "6b619561-5f87-4042-9250-9f07e71d8bb4" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Egress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "a715fafc-ca38-410c-9253-12ba506eabc0", "w": 20, "x": 9, - "y": 24 + "y": 29 }, "panelIndex": "a715fafc-ca38-410c-9253-12ba506eabc0", - "panelRefName": "panel_a715fafc-ca38-410c-9253-12ba506eabc0", "title": "Egress Traffic by APIName", - "type": "visualization", - "version": "7.5.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "b648e834-9fc3-406e-bb6e-bc38516f1427": { + "columnOrder": [ + "a0cbfa17-8e7a-4ba4-bc9b-1d34724e92b5", + "52ea9c9f-cb39-4311-a235-3489c5727f43", + "0a8507bb-d2a8-4914-a29f-137eed360a69" + ], + "columns": { + "0a8507bb-d2a8-4914-a29f-137eed360a69": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Ingress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + }, + "52ea9c9f-cb39-4311-a235-3489c5727f43": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a0cbfa17-8e7a-4ba4-bc9b-1d34724e92b5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0a8507bb-d2a8-4914-a29f-137eed360a69", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-b648e834-9fc3-406e-bb6e-bc38516f1427", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0a8507bb-d2a8-4914-a29f-137eed360a69" + ], + "layerId": "b648e834-9fc3-406e-bb6e-bc38516f1427", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "a0cbfa17-8e7a-4ba4-bc9b-1d34724e92b5", + "xAccessor": "52ea9c9f-cb39-4311-a235-3489c5727f43", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "0a8507bb-d2a8-4914-a29f-137eed360a69" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Ingress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "75f72920-be71-47a9-a967-f1c862ab2961", "w": 19, "x": 29, - "y": 24 + "y": 29 }, "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", - "panelRefName": "panel_75f72920-be71-47a9-a967-f1c862ab2961", "title": "Ingress Traffic by APIName", - "type": "visualization", - "version": "7.5.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Azure Metrics] Storage Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-09-01T05:30:06.264Z", "id": "azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, "references": [ { - "id": "azure_metrics-fcc24d70-32f5-11ea-a83e-25b8612d00cc", - "name": "3e05fed8-0edd-4973-a640-3499c62b141d:panel_3e05fed8-0edd-4973-a640-3499c62b141d", - "type": "visualization" - }, - { - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "name": "a9456b9b-efa6-410d-a56c-4b66aa8c499e:panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "type": "visualization" - }, - { - "id": "azure_metrics-634b83c0-32ee-11ea-a83e-25b8612d00cc", - "name": "ed66fab5-f4e7-45d9-b27f-2315e0a10850:panel_ed66fab5-f4e7-45d9-b27f-2315e0a10850", - "type": "visualization" - }, - { - "id": "azure_metrics-33d645e0-32ed-11ea-a83e-25b8612d00cc", - "name": "71f11ae2-b13c-49b5-ae16-3d6d5e1dacec:panel_71f11ae2-b13c-49b5-ae16-3d6d5e1dacec", - "type": "visualization" - }, - { - "id": "azure_metrics-2219de20-32ed-11ea-a83e-25b8612d00cc", - "name": "dae9895e-c53a-4989-bab1-1b7b7c233c56:panel_dae9895e-c53a-4989-bab1-1b7b7c233c56", - "type": "visualization" - }, - { - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "name": "1d623c03-4d02-4a81-b91e-49e82e112016:panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "type": "visualization" - }, - { - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization" - }, - { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "name": "87066244-7840-4555-9d12-026d64977f1a:panel_87066244-7840-4555-9d12-026d64977f1a", - "type": "visualization" - }, - { - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "name": "756da375-e6a2-4668-af43-0cd294878254:panel_756da375-e6a2-4668-af43-0cd294878254", - "type": "visualization" - }, - { - "id": "azure_metrics-109ec950-32e6-11ea-a83e-25b8612d00cc", - "name": "bf57aed2-3b69-4c8c-b602-e9054d08deb9:panel_bf57aed2-3b69-4c8c-b602-e9054d08deb9", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_4d6088e2-f470-4c13-b08f-cf6b06b13c6a:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "name": "a715fafc-ca38-410c-9253-12ba506eabc0:panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_edac4b55-78e4-4252-97eb-bbf610058b43:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "name": "75f72920-be71-47a9-a967-f1c862ab2961:panel_75f72920-be71-47a9-a967-f1c862ab2961", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_2bbcb2bd-697a-45a2-a463-4da14a9a07d4:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2.json index 79f5f5e9ec5..6d0aec6b272 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"e24a18a5-e96e-4e48-a813-6ac27de167b6\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"id\":\"e24a18a5-e96e-4e48-a813-6ac27de167b6\",\"enhancements\":{}}},\"5764ac1d-87aa-4fa8-812a-d55f4dc804e9\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"singleSelect\":true,\"id\":\"5764ac1d-87aa-4fa8-812a-d55f4dc804e9\",\"enhancements\":{}}},\"8e426d01-4311-46b4-9b3a-aa38989fab0d\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"Resource\",\"singleSelect\":true,\"id\":\"8e426d01-4311-46b4-9b3a-aa38989fab0d\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for the container registry in Azure.", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,144 +24,781 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Containers\n\n[Instances](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[**Registries**](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[Services](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", + "openLinksInNewTab": false + }, + "title": "Navigation Container Registry Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "51fee31f-97e1-4f8e-aeb2-daeca1ccf9be", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "51fee31f-97e1-4f8e-aeb2-daeca1ccf9be", - "panelRefName": "panel_51fee31f-97e1-4f8e-aeb2-daeca1ccf9be", "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-0fb3202b-7afd-431a-a2b6-37db2b05e38e", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0fb3202b-7afd-431a-a2b6-37db2b05e38e": { + "columnOrder": [ + "794377c5-bb06-4742-925c-228ba53d2d33", + "b80cecc3-d968-4960-bd0f-6bb934462185", + "a462a422-ac96-41e0-ac89-b2829c843721" + ], + "columns": { + "794377c5-bb06-4742-925c-228ba53d2d33": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "a462a422-ac96-41e0-ac89-b2829c843721": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Registry Successful Pull Count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_registry.successful_pull_count.total" + }, + "b80cecc3-d968-4960-bd0f-6bb934462185": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a462a422-ac96-41e0-ac89-b2829c843721" + ], + "layerId": "0fb3202b-7afd-431a-a2b6-37db2b05e38e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "794377c5-bb06-4742-925c-228ba53d2d33", + "xAccessor": "b80cecc3-d968-4960-bd0f-6bb934462185", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(188,74,0,1)", + "forAccessor": "a462a422-ac96-41e0-ac89-b2829c843721" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, "i": "d5569792-ff48-4843-b63e-d37218468ced", - "w": 18, - "x": 9, - "y": 0 + "w": 24, + "x": 0, + "y": 5 }, "panelIndex": "d5569792-ff48-4843-b63e-d37218468ced", - "panelRefName": "panel_d5569792-ff48-4843-b63e-d37218468ced", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "title": "Container Registry Successful Pull Count [Azure Metrics]", + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-de18b08a-95c6-472d-a4d9-4b94fb83912a", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "de18b08a-95c6-472d-a4d9-4b94fb83912a": { + "columnOrder": [ + "d3da8ced-dfbe-4f08-b0bd-d16769e39a81", + "d102bc80-f1c5-4753-83c0-260bd7dba88e", + "166a8c63-8bba-4f66-abf5-845fc94c9a81" + ], + "columns": { + "166a8c63-8bba-4f66-abf5-845fc94c9a81": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Registry Successful Push Count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_registry.successful_push_count.total" + }, + "d102bc80-f1c5-4753-83c0-260bd7dba88e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d3da8ced-dfbe-4f08-b0bd-d16769e39a81": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "166a8c63-8bba-4f66-abf5-845fc94c9a81" + ], + "layerId": "de18b08a-95c6-472d-a4d9-4b94fb83912a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "d3da8ced-dfbe-4f08-b0bd-d16769e39a81", + "xAccessor": "d102bc80-f1c5-4753-83c0-260bd7dba88e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(128,137,0,1)", + "forAccessor": "166a8c63-8bba-4f66-abf5-845fc94c9a81" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, "i": "25a02616-f735-494a-97f7-4a56531e9e5e", - "w": 21, - "x": 27, - "y": 0 + "w": 24, + "x": 24, + "y": 5 }, "panelIndex": "25a02616-f735-494a-97f7-4a56531e9e5e", - "panelRefName": "panel_25a02616-f735-494a-97f7-4a56531e9e5e", "title": "Container Registry Successful Push Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 11, - "i": "ec183a66-545b-4a67-bfb4-568def660612", - "w": 9, - "x": 0, - "y": 5 - }, - "panelIndex": "ec183a66-545b-4a67-bfb4-568def660612", - "panelRefName": "panel_ec183a66-545b-4a67-bfb4-568def660612", - "title": "Containers Filters", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-bb190f48-5d8d-46a4-8ef0-7f21c9b2719b", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "bb190f48-5d8d-46a4-8ef0-7f21c9b2719b": { + "columnOrder": [ + "732bc310-84f8-40c4-93d0-3f877749f6d1", + "5407c119-e770-4a0e-9ad0-411609bb72e6", + "15634ea6-bd04-4b1f-8727-91b73494d345" + ], + "columns": { + "15634ea6-bd04-4b1f-8727-91b73494d345": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Registry Successful Pull Count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_registry.successful_pull_count.total" + }, + "5407c119-e770-4a0e-9ad0-411609bb72e6": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "732bc310-84f8-40c4-93d0-3f877749f6d1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "15634ea6-bd04-4b1f-8727-91b73494d345" + ], + "layerId": "bb190f48-5d8d-46a4-8ef0-7f21c9b2719b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "732bc310-84f8-40c4-93d0-3f877749f6d1", + "xAccessor": "5407c119-e770-4a0e-9ad0-411609bb72e6", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(211,96,134,1)", + "forAccessor": "15634ea6-bd04-4b1f-8727-91b73494d345" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "7f508c43-afd7-4874-86ef-c6976700759b", "w": 24, "x": 0, - "y": 16 + "y": 21 }, "panelIndex": "7f508c43-afd7-4874-86ef-c6976700759b", - "panelRefName": "panel_7f508c43-afd7-4874-86ef-c6976700759b", "title": "Container Registry Total Pull Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-6062453c-6e46-4e3b-b924-63f77db4c2d7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "6062453c-6e46-4e3b-b924-63f77db4c2d7": { + "columnOrder": [ + "56774ff2-d06c-4363-a6bc-362331f2fd80", + "f7798c02-234e-42aa-af12-af6f5eb21dff", + "32082492-bced-4e4f-baf7-d3347f2ac59b" + ], + "columns": { + "32082492-bced-4e4f-baf7-d3347f2ac59b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Registry Total Push Count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_registry.total_push_count.total" + }, + "56774ff2-d06c-4363-a6bc-362331f2fd80": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f7798c02-234e-42aa-af12-af6f5eb21dff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "32082492-bced-4e4f-baf7-d3347f2ac59b" + ], + "layerId": "6062453c-6e46-4e3b-b924-63f77db4c2d7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "56774ff2-d06c-4363-a6bc-362331f2fd80", + "xAccessor": "f7798c02-234e-42aa-af12-af6f5eb21dff", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "32082492-bced-4e4f-baf7-d3347f2ac59b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "97a048da-9b56-420b-af8c-1f0d568f0f94", "w": 24, "x": 24, - "y": 16 + "y": 21 }, "panelIndex": "97a048da-9b56-420b-af8c-1f0d568f0f94", - "panelRefName": "panel_97a048da-9b56-420b-af8c-1f0d568f0f94", "title": "Container Registry Total Push Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Container Registry Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-1e70dc50-6d22-11ea-8fe8-71add5fd7c38", - "name": "51fee31f-97e1-4f8e-aeb2-daeca1ccf9be:panel_51fee31f-97e1-4f8e-aeb2-daeca1ccf9be", - "type": "visualization" + "id": "metrics-*", + "name": "d5569792-ff48-4843-b63e-d37218468ced:indexpattern-datasource-layer-0fb3202b-7afd-431a-a2b6-37db2b05e38e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "25a02616-f735-494a-97f7-4a56531e9e5e:indexpattern-datasource-layer-de18b08a-95c6-472d-a4d9-4b94fb83912a", + "type": "index-pattern" }, { - "id": "azure_metrics-7972b260-6d07-11ea-8fe8-71add5fd7c38", - "name": "d5569792-ff48-4843-b63e-d37218468ced:panel_d5569792-ff48-4843-b63e-d37218468ced", - "type": "visualization" + "id": "metrics-*", + "name": "7f508c43-afd7-4874-86ef-c6976700759b:indexpattern-datasource-layer-bb190f48-5d8d-46a4-8ef0-7f21c9b2719b", + "type": "index-pattern" }, { - "id": "azure_metrics-b88b7f90-6d07-11ea-8fe8-71add5fd7c38", - "name": "25a02616-f735-494a-97f7-4a56531e9e5e:panel_25a02616-f735-494a-97f7-4a56531e9e5e", - "type": "visualization" + "id": "metrics-*", + "name": "97a048da-9b56-420b-af8c-1f0d568f0f94:indexpattern-datasource-layer-6062453c-6e46-4e3b-b924-63f77db4c2d7", + "type": "index-pattern" }, { - "id": "azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9", - "name": "ec183a66-545b-4a67-bfb4-568def660612:panel_ec183a66-545b-4a67-bfb4-568def660612", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_e24a18a5-e96e-4e48-a813-6ac27de167b6:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-ff303710-6d07-11ea-8fe8-71add5fd7c38", - "name": "7f508c43-afd7-4874-86ef-c6976700759b:panel_7f508c43-afd7-4874-86ef-c6976700759b", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_5764ac1d-87aa-4fa8-812a-d55f4dc804e9:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-ddea7430-6d07-11ea-8fe8-71add5fd7c38", - "name": "97a048da-9b56-420b-af8c-1f0d568f0f94:panel_97a048da-9b56-420b-af8c-1f0d568f0f94", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_8e426d01-4311-46b4-9b3a-aa38989fab0d:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-91afcc50-eaad-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-91afcc50-eaad-11e9-90ec-112a988266d5.json index 0b6551cda37..81b67b3a123 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-91afcc50-eaad-11e9-90ec-112a988266d5.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-91afcc50-eaad-11e9-90ec-112a988266d5.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"8637c045-a72a-4b38-9e62-d3bf2e7a08b7\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"id\":\"8637c045-a72a-4b38-9e62-d3bf2e7a08b7\",\"enhancements\":{}}},\"cee07fda-dcef-4e03-abb4-52e251ba0d66\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"cee07fda-dcef-4e03-abb4-52e251ba0d66\",\"enhancements\":{}}},\"becc78e5-ae0e-49c5-afd3-bae0f51fde81\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.dimensions.vmname\",\"title\":\"VM Name (dimension)\",\"id\":\"becc78e5-ae0e-49c5-afd3-bae0f51fde81\",\"enhancements\":{}}}}" + }, "description": "This dashboard visualized relevant metrics for VM ScaleSets running on Azure cloud.", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,75 +24,516 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 12, - "i": "d84767cd-3fc9-438c-a969-f15c4d5fc9c5", - "w": 6, - "x": 0, - "y": 0 - }, - "panelIndex": "d84767cd-3fc9-438c-a969-f15c4d5fc9c5", - "panelRefName": "panel_d84767cd-3fc9-438c-a969-f15c4d5fc9c5", - "title": "Filters", - "type": "visualization", - "version": "7.4.0" - }, - { - "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-19ca4198-3d60-4298-bf58-2a8c8d703333", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "19ca4198-3d60-4298-bf58-2a8c8d703333": { + "columnOrder": [ + "aaab3b26-7d59-4adf-926c-484db2bbcbca", + "ec46a4a5-cd6b-4b86-9673-12cfb32742f8", + "5e12e1b2-732b-4598-b8d1-f658302b4fef" + ], + "columns": { + "5e12e1b2-732b-4598-b8d1-f658302b4fef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.compute_vm_scaleset.percentage_cpu.avg)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.percentage_cpu.avg" + }, + "aaab3b26-7d59-4adf-926c-484db2bbcbca": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec46a4a5-cd6b-4b86-9673-12cfb32742f8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "5e12e1b2-732b-4598-b8d1-f658302b4fef" + ], + "layerId": "19ca4198-3d60-4298-bf58-2a8c8d703333", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "ec46a4a5-cd6b-4b86-9673-12cfb32742f8", + "xAccessor": "aaab3b26-7d59-4adf-926c-484db2bbcbca", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "5e12e1b2-732b-4598-b8d1-f658302b4fef" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, "i": "127eff01-d34c-4bda-8f19-4cf06982989f", - "w": 20, - "x": 6, + "w": 24, + "x": 0, "y": 0 }, "panelIndex": "127eff01-d34c-4bda-8f19-4cf06982989f", - "panelRefName": "panel_127eff01-d34c-4bda-8f19-4cf06982989f", "title": "Percentage CPU", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e21a5a91-d219-4f09-b6d1-20eb943d56b3", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e21a5a91-d219-4f09-b6d1-20eb943d56b3": { + "columnOrder": [ + "f9ebe066-14eb-4b90-aceb-f2f5ef87a19a", + "3714522d-8d92-416a-bd8f-2d2a2defae96", + "1dd865ec-35f7-4842-a734-b49e8b8a3c54" + ], + "columns": { + "1dd865ec-35f7-4842-a734-b49e8b8a3c54": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.compute_vm_scaleset.available_memory_bytes.avg)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.available_memory_bytes.avg" + }, + "3714522d-8d92-416a-bd8f-2d2a2defae96": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f9ebe066-14eb-4b90-aceb-f2f5ef87a19a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1dd865ec-35f7-4842-a734-b49e8b8a3c54" + ], + "layerId": "e21a5a91-d219-4f09-b6d1-20eb943d56b3", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "3714522d-8d92-416a-bd8f-2d2a2defae96", + "xAccessor": "f9ebe066-14eb-4b90-aceb-f2f5ef87a19a", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "1dd865ec-35f7-4842-a734-b49e8b8a3c54" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, "i": "2f85c4f1-a575-49a1-99d3-fbed8a2806ec", - "w": 22, - "x": 26, + "w": 24, + "x": 24, "y": 0 }, "panelIndex": "2f85c4f1-a575-49a1-99d3-fbed8a2806ec", - "panelRefName": "panel_2f85c4f1-a575-49a1-99d3-fbed8a2806ec", "title": "Available Memory", - "type": "visualization", - "version": "7.4.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 11, - "i": "6cbc30b4-658e-4f7a-a888-221775fd0af3", - "w": 12, - "x": 36, - "y": 12 - }, - "panelIndex": "6cbc30b4-658e-4f7a-a888-221775fd0af3", - "panelRefName": "panel_6cbc30b4-658e-4f7a-a888-221775fd0af3", - "title": "Disk Reads", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-6f3a6179-62e3-40fd-956b-8fdfd46f8371", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "6f3a6179-62e3-40fd-956b-8fdfd46f8371": { + "columnOrder": [ + "50b321b7-2231-4b9b-8742-68c5b21bb7ff", + "0c0b01cd-a4c1-480d-993e-201cc50d9ffc", + "2b6d17dd-4bf7-46a8-baed-b64a32622da2" + ], + "columns": { + "0c0b01cd-a4c1-480d-993e-201cc50d9ffc": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "2b6d17dd-4bf7-46a8-baed-b64a32622da2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Azure VMSS Network In Total", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.network_in_total.total" + }, + "50b321b7-2231-4b9b-8742-68c5b21bb7ff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2b6d17dd-4bf7-46a8-baed-b64a32622da2" + ], + "layerId": "6f3a6179-62e3-40fd-956b-8fdfd46f8371", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "0c0b01cd-a4c1-480d-993e-201cc50d9ffc", + "xAccessor": "50b321b7-2231-4b9b-8742-68c5b21bb7ff", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "2b6d17dd-4bf7-46a8-baed-b64a32622da2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, @@ -96,14 +543,174 @@ "y": 12 }, "panelIndex": "e195e7ba-c736-4bf7-9f23-c96f4acd9b6b", - "panelRefName": "panel_e195e7ba-c736-4bf7-9f23-c96f4acd9b6b", "title": "Network In Total", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-03783e9a-a85e-4cbc-bbd9-f3426f8077a5", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "03783e9a-a85e-4cbc-bbd9-f3426f8077a5": { + "columnOrder": [ + "4e1e8b2d-e5eb-49a1-aae9-418fb76a732f", + "5a4ba3de-4077-4f57-ac47-4c000825ff2c", + "5423653e-dc39-4d05-b8ca-9a22cec245af" + ], + "columns": { + "4e1e8b2d-e5eb-49a1-aae9-418fb76a732f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "5423653e-dc39-4d05-b8ca-9a22cec245af": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Azure VM Network Out Total", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.network_out_total.total" + }, + "5a4ba3de-4077-4f57-ac47-4c000825ff2c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "5423653e-dc39-4d05-b8ca-9a22cec245af" + ], + "layerId": "03783e9a-a85e-4cbc-bbd9-f3426f8077a5", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "5a4ba3de-4077-4f57-ac47-4c000825ff2c", + "xAccessor": "4e1e8b2d-e5eb-49a1-aae9-418fb76a732f", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "5423653e-dc39-4d05-b8ca-9a22cec245af" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, @@ -113,14 +720,174 @@ "y": 12 }, "panelIndex": "64fc0214-97f7-4d52-a9bd-a91449293f1c", - "panelRefName": "panel_64fc0214-97f7-4d52-a9bd-a91449293f1c", "title": "Network Out Total", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-47a7b900-30f5-4735-9b3f-c1ce0791d125", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "47a7b900-30f5-4735-9b3f-c1ce0791d125": { + "columnOrder": [ + "2001c825-d5f5-4a28-ad75-de6dcff20a4b", + "ebf663a2-c3d6-46b8-8c4a-30ceffce5c8a", + "ef7945e7-3f56-4447-b6e4-e536304c0a9b" + ], + "columns": { + "2001c825-d5f5-4a28-ad75-de6dcff20a4b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ebf663a2-c3d6-46b8-8c4a-30ceffce5c8a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "ef7945e7-3f56-4447-b6e4-e536304c0a9b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Writes bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.disk_write_bytes.total" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ef7945e7-3f56-4447-b6e4-e536304c0a9b" + ], + "layerId": "47a7b900-30f5-4735-9b3f-c1ce0791d125", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "ebf663a2-c3d6-46b8-8c4a-30ceffce5c8a", + "xAccessor": "2001c825-d5f5-4a28-ad75-de6dcff20a4b", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,180,251,1)", + "forAccessor": "ef7945e7-3f56-4447-b6e4-e536304c0a9b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, @@ -130,14 +897,345 @@ "y": 12 }, "panelIndex": "12c9c185-81ed-4313-b274-b3384de2d396", - "panelRefName": "panel_12c9c185-81ed-4313-b274-b3384de2d396", "title": "Disk Writes", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-f3485eca-571b-4f08-bd0c-4be759cc64b6", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "f3485eca-571b-4f08-bd0c-4be759cc64b6": { + "columnOrder": [ + "87197844-2561-47b9-a72a-b0fb5b98b213", + "b44f6d7e-92c3-4aca-b17f-d224f542b2b1", + "459e86ae-fa0d-4f11-a148-d72a2160bc74" + ], + "columns": { + "459e86ae-fa0d-4f11-a148-d72a2160bc74": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Read bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.disk_read_bytes.total" + }, + "87197844-2561-47b9-a72a-b0fb5b98b213": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b44f6d7e-92c3-4aca-b17f-d224f542b2b1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "459e86ae-fa0d-4f11-a148-d72a2160bc74" + ], + "layerId": "f3485eca-571b-4f08-bd0c-4be759cc64b6", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "b44f6d7e-92c3-4aca-b17f-d224f542b2b1", + "xAccessor": "87197844-2561-47b9-a72a-b0fb5b98b213", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "459e86ae-fa0d-4f11-a148-d72a2160bc74" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "6cbc30b4-658e-4f7a-a888-221775fd0af3", + "w": 12, + "x": 36, + "y": 12 + }, + "panelIndex": "6cbc30b4-658e-4f7a-a888-221775fd0af3", + "title": "Disk Reads", + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7afed980-1b20-4a23-9bd7-ea4103b0ca07", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7afed980-1b20-4a23-9bd7-ea4103b0ca07": { + "columnOrder": [ + "a9d03b2b-3461-480b-87ca-6c2b1a92027f", + "08450621-b253-4fec-b7b3-b972f61b8822", + "209ad925-36ae-4727-be0a-07ae3b8ee05d" + ], + "columns": { + "08450621-b253-4fec-b7b3-b972f61b8822": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "209ad925-36ae-4727-be0a-07ae3b8ee05d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Read Operations/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.disk_read_operations_per_sec.avg" + }, + "a9d03b2b-3461-480b-87ca-6c2b1a92027f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "209ad925-36ae-4727-be0a-07ae3b8ee05d" + ], + "layerId": "7afed980-1b20-4a23-9bd7-ea4103b0ca07", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "08450621-b253-4fec-b7b3-b972f61b8822", + "xAccessor": "a9d03b2b-3461-480b-87ca-6c2b1a92027f", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "209ad925-36ae-4727-be0a-07ae3b8ee05d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -147,14 +1245,168 @@ "y": 23 }, "panelIndex": "200ae92b-4184-4aed-9868-6ce5e16e7a8d", - "panelRefName": "panel_200ae92b-4184-4aed-9868-6ce5e16e7a8d", "title": "Disk Read Operations/s", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-f8a913c2-543a-4a5b-b388-3b5533fd0c9e", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "f8a913c2-543a-4a5b-b388-3b5533fd0c9e": { + "columnOrder": [ + "5dd239de-13d4-455e-8529-194f1a07e594", + "8e969bff-e3b1-46b7-839c-90bd74ba46df", + "e9565d12-8e72-4111-bfd4-85f36000fb0f" + ], + "columns": { + "5dd239de-13d4-455e-8529-194f1a07e594": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8e969bff-e3b1-46b7-839c-90bd74ba46df": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "e9565d12-8e72-4111-bfd4-85f36000fb0f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Write Operations/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm_scaleset.disk_write_operations_per_sec.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e9565d12-8e72-4111-bfd4-85f36000fb0f" + ], + "layerId": "f8a913c2-543a-4a5b-b388-3b5533fd0c9e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "8e969bff-e3b1-46b7-839c-90bd74ba46df", + "xAccessor": "5dd239de-13d4-455e-8529-194f1a07e594", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "e9565d12-8e72-4111-bfd4-85f36000fb0f" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -164,66 +1416,75 @@ "y": 23 }, "panelIndex": "36c46a84-3e6b-4a7e-9246-357ae9d10d1e", - "panelRefName": "panel_36c46a84-3e6b-4a7e-9246-357ae9d10d1e", "title": "Disk Write Operations/s", - "type": "visualization", - "version": "7.4.0" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] VM Scale Sets Overview ", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-91afcc50-eaad-11e9-90ec-112a988266d5", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-686bc990-ea92-11e9-90ec-112a988266d5", - "name": "d84767cd-3fc9-438c-a969-f15c4d5fc9c5:panel_d84767cd-3fc9-438c-a969-f15c4d5fc9c5", - "type": "visualization" + "id": "metrics-*", + "name": "127eff01-d34c-4bda-8f19-4cf06982989f:indexpattern-datasource-layer-19ca4198-3d60-4298-bf58-2a8c8d703333", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2f85c4f1-a575-49a1-99d3-fbed8a2806ec:indexpattern-datasource-layer-e21a5a91-d219-4f09-b6d1-20eb943d56b3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e195e7ba-c736-4bf7-9f23-c96f4acd9b6b:indexpattern-datasource-layer-6f3a6179-62e3-40fd-956b-8fdfd46f8371", + "type": "index-pattern" }, { - "id": "azure_metrics-33500790-eaaf-11e9-90ec-112a988266d5", - "name": "127eff01-d34c-4bda-8f19-4cf06982989f:panel_127eff01-d34c-4bda-8f19-4cf06982989f", - "type": "visualization" + "id": "metrics-*", + "name": "64fc0214-97f7-4d52-a9bd-a91449293f1c:indexpattern-datasource-layer-03783e9a-a85e-4cbc-bbd9-f3426f8077a5", + "type": "index-pattern" }, { - "id": "azure_metrics-cecd6680-eb41-11e9-90ec-112a988266d5", - "name": "2f85c4f1-a575-49a1-99d3-fbed8a2806ec:panel_2f85c4f1-a575-49a1-99d3-fbed8a2806ec", - "type": "visualization" + "id": "metrics-*", + "name": "12c9c185-81ed-4313-b274-b3384de2d396:indexpattern-datasource-layer-47a7b900-30f5-4735-9b3f-c1ce0791d125", + "type": "index-pattern" }, { - "id": "azure_metrics-42cc28d0-ea9a-11e9-90ec-112a988266d5", - "name": "6cbc30b4-658e-4f7a-a888-221775fd0af3:panel_6cbc30b4-658e-4f7a-a888-221775fd0af3", - "type": "visualization" + "id": "metrics-*", + "name": "6cbc30b4-658e-4f7a-a888-221775fd0af3:indexpattern-datasource-layer-f3485eca-571b-4f08-bd0c-4be759cc64b6", + "type": "index-pattern" }, { - "id": "azure_metrics-64266ec0-eb42-11e9-90ec-112a988266d5", - "name": "e195e7ba-c736-4bf7-9f23-c96f4acd9b6b:panel_e195e7ba-c736-4bf7-9f23-c96f4acd9b6b", - "type": "visualization" + "id": "metrics-*", + "name": "200ae92b-4184-4aed-9868-6ce5e16e7a8d:indexpattern-datasource-layer-7afed980-1b20-4a23-9bd7-ea4103b0ca07", + "type": "index-pattern" }, { - "id": "azure_metrics-b45fd8e0-eb42-11e9-90ec-112a988266d5", - "name": "64fc0214-97f7-4d52-a9bd-a91449293f1c:panel_64fc0214-97f7-4d52-a9bd-a91449293f1c", - "type": "visualization" + "id": "metrics-*", + "name": "36c46a84-3e6b-4a7e-9246-357ae9d10d1e:indexpattern-datasource-layer-f8a913c2-543a-4a5b-b388-3b5533fd0c9e", + "type": "index-pattern" }, { - "id": "azure_metrics-0d03a670-eb43-11e9-90ec-112a988266d5", - "name": "12c9c185-81ed-4313-b274-b3384de2d396:panel_12c9c185-81ed-4313-b274-b3384de2d396", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_8637c045-a72a-4b38-9e62-d3bf2e7a08b7:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-9c1a1910-ea9a-11e9-90ec-112a988266d5", - "name": "200ae92b-4184-4aed-9868-6ce5e16e7a8d:panel_200ae92b-4184-4aed-9868-6ce5e16e7a8d", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_cee07fda-dcef-4e03-abb4-52e251ba0d66:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-cfaedaf0-eb43-11e9-90ec-112a988266d5", - "name": "36c46a84-3e6b-4a7e-9246-357ae9d10d1e:panel_36c46a84-3e6b-4a7e-9246-357ae9d10d1e", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_becc78e5-ae0e-49c5-afd3-bae0f51fde81:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38.json index 742ca1c38c7..cfe8dade387 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38.json @@ -1,7 +1,12 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ffdad1fb-52fd-4e71-bc31-b0c2c423ab11\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ffdad1fb-52fd-4e71-bc31-b0c2c423ab11\",\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"enhancements\":{}}},\"bc9a331c-0344-43d5-9076-7339b0ebdd90\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"bc9a331c-0344-43d5-9076-7339b0ebdd90\",\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"singleSelect\":true,\"enhancements\":{}}},\"e89da2e7-4e61-4d97-9cca-c0cad0a12093\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e89da2e7-4e61-4d97-9cca-c0cad0a12093\",\"fieldName\":\"azure.resource.name\",\"title\":\"Resource\",\"singleSelect\":true,\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for the container instances in Azure.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -13,150 +18,858 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": {} + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Containers\n\n[**Instances**](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[Registries](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[Services](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", + "openLinksInNewTab": false + }, + "title": "Navigation Container Instance Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "c3f93abd-4a7c-43fa-bde7-d26925082d2f", - "w": 11, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "c3f93abd-4a7c-43fa-bde7-d26925082d2f", - "panelRefName": "panel_c3f93abd-4a7c-43fa-bde7-d26925082d2f", "type": "visualization", - "version": "7.6.0" + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "658cae72-53f0-466c-a9a2-5d855dfaf21f": { + "columnOrder": [ + "7201da9b-0826-4776-b394-9fbafcb1b3aa", + "3d85e797-bf3e-4d7f-b8ef-ee681ba8c7be", + "8e71fc83-f2ce-4285-9734-701e2440b333" + ], + "columns": { + "3d85e797-bf3e-4d7f-b8ef-ee681ba8c7be": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "7201da9b-0826-4776-b394-9fbafcb1b3aa": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8e71fc83-f2ce-4285-9734-701e2440b333": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Azure Container CPU Utilization", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_instance.cpu_usage.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-658cae72-53f0-466c-a9a2-5d855dfaf21f", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8e71fc83-f2ce-4285-9734-701e2440b333" + ], + "layerId": "658cae72-53f0-466c-a9a2-5d855dfaf21f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "3d85e797-bf3e-4d7f-b8ef-ee681ba8c7be", + "xAccessor": "7201da9b-0826-4776-b394-9fbafcb1b3aa", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(164,221,0,1)", + "forAccessor": "8e71fc83-f2ce-4285-9734-701e2440b333" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Container Instance CPU Utilization [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, "i": "ea4c505b-43fb-4869-a94a-bba028071ecc", - "w": 17, - "x": 11, - "y": 0 + "w": 24, + "x": 0, + "y": 5 }, "panelIndex": "ea4c505b-43fb-4869-a94a-bba028071ecc", - "panelRefName": "panel_ea4c505b-43fb-4869-a94a-bba028071ecc", "title": "Container Instance CPU Utilization", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "56433bf4-d7c0-433f-964f-8c2dd8a97a6b": { + "columnOrder": [ + "6fb6336e-dbe7-4c83-aa53-bdc5b1ab7f30", + "b2d1c4f7-4edd-40be-9074-c19a2e3713ac", + "9c786694-3df7-415a-a56a-5a057591bf90" + ], + "columns": { + "6fb6336e-dbe7-4c83-aa53-bdc5b1ab7f30": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9c786694-3df7-415a-a56a-5a057591bf90": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Container Instance Memory Utilization", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.container_instance.memory_usage.avg" + }, + "b2d1c4f7-4edd-40be-9074-c19a2e3713ac": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-56433bf4-d7c0-433f-964f-8c2dd8a97a6b", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "9c786694-3df7-415a-a56a-5a057591bf90" + ], + "layerId": "56433bf4-d7c0-433f-964f-8c2dd8a97a6b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "b2d1c4f7-4edd-40be-9074-c19a2e3713ac", + "xAccessor": "6fb6336e-dbe7-4c83-aa53-bdc5b1ab7f30", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "9c786694-3df7-415a-a56a-5a057591bf90" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Container Instance Memory Utilization [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, "i": "0899027b-629e-4889-821f-45ee0161bd91", - "w": 20, - "x": 28, - "y": 0 + "w": 24, + "x": 24, + "y": 5 }, "panelIndex": "0899027b-629e-4889-821f-45ee0161bd91", - "panelRefName": "panel_0899027b-629e-4889-821f-45ee0161bd91", "title": "Container Instance Memory Utilization", - "type": "visualization", - "version": "7.6.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 11, - "i": "f72bd066-3696-4e0a-9660-78fb47c92152", - "w": 11, - "x": 0, - "y": 5 - }, - "panelIndex": "f72bd066-3696-4e0a-9660-78fb47c92152", - "panelRefName": "panel_f72bd066-3696-4e0a-9660-78fb47c92152", - "title": "Containers Filters", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ddcbb406-9ddd-4f61-be95-9ed0c3d61d57": { + "columnOrder": [ + "e4784370-989c-4e3f-b5c1-463097d0d63d", + "7a8b8086-cca2-4b64-bc9f-60b8e00d0ec6", + "e68f6c75-7232-46d8-aba4-2d9fbf90312d" + ], + "columns": { + "7a8b8086-cca2-4b64-bc9f-60b8e00d0ec6": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "e4784370-989c-4e3f-b5c1-463097d0d63d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e68f6c75-7232-46d8-aba4-2d9fbf90312d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Container Instance Network Bytes Received/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_instance.network_bytes_received_per_second.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-ddcbb406-9ddd-4f61-be95-9ed0c3d61d57", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e68f6c75-7232-46d8-aba4-2d9fbf90312d" + ], + "layerId": "ddcbb406-9ddd-4f61-be95-9ed0c3d61d57", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "7a8b8086-cca2-4b64-bc9f-60b8e00d0ec6", + "xAccessor": "e4784370-989c-4e3f-b5c1-463097d0d63d", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(251,158,0,1)", + "forAccessor": "e68f6c75-7232-46d8-aba4-2d9fbf90312d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Container Instance Network Bytes Received/s [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "7c9016b9-a76e-41f6-9945-ac6880fd9ab0", "w": 24, "x": 0, - "y": 16 + "y": 21 }, "panelIndex": "7c9016b9-a76e-41f6-9945-ac6880fd9ab0", - "panelRefName": "panel_7c9016b9-a76e-41f6-9945-ac6880fd9ab0", - "title": "Container Instance Netowrk Bytes Received/s", - "type": "visualization", - "version": "7.6.0" + "title": "Container Instance Network Bytes Received/s", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "4d307ae6-2eb5-4cc8-b51b-3991b53b8bd8": { + "columnOrder": [ + "4fec72f0-2a78-407f-8be4-6ae68a58820c", + "57a8bf85-b18a-4aac-8b55-18dbc32768eb", + "e7d9639b-cd0b-42bb-bbd2-90c300a70e02" + ], + "columns": { + "4fec72f0-2a78-407f-8be4-6ae68a58820c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "57a8bf85-b18a-4aac-8b55-18dbc32768eb": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "e7d9639b-cd0b-42bb-bbd2-90c300a70e02": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Container Instance Network Bytes Transmitted/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_instance.network_bytes_transmitted_per_second.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4d307ae6-2eb5-4cc8-b51b-3991b53b8bd8", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e7d9639b-cd0b-42bb-bbd2-90c300a70e02" + ], + "layerId": "4d307ae6-2eb5-4cc8-b51b-3991b53b8bd8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "57a8bf85-b18a-4aac-8b55-18dbc32768eb", + "xAccessor": "4fec72f0-2a78-407f-8be4-6ae68a58820c", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(128,137,0,1)", + "forAccessor": "e7d9639b-cd0b-42bb-bbd2-90c300a70e02" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Container Instance Network Bytes Transmitted/s [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "0abdf4ee-b569-430b-972a-a60160ef2221", "w": 24, "x": 24, - "y": 16 + "y": 21 }, "panelIndex": "0abdf4ee-b569-430b-972a-a60160ef2221", - "panelRefName": "panel_0abdf4ee-b569-430b-972a-a60160ef2221", "title": "Container Instance Network Bytes Transmitted/s", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Azure Metrics] Container Instance Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-08-29T11:32:00.024Z", "id": "azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, "references": [ { - "id": "azure_metrics-5720b830-6aad-11ea-af5c-73e8f396b3e9", - "name": "c3f93abd-4a7c-43fa-bde7-d26925082d2f:panel_c3f93abd-4a7c-43fa-bde7-d26925082d2f", - "type": "visualization" - }, - { - "id": "azure_metrics-04f8eec0-6ab1-11ea-af5c-73e8f396b3e9", - "name": "ea4c505b-43fb-4869-a94a-bba028071ecc:panel_ea4c505b-43fb-4869-a94a-bba028071ecc", - "type": "visualization" - }, - { - "id": "azure_metrics-942844b0-6ac5-11ea-af5c-73e8f396b3e9", - "name": "0899027b-629e-4889-821f-45ee0161bd91:panel_0899027b-629e-4889-821f-45ee0161bd91", - "type": "visualization" - }, - { - "id": "azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9", - "name": "f72bd066-3696-4e0a-9660-78fb47c92152:panel_f72bd066-3696-4e0a-9660-78fb47c92152", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_ffdad1fb-52fd-4e71-bc31-b0c2c423ab11:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-bd1c93b0-6cf7-11ea-8fe8-71add5fd7c38", - "name": "7c9016b9-a76e-41f6-9945-ac6880fd9ab0:panel_7c9016b9-a76e-41f6-9945-ac6880fd9ab0", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_bc9a331c-0344-43d5-9076-7339b0ebdd90:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-74a8e130-6cfa-11ea-8fe8-71add5fd7c38", - "name": "0abdf4ee-b569-430b-972a-a60160ef2221:panel_0abdf4ee-b569-430b-972a-a60160ef2221", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_e89da2e7-4e61-4d97-9cca-c0cad0a12093:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5.json index d3328ad0231..dcc9c777310 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"13f93daa-2996-4413-8716-73b186ca0271\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"id\":\"13f93daa-2996-4413-8716-73b186ca0271\",\"enhancements\":{}}},\"fc120d66-f166-410b-b088-f948c09f5009\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"fc120d66-f166-410b-b088-f948c09f5009\",\"enhancements\":{}}},\"eee6fbaa-e4c9-4c8d-816c-5c47fa5a7b1a\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"VM Name\",\"id\":\"eee6fbaa-e4c9-4c8d-816c-5c47fa5a7b1a\",\"enhancements\":{}}}}" + }, "description": "This dashboards shows ASP.NET and SQL Server specific metrics extracted from the azure.vm.windows.guestmetrics namespace", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,40 +24,165 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Guest ASP.NET \u0026 SQL Server Metrics\n\n[Back to Overview Metrics](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [Memory \u0026 Process](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [**ASP.NET and SQL Server**](#/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5) ", + "openLinksInNewTab": false + }, + "title": "Navigation Compute VM Guest ASP.NET \u0026 SQL Server Guest Metrics [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 6, "i": "aca8d6d8-91f6-4362-95e6-3547df2c95ab", - "w": 10, + "w": 24, "x": 0, "y": 0 }, "panelIndex": "aca8d6d8-91f6-4362-95e6-3547df2c95ab", - "panelRefName": "panel_aca8d6d8-91f6-4362-95e6-3547df2c95ab", "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 6, - "i": "b7b8bcc1-f776-45cf-a149-36665f2de746", - "w": 14, - "x": 10, - "y": 0 - }, - "panelIndex": "b7b8bcc1-f776-45cf-a149-36665f2de746", - "panelRefName": "panel_b7b8bcc1-f776-45cf-a149-36665f2de746", - "title": "Filters", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-04ca1413-c115-497d-9fc1-cbbc1096cd35", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "04ca1413-c115-497d-9fc1-cbbc1096cd35": { + "columnOrder": [ + "99dfae3a-9f13-458b-a72c-7e1e60046230", + "150abef4-24f9-4590-97e1-37086c47b194" + ], + "columns": { + "150abef4-24f9-4590-97e1-37086c47b194": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "connections", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.sqlserver_general_statistics_user_connections.avg" + }, + "99dfae3a-9f13-458b-a72c-7e1e60046230": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "150abef4-24f9-4590-97e1-37086c47b194" + ], + "layerId": "04ca1413-c115-497d-9fc1-cbbc1096cd35", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "99dfae3a-9f13-458b-a72c-7e1e60046230", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "150abef4-24f9-4590-97e1-37086c47b194" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -61,14 +192,136 @@ "y": 0 }, "panelIndex": "6a5abca9-1cfd-45ef-aa88-9b4a72ce2dca", - "panelRefName": "panel_6a5abca9-1cfd-45ef-aa88-9b4a72ce2dca", "title": "SQL Server User Connections", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-32e3900a-495a-4014-85ad-2ed800ff76d8", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "32e3900a-495a-4014-85ad-2ed800ff76d8": { + "columnOrder": [ + "760c9e2d-3ca5-4645-bc06-824141f59969", + "2e58f163-ed64-4a0d-867b-6e0797e313e5" + ], + "columns": { + "2e58f163-ed64-4a0d-867b-6e0797e313e5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "applications running", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_running.avg" + }, + "760c9e2d-3ca5-4645-bc06-824141f59969": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.2, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2e58f163-ed64-4a0d-867b-6e0797e313e5" + ], + "layerId": "32e3900a-495a-4014-85ad-2ed800ff76d8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "760c9e2d-3ca5-4645-bc06-824141f59969", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "2e58f163-ed64-4a0d-867b-6e0797e313e5" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -78,14 +331,141 @@ "y": 6 }, "panelIndex": "bc65dd87-08f6-49f7-b8bf-0d371431ad4d", - "panelRefName": "panel_bc65dd87-08f6-49f7-b8bf-0d371431ad4d", "title": "Applications Running", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-3aa3b228-eeaf-4a1b-801b-5fddfb60fed3", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "3aa3b228-eeaf-4a1b-801b-5fddfb60fed3": { + "columnOrder": [ + "d43e87f6-e5f1-40b2-8587-c94c129e02ae", + "d0eb903b-4a8f-4a3d-aa1e-e0f6bcc2de2c" + ], + "columns": { + "d0eb903b-4a8f-4a3d-aa1e-e0f6bcc2de2c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "memory", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.sqlserver_memory_manager_total_server_memory.avg" + }, + "d43e87f6-e5f1-40b2-8587-c94c129e02ae": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d0eb903b-4a8f-4a3d-aa1e-e0f6bcc2de2c" + ], + "layerId": "3aa3b228-eeaf-4a1b-801b-5fddfb60fed3", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "d43e87f6-e5f1-40b2-8587-c94c129e02ae", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "d0eb903b-4a8f-4a3d-aa1e-e0f6bcc2de2c" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -95,14 +475,312 @@ "y": 12 }, "panelIndex": "aaa96404-80de-44dc-990c-76bf40d3827b", - "panelRefName": "panel_aaa96404-80de-44dc-990c-76bf40d3827b", "title": "SQL Server Total Server Memory", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-d0780101-176b-42b3-bd87-1eb75070e4d8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-a24698c5-6841-456f-bd10-8ffe55877bca", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-3eb35d2d-eaa4-4bc8-8994-d92be01d01ae", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-46d93037-893a-4a1f-90fb-296f1eb58c17", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "3eb35d2d-eaa4-4bc8-8994-d92be01d01ae": { + "columnOrder": [ + "15f62cf5-0520-4902-98a5-2b77d5c3c8cb", + "fc7f5591-8179-422c-9a7c-6ae237157c66" + ], + "columns": { + "15f62cf5-0520-4902-98a5-2b77d5c3c8cb": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fc7f5591-8179-422c-9a7c-6ae237157c66": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "succeeded", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_requests_succeeded.avg" + } + }, + "incompleteColumns": {} + }, + "46d93037-893a-4a1f-90fb-296f1eb58c17": { + "columnOrder": [ + "8012f73d-6b6f-4c5e-a248-b01a53923e75", + "9287f204-1e7f-4da7-88e8-75b129563978" + ], + "columns": { + "8012f73d-6b6f-4c5e-a248-b01a53923e75": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9287f204-1e7f-4da7-88e8-75b129563978": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "total", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_requests_total.avg" + } + }, + "incompleteColumns": {} + }, + "a24698c5-6841-456f-bd10-8ffe55877bca": { + "columnOrder": [ + "2361bae7-da67-4752-b81c-784d63bd1133", + "e61e9769-4de2-45c6-bbb0-071a58a8f319" + ], + "columns": { + "2361bae7-da67-4752-b81c-784d63bd1133": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e61e9769-4de2-45c6-bbb0-071a58a8f319": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "failed", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_requests_failed.avg" + } + }, + "incompleteColumns": {} + }, + "d0780101-176b-42b3-bd87-1eb75070e4d8": { + "columnOrder": [ + "765b02b8-1ecb-4331-bdca-669963ec0d18", + "e1f90bc3-ef99-4b93-9ca9-40554f931802" + ], + "columns": { + "765b02b8-1ecb-4331-bdca-669963ec0d18": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e1f90bc3-ef99-4b93-9ca9-40554f931802": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "timed out", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_requests_timed_out.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e1f90bc3-ef99-4b93-9ca9-40554f931802" + ], + "layerId": "d0780101-176b-42b3-bd87-1eb75070e4d8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "765b02b8-1ecb-4331-bdca-669963ec0d18", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(254,146,0,1)", + "forAccessor": "e1f90bc3-ef99-4b93-9ca9-40554f931802" + } + ] + }, + { + "accessors": [ + "e61e9769-4de2-45c6-bbb0-071a58a8f319" + ], + "layerId": "a24698c5-6841-456f-bd10-8ffe55877bca", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "2361bae7-da67-4752-b81c-784d63bd1133", + "yConfig": [ + { + "axisMode": "left", + "color": "#DB1374", + "forAccessor": "e61e9769-4de2-45c6-bbb0-071a58a8f319" + } + ] + }, + { + "accessors": [ + "fc7f5591-8179-422c-9a7c-6ae237157c66" + ], + "layerId": "3eb35d2d-eaa4-4bc8-8994-d92be01d01ae", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "15f62cf5-0520-4902-98a5-2b77d5c3c8cb", + "yConfig": [ + { + "axisMode": "left", + "color": "#00B3A4", + "forAccessor": "fc7f5591-8179-422c-9a7c-6ae237157c66" + } + ] + }, + { + "accessors": [ + "9287f204-1e7f-4da7-88e8-75b129563978" + ], + "layerId": "46d93037-893a-4a1f-90fb-296f1eb58c17", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "8012f73d-6b6f-4c5e-a248-b01a53923e75", + "yConfig": [ + { + "axisMode": "left", + "color": "#490092", + "forAccessor": "9287f204-1e7f-4da7-88e8-75b129563978" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -112,14 +790,140 @@ "y": 18 }, "panelIndex": "5c0158cc-c884-4665-8bbf-7fc34d885d55", - "panelRefName": "panel_5c0158cc-c884-4665-8bbf-7fc34d885d55", "title": "Application Requests", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4e9fe76c-dd6e-482e-b5e6-80365f63ee1a", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "4e9fe76c-dd6e-482e-b5e6-80365f63ee1a": { + "columnOrder": [ + "b8991460-48a1-4f71-9db5-7c323e899b64", + "a7036c3d-b262-482f-ad20-ff5324c0bd47" + ], + "columns": { + "a7036c3d-b262-482f-ad20-ff5324c0bd47": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "errors", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_errors_total.avg" + }, + "b8991460-48a1-4f71-9db5-7c323e899b64": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.2, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a7036c3d-b262-482f-ad20-ff5324c0bd47" + ], + "layerId": "4e9fe76c-dd6e-482e-b5e6-80365f63ee1a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "b8991460-48a1-4f71-9db5-7c323e899b64", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(244,78,59,1)", + "forAccessor": "a7036c3d-b262-482f-ad20-ff5324c0bd47" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -129,14 +933,194 @@ "y": 18 }, "panelIndex": "03c9cff0-b2ec-4dd1-9a2f-db7f441e5e71", - "panelRefName": "panel_03c9cff0-b2ec-4dd1-9a2f-db7f441e5e71", "title": "Application Error Rates", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-62a117f6-ae04-4140-b189-3bf7f1aeed34", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-63780669-90ca-47bc-88bb-13c44f2183fd", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "62a117f6-ae04-4140-b189-3bf7f1aeed34": { + "columnOrder": [ + "c83c32be-ef92-46be-adc9-60270d078a0b", + "7646aaad-8f25-4012-b829-a2556dcefdea" + ], + "columns": { + "7646aaad-8f25-4012-b829-a2556dcefdea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Page Reads/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.sqlserver_buffer_manager_page_reads_per_sec.avg" + }, + "c83c32be-ef92-46be-adc9-60270d078a0b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "63780669-90ca-47bc-88bb-13c44f2183fd": { + "columnOrder": [ + "2b43f295-060e-42df-b966-6a415cfe81bc", + "d454debf-a642-4d31-91b2-1fc06ba66237" + ], + "columns": { + "2b43f295-060e-42df-b966-6a415cfe81bc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d454debf-a642-4d31-91b2-1fc06ba66237": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Page Writes/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.sqlserver_buffer_manager_page_writes_per_sec.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "7646aaad-8f25-4012-b829-a2556dcefdea" + ], + "layerId": "62a117f6-ae04-4140-b189-3bf7f1aeed34", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "c83c32be-ef92-46be-adc9-60270d078a0b", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "7646aaad-8f25-4012-b829-a2556dcefdea" + } + ] + }, + { + "accessors": [ + "d454debf-a642-4d31-91b2-1fc06ba66237" + ], + "layerId": "63780669-90ca-47bc-88bb-13c44f2183fd", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "2b43f295-060e-42df-b966-6a415cfe81bc", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "d454debf-a642-4d31-91b2-1fc06ba66237" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -146,14 +1130,312 @@ "y": 24 }, "panelIndex": "43effd82-fc6a-4d11-bd1e-d3b12a34cbce", - "panelRefName": "panel_43effd82-fc6a-4d11-bd1e-d3b12a34cbce", "title": "SQL Server Page Reads/Writes", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-70eaf0a1-58ec-4104-a28d-f60b942907d7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-a61ee0d9-85ea-4520-a2d8-58df29ff8037", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-a17f6ecc-8371-47d3-9712-c34fd46e2241", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-6e225479-97e6-48fc-a218-b73708f9e1e4", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "6e225479-97e6-48fc-a218-b73708f9e1e4": { + "columnOrder": [ + "6dbb7446-8979-4cd8-be0e-8f53f6b28b4e", + "ddaaa53a-86eb-49e2-8cad-4e5680ede30f" + ], + "columns": { + "6dbb7446-8979-4cd8-be0e-8f53f6b28b4e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ddaaa53a-86eb-49e2-8cad-4e5680ede30f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "total", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_sessions_total.avg" + } + }, + "incompleteColumns": {} + }, + "70eaf0a1-58ec-4104-a28d-f60b942907d7": { + "columnOrder": [ + "710798d3-cbd4-461c-8003-8e8803946419", + "f7838f99-ab97-4720-8b61-ac694e147be6" + ], + "columns": { + "710798d3-cbd4-461c-8003-8e8803946419": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f7838f99-ab97-4720-8b61-ac694e147be6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "active", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_sessions_active.avg" + } + }, + "incompleteColumns": {} + }, + "a17f6ecc-8371-47d3-9712-c34fd46e2241": { + "columnOrder": [ + "0ef5196d-6919-48d8-81fc-352f9df7fd20", + "40d92cb9-2a4b-494b-bf59-b24182da983b" + ], + "columns": { + "0ef5196d-6919-48d8-81fc-352f9df7fd20": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "40d92cb9-2a4b-494b-bf59-b24182da983b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "abandoned", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_sessions_abandoned.avg" + } + }, + "incompleteColumns": {} + }, + "a61ee0d9-85ea-4520-a2d8-58df29ff8037": { + "columnOrder": [ + "250ef7ef-8500-4087-8f08-50da9277b712", + "d5d7524c-135f-40fe-b419-827d9d7725a4" + ], + "columns": { + "250ef7ef-8500-4087-8f08-50da9277b712": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d5d7524c-135f-40fe-b419-827d9d7725a4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "timed out", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.asp_net_applications_sessions_timed_out.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f7838f99-ab97-4720-8b61-ac694e147be6" + ], + "layerId": "70eaf0a1-58ec-4104-a28d-f60b942907d7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "710798d3-cbd4-461c-8003-8e8803946419", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "f7838f99-ab97-4720-8b61-ac694e147be6" + } + ] + }, + { + "accessors": [ + "d5d7524c-135f-40fe-b419-827d9d7725a4" + ], + "layerId": "a61ee0d9-85ea-4520-a2d8-58df29ff8037", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "250ef7ef-8500-4087-8f08-50da9277b712", + "yConfig": [ + { + "axisMode": "left", + "color": "#DB1374", + "forAccessor": "d5d7524c-135f-40fe-b419-827d9d7725a4" + } + ] + }, + { + "accessors": [ + "40d92cb9-2a4b-494b-bf59-b24182da983b" + ], + "layerId": "a17f6ecc-8371-47d3-9712-c34fd46e2241", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "0ef5196d-6919-48d8-81fc-352f9df7fd20", + "yConfig": [ + { + "axisMode": "left", + "color": "#00B3A4", + "forAccessor": "40d92cb9-2a4b-494b-bf59-b24182da983b" + } + ] + }, + { + "accessors": [ + "ddaaa53a-86eb-49e2-8cad-4e5680ede30f" + ], + "layerId": "6e225479-97e6-48fc-a218-b73708f9e1e4", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "6dbb7446-8979-4cd8-be0e-8f53f6b28b4e", + "yConfig": [ + { + "axisMode": "left", + "color": "#490092", + "forAccessor": "ddaaa53a-86eb-49e2-8cad-4e5680ede30f" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -163,66 +1445,105 @@ "y": 36 }, "panelIndex": "b89c7551-e0e1-4642-ac18-01322ea72db8", - "panelRefName": "panel_b89c7551-e0e1-4642-ac18-01322ea72db8", "title": "Application Sessions", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Compute VM Guest ASP.NET \u0026 Sql Server", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-4bbd6f50-feaf-11eb-8fff-87871c582eca", - "name": "aca8d6d8-91f6-4362-95e6-3547df2c95ab:panel_aca8d6d8-91f6-4362-95e6-3547df2c95ab", - "type": "visualization" + "id": "metrics-*", + "name": "6a5abca9-1cfd-45ef-aa88-9b4a72ce2dca:indexpattern-datasource-layer-04ca1413-c115-497d-9fc1-cbbc1096cd35", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "bc65dd87-08f6-49f7-b8bf-0d371431ad4d:indexpattern-datasource-layer-32e3900a-495a-4014-85ad-2ed800ff76d8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "aaa96404-80de-44dc-990c-76bf40d3827b:indexpattern-datasource-layer-3aa3b228-eeaf-4a1b-801b-5fddfb60fed3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5c0158cc-c884-4665-8bbf-7fc34d885d55:indexpattern-datasource-layer-d0780101-176b-42b3-bd87-1eb75070e4d8", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5c0158cc-c884-4665-8bbf-7fc34d885d55:indexpattern-datasource-layer-a24698c5-6841-456f-bd10-8ffe55877bca", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5c0158cc-c884-4665-8bbf-7fc34d885d55:indexpattern-datasource-layer-3eb35d2d-eaa4-4bc8-8994-d92be01d01ae", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "5c0158cc-c884-4665-8bbf-7fc34d885d55:indexpattern-datasource-layer-46d93037-893a-4a1f-90fb-296f1eb58c17", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "03c9cff0-b2ec-4dd1-9a2f-db7f441e5e71:indexpattern-datasource-layer-4e9fe76c-dd6e-482e-b5e6-80365f63ee1a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "43effd82-fc6a-4d11-bd1e-d3b12a34cbce:indexpattern-datasource-layer-62a117f6-ae04-4140-b189-3bf7f1aeed34", + "type": "index-pattern" }, { - "id": "azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5", - "name": "b7b8bcc1-f776-45cf-a149-36665f2de746:panel_b7b8bcc1-f776-45cf-a149-36665f2de746", - "type": "visualization" + "id": "metrics-*", + "name": "43effd82-fc6a-4d11-bd1e-d3b12a34cbce:indexpattern-datasource-layer-63780669-90ca-47bc-88bb-13c44f2183fd", + "type": "index-pattern" }, { - "id": "azure_metrics-0aacc190-eaa8-11e9-90ec-112a988266d5", - "name": "6a5abca9-1cfd-45ef-aa88-9b4a72ce2dca:panel_6a5abca9-1cfd-45ef-aa88-9b4a72ce2dca", - "type": "visualization" + "id": "metrics-*", + "name": "b89c7551-e0e1-4642-ac18-01322ea72db8:indexpattern-datasource-layer-70eaf0a1-58ec-4104-a28d-f60b942907d7", + "type": "index-pattern" }, { - "id": "azure_metrics-1f5c1cd0-eaa3-11e9-90ec-112a988266d5", - "name": "bc65dd87-08f6-49f7-b8bf-0d371431ad4d:panel_bc65dd87-08f6-49f7-b8bf-0d371431ad4d", - "type": "visualization" + "id": "metrics-*", + "name": "b89c7551-e0e1-4642-ac18-01322ea72db8:indexpattern-datasource-layer-a61ee0d9-85ea-4520-a2d8-58df29ff8037", + "type": "index-pattern" }, { - "id": "azure_metrics-d7ea4290-eaa8-11e9-90ec-112a988266d5", - "name": "aaa96404-80de-44dc-990c-76bf40d3827b:panel_aaa96404-80de-44dc-990c-76bf40d3827b", - "type": "visualization" + "id": "metrics-*", + "name": "b89c7551-e0e1-4642-ac18-01322ea72db8:indexpattern-datasource-layer-a17f6ecc-8371-47d3-9712-c34fd46e2241", + "type": "index-pattern" }, { - "id": "azure_metrics-097bc300-eaa5-11e9-90ec-112a988266d5", - "name": "5c0158cc-c884-4665-8bbf-7fc34d885d55:panel_5c0158cc-c884-4665-8bbf-7fc34d885d55", - "type": "visualization" + "id": "metrics-*", + "name": "b89c7551-e0e1-4642-ac18-01322ea72db8:indexpattern-datasource-layer-6e225479-97e6-48fc-a218-b73708f9e1e4", + "type": "index-pattern" }, { - "id": "azure_metrics-6d52a660-eaa4-11e9-90ec-112a988266d5", - "name": "03c9cff0-b2ec-4dd1-9a2f-db7f441e5e71:panel_03c9cff0-b2ec-4dd1-9a2f-db7f441e5e71", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_13f93daa-2996-4413-8716-73b186ca0271:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-787a0a20-eaa8-11e9-90ec-112a988266d5", - "name": "43effd82-fc6a-4d11-bd1e-d3b12a34cbce:panel_43effd82-fc6a-4d11-bd1e-d3b12a34cbce", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_fc120d66-f166-410b-b088-f948c09f5009:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-b9aa9b20-eaa5-11e9-90ec-112a988266d5", - "name": "b89c7551-e0e1-4642-ac18-01322ea72db8:panel_b89c7551-e0e1-4642-ac18-01322ea72db8", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_eee6fbaa-e4c9-4c8d-816c-5c47fa5a7b1a:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc.json index 9cae7ded159..b99db13decf 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc.json @@ -1,4 +1,11 @@ { + "id": "azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2023-08-08T06:46:29.879Z", + "version": "WzgzMywxXQ==", "attributes": { "description": "This dashboard shows metrics for the blob storage type in Azure.", "hits": 0, @@ -39,9 +46,8 @@ }, "panelsJSON": [ { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 5, "i": "ed5f5642-c94a-481b-a8c2-7dfe4c6a4f05", @@ -50,14 +56,34 @@ "y": 0 }, "panelIndex": "ed5f5642-c94a-481b-a8c2-7dfe4c6a4f05", - "panelRefName": "panel_ed5f5642-c94a-481b-a8c2-7dfe4c6a4f05", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Navigation Blob Storage Overview [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "fontSize": 10, + "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [**Blob**](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", + "openLinksInNewTab": false + }, + "type": "markdown", + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + } + } + } }, { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 9, "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", @@ -66,15 +92,100 @@ "y": 0 }, "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "panelRefName": "panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "title": "Availability", - "type": "visualization", - "version": "7.7.0" - }, - { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "title": "Storage Availability [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "background_color": "rgba(104,204,202,1)", + "id": "18f616c0-32e2-11ea-867b-37070aefa392", + "operator": "gte", + "value": 100 + }, + { + "background_color": "rgba(244,78,59,1)", + "id": "998b1c90-32e2-11ea-867b-37070aefa392", + "operator": "lt", + "value": 100 + } + ], + "bar_color_rules": [ + { + "id": "28142cf0-32e2-11ea-867b-37070aefa392" + } + ], + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "29808e30-32e2-11ea-867b-37070aefa392" + } + ], + "gauge_inner_width": "7", + "gauge_style": "circle", + "gauge_width": 10, + "id": "0e91b810-32e2-11ea-a93d-dd20c62559b3", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(22,165,165,1)", + "fill": "0.6", + "formatter": "number", + "hide_in_legend": 1, + "id": "0e91b811-32e2-11ea-a93d-dd20c62559b3", + "label": "Availability", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.availability.avg", + "id": "0e91b812-32e2-11ea-a93d-dd20c62559b3", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "terms_field": null, + "type": "timeseries", + "value_template": "{{value}} %" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "last_value", + "type": "timeseries", + "use_kibana_indexes": false + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } }, + "title": "Availability" + }, + { + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 9, "i": "0c873134-b025-487d-be81-f727dbff0174", @@ -83,14 +194,101 @@ "y": 0 }, "panelIndex": "0c873134-b025-487d-be81-f727dbff0174", - "panelRefName": "panel_0c873134-b025-487d-be81-f727dbff0174", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Storage Blob Capacity [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "71978870-32e4-11ea-af9e-d70582a45bda" + } + ], + "bar_color_rules": [ + { + "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" + } + ], + "drilldown_url": "", + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" + } + ], + "gauge_inner_color": null, + "gauge_inner_width": "6", + "gauge_style": "circle", + "gauge_width": "10", + "hide_last_value_indicator": true, + "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", + "index_pattern": "metrics-*", + "interval": "60m", + "isModelInvalid": false, + "pivot_id": "azure.resource.name", + "pivot_label": "Resource Name", + "pivot_rows": "30", + "pivot_type": "string", + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "1.2", + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "bytes", + "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", + "label": "Blob Capacity", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.blob_capacity.avg", + "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "terms_field": "azure.resource.name", + "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "gauge", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } + } }, { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 9, "i": "41faed50-ba96-4484-b6dc-71ed3e2d3427", @@ -99,14 +297,97 @@ "y": 0 }, "panelIndex": "41faed50-ba96-4484-b6dc-71ed3e2d3427", - "panelRefName": "panel_41faed50-ba96-4484-b6dc-71ed3e2d3427", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Storage Blob Count [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "71978870-32e4-11ea-af9e-d70582a45bda" + } + ], + "bar_color_rules": [ + { + "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" + } + ], + "drilldown_url": "", + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" + } + ], + "gauge_inner_color": null, + "gauge_inner_width": "6", + "gauge_style": "circle", + "gauge_width": "10", + "hide_last_value_indicator": true, + "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", + "index_pattern": "metrics-*", + "interval": "60m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,156,224,1)", + "fill": "1.2", + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "'0'", + "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", + "label": "Blob Count", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.blob_count.avg", + "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "terms_field": "azure.resource.name", + "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "gauge", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } + } }, { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 9, "i": "1d623c03-4d02-4a81-b91e-49e82e112016", @@ -115,15 +396,72 @@ "y": 0 }, "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", - "panelRefName": "panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "title": "Transactions", - "type": "visualization", - "version": "7.7.0" - }, - { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "title": "Storage Transactions [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "c9fd65d0-32e8-11ea-84f4-e9593f8ba8f6", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "bar", + "color": "#3185FC", + "fill": 0.5, + "formatter": "number", + "id": "c9fd8ce0-32e8-11ea-84f4-e9593f8ba8f6", + "label": "avg(azure.storage_account.transactions.total)", + "line_width": "1", + "metrics": [ + { + "field": "azure.storage_account.transactions.total", + "id": "c9fd8ce1-32e8-11ea-84f4-e9593f8ba8f6", + "type": "max" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_mode": "terms", + "stacked": "none", + "terms_field": "azure.dimensions.response_type", + "terms_order_by": "c9fd8ce1-32e8-11ea-84f4-e9593f8ba8f6", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } }, + "title": "Transactions" + }, + { + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 15, "i": "ff6441f8-d66d-4399-bae5-25d3d861b299", @@ -132,14 +470,81 @@ "y": 5 }, "panelIndex": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "panelRefName": "panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Storage Filters [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "controls": [ + { + "fieldName": "azure.subscription_id", + "id": "1549397251041", + "indexPatternRefName": "control_0_index_pattern", + "label": "Subscription", + "options": { + "dynamicOptions": true, + "multiselect": false, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "", + "type": "list" + }, + { + "fieldName": "azure.resource.group", + "id": "1549512142947", + "indexPatternRefName": "control_1_index_pattern", + "label": "Resource Group", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "", + "type": "list" + }, + { + "fieldName": "azure.resource.name", + "id": "1578578146383", + "indexPatternRefName": "control_2_index_pattern", + "label": "Resource Name", + "options": { + "dynamicOptions": true, + "multiselect": true, + "order": "desc", + "size": 5, + "type": "terms" + }, + "parent": "", + "type": "list" + } + ], + "pinFilters": false, + "updateFiltersOnChange": true, + "useTimeFilter": false + }, + "type": "input_control_vis", + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + } + } + } }, { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 15, "i": "87066244-7840-4555-9d12-026d64977f1a", @@ -148,15 +553,72 @@ "y": 9 }, "panelIndex": "87066244-7840-4555-9d12-026d64977f1a", - "panelRefName": "panel_87066244-7840-4555-9d12-026d64977f1a", - "title": "Success Server Latency", - "type": "visualization", - "version": "7.7.0" - }, - { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "title": "Storage Success Server Latency [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "bar", + "color": "#3185FC", + "fill": 0.5, + "formatter": "number", + "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", + "label": "SuccessServerLatency (ms)", + "line_width": "1", + "metrics": [ + { + "field": "azure.storage_account.success_server_latency.avg", + "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_mode": "terms", + "stacked": "none", + "terms_field": "azure.dimensions.api_name", + "terms_order_by": "e9a40232-32e9-11ea-bda2-69435df36a5c", + "type": "timeseries", + "value_template": "{{value}} ms" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } }, + "title": "Success Server Latency" + }, + { + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 15, "i": "756da375-e6a2-4668-af43-0cd294878254", @@ -165,15 +627,72 @@ "y": 9 }, "panelIndex": "756da375-e6a2-4668-af43-0cd294878254", - "panelRefName": "panel_756da375-e6a2-4668-af43-0cd294878254", - "title": "Success E2E Latency", - "type": "visualization", - "version": "7.7.0" - }, - { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "title": "Storage Success E2E Latency [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "da4459b0-32ea-11ea-be35-cb10be813609", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "bar", + "color": "#3185FC", + "fill": 0.5, + "formatter": "number", + "id": "da4459b1-32ea-11ea-be35-cb10be813609", + "label": "Success E2E Latency (ms)", + "line_width": "1", + "metrics": [ + { + "field": "azure.storage_account.success_e2elatency.avg", + "id": "da4459b2-32ea-11ea-be35-cb10be813609", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "rainbow", + "split_mode": "terms", + "stacked": "none", + "terms_field": "azure.dimensions.api_name", + "terms_order_by": "da4459b2-32ea-11ea-be35-cb10be813609", + "type": "timeseries", + "value_template": "{{value}} ms" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } }, + "title": "Success E2E Latency" + }, + { + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 9, "i": "34aa5ce7-4f4b-4712-836f-3765e7c3fb3f", @@ -182,14 +701,97 @@ "y": 0 }, "panelIndex": "34aa5ce7-4f4b-4712-836f-3765e7c3fb3f", - "panelRefName": "panel_34aa5ce7-4f4b-4712-836f-3765e7c3fb3f", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Storage Container Count [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color": null, + "background_color_rules": [ + { + "id": "71978870-32e4-11ea-af9e-d70582a45bda" + } + ], + "bar_color_rules": [ + { + "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" + } + ], + "drilldown_url": "", + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" + } + ], + "gauge_inner_color": null, + "gauge_inner_width": "6", + "gauge_style": "circle", + "gauge_width": "10", + "hide_last_value_indicator": true, + "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", + "index_pattern": "metrics-*", + "interval": "60m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": "1.2", + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "'0'", + "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", + "label": "Container Count", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.container_count.avg", + "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "avg" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_mode": "everything", + "stacked": "none", + "terms_field": "azure.resource.name", + "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "gauge", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } + } }, { - "embeddableConfig": { - "enhancements": {} - }, + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 14, "i": "a715fafc-ca38-410c-9253-12ba506eabc0", @@ -198,15 +800,105 @@ "y": 24 }, "panelIndex": "a715fafc-ca38-410c-9253-12ba506eabc0", - "panelRefName": "panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "title": "Egress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" - }, - { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "title": "Storage Account Egress Traffic [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "0791c5a0-32d8-11ea-98d2-1194b9f2bfc0" + } + ], + "bar_color_rules": [ + { + "id": "fca016e0-32de-11ea-a435-e7199eba380d" + } + ], + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "fb8be7c0-32de-11ea-a435-e7199eba380d" + } + ], + "gauge_inner_width": 10, + "gauge_style": "half", + "gauge_width": 10, + "id": "f0edca80-32d5-11ea-b19d-fb5049b980ca", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(0,149,177,1)", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "bytes", + "hidden": false, + "id": "f0edf190-32d5-11ea-b19d-fb5049b980ca", + "label": "Storage Accounts Egress Total", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.egress.total", + "id": "f0edf191-32d5-11ea-b19d-fb5049b980ca", + "type": "max" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "rgba(0,98,177,1)", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "283dc410-32d9-11ea-98d2-1194b9f2bfc0" + } + ], + "split_mode": "terms", + "stacked": "none", + "terms_field": "azure.dimensions.api_name", + "terms_order_by": "f0edf191-32d5-11ea-b19d-fb5049b980ca", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } }, + "title": "Egress Traffic by APIName" + }, + { + "version": "8.3.0", + "type": "visualization", "gridData": { "h": 14, "i": "75f72920-be71-47a9-a967-f1c862ab2961", @@ -215,21 +907,107 @@ "y": 24 }, "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", - "panelRefName": "panel_75f72920-be71-47a9-a967-f1c862ab2961", - "title": "Ingress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "title": "Storage Account Ingress Traffic [Azure Metrics]", + "description": "", + "uiState": {}, + "params": { + "axis_formatter": "number", + "axis_min": 0, + "axis_position": "left", + "axis_scale": "normal", + "background_color_rules": [ + { + "id": "0791c5a0-32d8-11ea-98d2-1194b9f2bfc0" + } + ], + "bar_color_rules": [ + { + "id": "fca016e0-32de-11ea-a435-e7199eba380d" + } + ], + "filter": { + "language": "kuery", + "query": "" + }, + "gauge_color_rules": [ + { + "id": "fb8be7c0-32de-11ea-a435-e7199eba380d" + } + ], + "gauge_inner_width": 10, + "gauge_style": "half", + "gauge_width": 10, + "id": "f0edca80-32d5-11ea-b19d-fb5049b980ca", + "index_pattern": "metrics-*", + "interval": "5m", + "isModelInvalid": false, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "rgba(104,188,0,1)", + "fill": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "bytes", + "hidden": false, + "id": "f0edf190-32d5-11ea-b19d-fb5049b980ca", + "label": "Storage Accounts Ingress Total", + "line_width": 2, + "metrics": [ + { + "field": "azure.storage_account.ingress.total", + "id": "f0edf191-32d5-11ea-b19d-fb5049b980ca", + "type": "max" + } + ], + "point_size": 0, + "separate_axis": 0, + "split_color_mode": "gradient", + "split_filters": [ + { + "color": "rgba(0,98,177,1)", + "filter": { + "language": "kuery", + "query": "" + }, + "id": "283dc410-32d9-11ea-98d2-1194b9f2bfc0" + } + ], + "split_mode": "terms", + "stacked": "none", + "terms_field": "azure.dimensions.api_name", + "terms_order_by": "f0edf191-32d5-11ea-b19d-fb5049b980ca", + "type": "timeseries", + "value_template": "{{value}}" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "type": "timeseries", + "use_kibana_indexes": false, + "drop_last_bucket": 1 + }, + "type": "metrics", + "data": { + "aggs": [], + "searchSource": {} + } + } + }, + "title": "Ingress Traffic by APIName" } ], "timeRestore": false, "title": "[Azure Metrics] Blob Storage Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "dashboard": "7.14.0" - }, "references": [ { "id": "metrics-*", @@ -237,60 +1015,23 @@ "type": "index-pattern" }, { - "id": "azure_metrics-e4b25ee0-32f6-11ea-a83e-25b8612d00cc", - "name": "ed5f5642-c94a-481b-a8c2-7dfe4c6a4f05:panel_ed5f5642-c94a-481b-a8c2-7dfe4c6a4f05", - "type": "visualization" - }, - { - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "name": "a9456b9b-efa6-410d-a56c-4b66aa8c499e:panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "type": "visualization" + "type": "index-pattern", + "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:control_0_index_pattern", + "id": "metrics-*" }, { - "id": "azure_metrics-17ee2920-3391-11ea-a83e-25b8612d00cc", - "name": "0c873134-b025-487d-be81-f727dbff0174:panel_0c873134-b025-487d-be81-f727dbff0174", - "type": "visualization" + "type": "index-pattern", + "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:control_1_index_pattern", + "id": "metrics-*" }, { - "id": "azure_metrics-55936920-3391-11ea-a83e-25b8612d00cc", - "name": "41faed50-ba96-4484-b6dc-71ed3e2d3427:panel_41faed50-ba96-4484-b6dc-71ed3e2d3427", - "type": "visualization" - }, - { - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "name": "1d623c03-4d02-4a81-b91e-49e82e112016:panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "type": "visualization" - }, - { - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization" - }, - { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "name": "87066244-7840-4555-9d12-026d64977f1a:panel_87066244-7840-4555-9d12-026d64977f1a", - "type": "visualization" - }, - { - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "name": "756da375-e6a2-4668-af43-0cd294878254:panel_756da375-e6a2-4668-af43-0cd294878254", - "type": "visualization" - }, - { - "id": "azure_metrics-9e991b10-3391-11ea-a83e-25b8612d00cc", - "name": "34aa5ce7-4f4b-4712-836f-3765e7c3fb3f:panel_34aa5ce7-4f4b-4712-836f-3765e7c3fb3f", - "type": "visualization" - }, - { - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "name": "a715fafc-ca38-410c-9253-12ba506eabc0:panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "type": "visualization" - }, - { - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "name": "75f72920-be71-47a9-a967-f1c862ab2961:panel_75f72920-be71-47a9-a967-f1c862ab2961", - "type": "visualization" + "type": "index-pattern", + "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:control_2_index_pattern", + "id": "metrics-*" } ], - "type": "dashboard" + "migrationVersion": { + "dashboard": "8.3.0" + }, + "coreMigrationVersion": "8.3.0" } \ No newline at end of file diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-b232c220-8481-11ea-b181-4b1a9e0110f9.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-b232c220-8481-11ea-b181-4b1a9e0110f9.json index c1a559d2c57..f1a3bba939d 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-b232c220-8481-11ea-b181-4b1a9e0110f9.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-b232c220-8481-11ea-b181-4b1a9e0110f9.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"5ded6e5e-32f8-491e-a515-5465e2549e82\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"id\":\"5ded6e5e-32f8-491e-a515-5465e2549e82\",\"enhancements\":{}}},\"81c62f66-38e0-45a3-9b19-e380906868b3\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"singleSelect\":true,\"id\":\"81c62f66-38e0-45a3-9b19-e380906868b3\",\"enhancements\":{}}},\"7b24bd7b-62d4-41d1-8b73-a0cadf1977b4\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"Resource\",\"singleSelect\":true,\"id\":\"7b24bd7b-62d4-41d1-8b73-a0cadf1977b4\",\"enhancements\":{}}},\"5966e687-c394-49b7-9425-6b78bdd42278\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.dimensions.database_name\",\"title\":\"Database\",\"id\":\"5966e687-c394-49b7-9425-6b78bdd42278\",\"enhancements\":{}}}}" + }, "description": "This Azure Database Account dashboard visualizes the most important database account metrics.", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,188 +24,1106 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 4, - "i": "fe2125b1-526c-4293-b488-86d8c15ea3fb", - "w": 9, - "x": 0, - "y": 0 - }, - "panelIndex": "fe2125b1-526c-4293-b488-86d8c15ea3fb", - "panelRefName": "panel_fe2125b1-526c-4293-b488-86d8c15ea3fb", - "type": "visualization", - "version": "7.6.0" - }, - { - "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-2ea02a2a-cdd3-40ba-97da-5b9d05e8c045", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "2ea02a2a-cdd3-40ba-97da-5b9d05e8c045": { + "columnOrder": [ + "c97e22a5-f733-4829-9b73-6cbc360fc7ba", + "7363b83c-fe2f-4995-a378-dc4d1bab3111", + "3fb621b2-d036-4d81-921c-1a84b4e90811" + ], + "columns": { + "3fb621b2-d036-4d81-921c-1a84b4e90811": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Data Usage", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.database_account.data_usage.total" + }, + "7363b83c-fe2f-4995-a378-dc4d1bab3111": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "exclude": [ + "\"\u003cempty\u003e\"" + ], + "excludeIsRegex": true, + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3fb621b2-d036-4d81-921c-1a84b4e90811", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + }, + "c97e22a5-f733-4829-9b73-6cbc360fc7ba": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3fb621b2-d036-4d81-921c-1a84b4e90811" + ], + "layerId": "2ea02a2a-cdd3-40ba-97da-5b9d05e8c045", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "7363b83c-fe2f-4995-a378-dc4d1bab3111", + "xAccessor": "c97e22a5-f733-4829-9b73-6cbc360fc7ba", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "3fb621b2-d036-4d81-921c-1a84b4e90811" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, "i": "db895503-5a84-4b26-b889-c3c7ca964643", - "w": 18, - "x": 9, - "y": 0 + "w": 24, + "x": 0, + "y": 4 }, "panelIndex": "db895503-5a84-4b26-b889-c3c7ca964643", - "panelRefName": "panel_db895503-5a84-4b26-b889-c3c7ca964643", "title": "Data Usage", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4fccce2f-367f-4ed1-8b1d-95e99a644bf6", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "4fccce2f-367f-4ed1-8b1d-95e99a644bf6": { + "columnOrder": [ + "4e3e96de-e88a-43f1-8381-9760892ace3c", + "01be910c-aa52-4746-aa95-8ae74666515c", + "3c4ed7dd-e654-4c8b-bb2a-4b57c77fc059" + ], + "columns": { + "01be910c-aa52-4746-aa95-8ae74666515c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "exclude": [ + "\"\u003cempty\u003e\"" + ], + "excludeIsRegex": true, + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3c4ed7dd-e654-4c8b-bb2a-4b57c77fc059", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + }, + "3c4ed7dd-e654-4c8b-bb2a-4b57c77fc059": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Index Usage", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.database_account.index_usage.total" + }, + "4e3e96de-e88a-43f1-8381-9760892ace3c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3c4ed7dd-e654-4c8b-bb2a-4b57c77fc059" + ], + "layerId": "4fccce2f-367f-4ed1-8b1d-95e99a644bf6", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "01be910c-aa52-4746-aa95-8ae74666515c", + "xAccessor": "4e3e96de-e88a-43f1-8381-9760892ace3c", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "3c4ed7dd-e654-4c8b-bb2a-4b57c77fc059" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, "i": "0b986285-a5d0-4a31-bdb8-0f29cd50c2eb", - "w": 21, - "x": 27, - "y": 0 + "w": 24, + "x": 24, + "y": 4 }, "panelIndex": "0b986285-a5d0-4a31-bdb8-0f29cd50c2eb", - "panelRefName": "panel_0b986285-a5d0-4a31-bdb8-0f29cd50c2eb", "title": "Index Usage", - "type": "visualization", - "version": "7.6.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 14, - "i": "7d7b71ea-eb6b-43bf-be61-80235d1d4529", - "w": 9, - "x": 0, - "y": 4 - }, - "panelIndex": "7d7b71ea-eb6b-43bf-be61-80235d1d4529", - "panelRefName": "panel_7d7b71ea-eb6b-43bf-be61-80235d1d4529", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ce857b4e-c1a6-426a-922a-74414174f31c", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "ce857b4e-c1a6-426a-922a-74414174f31c": { + "columnOrder": [ + "6806524d-6952-4c0f-965e-a589f2ceb49d", + "8898315e-288c-49f3-9c48-d9a7fff604f9", + "d59fadff-0350-4448-adff-1926cfdfe2a7" + ], + "columns": { + "6806524d-6952-4c0f-965e-a589f2ceb49d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8898315e-288c-49f3-9c48-d9a7fff604f9": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "exclude": [ + "\"\u003cempty\u003e\"" + ], + "excludeIsRegex": true, + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d59fadff-0350-4448-adff-1926cfdfe2a7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + }, + "d59fadff-0350-4448-adff-1926cfdfe2a7": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Total Requests", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.database_account.total_requests.count" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d59fadff-0350-4448-adff-1926cfdfe2a7" + ], + "layerId": "ce857b4e-c1a6-426a-922a-74414174f31c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "8898315e-288c-49f3-9c48-d9a7fff604f9", + "xAccessor": "6806524d-6952-4c0f-965e-a589f2ceb49d", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(211,49,21,1)", + "forAccessor": "d59fadff-0350-4448-adff-1926cfdfe2a7" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "f6ce8b48-a876-4031-a43f-3ca3704a4ad6", "w": 24, "x": 0, - "y": 18 + "y": 22 }, "panelIndex": "f6ce8b48-a876-4031-a43f-3ca3704a4ad6", - "panelRefName": "panel_f6ce8b48-a876-4031-a43f-3ca3704a4ad6", "title": "Total Requests", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-29755bf1-08a6-4d0a-91be-45e89f7acf6c", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "29755bf1-08a6-4d0a-91be-45e89f7acf6c": { + "columnOrder": [ + "d296a866-7260-4fd0-92b8-c51c474191dc", + "6d44ab5c-94d8-44e3-90cf-2907e0818887", + "b2b5caee-bc32-49d4-a106-0bc5189d9c60" + ], + "columns": { + "6d44ab5c-94d8-44e3-90cf-2907e0818887": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "exclude": [ + "\"\u003cempty\u003e\"" + ], + "excludeIsRegex": true, + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b2b5caee-bc32-49d4-a106-0bc5189d9c60", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + }, + "b2b5caee-bc32-49d4-a106-0bc5189d9c60": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Document Count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.database_account.document_count.total" + }, + "d296a866-7260-4fd0-92b8-c51c474191dc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b2b5caee-bc32-49d4-a106-0bc5189d9c60" + ], + "layerId": "29755bf1-08a6-4d0a-91be-45e89f7acf6c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "6d44ab5c-94d8-44e3-90cf-2907e0818887", + "xAccessor": "d296a866-7260-4fd0-92b8-c51c474191dc", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(102,102,102,1)", + "forAccessor": "b2b5caee-bc32-49d4-a106-0bc5189d9c60" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "c604014a-647f-4a1d-b2e9-0304fdacc363", "w": 24, "x": 24, - "y": 18 + "y": 22 }, "panelIndex": "c604014a-647f-4a1d-b2e9-0304fdacc363", - "panelRefName": "panel_c604014a-647f-4a1d-b2e9-0304fdacc363", "title": "Document Count", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-836ebce7-0f89-405a-a22b-87640aefc7a7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "836ebce7-0f89-405a-a22b-87640aefc7a7": { + "columnOrder": [ + "510de163-da9e-4bbb-9123-fbcd8137f1b0", + "582ca1b9-b067-43f1-83ac-e7eaae6be66a", + "533fedbb-252f-4692-a9f4-684f2db7ecea" + ], + "columns": { + "510de163-da9e-4bbb-9123-fbcd8137f1b0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "533fedbb-252f-4692-a9f4-684f2db7ecea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Available storage", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "azure.database_account.available_storage.total" + }, + "582ca1b9-b067-43f1-83ac-e7eaae6be66a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "exclude": [ + "\"\u003cempty\u003e\"" + ], + "excludeIsRegex": true, + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "533fedbb-252f-4692-a9f4-684f2db7ecea", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "533fedbb-252f-4692-a9f4-684f2db7ecea" + ], + "layerId": "836ebce7-0f89-405a-a22b-87640aefc7a7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "582ca1b9-b067-43f1-83ac-e7eaae6be66a", + "xAccessor": "510de163-da9e-4bbb-9123-fbcd8137f1b0", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(101,50,148,1)", + "forAccessor": "533fedbb-252f-4692-a9f4-684f2db7ecea" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9", "w": 24, "x": 0, - "y": 33 + "y": 37 }, "panelIndex": "b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9", - "panelRefName": "panel_b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9", "title": "Available Storage", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-3450e519-734c-41f0-8359-ca2bdfa410d9", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "3450e519-734c-41f0-8359-ca2bdfa410d9": { + "columnOrder": [ + "e68bc054-a100-4a07-aa25-d143e7b35d7a", + "e6baa80e-eb80-490f-af62-85b660093713", + "927efb5c-668b-4d6b-b418-2826c9d0eea2" + ], + "columns": { + "927efb5c-668b-4d6b-b418-2826c9d0eea2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Requests", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.database_account.total_requests.count" + }, + "e68bc054-a100-4a07-aa25-d143e7b35d7a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status Codes", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "fallback": false, + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.status_code" + }, + "e6baa80e-eb80-490f-af62-85b660093713": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of azure.dimensions.database_name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "fallback": false, + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.database_name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "927efb5c-668b-4d6b-b418-2826c9d0eea2" + ], + "layerId": "3450e519-734c-41f0-8359-ca2bdfa410d9", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "e68bc054-a100-4a07-aa25-d143e7b35d7a", + "xAccessor": "e6baa80e-eb80-490f-af62-85b660093713" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "title": "Empty XY chart", + "valueLabels": "hide", + "xTitle": "", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "5e755432-3e55-405c-91cf-3348d5067a3a", + "i": "8686b8c9-df01-4872-8f72-001b39c0d824", "w": 24, "x": 24, - "y": 33 + "y": 37 }, - "panelIndex": "5e755432-3e55-405c-91cf-3348d5067a3a", - "panelRefName": "panel_5e755432-3e55-405c-91cf-3348d5067a3a", + "panelIndex": "8686b8c9-df01-4872-8f72-001b39c0d824", "title": "Requests Per Status Code", + "type": "lens", + "version": "8.4.0" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": {} + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Database Accounts\n", + "openLinksInNewTab": false + }, + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "ba6e5ed6-86d8-4d43-bc3c-158737ec9fdf", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "ba6e5ed6-86d8-4d43-bc3c-158737ec9fdf", + "title": "Navigation Database Account Overview [Azure Metrics]", "type": "visualization", - "version": "7.6.0" + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Database Account Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-b232c220-8481-11ea-b181-4b1a9e0110f9", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-4177aab0-83cc-11ea-be84-f5d4d6b9a792", - "name": "fe2125b1-526c-4293-b488-86d8c15ea3fb:panel_fe2125b1-526c-4293-b488-86d8c15ea3fb", - "type": "visualization" + "id": "metrics-*", + "name": "db895503-5a84-4b26-b889-c3c7ca964643:indexpattern-datasource-layer-2ea02a2a-cdd3-40ba-97da-5b9d05e8c045", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0b986285-a5d0-4a31-bdb8-0f29cd50c2eb:indexpattern-datasource-layer-4fccce2f-367f-4ed1-8b1d-95e99a644bf6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f6ce8b48-a876-4031-a43f-3ca3704a4ad6:indexpattern-datasource-layer-ce857b4e-c1a6-426a-922a-74414174f31c", + "type": "index-pattern" }, { - "id": "azure_metrics-a49b4e20-8490-11ea-b181-4b1a9e0110f9", - "name": "db895503-5a84-4b26-b889-c3c7ca964643:panel_db895503-5a84-4b26-b889-c3c7ca964643", - "type": "visualization" + "id": "metrics-*", + "name": "c604014a-647f-4a1d-b2e9-0304fdacc363:indexpattern-datasource-layer-29755bf1-08a6-4d0a-91be-45e89f7acf6c", + "type": "index-pattern" }, { - "id": "azure_metrics-d2801d70-8490-11ea-b181-4b1a9e0110f9", - "name": "0b986285-a5d0-4a31-bdb8-0f29cd50c2eb:panel_0b986285-a5d0-4a31-bdb8-0f29cd50c2eb", - "type": "visualization" + "id": "metrics-*", + "name": "b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9:indexpattern-datasource-layer-836ebce7-0f89-405a-a22b-87640aefc7a7", + "type": "index-pattern" }, { - "id": "azure_metrics-674c1d70-83cc-11ea-be84-f5d4d6b9a792", - "name": "7d7b71ea-eb6b-43bf-be61-80235d1d4529:panel_7d7b71ea-eb6b-43bf-be61-80235d1d4529", - "type": "visualization" + "id": "metrics-*", + "name": "8686b8c9-df01-4872-8f72-001b39c0d824:indexpattern-datasource-layer-3450e519-734c-41f0-8359-ca2bdfa410d9", + "type": "index-pattern" }, { - "id": "azure_metrics-a16b5900-8492-11ea-b181-4b1a9e0110f9", - "name": "f6ce8b48-a876-4031-a43f-3ca3704a4ad6:panel_f6ce8b48-a876-4031-a43f-3ca3704a4ad6", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_5ded6e5e-32f8-491e-a515-5465e2549e82:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-d3ac7d90-8492-11ea-b181-4b1a9e0110f9", - "name": "c604014a-647f-4a1d-b2e9-0304fdacc363:panel_c604014a-647f-4a1d-b2e9-0304fdacc363", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_81c62f66-38e0-45a3-9b19-e380906868b3:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d11cc", - "name": "b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9:panel_b0cbeaf7-8a12-4efa-b63b-5479c2cb39a9", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_7b24bd7b-62d4-41d1-8b73-a0cadf1977b4:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-037382e0-856e-11ea-91bc-ab084c7ec0e7", - "name": "5e755432-3e55-405c-91cf-3348d5067a3a:panel_5e755432-3e55-405c-91cf-3348d5067a3a", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_5966e687-c394-49b7-9425-6b78bdd42278:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca.json index c051ac8175a..faf367b1ce7 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"a3cac948-1725-4a9c-a58f-b0abf3c4f3eb\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"id\":\"a3cac948-1725-4a9c-a58f-b0abf3c4f3eb\",\"enhancements\":{}}},\"f29b5d93-bc00-4d20-9e72-9aa80d5dcbbe\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"f29b5d93-bc00-4d20-9e72-9aa80d5dcbbe\",\"enhancements\":{}}},\"0eb8103d-8425-410f-afa5-6c686749b5b9\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"VM Name\",\"id\":\"0eb8103d-8425-410f-afa5-6c686749b5b9\",\"enhancements\":{}}}}" + }, "description": "Guest Memory Metrics \u0026 Process Compute VM", "hits": 0, "kibanaSavedObjectMeta": { @@ -20,243 +26,1390 @@ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Guest Metrics for Windows VM's\n\n[Back to Overview](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [**Memory \u0026 Process**](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [ASP.NET and SQL Server](#/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5) ", + "openLinksInNewTab": false + }, + "title": "Navigation Compute VM Memory \u0026 Process Metrics [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 7, "i": "6df47ee8-074f-441f-9d2d-f423f0eccf30", - "w": 13, + "w": 26, "x": 0, "y": 0 }, "panelIndex": "6df47ee8-074f-441f-9d2d-f423f0eccf30", - "panelRefName": "panel_6df47ee8-074f-441f-9d2d-f423f0eccf30", "title": "Navigation Guest Metrics", "type": "visualization", - "version": "7.14.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 7, - "i": "03e2eaef-c73b-42d6-9e37-0c0eb13e1617", - "w": 13, - "x": 13, - "y": 0 - }, - "panelIndex": "03e2eaef-c73b-42d6-9e37-0c0eb13e1617", - "panelRefName": "panel_03e2eaef-c73b-42d6-9e37-0c0eb13e1617", - "title": "Filters", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-938e962f-006c-4f82-81e5-f3cf38e3ff3b", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "23eeae24-a238-4cfc-8673-69f05420ac16": { + "columnOrder": [ + "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "columns": { + "02e01509-6981-4f1d-ba33-18e4336f61c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Network interface received bytes/sec", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1, + "suffix": "/s" + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.network_interface_bytes_received_per_sec.avg" + }, + "8e27eec1-e8f7-464b-b441-080b1d162bb0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + }, + "938e962f-006c-4f82-81e5-f3cf38e3ff3b": { + "columnOrder": [ + "06e98232-adb4-4c42-8ba0-67e26aeacb13", + "b2b5e381-a999-4fb7-af4e-97f9ba3cb7f4", + "3b7b092f-815d-48fc-a24a-0bf922122064" + ], + "columns": { + "06e98232-adb4-4c42-8ba0-67e26aeacb13": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "3b7b092f-815d-48fc-a24a-0bf922122064": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Network interface sent bytes/sec", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.network_interface_bytes_sent_per_sec.avg" + }, + "b2b5e381-a999-4fb7-af4e-97f9ba3cb7f4": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "layerId": "23eeae24-a238-4cfc-8673-69f05420ac16", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "xAccessor": "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "02e01509-6981-4f1d-ba33-18e4336f61c1" + } + ] + }, + { + "accessors": [ + "3b7b092f-815d-48fc-a24a-0bf922122064" + ], + "layerId": "938e962f-006c-4f82-81e5-f3cf38e3ff3b", + "layerType": "data", + "seriesType": "area", + "splitAccessor": "b2b5e381-a999-4fb7-af4e-97f9ba3cb7f4", + "xAccessor": "06e98232-adb4-4c42-8ba0-67e26aeacb13", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "3b7b092f-815d-48fc-a24a-0bf922122064" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 18, - "i": "d92cc81b-bd94-4502-aa37-de44f2cada39", + "i": "7e138e70-820d-42ad-9e0d-8e6a3e136f54", "w": 22, "x": 26, "y": 0 }, - "panelIndex": "d92cc81b-bd94-4502-aa37-de44f2cada39", - "panelRefName": "panel_d92cc81b-bd94-4502-aa37-de44f2cada39", + "panelIndex": "7e138e70-820d-42ad-9e0d-8e6a3e136f54", "title": "Network interface sent/received bytes/sec", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "23eeae24-a238-4cfc-8673-69f05420ac16": { + "columnOrder": [ + "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "columns": { + "02e01509-6981-4f1d-ba33-18e4336f61c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Process Working Set Private", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.process_working_set_private.avg" + }, + "8e27eec1-e8f7-464b-b441-080b1d162bb0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "layerId": "23eeae24-a238-4cfc-8673-69f05420ac16", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "xAccessor": "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "02e01509-6981-4f1d-ba33-18e4336f61c1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "8d1c9102-89da-4af1-a139-0e0433778f3f", + "i": "99c2cd2e-18a5-41eb-a725-cb1f998843b3", "w": 26, "x": 0, "y": 7 }, - "panelIndex": "8d1c9102-89da-4af1-a139-0e0433778f3f", - "panelRefName": "panel_8d1c9102-89da-4af1-a139-0e0433778f3f", + "panelIndex": "99c2cd2e-18a5-41eb-a725-cb1f998843b3", "title": "Process Working Set Private", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e7bf0a20-33a2-4378-98f2-d99de0c55911": { + "columnOrder": [ + "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "columns": { + "0cd867ab-5d0e-401c-bf57-710ce6e54afc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Handle Count Average", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.process_handle_count.avg" + }, + "e06d815f-cd9a-4ac6-b791-5f5698314b4d": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "layerId": "e7bf0a20-33a2-4378-98f2-d99de0c55911", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "yConfig": [ + { + "axisMode": "auto", + "color": "#d36086", + "forAccessor": "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "title": "Empty XY chart", + "valueLabels": "show", + "xTitle": "", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "2393ec57-d9de-4f90-a628-fd1fceb39942", + "i": "ca6f4ef8-7e5c-4630-a590-18ce33a78a3d", "w": 11, "x": 26, "y": 18 }, - "panelIndex": "2393ec57-d9de-4f90-a628-fd1fceb39942", - "panelRefName": "panel_2393ec57-d9de-4f90-a628-fd1fceb39942", + "panelIndex": "ca6f4ef8-7e5c-4630-a590-18ce33a78a3d", "title": "Handle Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e7bf0a20-33a2-4378-98f2-d99de0c55911": { + "columnOrder": [ + "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "columns": { + "0cd867ab-5d0e-401c-bf57-710ce6e54afc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Thread Count Average", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.process_thread_count.avg" + }, + "e06d815f-cd9a-4ac6-b791-5f5698314b4d": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "layerId": "e7bf0a20-33a2-4378-98f2-d99de0c55911", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "yConfig": [ + { + "axisMode": "auto", + "color": "#da8b45", + "forAccessor": "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "title": "Empty XY chart", + "valueLabels": "show", + "xTitle": "", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "78f90428-8dff-489c-a916-d8fba60b958f", + "i": "af9b103b-35e9-45c0-9b3b-08dc9bacf330", "w": 11, "x": 37, "y": 18 }, - "panelIndex": "78f90428-8dff-489c-a916-d8fba60b958f", - "panelRefName": "panel_78f90428-8dff-489c-a916-d8fba60b958f", + "panelIndex": "af9b103b-35e9-45c0-9b3b-08dc9bacf330", "title": "Thread Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "23eeae24-a238-4cfc-8673-69f05420ac16": { + "columnOrder": [ + "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "columns": { + "02e01509-6981-4f1d-ba33-18e4336f61c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory committed bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.memory_committed_bytes.avg" + }, + "8e27eec1-e8f7-464b-b441-080b1d162bb0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "layerId": "23eeae24-a238-4cfc-8673-69f05420ac16", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "xAccessor": "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "02e01509-6981-4f1d-ba33-18e4336f61c1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "bd8c4170-3a70-4617-ac8d-61473df84c94", + "i": "2ea4838a-ea4f-4c11-945a-16d86c7d0877", "w": 26, "x": 0, "y": 22 }, - "panelIndex": "bd8c4170-3a70-4617-ac8d-61473df84c94", - "panelRefName": "panel_bd8c4170-3a70-4617-ac8d-61473df84c94", + "panelIndex": "2ea4838a-ea4f-4c11-945a-16d86c7d0877", "title": "Memory Committed Bytes", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e7bf0a20-33a2-4378-98f2-d99de0c55911": { + "columnOrder": [ + "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "columns": { + "0cd867ab-5d0e-401c-bf57-710ce6e54afc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Process Count Average", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.system_processes.avg" + }, + "e06d815f-cd9a-4ac6-b791-5f5698314b4d": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + ], + "layerId": "e7bf0a20-33a2-4378-98f2-d99de0c55911", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "e06d815f-cd9a-4ac6-b791-5f5698314b4d", + "yConfig": [ + { + "axisMode": "auto", + "color": "#ca8eae", + "forAccessor": "0cd867ab-5d0e-401c-bf57-710ce6e54afc" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "title": "Empty XY chart", + "valueLabels": "show", + "xTitle": "", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 8, - "i": "b46e124f-7836-4b99-9bf0-1884ae65dc39", + "i": "3f1f707c-36f7-4918-814a-474eda5e497a", "w": 22, "x": 26, "y": 29 }, - "panelIndex": "b46e124f-7836-4b99-9bf0-1884ae65dc39", - "panelRefName": "panel_b46e124f-7836-4b99-9bf0-1884ae65dc39", + "panelIndex": "3f1f707c-36f7-4918-814a-474eda5e497a", "title": "Process Count", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "23eeae24-a238-4cfc-8673-69f05420ac16": { + "columnOrder": [ + "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "columns": { + "02e01509-6981-4f1d-ba33-18e4336f61c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Process Working Set", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.process_working_set.avg" + }, + "8e27eec1-e8f7-464b-b441-080b1d162bb0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "layerId": "23eeae24-a238-4cfc-8673-69f05420ac16", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "xAccessor": "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "02e01509-6981-4f1d-ba33-18e4336f61c1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "4d5cd3af-24ff-4cd0-80ad-a4c7efb712b5", + "i": "eaa72995-e8f3-48b6-9d5e-dae6e829eb43", "w": 24, "x": 0, "y": 37 }, - "panelIndex": "4d5cd3af-24ff-4cd0-80ad-a4c7efb712b5", - "panelRefName": "panel_4d5cd3af-24ff-4cd0-80ad-a4c7efb712b5", + "panelIndex": "eaa72995-e8f3-48b6-9d5e-dae6e829eb43", "title": "Process Working Set", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "23eeae24-a238-4cfc-8673-69f05420ac16": { + "columnOrder": [ + "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "columns": { + "02e01509-6981-4f1d-ba33-18e4336f61c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Available memory", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.memory_available_bytes.avg" + }, + "8e27eec1-e8f7-464b-b441-080b1d162bb0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9ea462e9-3bbe-47f9-9b14-bfaf4e632200": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "02e01509-6981-4f1d-ba33-18e4336f61c1" + ], + "layerId": "23eeae24-a238-4cfc-8673-69f05420ac16", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "9ea462e9-3bbe-47f9-9b14-bfaf4e632200", + "xAccessor": "8e27eec1-e8f7-464b-b441-080b1d162bb0", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "02e01509-6981-4f1d-ba33-18e4336f61c1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "ef7d4ded-899b-4aef-827f-b0f960337479", + "i": "dc3f7246-f3f7-4b77-9ee8-0308e1a8c4e4", "w": 24, "x": 24, "y": 37 }, - "panelIndex": "ef7d4ded-899b-4aef-827f-b0f960337479", - "panelRefName": "panel_ef7d4ded-899b-4aef-827f-b0f960337479", + "panelIndex": "dc3f7246-f3f7-4b77-9ee8-0308e1a8c4e4", "title": "Available Memory", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Compute VM Guest Memory \u0026 Process Metrics Compute VM", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-94be5bc0-feae-11eb-8fff-87871c582eca", - "name": "6df47ee8-074f-441f-9d2d-f423f0eccf30:panel_6df47ee8-074f-441f-9d2d-f423f0eccf30", - "type": "visualization" + "id": "metrics-*", + "name": "7e138e70-820d-42ad-9e0d-8e6a3e136f54:indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7e138e70-820d-42ad-9e0d-8e6a3e136f54:indexpattern-datasource-layer-938e962f-006c-4f82-81e5-f3cf38e3ff3b", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "99c2cd2e-18a5-41eb-a725-cb1f998843b3:indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" }, { - "id": "azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5", - "name": "03e2eaef-c73b-42d6-9e37-0c0eb13e1617:panel_03e2eaef-c73b-42d6-9e37-0c0eb13e1617", - "type": "visualization" + "id": "metrics-*", + "name": "ca6f4ef8-7e5c-4630-a590-18ce33a78a3d:indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" }, { - "id": "azure_metrics-46ccce70-ff61-11eb-af1d-2505733a31f2", - "name": "d92cc81b-bd94-4502-aa37-de44f2cada39:panel_d92cc81b-bd94-4502-aa37-de44f2cada39", - "type": "visualization" + "id": "metrics-*", + "name": "af9b103b-35e9-45c0-9b3b-08dc9bacf330:indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" }, { - "id": "azure_metrics-707d2660-ff62-11eb-af1d-2505733a31f2", - "name": "8d1c9102-89da-4af1-a139-0e0433778f3f:panel_8d1c9102-89da-4af1-a139-0e0433778f3f", - "type": "visualization" + "id": "metrics-*", + "name": "2ea4838a-ea4f-4c11-945a-16d86c7d0877:indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" }, { - "id": "azure_metrics-4c2cb860-ff5e-11eb-af1d-2505733a31f2", - "name": "2393ec57-d9de-4f90-a628-fd1fceb39942:panel_2393ec57-d9de-4f90-a628-fd1fceb39942", - "type": "visualization" + "id": "metrics-*", + "name": "3f1f707c-36f7-4918-814a-474eda5e497a:indexpattern-datasource-layer-e7bf0a20-33a2-4378-98f2-d99de0c55911", + "type": "index-pattern" }, { - "id": "azure_metrics-044b8940-ff5e-11eb-af1d-2505733a31f2", - "name": "78f90428-8dff-489c-a916-d8fba60b958f:panel_78f90428-8dff-489c-a916-d8fba60b958f", - "type": "visualization" + "id": "metrics-*", + "name": "eaa72995-e8f3-48b6-9d5e-dae6e829eb43:indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" }, { - "id": "azure_metrics-1e9d1bb0-ff63-11eb-af1d-2505733a31f2", - "name": "bd8c4170-3a70-4617-ac8d-61473df84c94:panel_bd8c4170-3a70-4617-ac8d-61473df84c94", - "type": "visualization" + "id": "metrics-*", + "name": "dc3f7246-f3f7-4b77-9ee8-0308e1a8c4e4:indexpattern-datasource-layer-23eeae24-a238-4cfc-8673-69f05420ac16", + "type": "index-pattern" }, { - "id": "azure_metrics-c8a33540-ff5e-11eb-af1d-2505733a31f2", - "name": "b46e124f-7836-4b99-9bf0-1884ae65dc39:panel_b46e124f-7836-4b99-9bf0-1884ae65dc39", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_a3cac948-1725-4a9c-a58f-b0abf3c4f3eb:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-1a61d870-ff62-11eb-af1d-2505733a31f2", - "name": "4d5cd3af-24ff-4cd0-80ad-a4c7efb712b5:panel_4d5cd3af-24ff-4cd0-80ad-a4c7efb712b5", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_f29b5d93-bc00-4d20-9e72-9aa80d5dcbbe:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-46dd8ff0-ff64-11eb-af1d-2505733a31f2", - "name": "ef7d4ded-899b-4aef-827f-b0f960337479:panel_ef7d4ded-899b-4aef-827f-b0f960337479", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_0eb8103d-8425-410f-afa5-6c686749b5b9:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca.json index 17a458ef704..4b23fd98980 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"8a580292-80b5-46b0-bee4-d8780a00cbc2\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"id\":\"8a580292-80b5-46b0-bee4-d8780a00cbc2\",\"enhancements\":{}}},\"deeb5974-3f32-4cd6-933b-283f1a5da384\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"deeb5974-3f32-4cd6-933b-283f1a5da384\",\"enhancements\":{}}},\"8ccf77b5-f2ad-4a11-8419-4d1a8fb15ea4\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"VM Name\",\"id\":\"8ccf77b5-f2ad-4a11-8419-4d1a8fb15ea4\",\"enhancements\":{}}}}" + }, "description": " Guest Linux Metrics Overview", "hits": 0, "kibanaSavedObjectMeta": { @@ -20,266 +26,1541 @@ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Compute VM \n\n[Back to Overview](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [**Guest Linux VM Metrics**](#/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca) ", + "openLinksInNewTab": false + }, + "title": "Navigation Guest Linux Metrics Compute VM [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 9, "i": "df6397e0-3fed-4c5f-9841-3b7f89c7e41b", - "w": 7, + "w": 24, "x": 0, "y": 0 }, "panelIndex": "df6397e0-3fed-4c5f-9841-3b7f89c7e41b", - "panelRefName": "panel_df6397e0-3fed-4c5f-9841-3b7f89c7e41b", "title": "Navigation Guest Linux Metrics ", "type": "visualization", - "version": "7.14.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 9, - "i": "b7571f38-4a0f-411c-b84c-746669df468d", - "w": 17, - "x": 7, - "y": 0 - }, - "panelIndex": "b7571f38-4a0f-411c-b84c-746669df468d", - "panelRefName": "panel_b7571f38-4a0f-411c-b84c-746669df468d", - "title": "Filters", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-760bd9e2-c8ad-45ff-a3c9-dcd978a4ad81", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "760bd9e2-c8ad-45ff-a3c9-dcd978a4ad81": { + "columnOrder": [ + "b0a97ff6-213d-431b-9a71-030ef6f96ea5", + "af164723-c93c-481b-a345-eabc03fba644", + "169deb7e-b008-4af6-9b8e-9f9dda9c5c50" + ], + "columns": { + "169deb7e-b008-4af6-9b8e-9f9dda9c5c50": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "net/bytes received", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.net_per_bytes_recv.avg" + }, + "af164723-c93c-481b-a345-eabc03fba644": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0a97ff6-213d-431b-9a71-030ef6f96ea5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + }, + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "net/bytes sent", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.net_per_bytes_sent.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + }, + { + "accessors": [ + "169deb7e-b008-4af6-9b8e-9f9dda9c5c50" + ], + "layerId": "760bd9e2-c8ad-45ff-a3c9-dcd978a4ad81", + "layerType": "data", + "seriesType": "area", + "splitAccessor": "b0a97ff6-213d-431b-9a71-030ef6f96ea5", + "xAccessor": "af164723-c93c-481b-a345-eabc03fba644", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "169deb7e-b008-4af6-9b8e-9f9dda9c5c50" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "b82d81ce-f973-4c4a-b5a6-9a99b1f10a08", + "i": "2c6f3f4a-ff97-47e3-8eff-13376a4efeed", "w": 24, "x": 24, "y": 0 }, - "panelIndex": "b82d81ce-f973-4c4a-b5a6-9a99b1f10a08", - "panelRefName": "panel_b82d81ce-f973-4c4a-b5a6-9a99b1f10a08", + "panelIndex": "2c6f3f4a-ff97-47e3-8eff-13376a4efeed", "title": " net/bytes sent/recv", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU Usage Active", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.cpu_per_usage_active.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 13, - "i": "58f59040-938e-4b40-a8a6-a2c33caf037d", + "i": "59dd4415-6d20-4005-86a6-a841f0f82b18", "w": 24, "x": 0, "y": 9 }, - "panelIndex": "58f59040-938e-4b40-a8a6-a2c33caf037d", - "panelRefName": "panel_58f59040-938e-4b40-a8a6-a2c33caf037d", + "panelIndex": "59dd4415-6d20-4005-86a6-a841f0f82b18", "title": "CPU Usage Active", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU Usage Idle", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.cpu_per_usage_idle.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 13, - "i": "8a4be2ce-48e1-4de5-b9b5-5799375e8603", + "i": "6576350e-67e7-4d69-b1ab-bf567bf902f6", "w": 24, "x": 24, "y": 9 }, - "panelIndex": "8a4be2ce-48e1-4de5-b9b5-5799375e8603", - "panelRefName": "panel_8a4be2ce-48e1-4de5-b9b5-5799375e8603", + "panelIndex": "6576350e-67e7-4d69-b1ab-bf567bf902f6", "title": "CPU Usage Idle", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory available", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.mem_per_available.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 13, - "i": "7065ba6b-f72d-4099-93ba-7e79aab75ef8", + "h": 14, + "i": "41d0e8ec-d75e-4df4-83a7-e7902c2474b3", "w": 24, "x": 0, "y": 22 }, - "panelIndex": "7065ba6b-f72d-4099-93ba-7e79aab75ef8", - "panelRefName": "panel_7065ba6b-f72d-4099-93ba-7e79aab75ef8", + "panelIndex": "41d0e8ec-d75e-4df4-83a7-e7902c2474b3", "title": "Memory Available", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory used", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.mem_per_used.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 13, - "i": "bf1ba548-d4c6-4ab2-8857-ae4b4dd256d8", + "h": 14, + "i": "91d87470-2a44-4974-a333-92b59602b35e", "w": 24, "x": 24, "y": 22 }, - "panelIndex": "bf1ba548-d4c6-4ab2-8857-ae4b4dd256d8", - "panelRefName": "panel_bf1ba548-d4c6-4ab2-8857-ae4b4dd256d8", + "panelIndex": "91d87470-2a44-4974-a333-92b59602b35e", "title": "Memory Used", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Swap used", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.swap_per_used.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 14, - "i": "1cdd4ae6-10bf-4714-adf6-bf2447e4f5fd", + "i": "113b78ed-2dd8-4864-a0e3-21109cd64b8a", "w": 24, "x": 0, - "y": 35 + "y": 36 }, - "panelIndex": "1cdd4ae6-10bf-4714-adf6-bf2447e4f5fd", - "panelRefName": "panel_1cdd4ae6-10bf-4714-adf6-bf2447e4f5fd", + "panelIndex": "113b78ed-2dd8-4864-a0e3-21109cd64b8a", "title": "Swap Used", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory used", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.swap_per_free.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 14, - "i": "f75069c9-88e3-4bba-92e8-8ad443f2ccb4", + "i": "5b49fc1b-be9f-4b2a-8692-d5e73654dad3", "w": 24, "x": 24, - "y": 35 + "y": 36 }, - "panelIndex": "f75069c9-88e3-4bba-92e8-8ad443f2ccb4", - "panelRefName": "panel_f75069c9-88e3-4bba-92e8-8ad443f2ccb4", + "panelIndex": "5b49fc1b-be9f-4b2a-8692-d5e73654dad3", "title": "Swap Free", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Diskio Read bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.diskio_per_read_bytes.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 14, - "i": "36841927-78f4-406a-b56c-9f05ccfa3bf9", + "i": "269b6858-7076-45f6-aba8-f3ac92fa9fad", "w": 24, "x": 0, - "y": 49 + "y": 50 }, - "panelIndex": "36841927-78f4-406a-b56c-9f05ccfa3bf9", - "panelRefName": "panel_36841927-78f4-406a-b56c-9f05ccfa3bf9", + "panelIndex": "269b6858-7076-45f6-aba8-f3ac92fa9fad", "title": "Diskio Read Bytes", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b032bfa9-557c-4826-9c6f-65fd8c1adbca": { + "columnOrder": [ + "f3051120-8461-4c10-9462-9bfd410a9305", + "26f75266-751c-4401-8cbd-262c135184b5", + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "columns": { + "0a3ecf93-a404-48af-bb7c-701ec62b69b6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Memory used", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.diskio_per_write_bytes.avg" + }, + "26f75266-751c-4401-8cbd-262c135184b5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f3051120-8461-4c10-9462-9bfd410a9305": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + ], + "layerId": "b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "f3051120-8461-4c10-9462-9bfd410a9305", + "xAccessor": "26f75266-751c-4401-8cbd-262c135184b5", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "0a3ecf93-a404-48af-bb7c-701ec62b69b6" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 14, - "i": "161249d0-506f-4bc1-a351-eacde8bd7fec", + "i": "dfb7c4a7-8fb0-4eaf-aaa2-12235ee79282", "w": 24, "x": 24, - "y": 49 + "y": 50 }, - "panelIndex": "161249d0-506f-4bc1-a351-eacde8bd7fec", - "panelRefName": "panel_161249d0-506f-4bc1-a351-eacde8bd7fec", + "panelIndex": "dfb7c4a7-8fb0-4eaf-aaa2-12235ee79282", "title": "Diskio Write Bytes", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Compute VM Guest Linux Metrics Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-bcb236a0-feaf-11eb-8fff-87871c582eca", - "name": "df6397e0-3fed-4c5f-9841-3b7f89c7e41b:panel_df6397e0-3fed-4c5f-9841-3b7f89c7e41b", - "type": "visualization" + "id": "metrics-*", + "name": "2c6f3f4a-ff97-47e3-8eff-13376a4efeed:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2c6f3f4a-ff97-47e3-8eff-13376a4efeed:indexpattern-datasource-layer-760bd9e2-c8ad-45ff-a3c9-dcd978a4ad81", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "59dd4415-6d20-4005-86a6-a841f0f82b18:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5", - "name": "b7571f38-4a0f-411c-b84c-746669df468d:panel_b7571f38-4a0f-411c-b84c-746669df468d", - "type": "visualization" + "id": "metrics-*", + "name": "6576350e-67e7-4d69-b1ab-bf567bf902f6:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-b5aad170-ff66-11eb-af1d-2505733a31f2", - "name": "b82d81ce-f973-4c4a-b5a6-9a99b1f10a08:panel_b82d81ce-f973-4c4a-b5a6-9a99b1f10a08", - "type": "visualization" + "id": "metrics-*", + "name": "41d0e8ec-d75e-4df4-83a7-e7902c2474b3:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-45344560-ff67-11eb-af1d-2505733a31f2", - "name": "58f59040-938e-4b40-a8a6-a2c33caf037d:panel_58f59040-938e-4b40-a8a6-a2c33caf037d", - "type": "visualization" + "id": "metrics-*", + "name": "91d87470-2a44-4974-a333-92b59602b35e:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-7ddc8350-ff67-11eb-af1d-2505733a31f2", - "name": "8a4be2ce-48e1-4de5-b9b5-5799375e8603:panel_8a4be2ce-48e1-4de5-b9b5-5799375e8603", - "type": "visualization" + "id": "metrics-*", + "name": "113b78ed-2dd8-4864-a0e3-21109cd64b8a:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-0d24a880-ff68-11eb-af1d-2505733a31f2", - "name": "7065ba6b-f72d-4099-93ba-7e79aab75ef8:panel_7065ba6b-f72d-4099-93ba-7e79aab75ef8", - "type": "visualization" + "id": "metrics-*", + "name": "5b49fc1b-be9f-4b2a-8692-d5e73654dad3:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-58baa240-ff68-11eb-af1d-2505733a31f2", - "name": "bf1ba548-d4c6-4ab2-8857-ae4b4dd256d8:panel_bf1ba548-d4c6-4ab2-8857-ae4b4dd256d8", - "type": "visualization" + "id": "metrics-*", + "name": "269b6858-7076-45f6-aba8-f3ac92fa9fad:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-160e5bd0-ff6d-11eb-af1d-2505733a31f2", - "name": "1cdd4ae6-10bf-4714-adf6-bf2447e4f5fd:panel_1cdd4ae6-10bf-4714-adf6-bf2447e4f5fd", - "type": "visualization" + "id": "metrics-*", + "name": "dfb7c4a7-8fb0-4eaf-aaa2-12235ee79282:indexpattern-datasource-layer-b032bfa9-557c-4826-9c6f-65fd8c1adbca", + "type": "index-pattern" }, { - "id": "azure_metrics-59b69c30-ff6d-11eb-af1d-2505733a31f2", - "name": "f75069c9-88e3-4bba-92e8-8ad443f2ccb4:panel_f75069c9-88e3-4bba-92e8-8ad443f2ccb4", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_8a580292-80b5-46b0-bee4-d8780a00cbc2:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-f4367270-ff69-11eb-af1d-2505733a31f2", - "name": "36841927-78f4-406a-b56c-9f05ccfa3bf9:panel_36841927-78f4-406a-b56c-9f05ccfa3bf9", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_deeb5974-3f32-4cd6-933b-283f1a5da384:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-4fa6b100-ff6b-11eb-af1d-2505733a31f2", - "name": "161249d0-506f-4bc1-a351-eacde8bd7fec:panel_161249d0-506f-4bc1-a351-eacde8bd7fec", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_8ccf77b5-f2ad-4a11-8419-4d1a8fb15ea4:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38.json index a69b1e0e5f6..835183c17ea 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"86dd2752-09d1-4688-879b-80a081fcaf17\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"id\":\"86dd2752-09d1-4688-879b-80a081fcaf17\",\"enhancements\":{}}},\"b38c448d-a50d-4298-a673-bbf7aff4e948\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"singleSelect\":true,\"id\":\"b38c448d-a50d-4298-a673-bbf7aff4e948\",\"enhancements\":{}}},\"5f67629e-dd36-4154-8a6f-003df1c08474\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"Resource\",\"singleSelect\":true,\"id\":\"5f67629e-dd36-4154-8a6f-003df1c08474\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for the container service in Azure.", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,167 +24,1032 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": {} + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Containers\n\n[Instances](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[Registries](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[**Services**](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", + "openLinksInNewTab": false + }, + "title": "Navigation Container Service Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "32b4e6e2-bf3f-4c4a-8fdb-925f21f9d22b", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "32b4e6e2-bf3f-4c4a-8fdb-925f21f9d22b", - "panelRefName": "panel_32b4e6e2-bf3f-4c4a-8fdb-925f21f9d22b", "type": "visualization", - "version": "7.6.0" + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-69bd04bd-3fd9-4664-a868-60a064a5cb5a", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "69bd04bd-3fd9-4664-a868-60a064a5cb5a": { + "columnOrder": [ + "52fad886-ec57-45a0-a2c7-576392f1c640", + "b62a95f0-ba65-41cb-95d7-aff57217a255", + "d7d96aa2-65e3-445a-b385-0d2135148245" + ], + "columns": { + "52fad886-ec57-45a0-a2c7-576392f1c640": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b62a95f0-ba65-41cb-95d7-aff57217a255": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "d7d96aa2-65e3-445a-b385-0d2135148245": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Service Kube Node Status Allocatable Memory Bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.container_service.kube_node_status_allocatable_memory_bytes.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d7d96aa2-65e3-445a-b385-0d2135148245" + ], + "layerId": "69bd04bd-3fd9-4664-a868-60a064a5cb5a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "b62a95f0-ba65-41cb-95d7-aff57217a255", + "xAccessor": "52fad886-ec57-45a0-a2c7-576392f1c640", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "d7d96aa2-65e3-445a-b385-0d2135148245" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, "i": "c35d3d89-2f34-43a0-b346-85ba0e7c9e89", - "w": 18, - "x": 9, - "y": 0 + "w": 24, + "x": 0, + "y": 5 }, "panelIndex": "c35d3d89-2f34-43a0-b346-85ba0e7c9e89", - "panelRefName": "panel_c35d3d89-2f34-43a0-b346-85ba0e7c9e89", "title": "Container Service Kube Node Status Allocatable Memory", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7f40a742-367e-4df3-8d53-a2f2c9324c3e", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7f40a742-367e-4df3-8d53-a2f2c9324c3e": { + "columnOrder": [ + "3848dabd-d669-470c-b379-57e0788b63ad", + "40cf282e-df15-4273-9455-4e5cf822f493", + "4685825e-fd59-46d0-bd52-d8d1fe94a9b9" + ], + "columns": { + "3848dabd-d669-470c-b379-57e0788b63ad": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "40cf282e-df15-4273-9455-4e5cf822f493": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4685825e-fd59-46d0-bd52-d8d1fe94a9b9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Service Kube Node Status Allocatable CPU Cores", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_service.kube_node_status_allocatable_cpu_cores.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "4685825e-fd59-46d0-bd52-d8d1fe94a9b9" + ], + "layerId": "7f40a742-367e-4df3-8d53-a2f2c9324c3e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "3848dabd-d669-470c-b379-57e0788b63ad", + "xAccessor": "40cf282e-df15-4273-9455-4e5cf822f493", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(196,81,0,1)", + "forAccessor": "4685825e-fd59-46d0-bd52-d8d1fe94a9b9" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, "i": "e1952edf-ed31-49ee-8db1-24370998ab89", - "w": 21, - "x": 27, - "y": 0 + "w": 24, + "x": 24, + "y": 5 }, "panelIndex": "e1952edf-ed31-49ee-8db1-24370998ab89", - "panelRefName": "panel_e1952edf-ed31-49ee-8db1-24370998ab89", "title": "Container Service Kube Node Status Allocatable CPU Cores", - "type": "visualization", - "version": "7.6.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 12, - "i": "ec183a66-545b-4a67-bfb4-568def660612", - "w": 9, - "x": 0, - "y": 5 - }, - "panelIndex": "ec183a66-545b-4a67-bfb4-568def660612", - "panelRefName": "panel_ec183a66-545b-4a67-bfb4-568def660612", - "title": "Container Filters", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-8268302f-e1ba-4e07-ab78-4b566a7e2f70", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "8268302f-e1ba-4e07-ab78-4b566a7e2f70": { + "columnOrder": [ + "3807ea54-febf-4899-b59e-a6ae10ec8216", + "ccbbed49-224f-472f-a4f5-2ab5ca2137d6", + "a8f5ceb6-831c-4e7d-b266-6ab77c27d1bd" + ], + "columns": { + "3807ea54-febf-4899-b59e-a6ae10ec8216": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.pod", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.pod" + }, + "a8f5ceb6-831c-4e7d-b266-6ab77c27d1bd": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Container Service Kube Pod Status Phase", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_service.kube_pod_status_phase.avg" + }, + "ccbbed49-224f-472f-a4f5-2ab5ca2137d6": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a8f5ceb6-831c-4e7d-b266-6ab77c27d1bd" + ], + "layerId": "8268302f-e1ba-4e07-ab78-4b566a7e2f70", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "3807ea54-febf-4899-b59e-a6ae10ec8216", + "xAccessor": "ccbbed49-224f-472f-a4f5-2ab5ca2137d6", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(240,213,175,1)", + "forAccessor": "a8f5ceb6-831c-4e7d-b266-6ab77c27d1bd" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "ada37452-619f-470a-b9cd-bafa20e7d7b1", "w": 24, "x": 0, - "y": 17 + "y": 22 }, "panelIndex": "ada37452-619f-470a-b9cd-bafa20e7d7b1", - "panelRefName": "panel_ada37452-619f-470a-b9cd-bafa20e7d7b1", "title": "Container Service Kube Pod Status Phase", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-d9594890-7ab7-4d9a-8234-e2c8f1655947", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "d9594890-7ab7-4d9a-8234-e2c8f1655947": { + "columnOrder": [ + "e8cf1299-021f-40df-a995-3115fa9e5514", + "e38b53cb-2c25-4be2-af24-0d47927066a6", + "ffd873dd-2003-48c6-9be7-156f497496f9" + ], + "columns": { + "e38b53cb-2c25-4be2-af24-0d47927066a6": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e8cf1299-021f-40df-a995-3115fa9e5514": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.pod", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.pod" + }, + "ffd873dd-2003-48c6-9be7-156f497496f9": { + "dataType": "number", + "isBucketed": false, + "label": "Average of azure.container_service.kube_pod_status_ready.avg", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_service.kube_pod_status_ready.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ffd873dd-2003-48c6-9be7-156f497496f9" + ], + "layerId": "d9594890-7ab7-4d9a-8234-e2c8f1655947", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "e8cf1299-021f-40df-a995-3115fa9e5514", + "xAccessor": "e38b53cb-2c25-4be2-af24-0d47927066a6", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(200,205,124,1)", + "forAccessor": "ffd873dd-2003-48c6-9be7-156f497496f9" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "c8d3ed1a-6e72-4115-9a69-db1919a36fc4", "w": 24, "x": 24, - "y": 17 + "y": 22 }, "panelIndex": "c8d3ed1a-6e72-4115-9a69-db1919a36fc4", - "panelRefName": "panel_c8d3ed1a-6e72-4115-9a69-db1919a36fc4", "title": "Container Service Kube Pod Status Ready", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-b6bbccbe-23e8-4204-b8b0-7e40c8363d6a", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b6bbccbe-23e8-4204-b8b0-7e40c8363d6a": { + "columnOrder": [ + "b39fcfe5-b01a-4a59-acf1-e9ddb85d7fb2", + "73ba5f61-46b6-470a-8917-c3e3aeeedf99", + "0d21fd08-6990-4730-8784-568f4a661b81" + ], + "columns": { + "0d21fd08-6990-4730-8784-568f4a661b81": { + "dataType": "number", + "isBucketed": false, + "label": "Average of azure.container_service.kube_node_status_condition.avg", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.container_service.kube_node_status_condition.avg" + }, + "73ba5f61-46b6-470a-8917-c3e3aeeedf99": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "azure.dimensions.node: Descending", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "0d21fd08-6990-4730-8784-568f4a661b81", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.node" + }, + "b39fcfe5-b01a-4a59-acf1-e9ddb85d7fb2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"Ready\" and azure.dimensions.status : \"true\" " + }, + "label": "Ready \"true\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"Ready\" and azure.dimensions.status : \"false\" " + }, + "label": "Ready \"false\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"NetworkUnavailable\" and azure.dimensions.status : \"true\" " + }, + "label": "Network Unavailable \"true\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"NetworkUnavailable\" and azure.dimensions.status : \"false\" " + }, + "label": "NetworkUnavailable \"false\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"OutOfDisk\" and azure.dimensions.status : \"false\" " + }, + "label": "OutOfDisk \"false\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"OutOfDisk\" and azure.dimensions.status : \"true\" " + }, + "label": "OutOfDisk \"true\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"MemoryPressure\" and azure.dimensions.status : \"true\" " + }, + "label": "MemoryPressure \"true\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"MemoryPressure\" and azure.dimensions.status : \"false\" " + }, + "label": "MemoryPressure \"false\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"DiskPressure\" and azure.dimensions.status : \"false\" " + }, + "label": "DiskPressure \"false\"" + }, + { + "input": { + "language": "kuery", + "query": "azure.dimensions.condition : \"DiskPressure\" and azure.dimensions.status : \"true\" " + }, + "label": "DiskPressure \"true\"" + } + ] + }, + "scale": "ordinal" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": false, + "type": "heatmap_grid", + "yTitle": "" + }, + "layerId": "b6bbccbe-23e8-4204-b8b0-7e40c8363d6a", + "layerType": "data", + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "0d21fd08-6990-4730-8784-568f4a661b81", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#A50026", + "stop": 0 + }, + { + "color": "#F36D43", + "stop": 20 + }, + { + "color": "#FEDF8B", + "stop": 40 + }, + { + "color": "#D8EF8C", + "stop": 60 + }, + { + "color": "#65BC62", + "stop": 80 + } + ], + "continuity": "none", + "name": "custom", + "rangeMax": 100, + "rangeMin": 0, + "steps": 5, + "stops": [ + { + "color": "#A50026", + "stop": 20 + }, + { + "color": "#F36D43", + "stop": 40 + }, + { + "color": "#FEDF8B", + "stop": 60 + }, + { + "color": "#D8EF8C", + "stop": 80 + }, + { + "color": "#65BC62", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "title": "Empty Heatmap chart", + "valueAccessor": "0d21fd08-6990-4730-8784-568f4a661b81", + "xAccessor": "b39fcfe5-b01a-4a59-acf1-e9ddb85d7fb2", + "yAccessor": "73ba5f61-46b6-470a-8917-c3e3aeeedf99" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "707fb714-99af-4484-a56e-bfecdf592c58", + "i": "02550033-51ea-4075-92ae-9ca33ea71e39", "w": 48, "x": 0, - "y": 32 + "y": 37 }, - "panelIndex": "707fb714-99af-4484-a56e-bfecdf592c58", - "panelRefName": "panel_707fb714-99af-4484-a56e-bfecdf592c58", + "panelIndex": "02550033-51ea-4075-92ae-9ca33ea71e39", "title": "Container Service Kube Node Status Condition", - "type": "visualization", - "version": "7.6.0" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Container Service Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-3630b9a0-6d22-11ea-8fe8-71add5fd7c38", - "name": "32b4e6e2-bf3f-4c4a-8fdb-925f21f9d22b:panel_32b4e6e2-bf3f-4c4a-8fdb-925f21f9d22b", - "type": "visualization" + "id": "metrics-*", + "name": "c35d3d89-2f34-43a0-b346-85ba0e7c9e89:indexpattern-datasource-layer-69bd04bd-3fd9-4664-a868-60a064a5cb5a", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e1952edf-ed31-49ee-8db1-24370998ab89:indexpattern-datasource-layer-7f40a742-367e-4df3-8d53-a2f2c9324c3e", + "type": "index-pattern" }, { - "id": "azure_metrics-eda368d0-6d1d-11ea-8fe8-71add5fd7c38", - "name": "c35d3d89-2f34-43a0-b346-85ba0e7c9e89:panel_c35d3d89-2f34-43a0-b346-85ba0e7c9e89", - "type": "visualization" + "id": "metrics-*", + "name": "ada37452-619f-470a-b9cd-bafa20e7d7b1:indexpattern-datasource-layer-8268302f-e1ba-4e07-ab78-4b566a7e2f70", + "type": "index-pattern" }, { - "id": "azure_metrics-6e2d9930-6d1e-11ea-8fe8-71add5fd7c38", - "name": "e1952edf-ed31-49ee-8db1-24370998ab89:panel_e1952edf-ed31-49ee-8db1-24370998ab89", - "type": "visualization" + "id": "metrics-*", + "name": "c8d3ed1a-6e72-4115-9a69-db1919a36fc4:indexpattern-datasource-layer-d9594890-7ab7-4d9a-8234-e2c8f1655947", + "type": "index-pattern" }, { - "id": "azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9", - "name": "ec183a66-545b-4a67-bfb4-568def660612:panel_ec183a66-545b-4a67-bfb4-568def660612", - "type": "visualization" + "id": "metrics-*", + "name": "02550033-51ea-4075-92ae-9ca33ea71e39:indexpattern-datasource-layer-b6bbccbe-23e8-4204-b8b0-7e40c8363d6a", + "type": "index-pattern" }, { - "id": "azure_metrics-bda7b580-6d1f-11ea-8fe8-71add5fd7c38", - "name": "ada37452-619f-470a-b9cd-bafa20e7d7b1:panel_ada37452-619f-470a-b9cd-bafa20e7d7b1", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_86dd2752-09d1-4688-879b-80a081fcaf17:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-c19586f0-6d1e-11ea-8fe8-71add5fd7c38", - "name": "c8d3ed1a-6e72-4115-9a69-db1919a36fc4:panel_c8d3ed1a-6e72-4115-9a69-db1919a36fc4", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_b38c448d-a50d-4298-a673-bbf7aff4e948:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-e79211c0-6d37-11ea-8fe8-71add5fd7c38", - "name": "707fb714-99af-4484-a56e-bfecdf592c58:panel_707fb714-99af-4484-a56e-bfecdf592c58", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_5f67629e-dd36-4154-8a6f-003df1c08474:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc.json index 5ff08ae6db5..aa4a43f0884 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc.json @@ -1,7 +1,12 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"c7829894-f20c-4b19-ad2d-3a612701abc9\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c7829894-f20c-4b19-ad2d-3a612701abc9\",\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"enhancements\":{}}},\"95194504-becb-41f2-bd07-37297fd2fef6\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"95194504-becb-41f2-bd07-37297fd2fef6\",\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"enhancements\":{}}},\"d8a53398-5fc3-428e-9182-12bda0d851de\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"d8a53398-5fc3-428e-9182-12bda0d851de\",\"fieldName\":\"azure.resource.name\",\"title\":\"Resource Name\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for file storage type in Azure.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,232 +40,1846 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [**File**](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", + "openLinksInNewTab": false + }, + "title": "Navigation File Storage Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "ee131d2d-7ab5-4434-9e3b-230759c3e5ff", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "ee131d2d-7ab5-4434-9e3b-230759c3e5ff", - "panelRefName": "panel_ee131d2d-7ab5-4434-9e3b-230759c3e5ff", "type": "visualization", - "version": "7.7.0" + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "663f068d-e20e-4707-8a8e-749b694027f0": { + "columnOrder": [ + "84db5c1c-ec68-45ed-a47e-28cffd3de24a", + "12c42888-d32f-44da-a61d-84c1f18bdeefX0", + "12c42888-d32f-44da-a61d-84c1f18bdeefX1", + "12c42888-d32f-44da-a61d-84c1f18bdeef" + ], + "columns": { + "12c42888-d32f-44da-a61d-84c1f18bdeef": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.file_capacity.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.file_capacity.avg))", + "isFormulaBroken": false + }, + "references": [ + "12c42888-d32f-44da-a61d-84c1f18bdeefX1" + ], + "scale": "ratio" + }, + "12c42888-d32f-44da-a61d-84c1f18bdeefX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_capacity.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_capacity.avg" + }, + "12c42888-d32f-44da-a61d-84c1f18bdeefX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_capacity.avg))", + "operationType": "overall_max", + "references": [ + "12c42888-d32f-44da-a61d-84c1f18bdeefX0" + ], + "scale": "ratio" + }, + "84db5c1c-ec68-45ed-a47e-28cffd3de24a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "File Capacity", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_capacity.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-663f068d-e20e-4707-8a8e-749b694027f0", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FCC400", + "layerId": "663f068d-e20e-4707-8a8e-749b694027f0", + "layerType": "data", + "maxAccessor": "12c42888-d32f-44da-a61d-84c1f18bdeef", + "metricAccessor": "84db5c1c-ec68-45ed-a47e-28cffd3de24a" + } + }, + "title": "Storage File Capacity [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "i": "b24e3e0d-a748-4bb9-ad71-e0de392e2696", "w": 5, - "x": 9, - "y": 0 + "x": 0, + "y": 5 }, - "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "panelRefName": "panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "title": "Availability", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "b24e3e0d-a748-4bb9-ad71-e0de392e2696", + "title": "Storage File Capacity [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "755bcc63-9b76-40e2-ae5d-0080d083461c": { + "columnOrder": [ + "23858a4e-1e42-4904-83a2-ed6e49295ba2", + "9f5ac963-172f-4634-9a08-251dffc2537dX0", + "9f5ac963-172f-4634-9a08-251dffc2537dX1", + "9f5ac963-172f-4634-9a08-251dffc2537d" + ], + "columns": { + "23858a4e-1e42-4904-83a2-ed6e49295ba2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "File Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_count.avg" + }, + "9f5ac963-172f-4634-9a08-251dffc2537d": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.file_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.file_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "9f5ac963-172f-4634-9a08-251dffc2537dX1" + ], + "scale": "ratio" + }, + "9f5ac963-172f-4634-9a08-251dffc2537dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_count.avg" + }, + "9f5ac963-172f-4634-9a08-251dffc2537dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_count.avg))", + "operationType": "overall_max", + "references": [ + "9f5ac963-172f-4634-9a08-251dffc2537dX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-755bcc63-9b76-40e2-ae5d-0080d083461c", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#A4DD00", + "layerId": "755bcc63-9b76-40e2-ae5d-0080d083461c", + "layerType": "data", + "maxAccessor": "9f5ac963-172f-4634-9a08-251dffc2537d", + "metricAccessor": "23858a4e-1e42-4904-83a2-ed6e49295ba2" + } + }, + "title": "Storage File Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "b24e3e0d-a748-4bb9-ad71-e0de392e2696", + "i": "8131dfcd-2c52-4641-8259-2f4f2e7558d0", "w": 5, - "x": 14, - "y": 0 + "x": 5, + "y": 5 }, - "panelIndex": "b24e3e0d-a748-4bb9-ad71-e0de392e2696", - "panelRefName": "panel_b24e3e0d-a748-4bb9-ad71-e0de392e2696", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "8131dfcd-2c52-4641-8259-2f4f2e7558d0", + "title": "Storage File Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "c35f1e39-72c5-4288-b72e-80b53abee398": { + "columnOrder": [ + "22f058a6-1825-4063-8158-d90762047b37", + "062f829c-7c18-40ba-8284-fd5a58c25a8aX0", + "062f829c-7c18-40ba-8284-fd5a58c25a8aX1", + "062f829c-7c18-40ba-8284-fd5a58c25a8a" + ], + "columns": { + "062f829c-7c18-40ba-8284-fd5a58c25a8a": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.file_share_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.file_share_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "062f829c-7c18-40ba-8284-fd5a58c25a8aX1" + ], + "scale": "ratio" + }, + "062f829c-7c18-40ba-8284-fd5a58c25a8aX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_count.avg" + }, + "062f829c-7c18-40ba-8284-fd5a58c25a8aX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_count.avg))", + "operationType": "overall_max", + "references": [ + "062f829c-7c18-40ba-8284-fd5a58c25a8aX0" + ], + "scale": "ratio" + }, + "22f058a6-1825-4063-8158-d90762047b37": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "File Share Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_count.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-c35f1e39-72c5-4288-b72e-80b53abee398", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#A4DD00", + "layerId": "c35f1e39-72c5-4288-b72e-80b53abee398", + "layerType": "data", + "maxAccessor": "062f829c-7c18-40ba-8284-fd5a58c25a8a", + "metricAccessor": "22f058a6-1825-4063-8158-d90762047b37" + } + }, + "title": "Storage File Share Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "8131dfcd-2c52-4641-8259-2f4f2e7558d0", + "i": "49233089-be1d-4cda-9ccf-2815152e1016", "w": 5, - "x": 19, - "y": 0 + "x": 10, + "y": 5 }, - "panelIndex": "8131dfcd-2c52-4641-8259-2f4f2e7558d0", - "panelRefName": "panel_8131dfcd-2c52-4641-8259-2f4f2e7558d0", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "49233089-be1d-4cda-9ccf-2815152e1016", + "title": "Storage File Share Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "b8cd849b-ef0d-492a-88b8-70d5f5b654ce": { + "columnOrder": [ + "eb4b9d4f-0ea2-42cf-9641-65ff9f2c5335", + "a7b1928f-ce2c-43ff-b945-a6b419d9b760" + ], + "columns": { + "a7b1928f-ce2c-43ff-b945-a6b419d9b760": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Availability", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " %" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.availability.avg" + }, + "eb4b9d4f-0ea2-42cf-9641-65ff9f2c5335": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-b8cd849b-ef0d-492a-88b8-70d5f5b654ce", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.6, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a7b1928f-ce2c-43ff-b945-a6b419d9b760" + ], + "layerId": "b8cd849b-ef0d-492a-88b8-70d5f5b654ce", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "eb4b9d4f-0ea2-42cf-9641-65ff9f2c5335", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "a7b1928f-ce2c-43ff-b945-a6b419d9b760" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Availability [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "49233089-be1d-4cda-9ccf-2815152e1016", - "w": 5, - "x": 24, - "y": 0 + "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "w": 14, + "x": 15, + "y": 5 }, - "panelIndex": "49233089-be1d-4cda-9ccf-2815152e1016", - "panelRefName": "panel_49233089-be1d-4cda-9ccf-2815152e1016", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "title": "Availability", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e20a4093-e091-482f-ba02-7433fa318536": { + "columnOrder": [ + "99d6d2f9-fd90-4283-a041-f197eeebaaad", + "5f30c9f9-723a-493b-90b2-6b73114680cb", + "cf40e3fc-c7d5-4e5c-9440-26f87c96afd3" + ], + "columns": { + "5f30c9f9-723a-493b-90b2-6b73114680cb": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.response_type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cf40e3fc-c7d5-4e5c-9440-26f87c96afd3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.response_type" + }, + "99d6d2f9-fd90-4283-a041-f197eeebaaad": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cf40e3fc-c7d5-4e5c-9440-26f87c96afd3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.storage_account.transactions.total)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.storage_account.transactions.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e20a4093-e091-482f-ba02-7433fa318536", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "cf40e3fc-c7d5-4e5c-9440-26f87c96afd3" + ], + "layerId": "e20a4093-e091-482f-ba02-7433fa318536", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "5f30c9f9-723a-493b-90b2-6b73114680cb", + "xAccessor": "99d6d2f9-fd90-4283-a041-f197eeebaaad", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "cf40e3fc-c7d5-4e5c-9440-26f87c96afd3" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Transactions [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "1d623c03-4d02-4a81-b91e-49e82e112016", "w": 19, "x": 29, - "y": 0 + "y": 5 }, "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", - "panelRefName": "panel_1d623c03-4d02-4a81-b91e-49e82e112016", "title": "Transactions", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "0af83a0b-7495-43ef-b775-3947b43ae3d2": { + "columnOrder": [ + "a9cc5858-41b5-4dc6-a06f-8a2c20f56190", + "9d4a0ed0-f231-4462-a164-0babab6e282bX0", + "9d4a0ed0-f231-4462-a164-0babab6e282bX1", + "9d4a0ed0-f231-4462-a164-0babab6e282b" + ], + "columns": { + "9d4a0ed0-f231-4462-a164-0babab6e282b": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.file_share_snapshot_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.file_share_snapshot_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "9d4a0ed0-f231-4462-a164-0babab6e282bX1" + ], + "scale": "ratio" + }, + "9d4a0ed0-f231-4462-a164-0babab6e282bX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_snapshot_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_snapshot_count.avg" + }, + "9d4a0ed0-f231-4462-a164-0babab6e282bX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_snapshot_count.avg))", + "operationType": "overall_max", + "references": [ + "9d4a0ed0-f231-4462-a164-0babab6e282bX0" + ], + "scale": "ratio" + }, + "a9cc5858-41b5-4dc6-a06f-8a2c20f56190": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "File Share Snapshot Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_snapshot_count.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-0af83a0b-7495-43ef-b775-3947b43ae3d2", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#0062B1", + "layerId": "0af83a0b-7495-43ef-b775-3947b43ae3d2", + "layerType": "data", + "maxAccessor": "9d4a0ed0-f231-4462-a164-0babab6e282b", + "metricAccessor": "a9cc5858-41b5-4dc6-a06f-8a2c20f56190" + } + }, + "title": "Storage File Share Snapshot Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "ff6441f8-d66d-4399-bae5-25d3d861b299", + "h": 8, + "i": "2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", "w": 9, "x": 0, - "y": 5 + "y": 14 }, - "panelIndex": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "panelRefName": "panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", + "title": "Storage File Share Snapshot Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "4e6e46e0-0574-442a-90ad-8f4da25050a8": { + "columnOrder": [ + "b2d735cd-4039-429b-b7c7-eb3d90db3b20", + "bb9ea912-54a1-4623-8764-5aa15ec3e04c", + "05ccf6a0-2c96-4739-9d44-605c279562f4" + ], + "columns": { + "05ccf6a0-2c96-4739-9d44-605c279562f4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SuccessServerLatency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_server_latency.avg" + }, + "b2d735cd-4039-429b-b7c7-eb3d90db3b20": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "05ccf6a0-2c96-4739-9d44-605c279562f4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "bb9ea912-54a1-4623-8764-5aa15ec3e04c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4e6e46e0-0574-442a-90ad-8f4da25050a8", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "05ccf6a0-2c96-4739-9d44-605c279562f4" + ], + "layerId": "4e6e46e0-0574-442a-90ad-8f4da25050a8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "b2d735cd-4039-429b-b7c7-eb3d90db3b20", + "xAccessor": "bb9ea912-54a1-4623-8764-5aa15ec3e04c", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "05ccf6a0-2c96-4739-9d44-605c279562f4" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success Server Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "87066244-7840-4555-9d12-026d64977f1a", "w": 20, "x": 9, - "y": 9 + "y": 14 }, "panelIndex": "87066244-7840-4555-9d12-026d64977f1a", - "panelRefName": "panel_87066244-7840-4555-9d12-026d64977f1a", "title": "Success Server Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "cafb9be2-3e64-4c88-9890-c6df9bdb8785": { + "columnOrder": [ + "794cf5e2-d317-4f30-a975-e4ca760b7dbc", + "74ae4067-b47d-49c0-a9f7-7d9eca1a0961", + "8376a8a7-8690-48eb-9db1-adec8860c89a" + ], + "columns": { + "74ae4067-b47d-49c0-a9f7-7d9eca1a0961": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "794cf5e2-d317-4f30-a975-e4ca760b7dbc": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8376a8a7-8690-48eb-9db1-adec8860c89a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "8376a8a7-8690-48eb-9db1-adec8860c89a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Success E2E Latency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_e2elatency.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-cafb9be2-3e64-4c88-9890-c6df9bdb8785", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8376a8a7-8690-48eb-9db1-adec8860c89a" + ], + "layerId": "cafb9be2-3e64-4c88-9890-c6df9bdb8785", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "794cf5e2-d317-4f30-a975-e4ca760b7dbc", + "xAccessor": "74ae4067-b47d-49c0-a9f7-7d9eca1a0961", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "8376a8a7-8690-48eb-9db1-adec8860c89a" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success E2E Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "756da375-e6a2-4668-af43-0cd294878254", "w": 19, "x": 29, - "y": 9 + "y": 14 }, "panelIndex": "756da375-e6a2-4668-af43-0cd294878254", - "panelRefName": "panel_756da375-e6a2-4668-af43-0cd294878254", "title": "Success E2E Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "d0d4f08e-f81f-4ef5-b7de-fa476c0e719e": { + "columnOrder": [ + "19e57c7d-acf6-4e08-b599-0269fa62707f", + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X0", + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X1", + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3" + ], + "columns": { + "19e57c7d-acf6-4e08-b599-0269fa62707f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "File Share Snapshot Size", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_snapshot_size.avg" + }, + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.file_share_snapshot_size.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.file_share_snapshot_size.avg))", + "isFormulaBroken": false + }, + "references": [ + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X1" + ], + "scale": "ratio" + }, + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_snapshot_size.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.file_share_snapshot_size.avg" + }, + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.file_share_snapshot_size.avg))", + "operationType": "overall_max", + "references": [ + "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-d0d4f08e-f81f-4ef5-b7de-fa476c0e719e", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#0062B1", + "layerId": "d0d4f08e-f81f-4ef5-b7de-fa476c0e719e", + "layerType": "data", + "maxAccessor": "a67f2ce4-fc3a-4924-a5f5-c96e4474d4f3", + "metricAccessor": "19e57c7d-acf6-4e08-b599-0269fa62707f" + } + }, + "title": "Storage File Share Snapshot Size [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 8, - "i": "2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", - "w": 4, + "h": 7, + "i": "c6792441-37b6-4ef4-ad8b-21f137b2f0b4", + "w": 9, "x": 0, - "y": 20 + "y": 22 }, - "panelIndex": "2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", - "panelRefName": "panel_2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "c6792441-37b6-4ef4-ad8b-21f137b2f0b4", + "title": "Storage File Share Snapshot Size [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "93a05ec0-0f19-4812-93be-6f7dd9dcf90f": { + "columnOrder": [ + "a60341c7-5528-441d-8703-c21b368b46ab", + "ab446534-5509-411d-9354-db0fbfde7394", + "e4afa96f-9ac7-4e50-904f-bec27d4c0d24" + ], + "columns": { + "a60341c7-5528-441d-8703-c21b368b46ab": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4afa96f-9ac7-4e50-904f-bec27d4c0d24", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "ab446534-5509-411d-9354-db0fbfde7394": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e4afa96f-9ac7-4e50-904f-bec27d4c0d24": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Ingress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-93a05ec0-0f19-4812-93be-6f7dd9dcf90f", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e4afa96f-9ac7-4e50-904f-bec27d4c0d24" + ], + "layerId": "93a05ec0-0f19-4812-93be-6f7dd9dcf90f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "a60341c7-5528-441d-8703-c21b368b46ab", + "xAccessor": "ab446534-5509-411d-9354-db0fbfde7394", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "e4afa96f-9ac7-4e50-904f-bec27d4c0d24" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Ingress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 8, - "i": "c6792441-37b6-4ef4-ad8b-21f137b2f0b4", - "w": 5, - "x": 4, - "y": 20 + "h": 14, + "i": "75f72920-be71-47a9-a967-f1c862ab2961", + "w": 24, + "x": 24, + "y": 29 }, - "panelIndex": "c6792441-37b6-4ef4-ad8b-21f137b2f0b4", - "panelRefName": "panel_c6792441-37b6-4ef4-ad8b-21f137b2f0b4", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", + "title": "Ingress Traffic by APIName", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "c8c992bf-7fce-42d6-9f2c-c4387ea2ed69": { + "columnOrder": [ + "662706fd-22eb-4e13-bf8d-49046d97a50c", + "648dbe26-960c-42a5-b6a2-719df4525ead", + "6dc4b040-e9fd-46b6-acf6-256427c6e0ad" + ], + "columns": { + "648dbe26-960c-42a5-b6a2-719df4525ead": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "662706fd-22eb-4e13-bf8d-49046d97a50c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6dc4b040-e9fd-46b6-acf6-256427c6e0ad", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "6dc4b040-e9fd-46b6-acf6-256427c6e0ad": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Egress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-c8c992bf-7fce-42d6-9f2c-c4387ea2ed69", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6dc4b040-e9fd-46b6-acf6-256427c6e0ad" + ], + "layerId": "c8c992bf-7fce-42d6-9f2c-c4387ea2ed69", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "662706fd-22eb-4e13-bf8d-49046d97a50c", + "xAccessor": "648dbe26-960c-42a5-b6a2-719df4525ead", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,149,177,1)", + "forAccessor": "6dc4b040-e9fd-46b6-acf6-256427c6e0ad" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Egress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "a715fafc-ca38-410c-9253-12ba506eabc0", - "w": 20, - "x": 9, - "y": 24 + "w": 24, + "x": 0, + "y": 29 }, "panelIndex": "a715fafc-ca38-410c-9253-12ba506eabc0", - "panelRefName": "panel_a715fafc-ca38-410c-9253-12ba506eabc0", "title": "Egress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 14, - "i": "75f72920-be71-47a9-a967-f1c862ab2961", - "w": 19, - "x": 29, - "y": 24 - }, - "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", - "panelRefName": "panel_75f72920-be71-47a9-a967-f1c862ab2961", - "title": "Ingress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Azure Metrics] File Storage Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-09-01T05:23:11.892Z", "id": "azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, "references": [ { @@ -269,69 +1888,19 @@ "type": "index-pattern" }, { - "id": "azure_metrics-f18a7cb0-32f6-11ea-a83e-25b8612d00cc", - "name": "ee131d2d-7ab5-4434-9e3b-230759c3e5ff:panel_ee131d2d-7ab5-4434-9e3b-230759c3e5ff", - "type": "visualization" - }, - { - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "name": "a9456b9b-efa6-410d-a56c-4b66aa8c499e:panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "type": "visualization" - }, - { - "id": "azure_metrics-453965a0-3393-11ea-a83e-25b8612d00cc", - "name": "b24e3e0d-a748-4bb9-ad71-e0de392e2696:panel_b24e3e0d-a748-4bb9-ad71-e0de392e2696", - "type": "visualization" - }, - { - "id": "azure_metrics-722ef2f0-3393-11ea-a83e-25b8612d00cc", - "name": "8131dfcd-2c52-4641-8259-2f4f2e7558d0:panel_8131dfcd-2c52-4641-8259-2f4f2e7558d0", - "type": "visualization" - }, - { - "id": "azure_metrics-a4bf9710-3393-11ea-a83e-25b8612d00cc", - "name": "49233089-be1d-4cda-9ccf-2815152e1016:panel_49233089-be1d-4cda-9ccf-2815152e1016", - "type": "visualization" - }, - { - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "name": "1d623c03-4d02-4a81-b91e-49e82e112016:panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "type": "visualization" - }, - { - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization" - }, - { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "name": "87066244-7840-4555-9d12-026d64977f1a:panel_87066244-7840-4555-9d12-026d64977f1a", - "type": "visualization" - }, - { - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "name": "756da375-e6a2-4668-af43-0cd294878254:panel_756da375-e6a2-4668-af43-0cd294878254", - "type": "visualization" - }, - { - "id": "azure_metrics-09a6f150-3399-11ea-a83e-25b8612d00cc", - "name": "2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f:panel_2d5c6c0f-f4d2-44fb-b7e5-1a855b75e40f", - "type": "visualization" - }, - { - "id": "azure_metrics-241a55e0-3399-11ea-a83e-25b8612d00cc", - "name": "c6792441-37b6-4ef4-ad8b-21f137b2f0b4:panel_c6792441-37b6-4ef4-ad8b-21f137b2f0b4", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_c7829894-f20c-4b19-ad2d-3a612701abc9:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "name": "a715fafc-ca38-410c-9253-12ba506eabc0:panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_95194504-becb-41f2-bd07-37297fd2fef6:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "name": "75f72920-be71-47a9-a967-f1c862ab2961:panel_75f72920-be71-47a9-a967-f1c862ab2961", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_d8a53398-5fc3-428e-9182-12bda0d851de:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5.json index 92bb713a654..55fb2955fbb 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5.json @@ -1,5 +1,11 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"f6cf2f69-1455-4255-8cbb-754914b6f548\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cloud.region\",\"title\":\"Region\",\"id\":\"f6cf2f69-1455-4255-8cbb-754914b6f548\",\"enhancements\":{}}},\"8f432dec-9bb0-4084-a307-5894e4a3bb12\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"id\":\"8f432dec-9bb0-4084-a307-5894e4a3bb12\",\"enhancements\":{}}},\"1bd55cba-ce48-43f7-86cb-539ac5da7cae\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"azure.resource.name\",\"title\":\"VM Name\",\"id\":\"1bd55cba-ce48-43f7-86cb-539ac5da7cae\",\"enhancements\":{}}}}" + }, "description": "This dashboard visualized relevant metrics for VMs running on Azure cloud.", "hits": 0, "kibanaSavedObjectMeta": { @@ -18,40 +24,206 @@ "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "### Azure Compute VM \n\n[**Overview**](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Guest Windows VM Metrics](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [Guest Linux VM Metrics](#/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca)", + "openLinksInNewTab": false + }, + "title": "Navigation Compute VM Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 6, "i": "6dd69df8-690d-4fda-a3ee-691fb5de4645", - "w": 10, + "w": 26, "x": 0, "y": 0 }, "panelIndex": "6dd69df8-690d-4fda-a3ee-691fb5de4645", - "panelRefName": "panel_6dd69df8-690d-4fda-a3ee-691fb5de4645", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 6, - "i": "aa881f9d-28d3-4722-822e-3e670021cf52", - "w": 16, - "x": 10, - "y": 0 - }, - "panelIndex": "aa881f9d-28d3-4722-822e-3e670021cf52", - "panelRefName": "panel_aa881f9d-28d3-4722-822e-3e670021cf52", - "title": "VM Filters", "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ac0ccc8f-748c-414f-90e7-b2d160d261d1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "ac0ccc8f-748c-414f-90e7-b2d160d261d1": { + "columnOrder": [ + "dee4dad2-a884-422e-879f-d22250a2624a", + "b22915e9-c769-4ec3-bf53-4f0070ff0cab", + "7df0f935-5335-4b0f-999b-bcd3664bf942" + ], + "columns": { + "7df0f935-5335-4b0f-999b-bcd3664bf942": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Available Memory", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.available_memory_bytes.avg" + }, + "b22915e9-c769-4ec3-bf53-4f0070ff0cab": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dee4dad2-a884-422e-879f-d22250a2624a": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "7df0f935-5335-4b0f-999b-bcd3664bf942" + ], + "layerId": "ac0ccc8f-748c-414f-90e7-b2d160d261d1", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "dee4dad2-a884-422e-879f-d22250a2624a", + "xAccessor": "b22915e9-c769-4ec3-bf53-4f0070ff0cab", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "7df0f935-5335-4b0f-999b-bcd3664bf942" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -61,14 +233,181 @@ "y": 0 }, "panelIndex": "2473ef72-c56c-4783-a36a-f4b8efd66ab7", - "panelRefName": "panel_2473ef72-c56c-4783-a36a-f4b8efd66ab7", "title": "VM Available Memory", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7c37793f-5510-4105-bfa8-cba2ca4327c3", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7c37793f-5510-4105-bfa8-cba2ca4327c3": { + "columnOrder": [ + "1ed55f41-0e9e-4bfb-967a-0c9e660c8f23", + "26e9426d-e265-4110-a808-180d7dcc8d31", + "461d9c41-8634-4719-8116-42be96c1234b" + ], + "columns": { + "1ed55f41-0e9e-4bfb-967a-0c9e660c8f23": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "26e9426d-e265-4110-a808-180d7dcc8d31": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "461d9c41-8634-4719-8116-42be96c1234b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Azure VM CPU Utilization", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": "%" + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.percentage_cpu.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "461d9c41-8634-4719-8116-42be96c1234b" + ], + "layerId": "7c37793f-5510-4105-bfa8-cba2ca4327c3", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "1ed55f41-0e9e-4bfb-967a-0c9e660c8f23", + "xAccessor": "26e9426d-e265-4110-a808-180d7dcc8d31", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "461d9c41-8634-4719-8116-42be96c1234b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -78,14 +417,176 @@ "y": 6 }, "panelIndex": "e673f70c-f811-4290-9087-578c7dd13675", - "panelRefName": "panel_e673f70c-f811-4290-9087-578c7dd13675", "title": "VM CPU Utilization", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7ceb0410-35b9-4a5b-982d-45160c136a49", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7ceb0410-35b9-4a5b-982d-45160c136a49": { + "columnOrder": [ + "44e7d79c-cce8-4902-aa3b-3f6ad6ffb40c", + "09edcbe8-2531-4a5f-af07-28563db428aa", + "c5cfcafe-5176-4e63-a6dc-586d62286f98" + ], + "columns": { + "09edcbe8-2531-4a5f-af07-28563db428aa": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "44e7d79c-cce8-4902-aa3b-3f6ad6ffb40c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "c5cfcafe-5176-4e63-a6dc-586d62286f98": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Azure VM Network In Total", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.network_in_total.total" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c5cfcafe-5176-4e63-a6dc-586d62286f98" + ], + "layerId": "7ceb0410-35b9-4a5b-982d-45160c136a49", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "44e7d79c-cce8-4902-aa3b-3f6ad6ffb40c", + "xAccessor": "09edcbe8-2531-4a5f-af07-28563db428aa", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "c5cfcafe-5176-4e63-a6dc-586d62286f98" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -95,14 +596,176 @@ "y": 18 }, "panelIndex": "535d70b3-3f3c-4a84-85ba-ab671b6d144f", - "panelRefName": "panel_535d70b3-3f3c-4a84-85ba-ab671b6d144f", "title": "VM Network In Total", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-a8cb2545-583d-451b-a086-1f8fb6dfc7b2", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "a8cb2545-583d-451b-a086-1f8fb6dfc7b2": { + "columnOrder": [ + "4fe31555-4459-4b29-95ea-a711dec4f81e", + "476914ec-c92e-456b-ad0f-673254257df0", + "d851dd26-8630-4296-8c57-2274c5ba8517" + ], + "columns": { + "476914ec-c92e-456b-ad0f-673254257df0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4fe31555-4459-4b29-95ea-a711dec4f81e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "d851dd26-8630-4296-8c57-2274c5ba8517": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Azure VM Network Out Total", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.network_out_total.total" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d851dd26-8630-4296-8c57-2274c5ba8517" + ], + "layerId": "a8cb2545-583d-451b-a086-1f8fb6dfc7b2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "4fe31555-4459-4b29-95ea-a711dec4f81e", + "xAccessor": "476914ec-c92e-456b-ad0f-673254257df0", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(115,216,255,1)", + "forAccessor": "d851dd26-8630-4296-8c57-2274c5ba8517" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -112,14 +775,176 @@ "y": 18 }, "panelIndex": "6903a45e-bf11-4db2-9497-fd9692e83448", - "panelRefName": "panel_6903a45e-bf11-4db2-9497-fd9692e83448", "title": "VM Network Out Total", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7884bf33-f9c1-4249-85f6-e23361d08c14", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7884bf33-f9c1-4249-85f6-e23361d08c14": { + "columnOrder": [ + "0677be68-a86e-410f-bfba-3a10d8e31076", + "f41039cd-ec6f-4962-99eb-6730dac55c81", + "b148ba9a-a87b-4f66-8322-f031a143f7d2" + ], + "columns": { + "0677be68-a86e-410f-bfba-3a10d8e31076": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "b148ba9a-a87b-4f66-8322-f031a143f7d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Writes bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.disk_write_bytes.total" + }, + "f41039cd-ec6f-4962-99eb-6730dac55c81": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b148ba9a-a87b-4f66-8322-f031a143f7d2" + ], + "layerId": "7884bf33-f9c1-4249-85f6-e23361d08c14", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "0677be68-a86e-410f-bfba-3a10d8e31076", + "xAccessor": "f41039cd-ec6f-4962-99eb-6730dac55c81", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "b148ba9a-a87b-4f66-8322-f031a143f7d2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -129,14 +954,176 @@ "y": 18 }, "panelIndex": "aa57fa8f-f6ea-45e3-9b2c-ba948d625813", - "panelRefName": "panel_aa57fa8f-f6ea-45e3-9b2c-ba948d625813", "title": "VM Disk Writes", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-83a8d3cd-ad25-4d78-a8e6-e35b83ac8245", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "83a8d3cd-ad25-4d78-a8e6-e35b83ac8245": { + "columnOrder": [ + "5c8395a4-f0f7-4409-b542-7eff011d9bb0", + "6042afbc-97ba-4a9a-b6ce-c473cae6721e", + "bb35db70-0fc3-4dea-a37c-6c05ced09132" + ], + "columns": { + "5c8395a4-f0f7-4409-b542-7eff011d9bb0": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "6042afbc-97ba-4a9a-b6ce-c473cae6721e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "bb35db70-0fc3-4dea-a37c-6c05ced09132": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Read bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.disk_read_bytes.total" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "bb35db70-0fc3-4dea-a37c-6c05ced09132" + ], + "layerId": "83a8d3cd-ad25-4d78-a8e6-e35b83ac8245", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "5c8395a4-f0f7-4409-b542-7eff011d9bb0", + "xAccessor": "6042afbc-97ba-4a9a-b6ce-c473cae6721e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "bb35db70-0fc3-4dea-a37c-6c05ced09132" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -146,13 +1133,170 @@ "y": 18 }, "panelIndex": "14e225ef-6417-4377-b2cb-6b46b6693b78", - "panelRefName": "panel_14e225ef-6417-4377-b2cb-6b46b6693b78", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "title": "VM Disk Reads [Azure Metrics]", + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-6f90b4b3-9fa8-451f-bc49-59bc3836450f", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "6f90b4b3-9fa8-451f-bc49-59bc3836450f": { + "columnOrder": [ + "e90705d6-65bf-44ad-a639-82ea78d9305b", + "d3ab6fd4-1f88-408a-af43-deef5dffea76", + "ecf4dc66-da0f-4066-9ac5-87b27bc2fbfa" + ], + "columns": { + "d3ab6fd4-1f88-408a-af43-deef5dffea76": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e90705d6-65bf-44ad-a639-82ea78d9305b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "ecf4dc66-da0f-4066-9ac5-87b27bc2fbfa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Read Operations/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.disk_read_operations_per_sec.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ecf4dc66-da0f-4066-9ac5-87b27bc2fbfa" + ], + "layerId": "6f90b4b3-9fa8-451f-bc49-59bc3836450f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "e90705d6-65bf-44ad-a639-82ea78d9305b", + "xAccessor": "d3ab6fd4-1f88-408a-af43-deef5dffea76", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "ecf4dc66-da0f-4066-9ac5-87b27bc2fbfa" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 13, @@ -162,14 +1306,170 @@ "y": 30 }, "panelIndex": "8879143b-ed83-45ec-8c58-b10dc1597c22", - "panelRefName": "panel_8879143b-ed83-45ec-8c58-b10dc1597c22", "title": "VM Disk Read Operations/s", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-7a182b0f-6f12-475b-bf0b-1c3c59cd7fd7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7a182b0f-6f12-475b-bf0b-1c3c59cd7fd7": { + "columnOrder": [ + "de2c3ced-f671-4d66-bf4d-3ac52d766c56", + "90f5f864-5365-45ea-b7ae-319c3a215f71", + "f004326b-6910-4472-b28b-ea6f83be1026" + ], + "columns": { + "90f5f864-5365-45ea-b7ae-319c3a215f71": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "de2c3ced-f671-4d66-bf4d-3ac52d766c56": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.resource.name", + "operationType": "terms", + "params": { + "excludeIsRegex": false, + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.resource.name" + }, + "f004326b-6910-4472-b28b-ea6f83be1026": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VM Disk Write Operations/s", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.compute_vm.disk_write_operations_per_sec.avg" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f004326b-6910-4472-b28b-ea6f83be1026" + ], + "layerId": "7a182b0f-6f12-475b-bf0b-1c3c59cd7fd7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "de2c3ced-f671-4d66-bf4d-3ac52d766c56", + "xAccessor": "90f5f864-5365-45ea-b7ae-319c3a215f71", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "f004326b-6910-4472-b28b-ea6f83be1026" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + }, + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 13, @@ -179,71 +1479,75 @@ "y": 30 }, "panelIndex": "4071f2bf-1794-45ff-b76d-58864226d8b7", - "panelRefName": "panel_4071f2bf-1794-45ff-b76d-58864226d8b7", "title": "VM Disk Write Operations/s", - "type": "visualization", - "version": "7.14.0-SNAPSHOT" + "type": "lens", + "version": "8.4.0" } ], "timeRestore": false, "title": "[Azure Metrics] Compute VMs Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.4.0", "id": "azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.4.0" }, "references": [ { - "id": "azure_metrics-eaf13b40-feac-11eb-8fff-87871c582eca", - "name": "6dd69df8-690d-4fda-a3ee-691fb5de4645:panel_6dd69df8-690d-4fda-a3ee-691fb5de4645", - "type": "visualization" + "id": "metrics-*", + "name": "2473ef72-c56c-4783-a36a-f4b8efd66ab7:indexpattern-datasource-layer-ac0ccc8f-748c-414f-90e7-b2d160d261d1", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e673f70c-f811-4290-9087-578c7dd13675:indexpattern-datasource-layer-7c37793f-5510-4105-bfa8-cba2ca4327c3", + "type": "index-pattern" }, { - "id": "azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5", - "name": "aa881f9d-28d3-4722-822e-3e670021cf52:panel_aa881f9d-28d3-4722-822e-3e670021cf52", - "type": "visualization" + "id": "metrics-*", + "name": "535d70b3-3f3c-4a84-85ba-ab671b6d144f:indexpattern-datasource-layer-7ceb0410-35b9-4a5b-982d-45160c136a49", + "type": "index-pattern" }, { - "id": "azure_metrics-7205a4f0-ea95-11e9-90ec-112a988266d5", - "name": "2473ef72-c56c-4783-a36a-f4b8efd66ab7:panel_2473ef72-c56c-4783-a36a-f4b8efd66ab7", - "type": "visualization" + "id": "metrics-*", + "name": "6903a45e-bf11-4db2-9497-fd9692e83448:indexpattern-datasource-layer-a8cb2545-583d-451b-a086-1f8fb6dfc7b2", + "type": "index-pattern" }, { - "id": "azure_metrics-db9a3490-ea8f-11e9-90ec-112a988266d5", - "name": "e673f70c-f811-4290-9087-578c7dd13675:panel_e673f70c-f811-4290-9087-578c7dd13675", - "type": "visualization" + "id": "metrics-*", + "name": "aa57fa8f-f6ea-45e3-9b2c-ba948d625813:indexpattern-datasource-layer-7884bf33-f9c1-4249-85f6-e23361d08c14", + "type": "index-pattern" }, { - "id": "azure_metrics-8b6b9450-ea99-11e9-90ec-112a988266d5", - "name": "535d70b3-3f3c-4a84-85ba-ab671b6d144f:panel_535d70b3-3f3c-4a84-85ba-ab671b6d144f", - "type": "visualization" + "id": "metrics-*", + "name": "14e225ef-6417-4377-b2cb-6b46b6693b78:indexpattern-datasource-layer-83a8d3cd-ad25-4d78-a8e6-e35b83ac8245", + "type": "index-pattern" }, { - "id": "azure_metrics-abd32c30-ea99-11e9-90ec-112a988266d5", - "name": "6903a45e-bf11-4db2-9497-fd9692e83448:panel_6903a45e-bf11-4db2-9497-fd9692e83448", - "type": "visualization" + "id": "metrics-*", + "name": "8879143b-ed83-45ec-8c58-b10dc1597c22:indexpattern-datasource-layer-6f90b4b3-9fa8-451f-bc49-59bc3836450f", + "type": "index-pattern" }, { - "id": "azure_metrics-5c016810-ea9a-11e9-90ec-112a988266d5", - "name": "aa57fa8f-f6ea-45e3-9b2c-ba948d625813:panel_aa57fa8f-f6ea-45e3-9b2c-ba948d625813", - "type": "visualization" + "id": "metrics-*", + "name": "4071f2bf-1794-45ff-b76d-58864226d8b7:indexpattern-datasource-layer-7a182b0f-6f12-475b-bf0b-1c3c59cd7fd7", + "type": "index-pattern" }, { - "id": "azure_metrics-e8ca65c0-eb45-11e9-90ec-112a988266d5", - "name": "14e225ef-6417-4377-b2cb-6b46b6693b78:panel_14e225ef-6417-4377-b2cb-6b46b6693b78", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_f6cf2f69-1455-4255-8cbb-754914b6f548:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-3a50e950-eb46-11e9-90ec-112a988266d5", - "name": "8879143b-ed83-45ec-8c58-b10dc1597c22:panel_8879143b-ed83-45ec-8c58-b10dc1597c22", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_8f432dec-9bb0-4084-a307-5894e4a3bb12:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-0892eaa0-ea9a-11e9-90ec-112a988266d5", - "name": "4071f2bf-1794-45ff-b76d-58864226d8b7:panel_4071f2bf-1794-45ff-b76d-58864226d8b7", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_1bd55cba-ce48-43f7-86cb-539ac5da7cae:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc.json index 9f1061b9748..15c0d6e2df2 100644 --- a/packages/azure_metrics/kibana/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc.json +++ b/packages/azure_metrics/kibana/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc.json @@ -1,7 +1,12 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"859278cd-7231-4483-9a14-5bd544d85949\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"859278cd-7231-4483-9a14-5bd544d85949\",\"fieldName\":\"azure.subscription_id\",\"title\":\"Subscription\",\"singleSelect\":true,\"enhancements\":{}}},\"5606188c-ad52-4ec8-9eb0-5816a7e45c11\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"5606188c-ad52-4ec8-9eb0-5816a7e45c11\",\"fieldName\":\"azure.resource.group\",\"title\":\"Resource Group\",\"enhancements\":{}}},\"6f841590-bae1-4d83-8290-eb8d4e0e186f\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"6f841590-bae1-4d83-8290-eb8d4e0e186f\",\"fieldName\":\"azure.resource.name\",\"title\":\"Resource Name\",\"enhancements\":{}}}}" + }, "description": "This dashboard shows metrics for table storage type in Azure.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,200 +40,1580 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [**Table**](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", + "openLinksInNewTab": false + }, + "title": "Navigation Table Storage Overview [Azure Metrics]", + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 5, "i": "204cbabc-fafd-472c-b106-bd08f5262b1f", - "w": 9, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "204cbabc-fafd-472c-b106-bd08f5262b1f", - "panelRefName": "panel_204cbabc-fafd-472c-b106-bd08f5262b1f", - "type": "visualization", - "version": "7.7.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 9, - "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "w": 5, - "x": 9, - "y": 0 - }, - "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "panelRefName": "panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "title": "Availability", "type": "visualization", - "version": "7.7.0" + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "8af334fb-517e-41e8-93e9-c4dc79c034ed": { + "columnOrder": [ + "65b98bd8-f136-4716-9ec6-94443d4fac64", + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X0", + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X1", + "4ec7ad4b-9db8-47c7-98d7-19400cb70922" + ], + "columns": { + "4ec7ad4b-9db8-47c7-98d7-19400cb70922": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.table_capacity.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.table_capacity.avg))", + "isFormulaBroken": false + }, + "references": [ + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X1" + ], + "scale": "ratio" + }, + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_capacity.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_capacity.avg" + }, + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_capacity.avg))", + "operationType": "overall_max", + "references": [ + "4ec7ad4b-9db8-47c7-98d7-19400cb70922X0" + ], + "scale": "ratio" + }, + "65b98bd8-f136-4716-9ec6-94443d4fac64": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Table Capacity", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_capacity.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-8af334fb-517e-41e8-93e9-c4dc79c034ed", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "8af334fb-517e-41e8-93e9-c4dc79c034ed", + "layerType": "data", + "maxAccessor": "4ec7ad4b-9db8-47c7-98d7-19400cb70922", + "metricAccessor": "65b98bd8-f136-4716-9ec6-94443d4fac64" + } + }, + "title": "Storage Table Capacity [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "15b7c108-0214-4af6-9719-fab59affafec", "w": 5, - "x": 14, - "y": 0 + "x": 0, + "y": 5 }, "panelIndex": "15b7c108-0214-4af6-9719-fab59affafec", - "panelRefName": "panel_15b7c108-0214-4af6-9719-fab59affafec", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Table Capacity [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "9a7e40c9-8b33-4ae4-9954-5b4ef7d462f9": { + "columnOrder": [ + "2d62dcb1-64ad-46b4-9909-34975f4409ab", + "c17ea056-b0cd-4821-a97c-8682579757c3X0", + "c17ea056-b0cd-4821-a97c-8682579757c3X1", + "c17ea056-b0cd-4821-a97c-8682579757c3" + ], + "columns": { + "2d62dcb1-64ad-46b4-9909-34975f4409ab": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Table Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_count.avg" + }, + "c17ea056-b0cd-4821-a97c-8682579757c3": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.table_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.table_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "c17ea056-b0cd-4821-a97c-8682579757c3X1" + ], + "scale": "ratio" + }, + "c17ea056-b0cd-4821-a97c-8682579757c3X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_count.avg" + }, + "c17ea056-b0cd-4821-a97c-8682579757c3X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_count.avg))", + "operationType": "overall_max", + "references": [ + "c17ea056-b0cd-4821-a97c-8682579757c3X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-9a7e40c9-8b33-4ae4-9954-5b4ef7d462f9", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "9a7e40c9-8b33-4ae4-9954-5b4ef7d462f9", + "layerType": "data", + "maxAccessor": "c17ea056-b0cd-4821-a97c-8682579757c3", + "metricAccessor": "2d62dcb1-64ad-46b4-9909-34975f4409ab" + } + }, + "title": "Storage Table Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "4177a6e6-97d7-447e-bcf3-ee9c1d660bd8", "w": 5, - "x": 19, - "y": 0 + "x": 5, + "y": 5 }, "panelIndex": "4177a6e6-97d7-447e-bcf3-ee9c1d660bd8", - "panelRefName": "panel_4177a6e6-97d7-447e-bcf3-ee9c1d660bd8", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Table Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "562fb6db-df95-4ee2-b9b6-021ecaf2aba0": { + "columnOrder": [ + "fa522977-cc94-4c29-b0fd-812045d19c42", + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX0", + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX1", + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3e" + ], + "columns": { + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3e": { + "dataType": "number", + "isBucketed": false, + "label": "overall_max(average(azure.storage_account.table_entity_count.avg))", + "operationType": "formula", + "params": { + "formula": "overall_max(average(azure.storage_account.table_entity_count.avg))", + "isFormulaBroken": false + }, + "references": [ + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX1" + ], + "scale": "ratio" + }, + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_entity_count.avg))", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_entity_count.avg" + }, + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of overall_max(average(azure.storage_account.table_entity_count.avg))", + "operationType": "overall_max", + "references": [ + "303b0b16-adb3-4fa9-bd7c-67dc742d8f3eX0" + ], + "scale": "ratio" + }, + "fa522977-cc94-4c29-b0fd-812045d19c42": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Table Entity Count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.table_entity_count.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-562fb6db-df95-4ee2-b9b6-021ecaf2aba0", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#68CCCA", + "layerId": "562fb6db-df95-4ee2-b9b6-021ecaf2aba0", + "layerType": "data", + "maxAccessor": "303b0b16-adb3-4fa9-bd7c-67dc742d8f3e", + "metricAccessor": "fa522977-cc94-4c29-b0fd-812045d19c42" + } + }, + "title": "Storage Table Entity Count [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, "i": "28d85d90-3881-4d1f-b60c-43b545fc9f0e", "w": 5, - "x": 24, - "y": 0 + "x": 10, + "y": 5 }, "panelIndex": "28d85d90-3881-4d1f-b60c-43b545fc9f0e", - "panelRefName": "panel_28d85d90-3881-4d1f-b60c-43b545fc9f0e", - "type": "visualization", - "version": "7.7.0" + "title": "Storage Table Entity Count [Azure Metrics]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "6ec5d19a-5b84-4f8a-951a-6b752989e5db": { + "columnOrder": [ + "1e1ec37f-3e5a-443b-8ec6-1eb681feb19b", + "2481e81f-e447-4eee-9c37-2ecd948035f2" + ], + "columns": { + "1e1ec37f-3e5a-443b-8ec6-1eb681feb19b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "2481e81f-e447-4eee-9c37-2ecd948035f2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Availability", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " %" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.availability.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-6ec5d19a-5b84-4f8a-951a-6b752989e5db", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.6, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2481e81f-e447-4eee-9c37-2ecd948035f2" + ], + "layerId": "6ec5d19a-5b84-4f8a-951a-6b752989e5db", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "1e1ec37f-3e5a-443b-8ec6-1eb681feb19b", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "2481e81f-e447-4eee-9c37-2ecd948035f2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Availability [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 9, - "i": "1d623c03-4d02-4a81-b91e-49e82e112016", - "w": 19, - "x": 29, - "y": 0 + "i": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "w": 14, + "x": 15, + "y": 5 }, - "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", - "panelRefName": "panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "title": "Transactions", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "a9456b9b-efa6-410d-a56c-4b66aa8c499e", + "title": "Availability", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "fdeea35c-0b85-4ce8-9148-6c340ed94aca": { + "columnOrder": [ + "ce2cd4a6-25e6-48f3-bb29-4c723e497688", + "e438b915-2c1f-47e4-ab09-aaa2a45dbf6e", + "dc02b832-60c4-4a37-8295-81ca9af56da5" + ], + "columns": { + "ce2cd4a6-25e6-48f3-bb29-4c723e497688": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc02b832-60c4-4a37-8295-81ca9af56da5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "avg(azure.storage_account.transactions.total)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "azure.storage_account.transactions.total" + }, + "e438b915-2c1f-47e4-ab09-aaa2a45dbf6e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.response_type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc02b832-60c4-4a37-8295-81ca9af56da5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.response_type" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-fdeea35c-0b85-4ce8-9148-6c340ed94aca", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc02b832-60c4-4a37-8295-81ca9af56da5" + ], + "layerId": "fdeea35c-0b85-4ce8-9148-6c340ed94aca", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "e438b915-2c1f-47e4-ab09-aaa2a45dbf6e", + "xAccessor": "ce2cd4a6-25e6-48f3-bb29-4c723e497688", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "dc02b832-60c4-4a37-8295-81ca9af56da5" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Transactions [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "w": 9, - "x": 0, + "h": 9, + "i": "1d623c03-4d02-4a81-b91e-49e82e112016", + "w": 19, + "x": 29, "y": 5 }, - "panelIndex": "ff6441f8-d66d-4399-bae5-25d3d861b299", - "panelRefName": "panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "1d623c03-4d02-4a81-b91e-49e82e112016", + "title": "Transactions", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ffffce6b-7ff2-4323-aace-756f6f71630e": { + "columnOrder": [ + "2f3e58ea-acff-4be1-bad4-ebc45bb62465", + "3b97b566-65b4-4c3c-bbcf-24aab6d57e17", + "727a5c36-c364-41c8-8b05-ae24da3122ec" + ], + "columns": { + "2f3e58ea-acff-4be1-bad4-ebc45bb62465": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "727a5c36-c364-41c8-8b05-ae24da3122ec", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "3b97b566-65b4-4c3c-bbcf-24aab6d57e17": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "727a5c36-c364-41c8-8b05-ae24da3122ec": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SuccessServerLatency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_server_latency.avg" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-ffffce6b-7ff2-4323-aace-756f6f71630e", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "727a5c36-c364-41c8-8b05-ae24da3122ec" + ], + "layerId": "ffffce6b-7ff2-4323-aace-756f6f71630e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "2f3e58ea-acff-4be1-bad4-ebc45bb62465", + "xAccessor": "3b97b566-65b4-4c3c-bbcf-24aab6d57e17", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "727a5c36-c364-41c8-8b05-ae24da3122ec" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success Server Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "87066244-7840-4555-9d12-026d64977f1a", - "w": 20, - "x": 9, - "y": 9 + "w": 24, + "x": 0, + "y": 14 }, "panelIndex": "87066244-7840-4555-9d12-026d64977f1a", - "panelRefName": "panel_87066244-7840-4555-9d12-026d64977f1a", "title": "Success Server Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "d47b5c9b-40f9-4a0e-acc5-d73058704ddc": { + "columnOrder": [ + "1f077c05-f392-41f8-9687-bf528926222c", + "fa2f0143-0dfe-4318-ade6-9e37b34d6785", + "77a4e9f4-1a06-46b4-b1a6-7ca0d8802e12" + ], + "columns": { + "1f077c05-f392-41f8-9687-bf528926222c": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "77a4e9f4-1a06-46b4-b1a6-7ca0d8802e12", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "77a4e9f4-1a06-46b4-b1a6-7ca0d8802e12": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Success E2E Latency (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": " ms" + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.success_e2elatency.avg" + }, + "fa2f0143-0dfe-4318-ade6-9e37b34d6785": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-d47b5c9b-40f9-4a0e-acc5-d73058704ddc", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "77a4e9f4-1a06-46b4-b1a6-7ca0d8802e12" + ], + "layerId": "d47b5c9b-40f9-4a0e-acc5-d73058704ddc", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "1f077c05-f392-41f8-9687-bf528926222c", + "xAccessor": "fa2f0143-0dfe-4318-ade6-9e37b34d6785", + "yConfig": [ + { + "axisMode": "left", + "color": "#3185FC", + "forAccessor": "77a4e9f4-1a06-46b4-b1a6-7ca0d8802e12" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Success E2E Latency [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, "i": "756da375-e6a2-4668-af43-0cd294878254", - "w": 19, - "x": 29, - "y": 9 + "w": 24, + "x": 24, + "y": 14 }, "panelIndex": "756da375-e6a2-4668-af43-0cd294878254", - "panelRefName": "panel_756da375-e6a2-4668-af43-0cd294878254", "title": "Success E2E Latency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e0f41a92-50ad-4209-b292-1f0c2d8db375": { + "columnOrder": [ + "323383ba-66eb-47fb-b730-d64adae78d9b", + "4b8f44d5-8fd6-4bbd-bdfc-e4fa2971b108", + "a5b3fe18-0281-4168-af20-34a06fd7f8ed" + ], + "columns": { + "323383ba-66eb-47fb-b730-d64adae78d9b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a5b3fe18-0281-4168-af20-34a06fd7f8ed", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "4b8f44d5-8fd6-4bbd-bdfc-e4fa2971b108": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a5b3fe18-0281-4168-af20-34a06fd7f8ed": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Egress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.egress.total" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e0f41a92-50ad-4209-b292-1f0c2d8db375", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a5b3fe18-0281-4168-af20-34a06fd7f8ed" + ], + "layerId": "e0f41a92-50ad-4209-b292-1f0c2d8db375", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "323383ba-66eb-47fb-b730-d64adae78d9b", + "xAccessor": "4b8f44d5-8fd6-4bbd-bdfc-e4fa2971b108", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,149,177,1)", + "forAccessor": "a5b3fe18-0281-4168-af20-34a06fd7f8ed" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Egress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "a715fafc-ca38-410c-9253-12ba506eabc0", - "w": 20, - "x": 9, - "y": 24 + "w": 24, + "x": 0, + "y": 29 }, "panelIndex": "a715fafc-ca38-410c-9253-12ba506eabc0", - "panelRefName": "panel_a715fafc-ca38-410c-9253-12ba506eabc0", "title": "Egress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "2d4ade86-4433-4eb8-962b-6f92900590dc": { + "columnOrder": [ + "98eae805-2650-4843-a347-e4ef37788a15", + "bbc8e243-6b26-4dee-9096-96a6ff5fe938", + "a2d3840e-d2ef-4510-a746-08b2f1085e1e" + ], + "columns": { + "98eae805-2650-4843-a347-e4ef37788a15": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of azure.dimensions.api_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2d3840e-d2ef-4510-a746-08b2f1085e1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "azure.dimensions.api_name" + }, + "a2d3840e-d2ef-4510-a746-08b2f1085e1e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Storage Accounts Ingress Total", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "azure.storage_account.ingress.total" + }, + "bbc8e243-6b26-4dee-9096-96a6ff5fe938": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "5m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-2d4ade86-4433-4eb8-962b-6f92900590dc", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a2d3840e-d2ef-4510-a746-08b2f1085e1e" + ], + "layerId": "2d4ade86-4433-4eb8-962b-6f92900590dc", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "98eae805-2650-4843-a347-e4ef37788a15", + "xAccessor": "bbc8e243-6b26-4dee-9096-96a6ff5fe938", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,188,0,1)", + "forAccessor": "a2d3840e-d2ef-4510-a746-08b2f1085e1e" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Storage Account Ingress Traffic [Azure Metrics] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, "i": "75f72920-be71-47a9-a967-f1c862ab2961", - "w": 19, - "x": 29, - "y": 24 + "w": 24, + "x": 24, + "y": 29 }, "panelIndex": "75f72920-be71-47a9-a967-f1c862ab2961", - "panelRefName": "panel_75f72920-be71-47a9-a967-f1c862ab2961", "title": "Ingress Traffic by APIName", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Azure Metrics] Table Storage Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-09-01T05:45:24.377Z", "id": "azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, "references": [ { @@ -237,59 +1622,19 @@ "type": "index-pattern" }, { - "id": "azure_metrics-fdef3f40-32f6-11ea-a83e-25b8612d00cc", - "name": "204cbabc-fafd-472c-b106-bd08f5262b1f:panel_204cbabc-fafd-472c-b106-bd08f5262b1f", - "type": "visualization" - }, - { - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "name": "a9456b9b-efa6-410d-a56c-4b66aa8c499e:panel_a9456b9b-efa6-410d-a56c-4b66aa8c499e", - "type": "visualization" - }, - { - "id": "azure_metrics-f528e6a0-339a-11ea-a83e-25b8612d00cc", - "name": "15b7c108-0214-4af6-9719-fab59affafec:panel_15b7c108-0214-4af6-9719-fab59affafec", - "type": "visualization" - }, - { - "id": "azure_metrics-43b31a20-339b-11ea-a83e-25b8612d00cc", - "name": "4177a6e6-97d7-447e-bcf3-ee9c1d660bd8:panel_4177a6e6-97d7-447e-bcf3-ee9c1d660bd8", - "type": "visualization" - }, - { - "id": "azure_metrics-5cbf5820-339c-11ea-a83e-25b8612d00cc", - "name": "28d85d90-3881-4d1f-b60c-43b545fc9f0e:panel_28d85d90-3881-4d1f-b60c-43b545fc9f0e", - "type": "visualization" - }, - { - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "name": "1d623c03-4d02-4a81-b91e-49e82e112016:panel_1d623c03-4d02-4a81-b91e-49e82e112016", - "type": "visualization" - }, - { - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "name": "ff6441f8-d66d-4399-bae5-25d3d861b299:panel_ff6441f8-d66d-4399-bae5-25d3d861b299", - "type": "visualization" - }, - { - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "name": "87066244-7840-4555-9d12-026d64977f1a:panel_87066244-7840-4555-9d12-026d64977f1a", - "type": "visualization" - }, - { - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "name": "756da375-e6a2-4668-af43-0cd294878254:panel_756da375-e6a2-4668-af43-0cd294878254", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_859278cd-7231-4483-9a14-5bd544d85949:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "name": "a715fafc-ca38-410c-9253-12ba506eabc0:panel_a715fafc-ca38-410c-9253-12ba506eabc0", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_5606188c-ad52-4ec8-9eb0-5816a7e45c11:optionsListDataView", + "type": "index-pattern" }, { - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "name": "75f72920-be71-47a9-a967-f1c862ab2961:panel_75f72920-be71-47a9-a967-f1c862ab2961", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_6f841590-bae1-4d83-8290-eb8d4e0e186f:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0241cc10-339d-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0241cc10-339d-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 2a88b6dde03..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0241cc10-339d-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Queue Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(164,221,0,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Queue Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.queue_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Queue Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0241cc10-339d-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-037382e0-856e-11ea-91bc-ab084c7ec0e7.json b/packages/azure_metrics/kibana/visualization/azure_metrics-037382e0-856e-11ea-91bc-ab084c7ec0e7.json deleted file mode 100644 index d6026e50c9d..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-037382e0-856e-11ea-91bc-ab084c7ec0e7.json +++ /dev/null @@ -1,223 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index" - } - }, - "title": " Database Account Requests By Status Code [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total Requests", - "field": "azure.database_account.total_requests.count" - }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Status Codes", - "field": "azure.dimensions.status_code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Database", - "field": "azure.dimensions.database_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "split", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": false, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": false, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "dimensions": { - "series": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "Status Codes", - "params": {} - } - ], - "splitColumn": [ - { - "accessor": 1, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "Database", - "params": {} - } - ], - "x": null, - "y": [ - { - "accessor": 2, - "aggType": "avg", - "format": { - "id": "number", - "params": { - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "Total Requests", - "params": {} - } - ] - }, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "row": false, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Total Requests" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Total Requests" - }, - "type": "value" - } - ] - }, - "title": " Database Account Requests By Status Code [Azure Metrics]", - "type": "histogram" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-037382e0-856e-11ea-91bc-ab084c7ec0e7", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-044b8940-ff5e-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-044b8940-ff5e-11eb-af1d-2505733a31f2.json deleted file mode 100644 index b3b307200e1..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-044b8940-ff5e-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Thread Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "914bafb0-ff5d-11eb-8d10-c71ba6abf264" - } - ], - "bar_color_rules": [ - { - "id": "8f566f60-ff5d-11eb-8d10-c71ba6abf264" - } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "gauge_color_rules": [ - { - "id": "8dae3da0-ff5d-11eb-8d10-c71ba6abf264" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "095723bb-6b35-4299-95b6-3b1e4fe567aa", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(231,102,76,1)", - "fill": 0.5, - "formatter": "number", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Thread Count Average", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.process_thread_count.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "top_n", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Thread Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-044b8940-ff5e-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-04f8eec0-6ab1-11ea-af5c-73e8f396b3e9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-04f8eec0-6ab1-11ea-af5c-73e8f396b3e9.json deleted file mode 100644 index 276799e8aac..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-04f8eec0-6ab1-11ea-af5c-73e8f396b3e9.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Instance CPU Utilization [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerInstance/containerGroups\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(164,221,0,1)", - "fill": "", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Azure Container CPU Utilization", - "line_width": "2", - "metrics": [ - { - "field": "azure.container_instance.cpu_usage.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Instance CPU Utilization [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-04f8eec0-6ab1-11ea-af5c-73e8f396b3e9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0892eaa0-ea9a-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0892eaa0-ea9a-11e9-90ec-112a988266d5.json deleted file mode 100644 index 70cc2de737e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0892eaa0-ea9a-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Disk Write Operations/s [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "number", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Write Operations/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.disk_write_operations_per_sec.avg", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Disk Write Operations/s [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0892eaa0-ea9a-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-097bc300-eaa5-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-097bc300-eaa5-11e9-90ec-112a988266d5.json deleted file mode 100644 index 50e76a0b164..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-097bc300-eaa5-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,136 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "ASP.NET Application Requests [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "be74e9e0-eaa4-11e9-8923-850d87d8e766", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(254,146,0,1)", - "fill": 0, - "formatter": "number", - "id": "be74e9e1-eaa4-11e9-8923-850d87d8e766", - "label": "timed out", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_requests_timed_out.avg", - "id": "be74e9e2-eaa4-11e9-8923-850d87d8e766", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#DB1374", - "fill": 0, - "formatter": "number", - "id": "be74e9e3-eaa4-11e9-8923-850d87d8e766", - "label": "failed", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_requests_failed.avg", - "id": "be74e9e4-eaa4-11e9-8923-850d87d8e766", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#00B3A4", - "fill": 0, - "formatter": "number", - "id": "be7510f0-eaa4-11e9-8923-850d87d8e766", - "label": "succeeded", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_requests_succeeded.avg", - "id": "be7510f1-eaa4-11e9-8923-850d87d8e766", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#490092", - "fill": 0, - "formatter": "number", - "id": "be7510f2-eaa4-11e9-8923-850d87d8e766", - "label": "total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_requests_total.avg", - "id": "be7510f3-eaa4-11e9-8923-850d87d8e766", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "ASP.NET Application Requests [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-097bc300-eaa5-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-09a6f150-3399-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-09a6f150-3399-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 0b0378d608e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-09a6f150-3399-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage File Share Snapshot Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,98,177,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "File Share Snapshot Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.file_share_snapshot_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage File Share Snapshot Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-09a6f150-3399-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-09f05e00-32f7-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-09f05e00-32f7-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 889b2397171..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-09f05e00-32f7-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Queue Storage Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 10, - "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [**Queue**](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", - "openLinksInNewTab": false - }, - "title": "Navigation Queue Storage Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-09f05e00-32f7-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0aacc190-eaa8-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0aacc190-eaa8-11e9-90ec-112a988266d5.json deleted file mode 100644 index 9f746ddf181..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0aacc190-eaa8-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "SQL Server User Connections [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\" " - }, - "id": "da495db0-eaa7-11e9-a88b-4b683ca3087b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, - "formatter": "number", - "id": "da495db1-eaa7-11e9-a88b-4b683ca3087b", - "label": "connections", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.sqlserver_general_statistics_user_connections.avg", - "id": "da495db2-eaa7-11e9-a88b-4b683ca3087b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "SQL Server User Connections [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0aacc190-eaa8-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0d03a670-eb43-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0d03a670-eb43-11e9-90ec-112a988266d5.json deleted file mode 100644 index 7c9ef8f6ce4..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0d03a670-eb43-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Disk Writes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,180,251,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Writes bytes", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.disk_write_bytes.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Disk Writes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0d03a670-eb43-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0d24a880-ff68-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0d24a880-ff68-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 0b864c5721c..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0d24a880-ff68-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Mem available [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "0fb3f4f8-aa8a-4aa0-9fbe-b0edf258db35", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(170,101,86,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Memory available", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.mem_per_available.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "complimentary", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Mem available [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0d24a880-ff68-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9.json deleted file mode 100644 index 6eaf220198f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9.json +++ /dev/null @@ -1,91 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Containers Filters [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "azure.subscription_id", - "id": "1584710440054", - "indexPatternRefName": "control_0_index_pattern", - "label": "Subscription", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1584710497045", - "indexPatternRefName": "control_1_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.name", - "id": "1584710535722", - "indexPatternRefName": "control_2_index_pattern", - "label": "Resource", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "Containers Filters [Azure Metrics]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-0fa31060-6aae-11ea-af5c-73e8f396b3e9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-109ec950-32e6-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-109ec950-32e6-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index babac6e1863..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-109ec950-32e6-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Used Capacity Resource Table [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Used Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.used_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "top_n", - "use_kibana_indexes": false - }, - "title": "Storage Used Capacity Resource Table [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-109ec950-32e6-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-160e5bd0-ff6d-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-160e5bd0-ff6d-11eb-af1d-2505733a31f2.json deleted file mode 100644 index ed98caa3af9..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-160e5bd0-ff6d-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Swap Used [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "e0973b16-3ae9-492b-a436-049bf60dbef5", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(96,146,192,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Swap used", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.swap_per_used.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "complimentary", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Swap Used [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-160e5bd0-ff6d-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-17ee2920-3391-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-17ee2920-3391-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 28a54fd708f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-17ee2920-3391-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Blob Capacity [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,156,224,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Blob Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.blob_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Blob Capacity [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-17ee2920-3391-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-1a61d870-ff62-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-1a61d870-ff62-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 81106787b17..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-1a61d870-ff62-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Process Working Set [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "47544067-6bb1-4de2-ae92-834d46582265", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Process Working Set", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.process_working_set.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Process Working Set [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-1a61d870-ff62-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-1e70dc50-6d22-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-1e70dc50-6d22-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index f2b28808e5f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-1e70dc50-6d22-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Container Registry Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Containers\n\n[Instances](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[**Registries**](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[Services](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", - "openLinksInNewTab": false - }, - "title": "Navigation Container Registry Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-1e70dc50-6d22-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-1e9d1bb0-ff63-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-1e9d1bb0-ff63-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 37421718b86..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-1e9d1bb0-ff63-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Memory Committed Bytes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "8851f76e-5376-4962-87c2-b17d7b27f3bd", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Memory committed bytes", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.memory_committed_bytes.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Memory Committed Bytes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-1e9d1bb0-ff63-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-1f5c1cd0-eaa3-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-1f5c1cd0-eaa3-11e9-90ec-112a988266d5.json deleted file mode 100644 index 731b29d05e1..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-1f5c1cd0-eaa3-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,86 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "ASP.NET Applications Running [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "04bf3740-eaa3-11e9-8742-b533e334ee9a" - } - ], - "bar_color_rules": [ - { - "id": "03eec7e0-eaa3-11e9-8742-b533e334ee9a" - } - ], - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "gauge_color_rules": [ - { - "id": "07485320-eaa3-11e9-8742-b533e334ee9a" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "d1acb8f0-eaa2-11e9-a229-c9171499dcc6", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": "0.2", - "formatter": "number", - "id": "d1acb8f1-eaa2-11e9-a229-c9171499dcc6", - "label": "applications running", - "line_width": "1", - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_running.avg", - "id": "d1acb8f2-eaa2-11e9-a229-c9171499dcc6", - "type": "max" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "ASP.NET Applications Running [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-1f5c1cd0-eaa3-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-2219de20-32ed-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-2219de20-32ed-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 7c84debe193..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-2219de20-32ed-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Egress Gauge [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Egress", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.egress.total", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Egress Gauge [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-2219de20-32ed-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-241a55e0-3399-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-241a55e0-3399-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 43ab3760df5..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-241a55e0-3399-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage File Share Snapshot Size [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,98,177,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "File Share Snapshot Size", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.file_share_snapshot_size.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage File Share Snapshot Size [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-241a55e0-3399-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-2bedaca0-339d-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-2bedaca0-339d-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 8c19ce15320..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-2bedaca0-339d-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Queue Message Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0a'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Queue Message Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.queue_message_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Queue Message Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-2bedaca0-339d-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-33500790-eaaf-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-33500790-eaaf-11e9-90ec-112a988266d5.json deleted file mode 100644 index e06aa933e31..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-33500790-eaaf-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS CPU Utilization [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "7666abc0-eaae-11e9-a083-57ad7f0b1ec1", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, - "formatter": "number", - "id": "7666abc1-eaae-11e9-a083-57ad7f0b1ec1", - "label": "avg(azure.compute_vm_scaleset.percentage_cpu.avg)", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.percentage_cpu.avg", - "id": "7666abc2-eaae-11e9-a083-57ad7f0b1ec1", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS CPU Utilization [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-33500790-eaaf-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-33d645e0-32ed-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-33d645e0-32ed-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index d74bf518371..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-33d645e0-32ed-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Ingress Gauge [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Ingress", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.ingress.total", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Ingress Gauge [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-33d645e0-32ed-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-3630b9a0-6d22-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-3630b9a0-6d22-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 9845db90760..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-3630b9a0-6d22-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Navigation Container Service Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Containers\n\n[Instances](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[Registries](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[**Services**](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", - "openLinksInNewTab": false - }, - "title": "Navigation Container Service Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-3630b9a0-6d22-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-3a50e950-eb46-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-3a50e950-eb46-11e9-90ec-112a988266d5.json deleted file mode 100644 index 3e76eb336b8..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-3a50e950-eb46-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Disk Read Operations/s [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "number", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Read Operations/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.disk_read_operations_per_sec.avg", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Disk Read Operations/s [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-3a50e950-eb46-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 736e5beb6e9..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,99 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Availability [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "background_color": "rgba(104,204,202,1)", - "id": "18f616c0-32e2-11ea-867b-37070aefa392", - "operator": "gte", - "value": 100 - }, - { - "background_color": "rgba(244,78,59,1)", - "id": "998b1c90-32e2-11ea-867b-37070aefa392", - "operator": "lt", - "value": 100 - } - ], - "bar_color_rules": [ - { - "id": "28142cf0-32e2-11ea-867b-37070aefa392" - } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "29808e30-32e2-11ea-867b-37070aefa392" - } - ], - "gauge_inner_width": "7", - "gauge_style": "circle", - "gauge_width": 10, - "id": "0e91b810-32e2-11ea-a93d-dd20c62559b3", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(22,165,165,1)", - "fill": "0.6", - "formatter": "number", - "hide_in_legend": 1, - "id": "0e91b811-32e2-11ea-a93d-dd20c62559b3", - "label": "Availability", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.availability.avg", - "id": "0e91b812-32e2-11ea-a93d-dd20c62559b3", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": null, - "type": "timeseries", - "value_template": "{{value}} %" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "last_value", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Availability [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-40dbc0d0-32e3-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-4177aab0-83cc-11ea-be84-f5d4d6b9a792.json b/packages/azure_metrics/kibana/visualization/azure_metrics-4177aab0-83cc-11ea-be84-f5d4d6b9a792.json deleted file mode 100644 index 832be6404f0..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-4177aab0-83cc-11ea-be84-f5d4d6b9a792.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Navigation Database Account Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Database Accounts\n", - "openLinksInNewTab": false - }, - "title": "Navigation Database Account Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-4177aab0-83cc-11ea-be84-f5d4d6b9a792", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-42cc28d0-ea9a-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-42cc28d0-ea9a-11e9-90ec-112a988266d5.json deleted file mode 100644 index 88f1883f823..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-42cc28d0-ea9a-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Disk Reads [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Read bytes", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.disk_read_bytes.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Disk Reads [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-42cc28d0-ea9a-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-43b31a20-339b-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-43b31a20-339b-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 35a89a48f2a..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-43b31a20-339b-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Table Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Table Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.table_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Table Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-43b31a20-339b-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-45344560-ff67-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-45344560-ff67-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 2260724a824..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-45344560-ff67-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute Guest CPU Usage Active [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "64599d87-7adf-47e3-893c-9a2ce48182b0", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "CPU Usage Active", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.cpu_per_usage_active.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute Guest CPU Usage Active [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-45344560-ff67-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-453965a0-3393-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-453965a0-3393-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 6e8c8de147f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-453965a0-3393-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage File Capacity [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "File Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.file_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage File Capacity [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-453965a0-3393-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-46ccce70-ff61-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-46ccce70-ff61-11eb-af1d-2505733a31f2.json deleted file mode 100644 index ae09db39d8c..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-46ccce70-ff61-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,142 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Network interface bytes/sec", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "6d634e20-ff60-11eb-8d10-c71ba6abf264" - } - ], - "bar_color_rules": [ - { - "id": "70b908d0-ff60-11eb-8d10-c71ba6abf264" - } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "gauge_color_rules": [ - { - "id": "72827e30-ff60-11eb-8d10-c71ba6abf264" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "20c8ad7b-ede0-40c2-a0b0-b6d7fe2ade2c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(96,146,192,1)", - "fill": "0.5", - "formatter": "bytes", - "hidden": false, - "hide_in_legend": 0, - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Network interface received bytes/sec", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.network_interface_bytes_received_per_sec.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "temperature", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "steps": 0, - "terms_field": "azure.resource.name", - "terms_order_by": "3c459779-ee47-438a-9931-c543e713478b", - "type": "timeseries", - "value_template": "{{value}}/s" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "fc394600-ff5f-11eb-8d10-c71ba6abf264", - "label": "Network interface sent bytes/sec", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.network_interface_bytes_sent_per_sec.avg", - "id": "fc394601-ff5f-11eb-8d10-c71ba6abf264", - "type": "avg" - } - ], - "palette": { - "name": "positive", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "19695990-ff60-11eb-8d10-c71ba6abf264" - } - ], - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}/s" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Network interface bytes/sec", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-46ccce70-ff61-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-46dd8ff0-ff64-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-46dd8ff0-ff64-11eb-af1d-2505733a31f2.json deleted file mode 100644 index ea1094d5f6a..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-46dd8ff0-ff64-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Available Memory [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "519576cd-f5e4-48d0-a598-5e09fe30b8ef", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Available memory", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.memory_available_bytes.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Available Memory [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-46dd8ff0-ff64-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-4bbd6f50-feaf-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/visualization/azure_metrics-4bbd6f50-feaf-11eb-8fff-87871c582eca.json deleted file mode 100644 index 623bef9735e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-4bbd6f50-feaf-11eb-8fff-87871c582eca.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Compute VM Guest ASP.NET \u0026 SQL Server Guest Metrics [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Guest ASP.NET \u0026 SQL Server Metrics\n\n[Back to Overview Metrics](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [Memory \u0026 Process](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [**ASP.NET and SQL Server**](#/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5) ", - "openLinksInNewTab": false - }, - "title": "Navigation Compute VM Guest ASP.NET \u0026 SQL Server Guest Metrics [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-4bbd6f50-feaf-11eb-8fff-87871c582eca", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-4c2cb860-ff5e-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-4c2cb860-ff5e-11eb-af1d-2505733a31f2.json deleted file mode 100644 index aa4f049d0bd..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-4c2cb860-ff5e-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,89 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Handle Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "30de8430-ff5e-11eb-8d10-c71ba6abf264" - } - ], - "bar_color_rules": [ - { - "id": "314eab20-ff5e-11eb-8d10-c71ba6abf264" - } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "18a8b235-96dd-4eec-889b-15a487d62956", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(211,96,134,1)", - "fill": 0.5, - "formatter": "number", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Handle Count Average", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.process_handle_count.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "top_n", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Handle Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-4c2cb860-ff5e-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 24fa71d7012..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Account Ingress Traffic [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0791c5a0-32d8-11ea-98d2-1194b9f2bfc0" - } - ], - "bar_color_rules": [ - { - "id": "fca016e0-32de-11ea-a435-e7199eba380d" - } - ], - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "fb8be7c0-32de-11ea-a435-e7199eba380d" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "f0edca80-32d5-11ea-b19d-fb5049b980ca", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,188,0,1)", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "hidden": false, - "id": "f0edf190-32d5-11ea-b19d-fb5049b980ca", - "label": "Storage Accounts Ingress Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.ingress.total", - "id": "f0edf191-32d5-11ea-b19d-fb5049b980ca", - "type": "max" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_filters": [ - { - "color": "rgba(0,98,177,1)", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "283dc410-32d9-11ea-98d2-1194b9f2bfc0" - } - ], - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.api_name", - "terms_order_by": "f0edf191-32d5-11ea-b19d-fb5049b980ca", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Account Ingress Traffic [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-4eaef260-32e1-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-4fa6b100-ff6b-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-4fa6b100-ff6b-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 3500bed0824..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-4fa6b100-ff6b-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Diskio Write Bytes [Azure metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "1f539c7c-0bf8-4abe-ad51-063944c4ab87", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Diskio Write bytes", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.diskio_per_write_bytes.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Diskio Write Bytes [Azure metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-4fa6b100-ff6b-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5.json deleted file mode 100644 index 8a566af5267..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,97 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "VM Filters [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1549397251041", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1549512142947", - "indexPatternRefName": "control_1_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.name", - "id": "1570774891724", - "indexPatternRefName": "control_2_index_pattern", - "label": "VM Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "VM Filters [Azure Metrics]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-5031b220-eb61-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index af068d3a366..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,70 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Transactions [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "c9fd65d0-32e8-11ea-84f4-e9593f8ba8f6", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "#3185FC", - "fill": 0.5, - "formatter": "number", - "id": "c9fd8ce0-32e8-11ea-84f4-e9593f8ba8f6", - "label": "avg(azure.storage_account.transactions.total)", - "line_width": "1", - "metrics": [ - { - "field": "azure.storage_account.transactions.total", - "id": "c9fd8ce1-32e8-11ea-84f4-e9593f8ba8f6", - "type": "max" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.response_type", - "terms_order_by": "c9fd8ce1-32e8-11ea-84f4-e9593f8ba8f6", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Transactions [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-553f9320-32e9-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-55936920-3391-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-55936920-3391-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index cee3f6c2644..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-55936920-3391-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Blob Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,156,224,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Blob Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.blob_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Blob Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-55936920-3391-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-5720b830-6aad-11ea-af5c-73e8f396b3e9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-5720b830-6aad-11ea-af5c-73e8f396b3e9.json deleted file mode 100644 index df5c0706e3f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-5720b830-6aad-11ea-af5c-73e8f396b3e9.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Navigation Container Instance Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Containers\n\n[**Instances**](#/dashboard/azure_metrics-9c11ac60-6cf6-11ea-8fe8-71add5fd7c38) |\n[Registries](#/dashboard/azure_metrics-72fe31e7-ea7d-4796-94d1-8f0a091904e2) |\n[Services](#/dashboard/azure_metrics-dae20ed0-6d0a-11ea-8fe8-71add5fd7c38) ", - "openLinksInNewTab": false - }, - "title": "Navigation Container Instance Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-5720b830-6aad-11ea-af5c-73e8f396b3e9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-58baa240-ff68-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-58baa240-ff68-11eb-af1d-2505733a31f2.json deleted file mode 100644 index aae1783ceee..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-58baa240-ff68-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Memory used [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "3b6b4d67-082c-4253-98f2-23cfda52c7b7", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(231,102,76,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Memory used", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.mem_per_used.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "negative", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Memory used [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-58baa240-ff68-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 00ad8d91456..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Account Egress Traffic [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0791c5a0-32d8-11ea-98d2-1194b9f2bfc0" - } - ], - "bar_color_rules": [ - { - "id": "fca016e0-32de-11ea-a435-e7199eba380d" - } - ], - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "fb8be7c0-32de-11ea-a435-e7199eba380d" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "f0edca80-32d5-11ea-b19d-fb5049b980ca", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,149,177,1)", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "hidden": false, - "id": "f0edf190-32d5-11ea-b19d-fb5049b980ca", - "label": "Storage Accounts Egress Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.egress.total", - "id": "f0edf191-32d5-11ea-b19d-fb5049b980ca", - "type": "max" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_filters": [ - { - "color": "rgba(0,98,177,1)", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "283dc410-32d9-11ea-98d2-1194b9f2bfc0" - } - ], - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.api_name", - "terms_order_by": "f0edf191-32d5-11ea-b19d-fb5049b980ca", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Account Egress Traffic [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-599c62c0-32d7-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-59b69c30-ff6d-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-59b69c30-ff6d-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 80bb96419b7..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-59b69c30-ff6d-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Swap Free [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "bac46e14-eff0-4cd7-b441-085064a59c91", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Swap Free", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.swap_per_free.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "status", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Swap Free [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-59b69c30-ff6d-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-5c016810-ea9a-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-5c016810-ea9a-11e9-90ec-112a988266d5.json deleted file mode 100644 index 3ceec4b8f79..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-5c016810-ea9a-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Disk Writes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Writes bytes", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.disk_write_bytes.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Disk Writes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-5c016810-ea9a-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-5cbf5820-339c-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-5cbf5820-339c-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index bc5c1f39457..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-5cbf5820-339c-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Table Entity Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0a'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Table Entity Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.table_entity_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Table Entity Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-5cbf5820-339c-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-634b83c0-32ee-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-634b83c0-32ee-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 27898c2f261..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-634b83c0-32ee-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Used Capacity [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Used Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.used_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Used Capacity [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-634b83c0-32ee-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-64266ec0-eb42-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-64266ec0-eb42-11e9-90ec-112a988266d5.json deleted file mode 100644 index e7ac5b4f0fe..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-64266ec0-eb42-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Network In Total [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "Azure VMSS Network In Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.network_in_total.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Network In Total [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-64266ec0-eb42-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-674c1d70-83cc-11ea-be84-f5d4d6b9a792.json b/packages/azure_metrics/kibana/visualization/azure_metrics-674c1d70-83cc-11ea-be84-f5d4d6b9a792.json deleted file mode 100644 index 978b4d51127..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-674c1d70-83cc-11ea-be84-f5d4d6b9a792.json +++ /dev/null @@ -1,111 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Filters [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "azure.subscription_id", - "id": "1584710440054", - "indexPatternRefName": "control_0_index_pattern", - "label": "Subscription", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1584710497045", - "indexPatternRefName": "control_1_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.name", - "id": "1584710535722", - "indexPatternRefName": "control_2_index_pattern", - "label": "Resource", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.dimensions.database_name", - "id": "1587643606086", - "indexPatternRefName": "control_3_index_pattern", - "label": "Database", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "1584710535722", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "Database Account Filters [Azure Metrics]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-674c1d70-83cc-11ea-be84-f5d4d6b9a792", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_3_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 0ac7d74962e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,70 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Success E2E Latency [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "da4459b0-32ea-11ea-be35-cb10be813609", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "#3185FC", - "fill": 0.5, - "formatter": "number", - "id": "da4459b1-32ea-11ea-be35-cb10be813609", - "label": "Success E2E Latency (ms)", - "line_width": "1", - "metrics": [ - { - "field": "azure.storage_account.success_e2elatency.avg", - "id": "da4459b2-32ea-11ea-be35-cb10be813609", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.api_name", - "terms_order_by": "da4459b2-32ea-11ea-be35-cb10be813609", - "type": "timeseries", - "value_template": "{{value}} ms" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Success E2E Latency [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-685fbeb0-32eb-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-686bc990-ea92-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-686bc990-ea92-11e9-90ec-112a988266d5.json deleted file mode 100644 index 0ed079c7edd..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-686bc990-ea92-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,97 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "VMSS Filters [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "cloud.region", - "id": "1549397251041", - "indexPatternRefName": "control_0_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1549512142947", - "indexPatternRefName": "control_1_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.dimensions.vmname", - "id": "1570711989416", - "indexPatternRefName": "control_2_index_pattern", - "label": "VM Name (dimension)", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "VMSS Filters [Azure Metrics]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-686bc990-ea92-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-6d52a660-eaa4-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-6d52a660-eaa4-11e9-90ec-112a988266d5.json deleted file mode 100644 index d4933c6661b..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-6d52a660-eaa4-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,71 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "ASP.NET Application Error Rates [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "29576400-eaa4-11e9-a2d3-e7a00bbd3c18", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(244,78,59,1)", - "fill": "0.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "29578b10-eaa4-11e9-a2d3-e7a00bbd3c18", - "label": "errors", - "line_width": "1", - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_errors_total.avg", - "id": "29578b11-eaa4-11e9-a2d3-e7a00bbd3c18", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "ASP.NET Application Error Rates [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-6d52a660-eaa4-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-6e2d9930-6d1e-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-6e2d9930-6d1e-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 684fa078c23..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-6e2d9930-6d1e-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Service Kube Node Status Allocatable CPU Cores [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(196,81,0,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Service Kube Node Status Allocatable CPU Cores", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_service.kube_node_status_allocatable_cpu_cores.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Service Kube Node Status Allocatable CPU Cores [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-6e2d9930-6d1e-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-707d2660-ff62-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-707d2660-ff62-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 7e29eff3d01..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-707d2660-ff62-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,87 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Process Working Set Private", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "e90f7dab-0656-40d2-b1e0-f669895c3896", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(145,112,184,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Process Working Set Private", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.process_working_set_private.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "gradient", - "params": { - "colors": [ - "rgba(145,112,184,1)", - "rgb(92, 63, 126)" - ], - "gradient": true - }, - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Process Working Set Private", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-707d2660-ff62-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-7205a4f0-ea95-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-7205a4f0-ea95-11e9-90ec-112a988266d5.json deleted file mode 100644 index ad36ad1ddef..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-7205a4f0-ea95-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Available Memory [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "c7e12030-ea94-11e9-bf06-bfc27258c9ad", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": 0, - "formatter": "bytes", - "id": "c7e12031-ea94-11e9-bf06-bfc27258c9ad", - "label": "VM Available Memory", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.available_memory_bytes.avg", - "id": "c7e12032-ea94-11e9-bf06-bfc27258c9ad", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Available Memory [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-7205a4f0-ea95-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-722ef2f0-3393-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-722ef2f0-3393-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 4a48009c5b9..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-722ef2f0-3393-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage File Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(164,221,0,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "File Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.file_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage File Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-722ef2f0-3393-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-74a8e130-6cfa-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-74a8e130-6cfa-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 80ba6d76775..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-74a8e130-6cfa-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Instance Network Bytes Transmitted/s [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": "0", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerInstance/containerGroups\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(128,137,0,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Instance Network Bytes Transmitted/s", - "line_width": "2", - "metrics": [ - { - "field": "azure.container_instance.network_bytes_transmitted_per_second.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Instance Network Bytes Transmitted/s [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-74a8e130-6cfa-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-787a0a20-eaa8-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-787a0a20-eaa8-11e9-90ec-112a988266d5.json deleted file mode 100644 index 9790eeb223d..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-787a0a20-eaa8-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,90 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "SQL Server Page Reads/Writes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "35459a30-eaa8-11e9-a379-c33a712c0373", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "number", - "id": "35459a31-eaa8-11e9-a379-c33a712c0373", - "label": "Page Reads/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.sqlserver_buffer_manager_page_reads_per_sec.avg", - "id": "35459a32-eaa8-11e9-a379-c33a712c0373", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": 0, - "formatter": "number", - "id": "35459a33-eaa8-11e9-a379-c33a712c0373", - "label": "Page Writes/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.sqlserver_buffer_manager_page_writes_per_sec.avg", - "id": "35459a34-eaa8-11e9-a379-c33a712c0373", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "SQL Server Page Reads/Writes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-787a0a20-eaa8-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-7972b260-6d07-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-7972b260-6d07-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 0c3ecadc434..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-7972b260-6d07-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Registry Successful Pull Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(188,74,0,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Registry Successful Pull Count", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_registry.successful_pull_count.total", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Registry Successful Pull Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-7972b260-6d07-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-7ddc8350-ff67-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-7ddc8350-ff67-11eb-af1d-2505733a31f2.json deleted file mode 100644 index d3eb300ce22..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-7ddc8350-ff67-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest CPU Usage Idle [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "816f9129-cb91-44c8-9ea5-45633f4b9b64", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "CPU Usage Idle", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.cpu_per_usage_idle.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest CPU Usage Idle [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-7ddc8350-ff67-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 273a93160f8..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,70 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Success Server Latency [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "#3185FC", - "fill": 0.5, - "formatter": "number", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "SuccessServerLatency (ms)", - "line_width": "1", - "metrics": [ - { - "field": "azure.storage_account.success_server_latency.avg", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.api_name", - "terms_order_by": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "timeseries", - "value_template": "{{value}} ms" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Storage Success Server Latency [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d11cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d11cc.json deleted file mode 100644 index b67dc024d74..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d11cc.json +++ /dev/null @@ -1,71 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Available Storage [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\" " - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(101,50,148,1)", - "fill": "0", - "formatter": "bytes", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "Available storage", - "line_width": "2", - "metrics": [ - { - "field": "azure.database_account.available_storage.total", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "\"\u003cempty\u003e\"", - "terms_field": "azure.dimensions.database_name", - "terms_order_by": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Database Account Available Storage [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-81f16b40-32ea-11ea-a83e-25b8612d11cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-8b6b9450-ea99-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-8b6b9450-ea99-11e9-90ec-112a988266d5.json deleted file mode 100644 index 01af3ee8e43..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-8b6b9450-ea99-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Network In Total [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "Azure VM Network In Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.network_in_total.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Network In Total [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-8b6b9450-ea99-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-942844b0-6ac5-11ea-af5c-73e8f396b3e9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-942844b0-6ac5-11ea-af5c-73e8f396b3e9.json deleted file mode 100644 index 999fa79ee34..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-942844b0-6ac5-11ea-af5c-73e8f396b3e9.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Instance Memory Utilization [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": "0", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerInstance/containerGroups\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Instance Memory Utilization", - "line_width": "2", - "metrics": [ - { - "field": "azure.container_instance.memory_usage.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Instance Memory Utilization [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-942844b0-6ac5-11ea-af5c-73e8f396b3e9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-94be5bc0-feae-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/visualization/azure_metrics-94be5bc0-feae-11eb-8fff-87871c582eca.json deleted file mode 100644 index 245a81b8bb2..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-94be5bc0-feae-11eb-8fff-87871c582eca.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Compute VM Memory \u0026 Process Metrics [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Guest Metrics for Windows VM's\n\n[Back to Overview](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [**Memory \u0026 Process**](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [ASP.NET and SQL Server](#/dashboard/azure_metrics-a6f5d430-eaa6-11e9-90ec-112a988266d5) ", - "openLinksInNewTab": false - }, - "title": "Navigation Compute VM Memory \u0026 Process Metrics [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-94be5bc0-feae-11eb-8fff-87871c582eca", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-9c1a1910-ea9a-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-9c1a1910-ea9a-11e9-90ec-112a988266d5.json deleted file mode 100644 index edb9d901773..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-9c1a1910-ea9a-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Disk Read Operations [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "number", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Read Operations/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.disk_read_operations_per_sec.avg", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Disk Read Operations [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-9c1a1910-ea9a-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-9e991b10-3391-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-9e991b10-3391-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 4cdd05134a0..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-9e991b10-3391-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Container Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,188,0,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Container Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.container_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Container Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-9e991b10-3391-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-a16b5900-8492-11ea-b181-4b1a9e0110f9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-a16b5900-8492-11ea-b181-4b1a9e0110f9.json deleted file mode 100644 index 7135a9affac..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-a16b5900-8492-11ea-b181-4b1a9e0110f9.json +++ /dev/null @@ -1,75 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Total Requests [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\" " - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(211,49,21,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "Total Requests", - "line_width": "2", - "metrics": [ - { - "field": "azure.database_account.total_requests.count", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "\"\u003cempty\u003e\"", - "terms_field": "azure.dimensions.database_name", - "terms_order_by": "_count", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Database Account Total Requests [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-a16b5900-8492-11ea-b181-4b1a9e0110f9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-a49b4e20-8490-11ea-b181-4b1a9e0110f9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-a49b4e20-8490-11ea-b181-4b1a9e0110f9.json deleted file mode 100644 index 3cfd440155e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-a49b4e20-8490-11ea-b181-4b1a9e0110f9.json +++ /dev/null @@ -1,75 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Data Usage [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\" " - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "Data Usage", - "line_width": "2", - "metrics": [ - { - "field": "azure.database_account.data_usage.total", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "\"\u003cempty\u003e\"", - "terms_field": "azure.dimensions.database_name", - "terms_order_by": "_count", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Database Account Data Usage [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-a49b4e20-8490-11ea-b181-4b1a9e0110f9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-a4bf9710-3393-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-a4bf9710-3393-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index b9b61b2ef43..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-a4bf9710-3393-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,96 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage File Share Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(164,221,0,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "'0'", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "File Share Count", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.file_share_count.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage File Share Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-a4bf9710-3393-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-abd32c30-ea99-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-abd32c30-ea99-11e9-90ec-112a988266d5.json deleted file mode 100644 index 45ded17856a..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-abd32c30-ea99-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Network Out Total [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(115,216,255,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "Azure VM Network Out Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.network_out_total.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Network Out Total [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-abd32c30-ea99-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 53bc1461128..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,97 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Storage Filters [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "azure.subscription_id", - "id": "1549397251041", - "indexPatternRefName": "control_0_index_pattern", - "label": "Subscription", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.group", - "id": "1549512142947", - "indexPatternRefName": "control_1_index_pattern", - "label": "Resource Group", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "azure.resource.name", - "id": "1578578146383", - "indexPatternRefName": "control_2_index_pattern", - "label": "Resource Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "Storage Filters [Azure Metrics]", - "type": "input_control_vis" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-acced050-32d1-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_2_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-b45fd8e0-eb42-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-b45fd8e0-eb42-11e9-90ec-112a988266d5.json deleted file mode 100644 index c6edab2685c..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-b45fd8e0-eb42-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Network Out Total [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,188,0,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "Azure VM Network Out Total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.network_out_total.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Network Out Total [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-b45fd8e0-eb42-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-b5aad170-ff66-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-b5aad170-ff66-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 1fb081c171c..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-b5aad170-ff66-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM net/bytes sent/recv [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "b71eb3c5-1305-430d-a202-194bde6b17ce", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "net/bytes sent", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.net_per_bytes_sent.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(170,101,86,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "7fd45120-ff66-11eb-8d10-c71ba6abf264", - "label": "net/bytes received", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.net_per_bytes_recv.avg", - "id": "7fd45121-ff66-11eb-8d10-c71ba6abf264", - "type": "avg" - } - ], - "palette": { - "name": "gradient", - "params": { - "colors": [ - "rgba(170,101,86,1)", - "rgb(108, 64, 54)" - ], - "gradient": true - }, - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM net/bytes sent/recv [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-b5aad170-ff66-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-b88b7f90-6d07-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-b88b7f90-6d07-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 5b96d8e540b..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-b88b7f90-6d07-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Registry Successful Push Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(128,137,0,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Registry Successful Push Count", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_registry.successful_push_count.total", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Registry Successful Push Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-b88b7f90-6d07-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-b9aa9b20-eaa5-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-b9aa9b20-eaa5-11e9-90ec-112a988266d5.json deleted file mode 100644 index a55f32dd332..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-b9aa9b20-eaa5-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,136 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "ASP.NET Application Sessions [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "6d6575a0-eaa5-11e9-84ad-5919a47b8f34", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, - "formatter": "number", - "id": "6d6575a1-eaa5-11e9-84ad-5919a47b8f34", - "label": "active", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_sessions_active.avg", - "id": "6d6575a2-eaa5-11e9-84ad-5919a47b8f34", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#DB1374", - "fill": 0, - "formatter": "number", - "id": "6d6575a3-eaa5-11e9-84ad-5919a47b8f34", - "label": "timed out", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_sessions_timed_out.avg", - "id": "6d6575a4-eaa5-11e9-84ad-5919a47b8f34", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#00B3A4", - "fill": 0, - "formatter": "number", - "id": "6d6575a5-eaa5-11e9-84ad-5919a47b8f34", - "label": "abandoned", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_sessions_abandoned.avg", - "id": "6d6575a6-eaa5-11e9-84ad-5919a47b8f34", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#490092", - "fill": 0, - "formatter": "number", - "id": "6d6575a7-eaa5-11e9-84ad-5919a47b8f34", - "label": "total", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.asp_net_applications_sessions_total.avg", - "id": "6d6575a8-eaa5-11e9-84ad-5919a47b8f34", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "ASP.NET Application Sessions [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-b9aa9b20-eaa5-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-bcb236a0-feaf-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/visualization/azure_metrics-bcb236a0-feaf-11eb-8fff-87871c582eca.json deleted file mode 100644 index 9783d51fc5b..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-bcb236a0-feaf-11eb-8fff-87871c582eca.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Guest Linux Metrics Compute VM [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Compute VM \n\n[Back to Overview](#/dashboard/azure_metrics-eb3f05f0-ea9a-11e9-90ec-112a988266d5) | [**Guest Linux VM Metrics**](#/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca) ", - "openLinksInNewTab": false - }, - "title": "Navigation Guest Linux Metrics Compute VM [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-bcb236a0-feaf-11eb-8fff-87871c582eca", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-bd1c93b0-6cf7-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-bd1c93b0-6cf7-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 24c40a76914..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-bd1c93b0-6cf7-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Instance Network Bytes Received/s [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": "0", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerInstance/containerGroups\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(251,158,0,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Instance Network Bytes Received/s", - "line_width": "2", - "metrics": [ - { - "field": "azure.container_instance.network_bytes_received_per_second.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Instance Network Bytes Received/s [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-bd1c93b0-6cf7-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-bda7b580-6d1f-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-bda7b580-6d1f-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index e1e33bb3554..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-bda7b580-6d1f-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Service Kube Pod Status Phase [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0d772fb0-6d1f-11ea-a156-a582cfb250e8" - } - ], - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\" " - }, - "gauge_color_rules": [ - { - "id": "0ba507c0-6d1f-11ea-a156-a582cfb250e8" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(240,213,175,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Service Kube Pod Status Phase", - "line_width": "2", - "metrics": [ - { - "field": "azure.container_service.kube_pod_status_phase.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "00", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.pod" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Service Kube Pod Status Phase [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-bda7b580-6d1f-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-c19586f0-6d1e-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-c19586f0-6d1e-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index e203bde1647..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-c19586f0-6d1e-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Service Kube Pod Status Ready [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(200,205,124,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_service.kube_pod_status_ready.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.dimensions.pod", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Service Kube Pod Status Ready [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-c19586f0-6d1e-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-c8a33540-ff5e-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-c8a33540-ff5e-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 3c6b47dcd74..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-c8a33540-ff5e-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,89 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Process Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "aa681a50-ff5e-11eb-8d10-c71ba6abf264" - } - ], - "bar_color_rules": [ - { - "id": "aad1d8a0-ff5e-11eb-8d10-c71ba6abf264" - } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Windows.GuestMetrics\" " - }, - "id": "de3aa68a-00d9-4578-ad37-c2f7943b4243", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(202,142,174,1)", - "fill": 0.5, - "formatter": "number", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Process Count Average", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.system_processes.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "top_n", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Process Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-c8a33540-ff5e-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-cecd6680-eb41-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-cecd6680-eb41-11e9-90ec-112a988266d5.json deleted file mode 100644 index 54a28806cea..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-cecd6680-eb41-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Available Memory [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "e25fa710-eb3e-11e9-8bf6-ff656bce9010", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(22,165,165,1)", - "fill": 0, - "formatter": "bytes", - "id": "e25fa711-eb3e-11e9-8bf6-ff656bce9010", - "label": "avg(azure.compute_vm_scaleset.available_memory_bytes.avg)", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.available_memory_bytes.avg", - "id": "e25fa712-eb3e-11e9-8bf6-ff656bce9010", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Available Memory [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-cecd6680-eb41-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-cfaedaf0-eb43-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-cfaedaf0-eb43-11e9-90ec-112a988266d5.json deleted file mode 100644 index 30ba9cbde19..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-cfaedaf0-eb43-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VMSS Disk Write Operations [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachineScaleSets\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": 0, - "formatter": "number", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Write Operations/s", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm_scaleset.disk_write_operations_per_sec.avg", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VMSS Disk Write Operations [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-cfaedaf0-eb43-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-d2801d70-8490-11ea-b181-4b1a9e0110f9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-d2801d70-8490-11ea-b181-4b1a9e0110f9.json deleted file mode 100644 index 63187d1fb1d..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-d2801d70-8490-11ea-b181-4b1a9e0110f9.json +++ /dev/null @@ -1,75 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Index Usage [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\" " - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "Index Usage", - "line_width": "2", - "metrics": [ - { - "field": "azure.database_account.index_usage.total", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "\"\u003cempty\u003e\"", - "terms_field": "azure.dimensions.database_name", - "terms_order_by": "_count", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Database Account Index Usage [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-d2801d70-8490-11ea-b181-4b1a9e0110f9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-d3ac7d90-8492-11ea-b181-4b1a9e0110f9.json b/packages/azure_metrics/kibana/visualization/azure_metrics-d3ac7d90-8492-11ea-b181-4b1a9e0110f9.json deleted file mode 100644 index 524a5c2fdaa..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-d3ac7d90-8492-11ea-b181-4b1a9e0110f9.json +++ /dev/null @@ -1,75 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Database Account Document Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.DocumentDb/databaseAccounts\" " - }, - "id": "e9a40230-32e9-11ea-bda2-69435df36a5c", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(102,102,102,1)", - "fill": "0", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "e9a40231-32e9-11ea-bda2-69435df36a5c", - "label": "Document Count", - "line_width": "2", - "metrics": [ - { - "field": "azure.database_account.document_count.total", - "id": "e9a40232-32e9-11ea-bda2-69435df36a5c", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "\"\u003cempty\u003e\"", - "terms_field": "azure.dimensions.database_name", - "terms_order_by": "_count", - "type": "timeseries", - "value_template": "{{value}} " - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Database Account Document Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-d3ac7d90-8492-11ea-b181-4b1a9e0110f9", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-d7ea4290-eaa8-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-d7ea4290-eaa8-11e9-90ec-112a988266d5.json deleted file mode 100644 index 34a4f88bdbe..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-d7ea4290-eaa8-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "SQL Server Total Server Memory [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type:\"Microsoft.Compute/virtualMachines\" " - }, - "id": "94af6a00-eaa8-11e9-9269-d92e2d3f77fd", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#3185FC", - "fill": 0, - "formatter": "bytes", - "id": "94af6a01-eaa8-11e9-9269-d92e2d3f77fd", - "label": "memory", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.sqlserver_memory_manager_total_server_memory.avg", - "id": "94af6a02-eaa8-11e9-9269-d92e2d3f77fd", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "SQL Server Total Server Memory [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-d7ea4290-eaa8-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-db9a3490-ea8f-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-db9a3490-ea8f-11e9-90ec-112a988266d5.json deleted file mode 100644 index 7caeec61178..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-db9a3490-ea8f-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM CPU Utilization [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.Compute/virtualMachines\" " - }, - "id": "4f6c1610-ea8e-11e9-8c73-71740bcf3d8b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "4f6c1611-ea8e-11e9-8c73-71740bcf3d8b", - "label": "Azure VM CPU Utilization", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.percentage_cpu.avg", - "id": "4f6c1612-ea8e-11e9-8c73-71740bcf3d8b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "value_template": "{{value}}%" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM CPU Utilization [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-db9a3490-ea8f-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-ddea7430-6d07-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-ddea7430-6d07-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 6b92effe301..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-ddea7430-6d07-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Registry Total Push Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Registry Total Push Count", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_registry.total_push_count.total", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Registry Total Push Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-ddea7430-6d07-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-e159b990-339c-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-e159b990-339c-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 0f89b222df6..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-e159b990-339c-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Queue Capacity [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Queue Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.queue_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Queue Capacity [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-e159b990-339c-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-e4b25ee0-32f6-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-e4b25ee0-32f6-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index d0b28f28315..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-e4b25ee0-32f6-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Blob Storage Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 10, - "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [**Blob**](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", - "openLinksInNewTab": false - }, - "title": "Navigation Blob Storage Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-e4b25ee0-32f6-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-e79211c0-6d37-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-e79211c0-6d37-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index f20c8146e7f..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-e79211c0-6d37-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,232 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index" - } - }, - "title": "Container Service Kube Node Status Condition [Azure Metrics]", - "uiStateJSON": { - "vis": { - "defaultColors": { - "0 - 0.2": "rgb(165,0,38)", - "0.2 - 0.4": "rgb(244,109,67)", - "0.4 - 0.6": "rgb(254,224,139)", - "0.6 - 0.8": "rgb(217,239,139)", - "0.8 - 1": "rgb(102,189,99)" - }, - "legendOpen": true - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "field": "azure.container_service.kube_node_status_condition.avg" - }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "2", - "params": { - "filters": [ - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"Ready\" and azure.dimensions.status : \"true\" " - }, - "label": "Ready \"true\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"Ready\" and azure.dimensions.status : \"false\" " - }, - "label": "Ready \"false\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"NetworkUnavailable\" and azure.dimensions.status : \"true\" " - }, - "label": "Network Unavailable \"true\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"NetworkUnavailable\" and azure.dimensions.status : \"false\" " - }, - "label": "NetworkUnavailable \"false\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"OutOfDisk\" and azure.dimensions.status : \"false\" " - }, - "label": "OutOfDisk \"false\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"OutOfDisk\" and azure.dimensions.status : \"true\" " - }, - "label": "OutOfDisk \"true\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"MemoryPressure\" and azure.dimensions.status : \"true\" " - }, - "label": "MemoryPressure \"true\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"MemoryPressure\" and azure.dimensions.status : \"false\" " - }, - "label": "MemoryPressure \"false\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"DiskPressure\" and azure.dimensions.status : \"false\" " - }, - "label": "DiskPressure \"false\"" - }, - { - "input": { - "language": "kuery", - "query": "azure.dimensions.condition : \"DiskPressure\" and azure.dimensions.status : \"true\" " - }, - "label": "DiskPressure \"true\"" - } - ] - }, - "schema": "segment", - "type": "filters" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "azure.dimensions.node", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Green to Red", - "colorsNumber": 5, - "colorsRange": [ - { - "from": 0, - "to": 10 - } - ], - "dimensions": { - "series": [ - { - "accessor": 1, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "azure.dimensions.node: Descending", - "params": {} - } - ], - "x": { - "accessor": 0, - "aggType": "filters", - "format": {}, - "label": "filters", - "params": {} - }, - "y": [ - { - "accessor": 2, - "aggType": "avg", - "format": { - "id": "number", - "params": { - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "Average azure.container_service.kube_node_status_condition.avg", - "params": {} - } - ] - }, - "enableHover": false, - "invertColors": true, - "legendPosition": "right", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ] - }, - "title": "Container Service Kube Node Status Condition [Azure Metrics]", - "type": "heatmap" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-e79211c0-6d37-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-e8ca65c0-eb45-11e9-90ec-112a988266d5.json b/packages/azure_metrics/kibana/visualization/azure_metrics-e8ca65c0-eb45-11e9-90ec-112a988266d5.json deleted file mode 100644 index 75ba79573b7..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-e8ca65c0-eb45-11e9-90ec-112a988266d5.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "VM Disk Reads [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type :\"Microsoft.Compute/virtualMachines\" " - }, - "id": "39b6adc0-ea99-11e9-8328-799c817fb96b", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0, - "formatter": "bytes", - "id": "39b6adc1-ea99-11e9-8328-799c817fb96b", - "label": "VM Disk Read bytes", - "line_width": 2, - "metrics": [ - { - "field": "azure.compute_vm.disk_read_bytes.total", - "id": "39b6adc2-ea99-11e9-8328-799c817fb96b", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "VM Disk Reads [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-e8ca65c0-eb45-11e9-90ec-112a988266d5", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-eaf13b40-feac-11eb-8fff-87871c582eca.json b/packages/azure_metrics/kibana/visualization/azure_metrics-eaf13b40-feac-11eb-8fff-87871c582eca.json deleted file mode 100644 index 1ca7ed6ce3d..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-eaf13b40-feac-11eb-8fff-87871c582eca.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Compute VM Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "### Azure Compute VM \n\n[**Overview**](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Guest Windows VM Metrics](#/dashboard/azure_metrics-b6b434c0-feae-11eb-8fff-87871c582eca) | [Guest Linux VM Metrics](#/dashboard/azure_metrics-d8e3c5f0-feaf-11eb-8fff-87871c582eca)", - "openLinksInNewTab": false - }, - "title": "Navigation Compute VM Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-eaf13b40-feac-11eb-8fff-87871c582eca", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-eda368d0-6d1d-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-eda368d0-6d1d-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 7b6a86dcc4e..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-eda368d0-6d1d-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Container Service Kube Node Status Allocatable Memory Bytes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerService/managedClusters\" " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Container Service Kube Node Status Allocatable Memory Bytes", - "line_width": "02", - "metrics": [ - { - "field": "azure.container_service.kube_node_status_allocatable_memory_bytes.avg", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Container Service Kube Node Status Allocatable Memory Bytes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-eda368d0-6d1d-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-f18a7cb0-32f6-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-f18a7cb0-32f6-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 869103c050d..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-f18a7cb0-32f6-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation File Storage Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 10, - "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [**File**](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", - "openLinksInNewTab": false - }, - "title": "Navigation File Storage Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-f18a7cb0-32f6-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-f4367270-ff69-11eb-af1d-2505733a31f2.json b/packages/azure_metrics/kibana/visualization/azure_metrics-f4367270-ff69-11eb-af1d-2505733a31f2.json deleted file mode 100644 index 250c2bce1b7..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-f4367270-ff69-11eb-af1d-2505733a31f2.json +++ /dev/null @@ -1,87 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Azure Compute VM Guest Diskio Read bytes [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.namespace : \"Azure.VM.Linux.GuestMetrics\" " - }, - "id": "e09ae8d1-cbc7-4737-89cb-3805e1ace186", - "index_pattern": "metrics-*", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "1d3aba96-1604-449a-97f9-42f7000a424c", - "label": "Diskio Read bytes", - "line_width": 1, - "metrics": [ - { - "field": "azure.compute_vm.diskio_per_read_bytes.avg", - "id": "3c459779-ee47-438a-9931-c543e713478b", - "type": "avg" - } - ], - "palette": { - "name": "gradient", - "params": { - "colors": [ - "#68BC00", - "rgb(0, 0, 0)" - ], - "gradient": true - }, - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Azure Compute VM Guest Diskio Read bytes [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-f4367270-ff69-11eb-af1d-2505733a31f2", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-f528e6a0-339a-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-f528e6a0-339a-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index e3d20879dad..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-f528e6a0-339a-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,100 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Storage Table Capacity [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color": null, - "background_color_rules": [ - { - "id": "71978870-32e4-11ea-af9e-d70582a45bda" - } - ], - "bar_color_rules": [ - { - "id": "f11cfd90-32e5-11ea-af9e-d70582a45bda" - } - ], - "drilldown_url": "", - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "9c09ed50-32e4-11ea-af9e-d70582a45bda" - } - ], - "gauge_inner_color": null, - "gauge_inner_width": "6", - "gauge_style": "circle", - "gauge_width": "10", - "hide_last_value_indicator": true, - "id": "61fb4190-32e4-11ea-b9f8-4d0b340ad993", - "index_pattern": "metrics-*", - "interval": "60m", - "isModelInvalid": false, - "pivot_id": "azure.resource.name", - "pivot_label": "Resource Name", - "pivot_rows": "30", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "1.2", - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "bytes", - "id": "61fb4191-32e4-11ea-b9f8-4d0b340ad993", - "label": "Table Capacity", - "line_width": 2, - "metrics": [ - { - "field": "azure.storage_account.table_capacity.avg", - "id": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "avg" - } - ], - "point_size": 0, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "terms_field": "azure.resource.name", - "terms_order_by": "61fb4192-32e4-11ea-b9f8-4d0b340ad993", - "type": "timeseries", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Storage Table Capacity [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-f528e6a0-339a-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-fcc24d70-32f5-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-fcc24d70-32f5-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 4ed5d2b4ea8..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-fcc24d70-32f5-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Storage Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 10, - "markdown": "### Azure Storage\n\n[**Overview**](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [Table](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", - "openLinksInNewTab": false - }, - "title": "Navigation Storage Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-fcc24d70-32f5-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-fdef3f40-32f6-11ea-a83e-25b8612d00cc.json b/packages/azure_metrics/kibana/visualization/azure_metrics-fdef3f40-32f6-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index b5a4c951bde..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-fdef3f40-32f6-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Navigation Table Storage Overview [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 10, - "markdown": "### Azure Storage\n\n[Overview](#/dashboard/azure_metrics-1a151f80-32db-11ea-a83e-25b8612d00cc) | [Blob](#/dashboard/azure_metrics-b165ef60-32f7-11ea-a83e-25b8612d00cc) | [File](#/dashboard/azure_metrics-dff7a080-32f7-11ea-a83e-25b8612d00cc) | [**Table**](#/dashboard/azure_metrics-ff2fe020-32f7-11ea-a83e-25b8612d00cc) | [Queue](#/dashboard/azure_metrics-10efa340-32f8-11ea-a83e-25b8612d00cc) ", - "openLinksInNewTab": false - }, - "title": "Navigation Table Storage Overview [Azure Metrics]", - "type": "markdown" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-fdef3f40-32f6-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/kibana/visualization/azure_metrics-ff303710-6d07-11ea-8fe8-71add5fd7c38.json b/packages/azure_metrics/kibana/visualization/azure_metrics-ff303710-6d07-11ea-8fe8-71add5fd7c38.json deleted file mode 100644 index 72789c87fec..00000000000 --- a/packages/azure_metrics/kibana/visualization/azure_metrics-ff303710-6d07-11ea-8fe8-71add5fd7c38.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Container Registry Successful Pull Count [Azure Metrics]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "azure.resource.type : \"Microsoft.ContainerRegistry/registries\" " - }, - "id": "14650224-3115-4ea1-9ab4-ff911b357ebd", - "index_pattern_ref_name": "metrics_0_index_pattern", - "interval": "\u003e=5m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(211,96,134,1)", - "fill": 0.5, - "formatter": "number", - "id": "dddd4a3a-e26e-4043-8e30-9c0412df4eac", - "label": "Container Registry Successful Pull Count", - "line_width": 1, - "metrics": [ - { - "field": "azure.container_registry.successful_pull_count.total", - "id": "d11cd335-b6ff-4d9b-9b95-4f8366436b7d", - "type": "avg" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "azure.resource.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true - }, - "title": "Container Registry Successful Pull Count [Azure Metrics]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "azure_metrics-ff303710-6d07-11ea-8fe8-71add5fd7c38", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "metrics-*", - "name": "metrics_0_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/azure_metrics/manifest.yml b/packages/azure_metrics/manifest.yml index ddcaa7eacba..b646999a37d 100644 --- a/packages/azure_metrics/manifest.yml +++ b/packages/azure_metrics/manifest.yml @@ -1,6 +1,6 @@ name: azure_metrics title: Azure Resource Metrics -version: 1.0.16 +version: 1.0.43 release: ga description: Collect metrics from Azure resources with Elastic Agent. type: integration @@ -20,7 +20,7 @@ categories: - observability - azure conditions: - kibana.version: "^7.14.0 || ^8.0.0" + kibana.version: "^8.9.0" vars: - name: client_id type: text diff --git a/packages/barracuda/_dev/build/build.yml b/packages/barracuda/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/barracuda/_dev/build/build.yml +++ b/packages/barracuda/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/barracuda/changelog.yml b/packages/barracuda/changelog.yml index 509bb8183d6..6f030ce73ff 100644 --- a/packages/barracuda/changelog.yml +++ b/packages/barracuda/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.7.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.4.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-access.log-expected.json b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-access.log-expected.json index cc9f930e5b7..4b96f1a5c0e 100644 --- a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-access.log-expected.json +++ b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-access.log-expected.json @@ -48,7 +48,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -181,7 +181,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -306,7 +306,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -438,7 +438,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -567,7 +567,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -689,7 +689,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-audit.log-expected.json b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-audit.log-expected.json index 5cc79326080..41e6f4cef3e 100644 --- a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-audit.log-expected.json @@ -33,7 +33,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -92,7 +92,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-network-firewall.log-expected.json b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-network-firewall.log-expected.json index 097d9be7ca6..65e93b86f65 100644 --- a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-network-firewall.log-expected.json +++ b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-network-firewall.log-expected.json @@ -41,7 +41,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DENY", @@ -134,7 +134,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DENY", @@ -227,7 +227,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DENY", @@ -320,7 +320,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DENY", diff --git a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-system.log-expected.json b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-system.log-expected.json index 121786b4c08..0c1082aa5f5 100644 --- a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-system.log-expected.json +++ b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-system.log-expected.json @@ -15,7 +15,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -47,7 +47,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -79,7 +79,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -111,7 +111,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -143,7 +143,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -175,7 +175,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -207,7 +207,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -239,7 +239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -271,7 +271,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-web-firewall.log-expected.json b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-web-firewall.log-expected.json index 97ceda8c953..ad10bf1a72f 100644 --- a/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-web-firewall.log-expected.json +++ b/packages/barracuda/data_stream/waf/_dev/test/pipeline/test-web-firewall.log-expected.json @@ -44,7 +44,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOG", @@ -163,7 +163,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOG", @@ -283,7 +283,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOG", @@ -398,7 +398,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOG", @@ -514,7 +514,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DENY", diff --git a/packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/default.yml b/packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/default.yml index 84d63e9a50c..ede23c31789 100644 --- a/packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/default.yml +++ b/packages/barracuda/data_stream/waf/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - grok: field: event.original patterns: diff --git a/packages/barracuda/data_stream/waf/sample_event.json b/packages/barracuda/data_stream/waf/sample_event.json index 479126715c7..f6aa2291cb6 100644 --- a/packages/barracuda/data_stream/waf/sample_event.json +++ b/packages/barracuda/data_stream/waf/sample_event.json @@ -19,7 +19,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "11940e5d-16a1-424a-aeb2-97fb8029a5d0", diff --git a/packages/barracuda/docs/README.md b/packages/barracuda/docs/README.md index f5427150ac7..abfae7a25a1 100644 --- a/packages/barracuda/docs/README.md +++ b/packages/barracuda/docs/README.md @@ -55,7 +55,7 @@ An example event for `waf` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "11940e5d-16a1-424a-aeb2-97fb8029a5d0", @@ -165,14 +165,14 @@ An example event for `waf` looks as following: | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | diff --git a/packages/barracuda/kibana/tags.yml b/packages/barracuda/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/barracuda/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/barracuda/manifest.yml b/packages/barracuda/manifest.yml index 43dd55f3793..3f039a42dc8 100644 --- a/packages/barracuda/manifest.yml +++ b/packages/barracuda/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: barracuda title: "Barracuda Logs" -version: "1.4.0" +version: "1.7.0" description: Ingest Events from Barracuda Web Application Firewall type: integration categories: @@ -11,8 +11,10 @@ categories: source: license: "Elastic-2.0" conditions: - kibana.version: ^8.4.0 - elastic.subscription: basic + kibana: + version: ^8.4.0 + elastic: + subscription: basic screenshots: - src: /img/barracuda-waf-overview.png title: Overview @@ -59,3 +61,4 @@ policy_templates: description: Collecting syslog from Barracuda via file. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/barracuda_cloudgen_firewall/_dev/build/build.yml b/packages/barracuda_cloudgen_firewall/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/barracuda_cloudgen_firewall/_dev/build/build.yml +++ b/packages/barracuda_cloudgen_firewall/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/barracuda_cloudgen_firewall/changelog.yml b/packages/barracuda_cloudgen_firewall/changelog.yml index 57798857dd1..89e4eab0d3a 100644 --- a/packages/barracuda_cloudgen_firewall/changelog.yml +++ b/packages/barracuda_cloudgen_firewall/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.7.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json index 9a87d2d8b33..ed18815f3db 100644 --- a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-firewall.log-expected.json @@ -32,7 +32,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "End", diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json index ed9eced3151..02b681c38a4 100644 --- a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-threat.log-expected.json @@ -8,7 +8,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -84,7 +84,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -160,7 +160,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json index 3187e9121f2..9ee8b987731 100644 --- a/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/_dev/test/pipeline/test-web.log-expected.json @@ -27,7 +27,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "0", @@ -129,7 +129,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "0", diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 71bcdee4bd5..93b1469b5c7 100644 --- a/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Barracuda CloudGen Firewall processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Metadata about the origin of the event captured from the Lumberjack connection. - rename: diff --git a/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json b/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json index f1da130f6f6..bd10d57133b 100644 --- a/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json +++ b/packages/barracuda_cloudgen_firewall/data_stream/log/sample_event.json @@ -42,7 +42,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", diff --git a/packages/barracuda_cloudgen_firewall/docs/README.md b/packages/barracuda_cloudgen_firewall/docs/README.md index b92fbf1238b..beb47f01ca5 100644 --- a/packages/barracuda_cloudgen_firewall/docs/README.md +++ b/packages/barracuda_cloudgen_firewall/docs/README.md @@ -70,7 +70,7 @@ An example event for `log` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "70e82165-776e-4b35-98b8-b0c9491f4b6e", diff --git a/packages/barracuda_cloudgen_firewall/kibana/tags.yml b/packages/barracuda_cloudgen_firewall/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/barracuda_cloudgen_firewall/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/barracuda_cloudgen_firewall/manifest.yml b/packages/barracuda_cloudgen_firewall/manifest.yml index 85c3b980926..15a4195228a 100644 --- a/packages/barracuda_cloudgen_firewall/manifest.yml +++ b/packages/barracuda_cloudgen_firewall/manifest.yml @@ -1,12 +1,13 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: barracuda_cloudgen_firewall title: Barracuda CloudGen Firewall Logs -version: "1.4.0" +version: "1.7.0" description: Collect logs from Barracuda CloudGen Firewall devices with Elastic Agent. categories: ["network", "security", "firewall_security"] type: integration conditions: - kibana.version: "^8.5.0" + kibana: + version: "^8.5.0" policy_templates: - name: barracuda_cloudgen_firewall title: Barracuda CloudGen Firewall Logs @@ -22,3 +23,4 @@ icons: type: image/svg+xml owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/bitdefender/_dev/build/build.yml b/packages/bitdefender/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/bitdefender/_dev/build/build.yml +++ b/packages/bitdefender/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/bitdefender/_dev/deploy/docker/config.yml b/packages/bitdefender/_dev/deploy/docker/config.yml index ad40197ecb6..8009f8a0213 100644 --- a/packages/bitdefender/_dev/deploy/docker/config.yml +++ b/packages/bitdefender/_dev/deploy/docker/config.yml @@ -10,7 +10,6 @@ rules: Content-Type: - "application/json" body: '{"status":"OK"}' - - path: /api/v1.0/jsonrpc/push methods: ["POST"] request_headers: diff --git a/packages/bitdefender/changelog.yml b/packages/bitdefender/changelog.yml index 0a05e7eedae..49ab3611a9d 100644 --- a/packages/bitdefender/changelog.yml +++ b/packages/bitdefender/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.3.1" + changes: + - description: Remove version attribute from ingest node pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/7807 +- version: "1.3.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7339 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.1.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.0.0" changes: - description: Release BitDefender as GA. diff --git a/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json b/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json index 6afd499e574..999ec4a5faa 100644 --- a/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json +++ b/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json @@ -1,7 +1,7 @@ { - "events": [ - { - "message": "{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"serviceSettings\":{\"authorization\":\"********\",\"requireValidSslCertificate\":true,\"url\":\"https://webhook.your.tld/push/notifications\"},\"serviceType\":\"jsonRPC\",\"status\":1,\"subscribeToCompanies\":[\"12341234abcd12341234abcd\"],\"subscribeToEventTypes\":{\"adcloud\":true,\"antiexploit\":true,\"aph\":true,\"av\":true,\"avc\":true,\"dp\":true,\"endpoint-moved-in\":true,\"endpoint-moved-out\":true,\"exchange-malware\":true,\"exchange-user-credentials\":true,\"fw\":true,\"hd\":true,\"hwid-change\":true,\"install\":true,\"modules\":true,\"network-monitor\":true,\"network-sandboxing\":true,\"new-incident\":true,\"ransomware-mitigation\":true,\"registration\":true,\"security-container-update-available\":true,\"supa-update-status\":true,\"sva\":true,\"sva-load\":true,\"task-status\":true,\"troubleshooting-activity\":true,\"uc\":true,\"uninstall\":true}}}" - } - ] -} + "events": [ + { + "message": "{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"serviceSettings\":{\"authorization\":\"********\",\"requireValidSslCertificate\":true,\"url\":\"https://webhook.your.tld/push/notifications\"},\"serviceType\":\"jsonRPC\",\"status\":1,\"subscribeToCompanies\":[\"12341234abcd12341234abcd\"],\"subscribeToEventTypes\":{\"adcloud\":true,\"antiexploit\":true,\"aph\":true,\"av\":true,\"avc\":true,\"dp\":true,\"endpoint-moved-in\":true,\"endpoint-moved-out\":true,\"exchange-malware\":true,\"exchange-user-credentials\":true,\"fw\":true,\"hd\":true,\"hwid-change\":true,\"install\":true,\"modules\":true,\"network-monitor\":true,\"network-sandboxing\":true,\"new-incident\":true,\"ransomware-mitigation\":true,\"registration\":true,\"security-container-update-available\":true,\"supa-update-status\":true,\"sva\":true,\"sva-load\":true,\"task-status\":true,\"troubleshooting-activity\":true,\"uc\":true,\"uninstall\":true}}}" + } + ] +} \ No newline at end of file diff --git a/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json-expected.json b/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json-expected.json index 8ba18d2e613..07d79b3461d 100644 --- a/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json-expected.json +++ b/packages/bitdefender/data_stream/push_configuration/_dev/test/pipeline/test-push-configuration.json-expected.json @@ -48,7 +48,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"serviceSettings\":{\"authorization\":\"********\",\"requireValidSslCertificate\":true,\"url\":\"https://webhook.your.tld/push/notifications\"},\"serviceType\":\"jsonRPC\",\"status\":1,\"subscribeToCompanies\":[\"12341234abcd12341234abcd\"],\"subscribeToEventTypes\":{\"adcloud\":true,\"antiexploit\":true,\"aph\":true,\"av\":true,\"avc\":true,\"dp\":true,\"endpoint-moved-in\":true,\"endpoint-moved-out\":true,\"exchange-malware\":true,\"exchange-user-credentials\":true,\"fw\":true,\"hd\":true,\"hwid-change\":true,\"install\":true,\"modules\":true,\"network-monitor\":true,\"network-sandboxing\":true,\"new-incident\":true,\"ransomware-mitigation\":true,\"registration\":true,\"security-container-update-available\":true,\"supa-update-status\":true,\"sva\":true,\"sva-load\":true,\"task-status\":true,\"troubleshooting-activity\":true,\"uc\":true,\"uninstall\":true}}}" diff --git a/packages/bitdefender/data_stream/push_configuration/agent/stream/httpjson.yml.hbs b/packages/bitdefender/data_stream/push_configuration/agent/stream/httpjson.yml.hbs index 46b776a8910..bf7a7947a25 100644 --- a/packages/bitdefender/data_stream/push_configuration/agent/stream/httpjson.yml.hbs +++ b/packages/bitdefender/data_stream/push_configuration/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.url: {{url}} request.method: POST {{#if proxy_url }} diff --git a/packages/bitdefender/data_stream/push_configuration/elasticsearch/ingest_pipeline/default.yml b/packages/bitdefender/data_stream/push_configuration/elasticsearch/ingest_pipeline/default.yml index 39cb1ace1c2..5a28088c3eb 100644 --- a/packages/bitdefender/data_stream/push_configuration/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitdefender/data_stream/push_configuration/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 1 description: Pipeline for BitDefender push notification configuration processors: - json: @@ -10,7 +9,7 @@ processors: message: missing json object in input document - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/bitdefender/data_stream/push_configuration/manifest.yml b/packages/bitdefender/data_stream/push_configuration/manifest.yml index 23b7a5248fd..551957d2aa5 100644 --- a/packages/bitdefender/data_stream/push_configuration/manifest.yml +++ b/packages/bitdefender/data_stream/push_configuration/manifest.yml @@ -38,7 +38,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/bitdefender/data_stream/push_configuration/sample_event.json b/packages/bitdefender/data_stream/push_configuration/sample_event.json index ac1c6aaec46..8b1cff92ce1 100644 --- a/packages/bitdefender/data_stream/push_configuration/sample_event.json +++ b/packages/bitdefender/data_stream/push_configuration/sample_event.json @@ -56,7 +56,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", diff --git a/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json b/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json index 6af67003fe6..5483e573f57 100644 --- a/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json +++ b/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json @@ -1,88 +1,88 @@ { - "events": [ - { - "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"aph_type\":\"phishing\",\"url\":\"http://example.com/account/support/\",\"status\":\"aph_blocked\",\"last_blocked\":\"2017-09-14T08:49:43.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"aph\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"endpointId\":\"59b7d9bfa849af3a1465b7e3\",\"serverName\":\"FC-EXCHANGE-01\",\"sender\":\"fc_test01@fc.dom\",\"recipients\":[\"fc_test02@fc.dom\"],\"subject\":\"Emailing Sending.. WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0\",\"detectionTime\":\"2017-09-13T14: 20:37.000Z\",\"malware\":[{\"malwareName\":\"Trojan.Generic.KD.874127\",\"malwareType\":\"virus\",\"actionTaken\":\"quarantine\",\"infectedObject\":\"WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0\"}],\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"exchange-malware\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"product_registration\":\"registered\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"registration\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"10.17.46.196\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"malware_type\":\"file\",\"malware_name\":\"EICAR-Test-File (not a virus)\",\"file_path\":\"C:\\\\eicar0000001.txt\",\"hash\":\"8b3f191819931d1f2cef7289239b5f77c00b079847b9c2636e56854d1e5eff71\",\"final_status\":\"deleted\",\"timestamp\":\"2017-09-08T12:01:36.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"av\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"exploit_type\":\"AVC Blocked Exploit\",\"exploit_path\":\"C:\\\\Users\\\\admin\\\\Desktop\\\\Tools\\\\avcsim\\\\win32\\\\avcsim32.exe\",\"status\":\"avc_blocked\",\"last_blocked\":\"2017-09-14T07:56:33.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"avc\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"malware_status\":1,\"aph_status\":1,\"firewall_status\":1,\"avc_status\":1,\"uc_web_filtering\":0,\"uc_categ_filtering\":0,\"uc_application_status\":0,\"dp_status\":0,\"pu_status\":1,\"dlp_status\":0,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"modules\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"status\":\"portscan_blocked\",\"protocol_id\":\"6\",\"source_ip\":\"192.168.0.2\",\"last_blocked\":\"2017-09-08T12:52:03.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"fw\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"status\":0,\"fromSupa\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"supa-update-status\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"target_type\":\"http\",\"blocking_rule_name\":\"dv\",\"url\":\"http://example.com/\",\"status\":\"data_protection_blocked\",\"last_blocked\":\"2017-09-11T10:23:43.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"dp\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"uc_type\":\"http\",\"url\":\"http://192.168.0.1:2869/upnphost/udhisapi.dll\",\"block_type\":\"http_timelimiter\",\"categories\":\"\",\"status\":\"uc_site_blocked\",\"last_blocked\":\"2017-09-08T12:46:30.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"uc\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"userId\":\"59a14b2b1da197c6108b4568\",\"taskId\":\"59b28dc81da19711058b4568\",\"taskName\":\"Quick Scan 2017-09-08(sub-task)\",\"taskType\":272,\"targetName\":\"FC-WIN7-X64-01\",\"isSuccessful\":1,\"status\":3,\"errorMessage\":\"\",\"errorCode\":0,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"task-status\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"bitdefender-sva\",\"computer_fqdn\":\"bitdefender-sva\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b8f3aba849af3a1465b81e\",\"product_installed\":\"SVA\",\"loadAverage\":1,\"cpuUsage\":48,\"memoryUsage\":32,\"networkUsage\":0,\"overallUsage\":48,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"sva-load\",\"_testEvent_\":true}" - }, - { - "message": "{\"computer_name\":\"bitdefender-sva\",\"computer_fqdn\":\"bitdefender-sva\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b8f3aba849af3a1465b81e\",\"product_installed\":\"SVA\",\"powered_off\":0,\"product_update_available\":1,\"product_reboot_required\":0,\"lastupdate\":\"0\",\"updatesigam\":\"7.72479\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"sva\",\"_testEvent_\":true}" - }, - { - "message": "{\"endpointId\":\"59a1604e60369e06733f8aba\",\"computerName\":\"FC-WIN7-X64-01\",\"computerIp\":\"192.168.0.1\",\"detectionTime\":1505386969,\"threatType\":\"RANSOMWARE\",\"filePaths\":[\"C:\\\\Users\\\\Administrator\\\\Documents\\\\installer.xml\",\"D:\\\\opt\\\\bitdefender\\\\installer2.xml\",\"D:\\\\sources\\\\console\\\\CommonConsole\\\\app\\\\modules\\\\policies\\\\view\\\\endpoints\\\\networkSandboxing\\\\installer3.xml\"],\"fileSizes\":[\"2614\",\"2615\",\"2616\"],\"remediationActions\":[\"1\",\"\",\"1\"],\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"network-sandboxing\",\"_testEvent_\":true}" - }, - { - "message": "{\"endpointId\":\"59b7d9bfa849af3a1465b7e3\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"exchange-user-credentials\",\"_testEvent_\":true}" - }, - { - "message": "{\"module\":\"hwid-change\",\"product_installed\":\"BEST\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_name\":\"A\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"81.2.69.144\",\"computer_id\":\"5e284ff5b7e43d387ba54a96\",\"old_hwid\":\"00000000-0000-0000-0000-406186b5bde7\",\"new_hwid\":\"00000000-0000-0000-0000-406186b5bde6\",\"endpointId\":\"5e284ff5b7e43d387ba54a95\",\"_testEvent_\":true}" - }, - { - "message": "{\"module\":\"network-monitor\",\"product_installed\":\"BEST\",\"user\":{\"userName\":\"user1@domain.com\",\"userSid\":\"S-1-2-3-4\"},\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5d639e8f48ac2f04f6e00b1c\",\"actionTaken\":\"reportOnly\",\"detection_name\":\"PrivacyThreat.PasswordStealer.HTTP\",\"detection_attackTechnique\":\"discovery\",\"source_ip\":\"10.17.134.4\",\"victim_ip\":\"67.43.156.1\",\"local_port\":\"80\",\"timestamp\":\"2019-01-24T11:13:04.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"_testEvent_\":true}" - }, - { - "message": "{\"module\":\"new-incident\",\"created\":\"2020-07-20T09:36:23.485Z\",\"endpointId\":\"5efb3a520075db7384dfa285\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_id\":\"5efb3a520075db7384dfa286\",\"computer_fqdn\":\"desktop-jac14gs\",\"computer_name\":\"DESKTOP-JAC14GS\",\"detection_name\":\"ATC.Malicious\",\"attack_types\":[\"Other\"],\"computer_ip\":\"10.17.23.30\",\"severityScore\":90,\"incident_id\":\"5f1557cbe7b2584f3959ee19\",\"attack_entry\":1688239188,\"parent_process_path\":\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"parent_process_pid\":9636,\"process_path\":\"c:\\\\users\\\\bdadmin\\\\desktop\\\\atcsim\\\\atcsim32.exe\",\"process_pid\":10324,\"username\":\"DESKTOP-JAC14GS\\\\bdadmin\",\"user_sid\":\"S-1-5-21-3349207704-443292085-2237656896-1003\",\"process_command_line\":\"detect\",\"file_hash_md5\":\"ccb1b07bdf330627f02b3c832663a489\",\"file_hash_sha256\":\"d5adc6a65a57d30d3ae70d195983d155e7cd24f26eb1ebebde9b92655251ec55\",\"att_ck_id\":[\"T1036\",\"T1059\",\"T1002\",\"T1012\"],\"severity\":\"high\",\"main_action\":\"no action\",\"_testEvent_\":true}" - }, - { - "message": "{\"module\":\"ransomware-mitigation\",\"companyId\":\"623c18fb12fb8700396d6375\",\"product_installed\":\"SVA\",\"user\":{\"name\":\"user\",\"sid\":\"S-11-22-33\"},\"company_name\":\"Bitdefender\",\"computer_name\":\"DC-Nebula\",\"computer_fqdn\":\"undefined\",\"computer_ip\":\"10.17.16.10\",\"computer_id\":\"5ed4d2fef23f7325715dbb22\",\"attack_type\":\"remote\",\"item_count\":\"23\",\"detected_on\":1591007594,\"attack_source\":\"10.10.20.120\",\"_testEvent_\":true}" - }, - { - "message": "{\"module\":\"security-container-update-available\",\"product_installed\":\"BEST\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_name\":\"security-container-x\",\"computer_fqdn\":\"security-container-x-containers-host.dsd.ro\",\"computer_ip\":\"10.17.15.247\",\"computer_id\":\"60f6ba5e1b3272cce33c3281\",\"host_name\":\"TEST_ENDPOINT_2\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e3\",\"endpointId\":\"5e2085febf255a545e52276a\",\"hwid\":\"5e284ff-5b7e43d387ba-54a95\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"endpoint-moved-in\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"endpointId\":\"5e2085febf255a545e52276b\",\"hwid\":\"5e284ff-5b7e43d387ba-54a95\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"endpoint-moved-out\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"endpointId\":\"5e2085febf255a545e52276b\",\"reason\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"uninstall\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5cf51ba5e8ee8c5b1852a9d7\",\"endpointId\":\"5cf51ba5e8ee8c5b1852a9d6\",\"detection_action\":\"kill\",\"detection_threatName\":\"EICAR-Test-File (not a virus)\",\"detection_pid\":\"2000\",\"detection_exploitTechnique\":\"Flash/Generic\",\"detection_parentPid\":\"4000\",\"detection_path\":\"C:\\\\file15c8ba8b90ea1de127962f464.exe\",\"detection_parentPath\":\"C:\\\\file25c8ba8b90ea1de127962f464.exe\",\"detection_cve\":\"cve string\",\"detection_username\":\"user@domain.com\",\"detection_time\":\"2019-06-03T13:58:30.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"antiexploit\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5cf51ba5e8ee8c5b1852a9d7\",\"module\":\"install\",\"endpointId\":\"5e2085febf255a545e52276b\",\"hwid\":\"00000000-0000-0000-0000-406186b5bdbdzzz50\",\"companyId\":\"623c18fb12fb8700396d6375\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT_WINDOWS_10\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.0.101\",\"computer_id\":\"5ee30e2b29a4e218489442b6\",\"taskId\":\"5eea0105f23f731302405833\",\"taskType\":\"Debug Session\",\"errorCode\":3,\"username\":\"test@test.com\",\"localPath\":\"/test/dir\",\"networkSharePath\":\"//1.2.3.4/dir\",\"saveToBitdefenderCloud\":0,\"status\":3,\"stopReason\":2,\"failedStorageType\":1,\"startDate\":\"2020-06-24T06:06:48.000Z\",\"endDate\":\"2020-06-24T06:09:28.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"troubleshooting-activity\",\"_testEvent_\":true}" - }, - { - "message": "{\"product_installed\":\"EPS\",\"user\":{\"name\":\"admin\",\"sid\":\"BF410F3B-5F3A-41E1-BF8F-28DE6948A355\"},\"computer_name\":\"Computer 1\",\"computer_fqdn\":\"computer1.local\",\"computer_ip\":\"89.160.20.112\",\"computer_id\":\"5c12612db1a43dc3097b23c6\",\"malware_type\":\"file\",\"malware_name\":\"\",\"final_status\":\"quarantined\",\"file_path\":\"/Users/admin/Desktop/\",\"attack_type\":\"targeted attack\",\"detection_level\":\"permissive\",\"is_fileless_attack\":0,\"hwid\":\"22574006-79523827-7401-9565-1295-798280775872\",\"date\":\"2019-01-17T10:01:02.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"hd\",\"_testEvent_\":true}" - }, - { - "message": "{\"syncerId\":\"59b7d9bfa849af3a1465b7e3\",\"issueType\":0,\"lastAdReportDate\":\"2017-09-14T08:03:49.671Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"adcloud\",\"_testEvent_\":true}" - } - ] -} + "events": [ + { + "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"aph_type\":\"phishing\",\"url\":\"http://example.com/account/support/\",\"status\":\"aph_blocked\",\"last_blocked\":\"2017-09-14T08:49:43.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"aph\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"endpointId\":\"59b7d9bfa849af3a1465b7e3\",\"serverName\":\"FC-EXCHANGE-01\",\"sender\":\"fc_test01@fc.dom\",\"recipients\":[\"fc_test02@fc.dom\"],\"subject\":\"Emailing Sending.. WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0\",\"detectionTime\":\"2017-09-13T14: 20:37.000Z\",\"malware\":[{\"malwareName\":\"Trojan.Generic.KD.874127\",\"malwareType\":\"virus\",\"actionTaken\":\"quarantine\",\"infectedObject\":\"WL-cbe100c9f42a20ef9a4b1c20ed1a59f9-0\"}],\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"exchange-malware\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-EXCHANGE-01\",\"computer_fqdn\":\"fc-exchange-01.fc.dom\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"product_installed\":\"BEST\",\"product_registration\":\"registered\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"registration\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"10.17.46.196\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"malware_type\":\"file\",\"malware_name\":\"EICAR-Test-File (not a virus)\",\"file_path\":\"C:\\\\eicar0000001.txt\",\"hash\":\"8b3f191819931d1f2cef7289239b5f77c00b079847b9c2636e56854d1e5eff71\",\"final_status\":\"deleted\",\"timestamp\":\"2017-09-08T12:01:36.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"av\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"exploit_type\":\"AVC Blocked Exploit\",\"exploit_path\":\"C:\\\\Users\\\\admin\\\\Desktop\\\\Tools\\\\avcsim\\\\win32\\\\avcsim32.exe\",\"status\":\"avc_blocked\",\"last_blocked\":\"2017-09-14T07:56:33.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"avc\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"malware_status\":1,\"aph_status\":1,\"firewall_status\":1,\"avc_status\":1,\"uc_web_filtering\":0,\"uc_categ_filtering\":0,\"uc_application_status\":0,\"dp_status\":0,\"pu_status\":1,\"dlp_status\":0,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"modules\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"status\":\"portscan_blocked\",\"protocol_id\":\"6\",\"source_ip\":\"192.168.0.2\",\"last_blocked\":\"2017-09-08T12:52:03.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"fw\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"status\":0,\"fromSupa\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"supa-update-status\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"target_type\":\"http\",\"blocking_rule_name\":\"dv\",\"url\":\"http://example.com/\",\"status\":\"data_protection_blocked\",\"last_blocked\":\"2017-09-11T10:23:43.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"dp\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"uc_type\":\"http\",\"url\":\"http://192.168.0.1:2869/upnphost/udhisapi.dll\",\"block_type\":\"http_timelimiter\",\"categories\":\"\",\"status\":\"uc_site_blocked\",\"last_blocked\":\"2017-09-08T12:46:30.000Z\",\"count\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"uc\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"FC-WIN7-X64-01\",\"computer_fqdn\":\"fc-win7-x64-01\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59a1604e60369e06733f8abb\",\"product_installed\":\"BEST\",\"userId\":\"59a14b2b1da197c6108b4568\",\"taskId\":\"59b28dc81da19711058b4568\",\"taskName\":\"Quick Scan 2017-09-08(sub-task)\",\"taskType\":272,\"targetName\":\"FC-WIN7-X64-01\",\"isSuccessful\":1,\"status\":3,\"errorMessage\":\"\",\"errorCode\":0,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"task-status\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"bitdefender-sva\",\"computer_fqdn\":\"bitdefender-sva\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b8f3aba849af3a1465b81e\",\"product_installed\":\"SVA\",\"loadAverage\":1,\"cpuUsage\":48,\"memoryUsage\":32,\"networkUsage\":0,\"overallUsage\":48,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"sva-load\",\"_testEvent_\":true}" + }, + { + "message": "{\"computer_name\":\"bitdefender-sva\",\"computer_fqdn\":\"bitdefender-sva\",\"computer_ip\":\"192.168.0.1\",\"computer_id\":\"59b8f3aba849af3a1465b81e\",\"product_installed\":\"SVA\",\"powered_off\":0,\"product_update_available\":1,\"product_reboot_required\":0,\"lastupdate\":\"0\",\"updatesigam\":\"7.72479\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"sva\",\"_testEvent_\":true}" + }, + { + "message": "{\"endpointId\":\"59a1604e60369e06733f8aba\",\"computerName\":\"FC-WIN7-X64-01\",\"computerIp\":\"192.168.0.1\",\"detectionTime\":1505386969,\"threatType\":\"RANSOMWARE\",\"filePaths\":[\"C:\\\\Users\\\\Administrator\\\\Documents\\\\installer.xml\",\"D:\\\\opt\\\\bitdefender\\\\installer2.xml\",\"D:\\\\sources\\\\console\\\\CommonConsole\\\\app\\\\modules\\\\policies\\\\view\\\\endpoints\\\\networkSandboxing\\\\installer3.xml\"],\"fileSizes\":[\"2614\",\"2615\",\"2616\"],\"remediationActions\":[\"1\",\"\",\"1\"],\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"network-sandboxing\",\"_testEvent_\":true}" + }, + { + "message": "{\"endpointId\":\"59b7d9bfa849af3a1465b7e3\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"exchange-user-credentials\",\"_testEvent_\":true}" + }, + { + "message": "{\"module\":\"hwid-change\",\"product_installed\":\"BEST\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_name\":\"A\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"81.2.69.144\",\"computer_id\":\"5e284ff5b7e43d387ba54a96\",\"old_hwid\":\"00000000-0000-0000-0000-406186b5bde7\",\"new_hwid\":\"00000000-0000-0000-0000-406186b5bde6\",\"endpointId\":\"5e284ff5b7e43d387ba54a95\",\"_testEvent_\":true}" + }, + { + "message": "{\"module\":\"network-monitor\",\"product_installed\":\"BEST\",\"user\":{\"userName\":\"user1@domain.com\",\"userSid\":\"S-1-2-3-4\"},\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5d639e8f48ac2f04f6e00b1c\",\"actionTaken\":\"reportOnly\",\"detection_name\":\"PrivacyThreat.PasswordStealer.HTTP\",\"detection_attackTechnique\":\"discovery\",\"source_ip\":\"10.17.134.4\",\"victim_ip\":\"67.43.156.1\",\"local_port\":\"80\",\"timestamp\":\"2019-01-24T11:13:04.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"_testEvent_\":true}" + }, + { + "message": "{\"module\":\"new-incident\",\"created\":\"2020-07-20T09:36:23.485Z\",\"endpointId\":\"5efb3a520075db7384dfa285\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_id\":\"5efb3a520075db7384dfa286\",\"computer_fqdn\":\"desktop-jac14gs\",\"computer_name\":\"DESKTOP-JAC14GS\",\"detection_name\":\"ATC.Malicious\",\"attack_types\":[\"Other\"],\"computer_ip\":\"10.17.23.30\",\"severityScore\":90,\"incident_id\":\"5f1557cbe7b2584f3959ee19\",\"attack_entry\":1688239188,\"parent_process_path\":\"c:\\\\windows\\\\system32\\\\cmd.exe\",\"parent_process_pid\":9636,\"process_path\":\"c:\\\\users\\\\bdadmin\\\\desktop\\\\atcsim\\\\atcsim32.exe\",\"process_pid\":10324,\"username\":\"DESKTOP-JAC14GS\\\\bdadmin\",\"user_sid\":\"S-1-5-21-3349207704-443292085-2237656896-1003\",\"process_command_line\":\"detect\",\"file_hash_md5\":\"ccb1b07bdf330627f02b3c832663a489\",\"file_hash_sha256\":\"d5adc6a65a57d30d3ae70d195983d155e7cd24f26eb1ebebde9b92655251ec55\",\"att_ck_id\":[\"T1036\",\"T1059\",\"T1002\",\"T1012\"],\"severity\":\"high\",\"main_action\":\"no action\",\"_testEvent_\":true}" + }, + { + "message": "{\"module\":\"ransomware-mitigation\",\"companyId\":\"623c18fb12fb8700396d6375\",\"product_installed\":\"SVA\",\"user\":{\"name\":\"user\",\"sid\":\"S-11-22-33\"},\"company_name\":\"Bitdefender\",\"computer_name\":\"DC-Nebula\",\"computer_fqdn\":\"undefined\",\"computer_ip\":\"10.17.16.10\",\"computer_id\":\"5ed4d2fef23f7325715dbb22\",\"attack_type\":\"remote\",\"item_count\":\"23\",\"detected_on\":1591007594,\"attack_source\":\"10.10.20.120\",\"_testEvent_\":true}" + }, + { + "message": "{\"module\":\"security-container-update-available\",\"product_installed\":\"BEST\",\"companyId\":\"623c18fb12fb8700396d6375\",\"computer_name\":\"security-container-x\",\"computer_fqdn\":\"security-container-x-containers-host.dsd.ro\",\"computer_ip\":\"10.17.15.247\",\"computer_id\":\"60f6ba5e1b3272cce33c3281\",\"host_name\":\"TEST_ENDPOINT_2\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e3\",\"endpointId\":\"5e2085febf255a545e52276a\",\"hwid\":\"5e284ff-5b7e43d387ba-54a95\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"endpoint-moved-in\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"endpointId\":\"5e2085febf255a545e52276b\",\"hwid\":\"5e284ff-5b7e43d387ba-54a95\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"endpoint-moved-out\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"59b7d9bfa849af3a1465b7e4\",\"endpointId\":\"5e2085febf255a545e52276b\",\"reason\":1,\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"uninstall\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5cf51ba5e8ee8c5b1852a9d7\",\"endpointId\":\"5cf51ba5e8ee8c5b1852a9d6\",\"detection_action\":\"kill\",\"detection_threatName\":\"EICAR-Test-File (not a virus)\",\"detection_pid\":\"2000\",\"detection_exploitTechnique\":\"Flash/Generic\",\"detection_parentPid\":\"4000\",\"detection_path\":\"C:\\\\file15c8ba8b90ea1de127962f464.exe\",\"detection_parentPath\":\"C:\\\\file25c8ba8b90ea1de127962f464.exe\",\"detection_cve\":\"cve string\",\"detection_username\":\"user@domain.com\",\"detection_time\":\"2019-06-03T13:58:30.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"antiexploit\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.18.226\",\"computer_id\":\"5cf51ba5e8ee8c5b1852a9d7\",\"module\":\"install\",\"endpointId\":\"5e2085febf255a545e52276b\",\"hwid\":\"00000000-0000-0000-0000-406186b5bdbdzzz50\",\"companyId\":\"623c18fb12fb8700396d6375\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"BEST\",\"computer_name\":\"TEST_ENDPOINT_WINDOWS_10\",\"computer_fqdn\":\"test-endpoint.dsd.ro\",\"computer_ip\":\"10.10.0.101\",\"computer_id\":\"5ee30e2b29a4e218489442b6\",\"taskId\":\"5eea0105f23f731302405833\",\"taskType\":\"Debug Session\",\"errorCode\":3,\"username\":\"test@test.com\",\"localPath\":\"/test/dir\",\"networkSharePath\":\"//1.2.3.4/dir\",\"saveToBitdefenderCloud\":0,\"status\":3,\"stopReason\":2,\"failedStorageType\":1,\"startDate\":\"2020-06-24T06:06:48.000Z\",\"endDate\":\"2020-06-24T06:09:28.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"troubleshooting-activity\",\"_testEvent_\":true}" + }, + { + "message": "{\"product_installed\":\"EPS\",\"user\":{\"name\":\"admin\",\"sid\":\"BF410F3B-5F3A-41E1-BF8F-28DE6948A355\"},\"computer_name\":\"Computer 1\",\"computer_fqdn\":\"computer1.local\",\"computer_ip\":\"89.160.20.112\",\"computer_id\":\"5c12612db1a43dc3097b23c6\",\"malware_type\":\"file\",\"malware_name\":\"\",\"final_status\":\"quarantined\",\"file_path\":\"/Users/admin/Desktop/\",\"attack_type\":\"targeted attack\",\"detection_level\":\"permissive\",\"is_fileless_attack\":0,\"hwid\":\"22574006-79523827-7401-9565-1295-798280775872\",\"date\":\"2019-01-17T10:01:02.000Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"hd\",\"_testEvent_\":true}" + }, + { + "message": "{\"syncerId\":\"59b7d9bfa849af3a1465b7e3\",\"issueType\":0,\"lastAdReportDate\":\"2017-09-14T08:03:49.671Z\",\"companyId\":\"623c18fb12fb8700396d6375\",\"module\":\"adcloud\",\"_testEvent_\":true}" + } + ] +} \ No newline at end of file diff --git a/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json-expected.json b/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json-expected.json index 236756e0933..396cd5a6d6b 100644 --- a/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json-expected.json +++ b/packages/bitdefender/data_stream/push_notifications/_dev/test/pipeline/test-push-notification.json-expected.json @@ -23,7 +23,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "aph_blocked", @@ -109,7 +109,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "sender": { @@ -181,7 +181,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -246,7 +246,7 @@ "ip": "10.17.46.196" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", @@ -326,7 +326,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "avc_blocked", @@ -405,7 +405,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -469,7 +469,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "portscan_blocked", @@ -537,7 +537,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "0", @@ -603,7 +603,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_protection_blocked", @@ -678,7 +678,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "uc_site_blocked", @@ -756,7 +756,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "3", @@ -825,7 +825,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -890,7 +890,7 @@ "ip": "192.168.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -960,7 +960,7 @@ "id": "test1234" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1024,7 +1024,7 @@ "id": "test1234" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1087,7 +1087,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1173,7 +1173,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reportOnly", @@ -1283,7 +1283,7 @@ "ip": "10.17.23.30" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "no action", @@ -1389,7 +1389,7 @@ "ip": "10.17.16.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1461,7 +1461,7 @@ "ip": "10.17.15.247" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1523,7 +1523,7 @@ "ip": "10.10.18.226" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1584,7 +1584,7 @@ "ip": "10.10.18.226" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1645,7 +1645,7 @@ "ip": "10.10.18.226" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1715,7 +1715,7 @@ "ip": "10.10.18.226" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "kill", @@ -1799,7 +1799,7 @@ "ip": "10.10.18.226" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1870,7 +1870,7 @@ "ip": "10.10.0.101" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "3", @@ -1969,7 +1969,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "quarantined", @@ -2036,7 +2036,7 @@ "id": "test1234" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/bitdefender/data_stream/push_notifications/elasticsearch/ingest_pipeline/default.yml b/packages/bitdefender/data_stream/push_notifications/elasticsearch/ingest_pipeline/default.yml index 0bf160b9c6a..3d9403a8e7a 100644 --- a/packages/bitdefender/data_stream/push_notifications/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitdefender/data_stream/push_notifications/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 2 description: Processes HTTP JSON events from BitDefender processors: - json: @@ -31,7 +30,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ### fix common dumb string/numeric conflicts that we've seen so far, before doing anything else ### NOTE: given the insanity oozing out of the "defined" BitDefender push notification event type formats, diff --git a/packages/bitdefender/data_stream/push_notifications/manifest.yml b/packages/bitdefender/data_stream/push_notifications/manifest.yml index 1c7c2934adf..9854c1424f3 100644 --- a/packages/bitdefender/data_stream/push_notifications/manifest.yml +++ b/packages/bitdefender/data_stream/push_notifications/manifest.yml @@ -79,3 +79,4 @@ streams: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/bitdefender/data_stream/push_notifications/sample_event.json b/packages/bitdefender/data_stream/push_notifications/sample_event.json index c17b00dee0d..5f942670760 100644 --- a/packages/bitdefender/data_stream/push_notifications/sample_event.json +++ b/packages/bitdefender/data_stream/push_notifications/sample_event.json @@ -24,7 +24,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", diff --git a/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json b/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json index bf98a2f0827..81beee2c41c 100644 --- a/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json +++ b/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json @@ -1,3 +1,7 @@ { - "events": [{"message":"{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"count\":{\"errorMessages\":0,\"events\":9,\"sentMessages\":7,\"testEvents\":0},\"error\":{\"configurationError\":0,\"connectionError\":0,\"serviceError\":0,\"statusCode2xx\":0,\"statusCode300\":0,\"statusCode400\":0,\"statusCode500\":0,\"timeout\":0},\"lastUpdateTime\":\"2023-01-13T16:26:34\"}}"}] -} + "events": [ + { + "message": "{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"count\":{\"errorMessages\":0,\"events\":9,\"sentMessages\":7,\"testEvents\":0},\"error\":{\"configurationError\":0,\"connectionError\":0,\"serviceError\":0,\"statusCode2xx\":0,\"statusCode300\":0,\"statusCode400\":0,\"statusCode500\":0,\"timeout\":0},\"lastUpdateTime\":\"2023-01-13T16:26:34\"}}" + } + ] +} \ No newline at end of file diff --git a/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json-expected.json b/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json-expected.json index e7c9ba930f7..063b72e17a0 100644 --- a/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json-expected.json +++ b/packages/bitdefender/data_stream/push_statistics/_dev/test/pipeline/test-push-statistics.json-expected.json @@ -25,7 +25,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"id\":\"1\",\"jsonrpc\":\"2.0\",\"result\":{\"count\":{\"errorMessages\":0,\"events\":9,\"sentMessages\":7,\"testEvents\":0},\"error\":{\"configurationError\":0,\"connectionError\":0,\"serviceError\":0,\"statusCode2xx\":0,\"statusCode300\":0,\"statusCode400\":0,\"statusCode500\":0,\"timeout\":0},\"lastUpdateTime\":\"2023-01-13T16:26:34\"}}" diff --git a/packages/bitdefender/data_stream/push_statistics/agent/stream/httpjson.yml.hbs b/packages/bitdefender/data_stream/push_statistics/agent/stream/httpjson.yml.hbs index bddfb9a873b..f410e481d4d 100644 --- a/packages/bitdefender/data_stream/push_statistics/agent/stream/httpjson.yml.hbs +++ b/packages/bitdefender/data_stream/push_statistics/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.url: {{url}} request.method: POST {{#if proxy_url }} diff --git a/packages/bitdefender/data_stream/push_statistics/elasticsearch/ingest_pipeline/default.yml b/packages/bitdefender/data_stream/push_statistics/elasticsearch/ingest_pipeline/default.yml index a0cc03bfa7c..a8ca0f51ca5 100644 --- a/packages/bitdefender/data_stream/push_statistics/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitdefender/data_stream/push_statistics/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 1 description: Pipeline for BitDefender push notification stats processors: - json: @@ -10,7 +9,7 @@ processors: message: missing json object in input document - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/bitdefender/data_stream/push_statistics/manifest.yml b/packages/bitdefender/data_stream/push_statistics/manifest.yml index 097eee86b58..f173e4c8dc1 100644 --- a/packages/bitdefender/data_stream/push_statistics/manifest.yml +++ b/packages/bitdefender/data_stream/push_statistics/manifest.yml @@ -38,7 +38,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/bitdefender/data_stream/push_statistics/sample_event.json b/packages/bitdefender/data_stream/push_statistics/sample_event.json index 448a682095b..cc11025d982 100644 --- a/packages/bitdefender/data_stream/push_statistics/sample_event.json +++ b/packages/bitdefender/data_stream/push_statistics/sample_event.json @@ -36,7 +36,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", diff --git a/packages/bitdefender/docs/README.md b/packages/bitdefender/docs/README.md index 03c38dc15ca..a03146d7433 100644 --- a/packages/bitdefender/docs/README.md +++ b/packages/bitdefender/docs/README.md @@ -340,10 +340,10 @@ All BitDefender GravityZone log events are available in the `bitdefender_gravity | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -466,7 +466,7 @@ An example event for `push_notifications` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", @@ -621,7 +621,7 @@ An example event for `push_configuration` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", @@ -720,7 +720,7 @@ An example event for `push_statistics` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f0239f6f-245e-4d57-bada-68e5f564b259", diff --git a/packages/bitdefender/kibana/tags.yml b/packages/bitdefender/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/bitdefender/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/bitdefender/manifest.yml b/packages/bitdefender/manifest.yml index 7ada8d2f352..e1c75466f8d 100644 --- a/packages/bitdefender/manifest.yml +++ b/packages/bitdefender/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: bitdefender title: "BitDefender" -version: "1.0.0" +version: "1.5.0" source: license: "Elastic-2.0" description: "Ingest BitDefender GravityZone logs and data" @@ -9,8 +9,10 @@ type: integration categories: - security conditions: - kibana.version: "^8.5.1" - elastic.subscription: "basic" + kibana: + version: "^8.5.1" + elastic: + subscription: "basic" screenshots: - src: /img/bitdefender-dashboard-push-notifications.png title: Push Notifications Dashboard @@ -72,5 +74,13 @@ policy_templates: title: BitDefender GravityZone API Key show_user: true required: true + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/bitwarden/_dev/build/build.yml b/packages/bitwarden/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/bitwarden/_dev/build/build.yml +++ b/packages/bitwarden/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/bitwarden/changelog.yml b/packages/bitwarden/changelog.yml index 06bf3c693c4..984dcfddd30 100644 --- a/packages/bitwarden/changelog.yml +++ b/packages/bitwarden/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.3.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7338 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.1.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.0.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "1.0.0" changes: - description: Release Bitwarden as GA. diff --git a/packages/bitwarden/data_stream/collection/_dev/test/pipeline/test-collection.log-expected.json b/packages/bitwarden/data_stream/collection/_dev/test/pipeline/test-collection.log-expected.json index f8e37c29ed4..a55b9e29fe9 100644 --- a/packages/bitwarden/data_stream/collection/_dev/test/pipeline/test-collection.log-expected.json +++ b/packages/bitwarden/data_stream/collection/_dev/test/pipeline/test-collection.log-expected.json @@ -11,7 +11,7 @@ "object": "collection" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/bitwarden/data_stream/collection/agent/stream/httpjson.yml.hbs b/packages/bitwarden/data_stream/collection/agent/stream/httpjson.yml.hbs index ded1daf0de1..68bc236a7ec 100644 --- a/packages/bitwarden/data_stream/collection/agent/stream/httpjson.yml.hbs +++ b/packages/bitwarden/data_stream/collection/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{url}}/public/collections {{#if proxy_url}} diff --git a/packages/bitwarden/data_stream/collection/elasticsearch/ingest_pipeline/default.yml b/packages/bitwarden/data_stream/collection/elasticsearch/ingest_pipeline/default.yml index 158b5755ae6..26ab2182e13 100644 --- a/packages/bitwarden/data_stream/collection/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitwarden/data_stream/collection/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing collection logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -15,7 +15,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - set: diff --git a/packages/bitwarden/data_stream/collection/manifest.yml b/packages/bitwarden/data_stream/collection/manifest.yml index 2924b6c660d..a799adc03b2 100644 --- a/packages/bitwarden/data_stream/collection/manifest.yml +++ b/packages/bitwarden/data_stream/collection/manifest.yml @@ -17,7 +17,7 @@ streams: - name: http_client_timeout type: text title: HTTP client timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/bitwarden/data_stream/collection/sample_event.json b/packages/bitwarden/data_stream/collection/sample_event.json index 5886cfa2358..3899b636d85 100644 --- a/packages/bitwarden/data_stream/collection/sample_event.json +++ b/packages/bitwarden/data_stream/collection/sample_event.json @@ -22,7 +22,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", diff --git a/packages/bitwarden/data_stream/event/_dev/test/pipeline/test-event.log-expected.json b/packages/bitwarden/data_stream/event/_dev/test/pipeline/test-event.log-expected.json index 8294bc26d4e..a83c3b5cc4b 100644 --- a/packages/bitwarden/data_stream/event/_dev/test/pipeline/test-event.log-expected.json +++ b/packages/bitwarden/data_stream/event/_dev/test/pipeline/test-event.log-expected.json @@ -36,7 +36,7 @@ "object": "event" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -101,7 +101,7 @@ "object": "event" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -166,7 +166,7 @@ "object": "event" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -224,7 +224,7 @@ "object": "event" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/bitwarden/data_stream/event/agent/stream/httpjson.yml.hbs b/packages/bitwarden/data_stream/event/agent/stream/httpjson.yml.hbs index d10d4407b21..240208fcbbb 100644 --- a/packages/bitwarden/data_stream/event/agent/stream/httpjson.yml.hbs +++ b/packages/bitwarden/data_stream/event/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{url}}/public/events {{#if proxy_url}} diff --git a/packages/bitwarden/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/bitwarden/data_stream/event/elasticsearch/ingest_pipeline/default.yml index 91c9fe8e595..739e64f86c9 100644 --- a/packages/bitwarden/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitwarden/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing event logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -18,7 +18,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - fingerprint: @@ -47,7 +47,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless ignore_failure: false @@ -601,7 +601,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.date target_field: bitwarden.event.date @@ -612,7 +612,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.device tag: 'convert_device_to_string' @@ -623,7 +623,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless ignore_failure: false @@ -671,7 +671,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{bitwarden.event.ip_address}}}' diff --git a/packages/bitwarden/data_stream/event/manifest.yml b/packages/bitwarden/data_stream/event/manifest.yml index 5b79991c2dc..8c203141274 100644 --- a/packages/bitwarden/data_stream/event/manifest.yml +++ b/packages/bitwarden/data_stream/event/manifest.yml @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP client timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/bitwarden/data_stream/event/sample_event.json b/packages/bitwarden/data_stream/event/sample_event.json index 56111bdcda2..a3d6b427cff 100644 --- a/packages/bitwarden/data_stream/event/sample_event.json +++ b/packages/bitwarden/data_stream/event/sample_event.json @@ -46,7 +46,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", diff --git a/packages/bitwarden/data_stream/group/_dev/test/pipeline/test-group.log-expected.json b/packages/bitwarden/data_stream/group/_dev/test/pipeline/test-group.log-expected.json index 20e8d353e7e..4bfbe17f6dc 100644 --- a/packages/bitwarden/data_stream/group/_dev/test/pipeline/test-group.log-expected.json +++ b/packages/bitwarden/data_stream/group/_dev/test/pipeline/test-group.log-expected.json @@ -19,7 +19,7 @@ "object": "group" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/bitwarden/data_stream/group/agent/stream/httpjson.yml.hbs b/packages/bitwarden/data_stream/group/agent/stream/httpjson.yml.hbs index 57380ed6d37..02fe69f6575 100644 --- a/packages/bitwarden/data_stream/group/agent/stream/httpjson.yml.hbs +++ b/packages/bitwarden/data_stream/group/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{url}}/public/groups {{#if proxy_url}} diff --git a/packages/bitwarden/data_stream/group/elasticsearch/ingest_pipeline/default.yml b/packages/bitwarden/data_stream/group/elasticsearch/ingest_pipeline/default.yml index 738aab447b4..fb6409def1a 100644 --- a/packages/bitwarden/data_stream/group/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitwarden/data_stream/group/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing event logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -15,7 +15,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.kind value: event @@ -45,7 +45,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.externalId target_field: bitwarden.group.external.id @@ -78,7 +78,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.collections if: ctx.json?.collections instanceof List diff --git a/packages/bitwarden/data_stream/group/manifest.yml b/packages/bitwarden/data_stream/group/manifest.yml index 9493fe3debf..86229916ad4 100644 --- a/packages/bitwarden/data_stream/group/manifest.yml +++ b/packages/bitwarden/data_stream/group/manifest.yml @@ -17,7 +17,7 @@ streams: - name: http_client_timeout type: text title: HTTP client timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/bitwarden/data_stream/group/sample_event.json b/packages/bitwarden/data_stream/group/sample_event.json index 007c82b41fb..93e0838fb36 100644 --- a/packages/bitwarden/data_stream/group/sample_event.json +++ b/packages/bitwarden/data_stream/group/sample_event.json @@ -30,7 +30,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", diff --git a/packages/bitwarden/data_stream/policy/_dev/test/pipeline/test-policy.log-expected.json b/packages/bitwarden/data_stream/policy/_dev/test/pipeline/test-policy.log-expected.json index ec324a49133..f30f1b3acdd 100644 --- a/packages/bitwarden/data_stream/policy/_dev/test/pipeline/test-policy.log-expected.json +++ b/packages/bitwarden/data_stream/policy/_dev/test/pipeline/test-policy.log-expected.json @@ -30,7 +30,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -60,7 +60,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -99,7 +99,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -129,7 +129,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -159,7 +159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -186,7 +186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -213,7 +213,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -240,7 +240,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/bitwarden/data_stream/policy/agent/stream/httpjson.yml.hbs b/packages/bitwarden/data_stream/policy/agent/stream/httpjson.yml.hbs index d91e0076c85..d5a4199fec3 100644 --- a/packages/bitwarden/data_stream/policy/agent/stream/httpjson.yml.hbs +++ b/packages/bitwarden/data_stream/policy/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{url}}/public/policies {{#if proxy_url}} diff --git a/packages/bitwarden/data_stream/policy/elasticsearch/ingest_pipeline/default.yml b/packages/bitwarden/data_stream/policy/elasticsearch/ingest_pipeline/default.yml index 4c74c421a91..293f7cde142 100644 --- a/packages/bitwarden/data_stream/policy/elasticsearch/ingest_pipeline/default.yml +++ b/packages/bitwarden/data_stream/policy/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing policy logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -15,7 +15,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - set: @@ -34,7 +34,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.autoEnrollEnabled tag: 'convert_autoEnrollEnabled_to_string' @@ -45,7 +45,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.capitalize tag: 'convert_capitalize_to_string' @@ -55,7 +55,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.disableHideEmail tag: 'convert_disableHideEmail_to_string' @@ -66,7 +66,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.includeNumber tag: 'convert_includeNumber_to_string' @@ -77,7 +77,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minComplexity tag: 'convert_minComplexity_to_string' @@ -88,7 +88,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minLength tag: 'convert_minLength_to_string' @@ -99,7 +99,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minNumbers tag: 'convert_minNumbers_to_string' @@ -110,7 +110,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minNumberWords tag: 'convert_minNumberWords_to_string' @@ -121,7 +121,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minSpecial tag: 'convert_minSpecial_to_string' @@ -132,7 +132,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.minutes tag: 'convert_minutes_to_string' @@ -142,7 +142,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.requireLower tag: 'convert_requireLower_to_string' @@ -153,7 +153,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.requireNumbers tag: 'convert_requireNumbers_to_string' @@ -164,7 +164,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.requireSpecial tag: 'convert_requireSpecial_to_string' @@ -175,7 +175,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.requireUpper tag: 'convert_requireUpper_to_string' @@ -186,7 +186,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.useLower tag: 'convert_useLower_to_string' @@ -197,7 +197,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.useNumbers tag: 'convert_useNumbers_to_string' @@ -208,7 +208,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.useSpecial tag: 'convert_useSpecial_to_string' @@ -219,7 +219,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.data.useUpper tag: 'convert_useUpper_to_string' @@ -230,7 +230,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.data.defaultType target_field: json.data.default_type @@ -257,7 +257,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless ignore_failure: false diff --git a/packages/bitwarden/data_stream/policy/manifest.yml b/packages/bitwarden/data_stream/policy/manifest.yml index d61ec34bf2a..5b3af4f7d6a 100644 --- a/packages/bitwarden/data_stream/policy/manifest.yml +++ b/packages/bitwarden/data_stream/policy/manifest.yml @@ -17,7 +17,7 @@ streams: - name: http_client_timeout type: text title: HTTP client timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/bitwarden/data_stream/policy/sample_event.json b/packages/bitwarden/data_stream/policy/sample_event.json index d1a8c6e8307..73847f648f7 100644 --- a/packages/bitwarden/data_stream/policy/sample_event.json +++ b/packages/bitwarden/data_stream/policy/sample_event.json @@ -41,7 +41,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", diff --git a/packages/bitwarden/docs/README.md b/packages/bitwarden/docs/README.md index 9a3ba6937e6..f308bab80e3 100644 --- a/packages/bitwarden/docs/README.md +++ b/packages/bitwarden/docs/README.md @@ -73,7 +73,7 @@ An example event for `collection` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", @@ -179,7 +179,7 @@ An example event for `event` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", @@ -306,7 +306,7 @@ An example event for `group` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", @@ -417,7 +417,7 @@ An example event for `policy` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ff2a1bfe-20b0-4bab-ad84-8609f33b69f8", diff --git a/packages/bitwarden/kibana/tags.yml b/packages/bitwarden/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/bitwarden/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/bitwarden/manifest.yml b/packages/bitwarden/manifest.yml index db1583fdf66..56995152079 100644 --- a/packages/bitwarden/manifest.yml +++ b/packages/bitwarden/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: bitwarden title: Bitwarden -version: "1.0.0" +version: "1.5.0" source: license: Elastic-2.0 description: Collect logs from Bitwarden with Elastic Agent. @@ -10,8 +10,10 @@ categories: - security - credential_management conditions: - kibana.version: "^8.4.1" - elastic.subscription: "basic" + kibana: + version: "^8.4.1" + elastic: + subscription: "basic" screenshots: - src: /img/bitwarden-event-dashboard.png title: Event dashboard @@ -105,5 +107,13 @@ policy_templates: # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk # sxSmbIUfc2SGJGCJD4I= # -----END CERTIFICATE----- + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/box_events/_dev/build/build.yml b/packages/box_events/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/box_events/_dev/build/build.yml +++ b/packages/box_events/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/box_events/changelog.yml b/packages/box_events/changelog.yml index a19fa65f2f0..9d6e8dea9f7 100644 --- a/packages/box_events/changelog.yml +++ b/packages/box_events/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7592 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.6.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.5.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-anomalous-download.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-anomalous-download.log-expected.json index 5dde383de54..c5656cd4866 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-anomalous-download.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-anomalous-download.log-expected.json @@ -47,7 +47,7 @@ "ip": "10.1.2.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", @@ -191,7 +191,7 @@ "ip": "10.1.2.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-copy.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-copy.log-expected.json index 916eedad050..dc189c2fb5e 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-copy.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-copy.log-expected.json @@ -54,7 +54,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_COPY", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-create.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-create.log-expected.json index 0bb966ccac7..c3cc62b9b50 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-create.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-create.log-expected.json @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_CREATE", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-download.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-download.log-expected.json index da5cfcc32bf..0015d38acb3 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-download.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-download.log-expected.json @@ -71,7 +71,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_DOWNLOAD", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-event-types.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-event-types.log-expected.json index b910ced137f..5fe3e70c05e 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-event-types.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-event-types.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACCESS_GRANTED", @@ -21,7 +21,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACCESS_REVOKED", @@ -40,7 +40,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_DEVICE_ASSOCIATION", @@ -59,7 +59,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_LOGIN_ACTIVITY_DEVICE", @@ -79,7 +79,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADMIN_LOGIN", @@ -97,7 +97,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "APPLICATION_CREATED", @@ -115,7 +115,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "APPLICATION_PUBLIC_KEY_ADDED", @@ -135,7 +135,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "APPLICATION_PUBLIC_KEY_DELETED", @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ADMIN_ROLE", @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_FOLDER_PERMISSION", @@ -192,7 +192,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLABORATION_ACCEPT", @@ -211,7 +211,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLABORATION_EXPIRATION", @@ -230,7 +230,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLABORATION_INVITE", @@ -249,7 +249,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLABORATION_REMOVE", @@ -268,7 +268,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLABORATION_ROLE_CHANGE", @@ -287,7 +287,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLAB_ADD_COLLABORATOR", @@ -306,7 +306,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLAB_INVITE_COLLABORATOR", @@ -324,7 +324,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLAB_REMOVE_COLLABORATOR", @@ -343,7 +343,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COLLAB_ROLE_CHANGE", @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMMENT_CREATE", @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMMENT_DELETE", @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_ACCESS", @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_ABNORMAL_DOWNLOAD_ACTIVITY", @@ -437,7 +437,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_AUTOMATION_ADD", @@ -455,7 +455,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_AUTOMATION_DELETE", @@ -473,7 +473,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_POLICY_ADD", @@ -492,7 +492,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_SHARING_POLICY_VIOLATION", @@ -512,7 +512,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CONTENT_WORKFLOW_UPLOAD_POLICY_VIOLATION", @@ -532,7 +532,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COPY", @@ -550,7 +550,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DATA_RETENTION_CREATE_RETENTION", @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DATA_RETENTION_REMOVE_RETENTION", @@ -588,7 +588,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE", @@ -606,7 +606,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_USER", @@ -625,7 +625,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DEVICE_TRUST_CHECK_FAILED", @@ -645,7 +645,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DOWNLOAD", @@ -663,7 +663,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EDIT", @@ -682,7 +682,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EDIT_USER", @@ -700,7 +700,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EMAIL_ALIAS_CONFIRM", @@ -718,7 +718,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EMAIL_ALIAS_REMOVE", @@ -736,7 +736,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_TWO_FACTOR_AUTH", @@ -754,7 +754,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENTERPRISE_APP_AUTHORIZATION_UPDATE", @@ -773,7 +773,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FAILED_LOGIN", @@ -793,7 +793,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FILE_MARKED_MALICIOUS", @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FILE_WATERMARKED_DOWNLOAD", @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_ADD_ITEM", @@ -849,7 +849,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_ADD_USER", @@ -868,7 +868,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_CREATION", @@ -887,7 +887,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_DELETION", @@ -906,7 +906,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_EDITED", @@ -925,7 +925,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_REMOVE_ITEM", @@ -944,7 +944,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_REMOVE_USER", @@ -964,7 +964,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_COPY", @@ -982,7 +982,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_CREATE", @@ -1000,7 +1000,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_DOWNLOAD", @@ -1018,7 +1018,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_MAKE_CURRENT_VERSION", @@ -1037,7 +1037,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_MODIFY", @@ -1055,7 +1055,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_MOVE", @@ -1074,7 +1074,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_OPEN", @@ -1092,7 +1092,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_PREVIEW", @@ -1110,7 +1110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_RENAME", @@ -1129,7 +1129,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_SHARED", @@ -1148,7 +1148,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_SHARED_CREATE", @@ -1167,7 +1167,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_SHARED_UNSHARE", @@ -1186,7 +1186,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_SHARED_UPDATE", @@ -1205,7 +1205,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_SYNC", @@ -1224,7 +1224,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_TRASH", @@ -1243,7 +1243,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_UNDELETE_VIA_TRASH", @@ -1262,7 +1262,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_UNSYNC", @@ -1281,7 +1281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_UPLOAD", @@ -1299,7 +1299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LEGAL_HOLD_ASSIGNMENT_CREATE", @@ -1318,7 +1318,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LEGAL_HOLD_ASSIGNMENT_DELETE", @@ -1337,7 +1337,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LEGAL_HOLD_POLICY_CREATE", @@ -1356,7 +1356,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LEGAL_HOLD_POLICY_DELETE", @@ -1375,7 +1375,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LEGAL_HOLD_POLICY_UPDATE", @@ -1394,7 +1394,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOCK", @@ -1413,7 +1413,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOCK_CREATE", @@ -1432,7 +1432,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOCK_DESTROY", @@ -1451,7 +1451,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN", @@ -1469,7 +1469,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MASTER_INVITE_ACCEPT", @@ -1487,7 +1487,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MASTER_INVITE_REJECT", @@ -1505,7 +1505,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_INSTANCE_CREATE", @@ -1523,7 +1523,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_INSTANCE_DELETE", @@ -1541,7 +1541,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_INSTANCE_UPDATE", @@ -1559,7 +1559,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_TEMPLATE_CREATE", @@ -1577,7 +1577,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_TEMPLATE_DELETE", @@ -1595,7 +1595,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "METADATA_TEMPLATE_UPDATE", @@ -1613,7 +1613,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOVE", @@ -1632,7 +1632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NEW_USER", @@ -1650,7 +1650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PREVIEW", @@ -1668,7 +1668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_DEVICE_ASSOCIATION", @@ -1686,7 +1686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_LOGIN_ACTIVITY_DEVICE", @@ -1705,7 +1705,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME", @@ -1724,7 +1724,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RETENTION_POLICY_ASSIGNMENT_ADD", @@ -1743,7 +1743,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHARE", @@ -1762,7 +1762,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHARE_EXPIRATION", @@ -1781,7 +1781,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", @@ -1799,7 +1799,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_EXTERNAL_COLLAB_ACCESS_BLOCKED", @@ -1818,7 +1818,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_EXTERNAL_COLLAB_ACCESS_BLOCKED_MISSING_JUSTIFICATION", @@ -1837,7 +1837,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_EXTERNAL_COLLAB_INVITE_BLOCKED", @@ -1856,7 +1856,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_EXTERNAL_COLLAB_INVITE_BLOCKED_MISSING_JUSTIFICATION", @@ -1875,7 +1875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_JUSTIFICATION_APPROVAL", @@ -1894,7 +1894,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_ASSIGNED", @@ -1913,7 +1913,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_CANCELLED", @@ -1932,7 +1932,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_COMPLETED", @@ -1951,7 +1951,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_CONVERTED", @@ -1970,7 +1970,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_CREATED", @@ -1989,7 +1989,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_DECLINED", @@ -2008,7 +2008,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_EXPIRED", @@ -2027,7 +2027,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_SIGNED", @@ -2046,7 +2046,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGN_DOCUMENT_VIEWED_BY_SIGNED", @@ -2065,7 +2065,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGNER_DOWNLOADED", @@ -2084,7 +2084,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIGNER_FORWARDED", @@ -2103,7 +2103,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "STORAGE_EXPIRATION", @@ -2121,7 +2121,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TAG_ITEM_CREATE", @@ -2140,7 +2140,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TASK_ASSIGNMENT_CREATE", @@ -2160,7 +2160,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TASK_ASSIGNMENT_DELETE", @@ -2180,7 +2180,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TASK_ASSIGNMENT_UPDATE", @@ -2200,7 +2200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TASK_CREATE", @@ -2219,7 +2219,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TASK_UPDATE", @@ -2238,7 +2238,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TERMS_OF_SERVICE_ACCEPT", @@ -2257,7 +2257,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TERMS_OF_SERVICE_REJECT", @@ -2276,7 +2276,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNDELETE", @@ -2294,7 +2294,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNLOCK", @@ -2312,7 +2312,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNSHARE", @@ -2331,7 +2331,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_COLLABORATION_EXPIRATION", @@ -2351,7 +2351,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_SHARE_EXPIRATION", @@ -2370,7 +2370,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPLOAD", @@ -2388,7 +2388,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_AUTHENTICATE_OAUTH2_ACCESS_TOKEN_CREATE", @@ -2408,7 +2408,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "WATERMARK_LABEL_CREATE", @@ -2427,7 +2427,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "WATERMARK_LABEL_DELETE", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-malicious-content.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-malicious-content.log-expected.json index 642fcf0645f..18300bb3fea 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-malicious-content.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-malicious-content.log-expected.json @@ -61,7 +61,7 @@ "ip": "10.1.2.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", @@ -199,7 +199,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-preview.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-preview.log-expected.json index 1d5429dc56c..e4027c0ad7a 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-preview.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-preview.log-expected.json @@ -71,7 +71,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_PREVIEW", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-rename.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-rename.log-expected.json index 296be954bdc..0953849e882 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-rename.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-rename.log-expected.json @@ -54,7 +54,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_RENAME", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-locations.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-locations.log-expected.json index 8e8af62d4c5..25d5fc70733 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-locations.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-locations.log-expected.json @@ -19,7 +19,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", @@ -114,7 +114,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-sessions.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-sessions.log-expected.json index 7e93866f12f..41606f2f69c 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-sessions.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-suspicious-sessions.log-expected.json @@ -22,7 +22,7 @@ "ip": "10.1.2.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", @@ -116,7 +116,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SHIELD_ALERT", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-trash.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-trash.log-expected.json index fc76b7d93e1..63413e71bfb 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-trash.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-trash.log-expected.json @@ -49,7 +49,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_TRASH", diff --git a/packages/box_events/data_stream/events/_dev/test/pipeline/test-upload.log-expected.json b/packages/box_events/data_stream/events/_dev/test/pipeline/test-upload.log-expected.json index 52af96bff9f..e08dba02bc7 100644 --- a/packages/box_events/data_stream/events/_dev/test/pipeline/test-upload.log-expected.json +++ b/packages/box_events/data_stream/events/_dev/test/pipeline/test-upload.log-expected.json @@ -78,7 +78,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ITEM_UPLOAD", diff --git a/packages/box_events/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/box_events/data_stream/events/elasticsearch/ingest_pipeline/default.yml index 3ab7fd38c5e..262ca5ec098 100644 --- a/packages/box_events/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/box_events/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Box Events processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - rename: field: message target_field: event.original diff --git a/packages/box_events/data_stream/events/fields/ecs.yml b/packages/box_events/data_stream/events/fields/ecs.yml index df901b3be5a..2895f7a0881 100644 --- a/packages/box_events/data_stream/events/fields/ecs.yml +++ b/packages/box_events/data_stream/events/fields/ecs.yml @@ -74,8 +74,6 @@ name: threat.enrichments - external: ecs name: threat.enrichments.indicator.description -- external: ecs - name: threat.enrichments.indicator.ip - external: ecs name: threat.enrichments.indicator.first_seen - external: ecs diff --git a/packages/box_events/data_stream/events/fields/fields.yml b/packages/box_events/data_stream/events/fields/fields.yml index d95c59f198b..c84f5678897 100644 --- a/packages/box_events/data_stream/events/fields/fields.yml +++ b/packages/box_events/data_stream/events/fields/fields.yml @@ -229,12 +229,6 @@ - name: recorded_at description: The date and time at which this event occurred type: date - - name: created_at - description: When the event object was created - type: date - - name: created_at - description: When the event object was created - type: date - name: session description: Extend ECS related fields type: object @@ -387,13 +381,13 @@ fields: - name: type description: Value is always `folder`. This field is an array - type: array + type: keyword - name: id description: The unique identifier that represent a folder. This field is an array - type: array + type: keyword - name: name description: The name of the folder. This field is an array - type: array + type: keyword - name: purged_at description: The time at which this file is expected to be purged from the trash type: boolean diff --git a/packages/box_events/data_stream/events/manifest.yml b/packages/box_events/data_stream/events/manifest.yml index 545a6d09d7d..e0e4d81ad86 100644 --- a/packages/box_events/data_stream/events/manifest.yml +++ b/packages/box_events/data_stream/events/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: This sets the interval between requests to the Target Service, for example `300s` will send a request every 300 seconds. Events will be returned in batches of up to 100, with successive calls on expiry of the configured `interval` so you may wish to specify a lower interval when a substantial number of events are expected, however, we suggest to consider bandwidth when using lower settings + description: This sets the interval between requests to the Target Service, for example `300s` will send a request every 300 seconds. Events will be returned in batches of up to 100, with successive calls on expiry of the configured `interval` so you may wish to specify a lower interval when a substantial number of events are expected, however, we suggest to consider bandwidth when using lower settings. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/box_events/data_stream/events/sample_event.json b/packages/box_events/data_stream/events/sample_event.json index d5a462a486a..fd22e8f92de 100644 --- a/packages/box_events/data_stream/events/sample_event.json +++ b/packages/box_events/data_stream/events/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-12-08T08:00:00.000Z", "agent": { - "ephemeral_id": "19d0e7ab-6422-44e5-ab1b-a4344fde2a4f", - "id": "52ca6e8b-8f09-4ce6-a173-ec44c538809f", + "ephemeral_id": "764c37eb-8835-4094-ba76-e4a16049d6b9", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "box": { "additional_details": { @@ -57,12 +57,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "52ca6e8b-8f09-4ce6-a173-ec44c538809f", - "snapshot": true, - "version": "8.6.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "SHIELD_ALERT", @@ -71,10 +71,10 @@ "threat", "file" ], - "created": "2023-01-13T11:47:22.940Z", + "created": "2023-08-29T15:21:44.833Z", "dataset": "box_events.events", "id": "97f1b31f-f143-4777-81f8-1b557b39ca33", - "ingested": "2023-01-13T11:47:24Z", + "ingested": "2023-08-29T15:21:47Z", "kind": "alert", "risk_score": 77, "type": [ @@ -84,24 +84,24 @@ }, "host": { "architecture": "x86_64", - "containerized": false, + "containerized": true, "hostname": "docker-fleet-agent", - "id": "4547978d96e74314a1c62b73cc5cad86", + "id": "c2615f282eb54b57a5bab10d7ee84193", "ip": [ - "172.25.0.7" + "172.21.0.7" ], "mac": [ - "02-42-AC-19-00-07" + "02-42-AC-15-00-07" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", - "kernel": "5.15.49-linuxkit", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.5 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { diff --git a/packages/box_events/docs/README.md b/packages/box_events/docs/README.md index 188633e6dab..8eee67222b7 100644 --- a/packages/box_events/docs/README.md +++ b/packages/box_events/docs/README.md @@ -239,9 +239,9 @@ Preserves a raw copy of the original event, added to the field `event.original`. | box.source.parent.sequence_id | A numeric identifier that represents the most recent user event that has been applied to this item (parent) | keyword | | box.source.parent.type | Value is always `folder` | keyword | | box.source.path_collection.entries | The parent folders for this item | object | -| box.source.path_collection.entries.id | The unique identifier that represent a folder. This field is an array | array | -| box.source.path_collection.entries.name | The name of the folder. This field is an array | array | -| box.source.path_collection.entries.type | Value is always `folder`. This field is an array | array | +| box.source.path_collection.entries.id | The unique identifier that represent a folder. This field is an array | keyword | +| box.source.path_collection.entries.name | The name of the folder. This field is an array | keyword | +| box.source.path_collection.entries.type | Value is always `folder`. This field is an array | keyword | | box.source.path_collection.total_count | The number of folders in this list | long | | box.source.phone | Phone number | boolean | | box.source.purged_at | The time at which this file is expected to be purged from the trash | boolean | @@ -278,10 +278,10 @@ Preserves a raw copy of the original event, added to the field `event.original`. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | diff --git a/packages/box_events/kibana/tags.yml b/packages/box_events/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/box_events/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/box_events/manifest.yml b/packages/box_events/manifest.yml index be02d031752..2b6ef40b31b 100644 --- a/packages/box_events/manifest.yml +++ b/packages/box_events/manifest.yml @@ -1,9 +1,7 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: box_events title: Box Events -version: "1.5.0" -release: ga -license: basic +version: "1.9.0" description: "Collect logs from Box with Elastic Agent" type: integration categories: diff --git a/packages/carbon_black_cloud/_dev/build/build.yml b/packages/carbon_black_cloud/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/carbon_black_cloud/_dev/build/build.yml +++ b/packages/carbon_black_cloud/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/carbon_black_cloud/changelog.yml b/packages/carbon_black_cloud/changelog.yml index ef7f04bd098..06a44f94b54 100644 --- a/packages/carbon_black_cloud/changelog.yml +++ b/packages/carbon_black_cloud/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.12.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json index de351292166..4eecfee619e 100644 --- a/packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json +++ b/packages/carbon_black_cloud/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json @@ -61,7 +61,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "end": "2021-01-04T23:25:58.000Z", @@ -145,7 +145,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "end": "2020-11-17T22:02:16.000Z", @@ -271,7 +271,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "end": "2021-01-04T22:22:42.000Z", diff --git a/packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index f5e5b695b29..fbacd8de6f9 100644 --- a/packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbon_black_cloud/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud alerts. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/carbon_black_cloud/data_stream/alert/manifest.yml b/packages/carbon_black_cloud/data_stream/alert/manifest.yml index 6a1c709ade2..d5d4c58ad08 100644 --- a/packages/carbon_black_cloud/data_stream/alert/manifest.yml +++ b/packages/carbon_black_cloud/data_stream/alert/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Interval to fetch alerts from Carbon Black Cloud. NOTE:- Supported units for this parameter are h/m/s. + description: Interval to fetch alerts from Carbon Black Cloud. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the alerts from the Carbon Black Cloud API. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the alerts from the Carbon Black Cloud API. Supported units for this parameter are h/m/s. default: 24h multi: false required: true @@ -67,7 +67,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -83,7 +83,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE:- Supported units for this parameter are h/m/s. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. - name: api_timeout type: text title: "[SQS] API Timeout" @@ -91,7 +91,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE:- Supported units for this parameter are h/m/s. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/carbon_black_cloud/data_stream/alert/sample_event.json b/packages/carbon_black_cloud/data_stream/alert/sample_event.json index 4975573c5d2..708d71d665c 100644 --- a/packages/carbon_black_cloud/data_stream/alert/sample_event.json +++ b/packages/carbon_black_cloud/data_stream/alert/sample_event.json @@ -51,7 +51,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c073dde3-4d37-4b40-8161-a008a04d551f", diff --git a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/_dev/test/pipeline/test-asset-vulnerability-summary.log-expected.json b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/_dev/test/pipeline/test-asset-vulnerability-summary.log-expected.json index b1746cc76ba..f61ca660e34 100644 --- a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/_dev/test/pipeline/test-asset-vulnerability-summary.log-expected.json +++ b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/_dev/test/pipeline/test-asset-vulnerability-summary.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -67,7 +67,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -116,7 +116,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -165,7 +165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -214,7 +214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -263,7 +263,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -312,7 +312,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -361,7 +361,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", diff --git a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml index 54825d7414a..f333f224392 100644 --- a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: state diff --git a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/manifest.yml b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/manifest.yml index 1b2c8e26d82..afa402554a2 100644 --- a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/manifest.yml +++ b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Interval to query asset vulnerability summary in Carbon Black Cloud. NOTE:- Supported units for this parameter are h/m/s. + description: Interval to query asset vulnerability summary in Carbon Black Cloud. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/sample_event.json b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/sample_event.json index 42dc22f4a0e..872e41eb0d9 100644 --- a/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/sample_event.json +++ b/packages/carbon_black_cloud/data_stream/asset_vulnerability_summary/sample_event.json @@ -29,7 +29,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "45e49275-eb7d-4b20-a8af-d084fb2551c7", diff --git a/packages/carbon_black_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/carbon_black_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 1d1bc295592..7e6eb29dcc9 100644 --- a/packages/carbon_black_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/carbon_black_cloud/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -15,7 +15,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "16xxxxxxxxxx8ac7bd", @@ -51,7 +51,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "21xxxxxxxxxx93ff7c", @@ -87,7 +87,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "28xxxxxxxxxx8ac7bd", @@ -123,7 +123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "34xxxxxxxxxxd9ccf9", @@ -159,7 +159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "3axxxxxxxxxx2e5035", @@ -195,7 +195,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "32xxxxxxxxxx189c6d", @@ -231,7 +231,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9xxxxxxxxxx4b3d2c", diff --git a/packages/carbon_black_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index a0575e52ee3..c3cbc513354 100644 --- a/packages/carbon_black_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbon_black_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/carbon_black_cloud/data_stream/audit/manifest.yml b/packages/carbon_black_cloud/data_stream/audit/manifest.yml index d4aa797335c..5d0238e7087 100644 --- a/packages/carbon_black_cloud/data_stream/audit/manifest.yml +++ b/packages/carbon_black_cloud/data_stream/audit/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Interval to fetch audit logs from Carbon Black Cloud. NOTE:- Supported units for this parameter are h/m/s. + description: Interval to fetch audit logs from Carbon Black Cloud. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/carbon_black_cloud/data_stream/audit/sample_event.json b/packages/carbon_black_cloud/data_stream/audit/sample_event.json index 4fdd39ccf58..db89a77d320 100644 --- a/packages/carbon_black_cloud/data_stream/audit/sample_event.json +++ b/packages/carbon_black_cloud/data_stream/audit/sample_event.json @@ -25,7 +25,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "45e49275-eb7d-4b20-a8af-d084fb2551c7", diff --git a/packages/carbon_black_cloud/data_stream/endpoint_event/_dev/test/pipeline/test-endpoint-event.log-expected.json b/packages/carbon_black_cloud/data_stream/endpoint_event/_dev/test/pipeline/test-endpoint-event.log-expected.json index d2d5fed33ac..c7801e6b96a 100644 --- a/packages/carbon_black_cloud/data_stream/endpoint_event/_dev/test/pipeline/test-endpoint-event.log-expected.json +++ b/packages/carbon_black_cloud/data_stream/endpoint_event/_dev/test/pipeline/test-endpoint-event.log-expected.json @@ -37,7 +37,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CREATE_KEY", @@ -139,7 +139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_WRITE_VALUE", @@ -262,7 +262,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_OPEN_PROCESS_HANDLE", @@ -385,7 +385,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_OPEN_PROCESS_HANDLE", @@ -504,7 +504,7 @@ "path": "c:\\windows\\system32\\fltlib.dll" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_LOAD_MODULE", @@ -625,7 +625,7 @@ "path": "c:\\windows\\system32\\dnsapi.dll" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_LOAD_MODULE", @@ -746,7 +746,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CREATE_PROCESS", @@ -867,7 +867,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CREATE_PROCESS", @@ -968,7 +968,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_PROCESS_TERMINATE", @@ -1067,7 +1067,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_PROCESS_TERMINATE", @@ -1162,7 +1162,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_FILE_MOD_OPEN | ACTION_FILE_OPEN_DELETE", @@ -1260,7 +1260,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_FILE_MOD_OPEN | ACTION_FILE_OPEN_READ | ACTION_FILE_OPEN_WRITE", @@ -1362,7 +1362,7 @@ "port": 62909 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CONNECTION_CREATE", @@ -1470,7 +1470,7 @@ "port": 9716 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CONNECTION_LISTEN", @@ -1588,7 +1588,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_LOAD_SCRIPT", diff --git a/packages/carbon_black_cloud/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml index 2fd86563836..25223d99313 100644 --- a/packages/carbon_black_cloud/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbon_black_cloud/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud Endpoint Events. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/carbon_black_cloud/data_stream/endpoint_event/manifest.yml b/packages/carbon_black_cloud/data_stream/endpoint_event/manifest.yml index 684bb3d1e1d..97d31940eb8 100644 --- a/packages/carbon_black_cloud/data_stream/endpoint_event/manifest.yml +++ b/packages/carbon_black_cloud/data_stream/endpoint_event/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE:- Supported units for this parameter are h/m/s. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE:- Supported units for this parameter are h/m/s. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/carbon_black_cloud/data_stream/endpoint_event/sample_event.json b/packages/carbon_black_cloud/data_stream/endpoint_event/sample_event.json index 838d8b9020e..58c029fb454 100644 --- a/packages/carbon_black_cloud/data_stream/endpoint_event/sample_event.json +++ b/packages/carbon_black_cloud/data_stream/endpoint_event/sample_event.json @@ -20,7 +20,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "carbon_black_cloud": { "endpoint_event": { diff --git a/packages/carbon_black_cloud/data_stream/watchlist_hit/_dev/test/pipeline/test-watchlist-hit.log-expected.json b/packages/carbon_black_cloud/data_stream/watchlist_hit/_dev/test/pipeline/test-watchlist-hit.log-expected.json index 586973909a5..0913bd09c8b 100644 --- a/packages/carbon_black_cloud/data_stream/watchlist_hit/_dev/test/pipeline/test-watchlist-hit.log-expected.json +++ b/packages/carbon_black_cloud/data_stream/watchlist_hit/_dev/test/pipeline/test-watchlist-hit.log-expected.json @@ -67,7 +67,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -203,7 +203,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -333,7 +333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -455,7 +455,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -576,7 +576,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -683,7 +683,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/carbon_black_cloud/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml b/packages/carbon_black_cloud/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml index bdc34fde78d..4a9ccb7339d 100644 --- a/packages/carbon_black_cloud/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbon_black_cloud/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Carbon Black Cloud watchlist hit. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/carbon_black_cloud/data_stream/watchlist_hit/manifest.yml b/packages/carbon_black_cloud/data_stream/watchlist_hit/manifest.yml index 6fc7b5bef25..24fc8610729 100644 --- a/packages/carbon_black_cloud/data_stream/watchlist_hit/manifest.yml +++ b/packages/carbon_black_cloud/data_stream/watchlist_hit/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE:- Supported units for this parameter are h/m/s. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s. - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE:- Supported units for this parameter are h/m/s. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s. - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/carbon_black_cloud/data_stream/watchlist_hit/sample_event.json b/packages/carbon_black_cloud/data_stream/watchlist_hit/sample_event.json index ec1a8a7de85..438381ec90f 100644 --- a/packages/carbon_black_cloud/data_stream/watchlist_hit/sample_event.json +++ b/packages/carbon_black_cloud/data_stream/watchlist_hit/sample_event.json @@ -18,7 +18,7 @@ "version": "8.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "process": { "parent": { diff --git a/packages/carbon_black_cloud/docs/README.md b/packages/carbon_black_cloud/docs/README.md index 642b15115d5..c95ca443d2a 100644 --- a/packages/carbon_black_cloud/docs/README.md +++ b/packages/carbon_black_cloud/docs/README.md @@ -92,7 +92,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "45e49275-eb7d-4b20-a8af-d084fb2551c7", @@ -155,7 +155,7 @@ An example event for `audit` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module. | constant_keyword | @@ -244,7 +244,7 @@ An example event for `alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c073dde3-4d37-4b40-8161-a008a04d551f", @@ -374,16 +374,16 @@ An example event for `alert` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | @@ -441,7 +441,7 @@ An example event for `endpoint_event` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "carbon_black_cloud": { "endpoint_event": { @@ -602,7 +602,7 @@ An example event for `endpoint_event` looks as following: | dll.path | Full file path of the library. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module. | constant_keyword | @@ -683,7 +683,7 @@ An example event for `watchlist_hit` looks as following: "version": "8.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "process": { "parent": { @@ -837,9 +837,9 @@ An example event for `watchlist_hit` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | @@ -919,7 +919,7 @@ An example event for `asset_vulnerability_summary` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "45e49275-eb7d-4b20-a8af-d084fb2551c7", @@ -996,7 +996,7 @@ An example event for `asset_vulnerability_summary` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | diff --git a/packages/carbon_black_cloud/kibana/tags.yml b/packages/carbon_black_cloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/carbon_black_cloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/carbon_black_cloud/manifest.yml b/packages/carbon_black_cloud/manifest.yml index a68431e819c..d92f2f308a5 100644 --- a/packages/carbon_black_cloud/manifest.yml +++ b/packages/carbon_black_cloud/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: carbon_black_cloud title: VMware Carbon Black Cloud -version: "1.11.0" +version: "1.15.0" description: Collect logs from VMWare Carbon Black Cloud with Elastic Agent. type: integration categories: - security - edr_xdr conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/carbon_black_cloud-screenshot.png title: Carbon Black Cloud alert dashboard screenshot @@ -194,3 +195,4 @@ policy_templates: description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/carbonblack_edr/_dev/build/build.yml b/packages/carbonblack_edr/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/carbonblack_edr/_dev/build/build.yml +++ b/packages/carbonblack_edr/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/carbonblack_edr/changelog.yml b/packages/carbonblack_edr/changelog.yml index 64685ad9c42..e2567745f3e 100644 --- a/packages/carbonblack_edr/changelog.yml +++ b/packages/carbonblack_edr/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/carbonblack_edr/data_stream/log/_dev/test/pipeline/test-events.json-expected.json b/packages/carbonblack_edr/data_stream/log/_dev/test/pipeline/test-events.json-expected.json index 9616e53e11a..26bf2a915a8 100644 --- a/packages/carbonblack_edr/data_stream/log/_dev/test/pipeline/test-events.json-expected.json +++ b/packages/carbonblack_edr/data_stream/log/_dev/test/pipeline/test-events.json-expected.json @@ -15,7 +15,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -53,7 +53,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -89,7 +89,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -127,7 +127,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -165,7 +165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -201,7 +201,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -239,7 +239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -277,7 +277,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -315,7 +315,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -361,7 +361,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -428,7 +428,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -470,7 +470,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -530,7 +530,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -590,7 +590,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -633,7 +633,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -665,7 +665,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -702,7 +702,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -748,7 +748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -791,7 +791,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -823,7 +823,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -872,7 +872,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -913,7 +913,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -957,7 +957,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -1000,7 +1000,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -1032,7 +1032,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -1082,7 +1082,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -1136,7 +1136,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -1220,7 +1220,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -1257,7 +1257,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -1300,7 +1300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -1334,7 +1334,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -1384,7 +1384,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -1452,7 +1452,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -1528,7 +1528,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -1565,7 +1565,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -1601,7 +1601,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -1645,7 +1645,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -1679,7 +1679,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -1731,7 +1731,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -1808,7 +1808,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -1879,7 +1879,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -1916,7 +1916,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -1952,7 +1952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -1993,7 +1993,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -2039,7 +2039,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -2073,7 +2073,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -2123,7 +2123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -2194,7 +2194,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -2255,7 +2255,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -2292,7 +2292,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -2328,7 +2328,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -2369,7 +2369,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -2415,7 +2415,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -2457,7 +2457,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.module", @@ -2501,7 +2501,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -2551,7 +2551,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -2590,7 +2590,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -2630,7 +2630,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -2667,7 +2667,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -2703,7 +2703,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -2744,7 +2744,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -2790,7 +2790,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -2832,7 +2832,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.module", @@ -2876,7 +2876,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -2925,7 +2925,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -2969,7 +2969,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -3016,7 +3016,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.remotethread", @@ -3063,7 +3063,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -3100,7 +3100,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -3136,7 +3136,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -3177,7 +3177,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -3223,7 +3223,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -3265,7 +3265,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.module", @@ -3309,7 +3309,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -3359,7 +3359,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -3396,7 +3396,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -3444,7 +3444,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.remotethread", @@ -3491,7 +3491,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -3542,7 +3542,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.childproc", @@ -3580,7 +3580,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -3616,7 +3616,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.tamper", @@ -3661,7 +3661,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -3707,7 +3707,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -3749,7 +3749,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.module", @@ -3793,7 +3793,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -3842,7 +3842,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -3888,7 +3888,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -3942,7 +3942,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.remotethread", @@ -3989,7 +3989,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.regmod", @@ -4040,7 +4040,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.childproc", @@ -4078,7 +4078,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.observed", @@ -4127,7 +4127,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.filemod", @@ -4167,7 +4167,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.host.observed", @@ -4213,7 +4213,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.moduleload", @@ -4255,7 +4255,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.module", @@ -4299,7 +4299,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "binaryinfo.group.observed", @@ -4348,7 +4348,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.netconn", @@ -4396,7 +4396,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.filemod", @@ -4447,7 +4447,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ingress.event.remotethread", diff --git a/packages/carbonblack_edr/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/carbonblack_edr/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 13da825c827..0615e998f92 100644 --- a/packages/carbonblack_edr/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/carbonblack_edr/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing CarbonBlack EDR logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Validate that the input document conforms to the expected format # to avoid repetitive checks. diff --git a/packages/carbonblack_edr/data_stream/log/sample_event.json b/packages/carbonblack_edr/data_stream/log/sample_event.json index 88b99c8d7ec..0a3082e3521 100644 --- a/packages/carbonblack_edr/data_stream/log/sample_event.json +++ b/packages/carbonblack_edr/data_stream/log/sample_event.json @@ -24,7 +24,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "9cb9fa70-f3e9-45d8-b1cb-61425bd93e1a", diff --git a/packages/carbonblack_edr/docs/README.md b/packages/carbonblack_edr/docs/README.md index 5b0e093240a..b323ee782c8 100644 --- a/packages/carbonblack_edr/docs/README.md +++ b/packages/carbonblack_edr/docs/README.md @@ -58,7 +58,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "9cb9fa70-f3e9-45d8-b1cb-61425bd93e1a", @@ -267,17 +267,17 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | | file.code_signature.exists | Boolean to capture if a signature is present. | boolean | diff --git a/packages/carbonblack_edr/kibana/tags.yml b/packages/carbonblack_edr/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/carbonblack_edr/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/carbonblack_edr/manifest.yml b/packages/carbonblack_edr/manifest.yml index 5ae4caf9471..a07355a4c45 100644 --- a/packages/carbonblack_edr/manifest.yml +++ b/packages/carbonblack_edr/manifest.yml @@ -1,9 +1,9 @@ name: carbonblack_edr title: VMware Carbon Black EDR -version: "1.11.0" +version: "1.13.0" description: Collect logs from VMware Carbon Black EDR with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: 2.11.0 categories: [security, edr_xdr] conditions: kibana.version: ^7.14.0 || ^8.0.0 diff --git a/packages/cassandra/changelog.yml b/packages/cassandra/changelog.yml index 37e01152589..abcc1ca4be5 100644 --- a/packages/cassandra/changelog.yml +++ b/packages/cassandra/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.9.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.9.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6860 +- version: "1.8.1" + changes: + - description: Add metric_type mapping for the fields of `metrics` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6858 - version: "1.8.0" changes: - description: Add dimension fields for metrics datastream for TSDB enablement. diff --git a/packages/cassandra/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cassandra/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 4eb089b3e9b..9a90b36d4ca 100644 --- a/packages/cassandra/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cassandra/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -20,7 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - grok: field: event.original pattern_definitions: diff --git a/packages/cassandra/data_stream/metrics/fields/fields.yml b/packages/cassandra/data_stream/metrics/fields/fields.yml index 207dfac6566..ddad0a5f7c5 100644 --- a/packages/cassandra/data_stream/metrics/fields/fields.yml +++ b/packages/cassandra/data_stream/metrics/fields/fields.yml @@ -9,21 +9,28 @@ fields: - name: capacity type: long + metric_type: gauge - name: one_minute_hit_rate type: long + metric_type: gauge - name: requests.one_minute_rate type: long + metric_type: gauge - name: row_cache type: group fields: - name: capacity type: long + metric_type: gauge - name: one_minute_hit_rate type: long + metric_type: gauge - name: requests.one_minute_rate type: long + metric_type: gauge - name: client.connected_native_clients type: long + metric_type: gauge - name: client_request type: group fields: @@ -32,84 +39,116 @@ fields: - name: count type: long + metric_type: counter - name: one_minute_rate type: double + metric_type: gauge - name: timeoutsms type: double + metric_type: gauge - name: total_latency type: double + metric_type: counter - name: timeouts type: double + metric_type: counter - name: unavailables type: double + metric_type: counter - name: unavailablesms type: double + metric_type: gauge - name: read type: group fields: - name: count type: long + metric_type: counter - name: one_minute_rate type: double + metric_type: gauge - name: timeouts description: Number of read timeouts encountered. type: double + metric_type: counter - name: total_latency type: double + metric_type: counter - name: timeoutsms type: double + metric_type: gauge - name: unavailables description: Number of read unavailables encountered. type: double + metric_type: counter - name: unavailablesms type: double + metric_type: gauge - name: range_slice type: group fields: - name: one_minute_rate type: double + metric_type: gauge - name: total_latency type: double + metric_type: counter - name: casread.one_minute_rate type: double + metric_type: gauge - name: caswrite.one_minute_rate type: double + metric_type: gauge - name: column_family.total_disk_space_used type: long + metric_type: gauge - name: compaction type: group fields: - name: completed description: compaction completed tasks. type: long + metric_type: gauge - name: pending description: compaction pending tasks. type: long + metric_type: gauge - name: dropped_message type: group fields: - name: batch_remove type: long + metric_type: counter - name: batch_store type: long + metric_type: counter - name: counter_mutation type: long + metric_type: counter - name: hint type: long + metric_type: counter - name: mutation type: long + metric_type: counter - name: paged_range type: long + metric_type: counter - name: range_slice type: long + metric_type: counter - name: read type: long + metric_type: counter - name: read_repair type: long + metric_type: counter - name: request_response type: long + metric_type: counter - name: trace type: long + metric_type: counter - name: gc type: group fields: @@ -118,18 +157,22 @@ fields: - name: collection_count type: long + metric_type: gauge description: Total number of CMS collections that have occurred. - name: collection_time type: long + metric_type: gauge description: Approximate accumulated CMS collection elapsed time in milliseconds. - name: par_new type: group fields: - name: collection_count type: long + metric_type: gauge description: Total number of ParNew collections that have occurred. - name: collection_time type: long + metric_type: gauge description: Approximate accumulated ParNew collection elapsed time in milliseconds. - name: memory type: group @@ -140,44 +183,56 @@ - name: committed description: Committed heap memory usage. type: long + metric_type: gauge - name: init description: Initial heap memory usage. type: long + metric_type: gauge - name: max description: Max heap memory usage. type: long + metric_type: gauge - name: used description: Used heap memory usage. type: long + metric_type: gauge - name: other_usage type: group fields: - name: committed description: Committed non-heap memory usage. type: long + metric_type: gauge - name: init description: Initial non-heap memory usage. type: long + metric_type: gauge - name: max description: Max non-heap memory usage. type: long + metric_type: gauge - name: used description: Used non-heap memory usage. type: long + metric_type: gauge - name: storage type: group fields: - name: exceptions type: long + metric_type: counter description: The number of the total exceptions. - name: load type: long + metric_type: counter description: Storage used for Cassandra data in bytes. - name: total_hints type: long + metric_type: counter description: The number of the total hits. - name: total_hint_in_progress type: long + metric_type: counter description: The number of the total hits in progress. - name: system type: group @@ -205,24 +260,31 @@ fields: - name: all_memtables_heap_size type: long + metric_type: gauge - name: all_memtables_off_heap_size type: long + metric_type: gauge - name: live_disk_space_used type: long + metric_type: counter - name: live_ss_table_count type: long + metric_type: gauge - name: task type: group fields: - name: complete description: completed tasks. type: long + metric_type: gauge - name: pending description: pending tasks. type: long + metric_type: gauge - name: total_commitlog_size description: total commitlog size of tasks. type: long + metric_type: gauge - name: thread_pools type: group fields: @@ -231,33 +293,43 @@ fields: - name: active type: long + metric_type: gauge - name: pending type: long + metric_type: gauge - name: mutation_stage.request type: group fields: - name: active type: long + metric_type: gauge - name: pending type: long + metric_type: gauge - name: read_repair_stage.request type: group fields: - name: active type: long + metric_type: gauge - name: pending type: long + metric_type: gauge - name: read_stage.request type: group fields: - name: active type: long + metric_type: gauge - name: pending type: long + metric_type: gauge - name: request_response_stage.request type: group fields: - name: active type: long + metric_type: gauge - name: pending type: long + metric_type: gauge diff --git a/packages/cassandra/data_stream/metrics/manifest.yml b/packages/cassandra/data_stream/metrics/manifest.yml index d5b25a74526..6a989f92aaa 100644 --- a/packages/cassandra/data_stream/metrics/manifest.yml +++ b/packages/cassandra/data_stream/metrics/manifest.yml @@ -13,3 +13,5 @@ streams: show_user: true default: 10s template_path: "stream.yml.hbs" +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/cassandra/docs/README.md b/packages/cassandra/docs/README.md index 02bd2964af8..e05d3294290 100644 --- a/packages/cassandra/docs/README.md +++ b/packages/cassandra/docs/README.md @@ -333,110 +333,110 @@ An example event for `metrics` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cassandra.metrics.cache.key_cache.capacity | | long | -| cassandra.metrics.cache.key_cache.one_minute_hit_rate | | long | -| cassandra.metrics.cache.key_cache.requests.one_minute_rate | | long | -| cassandra.metrics.cache.row_cache.capacity | | long | -| cassandra.metrics.cache.row_cache.one_minute_hit_rate | | long | -| cassandra.metrics.cache.row_cache.requests.one_minute_rate | | long | -| cassandra.metrics.client.connected_native_clients | | long | -| cassandra.metrics.client_request.casread.one_minute_rate | | double | -| cassandra.metrics.client_request.caswrite.one_minute_rate | | double | -| cassandra.metrics.client_request.range_slice.one_minute_rate | | double | -| cassandra.metrics.client_request.range_slice.total_latency | | double | -| cassandra.metrics.client_request.read.count | | long | -| cassandra.metrics.client_request.read.one_minute_rate | | double | -| cassandra.metrics.client_request.read.timeouts | Number of read timeouts encountered. | double | -| cassandra.metrics.client_request.read.timeoutsms | | double | -| cassandra.metrics.client_request.read.total_latency | | double | -| cassandra.metrics.client_request.read.unavailables | Number of read unavailables encountered. | double | -| cassandra.metrics.client_request.read.unavailablesms | | double | -| cassandra.metrics.client_request.write.count | | long | -| cassandra.metrics.client_request.write.one_minute_rate | | double | -| cassandra.metrics.client_request.write.timeouts | | double | -| cassandra.metrics.client_request.write.timeoutsms | | double | -| cassandra.metrics.client_request.write.total_latency | | double | -| cassandra.metrics.client_request.write.unavailables | | double | -| cassandra.metrics.client_request.write.unavailablesms | | double | -| cassandra.metrics.column_family.total_disk_space_used | | long | -| cassandra.metrics.compaction.completed | compaction completed tasks. | long | -| cassandra.metrics.compaction.pending | compaction pending tasks. | long | -| cassandra.metrics.dropped_message.batch_remove | | long | -| cassandra.metrics.dropped_message.batch_store | | long | -| cassandra.metrics.dropped_message.counter_mutation | | long | -| cassandra.metrics.dropped_message.hint | | long | -| cassandra.metrics.dropped_message.mutation | | long | -| cassandra.metrics.dropped_message.paged_range | | long | -| cassandra.metrics.dropped_message.range_slice | | long | -| cassandra.metrics.dropped_message.read | | long | -| cassandra.metrics.dropped_message.read_repair | | long | -| cassandra.metrics.dropped_message.request_response | | long | -| cassandra.metrics.dropped_message.trace | | long | -| cassandra.metrics.gc.concurrent_mark_sweep.collection_count | Total number of CMS collections that have occurred. | long | -| cassandra.metrics.gc.concurrent_mark_sweep.collection_time | Approximate accumulated CMS collection elapsed time in milliseconds. | long | -| cassandra.metrics.gc.par_new.collection_count | Total number of ParNew collections that have occurred. | long | -| cassandra.metrics.gc.par_new.collection_time | Approximate accumulated ParNew collection elapsed time in milliseconds. | long | -| cassandra.metrics.memory.heap_usage.committed | Committed heap memory usage. | long | -| cassandra.metrics.memory.heap_usage.init | Initial heap memory usage. | long | -| cassandra.metrics.memory.heap_usage.max | Max heap memory usage. | long | -| cassandra.metrics.memory.heap_usage.used | Used heap memory usage. | long | -| cassandra.metrics.memory.other_usage.committed | Committed non-heap memory usage. | long | -| cassandra.metrics.memory.other_usage.init | Initial non-heap memory usage. | long | -| cassandra.metrics.memory.other_usage.max | Max non-heap memory usage. | long | -| cassandra.metrics.memory.other_usage.used | Used non-heap memory usage. | long | -| cassandra.metrics.storage.exceptions | The number of the total exceptions. | long | -| cassandra.metrics.storage.load | Storage used for Cassandra data in bytes. | long | -| cassandra.metrics.storage.total_hint_in_progress | The number of the total hits in progress. | long | -| cassandra.metrics.storage.total_hints | The number of the total hits. | long | -| cassandra.metrics.system.cluster | | keyword | -| cassandra.metrics.system.data_center | | keyword | -| cassandra.metrics.system.joining_nodes | | keyword | -| cassandra.metrics.system.leaving_nodes | | keyword | -| cassandra.metrics.system.live_nodes | | keyword | -| cassandra.metrics.system.moving_nodes | | keyword | -| cassandra.metrics.system.rack | | keyword | -| cassandra.metrics.system.unreachable_nodes | | keyword | -| cassandra.metrics.system.version | | keyword | -| cassandra.metrics.table.all_memtables_heap_size | | long | -| cassandra.metrics.table.all_memtables_off_heap_size | | long | -| cassandra.metrics.table.live_disk_space_used | | long | -| cassandra.metrics.table.live_ss_table_count | | long | -| cassandra.metrics.task.complete | completed tasks. | long | -| cassandra.metrics.task.pending | pending tasks. | long | -| cassandra.metrics.task.total_commitlog_size | total commitlog size of tasks. | long | -| cassandra.metrics.thread_pools.counter_mutation_stage.request.active | | long | -| cassandra.metrics.thread_pools.counter_mutation_stage.request.pending | | long | -| cassandra.metrics.thread_pools.mutation_stage.request.active | | long | -| cassandra.metrics.thread_pools.mutation_stage.request.pending | | long | -| cassandra.metrics.thread_pools.read_repair_stage.request.active | | long | -| cassandra.metrics.thread_pools.read_repair_stage.request.pending | | long | -| cassandra.metrics.thread_pools.read_stage.request.active | | long | -| cassandra.metrics.thread_pools.read_stage.request.pending | | long | -| cassandra.metrics.thread_pools.request_response_stage.request.active | | long | -| cassandra.metrics.thread_pools.request_response_stage.request.pending | | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cassandra.metrics.cache.key_cache.capacity | | long | gauge | +| cassandra.metrics.cache.key_cache.one_minute_hit_rate | | long | gauge | +| cassandra.metrics.cache.key_cache.requests.one_minute_rate | | long | gauge | +| cassandra.metrics.cache.row_cache.capacity | | long | gauge | +| cassandra.metrics.cache.row_cache.one_minute_hit_rate | | long | gauge | +| cassandra.metrics.cache.row_cache.requests.one_minute_rate | | long | gauge | +| cassandra.metrics.client.connected_native_clients | | long | gauge | +| cassandra.metrics.client_request.casread.one_minute_rate | | double | gauge | +| cassandra.metrics.client_request.caswrite.one_minute_rate | | double | gauge | +| cassandra.metrics.client_request.range_slice.one_minute_rate | | double | gauge | +| cassandra.metrics.client_request.range_slice.total_latency | | double | counter | +| cassandra.metrics.client_request.read.count | | long | counter | +| cassandra.metrics.client_request.read.one_minute_rate | | double | gauge | +| cassandra.metrics.client_request.read.timeouts | Number of read timeouts encountered. | double | counter | +| cassandra.metrics.client_request.read.timeoutsms | | double | gauge | +| cassandra.metrics.client_request.read.total_latency | | double | counter | +| cassandra.metrics.client_request.read.unavailables | Number of read unavailables encountered. | double | counter | +| cassandra.metrics.client_request.read.unavailablesms | | double | gauge | +| cassandra.metrics.client_request.write.count | | long | counter | +| cassandra.metrics.client_request.write.one_minute_rate | | double | gauge | +| cassandra.metrics.client_request.write.timeouts | | double | counter | +| cassandra.metrics.client_request.write.timeoutsms | | double | gauge | +| cassandra.metrics.client_request.write.total_latency | | double | counter | +| cassandra.metrics.client_request.write.unavailables | | double | counter | +| cassandra.metrics.client_request.write.unavailablesms | | double | gauge | +| cassandra.metrics.column_family.total_disk_space_used | | long | gauge | +| cassandra.metrics.compaction.completed | compaction completed tasks. | long | gauge | +| cassandra.metrics.compaction.pending | compaction pending tasks. | long | gauge | +| cassandra.metrics.dropped_message.batch_remove | | long | counter | +| cassandra.metrics.dropped_message.batch_store | | long | counter | +| cassandra.metrics.dropped_message.counter_mutation | | long | counter | +| cassandra.metrics.dropped_message.hint | | long | counter | +| cassandra.metrics.dropped_message.mutation | | long | counter | +| cassandra.metrics.dropped_message.paged_range | | long | counter | +| cassandra.metrics.dropped_message.range_slice | | long | counter | +| cassandra.metrics.dropped_message.read | | long | counter | +| cassandra.metrics.dropped_message.read_repair | | long | counter | +| cassandra.metrics.dropped_message.request_response | | long | counter | +| cassandra.metrics.dropped_message.trace | | long | counter | +| cassandra.metrics.gc.concurrent_mark_sweep.collection_count | Total number of CMS collections that have occurred. | long | gauge | +| cassandra.metrics.gc.concurrent_mark_sweep.collection_time | Approximate accumulated CMS collection elapsed time in milliseconds. | long | gauge | +| cassandra.metrics.gc.par_new.collection_count | Total number of ParNew collections that have occurred. | long | gauge | +| cassandra.metrics.gc.par_new.collection_time | Approximate accumulated ParNew collection elapsed time in milliseconds. | long | gauge | +| cassandra.metrics.memory.heap_usage.committed | Committed heap memory usage. | long | gauge | +| cassandra.metrics.memory.heap_usage.init | Initial heap memory usage. | long | gauge | +| cassandra.metrics.memory.heap_usage.max | Max heap memory usage. | long | gauge | +| cassandra.metrics.memory.heap_usage.used | Used heap memory usage. | long | gauge | +| cassandra.metrics.memory.other_usage.committed | Committed non-heap memory usage. | long | gauge | +| cassandra.metrics.memory.other_usage.init | Initial non-heap memory usage. | long | gauge | +| cassandra.metrics.memory.other_usage.max | Max non-heap memory usage. | long | gauge | +| cassandra.metrics.memory.other_usage.used | Used non-heap memory usage. | long | gauge | +| cassandra.metrics.storage.exceptions | The number of the total exceptions. | long | counter | +| cassandra.metrics.storage.load | Storage used for Cassandra data in bytes. | long | counter | +| cassandra.metrics.storage.total_hint_in_progress | The number of the total hits in progress. | long | counter | +| cassandra.metrics.storage.total_hints | The number of the total hits. | long | counter | +| cassandra.metrics.system.cluster | | keyword | | +| cassandra.metrics.system.data_center | | keyword | | +| cassandra.metrics.system.joining_nodes | | keyword | | +| cassandra.metrics.system.leaving_nodes | | keyword | | +| cassandra.metrics.system.live_nodes | | keyword | | +| cassandra.metrics.system.moving_nodes | | keyword | | +| cassandra.metrics.system.rack | | keyword | | +| cassandra.metrics.system.unreachable_nodes | | keyword | | +| cassandra.metrics.system.version | | keyword | | +| cassandra.metrics.table.all_memtables_heap_size | | long | gauge | +| cassandra.metrics.table.all_memtables_off_heap_size | | long | gauge | +| cassandra.metrics.table.live_disk_space_used | | long | counter | +| cassandra.metrics.table.live_ss_table_count | | long | gauge | +| cassandra.metrics.task.complete | completed tasks. | long | gauge | +| cassandra.metrics.task.pending | pending tasks. | long | gauge | +| cassandra.metrics.task.total_commitlog_size | total commitlog size of tasks. | long | gauge | +| cassandra.metrics.thread_pools.counter_mutation_stage.request.active | | long | gauge | +| cassandra.metrics.thread_pools.counter_mutation_stage.request.pending | | long | gauge | +| cassandra.metrics.thread_pools.mutation_stage.request.active | | long | gauge | +| cassandra.metrics.thread_pools.mutation_stage.request.pending | | long | gauge | +| cassandra.metrics.thread_pools.read_repair_stage.request.active | | long | gauge | +| cassandra.metrics.thread_pools.read_repair_stage.request.pending | | long | gauge | +| cassandra.metrics.thread_pools.read_stage.request.active | | long | gauge | +| cassandra.metrics.thread_pools.read_stage.request.pending | | long | gauge | +| cassandra.metrics.thread_pools.request_response_stage.request.active | | long | gauge | +| cassandra.metrics.thread_pools.request_response_stage.request.pending | | long | gauge | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.project.id | The cloud project identifier. Examples: Google Cloud Project id, Azure Project id. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error.message | Error message. | match_only_text | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/cassandra/manifest.yml b/packages/cassandra/manifest.yml index fade1c75cc9..6e3ef6a3557 100644 --- a/packages/cassandra/manifest.yml +++ b/packages/cassandra/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: cassandra title: Cassandra -version: "1.8.0" +version: "1.9.1" license: basic description: This Elastic integration collects logs and metrics from cassandra. type: integration @@ -10,7 +10,7 @@ categories: - observability release: ga conditions: - kibana.version: "^8.3.0" + kibana.version: "^8.8.0" screenshots: - src: /img/[Metrics Cassandra] Overview.png title: Overview Dashboard diff --git a/packages/cef/_dev/build/build.yml b/packages/cef/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/cef/_dev/build/build.yml +++ b/packages/cef/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/cef/changelog.yml b/packages/cef/changelog.yml index 4b05d667c03..f80dd344d4f 100644 --- a/packages/cef/changelog.yml +++ b/packages/cef/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 2.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "2.11.0" changes: - description: Ensure event.message is correctly set for pipeline errors. diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-arcsight.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-arcsight.json-expected.json index 566ac9463a6..9a479b230e6 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-arcsight.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-arcsight.json-expected.json @@ -50,7 +50,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "agent:016", @@ -132,7 +132,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "agent:030", @@ -206,7 +206,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "agent:044", @@ -287,7 +287,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "agent:031", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-cef.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-cef.json-expected.json index cd3d9b73b44..86d2de6e127 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-cef.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-cef.json-expected.json @@ -31,7 +31,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18", @@ -146,7 +146,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18", @@ -227,7 +227,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18", @@ -272,7 +272,7 @@ "ip": "192.168.1.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-checkpoint.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-checkpoint.json-expected.json index 1770abb5ca2..0bf4f02bcba 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-checkpoint.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-checkpoint.json-expected.json @@ -77,7 +77,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -168,7 +168,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Bypass", @@ -237,7 +237,7 @@ "ip": "::1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Drop", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-cisco-asa.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-cisco-asa.json-expected.json index 0e15e36f05b..e99e6f896e9 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-cisco-asa.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-cisco-asa.json-expected.json @@ -88,7 +88,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "305012", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-fp-ngfw-smc.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-fp-ngfw-smc.json-expected.json index 2560e6b01b9..6fde7700b0e 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-fp-ngfw-smc.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-fp-ngfw-smc.json-expected.json @@ -21,7 +21,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0", @@ -68,7 +68,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "9005", @@ -126,7 +126,7 @@ "ip": "10.1.1.40" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allow", @@ -219,7 +219,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "70019", @@ -292,7 +292,7 @@ "ip": "192.168.1.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Refuse", @@ -367,7 +367,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "70021", @@ -428,7 +428,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "72714", @@ -488,7 +488,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "72715", @@ -548,7 +548,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "72716", @@ -607,7 +607,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "78002", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-netscaler.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-netscaler.json-expected.json index 1006a3a7fa4..77525c52cae 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-netscaler.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-netscaler.json-expected.json @@ -28,7 +28,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -86,7 +86,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", @@ -144,7 +144,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "transformed", @@ -202,7 +202,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "transformed", @@ -260,7 +260,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-syslog.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-syslog.json-expected.json index d7a8e55523b..47745dee203 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-syslog.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-syslog.json-expected.json @@ -56,7 +56,7 @@ "domain": "centos7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Started", diff --git a/packages/cef/data_stream/log/_dev/test/pipeline/test-trend-micro.json-expected.json b/packages/cef/data_stream/log/_dev/test/pipeline/test-trend-micro.json-expected.json index ec1da056468..d839dd24ddd 100644 --- a/packages/cef/data_stream/log/_dev/test/pipeline/test-trend-micro.json-expected.json +++ b/packages/cef/data_stream/log/_dev/test/pipeline/test-trend-micro.json-expected.json @@ -19,7 +19,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "600", @@ -82,7 +82,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Delete", @@ -143,7 +143,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "detectOnly", @@ -233,7 +233,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Log", @@ -288,7 +288,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updated", @@ -381,7 +381,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "IDS:Reset", @@ -448,7 +448,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "3002795", @@ -504,7 +504,7 @@ "version": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "5000000", diff --git a/packages/cef/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cef/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 65b7eec8174..df4653bb108 100644 --- a/packages/cef/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cef/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for CEF logs. CEF decoding happens in the Agent. This perf processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - convert: field: event.id ignore_missing: true diff --git a/packages/cef/data_stream/log/sample_event.json b/packages/cef/data_stream/log/sample_event.json index ca47e166f3f..e78815813cc 100644 --- a/packages/cef/data_stream/log/sample_event.json +++ b/packages/cef/data_stream/log/sample_event.json @@ -42,7 +42,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f1ee4a83-b99b-4611-925d-b83b001f8b86", diff --git a/packages/cef/docs/README.md b/packages/cef/docs/README.md index af20b8e1e18..2620d52e1e6 100644 --- a/packages/cef/docs/README.md +++ b/packages/cef/docs/README.md @@ -175,7 +175,7 @@ An example event for `log` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f1ee4a83-b99b-4611-925d-b83b001f8b86", diff --git a/packages/cef/kibana/tags.yml b/packages/cef/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cef/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cef/manifest.yml b/packages/cef/manifest.yml index 58b72b4695e..e14d1d7f012 100644 --- a/packages/cef/manifest.yml +++ b/packages/cef/manifest.yml @@ -1,12 +1,13 @@ name: cef title: Common Event Format (CEF) -version: "2.11.0" +version: "2.14.0" description: Collect logs from CEF Logs with Elastic Agent. categories: - security conditions: - kibana.version: ^8.6.1 -format_version: 2.7.0 + kibana: + version: ^8.6.1 +format_version: "3.0.0" policy_templates: - name: cef title: CEF logs @@ -24,3 +25,4 @@ policy_templates: type: integration owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cel/_dev/build/build.yml b/packages/cel/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cel/_dev/build/build.yml +++ b/packages/cel/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cel/_dev/test/system/test-basic-auth-config.yml b/packages/cel/_dev/test/system/test-basic-auth-config.yml index 1ce9a113c3c..2004434a41e 100644 --- a/packages/cel/_dev/test/system/test-basic-auth-config.yml +++ b/packages/cel/_dev/test/system/test-basic-auth-config.yml @@ -1,6 +1,7 @@ vars: username: test password: test + redact_fields: [foo] resource_url: http://{{Hostname}}:{{Port}}/testbasicauth/api program: | bytes( diff --git a/packages/cel/_dev/test/system/test-get-config.yml b/packages/cel/_dev/test/system/test-get-config.yml index 6d0dff57e0a..886fb048a2a 100644 --- a/packages/cel/_dev/test/system/test-get-config.yml +++ b/packages/cel/_dev/test/system/test-get-config.yml @@ -1,4 +1,5 @@ vars: + redact_fields: [foo] resource_url: http://{{Hostname}}:{{Port}}/test/api enable_request_tracer: true program: | diff --git a/packages/cel/_dev/test/system/test-oauth-config.yml b/packages/cel/_dev/test/system/test-oauth-config.yml index 02794885a32..00ce233c598 100644 --- a/packages/cel/_dev/test/system/test-oauth-config.yml +++ b/packages/cel/_dev/test/system/test-oauth-config.yml @@ -1,4 +1,5 @@ vars: + redact_fields: [foo] oauth_id: test oauth_secret: test oauth_token_url: http://{{Hostname}}:{{Port}}/testoauth/token diff --git a/packages/cel/_dev/test/system/test-oauth-scope-config.yml b/packages/cel/_dev/test/system/test-oauth-scope-config.yml index 78bd6ecaeb7..f665bb1114e 100644 --- a/packages/cel/_dev/test/system/test-oauth-scope-config.yml +++ b/packages/cel/_dev/test/system/test-oauth-scope-config.yml @@ -1,4 +1,5 @@ vars: + redact_fields: [foo] oauth_id: test oauth_secret: test oauth_scopes: ["token_scope"] diff --git a/packages/cel/agent/input/input.yml.hbs b/packages/cel/agent/input/input.yml.hbs index 2afb6c2703a..4ad63943255 100644 --- a/packages/cel/agent/input/input.yml.hbs +++ b/packages/cel/agent/input/input.yml.hbs @@ -8,6 +8,13 @@ program: {{escape_string program}} state: {{state}} {{/if}} +redact.delete: {{delete_redacted_fields}} +{{#if redact_fields}} +redact.fields: +{{#each redact_fields as |field|}} + - {{field}} +{{/each}} +{{/if}} {{#if regexp}} regexp: @@ -110,7 +117,7 @@ resource.rate_limit.burst: {{resource_rate_limit_burst}} {{/if}} {{#if enable_request_tracer}} -resource.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" {{/if}} {{#if tags}} diff --git a/packages/cel/changelog.yml b/packages/cel/changelog.yml index d319c8cb927..34ebcbf324e 100644 --- a/packages/cel/changelog.yml +++ b/packages/cel/changelog.yml @@ -1,3 +1,28 @@ +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.1" + changes: + - description: Fix location of request trace log destination. + type: bugfix + link: https://github.com/elastic/integrations/pull/7335 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.1.0" + changes: + - description: Make debug log field redactions available. + type: enhancement + link: https://github.com/elastic/integrations/pull/6831 - version: "1.0.0" changes: - description: Make package GA. diff --git a/packages/cel/kibana/tags.yml b/packages/cel/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cel/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cel/manifest.yml b/packages/cel/manifest.yml index ae3ac69cd4c..938120c2c43 100644 --- a/packages/cel/manifest.yml +++ b/packages/cel/manifest.yml @@ -1,14 +1,16 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: cel title: CEL Custom API description: Collect custom events from an API with Elastic agent type: input -version: "1.0.0" +version: "1.4.0" categories: - custom conditions: - kibana.version: "^8.8.0" - elastic.subscription: "basic" + kibana: + version: "^8.8.0" + elastic: + subscription: "basic" policy_templates: - name: cel type: logs @@ -118,6 +120,25 @@ policy_templates: description: The URL endpoint that will be used to generate the tokens during the oauth2 flow. It is required if no oauth_custom variable is set or provider is not specified in oauth_custom variable. show_user: true required: false + - name: redact_fields + type: text + title: Redacted fields + description: | + Fields to redact in debug logs. When logging at debug-level the input state and CEL evaluation state are included + in logs. This may leak secrets, so list sensitive state fields in this configuration. + show_user: true + multi: true + required: false + - name: delete_redacted_fields + type: bool + title: Delete redacted fields + description: | + The default behavior for field redaction is to replace characters with `*`s. If field value length or presence will + leak information, the fields can be deleted from logging by setting this configuration to true. + show_user: true + multi: false + default: false + required: true - name: resource_ssl type: yaml title: Resource SSL Configuration @@ -273,7 +294,6 @@ policy_templates: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - - name: tags type: text title: Tags @@ -289,6 +309,6 @@ policy_templates: show_user: false description: > The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details. - owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ceph/_dev/build/docs/README.md b/packages/ceph/_dev/build/docs/README.md index 9a7ab5ea68e..cb2fbfb83ad 100644 --- a/packages/ceph/_dev/build/docs/README.md +++ b/packages/ceph/_dev/build/docs/README.md @@ -87,6 +87,100 @@ In the above JSON, please consider `api` as API User and value of `52dffd92-a103 After the integration is successfully configured, clicking on the Assets tab of the Ceph Integration should display a list of available dashboards. Click on the dashboard available for your configured data stream. It should be populated with the required data. +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Cluster Disk``, ``Cluster Health``, ``Cluster Status``, ``OSD Performance``, ``OSD Pool Stats``, ``OSD Tree`` and ``Pool Disk`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> Ceph -> Integration policies` open the configuration of Ceph and disable the `Collect Ceph metrics` toggle to reindex logs data streams and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-ceph.cluster_disk-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-ceph.cluster_disk-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-ceph.cluster_disk +``` +3. Go to `Integrations -> Ceph -> Settings` and click on `Reinstall Ceph`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-ceph.cluster_disk-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> Ceph -> Integration policies` and open configuration of integration and enable the `Collect Ceph metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Metrics reference ### Cluster Disk diff --git a/packages/ceph/changelog.yml b/packages/ceph/changelog.yml index 8abe4f69c59..a6e24b4b85c 100644 --- a/packages/ceph/changelog.yml +++ b/packages/ceph/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.0.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.0.0" + changes: + - description: Make CEPH GA. + type: enhancement + link: https://github.com/elastic/integrations/pull/7663 +- version: "0.10.1" + changes: + - description: Resolve host.ip field conflict. + type: bugfix + link: https://github.com/elastic/integrations/pull/7491 - version: "0.10.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/ceph/data_stream/cluster_disk/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/cluster_disk/elasticsearch/ingest_pipeline/default.yml index 8034534b15c..80afc7ffe18 100644 --- a/packages/ceph/data_stream/cluster_disk/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/cluster_disk/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/cluster_disk/fields/ecs.yml b/packages/ceph/data_stream/cluster_disk/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/cluster_disk/fields/ecs.yml +++ b/packages/ceph/data_stream/cluster_disk/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/cluster_health/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/cluster_health/elasticsearch/ingest_pipeline/default.yml index 3eeaf0409ff..c2ac84d31ac 100644 --- a/packages/ceph/data_stream/cluster_health/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/cluster_health/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/cluster_health/fields/ecs.yml b/packages/ceph/data_stream/cluster_health/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/cluster_health/fields/ecs.yml +++ b/packages/ceph/data_stream/cluster_health/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/cluster_status/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/cluster_status/elasticsearch/ingest_pipeline/default.yml index 0dc648922a6..34d72430fbf 100644 --- a/packages/ceph/data_stream/cluster_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/cluster_status/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/cluster_status/fields/ecs.yml b/packages/ceph/data_stream/cluster_status/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/cluster_status/fields/ecs.yml +++ b/packages/ceph/data_stream/cluster_status/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/osd_performance/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/osd_performance/elasticsearch/ingest_pipeline/default.yml index f1c9d431a3f..157f8ce75aa 100644 --- a/packages/ceph/data_stream/osd_performance/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/osd_performance/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/osd_performance/fields/ecs.yml b/packages/ceph/data_stream/osd_performance/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/osd_performance/fields/ecs.yml +++ b/packages/ceph/data_stream/osd_performance/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/osd_pool_stats/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/osd_pool_stats/elasticsearch/ingest_pipeline/default.yml index 47247849a50..4715ff16970 100644 --- a/packages/ceph/data_stream/osd_pool_stats/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/osd_pool_stats/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/osd_pool_stats/fields/ecs.yml b/packages/ceph/data_stream/osd_pool_stats/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/osd_pool_stats/fields/ecs.yml +++ b/packages/ceph/data_stream/osd_pool_stats/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/osd_tree/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/osd_tree/elasticsearch/ingest_pipeline/default.yml index e85ec456c5d..726053223b3 100644 --- a/packages/ceph/data_stream/osd_tree/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/osd_tree/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/osd_tree/fields/ecs.yml b/packages/ceph/data_stream/osd_tree/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/osd_tree/fields/ecs.yml +++ b/packages/ceph/data_stream/osd_tree/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/data_stream/pool_disk/elasticsearch/ingest_pipeline/default.yml b/packages/ceph/data_stream/pool_disk/elasticsearch/ingest_pipeline/default.yml index 7a4b3e80c22..2acabcbb65f 100644 --- a/packages/ceph/data_stream/pool_disk/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ceph/data_stream/pool_disk/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/ceph/data_stream/pool_disk/fields/ecs.yml b/packages/ceph/data_stream/pool_disk/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/ceph/data_stream/pool_disk/fields/ecs.yml +++ b/packages/ceph/data_stream/pool_disk/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/ceph/docs/README.md b/packages/ceph/docs/README.md index 9f3999201c0..c801cbc4632 100644 --- a/packages/ceph/docs/README.md +++ b/packages/ceph/docs/README.md @@ -87,6 +87,100 @@ In the above JSON, please consider `api` as API User and value of `52dffd92-a103 After the integration is successfully configured, clicking on the Assets tab of the Ceph Integration should display a list of available dashboards. Click on the dashboard available for your configured data stream. It should be populated with the required data. +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Cluster Disk``, ``Cluster Health``, ``Cluster Status``, ``OSD Performance``, ``OSD Pool Stats``, ``OSD Tree`` and ``Pool Disk`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> Ceph -> Integration policies` open the configuration of Ceph and disable the `Collect Ceph metrics` toggle to reindex logs data streams and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-ceph.cluster_disk-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-ceph.cluster_disk-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-ceph.cluster_disk +``` +3. Go to `Integrations -> Ceph -> Settings` and click on `Reinstall Ceph`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-ceph.cluster_disk-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> Ceph -> Integration policies` and open configuration of integration and enable the `Collect Ceph metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Metrics reference ### Cluster Disk @@ -182,6 +276,7 @@ An example event for `cluster_disk` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -272,6 +367,7 @@ An example event for `cluster_health` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.ip | Host ip addresses. | ip | | | input.type | Type of Filebeat input. | keyword | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | tags | List of keywords used to tag each event. | keyword | | @@ -453,6 +549,7 @@ An example event for `cluster_status` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -547,6 +644,7 @@ An example event for `osd_performance` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -649,6 +747,7 @@ An example event for `osd_pool_stats` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -758,6 +857,7 @@ An example event for `osd_tree` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.ip | Host ip addresses. | ip | | | input.type | Type of Filebeat input. | keyword | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | tags | List of keywords used to tag each event. | keyword | | @@ -862,6 +962,7 @@ An example event for `pool_disk` looks as following: | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | diff --git a/packages/ceph/img/ceph-overview-dashboard-cluster-metrics.png b/packages/ceph/img/ceph-overview-dashboard-cluster-metrics.png new file mode 100644 index 00000000000..61c6c576338 Binary files /dev/null and b/packages/ceph/img/ceph-overview-dashboard-cluster-metrics.png differ diff --git a/packages/ceph/img/ceph-overview-dashboard-osd-status.png b/packages/ceph/img/ceph-overview-dashboard-osd-status.png new file mode 100644 index 00000000000..a812d901bc0 Binary files /dev/null and b/packages/ceph/img/ceph-overview-dashboard-osd-status.png differ diff --git a/packages/ceph/img/ceph-overview-dashboard-pool-metrics.png b/packages/ceph/img/ceph-overview-dashboard-pool-metrics.png new file mode 100644 index 00000000000..d586cfaef59 Binary files /dev/null and b/packages/ceph/img/ceph-overview-dashboard-pool-metrics.png differ diff --git a/packages/ceph/img/ceph-overview-dashboard.png b/packages/ceph/img/ceph-overview-dashboard.png deleted file mode 100644 index 125819d785f..00000000000 Binary files a/packages/ceph/img/ceph-overview-dashboard.png and /dev/null differ diff --git a/packages/ceph/manifest.yml b/packages/ceph/manifest.yml index b1f4105ada8..c637ca24a3a 100644 --- a/packages/ceph/manifest.yml +++ b/packages/ceph/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: ceph title: Ceph -version: "0.10.0" +version: "1.0.1" description: This Elastic integration collects metrics from Ceph instance. type: integration categories: @@ -11,8 +11,16 @@ conditions: kibana.version: ^8.7.1 elastic.subscription: basic screenshots: - - src: /img/ceph-overview-dashboard.png - title: Ceph overview dashboard + - src: /img/ceph-overview-dashboard-cluster-metrics.png + title: Ceph cluster metrics overview + size: 600x600 + type: image/png + - src: /img/ceph-overview-dashboard-pool-metrics.png + title: Ceph pool metrics overview + size: 600x600 + type: image/png + - src: /img/ceph-overview-dashboard-osd-status.png + title: Ceph OSD status overview size: 600x600 type: image/png icons: diff --git a/packages/checkpoint/_dev/build/build.yml b/packages/checkpoint/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/checkpoint/_dev/build/build.yml +++ b/packages/checkpoint/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/checkpoint/changelog.yml b/packages/checkpoint/changelog.yml index 76a1c9218e4..9f61686e12a 100644 --- a/packages/checkpoint/changelog.yml +++ b/packages/checkpoint/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.26.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.25.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.24.0" + changes: + - description: Ensure `checkpoint.subs_exp` is a date. + type: enhancement + link: https://github.com/elastic/integrations/pull/7714 +- version: "1.23.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.22.0" changes: - description: Avoid data loss from updates with colliding loguid and timestamp. diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json index 6e0ee260999..9840638968d 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint-with-time.log-expected.json @@ -14,7 +14,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -94,7 +94,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Drop", @@ -170,7 +170,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Decrypt", @@ -256,7 +256,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Decrypt", diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json index 672a9e490be..e802f0bd777 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-checkpoint.log-expected.json @@ -6,7 +6,7 @@ "sys_message": "The eth0 interface is not protected by the anti-spoofing feature. Your network may be at risk" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -42,7 +42,7 @@ "sys_message": "installed Standard" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -86,7 +86,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -171,7 +171,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -245,7 +245,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -311,7 +311,7 @@ "status": "Finished" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -364,7 +364,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -452,7 +452,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -513,7 +513,7 @@ "status": "Started" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -566,7 +566,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -640,7 +640,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -706,7 +706,7 @@ "status": "Finished" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -745,7 +745,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -811,7 +811,7 @@ "update_status": "updated" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -846,7 +846,7 @@ "update_status": "updated" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -886,7 +886,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -968,7 +968,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Drop", @@ -1025,7 +1025,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -1096,7 +1096,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -1167,7 +1167,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -1238,7 +1238,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -1309,7 +1309,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -1374,7 +1374,7 @@ "syslog_severity": "Notice" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1427,7 +1427,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Drop", @@ -1509,12 +1509,12 @@ "log_id": "4", "origin_sic_name": "CN=NPFDCA00002,O=NPMDCM00001.domain.com.r44cbg", "special_properties": "0", - "subs_exp": "Tue Jan 1 00:00:00 2030", + "subs_exp": "2030-01-01T00:00:00.000Z", "subscription_stat": "valid", "subscription_stat_desc": "Contract is up to date." }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1583,7 +1583,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Drop", @@ -1689,7 +1689,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Block", diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r80x.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r80x.log-expected.json index 030bc4949c3..3c419191189 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r80x.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r80x.log-expected.json @@ -6,7 +6,7 @@ "origin_sic_name": "CN=xxx-dc-gw-1_gw-vp-ext-7,O=7checkpoint-mng..tstst7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -61,7 +61,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json index 085dff43f4f..f484edf06b2 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-r81x.log-expected.json @@ -13,7 +13,7 @@ "packets": 30 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -78,7 +78,7 @@ "ip": "81.2.69.142" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -161,7 +161,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -255,7 +255,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -337,7 +337,7 @@ "ip": "10.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -398,7 +398,7 @@ "sendtotrackerasadvancedauditlog": "0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -453,7 +453,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -502,7 +502,7 @@ "operation": "Set Object" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -553,7 +553,7 @@ "session_uid": "b08fb9da-a627-48b3-a815-0433f8ce6e06" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -608,7 +608,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -662,7 +662,7 @@ "system_application": "AutoUpdater" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -702,7 +702,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -754,7 +754,7 @@ "stormagentname": "daemon" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -790,7 +790,7 @@ "session_uid": "7ab751aa-66a7-4756-b66b-97a88b0a21fc" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -844,7 +844,7 @@ "origin_sic_name": "cn=cp_mgmt,o=gw-0b8ccd..zx8qy7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -887,7 +887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", @@ -976,7 +976,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Block", @@ -1096,7 +1096,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Block", diff --git a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log-expected.json b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log-expected.json index ce4b21abb09..9b84141ad31 100644 --- a/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log-expected.json +++ b/packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log-expected.json @@ -14,7 +14,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Accept", diff --git a/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml index 513bcfb0f27..c0ff5838f52 100644 --- a/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ b/packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing checkpoint firewall logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -655,6 +655,33 @@ processors: } else if (iana_number == '132') { ctx.network.transport = 'sctp'; } + - date: + field: checkpoint.subs_exp + target_field: checkpoint.subs_exp + timezone: "{{{ event.timezone }}}" + formats: + - 'EEE MMM dd HH:mm:ss yyyy' + - 'EEE MMM d HH:mm:ss yyyy' + - 'EEE MMM d HH:mm:ss yyyy' + - ISO8601 + - UNIX + if: "ctx.checkpoint?.subs_exp != null" + on_failure: + # Try to re-parse as UTC to catch when TZ is invalid or unknown. + - date: + tag: "date_utc_fallback" + field: checkpoint.subs_exp + target_field: checkpoint.subs_exp + formats: + - 'EEE MMM dd HH:mm:ss yyyy' + - 'EEE MMM d HH:mm:ss yyyy' + - 'EEE MMM d HH:mm:ss yyyy' + - ISO8601 + - UNIX + on_failure: + - remove: + field: checkpoint.subs_exp + ignore_missing: true - convert: field: checkpoint.packets type: long diff --git a/packages/checkpoint/data_stream/firewall/fields/fields.yml b/packages/checkpoint/data_stream/firewall/fields/fields.yml index c820ff2b1e2..87ea5b39388 100644 --- a/packages/checkpoint/data_stream/firewall/fields/fields.yml +++ b/packages/checkpoint/data_stream/firewall/fields/fields.yml @@ -1467,7 +1467,7 @@ description: | Layer uid. - name: subs_exp - type: keyword + type: date - name: subscriber type: ip description: | diff --git a/packages/checkpoint/data_stream/firewall/sample_event.json b/packages/checkpoint/data_stream/firewall/sample_event.json index 1223e54fa81..2fcc5619863 100644 --- a/packages/checkpoint/data_stream/firewall/sample_event.json +++ b/packages/checkpoint/data_stream/firewall/sample_event.json @@ -16,7 +16,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ecc82406-78ce-41c1-b1e2-7c12ce01f525", diff --git a/packages/checkpoint/docs/README.md b/packages/checkpoint/docs/README.md index 8af97bb2861..6e23e2a3d6f 100644 --- a/packages/checkpoint/docs/README.md +++ b/packages/checkpoint/docs/README.md @@ -68,7 +68,7 @@ An example event for `firewall` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ecc82406-78ce-41c1-b1e2-7c12ce01f525", @@ -518,7 +518,7 @@ An example event for `firewall` looks as following: | checkpoint.stormagentname | | keyword | | checkpoint.sub_policy_name | Layer name. | keyword | | checkpoint.sub_policy_uid | Layer uid. | keyword | -| checkpoint.subs_exp | | keyword | +| checkpoint.subs_exp | | date | | checkpoint.subscriber | Source IP before CGNAT. | ip | | checkpoint.subscription_stat | | keyword | | checkpoint.subscription_stat_desc | | keyword | @@ -641,19 +641,19 @@ An example event for `firewall` looks as following: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | diff --git a/packages/checkpoint/kibana/tags.yml b/packages/checkpoint/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/checkpoint/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/checkpoint/manifest.yml b/packages/checkpoint/manifest.yml index 59e4a7fe683..c4e125c3e58 100644 --- a/packages/checkpoint/manifest.yml +++ b/packages/checkpoint/manifest.yml @@ -1,12 +1,13 @@ name: checkpoint title: Check Point -version: "1.22.0" +version: "1.26.0" description: Collect logs from Check Point with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: [security, network, firewall_security] conditions: - kibana.version: "^8.6.0" + kibana: + version: "^8.6.0" icons: - src: /img/checkpoint-logo.svg title: Check Point @@ -122,3 +123,4 @@ policy_templates: description: "Collecting firewall logs from Check Point instances (input: udp)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_aironet/_dev/build/build.yml b/packages/cisco_aironet/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_aironet/_dev/build/build.yml +++ b/packages/cisco_aironet/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_aironet/changelog.yml b/packages/cisco_aironet/changelog.yml index a565c4fca5b..42e87f69de1 100644 --- a/packages/cisco_aironet/changelog.yml +++ b/packages/cisco_aironet/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json b/packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json index 79043ac9c1a..4d79d5cc23f 100644 --- a/packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json +++ b/packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json @@ -7,7 +7,7 @@ "mac": "2C-6D-C1-F5-0C-80" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Q_IND", @@ -49,7 +49,7 @@ "mac": "66-7C-DE-EF-D9-18" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ARP_ORPHANPKT_DETECTED", @@ -86,7 +86,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c132\u003eWLC001: -Traceback: 0x11759554 0x1175b0f0 0x1175d2b8 0x11766124 0x116d0cf8 0xfff2ae0888 0xfff29f2cfc" @@ -116,7 +116,7 @@ "mac": "28-6F-7F-F8-64-E0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_NAME_DELETED", @@ -156,7 +156,7 @@ "mac": "28-6F-7F-F8-64-E0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_NAME_CREATED", @@ -201,7 +201,7 @@ "ip": "fe80::1e24:cdff:fe11:2f90" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENTRY_CREATED", @@ -243,7 +243,7 @@ "ip": "fe80::aee2:d3ff:feba:56a4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENTRY_DELETED", @@ -286,7 +286,7 @@ "mac": "70-EE-50-56-99-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENTRY_CHANGED", @@ -323,7 +323,7 @@ "mac": "E8-96-06-02-02-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Q_IND", @@ -368,7 +368,7 @@ "ip": "fe80::48d:c1bc:6c01:6e85" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Q_IND", @@ -423,7 +423,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AAA_AUTH_ADMIN_USER", @@ -460,7 +460,7 @@ { "@timestamp": "2023-08-22T18:14:03.172Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADMIN_MODE_DISABLE", @@ -506,7 +506,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIG_ALARM_OFF", @@ -545,7 +545,7 @@ "mac": "4A-B8-CB-63-1D-BD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIG_ALARM_OFF_CONT", @@ -583,7 +583,7 @@ "mac": "28-6F-7F-F8-64-E0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIG_INFO1", @@ -630,7 +630,7 @@ "mac": "80-7D-3A-9B-2F-FC" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MAX_EAPOL_KEY_RETRANS", @@ -667,7 +667,7 @@ "mac": "CC-73-14-61-B0-8F" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RRM_LOGMSG", @@ -701,7 +701,7 @@ { "@timestamp": "2023-08-29T10:58:28.227Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RRM_LOGMSG", @@ -739,7 +739,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ABORT_AUTH", @@ -784,7 +784,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Q_IND", @@ -821,7 +821,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Q_IND", @@ -865,7 +865,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INVALID_WPA_KEY_STATE", @@ -902,7 +902,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "WPA_SEND_STATE_ERR", @@ -939,7 +939,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INVALID_REPLAY_CTR", @@ -973,7 +973,7 @@ { "@timestamp": "2023-08-29T10:47:25.944Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REPLAY_ERR", @@ -1010,7 +1010,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CLIENT_NOT_FOUND", @@ -1044,7 +1044,7 @@ { "@timestamp": "2023-08-22T18:14:24.651Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SIG_ALARM_OFF", @@ -1075,7 +1075,7 @@ { "@timestamp": "2023-08-29T10:58:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INVALID_REQUEST", @@ -1112,7 +1112,7 @@ "mac": "DE-FB-48-7C-4F-F7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AAA_AUTH_SEND_FAIL", @@ -1146,7 +1146,7 @@ { "@timestamp": "2023-08-20T14:55:28.577Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MLD_INVALID_IPV6_PKT", @@ -1180,7 +1180,7 @@ { "@timestamp": "2023-08-22T10:24:20.959Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILESTATION_NOT_FOUND", diff --git a/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml index e7853dfb5f2..69153bfa943 100644 --- a/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -8,7 +8,7 @@ processors: ignore_failure: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: event.original patterns: diff --git a/packages/cisco_aironet/data_stream/log/sample_event.json b/packages/cisco_aironet/data_stream/log/sample_event.json index 92038332a6a..377bb6a8ba7 100644 --- a/packages/cisco_aironet/data_stream/log/sample_event.json +++ b/packages/cisco_aironet/data_stream/log/sample_event.json @@ -21,7 +21,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "94011a8e-8b26-4bce-a627-d54316798b52", diff --git a/packages/cisco_aironet/docs/README.md b/packages/cisco_aironet/docs/README.md index 341442e3cef..2f9af55aea9 100644 --- a/packages/cisco_aironet/docs/README.md +++ b/packages/cisco_aironet/docs/README.md @@ -38,7 +38,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "94011a8e-8b26-4bce-a627-d54316798b52", diff --git a/packages/cisco_aironet/kibana/tags.yml b/packages/cisco_aironet/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_aironet/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_aironet/manifest.yml b/packages/cisco_aironet/manifest.yml index 736241ea13d..dc693e288d2 100644 --- a/packages/cisco_aironet/manifest.yml +++ b/packages/cisco_aironet/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: cisco_aironet title: "Cisco Aironet" -version: "1.4.0" +version: "1.6.0" description: "Integration for Cisco Aironet WLC Logs" type: integration categories: diff --git a/packages/cisco_asa/_dev/build/build.yml b/packages/cisco_asa/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_asa/_dev/build/build.yml +++ b/packages/cisco_asa/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_asa/changelog.yml b/packages/cisco_asa/changelog.yml index 00f7fa7abe2..fc70de32b6d 100644 --- a/packages/cisco_asa/changelog.yml +++ b/packages/cisco_asa/changelog.yml @@ -1,4 +1,42 @@ # newer versions go on top +- version: "2.22.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.21.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7595 +- version: "2.20.4" + changes: + - description: Add support for unspecified reason AAA user authenticaton rejection. + type: bugfix + link: https://github.com/elastic/integrations/pull/7604 +- version: "2.20.3" + changes: + - description: Add missing geo field mappings + type: bugfix + link: https://github.com/elastic/integrations/pull/7264 +- version: "2.20.2" + changes: + - description: Fix the processing of event 313005 when ports are missing. + type: bugfix + link: https://github.com/elastic/integrations/pull/7254 + - description: Collect network.transport for events 722033 and 722034. + type: bugfix + link: https://github.com/elastic/integrations/pull/7254 +- version: "2.20.1" + changes: + - description: Fix the handling of spaces in 113005 messages. + type: bugfix + link: https://github.com/elastic/integrations/pull/7216 +- version: "2.20.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "2.19.0" changes: - description: Convert dashboard to lens. diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log index d500930e841..617dfcf16af 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log @@ -12,6 +12,7 @@ May 5 17:51:17 dev01: %FTD-7-710006: VRRP request discarded from 192.168.2.2 to May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 3) on myif interface. Original IP payload: udp src 192.168.2.2/53 dst 192.168.2.3/10872. May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2(LOCAL\testgroup\testuser) dst dstif:192.168.2.3 (type 3, code 3) on myif interface. Original IP payload: udp src 192.168.2.2/53 dst 192.168.2.3/10872. May 5 17:51:17 dev01: %FTD-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2(LOCAL\testuser) dst dstif:192.168.2.3 (type 3, code 3) on myif interface. Original IP payload: udp src 192.168.2.2/53 dst 192.168.2.3/10872. +<188>May 5 17:51:17: %ASA-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 2) on srcif interface. Original IP payload: icmp src 192.168.2.2 dst 192.168.2.3 (type 0, code 0). May 5 18:16:21 dev01: %ASA-6-302021: Teardown ICMP connection for faddr 192.168.2.2/0 gaddr 81.2.69.144/2 laddr 10.10.10.10/2 type 8 code 0 May 5 18:22:35 dev01: %ASA-7-609001: Built local-host net:10.10.10.10 May 5 18:24:31 dev01: %ASA-7-609002: Teardown local-host identity:10.10.10.10 duration 0:00:00 @@ -105,3 +106,4 @@ May 5 19:02:25 dev01: %ASA-6-716039: Group User IP <172.31.9 <190>Mar 03 2023 09:01:16 sac-firewall : %ASA-6-113004: AAA user accounting Successful : server = 192.168.0.8 : user = sample-user <190>Mar 03 2023 08:50:32 sac-firewall : %ASA-6-113012: AAA user authentication Successful : local database : user = sample.user <190>Mar 03 2023 09:13:09 sac-firewall : %ASA-6-716039: Group User <*****> IP <192.168.0.8> Authentication: rejected, Session Type: WebVPN. +<166>Aug 28 2023 15:35:00 fw123-vc456 : %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.1.2.0 : user = user : user IP = 10.1.2.3 diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json index a000b732916..543299d6562 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-additional-messages.log-expected.json @@ -22,7 +22,7 @@ "port": 53500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -110,7 +110,7 @@ "port": 53500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -190,7 +190,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -252,7 +252,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -313,7 +313,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -377,7 +377,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -453,7 +453,7 @@ "port": 111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -537,7 +537,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -611,7 +611,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -688,7 +688,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -753,7 +753,7 @@ { "@timestamp": "2023-05-05T17:51:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -805,7 +805,7 @@ "port": 10872 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -883,7 +883,7 @@ "port": 10872 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -972,7 +972,7 @@ "port": 10872 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1043,6 +1043,84 @@ "preserve_original_event" ] }, + { + "@timestamp": "2023-05-05T17:51:17.000Z", + "cisco": { + "asa": { + "destination_interface": "dstif", + "icmp_code": 2, + "icmp_type": 3, + "source_interface": "srcif" + } + }, + "destination": { + "ip": "192.168.2.3" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "firewall-rule", + "category": [ + "network" + ], + "code": "313005", + "kind": "event", + "original": "\u003c188\u003eMay 5 17:51:17: %ASA-4-313005: No matching connection for ICMP error message: icmp src srcif:192.168.2.2 dst dstif:192.168.2.3 (type 3, code 2) on srcif interface. Original IP payload: icmp src 192.168.2.2 dst 192.168.2.3 (type 0, code 0).", + "severity": 4, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "input": { + "type": "icmp" + }, + "log": { + "level": "warning", + "syslog": { + "facility": { + "code": 23 + }, + "priority": 188, + "severity": { + "code": 4 + } + } + }, + "network": { + "community_id": "1:E6cKJx0lLYUlU1tO5oQTlY25dBg=", + "iana_number": "1", + "transport": "icmp" + }, + "observer": { + "egress": { + "interface": { + "name": "dstif" + } + }, + "ingress": { + "interface": { + "name": "srcif" + } + }, + "product": "asa", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "192.168.2.2", + "192.168.2.3" + ] + }, + "source": { + "ip": "192.168.2.2" + }, + "tags": [ + "preserve_original_event" + ] + }, { "@timestamp": "2023-05-05T18:16:21.000Z", "cisco": { @@ -1057,7 +1135,7 @@ "ip": "192.168.2.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1120,7 +1198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1178,7 +1256,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1243,7 +1321,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -1311,7 +1389,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -1380,7 +1458,7 @@ "port": 55225 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1469,7 +1547,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1549,7 +1627,7 @@ "port": 54230 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1627,7 +1705,7 @@ "ip": "192.168.2.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1698,7 +1776,7 @@ "port": 57006 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1772,7 +1850,7 @@ "port": 14322 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1846,7 +1924,7 @@ "port": 53356 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1933,7 +2011,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2021,7 +2099,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2102,7 +2180,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2177,7 +2255,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2246,7 +2324,7 @@ "port": 65020 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2318,7 +2396,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2389,7 +2467,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2460,7 +2538,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2532,7 +2610,7 @@ "port": 10051 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2607,7 +2685,7 @@ "port": 10051 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2682,7 +2760,7 @@ "port": 10051 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2756,7 +2834,7 @@ "port": 10051 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2836,7 +2914,7 @@ "port": 39222 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2910,7 +2988,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2963,7 +3041,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3023,7 +3101,7 @@ "port": 3452 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3101,7 +3179,7 @@ "port": 6007 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3167,7 +3245,7 @@ { "@timestamp": "2023-05-05T19:02:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3207,7 +3285,7 @@ { "@timestamp": "2023-05-05T19:02:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3257,7 +3335,7 @@ "port": 1985 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3318,7 +3396,7 @@ { "@timestamp": "2023-05-05T19:02:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3358,7 +3436,7 @@ { "@timestamp": "2023-05-05T19:02:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3408,7 +3486,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3486,7 +3564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3537,7 +3615,7 @@ "port": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3613,7 +3691,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3681,7 +3759,7 @@ "ip": "10.20.30.40" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3740,7 +3818,7 @@ "ip": "10.20.30.40" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3799,7 +3877,7 @@ "ip": "10.20.30.40" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3858,7 +3936,7 @@ "ip": "10.20.30.40" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3937,7 +4015,7 @@ "port": 9101 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4030,7 +4108,7 @@ "port": 51635 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4108,7 +4186,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4173,7 +4251,7 @@ { "@timestamp": "2023-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4224,7 +4302,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4287,7 +4365,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4344,7 +4422,7 @@ "ip": "10.10.1.254" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -4410,7 +4488,7 @@ { "@timestamp": "2023-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -4477,7 +4555,7 @@ "ip": "10.10.1.254" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4542,7 +4620,7 @@ { "@timestamp": "2023-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -4600,7 +4678,7 @@ { "@timestamp": "2023-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4681,7 +4759,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-disconnected", @@ -4746,7 +4824,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4809,7 +4887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4882,7 +4960,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4946,7 +5024,7 @@ "port": 23 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5030,7 +5108,7 @@ "port": 123123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "bypass", @@ -5117,7 +5195,7 @@ "port": 514514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -5195,7 +5273,7 @@ "port": 123412 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5278,7 +5356,7 @@ "port": 514514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5362,7 +5440,7 @@ "ip": "192.168.2.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -5435,7 +5513,7 @@ "ip": "192.168.2.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", @@ -5513,7 +5591,7 @@ "port": 7777 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -5587,7 +5665,7 @@ "port": 7777 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "error", @@ -5655,7 +5733,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5705,7 +5783,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5753,7 +5831,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "error", @@ -5802,7 +5880,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "error", @@ -5844,7 +5922,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5885,7 +5963,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "error", @@ -5927,7 +6005,7 @@ { "@timestamp": "2020-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "error", @@ -5976,7 +6054,7 @@ { "@timestamp": "2023-04-27T02:03:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6052,7 +6130,7 @@ "ip": "172.31.98.44" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6148,7 +6226,7 @@ "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6248,7 +6326,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6342,7 +6420,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6395,7 +6473,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6448,7 +6526,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6501,7 +6579,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6562,7 +6640,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -6637,7 +6715,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -6707,7 +6785,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -6764,7 +6842,7 @@ { "@timestamp": "2023-05-05T19:02:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -6815,7 +6893,7 @@ { "@timestamp": "2023-05-05T19:02:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -6871,7 +6949,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -6930,7 +7008,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -6989,7 +7067,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -7053,7 +7131,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -7121,7 +7199,7 @@ "ip": "192.168.0.8" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -7184,7 +7262,7 @@ { "@timestamp": "2023-03-03T08:50:32.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -7249,7 +7327,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", @@ -7313,6 +7391,76 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2023-08-28T15:35:00.000Z", + "destination": { + "address": "10.1.2.0", + "ip": "10.1.2.0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "logon-failed", + "category": [ + "authentication", + "network" + ], + "code": "113005", + "kind": "event", + "original": "\u003c166\u003eAug 28 2023 15:35:00 fw123-vc456 : %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 10.1.2.0 : user = user : user IP = 10.1.2.3", + "outcome": "failure", + "severity": 6, + "timezone": "UTC", + "type": [ + "denied", + "info" + ] + }, + "host": { + "hostname": "fw123-vc456" + }, + "log": { + "level": "informational", + "syslog": { + "facility": { + "code": 20 + }, + "priority": 166, + "severity": { + "code": 6 + } + } + }, + "observer": { + "hostname": "fw123-vc456", + "product": "asa", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "fw123-vc456" + ], + "ip": [ + "10.1.2.3", + "10.1.2.0" + ], + "user": [ + "user" + ] + }, + "source": { + "address": "10.1.2.3", + "ip": "10.1.2.3", + "user": { + "name": "user" + } + }, + "tags": [ + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-anyconnect-messages.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-anyconnect-messages.log-expected.json index 93d61ac5dc2..e55843f7b56 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-anyconnect-messages.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-anyconnect-messages.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -77,7 +77,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -151,7 +151,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -225,7 +225,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -299,7 +299,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -373,7 +373,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -447,7 +447,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -521,7 +521,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -595,7 +595,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -641,7 +641,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -715,7 +715,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-connected", @@ -789,7 +789,7 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-error", @@ -842,7 +842,7 @@ { "@timestamp": "2022-06-22T13:29:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-connected", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json index a670e209c99..d8a5176bd4f 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json @@ -17,7 +17,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -103,7 +103,7 @@ "ip": "10.123.123.123" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -179,7 +179,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -250,7 +250,7 @@ "port": 57621 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -325,7 +325,7 @@ "ip": "10.123.123.123" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -381,7 +381,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -455,7 +455,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -526,7 +526,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -597,7 +597,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -669,7 +669,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -758,7 +758,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -860,7 +860,7 @@ "port": 9803 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -972,7 +972,7 @@ "port": 9803 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1090,7 +1090,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log index 2c26d2a111e..d9be81e83dc 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log @@ -5,5 +5,6 @@ Aug 6 2020 11:01:37: %ASA-4-722037: Group User Aug 6 2020 11:01:38: %ASA-4-722051: Group User IP <67.43.156.12> IPv4 Address <67.43.156.12> IPv6 address <::> assigned to session Oct 20 2021 16:41:52: %ASA-4-722011: Group User <464_0273> IP <192.168.0.1> SVC Message: 17/WARNING: Reconnecting the VPN tunnel.. Oct 20 2021 16:41:52: %ASA-4-722033: Group User <464_0273> IP <192.168.0.1> First UDP SVC connection established for SVC session. +Oct 20 2021 16:41:52: %ASA-5-722033: Group User <464_0273> IP <192.168.0.1> First TCP SVC connection established for SVC session. Oct 20 2021 16:41:52: %ASA-4-722034: Group User <464_0273> IP <192.168.0.1> New TCP SVC connection, no existing connection. Oct 20 2021 16:41:52: %ASA-4-722037: Group User IP <192.168.0.1> SVC closing connection: DPD failure. diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log-expected.json index f8b16941b3a..a62ba212178 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa-missing-groups.log-expected.json @@ -25,7 +25,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-disconnected", @@ -100,7 +100,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-disconnected", @@ -153,7 +153,7 @@ { "@timestamp": "2019-10-20T15:42:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -215,7 +215,7 @@ { "@timestamp": "2020-08-06T11:01:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -270,7 +270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -331,7 +331,7 @@ { "@timestamp": "2021-10-20T16:41:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -381,7 +381,7 @@ { "@timestamp": "2021-10-20T16:41:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -400,6 +400,63 @@ "log": { "level": "warning" }, + "network": { + "iana_number": "17", + "transport": "udp" + }, + "observer": { + "product": "asa", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "192.168.0.1" + ], + "user": [ + "464_0273" + ] + }, + "source": { + "address": "192.168.0.1", + "ip": "192.168.0.1", + "user": { + "group": { + "name": "GroupPolicy_Employee" + }, + "name": "464_0273" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2021-10-20T16:41:52.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "firewall-rule", + "category": [ + "network" + ], + "code": "722033", + "kind": "event", + "original": "Oct 20 2021 16:41:52: %ASA-5-722033: Group \u003cGroupPolicy_Employee\u003e User \u003c464_0273\u003e IP \u003c192.168.0.1\u003e First TCP SVC connection established for SVC session.", + "severity": 5, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "notification" + }, + "network": { + "iana_number": "6", + "transport": "tcp" + }, "observer": { "product": "asa", "type": "firewall", @@ -430,7 +487,7 @@ { "@timestamp": "2021-10-20T16:41:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -449,6 +506,10 @@ "log": { "level": "warning" }, + "network": { + "iana_number": "6", + "transport": "tcp" + }, "observer": { "product": "asa", "type": "firewall", @@ -479,7 +540,7 @@ { "@timestamp": "2021-10-20T16:41:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json index 4103dd2d85b..553d149f910 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json @@ -14,7 +14,7 @@ "port": 8256 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -98,7 +98,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -179,7 +179,7 @@ "port": 1758 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -265,7 +265,7 @@ "port": 1757 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -351,7 +351,7 @@ "port": 1755 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -437,7 +437,7 @@ "port": 1754 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -523,7 +523,7 @@ "port": 1752 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -609,7 +609,7 @@ "port": 1749 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -695,7 +695,7 @@ "port": 1750 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -781,7 +781,7 @@ "port": 1747 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -867,7 +867,7 @@ "port": 1742 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -953,7 +953,7 @@ "port": 1741 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1039,7 +1039,7 @@ "port": 1739 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1125,7 +1125,7 @@ "port": 1740 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1211,7 +1211,7 @@ "port": 1738 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1297,7 +1297,7 @@ "port": 1756 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1383,7 +1383,7 @@ "port": 1737 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1469,7 +1469,7 @@ "port": 1736 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1555,7 +1555,7 @@ "port": 1765 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1640,7 +1640,7 @@ "port": 1188 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1724,7 +1724,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1805,7 +1805,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1894,7 +1894,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1975,7 +1975,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2059,7 +2059,7 @@ "port": 8257 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2143,7 +2143,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2223,7 +2223,7 @@ "port": 8258 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2307,7 +2307,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2392,7 +2392,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2477,7 +2477,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2558,7 +2558,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2643,7 +2643,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2727,7 +2727,7 @@ "port": 8259 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2811,7 +2811,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2891,7 +2891,7 @@ "port": 1189 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2975,7 +2975,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3060,7 +3060,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3141,7 +3141,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3226,7 +3226,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3310,7 +3310,7 @@ "port": 8265 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3394,7 +3394,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3479,7 +3479,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3564,7 +3564,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3645,7 +3645,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3730,7 +3730,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3814,7 +3814,7 @@ "port": 8266 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3898,7 +3898,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3979,7 +3979,7 @@ "port": 1453 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4069,7 +4069,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4150,7 +4150,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4235,7 +4235,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4319,7 +4319,7 @@ "port": 8267 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4403,7 +4403,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4483,7 +4483,7 @@ "port": 8268 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4567,7 +4567,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4647,7 +4647,7 @@ "port": 8269 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4731,7 +4731,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4816,7 +4816,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4897,7 +4897,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4981,7 +4981,7 @@ "port": 8270 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5065,7 +5065,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5145,7 +5145,7 @@ "port": 8271 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5229,7 +5229,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5314,7 +5314,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5395,7 +5395,7 @@ "port": 1457 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5480,7 +5480,7 @@ "port": 8272 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5564,7 +5564,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5645,7 +5645,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5729,7 +5729,7 @@ "port": 8273 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5813,7 +5813,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5893,7 +5893,7 @@ "port": 8267 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5976,7 +5976,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6060,7 +6060,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6140,7 +6140,7 @@ "port": 8268 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6223,7 +6223,7 @@ "port": 8269 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6306,7 +6306,7 @@ "port": 8270 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6389,7 +6389,7 @@ "port": 8271 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6472,7 +6472,7 @@ "port": 8272 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6555,7 +6555,7 @@ "port": 8273 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6639,7 +6639,7 @@ "port": 1382 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6725,7 +6725,7 @@ "port": 1385 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6810,7 +6810,7 @@ "port": 8278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6894,7 +6894,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6975,7 +6975,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7057,7 +7057,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7139,7 +7139,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7221,7 +7221,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7303,7 +7303,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7385,7 +7385,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7467,7 +7467,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7549,7 +7549,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7631,7 +7631,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7713,7 +7713,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7795,7 +7795,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7877,7 +7877,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7959,7 +7959,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8040,7 +8040,7 @@ "port": 8279 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8124,7 +8124,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8204,7 +8204,7 @@ "port": 1190 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8288,7 +8288,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8369,7 +8369,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -8458,7 +8458,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8539,7 +8539,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -8623,7 +8623,7 @@ "port": 8280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8707,7 +8707,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8787,7 +8787,7 @@ "port": 8281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8871,7 +8871,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8952,7 +8952,7 @@ "port": 1276 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9037,7 +9037,7 @@ "port": 8282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9121,7 +9121,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9202,7 +9202,7 @@ "port": 1277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9287,7 +9287,7 @@ "port": 8283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9371,7 +9371,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9452,7 +9452,7 @@ "port": 1278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9538,7 +9538,7 @@ "port": 1279 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9623,7 +9623,7 @@ "port": 8284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9707,7 +9707,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9788,7 +9788,7 @@ "port": 1280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9873,7 +9873,7 @@ "port": 8285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9957,7 +9957,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10037,7 +10037,7 @@ "port": 8286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10121,7 +10121,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10201,7 +10201,7 @@ "port": 8287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10285,7 +10285,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10365,7 +10365,7 @@ "port": 8288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10449,7 +10449,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10530,7 +10530,7 @@ "port": 1281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10616,7 +10616,7 @@ "port": 1282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10702,7 +10702,7 @@ "port": 1283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10787,7 +10787,7 @@ "port": 8289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10871,7 +10871,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10951,7 +10951,7 @@ "port": 8290 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11035,7 +11035,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11116,7 +11116,7 @@ "port": 1284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11201,7 +11201,7 @@ "port": 8291 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11285,7 +11285,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11366,7 +11366,7 @@ "port": 1285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11452,7 +11452,7 @@ "port": 1286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11542,7 +11542,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11622,7 +11622,7 @@ "port": 8292 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11706,7 +11706,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11787,7 +11787,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11876,7 +11876,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11957,7 +11957,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12041,7 +12041,7 @@ "port": 8293 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12125,7 +12125,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12206,7 +12206,7 @@ "port": 1288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12292,7 +12292,7 @@ "port": 1287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12382,7 +12382,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12463,7 +12463,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12547,7 +12547,7 @@ "port": 8294 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12631,7 +12631,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12712,7 +12712,7 @@ "port": 68 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12796,7 +12796,7 @@ "port": 8276 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12884,7 +12884,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12969,7 +12969,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13050,7 +13050,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13139,7 +13139,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13220,7 +13220,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13305,7 +13305,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13394,7 +13394,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13475,7 +13475,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13559,7 +13559,7 @@ "port": 8295 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13643,7 +13643,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13728,7 +13728,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13809,7 +13809,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13893,7 +13893,7 @@ "port": 8296 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13977,7 +13977,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14057,7 +14057,7 @@ "port": 8297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14141,7 +14141,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14221,7 +14221,7 @@ "port": 8298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14305,7 +14305,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14386,7 +14386,7 @@ "port": 1293 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14471,7 +14471,7 @@ "port": 8299 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14555,7 +14555,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14635,7 +14635,7 @@ "port": 8300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14719,7 +14719,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14800,7 +14800,7 @@ "port": 1294 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14886,7 +14886,7 @@ "port": 1295 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14972,7 +14972,7 @@ "port": 1296 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15057,7 +15057,7 @@ "port": 8301 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15141,7 +15141,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15221,7 +15221,7 @@ "port": 8302 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15305,7 +15305,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15390,7 +15390,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15471,7 +15471,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15556,7 +15556,7 @@ "port": 1297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15641,7 +15641,7 @@ "port": 8303 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15725,7 +15725,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15805,7 +15805,7 @@ "port": 8304 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15889,7 +15889,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15970,7 +15970,7 @@ "port": 1298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16056,7 +16056,7 @@ "port": 1300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16141,7 +16141,7 @@ "port": 8305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16225,7 +16225,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16305,7 +16305,7 @@ "port": 8306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16389,7 +16389,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16469,7 +16469,7 @@ "port": 8280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16552,7 +16552,7 @@ "port": 8281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16635,7 +16635,7 @@ "port": 8282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16718,7 +16718,7 @@ "port": 8283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16801,7 +16801,7 @@ "port": 8284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16884,7 +16884,7 @@ "port": 8285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16967,7 +16967,7 @@ "port": 8286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17050,7 +17050,7 @@ "port": 8287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17133,7 +17133,7 @@ "port": 8288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17216,7 +17216,7 @@ "port": 8289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17299,7 +17299,7 @@ "port": 8290 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17382,7 +17382,7 @@ "port": 8291 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17465,7 +17465,7 @@ "port": 8292 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17548,7 +17548,7 @@ "port": 8297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17631,7 +17631,7 @@ "port": 8298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17714,7 +17714,7 @@ "port": 8308 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -17798,7 +17798,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -17878,7 +17878,7 @@ "port": 8299 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17961,7 +17961,7 @@ "port": 8300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18049,7 +18049,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18134,7 +18134,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18215,7 +18215,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18300,7 +18300,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18384,7 +18384,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18468,7 +18468,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18548,7 +18548,7 @@ "port": 8301 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18631,7 +18631,7 @@ "port": 8302 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18714,7 +18714,7 @@ "port": 8303 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18797,7 +18797,7 @@ "port": 8304 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18880,7 +18880,7 @@ "port": 8305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18963,7 +18963,7 @@ "port": 8306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -19046,7 +19046,7 @@ "port": 8307 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -19130,7 +19130,7 @@ "port": 1305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -19216,7 +19216,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19298,7 +19298,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19380,7 +19380,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19461,7 +19461,7 @@ "port": 8310 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19545,7 +19545,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19626,7 +19626,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19708,7 +19708,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19790,7 +19790,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19872,7 +19872,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19954,7 +19954,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20036,7 +20036,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20118,7 +20118,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20200,7 +20200,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20282,7 +20282,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20364,7 +20364,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20446,7 +20446,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20528,7 +20528,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20610,7 +20610,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20692,7 +20692,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20774,7 +20774,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20856,7 +20856,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20938,7 +20938,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21020,7 +21020,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21102,7 +21102,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21184,7 +21184,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21266,7 +21266,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21348,7 +21348,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21430,7 +21430,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21512,7 +21512,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21594,7 +21594,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21676,7 +21676,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21758,7 +21758,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21840,7 +21840,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21922,7 +21922,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22004,7 +22004,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22086,7 +22086,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22168,7 +22168,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22250,7 +22250,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22336,7 +22336,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-dap-records.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-dap-records.log-expected.json index 6ca1492f674..9e8c46336b9 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-dap-records.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-dap-records.log-expected.json @@ -12,7 +12,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json index 031be4691a2..05bdcc2a4ad 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-01T01:00:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -47,7 +47,7 @@ { "@timestamp": "2023-01-01T01:00:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -98,7 +98,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-hostnames.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-hostnames.log-expected.json index af1d69d5034..5353ed54294 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-hostnames.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-hostnames.log-expected.json @@ -11,7 +11,7 @@ "domain": "target.destination.hostname.local" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -78,7 +78,7 @@ "ip": "192.168.2.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log index b8dd5e73906..cdd3ed8ecf3 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log @@ -17,5 +17,5 @@ Jul 14 01:45:09 81.2.69.142 %ASA-6-302021: Teardown ICMP connection for faddr et Jul 15 12:18:51 81.2.69.192 %ASA-6-113039: Group User IP <216.160.83.56> AnyConnect parent session started. Jul 1 09:27:13 216.160.83.56 : %ASA-6-113039: Group User IP <81.2.69.192> AnyConnect parent session started. Jun 14 01:22:47 81.2.69.142 %ASA-5-304001: 192.168.14.22 Accessed URL mirror:http://mirror.example.com/path/to/resource -Jul 1 09:27:13 216.160.83.56 : AAA user authentication Rejected : reason = AAA failure : server = 81.2.69.142 : user = 123 : user IP = 89.160.20.112 -Jul 1 09:27:13 216.160.83.56 : AAA user authentication Rejected : reason = Account has been disabled : server = 81.2.69.144 : user = alice : user IP = 89.160.20.128 +Jul 1 09:27:13 216.160.83.56 : %ASA-6-113005: AAA user authentication Rejected : reason = AAA failure : server = 81.2.69.142 : user = 123 : user IP = 89.160.20.112 +Jul 1 09:27:13 216.160.83.56 : %ASA-6-113005: AAA user authentication Rejected : reason = Account has been disabled : server = 81.2.69.144 : user = alice : user IP = 89.160.20.128 \ No newline at end of file diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log-expected.json index ec3758a9d41..c068a28506a 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-non-canonical.log-expected.json @@ -19,7 +19,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -99,7 +99,7 @@ "port": 10050 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -183,7 +183,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -267,7 +267,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -345,7 +345,7 @@ "port": 54703 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -415,7 +415,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -516,7 +516,7 @@ "port": 62409 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -606,7 +606,7 @@ "port": 56421 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -696,7 +696,7 @@ "port": 50578 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -782,7 +782,7 @@ "port": 56570 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -875,7 +875,7 @@ "port": 2511 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -970,7 +970,7 @@ "port": 2511 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1045,7 +1045,7 @@ "domain": "eth0_fw" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -1120,7 +1120,7 @@ "domain": "eth0_fw" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -1195,7 +1195,7 @@ "domain": "eth0_fw" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1270,7 +1270,7 @@ "domain": "eth0_fw" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1335,7 +1335,7 @@ { "@timestamp": "2023-07-15T12:18:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-connected", @@ -1410,7 +1410,7 @@ { "@timestamp": "2023-07-01T09:27:13.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "client-vpn-connected", @@ -1486,7 +1486,7 @@ "domain": "mirror" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1541,25 +1541,47 @@ }, { "@timestamp": "2023-07-01T09:27:13.000Z", - "cisco": { - "asa": { - "message_id": "", - "security": {} - } + "destination": { + "address": "81.2.69.142", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.142" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "original": "Jul 1 09:27:13 216.160.83.56 : AAA user authentication Rejected : reason = AAA failure : server = 81.2.69.142 : user = 123 : user IP = 89.160.20.112", - "severity": 7, - "timezone": "UTC" + "action": "logon-failed", + "category": [ + "authentication", + "network" + ], + "code": "113005", + "kind": "event", + "original": "Jul 1 09:27:13 216.160.83.56 : %ASA-6-113005: AAA user authentication Rejected : reason = AAA failure : server = 81.2.69.142 : user = 123 : user IP = 89.160.20.112", + "outcome": "failure", + "severity": 6, + "timezone": "UTC", + "type": [ + "denied", + "info" + ] }, "host": { "hostname": "216.160.83.56" }, "log": { - "level": "debug" + "level": "informational" }, "observer": { "hostname": "216.160.83.56", @@ -1570,33 +1592,87 @@ "related": { "hosts": [ "216.160.83.56" + ], + "ip": [ + "89.160.20.112", + "81.2.69.142" + ], + "user": [ + "123" ] }, + "source": { + "address": "89.160.20.112", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "user": { + "name": "123" + } + }, "tags": [ "preserve_original_event" ] }, { "@timestamp": "2023-07-01T09:27:13.000Z", - "cisco": { - "asa": { - "message_id": "", - "security": {} - } + "destination": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "original": "Jul 1 09:27:13 216.160.83.56 : AAA user authentication Rejected : reason = Account has been disabled : server = 81.2.69.144 : user = alice : user IP = 89.160.20.128", - "severity": 7, - "timezone": "UTC" + "action": "logon-failed", + "category": [ + "authentication", + "network" + ], + "code": "113005", + "kind": "event", + "original": "Jul 1 09:27:13 216.160.83.56 : %ASA-6-113005: AAA user authentication Rejected : reason = Account has been disabled : server = 81.2.69.144 : user = alice : user IP = 89.160.20.128", + "outcome": "failure", + "severity": 6, + "timezone": "UTC", + "type": [ + "denied", + "info" + ] }, "host": { "hostname": "216.160.83.56" }, "log": { - "level": "debug" + "level": "informational" }, "observer": { "hostname": "216.160.83.56", @@ -1607,8 +1683,40 @@ "related": { "hosts": [ "216.160.83.56" + ], + "ip": [ + "89.160.20.128", + "81.2.69.144" + ], + "user": [ + "alice" ] }, + "source": { + "address": "89.160.20.128", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "user": { + "name": "alice" + } + }, "tags": [ "preserve_original_event" ] diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json index 6dc7e8de78b..174230beff0 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json @@ -27,7 +27,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -105,7 +105,7 @@ "ip": "172.24.177.29" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -178,7 +178,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json index 6b44d821c12..8f69f3fa5e0 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json @@ -15,7 +15,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -86,7 +86,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -158,7 +158,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -228,7 +228,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -306,7 +306,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -383,7 +383,7 @@ "port": 12834 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -456,7 +456,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -528,7 +528,7 @@ "port": 25882 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -604,7 +604,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -677,7 +677,7 @@ "port": 45392 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -750,7 +750,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -825,7 +825,7 @@ "port": 52925 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -904,7 +904,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -985,7 +985,7 @@ "ip": "172.24.177.29" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1050,7 +1050,7 @@ "port": 10879 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1123,7 +1123,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1191,7 +1191,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1254,7 +1254,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1325,7 +1325,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1396,7 +1396,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1467,7 +1467,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1538,7 +1538,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1609,7 +1609,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1680,7 +1680,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1751,7 +1751,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1822,7 +1822,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1893,7 +1893,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1962,7 +1962,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2022,7 +2022,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2085,7 +2085,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2156,7 +2156,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2227,7 +2227,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2298,7 +2298,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2369,7 +2369,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2440,7 +2440,7 @@ "port": 8111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2511,7 +2511,7 @@ "port": 8111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2582,7 +2582,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2653,7 +2653,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2725,7 +2725,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2799,7 +2799,7 @@ "port": 11180 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2872,7 +2872,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2946,7 +2946,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3024,7 +3024,7 @@ "port": 1234 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3102,7 +3102,7 @@ "port": 1234 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3176,7 +3176,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3254,7 +3254,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3332,7 +3332,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3408,7 +3408,7 @@ "port": 5679 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3475,7 +3475,7 @@ "port": 5679 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3544,7 +3544,7 @@ "port": 5000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3622,7 +3622,7 @@ "port": 1234 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3699,7 +3699,7 @@ "port": 1234 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3772,7 +3772,7 @@ "port": 1235 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3850,7 +3850,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3921,7 +3921,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3985,7 +3985,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4049,7 +4049,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4113,7 +4113,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4177,7 +4177,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4241,7 +4241,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4305,7 +4305,7 @@ "ip": "192.168.1.255" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4369,7 +4369,7 @@ "ip": "192.168.1.255" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4436,7 +4436,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4509,7 +4509,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4577,7 +4577,7 @@ "ip": "172.16.1.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4647,7 +4647,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4735,7 +4735,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4816,7 +4816,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4883,7 +4883,7 @@ "ip": "192.168.2.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4934,7 +4934,7 @@ "ip": "192.168.2.32" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4992,7 +4992,7 @@ "ip": "192.168.0.19" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5077,7 +5077,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5148,7 +5148,7 @@ "ip": "172.17.6.211" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5234,7 +5234,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5345,7 +5345,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5458,7 +5458,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -5554,7 +5554,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -5654,7 +5654,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", @@ -5748,7 +5748,7 @@ "port": 18449 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5826,7 +5826,7 @@ "ip": "ff02::1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5899,7 +5899,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5989,7 +5989,7 @@ "port": 50120 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6093,7 +6093,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6196,7 +6196,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6294,7 +6294,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6402,7 +6402,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6507,7 +6507,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", diff --git a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sip.log-expected.json b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sip.log-expected.json index 89039ed7135..13bbb393a90 100644 --- a/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sip.log-expected.json +++ b/packages/cisco_asa/data_stream/log/_dev/test/pipeline/test-sip.log-expected.json @@ -16,7 +16,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -84,7 +84,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -152,7 +152,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -220,7 +220,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 1bb8df8896c..bcefb912542 100644 --- a/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -13,7 +13,7 @@ processors: message: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # # Parse the syslog header # @@ -453,9 +453,9 @@ processors: description: "113005" field: "message" patterns: - - "AAA user authentication Rejected: reason = %{REASON}: server = %{IP:destination.address} : user = ?%{CISCO_USER:source.user.name}: user IP = %{IP:source.address}" + - "AAA user authentication Rejected(%{SPACE})?: reason = %{REASON}(%{SPACE})?: server = %{IP:destination.address}(%{SPACE})?: user = ?%{CISCO_USER:source.user.name}(%{SPACE})?: user IP = %{IP:source.address}" pattern_definitions: - REASON: (AAA failure|Account has been disabled) + REASON: (AAA failure|Account has been disabled|Unspecified) CISCO_USER: ((LOCAL\\)?(%{HOSTNAME}\\)?%{USERNAME}(@%{HOSTNAME})?(, *%{NUMBER})?) - grok: if: "ctx._temp_.cisco.message_id == '113012'" @@ -606,9 +606,9 @@ processors: field: "message" description: "313005" patterns: - - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST} dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}/%{NUMBER:source.port} dst %{IPORHOST:destination.ip}/%{NUMBER:destination.port}." - - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.group.name}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}/%{NUMBER:source.port} dst %{IPORHOST:destination.ip}/%{NUMBER:destination.port}." - - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}/%{NUMBER:source.port} dst %{IPORHOST:destination.ip}/%{NUMBER:destination.port}." + - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST} dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" + - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.group.name}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" + - "No matching connection for ICMP error message: %{NOTSPACE:network.transport} src %{NOTCOLON:_temp_.cisco.source_interface}:%{IPORHOST}\\(%{NOTCOLON:source.user.domain}\\\\%{NOTSPACE:source.user.name}\\) dst %{NOTCOLON:_temp_.cisco.destination_interface}:%{IPORHOST} \\(type %{NUMBER:_temp_.cisco.icmp_type}, code %{NUMBER:_temp_.cisco.icmp_code}\\) on %{NOTCOLON} interface.%{SPACE}Original IP payload: %{NOTSPACE:input.type} src %{IPORHOST:source.ip}(/%{NUMBER:source.port})? dst %{IPORHOST:destination.ip}(/%{NUMBER:destination.port})?[.]?" pattern_definitions: NOTCOLON: "[^:]*" HOSTNAME: "\\b(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62})(?:\\.(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62}))*(\\.?|\\b)" @@ -904,15 +904,15 @@ processors: field: "message" description: "722033" patterns: - - 'Group <%{NOTSPACE:source.user.group.name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> First UDP SVC connection established for SVC session\.' - - 'Group %{NOTSPACE:source.user.group.name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} First UDP SVC connection established for SVC session\.' + - 'Group <%{NOTSPACE:source.user.group.name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> First %{NOTSPACE:network.transport} SVC connection established for SVC session\.' + - 'Group %{NOTSPACE:source.user.group.name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} First %{NOTSPACE:network.transport} SVC connection established for SVC session\.' - grok: if: "ctx._temp_.cisco.message_id == '722034'" field: "message" description: "722034" patterns: - - 'Group <%{NOTSPACE:source.user.group.name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> New TCP SVC connection, no existing connection\.' - - 'Group %{NOTSPACE:source.user.group.name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} New TCP SVC connection, no existing connection\.' + - 'Group <%{NOTSPACE:source.user.group.name}> User <%{NOTSPACE:source.user.name}> IP <%{IP:source.address}> New %{NOTSPACE:network.transport} SVC connection, no existing connection\.' + - 'Group %{NOTSPACE:source.user.group.name} User %{NOTSPACE:source.user.name} IP %{IP:source.address} New %{NOTSPACE:network.transport} SVC connection, no existing connection\.' - grok: if: "ctx._temp_.cisco.message_id == '722037'" field: "message" diff --git a/packages/cisco_asa/data_stream/log/fields/ecs.yml b/packages/cisco_asa/data_stream/log/fields/ecs.yml index a405431823d..101e0194ce3 100644 --- a/packages/cisco_asa/data_stream/log/fields/ecs.yml +++ b/packages/cisco_asa/data_stream/log/fields/ecs.yml @@ -14,6 +14,8 @@ name: destination.domain - external: ecs name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_code - external: ecs name: destination.geo.continent_name - external: ecs @@ -22,10 +24,16 @@ name: destination.geo.country_name - external: ecs name: destination.geo.location +- external: ecs + name: destination.geo.name +- external: ecs + name: destination.geo.postal_code - external: ecs name: destination.geo.region_iso_code - external: ecs name: destination.geo.region_name +- external: ecs + name: destination.geo.timezone - external: ecs name: destination.ip - external: ecs @@ -106,6 +114,28 @@ name: observer.egress.interface.name - external: ecs name: observer.egress.zone +- external: ecs + name: observer.geo.city_name +- external: ecs + name: observer.geo.continent_code +- external: ecs + name: observer.geo.continent_name +- external: ecs + name: observer.geo.country_iso_code +- external: ecs + name: observer.geo.country_name +- external: ecs + name: observer.geo.location +- external: ecs + name: observer.geo.name +- external: ecs + name: observer.geo.postal_code +- external: ecs + name: observer.geo.region_iso_code +- external: ecs + name: observer.geo.region_name +- external: ecs + name: observer.geo.timezone - external: ecs name: observer.hostname - external: ecs @@ -146,6 +176,8 @@ name: source.domain - external: ecs name: source.geo.city_name +- external: ecs + name: source.geo.continent_code - external: ecs name: source.geo.continent_name - external: ecs @@ -154,10 +186,16 @@ name: source.geo.country_name - external: ecs name: source.geo.location +- external: ecs + name: source.geo.name +- external: ecs + name: source.geo.postal_code - external: ecs name: source.geo.region_iso_code - external: ecs name: source.geo.region_name +- external: ecs + name: source.geo.timezone - external: ecs name: source.ip - external: ecs diff --git a/packages/cisco_asa/data_stream/log/sample_event.json b/packages/cisco_asa/data_stream/log/sample_event.json index 6ed0df99709..76f1831353c 100644 --- a/packages/cisco_asa/data_stream/log/sample_event.json +++ b/packages/cisco_asa/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-10-10T12:34:56.000Z", "agent": { - "ephemeral_id": "527259e1-8f53-40d5-a1b7-eeeae2bd0e5b", - "id": "d8aa4cb0-4002-48c4-abf4-14c12d2e4be1", + "ephemeral_id": "bf92e689-48fb-4249-92c2-e3a34105ed72", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.1.0" + "version": "8.9.1" }, "cisco": { "asa": { @@ -25,12 +25,12 @@ "port": 8256 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "d8aa4cb0-4002-48c4-abf4-14c12d2e4be1", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.1.0" + "version": "8.9.1" }, "event": { "action": "firewall-rule", @@ -40,7 +40,7 @@ ], "code": "305011", "dataset": "cisco_asa.log", - "ingested": "2023-06-01T10:41:28Z", + "ingested": "2023-08-29T16:16:14Z", "kind": "event", "original": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-305011: Built dynamic TCP translation from inside:172.31.98.44/1772 to outside:192.168.98.44/8256", "severity": 6, @@ -58,7 +58,7 @@ "log": { "level": "informational", "source": { - "address": "172.31.0.4:45752" + "address": "172.21.0.4:41604" } }, "network": { diff --git a/packages/cisco_asa/docs/README.md b/packages/cisco_asa/docs/README.md index 98e048a064c..4a866f9be28 100644 --- a/packages/cisco_asa/docs/README.md +++ b/packages/cisco_asa/docs/README.md @@ -17,11 +17,11 @@ An example event for `log` looks as following: { "@timestamp": "2018-10-10T12:34:56.000Z", "agent": { - "ephemeral_id": "527259e1-8f53-40d5-a1b7-eeeae2bd0e5b", - "id": "d8aa4cb0-4002-48c4-abf4-14c12d2e4be1", + "ephemeral_id": "bf92e689-48fb-4249-92c2-e3a34105ed72", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.1.0" + "version": "8.9.1" }, "cisco": { "asa": { @@ -41,12 +41,12 @@ An example event for `log` looks as following: "port": 8256 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "d8aa4cb0-4002-48c4-abf4-14c12d2e4be1", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.1.0" + "version": "8.9.1" }, "event": { "action": "firewall-rule", @@ -56,7 +56,7 @@ An example event for `log` looks as following: ], "code": "305011", "dataset": "cisco_asa.log", - "ingested": "2023-06-01T10:41:28Z", + "ingested": "2023-08-29T16:16:14Z", "kind": "event", "original": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-6-305011: Built dynamic TCP translation from inside:172.31.98.44/1772 to outside:192.168.98.44/8256", "severity": 6, @@ -74,7 +74,7 @@ An example event for `log` looks as following: "log": { "level": "informational", "source": { - "address": "172.31.0.4:45752" + "address": "172.21.0.4:41604" } }, "network": { @@ -202,12 +202,16 @@ An example event for `log` looks as following: | destination.bytes | Bytes sent from the destination to the source. | long | | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | +| destination.geo.continent_code | Two-letter code representing continent's name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | | destination.geo.country_iso_code | Country ISO code. | keyword | | destination.geo.country_name | Country name. | keyword | | destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | destination.geo.region_iso_code | Region ISO code. | keyword | | destination.geo.region_name | Region name. | keyword | +| destination.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | | destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | @@ -219,16 +223,16 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | @@ -272,6 +276,17 @@ An example event for `log` looks as following: | network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | | observer.egress.interface.name | Interface name as reported by the system. | keyword | | observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | +| observer.geo.city_name | City name. | keyword | +| observer.geo.continent_code | Two-letter code representing continent's name. | keyword | +| observer.geo.continent_name | Name of the continent. | keyword | +| observer.geo.country_iso_code | Country ISO code. | keyword | +| observer.geo.country_name | Country name. | keyword | +| observer.geo.location | Longitude and latitude. | geo_point | +| observer.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| observer.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| observer.geo.region_iso_code | Region ISO code. | keyword | +| observer.geo.region_name | Region name. | keyword | +| observer.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | observer.hostname | Hostname of the observer. | keyword | | observer.ingress.interface.name | Interface name as reported by the system. | keyword | | observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | @@ -300,12 +315,16 @@ An example event for `log` looks as following: | source.bytes | Bytes sent from the source to the destination. | long | | source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | +| source.geo.continent_code | Two-letter code representing continent's name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | source.geo.region_iso_code | Region ISO code. | keyword | | source.geo.region_name | Region name. | keyword | +| source.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | | source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | diff --git a/packages/cisco_asa/kibana/tags.yml b/packages/cisco_asa/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_asa/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_asa/manifest.yml b/packages/cisco_asa/manifest.yml index 35434e7e8c4..fe5608c94b7 100644 --- a/packages/cisco_asa/manifest.yml +++ b/packages/cisco_asa/manifest.yml @@ -1,15 +1,13 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: cisco_asa title: Cisco ASA -version: "2.19.0" -license: basic +version: "2.22.0" description: Collect logs from Cisco ASA with Elastic Agent. type: integration categories: - network - security - firewall_security -release: ga conditions: kibana.version: "^8.7.1" screenshots: diff --git a/packages/cisco_duo/_dev/build/build.yml b/packages/cisco_duo/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_duo/_dev/build/build.yml +++ b/packages/cisco_duo/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_duo/changelog.yml b/packages/cisco_duo/changelog.yml index bc52b2a1a31..e18618514b7 100644 --- a/packages/cisco_duo/changelog.yml +++ b/packages/cisco_duo/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.14.0" changes: - description: Convert to lens. diff --git a/packages/cisco_duo/data_stream/admin/_dev/test/pipeline/test-admin.log-expected.json b/packages/cisco_duo/data_stream/admin/_dev/test/pipeline/test-admin.log-expected.json index 7e91e0c1af0..4d544886696 100644 --- a/packages/cisco_duo/data_stream/admin/_dev/test/pipeline/test-admin.log-expected.json +++ b/packages/cisco_duo/data_stream/admin/_dev/test/pipeline/test-admin.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "activation_begin", @@ -43,7 +43,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "admin_activate_duo_push", @@ -77,7 +77,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "activation_begin", @@ -111,7 +111,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "activation_set_password", @@ -155,7 +155,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "admin_self_activate", @@ -200,7 +200,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "admin_update", @@ -246,7 +246,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_update", @@ -295,7 +295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_update", diff --git a/packages/cisco_duo/data_stream/admin/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_duo/data_stream/admin/elasticsearch/ingest_pipeline/default.yml index 01859a7fa5c..d71ba384b25 100644 --- a/packages/cisco_duo/data_stream/admin/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_duo/data_stream/admin/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cisco_duo administrator logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/cisco_duo/data_stream/admin/sample_event.json b/packages/cisco_duo/data_stream/admin/sample_event.json index 1c2c30364a7..267b5321a7e 100644 --- a/packages/cisco_duo/data_stream/admin/sample_event.json +++ b/packages/cisco_duo/data_stream/admin/sample_event.json @@ -21,7 +21,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json b/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json index c93d10d3b27..7b97a4f9480 100644 --- a/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json +++ b/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json @@ -40,7 +40,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -173,7 +173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -304,7 +304,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -434,7 +434,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -562,7 +562,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -674,7 +674,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -795,7 +795,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -907,7 +907,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1020,7 +1020,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1133,7 +1133,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1246,7 +1246,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1359,7 +1359,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1472,7 +1472,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1581,7 +1581,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1686,7 +1686,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1791,7 +1791,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1886,7 +1886,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-empty.log-expected.json b/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-empty.log-expected.json index 5af64a83c8a..1dfa105c68f 100644 --- a/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-empty.log-expected.json +++ b/packages/cisco_duo/data_stream/auth/_dev/test/pipeline/test-empty.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_duo/data_stream/auth/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_duo/data_stream/auth/elasticsearch/ingest_pipeline/default.yml index 8ada49cba17..24ccabe1541 100644 --- a/packages/cisco_duo/data_stream/auth/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_duo/data_stream/auth/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cisco_duo authentication logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/cisco_duo/data_stream/auth/sample_event.json b/packages/cisco_duo/data_stream/auth/sample_event.json index a2cb929ae68..83a726ca97f 100644 --- a/packages/cisco_duo/data_stream/auth/sample_event.json +++ b/packages/cisco_duo/data_stream/auth/sample_event.json @@ -50,7 +50,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/cisco_duo/data_stream/offline_enrollment/_dev/test/pipeline/test-offline-enrollment.log-expected.json b/packages/cisco_duo/data_stream/offline_enrollment/_dev/test/pipeline/test-offline-enrollment.log-expected.json index a8f06810109..3b7db334064 100644 --- a/packages/cisco_duo/data_stream/offline_enrollment/_dev/test/pipeline/test-offline-enrollment.log-expected.json +++ b/packages/cisco_duo/data_stream/offline_enrollment/_dev/test/pipeline/test-offline-enrollment.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"action\": \"o2fa_user_provisioned\",\"description\": \"{\\\"user_agent\\\": \\\"DuoCredProv/4.0.6.413 (Windows NT 6.3.9600; x64; Server)\\\", \\\"hostname\\\": \\\"WKSW10x64\\\", \\\"factor\\\": \\\"duo_otp\\\"}\",\"isotimestamp\": \"2019-08-30T16:10:05+00:00\",\"object\": \"Acme Laptop Windows Logon\",\"timestamp\": 1567181405,\"username\": \"narroway\"}" diff --git a/packages/cisco_duo/data_stream/offline_enrollment/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_duo/data_stream/offline_enrollment/elasticsearch/ingest_pipeline/default.yml index 847dafae4e3..e2dbad09c0c 100644 --- a/packages/cisco_duo/data_stream/offline_enrollment/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_duo/data_stream/offline_enrollment/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cisco_duo offline enrollment logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/cisco_duo/data_stream/offline_enrollment/sample_event.json b/packages/cisco_duo/data_stream/offline_enrollment/sample_event.json index 3b374331274..9a7fbc72204 100644 --- a/packages/cisco_duo/data_stream/offline_enrollment/sample_event.json +++ b/packages/cisco_duo/data_stream/offline_enrollment/sample_event.json @@ -27,7 +27,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/cisco_duo/data_stream/summary/_dev/test/pipeline/test-summary.log-expected.json b/packages/cisco_duo/data_stream/summary/_dev/test/pipeline/test-summary.log-expected.json index 96e857f8bf3..f67c4f39f28 100644 --- a/packages/cisco_duo/data_stream/summary/_dev/test/pipeline/test-summary.log-expected.json +++ b/packages/cisco_duo/data_stream/summary/_dev/test/pipeline/test-summary.log-expected.json @@ -1,7 +1,7 @@ { "expected": [ { - "@timestamp": "2023-05-25T20:17:35.337427076Z", + "@timestamp": "2023-09-20T13:25:56.851210996Z", "cisco_duo": { "summary": { "admin_count": 6, @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"response\":{\"admin_count\":6,\"integration_count\":5,\"telephony_credits_remaining\":473,\"user_count\":4},\"stat\":\"OK\"}" @@ -21,7 +21,7 @@ ] }, { - "@timestamp": "2023-05-25T20:17:35.337435532Z", + "@timestamp": "2023-09-20T13:25:56.851227178Z", "cisco_duo": { "summary": { "admin_count": 3, @@ -31,7 +31,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"response\":{\"admin_count\":3,\"integration_count\":9,\"telephony_credits_remaining\":960,\"user_count\":8},\"stat\":\"OK\"}" diff --git a/packages/cisco_duo/data_stream/summary/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_duo/data_stream/summary/elasticsearch/ingest_pipeline/default.yml index b5de4495974..abe9789f8cd 100644 --- a/packages/cisco_duo/data_stream/summary/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_duo/data_stream/summary/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cisco_duo summary logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: "@timestamp" value: "{{{_ingest.timestamp}}}" diff --git a/packages/cisco_duo/data_stream/summary/sample_event.json b/packages/cisco_duo/data_stream/summary/sample_event.json index 40e24a40a99..b6133faf089 100644 --- a/packages/cisco_duo/data_stream/summary/sample_event.json +++ b/packages/cisco_duo/data_stream/summary/sample_event.json @@ -21,7 +21,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/cisco_duo/data_stream/telephony/_dev/test/pipeline/test-telephony.log-expected.json b/packages/cisco_duo/data_stream/telephony/_dev/test/pipeline/test-telephony.log-expected.json index 699270b7b88..dbd1f37ec9b 100644 --- a/packages/cisco_duo/data_stream/telephony/_dev/test/pipeline/test-telephony.log-expected.json +++ b/packages/cisco_duo/data_stream/telephony/_dev/test/pipeline/test-telephony.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -32,7 +32,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -53,7 +53,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_duo/data_stream/telephony/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_duo/data_stream/telephony/elasticsearch/ingest_pipeline/default.yml index 3ce81f74b77..0f0dc03b8ff 100644 --- a/packages/cisco_duo/data_stream/telephony/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_duo/data_stream/telephony/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cisco_duo telephony logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/cisco_duo/data_stream/telephony/sample_event.json b/packages/cisco_duo/data_stream/telephony/sample_event.json index 7ae3bfc264b..abe52e166e2 100644 --- a/packages/cisco_duo/data_stream/telephony/sample_event.json +++ b/packages/cisco_duo/data_stream/telephony/sample_event.json @@ -21,7 +21,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", diff --git a/packages/cisco_duo/docs/README.md b/packages/cisco_duo/docs/README.md index 24cbb148aea..cb3accf1511 100644 --- a/packages/cisco_duo/docs/README.md +++ b/packages/cisco_duo/docs/README.md @@ -54,7 +54,7 @@ An example event for `admin` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", @@ -121,9 +121,9 @@ An example event for `admin` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.agent_id_status | Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. If no validation is performed then the field should be omitted. The allowed values are: `verified` - The `agent.id` field value matches expected value obtained from auth metadata. `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. `missing` - There was no `agent.id` field in the event to validate. `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -223,7 +223,7 @@ An example event for `auth` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", @@ -377,9 +377,9 @@ An example event for `auth` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.agent_id_status | Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. If no validation is performed then the field should be omitted. The allowed values are: `verified` - The `agent.id` field value matches expected value obtained from auth metadata. `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. `missing` - There was no `agent.id` field in the event to validate. `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -473,7 +473,7 @@ An example event for `offline_enrollment` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", @@ -537,7 +537,7 @@ An example event for `offline_enrollment` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | @@ -597,7 +597,7 @@ An example event for `summary` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", @@ -648,7 +648,7 @@ An example event for `summary` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | @@ -704,7 +704,7 @@ An example event for `telephony` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cdda426a-7e47-48c4-b2f5-b9f1ad5bf08a", @@ -756,9 +756,9 @@ An example event for `telephony` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | host.architecture | Operating system architecture. | keyword | diff --git a/packages/cisco_duo/kibana/tags.yml b/packages/cisco_duo/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_duo/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_duo/manifest.yml b/packages/cisco_duo/manifest.yml index 6f7d0d689a7..feae2338366 100644 --- a/packages/cisco_duo/manifest.yml +++ b/packages/cisco_duo/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: cisco_duo title: Cisco Duo -version: "1.14.0" +version: "1.17.0" description: Collect logs from Cisco Duo with Elastic Agent. type: integration categories: - security - iam conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/cisco_duo-screenshot.png title: Cisco Duo authentication log dashboard @@ -60,3 +61,4 @@ policy_templates: description: Collect Cisco Duo Administrator, Authentication, Offline Enrollment, Summary, and Telephony logs owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_ftd/_dev/build/build.yml b/packages/cisco_ftd/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_ftd/_dev/build/build.yml +++ b/packages/cisco_ftd/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_ftd/changelog.yml b/packages/cisco_ftd/changelog.yml index 870c39e38b2..55136922761 100644 --- a/packages/cisco_ftd/changelog.yml +++ b/packages/cisco_ftd/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: "2.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.15.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7596 +- version: "2.14.1" + changes: + - description: Add missing geo field mappings + type: bugfix + link: https://github.com/elastic/integrations/pull/7267 +- version: "2.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "2.13.2" + changes: + - description: Fix source.bytes and destination.bytes type + type: bugfix + link: https://github.com/elastic/integrations/pull/6929 +- version: "2.13.1" + changes: + - description: Remove Invalid ID + type: bugfix + link: https://github.com/elastic/integrations/pull/6669 - version: "2.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json index 0b821087be9..4dd57f4e30e 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa-fix.log-expected.json @@ -17,7 +17,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -103,7 +103,7 @@ "ip": "10.123.123.123" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -179,7 +179,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -250,7 +250,7 @@ "port": 57621 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -325,7 +325,7 @@ "ip": "10.123.123.123" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -385,7 +385,7 @@ "ip": "10.10.10.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-creation", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json index 868d07bdc07..834ab23ad27 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-asa.log-expected.json @@ -14,7 +14,7 @@ "port": 8256 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -98,7 +98,7 @@ "port": 1772 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -178,7 +178,7 @@ "port": 1758 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -264,7 +264,7 @@ "port": 1757 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -350,7 +350,7 @@ "port": 1755 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -436,7 +436,7 @@ "port": 1754 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -522,7 +522,7 @@ "port": 1752 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -608,7 +608,7 @@ "port": 1749 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -694,7 +694,7 @@ "port": 1750 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -780,7 +780,7 @@ "port": 1747 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -866,7 +866,7 @@ "port": 1742 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -952,7 +952,7 @@ "port": 1741 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1038,7 +1038,7 @@ "port": 1739 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1124,7 +1124,7 @@ "port": 1740 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1210,7 +1210,7 @@ "port": 1738 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1296,7 +1296,7 @@ "port": 1756 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1382,7 +1382,7 @@ "port": 1737 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1468,7 +1468,7 @@ "port": 1736 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1554,7 +1554,7 @@ "port": 1765 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1639,7 +1639,7 @@ "port": 1188 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1723,7 +1723,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1803,7 +1803,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1892,7 +1892,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1972,7 +1972,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2056,7 +2056,7 @@ "port": 8257 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2140,7 +2140,7 @@ "port": 1773 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2219,7 +2219,7 @@ "port": 8258 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2303,7 +2303,7 @@ "port": 1774 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2387,7 +2387,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2471,7 +2471,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2551,7 +2551,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2636,7 +2636,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -2720,7 +2720,7 @@ "port": 8259 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2804,7 +2804,7 @@ "port": 1775 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2883,7 +2883,7 @@ "port": 1189 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2967,7 +2967,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3051,7 +3051,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3131,7 +3131,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3216,7 +3216,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3300,7 +3300,7 @@ "port": 8265 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3384,7 +3384,7 @@ "port": 1452 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3468,7 +3468,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3552,7 +3552,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3632,7 +3632,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3717,7 +3717,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3801,7 +3801,7 @@ "port": 8266 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3885,7 +3885,7 @@ "port": 1453 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3965,7 +3965,7 @@ "port": 1453 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4055,7 +4055,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4135,7 +4135,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4220,7 +4220,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4304,7 +4304,7 @@ "port": 8267 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4388,7 +4388,7 @@ "port": 1454 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4467,7 +4467,7 @@ "port": 8268 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4551,7 +4551,7 @@ "port": 1455 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4630,7 +4630,7 @@ "port": 8269 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4714,7 +4714,7 @@ "port": 1456 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4798,7 +4798,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4878,7 +4878,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -4962,7 +4962,7 @@ "port": 8270 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5046,7 +5046,7 @@ "port": 1457 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5125,7 +5125,7 @@ "port": 8271 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5209,7 +5209,7 @@ "port": 1458 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5293,7 +5293,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5373,7 +5373,7 @@ "port": 1457 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5458,7 +5458,7 @@ "port": 8272 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5542,7 +5542,7 @@ "port": 1459 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5622,7 +5622,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5706,7 +5706,7 @@ "port": 8273 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5790,7 +5790,7 @@ "port": 1460 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5869,7 +5869,7 @@ "port": 8267 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -5952,7 +5952,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6036,7 +6036,7 @@ "port": 1385 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6115,7 +6115,7 @@ "port": 8268 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6198,7 +6198,7 @@ "port": 8269 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6281,7 +6281,7 @@ "port": 8270 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6364,7 +6364,7 @@ "port": 8271 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6447,7 +6447,7 @@ "port": 8272 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6530,7 +6530,7 @@ "port": 8273 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6614,7 +6614,7 @@ "port": 1382 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6700,7 +6700,7 @@ "port": 1385 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -6785,7 +6785,7 @@ "port": 8278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6869,7 +6869,7 @@ "port": 1386 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -6949,7 +6949,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7031,7 +7031,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7113,7 +7113,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7195,7 +7195,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7277,7 +7277,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7359,7 +7359,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7441,7 +7441,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7523,7 +7523,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7605,7 +7605,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7687,7 +7687,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7769,7 +7769,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7851,7 +7851,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -7933,7 +7933,7 @@ "port": 8277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8014,7 +8014,7 @@ "port": 8279 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8098,7 +8098,7 @@ "port": 1275 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8177,7 +8177,7 @@ "port": 1190 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8261,7 +8261,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8341,7 +8341,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -8430,7 +8430,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8510,7 +8510,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -8594,7 +8594,7 @@ "port": 8280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8678,7 +8678,7 @@ "port": 1276 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8757,7 +8757,7 @@ "port": 8281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8841,7 +8841,7 @@ "port": 1277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -8921,7 +8921,7 @@ "port": 1276 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9006,7 +9006,7 @@ "port": 8282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9090,7 +9090,7 @@ "port": 1278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9170,7 +9170,7 @@ "port": 1277 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9255,7 +9255,7 @@ "port": 8283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9339,7 +9339,7 @@ "port": 1279 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9419,7 +9419,7 @@ "port": 1278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9505,7 +9505,7 @@ "port": 1279 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9590,7 +9590,7 @@ "port": 8284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9674,7 +9674,7 @@ "port": 1280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9754,7 +9754,7 @@ "port": 1280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -9839,7 +9839,7 @@ "port": 8285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -9923,7 +9923,7 @@ "port": 1281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10002,7 +10002,7 @@ "port": 8286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10086,7 +10086,7 @@ "port": 1282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10165,7 +10165,7 @@ "port": 8287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10249,7 +10249,7 @@ "port": 1283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10328,7 +10328,7 @@ "port": 8288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10412,7 +10412,7 @@ "port": 1284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10492,7 +10492,7 @@ "port": 1281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10578,7 +10578,7 @@ "port": 1282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10664,7 +10664,7 @@ "port": 1283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -10749,7 +10749,7 @@ "port": 8289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10833,7 +10833,7 @@ "port": 1285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10912,7 +10912,7 @@ "port": 8290 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -10996,7 +10996,7 @@ "port": 1286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11076,7 +11076,7 @@ "port": 1284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11161,7 +11161,7 @@ "port": 8291 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11245,7 +11245,7 @@ "port": 1287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11325,7 +11325,7 @@ "port": 1285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11411,7 +11411,7 @@ "port": 1286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11501,7 +11501,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11580,7 +11580,7 @@ "port": 8292 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11664,7 +11664,7 @@ "port": 1288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11744,7 +11744,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11833,7 +11833,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -11913,7 +11913,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -11997,7 +11997,7 @@ "port": 8293 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12081,7 +12081,7 @@ "port": 1289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12161,7 +12161,7 @@ "port": 1288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12247,7 +12247,7 @@ "port": 1287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12337,7 +12337,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12417,7 +12417,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12501,7 +12501,7 @@ "port": 8294 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12585,7 +12585,7 @@ "port": 1290 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12665,7 +12665,7 @@ "port": 68 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12749,7 +12749,7 @@ "port": 8276 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -12837,7 +12837,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -12921,7 +12921,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13001,7 +13001,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13090,7 +13090,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13170,7 +13170,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13255,7 +13255,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13344,7 +13344,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13424,7 +13424,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13508,7 +13508,7 @@ "port": 8295 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13592,7 +13592,7 @@ "port": 1291 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13676,7 +13676,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13756,7 +13756,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -13840,7 +13840,7 @@ "port": 8296 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -13924,7 +13924,7 @@ "port": 1292 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14003,7 +14003,7 @@ "port": 8297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14087,7 +14087,7 @@ "port": 1293 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14166,7 +14166,7 @@ "port": 8298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14250,7 +14250,7 @@ "port": 1294 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14330,7 +14330,7 @@ "port": 1293 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14415,7 +14415,7 @@ "port": 8299 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14499,7 +14499,7 @@ "port": 1295 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14578,7 +14578,7 @@ "port": 8300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14662,7 +14662,7 @@ "port": 1296 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -14742,7 +14742,7 @@ "port": 1294 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14828,7 +14828,7 @@ "port": 1295 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14914,7 +14914,7 @@ "port": 1296 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -14999,7 +14999,7 @@ "port": 8301 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15083,7 +15083,7 @@ "port": 1297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15162,7 +15162,7 @@ "port": 8302 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15246,7 +15246,7 @@ "port": 1298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15330,7 +15330,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15410,7 +15410,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15495,7 +15495,7 @@ "port": 1297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15580,7 +15580,7 @@ "port": 8303 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15664,7 +15664,7 @@ "port": 1299 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15743,7 +15743,7 @@ "port": 8304 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15827,7 +15827,7 @@ "port": 1300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -15907,7 +15907,7 @@ "port": 1298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -15993,7 +15993,7 @@ "port": 1300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16078,7 +16078,7 @@ "port": 8305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16162,7 +16162,7 @@ "port": 1301 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16241,7 +16241,7 @@ "port": 8306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16325,7 +16325,7 @@ "port": 1302 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -16404,7 +16404,7 @@ "port": 8280 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16487,7 +16487,7 @@ "port": 8281 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16570,7 +16570,7 @@ "port": 8282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16653,7 +16653,7 @@ "port": 8283 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16736,7 +16736,7 @@ "port": 8284 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16819,7 +16819,7 @@ "port": 8285 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16902,7 +16902,7 @@ "port": 8286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -16985,7 +16985,7 @@ "port": 8287 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17068,7 +17068,7 @@ "port": 8288 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17151,7 +17151,7 @@ "port": 8289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17234,7 +17234,7 @@ "port": 8290 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17317,7 +17317,7 @@ "port": 8291 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17400,7 +17400,7 @@ "port": 8292 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17483,7 +17483,7 @@ "port": 8297 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17566,7 +17566,7 @@ "port": 8298 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17649,7 +17649,7 @@ "port": 8308 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -17733,7 +17733,7 @@ "port": 1304 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -17812,7 +17812,7 @@ "port": 8299 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17895,7 +17895,7 @@ "port": 8300 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -17983,7 +17983,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18067,7 +18067,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18147,7 +18147,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18232,7 +18232,7 @@ "port": 56132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18316,7 +18316,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18400,7 +18400,7 @@ "port": 1305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -18479,7 +18479,7 @@ "port": 8301 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18562,7 +18562,7 @@ "port": 8302 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18645,7 +18645,7 @@ "port": 8303 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18728,7 +18728,7 @@ "port": 8304 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18811,7 +18811,7 @@ "port": 8305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18894,7 +18894,7 @@ "port": 8306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -18977,7 +18977,7 @@ "port": 8307 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -19061,7 +19061,7 @@ "port": 1305 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -19147,7 +19147,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19229,7 +19229,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19311,7 +19311,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19392,7 +19392,7 @@ "port": 8310 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19476,7 +19476,7 @@ "port": 1306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19556,7 +19556,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19638,7 +19638,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19720,7 +19720,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19802,7 +19802,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19884,7 +19884,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -19966,7 +19966,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20048,7 +20048,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20130,7 +20130,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20212,7 +20212,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20294,7 +20294,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20376,7 +20376,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20458,7 +20458,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20540,7 +20540,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20622,7 +20622,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20704,7 +20704,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20786,7 +20786,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20868,7 +20868,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -20950,7 +20950,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21032,7 +21032,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21114,7 +21114,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21196,7 +21196,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21278,7 +21278,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21360,7 +21360,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21442,7 +21442,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21524,7 +21524,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21606,7 +21606,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21688,7 +21688,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21770,7 +21770,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21852,7 +21852,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -21934,7 +21934,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22016,7 +22016,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22098,7 +22098,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -22180,7 +22180,7 @@ "port": 8309 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json index fd8c6c33ac5..43b73477b57 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json @@ -68,7 +68,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -214,7 +214,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -358,7 +358,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -505,7 +505,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -650,7 +650,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -794,7 +794,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -941,7 +941,7 @@ "response_code": "NXDOMAIN" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1085,7 +1085,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1230,7 +1230,7 @@ "response_code": "SERVFAIL" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1376,7 +1376,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1520,7 +1520,7 @@ "response_code": "REFUSED" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1656,7 +1656,7 @@ "response_code": "SERVFAIL" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1802,7 +1802,7 @@ "response_code": "NXDOMAIN" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1947,7 +1947,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2093,7 +2093,7 @@ "response_code": "NXDOMAIN" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2239,7 +2239,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2383,7 +2383,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2527,7 +2527,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2671,7 +2671,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2811,7 +2811,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2957,7 +2957,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json index bcafb746450..765608ea4ce 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-filtered.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-01-01T01:00:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -47,7 +47,7 @@ { "@timestamp": "2019-01-01T01:00:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json index 710beea7d8c..1df47f91eed 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-firepower-management.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-08-14T13:56:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:56:30 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /platinum/platformSettingEdit.cgi?type=AuditLog, Page View\u0000x0a\u0000x00", @@ -40,7 +40,7 @@ { "@timestamp": "2019-08-14T13:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:57:19 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /platinum/platformSettingEdit.cgi?type=Banner, Page View\u0000x0a\u0000x00", @@ -77,7 +77,7 @@ { "@timestamp": "2019-08-14T13:57:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:57:26 ChangeReconciliation.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /platinum/ChangeReconciliation.cgi, Page View\u0000x0a\u0000x00", @@ -114,7 +114,7 @@ { "@timestamp": "2019-08-14T13:57:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:57:34 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /platinum/platformSettingEdit.cgi?type=IntrusionPolicyPrefs, Page View\u0000x0a\u0000x00", @@ -151,7 +151,7 @@ { "@timestamp": "2019-08-14T13:57:43.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:57:43 lights_out_mgmt.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /admin/lights_out_mgmt.cgi, Page View\u0000x0a\u0000x00", @@ -188,7 +188,7 @@ { "@timestamp": "2019-08-14T13:58:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:02 mojo_server.pl: siem-management: admin@10.0.255.31, Cloud Services, View url filtering settings\u0000x0a\u0000x00", @@ -225,7 +225,7 @@ { "@timestamp": "2019-08-14T13:58:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:02 mojo_server.pl: siem-management: admin@10.0.255.31, Cloud Services, View amp settings\u0000x0a\u0000x00", @@ -262,7 +262,7 @@ { "@timestamp": "2019-08-14T13:58:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:20 mojo_server.pl: siem-management: admin@10.0.255.31, System \u003e Monitoring \u003e Syslog, Page View\u0000x0a\u0000x00", @@ -299,7 +299,7 @@ { "@timestamp": "2019-08-14T13:58:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:41 mojo_server.pl: siem-management: admin@10.0.255.31, Devices \u003e Device Management, Page View\u0000x0a\u0000x00", @@ -336,7 +336,7 @@ { "@timestamp": "2019-08-14T13:58:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:47 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Device Management \u003e NGFW Interfaces, Page View\u0000x0a\u0000x00", @@ -373,7 +373,7 @@ { "@timestamp": "2019-08-14T13:58:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:52 mojo_server.pl: siem-management: admin@10.0.255.31, Devices \u003e Device Management \u003e NGFW Device Summary, Page View\u0000x0a\u0000x00", @@ -410,7 +410,7 @@ { "@timestamp": "2019-08-14T13:58:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:58:54 mojo_server.pl: siem-management: admin@10.0.255.31, Devices \u003e Device Management \u003e NGFW Device Summary, Page View\u0000x0a\u0000x00", @@ -447,7 +447,7 @@ { "@timestamp": "2019-08-14T13:59:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:59:10 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings, Page View\u0000x0a\u0000x00", @@ -484,7 +484,7 @@ { "@timestamp": "2019-08-14T13:59:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 13:59:15 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Page View\u0000x0a\u0000x00", @@ -521,7 +521,7 @@ { "@timestamp": "2019-08-14T14:00:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:00:37 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Save Policy ftd-policy\u0000x0a\u0000x00", @@ -558,7 +558,7 @@ { "@timestamp": "2019-08-14T14:00:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:00:37 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Modified: Syslog\u0000x0a\u0000x00", @@ -595,7 +595,7 @@ { "@timestamp": "2019-08-14T14:00:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:00:37 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Page View\u0000x0a\u0000x00", @@ -632,7 +632,7 @@ { "@timestamp": "2019-08-14T14:01:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:12 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Save Policy ftd-policy\u0000x0a\u0000x00", @@ -669,7 +669,7 @@ { "@timestamp": "2019-08-14T14:01:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:12 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Modified: Syslog\u0000x0a\u0000x00", @@ -706,7 +706,7 @@ { "@timestamp": "2019-08-14T14:01:13.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:13 sfdccsm: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Platform Settings Editor, Page View\u0000x0a\u0000x00", @@ -743,7 +743,7 @@ { "@timestamp": "2019-08-14T14:01:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:20 sfdccsm: siem-management: csm_processes@Default User IP, Login, Login Success\u0000x0a\u0000x00", @@ -780,7 +780,7 @@ { "@timestamp": "2019-08-14T14:01:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:31 ActionQueueScrape.pl: siem-management: csm_processes@Default User IP, Login, Login Success\u0000x0a\u0000x00", @@ -817,7 +817,7 @@ { "@timestamp": "2019-08-14T14:01:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:31 ActionQueueScrape.pl: siem-management: admin@localhost, Task Queue, Successful task completion : Pre-deploy Global Configuration Generation\u0000x0a\u0000x00", @@ -854,7 +854,7 @@ { "@timestamp": "2019-08-14T14:01:35.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:35 ActionQueueScrape.pl: siem-management: csm_processes@Default User IP, Login, Login Success\u0000x0a\u0000x00", @@ -891,7 +891,7 @@ { "@timestamp": "2019-08-14T14:01:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:36 ActionQueueScrape.pl: siem-management: admin@localhost, Task Queue, Successful task completion : Pre-deploy Device Configuration for siem-ftd\u0000x0a\u0000x00", @@ -928,7 +928,7 @@ { "@timestamp": "2019-08-14T14:01:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:55 mojo_server.pl: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration, Page View\u0000x0a\u0000x00", @@ -965,7 +965,7 @@ { "@timestamp": "2019-08-14T14:01:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:56 sfdccsm: siem-management: admin@localhost, Task Queue, Policy Deployment to siem-ftd - SUCCESS\u0000x0a\u0000x00", @@ -1002,7 +1002,7 @@ { "@timestamp": "2019-08-14T14:01:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:01:57 sfdccsm: siem-management: csm_processes@Default User IP, Login, Login Success\u0000x0a\u0000x00", @@ -1039,7 +1039,7 @@ { "@timestamp": "2019-08-14T14:02:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:02:03 mojo_server.pl: siem-management: admin@10.0.255.31, System \u003e Monitoring \u003e Syslog, Page View\u0000x0a\u0000x00", @@ -1076,7 +1076,7 @@ { "@timestamp": "2019-08-14T14:02:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:02:11 index.cgi: siem-management: admin@10.0.255.31, System \u003e Monitoring \u003e Audit, Page View\u0000x0a\u0000x00", @@ -1113,7 +1113,7 @@ { "@timestamp": "2019-08-14T14:02:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:02:19 mojo_server.pl: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration, Page View\u0000x0a\u0000x00", @@ -1150,7 +1150,7 @@ { "@timestamp": "2019-08-14T14:02:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:02:31 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, System \u003e Configuration \u003e Configuration \u003e /platinum/platformSettingEdit.cgi?type=AuditLog, Page View\u0000x0a\u0000x00", @@ -1187,7 +1187,7 @@ { "@timestamp": "2019-08-14T14:02:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14\u003eAug 14 2019 14:02:38 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Local System Configuration, Save Local System Configuration\u0000x0a\u0000x00", @@ -1223,7 +1223,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c14.2\u003eAug 14 2019 14:02:38 platformSettingEdit.cgi: siem-management: admin@10.0.255.31, Devices \u003e Platform Settings \u003e Audit Log Settings \u003e Modified: Send Audit Log to Syslog enabled \u003e Disabled", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-endpoint-profile.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-endpoint-profile.log-expected.json index 3e196868b16..691a36567e1 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-endpoint-profile.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-endpoint-profile.log-expected.json @@ -47,7 +47,7 @@ "manufacturer": "Microsoft" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -173,7 +173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -299,7 +299,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -425,7 +425,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -551,7 +551,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -677,7 +677,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -806,7 +806,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -935,7 +935,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1064,7 +1064,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1193,7 +1193,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1322,7 +1322,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1451,7 +1451,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1574,7 +1574,7 @@ "manufacturer": "Konica" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1697,7 +1697,7 @@ "manufacturer": "Android" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1817,7 +1817,7 @@ "manufacturer": "Android" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1940,7 +1940,7 @@ "manufacturer": "Android" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2063,7 +2063,7 @@ "manufacturer": "Android" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2186,7 +2186,7 @@ "manufacturer": "Android" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2312,7 +2312,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2438,7 +2438,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2564,7 +2564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2693,7 +2693,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2819,7 +2819,7 @@ "manufacturer": "Apple" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -2939,7 +2939,7 @@ "manufacturer": "Apple" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3062,7 +3062,7 @@ "manufacturer": "Apple" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3185,7 +3185,7 @@ "manufacturer": "Apple" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3311,7 +3311,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3437,7 +3437,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3560,7 +3560,7 @@ "manufacturer": "Cisco" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3683,7 +3683,7 @@ "manufacturer": "Cisco" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3806,7 +3806,7 @@ "manufacturer": "Cisco" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -3932,7 +3932,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4055,7 +4055,7 @@ "manufacturer": "Google" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4178,7 +4178,7 @@ "manufacturer": "RaspberryPi" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4298,7 +4298,7 @@ "manufacturer": "Intel" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4418,7 +4418,7 @@ "manufacturer": "HP" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4535,7 +4535,7 @@ "port": 631 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4655,7 +4655,7 @@ "manufacturer": "Nortel" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4775,7 +4775,7 @@ "manufacturer": "Dell" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -4895,7 +4895,7 @@ "manufacturer": "ChromeBook" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5021,7 +5021,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5144,7 +5144,7 @@ "manufacturer": "American Power Conversion" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5264,7 +5264,7 @@ "manufacturer": "Microsoft" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5390,7 +5390,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5513,7 +5513,7 @@ "manufacturer": "RICOH" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -5632,11 +5632,8 @@ "packets": 0, "port": 631 }, - "device": { - "manufacturer": "Invalid ID" - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json index 1e937a90c9d..d3c1e2e8305 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json @@ -12,7 +12,7 @@ "ip": "192.168.0.38" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -81,7 +81,7 @@ "ip": "192.168.0.139" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-inbound-outbound.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-inbound-outbound.log-expected.json index 86c6d63e037..49e13c48f38 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-inbound-outbound.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-inbound-outbound.log-expected.json @@ -37,7 +37,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -168,7 +168,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -267,7 +267,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -384,7 +384,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-intrusion.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-intrusion.log-expected.json index abc325770c9..59cf13b3bd8 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-intrusion.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-intrusion.log-expected.json @@ -41,7 +41,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -154,7 +154,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -265,7 +265,7 @@ "port": 39114 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -374,7 +374,7 @@ "port": 40740 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-no-type-id.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-no-type-id.log-expected.json index 0f8134b2e4b..f701ef7a646 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-no-type-id.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-no-type-id.log-expected.json @@ -18,7 +18,7 @@ "ip": "10.8.12.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -83,7 +83,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -141,7 +141,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -212,7 +212,7 @@ "port": 64311 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json index 1a0d4e8040f..7dcfca5746e 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-not-ip.log-expected.json @@ -27,7 +27,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -105,7 +105,7 @@ "ip": "172.24.177.29" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -178,7 +178,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json index 18ea65b40fa..5da604ecf7a 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-sample.log-expected.json @@ -15,7 +15,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -86,7 +86,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -158,7 +158,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -228,7 +228,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -306,7 +306,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -383,7 +383,7 @@ "port": 12834 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -459,7 +459,7 @@ "port": 4952 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -527,7 +527,7 @@ "port": 25882 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -603,7 +603,7 @@ "port": 52925 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -675,7 +675,7 @@ "port": 45392 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -752,7 +752,7 @@ "port": 4953 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -822,7 +822,7 @@ "port": 52925 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -901,7 +901,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -982,7 +982,7 @@ "ip": "172.24.177.29" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -1047,7 +1047,7 @@ "port": 10879 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1124,7 +1124,7 @@ "port": 4954 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1187,7 +1187,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1249,7 +1249,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1320,7 +1320,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1391,7 +1391,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1462,7 +1462,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1533,7 +1533,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1604,7 +1604,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1675,7 +1675,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1746,7 +1746,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1817,7 +1817,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1888,7 +1888,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -1957,7 +1957,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2016,7 +2016,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2078,7 +2078,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2149,7 +2149,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2220,7 +2220,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2291,7 +2291,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2362,7 +2362,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2433,7 +2433,7 @@ "port": 8111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2504,7 +2504,7 @@ "port": 8111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2575,7 +2575,7 @@ "port": 40443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2646,7 +2646,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2718,7 +2718,7 @@ "port": 2000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2792,7 +2792,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2868,7 +2868,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -2946,7 +2946,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3028,7 +3028,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3107,7 +3107,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3182,7 +3182,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3264,7 +3264,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3346,7 +3346,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3426,7 +3426,7 @@ "port": 5679 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3497,7 +3497,7 @@ "port": 5679 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3570,7 +3570,7 @@ "port": 5000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3652,7 +3652,7 @@ "port": 65000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3732,7 +3732,7 @@ "port": 65000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -3808,7 +3808,7 @@ "port": 1235 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3890,7 +3890,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow-expiration", @@ -3961,7 +3961,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4025,7 +4025,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4089,7 +4089,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4153,7 +4153,7 @@ "ip": "192.168.99.47" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4217,7 +4217,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4281,7 +4281,7 @@ "ip": "192.168.99.57" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4345,7 +4345,7 @@ "ip": "192.168.1.255" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4409,7 +4409,7 @@ "ip": "192.168.1.255" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4476,7 +4476,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4549,7 +4549,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4617,7 +4617,7 @@ "ip": "172.16.1.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4687,7 +4687,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4778,7 +4778,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4863,7 +4863,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4930,7 +4930,7 @@ "ip": "192.168.2.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -4981,7 +4981,7 @@ "ip": "192.168.2.32" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5038,7 +5038,7 @@ "ip": "192.168.0.19" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5125,7 +5125,7 @@ "port": 1433 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "firewall-rule", @@ -5191,7 +5191,7 @@ "ip": "192.168.0.8" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -5245,7 +5245,7 @@ { "@timestamp": "2023-03-03T08:50:32.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logged-in", @@ -5301,7 +5301,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-failed", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log index 312450d2381..c78948cac2f 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log @@ -12,3 +12,4 @@ Aug 14 2019 15:09:41 siem-ftd %FTD-1-430003: AccessControlRuleAction: Block, Ac 2023-03-27T08:54:54Z %FTD-1-430003: EventPriority: Low, DeviceUUID: 5c120000-ca5e-11e7-ab3c-ad268d8b0000, InstanceID: 5, FirstPacketSecond: 2023-03-27T08:54:54Z, ConnectionID: 56696, AccessControlRuleAction: Block with reset, SrcIP: 10.0.1.20, DstIP: 10.0.100.30, SrcPort: 50815, DstPort: 7680, Protocol: tcp, IngressInterface: Inside, EgressInterface: Outside, IngressZone: Inside, EgressZone: Outside, IngressVRF: Global, EgressVRF: Global, ACPolicy: ProductionPolicy, AccessControlRuleName: BlockReset-Policy, Prefilter Policy: Default Prefilter Policy, User: Not Found, Client: Windows Update client, ApplicationProtocol: Windows Update, ConnectionDuration: 0, InitiatorPackets: 3, ResponderPackets: 1, InitiatorBytes: 261, ResponderBytes: 66, NAPPolicy: Balanced Security and Connectivity 2023-03-27T08:55:09Z %FTD-1-430003: EventPriority: Low, DeviceUUID: 5c120000-ca5e-11e7-ab3c-ad268d8b0000, InstanceID: 1, FirstPacketSecond: 2023-03-27T08:54:39Z, ConnectionID: 57475, AccessControlRuleAction: Trust, SrcIP: 10.0.100.30, DstIP: 10.0.1.20, SrcPort: 44998, DstPort: 8193, Protocol: tcp, IngressInterface: Outside, EgressInterface: Inside, IngressZone: Outside, EgressZone: Inside, IngressVRF: Global, EgressVRF: Global, ACPolicy: ProductionPolicy, AccessControlRuleName: Exposed-Server1, Prefilter Policy: Default Prefilter Policy, User: PassiveAuth\user2, ConnectionDuration: 30, InitiatorPackets: 4, ResponderPackets: 0, InitiatorBytes: 0, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity 2023-03-27T12:26:00Z : %FTD-1-430001: DeviceUUID: 00009fd0-de50-11ea-b566-e4821b710000, InstanceID: 8, FirstPacketSecond: 2023-03-27T12:26:00Z, ConnectionID: 1309, SrcIP: 10.0.1.20, DstIP: 10.0.100.30, SrcPort: 54967, DstPort: 80, Protocol: tcp, IngressInterface: Inside, EgressInterface: Outside, IngressZone: Inside, EgressZone: Outside, Priority: 3, GID: 119, SID: 6, Revision: 3, Message: (http_inspect) URI has two-byte or three-byte UTF-8 encoding, Classification: Not Suspicious Traffic, User: Not Found, IntrusionPolicy: Inline IPS Policy, ACPolicy: FTD-ACP, AccessControlRuleName: PassRule, NAPPolicy: Balanced Security and Connectivity, InlineResult: Pass, IngressVRF: Global, EgressVRF: Global +2019-08-16T09:33:15Z firepower %FTD-1-430002: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46000, DstPort: 80, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, InitiatorPackets: 2, ResponderPackets: 1, InitiatorBytes: 3000000000, ResponderBytes: 3000000000, NAPPolicy: Balanced Security and Connectivity \ No newline at end of file diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log-expected.json index 2ca27b02a47..3c6a780a6a9 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-connection.log-expected.json @@ -42,7 +42,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -157,7 +157,7 @@ "packets": 1 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -299,7 +299,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -439,7 +439,7 @@ "response_code": "NXDOMAIN" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -568,7 +568,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -701,7 +701,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -848,7 +848,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -980,7 +980,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1111,7 +1111,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-started", @@ -1232,7 +1232,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1377,7 +1377,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1498,7 +1498,7 @@ "port": 7680 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1610,7 +1610,7 @@ "port": 8193 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", @@ -1727,7 +1727,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "intrusion-detected", @@ -1793,6 +1793,130 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2019-08-16T09:33:15.000Z", + "cisco": { + "ftd": { + "destination_interface": "outside", + "rule_name": [ + "default", + "Rule-1" + ], + "security": { + "ac_policy": "default", + "access_control_rule_action": "Allow", + "access_control_rule_name": "Rule-1", + "dst_ip": "81.2.69.144", + "dst_port": "80", + "egress_interface": "outside", + "egress_zone": "output-zone", + "ingress_interface": "inside", + "ingress_zone": "input-zone", + "initiator_bytes": "3000000000", + "initiator_packets": "2", + "nap_policy": "Balanced Security and Connectivity", + "prefilter_policy": "Default Prefilter Policy", + "protocol": "tcp", + "responder_bytes": "3000000000", + "responder_packets": "1", + "src_ip": "10.0.1.20", + "src_port": "46000", + "user": "No Authentication Required" + }, + "source_interface": "inside" + } + }, + "destination": { + "address": "81.2.69.144", + "bytes": 3000000000, + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "packets": 1, + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connection-started", + "category": [ + "network" + ], + "code": "430002", + "kind": "event", + "original": "2019-08-16T09:33:15Z firepower %FTD-1-430002: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46000, DstPort: 80, Protocol: tcp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, InitiatorPackets: 2, ResponderPackets: 1, InitiatorBytes: 3000000000, ResponderBytes: 3000000000, NAPPolicy: Balanced Security and Connectivity", + "outcome": "success", + "severity": 1, + "timezone": "UTC", + "type": [ + "connection", + "start", + "allowed" + ] + }, + "host": { + "hostname": "firepower" + }, + "log": { + "level": "alert" + }, + "network": { + "bytes": 6000000000, + "community_id": "1:Xumx4bGQqJmLtaW2LNJT/b/cOm8=", + "iana_number": "6", + "transport": "tcp" + }, + "observer": { + "egress": { + "interface": { + "name": "outside" + } + }, + "hostname": "firepower", + "ingress": { + "interface": { + "name": "inside" + } + }, + "product": "ftd", + "type": "idps", + "vendor": "Cisco" + }, + "related": { + "hosts": [ + "firepower" + ], + "ip": [ + "10.0.1.20", + "81.2.69.144" + ] + }, + "rule": { + "name": "Rule-1", + "ruleset": "default" + }, + "source": { + "address": "10.0.1.20", + "bytes": 3000000000, + "ip": "10.0.1.20", + "packets": 2, + "port": 46000 + }, + "tags": [ + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-file-malware.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-file-malware.log-expected.json index 0118ec6df4c..34bdb1c1b29 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-file-malware.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-file-malware.log-expected.json @@ -31,7 +31,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -130,7 +130,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -229,7 +229,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -328,7 +328,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -431,7 +431,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -541,7 +541,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file-detected", @@ -655,7 +655,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", @@ -780,7 +780,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", @@ -893,7 +893,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", @@ -1018,7 +1018,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", @@ -1146,7 +1146,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware-detected", diff --git a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-malware-site.log-expected.json b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-malware-site.log-expected.json index f8507b7a02e..427f2be4397 100644 --- a/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-malware-site.log-expected.json +++ b/packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-security-malware-site.log-expected.json @@ -64,7 +64,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-finished", diff --git a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 59eedc7a026..ac2989053df 100644 --- a/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # # Parse the syslog header # @@ -1463,20 +1463,20 @@ processors: value: "{{{event.duration}}}" ignore_empty_value: true # - # Ensure source.bytes is integer + # Ensure source.bytes is long # - convert: if: "ctx.source?.bytes != null" field: "source.bytes" - type: "integer" + type: "long" # - # Ensure destination.bytes is integer + # Ensure destination.bytes is long # - convert: if: "ctx.destination?.bytes != null" field: "destination.bytes" - type: "integer" + type: "long" # # Sum source.bytes and destination.bytes in network.bytes @@ -1484,7 +1484,7 @@ processors: - script: lang: painless source: "ctx.network.bytes = ctx.source.bytes + ctx.destination.bytes" - if: ctx.source?.bytes != null && ctx.destination?.bytes != null && ctx.network != null && ctx.network.bytes == null + if: ctx.source?.bytes != null && ctx.destination?.bytes != null && ctx.network?.bytes == null # # Process the flow duration "hh:mm:ss" present in some messages @@ -2037,7 +2037,7 @@ processors: # Define ECS Host and Device fields from Cisco ISE pxGrid Endpoint Profile data - remove: field: _temp_.host.type - if: "ctx._temp_?.host?.type != null && ctx.host?.type == 'Invalid ID'" + if: "ctx._temp_?.host?.type != null && ctx._temp_.host.type == 'Invalid ID'" - gsub: field: _temp_.host.type pattern: "Device" diff --git a/packages/cisco_ftd/data_stream/log/fields/ecs.yml b/packages/cisco_ftd/data_stream/log/fields/ecs.yml index cb2124eec53..7fe033fbe11 100644 --- a/packages/cisco_ftd/data_stream/log/fields/ecs.yml +++ b/packages/cisco_ftd/data_stream/log/fields/ecs.yml @@ -14,6 +14,8 @@ name: destination.domain - external: ecs name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_code - external: ecs name: destination.geo.continent_name - external: ecs @@ -22,10 +24,16 @@ name: destination.geo.country_name - external: ecs name: destination.geo.location +- external: ecs + name: destination.geo.name +- external: ecs + name: destination.geo.postal_code - external: ecs name: destination.geo.region_iso_code - external: ecs name: destination.geo.region_name +- external: ecs + name: destination.geo.timezone - external: ecs name: destination.ip - external: ecs @@ -102,10 +110,6 @@ name: http.request.referrer - external: ecs name: http.response.status_code -- external: ecs - name: host.type -- external: ecs - name: host.os.name - external: ecs name: host.os.full - external: ecs @@ -150,6 +154,28 @@ name: observer.egress.interface.name - external: ecs name: observer.egress.zone +- external: ecs + name: observer.geo.city_name +- external: ecs + name: observer.geo.continent_code +- external: ecs + name: observer.geo.continent_name +- external: ecs + name: observer.geo.country_iso_code +- external: ecs + name: observer.geo.country_name +- external: ecs + name: observer.geo.location +- external: ecs + name: observer.geo.name +- external: ecs + name: observer.geo.postal_code +- external: ecs + name: observer.geo.region_iso_code +- external: ecs + name: observer.geo.region_name +- external: ecs + name: observer.geo.timezone - external: ecs name: observer.hostname - external: ecs @@ -202,6 +228,8 @@ name: source.domain - external: ecs name: source.geo.city_name +- external: ecs + name: source.geo.continent_code - external: ecs name: source.geo.continent_name - external: ecs @@ -210,10 +238,16 @@ name: source.geo.country_name - external: ecs name: source.geo.location +- external: ecs + name: source.geo.name +- external: ecs + name: source.geo.postal_code - external: ecs name: source.geo.region_iso_code - external: ecs name: source.geo.region_name +- external: ecs + name: source.geo.timezone - external: ecs name: source.ip - external: ecs diff --git a/packages/cisco_ftd/data_stream/log/sample_event.json b/packages/cisco_ftd/data_stream/log/sample_event.json index c65a2c63e79..1c2aa103e79 100644 --- a/packages/cisco_ftd/data_stream/log/sample_event.json +++ b/packages/cisco_ftd/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-08-16T09:39:03.000Z", "agent": { - "ephemeral_id": "1aa46b02-06eb-46e3-a2ab-b19097155335", - "id": "edaff8cc-3bee-4424-9e62-8372293e3aac", + "ephemeral_id": "26eb6818-fd18-4fc7-aa90-b1b53cefb42c", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.1" }, "cisco": { "ftd": { @@ -60,12 +60,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "edaff8cc-3bee-4424-9e62-8372293e3aac", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0" + "version": "8.9.1" }, "event": { "action": "malware-detected", @@ -76,7 +76,7 @@ ], "code": "430005", "dataset": "cisco_ftd.log", - "ingested": "2023-06-01T10:53:44Z", + "ingested": "2023-08-29T16:38:11Z", "kind": "event", "original": "2019-08-16T09:39:03Z firepower %FTD-1-430005: SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46004, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Malware Cloud Lookup, FileSHA256: 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, SHA_Disposition: Unavailable, SperoDisposition: Spero detection not performed on file, ThreatName: Win.Ransomware.Eicar::95.sbx.tg, FileName: eicar_com.zip, FileType: ZIP, FileSize: 184, ApplicationProtocol: HTTP, Client: cURL, User: No Authentication Required, FirstPacketSecond: 2019-08-16T09:39:02Z, FilePolicy: malware-and-file-policy, FileStorageStatus: Not Stored (Disposition Was Pending), FileSandboxStatus: File Size Is Too Small, URI: http://www.eicar.org/download/eicar_com.zip", "severity": 1, @@ -102,7 +102,7 @@ "log": { "level": "alert", "source": { - "address": "192.168.176.4:45358" + "address": "172.21.0.4:45378" } }, "network": { diff --git a/packages/cisco_ftd/docs/README.md b/packages/cisco_ftd/docs/README.md index 61780f8d236..e9ffe4ae536 100644 --- a/packages/cisco_ftd/docs/README.md +++ b/packages/cisco_ftd/docs/README.md @@ -22,11 +22,11 @@ An example event for `log` looks as following: { "@timestamp": "2019-08-16T09:39:03.000Z", "agent": { - "ephemeral_id": "1aa46b02-06eb-46e3-a2ab-b19097155335", - "id": "edaff8cc-3bee-4424-9e62-8372293e3aac", + "ephemeral_id": "26eb6818-fd18-4fc7-aa90-b1b53cefb42c", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.1" }, "cisco": { "ftd": { @@ -81,12 +81,12 @@ An example event for `log` looks as following: "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "edaff8cc-3bee-4424-9e62-8372293e3aac", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0" + "version": "8.9.1" }, "event": { "action": "malware-detected", @@ -97,7 +97,7 @@ An example event for `log` looks as following: ], "code": "430005", "dataset": "cisco_ftd.log", - "ingested": "2023-06-01T10:53:44Z", + "ingested": "2023-08-29T16:38:11Z", "kind": "event", "original": "2019-08-16T09:39:03Z firepower %FTD-1-430005: SrcIP: 10.0.1.20, DstIP: 81.2.69.144, SrcPort: 46004, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Malware Cloud Lookup, FileSHA256: 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, SHA_Disposition: Unavailable, SperoDisposition: Spero detection not performed on file, ThreatName: Win.Ransomware.Eicar::95.sbx.tg, FileName: eicar_com.zip, FileType: ZIP, FileSize: 184, ApplicationProtocol: HTTP, Client: cURL, User: No Authentication Required, FirstPacketSecond: 2019-08-16T09:39:02Z, FilePolicy: malware-and-file-policy, FileStorageStatus: Not Stored (Disposition Was Pending), FileSandboxStatus: File Size Is Too Small, URI: http://www.eicar.org/download/eicar_com.zip", "severity": 1, @@ -123,7 +123,7 @@ An example event for `log` looks as following: "log": { "level": "alert", "source": { - "address": "192.168.176.4:45358" + "address": "172.21.0.4:45378" } }, "network": { @@ -248,12 +248,16 @@ An example event for `log` looks as following: | destination.bytes | Bytes sent from the destination to the source. | long | | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | +| destination.geo.continent_code | Two-letter code representing continent's name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | | destination.geo.country_iso_code | Country ISO code. | keyword | | destination.geo.country_name | Country name. | keyword | | destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | destination.geo.region_iso_code | Region ISO code. | keyword | | destination.geo.region_name | Region name. | keyword | +| destination.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | | destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | @@ -274,19 +278,19 @@ An example event for `log` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.sha256 | SHA256 hash. | keyword | @@ -309,7 +313,7 @@ An example event for `log` looks as following: | host.os.full.text | Multi-field of `host.os.full`. | match_only_text | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.name.text | Multi-field of `host.os.name`. | text | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | | host.os.version | Operating system version as a raw string. | keyword | @@ -339,6 +343,17 @@ An example event for `log` looks as following: | network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | | observer.egress.interface.name | Interface name as reported by the system. | keyword | | observer.egress.zone | Network zone of outbound traffic as reported by the observer to categorize the destination area of egress traffic, e.g. Internal, External, DMZ, HR, Legal, etc. | keyword | +| observer.geo.city_name | City name. | keyword | +| observer.geo.continent_code | Two-letter code representing continent's name. | keyword | +| observer.geo.continent_name | Name of the continent. | keyword | +| observer.geo.country_iso_code | Country ISO code. | keyword | +| observer.geo.country_name | Country name. | keyword | +| observer.geo.location | Longitude and latitude. | geo_point | +| observer.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| observer.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| observer.geo.region_iso_code | Region ISO code. | keyword | +| observer.geo.region_name | Region name. | keyword | +| observer.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | observer.hostname | Hostname of the observer. | keyword | | observer.ingress.interface.name | Interface name as reported by the system. | keyword | | observer.ingress.zone | Network zone of incoming traffic as reported by the observer to categorize the source area of ingress traffic. e.g. internal, External, DMZ, HR, Legal, etc. | keyword | @@ -373,12 +388,16 @@ An example event for `log` looks as following: | source.bytes | Bytes sent from the source to the destination. | long | | source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | +| source.geo.continent_code | Two-letter code representing continent's name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | source.geo.region_iso_code | Region ISO code. | keyword | | source.geo.region_name | Region name. | keyword | +| source.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | | source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | diff --git a/packages/cisco_ftd/kibana/tags.yml b/packages/cisco_ftd/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_ftd/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_ftd/manifest.yml b/packages/cisco_ftd/manifest.yml index 04773befa48..ec1942b9047 100644 --- a/packages/cisco_ftd/manifest.yml +++ b/packages/cisco_ftd/manifest.yml @@ -1,15 +1,13 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: cisco_ftd title: Cisco FTD -version: "2.13.0" -license: basic +version: "2.16.0" description: Collect logs from Cisco FTD with Elastic Agent. type: integration categories: - network - security - firewall_security -release: ga conditions: kibana.version: "^7.16.0 || ^8.0.0" icons: diff --git a/packages/cisco_ios/_dev/build/build.yml b/packages/cisco_ios/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_ios/_dev/build/build.yml +++ b/packages/cisco_ios/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_ios/changelog.yml b/packages/cisco_ios/changelog.yml index 16a470a557f..c55f3c4b54b 100644 --- a/packages/cisco_ios/changelog.yml +++ b/packages/cisco_ios/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 1.21.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.20.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.19.0" + changes: + - description: Support ingesting IOSXE-*-PLATFORM messages. + type: enhancement + link: https://github.com/elastic/integrations/pull/7688 +- version: "1.18.0" + changes: + - description: Support ingesting NTP log messages. + type: enhancement + link: https://github.com/elastic/integrations/pull/7466 +- version: "1.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.16.2" + changes: + - description: Fix parsing error when message_count is missing + type: bugfix + link: https://github.com/elastic/integrations/pull/6919 +- version: "1.16.1" + changes: + - description: Fix grok to be aware of fman_fp_image + type: bugfix + link: https://github.com/elastic/integrations/pull/6930 - version: "1.16.0" changes: - description: Adding Timezone Map advanced configuration option diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-asr920.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-asr920.log-expected.json index aa4abad53f9..776d285a401 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-asr920.log-expected.json +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-asr920.log-expected.json @@ -14,7 +14,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -80,7 +80,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -146,7 +146,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -207,7 +207,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -250,7 +250,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -292,7 +292,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -340,7 +340,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -418,7 +418,7 @@ "ip": "224.0.0.18" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -496,7 +496,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log index 17ba60830b8..c69a2050754 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log @@ -16,4 +16,11 @@ Mar 24 18:06:00 192.168.100.2 1991220: Mar 24 18:06:00.364 UTC: %SYS-6-LOGOUT: U Mar 24 17:37:39 192.168.100.2 1991221: Mar 24 17:37:39 UTC: %PIM-SW1-6-INVALID_RP_JOIN: Received (*, 10.36.2.78) Join from 10.4.5.66 for invalid RP 10.3.66.3 Mar 24 17:37:39 192.168.100.2 1991221: Mar 24 17:37:39 UTC: %PIM-SW1-6-INVALID_RP_JOIN: Received (10.50.22.5, 10.36.2.78) Join from 10.4.5.66 for invalid RP 10.3.66.3 Mar 24 12:09:35 192.168.100.2 1991217: Mar 24 12:09:35.367: %OSPF-4-NOVALIDKEY: No valid authentication send key is available on interface eth0 -Mar 24 12:06:47 192.168.100.2 1991218: Mar 24 12:06:47.099: %CCH323-6-CALL_PRESERVED: cch323_h225_handle_conn_loss: H.323 call preserved due to socket closure or error, Call Id = 6527, fd = 19 \ No newline at end of file +Mar 24 12:06:47 192.168.100.2 1991218: Mar 24 12:06:47.099: %CCH323-6-CALL_PRESERVED: cch323_h225_handle_conn_loss: H.323 call preserved due to socket closure or error, Call Id = 6527, fd = 19 +Jul 11 09:34:00 my-router-hostname 1663312: Jul 11 09:34:00.020: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 permitted tcp 172.16.0.26(59144) -> 10.100.8.34(1103), 1 packet +Jul 11 09:31:03 my-router-hostname 1663410: Jul 11 09:31:03.762: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list 110 denied tcp 10.100.8.34(59120) -> 172.16.0.26(7774), 1 packet +Jul 11 09:34:00 my-router-hostname 1663469: Jul 11 09:34:00.334: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 permitted udp 172.16.0.26(1985) -> 10.100.8.34(1985), 327 packets +Jul 11 09:34:00 my-router-hostname 1663511: Jul 11 09:34:00.209: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 denied udp 10.100.8.34(1985) -> 172.16.0.26(1985), 342 packets +Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:34:58.206: %FMANFP-6-IPACCESSLOGP: SIP0: fman_fp_image: list ACL denied udp 10.10.10.10(52361) -> 10.100.8.34(10001), 1 packet +Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:34:58.206: %FMANFP-6-IPACCESSLOGDP: F0: fman_fp_image: list ACL_TEST permitted icmp 172.16.0.26 -> 10.100.8.34 (8/0), 2 packets +Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:35:28.207: %FMANFP-6-IPACCESSLOGDP: F0: fman_fp_image: list ACL_TEST permitted icmp 10.100.8.34 -> 172.16.0.26 (8/0), 1 packet \ No newline at end of file diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log-expected.json index bf45c0b7530..f252c81ffcd 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log-expected.json +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-cisco-ios.log-expected.json @@ -14,7 +14,7 @@ "ip": "224.0.0.22" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -33,10 +33,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 177 denied igmp 192.168.100.197 -\u003e 224.0.0.22, 1 packet", "network": { @@ -79,7 +76,7 @@ "ip": "224.0.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -101,10 +98,7 @@ "type": "20" }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list INBOUND-ON-F11 denied igmp 192.168.100.2 -\u003e 224.0.0.2 (20), 1 packet", "network": { @@ -147,7 +141,7 @@ "ip": "255.255.255.255" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -166,10 +160,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 171 denied 0 192.168.100.1 -\u003e 255.255.255.255, 1 packet", "network": { @@ -221,7 +212,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allow", @@ -240,10 +231,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list ACL-IPv6-E0/0-IN/10 permitted tcp 2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6(1027) -\u003e 2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6(22), 9 packets", "network": { @@ -296,7 +284,7 @@ "port": 15600 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -315,10 +303,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 177 denied udp 192.168.100.195(55250) -\u003e 192.168.100.255(15600), 1 packet", "network": { @@ -362,7 +347,7 @@ "ip": "192.168.100.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -385,10 +370,7 @@ "type": "3" }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 151 denied icmp 192.168.100.1 -\u003e 192.168.100.2 (3/4), 1 packet", "network": { @@ -432,7 +414,7 @@ "port": 15600 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -451,10 +433,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 177 denied udp 192.168.100.195(54309) -\u003e 192.168.100.255(15600), 1 packet", "network": { @@ -493,7 +472,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -510,10 +489,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "access-list logging rate-limited or missed 18 packets", "observer": { @@ -540,7 +516,7 @@ "port": 15600 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -559,10 +535,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 177 denied udp 192.168.100.195(43989) -\u003e 192.168.100.255(15600), 1 packet", "network": { @@ -619,7 +592,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -638,10 +611,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 150 denied tcp 192.168.100.12(59832) -\u003e 81.2.69.144(80), 1 packet", "network": { @@ -680,7 +650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -697,10 +667,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "access-list logging rate-limited or missed 23 packets", "observer": { @@ -726,7 +693,7 @@ "ip": "192.168.100.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -749,10 +716,7 @@ "type": "3" }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 150 denied icmp 192.168.100.12 -\u003e 192.168.100.1 (3/3), 32 packets", "network": { @@ -808,7 +772,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -827,10 +791,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "list 150 denied tcp 192.168.100.12(59834) -\u003e 81.2.69.144(80), 1 packet", "network": { @@ -873,7 +834,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -890,10 +851,7 @@ ] }, "log": { - "level": "notification", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "notification" }, "message": "Login Success [user: john.smith] [Source: 10.2.55.3] [localport: 22] at 12:06:03 MST Wed Mar 24 2021", "network": { @@ -937,7 +895,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -954,10 +912,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "User john.smith has exited tty session 5(10.5.36.9)", "network": { @@ -1007,7 +962,7 @@ "ip": "10.3.66.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "multicast-join", @@ -1027,10 +982,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "Received (*, 10.36.2.78) Join from 10.4.5.66 for invalid RP 10.3.66.3", "network": { @@ -1078,7 +1030,7 @@ "ip": "10.3.66.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "multicast-join", @@ -1098,10 +1050,7 @@ ] }, "log": { - "level": "informational", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "informational" }, "message": "Received (10.50.22.5, 10.36.2.78) Join from 10.4.5.66 for invalid RP 10.3.66.3", "network": { @@ -1135,7 +1084,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1152,10 +1101,7 @@ ] }, "log": { - "level": "warning", - "syslog": { - "hostname": "192.168.100.2" - } + "level": "warning" }, "message": "No valid authentication send key is available on interface eth0", "observer": { @@ -1176,7 +1122,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1192,18 +1138,479 @@ "info" ] }, + "log": { + "level": "informational" + }, + "message": "H.323 call preserved due to socket closure or error, Call Id = 6527, fd = 19", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-11T09:34:00.020Z", + "cisco": { + "ios": { + "access_list": "internet_in_gig0", + "facility": "FMANFP", + "sequence": "1663312" + } + }, + "destination": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "port": 1103 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allow", + "category": [ + "network" + ], + "code": "IPACCESSLOGP", + "original": "Jul 11 09:34:00 my-router-hostname 1663312: Jul 11 09:34:00.020: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 permitted tcp 172.16.0.26(59144) -\u003e 10.100.8.34(1103), 1 packet", + "provider": "firewall", + "sequence": 1663312, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "allowed" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "my-router-hostname" + } + }, + "message": "list internet_in_gig0 permitted tcp 172.16.0.26(59144) -\u003e 10.100.8.34(1103), 1 packet", + "network": { + "community_id": "1:KXW3u/74dvvbFZ7Ewo9z4chd5T4=", + "packets": 1, + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "172.16.0.26", + "10.100.8.34" + ] + }, + "source": { + "address": "172.16.0.26", + "ip": "172.16.0.26", + "packets": 1, + "port": 59144 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-11T09:31:03.762Z", + "cisco": { + "ios": { + "access_list": "110", + "facility": "FMANFP", + "sequence": "1663410" + } + }, + "destination": { + "address": "172.16.0.26", + "ip": "172.16.0.26", + "port": 7774 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "deny", + "category": [ + "network" + ], + "code": "IPACCESSLOGP", + "original": "Jul 11 09:31:03 my-router-hostname 1663410: Jul 11 09:31:03.762: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list 110 denied tcp 10.100.8.34(59120) -\u003e 172.16.0.26(7774), 1 packet", + "provider": "firewall", + "sequence": 1663410, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "denied" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "my-router-hostname" + } + }, + "message": "list 110 denied tcp 10.100.8.34(59120) -\u003e 172.16.0.26(7774), 1 packet", + "network": { + "community_id": "1:e8Y05uGbOy3+E9kG3gX0ri93utw=", + "packets": 1, + "transport": "tcp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.100.8.34", + "172.16.0.26" + ] + }, + "source": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "packets": 1, + "port": 59120 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-11T09:34:00.334Z", + "cisco": { + "ios": { + "access_list": "internet_in_gig0", + "facility": "FMANFP", + "sequence": "1663469" + } + }, + "destination": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "port": 1985 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allow", + "category": [ + "network" + ], + "code": "IPACCESSLOGP", + "original": "Jul 11 09:34:00 my-router-hostname 1663469: Jul 11 09:34:00.334: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 permitted udp 172.16.0.26(1985) -\u003e 10.100.8.34(1985), 327 packets", + "provider": "firewall", + "sequence": 1663469, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "allowed" + ] + }, "log": { "level": "informational", "syslog": { - "hostname": "192.168.100.2" + "hostname": "my-router-hostname" } }, - "message": "cch323_h225_handle_conn_loss: H.323 call preserved due to socket closure or error, Call Id = 6527, fd = 19", + "message": "list internet_in_gig0 permitted udp 172.16.0.26(1985) -\u003e 10.100.8.34(1985), 327 packets", + "network": { + "community_id": "1:4IV7i5VTdXeQIUxYQNz2lfhh9eE=", + "packets": 327, + "transport": "udp", + "type": "ipv4" + }, "observer": { "product": "IOS", "type": "firewall", "vendor": "Cisco" }, + "related": { + "ip": [ + "172.16.0.26", + "10.100.8.34" + ] + }, + "source": { + "address": "172.16.0.26", + "ip": "172.16.0.26", + "packets": 327, + "port": 1985 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-11T09:34:00.209Z", + "cisco": { + "ios": { + "access_list": "internet_in_gig0", + "facility": "FMANFP", + "sequence": "1663511" + } + }, + "destination": { + "address": "172.16.0.26", + "ip": "172.16.0.26", + "port": 1985 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "deny", + "category": [ + "network" + ], + "code": "IPACCESSLOGP", + "original": "Jul 11 09:34:00 my-router-hostname 1663511: Jul 11 09:34:00.209: %FMANFP-6-IPACCESSLOGP: R0/0: fman_fp_image: list internet_in_gig0 denied udp 10.100.8.34(1985) -\u003e 172.16.0.26(1985), 342 packets", + "provider": "firewall", + "sequence": 1663511, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "denied" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "my-router-hostname" + } + }, + "message": "list internet_in_gig0 denied udp 10.100.8.34(1985) -\u003e 172.16.0.26(1985), 342 packets", + "network": { + "community_id": "1:4IV7i5VTdXeQIUxYQNz2lfhh9eE=", + "packets": 342, + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.100.8.34", + "172.16.0.26" + ] + }, + "source": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "packets": 342, + "port": 1985 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-10T23:34:58.206Z", + "cisco": { + "ios": { + "access_list": "ACL", + "facility": "FMANFP", + "sequence": "1663511" + } + }, + "destination": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "port": 10001 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "deny", + "category": [ + "network" + ], + "code": "IPACCESSLOGP", + "original": "Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:34:58.206: %FMANFP-6-IPACCESSLOGP: SIP0: fman_fp_image: list ACL denied udp 10.10.10.10(52361) -\u003e 10.100.8.34(10001), 1 packet", + "provider": "firewall", + "sequence": 1663511, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "denied" + ] + }, + "log": { + "level": "informational" + }, + "message": "list ACL denied udp 10.10.10.10(52361) -\u003e 10.100.8.34(10001), 1 packet", + "network": { + "community_id": "1:7HdATA0Zd7fB8RBwRLEo/zNyyLQ=", + "packets": 1, + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.10.10.10", + "10.100.8.34" + ] + }, + "source": { + "address": "10.10.10.10", + "ip": "10.10.10.10", + "packets": 1, + "port": 52361 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-10T23:34:58.206Z", + "cisco": { + "ios": { + "access_list": "ACL_TEST", + "facility": "FMANFP", + "sequence": "1663511" + } + }, + "destination": { + "address": "10.100.8.34", + "ip": "10.100.8.34" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allow", + "category": [ + "network" + ], + "code": "IPACCESSLOGDP", + "original": "Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:34:58.206: %FMANFP-6-IPACCESSLOGDP: F0: fman_fp_image: list ACL_TEST permitted icmp 172.16.0.26 -\u003e 10.100.8.34 (8/0), 2 packets", + "provider": "firewall", + "sequence": 1663511, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "allowed" + ] + }, + "icmp": { + "code": "0", + "type": "8" + }, + "log": { + "level": "informational" + }, + "message": "list ACL_TEST permitted icmp 172.16.0.26 -\u003e 10.100.8.34 (8/0), 2 packets", + "network": { + "community_id": "1:OvCASybztHusF+Fy8s345w5/IZw=", + "packets": 2, + "transport": "icmp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "172.16.0.26", + "10.100.8.34" + ] + }, + "source": { + "address": "172.16.0.26", + "ip": "172.16.0.26", + "packets": 2 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-06-10T23:35:28.207Z", + "cisco": { + "ios": { + "access_list": "ACL_TEST", + "facility": "FMANFP", + "sequence": "1663511" + } + }, + "destination": { + "address": "172.16.0.26", + "ip": "172.16.0.26" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allow", + "category": [ + "network" + ], + "code": "IPACCESSLOGDP", + "original": "Jun 10 23:34:58 10.0.0.1 1663511: Jun 10 23:35:28.207: %FMANFP-6-IPACCESSLOGDP: F0: fman_fp_image: list ACL_TEST permitted icmp 10.100.8.34 -\u003e 172.16.0.26 (8/0), 1 packet", + "provider": "firewall", + "sequence": 1663511, + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "allowed" + ] + }, + "icmp": { + "code": "0", + "type": "8" + }, + "log": { + "level": "informational" + }, + "message": "list ACL_TEST permitted icmp 10.100.8.34 -\u003e 172.16.0.26 (8/0), 1 packet", + "network": { + "community_id": "1:0NC2mwr4V+bYFoMF3BsibI/mn0Y=", + "packets": 1, + "transport": "icmp", + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.100.8.34", + "172.16.0.26" + ] + }, + "source": { + "address": "10.100.8.34", + "ip": "10.100.8.34", + "packets": 1 + }, "tags": [ "preserve_original_event" ] diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format-tzoffset.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format-tzoffset.log-expected.json index 6bdf6ff54ad..9d6cd2bab07 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format-tzoffset.log-expected.json +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format-tzoffset.log-expected.json @@ -9,7 +9,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -51,7 +51,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -93,7 +93,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format.log-expected.json index f5d6e396ae3..1fd0b4e0268 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format.log-expected.json +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-date-format.log-expected.json @@ -9,7 +9,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -51,7 +51,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -93,7 +93,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -135,7 +135,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -177,7 +177,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -219,7 +219,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -261,7 +261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -303,7 +303,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -345,7 +345,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -387,7 +387,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -429,7 +429,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -471,7 +471,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -513,7 +513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -555,7 +555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -597,7 +597,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -639,7 +639,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -681,7 +681,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -723,7 +723,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log new file mode 100644 index 00000000000..aa0fa741539 --- /dev/null +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log @@ -0,0 +1,17 @@ +<190>3132517: Jul 13 08:23:43 192.168.100.2 sw01: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>Jul 13 08:23:43 192.168.100.2 sw01: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>3132517: 192.168.100.2 3132513: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>3132783: 2a02:cf40::: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>3132811: sw01: 3132807: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>3132517: 3132513: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>2361044: sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>2361044: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>: sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>*Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format +<190>3132517: sw01: 3132513: 2y10w: %FOO-6-BAR: Test header format +<190>Jul 13 08:23:43 192.168.100.2 585917: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format +Jul 13 08:23:43 192.168.100.2 585917: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format +Jul 13 08:23:43 sw01 1663410: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format \ No newline at end of file diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log-expected.json new file mode 100644 index 00000000000..7f3bf494402 --- /dev/null +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog-header.log-expected.json @@ -0,0 +1,701 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132517, + "sequence": "3132779" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132517: Jul 13 08:23:43 192.168.100.2 sw01: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132779, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "sequence": "3132779" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003eJul 13 08:23:43 192.168.100.2 sw01: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132779, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132517, + "sequence": "3132513" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132517: 192.168.100.2 3132513: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132513, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132783, + "sequence": "3132779" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132783: 2a02:cf40::: 3132779: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132779, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132811, + "sequence": "3132807" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132811: sw01: 3132807: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132807, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132517, + "sequence": "3132513" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132517: 3132513: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132513, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 2361044 + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e2361044: sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 2361044, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003esw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 2361044 + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e2361044: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 2361044, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e: sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003eJul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.398Z", + "cisco": { + "ios": { + "facility": "FOO" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e*Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "cisco": { + "ios": { + "facility": "FOO", + "message_count": 3132517, + "sequence": "3132513", + "uptime": "2y10w" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003e3132517: sw01: 3132513: 2y10w: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 3132513, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01", + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.000Z", + "cisco": { + "ios": { + "facility": "FOO", + "sequence": "585917" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "\u003c190\u003eJul 13 08:23:43 192.168.100.2 585917: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 585917, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.000Z", + "cisco": { + "ios": { + "facility": "FOO", + "sequence": "585917" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "Jul 13 08:23:43 192.168.100.2 585917: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 585917, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational" + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-14T08:23:43.000Z", + "cisco": { + "ios": { + "facility": "FOO", + "sequence": "1663410" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "BAR", + "original": "Jul 13 08:23:43 sw01 1663410: Jul 14 2023 08:23:43 UTC: %FOO-6-BAR: Test header format", + "provider": "firewall", + "sequence": 1663410, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "hostname": "sw01" + } + }, + "message": "Test header format", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log index a7aa0660769..b8f69dd5332 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log @@ -1,4 +1,9 @@ <189>2360957: Jan 6 2022 20:52:12.861: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10) <189>: Jan 6 2022 20:54:26.961: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10) <190>: Jan 6 2022 20:55:50.671: %SEC-6-IPACCESSLOGDP: list 100 denied icmp 172.16.0.26 -> 10.100.8.34 (3/3), 20 packets -<189>: sw01: Jan 6 2022 21:01:34.964: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10) \ No newline at end of file +<189>: sw01: Jan 6 2022 21:01:34.964: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10) +<191>2637085: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (NOTICE): Clock synchronization lost. +<191>2637086: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (INFO): 10.200.1.105 961A 8A sys_peer +<191>2637087: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (NOTICE): Clock is synchronized. +<190>3352436: 3352457: Aug 12 2023 12:14:24.412 mdt: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:001 TS:00013807766185951588 %FW-6-SESS_AUDIT_TRAIL: (target:class) (ZP_PROCESS_TO_CORPORATE:CM_PROCESS_TO_CORPORATE):Stop dns session: initiator (10.50.14.44:33207) sent 48 bytes -- responder (10.120.42.6:53) sent 40 bytes, from GigabitEthernet10/0/2.6 +<190>3352460: 3352481: Aug 12 2023 12:15:33.963 mdt: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:001 TS:00013807835737559120 %FW-6-DROP_PKT: Dropping tcp pkt from GigabitEthernet1/0/2.6 10.50.14.44:53836 => 89.160.20.128:80(target:class)-(ZP_PROCESS_TO_CORPORATE:class-default) due to Policy drop:classify result with ip ident 13017 tcp flag 0x2, seq 4266642156, ack 0 diff --git a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log-expected.json b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log-expected.json index f1c41d6d8ab..55f9c82f496 100644 --- a/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log-expected.json +++ b/packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-syslog.log-expected.json @@ -9,7 +9,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -49,7 +49,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -93,7 +93,7 @@ "ip": "10.100.8.34" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -155,7 +155,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -186,6 +186,265 @@ "tags": [ "preserve_original_event" ] + }, + { + "@timestamp": "2023-08-18T07:15:04.461Z", + "cisco": { + "ios": { + "message_count": 2637085 + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c191\u003e2637085: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (NOTICE): Clock synchronization lost.", + "provider": "firewall", + "sequence": 2637085, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "hostname": "rt401-rk30409", + "priority": 191 + } + }, + "message": "NTP Core (NOTICE): Clock synchronization lost.", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-08-18T07:15:04.461Z", + "cisco": { + "ios": { + "message_count": 2637086 + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c191\u003e2637086: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (INFO): 10.200.1.105 961A 8A sys_peer", + "provider": "firewall", + "sequence": 2637086, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "hostname": "rt401-rk30409", + "priority": 191 + } + }, + "message": "NTP Core (INFO): 10.200.1.105 961A 8A sys_peer", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-08-18T07:15:04.461Z", + "cisco": { + "ios": { + "message_count": 2637087 + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "original": "\u003c191\u003e2637087: rt401-rk30409: Aug 18 07:15:04.461 CEST: NTP Core (NOTICE): Clock is synchronized.", + "provider": "firewall", + "sequence": 2637087, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "hostname": "rt401-rk30409", + "priority": 191 + } + }, + "message": "NTP Core (NOTICE): Clock is synchronized.", + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-08-12T12:14:24.412Z", + "cisco": { + "ios": { + "facility": "FW", + "interface": { + "name": "GigabitEthernet10/0/2.6" + }, + "message_count": 3352436, + "sequence": "3352457" + } + }, + "destination": { + "bytes": 40, + "ip": "10.120.42.6", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "SESS_AUDIT_TRAIL", + "original": "\u003c190\u003e3352436: 3352457: Aug 12 2023 12:14:24.412 mdt: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:001 TS:00013807766185951588 %FW-6-SESS_AUDIT_TRAIL: (target:class) (ZP_PROCESS_TO_CORPORATE:CM_PROCESS_TO_CORPORATE):Stop dns session: initiator (10.50.14.44:33207) sent 48 bytes -- responder (10.120.42.6:53) sent 40 bytes, from GigabitEthernet10/0/2.6", + "provider": "firewall", + "sequence": 3352457, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "(target:class) (ZP_PROCESS_TO_CORPORATE:CM_PROCESS_TO_CORPORATE):Stop dns session: initiator (10.50.14.44:33207) sent 48 bytes -- responder (10.120.42.6:53) sent 40 bytes, from GigabitEthernet10/0/2.6", + "network": { + "bytes": 88, + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.50.14.44", + "10.120.42.6" + ] + }, + "source": { + "bytes": 48, + "ip": "10.50.14.44", + "port": 33207 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-08-12T12:15:33.963Z", + "cisco": { + "ios": { + "facility": "FW", + "interface": { + "name": "GigabitEthernet1/0/2.6" + }, + "message_count": 3352460, + "sequence": "3352481" + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.128", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "code": "DROP_PKT", + "original": "\u003c190\u003e3352460: 3352481: Aug 12 2023 12:15:33.963 mdt: %IOSXE-6-PLATFORM: R0/0: cpp_cp: QFP:0.0 Thread:001 TS:00013807835737559120 %FW-6-DROP_PKT: Dropping tcp pkt from GigabitEthernet1/0/2.6 10.50.14.44:53836 =\u003e 89.160.20.128:80(target:class)-(ZP_PROCESS_TO_CORPORATE:class-default) due to Policy drop:classify result with ip ident 13017 tcp flag 0x2, seq 4266642156, ack 0", + "provider": "firewall", + "sequence": 3352481, + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "log": { + "level": "informational", + "syslog": { + "priority": 190 + } + }, + "message": "Dropping tcp pkt from GigabitEthernet1/0/2.6 10.50.14.44:53836 =\u003e 89.160.20.128:80(target:class)-(ZP_PROCESS_TO_CORPORATE:class-default) due to Policy drop:classify result with ip ident 13017 tcp flag 0x2, seq 4266642156, ack 0", + "network": { + "type": "ipv4" + }, + "observer": { + "product": "IOS", + "type": "firewall", + "vendor": "Cisco" + }, + "related": { + "ip": [ + "10.50.14.44", + "89.160.20.128" + ] + }, + "source": { + "ip": "10.50.14.44", + "port": 53836 + }, + "tags": [ + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml index d65a748de6b..345e5037cff 100644 --- a/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Cisco IOS logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.category value: [network] @@ -31,19 +31,37 @@ processors: - remove: field: message ignore_missing: true - - dissect: + - grok: field: event.original - pattern: '%{_temp_.header} %%{message}' + patterns: + - '%{DATA:_temp_.header} %%{GREEDYDATA:message}' + - '%{DATA:_temp_.header} %{NTP_MESSAGE:ntp_message}' + pattern_definitions: + NTP_MESSAGE: 'NTP %{GREEDYDATA}' tag: dissect_header - grok: field: _temp_.header tag: grok_header patterns: - - '^<%{NONNEGINT:log.syslog.priority:long}>%{NUMBER:cisco.ios.message_count}?: (?:%{SYSLOGHOST:log.syslog.hostname}: )?(?:%{NUMBER:cisco.ios.sequence}: )?(%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' - - '%{SYSLOGHOST:log.syslog.hostname} (%{NUMBER:cisco.ios.sequence}: )?%{CISCO_TIMESTAMP}' + - '^(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?(%{HOSTNAME:log.syslog.hostname}[:]? )?%{NUMBER:cisco.ios.sequence}: (%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?(%{HOSTNAME:log.syslog.hostname}: )?%{NUMBER:cisco.ios.sequence}: (%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?(%{HOSTNAME:log.syslog.hostname}: )?(%{NUMBER:cisco.ios.sequence}: )?(%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )?(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?%{HOSTNAME:log.syslog.hostname}: %{NUMBER:cisco.ios.sequence}: (%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )?(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?%{NUMBER:cisco.ios.sequence}: (%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )?(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?%{HOSTNAME:log.syslog.hostname}: (%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' + - '^(<%{NONNEGINT:log.syslog.priority:long}>)?(?:%{NUMBER:cisco.ios.message_count}: |: )?(%{SYSLOGTIMESTAMP}[:]? )?(%{IP}[:]? )?(%{HOSTNAME:log.syslog.hostname}: )?(%{NUMBER:cisco.ios.sequence}: )?(%{CISCO_TIMESTAMP}|%{NOTSPACE:cisco.ios.uptime}:)' pattern_definitions: - CISCO_TIMESTAMP: '%{CISCOTIMESTAMP:_temp_.cisco_timestamp}(?: %{CISCO_TZ:_temp_.tz})?' + CISCO_TIMESTAMP: '[*]?%{CISCOTIMESTAMP:_temp_.cisco_timestamp}(?: %{CISCO_TZ:_temp_.tz})?' CISCO_TZ: '[a-zA-Z]{1,4}' + on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - remove: + field: _temp_.header + ignore_missing: true + tag: on_failure_remove_header - set: field: event.sequence @@ -120,7 +138,34 @@ processors: field: message tag: grok_message patterns: - - "%{DATA:cisco.ios.facility}-%{POSINT:event.severity}-%{DATA:event.code}: %{GREEDYDATA:message}" + - '%{DATA:cisco.ios.facility}-%{POSINT:event.severity}-%{DATA:event.code}:\s+(\w+\d+(/\d+)?\:\s+)?([a-zA-Z0-9_]+\:\s+)?%{GREEDYDATA:message}' + ignore_missing: true + - grok: + field: message + tag: grok_child_message + patterns: + - '%%{DATA:cisco.ios.facility}-%{POSINT:event.severity}-%{DATA:event.code}:\s+(\w+\d+(/\d+)?\:\s+)?([a-zA-Z0-9_]+\:\s+)?%{GREEDYDATA:message}' + ignore_missing: true + if: ctx.cisco?.ios?.facility == 'IOSXE' && ctx.event?.code == 'PLATFORM' + - grok: + field: message + tag: grok_audit_details + patterns: + - 'initiator \(%{IP:source.ip}:%{NUMBER:source.port:long}\) sent %{NUMBER:source.bytes:long} bytes -- responder \(%{IP:destination.ip}:%{NUMBER:destination.port:long}\) sent %{NUMBER:destination.bytes:long} bytes, from %{NOTSPACE:cisco.ios.interface.name}' + ignore_missing: true + if: ctx.cisco?.ios?.facility == 'FW' && ctx.event?.code == 'SESS_AUDIT_TRAIL' + - grok: + field: message + tag: grok_drop_details + patterns: + - '^Dropping %{WORD} %{WORD} from %{NOTSPACE:cisco.ios.interface.name} %{IP:source.ip}:%{NUMBER:source.port:long} ?=> ?%{IP:destination.ip}:%{NUMBER:destination.port:long}' + ignore_missing: true + if: ctx.cisco?.ios?.facility == 'FW' && ctx.event?.code == 'DROP_PKT' + - rename: + field: ntp_message + target_field: message + tag: rename_ntp_message + if: ctx.ntp_message != null - convert: field: event.severity type: long @@ -226,6 +271,22 @@ processors: type: long tag: convert_destination_port ignore_missing: true + - script: + lang: painless + source: | + long n = 0; + if (ctx.source?.bytes != null) { + n += ctx.source.bytes + } + if (ctx.destination?.bytes != null) { + n += ctx.destination.bytes + } + if (ctx.network == null) { + ctx.network = new HashMap(); + } + ctx.network.bytes = n; + if: ctx.source?.bytes != null || ctx.destination?.bytes != null + ignore_failure: true - set: field: network.packets copy_from: source.packets diff --git a/packages/cisco_ios/data_stream/log/fields/ecs.yml b/packages/cisco_ios/data_stream/log/fields/ecs.yml index 05d7f3d85a0..528ae122641 100644 --- a/packages/cisco_ios/data_stream/log/fields/ecs.yml +++ b/packages/cisco_ios/data_stream/log/fields/ecs.yml @@ -2,6 +2,8 @@ name: '@timestamp' - external: ecs name: destination.address +- external: ecs + name: destination.bytes - external: ecs name: destination.as.number - external: ecs @@ -62,6 +64,8 @@ name: log.level - external: ecs name: message +- external: ecs + name: network.bytes - external: ecs name: network.community_id - external: ecs @@ -84,6 +88,8 @@ name: related.user - external: ecs name: source.address +- external: ecs + name: source.bytes - external: ecs name: source.ip - external: ecs @@ -114,3 +120,5 @@ name: tags - external: ecs name: log.syslog.priority +- external: ecs + name: log.syslog.hostname diff --git a/packages/cisco_ios/data_stream/log/fields/fields.yml b/packages/cisco_ios/data_stream/log/fields/fields.yml index 1eac30828a4..1ebe861b1f7 100644 --- a/packages/cisco_ios/data_stream/log/fields/fields.yml +++ b/packages/cisco_ios/data_stream/log/fields/fields.yml @@ -13,6 +13,12 @@ type: keyword description: | The facility to which the message refers (for example, SNMP, SYS, and so forth). A facility can be a hardware device, a protocol, or a module of the system software. It denotes the source or the cause of the system message. + - name: interface + type: group + fields: + - name: name + type: keyword + description: The name of the network interface. - name: pim type: group fields: @@ -60,6 +66,3 @@ - name: igmp.type type: keyword description: IGMP type. -- name: log.syslog.hostname - type: keyword - description: Hostname parsed from syslog header. diff --git a/packages/cisco_ios/data_stream/log/sample_event.json b/packages/cisco_ios/data_stream/log/sample_event.json index 56aa524fc5e..1017a27b459 100644 --- a/packages/cisco_ios/data_stream/log/sample_event.json +++ b/packages/cisco_ios/data_stream/log/sample_event.json @@ -1,16 +1,16 @@ { - "@timestamp": "2022-01-06T22:11:43.398+11:00", + "@timestamp": "2022-01-06T20:52:12.861Z", "agent": { - "ephemeral_id": "b4eeb540-5cc1-4878-b94d-09d0a0d440dd", - "id": "7fcefa24-63f3-457e-b11c-ccf7f1edaad6", + "ephemeral_id": "960a0fda-a7b7-4362-9018-34b1d0d119c4", + "id": "f00ff835-626e-4a18-a8a2-0bb3ebb7503f", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.0.0" }, "cisco": { "ios": { - "facility": "FOO", - "message_count": 2361044 + "facility": "SYS", + "message_count": 2360957 } }, "data_stream": { @@ -19,45 +19,43 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "7fcefa24-63f3-457e-b11c-ccf7f1edaad6", + "id": "f00ff835-626e-4a18-a8a2-0bb3ebb7503f", "snapshot": false, - "version": "8.6.2" + "version": "8.0.0" }, "event": { "agent_id_status": "verified", "category": [ "network" ], - "code": "BAR", + "code": "CONFIG_I", "dataset": "cisco_ios.log", - "ingested": "2023-06-01T11:59:13Z", - "original": "\u003c190\u003e2361044: sw01: Jan 6 2022 22:11:43.398 AEST: %FOO-6-BAR: Test date format.", + "ingested": "2023-07-13T09:20:48Z", + "original": "\u003c189\u003e2360957: Jan 6 2022 20:52:12.861: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10)", "provider": "firewall", - "sequence": 2361044, - "severity": 6, - "timezone": "Australia/Sydney", + "sequence": 2360957, + "severity": 5, + "timezone": "+00:00", "type": [ "info" ] }, "input": { - "type": "log" + "type": "tcp" }, "log": { - "file": { - "path": "/tmp/service_logs/cisco-ios-timezones.log" + "level": "notification", + "source": { + "address": "172.25.0.4:46792" }, - "level": "informational", - "offset": 0, "syslog": { - "hostname": "sw01", - "priority": 190 + "priority": 189 } }, - "message": "Test date format.", + "message": "Configured from console by akroh on vty0 (10.100.11.10)", "observer": { "product": "IOS", "type": "firewall", diff --git a/packages/cisco_ios/docs/README.md b/packages/cisco_ios/docs/README.md index 35016ebd54b..df850359b23 100644 --- a/packages/cisco_ios/docs/README.md +++ b/packages/cisco_ios/docs/README.md @@ -24,18 +24,18 @@ An example event for `log` looks as following: ```json { - "@timestamp": "2022-01-06T22:11:43.398+11:00", + "@timestamp": "2022-01-06T20:52:12.861Z", "agent": { - "ephemeral_id": "b4eeb540-5cc1-4878-b94d-09d0a0d440dd", - "id": "7fcefa24-63f3-457e-b11c-ccf7f1edaad6", + "ephemeral_id": "960a0fda-a7b7-4362-9018-34b1d0d119c4", + "id": "f00ff835-626e-4a18-a8a2-0bb3ebb7503f", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.0.0" }, "cisco": { "ios": { - "facility": "FOO", - "message_count": 2361044 + "facility": "SYS", + "message_count": 2360957 } }, "data_stream": { @@ -44,45 +44,43 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "7fcefa24-63f3-457e-b11c-ccf7f1edaad6", + "id": "f00ff835-626e-4a18-a8a2-0bb3ebb7503f", "snapshot": false, - "version": "8.6.2" + "version": "8.0.0" }, "event": { "agent_id_status": "verified", "category": [ "network" ], - "code": "BAR", + "code": "CONFIG_I", "dataset": "cisco_ios.log", - "ingested": "2023-06-01T11:59:13Z", - "original": "\u003c190\u003e2361044: sw01: Jan 6 2022 22:11:43.398 AEST: %FOO-6-BAR: Test date format.", + "ingested": "2023-07-13T09:20:48Z", + "original": "\u003c189\u003e2360957: Jan 6 2022 20:52:12.861: %SYS-5-CONFIG_I: Configured from console by akroh on vty0 (10.100.11.10)", "provider": "firewall", - "sequence": 2361044, - "severity": 6, - "timezone": "Australia/Sydney", + "sequence": 2360957, + "severity": 5, + "timezone": "+00:00", "type": [ "info" ] }, "input": { - "type": "log" + "type": "tcp" }, "log": { - "file": { - "path": "/tmp/service_logs/cisco-ios-timezones.log" + "level": "notification", + "source": { + "address": "172.25.0.4:46792" }, - "level": "informational", - "offset": 0, "syslog": { - "hostname": "sw01", - "priority": 190 + "priority": 189 } }, - "message": "Test date format.", + "message": "Configured from console by akroh on vty0 (10.100.11.10)", "observer": { "product": "IOS", "type": "firewall", @@ -104,6 +102,7 @@ An example event for `log` looks as following: | cisco.ios.access_list | Name of the IP access list. | keyword | | cisco.ios.action | Action taken by the device | keyword | | cisco.ios.facility | The facility to which the message refers (for example, SNMP, SYS, and so forth). A facility can be a hardware device, a protocol, or a module of the system software. It denotes the source or the cause of the system message. | keyword | +| cisco.ios.interface.name | The name of the network interface. | keyword | | cisco.ios.message_count | Message count number provided by the device when the device's service message-counter global configuration is set. | long | | cisco.ios.outcome | The result of the event | keyword | | cisco.ios.pim.group.ip | Multicast group IP | ip | @@ -132,6 +131,7 @@ An example event for `log` looks as following: | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | | destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | | destination.geo.city_name | City name. | keyword | | destination.geo.continent_name | Name of the continent. | keyword | | destination.geo.country_iso_code | Country ISO code. | keyword | @@ -148,17 +148,17 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -188,9 +188,10 @@ An example event for `log` looks as following: | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.offset | | long | | log.source.address | | keyword | -| log.syslog.hostname | Hostname parsed from syslog header. | keyword | +| log.syslog.hostname | The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector. | keyword | | log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | | network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | | network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | @@ -206,6 +207,7 @@ An example event for `log` looks as following: | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | source.as.organization.name | Organization name. | keyword | | source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.bytes | Bytes sent from the source to the destination. | long | | source.geo.city_name | City name. | keyword | | source.geo.continent_name | Name of the continent. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | diff --git a/packages/cisco_ios/kibana/tags.yml b/packages/cisco_ios/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_ios/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_ios/manifest.yml b/packages/cisco_ios/manifest.yml index c713241c013..2a68d2eda45 100644 --- a/packages/cisco_ios/manifest.yml +++ b/packages/cisco_ios/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: cisco_ios title: Cisco IOS -version: "1.16.0" +version: "1.21.0" description: Collect logs from Cisco IOS with Elastic Agent. type: integration categories: - network - security conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" icons: - src: /img/cisco.svg title: cisco @@ -30,3 +31,4 @@ policy_templates: description: Collecting logs from Cisco IOS via file owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_ise/_dev/build/build.yml b/packages/cisco_ise/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_ise/_dev/build/build.yml +++ b/packages/cisco_ise/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_ise/_dev/deploy/docker/docker-compose.yml b/packages/cisco_ise/_dev/deploy/docker/docker-compose.yml index d28a7f6a2be..a6aa39d0b79 100644 --- a/packages/cisco_ise/_dev/deploy/docker/docker-compose.yml +++ b/packages/cisco_ise/_dev/deploy/docker/docker-compose.yml @@ -1,5 +1,11 @@ version: "2.3" services: + cisco_ise-log-filestream: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" cisco_ise-log-tcp: image: docker.elastic.co/observability/stream:v0.8.0 volumes: diff --git a/packages/cisco_ise/changelog.yml b/packages/cisco_ise/changelog.yml index 11296bacaab..fde248c4676 100644 --- a/packages/cisco_ise/changelog.yml +++ b/packages/cisco_ise/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7597 +- version: "1.12.0" + changes: + - description: Add support for filestream input. + type: enhancement + link: https://github.com/elastic/integrations/pull/7394 +- version: "1.11.1" + changes: + - description: Add missing ECS field mappings + type: bugfix + link: https://github.com/elastic/integrations/pull/7269 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.10.0" changes: - description: Convert dashboard to lens. diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-ad-connector.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-ad-connector.log-expected.json index 8648168909c..9e381760bb2 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-ad-connector.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-ad-connector.log-expected.json @@ -34,7 +34,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -105,7 +105,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -178,7 +178,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -246,7 +246,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -311,7 +311,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -379,7 +379,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -444,7 +444,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -513,7 +513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -580,7 +580,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -642,7 +642,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -706,7 +706,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ad-connector", @@ -768,7 +768,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -817,7 +817,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-administrative-and-operational-audit.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-administrative-and-operational-audit.log-expected.json index 527701806d4..1680ff807ce 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-administrative-and-operational-audit.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-administrative-and-operational-audit.log-expected.json @@ -35,7 +35,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -53,7 +53,9 @@ ] }, "host": { - "ip": "81.2.69.143" + "ip": [ + "81.2.69.143" + ] }, "log": { "level": "notice", @@ -112,7 +114,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -130,7 +132,9 @@ ] }, "host": { - "ip": "81.2.69.143" + "ip": [ + "81.2.69.143" + ] }, "log": { "level": "notice", @@ -188,7 +192,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -264,7 +268,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -347,7 +351,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -431,7 +435,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -518,7 +522,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -599,7 +603,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "feedservice", @@ -659,7 +663,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "feedservice", @@ -733,7 +737,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -751,7 +755,9 @@ }, "host": { "hostname": "isehost", - "ip": "81.2.69.143" + "ip": [ + "81.2.69.143" + ] }, "log": { "level": "notice", @@ -810,7 +816,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -891,7 +897,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -968,7 +974,7 @@ "ip": "10.0.9.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap-tls", @@ -1044,7 +1050,7 @@ "ip": "10.0.9.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap-tls", @@ -1123,7 +1129,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -1141,7 +1147,9 @@ }, "host": { "hostname": "isehost", - "ip": "81.2.69.143" + "ip": [ + "81.2.69.143" + ] }, "log": { "level": "notice", @@ -1225,7 +1233,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -1307,7 +1315,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -1325,7 +1333,9 @@ }, "host": { "hostname": "isehost", - "ip": "172.16.17.255" + "ip": [ + "172.16.17.255" + ] }, "log": { "level": "notice", @@ -1399,7 +1409,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "process-management", @@ -1480,7 +1490,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -1560,7 +1570,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -1640,7 +1650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -1715,7 +1725,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -1790,7 +1800,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -1866,7 +1876,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -1942,7 +1952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -2018,7 +2028,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "administrator-login", @@ -2086,7 +2096,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -2145,7 +2155,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -2220,7 +2230,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -2327,7 +2337,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -2420,7 +2430,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -2509,7 +2519,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", @@ -2593,7 +2603,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "configuration-changes", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-authentication-flow-diagnostics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-authentication-flow-diagnostics.log-expected.json index 8a9b6c24c12..0851af92306 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-authentication-flow-diagnostics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-authentication-flow-diagnostics.log-expected.json @@ -62,7 +62,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -169,7 +169,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -274,7 +274,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication", @@ -379,7 +379,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -486,7 +486,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -591,7 +591,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -706,7 +706,7 @@ "ip": "10.0.9.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -816,7 +816,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflow", @@ -907,7 +907,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication", @@ -987,7 +987,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-failed-attempts.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-failed-attempts.log-expected.json index 76605d6ad29..5805e3175a0 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-failed-attempts.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-failed-attempts.log-expected.json @@ -83,7 +83,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-attempt", @@ -267,7 +267,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-attempt", @@ -352,7 +352,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "guest", @@ -491,7 +491,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -675,7 +675,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -1106,7 +1106,7 @@ "port": 1645 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed-attempt", @@ -1190,7 +1190,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-guest.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-guest.log-expected.json index 309155922cd..47e27b67639 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-guest.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-guest.log-expected.json @@ -45,7 +45,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "guest", @@ -134,7 +134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "guest", @@ -215,7 +215,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -265,7 +265,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -318,7 +318,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-identity-stores-diagnostics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-identity-stores-diagnostics.log-expected.json index 7c7ab6aaec8..b046afe3884 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-identity-stores-diagnostics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-identity-stores-diagnostics.log-expected.json @@ -49,7 +49,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -139,7 +139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -232,7 +232,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -327,7 +327,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -420,7 +420,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -489,7 +489,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -549,7 +549,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -609,7 +609,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -669,7 +669,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -730,7 +730,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -813,7 +813,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -904,7 +904,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -994,7 +994,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -1085,7 +1085,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "local-user-db", @@ -1179,7 +1179,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -1248,7 +1248,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "external-active-directory", @@ -1325,7 +1325,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-internal-operations-diagnostics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-internal-operations-diagnostics.log-expected.json index 35835badd80..bf211b4c029 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-internal-operations-diagnostics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-internal-operations-diagnostics.log-expected.json @@ -28,7 +28,7 @@ "port": 9025 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -87,7 +87,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "profiler", @@ -152,7 +152,7 @@ "port": 9005 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -217,7 +217,7 @@ "port": 9005 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "system-management", @@ -282,7 +282,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logging", @@ -339,7 +339,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-my-devices.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-my-devices.log-expected.json index 6a3ec4830d3..080c9f065d5 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-my-devices.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-my-devices.log-expected.json @@ -54,7 +54,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -154,7 +154,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -233,7 +233,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mydevices", @@ -304,7 +304,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log-expected.json index 9190eb80123..356343a45e7 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-passed-authentications.log-expected.json @@ -196,7 +196,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "passed-authentication", @@ -295,7 +295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "guest", @@ -455,7 +455,7 @@ "port": 1645 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "passed-authentication", @@ -539,7 +539,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -610,7 +610,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-policy-diagnostics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-policy-diagnostics.log-expected.json index 37fc5355720..1b9ee95db76 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-policy-diagnostics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-policy-diagnostics.log-expected.json @@ -41,7 +41,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -138,7 +138,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -259,7 +259,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -373,7 +373,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -467,7 +467,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -566,7 +566,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -658,7 +658,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy", @@ -744,7 +744,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-posture-client-provisioning-audit.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-posture-client-provisioning-audit.log-expected.json index c8d29ef6d93..37b8204d8d6 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-posture-client-provisioning-audit.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-posture-client-provisioning-audit.log-expected.json @@ -32,7 +32,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eps", @@ -102,7 +102,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log-expected.json index ed038e600fa..ddf370c12f5 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log-expected.json @@ -114,7 +114,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius-accounting", @@ -231,7 +231,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius-accounting", @@ -346,7 +346,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-diagnostics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-diagnostics.log-expected.json index 0882acec565..1cf9651f2e1 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-diagnostics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-diagnostics.log-expected.json @@ -58,7 +58,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -181,7 +181,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -266,7 +266,7 @@ "port": 1813 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -375,7 +375,7 @@ "port": 1813 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -496,7 +496,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -599,7 +599,7 @@ "port": 73 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -677,7 +677,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -776,7 +776,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -885,7 +885,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -984,7 +984,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -1087,7 +1087,7 @@ "port": 1813 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -1185,7 +1185,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -1300,7 +1300,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -1423,7 +1423,7 @@ "port": 72 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -1538,7 +1538,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -1653,7 +1653,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -1771,7 +1771,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -1895,7 +1895,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2019,7 +2019,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2144,7 +2144,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2263,7 +2263,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2377,7 +2377,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2496,7 +2496,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2614,7 +2614,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2732,7 +2732,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2851,7 +2851,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "eap", @@ -2964,7 +2964,7 @@ "port": 1892 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-system-statistics.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-system-statistics.log-expected.json index 0f72cf4abe6..bd90423c1e8 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-system-statistics.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-system-statistics.log-expected.json @@ -77,7 +77,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -172,7 +172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -190,7 +190,9 @@ ] }, "host": { - "ip": "81.2.69.143" + "ip": [ + "81.2.69.143" + ] }, "log": { "level": "notice", @@ -313,7 +315,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -404,7 +406,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -491,7 +493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -562,7 +564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-tacacs-accounting.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-tacacs-accounting.log-expected.json index 64a920296a0..b085cbd09a4 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-tacacs-accounting.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-tacacs-accounting.log-expected.json @@ -112,7 +112,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tacacs-accounting", @@ -263,7 +263,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tacacs-accounting", @@ -433,7 +433,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tacacs-accounting", @@ -578,7 +578,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-threat-centric-nac.log-expected.json b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-threat-centric-nac.log-expected.json index 7af29a333c6..dc405395817 100644 --- a/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-threat-centric-nac.log-expected.json +++ b/packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-threat-centric-nac.log-expected.json @@ -28,7 +28,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "irf", @@ -94,7 +94,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "irf", @@ -153,7 +153,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "radius", @@ -210,7 +210,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_ise/data_stream/log/_dev/test/system/test-filestream-config.yml b/packages/cisco_ise/data_stream/log/_dev/test/system/test-filestream-config.yml new file mode 100644 index 00000000000..ab621b50029 --- /dev/null +++ b/packages/cisco_ise/data_stream/log/_dev/test/system/test-filestream-config.yml @@ -0,0 +1,8 @@ +service: cisco_ise-log-filestream +input: filestream +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true + paths: + - '{{SERVICE_LOGS_DIR}}/*.log' diff --git a/packages/cisco_ise/data_stream/log/agent/stream/filestream.yml.hbs b/packages/cisco_ise/data_stream/log/agent/stream/filestream.yml.hbs new file mode 100644 index 00000000000..9fcdf9bb7ac --- /dev/null +++ b/packages/cisco_ise/data_stream/log/agent/stream/filestream.yml.hbs @@ -0,0 +1,19 @@ +paths: +{{#each paths as |path|}} +- {{path}} +{{/each}} +prospector.scanner.exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 733030c6999..fc8b07cb4b2 100644 --- a/packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Cisco ISE logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -123,6 +123,10 @@ processors: - pipeline: name: '{{ IngestPipeline "pipeline_identity_stores_diagnostics" }}' if: ctx.cisco_ise?.log?.category?.name == "CISE_Identity_Stores_Diagnostics" + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - convert: field: cisco_ise.log.log_details.ConfigVersionId target_field: cisco_ise.log.config_version.id diff --git a/packages/cisco_ise/data_stream/log/fields/ecs.yml b/packages/cisco_ise/data_stream/log/fields/ecs.yml index ff71e50dacf..6a5d79b5731 100644 --- a/packages/cisco_ise/data_stream/log/fields/ecs.yml +++ b/packages/cisco_ise/data_stream/log/fields/ecs.yml @@ -1,13 +1,75 @@ +- external: ecs + name: client.geo.city_name +- external: ecs + name: client.geo.continent_code +- external: ecs + name: client.geo.continent_name +- external: ecs + name: client.geo.country_iso_code +- external: ecs + name: client.geo.country_name +- external: ecs + name: client.geo.location +- external: ecs + name: client.geo.name +- external: ecs + name: client.geo.postal_code +- external: ecs + name: client.geo.region_iso_code +- external: ecs + name: client.geo.region_name +- external: ecs + name: client.geo.timezone - external: ecs name: client.ip - external: ecs name: client.port - external: ecs name: client.user.name +- external: ecs + name: destination.address +- external: ecs + name: destination.as.number +- external: ecs + name: destination.as.organization.name +- external: ecs + name: destination.bytes +- external: ecs + name: destination.domain +- external: ecs + name: destination.geo.city_name +- external: ecs + name: destination.geo.continent_code +- external: ecs + name: destination.geo.continent_name +- external: ecs + name: destination.geo.country_iso_code +- external: ecs + name: destination.geo.country_name +- external: ecs + name: destination.geo.location +- external: ecs + name: destination.geo.name +- external: ecs + name: destination.geo.postal_code +- external: ecs + name: destination.geo.region_iso_code +- external: ecs + name: destination.geo.region_name +- external: ecs + name: destination.geo.timezone - external: ecs name: destination.ip +- external: ecs + name: destination.nat.ip +- external: ecs + name: destination.nat.port +- external: ecs + name: destination.packets - external: ecs name: destination.port +- external: ecs + name: destination.user.name - external: ecs name: ecs.version - external: ecs @@ -22,10 +84,34 @@ name: event.sequence - external: ecs name: event.type +- external: ecs + name: host.geo.city_name +- external: ecs + name: host.geo.continent_code +- external: ecs + name: host.geo.continent_name +- external: ecs + name: host.geo.country_iso_code +- external: ecs + name: host.geo.country_name +- external: ecs + name: host.geo.location +- external: ecs + name: host.geo.name +- external: ecs + name: host.geo.postal_code +- external: ecs + name: host.geo.region_iso_code +- external: ecs + name: host.geo.region_name +- external: ecs + name: host.geo.timezone - external: ecs name: host.hostname - external: ecs name: host.ip +- external: ecs + name: log.file.path - external: ecs name: log.level - external: ecs @@ -46,8 +132,52 @@ name: related.user - external: ecs name: service.type +- external: ecs + name: source.address +- external: ecs + name: source.as.number +- external: ecs + name: source.as.organization.name +- external: ecs + name: source.bytes +- external: ecs + name: source.domain +- external: ecs + name: source.geo.city_name +- external: ecs + name: source.geo.continent_code +- external: ecs + name: source.geo.continent_name +- external: ecs + name: source.geo.country_iso_code +- external: ecs + name: source.geo.country_name +- external: ecs + name: source.geo.location +- external: ecs + name: source.geo.name +- external: ecs + name: source.geo.postal_code +- external: ecs + name: source.geo.region_iso_code +- external: ecs + name: source.geo.region_name +- external: ecs + name: source.geo.timezone - external: ecs name: source.ip +- external: ecs + name: source.nat.ip +- external: ecs + name: source.nat.port +- external: ecs + name: source.packets +- external: ecs + name: source.port +- external: ecs + name: source.user.name +- external: ecs + name: source.user.group.name - external: ecs name: tags - external: ecs diff --git a/packages/cisco_ise/data_stream/log/manifest.yml b/packages/cisco_ise/data_stream/log/manifest.yml index d4378868946..64484360d6b 100644 --- a/packages/cisco_ise/data_stream/log/manifest.yml +++ b/packages/cisco_ise/data_stream/log/manifest.yml @@ -72,3 +72,41 @@ streams: show_user: false description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: filestream + template_path: filestream.yml.hbs + title: Cisco_ISE logs + description: Collect Cisco ISE logs via TCP input. + vars: + - name: paths + title: Paths + type: text + required: true + show_user: true + multi: true + default: + - /var/log/cisco_ise* + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - cisco_ise-log + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/cisco_ise/data_stream/log/sample_event.json b/packages/cisco_ise/data_stream/log/sample_event.json index 6afac451a23..7e470891c43 100644 --- a/packages/cisco_ise/data_stream/log/sample_event.json +++ b/packages/cisco_ise/data_stream/log/sample_event.json @@ -1,160 +1,164 @@ { - "@timestamp": "2020-02-21T19:13:08.328Z", + "@timestamp": "2020-04-27T11:11:47.028-08:00", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "86f518cd-51e3-4798-9fa5-e8947dc5d209", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "cisco_ise": { "log": { "acct": { - "request": { - "flags": "Stop" + "authentic": "RADIUS", + "session": { + "id": "00000000/d4:ca:6d:14:87:3b/20879" + }, + "status": { + "type": "Start" } }, "acs": { "session": { - "id": "ldnnacpsn1/359344348/952729" + "id": "hijk.xyz.com/176956368/1092777" + } + }, + "airespace": { + "wlan": { + "id": 1 } }, - "authen_method": "TacacsPlus", - "avpair": { - "priv_lvl": 15, - "start_time": "2020-03-26T01:17:12.000Z", - "task_id": "2962", - "timezone": "GMT" + "allowed_protocol": { + "matched": { + "rule": "Default" + } + }, + "called_station": { + "id": "00-24-97-69-7a-c0" + }, + "calling_station": { + "id": "d4-ca-6d-14-87-3b" }, "category": { - "name": "CISE_TACACS_Accounting" + "name": "CISE_RADIUS_Accounting" }, - "cmdset": "[ CmdAV=show mac-address-table \u003ccr\u003e ]", + "class": "CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772", "config_version": { - "id": 1829 + "id": 33 }, "cpm": { "session": { - "id": "81.2.69.144Accounting306034364" + "id": "0a222bc0000000d123e111f0" } }, - "device": { - "type": [ - "Device Type#All Device Types#Routers", - "Device Type#All Device Types#Routers" - ] + "event": { + "timestamp": "2014-01-10T07:59:55.000Z" }, - "ipsec": [ - "IPSEC#Is IPSEC Device", - "IPSEC#Is IPSEC Device" - ], - "location": [ - "Location#All Locations#EMEA", - "Location#All Locations#EMEA" - ], - "message": { - "code": "3300", - "description": "Tacacs-Accounting: TACACS+ Accounting with Command", - "id": "0000000001" + "framed": { + "ip": "81.2.69.145" }, - "model": { - "name": "Unknown" + "location": "Location#All Locations#SJC#WNBU", + "message": { + "code": "3000", + "description": "Radius-Accounting: RADIUS Accounting start request", + "id": "0000070618" + }, + "nas": { + "identifier": "Acme_fe:56:00", + "ip": "81.2.69.145", + "port": { + "number": 13, + "type": "Wireless - IEEE 802.11" + } }, "network": { "device": { "groups": [ - "Location#All Locations#EMEA", - "Device Type#All Device Types#Routers", - "IPSEC#Is IPSEC Device" + "Location#All Locations#SJC#WNBU", + "Device Type#All Device Types#Wireless#WLC" ], - "name": "wlnwan1", - "profile": [ - "Cisco", - "Cisco" - ] + "name": "WNBU-WLC1" } }, - "port": "tty10", - "privilege": { - "level": 15 - }, "request": { - "latency": 1 - }, - "response": { - "AcctReply-Status": "Success" + "latency": 6 }, "segment": { "number": 0, - "total": 4 + "total": 1 }, "selected": { "access": { - "service": "Device Admin - TACACS" + "service": "Default Network Access" } }, - "service": { - "argument": "shell", - "name": "Login" - }, - "software": { - "version": "Unknown" - }, "step": [ - "13006", + "11004", + "11017", "15049", "15008", "15048", - "13035" + "15048", + "15048", + "15004", + "15006", + "11005" ], - "type": "Accounting" + "tunnel": { + "medium": { + "type": "(tag=0) 802" + }, + "private": { + "group_id": "(tag=0) 70" + }, + "type": "(tag=0) VLAN" + } } }, "client": { - "ip": "81.2.69.144" + "ip": "81.2.69.145" }, "data_stream": { "dataset": "cisco_ise.log", "namespace": "ep", "type": "logs" }, - "destination": { - "ip": "81.2.69.144" - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "action": "tacacs-accounting", + "action": "radius-accounting", "agent_id_status": "verified", "category": [ "configuration" ], "dataset": "cisco_ise.log", - "ingested": "2023-01-13T12:14:37Z", + "ingested": "2023-08-29T17:11:24Z", "kind": "event", - "sequence": 18415781, - "timezone": "+00:00", + "original": "\u003c182\u003eApr 27 11:11:47 hijk.xyz.com CISE_RADIUS_Accounting 0000070618 1 0 2020-04-27 11:11:47.028075 -08:00 0091827141 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=33, Device IP Address=81.2.69.145, RequestLatency=6, NetworkDeviceName=WNBU-WLC1, User-Name=nisehorrrrn, NAS-IP-Address=81.2.69.145, NAS-Port=13, Framed-IP-Address=81.2.69.145, Class=CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772, Called-Station-ID=00-24-97-69-7a-c0, Calling-Station-ID=d4-ca-6d-14-87-3b, NAS-Identifier=Acme_fe:56:00, Acct-Status-Type=Start, Acct-Session-Id=00000000/d4:ca:6d:14:87:3b/20879, Acct-Authentic=RADIUS, Event-Timestamp=1389340795, NAS-Port-Type=Wireless - IEEE 802.11, Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) 70, Airespace-Wlan-Id=1, AcsSessionID=hijk.xyz.com/176956368/1092777, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=15006, Step=11005, NetworkDeviceGroups=Location#All Locations#SJC#WNBU, NetworkDeviceGroups=Device Type#All Device Types#Wireless#WLC, CPMSessionID=0a222bc0000000d123e111f0, AllowedProtocolMatchedRule=Default, Location=Location#All Locations#SJC#WNBU, Device Type=Device Type#All Device Types#Wireless#WLC", + "sequence": 91827141, + "timezone": "-08:00", "type": [ "info" ] }, "host": { - "hostname": "cisco-ise-host" + "hostname": "hijk.xyz.com" }, "input": { - "type": "udp" + "type": "filestream" }, "log": { - "level": "notice", - "source": { - "address": "172.27.0.4:59237" + "file": { + "path": "/tmp/service_logs/log.log" }, + "level": "notice", + "offset": 44899, "syslog": { "priority": 182, "severity": { @@ -162,23 +166,24 @@ } } }, - "message": "2020-02-21 19:13:08.328 +00:00 0018415781 3300 NOTICE Tacacs-Accounting: TACACS+ Accounting with Command, ConfigVersionId=1829, Device IP Address=81.2.69.144, CmdSet=[ CmdAV=show mac-address-table \u003ccr\u003e ], RequestLatency=1, NetworkDeviceName=wlnwan1, Type=Accounting, Privilege-Level=15, Service=Login, User=psxvne, Port=tty10, Remote-Address=81.2.69.144, Authen-Method=TacacsPlus, AVPair=task_id=2962, AVPair=timezone=GMT, AVPair=start_time=1585185432, AVPair=priv-lvl=15, AcctRequest-Flags=Stop, Service-Argument=shell, AcsSessionID=ldnnacpsn1/359344348/952729, SelectedAccessService=Device Admin - TACACS, Step=13006, Step=15049, Step=15008, Step=15048, Step=13035, NetworkDeviceGroups=Location#All Locations#EMEA, NetworkDeviceGroups=Device Type#All Device Types#Routers, NetworkDeviceGroups=IPSEC#Is IPSEC Device, CPMSessionID=81.2.69.144Accounting306034364, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }", + "message": "2020-04-27 11:11:47.028075 -08:00 0091827141 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=33, Device IP Address=81.2.69.145, RequestLatency=6, NetworkDeviceName=WNBU-WLC1, User-Name=nisehorrrrn, NAS-IP-Address=81.2.69.145, NAS-Port=13, Framed-IP-Address=81.2.69.145, Class=CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772, Called-Station-ID=00-24-97-69-7a-c0, Calling-Station-ID=d4-ca-6d-14-87-3b, NAS-Identifier=Acme_fe:56:00, Acct-Status-Type=Start, Acct-Session-Id=00000000/d4:ca:6d:14:87:3b/20879, Acct-Authentic=RADIUS, Event-Timestamp=1389340795, NAS-Port-Type=Wireless - IEEE 802.11, Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) 70, Airespace-Wlan-Id=1, AcsSessionID=hijk.xyz.com/176956368/1092777, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=15006, Step=11005, NetworkDeviceGroups=Location#All Locations#SJC#WNBU, NetworkDeviceGroups=Device Type#All Device Types#Wireless#WLC, CPMSessionID=0a222bc0000000d123e111f0, AllowedProtocolMatchedRule=Default, Location=Location#All Locations#SJC#WNBU, Device Type=Device Type#All Device Types#Wireless#WLC", "related": { "hosts": [ - "cisco-ise-host" + "hijk.xyz.com" ], "ip": [ - "81.2.69.144" + "81.2.69.145" ], "user": [ - "psxvne" + "nisehorrrrn" ] }, "tags": [ + "preserve_original_event", "forwarded", "cisco_ise-log" ], "user": { - "name": "psxvne" + "name": "nisehorrrrn" } } \ No newline at end of file diff --git a/packages/cisco_ise/docs/README.md b/packages/cisco_ise/docs/README.md index 12f8bed9608..f68ff3a5c1c 100644 --- a/packages/cisco_ise/docs/README.md +++ b/packages/cisco_ise/docs/README.md @@ -35,162 +35,166 @@ An example event for `log` looks as following: ```json { - "@timestamp": "2020-02-21T19:13:08.328Z", + "@timestamp": "2020-04-27T11:11:47.028-08:00", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "86f518cd-51e3-4798-9fa5-e8947dc5d209", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "cisco_ise": { "log": { "acct": { - "request": { - "flags": "Stop" + "authentic": "RADIUS", + "session": { + "id": "00000000/d4:ca:6d:14:87:3b/20879" + }, + "status": { + "type": "Start" } }, "acs": { "session": { - "id": "ldnnacpsn1/359344348/952729" + "id": "hijk.xyz.com/176956368/1092777" + } + }, + "airespace": { + "wlan": { + "id": 1 + } + }, + "allowed_protocol": { + "matched": { + "rule": "Default" } }, - "authen_method": "TacacsPlus", - "avpair": { - "priv_lvl": 15, - "start_time": "2020-03-26T01:17:12.000Z", - "task_id": "2962", - "timezone": "GMT" + "called_station": { + "id": "00-24-97-69-7a-c0" + }, + "calling_station": { + "id": "d4-ca-6d-14-87-3b" }, "category": { - "name": "CISE_TACACS_Accounting" + "name": "CISE_RADIUS_Accounting" }, - "cmdset": "[ CmdAV=show mac-address-table \u003ccr\u003e ]", + "class": "CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772", "config_version": { - "id": 1829 + "id": 33 }, "cpm": { "session": { - "id": "81.2.69.144Accounting306034364" + "id": "0a222bc0000000d123e111f0" } }, - "device": { - "type": [ - "Device Type#All Device Types#Routers", - "Device Type#All Device Types#Routers" - ] + "event": { + "timestamp": "2014-01-10T07:59:55.000Z" }, - "ipsec": [ - "IPSEC#Is IPSEC Device", - "IPSEC#Is IPSEC Device" - ], - "location": [ - "Location#All Locations#EMEA", - "Location#All Locations#EMEA" - ], + "framed": { + "ip": "81.2.69.145" + }, + "location": "Location#All Locations#SJC#WNBU", "message": { - "code": "3300", - "description": "Tacacs-Accounting: TACACS+ Accounting with Command", - "id": "0000000001" + "code": "3000", + "description": "Radius-Accounting: RADIUS Accounting start request", + "id": "0000070618" }, - "model": { - "name": "Unknown" + "nas": { + "identifier": "Acme_fe:56:00", + "ip": "81.2.69.145", + "port": { + "number": 13, + "type": "Wireless - IEEE 802.11" + } }, "network": { "device": { "groups": [ - "Location#All Locations#EMEA", - "Device Type#All Device Types#Routers", - "IPSEC#Is IPSEC Device" + "Location#All Locations#SJC#WNBU", + "Device Type#All Device Types#Wireless#WLC" ], - "name": "wlnwan1", - "profile": [ - "Cisco", - "Cisco" - ] + "name": "WNBU-WLC1" } }, - "port": "tty10", - "privilege": { - "level": 15 - }, "request": { - "latency": 1 - }, - "response": { - "AcctReply-Status": "Success" + "latency": 6 }, "segment": { "number": 0, - "total": 4 + "total": 1 }, "selected": { "access": { - "service": "Device Admin - TACACS" + "service": "Default Network Access" } }, - "service": { - "argument": "shell", - "name": "Login" - }, - "software": { - "version": "Unknown" - }, "step": [ - "13006", + "11004", + "11017", "15049", "15008", "15048", - "13035" + "15048", + "15048", + "15004", + "15006", + "11005" ], - "type": "Accounting" + "tunnel": { + "medium": { + "type": "(tag=0) 802" + }, + "private": { + "group_id": "(tag=0) 70" + }, + "type": "(tag=0) VLAN" + } } }, "client": { - "ip": "81.2.69.144" + "ip": "81.2.69.145" }, "data_stream": { "dataset": "cisco_ise.log", "namespace": "ep", "type": "logs" }, - "destination": { - "ip": "81.2.69.144" - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "action": "tacacs-accounting", + "action": "radius-accounting", "agent_id_status": "verified", "category": [ "configuration" ], "dataset": "cisco_ise.log", - "ingested": "2023-01-13T12:14:37Z", + "ingested": "2023-08-29T17:11:24Z", "kind": "event", - "sequence": 18415781, - "timezone": "+00:00", + "original": "\u003c182\u003eApr 27 11:11:47 hijk.xyz.com CISE_RADIUS_Accounting 0000070618 1 0 2020-04-27 11:11:47.028075 -08:00 0091827141 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=33, Device IP Address=81.2.69.145, RequestLatency=6, NetworkDeviceName=WNBU-WLC1, User-Name=nisehorrrrn, NAS-IP-Address=81.2.69.145, NAS-Port=13, Framed-IP-Address=81.2.69.145, Class=CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772, Called-Station-ID=00-24-97-69-7a-c0, Calling-Station-ID=d4-ca-6d-14-87-3b, NAS-Identifier=Acme_fe:56:00, Acct-Status-Type=Start, Acct-Session-Id=00000000/d4:ca:6d:14:87:3b/20879, Acct-Authentic=RADIUS, Event-Timestamp=1389340795, NAS-Port-Type=Wireless - IEEE 802.11, Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) 70, Airespace-Wlan-Id=1, AcsSessionID=hijk.xyz.com/176956368/1092777, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=15006, Step=11005, NetworkDeviceGroups=Location#All Locations#SJC#WNBU, NetworkDeviceGroups=Device Type#All Device Types#Wireless#WLC, CPMSessionID=0a222bc0000000d123e111f0, AllowedProtocolMatchedRule=Default, Location=Location#All Locations#SJC#WNBU, Device Type=Device Type#All Device Types#Wireless#WLC", + "sequence": 91827141, + "timezone": "-08:00", "type": [ "info" ] }, "host": { - "hostname": "cisco-ise-host" + "hostname": "hijk.xyz.com" }, "input": { - "type": "udp" + "type": "filestream" }, "log": { - "level": "notice", - "source": { - "address": "172.27.0.4:59237" + "file": { + "path": "/tmp/service_logs/log.log" }, + "level": "notice", + "offset": 44899, "syslog": { "priority": 182, "severity": { @@ -198,24 +202,25 @@ An example event for `log` looks as following: } } }, - "message": "2020-02-21 19:13:08.328 +00:00 0018415781 3300 NOTICE Tacacs-Accounting: TACACS+ Accounting with Command, ConfigVersionId=1829, Device IP Address=81.2.69.144, CmdSet=[ CmdAV=show mac-address-table \u003ccr\u003e ], RequestLatency=1, NetworkDeviceName=wlnwan1, Type=Accounting, Privilege-Level=15, Service=Login, User=psxvne, Port=tty10, Remote-Address=81.2.69.144, Authen-Method=TacacsPlus, AVPair=task_id=2962, AVPair=timezone=GMT, AVPair=start_time=1585185432, AVPair=priv-lvl=15, AcctRequest-Flags=Stop, Service-Argument=shell, AcsSessionID=ldnnacpsn1/359344348/952729, SelectedAccessService=Device Admin - TACACS, Step=13006, Step=15049, Step=15008, Step=15048, Step=13035, NetworkDeviceGroups=Location#All Locations#EMEA, NetworkDeviceGroups=Device Type#All Device Types#Routers, NetworkDeviceGroups=IPSEC#Is IPSEC Device, CPMSessionID=81.2.69.144Accounting306034364, Model Name=Unknown, Software Version=Unknown, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }, Network Device Profile=Cisco, Location=Location#All Locations#EMEA, Device Type=Device Type#All Device Types#Routers, IPSEC=IPSEC#Is IPSEC Device, Response={AcctReply-Status=Success; }", + "message": "2020-04-27 11:11:47.028075 -08:00 0091827141 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=33, Device IP Address=81.2.69.145, RequestLatency=6, NetworkDeviceName=WNBU-WLC1, User-Name=nisehorrrrn, NAS-IP-Address=81.2.69.145, NAS-Port=13, Framed-IP-Address=81.2.69.145, Class=CACS:0a2025060001794f52cfa877:hijk.xyz.com/176956368/1092772, Called-Station-ID=00-24-97-69-7a-c0, Calling-Station-ID=d4-ca-6d-14-87-3b, NAS-Identifier=Acme_fe:56:00, Acct-Status-Type=Start, Acct-Session-Id=00000000/d4:ca:6d:14:87:3b/20879, Acct-Authentic=RADIUS, Event-Timestamp=1389340795, NAS-Port-Type=Wireless - IEEE 802.11, Tunnel-Type=(tag=0) VLAN, Tunnel-Medium-Type=(tag=0) 802, Tunnel-Private-Group-ID=(tag=0) 70, Airespace-Wlan-Id=1, AcsSessionID=hijk.xyz.com/176956368/1092777, SelectedAccessService=Default Network Access, Step=11004, Step=11017, Step=15049, Step=15008, Step=15048, Step=15048, Step=15048, Step=15004, Step=15006, Step=11005, NetworkDeviceGroups=Location#All Locations#SJC#WNBU, NetworkDeviceGroups=Device Type#All Device Types#Wireless#WLC, CPMSessionID=0a222bc0000000d123e111f0, AllowedProtocolMatchedRule=Default, Location=Location#All Locations#SJC#WNBU, Device Type=Device Type#All Device Types#Wireless#WLC", "related": { "hosts": [ - "cisco-ise-host" + "hijk.xyz.com" ], "ip": [ - "81.2.69.144" + "81.2.69.145" ], "user": [ - "psxvne" + "nisehorrrrn" ] }, "tags": [ + "preserve_original_event", "forwarded", "cisco_ise-log" ], "user": { - "name": "psxvne" + "name": "nisehorrrrn" } } ``` @@ -434,6 +439,17 @@ An example event for `log` looks as following: | cisco_ise.log.usecase | | keyword | | cisco_ise.log.user.type | | keyword | | cisco_ise.log.workflow | | flattened | +| client.geo.city_name | City name. | keyword | +| client.geo.continent_code | Two-letter code representing continent's name. | keyword | +| client.geo.continent_name | Name of the continent. | keyword | +| client.geo.country_iso_code | Country ISO code. | keyword | +| client.geo.country_name | Country name. | keyword | +| client.geo.location | Longitude and latitude. | geo_point | +| client.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| client.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| client.geo.region_iso_code | Region ISO code. | keyword | +| client.geo.region_name | Region name. | keyword | +| client.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | client.ip | IP address of the client (IPv4 or IPv6). | ip | | client.port | Port of the client. | long | | client.user.name | Short name or login of the user. | keyword | @@ -454,13 +470,35 @@ An example event for `log` looks as following: | data_stream.dataset | Data stream dataset. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | +| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| destination.as.organization.name | Organization name. | keyword | +| destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | +| destination.bytes | Bytes sent from the destination to the source. | long | +| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| destination.geo.city_name | City name. | keyword | +| destination.geo.continent_code | Two-letter code representing continent's name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | +| destination.geo.country_name | Country name. | keyword | +| destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | +| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | +| destination.packets | Packets sent from the destination to the source. | long | | destination.port | Port of the destination. | long | +| destination.user.name | Short name or login of the user. | keyword | +| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | @@ -468,6 +506,17 @@ An example event for `log` looks as following: | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.geo.city_name | City name. | keyword | +| host.geo.continent_code | Two-letter code representing continent's name. | keyword | +| host.geo.continent_name | Name of the continent. | keyword | +| host.geo.country_iso_code | Country ISO code. | keyword | +| host.geo.country_name | Country name. | keyword | +| host.geo.location | Longitude and latitude. | geo_point | +| host.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| host.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| host.geo.region_iso_code | Region ISO code. | keyword | +| host.geo.region_name | Region name. | keyword | +| host.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | host.ip | Host ip addresses. | ip | @@ -483,6 +532,7 @@ An example event for `log` looks as following: | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | input.type | Input type | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.logger | The name of the logger inside an application. This is usually the name of the class which initialized the logger, or can be a custom name. | keyword | | log.offset | Log offset | long | @@ -495,7 +545,31 @@ An example event for `log` looks as following: | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| source.as.organization.name | Organization name. | keyword | +| source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | +| source.bytes | Bytes sent from the source to the destination. | long | +| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | +| source.geo.city_name | City name. | keyword | +| source.geo.continent_code | Two-letter code representing continent's name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | +| source.geo.country_name | Country name. | keyword | +| source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | +| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | +| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | +| source.packets | Packets sent from the source to the destination. | long | +| source.port | Port of the source. | long | +| source.user.group.name | Name of the group. | keyword | +| source.user.name | Short name or login of the user. | keyword | +| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | | tags | List of keywords used to tag each event. | keyword | | user.full_name | User's full name, if available. | keyword | | user.full_name.text | Multi-field of `user.full_name`. | match_only_text | diff --git a/packages/cisco_ise/kibana/tags.yml b/packages/cisco_ise/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_ise/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_ise/manifest.yml b/packages/cisco_ise/manifest.yml index ad410853a85..db8e130eb07 100644 --- a/packages/cisco_ise/manifest.yml +++ b/packages/cisco_ise/manifest.yml @@ -1,16 +1,15 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: cisco_ise title: Cisco ISE -version: "1.10.0" -license: basic +version: "1.15.0" description: Collect logs from Cisco ISE with Elastic Agent. type: integration categories: - security - network -release: ga conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/cisco-ise-screenshot.png title: Cisco ISE dashboard screenshot @@ -95,5 +94,9 @@ policy_templates: required: true show_user: true default: 9026 + - type: filestream + title: Collect Cisco ISE logs using filestream input + description: Collecting Cisco ISE logs using filestream input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_meraki/_dev/build/build.yml b/packages/cisco_meraki/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_meraki/_dev/build/build.yml +++ b/packages/cisco_meraki/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_meraki/changelog.yml b/packages/cisco_meraki/changelog.yml index 648c79f6358..044b5d47e48 100644 --- a/packages/cisco_meraki/changelog.yml +++ b/packages/cisco_meraki/changelog.yml @@ -1,4 +1,30 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Handle blocked ARP packet messages. + type: enhancement + link: https://github.com/elastic/integrations/pull/7771 + - description: Handle auth event subtype. + type: enhancement + link: https://github.com/elastic/integrations/pull/7771 + - description: Handle port event subtype. + type: enhancement + link: https://github.com/elastic/integrations/pull/7771 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.1" + changes: + - description: Fix flows pipeline according to new Firmware MX18.101. + type: bugfix + link: https://github.com/elastic/integrations/pull/7391 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json index c1280f9d04a..222b141a6ae 100644 --- a/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json +++ b/packages/cisco_meraki/data_stream/events/_dev/test/pipeline/test-mx-events.json-expected.json @@ -27,7 +27,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cellular came up", @@ -79,7 +79,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Insight Alert", @@ -137,7 +137,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Failover event detected", diff --git a/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml index b5392d174b5..bc3a058698a 100644 --- a/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_meraki/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Cisco Meraki events processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.serial_number copy_from: json.deviceSerial diff --git a/packages/cisco_meraki/data_stream/events/sample_event.json b/packages/cisco_meraki/data_stream/events/sample_event.json index 9f07808081c..c644d1d2cfe 100644 --- a/packages/cisco_meraki/data_stream/events/sample_event.json +++ b/packages/cisco_meraki/data_stream/events/sample_event.json @@ -37,7 +37,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "878982e9-a174-4ed8-abe3-19378c1473de", diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json index b4123c20ebc..522b9da69b0 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-airmarshal-events.log-expected.json @@ -14,7 +14,7 @@ "mac": "6A-3A-3E-85-D9-F6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -61,7 +61,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -108,7 +108,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -156,7 +156,7 @@ "mac": "E2-CB-9C-B5-DD-BE" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -198,7 +198,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -245,7 +245,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -293,7 +293,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -340,7 +340,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -387,7 +387,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -435,7 +435,7 @@ "mac": "AE-17-E8-C7-DF-FD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -477,7 +477,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -524,7 +524,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -571,7 +571,7 @@ "mac": "6A-3A-3E-85-D9-F6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -619,7 +619,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -666,7 +666,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -713,7 +713,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -760,7 +760,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -807,7 +807,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -854,7 +854,7 @@ "mac": "78-55-CD-18-8F-76" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -903,7 +903,7 @@ "mac": "78-28-CA-AA-6A-4A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -945,7 +945,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -992,7 +992,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1040,7 +1040,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1088,7 +1088,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1136,7 +1136,7 @@ "mac": "AE-17-E8-C7-D8-51" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1183,7 +1183,7 @@ "mac": "E2-CB-9C-B5-D4-1E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1231,7 +1231,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1278,7 +1278,7 @@ "mac": "5C-AA-FD-5D-76-0E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1326,7 +1326,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1374,7 +1374,7 @@ "mac": "78-28-CA-AA-6A-0A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -1416,7 +1416,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1463,7 +1463,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1510,7 +1510,7 @@ "mac": "0E-8D-FB-70-0F-A8" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1557,7 +1557,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1605,7 +1605,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1653,7 +1653,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -1695,7 +1695,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1742,7 +1742,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1789,7 +1789,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1836,7 +1836,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1883,7 +1883,7 @@ "mac": "E2-CB-9C-B5-DC-6E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1930,7 +1930,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -1977,7 +1977,7 @@ "mac": "6A-3A-3E-85-CA-4E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2025,7 +2025,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2072,7 +2072,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2120,7 +2120,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -2163,7 +2163,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -2205,7 +2205,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2252,7 +2252,7 @@ "mac": "6A-3A-3E-85-D7-D4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2299,7 +2299,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2346,7 +2346,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2393,7 +2393,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2440,7 +2440,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2488,7 +2488,7 @@ "mac": "90-AC-3F-02-31-59" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -2530,7 +2530,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2577,7 +2577,7 @@ "mac": "78-28-CA-AA-6A-4A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2625,7 +2625,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2672,7 +2672,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2719,7 +2719,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2767,7 +2767,7 @@ "mac": "08-A7-C0-3B-5A-95" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -2809,7 +2809,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2857,7 +2857,7 @@ "mac": "78-28-CA-AA-69-96" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2905,7 +2905,7 @@ "mac": "AE-17-E8-C7-E2-9D" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -2953,7 +2953,7 @@ "mac": "E2-CB-9C-B5-DC-6E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3000,7 +3000,7 @@ "mac": "AE-17-E8-C7-DF-FD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3047,7 +3047,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3094,7 +3094,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3142,7 +3142,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3189,7 +3189,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3236,7 +3236,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3284,7 +3284,7 @@ "mac": "6E-DA-36-A2-39-71" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -3326,7 +3326,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3373,7 +3373,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3420,7 +3420,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3468,7 +3468,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3516,7 +3516,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3565,7 +3565,7 @@ "mac": "78-28-CA-AA-6A-4A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -3607,7 +3607,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3654,7 +3654,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3701,7 +3701,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3748,7 +3748,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3795,7 +3795,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3842,7 +3842,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3889,7 +3889,7 @@ "mac": "5C-AA-FD-5D-76-0E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3937,7 +3937,7 @@ "mac": "E2-CB-9C-B5-DC-6E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -3984,7 +3984,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4031,7 +4031,7 @@ "mac": "E2-CB-9C-B5-DA-7A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4079,7 +4079,7 @@ "mac": "E2-CB-9C-B5-DA-7A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4127,7 +4127,7 @@ "mac": "6A-3A-3E-85-D7-D4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4175,7 +4175,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4223,7 +4223,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4270,7 +4270,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4317,7 +4317,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4364,7 +4364,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4412,7 +4412,7 @@ "mac": "AE-17-E8-C7-DF-FD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -4454,7 +4454,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4501,7 +4501,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4549,7 +4549,7 @@ "mac": "78-28-CA-AA-6A-0A" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -4591,7 +4591,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4638,7 +4638,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4686,7 +4686,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4734,7 +4734,7 @@ "mac": "EE-CE-D5-6A-B6-22" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -4776,7 +4776,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4823,7 +4823,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4870,7 +4870,7 @@ "mac": "6A-3A-3E-85-D7-D4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -4919,7 +4919,7 @@ "mac": "AE-17-E8-C7-E1-41" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -4961,7 +4961,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5009,7 +5009,7 @@ "mac": "78-28-CA-AA-69-96" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -5051,7 +5051,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5098,7 +5098,7 @@ "mac": "E2-CB-9C-B5-D7-80" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5145,7 +5145,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5192,7 +5192,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5239,7 +5239,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5286,7 +5286,7 @@ "mac": "E2-CB-9C-B5-DD-BE" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5333,7 +5333,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5380,7 +5380,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5428,7 +5428,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5475,7 +5475,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5523,7 +5523,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5570,7 +5570,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5617,7 +5617,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5664,7 +5664,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5711,7 +5711,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5758,7 +5758,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5805,7 +5805,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5852,7 +5852,7 @@ "mac": "E2-CB-9C-B5-C5-68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5899,7 +5899,7 @@ "mac": "E2-CB-9C-B5-D8-54" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5946,7 +5946,7 @@ "mac": "6A-3A-3E-85-CA-4E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -5994,7 +5994,7 @@ "mac": "34-8F-27-25-CC-48" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssid-spoofing-detected", @@ -6036,7 +6036,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6083,7 +6083,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6130,7 +6130,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6177,7 +6177,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6224,7 +6224,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6271,7 +6271,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6318,7 +6318,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6366,7 +6366,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6413,7 +6413,7 @@ "mac": "E2-CB-9C-B5-DD-BE" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6460,7 +6460,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6507,7 +6507,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6554,7 +6554,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6601,7 +6601,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6649,7 +6649,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6696,7 +6696,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6743,7 +6743,7 @@ "mac": "6A-3A-3E-85-CA-4E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6790,7 +6790,7 @@ "mac": "AE-17-E8-C7-DF-FD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6837,7 +6837,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6884,7 +6884,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6931,7 +6931,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -6978,7 +6978,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7025,7 +7025,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7072,7 +7072,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7120,7 +7120,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7168,7 +7168,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7216,7 +7216,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7264,7 +7264,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7311,7 +7311,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7358,7 +7358,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7405,7 +7405,7 @@ "mac": "AE-17-E8-C7-D8-51" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7452,7 +7452,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7499,7 +7499,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7546,7 +7546,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7594,7 +7594,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7642,7 +7642,7 @@ "mac": "E2-CB-9C-B5-D4-1E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7689,7 +7689,7 @@ "mac": "AE-17-E8-C7-DF-FD" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7736,7 +7736,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7783,7 +7783,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7830,7 +7830,7 @@ "mac": "38-BA-F8-CC-82-2E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7878,7 +7878,7 @@ "mac": "38-BA-F8-CC-82-2E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7926,7 +7926,7 @@ "mac": "38-BA-F8-CC-82-2E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -7974,7 +7974,7 @@ "mac": "E2-CB-9C-B5-D8-54" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -8022,7 +8022,7 @@ "mac": "E2-CB-9C-B5-D8-54" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -8069,7 +8069,7 @@ "mac": "E2-CB-9C-B5-D8-54" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -8117,7 +8117,7 @@ "mac": "FF-FF-FF-FF-FF-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", @@ -8164,7 +8164,7 @@ "mac": "E2-CB-9C-B5-DC-6E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-ssid-detected", diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log index 1baeaa6cbba..4abf54d8cbd 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log @@ -21,3 +21,9 @@ <134>1 1639132875.360638431 1_2_AP_4 events type=disassociation radio='1' vap='1' client_mac='36:E7:E9:AE:04:3D' channel='132' reason='8' apple_da_reason='7' instigator='2' duration='40.260521941' auth_neg_dur='0.024206187' last_auth_ago='40.229666962' is_wpa='1' full_conn='0.477861916' ip_resp='1.005954707' ip_src='10.68.128.113' http_resp='0.477861916' arp_resp='0.179876562' arp_src='10.68.128.113' dns_server='10.128.128.128' dns_req_rtt='0.095675854' dns_resp='0.416596437' dhcp_lease_completed='0.182086020' dhcp_server='10.128.128.128' dhcp_server_mac='E0:CB:BC:49:F7:26' dhcp_resp='0.182086020' aid='1750957891' <134>1 1639132903.129587239 LG2_AP_01 events type=disassociation radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' channel='36' reason='8' apple_da_reason='7' instigator='2' duration='27.641499140' auth_neg_dur='0.008153688' last_auth_ago='27.627178619' is_wpa='1' full_conn='0.395120958' ip_resp='0.520431812' ip_src='10.72.66.49' http_resp='0.395120958' arp_resp='0.132684875' arp_src='10.72.66.49' dns_server='10.128.128.128' dns_req_rtt='0.121687' dns_resp='0.335365542' dhcp_lease_completed='0.133589958' dhcp_server='10.128.128.128' dhcp_server_mac='F8:9E:28:70:1A:7C' dhcp_resp='0.133589958' aid='1899362895' <134>1 1639132917.085087788 LG2_AP_01 events type=wpa_auth radio='1' vap='1' client_mac='8E:2F:69:33:FA:6A' aid='1546367691' +<134>1 1639132851.416656563 TCP9001 events Blocked ARP Packet from ab:01:02:03:04:05 with IP 81.2.69.144 on VLAN 123 +<134>1 1694519069.914814259 TCP9001 events Port 4 changed STP role from designated to disabled +<134>1 1694519069.912939179 TCP9001 events port 4 status changed from 100fdx to down +<134>1 1694519040.863533579 TCP9001 events Port 1 changed STP role from disabled to designated +<134>1 1694519040.862946339 TCP9001 events port 1 status changed from down to 100fdx +<134>1 1694519007.104885873 TCP9001 events Auth failure resets to success diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json index 7b0d8bfd2a5..fe49c8f09ee 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-events.log-expected.json @@ -12,7 +12,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dynamic-frequency-selection-detected", @@ -53,7 +53,7 @@ "mac": "E5-A4-98-71-9A-FE" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-wpa-failed-auth-or-deauth", @@ -95,7 +95,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-wpa-authentication", @@ -151,7 +151,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-disassociation-request", @@ -195,7 +195,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-association-request", @@ -232,7 +232,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site-to-site-vpn", @@ -268,7 +268,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site-to-site-vpn", @@ -310,7 +310,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "vpn-connectivity-change", @@ -348,7 +348,7 @@ "mac": "E0-CB-BC-02-4F-80" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-offer", @@ -386,7 +386,7 @@ "mac": "A4-83-E7-02-A2-F1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-no-offer", @@ -433,7 +433,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site-to-site-vpn", @@ -497,7 +497,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-disassociation-request", @@ -539,7 +539,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "association-rejected-for-load-balancing", @@ -581,7 +581,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-association-request", @@ -623,7 +623,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-wpa-authentication", @@ -664,7 +664,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -715,7 +715,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -770,7 +770,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-association-request", @@ -813,7 +813,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-8021x-auth", @@ -856,7 +856,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "8021x_auth", @@ -916,7 +916,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-disassociation-request", @@ -979,7 +979,7 @@ "event_type": "events" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-disassociation-request", @@ -1021,7 +1021,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "wifi-wpa-authentication", @@ -1048,6 +1048,214 @@ "forwarded", "preserve_original_event" ] + }, + { + "@timestamp": "2021-12-10T10:40:51.416Z", + "cisco_meraki": { + "event_subtype": "arp_blocked", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "arp_blocked", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1639132851.416656563 TCP9001 events Blocked ARP Packet from ab:01:02:03:04:05 with IP 81.2.69.144 on VLAN 123", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "TCP9001", + "ingress": { + "vlan": { + "id": "123" + } + } + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144", + "mac": "AB-01-02-03-04-05" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-09-12T11:44:29.914Z", + "cisco_meraki": { + "event_subtype": "port_changed_stp_role", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "port_changed_stp_role", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1694519069.914814259 TCP9001 events Port 4 changed STP role from designated to disabled", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "TCP9001" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-09-12T11:44:29.912Z", + "cisco_meraki": { + "event_subtype": "port_status_changed", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "port_status_changed", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1694519069.912939179 TCP9001 events port 4 status changed from 100fdx to down", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "TCP9001" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-09-12T11:44:00.863Z", + "cisco_meraki": { + "event_subtype": "port_changed_stp_role", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "port_changed_stp_role", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1694519040.863533579 TCP9001 events Port 1 changed STP role from disabled to designated", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "TCP9001" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-09-12T11:44:00.862Z", + "cisco_meraki": { + "event_subtype": "port_status_changed", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "port_status_changed", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1694519040.862946339 TCP9001 events port 1 status changed from down to 100fdx", + "type": [ + "info" + ] + }, + "log": { + "syslog": { + "priority": 134 + } + }, + "observer": { + "hostname": "TCP9001" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-09-12T11:43:27.104Z", + "cisco_meraki": { + "event_subtype": "auth", + "event_type": "events" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "auth", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 1694519007.104885873 TCP9001 events Auth failure resets to success", + "type": [ + "info" + ] + }, + "observer": { + "hostname": "TCP9001" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log index 8fede9d97a1..bf6da87e3d4 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log @@ -11,3 +11,7 @@ <134>1 1674604848.429996761 MX84 flows src=10.10.10.11 dst=172.16.12.23 mac=9C:7B:EF:A9:6C:D8 protocol=udp sport=64138 dport=3289 pattern: deny (src 10.10.0.0/16) <134>1 1674604848.429996761 MX84 flows src=10.241.192.11 dst=10.8.2.6 mac=9C:7B:EF:A5:9C:9B protocol=tcp sport=54791 dport=80 pattern: deny all <134>1 1674604848.429996761 MX84 flows src=192.168.201.81 dst=10.8.2.4 mac=B4:6B:FC:6A:E0:5A protocol=udp sport=60288 dport=53 pattern: allow all +<134>1 948136486.721741837 MX60 firewall src=10.10.10.11 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all +<134>1 948136486.721741837 MX60 vpn_firewall src=10.241.192.1 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all +<134>1 948136486.721741837 MX60 cellular_firewall src=10.10.10.11 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all +<134>1 948136486.721741837 MX60 bridge_anyconnect_client_vpn_firewall src=10.241.192.1 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json index 7e1ea97f363..e4cc2a093b5 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-flows.log-expected.json @@ -14,7 +14,7 @@ "port": 15600 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "layer3-firewall-allowed-flow", @@ -73,7 +73,7 @@ "port": 44210 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -131,7 +131,7 @@ "port": 15500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "layer3-firewall-allowed-flow", @@ -174,7 +174,7 @@ "ip": "ff02::1:ffb6:a227" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "layer3-firewall-allowed-flow", @@ -216,7 +216,7 @@ "ip": "224.0.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "layer3-firewall-allowed-flow", @@ -270,7 +270,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "layer3-firewall-allowed-flow", @@ -314,7 +314,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -373,7 +373,7 @@ "port": 9998 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -417,7 +417,7 @@ "ip": "172.28.1.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -475,7 +475,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -520,7 +520,7 @@ "port": 3289 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -565,7 +565,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -610,7 +610,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-session-initiated", @@ -639,6 +639,186 @@ "forwarded", "preserve_original_event" ] + }, + { + "@timestamp": "2000-01-17T19:14:46.721Z", + "cisco_meraki": { + "event_subtype": "ip_session_initiated", + "event_type": "firewall", + "firewall": { + "action": "allow", + "rule": "all" + } + }, + "destination": { + "ip": "10.241.77.255", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ip-session-initiated", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 948136486.721741837 MX60 firewall src=10.10.10.11 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all", + "type": [ + "info", + "access", + "start" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX60" + }, + "source": { + "ip": "10.10.10.11", + "mac": "24-2F-FA-1E-B7-E6", + "port": 9562 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2000-01-17T19:14:46.721Z", + "cisco_meraki": { + "event_subtype": "ip_session_initiated", + "event_type": "vpn_firewall", + "firewall": { + "action": "allow", + "rule": "all" + } + }, + "destination": { + "ip": "10.241.77.255", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ip-session-initiated", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 948136486.721741837 MX60 vpn_firewall src=10.241.192.1 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all", + "type": [ + "info", + "access", + "start" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX60" + }, + "source": { + "ip": "10.241.192.1", + "mac": "24-2F-FA-1E-B7-E6", + "port": 9562 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2000-01-17T19:14:46.721Z", + "cisco_meraki": { + "event_subtype": "ip_session_initiated", + "event_type": "cellular_firewall", + "firewall": { + "action": "allow", + "rule": "all" + } + }, + "destination": { + "ip": "10.241.77.255", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ip-session-initiated", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 948136486.721741837 MX60 cellular_firewall src=10.10.10.11 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all", + "type": [ + "info", + "access", + "start" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX60" + }, + "source": { + "ip": "10.10.10.11", + "mac": "24-2F-FA-1E-B7-E6", + "port": 9562 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] + }, + { + "@timestamp": "2000-01-17T19:14:46.721Z", + "cisco_meraki": { + "event_subtype": "ip_session_initiated", + "event_type": "bridge_anyconnect_client_vpn_firewall", + "firewall": { + "action": "allow", + "rule": "all" + } + }, + "destination": { + "ip": "10.241.77.255", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ip-session-initiated", + "category": [ + "network" + ], + "original": "\u003c134\u003e1 948136486.721741837 MX60 bridge_anyconnect_client_vpn_firewall src=10.241.192.1 dst=10.241.77.255 mac=24:2F:FA:1E:B7:E6 protocol=udp sport=9562 dport=53 pattern: allow all", + "type": [ + "info", + "access", + "start" + ] + }, + "network": { + "protocol": "udp" + }, + "observer": { + "hostname": "MX60" + }, + "source": { + "ip": "10.241.192.1", + "mac": "24-2F-FA-1E-B7-E6", + "port": 9562 + }, + "tags": [ + "forwarded", + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json index 1959c1c807f..dec9dad26db 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-ip-flow.log-expected.json @@ -22,7 +22,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -76,7 +76,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -130,7 +130,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -190,7 +190,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -259,7 +259,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -307,7 +307,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -376,7 +376,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -424,7 +424,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json index 6239441a46c..eb038ab7354 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-security-events.log-expected.json @@ -17,7 +17,7 @@ "port": 56391 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ids-signature-matched", @@ -93,7 +93,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malicious-file-actioned", @@ -143,7 +143,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "issued-retrospective-malicious-disposition", @@ -188,7 +188,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ids-signature-matched", @@ -246,7 +246,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ids-signature-matched", diff --git a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json index 60c5fc56526..a95e73cdfc0 100644 --- a/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json +++ b/packages/cisco_meraki/data_stream/log/_dev/test/pipeline/test-urls.log-expected.json @@ -32,7 +32,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "http-access-error", @@ -98,7 +98,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "http-access", @@ -164,7 +164,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "http-access", diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 210937231f1..660729767f3 100644 --- a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Cisco Meraki syslog processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -32,7 +32,7 @@ processors: value: 'failed to parse time field ({{{ _temp.ts_nano }}}): {{{ _ingest.on_failure_message }}}' - pipeline: name: '{{ IngestPipeline "flows" }}' - if: ctx.cisco_meraki.event_type == 'flows' + if: "['flows', 'firewall', 'vpn_firewall', 'cellular_firewall', 'bridge_anyconnect_client_vpn_firewall'].contains(ctx.cisco_meraki.event_type)" - pipeline: name: '{{ IngestPipeline "ipflows" }}' if: ctx.cisco_meraki.event_type == 'ip_flow_start' || ctx.cisco_meraki.event_type == 'ip_flow_end' diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml index 9ab57e85444..afd2e407494 100644 --- a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/events.yml @@ -11,11 +11,23 @@ processors: - set: field: cisco_meraki.event_subtype value: 'Site-to-Site VPN' - if: ctx?.msgtype.toLowerCase() == "site-to-site" + if: ctx.msgtype.toLowerCase() == "site-to-site" - set: field: cisco_meraki.event_subtype value: client_vpn_connect - if: ctx?.msgtype.toLowerCase() == "client_vpn_connect" + if: ctx.msgtype.toLowerCase() == "client_vpn_connect" +- set: + field: cisco_meraki.event_subtype + value: blocked + if: ctx.msgtype.toLowerCase() == "blocked" +- set: + field: cisco_meraki.event_subtype + value: auth + if: ctx.msgtype.toLowerCase() == "auth" +- set: + field: cisco_meraki.event_subtype + value: port + if: ctx.msgtype.toLowerCase() == "port" #################################################### # log event with type= format # these are dfs_event, association, disassocation, @@ -73,6 +85,60 @@ processors: WORDORHOST: '(?:%{WORD}|%{HOSTNAME})' if: ctx.event.original.startsWith('<') && ctx?.cisco_meraki?.event_subtype == "Site-to-Site VPN" +#################################################### +# Handle Blocked ARP +#################################################### +- grok: + field: event.original + patterns: + - '%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}%{BLOCKEDARP:_temp.blocked_arp} from %{MAC:source.mac} with IP %{IP:source.ip} on %{NOTSPACE} %{GREEDYDATA:observer.ingress.vlan.id}$' + pattern_definitions: + SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>' + SYSLOGVER: '\b(?:\d{1,2})\b' + SYSLOGHDR: '%{SYSLOGPRI}%{SYSLOGVER}' + WORDORHOST: '(?:%{WORD}|%{HOSTNAME})' + BLOCKEDARP: 'Blocked ARP Packet' + if: ctx.event.original.startsWith('<') && ctx?.cisco_meraki?.event_subtype == "blocked" +- gsub: + field: source.mac + pattern: '[:.]' + replacement: '-' + ignore_missing: true +- uppercase: + field: source.mac + ignore_missing: true +- set: + field: cisco_meraki.event_subtype + value: arp_blocked + if: ctx._temp?.blocked_arp != null + +#################################################### +# Handle Ports +#################################################### +- grok: + field: event.original + patterns: + - '(?i)%{SYSLOGHDR}%{SPACE}%{NUMBER}%{SPACE}%{WORDORHOST}%{SPACE}events%{SPACE}port %{NOTSPACE} %{PORTACTION:_temp.port_action}' + pattern_definitions: + SYSLOGPRI: '<%{NONNEGINT:log.syslog.priority:long}>' + SYSLOGVER: '\b(?:\d{1,2})\b' + SYSLOGHDR: '%{SYSLOGPRI}%{SYSLOGVER}' + WORDORHOST: '(?:%{WORD}|%{HOSTNAME})' + PORTACTION: '(?:changed stp role|status changed)' + if: ctx.event.original.startsWith('<') && ctx?.cisco_meraki?.event_subtype == "port" +- gsub: + field: _temp.port_action + pattern: ' ' + replacement: '_' + ignore_missing: true +- lowercase: + field: _temp.port_action + ignore_missing: true +- set: + field: cisco_meraki.event_subtype + value: 'port_{{{_temp.port_action}}}' + if: ctx._temp?.port_action != null + #################################################### # Handle dfs_event, wpa_auth, wpa_deauth, # association or disassociation diff --git a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml index 9ce32174526..80017cae929 100644 --- a/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml +++ b/packages/cisco_meraki/data_stream/log/elasticsearch/ingest_pipeline/flows.yml @@ -4,7 +4,9 @@ processors: - grok: field: event.original patterns: - - "flows( %{NOTSPACE:cisco_meraki.flows.op})? src=%{IP:source.ip:ip} dst=%{IP:destination.ip:ip}( mac=%{MAC:source.mac})? protocol=%{NOTSPACE:network.protocol}( type=%{NOTSPACE})?( sport=%{NONNEGINT:source.port:long})?( dport=%{NONNEGINT:destination.port:long})?( pattern: %{GREEDYDATA:cisco_meraki.firewall.pattern})?" + - "%{TYPE}( %{NOTSPACE:cisco_meraki.flows.op})? src=%{IP:source.ip:ip} dst=%{IP:destination.ip:ip}( mac=%{MAC:source.mac})? protocol=%{NOTSPACE:network.protocol}( type=%{NOTSPACE})?( sport=%{NONNEGINT:source.port:long})?( dport=%{NONNEGINT:destination.port:long})?( pattern: %{GREEDYDATA:cisco_meraki.firewall.pattern})?" + pattern_definitions: + TYPE: 'flows|firewall|vpn_firewall|cellular_firewall|bridge_anyconnect_client_vpn_firewall' - grok: field: cisco_meraki.firewall.pattern patterns: diff --git a/packages/cisco_meraki/data_stream/log/fields/ecs.yml b/packages/cisco_meraki/data_stream/log/fields/ecs.yml index 2e4f83a1d9e..e8ce1e59a77 100644 --- a/packages/cisco_meraki/data_stream/log/fields/ecs.yml +++ b/packages/cisco_meraki/data_stream/log/fields/ecs.yml @@ -146,6 +146,8 @@ name: observer.egress.interface.name - external: ecs name: observer.ingress.interface.name +- external: ecs + name: observer.ingress.vlan.id - external: ecs name: observer.product - external: ecs diff --git a/packages/cisco_meraki/data_stream/log/sample_event.json b/packages/cisco_meraki/data_stream/log/sample_event.json index 78c08c5facb..fd5c46dc587 100644 --- a/packages/cisco_meraki/data_stream/log/sample_event.json +++ b/packages/cisco_meraki/data_stream/log/sample_event.json @@ -27,7 +27,7 @@ "port": 56391 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "878982e9-a174-4ed8-abe3-19378c1473de", diff --git a/packages/cisco_meraki/docs/README.md b/packages/cisco_meraki/docs/README.md index b2de1a69304..a9d90d3d9b6 100644 --- a/packages/cisco_meraki/docs/README.md +++ b/packages/cisco_meraki/docs/README.md @@ -213,6 +213,7 @@ The `cisco_meraki.log` dataset provides events from the configured syslog server | observer.egress.interface.name | Interface name as reported by the system. | keyword | | observer.hostname | Hostname of the observer. | keyword | | observer.ingress.interface.name | Interface name as reported by the system. | keyword | +| observer.ingress.vlan.id | VLAN ID as reported by the observer. | keyword | | observer.mac | MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | observer.product | The product name of the observer. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | @@ -323,7 +324,7 @@ An example event for `log` looks as following: "port": 56391 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "878982e9-a174-4ed8-abe3-19378c1473de", @@ -658,7 +659,7 @@ An example event for `events` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "878982e9-a174-4ed8-abe3-19378c1473de", diff --git a/packages/cisco_meraki/kibana/tags.yml b/packages/cisco_meraki/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_meraki/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_meraki/manifest.yml b/packages/cisco_meraki/manifest.yml index e0c653f63e5..b22dcf2193b 100644 --- a/packages/cisco_meraki/manifest.yml +++ b/packages/cisco_meraki/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: cisco_meraki title: Cisco Meraki -version: "1.10.0" +version: "1.13.0" description: Collect logs from Cisco Meraki with Elastic Agent. type: integration categories: diff --git a/packages/cisco_nexus/_dev/build/build.yml b/packages/cisco_nexus/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/cisco_nexus/_dev/build/build.yml +++ b/packages/cisco_nexus/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/cisco_nexus/changelog.yml b/packages/cisco_nexus/changelog.yml index dd11b374a1a..38cfc47f31d 100644 --- a/packages/cisco_nexus/changelog.yml +++ b/packages/cisco_nexus/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 0.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "0.14.2" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "0.14.1" changes: - description: Add support for new log format. diff --git a/packages/cisco_nexus/data_stream/log/_dev/test/pipeline/test-nexus.log-expected.json b/packages/cisco_nexus/data_stream/log/_dev/test/pipeline/test-nexus.log-expected.json index 954474ad1d7..05d99768950 100644 --- a/packages/cisco_nexus/data_stream/log/_dev/test/pipeline/test-nexus.log-expected.json +++ b/packages/cisco_nexus/data_stream/log/_dev/test/pipeline/test-nexus.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -50,7 +50,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -102,7 +102,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -151,7 +151,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -199,7 +199,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -261,7 +261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -318,7 +318,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -362,7 +362,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -416,7 +416,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -467,7 +467,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -516,7 +516,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSTEM_MSG", @@ -578,7 +578,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -636,7 +636,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -681,7 +681,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -736,7 +736,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -788,7 +788,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -838,7 +838,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -909,7 +909,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -969,7 +969,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1016,7 +1016,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1073,7 +1073,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1125,7 +1125,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1171,7 +1171,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1250,7 +1250,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1308,7 +1308,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1348,7 +1348,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1417,7 +1417,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1465,7 +1465,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1499,7 +1499,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1546,7 +1546,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "DETECT_MULTIPLE_PEERS", @@ -1586,7 +1586,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1632,7 +1632,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1707,7 +1707,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1765,7 +1765,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1807,7 +1807,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSTEM_MSG", @@ -1864,7 +1864,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1921,7 +1921,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1973,7 +1973,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "CFGWRITE_STARTED", @@ -2030,7 +2030,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "CFGWRITE_DONE", @@ -2079,7 +2079,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2160,7 +2160,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2221,7 +2221,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSLOG_SL_MSG_WARNING", @@ -2287,7 +2287,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2346,7 +2346,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2407,7 +2407,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2458,7 +2458,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSTEM_MSG", @@ -2501,7 +2501,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSTEM_MSG", @@ -2559,7 +2559,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2618,7 +2618,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2674,7 +2674,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2735,7 +2735,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2793,7 +2793,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2858,7 +2858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2917,7 +2917,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2984,7 +2984,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3039,7 +3039,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "SYSTEM_MSG", @@ -3094,7 +3094,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3145,7 +3145,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3194,7 +3194,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3256,7 +3256,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3310,7 +3310,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "TACACS_WARNING", @@ -3357,7 +3357,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "TACACS_WARNING", @@ -3412,7 +3412,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3466,7 +3466,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3530,7 +3530,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3585,7 +3585,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3660,7 +3660,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "LOGOUT", @@ -3727,7 +3727,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3792,7 +3792,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3850,7 +3850,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3904,7 +3904,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3974,7 +3974,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "LOGOUT_C6K", diff --git a/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/default.yml index a6e16785909..87503af75f1 100644 --- a/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Cisco Nexus logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' tag: 'set_ecs_version' - set: field: observer.vendor @@ -45,7 +45,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: _conf.tz_offset target_field: event.timezone @@ -67,7 +67,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: temp.syslog_timestamp target_field: temp.syslog_timestamp @@ -84,7 +84,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: temp.timestamp value: '{{{temp.syslog_timestamp}}} {{{cisco_nexus.log.timezone}}}' @@ -116,7 +116,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: temp.timestamp tag: 'date_set_timestamp_timezone' @@ -144,7 +144,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: temp.timestamp tag: 'date_set_timestamp_custom' @@ -178,7 +178,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: temp.timestamp tag: 'date_set_timestamp_timezone_custom' @@ -213,7 +213,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: log.syslog.priority copy_from: cisco_nexus.log.priority_number @@ -279,7 +279,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless description: This script will set log.syslog.facility.code field from priority number and severity. @@ -291,7 +291,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - trim: field: cisco_nexus.log.description tag: 'trim_description' @@ -361,7 +361,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.kind value: pipeline_error diff --git a/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/pipeline_extract_message.yml b/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/pipeline_extract_message.yml index 6b6f26b349f..2d8a3fed2fb 100644 --- a/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/pipeline_extract_message.yml +++ b/packages/cisco_nexus/data_stream/log/elasticsearch/ingest_pipeline/pipeline_extract_message.yml @@ -62,7 +62,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - gsub: field: source.mac tag: 'gsub_sourcemac_add_hyphen' @@ -72,7 +72,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - uppercase: field: source.mac ignore_missing: true diff --git a/packages/cisco_nexus/data_stream/log/sample_event.json b/packages/cisco_nexus/data_stream/log/sample_event.json index 25a00fb2888..b9ace94c988 100644 --- a/packages/cisco_nexus/data_stream/log/sample_event.json +++ b/packages/cisco_nexus/data_stream/log/sample_event.json @@ -22,7 +22,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ae8acf2b-2fd5-4ab9-921c-e92bc69cd32c", diff --git a/packages/cisco_nexus/docs/README.md b/packages/cisco_nexus/docs/README.md index 09196ae63ee..b3cac3e6a1b 100644 --- a/packages/cisco_nexus/docs/README.md +++ b/packages/cisco_nexus/docs/README.md @@ -67,7 +67,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ae8acf2b-2fd5-4ab9-921c-e92bc69cd32c", diff --git a/packages/cisco_nexus/kibana/tags.yml b/packages/cisco_nexus/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_nexus/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_nexus/manifest.yml b/packages/cisco_nexus/manifest.yml index 0ac242c2ac6..129a0e967bf 100644 --- a/packages/cisco_nexus/manifest.yml +++ b/packages/cisco_nexus/manifest.yml @@ -1,15 +1,17 @@ -format_version: 2.8.0 +format_version: "3.0.0" name: cisco_nexus title: Cisco Nexus -version: "0.14.1" +version: "0.17.0" description: Collect logs from Cisco Nexus with Elastic Agent. type: integration categories: - network - security conditions: - kibana.version: ^8.7.0 - elastic.subscription: basic + kibana: + version: ^8.7.0 + elastic: + subscription: basic icons: - src: /img/cisco.svg title: cisco @@ -36,3 +38,4 @@ policy_templates: description: Collecting logs from Cisco Nexus via file. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_secure_email_gateway/_dev/build/build.yml b/packages/cisco_secure_email_gateway/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_secure_email_gateway/_dev/build/build.yml +++ b/packages/cisco_secure_email_gateway/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_secure_email_gateway/changelog.yml b/packages/cisco_secure_email_gateway/changelog.yml index b3ced95d9b4..92fd490d112 100644 --- a/packages/cisco_secure_email_gateway/changelog.yml +++ b/packages/cisco_secure_email_gateway/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.13.1" + changes: + - description: Remove the unused mappings for 'type' and 'filepath'. + type: bugfix + link: https://github.com/elastic/integrations/pull/7875 +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7599 +- version: "1.11.2" + changes: + - description: Match both Unix and Windows-style paths, correctly. + type: bugfix + link: https://github.com/elastic/integrations/pull/7572 +- version: "1.11.1" + changes: + - description: Match both Unix and Windows-style paths + type: bugfix + link: https://github.com/elastic/integrations/pull/7452 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.10.1" + changes: + - description: Fix grok timeout on expensive consolidated events logs. + type: bugfix + link: https://github.com/elastic/integrations/pull/6879 - version: "1.10.0" changes: - description: Convert dashboard to lens. diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-amp.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-amp.log-expected.json index 43b26919530..97eb12b9bc1 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-amp.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-amp.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -55,7 +55,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -110,7 +110,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -152,7 +152,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -206,7 +206,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -253,7 +253,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -301,7 +301,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -349,7 +349,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -391,7 +391,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -442,7 +442,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-anti-spam.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-anti-spam.log-expected.json index 49370673eed..bffd861af3c 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-anti-spam.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-anti-spam.log-expected.json @@ -14,7 +14,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -46,7 +46,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -79,7 +79,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log index f17c35dd1d0..d5bb8254c73 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log @@ -9,4 +9,6 @@ <166>Mar 17 18:24:37 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-023|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=423A4DF759243122B64F-7941F28E57A4 ESAMID=4086421 ESAICID=13956459 ESADCID=2522340 ESAAMPVerdict=UNKNOWN ESAASVerdict=NEGATIVE ESAAVVerdict=NOT_EVALUATED ESACFVerdict=NO_MATCH endTime=Thu Nov 24 13:39:24 2022 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=1.128.3.4 ESAAttachmentDetails={'image002.png': {'AMP': {'Verdict': 'FILE UNKNOWN', 'fileHash': '30bf618599d8784ebcf38769f8b524b40dc20d2ba262a1e4052d24711abcd064'}, 'BodyScanner': {}}, 'image001.png': {'AMP': {'Verdict': 'FILE UNKNOWN', 'fileHash': '7de9d8514c142887d11821fd30faddc693d192efdd19dfb6459872a1be63dcfa'}, 'BodyScanner': {}}} ESAFriendlyFrom=example.com ESAGMVerdict=NEGATIVE startTime=Thu Nov 24 13:39:16 2022 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=United States ESAMFVerdict=MATCH act=DELIVERED cs4Label=ExternalMsgID cs4='' ESAMsgSize=716707 ESAOFVerdict=NEGATIVE duser=example.com ESAHeloDomain=example.cisco.com ESAHeloIP=1.128.3.4 cfp1Label=SBRSScore cfp1=3.5 ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Favorable sourceHostName=example.cisco.com ESASenderGroup=ACCEPTLIST sourceAddress=1.128.3.4 msg='RE: SR 312312 : consolidate event log' ESATLSInCipher=KWLDS-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESATLSOutCipher=HDKWA-RSA-AES256-JMB-SHA384 ESATLSOutConnStatus=Success ESATLSOutProtocol=TLSv1.2 ESADaneHost=testdomain.com ESADaneStatus=success ESADHASource=1.128.3.4 ESADMARCVerdict=TempFailure cs5Label=ESAMsgLanguage cs5=English ESAMARAction={'action':'<>';'succesful_rcpts'='<>';'failed_recipients'='<>';'filename'='<>'} ESAMsgTooBigFromSender=true ESARateLimitedIP=1.128.3.4 <166>Apr 03 12:20:40 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.0.2-020|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=422084EE64B1B0454D49-AAFBF6B55869 ESAMID=164229 ESAICID=62908 ESADCID=47845 ESAAMPVerdict=SKIPPED ESAASVerdict=NEGATIVE ESAAVVerdict=NEGATIVE ESACFVerdict=NO_MATCH endTime=Mon Nov 14 15:40:48 2022 ESADLPVerdict=NOT_EVALUATED dvc=1.128.3.4 ESAFriendlyFrom=example.com ESAGMVerdict=NEGATIVE startTime=Mon Nov 14 15:40:47 2022 deviceInboundInterface=IncList deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=United States ESAMFVerdict=NOT_EVALUATED act=DELIVERED cs4Label=ExternalMsgID cs4='' ESAMsgSize=1411 ESAOFVerdict=NEGATIVE duser=example.com ESAHeloDomain=example.cisco.com ESAHeloIP=1.128.3.4 ESAReplyTo=example.com cfp1Label=SBRSScore cfp1=5.2 ESASDRDomainAge=1 month cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral sourceHostName=example.cisco.com ESASenderGroup=UNKNOWNLIST sourceAddress=1.128.3.4 msg="Demande d'achat Econocom Products and Solutions, ref: SSAY-MEDECIN3" <14>Jun 12 14:01:33 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=4235746AE34E6DD44EB8-CE101C994AA5 ESAMID=5181473 ESAICID=17267358 ESADCID=3036000 endTime=Mon Jun 12 14:01:31 2023 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=1.128.3.4 ESAFriendlyFrom=jean sistin ESAGMVerdict=NEGATIVE startTime=Mon Jun 12 14:01:27 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=jsistin@gmail.com cs1Label=MailPolicy cs1=Test quarantaine utilisateur cs2Label=SenderCountry cs2=United States ESAMFVerdict=MATCH act=DELIVERED cs4Label=ExternalMsgID cs4='' ESAMsgSize=3078 ESAOFVerdict=NEGATIVE duser=fpenigaud@exaprobe.com ESAHeloDomain=mail-oi1-f182.google.com ESAHeloIP=1.128.3.4 cfp1Label=SBRSScore cfp1=3.4 ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'jsistin@gmail.com'}} sourceHostName=mail-oi1-f182.google.com ESASenderGroup=ACCEPTLIST sourceAddress=1.128.3.4 msg='test url' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESATLSOutCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSOutConnStatus=Success ESATLSOutProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=NEGATIVE ESAAVVerdict=NOT_EVALUATED ESACFVerdict=NO_MATCH - +<14>Jul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=E7DEF468022C4EB09683-9A331A42E1F7 ESAMID=54376810 ESAICID=43587623 endTime=Tue Jul 4 06:21:54 2023 ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.144 ESAAttachmentDetails={'meeting.ics': {'AMP': {'Verdict': 'FILE UNKNOWN', 'fileHash': '17ae79446b4ec3baf161704831970aac49457d32935c6383c2a45aed136a99df'}, 'BodyScanner': {}}} ESAFriendlyFrom=River ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 16:12:44 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=river@this.example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=New Zealand ESAMFVerdict=MATCH act=DQ ESAFinalActionDetails=Message held temporarily in Delay Quarantine cs4Label=ExternalMsgID cs4='<2403354681.734500.1688449973515.mail.lion@example.com>' ESAMsgSize=18675 ESAOFVerdict=NEGATIVE duser=smith@example.com ESAHeloDomain=vm-lion.dmz ESAHeloIP=89.160.20.128 cfp1Label=SBRSScore cfp1=None ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'river@this.example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@vm-lion.dmz'}} sourceHostName=company.example.com sourceAddress=89.160.20.128 msg='Accept: Cisco - SOLUTIONS' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=FA_PENDING ESAASVerdict=NEGATIVE ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH +<14>Jul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=30543A3AB9E54FA8AAC1-FB812C95028D ESAMID=238746 ESAICID=435897324 ESADCID=34809573 endTime=Tue Jul 4 06:21:54 2023 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.142 ESAFriendlyFrom=Will ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 15:14:29 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=irobot@example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=United States ESAMFVerdict=MATCH act=QUARANTINED ESAFinalActionDetails=To SPAM cs4Label=ExternalMsgID cs4='' ESAMsgSize=12312 ESAOFVerdict=NEGATIVE duser=alfombra@example.com ESAHeloDomain=mail-q6by9-a42.google.com ESAHeloIP=81.2.69.192 cfp1Label=SBRSScore cfp1=2.7 ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'irobot@example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@mail-q6by9-a42.google.com'}} sourceHostName=mail-q6by9-a42.google.com ESASenderGroup=ACCEPTLIST sourceAddress=81.2.69.192 msg='IE : Crayons' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH +<14>Jul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=4FEF3A4372664BCCB404-20EE1767D434 ESAMID=786324 ESAICID=35635425 ESADCID=970897 endTime=Tue Jul 4 06:21:54 2023 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.144 ESAFriendlyFrom=Beaches ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 14:42:34 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=westinghouse-thoreau\\=example.com@example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=NZ ESAMFVerdict=MATCH act=QUARANTINED ESAFinalActionDetails=To SPAM cs4Label=ExternalMsgID cs4='<490b2a15fa4742331779cdaa4e@example.com>' ESAMsgSize=20668 ESAOFVerdict=NEGATIVE duser=thoreau@example.com ESAHeloDomain=example.com ESAHeloIP=89.160.20.112 ESAReplyTo=lane@example.com cfp1Label=SBRSScore cfp1=None ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'westinghouse-thoreau=example.com@example.com'}, 'helo': {'result': 'Pass', 'sender': 'postmaster@example.com'}} sourceHostName=example.com sourceAddress=89.160.20.112 msg=\"Totally not suspicious email subject\" ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=NO_MATCH diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log-expected.json index fecac4e4163..bd7ed38270c 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-consolidated-event.log-expected.json @@ -60,17 +60,21 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "1053", "subject": "Testing", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -163,17 +167,21 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "1053", "subject": "Testing", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -263,16 +271,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "153634", "subject": "[SUSPICIOUS MESSAGE] Everycloud Mailflow Monitor guid: 12312314123", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -354,11 +366,13 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "164226" }, @@ -448,16 +462,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "164230", "subject": "Everycloud Mailflow Monitor guid: 34214234232", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -552,16 +570,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "164229", "subject": "Everycloud Mailflow Monitor guid: 321514231213", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -656,16 +678,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "164231", "subject": "TEST", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -773,16 +799,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "4086421", "subject": "RE: SR 312312 : consolidate event log", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -901,16 +931,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "4086421", "subject": "RE: SR 312312 : consolidate event log", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -1005,16 +1039,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "164229", "subject": "Demande d'achat Econocom Products and Solutions, ref: SSAY-MEDECIN3", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -1118,16 +1156,20 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "jsistin@gmail.com" + "address": [ + "jsistin@gmail.com" + ] }, "message_id": "5181473", "subject": "test url", "to": { - "address": "fpenigaud@exaprobe.com" + "address": [ + "fpenigaud@exaprobe.com" + ] } }, "event": { @@ -1160,12 +1202,315 @@ ] }, { + "@timestamp": "2023-07-04T06:21:54.000Z", + "cisco_secure_email_gateway": { + "log": { + "act": "DQ", + "appliance": { + "product": "C100V Email Security Virtual Appliance", + "vendor": "Cisco", + "version": "14.3.0-032" + }, + "category": { + "name": "consolidated_event" + }, + "cef_format_version": "0", + "cfp1_label": "SBRSScore", + "cs1": "DEFAULT", + "cs1_label": "MailPolicy", + "cs2": "New Zealand", + "cs2_label": "SenderCountry", + "cs3": "N/A", + "cs3_label": "SDRThreatCategory", + "cs4": "2403354681.734500.1688449973515.mail.lion@example.com", + "cs4_label": "ExternalMsgID", + "cs6": "Neutral", + "cs6_label": "SDRRepScore", + "data": { + "ip": "81.2.69.144" + }, + "device_direction": "incoming", + "esa": { + "attachment_details": "{'meeting.ics': {'AMP': {'Verdict': 'FILE UNKNOWN', 'fileHash': '17ae79446b4ec3baf161704831970aac49457d32935c6383c2a45aed136a99df'}, 'BodyScanner': {}}}", + "dlp_verdict": "NOT_EVALUATED", + "final_action_details": "Message held temporarily in Delay Quarantine", + "friendly_from": "River \u003criver@this.example.com\u003e", + "graymail_verdict": "NEGATIVE", + "helo": { + "domain": "vm-lion.dmz", + "ip": "89.160.20.128" + }, + "injection_connection_id": "43587623", + "mail_flow_policy": "ACCEPT", + "mf_verdict": "MATCH", + "msg_size": 18675, + "outbreak_filter_verdict": "NEGATIVE", + "sdr_consolidated_domain_age": "30 days (or greater)", + "spf_verdict": "{'mailfrom': {'result': 'Pass', 'sender': 'river@this.example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@vm-lion.dmz'}}" + }, + "event": { + "name": "Consolidated Log Event" + }, + "event_class_id": "ESA_CONSOLIDATED_LOG_EVENT", + "listener": { + "name": "IncomingMail" + }, + "message": "'Accept: Cisco - SOLUTIONS' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=FA_PENDING ESAASVerdict=NEGATIVE ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH" + } + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "email": { + "from": { + "address": [ + "river@this.example.com" + ] + }, + "message_id": "54376810", + "to": { + "address": [ + "smith@example.com" + ] + } }, "event": { + "end": "Tue Jul 4 06:21:54 2023", + "kind": "event", + "original": "\u003c14\u003eJul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=E7DEF468022C4EB09683-9A331A42E1F7 ESAMID=54376810 ESAICID=43587623 endTime=Tue Jul 4 06:21:54 2023 ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.144 ESAAttachmentDetails={'meeting.ics': {'AMP': {'Verdict': 'FILE UNKNOWN', 'fileHash': '17ae79446b4ec3baf161704831970aac49457d32935c6383c2a45aed136a99df'}, 'BodyScanner': {}}} ESAFriendlyFrom=River \u003criver@this.example.com\u003e ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 16:12:44 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=river@this.example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=New Zealand ESAMFVerdict=MATCH act=DQ ESAFinalActionDetails=Message held temporarily in Delay Quarantine cs4Label=ExternalMsgID cs4='\u003c2403354681.734500.1688449973515.mail.lion@example.com\u003e' ESAMsgSize=18675 ESAOFVerdict=NEGATIVE duser=smith@example.com ESAHeloDomain=vm-lion.dmz ESAHeloIP=89.160.20.128 cfp1Label=SBRSScore cfp1=None ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'river@this.example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@vm-lion.dmz'}} sourceHostName=company.example.com sourceAddress=89.160.20.128 msg='Accept: Cisco - SOLUTIONS' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=FA_PENDING ESAASVerdict=NEGATIVE ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH", + "severity": "5", + "start": "Tue Jul 4 16:12:44 2023", "timezone": "UTC" }, + "host": { + "id": "E7DEF468022C4EB09683-9A331A42E1F7" + }, + "log": { + "syslog": { + "priority": 14 + } + }, + "related": { + "ip": [ + "89.160.20.128", + "81.2.69.144" + ] + }, + "source": { + "domain": "company.example.com", + "ip": "89.160.20.128" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-04T06:21:54.000Z", + "cisco_secure_email_gateway": { + "log": { + "act": "QUARANTINED", + "appliance": { + "product": "C100V Email Security Virtual Appliance", + "vendor": "Cisco", + "version": "14.3.0-032" + }, + "category": { + "name": "consolidated_event" + }, + "cef_format_version": "0", + "cfp1": 2.7, + "cfp1_label": "SBRSScore", + "cs1": "DEFAULT", + "cs1_label": "MailPolicy", + "cs2": "United States", + "cs2_label": "SenderCountry", + "cs3": "N/A", + "cs3_label": "SDRThreatCategory", + "cs4": "MDlhMDg0MjY0NmE2OWFkNTZhMzA2NDA0MDVkZWNlZWVlYzI3MjMyYmI5YWJlNDMxM2UxOGVjZTBiNGZmOGZmYSAgLQo@hotmail.com", + "cs4_label": "ExternalMsgID", + "cs6": "Neutral", + "cs6_label": "SDRRepScore", + "data": { + "ip": "81.2.69.142" + }, + "device_direction": "incoming", + "esa": { + "delivery_connection_id": "34809573", + "dkim_verdict": "pass", + "dlp_verdict": "NOT_EVALUATED", + "final_action_details": "To SPAM", + "friendly_from": "Will \u003cirobot@example.com\u003e", + "graymail_verdict": "NEGATIVE", + "helo": { + "domain": "mail-q6by9-a42.google.com", + "ip": "81.2.69.192" + }, + "injection_connection_id": "435897324", + "mail_flow_policy": "ACCEPT", + "mf_verdict": "MATCH", + "msg_size": 12312, + "outbreak_filter_verdict": "NEGATIVE", + "sdr_consolidated_domain_age": "30 days (or greater)", + "sender_group": "ACCEPTLIST", + "spf_verdict": "{'mailfrom': {'result': 'Pass', 'sender': 'irobot@example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@mail-q6by9-a42.google.com'}}" + }, + "event": { + "name": "Consolidated Log Event" + }, + "event_class_id": "ESA_CONSOLIDATED_LOG_EVENT", + "listener": { + "name": "IncomingMail" + }, + "message": "'IE : Crayons' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH" + } + }, + "ecs": { + "version": "8.9.0" + }, + "email": { + "from": { + "address": [ + "irobot@example.com" + ] + }, + "message_id": "238746", + "to": { + "address": [ + "alfombra@example.com" + ] + } + }, + "event": { + "end": "Tue Jul 4 06:21:54 2023", + "kind": "event", + "original": "\u003c14\u003eJul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=30543A3AB9E54FA8AAC1-FB812C95028D ESAMID=238746 ESAICID=435897324 ESADCID=34809573 endTime=Tue Jul 4 06:21:54 2023 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.142 ESAFriendlyFrom=Will \u003cirobot@example.com\u003e ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 15:14:29 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=irobot@example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=United States ESAMFVerdict=MATCH act=QUARANTINED ESAFinalActionDetails=To SPAM cs4Label=ExternalMsgID cs4='\u003cMDlhMDg0MjY0NmE2OWFkNTZhMzA2NDA0MDVkZWNlZWVlYzI3MjMyYmI5YWJlNDMxM2UxOGVjZTBiNGZmOGZmYSAgLQo@hotmail.com\u003e' ESAMsgSize=12312 ESAOFVerdict=NEGATIVE duser=alfombra@example.com ESAHeloDomain=mail-q6by9-a42.google.com ESAHeloIP=81.2.69.192 cfp1Label=SBRSScore cfp1=2.7 ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'irobot@example.com'}, 'helo': {'result': 'None', 'sender': 'postmaster@mail-q6by9-a42.google.com'}} sourceHostName=mail-q6by9-a42.google.com ESASenderGroup=ACCEPTLIST sourceAddress=81.2.69.192 msg='IE : Crayons' ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=MATCH", + "severity": "5", + "start": "Tue Jul 4 15:14:29 2023", + "timezone": "UTC" + }, + "host": { + "id": "30543A3AB9E54FA8AAC1-FB812C95028D" + }, + "log": { + "syslog": { + "priority": 14 + } + }, + "related": { + "ip": [ + "81.2.69.192", + "81.2.69.142" + ] + }, + "source": { + "domain": "mail-q6by9-a42.google.com", + "ip": "81.2.69.192" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-04T06:21:54.000Z", + "cisco_secure_email_gateway": { + "log": { + "act": "QUARANTINED", + "appliance": { + "product": "C100V Email Security Virtual Appliance", + "vendor": "Cisco", + "version": "14.3.0-032" + }, + "category": { + "name": "consolidated_event" + }, + "cef_format_version": "0", + "cfp1_label": "SBRSScore", + "cs1": "DEFAULT", + "cs1_label": "MailPolicy", + "cs2": "NZ", + "cs2_label": "SenderCountry", + "cs3": "N/A", + "cs3_label": "SDRThreatCategory", + "cs4": "490b2a15fa4742331779cdaa4e@example.com", + "cs4_label": "ExternalMsgID", + "cs6": "Neutral", + "cs6_label": "SDRRepScore", + "data": { + "ip": "81.2.69.144" + }, + "device_direction": "incoming", + "esa": { + "delivery_connection_id": "970897", + "dkim_verdict": "pass", + "dlp_verdict": "NOT_EVALUATED", + "final_action_details": "To SPAM", + "friendly_from": "Beaches \u003cplayas@example.com\u003e", + "graymail_verdict": "NEGATIVE", + "helo": { + "domain": "example.com", + "ip": "89.160.20.112" + }, + "injection_connection_id": "35635425", + "mail_flow_policy": "ACCEPT", + "mf_verdict": "MATCH", + "msg_size": 20668, + "outbreak_filter_verdict": "NEGATIVE", + "reply_to": "lane@example.com", + "sdr_consolidated_domain_age": "30 days (or greater)", + "spf_verdict": "{'mailfrom': {'result': 'Pass', 'sender': 'westinghouse-thoreau=example.com@example.com'}, 'helo': {'result': 'Pass', 'sender': 'postmaster@example.com'}}" + }, + "event": { + "name": "Consolidated Log Event" + }, + "event_class_id": "ESA_CONSOLIDATED_LOG_EVENT", + "listener": { + "name": "IncomingMail" + }, + "message": "\\\"Totally not suspicious email subject\\\" ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=NO_MATCH" + } + }, + "ecs": { + "version": "8.9.0" + }, + "email": { + "from": { + "address": [ + "westinghouse-thoreau\\\\=example.com@example.com" + ] + }, + "message_id": "786324", + "to": { + "address": [ + "thoreau@example.com" + ] + } + }, + "event": { + "end": "Tue Jul 4 06:21:54 2023", + "kind": "event", + "original": "\u003c14\u003eJul 04 06:21:54 consolidated_event: CEF:0|Cisco|C100V Email Security Virtual Appliance|14.3.0-032|ESA_CONSOLIDATED_LOG_EVENT|Consolidated Log Event|5|deviceExternalId=4FEF3A4372664BCCB404-20EE1767D434 ESAMID=786324 ESAICID=35635425 ESADCID=970897 endTime=Tue Jul 4 06:21:54 2023 ESADKIMVerdict=pass ESADLPVerdict=NOT_EVALUATED dvc=81.2.69.144 ESAFriendlyFrom=Beaches \u003cplayas@example.com\u003e ESAGMVerdict=NEGATIVE startTime=Tue Jul 4 14:42:34 2023 deviceInboundInterface=IncomingMail deviceDirection=0 ESAMailFlowPolicy=ACCEPT suser=westinghouse-thoreau\\\\=example.com@example.com cs1Label=MailPolicy cs1=DEFAULT cs2Label=SenderCountry cs2=NZ ESAMFVerdict=MATCH act=QUARANTINED ESAFinalActionDetails=To SPAM cs4Label=ExternalMsgID cs4='\u003c490b2a15fa4742331779cdaa4e@example.com\u003e' ESAMsgSize=20668 ESAOFVerdict=NEGATIVE duser=thoreau@example.com ESAHeloDomain=example.com ESAHeloIP=89.160.20.112 ESAReplyTo=lane@example.com cfp1Label=SBRSScore cfp1=None ESASDRDomainAge=30 days (or greater) cs3Label=SDRThreatCategory cs3=N/A cs6Label=SDRRepScore cs6=Neutral ESASPFVerdict={'mailfrom': {'result': 'Pass', 'sender': 'westinghouse-thoreau=example.com@example.com'}, 'helo': {'result': 'Pass', 'sender': 'postmaster@example.com'}} sourceHostName=example.com sourceAddress=89.160.20.112 msg=\\\"Totally not suspicious email subject\\\" ESATLSInCipher=ECDHE-RSA-AES256-GCM-SHA384 ESATLSInConnStatus=Success ESATLSInProtocol=TLSv1.2 ESAAMPVerdict=SKIPPED ESAASVerdict=SUSPECT ESAAVVerdict=NOT_EVALUATED ESACFVerdict=NO_MATCH", + "severity": "5", + "start": "Tue Jul 4 14:42:34 2023", + "timezone": "UTC" + }, + "host": { + "id": "4FEF3A4372664BCCB404-20EE1767D434" + }, + "log": { + "syslog": { + "priority": 14 + } + }, + "related": { + "ip": [ + "89.160.20.112", + "81.2.69.144" + ] + }, + "source": { + "domain": "example.com", + "ip": "89.160.20.112" + }, "tags": [ "preserve_original_event" ] diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-content-scanner.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-content-scanner.log-expected.json index 2add7c468c6..cf14aef11d1 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-content-scanner.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-content-scanner.log-expected.json @@ -13,7 +13,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -47,7 +47,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-error.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-error.log-expected.json index b052121da59..5b2726805e9 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-error.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-error.log-expected.json @@ -13,7 +13,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -44,12 +44,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "'Warning \u003cSystem\u003e example.com: Your \"IronPort Email Encryption\" key will expire in under 60...': Unrecoverable error", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -85,12 +87,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "Warning \u003cSystem\u003e example.com: Your \"IronPort Email Encryption\" key will expire in under 60...", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -122,12 +126,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "'Critical \u003cSystem\u003e example.com: Log Error: Subscription error_logs: Failed to connect to 10....' (attempt #0)", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-gui-log.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-gui-log.log-expected.json index d00d5cf4f5d..8e73ddfe49d 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-gui-log.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-gui-log.log-expected.json @@ -14,7 +14,7 @@ "ip": "1.128.3.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -88,7 +88,7 @@ "ip": "1.128.3.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -142,7 +142,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -186,7 +186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -230,7 +230,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -270,7 +270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -314,7 +314,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -344,7 +344,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -374,7 +374,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -413,7 +413,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -452,7 +452,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-status.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-status.log-expected.json index 685e3d91ceb..804e066375b 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-status.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-status.log-expected.json @@ -96,7 +96,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "0" diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-system.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-system.log-expected.json index cd7041daff6..fd0193a10d1 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-system.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-system.log-expected.json @@ -12,7 +12,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -57,7 +57,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -87,7 +87,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -117,7 +117,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -147,7 +147,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-text-mail.log-expected.json b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-text-mail.log-expected.json index 62c28e278c0..d477c409695 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-text-mail.log-expected.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/_dev/test/pipeline/test-common-text-mail.log-expected.json @@ -15,7 +15,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "111" @@ -48,7 +48,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -80,7 +80,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -109,12 +109,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "\"Warning \u003cSystem\u003e cisco.esa: URL category definitions have changed.; Added new category '...\"", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -153,7 +155,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -191,7 +193,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "6" @@ -223,11 +225,13 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "6" }, @@ -259,12 +263,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "6", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -294,11 +300,13 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "example.com" + "address": [ + "example.com" + ] }, "message_id": "6" }, @@ -330,7 +338,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -362,7 +370,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -401,7 +409,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "6" @@ -435,7 +443,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "message_id": "6" @@ -468,7 +476,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -498,7 +506,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -527,12 +535,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "Warning \u003cSystem\u003e example.com: Your \"IronPort Email Encryption\" key will expire in under 60...", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -563,7 +573,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -591,12 +601,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "'Warning \u003cSystem\u003e cisco.esa: Your \"Sophos Anti-Virus\" key will expire in under 60 day(s)....'", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -628,12 +640,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "subject": "'Warning \u003cSystem\u003e example.com: Your \"IronPort Email Encryption\" key will expire in under 60...': Unrecoverable error", "to": { - "address": "example.com" + "address": [ + "example.com" + ] } }, "event": { @@ -671,11 +685,13 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "to": { - "address": "example" + "address": [ + "example" + ] } }, "event": { diff --git a/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 40bc3b79b60..5aeb744705a 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Cisco Secure Email Gateway logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: _tmp.filepath value: '{{{log.file.path}}}' @@ -12,7 +12,7 @@ processors: field: _tmp.filepath if: ctx.log?.file?.path != null patterns: - - "^%{DATA}/%{WORD:cisco_secure_email_gateway.log.category.name}.@%{GREEDYDATA}.s$" + - '^%{DATA}[\\/]%{WORD:cisco_secure_email_gateway.log.category.name}.@%{GREEDYDATA}.s$' - rename: field: message target_field: event.original @@ -109,6 +109,14 @@ processors: - pipeline: name: '{{ IngestPipeline "pipeline_consolidated_event" }}' if: ctx.cisco_secure_email_gateway?.log?.category?.name == 'consolidated_event' + - set: + field: email.from.address + value: ['{{{email.from.address}}}'] + if: ctx.email?.from?.address instanceof String + - set: + field: email.to.address + value: ['{{{email.to.address}}}'] + if: ctx.email?.to?.address instanceof String - remove: field: - _tmp diff --git a/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/pipeline_consolidated_event.yml b/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/pipeline_consolidated_event.yml index ebcf2281af9..fc06195d95c 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/pipeline_consolidated_event.yml +++ b/packages/cisco_secure_email_gateway/data_stream/log/elasticsearch/ingest_pipeline/pipeline_consolidated_event.yml @@ -52,23 +52,29 @@ processors: (?:sourceHostName=%{DATA:source.domain} )?\ (?:ESASenderGroup=%{DATA:cisco_secure_email_gateway.log.esa.sender_group} )?\ (?:sourceAddress=%{IP:source.ip} )?\ - msg=('|\")%{DATA:email.subject}('|\")($|\\s)\ - (?:ESAURLDetails=%{DATA:cisco_secure_email_gateway.log.esa.url_details}($|\\s))?\ + msg=%{GREEDYDATA:_tmp.msg}$" + - ^%{GREEDYDATA:cisco_secure_email_gateway.log.message}$ + - grok: + field: _tmp.msg + if: ctx._tmp?.msg != null + patterns: + - "^['\"]%{DATA:email.subject}['\"](?:$|\\s)\ + (?:ESAURLDetails=%{DATA:cisco_secure_email_gateway.log.esa.url_details}(?:$|\\s))?\ (?:ESATLSInCipher=%{DATA:cisco_secure_email_gateway.log.esa.tls.in.cipher} )?\ (?:ESATLSInConnStatus=%{WORD:cisco_secure_email_gateway.log.esa.tls.in.connection_status} )?\ (?:ESATLSInProtocol=%{DATA:cisco_secure_email_gateway.log.esa.tls.in.protocol} )?\ (?:ESATLSOutCipher=%{DATA:cisco_secure_email_gateway.log.esa.tls.out.cipher} )?\ (?:ESATLSOutConnStatus=%{WORD:cisco_secure_email_gateway.log.esa.tls.out.connection_status} )?\ - (?:ESATLSOutProtocol=%{DATA:cisco_secure_email_gateway.log.esa.tls.out.protocol}($|\\s))?\ + (?:ESATLSOutProtocol=%{DATA:cisco_secure_email_gateway.log.esa.tls.out.protocol}(?:$|\\s))?\ (?:ESADaneHost=%{DATA:cisco_secure_email_gateway.log.esa.dane.host} )?\ - (?:ESADaneStatus=%{WORD:cisco_secure_email_gateway.log.esa.dane.status}($|\\s))?\ - (?:ESADHASource=%{IP:cisco_secure_email_gateway.log.esa.dha_source}($|\\s))?\ - (?:ESADMARCVerdict=%{WORD:cisco_secure_email_gateway.log.esa.dmarc_verdict}($|\\s))?\ - (?:cs5Label=%{DATA:cisco_secure_email_gateway.log.cs5_label}($|\\s))?\ - (?:cs5=%{DATA:cisco_secure_email_gateway.log.cs5}($|\\s))?\ - (?:ESAMARAction=%{DATA:cisco_secure_email_gateway.log.esa.mail_auto_remediation_action}($|\\s))?\ - (?:ESAMsgTooBigFromSender=%{WORD:cisco_secure_email_gateway.log.esa.msg_too_big_from_sender}($|\\s))?\ - (?:ESARateLimitedIP=%{GREEDYDATA:cisco_secure_email_gateway.log.esa.rate_limited_ip}($|\\s))?$" + (?:ESADaneStatus=%{WORD:cisco_secure_email_gateway.log.esa.dane.status}(?:$|\\s))?\ + (?:ESADHASource=%{IP:cisco_secure_email_gateway.log.esa.dha_source}(?:$|\\s))?\ + (?:ESADMARCVerdict=%{WORD:cisco_secure_email_gateway.log.esa.dmarc_verdict}(?:$|\\s))?\ + (?:cs5Label=%{DATA:cisco_secure_email_gateway.log.cs5_label}(?:$|\\s))?\ + (?:cs5=%{DATA:cisco_secure_email_gateway.log.cs5}(?:$|\\s))?\ + (?:ESAMARAction=%{DATA:cisco_secure_email_gateway.log.esa.mail_auto_remediation_action}(?:$|\\s))?\ + (?:ESAMsgTooBigFromSender=%{WORD:cisco_secure_email_gateway.log.esa.msg_too_big_from_sender}(?:$|\\s))?\ + (?:ESARateLimitedIP=%{GREEDYDATA:cisco_secure_email_gateway.log.esa.rate_limited_ip}(?:$|\\s))?$" - ^%{GREEDYDATA:cisco_secure_email_gateway.log.message}$ - kv: field: _tmp.details diff --git a/packages/cisco_secure_email_gateway/data_stream/log/fields/fields.yml b/packages/cisco_secure_email_gateway/data_stream/log/fields/fields.yml index e768df21ef6..1bff799d379 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/fields/fields.yml +++ b/packages/cisco_secure_email_gateway/data_stream/log/fields/fields.yml @@ -164,8 +164,8 @@ description: Disk I/O Utilization. - name: disposition type: keyword - description: "" - The file reputation disposition values are: MALICIOUS CLEAN FILE UNKNOWN - When the reputation score is zero. VERDICT UNKNOWN - When the disposition is FILE UNKNOWN and score is non-zero. LOW RISK - When no dynamic content is found in a file after file analysis, the verdict is Low Risk. The file is not sent for file analysis, and the message continues through the email pipeline. + description: >- + The file reputation disposition values are: MALICIOUS CLEAN FILE UNKNOWN - When the reputation score is zero. VERDICT UNKNOWN - When the disposition is FILE UNKNOWN and score is non-zero. LOW RISK - When no dynamic content is found in a file after file analysis, the verdict is Low Risk. The file is not sent for file analysis, and the message continues through the email pipeline. - name: dns type: group fields: @@ -281,8 +281,6 @@ type: keyword - name: msg_too_big type: keyword - - name: rate_limited_ip - type: keyword - name: estimated type: group fields: @@ -516,8 +514,8 @@ The upload action value recommended by the file reputation server to take on the given file 0 - Need not send for upload. 1 - Send file for upload. Note The email gateway uploads the file when the upload action value is ‘1.’. 2 - Do not send file for upload. 3 - Send only metadata for upload. - name: priority type: keyword - description: "" - Upload priority values are: High - For all selected file types, except PDF file type. Low - For only PDF file types. + description: >- + Upload priority values are: High - For all selected file types, except PDF file type. Low - For only PDF file types. - name: verified type: keyword - name: vendor_action @@ -530,16 +528,9 @@ description: This is the number of messages currently in the work queue. - name: zone type: keyword -- name: filepath - type: keyword - name: log.file.path type: keyword description: File path from which the log event was read / sent from. - name: log.source.address type: keyword description: Source address from which the log event was read / sent from. -- name: type - type: keyword - description: Input type. -- name: input.type - type: keyword diff --git a/packages/cisco_secure_email_gateway/data_stream/log/sample_event.json b/packages/cisco_secure_email_gateway/data_stream/log/sample_event.json index 26c44e94126..90612095647 100644 --- a/packages/cisco_secure_email_gateway/data_stream/log/sample_event.json +++ b/packages/cisco_secure_email_gateway/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-03-17T18:24:37.000Z", "agent": { - "ephemeral_id": "ad16a5f3-74d8-4f65-96c6-5d2fd1d8d0c0", - "id": "057e0b9b-e20a-4d3b-9276-cb2e5cb7bb53", + "ephemeral_id": "8bbd9c9d-bc30-42ce-bf39-89d3f9b042c3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "cisco_secure_email_gateway": { "log": { @@ -21,12 +21,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "057e0b9b-e20a-4d3b-9276-cb2e5cb7bb53", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.6.0" + "version": "8.9.1" }, "email": { "attachments": { @@ -41,7 +41,7 @@ "event": { "agent_id_status": "verified", "dataset": "cisco_secure_email_gateway.log", - "ingested": "2023-04-07T06:11:54Z", + "ingested": "2023-08-29T17:41:06Z", "kind": "event", "timezone": "UTC" }, @@ -51,7 +51,7 @@ "log": { "level": "info", "source": { - "address": "172.30.0.7:52815" + "address": "172.21.0.4:41169" }, "syslog": { "priority": 166 diff --git a/packages/cisco_secure_email_gateway/docs/README.md b/packages/cisco_secure_email_gateway/docs/README.md index 5ceefddb570..7d6c21de689 100644 --- a/packages/cisco_secure_email_gateway/docs/README.md +++ b/packages/cisco_secure_email_gateway/docs/README.md @@ -202,11 +202,11 @@ An example event for `log` looks as following: { "@timestamp": "2023-03-17T18:24:37.000Z", "agent": { - "ephemeral_id": "ad16a5f3-74d8-4f65-96c6-5d2fd1d8d0c0", - "id": "057e0b9b-e20a-4d3b-9276-cb2e5cb7bb53", + "ephemeral_id": "8bbd9c9d-bc30-42ce-bf39-89d3f9b042c3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "cisco_secure_email_gateway": { "log": { @@ -222,12 +222,12 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "057e0b9b-e20a-4d3b-9276-cb2e5cb7bb53", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.6.0" + "version": "8.9.1" }, "email": { "attachments": { @@ -242,7 +242,7 @@ An example event for `log` looks as following: "event": { "agent_id_status": "verified", "dataset": "cisco_secure_email_gateway.log", - "ingested": "2023-04-07T06:11:54Z", + "ingested": "2023-08-29T17:41:06Z", "kind": "event", "timezone": "UTC" }, @@ -252,7 +252,7 @@ An example event for `log` looks as following: "log": { "level": "info", "source": { - "address": "172.30.0.7:52815" + "address": "172.21.0.4:41169" }, "syslog": { "priority": 166 @@ -328,7 +328,7 @@ An example event for `log` looks as following: | cisco_secure_email_gateway.log.details | Additional information. | text | | cisco_secure_email_gateway.log.device_direction | | keyword | | cisco_secure_email_gateway.log.disk_io | Disk I/O Utilization. | long | -| cisco_secure_email_gateway.log.disposition | | keyword | +| cisco_secure_email_gateway.log.disposition | The file reputation disposition values are: MALICIOUS CLEAN FILE UNKNOWN - When the reputation score is zero. VERDICT UNKNOWN - When the disposition is FILE UNKNOWN and score is non-zero. LOW RISK - When no dynamic content is found in a file after file analysis, the verdict is Low Risk. The file is not sent for file analysis, and the message continues through the email pipeline. | keyword | | cisco_secure_email_gateway.log.dns.hard_bounces | DNS Hard Bounces. | long | | cisco_secure_email_gateway.log.dns.requests | DNS Requests. | long | | cisco_secure_email_gateway.log.dropped_messages | Dropped Messages. | long | @@ -449,7 +449,7 @@ An example event for `log` looks as following: | cisco_secure_email_gateway.log.unattempted_recipients | Unattempted Recipients. | long | | cisco_secure_email_gateway.log.update.timestamp | The date and time at which the file analysis for the file is complete. | date | | cisco_secure_email_gateway.log.upload.action | The upload action value recommended by the file reputation server to take on the given file 0 - Need not send for upload. 1 - Send file for upload. Note The email gateway uploads the file when the upload action value is ‘1.’. 2 - Do not send file for upload. 3 - Send only metadata for upload. | keyword | -| cisco_secure_email_gateway.log.upload.priority | | keyword | +| cisco_secure_email_gateway.log.upload.priority | Upload priority values are: High - For all selected file types, except PDF file type. Low - For only PDF file types. | keyword | | cisco_secure_email_gateway.log.vendor_action | | keyword | | cisco_secure_email_gateway.log.verdict | The file retrospective verdict value is malicious or clean. | keyword | | cisco_secure_email_gateway.log.verified | | keyword | @@ -492,7 +492,6 @@ An example event for `log` looks as following: | event.module | Event module. | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| filepath | | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | @@ -513,7 +512,7 @@ An example event for `log` looks as following: | http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | | http.response.status_code | HTTP response status code. | long | | http.version | HTTP version. | keyword | -| input.type | | keyword | +| input.type | Input type. | keyword | | log.file.path | File path from which the log event was read / sent from. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.offset | Log offset. | long | @@ -528,7 +527,6 @@ An example event for `log` looks as following: | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.port | Port of the source. | long | | tags | List of keywords used to tag each event. | keyword | -| type | Input type. | keyword | | url.path | Path of the request, such as "/search". | wildcard | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | diff --git a/packages/cisco_secure_email_gateway/kibana/tags.yml b/packages/cisco_secure_email_gateway/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_secure_email_gateway/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_secure_email_gateway/manifest.yml b/packages/cisco_secure_email_gateway/manifest.yml index b109f29960e..174e2652e29 100644 --- a/packages/cisco_secure_email_gateway/manifest.yml +++ b/packages/cisco_secure_email_gateway/manifest.yml @@ -1,17 +1,16 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: cisco_secure_email_gateway title: Cisco Secure Email Gateway -version: "1.10.0" -license: basic +version: "1.14.0" description: Collect logs from Cisco Secure Email Gateway with Elastic Agent. type: integration categories: - security - network - email_security -release: ga conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/cisco-secure-email-gateway-screenshot.png title: Cisco Secure Email Gateway dashboard screenshot @@ -38,3 +37,4 @@ policy_templates: description: Collecting Cisco Secure Email Gateway logs via UDP input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_secure_endpoint/_dev/build/build.yml b/packages/cisco_secure_endpoint/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_secure_endpoint/_dev/build/build.yml +++ b/packages/cisco_secure_endpoint/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_secure_endpoint/changelog.yml b/packages/cisco_secure_endpoint/changelog.yml index 127b47ef307..d8900df6867 100644 --- a/packages/cisco_secure_endpoint/changelog.yml +++ b/packages/cisco_secure_endpoint/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 2.20.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.18.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "2.17.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "2.16.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "2.15.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp1.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp1.log-expected.json index d187821b035..18b5927204d 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp1.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp1.log-expected.json @@ -29,7 +29,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -114,7 +114,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -185,7 +185,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -290,7 +290,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -371,7 +371,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -456,7 +456,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -565,7 +565,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -666,7 +666,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -750,7 +750,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -842,7 +842,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -934,7 +934,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1026,7 +1026,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1118,7 +1118,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1210,7 +1210,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1300,7 +1300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225530" @@ -1381,7 +1381,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225530" @@ -1462,7 +1462,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225530" @@ -1543,7 +1543,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225530" @@ -1624,7 +1624,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225530" @@ -1706,7 +1706,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1812,7 +1812,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1897,7 +1897,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "File Fetch Completed", @@ -1992,7 +1992,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -2077,7 +2077,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected in Low Prevalence Executable", @@ -2156,7 +2156,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "File Fetch Completed", @@ -2241,7 +2241,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -2311,7 +2311,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2392,7 +2392,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -2471,7 +2471,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2557,7 +2557,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2744,7 +2744,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Vulnerable Application Detected", @@ -2825,7 +2825,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -2898,7 +2898,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -2990,7 +2990,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3076,7 +3076,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3160,7 +3160,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3242,7 +3242,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -3313,7 +3313,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3418,7 +3418,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3500,7 +3500,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3605,7 +3605,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3689,7 +3689,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3781,7 +3781,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3887,7 +3887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Vulnerable Application Detected", @@ -3992,7 +3992,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Vulnerable Application Detected", @@ -4127,7 +4127,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Vulnerable Application Detected", @@ -4208,7 +4208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -4279,7 +4279,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Scan Completed, No Detections", @@ -4345,7 +4345,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Scan Started", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp2.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp2.log-expected.json index f72cea3bf72..5e6cd93cc04 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp2.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp2.log-expected.json @@ -79,7 +79,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SecureX Threat Hunting Incident", @@ -174,7 +174,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -283,7 +283,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -389,7 +389,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -500,7 +500,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -615,7 +615,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -730,7 +730,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -845,7 +845,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -960,7 +960,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -1075,7 +1075,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DFC Threat Detected", @@ -1174,7 +1174,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1261,7 +1261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1360,7 +1360,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Multiple Infected Files", @@ -1445,7 +1445,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1542,7 +1542,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1635,7 +1635,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1730,7 +1730,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Executed malware", @@ -1818,7 +1818,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1915,7 +1915,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2008,7 +2008,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2101,7 +2101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2198,7 +2198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2295,7 +2295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2388,7 +2388,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2494,7 +2494,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Vulnerable Application Detected", @@ -2580,7 +2580,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2677,7 +2677,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2770,7 +2770,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2863,7 +2863,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2960,7 +2960,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3053,7 +3053,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3146,7 +3146,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3232,7 +3232,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3318,7 +3318,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3407,7 +3407,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3513,7 +3513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3610,7 +3610,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3703,7 +3703,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3796,7 +3796,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3884,7 +3884,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Executed malware", @@ -3969,7 +3969,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4055,7 +4055,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp3.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp3.log-expected.json index 0219edbb7e8..28405408083 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp3.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp3.log-expected.json @@ -29,7 +29,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -115,7 +115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -205,7 +205,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -295,7 +295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -385,7 +385,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -475,7 +475,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -565,7 +565,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -655,7 +655,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -745,7 +745,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -835,7 +835,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -925,7 +925,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1015,7 +1015,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1105,7 +1105,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1195,7 +1195,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1285,7 +1285,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1375,7 +1375,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1465,7 +1465,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1555,7 +1555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1641,7 +1641,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1731,7 +1731,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1821,7 +1821,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1914,7 +1914,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2020,7 +2020,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2113,7 +2113,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2219,7 +2219,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2312,7 +2312,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2418,7 +2418,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2507,7 +2507,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2613,7 +2613,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2699,7 +2699,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2785,7 +2785,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2882,7 +2882,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2975,7 +2975,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3072,7 +3072,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3169,7 +3169,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3262,7 +3262,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3359,7 +3359,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3445,7 +3445,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3538,7 +3538,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3624,7 +3624,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3710,7 +3710,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3796,7 +3796,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3893,7 +3893,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3986,7 +3986,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4083,7 +4083,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp4.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp4.log-expected.json index d5c3ff339ba..ee4414682c3 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp4.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp4.log-expected.json @@ -29,7 +29,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -121,7 +121,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Executed malware", @@ -208,7 +208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -292,7 +292,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -377,7 +377,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -479,7 +479,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -579,7 +579,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -679,7 +679,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -775,7 +775,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -853,7 +853,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -934,7 +934,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1018,7 +1018,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1102,7 +1102,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1186,7 +1186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1270,7 +1270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1354,7 +1354,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1438,7 +1438,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1522,7 +1522,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1606,7 +1606,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1690,7 +1690,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1774,7 +1774,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1858,7 +1858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -1942,7 +1942,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -2026,7 +2026,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -2110,7 +2110,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2194,7 +2194,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -2279,7 +2279,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2382,7 +2382,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2485,7 +2485,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2592,7 +2592,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2695,7 +2695,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -2773,7 +2773,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -2851,7 +2851,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -2929,7 +2929,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3007,7 +3007,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3088,7 +3088,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -3172,7 +3172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -3256,7 +3256,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -3340,7 +3340,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -3425,7 +3425,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3534,7 +3534,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3639,7 +3639,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3717,7 +3717,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3796,7 +3796,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3893,7 +3893,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3993,7 +3993,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4100,7 +4100,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4204,7 +4204,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4297,7 +4297,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4393,7 +4393,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4502,7 +4502,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4603,7 +4603,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -4666,7 +4666,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -4736,7 +4736,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4820,7 +4820,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4904,7 +4904,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4986,7 +4986,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -5072,7 +5072,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -5158,7 +5158,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -5246,7 +5246,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -5331,7 +5331,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5436,7 +5436,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5541,7 +5541,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -5622,7 +5622,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -5706,7 +5706,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -5787,7 +5787,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -5866,7 +5866,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -5952,7 +5952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -6038,7 +6038,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -6130,7 +6130,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -6214,7 +6214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6298,7 +6298,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -6382,7 +6382,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6466,7 +6466,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6550,7 +6550,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6634,7 +6634,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6718,7 +6718,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6802,7 +6802,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6886,7 +6886,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -6970,7 +6970,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -7054,7 +7054,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -7139,7 +7139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -7244,7 +7244,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -7348,7 +7348,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -7440,7 +7440,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -7521,7 +7521,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -7605,7 +7605,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -7689,7 +7689,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -7771,7 +7771,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -7868,7 +7868,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -7965,7 +7965,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8062,7 +8062,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8159,7 +8159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8256,7 +8256,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8353,7 +8353,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8450,7 +8450,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8547,7 +8547,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8644,7 +8644,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8744,7 +8744,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -8844,7 +8844,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp5.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp5.log-expected.json index c70f8ec82d4..a9cc797f3fa 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp5.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp5.log-expected.json @@ -32,7 +32,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -138,7 +138,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -222,7 +222,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225761" @@ -304,7 +304,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -400,7 +400,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -509,7 +509,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -614,7 +614,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -695,7 +695,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -777,7 +777,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -874,7 +874,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -970,7 +970,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -1051,7 +1051,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1135,7 +1135,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1219,7 +1219,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1300,7 +1300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -1379,7 +1379,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1465,7 +1465,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1555,7 +1555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1641,7 +1641,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1729,7 +1729,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225761" @@ -1810,7 +1810,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -1889,7 +1889,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1979,7 +1979,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2071,7 +2071,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2155,7 +2155,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2239,7 +2239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2321,7 +2321,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2407,7 +2407,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2493,7 +2493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2583,7 +2583,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2789,7 +2789,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detection", @@ -2868,7 +2868,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2952,7 +2952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3036,7 +3036,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3120,7 +3120,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3202,7 +3202,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3288,7 +3288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3374,7 +3374,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3460,7 +3460,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3546,7 +3546,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3632,7 +3632,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3718,7 +3718,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -3806,7 +3806,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3888,7 +3888,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3985,7 +3985,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4072,7 +4072,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4168,7 +4168,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -4249,7 +4249,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4334,7 +4334,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4435,7 +4435,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -4516,7 +4516,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4600,7 +4600,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -4682,7 +4682,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4775,7 +4775,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4868,7 +4868,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4961,7 +4961,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5054,7 +5054,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5147,7 +5147,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5240,7 +5240,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5333,7 +5333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5426,7 +5426,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -5518,7 +5518,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp6.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp6.log-expected.json index 20f0e2a8b08..6283fd11bec 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp6.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp6.log-expected.json @@ -31,7 +31,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -115,7 +115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -199,7 +199,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -283,7 +283,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -367,7 +367,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225761" @@ -451,7 +451,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -533,7 +533,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -629,7 +629,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -733,7 +733,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -826,7 +826,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -918,7 +918,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -996,7 +996,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -1074,7 +1074,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -1153,7 +1153,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1249,7 +1249,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1358,7 +1358,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1465,7 +1465,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1570,7 +1570,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1678,7 +1678,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1762,7 +1762,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1843,7 +1843,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -1922,7 +1922,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2008,7 +2008,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2094,7 +2094,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2189,7 +2189,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -2275,7 +2275,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -2354,7 +2354,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2444,7 +2444,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2532,7 +2532,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2614,7 +2614,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2714,7 +2714,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2816,7 +2816,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2912,7 +2912,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3018,7 +3018,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3115,7 +3115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3207,7 +3207,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3285,7 +3285,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3367,7 +3367,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3472,7 +3472,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Potential Dropper Infection", @@ -3547,7 +3547,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -3617,7 +3617,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3699,7 +3699,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3792,7 +3792,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3887,7 +3887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -3971,7 +3971,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4055,7 +4055,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4139,7 +4139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4223,7 +4223,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -4308,7 +4308,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4412,7 +4412,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -4504,7 +4504,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -4585,7 +4585,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -4669,7 +4669,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp7.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp7.log-expected.json index 6669f29de1f..3e1867f5ca3 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp7.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp7.log-expected.json @@ -31,7 +31,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -113,7 +113,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -206,7 +206,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -299,7 +299,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -396,7 +396,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -492,7 +492,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -573,7 +573,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -654,7 +654,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -733,7 +733,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -830,7 +830,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -916,7 +916,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -1007,7 +1007,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -1092,7 +1092,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected in Low Prevalence Executable", @@ -1168,7 +1168,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -1234,7 +1234,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "File Fetch Completed", @@ -1327,7 +1327,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1432,7 +1432,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -1513,7 +1513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -1598,7 +1598,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1703,7 +1703,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -1808,7 +1808,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -1882,7 +1882,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Policy Update", @@ -1952,7 +1952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Executed malware", @@ -2039,7 +2039,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Multiple Infected Files", @@ -2123,7 +2123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -2202,7 +2202,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", @@ -2294,7 +2294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2376,7 +2376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2471,7 +2471,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2555,7 +2555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225558" @@ -2639,7 +2639,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -2721,7 +2721,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -2813,7 +2813,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -2891,7 +2891,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -2970,7 +2970,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3063,7 +3063,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3159,7 +3159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Quarantined", @@ -3238,7 +3238,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3335,7 +3335,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3432,7 +3432,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3532,7 +3532,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", @@ -3641,7 +3641,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malicious Activity Detection", @@ -3748,7 +3748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3840,7 +3840,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -3932,7 +3932,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -4024,7 +4024,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -4113,7 +4113,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "3221225524" @@ -4194,7 +4194,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Quarantine", @@ -4273,7 +4273,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Retrospective Detection", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp8.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp8.log-expected.json index d434f064a81..352b1bb3719 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp8.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp8.log-expected.json @@ -38,7 +38,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -152,7 +152,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -268,7 +268,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -394,7 +394,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -522,7 +522,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", @@ -640,7 +640,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Cloud IOC", diff --git a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp9.log-expected.json b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp9.log-expected.json index 0a8ae925bbd..fb124f3424c 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp9.log-expected.json +++ b/packages/cisco_secure_endpoint/data_stream/event/_dev/test/pipeline/test-cisco-amp9.log-expected.json @@ -29,7 +29,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Threat Detected", diff --git a/packages/cisco_secure_endpoint/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_secure_endpoint/data_stream/event/elasticsearch/ingest_pipeline/default.yml index 4b20ab63043..14ea0fbe418 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_secure_endpoint/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -54,7 +54,7 @@ processors: ####################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: alert diff --git a/packages/cisco_secure_endpoint/data_stream/event/manifest.yml b/packages/cisco_secure_endpoint/data_stream/event/manifest.yml index 2df9a1f5125..0e0cd752a44 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/manifest.yml +++ b/packages/cisco_secure_endpoint/data_stream/event/manifest.yml @@ -27,6 +27,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -37,7 +38,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: url type: text @@ -49,7 +50,7 @@ streams: default: https://api.amp.cisco.com/v1/events?offset=0&limit=300 - name: limit type: text - title: Initial Interval + title: Maximum logs per request multi: false required: true show_user: false @@ -61,7 +62,7 @@ streams: multi: false required: true show_user: true - description: Initial Interval for first log pull + description: Initial Interval for first log pull. Supported units for this parameter are h/m/s. default: 24h - name: ssl type: yaml diff --git a/packages/cisco_secure_endpoint/data_stream/event/sample_event.json b/packages/cisco_secure_endpoint/data_stream/event/sample_event.json index dabd7db2c08..08f7d9bcc81 100644 --- a/packages/cisco_secure_endpoint/data_stream/event/sample_event.json +++ b/packages/cisco_secure_endpoint/data_stream/event/sample_event.json @@ -48,7 +48,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "49007565-f0ac-4df0-9672-50a3e25920e8", diff --git a/packages/cisco_secure_endpoint/docs/README.md b/packages/cisco_secure_endpoint/docs/README.md index 71c70f9838e..c401c6047ec 100644 --- a/packages/cisco_secure_endpoint/docs/README.md +++ b/packages/cisco_secure_endpoint/docs/README.md @@ -63,7 +63,7 @@ An example event for `event` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "49007565-f0ac-4df0-9672-50a3e25920e8", @@ -219,16 +219,16 @@ An example event for `event` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | file.hash.md5 | MD5 hash. | keyword | | file.hash.sha1 | SHA1 hash. | keyword | diff --git a/packages/cisco_secure_endpoint/kibana/tags.yml b/packages/cisco_secure_endpoint/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_secure_endpoint/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_secure_endpoint/manifest.yml b/packages/cisco_secure_endpoint/manifest.yml index fa7c63b09d2..5f712a17e6a 100644 --- a/packages/cisco_secure_endpoint/manifest.yml +++ b/packages/cisco_secure_endpoint/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: cisco_secure_endpoint title: Cisco Secure Endpoint -version: "2.15.0" +version: "2.20.0" description: Collect logs from Cisco Secure Endpoint (AMP) with Elastic Agent. type: integration categories: - security - edr_xdr conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/cisco.svg title: cisco @@ -24,3 +25,4 @@ policy_templates: description: Collecting logs from the Cisco Secure Endpoint API owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cisco_umbrella/_dev/build/build.yml b/packages/cisco_umbrella/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cisco_umbrella/_dev/build/build.yml +++ b/packages/cisco_umbrella/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cisco_umbrella/changelog.yml b/packages/cisco_umbrella/changelog.yml index 634c8f2a9f1..8f44347b612 100644 --- a/packages/cisco_umbrella/changelog.yml +++ b/packages/cisco_umbrella/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.18.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.15.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.14.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-auditlogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-auditlogs.log-expected.json index 12c37c3fca4..4d48f2d11d7 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-auditlogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-auditlogs.log-expected.json @@ -12,7 +12,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -77,7 +77,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -134,7 +134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log-expected.json index 3e943944851..0f7386a5190 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-cloudfirewalllogs.log-expected.json @@ -31,7 +31,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fw-connection-ALLOW", @@ -110,7 +110,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fw-connection-BLOCK", @@ -194,7 +194,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fw-connection-ALLOW", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log-expected.json index 17b3927bb5a..178eeed85ac 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dlplogs.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dlp-BLOCK", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log-expected.json index 74c691e9d44..c0b1e231cc5 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-dnslogs.log-expected.json @@ -33,7 +33,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -121,7 +121,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Blocked", @@ -203,7 +203,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -296,7 +296,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -380,7 +380,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -468,7 +468,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -552,7 +552,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -638,7 +638,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Blocked", @@ -716,7 +716,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -789,7 +789,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -866,7 +866,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -960,7 +960,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -1064,7 +1064,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -1162,7 +1162,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", @@ -1263,7 +1263,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-request-Allowed", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-intrusionlogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-intrusionlogs.log-expected.json index fd3d5973fd0..ea655664601 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-intrusionlogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-intrusionlogs.log-expected.json @@ -37,7 +37,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ips-Would-Block", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-iplogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-iplogs.log-expected.json index df6650786b0..b45d154f267 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-iplogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-iplogs.log-expected.json @@ -26,7 +26,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -87,7 +87,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", diff --git a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-proxylogs.log-expected.json b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-proxylogs.log-expected.json index 61f7bf95997..480cad7c057 100644 --- a/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-proxylogs.log-expected.json +++ b/packages/cisco_umbrella/data_stream/log/_dev/test/pipeline/test-umbrella-proxylogs.log-expected.json @@ -29,7 +29,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -125,7 +125,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -201,7 +201,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -311,7 +311,7 @@ "ip": "89.160.20.130" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -418,7 +418,7 @@ "ip": "1.128.2.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -540,7 +540,7 @@ "ip": "67.43.156.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -651,7 +651,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -759,7 +759,7 @@ "ip": "67.43.156.205" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-HEAD", @@ -856,7 +856,7 @@ "ip": "67.43.156.205" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -965,7 +965,7 @@ "ip": "67.43.156.205" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -1074,7 +1074,7 @@ "ip": "67.43.156.205" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-HEAD", @@ -1183,7 +1183,7 @@ "ip": "67.43.156.205" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-HEAD", @@ -1294,7 +1294,7 @@ "ip": "67.43.156.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", @@ -1408,7 +1408,7 @@ "ip": "67.43.156.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", diff --git a/packages/cisco_umbrella/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_umbrella/data_stream/log/elasticsearch/ingest_pipeline/default.yml index ffad0a83179..67c714b596a 100644 --- a/packages/cisco_umbrella/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cisco_umbrella/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Cisco Umbrella processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Cisco diff --git a/packages/cisco_umbrella/data_stream/log/manifest.yml b/packages/cisco_umbrella/data_stream/log/manifest.yml index 0d055753d4d..f4f8dda13ca 100644 --- a/packages/cisco_umbrella/data_stream/log/manifest.yml +++ b/packages/cisco_umbrella/data_stream/log/manifest.yml @@ -111,14 +111,14 @@ streams: multi: false required: false show_user: false - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: API Timeout multi: false required: false show_user: false - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: fips_enabled type: bool title: Enable S3 FIPS diff --git a/packages/cisco_umbrella/data_stream/log/sample_event.json b/packages/cisco_umbrella/data_stream/log/sample_event.json index 9b5bf115757..e2e1e37ff18 100644 --- a/packages/cisco_umbrella/data_stream/log/sample_event.json +++ b/packages/cisco_umbrella/data_stream/log/sample_event.json @@ -34,7 +34,7 @@ "ip": "67.43.156.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", diff --git a/packages/cisco_umbrella/docs/README.md b/packages/cisco_umbrella/docs/README.md index db5ae5701c9..0712350881c 100644 --- a/packages/cisco_umbrella/docs/README.md +++ b/packages/cisco_umbrella/docs/README.md @@ -52,7 +52,7 @@ An example event for `log` looks as following: "ip": "67.43.156.204" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "proxy-request-GET", diff --git a/packages/cisco_umbrella/kibana/tags.yml b/packages/cisco_umbrella/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cisco_umbrella/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cisco_umbrella/manifest.yml b/packages/cisco_umbrella/manifest.yml index 042e7fb314f..9179393e30e 100644 --- a/packages/cisco_umbrella/manifest.yml +++ b/packages/cisco_umbrella/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: cisco_umbrella title: Cisco Umbrella -version: "1.14.0" +version: "1.18.0" description: Collect logs from Cisco Umbrella with Elastic Agent. type: integration categories: @@ -9,7 +9,8 @@ categories: - security - dns_security conditions: - kibana.version: "^8.4.0" + kibana: + version: "^8.4.0" icons: - src: /img/cisco.svg title: cisco @@ -25,3 +26,4 @@ policy_templates: description: Collecting logs from Cisco Umbrella owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/citrix_adc/_dev/build/docs/README.md b/packages/citrix_adc/_dev/build/docs/README.md index b7b053bb8a0..8598f0ad860 100644 --- a/packages/citrix_adc/_dev/build/docs/README.md +++ b/packages/citrix_adc/_dev/build/docs/README.md @@ -45,8 +45,15 @@ After the integration is successfully configured, clicking on the Assets tab of ### Troubleshooting +#### Dummy values + There could be a possibility that for some of the fields, Citrix ADC sets dummy values. For example, a field `cpuusagepcnt` is represented by `citrix_adc.system.cpu.utilization.pct`. `cpuusagepcnt` is set to `4294967295` for some [instances](https://github.com/citrix/citrix-adc-metrics-exporter/issues/44). If you also encounter it for some fields please reach out to the [Citrix ADC support team](https://support.citrix.com/plp/products/citrix_adc/tabs/popular-solutions). + +#### Type conflicts + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Interface``, ``LBVserver``, ``Service``, ``System``, and ``VPN`` data stream's indices. + ## Metrics reference ### Interface diff --git a/packages/citrix_adc/changelog.yml b/packages/citrix_adc/changelog.yml index 061e97ee743..44e354f669e 100644 --- a/packages/citrix_adc/changelog.yml +++ b/packages/citrix_adc/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.0.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.0.0" + changes: + - description: Make Citrix ADC GA. + type: enhancement + link: https://github.com/elastic/integrations/pull/7664 +- version: "0.7.1" + changes: + - description: Resolve host.ip field conflict. + type: bugfix + link: https://github.com/elastic/integrations/pull/7509 - version: "0.7.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/citrix_adc/data_stream/interface/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/interface/elasticsearch/ingest_pipeline/default.yml index 337dc8f6039..0912b13bcd0 100644 --- a/packages/citrix_adc/data_stream/interface/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/interface/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/citrix_adc/data_stream/interface/fields/ecs.yml b/packages/citrix_adc/data_stream/interface/fields/ecs.yml index deeb666ad97..7d58f2030d8 100644 --- a/packages/citrix_adc/data_stream/interface/fields/ecs.yml +++ b/packages/citrix_adc/data_stream/interface/fields/ecs.yml @@ -14,6 +14,8 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: interface.id - external: ecs diff --git a/packages/citrix_adc/data_stream/lbvserver/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/lbvserver/elasticsearch/ingest_pipeline/default.yml index 9f8d7125b6d..2c7a0065fad 100644 --- a/packages/citrix_adc/data_stream/lbvserver/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/lbvserver/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/citrix_adc/data_stream/lbvserver/fields/ecs.yml b/packages/citrix_adc/data_stream/lbvserver/fields/ecs.yml index 9939b9e6997..51e27c040ef 100644 --- a/packages/citrix_adc/data_stream/lbvserver/fields/ecs.yml +++ b/packages/citrix_adc/data_stream/lbvserver/fields/ecs.yml @@ -14,6 +14,8 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: related.ip - external: ecs diff --git a/packages/citrix_adc/data_stream/service/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/service/elasticsearch/ingest_pipeline/default.yml index 5ca194957a3..3863bce60fa 100644 --- a/packages/citrix_adc/data_stream/service/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/service/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/citrix_adc/data_stream/service/fields/ecs.yml b/packages/citrix_adc/data_stream/service/fields/ecs.yml index bbe5cd2ab75..0f8257bae5f 100644 --- a/packages/citrix_adc/data_stream/service/fields/ecs.yml +++ b/packages/citrix_adc/data_stream/service/fields/ecs.yml @@ -14,6 +14,8 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: related.ip - external: ecs diff --git a/packages/citrix_adc/data_stream/system/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/system/elasticsearch/ingest_pipeline/default.yml index e5188e0bb79..4e9a07c6460 100644 --- a/packages/citrix_adc/data_stream/system/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/system/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json @@ -124,10 +124,10 @@ processors: def bytes = (megabytes*1024*1024); return bytes; } - if(ctx.citrix_adc?.system?.memory?.size?.value!=null || ctx.citrix_adc?.system?.memory?.size?.value!=""){ + if(ctx.citrix_adc?.system?.memory?.size?.value!=null && ctx.citrix_adc?.system?.memory?.size?.value!=""){ ctx.citrix_adc.system.memory.size.value = convert(ctx.citrix_adc.system.memory.size.value); } - if(ctx.citrix_adc?.system?.memory?.usage?.value!=null || ctx.citrix_adc?.system?.memory?.usage?.value!=""){ + if(ctx.citrix_adc?.system?.memory?.usage?.value!=null && ctx.citrix_adc?.system?.memory?.usage?.value!=""){ ctx.citrix_adc.system.memory.usage.value = convert(ctx.citrix_adc.system.memory.usage.value); } - script: diff --git a/packages/citrix_adc/data_stream/system/fields/ecs.yml b/packages/citrix_adc/data_stream/system/fields/ecs.yml index cd6e234ba91..faa4f380cbf 100644 --- a/packages/citrix_adc/data_stream/system/fields/ecs.yml +++ b/packages/citrix_adc/data_stream/system/fields/ecs.yml @@ -14,5 +14,7 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: tags diff --git a/packages/citrix_adc/data_stream/vpn/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_adc/data_stream/vpn/elasticsearch/ingest_pipeline/default.yml index ca0d6fd4b0d..336639139ef 100644 --- a/packages/citrix_adc/data_stream/vpn/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_adc/data_stream/vpn/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/citrix_adc/data_stream/vpn/fields/ecs.yml b/packages/citrix_adc/data_stream/vpn/fields/ecs.yml index cd6e234ba91..faa4f380cbf 100644 --- a/packages/citrix_adc/data_stream/vpn/fields/ecs.yml +++ b/packages/citrix_adc/data_stream/vpn/fields/ecs.yml @@ -14,5 +14,7 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: tags diff --git a/packages/citrix_adc/docs/README.md b/packages/citrix_adc/docs/README.md index c0206fec4af..9b78a3cac81 100644 --- a/packages/citrix_adc/docs/README.md +++ b/packages/citrix_adc/docs/README.md @@ -45,8 +45,15 @@ After the integration is successfully configured, clicking on the Assets tab of ### Troubleshooting +#### Dummy values + There could be a possibility that for some of the fields, Citrix ADC sets dummy values. For example, a field `cpuusagepcnt` is represented by `citrix_adc.system.cpu.utilization.pct`. `cpuusagepcnt` is set to `4294967295` for some [instances](https://github.com/citrix/citrix-adc-metrics-exporter/issues/44). If you also encounter it for some fields please reach out to the [Citrix ADC support team](https://support.citrix.com/plp/products/citrix_adc/tabs/popular-solutions). + +#### Type conflicts + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Interface``, ``LBVserver``, ``Service``, ``System``, and ``VPN`` data stream's indices. + ## Metrics reference ### Interface @@ -257,6 +264,7 @@ An example event for `interface` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | interface.id | Interface ID as reported by an observer (typically SNMP interface ID). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -484,6 +492,7 @@ An example event for `lbvserver` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | related.ip | All of the IPs seen on your event. | ip | | | | server.ip | IP address of the server (IPv4 or IPv6). | ip | | | @@ -654,6 +663,7 @@ An example event for `service` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | related.ip | All of the IPs seen on your event. | ip | | | | service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | | | @@ -799,6 +809,7 @@ An example event for `system` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -1042,5 +1053,6 @@ An example event for `vpn` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.ip | Host ip addresses. | ip | | | input.type | Type of Filebeat input. | keyword | | | tags | List of keywords used to tag each event. | keyword | | diff --git a/packages/citrix_adc/manifest.yml b/packages/citrix_adc/manifest.yml index 625db966abc..239d9a41c67 100644 --- a/packages/citrix_adc/manifest.yml +++ b/packages/citrix_adc/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: citrix_adc title: Citrix ADC -version: "0.7.0" +version: "1.0.1" description: This Elastic integration collects metrics from Citrix ADC product. type: integration categories: diff --git a/packages/citrix_waf/_dev/build/build.yml b/packages/citrix_waf/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/citrix_waf/_dev/build/build.yml +++ b/packages/citrix_waf/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/citrix_waf/changelog.yml b/packages/citrix_waf/changelog.yml index cc0e14efd69..f29ee92c46e 100644 --- a/packages/citrix_waf/changelog.yml +++ b/packages/citrix_waf/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 - version: "1.7.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-cef.log-expected.json b/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-cef.log-expected.json index 7deac4c8126..22e6bd51748 100644 --- a/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-cef.log-expected.json +++ b/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-cef.log-expected.json @@ -34,7 +34,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -107,7 +107,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", @@ -181,7 +181,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "transformed", @@ -255,7 +255,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -331,7 +331,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", @@ -407,7 +407,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", @@ -480,7 +480,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "transformed", @@ -553,7 +553,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "transformed", @@ -626,7 +626,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", @@ -700,7 +700,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "not blocked", diff --git a/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json b/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json index aa006e8a8b3..223b8c55221 100644 --- a/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json +++ b/packages/citrix_waf/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json @@ -31,7 +31,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "60", @@ -69,7 +69,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5743593", @@ -107,7 +107,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "4471", @@ -145,7 +145,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "4472", @@ -183,7 +183,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "4473", @@ -221,7 +221,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "4474", diff --git a/packages/citrix_waf/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/citrix_waf/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 2b3954cd96d..b74239749b9 100644 --- a/packages/citrix_waf/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/citrix_waf/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Citrix Web App Firewall logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/citrix_waf/data_stream/log/sample_event.json b/packages/citrix_waf/data_stream/log/sample_event.json index bd65114729b..a720ce525b5 100644 --- a/packages/citrix_waf/data_stream/log/sample_event.json +++ b/packages/citrix_waf/data_stream/log/sample_event.json @@ -44,7 +44,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e30119bc-b47d-4e56-86e3-4a9683305c6e", diff --git a/packages/citrix_waf/docs/README.md b/packages/citrix_waf/docs/README.md index 0facea87e93..180a61a1d4d 100644 --- a/packages/citrix_waf/docs/README.md +++ b/packages/citrix_waf/docs/README.md @@ -95,7 +95,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e30119bc-b47d-4e56-86e3-4a9683305c6e", @@ -218,16 +218,16 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | diff --git a/packages/citrix_waf/kibana/tags.yml b/packages/citrix_waf/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/citrix_waf/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/citrix_waf/manifest.yml b/packages/citrix_waf/manifest.yml index e1688b30257..c3cbe4121ea 100644 --- a/packages/citrix_waf/manifest.yml +++ b/packages/citrix_waf/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: citrix_waf title: "Citrix Web App Firewall" -version: "1.7.0" +version: "1.10.0" description: Ingest events from Citrix Systems Web App Firewall. type: integration categories: @@ -9,7 +9,8 @@ categories: - security - web_application_firewall conditions: - kibana.version: "^8.3.0" + kibana: + version: "^8.3.0" icons: - src: /img/Citrix_Systems_logo.svg title: Citrix Systems @@ -36,3 +37,4 @@ policy_templates: description: Collecting logs from Citrix Web App Firewall via file owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cloud_defend/changelog.yml b/packages/cloud_defend/changelog.yml index f5015dc5d55..df5b1e665a9 100644 --- a/packages/cloud_defend/changelog.yml +++ b/packages/cloud_defend/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: "1.2.1-preview2" + changes: + - description: Updates manifest format version to 3.0.0. lifecycle.yml files added. + type: enhancement + link: https://github.com/elastic/integrations/pull/7805 +- version: "1.2.1-preview" + changes: + - description: Adds metrics-cloud_defend.heartbeat index + type: enhancement + link: https://github.com/elastic/integrations/pull/7571 +- version: "1.2.0" + changes: + - description: Release - Updates documentation to allow for new 'process blocking' feature. + type: enhancement + link: https://github.com/elastic/integrations/pull/7581 +- version: "1.2.0-preview" + changes: + - description: Updates documentation to allow for new 'process blocking' feature. + type: enhancement + link: https://github.com/elastic/integrations/pull/6987 +- version: "1.1.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/7047 - version: "1.0.7" changes: - description: Documentation fix. diff --git a/packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 8bfa2c46035..ee6dcb18451 100644 --- a/packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -23,6 +23,9 @@ processors: field: data_stream.type value: 'logs' on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/cloud_defend/data_stream/alerts/lifecycle.yml b/packages/cloud_defend/data_stream/alerts/lifecycle.yml new file mode 100644 index 00000000000..b56a81e81d7 --- /dev/null +++ b/packages/cloud_defend/data_stream/alerts/lifecycle.yml @@ -0,0 +1 @@ +data_retention: "30d" diff --git a/packages/cloud_defend/data_stream/file/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_defend/data_stream/file/elasticsearch/ingest_pipeline/default.yml index dde2f3363ec..a91f34319d4 100644 --- a/packages/cloud_defend/data_stream/file/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloud_defend/data_stream/file/elasticsearch/ingest_pipeline/default.yml @@ -23,6 +23,9 @@ processors: field: data_stream.type value: 'logs' on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/cloud_defend/data_stream/file/lifecycle.yml b/packages/cloud_defend/data_stream/file/lifecycle.yml new file mode 100644 index 00000000000..b56a81e81d7 --- /dev/null +++ b/packages/cloud_defend/data_stream/file/lifecycle.yml @@ -0,0 +1 @@ +data_retention: "30d" diff --git a/packages/cloud_defend/data_stream/heartbeat/agent/stream/stream.yml.hbs b/packages/cloud_defend/data_stream/heartbeat/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..1ab6fa7e7df --- /dev/null +++ b/packages/cloud_defend/data_stream/heartbeat/agent/stream/stream.yml.hbs @@ -0,0 +1 @@ +period: {{period}} diff --git a/packages/cloud_defend/data_stream/heartbeat/fields/base-fields.yml b/packages/cloud_defend/data_stream/heartbeat/fields/base-fields.yml new file mode 100644 index 00000000000..7c798f4534c --- /dev/null +++ b/packages/cloud_defend/data_stream/heartbeat/fields/base-fields.yml @@ -0,0 +1,12 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/cloud_defend/data_stream/heartbeat/fields/fields.yml b/packages/cloud_defend/data_stream/heartbeat/fields/fields.yml new file mode 100644 index 00000000000..6cb513091fd --- /dev/null +++ b/packages/cloud_defend/data_stream/heartbeat/fields/fields.yml @@ -0,0 +1,3 @@ +- name: cloud_defend.block_action_enabled + type: boolean + description: Indicates whether the policy configuring the current node contains blocking actions diff --git a/packages/cloud_defend/data_stream/heartbeat/lifecycle.yml b/packages/cloud_defend/data_stream/heartbeat/lifecycle.yml new file mode 100644 index 00000000000..b56a81e81d7 --- /dev/null +++ b/packages/cloud_defend/data_stream/heartbeat/lifecycle.yml @@ -0,0 +1 @@ +data_retention: "30d" diff --git a/packages/cloud_defend/data_stream/heartbeat/manifest.yml b/packages/cloud_defend/data_stream/heartbeat/manifest.yml new file mode 100644 index 00000000000..ceabe511d01 --- /dev/null +++ b/packages/cloud_defend/data_stream/heartbeat/manifest.yml @@ -0,0 +1,12 @@ +title: "Cloud Defend Liveness Heartbeat" +type: metrics +streams: + - input: cloud_defend/control + title: Cloud Defend Heartbeat + template_path: stream.yml.hbs + description: Collect liveness and uptime metrics for cloud defend + vars: + - name: period + type: text + title: Period + default: 30m diff --git a/packages/cloud_defend/data_stream/metrics/lifecycle.yml b/packages/cloud_defend/data_stream/metrics/lifecycle.yml new file mode 100644 index 00000000000..b56a81e81d7 --- /dev/null +++ b/packages/cloud_defend/data_stream/metrics/lifecycle.yml @@ -0,0 +1 @@ +data_retention: "30d" diff --git a/packages/cloud_defend/data_stream/process/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_defend/data_stream/process/elasticsearch/ingest_pipeline/default.yml index f4e96c34ab1..281a24ce12e 100644 --- a/packages/cloud_defend/data_stream/process/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloud_defend/data_stream/process/elasticsearch/ingest_pipeline/default.yml @@ -23,6 +23,9 @@ processors: field: data_stream.type value: 'logs' on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/cloud_defend/data_stream/process/lifecycle.yml b/packages/cloud_defend/data_stream/process/lifecycle.yml new file mode 100644 index 00000000000..b56a81e81d7 --- /dev/null +++ b/packages/cloud_defend/data_stream/process/lifecycle.yml @@ -0,0 +1 @@ +data_retention: "30d" diff --git a/packages/cloud_defend/docs/README.md b/packages/cloud_defend/docs/README.md index dc9678084b7..7534b6a6019 100644 --- a/packages/cloud_defend/docs/README.md +++ b/packages/cloud_defend/docs/README.md @@ -164,7 +164,7 @@ responses: | --------- | ----------- | | `log` | Sends events to the `logs-cloud_defend.file-*` data stream for `file` responses, and the `logs-cloud_defend.process-*` data stream for `process` responses. | | `alert` | Writes events (file or process) to the `logs-cloud_defend.alerts-*` data stream. | -| `block` | Prevents the system operation from proceeding. This blocking action happens *prior* to the execution of the event. It is required that the `alert` action be set if `block` is enabled. *Note: Currently `block` is only supported on file operations. Process blocking coming soon!* | +| `block` | Prevents the system operation from proceeding. This blocking action happens *prior* to the execution of the event. It is required that the `alert` action be set if `block` is enabled. ## Example @@ -319,7 +319,6 @@ The following fields are populated for all events where `event.category: process | [process.previous.executable](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-previous-executable) | '/bin/bash' | | [process.session_leader.args](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-args) | ['bash'] | | [process.session_leader.entity_id](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-entity-id) | 'NzgyOWYyNmQtYzJkMS00ZWFmLWExYWMtY2Q5Y2I5ZTEyZjc1LTE5MTU1MzUtMTY3OTMyODIzOQ==' | -| [process.session_leader.entry_meta.type](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-entry-meta-type) | 'container' | | [process.session_leader.executable](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-executable) | '/bin/bash' | | [process.session_leader.group.id](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-group-id) | '0' | | [process.session_leader.interactive](https://www.elastic.co/guide/en/ecs/current/ecs-process.html#field-process-interactive) | true | @@ -419,6 +418,6 @@ The following fields are populated for all events where `event.category: file` | File event exports | ✅ | ✅ | | Drift prevention | ✅ | ✅ | | Mount point awareness | ✅ | ✅ | -| Process blocking| Coming soon | Coming soon | +| Process blocking| ✅ | ✅ | | Network event exports | Coming soon | Coming soon | | Network blocking| Coming soon | Coming soon | diff --git a/packages/cloud_defend/manifest.yml b/packages/cloud_defend/manifest.yml index 4f5ea6e2071..77641a5b32b 100644 --- a/packages/cloud_defend/manifest.yml +++ b/packages/cloud_defend/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.3.0 +format_version: 3.0.0 name: cloud_defend title: "Defend for Containers" -version: 1.0.7 +version: 1.2.1-preview2 source: license: "Elastic-2.0" description: "Elastic Defend for Containers (BETA) provides cloud-native runtime protections for containerized environments." @@ -11,7 +11,8 @@ categories: - kubernetes - security conditions: - kibana.version: "^8.8.0" + kibana: + version: ^8.11.0 screenshots: - src: /img/control-policy-general-view-screenshot.png title: Control policy general view screenshot @@ -57,4 +58,5 @@ policy_templates: - match: [executableChanges] actions: [alert] owner: + type: elastic github: elastic/sec-cloudnative-integrations diff --git a/packages/cloud_security_posture/changelog.yml b/packages/cloud_security_posture/changelog.yml index 81c443e737b..20019c8273c 100644 --- a/packages/cloud_security_posture/changelog.yml +++ b/packages/cloud_security_posture/changelog.yml @@ -1,12 +1,60 @@ # newer versions go on top # version map: +# 1.6.x - 8.11.x # 1.5.x - 8.10.x # 1.4.x - 8.9.x # 1.3.x - 8.8.x # 1.2.x - 8.7.x - -- version: "1.5.0-preview21" +- version: "1.6.0-preview13" changes: + - description: Add support for Azure benchmark + type: enhancement + link: https://github.com/elastic/integrations/pull/7892 + - description: Add support for GCP organizations + type: enhancement + link: https://github.com/elastic/integrations/pull/7403 + - description: Add mapping to CSPM org fields + type: enhancement + link: https://github.com/elastic/integrations/pull/7818 +- version: "1.5.2" + changes: + - description: Refactor GCP credentials + type: enhancement + link: https://github.com/elastic/integrations/pull/7546 + - description: Validate OrganizationalUnitIds in CloudFormation + type: enhancement + link: https://github.com/elastic/integrations/pull/7605 +- version: "1.5.1" + changes: + - description: Bump version to 1.5.1 + type: enhancement + link: https://github.com/elastic/integrations/pull/7493 + - description: Remove capitalization and change type for tags + type: bugfix + link: https://github.com/elastic/integrations/pull/7485 +- version: "1.5.0" + changes: + - description: Add CIS GCP rule templates + type: enhancement + link: https://github.com/elastic/integrations/pull/7390 + - description: Remove default value for project id + type: bugfix + link: https://github.com/elastic/integrations/pull/7379 + - description: Add vulnerability mappings + type: enhancement + link: https://github.com/elastic/integrations/pull/1176 + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/7048 + - description: Add a cloudshell url for the GCP CSPM integration + type: enhancement + link: https://github.com/elastic/integrations/pull/7235 + - description: Added ingest processor to copy cluster_id to orchestrator.cluster.id + type: enhancement + link: https://github.com/elastic/integrations/pull/7185 + - description: Seperate KSPM and CSPM cloudformation templates + type: enhancement + link: https://github.com/elastic/integrations/pull/6899 - description: Modify CIS GCP config type: enhancement link: https://github.com/elastic/integrations/pull/6687 @@ -16,7 +64,7 @@ - description: Update CloudFormation template to use al2023 AMI and increased EBS volume size type: enhancement link: https://github.com/elastic/integrations/pull/6699 -- version: "1.4.0-preview22" +- version: "1.4.0" changes: - description: Populate new CloudFormation param ElasticArtifactServer type: enhancement diff --git a/packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs b/packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs index 6aa06e5fab5..df9ee14367a 100644 --- a/packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs +++ b/packages/cloud_security_posture/data_stream/findings/agent/stream/gcp.yml.hbs @@ -4,11 +4,17 @@ config: deployment: gcp benchmark: cis_gcp gcp: - project_id: {{project_id}} + {{#if gcp.project_id}} + project_id: {{gcp.project_id}} + {{/if}} + {{#if gcp.organization_id}} + organization_id: {{gcp.organization_id}} + {{/if}} + account_type: {{gcp.account_type}} credentials: - {{#if credentials_file}} - credentials_file_path: {{credentials_file}} + {{#if gcp.credentials.file}} + credentials_file_path: {{gcp.credentials.file}} + {{/if}} + {{#if gcp.credentials.json}} + credentials_json: '{{gcp.credentials.json}}' {{/if}} - {{#if credentials_json}} - credentials_json: '{{credentials_json}}' - {{/if}} \ No newline at end of file diff --git a/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml index caffca6aed2..71da37a8f5f 100644 --- a/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloud_security_posture/data_stream/findings/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,15 @@ processors: value: 'kspm' description: 'Backward compatibility cloudbeat version < 8.7' if: ctx.rule?.benchmark?.posture_type == null -on_failure: - set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + field: orchestrator.cluster.id + copy_from: cluster_id + description: 'Backward compatibility cloudbeat version < 8.8' + if: ctx.orchestrator?.cluster?.id == null +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/cloud_security_posture/data_stream/findings/fields/cloud.yml b/packages/cloud_security_posture/data_stream/findings/fields/cloud.yml new file mode 100644 index 00000000000..6d52c30820d --- /dev/null +++ b/packages/cloud_security_posture/data_stream/findings/fields/cloud.yml @@ -0,0 +1,8 @@ +# once introduced to ecs, these fields should be moved to ecs.yml +- name: cloud + type: group + fields: + - name: Organization.id + type: keyword + - name: Organization.name + type: keyword \ No newline at end of file diff --git a/packages/cloud_security_posture/data_stream/findings/manifest.yml b/packages/cloud_security_posture/data_stream/findings/manifest.yml index 77c610cce88..d765f964786 100644 --- a/packages/cloud_security_posture/data_stream/findings/manifest.yml +++ b/packages/cloud_security_posture/data_stream/findings/manifest.yml @@ -107,7 +107,7 @@ streams: show_user: false - name: aws.credentials.type type: text - title: Credential type + title: Credentials type multi: false required: false show_user: false @@ -122,6 +122,43 @@ streams: description: CIS Benchmark for Google Cloud Platform Foundation template_path: gcp.yml.hbs enabled: false + vars: + - name: gcp.account_type + type: text + title: Account Type + multi: false + required: true + show_user: false + - name: gcp.organization_id + type: text + title: Organization Id + multi: false + required: false + show_user: false + - name: gcp.project_id + type: text + title: Project Id + multi: false + required: false + show_user: true + - name: gcp.credentials.type + type: text + title: Credentials type + multi: false + required: false + show_user: false + - name: gcp.credentials.file + type: text + title: Credentials file + multi: false + required: false + show_user: true + - name: gcp.credentials.json + type: text + title: Credentials json + multi: false + required: false + show_user: true - input: cloudbeat/cis_azure title: CIS Azure Benchmark description: CIS Benchmark for Microsoft Azure Foundations diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml index 6f7216fc868..bcf1fe5c8c3 100644 --- a/packages/cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml @@ -1,10 +1,18 @@ --- description: Pipeline for cloudbeat vulnerabilities processors: -- set: - field: ecs.version - value: '8.6.0' + - set: + field: ecs.version + value: "8.6.0" + - set: + field: cloud.service.name + value: "AWS EC2" + description: "Adding vulnerability type for cloudbeat version < 8.10" + if: ctx.cloud?.service?.name == null on_failure: -- set: - field: error.message - value: '{{ _ingest.on_failure_message }}' + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/cloud.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/cloud.yml new file mode 100644 index 00000000000..10a3d10ea04 --- /dev/null +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/cloud.yml @@ -0,0 +1,19 @@ +- name: cloud + type: group + fields: + - name: service.name + type: keyword + - name: machine.type + type: keyword + - name: machine.Authentication.key + type: keyword + - name: machine.Launch_time + type: keyword + - name: machine.Image + type: keyword + - name: Tags + type: object + - name: availability_zone + type: keyword + - name: Security.security_groups + type: object diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml index a58b8a3064a..05d199513c1 100644 --- a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/ecs.yml @@ -80,6 +80,10 @@ external: ecs - name: cloud.account.name external: ecs +- name: cloud.instance.name + external: ecs +- name: cloud.instance.id + external: ecs - name: cloud.provider external: ecs - name: cloud.region diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/network.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/network.yml new file mode 100644 index 00000000000..3152379d5c5 --- /dev/null +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/network.yml @@ -0,0 +1,9 @@ +- name: network + type: group + fields: + - name: Private_ip + type: keyword + - name: Public_ip + type: keyword + - name: Mac_addresses + type: keyword diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/resource.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/resource.yml index 425eb9530e9..91525c1d26b 100644 --- a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/resource.yml +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/resource.yml @@ -1,3 +1,4 @@ +# Deprecated replaced by cloud.instance fields - name: resource type: group fields: diff --git a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml index 1ee67cb12db..dfb0ab8748f 100644 --- a/packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml +++ b/packages/cloud_security_posture/data_stream/vulnerabilities/fields/vulnerability.yml @@ -1,6 +1,7 @@ - name: vulnerability type: group fields: + # Deprecated replaced by category - name: class type: keyword - name: package.version diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/05480064-f899-53e8-b8ad-34172b09b400.json b/packages/cloud_security_posture/kibana/csp_rule_template/05480064-f899-53e8-b8ad-34172b09b400.json new file mode 100644 index 00000000000..b42c608213d --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/05480064-f899-53e8-b8ad-34172b09b400.json @@ -0,0 +1,38 @@ +{ + "id": "05480064-f899-53e8-b8ad-34172b09b400", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Deleting user-managed Service Account Keys may break communication with the applications using the corresponding keys.", + "default_value": "", + "references": "1. https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys\n2. https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts", + "id": "05480064-f899-53e8-b8ad-34172b09b400", + "name": "Ensure That There Are Only GCP-Managed Service Account Keys for Each Service Account", + "profile_applicability": "* Level 1", + "description": "User managed service accounts should not have user-managed keys.", + "rationale": "Anyone who has access to the keys will be able to access resources through the service account.\n\nGCP-managed keys are used by Cloud Platform services such as App Engine and Compute Engine.\nThese keys cannot be downloaded.\nGoogle will keep the keys and automatically rotate them on an approximately weekly basis.\nUser-managed keys are created, downloadable, and managed by users.\nThey expire 10 years from creation.\n\nFor user-managed keys, the user has to take ownership of key management activities which include:\n- Key storage\n- Key distribution\n- Key revocation\n- Key rotation\n- Protecting the keys from unauthorized users\n- Key recovery\n\nEven with key owner precautions, keys can be easily leaked by common development malpractices like checking keys into the source code or leaving them in the Downloads directory, or accidentally leaving them on support blogs/channels.\n\nIt is recommended to prevent user-managed service account keys.", + "audit": "**From Google Cloud Console**\n\n1. Go to the IAM page in the GCP Console using `https://console.cloud.google.com/iam-admin/iam`\n\n2. In the left navigation pane, click `Service accounts`. All service accounts and their corresponding keys are listed.\n\n3. Click the service accounts and check if keys exist.\n\n**From Google Cloud CLI**\n\nList All the service accounts:\n\n```\ngcloud iam service-accounts list\n```\nIdentify user-managed service accounts as such account `EMAIL` ends with `iam.gserviceaccount.com`\n\nFor each user-managed service account, list the keys managed by the user:\n```\ngcloud iam service-accounts keys list --iam-account= --managed-by=user\n```\nNo keys should be listed.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the IAM page in the GCP Console using `https://console.cloud.google.com/iam-admin/iam`\n\n2. In the left navigation pane, click `Service accounts`. All service accounts and their corresponding keys are listed.\n\n3. Click the service account.\n\n4. Click the `edit` and delete the keys.\n\n**From Google Cloud CLI**\n\nTo delete a user managed Service Account Key,\n\n```\ngcloud iam service-accounts keys delete --iam-account= \n```\n\n**Prevention:**\nYou can disable service account key creation through the `Disable service account key creation` Organization policy by visiting [https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountKeyCreation](https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountKeyCreation).\nLearn more at: [https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts](https://cloud.google.com/resource-manager/docs/organization-policy/restricting-service-accounts)\n\nIn addition, if you do not need to have service accounts in your project, you can also prevent the creation of service accounts through the `Disable service account creation` Organization policy: [https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountCreation](https://console.cloud.google.com/iam-admin/orgpolicies/iam-disableServiceAccountCreation).", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.4", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/0e318770-7077-5996-afd8-27ca34fc5446.json b/packages/cloud_security_posture/kibana/csp_rule_template/0e318770-7077-5996-afd8-27ca34fc5446.json new file mode 100644 index 00000000000..bec1996b82e --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/0e318770-7077-5996-afd8-27ca34fc5446.json @@ -0,0 +1,38 @@ +{ + "id": "0e318770-7077-5996-afd8-27ca34fc5446", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/vpc/docs/firewalls", + "id": "0e318770-7077-5996-afd8-27ca34fc5446", + "name": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes", + "profile_applicability": "* Level 2", + "description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.", + "rationale": "Monitoring for Create or Update Firewall rule events gives insight to network access changes and may reduce the time it takes to detect suspicious activity.", + "audit": "**From Google Cloud Console**\n\n**Ensure that the prescribed log metric is present:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure at least one metric `` is present with this filter text:\n\n```\nresource.type=\"gce_firewall_rule\" \nAND (protoPayload.methodName:\"compute.firewalls.patch\" \nOR protoPayload.methodName:\"compute.firewalls.insert\"\nOR protoPayload.methodName:\"compute.firewalls.delete\")\n```\n\n**Ensure that the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that appropriate notification channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure that the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to: \n\n```\nresource.type=\"gce_firewall_rule\" \nAND (protoPayload.methodName:\"compute.firewalls.patch\" \nOR protoPayload.methodName:\"compute.firewalls.insert\"\nOR protoPayload.methodName:\"compute.firewalls.delete\")\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains an least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n\n```\nresource.type=\"gce_firewall_rule\" \nAND (protoPayload.methodName:\"compute.firewalls.patch\" \nOR protoPayload.methodName:\"compute.firewalls.insert\"\nOR protoPayload.methodName:\"compute.firewalls.delete\")\n```\n\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the prescribed Alert Policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page displays.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notifications channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed Log Metric\n- Use the command: gcloud logging metrics create \n\nCreate the prescribed alert policy: \n- Use the command: gcloud alpha monitoring policies create", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.7", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/1316108c-33a8-5198-9529-45716c5a87b1.json b/packages/cloud_security_posture/kibana/csp_rule_template/1316108c-33a8-5198-9529-45716c5a87b1.json new file mode 100644 index 00000000000..aefaf53fc81 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/1316108c-33a8-5198-9529-45716c5a87b1.json @@ -0,0 +1,38 @@ +{ + "id": "1316108c-33a8-5198-9529-45716c5a87b1", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/current/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT", + "id": "1316108c-33a8-5198-9529-45716c5a87b1", + "name": "Ensure That the \u2018Log_min_duration_statement\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set to \u2018-1\u2032 (Disabled)", + "profile_applicability": "* Level 1", + "description": "The `log_min_duration_statement` flag defines the minimum amount of execution time of a statement in milliseconds where the total duration of the statement is logged.\nEnsure that `log_min_duration_statement` is disabled, i.e., a value of `-1` is set.", + "rationale": "Logging SQL statements may include sensitive information that should not be recorded in logs.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page.\n3. Go to the `Configuration` card.\n4. Under `Database flags`, check that the value of `log_min_duration_statement` flag is set to `-1`.\n\n**From Google Cloud CLI**\n\n5. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_min_duration_statement` is set to `-1`.\n```\ngcloud sql instances list --format=json| jq '.settings.databaseFlags[] | select(.name==\"log_min_duration_statement\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the PostgreSQL instance where the database flag needs to be enabled.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_min_duration_statement` from the drop-down menu and set a value of `-1`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. List all Cloud SQL database instances using the following command:\n```\ngcloud sql instances list\n```\n9. Configure the `log_min_duration_statement` flag for every Cloud SQL PosgreSQL database instance using the below command:\n```\ngcloud sql instances patch --database-flags log_min_duration_statement=-1\n```\n```\nNote: This command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.7", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/15c6f217-2ae2-5bb4-8ebe-f40adf02910d.json b/packages/cloud_security_posture/kibana/csp_rule_template/15c6f217-2ae2-5bb4-8ebe-f40adf02910d.json index 76b8ef4c47b..ac3aefc25b6 100644 --- a/packages/cloud_security_posture/kibana/csp_rule_template/15c6f217-2ae2-5bb4-8ebe-f40adf02910d.json +++ b/packages/cloud_security_posture/kibana/csp_rule_template/15c6f217-2ae2-5bb4-8ebe-f40adf02910d.json @@ -12,7 +12,7 @@ "description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events.\nBy default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", "rationale": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity using Amazon CloudWatch Events.", "audit": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`\n2. In the left navigation panel, click `buckets` and then click on the S3 Bucket Name that you want to examine.\n3. Click `Properties` tab to see in detail bucket configuration.\n4. If the current status for `Object-level` logging is set to `Disabled`, then object-level logging of read events for the selected s3 bucket is not set.\n5. If the current status for `Object-level` logging is set to `Enabled`, but the Read event check-box is unchecked, then object-level logging of read events for the selected s3 bucket is not set.\n6. Repeat steps 2 to 5 to verify `object-level` logging for `read` events of your other S3 buckets.\n\n**From Command Line:**\n7. Run `describe-trails` command to list the names of all Amazon CloudTrail trails currently available in the selected AWS region:\n```\naws cloudtrail describe-trails --region --output table --query trailList[*].Name\n```\n8. The command output will be table of the requested trail names.\n9. Run `get-event-selectors` command using the name of the trail returned at the previous step and custom query filters to determine if Data events logging feature is enabled within the selected CloudTrail trail configuration for s3 bucket resources:\n```\naws cloudtrail get-event-selectors --region --trail-name --query EventSelectors[*].DataResources[]\n```\n10. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.\n11. If the `get-event-selectors` command returns an empty array, the Data events are not included into the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.\n12. Repeat steps 1 to 5 for auditing each s3 bucket to identify other trails that are missing the capability to log Data events.\n13. Change the AWS region by updating the `--region` command parameter and perform the audit process for other regions.", - "remediation": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`\n2. In the left navigation panel, click `buckets` and then click on the S3 Bucket Name that you want to examine.\n3. Click `Properties` tab to see in detail bucket configuration.\n4. Click on the `Object-level` logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link `https://console.aws.amazon.com/cloudtrail/`\n5. Once the Cloudtrail is selected, check the Read event checkbox, so that `object-level` logging for `Read` events is enabled.\n6. Repeat steps 2 to 5 to enable `object-level` logging of read events for other S3 buckets.\n\n**From Command Line:**\n7. To enable `object-level` data events logging for S3 buckets within your AWS account, run `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier:\n```\naws cloudtrail put-event-selectors --region --trail-name --event-selectors '[{ \"ReadWriteType\": \"ReadOnly\", \"IncludeManagementEvents\":true, \"DataResources\": [{ \"Type\": \"AWS::S3::Object\", \"Values\": [\"arn:aws:s3:::/\"] }] }]'\n```\n8. The command output will be `object-level` event trail configuration.\n9. If you want to enable it for all buckets at ones then change Values parameter to `[\"arn:aws:s3\"]` in command given above.\n10. Repeat step 1 for each s3 bucket to update `object-level` logging of read events.\n11. Change the AWS region by updating the `--region` command parameter and perform the process for other regions.", + "remediation": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`\n2. In the left navigation panel, click `buckets` and then click on the S3 Bucket Name that you want to examine.\n3. Click `Properties` tab to see in detail bucket configuration.\n4. Click on the `Object-level` logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link `https://console.aws.amazon.com/cloudtrail/`\n5. Once the Cloudtrail is selected, check the Read event checkbox, so that `object-level` logging for `Read` events is enabled.\n6. Repeat steps 2 to 5 to enable `object-level` logging of read events for other S3 buckets.\n\n**From Command Line:**\n7. To enable `object-level` data events logging for S3 buckets within your AWS account, run `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier:\n```\naws cloudtrail put-event-selectors --region --trail-name --event-selectors '[{\n \"ReadWriteType\": \"ReadOnly\",\n \"IncludeManagementEvents\": true,\n \"DataResources\": [\n {\n \"Type\": \"AWS::S3::Object\",\n \"Values\": [\n \"arn:aws:s3:::/\"\n ]\n }\n ]\n}]'\n```\n8. The command output will be `object-level` event trail configuration.\n9. If you want to enable it for all buckets at ones then change Values parameter to `[\"arn:aws:s3\"]` in command given above.\n10. Repeat step 1 for each s3 bucket to update `object-level` logging of read events.\n11. Change the AWS region by updating the `--region` command parameter and perform the process for other regions.", "section": "Logging", "version": "1.0", "tags": [ diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/23e5f81e-ca05-53bf-8109-7e676feecee3.json b/packages/cloud_security_posture/kibana/csp_rule_template/23e5f81e-ca05-53bf-8109-7e676feecee3.json new file mode 100644 index 00000000000..93ff774cb3a --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/23e5f81e-ca05-53bf-8109-7e676feecee3.json @@ -0,0 +1,38 @@ +{ + "id": "23e5f81e-ca05-53bf-8109-7e676feecee3", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "All Secure Shell (SSH) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where SSH access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to SSH port for the concerned VPC(s).", + "default_value": "", + "references": "1. https://cloud.google.com/vpc/docs/firewalls#blockedtraffic\n2. https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts", + "id": "23e5f81e-ca05-53bf-8109-7e676feecee3", + "name": "Ensure That SSH Access Is Restricted From the Internet", + "profile_applicability": "* Level 2", + "description": "GCP `Firewall Rules` are specific to a `VPC Network`.\nEach rule either `allows` or `denies` traffic when its conditions are met.\nIts conditions allow the user to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.\n\nFirewall rules are defined at the VPC network level and are specific to the network in which they are defined.\nThe rules themselves cannot be shared among networks.\nFirewall rules only support IPv4 traffic.\nWhen specifying a source for an ingress rule or a destination for an egress rule by address, only an `IPv4` address or `IPv4 block in CIDR` notation can be used.\nGeneric `(0.0.0.0/0)` incoming traffic from the internet to VPC or VM instance using `SSH` on `Port 22` can be avoided.", + "rationale": "GCP `Firewall Rules` within a `VPC Network` apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network.\nEgress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication).\nFor an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified.\nThis route simply defines the path to the Internet, to avoid the most general `(0.0.0.0/0)` destination `IP Range` specified from the Internet through `SSH` with the default `Port 22`.\nGeneric access from the Internet to a specific IP Range needs to be restricted.", + "audit": "**From Google Cloud Console**\n\n1. Go to `VPC network`.\n2. Go to the `Firewall Rules`.\n3. Ensure that `Port` is not equal to `22` and `Action` is not set to `Allow`.\n4. Ensure `IP Ranges` is not equal to `0.0.0.0/0` under `Source filters`.\n\n**From Google Cloud CLI**\n\n gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed)'\n\nEnsure that there is no rule matching the below criteria:\n- `SOURCE_RANGES` is `0.0.0.0/0`\n- AND `DIRECTION` is `INGRESS`\n- AND IPProtocol is `tcp` or `ALL`\n- AND `PORTS` is set to `22` or `range containing 22` or `Null (not set)`\n\nNote: \n- When ALL TCP ports are allowed in a rule, PORT does not have any value set (`NULL`)\n- When ALL Protocols are allowed in a rule, PORT does not have any value set (`NULL`)", + "remediation": "**From Google Cloud Console**\n\n1. Go to `VPC Network`.\n2. Go to the `Firewall Rules`.\n3. Click the `Firewall Rule` you want to modify.\n4. Click `Edit`.\n5. Modify `Source IP ranges` to specific `IP`.\n6. Click `Save`.\n\n**From Google Cloud CLI**\n\n7. 1.Update the Firewall rule with the new `SOURCE_RANGE` from the below command:\n\n gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.6", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/2b7b51e2-7e54-5b24-bc9c-6d09416fd5dc.json b/packages/cloud_security_posture/kibana/csp_rule_template/2b7b51e2-7e54-5b24-bc9c-6d09416fd5dc.json new file mode 100644 index 00000000000..8e77d7b5ad4 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/2b7b51e2-7e54-5b24-bc9c-6d09416fd5dc.json @@ -0,0 +1,38 @@ +{ + "id": "2b7b51e2-7e54-5b24-bc9c-6d09416fd5dc", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "`Regenerating Key` may break existing client connectivity as the client will try to connect with older API keys they have stored on devices.", + "default_value": "", + "references": "1. https://developers.google.com/maps/api-security-best-practices#regenerate-apikey\n2. https://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys", + "id": "2b7b51e2-7e54-5b24-bc9c-6d09416fd5dc", + "name": "Ensure API Keys Are Rotated Every 90 Days", + "profile_applicability": "* Level 2", + "description": "API Keys should only be used for services in cases where other authentication methods are unavailable.\nIf they are in use it is recommended to rotate API keys every 90 days.", + "rationale": "Security risks involved in using API-Keys are listed below:\n\n- API keys are simple encrypted strings\n\n- API keys do not identify the user or the application making the API request\n\n- API keys are typically accessible to clients, making it easy to discover and steal an API key\n\nBecause of these potential risks, Google recommends using the standard authentication flow instead of API Keys.\nHowever, there are limited cases where API keys are more appropriate.\nFor example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.\n\nOnce a key is stolen, it has no expiration, meaning it may be used indefinitely unless the project owner revokes or regenerates the key.\n\nRotating API keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used.\n\n\nAPI keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen.", + "audit": "**From Google Cloud Console**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the section `API Keys`, for every key ensure the `creation date` is less than 90 days.\n\n**From Google Cloud CLI**\n\nTo list keys, use the command\n\n```\ngcloud services api-keys list\n```\nEnsure the date in `createTime` is within 90 days.", + "remediation": "**From Google Cloud Console**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page.\n\n3. Click `REGENERATE KEY` to rotate API key.\n\n4. Click `Save`.\n\n5. Repeat steps 2,3,4 for every API key that has not been rotated in the last 90 days.\n\n**Note:** Do not set `HTTP referrers` to wild-cards (* or *.[TLD] or *.[TLD]/*) allowing access to any/wide HTTP referrer(s)\nDo not set `IP addresses` and referrer to `any host (0.0.0.0 or 0.0.0.0/0 or ::0)`\n\n**From Google Cloud CLI**\n\nThere is not currently a way to regenerate and API key using gcloud commands.\nTo 'regenerate' a key you will need to create a new one, duplicate the restrictions from the key being rotated, and delete the old key.\n\n6. List existing keys.\n```\ngcloud services api-keys list\n```\n7. Note the `UID` and restrictions of the key to regenerate.\n\n8. Run this command to create a new API key. is the display name of the new key.\n````\ngcloud alpha services api-keys create --display-name=\"\"\n````\nNote the `UID` of the newly created key\n\n9. Run the update command to add required restrictions. \n\nNote - the restriction may vary for each key.\nRefer to this documentation for the appropriate flags.\nhttps://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys/update\n```\ngcloud alpha services api-keys update \n```\n10. Delete the old key.\n```\ngcloud alpha services api-keys delete \n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.15", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.15", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_15" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/2f7d9d2a-ec1f-545a-8258-ea62bbffad7f.json b/packages/cloud_security_posture/kibana/csp_rule_template/2f7d9d2a-ec1f-545a-8258-ea62bbffad7f.json new file mode 100644 index 00000000000..9b3d1c80005 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/2f7d9d2a-ec1f-545a-8258-ea62bbffad7f.json @@ -0,0 +1,38 @@ +{ + "id": "2f7d9d2a-ec1f-545a-8258-ea62bbffad7f", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "In order to change service account or scope for an instance, it needs to be stopped.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances\n2. https://cloud.google.com/compute/docs/access/service-accounts", + "id": "2f7d9d2a-ec1f-545a-8258-ea62bbffad7f", + "name": "Ensure That Instances Are Not Configured To Use the Default Service Account With Full Access to All Cloud APIs", + "profile_applicability": "* Level 1", + "description": "To support principle of least privileges and prevent potential privilege escalation it is recommended that instances are not assigned to default service account `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`.", + "rationale": "Along with ability to optionally create, manage and use user managed custom service accounts, Google Compute Engine provides default service account `Compute Engine default service account` for an instances to access necessary cloud services.\n`Project Editor` role is assigned to `Compute Engine default service account` hence, This service account has almost all capabilities over all cloud services except billing.\nHowever, when `Compute Engine default service account` assigned to an instance it can operate in 3 scopes.\n\n```\n1. Allow default access: Allows only minimum access required to run an Instance (Least Privileges)\n\n2. Allow full access to all Cloud APIs: Allow full access to all the cloud APIs/Services (Too much access)\n\n3. Set access for each API: Allows Instance administrator to choose only those APIs that are needed to perform specific business functionality expected by instance\n```\n\nWhen an instance is configured with `Compute Engine default service account` with Scope `Allow full access to all Cloud APIs`, based on IAM roles assigned to the user(s) accessing Instance, it may allow user to perform cloud operations/API calls that user is not supposed to perform leading to successful privilege escalation.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n2. Click on each instance name to go to its `VM instance details` page.\n3. Under the `API and identity management`, ensure that `Cloud API access scopes` is not set to `Allow full access to all Cloud APIs`.\n\n**From Google Cloud CLI**\n\n4. List the instances in your project and get details on each instance:\n```\ngcloud compute instances list --format=json | jq -r '.\n| \"SA Scopes: \\(.[].serviceAccounts[].scopes) Name: \\(.[].name) Email: \\(.[].serviceAccounts[].email)\"'\n```\n5. Ensure that the service account section has an email that does not match the pattern `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.\n\n**Exception:**\nVMs created by GKE should be excluded.\nThese VMs have names that start with `gke-` and are labeled `goog-gke-node", + "remediation": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click on the impacted VM instance.\n\n3. If the instance is not stopped, click the `Stop` button. Wait for the instance to be stopped.\n\n4. Next, click the `Edit` button.\n\n5. Scroll down to the `Service Account` section.\n\n6. Select a different service account or ensure that `Allow full access to all Cloud APIs` is not selected.\n\n7. Click the `Save` button to save your changes and then click `START`.\n\n**From Google Cloud CLI**\n\n8. Stop the instance:\n```\ngcloud compute instances stop \n```\n9. Update the instance:\n```\ngcloud compute instances set-service-account --service-account= --scopes [SCOPE1, SCOPE2...]\n```\n10. Restart the instance:\n```\ngcloud compute instances start \n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.2", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/33299b3d-68da-5604-8c62-62690fd40c49.json b/packages/cloud_security_posture/kibana/csp_rule_template/33299b3d-68da-5604-8c62-62690fd40c49.json new file mode 100644 index 00000000000..12e8454c81a --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/33299b3d-68da-5604-8c62-62690fd40c49.json @@ -0,0 +1,38 @@ +{ + "id": "33299b3d-68da-5604-8c62-62690fd40c49", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/external-scripts-enabled-server-configuration-option?view=sql-server-ver15\n2. https://cloud.google.com/sql/docs/sqlserver/flags\n3. https://docs.microsoft.com/en-us/sql/advanced-analytics/concepts/security?view=sql-server-ver15\n4. https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79347", + "id": "33299b3d-68da-5604-8c62-62690fd40c49", + "name": "Ensure 'external scripts enabled' database flag for Cloud SQL SQL Server instance is set to 'off'", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `external scripts enabled` database flag for Cloud SQL SQL Server instance to `off`", + "rationale": "`external scripts enabled` enable the execution of scripts with certain remote language extensions.\nThis property is OFF by default.\nWhen Advanced Analytics Services is installed, setup can optionally set this property to true.\nAs the External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed, which could adversely affect the security of the system, hence this should be disabled.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `external scripts enabled` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"external scripts enabled\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `external scripts enabled` from the drop-down menu, and set its value to `off`.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `external scripts enabled` database flag for every Cloud SQL SQL Server database instance using the below command.\n```\ngcloud sql instances patch --database-flags \"external scripts enabled=off\"\n```\n\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.1", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/33a612ed-8dee-554d-9dd7-857bfc31a33a.json b/packages/cloud_security_posture/kibana/csp_rule_template/33a612ed-8dee-554d-9dd7-857bfc31a33a.json new file mode 100644 index 00000000000..fc0f2a54383 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/33a612ed-8dee-554d-9dd7-857bfc31a33a.json @@ -0,0 +1,38 @@ +{ + "id": "33a612ed-8dee-554d-9dd7-857bfc31a33a", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "If you enable uniform bucket-level access, you revoke access from users who gain their access solely through object ACLs.\n\nCertain Google Cloud services, such as Stackdriver, Cloud Audit Logs, and Datastore, cannot export to Cloud Storage buckets that have uniform bucket-level access enabled.", + "default_value": "", + "references": "1. https://cloud.google.com/storage/docs/uniform-bucket-level-access\n2. https://cloud.google.com/storage/docs/using-uniform-bucket-level-access\n3. https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket", + "id": "33a612ed-8dee-554d-9dd7-857bfc31a33a", + "name": "Ensure That Cloud Storage Buckets Have Uniform Bucket-Level Access Enabled", + "profile_applicability": "* Level 2", + "description": "It is recommended that uniform bucket-level access is enabled on Cloud Storage buckets.", + "rationale": "It is recommended to use uniform bucket-level access to unify and simplify how you grant access to your Cloud Storage resources.\n\n\nCloud Storage offers two systems for granting users permission to access your buckets and objects: Cloud Identity and Access Management (Cloud IAM) and Access Control Lists (ACLs).\nThese systems act in parallel - in order for a user to access a Cloud Storage resource, only one of the systems needs to grant the user permission.\nCloud IAM is used throughout Google Cloud and allows you to grant a variety of permissions at the bucket and project levels.\nACLs are used only by Cloud Storage and have limited permission options, but they allow you to grant permissions on a per-object basis.\n\nIn order to support a uniform permissioning system, Cloud Storage has uniform bucket-level access.\nUsing this feature disables ACLs for all Cloud Storage resources: access to Cloud Storage resources then is granted exclusively through Cloud IAM.\nEnabling uniform bucket-level access guarantees that if a Storage bucket is not publicly accessible, no object in the bucket is publicly accessible either.", + "audit": "**From Google Cloud Console**\n\n1. Open the Cloud Storage browser in the Google Cloud Console by visiting: [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser)\n\n2. For each bucket, make sure that `Access control` column has the value `Uniform`.\n\n**From Google Cloud CLI**\n\n3. List all buckets in a project\n```\ngsutil ls\n```\n4. For each bucket, verify that uniform bucket-level access is enabled.\n```\ngsutil uniformbucketlevelaccess get gs://BUCKET_NAME/\n```\nIf uniform bucket-level access is enabled, the response looks like:\n\n```\nUniform bucket-level access setting for gs://BUCKET_NAME/:\n Enabled: True\n LockedTime: LOCK_DATE\n```", + "remediation": "**From Google Cloud Console**\n\n1. Open the Cloud Storage browser in the Google Cloud Console by visiting: [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser)\n\n2. In the list of buckets, click on the name of the desired bucket.\n\n3. Select the `Permissions` tab near the top of the page.\n\n4. In the text box that starts with `This bucket uses fine-grained access control...`, click `Edit`.\n\n5. In the pop-up menu that appears, select `Uniform`.\n\n6. Click `Save`.\n\n**From Google Cloud CLI**\n\nUse the on option in a uniformbucketlevelaccess set command:\n\n```\ngsutil uniformbucketlevelaccess set on gs://BUCKET_NAME/\n```\n\n**Prevention**\n\nYou can set up an Organization Policy to enforce that any new bucket has uniform bucket level access enabled.\nLearn more at:\n[https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket](https://cloud.google.com/storage/docs/setting-org-policies#uniform-bucket)", + "section": "Storage", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 5.2", + "Storage" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "5.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_5_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/3bfcca47-de6a-57d4-961f-3c7f5b5f699c.json b/packages/cloud_security_posture/kibana/csp_rule_template/3bfcca47-de6a-57d4-961f-3c7f5b5f699c.json new file mode 100644 index 00000000000..21ad4d87fe1 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/3bfcca47-de6a-57d4-961f-3c7f5b5f699c.json @@ -0,0 +1,38 @@ +{ + "id": "3bfcca47-de6a-57d4-961f-3c7f5b5f699c", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/current/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT", + "id": "3bfcca47-de6a-57d4-961f-3c7f5b5f699c", + "name": "Ensure \u2018Log_statement\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set Appropriately", + "profile_applicability": "* Level 2", + "description": "The value of `log_statement` flag determined the SQL statements that are logged.\nValid values are:\n- `none`\n- `ddl`\n- `mod`\n- `all`\n\nThe value `ddl` logs all data definition statements.\nThe value `mod` logs all ddl statements, plus data-modifying statements.\n\nThe statements are logged after a basic parsing is done and statement type is determined, thus this does not logs statements with errors.\nWhen using extended query protocol, logging occurs after an Execute message is received and values of the Bind parameters are included.\n\nA value of 'ddl' is recommended unless otherwise directed by your organization's logging policy.", + "rationale": "Auditing helps in forensic analysis.\nIf `log_statement` is not set to the correct value, too many statements may be logged leading to issues in finding the relevant information from the logs, or too few statements may be logged with relevant information missing from the logs.\nSetting log_statement to align with your organization's security and logging policies facilitates later auditing and review of database activities.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Go to `Configuration` card\n4. Under `Database flags`, check the value of `log_statement` flag is set to appropriately.\n\n**From Google Cloud CLI**\n\n5. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_statement`\n```\ngcloud sql instances list --format=json | jq '.[].settings.databaseFlags[] | select(.name==\"log_statement\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the PostgreSQL instance for which you want to enable the database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_statement` from the drop-down menu and set appropriate value.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `log_statement` database flag for every Cloud SQL PosgreSQL database instance using the below command.\n```\ngcloud sql instances patch --database-flags log_statement=\n```\n```\nNote: This command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.4", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/3ed0b9d8-c5f2-55e2-92a5-2531868e79ca.json b/packages/cloud_security_posture/kibana/csp_rule_template/3ed0b9d8-c5f2-55e2-92a5-2531868e79ca.json index 87554772a07..eeb6c76bcda 100644 --- a/packages/cloud_security_posture/kibana/csp_rule_template/3ed0b9d8-c5f2-55e2-92a5-2531868e79ca.json +++ b/packages/cloud_security_posture/kibana/csp_rule_template/3ed0b9d8-c5f2-55e2-92a5-2531868e79ca.json @@ -12,7 +12,7 @@ "description": "S3 object-level API operations such as GetObject, DeleteObject, and PutObject are called data events.\nBy default, CloudTrail trails don't log data events and so it is recommended to enable Object-level logging for S3 buckets.", "rationale": "Enabling object-level logging will help you meet data compliance requirements within your organization, perform comprehensive security analysis, monitor specific patterns of user behavior in your AWS account or take immediate actions on any object-level API activity within your S3 Buckets using Amazon CloudWatch Events.", "audit": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to CloudTrail dashboard at `https://console.aws.amazon.com/cloudtrail/`\n2. In the left panel, click `Trails` and then click on the CloudTrail Name that you want to examine.\n3. Review `General details`\n4. Confirm that `Multi-region trail` is set to `Yes`\n5. Scroll down to `Data events`\n6. Confirm that it reads:\nData events: S3\nBucket Name: All current and future S3 buckets\nRead: Enabled\nWrite: Enabled\n7. Repeat steps 2 to 6 to verify that Multi-region trail and Data events logging of S3 buckets in CloudTrail.\nIf the CloudTrails do not have multi-region and data events configured for S3 refer to the remediation below.\n\n**From Command Line:**\n\n8. Run `list-trails` command to list the names of all Amazon CloudTrail trails currently available in all AWS regions:\n```\naws cloudtrail list-trails\n```\n9. The command output will be a list of all the trail names to include.\n\"TrailARN\": \"arn:aws:cloudtrail:::trail/\",\n\"Name\": \"\",\n\"HomeRegion\": \"\"\n10. Next run 'get-trail- command to determine Multi-region.\n```\naws cloudtrail get-trail --name --region \n```\n11. The command output should include:\n\"IsMultiRegionTrail\": true,\n12. Next run `get-event-selectors` command using the `Name` of the trail and the `region` returned in step 2 to determine if Data events logging feature is enabled within the selected CloudTrail trail for all S3 buckets:\n```\naws cloudtrail get-event-selectors --region --trail-name --query EventSelectors[*].DataResources[]\n```\n13. The command output should be an array that contains the configuration of the AWS resource(S3 bucket) defined for the Data events selector.\n\"Type\": \"AWS::S3::Object\",\n \"Values\": [\n \"arn:aws:s3\"\n14. If the `get-event-selectors` command returns an empty array '[]', the Data events are not included in the selected AWS Cloudtrail trail logging configuration, therefore the S3 object-level API operations performed within your AWS account are not recorded.\n15. Repeat steps 1 to 5 for auditing each CloudTrail to determine if Data events for S3 are covered.\nIf Multi-region is not set to true and the Data events does not show S3 defined as shown refer to the remediation procedure below.", - "remediation": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`\n2. In the left navigation panel, click `buckets` and then click on the S3 Bucket Name that you want to examine.\n3. Click `Properties` tab to see in detail bucket configuration.\n4. Click on the `Object-level` logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link `https://console.aws.amazon.com/cloudtrail/`\n5. Once the Cloudtrail is selected, check the `Write` event checkbox, so that `object-level` logging for Write events is enabled.\n6. Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.\n\n**From Command Line:**\n\n7. To enable `object-level` data events logging for S3 buckets within your AWS account, run `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier:\n```\naws cloudtrail put-event-selectors --region --trail-name --event-selectors '[{ \"ReadWriteType\": \"WriteOnly\", \"IncludeManagementEvents\":true, \"DataResources\": [{ \"Type\": \"AWS::S3::Object\", \"Values\": [\"arn:aws:s3:::/\"] }] }]'\n```\n8. The command output will be `object-level` event trail configuration.\n9. If you want to enable it for all buckets at once then change Values parameter to `[\"arn:aws:s3\"]` in command given above.\n10. Repeat step 1 for each s3 bucket to update `object-level` logging of write events.\n11. Change the AWS region by updating the `--region` command parameter and perform the process for other regions.", + "remediation": "**From Console:**\n\n1. Login to the AWS Management Console and navigate to S3 dashboard at `https://console.aws.amazon.com/s3/`\n2. In the left navigation panel, click `buckets` and then click on the S3 Bucket Name that you want to examine.\n3. Click `Properties` tab to see in detail bucket configuration.\n4. Click on the `Object-level` logging setting, enter the CloudTrail name for the recording activity. You can choose an existing Cloudtrail or create a new one by navigating to the Cloudtrail console link `https://console.aws.amazon.com/cloudtrail/`\n5. Once the Cloudtrail is selected, check the `Write` event checkbox, so that `object-level` logging for Write events is enabled.\n6. Repeat steps 2 to 5 to enable object-level logging of write events for other S3 buckets.\n\n**From Command Line:**\n\n7. To enable `object-level` data events logging for S3 buckets within your AWS account, run `put-event-selectors` command using the name of the trail that you want to reconfigure as identifier:\n```\naws cloudtrail put-event-selectors --region --trail-name --event-selectors '[{\n \"ReadWriteType\": \"WriteOnly\",\n \"IncludeManagementEvents\": true,\n \"DataResources\": [\n {\n \"Type\": \"AWS::S3::Object\",\n \"Values\": [\n \"arn:aws:s3:::/\"\n ]\n }\n ]\n}]'\n```\n8. The command output will be `object-level` event trail configuration.\n9. If you want to enable it for all buckets at once then change Values parameter to `[\"arn:aws:s3\"]` in command given above.\n10. Repeat step 1 for each s3 bucket to update `object-level` logging of write events.\n11. Change the AWS region by updating the `--region` command parameter and perform the process for other regions.", "section": "Logging", "version": "1.0", "tags": [ diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/40ab36e3-7438-5c36-afcd-bf5f5401366e.json b/packages/cloud_security_posture/kibana/csp_rule_template/40ab36e3-7438-5c36-afcd-bf5f5401366e.json new file mode 100644 index 00000000000..f0099606fd7 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/40ab36e3-7438-5c36-afcd-bf5f5401366e.json @@ -0,0 +1,38 @@ +{ + "id": "40ab36e3-7438-5c36-afcd-bf5f5401366e", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHEN", + "id": "40ab36e3-7438-5c36-afcd-bf5f5401366e", + "name": "Ensure \u2018Log_min_error_statement\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set to \u2018Error\u2019 or Stricter", + "profile_applicability": "* Level 1", + "description": "The `log_min_error_statement` flag defines the minimum message severity level that are considered as an error statement.\nMessages for error statements are logged with the SQL statement.\nValid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.\nEach severity level includes the subsequent levels mentioned above.\nEnsure a value of `ERROR` or stricter is set.", + "rationale": "Auditing helps in troubleshooting operational problems and also permits forensic analysis.\nIf `log_min_error_statement` is not set to the correct value, messages may not be classified as error messages appropriately.\nConsidering general log messages as error messages would make is difficult to find actual errors and considering only stricter severity levels as error messages may skip actual errors to log their SQL statements.\nThe `log_min_error_statement` flag should be set to `ERROR` or stricter.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Go to `Configuration` card\n4. Under `Database flags`, check the value of `log_min_error_statement` flag is configured as to `ERROR` or stricter.\n\n**From Google Cloud CLI**\n\n5. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_min_error_statement` is set to `ERROR` or stricter.\n```\ngcloud sql instances list --format=json | jq '.[].settings.databaseFlags[] | select(.name==\"log_min_error_statement\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the PostgreSQL instance for which you want to enable the database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_min_error_statement` from the drop-down menu and set appropriate value.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `log_min_error_statement` database flag for every Cloud SQL PosgreSQL database instance using the below command.\n```\ngcloud sql instances patch --database-flags log_min_error_statement=\n```\n```\nNote: This command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.6", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/421191d6-a13c-5c78-8c5b-102e1229655f.json b/packages/cloud_security_posture/kibana/csp_rule_template/421191d6-a13c-5c78-8c5b-102e1229655f.json new file mode 100644 index 00000000000..217c5d42f3d --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/421191d6-a13c-5c78-8c5b-102e1229655f.json @@ -0,0 +1,38 @@ +{ + "id": "421191d6-a13c-5c78-8c5b-102e1229655f", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "The removed role should be assigned to a different user based on business needs.", + "default_value": "", + "references": "1. https://cloud.google.com/iam/docs/service-accounts\n2. https://cloud.google.com/iam/docs/understanding-roles\n3. https://cloud.google.com/iam/docs/granting-roles-to-service-accounts", + "id": "421191d6-a13c-5c78-8c5b-102e1229655f", + "name": "Ensure That Separation of Duties Is Enforced While Assigning Service Account Related Roles to Users", + "profile_applicability": "* Level 2", + "description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning service-account related roles to users.", + "rationale": "The built-in/predefined IAM role `Service Account admin` allows the user/identity to create, delete, and manage service account(s).\nThe built-in/predefined IAM role `Service Account User` allows the user/identity (with adequate privileges on Compute and App Engine) to assign service account(s) to Apps/Compute Instances.\n\nSeparation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action.\nIn Cloud IAM - service accounts, this could be an action such as using a service account to access resources that user should not normally have access to.\n\nSeparation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors.\nIt is considered best practice.\n\nNo user should have `Service Account Admin` and `Service Account User` roles assigned at the same time.", + "audit": "**From Google Cloud Console**\n\n1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`.\n\n2. Ensure no member has the roles `Service Account Admin` and `Service account User` assigned together.\n\n**From Google Cloud CLI**\n\n3. List all users and role assignments:\n\n```\ngcloud projects get-iam-policy [Project_ID] --format json | \\\n jq -r '[\n ([\"Service_Account_Admin_and_User\"] | (., map(length*\"-\"))), \n (\n [\n .bindings[] | \n select(.role == \"roles/iam.serviceAccountAdmin\" or .role == \"roles/iam.serviceAccountUser\").members[]\n ] | \n group_by(.) | \n map({User: ., Count: length}) | \n .[] | \n select(.Count == 2).User | \n unique\n )\n ] | \n .[] | \n @tsv'\n```\n\n4. All common users listed under `Service_Account_Admin_and_User` are assigned both the `roles/iam.serviceAccountAdmin` and `roles/iam.serviceAccountUser` roles.", + "remediation": "**From Google Cloud Console**\n\n1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`.\n\n2. For any member having both `Service Account Admin` and `Service account User` roles granted/assigned, click the `Delete Bin` icon to remove either role from the member.\nRemoval of a role should be done based on the business requirements.", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.8", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.8", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_8" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/4931d684-a386-5545-b2c4-47b836e0149b.json b/packages/cloud_security_posture/kibana/csp_rule_template/4931d684-a386-5545-b2c4-47b836e0149b.json new file mode 100644 index 00000000000..e04565b3c28 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/4931d684-a386-5545-b2c4-47b836e0149b.json @@ -0,0 +1,38 @@ +{ + "id": "4931d684-a386-5545-b2c4-47b836e0149b", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Automated Backups will increase required size of storage and costs associated with it.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/mysql/backup-recovery/backups\n2. https://cloud.google.com/sql/docs/postgres/backup-recovery/backing-up", + "id": "4931d684-a386-5545-b2c4-47b836e0149b", + "name": "Ensure That Cloud SQL Database Instances Are Configured With Automated Backups", + "profile_applicability": "* Level 1", + "description": "It is recommended to have all SQL database instances set to enable automated backups.", + "rationale": "Backups provide a way to restore a Cloud SQL instance to recover lost data or recover from a problem with that instance.\nAutomated backups need to be set for any instance that contains data that should be protected from loss or damage.\nThis recommendation is applicable for SQL Server, PostgreSql, MySql generation 1 and MySql generation 2 instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Click the instance name to open its instance details page.\n3. Go to the `Backups` menu.\n4. Ensure that `Automated backups` is set to `Enabled` and `Backup time` is mentioned.\n\n**From Google Cloud CLI**\n\n5. List all Cloud SQL database instances using the following command:\n```\ngcloud sql instances list\n```\n\n6. Ensure that the below command returns `True` for every Cloud SQL database instance.\n```\ngcloud sql instances describe --format=\"value('Enabled':settings.backupConfiguration.enabled)\"\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance where the backups need to be configured.\n3. Click `Edit`.\n4. In the `Backups` section, check `Enable automated backups', and choose a backup window.\n5. Click `Save`.\n\n**From Google Cloud CLI**\n\n6. List all Cloud SQL database instances using the following command:\n```\ngcloud sql instances list\n```\n\n7. Enable `Automated backups` for every Cloud SQL database instance using the below command:\n```\ngcloud sql instances patch --backup-start-time <[HH:MM]>\n```\nThe `backup-start-time` parameter is specified in 24-hour time, in the UTC\u00b100 time zone, and specifies the start of a 4-hour backup window.\nBackups can start any time during the backup window.", + "section": "Cloud SQL Database Services", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.7", + "Cloud SQL Database Services" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/4a6a8b7a-d7a2-5a52-af5c-70009500bbc5.json b/packages/cloud_security_posture/kibana/csp_rule_template/4a6a8b7a-d7a2-5a52-af5c-70009500bbc5.json new file mode 100644 index 00000000000..b71fa320890 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/4a6a8b7a-d7a2-5a52-af5c-70009500bbc5.json @@ -0,0 +1,38 @@ +{ + "id": "4a6a8b7a-d7a2-5a52-af5c-70009500bbc5", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Removing the external IP address from your Compute instance may cause some applications to stop working.", + "default_value": "", + "references": "1. https://cloud.google.com/load-balancing/docs/backend-service#backends_and_external_ip_addresses\n2. https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances\n3. https://cloud.google.com/compute/docs/instances/connecting-to-instance\n4. https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#unassign_ip\n5. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints", + "id": "4a6a8b7a-d7a2-5a52-af5c-70009500bbc5", + "name": "Ensure That Compute Instances Do Not Have Public IP Addresses", + "profile_applicability": "* Level 2", + "description": "Compute instances should not be configured to have external IP addresses.", + "rationale": "To reduce your attack surface, Compute instances should not have public IP addresses.\nInstead, instances should be configured behind load balancers, to minimize the instance's exposure to the internet.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. For every VM, ensure that there is no `External IP` configured.\n\n**From Google Cloud CLI**\n\n```\ngcloud compute instances list --format=json\n```\n\n3. The output should not contain an `accessConfigs` section under `networkInterfaces`. Note that the `natIP` value is present only for instances that are running or for instances that are stopped but have a static IP address. For instances that are stopped and are configured to have an ephemeral public IP address, the `natIP` field will not be present. Example output:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n networkTier: STANDARD\n type: ONE_TO_ONE_NAT\n```\n\n**Exception:**\nInstances created by GKE should be excluded because some of them have external IP addresses and cannot be changed by editing the instance settings.\nInstances created by GKE should be excluded.\nThese instances have names that start with \"gke-\" and are labeled \"goog-gke-node\".", + "remediation": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click on the instance name to go the the `Instance detail page`.\n\n3. Click `Edit`.\n\n4. For each Network interface, ensure that `External IP` is set to `None`.\n\n5. Click `Done` and then click `Save`.\n\n**From Google Cloud CLI**\n\n6. Describe the instance properties:\n```\ngcloud compute instances describe --zone=\n```\n\n7. Identify the access config name that contains the external IP address. This access config appears in the following format:\n\n```\nnetworkInterfaces:\n- accessConfigs:\n - kind: compute#accessConfig\n name: External NAT\n natIP: 130.211.181.55\n type: ONE_TO_ONE_NAT\n```\n\n8. Delete the access config. \n```\ngcloud compute instances delete-access-config --zone= --access-config-name \n```\n\nIn the above example, the `ACCESS_CONFIG_NAME` is `External NAT`.\nThe name of your access config might be different.\n\n**Prevention:**\nYou can configure the `Define allowed external IPs for VM instances` Organization Policy to prevent VMs from being configured with public IP addresses.\nLearn more at: [https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess](https://console.cloud.google.com/orgpolicies/compute-vmExternalIpAccess)", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.9", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.9", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_9" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/4b11956d-7985-524e-900e-20405e2baaca.json b/packages/cloud_security_posture/kibana/csp_rule_template/4b11956d-7985-524e-900e-20405e2baaca.json new file mode 100644 index 00000000000..0a405c84bee --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/4b11956d-7985-524e-900e-20405e2baaca.json @@ -0,0 +1,38 @@ +{ + "id": "4b11956d-7985-524e-900e-20405e2baaca", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Deleting an API key will break dependent applications (if any).", + "default_value": "", + "references": "1. https://cloud.google.com/docs/authentication/api-keys\n2. https://cloud.google.com/sdk/gcloud/reference/services/api-keys/list\n3. https://cloud.google.com/docs/authentication\n4. https://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys/delete", + "id": "4b11956d-7985-524e-900e-20405e2baaca", + "name": "Ensure API Keys Only Exist for Active Services", + "profile_applicability": "* Level 2", + "description": "API Keys should only be used for services in cases where other authentication methods are unavailable.\nUnused keys with their permissions in tact may still exist within a project.\nKeys are insecure because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides.\nIt is recommended to use standard authentication flow instead.", + "rationale": "To avoid the security risk in using API keys, it is recommended to use standard authentication flow instead.\nSecurity risks involved in using API-Keys appear below:\n\n- API keys are simple encrypted strings\n\n- API keys do not identify the user or the application making the API request\n\n- API keys are typically accessible to clients, making it easy to discover and steal an API key", + "audit": "**From Console:**\n\n1. From within the Project you wish to audit Go to `APIs & Services\\Credentials`. \n\n2. In the section `API Keys`, no API key should be listed.\n\n**From Google Cloud Command Line**\n\n3. Run the following from within the project you wish to audit **`gcloud services api-keys list --filter`**.\n\n4. There should be no keys listed at the project level.", + "remediation": "**From Console:**\n\n1. Go to `APIs & Services\\Credentials` using\n\n2. In the section `API Keys`, to delete API Keys: Click the `Delete Bin Icon` in front of every `API Key Name`.\n\n**From Google Cloud Command Line**\n\n3. Run the following from within the project you wish to audit **`gcloud services api-keys list --filter`**\n\n4. **Pipe the results into ** \n``gcloud alpha services api-keys delete``", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.12", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.12", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_12" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/4da6e870-fed1-5822-bb2d-f6a1714bc4a8.json b/packages/cloud_security_posture/kibana/csp_rule_template/4da6e870-fed1-5822-bb2d-f6a1714bc4a8.json index 94b1f219ff2..fa324783c1c 100644 --- a/packages/cloud_security_posture/kibana/csp_rule_template/4da6e870-fed1-5822-bb2d-f6a1714bc4a8.json +++ b/packages/cloud_security_posture/kibana/csp_rule_template/4da6e870-fed1-5822-bb2d-f6a1714bc4a8.json @@ -11,7 +11,7 @@ "profile_applicability": "* Level 2", "description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you.\nThe recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources.\nIt is recommended AWS Config be enabled in all regions.", "rationale": "The AWS configuration item history captured by AWS Config enables security analysis, resource change tracking, and compliance auditing.", - "audit": "Process to evaluate AWS Config configuration per region\n\n**From Console:**\n\n1. Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/).\n2. On the top right of the console select target Region.\n3. If presented with Setup AWS Config - follow remediation procedure:\n4. On the Resource inventory page, Click on edit (the gear icon). The Set Up AWS Config page appears.\n5. Ensure 1 or both check-boxes under \"All Resources\" is checked.\n - Include global resources related to IAM resources - which needs to be enabled in 1 region only\n6. Ensure the correct S3 bucket has been defined.\n7. Ensure the correct SNS topic has been defined.\n8. Repeat steps 2 to 7 for each region.\n\n**From Command Line:**\n\n9. Run this command to show all AWS Config recorders and their properties:\n```\naws configservice describe-configuration-recorders\n```\n10. Evaluate the output to ensure that there's at least one recorder for which `recordingGroup` object includes `\"allSupported\": true` AND `\"includeGlobalResourceTypes\": true`\n\nNote: There is one more parameter \"ResourceTypes\" in recordingGroup object.\nWe don't need to check the same as whenever we set \"allSupported\": true, AWS enforces resource types to be empty (\"ResourceTypes\":[])\n\nSample Output:\n\n```\n{\n \"ConfigurationRecorders\": [\n {\n \"recordingGroup\": {\n \"allSupported\": true,\n \"resourceTypes\": [],\n \"includeGlobalResourceTypes\": true\n },\n \"roleARN\": \"arn:aws:iam:::role/service-role/\",\n \"name\": \"default\"\n }\n ]\n}\n```\n\n11. Run this command to show the status for all AWS Config recorders:\n```\naws configservice describe-configuration-recorder-status\n```\n12. In the output, find recorders with `name` key matching the recorders that met criteria in step 2. Ensure that at least one of them includes `\"recording\": true` and `\"lastStatus\": \"SUCCESS\"`", + "audit": "Process to evaluate AWS Config configuration per region\n\n**From Console:**\n\n1. Sign in to the AWS Management Console and open the AWS Config console at [https://console.aws.amazon.com/config/](https://console.aws.amazon.com/config/).\n2. On the top right of the console select target Region.\n3. If presented with Setup AWS Config - follow remediation procedure:\n4. On the Resource inventory page, Click on edit (the gear icon). The Set Up AWS Config page appears.\n5. Ensure 1 or both check-boxes under \"All Resources\" is checked.\n - Include global resources related to IAM resources - which needs to be enabled in 1 region only\n6. Ensure the correct S3 bucket has been defined.\n7. Ensure the correct SNS topic has been defined.\n8. Repeat steps 2 to 7 for each region.\n\n**From Command Line:**\n\n9. Run this command to show all AWS Config recorders and their properties:\n```\naws configservice describe-configuration-recorders\n```\n10. Evaluate the output to ensure that there's at least one recorder for which `recordingGroup` object includes `\"allSupported\": true` AND `\"includeGlobalResourceTypes\": true`\n\nNote: There is one more parameter \"ResourceTypes\" in recordingGroup object.\nWe don't need to check the same as whenever we set \"allSupported\": true, AWS enforces resource types to be empty (\"ResourceTypes\":[])\n\nSample Output:\n\n```\n{\n \"ConfigurationRecorders\": [\n {\n \"recordingGroup\": {\n \"allSupported\": true,\n \"resourceTypes\": [],\n \"includeGlobalResourceTypes\": true\n },\n \"roleARN\": \"arn:aws:iam:::role/service-role/\",\n \"name\": \"default\"\n }\n ]\n}\n```\n\n11. Run this command to show the status for all AWS Config recorders:\n```\naws configservice describe-configuration-recorder-status\n```\n12. In the output, find recorders with `name` key matching the recorders that met criteria in step 2. Ensure that at least one of them includes `\"recording\": true` and `\"lastStatus\": \"SUCCESS\"`", "remediation": "To implement AWS Config configuration:\n\n**From Console:**\n\n1. Select the region you want to focus on in the top right of the console\n2. Click `Services` \n3. Click `Config` \n4. Define which resources you want to record in the selected region\n5. Choose to include global resources (IAM resources)\n6. Specify an S3 bucket in the same account or in another managed AWS account\n7. Create an SNS Topic from the same AWS account or another managed AWS account\n\n**From Command Line:**\n\n8. Ensure there is an appropriate S3 bucket, SNS topic, and IAM role per the [AWS Config Service prerequisites](http://docs.aws.amazon.com/config/latest/developerguide/gs-cli-prereq.html).\n9. Run this command to set up the configuration recorder\n```\naws configservice subscribe --s3-bucket my-config-bucket --sns-topic arn:aws:sns:us-east-1:012345678912:my-config-notice --iam-role arn:aws:iam::012345678912:role/myConfigRole\n```\n10. Run this command to start the configuration recorder:\n```\nstart-configuration-recorder --configuration-recorder-name \n```", "section": "Logging", "version": "1.0", diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/4eb0d962-c123-575e-8c0c-9d10a2fbe5d1.json b/packages/cloud_security_posture/kibana/csp_rule_template/4eb0d962-c123-575e-8c0c-9d10a2fbe5d1.json new file mode 100644 index 00000000000..00396183c3e --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/4eb0d962-c123-575e-8c0c-9d10a2fbe5d1.json @@ -0,0 +1,38 @@ +{ + "id": "4eb0d962-c123-575e-8c0c-9d10a2fbe5d1", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting the threshold too low will might result in increased log storage size and length, making it difficult to find actual errors. Setting the threshold to 'Warning' will log messages for the most needed error messages. Higher severity levels may cause errors needed to troubleshoot to not be logged.\n\nNote: To effectively turn off logging failing statements, set this parameter to PANIC.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHEN", + "id": "4eb0d962-c123-575e-8c0c-9d10a2fbe5d1", + "name": "Ensure that the \u2018Log_min_messages\u2019 Flag for a Cloud SQL PostgreSQL Instance is set at minimum to 'Warning'", + "profile_applicability": "* Level 1", + "description": "The `log_min_messages` flag defines the minimum message severity level that is considered as an error statement.\nMessages for error statements are logged with the SQL statement.\nValid values include `DEBUG5`, `DEBUG4`, `DEBUG3`, `DEBUG2`, `DEBUG1`, `INFO`, `NOTICE`, `WARNING`, `ERROR`, `LOG`, `FATAL`, and `PANIC`.\nEach severity level includes the subsequent levels mentioned above.\nERROR is considered the best practice setting.\nChanges should only be made in accordance with the organization's logging policy.", + "rationale": "Auditing helps in troubleshooting operational problems and also permits forensic analysis.\nIf `log_min_messages` is not set to the correct value, messages may not be classified as error messages appropriately.\nAn organization will need to decide their own threshold for logging `log_min_messages` flag.\n\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page.\n3. Go to the `Configuration` card.\n4. Under `Database flags`, check the value of `log_min_messages` flag is in accordance with the organization's logging policy.\n\n**From Google Cloud CLI**\n\n5. Use the below command for every Cloud SQL PostgreSQL database instance to verify that the value of `log_min_messages` is in accordance with the organization's logging policy.\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"log_min_messages\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances)\n2. Select the PostgreSQL instance for which you want to enable the database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_min_messages` from the drop-down menu and set appropriate value.\n6. Click `Save` to save the changes.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `log_min_messages` database flag for every Cloud SQL PosgreSQL database instance using the below command.\n```\ngcloud sql instances patch --database-flags log_min_messages=\n```\n```\nNote: This command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.5", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/5d7e7fce-64fb-5b7b-beeb-920496c2e333.json b/packages/cloud_security_posture/kibana/csp_rule_template/5d7e7fce-64fb-5b7b-beeb-920496c2e333.json new file mode 100644 index 00000000000..13cad00cbf0 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/5d7e7fce-64fb-5b7b-beeb-920496c2e333.json @@ -0,0 +1,38 @@ +{ + "id": "5d7e7fce-64fb-5b7b-beeb-920496c2e333", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-connections-server-configuration-option?view=sql-server-ver15\n3. https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79119", + "id": "5d7e7fce-64fb-5b7b-beeb-920496c2e333", + "name": "Ensure 'user Connections' Database Flag for Cloud Sql Sql Server Instance Is Set to a Non-limiting Value", + "profile_applicability": "* Level 1", + "description": "It is recommended to check the `user connections` for a Cloud SQL SQL Server instance to ensure that it is not artificially limiting connections.", + "rationale": "The `user connections` option specifies the maximum number of simultaneous user connections that are allowed on an instance of SQL Server.\nThe actual number of user connections allowed also depends on the version of SQL Server that you are using, and also the limits of your application or applications and hardware.\nSQL Server allows a maximum of 32,767 user connections.\nBecause user connections is by default a self-configuring value, with SQL Server adjusting the maximum number of user connections automatically as needed, up to the maximum value allowable.\nFor example, if only 10 users are logged in, 10 user connection objects are allocated.\nIn most cases, you do not have to change the value for this option.\nThe default is 0, which means that the maximum (32,767) user connections are allowed.\nHowever if there is a number defined here that limits connections, SQL Server will not allow anymore above this limit.\nIf the connections are at the limit, any new requests will be dropped, potentially causing lost data or outages for those using the database.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `user connections` listed under the `Database flags` section is 0.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns a value of 0, for every Cloud SQL SQL Server database instance.\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"user connections\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `user connections` from the drop-down menu, and set its value to your organization recommended value.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `user connections` database flag for every Cloud SQL SQL Server database instance using the below command.\n```\ngcloud sql instances patch --database-flags \"user connections=[0-32,767]\"\n```\n\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.3", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/5de29f7b-ba03-5c77-81d9-7ea65ebd6a0f.json b/packages/cloud_security_posture/kibana/csp_rule_template/5de29f7b-ba03-5c77-81d9-7ea65ebd6a0f.json new file mode 100644 index 00000000000..5cccd8751d2 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/5de29f7b-ba03-5c77-81d9-7ea65ebd6a0f.json @@ -0,0 +1,38 @@ +{ + "id": "5de29f7b-ba03-5c77-81d9-7ea65ebd6a0f", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Changing flags on a database may cause it to be restarted. The best time to do this is at a time where there is low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/t-sql/database-console-commands/dbcc-traceon-trace-flags-transact-sql?view=sql-server-ver15#trace-flags\n3. https://github.com/ktaranov/sqlserver-kit/blob/master/SQL%20Server%20Trace%20Flag.md", + "id": "5de29f7b-ba03-5c77-81d9-7ea65ebd6a0f", + "name": "Ensure '3625 (trace flag)' database flag for all Cloud SQL Server instances is set to 'on'", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `3625 (trace flag)` database flag for Cloud SQL SQL Server instance to `on`.", + "rationale": "Microsoft SQL Trace Flags are frequently used to diagnose performance issues or to debug stored procedures or complex computer systems, but they may also be recommended by Microsoft Support to address behavior that is negatively impacting a specific workload.\nAll documented trace flags and those recommended by Microsoft Support are fully supported in a production environment when used as directed.\n`3625(trace log)` Limits the amount of information returned to users who are not members of the sysadmin fixed server role, by masking the parameters of some error messages using '******'.\nSetting this in a Google Cloud flag for the instance allows for security through obscurity and prevents the disclosure of sensitive information, hence this is recommended to set this flag globally to on to prevent the flag having been left off, or changed by bad actors.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `3625` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns `on` for every Cloud SQL SQL Server database instance\n\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"3625\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `3625` from the drop-down menu, and set its value to `on`.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `3625` database flag for every Cloud SQL SQL Server database instance using the below command.\n```\ngcloud sql instances patch --database-flags \"3625=on\"\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.6", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/5ee69b99-8f70-5daf-b784-866131aca3ba.json b/packages/cloud_security_posture/kibana/csp_rule_template/5ee69b99-8f70-5daf-b784-866131aca3ba.json index 5c3f94bdcdd..c37e4bdb544 100644 --- a/packages/cloud_security_posture/kibana/csp_rule_template/5ee69b99-8f70-5daf-b784-866131aca3ba.json +++ b/packages/cloud_security_posture/kibana/csp_rule_template/5ee69b99-8f70-5daf-b784-866131aca3ba.json @@ -12,7 +12,7 @@ "description": "AWS provides a support center that can be used for incident notification and response, as well as technical support and customer services.\nCreate an IAM Role to allow authorized users to manage incidents with AWS Support.", "rationale": "By implementing least privilege for access control, an IAM Role will require an appropriate IAM Policy to allow Support Center Access in order to manage Incidents with AWS Support.", "audit": "**From Command Line:**\n\n1. List IAM policies, filter for the 'AWSSupportAccess' managed policy, and note the \"Arn\" element value:\n```\naws iam list-policies --query \"Policies[?PolicyName == 'AWSSupportAccess']\"\n```\n2. Check if the 'AWSSupportAccess' policy is attached to any role:\n\n```\naws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess\n```\n\n3. In Output, Ensure `PolicyRoles` does not return empty. 'Example: Example: PolicyRoles: [ ]'\n\nIf it returns empty refer to the remediation below.", - "remediation": "**From Command Line:**\n\n1. Create an IAM role for managing incidents with AWS:\n - Create a trust relationship policy document that allows to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json:\n```\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n }\n```\n2. Create the IAM role using the above trust policy:\n```\naws iam create-role --role-name --assume-role-policy-document file:///tmp/TrustPolicy.json\n```\n3. Attach 'AWSSupportAccess' managed policy to the created IAM role:\n```\naws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name \n```", + "remediation": "**From Command Line:**\n\n1. Create an IAM role for managing incidents with AWS:\n - Create a trust relationship policy document that allows to manage AWS incidents, and save it locally as /tmp/TrustPolicy.json:\n```\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n}\n```\n2. Create the IAM role using the above trust policy:\n```\naws iam create-role --role-name --assume-role-policy-document file:///tmp/TrustPolicy.json\n```\n3. Attach 'AWSSupportAccess' managed policy to the created IAM role:\n```\naws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/AWSSupportAccess --role-name \n```", "section": "Identity and Access Management", "version": "1.0", "tags": [ diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/64d37675-473f-5edc-882e-5b8b85b789c3.json b/packages/cloud_security_posture/kibana/csp_rule_template/64d37675-473f-5edc-882e-5b8b85b789c3.json new file mode 100644 index 00000000000..c64c8c7f3dd --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/64d37675-473f-5edc-882e-5b8b85b789c3.json @@ -0,0 +1,38 @@ +{ + "id": "64d37675-473f-5edc-882e-5b8b85b789c3", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "After enforcing SSL connection, existing client will not be able to communicate with SQL server unless configured with appropriate client-certificates to communicate to SQL database instance.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/configure-ssl-instance/", + "id": "64d37675-473f-5edc-882e-5b8b85b789c3", + "name": "Ensure That the Cloud SQL Database Instance Requires All Incoming Connections To Use SSL", + "profile_applicability": "* Level 1", + "description": "It is recommended to enforce all incoming connections to SQL database instance to use SSL.", + "rationale": "SQL database connections if successfully trapped (MITM); can reveal sensitive data like credentials, database queries, query outputs etc.\nFor security, it is recommended to always use SSL encryption when connecting to your instance.\nThis recommendation is applicable for Postgresql, MySql generation 1, MySql generation 2 and SQL Server 2017 instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n\n2. Click on an instance name to see its configuration overview.\n\n3. In the left-side panel, select `Connections`.\n\n4. In the `SSL connections` section, ensure that `Only secured connections are allowed to connect to this instance.`.\n\n**From Google Cloud CLI**\n\n5. Get the detailed configuration for every SQL database instance using the following command:\n\n```\ngcloud sql instances list --format=json\n```\n\nEnsure that section `settings: ipConfiguration` has the parameter `requireSsl` set to `true`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n\n2. Click on an instance name to see its configuration overview.\n\n3. In the left-side panel, select `Connections`.\n\n4. In the `SSL connections` section, click `Allow only SSL connections`.\n\n5. Under `Configure SSL server certificates` click `Create new certificate`.\n\n6. Under `Configure SSL client certificates` click `Create a client certificate`. \n\n7. Follow the instructions shown to learn how to connect to your instance. \n\n**From Google Cloud CLI**\n\nTo enforce SSL encryption for an instance run the command:\n\n```\ngcloud sql instances patch --require-ssl\n```\n\nNote:\n`RESTART` is required for type MySQL Generation 1 Instances (`backendType: FIRST_GEN`) to get this configuration in effect.", + "section": "Cloud SQL Database Services", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.4", + "Cloud SQL Database Services" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/677bdabb-ee3f-58a6-82f6-d40ccc4efe13.json b/packages/cloud_security_posture/kibana/csp_rule_template/677bdabb-ee3f-58a6-82f6-d40ccc4efe13.json new file mode 100644 index 00000000000..0e023a03fe8 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/677bdabb-ee3f-58a6-82f6-d40ccc4efe13.json @@ -0,0 +1,38 @@ +{ + "id": "677bdabb-ee3f-58a6-82f6-d40ccc4efe13", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "After a successful key rotation, the older key version is required in order to decrypt the data encrypted by that previous key version.", + "default_value": "", + "references": "1. https://cloud.google.com/kms/docs/key-rotation#frequency_of_key_rotation\n2. https://cloud.google.com/kms/docs/re-encrypt-data", + "id": "677bdabb-ee3f-58a6-82f6-d40ccc4efe13", + "name": "Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days", + "profile_applicability": "* Level 1", + "description": "Google Cloud Key Management Service stores cryptographic keys in a hierarchical structure designed for useful and elegant access control management.\n\n\nThe format for the rotation schedule depends on the client library that is used.\nFor the gcloud command-line tool, the next rotation time must be in `ISO` or `RFC3339` format, and the rotation period must be in the form `INTEGER[UNIT]`, where units can be one of seconds (s), minutes (m), hours (h) or days (d).", + "rationale": "Set a key rotation period and starting time.\nA key can be created with a specified `rotation period`, which is the time between when new key versions are generated automatically.\nA key can also be created with a specified next rotation time.\nA key is a named object representing a `cryptographic key` used for a specific purpose.\nThe key material, the actual bits used for `encryption`, can change over time as new key versions are created.\n\nA key is used to protect some `corpus of data`.\nA collection of files could be encrypted with the same key and people with `decrypt` permissions on that key would be able to decrypt those files.\nTherefore, it's necessary to make sure the `rotation period` is set to a specific time.", + "audit": "**From Google Cloud Console**\n\n1. Go to `Cryptographic Keys` by visiting: [https://console.cloud.google.com/security/kms](https://console.cloud.google.com/security/kms).\n2. Click on each key ring, then ensure each key in the keyring has `Next Rotation` set for less than 90 days from the current date.\n\n**From Google Cloud CLI**\n\n3. Ensure rotation is scheduled by `ROTATION_PERIOD` and `NEXT_ROTATION_TIME` for each key :\n\n```\ngcloud kms keys list --keyring= --location= --format=json'(rotationPeriod)'\n```\n\nEnsure outcome values for `rotationPeriod` and `nextRotationTime` satisfy the below criteria:\n\n`rotationPeriod is <= 129600m` \n`rotationPeriod is <= 7776000s` \n`rotationPeriod is <= 2160h` \n`rotationPeriod is <= 90d` \n`nextRotationTime is <= 90days` from current DATE", + "remediation": "**From Google Cloud Console**\n\n1. Go to `Cryptographic Keys` by visiting: [https://console.cloud.google.com/security/kms](https://console.cloud.google.com/security/kms).\n2. Click on the specific key ring\n3. From the list of keys, choose the specific key and Click on `Right side pop up the blade (3 dots)`.\n4. Click on `Edit rotation period`.\n5. On the pop-up window, `Select a new rotation period` in days which should be less than 90 and then choose `Starting on` date (date from which the rotation period begins).\n\n**From Google Cloud CLI**\n\n6. Update and schedule rotation by `ROTATION_PERIOD` and `NEXT_ROTATION_TIME` for each key:\n\n```\ngcloud kms keys update new --keyring=KEY_RING --location=LOCATION --next-rotation-time=NEXT_ROTATION_TIME --rotation-period=ROTATION_PERIOD\n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.10", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.10", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_10" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/67909c46-649c-52c1-a464-b3e81615d938.json b/packages/cloud_security_posture/kibana/csp_rule_template/67909c46-649c-52c1-a464-b3e81615d938.json new file mode 100644 index 00000000000..dddb156f11c --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/67909c46-649c-52c1-a464-b3e81615d938.json @@ -0,0 +1,38 @@ +{ + "id": "67909c46-649c-52c1-a464-b3e81615d938", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Using Customer Managed Keys involves additional overhead in maintenance by administrators.", + "default_value": "", + "references": "1. https://cloud.google.com/docs/security/encryption/default-encryption", + "id": "67909c46-649c-52c1-a464-b3e81615d938", + "name": "Ensure that Dataproc Cluster is encrypted using Customer-Managed Encryption Key", + "profile_applicability": "* Level 2", + "description": "When you use Dataproc, cluster and job data is stored on Persistent Disks (PDs) associated with the Compute Engine VMs in your cluster and in a Cloud Storage staging bucket.\nThis PD and bucket data is encrypted using a Google-generated data encryption key (DEK) and key encryption key (KEK).\nThe CMEK feature allows you to create, use, and revoke the key encryption key (KEK).\nGoogle still controls the data encryption key (DEK).", + "rationale": "\"Cloud services offer the ability to protect data related to those services using encryption keys managed by the customer within Cloud KMS.\nThese encryption keys are called customer-managed encryption keys (CMEK).\nWhen you protect data in Google Cloud services with CMEK, the CMEK key is within your control.", + "audit": "**From Google Cloud Console**\n\n1. Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.\n2. Select the project from the project dropdown list.\n3. On the `Dataproc Clusters` page, select the cluster and click on the Name attribute value that you want to examine.\n4. On the `details` page, select the `Configurations` tab.\n5. On the `Configurations` tab, check the `Encryption type` configuration attribute value. If the value is set to `Google-managed key`, then Dataproc Cluster is not encrypted with Customer managed encryption keys.\n\nRepeat step no.\n3 - 5 for other Dataproc Clusters available in the selected project.\n\n6. Change the project from the project dropdown list and repeat the audit procedure for other projects.\n\n**From Google Cloud CLI**\n\n7. Run clusters list command to list all the Dataproc Clusters available in the region:\n```\ngcloud dataproc clusters list --region='us-central1'\n```\n8. Run clusters describe command to get the key details of the selected cluster:\n```\ngcloud dataproc clusters describe --region=us-central1 --flatten=config.encryptionConfig.gcePdKmsKeyName\n```\n9. If the above command output return \"null\", then the selected cluster is not encrypted with Customer managed encryption keys.\n10. Repeat step no. 2 and 3 for other Dataproc Clusters available in the selected region. Change the region by updating --region and repeat step no. 2 for other clusters available in the project. Change the project by running the below command and repeat the audit procedure for other Dataproc clusters available in other projects:\n```\ngcloud config set project \"\n```", + "remediation": "**From Google Cloud Console**\n\n1. Login to the GCP Console and navigate to the Dataproc Cluster page by visiting https://console.cloud.google.com/dataproc/clusters.\n2. Select the project from the projects dropdown list.\n3. On the `Dataproc Cluster` page, click on the `Create Cluster` to create a new cluster with Customer managed encryption keys.\n4. On `Create a cluster` page, perform below steps:\n - Inside `Set up cluster` section perform below steps:\n -In the `Name` textbox, provide a name for your cluster.\n - From `Location` select the location in which you want to deploy a cluster.\n - Configure other configurations as per your requirements.\n - Inside `Configure Nodes` and `Customize cluster` section configure the settings as per your requirements.\n - Inside `Manage security` section, perform below steps:\n - From `Encryption`, select `Customer-managed key`.\n - Select a customer-managed key from dropdown list.\n - Ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account (\"serviceAccount:service-@compute-system.iam.gserviceaccount.com\").\n - Click on `Create` to create a cluster.\n - Once the cluster is created migrate all your workloads from the older cluster to the new cluster and delete the old cluster by performing the below steps:\n - On the `Clusters` page, select the old cluster and click on `Delete cluster`.\n - On the `Confirm deletion` window, click on `Confirm` to delete the cluster.\n - Repeat step above for other Dataproc clusters available in the selected project.\n - Change the project from the project dropdown list and repeat the remediation procedure for other Dataproc clusters available in other projects.\n\n**From Google Cloud CLI**\n\nBefore creating cluster ensure that the selected KMS Key have Cloud KMS CryptoKey Encrypter/Decrypter role assign to Dataproc Cluster service account (\"serviceAccount:service-@compute-system.iam.gserviceaccount.com\").\nRun clusters create command to create new cluster with customer-managed key:\n```\ngcloud dataproc clusters create --region=us-central1 --gce-pd-kms-key=\n```\nThe above command will create a new cluster in the selected region.\n\nOnce the cluster is created migrate all your workloads from the older cluster to the new cluster and Run clusters delete command to delete cluster:\n```\ngcloud dataproc clusters delete --region=us-central1\n```\nRepeat step no.\n1 to create a new Dataproc cluster.\nChange the project by running the below command and repeat the remediation procedure for other projects:\n```\ngcloud config set project \"\n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.17", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.17", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_17" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/68cfd04b-fc79-5877-8638-af3aa82d92db.json b/packages/cloud_security_posture/kibana/csp_rule_template/68cfd04b-fc79-5877-8638-af3aa82d92db.json new file mode 100644 index 00000000000..55e1baec0f1 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/68cfd04b-fc79-5877-8638-af3aa82d92db.json @@ -0,0 +1,38 @@ +{ + "id": "68cfd04b-fc79-5877-8638-af3aa82d92db", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "If you set a database IP to private, only host from the same network will have the ability to connect your database.\n\nConfiguring an existing Cloud SQL instance to use private IP causes the instance to restart.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/configure-private-ip\n2. https://cloud.google.com/vpc/docs/configure-private-services-access#procedure\n3. https://cloud.google.com/vpc/docs/configure-private-services-access#creating-connection", + "id": "68cfd04b-fc79-5877-8638-af3aa82d92db", + "name": "Ensure Instance IP assignment is set to private", + "profile_applicability": "* Level 1", + "description": "Instance addresses can be public IP or private IP.\nPublic IP means that the instance is accessible through the public internet.\nIn contrast, instances using only private IP are not accessible through the public internet, but are accessible through a Virtual Private Cloud (VPC).\n\nLimiting network access to your database will limit potential attacks.", + "rationale": "Setting databases access only to private will reduce attack surface.", + "audit": "**From Google Cloud Console**\n\n1. In the Google Cloud console, go to the `Cloud SQL Instances` page.\n2. Open the `Overview page` of an instance by clicking the instance name.\n3. Look for a field labeled `Private IP address` This field will only show if the Private IP option is checked. The IP listed should be in the private IP space.\n\n**From Google Cloud CLI**\n4. List cloud SQL instances\n```\ngcloud sql instances list --format=\"json\" | jq '.[] | .connectionName,.ipAddresses'\n```\nEach instance listed should have a `type` of `PRIVATE`.\n\n5. If you want to view a specific instance, note the (s) listed and run the following.\n```\ngcloud sql instances describe --format=\"json\" | jq '.ipAddresses'\n```\n`Type` should be `\"PRIVATE\"`\n```\n {\n \"ipAddress\": \"10.21.0.2\",\n \"type\": \"PRIVATE\"\n}\n```", + "remediation": "**From Google Cloud Console**\n\n1. In the Google Cloud console, go to the `Cloud SQL Instances` page.\n2. Open the `Overview page` of an instance by clicking the instance name.\n3. Select `Connections` from the SQL navigation menu.\n4. Check the `Private IP` checkbox. A drop-down list shows the available networks in your project.\n5. Select the VPC network you want to use:\n If you see `Private service connection required`:\n 1.\nClick `Set up connection`.\n 1.\nIn the `Allocate an IP range` section, choose one of the following options:\n - Select one or more existing IP ranges or create a new one from the dropdown.\nThe dropdown includes previously allocated ranges, if there are any, or you can select Allocate a new IP range and enter a new range and name.\n - Use an automatically allocated IP range in your network.\n Note: You can specify an address range only for a primary instance, not for a read replica or clone.\n 3.\nClick Continue.\n 1.\nClick Create connection.\n 1.\nVerify that you see the Private service connection for network VPC_NETWORK_NAME has been successfully created status.\n6. [Optional step for Private Services Access - review reference links to VPC documents for additional detail] If you want to allow other Google Cloud services such as BigQuery to access data in Cloud SQL and make queries against this data over a private IP connection, then select the Private path for Google Cloud services check box.\n7. Click Save\n\n**From Google Cloud CLI**\n\n8. List cloud SQL instances\n```\ngcloud sql instances list --format=\"json\" | jq '.[] | .connectionName,.ipAddresses'\n```\nNote the `project name` of the instance you want to set to a private IP, this will be \n\nNote the `instance name` of the instance you want to set to a private IP, this will be \n\nExample public instance output:\n\n```\n\"my-project-123456:us-central1:my-instance\"\n[\n {\n \"ipAddress\": \"0.0.0.0\",\n \"type\": \"PRIMARY\"\n },\n {\n \"ipAddress\": \"0.0.0.0\",\n \"type\": \"OUTGOING\"\n }\n```\n\n9. run the following command to list the available VPCs \n```\ngcloud compute networks list --format=\"json\" | jq '.[].name'\n```\nNote the name of the VPC to use for the instance private IP, this will be \n\n10. run the following to set instance to a private IP\n```\ngcloud beta sql instances patch \\\n--project= \\\n--network=projects//global/networks/ \\\n--no-assign-ip\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.9", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.9", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_9" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/68f9d23f-882f-55d1-86c6-711413c31129.json b/packages/cloud_security_posture/kibana/csp_rule_template/68f9d23f-882f-55d1-86c6-711413c31129.json new file mode 100644 index 00000000000..6f179b36b50 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/68f9d23f-882f-55d1-86c6-711413c31129.json @@ -0,0 +1,38 @@ +{ + "id": "68f9d23f-882f-55d1-86c6-711413c31129", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-remote-access-server-configuration-option?view=sql-server-ver15\n3. https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79337", + "id": "68f9d23f-882f-55d1-86c6-711413c31129", + "name": "Ensure 'remote access' database flag for Cloud SQL SQL Server instance is set to 'off'", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `remote access` database flag for Cloud SQL SQL Server instance to `off`.", + "rationale": "The `remote access` option controls the execution of stored procedures from local or remote servers on which instances of SQL Server are running.\nThis default value for this option is 1.\nThis grants permission to run local stored procedures from remote servers or remote stored procedures from the local server.\nTo prevent local stored procedures from being run from a remote server or remote stored procedures from being run on the local server, this must be disabled.\nThe Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.\n'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target, hence this should be disabled.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `remote access` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"remote access\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `remote access` from the drop-down menu, and set its value to `off`.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `remote access` database flag for every Cloud SQL SQL Server database instance using the below command\n```\ngcloud sql instances patch --database-flags \"remote access=off\"\n```\n\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.5", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/756e1a54-b2ce-56b9-a13f-17f652d7767c.json b/packages/cloud_security_posture/kibana/csp_rule_template/756e1a54-b2ce-56b9-a13f-17f652d7767c.json new file mode 100644 index 00000000000..cefc00d3e53 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/756e1a54-b2ce-56b9-a13f-17f652d7767c.json @@ -0,0 +1,38 @@ +{ + "id": "756e1a54-b2ce-56b9-a13f-17f652d7767c", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/logging/docs/audit/configure-data-access#getiampolicy-setiampolicy", + "id": "756e1a54-b2ce-56b9-a13f-17f652d7767c", + "name": "Ensure That the Log Metric Filter and Alerts Exist for Audit Configuration Changes", + "profile_applicability": "* Level 1", + "description": "Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, \"who did what, where, and when?\" within GCP projects.\n\nCloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services.\nCloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.", + "rationale": "Admin activity and data access logs produced by cloud audit logging enable security analysis, resource change tracking, and compliance auditing.\n\nConfiguring the metric filter and alerts for audit configuration changes ensures the recommended state of audit configuration is maintained so that all activities in the project are audit-able at any point in time.", + "audit": "**From Google Cloud Console**\n\n**Ensure the prescribed log metric is present:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure that at least one metric `` is present with the filter text:\n```\nprotoPayload.methodName=\"SetIamPolicy\" AND\nprotoPayload.serviceData.policyDelta.auditConfigDeltas:*\n```\n**Ensure that the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of 0 for greater than zero(0) seconds`, means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that appropriate notifications channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure that the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud beta logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to: \n```\nprotoPayload.methodName=\"SetIamPolicy\" AND\nprotoPayload.serviceData.policyDelta.auditConfigDeltas:*\n```\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains at least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n```\nprotoPayload.methodName=\"SetIamPolicy\" AND\nprotoPayload.serviceData.policyDelta.auditConfigDeltas:*\n```\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This will ensure that the log metric counts the number of log entries matching the user's advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create a prescribed Alert Policy:** \n\n7. Identify the new metric the user just created, under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page opens.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n10. Configure the desired notifications channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate a prescribed Log Metric:\n- Use the command: gcloud beta logging metrics create \n- Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create\n](https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create)\nCreate prescribed Alert Policy \n- Use the command: gcloud alpha monitoring policies create\n- Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create](https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create)", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.5", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/7e584486-4d0f-5edb-8a64-7ee0b59333b8.json b/packages/cloud_security_posture/kibana/csp_rule_template/7e584486-4d0f-5edb-8a64-7ee0b59333b8.json new file mode 100644 index 00000000000..84a61616e70 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/7e584486-4d0f-5edb-8a64-7ee0b59333b8.json @@ -0,0 +1,38 @@ +{ + "id": "7e584486-4d0f-5edb-8a64-7ee0b59333b8", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/vpc/docs/overview", + "id": "7e584486-4d0f-5edb-8a64-7ee0b59333b8", + "name": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Changes", + "profile_applicability": "* Level 2", + "description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network changes.", + "rationale": "It is possible to have more than one VPC within a project.\nIn addition, it is also possible to create a peer connection between two VPCs enabling network traffic to route between VPCs.\n\n\nMonitoring changes to a VPC will help ensure VPC traffic flow is not getting impacted.", + "audit": "**From Google Cloud Console**\n\n**Ensure the prescribed log metric is present:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure at least one metric `` is present with filter text:\n\n```\nresource.type=\"gce_network\" \nAND (protoPayload.methodName:\"compute.networks.insert\" \nOR protoPayload.methodName:\"compute.networks.patch\" \nOR protoPayload.methodName:\"compute.networks.delete\" \nOR protoPayload.methodName:\"compute.networks.removePeering\" \nOR protoPayload.methodName:\"compute.networks.addPeering\")\n```\n\n**Ensure the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of 0 for greater than 0 seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that appropriate notification channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure the log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with filter set to: \n```\nresource.type=\"gce_network\" \nAND protoPayload.methodName=\"beta.compute.networks.insert\" \nOR protoPayload.methodName=\"beta.compute.networks.patch\" \nOR protoPayload.methodName=\"v1.compute.networks.delete\" \nOR protoPayload.methodName=\"v1.compute.networks.removePeering\" \nOR protoPayload.methodName=\"v1.compute.networks.addPeering\"\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains at least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n\n```\nresource.type=\"gce_network\" \nAND (protoPayload.methodName:\"compute.networks.insert\" \nOR protoPayload.methodName:\"compute.networks.patch\" \nOR protoPayload.methodName:\"compute.networks.delete\" \nOR protoPayload.methodName:\"compute.networks.removePeering\" \nOR protoPayload.methodName:\"compute.networks.addPeering\")\n```\n\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the prescribed alert policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of 0 for the most recent value will ensure that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notification channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed Log Metric:\n- Use the command: gcloud logging metrics create \n\nCreate the prescribed alert policy: \n- Use the command: gcloud alpha monitoring policies create", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.9", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.9", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_9" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/84862c2c-4aba-5458-9c5f-12855091617b.json b/packages/cloud_security_posture/kibana/csp_rule_template/84862c2c-4aba-5458-9c5f-12855091617b.json new file mode 100644 index 00000000000..f34d1b59030 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/84862c2c-4aba-5458-9c5f-12855091617b.json @@ -0,0 +1,38 @@ +{ + "id": "84862c2c-4aba-5458-9c5f-12855091617b", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/storage/docs/overview\n6. https://cloud.google.com/sql/docs/\n7. https://cloud.google.com/sql/docs/mysql/\n8. https://cloud.google.com/sql/docs/postgres/", + "id": "84862c2c-4aba-5458-9c5f-12855091617b", + "name": "Ensure That the Log Metric Filter and Alerts Exist for SQL Instance Configuration Changes", + "profile_applicability": "* Level 2", + "description": "It is recommended that a metric filter and alarm be established for SQL instance configuration changes.", + "rationale": "Monitoring changes to SQL instance configuration changes may reduce the time needed to detect and correct misconfigurations done on the SQL server.\n\n\nBelow are a few of the configurable options which may the impact security posture of an SQL instance:\n\n- Enable auto backups and high availability: Misconfiguration may adversely impact business continuity, disaster recovery, and high availability \n\n- Authorize networks: Misconfiguration may increase exposure to untrusted networks", + "audit": "**From Google Cloud Console**\n\n**Ensure the prescribed log metric is present:**\n\n1. For each project that contains Cloud SQL instances, go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure that at least one metric `` is present with the filter text:\n\n```\nprotoPayload.methodName=\"cloudsql.instances.update\"\n```\n\n**Ensure that the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that the appropriate notifications channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure that the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to \n```\nprotoPayload.methodName=\"cloudsql.instances.update\"\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains at least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed Log Metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n\n```\nprotoPayload.methodName=\"cloudsql.instances.update\"\n```\n\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the prescribed alert policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the user's project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notification channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed log metric:\n- Use the command: gcloud logging metrics create \n\nCreate the prescribed alert policy: \n- Use the command: gcloud alpha monitoring policies create\n- Reference for command usage: [https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create](https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create)", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.11", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.11", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_11" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/873e6387-218d-587a-8fa1-3d65f4a77802.json b/packages/cloud_security_posture/kibana/csp_rule_template/873e6387-218d-587a-8fa1-3d65f4a77802.json new file mode 100644 index 00000000000..e117a121b70 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/873e6387-218d-587a-8fa1-3d65f4a77802.json @@ -0,0 +1,38 @@ +{ + "id": "873e6387-218d-587a-8fa1-3d65f4a77802", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/storage/docs/access-control/iam\n6. https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create\n7. https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create", + "id": "873e6387-218d-587a-8fa1-3d65f4a77802", + "name": "Ensure That the Log Metric Filter and Alerts Exist for VPC Network Route Changes", + "profile_applicability": "* Level 2", + "description": "It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) network route changes.", + "rationale": "Google Cloud Platform (GCP) routes define the paths network traffic takes from a VM instance to another destination.\nThe other destination can be inside the organization VPC network (such as another VM) or outside of it.\nEvery route consists of a destination and a next hop.\nTraffic whose destination IP is within the destination range is sent to the next hop for delivery.\n\n\nMonitoring changes to route tables will help ensure that all VPC traffic flows through an expected path.", + "audit": "**From Google Cloud Console**\n\n**Ensure that the prescribed Log metric is present:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure that at least one metric `` is present with the filter text:\n\n```\nresource.type=\"gce_route\" \nAND (protoPayload.methodName:\"compute.routes.delete\" \nOR protoPayload.methodName:\"compute.routes.insert\")\n```\n\n**Ensure the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting: [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of 0 for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alert thresholds make sense for the user's organization.\n\n5. Ensure that the appropriate notification channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to: \n\n```\nresource.type=\"gce_route\" \nAND (protoPayload.methodName:\"compute.routes.delete\" \nOR protoPayload.methodName:\"compute.routes.insert\")\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains an least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed Log Metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`\n\n3. Clear any text and add: \n\n```\nresource.type=\"gce_route\" \nAND (protoPayload.methodName:\"compute.routes.delete\" \nOR protoPayload.methodName:\"compute.routes.insert\")\n```\n\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the prescribed alert policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page displays.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notification channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed Log Metric:\n- Use the command: gcloud logging metrics create \n\nCreate the prescribed the alert policy: \n- Use the command: gcloud alpha monitoring policies create", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.8", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.8", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_8" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/89cc8ff0-be81-55f2-b1cf-d7db1e214741.json b/packages/cloud_security_posture/kibana/csp_rule_template/89cc8ff0-be81-55f2-b1cf-d7db1e214741.json new file mode 100644 index 00000000000..4bf3f179901 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/89cc8ff0-be81-55f2-b1cf-d7db1e214741.json @@ -0,0 +1,38 @@ +{ + "id": "89cc8ff0-be81-55f2-b1cf-d7db1e214741", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting `API restrictions` may break existing application functioning, if not done carefully.", + "default_value": "", + "references": "1. https://cloud.google.com/docs/authentication/api-keys\n2. https://cloud.google.com/apis/docs/overview", + "id": "89cc8ff0-be81-55f2-b1cf-d7db1e214741", + "name": "Ensure API Keys Are Restricted to Only APIs That Application Needs Access", + "profile_applicability": "* Level 2", + "description": "API Keys should only be used for services in cases where other authentication methods are unavailable.\nAPI keys are always at risk because they can be viewed publicly, such as from within a browser, or they can be accessed on a device where the key resides.\nIt is recommended to restrict API keys to use (call) only APIs required by an application.", + "rationale": "Security risks involved in using API-Keys are below:\n\n- API keys are simple encrypted strings\n\n- API keys do not identify the user or the application making the API request\n\n- API keys are typically accessible to clients, making it easy to discover and steal an API key\n\nIn light of these potential risks, Google recommends using the standard authentication flow instead of API-Keys.\nHowever, there are limited cases where API keys are more appropriate.\nFor example, if there is a mobile application that needs to use the Google Cloud Translation API, but doesn't otherwise need a backend server, API keys are the simplest way to authenticate to that API.\n\nIn order to reduce attack surfaces by providing `least privileges`, API-Keys can be restricted to use (call) only APIs required by an application.", + "audit": "**From Console:**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page.\n\n3. For every API Key, ensure the section `Key restrictions` parameter `API restrictions` is not set to `None`.\n\nOr, \n\nEnsure `API restrictions` is not set to `Google Cloud APIs`\n\n**Note:** `Google Cloud APIs` represents the API collection of all cloud services/APIs offered by Google cloud.\n\n**From Google Cloud CLI**\n\n4. List all API Keys.\n```\ngcloud services api-keys list\n```\nEach key should have a line that says `restrictions:` followed by varying parameters and NOT have a line saying `- service: cloudapis.googleapis.com` as shown here\n```\n restrictions:\n apiTargets:\n - service: cloudapis.googleapis.com\n\n```", + "remediation": "**From Console:**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the section `API Keys`, Click the `API Key Name`. The API Key properties display on a new page.\n\n3. In the `Key restrictions` section go to `API restrictions`.\n\n4. Click the `Select API` drop-down to choose an API.\n\n5. Click `Save`.\n\n6. Repeat steps 2,3,4,5 for every unrestricted API key\n\n**Note:** Do not set `API restrictions` to `Google Cloud APIs`, as this option allows access to all services offered by Google cloud.\n\n**From Google Cloud CLI**\n\n7. List all API keys.\n```\ngcloud services api-keys list\n```\n8. Note the `UID` of the key to add restrictions to.\n9. Run the update command with the appropriate flags to add the required restrictions.\n```\ngcloud alpha services api-keys update \n```\nNote- Flags can be found by running\n```\ngcloud alpha services api-keys update --help\n```\nor in this documentation\nhttps://cloud.google.com/sdk/gcloud/reference/alpha/services/api-keys/update", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.14", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.14", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_14" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/8a985fda-fc4c-5435-b7f0-c4d40bb1307a.json b/packages/cloud_security_posture/kibana/csp_rule_template/8a985fda-fc4c-5435-b7f0-c4d40bb1307a.json new file mode 100644 index 00000000000..fcfbf84d09a --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/8a985fda-fc4c-5435-b7f0-c4d40bb1307a.json @@ -0,0 +1,38 @@ +{ + "id": "8a985fda-fc4c-5435-b7f0-c4d40bb1307a", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "When an organization deletes the default network, it may need to migrate or service onto a new network.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/networking#firewall_rules\n2. https://cloud.google.com/compute/docs/reference/latest/networks/insert\n3. https://cloud.google.com/compute/docs/reference/latest/networks/delete\n4. https://cloud.google.com/vpc/docs/firewall-rules-logging\n5. https://cloud.google.com/vpc/docs/vpc#default-network\n6. https://cloud.google.com/sdk/gcloud/reference/compute/networks/delete", + "id": "8a985fda-fc4c-5435-b7f0-c4d40bb1307a", + "name": "Ensure That the Default Network Does Not Exist in a Project", + "profile_applicability": "* Level 2", + "description": "To prevent use of `default` network, a project should not have a `default` network.", + "rationale": "The `default` network has a preconfigured network configuration and automatically generates the following insecure firewall rules: \n\n- default-allow-internal: Allows ingress connections for all protocols and ports among instances in the network.\n- default-allow-ssh: Allows ingress connections on TCP port 22(SSH) from any source to any instance in the network.\n- default-allow-rdp: Allows ingress connections on TCP port 3389(RDP) from any source to any instance in the network.\n- default-allow-icmp: Allows ingress ICMP traffic from any source to any instance in the network.\n\nThese automatically created firewall rules do not get audit logged and cannot be configured to enable firewall rule logging.\n\n\nFurthermore, the default network is an auto mode network, which means that its subnets use the same predefined range of IP addresses, and as a result, it's not possible to use Cloud VPN or VPC Network Peering with the default network.\n\n\nBased on organization security and networking requirements, the organization should create a new network and delete the `default` network.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VPC networks` page by visiting: [https://console.cloud.google.com/networking/networks/list](https://console.cloud.google.com/networking/networks/list).\n\n2. Ensure that a network with the name `default` is not present.\n\n**From Google Cloud CLI**\n\n3. Set the project name in the Google Cloud Shell:\n```\n\ngcloud config set project PROJECT_ID \n```\n4. List the networks configured in that project:\n```\ngcloud compute networks list \n```\nIt should not list `default` as one of the available networks in that project.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the `VPC networks` page by visiting: [https://console.cloud.google.com/networking/networks/list](https://console.cloud.google.com/networking/networks/list).\n\n2. Click the network named `default`.\n\n3. On the network detail page, click `EDIT`.\n\n4. Click `DELETE VPC NETWORK`.\n\n5. If needed, create a new network to replace the default network.\n\n**From Google Cloud CLI**\n\nFor each Google Cloud Platform project,\n\n6. Delete the default network:\n```\ngcloud compute networks delete default\n```\n\n7. If needed, create a new network to replace it:\n```\ngcloud compute networks create NETWORK_NAME\n```\n\n**Prevention:**\n\nThe user can prevent the default network and its insecure default firewall rules from being created by setting up an Organization Policy to `Skip default network creation` at [https://console.cloud.google.com/iam-admin/orgpolicies/compute-skipDefaultNetworkCreation](https://console.cloud.google.com/iam-admin/orgpolicies/compute-skipDefaultNetworkCreation).", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.1", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/8c36c21b-3c8f-5a92-bc7e-62871428f4d2.json b/packages/cloud_security_posture/kibana/csp_rule_template/8c36c21b-3c8f-5a92-bc7e-62871428f4d2.json new file mode 100644 index 00000000000..096c50fe45b --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/8c36c21b-3c8f-5a92-bc7e-62871428f4d2.json @@ -0,0 +1,38 @@ +{ + "id": "8c36c21b-3c8f-5a92-bc7e-62871428f4d2", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Users already having Project-wide ssh key pairs and using third party SSH clients will lose access to the impacted Instances. For Project users using gcloud or GCP Console based SSH option, no manual key creation and distribution is required and will be handled by GCE (Google Compute Engine) itself. To access Instance using third party SSH clients Instance specific SSH key pairs need to be created and distributed to the required users.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys\n2. https://cloud.google.com/sdk/gcloud/reference/topic/formats", + "id": "8c36c21b-3c8f-5a92-bc7e-62871428f4d2", + "name": "Ensure \u201cBlock Project-Wide SSH Keys\u201d Is Enabled for VM Instances", + "profile_applicability": "* Level 1", + "description": "It is recommended to use Instance specific SSH key(s) instead of using common/shared project-wide SSH key(s) to access Instances.", + "rationale": "Project-wide SSH keys are stored in Compute/Project-meta-data.\nProject wide SSH keys can be used to login into all the instances within project.\nUsing project-wide SSH keys eases the SSH key management but if compromised, poses the security risk which can impact all the instances within project.\nIt is recommended to use Instance specific SSH keys which can limit the attack surface if the SSH keys are compromised.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). It will list all the instances in your project.\n\n2. For every instance, click on the name of the instance.\n\n3. Under `SSH Keys`, ensure `Block project-wide SSH keys` is selected.\n\n**From Google Cloud CLI**\n\n4. List the instances in your project and get details on each instance:\n```\ngcloud compute instances list --format=json\n```\n5. Ensure `key: block-project-ssh-keys` is set to `value: 'true'`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). It will list all the instances in your project.\n\n2. Click on the name of the Impacted instance\n\n3. Click `Edit` in the toolbar\n\n4. Under SSH Keys, go to the `Block project-wide SSH keys` checkbox\n\n5. To block users with project-wide SSH keys from connecting to this instance, select `Block project-wide SSH keys`\n\n6. Click `Save` at the bottom of the page\n\n7. Repeat steps for every impacted Instance\n\n**From Google Cloud CLI**\n\nTo block project-wide public SSH keys, set the metadata value to `TRUE`:\n\n```\ngcloud compute instances add-metadata --metadata block-project-ssh-keys=TRUE\n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.3", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/8daf3f8a-8cb0-58f4-955a-ce2dd2a11f75.json b/packages/cloud_security_posture/kibana/csp_rule_template/8daf3f8a-8cb0-58f4-955a-ce2dd2a11f75.json new file mode 100644 index 00000000000..6e2677bd220 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/8daf3f8a-8cb0-58f4-955a-ce2dd2a11f75.json @@ -0,0 +1,38 @@ +{ + "id": "8daf3f8a-8cb0-58f4-955a-ce2dd2a11f75", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Removing the binding for `allUsers` and `allAuthenticatedUsers` members denies accessing `cryptokeys` to anonymous or public users.", + "default_value": "", + "references": "1. https://cloud.google.com/sdk/gcloud/reference/kms/keys/remove-iam-policy-binding\n2. https://cloud.google.com/sdk/gcloud/reference/kms/keys/set-iam-policy\n3. https://cloud.google.com/sdk/gcloud/reference/kms/keys/get-iam-policy\n4. https://cloud.google.com/kms/docs/object-hierarchy#key_resource_id", + "id": "8daf3f8a-8cb0-58f4-955a-ce2dd2a11f75", + "name": "Ensure That Cloud KMS Cryptokeys Are Not Anonymously or Publicly Accessible", + "profile_applicability": "* Level 1", + "description": "It is recommended that the IAM policy on Cloud KMS `cryptokeys` should restrict anonymous and/or public access.", + "rationale": "Granting permissions to `allUsers` or `allAuthenticatedUsers` allows anyone to access the dataset.\nSuch access might not be desirable if sensitive data is stored at the location.\nIn this case, ensure that anonymous and/or public access to a Cloud KMS `cryptokey` is not allowed.", + "audit": "**From Google Cloud CLI**\n\n1. List all Cloud KMS `Cryptokeys`.\n```\ngcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'\n```\n2. Ensure the below command's output does not contain `allUsers` or `allAuthenticatedUsers`.\n```\ngcloud kms keys get-iam-policy [key_name] --keyring=[key_ring_name] --location=global --format=json | jq '.bindings[].members[]'\n```", + "remediation": "**From Google Cloud CLI**\n\n1. List all Cloud KMS `Cryptokeys`.\n\n```\ngcloud kms keys list --keyring=[key_ring_name] --location=global --format=json | jq '.[].name'\n```\n2. Remove IAM policy binding for a KMS key to remove access to `allUsers` and `allAuthenticatedUsers` using the below command.\n\n```\ngcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allAuthenticatedUsers' --role='[role]'\n\ngcloud kms keys remove-iam-policy-binding [key_name] --keyring=[key_ring_name] --location=global --member='allUsers' --role='[role]'\n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.9", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.9", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_9" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/8f2644ed-70b5-576f-b9b9-aabea6821749.json b/packages/cloud_security_posture/kibana/csp_rule_template/8f2644ed-70b5-576f-b9b9-aabea6821749.json new file mode 100644 index 00000000000..df56a41b822 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/8f2644ed-70b5-576f-b9b9-aabea6821749.json @@ -0,0 +1,38 @@ +{ + "id": "8f2644ed-70b5-576f-b9b9-aabea6821749", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Updating flags may cause the database to restart. This may cause it to unavailable for a short amount of time, so this is best done at a time of low usage. You should also determine if the tables in your databases reference another table without using credentials for that database, as turning off cross database ownership will break this relationship.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option?view=sql-server-ver15", + "id": "8f2644ed-70b5-576f-b9b9-aabea6821749", + "name": "Ensure that the 'cross db ownership chaining' database flag for Cloud SQL SQL Server instance is set to 'off'", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `cross db ownership chaining` database flag for Cloud SQL SQL Server instance to `off`.", + "rationale": "Use the `cross db ownership` for chaining option to configure cross-database ownership chaining for an instance of Microsoft SQL Server.\nThis server option allows you to control cross-database ownership chaining at the database level or to allow cross-database ownership chaining for all databases.\nEnabling `cross db ownership` is not recommended unless all of the databases hosted by the instance of SQL Server must participate in cross-database ownership chaining and you are aware of the security implications of this setting.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console.\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `cross db ownership chaining` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance:\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"cross db ownership chaining\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `cross db ownership chaining` from the drop-down menu, and set its value to `off`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `cross db ownership chaining` database flag for every Cloud SQL SQL Server database instance using the below command:\n```\ngcloud sql instances patch --database-flags \"cross db ownership chaining=off\"\n```\n\nNote: \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.2", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/9126cd85-611c-5b06-b2f2-a18338e26ae1.json b/packages/cloud_security_posture/kibana/csp_rule_template/9126cd85-611c-5b06-b2f2-a18338e26ae1.json new file mode 100644 index 00000000000..63aa2286410 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/9126cd85-611c-5b06-b2f2-a18338e26ae1.json @@ -0,0 +1,38 @@ +{ + "id": "9126cd85-611c-5b06-b2f2-a18338e26ae1", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/dns/dnssec-advanced#advanced_signing_options", + "id": "9126cd85-611c-5b06-b2f2-a18338e26ae1", + "name": "Ensure That RSASHA1 Is Not Used for the Zone-Signing Key in Cloud DNS DNSSEC", + "profile_applicability": "* Level 1", + "description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.\n\nDNSSEC algorithm numbers in this registry may be used in CERT RRs.\nZone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms.\nThe algorithm used for key signing should be a recommended one and it should be strong.", + "rationale": "DNSSEC algorithm numbers in this registry may be used in CERT RRs.\nZone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms.\n\nThe algorithm used for key signing should be a recommended one and it should be strong.\nWhen enabling DNSSEC for a managed zone, or creating a managed zone with DNSSEC, the DNSSEC signing algorithms and the denial-of-existence type can be selected.\nChanging the DNSSEC settings is only effective for a managed zone if DNSSEC is not already enabled.\nIf the need exists to change the settings for a managed zone where it has been enabled, turn DNSSEC off and then re-enable it with different settings.", + "audit": "**From Google Cloud CLI**\n\nEnsure the property algorithm for keyType zone signing is not using RSASHA1.\n\n```\ngcloud dns managed-zones describe --format=\"json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs)\"\n```", + "remediation": "**From Google Cloud CLI**\n\n1. If the need exists to change the settings for a managed zone where it has been enabled, DNSSEC must be turned off and then re-enabled with different settings. To turn off DNSSEC, run following command:\n```\ngcloud dns managed-zones update ZONE_NAME --dnssec-state off\n```\n\n2. To update zone-signing for a reported managed DNS Zone, run the following command:\n```\ngcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE\n```\n\nSupported algorithm options and key lengths are as follows.\n\n Algorithm KSK Length ZSK Length\n --------- ---------- ----------\n RSASHA1 1024,2048 1024,2048\n RSASHA256 1024,2048 1024,2048\n RSASHA512 1024,2048 1024,2048\n ECDSAP256SHA256 256 384\n ECDSAP384SHA384 384 384", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.5", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/91d52d43-da61-5ba2-a4d4-1018fee84559.json b/packages/cloud_security_posture/kibana/csp_rule_template/91d52d43-da61-5ba2-a4d4-1018fee84559.json index 3a780a683ab..a67233f6b6c 100644 --- a/packages/cloud_security_posture/kibana/csp_rule_template/91d52d43-da61-5ba2-a4d4-1018fee84559.json +++ b/packages/cloud_security_posture/kibana/csp_rule_template/91d52d43-da61-5ba2-a4d4-1018fee84559.json @@ -11,8 +11,8 @@ "profile_applicability": "* Level 1", "description": "S3 Bucket Access Logging generates a log that contains access records for each request made to your S3 bucket.\nAn access log record contains details about the request, such as the request type, the resources specified in the request worked, and the time and date the request was processed.\nIt is recommended that bucket access logging be enabled on the CloudTrail S3 bucket.", "rationale": "By enabling S3 bucket logging on target S3 buckets, it is possible to capture all events which may affect objects within any target buckets.\nConfiguring logs to be placed in a separate bucket allows access to log information which can be useful in security and incident response workflows.", - "audit": "Perform the following ensure the CloudTrail S3 bucket has access logging is enabled:\n\n**From Console:**\n\n1. Go to the Amazon CloudTrail console at [https://console.aws.amazon.com/cloudtrail/home](https://console.aws.amazon.com/cloudtrail/home)\n2. In the API activity history pane on the left, click Trails\n3. In the Trails pane, note the bucket names in the S3 bucket column\n4. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3).\n5. Under `All Buckets` click on a target S3 bucket\n6. Click on `Properties` in the top right of the console\n7. Under `Bucket:` _ `` _ click on `Logging` \n8. Ensure `Enabled` is checked.\n\n**From Command Line:**\n\n9. Get the name of the S3 bucket that CloudTrail is logging to:\n``` \naws cloudtrail describe-trails --query 'trailList[*].S3BucketName' \n```\n10. Ensure Bucket Logging is enabled:\n```\naws s3api get-bucket-logging --bucket \n```\nEnsure command does not returns empty output.\n\nSample Output for a bucket with logging enabled:\n\n```\n{\n \"LoggingEnabled\": {\n \"TargetPrefix\": \"\",\n \"TargetBucket\": \"\"\n }\n}\n```", - "remediation": "Perform the following to enable S3 bucket logging:\n\n**From Console:**\n\n1. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3).\n2. Under `All Buckets` click on the target S3 bucket\n3. Click on `Properties` in the top right of the console\n4. Under `Bucket:` click on `Logging` \n5. Configure bucket logging\n - Click on the `Enabled` checkbox\n - Select Target Bucket from list\n - Enter a Target Prefix\n6. Click `Save`.\n\n**From Command Line:**\n\n7. Get the name of the S3 bucket that CloudTrail is logging to:\n```\naws cloudtrail describe-trails --region --query trailList[*].S3BucketName\n```\n8. Copy and add target bucket name at ``, Prefix for logfile at `` and optionally add an email address in the following template and save it as ``:\n```\n{\n \"LoggingEnabled\": {\n \"TargetBucket\": \"\",\n \"TargetPrefix\": \"\",\n \"TargetGrants\": [\n {\n \"Grantee\": {\n \"Type\": \"AmazonCustomerByEmail\",\n \"EmailAddress\": \"\"\n },\n \"Permission\": \"FULL_CONTROL\"\n }\n ]\n } \n}\n```\n9. Run the `put-bucket-logging` command with bucket name and `` as input, for more information refer at [put-bucket-logging](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html):\n```\naws s3api put-bucket-logging --bucket --bucket-logging-status file://\n```", + "audit": "Perform the following ensure the CloudTrail S3 bucket has access logging is enabled:\n\n**From Console:**\n\n1. Go to the Amazon CloudTrail console at [https://console.aws.amazon.com/cloudtrail/home](https://console.aws.amazon.com/cloudtrail/home)\n2. In the API activity history pane on the left, click Trails\n3. In the Trails pane, note the bucket names in the S3 bucket column\n4. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3).\n5. Under `All Buckets` click on a target S3 bucket\n6. Click on `Properties` in the top right of the console\n7. Under `Bucket:` _ `` _ click on `Logging` \n8. Ensure `Enabled` is checked.\n\n**From Command Line:**\n\n9. Get the name of the S3 bucket that CloudTrail is logging to:\n``` \naws cloudtrail describe-trails --query 'trailList[*].S3BucketName' \n```\n10. Ensure Bucket Logging is enabled:\n```\naws s3api get-bucket-logging --bucket \n```\nEnsure command does not returns empty output.\n\nSample Output for a bucket with logging enabled:\n\n```\n{\n \"LoggingEnabled\": {\n \"TargetPrefix\": \"\",\n \"TargetBucket\": \"\"\n }\n}\n```", + "remediation": "Perform the following to enable S3 bucket logging:\n\n**From Console:**\n\n1. Sign in to the AWS Management Console and open the S3 console at [https://console.aws.amazon.com/s3](https://console.aws.amazon.com/s3).\n2. Under `All Buckets` click on the target S3 bucket\n3. Click on `Properties` in the top right of the console\n4. Under `Bucket:` click on `Logging` \n5. Configure bucket logging\n - Click on the `Enabled` checkbox\n - Select Target Bucket from list\n - Enter a Target Prefix\n6. Click `Save`.\n\n**From Command Line:**\n\n7. Get the name of the S3 bucket that CloudTrail is logging to:\n```\naws cloudtrail describe-trails --region --query trailList[*].S3BucketName\n```\n8. Copy and add target bucket name at ``, Prefix for logfile at `` and optionally add an email address in the following template and save it as ``:\n```\n{\n \"LoggingEnabled\": {\n \"TargetBucket\": \"\",\n \"TargetPrefix\": \"\",\n \"TargetGrants\": [\n {\n \"Grantee\": {\n \"Type\": \"AmazonCustomerByEmail\",\n \"EmailAddress\": \"\"\n },\n \"Permission\": \"FULL_CONTROL\"\n }\n ]\n }\n}\n```\n9. Run the `put-bucket-logging` command with bucket name and `` as input, for more information refer at [put-bucket-logging](https://docs.aws.amazon.com/cli/latest/reference/s3api/put-bucket-logging.html):\n```\naws s3api put-bucket-logging --bucket --bucket-logging-status file://\n```", "section": "Logging", "version": "1.0", "tags": [ diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/92077c86-0322-5497-b94e-38ef356eadd6.json b/packages/cloud_security_posture/kibana/csp_rule_template/92077c86-0322-5497-b94e-38ef356eadd6.json new file mode 100644 index 00000000000..27dedc28495 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/92077c86-0322-5497-b94e-38ef356eadd6.json @@ -0,0 +1,38 @@ +{ + "id": "92077c86-0322-5497-b94e-38ef356eadd6", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Removing the public IP address on SQL instances may break some applications that relied on it for database connectivity.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/mysql/configure-private-ip\n2. https://cloud.google.com/sql/docs/mysql/private-ip\n3. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints\n4. https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp", + "id": "92077c86-0322-5497-b94e-38ef356eadd6", + "name": "Ensure That Cloud SQL Database Instances Do Not Have Public IPs", + "profile_applicability": "* Level 2", + "description": "It is recommended to configure Second Generation Sql instance to use private IPs instead of public IPs.", + "rationale": "To lower the organization's attack surface, Cloud SQL databases should not have public IPs.\nPrivate IPs provide improved network security and lower latency for your application.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console: [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances)\n\n2. Ensure that every instance has a private IP address and no public IP address configured.\n\n**From Google Cloud CLI**\n\n3. List all Cloud SQL database instances using the following command:\n\n```\ngcloud sql instances list\n```\n\n4. For every instance of type `instanceType: CLOUD_SQL_INSTANCE` with `backendType: SECOND_GEN`, get detailed configuration. Ignore instances of type `READ_REPLICA_INSTANCE` because these instances inherit their settings from the primary instance. Also, note that first generation instances cannot be configured to have a private IP address.\n\n```\ngcloud sql instances describe \n```\n\n5. Ensure that the setting `ipAddresses` has an IP address configured of `type: PRIVATE` and has no IP address of `type: PRIMARY`. `PRIMARY` IP addresses are public addresses. An instance can have both a private and public address at the same time. Note also that you cannot use private IP with First Generation instances.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console: [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances)\n2. Click the instance name to open its Instance details page.\n3. Select the `Connections` tab.\n4. Deselect the `Public IP` checkbox.\n5. Click `Save` to update the instance.\n\n**From Google Cloud CLI**\n\n6. For every instance remove its public IP and assign a private IP instead:\n```\ngcloud sql instances patch --network= --no-assign-ip\n```\n\n7. Confirm the changes using the following command::\n```\ngcloud sql instances describe \n```\n\n**Prevention:**\n\nTo prevent new SQL instances from getting configured with public IP addresses, set up a `Restrict Public IP access on Cloud SQL instances` Organization policy at: [https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp](https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictPublicIp).", + "section": "Cloud SQL Database Services", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.6", + "Cloud SQL Database Services" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/9259a915-0294-54d6-b379-162ceb36e875.json b/packages/cloud_security_posture/kibana/csp_rule_template/9259a915-0294-54d6-b379-162ceb36e875.json new file mode 100644 index 00000000000..3e1c6fa8be5 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/9259a915-0294-54d6-b379-162ceb36e875.json @@ -0,0 +1,38 @@ +{ + "id": "9259a915-0294-54d6-b379-162ceb36e875", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT", + "id": "9259a915-0294-54d6-b379-162ceb36e875", + "name": "Ensure That the \u2018Log_disconnections\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set to \u2018On\u2019", + "profile_applicability": "* Level 1", + "description": "Enabling the `log_disconnections` setting logs the end of each session, including the session duration.", + "rationale": "PostgreSQL does not log session details such as duration and session end by default.\nEnabling the `log_disconnections` setting will create log entries at the end of each session which can be useful in troubleshooting issues and determine any unusual activity across a time period.\nThe `log_disconnections` and `log_connections` work hand in hand and generally, the pair would be enabled/disabled together.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Go to the `Configuration` card.\n4. Under `Database flags`, check the value of `log_disconnections` flag is configured as expected.\n\n**From Google Cloud CLI**\n\n5. Ensure the below command returns `on` for every Cloud SQL PostgreSQL database instance:\n```\ngcloud sql instances list --format=json | jq '.[].settings.databaseFlags[] | select(.name==\"log_disconnections\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the PostgreSQL instance where the database flag needs to be enabled.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_disconnections` from the drop-down menu and set the value as `on`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `log_disconnections` database flag for every Cloud SQL PosgreSQL database instance using the below command:\n```\ngcloud sql instances patch --database-flags log_disconnections=on\n```\n```\nNote: This command will overwrite all previously set database flags.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.3", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/92ab0102-d825-52ce-87a8-1d0b4e06166c.json b/packages/cloud_security_posture/kibana/csp_rule_template/92ab0102-d825-52ce-87a8-1d0b4e06166c.json new file mode 100644 index 00000000000..cc155ad42c3 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/92ab0102-d825-52ce-87a8-1d0b4e06166c.json @@ -0,0 +1,38 @@ +{ + "id": "92ab0102-d825-52ce-87a8-1d0b4e06166c", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling the pgAudit extension can lead to increased data storage requirements and to ensure durability of pgAudit log records in the event of unexpected storage issues, it is recommended to enable the `Enable automatic storage increases` setting on the instance. Enabling flags via the command line will also overwrite all existing flags, so you should apply all needed flags in the CLI command. Also flags may require a restart of the server to be implemented or will break existing functionality so update your servers at a time of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags#list-flags-postgres\n2. https://cloud.google.com/sql/docs/postgres/pg-audit#enable-auditing-flag\n3. https://cloud.google.com/sql/docs/postgres/pg-audit#customizing-database-audit-logging\n4. https://cloud.google.com/logging/docs/audit/configure-data-access#config-console-enable", + "id": "92ab0102-d825-52ce-87a8-1d0b4e06166c", + "name": "Ensure That 'cloudsql.enable_pgaudit' Database Flag for each Cloud Sql Postgresql Instance Is Set to 'on' For Centralized Logging", + "profile_applicability": "* Level 1", + "description": "Ensure `cloudsql.enable_pgaudit` database flag for Cloud SQL PostgreSQL instance is set to `on` to allow for centralized logging.", + "rationale": "As numerous other recommendations in this section consist of turning on flags for logging purposes, your organization will need a way to manage these logs.\nYou may have a solution already in place.\nIf you do not, consider installing and enabling the open source pgaudit extension within PostgreSQL and enabling its corresponding flag of `cloudsql.enable_pgaudit`.\nThis flag and installing the extension enables database auditing in PostgreSQL through the open-source pgAudit extension.\nThis extension provides detailed session and object logging to comply with government, financial, & ISO standards and provides auditing capabilities to mitigate threats by monitoring security events on the instance.\nEnabling the flag and settings later in this recommendation will send these logs to Google Logs Explorer so that you can access them in a central location.\nto This recommendation is applicable only to PostgreSQL database instances.", + "audit": "**Determining if the pgAudit Flag is set to 'on'**\n\n**From Google Cloud Console**\n\n1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Overview` page.\n3. Click `Edit`.\n4. Scroll down and expand `Flags`.\n5. Ensure that `cloudsql.enable_pgaudit` flag is set to `on`.\n\n**From Google Cloud CLI**\n\nRun the command by providing ``.\nEnsure the value of the flag is `on`.\n\n``` \ngcloud sql instances describe --format=\"json\" | jq '.settings|.|.databaseFlags[]|select(.name==\"cloudsql.enable_pgaudit\")|.value' \n```\n\n**Determine if the pgAudit extension is installed**\n\n6. Connect to the the server running PostgreSQL or through a SQL client of your choice.\n7. Via command line open the PostgreSQL shell by typing `psql`\n8. Run the following command\n\n```\nSELECT * \nFROM pg_extension;\n```\n\n9. If pgAudit is in this list. If so, it is installed.\n\n**Determine if Data Access Audit logs are enabled for your project and have sufficient privileges**\n\n10. From the homepage open the hamburger menu in the top left.\n11. Scroll down to `IAM & Admin`and hover over it.\n12. In the menu that opens up, select `Audit Logs`\n13. In the middle of the page, in the search box next to `filter` search for `Cloud Composer API`\n14. Select it, and ensure that both 'Admin Read' and 'Data Read' are checked.\n\n**Determine if logs are being sent to Logs Explorer**\n\n15. From the Google Console home page, open the hamburger menu in the top left.\n16. In the menu that pops open, scroll down to Logs Explorer under Operations.\n17. In the query box, paste the following and search\n```\nresource.type=\"cloudsql_database\"\nlogName=\"projects//logs/cloudaudit.googleapis.com%2Fdata_access\"\nprotoPayload.request.@type=\"type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry\"\n```\n18. If it returns any log sources, they are correctly setup.", + "remediation": "**Initialize the pgAudit flag**\n\n**From Google Cloud Console**\n\n1. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Overview` page.\n3. Click `Edit`.\n4. Scroll down and expand `Flags`.\n5. To set a flag that has not been set on the instance before, click `Add item`.\n6. Enter `cloudsql.enable_pgaudit` for the flag name and set the flag to `on`.\n7. Click `Done`.\n8. Click `Save` to update the configuration.\n9. Confirm your changes under `Flags` on the `Overview` page.\n\n**From Google Cloud CLI**\n\nRun the below command by providing `` to enable `cloudsql.enable_pgaudit` flag.\n\n```\ngcloud sql instances patch --database-flags cloudsql.enable_pgaudit=on\n```\n\nNote: `RESTART` is required to get this configuration in effect.\n\n**Creating the extension**\n\n10. Connect to the the server running PostgreSQL or through a SQL client of your choice.\n11. If SSHing to the server in the command line open the PostgreSQL shell by typing `psql`\n12. Run the following command as a superuser.\n\n```\nCREATE EXTENSION pgaudit;\n```\n\n**Updating the previously created pgaudit.log flag for your Logging Needs**\n\n**From Console:**\n\nNote: there are multiple options here.\nThis command will enable logging for all databases on a server.\nPlease see the customizing database audit logging reference for more flag options.\n\n\n13. Go to [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n14. Select the instance to open its `Overview` page.\n15. Click `Edit`.\n16. Scroll down and expand `Flags`.\n17. To set a flag that has not been set on the instance before, click `Add item`.\n18. Enter `pgaudit.log=all` for the flag name and set the flag to `on`.\n19. Click `Done`.\n20. Click `Save` to update the configuration.\n21. Confirm your changes under `Flags` on the `Overview` page.\n\n**From Command Line:**\n\nRun the command\n\n```\ngcloud sql instances patch --database-flags \\\n cloudsql.enable_pgaudit=on,pgaudit.log=all\n```\n\n**Determine if logs are being sent to Logs Explorer**\n\n22. From the Google Console home page, open the hamburger menu in the top left.\n23. In the menu that pops open, scroll down to Logs Explorer under Operations.\n24. In the query box, paste the following and search\n\nresource.type=\"cloudsql_database\"\nlogName=\"projects//logs/cloudaudit.googleapis.com%2Fdata_access\"\nprotoPayload.request.@type=\"type.googleapis.com/google.cloud.sql.audit.v1.PgAuditEntry\"\n\n If it returns any log sources, they are correctly setup.", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.8", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.8", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_8" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/933268ec-44e8-5fba-9ed7-535804521cc7.json b/packages/cloud_security_posture/kibana/csp_rule_template/933268ec-44e8-5fba-9ed7-535804521cc7.json new file mode 100644 index 00000000000..436e852ed1f --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/933268ec-44e8-5fba-9ed7-535804521cc7.json @@ -0,0 +1,38 @@ +{ + "id": "933268ec-44e8-5fba-9ed7-535804521cc7", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Removed roles should be assigned to another user based on business needs.", + "default_value": "", + "references": "1. https://cloud.google.com/kms/docs/separation-of-duties", + "id": "933268ec-44e8-5fba-9ed7-535804521cc7", + "name": "Ensure That Separation of Duties Is Enforced While Assigning KMS Related Roles to Users", + "profile_applicability": "* Level 2", + "description": "It is recommended that the principle of 'Separation of Duties' is enforced while assigning KMS related roles to users.", + "rationale": "The built-in/predefined IAM role `Cloud KMS Admin` allows the user/identity to create, delete, and manage service account(s).\nThe built-in/predefined IAM role `Cloud KMS CryptoKey Encrypter/Decrypter` allows the user/identity (with adequate privileges on concerned resources) to encrypt and decrypt data at rest using an encryption key(s).\n\nThe built-in/predefined IAM role `Cloud KMS CryptoKey Encrypter` allows the user/identity (with adequate privileges on concerned resources) to encrypt data at rest using an encryption key(s).\nThe built-in/predefined IAM role `Cloud KMS CryptoKey Decrypter` allows the user/identity (with adequate privileges on concerned resources) to decrypt data at rest using an encryption key(s).\n\nSeparation of duties is the concept of ensuring that one individual does not have all necessary permissions to be able to complete a malicious action.\nIn Cloud KMS, this could be an action such as using a key to access and decrypt data a user should not normally have access to.\nSeparation of duties is a business control typically used in larger organizations, meant to help avoid security or privacy incidents and errors.\nIt is considered best practice.\n\nNo user(s) should have `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` roles assigned at the same time.", + "audit": "**From Google Cloud Console**\n\n1. Go to `IAM & Admin/IAM` by visiting: [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam)\n\n2. Ensure no member has the roles `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` assigned.\n\n**From Google Cloud CLI**\n\n3. List all users and role assignments:\n\n```\ngcloud projects get-iam-policy PROJECT_ID\n```\n\n4. Ensure that there are no common users found in the member section for roles `cloudkms.admin` and any one of `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter`", + "remediation": "**From Google Cloud Console**\n\n1. Go to `IAM & Admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`\n\n2. For any member having `Cloud KMS Admin` and any of the `Cloud KMS CryptoKey Encrypter/Decrypter`, `Cloud KMS CryptoKey Encrypter`, `Cloud KMS CryptoKey Decrypter` roles granted/assigned, click the `Delete Bin` icon to remove the role from the member.\n\nNote: Removing a role should be done based on the business requirement.", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.11", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.11", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_11" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/936ea3f4-b4bc-5f3a-a7a0-dec9bda0a48c.json b/packages/cloud_security_posture/kibana/csp_rule_template/936ea3f4-b4bc-5f3a-a7a0-dec9bda0a48c.json new file mode 100644 index 00000000000..99e139636f4 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/936ea3f4-b4bc-5f3a-a7a0-dec9bda0a48c.json @@ -0,0 +1,38 @@ +{ + "id": "936ea3f4-b4bc-5f3a-a7a0-dec9bda0a48c", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "When `contained database authentication` is off (0) for the instance, contained databases cannot be created, or attached to the Database Engine. Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase.Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/contained-database-authentication-server-configuration-option?view=sql-server-ver15\n3. https://docs.microsoft.com/en-us/sql/relational-databases/databases/security-best-practices-with-contained-databases?view=sql-server-ver15", + "id": "936ea3f4-b4bc-5f3a-a7a0-dec9bda0a48c", + "name": "Ensure that the 'contained database authentication' database flag for Cloud SQL on the SQL Server instance is set to 'off'", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `contained database authentication` database flag for Cloud SQL on the SQL Server instance to `off`.", + "rationale": "A contained database includes all database settings and metadata required to define the database and has no configuration dependencies on the instance of the Database Engine where the database is installed.\nUsers can connect to the database without authenticating a login at the Database Engine level.\nIsolating the database from the Database Engine makes it possible to easily move the database to another instance of SQL Server.\nContained databases have some unique threats that should be understood and mitigated by SQL Server Database Engine administrators.\nMost of the threats are related to the USER WITH PASSWORD authentication process, which moves the authentication boundary from the Database Engine level to the database level, hence this is recommended to disable this flag.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `contained database authentication` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns `off` for every Cloud SQL SQL Server database instance.\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"contained database authentication\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `contained database authentication` from the drop-down menu, and set its value to `off`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `contained database authentication` database flag for every Cloud SQL SQL Server database instance using the below command:\n```\ngcloud sql instances patch --database-flags \"contained database authentication=off\"\n```\n\n```\nNote: \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.7", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/a1f327c0-3e4b-5b55-891a-b91e720cd535.json b/packages/cloud_security_posture/kibana/csp_rule_template/a1f327c0-3e4b-5b55-891a-b91e720cd535.json new file mode 100644 index 00000000000..45659bb076a --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/a1f327c0-3e4b-5b55-891a-b91e720cd535.json @@ -0,0 +1,38 @@ +{ + "id": "a1f327c0-3e4b-5b55-891a-b91e720cd535", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/dns/dnssec-advanced#advanced_signing_options", + "id": "a1f327c0-3e4b-5b55-891a-b91e720cd535", + "name": "Ensure That RSASHA1 Is Not Used for the Key-Signing Key in Cloud DNS DNSSEC", + "profile_applicability": "* Level 1", + "description": "NOTE: Currently, the SHA1 algorithm has been removed from general use by Google, and, if being used, needs to be whitelisted on a project basis by Google and will also, therefore, require a Google Cloud support contract.\n\nDNSSEC algorithm numbers in this registry may be used in CERT RRs.\nZone signing (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms.\nThe algorithm used for key signing should be a recommended one and it should be strong.", + "rationale": "Domain Name System Security Extensions (DNSSEC) algorithm numbers in this registry may be used in CERT RRs.\nZonesigning (DNSSEC) and transaction security mechanisms (SIG(0) and TSIG) make use of particular subsets of these algorithms.\n\nThe algorithm used for key signing should be a recommended one and it should be strong.\nWhen enabling DNSSEC for a managed zone, or creating a managed zone with DNSSEC, the user can select the DNSSEC signing algorithms and the denial-of-existence type.\nChanging the DNSSEC settings is only effective for a managed zone if DNSSEC is not already enabled.\nIf there is a need to change the settings for a managed zone where it has been enabled, turn DNSSEC off and then re-enable it with different settings.", + "audit": "**From Google Cloud CLI**\n\nEnsure the property algorithm for keyType keySigning is not using `RSASHA1`.\n\n gcloud dns managed-zones describe ZONENAME --format=\"json(dnsName,dnssecConfig.state,dnssecConfig.defaultKeySpecs)\"", + "remediation": "**From Google Cloud CLI**\n\n1. If it is necessary to change the settings for a managed zone where it has been enabled, NSSEC must be turned off and re-enabled with different settings. To turn off DNSSEC, run the following command:\n\n```\ngcloud dns managed-zones update ZONE_NAME --dnssec-state off\n```\n\n2. To update key-signing for a reported managed DNS Zone, run the following command:\n\n```\ngcloud dns managed-zones update ZONE_NAME --dnssec-state on --ksk-algorithm KSK_ALGORITHM --ksk-key-length KSK_KEY_LENGTH --zsk-algorithm ZSK_ALGORITHM --zsk-key-length ZSK_KEY_LENGTH --denial-of-existence DENIAL_OF_EXISTENCE\n```\n\nSupported algorithm options and key lengths are as follows.\n\n Algorithm KSK Length ZSK Length\n --------- ---------- ----------\n RSASHA1 1024,2048 1024,2048\n RSASHA256 1024,2048 1024,2048\n RSASHA512 1024,2048 1024,2048\n ECDSAP256SHA256 256 256\n ECDSAP384SHA384 384 384", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.4", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/a7c6b368-29db-53e6-8b86-dfaddf719f59.json b/packages/cloud_security_posture/kibana/csp_rule_template/a7c6b368-29db-53e6-8b86-dfaddf719f59.json new file mode 100644 index 00000000000..aa92f7cfd24 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/a7c6b368-29db-53e6-8b86-dfaddf719f59.json @@ -0,0 +1,38 @@ +{ + "id": "a7c6b368-29db-53e6-8b86-dfaddf719f59", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/storage/docs/overview\n6. https://cloud.google.com/storage/docs/access-control/iam-roles", + "id": "a7c6b368-29db-53e6-8b86-dfaddf719f59", + "name": "Ensure That the Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes", + "profile_applicability": "* Level 2", + "description": "It is recommended that a metric filter and alarm be established for Cloud Storage Bucket IAM changes.", + "rationale": "Monitoring changes to cloud storage bucket permissions may reduce the time needed to detect and correct permissions on sensitive cloud storage buckets and objects inside the bucket.", + "audit": "**From Google Cloud Console**\n\n**Ensure the prescribed log metric is present:**\n\n1. For each project that contains cloud storage buckets, go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure at least one metric `` is present with the filter text:\n\n```\nresource.type=\"gcs_bucket\"\nAND protoPayload.methodName=\"storage.setIamPermissions\"\n```\n\n**Ensure that the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of 0 for greater than 0 seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that the appropriate notifications channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure that the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to: \n```\nresource.type=gcs_bucket \nAND protoPayload.methodName=\"storage.setIamPermissions\"\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains an least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n```\nresource.type=\"gcs_bucket\" \nAND protoPayload.methodName=\"storage.setIamPermissions\"\n```\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the user's advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the prescribed Alert Policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the new metric and select `Create alert from Metric`. A new page appears.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notifications channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed Log Metric:\n- Use the command: gcloud beta logging metrics create \n\nCreate the prescribed alert policy: \n- Use the command: gcloud alpha monitoring policies create", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.10", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.10", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_10" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b0ed2847-4db1-57c3-b2b6-49b0576a2506.json b/packages/cloud_security_posture/kibana/csp_rule_template/b0ed2847-4db1-57c3-b2b6-49b0576a2506.json new file mode 100644 index 00000000000..ea7f5e09e27 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b0ed2847-4db1-57c3-b2b6-49b0576a2506.json @@ -0,0 +1,38 @@ +{ + "id": "b0ed2847-4db1-57c3-b2b6-49b0576a2506", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/mysql/flags\n2. https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_skip_show_database", + "id": "b0ed2847-4db1-57c3-b2b6-49b0576a2506", + "name": "Ensure \u2018Skip_show_database\u2019 Database Flag for Cloud SQL MySQL Instance Is Set to \u2018On\u2019", + "profile_applicability": "* Level 1", + "description": "It is recommended to set `skip_show_database` database flag for Cloud SQL Mysql instance to `on`", + "rationale": "'skip_show_database' database flag prevents people from using the SHOW DATABASES statement if they do not have the SHOW DATABASES privilege.\nThis can improve security if you have concerns about users being able to see databases belonging to other users.\nIts effect depends on the SHOW DATABASES privilege: If the variable value is ON, the SHOW DATABASES statement is permitted only to users who have the SHOW DATABASES privilege, and the statement displays all database names.\nIf the value is OFF, SHOW DATABASES is permitted to all users, but displays the names of only those databases for which the user has the SHOW DATABASES or other privilege.\nThis recommendation is applicable to Mysql database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `skip_show_database` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. List all Cloud SQL database Instances\n```\ngcloud sql instances list\n```\n5. Ensure the below command returns `on` for every Cloud SQL Mysql database instance\n```\ngcloud sql instances describe INSTANCE_NAME --format=json | jq '.settings.databaseFlags[] | select(.name==\"skip_show_database\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the Mysql instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `skip_show_database` from the drop-down menu, and set its value to `on`.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. List all Cloud SQL database Instances\n```\ngcloud sql instances list\n```\n9. Configure the `skip_show_database` database flag for every Cloud SQL Mysql database instance using the below command.\n```\ngcloud sql instances patch INSTANCE_NAME --database-flags skip_show_database=on\n```\n\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "MySQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.1.2", + "MySQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.1.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_1_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b190337a-56a7-5906-8960-76fd05283599.json b/packages/cloud_security_posture/kibana/csp_rule_template/b190337a-56a7-5906-8960-76fd05283599.json new file mode 100644 index 00000000000..ce8e8a9cbb2 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b190337a-56a7-5906-8960-76fd05283599.json @@ -0,0 +1,38 @@ +{ + "id": "b190337a-56a7-5906-8960-76fd05283599", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Deleting instance(s) acting as routers/packet forwarders may break the network connectivity.", + "default_value": "", + "references": "1. https://cloud.google.com/vpc/docs/using-routes#canipforward", + "id": "b190337a-56a7-5906-8960-76fd05283599", + "name": "Ensure That IP Forwarding Is Not Enabled on Instances", + "profile_applicability": "* Level 1", + "description": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance.\nSimilarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet.\nHowever, both capabilities are required if you want to use instances to help route packets.\n\nForwarding of data packets should be disabled to prevent data loss or information disclosure.", + "rationale": "Compute Engine instance cannot forward a packet unless the source IP address of the packet matches the IP address of the instance.\nSimilarly, GCP won't deliver a packet whose destination IP address is different than the IP address of the instance receiving the packet.\nHowever, both capabilities are required if you want to use instances to help route packets.\nTo enable this source and destination IP check, disable the `canIpForward` field, which allows an instance to send and receive packets with non-matching destination or source IPs.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM Instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). \n2. For every instance, click on its name to go to the `VM instance details` page.\n3. Under the `Network interfaces` section, ensure that `IP forwarding` is set to `Off` for every network interface.\n\n**From Google Cloud CLI**\n\n4. List all instances:\n```\ngcloud compute instances list --format='table(name,canIpForward)'\n```\n5. Ensure that `CAN_IP_FORWARD` column in the output of above command does not contain `True` for any VM instance.\n\n**Exception:**\nInstances created by GKE should be excluded because they need to have IP forwarding enabled and cannot be changed.\nInstances created by GKE have names that start with \"gke-\".", + "remediation": "You only edit the `canIpForward` setting at instance creation time.\nTherefore, you need to delete the instance and create a new one where `canIpForward` is set to `false`.\n\n**From Google Cloud Console**\n\n1. Go to the `VM Instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances). \n2. Select the `VM Instance` you want to remediate.\n3. Click the `Delete` button.\n4. On the 'VM Instances' page, click `CREATE INSTANCE'.\n5. Create a new instance with the desired configuration. By default, the instance is configured to not allow IP forwarding.\n\n**From Google Cloud CLI**\n\n6. Delete the instance:\n```\ngcloud compute instances delete INSTANCE_NAME\n```\n\n7. Create a new instance to replace it, with `IP forwarding` set to `Off`\n```\ngcloud compute instances create\n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.6", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b56e76ca-b976-5b96-ab3f-359e5b51ddf2.json b/packages/cloud_security_posture/kibana/csp_rule_template/b56e76ca-b976-5b96-ab3f-359e5b51ddf2.json new file mode 100644 index 00000000000..e6ea713699c --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b56e76ca-b976-5b96-ab3f-359e5b51ddf2.json @@ -0,0 +1,38 @@ +{ + "id": "b56e76ca-b976-5b96-ab3f-359e5b51ddf2", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/access/service-accounts\n2. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances\n3. https://cloud.google.com/sdk/gcloud/reference/compute/instances/set-service-account", + "id": "b56e76ca-b976-5b96-ab3f-359e5b51ddf2", + "name": "Ensure That Instances Are Not Configured To Use the Default Service Account", + "profile_applicability": "* Level 1", + "description": "It is recommended to configure your instance to not use the default Compute Engine service account because it has the Editor role on the project.", + "rationale": "The default Compute Engine service account has the Editor role on the project, which allows read and write access to most Google Cloud Services.\nTo defend against privilege escalations if your VM is compromised and prevent an attacker from gaining access to all of your project, it is recommended to not use the default Compute Engine service account.\nInstead, you should create a new service account and assigning only the permissions needed by your instance.\n\nThe default Compute Engine service account is named `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n2. Click on each instance name to go to its `VM instance details` page.\n3. Under the section `API and identity management`, ensure that the default Compute Engine service account is not used. This account is named `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.\n\n**From Google Cloud CLI**\n\n4. List the instances in your project and get details on each instance:\n```\ngcloud compute instances list --format=json | jq -r '.\n| \"SA: \\(.[].serviceAccounts[].email) Name: \\(.[].name)\"'\n```\n5. Ensure that the service account section has an email that does not match the pattern `[PROJECT_NUMBER]-compute@developer.gserviceaccount.com`.\n\n**Exception:**\nVMs created by GKE should be excluded.\nThese VMs have names that start with `gke-` and are labeled `goog-gke-node`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n2. Click on the instance name to go to its `VM instance details` page.\n3. Click `STOP` and then click `EDIT`.\n4. Under the section `API and identity management`, select a service account other than the default Compute Engine service account. You may first need to create a new service account.\n5. Click `Save` and then click `START`.\n\n**From Google Cloud CLI**\n\n6. Stop the instance:\n```\ngcloud compute instances stop \n```\n7. Update the instance:\n```\ngcloud compute instances set-service-account --service-account= \n```\n8. Restart the instance:\n```\ngcloud compute instances start \n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.1", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b64386ab-20fa-57d2-9b5b-631d64181531.json b/packages/cloud_security_posture/kibana/csp_rule_template/b64386ab-20fa-57d2-9b5b-631d64181531.json new file mode 100644 index 00000000000..02158c0b535 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b64386ab-20fa-57d2-9b5b-631d64181531.json @@ -0,0 +1,38 @@ +{ + "id": "b64386ab-20fa-57d2-9b5b-631d64181531", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/current/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT", + "id": "b64386ab-20fa-57d2-9b5b-631d64181531", + "name": "Ensure \u2018Log_error_verbosity\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set to \u2018DEFAULT\u2019 or Stricter", + "profile_applicability": "* Level 2", + "description": "The `log_error_verbosity` flag controls the verbosity/details of messages logged.\nValid values are:\n- `TERSE`\n- `DEFAULT`\n- `VERBOSE`\n\n`TERSE` excludes the logging of `DETAIL`, `HINT`, `QUERY`, and `CONTEXT` error information.\n\n`VERBOSE` output includes the `SQLSTATE` error code, source code file name, function name, and line number that generated the error.\n\nEnsure an appropriate value is set to 'DEFAULT' or stricter.", + "rationale": "Auditing helps in troubleshooting operational problems and also permits forensic analysis.\nIf `log_error_verbosity` is not set to the correct value, too many details or too few details may be logged.\nThis flag should be configured with a value of 'DEFAULT' or stricter.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Go to `Configuration` card\n4. Under `Database flags`, check the value of `log_error_verbosity` flag is set to 'DEFAULT' or stricter.\n\n**From Google Cloud CLI**\n\n5. Use the below command for every Cloud SQL PostgreSQL database instance to verify the value of `log_error_verbosity`\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"log_error_verbosity\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.\n2. Select the PostgreSQL instance for which you want to enable the database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_error_verbosity` from the drop-down menu and set appropriate value.\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the log_error_verbosity database flag for every Cloud SQL PosgreSQL database instance using the below command.\n```\ngcloud sql instances patch --database-flags log_error_verbosity=\n```\n```\nNote: This command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.1", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b8c40039-034b-5299-8660-a7c8d34efe36.json b/packages/cloud_security_posture/kibana/csp_rule_template/b8c40039-034b-5299-8660-a7c8d34efe36.json new file mode 100644 index 00000000000..c4bbf9c8932 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b8c40039-034b-5299-8660-a7c8d34efe36.json @@ -0,0 +1,38 @@ +{ + "id": "b8c40039-034b-5299-8660-a7c8d34efe36", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/instances/modifying-shielded-vm\n2. https://cloud.google.com/shielded-vm\n3. https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint", + "id": "b8c40039-034b-5299-8660-a7c8d34efe36", + "name": "Ensure Compute Instances Are Launched With Shielded VM Enabled", + "profile_applicability": "* Level 2", + "description": "To defend against advanced threats and ensure that the boot loader and firmware on your VMs are signed and untampered, it is recommended that Compute instances are launched with Shielded VM enabled.", + "rationale": "Shielded VMs are virtual machines (VMs) on Google Cloud Platform hardened by a set of security controls that help defend against rootkits and bootkits.\n\n\nShielded VM offers verifiable integrity of your Compute Engine VM instances, so you can be confident your instances haven't been compromised by boot- or kernel-level malware or rootkits.\nShielded VM's verifiable integrity is achieved through the use of Secure Boot, virtual trusted platform module (vTPM)-enabled Measured Boot, and integrity monitoring.\n\nShielded VM instances run firmware which is signed and verified using Google's Certificate Authority, ensuring that the instance's firmware is unmodified and establishing the root of trust for Secure Boot.\n\nIntegrity monitoring helps you understand and make decisions about the state of your VM instances and the Shielded VM vTPM enables Measured Boot by performing the measurements needed to create a known good boot baseline, called the integrity policy baseline.\nThe integrity policy baseline is used for comparison with measurements from subsequent VM boots to determine if anything has changed.\n\nSecure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.", + "audit": "**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click on the instance name to see its `VM instance details` page.\n\n3. Under the section `Shielded VM`, ensure that `vTPM` and `Integrity Monitoring` are `on`.\n\n**From Google Cloud CLI**\n\n4. For each instance in your project, get its metadata:\n```\ngcloud compute instances list --format=json | jq -r '.\n| \"vTPM: \\(.[].shieldedInstanceConfig.enableVtpm) IntegrityMonitoring: \\(.[].shieldedInstanceConfig.enableIntegrityMonitoring) Name: \\(.[].name)\"'\n```\n\n5. Ensure that there is a `shieldedInstanceConfig` configuration and that configuration has the `enableIntegrityMonitoring` and `enableVtpm` set to `true`. If the VM is not a Shield VM image, you will not see a shieldedInstanceConfig` in the output.", + "remediation": "To be able turn on `Shielded VM` on an instance, your instance must use an image with Shielded VM support.\n\n\n**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click on the instance name to see its `VM instance details` page.\n\n3. Click `STOP` to stop the instance.\n\n4. When the instance has stopped, click `EDIT`.\n\n5. In the Shielded VM section, select `Turn on vTPM` and `Turn on Integrity Monitoring`.\n\n6. Optionally, if you do not use any custom or unsigned drivers on the instance, also select `Turn on Secure Boot`.\n\n7. Click the `Save` button to modify the instance and then click `START` to restart it.\n\n**From Google Cloud CLI**\n\nYou can only enable Shielded VM options on instances that have Shielded VM support.\nFor a list of Shielded VM public images, run the gcloud compute images list command with the following flags:\n\n```\ngcloud compute images list --project gce-uefi-images --no-standard-images\n```\n\n8. Stop the instance:\n```\ngcloud compute instances stop \n```\n9. Update the instance:\n\n```\ngcloud compute instances update --shielded-vtpm --shielded-vm-integrity-monitoring\n```\n10. Optionally, if you do not use any custom or unsigned drivers on the instance, also turn on secure boot.\n\n```\ngcloud compute instances update --shielded-vm-secure-boot\n```\n\n11. Restart the instance:\n\n```\ngcloud compute instances start \n```\n\n**Prevention:**\n\nYou can ensure that all new VMs will be created with Shielded VM enabled by setting up an Organization Policy to for `Shielded VM` at [https://console.cloud.google.com/iam-admin/orgpolicies/compute-requireShieldedVm](https://console.cloud.google.com/iam-admin/orgpolicies/compute-requireShieldedVm).\nLearn more at: \n[https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint](https://cloud.google.com/security/shielded-cloud/shielded-vm#organization-policy-constraint).", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.8", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.8", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_8" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/b8f1182a-1b3e-5b08-8482-f74949163e97.json b/packages/cloud_security_posture/kibana/csp_rule_template/b8f1182a-1b3e-5b08-8482-f74949163e97.json new file mode 100644 index 00000000000..3a5959fc511 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/b8f1182a-1b3e-5b08-8482-f74949163e97.json @@ -0,0 +1,38 @@ +{ + "id": "b8f1182a-1b3e-5b08-8482-f74949163e97", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "After revoking `Service Account User` or `Service Account Token Creator` roles at the project level from all impacted user account(s), these roles should be assigned to a user(s) for specific service account(s) according to business needs.", + "default_value": "", + "references": "1. https://cloud.google.com/iam/docs/service-accounts\n2. https://cloud.google.com/iam/docs/granting-roles-to-service-accounts\n3. https://cloud.google.com/iam/docs/understanding-roles\n4. https://cloud.google.com/iam/docs/granting-changing-revoking-access\n5. https://console.cloud.google.com/iam-admin/iam", + "id": "b8f1182a-1b3e-5b08-8482-f74949163e97", + "name": "Ensure That IAM Users Are Not Assigned the Service Account User or Service Account Token Creator Roles at Project Level", + "profile_applicability": "* Level 1", + "description": "It is recommended to assign the `Service Account User (iam.serviceAccountUser)` and `Service Account Token Creator (iam.serviceAccountTokenCreator)` roles to a user for a specific service account rather than assigning the role to a user at project level.", + "rationale": "A service account is a special Google account that belongs to an application or a virtual machine (VM), instead of to an individual end-user.\nApplication/VM-Instance uses the service account to call the service's Google API so that users aren't directly involved.\nIn addition to being an identity, a service account is a resource that has IAM policies attached to it.\nThese policies determine who can use the service account.\n\nUsers with IAM roles to update the App Engine and Compute Engine instances (such as App Engine Deployer or Compute Instance Admin) can effectively run code as the service accounts used to run these instances, and indirectly gain access to all the resources for which the service accounts have access.\nSimilarly, SSH access to a Compute Engine instance may also provide the ability to execute code as that instance/Service account.\n\nBased on business needs, there could be multiple user-managed service accounts configured for a project.\nGranting the `iam.serviceAccountUser` or `iam.serviceAccountTokenCreator` roles to a user for a project gives the user access to all service accounts in the project, including service accounts that may be created in the future.\nThis can result in elevation of privileges by using service accounts and corresponding `Compute Engine instances`.\n\nIn order to implement `least privileges` best practices, IAM users should not be assigned the `Service Account User` or `Service Account Token Creator` roles at the project level.\nInstead, these roles should be assigned to a user for a specific service account, giving that user access to the service account.\nThe `Service Account User` allows a user to bind a service account to a long-running job service, whereas the `Service Account Token Creator` role allows a user to directly impersonate (or assert) the identity of a service account.", + "audit": "**From Google Cloud Console**\n\n1. Go to the IAM page in the GCP Console by visiting [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam)\n\n2. Click on the filter table text bar, Type `Role: Service Account User`.\n\n3. Ensure no user is listed as a result of the filter.\n\n4. Click on the filter table text bar, Type `Role: Service Account Token Creator`.\n\n5. Ensure no user is listed as a result of the filter.\n\n**From Google Cloud CLI**\n\nTo ensure IAM users are not assigned Service Account User role at the project level:\n\n```\ngcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep \"roles/iam.serviceAccountUser\"\n\ngcloud projects get-iam-policy PROJECT_ID --format json | jq '.bindings[].role' | grep \"roles/iam.serviceAccountTokenCreator\"\n```\n\nThese commands should not return any output.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the IAM page in the GCP Console by visiting: [https://console.cloud.google.com/iam-admin/iam](https://console.cloud.google.com/iam-admin/iam).\n\n2. Click on the filter table text bar. Type `Role: Service Account User`\n\n3. Click the `Delete Bin` icon in front of the role `Service Account User` for every user listed as a result of a filter.\n\n4. Click on the filter table text bar. Type `Role: Service Account Token Creator`\n\n5. Click the `Delete Bin` icon in front of the role `Service Account Token Creator` for every user listed as a result of a filter.\n\n**From Google Cloud CLI**\n\n6. Using a text editor, remove the bindings with the `roles/iam.serviceAccountUser` or `roles/iam.serviceAccountTokenCreator`. \n\nFor example, you can use the iam.json file shown below as follows:\n\n {\n \"bindings\": [\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n ],\n \"role\": \"roles/appengine.appViewer\"\n },\n {\n \"members\": [\n \"user:email1@gmail.com\"\n ],\n \"role\": \"roles/owner\"\n },\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n \"serviceAccount:123456789012-compute@developer.gserviceaccount.com\"\n ],\n \"role\": \"roles/editor\"\n }\n ],\n \"etag\": \"BwUjMhCsNvY=\"\n }\n\n7. Update the project's IAM policy:\n\n```\ngcloud projects set-iam-policy PROJECT_ID iam.json\n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.6", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/bac65dd0-771b-5bfb-8e5f-3b1dc8962684.json b/packages/cloud_security_posture/kibana/csp_rule_template/bac65dd0-771b-5bfb-8e5f-3b1dc8962684.json new file mode 100644 index 00000000000..55231991664 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/bac65dd0-771b-5bfb-8e5f-3b1dc8962684.json @@ -0,0 +1,38 @@ +{ + "id": "bac65dd0-771b-5bfb-8e5f-3b1dc8962684", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "The Cloud SQL database instance would not be available to public IP addresses.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/mysql/configure-ip\n2. https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks\n3. https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints\n4. https://cloud.google.com/sql/docs/mysql/connection-org-policy", + "id": "bac65dd0-771b-5bfb-8e5f-3b1dc8962684", + "name": "Ensure That Cloud SQL Database Instances Do Not Implicitly Whitelist All Public IP Addresses", + "profile_applicability": "* Level 1", + "description": "Database Server should accept connections only from trusted Network(s)/IP(s) and restrict access from public IP addresses.", + "rationale": "To minimize attack surface on a Database server instance, only trusted/known and required IP(s) should be white-listed to connect to it.\n\nAn authorized network should not have IPs/networks configured to `0.0.0.0/0` which will allow access to the instance from anywhere in the world.\nNote that authorized networks apply only to instances with public IPs.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Click the instance name to open its `Instance details` page.\n3. Under the `Configuration` section click `Edit configurations`\n4. Under `Configuration options` expand the `Connectivity` section.\n5. Ensure that no authorized network is configured to allow `0.0.0.0/0`.\n\n**From Google Cloud CLI**\n\n6. Get detailed configuration for every Cloud SQL database instance.\n\n```\ngcloud sql instances list --format=json\n```\n\nEnsure that the section `settings: ipConfiguration : authorizedNetworks` does not have any parameter `value` containing `0.0.0.0/0`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n\n2. Click the instance name to open its `Instance details` page.\n3. Under the `Configuration` section click `Edit configurations`\n4. Under `Configuration options` expand the `Connectivity` section.\n5. Click the `delete` icon for the authorized network `0.0.0.0/0`.\n6. Click `Save` to update the instance.\n\n**From Google Cloud CLI**\n\nUpdate the authorized network list by dropping off any addresses.\n\n```\ngcloud sql instances patch --authorized-networks=IP_ADDR1,IP_ADDR2...\n```\n\n**Prevention:**\n\nTo prevent new SQL instances from being configured to accept incoming connections from any IP addresses, set up a `Restrict Authorized Networks on Cloud SQL instances` Organization Policy at: [https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks](https://console.cloud.google.com/iam-admin/orgpolicies/sql-restrictAuthorizedNetworks).", + "section": "Cloud SQL Database Services", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.5", + "Cloud SQL Database Services" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/be1197db-90d0-58db-b780-f0a939264bd0.json b/packages/cloud_security_posture/kibana/csp_rule_template/be1197db-90d0-58db-b780-f0a939264bd0.json new file mode 100644 index 00000000000..699a62a3e25 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/be1197db-90d0-58db-b780-f0a939264bd0.json @@ -0,0 +1,38 @@ +{ + "id": "be1197db-90d0-58db-b780-f0a939264bd0", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Turning on logging will increase the required storage over time. Mismanaged logs may cause your storage costs to increase. Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/postgres/flags\n2. https://www.postgresql.org/docs/9.6/runtime-config-logging.html#RUNTIME-CONFIG-LOGGING-WHAT", + "id": "be1197db-90d0-58db-b780-f0a939264bd0", + "name": "Ensure That the \u2018Log_connections\u2019 Database Flag for Cloud SQL PostgreSQL Instance Is Set to \u2018On\u2019", + "profile_applicability": "* Level 1", + "description": "Enabling the `log_connections` setting causes each attempted connection to the server to be logged, along with successful completion of client authentication.\nThis parameter cannot be changed after the session starts.", + "rationale": "PostgreSQL does not log attempted connections by default.\nEnabling the `log_connections` setting will create log entries for each attempted connection as well as successful completion of client authentication which can be useful in troubleshooting issues and to determine any unusual connection attempts to the server.\nThis recommendation is applicable to PostgreSQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page.\n3. Go to the `Configuration` card.\n4. Under `Database flags`, check the value of `log_connections` flag to determine if it is configured as expected.\n\n**From Google Cloud CLI**\n\n5. Ensure the below command returns `on` for every Cloud SQL PostgreSQL database instance:\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"log_connections\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.\n2. Select the PostgreSQL instance for which you want to enable the database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `log_connections` from the drop-down menu and set the value as `on`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. Configure the `log_connections` database flag for every Cloud SQL PosgreSQL database instance using the below command.\n```\ngcloud sql instances patch --database-flags log_connections=on\n```\n```\nNote: \nThis command will overwrite all previously set database flags.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "PostgreSQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.2.2", + "PostgreSQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.2.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_2_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/c13f49ab-845e-5a89-a05e-6a7c7b23f628.json b/packages/cloud_security_posture/kibana/csp_rule_template/c13f49ab-845e-5a89-a05e-6a7c7b23f628.json new file mode 100644 index 00000000000..a1deb2c419c --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/c13f49ab-845e-5a89-a05e-6a7c7b23f628.json @@ -0,0 +1,38 @@ +{ + "id": "c13f49ab-845e-5a89-a05e-6a7c7b23f628", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Removing `*Admin` or `*admin` or `Editor` or `Owner` role assignments from service accounts may break functionality that uses impacted service accounts. Required role(s) should be assigned to impacted service accounts in order to restore broken functionalities.", + "default_value": "", + "references": "1. https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/\n2. https://cloud.google.com/iam/docs/understanding-roles\n3. https://cloud.google.com/iam/docs/understanding-service-accounts", + "id": "c13f49ab-845e-5a89-a05e-6a7c7b23f628", + "name": "Ensure That Service Account Has No Admin Privileges", + "profile_applicability": "* Level 1", + "description": "A service account is a special Google account that belongs to an application or a VM, instead of to an individual end-user.\nThe application uses the service account to call the service's Google API so that users aren't directly involved.\nIt's recommended not to use admin access for ServiceAccount.", + "rationale": "Service accounts represent service-level security of the Resources (application or a VM) which can be determined by the roles assigned to it.\nEnrolling ServiceAccount with Admin rights gives full access to an assigned application or a VM.\nA ServiceAccount Access holder can perform critical actions like delete, update change settings, etc.\nwithout user intervention.\nFor this reason, it's recommended that service accounts not have Admin rights.", + "audit": "**From Google Cloud Console**\n\n1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`\n2. Go to the `Members`\n3. Ensure that there are no `User-Managed user created service account(s)` with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner`\n\n**From Google Cloud CLI**\n\n4. Get the policy that you want to modify, and write it to a JSON file:\n\n```\ngcloud projects get-iam-policy PROJECT_ID --format json > iam.json\n```\n\n5. The contents of the JSON file will look similar to the following. Note that `role` of members group associated with each `serviceaccount` does not contain `*Admin` or `*admin` or does not match `roles/editor` or does not match `roles/owner`.\n\nThis recommendation is only applicable to `User-Managed user-created` service accounts.\nThese accounts have the nomenclature: `SERVICE_ACCOUNT_NAME@PROJECT_ID.iam.gserviceaccount.com`.\nNote that some Google-managed, Google-created service accounts have the same naming format, and should be excluded (e.g., `appsdev-apps-dev-script-auth@system.gserviceaccount.com` which needs the Owner role).\n\n**Sample Json output:**\n\n {\n \"bindings\": [\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n ],\n \"role\": \"roles/appengine.appAdmin\"\n },\n {\n \"members\": [\n \"user:email1@gmail.com\"\n ],\n \"role\": \"roles/owner\"\n },\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n \"serviceAccount:123456789012-compute@developer.gserviceaccount.com\"\n ],\n \"role\": \"roles/editor\"\n }\n ],\n \"etag\": \"BwUjMhCsNvY=\",\n \"version\": 1\n }", + "remediation": "**From Google Cloud Console**\n\n1. Go to `IAM & admin/IAM` using `https://console.cloud.google.com/iam-admin/iam`\n2. Go to the `Members`\n3. Identify `User-Managed user created` service account with roles containing `*Admin` or `*admin` or role matching `Editor` or role matching `Owner`\n4. Click the `Delete bin` icon to remove the role from the member (service account in this case)\n\n**From Google Cloud CLI**\n\n```\ngcloud projects get-iam-policy PROJECT_ID --format json > iam.json\n```\n\n5. Using a text editor, Remove `Role` which contains `roles/*Admin` or `roles/*admin` or matched `roles/editor` or matches 'roles/owner`. Add a role to the bindings array that defines the group members and the role for those members. \n\nFor example, to grant the role roles/appengine.appViewer to the `ServiceAccount` which is roles/editor, you would change the example shown below as follows:\n\n {\n \"bindings\": [\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n ],\n \"role\": \"roles/appengine.appViewer\"\n },\n {\n \"members\": [\n \"user:email1@gmail.com\"\n ],\n \"role\": \"roles/owner\"\n },\n {\n \"members\": [\n \"serviceAccount:our-project-123@appspot.gserviceaccount.com\",\n \"serviceAccount:123456789012-compute@developer.gserviceaccount.com\"\n ],\n \"role\": \"roles/editor\"\n }\n ],\n \"etag\": \"BwUjMhCsNvY=\"\n }\n6. Update the project's IAM policy:\n\n```\ngcloud projects set-iam-policy PROJECT_ID iam.json\n```", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.5", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/c2d65e60-221b-5748-a545-579a69ad4a93.json b/packages/cloud_security_posture/kibana/csp_rule_template/c2d65e60-221b-5748-a545-579a69ad4a93.json new file mode 100644 index 00000000000..cef624726b5 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/c2d65e60-221b-5748-a545-579a69ad4a93.json @@ -0,0 +1,38 @@ +{ + "id": "c2d65e60-221b-5748-a545-579a69ad4a93", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling OS Login on project disables metadata-based SSH key configurations on all instances from a project. Disabling OS Login restores SSH keys that you have configured in project or instance meta-data.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/instances/managing-instance-access\n2. https://cloud.google.com/compute/docs/instances/managing-instance-access#enable_oslogin\n3. https://cloud.google.com/sdk/gcloud/reference/compute/instances/remove-metadata\n4. https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication", + "id": "c2d65e60-221b-5748-a545-579a69ad4a93", + "name": "Ensure Oslogin Is Enabled for a Project", + "profile_applicability": "* Level 1", + "description": "Enabling OS login binds SSH certificates to IAM users and facilitates effective SSH certificate management.", + "rationale": "Enabling osLogin ensures that SSH keys used to connect to instances are mapped with IAM users.\nRevoking access to IAM user will revoke all the SSH keys associated with that particular user.\nIt facilitates centralized and automated SSH key pair management which is useful in handling cases like response to compromised SSH key pairs and/or revocation of external/third-party/Vendor users.", + "audit": "**From Google Cloud Console**\n\n1. Go to the VM compute metadata page by visiting [https://console.cloud.google.com/compute/metadata](https://console.cloud.google.com/compute/metadata).\n\n2. Ensure that key `enable-oslogin` is present with value set to `TRUE`. \n\n3. Because instances can override project settings, ensure that no instance has custom metadata with key `enable-oslogin` and value `FALSE`.\n\n**From Google Cloud CLI**\n\n4. List the instances in your project and get details on each instance:\n```\ngcloud compute instances list --format=json\n```\n5. Verify that the section `commonInstanceMetadata` has a key `enable-oslogin` set to value `TRUE`.\n**Exception:**\nVMs created by GKE should be excluded.\nThese VMs have names that start with `gke-` and are labeled `goog-gke-node`", + "remediation": "**From Google Cloud Console**\n\n1. Go to the VM compute metadata page by visiting: [https://console.cloud.google.com/compute/metadata](https://console.cloud.google.com/compute/metadata).\n\n2. Click `Edit`.\n\n3. Add a metadata entry where the key is `enable-oslogin` and the value is `TRUE`.\n\n4. Click `Save` to apply the changes.\n\n5. For every instance that overrides the project setting, go to the `VM Instances` page at [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n6. Click the name of the instance on which you want to remove the metadata value.\n7. At the top of the instance details page, click `Edit` to edit the instance settings.\n8. Under `Custom metadata`, remove any entry with key `enable-oslogin` and the value is `FALSE`\n9. At the bottom of the instance details page, click `Save` to apply your changes to the instance.\n\n**From Google Cloud CLI**\n\n10. Configure oslogin on the project:\n```\ngcloud compute project-info add-metadata --metadata enable-oslogin=TRUE\n```\n11. Remove instance metadata that overrides the project setting.\n```\ngcloud compute instances remove-metadata --keys=enable-oslogin\n```\n\nOptionally, you can enable two factor authentication for OS login.\nFor more information, see: [https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication](https://cloud.google.com/compute/docs/oslogin/setup-two-factor-authentication).", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.4", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/d3d725bd-652f-573e-97f5-adfd002fab8e.json b/packages/cloud_security_posture/kibana/csp_rule_template/d3d725bd-652f-573e-97f5-adfd002fab8e.json new file mode 100644 index 00000000000..6b09b972b38 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/d3d725bd-652f-573e-97f5-adfd002fab8e.json @@ -0,0 +1,38 @@ +{ + "id": "d3d725bd-652f-573e-97f5-adfd002fab8e", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "The dataset is not publicly accessible. Explicit modification of IAM privileges would be necessary to make them publicly accessible.", + "default_value": "", + "references": "1. https://cloud.google.com/bigquery/docs/dataset-access-controls", + "id": "d3d725bd-652f-573e-97f5-adfd002fab8e", + "name": "Ensure That BigQuery Datasets Are Not Anonymously or Publicly Accessible", + "profile_applicability": "* Level 1", + "description": "It is recommended that the IAM policy on BigQuery datasets does not allow anonymous and/or public access.", + "rationale": "Granting permissions to `allUsers` or `allAuthenticatedUsers` allows anyone to access the dataset.\nSuch access might not be desirable if sensitive data is being stored in the dataset.\nTherefore, ensure that anonymous and/or public access to a dataset is not allowed.", + "audit": "**From Google Cloud Console**\n\n1. Go to `BigQuery` by visiting: [https://console.cloud.google.com/bigquery](https://console.cloud.google.com/bigquery).\n2. Select a dataset from `Resources`.\n3. Click `SHARING` near the right side of the window and select `Permissions`.\n4. Validate that none of the attached roles contain `allUsers` or `allAuthenticatedUsers`.\n\n**From Google Cloud CLI**\n\nList the name of all datasets.\n```\nbq ls\n```\nRetrieve each dataset details using the following command:\n```\nbq show PROJECT_ID:DATASET_NAME\n```\nEnsure that `allUsers` and `allAuthenticatedUsers` have not been granted access to the dataset.", + "remediation": "**From Google Cloud Console**\n\n1. Go to `BigQuery` by visiting: [https://console.cloud.google.com/bigquery](https://console.cloud.google.com/bigquery).\n2. Select the dataset from 'Resources'.\n3. Click `SHARING` near the right side of the window and select `Permissions`.\n4. Review each attached role.\n5. Click the delete icon for each member `allUsers` or `allAuthenticatedUsers`. On the popup click `Remove`.\n\n**From Google Cloud CLI**\n\nList the name of all datasets.\n```\nbq ls\n```\nRetrieve the data set details: \n```\nbq show --format=prettyjson PROJECT_ID:DATASET_NAME > PATH_TO_FILE\n```\nIn the access section of the JSON file, update the dataset information to remove all roles containing `allUsers` or `allAuthenticatedUsers`.\n\nUpdate the dataset:\n```\nbq update --source PATH_TO_FILE PROJECT_ID:DATASET_NAME\n```\n\n**Prevention:**\n\nYou can prevent Bigquery dataset from becoming publicly accessible by setting up the `Domain restricted sharing` organization policy at: https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains .", + "section": "BigQuery", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 7.1", + "BigQuery" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "7.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_7_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/d63a2fd8-7ba2-5589-9899-23f99fd8c846.json b/packages/cloud_security_posture/kibana/csp_rule_template/d63a2fd8-7ba2-5589-9899-23f99fd8c846.json new file mode 100644 index 00000000000..5acfeeacc85 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/d63a2fd8-7ba2-5589-9899-23f99fd8c846.json @@ -0,0 +1,38 @@ +{ + "id": "d63a2fd8-7ba2-5589-9899-23f99fd8c846", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/instances/interacting-with-serial-console", + "id": "d63a2fd8-7ba2-5589-9899-23f99fd8c846", + "name": "Ensure \u2018Enable Connecting to Serial Ports\u2019 Is Not Enabled for VM Instance", + "profile_applicability": "* Level 1", + "description": "Interacting with a serial port is often referred to as the serial console, which is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.\n\nIf you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address.\nTherefore interactive serial console support should be disabled.", + "rationale": "A virtual machine instance has four virtual serial ports.\nInteracting with a serial port is similar to using a terminal window, in that input and output is entirely in text mode and there is no graphical interface or mouse support.\nThe instance's operating system, BIOS, and other system-level entities often write output to the serial ports, and can accept input such as commands or answers to prompts.\nTypically, these system-level entities use the first serial port (port 1) and serial port 1 is often referred to as the serial console.\n\nThe interactive serial console does not support IP-based access restrictions such as IP whitelists.\nIf you enable the interactive serial console on an instance, clients can attempt to connect to that instance from any IP address.\nThis allows anybody to connect to that instance if they know the correct SSH key, username, project ID, zone, and instance name.\n\nTherefore interactive serial console support should be disabled.", + "audit": "**From Google Cloud CLI**\n\n1. Login to Google Cloud console\n2. Go to Computer Engine\n3. Go to VM instances\n4. Click on the Specific VM\n5. Ensure `Enable connecting to serial ports` below `Remote access` block is unselected.\n\n**From Google Cloud Console**\n\nEnsure the below command's output shows `null`:\n\n```\ngcloud compute instances describe --zone= --format=\"json(metadata.items[].key,metadata.items[].value)\"\n``` \n\nor `key` and `value` properties from below command's json response are equal to `serial-port-enable` and `0` or `false` respectively.\n\n```\n {\n \"metadata\": {\n \"items\": [\n {\n \"key\": \"serial-port-enable\",\n \"value\": \"0\"\n }\n ]\n }\n}\n```", + "remediation": "**From Google Cloud CLI**\n\n1. Login to Google Cloud console\n2. Go to Computer Engine\n3. Go to VM instances\n4. Click on the Specific VM\n5. Click `EDIT`\n6. Unselect `Enable connecting to serial ports` below `Remote access` block.\n7. Click `Save`\n\n**From Google Cloud Console**\n\nUse the below command to disable \n```\ngcloud compute instances add-metadata --zone= --metadata=serial-port-enable=false\n```\n\nor\n\n```\ngcloud compute instances add-metadata --zone= --metadata=serial-port-enable=0\n```\n\n**Prevention:**\n\nYou can prevent VMs from having serial port access enable by `Disable VM serial port access` organization policy: \n[https://console.cloud.google.com/iam-admin/orgpolicies/compute-disableSerialPortAccess](https://console.cloud.google.com/iam-admin/orgpolicies/compute-disableSerialPortAccess).", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.5", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.5", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_5" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/dbd6a799-b6c3-5768-ab68-9bd6f63bbd48.json b/packages/cloud_security_posture/kibana/csp_rule_template/dbd6a799-b6c3-5768-ab68-9bd6f63bbd48.json new file mode 100644 index 00000000000..2c020aa532e --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/dbd6a799-b6c3-5768-ab68-9bd6f63bbd48.json @@ -0,0 +1,38 @@ +{ + "id": "dbd6a799-b6c3-5768-ab68-9bd6f63bbd48", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/sqlserver/flags\n2. https://docs.microsoft.com/en-us/sql/database-engine/configure-windows/configure-the-user-options-server-configuration-option?view=sql-server-ver15\n3. https://www.stigviewer.com/stig/ms_sql_server_2016_instance/2018-03-09/finding/V-79335", + "id": "dbd6a799-b6c3-5768-ab68-9bd6f63bbd48", + "name": "Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured", + "profile_applicability": "* Level 1", + "description": "It is recommended that, `user options` database flag for Cloud SQL SQL Server instance should not be configured.", + "rationale": "The `user options` option specifies global defaults for all users.\nA list of default query processing options is established for the duration of a user's work session.\nThe user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).\n\nA user can override these defaults by using the SET statement.\nYou can configure user options dynamically for new logins.\nAfter you change the setting of user options, new login sessions use the new setting; current login sessions are not affected.\nThis recommendation is applicable to SQL Server database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `user options` that has been set is not listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. Ensure the below command returns empty result for every Cloud SQL SQL Server database instance\n```\ngcloud sql instances list --format=json | jq '.settings.databaseFlags[] | select(.name==\"user options\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the SQL Server instance for which you want to enable to database flag.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. Click the X next `user options` flag shown\n6. Click `Save` to save your changes.\n7. Confirm your changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. List all Cloud SQL database Instances\n```\ngcloud sql instances list\n```\n9. Clear the `user options` database flag for every Cloud SQL SQL Server database instance using either of the below commands.\n\n```\n10. 1.Clearing all flags to their default value\n\ngcloud sql instances patch --clear-database-flags\n\nOR\n11. To clear only `user options` database flag, configure the database flag by overriding the `user options`. Exclude `user options` flag and its value, and keep all other flags you want to configure.\n\ngcloud sql instances patch --database-flags [FLAG1=VALUE1,FLAG2=VALUE2]\n```\n\n```\nNote : \n\nThis command will overwrite all database flags previously set.\nTo keep those and add new ones, include the values for all flags you want set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "SQL Server", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.3.4", + "SQL Server" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.3.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_3_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/e2306922-4f95-5660-bf2e-9610f556de69.json b/packages/cloud_security_posture/kibana/csp_rule_template/e2306922-4f95-5660-bf2e-9610f556de69.json new file mode 100644 index 00000000000..d9e95e0dd03 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/e2306922-4f95-5660-bf2e-9610f556de69.json @@ -0,0 +1,38 @@ +{ + "id": "e2306922-4f95-5660-bf2e-9610f556de69", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "All Remote Desktop Protocol (RDP) connections from outside of the network to the concerned VPC(s) will be blocked. There could be a business need where secure shell access is required from outside of the network to access resources associated with the VPC. In that case, specific source IP(s) should be mentioned in firewall rules to white-list access to RDP port for the concerned VPC(s).", + "default_value": "", + "references": "1. https://cloud.google.com/vpc/docs/firewalls#blockedtraffic\n2. https://cloud.google.com/blog/products/identity-security/cloud-iap-enables-context-aware-access-to-vms-via-ssh-and-rdp-without-bastion-hosts", + "id": "e2306922-4f95-5660-bf2e-9610f556de69", + "name": "Ensure That RDP Access Is Restricted From the Internet", + "profile_applicability": "* Level 2", + "description": "GCP `Firewall Rules` are specific to a `VPC Network`.\nEach rule either `allows` or `denies` traffic when its conditions are met.\nIts conditions allow users to specify the type of traffic, such as ports and protocols, and the source or destination of the traffic, including IP addresses, subnets, and instances.\n\nFirewall rules are defined at the VPC network level and are specific to the network in which they are defined.\nThe rules themselves cannot be shared among networks.\nFirewall rules only support IPv4 traffic.\nWhen specifying a source for an ingress rule or a destination for an egress rule by address, an `IPv4` address or `IPv4 block in CIDR` notation can be used.\nGeneric `(0.0.0.0/0)` incoming traffic from the Internet to a VPC or VM instance using `RDP` on `Port 3389` can be avoided.", + "rationale": "GCP `Firewall Rules` within a `VPC Network`.\nThese rules apply to outgoing (egress) traffic from instances and incoming (ingress) traffic to instances in the network.\nEgress and ingress traffic flows are controlled even if the traffic stays within the network (for example, instance-to-instance communication).\nFor an instance to have outgoing Internet access, the network must have a valid Internet gateway route or custom route whose destination IP is specified.\nThis route simply defines the path to the Internet, to avoid the most general `(0.0.0.0/0)` destination `IP Range` specified from the Internet through `RDP` with the default `Port 3389`.\nGeneric access from the Internet to a specific IP Range should be restricted.", + "audit": "**From Google Cloud Console**\n\n1. Go to `VPC network`.\n2. Go to the `Firewall Rules`.\n3. Ensure `Port` is not equal to `3389` and `Action` is not `Allow`.\n4. Ensure `IP Ranges` is not equal to `0.0.0.0/0` under `Source filters`.\n\n**From Google Cloud CLI**\n\n gcloud compute firewall-rules list --format=table'(name,direction,sourceRanges,allowed.ports)'\n\nEnsure that there is no rule matching the below criteria:\n- `SOURCE_RANGES` is `0.0.0.0/0`\n- AND `DIRECTION` is `INGRESS`\n- AND IPProtocol is `TCP` or `ALL`\n- AND `PORTS` is set to `3389` or `range containing 3389` or `Null (not set)`\n\nNote: \n- When ALL TCP ports are allowed in a rule, PORT does not have any value set (`NULL`)\n- When ALL Protocols are allowed in a rule, PORT does not have any value set (`NULL`)", + "remediation": "**From Google Cloud Console**\n\n1. Go to `VPC Network`.\n2. Go to the `Firewall Rules`.\n3. Click the `Firewall Rule` to be modified.\n4. Click `Edit`.\n5. Modify `Source IP ranges` to specific `IP`.\n6. Click `Save`.\n\n**From Google Cloud CLI**\n\n7. 1.Update RDP Firewall rule with new `SOURCE_RANGE` from the below command:\n\n gcloud compute firewall-rules update FirewallName --allow=[PROTOCOL[:PORT[-PORT]],...] --source-ranges=[CIDR_RANGE,...]", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.7", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/e833e6a8-673d-56b2-a979-f9aa4e52cb71.json b/packages/cloud_security_posture/kibana/csp_rule_template/e833e6a8-673d-56b2-a979-f9aa4e52cb71.json new file mode 100644 index 00000000000..30d126e76bb --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/e833e6a8-673d-56b2-a979-f9aa4e52cb71.json @@ -0,0 +1,38 @@ +{ + "id": "e833e6a8-673d-56b2-a979-f9aa4e52cb71", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "'- Confidential Computing for Compute instances does not support live migration. Unlike regular Compute instances, Confidential VMs experience disruptions during maintenance events like a software or hardware update.\n- Additional charges may be incurred when enabling this security feature. See [https://cloud.google.com/compute/confidential-vm/pricing](https://cloud.google.com/compute/confidential-vm/pricing) for more info.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/confidential-vm/docs/creating-cvm-instance\n2. https://cloud.google.com/compute/confidential-vm/docs/about-cvm\n3. https://cloud.google.com/confidential-computing\n4. https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-confidential-computing-with-confidential-vms", + "id": "e833e6a8-673d-56b2-a979-f9aa4e52cb71", + "name": "Ensure That Compute Instances Have Confidential Computing Enabled", + "profile_applicability": "* Level 2", + "description": "Google Cloud encrypts data at-rest and in-transit, but customer data must be decrypted for processing.\nConfidential Computing is a breakthrough technology which encrypts data in-use\u2014while it is being processed.\nConfidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU).\n\n\nConfidential VMs leverage the Secure Encrypted Virtualization (SEV) feature of AMD EPYC\u2122 CPUs.\nCustomer data will stay encrypted while it is used, indexed, queried, or trained on.\nEncryption keys are generated in hardware, per VM, and not exportable.\nThanks to built-in hardware optimizations of both performance and security, there is no significant performance penalty to Confidential Computing workloads.", + "rationale": "Confidential Computing enables customers' sensitive code and other data encrypted in memory during processing.\nGoogle does not have access to the encryption keys.\nConfidential VM can help alleviate concerns about risk related to either dependency on Google infrastructure or Google insiders' access to customer data in the clear.", + "audit": "Note: Confidential Computing is currently only supported on N2D machines.\nTo learn more about types of N2D machines, visit [https://cloud.google.com/compute/docs/machine-types#n2d_machine_types](https://cloud.google.com/compute/docs/machine-types#n2d_machine_types)\n\n**From Google Cloud Console**\n\n1. Go to the `VM instances` page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click on the instance name to see its VM instance details page.\n\n3. Ensure that `Confidential VM service` is `Enabled`.\n\n**From Google Cloud CLI**\n\n4. List the instances in your project and get details on each instance:\n\n```\ngcloud compute instances list --format=json\n```\n5. Ensure that `enableConfidentialCompute` is set to `true` for all instances with machine type starting with \"n2d-\".\n\n```\nconfidentialInstanceConfig:\n enableConfidentialCompute: true\n```", + "remediation": "Confidential Computing can only be enabled when an instance is created.\nYou must delete the current instance and create a new one.\n\n**From Google Cloud Console**\n\n1. Go to the VM instances page by visiting: [https://console.cloud.google.com/compute/instances](https://console.cloud.google.com/compute/instances).\n\n2. Click `CREATE INSTANCE`.\n\n3. Fill out the desired configuration for your instance.\n\n4. Under the `Confidential VM service` section, check the option `Enable the Confidential Computing service on this VM instance`.\n\n5. Click `Create`.\n\n**From Google Cloud CLI**\n\nCreate a new instance with Confidential Compute enabled.\n\n\n```\ngcloud compute instances create --zone --confidential-compute --maintenance-policy=TERMINATE \n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.11", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.11", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_11" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/e83a8e8a-e34b-5a01-8142-82d5aef60cab.json b/packages/cloud_security_posture/kibana/csp_rule_template/e83a8e8a-e34b-5a01-8142-82d5aef60cab.json new file mode 100644 index 00000000000..a1d1432645c --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/e83a8e8a-e34b-5a01-8142-82d5aef60cab.json @@ -0,0 +1,38 @@ +{ + "id": "e83a8e8a-e34b-5a01-8142-82d5aef60cab", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging", + "id": "e83a8e8a-e34b-5a01-8142-82d5aef60cab", + "name": "Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes", + "profile_applicability": "* Level 1", + "description": "In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all `roles/Owner` assignments should be monitored.\n\nMembers (users/Service-Accounts) with a role assignment to primitive role `roles/Owner` are project owners.\n\nThe project owner has all the privileges on the project the role belongs to.\nThese are summarized below:\n- All viewer permissions on all GCP Services within the project\n- Permissions for actions that modify the state of all GCP services within the project\n- Manage roles and permissions for a project and all resources within the project\n- Set up billing for a project\n\nGranting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy.\nTherefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy.\nThis is because the project IAM policy contains sensitive access control data.\nHaving a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.", + "rationale": "Project ownership has the highest level of privileges on a project.\nTo avoid misuse of project resources, the project ownership assignment/change actions mentioned above should be monitored and alerted to concerned recipients.\n- Sending project ownership invites\n- Acceptance/Rejection of project ownership invite by user\n- Adding `role\\Owner` to a user/service-account\n- Removing a user/Service account from `role\\Owner`", + "audit": "**From Google Cloud Console**\n\n**Ensure that the prescribed log metric is present:**\n\n1. Go to `Logging/Log-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure that at least one metric `` is present with filter text:\n\n```\n(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") \nAND (ProjectOwnership OR projectOwnerInvitee) \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"REMOVE\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\") \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"ADD\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\")\n```\n\n**Ensure that the prescribed Alerting Policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for your organization.\n\n5. Ensure that the appropriate notifications channels have been set up.\n\n**From Google Cloud CLI**\n\n**Ensure that the prescribed log metric is present:**\n\n6. List the log metrics:\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with filter set to: \n```\n(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") \nAND (ProjectOwnership OR projectOwnerInvitee) \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"REMOVE\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\") \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"ADD\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\")\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains an least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`", + "remediation": "**From Google Cloud Console**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n\n```\n(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") \nAND (ProjectOwnership OR projectOwnerInvitee) \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"REMOVE\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\") \nOR (protoPayload.serviceData.policyDelta.bindingDeltas.action=\"ADD\" \nAND protoPayload.serviceData.policyDelta.bindingDeltas.role=\"roles/owner\")\n```\n\n4. Click `Submit Filter`. The logs display based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and the `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create the display prescribed Alert Policy:** \n\n7. Identify the newly created metric under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the desired metric and select `Create alert from Metric`. A new page opens.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notifications channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate a prescribed Log Metric:\n- Use the command: gcloud beta logging metrics create \n- Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create\n\nCreate prescribed Alert Policy \n- Use the command: gcloud alpha monitoring policies create\n- Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.4", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.4", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_4" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/ec7949d4-9e55-5f44-8c4a-a0e674a2a46f.json b/packages/cloud_security_posture/kibana/csp_rule_template/ec7949d4-9e55-5f44-8c4a-a0e674a2a46f.json new file mode 100644 index 00000000000..d87d91ecc2c --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/ec7949d4-9e55-5f44-8c4a-a0e674a2a46f.json @@ -0,0 +1,38 @@ +{ + "id": "ec7949d4-9e55-5f44-8c4a-a0e674a2a46f", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "", + "default_value": "", + "references": "1. https://cloudplatform.googleblog.com/2017/11/DNSSEC-now-available-in-Cloud-DNS.html\n2. https://cloud.google.com/dns/dnssec-config#enabling\n3. https://cloud.google.com/dns/dnssec", + "id": "ec7949d4-9e55-5f44-8c4a-a0e674a2a46f", + "name": "Ensure That DNSSEC Is Enabled for Cloud DNS", + "profile_applicability": "* Level 1", + "description": "Cloud Domain Name System (DNS) is a fast, reliable and cost-effective domain name system that powers millions of domains on the internet.\nDomain Name System Security Extensions (DNSSEC) in Cloud DNS enables domain owners to take easy steps to protect their domains against DNS hijacking and man-in-the-middle and other attacks.", + "rationale": "Domain Name System Security Extensions (DNSSEC) adds security to the DNS protocol by enabling DNS responses to be validated.\nHaving a trustworthy DNS that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today\u2019s web-based applications.\nAttackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks.\nDNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records.\nAs a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites.", + "audit": "**From Google Cloud Console**\n\n1. Go to `Cloud DNS` by visiting [https://console.cloud.google.com/net-services/dns/zones](https://console.cloud.google.com/net-services/dns/zones).\n2. For each zone of `Type` `Public`, ensure that `DNSSEC` is set to `On`.\n\n**From Google Cloud CLI**\n\n3. List all the Managed Zones in a project:\n```\ngcloud dns managed-zones list\n```\n\n4. For each zone of `VISIBILITY` `public`, get its metadata: \n\n```\ngcloud dns managed-zones describe ZONE_NAME\n```\n\n5. Ensure that `dnssecConfig.state` property is `on`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to `Cloud DNS` by visiting [https://console.cloud.google.com/net-services/dns/zones](https://console.cloud.google.com/net-services/dns/zones).\n2. For each zone of `Type` `Public`, set `DNSSEC` to `On`.\n\n**From Google Cloud CLI**\n\nUse the below command to enable `DNSSEC` for Cloud DNS Zone Name.\n```\ngcloud dns managed-zones update ZONE_NAME --dnssec-state on\n```", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.3", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/eed3e284-5030-56db-b749-01d7120dc577.json b/packages/cloud_security_posture/kibana/csp_rule_template/eed3e284-5030-56db-b749-01d7120dc577.json new file mode 100644 index 00000000000..51b4d485e3e --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/eed3e284-5030-56db-b749-01d7120dc577.json @@ -0,0 +1,38 @@ +{ + "id": "eed3e284-5030-56db-b749-01d7120dc577", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Using Customer-managed encryption keys (CMEK) will incur additional labor-hour investment to create, protect, and manage the keys.", + "default_value": "", + "references": "1. https://cloud.google.com/bigquery/docs/customer-managed-encryption", + "id": "eed3e284-5030-56db-b749-01d7120dc577", + "name": "Ensure That a Default Customer-Managed Encryption Key (CMEK) Is Specified for All BigQuery Data Sets", + "profile_applicability": "* Level 2", + "description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys.\nThe data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`.\nThis is seamless and do not require any additional input from the user.\nHowever, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.", + "rationale": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys.\nThis is seamless and does not require any additional input from the user.\n\nFor greater control over the encryption, customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.\nSetting a Default Customer-managed encryption key (CMEK) for a data set ensure any tables created in future will use the specified CMEK if none other is provided.\n\n```\nNote: Google does not store your keys on its servers and cannot access your protected data unless you provide the key.\nThis also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key.\n```", + "audit": "**From Google Cloud Console**\n\n1. Go to `Analytics`\n2. Go to `BigQuery`\n3. Under `Analysis` click on `SQL Workspaces`, select the project\n4. Select Data Set\n5. Ensure `Customer-managed key` is present under `Dataset info` section.\n6. Repeat for each data set in all projects.\n\n**From Google Cloud CLI**\n\nList all dataset names\n```\nbq ls\n```\nUse the following command to view each dataset details.\n```\nbq show \n```\nVerify the `kmsKeyName` is present.", + "remediation": "**From Google Cloud CLI**\n\nThe default CMEK for existing data sets can be updated by specifying the default key in the `EncryptionConfiguration.kmsKeyName` field when calling the `datasets.insert` or `datasets.patch` methods", + "section": "BigQuery", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 7.3", + "BigQuery" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "7.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_7_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/f00c266c-0e28-5c49-b2b0-cd97603341ec.json b/packages/cloud_security_posture/kibana/csp_rule_template/f00c266c-0e28-5c49-b2b0-cd97603341ec.json new file mode 100644 index 00000000000..a0e7ecafbdd --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/f00c266c-0e28-5c49-b2b0-cd97603341ec.json @@ -0,0 +1,38 @@ +{ + "id": "f00c266c-0e28-5c49-b2b0-cd97603341ec", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Using Customer-managed encryption keys (CMEK) will incur additional labor-hour investment to create, protect, and manage the keys.", + "default_value": "", + "references": "1. https://cloud.google.com/bigquery/docs/customer-managed-encryption", + "id": "f00c266c-0e28-5c49-b2b0-cd97603341ec", + "name": "Ensure That All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK)", + "profile_applicability": "* Level 2", + "description": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys.\nThe data is encrypted using the `data encryption keys` and data encryption keys themselves are further encrypted using `key encryption keys`.\nThis is seamless and do not require any additional input from the user.\nHowever, if you want to have greater control, Customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery Data Sets.\nIf CMEK is used, the CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.", + "rationale": "BigQuery by default encrypts the data as rest by employing `Envelope Encryption` using Google managed cryptographic keys.\nThis is seamless and does not require any additional input from the user.\n\nFor greater control over the encryption, customer-managed encryption keys (CMEK) can be used as encryption key management solution for BigQuery tables.\nThe CMEK is used to encrypt the data encryption keys instead of using google-managed encryption keys.\nBigQuery stores the table and CMEK association and the encryption/decryption is done automatically.\n\nApplying the Default Customer-managed keys on BigQuery data sets ensures that all the new tables created in the future will be encrypted using CMEK but existing tables need to be updated to use CMEK individually.\n\n```\nNote: Google does not store your keys on its servers and cannot access your protected data unless you provide the key.\nThis also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key.\n```", + "audit": "**From Google Cloud Console**\n\n1. Go to `Analytics`\n2. Go to `BigQuery`\n3. Under `SQL Workspace`, select the project\n4. Select Data Set, select the table\n5. Go to `Details` tab\n6. Under `Table info`, verify `Customer-managed key` is present.\n7. Repeat for each table in all data sets for all projects.\n\n**From Google Cloud CLI**\n\nList all dataset names\n```\nbq ls\n```\nUse the following command to view the table details.\nVerify the `kmsKeyName` is present.\n```\nbq show \n```", + "remediation": "**From Google Cloud CLI**\nUse the following command to copy the data.\nThe source and the destination needs to be same in case copying to the original table.\n```\nbq cp --destination_kms_key source_dataset.source_table destination_dataset.destination_table\n```", + "section": "BigQuery", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 7.2", + "BigQuery" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "7.2", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_7_2" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/f44d0940-2e62-5993-9028-d3e63ae23960.json b/packages/cloud_security_posture/kibana/csp_rule_template/f44d0940-2e62-5993-9028-d3e63ae23960.json new file mode 100644 index 00000000000..381a94bb82a --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/f44d0940-2e62-5993-9028-d3e63ae23960.json @@ -0,0 +1,38 @@ +{ + "id": "f44d0940-2e62-5993-9028-d3e63ae23960", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "On high use systems with a high percentage sample rate, the logging file may grow to high capacity in a short amount of time. Ensure that the sample rate is set appropriately so that storage costs are not exorbitant.", + "default_value": "", + "references": "1. https://cloud.google.com/load-balancing/\n2. https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring#gcloud:-global-mode\n3. https://cloud.google.com/sdk/gcloud/reference/compute/backend-services/", + "id": "f44d0940-2e62-5993-9028-d3e63ae23960", + "name": "Ensure Logging is enabled for HTTP(S) Load Balancer", + "profile_applicability": "* Level 2", + "description": "Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.", + "rationale": "Logging will allow you to view HTTPS network traffic to your web applications.", + "audit": "**From Google Cloud Console**\n\n1. From Google Cloud home open the Navigation Menu in the top left.\n\n2. Under the `Networking` heading select `Network services`.\n\n3. Select the HTTPS load-balancer you wish to audit.\n\n4. Select `Edit` then `Backend Configuration`. \n\n5. Select `Edit` on the corresponding backend service.\n\n6. Ensure that `Enable Logging` is selected. Also ensure that `Sample Rate` is set to an appropriate level for your needs.\n\n**From Google Cloud CLI**\n\n7. Run the following command\n\n```\ngcloud compute backend-services describe \n```\n\n8. Ensure that ```enable-logging``` is enabled and ```sample rate``` is set to your desired level.", + "remediation": "**From Google Cloud Console**\n\n1. From Google Cloud home open the Navigation Menu in the top left.\n\n2. Under the `Networking` heading select `Network services`.\n\n3. Select the HTTPS load-balancer you wish to audit.\n\n4. Select `Edit` then `Backend Configuration`. \n\n5. Select `Edit` on the corresponding backend service.\n\n6. Click `Enable Logging`.\n\n7. Set `Sample Rate` to a desired value. This is a percentage as a decimal point. 1.0 is 100%.\n\n**From Google Cloud CLI**\n\n8. Run the following command\n\n```\ngcloud compute backend-services update --region=REGION --enable-logging --logging-sample-rate=\n```", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.16", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.16", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_16" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/f62488d2-4b52-57d4-8ecd-d8f47dcb3dda.json b/packages/cloud_security_posture/kibana/csp_rule_template/f62488d2-4b52-57d4-8ecd-d8f47dcb3dda.json new file mode 100644 index 00000000000..f6dc8318d80 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/f62488d2-4b52-57d4-8ecd-d8f47dcb3dda.json @@ -0,0 +1,38 @@ +{ + "id": "f62488d2-4b52-57d4-8ecd-d8f47dcb3dda", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Disabling `local_infile` makes the server refuse local data loading by clients that have LOCAL enabled on the client side.", + "default_value": "", + "references": "1. https://cloud.google.com/sql/docs/mysql/flags\n2. https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html#sysvar_local_infile\n3. https://dev.mysql.com/doc/refman/5.7/en/load-data-local.html", + "id": "f62488d2-4b52-57d4-8ecd-d8f47dcb3dda", + "name": "Ensure That the \u2018Local_infile\u2019 Database Flag for a Cloud SQL MySQL Instance Is Set to \u2018Off\u2019", + "profile_applicability": "* Level 1", + "description": "It is recommended to set the `local_infile` database flag for a Cloud SQL MySQL instance to `off`.", + "rationale": "The `local_infile` flag controls the server-side LOCAL capability for LOAD DATA statements.\nDepending on the `local_infile` setting, the server refuses or permits local data loading by clients that have LOCAL enabled on the client side.\n\nTo explicitly cause the server to refuse LOAD DATA LOCAL statements (regardless of how client programs and libraries are configured at build time or runtime), start mysqld with local_infile disabled.\nlocal_infile can also be set at runtime.\n\nDue to security issues associated with the `local_infile` flag, it is recommended to disable it.\nThis recommendation is applicable to MySQL database instances.", + "audit": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the instance to open its `Instance Overview` page\n3. Ensure the database flag `local_infile` that has been set is listed under the `Database flags` section.\n\n**From Google Cloud CLI**\n\n4. List all Cloud SQL database instances:\n```\ngcloud sql instances list\n```\n5. Ensure the below command returns `off` for every Cloud SQL MySQL database instance.\n```\ngcloud sql instances describe INSTANCE_NAME --format=json | jq '.settings.databaseFlags[] | select(.name==\"local_infile\")|.value'\n```", + "remediation": "**From Google Cloud Console**\n\n1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting [https://console.cloud.google.com/sql/instances](https://console.cloud.google.com/sql/instances).\n2. Select the MySQL instance where the database flag needs to be enabled.\n3. Click `Edit`.\n4. Scroll down to the `Flags` section.\n5. To set a flag that has not been set on the instance before, click `Add item`, choose the flag `local_infile` from the drop-down menu, and set its value to `off`.\n6. Click `Save`.\n7. Confirm the changes under `Flags` on the Overview page.\n\n**From Google Cloud CLI**\n\n8. List all Cloud SQL database instances using the following command:\n```\ngcloud sql instances list\n```\n9. Configure the `local_infile` database flag for every Cloud SQL Mysql database instance using the below command:\n```\ngcloud sql instances patch INSTANCE_NAME --database-flags local_infile=off\n```\n\n```\nNote : \n\nThis command will overwrite all database flags that were previously set.\nTo keep those and add new ones, include the values for all flags to be set on the instance; any flag not specifically included is set to its default value.\nFor flags that do not take a value, specify the flag name followed by an equals sign (\"=\").\n```", + "section": "MySQL Database", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 6.1.3", + "MySQL Database" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "6.1.3", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_6_1_3" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/fb4368ab-cdee-5188-814c-a8197411ba22.json b/packages/cloud_security_posture/kibana/csp_rule_template/fb4368ab-cdee-5188-814c-a8197411ba22.json new file mode 100644 index 00000000000..1c7957788ac --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/fb4368ab-cdee-5188-814c-a8197411ba22.json @@ -0,0 +1,38 @@ +{ + "id": "fb4368ab-cdee-5188-814c-a8197411ba22", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "No storage buckets would be publicly accessible. You would have to explicitly administer bucket access.", + "default_value": "", + "references": "1. https://cloud.google.com/storage/docs/access-control/iam-reference\n2. https://cloud.google.com/storage/docs/access-control/making-data-public\n3. https://cloud.google.com/storage/docs/gsutil/commands/iam", + "id": "fb4368ab-cdee-5188-814c-a8197411ba22", + "name": "Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible", + "profile_applicability": "* Level 1", + "description": "It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access.", + "rationale": "Allowing anonymous or public access grants permissions to anyone to access bucket content.\nSuch access might not be desired if you are storing any sensitive data.\nHence, ensure that anonymous or public access to a bucket is not allowed.", + "audit": "**From Google Cloud Console**\n\n1. Go to `Storage browser` by visiting [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser).\n2. Click on each bucket name to go to its `Bucket details` page.\n3. Click on the `Permissions` tab.\n4. Ensure that `allUsers` and `allAuthenticatedUsers` are not in the `Members` list.\n\n**From Google Cloud CLI**\n\n5. List all buckets in a project\n\n```\ngsutil ls\n```\n\n6. Check the IAM Policy for each bucket:\n\n```\ngsutil iam get gs://BUCKET_NAME\n```\n\nNo role should contain `allUsers` and/or `allAuthenticatedUsers` as a member.\n\n**Using Rest API**\n\n7. List all buckets in a project\n\n```\nGet https://www.googleapis.com/storage/v1/b?project=\n```\n\n8. Check the IAM Policy for each bucket\n\n```\nGET https://www.googleapis.com/storage/v1/b//iam\n```\n\nNo role should contain `allUsers` and/or `allAuthenticatedUsers` as a member.", + "remediation": "**From Google Cloud Console**\n\n1. Go to `Storage browser` by visiting [https://console.cloud.google.com/storage/browser](https://console.cloud.google.com/storage/browser).\n2. Click on the bucket name to go to its `Bucket details` page.\n3. Click on the `Permissions` tab. \n4. Click `Delete` button in front of `allUsers` and `allAuthenticatedUsers` to remove that particular role assignment.\n\n**From Google Cloud CLI**\n\nRemove `allUsers` and `allAuthenticatedUsers` access.\n```\ngsutil iam ch -d allUsers gs://BUCKET_NAME\ngsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME\n```\n\n**Prevention:**\n\nYou can prevent Storage buckets from becoming publicly accessible by setting up the `Domain restricted sharing` organization policy at:[ https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains ](https://console.cloud.google.com/iam-admin/orgpolicies/iam-allowedPolicyMemberDomains).", + "section": "Storage", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 5.1", + "Storage" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "5.1", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_5_1" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/fdff0b83-dc73-5d60-9ad3-b98ed139a1b4.json b/packages/cloud_security_posture/kibana/csp_rule_template/fdff0b83-dc73-5d60-9ad3-b98ed139a1b4.json new file mode 100644 index 00000000000..c9315c54778 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/fdff0b83-dc73-5d60-9ad3-b98ed139a1b4.json @@ -0,0 +1,38 @@ +{ + "id": "fdff0b83-dc73-5d60-9ad3-b98ed139a1b4", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Rotating service account keys will break communication for dependent applications. Dependent applications need to be configured manually with the new key `ID` displayed in the `Service account keys` section and the `private key` downloaded by the user.", + "default_value": "", + "references": "1. https://cloud.google.com/iam/docs/understanding-service-accounts#managing_service_account_keys\n2. https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/keys/list\n3. https://cloud.google.com/iam/docs/service-accounts", + "id": "fdff0b83-dc73-5d60-9ad3-b98ed139a1b4", + "name": "Ensure User-Managed/External Keys for Service Accounts Are Rotated Every 90 Days or Fewer", + "profile_applicability": "* Level 1", + "description": "Service Account keys consist of a key ID (Private_key_Id) and Private key, which are used to sign programmatic requests users make to Google cloud services accessible to that particular service account.\nIt is recommended that all Service Account keys are regularly rotated.", + "rationale": "Rotating Service Account keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used.\nService Account keys should be rotated to ensure that data cannot be accessed with an old key that might have been lost, cracked, or stolen.\n\nEach service account is associated with a key pair managed by Google Cloud Platform (GCP).\nIt is used for service-to-service authentication within GCP.\nGoogle rotates the keys daily.\n\nGCP provides the option to create one or more user-managed (also called external key pairs) key pairs for use from outside GCP (for example, for use with Application Default Credentials).\nWhen a new key pair is created, the user is required to download the private key (which is not retained by Google).\nWith external keys, users are responsible for keeping the private key secure and other management operations such as key rotation.\nExternal keys can be managed by the IAM API, gcloud command-line tool, or the Service Accounts page in the Google Cloud Platform Console.\nGCP facilitates up to 10 external service account keys per service account to facilitate key rotation.", + "audit": "**From Google Cloud Console**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the section `Service Account Keys`, for every External (user-managed) service account key listed ensure the `creation date` is within the past 90 days.\n\n**From Google Cloud CLI**\n\n3. List all Service accounts from a project.\n\n```\ngcloud iam service-accounts list\n```\n\n4. For every service account list service account keys.\n\n```\ngcloud iam service-accounts keys list --iam-account [Service_Account_Email_Id] --format=json\n```\n\n5. Ensure every service account key for a service account has a `\"validAfterTime\"` value within the past 90 days.", + "remediation": "**From Google Cloud Console**\n\n**Delete any external (user-managed) Service Account Key older than 90 days:**\n\n1. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n2. In the Section `Service Account Keys`, for every external (user-managed) service account key where `creation date` is greater than or equal to the past 90 days, click `Delete Bin Icon` to `Delete Service Account key`\n\n**Create a new external (user-managed) Service Account Key for a Service Account:**\n\n3. Go to `APIs & Services\\Credentials` using `https://console.cloud.google.com/apis/credentials`\n\n4. Click `Create Credentials` and Select `Service Account Key`.\n\n5. Choose the service account in the drop-down list for which an External (user-managed) Service Account key needs to be created.\n\n6. Select the desired key type format among `JSON` or `P12`.\n\n7. Click `Create`. It will download the `private key`. Keep it safe. \n\n8. Click `Close` if prompted. \n\n9. The site will redirect to the `APIs & Services\\Credentials` page. Make a note of the new `ID` displayed in the `Service account keys` section.", + "section": "Identity and Access Management", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 1.7", + "Identity and Access Management" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "1.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_1_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/fe083488-fa0f-5408-9624-ac27607ac2ff.json b/packages/cloud_security_posture/kibana/csp_rule_template/fe083488-fa0f-5408-9624-ac27607ac2ff.json new file mode 100644 index 00000000000..ba74705f786 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/fe083488-fa0f-5408-9624-ac27607ac2ff.json @@ -0,0 +1,38 @@ +{ + "id": "fe083488-fa0f-5408-9624-ac27607ac2ff", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Standard pricing for Stackdriver Logging, BigQuery, or Cloud Pub/Sub applies. VPC Flow Logs generation will be charged starting in GA as described in reference: https://cloud.google.com/vpc/", + "default_value": "", + "references": "1. https://cloud.google.com/vpc/docs/using-flow-logs#enabling_vpc_flow_logging\n2. https://cloud.google.com/vpc/", + "id": "fe083488-fa0f-5408-9624-ac27607ac2ff", + "name": "Ensure that VPC Flow Logs is Enabled for Every Subnet in a VPC Network", + "profile_applicability": "* Level 2", + "description": "Flow Logs is a feature that enables users to capture information about the IP traffic going to and from network interfaces in the organization's VPC Subnets.\nOnce a flow log is created, the user can view and retrieve its data in Stackdriver Logging.\nIt is recommended that Flow Logs be enabled for every business-critical VPC subnet.", + "rationale": "VPC networks and subnetworks not reserved for internal HTTP(S) load balancing provide logically isolated and secure network partitions where GCP resources can be launched.\nWhen Flow Logs are enabled for a subnet, VMs within that subnet start reporting on all Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) flows.\nEach VM samples the TCP and UDP flows it sees, inbound and outbound, whether the flow is to or from another VM, a host in the on-premises datacenter, a Google service, or a host on the Internet.\nIf two GCP VMs are communicating, and both are in subnets that have VPC Flow Logs enabled, both VMs report the flows.\n\nFlow Logs supports the following use cases:\n\n- Network monitoring\n- Understanding network usage and optimizing network traffic expenses\n- Network forensics\n- Real-time security analysis\n\nFlow Logs provide visibility into network traffic for each VM inside the subnet and can be used to detect anomalous traffic or provide insight during security workflows.\n\nThe Flow Logs must be configured such that all network traffic is logged, the interval of logging is granular to provide detailed information on the connections, no logs are filtered, and metadata to facilitate investigations are included.\n\n**Note**: Subnets reserved for use by internal HTTP(S) load balancers do not support VPC flow logs.", + "audit": "**From Google Cloud Console**\n\n1. Go to the VPC network GCP Console visiting `https://console.cloud.google.com/networking/networks/list` \n\n2. From the list of network subnets, make sure for each subnet:\n- `Flow Logs` is set to `On`\n- `Aggregation Interval` is set to `5 sec`\n- `Include metadata` checkbox is checked\n- `Sample rate` is set to `100%`\n\n**Note**: It is not possible to determine if a Log filter has been defined from the console.\n\n**From Google Cloud CLI**\n\n```\ngcloud compute networks subnets list --format json | \\\n jq -r '([\"Subnet\",\"Purpose\",\"Flow_Logs\",\"Aggregation_Interval\",\"Flow_Sampling\",\"Metadata\",\"Logs_Filtered\"] | (., map(length*\"-\"))), \n (.[] | \n [\n .name, \n .purpose,\n (if has(\"enableFlowLogs\") and .enableFlowLogs == true then \"Enabled\" else \"Disabled\" end),\n (if has(\"logConfig\") then .logConfig.aggregationInterval else \"N/A\" end),\n (if has(\"logConfig\") then .logConfig.flowSampling else \"N/A\" end),\n (if has(\"logConfig\") then .logConfig.metadata else \"N/A\" end),\n (if has(\"logConfig\") then (.logConfig | has(\"filterExpr\")) else \"N/A\" end)\n ]\n ) | \n @tsv' | \\\n column -t\n\n```\n\nThe output of the above command will list:\n- each subnet\n- the subnet's purpose\n- a `Enabled` or `Disabled` value if `Flow Logs` are enabled\n- the value for `Aggregation Interval` or `N/A` if disabled, the value for `Flow Sampling` or `N/A` if disabled\n- the value for `Metadata` or `N/A` if disabled\n- 'true' or 'false' if a Logging Filter is configured or 'N/A' if disabled.\n\nIf the subnet's purpose is `PRIVATE` then `Flow Logs` should be `Enabled`.\n\nIf `Flow Logs` is enabled then:\n- `Aggregation_Interval` should be `INTERVAL_5_SEC`\n- `Flow_Sampling` should be 1\n- `Metadata` should be `INCLUDE_ALL_METADATA`\n- `Logs_Filtered` should be `false`.", + "remediation": "**From Google Cloud Console**\n\n1. Go to the VPC network GCP Console visiting `https://console.cloud.google.com/networking/networks/list` \n\n2. Click the name of a subnet, The `Subnet details` page displays.\n\n3. Click the `EDIT` button.\n\n4. Set `Flow Logs` to `On`.\n\n5. Expand the `Configure Logs` section.\n\n6. Set `Aggregation Interval` to `5 SEC`.\n\n7. Check the box beside `Include metadata`.\n\n8. Set `Sample rate` to `100`.\n\n9. Click Save.\n\n**Note**: It is not possible to configure a Log filter from the console.\n\n**From Google Cloud CLI**\n\nTo enable VPC Flow Logs for a network subnet, run the following command:\n```\ngcloud compute networks subnets update [SUBNET_NAME] --region [REGION] --enable-flow-logs --logging-aggregation-interval=interval-5-sec --logging-flow-sampling=1 --logging-metadata=include-all\n```", + "section": "Networking", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 3.8", + "Networking" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "3.8", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_3_8" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/ff3a8287-e4ac-5a3c-b0d7-4f349e0ab077.json b/packages/cloud_security_posture/kibana/csp_rule_template/ff3a8287-e4ac-5a3c-b0d7-4f349e0ab077.json new file mode 100644 index 00000000000..39b1d4e8ac2 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/ff3a8287-e4ac-5a3c-b0d7-4f349e0ab077.json @@ -0,0 +1,38 @@ +{ + "id": "ff3a8287-e4ac-5a3c-b0d7-4f349e0ab077", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "If you lose your encryption key, you will not be able to recover the data.", + "default_value": "", + "references": "1. https://cloud.google.com/compute/docs/disks/customer-supplied-encryption#encrypt_a_new_persistent_disk_with_your_own_keys\n2. https://cloud.google.com/compute/docs/reference/rest/v1/disks/get\n3. https://cloud.google.com/compute/docs/disks/customer-supplied-encryption#key_file", + "id": "ff3a8287-e4ac-5a3c-b0d7-4f349e0ab077", + "name": "Ensure VM Disks for Critical VMs Are Encrypted With Customer-Supplied Encryption Keys (CSEK)", + "profile_applicability": "* Level 2", + "description": "Customer-Supplied Encryption Keys (CSEK) are a feature in Google Cloud Storage and Google Compute Engine.\nIf you supply your own encryption keys, Google uses your key to protect the Google-generated keys used to encrypt and decrypt your data.\nBy default, Google Compute Engine encrypts all data at rest.\nCompute Engine handles and manages this encryption for you without any additional actions on your part.\nHowever, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.", + "rationale": "By default, Google Compute Engine encrypts all data at rest.\nCompute Engine handles and manages this encryption for you without any additional actions on your part.\nHowever, if you wanted to control and manage this encryption yourself, you can provide your own encryption keys.\n\nIf you provide your own encryption keys, Compute Engine uses your key to protect the Google-generated keys used to encrypt and decrypt your data.\nOnly users who can provide the correct key can use resources protected by a customer-supplied encryption key.\n\nGoogle does not store your keys on its servers and cannot access your protected data unless you provide the key.\nThis also means that if you forget or lose your key, there is no way for Google to recover the key or to recover any data encrypted with the lost key.\n\nAt least business critical VMs should have VM disks encrypted with CSEK.", + "audit": "**From Google Cloud Console**\n\n1. Go to Compute Engine `Disks` by visiting: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks).\n2. Click on the disk for your critical VMs to see its configuration details.\n3. Ensure that `Encryption type` is set to `Customer supplied`.\n\n**From Google Cloud CLI**\n\nEnsure `diskEncryptionKey` property in the below command's response is not null, and contains key `sha256` with corresponding value\n\n```\ngcloud compute disks describe --zone --format=\"json(diskEncryptionKey,name)\"\n```", + "remediation": "Currently there is no way to update the encryption of an existing disk.\nTherefore you should create a new disk with `Encryption` set to `Customer supplied`.\n\n**From Google Cloud Console**\n\n1. Go to Compute Engine `Disks` by visiting: [https://console.cloud.google.com/compute/disks](https://console.cloud.google.com/compute/disks).\n2. Click `CREATE DISK`.\n3. Set `Encryption type` to `Customer supplied`,\n4. Provide the `Key` in the box.\n5. Select `Wrapped key`.\n6. Click `Create`.\n\n**From Google Cloud CLI**\n\nIn the gcloud compute tool, encrypt a disk using the --csek-key-file flag during instance creation.\nIf you are using an RSA-wrapped key, use the gcloud beta component:\n\n```\ngcloud compute instances create --csek-key-file \n```\n\nTo encrypt a standalone persistent disk:\n```\ngcloud compute disks create --csek-key-file \n```", + "section": "Virtual Machines", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 4.7", + "Virtual Machines" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "4.7", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_4_7" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/kibana/csp_rule_template/ffc9fb91-dc44-512b-a558-036e8ce11282.json b/packages/cloud_security_posture/kibana/csp_rule_template/ffc9fb91-dc44-512b-a558-036e8ce11282.json new file mode 100644 index 00000000000..3a053ddea09 --- /dev/null +++ b/packages/cloud_security_posture/kibana/csp_rule_template/ffc9fb91-dc44-512b-a558-036e8ce11282.json @@ -0,0 +1,38 @@ +{ + "id": "ffc9fb91-dc44-512b-a558-036e8ce11282", + "type": "csp-rule-template", + "attributes": { + "metadata": { + "impact": "Enabling of logging may result in your project being charged for the additional logs usage.", + "default_value": "", + "references": "1. https://cloud.google.com/logging/docs/logs-based-metrics/\n2. https://cloud.google.com/monitoring/custom-metrics/\n3. https://cloud.google.com/monitoring/alerts/\n4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging\n5. https://cloud.google.com/iam/docs/understanding-custom-roles", + "id": "ffc9fb91-dc44-512b-a558-036e8ce11282", + "name": "Ensure That the Log Metric Filter and Alerts Exist for Custom Role Changes", + "profile_applicability": "* Level 1", + "description": "It is recommended that a metric filter and alarm be established for changes to Identity and Access Management (IAM) role creation, deletion and updating activities.", + "rationale": "Google Cloud IAM provides predefined roles that give granular access to specific Google Cloud Platform resources and prevent unwanted access to other resources.\nHowever, to cater to organization-specific needs, Cloud IAM also provides the ability to create custom roles.\nProject owners and administrators with the Organization Role Administrator role or the IAM Role Administrator role can create custom roles.\n\nMonitoring role creation, deletion and updating activities will help in identifying any over-privileged role at early stages.", + "audit": "**From Console:**\n\n**Ensure that the prescribed log metric is present:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n2. In the `User-defined Metrics` section, ensure that at least one metric `` is present with filter text:\n\n```\nresource.type=\"iam_role\" \nAND (protoPayload.methodName=\"google.iam.admin.v1.CreateRole\" \nOR protoPayload.methodName=\"google.iam.admin.v1.DeleteRole\" \nOR protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\")\n```\n\n**Ensure that the prescribed alerting policy is present:**\n\n3. Go to `Alerting` by visiting [https://console.cloud.google.com/monitoring/alerting](https://console.cloud.google.com/monitoring/alerting).\n\n4. Under the `Policies` section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example, `Violates when: Any logging.googleapis.com/user/ stream` `is above a threshold of zero(0) for greater than zero(0) seconds` means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for the user's organization.\n\n5. Ensure that the appropriate notifications channels have been set up.\n\n**From Google Cloud CLI**\n\nEnsure that the prescribed log metric is present:\n\n6. List the log metrics:\n\n```\ngcloud logging metrics list --format json\n```\n7. Ensure that the output contains at least one metric with the filter set to:\n\n```\nresource.type=\"iam_role\"\nAND (protoPayload.methodName = \"google.iam.admin.v1.CreateRole\" OR\nprotoPayload.methodName=\"google.iam.admin.v1.DeleteRole\" OR\nprotoPayload.methodName=\"google.iam.admin.v1.UpdateRole\")\n```\n\n8. Note the value of the property `metricDescriptor.type` for the identified metric, in the format `logging.googleapis.com/user/`.\n\n**Ensure that the prescribed alerting policy is present:**\n\n9. List the alerting policies:\n```\ngcloud alpha monitoring policies list --format json\n```\n10. Ensure that the output contains an least one alert policy where:\n- `conditions.conditionThreshold.filter` is set to `metric.type=\\\"logging.googleapis.com/user/\\\"`\n- AND `enabled` is set to `true`.", + "remediation": "**From Console:**\n\n**Create the prescribed log metric:**\n\n1. Go to `Logging/Logs-based Metrics` by visiting [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics) and click \"CREATE METRIC\".\n\n2. Click the down arrow symbol on the `Filter Bar` at the rightmost corner and select `Convert to Advanced Filter`.\n\n3. Clear any text and add: \n\n```\nresource.type=\"iam_role\" \nAND (protoPayload.methodName = \"google.iam.admin.v1.CreateRole\" \nOR protoPayload.methodName=\"google.iam.admin.v1.DeleteRole\" \nOR protoPayload.methodName=\"google.iam.admin.v1.UpdateRole\")\n```\n\n4. Click `Submit Filter`. Display logs appear based on the filter text entered by the user.\n\n5. In the `Metric Editor` menu on the right, fill out the name field. Set `Units` to `1` (default) and `Type` to `Counter`. This ensures that the log metric counts the number of log entries matching the advanced logs query.\n\n6. Click `Create Metric`. \n\n**Create a prescribed Alert Policy:** \n\n7. Identify the new metric that was just created under the section `User-defined Metrics` at [https://console.cloud.google.com/logs/metrics](https://console.cloud.google.com/logs/metrics).\n\n8. Click the 3-dot icon in the rightmost column for the metric and select `Create alert from Metric`. A new page displays.\n\n9. Fill out the alert policy configuration and click `Save`. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project:\n```\nSet `Aggregator` to `Count`\n\nSet `Configuration`:\n\n- Condition: above\n\n- Threshold: 0\n\n- For: most recent value\n```\n\n10. Configure the desired notification channels in the section `Notifications`.\n\n11. Name the policy and click `Save`.\n\n**From Google Cloud CLI**\n\nCreate the prescribed Log Metric:\n- Use the command: gcloud logging metrics create \n\nCreate the prescribed Alert Policy: \n- Use the command: gcloud alpha monitoring policies create ", + "section": "Logging and Monitoring", + "version": "1.0", + "tags": [ + "CIS", + "GCP", + "CIS 2.6", + "Logging and Monitoring" + ], + "benchmark": { + "name": "CIS Google Cloud Platform Foundation", + "version": "v2.0.0", + "id": "cis_gcp", + "rule_number": "2.6", + "posture_type": "cspm" + }, + "rego_rule_id": "cis_2_6" + } + }, + "migrationVersion": { + "csp-rule-template": "8.7.0" + }, + "coreMigrationVersion": "8.7.0" +} \ No newline at end of file diff --git a/packages/cloud_security_posture/manifest.yml b/packages/cloud_security_posture/manifest.yml index 291f1f11d4d..9ef55f41f18 100644 --- a/packages/cloud_security_posture/manifest.yml +++ b/packages/cloud_security_posture/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.3.0 name: cloud_security_posture title: "Security Posture Management" -version: "1.5.0-preview21" +version: "1.6.0-preview13" source: license: "Elastic-2.0" description: "Identify & remediate configuration risks in your Cloud infrastructure" @@ -11,7 +11,7 @@ categories: - kubernetes - security conditions: - kibana.version: "^8.10.0" + kibana.version: "^8.11.0" elastic.subscription: basic screenshots: - src: /img/dashboard.png @@ -112,33 +112,33 @@ policy_templates: required: true show_user: false description: Template URL to Cloud Formation Quick Create Stack - default: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-8.10.0-2023-06-26-13-36-58.yml&stackName=Elastic-Cloud-Security-Posture-Management¶m_EnrollmentToken=FLEET_ENROLLMENT_TOKEN¶m_FleetUrl=FLEET_URL¶m_ElasticAgentVersion=KIBANA_VERSION¶m_ElasticArtifactServer=https://artifacts.elastic.co/downloads/beats/elastic-agent¶m_Integration=CloudSecurityPostureManagement + # ACCOUNT_TYPE value should be either "single-account" or "organization-account" + default: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-8.11.0-2023-09-10-08-35-18.yml&stackName=Elastic-Cloud-Security-Posture-Management¶m_EnrollmentToken=FLEET_ENROLLMENT_TOKEN¶m_FleetUrl=FLEET_URL¶m_ElasticAgentVersion=KIBANA_VERSION¶m_ElasticArtifactServer=https://artifacts.elastic.co/downloads/beats/elastic-agent - type: cloudbeat/cis_gcp title: GCP description: CIS Benchmark for Google Cloud Platform Foundations vars: - - name: project_id + - name: cloud_shell_url type: text - title: Project Id + title: CloudShell URL multi: false required: true - show_user: true - default: SET_PROJECT_NAME - - name: credentials_file - type: text - title: Credentials File - multi: false - required: false - show_user: true - - name: credentials_json - type: text - title: Credentials Json - multi: false - required: false - show_user: true + show_user: false + description: A URL to CloudShell for creating a new deployment + default: https://shell.cloud.google.com/cloudshell/?ephemeral=true&cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Felastic%2Fcloudbeat&cloudshell_git_branch=8.10&cloudshell_workspace=deploy%2Fdeployment-manager&show=terminal - type: cloudbeat/cis_azure title: Azure description: CIS Benchmark for Microsoft Azure Foundations + vars: + - name: arm_template_url + type: text + title: ARM Template URL + multi: false + required: true + show_user: false + description: A URL to the ARM Template for creating a new deployment + # TODO: Update main to 8.11 when ready + default: https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Felastic%2Fcloudbeat%2Fmain%2Fdeploy%2Fazure%2FazureARMTemplate.json - name: vuln_mgmt title: Cloud Native Vulnerability Management (CNVM) description: Scan for cloud workload vulnerabilities @@ -174,6 +174,6 @@ policy_templates: required: true show_user: false description: Template URL to Cloud Formation Quick Create Stack - default: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-8.10.0-2023-06-26-13-36-58.yml&stackName=Elastic-Vulnerability-Management¶m_EnrollmentToken=FLEET_ENROLLMENT_TOKEN¶m_FleetUrl=FLEET_URL¶m_ElasticAgentVersion=KIBANA_VERSION¶m_ElasticArtifactServer=https://artifacts.elastic.co/downloads/beats/elastic-agent + default: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cnvm-8.11.0-2023-09-10-08-35-18.yml&stackName=Elastic-Vulnerability-Management¶m_EnrollmentToken=FLEET_ENROLLMENT_TOKEN¶m_FleetUrl=FLEET_URL¶m_ElasticAgentVersion=KIBANA_VERSION¶m_ElasticArtifactServer=https://artifacts.elastic.co/downloads/beats/elastic-agent owner: github: elastic/cloud-security-posture diff --git a/packages/cloudflare/_dev/build/build.yml b/packages/cloudflare/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cloudflare/_dev/build/build.yml +++ b/packages/cloudflare/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cloudflare/changelog.yml b/packages/cloudflare/changelog.yml index 59d9f6d1537..1c740a13ceb 100644 --- a/packages/cloudflare/changelog.yml +++ b/packages/cloudflare/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 2.16.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.14.1" + changes: + - description: Fix handling of unix timestamps. + type: bugfix + link: https://github.com/elastic/integrations/pull/7763 +- version: "2.14.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7600 +- version: "2.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "2.12.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "2.11.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 +- version: "2.10.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "2.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cloudflare/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/cloudflare/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 444f9e9fb2a..11b46ad6ee4 100644 --- a/packages/cloudflare/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/cloudflare/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -27,7 +27,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_create", @@ -109,7 +109,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_revoke", @@ -185,7 +185,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "api_key_view", @@ -261,7 +261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "api_key_view", @@ -337,7 +337,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rotate_api_key", @@ -413,7 +413,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "api_key_created", @@ -493,7 +493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_create", @@ -569,7 +569,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login", @@ -648,7 +648,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "purge", @@ -736,7 +736,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tls_settings_deployed", @@ -789,7 +789,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -871,7 +871,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_revoke", @@ -953,7 +953,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_revoke", @@ -1035,7 +1035,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_roll", @@ -1115,7 +1115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_create", @@ -1204,7 +1204,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1294,7 +1294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1384,7 +1384,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1475,7 +1475,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1566,7 +1566,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1657,7 +1657,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1748,7 +1748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1839,7 +1839,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -1929,7 +1929,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -2019,7 +2019,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -2109,7 +2109,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -2199,7 +2199,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_del", @@ -2288,7 +2288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2377,7 +2377,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2466,7 +2466,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2555,7 +2555,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2644,7 +2644,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2734,7 +2734,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2824,7 +2824,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -2914,7 +2914,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3004,7 +3004,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3094,7 +3094,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3183,7 +3183,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3272,7 +3272,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3361,7 +3361,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rec_add", @@ -3442,7 +3442,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pending", @@ -3530,7 +3530,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tls_settings_deployed", @@ -3584,7 +3584,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add", @@ -3667,7 +3667,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_setting", @@ -3748,7 +3748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_create", @@ -3824,7 +3824,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login", @@ -3900,7 +3900,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login", diff --git a/packages/cloudflare/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 60936ddc4b4..946fdaa6e25 100644 --- a/packages/cloudflare/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cloudflare audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/cloudflare/data_stream/audit/manifest.yml b/packages/cloudflare/data_stream/audit/manifest.yml index b7ba0a75c45..a8ac79b5d69 100644 --- a/packages/cloudflare/data_stream/audit/manifest.yml +++ b/packages/cloudflare/data_stream/audit/manifest.yml @@ -29,7 +29,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -37,7 +37,7 @@ streams: multi: false required: true show_user: false - description: Initial interval at which the logs will be pulled. Defaults to 30 days (720 hours). Max is 12960 hours (18 months). + description: Initial interval at which the logs will be pulled. Defaults to 30 days (720 hours). Max is 12960 hours (18 months). Supported units for this parameter are h/m/s. default: 720h - name: tags type: text diff --git a/packages/cloudflare/data_stream/audit/sample_event.json b/packages/cloudflare/data_stream/audit/sample_event.json index 9e5d05c3cc0..640efe5925c 100644 --- a/packages/cloudflare/data_stream/audit/sample_event.json +++ b/packages/cloudflare/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-30T13:42:04.000Z", "agent": { - "ephemeral_id": "cda31903-d3e4-4a1a-acb3-7e49abd31cb8", - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "ephemeral_id": "39e9d205-25b6-4c72-981c-790a9e82c064", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.1" }, "cloud": { "account": { @@ -33,12 +33,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.7.1" + "version": "8.9.1" }, "event": { "action": "rotate_api_key", @@ -46,10 +46,10 @@ "category": [ "iam" ], - "created": "2023-05-30T15:16:32.942Z", + "created": "2023-08-29T18:00:18.207Z", "dataset": "cloudflare.audit", "id": "8d3396e8-c903-5a66-9421-00fc34570550", - "ingested": "2023-05-30T15:16:33Z", + "ingested": "2023-08-29T18:00:19Z", "kind": "event", "original": "{\"action\":{\"info\":\"key digest: c6b5d100d7ce492d24c5b13160fce1cc0092ce7e8d8430e9f5cf5468868be6f6\",\"result\":true,\"type\":\"rotate_API_key\"},\"actor\":{\"email\":\"user@example.com\",\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ip\":\"52.91.36.10\",\"type\":\"user\"},\"id\":\"8d3396e8-c903-5a66-9421-00fc34570550\",\"interface\":\"\",\"metadata\":{},\"newValue\":\"\",\"oldValue\":\"\",\"owner\":{\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\"},\"resource\":{\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"type\":\"account\"},\"when\":\"2021-11-30T13:42:04Z\"}", "outcome": "success", diff --git a/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log b/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log index 99bd1765d9d..121104f11d0 100644 --- a/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log +++ b/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log @@ -1,3 +1,4 @@ {"CacheCacheStatus":"unknown","CacheResponseBytes":0,"CacheResponseStatus":0,"CacheTieredFill":false,"ClientASN":15169,"ClientCountry":"us","ClientDeviceType":"desktop","ClientIP":"89.160.20.156","ClientIPClass":"noRecord","ClientRequestBytes":2577,"ClientRequestHost":"cf-analytics.com","ClientRequestMethod":"POST","ClientRequestPath":"/wp-cron.php","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://cf-analytics.com/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000","ClientRequestURI":"/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000","ClientRequestUserAgent":"WordPress/5.2.2;https://cf-analytics.com","ClientSSLCipher":"ECDHE-ECDSA-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.2","ClientSrcPort":55028,"EdgeColoID":14,"EdgeEndTimestamp":"2019-08-02T15:29:08Z","EdgePathingOp":"ban","EdgePathingSrc":"filter_based_firewall","EdgePathingStatus":"captchaNew","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"","EdgeResponseBytes":2848,"EdgeResponseCompressionRatio":2.64,"EdgeResponseContentType":"text/html","EdgeResponseStatus":403,"EdgeServerIP":"","EdgeStartTimestamp":"2019-08-02T15:29:08Z","FirewallMatchesActions":["simulate","challenge"],"FirewallMatchesSources":["firewallRules","firewallRules"],"FirewallMatchesRuleIDs":["094b71fea25d4860a61fa0c6fbbd8d8b","e454fd4a0ce546b3a9a462536613692c"],"OriginIP":"","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","RayID":"500115ec386354d8","SecurityLevel":"med","WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":155978002} {"CacheCacheStatus":"hit","CacheResponseBytes":26888,"CacheResponseStatus":200,"CacheTieredFill":true,"ClientASN":1136,"ClientCountry":"nl","ClientDeviceType":"desktop","ClientIP":"89.160.20.156","ClientIPClass":"noRecord","ClientRequestBytes":5324,"ClientRequestHost":"eqlplayground.io","ClientRequestMethod":"GET","ClientRequestPath":"/40865/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.9.js","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://eqlplayground.io/s/eqldemo/app/security/timelines/default?sourcerer=(default:!(.siem-signals-eqldemo))&timerange=(global:(linkTo:!(),timerange:(from:%272021-03-03T19:55:15.519Z%27,fromStr:now-24h,kind:relative,to:%272021-03-04T19:55:15.519Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272020-03-04T19:55:28.684Z%27,fromStr:now-1y,kind:relative,to:%272021-03-04T19:55:28.692Z%27,toStr:now)))&timeline=(activeTab:eql,graphEventId:%27%27,id:%2769f93840-7d23-11eb-866c-79a0609409ba%27,isOpen:!t)","ClientRequestURI":"/40865/bundles/plugin/securitySolution/8.0.0/securitySolution.chunk.9.js","ClientRequestUserAgent":"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36","ClientSSLCipher":"NONE","ClientSSLProtocol":"none","ClientSrcPort":0,"ClientXRequestedWith":"","EdgeColoCode":"33.147.138.217","EdgeColoID":20,"EdgeEndTimestamp":1625752958875000000,"EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"eqlplayground.io","EdgeResponseBytes":24743,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/javascript","EdgeResponseStatus":200,"EdgeServerIP":"89.160.20.156","EdgeStartTimestamp":1625752958812000000,"FirewallMatchesActions":[],"FirewallMatchesRuleIDs":[],"FirewallMatchesSources":[],"OriginIP":"","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"66b9d9f88b5b4c4f","RayID":"66b9d9f890ae4c4f","SecurityLevel":"off","WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":true,"WorkerSubrequestCount":0,"ZoneID":393347122} -{"CacheCacheStatus":"unknown","CacheResponseBytes":0,"CacheResponseStatus":0,"CacheTieredFill":false,"ClientASN":1136,"ClientCountry":"nl","ClientDeviceType":"desktop","ClientIP":"89.160.20.156","ClientIPClass":"noRecord","ClientRequestBytes":2520,"ClientRequestHost":"eqlplayground.io","ClientRequestMethod":"GET","ClientRequestPath":"/s/eqldemo/security/account","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"","ClientRequestURI":"/s/eqldemo/security/account","ClientRequestUserAgent":"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36","ClientSSLCipher":"AEAD-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.3","ClientSrcPort":61593,"ClientXRequestedWith":"","EdgeColoCode":"AMS","EdgeColoID":20,"EdgeEndTimestamp":1625754264684000000,"EdgePathingOp":"ban","EdgePathingSrc":"filter_based_firewall","EdgePathingStatus":"nr","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"183.53.30.34","EdgeResponseBytes":2066,"EdgeResponseCompressionRatio":2.45,"EdgeResponseContentType":"text/html","EdgeResponseStatus":403,"EdgeServerIP":"","EdgeStartTimestamp":1625754264676000000,"FirewallMatchesActions":["block"],"FirewallMatchesRuleIDs":["391eb601201e4f2a81038910f2b63f6d"],"FirewallMatchesSources":["firewallRules"],"OriginIP":"89.160.20.156","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","RayID":"66b9f9da396e4c01","SecurityLevel":"unk","WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":393347122} \ No newline at end of file +{"CacheCacheStatus":"unknown","CacheResponseBytes":0,"CacheResponseStatus":0,"CacheTieredFill":false,"ClientASN":1136,"ClientCountry":"nl","ClientDeviceType":"desktop","ClientIP":"89.160.20.156","ClientIPClass":"noRecord","ClientRequestBytes":2520,"ClientRequestHost":"eqlplayground.io","ClientRequestMethod":"GET","ClientRequestPath":"/s/eqldemo/security/account","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"","ClientRequestURI":"/s/eqldemo/security/account","ClientRequestUserAgent":"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36","ClientSSLCipher":"AEAD-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.3","ClientSrcPort":61593,"ClientXRequestedWith":"","EdgeColoCode":"AMS","EdgeColoID":20,"EdgeEndTimestamp":1625754264684000000,"EdgePathingOp":"ban","EdgePathingSrc":"filter_based_firewall","EdgePathingStatus":"nr","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"183.53.30.34","EdgeResponseBytes":2066,"EdgeResponseCompressionRatio":2.45,"EdgeResponseContentType":"text/html","EdgeResponseStatus":403,"EdgeServerIP":"","EdgeStartTimestamp":1625754264676000000,"FirewallMatchesActions":["block"],"FirewallMatchesRuleIDs":["391eb601201e4f2a81038910f2b63f6d"],"FirewallMatchesSources":["firewallRules"],"OriginIP":"89.160.20.156","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","RayID":"66b9f9da396e4c01","SecurityLevel":"unk","WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":393347122} +{"CacheCacheStatus":"unknown","CacheResponseBytes":0,"CacheResponseStatus":0,"CacheTieredFill":false,"ClientASN":1136,"ClientCountry":"nl","ClientDeviceType":"desktop","ClientIP":"89.160.20.156","ClientIPClass":"noRecord","ClientRequestBytes":2520,"ClientRequestHost":"eqlplayground.io","ClientRequestMethod":"GET","ClientRequestPath":"/s/eqldemo/security/account","ClientRequestProtocol":"HTTP/2","ClientRequestReferer":"","ClientRequestURI":"/s/eqldemo/security/account","ClientRequestUserAgent":"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36","ClientSSLCipher":"AEAD-AES128-GCM-SHA256","ClientSSLProtocol":"TLSv1.3","ClientSrcPort":61593,"ClientXRequestedWith":"","EdgeColoCode":"AMS","EdgeColoID":20,"EdgeEndTimestamp":1625754264,"EdgePathingOp":"ban","EdgePathingSrc":"filter_based_firewall","EdgePathingStatus":"nr","EdgeRateLimitAction":"","EdgeRateLimitID":0,"EdgeRequestHost":"183.53.30.34","EdgeResponseBytes":2066,"EdgeResponseCompressionRatio":2.45,"EdgeResponseContentType":"text/html","EdgeResponseStatus":403,"EdgeServerIP":"","EdgeStartTimestamp":1625754264,"FirewallMatchesActions":["block"],"FirewallMatchesRuleIDs":["391eb601201e4f2a81038910f2b63f6d"],"FirewallMatchesSources":["firewallRules"],"OriginIP":"89.160.20.156","OriginResponseBytes":0,"OriginResponseHTTPExpires":"","OriginResponseHTTPLastModified":"","OriginResponseStatus":0,"OriginResponseTime":0,"OriginSSLProtocol":"unknown","ParentRayID":"00","RayID":"66b9f9da396e4c01","SecurityLevel":"unk","WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"","WAFProfile":"unknown","WAFRuleID":"","WAFRuleMessage":"","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":false,"WorkerSubrequestCount":0,"ZoneID":393347122} diff --git a/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log-expected.json b/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log-expected.json index 5f63137571d..e62ee21cc3c 100644 --- a/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log-expected.json +++ b/packages/cloudflare/data_stream/logpull/_dev/test/pipeline/test-http-json.log-expected.json @@ -105,7 +105,7 @@ "bytes": 2848 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -289,7 +289,7 @@ "bytes": 24743 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -497,7 +497,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -592,6 +592,210 @@ }, "version": "91.0.4472.124" } + }, + { + "@timestamp": "2021-07-08T14:24:24.000Z", + "client": { + "address": "89.160.20.156", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "bytes": 2520, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.156", + "port": 61593 + }, + "cloudflare": { + "cache": { + "status": "unknown", + "tiered_fill": false + }, + "client": { + "ip_class": "noRecord", + "ssl": { + "protocol": "TLSv1.3" + } + }, + "device_type": "desktop", + "edge": { + "colo": { + "code": "AMS", + "id": 20 + }, + "pathing": { + "op": "ban", + "src": "filter_based_firewall", + "status": "nr" + }, + "rate_limit": { + "id": 0 + }, + "request": { + "host": "183.53.30.34" + }, + "response": { + "bytes": 2066, + "compression_ratio": 2.45, + "content_type": "text/html", + "status_code": 403 + } + }, + "firewall": { + "actions": [ + "block" + ], + "rule_ids": [ + "391eb601201e4f2a81038910f2b63f6d" + ], + "sources": [ + "firewallRules" + ] + }, + "origin": { + "response": { + "bytes": 0, + "status_code": 0, + "time": 0 + }, + "ssl": { + "protocol": "unknown" + } + }, + "parent": { + "ray_id": "00" + }, + "ray_id": "66b9f9da396e4c01", + "security_level": "unk", + "waf": { + "action": "unknown", + "flags": "0", + "profile": "unknown" + }, + "worker": { + "cpu_time": 0, + "status": "unknown", + "subrequest": false, + "subrequest_count": 0 + }, + "zone": { + "id": 393347122 + } + }, + "destination": { + "address": "89.160.20.156", + "bytes": 2066, + "ip": "89.160.20.156" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": [ + "block" + ], + "category": [ + "network" + ], + "duration": 0, + "end": "2021-07-08T14:24:24.000Z", + "kind": "event", + "original": "{\"CacheCacheStatus\":\"unknown\",\"CacheResponseBytes\":0,\"CacheResponseStatus\":0,\"CacheTieredFill\":false,\"ClientASN\":1136,\"ClientCountry\":\"nl\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"89.160.20.156\",\"ClientIPClass\":\"noRecord\",\"ClientRequestBytes\":2520,\"ClientRequestHost\":\"eqlplayground.io\",\"ClientRequestMethod\":\"GET\",\"ClientRequestPath\":\"/s/eqldemo/security/account\",\"ClientRequestProtocol\":\"HTTP/2\",\"ClientRequestReferer\":\"\",\"ClientRequestURI\":\"/s/eqldemo/security/account\",\"ClientRequestUserAgent\":\"Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36\",\"ClientSSLCipher\":\"AEAD-AES128-GCM-SHA256\",\"ClientSSLProtocol\":\"TLSv1.3\",\"ClientSrcPort\":61593,\"ClientXRequestedWith\":\"\",\"EdgeColoCode\":\"AMS\",\"EdgeColoID\":20,\"EdgeEndTimestamp\":1625754264,\"EdgePathingOp\":\"ban\",\"EdgePathingSrc\":\"filter_based_firewall\",\"EdgePathingStatus\":\"nr\",\"EdgeRateLimitAction\":\"\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"183.53.30.34\",\"EdgeResponseBytes\":2066,\"EdgeResponseCompressionRatio\":2.45,\"EdgeResponseContentType\":\"text/html\",\"EdgeResponseStatus\":403,\"EdgeServerIP\":\"\",\"EdgeStartTimestamp\":1625754264,\"FirewallMatchesActions\":[\"block\"],\"FirewallMatchesRuleIDs\":[\"391eb601201e4f2a81038910f2b63f6d\"],\"FirewallMatchesSources\":[\"firewallRules\"],\"OriginIP\":\"89.160.20.156\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":0,\"OriginResponseTime\":0,\"OriginSSLProtocol\":\"unknown\",\"ParentRayID\":\"00\",\"RayID\":\"66b9f9da396e4c01\",\"SecurityLevel\":\"unk\",\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"ZoneID\":393347122}", + "start": "2021-07-08T14:24:24.000Z", + "type": [ + "denied" + ] + }, + "http": { + "request": { + "bytes": 2520, + "method": "GET" + }, + "response": { + "bytes": 2066, + "status_code": 403 + }, + "version": "2" + }, + "network": { + "bytes": 4586, + "protocol": "http", + "transport": "tcp" + }, + "observer": { + "type": "proxy", + "vendor": "cloudflare" + }, + "server": { + "address": "89.160.20.156", + "bytes": 2066, + "ip": "89.160.20.156" + }, + "source": { + "address": "89.160.20.156", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "bytes": 2520, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.156", + "port": 61593 + }, + "tags": [ + "preserve_original_event" + ], + "tls": { + "cipher": "AEAD-AES128-GCM-SHA256", + "version": "1.3", + "version_protocol": "tls" + }, + "url": { + "domain": "eqlplayground.io", + "full": "https://eqlplayground.io/s/eqldemo/security/account", + "original": "/s/eqldemo/security/account", + "path": "/s/eqldemo/security/account", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Chrome", + "original": "Mozilla/5.0(WindowsNT10.0;Win64;x64)AppleWebKit/537.36(KHTML,likeGecko)Chrome/91.0.4472.124Safari/537.36", + "os": { + "full": "Windows $1", + "name": "Windows", + "version": "$1" + }, + "version": "91.0.4472.124" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/default.yml index 9449adb6c78..41331ff6404 100644 --- a/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing cloudflare logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/http.yml b/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/http.yml index 342092d1e58..7fb0dbc50f2 100644 --- a/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/http.yml +++ b/packages/cloudflare/data_stream/logpull/elasticsearch/ingest_pipeline/http.yml @@ -2,26 +2,48 @@ description: Pipeline for parsing cloudflare http logs processors: # Event Time Fields -- convert: - field: json.EdgeStartTimestamp - tag: convert_edge_start_timestamp - type: string -- convert: - field: json.EdgeEndTimestamp - tag: convert_edge_end_timestamp - type: string -- gsub: - field: json.EdgeStartTimestamp - tag: gsub_edge_start_timestamp - pattern: "\\d{6}$" - replacement: "" - if: "ctx?.json?.EdgeStartTimestamp != null && (ctx?.json?.EdgeStartTimestamp).length() > 18" -- gsub: - field: json.EdgeEndTimestamp - tag: gsub_edge_end_timestamp - pattern: "\\d{6}$" - replacement: "" - if: "ctx?.json?.EdgeEndTimestamp != null && (ctx?.json?.EdgeEndTimestamp).length() > 18" +- script: + lang: painless + tag: painless_edge_start_timestamp_to_milli + if: ctx.json?.EdgeStartTimestamp != null + source: | + try { + long t; + if (ctx.json.EdgeStartTimestamp instanceof String) { + t = Long.parseLong(ctx.json.EdgeStartTimestamp); + } else if (ctx.json.EdgeStartTimestamp instanceof Number) { + t = (long)(ctx.json.EdgeStartTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.EdgeStartTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.EdgeStartTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} +- script: + lang: painless + tag: painless_edge_end_timestamp_to_milli + if: ctx.json?.EdgeEndTimestamp != null + source: | + try { + long t; + if (ctx.json.EdgeEndTimestamp instanceof String) { + t = Long.parseLong(ctx.json.EdgeEndTimestamp); + } else if (ctx.json.EdgeEndTimestamp instanceof Number) { + t = (long)(ctx.json.EdgeEndTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.EdgeEndTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.EdgeEndTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.EdgeStartTimestamp tag: date_edge_start_timestamp diff --git a/packages/cloudflare/data_stream/logpull/manifest.yml b/packages/cloudflare/data_stream/logpull/manifest.yml index 1a3eccd77a2..cb2420a12dd 100644 --- a/packages/cloudflare/data_stream/logpull/manifest.yml +++ b/packages/cloudflare/data_stream/logpull/manifest.yml @@ -36,7 +36,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 1s and 1h. + description: Interval at which the logs will be pulled. The value must be between 1s and 1h. Supported units for this parameter are h/m/s. default: 5m - name: tags type: text diff --git a/packages/cloudflare/data_stream/logpull/sample_event.json b/packages/cloudflare/data_stream/logpull/sample_event.json index e70c84428b0..95744da5e5c 100644 --- a/packages/cloudflare/data_stream/logpull/sample_event.json +++ b/packages/cloudflare/data_stream/logpull/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-08-02T15:29:08.000Z", "agent": { - "ephemeral_id": "942c0900-9eb8-43ac-bf2f-3a7070a381dc", - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "ephemeral_id": "00b965c0-5825-4d93-a9b8-1142d1a47d13", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.1" }, "client": { "address": "35.232.161.245", @@ -103,12 +103,12 @@ "bytes": 2848 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.7.1" + "version": "8.9.1" }, "event": { "action": [ @@ -119,11 +119,11 @@ "category": [ "network" ], - "created": "2023-05-30T15:16:56.928Z", + "created": "2023-08-29T18:01:11.111Z", "dataset": "cloudflare.logpull", "duration": 0, "end": "2019-08-02T15:29:08.000Z", - "ingested": "2023-05-30T15:16:57Z", + "ingested": "2023-08-29T18:01:14Z", "kind": "event", "original": "{\"CacheCacheStatus\":\"unknown\",\"CacheResponseBytes\":0,\"CacheResponseStatus\":0,\"CacheTieredFill\":false,\"ClientASN\":15169,\"ClientCountry\":\"us\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"35.232.161.245\",\"ClientIPClass\":\"noRecord\",\"ClientRequestBytes\":2577,\"ClientRequestHost\":\"cf-analytics.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/wp-cron.php\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://cf-analytics.com/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000\",\"ClientRequestURI\":\"/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000\",\"ClientRequestUserAgent\":\"WordPress/5.2.2;https://cf-analytics.com\",\"ClientSSLCipher\":\"ECDHE-ECDSA-AES128-GCM-SHA256\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientSrcPort\":55028,\"EdgeColoID\":14,\"EdgeEndTimestamp\":\"2019-08-02T15:29:08Z\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"filter_based_firewall\",\"EdgePathingStatus\":\"captchaNew\",\"EdgeRateLimitAction\":\"\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"\",\"EdgeResponseBytes\":2848,\"EdgeResponseCompressionRatio\":2.64,\"EdgeResponseContentType\":\"text/html\",\"EdgeResponseStatus\":403,\"EdgeServerIP\":\"\",\"EdgeStartTimestamp\":\"2019-08-02T15:29:08Z\",\"FirewallMatchesActions\":[\"simulate\",\"challenge\"],\"FirewallMatchesRuleIDs\":[\"094b71fea25d4860a61fa0c6fbbd8d8b\",\"e454fd4a0ce546b3a9a462536613692c\"],\"FirewallMatchesSources\":[\"firewallRules\",\"firewallRules\"],\"OriginIP\":\"\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":0,\"OriginResponseTime\":0,\"OriginSSLProtocol\":\"unknown\",\"ParentRayID\":\"00\",\"RayID\":\"500115ec386354d8\",\"SecurityLevel\":\"med\",\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"ZoneID\":155978002}", "start": "2019-08-02T15:29:08.000Z" diff --git a/packages/cloudflare/docs/README.md b/packages/cloudflare/docs/README.md index 4672e7934a2..c4d5c572665 100644 --- a/packages/cloudflare/docs/README.md +++ b/packages/cloudflare/docs/README.md @@ -92,7 +92,7 @@ Audit logs summarize the history of changes made within your Cloudflare account. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | @@ -146,11 +146,11 @@ An example event for `audit` looks as following: { "@timestamp": "2021-11-30T13:42:04.000Z", "agent": { - "ephemeral_id": "cda31903-d3e4-4a1a-acb3-7e49abd31cb8", - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "ephemeral_id": "39e9d205-25b6-4c72-981c-790a9e82c064", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.1" }, "cloud": { "account": { @@ -178,12 +178,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.7.1" + "version": "8.9.1" }, "event": { "action": "rotate_api_key", @@ -191,10 +191,10 @@ An example event for `audit` looks as following: "category": [ "iam" ], - "created": "2023-05-30T15:16:32.942Z", + "created": "2023-08-29T18:00:18.207Z", "dataset": "cloudflare.audit", "id": "8d3396e8-c903-5a66-9421-00fc34570550", - "ingested": "2023-05-30T15:16:33Z", + "ingested": "2023-08-29T18:00:19Z", "kind": "event", "original": "{\"action\":{\"info\":\"key digest: c6b5d100d7ce492d24c5b13160fce1cc0092ce7e8d8430e9f5cf5468868be6f6\",\"result\":true,\"type\":\"rotate_API_key\"},\"actor\":{\"email\":\"user@example.com\",\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ip\":\"52.91.36.10\",\"type\":\"user\"},\"id\":\"8d3396e8-c903-5a66-9421-00fc34570550\",\"interface\":\"\",\"metadata\":{},\"newValue\":\"\",\"oldValue\":\"\",\"owner\":{\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\"},\"resource\":{\"id\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"type\":\"account\"},\"when\":\"2021-11-30T13:42:04Z\"}", "outcome": "success", @@ -317,17 +317,17 @@ These logs contain data related to the connecting client, the request path throu | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -437,11 +437,11 @@ An example event for `logpull` looks as following: { "@timestamp": "2019-08-02T15:29:08.000Z", "agent": { - "ephemeral_id": "942c0900-9eb8-43ac-bf2f-3a7070a381dc", - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "ephemeral_id": "00b965c0-5825-4d93-a9b8-1142d1a47d13", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.1" }, "client": { "address": "35.232.161.245", @@ -539,12 +539,12 @@ An example event for `logpull` looks as following: "bytes": 2848 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b24488e9-8abc-4656-b489-a14346cd8097", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.7.1" + "version": "8.9.1" }, "event": { "action": [ @@ -555,11 +555,11 @@ An example event for `logpull` looks as following: "category": [ "network" ], - "created": "2023-05-30T15:16:56.928Z", + "created": "2023-08-29T18:01:11.111Z", "dataset": "cloudflare.logpull", "duration": 0, "end": "2019-08-02T15:29:08.000Z", - "ingested": "2023-05-30T15:16:57Z", + "ingested": "2023-08-29T18:01:14Z", "kind": "event", "original": "{\"CacheCacheStatus\":\"unknown\",\"CacheResponseBytes\":0,\"CacheResponseStatus\":0,\"CacheTieredFill\":false,\"ClientASN\":15169,\"ClientCountry\":\"us\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"35.232.161.245\",\"ClientIPClass\":\"noRecord\",\"ClientRequestBytes\":2577,\"ClientRequestHost\":\"cf-analytics.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/wp-cron.php\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://cf-analytics.com/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000\",\"ClientRequestURI\":\"/wp-cron.php?doing_wp_cron=1564759748.3962020874023437500000\",\"ClientRequestUserAgent\":\"WordPress/5.2.2;https://cf-analytics.com\",\"ClientSSLCipher\":\"ECDHE-ECDSA-AES128-GCM-SHA256\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientSrcPort\":55028,\"EdgeColoID\":14,\"EdgeEndTimestamp\":\"2019-08-02T15:29:08Z\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"filter_based_firewall\",\"EdgePathingStatus\":\"captchaNew\",\"EdgeRateLimitAction\":\"\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"\",\"EdgeResponseBytes\":2848,\"EdgeResponseCompressionRatio\":2.64,\"EdgeResponseContentType\":\"text/html\",\"EdgeResponseStatus\":403,\"EdgeServerIP\":\"\",\"EdgeStartTimestamp\":\"2019-08-02T15:29:08Z\",\"FirewallMatchesActions\":[\"simulate\",\"challenge\"],\"FirewallMatchesRuleIDs\":[\"094b71fea25d4860a61fa0c6fbbd8d8b\",\"e454fd4a0ce546b3a9a462536613692c\"],\"FirewallMatchesSources\":[\"firewallRules\",\"firewallRules\"],\"OriginIP\":\"\",\"OriginResponseBytes\":0,\"OriginResponseHTTPExpires\":\"\",\"OriginResponseHTTPLastModified\":\"\",\"OriginResponseStatus\":0,\"OriginResponseTime\":0,\"OriginSSLProtocol\":\"unknown\",\"ParentRayID\":\"00\",\"RayID\":\"500115ec386354d8\",\"SecurityLevel\":\"med\",\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"\",\"WAFRuleMessage\":\"\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":false,\"WorkerSubrequestCount\":0,\"ZoneID\":155978002}", "start": "2019-08-02T15:29:08.000Z" diff --git a/packages/cloudflare/kibana/tags.yml b/packages/cloudflare/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cloudflare/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cloudflare/manifest.yml b/packages/cloudflare/manifest.yml index 17aca73bc42..29c198bdae0 100644 --- a/packages/cloudflare/manifest.yml +++ b/packages/cloudflare/manifest.yml @@ -1,12 +1,13 @@ name: cloudflare title: Cloudflare -version: "2.9.0" +version: "2.16.0" description: Collect logs from Cloudflare with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: [security, network, cdn_security] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/cf-logo-v.svg title: Cloudflare @@ -65,9 +66,11 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true default: 60s owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cloudflare_logpush/_dev/build/build.yml b/packages/cloudflare_logpush/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cloudflare_logpush/_dev/build/build.yml +++ b/packages/cloudflare_logpush/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cloudflare_logpush/_dev/build/docs/README.md b/packages/cloudflare_logpush/_dev/build/docs/README.md index 610659f4689..daa0f6bad0e 100644 --- a/packages/cloudflare_logpush/_dev/build/docs/README.md +++ b/packages/cloudflare_logpush/_dev/build/docs/README.md @@ -2,7 +2,7 @@ ## Overview -The [Cloudflare Logpush](https://www.cloudflare.com/) integration allows you to monitor Access Request, Audit, CASB, Device Posture, DNS, Firewall Event, Gateway DNS, Gateway HTTP, Gateway Network, HTTP Request, NEL Report, Network Analytics, Spectrum Event and Network Session logs. Cloudflare is a content delivery network and DDoS mitigation company. Cloudflare provides a network designed to make everything you connect to the Internet secure, private, fast, and reliable; secure your websites, APIs, and Internet applications; protect corporate networks, employees, and devices; and write and deploy code that runs on the network edge. +The [Cloudflare Logpush](https://www.cloudflare.com/) integration allows you to monitor Access Request, Audit, CASB, Device Posture, DNS, Firewall Event, Gateway DNS, Gateway HTTP, Gateway Network, HTTP Request, NEL Report, Network Analytics, Spectrum Event, Network Session and Workers Trace Events logs. Cloudflare is a content delivery network and DDoS mitigation company. Cloudflare provides a network designed to make everything you connect to the Internet secure, private, fast, and reliable; secure your websites, APIs, and Internet applications; protect corporate networks, employees, and devices; and write and deploy code that runs on the network edge. The Cloudflare Logpush integration can be used in three different modes to collect data: - HTTP Endpoint mode - Cloudflare pushes logs directly to an HTTP endpoint hosted by your Elastic Agent. @@ -47,6 +47,8 @@ The Cloudflare Logpush integration collects logs for the following types of even **Spectrum Event**: See Example Schema [here](https://developers.cloudflare.com/logs/reference/log-fields/zone/spectrum_events/). +**Workers Trace Events**: See Example Schema [here](https://developers.cloudflare.com/logs/reference/log-fields/account/workers_trace_events/). + ## Requirements You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware. @@ -77,6 +79,7 @@ This module has been tested against **Cloudflare version v4**. | Network Analytics | network_analytics_logs | | Zero Trust Network Session | network_session | | Spectrum Event | spectrum_event | + | Workers Trace Events | workers_trace | ### To collect data from AWS SQS, follow the below steps: 1. If data forwarding to an AWS S3 Bucket hasn't been configured, then first setup an AWS S3 Bucket as mentioned in the above documentation. @@ -284,4 +287,15 @@ Default port for HTTP Endpoint: _9566_ {{event "spectrum_event"}} -{{fields "spectrum_event"}} \ No newline at end of file +{{fields "spectrum_event"}} + +### workers_trace + +This is the `workers_trace` dataset. +Default port for HTTP Endpoint: _9574_ + +#### Example + +{{event "workers_trace"}} + +{{fields "workers_trace"}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/_dev/deploy/docker/docker-compose.yml b/packages/cloudflare_logpush/_dev/deploy/docker/docker-compose.yml index b7ff8e6faf9..1a8406b8e66 100644 --- a/packages/cloudflare_logpush/_dev/deploy/docker/docker-compose.yml +++ b/packages/cloudflare_logpush/_dev/deploy/docker/docker-compose.yml @@ -112,3 +112,11 @@ services: - STREAM_PROTOCOL=webhook - STREAM_ADDR=http://elastic-agent:9573/ command: log --start-signal=SIGHUP --delay=5s /sample_logs/device_posture.log + cloudflare-logpush-workers-trace-http-endpoint: + image: docker.elastic.co/observability/stream:v0.7.0 + volumes: + - ./sample_logs:/sample_logs:ro + environment: + - STREAM_PROTOCOL=webhook + - STREAM_ADDR=http://elastic-agent:9574/ + command: log --start-signal=SIGHUP --delay=5s /sample_logs/workers_trace.log diff --git a/packages/cloudflare_logpush/_dev/deploy/docker/sample_logs/workers_trace.log b/packages/cloudflare_logpush/_dev/deploy/docker/sample_logs/workers_trace.log new file mode 100644 index 00000000000..c92856e56e2 --- /dev/null +++ b/packages/cloudflare_logpush/_dev/deploy/docker/sample_logs/workers_trace.log @@ -0,0 +1 @@ +{"Event":{"RayID":"7e9ae7157ac0c33a","Request":{"URL":"http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog","Method":"GET"},"Response":{"Status":404}},"EventTimestampMs":1689852946804,"EventType":"fetch","Exceptions":[{"Message":"Uncaught TypeError: Cannot read property 'x' of undefined","Stack":"TypeError: Cannot read property 'x' of undefined\n at fetchHandler (/workers/script.js:12:27)\n at handleRequest (/workers/script.js:6:13)"}],"Logs":[{"level":"info","message":"Request received for /api/data"},{"level":"error","message":"Something went wrong"}],"Outcome":"exception","ScriptName":"chat-gpt-little-butterfly-0c3d","ScriptTags":["api","chatgpt"],"DispatchNamespace":"my-worker-dispatch"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/changelog.yml b/packages/cloudflare_logpush/changelog.yml index e67d3923085..9ebc3809842 100644 --- a/packages/cloudflare_logpush/changelog.yml +++ b/packages/cloudflare_logpush/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.1" + changes: + - description: Fix handling of timestamps. + type: bugfix + link: https://github.com/elastic/integrations/pull/7764 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.7.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.6.0" + changes: + - description: Add support for Workers Trace Events logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/7136 - version: "1.5.0" changes: - description: Add new data streams to cover all Zero Trust events. diff --git a/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log b/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log index f98a0cd9bf2..e5dda683cdf 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log +++ b/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log @@ -1 +1,3 @@ +{"Action":"login","Allowed":true,"AppDomain":"partner-zt-logs.cloudflareaccess.com/warp","AppUUID":"123e4567-e89b-12d3-a456-426614174000","Connection":"onetimepin","Country":"us","CreatedAt":"2023-05-24T02:48:33+09:30","Email":"user@example.com","IPAddress":"67.43.156.93","PurposeJustificationPrompt":"Please provide your reason for accessing the application.","PurposeJustificationResponse":"I need to access the application for work purposes.","RayID":"00c0ffeeabc12345","TemporaryAccessApprovers":["approver1@example.com","approver2@example.com"],"TemporaryAccessDuration":7200,"UserUID":"166befbb-00e3-5e20-bd6e-27245333949f"} +{"Action":"login","Allowed":true,"AppDomain":"partner-zt-logs.cloudflareaccess.com/warp","AppUUID":"123e4567-e89b-12d3-a456-426614174000","Connection":"onetimepin","Country":"us","CreatedAt":1684862313,"Email":"user@example.com","IPAddress":"67.43.156.93","PurposeJustificationPrompt":"Please provide your reason for accessing the application.","PurposeJustificationResponse":"I need to access the application for work purposes.","RayID":"00c0ffeeabc12345","TemporaryAccessApprovers":["approver1@example.com","approver2@example.com"],"TemporaryAccessDuration":7200,"UserUID":"166befbb-00e3-5e20-bd6e-27245333949f"} {"Action":"login","Allowed":true,"AppDomain":"partner-zt-logs.cloudflareaccess.com/warp","AppUUID":"123e4567-e89b-12d3-a456-426614174000","Connection":"onetimepin","Country":"us","CreatedAt":1684862313000000000,"Email":"user@example.com","IPAddress":"67.43.156.93","PurposeJustificationPrompt":"Please provide your reason for accessing the application.","PurposeJustificationResponse":"I need to access the application for work purposes.","RayID":"00c0ffeeabc12345","TemporaryAccessApprovers":["approver1@example.com","approver2@example.com"],"TemporaryAccessDuration":7200,"UserUID":"166befbb-00e3-5e20-bd6e-27245333949f"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log-expected.json b/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log-expected.json index fdfdf726f74..304f3fcd20b 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/access_request/_dev/test/pipeline/test-pipeline-access-request.log-expected.json @@ -52,7 +52,187 @@ } }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" + }, + "event": { + "action": "login", + "category": [ + "network" + ], + "id": "00c0ffeeabc12345", + "kind": "event", + "original": "{\"Action\":\"login\",\"Allowed\":true,\"AppDomain\":\"partner-zt-logs.cloudflareaccess.com/warp\",\"AppUUID\":\"123e4567-e89b-12d3-a456-426614174000\",\"Connection\":\"onetimepin\",\"Country\":\"us\",\"CreatedAt\":\"2023-05-24T02:48:33+09:30\",\"Email\":\"user@example.com\",\"IPAddress\":\"67.43.156.93\",\"PurposeJustificationPrompt\":\"Please provide your reason for accessing the application.\",\"PurposeJustificationResponse\":\"I need to access the application for work purposes.\",\"RayID\":\"00c0ffeeabc12345\",\"TemporaryAccessApprovers\":[\"approver1@example.com\",\"approver2@example.com\"],\"TemporaryAccessDuration\":7200,\"UserUID\":\"166befbb-00e3-5e20-bd6e-27245333949f\"}", + "type": [ + "access", + "allowed" + ] + }, + "related": { + "ip": [ + "67.43.156.93" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245333949f", + "user@example.com", + "approver1@example.com", + "approver2@example.com" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "partner-zt-logs.cloudflareaccess.com/warp" + }, + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245333949f" + } + }, + { + "@timestamp": "2023-05-23T17:18:33.000Z", + "client": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.93" + }, + "cloudflare_logpush": { + "access_request": { + "action": "login", + "allowed": true, + "app": { + "domain": "partner-zt-logs.cloudflareaccess.com/warp", + "uuid": "123e4567-e89b-12d3-a456-426614174000" + }, + "client": { + "ip": "67.43.156.93" + }, + "connection": "onetimepin", + "country": "us", + "ray": { + "id": "00c0ffeeabc12345" + }, + "request": { + "prompt": "Please provide your reason for accessing the application.", + "response": "I need to access the application for work purposes." + }, + "temp_access": { + "approvers": [ + "approver1@example.com", + "approver2@example.com" + ], + "duration": 7200 + }, + "timestamp": "2023-05-23T17:18:33.000Z", + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245333949f" + } + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "login", + "category": [ + "network" + ], + "id": "00c0ffeeabc12345", + "kind": "event", + "original": "{\"Action\":\"login\",\"Allowed\":true,\"AppDomain\":\"partner-zt-logs.cloudflareaccess.com/warp\",\"AppUUID\":\"123e4567-e89b-12d3-a456-426614174000\",\"Connection\":\"onetimepin\",\"Country\":\"us\",\"CreatedAt\":1684862313,\"Email\":\"user@example.com\",\"IPAddress\":\"67.43.156.93\",\"PurposeJustificationPrompt\":\"Please provide your reason for accessing the application.\",\"PurposeJustificationResponse\":\"I need to access the application for work purposes.\",\"RayID\":\"00c0ffeeabc12345\",\"TemporaryAccessApprovers\":[\"approver1@example.com\",\"approver2@example.com\"],\"TemporaryAccessDuration\":7200,\"UserUID\":\"166befbb-00e3-5e20-bd6e-27245333949f\"}", + "type": [ + "access", + "allowed" + ] + }, + "related": { + "ip": [ + "67.43.156.93" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245333949f", + "user@example.com", + "approver1@example.com", + "approver2@example.com" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "partner-zt-logs.cloudflareaccess.com/warp" + }, + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245333949f" + } + }, + { + "@timestamp": "2023-05-23T17:18:33.000Z", + "client": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.93" + }, + "cloudflare_logpush": { + "access_request": { + "action": "login", + "allowed": true, + "app": { + "domain": "partner-zt-logs.cloudflareaccess.com/warp", + "uuid": "123e4567-e89b-12d3-a456-426614174000" + }, + "client": { + "ip": "67.43.156.93" + }, + "connection": "onetimepin", + "country": "us", + "ray": { + "id": "00c0ffeeabc12345" + }, + "request": { + "prompt": "Please provide your reason for accessing the application.", + "response": "I need to access the application for work purposes." + }, + "temp_access": { + "approvers": [ + "approver1@example.com", + "approver2@example.com" + ], + "duration": 7200 + }, + "timestamp": "2023-05-23T17:18:33.000Z", + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245333949f" + } + } + }, + "ecs": { + "version": "8.9.0" }, "event": { "action": "login", diff --git a/packages/cloudflare_logpush/data_stream/access_request/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/access_request/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/access_request/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/access_request/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/access_request/elasticsearch/ingest_pipeline/default.yml index f1cea4a488b..e88d6e47bb7 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/access_request/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Access Request logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: field: event.kind value: event # ECS fields - - convert: - field: json.CreatedAt - type: string - ignore_missing: true - - gsub: - field: json.CreatedAt - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_created_at_to_milli + if: ctx.json?.CreatedAt != null + source: | + try { + long t; + if (ctx.json.CreatedAt instanceof String) { + t = Long.parseLong(ctx.json.CreatedAt); + } else if (ctx.json.CreatedAt instanceof Number) { + t = (long)(ctx.json.CreatedAt); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.CreatedAt = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.CreatedAt = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.CreatedAt if: ctx.json?.CreatedAt != null && ctx.json.CreatedAt != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/access_request/manifest.yml b/packages/cloudflare_logpush/data_stream/access_request/manifest.yml index 09d5faa1264..2c2fb57db19 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/access_request/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/access_request/sample_event.json b/packages/cloudflare_logpush/data_stream/access_request/sample_event.json index 3fee18f3a2d..555957f0811 100644 --- a/packages/cloudflare_logpush/data_stream/access_request/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/access_request/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-23T17:18:33.000Z", "agent": { - "ephemeral_id": "3411f8c1-29fc-49d3-b0ac-c50c21b18620", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "85b9b34b-5ff7-4928-aa51-47f2558ce97d", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "client": { "as": { @@ -62,12 +62,12 @@ "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "login", @@ -77,7 +77,7 @@ ], "dataset": "cloudflare_logpush.access_request", "id": "00c0ffeeabc12345", - "ingested": "2023-06-12T08:07:41Z", + "ingested": "2023-07-25T07:29:19Z", "kind": "event", "original": "{\"Action\":\"login\",\"Allowed\":true,\"AppDomain\":\"partner-zt-logs.cloudflareaccess.com/warp\",\"AppUUID\":\"123e4567-e89b-12d3-a456-426614174000\",\"Connection\":\"onetimepin\",\"Country\":\"us\",\"CreatedAt\":1684862313000000000,\"Email\":\"user@example.com\",\"IPAddress\":\"67.43.156.93\",\"PurposeJustificationPrompt\":\"Please provide your reason for accessing the application.\",\"PurposeJustificationResponse\":\"I need to access the application for work purposes.\",\"RayID\":\"00c0ffeeabc12345\",\"TemporaryAccessApprovers\":[\"approver1@example.com\",\"approver2@example.com\"],\"TemporaryAccessDuration\":7200,\"UserUID\":\"166befbb-00e3-5e20-bd6e-27245333949f\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log b/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log index 558d81e34a6..5e2bad10701 100644 --- a/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log +++ b/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log @@ -1 +1,3 @@ {"ActionResult":true,"ActionType":"token_create","ActorEmail":"user@example.com","ActorID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ActorIP":"81.2.69.142","ActorType":"user","ID":"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425","Interface":"UI","Metadata":{"token_name":"test","token_tag":"b7261c49a793a82678d12285f0bc1401"},"NewValue":{"key1":"value1","key2":"value2"},"OldValue":{"key3":"value4","key4":"value4"},"OwnerID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceType":"account","When":"2021-11-30T20:19:48Z"} +{"ActionResult":true,"ActionType":"token_create","ActorEmail":"user@example.com","ActorID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ActorIP":"81.2.69.142","ActorType":"user","ID":"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425","Interface":"UI","Metadata":{"token_name":"test","token_tag":"b7261c49a793a82678d12285f0bc1401"},"NewValue":{"key1":"value1","key2":"value2"},"OldValue":{"key3":"value4","key4":"value4"},"OwnerID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceType":"account","When":"1638303588"} +{"ActionResult":true,"ActionType":"token_create","ActorEmail":"user@example.com","ActorID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ActorIP":"81.2.69.142","ActorType":"user","ID":"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425","Interface":"UI","Metadata":{"token_name":"test","token_tag":"b7261c49a793a82678d12285f0bc1401"},"NewValue":{"key1":"value1","key2":"value2"},"OldValue":{"key3":"value4","key4":"value4"},"OwnerID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceID":"enl3j9du8rnx2swwd9l32qots7l54t9s","ResourceType":"account","When":"1638303588000000000"} diff --git a/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json b/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json index 0177d08ef52..eea0bf8d85d 100644 --- a/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json @@ -39,7 +39,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "token_create", @@ -74,6 +74,156 @@ "email": "user@example.com", "id": "enl3j9du8rnx2swwd9l32qots7l54t9s" } + }, + { + "@timestamp": "2021-11-30T20:19:48.000Z", + "cloudflare_logpush": { + "audit": { + "action": { + "result": "success", + "type": "token_create" + }, + "actor": { + "email": "user@example.com", + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s", + "ip": "81.2.69.142", + "type": "user" + }, + "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", + "interface": "UI", + "metadata": { + "token_name": "test", + "token_tag": "b7261c49a793a82678d12285f0bc1401" + }, + "new_value": { + "key1": "value1", + "key2": "value2" + }, + "old_value": { + "key3": "value4", + "key4": "value4" + }, + "owner": { + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s" + }, + "resource": { + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s", + "type": "account" + }, + "timestamp": "2021-11-30T20:19:48.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "token_create", + "category": [ + "authentication" + ], + "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", + "kind": "event", + "original": "{\"ActionResult\":true,\"ActionType\":\"token_create\",\"ActorEmail\":\"user@example.com\",\"ActorID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ActorIP\":\"81.2.69.142\",\"ActorType\":\"user\",\"ID\":\"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425\",\"Interface\":\"UI\",\"Metadata\":{\"token_name\":\"test\",\"token_tag\":\"b7261c49a793a82678d12285f0bc1401\"},\"NewValue\":{\"key1\":\"value1\",\"key2\":\"value2\"},\"OldValue\":{\"key3\":\"value4\",\"key4\":\"value4\"},\"OwnerID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceType\":\"account\",\"When\":\"1638303588\"}", + "outcome": "success", + "provider": "UI", + "type": [ + "info" + ] + }, + "related": { + "ip": [ + "81.2.69.142" + ], + "user": [ + "enl3j9du8rnx2swwd9l32qots7l54t9s" + ] + }, + "source": { + "ip": "81.2.69.142" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@example.com", + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s" + } + }, + { + "@timestamp": "2021-11-30T20:19:48.000Z", + "cloudflare_logpush": { + "audit": { + "action": { + "result": "success", + "type": "token_create" + }, + "actor": { + "email": "user@example.com", + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s", + "ip": "81.2.69.142", + "type": "user" + }, + "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", + "interface": "UI", + "metadata": { + "token_name": "test", + "token_tag": "b7261c49a793a82678d12285f0bc1401" + }, + "new_value": { + "key1": "value1", + "key2": "value2" + }, + "old_value": { + "key3": "value4", + "key4": "value4" + }, + "owner": { + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s" + }, + "resource": { + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s", + "type": "account" + }, + "timestamp": "2021-11-30T20:19:48.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "token_create", + "category": [ + "authentication" + ], + "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", + "kind": "event", + "original": "{\"ActionResult\":true,\"ActionType\":\"token_create\",\"ActorEmail\":\"user@example.com\",\"ActorID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ActorIP\":\"81.2.69.142\",\"ActorType\":\"user\",\"ID\":\"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425\",\"Interface\":\"UI\",\"Metadata\":{\"token_name\":\"test\",\"token_tag\":\"b7261c49a793a82678d12285f0bc1401\"},\"NewValue\":{\"key1\":\"value1\",\"key2\":\"value2\"},\"OldValue\":{\"key3\":\"value4\",\"key4\":\"value4\"},\"OwnerID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceType\":\"account\",\"When\":\"1638303588000000000\"}", + "outcome": "success", + "provider": "UI", + "type": [ + "info" + ] + }, + "related": { + "ip": [ + "81.2.69.142" + ], + "user": [ + "enl3j9du8rnx2swwd9l32qots7l54t9s" + ] + }, + "source": { + "ip": "81.2.69.142" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@example.com", + "id": "enl3j9du8rnx2swwd9l32qots7l54t9s" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/audit/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/audit/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/audit/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/audit/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index e53ac2f023b..bbfdad9a24a 100644 --- a/packages/cloudflare_logpush/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.category value: [authentication] - - convert: - field: json.When - type: string - ignore_missing: true - - gsub: - field: json.When - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_when_to_milli + if: ctx.json?.When != null + source: | + try { + long t; + if (ctx.json.When instanceof String) { + t = Long.parseLong(ctx.json.When); + } else if (ctx.json.When instanceof Number) { + t = (long)(ctx.json.When); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.When = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.When = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.When if: ctx.json?.When != null && ctx.json.When != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/audit/manifest.yml b/packages/cloudflare_logpush/data_stream/audit/manifest.yml index d436e40810a..dea31923e6e 100644 --- a/packages/cloudflare_logpush/data_stream/audit/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/audit/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/audit/sample_event.json b/packages/cloudflare_logpush/data_stream/audit/sample_event.json index 2ba66610072..498e59c6190 100644 --- a/packages/cloudflare_logpush/data_stream/audit/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-30T20:19:48.000Z", "agent": { - "ephemeral_id": "cb8c8de0-104f-4c62-977f-1344e6c37ded", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "a5eb9e51-5d15-4f28-8e87-5f798dba39bc", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "audit": { @@ -49,12 +49,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "token_create", @@ -64,7 +64,7 @@ ], "dataset": "cloudflare_logpush.audit", "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", - "ingested": "2023-06-12T08:08:21Z", + "ingested": "2023-07-25T07:30:08Z", "kind": "event", "original": "{\"ActionResult\":true,\"ActionType\":\"token_create\",\"ActorEmail\":\"user@example.com\",\"ActorID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ActorIP\":\"81.2.69.142\",\"ActorType\":\"user\",\"ID\":\"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425\",\"Interface\":\"UI\",\"Metadata\":{\"token_name\":\"test\",\"token_tag\":\"b7261c49a793a82678d12285f0bc1401\"},\"NewValue\":{\"key1\":\"value1\",\"key2\":\"value2\"},\"OldValue\":{\"key3\":\"value4\",\"key4\":\"value4\"},\"OwnerID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceType\":\"account\",\"When\":\"2021-11-30T20:19:48Z\"}", "outcome": "success", diff --git a/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log b/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log index 389eb2d912d..e3ef67423f0 100644 --- a/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log +++ b/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log @@ -1 +1,3 @@ -{"AssetDisplayName":"John Doe","AssetExternalID":"0051N000004mG2LAAA","AssetLink":"https://example.com/resource","AssetMetadata":{"Id":"0051N000004mG2LAAA","Fax":null,"Name":"John Doe","Alias":"JDoe","Email":"user@example.com","Phone":"+3460000000","Title":"Customer Solutions Engineer","Address":{"city":"Singapore","state":null,"street":null,"country":"Singapore","latitude":null,"longitude":null,"stateCode":null,"postalCode":null,"countryCode":"SG","geocodeAccuracy":null},"Division":null,"IsActive":false,"LastName":"Doe","UserType":"Standard","AccountId":null,"BadgeText":"","ContactId":null,"Extension":null,"FirstName":"John","Signature":null,"Department":"521","SenderName":null,"UserRoleId":"00E2G000001E","attributes":{"url":"/services/data/userID","type":"User"},"CompanyName":"MyCompany","MobilePhone":null,"SenderEmail":"sender@example.com","CallCenterId":null,"FullPhotoUrl":"https://photos.com/profilephoto/001","LocaleSidKey":"en_SG","LastLoginDate":"2021-10-06T06:32:09.000+0000","SmallPhotoUrl":"https://photos.com/photo/001","BannerPhotoUrl":"/profilephoto/001","EmployeeNumber":"18124","LastViewedDate":null,"TimeZoneSidKey":"Asia/Singapore","DigestFrequency":"D","ForecastEnabled":false,"EmailEncodingKey":"UTF-8","CommunityNickname":"Doe.John","LanguageLocaleKey":"en_US","LastReferencedDate":null,"ReceivesInfoEmails":true,"SmallBannerPhotoUrl":"/profilephoto/001/D","FederationIdentifier":null,"IsProfilePhotoActive":false,"MediumBannerPhotoUrl":"/profilephoto/001/E","EmailPreferencesAutoBcc":true,"ReceivesAdminInfoEmails":true,"OfflineTrialExpirationDate":null,"UserPermissionsOfflineUser":false,"UserPermissionsSupportUser":false,"UserPermissionsMarketingUser":false,"UserPermissionsInteractionUser":true,"DefaultGroupNotificationFrequency":"N","UserPermissionsCallCenterAutoLogin":false},"DetectedTimestamp":"2023-05-16T10:00:00Z","FindingTypeDisplayName":"Salesforce User Sending Email with Different Email Address","FindingTypeID":"a2790c4f-03f5-449f-b209-5f4447f417aa","FindingTypeSeverity":"Medium","InstanceID":"6b187be4-2dd5-42c5-a37b-111111111111","IntegrationDisplayName":"Salesforce Testing","IntegrationID":"c772678d-5cf1-4c73-bf3f-111111111111","IntegrationPolicyVendor":"Salesforce Connection"} \ No newline at end of file +{"AssetDisplayName":"John Doe","AssetExternalID":"0051N000004mG2LAAA","AssetLink":"https://example.com/resource","AssetMetadata":{"Id":"0051N000004mG2LAAA","Fax":null,"Name":"John Doe","Alias":"JDoe","Email":"user@example.com","Phone":"+3460000000","Title":"Customer Solutions Engineer","Address":{"city":"Singapore","state":null,"street":null,"country":"Singapore","latitude":null,"longitude":null,"stateCode":null,"postalCode":null,"countryCode":"SG","geocodeAccuracy":null},"Division":null,"IsActive":false,"LastName":"Doe","UserType":"Standard","AccountId":null,"BadgeText":"","ContactId":null,"Extension":null,"FirstName":"John","Signature":null,"Department":"521","SenderName":null,"UserRoleId":"00E2G000001E","attributes":{"url":"/services/data/userID","type":"User"},"CompanyName":"MyCompany","MobilePhone":null,"SenderEmail":"sender@example.com","CallCenterId":null,"FullPhotoUrl":"https://photos.com/profilephoto/001","LocaleSidKey":"en_SG","LastLoginDate":"2021-10-06T06:32:09.000+0000","SmallPhotoUrl":"https://photos.com/photo/001","BannerPhotoUrl":"/profilephoto/001","EmployeeNumber":"18124","LastViewedDate":null,"TimeZoneSidKey":"Asia/Singapore","DigestFrequency":"D","ForecastEnabled":false,"EmailEncodingKey":"UTF-8","CommunityNickname":"Doe.John","LanguageLocaleKey":"en_US","LastReferencedDate":null,"ReceivesInfoEmails":true,"SmallBannerPhotoUrl":"/profilephoto/001/D","FederationIdentifier":null,"IsProfilePhotoActive":false,"MediumBannerPhotoUrl":"/profilephoto/001/E","EmailPreferencesAutoBcc":true,"ReceivesAdminInfoEmails":true,"OfflineTrialExpirationDate":null,"UserPermissionsOfflineUser":false,"UserPermissionsSupportUser":false,"UserPermissionsMarketingUser":false,"UserPermissionsInteractionUser":true,"DefaultGroupNotificationFrequency":"N","UserPermissionsCallCenterAutoLogin":false},"DetectedTimestamp":"2023-05-16T10:00:00Z","FindingTypeDisplayName":"Salesforce User Sending Email with Different Email Address","FindingTypeID":"a2790c4f-03f5-449f-b209-5f4447f417aa","FindingTypeSeverity":"Medium","InstanceID":"6b187be4-2dd5-42c5-a37b-111111111111","IntegrationDisplayName":"Salesforce Testing","IntegrationID":"c772678d-5cf1-4c73-bf3f-111111111111","IntegrationPolicyVendor":"Salesforce Connection"} +{"AssetDisplayName":"John Doe","AssetExternalID":"0051N000004mG2LAAA","AssetLink":"https://example.com/resource","AssetMetadata":{"Id":"0051N000004mG2LAAA","Fax":null,"Name":"John Doe","Alias":"JDoe","Email":"user@example.com","Phone":"+3460000000","Title":"Customer Solutions Engineer","Address":{"city":"Singapore","state":null,"street":null,"country":"Singapore","latitude":null,"longitude":null,"stateCode":null,"postalCode":null,"countryCode":"SG","geocodeAccuracy":null},"Division":null,"IsActive":false,"LastName":"Doe","UserType":"Standard","AccountId":null,"BadgeText":"","ContactId":null,"Extension":null,"FirstName":"John","Signature":null,"Department":"521","SenderName":null,"UserRoleId":"00E2G000001E","attributes":{"url":"/services/data/userID","type":"User"},"CompanyName":"MyCompany","MobilePhone":null,"SenderEmail":"sender@example.com","CallCenterId":null,"FullPhotoUrl":"https://photos.com/profilephoto/001","LocaleSidKey":"en_SG","LastLoginDate":"2021-10-06T06:32:09.000+0000","SmallPhotoUrl":"https://photos.com/photo/001","BannerPhotoUrl":"/profilephoto/001","EmployeeNumber":"18124","LastViewedDate":null,"TimeZoneSidKey":"Asia/Singapore","DigestFrequency":"D","ForecastEnabled":false,"EmailEncodingKey":"UTF-8","CommunityNickname":"Doe.John","LanguageLocaleKey":"en_US","LastReferencedDate":null,"ReceivesInfoEmails":true,"SmallBannerPhotoUrl":"/profilephoto/001/D","FederationIdentifier":null,"IsProfilePhotoActive":false,"MediumBannerPhotoUrl":"/profilephoto/001/E","EmailPreferencesAutoBcc":true,"ReceivesAdminInfoEmails":true,"OfflineTrialExpirationDate":null,"UserPermissionsOfflineUser":false,"UserPermissionsSupportUser":false,"UserPermissionsMarketingUser":false,"UserPermissionsInteractionUser":true,"DefaultGroupNotificationFrequency":"N","UserPermissionsCallCenterAutoLogin":false},"DetectedTimestamp":"1684231200","FindingTypeDisplayName":"Salesforce User Sending Email with Different Email Address","FindingTypeID":"a2790c4f-03f5-449f-b209-5f4447f417aa","FindingTypeSeverity":"Medium","InstanceID":"6b187be4-2dd5-42c5-a37b-111111111111","IntegrationDisplayName":"Salesforce Testing","IntegrationID":"c772678d-5cf1-4c73-bf3f-111111111111","IntegrationPolicyVendor":"Salesforce Connection"} +{"AssetDisplayName":"John Doe","AssetExternalID":"0051N000004mG2LAAA","AssetLink":"https://example.com/resource","AssetMetadata":{"Id":"0051N000004mG2LAAA","Fax":null,"Name":"John Doe","Alias":"JDoe","Email":"user@example.com","Phone":"+3460000000","Title":"Customer Solutions Engineer","Address":{"city":"Singapore","state":null,"street":null,"country":"Singapore","latitude":null,"longitude":null,"stateCode":null,"postalCode":null,"countryCode":"SG","geocodeAccuracy":null},"Division":null,"IsActive":false,"LastName":"Doe","UserType":"Standard","AccountId":null,"BadgeText":"","ContactId":null,"Extension":null,"FirstName":"John","Signature":null,"Department":"521","SenderName":null,"UserRoleId":"00E2G000001E","attributes":{"url":"/services/data/userID","type":"User"},"CompanyName":"MyCompany","MobilePhone":null,"SenderEmail":"sender@example.com","CallCenterId":null,"FullPhotoUrl":"https://photos.com/profilephoto/001","LocaleSidKey":"en_SG","LastLoginDate":"2021-10-06T06:32:09.000+0000","SmallPhotoUrl":"https://photos.com/photo/001","BannerPhotoUrl":"/profilephoto/001","EmployeeNumber":"18124","LastViewedDate":null,"TimeZoneSidKey":"Asia/Singapore","DigestFrequency":"D","ForecastEnabled":false,"EmailEncodingKey":"UTF-8","CommunityNickname":"Doe.John","LanguageLocaleKey":"en_US","LastReferencedDate":null,"ReceivesInfoEmails":true,"SmallBannerPhotoUrl":"/profilephoto/001/D","FederationIdentifier":null,"IsProfilePhotoActive":false,"MediumBannerPhotoUrl":"/profilephoto/001/E","EmailPreferencesAutoBcc":true,"ReceivesAdminInfoEmails":true,"OfflineTrialExpirationDate":null,"UserPermissionsOfflineUser":false,"UserPermissionsSupportUser":false,"UserPermissionsMarketingUser":false,"UserPermissionsInteractionUser":true,"DefaultGroupNotificationFrequency":"N","UserPermissionsCallCenterAutoLogin":false},"DetectedTimestamp":"1684231200000000000","FindingTypeDisplayName":"Salesforce User Sending Email with Different Email Address","FindingTypeID":"a2790c4f-03f5-449f-b209-5f4447f417aa","FindingTypeSeverity":"Medium","InstanceID":"6b187be4-2dd5-42c5-a37b-111111111111","IntegrationDisplayName":"Salesforce Testing","IntegrationID":"c772678d-5cf1-4c73-bf3f-111111111111","IntegrationPolicyVendor":"Salesforce Connection"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log-expected.json b/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log-expected.json index c65f79ca919..c99887903b7 100644 --- a/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/casb/_dev/test/pipeline/test-pipeline-casb.log-expected.json @@ -75,7 +75,7 @@ } }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "category": [ @@ -99,6 +99,206 @@ "path": "/resource", "scheme": "https" } + }, + { + "@timestamp": "2023-05-16T10:00:00.000Z", + "cloudflare_logpush": { + "casb": { + "asset": { + "id": "0051N000004mG2LAAA", + "metadata": { + "Address": { + "city": "Singapore", + "country": "Singapore", + "countryCode": "SG" + }, + "Alias": "JDoe", + "BannerPhotoUrl": "/profilephoto/001", + "CommunityNickname": "Doe.John", + "CompanyName": "MyCompany", + "DefaultGroupNotificationFrequency": "N", + "Department": "521", + "DigestFrequency": "D", + "Email": "user@example.com", + "EmailEncodingKey": "UTF-8", + "EmailPreferencesAutoBcc": true, + "EmployeeNumber": "18124", + "FirstName": "John", + "ForecastEnabled": false, + "FullPhotoUrl": "https://photos.com/profilephoto/001", + "Id": "0051N000004mG2LAAA", + "IsActive": false, + "IsProfilePhotoActive": false, + "LanguageLocaleKey": "en_US", + "LastLoginDate": "2021-10-06T06:32:09.000+0000", + "LastName": "Doe", + "LocaleSidKey": "en_SG", + "MediumBannerPhotoUrl": "/profilephoto/001/E", + "Name": "John Doe", + "Phone": "+3460000000", + "ReceivesAdminInfoEmails": true, + "ReceivesInfoEmails": true, + "SenderEmail": "sender@example.com", + "SmallBannerPhotoUrl": "/profilephoto/001/D", + "SmallPhotoUrl": "https://photos.com/photo/001", + "TimeZoneSidKey": "Asia/Singapore", + "Title": "Customer Solutions Engineer", + "UserPermissionsCallCenterAutoLogin": false, + "UserPermissionsInteractionUser": true, + "UserPermissionsMarketingUser": false, + "UserPermissionsOfflineUser": false, + "UserPermissionsSupportUser": false, + "UserRoleId": "00E2G000001E", + "UserType": "Standard", + "attributes": { + "type": "User", + "url": "/services/data/userID" + } + }, + "name": "John Doe", + "url": "https://example.com/resource" + }, + "finding": { + "id": "6b187be4-2dd5-42c5-a37b-111111111111", + "type": { + "id": "a2790c4f-03f5-449f-b209-5f4447f417aa", + "name": "Salesforce User Sending Email with Different Email Address", + "severity": "Medium" + } + }, + "integration": { + "id": "c772678d-5cf1-4c73-bf3f-111111111111", + "name": "Salesforce Testing", + "policy_vendor": "Salesforce Connection" + }, + "timestamp": "2023-05-16T10:00:00.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "id": "6b187be4-2dd5-42c5-a37b-111111111111", + "kind": "event", + "original": "{\"AssetDisplayName\":\"John Doe\",\"AssetExternalID\":\"0051N000004mG2LAAA\",\"AssetLink\":\"https://example.com/resource\",\"AssetMetadata\":{\"Id\":\"0051N000004mG2LAAA\",\"Fax\":null,\"Name\":\"John Doe\",\"Alias\":\"JDoe\",\"Email\":\"user@example.com\",\"Phone\":\"+3460000000\",\"Title\":\"Customer Solutions Engineer\",\"Address\":{\"city\":\"Singapore\",\"state\":null,\"street\":null,\"country\":\"Singapore\",\"latitude\":null,\"longitude\":null,\"stateCode\":null,\"postalCode\":null,\"countryCode\":\"SG\",\"geocodeAccuracy\":null},\"Division\":null,\"IsActive\":false,\"LastName\":\"Doe\",\"UserType\":\"Standard\",\"AccountId\":null,\"BadgeText\":\"\",\"ContactId\":null,\"Extension\":null,\"FirstName\":\"John\",\"Signature\":null,\"Department\":\"521\",\"SenderName\":null,\"UserRoleId\":\"00E2G000001E\",\"attributes\":{\"url\":\"/services/data/userID\",\"type\":\"User\"},\"CompanyName\":\"MyCompany\",\"MobilePhone\":null,\"SenderEmail\":\"sender@example.com\",\"CallCenterId\":null,\"FullPhotoUrl\":\"https://photos.com/profilephoto/001\",\"LocaleSidKey\":\"en_SG\",\"LastLoginDate\":\"2021-10-06T06:32:09.000+0000\",\"SmallPhotoUrl\":\"https://photos.com/photo/001\",\"BannerPhotoUrl\":\"/profilephoto/001\",\"EmployeeNumber\":\"18124\",\"LastViewedDate\":null,\"TimeZoneSidKey\":\"Asia/Singapore\",\"DigestFrequency\":\"D\",\"ForecastEnabled\":false,\"EmailEncodingKey\":\"UTF-8\",\"CommunityNickname\":\"Doe.John\",\"LanguageLocaleKey\":\"en_US\",\"LastReferencedDate\":null,\"ReceivesInfoEmails\":true,\"SmallBannerPhotoUrl\":\"/profilephoto/001/D\",\"FederationIdentifier\":null,\"IsProfilePhotoActive\":false,\"MediumBannerPhotoUrl\":\"/profilephoto/001/E\",\"EmailPreferencesAutoBcc\":true,\"ReceivesAdminInfoEmails\":true,\"OfflineTrialExpirationDate\":null,\"UserPermissionsOfflineUser\":false,\"UserPermissionsSupportUser\":false,\"UserPermissionsMarketingUser\":false,\"UserPermissionsInteractionUser\":true,\"DefaultGroupNotificationFrequency\":\"N\",\"UserPermissionsCallCenterAutoLogin\":false},\"DetectedTimestamp\":\"1684231200\",\"FindingTypeDisplayName\":\"Salesforce User Sending Email with Different Email Address\",\"FindingTypeID\":\"a2790c4f-03f5-449f-b209-5f4447f417aa\",\"FindingTypeSeverity\":\"Medium\",\"InstanceID\":\"6b187be4-2dd5-42c5-a37b-111111111111\",\"IntegrationDisplayName\":\"Salesforce Testing\",\"IntegrationID\":\"c772678d-5cf1-4c73-bf3f-111111111111\",\"IntegrationPolicyVendor\":\"Salesforce Connection\"}", + "severity": 2, + "type": [ + "access" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "example.com", + "original": "https://example.com/resource", + "path": "/resource", + "scheme": "https" + } + }, + { + "@timestamp": "2023-05-16T10:00:00.000Z", + "cloudflare_logpush": { + "casb": { + "asset": { + "id": "0051N000004mG2LAAA", + "metadata": { + "Address": { + "city": "Singapore", + "country": "Singapore", + "countryCode": "SG" + }, + "Alias": "JDoe", + "BannerPhotoUrl": "/profilephoto/001", + "CommunityNickname": "Doe.John", + "CompanyName": "MyCompany", + "DefaultGroupNotificationFrequency": "N", + "Department": "521", + "DigestFrequency": "D", + "Email": "user@example.com", + "EmailEncodingKey": "UTF-8", + "EmailPreferencesAutoBcc": true, + "EmployeeNumber": "18124", + "FirstName": "John", + "ForecastEnabled": false, + "FullPhotoUrl": "https://photos.com/profilephoto/001", + "Id": "0051N000004mG2LAAA", + "IsActive": false, + "IsProfilePhotoActive": false, + "LanguageLocaleKey": "en_US", + "LastLoginDate": "2021-10-06T06:32:09.000+0000", + "LastName": "Doe", + "LocaleSidKey": "en_SG", + "MediumBannerPhotoUrl": "/profilephoto/001/E", + "Name": "John Doe", + "Phone": "+3460000000", + "ReceivesAdminInfoEmails": true, + "ReceivesInfoEmails": true, + "SenderEmail": "sender@example.com", + "SmallBannerPhotoUrl": "/profilephoto/001/D", + "SmallPhotoUrl": "https://photos.com/photo/001", + "TimeZoneSidKey": "Asia/Singapore", + "Title": "Customer Solutions Engineer", + "UserPermissionsCallCenterAutoLogin": false, + "UserPermissionsInteractionUser": true, + "UserPermissionsMarketingUser": false, + "UserPermissionsOfflineUser": false, + "UserPermissionsSupportUser": false, + "UserRoleId": "00E2G000001E", + "UserType": "Standard", + "attributes": { + "type": "User", + "url": "/services/data/userID" + } + }, + "name": "John Doe", + "url": "https://example.com/resource" + }, + "finding": { + "id": "6b187be4-2dd5-42c5-a37b-111111111111", + "type": { + "id": "a2790c4f-03f5-449f-b209-5f4447f417aa", + "name": "Salesforce User Sending Email with Different Email Address", + "severity": "Medium" + } + }, + "integration": { + "id": "c772678d-5cf1-4c73-bf3f-111111111111", + "name": "Salesforce Testing", + "policy_vendor": "Salesforce Connection" + }, + "timestamp": "2023-05-16T10:00:00.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "id": "6b187be4-2dd5-42c5-a37b-111111111111", + "kind": "event", + "original": "{\"AssetDisplayName\":\"John Doe\",\"AssetExternalID\":\"0051N000004mG2LAAA\",\"AssetLink\":\"https://example.com/resource\",\"AssetMetadata\":{\"Id\":\"0051N000004mG2LAAA\",\"Fax\":null,\"Name\":\"John Doe\",\"Alias\":\"JDoe\",\"Email\":\"user@example.com\",\"Phone\":\"+3460000000\",\"Title\":\"Customer Solutions Engineer\",\"Address\":{\"city\":\"Singapore\",\"state\":null,\"street\":null,\"country\":\"Singapore\",\"latitude\":null,\"longitude\":null,\"stateCode\":null,\"postalCode\":null,\"countryCode\":\"SG\",\"geocodeAccuracy\":null},\"Division\":null,\"IsActive\":false,\"LastName\":\"Doe\",\"UserType\":\"Standard\",\"AccountId\":null,\"BadgeText\":\"\",\"ContactId\":null,\"Extension\":null,\"FirstName\":\"John\",\"Signature\":null,\"Department\":\"521\",\"SenderName\":null,\"UserRoleId\":\"00E2G000001E\",\"attributes\":{\"url\":\"/services/data/userID\",\"type\":\"User\"},\"CompanyName\":\"MyCompany\",\"MobilePhone\":null,\"SenderEmail\":\"sender@example.com\",\"CallCenterId\":null,\"FullPhotoUrl\":\"https://photos.com/profilephoto/001\",\"LocaleSidKey\":\"en_SG\",\"LastLoginDate\":\"2021-10-06T06:32:09.000+0000\",\"SmallPhotoUrl\":\"https://photos.com/photo/001\",\"BannerPhotoUrl\":\"/profilephoto/001\",\"EmployeeNumber\":\"18124\",\"LastViewedDate\":null,\"TimeZoneSidKey\":\"Asia/Singapore\",\"DigestFrequency\":\"D\",\"ForecastEnabled\":false,\"EmailEncodingKey\":\"UTF-8\",\"CommunityNickname\":\"Doe.John\",\"LanguageLocaleKey\":\"en_US\",\"LastReferencedDate\":null,\"ReceivesInfoEmails\":true,\"SmallBannerPhotoUrl\":\"/profilephoto/001/D\",\"FederationIdentifier\":null,\"IsProfilePhotoActive\":false,\"MediumBannerPhotoUrl\":\"/profilephoto/001/E\",\"EmailPreferencesAutoBcc\":true,\"ReceivesAdminInfoEmails\":true,\"OfflineTrialExpirationDate\":null,\"UserPermissionsOfflineUser\":false,\"UserPermissionsSupportUser\":false,\"UserPermissionsMarketingUser\":false,\"UserPermissionsInteractionUser\":true,\"DefaultGroupNotificationFrequency\":\"N\",\"UserPermissionsCallCenterAutoLogin\":false},\"DetectedTimestamp\":\"1684231200000000000\",\"FindingTypeDisplayName\":\"Salesforce User Sending Email with Different Email Address\",\"FindingTypeID\":\"a2790c4f-03f5-449f-b209-5f4447f417aa\",\"FindingTypeSeverity\":\"Medium\",\"InstanceID\":\"6b187be4-2dd5-42c5-a37b-111111111111\",\"IntegrationDisplayName\":\"Salesforce Testing\",\"IntegrationID\":\"c772678d-5cf1-4c73-bf3f-111111111111\",\"IntegrationPolicyVendor\":\"Salesforce Connection\"}", + "severity": 2, + "type": [ + "access" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "example.com", + "original": "https://example.com/resource", + "path": "/resource", + "scheme": "https" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/casb/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/casb/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/casb/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/casb/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/casb/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/casb/elasticsearch/ingest_pipeline/default.yml index 015dbaf07fc..0c3be0cd5e0 100644 --- a/packages/cloudflare_logpush/data_stream/casb/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/casb/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare CASB Findings logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -20,22 +20,32 @@ processors: - set: field: event.kind value: event - - convert: - field: json.DetectedTimestamp - type: string - ignore_missing: true - - gsub: - field: json.DetectedTimestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_detected_timestamp_to_milli + if: ctx.json?.DetectedTimestamp != null + source: | + try { + long t; + if (ctx.json.DetectedTimestamp instanceof String) { + t = Long.parseLong(ctx.json.DetectedTimestamp); + } else if (ctx.json.DetectedTimestamp instanceof Number) { + t = (long)(ctx.json.DetectedTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.DetectedTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.DetectedTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.DetectedTimestamp if: ctx.json?.DetectedTimestamp != null && ctx.json.DetectedTimestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/casb/manifest.yml b/packages/cloudflare_logpush/data_stream/casb/manifest.yml index 349af94f6ec..1dfd2939212 100644 --- a/packages/cloudflare_logpush/data_stream/casb/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/casb/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/casb/sample_event.json b/packages/cloudflare_logpush/data_stream/casb/sample_event.json index a87787c9b64..85cc427e013 100644 --- a/packages/cloudflare_logpush/data_stream/casb/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/casb/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-16T10:00:00.000Z", "agent": { - "ephemeral_id": "65c8c68e-215e-4ba6-887b-8cdaa353dfe8", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "96d395e1-0809-4277-9751-12fc1609d0ea", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "casb": { @@ -85,12 +85,12 @@ "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -99,7 +99,7 @@ ], "dataset": "cloudflare_logpush.casb", "id": "6b187be4-2dd5-42c5-a37b-111111111111", - "ingested": "2023-06-12T08:09:02Z", + "ingested": "2023-07-25T07:30:57Z", "kind": "event", "original": "{\"AssetDisplayName\":\"John Doe\",\"AssetExternalID\":\"0051N000004mG2LAAA\",\"AssetLink\":\"https://example.com/resource\",\"AssetMetadata\":{\"AccountId\":null,\"Address\":{\"city\":\"Singapore\",\"country\":\"Singapore\",\"countryCode\":\"SG\",\"geocodeAccuracy\":null,\"latitude\":null,\"longitude\":null,\"postalCode\":null,\"state\":null,\"stateCode\":null,\"street\":null},\"Alias\":\"JDoe\",\"BadgeText\":\"\",\"BannerPhotoUrl\":\"/profilephoto/001\",\"CallCenterId\":null,\"CommunityNickname\":\"Doe.John\",\"CompanyName\":\"MyCompany\",\"ContactId\":null,\"DefaultGroupNotificationFrequency\":\"N\",\"Department\":\"521\",\"DigestFrequency\":\"D\",\"Division\":null,\"Email\":\"user@example.com\",\"EmailEncodingKey\":\"UTF-8\",\"EmailPreferencesAutoBcc\":true,\"EmployeeNumber\":\"18124\",\"Extension\":null,\"Fax\":null,\"FederationIdentifier\":null,\"FirstName\":\"John\",\"ForecastEnabled\":false,\"FullPhotoUrl\":\"https://photos.com/profilephoto/001\",\"Id\":\"0051N000004mG2LAAA\",\"IsActive\":false,\"IsProfilePhotoActive\":false,\"LanguageLocaleKey\":\"en_US\",\"LastLoginDate\":\"2021-10-06T06:32:09.000+0000\",\"LastName\":\"Doe\",\"LastReferencedDate\":null,\"LastViewedDate\":null,\"LocaleSidKey\":\"en_SG\",\"MediumBannerPhotoUrl\":\"/profilephoto/001/E\",\"MobilePhone\":null,\"Name\":\"John Doe\",\"OfflineTrialExpirationDate\":null,\"Phone\":\"+3460000000\",\"ReceivesAdminInfoEmails\":true,\"ReceivesInfoEmails\":true,\"SenderEmail\":\"sender@example.com\",\"SenderName\":null,\"Signature\":null,\"SmallBannerPhotoUrl\":\"/profilephoto/001/D\",\"SmallPhotoUrl\":\"https://photos.com/photo/001\",\"TimeZoneSidKey\":\"Asia/Singapore\",\"Title\":\"Customer Solutions Engineer\",\"UserPermissionsCallCenterAutoLogin\":false,\"UserPermissionsInteractionUser\":true,\"UserPermissionsMarketingUser\":false,\"UserPermissionsOfflineUser\":false,\"UserPermissionsSupportUser\":false,\"UserRoleId\":\"00E2G000001E\",\"UserType\":\"Standard\",\"attributes\":{\"type\":\"User\",\"url\":\"/services/data/userID\"}},\"DetectedTimestamp\":\"2023-05-16T10:00:00Z\",\"FindingTypeDisplayName\":\"Salesforce User Sending Email with Different Email Address\",\"FindingTypeID\":\"a2790c4f-03f5-449f-b209-5f4447f417aa\",\"FindingTypeSeverity\":\"Medium\",\"InstanceID\":\"6b187be4-2dd5-42c5-a37b-111111111111\",\"IntegrationDisplayName\":\"Salesforce Testing\",\"IntegrationID\":\"c772678d-5cf1-4c73-bf3f-111111111111\",\"IntegrationPolicyVendor\":\"Salesforce Connection\"}", "severity": 2, diff --git a/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log b/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log index 8d43739206c..eed2d59c061 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log +++ b/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log @@ -1 +1,3 @@ -{"ClientVersion":"2023.3.258","DeviceID":"083a8354-d56c-11ed-9771-111111111","DeviceManufacturer":"Google Compute Engine","DeviceModel":"Google Compute Engine","DeviceName":"zt-test-vm1","DeviceSerialNumber":"GoogleCloud-ABCD1234567890","DeviceType":"linux","Email":"user@example.com","OSVersion":"5.15.0","PolicyID":"policy-abcdefgh","PostureCheckName":"Ubuntu","PostureCheckType":"os_version","PostureEvaluatedResult":true,"PostureExpectedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"PostureReceivedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"Timestamp":"2023-05-17T12:00:00Z","UserUID":"user-abcdefgh"} \ No newline at end of file +{"ClientVersion":"2023.3.258","DeviceID":"083a8354-d56c-11ed-9771-111111111","DeviceManufacturer":"Google Compute Engine","DeviceModel":"Google Compute Engine","DeviceName":"zt-test-vm1","DeviceSerialNumber":"GoogleCloud-ABCD1234567890","DeviceType":"linux","Email":"user@example.com","OSVersion":"5.15.0","PolicyID":"policy-abcdefgh","PostureCheckName":"Ubuntu","PostureCheckType":"os_version","PostureEvaluatedResult":true,"PostureExpectedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"PostureReceivedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"Timestamp":"2023-05-17T12:00:00Z","UserUID":"user-abcdefgh"} +{"ClientVersion":"2023.3.258","DeviceID":"083a8354-d56c-11ed-9771-111111111","DeviceManufacturer":"Google Compute Engine","DeviceModel":"Google Compute Engine","DeviceName":"zt-test-vm1","DeviceSerialNumber":"GoogleCloud-ABCD1234567890","DeviceType":"linux","Email":"user@example.com","OSVersion":"5.15.0","PolicyID":"policy-abcdefgh","PostureCheckName":"Ubuntu","PostureCheckType":"os_version","PostureEvaluatedResult":true,"PostureExpectedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"PostureReceivedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"Timestamp":"1684324800","UserUID":"user-abcdefgh"} +{"ClientVersion":"2023.3.258","DeviceID":"083a8354-d56c-11ed-9771-111111111","DeviceManufacturer":"Google Compute Engine","DeviceModel":"Google Compute Engine","DeviceName":"zt-test-vm1","DeviceSerialNumber":"GoogleCloud-ABCD1234567890","DeviceType":"linux","Email":"user@example.com","OSVersion":"5.15.0","PolicyID":"policy-abcdefgh","PostureCheckName":"Ubuntu","PostureCheckType":"os_version","PostureEvaluatedResult":true,"PostureExpectedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"PostureReceivedJSON":{"version":"5.15.0-1025-gcp","operator":"==","os_distro_name":"ubuntu","os_distro_revision":"20.04"},"Timestamp":"1684324800000000000","UserUID":"user-abcdefgh"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log-expected.json b/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log-expected.json index b1d38859ec0..57eea799594 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/device_posture/_dev/test/pipeline/test-pipeline-device-posture.log-expected.json @@ -44,7 +44,7 @@ } }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "category": [ @@ -91,6 +91,190 @@ "user_agent": { "version": "2023.3.258" } + }, + { + "@timestamp": "2023-05-17T12:00:00.000Z", + "cloudflare_logpush": { + "device_posture": { + "eval": { + "expected": { + "operator": "==", + "os_distro_name": "ubuntu", + "os_distro_revision": "20.04", + "version": "5.15.0-1025-gcp" + }, + "received": { + "operator": "==", + "os_distro_name": "ubuntu", + "os_distro_revision": "20.04", + "version": "5.15.0-1025-gcp" + }, + "result": true + }, + "host": { + "id": "083a8354-d56c-11ed-9771-111111111", + "manufacturer": "Google Compute Engine", + "model": "Google Compute Engine", + "name": "zt-test-vm1", + "os": { + "family": "linux", + "version": "5.15.0" + }, + "serial": "GoogleCloud-ABCD1234567890" + }, + "rule": { + "category": "os_version", + "id": "policy-abcdefgh", + "name": "Ubuntu" + }, + "timestamp": "2023-05-17T12:00:00.000Z", + "user": { + "email": "user@example.com", + "id": "user-abcdefgh" + }, + "version": "2023.3.258" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"ClientVersion\":\"2023.3.258\",\"DeviceID\":\"083a8354-d56c-11ed-9771-111111111\",\"DeviceManufacturer\":\"Google Compute Engine\",\"DeviceModel\":\"Google Compute Engine\",\"DeviceName\":\"zt-test-vm1\",\"DeviceSerialNumber\":\"GoogleCloud-ABCD1234567890\",\"DeviceType\":\"linux\",\"Email\":\"user@example.com\",\"OSVersion\":\"5.15.0\",\"PolicyID\":\"policy-abcdefgh\",\"PostureCheckName\":\"Ubuntu\",\"PostureCheckType\":\"os_version\",\"PostureEvaluatedResult\":true,\"PostureExpectedJSON\":{\"version\":\"5.15.0-1025-gcp\",\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\"},\"PostureReceivedJSON\":{\"version\":\"5.15.0-1025-gcp\",\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\"},\"Timestamp\":\"1684324800\",\"UserUID\":\"user-abcdefgh\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-111111111", + "name": "zt-test-vm1", + "os": { + "family": "linux", + "version": "5.15.0" + } + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-111111111", + "zt-test-vm1" + ], + "user": [ + "user-abcdefgh", + "user@example.com" + ] + }, + "rule": { + "category": "os_version", + "id": "policy-abcdefgh", + "name": "Ubuntu" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@example.com", + "id": "user-abcdefgh" + }, + "user_agent": { + "version": "2023.3.258" + } + }, + { + "@timestamp": "2023-05-17T12:00:00.000Z", + "cloudflare_logpush": { + "device_posture": { + "eval": { + "expected": { + "operator": "==", + "os_distro_name": "ubuntu", + "os_distro_revision": "20.04", + "version": "5.15.0-1025-gcp" + }, + "received": { + "operator": "==", + "os_distro_name": "ubuntu", + "os_distro_revision": "20.04", + "version": "5.15.0-1025-gcp" + }, + "result": true + }, + "host": { + "id": "083a8354-d56c-11ed-9771-111111111", + "manufacturer": "Google Compute Engine", + "model": "Google Compute Engine", + "name": "zt-test-vm1", + "os": { + "family": "linux", + "version": "5.15.0" + }, + "serial": "GoogleCloud-ABCD1234567890" + }, + "rule": { + "category": "os_version", + "id": "policy-abcdefgh", + "name": "Ubuntu" + }, + "timestamp": "2023-05-17T12:00:00.000Z", + "user": { + "email": "user@example.com", + "id": "user-abcdefgh" + }, + "version": "2023.3.258" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"ClientVersion\":\"2023.3.258\",\"DeviceID\":\"083a8354-d56c-11ed-9771-111111111\",\"DeviceManufacturer\":\"Google Compute Engine\",\"DeviceModel\":\"Google Compute Engine\",\"DeviceName\":\"zt-test-vm1\",\"DeviceSerialNumber\":\"GoogleCloud-ABCD1234567890\",\"DeviceType\":\"linux\",\"Email\":\"user@example.com\",\"OSVersion\":\"5.15.0\",\"PolicyID\":\"policy-abcdefgh\",\"PostureCheckName\":\"Ubuntu\",\"PostureCheckType\":\"os_version\",\"PostureEvaluatedResult\":true,\"PostureExpectedJSON\":{\"version\":\"5.15.0-1025-gcp\",\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\"},\"PostureReceivedJSON\":{\"version\":\"5.15.0-1025-gcp\",\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\"},\"Timestamp\":\"1684324800000000000\",\"UserUID\":\"user-abcdefgh\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-111111111", + "name": "zt-test-vm1", + "os": { + "family": "linux", + "version": "5.15.0" + } + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-111111111", + "zt-test-vm1" + ], + "user": [ + "user-abcdefgh", + "user@example.com" + ] + }, + "rule": { + "category": "os_version", + "id": "policy-abcdefgh", + "name": "Ubuntu" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@example.com", + "id": "user-abcdefgh" + }, + "user_agent": { + "version": "2023.3.258" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/device_posture/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/device_posture/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/device_posture/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/device_posture/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/device_posture/elasticsearch/ingest_pipeline/default.yml index 08bd785e904..af6d489c338 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/device_posture/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Device Posture Results logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -20,22 +20,32 @@ processors: - set: field: event.kind value: event - - convert: - field: json.Timestamp - type: string - ignore_missing: true - - gsub: - field: json.Timestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_timestamp_to_milli + if: ctx.json?.Timestamp != null + source: | + try { + long t; + if (ctx.json.Timestamp instanceof String) { + t = Long.parseLong(ctx.json.Timestamp); + } else if (ctx.json.Timestamp instanceof Number) { + t = (long)(ctx.json.Timestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Timestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Timestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Timestamp if: ctx.json?.Timestamp != null && ctx.json.Timestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/device_posture/manifest.yml b/packages/cloudflare_logpush/data_stream/device_posture/manifest.yml index 5a84c3f0f10..77f5b4c9869 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/device_posture/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/device_posture/sample_event.json b/packages/cloudflare_logpush/data_stream/device_posture/sample_event.json index 2b508f55082..ddc62196984 100644 --- a/packages/cloudflare_logpush/data_stream/device_posture/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/device_posture/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-17T12:00:00.000Z", "agent": { - "ephemeral_id": "53efe65d-da86-46ae-871a-4d57db0b5d74", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "64490d01-053f-4f30-8582-f198c691510a", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "device_posture": { @@ -54,12 +54,12 @@ "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -67,7 +67,7 @@ "host" ], "dataset": "cloudflare_logpush.device_posture", - "ingested": "2023-06-12T08:09:41Z", + "ingested": "2023-07-25T07:31:45Z", "kind": "event", "original": "{\"ClientVersion\":\"2023.3.258\",\"DeviceID\":\"083a8354-d56c-11ed-9771-111111111\",\"DeviceManufacturer\":\"Google Compute Engine\",\"DeviceModel\":\"Google Compute Engine\",\"DeviceName\":\"zt-test-vm1\",\"DeviceSerialNumber\":\"GoogleCloud-ABCD1234567890\",\"DeviceType\":\"linux\",\"Email\":\"user@example.com\",\"OSVersion\":\"5.15.0\",\"PolicyID\":\"policy-abcdefgh\",\"PostureCheckName\":\"Ubuntu\",\"PostureCheckType\":\"os_version\",\"PostureEvaluatedResult\":true,\"PostureExpectedJSON\":{\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\",\"version\":\"5.15.0-1025-gcp\"},\"PostureReceivedJSON\":{\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\",\"version\":\"5.15.0-1025-gcp\"},\"Timestamp\":\"2023-05-17T12:00:00Z\",\"UserUID\":\"user-abcdefgh\"}", "outcome": "success", diff --git a/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log b/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log index 9c4d06de1b5..51120651623 100644 --- a/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log +++ b/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log @@ -1 +1,3 @@ -{"ColoCode":"MRS","EDNSSubnet":"1.128.0.0","EDNSSubnetLength":0,"QueryName":"example.com","QueryType":65535,"ResponseCached":false,"ResponseCode":0,"SourceIP":"175.16.199.0","Timestamp":"2022-05-26T09:23:54Z"} \ No newline at end of file +{"ColoCode":"MRS","EDNSSubnet":"1.128.0.0","EDNSSubnetLength":0,"QueryName":"example.com","QueryType":65535,"ResponseCached":false,"ResponseCode":0,"SourceIP":"175.16.199.0","Timestamp":"2022-05-26T09:23:54Z"} +{"ColoCode":"MRS","EDNSSubnet":"1.128.0.0","EDNSSubnetLength":0,"QueryName":"example.com","QueryType":65535,"ResponseCached":false,"ResponseCode":0,"SourceIP":"175.16.199.0","Timestamp":"1653557034"} +{"ColoCode":"MRS","EDNSSubnet":"1.128.0.0","EDNSSubnetLength":0,"QueryName":"example.com","QueryType":65535,"ResponseCached":false,"ResponseCode":0,"SourceIP":"175.16.199.0","Timestamp":"1653557034000000000"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log-expected.json b/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log-expected.json index ea2f04acb6e..742b3aacb35 100644 --- a/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/dns/_dev/test/pipeline/test-pipeline-dns.log-expected.json @@ -31,7 +31,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -56,6 +56,120 @@ "preserve_original_event", "preserve_duplicate_custom_fields" ] + }, + { + "@timestamp": "2022-05-26T09:23:54.000Z", + "cloudflare_logpush": { + "dns": { + "colo": { + "code": "MRS" + }, + "edns": { + "subnet": "1.128.0.0", + "subnet_length": 0 + }, + "query": { + "name": "example.com", + "type": 65535 + }, + "response": { + "cached": false, + "code": 0 + }, + "source": { + "ip": "175.16.199.0" + }, + "timestamp": "2022-05-26T09:23:54.000Z" + } + }, + "dns": { + "question": { + "name": "example.com" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ColoCode\":\"MRS\",\"EDNSSubnet\":\"1.128.0.0\",\"EDNSSubnetLength\":0,\"QueryName\":\"example.com\",\"QueryType\":65535,\"ResponseCached\":false,\"ResponseCode\":0,\"SourceIP\":\"175.16.199.0\",\"Timestamp\":\"1653557034\"}", + "type": [ + "info" + ] + }, + "related": { + "ip": [ + "175.16.199.0", + "1.128.0.0" + ] + }, + "source": { + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2022-05-26T09:23:54.000Z", + "cloudflare_logpush": { + "dns": { + "colo": { + "code": "MRS" + }, + "edns": { + "subnet": "1.128.0.0", + "subnet_length": 0 + }, + "query": { + "name": "example.com", + "type": 65535 + }, + "response": { + "cached": false, + "code": 0 + }, + "source": { + "ip": "175.16.199.0" + }, + "timestamp": "2022-05-26T09:23:54.000Z" + } + }, + "dns": { + "question": { + "name": "example.com" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ColoCode\":\"MRS\",\"EDNSSubnet\":\"1.128.0.0\",\"EDNSSubnetLength\":0,\"QueryName\":\"example.com\",\"QueryType\":65535,\"ResponseCached\":false,\"ResponseCode\":0,\"SourceIP\":\"175.16.199.0\",\"Timestamp\":\"1653557034000000000\"}", + "type": [ + "info" + ] + }, + "related": { + "ip": [ + "175.16.199.0", + "1.128.0.0" + ] + }, + "source": { + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/dns/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/dns/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/dns/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/dns/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index 32c69cd341a..66ec9eba90c 100644 --- a/packages/cloudflare_logpush/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare DNS logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.Timestamp - type: string - ignore_missing: true - - gsub: - field: json.Timestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_timestamp_to_milli + if: ctx.json?.Timestamp != null + source: | + try { + long t; + if (ctx.json.Timestamp instanceof String) { + t = Long.parseLong(ctx.json.Timestamp); + } else if (ctx.json.Timestamp instanceof Number) { + t = (long)(ctx.json.Timestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Timestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Timestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Timestamp if: ctx.json?.Timestamp != null && ctx.json.Timestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/dns/manifest.yml b/packages/cloudflare_logpush/data_stream/dns/manifest.yml index ab938420df3..e83cc9f68fe 100644 --- a/packages/cloudflare_logpush/data_stream/dns/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/dns/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/dns/sample_event.json b/packages/cloudflare_logpush/data_stream/dns/sample_event.json index b4e483b6897..b318354e358 100644 --- a/packages/cloudflare_logpush/data_stream/dns/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/dns/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-26T09:23:54.000Z", "agent": { - "ephemeral_id": "46ca52ad-75a1-46fa-81a1-e9845fb5074e", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "62a245d4-8aec-4021-b4ae-89e830b7a5d3", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "dns": { @@ -41,12 +41,12 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -54,7 +54,7 @@ "network" ], "dataset": "cloudflare_logpush.dns", - "ingested": "2023-06-12T08:10:21Z", + "ingested": "2023-07-25T07:32:33Z", "kind": "event", "original": "{\"ColoCode\":\"MRS\",\"EDNSSubnet\":\"1.128.0.0\",\"EDNSSubnetLength\":0,\"QueryName\":\"example.com\",\"QueryType\":65535,\"ResponseCached\":false,\"ResponseCode\":0,\"SourceIP\":\"175.16.199.0\",\"Timestamp\":\"2022-05-26T09:23:54Z\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log b/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log index 16af53c082c..7d5344e029f 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log +++ b/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log @@ -1 +1,3 @@ -{"ClientRequestScheme":"https","MatchIndex":1,"ClientRefererHost":"abc.example.com","Source":"firewallrules","ClientRequestUserAgent":"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ClientRefererPath":"/abc/checkout","Metadata":{"filter":"1ced07e066a34abf8b14f2a99593bc8d","type":"customer"},"EdgeResponseStatus":403,"ClientRequestProtocol":"HTTP/1.1","OriginatorRayID":"00","RayID":"713d477539b55c29","ClientRequestMethod":"GET","ClientIP":"175.16.199.0","ClientRequestPath":"/abc/checkout","Action":"block","Kind":"firewall","RuleID":"7dc666e026974dab84884c73b3e2afe1","ClientIPClass":"searchEngine","ClientASNDescription":"CLOUDFLARENET","ClientCountry":"us","ClientRefererQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","ClientRequestQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","OriginResponseStatus":0,"EdgeColoCode":"IAD","ClientRefererScheme":"referer URL scheme","Datetime":"2022-05-31T05:23:43Z","ClientRequestHost":"xyz.example.com","ClientASN":15169} \ No newline at end of file +{"ClientRequestScheme":"https","MatchIndex":1,"ClientRefererHost":"abc.example.com","Source":"firewallrules","ClientRequestUserAgent":"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ClientRefererPath":"/abc/checkout","Metadata":{"filter":"1ced07e066a34abf8b14f2a99593bc8d","type":"customer"},"EdgeResponseStatus":403,"ClientRequestProtocol":"HTTP/1.1","OriginatorRayID":"00","RayID":"713d477539b55c29","ClientRequestMethod":"GET","ClientIP":"175.16.199.0","ClientRequestPath":"/abc/checkout","Action":"block","Kind":"firewall","RuleID":"7dc666e026974dab84884c73b3e2afe1","ClientIPClass":"searchEngine","ClientASNDescription":"CLOUDFLARENET","ClientCountry":"us","ClientRefererQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","ClientRequestQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","OriginResponseStatus":0,"EdgeColoCode":"IAD","ClientRefererScheme":"referer URL scheme","Datetime":"2022-05-31T05:23:43Z","ClientRequestHost":"xyz.example.com","ClientASN":15169} +{"ClientRequestScheme":"https","MatchIndex":1,"ClientRefererHost":"abc.example.com","Source":"firewallrules","ClientRequestUserAgent":"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ClientRefererPath":"/abc/checkout","Metadata":{"filter":"1ced07e066a34abf8b14f2a99593bc8d","type":"customer"},"EdgeResponseStatus":403,"ClientRequestProtocol":"HTTP/1.1","OriginatorRayID":"00","RayID":"713d477539b55c29","ClientRequestMethod":"GET","ClientIP":"175.16.199.0","ClientRequestPath":"/abc/checkout","Action":"block","Kind":"firewall","RuleID":"7dc666e026974dab84884c73b3e2afe1","ClientIPClass":"searchEngine","ClientASNDescription":"CLOUDFLARENET","ClientCountry":"us","ClientRefererQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","ClientRequestQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","OriginResponseStatus":0,"EdgeColoCode":"IAD","ClientRefererScheme":"referer URL scheme","Datetime":"1653974623","ClientRequestHost":"xyz.example.com","ClientASN":15169} +{"ClientRequestScheme":"https","MatchIndex":1,"ClientRefererHost":"abc.example.com","Source":"firewallrules","ClientRequestUserAgent":"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ClientRefererPath":"/abc/checkout","Metadata":{"filter":"1ced07e066a34abf8b14f2a99593bc8d","type":"customer"},"EdgeResponseStatus":403,"ClientRequestProtocol":"HTTP/1.1","OriginatorRayID":"00","RayID":"713d477539b55c29","ClientRequestMethod":"GET","ClientIP":"175.16.199.0","ClientRequestPath":"/abc/checkout","Action":"block","Kind":"firewall","RuleID":"7dc666e026974dab84884c73b3e2afe1","ClientIPClass":"searchEngine","ClientASNDescription":"CLOUDFLARENET","ClientCountry":"us","ClientRefererQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","ClientRequestQuery":"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))&timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))","OriginResponseStatus":0,"EdgeColoCode":"IAD","ClientRefererScheme":"referer URL scheme","Datetime":"1653974623000000000","ClientRequestHost":"xyz.example.com","ClientASN":15169} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log-expected.json b/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log-expected.json index 95764e5f297..2c45b45e1a6 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/firewall_event/_dev/test/pipeline/test-pipeline-firewall-event.log-expected.json @@ -64,7 +64,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -133,6 +133,274 @@ }, "version": "2.1" } + }, + { + "@timestamp": "2022-05-31T05:23:43.000Z", + "cloudflare_logpush": { + "firewall_event": { + "action": "block", + "client": { + "asn": { + "description": "CLOUDFLARENET", + "value": 15169 + }, + "country": "us", + "ip": "175.16.199.0", + "ip_class": "searchEngine", + "referer": { + "host": "abc.example.com", + "path": "/abc/checkout", + "query": "?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "referer URL scheme" + }, + "request": { + "host": "xyz.example.com", + "method": "GET", + "path": "/abc/checkout", + "protocol": "HTTP/1.1", + "query": "?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "https", + "user": { + "agent": "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" + } + } + }, + "edge": { + "colo": { + "code": "IAD" + }, + "response": { + "status": 403 + } + }, + "kind": "firewall", + "match_index": 1, + "meta_data": { + "filter": "1ced07e066a34abf8b14f2a99593bc8d", + "type": "customer" + }, + "origin": { + "ray": { + "id": "00" + }, + "response": { + "status": 0 + } + }, + "ray": { + "id": "713d477539b55c29" + }, + "rule": { + "id": "7dc666e026974dab84884c73b3e2afe1" + }, + "source": "firewallrules", + "timestamp": "2022-05-31T05:23:43.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ClientRequestScheme\":\"https\",\"MatchIndex\":1,\"ClientRefererHost\":\"abc.example.com\",\"Source\":\"firewallrules\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\",\"ClientRefererPath\":\"/abc/checkout\",\"Metadata\":{\"filter\":\"1ced07e066a34abf8b14f2a99593bc8d\",\"type\":\"customer\"},\"EdgeResponseStatus\":403,\"ClientRequestProtocol\":\"HTTP/1.1\",\"OriginatorRayID\":\"00\",\"RayID\":\"713d477539b55c29\",\"ClientRequestMethod\":\"GET\",\"ClientIP\":\"175.16.199.0\",\"ClientRequestPath\":\"/abc/checkout\",\"Action\":\"block\",\"Kind\":\"firewall\",\"RuleID\":\"7dc666e026974dab84884c73b3e2afe1\",\"ClientIPClass\":\"searchEngine\",\"ClientASNDescription\":\"CLOUDFLARENET\",\"ClientCountry\":\"us\",\"ClientRefererQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRequestQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"OriginResponseStatus\":0,\"EdgeColoCode\":\"IAD\",\"ClientRefererScheme\":\"referer URL scheme\",\"Datetime\":\"1653974623\",\"ClientRequestHost\":\"xyz.example.com\",\"ClientASN\":15169}", + "type": [ + "info" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 403 + }, + "version": "1.1" + }, + "network": { + "protocol": "http" + }, + "related": { + "hosts": [ + "abc.example.com", + "xyz.example.com" + ], + "ip": [ + "175.16.199.0" + ] + }, + "rule": { + "id": "7dc666e026974dab84884c73b3e2afe1" + }, + "source": { + "as": { + "number": 15169 + }, + "geo": { + "country_iso_code": "us" + }, + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "xyz.example.com", + "path": "/abc/checkout", + "query": "sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Spider" + }, + "name": "Googlebot", + "original": "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", + "os": { + "full": "Android 6.0.1", + "name": "Android", + "version": "6.0.1" + }, + "version": "2.1" + } + }, + { + "@timestamp": "2022-05-31T05:23:43.000Z", + "cloudflare_logpush": { + "firewall_event": { + "action": "block", + "client": { + "asn": { + "description": "CLOUDFLARENET", + "value": 15169 + }, + "country": "us", + "ip": "175.16.199.0", + "ip_class": "searchEngine", + "referer": { + "host": "abc.example.com", + "path": "/abc/checkout", + "query": "?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "referer URL scheme" + }, + "request": { + "host": "xyz.example.com", + "method": "GET", + "path": "/abc/checkout", + "protocol": "HTTP/1.1", + "query": "?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "https", + "user": { + "agent": "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" + } + } + }, + "edge": { + "colo": { + "code": "IAD" + }, + "response": { + "status": 403 + } + }, + "kind": "firewall", + "match_index": 1, + "meta_data": { + "filter": "1ced07e066a34abf8b14f2a99593bc8d", + "type": "customer" + }, + "origin": { + "ray": { + "id": "00" + }, + "response": { + "status": 0 + } + }, + "ray": { + "id": "713d477539b55c29" + }, + "rule": { + "id": "7dc666e026974dab84884c73b3e2afe1" + }, + "source": "firewallrules", + "timestamp": "2022-05-31T05:23:43.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ClientRequestScheme\":\"https\",\"MatchIndex\":1,\"ClientRefererHost\":\"abc.example.com\",\"Source\":\"firewallrules\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\",\"ClientRefererPath\":\"/abc/checkout\",\"Metadata\":{\"filter\":\"1ced07e066a34abf8b14f2a99593bc8d\",\"type\":\"customer\"},\"EdgeResponseStatus\":403,\"ClientRequestProtocol\":\"HTTP/1.1\",\"OriginatorRayID\":\"00\",\"RayID\":\"713d477539b55c29\",\"ClientRequestMethod\":\"GET\",\"ClientIP\":\"175.16.199.0\",\"ClientRequestPath\":\"/abc/checkout\",\"Action\":\"block\",\"Kind\":\"firewall\",\"RuleID\":\"7dc666e026974dab84884c73b3e2afe1\",\"ClientIPClass\":\"searchEngine\",\"ClientASNDescription\":\"CLOUDFLARENET\",\"ClientCountry\":\"us\",\"ClientRefererQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRequestQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"OriginResponseStatus\":0,\"EdgeColoCode\":\"IAD\",\"ClientRefererScheme\":\"referer URL scheme\",\"Datetime\":\"1653974623000000000\",\"ClientRequestHost\":\"xyz.example.com\",\"ClientASN\":15169}", + "type": [ + "info" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 403 + }, + "version": "1.1" + }, + "network": { + "protocol": "http" + }, + "related": { + "hosts": [ + "abc.example.com", + "xyz.example.com" + ], + "ip": [ + "175.16.199.0" + ] + }, + "rule": { + "id": "7dc666e026974dab84884c73b3e2afe1" + }, + "source": { + "as": { + "number": 15169 + }, + "geo": { + "country_iso_code": "us" + }, + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "xyz.example.com", + "path": "/abc/checkout", + "query": "sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Spider" + }, + "name": "Googlebot", + "original": "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", + "os": { + "full": "Android 6.0.1", + "name": "Android", + "version": "6.0.1" + }, + "version": "2.1" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/firewall_event/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/firewall_event/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml index d839e699f9c..965b5b5becd 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/firewall_event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Firewall Event logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.Datetime - type: string - ignore_missing: true - - gsub: - field: json.Datetime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_datetime_to_milli + if: ctx.json?.Datetime != null + source: | + try { + long t; + if (ctx.json.Datetime instanceof String) { + t = Long.parseLong(ctx.json.Datetime); + } else if (ctx.json.Datetime instanceof Number) { + t = (long)(ctx.json.Datetime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Datetime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Datetime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Datetime if: ctx.json?.Datetime != null && ctx.json.Datetime != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/manifest.yml b/packages/cloudflare_logpush/data_stream/firewall_event/manifest.yml index a1e0f5dff5f..664f993a2e4 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/firewall_event/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/firewall_event/sample_event.json b/packages/cloudflare_logpush/data_stream/firewall_event/sample_event.json index 23894d4bf2a..a9b166bb3dd 100644 --- a/packages/cloudflare_logpush/data_stream/firewall_event/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/firewall_event/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-31T05:23:43.000Z", "agent": { - "ephemeral_id": "41c07abb-406e-4e1c-b9ce-214fe0b5263c", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "1adb216f-03d3-41e1-9b8e-a11f61314bde", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "firewall_event": { @@ -74,12 +74,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "block", @@ -88,7 +88,7 @@ "network" ], "dataset": "cloudflare_logpush.firewall_event", - "ingested": "2023-06-12T08:11:03Z", + "ingested": "2023-07-25T07:33:23Z", "kind": "event", "original": "{\"Action\":\"block\",\"ClientASN\":15169,\"ClientASNDescription\":\"CLOUDFLARENET\",\"ClientCountry\":\"us\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"searchEngine\",\"ClientRefererHost\":\"abc.example.com\",\"ClientRefererPath\":\"/abc/checkout\",\"ClientRefererQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRefererScheme\":\"referer URL scheme\",\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestPath\":\"/abc/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRequestScheme\":\"https\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\",\"Datetime\":\"2022-05-31T05:23:43Z\",\"EdgeColoCode\":\"IAD\",\"EdgeResponseStatus\":403,\"Kind\":\"firewall\",\"MatchIndex\":1,\"Metadata\":{\"filter\":\"1ced07e066a34abf8b14f2a99593bc8d\",\"type\":\"customer\"},\"OriginResponseStatus\":0,\"OriginatorRayID\":\"00\",\"RayID\":\"713d477539b55c29\",\"RuleID\":\"7dc666e026974dab84884c73b3e2afe1\",\"Source\":\"firewallrules\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log b/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log index ff72e6cb2e5..6aea9121a09 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log @@ -1 +1,3 @@ -{"ApplicationID":0,"ColoCode":"ORD","ColoID":14,"Datetime":"2023-05-02T22:49:53Z","DeviceID":"083a8354-d56c-11ed-9771-6a842b111aaa","DeviceName":"zt-test-vm1","DstIP":"89.160.20.129","DstPort":443,"Email":"user@test.com","Location":"GCP default","LocationID":"f233bd67-78c7-4050-9aff-ad63cce25732","MatchedCategoryIDs":[7,163],"MatchedCategoryNames":["Photography","Weather"],"Policy":"7bdc7a9c-81d3-4816-8e56-de1acad3dec5","PolicyID":"1412","Protocol":"https","QueryCategoryIDs":[26,155],"QueryCategoryNames":["Technology","Technology"],"QueryName":"security.ubuntu.com","QueryNameReversed":"com.ubuntu.security","QuerySize":48,"QueryType":1,"QueryTypeName":"A","RCode":0,"RData":[{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic="},{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ="},{"type":"1","data":"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc="}],"ResolvedIPs":["67.43.156.1","67.43.156.2","67.43.156.3"],"ResolverDecision":"allowedOnNoPolicyMatch","SrcIP":"67.43.156.2","SrcPort":0,"TimeZone":"UTC","TimeZoneInferredMethod":"fromLocalTime","UserID":"166befbb-00e3-5e20-bd6e-27245000000"} \ No newline at end of file +{"ApplicationID":0,"ColoCode":"ORD","ColoID":14,"Datetime":"2023-05-02T22:49:53Z","DeviceID":"083a8354-d56c-11ed-9771-6a842b111aaa","DeviceName":"zt-test-vm1","DstIP":"89.160.20.129","DstPort":443,"Email":"user@test.com","Location":"GCP default","LocationID":"f233bd67-78c7-4050-9aff-ad63cce25732","MatchedCategoryIDs":[7,163],"MatchedCategoryNames":["Photography","Weather"],"Policy":"7bdc7a9c-81d3-4816-8e56-de1acad3dec5","PolicyID":"1412","Protocol":"https","QueryCategoryIDs":[26,155],"QueryCategoryNames":["Technology","Technology"],"QueryName":"security.ubuntu.com","QueryNameReversed":"com.ubuntu.security","QuerySize":48,"QueryType":1,"QueryTypeName":"A","RCode":0,"RData":[{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic="},{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ="},{"type":"1","data":"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc="}],"ResolvedIPs":["67.43.156.1","67.43.156.2","67.43.156.3"],"ResolverDecision":"allowedOnNoPolicyMatch","SrcIP":"67.43.156.2","SrcPort":0,"TimeZone":"UTC","TimeZoneInferredMethod":"fromLocalTime","UserID":"166befbb-00e3-5e20-bd6e-27245000000"} +{"ApplicationID":0,"ColoCode":"ORD","ColoID":14,"Datetime":"1683067793","DeviceID":"083a8354-d56c-11ed-9771-6a842b111aaa","DeviceName":"zt-test-vm1","DstIP":"89.160.20.129","DstPort":443,"Email":"user@test.com","Location":"GCP default","LocationID":"f233bd67-78c7-4050-9aff-ad63cce25732","MatchedCategoryIDs":[7,163],"MatchedCategoryNames":["Photography","Weather"],"Policy":"7bdc7a9c-81d3-4816-8e56-de1acad3dec5","PolicyID":"1412","Protocol":"https","QueryCategoryIDs":[26,155],"QueryCategoryNames":["Technology","Technology"],"QueryName":"security.ubuntu.com","QueryNameReversed":"com.ubuntu.security","QuerySize":48,"QueryType":1,"QueryTypeName":"A","RCode":0,"RData":[{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic="},{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ="},{"type":"1","data":"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc="}],"ResolvedIPs":["67.43.156.1","67.43.156.2","67.43.156.3"],"ResolverDecision":"allowedOnNoPolicyMatch","SrcIP":"67.43.156.2","SrcPort":0,"TimeZone":"UTC","TimeZoneInferredMethod":"fromLocalTime","UserID":"166befbb-00e3-5e20-bd6e-27245000000"} +{"ApplicationID":0,"ColoCode":"ORD","ColoID":14,"Datetime":"1683067793000000000","DeviceID":"083a8354-d56c-11ed-9771-6a842b111aaa","DeviceName":"zt-test-vm1","DstIP":"89.160.20.129","DstPort":443,"Email":"user@test.com","Location":"GCP default","LocationID":"f233bd67-78c7-4050-9aff-ad63cce25732","MatchedCategoryIDs":[7,163],"MatchedCategoryNames":["Photography","Weather"],"Policy":"7bdc7a9c-81d3-4816-8e56-de1acad3dec5","PolicyID":"1412","Protocol":"https","QueryCategoryIDs":[26,155],"QueryCategoryNames":["Technology","Technology"],"QueryName":"security.ubuntu.com","QueryNameReversed":"com.ubuntu.security","QuerySize":48,"QueryType":1,"QueryTypeName":"A","RCode":0,"RData":[{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic="},{"type":"1","data":"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ="},{"type":"1","data":"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc="}],"ResolvedIPs":["67.43.156.1","67.43.156.2","67.43.156.3"],"ResolverDecision":"allowedOnNoPolicyMatch","SrcIP":"67.43.156.2","SrcPort":0,"TimeZone":"UTC","TimeZoneInferredMethod":"fromLocalTime","UserID":"166befbb-00e3-5e20-bd6e-27245000000"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log-expected.json b/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log-expected.json index e7a46dfa84f..2c480e309c2 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/_dev/test/pipeline/test-pipeline-gateway-dns.log-expected.json @@ -138,7 +138,7 @@ "response_code": "0" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "category": [ @@ -197,6 +197,402 @@ "email": "user@test.com", "id": "166befbb-00e3-5e20-bd6e-27245000000" } + }, + { + "@timestamp": "2023-05-02T22:49:53.000Z", + "cloudflare_logpush": { + "gateway_dns": { + "answers": [ + { + "data": "CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=", + "type": "1" + }, + { + "data": "CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=", + "type": "1" + }, + { + "data": "CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=", + "type": "1" + } + ], + "application_id": 0, + "colo": { + "code": "ORD", + "id": 14 + }, + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b111aaa", + "name": "zt-test-vm1" + }, + "location": { + "id": "f233bd67-78c7-4050-9aff-ad63cce25732", + "name": "GCP default" + }, + "matched": { + "category": { + "ids": [ + 7, + 163 + ], + "names": [ + "Photography", + "Weather" + ] + } + }, + "policy": { + "id": "1412", + "name": "7bdc7a9c-81d3-4816-8e56-de1acad3dec5" + }, + "protocol": "https", + "question": { + "category": { + "ids": [ + 26, + 155 + ], + "names": [ + "Technology", + "Technology" + ] + }, + "name": "security.ubuntu.com", + "reversed": "com.ubuntu.security", + "size": 48, + "type": "A", + "type_id": 1 + }, + "resolved_ip": [ + "67.43.156.1", + "67.43.156.2", + "67.43.156.3" + ], + "resolver_decision": "allowedOnNoPolicyMatch", + "response_code": "0", + "source": { + "ip": "67.43.156.2", + "port": 0 + }, + "timestamp": "2023-05-02T22:49:53.000Z", + "timezone": "UTC", + "timezone_inferred_method": "fromLocalTime", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245000000" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "dns": { + "answers": [ + { + "data": "CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=", + "type": "1" + }, + { + "data": "CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=", + "type": "1" + }, + { + "data": "CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=", + "type": "1" + } + ], + "question": { + "name": "security.ubuntu.com", + "type": "A" + }, + "resolved_ip": [ + "67.43.156.1", + "67.43.156.2", + "67.43.156.3" + ], + "response_code": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ApplicationID\":0,\"ColoCode\":\"ORD\",\"ColoID\":14,\"Datetime\":\"1683067793\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b111aaa\",\"DeviceName\":\"zt-test-vm1\",\"DstIP\":\"89.160.20.129\",\"DstPort\":443,\"Email\":\"user@test.com\",\"Location\":\"GCP default\",\"LocationID\":\"f233bd67-78c7-4050-9aff-ad63cce25732\",\"MatchedCategoryIDs\":[7,163],\"MatchedCategoryNames\":[\"Photography\",\"Weather\"],\"Policy\":\"7bdc7a9c-81d3-4816-8e56-de1acad3dec5\",\"PolicyID\":\"1412\",\"Protocol\":\"https\",\"QueryCategoryIDs\":[26,155],\"QueryCategoryNames\":[\"Technology\",\"Technology\"],\"QueryName\":\"security.ubuntu.com\",\"QueryNameReversed\":\"com.ubuntu.security\",\"QuerySize\":48,\"QueryType\":1,\"QueryTypeName\":\"A\",\"RCode\":0,\"RData\":[{\"type\":\"1\",\"data\":\"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=\"},{\"type\":\"1\",\"data\":\"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=\"},{\"type\":\"1\",\"data\":\"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=\"}],\"ResolvedIPs\":[\"67.43.156.1\",\"67.43.156.2\",\"67.43.156.3\"],\"ResolverDecision\":\"allowedOnNoPolicyMatch\",\"SrcIP\":\"67.43.156.2\",\"SrcPort\":0,\"TimeZone\":\"UTC\",\"TimeZoneInferredMethod\":\"fromLocalTime\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245000000\"}", + "outcome": "success", + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b111aaa", + "name": "zt-test-vm1" + }, + "network": { + "protocol": "https" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b111aaa", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245000000", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 0 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245000000" + } + }, + { + "@timestamp": "2023-05-02T22:49:53.000Z", + "cloudflare_logpush": { + "gateway_dns": { + "answers": [ + { + "data": "CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=", + "type": "1" + }, + { + "data": "CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=", + "type": "1" + }, + { + "data": "CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=", + "type": "1" + } + ], + "application_id": 0, + "colo": { + "code": "ORD", + "id": 14 + }, + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b111aaa", + "name": "zt-test-vm1" + }, + "location": { + "id": "f233bd67-78c7-4050-9aff-ad63cce25732", + "name": "GCP default" + }, + "matched": { + "category": { + "ids": [ + 7, + 163 + ], + "names": [ + "Photography", + "Weather" + ] + } + }, + "policy": { + "id": "1412", + "name": "7bdc7a9c-81d3-4816-8e56-de1acad3dec5" + }, + "protocol": "https", + "question": { + "category": { + "ids": [ + 26, + 155 + ], + "names": [ + "Technology", + "Technology" + ] + }, + "name": "security.ubuntu.com", + "reversed": "com.ubuntu.security", + "size": 48, + "type": "A", + "type_id": 1 + }, + "resolved_ip": [ + "67.43.156.1", + "67.43.156.2", + "67.43.156.3" + ], + "resolver_decision": "allowedOnNoPolicyMatch", + "response_code": "0", + "source": { + "ip": "67.43.156.2", + "port": 0 + }, + "timestamp": "2023-05-02T22:49:53.000Z", + "timezone": "UTC", + "timezone_inferred_method": "fromLocalTime", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245000000" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "dns": { + "answers": [ + { + "data": "CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=", + "type": "1" + }, + { + "data": "CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=", + "type": "1" + }, + { + "data": "CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=", + "type": "1" + } + ], + "question": { + "name": "security.ubuntu.com", + "type": "A" + }, + "resolved_ip": [ + "67.43.156.1", + "67.43.156.2", + "67.43.156.3" + ], + "response_code": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ApplicationID\":0,\"ColoCode\":\"ORD\",\"ColoID\":14,\"Datetime\":\"1683067793000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b111aaa\",\"DeviceName\":\"zt-test-vm1\",\"DstIP\":\"89.160.20.129\",\"DstPort\":443,\"Email\":\"user@test.com\",\"Location\":\"GCP default\",\"LocationID\":\"f233bd67-78c7-4050-9aff-ad63cce25732\",\"MatchedCategoryIDs\":[7,163],\"MatchedCategoryNames\":[\"Photography\",\"Weather\"],\"Policy\":\"7bdc7a9c-81d3-4816-8e56-de1acad3dec5\",\"PolicyID\":\"1412\",\"Protocol\":\"https\",\"QueryCategoryIDs\":[26,155],\"QueryCategoryNames\":[\"Technology\",\"Technology\"],\"QueryName\":\"security.ubuntu.com\",\"QueryNameReversed\":\"com.ubuntu.security\",\"QuerySize\":48,\"QueryType\":1,\"QueryTypeName\":\"A\",\"RCode\":0,\"RData\":[{\"type\":\"1\",\"data\":\"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=\"},{\"type\":\"1\",\"data\":\"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=\"},{\"type\":\"1\",\"data\":\"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=\"}],\"ResolvedIPs\":[\"67.43.156.1\",\"67.43.156.2\",\"67.43.156.3\"],\"ResolverDecision\":\"allowedOnNoPolicyMatch\",\"SrcIP\":\"67.43.156.2\",\"SrcPort\":0,\"TimeZone\":\"UTC\",\"TimeZoneInferredMethod\":\"fromLocalTime\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245000000\"}", + "outcome": "success", + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b111aaa", + "name": "zt-test-vm1" + }, + "network": { + "protocol": "https" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b111aaa", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245000000", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 0 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245000000" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/gateway_dns/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/gateway_dns/elasticsearch/ingest_pipeline/default.yml index f521b8f21d1..aa0c7820d08 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Gateway DNS logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: field: event.type value: [info] # ECS fields - - convert: - field: json.Datetime - type: string - ignore_missing: true - - gsub: - field: json.Datetime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_datetime_to_milli + if: ctx.json?.Datetime != null + source: | + try { + long t; + if (ctx.json.Datetime instanceof String) { + t = Long.parseLong(ctx.json.Datetime); + } else if (ctx.json.Datetime instanceof Number) { + t = (long)(ctx.json.Datetime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Datetime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Datetime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Datetime if: ctx.json?.Datetime != null && ctx.json.Datetime != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/manifest.yml b/packages/cloudflare_logpush/data_stream/gateway_dns/manifest.yml index b6dbcb23dc6..9297390a9d2 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/gateway_dns/sample_event.json b/packages/cloudflare_logpush/data_stream/gateway_dns/sample_event.json index f590b42d2b6..a0c5b1eb513 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_dns/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/gateway_dns/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-02T22:49:53.000Z", "agent": { - "ephemeral_id": "b551b024-376c-424e-b6ad-f6143e24589d", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "c151dcfc-4b1f-44f0-927b-78e6cb7ee7b7", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_dns": { @@ -148,12 +148,12 @@ "response_code": "0" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -161,7 +161,7 @@ "network" ], "dataset": "cloudflare_logpush.gateway_dns", - "ingested": "2023-06-12T08:11:41Z", + "ingested": "2023-07-25T07:34:12Z", "kind": "event", "original": "{\"ApplicationID\":0,\"ColoCode\":\"ORD\",\"ColoID\":14,\"Datetime\":\"2023-05-02T22:49:53Z\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b111aaa\",\"DeviceName\":\"zt-test-vm1\",\"DstIP\":\"89.160.20.129\",\"DstPort\":443,\"Email\":\"user@test.com\",\"Location\":\"GCP default\",\"LocationID\":\"f233bd67-78c7-4050-9aff-ad63cce25732\",\"MatchedCategoryIDs\":[7,163],\"MatchedCategoryNames\":[\"Photography\",\"Weather\"],\"Policy\":\"7bdc7a9c-81d3-4816-8e56-de1acad3dec5\",\"PolicyID\":\"1412\",\"Protocol\":\"https\",\"QueryCategoryIDs\":[26,155],\"QueryCategoryNames\":[\"Technology\",\"Technology\"],\"QueryName\":\"security.ubuntu.com\",\"QueryNameReversed\":\"com.ubuntu.security\",\"QuerySize\":48,\"QueryType\":1,\"QueryTypeName\":\"A\",\"RCode\":0,\"RData\":[{\"data\":\"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=\",\"type\":\"1\"},{\"data\":\"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=\",\"type\":\"1\"},{\"data\":\"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=\",\"type\":\"1\"}],\"ResolvedIPs\":[\"67.43.156.1\",\"67.43.156.2\",\"67.43.156.3\"],\"ResolverDecision\":\"allowedOnNoPolicyMatch\",\"SrcIP\":\"67.43.156.2\",\"SrcPort\":0,\"TimeZone\":\"UTC\",\"TimeZoneInferredMethod\":\"fromLocalTime\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245000000\"}", "outcome": "success", diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log b/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log index 3e8de98efc6..711365b5d65 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log +++ b/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log @@ -1 +1,3 @@ -{"AccountID":"e1836771179f98aabb828da5ea69a348","Action":"block","BlockedFileHash":"91dc1db739a705105e1c763bfdbdaa84c0de8","BlockedFileName":"downloaded_test","BlockedFileReason":"malware","BlockedFileSize":43,"BlockedFileType":"bin","Datetime":"2023-05-03T20:55:05Z","DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","DownloadedFileNames":["downloaded_file","downloaded_test"],"Email":"user@example.com","FileInfo":{"files":[{"name":"downloaded_file","size":43},{"name":"downloaded_test","size":341}]},"HTTPHost":"guce.yahoo.com","HTTPMethod":"GET","HTTPStatusCode":302,"HTTPVersion":"HTTP/2","IsIsolated":false,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"Block Yahoo","Referer":"https://www.example.com/","RequestID":"1884fec9b600007fb06a299400000001","SourceInternalIP":"192.168.1.123","SourceIP":"67.43.156.2","SourcePort":47924,"UntrustedCertificateAction":"none","UploadedFileNames":["uploaded_file","uploaded_test"],"URL":"https://test.com","UserAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} \ No newline at end of file +{"AccountID":"e1836771179f98aabb828da5ea69a348","Action":"block","BlockedFileHash":"91dc1db739a705105e1c763bfdbdaa84c0de8","BlockedFileName":"downloaded_test","BlockedFileReason":"malware","BlockedFileSize":43,"BlockedFileType":"bin","Datetime":"2023-05-03T20:55:05Z","DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","DownloadedFileNames":["downloaded_file","downloaded_test"],"Email":"user@example.com","FileInfo":{"files":[{"name":"downloaded_file","size":43},{"name":"downloaded_test","size":341}]},"HTTPHost":"guce.yahoo.com","HTTPMethod":"GET","HTTPStatusCode":302,"HTTPVersion":"HTTP/2","IsIsolated":false,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"Block Yahoo","Referer":"https://www.example.com/","RequestID":"1884fec9b600007fb06a299400000001","SourceInternalIP":"192.168.1.123","SourceIP":"67.43.156.2","SourcePort":47924,"UntrustedCertificateAction":"none","UploadedFileNames":["uploaded_file","uploaded_test"],"URL":"https://test.com","UserAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} +{"AccountID":"e1836771179f98aabb828da5ea69a348","Action":"block","BlockedFileHash":"91dc1db739a705105e1c763bfdbdaa84c0de8","BlockedFileName":"downloaded_test","BlockedFileReason":"malware","BlockedFileSize":43,"BlockedFileType":"bin","Datetime":"1683147305","DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","DownloadedFileNames":["downloaded_file","downloaded_test"],"Email":"user@example.com","FileInfo":{"files":[{"name":"downloaded_file","size":43},{"name":"downloaded_test","size":341}]},"HTTPHost":"guce.yahoo.com","HTTPMethod":"GET","HTTPStatusCode":302,"HTTPVersion":"HTTP/2","IsIsolated":false,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"Block Yahoo","Referer":"https://www.example.com/","RequestID":"1884fec9b600007fb06a299400000001","SourceInternalIP":"192.168.1.123","SourceIP":"67.43.156.2","SourcePort":47924,"UntrustedCertificateAction":"none","UploadedFileNames":["uploaded_file","uploaded_test"],"URL":"https://test.com","UserAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} +{"AccountID":"e1836771179f98aabb828da5ea69a348","Action":"block","BlockedFileHash":"91dc1db739a705105e1c763bfdbdaa84c0de8","BlockedFileName":"downloaded_test","BlockedFileReason":"malware","BlockedFileSize":43,"BlockedFileType":"bin","Datetime":"1683147305000000000","DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","DownloadedFileNames":["downloaded_file","downloaded_test"],"Email":"user@example.com","FileInfo":{"files":[{"name":"downloaded_file","size":43},{"name":"downloaded_test","size":341}]},"HTTPHost":"guce.yahoo.com","HTTPMethod":"GET","HTTPStatusCode":302,"HTTPVersion":"HTTP/2","IsIsolated":false,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"Block Yahoo","Referer":"https://www.example.com/","RequestID":"1884fec9b600007fb06a299400000001","SourceInternalIP":"192.168.1.123","SourceIP":"67.43.156.2","SourcePort":47924,"UntrustedCertificateAction":"none","UploadedFileNames":["uploaded_file","uploaded_test"],"URL":"https://test.com","UserAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log-expected.json b/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log-expected.json index 0ad5a111c61..c3ab60e6680 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/gateway_http/_dev/test/pipeline/test-pipeline-gateway-http.log-expected.json @@ -94,7 +94,7 @@ "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -168,6 +168,344 @@ "user_agent": { "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0" } + }, + { + "@timestamp": "2023-05-03T20:55:05.000Z", + "cloudflare_logpush": { + "gateway_http": { + "account_id": "e1836771179f98aabb828da5ea69a348", + "action": "block", + "blocked_file": { + "hash": "91dc1db739a705105e1c763bfdbdaa84c0de8", + "name": "downloaded_test", + "reason": "malware", + "size": 43, + "type": "bin" + }, + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "downloaded_files": [ + "downloaded_file", + "downloaded_test" + ], + "file_info": { + "files": [ + { + "name": "downloaded_file", + "size": 43 + }, + { + "name": "downloaded_test", + "size": 341 + } + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "isolated": false, + "policy": { + "id": "85063bec-74cb-4546-85a3-e0cde2cdfda2", + "name": "Block Yahoo" + }, + "request": { + "host": "guce.yahoo.com", + "method": "GET", + "referrer": "https://www.example.com/", + "version": "HTTP/2" + }, + "request_id": "1884fec9b600007fb06a299400000001", + "response": { + "status_code": 302 + }, + "source": { + "internal_ip": "192.168.1.123", + "ip": "67.43.156.2", + "port": 47924 + }, + "timestamp": "2023-05-03T20:55:05.000Z", + "untrusted_certificate_action": "none", + "uploaded_files": [ + "uploaded_file", + "uploaded_test" + ], + "url": "https://test.com", + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0" + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a348\",\"Action\":\"block\",\"BlockedFileHash\":\"91dc1db739a705105e1c763bfdbdaa84c0de8\",\"BlockedFileName\":\"downloaded_test\",\"BlockedFileReason\":\"malware\",\"BlockedFileSize\":43,\"BlockedFileType\":\"bin\",\"Datetime\":\"1683147305\",\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"DownloadedFileNames\":[\"downloaded_file\",\"downloaded_test\"],\"Email\":\"user@example.com\",\"FileInfo\":{\"files\":[{\"name\":\"downloaded_file\",\"size\":43},{\"name\":\"downloaded_test\",\"size\":341}]},\"HTTPHost\":\"guce.yahoo.com\",\"HTTPMethod\":\"GET\",\"HTTPStatusCode\":302,\"HTTPVersion\":\"HTTP/2\",\"IsIsolated\":false,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"Block Yahoo\",\"Referer\":\"https://www.example.com/\",\"RequestID\":\"1884fec9b600007fb06a299400000001\",\"SourceInternalIP\":\"192.168.1.123\",\"SourceIP\":\"67.43.156.2\",\"SourcePort\":47924,\"UntrustedCertificateAction\":\"none\",\"UploadedFileNames\":[\"uploaded_file\",\"uploaded_test\"],\"URL\":\"https://test.com\",\"UserAgent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", + "type": [ + "info", + "denied" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "http": { + "request": { + "method": "GET", + "referrer": "https://www.example.com/" + }, + "response": { + "status_code": 302 + }, + "version": "HTTP/2" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@example.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 47924 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "test.com", + "original": "https://test.com", + "scheme": "https" + }, + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0" + } + }, + { + "@timestamp": "2023-05-03T20:55:05.000Z", + "cloudflare_logpush": { + "gateway_http": { + "account_id": "e1836771179f98aabb828da5ea69a348", + "action": "block", + "blocked_file": { + "hash": "91dc1db739a705105e1c763bfdbdaa84c0de8", + "name": "downloaded_test", + "reason": "malware", + "size": 43, + "type": "bin" + }, + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "downloaded_files": [ + "downloaded_file", + "downloaded_test" + ], + "file_info": { + "files": [ + { + "name": "downloaded_file", + "size": 43 + }, + { + "name": "downloaded_test", + "size": 341 + } + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "isolated": false, + "policy": { + "id": "85063bec-74cb-4546-85a3-e0cde2cdfda2", + "name": "Block Yahoo" + }, + "request": { + "host": "guce.yahoo.com", + "method": "GET", + "referrer": "https://www.example.com/", + "version": "HTTP/2" + }, + "request_id": "1884fec9b600007fb06a299400000001", + "response": { + "status_code": 302 + }, + "source": { + "internal_ip": "192.168.1.123", + "ip": "67.43.156.2", + "port": 47924 + }, + "timestamp": "2023-05-03T20:55:05.000Z", + "untrusted_certificate_action": "none", + "uploaded_files": [ + "uploaded_file", + "uploaded_test" + ], + "url": "https://test.com", + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "user_agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0" + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a348\",\"Action\":\"block\",\"BlockedFileHash\":\"91dc1db739a705105e1c763bfdbdaa84c0de8\",\"BlockedFileName\":\"downloaded_test\",\"BlockedFileReason\":\"malware\",\"BlockedFileSize\":43,\"BlockedFileType\":\"bin\",\"Datetime\":\"1683147305000000000\",\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"DownloadedFileNames\":[\"downloaded_file\",\"downloaded_test\"],\"Email\":\"user@example.com\",\"FileInfo\":{\"files\":[{\"name\":\"downloaded_file\",\"size\":43},{\"name\":\"downloaded_test\",\"size\":341}]},\"HTTPHost\":\"guce.yahoo.com\",\"HTTPMethod\":\"GET\",\"HTTPStatusCode\":302,\"HTTPVersion\":\"HTTP/2\",\"IsIsolated\":false,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"Block Yahoo\",\"Referer\":\"https://www.example.com/\",\"RequestID\":\"1884fec9b600007fb06a299400000001\",\"SourceInternalIP\":\"192.168.1.123\",\"SourceIP\":\"67.43.156.2\",\"SourcePort\":47924,\"UntrustedCertificateAction\":\"none\",\"UploadedFileNames\":[\"uploaded_file\",\"uploaded_test\"],\"URL\":\"https://test.com\",\"UserAgent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", + "type": [ + "info", + "denied" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "http": { + "request": { + "method": "GET", + "referrer": "https://www.example.com/" + }, + "response": { + "status_code": 302 + }, + "version": "HTTP/2" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@example.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 47924 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "test.com", + "original": "https://test.com", + "scheme": "https" + }, + "user": { + "email": "user@example.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "user_agent": { + "original": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/gateway_http/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/gateway_http/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/gateway_http/elasticsearch/ingest_pipeline/default.yml index 2e0cf7e93dd..7e8ab64104b 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_http/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Gateway HTTP logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -36,22 +36,32 @@ processors: field: event.kind value: event # ECS fields - - convert: - field: json.Datetime - type: string - ignore_missing: true - - gsub: - field: json.Datetime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_datetime_to_milli + if: ctx.json?.Datetime != null + source: | + try { + long t; + if (ctx.json.Datetime instanceof String) { + t = Long.parseLong(ctx.json.Datetime); + } else if (ctx.json.Datetime instanceof Number) { + t = (long)(ctx.json.Datetime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Datetime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Datetime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Datetime if: ctx.json?.Datetime != null && ctx.json.Datetime != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/manifest.yml b/packages/cloudflare_logpush/data_stream/gateway_http/manifest.yml index fae618a905b..1616b698c4d 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_http/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/gateway_http/sample_event.json b/packages/cloudflare_logpush/data_stream/gateway_http/sample_event.json index 86d51398761..774ccbba2d0 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_http/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/gateway_http/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-03T20:55:05.000Z", "agent": { - "ephemeral_id": "8ea5d833-9f60-4323-936f-870d4e08dd40", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "3e824634-2a1f-48e2-b897-27806da3c6ad", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_http": { @@ -104,12 +104,12 @@ "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "block", @@ -118,7 +118,7 @@ "network" ], "dataset": "cloudflare_logpush.gateway_http", - "ingested": "2023-06-12T08:12:22Z", + "ingested": "2023-07-25T07:35:00Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a348\",\"Action\":\"block\",\"BlockedFileHash\":\"91dc1db739a705105e1c763bfdbdaa84c0de8\",\"BlockedFileName\":\"downloaded_test\",\"BlockedFileReason\":\"malware\",\"BlockedFileSize\":43,\"BlockedFileType\":\"bin\",\"Datetime\":\"2023-05-03T20:55:05Z\",\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"DownloadedFileNames\":[\"downloaded_file\",\"downloaded_test\"],\"Email\":\"user@example.com\",\"FileInfo\":{\"files\":[{\"name\":\"downloaded_file\",\"size\":43},{\"name\":\"downloaded_test\",\"size\":341}]},\"HTTPHost\":\"guce.yahoo.com\",\"HTTPMethod\":\"GET\",\"HTTPStatusCode\":302,\"HTTPVersion\":\"HTTP/2\",\"IsIsolated\":false,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"Block Yahoo\",\"Referer\":\"https://www.example.com/\",\"RequestID\":\"1884fec9b600007fb06a299400000001\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.123\",\"SourcePort\":47924,\"URL\":\"https://test.com\",\"UntrustedCertificateAction\":\"none\",\"UploadedFileNames\":[\"uploaded_file\",\"uploaded_test\"],\"UserAgent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log b/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log index 62317302895..c1ea4231460 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log +++ b/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log @@ -1 +1,3 @@ +{"AccountID":"e1836771179f98aabb828da5ea69a111","Action":"allowedOnNoRuleMatch","Datetime":"2023-05-19T06:42:57+09:30","DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","Email":"user@test.com","OverrideIP":"175.16.199.4","OverridePort":8080,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"My policy","SNI":"www.elastic.co","SessionID":"5f2d04be-3512-11e8-b467-0ed5f89f718b","SourceIP":"67.43.156.2","SourceInternalIP":"192.168.1.3","SourcePort":47924,"Transport":"tcp","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} +{"AccountID":"e1836771179f98aabb828da5ea69a111","Action":"allowedOnNoRuleMatch","Datetime":1684444377,"DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","Email":"user@test.com","OverrideIP":"175.16.199.4","OverridePort":8080,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"My policy","SNI":"www.elastic.co","SessionID":"5f2d04be-3512-11e8-b467-0ed5f89f718b","SourceIP":"67.43.156.2","SourceInternalIP":"192.168.1.3","SourcePort":47924,"Transport":"tcp","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} {"AccountID":"e1836771179f98aabb828da5ea69a111","Action":"allowedOnNoRuleMatch","Datetime":1684444377058000000,"DestinationIP":"89.160.20.129","DestinationPort":443,"DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","Email":"user@test.com","OverrideIP":"175.16.199.4","OverridePort":8080,"PolicyID":"85063bec-74cb-4546-85a3-e0cde2cdfda2","PolicyName":"My policy","SNI":"www.elastic.co","SessionID":"5f2d04be-3512-11e8-b467-0ed5f89f718b","SourceIP":"67.43.156.2","SourceInternalIP":"192.168.1.3","SourcePort":47924,"Transport":"tcp","UserID":"166befbb-00e3-5e20-bd6e-27245723949f"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log-expected.json b/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log-expected.json index f5fa2f1bc29..d4e72c1eba3 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/gateway_network/_dev/test/pipeline/test-pipeline-gateway-network.log-expected.json @@ -1,5 +1,261 @@ { "expected": [ + { + "@timestamp": "2023-05-18T21:12:57.000Z", + "cloudflare_logpush": { + "gateway_network": { + "account_id": "e1836771179f98aabb828da5ea69a111", + "action": "allowedOnNoRuleMatch", + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "override": { + "ip": "175.16.199.4", + "port": 8080 + }, + "policy": { + "id": "85063bec-74cb-4546-85a3-e0cde2cdfda2", + "name": "My policy" + }, + "session_id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", + "sni": "www.elastic.co", + "source": { + "internal_ip": "192.168.1.3", + "ip": "67.43.156.2", + "port": 47924 + }, + "timestamp": "2023-05-18T21:12:57.000Z", + "transport": "tcp", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "domain": "www.elastic.co", + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allowedOnNoRuleMatch", + "category": [ + "network" + ], + "id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"Action\":\"allowedOnNoRuleMatch\",\"Datetime\":\"2023-05-19T06:42:57+09:30\",\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"Email\":\"user@test.com\",\"OverrideIP\":\"175.16.199.4\",\"OverridePort\":8080,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"My policy\",\"SNI\":\"www.elastic.co\",\"SessionID\":\"5f2d04be-3512-11e8-b467-0ed5f89f718b\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.3\",\"SourcePort\":47924,\"Transport\":\"tcp\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "network": { + "transport": "tcp" + }, + "related": { + "hosts": [ + "www.elastic.co", + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129", + "175.16.199.4" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 47924 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "client": { + "server_name": "www.elastic.co" + } + }, + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + } + }, + { + "@timestamp": "2023-05-18T21:12:57.000Z", + "cloudflare_logpush": { + "gateway_network": { + "account_id": "e1836771179f98aabb828da5ea69a111", + "action": "allowedOnNoRuleMatch", + "destination": { + "ip": "89.160.20.129", + "port": 443 + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "override": { + "ip": "175.16.199.4", + "port": 8080 + }, + "policy": { + "id": "85063bec-74cb-4546-85a3-e0cde2cdfda2", + "name": "My policy" + }, + "session_id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", + "sni": "www.elastic.co", + "source": { + "internal_ip": "192.168.1.3", + "ip": "67.43.156.2", + "port": 47924 + }, + "timestamp": "2023-05-18T21:12:57.000Z", + "transport": "tcp", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "domain": "www.elastic.co", + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "allowedOnNoRuleMatch", + "category": [ + "network" + ], + "id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"Action\":\"allowedOnNoRuleMatch\",\"Datetime\":1684444377,\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"Email\":\"user@test.com\",\"OverrideIP\":\"175.16.199.4\",\"OverridePort\":8080,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"My policy\",\"SNI\":\"www.elastic.co\",\"SessionID\":\"5f2d04be-3512-11e8-b467-0ed5f89f718b\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.3\",\"SourcePort\":47924,\"Transport\":\"tcp\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "network": { + "transport": "tcp" + }, + "related": { + "hosts": [ + "www.elastic.co", + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129", + "175.16.199.4" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 47924 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "client": { + "server_name": "www.elastic.co" + } + }, + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + } + }, { "@timestamp": "2023-05-18T21:12:57.058Z", "cloudflare_logpush": { @@ -61,7 +317,7 @@ "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "action": "allowedOnNoRuleMatch", diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/gateway_network/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/gateway_network/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/gateway_network/elasticsearch/ingest_pipeline/default.yml index d6ca554f0c1..04d7ed02bd9 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_network/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Gateway Network logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: field: event.kind value: event # ECS fields - - convert: - field: json.Datetime - type: string - ignore_missing: true - - gsub: - field: json.Datetime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_datetime_to_milli + if: ctx.json?.Datetime != null + source: | + try { + long t; + if (ctx.json.Datetime instanceof String) { + t = Long.parseLong(ctx.json.Datetime); + } else if (ctx.json.Datetime instanceof Number) { + t = (long)(ctx.json.Datetime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Datetime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Datetime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Datetime if: ctx.json?.Datetime != null && ctx.json.Datetime != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/manifest.yml b/packages/cloudflare_logpush/data_stream/gateway_network/manifest.yml index 8c24e5011b2..74fa48e7aee 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/gateway_network/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/gateway_network/sample_event.json b/packages/cloudflare_logpush/data_stream/gateway_network/sample_event.json index 97ae2c6bbf7..5fa2a0d250d 100644 --- a/packages/cloudflare_logpush/data_stream/gateway_network/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/gateway_network/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-18T21:12:57.058Z", "agent": { - "ephemeral_id": "52c5301e-581f-4fea-bd5d-5182ae0e3c20", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "05a8214e-8815-4643-8f29-d9b0525e810a", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_network": { @@ -71,12 +71,12 @@ "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "allowedOnNoRuleMatch", @@ -86,7 +86,7 @@ ], "dataset": "cloudflare_logpush.gateway_network", "id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", - "ingested": "2023-06-12T08:13:05Z", + "ingested": "2023-07-25T07:35:45Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"Action\":\"allowedOnNoRuleMatch\",\"Datetime\":1684444377058000000,\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"Email\":\"user@test.com\",\"OverrideIP\":\"175.16.199.4\",\"OverridePort\":8080,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"My policy\",\"SNI\":\"www.elastic.co\",\"SessionID\":\"5f2d04be-3512-11e8-b467-0ed5f89f718b\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.3\",\"SourcePort\":47924,\"Transport\":\"tcp\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log b/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log index ba0cc8c0385..ef1694cebc7 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log +++ b/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log @@ -1,2 +1,4 @@ {"BotScore":"20","BotScoreSrc":"Verified Bot","BotTags":"bing","CacheCacheStatus":"dynamic","CacheResponseBytes":983828,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":43766,"ClientCountry":"sa","ClientDeviceType":"desktop","ClientIP":"175.16.199.0","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"Fingerprint","ClientMTLSAuthStatus":"unknown","ClientRequestBytes":5800,"ClientRequestHost":"xyz.example.com","ClientRequestMethod":"POST","ClientRequestPath":"/xyz/checkout","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))&timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))&timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)","ClientRequestScheme":"https","ClientRequestSource":"edgeWorkerFetch","ClientRequestURI":"/s/example/api/telemetry/v2/clusters/_stats","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36","ClientSrcPort":0,"ClientSSLCipher":"NONE","ClientSSLProtocol":"TLSv1.2","ClientTCPRTTMs":0,"ClientXRequestedWith":"Request With","Cookies":{"key":"value"},"EdgeCFConnectingO2O":false,"EdgeColoCode":"RUH","EdgeColoID":339,"EdgeEndTimestamp":"2022-05-25T13:25:32Z","EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"unknown","EdgeRateLimitID":0,"EdgeRequestHost":"abc.example.com","EdgeResponseBodyBytes":980397,"EdgeResponseBytes":981308,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/json","EdgeResponseStatus":200,"EdgeServerIP":"1.128.0.0","EdgeStartTimestamp":"2022-05-25T13:25:26Z","EdgeTimeToFirstByteMs":5333,"OriginDNSResponseTimeMs":3,"OriginIP":"67.43.156.0","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":5319,"OriginResponseHeaderReceiveDurationMs":5155,"OriginResponseHTTPExpires":"2022-05-27T13:25:26Z","OriginResponseHTTPLastModified":"2022-05-26T13:25:26Z","OriginResponseStatus":200,"OriginResponseTime":5232000000,"OriginSSLProtocol":"TLSv1.2","OriginTCPHandshakeDurationMs":24,"OriginTLSHandshakeDurationMs":53,"ParentRayID":"710e98d93d50357d","RayID":"710e98d9367f357d","SecurityLevel":"off","SmartRouteColoID":20,"UpperTierColoID":0,"WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"example","WAFProfile":"unknown","WAFRuleID":"98d93d5","WAFRuleMessage":"matchad variable message","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":true,"WorkerSubrequestCount":0,"ZoneID":393347122,"ZoneName":"example.com"} {"BotScore":"20","BotScoreSrc":"Verified Bot","BotTags":"bing","CacheCacheStatus":"dynamic","CacheResponseBytes":983828,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":43766,"ClientCountry":"sa","ClientDeviceType":"desktop","ClientIP":"175.16.199.0","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"Fingerprint","ClientMTLSAuthStatus":"unknown","ClientRequestBytes":5800,"ClientRequestHost":"xyz.example.com","ClientRequestMethod":"POST","ClientRequestPath":"/xyz/checkout","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))&timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))&timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)","ClientRequestScheme":"https","ClientRequestSource":"edgeWorkerFetch","ClientRequestURI":"/s/example/api/telemetry/v2/clusters/_stats","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36","ClientSrcPort":0,"ClientSSLCipher":"NONE","ClientSSLProtocol":"TLSv1.2","ClientTCPRTTMs":0,"ClientXRequestedWith":"Request With","Cookies":{"key":"value"},"EdgeCFConnectingO2O":false,"EdgeColoCode":"RUH","EdgeColoID":339,"EdgeEndTimestamp":"2022-05-25T13:25:32Z","EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"unknown","EdgeRateLimitID":0,"EdgeRequestHost":"abc.example.com","EdgeResponseBodyBytes":980397,"EdgeResponseBytes":981308,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/json","EdgeResponseStatus":200,"EdgeServerIP":"1.128.0.0","EdgeStartTimestamp":"2022-05-25T13:25:26Z","EdgeTimeToFirstByteMs":5333,"OriginDNSResponseTimeMs":3,"OriginIP":"67.43.156.0","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":5319,"OriginResponseHeaderReceiveDurationMs":5155,"OriginResponseHTTPExpires":"Thu, 21 May 2022 11:17:33 UTC","OriginResponseHTTPLastModified":"Thu, 19 May 2022 11:17:33 UTC","OriginResponseStatus":200,"OriginResponseTime":5232000000,"OriginSSLProtocol":"TLSv1.2","OriginTCPHandshakeDurationMs":24,"OriginTLSHandshakeDurationMs":53,"ParentRayID":"710e98d93d50357d","RayID":"710e98d9367f357d","SecurityLevel":"off","SmartRouteColoID":20,"UpperTierColoID":0,"WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"example","WAFProfile":"unknown","WAFRuleID":"98d93d5","WAFRuleMessage":"matchad variable message","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":true,"WorkerSubrequestCount":0,"ZoneID":393347122,"ZoneName":"example.com"} +{"BotScore":"20","BotScoreSrc":"Verified Bot","BotTags":"bing","CacheCacheStatus":"dynamic","CacheResponseBytes":983828,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":43766,"ClientCountry":"sa","ClientDeviceType":"desktop","ClientIP":"175.16.199.0","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"Fingerprint","ClientMTLSAuthStatus":"unknown","ClientRequestBytes":5800,"ClientRequestHost":"xyz.example.com","ClientRequestMethod":"POST","ClientRequestPath":"/xyz/checkout","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))&timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))&timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)","ClientRequestScheme":"https","ClientRequestSource":"edgeWorkerFetch","ClientRequestURI":"/s/example/api/telemetry/v2/clusters/_stats","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36","ClientSrcPort":0,"ClientSSLCipher":"NONE","ClientSSLProtocol":"TLSv1.2","ClientTCPRTTMs":0,"ClientXRequestedWith":"Request With","Cookies":{"key":"value"},"EdgeCFConnectingO2O":false,"EdgeColoCode":"RUH","EdgeColoID":339,"EdgeEndTimestamp":"1653485132","EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"unknown","EdgeRateLimitID":0,"EdgeRequestHost":"abc.example.com","EdgeResponseBodyBytes":980397,"EdgeResponseBytes":981308,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/json","EdgeResponseStatus":200,"EdgeServerIP":"1.128.0.0","EdgeStartTimestamp":"1653485126","EdgeTimeToFirstByteMs":5333,"OriginDNSResponseTimeMs":3,"OriginIP":"67.43.156.0","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":5319,"OriginResponseHeaderReceiveDurationMs":5155,"OriginResponseHTTPExpires":"Thu, 21 May 2022 11:17:33 UTC","OriginResponseHTTPLastModified":"Thu, 19 May 2022 11:17:33 UTC","OriginResponseStatus":200,"OriginResponseTime":5232000000,"OriginSSLProtocol":"TLSv1.2","OriginTCPHandshakeDurationMs":24,"OriginTLSHandshakeDurationMs":53,"ParentRayID":"710e98d93d50357d","RayID":"710e98d9367f357d","SecurityLevel":"off","SmartRouteColoID":20,"UpperTierColoID":0,"WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"example","WAFProfile":"unknown","WAFRuleID":"98d93d5","WAFRuleMessage":"matchad variable message","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":true,"WorkerSubrequestCount":0,"ZoneID":393347122,"ZoneName":"example.com"} +{"BotScore":"20","BotScoreSrc":"Verified Bot","BotTags":"bing","CacheCacheStatus":"dynamic","CacheResponseBytes":983828,"CacheResponseStatus":200,"CacheTieredFill":false,"ClientASN":43766,"ClientCountry":"sa","ClientDeviceType":"desktop","ClientIP":"175.16.199.0","ClientIPClass":"noRecord","ClientMTLSAuthCertFingerprint":"Fingerprint","ClientMTLSAuthStatus":"unknown","ClientRequestBytes":5800,"ClientRequestHost":"xyz.example.com","ClientRequestMethod":"POST","ClientRequestPath":"/xyz/checkout","ClientRequestProtocol":"HTTP/1.1","ClientRequestReferer":"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))&timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))&timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)","ClientRequestScheme":"https","ClientRequestSource":"edgeWorkerFetch","ClientRequestURI":"/s/example/api/telemetry/v2/clusters/_stats","ClientRequestUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36","ClientSrcPort":0,"ClientSSLCipher":"NONE","ClientSSLProtocol":"TLSv1.2","ClientTCPRTTMs":0,"ClientXRequestedWith":"Request With","Cookies":{"key":"value"},"EdgeCFConnectingO2O":false,"EdgeColoCode":"RUH","EdgeColoID":339,"EdgeEndTimestamp":"1653485132000000000","EdgePathingOp":"wl","EdgePathingSrc":"macro","EdgePathingStatus":"nr","EdgeRateLimitAction":"unknown","EdgeRateLimitID":0,"EdgeRequestHost":"abc.example.com","EdgeResponseBodyBytes":980397,"EdgeResponseBytes":981308,"EdgeResponseCompressionRatio":0,"EdgeResponseContentType":"application/json","EdgeResponseStatus":200,"EdgeServerIP":"1.128.0.0","EdgeStartTimestamp":"1653485126000000000","EdgeTimeToFirstByteMs":5333,"OriginDNSResponseTimeMs":3,"OriginIP":"67.43.156.0","OriginRequestHeaderSendDurationMs":0,"OriginResponseBytes":0,"OriginResponseDurationMs":5319,"OriginResponseHeaderReceiveDurationMs":5155,"OriginResponseHTTPExpires":"Thu, 21 May 2022 11:17:33 UTC","OriginResponseHTTPLastModified":"Thu, 19 May 2022 11:17:33 UTC","OriginResponseStatus":200,"OriginResponseTime":5232000000,"OriginSSLProtocol":"TLSv1.2","OriginTCPHandshakeDurationMs":24,"OriginTLSHandshakeDurationMs":53,"ParentRayID":"710e98d93d50357d","RayID":"710e98d9367f357d","SecurityLevel":"off","SmartRouteColoID":20,"UpperTierColoID":0,"WAFAction":"unknown","WAFFlags":"0","WAFMatchedVar":"example","WAFProfile":"unknown","WAFRuleID":"98d93d5","WAFRuleMessage":"matchad variable message","WorkerCPUTime":0,"WorkerStatus":"unknown","WorkerSubrequest":true,"WorkerSubrequestCount":0,"ZoneID":393347122,"ZoneName":"example.com"} diff --git a/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log-expected.json b/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log-expected.json index 54c8dd7f6a1..e49cf562b97 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/http_request/_dev/test/pipeline/test-pipeline-http-request.log-expected.json @@ -1,7 +1,7 @@ { "expected": [ { - "@timestamp": "2022-05-25T13:25:26Z", + "@timestamp": "2022-05-25T13:25:26.000Z", "cloudflare_logpush": { "http_request": { "bot": { @@ -174,7 +174,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -243,7 +243,7 @@ } }, { - "@timestamp": "2022-05-25T13:25:26Z", + "@timestamp": "2022-05-25T13:25:26.000Z", "cloudflare_logpush": { "http_request": { "bot": { @@ -416,7 +416,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -483,6 +483,490 @@ }, "version": "51.0.2704.103" } + }, + { + "@timestamp": "2022-05-25T13:25:26.000Z", + "cloudflare_logpush": { + "http_request": { + "bot": { + "score": { + "src": "Verified Bot", + "value": 20 + }, + "tag": "bing" + }, + "cache": { + "response": { + "bytes": 983828, + "status": 200 + }, + "status": "dynamic", + "tiered_fill": false + }, + "client": { + "asn": 43766, + "country": "sa", + "device": { + "type": "desktop" + }, + "ip": "175.16.199.0", + "ip_class": "noRecord", + "mtls": { + "auth": { + "fingerprint": "Fingerprint", + "status": "unknown" + } + }, + "request": { + "bytes": 5800, + "host": "xyz.example.com", + "method": "POST", + "path": "/xyz/checkout", + "protocol": "HTTP/1.1", + "referer": "https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)", + "scheme": "https", + "source": "edgeWorkerFetch", + "uri": "/s/example/api/telemetry/v2/clusters/_stats", + "user": { + "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" + } + }, + "src": { + "port": 0 + }, + "ssl": { + "cipher": "NONE", + "protocol": "TLSv1.2" + }, + "tcp_rtt": { + "ms": 0 + }, + "xrequested_with": "Request With" + }, + "cookies": { + "key": "value" + }, + "edge": { + "cf_connecting_o2o": false, + "colo": { + "code": "RUH", + "id": 339 + }, + "end_time": "2022-05-25T13:25:32.000Z", + "pathing": { + "op": "wl", + "src": "macro", + "status": "nr" + }, + "rate": { + "limit": { + "action": "unknown", + "id": 0 + } + }, + "request": { + "host": "abc.example.com" + }, + "response": { + "body_bytes": 980397, + "bytes": 981308, + "compression_ratio": 0.0, + "content_type": "application/json", + "status": 200 + }, + "server": { + "ip": "1.128.0.0" + }, + "start_time": "2022-05-25T13:25:26.000Z", + "time_to_first_byte": { + "ms": 5333 + } + }, + "origin": { + "dns_response_time": { + "ms": 3 + }, + "ip": "67.43.156.0", + "request_header_send_duration": { + "ms": 0 + }, + "response": { + "bytes": 0, + "duration": { + "ms": 5319 + }, + "header_receive_duration": { + "ms": 5155 + }, + "http": { + "expires": "2022-05-21T11:17:33.000Z", + "last_modified": "2022-05-19T11:17:33.000Z" + }, + "status": 200, + "time": 5232000000 + }, + "ssl_protocol": "TLSv1.2", + "tcp_handshake_duration": { + "ms": 24 + }, + "tls_handshake_duration": { + "ms": 53 + } + }, + "parent_ray": { + "id": "710e98d93d50357d" + }, + "ray": { + "id": "710e98d9367f357d" + }, + "security_level": "off", + "smart_route": { + "colo": { + "id": 20 + } + }, + "upper_tier": { + "colo": { + "id": 0 + } + }, + "waf": { + "action": "unknown", + "flag": "0", + "matched_var": "example", + "profile": "unknown", + "rule": { + "id": "98d93d5", + "message": "matchad variable message" + } + }, + "worker": { + "cpu_time": 0, + "status": "unknown", + "subrequest": { + "count": 0, + "value": true + } + }, + "zone": { + "id": 393347122, + "name": "example.com" + } + } + }, + "destination": { + "ip": "67.43.156.0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"BotScore\":\"20\",\"BotScoreSrc\":\"Verified Bot\",\"BotTags\":\"bing\",\"CacheCacheStatus\":\"dynamic\",\"CacheResponseBytes\":983828,\"CacheResponseStatus\":200,\"CacheTieredFill\":false,\"ClientASN\":43766,\"ClientCountry\":\"sa\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"noRecord\",\"ClientMTLSAuthCertFingerprint\":\"Fingerprint\",\"ClientMTLSAuthStatus\":\"unknown\",\"ClientRequestBytes\":5800,\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/xyz/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)\",\"ClientRequestScheme\":\"https\",\"ClientRequestSource\":\"edgeWorkerFetch\",\"ClientRequestURI\":\"/s/example/api/telemetry/v2/clusters/_stats\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\",\"ClientSrcPort\":0,\"ClientSSLCipher\":\"NONE\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientTCPRTTMs\":0,\"ClientXRequestedWith\":\"Request With\",\"Cookies\":{\"key\":\"value\"},\"EdgeCFConnectingO2O\":false,\"EdgeColoCode\":\"RUH\",\"EdgeColoID\":339,\"EdgeEndTimestamp\":\"1653485132\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"macro\",\"EdgePathingStatus\":\"nr\",\"EdgeRateLimitAction\":\"unknown\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"abc.example.com\",\"EdgeResponseBodyBytes\":980397,\"EdgeResponseBytes\":981308,\"EdgeResponseCompressionRatio\":0,\"EdgeResponseContentType\":\"application/json\",\"EdgeResponseStatus\":200,\"EdgeServerIP\":\"1.128.0.0\",\"EdgeStartTimestamp\":\"1653485126\",\"EdgeTimeToFirstByteMs\":5333,\"OriginDNSResponseTimeMs\":3,\"OriginIP\":\"67.43.156.0\",\"OriginRequestHeaderSendDurationMs\":0,\"OriginResponseBytes\":0,\"OriginResponseDurationMs\":5319,\"OriginResponseHeaderReceiveDurationMs\":5155,\"OriginResponseHTTPExpires\":\"Thu, 21 May 2022 11:17:33 UTC\",\"OriginResponseHTTPLastModified\":\"Thu, 19 May 2022 11:17:33 UTC\",\"OriginResponseStatus\":200,\"OriginResponseTime\":5232000000,\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginTCPHandshakeDurationMs\":24,\"OriginTLSHandshakeDurationMs\":53,\"ParentRayID\":\"710e98d93d50357d\",\"RayID\":\"710e98d9367f357d\",\"SecurityLevel\":\"off\",\"SmartRouteColoID\":20,\"UpperTierColoID\":0,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"example\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"98d93d5\",\"WAFRuleMessage\":\"matchad variable message\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":true,\"WorkerSubrequestCount\":0,\"ZoneID\":393347122,\"ZoneName\":\"example.com\"}", + "type": [ + "info" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "mime_type": "application/json", + "status_code": 200 + }, + "version": "1.1" + }, + "network": { + "protocol": "http" + }, + "related": { + "ip": [ + "175.16.199.0", + "67.43.156.0" + ] + }, + "source": { + "as": { + "number": 43766 + }, + "geo": { + "country_iso_code": "sa" + }, + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "version": "1.2", + "version_protocol": "tls" + }, + "url": { + "domain": "xyz.example.com", + "original": "/s/example/api/telemetry/v2/clusters/_stats", + "path": "/s/example/api/telemetry/v2/clusters/_stats", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36", + "os": { + "full": "Mac OS X 10.10.5", + "name": "Mac OS X", + "version": "10.10.5" + }, + "version": "51.0.2704.103" + } + }, + { + "@timestamp": "2022-05-25T13:25:26.000Z", + "cloudflare_logpush": { + "http_request": { + "bot": { + "score": { + "src": "Verified Bot", + "value": 20 + }, + "tag": "bing" + }, + "cache": { + "response": { + "bytes": 983828, + "status": 200 + }, + "status": "dynamic", + "tiered_fill": false + }, + "client": { + "asn": 43766, + "country": "sa", + "device": { + "type": "desktop" + }, + "ip": "175.16.199.0", + "ip_class": "noRecord", + "mtls": { + "auth": { + "fingerprint": "Fingerprint", + "status": "unknown" + } + }, + "request": { + "bytes": 5800, + "host": "xyz.example.com", + "method": "POST", + "path": "/xyz/checkout", + "protocol": "HTTP/1.1", + "referer": "https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)", + "scheme": "https", + "source": "edgeWorkerFetch", + "uri": "/s/example/api/telemetry/v2/clusters/_stats", + "user": { + "agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36" + } + }, + "src": { + "port": 0 + }, + "ssl": { + "cipher": "NONE", + "protocol": "TLSv1.2" + }, + "tcp_rtt": { + "ms": 0 + }, + "xrequested_with": "Request With" + }, + "cookies": { + "key": "value" + }, + "edge": { + "cf_connecting_o2o": false, + "colo": { + "code": "RUH", + "id": 339 + }, + "end_time": "2022-05-25T13:25:32.000Z", + "pathing": { + "op": "wl", + "src": "macro", + "status": "nr" + }, + "rate": { + "limit": { + "action": "unknown", + "id": 0 + } + }, + "request": { + "host": "abc.example.com" + }, + "response": { + "body_bytes": 980397, + "bytes": 981308, + "compression_ratio": 0.0, + "content_type": "application/json", + "status": 200 + }, + "server": { + "ip": "1.128.0.0" + }, + "start_time": "2022-05-25T13:25:26.000Z", + "time_to_first_byte": { + "ms": 5333 + } + }, + "origin": { + "dns_response_time": { + "ms": 3 + }, + "ip": "67.43.156.0", + "request_header_send_duration": { + "ms": 0 + }, + "response": { + "bytes": 0, + "duration": { + "ms": 5319 + }, + "header_receive_duration": { + "ms": 5155 + }, + "http": { + "expires": "2022-05-21T11:17:33.000Z", + "last_modified": "2022-05-19T11:17:33.000Z" + }, + "status": 200, + "time": 5232000000 + }, + "ssl_protocol": "TLSv1.2", + "tcp_handshake_duration": { + "ms": 24 + }, + "tls_handshake_duration": { + "ms": 53 + } + }, + "parent_ray": { + "id": "710e98d93d50357d" + }, + "ray": { + "id": "710e98d9367f357d" + }, + "security_level": "off", + "smart_route": { + "colo": { + "id": 20 + } + }, + "upper_tier": { + "colo": { + "id": 0 + } + }, + "waf": { + "action": "unknown", + "flag": "0", + "matched_var": "example", + "profile": "unknown", + "rule": { + "id": "98d93d5", + "message": "matchad variable message" + } + }, + "worker": { + "cpu_time": 0, + "status": "unknown", + "subrequest": { + "count": 0, + "value": true + } + }, + "zone": { + "id": 393347122, + "name": "example.com" + } + } + }, + "destination": { + "ip": "67.43.156.0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"BotScore\":\"20\",\"BotScoreSrc\":\"Verified Bot\",\"BotTags\":\"bing\",\"CacheCacheStatus\":\"dynamic\",\"CacheResponseBytes\":983828,\"CacheResponseStatus\":200,\"CacheTieredFill\":false,\"ClientASN\":43766,\"ClientCountry\":\"sa\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"noRecord\",\"ClientMTLSAuthCertFingerprint\":\"Fingerprint\",\"ClientMTLSAuthStatus\":\"unknown\",\"ClientRequestBytes\":5800,\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/xyz/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)\",\"ClientRequestScheme\":\"https\",\"ClientRequestSource\":\"edgeWorkerFetch\",\"ClientRequestURI\":\"/s/example/api/telemetry/v2/clusters/_stats\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\",\"ClientSrcPort\":0,\"ClientSSLCipher\":\"NONE\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientTCPRTTMs\":0,\"ClientXRequestedWith\":\"Request With\",\"Cookies\":{\"key\":\"value\"},\"EdgeCFConnectingO2O\":false,\"EdgeColoCode\":\"RUH\",\"EdgeColoID\":339,\"EdgeEndTimestamp\":\"1653485132000000000\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"macro\",\"EdgePathingStatus\":\"nr\",\"EdgeRateLimitAction\":\"unknown\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"abc.example.com\",\"EdgeResponseBodyBytes\":980397,\"EdgeResponseBytes\":981308,\"EdgeResponseCompressionRatio\":0,\"EdgeResponseContentType\":\"application/json\",\"EdgeResponseStatus\":200,\"EdgeServerIP\":\"1.128.0.0\",\"EdgeStartTimestamp\":\"1653485126000000000\",\"EdgeTimeToFirstByteMs\":5333,\"OriginDNSResponseTimeMs\":3,\"OriginIP\":\"67.43.156.0\",\"OriginRequestHeaderSendDurationMs\":0,\"OriginResponseBytes\":0,\"OriginResponseDurationMs\":5319,\"OriginResponseHeaderReceiveDurationMs\":5155,\"OriginResponseHTTPExpires\":\"Thu, 21 May 2022 11:17:33 UTC\",\"OriginResponseHTTPLastModified\":\"Thu, 19 May 2022 11:17:33 UTC\",\"OriginResponseStatus\":200,\"OriginResponseTime\":5232000000,\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginTCPHandshakeDurationMs\":24,\"OriginTLSHandshakeDurationMs\":53,\"ParentRayID\":\"710e98d93d50357d\",\"RayID\":\"710e98d9367f357d\",\"SecurityLevel\":\"off\",\"SmartRouteColoID\":20,\"UpperTierColoID\":0,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"example\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"98d93d5\",\"WAFRuleMessage\":\"matchad variable message\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":true,\"WorkerSubrequestCount\":0,\"ZoneID\":393347122,\"ZoneName\":\"example.com\"}", + "type": [ + "info" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "mime_type": "application/json", + "status_code": 200 + }, + "version": "1.1" + }, + "network": { + "protocol": "http" + }, + "related": { + "ip": [ + "175.16.199.0", + "67.43.156.0" + ] + }, + "source": { + "as": { + "number": 43766 + }, + "geo": { + "country_iso_code": "sa" + }, + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "version": "1.2", + "version_protocol": "tls" + }, + "url": { + "domain": "xyz.example.com", + "original": "/s/example/api/telemetry/v2/clusters/_stats", + "path": "/s/example/api/telemetry/v2/clusters/_stats", + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Mac" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36", + "os": { + "full": "Mac OS X 10.10.5", + "name": "Mac OS X", + "version": "10.10.5" + }, + "version": "51.0.2704.103" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/http_request/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/http_request/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/http_request/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/http_request/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/http_request/elasticsearch/ingest_pipeline/default.yml index ed7e4bb09c3..5bdb3d7bc76 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/http_request/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare HTTP Request logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.EdgeStartTimestamp - type: string - ignore_missing: true - - gsub: - field: json.EdgeStartTimestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_edge_start_timestamp_to_milli + if: ctx.json?.EdgeStartTimestamp != null + source: | + try { + long t; + if (ctx.json.EdgeStartTimestamp instanceof String) { + t = Long.parseLong(ctx.json.EdgeStartTimestamp); + } else if (ctx.json.EdgeStartTimestamp instanceof Number) { + t = (long)(ctx.json.EdgeStartTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.EdgeStartTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.EdgeStartTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.EdgeStartTimestamp if: ctx.json?.EdgeStartTimestamp != null && ctx.json.EdgeStartTimestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC @@ -46,25 +56,35 @@ processors: field: error.message value: "{{{_ingest.on_failure_message}}}" - set: - if: ctx.json?.EdgeStartTimestamp != null + if: ctx.cloudflare_logpush?.http_request?.edge?.start_time != null field: '@timestamp' - copy_from: json.EdgeStartTimestamp - - convert: - field: json.EdgeEndTimestamp - type: string - ignore_missing: true - - gsub: - field: json.EdgeEndTimestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + copy_from: cloudflare_logpush.http_request.edge.start_time + - script: + lang: painless + tag: painless_edge_end_timestamp_to_milli + if: ctx.json?.EdgeEndTimestamp != null + source: | + try { + long t; + if (ctx.json.EdgeEndTimestamp instanceof String) { + t = Long.parseLong(ctx.json.EdgeEndTimestamp); + } else if (ctx.json.EdgeEndTimestamp instanceof Number) { + t = (long)(ctx.json.EdgeEndTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.EdgeEndTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.EdgeEndTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.EdgeEndTimestamp if: ctx.json?.EdgeEndTimestamp != null && ctx.json.EdgeEndTimestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/http_request/manifest.yml b/packages/cloudflare_logpush/data_stream/http_request/manifest.yml index 4a2657ba483..df9ef7dbd4e 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/http_request/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/http_request/sample_event.json b/packages/cloudflare_logpush/data_stream/http_request/sample_event.json index e224cc17bd6..5933888fb9b 100644 --- a/packages/cloudflare_logpush/data_stream/http_request/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/http_request/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-25T13:25:26Z", "agent": { - "ephemeral_id": "c65f628c-26b5-4fcb-b980-a9b52becfb43", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "34c73788-e42e-47fa-a84f-20cef1b89ae6", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "http_request": { @@ -184,12 +184,12 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -197,7 +197,7 @@ "network" ], "dataset": "cloudflare_logpush.http_request", - "ingested": "2023-06-12T08:13:45Z", + "ingested": "2023-07-25T07:36:34Z", "kind": "event", "original": "{\"BotScore\":\"20\",\"BotScoreSrc\":\"Verified Bot\",\"BotTags\":\"bing\",\"CacheCacheStatus\":\"dynamic\",\"CacheResponseBytes\":983828,\"CacheResponseStatus\":200,\"CacheTieredFill\":false,\"ClientASN\":43766,\"ClientCountry\":\"sa\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"noRecord\",\"ClientMTLSAuthCertFingerprint\":\"Fingerprint\",\"ClientMTLSAuthStatus\":\"unknown\",\"ClientRequestBytes\":5800,\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/xyz/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)\",\"ClientRequestScheme\":\"https\",\"ClientRequestSource\":\"edgeWorkerFetch\",\"ClientRequestURI\":\"/s/example/api/telemetry/v2/clusters/_stats\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\",\"ClientSSLCipher\":\"NONE\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientSrcPort\":0,\"ClientTCPRTTMs\":0,\"ClientXRequestedWith\":\"Request With\",\"Cookies\":{\"key\":\"value\"},\"EdgeCFConnectingO2O\":false,\"EdgeColoCode\":\"RUH\",\"EdgeColoID\":339,\"EdgeEndTimestamp\":\"2022-05-25T13:25:32Z\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"macro\",\"EdgePathingStatus\":\"nr\",\"EdgeRateLimitAction\":\"unknown\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"abc.example.com\",\"EdgeResponseBodyBytes\":980397,\"EdgeResponseBytes\":981308,\"EdgeResponseCompressionRatio\":0,\"EdgeResponseContentType\":\"application/json\",\"EdgeResponseStatus\":200,\"EdgeServerIP\":\"1.128.0.0\",\"EdgeStartTimestamp\":\"2022-05-25T13:25:26Z\",\"EdgeTimeToFirstByteMs\":5333,\"OriginDNSResponseTimeMs\":3,\"OriginIP\":\"67.43.156.0\",\"OriginRequestHeaderSendDurationMs\":0,\"OriginResponseBytes\":0,\"OriginResponseDurationMs\":5319,\"OriginResponseHTTPExpires\":\"2022-05-27T13:25:26Z\",\"OriginResponseHTTPLastModified\":\"2022-05-26T13:25:26Z\",\"OriginResponseHeaderReceiveDurationMs\":5155,\"OriginResponseStatus\":200,\"OriginResponseTime\":5232000000,\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginTCPHandshakeDurationMs\":24,\"OriginTLSHandshakeDurationMs\":53,\"ParentRayID\":\"710e98d93d50357d\",\"RayID\":\"710e98d9367f357d\",\"SecurityLevel\":\"off\",\"SmartRouteColoID\":20,\"UpperTierColoID\":0,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"example\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"98d93d5\",\"WAFRuleMessage\":\"matchad variable message\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":true,\"WorkerSubrequestCount\":0,\"ZoneID\":393347122,\"ZoneName\":\"example.com\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log b/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log index 5583050f828..f5babd62b87 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log +++ b/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log @@ -1 +1,3 @@ -{"ClientIPASN":"13335","ClientIPASNDescription":"CLOUDFLARENET","ClientIPCountry":"US","LastKnownGoodColoCode":"SJC","Phase":"connection","Timestamp":"2021-07-27T00:01:07Z","Type":"network-error"} \ No newline at end of file +{"ClientIPASN":"13335","ClientIPASNDescription":"CLOUDFLARENET","ClientIPCountry":"US","LastKnownGoodColoCode":"SJC","Phase":"connection","Timestamp":"2021-07-27T00:01:07Z","Type":"network-error"} +{"ClientIPASN":"13335","ClientIPASNDescription":"CLOUDFLARENET","ClientIPCountry":"US","LastKnownGoodColoCode":"SJC","Phase":"connection","Timestamp":"1627344067","Type":"network-error"} +{"ClientIPASN":"13335","ClientIPASNDescription":"CLOUDFLARENET","ClientIPCountry":"US","LastKnownGoodColoCode":"SJC","Phase":"connection","Timestamp":"1627344067000000000","Type":"network-error"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log-expected.json b/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log-expected.json index 85a9f533a23..4d38aa3d6b4 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/nel_report/_dev/test/pipeline/test-pipeline-nel-report.log-expected.json @@ -26,7 +26,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "type": "network-error" @@ -45,6 +45,98 @@ "preserve_original_event", "preserve_duplicate_custom_fields" ] + }, + { + "@timestamp": "2021-07-27T00:01:07.000Z", + "cloudflare_logpush": { + "nel_report": { + "client": { + "ip": { + "asn": { + "description": "CLOUDFLARENET", + "value": 13335 + }, + "country": "US" + } + }, + "error": { + "type": "network-error" + }, + "last_known_good": { + "colo": { + "code": "SJC" + } + }, + "phase": "connection", + "timestamp": "2021-07-27T00:01:07.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "error": { + "type": "network-error" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ClientIPASN\":\"13335\",\"ClientIPASNDescription\":\"CLOUDFLARENET\",\"ClientIPCountry\":\"US\",\"LastKnownGoodColoCode\":\"SJC\",\"Phase\":\"connection\",\"Timestamp\":\"1627344067\",\"Type\":\"network-error\"}", + "type": [ + "info" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2021-07-27T00:01:07.000Z", + "cloudflare_logpush": { + "nel_report": { + "client": { + "ip": { + "asn": { + "description": "CLOUDFLARENET", + "value": 13335 + }, + "country": "US" + } + }, + "error": { + "type": "network-error" + }, + "last_known_good": { + "colo": { + "code": "SJC" + } + }, + "phase": "connection", + "timestamp": "2021-07-27T00:01:07.000Z" + } + }, + "ecs": { + "version": "8.9.0" + }, + "error": { + "type": "network-error" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"ClientIPASN\":\"13335\",\"ClientIPASNDescription\":\"CLOUDFLARENET\",\"ClientIPCountry\":\"US\",\"LastKnownGoodColoCode\":\"SJC\",\"Phase\":\"connection\",\"Timestamp\":\"1627344067000000000\",\"Type\":\"network-error\"}", + "type": [ + "info" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/nel_report/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/nel_report/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/nel_report/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/nel_report/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/nel_report/elasticsearch/ingest_pipeline/default.yml index d7e71a518f2..8f2d8199bb1 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/nel_report/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare NEL Report logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.Timestamp - type: string - ignore_missing: true - - gsub: - field: json.Timestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_timestamp_to_milli + if: ctx.json?.Timestamp != null + source: | + try { + long t; + if (ctx.json.Timestamp instanceof String) { + t = Long.parseLong(ctx.json.Timestamp); + } else if (ctx.json.Timestamp instanceof Number) { + t = (long)(ctx.json.Timestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Timestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Timestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Timestamp if: ctx.json?.Timestamp != null && ctx.json.Timestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/nel_report/manifest.yml b/packages/cloudflare_logpush/data_stream/nel_report/manifest.yml index 3d7299c5541..f2a9147f738 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/nel_report/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/nel_report/sample_event.json b/packages/cloudflare_logpush/data_stream/nel_report/sample_event.json index 0d637b5b917..76316859eae 100644 --- a/packages/cloudflare_logpush/data_stream/nel_report/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/nel_report/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-07-27T00:01:07.000Z", "agent": { - "ephemeral_id": "ca748e98-43dc-492d-aa00-907d89a64d5e", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "55a2ad15-22a6-4b90-9cb7-6d23c41597f2", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "nel_report": { @@ -36,12 +36,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "error": { "type": "network-error" @@ -52,7 +52,7 @@ "network" ], "dataset": "cloudflare_logpush.nel_report", - "ingested": "2023-06-12T08:14:25Z", + "ingested": "2023-07-25T07:37:18Z", "kind": "event", "original": "{\"ClientIPASN\":\"13335\",\"ClientIPASNDescription\":\"CLOUDFLARENET\",\"ClientIPCountry\":\"US\",\"LastKnownGoodColoCode\":\"SJC\",\"Phase\":\"connection\",\"Timestamp\":\"2021-07-27T00:01:07Z\",\"Type\":\"network-error\"}", "type": [ diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log b/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log index 4db91702d56..2b0fd8416a1 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log +++ b/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log @@ -1 +1,3 @@ -{"AttackCampaignID":"xyz987","AttackID":"abc777","ColoCountry":"AD","ColoGeoHash":"gbuun","ColoID":46,"ColoName":"SJC","Datetime":"2021-07-27T00:01:07Z","DestinationASN":1900,"DestinationASNDescription":"asn description","DestinationCountry":"AD","DestinationGeoHash":"gbuun","DestinationPort":5678,"Direction":"ingress","GREChecksum":10,"GREEthertype":10,"GREHeaderLength":1024,"GREKey":10,"GRESequenceNumber":10,"GREVersion":10,"ICMPChecksum":10,"ICMPCode":10,"ICMPType":10,"IPDestinationAddress":"175.16.199.0","IPDestinationSubnet":"/24","IPFragmentOffset":1480,"IPHeaderLength":20,"IPMoreFragments":1480,"IPProtocol":6,"IPProtocolName":"tcp","IPSourceAddress":"67.43.156.0","IPSourceSubnet":"/24","IPTotalLength":1024,"IPTotalLengthBuckets":10,"IPTtl":240,"IPTtlBuckets":2,"IPv4Checksum":0,"IPv4DontFragment":0,"IPv4Dscp":46,"IPv4Ecn":1,"IPv4Identification":1,"IPv4Options":1,"IPv6Dscp":46,"IPv6Ecn":1,"IPv6ExtensionHeaders":"header","IPv6FlowLabel":1,"IPv6Identification":1,"MitigationReason":"BLOCKED","MitigationScope":"local","MitigationSystem":"flowtrackd","Outcome":"pass","ProtocolState":"OPEN","RuleID":"rule1","RulesetID":"3b64149bfa6e4220bbbc2bd6db589552","RulesetOverrideID":"id1","SampleInterval":1,"SourceASN":1500,"SourceASNDescription":"Source ASN Description","SourceCountry":"AD","SourceGeoHash":"gbuun","SourcePort":1234,"TCPAcknowledgementNumber":1000,"TCPChecksum":10,"TCPDataOffset":0,"TCPFlags":1,"TCPFlagsString":"Human-readable flags string","TCPMss":512,"TCPOptions":"mss","TCPSackBlocks":1,"TCPSacksPermitted":1,"TCPSequenceNumber":100,"TCPTimestampEcr":100,"TCPTimestampValue":100,"TCPUrgentPointer":10,"TCPWindowScale":10,"TCPWindowSize":10,"UDPChecksum":10,"UDPPayloadLength":10,"Verdict":"pass"} \ No newline at end of file +{"AttackCampaignID":"xyz987","AttackID":"abc777","ColoCountry":"AD","ColoGeoHash":"gbuun","ColoID":46,"ColoName":"SJC","Datetime":"2021-07-27T00:01:07Z","DestinationASN":1900,"DestinationASNDescription":"asn description","DestinationCountry":"AD","DestinationGeoHash":"gbuun","DestinationPort":5678,"Direction":"ingress","GREChecksum":10,"GREEthertype":10,"GREHeaderLength":1024,"GREKey":10,"GRESequenceNumber":10,"GREVersion":10,"ICMPChecksum":10,"ICMPCode":10,"ICMPType":10,"IPDestinationAddress":"175.16.199.0","IPDestinationSubnet":"/24","IPFragmentOffset":1480,"IPHeaderLength":20,"IPMoreFragments":1480,"IPProtocol":6,"IPProtocolName":"tcp","IPSourceAddress":"67.43.156.0","IPSourceSubnet":"/24","IPTotalLength":1024,"IPTotalLengthBuckets":10,"IPTtl":240,"IPTtlBuckets":2,"IPv4Checksum":0,"IPv4DontFragment":0,"IPv4Dscp":46,"IPv4Ecn":1,"IPv4Identification":1,"IPv4Options":1,"IPv6Dscp":46,"IPv6Ecn":1,"IPv6ExtensionHeaders":"header","IPv6FlowLabel":1,"IPv6Identification":1,"MitigationReason":"BLOCKED","MitigationScope":"local","MitigationSystem":"flowtrackd","Outcome":"pass","ProtocolState":"OPEN","RuleID":"rule1","RulesetID":"3b64149bfa6e4220bbbc2bd6db589552","RulesetOverrideID":"id1","SampleInterval":1,"SourceASN":1500,"SourceASNDescription":"Source ASN Description","SourceCountry":"AD","SourceGeoHash":"gbuun","SourcePort":1234,"TCPAcknowledgementNumber":1000,"TCPChecksum":10,"TCPDataOffset":0,"TCPFlags":1,"TCPFlagsString":"Human-readable flags string","TCPMss":512,"TCPOptions":"mss","TCPSackBlocks":1,"TCPSacksPermitted":1,"TCPSequenceNumber":100,"TCPTimestampEcr":100,"TCPTimestampValue":100,"TCPUrgentPointer":10,"TCPWindowScale":10,"TCPWindowSize":10,"UDPChecksum":10,"UDPPayloadLength":10,"Verdict":"pass"} +{"AttackCampaignID":"xyz987","AttackID":"abc777","ColoCountry":"AD","ColoGeoHash":"gbuun","ColoID":46,"ColoName":"SJC","Datetime":"1627344067","DestinationASN":1900,"DestinationASNDescription":"asn description","DestinationCountry":"AD","DestinationGeoHash":"gbuun","DestinationPort":5678,"Direction":"ingress","GREChecksum":10,"GREEthertype":10,"GREHeaderLength":1024,"GREKey":10,"GRESequenceNumber":10,"GREVersion":10,"ICMPChecksum":10,"ICMPCode":10,"ICMPType":10,"IPDestinationAddress":"175.16.199.0","IPDestinationSubnet":"/24","IPFragmentOffset":1480,"IPHeaderLength":20,"IPMoreFragments":1480,"IPProtocol":6,"IPProtocolName":"tcp","IPSourceAddress":"67.43.156.0","IPSourceSubnet":"/24","IPTotalLength":1024,"IPTotalLengthBuckets":10,"IPTtl":240,"IPTtlBuckets":2,"IPv4Checksum":0,"IPv4DontFragment":0,"IPv4Dscp":46,"IPv4Ecn":1,"IPv4Identification":1,"IPv4Options":1,"IPv6Dscp":46,"IPv6Ecn":1,"IPv6ExtensionHeaders":"header","IPv6FlowLabel":1,"IPv6Identification":1,"MitigationReason":"BLOCKED","MitigationScope":"local","MitigationSystem":"flowtrackd","Outcome":"pass","ProtocolState":"OPEN","RuleID":"rule1","RulesetID":"3b64149bfa6e4220bbbc2bd6db589552","RulesetOverrideID":"id1","SampleInterval":1,"SourceASN":1500,"SourceASNDescription":"Source ASN Description","SourceCountry":"AD","SourceGeoHash":"gbuun","SourcePort":1234,"TCPAcknowledgementNumber":1000,"TCPChecksum":10,"TCPDataOffset":0,"TCPFlags":1,"TCPFlagsString":"Human-readable flags string","TCPMss":512,"TCPOptions":"mss","TCPSackBlocks":1,"TCPSacksPermitted":1,"TCPSequenceNumber":100,"TCPTimestampEcr":100,"TCPTimestampValue":100,"TCPUrgentPointer":10,"TCPWindowScale":10,"TCPWindowSize":10,"UDPChecksum":10,"UDPPayloadLength":10,"Verdict":"pass"} +{"AttackCampaignID":"xyz987","AttackID":"abc777","ColoCountry":"AD","ColoGeoHash":"gbuun","ColoID":46,"ColoName":"SJC","Datetime":"1627344067000000000","DestinationASN":1900,"DestinationASNDescription":"asn description","DestinationCountry":"AD","DestinationGeoHash":"gbuun","DestinationPort":5678,"Direction":"ingress","GREChecksum":10,"GREEthertype":10,"GREHeaderLength":1024,"GREKey":10,"GRESequenceNumber":10,"GREVersion":10,"ICMPChecksum":10,"ICMPCode":10,"ICMPType":10,"IPDestinationAddress":"175.16.199.0","IPDestinationSubnet":"/24","IPFragmentOffset":1480,"IPHeaderLength":20,"IPMoreFragments":1480,"IPProtocol":6,"IPProtocolName":"tcp","IPSourceAddress":"67.43.156.0","IPSourceSubnet":"/24","IPTotalLength":1024,"IPTotalLengthBuckets":10,"IPTtl":240,"IPTtlBuckets":2,"IPv4Checksum":0,"IPv4DontFragment":0,"IPv4Dscp":46,"IPv4Ecn":1,"IPv4Identification":1,"IPv4Options":1,"IPv6Dscp":46,"IPv6Ecn":1,"IPv6ExtensionHeaders":"header","IPv6FlowLabel":1,"IPv6Identification":1,"MitigationReason":"BLOCKED","MitigationScope":"local","MitigationSystem":"flowtrackd","Outcome":"pass","ProtocolState":"OPEN","RuleID":"rule1","RulesetID":"3b64149bfa6e4220bbbc2bd6db589552","RulesetOverrideID":"id1","SampleInterval":1,"SourceASN":1500,"SourceASNDescription":"Source ASN Description","SourceCountry":"AD","SourceGeoHash":"gbuun","SourcePort":1234,"TCPAcknowledgementNumber":1000,"TCPChecksum":10,"TCPDataOffset":0,"TCPFlags":1,"TCPFlagsString":"Human-readable flags string","TCPMss":512,"TCPOptions":"mss","TCPSackBlocks":1,"TCPSacksPermitted":1,"TCPSequenceNumber":100,"TCPTimestampEcr":100,"TCPTimestampValue":100,"TCPUrgentPointer":10,"TCPWindowScale":10,"TCPWindowSize":10,"UDPChecksum":10,"UDPPayloadLength":10,"Verdict":"pass"} diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log-expected.json b/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log-expected.json index 771f36d2e9c..2fe1c4fa724 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/network_analytics/_dev/test/pipeline/test-pipeline-network-analytics.log-expected.json @@ -167,7 +167,7 @@ "port": 5678 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -208,6 +208,424 @@ "preserve_original_event", "preserve_duplicate_custom_fields" ] + }, + { + "@timestamp": "2021-07-27T00:01:07.000Z", + "cloudflare_logpush": { + "network_analytics": { + "attack": { + "campaign": { + "id": "xyz987" + }, + "id": "abc777" + }, + "colo": { + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "id": 46, + "name": "SJC" + }, + "destination": { + "as": { + "number": { + "description": "asn description" + } + }, + "asn": 1900, + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "ip": "175.16.199.0", + "port": 5678 + }, + "direction": "ingress", + "gre": { + "checksum": 10, + "ether": { + "type": 10 + }, + "header": { + "length": 1024 + }, + "key": 10, + "sequence": { + "number": 10 + }, + "version": 10 + }, + "icmp": { + "checksum": 10, + "code": 10, + "type": 10 + }, + "ip": { + "destination": { + "subnet": "/24" + }, + "fragment": { + "offset": 1480 + }, + "header": { + "length": 20 + }, + "more": { + "fragments": 1480 + }, + "protocol": { + "name": "tcp", + "value": 6 + }, + "source": { + "subnet": "/24" + }, + "total": { + "length": { + "buckets": 10, + "value": 1024 + } + }, + "ttl": { + "buckets": 2, + "value": 240 + } + }, + "ipv4": { + "checksum": 0, + "dont_fragment": 0, + "dscp": 46, + "ecn": 1, + "identification": 1, + "options": 1 + }, + "ipv6": { + "dscp": 46, + "ecn": 1, + "extension_headers": "header", + "flow_label": 1, + "identification": 1 + }, + "mitigation": { + "reason": "BLOCKED", + "scope": "local", + "system": "flowtrackd" + }, + "outcome": "success", + "protocol_state": "OPEN", + "rule": { + "id": "rule1", + "set": { + "id": "3b64149bfa6e4220bbbc2bd6db589552", + "override": { + "id": "id1" + } + } + }, + "sample_interval": 1, + "source": { + "as": { + "number": { + "description": "Source ASN Description" + } + }, + "asn": 1500, + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "ip": "67.43.156.0", + "port": 1234 + }, + "tcp": { + "acknowledgement_number": 1000, + "checksum": 10, + "dataoffset": 0, + "flags": { + "string": "Human-readable flags string", + "value": 1 + }, + "mss": 512, + "options": "mss", + "sack": { + "blocks": 1, + "permitted": 1 + }, + "sequence_number": 100, + "timestamp": { + "ecr": 100, + "value": 100 + }, + "urgent_pointer": 10, + "window": { + "scale": 10, + "size": 10 + } + }, + "timestamp": "2021-07-27T00:01:07.000Z", + "udp": { + "checksum": 10, + "payload_length": 10 + }, + "verdict": "pass" + } + }, + "destination": { + "as": { + "number": 1900 + }, + "ip": "175.16.199.0", + "port": 5678 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"AttackCampaignID\":\"xyz987\",\"AttackID\":\"abc777\",\"ColoCountry\":\"AD\",\"ColoGeoHash\":\"gbuun\",\"ColoID\":46,\"ColoName\":\"SJC\",\"Datetime\":\"1627344067\",\"DestinationASN\":1900,\"DestinationASNDescription\":\"asn description\",\"DestinationCountry\":\"AD\",\"DestinationGeoHash\":\"gbuun\",\"DestinationPort\":5678,\"Direction\":\"ingress\",\"GREChecksum\":10,\"GREEthertype\":10,\"GREHeaderLength\":1024,\"GREKey\":10,\"GRESequenceNumber\":10,\"GREVersion\":10,\"ICMPChecksum\":10,\"ICMPCode\":10,\"ICMPType\":10,\"IPDestinationAddress\":\"175.16.199.0\",\"IPDestinationSubnet\":\"/24\",\"IPFragmentOffset\":1480,\"IPHeaderLength\":20,\"IPMoreFragments\":1480,\"IPProtocol\":6,\"IPProtocolName\":\"tcp\",\"IPSourceAddress\":\"67.43.156.0\",\"IPSourceSubnet\":\"/24\",\"IPTotalLength\":1024,\"IPTotalLengthBuckets\":10,\"IPTtl\":240,\"IPTtlBuckets\":2,\"IPv4Checksum\":0,\"IPv4DontFragment\":0,\"IPv4Dscp\":46,\"IPv4Ecn\":1,\"IPv4Identification\":1,\"IPv4Options\":1,\"IPv6Dscp\":46,\"IPv6Ecn\":1,\"IPv6ExtensionHeaders\":\"header\",\"IPv6FlowLabel\":1,\"IPv6Identification\":1,\"MitigationReason\":\"BLOCKED\",\"MitigationScope\":\"local\",\"MitigationSystem\":\"flowtrackd\",\"Outcome\":\"pass\",\"ProtocolState\":\"OPEN\",\"RuleID\":\"rule1\",\"RulesetID\":\"3b64149bfa6e4220bbbc2bd6db589552\",\"RulesetOverrideID\":\"id1\",\"SampleInterval\":1,\"SourceASN\":1500,\"SourceASNDescription\":\"Source ASN Description\",\"SourceCountry\":\"AD\",\"SourceGeoHash\":\"gbuun\",\"SourcePort\":1234,\"TCPAcknowledgementNumber\":1000,\"TCPChecksum\":10,\"TCPDataOffset\":0,\"TCPFlags\":1,\"TCPFlagsString\":\"Human-readable flags string\",\"TCPMss\":512,\"TCPOptions\":\"mss\",\"TCPSackBlocks\":1,\"TCPSacksPermitted\":1,\"TCPSequenceNumber\":100,\"TCPTimestampEcr\":100,\"TCPTimestampValue\":100,\"TCPUrgentPointer\":10,\"TCPWindowScale\":10,\"TCPWindowSize\":10,\"UDPChecksum\":10,\"UDPPayloadLength\":10,\"Verdict\":\"pass\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "network": { + "community_id": "1:8MePL/O2uen4bksCpCfVgHj9CQY=", + "direction": "ingress", + "transport": "tcp" + }, + "related": { + "hash": [ + "gbuun" + ], + "ip": [ + "67.43.156.0", + "175.16.199.0" + ] + }, + "rule": { + "id": "rule1" + }, + "source": { + "as": { + "number": 1500 + }, + "ip": "67.43.156.0", + "port": 1234 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2021-07-27T00:01:07.000Z", + "cloudflare_logpush": { + "network_analytics": { + "attack": { + "campaign": { + "id": "xyz987" + }, + "id": "abc777" + }, + "colo": { + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "id": 46, + "name": "SJC" + }, + "destination": { + "as": { + "number": { + "description": "asn description" + } + }, + "asn": 1900, + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "ip": "175.16.199.0", + "port": 5678 + }, + "direction": "ingress", + "gre": { + "checksum": 10, + "ether": { + "type": 10 + }, + "header": { + "length": 1024 + }, + "key": 10, + "sequence": { + "number": 10 + }, + "version": 10 + }, + "icmp": { + "checksum": 10, + "code": 10, + "type": 10 + }, + "ip": { + "destination": { + "subnet": "/24" + }, + "fragment": { + "offset": 1480 + }, + "header": { + "length": 20 + }, + "more": { + "fragments": 1480 + }, + "protocol": { + "name": "tcp", + "value": 6 + }, + "source": { + "subnet": "/24" + }, + "total": { + "length": { + "buckets": 10, + "value": 1024 + } + }, + "ttl": { + "buckets": 2, + "value": 240 + } + }, + "ipv4": { + "checksum": 0, + "dont_fragment": 0, + "dscp": 46, + "ecn": 1, + "identification": 1, + "options": 1 + }, + "ipv6": { + "dscp": 46, + "ecn": 1, + "extension_headers": "header", + "flow_label": 1, + "identification": 1 + }, + "mitigation": { + "reason": "BLOCKED", + "scope": "local", + "system": "flowtrackd" + }, + "outcome": "success", + "protocol_state": "OPEN", + "rule": { + "id": "rule1", + "set": { + "id": "3b64149bfa6e4220bbbc2bd6db589552", + "override": { + "id": "id1" + } + } + }, + "sample_interval": 1, + "source": { + "as": { + "number": { + "description": "Source ASN Description" + } + }, + "asn": 1500, + "country": "AD", + "geo_hash": "gbuun", + "geo_location": "gbuun", + "ip": "67.43.156.0", + "port": 1234 + }, + "tcp": { + "acknowledgement_number": 1000, + "checksum": 10, + "dataoffset": 0, + "flags": { + "string": "Human-readable flags string", + "value": 1 + }, + "mss": 512, + "options": "mss", + "sack": { + "blocks": 1, + "permitted": 1 + }, + "sequence_number": 100, + "timestamp": { + "ecr": 100, + "value": 100 + }, + "urgent_pointer": 10, + "window": { + "scale": 10, + "size": 10 + } + }, + "timestamp": "2021-07-27T00:01:07.000Z", + "udp": { + "checksum": 10, + "payload_length": 10 + }, + "verdict": "pass" + } + }, + "destination": { + "as": { + "number": 1900 + }, + "ip": "175.16.199.0", + "port": 5678 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "{\"AttackCampaignID\":\"xyz987\",\"AttackID\":\"abc777\",\"ColoCountry\":\"AD\",\"ColoGeoHash\":\"gbuun\",\"ColoID\":46,\"ColoName\":\"SJC\",\"Datetime\":\"1627344067000000000\",\"DestinationASN\":1900,\"DestinationASNDescription\":\"asn description\",\"DestinationCountry\":\"AD\",\"DestinationGeoHash\":\"gbuun\",\"DestinationPort\":5678,\"Direction\":\"ingress\",\"GREChecksum\":10,\"GREEthertype\":10,\"GREHeaderLength\":1024,\"GREKey\":10,\"GRESequenceNumber\":10,\"GREVersion\":10,\"ICMPChecksum\":10,\"ICMPCode\":10,\"ICMPType\":10,\"IPDestinationAddress\":\"175.16.199.0\",\"IPDestinationSubnet\":\"/24\",\"IPFragmentOffset\":1480,\"IPHeaderLength\":20,\"IPMoreFragments\":1480,\"IPProtocol\":6,\"IPProtocolName\":\"tcp\",\"IPSourceAddress\":\"67.43.156.0\",\"IPSourceSubnet\":\"/24\",\"IPTotalLength\":1024,\"IPTotalLengthBuckets\":10,\"IPTtl\":240,\"IPTtlBuckets\":2,\"IPv4Checksum\":0,\"IPv4DontFragment\":0,\"IPv4Dscp\":46,\"IPv4Ecn\":1,\"IPv4Identification\":1,\"IPv4Options\":1,\"IPv6Dscp\":46,\"IPv6Ecn\":1,\"IPv6ExtensionHeaders\":\"header\",\"IPv6FlowLabel\":1,\"IPv6Identification\":1,\"MitigationReason\":\"BLOCKED\",\"MitigationScope\":\"local\",\"MitigationSystem\":\"flowtrackd\",\"Outcome\":\"pass\",\"ProtocolState\":\"OPEN\",\"RuleID\":\"rule1\",\"RulesetID\":\"3b64149bfa6e4220bbbc2bd6db589552\",\"RulesetOverrideID\":\"id1\",\"SampleInterval\":1,\"SourceASN\":1500,\"SourceASNDescription\":\"Source ASN Description\",\"SourceCountry\":\"AD\",\"SourceGeoHash\":\"gbuun\",\"SourcePort\":1234,\"TCPAcknowledgementNumber\":1000,\"TCPChecksum\":10,\"TCPDataOffset\":0,\"TCPFlags\":1,\"TCPFlagsString\":\"Human-readable flags string\",\"TCPMss\":512,\"TCPOptions\":\"mss\",\"TCPSackBlocks\":1,\"TCPSacksPermitted\":1,\"TCPSequenceNumber\":100,\"TCPTimestampEcr\":100,\"TCPTimestampValue\":100,\"TCPUrgentPointer\":10,\"TCPWindowScale\":10,\"TCPWindowSize\":10,\"UDPChecksum\":10,\"UDPPayloadLength\":10,\"Verdict\":\"pass\"}", + "outcome": "success", + "type": [ + "info" + ] + }, + "network": { + "community_id": "1:8MePL/O2uen4bksCpCfVgHj9CQY=", + "direction": "ingress", + "transport": "tcp" + }, + "related": { + "hash": [ + "gbuun" + ], + "ip": [ + "67.43.156.0", + "175.16.199.0" + ] + }, + "rule": { + "id": "rule1" + }, + "source": { + "as": { + "number": 1500 + }, + "ip": "67.43.156.0", + "port": 1234 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/network_analytics/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/network_analytics/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/network_analytics/elasticsearch/ingest_pipeline/default.yml index e9ac31507ed..2cef74dddd8 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/network_analytics/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Network Analytics logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.Datetime - type: string - ignore_missing: true - - gsub: - field: json.Datetime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_datetime_to_milli + if: ctx.json?.Datetime != null + source: | + try { + long t; + if (ctx.json.Datetime instanceof String) { + t = Long.parseLong(ctx.json.Datetime); + } else if (ctx.json.Datetime instanceof Number) { + t = (long)(ctx.json.Datetime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Datetime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Datetime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Datetime if: ctx.json?.Datetime != null && ctx.json.Datetime != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/manifest.yml b/packages/cloudflare_logpush/data_stream/network_analytics/manifest.yml index 8f0a7ea3775..143d960d0ef 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/network_analytics/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/network_analytics/sample_event.json b/packages/cloudflare_logpush/data_stream/network_analytics/sample_event.json index 592ff6cd9e7..28c4225ab0f 100644 --- a/packages/cloudflare_logpush/data_stream/network_analytics/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/network_analytics/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-07-27T00:01:07.000Z", "agent": { - "ephemeral_id": "2d05f4a9-c7d4-4a53-a65b-93b84b82984c", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "cc63528e-4a4d-45a9-bf41-97387ffeb7a2", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "network_analytics": { @@ -177,12 +177,12 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -190,7 +190,7 @@ "network" ], "dataset": "cloudflare_logpush.network_analytics", - "ingested": "2023-06-12T08:15:07Z", + "ingested": "2023-07-25T07:38:02Z", "kind": "event", "original": "{\"AttackCampaignID\":\"xyz987\",\"AttackID\":\"abc777\",\"ColoCountry\":\"AD\",\"ColoGeoHash\":\"gbuun\",\"ColoID\":46,\"ColoName\":\"SJC\",\"Datetime\":\"2021-07-27T00:01:07Z\",\"DestinationASN\":1900,\"DestinationASNDescription\":\"asn description\",\"DestinationCountry\":\"AD\",\"DestinationGeoHash\":\"gbuun\",\"DestinationPort\":0,\"Direction\":\"ingress\",\"GREChecksum\":10,\"GREEthertype\":10,\"GREHeaderLength\":1024,\"GREKey\":10,\"GRESequenceNumber\":10,\"GREVersion\":10,\"ICMPChecksum\":10,\"ICMPCode\":10,\"ICMPType\":10,\"IPDestinationAddress\":\"175.16.199.0\",\"IPDestinationSubnet\":\"/24\",\"IPFragmentOffset\":1480,\"IPHeaderLength\":20,\"IPMoreFragments\":1480,\"IPProtocol\":6,\"IPProtocolName\":\"tcp\",\"IPSourceAddress\":\"67.43.156.0\",\"IPSourceSubnet\":\"/24\",\"IPTotalLength\":1024,\"IPTotalLengthBuckets\":10,\"IPTtl\":240,\"IPTtlBuckets\":2,\"IPv4Checksum\":0,\"IPv4DontFragment\":0,\"IPv4Dscp\":46,\"IPv4Ecn\":1,\"IPv4Identification\":1,\"IPv4Options\":1,\"IPv6Dscp\":46,\"IPv6Ecn\":1,\"IPv6ExtensionHeaders\":\"header\",\"IPv6FlowLabel\":1,\"IPv6Identification\":1,\"MitigationReason\":\"BLOCKED\",\"MitigationScope\":\"local\",\"MitigationSystem\":\"flowtrackd\",\"Outcome\":\"pass\",\"ProtocolState\":\"OPEN\",\"RuleID\":\"rule1\",\"RulesetID\":\"3b64149bfa6e4220bbbc2bd6db589552\",\"RulesetOverrideID\":\"id1\",\"SampleInterval\":1,\"SourceASN\":1500,\"SourceASNDescription\":\"Source ASN Description\",\"SourceCountry\":\"AD\",\"SourceGeoHash\":\"gbuun\",\"SourcePort\":0,\"TCPAcknowledgementNumber\":1000,\"TCPChecksum\":10,\"TCPDataOffset\":0,\"TCPFlags\":1,\"TCPFlagsString\":\"Human-readable flags string\",\"TCPMss\":512,\"TCPOptions\":\"mss\",\"TCPSackBlocks\":1,\"TCPSacksPermitted\":1,\"TCPSequenceNumber\":100,\"TCPTimestampEcr\":100,\"TCPTimestampValue\":100,\"TCPUrgentPointer\":10,\"TCPWindowScale\":10,\"TCPWindowSize\":10,\"UDPChecksum\":10,\"UDPPayloadLength\":10,\"Verdict\":\"pass\"}", "outcome": "success", diff --git a/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log b/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log index 25d8c3d328b..b2a7141fb9f 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log +++ b/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log @@ -1 +1,3 @@ -{"AccountID":"e1836771179f98aabb828da5ea69a111","BytesReceived":679,"BytesSent":2333,"ClientTCPHandshakeDurationMs":12,"ClientTLSCipher":"TLS_AES_128_GCM_SHA256","ClientTLSHandshakeDurationMs":125,"ClientTLSVersion":"TLS 1.3","ConnectionCloseReason":"CLIENT_CLOSED","ConnectionReuse":false,"DestinationTunnelID":"00000000-0000-0000-0000-000000000000","DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","EgressColoName":"ORD","EgressIP":"2a02:cf40::23","EgressPort":41052,"EgressRuleID":"00000000-0000-0000-0000-000000000000","EgressRuleName":"Egress Rule 1","Email":"user@test.com","IngressColoName":"ORD","Offramp":"INTERNET","OriginIP":"89.160.20.129","OriginPort":80,"OriginTLSCertificateIssuer":"DigiCert Inc","OriginTLSCertificateValidationResult":"VALID","OriginTLSCipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","OriginTLSHandshakeDurationMs":130,"OriginTLSVersion":"TLS 1.2","Protocol":"TCP","RuleEvaluationDurationMs":10,"SessionEndTime":"2023-05-04T11:29:14Z","SessionID":"18881f179300007fb0d06d6400000001","SessionStartTime":"2023-05-04T11:29:14Z","SourceInternalIP":"1.128.0.1","SourceIP":"67.43.156.2","SourcePort":52994,"UserID":"166befbb-00e3-5e20-bd6e-27245723949f","VirtualNetworkID":"0ce99869-63d3-4d5d-bdaf-d4f33df964aa"} \ No newline at end of file +{"AccountID":"e1836771179f98aabb828da5ea69a111","BytesReceived":679,"BytesSent":2333,"ClientTCPHandshakeDurationMs":12,"ClientTLSCipher":"TLS_AES_128_GCM_SHA256","ClientTLSHandshakeDurationMs":125,"ClientTLSVersion":"TLS 1.3","ConnectionCloseReason":"CLIENT_CLOSED","ConnectionReuse":false,"DestinationTunnelID":"00000000-0000-0000-0000-000000000000","DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","EgressColoName":"ORD","EgressIP":"2a02:cf40::23","EgressPort":41052,"EgressRuleID":"00000000-0000-0000-0000-000000000000","EgressRuleName":"Egress Rule 1","Email":"user@test.com","IngressColoName":"ORD","Offramp":"INTERNET","OriginIP":"89.160.20.129","OriginPort":80,"OriginTLSCertificateIssuer":"DigiCert Inc","OriginTLSCertificateValidationResult":"VALID","OriginTLSCipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","OriginTLSHandshakeDurationMs":130,"OriginTLSVersion":"TLS 1.2","Protocol":"TCP","RuleEvaluationDurationMs":10,"SessionEndTime":"2023-05-04T11:29:14Z","SessionID":"18881f179300007fb0d06d6400000001","SessionStartTime":"2023-05-04T11:29:14Z","SourceInternalIP":"1.128.0.1","SourceIP":"67.43.156.2","SourcePort":52994,"UserID":"166befbb-00e3-5e20-bd6e-27245723949f","VirtualNetworkID":"0ce99869-63d3-4d5d-bdaf-d4f33df964aa"} +{"AccountID":"e1836771179f98aabb828da5ea69a111","BytesReceived":679,"BytesSent":2333,"ClientTCPHandshakeDurationMs":12,"ClientTLSCipher":"TLS_AES_128_GCM_SHA256","ClientTLSHandshakeDurationMs":125,"ClientTLSVersion":"TLS 1.3","ConnectionCloseReason":"CLIENT_CLOSED","ConnectionReuse":false,"DestinationTunnelID":"00000000-0000-0000-0000-000000000000","DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","EgressColoName":"ORD","EgressIP":"2a02:cf40::23","EgressPort":41052,"EgressRuleID":"00000000-0000-0000-0000-000000000000","EgressRuleName":"Egress Rule 1","Email":"user@test.com","IngressColoName":"ORD","Offramp":"INTERNET","OriginIP":"89.160.20.129","OriginPort":80,"OriginTLSCertificateIssuer":"DigiCert Inc","OriginTLSCertificateValidationResult":"VALID","OriginTLSCipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","OriginTLSHandshakeDurationMs":130,"OriginTLSVersion":"TLS 1.2","Protocol":"TCP","RuleEvaluationDurationMs":10,"SessionEndTime":"1683199754","SessionID":"18881f179300007fb0d06d6400000001","SessionStartTime":"1683199754","SourceInternalIP":"1.128.0.1","SourceIP":"67.43.156.2","SourcePort":52994,"UserID":"166befbb-00e3-5e20-bd6e-27245723949f","VirtualNetworkID":"0ce99869-63d3-4d5d-bdaf-d4f33df964aa"} +{"AccountID":"e1836771179f98aabb828da5ea69a111","BytesReceived":679,"BytesSent":2333,"ClientTCPHandshakeDurationMs":12,"ClientTLSCipher":"TLS_AES_128_GCM_SHA256","ClientTLSHandshakeDurationMs":125,"ClientTLSVersion":"TLS 1.3","ConnectionCloseReason":"CLIENT_CLOSED","ConnectionReuse":false,"DestinationTunnelID":"00000000-0000-0000-0000-000000000000","DeviceID":"083a8354-d56c-11ed-9771-6a842b100cff","DeviceName":"zt-test-vm1","EgressColoName":"ORD","EgressIP":"2a02:cf40::23","EgressPort":41052,"EgressRuleID":"00000000-0000-0000-0000-000000000000","EgressRuleName":"Egress Rule 1","Email":"user@test.com","IngressColoName":"ORD","Offramp":"INTERNET","OriginIP":"89.160.20.129","OriginPort":80,"OriginTLSCertificateIssuer":"DigiCert Inc","OriginTLSCertificateValidationResult":"VALID","OriginTLSCipher":"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","OriginTLSHandshakeDurationMs":130,"OriginTLSVersion":"TLS 1.2","Protocol":"TCP","RuleEvaluationDurationMs":10,"SessionEndTime":"1683199754000000000","SessionID":"18881f179300007fb0d06d6400000001","SessionStartTime":"1683199754000000000","SourceInternalIP":"1.128.0.1","SourceIP":"67.43.156.2","SourcePort":52994,"UserID":"166befbb-00e3-5e20-bd6e-27245723949f","VirtualNetworkID":"0ce99869-63d3-4d5d-bdaf-d4f33df964aa"} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log-expected.json b/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log-expected.json index 7571bcaf88a..6838b44fb97 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/network_session/_dev/test/pipeline/test-pipeline-network-session.log-expected.json @@ -32,9 +32,9 @@ "time_ms": 10 }, "session": { - "end": "2023-05-04T11:29:14Z", + "end": "2023-05-04T11:29:14.000Z", "id": "18881f179300007fb0d06d6400000001", - "start": "2023-05-04T11:29:14Z" + "start": "2023-05-04T11:29:14.000Z" }, "source": { "bytes": 2333, @@ -102,18 +102,366 @@ "port": 80 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "event": { "category": [ "network", "session" ], - "end": "2023-05-04T11:29:14Z", + "end": "2023-05-04T11:29:14.000Z", "id": "18881f179300007fb0d06d6400000001", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"BytesReceived\":679,\"BytesSent\":2333,\"ClientTCPHandshakeDurationMs\":12,\"ClientTLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"ClientTLSHandshakeDurationMs\":125,\"ClientTLSVersion\":\"TLS 1.3\",\"ConnectionCloseReason\":\"CLIENT_CLOSED\",\"ConnectionReuse\":false,\"DestinationTunnelID\":\"00000000-0000-0000-0000-000000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"EgressColoName\":\"ORD\",\"EgressIP\":\"2a02:cf40::23\",\"EgressPort\":41052,\"EgressRuleID\":\"00000000-0000-0000-0000-000000000000\",\"EgressRuleName\":\"Egress Rule 1\",\"Email\":\"user@test.com\",\"IngressColoName\":\"ORD\",\"Offramp\":\"INTERNET\",\"OriginIP\":\"89.160.20.129\",\"OriginPort\":80,\"OriginTLSCertificateIssuer\":\"DigiCert Inc\",\"OriginTLSCertificateValidationResult\":\"VALID\",\"OriginTLSCipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"OriginTLSHandshakeDurationMs\":130,\"OriginTLSVersion\":\"TLS 1.2\",\"Protocol\":\"TCP\",\"RuleEvaluationDurationMs\":10,\"SessionEndTime\":\"2023-05-04T11:29:14Z\",\"SessionID\":\"18881f179300007fb0d06d6400000001\",\"SessionStartTime\":\"2023-05-04T11:29:14Z\",\"SourceInternalIP\":\"1.128.0.1\",\"SourceIP\":\"67.43.156.2\",\"SourcePort\":52994,\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\",\"VirtualNetworkID\":\"0ce99869-63d3-4d5d-bdaf-d4f33df964aa\"}", - "start": "2023-05-04T11:29:14Z", + "start": "2023-05-04T11:29:14.000Z", + "type": [ + "connection" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "network": { + "transport": "TCP" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129", + "2a02:cf40::23" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "bytes": 2333, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 52994 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "server": { + "issuer": "DigiCert Inc" + } + }, + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "vlan": { + "id": "0ce99869-63d3-4d5d-bdaf-d4f33df964aa" + } + }, + { + "@timestamp": "2023-05-04T11:29:14.000Z", + "cloudflare_logpush": { + "network_session": { + "account_id": "e1836771179f98aabb828da5ea69a111", + "destination": { + "bytes": 679, + "ip": "89.160.20.129", + "port": 80, + "tunnel_id": "00000000-0000-0000-0000-000000000000" + }, + "egress": { + "colo_name": "ORD", + "ip": "2a02:cf40::23", + "port": 41052, + "rule": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Egress Rule 1" + } + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "ingress": { + "colo_name": "ORD" + }, + "offramp": "INTERNET", + "rule_evaluation": { + "time_ms": 10 + }, + "session": { + "end": "2023-05-04T11:29:14.000Z", + "id": "18881f179300007fb0d06d6400000001", + "start": "2023-05-04T11:29:14.000Z" + }, + "source": { + "bytes": 2333, + "internal_ip": "1.128.0.1", + "ip": "67.43.156.2", + "port": 52994 + }, + "tcp": { + "client": { + "handshake_time_ms": 12 + }, + "connection": { + "close_reason": "CLIENT_CLOSED", + "reuse": false + } + }, + "timestamp": "2023-05-04T11:29:14.000Z", + "tls": { + "client": { + "cipher": "TLS_AES_128_GCM_SHA256", + "handshake_time_ms": 125, + "version": "TLS 1.3" + }, + "server": { + "certificate": { + "issuer": "DigiCert Inc", + "validation_result": "VALID" + }, + "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "handshake_time_ms": 130, + "version": "TLS 1.2" + } + }, + "transport": "TCP", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "vlan": { + "id": "0ce99869-63d3-4d5d-bdaf-d4f33df964aa" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "bytes": 679, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "end": "2023-05-04T11:29:14.000Z", + "id": "18881f179300007fb0d06d6400000001", + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"BytesReceived\":679,\"BytesSent\":2333,\"ClientTCPHandshakeDurationMs\":12,\"ClientTLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"ClientTLSHandshakeDurationMs\":125,\"ClientTLSVersion\":\"TLS 1.3\",\"ConnectionCloseReason\":\"CLIENT_CLOSED\",\"ConnectionReuse\":false,\"DestinationTunnelID\":\"00000000-0000-0000-0000-000000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"EgressColoName\":\"ORD\",\"EgressIP\":\"2a02:cf40::23\",\"EgressPort\":41052,\"EgressRuleID\":\"00000000-0000-0000-0000-000000000000\",\"EgressRuleName\":\"Egress Rule 1\",\"Email\":\"user@test.com\",\"IngressColoName\":\"ORD\",\"Offramp\":\"INTERNET\",\"OriginIP\":\"89.160.20.129\",\"OriginPort\":80,\"OriginTLSCertificateIssuer\":\"DigiCert Inc\",\"OriginTLSCertificateValidationResult\":\"VALID\",\"OriginTLSCipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"OriginTLSHandshakeDurationMs\":130,\"OriginTLSVersion\":\"TLS 1.2\",\"Protocol\":\"TCP\",\"RuleEvaluationDurationMs\":10,\"SessionEndTime\":\"1683199754\",\"SessionID\":\"18881f179300007fb0d06d6400000001\",\"SessionStartTime\":\"1683199754\",\"SourceInternalIP\":\"1.128.0.1\",\"SourceIP\":\"67.43.156.2\",\"SourcePort\":52994,\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\",\"VirtualNetworkID\":\"0ce99869-63d3-4d5d-bdaf-d4f33df964aa\"}", + "start": "2023-05-04T11:29:14.000Z", + "type": [ + "connection" + ] + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "network": { + "transport": "TCP" + }, + "related": { + "hosts": [ + "083a8354-d56c-11ed-9771-6a842b100cff", + "zt-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129", + "2a02:cf40::23" + ], + "user": [ + "166befbb-00e3-5e20-bd6e-27245723949f", + "user@test.com" + ] + }, + "source": { + "as": { + "number": 35908 + }, + "bytes": 2333, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "port": 52994 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "server": { + "issuer": "DigiCert Inc" + } + }, + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "vlan": { + "id": "0ce99869-63d3-4d5d-bdaf-d4f33df964aa" + } + }, + { + "@timestamp": "2023-05-04T11:29:14.000Z", + "cloudflare_logpush": { + "network_session": { + "account_id": "e1836771179f98aabb828da5ea69a111", + "destination": { + "bytes": 679, + "ip": "89.160.20.129", + "port": 80, + "tunnel_id": "00000000-0000-0000-0000-000000000000" + }, + "egress": { + "colo_name": "ORD", + "ip": "2a02:cf40::23", + "port": 41052, + "rule": { + "id": "00000000-0000-0000-0000-000000000000", + "name": "Egress Rule 1" + } + }, + "host": { + "id": "083a8354-d56c-11ed-9771-6a842b100cff", + "name": "zt-test-vm1" + }, + "ingress": { + "colo_name": "ORD" + }, + "offramp": "INTERNET", + "rule_evaluation": { + "time_ms": 10 + }, + "session": { + "end": "2023-05-04T11:29:14.000Z", + "id": "18881f179300007fb0d06d6400000001", + "start": "2023-05-04T11:29:14.000Z" + }, + "source": { + "bytes": 2333, + "internal_ip": "1.128.0.1", + "ip": "67.43.156.2", + "port": 52994 + }, + "tcp": { + "client": { + "handshake_time_ms": 12 + }, + "connection": { + "close_reason": "CLIENT_CLOSED", + "reuse": false + } + }, + "timestamp": "2023-05-04T11:29:14.000Z", + "tls": { + "client": { + "cipher": "TLS_AES_128_GCM_SHA256", + "handshake_time_ms": 125, + "version": "TLS 1.3" + }, + "server": { + "certificate": { + "issuer": "DigiCert Inc", + "validation_result": "VALID" + }, + "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "handshake_time_ms": 130, + "version": "TLS 1.2" + } + }, + "transport": "TCP", + "user": { + "email": "user@test.com", + "id": "166befbb-00e3-5e20-bd6e-27245723949f" + }, + "vlan": { + "id": "0ce99869-63d3-4d5d-bdaf-d4f33df964aa" + } + } + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "bytes": 679, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network", + "session" + ], + "end": "2023-05-04T11:29:14.000Z", + "id": "18881f179300007fb0d06d6400000001", + "kind": "event", + "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"BytesReceived\":679,\"BytesSent\":2333,\"ClientTCPHandshakeDurationMs\":12,\"ClientTLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"ClientTLSHandshakeDurationMs\":125,\"ClientTLSVersion\":\"TLS 1.3\",\"ConnectionCloseReason\":\"CLIENT_CLOSED\",\"ConnectionReuse\":false,\"DestinationTunnelID\":\"00000000-0000-0000-0000-000000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"EgressColoName\":\"ORD\",\"EgressIP\":\"2a02:cf40::23\",\"EgressPort\":41052,\"EgressRuleID\":\"00000000-0000-0000-0000-000000000000\",\"EgressRuleName\":\"Egress Rule 1\",\"Email\":\"user@test.com\",\"IngressColoName\":\"ORD\",\"Offramp\":\"INTERNET\",\"OriginIP\":\"89.160.20.129\",\"OriginPort\":80,\"OriginTLSCertificateIssuer\":\"DigiCert Inc\",\"OriginTLSCertificateValidationResult\":\"VALID\",\"OriginTLSCipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"OriginTLSHandshakeDurationMs\":130,\"OriginTLSVersion\":\"TLS 1.2\",\"Protocol\":\"TCP\",\"RuleEvaluationDurationMs\":10,\"SessionEndTime\":\"1683199754000000000\",\"SessionID\":\"18881f179300007fb0d06d6400000001\",\"SessionStartTime\":\"1683199754000000000\",\"SourceInternalIP\":\"1.128.0.1\",\"SourceIP\":\"67.43.156.2\",\"SourcePort\":52994,\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\",\"VirtualNetworkID\":\"0ce99869-63d3-4d5d-bdaf-d4f33df964aa\"}", + "start": "2023-05-04T11:29:14.000Z", "type": [ "connection" ] diff --git a/packages/cloudflare_logpush/data_stream/network_session/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/network_session/agent/stream/http_endpoint.yml.hbs index 8635df96428..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/network_session/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} diff --git a/packages/cloudflare_logpush/data_stream/network_session/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/network_session/elasticsearch/ingest_pipeline/default.yml index b48417a8031..01dc6658202 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/network_session/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Zero Trust Network Session logs. processors: - set: field: ecs.version - value: 8.7.0 + value: 8.9.0 - rename: field: message target_field: event.original @@ -21,22 +21,69 @@ processors: field: event.kind value: event # ECS fields - - convert: - field: json.SessionStartTime - type: string - ignore_missing: true - - gsub: - field: json.SessionStartTime - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_session_start_time_to_milli + if: ctx.json?.SessionStartTime != null + source: | + try { + long t; + if (ctx.json.SessionStartTime instanceof String) { + t = Long.parseLong(ctx.json.SessionStartTime); + } else if (ctx.json.SessionStartTime instanceof Number) { + t = (long)(ctx.json.SessionStartTime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.SessionStartTime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.SessionStartTime = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.SessionStartTime if: ctx.json?.SessionStartTime != null && ctx.json.SessionStartTime != '' formats: - UNIX_MS - - UNIX + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ssZ + timezone: UTC + on_failure: + - append: + field: error.message + value: "{{{_ingest.on_failure_message}}}" + - set: + field: json.SessionStartTime + copy_from: "@timestamp" + - script: + lang: painless + tag: painless_session_end_time_to_milli + if: ctx.json?.SessionEndTime != null + source: | + try { + long t; + if (ctx.json.SessionEndTime instanceof String) { + t = Long.parseLong(ctx.json.SessionEndTime); + } else if (ctx.json.SessionEndTime instanceof Number) { + t = (long)(ctx.json.SessionEndTime); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.SessionEndTime = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.SessionEndTime = t*(long)(1e3) + } + } + catch (Exception e) {} + - date: + field: json.SessionEndTime + target_field: json.SessionEndTime + if: ctx.json?.SessionEndTime != null && ctx.json.SessionEndTime != '' + formats: + - UNIX_MS - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC diff --git a/packages/cloudflare_logpush/data_stream/network_session/manifest.yml b/packages/cloudflare_logpush/data_stream/network_session/manifest.yml index 97da20e2e7b..3d5c27937d9 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/network_session/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/network_session/sample_event.json b/packages/cloudflare_logpush/data_stream/network_session/sample_event.json index ba60629570a..a04a3d5e633 100644 --- a/packages/cloudflare_logpush/data_stream/network_session/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/network_session/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-05-04T11:29:14.000Z", "agent": { - "ephemeral_id": "34032d6e-2a7f-4344-bd82-4bb85bb85eaa", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "10791184-35f0-4dd7-b44f-43617b758741", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "network_session": { @@ -112,12 +112,12 @@ "port": 80 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -128,7 +128,7 @@ "dataset": "cloudflare_logpush.network_session", "end": "2023-05-04T11:29:14Z", "id": "18881f179300007fb0d06d6400000001", - "ingested": "2023-06-12T08:15:47Z", + "ingested": "2023-07-25T07:38:48Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"BytesReceived\":679,\"BytesSent\":2333,\"ClientTCPHandshakeDurationMs\":12,\"ClientTLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"ClientTLSHandshakeDurationMs\":125,\"ClientTLSVersion\":\"TLS 1.3\",\"ConnectionCloseReason\":\"CLIENT_CLOSED\",\"ConnectionReuse\":false,\"DestinationTunnelID\":\"00000000-0000-0000-0000-000000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"EgressColoName\":\"ORD\",\"EgressIP\":\"2a02:cf40::23\",\"EgressPort\":41052,\"EgressRuleID\":\"00000000-0000-0000-0000-000000000000\",\"EgressRuleName\":\"Egress Rule 1\",\"Email\":\"user@test.com\",\"IngressColoName\":\"ORD\",\"Offramp\":\"INTERNET\",\"OriginIP\":\"89.160.20.129\",\"OriginPort\":80,\"OriginTLSCertificateIssuer\":\"DigiCert Inc\",\"OriginTLSCertificateValidationResult\":\"VALID\",\"OriginTLSCipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"OriginTLSHandshakeDurationMs\":130,\"OriginTLSVersion\":\"TLS 1.2\",\"Protocol\":\"TCP\",\"RuleEvaluationDurationMs\":10,\"SessionEndTime\":\"2023-05-04T11:29:14Z\",\"SessionID\":\"18881f179300007fb0d06d6400000001\",\"SessionStartTime\":\"2023-05-04T11:29:14Z\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"1.128.0.1\",\"SourcePort\":52994,\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\",\"VirtualNetworkID\":\"0ce99869-63d3-4d5d-bdaf-d4f33df964aa\"}", "start": "2023-05-04T11:29:14Z", diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log b/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log index 7fa7dac85cf..872ddc1e139 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log @@ -1 +1,3 @@ -{"Application":"7ef659a2f8ef4810a9bade96fdad7c75","ClientAsn":200391,"ClientBytes":0,"ClientCountry":"bg","ClientIP":"67.43.156.0","ClientMatchedIpFirewall":"UNKNOWN","ClientPort":40456,"ClientProto":"tcp","ClientTcpRtt":0,"ClientTlsCipher":"UNK","ClientTlsClientHelloServerName":"server name","ClientTlsProtocol":"TLSv1.2","ClientTlsStatus":"UNKNOWN","ColoCode":"SOF","ConnectTimestamp":"2022-05-26T09:24:00Z","DisconnectTimestamp":"1970-01-01T00:00:00Z","Event":"connect","IpFirewall":false,"OriginBytes":0,"OriginIP":"175.16.199.0","OriginPort":3389,"OriginProto":"tcp","OriginTcpRtt":0,"OriginTlsCipher":"UNK","OriginTlsFingerprint":"0000000000000000000000000000000000000000000000000000000000000000.","OriginTlsMode":"off","OriginTlsProtocol":"unknown","OriginTlsStatus":"UNKNOWN","ProxyProtocol":"off","Status":0,"Timestamp":"2022-05-26T09:24:00Z"} \ No newline at end of file +{"Application":"7ef659a2f8ef4810a9bade96fdad7c75","ClientAsn":200391,"ClientBytes":0,"ClientCountry":"bg","ClientIP":"67.43.156.0","ClientMatchedIpFirewall":"UNKNOWN","ClientPort":40456,"ClientProto":"tcp","ClientTcpRtt":0,"ClientTlsCipher":"UNK","ClientTlsClientHelloServerName":"server name","ClientTlsProtocol":"TLSv1.2","ClientTlsStatus":"UNKNOWN","ColoCode":"SOF","ConnectTimestamp":"2022-05-26T09:24:00Z","DisconnectTimestamp":"1970-01-01T00:00:00Z","Event":"connect","IpFirewall":false,"OriginBytes":0,"OriginIP":"175.16.199.0","OriginPort":3389,"OriginProto":"tcp","OriginTcpRtt":0,"OriginTlsCipher":"UNK","OriginTlsFingerprint":"0000000000000000000000000000000000000000000000000000000000000000.","OriginTlsMode":"off","OriginTlsProtocol":"unknown","OriginTlsStatus":"UNKNOWN","ProxyProtocol":"off","Status":0,"Timestamp":"2022-05-26T09:24:00Z"} +{"Application":"7ef659a2f8ef4810a9bade96fdad7c75","ClientAsn":200391,"ClientBytes":0,"ClientCountry":"bg","ClientIP":"67.43.156.0","ClientMatchedIpFirewall":"UNKNOWN","ClientPort":40456,"ClientProto":"tcp","ClientTcpRtt":0,"ClientTlsCipher":"UNK","ClientTlsClientHelloServerName":"server name","ClientTlsProtocol":"TLSv1.2","ClientTlsStatus":"UNKNOWN","ColoCode":"SOF","ConnectTimestamp":"1653557040","DisconnectTimestamp":"0","Event":"connect","IpFirewall":false,"OriginBytes":0,"OriginIP":"175.16.199.0","OriginPort":3389,"OriginProto":"tcp","OriginTcpRtt":0,"OriginTlsCipher":"UNK","OriginTlsFingerprint":"0000000000000000000000000000000000000000000000000000000000000000.","OriginTlsMode":"off","OriginTlsProtocol":"unknown","OriginTlsStatus":"UNKNOWN","ProxyProtocol":"off","Status":0,"Timestamp":"1653557040"} +{"Application":"7ef659a2f8ef4810a9bade96fdad7c75","ClientAsn":200391,"ClientBytes":0,"ClientCountry":"bg","ClientIP":"67.43.156.0","ClientMatchedIpFirewall":"UNKNOWN","ClientPort":40456,"ClientProto":"tcp","ClientTcpRtt":0,"ClientTlsCipher":"UNK","ClientTlsClientHelloServerName":"server name","ClientTlsProtocol":"TLSv1.2","ClientTlsStatus":"UNKNOWN","ColoCode":"SOF","ConnectTimestamp":"1653557040000000000","DisconnectTimestamp":"0","Event":"connect","IpFirewall":false,"OriginBytes":0,"OriginIP":"175.16.199.0","OriginPort":3389,"OriginProto":"tcp","OriginTcpRtt":0,"OriginTlsCipher":"UNK","OriginTlsFingerprint":"0000000000000000000000000000000000000000000000000000000000000000.","OriginTlsMode":"off","OriginTlsProtocol":"unknown","OriginTlsStatus":"UNKNOWN","ProxyProtocol":"off","Status":0,"Timestamp":"1653557040000000000"} diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log-expected.json b/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log-expected.json index 788ccd73be6..1d9b46ecb1d 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log-expected.json +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/_dev/test/pipeline/test-pipeline-spectrum-event.log-expected.json @@ -59,7 +59,7 @@ "port": 3389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connect", @@ -109,6 +109,226 @@ "version": "1.2", "version_protocol": "tls" } + }, + { + "@timestamp": "2022-05-26T09:24:00.000Z", + "cloudflare_logpush": { + "spectrum_event": { + "action": "connect", + "application": "7ef659a2f8ef4810a9bade96fdad7c75", + "client": { + "asn": 200391, + "bytes": 0, + "country": "bg", + "ip": "67.43.156.0", + "matched_ip_firewall": "UNKNOWN", + "port": 40456, + "protocol": "tcp", + "tcp_rtt": 0, + "tls": { + "cipher": "UNK", + "client_hello_server_name": "server name", + "protocol": "TLSv1.2", + "status": "UNKNOWN" + } + }, + "colo": { + "code": "SOF" + }, + "connect": { + "time": "2022-05-26T09:24:00.000Z" + }, + "disconnect": { + "time": "1970-01-01T00:00:00.000Z" + }, + "ip_firewall": false, + "origin": { + "bytes": 0, + "ip": "175.16.199.0", + "port": 3389, + "protocol": "tcp", + "tcp_rtt": 0, + "tls": { + "cipher": "UNK", + "fingerprint": "0000000000000000000000000000000000000000000000000000000000000000.", + "mode": "off", + "protocol": "unknown", + "status": "UNKNOWN" + } + }, + "proxy": { + "protocol": "off" + }, + "status": 0, + "timestamp": "2022-05-26T09:24:00.000Z" + } + }, + "destination": { + "bytes": 0, + "ip": "175.16.199.0", + "port": 3389 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connect", + "category": [ + "network" + ], + "end": "1970-01-01T00:00:00.000Z", + "id": "7ef659a2f8ef4810a9bade96fdad7c75", + "kind": "event", + "original": "{\"Application\":\"7ef659a2f8ef4810a9bade96fdad7c75\",\"ClientAsn\":200391,\"ClientBytes\":0,\"ClientCountry\":\"bg\",\"ClientIP\":\"67.43.156.0\",\"ClientMatchedIpFirewall\":\"UNKNOWN\",\"ClientPort\":40456,\"ClientProto\":\"tcp\",\"ClientTcpRtt\":0,\"ClientTlsCipher\":\"UNK\",\"ClientTlsClientHelloServerName\":\"server name\",\"ClientTlsProtocol\":\"TLSv1.2\",\"ClientTlsStatus\":\"UNKNOWN\",\"ColoCode\":\"SOF\",\"ConnectTimestamp\":\"1653557040\",\"DisconnectTimestamp\":\"0\",\"Event\":\"connect\",\"IpFirewall\":false,\"OriginBytes\":0,\"OriginIP\":\"175.16.199.0\",\"OriginPort\":3389,\"OriginProto\":\"tcp\",\"OriginTcpRtt\":0,\"OriginTlsCipher\":\"UNK\",\"OriginTlsFingerprint\":\"0000000000000000000000000000000000000000000000000000000000000000.\",\"OriginTlsMode\":\"off\",\"OriginTlsProtocol\":\"unknown\",\"OriginTlsStatus\":\"UNKNOWN\",\"ProxyProtocol\":\"off\",\"Status\":0,\"Timestamp\":\"1653557040\"}", + "start": "2022-05-26T09:24:00.000Z", + "type": [ + "info" + ] + }, + "http": { + "response": { + "status_code": 0 + } + }, + "network": { + "community_id": "1:X7lywUVKlduqRq5SyCRaBj4hLP0=", + "transport": "tcp" + }, + "related": { + "ip": [ + "67.43.156.0", + "175.16.199.0" + ] + }, + "source": { + "as": { + "number": 200391 + }, + "bytes": 0, + "geo": { + "country_iso_code": "bg" + }, + "ip": "67.43.156.0", + "port": 40456 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "version": "1.2", + "version_protocol": "tls" + } + }, + { + "@timestamp": "2022-05-26T09:24:00.000Z", + "cloudflare_logpush": { + "spectrum_event": { + "action": "connect", + "application": "7ef659a2f8ef4810a9bade96fdad7c75", + "client": { + "asn": 200391, + "bytes": 0, + "country": "bg", + "ip": "67.43.156.0", + "matched_ip_firewall": "UNKNOWN", + "port": 40456, + "protocol": "tcp", + "tcp_rtt": 0, + "tls": { + "cipher": "UNK", + "client_hello_server_name": "server name", + "protocol": "TLSv1.2", + "status": "UNKNOWN" + } + }, + "colo": { + "code": "SOF" + }, + "connect": { + "time": "2022-05-26T09:24:00.000Z" + }, + "disconnect": { + "time": "1970-01-01T00:00:00.000Z" + }, + "ip_firewall": false, + "origin": { + "bytes": 0, + "ip": "175.16.199.0", + "port": 3389, + "protocol": "tcp", + "tcp_rtt": 0, + "tls": { + "cipher": "UNK", + "fingerprint": "0000000000000000000000000000000000000000000000000000000000000000.", + "mode": "off", + "protocol": "unknown", + "status": "UNKNOWN" + } + }, + "proxy": { + "protocol": "off" + }, + "status": 0, + "timestamp": "2022-05-26T09:24:00.000Z" + } + }, + "destination": { + "bytes": 0, + "ip": "175.16.199.0", + "port": 3389 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connect", + "category": [ + "network" + ], + "end": "1970-01-01T00:00:00.000Z", + "id": "7ef659a2f8ef4810a9bade96fdad7c75", + "kind": "event", + "original": "{\"Application\":\"7ef659a2f8ef4810a9bade96fdad7c75\",\"ClientAsn\":200391,\"ClientBytes\":0,\"ClientCountry\":\"bg\",\"ClientIP\":\"67.43.156.0\",\"ClientMatchedIpFirewall\":\"UNKNOWN\",\"ClientPort\":40456,\"ClientProto\":\"tcp\",\"ClientTcpRtt\":0,\"ClientTlsCipher\":\"UNK\",\"ClientTlsClientHelloServerName\":\"server name\",\"ClientTlsProtocol\":\"TLSv1.2\",\"ClientTlsStatus\":\"UNKNOWN\",\"ColoCode\":\"SOF\",\"ConnectTimestamp\":\"1653557040000000000\",\"DisconnectTimestamp\":\"0\",\"Event\":\"connect\",\"IpFirewall\":false,\"OriginBytes\":0,\"OriginIP\":\"175.16.199.0\",\"OriginPort\":3389,\"OriginProto\":\"tcp\",\"OriginTcpRtt\":0,\"OriginTlsCipher\":\"UNK\",\"OriginTlsFingerprint\":\"0000000000000000000000000000000000000000000000000000000000000000.\",\"OriginTlsMode\":\"off\",\"OriginTlsProtocol\":\"unknown\",\"OriginTlsStatus\":\"UNKNOWN\",\"ProxyProtocol\":\"off\",\"Status\":0,\"Timestamp\":\"1653557040000000000\"}", + "start": "2022-05-26T09:24:00.000Z", + "type": [ + "info" + ] + }, + "http": { + "response": { + "status_code": 0 + } + }, + "network": { + "community_id": "1:X7lywUVKlduqRq5SyCRaBj4hLP0=", + "transport": "tcp" + }, + "related": { + "ip": [ + "67.43.156.0", + "175.16.199.0" + ] + }, + "source": { + "as": { + "number": 200391 + }, + "bytes": 0, + "geo": { + "country_iso_code": "bg" + }, + "ip": "67.43.156.0", + "port": 40456 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "tls": { + "version": "1.2", + "version_protocol": "tls" + } } ] } \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/spectrum_event/agent/stream/http_endpoint.yml.hbs index 53229700cc0..f4c666e78bd 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/agent/stream/http_endpoint.yml.hbs +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/agent/stream/http_endpoint.yml.hbs @@ -1,7 +1,6 @@ listen_address: {{listen_address}} listen_port: {{listen_port}} url: {{url}} -content_type: "" {{#if secret_header}} secret.header: {{secret_header}} {{/if}} @@ -16,13 +15,13 @@ preserve_duplicate_custom_fields: true {{/if}} tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields +- preserve_duplicate_custom_fields {{/if}} {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true @@ -33,4 +32,4 @@ ssl: {{ssl}} {{#if processors}} processors: {{processors}} -{{/if}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/spectrum_event/elasticsearch/ingest_pipeline/default.yml index da4a984df5b..7c8e945f703 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Cloudflare Spectrum Event logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -21,22 +21,32 @@ processors: - set: field: event.type value: [info] - - convert: - field: json.Timestamp - type: string - ignore_missing: true - - gsub: - field: json.Timestamp - pattern: (^[0-9]+)([0-9]{6}$) - replacement: $1 - ignore_missing: true - description: Convert timestamp's granularity from nanosecond to millisecond + - script: + lang: painless + tag: painless_timestamp_to_milli + if: ctx.json?.Timestamp != null + source: | + try { + long t; + if (ctx.json.Timestamp instanceof String) { + t = Long.parseLong(ctx.json.Timestamp); + } else if (ctx.json.Timestamp instanceof Number) { + t = (long)(ctx.json.Timestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.Timestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.Timestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.Timestamp if: ctx.json?.Timestamp != null && ctx.json.Timestamp != '' formats: - UNIX_MS - - UNIX - ISO8601 - yyyy-MM-dd'T'HH:mm:ssZ timezone: UTC @@ -48,6 +58,27 @@ processors: field: cloudflare_logpush.spectrum_event.timestamp copy_from: '@timestamp' ignore_failure: true + - script: + lang: painless + tag: painless_connect_timestamp_to_milli + if: ctx.json?.ConnectTimestamp != null + source: | + try { + long t; + if (ctx.json.ConnectTimestamp instanceof String) { + t = Long.parseLong(ctx.json.ConnectTimestamp); + } else if (ctx.json.ConnectTimestamp instanceof Number) { + t = (long)(ctx.json.ConnectTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.ConnectTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.ConnectTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.ConnectTimestamp if: ctx.json?.ConnectTimestamp != null && ctx.json.ConnectTimestamp != '' @@ -68,6 +99,27 @@ processors: field: event.start copy_from: cloudflare_logpush.spectrum_event.connect.time ignore_failure: true + - script: + lang: painless + tag: painless_disconnect_timestamp_to_milli + if: ctx.json?.DisconnectTimestamp != null + source: | + try { + long t; + if (ctx.json.DisconnectTimestamp instanceof String) { + t = Long.parseLong(ctx.json.DisconnectTimestamp); + } else if (ctx.json.DisconnectTimestamp instanceof Number) { + t = (long)(ctx.json.DisconnectTimestamp); + } else { + return; + } + if (t > (long)(1e18)) { + ctx.json.DisconnectTimestamp = t/(long)(1e6) + } else if (t < (long)(1e10)) { + ctx.json.DisconnectTimestamp = t*(long)(1e3) + } + } + catch (Exception e) {} - date: field: json.DisconnectTimestamp if: ctx.json?.DisconnectTimestamp != null && ctx.json.DisconnectTimestamp != '' diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/manifest.yml b/packages/cloudflare_logpush/data_stream/spectrum_event/manifest.yml index 654a9e97ae9..62618573875 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/manifest.yml +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/manifest.yml @@ -82,7 +82,7 @@ streams: required: false show_user: true default: 1m - description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + description: Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s. - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 300s - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: '[SQS] API Timeout' @@ -106,7 +106,7 @@ streams: required: false show_user: true default: 120s - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -192,7 +192,7 @@ streams: required: false show_user: true default: 120s - description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h. - name: buckets type: yaml title: Buckets diff --git a/packages/cloudflare_logpush/data_stream/spectrum_event/sample_event.json b/packages/cloudflare_logpush/data_stream/spectrum_event/sample_event.json index 9eb2cb2dd54..0933db06afd 100644 --- a/packages/cloudflare_logpush/data_stream/spectrum_event/sample_event.json +++ b/packages/cloudflare_logpush/data_stream/spectrum_event/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-26T09:24:00.000Z", "agent": { - "ephemeral_id": "68aa0fb3-4da4-4501-ac49-30f69891f141", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "ff280729-a1df-48bc-bca4-643e1848944d", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "spectrum_event": { @@ -69,12 +69,12 @@ "port": 3389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "connect", @@ -85,7 +85,7 @@ "dataset": "cloudflare_logpush.spectrum_event", "end": "1970-01-01T00:00:00.000Z", "id": "7ef659a2f8ef4810a9bade96fdad7c75", - "ingested": "2023-06-12T08:16:29Z", + "ingested": "2023-07-25T07:39:33Z", "kind": "event", "original": "{\"Application\":\"7ef659a2f8ef4810a9bade96fdad7c75\",\"ClientAsn\":200391,\"ClientBytes\":0,\"ClientCountry\":\"bg\",\"ClientIP\":\"67.43.156.0\",\"ClientMatchedIpFirewall\":\"UNKNOWN\",\"ClientPort\":40456,\"ClientProto\":\"tcp\",\"ClientTcpRtt\":0,\"ClientTlsCipher\":\"UNK\",\"ClientTlsClientHelloServerName\":\"server name\",\"ClientTlsProtocol\":\"unknown\",\"ClientTlsStatus\":\"UNKNOWN\",\"ColoCode\":\"SOF\",\"ConnectTimestamp\":\"2022-05-26T09:24:00Z\",\"DisconnectTimestamp\":\"1970-01-01T00:00:00Z\",\"Event\":\"connect\",\"IpFirewall\":false,\"OriginBytes\":0,\"OriginIP\":\"175.16.199.0\",\"OriginPort\":3389,\"OriginProto\":\"tcp\",\"OriginTcpRtt\":0,\"OriginTlsCipher\":\"UNK\",\"OriginTlsFingerprint\":\"0000000000000000000000000000000000000000000000000000000000000000.\",\"OriginTlsMode\":\"off\",\"OriginTlsProtocol\":\"unknown\",\"OriginTlsStatus\":\"UNKNOWN\",\"ProxyProtocol\":\"off\",\"Status\":0,\"Timestamp\":\"2022-05-26T09:24:00Z\"}", "start": "2022-05-26T09:24:00.000Z", diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-common-config.yml b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log new file mode 100644 index 00000000000..8101f6a7f0e --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log @@ -0,0 +1,2 @@ +{"Event":{"RayID":"7e9ae7157ac0c33a","Request":{"URL":"http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog","Method":"GET"},"Response":{"Status":404}},"EventTimestampMs":1689852946804,"EventType":"fetch","Exceptions":[{"Message":"Uncaught TypeError: Cannot read property 'x' of undefined","Stack":"TypeError: Cannot read property 'x' of undefined\n at fetchHandler (/workers/script.js:12:27)\n at handleRequest (/workers/script.js:6:13)"}],"Logs":[{"level":"info","message":"Request received for /api/data"},{"level":"error","message":"Something went wrong"}],"Outcome":"exception","ScriptName":"chat-gpt-little-butterfly-0c3d","ScriptTags":["api","chatgpt"],"DispatchNamespace":"my-worker-dispatch"} +{"Event":{"RayID":"7e9ab8407cddceb5","Request":{"URL":"https://basic-bundle-broken-darkness-00e7.example.workers.dev/","Method":"GET"},"Response":{"Status":200}},"EventTimestampMs":1689851028562,"EventType":"fetch","Exceptions":[],"Logs":[],"Outcome":"ok","ScriptName":"basic-bundle-broken-darkness-00e7","ScriptTags":["api","example"]} diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log-expected.json b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log-expected.json new file mode 100644 index 00000000000..306216d6cbf --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/pipeline/test-pipeline-workers-trace.log-expected.json @@ -0,0 +1,144 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-20T11:35:46.804Z", + "cloudflare_logpush": { + "workers_trace": { + "dispatch_namespace": "my-worker-dispatch", + "event": { + "ray_id": "7e9ae7157ac0c33a", + "request": { + "method": "GET", + "url": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog" + }, + "response": { + "status": 404 + } + }, + "exceptions": [ + { + "message": "Uncaught TypeError: Cannot read property 'x' of undefined", + "stack": "TypeError: Cannot read property 'x' of undefined\n at fetchHandler (/workers/script.js:12:27)\n at handleRequest (/workers/script.js:6:13)" + } + ], + "logs": [ + { + "level": "info", + "message": "Request received for /api/data" + }, + { + "level": "error", + "message": "Something went wrong" + } + ], + "outcome": "exception", + "script": { + "name": "chat-gpt-little-butterfly-0c3d", + "tags": [ + "api", + "chatgpt" + ] + }, + "timestamp": "2023-07-20T11:35:46.804Z", + "type": "fetch" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "fetch", + "category": [ + "web" + ], + "id": "7e9ae7157ac0c33a", + "kind": "event", + "original": "{\"Event\":{\"RayID\":\"7e9ae7157ac0c33a\",\"Request\":{\"URL\":\"http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog\",\"Method\":\"GET\"},\"Response\":{\"Status\":404}},\"EventTimestampMs\":1689852946804,\"EventType\":\"fetch\",\"Exceptions\":[{\"Message\":\"Uncaught TypeError: Cannot read property 'x' of undefined\",\"Stack\":\"TypeError: Cannot read property 'x' of undefined\\n at fetchHandler (/workers/script.js:12:27)\\n at handleRequest (/workers/script.js:6:13)\"}],\"Logs\":[{\"level\":\"info\",\"message\":\"Request received for /api/data\"},{\"level\":\"error\",\"message\":\"Something went wrong\"}],\"Outcome\":\"exception\",\"ScriptName\":\"chat-gpt-little-butterfly-0c3d\",\"ScriptTags\":[\"api\",\"chatgpt\"],\"DispatchNamespace\":\"my-worker-dispatch\"}", + "outcome": "failure", + "type": [ + "info", + "error" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 404 + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "chat-gpt-little-butterfly-0c3d.example.workers.dev", + "original": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog", + "path": "/v2/_catalog", + "scheme": "http" + } + }, + { + "@timestamp": "2023-07-20T11:03:48.562Z", + "cloudflare_logpush": { + "workers_trace": { + "event": { + "ray_id": "7e9ab8407cddceb5", + "request": { + "method": "GET", + "url": "https://basic-bundle-broken-darkness-00e7.example.workers.dev/" + }, + "response": { + "status": 200 + } + }, + "outcome": "ok", + "script": { + "name": "basic-bundle-broken-darkness-00e7", + "tags": [ + "api", + "example" + ] + }, + "timestamp": "2023-07-20T11:03:48.562Z", + "type": "fetch" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "fetch", + "category": [ + "web" + ], + "id": "7e9ab8407cddceb5", + "kind": "event", + "original": "{\"Event\":{\"RayID\":\"7e9ab8407cddceb5\",\"Request\":{\"URL\":\"https://basic-bundle-broken-darkness-00e7.example.workers.dev/\",\"Method\":\"GET\"},\"Response\":{\"Status\":200}},\"EventTimestampMs\":1689851028562,\"EventType\":\"fetch\",\"Exceptions\":[],\"Logs\":[],\"Outcome\":\"ok\",\"ScriptName\":\"basic-bundle-broken-darkness-00e7\",\"ScriptTags\":[\"api\",\"example\"]}", + "outcome": "success", + "type": [ + "info" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 200 + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "basic-bundle-broken-darkness-00e7.example.workers.dev", + "original": "https://basic-bundle-broken-darkness-00e7.example.workers.dev/", + "path": "/", + "scheme": "https" + } + } + ] +} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/system/test-http-endpoint-config.yml b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/system/test-http-endpoint-config.yml new file mode 100644 index 00000000000..be21b9c325f --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/_dev/test/system/test-http-endpoint-config.yml @@ -0,0 +1,10 @@ +service: cloudflare-logpush-workers-trace-http-endpoint +service_notify_signal: SIGHUP +input: http_endpoint +vars: + listen_address: 0.0.0.0 +data_stream: + vars: + listen_port: 9574 + preserve_original_event: true + preserve_duplicate_custom_fields: true diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/aws-s3.yml.hbs b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..c31f1e2ec98 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,90 @@ +{{#if collect_s3_logs}} + +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url_workers_trace}} +queue_url: {{queue_url_workers_trace}} +{{else if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{#if file_selectors}} +file_selectors: +{{file_selectors}} +{{/if}} + +{{/if}} + +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if endpoint}} +endpoint: {{endpoint}} +{{/if}} +{{#if default_region}} +default_region: {{default_region}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url}} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if collect_s3_logs}} +- collect_s3_logs +{{else}} +- collect_sqs_logs +{{/if}} +{{#if preserve_original_event}} +- preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} +- preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} +- {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/gcs.yml.hbs b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/gcs.yml.hbs new file mode 100644 index 00000000000..521a27fa03d --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/gcs.yml.hbs @@ -0,0 +1,38 @@ +{{#if project_id}} +project_id: {{project_id}} +{{/if}} +{{#if service_account_key}} +auth.credentials_json.account_key: {{service_account_key}} +{{/if}} +{{#if service_account_file}} +auth.credentials_file.path: {{service_account_file}} +{{/if}} +{{#if number_of_workers}} +max_workers: {{number_of_workers}} +{{/if}} +{{#if poll}} +poll: {{poll}} +{{/if}} +{{#if poll_interval}} +poll_interval: {{poll_interval}} +{{/if}} +{{#if bucket_timeout}} +bucket_timeout: {{bucket_timeout}} +{{/if}} +{{#if buckets}} +buckets: +{{buckets}} +{{/if}} +{{#if tags}} +tags: +{{#each tags as |tag|}} +- {{tag}} +{{/each}} +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/http_endpoint.yml.hbs b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/http_endpoint.yml.hbs new file mode 100644 index 00000000000..f4c666e78bd --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/agent/stream/http_endpoint.yml.hbs @@ -0,0 +1,35 @@ +listen_address: {{listen_address}} +listen_port: {{listen_port}} +url: {{url}} +{{#if secret_header}} +secret.header: {{secret_header}} +{{/if}} +{{#if secret_value}} +secret.value: {{secret_value}} +{{/if}} +{{#if preserve_original_event}} +preserve_original_event: true +{{/if}} +{{#if preserve_duplicate_custom_fields}} +preserve_duplicate_custom_fields: true +{{/if}} +tags: +{{#if preserve_original_event}} +- preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} +- preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} +- {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if ssl}} +ssl: {{ssl}} +{{/if}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/elasticsearch/ingest_pipeline/default.yml b/packages/cloudflare_logpush/data_stream/workers_trace/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..688dbbd591d --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,219 @@ +--- +description: Pipeline for parsing Cloudflare Workers Trace Event logs. +processors: + - set: + field: ecs.version + value: 8.9.0 + tag: set_ecs_version + - rename: + field: message + target_field: event.original + ignore_missing: true + tag: rename_event_original + - json: + field: event.original + target_field: json + tag: json_event_original + - set: + field: event.category + value: [web] + tag: set_event_category + - set: + field: event.type + value: [info] + tag: set_event_type + - set: + field: event.kind + value: event + tag: set_event_kind + + # Timestamp + - date: + field: json.EventTimestampMs + if: ctx.json?.EventTimestampMs != null && ctx.json.EventTimestampMs != '' + formats: + - UNIX_MS + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ssZ + timezone: UTC + tag: date_event_timestamp + on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: cloudflare_logpush.workers_trace.timestamp + copy_from: "@timestamp" + tag: set_timestamp + + # ECS fields + - rename: + field: json.EventType + target_field: cloudflare_logpush.workers_trace.type + ignore_missing: true + tag: rename_event_type + - set: + field: event.action + copy_from: cloudflare_logpush.workers_trace.type + tag: set_event_action + + # Set event.outcome + - rename: + field: json.Outcome + target_field: cloudflare_logpush.workers_trace.outcome + ignore_missing: true + tag: rename_outcome + - set: + field: event.outcome + value: success + if: ctx.cloudflare_logpush?.workers_trace?.outcome == 'ok' + tag: set_event_outcome_success + - set: + field: event.outcome + value: failure + if: ctx.cloudflare_logpush?.workers_trace?.outcome == 'exception' + tag: set_event_outcome_failure + - append: + field: event.type + value: error + allow_duplicates: false + if: ctx.event?.outcome == 'failure' + tag: append_event_type_error + + # Custom fields + - rename: + field: json.DispatchNamespace + target_field: cloudflare_logpush.workers_trace.dispatch_namespace + ignore_missing: true + tag: rename_dispatch_namespace + - rename: + field: json.Event + target_field: cloudflare_logpush.workers_trace.event + ignore_missing: true + tag: rename_event + - rename: + field: json.Exceptions + target_field: cloudflare_logpush.workers_trace.exceptions + ignore_missing: true + tag: rename_exceptions + - rename: + field: json.Logs + target_field: cloudflare_logpush.workers_trace.logs + ignore_missing: true + tag: rename_logs + - rename: + field: json.ScriptName + target_field: cloudflare_logpush.workers_trace.script.name + ignore_missing: true + tag: rename_script_name + - rename: + field: json.ScriptTags + target_field: cloudflare_logpush.workers_trace.script.tags + ignore_missing: true + tag: rename_script_tags + + - script: + description: Convert Workers Trace Events keys to snake case recursively. + tag: script_convert_snake_case + lang: painless + source: |- + Map keysToSnakeCase(Map m) { + def regex = /([a-z])([A-Z]+)/; + def out = [:]; + + for (entry in m.entrySet()) { + def k = entry.getKey(); + def v = entry.getValue(); + + if (v instanceof Map) { + v = keysToSnakeCase(v); + } else if (v instanceof List) { + for (int i = 0; i < v.size(); i++) { + def item = v.get(i); + if (item instanceof Map) { + v.set(i, keysToSnakeCase(item)); + } + } + } + + k = regex.matcher(k).replaceAll('$1_$2').toLowerCase(); + out.put(k, v); + } + + return out; + } + + ctx.cloudflare_logpush['workers_trace'] = keysToSnakeCase(ctx.cloudflare_logpush.workers_trace); + + - set: + field: event.id + copy_from: cloudflare_logpush.workers_trace.event.ray_id + ignore_empty_value: true + tag: set_event_id + - set: + field: http.request.method + copy_from: cloudflare_logpush.workers_trace.event.request.method + ignore_empty_value: true + tag: set_http_request_method + - set: + field: http.response.status_code + copy_from: cloudflare_logpush.workers_trace.event.response.status + ignore_empty_value: true + tag: set_http_response_status + - uri_parts: + field: cloudflare_logpush.workers_trace.event.request.url + target_field: url + if: ctx.cloudflare_logpush?.workers_trace?.event?.request?.url != null + tag: uri_parts_http_url + + # Clean event + - remove: + field: json + ignore_missing: true + tag: remove_json + - remove: + field: + - cloudflare_logpush.workers_trace.event.ray_id + - cloudflare_logpush.workers_trace.event.request.method + - cloudflare_logpush.workers_trace.event.request.url + - cloudflare_logpush.workers_trace.event.response.status + - cloudflare_logpush.workers_trace.outcome + - cloudflare_logpush.workers_trace.timestamp + - cloudflare_logpush.workers_trace.type + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + ignore_failure: true + ignore_missing: true + tag: remove_duplicated_custom_fields + - remove: + field: event.original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + ignore_failure: true + ignore_missing: true + tag: remove_event_original + - script: + description: Drops null/empty values recursively. + tag: script_drop_empty_fields + lang: painless + source: |- + boolean dropEmptyFields(Object object) { + if (object == null || object == "") { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(value -> dropEmptyFields(value)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(value -> dropEmptyFields(value)); + return (((List) object).length == 0); + } + return false; + } + dropEmptyFields(ctx); +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/fields/agent.yml b/packages/cloudflare_logpush/data_stream/workers_trace/fields/agent.yml new file mode 100644 index 00000000000..73e076a93b1 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/fields/agent.yml @@ -0,0 +1,186 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization ID used to identify different entities in a multi-tenant environment. Examples: AWS account ID, Google Cloud ORG ID, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container ID. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host ID. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host IP addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + +- name: input.type + type: keyword + description: Input type +- name: log.offset + type: long + description: Log offset diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/fields/base-fields.yml b/packages/cloudflare_logpush/data_stream/workers_trace/fields/base-fields.yml new file mode 100644 index 00000000000..773a75b6497 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: cloudflare_logpush.workers_trace +- name: event.module + type: constant_keyword + description: Event module. + value: cloudflare_logpush diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/fields/ecs.yml b/packages/cloudflare_logpush/data_stream/workers_trace/fields/ecs.yml new file mode 100644 index 00000000000..8993427eec6 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/fields/ecs.yml @@ -0,0 +1,48 @@ +- external: ecs + name: ecs.version +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.id +- external: ecs + name: event.kind +- external: ecs + name: event.original +- external: ecs + name: event.type +- external: ecs + name: http.request.method +- external: ecs + name: http.response.status_code +- external: ecs + name: tags +- external: ecs + name: url.domain +- external: ecs + name: url.extension +- external: ecs + name: url.fragment +- external: ecs + name: url.full +- external: ecs + name: url.original +- external: ecs + name: url.password +- external: ecs + name: url.path +- external: ecs + name: url.port +- external: ecs + name: url.query +- external: ecs + name: url.registered_domain +- external: ecs + name: url.scheme +- external: ecs + name: url.subdomain +- external: ecs + name: url.top_level_domain +- external: ecs + name: url.username diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/fields/fields.yml b/packages/cloudflare_logpush/data_stream/workers_trace/fields/fields.yml new file mode 100644 index 00000000000..753fa16f0ab --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/fields/fields.yml @@ -0,0 +1,37 @@ +- name: cloudflare_logpush.workers_trace + type: group + description: Integration for parsing Cloudflare Workers Trace Event logs. + fields: + - name: dispatch_namespace + type: keyword + description: The Cloudflare Worker dispatch namespace. + - name: event + type: flattened + description: Details about the source event. + - name: exceptions + type: flattened + description: List of uncaught exceptions during the invocation. + - name: logs + type: flattened + description: List of console messages emitted during the invocation. + - name: outcome + type: keyword + description: The outcome of the worker script invocation. Possible values are ok | exception. + - name: script + type: group + fields: + - name: name + type: keyword + description: The Cloudflare Worker script name. + - name: tags + type: keyword + description: A list of user-defined tags used to categorize the Worker. + - name: timestamp + type: date + description: The timestamp of when the event was received. + - name: type + type: keyword + description: The event type that triggered the invocation. +- name: log.source.address + type: keyword + description: Source address from which the log event was read / sent from. diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/manifest.yml b/packages/cloudflare_logpush/data_stream/workers_trace/manifest.yml new file mode 100644 index 00000000000..e48875c038a --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/manifest.yml @@ -0,0 +1,231 @@ +title: Collect Workers Trace Event logs from Cloudflare +type: logs +streams: + - input: http_endpoint + template_path: http_endpoint.yml.hbs + title: Workers Trace Event logs + description: Collect Workers Trace Event logs from Cloudflare via HTTP endpoint. + vars: + - name: listen_port + type: integer + title: Listen Port + description: The port number the listener binds to. + multi: false + required: true + show_user: true + default: 9574 + - name: url + type: text + title: URL + description: This option specifies which URL path to accept requests on. Defaults to /. + multi: false + required: false + show_user: false + default: / + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - cloudflare_logpush-workers_trace + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: true + title: Preserve duplicate custom fields + description: Preserve custom fields for all ECS mappings. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: aws-s3 + title: Workers Trace Event logs + description: Collect Workers Trace Event logs from Cloudflare via S3 or SQS. + template_path: aws-s3.yml.hbs + vars: + - name: queue_url_workers_trace + type: text + title: "[Workers Trace Event][SQS] Queue URL" + multi: false + required: false + show_user: true + description: "URL of the AWS SQS queue that messages will be received from.\nThis is only required if you want to collect logs via AWS SQS.\nThis is a Workers Trace Event data stream specific queue URL. This will override the global queue URL if provided." + - name: bucket_list_prefix + type: text + title: '[S3] Bucket Prefix' + multi: false + required: false + show_user: true + default: workers_trace + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: '[S3] Interval' + multi: false + required: false + show_user: true + default: 1m + description: Time interval for polling listing of the S3 bucket. NOTE:- Supported units for this parameter are h/m/s. + - name: number_of_workers + type: integer + title: '[S3] Number of Workers' + multi: false + required: false + show_user: true + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: visibility_timeout + type: text + title: '[SQS] Visibility Timeout' + multi: false + required: false + show_user: true + default: 300s + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + - name: api_timeout + type: text + title: '[SQS] API Timeout' + multi: false + required: false + show_user: true + default: 120s + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + - name: max_number_of_messages + type: integer + title: '[SQS] Maximum Concurrent SQS Messages' + required: false + show_user: true + default: 5 + description: The maximum number of SQS messages that can be inflight at any time. + - name: file_selectors + type: yaml + title: '[SQS] File Selectors' + multi: false + required: false + show_user: false + default: | + - regex: 'workers_trace/' + description: If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - cloudflare_logpush-workers_trace + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: true + title: Preserve duplicate custom fields + description: Preserve custom fields for all ECS mappings. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: gcs + title: Workers Trace Event logs + description: Collect Workers Trace Event logs from Cloudflare via GCS. + template_path: gcs.yml.hbs + vars: + - name: number_of_workers + type: integer + title: 'Maximum number of workers' + multi: false + required: false + show_user: true + default: 3 + description: Determines how many workers are spawned per bucket. + - name: poll + type: bool + title: 'Polling' + multi: false + required: false + show_user: true + default: true + description: Determines if the bucket will be continuously polled for new documents. + - name: poll_interval + type: text + title: 'Polling interval' + multi: false + required: false + show_user: true + default: 15s + description: Determines the time interval between polling operations. + - name: bucket_timeout + type: text + title: 'Bucket Timeout' + multi: false + required: false + show_user: true + default: 120s + description: Defines the maximum time that the sdk will wait for a bucket api response before timing out. + - name: buckets + type: yaml + title: Buckets + description: "This attribute contains the details about a specific bucket like, name, number_of_workers, poll, poll_interval and bucket_timeout. The attribute 'name' is specific to a bucket as it describes the bucket name, while the fields number_of_workers, poll, poll_interval and bucket_timeout can exist both at the bucket level and at the global level. If you have already defined the attributes globally, then you can only specify the name in this yaml config. If you want to override any specific attribute for a specific bucket, then, you can define it here. Any attribute defined in the yaml will override the global definitions. Please see the relevant [Documentation](https://www.elastic.co/guide/en/beats/filebeat/8.5/filebeat-input-gcs.html#attrib-buckets) for further information.\n" + required: true + show_user: true + default: | + # You can define as many buckets as you want here. + + - name: workers_trace_logs + - name: workers_trace_logs_2 + + # The config below is an example of how to override the global config. + + #- name: workers_trace_logs_3 + # number_of_workers: 3 + # poll: true + # poll_interval: 10s + # bucket_timeout: 30s + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: | + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - cloudflare_logpush-workers_trace diff --git a/packages/cloudflare_logpush/data_stream/workers_trace/sample_event.json b/packages/cloudflare_logpush/data_stream/workers_trace/sample_event.json new file mode 100644 index 00000000000..e7f24b26d03 --- /dev/null +++ b/packages/cloudflare_logpush/data_stream/workers_trace/sample_event.json @@ -0,0 +1,104 @@ +{ + "@timestamp": "2023-07-20T11:35:46.804Z", + "agent": { + "ephemeral_id": "1c895f67-5aeb-479b-b5af-8fcfceef87f6", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.1" + }, + "cloudflare_logpush": { + "workers_trace": { + "dispatch_namespace": "my-worker-dispatch", + "event": { + "ray_id": "7e9ae7157ac0c33a", + "request": { + "method": "GET", + "url": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog" + }, + "response": { + "status": 404 + } + }, + "exceptions": [ + { + "message": "Uncaught TypeError: Cannot read property 'x' of undefined", + "stack": "TypeError: Cannot read property 'x' of undefined\n at fetchHandler (/workers/script.js:12:27)\n at handleRequest (/workers/script.js:6:13)" + } + ], + "logs": [ + { + "level": "info", + "message": "Request received for /api/data" + }, + { + "level": "error", + "message": "Something went wrong" + } + ], + "outcome": "exception", + "script": { + "name": "chat-gpt-little-butterfly-0c3d", + "tags": [ + "api", + "chatgpt" + ] + }, + "timestamp": "2023-07-20T11:35:46.804Z", + "type": "fetch" + } + }, + "data_stream": { + "dataset": "cloudflare_logpush.workers_trace", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", + "snapshot": false, + "version": "8.8.1" + }, + "event": { + "action": "fetch", + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "cloudflare_logpush.workers_trace", + "id": "7e9ae7157ac0c33a", + "ingested": "2023-07-25T07:40:19Z", + "kind": "event", + "original": "{\"DispatchNamespace\":\"my-worker-dispatch\",\"Event\":{\"RayID\":\"7e9ae7157ac0c33a\",\"Request\":{\"Method\":\"GET\",\"URL\":\"http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog\"},\"Response\":{\"Status\":404}},\"EventTimestampMs\":1689852946804,\"EventType\":\"fetch\",\"Exceptions\":[{\"Message\":\"Uncaught TypeError: Cannot read property 'x' of undefined\",\"Stack\":\"TypeError: Cannot read property 'x' of undefined\\n at fetchHandler (/workers/script.js:12:27)\\n at handleRequest (/workers/script.js:6:13)\"}],\"Logs\":[{\"level\":\"info\",\"message\":\"Request received for /api/data\"},{\"level\":\"error\",\"message\":\"Something went wrong\"}],\"Outcome\":\"exception\",\"ScriptName\":\"chat-gpt-little-butterfly-0c3d\",\"ScriptTags\":[\"api\",\"chatgpt\"]}", + "outcome": "failure", + "type": [ + "info", + "error" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 404 + } + }, + "input": { + "type": "http_endpoint" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "cloudflare_logpush-workers_trace" + ], + "url": { + "domain": "chat-gpt-little-butterfly-0c3d.example.workers.dev", + "original": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog", + "path": "/v2/_catalog", + "scheme": "http" + } +} \ No newline at end of file diff --git a/packages/cloudflare_logpush/docs/README.md b/packages/cloudflare_logpush/docs/README.md index 5bcc84c13a5..37b7874ebf4 100644 --- a/packages/cloudflare_logpush/docs/README.md +++ b/packages/cloudflare_logpush/docs/README.md @@ -2,7 +2,7 @@ ## Overview -The [Cloudflare Logpush](https://www.cloudflare.com/) integration allows you to monitor Access Request, Audit, CASB, Device Posture, DNS, Firewall Event, Gateway DNS, Gateway HTTP, Gateway Network, HTTP Request, NEL Report, Network Analytics, Spectrum Event and Network Session logs. Cloudflare is a content delivery network and DDoS mitigation company. Cloudflare provides a network designed to make everything you connect to the Internet secure, private, fast, and reliable; secure your websites, APIs, and Internet applications; protect corporate networks, employees, and devices; and write and deploy code that runs on the network edge. +The [Cloudflare Logpush](https://www.cloudflare.com/) integration allows you to monitor Access Request, Audit, CASB, Device Posture, DNS, Firewall Event, Gateway DNS, Gateway HTTP, Gateway Network, HTTP Request, NEL Report, Network Analytics, Spectrum Event, Network Session and Workers Trace Events logs. Cloudflare is a content delivery network and DDoS mitigation company. Cloudflare provides a network designed to make everything you connect to the Internet secure, private, fast, and reliable; secure your websites, APIs, and Internet applications; protect corporate networks, employees, and devices; and write and deploy code that runs on the network edge. The Cloudflare Logpush integration can be used in three different modes to collect data: - HTTP Endpoint mode - Cloudflare pushes logs directly to an HTTP endpoint hosted by your Elastic Agent. @@ -47,6 +47,8 @@ The Cloudflare Logpush integration collects logs for the following types of even **Spectrum Event**: See Example Schema [here](https://developers.cloudflare.com/logs/reference/log-fields/zone/spectrum_events/). +**Workers Trace Events**: See Example Schema [here](https://developers.cloudflare.com/logs/reference/log-fields/account/workers_trace_events/). + ## Requirements You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware. @@ -77,6 +79,7 @@ This module has been tested against **Cloudflare version v4**. | Network Analytics | network_analytics_logs | | Zero Trust Network Session | network_session | | Spectrum Event | spectrum_event | + | Workers Trace Events | workers_trace | ### To collect data from AWS SQS, follow the below steps: 1. If data forwarding to an AWS S3 Bucket hasn't been configured, then first setup an AWS S3 Bucket as mentioned in the above documentation. @@ -145,11 +148,11 @@ An example event for `access_request` looks as following: { "@timestamp": "2023-05-23T17:18:33.000Z", "agent": { - "ephemeral_id": "3411f8c1-29fc-49d3-b0ac-c50c21b18620", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "85b9b34b-5ff7-4928-aa51-47f2558ce97d", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "client": { "as": { @@ -206,12 +209,12 @@ An example event for `access_request` looks as following: "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "login", @@ -221,7 +224,7 @@ An example event for `access_request` looks as following: ], "dataset": "cloudflare_logpush.access_request", "id": "00c0ffeeabc12345", - "ingested": "2023-06-12T08:07:41Z", + "ingested": "2023-07-25T07:29:19Z", "kind": "event", "original": "{\"Action\":\"login\",\"Allowed\":true,\"AppDomain\":\"partner-zt-logs.cloudflareaccess.com/warp\",\"AppUUID\":\"123e4567-e89b-12d3-a456-426614174000\",\"Connection\":\"onetimepin\",\"Country\":\"us\",\"CreatedAt\":1684862313000000000,\"Email\":\"user@example.com\",\"IPAddress\":\"67.43.156.93\",\"PurposeJustificationPrompt\":\"Please provide your reason for accessing the application.\",\"PurposeJustificationResponse\":\"I need to access the application for work purposes.\",\"RayID\":\"00c0ffeeabc12345\",\"TemporaryAccessApprovers\":[\"approver1@example.com\",\"approver2@example.com\"],\"TemporaryAccessDuration\":7200,\"UserUID\":\"166befbb-00e3-5e20-bd6e-27245333949f\"}", "type": [ @@ -313,10 +316,10 @@ An example event for `access_request` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -361,11 +364,11 @@ An example event for `audit` looks as following: { "@timestamp": "2021-11-30T20:19:48.000Z", "agent": { - "ephemeral_id": "cb8c8de0-104f-4c62-977f-1344e6c37ded", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "a5eb9e51-5d15-4f28-8e87-5f798dba39bc", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "audit": { @@ -409,12 +412,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "token_create", @@ -424,7 +427,7 @@ An example event for `audit` looks as following: ], "dataset": "cloudflare_logpush.audit", "id": "73fd39ed-5aab-4a2a-b93c-c9a4abf0c425", - "ingested": "2023-06-12T08:08:21Z", + "ingested": "2023-07-25T07:30:08Z", "kind": "event", "original": "{\"ActionResult\":true,\"ActionType\":\"token_create\",\"ActorEmail\":\"user@example.com\",\"ActorID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ActorIP\":\"81.2.69.142\",\"ActorType\":\"user\",\"ID\":\"73fd39ed-5aab-4a2a-b93c-c9a4abf0c425\",\"Interface\":\"UI\",\"Metadata\":{\"token_name\":\"test\",\"token_tag\":\"b7261c49a793a82678d12285f0bc1401\"},\"NewValue\":{\"key1\":\"value1\",\"key2\":\"value2\"},\"OldValue\":{\"key3\":\"value4\",\"key4\":\"value4\"},\"OwnerID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceID\":\"enl3j9du8rnx2swwd9l32qots7l54t9s\",\"ResourceType\":\"account\",\"When\":\"2021-11-30T20:19:48Z\"}", "outcome": "success", @@ -499,10 +502,10 @@ An example event for `audit` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -549,11 +552,11 @@ An example event for `casb` looks as following: { "@timestamp": "2023-05-16T10:00:00.000Z", "agent": { - "ephemeral_id": "65c8c68e-215e-4ba6-887b-8cdaa353dfe8", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "96d395e1-0809-4277-9751-12fc1609d0ea", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "casb": { @@ -633,12 +636,12 @@ An example event for `casb` looks as following: "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -647,7 +650,7 @@ An example event for `casb` looks as following: ], "dataset": "cloudflare_logpush.casb", "id": "6b187be4-2dd5-42c5-a37b-111111111111", - "ingested": "2023-06-12T08:09:02Z", + "ingested": "2023-07-25T07:30:57Z", "kind": "event", "original": "{\"AssetDisplayName\":\"John Doe\",\"AssetExternalID\":\"0051N000004mG2LAAA\",\"AssetLink\":\"https://example.com/resource\",\"AssetMetadata\":{\"AccountId\":null,\"Address\":{\"city\":\"Singapore\",\"country\":\"Singapore\",\"countryCode\":\"SG\",\"geocodeAccuracy\":null,\"latitude\":null,\"longitude\":null,\"postalCode\":null,\"state\":null,\"stateCode\":null,\"street\":null},\"Alias\":\"JDoe\",\"BadgeText\":\"\",\"BannerPhotoUrl\":\"/profilephoto/001\",\"CallCenterId\":null,\"CommunityNickname\":\"Doe.John\",\"CompanyName\":\"MyCompany\",\"ContactId\":null,\"DefaultGroupNotificationFrequency\":\"N\",\"Department\":\"521\",\"DigestFrequency\":\"D\",\"Division\":null,\"Email\":\"user@example.com\",\"EmailEncodingKey\":\"UTF-8\",\"EmailPreferencesAutoBcc\":true,\"EmployeeNumber\":\"18124\",\"Extension\":null,\"Fax\":null,\"FederationIdentifier\":null,\"FirstName\":\"John\",\"ForecastEnabled\":false,\"FullPhotoUrl\":\"https://photos.com/profilephoto/001\",\"Id\":\"0051N000004mG2LAAA\",\"IsActive\":false,\"IsProfilePhotoActive\":false,\"LanguageLocaleKey\":\"en_US\",\"LastLoginDate\":\"2021-10-06T06:32:09.000+0000\",\"LastName\":\"Doe\",\"LastReferencedDate\":null,\"LastViewedDate\":null,\"LocaleSidKey\":\"en_SG\",\"MediumBannerPhotoUrl\":\"/profilephoto/001/E\",\"MobilePhone\":null,\"Name\":\"John Doe\",\"OfflineTrialExpirationDate\":null,\"Phone\":\"+3460000000\",\"ReceivesAdminInfoEmails\":true,\"ReceivesInfoEmails\":true,\"SenderEmail\":\"sender@example.com\",\"SenderName\":null,\"Signature\":null,\"SmallBannerPhotoUrl\":\"/profilephoto/001/D\",\"SmallPhotoUrl\":\"https://photos.com/photo/001\",\"TimeZoneSidKey\":\"Asia/Singapore\",\"Title\":\"Customer Solutions Engineer\",\"UserPermissionsCallCenterAutoLogin\":false,\"UserPermissionsInteractionUser\":true,\"UserPermissionsMarketingUser\":false,\"UserPermissionsOfflineUser\":false,\"UserPermissionsSupportUser\":false,\"UserRoleId\":\"00E2G000001E\",\"UserType\":\"Standard\",\"attributes\":{\"type\":\"User\",\"url\":\"/services/data/userID\"}},\"DetectedTimestamp\":\"2023-05-16T10:00:00Z\",\"FindingTypeDisplayName\":\"Salesforce User Sending Email with Different Email Address\",\"FindingTypeID\":\"a2790c4f-03f5-449f-b209-5f4447f417aa\",\"FindingTypeSeverity\":\"Medium\",\"InstanceID\":\"6b187be4-2dd5-42c5-a37b-111111111111\",\"IntegrationDisplayName\":\"Salesforce Testing\",\"IntegrationID\":\"c772678d-5cf1-4c73-bf3f-111111111111\",\"IntegrationPolicyVendor\":\"Salesforce Connection\"}", "severity": 2, @@ -707,10 +710,10 @@ An example event for `casb` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | @@ -766,11 +769,11 @@ An example event for `device_posture` looks as following: { "@timestamp": "2023-05-17T12:00:00.000Z", "agent": { - "ephemeral_id": "53efe65d-da86-46ae-871a-4d57db0b5d74", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "64490d01-053f-4f30-8582-f198c691510a", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "device_posture": { @@ -819,12 +822,12 @@ An example event for `device_posture` looks as following: "type": "logs" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -832,7 +835,7 @@ An example event for `device_posture` looks as following: "host" ], "dataset": "cloudflare_logpush.device_posture", - "ingested": "2023-06-12T08:09:41Z", + "ingested": "2023-07-25T07:31:45Z", "kind": "event", "original": "{\"ClientVersion\":\"2023.3.258\",\"DeviceID\":\"083a8354-d56c-11ed-9771-111111111\",\"DeviceManufacturer\":\"Google Compute Engine\",\"DeviceModel\":\"Google Compute Engine\",\"DeviceName\":\"zt-test-vm1\",\"DeviceSerialNumber\":\"GoogleCloud-ABCD1234567890\",\"DeviceType\":\"linux\",\"Email\":\"user@example.com\",\"OSVersion\":\"5.15.0\",\"PolicyID\":\"policy-abcdefgh\",\"PostureCheckName\":\"Ubuntu\",\"PostureCheckType\":\"os_version\",\"PostureEvaluatedResult\":true,\"PostureExpectedJSON\":{\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\",\"version\":\"5.15.0-1025-gcp\"},\"PostureReceivedJSON\":{\"operator\":\"==\",\"os_distro_name\":\"ubuntu\",\"os_distro_revision\":\"20.04\",\"version\":\"5.15.0-1025-gcp\"},\"Timestamp\":\"2023-05-17T12:00:00Z\",\"UserUID\":\"user-abcdefgh\"}", "outcome": "success", @@ -922,9 +925,9 @@ An example event for `device_posture` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -973,11 +976,11 @@ An example event for `dns` looks as following: { "@timestamp": "2022-05-26T09:23:54.000Z", "agent": { - "ephemeral_id": "46ca52ad-75a1-46fa-81a1-e9845fb5074e", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "62a245d4-8aec-4021-b4ae-89e830b7a5d3", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "dns": { @@ -1013,12 +1016,12 @@ An example event for `dns` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -1026,7 +1029,7 @@ An example event for `dns` looks as following: "network" ], "dataset": "cloudflare_logpush.dns", - "ingested": "2023-06-12T08:10:21Z", + "ingested": "2023-07-25T07:32:33Z", "kind": "event", "original": "{\"ColoCode\":\"MRS\",\"EDNSSubnet\":\"1.128.0.0\",\"EDNSSubnetLength\":0,\"QueryName\":\"example.com\",\"QueryType\":65535,\"ResponseCached\":false,\"ResponseCode\":0,\"SourceIP\":\"175.16.199.0\",\"Timestamp\":\"2022-05-26T09:23:54Z\"}", "type": [ @@ -1087,9 +1090,9 @@ An example event for `dns` looks as following: | dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1132,11 +1135,11 @@ An example event for `firewall_event` looks as following: { "@timestamp": "2022-05-31T05:23:43.000Z", "agent": { - "ephemeral_id": "41c07abb-406e-4e1c-b9ce-214fe0b5263c", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "1adb216f-03d3-41e1-9b8e-a11f61314bde", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "firewall_event": { @@ -1205,12 +1208,12 @@ An example event for `firewall_event` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "block", @@ -1219,7 +1222,7 @@ An example event for `firewall_event` looks as following: "network" ], "dataset": "cloudflare_logpush.firewall_event", - "ingested": "2023-06-12T08:11:03Z", + "ingested": "2023-07-25T07:33:23Z", "kind": "event", "original": "{\"Action\":\"block\",\"ClientASN\":15169,\"ClientASNDescription\":\"CLOUDFLARENET\",\"ClientCountry\":\"us\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"searchEngine\",\"ClientRefererHost\":\"abc.example.com\",\"ClientRefererPath\":\"/abc/checkout\",\"ClientRefererQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRefererScheme\":\"referer URL scheme\",\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"GET\",\"ClientRequestPath\":\"/abc/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestQuery\":\"?sourcerer=(default%3A(id%3A!n%2CselectedPatterns%3A!(eqldemo%2C%27logs-endpoint.*-eqldemo%27%2C%27logs-system.*-eqldemo%27%2C%27logs-windows.*-eqldemo%27%2Cmetricseqldemo)))\\u0026timerange=(global%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.199Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.200Z%27%2CtoStr%3Anow))%2Ctimeline%3A(linkTo%3A!()%2Ctimerange%3A(from%3A%272022-04-05T00%3A00%3A01.201Z%27%2CfromStr%3Anow-24h%2Ckind%3Arelative%2Cto%3A%272022-04-06T00%3A00%3A01.202Z%27%2CtoStr%3Anow)))\",\"ClientRequestScheme\":\"https\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\",\"Datetime\":\"2022-05-31T05:23:43Z\",\"EdgeColoCode\":\"IAD\",\"EdgeResponseStatus\":403,\"Kind\":\"firewall\",\"MatchIndex\":1,\"Metadata\":{\"filter\":\"1ced07e066a34abf8b14f2a99593bc8d\",\"type\":\"customer\"},\"OriginResponseStatus\":0,\"OriginatorRayID\":\"00\",\"RayID\":\"713d477539b55c29\",\"RuleID\":\"7dc666e026974dab84884c73b3e2afe1\",\"Source\":\"firewallrules\"}", "type": [ @@ -1342,9 +1345,9 @@ An example event for `firewall_event` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1408,11 +1411,11 @@ An example event for `gateway_dns` looks as following: { "@timestamp": "2023-05-02T22:49:53.000Z", "agent": { - "ephemeral_id": "b551b024-376c-424e-b6ad-f6143e24589d", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "c151dcfc-4b1f-44f0-927b-78e6cb7ee7b7", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_dns": { @@ -1555,12 +1558,12 @@ An example event for `gateway_dns` looks as following: "response_code": "0" }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -1568,7 +1571,7 @@ An example event for `gateway_dns` looks as following: "network" ], "dataset": "cloudflare_logpush.gateway_dns", - "ingested": "2023-06-12T08:11:41Z", + "ingested": "2023-07-25T07:34:12Z", "kind": "event", "original": "{\"ApplicationID\":0,\"ColoCode\":\"ORD\",\"ColoID\":14,\"Datetime\":\"2023-05-02T22:49:53Z\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b111aaa\",\"DeviceName\":\"zt-test-vm1\",\"DstIP\":\"89.160.20.129\",\"DstPort\":443,\"Email\":\"user@test.com\",\"Location\":\"GCP default\",\"LocationID\":\"f233bd67-78c7-4050-9aff-ad63cce25732\",\"MatchedCategoryIDs\":[7,163],\"MatchedCategoryNames\":[\"Photography\",\"Weather\"],\"Policy\":\"7bdc7a9c-81d3-4816-8e56-de1acad3dec5\",\"PolicyID\":\"1412\",\"Protocol\":\"https\",\"QueryCategoryIDs\":[26,155],\"QueryCategoryNames\":[\"Technology\",\"Technology\"],\"QueryName\":\"security.ubuntu.com\",\"QueryNameReversed\":\"com.ubuntu.security\",\"QuerySize\":48,\"QueryType\":1,\"QueryTypeName\":\"A\",\"RCode\":0,\"RData\":[{\"data\":\"CHNlY3VyaXR5BnVidW50dQMjb20AAAEAAQAAAAgABLl9vic=\",\"type\":\"1\"},{\"data\":\"CHNlY3VyaXR5BnVidW50dQNjb20AAAEAABAAAAgABLl9viQ=\",\"type\":\"1\"},{\"data\":\"CHNlT3VyaXR5BnVidW50dQNjb20AAAEAAQAAAAgABFu9Wyc=\",\"type\":\"1\"}],\"ResolvedIPs\":[\"67.43.156.1\",\"67.43.156.2\",\"67.43.156.3\"],\"ResolverDecision\":\"allowedOnNoPolicyMatch\",\"SrcIP\":\"67.43.156.2\",\"SrcPort\":0,\"TimeZone\":\"UTC\",\"TimeZoneInferredMethod\":\"fromLocalTime\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245000000\"}", "outcome": "success", @@ -1706,9 +1709,9 @@ An example event for `gateway_dns` looks as following: | dns.response_code | The DNS response code. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -1772,11 +1775,11 @@ An example event for `gateway_http` looks as following: { "@timestamp": "2023-05-03T20:55:05.000Z", "agent": { - "ephemeral_id": "8ea5d833-9f60-4323-936f-870d4e08dd40", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "3e824634-2a1f-48e2-b897-27806da3c6ad", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_http": { @@ -1875,12 +1878,12 @@ An example event for `gateway_http` looks as following: "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "block", @@ -1889,7 +1892,7 @@ An example event for `gateway_http` looks as following: "network" ], "dataset": "cloudflare_logpush.gateway_http", - "ingested": "2023-06-12T08:12:22Z", + "ingested": "2023-07-25T07:35:00Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a348\",\"Action\":\"block\",\"BlockedFileHash\":\"91dc1db739a705105e1c763bfdbdaa84c0de8\",\"BlockedFileName\":\"downloaded_test\",\"BlockedFileReason\":\"malware\",\"BlockedFileSize\":43,\"BlockedFileType\":\"bin\",\"Datetime\":\"2023-05-03T20:55:05Z\",\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"DownloadedFileNames\":[\"downloaded_file\",\"downloaded_test\"],\"Email\":\"user@example.com\",\"FileInfo\":{\"files\":[{\"name\":\"downloaded_file\",\"size\":43},{\"name\":\"downloaded_test\",\"size\":341}]},\"HTTPHost\":\"guce.yahoo.com\",\"HTTPMethod\":\"GET\",\"HTTPStatusCode\":302,\"HTTPVersion\":\"HTTP/2\",\"IsIsolated\":false,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"Block Yahoo\",\"Referer\":\"https://www.example.com/\",\"RequestID\":\"1884fec9b600007fb06a299400000001\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.123\",\"SourcePort\":47924,\"URL\":\"https://test.com\",\"UntrustedCertificateAction\":\"none\",\"UploadedFileNames\":[\"uploaded_file\",\"uploaded_test\"],\"UserAgent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64) Firefox/112.0\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", "type": [ @@ -2037,9 +2040,9 @@ An example event for `gateway_http` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2122,11 +2125,11 @@ An example event for `gateway_network` looks as following: { "@timestamp": "2023-05-18T21:12:57.058Z", "agent": { - "ephemeral_id": "52c5301e-581f-4fea-bd5d-5182ae0e3c20", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "05a8214e-8815-4643-8f29-d9b0525e810a", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "gateway_network": { @@ -2192,12 +2195,12 @@ An example event for `gateway_network` looks as following: "port": 443 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "allowedOnNoRuleMatch", @@ -2207,7 +2210,7 @@ An example event for `gateway_network` looks as following: ], "dataset": "cloudflare_logpush.gateway_network", "id": "5f2d04be-3512-11e8-b467-0ed5f89f718b", - "ingested": "2023-06-12T08:13:05Z", + "ingested": "2023-07-25T07:35:45Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"Action\":\"allowedOnNoRuleMatch\",\"Datetime\":1684444377058000000,\"DestinationIP\":\"89.160.20.129\",\"DestinationPort\":443,\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"Email\":\"user@test.com\",\"OverrideIP\":\"175.16.199.4\",\"OverridePort\":8080,\"PolicyID\":\"85063bec-74cb-4546-85a3-e0cde2cdfda2\",\"PolicyName\":\"My policy\",\"SNI\":\"www.elastic.co\",\"SessionID\":\"5f2d04be-3512-11e8-b467-0ed5f89f718b\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"192.168.1.3\",\"SourcePort\":47924,\"Transport\":\"tcp\",\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\"}", "type": [ @@ -2334,10 +2337,10 @@ An example event for `gateway_network` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2400,11 +2403,11 @@ An example event for `http_request` looks as following: { "@timestamp": "2022-05-25T13:25:26Z", "agent": { - "ephemeral_id": "c65f628c-26b5-4fcb-b980-a9b52becfb43", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "34c73788-e42e-47fa-a84f-20cef1b89ae6", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "http_request": { @@ -2583,12 +2586,12 @@ An example event for `http_request` looks as following: "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -2596,7 +2599,7 @@ An example event for `http_request` looks as following: "network" ], "dataset": "cloudflare_logpush.http_request", - "ingested": "2023-06-12T08:13:45Z", + "ingested": "2023-07-25T07:36:34Z", "kind": "event", "original": "{\"BotScore\":\"20\",\"BotScoreSrc\":\"Verified Bot\",\"BotTags\":\"bing\",\"CacheCacheStatus\":\"dynamic\",\"CacheResponseBytes\":983828,\"CacheResponseStatus\":200,\"CacheTieredFill\":false,\"ClientASN\":43766,\"ClientCountry\":\"sa\",\"ClientDeviceType\":\"desktop\",\"ClientIP\":\"175.16.199.0\",\"ClientIPClass\":\"noRecord\",\"ClientMTLSAuthCertFingerprint\":\"Fingerprint\",\"ClientMTLSAuthStatus\":\"unknown\",\"ClientRequestBytes\":5800,\"ClientRequestHost\":\"xyz.example.com\",\"ClientRequestMethod\":\"POST\",\"ClientRequestPath\":\"/xyz/checkout\",\"ClientRequestProtocol\":\"HTTP/1.1\",\"ClientRequestReferer\":\"https://example.com/s/example/default?sourcerer=(default:(id:!n,selectedPatterns:!(example,%27logs-endpoint.*-example%27,%27logs-system.*-example%27,%27logs-windows.*-example%27)))\\u0026timerange=(global:(linkTo:!(),timerange:(from:%272022-05-16T06:26:36.340Z%27,fromStr:now-24h,kind:relative,to:%272022-05-17T06:26:36.340Z%27,toStr:now)),timeline:(linkTo:!(),timerange:(from:%272022-04-17T22:00:00.000Z%27,kind:absolute,to:%272022-04-18T21:59:59.999Z%27)))\\u0026timeline=(activeTab:notes,graphEventId:%27%27,id:%279844bdd4-4dd6-5b22-ab40-3cd46fce8d6b%27,isOpen:!t)\",\"ClientRequestScheme\":\"https\",\"ClientRequestSource\":\"edgeWorkerFetch\",\"ClientRequestURI\":\"/s/example/api/telemetry/v2/clusters/_stats\",\"ClientRequestUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36\",\"ClientSSLCipher\":\"NONE\",\"ClientSSLProtocol\":\"TLSv1.2\",\"ClientSrcPort\":0,\"ClientTCPRTTMs\":0,\"ClientXRequestedWith\":\"Request With\",\"Cookies\":{\"key\":\"value\"},\"EdgeCFConnectingO2O\":false,\"EdgeColoCode\":\"RUH\",\"EdgeColoID\":339,\"EdgeEndTimestamp\":\"2022-05-25T13:25:32Z\",\"EdgePathingOp\":\"wl\",\"EdgePathingSrc\":\"macro\",\"EdgePathingStatus\":\"nr\",\"EdgeRateLimitAction\":\"unknown\",\"EdgeRateLimitID\":0,\"EdgeRequestHost\":\"abc.example.com\",\"EdgeResponseBodyBytes\":980397,\"EdgeResponseBytes\":981308,\"EdgeResponseCompressionRatio\":0,\"EdgeResponseContentType\":\"application/json\",\"EdgeResponseStatus\":200,\"EdgeServerIP\":\"1.128.0.0\",\"EdgeStartTimestamp\":\"2022-05-25T13:25:26Z\",\"EdgeTimeToFirstByteMs\":5333,\"OriginDNSResponseTimeMs\":3,\"OriginIP\":\"67.43.156.0\",\"OriginRequestHeaderSendDurationMs\":0,\"OriginResponseBytes\":0,\"OriginResponseDurationMs\":5319,\"OriginResponseHTTPExpires\":\"2022-05-27T13:25:26Z\",\"OriginResponseHTTPLastModified\":\"2022-05-26T13:25:26Z\",\"OriginResponseHeaderReceiveDurationMs\":5155,\"OriginResponseStatus\":200,\"OriginResponseTime\":5232000000,\"OriginSSLProtocol\":\"TLSv1.2\",\"OriginTCPHandshakeDurationMs\":24,\"OriginTLSHandshakeDurationMs\":53,\"ParentRayID\":\"710e98d93d50357d\",\"RayID\":\"710e98d9367f357d\",\"SecurityLevel\":\"off\",\"SmartRouteColoID\":20,\"UpperTierColoID\":0,\"WAFAction\":\"unknown\",\"WAFFlags\":\"0\",\"WAFMatchedVar\":\"example\",\"WAFProfile\":\"unknown\",\"WAFRuleID\":\"98d93d5\",\"WAFRuleMessage\":\"matchad variable message\",\"WorkerCPUTime\":0,\"WorkerStatus\":\"unknown\",\"WorkerSubrequest\":true,\"WorkerSubrequestCount\":0,\"ZoneID\":393347122,\"ZoneName\":\"example.com\"}", "type": [ @@ -2775,9 +2778,9 @@ An example event for `http_request` looks as following: | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2845,11 +2848,11 @@ An example event for `nel_report` looks as following: { "@timestamp": "2021-07-27T00:01:07.000Z", "agent": { - "ephemeral_id": "ca748e98-43dc-492d-aa00-907d89a64d5e", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "55a2ad15-22a6-4b90-9cb7-6d23c41597f2", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "nel_report": { @@ -2880,12 +2883,12 @@ An example event for `nel_report` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "error": { "type": "network-error" @@ -2896,7 +2899,7 @@ An example event for `nel_report` looks as following: "network" ], "dataset": "cloudflare_logpush.nel_report", - "ingested": "2023-06-12T08:14:25Z", + "ingested": "2023-07-25T07:37:18Z", "kind": "event", "original": "{\"ClientIPASN\":\"13335\",\"ClientIPASNDescription\":\"CLOUDFLARENET\",\"ClientIPCountry\":\"US\",\"LastKnownGoodColoCode\":\"SJC\",\"Phase\":\"connection\",\"Timestamp\":\"2021-07-27T00:01:07Z\",\"Type\":\"network-error\"}", "type": [ @@ -2946,9 +2949,9 @@ An example event for `nel_report` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.type | The type of the error, for example the class name of the exception. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2988,11 +2991,11 @@ An example event for `network_analytics` looks as following: { "@timestamp": "2021-07-27T00:01:07.000Z", "agent": { - "ephemeral_id": "2d05f4a9-c7d4-4a53-a65b-93b84b82984c", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "cc63528e-4a4d-45a9-bf41-97387ffeb7a2", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "network_analytics": { @@ -3164,12 +3167,12 @@ An example event for `network_analytics` looks as following: "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -3177,7 +3180,7 @@ An example event for `network_analytics` looks as following: "network" ], "dataset": "cloudflare_logpush.network_analytics", - "ingested": "2023-06-12T08:15:07Z", + "ingested": "2023-07-25T07:38:02Z", "kind": "event", "original": "{\"AttackCampaignID\":\"xyz987\",\"AttackID\":\"abc777\",\"ColoCountry\":\"AD\",\"ColoGeoHash\":\"gbuun\",\"ColoID\":46,\"ColoName\":\"SJC\",\"Datetime\":\"2021-07-27T00:01:07Z\",\"DestinationASN\":1900,\"DestinationASNDescription\":\"asn description\",\"DestinationCountry\":\"AD\",\"DestinationGeoHash\":\"gbuun\",\"DestinationPort\":0,\"Direction\":\"ingress\",\"GREChecksum\":10,\"GREEthertype\":10,\"GREHeaderLength\":1024,\"GREKey\":10,\"GRESequenceNumber\":10,\"GREVersion\":10,\"ICMPChecksum\":10,\"ICMPCode\":10,\"ICMPType\":10,\"IPDestinationAddress\":\"175.16.199.0\",\"IPDestinationSubnet\":\"/24\",\"IPFragmentOffset\":1480,\"IPHeaderLength\":20,\"IPMoreFragments\":1480,\"IPProtocol\":6,\"IPProtocolName\":\"tcp\",\"IPSourceAddress\":\"67.43.156.0\",\"IPSourceSubnet\":\"/24\",\"IPTotalLength\":1024,\"IPTotalLengthBuckets\":10,\"IPTtl\":240,\"IPTtlBuckets\":2,\"IPv4Checksum\":0,\"IPv4DontFragment\":0,\"IPv4Dscp\":46,\"IPv4Ecn\":1,\"IPv4Identification\":1,\"IPv4Options\":1,\"IPv6Dscp\":46,\"IPv6Ecn\":1,\"IPv6ExtensionHeaders\":\"header\",\"IPv6FlowLabel\":1,\"IPv6Identification\":1,\"MitigationReason\":\"BLOCKED\",\"MitigationScope\":\"local\",\"MitigationSystem\":\"flowtrackd\",\"Outcome\":\"pass\",\"ProtocolState\":\"OPEN\",\"RuleID\":\"rule1\",\"RulesetID\":\"3b64149bfa6e4220bbbc2bd6db589552\",\"RulesetOverrideID\":\"id1\",\"SampleInterval\":1,\"SourceASN\":1500,\"SourceASNDescription\":\"Source ASN Description\",\"SourceCountry\":\"AD\",\"SourceGeoHash\":\"gbuun\",\"SourcePort\":0,\"TCPAcknowledgementNumber\":1000,\"TCPChecksum\":10,\"TCPDataOffset\":0,\"TCPFlags\":1,\"TCPFlagsString\":\"Human-readable flags string\",\"TCPMss\":512,\"TCPOptions\":\"mss\",\"TCPSackBlocks\":1,\"TCPSacksPermitted\":1,\"TCPSequenceNumber\":100,\"TCPTimestampEcr\":100,\"TCPTimestampValue\":100,\"TCPUrgentPointer\":10,\"TCPWindowScale\":10,\"TCPWindowSize\":10,\"UDPChecksum\":10,\"UDPPayloadLength\":10,\"Verdict\":\"pass\"}", "outcome": "success", @@ -3327,9 +3330,9 @@ An example event for `network_analytics` looks as following: | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -3379,11 +3382,11 @@ An example event for `network_session` looks as following: { "@timestamp": "2023-05-04T11:29:14.000Z", "agent": { - "ephemeral_id": "34032d6e-2a7f-4344-bd82-4bb85bb85eaa", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "10791184-35f0-4dd7-b44f-43617b758741", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "network_session": { @@ -3490,12 +3493,12 @@ An example event for `network_session` looks as following: "port": 80 }, "ecs": { - "version": "8.7.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", @@ -3506,7 +3509,7 @@ An example event for `network_session` looks as following: "dataset": "cloudflare_logpush.network_session", "end": "2023-05-04T11:29:14Z", "id": "18881f179300007fb0d06d6400000001", - "ingested": "2023-06-12T08:15:47Z", + "ingested": "2023-07-25T07:38:48Z", "kind": "event", "original": "{\"AccountID\":\"e1836771179f98aabb828da5ea69a111\",\"BytesReceived\":679,\"BytesSent\":2333,\"ClientTCPHandshakeDurationMs\":12,\"ClientTLSCipher\":\"TLS_AES_128_GCM_SHA256\",\"ClientTLSHandshakeDurationMs\":125,\"ClientTLSVersion\":\"TLS 1.3\",\"ConnectionCloseReason\":\"CLIENT_CLOSED\",\"ConnectionReuse\":false,\"DestinationTunnelID\":\"00000000-0000-0000-0000-000000000000\",\"DeviceID\":\"083a8354-d56c-11ed-9771-6a842b100cff\",\"DeviceName\":\"zt-test-vm1\",\"EgressColoName\":\"ORD\",\"EgressIP\":\"2a02:cf40::23\",\"EgressPort\":41052,\"EgressRuleID\":\"00000000-0000-0000-0000-000000000000\",\"EgressRuleName\":\"Egress Rule 1\",\"Email\":\"user@test.com\",\"IngressColoName\":\"ORD\",\"Offramp\":\"INTERNET\",\"OriginIP\":\"89.160.20.129\",\"OriginPort\":80,\"OriginTLSCertificateIssuer\":\"DigiCert Inc\",\"OriginTLSCertificateValidationResult\":\"VALID\",\"OriginTLSCipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"OriginTLSHandshakeDurationMs\":130,\"OriginTLSVersion\":\"TLS 1.2\",\"Protocol\":\"TCP\",\"RuleEvaluationDurationMs\":10,\"SessionEndTime\":\"2023-05-04T11:29:14Z\",\"SessionID\":\"18881f179300007fb0d06d6400000001\",\"SessionStartTime\":\"2023-05-04T11:29:14Z\",\"SourceIP\":\"67.43.156.2\",\"SourceInternalIP\":\"1.128.0.1\",\"SourcePort\":52994,\"UserID\":\"166befbb-00e3-5e20-bd6e-27245723949f\",\"VirtualNetworkID\":\"0ce99869-63d3-4d5d-bdaf-d4f33df964aa\"}", "start": "2023-05-04T11:29:14Z", @@ -3658,14 +3661,14 @@ An example event for `network_session` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -3728,11 +3731,11 @@ An example event for `spectrum_event` looks as following: { "@timestamp": "2022-05-26T09:24:00.000Z", "agent": { - "ephemeral_id": "68aa0fb3-4da4-4501-ac49-30f69891f141", - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "ephemeral_id": "ff280729-a1df-48bc-bca4-643e1848944d", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.1" }, "cloudflare_logpush": { "spectrum_event": { @@ -3796,12 +3799,12 @@ An example event for `spectrum_event` looks as following: "port": 3389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "0ea095a8-f104-433c-b0d6-33ed0d5e2108", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", "snapshot": false, - "version": "8.7.1" + "version": "8.8.1" }, "event": { "action": "connect", @@ -3812,7 +3815,7 @@ An example event for `spectrum_event` looks as following: "dataset": "cloudflare_logpush.spectrum_event", "end": "1970-01-01T00:00:00.000Z", "id": "7ef659a2f8ef4810a9bade96fdad7c75", - "ingested": "2023-06-12T08:16:29Z", + "ingested": "2023-07-25T07:39:33Z", "kind": "event", "original": "{\"Application\":\"7ef659a2f8ef4810a9bade96fdad7c75\",\"ClientAsn\":200391,\"ClientBytes\":0,\"ClientCountry\":\"bg\",\"ClientIP\":\"67.43.156.0\",\"ClientMatchedIpFirewall\":\"UNKNOWN\",\"ClientPort\":40456,\"ClientProto\":\"tcp\",\"ClientTcpRtt\":0,\"ClientTlsCipher\":\"UNK\",\"ClientTlsClientHelloServerName\":\"server name\",\"ClientTlsProtocol\":\"unknown\",\"ClientTlsStatus\":\"UNKNOWN\",\"ColoCode\":\"SOF\",\"ConnectTimestamp\":\"2022-05-26T09:24:00Z\",\"DisconnectTimestamp\":\"1970-01-01T00:00:00Z\",\"Event\":\"connect\",\"IpFirewall\":false,\"OriginBytes\":0,\"OriginIP\":\"175.16.199.0\",\"OriginPort\":3389,\"OriginProto\":\"tcp\",\"OriginTcpRtt\":0,\"OriginTlsCipher\":\"UNK\",\"OriginTlsFingerprint\":\"0000000000000000000000000000000000000000000000000000000000000000.\",\"OriginTlsMode\":\"off\",\"OriginTlsProtocol\":\"unknown\",\"OriginTlsStatus\":\"UNKNOWN\",\"ProxyProtocol\":\"off\",\"Status\":0,\"Timestamp\":\"2022-05-26T09:24:00Z\"}", "start": "2022-05-26T09:24:00.000Z", @@ -3916,14 +3919,14 @@ An example event for `spectrum_event` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -3957,3 +3960,199 @@ An example event for `spectrum_event` looks as following: | tags | List of keywords used to tag each event. | keyword | | tls.version | Numeric part of the version parsed from the original string. | keyword | | tls.version_protocol | Normalized lowercase protocol name parsed from original string. | keyword | + + +### workers_trace + +This is the `workers_trace` dataset. +Default port for HTTP Endpoint: _9574_ + +#### Example + +An example event for `workers_trace` looks as following: + +```json +{ + "@timestamp": "2023-07-20T11:35:46.804Z", + "agent": { + "ephemeral_id": "1c895f67-5aeb-479b-b5af-8fcfceef87f6", + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.1" + }, + "cloudflare_logpush": { + "workers_trace": { + "dispatch_namespace": "my-worker-dispatch", + "event": { + "ray_id": "7e9ae7157ac0c33a", + "request": { + "method": "GET", + "url": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog" + }, + "response": { + "status": 404 + } + }, + "exceptions": [ + { + "message": "Uncaught TypeError: Cannot read property 'x' of undefined", + "stack": "TypeError: Cannot read property 'x' of undefined\n at fetchHandler (/workers/script.js:12:27)\n at handleRequest (/workers/script.js:6:13)" + } + ], + "logs": [ + { + "level": "info", + "message": "Request received for /api/data" + }, + { + "level": "error", + "message": "Something went wrong" + } + ], + "outcome": "exception", + "script": { + "name": "chat-gpt-little-butterfly-0c3d", + "tags": [ + "api", + "chatgpt" + ] + }, + "timestamp": "2023-07-20T11:35:46.804Z", + "type": "fetch" + } + }, + "data_stream": { + "dataset": "cloudflare_logpush.workers_trace", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "f4e828d2-efc6-4c31-93f3-c87b01e57a16", + "snapshot": false, + "version": "8.8.1" + }, + "event": { + "action": "fetch", + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "cloudflare_logpush.workers_trace", + "id": "7e9ae7157ac0c33a", + "ingested": "2023-07-25T07:40:19Z", + "kind": "event", + "original": "{\"DispatchNamespace\":\"my-worker-dispatch\",\"Event\":{\"RayID\":\"7e9ae7157ac0c33a\",\"Request\":{\"Method\":\"GET\",\"URL\":\"http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog\"},\"Response\":{\"Status\":404}},\"EventTimestampMs\":1689852946804,\"EventType\":\"fetch\",\"Exceptions\":[{\"Message\":\"Uncaught TypeError: Cannot read property 'x' of undefined\",\"Stack\":\"TypeError: Cannot read property 'x' of undefined\\n at fetchHandler (/workers/script.js:12:27)\\n at handleRequest (/workers/script.js:6:13)\"}],\"Logs\":[{\"level\":\"info\",\"message\":\"Request received for /api/data\"},{\"level\":\"error\",\"message\":\"Something went wrong\"}],\"Outcome\":\"exception\",\"ScriptName\":\"chat-gpt-little-butterfly-0c3d\",\"ScriptTags\":[\"api\",\"chatgpt\"]}", + "outcome": "failure", + "type": [ + "info", + "error" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "status_code": 404 + } + }, + "input": { + "type": "http_endpoint" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "cloudflare_logpush-workers_trace" + ], + "url": { + "domain": "chat-gpt-little-butterfly-0c3d.example.workers.dev", + "original": "http://chat-gpt-little-butterfly-0c3d.example.workers.dev/v2/_catalog", + "path": "/v2/_catalog", + "scheme": "http" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization ID used to identify different entities in a multi-tenant environment. Examples: AWS account ID, Google Cloud ORG ID, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| cloudflare_logpush.workers_trace.dispatch_namespace | The Cloudflare Worker dispatch namespace. | keyword | +| cloudflare_logpush.workers_trace.event | Details about the source event. | flattened | +| cloudflare_logpush.workers_trace.exceptions | List of uncaught exceptions during the invocation. | flattened | +| cloudflare_logpush.workers_trace.logs | List of console messages emitted during the invocation. | flattened | +| cloudflare_logpush.workers_trace.outcome | The outcome of the worker script invocation. Possible values are ok | exception. | keyword | +| cloudflare_logpush.workers_trace.script.name | The Cloudflare Worker script name. | keyword | +| cloudflare_logpush.workers_trace.script.tags | A list of user-defined tags used to categorize the Worker. | keyword | +| cloudflare_logpush.workers_trace.timestamp | The timestamp of when the event was received. | date | +| cloudflare_logpush.workers_trace.type | The event type that triggered the invocation. | keyword | +| container.id | Unique container ID. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Event module. | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host ID. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host IP addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | +| http.response.status_code | HTTP response status code. | long | +| input.type | Input type | keyword | +| log.offset | Log offset | long | +| log.source.address | Source address from which the log event was read / sent from. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | +| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | +| url.full.text | Multi-field of `url.full`. | match_only_text | +| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | +| url.original.text | Multi-field of `url.original`. | match_only_text | +| url.password | Password of the request. | keyword | +| url.path | Path of the request, such as "/search". | wildcard | +| url.port | Port of the request, such as 443. | long | +| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | +| url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | +| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | +| url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| url.username | Username of the request. | keyword | diff --git a/packages/cloudflare_logpush/img/cloudflare_logpush-workers_trace1.png b/packages/cloudflare_logpush/img/cloudflare_logpush-workers_trace1.png new file mode 100644 index 00000000000..bd7571e3e92 Binary files /dev/null and b/packages/cloudflare_logpush/img/cloudflare_logpush-workers_trace1.png differ diff --git a/packages/cloudflare_logpush/kibana/dashboard/cloudflare_logpush-a32dd850-2ad7-11ee-87da-672c93538971.json b/packages/cloudflare_logpush/kibana/dashboard/cloudflare_logpush-a32dd850-2ad7-11ee-87da-672c93538971.json new file mode 100644 index 00000000000..bcd3694203b --- /dev/null +++ b/packages/cloudflare_logpush/kibana/dashboard/cloudflare_logpush-a32dd850-2ad7-11ee-87da-672c93538971.json @@ -0,0 +1,1159 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"8bbf6ad1-37ae-44c3-a39c-9a8ea9433308\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"8bbf6ad1-37ae-44c3-a39c-9a8ea9433308\",\"fieldName\":\"http.request.method\",\"title\":\"HTTP Request Method\",\"selectedOptions\":[],\"enhancements\":{}}},\"ad801e07-23f4-4740-8822-69fb17f5b1a2\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ad801e07-23f4-4740-8822-69fb17f5b1a2\",\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"enhancements\":{}}},\"b92df946-457d-4873-9279-1132e3462323\":{\"type\":\"rangeSliderControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"b92df946-457d-4873-9279-1132e3462323\",\"fieldName\":\"http.response.status_code\",\"title\":\"HTTP Response Code\",\"enhancements\":{}}},\"fdc3f099-79ba-4e97-b3f1-7224e11bc14b\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fdc3f099-79ba-4e97-b3f1-7224e11bc14b\",\"fieldName\":\"event.action\",\"title\":\"Action\",\"enhancements\":{}}},\"c071ba44-45ef-487b-bddd-40e74d3d0298\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c071ba44-45ef-487b-bddd-40e74d3d0298\",\"fieldName\":\"cloudflare_logpush.workers_trace.script.name\",\"title\":\"Script Name\",\"enhancements\":{}}},\"c480ba9a-02e0-4b58-b390-a89a6c580722\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c480ba9a-02e0-4b58-b390-a89a6c580722\",\"fieldName\":\"cloudflare_logpush.workers_trace.script.tags\",\"title\":\"Script Tags\",\"enhancements\":{}}},\"42493894-084c-4ddc-bb32-9a3b45326510\":{\"type\":\"optionsListControl\",\"order\":6,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"42493894-084c-4ddc-bb32-9a3b45326510\",\"fieldName\":\"cloudflare_logpush.workers_trace.dispatch_namespace\",\"title\":\"Dispatch Namespace\",\"enhancements\":{}}},\"93e6eb58-597a-410a-9a72-fc8f9caa0824\":{\"type\":\"optionsListControl\",\"order\":7,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"93e6eb58-597a-410a-9a72-fc8f9caa0824\",\"fieldName\":\"url.domain\",\"title\":\"URL Domain\",\"enhancements\":{}}}}" + }, + "description": "Workers Trace Events collected by the Cloudflare Logpush integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Cloudflare Logpush**\n\n**[Workers Trace Events](/app/dashboards#/view/cloudflare_logpush-a32dd850-2ad7-11ee-87da-672c93538971)** \n\n**Overview**\n\nThis dashboard provides information about the Workers Trace Events collected by the Cloudflare Logpush integration.\n\n[**Integration Page**](/app/integrations/detail/cloudflare_logpush/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 45, + "i": "2f608102-773f-4fee-98bf-c7721dd5951e", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "2f608102-773f-4fee-98bf-c7721dd5951e", + "title": "Table of contents", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ad37a7c6-fc5c-425f-a96f-2fb039cc1a13": { + "columnOrder": [ + "2c1c4613-f35e-4588-bc31-cfaa54f35133", + "2b29f2cf-f1eb-46f4-93e6-2664f9a76575", + "1b5ee11d-1d19-4cb5-92d8-3762095f7155", + "0bc2482d-3aa8-4461-bbc7-d0c56f50a5ea" + ], + "columns": { + "0bc2482d-3aa8-4461-bbc7-d0c56f50a5ea": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.outcome : \"failure\" " + }, + "isBucketed": false, + "label": "Failure Events", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "1b5ee11d-1d19-4cb5-92d8-3762095f7155": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.outcome : \"success\" " + }, + "isBucketed": false, + "label": "Success Events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2b29f2cf-f1eb-46f4-93e6-2664f9a76575": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "lucene", + "query": "" + }, + "isBucketed": false, + "label": "Total Events", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2c1c4613-f35e-4588-bc31-cfaa54f35133": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-ad37a7c6-fc5c-425f-a96f-2fb039cc1a13", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2b29f2cf-f1eb-46f4-93e6-2664f9a76575", + "1b5ee11d-1d19-4cb5-92d8-3762095f7155", + "0bc2482d-3aa8-4461-bbc7-d0c56f50a5ea" + ], + "layerId": "ad37a7c6-fc5c-425f-a96f-2fb039cc1a13", + "layerType": "data", + "seriesType": "area", + "xAccessor": "2c1c4613-f35e-4588-bc31-cfaa54f35133", + "yConfig": [ + { + "axisMode": "left", + "color": "#54b399", + "forAccessor": "2b29f2cf-f1eb-46f4-93e6-2664f9a76575" + }, + { + "axisMode": "left", + "color": "#6092c0", + "forAccessor": "1b5ee11d-1d19-4cb5-92d8-3762095f7155" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "Events" + } + }, + "title": "Total Requests vs. Origin Requests in rps last 24 hours [Cloudflare] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3491263f-85b9-4f4b-b2b6-74b275bac113", + "w": 20, + "x": 8, + "y": 0 + }, + "panelIndex": "3491263f-85b9-4f4b-b2b6-74b275bac113", + "title": "[Cloudflare Logpush] Workers Trace Events by Outcome", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af534ed2-ab39-47e7-bb3a-3c908a1087be", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0a1d14a1-6c2d-448f-aeab-c74516b341ac": { + "columnOrder": [ + "b5639095-6675-4615-80b1-0131de7da9e6", + "b0cce0ae-7c37-47aa-8081-9956000a0233" + ], + "columns": { + "b0cce0ae-7c37-47aa-8081-9956000a0233": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b5639095-6675-4615-80b1-0131de7da9e6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0cce0ae-7c37-47aa-8081-9956000a0233", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "af534ed2-ab39-47e7-bb3a-3c908a1087be", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0cce0ae-7c37-47aa-8081-9956000a0233" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b5639095-6675-4615-80b1-0131de7da9e6" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e2fd2885-4175-46e1-9120-f4c3582e8d38", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "e2fd2885-4175-46e1-9120-f4c3582e8d38", + "title": "[Cloudflare Logpush] Event Outcome Ratio", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1e78be6d-8f04-4128-90f4-5b3959c5dc7f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0a1d14a1-6c2d-448f-aeab-c74516b341ac": { + "columnOrder": [ + "b5639095-6675-4615-80b1-0131de7da9e6", + "b0cce0ae-7c37-47aa-8081-9956000a0233" + ], + "columns": { + "b0cce0ae-7c37-47aa-8081-9956000a0233": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b5639095-6675-4615-80b1-0131de7da9e6": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Status Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0cce0ae-7c37-47aa-8081-9956000a0233", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1e78be6d-8f04-4128-90f4-5b3959c5dc7f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0cce0ae-7c37-47aa-8081-9956000a0233" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b5639095-6675-4615-80b1-0131de7da9e6" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "6b325841-d762-487d-8dca-cb4ebebb627d", + "w": 20, + "x": 8, + "y": 15 + }, + "panelIndex": "6b325841-d762-487d-8dca-cb4ebebb627d", + "title": "[Cloudflare Logpush] Top HTTP Response Code", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5b887ab3-d47e-4517-b700-14d9a5208aa6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8163ada-58bc-4a6d-bb72-c6fdf4c6f1d1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5b887ab3-d47e-4517-b700-14d9a5208aa6": { + "columnOrder": [ + "5e0fed4f-4019-4812-8842-f3390fe1358f", + "6d7d2862-4389-45a1-bba1-3cd9b182fb40" + ], + "columns": { + "5e0fed4f-4019-4812-8842-f3390fe1358f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "HTTP Request Method", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6d7d2862-4389-45a1-bba1-3cd9b182fb40", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "http.request.method" + }, + "6d7d2862-4389-45a1-bba1-3cd9b182fb40": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a8163ada-58bc-4a6d-bb72-c6fdf4c6f1d1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6d7d2862-4389-45a1-bba1-3cd9b182fb40" + ], + "layerId": "5b887ab3-d47e-4517-b700-14d9a5208aa6", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "xAccessor": "5e0fed4f-4019-4812-8842-f3390fe1358f" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "8bf7449a-9767-4d83-af74-bda870702574", + "w": 20, + "x": 28, + "y": 15 + }, + "panelIndex": "8bf7449a-9767-4d83-af74-bda870702574", + "title": "[Cloudflare Logpush] Top HTTP Request Method", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-49a5faac-3cae-448d-98ca-a61e4c17d63b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0f092bcb-99e9-4e8c-8054-d41e1d2ef9ce", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "49a5faac-3cae-448d-98ca-a61e4c17d63b": { + "columnOrder": [ + "e74456ed-d03c-46b9-80b8-5a90b1fb62bb", + "c50bafa5-0f9a-4072-ad18-26a749624977" + ], + "columns": { + "c50bafa5-0f9a-4072-ad18-26a749624977": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e74456ed-d03c-46b9-80b8-5a90b1fb62bb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "URL Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c50bafa5-0f9a-4072-ad18-26a749624977", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.domain" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0f092bcb-99e9-4e8c-8054-d41e1d2ef9ce", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e74456ed-d03c-46b9-80b8-5a90b1fb62bb", + "isTransposed": false + }, + { + "columnId": "c50bafa5-0f9a-4072-ad18-26a749624977", + "isTransposed": false + } + ], + "layerId": "49a5faac-3cae-448d-98ca-a61e4c17d63b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2048f6ff-25c6-4123-a609-3b931f6e817c", + "w": 20, + "x": 8, + "y": 30 + }, + "panelIndex": "2048f6ff-25c6-4123-a609-3b931f6e817c", + "title": "[Cloudflare Logpush] Top URL Domains", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-49a5faac-3cae-448d-98ca-a61e4c17d63b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "28dbbc66-83d1-41e9-9f81-c7fad36a9167", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "49a5faac-3cae-448d-98ca-a61e4c17d63b": { + "columnOrder": [ + "e74456ed-d03c-46b9-80b8-5a90b1fb62bb", + "c50bafa5-0f9a-4072-ad18-26a749624977" + ], + "columns": { + "c50bafa5-0f9a-4072-ad18-26a749624977": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e74456ed-d03c-46b9-80b8-5a90b1fb62bb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Script Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c50bafa5-0f9a-4072-ad18-26a749624977", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cloudflare_logpush.workers_trace.script.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "28dbbc66-83d1-41e9-9f81-c7fad36a9167", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e74456ed-d03c-46b9-80b8-5a90b1fb62bb", + "isTransposed": false + }, + { + "columnId": "c50bafa5-0f9a-4072-ad18-26a749624977", + "isTransposed": false + } + ], + "layerId": "49a5faac-3cae-448d-98ca-a61e4c17d63b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "aa1ad025-cb18-45f0-8c07-1dc21e517b08", + "w": 20, + "x": 28, + "y": 30 + }, + "panelIndex": "aa1ad025-cb18-45f0-8c07-1dc21e517b08", + "title": "[Cloudflare Logpush] Top Script Names", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 25, + "i": "ca1508a9-c6ce-42aa-a144-9bd1648aa2fc", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "ca1508a9-c6ce-42aa-a144-9bd1648aa2fc", + "panelRefName": "panel_ca1508a9-c6ce-42aa-a144-9bd1648aa2fc", + "title": "[Cloudflare Logpush] Latest Workers Trace Events", + "type": "search", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Logs Cloudflare Logpush] Workers Trace Events", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-25T11:01:17.798Z", + "id": "cloudflare_logpush-a32dd850-2ad7-11ee-87da-672c93538971", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "e2fd2885-4175-46e1-9120-f4c3582e8d38:indexpattern-datasource-layer-0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2fd2885-4175-46e1-9120-f4c3582e8d38:af534ed2-ab39-47e7-bb3a-3c908a1087be", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6b325841-d762-487d-8dca-cb4ebebb627d:indexpattern-datasource-layer-0a1d14a1-6c2d-448f-aeab-c74516b341ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6b325841-d762-487d-8dca-cb4ebebb627d:1e78be6d-8f04-4128-90f4-5b3959c5dc7f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8bf7449a-9767-4d83-af74-bda870702574:indexpattern-datasource-layer-5b887ab3-d47e-4517-b700-14d9a5208aa6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8bf7449a-9767-4d83-af74-bda870702574:a8163ada-58bc-4a6d-bb72-c6fdf4c6f1d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2048f6ff-25c6-4123-a609-3b931f6e817c:indexpattern-datasource-layer-49a5faac-3cae-448d-98ca-a61e4c17d63b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2048f6ff-25c6-4123-a609-3b931f6e817c:0f092bcb-99e9-4e8c-8054-d41e1d2ef9ce", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa1ad025-cb18-45f0-8c07-1dc21e517b08:indexpattern-datasource-layer-49a5faac-3cae-448d-98ca-a61e4c17d63b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa1ad025-cb18-45f0-8c07-1dc21e517b08:28dbbc66-83d1-41e9-9f81-c7fad36a9167", + "type": "index-pattern" + }, + { + "id": "cloudflare_logpush-c1961a90-2ad3-11ee-87da-672c93538971", + "name": "ca1508a9-c6ce-42aa-a144-9bd1648aa2fc:panel_ca1508a9-c6ce-42aa-a144-9bd1648aa2fc", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_8bbf6ad1-37ae-44c3-a39c-9a8ea9433308:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ad801e07-23f4-4740-8822-69fb17f5b1a2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_b92df946-457d-4873-9279-1132e3462323:rangeSliderDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fdc3f099-79ba-4e97-b3f1-7224e11bc14b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c071ba44-45ef-487b-bddd-40e74d3d0298:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c480ba9a-02e0-4b58-b390-a89a6c580722:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_42493894-084c-4ddc-bb32-9a3b45326510:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_93e6eb58-597a-410a-9a72-fc8f9caa0824:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/cloudflare_logpush/kibana/search/cloudflare_logpush-c1961a90-2ad3-11ee-87da-672c93538971.json b/packages/cloudflare_logpush/kibana/search/cloudflare_logpush-c1961a90-2ad3-11ee-87da-672c93538971.json new file mode 100644 index 00000000000..c421a332a27 --- /dev/null +++ b/packages/cloudflare_logpush/kibana/search/cloudflare_logpush-c1961a90-2ad3-11ee-87da-672c93538971.json @@ -0,0 +1,71 @@ +{ + "attributes": { + "columns": [ + "event.id", + "cloudflare_logpush.workers_trace.script.name", + "http.request.method", + "http.response.status_code", + "url.original" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "cloudflare_logpush.workers_trace" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "cloudflare_logpush.workers_trace" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [], + "timeRestore": false, + "title": "Workers Trace Events search", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-25T10:55:26.445Z", + "id": "cloudflare_logpush-c1961a90-2ad3-11ee-87da-672c93538971", + "migrationVersion": { + "search": "8.0.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search" +} \ No newline at end of file diff --git a/packages/cloudflare_logpush/kibana/tags.yml b/packages/cloudflare_logpush/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cloudflare_logpush/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cloudflare_logpush/manifest.yml b/packages/cloudflare_logpush/manifest.yml index 9c14bf7ec89..59a65f0a39d 100644 --- a/packages/cloudflare_logpush/manifest.yml +++ b/packages/cloudflare_logpush/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: cloudflare_logpush title: Cloudflare Logpush -version: "1.5.0" +version: "1.9.0" description: Collect and parse logs from Cloudflare API with Elastic Agent. type: integration categories: @@ -9,7 +9,7 @@ categories: - network - cdn_security conditions: - kibana.version: ^8.7.0 + kibana.version: ^8.7.1 screenshots: - src: /img/cloudflare_logpush-overview1.png title: Cloudflare Logpush - Zero Trust Overview @@ -27,6 +27,10 @@ screenshots: title: Cloudflare - Network Sessions size: 1850x948 type: image/png + - src: /img/cloudflare_logpush-workers_trace1.png + title: Cloudflare - Workers Trace + size: 1850x948 + type: image/png icons: - src: /img/cloudflare-logo.svg title: Cloudflare Logpush logo diff --git a/packages/cockroachdb/changelog.yml b/packages/cockroachdb/changelog.yml index 1fe66834ab2..85dbcf5e7bb 100644 --- a/packages/cockroachdb/changelog.yml +++ b/packages/cockroachdb/changelog.yml @@ -1,3 +1,13 @@ +- version: "1.6.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6774 +- version: "1.5.1" + changes: + - description: Revert metrics field definition to the format used before introducing metric_type. + type: enhancement + link: https://github.com/elastic/integrations/pull/7429 - version: "1.5.0" changes: - description: Add `metric_type` mapping for the fields of `status` datastream. diff --git a/packages/cockroachdb/data_stream/status/fields/fields.yml b/packages/cockroachdb/data_stream/status/fields/fields.yml index 8ebf59b6606..01dbc50043e 100644 --- a/packages/cockroachdb/data_stream/status/fields/fields.yml +++ b/packages/cockroachdb/data_stream/status/fields/fields.yml @@ -1,17 +1,23 @@ - name: cockroachdb.status.*.value - type: double + type: object + object_type: double + object_type_mapping_type: "*" metric_type: gauge description: > Prometheus gauge metric - name: cockroachdb.status.*.counter - type: double + type: object + object_type: double + object_type_mapping_type: "*" metric_type: counter description: > Prometheus counter metric - name: cockroachdb.status.*.rate - type: double + type: object + object_type: double + object_type_mapping_type: "*" metric_type: counter description: > Prometheus rated counter metric diff --git a/packages/cockroachdb/data_stream/status/manifest.yml b/packages/cockroachdb/data_stream/status/manifest.yml index b83cd2dc170..b9fcb107d4b 100644 --- a/packages/cockroachdb/data_stream/status/manifest.yml +++ b/packages/cockroachdb/data_stream/status/manifest.yml @@ -60,6 +60,7 @@ streams: description: Collect CockroachDB status metrics elasticsearch: + index_mode: "time_series" index_template: settings: index.mapping.dimension_fields.limit: 32 \ No newline at end of file diff --git a/packages/cockroachdb/docs/README.md b/packages/cockroachdb/docs/README.md index bd2c029a583..254eba1f12f 100644 --- a/packages/cockroachdb/docs/README.md +++ b/packages/cockroachdb/docs/README.md @@ -26,10 +26,10 @@ exposing metrics in Prometheus format. | cloud.project.id | Name of the project in Google Cloud. | keyword | | | cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | cloud.region | Region in which this host is running. | keyword | | -| cockroachdb.status.\*.counter | Prometheus counter metric | double | counter | +| cockroachdb.status.\*.counter | Prometheus counter metric | object | counter | | cockroachdb.status.\*.histogram | Prometheus histogram metric | object | | -| cockroachdb.status.\*.rate | Prometheus rated counter metric | double | counter | -| cockroachdb.status.\*.value | Prometheus gauge metric | double | gauge | +| cockroachdb.status.\*.rate | Prometheus rated counter metric | object | counter | +| cockroachdb.status.\*.value | Prometheus gauge metric | object | gauge | | cockroachdb.status.labels.advertise_addr | The IP address/hostname and port to tell other nodes to use. | keyword | | | cockroachdb.status.labels.go_version | The version of Go in which the source code is written. | keyword | | | cockroachdb.status.labels.http_addr | The IP address/hostname and port to listen on for DB Console HTTP requests. | keyword | | diff --git a/packages/cockroachdb/manifest.yml b/packages/cockroachdb/manifest.yml index cde9d48d7c4..821ad73084d 100644 --- a/packages/cockroachdb/manifest.yml +++ b/packages/cockroachdb/manifest.yml @@ -1,6 +1,6 @@ name: cockroachdb title: CockroachDB Metrics -version: "1.5.0" +version: "1.6.0" release: ga description: Collect metrics from CockroachDB servers with Elastic Agent. type: integration @@ -20,7 +20,7 @@ categories: - observability - datastore conditions: - kibana.version: "^8.6.0" + kibana.version: "^8.9.0" vars: - name: hosts type: text diff --git a/packages/couchbase/changelog.yml b/packages/couchbase/changelog.yml index 163514d22a6..3555741b8f7 100644 --- a/packages/couchbase/changelog.yml +++ b/packages/couchbase/changelog.yml @@ -1,3 +1,58 @@ +- version: "1.3.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7721 +- version: "1.2.8" + changes: + - description: Add dimension mapping for `xdcr` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7661 +- version: "1.2.7" + changes: + - description: Add dimension mapping for `resource` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7643 +- version: "1.2.6" + changes: + - description: Add dimension mapping for `query_index` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7608 +- version: "1.2.5" + changes: + - description: Add dimension mapping for `miscellaneous` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7606 +- version: "1.2.4" + changes: + - description: Add dimension mapping for `database_stats` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7540 +- version: "1.2.3" + changes: + - description: Add dimension mapping for `cluster` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7524 +- version: "1.2.2" + changes: + - description: Added dimension field mapping to `cbl_replication` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7498 +- version: "1.2.1" + changes: + - description: Add dimension mapping for `cache` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7430 +- version: "1.2.0" + changes: + - description: Add dimension field mapping to `bucket` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7419 +- version: "1.1.0" + changes: + - description: Add support for HTTP request trace logging to node data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7344 - version: "1.0.0" changes: - description: Make Couchbase GA diff --git a/packages/couchbase/data_stream/bucket/fields/ecs.yml b/packages/couchbase/data_stream/bucket/fields/ecs.yml index a1549907d13..20fc8ab532e 100644 --- a/packages/couchbase/data_stream/bucket/fields/ecs.yml +++ b/packages/couchbase/data_stream/bucket/fields/ecs.yml @@ -18,7 +18,32 @@ name: event.type - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true diff --git a/packages/couchbase/data_stream/bucket/fields/fields.yml b/packages/couchbase/data_stream/bucket/fields/fields.yml index 85ed950ab84..c1fb4b58cf6 100644 --- a/packages/couchbase/data_stream/bucket/fields/fields.yml +++ b/packages/couchbase/data_stream/bucket/fields/fields.yml @@ -32,6 +32,8 @@ metric_type: gauge - name: name type: keyword + #Reason to add as dimension: Bucketname is unique and uniquely identify a bucket within a cluster + dimension: true description: Name of the bucket. - name: operations_per_sec type: long diff --git a/packages/couchbase/data_stream/bucket/manifest.yml b/packages/couchbase/data_stream/bucket/manifest.yml index 04029cad669..6c600a21262 100644 --- a/packages/couchbase/data_stream/bucket/manifest.yml +++ b/packages/couchbase/data_stream/bucket/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/cache/fields/ecs.yml b/packages/couchbase/data_stream/cache/fields/ecs.yml index 5ce04c4dc40..15f1187bebf 100644 --- a/packages/couchbase/data_stream/cache/fields/ecs.yml +++ b/packages/couchbase/data_stream/cache/fields/ecs.yml @@ -20,7 +20,32 @@ name: server.address - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/cache/fields/fields.yml b/packages/couchbase/data_stream/cache/fields/fields.yml index c82614e19d8..c43f4f6eeab 100644 --- a/packages/couchbase/data_stream/cache/fields/fields.yml +++ b/packages/couchbase/data_stream/cache/fields/fields.yml @@ -40,6 +40,7 @@ metric_type: gauge - name: database.name type: keyword + dimension: true description: The database for which the data is being extracted. - name: revision type: group diff --git a/packages/couchbase/data_stream/cache/manifest.yml b/packages/couchbase/data_stream/cache/manifest.yml index a08a885596a..51a09d40949 100644 --- a/packages/couchbase/data_stream/cache/manifest.yml +++ b/packages/couchbase/data_stream/cache/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/cbl_replication/fields/ecs.yml b/packages/couchbase/data_stream/cbl_replication/fields/ecs.yml index 5ce04c4dc40..15f1187bebf 100644 --- a/packages/couchbase/data_stream/cbl_replication/fields/ecs.yml +++ b/packages/couchbase/data_stream/cbl_replication/fields/ecs.yml @@ -20,7 +20,32 @@ name: server.address - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/cbl_replication/fields/fields.yml b/packages/couchbase/data_stream/cbl_replication/fields/fields.yml index f291ddc3a4e..19ac8a72938 100644 --- a/packages/couchbase/data_stream/cbl_replication/fields/fields.yml +++ b/packages/couchbase/data_stream/cbl_replication/fields/fields.yml @@ -6,6 +6,7 @@ fields: - name: database.name type: keyword + dimension: true description: The database for which the data is being extracted. - name: pull type: group diff --git a/packages/couchbase/data_stream/cbl_replication/manifest.yml b/packages/couchbase/data_stream/cbl_replication/manifest.yml index 9f768f5aaa5..eb896d0c922 100644 --- a/packages/couchbase/data_stream/cbl_replication/manifest.yml +++ b/packages/couchbase/data_stream/cbl_replication/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/cluster/fields/ecs.yml b/packages/couchbase/data_stream/cluster/fields/ecs.yml index a1549907d13..20fc8ab532e 100644 --- a/packages/couchbase/data_stream/cluster/fields/ecs.yml +++ b/packages/couchbase/data_stream/cluster/fields/ecs.yml @@ -18,7 +18,32 @@ name: event.type - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true diff --git a/packages/couchbase/data_stream/cluster/manifest.yml b/packages/couchbase/data_stream/cluster/manifest.yml index 36d18b8e0a6..b1b22ff4e2c 100644 --- a/packages/couchbase/data_stream/cluster/manifest.yml +++ b/packages/couchbase/data_stream/cluster/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/database_stats/fields/ecs.yml b/packages/couchbase/data_stream/database_stats/fields/ecs.yml index 5ce04c4dc40..15f1187bebf 100644 --- a/packages/couchbase/data_stream/database_stats/fields/ecs.yml +++ b/packages/couchbase/data_stream/database_stats/fields/ecs.yml @@ -20,7 +20,32 @@ name: server.address - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/database_stats/fields/fields.yml b/packages/couchbase/data_stream/database_stats/fields/fields.yml index 9236af11290..3b5108dd908 100644 --- a/packages/couchbase/data_stream/database_stats/fields/fields.yml +++ b/packages/couchbase/data_stream/database_stats/fields/fields.yml @@ -6,6 +6,7 @@ fields: - name: database.name type: keyword + dimension: true description: The database for which the data is being extracted. - name: dcp.received.time type: long diff --git a/packages/couchbase/data_stream/database_stats/manifest.yml b/packages/couchbase/data_stream/database_stats/manifest.yml index 00131a33550..5a3ceb279fa 100644 --- a/packages/couchbase/data_stream/database_stats/manifest.yml +++ b/packages/couchbase/data_stream/database_stats/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/miscellaneous/fields/ecs.yml b/packages/couchbase/data_stream/miscellaneous/fields/ecs.yml index 5ce04c4dc40..15f1187bebf 100644 --- a/packages/couchbase/data_stream/miscellaneous/fields/ecs.yml +++ b/packages/couchbase/data_stream/miscellaneous/fields/ecs.yml @@ -20,7 +20,32 @@ name: server.address - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/miscellaneous/fields/fields.yml b/packages/couchbase/data_stream/miscellaneous/fields/fields.yml index cfdd0b2d8ee..7dacb1db974 100644 --- a/packages/couchbase/data_stream/miscellaneous/fields/fields.yml +++ b/packages/couchbase/data_stream/miscellaneous/fields/fields.yml @@ -6,6 +6,7 @@ fields: - name: database.name type: keyword + dimension: true description: The database for which the data is being extracted. - name: delta_sync type: group diff --git a/packages/couchbase/data_stream/miscellaneous/manifest.yml b/packages/couchbase/data_stream/miscellaneous/manifest.yml index 959cb28c960..f9d96f1789f 100644 --- a/packages/couchbase/data_stream/miscellaneous/manifest.yml +++ b/packages/couchbase/data_stream/miscellaneous/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/node/agent/stream/stream.yml.hbs b/packages/couchbase/data_stream/node/agent/stream/stream.yml.hbs index 48d70a82e6c..0e116c9beac 100644 --- a/packages/couchbase/data_stream/node/agent/stream/stream.yml.hbs +++ b/packages/couchbase/data_stream/node/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{period}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{host_couchbase.[0]}}/pools/default {{#if ssl_couchbase}} diff --git a/packages/couchbase/data_stream/node/manifest.yml b/packages/couchbase/data_stream/node/manifest.yml index 48caa4cc16e..a06d3514d83 100644 --- a/packages/couchbase/data_stream/node/manifest.yml +++ b/packages/couchbase/data_stream/node/manifest.yml @@ -29,3 +29,10 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. diff --git a/packages/couchbase/data_stream/query_index/fields/ecs.yml b/packages/couchbase/data_stream/query_index/fields/ecs.yml index a1549907d13..03bd6844606 100644 --- a/packages/couchbase/data_stream/query_index/fields/ecs.yml +++ b/packages/couchbase/data_stream/query_index/fields/ecs.yml @@ -18,7 +18,32 @@ name: event.type - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/query_index/manifest.yml b/packages/couchbase/data_stream/query_index/manifest.yml index 16e9ea321fb..0abc3cecc2c 100644 --- a/packages/couchbase/data_stream/query_index/manifest.yml +++ b/packages/couchbase/data_stream/query_index/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/resource/fields/ecs.yml b/packages/couchbase/data_stream/resource/fields/ecs.yml index 5ce04c4dc40..4c8245f29eb 100644 --- a/packages/couchbase/data_stream/resource/fields/ecs.yml +++ b/packages/couchbase/data_stream/resource/fields/ecs.yml @@ -20,7 +20,32 @@ name: server.address - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true diff --git a/packages/couchbase/data_stream/resource/manifest.yml b/packages/couchbase/data_stream/resource/manifest.yml index ef7ca4bdf10..26f1e4db314 100644 --- a/packages/couchbase/data_stream/resource/manifest.yml +++ b/packages/couchbase/data_stream/resource/manifest.yml @@ -29,3 +29,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/data_stream/xdcr/fields/ecs.yml b/packages/couchbase/data_stream/xdcr/fields/ecs.yml index a1549907d13..03bd6844606 100644 --- a/packages/couchbase/data_stream/xdcr/fields/ecs.yml +++ b/packages/couchbase/data_stream/xdcr/fields/ecs.yml @@ -18,7 +18,32 @@ name: event.type - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/couchbase/data_stream/xdcr/manifest.yml b/packages/couchbase/data_stream/xdcr/manifest.yml index 2c1e7b7c8a9..74d473847a3 100644 --- a/packages/couchbase/data_stream/xdcr/manifest.yml +++ b/packages/couchbase/data_stream/xdcr/manifest.yml @@ -36,3 +36,5 @@ streams: required: false show_user: false description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/couchbase/docs/README.md b/packages/couchbase/docs/README.md index 27e1a69a5ce..f8e9d3fe0e8 100644 --- a/packages/couchbase/docs/README.md +++ b/packages/couchbase/docs/README.md @@ -169,6 +169,13 @@ An example event for `bucket` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.bucket.data.used.bytes | Size of user data within buckets of the specified state that are resident in RAM. | long | byte | gauge | | couchbase.bucket.disk.fetches | Number of disk fetches. | long | | gauge | | couchbase.bucket.disk.used.bytes | Amount of disk used (bytes). | long | byte | gauge | @@ -191,6 +198,7 @@ An example event for `bucket` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -309,6 +317,13 @@ An example event for `cache` looks as following: | Field | Description | Type | Metric Type | |---|---|---|---| | @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | | couchbase.cache.channel.count | The total number of channels being cached. | long | gauge | | couchbase.cache.channel.entries.max | The total size of the largest channel cache. | long | gauge | | couchbase.cache.channel.hits | The total number of channel cache requests fully served by the cache. | long | counter | @@ -331,6 +346,7 @@ An example event for `cache` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | @@ -491,6 +507,13 @@ An example event for `cluster` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.cluster.buckets.max.count | Maximum number of buckets. | long | | | | couchbase.cluster.hdd.free.bytes | Free hard drive space in the cluster (bytes). | long | byte | gauge | | couchbase.cluster.hdd.quota.total.bytes | Hard drive quota total for the cluster (bytes). | long | byte | gauge | @@ -518,6 +541,7 @@ An example event for `cluster` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -681,6 +705,13 @@ An example event for `cbl_replication` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.cbl_replication.database.name | The database for which the data is being extracted. | keyword | | | | couchbase.cbl_replication.pull.attachment.bytes | The total size of attachments pulled. This is the pre-compressed size. | long | byte | counter | | couchbase.cbl_replication.pull.attachment.count | The total number of attachments pulled. | long | | counter | @@ -712,6 +743,7 @@ An example event for `cbl_replication` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | @@ -830,6 +862,13 @@ An example event for `database_stats` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.database_stats.database.name | The database for which the data is being extracted. | keyword | | | | couchbase.database_stats.dcp.received.time | The time between a document write and that document being received by Sync Gateway over DCP. | long | s | gauge | | couchbase.database_stats.document.reads.blip | The total number of documents read via Couchbase Lite 2.x replication since Sync Gateway node startup. | long | | counter | @@ -849,6 +888,7 @@ An example event for `database_stats` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | @@ -1013,6 +1053,13 @@ An example event for `miscellaneous` looks as following: | Field | Description | Type | Metric Type | |---|---|---|---| | @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | | couchbase.miscellaneous.database.name | The database for which the data is being extracted. | keyword | | | couchbase.miscellaneous.delta_sync.cache.hits | The total number of requested deltas that were available in the revision cache. | long | counter | | couchbase.miscellaneous.delta_sync.pull.replications | The number of delta replications that have been run. | long | counter | @@ -1040,6 +1087,7 @@ An example event for `miscellaneous` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | @@ -1171,6 +1219,13 @@ An example event for `resource` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.resource.admin_net.bytes.received | The total number of bytes received (since node start-up) on the network interface to which the Sync Gateway api.admin_interface is bound. | scaled_float | byte | gauge | | couchbase.resource.admin_net.bytes.sent | The total number of bytes sent (since node start-up) on the network interface to which the Sync Gateway api.admin_interface is bound. | scaled_float | byte | gauge | | couchbase.resource.error.count | The total number of errors logged. | long | | counter | @@ -1195,6 +1250,7 @@ An example event for `resource` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | @@ -1480,6 +1536,13 @@ An example event for `query_index` looks as following: | Field | Description | Type | Unit | |---|---|---|---| | @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | | couchbase.query_index.eventing.failed.count | Total number of failed eventing function operations. | float | | | couchbase.query_index.query.request_time.avg | Average total request time. | float | s | | couchbase.query_index.query.requests | Current number of requests per second. | float | | @@ -1498,6 +1561,7 @@ An example event for `query_index` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | tags | List of keywords used to tag each event. | keyword | | @@ -1609,6 +1673,13 @@ An example event for `xdcr` looks as following: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | couchbase.xdcr.backoff | Number of backoffs for XDCR DCP connections. | float | | gauge | | couchbase.xdcr.bytes.total | Number of bytes being sent for XDCR DCP connections. | float | byte | gauge | | couchbase.xdcr.count | Number of internal XDCR DCP connections in specified bucket. | float | | gauge | @@ -1628,6 +1699,7 @@ An example event for `xdcr` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | diff --git a/packages/couchbase/manifest.yml b/packages/couchbase/manifest.yml index 0fbe164288c..c22e8e36625 100644 --- a/packages/couchbase/manifest.yml +++ b/packages/couchbase/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: couchbase title: Couchbase -version: "1.0.0" +version: "1.3.0" license: basic description: Collect metrics from Couchbase databases with Elastic Agent. type: integration @@ -9,7 +9,7 @@ categories: - datastore - observability conditions: - kibana.version: ^8.4.0 + kibana.version: ^8.8.0 screenshots: - src: /img/couchbase-metrics-overview.png title: Couchbase metrics Overview dashboard diff --git a/packages/couchdb/changelog.yml b/packages/couchdb/changelog.yml index b60f81fa93d..14f1dfa494a 100644 --- a/packages/couchdb/changelog.yml +++ b/packages/couchdb/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.0.0" + changes: + - description: Make CouchDB GA. + type: enhancement + link: https://github.com/elastic/integrations/pull/7666 +- version: "0.7.1" + changes: + - description: Resolve the conflicts in host.ip field. + type: bugfix + link: https://github.com/elastic/integrations/pull/7495 - version: "0.7.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/couchdb/data_stream/server/fields/ecs.yml b/packages/couchdb/data_stream/server/fields/ecs.yml index c56eb817f90..6e3e376fc38 100644 --- a/packages/couchdb/data_stream/server/fields/ecs.yml +++ b/packages/couchdb/data_stream/server/fields/ecs.yml @@ -14,6 +14,8 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address dimension: true diff --git a/packages/couchdb/docs/README.md b/packages/couchdb/docs/README.md index dc0ce438313..a4e2f168215 100644 --- a/packages/couchdb/docs/README.md +++ b/packages/couchdb/docs/README.md @@ -204,6 +204,7 @@ An example event for `server` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | diff --git a/packages/couchdb/manifest.yml b/packages/couchdb/manifest.yml index 7860ddc47dc..40ae4e9fe56 100644 --- a/packages/couchdb/manifest.yml +++ b/packages/couchdb/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: couchdb title: CouchDB -version: "0.7.0" +version: "1.0.0" license: basic description: Collect metrics from CouchDB with Elastic Agent. type: integration @@ -69,4 +69,3 @@ policy_templates: show_user: false owner: github: elastic/obs-infraobs-integrations - diff --git a/packages/crowdstrike/_dev/build/build.yml b/packages/crowdstrike/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/crowdstrike/_dev/build/build.yml +++ b/packages/crowdstrike/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/crowdstrike/changelog.yml b/packages/crowdstrike/changelog.yml index 1249aea797a..5e34c5efeb9 100644 --- a/packages/crowdstrike/changelog.yml +++ b/packages/crowdstrike/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.3" + changes: + - description: Convert Win32 timestamps to unix millisecond timestamps. + type: bugfix + link: https://github.com/elastic/integrations/pull/7734 +- version: "1.18.2" + changes: + - description: Fixed event tag handling for the falcon data-stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7625 +- version: "1.18.1" + changes: + - description: Fixed Windows NT timestamp handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/7548 +- version: "1.18.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7107 +- version: "1.17.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.16.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 +- version: "1.16.0" + changes: + - description: Adding new Event types to the Falcon Datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6844 - version: "1.15.0" changes: - description: Overhaul of the Falcon Datastream, adding plenty of new fields and ECS mappings. diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json index 9f058be2cc3..5f82ec01f78 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-audit-events.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2020-02-27T19:12:14.000Z", "crowdstrike": { "event": { "SessionId": "6020260b-0398-4d41-999d-5531b55522de" @@ -13,7 +14,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -23,6 +24,7 @@ "network", "session" ], + "created": "2020-02-27T19:12:14.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", "start": "2020-02-27T19:12:14.000Z", @@ -55,6 +57,7 @@ } }, { + "@timestamp": "2020-02-27T19:12:52.000Z", "crowdstrike": { "event": { "SessionId": "6020260b-0398-4d41-999d-5531b55522de" @@ -67,7 +70,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -77,6 +80,7 @@ "network", "session" ], + "created": "2020-02-27T19:12:52.000Z", "end": "2020-02-27T19:12:52.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"6020260b-0398-4d41-999d-5531b55522de\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", @@ -109,6 +113,7 @@ } }, { + "@timestamp": "2020-02-12T21:29:10.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -144,7 +149,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -153,6 +158,7 @@ "category": [ "iam" ], + "created": "2020-02-12T21:29:10.710Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 0,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581542950710,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"api-client-id:1234567890abcdefghijklmnopqrstuvwxyz\",\n \"UserIp\": \"10.10.0.8\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1581542950,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"1234567890abcdefghijklmnopqr\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"-1\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"siem-connector-v2.0.0\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"[UserActivityAuditEvent HashSpreadingEvent RemoteResponseSessionStartEvent RemoteResponseSessionEndEvent DetectionSummaryEvent AuthActivityAuditEvent]\"\n }\n ]\n }\n}", "outcome": "success" @@ -195,7 +201,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -204,6 +210,7 @@ "category": [ "authentication" ], + "created": "2020-02-12T21:39:37.147Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581543577147,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581543577147\n }\n}", "outcome": "success" @@ -247,7 +254,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -256,6 +263,7 @@ "category": [ "authentication" ], + "created": "2020-02-12T22:14:37.554Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 2,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581545677554,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"bob@company.com\",\n \"UserIp\": \"192.168.6.3\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581545677554\n }\n}", "outcome": "success" @@ -285,6 +293,7 @@ } }, { + "@timestamp": "2020-02-12T22:24:08.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -307,13 +316,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_activity_audit_event", "category": [ "iam" ], + "created": "2020-02-12T22:24:08.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581546248000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"chris@company.com\",\n \"UserIp\": \"192.168.6.13\",\n \"OperationName\": \"update_group\",\n \"ServiceName\": \"groups\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"group_id\",\n \"ValueString\": \"3c80ce30b9654cb4bd15beec6a517e65\"\n },\n {\n \"Key\": \"action_name\",\n \"ValueString\": \"add_group_member\"\n }\n ],\n \"UTCTimestamp\": 1581546248\n }\n}", "type": [ @@ -365,7 +375,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -374,6 +384,7 @@ "category": [ "iam" ], + "created": "2020-02-13T13:41:52.140Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 4,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601312140,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"requestResetPassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601312140,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"alice@company.com\"\n }\n ]\n }\n}", "outcome": "success" @@ -417,7 +428,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -426,6 +437,7 @@ "category": [ "authentication" ], + "created": "2020-02-13T13:42:21.730Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 5,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601341730,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601341730\n }\n}", "outcome": "success" @@ -475,7 +487,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -484,6 +496,7 @@ "category": [ "iam" ], + "created": "2020-02-13T13:45:20.236Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601520236,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"changePassword\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601520236,\n \"AuditKeyValues\": [\n {\n \"Key\": \"target_name\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", "outcome": "success", @@ -531,7 +544,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -540,6 +553,7 @@ "category": [ "authentication" ], + "created": "2020-02-13T13:46:12.362Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 7,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601572362,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"userAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601572362\n }\n}", "outcome": "success" @@ -583,7 +597,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -592,6 +606,7 @@ "category": [ "authentication" ], + "created": "2020-02-13T13:50:14.754Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601814754,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"twoFactorAuthenticate\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601814754\n }\n}", "outcome": "success" @@ -635,7 +650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -644,6 +659,7 @@ "category": [ "iam" ], + "created": "2020-02-13T13:50:20.289Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 9,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1581601820289,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"selfAcceptEula\",\n \"ServiceName\": \"CrowdStrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1581601820289\n }\n}", "outcome": "success" @@ -673,6 +689,7 @@ } }, { + "@timestamp": "2020-02-13T14:14:22.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -703,13 +720,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_activity_audit_event", "category": [ "iam" ], + "created": "2020-02-13T14:14:22.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 10,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1581603262000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"alice@company.com\",\n \"UserIp\": \"192.168.6.8\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"ldt:5a6fd0b7347440cd74cb84855a8aee18:17180539745\"\n },\n {\n \"Key\": \"new_state\",\n \"ValueString\": \"in_progress\"\n },\n {\n \"Key\": \"assigned_to\",\n \"ValueString\": \"First Last\"\n },\n {\n \"Key\": \"assigned_to_uid\",\n \"ValueString\": \"first.last@company.com\"\n }\n ],\n \"UTCTimestamp\": 1581603262\n }\n}", "type": [ diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json index 75b7e424bdf..b14e18ecb5e 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-auth-activity.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2023-06-15T14:29:38.000Z", "crowdstrike": { "event": { "Attributes": { @@ -43,7 +44,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -52,6 +53,7 @@ "category": [ "iam" ], + "created": "2023-06-15T16:06:52.400Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 6,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStopped\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686839378,\n \"AuditKeyValues\": [\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n },\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APIID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"2\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APPCLIENTIDTEST\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"2\",\n \"partition\": \"0\"\n }\n }\n}", "outcome": "success" @@ -92,6 +94,7 @@ } }, { + "@timestamp": "2023-06-15T17:19:16.000Z", "crowdstrike": { "event": { "Attributes": { @@ -134,7 +137,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -143,6 +146,7 @@ "category": [ "iam" ], + "created": "2023-06-15T17:19:16.137Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 8,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1686849556137,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"API:USERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"streamStarted\",\n \"ServiceName\": \"Crowdstrike Streaming API\",\n \"Success\": true,\n \"UTCTimestamp\": 1686849556,\n \"AuditKeyValues\": [\n {\n \"Key\": \"APIClientID\",\n \"ValueString\": \"APICLIENTID\"\n },\n {\n \"Key\": \"partition\",\n \"ValueString\": \"0\"\n },\n {\n \"Key\": \"offset\",\n \"ValueString\": \"8\"\n },\n {\n \"Key\": \"appId\",\n \"ValueString\": \"APPIDTEST\"\n },\n {\n \"Key\": \"eventType\",\n \"ValueString\": \"All event type(s)\"\n }\n ],\n \"Attributes\": {\n \"APIClientID\": \"APICLIENTID\",\n \"appId\": \"APPIDTEST\",\n \"eventType\": \"All event type(s)\",\n \"offset\": \"8\",\n \"partition\": \"0\"\n }\n }\n}", "outcome": "success" diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log new file mode 100644 index 00000000000..aa0e66380d1 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log @@ -0,0 +1,26 @@ +{ + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712858, + "eventType": "CSPMIOAStreamingEvent", + "eventCreationTime": 1663011160000, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "PolicyId": 249, + "PolicyStatement": "EC2 instance manually deleted by IAM user", + "CloudProvider": "aws", + "CloudService": "EC2", + "Severity": 1, + "SeverityName": "High", + "EventAction": "TerminateInstances", + "EventSource": "aws.cloudtrail", + "EventCreatedTimestamp": 1663011160, + "UserId": "AIDAXRCSSEFWEAH3BLR2Z", + "UserName": "cs_internal_service_acct", + "UserSourceIp": "81.2.69.144", + "Tactic": "Impact", + "Technique": "Data Destruction" + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json new file mode 100644 index 00000000000..f9d367552c0 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmioa-streaming.log-expected.json @@ -0,0 +1,93 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:32:40.000Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "aws", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "PolicyId": 249, + "SeverityName": "High" + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMIOAStreamingEvent", + "offset": 54712858, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "TerminateInstances", + "category": [ + "configuration" + ], + "created": "2022-09-12T19:32:40.000Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712858,\n\t\t\"eventType\": \"CSPMIOAStreamingEvent\",\n\t\t\"eventCreationTime\": 1663011160000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"PolicyId\": 249,\n\t\t\"PolicyStatement\": \"EC2 instance manually deleted by IAM user\",\n\t\t\"CloudProvider\": \"aws\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"EventAction\": \"TerminateInstances\",\n\t\t\"EventSource\": \"aws.cloudtrail\",\n\t\t\"EventCreatedTimestamp\": 1663011160,\n\t\t\"UserId\": \"AIDAXRCSSEFWEAH3BLR2Z\",\n\t\t\"UserName\": \"cs_internal_service_acct\",\n\t\t\"UserSourceIp\": \"81.2.69.144\",\n\t\t\"Tactic\": \"Impact\",\n\t\t\"Technique\": \"Data Destruction\"\n\t}\n}", + "provider": "aws.cloudtrail", + "severity": 1, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 instance manually deleted by IAM user", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "ip": [ + "81.2.69.144" + ], + "user": [ + "cs_internal_service_acct" + ] + }, + "source": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Impact" + ] + }, + "technique": { + "name": [ + "Data Destruction" + ] + } + }, + "user": { + "id": "AIDAXRCSSEFWEAH3BLR2Z", + "name": "cs_internal_service_acct" + } + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log new file mode 100644 index 00000000000..d1fb05fcec8 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log @@ -0,0 +1,52 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": [{ + "Key": "cstag-business", + "ValueString": "Sales" + }, { + "Key": "cstag-accounting", + "ValueString": "dev" + }, { + "Key": "cstag-department", + "ValueString": "Sales - 310000" + }, { + "Key": "Slackbot Env UUID", + "ValueString": "C68EC25E-32BD-11ED-AE4B-0EBCA3237C75" + }, { + "Key": "Name", + "ValueString": "CS-SE-Demo-KALI-ROBERT.WILSON" + }, { + "Key": "Slack_User", + "ValueString": "bob.smith" + }, { + "Key": "cstag-owner", + "ValueString": "jane.doe" + }], + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json new file mode 100644 index 00000000000..33c8de90714 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-cspmsearch-streaming.log-expected.json @@ -0,0 +1,75 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": [{\n\t\t\t\"Key\": \"cstag-business\",\n\t\t\t\"ValueString\": \"Sales\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-accounting\",\n\t\t\t\"ValueString\": \"dev\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-department\",\n\t\t\t\"ValueString\": \"Sales - 310000\"\n\t\t}, {\n\t\t\t\"Key\": \"Slackbot Env UUID\",\n\t\t\t\"ValueString\": \"C68EC25E-32BD-11ED-AE4B-0EBCA3237C75\"\n\t\t}, {\n\t\t\t\"Key\": \"Name\",\n\t\t\t\"ValueString\": \"CS-SE-Demo-KALI-ROBERT.WILSON\"\n\t\t}, {\n\t\t\t\"Key\": \"Slack_User\",\n\t\t\t\"ValueString\": \"bob.smith\"\n\t\t}, {\n\t\t\t\"Key\": \"cstag-owner\",\n\t\t\t\"ValueString\": \"jane.doe\"\n\t\t}],\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "severity": 1, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "cstag-business:Sales", + "cstag-accounting:dev", + "cstag-department:Sales - 310000", + "Slackbot Env UUID:C68EC25E-32BD-11ED-AE4B-0EBCA3237C75", + "Name:CS-SE-Demo-KALI-ROBERT.WILSON", + "Slack_User:bob.smith", + "cstag-owner:jane.doe" + ] + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json index 5723d8d8f9c..a9188bcf0ac 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-detection-summary.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2023-06-15T16:06:52.400Z", "crowdstrike": { "event": { "AssociatedFile": "\\Device\\HarddiskVolume3\\TESTUSER\\TESTELASTICUSER\\SOFTWARE\\TESTSOFTWARE\\FILE.exe", @@ -72,13 +73,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", "category": [ "malware" ], + "created": "2023-06-15T16:06:52.400Z", "kind": "alert", "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 1,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1686845212400,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 123123,\n \"ParentProcessId\": 321321,\n \"ComputerName\": \"ELASTICHOST\",\n \"UserName\": \"ELASTICUSER\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file is classified as Adware/PUP based on its SHA256 hash.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"TESTFILE.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume3\\\\Users\\\\ELASTICUSER\\\\Software\\\\TESTSOFTWARE\",\n \"CommandLine\": \"\\\"C:\\\\Users\\\\TESTUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\\\" -Embedding\",\n \"SHA256String\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"MD5String\": \"49f30e09200e7b59edc5ef32fbd0442c\",\n \"SHA1String\": \"7e54a24d4df5b7fe4a75d7ce1c027705c368666b\",\n \"MachineDomain\": \"INTERNAL\",\n \"NetworkAccesses\": [\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845157,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.1\",\n \"LocalPort\": 53517,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 443,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n },\n {\n \"AccessType\": 0,\n \"AccessTimestamp\": 1686845158,\n \"Protocol\": \"TCP\",\n \"LocalAddress\": \"10.0.0.2\",\n \"LocalPort\": 53518,\n \"RemoteAddress\": \"67.43.156.1\",\n \"RemotePort\": 80,\n \"ConnectionDirection\": 0,\n \"IsIPV6\": false\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID\",\n \"SensorId\": \"sensorid123\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0b2cde5b355bda69aeb15159fa98b5554053f0936259a53c6dfb0934389238a2\",\n \"DetectId\": \"detect::id::test\",\n \"LocalIP\": \"89.160.20.112\",\n \"MACAddress\": \"1c-2d-b3-4a-56-7e\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"PUP\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false,\n \"HandleOperationDowngraded\": false,\n \"KillActionFailed\": false,\n \"BlockingUnsupportedOrDisabled\": false,\n \"SuspendProcess\": false,\n \"SuspendParent\": false\n },\n \"ParentImageFileName\": \"\",\n \"ParentCommandLine\": \"\",\n \"GrandparentImageFileName\": \"\",\n \"GrandparentCommandLine\": \"\",\n \"HostGroups\": \"hostgroupsID\",\n \"AssociatedFile\": \"\\\\Device\\\\HarddiskVolume3\\\\TESTUSER\\\\TESTELASTICUSER\\\\SOFTWARE\\\\TESTSOFTWARE\\\\FILE.exe\",\n \"PatternId\": 5728\n }\n}", "reference": "https://falcon.crowdstrike.com/activity/detections/detail/REFERENCE?_cid=CID", @@ -135,6 +137,7 @@ ] }, "rule": { + "description": "This file is classified as Adware/PUP based on its SHA256 hash.", "id": "detect::id::test", "name": "NGAV" }, @@ -163,7 +166,17 @@ "preserve_original_event" ], "threat": { - "framework": "MITRE ATT\u0026CK" + "framework": "MITRE ATT\u0026CK", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "PUP" + ] + } }, "user": { "name": "ELASTICUSER" diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json index 914f53f5b99..866bf6d3101 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-events.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2020-02-19T08:30:00.000Z", "crowdstrike": { "event": { "MACAddress": "00-00-00-11-22-33", @@ -32,13 +33,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Prevention, process killed.", "category": [ "malware" ], + "created": "2020-02-19T08:30:00.000Z", "kind": "alert", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 294564,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1582101000000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1536846339,\n \"ProcessEndTime\": 0,\n \"ProcessId\": 38684386611,\n \"ParentProcessId\": 38682494050,\n \"ComputerName\": \"alice-laptop\",\n \"UserName\": \"alice\",\n \"DetectName\": \"Process Terminated\",\n \"DetectDescription\": \"Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.\",\n \"Severity\": 4,\n \"SeverityName\": \"High\",\n \"FileName\": \"explorer.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume1\\\\Windows\",\n \"CommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"SHA256String\": \"6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a\",\n \"MD5String\": \"ac4c51eb24aa95b77f705ab159189e24\",\n \"MachineDomain\": \"CORP-DOMAIN\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4\",\n \"SensorId\": \"7c808b4c8878433287eea53d4a8c3268\",\n \"DetectId\": \"ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584\",\n \"LocalIP\": \"192.168.12.51\",\n \"MACAddress\": \"00-00-00-11-22-33\",\n \"Tactic\": \"Malware\",\n \"Technique\": \"Ransomware\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Prevention, process killed.\",\n \"PatternDispositionValue\": 16,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": true,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": false,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": false\n }\n }\n}", "reference": "https://falcon.crowdstrike.com/ec86abd353824e96765ecbe18eb4f0b4", @@ -92,6 +94,7 @@ ] }, "rule": { + "description": "Terminated a process related to the deletion of backups, which is often indicative of ransomware activity.", "id": "ldt:ec86abd353824e96765ecbe18eb4f0b4:38655257584", "name": "Process Terminated" }, @@ -102,13 +105,24 @@ "preserve_original_event" ], "threat": { - "framework": "MITRE ATT\u0026CK" + "framework": "MITRE ATT\u0026CK", + "tactic": { + "name": [ + "Malware" + ] + }, + "technique": { + "name": [ + "Ransomware" + ] + } }, "user": { "name": "alice" } }, { + "@timestamp": "2020-03-04T04:17:56.766Z", "crowdstrike": { "event": { "FineScore": 1.2, @@ -122,7 +136,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -131,6 +145,7 @@ "category": [ "malware" ], + "created": "2020-03-04T04:17:56.766Z", "end": "2020-03-04T04:17:50.000Z", "kind": "alert", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 1824,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1583295476766,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1583295228,\n \"IncidentEndTime\": 1583295470,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"State\": \"open\",\n \"FineScore\": 1.2\n }\n}", @@ -150,6 +165,7 @@ ] }, { + "@timestamp": "2020-06-26T15:55:52.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -172,13 +188,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_activity_audit_event", "category": [ "iam" ], + "created": "2020-06-26T15:55:52.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"8f69fe9e-b995-4204-95ad-44f9bcf75b6b\",\n \"offset\": 22865,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1593186952000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"35b35a53da374816a6b471cf09e12019_a076d3121743755f2d4f8d4d5807f0bc013177f7847d09b48e76de88ace08c78\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1593186952\n }\n}", "type": [ diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json index d369d00a31a..d0c57100ce6 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-firewall.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2020-07-20T12:41:46.000Z", "crowdstrike": { "event": { "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", @@ -32,7 +33,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -42,6 +43,7 @@ "network" ], "code": "FirewallRuleIP4Matched", + "created": "2020-07-20T12:41:46.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"/usr/bin/nginx\",\n \"LocalAddress\": \"10.10.10.10\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-TESTSTATION-General\",\n \"PolicyID\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"216.160.83.56\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"158446832506666\"\n }\n}", "type": [ diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log new file mode 100644 index 00000000000..8c51652f042 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log @@ -0,0 +1,26 @@ +{ + "metadata": { + "customerIDString": "3426316453426234", + "offset": 2664264, + "eventType": "IdentityProtectionEvent", + "eventCreationTime": 1686891836581, + "version": "1.0" + }, + "event": { + "IncidentType": "UNUSUAL_ENDPOINT_USE", + "IncidentDescription": "User seen coming from a location that deviates from their baseline.", + "Severity": 1, + "SeverityName": "INFO", + "StartTime": 1686891836383, + "EndTime": 1686891836553, + "IdentityProtectionIncidentId": "INC-123", + "UserName": "TESTUSER", + "EndpointName": "TESTHOSTNAME", + "EndpointIp": "89.160.20.112", + "Category": "Incidents", + "NumbersOfAlerts": 1, + "NumberOfCompromisedEntities": 1, + "State": "NEW", + "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123" + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json new file mode 100644 index 00000000000..c1c44241134 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-identity-protection-incident.log-expected.json @@ -0,0 +1,61 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-16T05:03:56.553Z", + "crowdstrike": { + "event": { + "Category": "Incidents", + "NumberOfCompromisedEntities": 1, + "NumbersOfAlerts": 1, + "SeverityName": "INFO", + "State": "NEW" + }, + "metadata": { + "customerIDString": "3426316453426234", + "eventType": "IdentityProtectionEvent", + "offset": 2664264, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "UNUSUAL_ENDPOINT_USE", + "category": [ + "iam" + ], + "created": "2023-06-16T05:03:56.581Z", + "id": "INC-123", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"3426316453426234\",\n \"offset\": 2664264,\n \"eventType\": \"IdentityProtectionEvent\",\n \"eventCreationTime\": 1686891836581,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentType\": \"UNUSUAL_ENDPOINT_USE\",\n \"IncidentDescription\": \"User seen coming from a location that deviates from their baseline.\",\n \"Severity\": 1,\n \"SeverityName\": \"INFO\",\n \"StartTime\": 1686891836383,\n \"EndTime\": 1686891836553,\n \"IdentityProtectionIncidentId\": \"INC-123\",\n \"UserName\": \"TESTUSER\",\n \"EndpointName\": \"TESTHOSTNAME\",\n \"EndpointIp\": \"89.160.20.112\",\n \"Category\": \"Incidents\",\n \"NumbersOfAlerts\": 1,\n \"NumberOfCompromisedEntities\": 1,\n \"State\": \"NEW\",\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/incidents/INC-123\"\n }\n}", + "reference": "https://falcon.crowdstrike.com/identity-protection/incidents/INC-123", + "severity": 1, + "start": "2023-06-16T05:03:56.553Z", + "type": [ + "info" + ] + }, + "host": { + "hostname": "TESTHOSTNAME", + "ip": "89.160.20.112" + }, + "message": "User seen coming from a location that deviates from their baseline.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "user": [ + "TESTUSER" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "TESTUSER" + } + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json index 236ab0f46b5..b2613629ab0 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-incident-summary.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2023-06-15T16:06:52.400Z", "crowdstrike": { "event": { "FineScore": 0.5, @@ -19,7 +20,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -28,6 +29,7 @@ "category": [ "malware" ], + "created": "2023-06-15T16:06:52.400Z", "end": "2023-06-04T02:14:52.000Z", "id": "inc:123:abc", "kind": "alert", diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log new file mode 100644 index 00000000000..a738d1eb824 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log @@ -0,0 +1,34 @@ +{ + "metadata": { + "customerIDString": "12312312312312321", + "offset": 2662765, + "eventType": "IdpDetectionSummaryEvent", + "eventCreationTime": 1686848064000, + "version": "1.0" + }, + "event": { + "ContextTimeStamp": 133221234560000000, + "DetectId": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "DetectName": "Unusual login to an endpoint", + "DetectDescription": "A user logged in to a machine for the first time", + "FalconHostLink": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "StartTime": 123456789000000000, + "EndTime": 123456789000000000, + "Severity": 7, + "Tactic": "Initial Access", + "Technique": "Valid Accounts", + "Objective": "Gain Access", + "SourceAccountDomain": "DOMAIN.COM", + "SourceAccountName": "johnb", + "SourceAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointHostName": "pc01.domain.com", + "SourceEndpointIpAddress": "81.2.69.144", + "SourceEndpointSensorId": "12345678901234567890123456789012", + "PrecedingActivityTimeStamp": 133154452345780000, + "MostRecentActivityTimeStamp": 133313215755670000, + "ActivityId": "12345678-1234-1234-1234-123456789000", + "PatternId": 51135 + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json new file mode 100644 index 00000000000..29dc3198378 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-ipd-summary.log-expected.json @@ -0,0 +1,87 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-15T16:54:24.000Z", + "crowdstrike": { + "event": { + "ActivityId": "12345678-1234-1234-1234-123456789000", + "MostRecentActivityTimeStamp": 1686847975567, + "Objective": "Gain Access", + "PatternId": "51135", + "PrecedingActivityTimeStamp": 1670971634578, + "SourceEndpointAccountObjectGuid": "12345678-1234-1234-1234-123456789000", + "SourceEndpointAccountObjectSid": "S-1-3-44-55555555-666666666-7777777777-88888", + "SourceEndpointSensorId": "12345678901234567890123456789012" + }, + "metadata": { + "customerIDString": "12312312312312321", + "eventType": "IdpDetectionSummaryEvent", + "offset": 2662765, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ipd-detection", + "category": [ + "malware" + ], + "created": "2023-03-01T05:50:56.000Z", + "end": "1992-03-21T19:15:00.000Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"12312312312312321\",\n\t\t\"offset\": 2662765,\n\t\t\"eventType\": \"IdpDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1686848064000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"ContextTimeStamp\": 133221234560000000,\n\t\t\"DetectId\": \"12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000\",\n\t\t\"DetectName\": \"Unusual login to an endpoint\",\n\t\t\"DetectDescription\": \"A user logged in to a machine for the first time\",\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012\",\n\t\t\"StartTime\": 123456789000000000,\n\t\t\"EndTime\": 123456789000000000,\n\t\t\"Severity\": 7,\n\t\t\"Tactic\": \"Initial Access\",\n\t\t\"Technique\": \"Valid Accounts\",\n\t\t\"Objective\": \"Gain Access\",\n\t\t\"SourceAccountDomain\": \"DOMAIN.COM\",\n\t\t\"SourceAccountName\": \"johnb\",\n\t\t\"SourceAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointAccountObjectGuid\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"SourceEndpointAccountObjectSid\": \"S-1-3-44-55555555-666666666-7777777777-88888\",\n\t\t\"SourceEndpointHostName\": \"pc01.domain.com\",\n\t\t\"SourceEndpointIpAddress\": \"81.2.69.144\",\n\t\t\"SourceEndpointSensorId\": \"12345678901234567890123456789012\",\n\t\t\"PrecedingActivityTimeStamp\": 133154452345780000,\n\t\t\"MostRecentActivityTimeStamp\": 133313215755670000,\n\t\t\"ActivityId\": \"12345678-1234-1234-1234-123456789000\",\n\t\t\"PatternId\": 51135\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/identity-protection/detections/12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000?cid=12345678901234567890123456789012", + "severity": 7, + "start": "1992-03-21T19:15:00.000Z", + "type": [ + "info" + ] + }, + "host": { + "ip": "81.2.69.144", + "name": "pc01.domain.com" + }, + "message": "A user logged in to a machine for the first time", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "pc01.domain.com" + ], + "user": [ + "johnb" + ] + }, + "rule": { + "description": "A user logged in to a machine for the first time", + "id": "12345678901234567890123456789012:ind:12345678901234567890123456789012:12345678-1234-1234-1234-123456789000", + "name": "Unusual login to an endpoint", + "uuid": "51135" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "tactic": { + "name": [ + "Initial Access" + ] + }, + "technique": { + "name": [ + "Valid Accounts" + ] + } + }, + "user": { + "domain": "DOMAIN.COM", + "id": "S-1-3-44-55555555-666666666-7777777777-88888", + "name": "johnb" + } + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log new file mode 100644 index 00000000000..1f9ba7a9390 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log @@ -0,0 +1,36 @@ +{ + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "offset": 701283, + "eventType": "MobileDetectionSummaryEvent", + "eventCreationTime": 1649420269000, + "version": "1.0" + }, + "event": { + "SensorId": "85ae98xxxxxxd9a8f2", + "MobileDetectionId": 1310556238, + "ComputerName": "TESTComputer", + "UserName": "TestUSER", + "ContextTimeStamp": 1649061056, + "DetectId": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "DetectName": "AppSideloadDetected", + "DetectDescription": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "Tactic": "Insecure security posture", + "TacticId": "CSTA0009", + "Technique": "Bad device settings", + "TechniqueId": "CST0024", + "Objective": "Falcon Detection Method", + "Severity": 50, + "FalconHostLink": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "MobileAppsDetails": [{ + "AppIdentifier": "com.facebook.katana", + "AndroidAppLabel": "Facebook", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "AppInstallerInformation": "unknown", + "IsBeingDebugged": false, + "AndroidAppVersionName": "323.0.0.46.119", + "IsContainerized": false + }] + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json new file mode 100644 index 00000000000..cd6012584ab --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-mobile-detection-summary.log-expected.json @@ -0,0 +1,96 @@ +{ + "expected": [ + { + "@timestamp": "2022-04-08T12:17:49.000Z", + "crowdstrike": { + "event": { + "MobileAppsDetails": [ + { + "AndroidAppLabel": "Facebook", + "AndroidAppVersionName": "323.0.0.46.119", + "AppIdentifier": "com.facebook.katana", + "AppInstallerInformation": "unknown", + "DexFileHashes": "abc456xxxxxxxxxxxxxxxxdef789", + "ImageFileName": "/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk", + "IsBeingDebugged": false, + "IsContainerized": false + } + ], + "Objective": "Falcon Detection Method" + }, + "metadata": { + "customerIDString": "0123456789ABCDEFGHIJKLMNOPQRSTUV", + "eventType": "MobileDetectionSummaryEvent", + "offset": 701283, + "version": "1.0" + } + }, + "device": { + "id": "85ae98xxxxxxd9a8f2" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "mobile-detection", + "category": [ + "malware" + ], + "created": "2022-04-04T08:30:56.000Z", + "id": 1310556238, + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"offset\": 701283,\n\t\t\"eventType\": \"MobileDetectionSummaryEvent\",\n\t\t\"eventCreationTime\": 1649420269000,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"SensorId\": \"85ae98xxxxxxd9a8f2\",\n\t\t\"MobileDetectionId\": 1310556238,\n\t\t\"ComputerName\": \"TESTComputer\",\n\t\t\"UserName\": \"TestUSER\",\n\t\t\"ContextTimeStamp\": 1649061056,\n\t\t\"DetectId\": \"0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238\",\n\t\t\"DetectName\": \"AppSideloadDetected\",\n\t\t\"DetectDescription\": \"Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. \",\n\t\t\"Tactic\": \"Insecure security posture\",\n\t\t\"TacticId\": \"CSTA0009\",\n\t\t\"Technique\": \"Bad device settings\",\n\t\t\"TechniqueId\": \"CST0024\",\n\t\t\"Objective\": \"Falcon Detection Method\",\n\t\t\"Severity\": 50,\n\t\t\"FalconHostLink\": \"https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV\",\n\t\t\"MobileAppsDetails\": [{\n\t\t\t\"AppIdentifier\": \"com.facebook.katana\",\n\t\t\t\"AndroidAppLabel\": \"Facebook\",\n\t\t\t\"DexFileHashes\": \"abc456xxxxxxxxxxxxxxxxdef789\",\n\t\t\t\"ImageFileName\": \"/data/app/com.facebook.katana-djFExxxxxxxxxrkg==/base.apk\",\n\t\t\t\"AppInstallerInformation\": \"unknown\",\n\t\t\t\"IsBeingDebugged\": false,\n\t\t\t\"AndroidAppVersionName\": \"323.0.0.46.119\",\n\t\t\t\"IsContainerized\": false\n\t\t}]\n\t}\n}", + "reference": "https://falcon.crowdstrike.com/mobile/detections/0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238?_cid=0123456789ABCDEFGHIJKLMNOPQRSTUV", + "severity": 50, + "type": [ + "info" + ] + }, + "host": { + "name": "TESTComputer" + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "TESTComputer" + ], + "user": [ + "TestUSER" + ] + }, + "rule": { + "description": "Apps are installed from outside the PlayStore. Trigger based on a System callback when apps are installed or updated. ", + "id": "0123456789ABCDEFGHIJKLMNOPQRSTUV:ind:85ae98xxxxxxd9a8f2:41104|1310556238", + "name": "AppSideloadDetected" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "CSTA0009" + ], + "name": [ + "Insecure security posture" + ] + }, + "technique": { + "id": [ + "CST0024" + ], + "name": [ + "Bad device settings" + ] + } + }, + "user": { + "name": "TestUSER" + } + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log new file mode 100644 index 00000000000..8d77763fc53 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log @@ -0,0 +1,23 @@ +{ + "metadata": { + "customerIDString": "1231231231231", + "offset": 2664218, + "eventType": "ReconNotificationSummaryEvent", + "eventCreationTime": 1686889114000, + "version": "1.0" + }, + "event": { + "NotificationId": "oifgdjgpoidfsjhpoihio", + "Highlights": [ + "Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text" + ], + "MatchedTimestamp": 1686889114000, + "RuleId": "123543-0cb1-4806-9ccd-a543123", + "RuleName": "TestRuleName", + "RuleTopic": "TestRuleTopic", + "RulePriority": "high", + "ItemId": "oigjfdsiughsiopudhfoiusadhfiouhipou==", + "ItemType": "post", + "ItemPostedTimestamp": 1686873909000 + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json new file mode 100644 index 00000000000..c014f6ce4b0 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-recon-notification.log-expected.json @@ -0,0 +1,52 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-16T04:18:34.000Z", + "crowdstrike": { + "event": { + "Highlights": [ + "Some highlighed text \u0026lt;cs-highlight\u0026gt;test\u0026lt;/cs-highlight\u0026gt; \u0026lt;cs-highlight\u0026gt;gdsfgasd\u0026lt;/cs-highlight\u0026gt;.\n\nAs an Some more text" + ], + "ItemPostedTimestamp": 1686873909000, + "ItemType": "post", + "NotificationId": "oifgdjgpoidfsjhpoihio", + "RulePriority": "high" + }, + "metadata": { + "customerIDString": "1231231231231", + "eventType": "ReconNotificationSummaryEvent", + "offset": 2664218, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "recon-notification-", + "category": [ + "threat" + ], + "created": "2023-06-16T00:05:09.000Z", + "id": "oigjfdsiughsiopudhfoiusadhfiouhipou==", + "kind": "event", + "original": "{\n \"metadata\": {\n \"customerIDString\": \"1231231231231\",\n \"offset\": 2664218,\n \"eventType\": \"ReconNotificationSummaryEvent\",\n \"eventCreationTime\": 1686889114000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"NotificationId\": \"oifgdjgpoidfsjhpoihio\",\n \"Highlights\": [\n \"Some highlighed text \\u0026lt;cs-highlight\\u0026gt;test\\u0026lt;/cs-highlight\\u0026gt; \\u0026lt;cs-highlight\\u0026gt;gdsfgasd\\u0026lt;/cs-highlight\\u0026gt;.\\n\\nAs an Some more text\"\n ],\n \"MatchedTimestamp\": 1686889114000,\n \"RuleId\": \"123543-0cb1-4806-9ccd-a543123\",\n \"RuleName\": \"TestRuleName\",\n \"RuleTopic\": \"TestRuleTopic\",\n \"RulePriority\": \"high\",\n \"ItemId\": \"oigjfdsiughsiopudhfoiusadhfiouhipou==\",\n \"ItemType\": \"post\",\n \"ItemPostedTimestamp\": 1686873909000\n }\n}", + "type": [ + "indicator" + ] + }, + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "rule": { + "id": "123543-0cb1-4806-9ccd-a543123", + "name": "TestRuleName", + "ruleset": "TestRuleTopic" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json index cfa9657913b..6f598545e4f 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-remote-response.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2020-02-27T19:12:14.000Z", "crowdstrike": { "event": { "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" @@ -13,7 +14,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -23,6 +24,7 @@ "network", "session" ], + "created": "2020-02-27T19:12:14.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1045,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1582830734000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1582830734\n }\n}", "start": "2020-02-27T19:12:14.000Z", @@ -55,6 +57,7 @@ } }, { + "@timestamp": "2020-02-27T19:12:52.000Z", "crowdstrike": { "event": { "SessionId": "12345a1bc2d34fghi56jk7890lmno12p" @@ -67,7 +70,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -77,6 +80,7 @@ "network", "session" ], + "created": "2020-02-27T19:12:52.000Z", "end": "2020-02-27T19:12:52.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 1046,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1582830772000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"HostnameField\": \"hostnameofmachine\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1582830772\n }\n}", diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json index 37e360872f6..3f426ba0a71 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-sample.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2020-07-20T12:41:46.000Z", "crowdstrike": { "event": { "CustomerId": "12345a1bc2d34fghi56jk7890lmno12p", @@ -31,7 +32,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -41,6 +42,7 @@ "network" ], "code": "FirewallRuleIP4Matched", + "created": "2020-07-20T12:41:46.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70689,\n \"eventType\": \"FirewallMatchEvent\",\n \"eventCreationTime\": 1595248906000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"DeviceId\": \"718af202ab2c4ba5b6a5d10d39c0e0a5\",\n \"CustomerId\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"Ipv\": \"ipv4\",\n \"CommandLine\": \"\",\n \"ConnectionDirection\": \"1\",\n \"EventType\": \"FirewallRuleIP4Matched\",\n \"Flags\": {\n \"Audit\": false,\n \"Log\": false,\n \"Monitor\": true\n },\n \"HostName\": \"TESTDEVICE01\",\n \"ICMPCode\": \"\",\n \"ICMPType\": \"\",\n \"ImageFileName\": \"\",\n \"LocalAddress\": \"10.37.60.194\",\n \"LocalPort\": \"445\",\n \"MatchCount\": 1,\n \"MatchCountSinceLastReport\": 1,\n \"NetworkProfile\": \"2\",\n \"PID\": \"206158879910\",\n \"PolicyName\": \"PROD-FW-Workstations-General\",\n \"PolicyID\": \"74e7f1552a3a4d90a6d65578642c8584\",\n \"Protocol\": \"6\",\n \"RemoteAddress\": \"10.37.60.21\",\n \"RemotePort\": \"54952\",\n \"RuleAction\": \"2\",\n \"RuleDescription\": \"\",\n \"RuleFamilyID\": \"fec73e96a1bf4481be582c3f89b234fa\",\n \"RuleGroupName\": \"SMB Rules\",\n \"RuleName\": \"Inbound SMB Block \\u0026 Log Private\",\n \"RuleId\": \"4877172638743447345\",\n \"Status\": \"\",\n \"Timestamp\": \"2020-07-20T12:41:44Z\",\n \"TreeID\": \"\"\n }\n}", "type": [ @@ -88,6 +90,7 @@ ] }, { + "@timestamp": "2020-07-17T17:02:08.414Z", "crowdstrike": { "event": { "FineScore": 0.1, @@ -101,7 +104,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -110,6 +113,7 @@ "category": [ "malware" ], + "created": "2020-07-17T17:02:08.414Z", "end": "2020-07-17T17:01:56.000Z", "kind": "alert", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57181,\n \"eventType\": \"IncidentSummaryEvent\",\n \"eventCreationTime\": 1595005328414,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"IncidentStartTime\": 1595005316,\n \"IncidentEndTime\": 1595005316,\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/crowdscore/incidents/details/inc:1234567893cd4e55b3a832ba2140478e:72e291e40c1544d390eabf135d875e54\",\n \"State\": \"open\",\n \"FineScore\": 0.1,\n \"LateralMovement\": 0\n }\n}", @@ -129,6 +133,7 @@ ] }, { + "@timestamp": "2020-07-20T12:26:10.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -164,7 +169,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -173,6 +178,7 @@ "category": [ "iam" ], + "created": "2020-07-20T12:26:10.093Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70509,\n \"eventType\": \"AuthActivityAuditEvent\",\n \"eventCreationTime\": 1595247970093,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"first.last@company.com\",\n \"UserIp\": \"67.43.156.15\",\n \"OperationName\": \"saml2Assert\",\n \"ServiceName\": \"Crowdstrike Authentication\",\n \"Success\": true,\n \"UTCTimestamp\": 1595247970,\n \"AuditKeyValues\": [\n {\n \"Key\": \"trace_id\",\n \"ValueString\": \"b0b33836-555c-4e0e-a5ef-d368f6799f6b\"\n },\n {\n \"Key\": \"actor_user\",\n \"ValueString\": \"first.last@company.com\"\n },\n {\n \"Key\": \"actor_user_uuid\",\n \"ValueString\": \"123ab123-abc1-12a1-12a1-12a1ab12a1a1\"\n },\n {\n \"Key\": \"actor_cid\",\n \"ValueString\": \"123456a1ab1a12abc12ab1234abcd12a\"\n },\n {\n \"Key\": \"target_user\",\n \"ValueString\": \"first.last@company.com\"\n }\n ]\n }\n}", "outcome": "success" @@ -214,6 +220,7 @@ } }, { + "@timestamp": "2020-07-20T12:41:25.000Z", "crowdstrike": { "event": { "AuditKeyValues": [ @@ -236,13 +243,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_activity_audit_event", "category": [ "iam" ], + "created": "2020-07-20T12:41:25.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 70683,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1595248885000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"Crowdstrike\",\n \"UserIp\": \"\",\n \"OperationName\": \"quarantined_file_update\",\n \"ServiceName\": \"quarantined_files\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"quarantined_file_id\",\n \"ValueString\": \"ab1cde05567b455b93afbe2d3df352c9_328024a065630f897f09963d4b67b0c95d4054f540c2ca8014d5b012718bfa21\"\n },\n {\n \"Key\": \"action_taken\",\n \"ValueString\": \"quarantined\"\n }\n ],\n \"UTCTimestamp\": 1595248885\n }\n}", "type": [ @@ -267,6 +275,7 @@ } }, { + "@timestamp": "2020-07-17T17:14:53.000Z", "crowdstrike": { "event": { "SessionId": "330633db-1cda-4355-b0d8-2c2edc91fe3e" @@ -279,7 +288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -289,6 +298,7 @@ "network", "session" ], + "created": "2020-07-17T17:14:53.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57217,\n \"eventType\": \"RemoteResponseSessionStartEvent\",\n \"eventCreationTime\": 1595006093000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"StartTimestamp\": 1595006093\n }\n}", "start": "2020-07-17T17:14:53.000Z", @@ -321,6 +331,7 @@ } }, { + "@timestamp": "2020-07-17T17:28:19.000Z", "crowdstrike": { "event": { "Commands": [ @@ -344,7 +355,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -354,6 +365,7 @@ "network", "session" ], + "created": "2020-07-17T17:28:19.000Z", "end": "2020-07-17T17:28:19.000Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57269,\n \"eventType\": \"RemoteResponseSessionEndEvent\",\n \"eventCreationTime\": 1595006899000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"SessionId\": \"330633db-1cda-4355-b0d8-2c2edc91fe3e\",\n \"HostnameField\": \"TESTDEVICE01\",\n \"UserName\": \"first.last@company.com\",\n \"EndTimestamp\": 1595006899,\n \"Commands\": [\n \"cd \\\\Program Files (x86)\\\\Symantec\",\n \"ls .\",\n \"cd \\\\Program Files (x86)\",\n \"ls .\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"reg set HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default GroupingTags -ValueType=```REG_SZ``` -Value=```Protect```\",\n \"reg query HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CrowdStrike\\\\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\\\\{16e0423f-7058-48c9-a204-725362b67639}\\\\Default\",\n \"restart\",\n \"restart -Confirm\"\n ]\n }\n}", @@ -386,6 +398,7 @@ } }, { + "@timestamp": "2020-07-17T16:11:31.000Z", "crowdstrike": { "event": { "ExecutablesWritten": [ @@ -448,13 +461,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Detection, process would have been blocked if related prevention policy setting was enabled.", "category": [ "malware" ], + "created": "2020-07-17T16:11:31.000Z", "kind": "alert", "original": "{\n \"metadata\": {\n \"customerIDString\": \"12345a1bc2d34fghi56jk7890lmno12p\",\n \"offset\": 57047,\n \"eventType\": \"DetectionSummaryEvent\",\n \"eventCreationTime\": 1595002291000,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"ProcessStartTime\": 1595002290,\n \"ProcessEndTime\": 1595002290,\n \"ProcessId\": 663790158277,\n \"ParentProcessId\": 627311656469,\n \"ComputerName\": \"TESTDEVICE01\",\n \"UserName\": \"First.last\",\n \"DetectName\": \"NGAV\",\n \"DetectDescription\": \"This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.\",\n \"Severity\": 2,\n \"SeverityName\": \"Low\",\n \"FileName\": \"filename.exe\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\",\n \"CommandLine\": \"\\\"C:\\\\ProgramData\\\\file\\\\path\\\\filename.exe\\\" \",\n \"SHA256String\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"MD5String\": \"0ab1235adca04aef6239f5496ef0a5df\",\n \"SHA1String\": \"0000000000000000000000000000000000000000\",\n \"MachineDomain\": \"NA\",\n \"ExecutablesWritten\": [\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939Configuration.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n },\n {\n \"Timestamp\": 1595002290,\n \"FileName\": \"NEURO_200_J1939CanPackMessage.mexw64\",\n \"FilePath\": \"\\\\Device\\\\HarddiskVolume2\\\\ProgramData\\\\file\\\\path\\\\is\\\\right\\\\here\\\\folder\"\n }\n ],\n \"FalconHostLink\": \"https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p\",\n \"SensorId\": \"1abcd2345b8c4151a0cb45dcfbe6d3d0\",\n \"IOCType\": \"hash_sha256\",\n \"IOCValue\": \"0a123b185f9a32fde1df59897089014c92e3d08a0533b54baa72ba2a93d64deb\",\n \"DetectId\": \"ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719\",\n \"LocalIP\": \"10.1.190.117\",\n \"MACAddress\": \"54-ad-d4-d2-a8-0b\",\n \"Tactic\": \"Machine Learning\",\n \"Technique\": \"Sensor-based ML\",\n \"Objective\": \"Falcon Detection Method\",\n \"PatternDispositionDescription\": \"Detection, process would have been blocked if related prevention policy setting was enabled.\",\n \"PatternDispositionValue\": 2304,\n \"PatternDispositionFlags\": {\n \"Indicator\": false,\n \"Detect\": false,\n \"InddetMask\": false,\n \"SensorOnly\": false,\n \"Rooting\": false,\n \"KillProcess\": false,\n \"KillSubProcess\": false,\n \"QuarantineMachine\": false,\n \"QuarantineFile\": false,\n \"PolicyDisabled\": true,\n \"KillParent\": false,\n \"OperationBlocked\": false,\n \"ProcessBlocked\": true,\n \"RegistryOperationBlocked\": false,\n \"CriticalProcessDisabled\": false,\n \"BootupSafeguardEnabled\": false,\n \"FsOperationBlocked\": false\n },\n \"ParentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\explorer.exe\",\n \"ParentCommandLine\": \"C:\\\\Windows\\\\Explorer.EXE\",\n \"GrandparentImageFileName\": \"\\\\Device\\\\HarddiskVolume2\\\\Windows\\\\System32\\\\userinit.exe\",\n \"GrandparentCommandLine\": \"C:\\\\Windows\\\\system32\\\\userinit.exe\"\n }\n}", "reference": "https://falcon.crowdstrike.com/activity/detections/detail/1abcd2345b8c4151a0cb45dcfbe6d3d0/124559902719?_cid=12345a1bc2d34fghi56jk7890lmno12p", @@ -515,6 +529,7 @@ ] }, "rule": { + "description": "This file meets the machine learning-based on-sensor AV protection's low confidence threshold for malicious files.", "id": "ldt:1abcd2345b8c4151a0cb45dcfbe6d3d0:124559902719", "name": "NGAV" }, @@ -525,7 +540,17 @@ "preserve_original_event" ], "threat": { - "framework": "MITRE ATT\u0026CK" + "framework": "MITRE ATT\u0026CK", + "tactic": { + "name": [ + "Machine Learning" + ] + }, + "technique": { + "name": [ + "Sensor-based ML" + ] + } }, "user": { "name": "First.last" diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log new file mode 100644 index 00000000000..898afc6415f --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log @@ -0,0 +1,31 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": "SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111", + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json new file mode 100644 index 00000000000..abed13899bc --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags-list.log-expected.json @@ -0,0 +1,72 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER, SensorGroupingTags/XYZ, 321, 1111\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "severity": 1, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/TEACHER", + "SensorGroupingTags/XYZ", + "321", + "1111" + ] + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log new file mode 100644 index 00000000000..45a23413b49 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log @@ -0,0 +1,31 @@ +{ + "metadata": { + + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "offset": 54712611, + "eventType": "CSPMSearchStreamingEvent", + "eventCreationTime": 1663009688832, + "version": "1.0" + }, + "event": { + "AccountId": "XXXXXXXXXXXX", + "Region": "us-west-2", + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceName": "", + "ResourceCreateTime": 0, + "PolicyStatement": "EC2 NACL configured for global ingress", + "PolicyId": 26, + "Severity": 1, + "SeverityName": "High", + "CloudPlatform": "AWS", + "CloudService": "EC2", + "Disposition": "Failed", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "ResourceAttributes": "{\"ACL ID\": \"acl - 005e6 bb98e75ac17e\",\"VPC ID\": \"vpc - 0e886040 c27d9f526\",\"Platform\": \"Linux\",\"Instance ID\": \"i - 0108 fce80eXXXXXXX\",\"Launch Time\": \"2022 - 09 - 12 17: 11: 06 + 00\",\"Instance State\": \"running\"}", + "Tags": "SensorGroupingTags/TEACHER", + "ReportUrl": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "Timestamp": 1663009688832 + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json new file mode 100644 index 00000000000..5fe9f0d0b93 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-tags.log-expected.json @@ -0,0 +1,69 @@ +{ + "expected": [ + { + "@timestamp": "2022-09-12T19:08:08.832Z", + "cloud": { + "account": { + "id": "XXXXXXXXXXXX" + }, + "provider": "AWS", + "region": "us-west-2", + "service": { + "name": "EC2" + } + }, + "crowdstrike": { + "event": { + "Finding": "Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All", + "PolicyId": 26, + "ResourceAttributes": { + "ACL ID": "acl - 005e6 bb98e75ac17e", + "Instance ID": "i - 0108 fce80eXXXXXXX", + "Instance State": "running", + "Launch Time": "2022 - 09 - 12 17: 11: 06 + 00", + "Platform": "Linux", + "VPC ID": "vpc - 0e886040 c27d9f526" + }, + "ResourceId": "i-0108fce80eXXXXXXX", + "ResourceIdType": "Instance Id", + "ResourceUrl": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX", + "SeverityName": "High", + "Timestamp": 1663009688832 + }, + "metadata": { + "customerIDString": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", + "eventType": "CSPMSearchStreamingEvent", + "offset": 54712611, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "configuration" + ], + "created": "2022-09-12T19:08:08.832Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\n\t\t\"customerIDString\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\t\t\"offset\": 54712611,\n\t\t\"eventType\": \"CSPMSearchStreamingEvent\",\n\t\t\"eventCreationTime\": 1663009688832,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"AccountId\": \"XXXXXXXXXXXX\",\n\t\t\"Region\": \"us-west-2\",\n\t\t\"ResourceId\": \"i-0108fce80eXXXXXXX\",\n\t\t\"ResourceIdType\": \"Instance Id\",\n\t\t\"ResourceName\": \"\",\n\t\t\"ResourceCreateTime\": 0,\n\t\t\"PolicyStatement\": \"EC2 NACL configured for global ingress\",\n\t\t\"PolicyId\": 26,\n\t\t\"Severity\": 1,\n\t\t\"SeverityName\": \"High\",\n\t\t\"CloudPlatform\": \"AWS\",\n\t\t\"CloudService\": \"EC2\",\n\t\t\"Disposition\": \"Failed\",\n\t\t\"ResourceUrl\": \"https://us-west-2.console.aws.amazon.com/ec2/v2/home?region=us-west-2#InstanceDetails:instanceId=i-0108fce80eXXXXXXX\",\n\t\t\"Finding\": \"Instance ID: i-0108fce80e5ab5129|VPC ID: vpc-0e886040c27d9f526|Network ACL ID: acl-005e6bb98e75ac17e|Rule Number: 100|CIDR Block: 0.0.0.0/0|Protocol: All\",\n\t\t\"ResourceAttributes\": \"{\\\"ACL ID\\\": \\\"acl - 005e6 bb98e75ac17e\\\",\\\"VPC ID\\\": \\\"vpc - 0e886040 c27d9f526\\\",\\\"Platform\\\": \\\"Linux\\\",\\\"Instance ID\\\": \\\"i - 0108 fce80eXXXXXXX\\\",\\\"Launch Time\\\": \\\"2022 - 09 - 12 17: 11: 06 + 00\\\",\\\"Instance State\\\": \\\"running\\\"}\",\n\t\t\"Tags\": \"SensorGroupingTags/TEACHER\",\n\t\t\"ReportUrl\": \"https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\\u0026policy_id=26\\u0026scan_id=1a8adc1c36aa7d83e90e5c06\\u0026service=EC2\",\n\t\t\"Timestamp\": 1663009688832\n\t}\n}", + "outcome": "failure", + "reference": "https://falcon.crowdstrike.com/cloud-security/cspm/assessment-drilldown?event-type=cspm_policy_26\u0026policy_id=26\u0026scan_id=1a8adc1c36aa7d83e90e5c06\u0026service=EC2", + "severity": 1, + "type": [ + "info", + "change" + ] + }, + "message": "EC2 NACL configured for global ingress", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "tags": [ + "preserve_original_event", + "SensorGroupingTags/TEACHER" + ] + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json index 5c55dc89ede..6308bcfd240 100644 --- a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-user-activity.log-expected.json @@ -1,6 +1,7 @@ { "expected": [ { + "@timestamp": "2023-06-15T14:29:38.000Z", "crowdstrike": { "event": { "Attributes": { @@ -22,13 +23,14 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_activity_audit_event", "category": [ "iam" ], + "created": "2023-06-15T16:06:52.400Z", "kind": "event", "original": "{\n \"metadata\": {\n \"customerIDString\": \"123123abcd\",\n \"offset\": 3,\n \"eventType\": \"UserActivityAuditEvent\",\n \"eventCreationTime\": 1686845212400,\n \"version\": \"1.0\"\n },\n \"event\": {\n \"UserId\": \"TESTUSERID\",\n \"UserIp\": \"175.16.199.1\",\n \"OperationName\": \"detection_update\",\n \"ServiceName\": \"detections\",\n \"AuditKeyValues\": [\n {\n \"Key\": \"detection_id\",\n \"ValueString\": \"TESTVALUE:ind:STRING123:456-123-654\"\n }\n ],\n \"UTCTimestamp\": 1686839378,\n \"Attributes\": {\n \"detection_id\": \"DETECTID:ind:TESTID:456-123-654\"\n }\n }\n}", "type": [ diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log new file mode 100644 index 00000000000..bff89fc7641 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log @@ -0,0 +1,29 @@ +{ + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventCreationTime": 1651174243000, + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + }, + "event": { + "Author": "CrowdStrike", + "DataDomains": "Identity,Network,Endpoint", + "Description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "DetectId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "EndTimeEpoch": 1643317927664000000, + "IPv4Addresses": "81.2.69.144,81.2.69.192", + "HostNames": "XDR-WIN10", + "Name": "Metasploit and brute force login attempt", + "PatternId": 100011, + "Severity": 90, + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "StartTimeEpoch": 1643317697728000000, + "TacticIds": "TA0001,TA0002", + "Tactics": "Initial Access,Execution", + "TechniqueIds": "T1566.001,T1203", + "Techniques": "Spearphishing Attachment,Exploitation for Client Execution", + "XdrType": "xdr" + } +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json new file mode 100644 index 00000000000..b550c7fb018 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/_dev/test/pipeline/test-falcon-xdr-detection-summary.log-expected.json @@ -0,0 +1,89 @@ +{ + "expected": [ + { + "@timestamp": "2022-01-27T21:08:17.728Z", + "crowdstrike": { + "event": { + "DataDomains": [ + "Identity", + "Network", + "Endpoint" + ], + "PatternId": "100011", + "SourceProducts": "Falcon,Corelight", + "SourceVendors": "CrowdStrike,Corelight", + "XdrType": "xdr" + }, + "metadata": { + "customerIDString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", + "eventType": "XdrDetectionSummaryEvent", + "offset": 34280810, + "version": "1.0" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "xdr-detection", + "category": [ + "malware" + ], + "created": "2022-04-28T19:30:43.000Z", + "end": "2022-01-27T21:12:07.664Z", + "kind": "alert", + "original": "{\n\t\"metadata\": {\n\t\t\"customerIDString\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\n\t\t\"eventCreationTime\": 1651174243000,\n\t\t\"eventType\": \"XdrDetectionSummaryEvent\",\n\t\t\"offset\": 34280810,\n\t\t\"version\": \"1.0\"\n\t},\n\t\"event\": {\n\t\t\"Author\": \"CrowdStrike\",\n\t\t\"DataDomains\": \"Identity,Network,Endpoint\",\n\t\t\"Description\": \"Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.\",\n\t\t\"DetectId\": \"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc\",\n\t\t\"EndTimeEpoch\": 1643317927664000000,\n\t\t\"IPv4Addresses\": \"81.2.69.144,81.2.69.192\",\n\t\t\"HostNames\": \"XDR-WIN10\",\n\t\t\"Name\": \"Metasploit and brute force login attempt\",\n\t\t\"PatternId\": 100011,\n\t\t\"Severity\": 90,\n\t\t\"SourceProducts\": \"Falcon,Corelight\",\n\t\t\"SourceVendors\": \"CrowdStrike,Corelight\",\n\t\t\"StartTimeEpoch\": 1643317697728000000,\n\t\t\"TacticIds\": \"TA0001,TA0002\",\n\t\t\"Tactics\": \"Initial Access,Execution\",\n\t\t\"TechniqueIds\": \"T1566.001,T1203\",\n\t\t\"Techniques\": \"Spearphishing Attachment,Exploitation for Client Execution\",\n\t\t\"XdrType\": \"xdr\"\n\t}\n}", + "severity": 90, + "start": "2022-01-27T21:08:17.728Z", + "type": [ + "info" + ] + }, + "message": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "observer": { + "product": "Falcon", + "vendor": "Crowdstrike" + }, + "related": { + "hosts": [ + "XDR-WIN10" + ] + }, + "rule": { + "author": [ + "CrowdStrike" + ], + "description": "Encrypted Metasploit traffic and login activity indicative of a brute force attempt were observed from a common IP.", + "id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:ind:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx:xdr|eee4a5c51106f0419184d0dd08fb05bc", + "name": "Metasploit and brute force login attempt", + "uuid": "100011" + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0001", + "TA0002" + ], + "name": [ + "Initial Access", + "Execution" + ] + }, + "technique": { + "id": [ + "T1566.001", + "T1203" + ], + "name": [ + "Spearphishing Attachment", + "Exploitation for Client Execution" + ] + } + } + } + ] +} \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml new file mode 100644 index 00000000000..2f44dcbda99 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/cspm_events.yml @@ -0,0 +1,163 @@ +--- +processors: + - set: + field: event.kind + value: alert + - append: + field: event.category + value: configuration + tag: append_configuration_category + - append: + field: event.type + value: + - info + - change + tag: append_info_change_type + - set: + field: event.outcome + value: success + if: ctx.crowdstrike?.event?.Disposition == "Passed" + - set: + field: event.outcome + value: failure + if: ctx.crowdstrike?.event?.Disposition == "Failed" + - rename: + field: crowdstrike.event.EventAction + target_field: event.action + ignore_missing: true + tag: rename_event_action + - rename: + field: crowdstrike.event.ReportUrl + target_field: event.reference + ignore_missing: true + tag: rename_event_resource_url + - json: + field: crowdstrike.event.ResourceAttributes + tag: decode_json_resource_attributes + if: ctx.crowdstrike?.event?.ResourceAttributes != null + - rename: + field: crowdstrike.event.EventSource + target_field: event.provider + ignore_missing: true + tag: rename_event_source + - rename: + field: crowdstrike.event.Severity + target_field: event.severity + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.AccountId + target_field: cloud.account.id + ignore_missing: true + - rename: + field: crowdstrike.event.Region + target_field: cloud.region + ignore_missing: true + tag: rename_cloud_region +#CSPMS uses Platform, CSPMIOA uses Provider + - rename: + field: crowdstrike.event.CloudProvider + target_field: cloud.provider + ignore_missing: true + tag: rename_cloud_provider + - rename: + field: crowdstrike.event.CloudPlatform + target_field: cloud.provider + ignore_missing: true + tag: rename_cloud_platform + - rename: + field: crowdstrike.event.CloudService + target_field: cloud.service.name + ignore_missing: true + tag: rename_cloud_service + - rename: + field: crowdstrike.event.PolicyStatement + target_field: message + ignore_missing: true + tag: rename_policy_statement + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.UserId + target_field: user.id + ignore_missing: true + tag: rename_user_id + - rename: + field: crowdstrike.event.UserSourceIp + target_field: source.ip + ignore_missing: true + tag: rename_user_source_ip + - date: + field: crowdstrike.event.Timestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX_MS + tag: date_event_created_timestamp + if: "ctx.crowdstrike?.event?.Timestamp != null && String.valueOf(ctx.crowdstrike.event.Timestamp).length() >= 12" + - date: + field: crowdstrike.event.Timestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX + tag: date_event_created_timestamp + if: 'ctx.crowdstrike?.event?.Timestamp != null && String.valueOf(ctx.crowdstrike.event.Timestamp).length() <= 11' + - date: + field: crowdstrike.event.EventCreatedTimestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX_MS + tag: date_event_created_timestamp + if: "ctx.crowdstrike?.event?.EventCreatedTimestamp != null && String.valueOf(ctx.crowdstrike.event.EventCreatedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.EventCreatedTimestamp + target_field: "@timestamp" + timezone: UTC + formats: + - UNIX + tag: date_event_created_timestamp + if: 'ctx.crowdstrike?.event?.EventCreatedTimestamp != null && String.valueOf(ctx.crowdstrike.event.EventCreatedTimestamp).length() <= 11' + - remove: + field: crowdstrike.event.ResourceCreateTime + ignore_missing: true + tag: remove_resource_create_time + if: ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime == 0 + - date: + field: crowdstrike.event.ResourceCreateTime + target_field: crowdstrike.event.ResourceCreateTime + timezone: UTC + formats: + - UNIX_MS + tag: date_resource_create_time + if: "ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime != 0 && String.valueOf(ctx.crowdstrike.event.ResourceCreateTime).length() >= 12" + - date: + field: crowdstrike.event.ResourceCreateTime + target_field: crowdstrike.event.ResourceCreateTime + timezone: UTC + formats: + - UNIX + tag: date_resource_create_time + if: 'ctx.crowdstrike?.event?.ResourceCreateTime != null && ctx.crowdstrike.event.ResourceCreateTime != 0 && String.valueOf(ctx.crowdstrike.event.ResourceCreateTime).length() <= 11' + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml index 7fe93e05b4e..8019c70e1e5 100644 --- a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Ingest pipeline for normalizing CrowdStrike Falcon logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -35,7 +35,68 @@ processors: type: string tag: convert_pattern_id ignore_missing: true + # Script to convert windows NT timestamp to unix timestamp + - script: + tag: convert-nt-timestamp-to-unix + description: Convert Windows NT timestamps to UNIX timestamps for multiple fields. + lang: painless + if : ctx.crowdstrike?.event != null + params: + values: + - 'StartTime' + - 'EndTime' + - 'ContextTimeStamp' + - 'EndTimestamp' + - 'IncidentEndTime' + - 'IncidentStartTime' + - 'ItemPostedTimestamp' + - 'MatchedTimestamp' + - 'MostRecentActivityTimeStamp' + - 'PrecedingActivityTimeStamp' + - 'StartTimestamp' + - 'UTCTimestamp' +# Process to convert LDAP/WIN32 FILETIME to Unix (milliseconds) timestamp. +# More details can be found here https://devblogs.microsoft.com/oldnewthing/20030905-02/?p=42653 and here https://www.epochconverter.com/ldap + source: | + def convertToUnix(def longValue) { + if (longValue > 0x0100000000000000L) { + return (longValue / 10000) - 11644473600000L; + } + return longValue; + } + for (def field : params.values) { + def fieldValue = ctx.crowdstrike.event[field]; + if (fieldValue != null) { + if (fieldValue instanceof long) { + ctx.crowdstrike.event[field] = convertToUnix(fieldValue); + } else if (fieldValue instanceof String) { + if (!fieldValue.contains('.')) { + def timestamp = Long.parseLong(fieldValue); + ctx.crowdstrike.event[field] = convertToUnix(timestamp); + } + } + } + } + # Handle event Tags, which can be a string or a list of maps. + - script: + tag: convert-Tags-and-copy-to-tags + description: Convert tags from nested type and append to ctx.tags. + lang: painless + if : ctx.crowdstrike?.event?.Tags != null + source: | + if (ctx.crowdstrike.event.Tags instanceof List) { + for (tag in ctx.crowdstrike.event.Tags) { + if (tag instanceof Map) { + ctx.tags.add(tag["Key"] + ":" + tag["ValueString"]); + } + } + } else if (ctx.crowdstrike.event.Tags instanceof String) { + def values = ctx.crowdstrike.event.Tags.splitOnToken(','); + for (value in values) { + ctx.tags.add(value.trim()); + } + } # UTCTimestamp should exist in each event, however on the off-chance it might not be (Like RemoteSession Start/End), then we have to use eventCreation time. - date: field: crowdstrike.event.UTCTimestamp @@ -45,13 +106,28 @@ processors: tag: date_utc_timestamp if: 'ctx.crowdstrike?.event?.UTCTimestamp != null && String.valueOf(ctx.crowdstrike.event.UTCTimestamp).length() >= 12' - date: - field: crowdstrike.event.eventCreationTime + field: crowdstrike.event.UTCTimestamp + timezone: UTC + formats: + - UNIX + tag: date_utc_timestamp + if: 'ctx.crowdstrike?.event?.UTCTimestamp != null && String.valueOf(ctx.crowdstrike.event.UTCTimestamp).length() <= 11' + - date: + field: crowdstrike.metadata.eventCreationTime target_field: event.created timezone: UTC formats: - UNIX tag: date_event_creation_time - if: 'ctx.crowdstrike?.event?.eventCreationTime != null && String.valueOf(ctx.crowdstrike.event.eventCreationTime).length() <= 11' + if: 'ctx.crowdstrike?.metadata?.eventCreationTime != null && String.valueOf(ctx.crowdstrike.metadata.eventCreationTime).length() <= 11' + - date: + field: crowdstrike.metadata.eventCreationTime + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_creation_time + if: 'ctx.crowdstrike?.metadata?.eventCreationTime != null && String.valueOf(ctx.crowdstrike.metadata.eventCreationTime).length() >= 12' - set: field: '@timestamp' copy_from: event.created @@ -128,10 +204,34 @@ processors: name: '{{ IngestPipeline "detection_summary" }}' tag: pipeline_detection_summary if: ctx.crowdstrike?.metadata?.eventType == "DetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "mobile_detection_summary" }}' + tag: pipeline_mobile_detection_summary + if: ctx.crowdstrike?.metadata?.eventType == "MobileDetectionSummaryEvent" - pipeline: name: '{{ IngestPipeline "incident_summary" }}' tag: pipeline_incident_summary if: ctx.crowdstrike?.metadata?.eventType == "IncidentSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "xdr_detection_summary" }}' + tag: pipeline_xdr_summary + if: ctx.crowdstrike?.metadata?.eventType == "XdrDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "ipd_detection_summary" }}' + tag: pipeline_ipd_summary + if: ctx.crowdstrike?.metadata?.eventType == "IdpDetectionSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "recon_notification_summary" }}' + tag: pipeline_recon_nofitication_summary + if: ctx.crowdstrike?.metadata?.eventType == "ReconNotificationSummaryEvent" + - pipeline: + name: '{{ IngestPipeline "identity_protection_incident" }}' + tag: pipeline_identity_protection_incident + if: ctx.crowdstrike?.metadata?.eventType == "IdentityProtectionEvent" + - pipeline: + name: '{{ IngestPipeline "cspm_events" }}' + tag: pipeline_cspm_events + if: "['CSPMIOAStreamingEvent','CSPMSearchStreamingEvent'].contains(ctx.crowdstrike?.metadata?.eventType)" - pipeline: name: '{{ IngestPipeline "user_activity_audit" }}' tag: pipeline_user_activity_audit @@ -237,25 +337,55 @@ processors: if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true + # This removes any fields that are mapped to ECS, but have not been renamed. + # This is to prevent the fields from being duplicated in the event. - remove: field: - _tmp_ - crowdstrike.event.Technique + - crowdstrike.event.TechniqueId - crowdstrike.event.Tactic + - crowdstrike.event.TacticId + - crowdstrike.event.Techniques + - crowdstrike.event.TechniqueIds + - crowdstrike.event.Tactics + - crowdstrike.event.TacticIds + - crowdstrike.event.IPv6Addresses + - crowdstrike.event.IPv4Addresses - crowdstrike.event.ParentCommandLine - crowdstrike.event.CommandLine - crowdstrike.event.ProcessStartTime - crowdstrike.event.IncidentStartTime + - crowdstrike.event.HostNames + - crowdstrike.event.DomainNames + - crowdstrike.event.Users + - crowdstrike.event.SHA256Hashes + - crowdstrike.event.MD5Hashes + - crowdstrike.event.Author - crowdstrike.event.ProcessEndTime - crowdstrike.event.IncidentEndTime - crowdstrike.metadata.eventCreationTime - crowdstrike.event.UTCTimestamp + - crowdstrike.event.ContextTimeStamp - crowdstrike.event.PID - crowdstrike.event.RemotePort - crowdstrike.event.LocalPort - crowdstrike.event.ConnectionDirection - crowdstrike.event.StartTimestamp + - crowdstrike.event.StartTimeEpoch + - crowdstrike.event.AdditionalAccountDomain + - crowdstrike.event.AdditionalAccountName + - crowdstrike.event.AdditionalEndpointHostName + - crowdstrike.event.AdditionalEndpointIpAddress + - crowdstrike.event.AttemptOutcome + - crowdstrike.event.EndTimeEpoch - crowdstrike.event.EndTimestamp + - crowdstrike.event.EndTime + - crowdstrike.event.EventCreatedTimestamp + - crowdstrike.event.StartTime + - crowdstrike.event.Disposition + - crowdstrike.event.MatchedTimestamp + - crowdstrike.event.Tags ignore_missing: true on_failure: diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml index b0980a691b9..69f2d024d00 100644 --- a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/detection_summary.yml @@ -3,6 +3,7 @@ processors: - set: field: event.kind value: alert + tag: set_event_kind - append: field: event.category value: malware @@ -95,6 +96,11 @@ processors: target_field: message ignore_missing: true tag: rename_detect_description + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null - rename: field: crowdstrike.event.FileName target_field: process.name @@ -156,6 +162,7 @@ processors: field: crowdstrike.event.DetectName target_field: rule.name ignore_missing: true + tag: rename_detect_name - rename: field: crowdstrike.event.DetectId target_field: rule.id @@ -172,32 +179,29 @@ processors: ignore_missing: true tag: uppercase_mac_address if: ctx.host?.mac != null - - rename: - field: crowdstrike.event.DetectDescription - target_field: rule.description - ignore_missing: true - tag: rename_detect_description - set: field: threat.framework value: MITRE ATT&CK - - lowercase: - field: crowdstrike.event.Technique - ignore_missing: true - tag: lowercase_technique - append: field: threat.technique.name value: "{{{crowdstrike.event.Technique}}}" tag: append_technique_name - if: ctx._tmp?.threat?.technique?.name != null - - lowercase: - field: _tmp.threat.tactic.name - ignore_missing: true - tag: lowercase_tactic_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null - append: field: threat.tactic.name value: "{{{crowdstrike.event.Tactic}}}" tag: append_tactic_name - if: ctx._tmp?.threat?.tactic?.name != null + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null on_failure: - append: diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml new file mode 100644 index 00000000000..ef3cfb5022a --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/identity_protection_incident.yml @@ -0,0 +1,115 @@ +--- +processors: + - set: + field: event.kind + value: event + tag: set_event_kind + - append: + field: event.category + value: iam + tag: append_iam_category + - append: + field: event.type + value: info + tag: append_info_type + - rename: + field: crowdstrike.event.IncidentType + target_field: event.action + ignore_missing: true + tag: rename_incident_type + - rename: + field: crowdstrike.event.IncidentDescription + target_field: message + ignore_missing: true + tag: rename_incident_description + - rename: + field: crowdstrike.event.Severity + target_field: event.severity + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.IdentityProtectionIncidentId + target_field: event.id + ignore_missing: true + tag: rename_identity_protection_incident_id + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.EndpointName + target_field: host.hostname + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.EndpointIp + target_field: host.ip + ignore_missing: true + tag: rename_user_name + - convert: + field: crowdstrike.event.StartTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTime != null + - gsub: + field: crowdstrike.event.StartTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() > 18" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() >= 12" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() <= 11' + - convert: + field: crowdstrike.event.EndTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTime != null + - gsub: + field: crowdstrike.event.EndTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() > 18" + - date: + field: crowdstrike.event.EndTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() >= 12" + - date: + field: crowdstrike.event.EndTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() <= 11' + - set: + field: '@timestamp' + copy_from: event.start + tag: copy_timestamp_from_event_start + if: ctx.event?.start != null \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml new file mode 100644 index 00000000000..1989ecb1719 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/ipd_detection_summary.yml @@ -0,0 +1,278 @@ +--- +processors: + - set: + field: event.kind + value: alert + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + field: event.action + value: ipd-detection + - set: + field: event.outcome + value: success + if: ctx.crowdstrike?.event?.AttemptOutcome == true + - set: + field: event.outcome + value: failure + if: ctx.crowdstrike?.event?.AttemptOutcome == false + - rename: + field: crowdstrike.event.DetectDescription + target_field: message + ignore_missing: true + tag: rename_detect_description + - rename: + field: crowdstrike.event.LocationCountryCode + target_field: host.geo.country_iso_code + ignore_missing: true + tag: rename_location_country_code + - convert: + field: crowdstrike.event.PatternId + target_field: rule.uuid + type: string + tag: convert_pattern_id + ignore_missing: true + - rename: + field: crowdstrike.event.Severity + target_field: event.severity + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.SourceAccountDomain + target_field: user.domain + ignore_missing: true + tag: rename_source_account_domain + - rename: + field: crowdstrike.event.SourceAccountName + target_field: user.name + ignore_missing: true + tag: rename_source_account_name + - rename: + field: crowdstrike.event.SourceAccountObjectSid + target_field: user.id + ignore_missing: true + tag: rename_source_account_object_sid + - rename: + field: crowdstrike.event.SourceEndpointHostName + target_field: host.name + ignore_missing: true + tag: rename_source_endpoint_hostname + - rename: + field: crowdstrike.event.SourceEndpointIpAddress + target_field: host.ip + ignore_missing: true + tag: rename_source_endpoint_ipaddress + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null + - rename: + field: crowdstrike.event.DetectName + target_field: rule.name + ignore_missing: true + tag: rename_detect_name + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - remove: + field: + - event.created + ignore_missing: true + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + - convert: + field: crowdstrike.event.ContextTimeStamp + type: string + tag: convert_context_timestamp + ignore_missing: true + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + - gsub: + field: crowdstrike.event.ContextTimeStamp + pattern: "\\d{6}$" + replacement: "" + tag: gsub_context_timestamp + if: "ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() > 18" + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_context_timestamp + if: "ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() >= 12" + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_context_timestamp + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && ctx.crowdstrike.event.ContextTimeStamp.length() <= 11' + - convert: + field: crowdstrike.event.AccountCreationTimeStamp + type: string + tag: convert_account_creation_timestamp + ignore_missing: true + if: ctx.crowdstrike?.event?.AccountCreationTimeStamp != null + - gsub: + field: crowdstrike.event.AccountCreationTimeStamp + pattern: "\\d{6}$" + replacement: "" + tag: gsub_account_creation_timestamp + if: "ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() > 18" + - date: + field: crowdstrike.event.AccountCreationTimeStamp + target_field: crowdstrike.event.AccountCreationTimeStamp + timezone: UTC + formats: + - UNIX_MS + tag: date_account_creation_timestamp + if: "ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() >= 12" + - date: + field: crowdstrike.event.AccountCreationTimeStamp + target_field: crowdstrike.event.AccountCreationTimeStamp + timezone: UTC + formats: + - UNIX + tag: date_account_creation_timestamp + if: 'ctx.crowdstrike?.event?.AccountCreationTimeStamp != null && ctx.crowdstrike.event.AccountCreationTimeStamp.length() <= 11' + - convert: + field: crowdstrike.event.StartTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTime != null + - gsub: + field: crowdstrike.event.StartTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() > 18" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() >= 12" + - date: + field: crowdstrike.event.StartTime + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTime != null && ctx.crowdstrike.event.StartTime.length() <= 11' + - convert: + field: crowdstrike.event.EndTime + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTime != null + - gsub: + field: crowdstrike.event.EndTime + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() > 18" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_event_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() >= 12" + - date: + field: crowdstrike.event.EndTime + target_field: event.end + timezone: UTC + formats: + - UNIX + tag: date_event_end_time_epoch + if: 'ctx.crowdstrike?.event?.EndTime != null && ctx.crowdstrike.event.EndTime.length() <= 11' + - append: + field: related.hosts + value: "{{{crowdstrike.event.TargetEndpointHostName}}}" + allow_duplicates: false + tag: append_target_endpoint_hostname + if: ctx.crowdstrike?.event?.TargetEndpointHostName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.TargetDomain}}}" + allow_duplicates: false + tag: append_target_domain + if: ctx.crowdstrike?.event?.TargetDomain != null + - append: + field: related.user + value: "{{{crowdstrike.event.TargetAccountName}}}" + allow_duplicates: false + tag: append_target_account_name + if: ctx.crowdstrike?.event?.TargetAccountName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalAccountDomain}}}" + allow_duplicates: false + tag: append_additional_account_domain + if: ctx.crowdstrike?.event?.AdditionalAccountDomain != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalAccountName}}}" + allow_duplicates: false + tag: append_additional_account_domain + if: ctx.crowdstrike?.event?.AdditionalAccountName != null + - append: + field: related.hosts + value: "{{{crowdstrike.event.AdditionalEndpointHostName}}}" + allow_duplicates: false + tag: append_additional_endpoint_hostname + if: ctx.crowdstrike?.event?.AdditionalEndpointHostName != null + - append: + field: related.ip + value: "{{{crowdstrike.event.AdditionalEndpointIpAddress}}}" + allow_duplicates: false + tag: append_additional_endpoint_hostname + if: ctx.crowdstrike?.event?.AdditionalEndpointIpAddress != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml new file mode 100644 index 00000000000..95000aee4fa --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/mobile_detection_summary.yml @@ -0,0 +1,120 @@ +--- +processors: + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + field: event.action + value: mobile-detection + - remove: + field: event.created + if: ctx.crowdstrike?.event?.ContextTimeStamp != null + tag: remove_event_created + ignore_missing: true + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_creation_time + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && String.valueOf(ctx.crowdstrike.event.ContextTimeStamp).length() <= 11' + - date: + field: crowdstrike.event.ContextTimeStamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_creation_time + if: 'ctx.crowdstrike?.event?.ContextTimeStamp != null && String.valueOf(ctx.crowdstrike.event.ContextTimeStamp).length() >= 12' + - rename: + field: crowdstrike.event.MobileDetectionId + target_field: event.id + ignore_missing: true + tag: rename_mobile_detect_id + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - rename: + field: crowdstrike.event.DetectName + target_field: rule.name + ignore_missing: true + tag: rename_detect_name + - rename: + field: crowdstrike.event.DetectDescription + target_field: rule.description + ignore_missing: true + tag: rename_detect_description + - set: + field: threat.framework + value: MITRE ATT&CK + - append: + field: threat.technique.name + value: "{{{crowdstrike.event.Technique}}}" + tag: append_technique_name + if: ctx.crowdstrike?.event?.Technique != null + - append: + field: threat.technique.id + value: "{{{crowdstrike.event.TechniqueId}}}" + tag: append_technique_id + if: ctx.crowdstrike?.event?.TechniqueId != null + - append: + field: threat.tactic.name + value: "{{{crowdstrike.event.Tactic}}}" + tag: append_tactic_name + if: ctx.crowdstrike?.event?.Tactic != null + - append: + field: threat.tactic.id + value: "{{{crowdstrike.event.TacticId}}}" + tag: append_tactic_id + if: ctx.crowdstrike?.event?.TacticId != null + - rename: + field: crowdstrike.event.ComputerName + target_field: host.name + ignore_missing: true + tag: rename_computer_name + - rename: + field: crowdstrike.event.UserName + target_field: user.name + ignore_missing: true + tag: rename_user_name + - rename: + field: crowdstrike.event.FalconHostLink + target_field: event.reference + ignore_missing: true + tag: rename_falcon_host_link + - rename: + field: crowdstrike.event.Severity + target_field: event.severity + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.SensorId + target_field: device.id + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.ProcessId + target_field: process.pid + ignore_missing: true + tag: rename_process_id + +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml new file mode 100644 index 00000000000..791c4b1c457 --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/recon_notification_summary.yml @@ -0,0 +1,88 @@ +--- +processors: + - set: + field: event.kind + value: event + - append: + field: event.category + value: threat + tag: append_threat_category + - append: + field: event.type + value: indicator + tag: append_indicator_type + - set: + field: event.action + value: recon-notification + if: ctx.crowdstrike?.event?.ItemType == null + - set: + field: event.action + value: "recon-notification-{{{ctx.crowdstrike.event.ItemType}}}" + if: ctx.crowdstrike?.event?.ItemType != null + - rename: + field: crowdstrike.event.ItemId + target_field: event.id + ignore_missing: true + tag: rename_item_id + - rename: + field: crowdstrike.event.RuleId + target_field: rule.id + ignore_missing: true + tag: rename_rule_id + - rename: + field: crowdstrike.event.RuleName + target_field: rule.name + ignore_missing: true + tag: rename_rule_name + - rename: + field: crowdstrike.event.RuleTopic + target_field: rule.ruleset + ignore_missing: true + tag: rename_rule_topic + - rename: + field: crowdstrike.event.RuleTopic + target_field: rule.description + ignore_missing: true + tag: rename_rule_topic + - date: + field: crowdstrike.event.MatchedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_matched_timestamp + if: "ctx.crowdstrike?.event?.MatchedTimestamp != null && String.valueOf(ctx.crowdstrike.event.MatchedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.MatchedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_matched_timestamp + if: 'ctx.crowdstrike?.event?.MatchedTimestamp != null && String.valueOf(ctx.crowdstrike.event.MatchedTimestamp).length() <= 11' + - date: + field: crowdstrike.event.ItemPostedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX_MS + tag: date_event_matched_timestamp + if: "ctx.crowdstrike?.event?.ItemPostedTimestamp != null && String.valueOf(ctx.crowdstrike.event.ItemPostedTimestamp).length() >= 12" + - date: + field: crowdstrike.event.ItemPostedTimestamp + target_field: event.created + timezone: UTC + formats: + - UNIX + tag: date_event_matched_timestamp + if: 'ctx.crowdstrike?.event?.ItemPostedTimestamp != null && String.valueOf(ctx.crowdstrike.event.ItemPostedTimestamp).length() <= 11' + + +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml new file mode 100644 index 00000000000..fac00c209bc --- /dev/null +++ b/packages/crowdstrike/data_stream/falcon/elasticsearch/ingest_pipeline/xdr_detection_summary.yml @@ -0,0 +1,243 @@ +--- +processors: + - set: + field: event.kind + value: alert + tag: set_event_kind + - append: + field: event.category + value: malware + tag: append_malware_category + - append: + field: event.type + value: info + tag: append_info_type + - set: + field: event.action + value: xdr-detection + - append: + field: rule.author + value: "{{{crowdstrike.event.Author}}}" + tag: append_author + if: ctx.crowdstrike?.event?.Author != null + - rename: + field: crowdstrike.event.Severity + target_field: event.severity + ignore_missing: true + tag: rename_severity + - rename: + field: crowdstrike.event.Name + target_field: rule.name + ignore_missing: true + - rename: + field: crowdstrike.event.DetectId + target_field: rule.id + ignore_missing: true + tag: rename_detect_id + - convert: + field: crowdstrike.event.PatternId + target_field: rule.uuid + type: string + tag: convert_pattern_id + ignore_missing: true + - rename: + field: crowdstrike.event.Description + target_field: message + ignore_missing: true + tag: rename_description + - split: + field: crowdstrike.event.DataDomains + separator: "," + tag: split_data_domains + if: ctx.crowdstrike?.event?.DataDomains != null && ctx.crowdstrike?.event?.DataDomains.contains(",") + - split: + field: crowdstrike.event.EmailAddresses + separator: "," + tag: split_email_addresses + if: ctx.crowdstrike?.event?.EmailAddresses != null && ctx.crowdstrike?.event?.EmailAddresses.contains(",") + - split: + field: crowdstrike.event.IPV4Addresses + separator: "," + target_field: related.ip + tag: split_ipv4_addresses + if: ctx.crowdstrike?.event?.IPV4Addresses != null && ctx.crowdstrike?.event?.IPV4Addresses.contains(",") + - append: + field: related.ip + value: "{{{crowdstrike.event.IPV4Addresses}}}" + allow_duplicates: false + tag: append_ipv4_addresses + if: ctx.crowdstrike?.event?.IPV4Addresses != null && !ctx.crowdstrike?.event?.IPV4Addresses.contains(",") + - split: + field: crowdstrike.event.IPV6Addresses + separator: "," + target_field: related.ip + tag: split_ipv6_addresses + if: ctx.crowdstrike?.event?.IPV6Addresses != null && ctx.crowdstrike?.event?.IPV6Addresses.contains(",") + - append: + field: related.ip + value: "{{{crowdstrike.event.IPV6Addresses}}}" + allow_duplicates: false + tag: append_ipv6_addresses + if: ctx.crowdstrike?.event?.IPV6Addresses != null && !ctx.crowdstrike?.event?.IPV6Addresses.contains(",") + - split: + field: crowdstrike.event.HostNames + separator: "," + target_field: related.hosts + tag: split_host_names + if: ctx.crowdstrike?.event?.HostNames != null && ctx.crowdstrike?.event?.HostNames.contains(",") + - append: + field: related.hosts + value: "{{{crowdstrike.event.HostNames}}}" + allow_duplicates: false + tag: append_host_names + if: ctx.crowdstrike?.event?.HostNames != null && !ctx.crowdstrike?.event?.HostNames.contains(",") + - split: + field: crowdstrike.event.DomainNames + separator: "," + target_field: related.hosts + tag: split_domain_names + if: ctx.crowdstrike?.event?.DomainNames != null && ctx.crowdstrike?.event?.DomainNames.contains(",") + - append: + field: related.hosts + value: "{{{crowdstrike.event.DomainNames}}}" + allow_duplicates: false + tag: append_domain_names + if: ctx.crowdstrike?.event?.DomainNames != null && !ctx.crowdstrike?.event?.DomainNames.contains(",") + - split: + field: crowdstrike.event.SHA256Hashes + separator: "," + target_field: related.hash + tag: split_domain_names + if: ctx.crowdstrike?.event?.SHA256Hashes != null && ctx.crowdstrike?.event?.SHA256Hashes.contains(",") + - append: + field: related.hash + value: "{{{crowdstrike.event.SHA256Hashes}}}" + allow_duplicates: false + tag: append_domain_names + if: ctx.crowdstrike?.event?.SHA256Hashes != null && !ctx.crowdstrike?.event?.SHA256Hashes.contains(",") + - split: + field: crowdstrike.event.MD5Hashes + separator: "," + target_field: related.hash + tag: split_domain_names + if: ctx.crowdstrike?.event?.MD5Hashes != null && ctx.crowdstrike?.event?.MD5Hashes.contains(",") + - append: + field: related.hash + value: "{{{crowdstrike.event.MD5Hashes}}}" + allow_duplicates: false + tag: append_domain_names + if: ctx.crowdstrike?.event?.MD5Hashes != null && !ctx.crowdstrike?.event?.MD5Hashes.contains(",") + - split: + field: crowdstrike.event.Users + separator: "," + target_field: related.user + tag: split_domain_names + if: ctx.crowdstrike?.event?.Users != null && ctx.crowdstrike?.event?.Users.contains(",") + - append: + field: related.user + value: "{{{crowdstrike.event.Users}}}" + allow_duplicates: false + tag: append_domain_names + if: ctx.crowdstrike?.event?.Users != null && !ctx.crowdstrike?.event?.Users.contains(",") + - set: + field: rule.description + copy_from: message + tag: set_rule_description + if: ctx.message != null + - convert: + field: crowdstrike.event.StartTimeEpoch + type: string + tag: convert_start_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.StartTimeEpoch != null + - gsub: + field: crowdstrike.event.StartTimeEpoch + pattern: "\\d{6}$" + replacement: "" + tag: gsub_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() > 18" + - date: + field: crowdstrike.event.StartTimeEpoch + target_field: event.start + timezone: UTC + formats: + - UNIX_MS + tag: date_event_start_time_epoch + if: "ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() >= 12" + - date: + field: crowdstrike.event.StartTimeEpoch + target_field: event.start + timezone: UTC + formats: + - UNIX + tag: date_event_start_time_epoch + if: 'ctx.crowdstrike?.event?.StartTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.StartTimeEpoch).length() <= 11' + - set: + field: '@timestamp' + copy_from: event.start + tag: copy_timestamp_from_event_start + if: ctx.event?.start != null + - convert: + field: crowdstrike.event.EndTimeEpoch + type: string + tag: convert_end_time_epoch + ignore_missing: true + if: ctx.crowdstrike?.event?.EndTimeEpoch != null + - gsub: + field: crowdstrike.event.EndTimeEpoch + pattern: "\\d{6}$" + replacement: "" + tag: gsub_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() > 18" + - date: + field: crowdstrike.event.EndTimeEpoch + target_field: event.end + timezone: UTC + formats: + - UNIX_MS + tag: date_event_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() >= 12" + - date: + field: crowdstrike.event.EndTimeEpoch + target_field: process.end + timezone: UTC + formats: + - UNIX + tag: date_event_end_time_epoch + if: "ctx.crowdstrike?.event?.EndTimeEpoch != null && String.valueOf(ctx.crowdstrike.event.EndTimeEpoch).length() <= 11" + - set: + field: threat.framework + value: MITRE ATT&CK + - split: + field: crowdstrike.event.Techniques + separator: "," + target_field: threat.technique.name + tag: split_techniques + if: ctx.crowdstrike?.event?.Techniques != null + - split: + field: crowdstrike.event.TechniqueIds + separator: "," + target_field: threat.technique.id + tag: split_technique_ids + if: ctx.crowdstrike?.event?.TechniqueIds != null + - split: + field: crowdstrike.event.Tactics + separator: "," + target_field: threat.tactic.name + tag: split_tactics + if: ctx.crowdstrike?.event?.Tactics != null + - split: + field: crowdstrike.event.TacticIds + separator: "," + target_field: threat.tactic.id + tag: split_tactic_ids + if: ctx.crowdstrike?.event?.TacticIds != null + +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/crowdstrike/data_stream/falcon/fields/ecs.yml b/packages/crowdstrike/data_stream/falcon/fields/ecs.yml index bc198a6f8f4..bb9fb2639b4 100644 --- a/packages/crowdstrike/data_stream/falcon/fields/ecs.yml +++ b/packages/crowdstrike/data_stream/falcon/fields/ecs.yml @@ -28,6 +28,8 @@ external: ecs - name: event.end external: ecs +- name: user.id + external: ecs - name: user.name external: ecs - name: user.domain @@ -36,8 +38,12 @@ external: ecs - name: threat.technique.name external: ecs +- name: threat.technique.id + external: ecs - name: threat.tactic.name external: ecs +- name: threat.tactic.id + external: ecs - name: threat.framework external: ecs - name: process.pid @@ -62,6 +68,8 @@ external: ecs - name: process.parent.args external: ecs +- name: device.id + external: ecs - name: agent.name external: ecs - name: agent.id @@ -86,8 +94,12 @@ external: ecs - name: file.path external: ecs +- name: rule.author + external: ecs - name: rule.id external: ecs +- name: rule.uuid + external: ecs - name: rule.name external: ecs - name: rule.description diff --git a/packages/crowdstrike/data_stream/falcon/fields/fields.yml b/packages/crowdstrike/data_stream/falcon/fields/fields.yml index cab9ba856a9..6ae39ea7103 100644 --- a/packages/crowdstrike/data_stream/falcon/fields/fields.yml +++ b/packages/crowdstrike/data_stream/falcon/fields/fields.yml @@ -34,10 +34,158 @@ type: keyword description: | Name of the detection. + - name: DataDomains + type: keyword + description: | + Data domains of the event that was the primary indicator or created it. + - name: ActivityId + type: keyword + description: | + ID of the activity that triggered the detection. + - name: PolicyId + type: long + description: | + The ID of the associated Policy. + - name: AddedPrivilege + type: keyword + description: | + The difference between their current and previous list of privileges. + - name: AdditionalAccountObjectGuid + type: keyword + description: | + Additional involved user object GUID. + - name: AdditionalAccountObjectSid + type: keyword + description: | + Additional involved user object SID. + - name: AdditionalAccountUpn + type: keyword + description: | + Additional involved user UPN. + - name: SourceAccountUpn + type: keyword + description: | + Source user UPN. + - name: AdditionalActivityId + type: keyword + description: | + ID of an additional activity related to the detection. + - name: AdditionalEndpointAccountObjectGuid + type: keyword + description: | + Additional involved endpoint object GUID. + - name: SourceEndpointAccountObjectGuid + type: keyword + description: | + Source endpoint object GUID + - name: AdditionalEndpointAccountObjectSid + type: keyword + description: | + Additional involved endpoint object SID. + - name: SourceEndpointAccountObjectSid + type: keyword + description: | + Source endpoint object SID. + - name: AdditionalEndpointSensorId + type: keyword + description: | + Additional involved endpoint agent ID. + - name: SourceEndpointIpReputation + type: keyword + description: | + Source endpoint IP reputation. + - name: SourceEndpointSensorId + type: keyword + description: | + Source endpoint agent ID. + - name: AdditionalLocationCountryCode + type: keyword + description: | + Additional involved country code. + - name: AdditionalSsoApplicationIdentifier + type: keyword + description: | + Additional application identifier. + - name: SsoApplicationIdentifier + type: keyword + description: | + Destination application identifier. + - name: SuspiciousMachineAccountAlterationType + type: keyword + description: | + Machine alteration type. + - name: AnomalousTicketContentClassification + type: keyword + description: | + Ticket signature analysis. + - name: CertificateTemplateName + type: keyword + description: | + Name of the certificate template. + - name: CertificateTemplateIdentifier + type: keyword + description: | + The ID of the certificate template. + - name: AccountCreationTimeStamp + type: date + description: | + The timestamp of when the source account was created in Active Directory. + - name: XdrType + type: keyword + description: | + Type of detection: xdr or xdr-scheduled-search. + - name: IdpPolicyRuleAction + type: keyword + description: | + Identity Protection policy rule action. + - name: IdpPolicyRuleName + type: keyword + description: | + Identity Protection policy rule name. + - name: IdpPolicyRuleTrigger + type: keyword + description: | + Identity Protection policy rule trigger. + - name: LdapSearchQueryAttack + type: keyword + description: | + Detected LDAP tool attack. - name: SeverityName type: keyword description: | - Severity score text. + The severity level of the detection, as a string (High/Medium/Informational). + - name: NotificationId + type: keyword + description: | + ID of the generated notification. + - name: Highlights + type: text + description: | + Sections of content that matched the monitoring rule. + - name: ItemPostedTimestamp + type: date + description: | + Time the raw intelligence was posted. + - name: MostRecentActivityTimeStamp + type: date + description: | + The timestamp of the latest activity performed by the account. + - name: PrecedingActivityTimeStamp + type: date + description: | + The timestamp of the activity before the most recent activity was performed. + - name: SourceProducts + type: keyword + description: | + Names of the products from which the source data originated. + - name: SourceVendors + type: keyword + description: | + Names of the vendors from which the source data originated. + - name: EmailAddresses + type: keyword + description: | + Summary list of all associated entity email addresses. - name: SHA1String type: keyword description: | @@ -62,6 +210,42 @@ type: keyword description: | Unique ID associated with the Falcon sensor. + - name: TargetAccountDomain + type: keyword + description: | + Target user domain. + - name: TargetAccountName + type: keyword + description: | + Target user name. + - name: TargetAccountObjectSid + type: keyword + description: | + Target user object SID. + - name: TargetAccountUpn + type: keyword + description: | + Target user UPN. + - name: TargetEndpointAccountObjectGuid + type: keyword + description: | + Target endpoint object GUID. + - name: TargetEndpointAccountObjectSid + type: keyword + description: | + Target endpoint object SID. + - name: TargetEndpointHostName + type: keyword + description: | + Target endpoint hostname. + - name: TargetEndpointSensorId + type: keyword + description: | + Target endpoint agent ID. + - name: TargetServiceAccessIdentifier + type: keyword + description: | + Target SPN. - name: DetectId type: keyword description: | @@ -78,6 +262,18 @@ type: keyword description: | Method of detection. + - name: PreviousPrivileges + type: keyword + description: | + A list of the source account's privileges before privilege changes were made. + - name: ProtocolAnomalyClassification + type: keyword + description: | + Authentication signature analysis. + - name: RpcOpClassification + type: keyword + description: | + RPC operation type. - name: PatternDispositionValue type: integer description: | @@ -131,10 +327,6 @@ type: boolean - name: SuspendProcess type: boolean - - name: State - type: keyword - description: | - Whether the incident summary is open and ongoing or closed. - name: AssociatedFile type: keyword description: | @@ -143,6 +335,10 @@ type: keyword description: | The numerical ID of the pattern associated with the action taken on the detection. + - name: Finding + type: keyword + description: | + The details of the finding. - name: FineScore type: float description: | @@ -155,18 +351,130 @@ type: keyword description: | Event subtype. + - name: RulePriority + type: keyword + description: | + Priority of the monitoring rule that found the match. + - name: ItemType + type: keyword + description: | + Type of raw intelligence. - name: OARuleInstanceID type: keyword description: | Numerical ID of the custom IOA rule under a given CID. + - name: ResourceUrl + type: keyword + description: | + The URL to the cloud resource. + - name: Tags + type: nested + description: | + Tags on the cloud resources if any. - name: IOARuleInstanceVersion type: long description: | Version number of the InstanceID that triggered. + - name: ResourceAttributes + type: flattened + description: | + A JSON blob with all resource attributes. + - name: ResourceId + type: keyword + description: | + The cloud resource identifier. + - name: ResourceIdType + type: keyword + description: | + The type of the detected resource identifier. + - name: ResourceName + type: keyword + description: | + Resource name if any. - name: IOARuleName type: keyword description: | Name given to the custom IOA rule that triggered. + - name: SELinuxEnforcementPolicy + type: keyword + description: | + State of SELinux enforcement policy on an Android device. + - name: SafetyNetErrors + type: keyword + description: | + Describes a SafetyNet error + - name: SafetyNetCTSProfileMatch + type: keyword + description: | + The result of a stricter verdict for device integrity. + - name: SafetyNetBasicIntegrity + type: keyword + description: | + The result of a more lenient verdict for device integrity. + - name: SafetyNetEvaluationType + type: keyword + description: | + Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. + - name: SafetyNetErrorMessage + type: keyword + description: | + An encoded error message. + - name: SafetyNetAdvice + type: keyword + description: | + Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. + - name: KeyStoreErrors + type: keyword + description: | + Describes a KeyStore error. + - name: VerifiedBootState + type: keyword + description: | + Provides the device’s current boot state. + - name: MobileAppsDetails + type: nested + description: | + Provides one or more JSON objects describing the related mobile applications. + - name: MobileNetworkConnections + type: nested + description: | + Provides one or more JSON objects describing the related network connections from the mobile device. + - name: MobileDnsRequests + type: nested + description: | + Provides one or more JSON objects describing the related DNS requests from the mobile device. + - name: MountedVolumes + type: nested + description: | + Provides one or more JSON objects describing mounted volumes on the mobile device. + - name: Trampolines + type: nested + description: | + Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. + - name: LoadedObjects + type: nested + description: | + Provides one or more JSON objects describing the loaded objects related to the detection. + - name: ObjectiveCRuntimesAltered + type: nested + description: | + Provides one or more JSON objects describing the obj-c methods related to the malware. + - name: RootAccessIndicators + type: nested + description: | + Provides one or more JSON objects which includes logs and stack traces from the suspicious source. + - name: Certificates + type: nested + description: | + Provides one or more JSON objects which includes related SSL/TLS Certificates. + - name: EnvironmentVariables + type: nested + description: | + Provides one or more JSON objects which includes related environment variables. + - name: SystemProperties + type: nested + description: | + Provides one or more JSON objects which includes related system properties. - name: Success type: boolean description: | @@ -227,10 +535,26 @@ type: keyword description: | CrowdStrike value for indicator of compromise. + - name: Category + type: keyword + description: | + IDP incident category. + - name: NumbersOfAlerts + type: long + description: | + Number of alerts in the identity-based incident. + - name: NumberOfCompromisedEntities + type: long + description: | + Number of compromised entities, users and endpoints. - name: ServiceName type: keyword description: | Description of which related service was involved in the event. + - name: State + type: keyword + description: | + Identity-based detection or incident status. - name: ParentImageFileName type: keyword description: | @@ -291,6 +615,22 @@ type: keyword description: | CrowdStrike provided protocol. + - name: ScheduledSearchId + type: keyword + description: | + Unique identifier of the associated scheduled search. + - name: ScheduledSearchUserUUID + type: keyword + description: | + UUID of the user that created the the associated scheduled search. + - name: ScheduledSearchUserId + type: keyword + description: | + User ID of the user that created the the associated scheduled search. + - name: ScheduledSearchExecutionId + type: keyword + description: | + ID of the specific search execution. - name: NetworkProfile type: keyword description: | diff --git a/packages/crowdstrike/data_stream/falcon/sample_event.json b/packages/crowdstrike/data_stream/falcon/sample_event.json index ac03c62d1dd..9604ba877ad 100644 --- a/packages/crowdstrike/data_stream/falcon/sample_event.json +++ b/packages/crowdstrike/data_stream/falcon/sample_event.json @@ -25,7 +25,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "62b999a7-d53a-460e-b8cb-bcccb4e5fbd5", diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json index b9705becec7..449b3d2e2b1 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-data.log-expected.json @@ -68,7 +68,7 @@ "eid": 118 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-06T05:38:50.000Z", @@ -184,7 +184,7 @@ "eid": 119 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-05T01:52:00.000Z", diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json index b8d6785756a..2bcf71c81a6 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdr.log-expected.json @@ -18,7 +18,7 @@ "name": "SyntheticProcessRollup2MacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SyntheticProcessRollup2", @@ -124,7 +124,7 @@ "name": "EndOfProcessMacV15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -218,7 +218,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RawBindIP6", @@ -314,7 +314,7 @@ "name": "ProcessRollup2StatsMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2Stats", @@ -417,7 +417,7 @@ "name": "SensorHeartbeatMacV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SensorHeartbeat", @@ -493,7 +493,7 @@ "name": "ProcessRollup2MacV5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -613,7 +613,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkReceiveAcceptIP4", @@ -709,7 +709,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RawBindIP4", @@ -815,7 +815,7 @@ "port": 50626 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP6", @@ -908,7 +908,7 @@ "name": "ProcessRollup2LinV6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -1021,7 +1021,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP6", @@ -1105,7 +1105,7 @@ "name": "OoxmlFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OoxmlFileWritten", @@ -1208,7 +1208,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP4", @@ -1308,7 +1308,7 @@ "name": "ChannelVersionRequiredLinV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ChannelVersionRequired", @@ -1373,7 +1373,7 @@ "name": "LocalIpAddressIP6LinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressIP6", @@ -1463,7 +1463,7 @@ "name": "ChannelVersionRequiredMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ChannelVersionRequired", @@ -1527,7 +1527,7 @@ "name": "SensorHeartbeatLinV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SensorHeartbeat", @@ -1595,7 +1595,7 @@ "name": "JavaClassFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "JavaClassFileWritten", @@ -1699,7 +1699,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP4", @@ -1793,7 +1793,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DnsRequest", @@ -1867,7 +1867,7 @@ "name": "NewScriptWrittenMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewScriptWritten", @@ -1953,7 +1953,7 @@ "name": "LocalIpAddressRemovedIP6LinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressRemovedIP6", @@ -2040,7 +2040,7 @@ "name": "DirectoryCreateMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DirectoryCreate", @@ -2148,7 +2148,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkCloseIP4", @@ -2273,7 +2273,7 @@ "name": "FsVolumeMountedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeMounted", @@ -2352,7 +2352,7 @@ "name": "LocalIpAddressIP4LinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressIP4", @@ -2443,7 +2443,7 @@ "name": "LocalIpAddressRemovedIP6MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressRemovedIP6", @@ -2545,7 +2545,7 @@ "name": "LocalIpAddressIP6MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressIP6", @@ -2640,7 +2640,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP4", @@ -2723,7 +2723,7 @@ "name": "ExecutableDeletedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ExecutableDeleted", @@ -2803,7 +2803,7 @@ "name": "GzipFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GzipFileWritten", @@ -2880,7 +2880,7 @@ "name": "IOServiceRegisterMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "IOServiceRegister", @@ -2949,7 +2949,7 @@ "name": "PtyCreatedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PtyCreated", @@ -3028,7 +3028,7 @@ "name": "LocalIpAddressRemovedIP4MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressRemovedIP4", @@ -3123,7 +3123,7 @@ "port": 9 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkCloseIP6", @@ -3213,7 +3213,7 @@ "name": "ConfigStateUpdateLinV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ConfigStateUpdate", @@ -3282,7 +3282,7 @@ "name": "SuspiciousDnsRequestMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousDnsRequest", @@ -3362,7 +3362,7 @@ "name": "ErrorEventLinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ErrorEvent", @@ -3459,7 +3459,7 @@ "name": "ConfigStateUpdateMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ConfigStateUpdate", @@ -3528,7 +3528,7 @@ "name": "KextLoadMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "KextLoad", @@ -3603,7 +3603,7 @@ "name": "ChannelVersionRequiredLinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ChannelVersionRequired", @@ -3667,7 +3667,7 @@ "name": "ProcessRollup2StatsLinV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2Stats", @@ -3760,7 +3760,7 @@ "name": "UserIdentityMacV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserIdentity", @@ -3848,7 +3848,7 @@ "name": "DeliverLocalFXToCloudMacV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DeliverLocalFXToCloud", @@ -3909,7 +3909,7 @@ "name": "CreateProcessArgsMac" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CreateProcessArgs", @@ -4011,7 +4011,7 @@ "name": "PdfFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PdfFileWritten", @@ -4095,7 +4095,7 @@ "name": "GroupIdentityMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupIdentity", @@ -4168,7 +4168,7 @@ "name": "MachOFileWrittenMacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MachOFileWritten", @@ -4265,7 +4265,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP6", @@ -4470,7 +4470,7 @@ "name": "CurrentSystemTagsMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CurrentSystemTags", @@ -4539,7 +4539,7 @@ "name": "NewExecutableWrittenMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewExecutableWritten", @@ -4748,7 +4748,7 @@ "name": "LfoUploadDataCompleteMacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LfoUploadDataComplete", @@ -4825,7 +4825,7 @@ "name": "LightningLatencyInfoMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LightningLatencyInfo", @@ -4921,7 +4921,7 @@ "name": "NeighborListIP4MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NeighborListIP4", @@ -4990,7 +4990,7 @@ "name": "ZipFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ZipFileWritten", @@ -5095,7 +5095,7 @@ "name": "AgentOnlineMacV13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AgentOnline", @@ -5177,7 +5177,7 @@ "name": "CriticalFileAccessedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CriticalFileAccessed", @@ -5270,7 +5270,7 @@ "name": "OsVersionInfoMacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OsVersionInfo", @@ -5356,7 +5356,7 @@ "name": "ConfigStateUpdateLinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ConfigStateUpdate", @@ -5424,7 +5424,7 @@ "name": "LFODownloadConfirmationLinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LFODownloadConfirmation", @@ -5509,7 +5509,7 @@ "name": "TarFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TarFileWritten", @@ -5602,7 +5602,7 @@ "name": "AgentConnectMacV5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AgentConnect", @@ -5674,7 +5674,7 @@ "name": "LFODownloadConfirmationMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LFODownloadConfirmation", @@ -5761,7 +5761,7 @@ "name": "AsepFileChangeMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AsepFileChange", @@ -5843,7 +5843,7 @@ "name": "TerminateProcessLinV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TerminateProcess", @@ -5918,7 +5918,7 @@ "name": "FirewallEnabledMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FirewallEnabled", @@ -5991,7 +5991,7 @@ "name": "FsVolumeUnmountedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeUnmounted", @@ -6069,7 +6069,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP4", @@ -6153,7 +6153,7 @@ "name": "ELFFileWrittenMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ELFFileWritten", @@ -6248,7 +6248,7 @@ "name": "OsVersionInfoLinV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OsVersionInfo", @@ -6319,7 +6319,7 @@ "name": "CriticalFileModifiedMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CriticalFileModified", @@ -6412,7 +6412,7 @@ "name": "NeighborListIP6MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NeighborListIP6", @@ -6482,7 +6482,7 @@ "name": "NewScriptWrittenMacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewScriptWritten", @@ -6581,7 +6581,7 @@ "name": "SystemCapacityMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SystemCapacity", @@ -6655,7 +6655,7 @@ "name": "FirmwareAnalysisStatusMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FirmwareAnalysisStatus", @@ -6741,7 +6741,7 @@ "name": "LocalIpAddressIP4MacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LocalIpAddressIP4", @@ -6835,7 +6835,7 @@ "name": "ProcessRollup2LinV5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -6948,7 +6948,7 @@ "name": "EndOfProcessMacV14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -7082,7 +7082,7 @@ "name": "EndOfProcessV15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -7183,7 +7183,7 @@ "name": "EndOfProcessMacV12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -7280,7 +7280,7 @@ "name": "ProcessRollup2V17" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -7383,7 +7383,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DnsRequest", @@ -7457,7 +7457,7 @@ "name": "CriticalFileAccessedLinV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CriticalFileAccessed", @@ -7554,7 +7554,7 @@ "name": "ProcessRollup2MacV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -7665,7 +7665,7 @@ "name": "NewScriptWrittenV7" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewScriptWritten", @@ -7768,7 +7768,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP4", @@ -7876,7 +7876,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP4", @@ -7981,7 +7981,7 @@ "name": "UserLogonV8" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLogon", @@ -8077,7 +8077,7 @@ "name": "PeFileWrittenV14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PeFileWritten", @@ -8177,7 +8177,7 @@ "name": "UserLogoffV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLogoff", @@ -8268,7 +8268,7 @@ "name": "NewExecutableWrittenV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewExecutableWritten", @@ -8360,7 +8360,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP4", @@ -8470,7 +8470,7 @@ "ip": "67.43.156.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLogonFailed2", @@ -8559,7 +8559,7 @@ "name": "ExecutableDeletedV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ExecutableDeleted", @@ -8655,7 +8655,7 @@ "name": "EndOfProcessMacV11" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -8735,7 +8735,7 @@ "name": "RegisterRawInputDevicesEtwV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RegisterRawInputDevicesEtw", @@ -8813,7 +8813,7 @@ "name": "LFODownloadConfirmationV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LFODownloadConfirmation", @@ -8906,7 +8906,7 @@ "name": "NewExecutableRenamedV6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewExecutableRenamed", @@ -8999,7 +8999,7 @@ "name": "DirectoryCreateV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DirectoryCreate", @@ -9088,7 +9088,7 @@ "name": "ServiceStartedV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ServiceStarted", @@ -9187,7 +9187,7 @@ "port": 2181 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP6", @@ -9285,7 +9285,7 @@ "name": "UserIdentityV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserIdentity", @@ -9401,7 +9401,7 @@ "name": "ProcessRollup2V16" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -9509,7 +9509,7 @@ "name": "RansomwareOpenFileV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RansomwareOpenFile", @@ -9645,7 +9645,7 @@ "name": "EndOfProcessV14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EndOfProcess", @@ -9742,7 +9742,7 @@ "name": "OoxmlFileWrittenV11" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OoxmlFileWritten", @@ -9835,7 +9835,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP6", @@ -9932,7 +9932,7 @@ "name": "AsepFileChangeMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AsepFileChange", @@ -10019,7 +10019,7 @@ "name": "UserLogonFailedV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLogonFailed", @@ -10119,7 +10119,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkConnectIP6", @@ -10213,7 +10213,7 @@ "name": "NewExecutableRenamedMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NewExecutableRenamed", @@ -10308,7 +10308,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP6", @@ -10394,7 +10394,7 @@ "name": "SuspiciousDnsRequestV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousDnsRequest", @@ -10480,7 +10480,7 @@ "name": "FsVolumeMountedV6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeMounted", @@ -10563,7 +10563,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NetworkListenIP4", @@ -10657,7 +10657,7 @@ "name": "HostedServiceStartedV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "HostedServiceStarted", @@ -10738,7 +10738,7 @@ "name": "HostedServiceStoppedV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "HostedServiceStopped", @@ -10820,7 +10820,7 @@ "name": "PdfFileWrittenV11" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PdfFileWritten", @@ -10922,7 +10922,7 @@ "name": "ProcessRollup2V18" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -11019,7 +11019,7 @@ "name": "UserIdentityMacV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserIdentity", @@ -11104,7 +11104,7 @@ "name": "HostInfoV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "HostInfo", @@ -11182,7 +11182,7 @@ "name": "GenericFileWrittenV11" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GenericFileWritten", @@ -11265,7 +11265,7 @@ "name": "FsVolumeUnmountedV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeUnmounted", @@ -11338,7 +11338,7 @@ "name": "FirewallDisabledMacV1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FirewallDisabled", @@ -11420,7 +11420,7 @@ "cid": "ffffffff30a3407dae27d0503611022ff" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2021-11-09T05:47:19.952Z", @@ -11499,7 +11499,7 @@ "name": "UserLogoffV3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLogoff", @@ -11599,7 +11599,7 @@ "name": "ProcessRollup2V19" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ProcessRollup2", @@ -11700,7 +11700,7 @@ "name": "FsVolumeUnmountedV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeUnmounted", @@ -11785,7 +11785,7 @@ "subnet": "10.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-16T01:57:00.343Z", @@ -11868,7 +11868,7 @@ "name": "FsVolumeUnmountedV2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FsVolumeUnmounted", diff --git a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json index e324f20ec3f..0b57dbb6fad 100644 --- a/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json +++ b/packages/crowdstrike/data_stream/fdr/_dev/test/pipeline/test-fdrv2-notmanaged.log-expected.json @@ -22,7 +22,7 @@ "subnet": "192.168" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-06T08:25:02.395Z", diff --git a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml index e97ba7c27b5..395f6c07cd6 100644 --- a/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml +++ b/packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline/default.yml @@ -191,7 +191,7 @@ processors: ## ECS fields. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## Categorization. - script: @@ -1849,7 +1849,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP4 instanceof List && ctx.crowdstrike.LocalAddressIP4.length > 0 @@ -1874,7 +1874,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip if: ctx.source?.ip == null && ctx.crowdstrike?.LocalAddressIP6 instanceof List && ctx.crowdstrike.LocalAddressIP6.length > 0 diff --git a/packages/crowdstrike/data_stream/fdr/manifest.yml b/packages/crowdstrike/data_stream/fdr/manifest.yml index 6e3707ff2c9..68873ff7627 100644 --- a/packages/crowdstrike/data_stream/fdr/manifest.yml +++ b/packages/crowdstrike/data_stream/fdr/manifest.yml @@ -89,14 +89,14 @@ streams: multi: false required: false show_user: false - description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. + description: The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Valid time units are h, m, s. - name: api_timeout type: text title: API Timeout multi: false required: false show_user: false - description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. + description: The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Valid time units are h, m, s. - name: fips_enabled type: bool title: Enable S3 FIPS diff --git a/packages/crowdstrike/data_stream/fdr/sample_event.json b/packages/crowdstrike/data_stream/fdr/sample_event.json index 695dfbd7dc3..d633dd866dd 100644 --- a/packages/crowdstrike/data_stream/fdr/sample_event.json +++ b/packages/crowdstrike/data_stream/fdr/sample_event.json @@ -31,7 +31,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "62b999a7-d53a-460e-b8cb-bcccb4e5fbd5", diff --git a/packages/crowdstrike/docs/README.md b/packages/crowdstrike/docs/README.md index 4b254f38716..424ece1fb51 100644 --- a/packages/crowdstrike/docs/README.md +++ b/packages/crowdstrike/docs/README.md @@ -53,25 +53,47 @@ Current supported event types are: | container.image.name | Name of the image the container was built on. | keyword | | container.labels | Image labels. | object | | container.name | Container name. | keyword | +| crowdstrike.event.AccountCreationTimeStamp | The timestamp of when the source account was created in Active Directory. | date | +| crowdstrike.event.ActivityId | ID of the activity that triggered the detection. | keyword | +| crowdstrike.event.AddedPrivilege | The difference between their current and previous list of privileges. | keyword | +| crowdstrike.event.AdditionalAccountObjectGuid | Additional involved user object GUID. | keyword | +| crowdstrike.event.AdditionalAccountObjectSid | Additional involved user object SID. | keyword | +| crowdstrike.event.AdditionalAccountUpn | Additional involved user UPN. | keyword | +| crowdstrike.event.AdditionalActivityId | ID of an additional activity related to the detection. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectGuid | Additional involved endpoint object GUID. | keyword | +| crowdstrike.event.AdditionalEndpointAccountObjectSid | Additional involved endpoint object SID. | keyword | +| crowdstrike.event.AdditionalEndpointSensorId | Additional involved endpoint agent ID. | keyword | +| crowdstrike.event.AdditionalLocationCountryCode | Additional involved country code. | keyword | +| crowdstrike.event.AdditionalSsoApplicationIdentifier | Additional application identifier. | keyword | +| crowdstrike.event.AnomalousTicketContentClassification | Ticket signature analysis. | keyword | | crowdstrike.event.AssociatedFile | The file associated with the triggering indicator. | keyword | | crowdstrike.event.Attributes | JSON objects containing additional information about the event. | flattened | | crowdstrike.event.AuditKeyValues | Fields that were changed in this event. | nested | +| crowdstrike.event.Category | IDP incident category. | keyword | +| crowdstrike.event.CertificateTemplateIdentifier | The ID of the certificate template. | keyword | +| crowdstrike.event.CertificateTemplateName | Name of the certificate template. | keyword | +| crowdstrike.event.Certificates | Provides one or more JSON objects which includes related SSL/TLS Certificates. | nested | | crowdstrike.event.Commands | Commands run in a remote session. | keyword | | crowdstrike.event.ComputerName | Name of the computer where the detection occurred. | keyword | | crowdstrike.event.CustomerId | Customer identifier. | keyword | +| crowdstrike.event.DataDomains | Data domains of the event that was the primary indicator or created it. | keyword | | crowdstrike.event.DetectId | Unique ID associated with the detection. | keyword | | crowdstrike.event.DetectName | Name of the detection. | keyword | | crowdstrike.event.DeviceId | Device on which the event occurred. | keyword | | crowdstrike.event.DnsRequests | Detected DNS requests done by a process. | nested | | crowdstrike.event.DocumentsAccessed | Detected documents accessed by a process. | nested | +| crowdstrike.event.EmailAddresses | Summary list of all associated entity email addresses. | keyword | +| crowdstrike.event.EnvironmentVariables | Provides one or more JSON objects which includes related environment variables. | nested | | crowdstrike.event.EventType | CrowdStrike provided event type. | keyword | | crowdstrike.event.ExecutablesWritten | Detected executables written to disk by a process. | nested | +| crowdstrike.event.Finding | The details of the finding. | keyword | | crowdstrike.event.FineScore | The highest incident score reached as of the time the event was sent. | float | | crowdstrike.event.Flags.Audit | CrowdStrike audit flag. | boolean | | crowdstrike.event.Flags.Log | CrowdStrike log flag. | boolean | | crowdstrike.event.Flags.Monitor | CrowdStrike monitor flag. | boolean | | crowdstrike.event.GrandparentCommandLine | Grandparent process command line arguments. | keyword | | crowdstrike.event.GrandparentImageFileName | Path to the grandparent process. | keyword | +| crowdstrike.event.Highlights | Sections of content that matched the monitoring rule. | text | | crowdstrike.event.HostGroups | Array of related Host Group IDs. | keyword | | crowdstrike.event.ICMPCode | RFC2780 ICMP Code field. | keyword | | crowdstrike.event.ICMPType | RFC2780 ICMP Type field. | keyword | @@ -79,20 +101,37 @@ Current supported event types are: | crowdstrike.event.IOARuleName | Name given to the custom IOA rule that triggered. | keyword | | crowdstrike.event.IOCType | CrowdStrike type for indicator of compromise. | keyword | | crowdstrike.event.IOCValue | CrowdStrike value for indicator of compromise. | keyword | +| crowdstrike.event.IdpPolicyRuleAction | Identity Protection policy rule action. | keyword | +| crowdstrike.event.IdpPolicyRuleName | Identity Protection policy rule name. | keyword | +| crowdstrike.event.IdpPolicyRuleTrigger | Identity Protection policy rule trigger. | keyword | | crowdstrike.event.IncidentType | Incident Type | keyword | | crowdstrike.event.Ipv | Protocol for network request. | keyword | +| crowdstrike.event.ItemPostedTimestamp | Time the raw intelligence was posted. | date | +| crowdstrike.event.ItemType | Type of raw intelligence. | keyword | +| crowdstrike.event.KeyStoreErrors | Describes a KeyStore error. | keyword | | crowdstrike.event.LMHostIDs | Array of host IDs seen to have experienced lateral movement because of the incident. | nested | | crowdstrike.event.LateralMovement | Lateral movement field for incident. | long | +| crowdstrike.event.LdapSearchQueryAttack | Detected LDAP tool attack. | keyword | +| crowdstrike.event.LoadedObjects | Provides one or more JSON objects describing the loaded objects related to the detection. | nested | | crowdstrike.event.LocalIP | IP address of the host associated with the detection. | keyword | | crowdstrike.event.MACAddress | MAC address of the host associated with the detection. | keyword | | crowdstrike.event.MD5String | MD5 sum of the executable associated with the detection. | keyword | | crowdstrike.event.MachineDomain | Domain for the machine associated with the detection. | keyword | | crowdstrike.event.MatchCount | Number of firewall rule matches. | long | | crowdstrike.event.MatchCountSinceLastReport | Number of firewall rule matches since the last report. | long | +| crowdstrike.event.MobileAppsDetails | Provides one or more JSON objects describing the related mobile applications. | nested | +| crowdstrike.event.MobileDnsRequests | Provides one or more JSON objects describing the related DNS requests from the mobile device. | nested | +| crowdstrike.event.MobileNetworkConnections | Provides one or more JSON objects describing the related network connections from the mobile device. | nested | +| crowdstrike.event.MostRecentActivityTimeStamp | The timestamp of the latest activity performed by the account. | date | +| crowdstrike.event.MountedVolumes | Provides one or more JSON objects describing mounted volumes on the mobile device. | nested | | crowdstrike.event.NetworkAccesses | Detected Network traffic done by a process. | nested | | crowdstrike.event.NetworkProfile | CrowdStrike network profile. | keyword | +| crowdstrike.event.NotificationId | ID of the generated notification. | keyword | +| crowdstrike.event.NumberOfCompromisedEntities | Number of compromised entities, users and endpoints. | long | +| crowdstrike.event.NumbersOfAlerts | Number of alerts in the identity-based incident. | long | | crowdstrike.event.OARuleInstanceID | Numerical ID of the custom IOA rule under a given CID. | keyword | | crowdstrike.event.Objective | Method of detection. | keyword | +| crowdstrike.event.ObjectiveCRuntimesAltered | Provides one or more JSON objects describing the obj-c methods related to the malware. | nested | | crowdstrike.event.OperationName | Event subtype. | keyword | | crowdstrike.event.ParentImageFileName | The parent image file name involved. | keyword | | crowdstrike.event.PatternDispositionFlags.BlockingUnsupportedOrDisabled | | boolean | @@ -120,22 +159,68 @@ Current supported event types are: | crowdstrike.event.PatternDispositionValue | Unique ID associated with action taken. | integer | | crowdstrike.event.PatternId | The numerical ID of the pattern associated with the action taken on the detection. | keyword | | crowdstrike.event.PolicyID | CrowdStrike policy id. | keyword | +| crowdstrike.event.PolicyId | The ID of the associated Policy. | long | | crowdstrike.event.PolicyName | CrowdStrike policy name. | keyword | +| crowdstrike.event.PrecedingActivityTimeStamp | The timestamp of the activity before the most recent activity was performed. | date | +| crowdstrike.event.PreviousPrivileges | A list of the source account's privileges before privilege changes were made. | keyword | | crowdstrike.event.Protocol | CrowdStrike provided protocol. | keyword | +| crowdstrike.event.ProtocolAnomalyClassification | Authentication signature analysis. | keyword | +| crowdstrike.event.ResourceAttributes | A JSON blob with all resource attributes. | flattened | +| crowdstrike.event.ResourceId | The cloud resource identifier. | keyword | +| crowdstrike.event.ResourceIdType | The type of the detected resource identifier. | keyword | +| crowdstrike.event.ResourceName | Resource name if any. | keyword | +| crowdstrike.event.ResourceUrl | The URL to the cloud resource. | keyword | +| crowdstrike.event.RootAccessIndicators | Provides one or more JSON objects which includes logs and stack traces from the suspicious source. | nested | +| crowdstrike.event.RpcOpClassification | RPC operation type. | keyword | | crowdstrike.event.RuleAction | Firewall rule action. | keyword | +| crowdstrike.event.RulePriority | Priority of the monitoring rule that found the match. | keyword | +| crowdstrike.event.SELinuxEnforcementPolicy | State of SELinux enforcement policy on an Android device. | keyword | | crowdstrike.event.SHA1String | SHA1 sum of the executable associated with the detection. | keyword | | crowdstrike.event.SHA256String | SHA256 sum of the executable associated with the detection. | keyword | +| crowdstrike.event.SafetyNetAdvice | Provides information to help explain why the Google SafetyNet Attestation API set eitherCTSProfileMatch or BasicIntegrity fields to false. | keyword | +| crowdstrike.event.SafetyNetBasicIntegrity | The result of a more lenient verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetCTSProfileMatch | The result of a stricter verdict for device integrity. | keyword | +| crowdstrike.event.SafetyNetErrorMessage | An encoded error message. | keyword | +| crowdstrike.event.SafetyNetErrors | Describes a SafetyNet error | keyword | +| crowdstrike.event.SafetyNetEvaluationType | Provides information about the type of measurements used to compute fields likeCTSProfileMatch and BasicIntegrity. | keyword | | crowdstrike.event.ScanResults | Array of scan results. | nested | +| crowdstrike.event.ScheduledSearchExecutionId | ID of the specific search execution. | keyword | +| crowdstrike.event.ScheduledSearchId | Unique identifier of the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserId | User ID of the user that created the the associated scheduled search. | keyword | +| crowdstrike.event.ScheduledSearchUserUUID | UUID of the user that created the the associated scheduled search. | keyword | | crowdstrike.event.SensorId | Unique ID associated with the Falcon sensor. | keyword | | crowdstrike.event.ServiceName | Description of which related service was involved in the event. | keyword | | crowdstrike.event.SessionId | Session ID of the remote response session. | keyword | -| crowdstrike.event.SeverityName | Severity score text. | keyword | -| crowdstrike.event.State | Whether the incident summary is open and ongoing or closed. | keyword | +| crowdstrike.event.SeverityName | The severity level of the detection, as a string (High/Medium/Informational). | keyword | +| crowdstrike.event.SourceAccountUpn | Source user UPN. | keyword | +| crowdstrike.event.SourceEndpointAccountObjectGuid | Source endpoint object GUID | keyword | +| crowdstrike.event.SourceEndpointAccountObjectSid | Source endpoint object SID. | keyword | +| crowdstrike.event.SourceEndpointIpReputation | Source endpoint IP reputation. | keyword | +| crowdstrike.event.SourceEndpointSensorId | Source endpoint agent ID. | keyword | +| crowdstrike.event.SourceProducts | Names of the products from which the source data originated. | keyword | +| crowdstrike.event.SourceVendors | Names of the vendors from which the source data originated. | keyword | +| crowdstrike.event.SsoApplicationIdentifier | Destination application identifier. | keyword | +| crowdstrike.event.State | Identity-based detection or incident status. | keyword | | crowdstrike.event.Status | CrowdStrike status. | keyword | | crowdstrike.event.Success | Indicator of whether or not this event was successful. | boolean | +| crowdstrike.event.SuspiciousMachineAccountAlterationType | Machine alteration type. | keyword | +| crowdstrike.event.SystemProperties | Provides one or more JSON objects which includes related system properties. | nested | +| crowdstrike.event.Tags | Tags on the cloud resources if any. | nested | +| crowdstrike.event.TargetAccountDomain | Target user domain. | keyword | +| crowdstrike.event.TargetAccountName | Target user name. | keyword | +| crowdstrike.event.TargetAccountObjectSid | Target user object SID. | keyword | +| crowdstrike.event.TargetAccountUpn | Target user UPN. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectGuid | Target endpoint object GUID. | keyword | +| crowdstrike.event.TargetEndpointAccountObjectSid | Target endpoint object SID. | keyword | +| crowdstrike.event.TargetEndpointHostName | Target endpoint hostname. | keyword | +| crowdstrike.event.TargetEndpointSensorId | Target endpoint agent ID. | keyword | +| crowdstrike.event.TargetServiceAccessIdentifier | Target SPN. | keyword | | crowdstrike.event.Timestamp | Firewall rule triggered timestamp. | date | +| crowdstrike.event.Trampolines | Provides one or more JSON objects describing the relevant functions and processes performing inline API hooks. | nested | | crowdstrike.event.TreeID | CrowdStrike tree id. | keyword | | crowdstrike.event.UserId | Email address or user ID associated with the event. | keyword | +| crowdstrike.event.VerifiedBootState | Provides the device’s current boot state. | keyword | +| crowdstrike.event.XdrType | Type of detection: xdr or xdr-scheduled-search. | keyword | | crowdstrike.metadata.customerIDString | Customer identifier | keyword | | crowdstrike.metadata.eventType | DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent | keyword | | crowdstrike.metadata.offset | Offset number that tracks the location of the event in stream. This is used to identify unique detection events. | integer | @@ -155,21 +240,22 @@ Current supported event types are: | destination.geo.region_name | Region name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.port | Port of the destination. | long | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | | file.hash.md5 | MD5 hash. | keyword | @@ -223,11 +309,13 @@ Current supported event types are: | related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.author | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | keyword | | rule.category | A categorization value keyword used by the entity using the rule for detection of this event. | keyword | | rule.description | The description of the rule generating the event. | keyword | | rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | | rule.name | The name of the rule or signature generating the event. | keyword | | rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | +| rule.uuid | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | keyword | | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | source.as.organization.name | Organization name. | keyword | | source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | @@ -242,11 +330,14 @@ Current supported event types are: | source.port | Port of the source. | long | | tags | List of keywords used to tag each event. | keyword | | threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | | threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | | threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | | threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | | user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | | user.email | User email address. | keyword | +| user.id | Unique identifier of the user. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -281,7 +372,7 @@ An example event for `falcon` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "62b999a7-d53a-460e-b8cb-bcccb4e5fbd5", @@ -868,10 +959,10 @@ and/or `session_token`. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -1017,7 +1108,7 @@ An example event for `fdr` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "62b999a7-d53a-460e-b8cb-bcccb4e5fbd5", diff --git a/packages/crowdstrike/kibana/tags.yml b/packages/crowdstrike/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/crowdstrike/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/crowdstrike/manifest.yml b/packages/crowdstrike/manifest.yml index 4701fdfc0fe..c4e788f6c92 100644 --- a/packages/crowdstrike/manifest.yml +++ b/packages/crowdstrike/manifest.yml @@ -1,9 +1,9 @@ name: crowdstrike title: CrowdStrike -version: "1.15.0" +version: "1.19.0" description: Collect logs from Crowdstrike with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: 2.11.0 categories: [security, edr_xdr] conditions: kibana.version: "^8.0.0" diff --git a/packages/cyberark_pta/_dev/build/build.yml b/packages/cyberark_pta/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cyberark_pta/_dev/build/build.yml +++ b/packages/cyberark_pta/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cyberark_pta/changelog.yml b/packages/cyberark_pta/changelog.yml index e52949a0c0b..794a859ad65 100644 --- a/packages/cyberark_pta/changelog.yml +++ b/packages/cyberark_pta/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.6.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.5.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.4.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.3.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json b/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json index 542bcc28e82..2069d3d9467 100644 --- a/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json +++ b/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-active-dormant-user.json-expected.json @@ -44,7 +44,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "26", diff --git a/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json-expected.json b/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json-expected.json index b6ed7dadc7a..3677d333d5a 100644 --- a/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json-expected.json +++ b/packages/cyberark_pta/data_stream/events/_dev/test/pipeline/test-suspected-cred-theft.json-expected.json @@ -44,7 +44,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1", diff --git a/packages/cyberark_pta/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/cyberark_pta/data_stream/events/elasticsearch/ingest_pipeline/default.yml index f90b8a5facf..d31d0a29823 100644 --- a/packages/cyberark_pta/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cyberark_pta/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for CyberArk PTA processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.action value: "{{cef.extensions.deviceCustomString5}}" diff --git a/packages/cyberark_pta/data_stream/events/sample_event.json b/packages/cyberark_pta/data_stream/events/sample_event.json index 63cdfa94a1a..decae2af007 100644 --- a/packages/cyberark_pta/data_stream/events/sample_event.json +++ b/packages/cyberark_pta/data_stream/events/sample_event.json @@ -55,7 +55,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "61c2aa93-e34e-4412-bd9b-ce85257847de", diff --git a/packages/cyberark_pta/docs/README.md b/packages/cyberark_pta/docs/README.md index 0f06b54238e..0c6e2eeb634 100644 --- a/packages/cyberark_pta/docs/README.md +++ b/packages/cyberark_pta/docs/README.md @@ -287,7 +287,7 @@ An example event for pta looks as following: | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module | constant_keyword | diff --git a/packages/cyberark_pta/kibana/tags.yml b/packages/cyberark_pta/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cyberark_pta/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cyberark_pta/manifest.yml b/packages/cyberark_pta/manifest.yml index 601d60a17db..9dc597f7738 100644 --- a/packages/cyberark_pta/manifest.yml +++ b/packages/cyberark_pta/manifest.yml @@ -1,12 +1,13 @@ name: cyberark_pta title: Cyberark Privileged Threat Analytics -version: "1.3.0" +version: "1.6.0" description: Collect security logs from Cyberark PTA integration. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security", "iam"] conditions: - kibana.version: ^7.17.0 || ^8.0.0 + kibana: + version: ^7.17.0 || ^8.0.0 screenshots: - src: /img/cyberarkpta-overview.png title: cyberark pta overview @@ -30,3 +31,4 @@ icons: type: image/svg+xml owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/cyberarkpas/_dev/build/build.yml b/packages/cyberarkpas/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cyberarkpas/_dev/build/build.yml +++ b/packages/cyberarkpas/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cyberarkpas/changelog.yml b/packages/cyberarkpas/changelog.yml index caeb1ad0843..1d01294203c 100644 --- a/packages/cyberarkpas/changelog.yml +++ b/packages/cyberarkpas/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "2.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.14.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7590 +- version: "2.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "2.12.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 - version: "2.11.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-105-add-file-category.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-105-add-file-category.log-expected.json index e02c38e6f6a..0f8a3e22d98 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-105-add-file-category.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-105-add-file-category.log-expected.json @@ -25,7 +25,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", @@ -87,7 +87,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", @@ -154,7 +154,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", @@ -222,7 +222,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", @@ -289,7 +289,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", @@ -357,7 +357,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add file category", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-106-update-file-category.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-106-update-file-category.log-expected.json index 569152b6446..361a3531ba8 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-106-update-file-category.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-106-update-file-category.log-expected.json @@ -25,7 +25,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", @@ -87,7 +87,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", @@ -154,7 +154,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", @@ -222,7 +222,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", @@ -290,7 +290,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", @@ -358,7 +358,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update file category", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-107-delete-file-category.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-107-delete-file-category.log-expected.json index 7b40702fce0..78c98501fac 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-107-delete-file-category.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-107-delete-file-category.log-expected.json @@ -26,7 +26,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file category", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-124-rename-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-124-rename-file.log-expected.json index 013b0a9d42c..04ca26a81c3 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-124-rename-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-124-rename-file.log-expected.json @@ -24,7 +24,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rename file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-125-rename-file-cont.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-125-rename-file-cont.log-expected.json index e1a4b7fccf0..56a4f195d67 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-125-rename-file-cont.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-125-rename-file-cont.log-expected.json @@ -24,7 +24,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rename file (cont.)", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-126-unlock-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-126-unlock-file.log-expected.json index 4dbe94bb1ce..ad43a30be94 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-126-unlock-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-126-unlock-file.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unlock file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-130-cpm-disable-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-130-cpm-disable-password.log-expected.json index e38b8d316e7..545182a8dc2 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-130-cpm-disable-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-130-cpm-disable-password.log-expected.json @@ -43,7 +43,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm disable password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-178-get-user-s-details.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-178-get-user-s-details.log-expected.json index ed41d32ffca..fdf06bb2211 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-178-get-user-s-details.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-178-get-user-s-details.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "get user's details", @@ -26,7 +26,9 @@ "kind": "event", "original": "\u003c7\u003e1 2021-03-11T18:45:23Z VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"raw\":\"\u003csyslog\u003e\\n\\n \u003caudit_record\u003e\\n \u003cRfc5424\u003eyes\u003c/Rfc5424\u003e\\n \u003cTimestamp\u003eMar 11 10:45:23\u003c/Timestamp\u003e\\n \u003cIsoTimestamp\u003e2021-03-11T18:45:23Z\u003c/IsoTimestamp\u003e\\n \u003cHostname\u003eVAULT\u003c/Hostname\u003e\\n \u003cVendor\u003eCyber-Ark\u003c/Vendor\u003e\\n \u003cProduct\u003eVault\u003c/Product\u003e\\n \u003cVersion\u003e11.7.0000\u003c/Version\u003e\\n \u003cMessageID\u003e178\u003c/MessageID\u003e\\n \u003cDesc\u003eGet User's Details\u003c/Desc\u003e\\n \u003cSeverity\u003eError\u003c/Severity\u003e\\n \u003cIssuer\u003eAdministrator\u003c/Issuer\u003e\\n \u003cAction\u003eGet User's Details\u003c/Action\u003e\\n \u003cSourceUser\u003eMaster\u003c/SourceUser\u003e\\n \u003cTargetUser\u003e\u003c/TargetUser\u003e\\n \u003cSafe\u003e\u003c/Safe\u003e\\n \u003cFile\u003e\u003c/File\u003e\\n \u003cStation\u003e127.0.0.1\u003c/Station\u003e\\n \u003cLocation\u003e\u003c/Location\u003e\\n \u003cCategory\u003e\u003c/Category\u003e\\n \u003cRequestId\u003e\u003c/RequestId\u003e\\n \u003cReason\u003e\u003c/Reason\u003e\\n \u003cExtraDetails\u003e\u003c/ExtraDetails\u003e\\n \u003cMessage\u003eGet User's Details\u003c/Message\u003e\\n \u003cGatewayStation\u003e\u003c/GatewayStation\u003e\\n \u003c/audit_record\u003e\\n\\n\u003c/syslog\u003e\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"yes\",\"Timestamp\":\"Mar 11 10:45:23\",\"IsoTimestamp\":\"2021-03-11T18:45:23Z\",\"Hostname\":\"VAULT\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"178\",\"Desc\":\"Get User's Details\",\"Severity\":\"Error\",\"Issuer\":\"Administrator\",\"Action\":\"Get User's Details\",\"SourceUser\":\"Master\",\"TargetUser\":\"\",\"Safe\":\"\",\"File\":\"\",\"Station\":\"127.0.0.1\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Get User's Details\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-180-add-user.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-180-add-user.log-expected.json index 5ab32987fb5..4175669b554 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-180-add-user.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-180-add-user.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -95,7 +95,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -173,7 +173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -251,7 +251,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -329,7 +329,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -407,7 +407,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -485,7 +485,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -564,7 +564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -643,7 +643,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -722,7 +722,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -801,7 +801,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", @@ -880,7 +880,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add user", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-181-update-safe.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-181-update-safe.log-expected.json index d38e04fb5fa..a640a2dbbd3 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-181-update-safe.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-181-update-safe.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update safe", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-185-add-safe.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-185-add-safe.log-expected.json index cb5cb38fb5a..9cf7190a5c7 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-185-add-safe.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-185-add-safe.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add safe", @@ -80,7 +80,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add safe", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-187-add-folder.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-187-add-folder.log-expected.json index ecc0bbdad36..4c7555449f5 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-187-add-folder.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-187-add-folder.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add folder", @@ -85,7 +85,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add folder", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-19-full-gateway-connection.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-19-full-gateway-connection.log-expected.json index 08f794a7030..c2967a10ad9 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-19-full-gateway-connection.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-19-full-gateway-connection.log-expected.json @@ -25,7 +25,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -107,7 +107,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -198,7 +198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -289,7 +289,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -370,7 +370,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -462,7 +462,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -554,7 +554,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -637,7 +637,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", @@ -738,7 +738,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "full gateway connection", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-20-partial-gateway-connection.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-20-partial-gateway-connection.log-expected.json index e2e2ca9b408..2956403cc16 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-20-partial-gateway-connection.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-20-partial-gateway-connection.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "partial gateway connection", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-202-old-backup-files-deletion-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-202-old-backup-files-deletion-start.log-expected.json index 24b61fb6ab0..5c43001cc76 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-202-old-backup-files-deletion-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-202-old-backup-files-deletion-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "old backup files deletion start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-203-old-backup-files-deletion-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-203-old-backup-files-deletion-end.log-expected.json index 77d5065fea8..2c4b500f5e7 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-203-old-backup-files-deletion-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-203-old-backup-files-deletion-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "old backup files deletion end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-22-cpm-verify-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-22-cpm-verify-password.log-expected.json index 43ec5808985..e1322f2fcde 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-22-cpm-verify-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-22-cpm-verify-password.log-expected.json @@ -44,7 +44,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password", @@ -150,7 +150,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-23-action-on-closed-safe.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-23-action-on-closed-safe.log-expected.json index 195c9918778..c86866ee217 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-23-action-on-closed-safe.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-23-action-on-closed-safe.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "action on closed safe", @@ -25,7 +25,9 @@ "kind": "event", "original": "\u003c7\u003e1 2021-03-10T09:11:20Z VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"yes\",\"Timestamp\":\"Mar 10 01:11:20\",\"IsoTimestamp\":\"2021-03-10T09:11:20Z\",\"Hostname\":\"VAULT\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"23\",\"Desc\":\"Action On Closed Safe\",\"Severity\":\"Error\",\"Issuer\":\"Administrator\",\"Action\":\"Action On Closed Safe\",\"SourceUser\":\"\",\"TargetUser\":\"\",\"Safe\":\"PSMPConf\",\"File\":\"\",\"Station\":\"67.43.156.13\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Action On Closed Safe\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" @@ -81,7 +83,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "action on closed safe", @@ -89,7 +91,9 @@ "kind": "event", "original": "\u003c7\u003e1 2021-03-14T12:07:27Z VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"raw\":\"\u003csyslog\u003e\\n\\n \u003caudit_record\u003e\\n \u003cRfc5424\u003eyes\u003c/Rfc5424\u003e\\n \u003cTimestamp\u003eMar 14 05:07:27\u003c/Timestamp\u003e\\n \u003cIsoTimestamp\u003e2021-03-14T12:07:27Z\u003c/IsoTimestamp\u003e\\n \u003cHostname\u003eVAULT\u003c/Hostname\u003e\\n \u003cVendor\u003eCyber-Ark\u003c/Vendor\u003e\\n \u003cProduct\u003eVault\u003c/Product\u003e\\n \u003cVersion\u003e11.7.0000\u003c/Version\u003e\\n \u003cMessageID\u003e23\u003c/MessageID\u003e\\n \u003cDesc\u003eAction On Closed Safe\u003c/Desc\u003e\\n \u003cSeverity\u003eError\u003c/Severity\u003e\\n \u003cIssuer\u003ePasswordManager\u003c/Issuer\u003e\\n \u003cAction\u003eAction On Closed Safe\u003c/Action\u003e\\n \u003cSourceUser\u003e\u003c/SourceUser\u003e\\n \u003cTargetUser\u003e\u003c/TargetUser\u003e\\n \u003cSafe\u003eAccountsFeedADAccounts\u003c/Safe\u003e\\n \u003cFile\u003e\u003c/File\u003e\\n \u003cStation\u003e10.0.1.20\u003c/Station\u003e\\n \u003cLocation\u003e\u003c/Location\u003e\\n \u003cCategory\u003e\u003c/Category\u003e\\n \u003cRequestId\u003e\u003c/RequestId\u003e\\n \u003cReason\u003e\u003c/Reason\u003e\\n \u003cExtraDetails\u003e\u003c/ExtraDetails\u003e\\n \u003cMessage\u003eAction On Closed Safe\u003c/Message\u003e\\n \u003cGatewayStation\u003e\u003c/GatewayStation\u003e\\n \u003c/audit_record\u003e\\n\\n\u003c/syslog\u003e\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"yes\",\"Timestamp\":\"Mar 14 05:07:27\",\"IsoTimestamp\":\"2021-03-14T12:07:27Z\",\"Hostname\":\"VAULT\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"23\",\"Desc\":\"Action On Closed Safe\",\"Severity\":\"Error\",\"Issuer\":\"PasswordManager\",\"Action\":\"Action On Closed Safe\",\"SourceUser\":\"\",\"TargetUser\":\"\",\"Safe\":\"AccountsFeedADAccounts\",\"File\":\"\",\"Station\":\"10.0.1.20\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Action On Closed Safe\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" @@ -136,7 +140,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "action on closed safe", @@ -144,7 +148,9 @@ "kind": "event", "original": "\u003c7\u003e1 2021-03-14T12:57:16Z VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"raw\":\"\u003csyslog\u003e\\n\\n \u003caudit_record\u003e\\n \u003cRfc5424\u003eyes\u003c/Rfc5424\u003e\\n \u003cTimestamp\u003eMar 14 05:57:16\u003c/Timestamp\u003e\\n \u003cIsoTimestamp\u003e2021-03-14T12:57:16Z\u003c/IsoTimestamp\u003e\\n \u003cHostname\u003eVAULT\u003c/Hostname\u003e\\n \u003cVendor\u003eCyber-Ark\u003c/Vendor\u003e\\n \u003cProduct\u003eVault\u003c/Product\u003e\\n \u003cVersion\u003e11.7.0000\u003c/Version\u003e\\n \u003cMessageID\u003e23\u003c/MessageID\u003e\\n \u003cDesc\u003eAction On Closed Safe\u003c/Desc\u003e\\n \u003cSeverity\u003eError\u003c/Severity\u003e\\n \u003cIssuer\u003eAdministrator\u003c/Issuer\u003e\\n \u003cAction\u003eAction On Closed Safe\u003c/Action\u003e\\n \u003cSourceUser\u003e\u003c/SourceUser\u003e\\n \u003cTargetUser\u003e\u003c/TargetUser\u003e\\n \u003cSafe\u003ePSMPConf\u003c/Safe\u003e\\n \u003cFile\u003e\u003c/File\u003e\\n \u003cStation\u003e67.43.156.15\u003c/Station\u003e\\n \u003cLocation\u003e\u003c/Location\u003e\\n \u003cCategory\u003e\u003c/Category\u003e\\n \u003cRequestId\u003e\u003c/RequestId\u003e\\n \u003cReason\u003e\u003c/Reason\u003e\\n \u003cExtraDetails\u003e\u003c/ExtraDetails\u003e\\n \u003cMessage\u003eAction On Closed Safe\u003c/Message\u003e\\n \u003cGatewayStation\u003e\u003c/GatewayStation\u003e\\n \u003c/audit_record\u003e\\n\\n\u003c/syslog\u003e\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"yes\",\"Timestamp\":\"Mar 14 05:57:16\",\"IsoTimestamp\":\"2021-03-14T12:57:16Z\",\"Hostname\":\"VAULT\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"23\",\"Desc\":\"Action On Closed Safe\",\"Severity\":\"Error\",\"Issuer\":\"Administrator\",\"Action\":\"Action On Closed Safe\",\"SourceUser\":\"\",\"TargetUser\":\"\",\"Safe\":\"PSMPConf\",\"File\":\"\",\"Station\":\"67.43.156.15\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Action On Closed Safe\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-24-cpm-change-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-24-cpm-change-password.log-expected.json index e36f42b1b4e..7347183d104 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-24-cpm-change-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-24-cpm-change-password.log-expected.json @@ -42,7 +42,7 @@ "domain": "radiussrv.cyberark.local" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm change password", @@ -136,7 +136,7 @@ "domain": "components" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm change password", @@ -239,7 +239,7 @@ "domain": "components" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm change password", @@ -343,7 +343,7 @@ "domain": "components" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm change password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-259-add-update-group.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-259-add-update-group.log-expected.json index 27e901fe676..37805f3abab 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-259-add-update-group.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-259-add-update-group.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add/update group", @@ -79,7 +79,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add/update group", @@ -141,7 +141,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add/update group", @@ -203,7 +203,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add/update group", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-265-add-group-member.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-265-add-group-member.log-expected.json index 67e938706d8..f1ce112eaec 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-265-add-group-member.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-265-add-group-member.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -81,7 +81,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -144,7 +144,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -207,7 +207,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -270,7 +270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -333,7 +333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -396,7 +396,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -459,7 +459,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -522,7 +522,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -586,7 +586,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -650,7 +650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -714,7 +714,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -778,7 +778,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", @@ -842,7 +842,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add group member", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-266-remove-group-member.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-266-remove-group-member.log-expected.json index 8eb5d2a8bc9..2439e9eb944 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-266-remove-group-member.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-266-remove-group-member.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove group member", @@ -81,7 +81,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove group member", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-273-remove-owner.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-273-remove-owner.log-expected.json index 2add192e59a..2de00e35311 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-273-remove-owner.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-273-remove-owner.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove owner", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-278-add-rule.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-278-add-rule.log-expected.json index 01378fc4aec..31e762a956e 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-278-add-rule.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-278-add-rule.log-expected.json @@ -21,7 +21,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add rule", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-288-auto-clear-users-history-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-288-auto-clear-users-history-start.log-expected.json index 3c06ae827a6..96a125b8a12 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-288-auto-clear-users-history-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-288-auto-clear-users-history-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear users history start", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear users history start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-289-auto-clear-users-history-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-289-auto-clear-users-history-end.log-expected.json index 5ca2de46c46..d49395e629f 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-289-auto-clear-users-history-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-289-auto-clear-users-history-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear users history end", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear users history end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-290-auto-clear-safes-history-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-290-auto-clear-safes-history-start.log-expected.json index eb3f903acd3..3bfb26aa95e 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-290-auto-clear-safes-history-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-290-auto-clear-safes-history-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear safes history start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-291-auto-clear-safes-history-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-291-auto-clear-safes-history-end.log-expected.json index 5aa4a2991f3..85ac7b40590 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-291-auto-clear-safes-history-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-291-auto-clear-safes-history-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "auto clear safes history end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-294-store-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-294-store-password.log-expected.json index 7524ad63ce1..a0d2ad80310 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-294-store-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-294-store-password.log-expected.json @@ -28,7 +28,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -90,7 +90,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -172,7 +172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -239,7 +239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -296,7 +296,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -362,7 +362,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -449,7 +449,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -517,7 +517,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -596,7 +596,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", @@ -674,7 +674,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-295-retrieve-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-295-retrieve-password.log-expected.json index 3bc7bbb2b66..124423ee5bb 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-295-retrieve-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-295-retrieve-password.log-expected.json @@ -36,7 +36,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -134,7 +134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -219,7 +219,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -324,7 +324,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -410,7 +410,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -510,7 +510,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -600,7 +600,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -694,7 +694,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -803,7 +803,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -889,7 +889,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -979,7 +979,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -1073,7 +1073,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", @@ -1169,7 +1169,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-300-psm-connect.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-300-psm-connect.log-expected.json index 22d3cdaa264..748314dcdc3 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-300-psm-connect.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-300-psm-connect.log-expected.json @@ -47,7 +47,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -153,7 +153,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -270,7 +270,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -387,7 +387,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -504,7 +504,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -621,7 +621,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -738,7 +738,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -861,7 +861,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -992,7 +992,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1121,7 +1121,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1250,7 +1250,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1379,7 +1379,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1504,7 +1504,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1629,7 +1629,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1763,7 +1763,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -1897,7 +1897,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", @@ -2031,7 +2031,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm connect", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-302-psm-disconnect.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-302-psm-disconnect.log-expected.json index a80a3501357..cd79005b856 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-302-psm-disconnect.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-302-psm-disconnect.log-expected.json @@ -48,7 +48,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -156,7 +156,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -275,7 +275,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -394,7 +394,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -513,7 +513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -632,7 +632,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -751,7 +751,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -876,7 +876,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1009,7 +1009,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1140,7 +1140,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1271,7 +1271,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1402,7 +1402,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1529,7 +1529,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1656,7 +1656,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1792,7 +1792,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", @@ -1928,7 +1928,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm disconnect", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-304-psm-upload-recording.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-304-psm-upload-recording.log-expected.json index 52f4fbc5642..36d20feb045 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-304-psm-upload-recording.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-304-psm-upload-recording.log-expected.json @@ -31,7 +31,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "psm upload recording", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-308-use-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-308-use-password.log-expected.json index 68730a94baf..c2999df8803 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-308-use-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-308-use-password.log-expected.json @@ -42,7 +42,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -137,7 +137,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -244,7 +244,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -351,7 +351,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -458,7 +458,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -565,7 +565,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -672,7 +672,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -784,7 +784,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -902,7 +902,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -1025,7 +1025,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", @@ -1148,7 +1148,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "use password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-309-undefined-user-logon.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-309-undefined-user-logon.log-expected.json index c86af6d2140..0032852d357 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-309-undefined-user-logon.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-309-undefined-user-logon.log-expected.json @@ -21,7 +21,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", @@ -95,7 +95,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", @@ -165,7 +165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", @@ -254,7 +254,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", @@ -338,7 +338,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-31-cpm-reconcile-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-31-cpm-reconcile-password.log-expected.json index e028d754de9..10e06233a53 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-31-cpm-reconcile-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-31-cpm-reconcile-password.log-expected.json @@ -44,7 +44,7 @@ "domain": "dbserver.cyberark.local" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-310-monitor-dr-replication-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-310-monitor-dr-replication-start.log-expected.json index b4e35d531a4..be12b2c98ad 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-310-monitor-dr-replication-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-310-monitor-dr-replication-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor dr replication start", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor dr replication start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-311-monitor-dr-replication-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-311-monitor-dr-replication-end.log-expected.json index 9d9083857fd..37afce74c1b 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-311-monitor-dr-replication-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-311-monitor-dr-replication-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor dr replication end", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor dr replication end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-316-reset-user-password-detailed-information.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-316-reset-user-password-detailed-information.log-expected.json index 5a2e9666dee..468e0b53b81 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-316-reset-user-password-detailed-information.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-316-reset-user-password-detailed-information.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reset user password detailed information", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-317-reset-user-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-317-reset-user-password.log-expected.json index 31637250768..042d6a45979 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-317-reset-user-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-317-reset-user-password.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reset user password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-32-add-owner.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-32-add-owner.log-expected.json index 6e19aa4f21e..8396c03a882 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-32-add-owner.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-32-add-owner.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -99,7 +99,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -179,7 +179,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -260,7 +260,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -341,7 +341,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -422,7 +422,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -503,7 +503,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -584,7 +584,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -665,7 +665,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -746,7 +746,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -827,7 +827,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -908,7 +908,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -989,7 +989,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -1070,7 +1070,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -1151,7 +1151,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", @@ -1232,7 +1232,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add owner", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-326-cpm-auto-detection-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-326-cpm-auto-detection-start.log-expected.json index ffa23f5555e..96e672fff40 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-326-cpm-auto-detection-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-326-cpm-auto-detection-start.log-expected.json @@ -25,7 +25,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm auto-detection start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-327-cpm-auto-detection-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-327-cpm-auto-detection-end.log-expected.json index db18ce1bc6b..cd6387fbb62 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-327-cpm-auto-detection-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-327-cpm-auto-detection-end.log-expected.json @@ -25,7 +25,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm auto-detection end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-33-update-owner.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-33-update-owner.log-expected.json index 1b3e8a1318b..e2ac8cf0bee 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-33-update-owner.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-33-update-owner.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -99,7 +99,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -180,7 +180,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -261,7 +261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -342,7 +342,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -423,7 +423,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", @@ -505,7 +505,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update owner", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-355-monitor-license-expiration-date-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-355-monitor-license-expiration-date-start.log-expected.json index 40164dcfc08..dd9c2fc8de6 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-355-monitor-license-expiration-date-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-355-monitor-license-expiration-date-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor license expiration date start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-356-monitor-license-expiration-date-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-356-monitor-license-expiration-date-end.log-expected.json index 3f375cf23eb..66357934e40 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-356-monitor-license-expiration-date-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-356-monitor-license-expiration-date-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor license expiration date end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-357-monitor-fw-rules-start.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-357-monitor-fw-rules-start.log-expected.json index fc6ebd701ee..106579466e3 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-357-monitor-fw-rules-start.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-357-monitor-fw-rules-start.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor fw rules start", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor fw rules start", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-358-monitor-fw-rules-end.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-358-monitor-fw-rules-end.log-expected.json index 4097df98121..129ed1f047a 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-358-monitor-fw-rules-end.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-358-monitor-fw-rules-end.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor fw rules end", @@ -66,7 +66,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "monitor fw rules end", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-359-sql-command.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-359-sql-command.log-expected.json index 7fd9f683341..24f3f0a4311 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-359-sql-command.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-359-sql-command.log-expected.json @@ -58,7 +58,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -176,7 +176,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -294,7 +294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -412,7 +412,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -530,7 +530,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -648,7 +648,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -766,7 +766,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -884,7 +884,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -1002,7 +1002,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", @@ -1120,7 +1120,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sql command", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-361-keystroke-logging.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-361-keystroke-logging.log-expected.json index 7743a72c853..edab1b80d75 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-361-keystroke-logging.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-361-keystroke-logging.log-expected.json @@ -50,7 +50,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -164,7 +164,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -295,7 +295,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -426,7 +426,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -557,7 +557,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -693,7 +693,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", @@ -829,7 +829,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-38-cpm-verify-password-failed.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-38-cpm-verify-password-failed.log-expected.json index 7fc31191b49..49e1d73ca86 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-38-cpm-verify-password-failed.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-38-cpm-verify-password-failed.log-expected.json @@ -57,7 +57,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -176,7 +176,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -294,7 +294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -413,7 +413,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -532,7 +532,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -640,7 +640,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -749,7 +749,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -858,7 +858,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -967,7 +967,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1076,7 +1076,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1188,7 +1188,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1300,7 +1300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1412,7 +1412,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1527,7 +1527,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", @@ -1646,7 +1646,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify password failed", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-385-blservice-audit-record.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-385-blservice-audit-record.log-expected.json index 551b49750fe..4dc5b44959a 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-385-blservice-audit-record.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-385-blservice-audit-record.log-expected.json @@ -23,7 +23,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blservice audit record", @@ -86,7 +86,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blservice audit record", @@ -149,7 +149,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blservice audit record", @@ -212,7 +212,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blservice audit record", @@ -275,7 +275,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blservice audit record", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-4-user-authentication.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-4-user-authentication.log-expected.json index e85c4162146..b00ebd67efe 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-4-user-authentication.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-4-user-authentication.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", @@ -96,7 +96,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_failure", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-411-window-title.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-411-window-title.log-expected.json index 8c585f80394..1819af7c1f4 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-411-window-title.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-411-window-title.log-expected.json @@ -56,7 +56,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "window title", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-412-keystroke-logging.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-412-keystroke-logging.log-expected.json index aa37556b3f4..1aca7eefeb6 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-412-keystroke-logging.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-412-keystroke-logging.log-expected.json @@ -57,7 +57,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "keystroke logging", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-414-cpm-verify-ssh-key.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-414-cpm-verify-ssh-key.log-expected.json index 2ede7c7d3b3..c83fc3d163f 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-414-cpm-verify-ssh-key.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-414-cpm-verify-ssh-key.log-expected.json @@ -53,7 +53,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm verify ssh key", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-427-store-ssh-key.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-427-store-ssh-key.log-expected.json index 5f20644bf8a..df406da58ec 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-427-store-ssh-key.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-427-store-ssh-key.log-expected.json @@ -24,7 +24,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store ssh key", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-428-retrieve-ssh-key.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-428-retrieve-ssh-key.log-expected.json index ceee6cf4376..6f7cd9a2ff5 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-428-retrieve-ssh-key.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-428-retrieve-ssh-key.log-expected.json @@ -53,7 +53,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve ssh key", @@ -172,7 +172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve ssh key", @@ -287,7 +287,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve ssh key", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-449-create-discovery-succeeded.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-449-create-discovery-succeeded.log-expected.json index 08409753231..bcf346e40eb 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-449-create-discovery-succeeded.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-449-create-discovery-succeeded.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create discovery succeeded", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-459-general-audit.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-459-general-audit.log-expected.json index a6d92a28331..cc1a48f6ee4 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-459-general-audit.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-459-general-audit.log-expected.json @@ -42,7 +42,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "general audit", @@ -123,7 +123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "general audit", @@ -205,7 +205,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "general audit", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-467-the-component-public-key-for-jwt-authentication-was-updated.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-467-the-component-public-key-for-jwt-authentication-was-updated.log-expected.json index fb9b046b43d..462ed948fc2 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-467-the-component-public-key-for-jwt-authentication-was-updated.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-467-the-component-public-key-for-jwt-authentication-was-updated.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "the component public key for jwt authentication was updated", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-479-security-warning-the-signature-hash-algorithm-of-the-vault-certificate-is-sha1.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-479-security-warning-the-signature-hash-algorithm-of-the-vault-certificate-is-sha1.log-expected.json index 9171e7ac14a..fe1f7a3f2fd 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-479-security-warning-the-signature-hash-algorithm-of-the-vault-certificate-is-sha1.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-479-security-warning-the-signature-hash-algorithm-of-the-vault-certificate-is-sha1.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security warning - the signature hash algorithm of the vault certificate is sha1.", @@ -24,7 +24,9 @@ "kind": "event", "original": "\u003c7\u003e1 2021-03-04T19:10:01Z VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"yes\",\"Timestamp\":\"Mar 04 11:10:01\",\"IsoTimestamp\":\"2021-03-04T19:10:01Z\",\"Hostname\":\"VAULT\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"479\",\"Desc\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"Severity\":\"Error\",\"Issuer\":\"Builtin\",\"Action\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"SourceUser\":\"\",\"TargetUser\":\"\",\"Safe\":\"\",\"File\":\"\",\"Station\":\"0.0.0.0\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" @@ -67,7 +69,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security warning - the signature hash algorithm of the vault certificate is sha1.", @@ -75,7 +77,9 @@ "kind": "event", "original": "Mar 08 07:46:54 VAULT {\"format\":\"elastic\",\"version\":\"1.0\",\"syslog\":{\"audit_record\":{\"Rfc5424\":\"no\",\"Vendor\":\"Cyber-Ark\",\"Product\":\"Vault\",\"Version\":\"11.7.0000\",\"MessageID\":\"479\",\"Desc\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"Severity\":\"Error\",\"Issuer\":\"Builtin\",\"Action\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"SourceUser\":\"\",\"TargetUser\":\"\",\"Safe\":\"\",\"File\":\"\",\"Station\":\"0.0.0.0\",\"Location\":\"\",\"Category\":\"\",\"RequestId\":\"\",\"Reason\":\"\",\"ExtraDetails\":\"\",\"Message\":\"Security warning - The Signature Hash Algorithm of the Vault certificate is SHA1.\",\"GatewayStation\":\"\"}}}", "severity": 7, - "type": "error" + "type": [ + "error" + ] }, "host": { "name": "VAULT" diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-482-update-existing-add-account-bulk-operation-succeeded.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-482-update-existing-add-account-bulk-operation-succeeded.log-expected.json index 544f722ef4b..9a218be6ee4 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-482-update-existing-add-account-bulk-operation-succeeded.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-482-update-existing-add-account-bulk-operation-succeeded.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update existing add account bulk operation succeeded", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-50-store-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-50-store-file.log-expected.json index 29e6a3e9736..6b5957ec1e1 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-50-store-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-50-store-file.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", @@ -75,7 +75,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", @@ -141,7 +141,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", @@ -198,7 +198,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", @@ -265,7 +265,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", @@ -337,7 +337,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "store file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-51-retrieve-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-51-retrieve-file.log-expected.json index 882ccb29025..7afa9976c34 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-51-retrieve-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-51-retrieve-file.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve file", @@ -75,7 +75,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve file", @@ -137,7 +137,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-52-delete-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-52-delete-file.log-expected.json index 077de97397c..f6c29d447de 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-52-delete-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-52-delete-file.log-expected.json @@ -31,7 +31,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -106,7 +106,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -167,7 +167,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -225,7 +225,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -301,7 +301,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -372,7 +372,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -445,7 +445,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -518,7 +518,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -595,7 +595,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", @@ -672,7 +672,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-57-cpm-change-password-failed.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-57-cpm-change-password-failed.log-expected.json index bee66e0fa95..6477366b243 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-57-cpm-change-password-failed.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-57-cpm-change-password-failed.log-expected.json @@ -54,7 +54,7 @@ "domain": "rhel7.cybr.com" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm change password failed", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-59-clear-safe-history.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-59-clear-safe-history.log-expected.json index c9eaebec4bf..ab7f6eaee90 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-59-clear-safe-history.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-59-clear-safe-history.log-expected.json @@ -17,7 +17,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "clear safe history", @@ -68,7 +68,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "clear safe history", @@ -116,7 +116,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "clear safe history", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-60-cpm-reconcile-password-failed.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-60-cpm-reconcile-password-failed.log-expected.json index 0a15fcfc116..f3575b16fd8 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-60-cpm-reconcile-password-failed.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-60-cpm-reconcile-password-failed.log-expected.json @@ -54,7 +54,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -172,7 +172,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -288,7 +288,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -406,7 +406,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -524,7 +524,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -641,7 +641,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -760,7 +760,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -877,7 +877,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", @@ -997,7 +997,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cpm reconcile password failed", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-62-create-file-version.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-62-create-file-version.log-expected.json index d52d85050e1..c3c68d3c368 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-62-create-file-version.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-62-create-file-version.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -84,7 +84,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -150,7 +150,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -216,7 +216,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -283,7 +283,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -341,7 +341,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -413,7 +413,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", @@ -474,7 +474,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create file version", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-7-logon.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-7-logon.log-expected.json index 7270840a835..3a6079ea889 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-7-logon.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-7-logon.log-expected.json @@ -21,7 +21,7 @@ "ip": "10.2.0.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -82,7 +82,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -148,7 +148,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -214,7 +214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -280,7 +280,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -346,7 +346,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -417,7 +417,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -492,7 +492,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -576,7 +576,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -655,7 +655,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -730,7 +730,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -805,7 +805,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-8-logoff.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-8-logoff.log-expected.json index d163c8852a3..f6936777664 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-8-logoff.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-8-logoff.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -82,7 +82,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -148,7 +148,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -214,7 +214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -280,7 +280,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -346,7 +346,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -412,7 +412,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -487,7 +487,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -562,7 +562,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -637,7 +637,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -727,7 +727,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -812,7 +812,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -883,7 +883,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -959,7 +959,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", @@ -1049,7 +1049,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logoff", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-88-set-password.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-88-set-password.log-expected.json index d31fba34085..25a0a18e62a 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-88-set-password.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-88-set-password.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -68,7 +68,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -118,7 +118,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -165,7 +165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -217,7 +217,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -269,7 +269,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -330,7 +330,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -391,7 +391,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -452,7 +452,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -513,7 +513,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -574,7 +574,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -635,7 +635,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -697,7 +697,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -759,7 +759,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -821,7 +821,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -883,7 +883,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -945,7 +945,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", @@ -1007,7 +1007,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "set password", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-98-open-file-write-only.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-98-open-file-write-only.log-expected.json index 56a807159d1..138f8deec04 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-98-open-file-write-only.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-98-open-file-write-only.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open file (write only)", @@ -75,7 +75,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open file (write only)", @@ -141,7 +141,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open file (write only)", @@ -213,7 +213,7 @@ "ip": "10.0.1.20" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open file (write only)", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-99-open-file.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-99-open-file.log-expected.json index 289c7b96c15..8ae0a5aa1b8 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-99-open-file.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-99-open-file.log-expected.json @@ -18,7 +18,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-legacysyslog.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-legacysyslog.log-expected.json index 226ad08d31a..279ae81bac1 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-legacysyslog.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-legacysyslog.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve file", diff --git a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-rfc5424syslog.log-expected.json b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-rfc5424syslog.log-expected.json index 9651d3e332b..02cb9925025 100644 --- a/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-rfc5424syslog.log-expected.json +++ b/packages/cyberarkpas/data_stream/audit/_dev/test/pipeline/test-rfc5424syslog.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -82,7 +82,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", @@ -150,7 +150,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "retrieve file", @@ -205,7 +205,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authentication_success", diff --git a/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 80980880037..24ec6a6d13a 100644 --- a/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cyberarkpas/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: # - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # # Set event.original from message, unless reindexing. @@ -349,7 +349,7 @@ processors: if: 'ctx.cyberarkpas.audit.severity == "Critical"' - set: field: event.type - value: error + value: [error] if: 'ctx.event?.severity > 6' - rename: diff --git a/packages/cyberarkpas/data_stream/audit/sample_event.json b/packages/cyberarkpas/data_stream/audit/sample_event.json index 1caee7cf32d..d9de00f51f0 100644 --- a/packages/cyberarkpas/data_stream/audit/sample_event.json +++ b/packages/cyberarkpas/data_stream/audit/sample_event.json @@ -1,25 +1,23 @@ { - "@timestamp": "2021-03-08T18:07:51.000Z", + "@timestamp": "2021-03-04T17:27:14.000Z", "agent": { - "ephemeral_id": "0c6c824f-931a-418f-9535-22af6210c402", - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "ephemeral_id": "2e1e0d3f-9ac4-4f6a-816b-2b2b7400148a", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.9.1" }, "cyberarkpas": { "audit": { - "action": "Full Gateway Connection", - "desc": "Full Gateway Connection", - "gateway_station": "10.0.1.20", - "iso_timestamp": "2021-03-08T18:07:51Z", - "issuer": "Administrator", - "message": "Full Gateway Connection", + "action": "Logon", + "desc": "Logon", + "iso_timestamp": "2021-03-04T17:27:14Z", + "issuer": "PVWAGWUser", + "message": "Logon", "rfc5424": true, "severity": "Info", - "source_user": "PVWAGWUser", - "station": "127.0.0.1", - "timestamp": "Mar 08 10:07:51" + "station": "10.0.1.20", + "timestamp": "Mar 04 09:27:14" } }, "data_stream": { @@ -27,30 +25,24 @@ "namespace": "ep", "type": "logs" }, - "destination": { - "address": "10.0.1.20", - "ip": "10.0.1.20", - "user": { - "name": "Administrator" - } - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.9.1" }, "event": { - "action": "full gateway connection", + "action": "authentication_success", "agent_id_status": "verified", "category": [ - "network" + "authentication", + "session" ], - "code": "19", + "code": "7", "dataset": "cyberarkpas.audit", - "ingested": "2022-02-03T12:51:00Z", + "ingested": "2023-08-29T14:16:49Z", "kind": "event", "outcome": "success", "severity": 2, @@ -63,19 +55,16 @@ "name": "VAULT" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "source": { - "address": "172.19.0.7:35950" + "address": "172.21.0.4:38370" }, "syslog": { "priority": 5 } }, - "network": { - "direction": "internal" - }, "observer": { "hostname": "VAULT", "product": "Vault", @@ -84,20 +73,15 @@ }, "related": { "ip": [ - "127.0.0.1", "10.0.1.20" ], "user": [ - "PVWAGWUser", - "Administrator" + "PVWAGWUser" ] }, "source": { - "address": "127.0.0.1", - "ip": "127.0.0.1", - "user": { - "name": "PVWAGWUser" - } + "address": "10.0.1.20", + "ip": "10.0.1.20" }, "tags": [ "cyberarkpas-audit", diff --git a/packages/cyberarkpas/docs/README.md b/packages/cyberarkpas/docs/README.md index 6f5906784f8..fb7944c796e 100644 --- a/packages/cyberarkpas/docs/README.md +++ b/packages/cyberarkpas/docs/README.md @@ -32,27 +32,25 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2021-03-08T18:07:51.000Z", + "@timestamp": "2021-03-04T17:27:14.000Z", "agent": { - "ephemeral_id": "0c6c824f-931a-418f-9535-22af6210c402", - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "ephemeral_id": "2e1e0d3f-9ac4-4f6a-816b-2b2b7400148a", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.9.1" }, "cyberarkpas": { "audit": { - "action": "Full Gateway Connection", - "desc": "Full Gateway Connection", - "gateway_station": "10.0.1.20", - "iso_timestamp": "2021-03-08T18:07:51Z", - "issuer": "Administrator", - "message": "Full Gateway Connection", + "action": "Logon", + "desc": "Logon", + "iso_timestamp": "2021-03-04T17:27:14Z", + "issuer": "PVWAGWUser", + "message": "Logon", "rfc5424": true, "severity": "Info", - "source_user": "PVWAGWUser", - "station": "127.0.0.1", - "timestamp": "Mar 08 10:07:51" + "station": "10.0.1.20", + "timestamp": "Mar 04 09:27:14" } }, "data_stream": { @@ -60,30 +58,24 @@ An example event for `audit` looks as following: "namespace": "ep", "type": "logs" }, - "destination": { - "address": "10.0.1.20", - "ip": "10.0.1.20", - "user": { - "name": "Administrator" - } - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.9.1" }, "event": { - "action": "full gateway connection", + "action": "authentication_success", "agent_id_status": "verified", "category": [ - "network" + "authentication", + "session" ], - "code": "19", + "code": "7", "dataset": "cyberarkpas.audit", - "ingested": "2022-02-03T12:51:00Z", + "ingested": "2023-08-29T14:16:49Z", "kind": "event", "outcome": "success", "severity": 2, @@ -96,19 +88,16 @@ An example event for `audit` looks as following: "name": "VAULT" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "source": { - "address": "172.19.0.7:35950" + "address": "172.21.0.4:38370" }, "syslog": { "priority": 5 } }, - "network": { - "direction": "internal" - }, "observer": { "hostname": "VAULT", "product": "Vault", @@ -117,20 +106,15 @@ An example event for `audit` looks as following: }, "related": { "ip": [ - "127.0.0.1", "10.0.1.20" ], "user": [ - "PVWAGWUser", - "Administrator" + "PVWAGWUser" ] }, "source": { - "address": "127.0.0.1", - "ip": "127.0.0.1", - "user": { - "name": "PVWAGWUser" - } + "address": "10.0.1.20", + "ip": "10.0.1.20" }, "tags": [ "cyberarkpas-audit", @@ -243,9 +227,9 @@ An example event for `audit` looks as following: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/cyberarkpas/kibana/dashboard/cyberarkpas-eb12ef60-96f6-11eb-bbf8-d77aef8ad7a6.json b/packages/cyberarkpas/kibana/dashboard/cyberarkpas-eb12ef60-96f6-11eb-bbf8-d77aef8ad7a6.json index b7e1d7eb255..5190873da9c 100644 --- a/packages/cyberarkpas/kibana/dashboard/cyberarkpas-eb12ef60-96f6-11eb-bbf8-d77aef8ad7a6.json +++ b/packages/cyberarkpas/kibana/dashboard/cyberarkpas-eb12ef60-96f6-11eb-bbf8-d77aef8ad7a6.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard for CyberArk Privileged Access Security events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,6 +34,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -59,8 +61,7 @@ { "fieldName": "observer.hostname", "id": "1617726994032", - "indexPattern": "logs-*", - "indexPatternRefName": "control_0_index_pattern", + "indexPatternRefName": "control_1007fa0d-a6a1-4682-a346-a90acc179da5_0_index_pattern", "label": " By Vault host", "options": { "dynamicOptions": true, @@ -75,8 +76,7 @@ { "fieldName": "event.code", "id": "1617811797137", - "indexPattern": "logs-*", - "indexPatternRefName": "control_1_index_pattern", + "indexPatternRefName": "control_1007fa0d-a6a1-4682-a346-a90acc179da5_1_index_pattern", "label": "By event code", "options": { "dynamicOptions": true, @@ -108,108 +108,174 @@ "panelIndex": "1007fa0d-a6a1-4682-a346-a90acc179da5", "title": "Filters", "type": "visualization", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-458a62ba-2bce-4ab1-8d75-8f028536bb8e", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "default_index_pattern": "logs-*", - "default_timefield": "@timestamp", - "filter": { + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "458a62ba-2bce-4ab1-8d75-8f028536bb8e": { + "columnOrder": [ + "a597ad44-9c41-4213-9423-79e2410b5c64", + "82fedc27-d244-492f-8757-8968d908e10b", + "d6d59597-fbb4-4f97-af03-0a586aaf7826" + ], + "columns": { + "82fedc27-d244-492f-8757-8968d908e10b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of cyberarkpas.audit.desc", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cyberarkpas.audit.desc" + }, + "a597ad44-9c41-4213-9423-79e2410b5c64": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d6d59597-fbb4-4f97-af03-0a586aaf7826": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { "language": "kuery", - "query": "data_stream.dataset:\"cyberarkpas.audit\" " + "query": "" }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "hide_in_legend": 0, - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "rainbow", - "params": { - "colors": [ - "#68BC00", - "#009CE0", - "#B0BC00", - "#16A5A5", - "#D33115", - "#E27300", - "#FCC400", - "#7B64FF", - "#FA28FF", - "#333333", - "#808080", - "#194D33", - "#0062B1", - "#808900", - "#0C797D", - "#9F0500", - "#C45100", - "#FB9E00", - "#653294", - "#AB149E", - "#0F1419", - "#666666" - ], - "gradient": false + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d6d59597-fbb4-4f97-af03-0a586aaf7826" + ], + "layerId": "458a62ba-2bce-4ab1-8d75-8f028536bb8e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_color_mode": null, - "split_mode": "terms", - "stacked": "stacked", - "terms_field": "cyberarkpas.audit.desc", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": true + "seriesType": "bar_stacked", + "splitAccessor": "82fedc27-d244-492f-8757-8968d908e10b", + "xAccessor": "a597ad44-9c41-4213-9423-79e2410b5c64", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "d6d59597-fbb4-4f97-af03-0a586aaf7826" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "title": "", - "type": "metrics", - "uiState": {} - } + "title": "event types by time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 13, @@ -220,8 +286,8 @@ }, "panelIndex": "f2dc3750-9b7c-4b0e-a45d-3d3b08f74f3e", "title": "event types by time", - "type": "visualization", - "version": "7.12.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -240,7 +306,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "33bc0096-e418-4f81-9c7c-7fdd16cc5203": { "columnOrder": [ @@ -254,7 +320,7 @@ "label": " ", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -269,12 +335,16 @@ }, "visualization": { "accessor": "eedd5aa8-a7c4-466a-b10b-3a8cba3bac12", - "layerId": "33bc0096-e418-4f81-9c7c-7fdd16cc5203" + "layerId": "33bc0096-e418-4f81-9c7c-7fdd16cc5203", + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -289,7 +359,7 @@ "panelIndex": "af9e9f0b-a40c-411e-b441-2a779983ed24", "title": "Count of events", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -308,7 +378,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "de047c06-a965-47aa-8a15-8b0266d5abc3": { "columnOrder": [ @@ -322,7 +392,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b916e5f5-a64a-49f1-b37a-ee1825fc61a4": { "dataType": "string", @@ -357,14 +427,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b916e5f5-a64a-49f1-b37a-ee1825fc61a4" - ], "layerId": "de047c06-a965-47aa-8a15-8b0266d5abc3", + "layerType": "data", "legendDisplay": "default", - "metric": "3effd03e-0ed9-4e2d-ba8e-d77ae505092e", + "legendSize": "auto", + "metrics": [ + "3effd03e-0ed9-4e2d-ba8e-d77ae505092e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b916e5f5-a64a-49f1-b37a-ee1825fc61a4" + ] } ], "shape": "donut" @@ -387,7 +461,7 @@ "panelIndex": "7031905a-92ab-4e0e-aa58-72f1c07ff409", "title": "Breakdown by outcome", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -416,7 +490,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "19858811-84d1-4f50-901c-dc1451972324": { "columnOrder": [ @@ -447,7 +521,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -463,7 +537,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -484,7 +558,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "event.code", "negate": false, "params": [ @@ -532,19 +606,23 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ + "layerId": "19858811-84d1-4f50-901c-dc1451972324", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "e3526253-18e0-4122-b112-ee5b4b9e23d7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ "81dcff19-b14a-4e4b-999e-dbbcbdfdf816", "81dcff19-b14a-4e4b-999e-dbbcbdfdf816", "81dcff19-b14a-4e4b-999e-dbbcbdfdf816", "81dcff19-b14a-4e4b-999e-dbbcbdfdf816", "81dcff19-b14a-4e4b-999e-dbbcbdfdf816", "81dcff19-b14a-4e4b-999e-dbbcbdfdf816" - ], - "layerId": "19858811-84d1-4f50-901c-dc1451972324", - "legendDisplay": "default", - "metric": "e3526253-18e0-4122-b112-ee5b4b9e23d7", - "nestedLegend": false, - "numberDisplay": "percent" + ] } ], "shape": "donut" @@ -567,7 +645,7 @@ "panelIndex": "a24b9c0c-da95-4016-9fe5-2c0d34005832", "title": "Top 10 user credentials accessed", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -596,7 +674,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "50325938-6a9e-4a26-946e-4468e68c6591": { "columnOrder": [ @@ -630,7 +708,7 @@ "label": "Credentials accessed", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c05a39ad-2983-4f4a-900d-a939ecbda504": { "dataType": "date", @@ -638,6 +716,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -657,7 +736,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -678,7 +757,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "event.code", "negate": false, "params": [ @@ -746,6 +825,7 @@ "a808a872-71b5-4a76-a939-354f68991881" ], "layerId": "50325938-6a9e-4a26-946e-4468e68c6591", + "layerType": "data", "position": "top", "seriesType": "area_stacked", "showGridlines": false, @@ -755,6 +835,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "area_stacked", @@ -783,7 +864,7 @@ "panelIndex": "1dc68cc6-e1b3-43ea-9b0e-f423d194b99a", "title": "Credential access by time", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -807,7 +888,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "105faf70-8330-46b3-a82a-573a383068fa": { "columnOrder": [ @@ -823,7 +904,7 @@ "label": "Authentications", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c51d6847-2fcc-4d13-a44f-49786cb979ed": { "customLabel": true, @@ -875,7 +956,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "event.category", "negate": false, "params": [ @@ -919,6 +1000,7 @@ "c0147524-accc-4dee-a4fc-44199e3459f1" ], "layerId": "105faf70-8330-46b3-a82a-573a383068fa", + "layerType": "data", "palette": { "name": "status", "type": "palette" @@ -932,6 +1014,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right", "showSingleSeries": false }, @@ -961,13 +1044,13 @@ "panelIndex": "c56b3e4d-bfb6-4b06-a62b-282753b85f7a", "title": "Vault Authentication attempts", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"id\":null,\"isAutoSelect\":true},\"id\":\"a3734143-d6e1-4551-b0b1-8282a37e151b\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\"},{\"label\":\"logs-* | Source Point\",\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"geoField\":\"source.geo.location\",\"scalingType\":\"TOP_HITS\",\"topHitsSplitField\":\"source.ip\",\"tooltipProperties\":[\"host.name\",\"source.ip\",\"source.domain\",\"source.geo.country_iso_code\",\"source.as.organization.name\"],\"id\":\"5f2b25a1-01ea-45ca-a4a2-f1a670c3b149\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"filterByMapBounds\":true,\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSize\":22},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"home\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#6092C0\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":8}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"icon\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"2ad8e318-4ef4-4e89-94f2-f37e395c488c\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"VECTOR\",\"joins\":[]},{\"label\":\"logs-* | Destination point\",\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"geoField\":\"destination.geo.location\",\"scalingType\":\"TOP_HITS\",\"topHitsSplitField\":\"destination.ip\",\"tooltipProperties\":[\"host.name\",\"destination.ip\",\"destination.domain\",\"destination.geo.country_iso_code\",\"destination.as.organization.name\"],\"id\":\"bc95f479-964f-4498-be1e-376d34a01b0a\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"filterByMapBounds\":true,\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSize\":35},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#D36086\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":8}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"icon\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"dbb878c8-4039-49f1-b2ff-ab7fb942ba55\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"VECTOR\",\"joins\":[]},{\"label\":\"logs-* | Line\",\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"sourceGeoField\":\"source.geo.location\",\"destGeoField\":\"destination.geo.location\",\"metrics\":[{\"type\":\"count\"},{\"type\":\"sum\",\"field\":\"destination.bytes\"}],\"id\":\"faf6884d-b7cb-41dd-ab86-95970d7c59d2\",\"type\":\"ES_PEW_PEW\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#6092C0\"}},\"lineWidth\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":1,\"maxSize\":8,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"9c450fbf-b009-4b53-9810-2f47ca8dcfa8\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"VECTOR\",\"joins\":[]}]", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"id\":null,\"isAutoSelect\":true,\"lightModeDefault\":\"road_map\"},\"id\":\"a3734143-d6e1-4551-b0b1-8282a37e151b\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"type\":\"EMS_VECTOR_TILE\"},{\"label\":\"logs-* | Source Point\",\"sourceDescriptor\":{\"geoField\":\"source.geo.location\",\"scalingType\":\"TOP_HITS\",\"topHitsSplitField\":\"source.ip\",\"tooltipProperties\":[\"host.name\",\"source.ip\",\"source.domain\",\"source.geo.country_iso_code\",\"source.as.organization.name\"],\"id\":\"5f2b25a1-01ea-45ca-a4a2-f1a670c3b149\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"filterByMapBounds\":true,\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSize\":22,\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"home\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#6092C0\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":8}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"icon\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"2ad8e318-4ef4-4e89-94f2-f37e395c488c\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[]},{\"label\":\"logs-* | Destination point\",\"sourceDescriptor\":{\"geoField\":\"destination.geo.location\",\"scalingType\":\"TOP_HITS\",\"topHitsSplitField\":\"destination.ip\",\"tooltipProperties\":[\"host.name\",\"destination.ip\",\"destination.domain\",\"destination.geo.country_iso_code\",\"destination.as.organization.name\"],\"id\":\"bc95f479-964f-4498-be1e-376d34a01b0a\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"filterByMapBounds\":true,\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSize\":35,\"indexPatternRefName\":\"layer_2_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#D36086\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":8}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"icon\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"dbb878c8-4039-49f1-b2ff-ab7fb942ba55\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[]},{\"label\":\"logs-* | Line\",\"sourceDescriptor\":{\"sourceGeoField\":\"source.geo.location\",\"destGeoField\":\"destination.geo.location\",\"metrics\":[{\"type\":\"count\"},{\"type\":\"sum\",\"field\":\"destination.bytes\"}],\"id\":\"faf6884d-b7cb-41dd-ab86-95970d7c59d2\",\"type\":\"ES_PEW_PEW\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"indexPatternRefName\":\"layer_3_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#6092C0\"}},\"lineWidth\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":1,\"maxSize\":8,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"9c450fbf-b009-4b53-9810-2f47ca8dcfa8\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[]}]", "mapStateJSON": "{\"zoom\":1.24,\"center\":{\"lon\":-49.38072,\"lat\":7.87497},\"timeFilters\":{\"from\":\"now-15w\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" @@ -999,7 +1082,7 @@ "panelIndex": "cd1e20e7-706f-4d02-949c-d9f5908bad67", "title": "Network sources and destinations", "type": "map", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1028,7 +1111,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "028c5c1e-79f9-4999-8438-4889ac2b714c": { "columnOrder": [ @@ -1063,7 +1146,7 @@ "operationType": "count", "params": {}, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1079,7 +1162,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "event.category", "negate": false, "params": { @@ -1100,7 +1183,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "event.outcome", "negate": false, "params": { @@ -1137,6 +1220,7 @@ "f2cd86e2-fb91-48b2-b8dd-e98395d28e00" ], "layerId": "028c5c1e-79f9-4999-8438-4889ac2b714c", + "layerType": "data", "position": "top", "seriesType": "bar_horizontal", "showGridlines": false, @@ -1151,6 +1235,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_horizontal", @@ -1179,7 +1264,7 @@ "panelIndex": "c6305b30-a7e2-4cc3-b49b-db99031f150e", "title": "Top users by failed authentications to Vault", "type": "lens", - "version": "7.12.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1194,9 +1279,10 @@ "y": 49 }, "panelIndex": "96a2c711-40a3-4dfc-87f5-4b193078e05a", - "panelRefName": "panel_9", + "panelRefName": "panel_96a2c711-40a3-4dfc-87f5-4b193078e05a", "title": "Credential Access", - "version": "7.12.0" + "type": "search", + "version": "8.7.1" }, { "embeddableConfig": { @@ -1218,23 +1304,22 @@ "y": 64 }, "panelIndex": "6cd62115-65e7-416f-8da7-96b0d7a9d932", - "panelRefName": "panel_10", + "panelRefName": "panel_6cd62115-65e7-416f-8da7-96b0d7a9d932", "title": "All logs", - "version": "7.12.0" + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs CyberArk PAS] Overview", "version": 1 }, - "coreMigrationVersion": "7.12.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T03:53:08.521Z", "id": "cyberarkpas-eb12ef60-96f6-11eb-bbf8-d77aef8ad7a6", "migrationVersion": { - "dashboard": "7.11.0" + "dashboard": "8.7.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1243,132 +1328,137 @@ }, { "id": "logs-*", - "name": "control_0_index_pattern", + "name": "1007fa0d-a6a1-4682-a346-a90acc179da5:control_1007fa0d-a6a1-4682-a346-a90acc179da5_0_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1007fa0d-a6a1-4682-a346-a90acc179da5:control_1007fa0d-a6a1-4682-a346-a90acc179da5_1_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "control_1_index_pattern", + "name": "f2dc3750-9b7c-4b0e-a45d-3d3b08f74f3e:indexpattern-datasource-layer-458a62ba-2bce-4ab1-8d75-8f028536bb8e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "af9e9f0b-a40c-411e-b441-2a779983ed24:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-33bc0096-e418-4f81-9c7c-7fdd16cc5203", + "name": "af9e9f0b-a40c-411e-b441-2a779983ed24:indexpattern-datasource-layer-33bc0096-e418-4f81-9c7c-7fdd16cc5203", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "7031905a-92ab-4e0e-aa58-72f1c07ff409:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-de047c06-a965-47aa-8a15-8b0266d5abc3", + "name": "7031905a-92ab-4e0e-aa58-72f1c07ff409:indexpattern-datasource-layer-de047c06-a965-47aa-8a15-8b0266d5abc3", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "a24b9c0c-da95-4016-9fe5-2c0d34005832:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-19858811-84d1-4f50-901c-dc1451972324", + "name": "a24b9c0c-da95-4016-9fe5-2c0d34005832:indexpattern-datasource-layer-19858811-84d1-4f50-901c-dc1451972324", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "a24b9c0c-da95-4016-9fe5-2c0d34005832:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-1", + "name": "a24b9c0c-da95-4016-9fe5-2c0d34005832:filter-index-pattern-1", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "1dc68cc6-e1b3-43ea-9b0e-f423d194b99a:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-50325938-6a9e-4a26-946e-4468e68c6591", + "name": "1dc68cc6-e1b3-43ea-9b0e-f423d194b99a:indexpattern-datasource-layer-50325938-6a9e-4a26-946e-4468e68c6591", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "1dc68cc6-e1b3-43ea-9b0e-f423d194b99a:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-1", + "name": "1dc68cc6-e1b3-43ea-9b0e-f423d194b99a:filter-index-pattern-1", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "c56b3e4d-bfb6-4b06-a62b-282753b85f7a:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-105faf70-8330-46b3-a82a-573a383068fa", + "name": "c56b3e4d-bfb6-4b06-a62b-282753b85f7a:indexpattern-datasource-layer-105faf70-8330-46b3-a82a-573a383068fa", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "c56b3e4d-bfb6-4b06-a62b-282753b85f7a:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "layer_1_source_index_pattern", + "name": "cd1e20e7-706f-4d02-949c-d9f5908bad67:layer_1_source_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "layer_2_source_index_pattern", + "name": "cd1e20e7-706f-4d02-949c-d9f5908bad67:layer_2_source_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "layer_3_source_index_pattern", + "name": "cd1e20e7-706f-4d02-949c-d9f5908bad67:layer_3_source_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "c6305b30-a7e2-4cc3-b49b-db99031f150e:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-028c5c1e-79f9-4999-8438-4889ac2b714c", + "name": "c6305b30-a7e2-4cc3-b49b-db99031f150e:indexpattern-datasource-layer-028c5c1e-79f9-4999-8438-4889ac2b714c", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "c6305b30-a7e2-4cc3-b49b-db99031f150e:filter-index-pattern-0", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-1", + "name": "c6305b30-a7e2-4cc3-b49b-db99031f150e:filter-index-pattern-1", "type": "index-pattern" }, { "id": "cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6", - "name": "panel_9", + "name": "96a2c711-40a3-4dfc-87f5-4b193078e05a:panel_96a2c711-40a3-4dfc-87f5-4b193078e05a", "type": "search" }, { "id": "cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6", - "name": "panel_10", + "name": "6cd62115-65e7-416f-8da7-96b0d7a9d932:panel_6cd62115-65e7-416f-8da7-96b0d7a9d932", "type": "search" } ], diff --git a/packages/cyberarkpas/kibana/search/cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6.json b/packages/cyberarkpas/kibana/search/cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6.json index 74daca557b1..c579d2a9879 100644 --- a/packages/cyberarkpas/kibana/search/cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6.json +++ b/packages/cyberarkpas/kibana/search/cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6.json @@ -117,14 +117,12 @@ "title": "Credential Access logs [Logs CyberArk PAS]", "version": 1 }, - "coreMigrationVersion": "7.12.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T03:50:17.631Z", "id": "cyberarkpas-a9b82df0-97a5-11eb-bbf8-d77aef8ad7a6", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/cyberarkpas/kibana/search/cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6.json b/packages/cyberarkpas/kibana/search/cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6.json index e7d2294ff17..1c44adaca83 100644 --- a/packages/cyberarkpas/kibana/search/cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6.json +++ b/packages/cyberarkpas/kibana/search/cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6.json @@ -22,14 +22,12 @@ "title": "All logs [Logs CyberArk PAS]", "version": 1 }, - "coreMigrationVersion": "7.12.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T03:50:17.631Z", "id": "cyberarkpas-fec0d170-96f7-11eb-bbf8-d77aef8ad7a6", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/cyberarkpas/kibana/tags.yml b/packages/cyberarkpas/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/cyberarkpas/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/cyberarkpas/manifest.yml b/packages/cyberarkpas/manifest.yml index 616f7ddf34c..6c8fca8b520 100644 --- a/packages/cyberarkpas/manifest.yml +++ b/packages/cyberarkpas/manifest.yml @@ -1,14 +1,12 @@ name: cyberarkpas title: CyberArk Privileged Access Security -version: "2.11.0" -release: ga +version: "2.15.0" description: Collect logs from CyberArk Privileged Access Security with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: ["security", "iam"] conditions: - kibana.version: ^7.16.0 || ^8.0.0 + kibana.version: ^8.7.1 screenshots: - src: /img/filebeat-cyberarkpas-overview.png title: filebeat cyberarkpas overview diff --git a/packages/cylance/_dev/build/build.yml b/packages/cylance/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/cylance/_dev/build/build.yml +++ b/packages/cylance/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/cylance/changelog.yml b/packages/cylance/changelog.yml index a413e278fc4..d72a0d7eb00 100644 --- a/packages/cylance/changelog.yml +++ b/packages/cylance/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "0.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/cylance/data_stream/protect/_dev/test/pipeline/test-generated.log-expected.json b/packages/cylance/data_stream/protect/_dev/test/pipeline/test-generated.log-expected.json index 7567ab9466c..a0de9b33b88 100644 --- a/packages/cylance/data_stream/protect/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/cylance/data_stream/protect/_dev/test/pipeline/test-generated.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "29-January-2016 06:09:59 high boNemoe4402.www.invalid dolore \u003c\u003csequa\u003eabo 2016-1-29T6:09:59.squira nostrud4819.mail.test CylancePROTECT mqui nci [billoi] Event Type: AuditLog, Event Name: ZoneAdd, Message: Policy Assigned:orev; Devices: pisciv , User: uii umexe (estlabo)", "tags": [ @@ -11,7 +11,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-2-12T1:12:33.olupt volup208.invalid CylancePROTECT eosquir orsi [nulapari] Event Type: AuditLog, Event Name: LoginSuccess, Message: Devices: vol, User: luptat isiutal (moenimi)", "tags": [ @@ -20,7 +20,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "26-Feb-2016 8:15:08 very-high anonnu410.internal.home aqu \u003c\u003cutper\u003esquame 26T20:15:08.ntex eius6159.www5.localhost CylancePROTECT Event Name:Alert, Device Message: Device: aer User: ),lupt (tia oloremqu Zone Names: temvel Device Id: iatu", "tags": [ @@ -29,7 +29,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-3-12T3:17:42.ceroinBC ratvolup497.www.corp CylancePROTECT ionofde con [uia] Event Type: AuditLog, Event Name: SystemSecurity, Message: ommodic, User: mipsu consec (taliquip)", "tags": [ @@ -38,7 +38,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-3-26T10:20:16.gelit tatno5625.api.local CylancePROTECT taev roidents [oluptas] Event Type: AuditLog, Event Name: Alert, Message: Source: taliqu; SHA256: ommod; Reason: failure, User: tur aperi (iveli)", "tags": [ @@ -47,7 +47,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "uatDuis 2016-4-9T5:22:51.ude maveniam1399.mail.lan CylancePROTECT siutaliq exercit [tempor] Event Type: omnis, Event Name: SystemSecurity, Device Name: eip, Agent Version: lupta, IP Address: (10.124.61.119), MAC Address: (01:00:5e:dc:bb:8b), Logged On Users: (occ), OS: ect Zone Names: reetdolo", "tags": [ @@ -56,7 +56,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "24-Apr-2016 12:25:25 low lor340.mail.local natura \u003c\u003caboris\u003eima 24T00:25:25.tanimi nimadmin6499.local CylancePROTECT Event Name:Device Policy Assigned, Device Message: Device: dexe User: ),urerep (aquaeab liqu Zone Names: lorem Device Id: emq", "tags": [ @@ -65,7 +65,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ari 2016-5-8T7:27:59.equun suntinc4934.www5.test CylancePROTECT ipis gelits [tatevel] Event Type: AuditLog, Event Name: ThreatUpdated, Message: Policy: uptatev; SHA256: uovol, User: )dmi (olab mquisnos", "tags": [ @@ -74,7 +74,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "22-May-2016 14:30:33 medium tvol457.internal.local inim \u003c\u003cema\u003eroinBCSe 2016-5-22T2:30:33.onse tae1382.mail.localhost CylancePROTECT oluptate ofdeF tion Event Type: orsitame, Event Name: threat_quarantined, Threat Class: lit, Threat Subclass: iam, SHA256: qua, MD5: umdo", "tags": [ @@ -83,7 +83,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-6-5T9:33:08.eniam reetdolo2451.www.example CylancePROTECT rumet oll [erc] Event Type: ScriptControl, Event Name: SystemSecurity, Device Name: llam, File Path: aspern, Interpreter: itlabori, Interpreter Version: 1.2344, Zone Names: ollit, User Name: usan", "tags": [ @@ -92,7 +92,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "olo 2016-6-20T4:35:42.uaera sitas4259.mail.corp CylancePROTECT atquovo iumto aboreetd Event Type: AuditLog, Event Name: ZoneAddDevice, Message: Zone: dun; Policy: enim; Value: saute, User: vel quu (undeo)", "tags": [ @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-7-4T11:38:16.isqu uis7612.www5.domain CylancePROTECT llumquid tation [ips] Event Type: emeumfug, Event Name: Registration, emporinc", "tags": [ @@ -110,7 +110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "cup 2016-7-18T6:40:50.boNemoen uid7309.api.domain CylancePROTECT uradi aborumSe luptat Event Type: AuditLog, Event Name: SyslogSettingsSave, Message: Policy: antiumto, User: strude ctetura (usmod)", "tags": [ @@ -119,7 +119,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2-Aug-2016 1:43:25 high fugit7668.www5.invalid lupt \u003c\u003cxea\u003equa 2T01:43:25.luptatev admi3749.api.lan CylancePROTECT Event Name:DeviceRemove, Device Message: Device: tinvol; Zones Removed: dolore; Zones Added: abor, User: iqui etc (etM), Zone Names:nimadmin Device Id: ditautfu", "tags": [ @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-8-16T8:45:59.ostr rudexerc703.internal.host CylancePROTECT itaut imaven [liqua] Event Type: ScriptControl, Event Name: fullaccess, Device Name: onproide, File Path: Nemoen, Interpreter: tfug, Interpreter Version: 1.5383 (ccu), Zone Names: urE, User Name: isaute", "tags": [ @@ -137,7 +137,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "eomnisis 2016-8-30T3:48:33.mqui civeli370.www5.local CylancePROTECT sunt stl tdolorem Event Type: AuditLog, Event Name: Alert, Message: The Device: picia was auto assigned to the Zone: IP Address: Fake Devices, User: mUtenima emaperi ()tame", "tags": [ @@ -146,7 +146,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 2016/09/13 22:51:07 ivelits712.api.example CylancePROTECT Event Type: AppControl, etdolo inv [agnaali] Event Type: AppControl, Event Name: threat_found, Device Name: sequatur, IP Address: (10.199.98.186), Action: cancel, Action Type: nihi, File Path: Lor, SHA256: itecto, Zone Names: erc", "tags": [ @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "olupt 2016-9-28T5:53:42.modoco estqu1709.internal.example CylancePROTECT ostrume molest [upt] Event Type: Threat, Event Name: LoginSuccess, Device Name: uasia, IP Address: (10.64.70.5), File Name: ici, Path: giatquov, Drive Type: eritquii, SHA256: dexeac, MD5: iscinge, Status: atvol, Cylance Score: 145.898000, Found Date: uames, File Type: tati, Is Running: utaliqu, Auto Run: oriosamn, Detected By: deFinibu, Zone Names: iadese, Is Malware: imidest, Is Unique To Cylance: emagnama, Threat Classification: eprehend", "tags": [ @@ -164,7 +164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2016-10-12T12:56:16.suntinc xeac7155.www.localdomain CylancePROTECT taliq intoccae [ents] Event Type: pida, Event Name: Alert, Device Name: idolor, Agent Version: emeumfu, IP Address: (10.143.239.210), MAC Address: (01:00:5e:93:1c:9f), Logged On Users: (oinBCSe), OS: mnisist Zone Names: sedd", "tags": [ @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ipitla 2016-10-26T7:58:50.quae maccusa5126.api.domain CylancePROTECT idex xerci [aqu] Event Type: ExploitAttempt, Event Name: Alert, Device Name: olorema, IP Address: (10.32.143.134), Action: accept, Process ID: 2289, Process Name: aliqu.exe, User Name: olupta, Violation Type: mipsumd, Zone Names: eFinib", "tags": [ @@ -182,7 +182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10-Nov-2016 3:01:24 low eav3687.internal.local siar \u003c\u003corev\u003eiamquis 10T03:01:24.quirat llu4718.localhost CylancePROTECT Event Name:DeviceEdit, Device Name:conseq, External Device Type:oidentsu, External Device Vendor ID:atiset, External Device Name:atu, External Device Product ID:umexerci, External Device Serial Number:ern, Zone Names:psaquae", "tags": [ @@ -191,7 +191,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Nov 24 10:03:59 doloremi7402.www.test CylancePROTECT Event Type:stquidol, Event Name:DeviceRemove, Device Message: Device: leumiu; Policy Changed: namali to 'taevit', User: rinrepre etconse (tincu), Zone Names:ari, Device Id: exercit", "tags": [ @@ -200,7 +200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "8-December-2016 17:06:33 very-high occae1180.internal.localhost aquaeabi \u003c\u003clita\u003eadeseru 2016-12-8T5:06:33.emoe eaq908.api.home CylancePROTECT itame intoc [oluptas] Event Type: tNequepo, Event Name: ZoneAddDevice, Device Name: luptasn, Zone Names:equat", "tags": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ihilmole 2016-12-23T12:09:07.eriamea amre146.mail.host CylancePROTECT pisciv iquidex radipisc Event Type: AuditLog, Event Name: ZoneAddDevice, Message: Policy: nti; SHA256: abi; Category: sectetur, User: )uioffi (oru temqu", "tags": [ @@ -218,7 +218,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ommodico 2017-1-6T7:11:41.quatD mcolab379.internal.home CylancePROTECT tsedqu agnid [proide] Event Type: ScriptControl, Event Name: DeviceRemove, Device Name: tper, File Path: olor, Interpreter: Neque, Interpreter Version: 1.4129 (xerc), Zone Names: iutali, User Name: fdeFi", "tags": [ @@ -227,7 +227,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Jan 20 2:14:16 tasuntex5037.www.corp CylancePROTECT Event Type:boN, Event Name:threat_quarantined, Device Name:ectio, Agent Version:dutper, IP Address: (10.237.205.140), MAC Address: (01:00:5e:3f:c4:6c), Logged On Users: (uames), OS:iduntu, Zone Names:veniam", "tags": [ @@ -236,7 +236,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "3-Feb-2017 9:16:50 very-high reme622.mail.example isnisiu \u003c\u003cbore\u003etsu 3T21:16:50.tcons sciun4694.api.lan CylancePROTECT Event Name:LoginSuccess, Device Message: Device: nsect User: ),idata (rumwritt magnid Zone Names: enderit Device Id: untex", "tags": [ @@ -245,7 +245,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "paquioff 2017-2-18T4:19:24.mquisnos maven3758.www.invalid CylancePROTECT labor didunt uptatema Event Type: ExploitAttempt, Event Name: DeviceEdit, Device Name: udan, IP Address: (10.74.104.215), Action: cancel, Process ID: 7410, Process Name: mveleu.exe, User Name: nofdeFin, Violation Type: sequam, Zone Names: temvel", "tags": [ @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "4-Mar-2017 11:21:59 medium tvolu3997.mail.home eiu \u003c\u003cntiumdo\u003eautfu 4T11:21:59.gnaaliq mni7200.mail.localdomain CylancePROTECT Event Name:pechange, Device Name:idolor, Zone Names:uisau, Device Id: eleum", "tags": [ @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Mar 18 6:24:33 ate4627.localdomain CylancePROTECT Event Type:officiad, Event Name:Device Policy Assigned, Message: The Device:quinescwas auto assigned to Zone:madmi, User:tur", "tags": [ @@ -272,7 +272,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2-April-2017 01:27:07 very-high orem6702.invalid tev \u003c\u003csaute\u003entocca 2017-4-2T1:27:07.ostru ntoccae1705.internal.invalid CylancePROTECT temquiav equatu [upta] Event Type: ScriptControl, Event Name: Alert, Device Name: sBon, File Path: orro, Interpreter: tae, Interpreter Version: 1.3212, Zone Names: tlab, User Name: aperiame", "tags": [ @@ -281,7 +281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "16-Apr-2017 8:29:41 high tobea2364.internal.localhost itinvol \u003c\u003ceavolup\u003efugiatn 16T08:29:41.docon etconsec6708.internal.invalid CylancePROTECT Event Name:PolicyAdd, Device Name:ersp, External Device Type:tquov, External Device Vendor ID:diconseq, External Device Name:inven, External Device Product ID:osquira, External Device Serial Number:tes, Zone Names:mquame", "tags": [ @@ -290,7 +290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-4-30T3:32:16.squirati Sedutp7428.internal.home CylancePROTECT utlabor itessequ [porro] Event Type: AuditLog, Event Name: PolicyAdd, Message: Zone: iquipe; Policy: itempor; Value: quin, User: upida tvolupt (eufugi)", "tags": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "uamni 2017-5-14T10:34:50.ctet ati4639.www5.home CylancePROTECT archite loreme [untu] Event Type: AuditLog, Event Name: Alert, Message: Device: ven; User: con nisist (usmodte)", "tags": [ @@ -308,7 +308,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-5-29T5:37:24.eturadi torever662.www5.home CylancePROTECT quam sumdolor [meaqueip] Event Type: AuditLog, Event Name: PolicyAdd, Message: The Device: pexe was auto assigned to the Zone: IP Address: 10.70.168.240, User: amcol adeser ()oin", "tags": [ @@ -317,7 +317,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "12-June-2017 12:39:58 medium meius3932.internal.example ccaeca \u003c\u003cumdolo\u003euptate 2017-6-12T12:39:58.amc cusant1701.api.localdomain CylancePROTECT siutaliq dutp psaquaea Event Type: taevita, Event Name: DeviceRemove, Device Name: siut, Agent Version: tconsect, IP Address: (10.190.175.158), MAC Address: (01:00:5e:45:8b:97), Logged On Users: (ditemp), OS: edqui", "tags": [ @@ -326,7 +326,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "26-June-2017 19:42:33 very-high rnatu2805.www.home enderi \u003c\u003cmquisno\u003eodoconse 2017-6-26T7:42:33.quamqua eacommod1930.internal.lan CylancePROTECT tpersp stla uptatema Event Type: AuditLog, Event Name: fullaccess, Message: Device: uradi; SHA256: tot; Category: llamco, User: )nea (psum tasnulap", "tags": [ @@ -335,7 +335,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-7-11T2:45:07.oremipsu emeumfug4387.internal.lan CylancePROTECT uidol litani [utodita] Event Type: AuditLog, Event Name: Alert, Message: Device: untincul; SHA256: iduntu, User: )ccaeca (niamq lapariat", "tags": [ @@ -344,7 +344,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "uat 2017-7-25T9:47:41.tiaec rumwrit764.www5.local CylancePROTECT edquiac urerepr [eseru] Event Type: DeviceControl, Event Name: DeviceRemove, Device Name: etMal, External Device Type: qua, External Device Vendor ID: rsita, External Device Name: ate, External Device Product ID: ipsamvo, External Device Serial Number: onula, Zone Names: miu", "tags": [ @@ -353,7 +353,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Aug 8 4:50:15 mex2054.mail.corp CylancePROTECT Event Type:luptat, Event Name:SyslogSettingsSave, Message: Provider:ica, Source IP:10.13.66.97, User: dicta taedicta (ritt)#015", "tags": [ @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-8-22T11:52:50.dictasun veniamqu7284.mail.invalid CylancePROTECT nte mvel nof Event Type: AuditLog, Event Name: DeviceEdit, Message: The Device: tetur was auto assigned to the Zone: IP Address: Fake Devices, User: ()xce", "tags": [ @@ -371,7 +371,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "6-September-2017 06:55:24 high isiu5733.api.domain etdolor \u003c\u003clupta\u003exeaco 2017-9-6T6:55:24.nvolupt oremi1485.api.localhost CylancePROTECT iosa boNemoe [onsequ] Event Type: AuditLog, Event Name: threat_quarantined, Message: SHA256: amvolupt; Reason: success, User: atisund xea (ites)", "tags": [ @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "eri 2017-9-20T1:57:58.quunt olori416.api.test CylancePROTECT elit cidunt plica Event Type: ExploitAttempt, Event Name: Alert, Device Name: exeaco, IP Address: (10.31.190.145), Action: cancel, Process ID: 5530, Process Name: accusant.exe, User Name: onse, Violation Type: admin, Zone Names: stenatu", "tags": [ @@ -389,7 +389,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "4-Oct-2017 9:00:32 high nvol6269.internal.local tla \u003c\u003citem\u003enimid 4T21:00:32.dat periam126.api.host CylancePROTECT Event Name:threat_found, Threat Class:rExc, Threat Subclass:iusmo, SHA256:tame, MD5:naaliq", "tags": [ @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "19-October-2017 04:03:07 medium toccaec7645.www5.home psaqua \u003c\u003cullamcor\u003eitationu 2017-10-19T4:03:07.proident maliquam2147.internal.home CylancePROTECT lores ritati orisni Event Type: DeviceControl, Event Name: PolicyAdd, Device Name: estl, External Device Type: sitam, External Device Vendor ID: orem, External Device Name: rcit, External Device Product ID: llamco, External Device Serial Number: atu, Zone Names: untincul", "tags": [ @@ -407,7 +407,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "iuntNe 2017-11-2T11:05:41.atise tate6578.api.localdomain CylancePROTECT emvele isnost [olorem] Event Type: Threat, Event Name: PolicyAdd, Device Name: yCiceroi, IP Address: (10.252.165.146), File Name: iquamqua, Path: sit, Drive Type: rumSect, SHA256: ita, MD5: vitaed, Status: exeaco, Cylance Score: 51.523000, Found Date: mven, File Type: olorsit, Is Running: tore, Auto Run: elits, Detected By: consequa, Zone Names: turadip, Is Malware: tatevel, Is Unique To Cylance: boreetdo, Threat Classification: undeom", "tags": [ @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-11-16T6:08:15.uov itlab6956.mail.local CylancePROTECT loremqu tetur amvo Event Type: siuta, Event Name: threat_changed, Device Name: ommodo, Agent Version: uptat, IP Address: (10.105.46.101, tatione), MAC Address: (01:00:5e:de:32:2c, ori), Logged On Users: (tconsect), OS: rum", "tags": [ @@ -425,7 +425,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-12-1T1:10:49.ugiatn midestl1919.host CylancePROTECT cingel modocon [ipsu] Event Type: ntNeq, Event Name: Device Policy Assigned, Device Name: aUt, Agent Version: boNem, IP Address: (10.124.88.222), MAC Address: (01:00:5e:f9:78:c2), Logged On Users: (onu), OS: liquaUte", "tags": [ @@ -434,7 +434,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ria 2017-12-15T8:13:24.atDu nsec923.internal.local CylancePROTECT agnaaliq tlaboree norumet Event Type: ExploitAttempt, Event Name: DeviceEdit, Device Name: mod, IP Address: (10.28.120.149), Action: deny, Process ID: 3916, Process Name: tinvolup.exe, User Name: tsed, Violation Type: inv, Zone Names: rroq", "tags": [ @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2017-12-29T3:15:58.mipsamvo eiusmod3517.internal.invalid CylancePROTECT oreveri ehende [eaqueip] Event Type: AuditLog, Event Name: ZoneAddDevice, Message: Device: olup; SHA256: labor, User: )dol (sciun metcons", "tags": [ @@ -452,7 +452,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "12-January-2018 22:18:32 high asnu3806.api.lan tamet \u003c\u003cperspici\u003eationul 2018/01/12T22:18:32.mquisn queips4947.mail.example CylancePROTECT molestia quir eavolup Event Type: AppControl, Event Name: Registration, Device Name: labore, IP Address: (10.165.16.231), Action: accept, Action Type: uto, File Path: iuntNequ, SHA256: esseq, Zone Names: aincidun", "tags": [ @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "27-January-2018 05:21:06 low oloreseo5039.test derit \u003c\u003corese\u003edolor 2018-1-27T5:21:06.econs ntexpl3889.www.home CylancePROTECT yCic nder [mdolore] Event Type: Cic, Event Name: DeviceRemove, Device Name: saqu, Agent Version: iscive, IP Address: (10.156.34.19), MAC Address: (01:00:5e:54:ab:3f), Logged On Users: (imveni), OS: ariaturE Zone Names: stquid", "tags": [ @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ree 2018-2-10T12:23:41.saquaea ation6657.www.home CylancePROTECT iatqu lorsi repreh Event Type: AuditLog, Event Name: Registration, Message: sitamet, User: utlabo tetur (tionula)", "tags": [ @@ -479,7 +479,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "24-Feb-2018 7:26:15 very-high idolor3916.www5.home tas \u003c\u003cautfugi\u003etasun 24T19:26:15.duntutla ntium4450.www5.localdomain CylancePROTECT Event Name:DeviceRemove, Device Name:vol, Agent Version:oremquel, IP Address: (10.22.94.10), MAC Address: (01:00:5e:ee:e8:77), Logged On Users: (ssusci), OS:animid, Zone Names:mpo", "tags": [ @@ -488,7 +488,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "llam 2018-3-11T2:28:49.cti aparia1179.www.localdomain CylancePROTECT rever ore offici Event Type: AuditLog, Event Name: DeviceEdit, Message: Devices: metco, User: acom ceroinB (nim)", "tags": [ @@ -497,7 +497,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "25-March-2018 09:31:24 medium taliqui5348.mail.localdomain loremag \u003c\u003ctcu\u003eiatqu 2018-3-25T9:31:24.inBCSedu erspi5757.local CylancePROTECT suntex iacons [occaec] Event Type: DeviceControl, Event Name: LoginSuccess, Device Name: uov, External Device Type: quaeab, External Device Vendor ID: fici, External Device Name: imve, External Device Product ID: quide, External Device Serial Number: quaU, Zone Names: undeomni", "tags": [ @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "liquid 2018-4-8T4:33:58.enim Finibus1411.www5.corp CylancePROTECT xea taed umdolo Event Type: AuditLog, Event Name: fullaccess, Message: Policy Assigned:rroqu; Devices: dquiaco , User: nibus vitaed (ser)", "tags": [ @@ -515,7 +515,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Apr 22 11:36:32 upt7879.www5.example CylancePROTECT Event Type:idolo, Event Name:threat_found, Device Message: Device: edolo; Zones Removed: ugiatquo; Zones Added: ntium, User: uptate lloinven (econs), Zone Names:lmolesti Device Id: apariatu", "tags": [ @@ -524,7 +524,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 2018/05/07 06:39:06 erspi4926.www5.test CylancePROTECT Event Type: AppControl, incidid quin [autemv] Event Type: AppControl, Event Name: PolicyAdd, Device Name: fugits, IP Address: (10.153.34.43), Action: allow, Action Type: acommo, File Path: isi, SHA256: culpaq, Zone Names: saute", "tags": [ @@ -533,7 +533,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2018-5-21T1:41:41.abor magnid3343.home CylancePROTECT tesseq niam [pernat] Event Type: DeviceControl, Event Name: threat_found, Device Name: gitse, External Device Type: ugitse, External Device Vendor ID: quiineav, External Device Name: billoinv, External Device Product ID: sci, External Device Serial Number: col, Zone Names: obea", "tags": [ @@ -542,7 +542,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "4-Jun-2018 8:44:15 high uptatem4483.localhost inrepr \u003c\u003cmol\u003eumdolors 4T20:44:15.dolori asperna7623.www.home CylancePROTECT Event Name:ThreatUpdated, Message: Device:dexewas auto assigned to Zone:tat, User:onproide", "tags": [ @@ -551,7 +551,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "riosa 2018-6-19T3:46:49.tNe pisc3553.internal.home CylancePROTECT rautod olest eataev Event Type: ExploitAttempt, Event Name: DeviceEdit, Device Name: ritati, IP Address: (10.43.110.203), Action: allow, Process ID: 1359, Process Name: nim.exe, User Name: ame, Violation Type: amvolu, Zone Names: mip", "tags": [ @@ -560,7 +560,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "3-July-2018 10:49:23 medium iame4937.local tiumd \u003c\u003cntmoll\u003emexer 2018/07/03T10:49:23.estla uipexe7153.api.corp CylancePROTECT saqu remips illoi Event Type: AppControl, Event Name: ZoneAdd, Device Name: abori, IP Address: (10.127.20.244), Action: block, Action Type: uelauda, File Path: ema, SHA256: odi, Zone Names: ptatems", "tags": [ @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "nde 2018-7-17T5:51:58.abillo undeom845.www5.example CylancePROTECT quaer eetdo [tlab] Event Type: ScriptControl, Event Name: LoginSuccess, Device Name: liq, File Path: seddoeiu, Interpreter: nse, Interpreter Version: 1.3421, Zone Names: quira, User Name: tassita", "tags": [ @@ -578,7 +578,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Aug 1 12:54:32 atis6201.internal.invalid CylancePROTECT Event Type:nisiut, Event Name:threat_changed, Message: Device:quirawas auto assigned to Zone:rror, User:tatema", "tags": [ @@ -587,7 +587,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "15-August-2018 07:57:06 low tperspic7591.www.lan ict \u003c\u003csquirati\u003etem 2018-8-15T7:57:06.mestq ura675.mail.localdomain CylancePROTECT eleumiu uei Nequepo Event Type: DeviceControl, Event Name: DeviceRemove, Device Name: seddo, External Device Type: uam, External Device Vendor ID: orumSec, External Device Name: nisiuta, External Device Product ID: stiaecon, External Device Serial Number: dol, Zone Names: sumquiad", "tags": [ @@ -596,7 +596,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "29-August-2018 14:59:40 high oeni179.api.localhost gna \u003c\u003cisiutali\u003elumqu 2018-8-29T2:59:40.onulamco ons5050.mail.test CylancePROTECT unt tass [tiumdol] Event Type: Threat, Event Name: threat_quarantined, Device Name: mquiad, IP Address: (10.48.209.115), File Name: psa, Path: nculpaq, Drive Type: reseosqu, SHA256: sequat, MD5: lor, Status: ccaec, Cylance Score: 75.498000, Found Date: ommo, File Type: iame, Is Running: laudanti, Auto Run: umiurer, Detected By: rere, Zone Names: cta, Is Malware: aevi, Is Unique To Cylance: uameiusm, Threat Classification: adm", "tags": [ @@ -605,7 +605,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "12-September-2018 22:02:15 medium mnihilm1903.internal.host ditautf \u003c\u003citametc\u003eori 2018-9-12T10:02:15.uamqu olori4584.mail.domain CylancePROTECT sunt autfugit emUte Event Type: AuditLog, Event Name: ThreatUpdated, Message: Zone: nturmag; Policy: tura; Value: osquirat, User: equat aliquid (usantiu)", "tags": [ @@ -614,7 +614,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "27-Sep-2018 5:04:49 very-high trudex4443.www5.localhost lor \u003c\u003cxplic\u003eeseruntm 27T05:04:49.lpaquiof oloreeu7597.mail.home CylancePROTECT Event Name:PolicyAdd, Device Name:nula, Agent Version:quiacons, IP Address: (10.7.99.47), MAC Address: (01:00:5e:e8:41:ae), Logged On Users: (evolupta), OS:teturadi, Zone Names:ditau", "tags": [ @@ -623,7 +623,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "hend 2018-10-11T12:07:23.eacommo ueip5847.api.test CylancePROTECT umd sciveli [dolorem] Event Type: sed, Event Name: Device Updated, Threat Class: Nemoenim, Threat Subclass: usm, SHA256: labori, MD5: porai", "tags": [ @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "ostr 2018-10-25T7:09:57.sec uid3520.www.home CylancePROTECT eFini ectob [mrema] Event Type: ScriptControl, Event Name: SystemSecurity, Device Name: prehend, File Path: eufug, Interpreter: roquisq, Interpreter Version: 1.989 (est), Zone Names: civelits, User Name: ici", "tags": [ @@ -641,7 +641,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Nov 9 2:12:32 miurerep3693.mail.localhost CylancePROTECT Event Type:iduntu, Event Name:SyslogSettingsSave, Device Name:inibusB, Zone Names:nostrud", "tags": [ @@ -650,7 +650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Nov 23 9:15:06 esse3795.www.host CylancePROTECT Event Type:pariatur, Event Name:SyslogSettingsSave, Message: The Device:imaveniawas auto assigned to Zone:expli, User:ugiat", "tags": [ @@ -659,7 +659,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "bore 2018-12-7T4:17:40.ptate teir7585.www5.localdomain CylancePROTECT quu xeac [llitanim] Event Type: AuditLog, Event Name: SystemSecurity, Message: Devices: oreverit, User: scip Finibus (Utenimad)", "tags": [ @@ -668,7 +668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Dec 21 11:20:14 hen1901.example CylancePROTECT Event Type:ali, Event Name:SyslogSettingsSave, Device Name:quunt, External Device Type:itasp, External Device Vendor ID:qui, External Device Name:equeporr, External Device Product ID:met, External Device Serial Number:volup, Zone Names:ptate, Device Id: entsu, Policy Name: conse", "tags": [ @@ -677,7 +677,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Jan 5 6:22:49 mag4267.www.test CylancePROTECT Event Type:atura, Event Name:Alert, Device Message: Device: oreeu User: ),nvo (iamqui tassita Zone Names: colabori Device Id: imidestl", "tags": [ @@ -686,7 +686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-1-19T1:25:23.minimve serrorsi1096.www5.localdomain CylancePROTECT lamco cit [siar] Event Type: AuditLog, Event Name: ZoneAddDevice, Message: The Device: reetdo was auto assigned to the Zone: IP Address: Fake Devices, User: ()ever", "tags": [ @@ -695,7 +695,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "quiav 2019-2-2T8:27:57.mse prehen4807.mail.invalid CylancePROTECT liqua ariatur [labo] Event Type: DeviceControl, Event Name: SystemSecurity, Device Name: remq, External Device Type: unt, External Device Vendor ID: tla, External Device Name: arch, External Device Product ID: lite, External Device Serial Number: ugia, Zone Names: meum", "tags": [ @@ -704,7 +704,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "Feb 17 3:30:32 nvolupta126.www.domain CylancePROTECT Event Type:quas, Event Name:threat_found, Device Name:orp, File Path:ender, Interpreter:dico, Interpreter Version:1.5848, Zone Names:Utenima, User Name: olore", "tags": [ @@ -713,7 +713,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "3-March-2019 10:33:06 medium radip4253.www.corp gna \u003c\u003cici\u003equamnih 2019-3-3T10:33:06.asnulap yCiceroi5998.mail.home CylancePROTECT inc tect uiad Event Type: DeviceControl, Event Name: DeviceRemove, Device Name: roinBCSe, External Device Type: maperiam, External Device Vendor ID: mSec, External Device Name: smoditem, External Device Product ID: tatisetq, External Device Serial Number: uidolo, Zone Names: umdolore", "tags": [ @@ -722,7 +722,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-3-17T5:35:40.abori sit1400.www.lan CylancePROTECT ames amni [tatio] Event Type: AuditLog, Event Name: ZoneAdd, Message: Zone: ntsunti; Policy: borios; Value: ani, User: uid idatat (onev)", "tags": [ @@ -731,7 +731,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "iosamni 2019-4-1T12:38:14.idu sis3986.internal.lan CylancePROTECT tsedquia its umdolor Event Type: isiu, Event Name: Device Policy Assigned, Device Name: mmodi, Agent Version: snostr, IP Address: (10.232.90.3), MAC Address: (01:00:5e:e6:a6:a2), Logged On Users: (midestl), OS: nci", "tags": [ @@ -740,7 +740,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "hilmole 2019-4-15T7:40:49.sequ sectetu7182.localdomain CylancePROTECT dolor lorumwri [amnihil] Event Type: orissus, Event Name: Device Updated, uido", "tags": [ @@ -749,7 +749,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-4-29T2:43:23.itse officiad4982.www5.domain CylancePROTECT lumqui quiavolu [upta] Event Type: AuditLog, Event Name: ZoneAdd, Message: Device: umtota; User: etdolore magnaa (sumquiad)", "tags": [ @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-5-13T9:45:57.Duisa consequa1486.internal.localdomain CylancePROTECT aevitaed byCic [leumiur] Event Type: ptatemse, Event Name: pechange, Threat Class: quaeratv, Threat Subclass: involu, SHA256: tobeata, MD5: nesciun", "tags": [ @@ -767,7 +767,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "onorumet 2019-5-28T4:48:31.ptatema eavolup6981.www5.example CylancePROTECT psaquaea rchit psumq Event Type: DeviceControl, Event Name: threat_changed, Device Name: lum, External Device Type: xerc, External Device Vendor ID: ctetura, External Device Name: msequ, External Device Product ID: nvol, External Device Serial Number: enimadmi, Zone Names: tateveli", "tags": [ @@ -776,7 +776,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-6-11T11:51:06.oremip its6443.mail.example CylancePROTECT natuserr ostrudex [nse] Event Type: miurere, Event Name: fullaccess, Device Name: tlabo, Agent Version: tatemse, IP Address: (10.139.80.71), MAC Address: (01:00:5e:bc:c1:21), Logged On Users: (orem), OS: eniamqui", "tags": [ @@ -785,7 +785,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "25-June-2019 18:53:40 high tnulapa7580.www.domain adeser \u003c\u003cuasiarc\u003edoeiu 2019-6-25T6:53:40.onsectet dentsunt6061.www5.home CylancePROTECT tobeata imven onnumqua Event Type: quioff, Event Name: SyslogSettingsSave, Device Names: (upt), Policy Name: atatnonp, User: nvol dtemp (mquis)", "tags": [ @@ -794,7 +794,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10-July-2019 01:56:14 medium midest133.www5.example tocca \u003c\u003corsitvol\u003entor 2019-7-10T1:56:14.oinBCSed oid218.api.invalid CylancePROTECT roquisqu ariat midestl Event Type: AuditLog, Event Name: SyslogSettingsSave, Message: mcorpori, User: mqu pteursi (orsitam)", "tags": [ @@ -803,7 +803,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "totamre 2019-7-24T8:58:48.rpo velites4233.internal.home CylancePROTECT uisaute uun end Event Type: odocons, Event Name: Alert, Threat Class: asp, Threat Subclass: dexercit, SHA256: amn, MD5: itessequ", "tags": [ @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "7-August-2019 16:01:23 low sumd3215.test aUtenima \u003c\u003cturQuis\u003etaevi 2019-8-7T4:01:23.uames tconsec7604.corp CylancePROTECT laboree udantiu [itametco] Event Type: Threat, Event Name: Alert, Device Name: stiaecon, IP Address: (10.223.246.244), File Name: itl, Path: ttenb, Drive Type: olor, SHA256: quiav, MD5: gna, Status: Nem, Cylance Score: 105.845000, Found Date: lors, File Type: oluptat, Is Running: enimad, Auto Run: tis, Detected By: qua, Zone Names: con, Is Malware: tore, Is Unique To Cylance: sequatD, Threat Classification: ercitati", "tags": [ @@ -821,7 +821,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "21-Aug-2019 11:03:57 high oeiusmo5035.api.local tconse \u003c\u003crem\u003etseddoei 21T23:03:57.teursint etMa3452.www5.test CylancePROTECT Event Name:threat_found, Device Name:nturmag, File Path:uredol, Interpreter:maliqua, Interpreter Version:1.4613, Zone Names:mquia, User Name: omnisi, Device Id: etMalor, Policy Name: mco", "tags": [ @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "5-September-2019 06:06:31 high taspe1205.mail.domain cti \u003c\u003commodoc\u003ense 2019-9-5T6:06:31.mveniam tuser2694.internal.invalid CylancePROTECT tlaboru aeabillo [ciad] Event Type: ugiatqu, Event Name: threat_found, Device Names: (turveli), Policy Name: isciv, User: natus boreet (luptasnu)", "tags": [ @@ -839,7 +839,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "edqu 2019-9-19T1:09:05.tationu gnaaliq5240.api.test CylancePROTECT nula ameaquei [gnama] Event Type: esciun, Event Name: pechange, Threat Class: ratvo, Threat Subclass: ntutl, SHA256: volupt, MD5: ine", "tags": [ @@ -848,7 +848,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "3-Oct-2019 8:11:40 low ditaut33.mail.localhost iumdo \u003c\u003coreeu\u003emea 3T20:11:40.ssec illum2625.test CylancePROTECT Event Name:LoginSuccess, Threat Class:iaeconse, Threat Subclass:uisa, SHA256:nimadmin, MD5:tdolo", "tags": [ @@ -857,7 +857,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "18-October-2019 03:14:14 high porissus1225.www5.corp ddoe \u003c\u003cuptateve\u003eured 2019-10-18T3:14:14.ctetu oreeu6419.www.corp CylancePROTECT cul iinea snos Event Type: AuditLog, Event Name: PolicyAdd, Message: Device: moenimip; User: uames tium (ianonn)", "tags": [ @@ -866,7 +866,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-11-1T10:16:48.tiset sci333.mail.home CylancePROTECT doloreeu lors eumfu Event Type: docons, Event Name: PolicyAdd, Device Names: (eumf), Policy Name: roquisq, User: uasi maveniam (uis)", "tags": [ @@ -875,7 +875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "imi 2019-11-15T5:19:22.animi edutpers6452.api.host CylancePROTECT ntiumt sumquia vento Event Type: sitv, Event Name: LoginSuccess, Threat Class: com, Threat Subclass: rep, SHA256: mveni, MD5: aquae", "tags": [ @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "30-November-2019 00:21:57 low iaturE3103.api.domain aturve \u003c\u003cptateve\u003eiatu 2019/11/30T00:21:57.use nulamc5617.mail.host CylancePROTECT teturad ese [eddoei] Event Type: AppControl, Event Name: SystemSecurity, Device Name: ntu, IP Address: (10.134.137.205), Action: deny, Action Type: duntut, File Path: emporin, SHA256: oreseosq, Zone Names: etquasia", "tags": [ @@ -893,7 +893,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "2019-12-14T7:24:31.cinge tatem4713.internal.host CylancePROTECT elites pariat [nimip] Event Type: AuditLog, Event Name: threat_found, Message: Zone: usci; Policy: unturmag; Value: dexeaco, User: lupta ura (oreeufug)", "tags": [ diff --git a/packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json-expected.json b/packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json-expected.json index d38fce9b355..ee3c53ce7da 100644 --- a/packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json-expected.json +++ b/packages/cylance/data_stream/protect/_dev/test/pipeline/test-rsa2elk-output.json-expected.json @@ -15,7 +15,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", diff --git a/packages/cylance/data_stream/protect/elasticsearch/ingest_pipeline/default.yml b/packages/cylance/data_stream/protect/elasticsearch/ingest_pipeline/default.yml index 3bd705f718b..a435d1f310d 100644 --- a/packages/cylance/data_stream/protect/elasticsearch/ingest_pipeline/default.yml +++ b/packages/cylance/data_stream/protect/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for CylanceProtect processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - gsub: field: host.mac ignore_missing: true diff --git a/packages/cylance/data_stream/protect/sample_event.json b/packages/cylance/data_stream/protect/sample_event.json index 3742954ea22..501249f5314 100644 --- a/packages/cylance/data_stream/protect/sample_event.json +++ b/packages/cylance/data_stream/protect/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", diff --git a/packages/cylance/manifest.yml b/packages/cylance/manifest.yml index 065283dac13..7463bae1d28 100644 --- a/packages/cylance/manifest.yml +++ b/packages/cylance/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.7.0 name: cylance title: CylanceProtect Logs -version: "0.16.0" +version: "0.17.0" description: Collect logs from CylanceProtect devices with Elastic Agent. categories: ["security", "edr_xdr"] type: integration diff --git a/packages/darktrace/_dev/build/build.yml b/packages/darktrace/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/darktrace/_dev/build/build.yml +++ b/packages/darktrace/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/darktrace/changelog.yml b/packages/darktrace/changelog.yml index f9d9e01e96e..4401d681e23 100644 --- a/packages/darktrace/changelog.yml +++ b/packages/darktrace/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.7.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.6.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 - version: "1.5.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/darktrace/data_stream/ai_analyst_alert/_dev/test/pipeline/test-ai-analyst-alert.log-expected.json b/packages/darktrace/data_stream/ai_analyst_alert/_dev/test/pipeline/test-ai-analyst-alert.log-expected.json index 81ab0204d25..f643cc177be 100644 --- a/packages/darktrace/data_stream/ai_analyst_alert/_dev/test/pipeline/test-ai-analyst-alert.log-expected.json +++ b/packages/darktrace/data_stream/ai_analyst_alert/_dev/test/pipeline/test-ai-analyst-alert.log-expected.json @@ -135,7 +135,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -409,7 +409,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/darktrace/data_stream/ai_analyst_alert/elasticsearch/ingest_pipeline/default.yml b/packages/darktrace/data_stream/ai_analyst_alert/elasticsearch/ingest_pipeline/default.yml index 21d9e5be04a..72971a1e224 100644 --- a/packages/darktrace/data_stream/ai_analyst_alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/darktrace/data_stream/ai_analyst_alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing AI Analyst Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: message patterns: diff --git a/packages/darktrace/data_stream/ai_analyst_alert/manifest.yml b/packages/darktrace/data_stream/ai_analyst_alert/manifest.yml index 6e056b2c96d..0814b4056d3 100644 --- a/packages/darktrace/data_stream/ai_analyst_alert/manifest.yml +++ b/packages/darktrace/data_stream/ai_analyst_alert/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the AI Analyst Alert logs from Darktrace. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the AI Analyst Alert logs from Darktrace. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Darktrace API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Darktrace API. Supported units for this parameter are h/m/s. default: 1m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/darktrace/data_stream/ai_analyst_alert/sample_event.json b/packages/darktrace/data_stream/ai_analyst_alert/sample_event.json index 68c0b73452f..2bd7dd8ea18 100644 --- a/packages/darktrace/data_stream/ai_analyst_alert/sample_event.json +++ b/packages/darktrace/data_stream/ai_analyst_alert/sample_event.json @@ -144,7 +144,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", diff --git a/packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log-expected.json b/packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log-expected.json index 606fe3d5a7e..c06f8168f2b 100644 --- a/packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log-expected.json +++ b/packages/darktrace/data_stream/model_breach_alert/_dev/test/pipeline/test-model-breach-alert.log-expected.json @@ -132,7 +132,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2022-07-13T02:12:45.000Z", @@ -517,7 +517,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1074,7 +1074,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1163,7 +1163,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2022-08-05T09:35:45.460Z", @@ -1241,7 +1241,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2022-08-05T09:34:46.317Z", diff --git a/packages/darktrace/data_stream/model_breach_alert/elasticsearch/ingest_pipeline/default.yml b/packages/darktrace/data_stream/model_breach_alert/elasticsearch/ingest_pipeline/default.yml index 5dacd346f50..e8d07e01de1 100644 --- a/packages/darktrace/data_stream/model_breach_alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/darktrace/data_stream/model_breach_alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Model Breach Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: message patterns: diff --git a/packages/darktrace/data_stream/model_breach_alert/manifest.yml b/packages/darktrace/data_stream/model_breach_alert/manifest.yml index 1f16664378b..9f883249d51 100644 --- a/packages/darktrace/data_stream/model_breach_alert/manifest.yml +++ b/packages/darktrace/data_stream/model_breach_alert/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the Model Breach Alert logs from Darktrace. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the Model Breach Alert logs from Darktrace. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Darktrace API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Darktrace API. Supported units for this parameter are h/m/s. default: 1m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/darktrace/data_stream/model_breach_alert/sample_event.json b/packages/darktrace/data_stream/model_breach_alert/sample_event.json index b37a903ce8b..d48065b2005 100644 --- a/packages/darktrace/data_stream/model_breach_alert/sample_event.json +++ b/packages/darktrace/data_stream/model_breach_alert/sample_event.json @@ -499,7 +499,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", diff --git a/packages/darktrace/data_stream/system_status_alert/_dev/test/pipeline/test-system-status-alert.log-expected.json b/packages/darktrace/data_stream/system_status_alert/_dev/test/pipeline/test-system-status-alert.log-expected.json index 4155ae96d4f..6b8d1a4037c 100644 --- a/packages/darktrace/data_stream/system_status_alert/_dev/test/pipeline/test-system-status-alert.log-expected.json +++ b/packages/darktrace/data_stream/system_status_alert/_dev/test/pipeline/test-system-status-alert.log-expected.json @@ -19,7 +19,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "abcdabcd-1234-1234-1234-3abababcdcd3", @@ -76,7 +76,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "abcd1234-1234-1234-1234-3abababcdcd3", diff --git a/packages/darktrace/data_stream/system_status_alert/elasticsearch/ingest_pipeline/default.yml b/packages/darktrace/data_stream/system_status_alert/elasticsearch/ingest_pipeline/default.yml index 4c53699c357..9121ab4843e 100644 --- a/packages/darktrace/data_stream/system_status_alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/darktrace/data_stream/system_status_alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing System Status Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: message patterns: diff --git a/packages/darktrace/data_stream/system_status_alert/sample_event.json b/packages/darktrace/data_stream/system_status_alert/sample_event.json index 12cd3cc3727..1db76b2c6bf 100644 --- a/packages/darktrace/data_stream/system_status_alert/sample_event.json +++ b/packages/darktrace/data_stream/system_status_alert/sample_event.json @@ -29,7 +29,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", diff --git a/packages/darktrace/docs/README.md b/packages/darktrace/docs/README.md index 5ba6ba2dad0..3e6d1a4da54 100644 --- a/packages/darktrace/docs/README.md +++ b/packages/darktrace/docs/README.md @@ -254,7 +254,7 @@ An example event for `ai_analyst_alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", @@ -419,17 +419,17 @@ An example event for `ai_analyst_alert` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -979,7 +979,7 @@ An example event for `model_breach_alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", @@ -1215,15 +1215,15 @@ An example event for `model_breach_alert` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -1310,7 +1310,7 @@ An example event for `system_status_alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "85270a54-b915-4d11-9305-d004346cb8cf", @@ -1422,10 +1422,10 @@ An example event for `system_status_alert` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | diff --git a/packages/darktrace/kibana/dashboard/darktrace-6bd3c320-13b2-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/dashboard/darktrace-6bd3c320-13b2-11ed-bdc1-9f13147efcf8.json index fdabfd6f8c1..d16b239eb2e 100644 --- a/packages/darktrace/kibana/dashboard/darktrace-6bd3c320-13b2-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/dashboard/darktrace-6bd3c320-13b2-11ed-bdc1-9f13147efcf8.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Darktrace System Status Alerts Overview.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -39,7 +40,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1b85280d-b235-4523-b782-fd77e9046901": { "columnOrder": [ @@ -94,12 +95,15 @@ "visualization": { "accessor": "426426da-2361-40d0-a759-2591bdf082c9", "layerId": "1b85280d-b235-4523-b782-fd77e9046901", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -114,7 +118,7 @@ "panelIndex": "5f64c3c5-4d59-4abb-a6ab-234a1ee66151", "title": "Number of Active Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -133,7 +137,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f27d6430-9a24-4f7b-86b0-43950b6f2393": { "columnOrder": [ @@ -190,15 +194,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ecdeb1b2-48c5-4966-bca9-0f228a2916f3" - ], "layerId": "f27d6430-9a24-4f7b-86b0-43950b6f2393", "layerType": "data", "legendDisplay": "default", - "metric": "11c181af-dff4-4a0a-ad2e-0846bd66affe", + "legendSize": "auto", + "metrics": [ + "11c181af-dff4-4a0a-ad2e-0846bd66affe" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ecdeb1b2-48c5-4966-bca9-0f228a2916f3" + ] } ], "shape": "pie" @@ -221,7 +228,7 @@ "panelIndex": "e7b10ecb-271a-4010-9947-9597225acd58", "title": "Distribution of System Status Alerts by Priority Level [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -240,7 +247,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b1042ac5-75bd-48e1-9c8c-4ab507402159": { "columnOrder": [ @@ -325,7 +332,7 @@ "panelIndex": "77e3df19-769a-414a-b96b-dbb37169629d", "title": "Top 10 Hostname with Highest System Status Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -344,7 +351,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "607d2de2-df5d-4503-90e0-4ac42323c46e": { "columnOrder": [ @@ -429,7 +436,7 @@ "panelIndex": "7d794103-85bd-4669-b9bc-b9223d2eba5c", "title": "Top 10 Alert Name with Highest System Status Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -445,17 +452,18 @@ "panelIndex": "00e77d89-2b5e-4f2d-bc08-f7d1ce5165dd", "panelRefName": "panel_00e77d89-2b5e-4f2d-bc08-f7d1ce5165dd", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Darktrace] System Status Alerts Overview", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:11:31.401Z", "id": "darktrace-6bd3c320-13b2-11ed-bdc1-9f13147efcf8", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/darktrace/kibana/dashboard/darktrace-da768d80-1399-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/dashboard/darktrace-da768d80-1399-11ed-bdc1-9f13147efcf8.json index bf5cb00e86e..82205d7f023 100644 --- a/packages/darktrace/kibana/dashboard/darktrace-da768d80-1399-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/dashboard/darktrace-da768d80-1399-11ed-bdc1-9f13147efcf8.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Darktrace Model Breach Alerts Overview.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -34,7 +35,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "16c69f2e-ffe0-4393-9d91-dece311e3f0f": { "columnOrder": [ @@ -67,12 +68,15 @@ "visualization": { "accessor": "099298f5-fc58-4473-860e-84bc44f2e387", "layerId": "16c69f2e-ffe0-4393-9d91-dece311e3f0f", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -87,7 +91,7 @@ "panelIndex": "14e3bf5d-011f-48d2-83a9-fc62d707cdd1", "title": "Number of Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -111,7 +115,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8d4cd3ff-fd36-462e-ae82-826554dc847d": { "columnOrder": [ @@ -166,12 +170,15 @@ "visualization": { "accessor": "861dc1ff-427e-4512-bb2c-e28d3f7564b2", "layerId": "8d4cd3ff-fd36-462e-ae82-826554dc847d", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -186,7 +193,7 @@ "panelIndex": "07f13cdd-3a86-40e5-914f-8f50c695b6ee", "title": "Number of Active Models [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -205,7 +212,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a4c3d027-4533-411a-b9f1-26f0a4fedb66": { "columnOrder": [ @@ -262,15 +269,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1ea9479b-4db9-4215-97d9-1d7a275176ab" - ], "layerId": "a4c3d027-4533-411a-b9f1-26f0a4fedb66", "layerType": "data", "legendDisplay": "default", - "metric": "36c1f412-cfb7-4ea0-b9c9-a323c72e800d", + "legendSize": "auto", + "metrics": [ + "36c1f412-cfb7-4ea0-b9c9-a323c72e800d" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1ea9479b-4db9-4215-97d9-1d7a275176ab" + ] } ], "shape": "pie" @@ -293,7 +303,7 @@ "panelIndex": "1fafffde-be8a-4e46-bc58-a52db1e94931", "title": "Distribution of Model Breach Alerts by Model Category [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -312,7 +322,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8a0016c8-0623-4e96-a007-240f0bfe88c2": { "columnOrder": [ @@ -395,6 +405,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -423,7 +434,7 @@ "panelIndex": "ddcd6a80-5ab0-4522-b984-022b7da2d4b0", "title": "Distribution of Model Breach Alerts by Model Priority [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -442,7 +453,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "267ebe2d-c964-48cf-9c9a-1a1fb09f6e3c": { "columnOrder": [ @@ -499,15 +510,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c2ee5623-973c-416f-80b0-bae47d66f83b" - ], "layerId": "267ebe2d-c964-48cf-9c9a-1a1fb09f6e3c", "layerType": "data", "legendDisplay": "default", - "metric": "8630c019-3e7e-4734-b1c2-1a82f39fb7fc", + "legendSize": "auto", + "metrics": [ + "8630c019-3e7e-4734-b1c2-1a82f39fb7fc" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c2ee5623-973c-416f-80b0-bae47d66f83b" + ] } ], "shape": "pie" @@ -530,7 +544,7 @@ "panelIndex": "44710442-b7b8-413a-9e52-4d7ba519a296", "title": "Distribution of Model Breach Alerts by Model Behaviour [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -549,7 +563,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "26e0acea-9274-411a-91a3-8537b1e00aff": { "columnOrder": [ @@ -637,7 +651,7 @@ "panelIndex": "747c1919-e215-4b97-9d8b-8ee528c1deaa", "title": "Top 10 Model Breach Alerts by Highest Model Breach Score [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -656,7 +670,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "adde69bc-fda5-4560-8a54-202ca975652f": { "columnOrder": [ @@ -744,7 +758,7 @@ "panelIndex": "aca1678c-d3d8-478e-a09c-dfdd86a5b3f7", "title": "Top 10 Model Name with Highest Model Breach [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -763,7 +777,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0c7a50df-8359-42ff-806d-a22eb35b597a": { "columnOrder": [ @@ -848,7 +862,7 @@ "panelIndex": "19b3fa09-6280-430a-9046-a613dfde3696", "title": "Top 10 Device Type with Highest Model Breach [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -867,7 +881,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7bd679f9-8a5b-4906-beaa-750102e3a26f": { "columnOrder": [ @@ -924,15 +938,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "13359fdf-964f-441c-8d49-dcacd44d74a9" - ], "layerId": "7bd679f9-8a5b-4906-beaa-750102e3a26f", "layerType": "data", "legendDisplay": "default", - "metric": "d0c28963-3b20-44ed-bd81-668ccef65e64", + "legendSize": "auto", + "metrics": [ + "d0c28963-3b20-44ed-bd81-668ccef65e64" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "13359fdf-964f-441c-8d49-dcacd44d74a9" + ] } ], "shape": "pie" @@ -955,7 +972,7 @@ "panelIndex": "185e6cd3-4cf8-45fd-937e-77abd9e6aad7", "title": "Distribution of Model Breach Alerts by Targeted Vendor [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -968,53 +985,54 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-c8ea502e-ae28-47dd-9b90-484d50083243", + "name": "indexpattern-datasource-layer-88c07c59-c625-4652-8156-54991d0869d8", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "c8ea502e-ae28-47dd-9b90-484d50083243": { + "88c07c59-c625-4652-8156-54991d0869d8": { "columnOrder": [ - "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1", - "dbd63d7d-3048-4f3e-a068-d891e14f517b" + "3fdb34e6-9e66-42b8-8705-ce15282352a8", + "0f644c53-93f7-450a-ab4a-2d08a26251a7" ], "columns": { - "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1": { + "0f644c53-93f7-450a-ab4a-2d08a26251a7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "darktrace.model_breach_alert.pbid" + }, + "3fdb34e6-9e66-42b8-8705-ce15282352a8": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Device Host ID", + "label": "Antigena Action", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "dbd63d7d-3048-4f3e-a068-d891e14f517b", + "columnId": "0f644c53-93f7-450a-ab4a-2d08a26251a7", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", - "sourceField": "host.id" - }, - "dbd63d7d-3048-4f3e-a068-d891e14f517b": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "darktrace.model_breach_alert.pbid" + "sourceField": "event.action" } }, "incompleteColumns": {} @@ -1028,39 +1046,47 @@ "query": "data_stream.dataset : \"darktrace.model_breach_alert\"" }, "visualization": { - "columns": [ - { - "alignment": "left", - "columnId": "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1", - "isTransposed": false - }, + "layers": [ { - "columnId": "dbd63d7d-3048-4f3e-a068-d891e14f517b", - "isTransposed": false + "accessors": [ + "0f644c53-93f7-450a-ab4a-2d08a26251a7" + ], + "layerId": "88c07c59-c625-4652-8156-54991d0869d8", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "3fdb34e6-9e66-42b8-8705-ce15282352a8" } ], - "layerId": "c8ea502e-ae28-47dd-9b90-484d50083243", - "layerType": "data" + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0", + "i": "889bb859-0938-46a4-b078-30f5fedd10a7", "w": 24, - "x": 24, + "x": 0, "y": 60 }, - "panelIndex": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0", - "title": "Top 10 Device Host ID with Highest Model Breach [Logs Darktrace]", + "panelIndex": "889bb859-0938-46a4-b078-30f5fedd10a7", + "title": "Distribution of Model Breach Alerts by Antigena Action [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1073,54 +1099,53 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-88c07c59-c625-4652-8156-54991d0869d8", + "name": "indexpattern-datasource-layer-c8ea502e-ae28-47dd-9b90-484d50083243", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "88c07c59-c625-4652-8156-54991d0869d8": { + "c8ea502e-ae28-47dd-9b90-484d50083243": { "columnOrder": [ - "3fdb34e6-9e66-42b8-8705-ce15282352a8", - "0f644c53-93f7-450a-ab4a-2d08a26251a7" + "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1", + "dbd63d7d-3048-4f3e-a068-d891e14f517b" ], "columns": { - "0f644c53-93f7-450a-ab4a-2d08a26251a7": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "darktrace.model_breach_alert.pbid" - }, - "3fdb34e6-9e66-42b8-8705-ce15282352a8": { + "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Antigena Action", + "label": "Device Host ID", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "0f644c53-93f7-450a-ab4a-2d08a26251a7", + "columnId": "dbd63d7d-3048-4f3e-a068-d891e14f517b", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "secondaryFields": [], "size": 10 }, "scale": "ordinal", - "sourceField": "event.action" + "sourceField": "host.id" + }, + "dbd63d7d-3048-4f3e-a068-d891e14f517b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "darktrace.model_breach_alert.pbid" } }, "incompleteColumns": {} @@ -1134,46 +1159,39 @@ "query": "data_stream.dataset : \"darktrace.model_breach_alert\"" }, "visualization": { - "layers": [ + "columns": [ { - "accessors": [ - "0f644c53-93f7-450a-ab4a-2d08a26251a7" - ], - "layerId": "88c07c59-c625-4652-8156-54991d0869d8", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "3fdb34e6-9e66-42b8-8705-ce15282352a8" + "alignment": "left", + "columnId": "0e81fce6-dd05-4dcb-9cc1-1bfedfd001d1", + "isTransposed": false + }, + { + "columnId": "dbd63d7d-3048-4f3e-a068-d891e14f517b", + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide" + "layerId": "c8ea502e-ae28-47dd-9b90-484d50083243", + "layerType": "data" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "889bb859-0938-46a4-b078-30f5fedd10a7", + "i": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0", "w": 24, - "x": 0, + "x": 24, "y": 60 }, - "panelIndex": "889bb859-0938-46a4-b078-30f5fedd10a7", - "title": "Distribution of Model Breach Alerts by Antigena Action [Logs Darktrace]", + "panelIndex": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0", + "title": "Top 10 Device Host ID with Highest Model Breach [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1192,7 +1210,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "68e57e92-bad9-44bd-8022-16b46d218096": { "columnOrder": [ @@ -1260,6 +1278,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -1284,82 +1303,143 @@ "panelIndex": "c6560c58-be58-4718-abed-0356a2ba3b09", "title": "Model Throttle Over Time [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Tag Cloud", - "emptyAsNull": false, - "field": "darktrace.model_breach_alert.pbid" - }, - "schema": "metric", - "type": "cardinality" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0ec8ccf8-0e4f-407a-bb36-2a023091372d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0ec8ccf8-0e4f-407a-bb36-2a023091372d": { + "columnOrder": [ + "efb215c1-4adc-4670-921e-792eaea510ac", + "6b1f5241-4a07-4f2f-9086-690ed4c7b7a6" + ], + "columns": { + "6b1f5241-4a07-4f2f-9086-690ed4c7b7a6": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "efb215c1-4adc-4670-921e-792eaea510ac": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Mitre Techniques", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b1f5241-4a07-4f2f-9086-690ed4c7b7a6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Mitre Techniques", - "field": "threat.technique.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "textBased": { + "layers": {} } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"darktrace.model_breach_alert\"" - } - } - }, - "description": "", - "id": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" }, - "scale": "linear", - "showLabel": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b1f5241-4a07-4f2f-9086-690ed4c7b7a6" + ], + "layerId": "0ec8ccf8-0e4f-407a-bb36-2a023091372d", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "efb215c1-4adc-4670-921e-792eaea510ac" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, "title": "", - "type": "tagcloud", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 23, - "i": "12736f17-d97c-4f4c-a66b-5eba7c2fec9c", + "i": "d0dcf71d-0e76-407c-b9c2-be378b9f23d3", "w": 48, "x": 0, "y": 94 }, - "panelIndex": "12736f17-d97c-4f4c-a66b-5eba7c2fec9c", + "panelIndex": "d0dcf71d-0e76-407c-b9c2-be378b9f23d3", "title": "Top Mitre Techniques [Logs Darktrace]", - "type": "visualization", - "version": "8.2.1" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -1375,17 +1455,18 @@ "panelIndex": "e9b4f5f5-d478-403d-a78e-9e39ad3486f0", "panelRefName": "panel_e9b4f5f5-d478-403d-a78e-9e39ad3486f0", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Darktrace] Model Breach Alerts Overview", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:15:47.528Z", "id": "darktrace-da768d80-1399-11ed-bdc1-9f13147efcf8", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1485,22 +1566,22 @@ }, { "id": "logs-*", - "name": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0:indexpattern-datasource-current-indexpattern", + "name": "889bb859-0938-46a4-b078-30f5fedd10a7:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0:indexpattern-datasource-layer-c8ea502e-ae28-47dd-9b90-484d50083243", + "name": "889bb859-0938-46a4-b078-30f5fedd10a7:indexpattern-datasource-layer-88c07c59-c625-4652-8156-54991d0869d8", "type": "index-pattern" }, { "id": "logs-*", - "name": "889bb859-0938-46a4-b078-30f5fedd10a7:indexpattern-datasource-current-indexpattern", + "name": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "889bb859-0938-46a4-b078-30f5fedd10a7:indexpattern-datasource-layer-88c07c59-c625-4652-8156-54991d0869d8", + "name": "7c6faaf4-5d0c-49a1-b1d2-605f18e675b0:indexpattern-datasource-layer-c8ea502e-ae28-47dd-9b90-484d50083243", "type": "index-pattern" }, { @@ -1515,7 +1596,7 @@ }, { "id": "logs-*", - "name": "12736f17-d97c-4f4c-a66b-5eba7c2fec9c:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "d0dcf71d-0e76-407c-b9c2-be378b9f23d3:indexpattern-datasource-layer-0ec8ccf8-0e4f-407a-bb36-2a023091372d", "type": "index-pattern" }, { diff --git a/packages/darktrace/kibana/dashboard/darktrace-eb643d20-13a5-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/dashboard/darktrace-eb643d20-13a5-11ed-bdc1-9f13147efcf8.json index b0cec601476..10627f58e64 100644 --- a/packages/darktrace/kibana/dashboard/darktrace-eb643d20-13a5-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/dashboard/darktrace-eb643d20-13a5-11ed-bdc1-9f13147efcf8.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Darktrace AI Analyst Alerts Overview.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -39,7 +40,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1f84b818-192c-4dca-b929-1884e060576b": { "columnOrder": [ @@ -94,12 +95,15 @@ "visualization": { "accessor": "367e5418-6e25-45f2-b5fc-6ddd3618b869", "layerId": "1f84b818-192c-4dca-b929-1884e060576b", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -114,7 +118,7 @@ "panelIndex": "e28c7c69-2ae8-46fd-b361-38be020491a8", "title": "Count of User Triggered AI Analyst Investigation [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -138,7 +142,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1f84b818-192c-4dca-b929-1884e060576b": { "columnOrder": [ @@ -193,12 +197,15 @@ "visualization": { "accessor": "367e5418-6e25-45f2-b5fc-6ddd3618b869", "layerId": "1f84b818-192c-4dca-b929-1884e060576b", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -213,7 +220,7 @@ "panelIndex": "be1b9c5a-2ea0-48ac-8ad6-221769ff83f9", "title": "Count of Externally Triggered AI Analyst Investigation [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -237,7 +244,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1f84b818-192c-4dca-b929-1884e060576b": { "columnOrder": [ @@ -292,12 +299,15 @@ "visualization": { "accessor": "367e5418-6e25-45f2-b5fc-6ddd3618b869", "layerId": "1f84b818-192c-4dca-b929-1884e060576b", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -312,7 +322,7 @@ "panelIndex": "034d5870-b571-4276-9fad-1495a3665eed", "title": "Count of Acknowledged AI Analyst Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -331,7 +341,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "66afac91-ca1e-4a4a-ab0d-e18a2903ace7": { "columnOrder": [ @@ -388,15 +398,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6e2b5d5b-0584-412f-a87f-b60279d2173d" - ], "layerId": "66afac91-ca1e-4a4a-ab0d-e18a2903ace7", "layerType": "data", "legendDisplay": "default", - "metric": "8f546d14-cc1d-4d80-8cec-8e326bfd19d1", + "legendSize": "auto", + "metrics": [ + "8f546d14-cc1d-4d80-8cec-8e326bfd19d1" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6e2b5d5b-0584-412f-a87f-b60279d2173d" + ] } ], "shape": "pie" @@ -419,7 +432,7 @@ "panelIndex": "65f35405-87eb-4a98-a0c2-2e3c7426cb28", "title": "Distribution of AI Analyst Alerts by Behavior Category [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -438,7 +451,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "effe003f-604a-49a3-a903-d4d2c75df944": { "columnOrder": [ @@ -507,6 +520,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -531,7 +545,7 @@ "panelIndex": "8882d78e-7df8-4d33-b7b5-e21f5d25dfe7", "title": "Distribution of AI Analyst Alerts by Summariser [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -550,7 +564,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "dea45bd8-269e-48c4-98d3-fc47717ae139": { "columnOrder": [ @@ -637,7 +651,7 @@ "panelIndex": "6b003410-fd00-4dc5-b9c7-8bd1f711ffbe", "title": "Top 10 AI Analyst Alerts with Highest Score [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -656,7 +670,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3bb3b1dd-30aa-46d6-8a14-32c14c706f47": { "columnOrder": [ @@ -741,7 +755,7 @@ "panelIndex": "930d2983-f872-4001-ba45-b44aee791167", "title": "Top 10 BreachDevices Hostname with Highest AI Analyst Alerts [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -760,7 +774,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9eda772e-1fbd-4296-a543-8bbd18b2359a": { "columnOrder": [ @@ -847,7 +861,7 @@ "panelIndex": "7e4d0098-0cc8-403d-aaca-92758d697950", "title": "Top 10 AI Analyst Alerts with Highest Group Score [Logs Darktrace]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -863,17 +877,18 @@ "panelIndex": "4ce4eb50-af35-423a-b20f-61a715aa4388", "panelRefName": "panel_4ce4eb50-af35-423a-b20f-61a715aa4388", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Darktrace] AI Analyst Alerts Overview", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:11:46.485Z", "id": "darktrace-eb643d20-13a5-11ed-bdc1-9f13147efcf8", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/darktrace/kibana/search/darktrace-31a3f8a0-13a3-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/search/darktrace-31a3f8a0-13a3-11ed-bdc1-9f13147efcf8.json index b520d9b6d92..da57cee14d3 100644 --- a/packages/darktrace/kibana/search/darktrace-31a3f8a0-13a3-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/search/darktrace-31a3f8a0-13a3-11ed-bdc1-9f13147efcf8.json @@ -28,7 +28,8 @@ ], "title": "Model Breach Alerts Essential Details [Logs Darktrace]" }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:10:39.307Z", "id": "darktrace-31a3f8a0-13a3-11ed-bdc1-9f13147efcf8", "migrationVersion": { "search": "8.0.0" diff --git a/packages/darktrace/kibana/search/darktrace-c0e40350-13aa-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/search/darktrace-c0e40350-13aa-11ed-bdc1-9f13147efcf8.json index 726cefb46b2..ebf6d815e48 100644 --- a/packages/darktrace/kibana/search/darktrace-c0e40350-13aa-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/search/darktrace-c0e40350-13aa-11ed-bdc1-9f13147efcf8.json @@ -28,7 +28,8 @@ ], "title": "AI Analyst Alerts Essential Details [Logs Darktrace]" }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:10:39.307Z", "id": "darktrace-c0e40350-13aa-11ed-bdc1-9f13147efcf8", "migrationVersion": { "search": "8.0.0" diff --git a/packages/darktrace/kibana/search/darktrace-fbf9cfc0-13b3-11ed-bdc1-9f13147efcf8.json b/packages/darktrace/kibana/search/darktrace-fbf9cfc0-13b3-11ed-bdc1-9f13147efcf8.json index 49cb80e2e20..605a32ef5be 100644 --- a/packages/darktrace/kibana/search/darktrace-fbf9cfc0-13b3-11ed-bdc1-9f13147efcf8.json +++ b/packages/darktrace/kibana/search/darktrace-fbf9cfc0-13b3-11ed-bdc1-9f13147efcf8.json @@ -29,7 +29,8 @@ ], "title": "System Status Alerts Essential Details [Logs Darktrace]" }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:10:39.307Z", "id": "darktrace-fbf9cfc0-13b3-11ed-bdc1-9f13147efcf8", "migrationVersion": { "search": "8.0.0" diff --git a/packages/darktrace/kibana/tags.yml b/packages/darktrace/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/darktrace/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/darktrace/manifest.yml b/packages/darktrace/manifest.yml index be1b303212f..36bb84b15ab 100644 --- a/packages/darktrace/manifest.yml +++ b/packages/darktrace/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: darktrace title: Darktrace -version: "1.5.0" +version: "1.10.0" description: Collect logs from Darktrace with Elastic Agent. type: integration categories: - security - network_security conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/darktrace-screenshot.png title: Darktrace Model Breach Alert Dashboard Screenshot @@ -141,3 +142,4 @@ policy_templates: default: localhost owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/dga/changelog.yml b/packages/dga/changelog.yml index e24ff60a23c..08e86b2db39 100644 --- a/packages/dga/changelog.yml +++ b/packages/dga/changelog.yml @@ -1,3 +1,9 @@ +# newer versions go on top +- version: "1.1.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/7053 - version: "1.0.1" changes: - description: Add the Advanced Analytics (UEBA) subcategory diff --git a/packages/dga/elasticsearch/ingest_pipeline/ml_dga_inference_pipeline.yml b/packages/dga/elasticsearch/ingest_pipeline/ml_dga_inference_pipeline.yml index 08a13053c43..13a584a20d0 100644 --- a/packages/dga/elasticsearch/ingest_pipeline/ml_dga_inference_pipeline.yml +++ b/packages/dga/elasticsearch/ingest_pipeline/ml_dga_inference_pipeline.yml @@ -99,3 +99,10 @@ processors: ctx['ml_is_dga'] = new HashMap(); ctx['ml_is_dga']['malicious_prediction'] = malicious_prediction; ctx['ml_is_dga']['malicious_probability'] = malicious_probability; +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/dga/elasticsearch/ingest_pipeline/ml_dga_ingest_pipeline.yml b/packages/dga/elasticsearch/ingest_pipeline/ml_dga_ingest_pipeline.yml index ba3f26d9a5e..32179060ae1 100644 --- a/packages/dga/elasticsearch/ingest_pipeline/ml_dga_ingest_pipeline.yml +++ b/packages/dga/elasticsearch/ingest_pipeline/ml_dga_ingest_pipeline.yml @@ -7,5 +7,8 @@ processors: version: 1 on_failure: - set: + field: event.kind + value: pipeline_error + - append: field: error.message - value: '{{ _ingest.on_failure_message }}' + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/dga/manifest.yml b/packages/dga/manifest.yml index 50a3ac068d8..58bb1a29a3f 100644 --- a/packages/dga/manifest.yml +++ b/packages/dga/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: dga title: "Domain Generation Algorithm Detection" -version: 1.0.1 +version: 1.1.0 license: basic description: "ML solution package to detect domain generation algorithm (DGA) activity in your network data. Requires a Platinum subscription." type: integration diff --git a/packages/docker/_dev/build/docs/README.md b/packages/docker/_dev/build/docs/README.md index 6ce694e33d7..ce7d464d400 100644 --- a/packages/docker/_dev/build/docs/README.md +++ b/packages/docker/_dev/build/docs/README.md @@ -8,8 +8,7 @@ The `container_logs` data stream for containers' logs collection is enabled by d ## Compatibility The Docker module is currently tested on Linux and Mac with the community -edition engine, versions 1.11 and 17.09.0-ce. It is not tested on Windows, -but it should also work there. +edition engine, versions 1.11 and 17.09.0-ce. ## Running from within Docker diff --git a/packages/docker/changelog.yml b/packages/docker/changelog.yml index 56651bb65ad..9ca4359e5da 100644 --- a/packages/docker/changelog.yml +++ b/packages/docker/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.8.1" + changes: + - description: Remove confusing documentation about Windows support. + type: enhancement + link: https://github.com/elastic/integrations/pull/7645 - version: "2.8.0" changes: - description: Enable time series data streams for the metrics datasets, except for event dataset. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html diff --git a/packages/docker/docs/README.md b/packages/docker/docs/README.md index 2a53fa11a79..d1c0695e21c 100644 --- a/packages/docker/docs/README.md +++ b/packages/docker/docs/README.md @@ -8,8 +8,7 @@ The `container_logs` data stream for containers' logs collection is enabled by d ## Compatibility The Docker module is currently tested on Linux and Mac with the community -edition engine, versions 1.11 and 17.09.0-ce. It is not tested on Windows, -but it should also work there. +edition engine, versions 1.11 and 17.09.0-ce. ## Running from within Docker diff --git a/packages/docker/manifest.yml b/packages/docker/manifest.yml index 3aad1309f4d..be74ca41f08 100644 --- a/packages/docker/manifest.yml +++ b/packages/docker/manifest.yml @@ -1,6 +1,6 @@ name: docker title: Docker -version: 2.8.0 +version: 2.8.1 release: ga description: Collect metrics and logs from Docker instances with Elastic Agent. type: integration diff --git a/packages/elastic_agent/changelog.yml b/packages/elastic_agent/changelog.yml index b68ac119c56..5b9773a5051 100644 --- a/packages/elastic_agent/changelog.yml +++ b/packages/elastic_agent/changelog.yml @@ -1,4 +1,65 @@ # newer versions go on top +- version: "1.13.1" + changes: + - description: Fix mapping and description for the `system.process.cpu.{system,user,total}.time.ms` fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/7872 + - description: Align mapping for the `beat.stats.libbeat.config.{running,starts,stops}` fields with the `beat` integration. + type: bugfix + link: https://github.com/elastic/integrations/pull/7872 + - description: For the `message` field, consistently use the ECS defined mapping type of `match_only_text`. + type: bugfix + link: https://github.com/elastic/integrations/pull/7872 +- version: "1.13.0" + changes: + - description: Remove metric mappings from the filebeat_input_logs data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/7753 +- version: "1.12.1" + changes: + - description: Add a new dataset to include both metrics and logs for the active integrations and agent charts + type: enhancement + link: https://github.com/elastic/integrations/pull/7674 +- version: "1.12.0" + changes: + - description: Add metrics for queue depth, output batch size and output batch rate. + type: enhancement + link: https://github.com/elastic/integrations/pull/7611 +- version: "1.11.2" + changes: + - description: Adding hyperlinks that works when installed on different spaces. + type: enhancement + link: https://github.com/elastic/integrations/pull/7476 +- version: "1.11.1" + changes: + - description: Fix agent health dashboard links to work when installed in other spaces. + type: bugfix + link: https://github.com/elastic/integrations/pull/7471 +- version: "1.11.0" + changes: + - description: Enable time series data streams for the metrics datastreams except for endpoint security metrics and filebeat input metrics. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7214 +- version: "1.10.1" + changes: + - description: Set metric type for all metric fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/5618 +- version: "1.10.0" + changes: + - description: Set dimension fields for metrics data streams APM Server, Auditbeat, Cloudbeat, Elastic Agent, Heartbeat, Filebeat, Metricbeat, Osquery and Packetbeat. + type: enhancement + link: https://github.com/elastic/integrations/pull/6939 +- version: "1.9.1" + changes: + - description: For the filebeat_input metrics data stream, prevent dynamic mapping rules designed for long values from matching objects. This fixes mapping issues for the 'filebeat_input.httpjson_interval_pages_total' histogram. + type: bugfix + link: https://github.com/elastic/integrations/pull/7179 +- version: "1.9.0" + changes: + - description: Add fleet-server attributes to log. + type: enhancement + link: https://github.com/elastic/integrations/pull/7096 - version: "1.8.0" changes: - description: Added new Health dashboards for Input Metrics diff --git a/packages/elastic_agent/data_stream/apm_server_logs/fields/fields.yml b/packages/elastic_agent/data_stream/apm_server_logs/fields/fields.yml index 24771ec5046..504e0bb9581 100644 --- a/packages/elastic_agent/data_stream/apm_server_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/apm_server_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents diff --git a/packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/apm_server_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/apm_server_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/apm_server_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/apm_server_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/apm_server_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/apm_server_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/apm_server_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/apm_server_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/apm_server_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/apm_server_metrics/manifest.yml b/packages/elastic_agent/data_stream/apm_server_metrics/manifest.yml index 074a92bed2e..096560eff7d 100644 --- a/packages/elastic_agent/data_stream/apm_server_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/apm_server_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.apm_server type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/auditbeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/auditbeat_logs/fields/fields.yml index 24771ec5046..012b7bf3c5b 100644 --- a/packages/elastic_agent/data_stream/auditbeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/auditbeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,50 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/auditbeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/auditbeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/auditbeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/auditbeat_metrics/manifest.yml index 4d7bfdd55e0..8d5cd8a16b2 100644 --- a/packages/elastic_agent/data_stream/auditbeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/auditbeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent Auditbeat Metrics dataset: elastic_agent.auditbeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/cloud_defend_logs/fields/fields.yml b/packages/elastic_agent/data_stream/cloud_defend_logs/fields/fields.yml index 1acd8e61492..3e634873125 100644 --- a/packages/elastic_agent/data_stream/cloud_defend_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/cloud_defend_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: decision_id type: text title: Decision ID diff --git a/packages/elastic_agent/data_stream/cloudbeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/cloudbeat_logs/fields/fields.yml index 1acd8e61492..61fe833aa96 100644 --- a/packages/elastic_agent/data_stream/cloudbeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/cloudbeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: decision_id type: text title: Decision ID @@ -30,3 +29,50 @@ type: keyword ignore_above: 1024 description: Elastic agent version. + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/fields.yml index 2610256d2db..5302fe09d73 100644 --- a/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/cloudbeat_metrics/fields/fields.yml @@ -45,17 +45,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -107,25 +110,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/cloudbeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/cloudbeat_metrics/manifest.yml index 889c49b1e40..5aa2c7bee2d 100644 --- a/packages/elastic_agent/data_stream/cloudbeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/cloudbeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.cloudbeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/elastic_agent_logs/fields/fields.yml b/packages/elastic_agent/data_stream/elastic_agent_logs/fields/fields.yml index 4f90a16fc68..f8fb04af2f5 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -51,6 +50,9 @@ type: keyword ignore_above: 1024 description: Previous component health + - name: dataset + type: keyword + ignore_above: 1024 - name: unit type: group description: Agent unit that the log message is about, only available on Elastic Agent 8.6.0+ diff --git a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-stats-fields.yml b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-stats-fields.yml index 8fd2649426a..6ea4b078eca 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-stats-fields.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/beat-stats-fields.yml @@ -160,11 +160,11 @@ type: group fields: - name: running - type: short + type: long - name: starts - type: short + type: long - name: stops - type: short + type: long - name: output type: group description: > diff --git a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml index 638b77e5c83..596aa1383e0 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type diff --git a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/fields.yml index 55071a1dded..fbbdf6701ac 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_metrics/fields/fields.yml @@ -10,7 +10,7 @@ - name: process level: extended type: keyword - ignore_above: 1024 + dimension: true description: Process run by the Elastic Agent. example: metricbeat - name: snapshot @@ -51,16 +51,19 @@ The total CPU time spent by the process. - name: total.time.ms type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/elastic_agent_metrics/manifest.yml b/packages/elastic_agent/data_stream/elastic_agent_metrics/manifest.yml index 47dac922612..1a3463819c6 100644 --- a/packages/elastic_agent/data_stream/elastic_agent_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/elastic_agent_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.elastic_agent type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/endpoint_sercurity_logs/fields/fields.yml b/packages/elastic_agent/data_stream/endpoint_sercurity_logs/fields/fields.yml index 24771ec5046..504e0bb9581 100644 --- a/packages/elastic_agent/data_stream/endpoint_sercurity_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/endpoint_sercurity_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents diff --git a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/agent.yml b/packages/elastic_agent/data_stream/filebeat_input_logs/fields/agent.yml deleted file mode 100644 index 79a7a39864b..00000000000 --- a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/agent.yml +++ /dev/null @@ -1,180 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on." - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier." - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime." - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes." - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider." - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine." - - name: id - level: core - type: keyword - ignore_above: 1024 - description: "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`." - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: "Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use." - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment." - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - diff --git a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/ecs.yml b/packages/elastic_agent/data_stream/filebeat_input_logs/fields/ecs.yml deleted file mode 100644 index 638b77e5c83..00000000000 --- a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/ecs.yml +++ /dev/null @@ -1,16 +0,0 @@ -- external: ecs - name: ecs.version -- name: agent.build.original - external: ecs -- name: agent.ephemeral_id - external: ecs -- name: agent.id - external: ecs -- name: agent.name - external: ecs -- name: agent.type - external: ecs -- name: agent.version - external: ecs -- name: log.level - external: ecs diff --git a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_input_logs/fields/fields.yml deleted file mode 100644 index cb986084709..00000000000 --- a/packages/elastic_agent/data_stream/filebeat_input_logs/fields/fields.yml +++ /dev/null @@ -1,56 +0,0 @@ -- name: filebeat_input - title: Filebeat Input Metric fields - description: Fields related to the Filebeat Input Metrics - type: group - fields: - # Common static fields for all inputs - - name: id - type: keyword - description: ID of the Filebeat Input - - name: input - type: keyword - description: Filebeat Input type - # Common dynamic fields for all inputs - - name: '*.histogram.count' - type: object - object_type: long - object_type_mapping_type: "*" - description: Map all fields with `path_match:``*.histogram.count` to `long` - - name: '*.histogram.*' - type: object - object_type: double - object_type_mapping_type: "*" - description: Map all fields with `path_match:``*.histogram.*` to `double` - - name: '*_total' - type: object - object_type: long - object_type_mapping_type: "*" - description: Map all fields with `path_match:``*_total` to `long` - - name: '*_gauge' - type: object - object_type: long - object_type_mapping_type: "*" - description: Map all fields with `path_match:``*_gauge` to `long` - - name: '*_length' - type: object - object_type: long - object_type_mapping_type: "*" - description: Map all fields with `path_match:``*_length` to `long` - # CEL specific fields - - name: resource - type: keyword - description: URL-ish of CEL input resource - - name: cel_executions - type: long - description: URL-ish of input resource - # Lumberjack specific fields - - name: bind_address - type: keyword - description: Bind address of Lumberjack input. - # UDP specific fields - - name: device - type: keyword - description: Name of the UDP device being monitored - - name: system_packet_drops - type: long - description: Number of udp drops noted in /proc/net/udp diff --git a/packages/elastic_agent/data_stream/filebeat_input_logs/manifest.yml b/packages/elastic_agent/data_stream/filebeat_input_logs/manifest.yml index 2d2ceef1196..26594fb464f 100644 --- a/packages/elastic_agent/data_stream/filebeat_input_logs/manifest.yml +++ b/packages/elastic_agent/data_stream/filebeat_input_logs/manifest.yml @@ -1,3 +1,4 @@ +# Added only as a place holder to satisfy Fleet https://github.com/elastic/kibana/pull/149974. This datastream is always empty. title: Elastic Agent dataset: elastic_agent.filebeat_input type: logs diff --git a/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/ecs.yml index 638b77e5c83..dea72386a1f 100644 --- a/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/ecs.yml @@ -14,3 +14,6 @@ external: ecs - name: log.level external: ecs +- name: agent.id + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml index cb986084709..d9acaff2157 100644 --- a/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml @@ -12,29 +12,24 @@ description: Filebeat Input type # Common dynamic fields for all inputs - name: '*.histogram.count' - type: object - object_type: long - object_type_mapping_type: "*" + type: long + metric_type: gauge description: Map all fields with `path_match:``*.histogram.count` to `long` - name: '*.histogram.*' - type: object - object_type: double - object_type_mapping_type: "*" + type: double + metric_type: gauge description: Map all fields with `path_match:``*.histogram.*` to `double` - name: '*_total' - type: object - object_type: long - object_type_mapping_type: "*" + type: long + metric_type: counter description: Map all fields with `path_match:``*_total` to `long` - name: '*_gauge' - type: object - object_type: long - object_type_mapping_type: "*" + type: long + metric_type: gauge description: Map all fields with `path_match:``*_gauge` to `long` - name: '*_length' - type: object - object_type: long - object_type_mapping_type: "*" + type: long + metric_type: gauge description: Map all fields with `path_match:``*_length` to `long` # CEL specific fields - name: resource diff --git a/packages/elastic_agent/data_stream/filebeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_logs/fields/fields.yml index 24771ec5046..012b7bf3c5b 100644 --- a/packages/elastic_agent/data_stream/filebeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/filebeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,50 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/filebeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/filebeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/filebeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/filebeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/filebeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/filebeat_metrics/fields/ecs.yml index 638b77e5c83..596aa1383e0 100644 --- a/packages/elastic_agent/data_stream/filebeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/filebeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type diff --git a/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/filebeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/filebeat_metrics/manifest.yml index d3d6251b7eb..a07cf076818 100644 --- a/packages/elastic_agent/data_stream/filebeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/filebeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.filebeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/fleet_server_logs/fields/ecs.yml b/packages/elastic_agent/data_stream/fleet_server_logs/fields/ecs.yml index 638b77e5c83..65802056c30 100644 --- a/packages/elastic_agent/data_stream/fleet_server_logs/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/fleet_server_logs/fields/ecs.yml @@ -14,3 +14,19 @@ external: ecs - name: log.level external: ecs +- name: error.message + external: ecs +- name: http.request.id + external: ecs +- name: http.request.body.bytes + external: ecs +- name: http.request.method + external: ecs +- name: http.response.status_code + external: ecs +- name: http.response.body.bytes + external: ecs +- name: http.version + external: ecs +- name: url.full + external: ecs diff --git a/packages/elastic_agent/data_stream/fleet_server_logs/fields/fields.yml b/packages/elastic_agent/data_stream/fleet_server_logs/fields/fields.yml index 24771ec5046..2c3028a180d 100644 --- a/packages/elastic_agent/data_stream/fleet_server_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/fleet_server_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,27 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 +- name: policy_id + type: keyword + ignore_above: 1024 + description: The policy ID fleet-server is operating on when starting a monitor or similar internal workflow. +- name: fleet + title: Fleet Server + description: Fleet server annotations. + type: group + fields: + - name: access.apikey.id + level: extended + type: keyword + ignore_above: 1024 + description: The API key used when a fleet endpoint is accessed. + - name: agent.id + level: extended + type: keyword + ignore_above: 1024 + description: The ID of the agent interacting with a fleet endpoint. + - name: policy.id + level: extended + type: keyword + ignore_above: 1024 + description: The ID of the policy being used in a request to a fleet endpoint. diff --git a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/fleet_server_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/fleet_server_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/fleet_server_metrics/manifest.yml b/packages/elastic_agent/data_stream/fleet_server_metrics/manifest.yml index c0adf93736f..26b9f5b0570 100644 --- a/packages/elastic_agent/data_stream/fleet_server_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/fleet_server_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.fleet_server type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/heartbeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/heartbeat_logs/fields/fields.yml index 371ed822a54..5044a016cd6 100644 --- a/packages/elastic_agent/data_stream/heartbeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/heartbeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -29,3 +28,50 @@ - name: event.dataset type: constant_keyword description: Event dataset + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/heartbeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/heartbeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/heartbeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/heartbeat_metrics/manifest.yml index 012bf459270..e003deb004b 100644 --- a/packages/elastic_agent/data_stream/heartbeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/heartbeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.heartbeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/metricbeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/metricbeat_logs/fields/fields.yml index 24771ec5046..012b7bf3c5b 100644 --- a/packages/elastic_agent/data_stream/metricbeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/metricbeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,50 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/metricbeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/metricbeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/metricbeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/metricbeat_metrics/manifest.yml index 54f1bd07548..7cfc4f5e0c7 100644 --- a/packages/elastic_agent/data_stream/metricbeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/metricbeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.metricbeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/osquerybeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/osquerybeat_logs/fields/fields.yml index 24771ec5046..012b7bf3c5b 100644 --- a/packages/elastic_agent/data_stream/osquerybeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/osquerybeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,50 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/osquerybeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/osquerybeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/osquerybeat_metrics/manifest.yml index c9fa19ace36..4a21ef52bfc 100644 --- a/packages/elastic_agent/data_stream/osquerybeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/osquerybeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.osquerybeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/data_stream/packetbeat_logs/fields/fields.yml b/packages/elastic_agent/data_stream/packetbeat_logs/fields/fields.yml index 24771ec5046..012b7bf3c5b 100644 --- a/packages/elastic_agent/data_stream/packetbeat_logs/fields/fields.yml +++ b/packages/elastic_agent/data_stream/packetbeat_logs/fields/fields.yml @@ -1,6 +1,5 @@ - name: message - type: text - title: Log Message + external: ecs - name: elastic_agent title: Elastic Agent description: Fields related to the Elastic Agents @@ -26,3 +25,50 @@ ignore_above: 1024 description: Elastic agent version. example: 7.11.0 + +- name: component + type: group + description: Agent component that the log message is about, only available on Elastic Agent 8.6.0+ + fields: + - name: id + type: wildcard + ignore_above: 1024 + description: Component id + - name: type + type: keyword + ignore_above: 1024 + description: The type of the component + - name: binary + type: keyword + ignore_above: 1024 + description: The binary that exeuctes the component + example: filebeat + - name: dataset + type: keyword + ignore_above: 1024 + +# Metrics currently logged in "Non-zero metrics in the last 30s" logs +# TODO: Update Agent to move these to the "metrics" data streams +# Note: none of thes metric_type fields are used on logs data streams +- name: monitoring.metrics.libbeat.pipeline + type: group + fields: + - name: events + type: group + fields: + - name: active + type: long + metric_type: gauge + description: Number of events currently in the pipeline. The maximum size is the configured queue size plus one event per event pipeline client. + - name: published + type: long + metric_type: counter + description: Number of events published by the pipeline + - name: total + type: long + metric_type: counter + description: Number of events processed by the pipeline + - name: queue.acked + type: long + metric_type: counter + description: Number of events successfully acknowledged by the output diff --git a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/beat-fields.yml b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/beat-fields.yml index 0c063d19aee..2208b6c44f3 100644 --- a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/beat-fields.yml +++ b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/beat-fields.yml @@ -25,41 +25,49 @@ fields: - name: acked type: long + metric_type: counter description: > Number of events acknowledged - name: active type: long + metric_type: gauge description: > Number of active events - name: batches type: long + metric_type: counter description: > Number of event batches - name: dropped type: long + metric_type: counter description: > Number of events dropped - name: duplicates type: long + metric_type: counter description: > Number of events duplicated - name: failed type: long + metric_type: counter description: > Number of events failed - name: toomany type: long + metric_type: counter description: > Number of too many events - name: total type: long + metric_type: counter description: > Total number of events @@ -71,11 +79,13 @@ fields: - name: bytes type: long + metric_type: counter description: > Number of bytes written - name: errors type: long + metric_type: counter description: > Number of write errors diff --git a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/ecs.yml b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/ecs.yml index 638b77e5c83..0a55b730f10 100644 --- a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/ecs.yml +++ b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/ecs.yml @@ -6,6 +6,7 @@ external: ecs - name: agent.id external: ecs + dimension: true - name: agent.name external: ecs - name: agent.type @@ -14,3 +15,6 @@ external: ecs - name: log.level external: ecs +- name: service.address + external: ecs + dimension: true diff --git a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/fields.yml index a516126a23b..127066f5971 100644 --- a/packages/elastic_agent/data_stream/packetbeat_metrics/fields/fields.yml +++ b/packages/elastic_agent/data_stream/packetbeat_metrics/fields/fields.yml @@ -50,17 +50,20 @@ description: | The total CPU time spent by the process. - name: total.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The total CPU time spent by the process. - name: user.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in user space. - name: system.time.ms - type: date + type: long + metric_type: counter description: | - The time when the process was started. + The amount of CPU time the process spent in kernel space. - name: memory type: group fields: @@ -112,25 +115,30 @@ - name: cfs.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long unit: micros + metric_type: gauge description: | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long unit: micros + metric_type: gauge description: | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - name: stats.periods diff --git a/packages/elastic_agent/data_stream/packetbeat_metrics/manifest.yml b/packages/elastic_agent/data_stream/packetbeat_metrics/manifest.yml index 5e9feeebc10..24f6f76bde2 100644 --- a/packages/elastic_agent/data_stream/packetbeat_metrics/manifest.yml +++ b/packages/elastic_agent/data_stream/packetbeat_metrics/manifest.yml @@ -2,6 +2,7 @@ title: Elastic Agent dataset: elastic_agent.packetbeat type: metrics elasticsearch: + index_mode: "time_series" index_template: mappings: dynamic: false diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824.json index 81da6f514cc..1478a28b2fd 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n**[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)** \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboards shows more detailed health information specifically related to running Elastic Agent instances.\n\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n**[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824)** \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboards shows more detailed health information specifically related to running Elastic Agent instances.\n\n", "openLinksInNewTab": false }, "title": "", @@ -805,7 +805,7 @@ "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:54:25.234Z", + "created_at": "2023-09-06T10:34:02.860Z", "id": "elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824", "migrationVersion": { "dashboard": "8.7.0" diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824.json index f9fcf2377e8..e03e7227189 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n**[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)** \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n\n**Overview**\n\nThis dashboards visualizes the statistics and overall health of all the active integrations.\n\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n**[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824)** \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n\n**Overview**\n\nThis dashboards visualizes the statistics and overall health of all the active integrations.\n\n", "openLinksInNewTab": false }, "title": "", @@ -474,7 +474,7 @@ "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:55:03.107Z", + "created_at": "2023-09-06T10:34:02.860Z", "id": "elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824", "migrationVersion": { "dashboard": "8.7.0" diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c.json index 3310b2b215a..28a5ab92cfd 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n**[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c)** \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n**[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c)** \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2.json index 2e52e4b4a5f..e6744649c97 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n**[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2)** \n[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.** \n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n**[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2)** \n[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.** \n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2.json index a52df178376..f7e2ba23719 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n**[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2)** \n[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n**[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2)** \n[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2.json index f683339fa89..6efc6fd95f4 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n**[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2)** \n[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n**[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2)** \n[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824.json index 7075cebfcc0..3bc631ed891 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n**[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)** \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboard gives an overview of the current overall state and health of all Agents and their related enabled Integrations.\n\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n**[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824)** \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboard gives an overview of the current overall state and health of all Agents and their related enabled Integrations.\n\n", "openLinksInNewTab": false }, "title": "", @@ -66,20 +66,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-7a3dc055-1f15-4a42-b451-90a79c11e49c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e2c20fa4-7e01-4743-a82a-fc13f6d78233", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "94331d37-a953-4700-bcae-4b467884b096": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "94331d37-a953-4700-bcae-4b467884b096", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -128,7 +129,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e2c20fa4-7e01-4743-a82a-fc13f6d78233", + "index": "94331d37-a953-4700-bcae-4b467884b096", "key": "data_stream.dataset", "negate": true, "params": { @@ -143,7 +144,13 @@ } } ], - "internalReferences": [], + "internalReferences": [ + { + "id": "94331d37-a953-4700-bcae-4b467884b096", + "name": "indexpattern-datasource-layer-7a3dc055-1f15-4a42-b451-90a79c11e49c", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -230,15 +237,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "509ef00a-afdf-4b93-a616-fe6a0c1496a4": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "509ef00a-afdf-4b93-a616-fe6a0c1496a4", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -274,7 +287,13 @@ } }, "filters": [], - "internalReferences": [], + "internalReferences": [ + { + "id": "509ef00a-afdf-4b93-a616-fe6a0c1496a4", + "name": "indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -361,20 +380,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "5a27aadf-9ccb-42d0-8817-3b365bd7abbf", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "7d6635c4-3438-471c-9e45-6a1e6057a7fe": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "7d6635c4-3438-471c-9e45-6a1e6057a7fe", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -417,7 +437,7 @@ "meta": { "alias": null, "disabled": false, - "index": "5a27aadf-9ccb-42d0-8817-3b365bd7abbf", + "index": "7d6635c4-3438-471c-9e45-6a1e6057a7fe", "key": "data_stream.dataset", "negate": true, "params": { @@ -432,7 +452,13 @@ } } ], - "internalReferences": [], + "internalReferences": [ + { + "id": "7d6635c4-3438-471c-9e45-6a1e6057a7fe", + "name": "indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -519,20 +545,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-6c39da5e-0bfa-4ac0-b52c-75491ad21e8a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fbb56fc8-f301-483f-8d45-f6b2203ed246", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "cd1d606c-b055-4564-b684-4fba543190d7": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "cd1d606c-b055-4564-b684-4fba543190d7", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -591,7 +618,7 @@ "meta": { "alias": null, "disabled": false, - "index": "fbb56fc8-f301-483f-8d45-f6b2203ed246", + "index": "cd1d606c-b055-4564-b684-4fba543190d7", "key": "data_stream.dataset", "negate": true, "params": { @@ -606,7 +633,13 @@ } } ], - "internalReferences": [], + "internalReferences": [ + { + "id": "cd1d606c-b055-4564-b684-4fba543190d7", + "name": "indexpattern-datasource-layer-6c39da5e-0bfa-4ac0-b52c-75491ad21e8a", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -695,20 +728,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-468dc136-5f5c-4cd1-8569-cc8529881e52", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "aeb42231-d9f7-4e06-81cf-2d05bc0012ba", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "726233d2-67fb-4e0c-b7e0-948ded447475": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "726233d2-67fb-4e0c-b7e0-948ded447475", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -754,7 +788,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "aeb42231-d9f7-4e06-81cf-2d05bc0012ba", + "index": "726233d2-67fb-4e0c-b7e0-948ded447475", "key": "data_stream.dataset", "negate": true, "params": { @@ -769,7 +803,13 @@ } } ], - "internalReferences": [], + "internalReferences": [ + { + "id": "726233d2-67fb-4e0c-b7e0-948ded447475", + "name": "indexpattern-datasource-layer-468dc136-5f5c-4cd1-8569-cc8529881e52", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -859,20 +899,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-06e5675e-d8f9-45b5-ba57-bae75a6eab02", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0769541a-e3f2-49c1-beb8-aaf9ecf101e2", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "add3e5b6-18cd-45f2-b47a-406dd1a1e38b": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "add3e5b6-18cd-45f2-b47a-406dd1a1e38b", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -932,7 +973,7 @@ "meta": { "alias": null, "disabled": false, - "index": "0769541a-e3f2-49c1-beb8-aaf9ecf101e2", + "index": "add3e5b6-18cd-45f2-b47a-406dd1a1e38b", "key": "data_stream.dataset", "negate": true, "params": { @@ -947,7 +988,13 @@ } } ], - "internalReferences": [], + "internalReferences": [ + { + "id": "add3e5b6-18cd-45f2-b47a-406dd1a1e38b", + "name": "indexpattern-datasource-layer-06e5675e-d8f9-45b5-ba57-bae75a6eab02", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -1016,15 +1063,21 @@ { "embeddableConfig": { "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-70d7d4e3-d581-41d1-81d1-834b8f5f3ab9", - "type": "index-pattern" - } - ], + "references": [], "state": { - "adHocDataViews": {}, + "adHocDataViews": { + "29dea7d7-0df6-4723-a1f6-622575e7e12b": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "29dea7d7-0df6-4723-a1f6-622575e7e12b", + "name": "logs-*, metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*,metrics-*" + } + }, "datasourceStates": { "formBased": { "layers": { @@ -1081,7 +1134,13 @@ } }, "filters": [], - "internalReferences": [], + "internalReferences": [ + { + "id": "29dea7d7-0df6-4723-a1f6-622575e7e12b", + "name": "indexpattern-datasource-layer-70d7d4e3-d581-41d1-81d1-834b8f5f3ab9", + "type": "index-pattern" + } + ], "query": { "language": "kuery", "query": "" @@ -1181,102 +1240,42 @@ "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:53:36.738Z", + "created_at": "2023-09-06T11:50:47.518Z", "id": "elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824", "migrationVersion": { "dashboard": "8.7.0" }, "references": [ - { - "id": "logs-*", - "name": "106d153c-b2ce-497f-92a2-a6e37f3fee48:indexpattern-datasource-layer-7a3dc055-1f15-4a42-b451-90a79c11e49c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "106d153c-b2ce-497f-92a2-a6e37f3fee48:e2c20fa4-7e01-4743-a82a-fc13f6d78233", - "type": "index-pattern" - }, { "id": "elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824", "name": "106d153c-b2ce-497f-92a2-a6e37f3fee48:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:9ecd8fe7-916e-468c-a071-4ea76cf09520:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "f7fb14c3-542a-4dcb-a141-ea6f57f7ec50:indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", - "type": "index-pattern" - }, { "id": "elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824", "name": "f7fb14c3-542a-4dcb-a141-ea6f57f7ec50:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:34bc44f3-8bfe-424b-ada8-225ec0ca67a6:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "e8be8d39-4557-4077-bf45-e8c481f90699:indexpattern-datasource-layer-87b97f29-3b44-4769-8c7c-469a4d9a906f", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e8be8d39-4557-4077-bf45-e8c481f90699:5a27aadf-9ccb-42d0-8817-3b365bd7abbf", - "type": "index-pattern" - }, { "id": "elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824", "name": "e8be8d39-4557-4077-bf45-e8c481f90699:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:1c9c2911-505b-4aae-92d9-ae278ab4a378:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "b197eb2e-ee86-490c-afe1-605ce8e2edc1:indexpattern-datasource-layer-6c39da5e-0bfa-4ac0-b52c-75491ad21e8a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b197eb2e-ee86-490c-afe1-605ce8e2edc1:fbb56fc8-f301-483f-8d45-f6b2203ed246", - "type": "index-pattern" - }, { "id": "elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824", "name": "b197eb2e-ee86-490c-afe1-605ce8e2edc1:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:8b6dea27-19d8-4cbd-bc1a-cc1f5dd63544:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "d9875e32-dd5f-4084-81c5-262f7bd0ccba:indexpattern-datasource-layer-468dc136-5f5c-4cd1-8569-cc8529881e52", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d9875e32-dd5f-4084-81c5-262f7bd0ccba:aeb42231-d9f7-4e06-81cf-2d05bc0012ba", - "type": "index-pattern" - }, { "id": "elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824", "name": "d9875e32-dd5f-4084-81c5-262f7bd0ccba:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:ff1c170b-d997-40ef-9093-ca8265c8c031:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "9ea33099-240d-4f37-b154-216aaccb6f4a:indexpattern-datasource-layer-06e5675e-d8f9-45b5-ba57-bae75a6eab02", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9ea33099-240d-4f37-b154-216aaccb6f4a:0769541a-e3f2-49c1-beb8-aaf9ecf101e2", - "type": "index-pattern" - }, { "id": "elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824", "name": "9ea33099-240d-4f37-b154-216aaccb6f4a:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:7c5aeb9a-d5d0-4e3a-89c0-98bb2f46e6cc:dashboardId", "type": "dashboard" }, - { - "id": "logs-*", - "name": "6e1bf032-bd2e-45e3-804b-d630d460228a:indexpattern-datasource-layer-70d7d4e3-d581-41d1-81d1-834b8f5f3ab9", - "type": "index-pattern" - }, { "id": "elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824", "name": "6e1bf032-bd2e-45e3-804b-d630d460228a:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:00799702-30ac-4ab1-9a3e-a82aa1f0d507:dashboardId", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2.json index e386f785cb3..53ac002dbe8 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n**[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2)** \n[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Inputs** \n**[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2)** \n[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest and its related Input ID to visualize the metrics correctly.**\n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2.json index b6c960255be..1ac946e38f8 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2.json @@ -43,7 +43,7 @@ "id": "", "params": { "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n**[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2)** \n\n**Inputs** \n[Cloudwatch](/app/dashboards#/view/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](/app/dashboards#/view/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](/app/dashboards#/view/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](/app/dashboards#/view/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](/app/dashboards#/view/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest to visualize the metrics correctly. \nUse the Metric counters to Drilldown to the specific Input Dashboard.** \n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n\n", + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395) \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n**[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2)** \n\n**Inputs** \n[Cloudwatch](#/dashboard/elastic_agent-a7b5e7a0-cd44-11ed-869d-e7dc1b551cd2) \n[S3](#/dashboard/elastic_agent-77cdb1c0-cd45-11ed-869d-e7dc1b551cd2) \n[TCP](#/dashboard/elastic_agent-7d110ba0-cd45-11ed-869d-e7dc1b551cd2) \n[UDP](#/dashboard/elastic_agent-87ad4330-cd45-11ed-869d-e7dc1b551cd2) \n[Winlog](#/dashboard/elastic_agent-1badd650-d136-11ed-b85f-4be0157fc90c) \n\n\n**Overview**\n\nThis dashboards is used to monitor and troubleshoot ingest performance from integrations. \n\n**For the best experience, filter on the specific Agent of interest to visualize the metrics correctly. \nUse the Metric counters to Drilldown to the specific Input Dashboard.** \n\n**This dashboard requires that \"Collect Agent Metrics\" are configured on the relevant Elastic Agent policy.**\n\n", "openLinksInNewTab": false }, "title": "", diff --git a/packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json b/packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json index bcc1e5d9c73..9ff422d6fc3 100644 --- a/packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json +++ b/packages/elastic_agent/kibana/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395.json @@ -24,6 +24,45 @@ "useMargins": true }, "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](#/dashboard/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](#/dashboard/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n**[Agent Metrics](#/dashboard/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)** \n[Integrations](#/dashboard/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](#/dashboard/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboard is used to show detailed metrics related to the specific agent used in the filter.\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 27, + "i": "443b1597-9d5f-4b9c-8848-643d0381b2f4", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "443b1597-9d5f-4b9c-8848-643d0381b2f4", + "title": "Table of Contents", + "type": "visualization", + "version": "8.7.1" + }, { "embeddableConfig": { "enhancements": {}, @@ -146,45 +185,6 @@ "type": "visualization", "version": "8.7.1" }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "**Navigation**\n\n**Agent Health** \n\n[Overview](/app/dashboards#/view/elastic_agent-a148dc70-6b3c-11ed-98de-67bdecd21824) \n[Agent Info](/app/dashboards#/view/elastic_agent-0600ffa0-6b5e-11ed-98de-67bdecd21824) \n**[Agent Metrics](/app/dashboards#/view/elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395)** \n[Integrations](/app/dashboards#/view/elastic_agent-1a4e7280-6b5e-11ed-98de-67bdecd21824) \n[Input Metrics](/app/dashboards#/view/elastic_agent-a8192f90-cd3f-11ed-869d-e7dc1b551cd2) \n\n**Overview**\n\nThis dashboard is used to show detailed metrics related to the specific agent used in the filter.\n\n", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 27, - "i": "443b1597-9d5f-4b9c-8848-643d0381b2f4", - "w": 8, - "x": 0, - "y": 0 - }, - "panelIndex": "443b1597-9d5f-4b9c-8848-643d0381b2f4", - "title": "Table of Contents", - "type": "visualization", - "version": "8.7.1" - }, { "embeddableConfig": { "attributes": { @@ -487,12 +487,12 @@ "references": [ { "id": "metrics-*", - "name": "indexpattern-datasource-layer-47363713-6910-43c5-9f85-328b9ee18f0d", + "name": "indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", "type": "index-pattern" }, { "id": "metrics-*", - "name": "4984682b-b209-448b-a8bc-239d1858c0ae", + "name": "1f53ae6d-f631-4ef1-8da4-e1918fd352af", "type": "index-pattern" } ], @@ -501,15 +501,15 @@ "datasourceStates": { "formBased": { "layers": { - "47363713-6910-43c5-9f85-328b9ee18f0d": { + "ad65be36-0be3-4937-8f41-ec9e48adfce6": { "columnOrder": [ - "009f999d-bdb4-4b3f-a031-06d2a7173a57", - "754d7a35-095e-4905-ad7d-23d89edaf74f", - "c601246c-06f3-4f94-9d2a-a950eb4d499e", - "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b" + "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "49cd060d-6f21-4d81-ad6b-1c8462c97353", + "e201a210-6e89-4d72-9d9c-a00b036fb0eb", + "f5cbe487-2a43-425b-9cd1-40283e5e596c" ], "columns": { - "009f999d-bdb4-4b3f-a031-06d2a7173a57": { + "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a": { "dataType": "string", "isBucketed": true, "label": "Top values of beat.type", @@ -530,15 +530,7 @@ "scale": "ordinal", "sourceField": "beat.type" }, - "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b": { - "dataType": "number", - "isBucketed": false, - "label": "Maximum of beat.stats.libbeat.output.write.bytes", - "operationType": "max", - "scale": "ratio", - "sourceField": "beat.stats.libbeat.output.write.bytes" - }, - "754d7a35-095e-4905-ad7d-23d89edaf74f": { + "49cd060d-6f21-4d81-ad6b-1c8462c97353": { "dataType": "date", "isBucketed": true, "label": "@timestamp", @@ -551,7 +543,7 @@ "scale": "interval", "sourceField": "@timestamp" }, - "c601246c-06f3-4f94-9d2a-a950eb4d499e": { + "e201a210-6e89-4d72-9d9c-a00b036fb0eb": { "customLabel": true, "dataType": "number", "filter": { @@ -559,21 +551,21 @@ "query": "data_stream.dataset : \"elastic_agent.*\" " }, "isBucketed": false, - "label": "Bytes sent/s", + "label": "Events Rate /s", "operationType": "counter_rate", - "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } - } - }, "references": [ - "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b" + "f5cbe487-2a43-425b-9cd1-40283e5e596c" ], "scale": "ratio", "timeScale": "s" + }, + "f5cbe487-2a43-425b-9cd1-40283e5e596c": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of beat.stats.libbeat.output.events.total", + "operationType": "max", + "scale": "ratio", + "sourceField": "beat.stats.libbeat.output.events.total" } }, "incompleteColumns": {} @@ -589,7 +581,7 @@ "meta": { "alias": null, "disabled": false, - "index": "4984682b-b209-448b-a8bc-239d1858c0ae", + "index": "1f53ae6d-f631-4ef1-8da4-e1918fd352af", "key": "data_stream.dataset", "negate": false, "params": { @@ -629,15 +621,15 @@ "layers": [ { "accessors": [ - "c601246c-06f3-4f94-9d2a-a950eb4d499e" + "e201a210-6e89-4d72-9d9c-a00b036fb0eb" ], - "layerId": "47363713-6910-43c5-9f85-328b9ee18f0d", + "layerId": "ad65be36-0be3-4937-8f41-ec9e48adfce6", "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "009f999d-bdb4-4b3f-a031-06d2a7173a57", - "xAccessor": "754d7a35-095e-4905-ad7d-23d89edaf74f" + "splitAccessor": "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "xAccessor": "49cd060d-6f21-4d81-ad6b-1c8462c97353" } ], "legend": { @@ -669,13 +661,13 @@ }, "gridData": { "h": 9, - "i": "daff36f6-d0b5-45e8-b0d9-910bace3c15b", + "i": "6f1753a7-612d-4e25-a33f-8aa3542d3c39", "w": 24, - "x": 24, + "x": 0, "y": 27 }, - "panelIndex": "daff36f6-d0b5-45e8-b0d9-910bace3c15b", - "title": "[Elastic Agent] Output write throughput", + "panelIndex": "6f1753a7-612d-4e25-a33f-8aa3542d3c39", + "title": "[Elastic Agent] Total events rate /s", "type": "lens", "version": "8.7.1" }, @@ -685,12 +677,12 @@ "references": [ { "id": "metrics-*", - "name": "indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "name": "indexpattern-datasource-layer-47363713-6910-43c5-9f85-328b9ee18f0d", "type": "index-pattern" }, { "id": "metrics-*", - "name": "1f53ae6d-f631-4ef1-8da4-e1918fd352af", + "name": "4984682b-b209-448b-a8bc-239d1858c0ae", "type": "index-pattern" } ], @@ -699,15 +691,15 @@ "datasourceStates": { "formBased": { "layers": { - "ad65be36-0be3-4937-8f41-ec9e48adfce6": { + "47363713-6910-43c5-9f85-328b9ee18f0d": { "columnOrder": [ - "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", - "49cd060d-6f21-4d81-ad6b-1c8462c97353", - "e201a210-6e89-4d72-9d9c-a00b036fb0eb", - "f5cbe487-2a43-425b-9cd1-40283e5e596c" + "009f999d-bdb4-4b3f-a031-06d2a7173a57", + "754d7a35-095e-4905-ad7d-23d89edaf74f", + "c601246c-06f3-4f94-9d2a-a950eb4d499e", + "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b" ], "columns": { - "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a": { + "009f999d-bdb4-4b3f-a031-06d2a7173a57": { "dataType": "string", "isBucketed": true, "label": "Top values of beat.type", @@ -728,7 +720,15 @@ "scale": "ordinal", "sourceField": "beat.type" }, - "49cd060d-6f21-4d81-ad6b-1c8462c97353": { + "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of beat.stats.libbeat.output.write.bytes", + "operationType": "max", + "scale": "ratio", + "sourceField": "beat.stats.libbeat.output.write.bytes" + }, + "754d7a35-095e-4905-ad7d-23d89edaf74f": { "dataType": "date", "isBucketed": true, "label": "@timestamp", @@ -741,7 +741,7 @@ "scale": "interval", "sourceField": "@timestamp" }, - "e201a210-6e89-4d72-9d9c-a00b036fb0eb": { + "c601246c-06f3-4f94-9d2a-a950eb4d499e": { "customLabel": true, "dataType": "number", "filter": { @@ -749,21 +749,21 @@ "query": "data_stream.dataset : \"elastic_agent.*\" " }, "isBucketed": false, - "label": "Events Rate /s", + "label": "Bytes sent/s", "operationType": "counter_rate", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, "references": [ - "f5cbe487-2a43-425b-9cd1-40283e5e596c" + "672c59a5-1ad7-4f2b-89a5-cb3920d94e4b" ], "scale": "ratio", "timeScale": "s" - }, - "f5cbe487-2a43-425b-9cd1-40283e5e596c": { - "dataType": "number", - "isBucketed": false, - "label": "Maximum of beat.stats.libbeat.output.events.total", - "operationType": "max", - "scale": "ratio", - "sourceField": "beat.stats.libbeat.output.events.total" } }, "incompleteColumns": {} @@ -779,7 +779,7 @@ "meta": { "alias": null, "disabled": false, - "index": "1f53ae6d-f631-4ef1-8da4-e1918fd352af", + "index": "4984682b-b209-448b-a8bc-239d1858c0ae", "key": "data_stream.dataset", "negate": false, "params": { @@ -819,15 +819,15 @@ "layers": [ { "accessors": [ - "e201a210-6e89-4d72-9d9c-a00b036fb0eb" + "c601246c-06f3-4f94-9d2a-a950eb4d499e" ], - "layerId": "ad65be36-0be3-4937-8f41-ec9e48adfce6", + "layerId": "47363713-6910-43c5-9f85-328b9ee18f0d", "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", - "xAccessor": "49cd060d-6f21-4d81-ad6b-1c8462c97353" + "splitAccessor": "009f999d-bdb4-4b3f-a031-06d2a7173a57", + "xAccessor": "754d7a35-095e-4905-ad7d-23d89edaf74f" } ], "legend": { @@ -859,13 +859,13 @@ }, "gridData": { "h": 9, - "i": "6f1753a7-612d-4e25-a33f-8aa3542d3c39", + "i": "daff36f6-d0b5-45e8-b0d9-910bace3c15b", "w": 24, - "x": 0, + "x": 24, "y": 27 }, - "panelIndex": "6f1753a7-612d-4e25-a33f-8aa3542d3c39", - "title": "[Elastic Agent] Total events rate /s", + "panelIndex": "daff36f6-d0b5-45e8-b0d9-910bace3c15b", + "title": "[Elastic Agent] Output write throughput", "type": "lens", "version": "8.7.1" }, @@ -880,7 +880,7 @@ }, { "id": "metrics-*", - "name": "d8c4f995-b5b9-4da1-9c7c-32fd11cfbcee", + "name": "9ef414bb-7c9f-40b2-a01f-da090834917a", "type": "index-pattern" } ], @@ -891,16 +891,30 @@ "layers": { "ad65be36-0be3-4937-8f41-ec9e48adfce6": { "columnOrder": [ - "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541", "49cd060d-6f21-4d81-ad6b-1c8462c97353", "e201a210-6e89-4d72-9d9c-a00b036fb0eb", "f5cbe487-2a43-425b-9cd1-40283e5e596c" ], "columns": { - "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a": { + "49cd060d-6f21-4d81-ad6b-1c8462c97353": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541": { + "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top values of beat.type", + "label": "Beat types", "operationType": "terms", "params": { "missingBucket": false, @@ -909,7 +923,7 @@ "type": "alphabetical" }, "orderDirection": "asc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -918,19 +932,6 @@ "scale": "ordinal", "sourceField": "beat.type" }, - "49cd060d-6f21-4d81-ad6b-1c8462c97353": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": true, - "includeEmptyRows": false, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, "e201a210-6e89-4d72-9d9c-a00b036fb0eb": { "customLabel": true, "dataType": "number", @@ -939,7 +940,7 @@ "query": "data_stream.dataset : \"elastic_agent.*\" " }, "isBucketed": false, - "label": "Events Rate /s", + "label": "Output Errors", "operationType": "counter_rate", "references": [ "f5cbe487-2a43-425b-9cd1-40283e5e596c" @@ -950,10 +951,10 @@ "f5cbe487-2a43-425b-9cd1-40283e5e596c": { "dataType": "number", "isBucketed": false, - "label": "Maximum of beat.stats.libbeat.output.events.acked", + "label": "Maximum of beat.stats.libbeat.output.write.errors", "operationType": "max", "scale": "ratio", - "sourceField": "beat.stats.libbeat.output.events.acked" + "sourceField": "beat.stats.libbeat.output.write.errors" } }, "incompleteColumns": {} @@ -969,7 +970,7 @@ "meta": { "alias": null, "disabled": false, - "index": "d8c4f995-b5b9-4da1-9c7c-32fd11cfbcee", + "index": "9ef414bb-7c9f-40b2-a01f-da090834917a", "key": "data_stream.dataset", "negate": false, "params": { @@ -1016,7 +1017,7 @@ "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "splitAccessor": "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541", "xAccessor": "49cd060d-6f21-4d81-ad6b-1c8462c97353" } ], @@ -1049,7 +1050,197 @@ }, "gridData": { "h": 9, - "i": "b1dcfde7-66f1-41fb-bc7d-d3deef840d4f", + "i": "0165de2d-694a-40f5-95e1-855ce4ebd03e", + "w": 24, + "x": 0, + "y": 36 + }, + "panelIndex": "0165de2d-694a-40f5-95e1-855ce4ebd03e", + "title": "[Elastic Agent] Output write errors", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "d8c4f995-b5b9-4da1-9c7c-32fd11cfbcee", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ad65be36-0be3-4937-8f41-ec9e48adfce6": { + "columnOrder": [ + "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "49cd060d-6f21-4d81-ad6b-1c8462c97353", + "e201a210-6e89-4d72-9d9c-a00b036fb0eb", + "f5cbe487-2a43-425b-9cd1-40283e5e596c" + ], + "columns": { + "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of beat.type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beat.type" + }, + "49cd060d-6f21-4d81-ad6b-1c8462c97353": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e201a210-6e89-4d72-9d9c-a00b036fb0eb": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "data_stream.dataset : \"elastic_agent.*\" " + }, + "isBucketed": false, + "label": "Events Rate /s", + "operationType": "counter_rate", + "references": [ + "f5cbe487-2a43-425b-9cd1-40283e5e596c" + ], + "scale": "ratio", + "timeScale": "s" + }, + "f5cbe487-2a43-425b-9cd1-40283e5e596c": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of beat.stats.libbeat.output.events.acked", + "operationType": "max", + "scale": "ratio", + "sourceField": "beat.stats.libbeat.output.events.acked" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d8c4f995-b5b9-4da1-9c7c-32fd11cfbcee", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "elastic_agent.*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "elastic_agent.*" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e201a210-6e89-4d72-9d9c-a00b036fb0eb" + ], + "layerId": "ad65be36-0be3-4937-8f41-ec9e48adfce6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "2e112c50-5bc4-4c0b-a69b-8c17e0f9fc0a", + "xAccessor": "49cd060d-6f21-4d81-ad6b-1c8462c97353" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "b1dcfde7-66f1-41fb-bc7d-d3deef840d4f", "w": 24, "x": 24, "y": 36 @@ -1070,7 +1261,7 @@ }, { "id": "metrics-*", - "name": "9ef414bb-7c9f-40b2-a01f-da090834917a", + "name": "ea5a0af6-28f9-412b-bbd7-99c48037b794", "type": "index-pattern" } ], @@ -1130,7 +1321,7 @@ "query": "data_stream.dataset : \"elastic_agent.*\" " }, "isBucketed": false, - "label": "Output Errors", + "label": "Batches sent/s", "operationType": "counter_rate", "references": [ "f5cbe487-2a43-425b-9cd1-40283e5e596c" @@ -1141,10 +1332,10 @@ "f5cbe487-2a43-425b-9cd1-40283e5e596c": { "dataType": "number", "isBucketed": false, - "label": "Maximum of beat.stats.libbeat.output.write.errors", + "label": "Batches sent/s", "operationType": "max", "scale": "ratio", - "sourceField": "beat.stats.libbeat.output.write.errors" + "sourceField": "beat.stats.libbeat.output.events.batches" } }, "incompleteColumns": {} @@ -1160,7 +1351,7 @@ "meta": { "alias": null, "disabled": false, - "index": "9ef414bb-7c9f-40b2-a01f-da090834917a", + "index": "ea5a0af6-28f9-412b-bbd7-99c48037b794", "key": "data_stream.dataset", "negate": false, "params": { @@ -1231,23 +1422,549 @@ "yRightExtent": { "mode": "full" } - } + } + }, + "title": "[Elastic Agent] Output write errors (copy)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "1a30ba18-2c22-4935-b245-6ec8f1a37ced", + "w": 24, + "x": 0, + "y": 45 + }, + "panelIndex": "1a30ba18-2c22-4935-b245-6ec8f1a37ced", + "title": "[Elastic Agent] Output write batches", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a867faed-481f-461e-9416-0b99b025f7a8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ad65be36-0be3-4937-8f41-ec9e48adfce6": { + "columnOrder": [ + "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541", + "49cd060d-6f21-4d81-ad6b-1c8462c97353", + "e201a210-6e89-4d72-9d9c-a00b036fb0eb" + ], + "columns": { + "49cd060d-6f21-4d81-ad6b-1c8462c97353": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Beat types", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "e201a210-6e89-4d72-9d9c-a00b036fb0eb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "beat.type" + }, + "e201a210-6e89-4d72-9d9c-a00b036fb0eb": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "beat.type:*" + }, + "isBucketed": false, + "label": "Batch size", + "operationType": "max", + "scale": "ratio", + "sourceField": "beat.stats.libbeat.output.events.active", + "timeScale": "s" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a867faed-481f-461e-9416-0b99b025f7a8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "elastic_agent.*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "elastic_agent.*" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e201a210-6e89-4d72-9d9c-a00b036fb0eb" + ], + "layerId": "ad65be36-0be3-4937-8f41-ec9e48adfce6", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "cb2f461c-587a-4f6a-8ad4-e4b0f61c9541", + "xAccessor": "49cd060d-6f21-4d81-ad6b-1c8462c97353" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "[Elastic Agent] Output write errors (copy)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "d004044a-99f4-44fa-964a-361accd1810d", + "w": 24, + "x": 24, + "y": 45 + }, + "panelIndex": "d004044a-99f4-44fa-964a-361accd1810d", + "title": "[Elastic Agent] Output batch size", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-38cd2447-deab-49b7-9d84-400f2ba12511", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "97ad75be-db47-4cb4-bb1e-0c0320d04edd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "38cd2447-deab-49b7-9d84-400f2ba12511": { + "columnOrder": [ + "0a3d2e1f-e2f5-4001-b02b-927904b0ab94", + "6093c949-5f5d-4c72-baba-5a84ce2f1a9b", + "c37367a6-4c26-4f3f-86eb-10db67933171" + ], + "columns": { + "0a3d2e1f-e2f5-4001-b02b-927904b0ab94": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of component.id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c37367a6-4c26-4f3f-86eb-10db67933171", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "component.id" + }, + "6093c949-5f5d-4c72-baba-5a84ce2f1a9b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c37367a6-4c26-4f3f-86eb-10db67933171": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Queue depth", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "monitoring.metrics.libbeat.pipeline.events.active" + } + }, + "incompleteColumns": {}, + "linkToLayers": [], + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "97ad75be-db47-4cb4-bb1e-0c0320d04edd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "elastic_agent.*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "elastic_agent.*" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c37367a6-4c26-4f3f-86eb-10db67933171" + ], + "layerId": "38cd2447-deab-49b7-9d84-400f2ba12511", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "0a3d2e1f-e2f5-4001-b02b-927904b0ab94", + "xAccessor": "6093c949-5f5d-4c72-baba-5a84ce2f1a9b" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "[Elastic Agent] Queue depth", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "9bbe71b3-01b6-4eb3-bac0-90ea2437d0d1", + "w": 24, + "x": 24, + "y": 54 + }, + "panelIndex": "9bbe71b3-01b6-4eb3-bac0-90ea2437d0d1", + "title": "[Elastic Agent] Queue depth", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "elastic_agent.elastic_agent" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "elastic_agent.elastic_agent" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "axis_formatter": "number", + "axis_position": "left", + "axis_scale": "normal", + "drop_last_bucket": 0, + "filter": { + "language": "kuery", + "query": "" + }, + "id": "f0383b91-4a09-4b03-a013-f5938add6bfa", + "index_pattern_ref_name": "metrics_42ec7297-eb0f-492b-bb18-d1301fa1ead7_0_index_pattern", + "interval": "", + "isModelInvalid": false, + "max_lines_legend": 1, + "series": [ + { + "axis_position": "right", + "chart_type": "line", + "color": "#68BC00", + "fill": 0.5, + "filter": { + "language": "kuery", + "query": "" + }, + "formatter": "number", + "id": "a35c4256-5cee-4b6a-ae21-bdd0f0f6d4a2", + "label": "Cgroup CPU usage", + "line_width": 1, + "metrics": [ + { + "field": "system.process.cgroup.cpuacct.total.ns", + "id": "458710e3-e78d-4ebf-b9c7-3b1ca8bfc55a", + "type": "max" + }, + { + "field": "system.process.cgroup.cpu.cfs.quota.us", + "id": "5a08b810-fc31-11eb-9d3e-9d72967e3395", + "type": "min" + }, + { + "field": "458710e3-e78d-4ebf-b9c7-3b1ca8bfc55a", + "id": "391dc9f0-fc32-11eb-9d3e-9d72967e3395", + "type": "derivative", + "unit": "1s" + }, + { + "field": "90f31960-fc31-11eb-9d3e-9d72967e3395", + "id": "4661f000-fc32-11eb-9d3e-9d72967e3395", + "type": "derivative", + "unit": "1s" + }, + { + "field": "system.process.cgroup.cpu.stats.periods", + "id": "90f31960-fc31-11eb-9d3e-9d72967e3395", + "type": "max" + }, + { + "id": "5c737680-fc31-11eb-9d3e-9d72967e3395", + "script": "\n if (params.deltaUsageDerivNormalizedValue \u003e 0 \u0026\u0026 params.periodsDerivNormalizedValue \u003e0 \u0026\u0026 params.quota \u003e 0) {\n // if throttling is configured\n double factor = params.deltaUsageDerivNormalizedValue / (params.periodsDerivNormalizedValue * params.quota * 1000); \n\n return factor * 100; \n }\n\n return null;", + "type": "calculation", + "variables": [ + { + "field": "391dc9f0-fc32-11eb-9d3e-9d72967e3395", + "id": "60300950-fc31-11eb-9d3e-9d72967e3395", + "name": "deltaUsageDerivNormalizedValue" + }, + { + "field": "4661f000-fc32-11eb-9d3e-9d72967e3395", + "id": "d6060d50-fc31-11eb-9d3e-9d72967e3395", + "name": "periodsDerivNormalizedValue" + }, + { + "field": "5a08b810-fc31-11eb-9d3e-9d72967e3395", + "id": "e3368450-fc31-11eb-9d3e-9d72967e3395", + "name": "quota" + } + ] + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "point_size": 1, + "separate_axis": 0, + "split_mode": "terms", + "stacked": "stacked", + "terms_field": "elastic_agent.process", + "time_range_mode": "entire_time_range", + "type": "timeseries", + "value_template": "{{value}}%" + } + ], + "show_grid": 1, + "show_legend": 1, + "time_field": "@timestamp", + "time_range_mode": "entire_time_range", + "tooltip_mode": "show_all", + "truncate_legend": 1, + "type": "timeseries", + "use_kibana_indexes": true }, - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + "type": "metrics", + "uiState": {} + } }, "gridData": { "h": 9, - "i": "0165de2d-694a-40f5-95e1-855ce4ebd03e", + "i": "42ec7297-eb0f-492b-bb18-d1301fa1ead7", "w": 24, "x": 0, - "y": 36 + "y": 54 }, - "panelIndex": "0165de2d-694a-40f5-95e1-855ce4ebd03e", - "title": "[Elastic Agent] Output write errors", - "type": "lens", + "panelIndex": "42ec7297-eb0f-492b-bb18-d1301fa1ead7", + "title": "[Elastic Agent] CGroup CPU Usage", + "type": "visualization", "version": "8.7.1" }, { @@ -1440,167 +2157,12 @@ "i": "e651fb9f-763d-4c9d-80d7-7c56adb98883", "w": 24, "x": 24, - "y": 45 + "y": 63 }, "panelIndex": "e651fb9f-763d-4c9d-80d7-7c56adb98883", "title": "[Elastic Agent] Cgroup Memory Usage", "type": "lens", "version": "8.7.1" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "elastic_agent.elastic_agent" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "elastic_agent.elastic_agent" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "" - }, - "id": "f0383b91-4a09-4b03-a013-f5938add6bfa", - "index_pattern_ref_name": "metrics_42ec7297-eb0f-492b-bb18-d1301fa1ead7_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "" - }, - "formatter": "number", - "id": "a35c4256-5cee-4b6a-ae21-bdd0f0f6d4a2", - "label": "Cgroup CPU usage", - "line_width": 1, - "metrics": [ - { - "field": "system.process.cgroup.cpuacct.total.ns", - "id": "458710e3-e78d-4ebf-b9c7-3b1ca8bfc55a", - "type": "max" - }, - { - "field": "system.process.cgroup.cpu.cfs.quota.us", - "id": "5a08b810-fc31-11eb-9d3e-9d72967e3395", - "type": "min" - }, - { - "field": "458710e3-e78d-4ebf-b9c7-3b1ca8bfc55a", - "id": "391dc9f0-fc32-11eb-9d3e-9d72967e3395", - "type": "derivative", - "unit": "1s" - }, - { - "field": "90f31960-fc31-11eb-9d3e-9d72967e3395", - "id": "4661f000-fc32-11eb-9d3e-9d72967e3395", - "type": "derivative", - "unit": "1s" - }, - { - "field": "system.process.cgroup.cpu.stats.periods", - "id": "90f31960-fc31-11eb-9d3e-9d72967e3395", - "type": "max" - }, - { - "id": "5c737680-fc31-11eb-9d3e-9d72967e3395", - "script": "\n if (params.deltaUsageDerivNormalizedValue \u003e 0 \u0026\u0026 params.periodsDerivNormalizedValue \u003e0 \u0026\u0026 params.quota \u003e 0) {\n // if throttling is configured\n double factor = params.deltaUsageDerivNormalizedValue / (params.periodsDerivNormalizedValue * params.quota * 1000); \n\n return factor * 100; \n }\n\n return null;", - "type": "calculation", - "variables": [ - { - "field": "391dc9f0-fc32-11eb-9d3e-9d72967e3395", - "id": "60300950-fc31-11eb-9d3e-9d72967e3395", - "name": "deltaUsageDerivNormalizedValue" - }, - { - "field": "4661f000-fc32-11eb-9d3e-9d72967e3395", - "id": "d6060d50-fc31-11eb-9d3e-9d72967e3395", - "name": "periodsDerivNormalizedValue" - }, - { - "field": "5a08b810-fc31-11eb-9d3e-9d72967e3395", - "id": "e3368450-fc31-11eb-9d3e-9d72967e3395", - "name": "quota" - } - ] - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "terms", - "stacked": "stacked", - "terms_field": "elastic_agent.process", - "time_range_mode": "entire_time_range", - "type": "timeseries", - "value_template": "{{value}}%" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": true - }, - "type": "metrics", - "uiState": {} - } - }, - "gridData": { - "h": 9, - "i": "42ec7297-eb0f-492b-bb18-d1301fa1ead7", - "w": 24, - "x": 0, - "y": 45 - }, - "panelIndex": "42ec7297-eb0f-492b-bb18-d1301fa1ead7", - "title": "[Elastic Agent] CGroup CPU Usage", - "type": "visualization", - "version": "8.7.1" } ], "timeRestore": false, @@ -1608,7 +2170,7 @@ "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:54:53.566Z", + "created_at": "2023-08-30T14:21:48.118Z", "id": "elastic_agent-f47f18cc-9c7d-4278-b2ea-a6dee816d395", "migrationVersion": { "dashboard": "8.7.0" @@ -1629,6 +2191,16 @@ "name": "3f8fc111-60c1-4886-bb6d-3b83cdcf88c5:indexpattern-datasource-layer-46ce3b62-69c2-45c5-bfb2-8eadce526ad1", "type": "index-pattern" }, + { + "id": "metrics-*", + "name": "6f1753a7-612d-4e25-a33f-8aa3542d3c39:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "6f1753a7-612d-4e25-a33f-8aa3542d3c39:1f53ae6d-f631-4ef1-8da4-e1918fd352af", + "type": "index-pattern" + }, { "id": "metrics-*", "name": "daff36f6-d0b5-45e8-b0d9-910bace3c15b:indexpattern-datasource-layer-47363713-6910-43c5-9f85-328b9ee18f0d", @@ -1641,12 +2213,12 @@ }, { "id": "metrics-*", - "name": "6f1753a7-612d-4e25-a33f-8aa3542d3c39:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "name": "0165de2d-694a-40f5-95e1-855ce4ebd03e:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", "type": "index-pattern" }, { "id": "metrics-*", - "name": "6f1753a7-612d-4e25-a33f-8aa3542d3c39:1f53ae6d-f631-4ef1-8da4-e1918fd352af", + "name": "0165de2d-694a-40f5-95e1-855ce4ebd03e:9ef414bb-7c9f-40b2-a01f-da090834917a", "type": "index-pattern" }, { @@ -1661,22 +2233,32 @@ }, { "id": "metrics-*", - "name": "0165de2d-694a-40f5-95e1-855ce4ebd03e:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", + "name": "1a30ba18-2c22-4935-b245-6ec8f1a37ced:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", "type": "index-pattern" }, { "id": "metrics-*", - "name": "0165de2d-694a-40f5-95e1-855ce4ebd03e:9ef414bb-7c9f-40b2-a01f-da090834917a", + "name": "1a30ba18-2c22-4935-b245-6ec8f1a37ced:ea5a0af6-28f9-412b-bbd7-99c48037b794", "type": "index-pattern" }, { "id": "metrics-*", - "name": "e651fb9f-763d-4c9d-80d7-7c56adb98883:indexpattern-datasource-layer-fa212775-2294-4cb0-a671-eb76e6856d14", + "name": "d004044a-99f4-44fa-964a-361accd1810d:indexpattern-datasource-layer-ad65be36-0be3-4937-8f41-ec9e48adfce6", "type": "index-pattern" }, { "id": "metrics-*", - "name": "e651fb9f-763d-4c9d-80d7-7c56adb98883:indexpattern-datasource-layer-c7cc9cd8-585a-4078-a86f-8b0213c874fd", + "name": "d004044a-99f4-44fa-964a-361accd1810d:a867faed-481f-461e-9416-0b99b025f7a8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9bbe71b3-01b6-4eb3-bac0-90ea2437d0d1:indexpattern-datasource-layer-38cd2447-deab-49b7-9d84-400f2ba12511", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9bbe71b3-01b6-4eb3-bac0-90ea2437d0d1:97ad75be-db47-4cb4-bb1e-0c0320d04edd", "type": "index-pattern" }, { @@ -1689,6 +2271,16 @@ "name": "42ec7297-eb0f-492b-bb18-d1301fa1ead7:metrics_42ec7297-eb0f-492b-bb18-d1301fa1ead7_0_index_pattern", "type": "index-pattern" }, + { + "id": "metrics-*", + "name": "e651fb9f-763d-4c9d-80d7-7c56adb98883:indexpattern-datasource-layer-fa212775-2294-4cb0-a671-eb76e6856d14", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e651fb9f-763d-4c9d-80d7-7c56adb98883:indexpattern-datasource-layer-c7cc9cd8-585a-4078-a86f-8b0213c874fd", + "type": "index-pattern" + }, { "id": "metrics-*", "name": "controlGroup_2678bf39-3def-453e-9f30-2904bc88efe9:optionsListDataView", diff --git a/packages/elastic_agent/kibana/search/elastic_agent-462b68c0-b10b-11ed-957f-f1c897630287.json b/packages/elastic_agent/kibana/search/elastic_agent-462b68c0-b10b-11ed-957f-f1c897630287.json index 59ae423f0ce..d976bd205c2 100644 --- a/packages/elastic_agent/kibana/search/elastic_agent-462b68c0-b10b-11ed-957f-f1c897630287.json +++ b/packages/elastic_agent/kibana/search/elastic_agent-462b68c0-b10b-11ed-957f-f1c897630287.json @@ -35,7 +35,7 @@ "usesAdHocDataView": false }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:30:29.478Z", + "created_at": "2023-09-06T10:34:02.860Z", "id": "elastic_agent-462b68c0-b10b-11ed-957f-f1c897630287", "migrationVersion": { "search": "8.0.0" diff --git a/packages/elastic_agent/kibana/search/elastic_agent-522c9e20-ad53-11ed-957f-f1c897630287.json b/packages/elastic_agent/kibana/search/elastic_agent-522c9e20-ad53-11ed-957f-f1c897630287.json index b790221eddc..e3ee87c8008 100644 --- a/packages/elastic_agent/kibana/search/elastic_agent-522c9e20-ad53-11ed-957f-f1c897630287.json +++ b/packages/elastic_agent/kibana/search/elastic_agent-522c9e20-ad53-11ed-957f-f1c897630287.json @@ -78,7 +78,7 @@ "usesAdHocDataView": false }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-04T11:30:29.478Z", + "created_at": "2023-09-06T10:34:02.860Z", "id": "elastic_agent-522c9e20-ad53-11ed-957f-f1c897630287", "migrationVersion": { "search": "8.0.0" diff --git a/packages/elastic_agent/manifest.yml b/packages/elastic_agent/manifest.yml index bd00002d53d..52b893401c8 100644 --- a/packages/elastic_agent/manifest.yml +++ b/packages/elastic_agent/manifest.yml @@ -1,13 +1,13 @@ name: elastic_agent title: Elastic Agent -version: 1.8.0 +version: 1.13.1 description: Collect logs and metrics from Elastic Agents. type: integration format_version: 1.0.0 license: basic categories: ["elastic_stack"] conditions: - kibana.version: "^8.7.1" + kibana.version: "^8.9.0" owner: github: elastic/elastic-agent icons: diff --git a/packages/elastic_package_registry/changelog.yml b/packages/elastic_package_registry/changelog.yml index 3dffddbd5ba..6cc95d654ed 100644 --- a/packages/elastic_package_registry/changelog.yml +++ b/packages/elastic_package_registry/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.1.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/7054 - version: "0.0.7" changes: - description: Fix invalid TSDS metric type for package_registry.start_time field diff --git a/packages/elastic_package_registry/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml b/packages/elastic_package_registry/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml index ae64b0c4801..6acb4d962a9 100644 --- a/packages/elastic_package_registry/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml +++ b/packages/elastic_package_registry/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml @@ -86,6 +86,8 @@ processors: } on_failure: - set: + field: event.kind + value: pipeline_error + - append: field: error.message - value: '{{ _ingest.on_failure_message }}' - + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/elastic_package_registry/manifest.yml b/packages/elastic_package_registry/manifest.yml index b8a41f9b57f..ea625759460 100644 --- a/packages/elastic_package_registry/manifest.yml +++ b/packages/elastic_package_registry/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: elastic_package_registry title: "Elastic Package Registry" -version: 0.0.7 +version: 0.1.0 description: "Collect metrics from a Elastic Package Registry instance" type: integration categories: diff --git a/packages/elasticsearch/changelog.yml b/packages/elasticsearch/changelog.yml index afb4531aa96..6741133f734 100644 --- a/packages/elasticsearch/changelog.yml +++ b/packages/elasticsearch/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.10.0" + changes: + - description: Add support for api_key authentication + type: enhancement + link: https://github.com/elastic/integrations/pull/7637 +- version: "1.9.0" + changes: + - description: Enable time series data streams for the metrics datasets Index, Index Summary, Index Recovery, ML Job, Ingest Pipeline, Node and Node Stats. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html + type: enhancement + link: https://github.com/elastic/integrations/pull/6861 - version: "1.8.1" changes: - description: Add metric_type mapping for the fields of metrics datasets to support TSDB. diff --git a/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs index 7e63bdf8ae7..1b5dbca372f 100644 --- a/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs index c9fcaa8732b..009433c8128 100644 --- a/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs index 516dcd1ced1..22a2a68cf87 100644 --- a/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs index d31882fa7ca..788127f47a4 100644 --- a/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/index/manifest.yml b/packages/elasticsearch/data_stream/index/manifest.yml index a71006240cf..b7074671545 100644 --- a/packages/elasticsearch/data_stream/index/manifest.yml +++ b/packages/elasticsearch/data_stream/index/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Index metrics diff --git a/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs index e7602621fda..27956a588e5 100644 --- a/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs @@ -11,6 +11,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -25,4 +28,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/index_recovery/manifest.yml b/packages/elasticsearch/data_stream/index_recovery/manifest.yml index abb1a66eec7..5153f74b6ce 100644 --- a/packages/elasticsearch/data_stream/index_recovery/manifest.yml +++ b/packages/elasticsearch/data_stream/index_recovery/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Index recovery metrics diff --git a/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs index e98e753be10..8f9d6eed8f9 100644 --- a/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/index_summary/manifest.yml b/packages/elasticsearch/data_stream/index_summary/manifest.yml index 5de872110af..fe6e0ed772e 100644 --- a/packages/elasticsearch/data_stream/index_summary/manifest.yml +++ b/packages/elasticsearch/data_stream/index_summary/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Index summary metrics diff --git a/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs index c3735261340..cb28b8febce 100644 --- a/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} diff --git a/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml b/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml index a44f0a2ab33..7c7d10972dd 100644 --- a/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml +++ b/packages/elasticsearch/data_stream/ingest_pipeline/manifest.yml @@ -7,6 +7,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Ingest Pipeline metrics diff --git a/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs index 6e9de5fca1e..c1ecc3f727d 100644 --- a/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/ml_job/manifest.yml b/packages/elasticsearch/data_stream/ml_job/manifest.yml index 591dd9c4900..d68407982ac 100644 --- a/packages/elasticsearch/data_stream/ml_job/manifest.yml +++ b/packages/elasticsearch/data_stream/ml_job/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Anomaly detection machine learning job metrics diff --git a/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs index 463a0625b87..d48813bc6d5 100644 --- a/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/node/manifest.yml b/packages/elasticsearch/data_stream/node/manifest.yml index a595309fdcc..34ceae8ea4e 100644 --- a/packages/elasticsearch/data_stream/node/manifest.yml +++ b/packages/elasticsearch/data_stream/node/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Node metrics diff --git a/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs index b94fe55803c..22540bbc057 100644 --- a/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/node_stats/manifest.yml b/packages/elasticsearch/data_stream/node_stats/manifest.yml index 8331403a63b..c27874da091 100644 --- a/packages/elasticsearch/data_stream/node_stats/manifest.yml +++ b/packages/elasticsearch/data_stream/node_stats/manifest.yml @@ -6,6 +6,7 @@ elasticsearch: index_template: mappings: dynamic: false + index_mode: "time_series" streams: - input: elasticsearch/metrics title: Cluster nodes statistics diff --git a/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs index 41afa52e3ed..b954f53394b 100644 --- a/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs index e5b626ba0e8..e1c03081610 100644 --- a/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs +++ b/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs @@ -10,6 +10,9 @@ username: {{username}} {{#if password}} password: {{password}} {{/if}} +{{#if api_key}} +api_key: {{api_key}} +{{/if}} period: {{period}} {{#if ssl}} ssl: {{ssl}} @@ -24,4 +27,4 @@ condition: ${kubernetes_leaderelection.leader} == true {{#if condition }} condition: {{ condition }} {{/if}} -{{/if}} \ No newline at end of file +{{/if}} diff --git a/packages/elasticsearch/manifest.yml b/packages/elasticsearch/manifest.yml index adeea2fe7e9..2162695ffb1 100644 --- a/packages/elasticsearch/manifest.yml +++ b/packages/elasticsearch/manifest.yml @@ -1,6 +1,6 @@ name: elasticsearch title: Elasticsearch -version: 1.8.1 +version: 1.10.0 description: Elasticsearch Integration type: integration icons: @@ -12,7 +12,7 @@ format_version: 2.6.0 categories: ["elastic_stack", "datastore"] conditions: elastic.subscription: basic - kibana.version: ^8.8.0 + kibana.version: ^8.10.0 owner: github: elastic/infra-monitoring-ui policy_templates: @@ -57,6 +57,13 @@ policy_templates: multi: false required: false show_user: false + - name: api_key + type: password + title: API Key + description: Elasticsearch API Key in Beats format. Use when connecting to elasticsearch in place of username/password. + multi: false + required: false + show_user: false - name: scope type: select title: Scope diff --git a/packages/entityanalytics_entra_id/_dev/build/build.yml b/packages/entityanalytics_entra_id/_dev/build/build.yml new file mode 100644 index 00000000000..c8eeec8cacf --- /dev/null +++ b/packages/entityanalytics_entra_id/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@v8.9.0 diff --git a/packages/entityanalytics_entra_id/_dev/build/docs/README.md b/packages/entityanalytics_entra_id/_dev/build/docs/README.md new file mode 100644 index 00000000000..739330eaa3b --- /dev/null +++ b/packages/entityanalytics_entra_id/_dev/build/docs/README.md @@ -0,0 +1,110 @@ +# Microsoft Entra ID Entity Analytics + +This integration retrieves users, with group memberships, from Microsoft Entra ID +(formerly Azure Active Directory). + +## Configuration + +The necessary API permissions need to be granted in Microsoft Entra in order for the +integration to function properly: + +| Permission | Type | +|----------------------|-------------| +| GroupMember.Read.All | Application | +| User.Read.All | Application | + +For a full guide on how to set up the necessary App Registration, permission +granting, and secret configuration, follow this [guide](https://learn.microsoft.com/en-us/graph/auth-v2-service). + +## Usage + +The integration periodically contacts Microsoft Entra ID using the Graph API, +retrieving updates for users and groups, updates its internal cache of user +metadata and group membership information, and ships updated user metadata to +Elasticsearch. + +Fetching and shipping updates occurs in one of two processes: **full synchronizations** +and **incremental updates**. Full synchronizations will send the entire list of +users in state, along with write markers to indicate the start and end of the +synchronization event. Incremental updates will only send data for changed users +during that event. Changes on a user can come in many forms, whether it be a +change to the user's metadata, a user was added or deleted, or group membership +was changed (either direct or transitive). By default, full synchronizations +occur every 24 hours and incremental updates occur every hour. These intervals +may be customized to suit your use case. + +## Sample Events + +{{event "entity"}} + +The "write markers" bounding a full synchronization: + +```json +{ + "input": { + "type": "entity-analytics" + }, + "@timestamp": "2023-03-22T14:34:37.693Z", + "ecs": { + "version": "8.7.0" + }, + "data_stream": { + "namespace": "ep", + "type": "logs", + "dataset": "entityanalytics_entra_id.entity" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2023-03-22T14:34:41Z", + "start": "2023-03-22T14:34:37.693Z", + "action": "started", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ], + "dataset": "entityanalytics_entra_id.entity" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-d59eafe1-0583-4d42-b298-2bd30ef0b3b7" + } +} +``` + +```json +{ + "input": { + "type": "entity-analytics" + }, + "@timestamp": "2023-03-22T14:34:40.684Z", + "ecs": { + "version": "8.7.0" + }, + "data_stream": { + "namespace": "ep", + "type": "logs", + "dataset": "entityanalytics_entra_id.entity" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2023-03-22T14:34:41Z", + "action": "completed", + "end": "2023-03-22T14:34:40.684Z", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ], + "dataset": "entityanalytics_entra_id.entity" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-d59eafe1-0583-4d42-b298-2bd30ef0b3b7" + } +} +``` + +{{fields "entity"}} diff --git a/packages/entityanalytics_entra_id/_dev/deploy/docker/docker-compose.yml b/packages/entityanalytics_entra_id/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..b48bf23b5f2 --- /dev/null +++ b/packages/entityanalytics_entra_id/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,14 @@ +version: '3.0' +services: + entra_id: + image: docker.elastic.co/observability/stream:v0.7.0 + ports: + - 8080 + volumes: + - ./files:/files:ro + environment: + PORT: 8080 + command: + - http-server + - --addr=:8080 + - --config=/files/config.yml diff --git a/packages/entityanalytics_entra_id/_dev/deploy/docker/files/config.yml b/packages/entityanalytics_entra_id/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..7c6fab52f8b --- /dev/null +++ b/packages/entityanalytics_entra_id/_dev/deploy/docker/files/config.yml @@ -0,0 +1,25 @@ +rules: + - path: /TENANT_ID/oauth2/v2.0/token + methods: ["POST"] + responses: + - status_code: 200 + body: |- + {"token_type": "Bearer","access_token":"TEST","expires_in":3600,"ext_expires_in":3600} + - path: /v1.0/users/delta + methods: ["GET"] + responses: + - status_code: 200 + body: |- + {"@odata.deltaLink":"http://localhost:8080/v1.0/users/delta?$skiptoken=1","value":[{"id":"aa534e49-edfd-4541-8256-8bbf34f122b4","userPrincipalName":"First21480.Last11836@example.com","mail":"First21480_Last11836@example.com","displayName":"First21480 Last11836","givenName":"First21480","surname":"Last11836","jobTitle":"Manager","officeLocation":"608 St N, Somewhere, ABC, XYZ","mobilePhone":"231-482-2649","businessPhones":["55-692-8856","552-265-6614"],"accountEnabled":true},{"id":"feb6a386-612a-4ed1-9b13-2adc73074a19","userPrincipalName":"First45375.Last58638@example.com","mail":"First45375_Last58638@example.com","displayName":"First45375 Last58638","givenName":"First45375","surname":"Last58638","jobTitle":"Tech Writer","officeLocation":"682 St N, Somewhere, ABC, XYZ","mobilePhone":"385-169-3671","businessPhones":null,"accountEnabled":false}]} + - path: /v1.0/groups/delta + methods: ["GET"] + responses: + - status_code: 200 + body: |- + {"@odata.deltaLink":"http://localhost:8080/v1.0/groups/delta?$skiptoken=1","value":[{"id":"e7089e3a-2c83-4f08-8280-7530ed39b6ca","name":"Group 5202","members@delta":[{"id":"aa534e49-edfd-4541-8256-8bbf34f122b4","type":"#microsoft.graph.user"},{"id":"feb6a386-612a-4ed1-9b13-2adc73074a19","type":"#microsoft.graph.user"}]},{"id":"526588ce-2828-4cb1-9c9b-e57026e94b82","name":"Group 16739","members@delta":[{"id":"aa534e49-edfd-4541-8256-8bbf34f122b4","type":"#microsoft.graph.user"}]}]} + - path: /v1.0/devices/delta + methods: ["GET"] + responses: + - status_code: 200 + body: |- + {"@odata.deltaLink":"http://localhost:8080/v1.0/devices/delta?$skiptoken=1","value":[]} diff --git a/packages/entityanalytics_entra_id/changelog.yml b/packages/entityanalytics_entra_id/changelog.yml new file mode 100644 index 00000000000..7e88070eb72 --- /dev/null +++ b/packages/entityanalytics_entra_id/changelog.yml @@ -0,0 +1,16 @@ +# newer versions go on top +- version: 0.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.1.0" + changes: + - description: Initial release of package. + type: enhancement + link: https://github.com/elastic/integrations/pull/7392 diff --git a/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json new file mode 100644 index 00000000000..9ece38653aa --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json @@ -0,0 +1,71 @@ +{ + "events": [ + { + "@timestamp": "2023-03-06T10:07:13.883Z", + "azure_ad": { + "userPrincipalName": "First21480.Last11836@example.com", + "mail": "First21480_Last11836@example.com", + "displayName": "First21480 Last11836", + "givenName": "First21480", + "surname": "Last11836", + "jobTitle": "Manager", + "officeLocation": "608 St N, Somewhere, ABC, XYZ", + "mobilePhone": "231-482-2649", + "businessPhones": [ + "55-692-8856", + "552-265-6614" + ], + "accountEnabled": true + }, + "event": { + "action": "user-discovered" + }, + "labels": { + "identity_source": "entra_id-1" + }, + "user": { + "id": "aa534e49-edfd-4541-8256-8bbf34f122b4", + "group": [ + { + "id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca", + "name": "Group 5202" + }, + { + "id": "526588ce-2828-4cb1-9c9b-e57026e94b82", + "name": "Group 16739" + } + ] + } + }, + { + "@timestamp": "2023-03-06T10:07:13.883Z", + "azure_ad": { + "userPrincipalName": "First45375.Last58638@example.com", + "mail": "First45375_Last58638@example.com", + "displayName": "First45375 Last58638", + "givenName": "First45375", + "surname": "Last58638", + "jobTitle": "Tech Writer", + "officeLocation": "682 St N, Somewhere, ABC, XYZ", + "mobilePhone": "385-169-3671", + "businessPhones": null, + "accountEnabled": false + }, + "event": { + "action": "user-discovered" + }, + "labels": { + "identity_source": "entra_id-1" + }, + "user": { + "id": "feb6a386-612a-4ed1-9b13-2adc73074a19", + "group": [ + { + "id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca", + "name": "Group 5202" + } + ] + } + } + ] +} \ No newline at end of file diff --git a/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json-expected.json b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json-expected.json new file mode 100644 index 00000000000..ec544547250 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/pipeline/test-users.json-expected.json @@ -0,0 +1,100 @@ +{ + "expected": [ + { + "@timestamp": "2023-03-06T10:07:13.883Z", + "asset": { + "group": [ + { + "id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca", + "name": "Group 5202" + }, + { + "id": "526588ce-2828-4cb1-9c9b-e57026e94b82", + "name": "Group 16739" + } + ] + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "user-discovered", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ] + }, + "labels": { + "identity_source": "entra_id-1" + }, + "user": { + "email": "First21480_Last11836@example.com", + "enabled": true, + "first_name": "First21480", + "full_name": "First21480 Last11836", + "id": "aa534e49-edfd-4541-8256-8bbf34f122b4", + "job_title": "Manager", + "last_name": "Last11836", + "name": [ + "First21480.Last11836@example.com" + ], + "phone": [ + "231-482-2649", + "55-692-8856", + "552-265-6614" + ], + "work": { + "location": "608 St N, Somewhere, ABC, XYZ" + } + } + }, + { + "@timestamp": "2023-03-06T10:07:13.883Z", + "asset": { + "group": [ + { + "id": "e7089e3a-2c83-4f08-8280-7530ed39b6ca", + "name": "Group 5202" + } + ] + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "user-discovered", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ] + }, + "labels": { + "identity_source": "entra_id-1" + }, + "user": { + "email": "First45375_Last58638@example.com", + "enabled": false, + "first_name": "First45375", + "full_name": "First45375 Last58638", + "id": "feb6a386-612a-4ed1-9b13-2adc73074a19", + "job_title": "Tech Writer", + "last_name": "Last58638", + "name": [ + "First45375.Last58638@example.com" + ], + "phone": [ + "385-169-3671" + ], + "work": { + "location": "682 St N, Somewhere, ABC, XYZ" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/system/test-default-config.yml b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..e831a75103d --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/_dev/test/system/test-default-config.yml @@ -0,0 +1,9 @@ +input: entity-analytics +service: entra_id +data_stream: + vars: + tenant_id: TENANT_ID + client_id: CLIENT_ID + secret: foobar + login_endpoint: http://{{Hostname}}:{{Port}} + api_endpoint: http://{{Hostname}}:{{Port}}/v1.0 diff --git a/packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs b/packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs new file mode 100644 index 00000000000..20448eb7dee --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/agent/stream/entity-analytics.yml.hbs @@ -0,0 +1,15 @@ +provider: azure-ad +sync_interval: {{sync_interval}} +update_interval: {{update_interval}} +client_id: {{client_id}} +tenant_id: {{tenant_id}} +secret: {{secret}} +login_endpoint: {{login_endpoint}} +api_endpoint: {{api_endpoint}} +login_scopes: +{{#each login_scopes as |login_scope|}} + - {{login_scope}} +{{/each}} +{{#if custom_options}} +{{custom_options}} +{{/if}} diff --git a/packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/default.yml b/packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..81f203117bf --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,91 @@ +--- +description: Pipeline for processing Microsoft Entra ID user entities. +processors: +- set: + field: ecs.version + value: "8.9.0" + +# Only user documents are currently supported. +- drop: + if: ctx.device?.id != null + +# Event properties. +- set: + field: event.category + value: ["iam"] +- set: + field: event.type + value: ["user", "info"] + +# User properties. +- rename: + field: azure_ad.mail + target_field: user.email + ignore_missing: true +- append: + field: user.name + value: "{{{azure_ad.userPrincipalName}}}" + allow_duplicates: false + if: ctx.azure_ad?.userPrincipalName != null +- rename: + field: azure_ad.displayName + target_field: user.full_name + ignore_missing: true +- rename: + field: azure_ad.givenName + target_field: user.first_name + ignore_missing: true +- rename: + field: azure_ad.surname + target_field: user.last_name + ignore_missing: true +- rename: + field: azure_ad.accountEnabled + target_field: user.enabled + ignore_missing: true +- append: + field: user.phone + value: "{{{azure_ad.mobilePhone}}}" + allow_duplicates: false + if: ctx.azure_ad?.mobilePhone != null +- append: + field: user.phone + value: "{{{azure_ad.businessPhones}}}" + allow_duplicates: false + if: ctx.azure_ad?.businessPhones instanceof String +- foreach: + field: azure_ad.businessPhones + if: ctx.azure_ad?.businessPhones instanceof List + processor: + append: + field: user.phone + value: "{{{_ingest._value}}}" + allow_duplicates: false +- rename: + field: azure_ad.jobTitle + target_field: user.job_title + ignore_missing: true +- rename: + field: azure_ad.officeLocation + target_field: user.work.location + ignore_missing: true +- rename: + field: user.group + target_field: asset.group + ignore_missing: true + +- remove: + field: + - azure_ad + ignore_missing: true +- remove: + field: event.original + if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true + +on_failure: +- set: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" diff --git a/packages/entityanalytics_entra_id/data_stream/entity/fields/agent.yml b/packages/entityanalytics_entra_id/data_stream/entity/fields/agent.yml new file mode 100644 index 00000000000..8e774447801 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/fields/agent.yml @@ -0,0 +1,178 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on." + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier." + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime." + type: group + fields: + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes." + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider." + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine." + - name: id + level: core + type: keyword + ignore_above: 1024 + description: "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`." + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: "Name of the host.\nIt can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use." + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment." + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + +- name: log.source.address + type: keyword + description: Source address from which the log event was read / sent from. diff --git a/packages/entityanalytics_entra_id/data_stream/entity/fields/base-fields.yml b/packages/entityanalytics_entra_id/data_stream/entity/fields/base-fields.yml new file mode 100644 index 00000000000..e6d772e50e4 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/fields/base-fields.yml @@ -0,0 +1,28 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Name of the module this data is coming from. + value: entityanalytics_entra_id +- name: event.dataset + type: constant_keyword + description: Name of the dataset. + value: entityanalytics_entra_id.entity +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.kind + type: constant_keyword + description: The event kind. + value: asset +- name: event.provider + type: constant_keyword + description: The event kind. + value: Microsoft Entra ID diff --git a/packages/entityanalytics_entra_id/data_stream/entity/fields/beats.yml b/packages/entityanalytics_entra_id/data_stream/entity/fields/beats.yml new file mode 100644 index 00000000000..05a6db47402 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/fields/beats.yml @@ -0,0 +1,15 @@ +- description: Type of Filebeat input. + name: input.type + type: keyword +- description: Flags for the log file. + name: log.flags + type: keyword +- description: Offset of the entry in the log file. + name: log.offset + type: long +- description: Path to the log file. + name: log.file.path + type: keyword +- description: Log message optimized for viewing in a log viewer. + name: event.message + type: text diff --git a/packages/entityanalytics_entra_id/data_stream/entity/fields/ecs.yml b/packages/entityanalytics_entra_id/data_stream/entity/fields/ecs.yml new file mode 100644 index 00000000000..63a9e9ec303 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: ecs.version +- external: ecs + name: error.message +- external: ecs + name: event.category +- external: ecs + name: event.start +- external: ecs + name: event.type +- external: ecs + name: labels +- external: ecs + name: user.email +- external: ecs + name: user.id +- external: ecs + name: user.name +- external: ecs + name: user.full_name +- external: ecs + name: user.group.id +- external: ecs + name: user.group.name diff --git a/packages/entityanalytics_entra_id/data_stream/entity/fields/fields.yml b/packages/entityanalytics_entra_id/data_stream/entity/fields/fields.yml new file mode 100644 index 00000000000..a6562d8bc88 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/fields/fields.yml @@ -0,0 +1,49 @@ +- name: user + type: group + fields: + - name: enabled + type: boolean + description: |- + User account enabled status. + - name: first_name + type: keyword + description: |- + User first (given) name. + - name: last_name + type: keyword + description: |- + User last (surname) name. + - name: phone + type: keyword + description: |- + User's phone numbers. + - name: job_title + type: keyword + description: |- + User's job title. + - name: work + type: group + fields: + - name: location + type: keyword + description: |- + User's work location. +- name: asset + type: group + fields: + - name: group + type: group + fields: + - name: id + type: keyword + description: Unique identifier for the group. + - name: name + type: keyword + description: Name of the group. +- name: labels + type: group + fields: + - name: identity_source + type: keyword + description: |- + Unique identifier for the identity source. diff --git a/packages/entityanalytics_entra_id/data_stream/entity/manifest.yml b/packages/entityanalytics_entra_id/data_stream/entity/manifest.yml new file mode 100644 index 00000000000..fd5cb46d9e3 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/manifest.yml @@ -0,0 +1,80 @@ +title: "Identities" +type: logs +streams: + - input: entity-analytics + title: Collect identities + description: Collecting identities from Microsoft Entra ID. + template_path: entity-analytics.yml.hbs + vars: + - name: tenant_id + type: text + title: Tenant ID + required: true + - name: client_id + type: text + title: Client (Application) ID + required: true + - name: secret + type: password + title: Secret (API Key) + required: true + - name: sync_interval + type: text + title: Sync Interval + description: |- + How often full synchronizations should occur. Must be greater than + Update Interval. Expected value is a duration string (15m, 1h, 1m30, + etc), defaults to 24h. + required: false + show_user: false + - name: update_interval + type: text + title: Update Interval + description: |- + How often incremental updates should occur. Must be less than Sync + Interval. Expected value is a duration string (15m, 1h, 1m30, etc), + defaults to 15m. + required: false + show_user: false + - name: login_endpoint + type: text + title: Login Endpoint URL + default: "https://login.microsoftonline.com" + description: URL for OAuth2 logins. + required: false + show_user: false + - name: login_scopes + type: text + title: Login Scopes + multi: true + default: + - "https://graph.microsoft.com/.default" + description: Scopes for OAuth2 token. + required: false + show_user: false + - name: api_endpoint + type: text + title: API Endpoint URL + default: "https://graph.microsoft.com/v1.0" + description: URL for the API endpoint. + required: false + show_user: false + - name: custom_options + type: yaml + title: Custom Options + multi: false + required: false + show_user: false + description: |- + Specify custom configuration options for the Entity Analytics input. See + [Entity Analytics](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-entityanalytics.html) + for details. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - entityanalytics_entra_id-entity diff --git a/packages/entityanalytics_entra_id/data_stream/entity/sample_event.json b/packages/entityanalytics_entra_id/data_stream/entity/sample_event.json new file mode 100644 index 00000000000..9f0404b8ab0 --- /dev/null +++ b/packages/entityanalytics_entra_id/data_stream/entity/sample_event.json @@ -0,0 +1,65 @@ +{ + "@timestamp": "2023-08-15T14:38:54.461Z", + "agent": { + "ephemeral_id": "d6f9f501-2f57-475f-ac8a-0f07a280ab47", + "id": "a5d370e8-ae36-45f7-adbd-f22b984b979d", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.10.0" + }, + "data_stream": { + "dataset": "entityanalytics_entra_id.entity", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "a5d370e8-ae36-45f7-adbd-f22b984b979d", + "snapshot": true, + "version": "8.10.0" + }, + "event": { + "action": "started", + "agent_id_status": "verified", + "category": [ + "iam" + ], + "dataset": "entityanalytics_entra_id.entity", + "ingested": "2023-08-15T14:38:57Z", + "start": "2023-08-15T14:38:54.461Z", + "type": [ + "user", + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e99a2f1240444f1d9b0988489b67037d", + "ip": [ + "192.168.112.7" + ], + "mac": [ + "02-42-C0-A8-70-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "input": { + "type": "entity-analytics" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-91c18afb-5a41-4079-90d1-3bd684fb38a9" + } +} \ No newline at end of file diff --git a/packages/entityanalytics_entra_id/docs/README.md b/packages/entityanalytics_entra_id/docs/README.md new file mode 100644 index 00000000000..b09fb609897 --- /dev/null +++ b/packages/entityanalytics_entra_id/docs/README.md @@ -0,0 +1,248 @@ +# Microsoft Entra ID Entity Analytics + +This integration retrieves users, with group memberships, from Microsoft Entra ID +(formerly Azure Active Directory). + +## Configuration + +The necessary API permissions need to be granted in Microsoft Entra in order for the +integration to function properly: + +| Permission | Type | +|----------------------|-------------| +| GroupMember.Read.All | Application | +| User.Read.All | Application | + +For a full guide on how to set up the necessary App Registration, permission +granting, and secret configuration, follow this [guide](https://learn.microsoft.com/en-us/graph/auth-v2-service). + +## Usage + +The integration periodically contacts Microsoft Entra ID using the Graph API, +retrieving updates for users and groups, updates its internal cache of user +metadata and group membership information, and ships updated user metadata to +Elasticsearch. + +Fetching and shipping updates occurs in one of two processes: **full synchronizations** +and **incremental updates**. Full synchronizations will send the entire list of +users in state, along with write markers to indicate the start and end of the +synchronization event. Incremental updates will only send data for changed users +during that event. Changes on a user can come in many forms, whether it be a +change to the user's metadata, a user was added or deleted, or group membership +was changed (either direct or transitive). By default, full synchronizations +occur every 24 hours and incremental updates occur every hour. These intervals +may be customized to suit your use case. + +## Sample Events + +An example event for `entity` looks as following: + +```json +{ + "@timestamp": "2023-08-15T14:38:54.461Z", + "agent": { + "ephemeral_id": "d6f9f501-2f57-475f-ac8a-0f07a280ab47", + "id": "a5d370e8-ae36-45f7-adbd-f22b984b979d", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.10.0" + }, + "data_stream": { + "dataset": "entityanalytics_entra_id.entity", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "a5d370e8-ae36-45f7-adbd-f22b984b979d", + "snapshot": true, + "version": "8.10.0" + }, + "event": { + "action": "started", + "agent_id_status": "verified", + "category": [ + "iam" + ], + "dataset": "entityanalytics_entra_id.entity", + "ingested": "2023-08-15T14:38:57Z", + "start": "2023-08-15T14:38:54.461Z", + "type": [ + "user", + "info" + ] + }, + "host": { + "architecture": "x86_64", + "containerized": true, + "hostname": "docker-fleet-agent", + "id": "e99a2f1240444f1d9b0988489b67037d", + "ip": [ + "192.168.112.7" + ], + "mac": [ + "02-42-C0-A8-70-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "input": { + "type": "entity-analytics" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-91c18afb-5a41-4079-90d1-3bd684fb38a9" + } +} +``` + +The "write markers" bounding a full synchronization: + +```json +{ + "input": { + "type": "entity-analytics" + }, + "@timestamp": "2023-03-22T14:34:37.693Z", + "ecs": { + "version": "8.7.0" + }, + "data_stream": { + "namespace": "ep", + "type": "logs", + "dataset": "entityanalytics_entra_id.entity" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2023-03-22T14:34:41Z", + "start": "2023-03-22T14:34:37.693Z", + "action": "started", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ], + "dataset": "entityanalytics_entra_id.entity" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-d59eafe1-0583-4d42-b298-2bd30ef0b3b7" + } +} +``` + +```json +{ + "input": { + "type": "entity-analytics" + }, + "@timestamp": "2023-03-22T14:34:40.684Z", + "ecs": { + "version": "8.7.0" + }, + "data_stream": { + "namespace": "ep", + "type": "logs", + "dataset": "entityanalytics_entra_id.entity" + }, + "event": { + "agent_id_status": "verified", + "ingested": "2023-03-22T14:34:41Z", + "action": "completed", + "end": "2023-03-22T14:34:40.684Z", + "category": [ + "iam" + ], + "type": [ + "user", + "info" + ], + "dataset": "entityanalytics_entra_id.entity" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_entra_id.entity-d59eafe1-0583-4d42-b298-2bd30ef0b3b7" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| asset.group.id | Unique identifier for the group. | keyword | +| asset.group.name | Name of the group. | keyword | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.dataset | Name of the dataset. | constant_keyword | +| event.kind | The event kind. | constant_keyword | +| event.message | Log message optimized for viewing in a log viewer. | text | +| event.module | Name of the module this data is coming from. | constant_keyword | +| event.provider | The event kind. | constant_keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | +| labels.identity_source | Unique identifier for the identity source. | keyword | +| log.file.path | Path to the log file. | keyword | +| log.flags | Flags for the log file. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| log.source.address | Source address from which the log event was read / sent from. | keyword | +| user.email | User email address. | keyword | +| user.enabled | User account enabled status. | boolean | +| user.first_name | User first (given) name. | keyword | +| user.full_name | User's full name, if available. | keyword | +| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | +| user.group.id | Unique identifier for the group on the system/platform. | keyword | +| user.group.name | Name of the group. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.job_title | User's job title. | keyword | +| user.last_name | User last (surname) name. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| user.phone | User's phone numbers. | keyword | +| user.work.location | User's work location. | keyword | + diff --git a/packages/entityanalytics_entra_id/img/logo-azure.svg b/packages/entityanalytics_entra_id/img/logo-azure.svg new file mode 100644 index 00000000000..7595554fffa --- /dev/null +++ b/packages/entityanalytics_entra_id/img/logo-azure.svg @@ -0,0 +1,3 @@ + + + diff --git a/packages/entityanalytics_entra_id/kibana/tags.yml b/packages/entityanalytics_entra_id/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/entityanalytics_entra_id/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/entityanalytics_entra_id/manifest.yml b/packages/entityanalytics_entra_id/manifest.yml new file mode 100644 index 00000000000..90f11af0ad1 --- /dev/null +++ b/packages/entityanalytics_entra_id/manifest.yml @@ -0,0 +1,31 @@ +format_version: "3.0.0" +name: entityanalytics_entra_id +title: "Microsoft Entra ID Entity Analytics" +version: "0.3.0" +description: "Collect identities from Microsoft Entra ID (formerly Azure Active Directory) with Elastic Agent." +type: integration +categories: + - azure + - cloud + - security +conditions: + kibana: + version: "^8.9.0" + elastic: + subscription: "basic" +icons: + - src: /img/logo-azure.svg + title: Azure logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: entity + title: Identities + description: Collect identities. + inputs: + - type: entity-analytics + title: Collect identities + description: Collecting identities from Microsoft Entra ID. +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/entityanalytics_okta/_dev/build/build.yml b/packages/entityanalytics_okta/_dev/build/build.yml new file mode 100644 index 00000000000..c1af686e524 --- /dev/null +++ b/packages/entityanalytics_okta/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/entityanalytics_okta/_dev/build/docs/README.md b/packages/entityanalytics_okta/_dev/build/docs/README.md new file mode 100644 index 00000000000..b4c0d49589f --- /dev/null +++ b/packages/entityanalytics_okta/_dev/build/docs/README.md @@ -0,0 +1,138 @@ +# Okta Entity Analytics + +This [Okta Entity Analytics](https://www.okta.com/) integration allows users to securely stream User Entities data to Elastic Security via the REST API. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for risk-scoring scenarios (e.g., context enrichments) and detecting advanced analytics (UBA) use cases. + +## Compatibility + +This module has been tested against the Core Okta API version **v1**. + +## Data streams + +The Okta Entity Analytics integration collects one type of data: user. + +**User** is used to retrieve all user logs available in an organization. See more details in the API documentation [here](https://developer.okta.com/docs/reference/api/users/#list-users). + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data using Entity Analytics Input and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data from Okta, follow the below steps: + +- Required URL namespace, which should be preceded by an organization's subdomain (tenant) or configured custom domain. +- Create an Okta API Token for Authentication. Follow this [guide](https://developer.okta.com/docs/guides/create-an-api-token/main/). + +### Enabling the integration in Elastic: + +1. In Kibana, go to Management > Integrations. +2. In the "Search for integrations" search bar, type Okta Entity Analytics. +3. Click on the "Okta Entity Analytics" integration from the search results. +4. Click on the Add Okta Entity Analytics Integration button to add the integration. +5. While adding the integration, add the URL and API Token that we got earlier. +6. Save the integration by adding other necessary parameters. + +## Usage + +The Okta provider periodically contacts the Okta API, retrieving updates for users, updates its internal cache of user metadata, and ships updated user metadata to Elasticsearch. + +Fetching and shipping updates occurs in one of two processes: **full synchronizations** and **incremental updates**. Full synchronizations will send the entire list of users in state, along with write markers to indicate the start and end of the synchronization event. Incremental updates will only send data for changed users during that event. Changes on a user can come in many forms, whether it be a change to the user’s metadata, or a user was added or deleted. By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case. + +## Sample Events + +A user document: + +```json +{ + "@timestamp": "2023-07-04T09:57:19.786056-05:00", + "event": { + "action": "user-discovered" + }, + "okta": { + "id": "userid", + "status": "RECOVERY", + "created": "2023-06-02T09:33:00.189752+09:30", + "activated": "0001-01-01T00:00:00Z", + "statusChanged": "2023-06-02T09:33:00.189752+09:30", + "lastLogin": "2023-06-02T09:33:00.189752+09:30", + "lastUpdated": "2023-06-02T09:33:00.189753+09:30", + "passwordChanged": "2023-06-02T09:33:00.189753+09:30", + "type": { + "id": "typeid" + }, + "profile": { + "login": "name.surname@example.com", + "email": "name.surname@example.com", + "firstName": "name", + "lastName": "surname" + }, + "credentials": { + "password": {}, + "provider": { + "type": "OKTA", + "name": "OKTA" + } + }, + "_links": { + "self": { + "href": "https://localhost/api/v1/users/userid" + } + } + }, + "user": { + "id": "userid" + }, + "labels": { + "identity_source": "okta-1" + } +} +``` + +Full synchronizations will be bounded on either side by "write marker" documents. + +```json +{ + "@timestamp": "2022-11-04T09:57:19.786056-05:00", + "event": { + "action": "started", + "start": "2022-11-04T09:57:19.786056-05:00" + }, + "labels": { + "identity_source": "okta-1" + } +} +``` + +## Logs reference + +### User + +This is the `User` dataset. + +#### Example + +{{event "user"}} + +{{fields "user"}} diff --git a/packages/entityanalytics_okta/_dev/deploy/docker/docker-compose.yml b/packages/entityanalytics_okta/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..5506d8cc34d --- /dev/null +++ b/packages/entityanalytics_okta/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,17 @@ +version: '2.3' +services: + entityanalytics_okta: + image: docker.elastic.co/observability/stream:v0.10.0 + hostname: trial-xxxxxxx-admin.okta.com + ports: + - 443 + volumes: + - ./files:/files:ro + environment: + PORT: "443" + command: + - http-server + - --addr=:443 + - --config=/files/config.yml + - --tls-cert=/files/certificate.crt + - --tls-key=/files/private.key diff --git a/packages/entityanalytics_okta/_dev/deploy/docker/files/certificate.crt b/packages/entityanalytics_okta/_dev/deploy/docker/files/certificate.crt new file mode 100644 index 00000000000..c05b2d0ac82 --- /dev/null +++ b/packages/entityanalytics_okta/_dev/deploy/docker/files/certificate.crt @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDTjCCAjYCCQDXiI0YQTvKWTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJY +WDEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZhdWx0IENvbXBh +bnkgTHRkMSUwIwYDVQQDDBx0cmlhbC14eHh4eHh4LWFkbWluLm9rdGEuY29tMB4X +DTIzMDYyNzEyNDA1NVoXDTI0MDYyNjEyNDA1NVowaTELMAkGA1UEBhMCWFgxFTAT +BgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0 +ZDElMCMGA1UEAwwcdHJpYWwteHh4eHh4eC1hZG1pbi5va3RhLmNvbTCCASIwDQYJ +KoZIhvcNAQEBBQADggEPADCCAQoCggEBANfafZ9Sz4mYMsJBvc94VtQHGRO8g7ne +LXa1E2rY4e4zVbQxm7EtZw25+MQjJp2zxHntYS6Loa3bfm1g9au97tQk4YlL7Ie8 +9ng1qMhAFqc07Xr7jTpYD1XUKXzJ6m/ExgjHz3ohTVT4+PporR18CrGI1PiLPOFI +hdgwjYYsz7ghKglWjC3wxXtSOBwFNo0QM0/FHmfuUluEfoEBagPqTESvPsCtrUSz +0JuWGm4jbacY0BWfTZtZYF81468b9JDDXvFXZLre6WvFbWmw86E/Jv4bdy0RuX3L +UtMbSdqOBw+QwaLpQn72OuxhDPZVtNjI9ihzLeixTY20C36QTXSoJXcCAwEAATAN +BgkqhkiG9w0BAQsFAAOCAQEAPAkhHfOVE8SonSRQK9yp8MdVWC7KyqtayHZq7xkj +UMwX2z0Jk1FQFimXNw3dRLV6yuOW0+ra0opuODV+VwsIj/2FqHKMnPQBUj5jrLui +TYGHv4RYE5R8YqvphCeCw+Tr3bSMdpuQuRLhWjqZUpSR+yav72ebBXJvxqvOVBTT +lsJVUm1XPfmbH8yI7Lc4DzIoQmUXdhqLu7mx4kVvLvYEwq1xgK/PZDzPde0uqvZR +gqF5pq77W705pLc+GYWWTjlDNXIrcXnMuljcGR+UIs5GuGwAaflhBiqLXrKdi8oh +3pQrTZO28+/Yc7PYFkVZOwvWl/OJ8bKSDFuRuz2eGAWgmQ== +-----END CERTIFICATE----- diff --git a/packages/entityanalytics_okta/_dev/deploy/docker/files/config.yml b/packages/entityanalytics_okta/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..3c08a5aadab --- /dev/null +++ b/packages/entityanalytics_okta/_dev/deploy/docker/files/config.yml @@ -0,0 +1,7 @@ +rules: + - path: /api/v1/users + methods: ["GET"] + responses: + - status_code: 200 + body: | + [{"id":"00ub0oNGTSWTBKOLGLNR","status":"ACTIVE","created":"2013-06-24T16:39:18.000Z","activated":"2013-06-24T16:39:19.000Z","statusChanged":"2013-06-24T16:39:19.000Z","lastLogin":"2013-06-24T17:39:19.000Z","lastUpdated":"2013-07-02T21:36:25.344Z","passwordChanged":"2013-07-02T21:36:25.344Z","profile":{"firstName":"Isaac","lastName":"Brock","email":"isaac.brock@example.com","login":"isaac.brock@example.com","mobilePhone":"555-415-1337"},"credentials":{"password":{"value":"tlpWENT2m"},"recovery_question":{"question":"Who's a major player in the cowboy scene?","answer":"Annie Oakley"},"provider":{"type":"OKTA","name":"OKTA"}}}] diff --git a/packages/entityanalytics_okta/_dev/deploy/docker/files/private.key b/packages/entityanalytics_okta/_dev/deploy/docker/files/private.key new file mode 100644 index 00000000000..55319fd62ca --- /dev/null +++ b/packages/entityanalytics_okta/_dev/deploy/docker/files/private.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDX2n2fUs+JmDLC +Qb3PeFbUBxkTvIO53i12tRNq2OHuM1W0MZuxLWcNufjEIyads8R57WEui6Gt235t +YPWrve7UJOGJS+yHvPZ4NajIQBanNO16+406WA9V1Cl8yepvxMYIx896IU1U+Pj6 +aK0dfAqxiNT4izzhSIXYMI2GLM+4ISoJVowt8MV7UjgcBTaNEDNPxR5n7lJbhH6B +AWoD6kxErz7Ara1Es9CblhpuI22nGNAVn02bWWBfNeOvG/SQw17xV2S63ulrxW1p +sPOhPyb+G3ctEbl9y1LTG0najgcPkMGi6UJ+9jrsYQz2VbTYyPYocy3osU2NtAt+ +kE10qCV3AgMBAAECggEAb8Z7wNIwGE9REZjbgqENTXRzfu3ixJARuOPhrzWqISBC +JDKALgqVz9zavi55o7ZgascKyQCTc6Uy3c8UyJ9tGjwS8nb3f/7RHsSipzfQwzs8 +MrAqnOjW4BoidbVVihU6e3eEr/iow/S9cWZdJuSB4Rc7OY1YtExKyv2xe6ae1fia +OhJZxJ5zxCfw0hd0B1w9cgd0nzfKn1xGQktLn/8XbJUUEm9C1PQ6ocpjXV0b+KSg +5gcFEOW3ndyFvnz1ayBs0VSAlhKo3nffYUUUJoMod+dNRx2UAW9En2NYmJORDu11 +VNUKZjmQWnNODu8QwzOlrlPzmyKdHnyncDm7AZe58QKBgQD++Ar1UuJ9CfQA2lK/ +NSC5L4UhkXt53vZiYy0z+mmox97DYotqSraRiqLk/KUr9Qx8Fyjgyxj7+MScKRiA +Hu3NEuYeE6VVf+bCf1L1EntaC9rpSuMxLB+qKqW7Ni3oyBypFxWCblPcezWl41Ay +eSCTAZyfIkJupvVa5EB5VScGiQKBgQDYufQcHCGF9GBUAwRdJY8FbX64mkeIX+YH +6TmG5mmsYjhbYy2HiWlHQhhWDiaVtzQMKTBgXhV/ISumOwyuXqUiVY7HYHdQN+6G +ZZmdOIqk+x/7ArW/MIXX56aBoV1K0bCTqs4XSYTsNmECeU8W++SylXMZP5vCbozb +2ZWiJUrL/wKBgDI8y2P1Fd1PRb2ZRu6X2D/ExjWMBclIjkFqizCPqZvw7cqPsyqZ +WAmrSFdYFG9p1DDrG0nXmq+jH5IpYsNz1KUwkRjiBBSpo9002zKglp9ycIrBD6zT +pdWQm6EclsUkEMmcW8ecV3e86yApftbDGRD+I08ToAVPbk6fZLjDd3IJAoGAaLQ9 ++S6mC39q4muqug2hMTAbHrh6gqpCCeRlRIUg3IV/ULdzkZ2TXTfTZg/kGESwQofL +tWL+47J00hSJJdzXzuSi3DQAsKK0+/0t38UnRlmEs9I1WC7rGsnxqYL5/WGc+1pz +wtBkBXKoH3fX+/SqIpUNTE9swtyB9N0D65g0sKUCgYEA2WAL8t8TICDRY2Iyq2fN +SdqqOEP3noR+6lSHPWhjFeC5xQXPFKNUDnr9e3KofT3+wdgTqSh77zEdF7+yfR/y +JEsDVB5ThYVDS2sHvUoPGnLg42i3CauirMiBgmQZgL5h1Un+tzN0jJS79p9iWtJj +1igypjZrzf2/vRj23rEcPOM= +-----END PRIVATE KEY----- diff --git a/packages/entityanalytics_okta/changelog.yml b/packages/entityanalytics_okta/changelog.yml new file mode 100644 index 00000000000..ee1247267b5 --- /dev/null +++ b/packages/entityanalytics_okta/changelog.yml @@ -0,0 +1,26 @@ +# newer versions go on top +- version: 0.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.3.0" + changes: + - description: Add user.geo.*, user.organization.*, and asset categorization mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/7402 +- version: "0.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "0.1.0" + changes: + - description: Initial Release. + type: enhancement + link: https://github.com/elastic/integrations/pull/6911 diff --git a/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-common-config.yml b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json new file mode 100644 index 00000000000..3230ec403f4 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json @@ -0,0 +1,60 @@ +{ + "events": [ + { + "@timestamp": "2023-06-13T07:12:17.341Z", + "okta": { + "id": "00ub0oNGTSWTBKOLGLNR", + "status": "ACTIVE", + "created": "2013-06-24T16:39:18.000Z", + "activated": "2013-06-24T16:39:19.000Z", + "statusChanged": "2013-06-24T16:39:19.000Z", + "lastLogin": "2013-06-24T17:39:19.000Z", + "lastUpdated": "2013-06-27T16:35:28.000Z", + "passwordChanged": "2013-06-24T16:39:19.000Z", + "profile": { + "login": "isaac.brock@example.com", + "firstName": "Isaac", + "lastName": "Brock", + "nickName": "issac", + "displayName": "Isaac Brock", + "email": "isaac.brock@example.com", + "secondEmail": "isaac@example.org", + "profileUrl": "http://www.example.com/profile", + "preferredLanguage": "en-US", + "userType": "Employee", + "organization": "Okta", + "title": "Director", + "division": "R\u0026D", + "department": "Engineering", + "costCenter": "10", + "employeeNumber": "187", + "mobilePhone": "+1-555-415-1337", + "primaryPhone": "+1-555-514-1337", + "streetAddress": "301 Brannan St.", + "city": "San Francisco", + "state": "CA", + "zipCode": "94107", + "countryCode": "US" + }, + "credentials": { + "provider": { + "type": "OKTA", + "name": "OKTA" + } + } + }, + "user": { + "id": "00u5tvodynDjUCNKn697" + }, + "event": { + "action": "user-modified" + }, + "input": { + "type": "entity-analytics" + }, + "ecs": { + "version": "8.0.0" + } + } + ] +} \ No newline at end of file diff --git a/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json-expected.json b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json-expected.json new file mode 100644 index 00000000000..89aca057b5b --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/_dev/test/pipeline/test-user.json-expected.json @@ -0,0 +1,138 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-13T07:12:17.341Z", + "asset": { + "category": "entity", + "costCenter": "10", + "create_date": "2013-06-24T16:39:18.000Z", + "id": "00ub0oNGTSWTBKOLGLNR", + "last_seen": "2013-06-24T17:39:19.000Z", + "last_status_change_date": "2013-06-24T16:39:19.000Z", + "last_updated": "2013-06-27T16:35:28.000Z", + "name": "Isaac Brock", + "status": "ACTIVE", + "type": "okta_user", + "vendor": "OKTA" + }, + "ecs": { + "version": "8.9.0" + }, + "entityanalytics_okta": { + "user": { + "activated": "2013-06-24T16:39:19.000Z", + "created": "2013-06-24T16:39:18.000Z", + "credentials": { + "provider": { + "name": "OKTA", + "type": "OKTA" + } + }, + "id": "00ub0oNGTSWTBKOLGLNR", + "last_login": "2013-06-24T17:39:19.000Z", + "last_updated": "2013-06-27T16:35:28.000Z", + "password_changed": "2013-06-24T16:39:19.000Z", + "profile": { + "city": "San Francisco", + "cost_center": "10", + "country_code": "US", + "department": "Engineering", + "display_name": "Isaac Brock", + "division": "R\u0026D", + "email": "isaac.brock@example.com", + "employee_number": "187", + "first_name": "Isaac", + "last_name": "Brock", + "login": "isaac.brock@example.com", + "mobile_phone": "+1-555-415-1337", + "nick_name": "issac", + "organization": "Okta", + "preferred_language": "en-US", + "primary_phone": "+1-555-514-1337", + "second_email": "isaac@example.org", + "state": "CA", + "street_address": "301 Brannan St.", + "title": "Director", + "url": "http://www.example.com/profile", + "user_type": "Employee", + "zip_code": "94107" + }, + "status": "ACTIVE", + "status_changed": "2013-06-24T16:39:19.000Z" + } + }, + "event": { + "action": "user-modified", + "category": [ + "iam" + ], + "kind": "asset", + "type": [ + "user", + "info" + ] + }, + "input": { + "type": "entity-analytics" + }, + "related": { + "user": [ + "00ub0oNGTSWTBKOLGLNR", + "isaac.brock@example.com", + "isaac@example.org", + "Isaac", + "Brock", + "Isaac Brock", + "issac", + "187" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "account": { + "activated_date": "2013-06-24T16:39:19.000Z", + "change_date": "2013-06-24T16:39:19.000Z", + "create_date": "2013-06-24T16:39:18.000Z", + "password_change_date": "2013-06-24T16:39:19.000Z", + "status": { + "deprovisioned": false, + "locked_out": false, + "password_expired": false, + "recovery": false, + "suspended": false + } + }, + "email": "isaac.brock@example.com", + "full_name": "Isaac Brock", + "geo": { + "city_name": "San Francisco", + "country_iso_code": "US", + "name": "301 Brannan St.", + "postal_code": "94107", + "region_name": "CA" + }, + "id": "00u5tvodynDjUCNKn697", + "name": "isaac.brock@example.com", + "organization": { + "name": "Okta" + }, + "profile": { + "department": "Engineering", + "first_name": "Isaac", + "id": "187", + "job_title": "Director", + "last_name": "Brock", + "mobile_phone": "+1-555-415-1337", + "other_identities": "isaac@example.org", + "primaryPhone": "+1-555-514-1337", + "secondEmail": "isaac@example.org", + "status": "ACTIVE", + "type": "Employee" + } + } + } + ] +} \ No newline at end of file diff --git a/packages/entityanalytics_okta/data_stream/user/_dev/test/system/test-default-config.yml b/packages/entityanalytics_okta/data_stream/user/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..d695e51595e --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/_dev/test/system/test-default-config.yml @@ -0,0 +1,30 @@ +input: entity-analytics +service: entityanalytics_okta +data_stream: + vars: + okta_domain: trial-xxxxxxx-admin.okta.com + okta_token: xxxx + preserve_duplicate_custom_fields: true + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDTjCCAjYCCQDXiI0YQTvKWTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJY + WDEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZhdWx0IENvbXBh + bnkgTHRkMSUwIwYDVQQDDBx0cmlhbC14eHh4eHh4LWFkbWluLm9rdGEuY29tMB4X + DTIzMDYyNzEyNDA1NVoXDTI0MDYyNjEyNDA1NVowaTELMAkGA1UEBhMCWFgxFTAT + BgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21wYW55IEx0 + ZDElMCMGA1UEAwwcdHJpYWwteHh4eHh4eC1hZG1pbi5va3RhLmNvbTCCASIwDQYJ + KoZIhvcNAQEBBQADggEPADCCAQoCggEBANfafZ9Sz4mYMsJBvc94VtQHGRO8g7ne + LXa1E2rY4e4zVbQxm7EtZw25+MQjJp2zxHntYS6Loa3bfm1g9au97tQk4YlL7Ie8 + 9ng1qMhAFqc07Xr7jTpYD1XUKXzJ6m/ExgjHz3ohTVT4+PporR18CrGI1PiLPOFI + hdgwjYYsz7ghKglWjC3wxXtSOBwFNo0QM0/FHmfuUluEfoEBagPqTESvPsCtrUSz + 0JuWGm4jbacY0BWfTZtZYF81468b9JDDXvFXZLre6WvFbWmw86E/Jv4bdy0RuX3L + UtMbSdqOBw+QwaLpQn72OuxhDPZVtNjI9ihzLeixTY20C36QTXSoJXcCAwEAATAN + BgkqhkiG9w0BAQsFAAOCAQEAPAkhHfOVE8SonSRQK9yp8MdVWC7KyqtayHZq7xkj + UMwX2z0Jk1FQFimXNw3dRLV6yuOW0+ra0opuODV+VwsIj/2FqHKMnPQBUj5jrLui + TYGHv4RYE5R8YqvphCeCw+Tr3bSMdpuQuRLhWjqZUpSR+yav72ebBXJvxqvOVBTT + lsJVUm1XPfmbH8yI7Lc4DzIoQmUXdhqLu7mx4kVvLvYEwq1xgK/PZDzPde0uqvZR + gqF5pq77W705pLc+GYWWTjlDNXIrcXnMuljcGR+UIs5GuGwAaflhBiqLXrKdi8oh + 3pQrTZO28+/Yc7PYFkVZOwvWl/OJ8bKSDFuRuz2eGAWgmQ== + -----END CERTIFICATE----- diff --git a/packages/entityanalytics_okta/data_stream/user/agent/stream/entity-analytics.yml.hbs b/packages/entityanalytics_okta/data_stream/user/agent/stream/entity-analytics.yml.hbs new file mode 100644 index 00000000000..a9ad8500d55 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/agent/stream/entity-analytics.yml.hbs @@ -0,0 +1,31 @@ +provider: okta +{{#if id}} +id: {{id}} +{{/if}} +sync_interval: {{sync_interval}} +update_interval: {{update_interval}} +okta_domain: {{okta_domain}} +okta_token: {{okta_token}} +{{#if proxy_url}} +request.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +request.timeout: {{http_client_timeout}} +{{/if}} +tags: +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/entityanalytics_okta/data_stream/user/elasticsearch/ingest_pipeline/default.yml b/packages/entityanalytics_okta/data_stream/user/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..6b412765783 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,645 @@ +--- +description: Pipeline for processing User logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - set: + field: event.kind + tag: set_event_kind + value: asset + - set: + field: event.category + tag: set_event_category + value: ['iam'] + - set: + field: event.type + tag: set_event_type + value: ['user','info'] + - set: + field: asset.category + tag: set_asset_category + value: entity + - set: + field: asset.type + tag: set_asset_type + value: okta_user + - rename: + field: okta.id + target_field: entityanalytics_okta.user.id + tag: rename_user_id + ignore_missing: true + - set: + field: asset.id + copy_from: entityanalytics_okta.user.id + tag: set_asset_id + ignore_empty_value: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.id}}}' + tag: append_user_id_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.id != null + - script: + lang: painless + description: Set User Account Status properties. + tag: painless_set_user_account_status + if: ctx.okta?.status != null + source: |- + if (ctx.user == null) { + ctx.user = new HashMap(); + } + if (ctx.user.account == null) { + ctx.user.account = new HashMap(); + } + if (ctx.user.account.status == null) { + ctx.user.account.status = new HashMap(); + } + ctx.user.account.status.put('recovery', false); + ctx.user.account.status.put('locked_out', false); + ctx.user.account.status.put('suspended', false); + ctx.user.account.status.put('password_expired', false); + ctx.user.account.status.put('deprovisioned', false); + def status = ctx.okta.status.toLowerCase(); + if (['recovery', 'locked_out', 'suspended', 'password_expired', 'deprovisioned'].contains(status)) { + ctx.user.account.status[status] = true; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: okta.status + target_field: entityanalytics_okta.user.status + tag: rename_user_status + ignore_missing: true + - set: + field: asset.status + copy_from: entityanalytics_okta.user.status + tag: set_asset_status + ignore_empty_value: true + - set: + field: user.profile.status + copy_from: entityanalytics_okta.user.status + tag: set_user_profile_status + ignore_empty_value: true + - date: + field: okta.created + target_field: entityanalytics_okta.user.created + tag: date_user_created + formats: + - ISO8601 + if: ctx.okta?.created != null && ctx.okta.created != '' + on_failure: + - remove: + field: okta.created + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.account.create_date + copy_from: entityanalytics_okta.user.created + tag: set_user_account_create_date + ignore_empty_value: true + - set: + field: asset.create_date + copy_from: entityanalytics_okta.user.created + tag: set_asset_create_date + ignore_empty_value: true + - date: + field: okta.activated + target_field: entityanalytics_okta.user.activated + tag: date_user_activated + formats: + - ISO8601 + if: ctx.okta?.activated != null && ctx.okta.activated != '' + on_failure: + - remove: + field: okta.activated + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.account.activated_date + copy_from: entityanalytics_okta.user.activated + tag: set_user_account_activated_date + ignore_empty_value: true + - date: + field: okta.statusChanged + target_field: entityanalytics_okta.user.status_changed + tag: date_user_status_changed + formats: + - ISO8601 + if: ctx.okta?.statusChanged != null && ctx.okta.statusChanged != '' + on_failure: + - remove: + field: okta.statusChanged + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.account.change_date + copy_from: entityanalytics_okta.user.status_changed + tag: set_user_account_change_date + ignore_empty_value: true + - set: + field: asset.last_status_change_date + copy_from: entityanalytics_okta.user.status_changed + tag: set_asset_last_status_change_date + ignore_empty_value: true + - date: + field: okta.lastLogin + target_field: entityanalytics_okta.user.last_login + tag: date_user_last_login + formats: + - ISO8601 + if: ctx.okta?.lastLogin != null && ctx.okta.lastLogin != '' + on_failure: + - remove: + field: okta.lastLogin + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: asset.last_seen + copy_from: entityanalytics_okta.user.last_login + tag: set_asset_last_seen + ignore_empty_value: true + - date: + field: okta.lastUpdated + target_field: entityanalytics_okta.user.last_updated + tag: date_user_last_updated + formats: + - ISO8601 + if: ctx.okta?.lastUpdated != null && ctx.okta.lastUpdated != '' + on_failure: + - remove: + field: okta.lastUpdated + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: asset.last_updated + copy_from: entityanalytics_okta.user.last_updated + tag: set_asset_last_seen + ignore_empty_value: true + - date: + field: okta.passwordChanged + target_field: entityanalytics_okta.user.password_changed + tag: date_user_password_changed + formats: + - ISO8601 + if: ctx.okta?.passwordChanged != null && ctx.okta.passwordChanged != '' + on_failure: + - remove: + field: okta.passwordChanged + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: user.account.password_change_date + copy_from: entityanalytics_okta.user.password_changed + tag: set_user_account_password_change_date + ignore_empty_value: true + - rename: + field: okta.type + target_field: entityanalytics_okta.user.type + tag: rename_user_type + ignore_missing: true + - rename: + field: okta.transitioningToStatus + target_field: entityanalytics_okta.user.transitioning_to_status + tag: user_transitioning_to_status + ignore_missing: true + - rename: + field: okta.profile.login + target_field: entityanalytics_okta.user.profile.login + tag: rename_user_profile_login + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.login}}}' + tag: append_user_profile_login_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.login != null + - set: + field: user.name + copy_from: entityanalytics_okta.user.profile.login + tag: set_user_name + ignore_empty_value: true + - rename: + field: okta.profile.email + target_field: entityanalytics_okta.user.profile.email + tag: rename_user_profile_email + ignore_missing: true + - set: + field: user.email + copy_from: entityanalytics_okta.user.profile.email + tag: set_user_email + ignore_empty_value: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.email}}}' + tag: append_user_profile_email_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.email != null + - rename: + field: okta.profile.secondEmail + target_field: entityanalytics_okta.user.profile.second_email + tag: rename_user_profile_second_email + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.second_email}}}' + tag: append_user_profile_second_email_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.second_email != null + - set: + field: user.profile.other_identities + copy_from: entityanalytics_okta.user.profile.second_email + tag: set_user_profile_other_identities + ignore_empty_value: true + - set: + field: user.profile.secondEmail + copy_from: entityanalytics_okta.user.profile.second_email + tag: set_user_profile_secondEmail + ignore_empty_value: true + - rename: + field: okta.profile.firstName + target_field: entityanalytics_okta.user.profile.first_name + tag: rename_user_profile_first_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.first_name}}}' + tag: append_user_profile_first_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.first_name != null + - set: + field: user.profile.first_name + copy_from: entityanalytics_okta.user.profile.first_name + tag: set_user_profile_first_name + ignore_empty_value: true + - rename: + field: okta.profile.lastName + target_field: entityanalytics_okta.user.profile.last_name + tag: rename_user_profile_last_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.last_name}}}' + tag: append_user_profile_last_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.last_name != null + - set: + field: user.profile.last_name + copy_from: entityanalytics_okta.user.profile.last_name + tag: set_user_profile_last_name + ignore_empty_value: true + - rename: + field: okta.profile.middleName + target_field: entityanalytics_okta.user.profile.middle_name + tag: rename_user_profile_middle_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.middle_name}}}' + tag: append_user_profile_middle_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.middle_name != null + - rename: + field: okta.profile.honorificPrefix + target_field: entityanalytics_okta.user.profile.honorific.prefix + tag: rename_user_profile_honorific_prefix + ignore_missing: true + - rename: + field: okta.profile.honorificSuffix + target_field: entityanalytics_okta.user.profile.honorific.suffix + tag: rename_user_profile_honorific_suffix + ignore_missing: true + - rename: + field: okta.profile.title + target_field: entityanalytics_okta.user.profile.title + tag: rename_user_profile_title + ignore_missing: true + - set: + field: user.profile.job_title + copy_from: entityanalytics_okta.user.profile.title + tag: set_user_profile_job_title + ignore_empty_value: true + - rename: + field: okta.profile.displayName + target_field: entityanalytics_okta.user.profile.display_name + tag: rename_user_profile_display_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.display_name}}}' + tag: append_user_profile_display_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.display_name != null + - set: + field: user.full_name + copy_from: entityanalytics_okta.user.profile.display_name + tag: set_user_full_name + ignore_empty_value: true + - set: + field: asset.name + copy_from: entityanalytics_okta.user.profile.display_name + tag: set_asset_name + ignore_empty_value: true + - rename: + field: okta.profile.nickName + target_field: entityanalytics_okta.user.profile.nick_name + tag: rename_user_profile_nick_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.nick_name}}}' + tag: append_user_profile_nick_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.nick_name != null + - rename: + field: okta.profile.profileUrl + target_field: entityanalytics_okta.user.profile.url + tag: rename_user_profile_url + ignore_missing: true + - rename: + field: okta.profile.primaryPhone + target_field: entityanalytics_okta.user.profile.primary_phone + tag: rename_user_profile_primary_phone + ignore_missing: true + - set: + field: user.profile.primaryPhone + copy_from: entityanalytics_okta.user.profile.primary_phone + tag: set_user_profile_primaryPhone + ignore_empty_value: true + - rename: + field: okta.profile.mobilePhone + target_field: entityanalytics_okta.user.profile.mobile_phone + tag: rename_user_profile_mobile_phone + ignore_missing: true + - set: + field: user.profile.mobile_phone + copy_from: entityanalytics_okta.user.profile.mobile_phone + tag: set_user_profile_mobile_phone + ignore_empty_value: true + - rename: + field: okta.profile.streetAddress + target_field: entityanalytics_okta.user.profile.street_address + tag: rename_user_profile_street_address + ignore_missing: true + - set: + field: user.geo.name + copy_from: entityanalytics_okta.user.profile.street_address + tag: set_user_geo_name + ignore_empty_value: true + - rename: + field: okta.profile.city + target_field: entityanalytics_okta.user.profile.city + tag: rename_user_profile_city + ignore_missing: true + - set: + field: user.geo.city_name + copy_from: entityanalytics_okta.user.profile.city + tag: set_user_geo_city_name + ignore_empty_value: true + - rename: + field: okta.profile.state + target_field: entityanalytics_okta.user.profile.state + tag: rename_user_profile_state + ignore_missing: true + - set: + field: user.geo.region_name + copy_from: entityanalytics_okta.user.profile.state + tag: set_user_geo_region_name + ignore_empty_value: true + - rename: + field: okta.profile.zipCode + target_field: entityanalytics_okta.user.profile.zip_code + tag: rename_user_profile_zip_code + ignore_missing: true + - set: + field: user.geo.postal_code + copy_from: entityanalytics_okta.user.profile.zip_code + tag: set_user_geo_postal_code + ignore_empty_value: true + - rename: + field: okta.profile.countryCode + target_field: entityanalytics_okta.user.profile.country_code + tag: rename_user_profile_country_code + ignore_missing: true + - set: + field: user.geo.country_iso_code + copy_from: entityanalytics_okta.user.profile.country_code + tag: set_user_geo_country_iso_code + ignore_empty_value: true + - rename: + field: okta.profile.postalAddress + target_field: entityanalytics_okta.user.profile.postal_address + tag: rename_user_profile_postal_address + ignore_missing: true + - rename: + field: okta.profile.preferredLanguage + target_field: entityanalytics_okta.user.profile.preferred_language + tag: rename_user_profile_preferred_language + ignore_missing: true + - rename: + field: okta.profile.locale + target_field: entityanalytics_okta.user.profile.locale + tag: rename_user_profile_locale + ignore_missing: true + - rename: + field: okta.profile.timezone + target_field: entityanalytics_okta.user.profile.timezone + tag: rename_user_profile_timezone + ignore_missing: true + - set: + field: user.geo.timezone + copy_from: entityanalytics_okta.user.profile.timezone + tag: set_user_geo_timezone + ignore_empty_value: true + - rename: + field: okta.profile.userType + target_field: entityanalytics_okta.user.profile.user_type + tag: rename_user_profile_user_type + ignore_missing: true + - set: + field: user.profile.type + copy_from: entityanalytics_okta.user.profile.user_type + tag: set_user_profile_type + ignore_empty_value: true + - rename: + field: okta.profile.employeeNumber + target_field: entityanalytics_okta.user.profile.employee_number + tag: rename_user_profile_employee_number + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.employee_number}}}' + tag: append_user_profile_employee_number_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.employee_number != null + - set: + field: user.profile.id + copy_from: entityanalytics_okta.user.profile.employee_number + tag: set_user_profile_id + ignore_empty_value: true + - rename: + field: okta.profile.costCenter + target_field: entityanalytics_okta.user.profile.cost_center + tag: rename_user_profile_cost_center + ignore_missing: true + - set: + field: asset.costCenter + copy_from: entityanalytics_okta.user.profile.cost_center + tag: set_asset_costCenter + ignore_empty_value: true + - rename: + field: okta.profile.organization + target_field: entityanalytics_okta.user.profile.organization + tag: rename_user_profile_organization + ignore_missing: true + - set: + field: user.organization.name + copy_from: entityanalytics_okta.user.profile.organization + tag: set_user_profile_organization + ignore_empty_value: true + - rename: + field: okta.profile.division + target_field: entityanalytics_okta.user.profile.division + tag: rename_user_profile_division + ignore_missing: true + - rename: + field: okta.profile.department + target_field: entityanalytics_okta.user.profile.department + tag: rename_user_profile_department + ignore_missing: true + - set: + field: user.profile.department + copy_from: entityanalytics_okta.user.profile.department + tag: set_user_profile_department + ignore_empty_value: true + - rename: + field: okta.profile.managerId + target_field: entityanalytics_okta.user.profile.manager.id + tag: rename_user_profile_manager_id + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.manager.id}}}' + tag: append_user_profile_manager_id_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.manager?.id != null + - set: + field: user.profile.manager + copy_from: entityanalytics_okta.user.profile.manager.id + tag: set_user_profile_manager + ignore_empty_value: true + - rename: + field: okta.profile.manager + target_field: entityanalytics_okta.user.profile.manager.name + tag: rename_user_profile_manager_name + ignore_missing: true + - append: + field: related.user + value: '{{{entityanalytics_okta.user.profile.manager.name}}}' + tag: append_user_profile_manager_name_into_related_user + allow_duplicates: false + if: ctx.entityanalytics_okta?.user?.profile?.manager?.name != null + - rename: + field: okta.credentials.provider.type + target_field: entityanalytics_okta.user.credentials.provider.type + tag: rename_user_credentials_provider_type + ignore_missing: true + - rename: + field: okta.credentials.provider.name + target_field: entityanalytics_okta.user.credentials.provider.name + tag: rename_user_credentials_provider_name + ignore_missing: true + - set: + field: asset.vendor + copy_from: entityanalytics_okta.user.credentials.provider.name + tag: set_asset_vendor + ignore_empty_value: true + - rename: + field: okta._links + target_field: entityanalytics_okta.user._links + tag: rename_user_links + ignore_missing: true + - rename: + field: okta._embedded + target_field: entityanalytics_okta.user._embedded + tag: rename_user_embedded + ignore_missing: true + - remove: + field: + - okta + tag: remove_okta + ignore_missing: true + - remove: + field: + - entityanalytics_okta.user.profile.cost_center + - entityanalytics_okta.user.last_login + - entityanalytics_okta.user.last_updated + - entityanalytics_okta.user.status + - entityanalytics_okta.user.credentials.provider.name + - entityanalytics_okta.user.activated + - entityanalytics_okta.user.status_changed + - entityanalytics_okta.user.created + - entityanalytics_okta.user.password_changed + - entityanalytics_okta.user.profile.email + - entityanalytics_okta.user.profile.display_name + - entityanalytics_okta.user.id + - entityanalytics_okta.user.profile.login + - entityanalytics_okta.user.profile.department + - entityanalytics_okta.user.profile.first_name + - entityanalytics_okta.user.profile.employee_number + - entityanalytics_okta.user.profile.title + - entityanalytics_okta.user.profile.last_name + - entityanalytics_okta.user.profile.manager.id + - entityanalytics_okta.user.profile.mobile_phone + - entityanalytics_okta.user.profile.primary_phone + - entityanalytics_okta.user.profile.organization + - entityanalytics_okta.user.profile.street_address + - entityanalytics_okta.user.profile.city + - entityanalytics_okta.user.profile.state + - entityanalytics_okta.user.profile.zip_code + - entityanalytics_okta.user.profile.timezone + - entityanalytics_okta.user.profile.country_code + - entityanalytics_okta.user.profile.second_email + - entityanalytics_okta.user.profile.user_type + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + tag: set_pipeline_error_into_event_kind + value: pipeline_error + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/entityanalytics_okta/data_stream/user/fields/base-fields.yml b/packages/entityanalytics_okta/data_stream/user/fields/base-fields.yml new file mode 100644 index 00000000000..4afa5d7d6a1 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: entityanalytics_okta +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: entityanalytics_okta.user +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/entityanalytics_okta/data_stream/user/fields/beats.yml b/packages/entityanalytics_okta/data_stream/user/fields/beats.yml new file mode 100644 index 00000000000..b3701b581cf --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/entityanalytics_okta/data_stream/user/fields/ecs.yml b/packages/entityanalytics_okta/data_stream/user/fields/ecs.yml new file mode 100644 index 00000000000..7ab99caceaf --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/fields/ecs.yml @@ -0,0 +1,104 @@ +- name: asset + type: group + fields: + - name: category + type: keyword + - name: costCenter + type: keyword + - name: create_date + type: date + - name: id + type: keyword + - name: last_seen + type: date + - name: last_status_change_date + type: date + - name: last_updated + type: date + - name: name + type: keyword + - name: status + type: keyword + - name: type + type: keyword + - name: vendor + type: keyword +- name: labels + type: group + fields: + - name: identity_source + type: keyword +- name: user + type: group + fields: + - name: account + type: group + fields: + - name: activated_date + type: date + - name: change_date + type: date + - name: create_date + type: date + - name: password_change_date + type: date + - name: status + type: group + fields: + - name: deprovisioned + type: boolean + - name: locked_out + type: boolean + - name: password_expired + type: boolean + - name: recovery + type: boolean + - name: suspended + type: boolean + - name: geo + type: group + fields: + - name: city_name + type: keyword + - name: country_iso_code + type: keyword + - name: name + type: keyword + - name: postal_code + type: keyword + - name: region_name + type: keyword + - name: timezone + type: keyword + - name: organization + type: group + fields: + - name: name + type: keyword + - name: profile + type: group + fields: + - name: department + type: keyword + - name: first_name + type: keyword + - name: id + type: keyword + - name: job_title + type: keyword + - name: last_name + type: keyword + - name: manager + type: keyword + - name: mobile_phone + type: keyword + - name: other_identities + type: keyword + - name: primaryPhone + type: keyword + - name: secondEmail + type: keyword + - name: status + type: keyword + - name: type + type: keyword diff --git a/packages/entityanalytics_okta/data_stream/user/fields/fields.yml b/packages/entityanalytics_okta/data_stream/user/fields/fields.yml new file mode 100644 index 00000000000..3a490a76eff --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/fields/fields.yml @@ -0,0 +1,154 @@ +- name: entityanalytics_okta + type: group + fields: + - name: user + type: group + fields: + - name: _embedded + type: object + description: embedded resources related to the user. + - name: _links + type: object + description: link relations for the user's current status. + - name: activated + type: date + description: timestamp when transition to ACTIVE status completed. + - name: created + type: date + description: timestamp when user was created. + - name: credentials + type: group + fields: + - name: provider + type: group + fields: + - name: name + type: keyword + - name: type + type: keyword + - name: id + type: keyword + description: unique key for user. + - name: last_login + type: date + description: timestamp of last login. + - name: last_updated + type: date + description: timestamp when user was last updated. + - name: password_changed + type: date + description: timestamp when password last changed. + - name: profile + type: group + fields: + - name: city + type: keyword + description: City or locality component of user's address (locality). + - name: cost_center + type: keyword + description: Name of a cost center assigned to user. + - name: country_code + type: keyword + description: Country name component of user's address (country). + - name: department + type: keyword + description: Name of user's department. + - name: display_name + type: keyword + description: Name of the user, suitable for display to end users. + - name: division + type: keyword + description: Name of user's division. + - name: email + type: keyword + description: Primary email address of user. + - name: employee_number + type: keyword + description: Organization or company assigned unique identifier for the user. + - name: first_name + type: keyword + description: Given name of the user (givenName). + - name: honorific + type: group + fields: + - name: prefix + type: keyword + description: Honorific prefix(es) of the user, or title in most Western languages. + - name: suffix + type: keyword + description: Honorific suffix(es) of the user. + - name: last_name + type: keyword + description: Family name of the user (familyName). + - name: locale + type: keyword + description: User's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. + - name: login + type: keyword + description: Unique identifier for the user (username). + - name: manager + type: group + fields: + - name: id + type: keyword + description: id of a user's manager. + - name: name + type: keyword + description: displayName of the user's manager. + - name: middle_name + type: keyword + description: Middle name(s) of the user. + - name: mobile_phone + type: keyword + description: Mobile phone number of user. + - name: nick_name + type: keyword + description: Casual way to address the user in real life. + - name: organization + type: keyword + description: Name of user's organization. + - name: postal_address + type: keyword + description: Mailing address component of user's address. + - name: preferred_language + type: keyword + description: User's preferred written or spoken languages. + - name: primary_phone + type: keyword + description: Primary phone number of user such as home number. + - name: second_email + type: keyword + description: Secondary email address of user typically used for account recovery. + - name: state + type: keyword + description: State or region component of user's address (region). + - name: street_address + type: keyword + description: Full street address component of user's address. + - name: timezone + type: keyword + description: User's time zone. + - name: title + type: keyword + description: User's title, such as "Vice President". + - name: url + type: keyword + description: 'URL of user''s online profile (for example: a web page).' + - name: user_type + type: keyword + description: Used to describe the organization to user relationship such as "Employee" or "Contractor". + - name: zip_code + type: keyword + description: ZIP code or postal code component of user's address (postalCode). + - name: status + type: keyword + description: current status of user. + - name: status_changed + type: date + description: timestamp when status last changed. + - name: transitioning_to_status + type: keyword + description: target status of an in-progress asynchronous status transition. + - name: type + type: object + description: user type that determines the schema for the user's profile. diff --git a/packages/entityanalytics_okta/data_stream/user/manifest.yml b/packages/entityanalytics_okta/data_stream/user/manifest.yml new file mode 100644 index 00000000000..b6a20248b61 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/manifest.yml @@ -0,0 +1,114 @@ +title: Collect User Identities logs from Okta +type: logs +streams: + - input: entity-analytics + title: User Identities logs + description: Collect User Identities logs from Okta. + template_path: entity-analytics.yml.hbs + vars: + - name: okta_domain + type: text + title: Domain + multi: false + required: true + show_user: true + description: The Okta domain. + - name: okta_token + type: password + title: Okta API Token + multi: false + required: true + show_user: true + description: The Okta API token, used for authentication. + - name: sync_interval + type: text + title: Sync Interval + description: How often full synchronizations should occur. Must be greater than Update Interval. Expected value is a duration string (15m, 1h, 1m30, etc), defaults to 24h. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: true + default: 24h + - name: update_interval + type: text + title: Update Interval + description: How often incremental updates should occur. Must be less than Sync Interval. Expected value is a duration string (15m, 1h, 1m30, etc), defaults to 15m. Supported units for this parameter are h/m/s. + default: 15m + multi: false + required: true + show_user: true + - name: id + type: text + title: Input ID + description: Identity Source. Which will be added to every event as a label. + multi: false + required: false + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - entityanalytics_okta-user + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve entityanalytics_okta.user fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/entityanalytics_okta/data_stream/user/sample_event.json b/packages/entityanalytics_okta/data_stream/user/sample_event.json new file mode 100644 index 00000000000..d669c44b065 --- /dev/null +++ b/packages/entityanalytics_okta/data_stream/user/sample_event.json @@ -0,0 +1,116 @@ +{ + "@timestamp": "2023-08-11T07:01:21.235Z", + "agent": { + "ephemeral_id": "dbb88a7d-16aa-44e4-8bef-c707be5ac5e2", + "id": "28086f58-96fe-486b-9ef2-4ca0bd13a4e5", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "asset": { + "category": "entity", + "create_date": "2013-06-24T16:39:18.000Z", + "id": "00ub0oNGTSWTBKOLGLNR", + "last_seen": "2013-06-24T17:39:19.000Z", + "last_status_change_date": "2013-06-24T16:39:19.000Z", + "last_updated": "2013-07-02T21:36:25.344Z", + "status": "ACTIVE", + "type": "okta_user", + "vendor": "OKTA" + }, + "data_stream": { + "dataset": "entityanalytics_okta.user", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "28086f58-96fe-486b-9ef2-4ca0bd13a4e5", + "snapshot": false, + "version": "8.9.0" + }, + "entityanalytics_okta": { + "user": { + "activated": "2013-06-24T16:39:19.000Z", + "created": "2013-06-24T16:39:18.000Z", + "credentials": { + "provider": { + "name": "OKTA", + "type": "OKTA" + } + }, + "id": "00ub0oNGTSWTBKOLGLNR", + "last_login": "2013-06-24T17:39:19.000Z", + "last_updated": "2013-07-02T21:36:25.344Z", + "password_changed": "2013-07-02T21:36:25.344Z", + "profile": { + "email": "isaac.brock@example.com", + "first_name": "Isaac", + "last_name": "Brock", + "login": "isaac.brock@example.com", + "mobile_phone": "555-415-1337" + }, + "status": "ACTIVE", + "status_changed": "2013-06-24T16:39:19.000Z" + } + }, + "event": { + "action": "user-discovered", + "agent_id_status": "verified", + "category": [ + "iam" + ], + "dataset": "entityanalytics_okta.user", + "ingested": "2023-08-11T07:01:22Z", + "kind": "asset", + "type": [ + "user", + "info" + ] + }, + "input": { + "type": "entity-analytics" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_okta.user-418d01f7-61b7-4df5-8d71-9e0ce541334e" + }, + "related": { + "user": [ + "00ub0oNGTSWTBKOLGLNR", + "isaac.brock@example.com", + "Isaac", + "Brock" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "entityanalytics_okta-user" + ], + "user": { + "account": { + "activated_date": "2013-06-24T16:39:19.000Z", + "change_date": "2013-06-24T16:39:19.000Z", + "create_date": "2013-06-24T16:39:18.000Z", + "password_change_date": "2013-07-02T21:36:25.344Z", + "status": { + "deprovisioned": false, + "locked_out": false, + "password_expired": false, + "recovery": false, + "suspended": false + } + }, + "email": "isaac.brock@example.com", + "id": "00ub0oNGTSWTBKOLGLNR", + "name": "isaac.brock@example.com", + "profile": { + "first_name": "Isaac", + "last_name": "Brock", + "mobile_phone": "555-415-1337", + "status": "ACTIVE" + } + } +} \ No newline at end of file diff --git a/packages/entityanalytics_okta/docs/README.md b/packages/entityanalytics_okta/docs/README.md new file mode 100644 index 00000000000..c95c82a768a --- /dev/null +++ b/packages/entityanalytics_okta/docs/README.md @@ -0,0 +1,355 @@ +# Okta Entity Analytics + +This [Okta Entity Analytics](https://www.okta.com/) integration allows users to securely stream User Entities data to Elastic Security via the REST API. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for risk-scoring scenarios (e.g., context enrichments) and detecting advanced analytics (UBA) use cases. + +## Compatibility + +This module has been tested against the Core Okta API version **v1**. + +## Data streams + +The Okta Entity Analytics integration collects one type of data: user. + +**User** is used to retrieve all user logs available in an organization. See more details in the API documentation [here](https://developer.okta.com/docs/reference/api/users/#list-users). + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data using Entity Analytics Input and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data from Okta, follow the below steps: + +- Required URL namespace, which should be preceded by an organization's subdomain (tenant) or configured custom domain. +- Create an Okta API Token for Authentication. Follow this [guide](https://developer.okta.com/docs/guides/create-an-api-token/main/). + +### Enabling the integration in Elastic: + +1. In Kibana, go to Management > Integrations. +2. In the "Search for integrations" search bar, type Okta Entity Analytics. +3. Click on the "Okta Entity Analytics" integration from the search results. +4. Click on the Add Okta Entity Analytics Integration button to add the integration. +5. While adding the integration, add the URL and API Token that we got earlier. +6. Save the integration by adding other necessary parameters. + +## Usage + +The Okta provider periodically contacts the Okta API, retrieving updates for users, updates its internal cache of user metadata, and ships updated user metadata to Elasticsearch. + +Fetching and shipping updates occurs in one of two processes: **full synchronizations** and **incremental updates**. Full synchronizations will send the entire list of users in state, along with write markers to indicate the start and end of the synchronization event. Incremental updates will only send data for changed users during that event. Changes on a user can come in many forms, whether it be a change to the user’s metadata, or a user was added or deleted. By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case. + +## Sample Events + +A user document: + +```json +{ + "@timestamp": "2023-07-04T09:57:19.786056-05:00", + "event": { + "action": "user-discovered" + }, + "okta": { + "id": "userid", + "status": "RECOVERY", + "created": "2023-06-02T09:33:00.189752+09:30", + "activated": "0001-01-01T00:00:00Z", + "statusChanged": "2023-06-02T09:33:00.189752+09:30", + "lastLogin": "2023-06-02T09:33:00.189752+09:30", + "lastUpdated": "2023-06-02T09:33:00.189753+09:30", + "passwordChanged": "2023-06-02T09:33:00.189753+09:30", + "type": { + "id": "typeid" + }, + "profile": { + "login": "name.surname@example.com", + "email": "name.surname@example.com", + "firstName": "name", + "lastName": "surname" + }, + "credentials": { + "password": {}, + "provider": { + "type": "OKTA", + "name": "OKTA" + } + }, + "_links": { + "self": { + "href": "https://localhost/api/v1/users/userid" + } + } + }, + "user": { + "id": "userid" + }, + "labels": { + "identity_source": "okta-1" + } +} +``` + +Full synchronizations will be bounded on either side by "write marker" documents. + +```json +{ + "@timestamp": "2022-11-04T09:57:19.786056-05:00", + "event": { + "action": "started", + "start": "2022-11-04T09:57:19.786056-05:00" + }, + "labels": { + "identity_source": "okta-1" + } +} +``` + +## Logs reference + +### User + +This is the `User` dataset. + +#### Example + +An example event for `user` looks as following: + +```json +{ + "@timestamp": "2023-08-11T07:01:21.235Z", + "agent": { + "ephemeral_id": "dbb88a7d-16aa-44e4-8bef-c707be5ac5e2", + "id": "28086f58-96fe-486b-9ef2-4ca0bd13a4e5", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "asset": { + "category": "entity", + "create_date": "2013-06-24T16:39:18.000Z", + "id": "00ub0oNGTSWTBKOLGLNR", + "last_seen": "2013-06-24T17:39:19.000Z", + "last_status_change_date": "2013-06-24T16:39:19.000Z", + "last_updated": "2013-07-02T21:36:25.344Z", + "status": "ACTIVE", + "type": "okta_user", + "vendor": "OKTA" + }, + "data_stream": { + "dataset": "entityanalytics_okta.user", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "28086f58-96fe-486b-9ef2-4ca0bd13a4e5", + "snapshot": false, + "version": "8.9.0" + }, + "entityanalytics_okta": { + "user": { + "activated": "2013-06-24T16:39:19.000Z", + "created": "2013-06-24T16:39:18.000Z", + "credentials": { + "provider": { + "name": "OKTA", + "type": "OKTA" + } + }, + "id": "00ub0oNGTSWTBKOLGLNR", + "last_login": "2013-06-24T17:39:19.000Z", + "last_updated": "2013-07-02T21:36:25.344Z", + "password_changed": "2013-07-02T21:36:25.344Z", + "profile": { + "email": "isaac.brock@example.com", + "first_name": "Isaac", + "last_name": "Brock", + "login": "isaac.brock@example.com", + "mobile_phone": "555-415-1337" + }, + "status": "ACTIVE", + "status_changed": "2013-06-24T16:39:19.000Z" + } + }, + "event": { + "action": "user-discovered", + "agent_id_status": "verified", + "category": [ + "iam" + ], + "dataset": "entityanalytics_okta.user", + "ingested": "2023-08-11T07:01:22Z", + "kind": "asset", + "type": [ + "user", + "info" + ] + }, + "input": { + "type": "entity-analytics" + }, + "labels": { + "identity_source": "entity-analytics-entityanalytics_okta.user-418d01f7-61b7-4df5-8d71-9e0ce541334e" + }, + "related": { + "user": [ + "00ub0oNGTSWTBKOLGLNR", + "isaac.brock@example.com", + "Isaac", + "Brock" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "entityanalytics_okta-user" + ], + "user": { + "account": { + "activated_date": "2013-06-24T16:39:19.000Z", + "change_date": "2013-06-24T16:39:19.000Z", + "create_date": "2013-06-24T16:39:18.000Z", + "password_change_date": "2013-07-02T21:36:25.344Z", + "status": { + "deprovisioned": false, + "locked_out": false, + "password_expired": false, + "recovery": false, + "suspended": false + } + }, + "email": "isaac.brock@example.com", + "id": "00ub0oNGTSWTBKOLGLNR", + "name": "isaac.brock@example.com", + "profile": { + "first_name": "Isaac", + "last_name": "Brock", + "mobile_phone": "555-415-1337", + "status": "ACTIVE" + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| asset.category | | keyword | +| asset.costCenter | | keyword | +| asset.create_date | | date | +| asset.id | | keyword | +| asset.last_seen | | date | +| asset.last_status_change_date | | date | +| asset.last_updated | | date | +| asset.name | | keyword | +| asset.status | | keyword | +| asset.type | | keyword | +| asset.vendor | | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| entityanalytics_okta.user._embedded | embedded resources related to the user. | object | +| entityanalytics_okta.user._links | link relations for the user's current status. | object | +| entityanalytics_okta.user.activated | timestamp when transition to ACTIVE status completed. | date | +| entityanalytics_okta.user.created | timestamp when user was created. | date | +| entityanalytics_okta.user.credentials.provider.name | | keyword | +| entityanalytics_okta.user.credentials.provider.type | | keyword | +| entityanalytics_okta.user.id | unique key for user. | keyword | +| entityanalytics_okta.user.last_login | timestamp of last login. | date | +| entityanalytics_okta.user.last_updated | timestamp when user was last updated. | date | +| entityanalytics_okta.user.password_changed | timestamp when password last changed. | date | +| entityanalytics_okta.user.profile.city | City or locality component of user's address (locality). | keyword | +| entityanalytics_okta.user.profile.cost_center | Name of a cost center assigned to user. | keyword | +| entityanalytics_okta.user.profile.country_code | Country name component of user's address (country). | keyword | +| entityanalytics_okta.user.profile.department | Name of user's department. | keyword | +| entityanalytics_okta.user.profile.display_name | Name of the user, suitable for display to end users. | keyword | +| entityanalytics_okta.user.profile.division | Name of user's division. | keyword | +| entityanalytics_okta.user.profile.email | Primary email address of user. | keyword | +| entityanalytics_okta.user.profile.employee_number | Organization or company assigned unique identifier for the user. | keyword | +| entityanalytics_okta.user.profile.first_name | Given name of the user (givenName). | keyword | +| entityanalytics_okta.user.profile.honorific.prefix | Honorific prefix(es) of the user, or title in most Western languages. | keyword | +| entityanalytics_okta.user.profile.honorific.suffix | Honorific suffix(es) of the user. | keyword | +| entityanalytics_okta.user.profile.last_name | Family name of the user (familyName). | keyword | +| entityanalytics_okta.user.profile.locale | User's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on. | keyword | +| entityanalytics_okta.user.profile.login | Unique identifier for the user (username). | keyword | +| entityanalytics_okta.user.profile.manager.id | id of a user's manager. | keyword | +| entityanalytics_okta.user.profile.manager.name | displayName of the user's manager. | keyword | +| entityanalytics_okta.user.profile.middle_name | Middle name(s) of the user. | keyword | +| entityanalytics_okta.user.profile.mobile_phone | Mobile phone number of user. | keyword | +| entityanalytics_okta.user.profile.nick_name | Casual way to address the user in real life. | keyword | +| entityanalytics_okta.user.profile.organization | Name of user's organization. | keyword | +| entityanalytics_okta.user.profile.postal_address | Mailing address component of user's address. | keyword | +| entityanalytics_okta.user.profile.preferred_language | User's preferred written or spoken languages. | keyword | +| entityanalytics_okta.user.profile.primary_phone | Primary phone number of user such as home number. | keyword | +| entityanalytics_okta.user.profile.second_email | Secondary email address of user typically used for account recovery. | keyword | +| entityanalytics_okta.user.profile.state | State or region component of user's address (region). | keyword | +| entityanalytics_okta.user.profile.street_address | Full street address component of user's address. | keyword | +| entityanalytics_okta.user.profile.timezone | User's time zone. | keyword | +| entityanalytics_okta.user.profile.title | User's title, such as "Vice President". | keyword | +| entityanalytics_okta.user.profile.url | URL of user's online profile (for example: a web page). | keyword | +| entityanalytics_okta.user.profile.user_type | Used to describe the organization to user relationship such as "Employee" or "Contractor". | keyword | +| entityanalytics_okta.user.profile.zip_code | ZIP code or postal code component of user's address (postalCode). | keyword | +| entityanalytics_okta.user.status | current status of user. | keyword | +| entityanalytics_okta.user.status_changed | timestamp when status last changed. | date | +| entityanalytics_okta.user.transitioning_to_status | target status of an in-progress asynchronous status transition. | keyword | +| entityanalytics_okta.user.type | user type that determines the schema for the user's profile. | object | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| labels.identity_source | | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | +| user.account.activated_date | | date | +| user.account.change_date | | date | +| user.account.create_date | | date | +| user.account.password_change_date | | date | +| user.account.status.deprovisioned | | boolean | +| user.account.status.locked_out | | boolean | +| user.account.status.password_expired | | boolean | +| user.account.status.recovery | | boolean | +| user.account.status.suspended | | boolean | +| user.geo.city_name | | keyword | +| user.geo.country_iso_code | | keyword | +| user.geo.name | | keyword | +| user.geo.postal_code | | keyword | +| user.geo.region_name | | keyword | +| user.geo.timezone | | keyword | +| user.organization.name | | keyword | +| user.profile.department | | keyword | +| user.profile.first_name | | keyword | +| user.profile.id | | keyword | +| user.profile.job_title | | keyword | +| user.profile.last_name | | keyword | +| user.profile.manager | | keyword | +| user.profile.mobile_phone | | keyword | +| user.profile.other_identities | | keyword | +| user.profile.primaryPhone | | keyword | +| user.profile.secondEmail | | keyword | +| user.profile.status | | keyword | +| user.profile.type | | keyword | + diff --git a/packages/entityanalytics_okta/img/entityanalytics_okta-user-screenshot.png b/packages/entityanalytics_okta/img/entityanalytics_okta-user-screenshot.png new file mode 100644 index 00000000000..7d2c97370fc Binary files /dev/null and b/packages/entityanalytics_okta/img/entityanalytics_okta-user-screenshot.png differ diff --git a/packages/entityanalytics_okta/img/okta-logo-dark.svg b/packages/entityanalytics_okta/img/okta-logo-dark.svg new file mode 100644 index 00000000000..0d468bbd4cc --- /dev/null +++ b/packages/entityanalytics_okta/img/okta-logo-dark.svg @@ -0,0 +1,72 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/entityanalytics_okta/img/okta-logo.svg b/packages/entityanalytics_okta/img/okta-logo.svg new file mode 100644 index 00000000000..9fe6d8240b7 --- /dev/null +++ b/packages/entityanalytics_okta/img/okta-logo.svg @@ -0,0 +1,72 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/entityanalytics_okta/kibana/dashboard/entityanalytics_okta-e5242a60-0f35-11ee-8319-1d33c4a0c7ae.json b/packages/entityanalytics_okta/kibana/dashboard/entityanalytics_okta-e5242a60-0f35-11ee-8319-1d33c4a0c7ae.json new file mode 100644 index 00000000000..e5c01bffc41 --- /dev/null +++ b/packages/entityanalytics_okta/kibana/dashboard/entityanalytics_okta-e5242a60-0f35-11ee-8319-1d33c4a0c7ae.json @@ -0,0 +1,1092 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"1f994be8-6b14-4377-b289-24dea729179b\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1f994be8-6b14-4377-b289-24dea729179b\",\"fieldName\":\"user.geo.country_iso_code\",\"title\":\"Country Code\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"adde9adc-399a-48e3-8a4f-5f4b3942f80d\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"adde9adc-399a-48e3-8a4f-5f4b3942f80d\",\"fieldName\":\"user.profile.type\",\"title\":\"User Type\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}},\"7453e8ff-ccff-44f2-a65d-5a79ecdcb2f3\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"7453e8ff-ccff-44f2-a65d-5a79ecdcb2f3\",\"fieldName\":\"asset.status\",\"title\":\"Status\",\"grow\":true,\"width\":\"medium\",\"enhancements\":{}}}}" + }, + "description": "Overview of Okta User Entities.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Entity Analytics Okta** \n\n**User**\n\nThis dashboard shows the count of users and status information related to the specific filter applied.\n\n\n\n[**Integration Page**](/app/integrations/detail/entityanalytics_okta/overview)\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 56, + "i": "ab349bb2-1f42-4065-82c6-0e6947fb6303", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "ab349bb2-1f42-4065-82c6-0e6947fb6303", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-60d3e2ca-301c-4d17-93ee-36216debb3cf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5ac369c9-3f9d-4ffc-8b61-e3a7abfb3eeb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "60d3e2ca-301c-4d17-93ee-36216debb3cf": { + "columnOrder": [ + "85bddda4-21fd-4940-8c75-c47bf56425d3", + "645663bf-ccb0-47a3-8b55-449c07dafe37" + ], + "columns": { + "645663bf-ccb0-47a3-8b55-449c07dafe37": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "compact": false, + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "85bddda4-21fd-4940-8c75-c47bf56425d3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "645663bf-ccb0-47a3-8b55-449c07dafe37", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 8 + }, + "scale": "ordinal", + "sourceField": "asset.status" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5ac369c9-3f9d-4ffc-8b61-e3a7abfb3eeb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "85bddda4-21fd-4940-8c75-c47bf56425d3", + "color": "#6092C0", + "layerId": "60d3e2ca-301c-4d17-93ee-36216debb3cf", + "layerType": "data", + "maxCols": 4, + "metricAccessor": "645663bf-ccb0-47a3-8b55-449c07dafe37" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 14, + "i": "21148e57-e528-4b4b-a521-2ba6f9dbe160", + "w": 40, + "x": 8, + "y": 0 + }, + "panelIndex": "21148e57-e528-4b4b-a521-2ba6f9dbe160", + "title": "Count of Users [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af622efb-9441-4a82-ace4-d970984b5e04", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b06da7f-7afa-4b09-b28b-096a9b0dcd01": { + "columnOrder": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7", + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "columns": { + "0cfcd983-28c2-42f2-9812-972e1ebf7b59": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "616bf93c-1d72-4528-82b9-8864f091cbc7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Department", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0cfcd983-28c2-42f2-9812-972e1ebf7b59", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.profile.department" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "af622efb-9441-4a82-ace4-d970984b5e04", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "layerId": "2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "616bf93c-1d72-4528-82b9-8864f091cbc7" + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "e10e53c1-62b9-46d5-929f-8ac3b156bf59", + "w": 20, + "x": 8, + "y": 14 + }, + "panelIndex": "e10e53c1-62b9-46d5-929f-8ac3b156bf59", + "title": "Users by Department [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e08068a6-d2d5-495d-9b77-ad808ec8562a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b06da7f-7afa-4b09-b28b-096a9b0dcd01": { + "columnOrder": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7", + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "columns": { + "0cfcd983-28c2-42f2-9812-972e1ebf7b59": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "616bf93c-1d72-4528-82b9-8864f091cbc7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Profile Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0cfcd983-28c2-42f2-9812-972e1ebf7b59", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.profile.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e08068a6-d2d5-495d-9b77-ad808ec8562a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "bcf0995b-c984-41e6-a358-4168cb8e6c65", + "w": 20, + "x": 28, + "y": 14 + }, + "panelIndex": "bcf0995b-c984-41e6-a358-4168cb8e6c65", + "title": "Users by Profile Type [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "edfd6145-ed06-406d-9fcd-019f722250c7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b06da7f-7afa-4b09-b28b-096a9b0dcd01": { + "columnOrder": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7", + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "columns": { + "0cfcd983-28c2-42f2-9812-972e1ebf7b59": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "616bf93c-1d72-4528-82b9-8864f091cbc7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Division", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0cfcd983-28c2-42f2-9812-972e1ebf7b59", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "entityanalytics_okta.user.profile.division" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "edfd6145-ed06-406d-9fcd-019f722250c7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "7ee0e664-12a3-4e3a-8e84-8eca5d85be85", + "w": 20, + "x": 8, + "y": 28 + }, + "panelIndex": "7ee0e664-12a3-4e3a-8e84-8eca5d85be85", + "title": "Users by Division [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee3fe881-2036-4385-b9a9-c7ba53bf3ee3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b06da7f-7afa-4b09-b28b-096a9b0dcd01": { + "columnOrder": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7", + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "columns": { + "0cfcd983-28c2-42f2-9812-972e1ebf7b59": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "616bf93c-1d72-4528-82b9-8864f091cbc7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Organization", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0cfcd983-28c2-42f2-9812-972e1ebf7b59", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.organization.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ee3fe881-2036-4385-b9a9-c7ba53bf3ee3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "44ee546b-233f-4f65-8775-943b8dd19102", + "w": 20, + "x": 28, + "y": 28 + }, + "panelIndex": "44ee546b-233f-4f65-8775-943b8dd19102", + "title": "Users by Organization [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4ad7383a-6265-4468-89f0-132a4c87bf48", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2b06da7f-7afa-4b09-b28b-096a9b0dcd01": { + "columnOrder": [ + "616bf93c-1d72-4528-82b9-8864f091cbc7", + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "columns": { + "0cfcd983-28c2-42f2-9812-972e1ebf7b59": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "616bf93c-1d72-4528-82b9-8864f091cbc7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Job Title", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0cfcd983-28c2-42f2-9812-972e1ebf7b59", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.profile.job_title" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4ad7383a-6265-4468-89f0-132a4c87bf48", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "0cfcd983-28c2-42f2-9812-972e1ebf7b59" + ], + "layerId": "2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "616bf93c-1d72-4528-82b9-8864f091cbc7" + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "0cfeb7da-d885-4e8e-97ac-1457b946573d", + "w": 40, + "x": 8, + "y": 42 + }, + "panelIndex": "0cfeb7da-d885-4e8e-97ac-1457b946573d", + "title": "Users by Job Title [Logs Okta Entity Analytics]", + "type": "lens", + "version": "8.9.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {}, + "sort": [ + [ + "@timestamp", + "desc" + ] + ] + }, + "gridData": { + "h": 18, + "i": "e0699800-287b-44bf-9c36-e8c67c125535", + "w": 48, + "x": 0, + "y": 56 + }, + "panelIndex": "e0699800-287b-44bf-9c36-e8c67c125535", + "panelRefName": "panel_e0699800-287b-44bf-9c36-e8c67c125535", + "type": "search", + "version": "8.9.0-SNAPSHOT" + } + ], + "timeRestore": false, + "title": "[Logs Okta Entity Analytics] User", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-13T13:27:09.540Z", + "id": "entityanalytics_okta-e5242a60-0f35-11ee-8319-1d33c4a0c7ae", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "21148e57-e528-4b4b-a521-2ba6f9dbe160:indexpattern-datasource-layer-60d3e2ca-301c-4d17-93ee-36216debb3cf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "21148e57-e528-4b4b-a521-2ba6f9dbe160:5ac369c9-3f9d-4ffc-8b61-e3a7abfb3eeb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e10e53c1-62b9-46d5-929f-8ac3b156bf59:indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e10e53c1-62b9-46d5-929f-8ac3b156bf59:af622efb-9441-4a82-ace4-d970984b5e04", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcf0995b-c984-41e6-a358-4168cb8e6c65:indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bcf0995b-c984-41e6-a358-4168cb8e6c65:e08068a6-d2d5-495d-9b77-ad808ec8562a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7ee0e664-12a3-4e3a-8e84-8eca5d85be85:indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7ee0e664-12a3-4e3a-8e84-8eca5d85be85:edfd6145-ed06-406d-9fcd-019f722250c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "44ee546b-233f-4f65-8775-943b8dd19102:indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "44ee546b-233f-4f65-8775-943b8dd19102:ee3fe881-2036-4385-b9a9-c7ba53bf3ee3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0cfeb7da-d885-4e8e-97ac-1457b946573d:indexpattern-datasource-layer-2b06da7f-7afa-4b09-b28b-096a9b0dcd01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0cfeb7da-d885-4e8e-97ac-1457b946573d:4ad7383a-6265-4468-89f0-132a4c87bf48", + "type": "index-pattern" + }, + { + "id": "entityanalytics_okta-d4f05110-0f7a-11ee-8319-1d33c4a0c7ae", + "name": "e0699800-287b-44bf-9c36-e8c67c125535:panel_e0699800-287b-44bf-9c36-e8c67c125535", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_1f994be8-6b14-4377-b289-24dea729179b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_adde9adc-399a-48e3-8a4f-5f4b3942f80d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_7453e8ff-ccff-44f2-a65d-5a79ecdcb2f3:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/entityanalytics_okta/kibana/search/entityanalytics_okta-d4f05110-0f7a-11ee-8319-1d33c4a0c7ae.json b/packages/entityanalytics_okta/kibana/search/entityanalytics_okta-d4f05110-0f7a-11ee-8319-1d33c4a0c7ae.json new file mode 100644 index 00000000000..3482b4b28fe --- /dev/null +++ b/packages/entityanalytics_okta/kibana/search/entityanalytics_okta-d4f05110-0f7a-11ee-8319-1d33c4a0c7ae.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "columns": [ + "asset.last_updated", + "user.id", + "user.full_name", + "event.action", + "asset.status" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "entityanalytics_okta.user" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "entityanalytics_okta.user" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Users Essential Details [Logs Okta Entity Analytics]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-13T13:12:55.902Z", + "id": "entityanalytics_okta-d4f05110-0f7a-11ee-8319-1d33c4a0c7ae", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "search": "8.0.0" + } +} \ No newline at end of file diff --git a/packages/entityanalytics_okta/kibana/tags.yml b/packages/entityanalytics_okta/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/entityanalytics_okta/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/entityanalytics_okta/manifest.yml b/packages/entityanalytics_okta/manifest.yml new file mode 100644 index 00000000000..1a583e3a0ef --- /dev/null +++ b/packages/entityanalytics_okta/manifest.yml @@ -0,0 +1,39 @@ +format_version: "3.0.0" +name: entityanalytics_okta +title: Okta Entity Analytics +version: "0.5.0" +description: "Collect User Identities from Okta with Elastic Agent." +type: integration +categories: + - security +conditions: + kibana: + version: "^8.9.0" + elastic: + subscription: "basic" +screenshots: + - src: /img/entityanalytics_okta-user-screenshot.png + title: Entity Analytics Okta User Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/okta-logo.svg + title: Okta Logo + size: 32x32 + type: image/svg+xml + - src: /img/okta-logo-dark.svg + title: Okta Logo + size: 32x32 + type: image/svg+xml + dark_mode: true +policy_templates: + - name: user + title: User Identities + description: Collect user identities. + inputs: + - type: entity-analytics + title: Collect user identities + description: Collecting identities from Okta. +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/f5/changelog.yml b/packages/f5/changelog.yml index f297b74e4f5..91225a752c9 100644 --- a/packages/f5/changelog.yml +++ b/packages/f5/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.17.0" + changes: + - description: Deprecate package. + type: enhancement + link: https://github.com/elastic/integrations/pull/6832 - version: "0.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/f5/manifest.yml b/packages/f5/manifest.yml index 35953ce2fa0..f41f05e056e 100644 --- a/packages/f5/manifest.yml +++ b/packages/f5/manifest.yml @@ -1,8 +1,8 @@ format_version: 1.0.0 name: f5 -title: F5 Logs -version: "0.16.0" -description: Collect and parse logs from F5 devices with Elastic Agent. +title: F5 Logs (Deprecated) +version: "0.17.0" +description: Deprecated. Use the F5 BIG-IP package instead. categories: ["observability", "load_balancer"] release: experimental license: basic diff --git a/packages/f5_bigip/_dev/build/build.yml b/packages/f5_bigip/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/f5_bigip/_dev/build/build.yml +++ b/packages/f5_bigip/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/f5_bigip/_dev/deploy/docker/docker-compose.yml b/packages/f5_bigip/_dev/deploy/docker/docker-compose.yml index d24e5b7e801..5cf4ca6df97 100644 --- a/packages/f5_bigip/_dev/deploy/docker/docker-compose.yml +++ b/packages/f5_bigip/_dev/deploy/docker/docker-compose.yml @@ -1,5 +1,11 @@ version: '2.3' services: + f5-bigip-log-filestream: + image: alpine + volumes: + - ./sample_logs:/sample_logs:ro + - ${SERVICE_LOGS_DIR}:/var/log + command: /bin/sh -c "cp /sample_logs/* /var/log/" f5-bigip-log-http-endpoint: image: docker.elastic.co/observability/stream:v0.8.0 volumes: diff --git a/packages/f5_bigip/changelog.yml b/packages/f5_bigip/changelog.yml index 735f7177685..e373e1d329c 100644 --- a/packages/f5_bigip/changelog.yml +++ b/packages/f5_bigip/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.9.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.6.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.5.0" + changes: + - description: Provide logfile input. + type: enhancement + link: https://github.com/elastic/integrations/pull/6988 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-afm.log-expected.json b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-afm.log-expected.json index 45521b747d2..b3a03992032 100644 --- a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-afm.log-expected.json +++ b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-afm.log-expected.json @@ -8,7 +8,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Reject", @@ -153,7 +153,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Reject", diff --git a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-apm.log-expected.json b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-apm.log-expected.json index 33d34500418..5b1d78f56ac 100644 --- a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-apm.log-expected.json +++ b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-apm.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-12-03T22:10:07.783Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -64,7 +64,7 @@ { "@timestamp": "2021-10-01T08:00:03.319Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -125,7 +125,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-asm.log-expected.json b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-asm.log-expected.json index 667257555a6..2f71dc8ef2a 100644 --- a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-asm.log-expected.json +++ b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-asm.log-expected.json @@ -10,7 +10,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -173,7 +173,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-avr.log-expected.json b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-avr.log-expected.json index b4bf2d3b25b..1f27ebd8ffa 100644 --- a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-avr.log-expected.json +++ b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-avr.log-expected.json @@ -10,7 +10,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -210,7 +210,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -297,7 +297,7 @@ "ip": "81.2.69.142" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Legal", @@ -428,7 +428,7 @@ { "@timestamp": "2019-04-30T02:52:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -513,7 +513,7 @@ { "@timestamp": "2019-04-30T02:00:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -595,7 +595,7 @@ { "@timestamp": "2019-04-18T07:22:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-ltm.log-expected.json b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-ltm.log-expected.json index 1e671fe25cb..9b8fe8c22bf 100644 --- a/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-ltm.log-expected.json +++ b/packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-ltm.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -113,7 +113,7 @@ "ip": "216.160.83.56" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/f5_bigip/data_stream/log/_dev/test/system/test-filestream-config.yml b/packages/f5_bigip/data_stream/log/_dev/test/system/test-filestream-config.yml new file mode 100644 index 00000000000..55948b52c20 --- /dev/null +++ b/packages/f5_bigip/data_stream/log/_dev/test/system/test-filestream-config.yml @@ -0,0 +1,8 @@ +service: f5-bigip-log-filestream +input: filestream +data_stream: + vars: + preserve_original_event: true + preserve_duplicate_custom_fields: true + paths: + - '{{SERVICE_LOGS_DIR}}/*.log' diff --git a/packages/f5_bigip/data_stream/log/agent/stream/log.yml.hbs b/packages/f5_bigip/data_stream/log/agent/stream/log.yml.hbs new file mode 100644 index 00000000000..4a8b4de4434 --- /dev/null +++ b/packages/f5_bigip/data_stream/log/agent/stream/log.yml.hbs @@ -0,0 +1,43 @@ +paths: +{{#each paths as |path|}} +- {{path}} +{{/each}} +prospector.scanner.exclude_files: [".gz$"] +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- decode_json_fields: + fields: message + target: json + add_error_key: true +- drop_event: + when: + not: + or: + - equals: + json.telemetryEventCategory: LTM + - equals: + json.telemetryEventCategory: ASM + - equals: + json.telemetryEventCategory: AFM + - equals: + json.telemetryEventCategory: AVR + - equals: + json.telemetryEventCategory: APM +- drop_fields: + fields: ['json'] + ignore_missing: true +{{#if processors}} +{{processors}} +{{/if}} diff --git a/packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 8aba1033bdf..60db77d9218 100644 --- a/packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing F5 BIGIP logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/f5_bigip/data_stream/log/fields/ecs.yml b/packages/f5_bigip/data_stream/log/fields/ecs.yml index 0ec5fa80196..a51a91ad790 100644 --- a/packages/f5_bigip/data_stream/log/fields/ecs.yml +++ b/packages/f5_bigip/data_stream/log/fields/ecs.yml @@ -40,6 +40,8 @@ name: http.response.status_code - external: ecs name: http.version +- external: ecs + name: log.file.path - external: ecs name: log.level - external: ecs diff --git a/packages/f5_bigip/data_stream/log/manifest.yml b/packages/f5_bigip/data_stream/log/manifest.yml index 4cb408ae439..f9319693e87 100644 --- a/packages/f5_bigip/data_stream/log/manifest.yml +++ b/packages/f5_bigip/data_stream/log/manifest.yml @@ -74,7 +74,7 @@ streams: required: false show_user: true default: 1m - description: 'Time interval for polling listing of the S3 bucket. NOTE: Supported units for this parameter are h/m/s.' + description: 'Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.' - name: number_of_workers type: integer title: '[S3] Number of Workers' @@ -98,7 +98,7 @@ streams: required: false show_user: true default: 120s - description: 'The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s.' + description: 'The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.' - name: max_number_of_messages type: integer title: '[SQS] Maximum Concurrent SQS Messages' @@ -148,3 +148,49 @@ streams: show_user: false description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - title: F5 BIG-IP logs using filestream input + description: Collect F5 BIG-IP logs using filestream input. + input: filestream + template_path: log.yml.hbs + vars: + - name: paths + title: Paths + type: text + required: true + show_user: true + multi: true + default: + - /var/log/ltm.* + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - f5_bigip-log + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve custom fields for all ECS mappings. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/f5_bigip/data_stream/log/sample_event.json b/packages/f5_bigip/data_stream/log/sample_event.json index e3f9a63ea52..8a78270d042 100644 --- a/packages/f5_bigip/data_stream/log/sample_event.json +++ b/packages/f5_bigip/data_stream/log/sample_event.json @@ -21,7 +21,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "121c9eba-d12d-4405-9bf4-83bc92e8c764", diff --git a/packages/f5_bigip/docs/README.md b/packages/f5_bigip/docs/README.md index b467a2d07ac..b23187bbd19 100644 --- a/packages/f5_bigip/docs/README.md +++ b/packages/f5_bigip/docs/README.md @@ -181,7 +181,7 @@ An example event for `log` looks as following: "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "121c9eba-d12d-4405-9bf4-83bc92e8c764", @@ -379,9 +379,9 @@ An example event for `log` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | @@ -702,6 +702,7 @@ An example event for `log` looks as following: | http.response.status_code | HTTP response status code. | long | | http.version | HTTP version. | keyword | | input.type | Input type | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.offset | Log offset | long | | log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | diff --git a/packages/f5_bigip/kibana/tags.yml b/packages/f5_bigip/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/f5_bigip/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/f5_bigip/manifest.yml b/packages/f5_bigip/manifest.yml index df23e8da18c..eaba4a65f24 100644 --- a/packages/f5_bigip/manifest.yml +++ b/packages/f5_bigip/manifest.yml @@ -1,14 +1,16 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: f5_bigip title: F5 BIG-IP -version: "1.4.0" +version: "1.9.0" description: Collect logs from F5 BIG-IP with Elastic Agent. type: integration categories: - security conditions: - kibana.version: ^7.17.0 || ^8.0.0 - elastic.subscription: basic + kibana: + version: ^7.17.0 || ^8.0.0 + elastic: + subscription: basic screenshots: - src: /img/f5-bigip-screenshot.png title: F5 BIG-IP dashboard screenshot @@ -167,5 +169,9 @@ policy_templates: required: false show_user: false description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - type: filestream + title: Collect F5 BIG-IP logs using filestream input + description: Collecting logs from F5 BIG-IP using filestream input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fim/_dev/build/build.yml b/packages/fim/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/fim/_dev/build/build.yml +++ b/packages/fim/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/fim/changelog.yml b/packages/fim/changelog.yml index 5fb79194ff6..61209b309dd 100644 --- a/packages/fim/changelog.yml +++ b/packages/fim/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.1" + changes: + - description: Exclude files that are regularly updated. + type: bugfix + link: https://github.com/elastic/integrations/pull/7573 +- version: "1.10.0" + changes: + - description: Added dashboard for FIM events overview. + type: enhancement + link: https://github.com/elastic/integrations/pull/7535 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/fim/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/fim/data_stream/event/elasticsearch/ingest_pipeline/default.yml index e9540d7eeef..e3c13a7cee9 100644 --- a/packages/fim/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fim/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing auditd events processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' on_failure: - set: field: event.kind diff --git a/packages/fim/data_stream/event/sample_event.json b/packages/fim/data_stream/event/sample_event.json index da75d267b8a..e3033cfba81 100644 --- a/packages/fim/data_stream/event/sample_event.json +++ b/packages/fim/data_stream/event/sample_event.json @@ -8,7 +8,7 @@ "version": "8.3.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "data_stream": { "dataset": "fim.event", diff --git a/packages/fim/docs/README.md b/packages/fim/docs/README.md index 3a3df1963e4..fc7a1d8ddec 100644 --- a/packages/fim/docs/README.md +++ b/packages/fim/docs/README.md @@ -34,7 +34,7 @@ An example event for `event` looks as following: "version": "8.3.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "data_stream": { "dataset": "fim.event", diff --git a/packages/fim/img/fim-overview.png b/packages/fim/img/fim-overview.png new file mode 100644 index 00000000000..3dae4ad38c1 Binary files /dev/null and b/packages/fim/img/fim-overview.png differ diff --git a/packages/fim/kibana/dashboard/fim-97c782f0-4291-11ee-a0f4-51818a115e85.json b/packages/fim/kibana/dashboard/fim-97c782f0-4291-11ee-a0f4-51818a115e85.json new file mode 100644 index 00000000000..52f250cc6dd --- /dev/null +++ b/packages/fim/kibana/dashboard/fim-97c782f0-4291-11ee-a0f4-51818a115e85.json @@ -0,0 +1,984 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"1493457d-79d9-47e6-ba81-8741d24ecff6\":{\"order\":6,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"agent.name\",\"title\":\"Agent name\",\"id\":\"1493457d-79d9-47e6-ba81-8741d24ecff6\",\"enhancements\":{}}},\"69968e76-1a2d-46cc-85f8-16cc08091b4d\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"69968e76-1a2d-46cc-85f8-16cc08091b4d\",\"fieldName\":\"event.action\",\"title\":\"Action\",\"enhancements\":{}}},\"2e332616-cbb4-4b36-8b40-b8e73cf5e12d\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"2e332616-cbb4-4b36-8b40-b8e73cf5e12d\",\"fieldName\":\"file.hash.sha1\",\"title\":\"SHA1\",\"enhancements\":{}}},\"2e1f7a9a-9603-452d-a303-948334f86026\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"2e1f7a9a-9603-452d-a303-948334f86026\",\"fieldName\":\"file.path\",\"title\":\"File path\",\"enhancements\":{}}},\"1eb33bc0-80e1-4b97-b20d-98c09d6b2667\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1eb33bc0-80e1-4b97-b20d-98c09d6b2667\",\"fieldName\":\"host.os.platform\",\"title\":\"Host platform\",\"enhancements\":{}}},\"63c1b88d-be1e-47ae-8b04-24b0c40f6c59\":{\"type\":\"optionsListControl\",\"order\":5,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"63c1b88d-be1e-47ae-8b04-24b0c40f6c59\",\"fieldName\":\"host.os.name\",\"title\":\"Hostname\",\"enhancements\":{}}},\"f696824e-7a6e-4a76-9eb4-1867d467232d\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"f696824e-7a6e-4a76-9eb4-1867d467232d\",\"fieldName\":\"file.owner\",\"title\":\"File owner\",\"enhancements\":{}}}}" + }, + "description": "Events collected by the File Integrity Monitoring integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**File Integrity Monitoring**\n\n**[Events](/app/dashboards#/view/fim-97c782f0-4291-11ee-a0f4-51818a115e85)** \n\n**Overview**\n\nThis dashboard provides information about the File Integrity Monitoring events collected. \n\nThe FIM integration sends events when a file is changed (created, updated, or deleted) in realtime. At startup this integration will perform an initial scan of the configured files and directories to generate baseline data for the monitored paths and detect changes since the last time it was run. It uses locally persisted data in order to only send events for new or modified files.\n\nThis integration is compatible with Linux, Windows and macOS platforms.\n\nMore information at the [**Integration Page**](/app/integrations/detail/fim/overview).", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 39, + "i": "1d4f74c6-35f0-42db-8592-362faed90dbe", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "1d4f74c6-35f0-42db-8592-362faed90dbe", + "title": "Table of contents", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "503d042f-35c7-4fed-bdd5-bbe2aaee3569", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e2ba06d4-96c6-48b6-8699-12d5e8ae89f9": { + "columnOrder": [ + "83aab0f5-8206-4612-a6fb-262fb99b864d", + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b" + ], + "columns": { + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "83aab0f5-8206-4612-a6fb-262fb99b864d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top actions", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [ + "created", + "deleted", + "updated" + ], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c475ec0-c6e8-41d4-bed5-ef547cb2498b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "index": "503d042f-35c7-4fed-bdd5-bbe2aaee3569", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "allowMultipleMetrics": false, + "categoryDisplay": "default", + "collapseFns": { + "83aab0f5-8206-4612-a6fb-262fb99b864d": "" + }, + "emptySizeRatio": 0.3, + "layerId": "e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "83aab0f5-8206-4612-a6fb-262fb99b864d" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "17459f03-e774-4ca8-b17c-cbe1c2196437", + "w": 20, + "x": 8, + "y": 0 + }, + "panelIndex": "17459f03-e774-4ca8-b17c-cbe1c2196437", + "title": "[Logs FIM] Top actions over monitored files", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e3b7feb2-eedf-4467-a4e8-a8d765ec88c1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e2ba06d4-96c6-48b6-8699-12d5e8ae89f9": { + "columnOrder": [ + "83aab0f5-8206-4612-a6fb-262fb99b864d", + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b" + ], + "columns": { + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "83aab0f5-8206-4612-a6fb-262fb99b864d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top actions", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c475ec0-c6e8-41d4-bed5-ef547cb2498b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.platform" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "index": "e3b7feb2-eedf-4467-a4e8-a8d765ec88c1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "allowMultipleMetrics": false, + "categoryDisplay": "default", + "collapseFns": { + "83aab0f5-8206-4612-a6fb-262fb99b864d": "" + }, + "emptySizeRatio": 0.3, + "layerId": "e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "2c475ec0-c6e8-41d4-bed5-ef547cb2498b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "83aab0f5-8206-4612-a6fb-262fb99b864d" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "2bb7d4a5-64e6-4e1b-ac71-7096e0702142", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "2bb7d4a5-64e6-4e1b-ac71-7096e0702142", + "title": "[Logs FIM] Top platforms", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-abba7002-5788-4a05-a010-367b1a38559e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9280d1c3-3772-42b9-b279-74692298c965", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "abba7002-5788-4a05-a010-367b1a38559e": { + "columnOrder": [ + "813d9f5c-e86b-41c4-904a-600d198c8160", + "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9" + ], + "columns": { + "813d9f5c-e86b-41c4-904a-600d198c8160": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "File", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "file.path" + }, + "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "index": "9280d1c3-3772-42b9-b279-74692298c965", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9" + }, + { + "columnId": "813d9f5c-e86b-41c4-904a-600d198c8160", + "isTransposed": false + } + ], + "layerId": "abba7002-5788-4a05-a010-367b1a38559e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "ef42409b-48f1-46d3-9c36-219137e54dba", + "w": 20, + "x": 8, + "y": 12 + }, + "panelIndex": "ef42409b-48f1-46d3-9c36-219137e54dba", + "title": "[Logs FIM] Top files", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-abba7002-5788-4a05-a010-367b1a38559e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "02d36f73-c5c1-417a-a4e9-64d811ada15f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "abba7002-5788-4a05-a010-367b1a38559e": { + "columnOrder": [ + "813d9f5c-e86b-41c4-904a-600d198c8160", + "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9" + ], + "columns": { + "813d9f5c-e86b-41c4-904a-600d198c8160": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "File owner", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "file.owner" + }, + "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "index": "02d36f73-c5c1-417a-a4e9-64d811ada15f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9dc9f22f-662a-4546-bfd5-2d9e6a0129a9" + }, + { + "columnId": "813d9f5c-e86b-41c4-904a-600d198c8160", + "isTransposed": false + } + ], + "layerId": "abba7002-5788-4a05-a010-367b1a38559e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "903ce2be-2885-45b7-b65d-c2d2bcab3f2b", + "w": 20, + "x": 28, + "y": 12 + }, + "panelIndex": "903ce2be-2885-45b7-b65d-c2d2bcab3f2b", + "title": "[Logs FIM] Top file owners", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7c63feda-8bc4-4a78-be78-e575ab63d42e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1db3d3fc-31aa-4416-a124-cdfb04f471a3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c63feda-8bc4-4a78-be78-e575ab63d42e": { + "columnOrder": [ + "a05583b9-09e3-4d8a-a53a-80dc91c9687b", + "50f4005e-aea9-40f0-ab5a-c9be1198d75b", + "00946662-c79f-4e12-acd5-9fee313b368c", + "dde0b8fc-8145-40d6-8bf9-782059042f7b" + ], + "columns": { + "00946662-c79f-4e12-acd5-9fee313b368c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action: \"deleted\"" + }, + "isBucketed": false, + "label": "Deleted", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "50f4005e-aea9-40f0-ab5a-c9be1198d75b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action : \"created\"" + }, + "isBucketed": false, + "label": "Created", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a05583b9-09e3-4d8a-a53a-80dc91c9687b": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dde0b8fc-8145-40d6-8bf9-782059042f7b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action : \"updated\" " + }, + "isBucketed": false, + "label": "Updated", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "index": "1db3d3fc-31aa-4416-a124-cdfb04f471a3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "curveType": "CURVE_MONOTONE_X", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "50f4005e-aea9-40f0-ab5a-c9be1198d75b", + "00946662-c79f-4e12-acd5-9fee313b368c", + "dde0b8fc-8145-40d6-8bf9-782059042f7b" + ], + "isHistogram": true, + "layerId": "7c63feda-8bc4-4a78-be78-e575ab63d42e", + "layerType": "data", + "seriesType": "area", + "simpleView": false, + "xAccessor": "a05583b9-09e3-4d8a-a53a-80dc91c9687b", + "xScaleType": "time", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "dde0b8fc-8145-40d6-8bf9-782059042f7b" + }, + { + "color": "#e7664c", + "forAccessor": "00946662-c79f-4e12-acd5-9fee313b368c" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "area", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "xTitle": "Timestamp", + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "FIM events" + } + }, + "title": "Threats Over Time [Cloudflare] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "8a2459e5-fd93-4efc-9d6e-39928b9ce5e4", + "w": 40, + "x": 8, + "y": 24 + }, + "panelIndex": "8a2459e5-fd93-4efc-9d6e-39928b9ce5e4", + "title": "[Logs FIM] Events over time (Created vs Deleted vs Modified)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 23, + "i": "7969a555-0794-4dcc-98c4-a1435b7d787a", + "w": 48, + "x": 0, + "y": 39 + }, + "panelIndex": "7969a555-0794-4dcc-98c4-a1435b7d787a", + "panelRefName": "panel_7969a555-0794-4dcc-98c4-a1435b7d787a", + "type": "search", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Logs FIM] Events overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-24T16:36:42.102Z", + "id": "fim-97c782f0-4291-11ee-a0f4-51818a115e85", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "17459f03-e774-4ca8-b17c-cbe1c2196437:indexpattern-datasource-layer-e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17459f03-e774-4ca8-b17c-cbe1c2196437:503d042f-35c7-4fed-bdd5-bbe2aaee3569", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2bb7d4a5-64e6-4e1b-ac71-7096e0702142:indexpattern-datasource-layer-e2ba06d4-96c6-48b6-8699-12d5e8ae89f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2bb7d4a5-64e6-4e1b-ac71-7096e0702142:e3b7feb2-eedf-4467-a4e8-a8d765ec88c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ef42409b-48f1-46d3-9c36-219137e54dba:indexpattern-datasource-layer-abba7002-5788-4a05-a010-367b1a38559e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ef42409b-48f1-46d3-9c36-219137e54dba:9280d1c3-3772-42b9-b279-74692298c965", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "903ce2be-2885-45b7-b65d-c2d2bcab3f2b:indexpattern-datasource-layer-abba7002-5788-4a05-a010-367b1a38559e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "903ce2be-2885-45b7-b65d-c2d2bcab3f2b:02d36f73-c5c1-417a-a4e9-64d811ada15f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a2459e5-fd93-4efc-9d6e-39928b9ce5e4:indexpattern-datasource-layer-7c63feda-8bc4-4a78-be78-e575ab63d42e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a2459e5-fd93-4efc-9d6e-39928b9ce5e4:1db3d3fc-31aa-4416-a124-cdfb04f471a3", + "type": "index-pattern" + }, + { + "id": "fim-6c045e50-4295-11ee-a0f4-51818a115e85", + "name": "7969a555-0794-4dcc-98c4-a1435b7d787a:panel_7969a555-0794-4dcc-98c4-a1435b7d787a", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_1493457d-79d9-47e6-ba81-8741d24ecff6:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_69968e76-1a2d-46cc-85f8-16cc08091b4d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2e332616-cbb4-4b36-8b40-b8e73cf5e12d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2e1f7a9a-9603-452d-a303-948334f86026:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_1eb33bc0-80e1-4b97-b20d-98c09d6b2667:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_63c1b88d-be1e-47ae-8b04-24b0c40f6c59:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f696824e-7a6e-4a76-9eb4-1867d467232d:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/fim/kibana/search/fim-6c045e50-4295-11ee-a0f4-51818a115e85.json b/packages/fim/kibana/search/fim-6c045e50-4295-11ee-a0f4-51818a115e85.json new file mode 100644 index 00000000000..eedc6973dd8 --- /dev/null +++ b/packages/fim/kibana/search/fim-6c045e50-4295-11ee-a0f4-51818a115e85.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "columns": [ + "file.path", + "file.hash.sha1", + "event.action", + "host.hostname" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "FIM", + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "fim.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "fim.event" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Latest FIM events", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-24T15:46:42.486Z", + "id": "fim-6c045e50-4295-11ee-a0f4-51818a115e85", + "migrationVersion": { + "search": "8.0.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search" +} \ No newline at end of file diff --git a/packages/fim/kibana/tags.yml b/packages/fim/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fim/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fim/manifest.yml b/packages/fim/manifest.yml index 806866501f4..d0c437921e6 100644 --- a/packages/fim/manifest.yml +++ b/packages/fim/manifest.yml @@ -1,18 +1,23 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: fim title: "File Integrity Monitoring" -version: "1.8.0" +version: "1.12.0" description: "The File Integrity Monitoring integration reports filesystem changes in real time." type: integration categories: - security conditions: - kibana.version: "^8.2.0" + kibana: + version: ^8.7.1 icons: - src: /img/sample-logo.svg title: Sample logo size: 32x32 type: image/svg+xml +screenshots: + - src: /img/fim-overview.png + title: FIM events overview dashboard + type: image/png policy_templates: - name: fim title: File Integrity Monitoring @@ -39,7 +44,6 @@ vars: - /sbin - /usr/sbin - /etc - - /usr/share - name: recursive type: bool title: Recursive monitoring @@ -104,6 +108,9 @@ vars: - '(?i)\.sw[nop]$' - '~$' - '/\.git($|/)' + - '\.tmp$' + - '\.log$' + - '\.db$' - name: keep_null type: bool title: Keep null fields @@ -130,3 +137,4 @@ vars: See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fireeye/_dev/build/build.yml b/packages/fireeye/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/fireeye/_dev/build/build.yml +++ b/packages/fireeye/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/fireeye/changelog.yml b/packages/fireeye/changelog.yml index a65c684c34e..d871eaec106 100644 --- a/packages/fireeye/changelog.yml +++ b/packages/fireeye/changelog.yml @@ -1,3 +1,13 @@ +- version: "1.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/fireeye/data_stream/nx/_dev/test/pipeline/test-nx.log-expected.json b/packages/fireeye/data_stream/nx/_dev/test/pipeline/test-nx.log-expected.json index 6f4ed7c537b..1a42f62a41e 100644 --- a/packages/fireeye/data_stream/nx/_dev/test/pipeline/test-nx.log-expected.json +++ b/packages/fireeye/data_stream/nx/_dev/test/pipeline/test-nx.log-expected.json @@ -10,7 +10,7 @@ "port": 10001 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -83,7 +83,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -144,7 +144,7 @@ "port": 10001 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -217,7 +217,7 @@ "port": 5938 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -299,7 +299,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -370,7 +370,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -485,7 +485,7 @@ "port": 5601 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -593,7 +593,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/default.yml b/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/default.yml index 4eb4dd674a3..0f80ad7467a 100644 --- a/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fireeye/data_stream/nx/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing FireEye NX logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: "Fireeye" diff --git a/packages/fireeye/data_stream/nx/sample_event.json b/packages/fireeye/data_stream/nx/sample_event.json index 7f6af23e461..47501a57c3a 100644 --- a/packages/fireeye/data_stream/nx/sample_event.json +++ b/packages/fireeye/data_stream/nx/sample_event.json @@ -20,7 +20,7 @@ "port": 10001 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b10c3ab-9f4b-4ca0-b5ad-b6200b7fe65d", diff --git a/packages/fireeye/docs/README.md b/packages/fireeye/docs/README.md index 6c688235157..a042e8c8764 100644 --- a/packages/fireeye/docs/README.md +++ b/packages/fireeye/docs/README.md @@ -194,7 +194,7 @@ An example event for `nx` looks as following: "port": 10001 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b10c3ab-9f4b-4ca0-b5ad-b6200b7fe65d", diff --git a/packages/fireeye/kibana/tags.yml b/packages/fireeye/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fireeye/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fireeye/manifest.yml b/packages/fireeye/manifest.yml index 0800f3e9d39..a6afe2133fe 100644 --- a/packages/fireeye/manifest.yml +++ b/packages/fireeye/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: fireeye title: "FireEye Network Security" -version: "1.13.0" +version: "1.15.0" description: Collect logs from FireEye NX with Elastic Agent. type: integration categories: diff --git a/packages/forcepoint_web/_dev/build/build.yml b/packages/forcepoint_web/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/forcepoint_web/_dev/build/build.yml +++ b/packages/forcepoint_web/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/forcepoint_web/changelog.yml b/packages/forcepoint_web/changelog.yml index a248a32a896..af914b0779b 100644 --- a/packages/forcepoint_web/changelog.yml +++ b/packages/forcepoint_web/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.1" + changes: + - description: Remove version attribute from ingest node pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/7807 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.0.0" changes: - description: Release Forcepoint Web Security as GA. diff --git a/packages/forcepoint_web/data_stream/logs/_dev/test/pipeline/test-forcepoint-web.json-expected.json b/packages/forcepoint_web/data_stream/logs/_dev/test/pipeline/test-forcepoint-web.json-expected.json index 808f63406d8..218ae7e1a9a 100644 --- a/packages/forcepoint_web/data_stream/logs/_dev/test/pipeline/test-forcepoint-web.json-expected.json +++ b/packages/forcepoint_web/data_stream/logs/_dev/test/pipeline/test-forcepoint-web.json-expected.json @@ -23,7 +23,7 @@ "ip": "175.16.199.68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/forcepoint_web/data_stream/logs/elasticsearch/ingest_pipeline/default.yml b/packages/forcepoint_web/data_stream/logs/elasticsearch/ingest_pipeline/default.yml index 3979f38e83e..c737a925b37 100644 --- a/packages/forcepoint_web/data_stream/logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forcepoint_web/data_stream/logs/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 1 description: Pipeline to process Forcepoint Web logs processors: @@ -46,7 +45,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: if: "ctx?.tags != null && ctx.tags.contains('preserve_original_event')" diff --git a/packages/forcepoint_web/data_stream/logs/sample_event.json b/packages/forcepoint_web/data_stream/logs/sample_event.json index 397bda534a7..be26fc1aaf8 100644 --- a/packages/forcepoint_web/data_stream/logs/sample_event.json +++ b/packages/forcepoint_web/data_stream/logs/sample_event.json @@ -16,7 +16,7 @@ "ip": "3.24.198.68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8cc7367b-4069-4535-8545-a477b8c273af", diff --git a/packages/forcepoint_web/docs/README.md b/packages/forcepoint_web/docs/README.md index a8b82321b93..6d6819fb7a0 100644 --- a/packages/forcepoint_web/docs/README.md +++ b/packages/forcepoint_web/docs/README.md @@ -101,7 +101,7 @@ An example event for `logs` looks as following: "ip": "3.24.198.68" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8cc7367b-4069-4535-8545-a477b8c273af", @@ -238,13 +238,13 @@ The following fields may be used by the package: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | diff --git a/packages/forcepoint_web/kibana/tags.yml b/packages/forcepoint_web/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/forcepoint_web/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/forcepoint_web/manifest.yml b/packages/forcepoint_web/manifest.yml index da0d4ccb47b..e3ebaecfa0c 100644 --- a/packages/forcepoint_web/manifest.yml +++ b/packages/forcepoint_web/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: forcepoint_web title: "Forcepoint Web Security" -version: "1.0.0" +version: "1.3.0" source: license: "Elastic-2.0" description: "Forcepoint Web Security" @@ -10,8 +10,10 @@ categories: - network - security conditions: - kibana.version: "^8.5.1" - elastic.subscription: "basic" + kibana: + version: "^8.5.1" + elastic: + subscription: "basic" screenshots: - src: /img/sample-screenshot.png title: Sample screenshot @@ -32,3 +34,4 @@ policy_templates: description: Collecting logs from Forcepoint Web Security via file. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/forgerock/_dev/build/build.yml b/packages/forgerock/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/forgerock/_dev/build/build.yml +++ b/packages/forgerock/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/forgerock/changelog.yml b/packages/forgerock/changelog.yml index 60f2676117e..ba54cd980be 100644 --- a/packages/forgerock/changelog.yml +++ b/packages/forgerock/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.9.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7601 +- version: "1.6.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.5.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.4.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.3.1" changes: - description: Fix IDM Activity revision field type. diff --git a/packages/forgerock/data_stream/am_access/_dev/test/pipeline/test-am-access.log-expected.json b/packages/forgerock/data_stream/am_access/_dev/test/pipeline/test-am-access.log-expected.json index 41d9cc248d9..ffe754b0250 100644 --- a/packages/forgerock/data_stream/am_access/_dev/test/pipeline/test-am-access.log-expected.json +++ b/packages/forgerock/data_stream/am_access/_dev/test/pipeline/test-am-access.log-expected.json @@ -6,7 +6,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -73,7 +73,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", @@ -156,7 +156,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -217,7 +217,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", @@ -295,7 +295,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -362,7 +362,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", @@ -445,7 +445,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -505,7 +505,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -573,7 +573,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", @@ -651,7 +651,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -721,7 +721,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", @@ -804,7 +804,7 @@ "ip": "1.128.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -878,7 +878,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-ATTEMPT", @@ -939,7 +939,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-ACCESS-OUTCOME", diff --git a/packages/forgerock/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml index 5ed09b36fed..ae4fe74772b 100644 --- a/packages/forgerock/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock am-access audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/am_access/sample_event.json b/packages/forgerock/data_stream/am_access/sample_event.json index 9eb7f580685..88143476860 100644 --- a/packages/forgerock/data_stream/am_access/sample_event.json +++ b/packages/forgerock/data_stream/am_access/sample_event.json @@ -1,67 +1,63 @@ { - "@timestamp": "2022-10-05T18:21:48.248Z", - "client": { - "ip": "1.128.0.0" + "@timestamp": "2022-11-06T18:16:43.813Z", + "agent": { + "ephemeral_id": "d7b5cd10-b6c7-4ab2-8d07-043fb6d42e2b", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_access", + "namespace": "ep", + "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "action": "AM-ACCESS-ATTEMPT", - "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256203", + "action": "AM-SESSION-IDLE_TIMED_OUT", + "agent_id_status": "verified", + "created": "2023-08-29T18:23:25.132Z", + "dataset": "forgerock.am_access", + "id": "688b24d9-968e-4a20-b471-9bd78f1e46ec-79599", + "ingested": "2023-08-29T18:23:28Z", "type": "access" }, "forgerock": { - "eventName": "AM-ACCESS-ATTEMPT", - "http": { - "request": { - "headers": { - "accept": [ - "text/plain,*/*" - ], - "content-type": [ - "application/x-www-form-urlencoded" - ], - "host": [ - "openam-chico-poc.forgeblocks.com" - ], - "user-agent": [ - "Jersey/2.34 (HttpUrlConnection 11.0.9)" - ], - "x-forwarded-for": [ - "34.94.38.177, 34.149.144.150, 10.168.0.8" - ], - "x-forwarded-proto": [ - "https" - ] - }, - "secure": true - } - }, + "eventName": "AM-SESSION-IDLE_TIMED_OUT", "level": "INFO", + "objectId": "688b24d9-968e-4a20-b471-9bd78f1e46ec-13901", "realm": "/", - "request": { - "detail": { - "grant_type": "client_credentials", - "scope": "fr:idm:*" - } - }, "source": "audit", - "topic": "access" + "topic": "activity", + "trackingIds": [ + "688b24d9-968e-4a20-b471-9bd78f1e46ec-13901" + ] }, - "http": { - "request": { - "Path": "https://openam-chico-poc.forgeblocks.com/am/oauth2/access_token", - "method": "POST" - } + "input": { + "type": "httpjson" }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { - "name": "OAuth" + "name": "Session" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-access" + ], "transaction": { - "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" + "id": "688b24d9-968e-4a20-b471-9bd78f1e46ec-1" + }, + "user": { + "id": "id=d7cd65bf-743c-4753-a78f-a20daae7e3bf,ou=user,ou=am-config" } } \ No newline at end of file diff --git a/packages/forgerock/data_stream/am_activity/_dev/test/pipeline/test-am-activity.log-expected.json b/packages/forgerock/data_stream/am_activity/_dev/test/pipeline/test-am-activity.log-expected.json index 7be21c45dab..44361aa7fff 100644 --- a/packages/forgerock/data_stream/am_activity/_dev/test/pipeline/test-am-activity.log-expected.json +++ b/packages/forgerock/data_stream/am_activity/_dev/test/pipeline/test-am-activity.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-05T20:55:59.966Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -39,7 +39,7 @@ { "@timestamp": "2022-10-05T21:26:00.043Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-IDLE_TIMED_OUT", @@ -72,7 +72,7 @@ { "@timestamp": "2022-10-05T22:29:20.069Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -108,7 +108,7 @@ { "@timestamp": "2022-10-05T23:21:42.553Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-IDENTITY-CHANGE", @@ -151,7 +151,7 @@ { "@timestamp": "2022-10-05T23:21:55.767Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-IDENTITY-CHANGE", @@ -200,7 +200,7 @@ { "@timestamp": "2022-10-05T23:21:55.776Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -236,7 +236,7 @@ { "@timestamp": "2022-10-05T23:33:01.037Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-IDLE_TIMED_OUT", @@ -269,7 +269,7 @@ { "@timestamp": "2022-10-05T23:54:17.025Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-IDLE_TIMED_OUT", @@ -302,7 +302,7 @@ { "@timestamp": "2022-10-06T15:45:21.439Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -338,7 +338,7 @@ { "@timestamp": "2022-10-06T16:15:21.580Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-IDLE_TIMED_OUT", @@ -371,7 +371,7 @@ { "@timestamp": "2022-10-06T17:03:08.826Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -407,7 +407,7 @@ { "@timestamp": "2022-10-06T17:19:53.832Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -443,7 +443,7 @@ { "@timestamp": "2022-10-06T17:33:04.980Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-IDENTITY-CHANGE", @@ -481,7 +481,7 @@ { "@timestamp": "2022-10-06T17:33:05.188Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-CREATED", @@ -517,7 +517,7 @@ { "@timestamp": "2022-10-06T17:33:08.866Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-IDLE_TIMED_OUT", @@ -550,7 +550,7 @@ { "@timestamp": "2022-10-06T17:33:12.247Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-SESSION-DESTROYED", diff --git a/packages/forgerock/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml index a38bea3073f..c71503b4ae9 100644 --- a/packages/forgerock/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock am-activity audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/am_activity/sample_event.json b/packages/forgerock/data_stream/am_activity/sample_event.json index 3755d4a13a4..541a4176c67 100644 --- a/packages/forgerock/data_stream/am_activity/sample_event.json +++ b/packages/forgerock/data_stream/am_activity/sample_event.json @@ -1,11 +1,32 @@ { "@timestamp": "2022-10-05T20:55:59.966Z", + "agent": { + "ephemeral_id": "6af93045-8737-4c3a-87a6-6b24d24d94c3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_activity", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-SESSION-CREATED", + "agent_id_status": "verified", + "created": "2023-08-29T18:24:18.086Z", + "dataset": "forgerock.am_activity", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-438366", + "ingested": "2023-08-29T18:24:21Z", "reason": "CREATE" }, "forgerock": { @@ -18,12 +39,20 @@ "45463f84-ff1b-499f-aa84-8d4bd93150de-438033" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { "name": "Session" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-activity" + ], "transaction": { "id": "5ff83988-8f23-4108-9359-42658fcfc4d1-request-3/0" }, diff --git a/packages/forgerock/data_stream/am_authentication/_dev/test/pipeline/test-am-authentication.log-expected.json b/packages/forgerock/data_stream/am_authentication/_dev/test/pipeline/test-am-authentication.log-expected.json index 76852506249..573befa9312 100644 --- a/packages/forgerock/data_stream/am_authentication/_dev/test/pipeline/test-am-authentication.log-expected.json +++ b/packages/forgerock/data_stream/am_authentication/_dev/test/pipeline/test-am-authentication.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-05T18:21:48.253Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-COMPLETED", @@ -51,7 +51,7 @@ { "@timestamp": "2022-10-05T18:21:48.450Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-MODULE-COMPLETED", @@ -97,7 +97,7 @@ { "@timestamp": "2022-10-05T18:21:48.451Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-COMPLETED", @@ -145,7 +145,7 @@ { "@timestamp": "2022-10-05T18:21:48.863Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-MODULE-COMPLETED", @@ -191,7 +191,7 @@ { "@timestamp": "2022-10-05T18:21:48.864Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-COMPLETED", @@ -239,7 +239,7 @@ { "@timestamp": "2022-10-05T18:21:49.058Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-MODULE-COMPLETED", @@ -285,7 +285,7 @@ { "@timestamp": "2022-10-05T18:21:49.059Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-LOGIN-COMPLETED", diff --git a/packages/forgerock/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml index 91a0addff2f..089e423ad36 100644 --- a/packages/forgerock/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock am-authentication audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/am_authentication/sample_event.json b/packages/forgerock/data_stream/am_authentication/sample_event.json index 1db343dd8a4..eeed3a5f90d 100644 --- a/packages/forgerock/data_stream/am_authentication/sample_event.json +++ b/packages/forgerock/data_stream/am_authentication/sample_event.json @@ -1,12 +1,33 @@ { "@timestamp": "2022-10-05T18:21:48.253Z", + "agent": { + "ephemeral_id": "3a49e2d0-3cf1-4a2f-8f79-88f5bcc4f5bb", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_authentication", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-LOGIN-COMPLETED", + "agent_id_status": "verified", "category": "authentication", + "created": "2023-08-29T18:25:11.183Z", + "dataset": "forgerock.am_authentication", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256208", + "ingested": "2023-08-29T18:25:14Z", "outcome": "success" }, "forgerock": { @@ -33,12 +54,20 @@ "45463f84-ff1b-499f-aa84-8d4bd93150de-256204" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { "name": "Authentication" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-authentication" + ], "transaction": { "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" }, diff --git a/packages/forgerock/data_stream/am_config/_dev/test/pipeline/test-am-config.log-expected.json b/packages/forgerock/data_stream/am_config/_dev/test/pipeline/test-am-config.log-expected.json index 61159d7ffa7..86c12b974f8 100644 --- a/packages/forgerock/data_stream/am_config/_dev/test/pipeline/test-am-config.log-expected.json +++ b/packages/forgerock/data_stream/am_config/_dev/test/pipeline/test-am-config.log-expected.json @@ -3,11 +3,13 @@ { "@timestamp": "2022-09-20T14:40:10.664Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", + "category": [ + "configuration" + ], "id": "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-20605" }, "forgerock": { @@ -37,11 +39,13 @@ { "@timestamp": "2022-09-20T18:21:24.739Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", + "category": [ + "configuration" + ], "id": "2fc30045-3090-44d5-bd88-6b42eeacc0ed-124858" }, "forgerock": { @@ -74,11 +78,13 @@ { "@timestamp": "2022-09-20T18:21:24.980Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", + "category": [ + "configuration" + ], "id": "2fc30045-3090-44d5-bd88-6b42eeacc0ed-124871" }, "forgerock": { @@ -111,11 +117,13 @@ { "@timestamp": "2022-09-20T18:21:28.753Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", + "category": [ + "configuration" + ], "id": "2fc30045-3090-44d5-bd88-6b42eeacc0ed-125179" }, "forgerock": { diff --git a/packages/forgerock/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml index b2472afc9dc..b01b4acc04a 100644 --- a/packages/forgerock/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock am-confg audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform @@ -41,7 +41,7 @@ processors: # am-config processing - set: field: event.category - value: configuration + value: [configuration] - set: field: event.action copy_from: forgerock.eventName diff --git a/packages/forgerock/data_stream/am_config/sample_event.json b/packages/forgerock/data_stream/am_config/sample_event.json index 0fd2d531a13..5838db6c01a 100644 --- a/packages/forgerock/data_stream/am_config/sample_event.json +++ b/packages/forgerock/data_stream/am_config/sample_event.json @@ -1,12 +1,35 @@ { "@timestamp": "2022-09-20T14:40:10.664Z", + "agent": { + "ephemeral_id": "8b20ca54-fc63-4851-8782-615436bf1368", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_config", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", - "id": "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-20605" + "agent_id_status": "verified", + "category": [ + "configuration" + ], + "created": "2023-08-29T18:26:03.247Z", + "dataset": "forgerock.am_config", + "id": "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-20605", + "ingested": "2023-08-29T18:26:06Z" }, "forgerock": { "level": "INFO", @@ -19,9 +42,17 @@ "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-5563" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-config" + ], "transaction": { "id": "1663684810619-c42f8145dec437c43428-2465/0" }, diff --git a/packages/forgerock/data_stream/am_core/_dev/test/pipeline/test-am-core.log-expected.json b/packages/forgerock/data_stream/am_core/_dev/test/pipeline/test-am-core.log-expected.json index 1cd9e50553f..d32933165fe 100644 --- a/packages/forgerock/data_stream/am_core/_dev/test/pipeline/test-am-core.log-expected.json +++ b/packages/forgerock/data_stream/am_core/_dev/test/pipeline/test-am-core.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-12-05T19:29:20.845Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Connection attempt failed: availableConnections=0, maxPoolSize=10" @@ -25,7 +25,7 @@ { "@timestamp": "2022-12-05T19:29:20.855Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Closing 1 idle pooled sockets: availableConnections=2, maxPoolSize=10" @@ -47,7 +47,7 @@ { "@timestamp": "2022-12-05T19:29:21.767Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "stack_trace": "java.io.IOException: Enclosing message doesn't have the application/x-www-form-urlencoded Content-Type header\n\tat org.forgerock.http.protocol.Entity.getFormAsync(Entity.java:363)\n\tat org.forgerock.http.protocol.Entity.getForm(Entity.java:343)\n\tat org.forgerock.openam.http.ApiDescriptorFilter.filter(ApiDescriptorFilter.java:46)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.ResponseContext$ResponseContextFilter.filter(ResponseContext.java:53)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.OpenAMHttpApplication.lambda$static$1(OpenAMHttpApplication.java:60)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.OpenAMHttpApplication.lambda$cacheHeaderFilter$3(OpenAMHttpApplication.java:88)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.http.filter.TransactionIdInboundFilter.filter(TransactionIdInboundFilter.java:86)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.http.servlet.HttpFrameworkServlet.service(HttpFrameworkServlet.java:282)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:764)\n\tat org.forgerock.openam.http.OpenAMHttpFrameworkServlet.service(OpenAMHttpFrameworkServlet.java:47)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:764)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.services.datastore.DataStoreConsistencyFilter.lambda$doFilter$0(DataStoreConsistencyFilter.java:46)\n\tat org.forgerock.openam.service.datastore.ReentrantVolatileActionConsistencyController.safeExecute(ReentrantVolatileActionConsistencyController.java:37)\n\tat org.forgerock.openam.services.datastore.DataStoreConsistencyFilter.doFilter(DataStoreConsistencyFilter.java:46)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.rest.ProtocolVersionFilter.doFilter(ProtocolVersionFilter.java:63)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SecureCookieFilter.doFilter(SecureCookieFilter.java:63)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.DisableSameSiteCookiesFilter.doFilter(DisableSameSiteCookiesFilter.java:106)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.validation.ResponseValidationFilter.doFilter(ResponseValidationFilter.java:59)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat com.sun.identity.setup.AMSetupFilter.doFilter(AMSetupFilter.java:115)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.validation.RequestEntitySizeVerificationFilter.doFilter(RequestEntitySizeVerificationFilter.java:64)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.audit.context.AuditContextFilter.doFilter(AuditContextFilter.java:47)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1789)\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat java.base/java.lang.Thread.run(Thread.java:829)\n" @@ -75,7 +75,7 @@ { "@timestamp": "2022-12-05T19:29:21.768Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Readiness health check invoked" @@ -100,7 +100,7 @@ { "@timestamp": "2022-12-05T19:29:22.365Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "stack_trace": "java.io.IOException: Enclosing message doesn't have the application/x-www-form-urlencoded Content-Type header\n\tat org.forgerock.http.protocol.Entity.getFormAsync(Entity.java:363)\n\tat org.forgerock.http.protocol.Entity.getForm(Entity.java:343)\n\tat org.forgerock.openam.http.ApiDescriptorFilter.filter(ApiDescriptorFilter.java:46)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.ResponseContext$ResponseContextFilter.filter(ResponseContext.java:53)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.OpenAMHttpApplication.lambda$static$1(OpenAMHttpApplication.java:60)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.openam.http.OpenAMHttpApplication.lambda$cacheHeaderFilter$3(OpenAMHttpApplication.java:88)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.http.filter.TransactionIdInboundFilter.filter(TransactionIdInboundFilter.java:86)\n\tat org.forgerock.http.handler.Handlers$1.handle(Handlers.java:54)\n\tat org.forgerock.http.servlet.HttpFrameworkServlet.service(HttpFrameworkServlet.java:282)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:764)\n\tat org.forgerock.openam.http.OpenAMHttpFrameworkServlet.service(OpenAMHttpFrameworkServlet.java:47)\n\tat javax.servlet.http.HttpServlet.service(HttpServlet.java:764)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.services.datastore.DataStoreConsistencyFilter.lambda$doFilter$0(DataStoreConsistencyFilter.java:46)\n\tat org.forgerock.openam.service.datastore.ReentrantVolatileActionConsistencyController.safeExecute(ReentrantVolatileActionConsistencyController.java:37)\n\tat org.forgerock.openam.services.datastore.DataStoreConsistencyFilter.doFilter(DataStoreConsistencyFilter.java:46)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.rest.ProtocolVersionFilter.doFilter(ProtocolVersionFilter.java:63)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SecureCookieFilter.doFilter(SecureCookieFilter.java:63)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.DisableSameSiteCookiesFilter.doFilter(DisableSameSiteCookiesFilter.java:106)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.validation.ResponseValidationFilter.doFilter(ResponseValidationFilter.java:59)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.headers.SetHeadersFilter.doFilter(SetHeadersFilter.java:110)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat com.sun.identity.setup.AMSetupFilter.doFilter(AMSetupFilter.java:115)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.validation.RequestEntitySizeVerificationFilter.doFilter(RequestEntitySizeVerificationFilter.java:64)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.forgerock.openam.audit.context.AuditContextFilter.doFilter(AuditContextFilter.java:47)\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)\n\tat org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)\n\tat org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)\n\tat org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)\n\tat org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890)\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1789)\n\tat org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)\n\tat org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n\tat java.base/java.lang.Thread.run(Thread.java:829)\n" diff --git a/packages/forgerock/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml index 9f613c70a0b..5a0f97f43ae 100644 --- a/packages/forgerock/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock am-core debug logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/am_core/sample_event.json b/packages/forgerock/data_stream/am_core/sample_event.json index 7853ef5bb92..97eb0531a40 100644 --- a/packages/forgerock/data_stream/am_core/sample_event.json +++ b/packages/forgerock/data_stream/am_core/sample_event.json @@ -1,14 +1,38 @@ { "@timestamp": "2022-12-05T19:29:20.845Z", + "agent": { + "ephemeral_id": "a4c66cb1-05e2-4a3c-bf9f-b1ba82d619a3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_core", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:26:55.131Z", + "dataset": "forgerock.am_core", + "ingested": "2023-08-29T18:26:58Z", "reason": "Connection attempt failed: availableConnections=0, maxPoolSize=10" }, "forgerock": { "context": "default" }, + "input": { + "type": "httpjson" + }, "log": { "level": "DEBUG", "logger": "org.forgerock.opendj.ldap.CachedConnectionPool" @@ -18,5 +42,10 @@ }, "process": { "name": "LDAP SDK Default Scheduler" - } + }, + "tags": [ + "forwarded", + "forgerock-debug", + "forgerock-am-core" + ] } \ No newline at end of file diff --git a/packages/forgerock/data_stream/idm_access/_dev/test/pipeline/test-idm-access.log-expected.json b/packages/forgerock/data_stream/idm_access/_dev/test/pipeline/test-idm-access.log-expected.json index 09c102dc380..932ba235747 100644 --- a/packages/forgerock/data_stream/idm_access/_dev/test/pipeline/test-idm-access.log-expected.json +++ b/packages/forgerock/data_stream/idm_access/_dev/test/pipeline/test-idm-access.log-expected.json @@ -7,7 +7,7 @@ "port": 56278 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "duration": 2000000, @@ -72,7 +72,7 @@ "port": 56286 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "duration": 2000000, @@ -137,7 +137,7 @@ "port": 44310 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "duration": 2000000, @@ -202,7 +202,7 @@ "port": 59132 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "duration": 2000000, diff --git a/packages/forgerock/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml index 093a651a1a3..976e7b3fe74 100644 --- a/packages/forgerock/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-access audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_access/sample_event.json b/packages/forgerock/data_stream/idm_access/sample_event.json index 18dd064849d..749d7abfb4e 100644 --- a/packages/forgerock/data_stream/idm_access/sample_event.json +++ b/packages/forgerock/data_stream/idm_access/sample_event.json @@ -1,15 +1,36 @@ { "@timestamp": "2022-11-01T15:04:50.110Z", + "agent": { + "ephemeral_id": "21bbe733-0623-4805-af6d-e7cb05b45003", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, "client": { - "ip": "1.128.0.0", + "ip": "216.160.83.56", "port": 56278 }, + "data_stream": { + "dataset": "forgerock.idm_access", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:27:48.240Z", + "dataset": "forgerock.idm_access", "duration": 2000000, "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-49025", + "ingested": "2023-08-29T18:27:51Z", "outcome": "success", "type": "access" }, @@ -50,12 +71,20 @@ "status_code": 200 } }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "server": { - "ip": "175.16.199.0" + "ip": "81.2.69.142" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-access" + ], "transaction": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-49021" }, diff --git a/packages/forgerock/data_stream/idm_activity/_dev/test/pipeline/test-idm-activity.log-expected.json b/packages/forgerock/data_stream/idm_activity/_dev/test/pipeline/test-idm-activity.log-expected.json index 71c2a4f3751..ee7a21eefca 100644 --- a/packages/forgerock/data_stream/idm_activity/_dev/test/pipeline/test-idm-activity.log-expected.json +++ b/packages/forgerock/data_stream/idm_activity/_dev/test/pipeline/test-idm-activity.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-11-01T17:55:08.523Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-259113", @@ -35,7 +35,7 @@ { "@timestamp": "2022-11-01T18:02:39.806Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-268903", @@ -68,7 +68,7 @@ { "@timestamp": "2022-11-01T18:02:39.882Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-268906", @@ -101,7 +101,7 @@ { "@timestamp": "2022-11-01T18:07:23.147Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-276027", @@ -133,7 +133,7 @@ { "@timestamp": "2022-11-01T18:07:23.407Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-276057", @@ -165,7 +165,7 @@ { "@timestamp": "2022-11-01T18:07:23.367Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-276055", @@ -195,4 +195,4 @@ } } ] -} +} \ No newline at end of file diff --git a/packages/forgerock/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml index f980d9bfd5d..83a9dd25065 100644 --- a/packages/forgerock/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-activity audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_activity/sample_event.json b/packages/forgerock/data_stream/idm_activity/sample_event.json index 5fb18efafe1..6f6f40ddad9 100644 --- a/packages/forgerock/data_stream/idm_activity/sample_event.json +++ b/packages/forgerock/data_stream/idm_activity/sample_event.json @@ -1,32 +1,62 @@ { - "@timestamp": "2022-11-01T17:55:08.523Z", + "@timestamp": "2022-11-01T18:02:39.882Z", + "agent": { + "ephemeral_id": "353ff5a3-0662-4599-99a0-3cff15bab6d7", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_activity", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-259113", + "agent_id_status": "verified", + "created": "2023-08-29T18:28:40.611Z", + "dataset": "forgerock.idm_activity", + "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-268906", + "ingested": "2023-08-29T18:28:43Z", "outcome": "success" }, "forgerock": { - "eventName": "activity", + "eventName": "relationship_created", "level": "INFO", - "objectId": "internal/role/8713dd4e-3f4a-480d-9172-3a70a2dea73f", - "operation": "PATCH", + "message": "Relationship originating from managed/alpha_organization/e6df3df4-c798-4187-ba06-db8e6ae3db88 via the relationship field parent and referencing managed/alpha_organization/c4de605d-9d1b-439e-9ea8-9aba47e01008 was created.", + "objectId": "managed/alpha_organization/e6df3df4-c798-4187-ba06-db8e6ae3db88/parent/bb20cd10-e6ad-48fd-8ef1-e8d4c3f7859f", + "operation": "CREATE", "passwordChanged": false, "revision": "00000000478fd92b", "source": "audit", "topic": "activity" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-activity" + ], "transaction": { - "id": "1667325297350-5f3959fa550528a7ef3d-23359/0" + "id": "1667325742545-ee41d6454a6b4a815b69-24798/0" }, "user": { "effective": { - "id": "d7cd65bf-743c-4753-a78f-a20daae7e3bf" + "id": "9120c7db-d7e6-4b51-b805-07bbee7a4bb9" }, - "id": "d7cd65bf-743c-4753-a78f-a20daae7e3bf" + "id": "9120c7db-d7e6-4b51-b805-07bbee7a4bb9" } -} +} \ No newline at end of file diff --git a/packages/forgerock/data_stream/idm_authentication/_dev/test/pipeline/test-idm-authentication.log-expected.json b/packages/forgerock/data_stream/idm_authentication/_dev/test/pipeline/test-idm-authentication.log-expected.json index 77cdee202d0..841e649652e 100644 --- a/packages/forgerock/data_stream/idm_authentication/_dev/test/pipeline/test-idm-authentication.log-expected.json +++ b/packages/forgerock/data_stream/idm_authentication/_dev/test/pipeline/test-idm-authentication.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-05T18:21:48.253Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "authentication", diff --git a/packages/forgerock/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml index 59faa0c1635..542ed2534b0 100644 --- a/packages/forgerock/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-authentication audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_authentication/sample_event.json b/packages/forgerock/data_stream/idm_authentication/sample_event.json index ee0b1f49864..7c4bb80476b 100644 --- a/packages/forgerock/data_stream/idm_authentication/sample_event.json +++ b/packages/forgerock/data_stream/idm_authentication/sample_event.json @@ -1,11 +1,32 @@ { "@timestamp": "2022-10-05T18:21:48.253Z", + "agent": { + "ephemeral_id": "c42575e9-a330-406b-a3b5-04edf383bb2e", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_authentication", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", "category": "authentication", + "created": "2023-08-29T18:29:35.619Z", + "dataset": "forgerock.idm_authentication", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256208", + "ingested": "2023-08-29T18:29:38Z", "outcome": "success" }, "forgerock": { @@ -32,9 +53,17 @@ "45463f84-ff1b-499f-aa84-8d4bd93150de-256204" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-authentication" + ], "transaction": { "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" }, diff --git a/packages/forgerock/data_stream/idm_config/_dev/test/pipeline/test-idm-config.log-expected.json b/packages/forgerock/data_stream/idm_config/_dev/test/pipeline/test-idm-config.log-expected.json index 3ebb18a5492..d79cf2e938d 100644 --- a/packages/forgerock/data_stream/idm_config/_dev/test/pipeline/test-idm-config.log-expected.json +++ b/packages/forgerock/data_stream/idm_config/_dev/test/pipeline/test-idm-config.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-19T16:12:12.549Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "configuration", @@ -35,7 +35,7 @@ { "@timestamp": "2022-10-19T16:12:55.668Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "configuration", @@ -67,7 +67,7 @@ { "@timestamp": "2022-10-19T16:13:04.862Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "configuration", diff --git a/packages/forgerock/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml index dbe1958dcf4..3cfad65c2f5 100644 --- a/packages/forgerock/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-config audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_config/sample_event.json b/packages/forgerock/data_stream/idm_config/sample_event.json index e558f045f4d..3fb545dceaa 100644 --- a/packages/forgerock/data_stream/idm_config/sample_event.json +++ b/packages/forgerock/data_stream/idm_config/sample_event.json @@ -1,11 +1,32 @@ { "@timestamp": "2022-10-19T16:12:12.549Z", + "agent": { + "ephemeral_id": "e0c45592-0c85-42cf-a413-86e1a9ea0fba", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_config", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", "category": "configuration", - "id": "5e787c05-c32f-40d3-9e77-666376f6738f-134332" + "created": "2023-08-29T18:30:25.437Z", + "dataset": "forgerock.idm_config", + "id": "5e787c05-c32f-40d3-9e77-666376f6738f-134332", + "ingested": "2023-08-29T18:30:28Z" }, "forgerock": { "changedFields": [ @@ -17,9 +38,17 @@ "source": "audit", "topic": "config" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-config" + ], "transaction": { "id": "1666195908296-b802a87436c00618a43e-13149/0" }, diff --git a/packages/forgerock/data_stream/idm_core/_dev/test/pipeline/test-idm-core.log-expected.json b/packages/forgerock/data_stream/idm_core/_dev/test/pipeline/test-idm-core.log-expected.json index 16156c2db2b..44541fd3a3a 100644 --- a/packages/forgerock/data_stream/idm_core/_dev/test/pipeline/test-idm-core.log-expected.json +++ b/packages/forgerock/data_stream/idm_core/_dev/test/pipeline/test-idm-core.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" @@ -15,7 +15,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "FINE: Read name=user id=anonymous" @@ -27,7 +27,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" @@ -39,7 +39,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "FINE: Read name=user id=anonymous" @@ -51,7 +51,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" @@ -63,7 +63,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "FINE: Read name=user id=anonymous" @@ -75,7 +75,7 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" diff --git a/packages/forgerock/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml index 89e7c7c54ba..9a998c69119 100644 --- a/packages/forgerock/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-core debug logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_core/sample_event.json b/packages/forgerock/data_stream/idm_core/sample_event.json index ae0522d6534..e5fceb6c4bb 100644 --- a/packages/forgerock/data_stream/idm_core/sample_event.json +++ b/packages/forgerock/data_stream/idm_core/sample_event.json @@ -1,12 +1,41 @@ { "@timestamp": "2022-12-05T20:01:34.448Z", + "agent": { + "ephemeral_id": "6afff7c3-5136-4b5c-bd1e-41176dfda962", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_core", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:31:16.370Z", + "dataset": "forgerock.idm_core", + "ingested": "2023-08-29T18:31:19Z", "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" - } + }, + "tags": [ + "forwarded", + "forgerock-debug", + "forgerock-idm-core" + ] } \ No newline at end of file diff --git a/packages/forgerock/data_stream/idm_sync/_dev/test/pipeline/test-idm-sync.log-expected.json b/packages/forgerock/data_stream/idm_sync/_dev/test/pipeline/test-idm-sync.log-expected.json index 3474466db2f..3328c40718d 100644 --- a/packages/forgerock/data_stream/idm_sync/_dev/test/pipeline/test-idm-sync.log-expected.json +++ b/packages/forgerock/data_stream/idm_sync/_dev/test/pipeline/test-idm-sync.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-19T16:09:17.900Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130280", @@ -33,7 +33,7 @@ { "@timestamp": "2022-10-19T16:09:18.157Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130294", @@ -63,7 +63,7 @@ { "@timestamp": "2022-10-19T16:09:18.210Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130298", @@ -94,7 +94,7 @@ { "@timestamp": "2022-10-19T16:09:18.289Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130301", @@ -124,7 +124,7 @@ { "@timestamp": "2022-10-19T16:09:18.432Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130303", diff --git a/packages/forgerock/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml b/packages/forgerock/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml index 93efb4570fa..401abc34b1d 100644 --- a/packages/forgerock/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml +++ b/packages/forgerock/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for ForgeRock idm-sync audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: ForgeRock Identity Platform diff --git a/packages/forgerock/data_stream/idm_sync/sample_event.json b/packages/forgerock/data_stream/idm_sync/sample_event.json index 9c9cf2bb04a..b1163a0437f 100644 --- a/packages/forgerock/data_stream/idm_sync/sample_event.json +++ b/packages/forgerock/data_stream/idm_sync/sample_event.json @@ -1,10 +1,31 @@ { "@timestamp": "2022-10-19T16:09:17.900Z", + "agent": { + "ephemeral_id": "de52dbc7-9ccf-4400-8b31-2299929a4a11", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_sync", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:32:10.406Z", + "dataset": "forgerock.idm_sync", "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130280", + "ingested": "2023-08-29T18:32:13Z", "outcome": "success" }, "forgerock": { @@ -18,9 +39,17 @@ "sourceObjectId": "managed/alpha_user/9d88b635-9b7a-48d3-9a57-1978b99a5f41", "topic": "sync" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-sync" + ], "transaction": { "id": "1666195747447-56a35455016b7da218a6-11991/0" }, diff --git a/packages/forgerock/docs/README.md b/packages/forgerock/docs/README.md index f40f18c357c..4e6980b404a 100644 --- a/packages/forgerock/docs/README.md +++ b/packages/forgerock/docs/README.md @@ -16,70 +16,66 @@ An example event for `am_access` looks as following: ```json { - "@timestamp": "2022-10-05T18:21:48.248Z", - "client": { - "ip": "1.128.0.0" + "@timestamp": "2022-11-06T18:16:43.813Z", + "agent": { + "ephemeral_id": "d7b5cd10-b6c7-4ab2-8d07-043fb6d42e2b", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_access", + "namespace": "ep", + "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "action": "AM-ACCESS-ATTEMPT", - "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256203", + "action": "AM-SESSION-IDLE_TIMED_OUT", + "agent_id_status": "verified", + "created": "2023-08-29T18:23:25.132Z", + "dataset": "forgerock.am_access", + "id": "688b24d9-968e-4a20-b471-9bd78f1e46ec-79599", + "ingested": "2023-08-29T18:23:28Z", "type": "access" }, "forgerock": { - "eventName": "AM-ACCESS-ATTEMPT", - "http": { - "request": { - "headers": { - "accept": [ - "text/plain,*/*" - ], - "content-type": [ - "application/x-www-form-urlencoded" - ], - "host": [ - "openam-chico-poc.forgeblocks.com" - ], - "user-agent": [ - "Jersey/2.34 (HttpUrlConnection 11.0.9)" - ], - "x-forwarded-for": [ - "34.94.38.177, 34.149.144.150, 10.168.0.8" - ], - "x-forwarded-proto": [ - "https" - ] - }, - "secure": true - } - }, + "eventName": "AM-SESSION-IDLE_TIMED_OUT", "level": "INFO", + "objectId": "688b24d9-968e-4a20-b471-9bd78f1e46ec-13901", "realm": "/", - "request": { - "detail": { - "grant_type": "client_credentials", - "scope": "fr:idm:*" - } - }, "source": "audit", - "topic": "access" + "topic": "activity", + "trackingIds": [ + "688b24d9-968e-4a20-b471-9bd78f1e46ec-13901" + ] }, - "http": { - "request": { - "Path": "https://openam-chico-poc.forgeblocks.com/am/oauth2/access_token", - "method": "POST" - } + "input": { + "type": "httpjson" }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { - "name": "OAuth" + "name": "Session" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-access" + ], "transaction": { - "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" + "id": "688b24d9-968e-4a20-b471-9bd78f1e46ec-1" + }, + "user": { + "id": "id=d7cd65bf-743c-4753-a78f-a20daae7e3bf,ou=user,ou=am-config" } } ``` @@ -98,7 +94,7 @@ An example event for `am_access` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -164,12 +160,33 @@ An example event for `am_activity` looks as following: ```json { "@timestamp": "2022-10-05T20:55:59.966Z", + "agent": { + "ephemeral_id": "6af93045-8737-4c3a-87a6-6b24d24d94c3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_activity", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-SESSION-CREATED", + "agent_id_status": "verified", + "created": "2023-08-29T18:24:18.086Z", + "dataset": "forgerock.am_activity", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-438366", + "ingested": "2023-08-29T18:24:21Z", "reason": "CREATE" }, "forgerock": { @@ -182,12 +199,20 @@ An example event for `am_activity` looks as following: "45463f84-ff1b-499f-aa84-8d4bd93150de-438033" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { "name": "Session" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-activity" + ], "transaction": { "id": "5ff83988-8f23-4108-9359-42658fcfc4d1-request-3/0" }, @@ -211,7 +236,7 @@ An example event for `am_activity` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | forgerock.after | Specifies the JSON representation of the object after the activity. | object | @@ -244,13 +269,34 @@ An example event for `am_authentication` looks as following: ```json { "@timestamp": "2022-10-05T18:21:48.253Z", + "agent": { + "ephemeral_id": "3a49e2d0-3cf1-4a2f-8f79-88f5bcc4f5bb", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_authentication", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-LOGIN-COMPLETED", + "agent_id_status": "verified", "category": "authentication", + "created": "2023-08-29T18:25:11.183Z", + "dataset": "forgerock.am_authentication", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256208", + "ingested": "2023-08-29T18:25:14Z", "outcome": "success" }, "forgerock": { @@ -277,12 +323,20 @@ An example event for `am_authentication` looks as following: "45463f84-ff1b-499f-aa84-8d4bd93150de-256204" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "service": { "name": "Authentication" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-authentication" + ], "transaction": { "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" }, @@ -330,13 +384,36 @@ An example event for `am_config` looks as following: ```json { "@timestamp": "2022-09-20T14:40:10.664Z", + "agent": { + "ephemeral_id": "8b20ca54-fc63-4851-8782-615436bf1368", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_config", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "AM-CONFIG-CHANGE", - "category": "configuration", - "id": "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-20605" + "agent_id_status": "verified", + "category": [ + "configuration" + ], + "created": "2023-08-29T18:26:03.247Z", + "dataset": "forgerock.am_config", + "id": "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-20605", + "ingested": "2023-08-29T18:26:06Z" }, "forgerock": { "level": "INFO", @@ -349,9 +426,17 @@ An example event for `am_config` looks as following: "4e8550cd-71d6-4a08-b5b0-bb63bcbbc960-5563" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-am-config" + ], "transaction": { "id": "1663684810619-c42f8145dec437c43428-2465/0" }, @@ -404,15 +489,39 @@ An example event for `am_core` looks as following: ```json { "@timestamp": "2022-12-05T19:29:20.845Z", + "agent": { + "ephemeral_id": "a4c66cb1-05e2-4a3c-bf9f-b1ba82d619a3", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.am_core", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:26:55.131Z", + "dataset": "forgerock.am_core", + "ingested": "2023-08-29T18:26:58Z", "reason": "Connection attempt failed: availableConnections=0, maxPoolSize=10" }, "forgerock": { "context": "default" }, + "input": { + "type": "httpjson" + }, "log": { "level": "DEBUG", "logger": "org.forgerock.opendj.ldap.CachedConnectionPool" @@ -422,7 +531,12 @@ An example event for `am_core` looks as following: }, "process": { "name": "LDAP SDK Default Scheduler" - } + }, + "tags": [ + "forwarded", + "forgerock-debug", + "forgerock-am-core" + ] } ``` @@ -460,16 +574,37 @@ An example event for `idm_access` looks as following: ```json { "@timestamp": "2022-11-01T15:04:50.110Z", + "agent": { + "ephemeral_id": "21bbe733-0623-4805-af6d-e7cb05b45003", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, "client": { - "ip": "1.128.0.0", + "ip": "216.160.83.56", "port": 56278 }, + "data_stream": { + "dataset": "forgerock.idm_access", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:27:48.240Z", + "dataset": "forgerock.idm_access", "duration": 2000000, "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-49025", + "ingested": "2023-08-29T18:27:51Z", "outcome": "success", "type": "access" }, @@ -510,12 +645,20 @@ An example event for `idm_access` looks as following: "status_code": 200 } }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, "server": { - "ip": "175.16.199.0" + "ip": "81.2.69.142" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-access" + ], "transaction": { "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-49021" }, @@ -569,35 +712,65 @@ An example event for `idm_activity` looks as following: ```json { - "@timestamp": "2022-11-01T17:55:08.523Z", + "@timestamp": "2022-11-01T18:02:39.882Z", + "agent": { + "ephemeral_id": "353ff5a3-0662-4599-99a0-3cff15bab6d7", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_activity", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { - "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-259113", + "agent_id_status": "verified", + "created": "2023-08-29T18:28:40.611Z", + "dataset": "forgerock.idm_activity", + "id": "a9a32d9e-7029-45e6-b581-eafb5d502273-268906", + "ingested": "2023-08-29T18:28:43Z", "outcome": "success" }, "forgerock": { - "eventName": "activity", + "eventName": "relationship_created", "level": "INFO", - "objectId": "internal/role/8713dd4e-3f4a-480d-9172-3a70a2dea73f", - "operation": "PATCH", + "message": "Relationship originating from managed/alpha_organization/e6df3df4-c798-4187-ba06-db8e6ae3db88 via the relationship field parent and referencing managed/alpha_organization/c4de605d-9d1b-439e-9ea8-9aba47e01008 was created.", + "objectId": "managed/alpha_organization/e6df3df4-c798-4187-ba06-db8e6ae3db88/parent/bb20cd10-e6ad-48fd-8ef1-e8d4c3f7859f", + "operation": "CREATE", "passwordChanged": false, "revision": "00000000478fd92b", "source": "audit", "topic": "activity" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-activity" + ], "transaction": { - "id": "1667325297350-5f3959fa550528a7ef3d-23359/0" + "id": "1667325742545-ee41d6454a6b4a815b69-24798/0" }, "user": { "effective": { - "id": "d7cd65bf-743c-4753-a78f-a20daae7e3bf" + "id": "9120c7db-d7e6-4b51-b805-07bbee7a4bb9" }, - "id": "d7cd65bf-743c-4753-a78f-a20daae7e3bf" + "id": "9120c7db-d7e6-4b51-b805-07bbee7a4bb9" } } ``` @@ -640,12 +813,33 @@ An example event for `idm_authentication` looks as following: ```json { "@timestamp": "2022-10-05T18:21:48.253Z", + "agent": { + "ephemeral_id": "c42575e9-a330-406b-a3b5-04edf383bb2e", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_authentication", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", "category": "authentication", + "created": "2023-08-29T18:29:35.619Z", + "dataset": "forgerock.idm_authentication", "id": "45463f84-ff1b-499f-aa84-8d4bd93150de-256208", + "ingested": "2023-08-29T18:29:38Z", "outcome": "success" }, "forgerock": { @@ -672,9 +866,17 @@ An example event for `idm_authentication` looks as following: "45463f84-ff1b-499f-aa84-8d4bd93150de-256204" ] }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-authentication" + ], "transaction": { "id": "1664994108247-9f138d8fc9f59d23164c-26466/0" }, @@ -720,12 +922,33 @@ An example event for `idm_config` looks as following: ```json { "@timestamp": "2022-10-19T16:12:12.549Z", + "agent": { + "ephemeral_id": "e0c45592-0c85-42cf-a413-86e1a9ea0fba", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_config", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", "category": "configuration", - "id": "5e787c05-c32f-40d3-9e77-666376f6738f-134332" + "created": "2023-08-29T18:30:25.437Z", + "dataset": "forgerock.idm_config", + "id": "5e787c05-c32f-40d3-9e77-666376f6738f-134332", + "ingested": "2023-08-29T18:30:28Z" }, "forgerock": { "changedFields": [ @@ -737,9 +960,17 @@ An example event for `idm_config` looks as following: "source": "audit", "topic": "config" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-config" + ], "transaction": { "id": "1666195908296-b802a87436c00618a43e-13149/0" }, @@ -787,15 +1018,44 @@ An example event for `idm_core` looks as following: ```json { "@timestamp": "2022-12-05T20:01:34.448Z", + "agent": { + "ephemeral_id": "6afff7c3-5136-4b5c-bd1e-41176dfda962", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_core", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:31:16.370Z", + "dataset": "forgerock.idm_core", + "ingested": "2023-08-29T18:31:19Z", "reason": "Dec 05, 2022 8:01:34 PM org.forgerock.openidm.internal.InternalObjectSet readInstance" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" - } + }, + "tags": [ + "forwarded", + "forgerock-debug", + "forgerock-idm-core" + ] } ``` @@ -824,11 +1084,32 @@ An example event for `idm_sync` looks as following: ```json { "@timestamp": "2022-10-19T16:09:17.900Z", + "agent": { + "ephemeral_id": "de52dbc7-9ccf-4400-8b31-2299929a4a11", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.1" + }, + "data_stream": { + "dataset": "forgerock.idm_sync", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { + "agent_id_status": "verified", + "created": "2023-08-29T18:32:10.406Z", + "dataset": "forgerock.idm_sync", "id": "5e787c05-c32f-40d3-9e77-666376f6738f-130280", + "ingested": "2023-08-29T18:32:13Z", "outcome": "success" }, "forgerock": { @@ -842,9 +1123,17 @@ An example event for `idm_sync` looks as following: "sourceObjectId": "managed/alpha_user/9d88b635-9b7a-48d3-9a57-1978b99a5f41", "topic": "sync" }, + "input": { + "type": "httpjson" + }, "observer": { "vendor": "ForgeRock Identity Platform" }, + "tags": [ + "forwarded", + "forgerock-audit", + "forgerock-idm-sync" + ], "transaction": { "id": "1666195747447-56a35455016b7da218a6-11991/0" }, diff --git a/packages/forgerock/kibana/tags.yml b/packages/forgerock/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/forgerock/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/forgerock/manifest.yml b/packages/forgerock/manifest.yml index 333ff5792a4..a2402f1c75e 100644 --- a/packages/forgerock/manifest.yml +++ b/packages/forgerock/manifest.yml @@ -1,14 +1,13 @@ name: forgerock title: "ForgeRock" -version: "1.3.1" -release: ga -license: basic +version: "1.9.0" description: Collect audit logs from ForgeRock with Elastic Agent. type: integration -format_version: 1.0.0 +format_version: "3.0.0" categories: ["security"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/forgerock-dashboard.png title: ForgeRock Dashboard @@ -41,6 +40,7 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -66,7 +66,7 @@ policy_templates: - name: initial_interval type: text title: Initial Interval - description: How far back to pull logs from ForgeRock. Can not be longer than 24 hours. + description: How far back to pull logs from ForgeRock. Can not be longer than 24 hours. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -74,7 +74,7 @@ policy_templates: - name: interval type: text title: Interval - description: Duration between requests to the ForgeRock API. + description: Duration between requests to the ForgeRock API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -86,3 +86,4 @@ icons: type: image/svg+xml owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fortinet_forticlient/_dev/build/build.yml b/packages/fortinet_forticlient/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/fortinet_forticlient/_dev/build/build.yml +++ b/packages/fortinet_forticlient/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/fortinet_forticlient/changelog.yml b/packages/fortinet_forticlient/changelog.yml index ae34ccf6877..2a692f007c4 100644 --- a/packages/fortinet_forticlient/changelog.yml +++ b/packages/fortinet_forticlient/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.7.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/fortinet_forticlient/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json b/packages/fortinet_forticlient/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json index c759838f1cb..275971746a7 100644 --- a/packages/fortinet_forticlient/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/fortinet_forticlient/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 29 06:09:59 boNemoe4402.www.invalid proto=udp service=http status=deny src=10.150.92.220 dst=10.102.123.34 src_port=7178 dst_port=3994 server_app=reeufugi pid=7880 app_name=enderitq traff_direct=external block_count=5286 logon_user=sumdo@litesse6379.api.domain msg=failure", "observer": { @@ -16,7 +16,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 12 13:12:33 olupt4880.api.home proto=icmp service=https status=deny src=10.33.212.159 dst=10.149.203.46 src_port=2789 dst_port=5861 server_app=vol pid=4539 app_name=uidolor traff_direct=internal block_count=4402 logon_user=mipsumq@gnaali6189.internal.localhost msg=unknown", "observer": { @@ -30,7 +30,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 26 20:15:08 aqu1628.internal.domain proto=ipv6-icmp service=smtp status=deny src=10.173.116.41 dst=10.118.175.9 src_port=3710 dst_port=2802 server_app=aer pid=445 app_name=nse traff_direct=unknown block_count=7019 logon_user=uame@quis1130.internal.corp msg=success", "observer": { @@ -44,7 +44,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 12 03:17:42 tinculp2940.internal.local proto=ggp service=https status=deny src=10.134.137.177 dst=10.202.204.154 src_port=7868 dst_port=3587 server_app=amco pid=5712 app_name=psumquia traff_direct=unknown block_count=2458 logon_user=orsitame@reprehe189.internal.home msg=success", "observer": { @@ -58,7 +58,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 26 10:20:16 rad2103.api.domain proto=ipv6-icmp service=pop3 status=deny src=10.245.142.250 dst=10.70.0.60 src_port=5408 dst_port=4982 server_app=estqui pid=6557 app_name=magn traff_direct=inbound block_count=2638 logon_user=eos@enimad2283.internal.domain msg=failure", "observer": { @@ -72,7 +72,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 9 17:22:51 enim5316.www5.local proto=ipv6-icmp service=smtp status=deny src=10.202.72.124 dst=10.200.188.142 src_port=4665 dst_port=7143 server_app=omnis pid=2061 app_name=eip traff_direct=external block_count=513 logon_user=iusmodt@doloreeu3553.www5.home msg=unknown", "observer": { @@ -86,7 +86,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 24 00:25:25 reetdolo2770.www5.local proto=tcp service=pop3 status=deny src=10.12.44.169 dst=10.214.225.125 src_port=5710 dst_port=2121 server_app=inBCSedu pid=5722 app_name=tanimi traff_direct=outbound block_count=6071 logon_user=erep@iutal13.api.localdomain msg=failure", "observer": { @@ -100,7 +100,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 8 07:27:59 isiu1114.internal.corp proto=icmp service=http status=deny src=10.66.108.11 dst=10.198.136.50 src_port=6875 dst_port=2089 server_app=ipis pid=5037 app_name=ari traff_direct=unknown block_count=3856 logon_user=uptatev@uovol492.www.localhost msg=unknown", "observer": { @@ -114,7 +114,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 22 14:30:33 usmodte1296.www.corp proto=igmp service=ms-wbt-server status=deny src=10.178.244.31 dst=10.69.20.77 src_port=3857 dst_port=7579 server_app=nonnu pid=776 app_name=riat traff_direct=unknown block_count=5575 logon_user=umdolor@osquir6997.corp msg=failure", "observer": { @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 5 21:33:08 tatno4987.www5.localhost proto=ggp service=pop3 status=deny src=10.54.231.100 dst=10.203.5.162 src_port=5616 dst_port=7290 server_app=iam pid=6096 app_name=ciati traff_direct=unknown block_count=3162 logon_user=umdolore@eniam7007.api.invalid msg=success", "observer": { @@ -142,7 +142,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 20 04:35:42 tatno6787.internal.localhost proto=icmp service=pop3 status=deny src=10.65.83.160 dst=10.136.252.240 src_port=3592 dst_port=4105 server_app=uradi pid=7307 app_name=essequ traff_direct=outbound block_count=7148 logon_user=ender@snulapar3794.api.domain msg=failure", "observer": { @@ -156,7 +156,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 4 11:38:16 essecill2595.mail.local proto=ggp service=http status=deny src=10.57.40.29 dst=10.210.213.18 src_port=7616 dst_port=3970 server_app=atuse pid=2703 app_name=uis traff_direct=internal block_count=6179 logon_user=onse@liq5883.localdomain msg=unknown", "observer": { @@ -170,7 +170,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 18 18:40:50 ali6446.localhost proto=udp service=smtp status=deny src=10.144.82.69 dst=10.200.156.102 src_port=2896 dst_port=6061 server_app=rporis pid=5166 app_name=par traff_direct=outbound block_count=7041 logon_user=rveli@rsint7026.test msg=success", "observer": { @@ -184,7 +184,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 2 01:43:25 torev7118.internal.domain proto=ipv6 service=smtp status=deny src=10.109.232.112 dst=10.72.58.135 src_port=5160 dst_port=2382 server_app=fugit pid=7668 app_name=rsitamet traff_direct=internal block_count=1112 logon_user=xea@qua2945.www.local msg=failure", "observer": { @@ -198,7 +198,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 16 08:45:59 dolore6103.www5.example proto=udp service=http status=deny src=10.38.22.45 dst=10.72.29.73 src_port=1493 dst_port=203 server_app=piscing pid=1044 app_name=entsu traff_direct=unknown block_count=4979 logon_user=onproide@luptat6494.www.example msg=failure", "observer": { @@ -212,7 +212,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 30 15:48:33 errorsi6996.www.domain proto=tcp service=smtp status=deny src=10.70.95.74 dst=10.76.72.111 src_port=6119 dst_port=7388 server_app=emaperi pid=7183 app_name=sumquiad traff_direct=internal block_count=2362 logon_user=ivelits@moenimi6317.internal.invalid msg=failure", "observer": { @@ -226,7 +226,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 13 22:51:07 lumquido5839.api.corp proto=ipv6 service=https status=deny src=10.19.201.13 dst=10.73.69.75 src_port=5006 dst_port=6218 server_app=nsec pid=6907 app_name=estqu traff_direct=unknown block_count=2655 logon_user=tat@tion1761.home msg=unknown", "observer": { @@ -240,7 +240,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 28 05:53:42 aperia4409.www5.invalid proto=rdp service=ms-wbt-server status=deny src=10.78.151.178 dst=10.84.105.75 src_port=1846 dst_port=98 server_app=uames pid=499 app_name=msequi traff_direct=external block_count=4085 logon_user=iquaUten@santium4235.api.local msg=unknown", "observer": { @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 12 12:56:16 tem2496.api.lan proto=rdp service=ms-wbt-server status=deny src=10.135.233.146 dst=10.25.192.202 src_port=4181 dst_port=6462 server_app=ents pid=1531 app_name=Loremip traff_direct=internal block_count=4610 logon_user=emeumfu@CSed2857.www5.example msg=failure", "observer": { @@ -268,7 +268,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 26 19:58:50 eme6710.mail.invalid proto=rdp service=https status=deny src=10.121.219.204 dst=10.104.134.200 src_port=3611 dst_port=2508 server_app=reetd pid=6051 app_name=quae traff_direct=outbound block_count=7084 logon_user=uptat@equep5085.mail.domain msg=failure", "observer": { @@ -282,7 +282,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 10 03:01:24 ihilm1669.mail.invalid proto=tcp service=https status=deny src=10.191.105.82 dst=10.225.160.182 src_port=3361 dst_port=4810 server_app=uovolup pid=6994 app_name=llu traff_direct=external block_count=3936 logon_user=eirure@conseq557.mail.lan msg=unknown", "observer": { @@ -296,7 +296,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 24 10:03:59 umexerci1284.internal.localdomain proto=rdp service=smtp status=deny src=10.141.44.153 dst=10.161.57.8 src_port=3750 dst_port=2716 server_app=oei pid=5200 app_name=snostrud traff_direct=inbound block_count=3333 logon_user=quisnos@ite2026.www.invalid msg=failure", "observer": { @@ -310,7 +310,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 8 17:06:33 adol485.example proto=udp service=https status=deny src=10.153.111.103 dst=10.6.167.7 src_port=4977 dst_port=2022 server_app=taevit pid=3365 app_name=nsecte traff_direct=internal block_count=7424 logon_user=eumfug@lit5929.test msg=success", "observer": { @@ -324,7 +324,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 23 00:09:07 evita5008.www.localdomain proto=ggp service=pop3 status=deny src=10.248.204.182 dst=10.134.148.219 src_port=1331 dst_port=4430 server_app=tmo pid=1835 app_name=abi traff_direct=inbound block_count=4168 logon_user=uioffi@oru6938.invalid msg=success", "observer": { @@ -338,7 +338,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 6 07:11:41 tsedqu2456.www5.invalid proto=ipv6 service=smtp status=deny src=10.178.77.231 dst=10.163.5.243 src_port=5294 dst_port=4129 server_app=xerc pid=2019 app_name=hitecto traff_direct=unknown block_count=1123 logon_user=liquide@etdol5473.local msg=success", "observer": { @@ -352,7 +352,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 20 14:14:16 ris3314.mail.invalid proto=ggp service=smtp status=deny src=10.177.194.18 dst=10.221.89.228 src_port=766 dst_port=2447 server_app=uamei pid=2493 app_name=aera traff_direct=outbound block_count=1747 logon_user=aliquam@nimid893.mail.corp msg=success", "observer": { @@ -366,7 +366,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 3 21:16:50 reme622.mail.example proto=icmp service=ms-wbt-server status=deny src=10.241.65.49 dst=10.32.239.1 src_port=3027 dst_port=3128 server_app=dictasu pid=3022 app_name=catc traff_direct=unknown block_count=3522 logon_user=idata@rumwritt6003.host msg=failure", "observer": { @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 18 04:19:24 non3341.mail.invalid proto=ggp service=http status=deny src=10.168.90.81 dst=10.101.57.120 src_port=6866 dst_port=6501 server_app=laboree pid=2328 app_name=intocc traff_direct=internal block_count=5516 logon_user=eporr@xeacomm6855.api.corp msg=success", "observer": { @@ -394,7 +394,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 4 11:21:59 ris727.api.local proto=tcp service=ms-wbt-server status=deny src=10.14.211.43 dst=10.130.14.60 src_port=4456 dst_port=2051 server_app=autfu pid=1156 app_name=tessec traff_direct=external block_count=7200 logon_user=litse@icabo4125.mail.domain msg=unknown", "observer": { @@ -408,7 +408,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 18 18:24:33 stquido5705.api.host proto=icmp service=http status=deny src=10.60.129.15 dst=10.248.101.25 src_port=106 dst_port=5740 server_app=Nequepo pid=6003 app_name=pora traff_direct=unknown block_count=6437 logon_user=evolup@ionofdeF5643.www.localhost msg=success", "observer": { @@ -422,7 +422,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 2 01:27:07 etcons7378.api.lan proto=tcp service=https status=deny src=10.72.93.28 dst=10.111.187.12 src_port=3577 dst_port=3994 server_app=aper pid=5651 app_name=tur traff_direct=inbound block_count=3427 logon_user=niamqui@orem6702.invalid msg=failure", "observer": { @@ -436,7 +436,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 16 08:29:41 vita2681.www5.local proto=icmp service=ms-wbt-server status=deny src=10.27.14.168 dst=10.66.2.232 src_port=2224 dst_port=5764 server_app=fugiatn pid=3470 app_name=ipsumd traff_direct=outbound block_count=6708 logon_user=uirati@oin6780.mail.domain msg=unknown", "observer": { @@ -450,7 +450,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 30 15:32:16 tnulapa7592.www.local proto=ggp service=ms-wbt-server status=deny src=10.75.99.127 dst=10.195.2.130 src_port=1766 dst_port=202 server_app=mporin pid=6932 app_name=nisiuta traff_direct=internal block_count=3828 logon_user=inibusB@eprehen3224.www5.localdomain msg=failure", "observer": { @@ -464,7 +464,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 14 22:34:50 lup2134.www.localhost proto=ipv6 service=pop3 status=deny src=10.201.238.90 dst=10.245.104.182 src_port=3759 dst_port=55 server_app=ccaecat pid=6945 app_name=onsequ traff_direct=outbound block_count=4198 logon_user=ovol@ptasn6599.www.localhost msg=success", "observer": { @@ -478,7 +478,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 29 05:37:24 tanimid3337.mail.corp proto=ipv6-icmp service=http status=deny src=10.217.150.196 dst=10.105.91.31 src_port=2056 dst_port=5987 server_app=loreme pid=853 app_name=psumquia traff_direct=external block_count=4444 logon_user=con@nisist2752.home msg=unknown", "observer": { @@ -492,7 +492,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 12 12:39:58 eumiu765.api.lan proto=ipv6-icmp service=https status=deny src=10.4.157.1 dst=10.184.18.202 src_port=52 dst_port=205 server_app=ofdeFini pid=4153 app_name=molli traff_direct=outbound block_count=725 logon_user=oditem@gitsedqu2649.mail.lan msg=unknown", "observer": { @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 26 19:42:33 mquelau5326.mail.lan proto=icmp service=https status=deny src=10.255.39.252 dst=10.113.95.59 src_port=863 dst_port=4367 server_app=fugitsed pid=1693 app_name=idolo traff_direct=internal block_count=3147 logon_user=persp@entsunt3962.www.example msg=success", "observer": { @@ -520,7 +520,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 11 02:45:07 idestlab2631.www.lan proto=tcp service=http status=deny src=10.27.16.118 dst=10.83.177.2 src_port=18 dst_port=1827 server_app=iat pid=337 app_name=rinre traff_direct=internal block_count=1300 logon_user=borios@tut2703.www.host msg=success", "observer": { @@ -534,7 +534,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 25 09:47:41 inesci6789.test proto=udp service=http status=deny src=10.38.54.72 dst=10.167.227.44 src_port=6595 dst_port=5736 server_app=lillum pid=7041 app_name=its traff_direct=outbound block_count=7644 logon_user=riamea@entorev160.test msg=failure", "observer": { @@ -548,7 +548,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 8 16:50:15 ccaeca7077.internal.corp proto=tcp service=http status=deny src=10.216.54.184 dst=10.215.205.216 src_port=1495 dst_port=647 server_app=riat pid=3854 app_name=psaquaea traff_direct=external block_count=7536 logon_user=ameiusm@proide3714.mail.localdomain msg=unknown", "observer": { @@ -562,7 +562,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 22 23:52:50 ima2031.api.corp proto=igmp service=smtp status=deny src=10.9.12.248 dst=10.9.18.237 src_port=765 dst_port=2486 server_app=tpersp pid=55 app_name=seosqui traff_direct=internal block_count=6379 logon_user=uradi@tot5313.mail.invalid msg=success", "observer": { @@ -576,7 +576,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 6 06:55:24 ian867.internal.corp proto=rdp service=https status=deny src=10.83.130.226 dst=10.41.123.102 src_port=1542 dst_port=2300 server_app=odoconse pid=228 app_name=quatu traff_direct=external block_count=7661 logon_user=tenim@rumet3801.internal.domain msg=unknown", "observer": { @@ -590,7 +590,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 20 13:57:58 lorin4249.corp proto=tcp service=pop3 status=deny src=10.175.112.197 dst=10.80.152.108 src_port=1749 dst_port=2742 server_app=exeacom pid=4253 app_name=rita traff_direct=outbound block_count=6984 logon_user=tametcon@liqua2834.www5.lan msg=failure", "observer": { @@ -604,7 +604,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 4 21:00:32 gnaaliqu3935.api.test proto=udp service=smtp status=deny src=10.134.18.114 dst=10.142.25.100 src_port=2761 dst_port=5770 server_app=mdol pid=2200 app_name=nby traff_direct=internal block_count=624 logon_user=osqui@sequat7273.api.host msg=failure", "observer": { @@ -618,7 +618,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 19 04:03:07 nsequat1859.internal.localhost proto=udp service=http status=deny src=10.28.118.160 dst=10.223.119.218 src_port=6247 dst_port=300 server_app=umexerc pid=5717 app_name=intocc traff_direct=internal block_count=4387 logon_user=ntsunt@uidol4575.localhost msg=failure", "observer": { @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 2 11:05:41 ritin2495.api.corp proto=ggp service=https status=deny src=10.110.114.175 dst=10.47.28.48 src_port=4986 dst_port=3032 server_app=tatem pid=4469 app_name=luptat traff_direct=unknown block_count=4488 logon_user=plicab@oremq2000.api.corp msg=unknown", "observer": { @@ -646,7 +646,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 16 18:08:15 tetur2694.mail.local proto=ggp service=pop3 status=deny src=10.40.251.202 dst=10.90.33.138 src_port=5733 dst_port=7876 server_app=enimadmi pid=5524 app_name=lupta traff_direct=external block_count=6847 logon_user=nvolupt@oremi1485.api.localhost msg=success", "observer": { @@ -660,7 +660,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 1 01:10:49 rem7043.localhost proto=ipv6 service=ms-wbt-server status=deny src=10.65.2.106 dst=10.227.173.252 src_port=5410 dst_port=5337 server_app=nisiut pid=3624 app_name=teturad traff_direct=external block_count=7576 logon_user=itation@sequatD5469.www5.lan msg=unknown", "observer": { @@ -674,7 +674,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 15 08:13:24 emqu2846.internal.home proto=udp service=https status=deny src=10.193.233.229 dst=10.28.84.106 src_port=2859 dst_port=4844 server_app=eaqu pid=1609 app_name=uptatemU traff_direct=inbound block_count=3096 logon_user=tla@item2738.test msg=success", "observer": { @@ -688,7 +688,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 29 15:15:58 dqu6144.api.localhost proto=ggp service=ms-wbt-server status=deny src=10.150.245.88 dst=10.210.89.183 src_port=3642 dst_port=2589 server_app=ulpa pid=6248 app_name=iusmodte traff_direct=external block_count=2700 logon_user=sequa@iosamnis1047.internal.localdomain msg=success", "observer": { @@ -702,7 +702,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 12 22:18:32 giatquov1918.internal.example proto=udp service=ms-wbt-server status=deny src=10.180.195.43 dst=10.85.185.13 src_port=4540 dst_port=7793 server_app=gnaal pid=7224 app_name=proident traff_direct=outbound block_count=1867 logon_user=voluptas@orroq6677.internal.example msg=failure", "observer": { @@ -716,7 +716,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 27 05:21:06 estl5804.internal.local proto=udp service=ms-wbt-server status=deny src=10.207.211.230 dst=10.210.28.247 src_port=3449 dst_port=7257 server_app=ssecil pid=430 app_name=iuntNe traff_direct=unknown block_count=7672 logon_user=tate@onevo4326.internal.local msg=failure", "observer": { @@ -730,7 +730,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 10 12:23:41 Sedut1775.www.domain proto=rdp service=ms-wbt-server status=deny src=10.86.11.48 dst=10.248.165.185 src_port=3436 dst_port=5460 server_app=olorsi pid=3589 app_name=exeaco traff_direct=external block_count=4801 logon_user=dquiac@itaedict7233.mail.localdomain msg=unknown", "observer": { @@ -744,7 +744,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 24 19:26:15 mac7484.www5.test proto=ipv6-icmp service=http status=deny src=10.118.6.177 dst=10.47.125.38 src_port=6977 dst_port=3896 server_app=isn pid=4814 app_name=omm traff_direct=outbound block_count=1844 logon_user=quunt@numquam5869.internal.example msg=unknown", "observer": { @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 11 02:28:49 oin1140.mail.localhost proto=icmp service=pop3 status=deny src=10.50.233.155 dst=10.60.142.127 src_port=1081 dst_port=5112 server_app=urExce pid=276 app_name=nturm traff_direct=outbound block_count=2241 logon_user=atv@onu6137.api.home msg=success", "observer": { @@ -772,7 +772,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 25 09:31:24 naaliq3710.api.local proto=rdp service=http status=deny src=10.28.82.189 dst=10.120.10.211 src_port=3916 dst_port=7661 server_app=odt pid=2452 app_name=inv traff_direct=internal block_count=7705 logon_user=rcit@aecatcup2241.www5.test msg=failure", "observer": { @@ -786,7 +786,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 8 16:33:58 volupta3552.internal.localhost proto=ipv6 service=pop3 status=deny src=10.31.237.225 dst=10.6.38.163 src_port=6153 dst_port=4059 server_app=oreveri pid=3453 app_name=avolu traff_direct=inbound block_count=2820 logon_user=olup@labor6360.mail.local msg=failure", "observer": { @@ -800,7 +800,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 22 23:36:32 onse380.internal.localdomain proto=ggp service=https status=deny src=10.226.5.189 dst=10.125.165.144 src_port=3371 dst_port=7889 server_app=dexerc pid=2302 app_name=tatem traff_direct=inbound block_count=5407 logon_user=mvolu@mveleum4322.www5.host msg=success", "observer": { @@ -814,7 +814,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 7 06:39:06 queips4947.mail.example proto=udp service=smtp status=deny src=10.97.149.97 dst=10.46.56.204 src_port=2463 dst_port=5070 server_app=uela pid=7079 app_name=umf traff_direct=unknown block_count=2441 logon_user=dolorsit@archite1843.mail.home msg=unknown", "observer": { @@ -828,7 +828,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 21 13:41:41 oloreseo5039.test proto=ggp service=https status=deny src=10.218.0.197 dst=10.28.105.124 src_port=7581 dst_port=4797 server_app=eritin pid=5773 app_name=litsedq traff_direct=outbound block_count=5749 logon_user=ntNe@itanim4024.api.example msg=success", "observer": { @@ -842,7 +842,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 4 20:44:15 minim459.mail.local proto=rdp service=https status=deny src=10.123.199.198 dst=10.17.87.79 src_port=6332 dst_port=3414 server_app=tionula pid=1586 app_name=ate traff_direct=outbound block_count=5006 logon_user=ratvolu@nreprehe715.api.home msg=unknown", "observer": { @@ -856,7 +856,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 19 03:46:49 eratv211.api.host proto=rdp service=https status=deny src=10.38.86.177 dst=10.115.68.40 src_port=5768 dst_port=5483 server_app=boNem pid=5137 app_name=ssusci traff_direct=internal block_count=2841 logon_user=mpo@unte893.internal.host msg=success", "observer": { @@ -870,7 +870,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 3 10:49:23 aparia1179.www.localdomain proto=tcp service=https status=deny src=10.193.118.163 dst=10.115.174.107 src_port=548 dst_port=5597 server_app=acom pid=5704 app_name=dolorem traff_direct=internal block_count=10 logon_user=exeacomm@aspe951.mail.domain msg=success", "observer": { @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 17 17:51:58 iatqu6203.mail.corp proto=icmp service=http status=deny src=10.37.128.49 dst=10.77.77.208 src_port=625 dst_port=1101 server_app=esci pid=2310 app_name=essecill traff_direct=external block_count=2653 logon_user=moles@dipiscin4957.www.home msg=unknown", "observer": { @@ -898,7 +898,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 1 00:54:32 ptasnula6576.api.invalid proto=tcp service=ms-wbt-server status=deny src=10.54.73.158 dst=10.1.96.93 src_port=5752 dst_port=428 server_app=docon pid=5398 app_name=ntium traff_direct=internal block_count=4392 logon_user=lloinven@econs2687.internal.localdomain msg=unknown", "observer": { @@ -912,7 +912,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 15 07:57:06 mag1506.internal.domain proto=igmp service=smtp status=deny src=10.131.126.109 dst=10.182.152.242 src_port=1877 dst_port=6998 server_app=rcitat pid=2465 app_name=ecillum traff_direct=inbound block_count=3208 logon_user=dolor@tiumto5834.api.lan msg=success", "observer": { @@ -926,7 +926,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 29 14:59:40 fugits1163.host proto=icmp service=http status=deny src=10.181.247.224 dst=10.77.229.168 src_port=260 dst_port=3777 server_app=atatnon pid=6064 app_name=abor traff_direct=external block_count=329 logon_user=adol@iutal6032.www.test msg=failure", "observer": { @@ -940,7 +940,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 12 22:02:15 gitse2463.www5.invalid proto=ipv6-icmp service=http status=deny src=10.235.116.121 dst=10.72.162.6 src_port=1 dst_port=5516 server_app=emp pid=2861 app_name=luptas traff_direct=outbound block_count=1444 logon_user=oinv@inculp2078.host msg=unknown", "observer": { @@ -954,7 +954,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 27 05:04:49 temse6953.www.example proto=ipv6-icmp service=https status=deny src=10.149.193.117 dst=10.28.124.236 src_port=5343 dst_port=3434 server_app=atcupi pid=3559 app_name=edquia traff_direct=internal block_count=3176 logon_user=mullam@mexerc2757.internal.home msg=failure", "observer": { @@ -968,7 +968,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 11 12:07:23 deriti6952.mail.domain proto=ipv6-icmp service=http status=deny src=10.34.131.224 dst=10.196.96.162 src_port=649 dst_port=6378 server_app=equatDu pid=1710 app_name=aconse traff_direct=outbound block_count=7174 logon_user=tnonproi@squira4455.api.domain msg=failure", "observer": { @@ -982,7 +982,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 25 19:09:57 abor1370.www.domain proto=ipv6-icmp service=https status=deny src=10.97.236.123 dst=10.77.78.180 src_port=5159 dst_port=5380 server_app=reetdol pid=4984 app_name=ugi traff_direct=inbound block_count=4782 logon_user=nisi@emveleum3661.localhost msg=unknown", "observer": { @@ -996,7 +996,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 9 02:12:32 emullamc5418.mail.test proto=ipv6 service=ms-wbt-server status=deny src=10.82.133.66 dst=10.45.54.107 src_port=7229 dst_port=3593 server_app=nse pid=3421 app_name=quira traff_direct=unknown block_count=5362 logon_user=olorem@sedquiac6517.internal.localhost msg=failure", "observer": { @@ -1010,7 +1010,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 23 09:15:06 squirati7050.www5.lan proto=rdp service=pop3 status=deny src=10.180.180.230 dst=10.170.252.219 src_port=4147 dst_port=2454 server_app=tesseci pid=4020 app_name=radipis traff_direct=external block_count=7020 logon_user=nse@veniam3148.www5.home msg=failure", "observer": { @@ -1024,7 +1024,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 7 16:17:40 venia2079.mail.example proto=rdp service=http status=deny src=10.5.11.205 dst=10.65.144.51 src_port=4901 dst_port=2283 server_app=lumqu pid=617 app_name=autf traff_direct=outbound block_count=5050 logon_user=uptat@unt3559.www.home msg=failure", "observer": { @@ -1038,7 +1038,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 21 23:20:14 snostrum3450.www5.localhost proto=udp service=smtp status=deny src=10.195.223.82 dst=10.76.122.196 src_port=3128 dst_port=5325 server_app=atu pid=487 app_name=iame traff_direct=external block_count=593 logon_user=umiurer@rere5274.mail.domain msg=success", "observer": { @@ -1052,7 +1052,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 5 06:22:49 gelitsed3249.corp proto=icmp service=ms-wbt-server status=deny src=10.138.210.116 dst=10.225.255.211 src_port=5595 dst_port=3369 server_app=rum pid=2442 app_name=eursinto traff_direct=external block_count=956 logon_user=fugiatn@uaeabi3728.www5.invalid msg=failure", "observer": { @@ -1066,7 +1066,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 19 13:25:23 dolor7082.internal.localhost proto=icmp service=smtp status=deny src=10.250.81.189 dst=10.219.1.151 src_port=5404 dst_port=4323 server_app=redo pid=6311 app_name=ditautf traff_direct=external block_count=3262 logon_user=ori@uamqu2804.test msg=unknown", "observer": { @@ -1080,7 +1080,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 2 20:27:57 totam6886.api.localhost proto=ggp service=https status=deny src=10.54.23.133 dst=10.76.125.70 src_port=3258 dst_port=756 server_app=oluptat pid=7128 app_name=eseruntm traff_direct=internal block_count=1916 logon_user=oloreeu@olor5201.host msg=unknown", "observer": { @@ -1094,7 +1094,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 17 03:30:32 laborum5749.www.example proto=igmp service=http status=deny src=10.36.110.69 dst=10.189.42.62 src_port=4187 dst_port=4262 server_app=duntut pid=2780 app_name=ullamc traff_direct=unknown block_count=170 logon_user=eque@eufug3348.www.lan msg=success", "observer": { @@ -1108,7 +1108,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 3 10:33:06 lup3313.api.home proto=tcp service=https status=deny src=10.47.179.68 dst=10.183.202.82 src_port=5107 dst_port=2208 server_app=usmod pid=3284 app_name=amni traff_direct=unknown block_count=2645 logon_user=umfugi@stquidol239.www5.invalid msg=failure", "observer": { @@ -1122,7 +1122,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 17 17:35:40 edq5397.www.test proto=ipv6-icmp service=pop3 status=deny src=10.73.28.165 dst=10.221.206.74 src_port=3668 dst_port=1480 server_app=ihilmole pid=2314 app_name=litanim traff_direct=inbound block_count=5572 logon_user=quas@gia6531.mail.invalid msg=success", "observer": { @@ -1136,7 +1136,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 1 00:38:14 udan6536.www5.test proto=ipv6 service=ms-wbt-server status=deny src=10.85.104.146 dst=10.14.204.36 src_port=3442 dst_port=4887 server_app=qua pid=5284 app_name=ents traff_direct=inbound block_count=973 logon_user=emp@lamcola4879.www5.localdomain msg=success", "observer": { @@ -1150,7 +1150,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 15 07:40:49 rumet6923.www5.lan proto=rdp service=https status=deny src=10.208.18.210 dst=10.30.246.132 src_port=3601 dst_port=388 server_app=texplica pid=3990 app_name=ore traff_direct=outbound block_count=5624 logon_user=veniam@edquian330.mail.local msg=unknown", "observer": { @@ -1164,7 +1164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 29 14:43:23 itse522.internal.localdomain proto=udp service=pop3 status=deny src=10.106.249.91 dst=10.19.119.17 src_port=1732 dst_port=3822 server_app=veleumi pid=4337 app_name=tvol traff_direct=unknown block_count=2783 logon_user=lit@santi837.api.domain msg=success", "observer": { @@ -1178,7 +1178,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 13 21:45:57 amc3059.local proto=igmp service=http status=deny src=10.29.109.126 dst=10.181.41.154 src_port=6261 dst_port=866 server_app=itseddo pid=5275 app_name=seos traff_direct=unknown block_count=6721 logon_user=labo@lpaquiof804.internal.invalid msg=failure", "observer": { @@ -1192,7 +1192,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 28 04:48:31 enbyCi3813.api.domain proto=ipv6-icmp service=https status=deny src=10.164.207.42 dst=10.164.120.197 src_port=1901 dst_port=2304 server_app=itametco pid=2286 app_name=remip traff_direct=external block_count=3116 logon_user=pta@nonn4478.host msg=unknown", "observer": { @@ -1206,7 +1206,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 11 11:51:06 liquipex1155.mail.corp proto=ipv6-icmp service=smtp status=deny src=10.183.189.133 dst=10.154.191.225 src_port=5347 dst_port=7856 server_app=Loremip pid=2990 app_name=tur traff_direct=unknown block_count=6105 logon_user=ita@amquaer3985.www5.example msg=success", "observer": { @@ -1220,7 +1220,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 25 18:53:40 isn3991.local proto=igmp service=smtp status=deny src=10.29.120.226 dst=10.103.189.199 src_port=1296 dst_port=767 server_app=exerci pid=226 app_name=eserun traff_direct=outbound block_count=5452 logon_user=emu@orem6317.local msg=failure", "observer": { @@ -1234,7 +1234,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 10 01:56:14 iumtotam1010.www5.corp proto=icmp service=https status=deny src=10.133.254.23 dst=10.210.153.7 src_port=6251 dst_port=7030 server_app=nofdeFi pid=4691 app_name=sautei traff_direct=external block_count=2088 logon_user=voluptas@velill3230.www.corp msg=success", "observer": { @@ -1248,7 +1248,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 24 08:58:48 onsecte91.www5.localdomain proto=tcp service=pop3 status=deny src=10.126.245.73 dst=10.91.2.135 src_port=180 dst_port=2141 server_app=ender pid=5647 app_name=rumSecti traff_direct=outbound block_count=4680 logon_user=olore@orumS757.www5.corp msg=success", "observer": { @@ -1262,7 +1262,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 7 16:01:23 abori7686.internal.host proto=rdp service=https status=deny src=10.183.243.246 dst=10.137.85.123 src_port=218 dst_port=7073 server_app=ntsunti pid=2313 app_name=magnam traff_direct=internal block_count=6402 logon_user=cid@emi4534.www.localdomain msg=failure", "observer": { @@ -1276,7 +1276,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 21 23:03:57 reprehen3513.test proto=ipv6 service=smtp status=deny src=10.61.225.196 dst=10.10.86.55 src_port=4720 dst_port=5132 server_app=isiu pid=1585 app_name=mmodi traff_direct=external block_count=3034 logon_user=eniamqu@inimav1576.mail.example msg=failure", "observer": { @@ -1290,7 +1290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 5 06:06:31 orroquis284.api.domain proto=udp service=http status=deny src=10.125.143.153 dst=10.79.73.195 src_port=2657 dst_port=457 server_app=umf pid=3141 app_name=moll traff_direct=outbound block_count=7645 logon_user=emip@aturQu7083.mail.host msg=failure", "observer": { @@ -1304,7 +1304,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 19 13:09:05 tionula2060.www5.localhost proto=ipv6 service=ms-wbt-server status=deny src=10.240.216.85 dst=10.64.139.17 src_port=2046 dst_port=2438 server_app=ice pid=6331 app_name=aal traff_direct=external block_count=4982 logon_user=nimadmin@lumqui7769.mail.local msg=unknown", "observer": { @@ -1318,7 +1318,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 3 20:11:40 rumSecti111.www5.domain proto=ipv6 service=ms-wbt-server status=deny src=10.87.90.49 dst=10.222.245.80 src_port=1486 dst_port=4017 server_app=itaedict pid=4474 app_name=byCic traff_direct=inbound block_count=3380 logon_user=ptatemse@siarc6339.internal.corp msg=success", "observer": { @@ -1332,7 +1332,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 18 03:14:14 olores7881.local proto=udp service=pop3 status=deny src=10.143.53.214 dst=10.87.144.208 src_port=3310 dst_port=2440 server_app=ipsumq pid=4855 app_name=psaquaea traff_direct=unknown block_count=5772 logon_user=psumq@ptatev6552.www.test msg=success", "observer": { @@ -1346,7 +1346,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 1 10:16:48 tDuis3281.www5.localdomain proto=ipv6-icmp service=pop3 status=deny src=10.204.178.19 dst=10.105.97.134 src_port=616 dst_port=1935 server_app=oremque pid=1729 app_name=inimve traff_direct=unknown block_count=6564 logon_user=mexercit@byC5766.internal.home msg=success", "observer": { @@ -1360,7 +1360,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 15 17:19:22 uptasnul2751.www5.corp proto=rdp service=smtp status=deny src=10.161.64.168 dst=10.194.67.223 src_port=7154 dst_port=5767 server_app=tatemse pid=4493 app_name=amqui traff_direct=inbound block_count=3673 logon_user=tion@hender6628.local msg=unknown", "observer": { @@ -1374,7 +1374,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 30 00:21:57 upt6017.api.localdomain proto=tcp service=smtp status=deny src=10.100.154.220 dst=10.120.148.241 src_port=5535 dst_port=1655 server_app=eeufug pid=6094 app_name=modt traff_direct=external block_count=5150 logon_user=rsitam@xercit7649.www5.home msg=failure", "observer": { @@ -1388,7 +1388,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 14 07:24:31 tpers2217.internal.lan proto=udp service=ms-wbt-server status=deny src=10.116.153.19 dst=10.180.90.112 src_port=6610 dst_port=1936 server_app=olu pid=5012 app_name=dexercit traff_direct=outbound block_count=2216 logon_user=itessequ@porissu1470.domain msg=success", "observer": { diff --git a/packages/fortinet_forticlient/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_forticlient/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 7d1956659fc..5460714ec2c 100644 --- a/packages/fortinet_forticlient/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fortinet_forticlient/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Fortinet FortiClient Endpoint Security processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Fortinet diff --git a/packages/fortinet_forticlient/data_stream/log/sample_event.json b/packages/fortinet_forticlient/data_stream/log/sample_event.json index 3ab4aacb01c..26b17cb7922 100644 --- a/packages/fortinet_forticlient/data_stream/log/sample_event.json +++ b/packages/fortinet_forticlient/data_stream/log/sample_event.json @@ -19,7 +19,7 @@ "port": 3994 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", diff --git a/packages/fortinet_forticlient/docs/README.md b/packages/fortinet_forticlient/docs/README.md index 9fa28faaa5d..9710de6ff6c 100644 --- a/packages/fortinet_forticlient/docs/README.md +++ b/packages/fortinet_forticlient/docs/README.md @@ -34,7 +34,7 @@ An example event for `log` looks as following: "port": 3994 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", diff --git a/packages/fortinet_forticlient/manifest.yml b/packages/fortinet_forticlient/manifest.yml index 38e93dc3e14..484b79fc7e6 100644 --- a/packages/fortinet_forticlient/manifest.yml +++ b/packages/fortinet_forticlient/manifest.yml @@ -1,6 +1,6 @@ name: fortinet_forticlient title: Fortinet FortiClient Logs -version: "1.7.0" +version: "1.8.0" description: Collect logs from Fortinet FortiClient instances with Elastic Agent. type: integration format_version: 2.7.0 diff --git a/packages/fortinet_fortiedr/_dev/build/build.yml b/packages/fortinet_fortiedr/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/fortinet_fortiedr/_dev/build/build.yml +++ b/packages/fortinet_fortiedr/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/fortinet_fortiedr/changelog.yml b/packages/fortinet_fortiedr/changelog.yml index 0f2f5e7a5ed..0e07c0f78d6 100644 --- a/packages/fortinet_fortiedr/changelog.yml +++ b/packages/fortinet_fortiedr/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.11.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.10.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/fortinet_fortiedr/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json b/packages/fortinet_fortiedr/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json index d7be423a6d8..d317fd76de9 100644 --- a/packages/fortinet_fortiedr/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/fortinet_fortiedr/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-09-18T06:42:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -92,7 +92,7 @@ { "@timestamp": "2019-09-18T07:42:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", diff --git a/packages/fortinet_fortiedr/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_fortiedr/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 60ab6978e21..668f11ecf5a 100644 --- a/packages/fortinet_fortiedr/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fortinet_fortiedr/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Fortinet FortiEDR Endpoint Detection and Response processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Fortinet diff --git a/packages/fortinet_fortiedr/data_stream/log/sample_event.json b/packages/fortinet_fortiedr/data_stream/log/sample_event.json index 5af3c68eca9..303bc88f6a6 100644 --- a/packages/fortinet_fortiedr/data_stream/log/sample_event.json +++ b/packages/fortinet_fortiedr/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e2f57999-9659-45c8-a03c-c5bf85dc5124", diff --git a/packages/fortinet_fortiedr/docs/README.md b/packages/fortinet_fortiedr/docs/README.md index 3b886e77de0..33b12afebc8 100644 --- a/packages/fortinet_fortiedr/docs/README.md +++ b/packages/fortinet_fortiedr/docs/README.md @@ -38,7 +38,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e2f57999-9659-45c8-a03c-c5bf85dc5124", diff --git a/packages/fortinet_fortiedr/kibana/tags.yml b/packages/fortinet_fortiedr/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fortinet_fortiedr/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fortinet_fortiedr/manifest.yml b/packages/fortinet_fortiedr/manifest.yml index c9217d3dc3a..330ba9228ab 100644 --- a/packages/fortinet_fortiedr/manifest.yml +++ b/packages/fortinet_fortiedr/manifest.yml @@ -1,12 +1,13 @@ name: fortinet_fortiedr title: Fortinet FortiEDR Logs -version: "1.8.0" +version: "1.11.0" description: Collect logs from Fortinet FortiEDR instances with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security", "edr_xdr"] conditions: - kibana.version: "^7.17.0 || ^8.0.0" + kibana: + version: "^7.17.0 || ^8.0.0" icons: - src: /img/fortinet-logo.svg title: Fortinet @@ -28,3 +29,4 @@ policy_templates: description: "Collecting logs from Fortinet FortiEDR instances (input: udp)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fortinet_fortigate/_dev/build/build.yml b/packages/fortinet_fortigate/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/fortinet_fortigate/_dev/build/build.yml +++ b/packages/fortinet_fortigate/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/fortinet_fortigate/_dev/build/docs/README.md b/packages/fortinet_fortigate/_dev/build/docs/README.md index 4664d29e0d2..5b8a631d3f7 100644 --- a/packages/fortinet_fortigate/_dev/build/docs/README.md +++ b/packages/fortinet_fortigate/_dev/build/docs/README.md @@ -6,6 +6,10 @@ This integration is for Fortinet FortiGate logs sent in the syslog format. This integration has been tested against FortiOS version 6.0.x and 6.2.x. Versions above this are expected to work but have not been tested. +## Note + +- When using the TCP input, be careful with the configured TCP framing. According to the [Fortigate reference](https://docs.fortinet.com/document/fortigate/7.4.0/cli-reference/405620/config-log-syslogd-setting), framing should be set to `rfc6587` when the syslog mode is reliable. + ### Log The `log` dataset collects JFortinet FortiGate logs. diff --git a/packages/fortinet_fortigate/changelog.yml b/packages/fortinet_fortigate/changelog.yml index c8b6b00dfe8..95d6dbeb0c2 100644 --- a/packages/fortinet_fortigate/changelog.yml +++ b/packages/fortinet_fortigate/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.18.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.1" + changes: + - description: Enable RFC 6587 framing by default on TCP input. + type: bugfix + link: https://github.com/elastic/integrations/pull/7516 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.15.0" changes: - description: Allow syslog lines without a priority. diff --git a/packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json b/packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json index 9b8aeab3b3f..735aa17e7be 100644 --- a/packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json +++ b/packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet.log-expected.json @@ -20,7 +20,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ftgd_blk", @@ -142,7 +142,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -254,7 +254,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ftgd_allow", @@ -375,7 +375,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "signature", @@ -506,7 +506,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "signature", @@ -651,7 +651,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-response", @@ -772,7 +772,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-response", @@ -878,7 +878,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "signature", @@ -1011,7 +1011,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-response", @@ -1127,7 +1127,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-query", @@ -1227,7 +1227,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ssl-anomalies", @@ -1321,7 +1321,7 @@ { "@timestamp": "2020-04-23T12:32:48.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1406,7 +1406,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1502,7 +1502,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1589,7 +1589,7 @@ { "@timestamp": "2020-04-23T14:32:09.000-03:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1652,7 +1652,7 @@ { "@timestamp": "2020-04-23T12:32:09.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1738,7 +1738,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1826,7 +1826,7 @@ { "@timestamp": "2020-04-23T14:24:13.000-03:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0100041006", @@ -1873,7 +1873,7 @@ { "@timestamp": "2020-04-23T12:23:47.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0107045057", @@ -1956,7 +1956,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2031,7 +2031,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2105,7 +2105,7 @@ { "@timestamp": "2020-04-23T14:16:42.000-03:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2174,7 +2174,7 @@ { "@timestamp": "2020-04-23T12:16:02.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0100022915", @@ -2222,7 +2222,7 @@ { "@timestamp": "2020-04-23T12:16:02.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0100022913", @@ -2287,7 +2287,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns", @@ -2398,7 +2398,7 @@ "port": 6000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -2530,7 +2530,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -2649,7 +2649,7 @@ "packets": 40 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -2760,7 +2760,7 @@ "port": 1235 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-conn", @@ -2878,7 +2878,7 @@ "port": 442 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "close", @@ -3036,7 +3036,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "app-ctrl-all", @@ -3160,7 +3160,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3234,7 +3234,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3282,7 +3282,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3330,7 +3330,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3378,7 +3378,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3426,7 +3426,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3474,7 +3474,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3522,7 +3522,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3570,7 +3570,7 @@ { "@timestamp": "2021-05-07T08:31:14.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3622,7 +3622,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -3716,7 +3716,7 @@ { "@timestamp": "2022-07-29T14:17:14.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0112053203", @@ -3763,7 +3763,7 @@ { "@timestamp": "2022-07-29T14:17:14.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0110052005", @@ -3837,7 +3837,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -3967,7 +3967,7 @@ "port": 12530 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "signature", @@ -4067,7 +4067,7 @@ "port": 7680 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -4182,7 +4182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c190\u003edate= desc=\"Object update request from device of FortiClient received\" msg=\"Send new version object to device (sn:FSAxxxxxxxxx, ip=127.0.0.1): objid=0000000000, curr_ver=00091.03310\"" @@ -4215,7 +4215,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "date= desc=\"Object update request from device of FortiClient received\" msg=\"Send new version object to device (sn:FSAxxxxxxxxx, ip=127.0.0.1): objid=0000000000, curr_ver=00091.03310\"" diff --git a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml index fa99af910e1..37f88213298 100644 --- a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing fortinet firewall logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/fortinet_fortigate/data_stream/log/manifest.yml b/packages/fortinet_fortigate/data_stream/log/manifest.yml index a906cde1234..615213a96ab 100644 --- a/packages/fortinet_fortigate/data_stream/log/manifest.yml +++ b/packages/fortinet_fortigate/data_stream/log/manifest.yml @@ -82,9 +82,9 @@ streams: required: false show_user: false default: | + framing: rfc6587 + #max_message_size: 50KiB #max_connections: 1 - #framing: delimitier - #line_delimiter: "\n" description: Specify custom configuration options for the TCP input. template_path: tcp.yml.hbs title: Fortinet firewall logs (tcp) diff --git a/packages/fortinet_fortigate/data_stream/log/sample_event.json b/packages/fortinet_fortigate/data_stream/log/sample_event.json index 30562069679..b0aeaa0f766 100644 --- a/packages/fortinet_fortigate/data_stream/log/sample_event.json +++ b/packages/fortinet_fortigate/data_stream/log/sample_event.json @@ -29,7 +29,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b10c3ab-9f4b-4ca0-b5ad-b6200b7fe65d", diff --git a/packages/fortinet_fortigate/docs/README.md b/packages/fortinet_fortigate/docs/README.md index c65df14966d..555bb996270 100644 --- a/packages/fortinet_fortigate/docs/README.md +++ b/packages/fortinet_fortigate/docs/README.md @@ -6,6 +6,10 @@ This integration is for Fortinet FortiGate logs sent in the syslog format. This integration has been tested against FortiOS version 6.0.x and 6.2.x. Versions above this are expected to work but have not been tested. +## Note + +- When using the TCP input, be careful with the configured TCP framing. According to the [Fortigate reference](https://docs.fortinet.com/document/fortigate/7.4.0/cli-reference/405620/config-log-syslogd-setting), framing should be set to `rfc6587` when the syslog mode is reliable. + ### Log The `log` dataset collects JFortinet FortiGate logs. @@ -44,7 +48,7 @@ An example event for `log` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b10c3ab-9f4b-4ca0-b5ad-b6200b7fe65d", @@ -231,14 +235,14 @@ An example event for `log` looks as following: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.dataset | Name of the dataset. | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.message | Log message optimized for viewing in a log viewer. | text | | event.module | Name of the module this data is coming from. | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | diff --git a/packages/fortinet_fortigate/kibana/tags.yml b/packages/fortinet_fortigate/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fortinet_fortigate/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fortinet_fortigate/manifest.yml b/packages/fortinet_fortigate/manifest.yml index 839c0a65575..9a59c4a6241 100644 --- a/packages/fortinet_fortigate/manifest.yml +++ b/packages/fortinet_fortigate/manifest.yml @@ -1,12 +1,13 @@ name: fortinet_fortigate title: Fortinet FortiGate Firewall Logs -version: "1.15.0" +version: "1.18.0" description: Collect logs from Fortinet FortiGate firewalls with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security", "network", "firewall_security"] conditions: - kibana.version: "^8.3.0" + kibana: + version: "^8.3.0" icons: - src: /img/fortinet-logo.svg title: Fortinet @@ -33,3 +34,4 @@ policy_templates: description: "Collecting logs from Fortinet FortiGate instances (input: udp)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fortinet_fortimail/_dev/build/build.yml b/packages/fortinet_fortimail/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/fortinet_fortimail/_dev/build/build.yml +++ b/packages/fortinet_fortimail/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/fortinet_fortimail/changelog.yml b/packages/fortinet_fortimail/changelog.yml index 7ce5b3b0a0a..29857b347ff 100644 --- a/packages/fortinet_fortimail/changelog.yml +++ b/packages/fortinet_fortimail/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 2.8.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.7.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.6.0" + changes: + - description: Handle block rule addition and removal. + type: enhancement + link: https://github.com/elastic/integrations/pull/7191 +- version: "2.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "2.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antispam.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antispam.log-expected.json index 3260f122923..69bc8e2a2c5 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antispam.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antispam.log-expected.json @@ -6,7 +6,7 @@ "ip": "10.50.2.225" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antivirus.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antivirus.log-expected.json index 46a9b124849..f1f8553f52b 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antivirus.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-antivirus.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-30T16:09:15.246Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-encryption.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-encryption.log-expected.json index f95308cb395..6db961c16e4 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-encryption.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-encryption.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-30T16:09:15.246Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0400003064", @@ -50,7 +50,7 @@ { "@timestamp": "2023-01-30T16:09:15.246Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-history.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-history.log-expected.json index 6e340066763..b3599242ffd 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-history.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-history.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.194" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "unknown", @@ -105,7 +105,7 @@ "ip": "81.2.69.192" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "in", diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-mail.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-mail.log-expected.json index 021ccab3b2f..364bbb27719 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-mail.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-mail.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-06T18:06:10.119Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -74,7 +74,7 @@ { "@timestamp": "2023-02-06T18:28:49.954Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -145,7 +145,7 @@ { "@timestamp": "2023-02-01T14:42:35.521Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -225,7 +225,7 @@ { "@timestamp": "2023-01-30T16:06:24.345Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NONE", @@ -296,7 +296,7 @@ { "@timestamp": "2023-03-02T12:55:12.771Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", @@ -376,7 +376,7 @@ { "@timestamp": "2023-03-02T12:51:59.968Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unknown", diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log index 9d332be70ce..257f4bf33c5 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log @@ -17,3 +17,5 @@ <190>date=2023-02-06,time=19:35:20.062,device_id=FEVM02TM23000064,log_id=0704003868,type=kevent,subtype=update,pri=information,,msg="Loaded avdb 91.00325(02/06/0023 05:39) using av engine 6.283" <190>date=2023-02-06,time=19:35:20.068,device_id=FEVM02TM23000064,log_id=0704001887,type=kevent,subtype=update,pri=information,,msg="Update result: virus db:yes, virus engine:no, spam db:no, spam engine:no" <190>date=2023-02-07,time=14:38:16.642,device_id=FEVM02TM23000064,log_id=0704001887,type=kevent,subtype=update,pri=information,,msg="Internet service DB update succeeded" +<191>date=2023-07-28,time=04:48:36.567,device_id=FEVM02xxnnnnnn,log_id=0702001939,type=kevent,subtype=system,pri=debug, user=,ui=,action=none,status=none,msg="authserver: removed block rule for 81.2.69.144" +<191>date=2023-07-28,time=03:58:41.726,device_id=FEVM02xxnnnnnn,log_id=0702001941,type=kevent,subtype=system,pri=debug, user=,ui=,action=none,status=none,msg="authserver: added block rule for 81.2.69.144 until 2023-07-28 04:48 -0400" \ No newline at end of file diff --git a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log-expected.json b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log-expected.json index 8e2fb8966f5..866a356ea0b 100644 --- a/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log-expected.json +++ b/packages/fortinet_fortimail/data_stream/log/_dev/test/pipeline/test-system.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-06T19:10:00.391Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -84,7 +84,7 @@ { "@timestamp": "2023-02-07T09:01:43.129Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -165,7 +165,7 @@ { "@timestamp": "2023-02-07T09:05:02.414Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -246,7 +246,7 @@ { "@timestamp": "2023-02-07T09:08:21.402Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -327,7 +327,7 @@ { "@timestamp": "2023-02-07T09:09:17.129Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -408,7 +408,7 @@ { "@timestamp": "2023-02-14T10:54:07.089Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -501,7 +501,7 @@ { "@timestamp": "2023-02-14T10:55:31.392Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -594,7 +594,7 @@ { "@timestamp": "2023-02-08T15:20:16.506Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -687,7 +687,7 @@ { "@timestamp": "2023-02-07T12:34:55.214Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -776,7 +776,7 @@ { "@timestamp": "2023-02-06T18:05:49.266Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logout", @@ -866,7 +866,7 @@ { "@timestamp": "2023-02-06T18:49:59.807Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login", @@ -947,7 +947,7 @@ { "@timestamp": "2023-02-06T19:00:25.566Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -1001,7 +1001,7 @@ { "@timestamp": "2023-02-08T23:28:33.214Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -1072,7 +1072,7 @@ { "@timestamp": "2023-02-07T09:27:19.984Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -1143,7 +1143,7 @@ { "@timestamp": "2023-02-07T15:24:50.526Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -1197,7 +1197,7 @@ { "@timestamp": "2023-02-08T15:20:16.509Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "none", @@ -1251,7 +1251,7 @@ { "@timestamp": "2023-02-06T19:35:20.062Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "0704003868", @@ -1299,7 +1299,7 @@ { "@timestamp": "2023-02-06T19:35:20.068Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1353,7 +1353,7 @@ { "@timestamp": "2023-02-07T14:38:16.642Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1403,6 +1403,134 @@ "preserve_original_event", "preserve_duplicate_custom_fields" ] + }, + { + "@timestamp": "2023-07-28T04:48:36.567Z", + "client": { + "ip": [ + "81.2.69.144" + ] + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "removed_block_rule", + "code": "0702001939", + "kind": "event", + "original": "\u003c191\u003edate=2023-07-28,time=04:48:36.567,device_id=FEVM02xxnnnnnn,log_id=0702001939,type=kevent,subtype=system,pri=debug, user=,ui=,action=none,status=none,msg=\"authserver: removed block rule for 81.2.69.144\"", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "fortinet_fortimail": { + "log": { + "action": "none", + "date": "2023-07-28", + "device_id": "FEVM02xxnnnnnn", + "id": "0702001939", + "message": "authserver: removed block rule for 81.2.69.144", + "priority": "debug", + "priority_number": 191, + "status": "none", + "sub_type": "system", + "time": "04:48:36.567", + "type": "kevent" + } + }, + "log": { + "level": "debug", + "syslog": { + "facility": { + "code": 23 + }, + "priority": 191, + "severity": { + "code": 7 + } + } + }, + "message": "authserver: removed block rule for 81.2.69.144", + "observer": { + "product": "FortiMail", + "serial_number": "FEVM02xxnnnnnn", + "type": "firewall", + "vendor": "Fortinet" + }, + "related": { + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-28T03:58:41.726Z", + "client": { + "ip": [ + "81.2.69.144" + ] + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "added_block_rule", + "code": "0702001941", + "kind": "event", + "original": "\u003c191\u003edate=2023-07-28,time=03:58:41.726,device_id=FEVM02xxnnnnnn,log_id=0702001941,type=kevent,subtype=system,pri=debug, user=,ui=,action=none,status=none,msg=\"authserver: added block rule for 81.2.69.144 until 2023-07-28 04:48 -0400\"", + "outcome": "unknown", + "type": [ + "info" + ] + }, + "fortinet_fortimail": { + "log": { + "action": "none", + "date": "2023-07-28", + "device_id": "FEVM02xxnnnnnn", + "id": "0702001941", + "message": "authserver: added block rule for 81.2.69.144 until 2023-07-28 04:48 -0400", + "priority": "debug", + "priority_number": 191, + "status": "none", + "sub_type": "system", + "time": "03:58:41.726", + "type": "kevent" + } + }, + "log": { + "level": "debug", + "syslog": { + "facility": { + "code": 23 + }, + "priority": 191, + "severity": { + "code": 7 + } + } + }, + "message": "authserver: added block rule for 81.2.69.144 until 2023-07-28 04:48 -0400", + "observer": { + "product": "FortiMail", + "serial_number": "FEVM02xxnnnnnn", + "type": "firewall", + "vendor": "Fortinet" + }, + "related": { + "ip": [ + "81.2.69.144" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] } ] } \ No newline at end of file diff --git a/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 21e80178e48..fc5cd993569 100644 --- a/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Fortinet FortiMail logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Fortinet diff --git a/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/pipeline_system.yml b/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/pipeline_system.yml index 7bb88f3ac43..12ea5551046 100644 --- a/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/pipeline_system.yml +++ b/packages/fortinet_fortimail/data_stream/log/elasticsearch/ingest_pipeline/pipeline_system.yml @@ -86,10 +86,13 @@ processors: - '^%{PREFIX} %{DATA}%{IP:fortinet_fortimail.log.ip}%{GREEDYDATA:temp.msg}$' - '^%{PREFIX}%{GREEDYDATA:temp.msg}$' - '^%{DATA}%{USER} %{DATA}%{IP:fortinet_fortimail.log.ip}%{GREEDYDATA:temp.msg}$' + - '^authserver: %{BLOCK_ACTION:temp.block_action} block rule for %{IP:temp.block_ip}$' + - '^authserver: %{BLOCK_ACTION:temp.block_action} block rule for %{IP:temp.block_ip} until %{GREEDYDATA}$' - '^%{DATA}%{USER} %{GREEDYDATA:temp.msg}$' pattern_definitions: PREFIX: '%{DATA}(?i)interface %{NUMBER:fortinet_fortimail.log.port:long}%{DATA} %{USER}' USER: '(?i)user %{NOTSPACE:temp.user}' + BLOCK_ACTION: '(?:added|removed)' - set: field: source.port copy_from: fortinet_fortimail.log.port @@ -99,6 +102,20 @@ processors: value: '{{{fortinet_fortimail.log.ip}}}' allow_duplicates: false if: ctx.fortinet_fortimail?.log?.ip != null + - append: + field: related.ip + value: '{{{temp.block_ip}}}' + allow_duplicates: false + if: ctx.temp?.block_ip != null + - append: + field: client.ip + value: '{{{temp.block_ip}}}' + allow_duplicates: false + if: ctx.temp?.block_ip != null + - set: + field: event.action + value: '{{{temp.block_action}}}_block_rule' + if: ctx.temp?.block_ip != null - append: field: fortinet_fortimail.log.user value: '{{{temp.user}}}' @@ -122,6 +139,7 @@ processors: field: event.action copy_from: fortinet_fortimail.log.action ignore_empty_value: true + override: false - rename: field: temp.module target_field: fortinet_fortimail.log.module diff --git a/packages/fortinet_fortimail/data_stream/log/sample_event.json b/packages/fortinet_fortimail/data_stream/log/sample_event.json index 274246f2f90..562e342c618 100644 --- a/packages/fortinet_fortimail/data_stream/log/sample_event.json +++ b/packages/fortinet_fortimail/data_stream/log/sample_event.json @@ -16,7 +16,7 @@ "ip": "81.2.69.194" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "5fcd6016-3c0e-45e7-b624-cc2a254f1769", diff --git a/packages/fortinet_fortimail/docs/README.md b/packages/fortinet_fortimail/docs/README.md index 98adbca4e11..9652fef080a 100644 --- a/packages/fortinet_fortimail/docs/README.md +++ b/packages/fortinet_fortimail/docs/README.md @@ -71,7 +71,7 @@ An example event for `log` looks as following: "ip": "81.2.69.194" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "5fcd6016-3c0e-45e7-b624-cc2a254f1769", diff --git a/packages/fortinet_fortimail/kibana/tags.yml b/packages/fortinet_fortimail/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fortinet_fortimail/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fortinet_fortimail/manifest.yml b/packages/fortinet_fortimail/manifest.yml index 620966b6e1d..2982ca752ea 100644 --- a/packages/fortinet_fortimail/manifest.yml +++ b/packages/fortinet_fortimail/manifest.yml @@ -1,13 +1,15 @@ name: fortinet_fortimail title: Fortinet FortiMail -version: "2.4.0" +version: "2.8.0" description: Collect logs from Fortinet FortiMail instances with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security", "email_security"] conditions: - kibana.version: ^8.3.0 - elastic.subscription: basic + kibana: + version: ^8.3.0 + elastic: + subscription: basic icons: - src: /img/fortinet-logo.svg title: Fortinet @@ -46,3 +48,4 @@ policy_templates: description: Collecting logs from Fortinet FortiMail instances via udp input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/fortinet_fortimanager/_dev/build/build.yml b/packages/fortinet_fortimanager/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/fortinet_fortimanager/_dev/build/build.yml +++ b/packages/fortinet_fortimanager/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/fortinet_fortimanager/changelog.yml b/packages/fortinet_fortimanager/changelog.yml index 81137e29506..844f66a800b 100644 --- a/packages/fortinet_fortimanager/changelog.yml +++ b/packages/fortinet_fortimanager/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 2.6.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.5.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.4.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "2.3.1-next" + changes: + - description: Relax constraints on date values for testing. + type: bugfix + link: https://github.com/elastic/integrations/pull/6857 - version: "2.3.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-common-config.yml b/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-common-config.yml index be41bb0d476..1445dcc9237 100644 --- a/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-common-config.yml +++ b/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-common-config.yml @@ -2,3 +2,6 @@ fields: tags: - preserve_original_event - preserve_duplicate_custom_fields +# Temporarily relax constraints on data fields. Remove after 8.9 is lowest kibana.version. +dynamic_fields: + fortimanager.log.itime: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" diff --git a/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-fortimanager.log-expected.json b/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-fortimanager.log-expected.json index 546151e0ef7..87c2d1e6f7d 100644 --- a/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-fortimanager.log-expected.json +++ b/packages/fortinet_fortimanager/data_stream/log/_dev/test/pipeline/test-fortimanager.log-expected.json @@ -6,7 +6,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -73,7 +73,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -139,7 +139,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -202,7 +202,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -274,7 +274,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -343,7 +343,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -408,7 +408,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -470,7 +470,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "run", @@ -534,7 +534,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diagnose", @@ -602,7 +602,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "roll", @@ -665,7 +665,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -730,7 +730,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -797,7 +797,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -863,7 +863,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -926,7 +926,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -995,7 +995,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1060,7 +1060,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1122,7 +1122,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "run", @@ -1186,7 +1186,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diagnose", @@ -1254,7 +1254,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "roll", @@ -1317,7 +1317,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1379,7 +1379,7 @@ { "@timestamp": "2023-02-23T17:49:29.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1410,7 +1410,7 @@ "epid": "1", "euid": "1", "id": "0008017006", - "itime": "2023-01-01T00:00:00.957Z", + "itime": "1970-01-20T09:39:39.957Z", "level": "information", "msg": "FGVM02TM22028028[root] policy package 'FGVM02TM22028028' status updated to MODIFIED", "operation": "package/template status", @@ -1455,7 +1455,7 @@ { "@timestamp": "2023-02-22T22:10:49.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1483,7 +1483,7 @@ "epid": "1", "euid": "1", "id": "0025035003", - "itime": "2023-01-01T00:00:00.928Z", + "itime": "1970-01-20T09:39:14.928Z", "level": "notice", "msg": "Log service started", "operation": "Log daemon start", @@ -1517,7 +1517,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1579,7 +1579,7 @@ { "@timestamp": "2023-02-23T16:22:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1610,7 +1610,7 @@ "epid": "1", "euid": "1", "id": "0021030002", - "itime": "2023-01-01T00:00:00.531Z", + "itime": "1970-01-20T09:39:16.531Z", "level": "notice", "operation": "add", "performed_on": "dev=global,adom=root", @@ -1652,7 +1652,7 @@ { "@timestamp": "2023-02-22T22:51:42.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1680,7 +1680,7 @@ "epid": "1", "euid": "1", "id": "0005014002", - "itime": "2023-01-01T00:00:00.737Z", + "itime": "1970-01-20T09:22:16.737Z", "level": "information", "msg": "Update CLI script 'Configuratin Change' in adom 'root' by user 'admin'", "priority_number": 134, diff --git a/packages/fortinet_fortimanager/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/fortinet_fortimanager/data_stream/log/elasticsearch/ingest_pipeline/default.yml index a84636bca26..7fedd2d02e0 100644 --- a/packages/fortinet_fortimanager/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/fortinet_fortimanager/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Fortinet FortiManager. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: event diff --git a/packages/fortinet_fortimanager/data_stream/log/sample_event.json b/packages/fortinet_fortimanager/data_stream/log/sample_event.json index 80c05e6f1cd..ea6c19c3f05 100644 --- a/packages/fortinet_fortimanager/data_stream/log/sample_event.json +++ b/packages/fortinet_fortimanager/data_stream/log/sample_event.json @@ -16,7 +16,7 @@ "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "207d005f-24c8-4c18-9523-e040132174ee", diff --git a/packages/fortinet_fortimanager/docs/README.md b/packages/fortinet_fortimanager/docs/README.md index 4688bf09829..fe064b2d0f1 100644 --- a/packages/fortinet_fortimanager/docs/README.md +++ b/packages/fortinet_fortimanager/docs/README.md @@ -65,7 +65,7 @@ An example event for `log` looks as following: "id": "FMGVMSTM23000100" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "207d005f-24c8-4c18-9523-e040132174ee", diff --git a/packages/fortinet_fortimanager/kibana/tags.yml b/packages/fortinet_fortimanager/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/fortinet_fortimanager/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/fortinet_fortimanager/manifest.yml b/packages/fortinet_fortimanager/manifest.yml index 6742caed59e..499ee051e94 100644 --- a/packages/fortinet_fortimanager/manifest.yml +++ b/packages/fortinet_fortimanager/manifest.yml @@ -1,13 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: fortinet_fortimanager title: Fortinet FortiManager Logs -version: "2.3.0" +version: "2.6.0" description: Collect logs from Fortinet FortiManager instances with Elastic Agent. type: integration categories: ["security", "network", "firewall_security"] conditions: - kibana.version: ^8.3.0 - elastic.subscription: basic + kibana: + version: ^8.3.0 + elastic: + subscription: basic screenshots: - src: /img/fortimanager-dashboard.png title: Fortinet FortiManager Events Dashboard Screenshot @@ -34,3 +36,4 @@ policy_templates: description: Collecting logs from Fortinet FortiManager instances via udp input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/gcp/_dev/build/docs/cloudsql.md b/packages/gcp/_dev/build/docs/cloudsql.md new file mode 100644 index 00000000000..3e273a9c45c --- /dev/null +++ b/packages/gcp/_dev/build/docs/cloudsql.md @@ -0,0 +1,30 @@ +# CloudSQL + +The `cloudsql` dataset fetches metrics from [CloudSQL](https://cloud.google.com/sql) in Google Cloud Platform. It contains all metrics exported from the [GCP CloudSQL Monitoring API](https://cloud.google.com/monitoring/api/metrics_gcp#gcp-cloudsql). + +`gcp.labels.cloudsql.name` label is utilized to identify the type of Google Cloud SQL database that generated the metrics. In the pipelines, this label is crucial for distinguishing between various Cloud SQL database types and directing the metrics to their respective destinations. Current valid values are `mysql`, `postgres` and `sqlserver`. Other values will be dropped. + +## MySQL Metrics + +CloudSQL MySQL metrics. + +{{event "cloudsql_mysql"}} + +{{fields "cloudsql_mysql"}} + +## PostgreSQL Metrics + +CloudSQL PostgreSQL metrics. + +{{event "cloudsql_postgresql"}} + +{{fields "cloudsql_postgresql"}} + + +## SQL Server Metrics + +CloudSQL SQL Server metrics. + +{{event "cloudsql_sqlserver"}} + +{{fields "cloudsql_sqlserver"}} diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index fe172861891..dcbfff9e3e9 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -1,4 +1,74 @@ # newer versions go on top +- version: "2.29.0" + changes: + - description: Remove GCP CloudSQL deprecated, alpha or beta metrics and fix field types. + type: bugfix + link: https://github.com/elastic/integrations/pull/7367 +- version: "2.28.5" + changes: + - description: Set metric type for GKE, Load Balancing, PubSub, Redis and Storage data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/7569 +- version: "2.28.4" + changes: + - description: Migrate GCP Load Balancing HTTPS Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7458 +- version: "2.28.3" + changes: + - description: Set metric type for Cloud Run, Compute, Dataproc and Firestore data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/7560 +- version: "2.28.2" + changes: + - description: Migrate GCP Load Balancing TCP SSL Proxy Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7459 +- version: "2.28.1" + changes: + - description: Set metric type for CloudSQL data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/7556 +- version: "2.28.0" + changes: + - description: Migrate GCP Load Balancing L3 Overview dashboard to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7461 +- version: "2.27.0" + changes: + - description: Add GCP CloudSQL MySQL, SQL Server and PostgreSQL dashboards. + type: enhancement + link: https://github.com/elastic/integrations/pull/7368 +- version: "2.26.0" + changes: + - description: Fix GCP loadbalancing_metrics fields prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7287 +- version: "2.25.1" + changes: + - description: Fix check on gcp.audit.authorization_info[].granted. + type: bugfix + link: https://github.com/elastic/integrations/pull/7308 +- version: "2.25.0" + changes: + - description: Migrate GCP Billing input control to new control panel. + type: enhancement + link: https://github.com/elastic/integrations/pull/7249 +- version: "2.24.0" + changes: + - description: Add GCP CloudSQL MySQL, Postgres, SQLServer data streams + type: enhancement + link: https://github.com/elastic/integrations/pull/4126 +- version: "2.23.0" + changes: + - description: Convert security dashboards to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/7014 +- version: "2.22.1" + changes: + - description: Change ownership in manifest. + type: enhancement + link: https://github.com/elastic/integrations/pull/6614 - version: "2.22.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log b/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log new file mode 100644 index 00000000000..78fa321bcac --- /dev/null +++ b/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log @@ -0,0 +1 @@ +{"insertId":"-abcdef","logName":"organizations/123456789098/logs/cloudaudit.googleapis.com%2Fdata_access","protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"joel.miller@contoso.com"},"authorizationInfo":[{"resourceAttributes":{}}],"methodName":"CloudResourceManagerOrganizationsV3Service-SearchOrganizations","request":{"@type":"type.googleapis.com/google.cloud.resourcemanager.v3.SearchOrganizationsRequest","pageSize":100},"requestMetadata":{"callerIp":"private","destinationAttributes":{},"requestAttributes":{}},"resourceName":"organizations/123456789098","serviceName":"cloudresourcemanager.googleapis.com","status":{}},"receiveTimestamp":"2023-08-02T11:20:31.13521906Z","resource":{"labels":{"organization_id":"123456789098"},"type":"organization"},"severity":"INFO","timestamp":"2023-08-02T11:20:30.734968Z"} \ No newline at end of file diff --git a/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log-expected.json b/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log-expected.json new file mode 100644 index 00000000000..5edf92ed241 --- /dev/null +++ b/packages/gcp/data_stream/audit/_dev/test/pipeline/test-sdh-3695.log-expected.json @@ -0,0 +1,50 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-02T11:20:30.734Z", + "client": { + "user": { + "email": "joel.miller@contoso.com" + } + }, + "cloud": { + "provider": "gcp" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "action": "CloudResourceManagerOrganizationsV3Service-SearchOrganizations", + "category": [ + "network", + "configuration" + ], + "id": "-abcdef", + "kind": "event", + "original": "{\"insertId\":\"-abcdef\",\"logName\":\"organizations/123456789098/logs/cloudaudit.googleapis.com%2Fdata_access\",\"protoPayload\":{\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"authenticationInfo\":{\"principalEmail\":\"joel.miller@contoso.com\"},\"authorizationInfo\":[{\"resourceAttributes\":{}}],\"methodName\":\"CloudResourceManagerOrganizationsV3Service-SearchOrganizations\",\"request\":{\"@type\":\"type.googleapis.com/google.cloud.resourcemanager.v3.SearchOrganizationsRequest\",\"pageSize\":100},\"requestMetadata\":{\"callerIp\":\"private\",\"destinationAttributes\":{},\"requestAttributes\":{}},\"resourceName\":\"organizations/123456789098\",\"serviceName\":\"cloudresourcemanager.googleapis.com\",\"status\":{}},\"receiveTimestamp\":\"2023-08-02T11:20:31.13521906Z\",\"resource\":{\"labels\":{\"organization_id\":\"123456789098\"},\"type\":\"organization\"},\"severity\":\"INFO\",\"timestamp\":\"2023-08-02T11:20:30.734968Z\"}", + "outcome": "unknown", + "provider": "data_access" + }, + "gcp": { + "audit": { + "request": { + "@type": "type.googleapis.com/google.cloud.resourcemanager.v3.SearchOrganizationsRequest", + "pageSize": 100 + }, + "resource_name": "organizations/123456789098", + "type": "type.googleapis.com/google.cloud.audit.AuditLog" + } + }, + "log": { + "level": "INFO", + "logger": "organizations/123456789098/logs/cloudaudit.googleapis.com%2Fdata_access" + }, + "service": { + "name": "cloudresourcemanager.googleapis.com" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index a3504767f15..a738b0ee491 100644 --- a/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -305,15 +305,15 @@ processors: - set: field: event.outcome value: success - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && ctx?.gcp?.audit?.authorization_info[0].granted + if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && ctx?.gcp?.audit?.authorization_info[0]?.granted == true - set: field: event.outcome value: failure - if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && !ctx?.gcp?.audit?.authorization_info[0].granted + if: ctx?.gcp?.audit?.status?.code == null && ctx?.gcp?.audit?.authorization_info != null && ctx?.gcp?.audit?.authorization_info instanceof List && ctx?.gcp?.audit?.authorization_info.size() == 1 && ctx?.gcp?.audit?.authorization_info[0]?.granted == false - set: field: event.outcome value: unknown - if: ctx?.event?.outcome == null + override: false ## # if gcp.audit.authorization_info.[0].granted is true then diff --git a/packages/gcp/data_stream/audit/fields/fields.yml b/packages/gcp/data_stream/audit/fields/fields.yml index 12064f765e5..027cc591bce 100644 --- a/packages/gcp/data_stream/audit/fields/fields.yml +++ b/packages/gcp/data_stream/audit/fields/fields.yml @@ -18,7 +18,7 @@ type: keyword description: "String representation of identity of requesting party. Populated for both first and third party identities. Only present for APIs that support third-party identities." - name: authorization_info - type: array + type: nested description: | Authorization information for the operation. fields: @@ -97,7 +97,7 @@ type: group fields: - name: current_locations - type: array + type: keyword description: | Current locations of the resource. - name: service_name diff --git a/packages/gcp/data_stream/audit/manifest.yml b/packages/gcp/data_stream/audit/manifest.yml index 6e6c72657dc..130daabdcfb 100644 --- a/packages/gcp/data_stream/audit/manifest.yml +++ b/packages/gcp/data_stream/audit/manifest.yml @@ -40,7 +40,7 @@ streams: description: The maximum number of unprocessed messages (unacknowledged but not yet expired). If the value is negative, then there will be no limit on the number of unprocessed messages. Default is 1000. multi: false required: false - show_user: false + show_user: false - name: alternative_host type: text title: Alternative host diff --git a/packages/gcp/data_stream/audit/sample_event.json b/packages/gcp/data_stream/audit/sample_event.json index e7f9d8e867f..a1b43473e16 100644 --- a/packages/gcp/data_stream/audit/sample_event.json +++ b/packages/gcp/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-12-19T00:44:25.051Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "7780bdcf-661a-4891-83bd-dd5233873f9d", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "client": { "user": { @@ -27,9 +27,9 @@ "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "beta.compute.instances.aggregatedList", @@ -38,10 +38,10 @@ "network", "configuration" ], - "created": "2023-01-13T14:59:20.459Z", + "created": "2023-07-19T18:53:36.388Z", "dataset": "gcp.audit", "id": "yonau2dg2zi", - "ingested": "2023-01-13T14:59:21Z", + "ingested": "2023-07-19T18:53:40Z", "kind": "event", "outcome": "success", "provider": "data_access", diff --git a/packages/gcp/data_stream/cloudrun_metrics/fields/fields.yml b/packages/gcp/data_stream/cloudrun_metrics/fields/fields.yml index 4e6d3470ae8..454e5ed6be0 100644 --- a/packages/gcp/data_stream/cloudrun_metrics/fields/fields.yml +++ b/packages/gcp/data_stream/cloudrun_metrics/fields/fields.yml @@ -4,11 +4,13 @@ fields: - name: container.billable_instance_time type: double - description: Billable time aggregated across all container instances. For a given container instance, billable time occurs when the container instance is starting or at least one request is being processed. Billable time is rounded up to the nearest 100 milliseconds. + metric_type: gauge + description: Delta of billable time aggregated across all container instances. For a given container instance, billable time occurs when the container instance is starting or at least one request is being processed. Billable time is rounded up to the nearest 100 milliseconds. - name: container.cpu.allocation_time.sec type: double unit: s - description: Container CPU allocation in seconds. + metric_type: gauge + description: Delta of container CPU allocation in seconds. - name: container.cpu.utilizations type: object object_type: histogram @@ -23,7 +25,8 @@ description: Distribution of the maximum number number of concurrent requests being served by each container instance over a minute. - name: container.memory.allocation_time type: double - description: Container memory allocation in Gigabytes-seconds. + metric_type: gauge + description: Delta of container memory allocation in Gigabytes-seconds. - name: container.memory.utilizations type: object object_type: histogram @@ -31,14 +34,17 @@ - name: container.network.received.bytes type: long unit: byte - description: Incoming socket and HTTP response traffic, in bytes. + metric_type: gauge + description: Delta of incoming socket and HTTP response traffic, in bytes. - name: container.network.sent.bytes type: long unit: byte - description: Outgoing socket and HTTP response traffic, in bytes. + metric_type: gauge + description: Delta of outgoing socket and HTTP response traffic, in bytes. - name: request.count type: long - description: Number of requests reaching the revision. Excludes requests that are not reaching your container instances (e.g. unauthorized requests or when maximum number of instances is reached). + metric_type: gauge + description: Delta of number of requests reaching the revision. Excludes requests that are not reaching your container instances (e.g. unauthorized requests or when maximum number of instances is reached). - name: request_latencies type: object object_type: histogram diff --git a/packages/gcp/data_stream/cloudsql_mysql/agent/stream/stream.yml.hbs b/packages/gcp/data_stream/cloudsql_mysql/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..0c3190ad376 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/agent/stream/stream.yml.hbs @@ -0,0 +1,57 @@ +metricsets: ["metrics"] +period: {{period}} +project_id: {{project_id}} +{{#if credentials_file}} +credentials_file_path: {{credentials_file}} +{{/if}} +{{#if credentials_json}} +credentials_json: '{{credentials_json}}' +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +exclude_labels: {{exclude_labels}} +metrics: + - aligner: ALIGN_NONE + service: cloudsql + metric_types: + - "database/auto_failover_request_count" + - "database/available_for_failover" + - "database/cpu/reserved_cores" + - "database/cpu/usage_time" + - "database/cpu/utilization" + - "database/disk/bytes_used" + - "database/disk/quota" + - "database/disk/read_ops_count" + - "database/disk/utilization" + - "database/disk/write_ops_count" + - "database/instance_state" + - "database/memory/quota" + - "database/memory/total_usage" + - "database/memory/usage" + - "database/memory/utilization" + - "database/mysql/innodb_buffer_pool_pages_dirty" + - "database/mysql/innodb_buffer_pool_pages_free" + - "database/mysql/innodb_buffer_pool_pages_total" + - "database/mysql/innodb_data_fsyncs" + - "database/mysql/innodb_os_log_fsyncs" + - "database/mysql/innodb_pages_read" + - "database/mysql/innodb_pages_written" + - "database/mysql/queries" + - "database/mysql/questions" + - "database/mysql/received_bytes_count" + - "database/mysql/replication/last_io_errno" + - "database/mysql/replication/last_sql_errno" + - "database/mysql/replication/seconds_behind_master" + - "database/mysql/replication/slave_io_running" + - "database/mysql/replication/slave_io_running_state" + - "database/mysql/replication/slave_sql_running" + - "database/mysql/replication/slave_sql_running_state" + - "database/mysql/sent_bytes_count" + - "database/network/connections" + - "database/network/received_bytes_count" + - "database/network/sent_bytes_count" + - "database/replication/network_lag" + - "database/replication/replica_lag" + - "database/up" + - "database/uptime" \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_mysql/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/cloudsql_mysql/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..5bf07a9383e --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,174 @@ +--- +description: Pipeline for parsing GCP CloudSQL MySQL metrics. +processors: + - drop: + description: Drop if database is not MySQL. + if: "ctx?.gcp?.labels?.cloudsql?.name != 'mysql'" + - rename: + field: gcp.metrics.database.auto_failover_request_count.value + target_field: gcp.cloudsql_mysql.database.auto_failover_request.count + ignore_missing: true + - rename: + field: gcp.metrics.database.available_for_failover.value + target_field: gcp.cloudsql_mysql.database.available_for_failover + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.reserved_cores.value + target_field: gcp.cloudsql_mysql.database.cpu.reserved_cores.count + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.usage_time.value + target_field: gcp.cloudsql_mysql.database.cpu.usage_time.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.utilization.value + target_field: gcp.cloudsql_mysql.database.cpu.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.bytes_used.value + target_field: gcp.cloudsql_mysql.database.disk.bytes_used.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.quota.value + target_field: gcp.cloudsql_mysql.database.disk.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.read_ops_count.value + target_field: gcp.cloudsql_mysql.database.disk.read_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.utilization.value + target_field: gcp.cloudsql_mysql.database.disk.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.write_ops_count.value + target_field: gcp.cloudsql_mysql.database.disk.write_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.instance_state.value + target_field: gcp.cloudsql_mysql.database.instance_state + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.quota.value + target_field: gcp.cloudsql_mysql.database.memory.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.total_usage.value + target_field: gcp.cloudsql_mysql.database.memory.total_usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.usage.value + target_field: gcp.cloudsql_mysql.database.memory.usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.utilization.value + target_field: gcp.cloudsql_mysql.database.memory.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_buffer_pool_pages_dirty.value + target_field: gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_dirty.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_buffer_pool_pages_free.value + target_field: gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_free.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_buffer_pool_pages_total.value + target_field: gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_total.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_data_fsyncs.value + target_field: gcp.cloudsql_mysql.database.innodb_data_fsyncs.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_os_log_fsyncs.value + target_field: gcp.cloudsql_mysql.database.innodb_os_log_fsyncs.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_pages_read.value + target_field: gcp.cloudsql_mysql.database.innodb_pages_read.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.innodb_pages_written.value + target_field: gcp.cloudsql_mysql.database.innodb_pages_written.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.queries.value + target_field: gcp.cloudsql_mysql.database.queries.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.questions.value + target_field: gcp.cloudsql_mysql.database.questions.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.received_bytes_count.value + target_field: gcp.cloudsql_mysql.database.received_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.last_io_errno.value + target_field: gcp.cloudsql_mysql.database.replication.last_io_errno + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.last_sql_errno.value + target_field: gcp.cloudsql_mysql.database.replication.last_sql_errno + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.seconds_behind_master.value + target_field: gcp.cloudsql_mysql.database.replication.seconds_behind_master.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.slave_io_running.value + target_field: gcp.cloudsql_mysql.database.replication.slave_io_running + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.slave_io_running_state.value + target_field: gcp.cloudsql_mysql.database.replication.slave_io_running_state + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.slave_sql_running.value + target_field: gcp.cloudsql_mysql.database.replication.slave_sql_running + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.replication.slave_sql_running_state.value + target_field: gcp.cloudsql_mysql.database.replication.slave_sql_running_state + ignore_missing: true + - rename: + field: gcp.metrics.database.mysql.sent_bytes_count.value + target_field: gcp.cloudsql_mysql.database.sent_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.connections.value + target_field: gcp.cloudsql_mysql.database.network.connections.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.received_bytes_count.value + target_field: gcp.cloudsql_mysql.database.network.received_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.sent_bytes_count.value + target_field: gcp.cloudsql_mysql.database.network.sent_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.network_lag.value + target_field: gcp.cloudsql_mysql.database.replication.network_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.replica_lag.value + target_field: gcp.cloudsql_mysql.database.replication.replica_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.up.value + target_field: gcp.cloudsql_mysql.database.up + ignore_missing: true + - rename: + field: gcp.metrics.database.uptime.value + target_field: gcp.cloudsql_mysql.database.uptime.sec + ignore_missing: true + - remove: + field: + - gcp.metrics + ignore_missing: true +on_failure: + - set: + field: error.message + value: '{{ _ingest.on_failure_message }}' \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_mysql/fields/agent.yml b/packages/gcp/data_stream/cloudsql_mysql/fields/agent.yml new file mode 100644 index 00000000000..8e686410afb --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/fields/agent.yml @@ -0,0 +1,160 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an GCP Compute VM and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/gcp/data_stream/cloudsql_mysql/fields/base-fields.yml b/packages/gcp/data_stream/cloudsql_mysql/fields/base-fields.yml new file mode 100644 index 00000000000..a3e4f8df6ea --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: gcp +- name: event.dataset + type: constant_keyword + description: Event dataset + value: gcp.cloudsql_mysql diff --git a/packages/gcp/data_stream/cloudsql_mysql/fields/ecs.yml b/packages/gcp/data_stream/cloudsql_mysql/fields/ecs.yml new file mode 100644 index 00000000000..83e3f6f1225 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: cloud +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.account.name +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: ecs.version +- external: ecs + name: error +- external: ecs + name: error.message +- external: ecs + name: service.type diff --git a/packages/gcp/data_stream/cloudsql_mysql/fields/fields.yml b/packages/gcp/data_stream/cloudsql_mysql/fields/fields.yml new file mode 100644 index 00000000000..068ab45ae7e --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/fields/fields.yml @@ -0,0 +1,172 @@ +- name: gcp.cloudsql_mysql + description: Google Cloud CloudSQL MySQL metrics + type: group + fields: + - name: database.auto_failover_request.count + type: long + metric_type: gauge + description: Delta of number of instance auto-failover requests. + - name: database.available_for_failover + type: long + metric_type: gauge + description: This is > 0 if the failover operation is available on the instance. + - name: database.cpu.reserved_cores.count + type: double + metric_type: gauge + description: Number of cores reserved for the database. + - name: database.cpu.usage_time.sec + type: double + unit: s + metric_type: gauge + description: Delta CPU usage time in seconds. + - name: database.cpu.utilization.pct + type: double + unit: percent + metric_type: gauge + description: Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. + - name: database.disk.bytes_used.bytes + type: long + unit: byte + metric_type: gauge + description: Data utilization in bytes. + - name: database.disk.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum data disk size in bytes. + - name: database.disk.read_ops.count + type: long + metric_type: gauge + description: Delta count of data disk read IO operations. + - name: database.disk.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the disk quota that is currently in use. + - name: database.disk.write_ops.count + type: long + metric_type: gauge + description: Delta count of data disk write IO operations. + - name: database.instance_state + type: boolean + description: The current serving state of the Cloud SQL instance. + - name: database.memory.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum RAM size in bytes. + - name: database.memory.total_usage.bytes + type: long + unit: byte + metric_type: gauge + description: Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. + - name: database.memory.usage.bytes + type: long + unit: byte + metric_type: gauge + description: RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. + - name: database.memory.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the memory quota that is currently in use. + - name: database.innodb_buffer_pool_pages_dirty.count + type: long + metric_type: gauge + description: Number of unflushed pages in the InnoDB buffer pool. + - name: database.innodb_buffer_pool_pages_free.count + type: long + metric_type: gauge + description: Number of unused pages in the InnoDB buffer pool. + - name: database.innodb_buffer_pool_pages_total.count + type: long + metric_type: gauge + description: Total number of pages in the InnoDB buffer pool. + - name: database.innodb_data_fsyncs.count + type: long + metric_type: gauge + description: Delta count of InnoDB fsync() calls. + - name: database.innodb_os_log_fsyncs.count + type: long + metric_type: gauge + description: Delta count of InnoDB fsync() calls to the log file. + - name: database.innodb_pages_read.count + type: long + metric_type: gauge + description: Delta count of InnoDB pages read. + - name: database.innodb_pages_written.count + type: long + metric_type: gauge + description: Delta count of InnoDB pages written. + - name: database.queries.count + type: long + metric_type: gauge + description: Delta count of statements executed by the server. + - name: database.questions.count + type: long + metric_type: gauge + description: Delta count of statements executed by the server sent by the client. + - name: database.received_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes received by MySQL process. + - name: database.replication.last_io_errno + type: long + metric_type: gauge + description: The error number of the most recent error that caused the I/O thread to stop. + - name: database.replication.last_sql_errno + type: long + metric_type: gauge + description: The error number of the most recent error that caused the SQL thread to stop. + - name: database.replication.seconds_behind_master.sec + type: long + unit: s + metric_type: gauge + description: Number of seconds the read replica is behind its primary (approximation). + - name: database.replication.slave_io_running + type: keyword + description: Indicates whether the I/O thread for reading the primary's binary log is running. Possible values are Yes, No and Connecting. + - name: database.replication.slave_io_running_state + type: boolean + description: Indicates whether the I/O thread for reading the primary's binary log is running. Possible values are Yes, No and Connecting, and the values are exposed through the 'state' field. + - name: database.replication.slave_sql_running + type: keyword + description: Indicates whether the SQL thread for executing events in the relay log is running. + - name: database.replication.slave_sql_running_state + type: boolean + description: Indicates whether the SQL thread for executing events in the relay log is running. Possible values are Yes / No, and the values are exposed through the 'state' field. + - name: database.sent_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes sent by MySQL process. + - name: database.network.connections.count + type: long + metric_type: gauge + description: Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. + - name: database.network.received_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes received through the network. + - name: database.network.sent_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes sent through the network. + - name: database.replication.network_lag.sec + type: long + unit: s + metric_type: gauge + description: Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. + - name: database.replication.replica_lag.sec + type: double + unit: s + metric_type: gauge + description: Number of seconds the read replica is behind its primary (approximation). + - name: database.up + type: long + metric_type: gauge + description: Indicates if the server is up or not. + - name: database.uptime.sec + type: long + unit: s + metric_type: gauge + description: Delta count of the time in seconds the instance has been running. diff --git a/packages/gcp/data_stream/cloudsql_mysql/fields/package-fields.yml b/packages/gcp/data_stream/cloudsql_mysql/fields/package-fields.yml new file mode 100644 index 00000000000..d8ccb93f502 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/fields/package-fields.yml @@ -0,0 +1,31 @@ +- name: gcp + description: >- + GCP module + fields: + - name: labels + type: object + description: >- + GCP monitoring metrics labels + fields: + - name: user.* + type: object + object_type: keyword + - name: metadata.* + type: object + object_type: keyword + - name: metrics.* + type: object + object_type: keyword + - name: system.* + type: object + object_type: keyword + - name: resource.* + type: object + object_type: keyword + - name: "metrics.*.*.*.*" + type: object + object_type: double + object_type_mapping_type: "*" + description: > + Metrics that returned from Google Cloud API query. + diff --git a/packages/gcp/data_stream/cloudsql_mysql/manifest.yml b/packages/gcp/data_stream/cloudsql_mysql/manifest.yml new file mode 100644 index 00000000000..8fff525cb48 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/manifest.yml @@ -0,0 +1,25 @@ +title: "GCP CloudSQL MySQL Metrics" +type: metrics +streams: + - input: gcp/metrics + title: GCP CloudSQL MySQL Metrics + description: Collect GCP CloudSQL MySQL Metrics + vars: + - name: region + type: text + title: GCP Region + multi: false + required: false + show_user: true + - name: period + type: text + title: Period + default: 60s + required: true + - name: exclude_labels + type: bool + title: Exclude Labels + description: Exclude additional labels from metrics + multi: false + required: false + show_user: true diff --git a/packages/gcp/data_stream/cloudsql_mysql/sample_event.json b/packages/gcp/data_stream/cloudsql_mysql/sample_event.json new file mode 100644 index 00000000000..38772ffa488 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_mysql/sample_event.json @@ -0,0 +1,47 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_mysql", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_mysql": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_postgresql/agent/stream/stream.yml.hbs b/packages/gcp/data_stream/cloudsql_postgresql/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..7321abaaec9 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/agent/stream/stream.yml.hbs @@ -0,0 +1,63 @@ +metricsets: ["metrics"] +period: {{period}} +project_id: {{project_id}} +{{#if credentials_file}} +credentials_file_path: {{credentials_file}} +{{/if}} +{{#if credentials_json}} +credentials_json: '{{credentials_json}}' +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +exclude_labels: {{exclude_labels}} +metrics: + - aligner: ALIGN_NONE + service: cloudsql + metric_types: + - "database/auto_failover_request_count" + - "database/available_for_failover" + - "database/cpu/reserved_cores" + - "database/cpu/usage_time" + - "database/cpu/utilization" + - "database/disk/bytes_used" + - "database/disk/quota" + - "database/disk/read_ops_count" + - "database/disk/utilization" + - "database/disk/write_ops_count" + - "database/instance_state" + - "database/memory/quota" + - "database/memory/total_usage" + - "database/memory/usage" + - "database/memory/utilization" + - "database/network/connections" + - "database/network/received_bytes_count" + - "database/network/sent_bytes_count" + - "database/postgresql/insights/aggregate/execution_time" + - "database/postgresql/insights/aggregate/io_time" + - "database/postgresql/insights/aggregate/latencies" + - "database/postgresql/insights/aggregate/lock_time" + - "database/postgresql/insights/aggregate/row_count" + - "database/postgresql/insights/aggregate/shared_blk_access_count" + - "database/postgresql/insights/perquery/execution_time" + - "database/postgresql/insights/perquery/io_time" + - "database/postgresql/insights/perquery/latencies" + - "database/postgresql/insights/perquery/lock_time" + - "database/postgresql/insights/perquery/row_count" + - "database/postgresql/insights/perquery/shared_blk_access_count" + - "database/postgresql/insights/pertag/execution_time" + - "database/postgresql/insights/pertag/io_time" + - "database/postgresql/insights/pertag/latencies" + - "database/postgresql/insights/pertag/lock_time" + - "database/postgresql/insights/pertag/row_count" + - "database/postgresql/insights/pertag/shared_blk_access_count" + - "database/postgresql/num_backends" + - "database/postgresql/replication/replica_byte_lag" + - "database/postgresql/transaction_count" + - "database/postgresql/transaction_id_count" + - "database/postgresql/transaction_id_utilization" + - "database/postgresql/vacuum/oldest_transaction_age" + - "database/replication/network_lag" + - "database/replication/replica_lag" + - "database/up" + - "database/uptime" \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_postgresql/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/cloudsql_postgresql/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..6a0dda22f1e --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,198 @@ +--- +description: Pipeline for parsing GCP CloudSQL PostgreSQL metrics. +processors: + - drop: + description: Drop if database is not PostgreSQL. + if: "ctx?.gcp?.labels?.cloudsql?.name != 'postgres'" + - rename: + field: gcp.metrics.database.auto_failover_request_count.value + target_field: gcp.cloudsql_postgresql.database.auto_failover_request.count + ignore_missing: true + - rename: + field: gcp.metrics.database.available_for_failover.value + target_field: gcp.cloudsql_postgresql.database.available_for_failover + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.reserved_cores.value + target_field: gcp.cloudsql_postgresql.database.cpu.reserved_cores.count + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.usage_time.value + target_field: gcp.cloudsql_postgresql.database.cpu.usage_time.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.utilization.value + target_field: gcp.cloudsql_postgresql.database.cpu.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.bytes_used.value + target_field: gcp.cloudsql_postgresql.database.disk.bytes_used.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.quota.value + target_field: gcp.cloudsql_postgresql.database.disk.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.read_ops_count.value + target_field: gcp.cloudsql_postgresql.database.disk.read_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.utilization.value + target_field: gcp.cloudsql_postgresql.database.disk.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.write_ops_count.value + target_field: gcp.cloudsql_postgresql.database.disk.write_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.instance_state.value + target_field: gcp.cloudsql_postgresql.database.instance_state + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.quota.value + target_field: gcp.cloudsql_postgresql.database.memory.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.total_usage.value + target_field: gcp.cloudsql_postgresql.database.memory.total_usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.usage.value + target_field: gcp.cloudsql_postgresql.database.memory.usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.utilization.value + target_field: gcp.cloudsql_postgresql.database.memory.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.network.connections.value + target_field: gcp.cloudsql_postgresql.database.network.connections.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.received_bytes_count.value + target_field: gcp.cloudsql_postgresql.database.network.received_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.sent_bytes_count.value + target_field: gcp.cloudsql_postgresql.database.network.sent_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.execution_time.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.execution_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.io_time.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.io_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.latencies.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.latencies + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.lock_time.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.lock_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.row_count.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.row.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.aggregate.shared_blk_access_count.value + target_field: gcp.cloudsql_postgresql.database.insights.aggregate.shared_blk_access.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.execution_time.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.execution_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.io_time.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.io_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.latencies.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.latencies + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.lock_time.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.lock_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.row_count.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.row.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.perquery.shared_blk_access_count.value + target_field: gcp.cloudsql_postgresql.database.insights.perquery.shared_blk_access.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.execution_time.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.execution_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.io_time.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.io_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.latencies.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.latencies + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.lock_time.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.lock_time + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.row_count.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.row.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.insights.pertag.shared_blk_access_count.value + target_field: gcp.cloudsql_postgresql.database.insights.pertag.shared_blk_access.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.num_backends.value + target_field: gcp.cloudsql_postgresql.database.num_backends.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.replication.replica_byte_lag.value + target_field: gcp.cloudsql_postgresql.database.replication.replica_byte_lag.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.transaction_count.value + target_field: gcp.cloudsql_postgresql.database.transaction.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.transaction_id_count.value + target_field: gcp.cloudsql_postgresql.database.transaction_id.count + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.transaction_id_utilization.value + target_field: gcp.cloudsql_postgresql.database.transaction_id_utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.postgresql.vacuum.oldest_transaction_age.value + target_field: gcp.cloudsql_postgresql.database.vacuum.oldest_transaction_age + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.network_lag.value + target_field: gcp.cloudsql_postgresql.database.replication.network_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.replica_lag.value + target_field: gcp.cloudsql_postgresql.database.replication.replica_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.up.value + target_field: gcp.cloudsql_postgresql.database.up + ignore_missing: true + - rename: + field: gcp.metrics.database.uptime.value + target_field: gcp.cloudsql_postgresql.database.uptime.sec + ignore_missing: true + - remove: + field: + - gcp.metrics + ignore_missing: true +on_failure: + - set: + field: error.message + value: '{{ _ingest.on_failure_message }}' \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_postgresql/fields/agent.yml b/packages/gcp/data_stream/cloudsql_postgresql/fields/agent.yml new file mode 100644 index 00000000000..8e686410afb --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/fields/agent.yml @@ -0,0 +1,160 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an GCP Compute VM and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/gcp/data_stream/cloudsql_postgresql/fields/base-fields.yml b/packages/gcp/data_stream/cloudsql_postgresql/fields/base-fields.yml new file mode 100644 index 00000000000..28685d36240 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: gcp +- name: event.dataset + type: constant_keyword + description: Event dataset + value: gcp.cloudsql_postgresql diff --git a/packages/gcp/data_stream/cloudsql_postgresql/fields/ecs.yml b/packages/gcp/data_stream/cloudsql_postgresql/fields/ecs.yml new file mode 100644 index 00000000000..83e3f6f1225 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: cloud +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.account.name +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: ecs.version +- external: ecs + name: error +- external: ecs + name: error.message +- external: ecs + name: service.type diff --git a/packages/gcp/data_stream/cloudsql_postgresql/fields/fields.yml b/packages/gcp/data_stream/cloudsql_postgresql/fields/fields.yml new file mode 100644 index 00000000000..a5118f616f7 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/fields/fields.yml @@ -0,0 +1,199 @@ +- name: gcp.cloudsql_postgresql + description: Google Cloud CloudSQL PostgreSQL metrics + type: group + fields: + - name: database.auto_failover_request.count + type: long + metric_type: gauge + description: Delta of number of instance auto-failover requests. + - name: database.available_for_failover + type: long + metric_type: gauge + description: This is > 0 if the failover operation is available on the instance. + - name: database.cpu.reserved_cores.count + type: double + metric_type: gauge + description: Number of cores reserved for the database. + - name: database.cpu.usage_time.sec + type: double + unit: s + metric_type: gauge + description: Delta CPU usage time in seconds. + - name: database.cpu.utilization.pct + type: double + unit: percent + metric_type: gauge + description: Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. + - name: database.disk.bytes_used.bytes + type: long + unit: byte + metric_type: gauge + description: Data utilization in bytes. + - name: database.disk.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum data disk size in bytes. + - name: database.disk.read_ops.count + type: long + metric_type: gauge + description: Delta count of data disk read IO operations. + - name: database.disk.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the disk quota that is currently in use. + - name: database.disk.write_ops.count + type: long + metric_type: gauge + description: Delta count of data disk write IO operations. + - name: database.instance_state + type: boolean + description: The current serving state of the Cloud SQL instance. + - name: database.memory.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum RAM size in bytes. + - name: database.memory.total_usage.bytes + type: long + unit: byte + metric_type: gauge + description: Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. + - name: database.memory.usage.bytes + type: long + unit: byte + metric_type: gauge + description: RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. + - name: database.memory.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the memory quota that is currently in use. + - name: database.network.connections.count + type: long + metric_type: gauge + description: Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. + - name: database.network.received_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes received through the network. + - name: database.network.sent_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes sent through the network. + - name: database.insights.aggregate.execution_time + type: long + metric_type: counter + description: Accumulated query execution time per user per database. This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. + - name: database.insights.aggregate.io_time + type: long + metric_type: counter + description: Accumulated IO time per user per database. + - name: database.insights.aggregate.latencies + type: long + metric_type: counter + description: Query latency distribution per user per database. + - name: database.insights.aggregate.lock_time + type: long + metric_type: counter + description: Accumulated lock wait time per user per database. + - name: database.insights.aggregate.row.count + type: long + metric_type: counter + description: Total number of rows affected during query execution. + - name: database.insights.aggregate.shared_blk_access.count + type: long + metric_type: counter + description: Shared blocks (regular tables & indexed) accessed by statement execution. + - name: database.insights.perquery.execution_time + type: long + metric_type: counter + description: Accumulated execution times per user per database per query.This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. + - name: database.insights.perquery.io_time + type: long + metric_type: counter + description: Accumulated IO time per user per database per query. + - name: database.insights.perquery.latencies + type: histogram + description: Query latency distribution per user per database per query. + - name: database.insights.perquery.lock_time + type: long + metric_type: counter + description: Accumulated lock wait time per user per database per query. + - name: database.insights.perquery.row.count + type: long + metric_type: counter + description: Total number of rows affected during query execution. + - name: database.insights.perquery.shared_blk_access.count + type: long + metric_type: counter + description: Shared blocks (regular tables & indexed) accesssed by statement execution. + - name: database.insights.pertag.execution_time + type: long + metric_type: counter + description: Accumulated execution times per user per database per tag.This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. + - name: database.insights.pertag.io_time + type: long + metric_type: counter + description: Accumulated IO write time per user per database per tag. + - name: database.insights.pertag.latencies + type: histogram + description: Query latency distribution per user per database per tag. + - name: database.insights.pertag.lock_time + type: long + metric_type: counter + description: Accumulated lock wait time per user per database per tag. + - name: database.insights.pertag.row.count + type: long + metric_type: counter + description: Total number of rows affected during query execution. + - name: database.insights.pertag.shared_blk_access.count + type: long + metric_type: counter + description: Shared blocks (regular tables & indexed) accessed by statement execution. + - name: database.num_backends.count + type: long + metric_type: gauge + description: Number of connections to the Cloud SQL PostgreSQL instance. + - name: database.replication.replica_byte_lag.bytes + type: long + unit: byte + metric_type: gauge + description: Replication lag in bytes. Reported from the master per replica. + - name: database.transaction.count + type: long + metric_type: gauge + description: Delta count of number of transactions. + - name: database.transaction_id.count + type: long + metric_type: gauge + description: Delta count of transaction ID. + - name: database.transaction_id_utilization.pct + type: double + unit: percent + metric_type: gauge + description: Current utilization represented as a percentage of transaction IDs consumed by the Cloud SQL PostgreSQL instance. Values are typically numbers between 0.0 and 1.0. Charts display the values as a percentage between 0% and 100%. + - name: database.vacuum.oldest_transaction_age + type: long + metric_type: gauge + description: Age of the oldest transaction yet to be vacuumed in the Cloud SQL PostgreSQL instance, measured in number of transactions that have happened since the oldest transaction. + - name: database.replication.network_lag.sec + type: long + unit: s + metric_type: gauge + description: Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. + - name: database.replication.replica_lag.sec + type: double + unit: s + metric_type: gauge + description: Number of seconds the read replica is behind its primary (approximation). + - name: database.up + type: long + metric_type: gauge + description: Indicates if the server is up or not. + - name: database.uptime.sec + type: long + unit: s + metric_type: gauge + description: Delta count of the time in seconds the instance has been running. diff --git a/packages/gcp/data_stream/cloudsql_postgresql/fields/package-fields.yml b/packages/gcp/data_stream/cloudsql_postgresql/fields/package-fields.yml new file mode 100644 index 00000000000..d8ccb93f502 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/fields/package-fields.yml @@ -0,0 +1,31 @@ +- name: gcp + description: >- + GCP module + fields: + - name: labels + type: object + description: >- + GCP monitoring metrics labels + fields: + - name: user.* + type: object + object_type: keyword + - name: metadata.* + type: object + object_type: keyword + - name: metrics.* + type: object + object_type: keyword + - name: system.* + type: object + object_type: keyword + - name: resource.* + type: object + object_type: keyword + - name: "metrics.*.*.*.*" + type: object + object_type: double + object_type_mapping_type: "*" + description: > + Metrics that returned from Google Cloud API query. + diff --git a/packages/gcp/data_stream/cloudsql_postgresql/manifest.yml b/packages/gcp/data_stream/cloudsql_postgresql/manifest.yml new file mode 100644 index 00000000000..14d7ba51b12 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/manifest.yml @@ -0,0 +1,25 @@ +title: "GCP CloudSQL PostgreSQL Metrics" +type: metrics +streams: + - input: gcp/metrics + title: GCP CloudSQL PostgreSQL Metrics + description: Collect GCP CloudSQL PostgreSQL Metrics + vars: + - name: region + type: text + title: GCP Region + multi: false + required: false + show_user: true + - name: period + type: text + title: Period + default: 60s + required: true + - name: exclude_labels + type: bool + title: Exclude Labels + description: Exclude additional labels from metrics + multi: false + required: false + show_user: true diff --git a/packages/gcp/data_stream/cloudsql_postgresql/sample_event.json b/packages/gcp/data_stream/cloudsql_postgresql/sample_event.json new file mode 100644 index 00000000000..c0163ee6ed9 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_postgresql/sample_event.json @@ -0,0 +1,47 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_postgresql", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_postgresql": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/agent/stream/stream.yml.hbs b/packages/gcp/data_stream/cloudsql_sqlserver/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..87cd2b8261f --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/agent/stream/stream.yml.hbs @@ -0,0 +1,41 @@ +metricsets: ["metrics"] +period: {{period}} +project_id: {{project_id}} +{{#if credentials_file}} +credentials_file_path: {{credentials_file}} +{{/if}} +{{#if credentials_json}} +credentials_json: '{{credentials_json}}' +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +exclude_labels: {{exclude_labels}} +metrics: + - aligner: ALIGN_NONE + service: cloudsql + metric_types: + - "database/auto_failover_request_count" + - "database/available_for_failover" + - "database/cpu/reserved_cores" + - "database/cpu/usage_time" + - "database/cpu/utilization" + - "database/disk/bytes_used" + - "database/disk/quota" + - "database/disk/read_ops_count" + - "database/disk/utilization" + - "database/disk/write_ops_count" + - "database/instance_state" + - "database/memory/quota" + - "database/memory/total_usage" + - "database/memory/usage" + - "database/memory/utilization" + - "database/network/connections" + - "database/network/received_bytes_count" + - "database/network/sent_bytes_count" + - "database/replication/network_lag" + - "database/replication/replica_lag" + - "database/sqlserver/audits_size" + - "database/sqlserver/audits_upload_count" + - "database/up" + - "database/uptime" \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/cloudsql_sqlserver/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..9a353b147b6 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,110 @@ +--- +description: Pipeline for parsing GCP CloudSQL SQL Server metrics. +processors: + - drop: + description: Drop if database is not SQLServer. + if: "ctx?.gcp?.labels?.cloudsql?.name != 'sqlserver'" + - rename: + field: gcp.metrics.database.auto_failover_request_count.value + target_field: gcp.cloudsql_sqlserver.database.auto_failover_request.count + ignore_missing: true + - rename: + field: gcp.metrics.database.available_for_failover.value + target_field: gcp.cloudsql_sqlserver.database.available_for_failover + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.reserved_cores.value + target_field: gcp.cloudsql_sqlserver.database.cpu.reserved_cores.count + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.usage_time.value + target_field: gcp.cloudsql_sqlserver.database.cpu.usage_time.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.cpu.utilization.value + target_field: gcp.cloudsql_sqlserver.database.cpu.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.bytes_used.value + target_field: gcp.cloudsql_sqlserver.database.disk.bytes_used.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.quota.value + target_field: gcp.cloudsql_sqlserver.database.disk.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.read_ops_count.value + target_field: gcp.cloudsql_sqlserver.database.disk.read_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.utilization.value + target_field: gcp.cloudsql_sqlserver.database.disk.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.disk.write_ops_count.value + target_field: gcp.cloudsql_sqlserver.database.disk.write_ops.count + ignore_missing: true + - rename: + field: gcp.metrics.database.instance_state.value + target_field: gcp.cloudsql_sqlserver.database.instance_state + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.quota.value + target_field: gcp.cloudsql_sqlserver.database.memory.quota.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.total_usage.value + target_field: gcp.cloudsql_sqlserver.database.memory.total_usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.usage.value + target_field: gcp.cloudsql_sqlserver.database.memory.usage.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.memory.utilization.value + target_field: gcp.cloudsql_sqlserver.database.memory.utilization.pct + ignore_missing: true + - rename: + field: gcp.metrics.database.network.connections.value + target_field: gcp.cloudsql_sqlserver.database.network.connections.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.received_bytes_count.value + target_field: gcp.cloudsql_sqlserver.database.network.received_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.network.sent_bytes_count.value + target_field: gcp.cloudsql_sqlserver.database.network.sent_bytes.count + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.network_lag.value + target_field: gcp.cloudsql_sqlserver.database.replication.network_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.replication.replica_lag.value + target_field: gcp.cloudsql_sqlserver.database.replication.replica_lag.sec + ignore_missing: true + - rename: + field: gcp.metrics.database.sqlserver.audits_size.value + target_field: gcp.cloudsql_sqlserver.database.audits_size.bytes + ignore_missing: true + - rename: + field: gcp.metrics.database.sqlserver.audits_upload_count.value + target_field: gcp.cloudsql_sqlserver.database.audits_upload.count + ignore_missing: true + - rename: + field: gcp.metrics.database.up.value + target_field: gcp.cloudsql_sqlserver.database.up + ignore_missing: true + - rename: + field: gcp.metrics.database.uptime.value + target_field: gcp.cloudsql_sqlserver.database.uptime.sec + ignore_missing: true + - remove: + field: + - gcp.metrics + ignore_missing: true +on_failure: + - set: + field: error.message + value: '{{ _ingest.on_failure_message }}' \ No newline at end of file diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/fields/agent.yml b/packages/gcp/data_stream/cloudsql_sqlserver/fields/agent.yml new file mode 100644 index 00000000000..8e686410afb --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/fields/agent.yml @@ -0,0 +1,160 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an GCP Compute VM and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/fields/base-fields.yml b/packages/gcp/data_stream/cloudsql_sqlserver/fields/base-fields.yml new file mode 100644 index 00000000000..9b91d1ac525 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: gcp +- name: event.dataset + type: constant_keyword + description: Event dataset + value: gcp.cloudsql_sqlserver diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/fields/ecs.yml b/packages/gcp/data_stream/cloudsql_sqlserver/fields/ecs.yml new file mode 100644 index 00000000000..83e3f6f1225 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: cloud +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.account.name +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: ecs.version +- external: ecs + name: error +- external: ecs + name: error.message +- external: ecs + name: service.type diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/fields/fields.yml b/packages/gcp/data_stream/cloudsql_sqlserver/fields/fields.yml new file mode 100644 index 00000000000..687cde85335 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/fields/fields.yml @@ -0,0 +1,112 @@ +- name: gcp.cloudsql_sqlserver + description: Google Cloud CloudSQL SQL Server metrics + type: group + fields: + - name: database.auto_failover_request.count + type: long + metric_type: gauge + description: Delta of number of instance auto-failover requests. + - name: database.available_for_failover + type: long + metric_type: gauge + description: This is > 0 if the failover operation is available on the instance. + - name: database.cpu.reserved_cores.count + type: double + metric_type: gauge + description: Number of cores reserved for the database. + - name: database.cpu.usage_time.sec + type: double + unit: s + metric_type: gauge + description: Delta CPU usage time in seconds. + - name: database.cpu.utilization.pct + type: double + unit: percent + metric_type: gauge + description: Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. + - name: database.disk.bytes_used.bytes + type: long + unit: byte + metric_type: gauge + description: Data utilization in bytes. + - name: database.disk.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum data disk size in bytes. + - name: database.disk.read_ops.count + type: long + metric_type: gauge + description: Delta count of data disk read IO operations. + - name: database.disk.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the disk quota that is currently in use. + - name: database.disk.write_ops.count + type: long + metric_type: gauge + description: Delta count of data disk write IO operations. + - name: database.instance_state + type: boolean + description: The current serving state of the Cloud SQL instance. + - name: database.memory.quota.bytes + type: long + unit: byte + metric_type: gauge + description: Maximum RAM size in bytes. + - name: database.memory.total_usage.bytes + type: long + unit: byte + metric_type: gauge + description: Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. + - name: database.memory.usage.bytes + type: long + unit: byte + metric_type: gauge + description: RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. + - name: database.memory.utilization.pct + type: double + unit: percent + metric_type: gauge + description: The fraction of the memory quota that is currently in use. + - name: database.network.connections.count + type: long + metric_type: gauge + description: Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. + - name: database.network.received_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes received through the network. + - name: database.network.sent_bytes.count + type: long + metric_type: gauge + description: Delta count of bytes sent through the network. + - name: database.replication.network_lag.sec + type: long + unit: s + metric_type: gauge + description: Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. + - name: database.replication.replica_lag.sec + type: double + unit: s + metric_type: gauge + description: Number of seconds the read replica is behind its primary (approximation). + - name: database.audits_size.bytes + type: long + unit: byte + metric_type: gauge + description: Tracks the size in bytes of stored SQLServer audit files on an instance. + - name: database.audits_upload.count + type: long + metric_type: gauge + description: Delta count of total number of SQLServer audit file uploads to a GCS bucket and whether or not an upload was successful. + - name: database.up + type: long + metric_type: gauge + description: Indicates if the server is up or not. + - name: database.uptime.sec + type: long + unit: s + metric_type: gauge + description: Delta count of the time in seconds the instance has been running. diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/fields/package-fields.yml b/packages/gcp/data_stream/cloudsql_sqlserver/fields/package-fields.yml new file mode 100644 index 00000000000..d8ccb93f502 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/fields/package-fields.yml @@ -0,0 +1,31 @@ +- name: gcp + description: >- + GCP module + fields: + - name: labels + type: object + description: >- + GCP monitoring metrics labels + fields: + - name: user.* + type: object + object_type: keyword + - name: metadata.* + type: object + object_type: keyword + - name: metrics.* + type: object + object_type: keyword + - name: system.* + type: object + object_type: keyword + - name: resource.* + type: object + object_type: keyword + - name: "metrics.*.*.*.*" + type: object + object_type: double + object_type_mapping_type: "*" + description: > + Metrics that returned from Google Cloud API query. + diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/manifest.yml b/packages/gcp/data_stream/cloudsql_sqlserver/manifest.yml new file mode 100644 index 00000000000..75ea1161095 --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/manifest.yml @@ -0,0 +1,25 @@ +title: "GCP CloudSQL SQL Server Metrics" +type: metrics +streams: + - input: gcp/metrics + title: GCP CloudSQL SQL Server Metrics + description: Collect GCP CloudSQL SQL Server Metrics + vars: + - name: region + type: text + title: GCP Region + multi: false + required: false + show_user: true + - name: period + type: text + title: Period + default: 60s + required: true + - name: exclude_labels + type: bool + title: Exclude Labels + description: Exclude additional labels from metrics + multi: false + required: false + show_user: true diff --git a/packages/gcp/data_stream/cloudsql_sqlserver/sample_event.json b/packages/gcp/data_stream/cloudsql_sqlserver/sample_event.json new file mode 100644 index 00000000000..6395e2b3a2a --- /dev/null +++ b/packages/gcp/data_stream/cloudsql_sqlserver/sample_event.json @@ -0,0 +1,47 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_sqlserver", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_sqlserver": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} \ No newline at end of file diff --git a/packages/gcp/data_stream/compute/fields/fields.yml b/packages/gcp/data_stream/compute/fields/fields.yml index c55330dd657..825d8c7b990 100644 --- a/packages/gcp/data_stream/compute/fields/fields.yml +++ b/packages/gcp/data_stream/compute/fields/fields.yml @@ -4,58 +4,77 @@ fields: - name: firewall.dropped.bytes type: long - description: Incoming bytes dropped by the firewall + metric_type: gauge + description: Delta of incoming bytes dropped by the firewall - name: firewall.dropped_packets_count.value type: long - description: Incoming packets dropped by the firewall + metric_type: gauge + description: Delta of incoming packets dropped by the firewall - name: instance.cpu.reserved_cores.value type: double + metric_type: gauge description: Number of cores reserved on the host of the instance - name: instance.cpu.usage_time.sec type: double - description: Usage for all cores in seconds + metric_type: gauge + description: Delta of usage for all cores in seconds - name: instance.cpu.usage.pct type: double + metric_type: gauge description: The fraction of the allocated CPU that is currently in use on the instance - name: instance.disk.read.bytes type: long - description: Count of bytes read from disk + metric_type: gauge + description: Delta of count of bytes read from disk - name: instance.disk.read_ops_count.value type: long - description: Count of disk read IO operations + metric_type: gauge + description: Delta of count of disk read IO operations - name: instance.disk.write.bytes type: long - description: Count of bytes written to disk + metric_type: gauge + description: Delta of count of bytes written to disk - name: instance.disk.write_ops_count.value type: long - description: Count of disk write IO operations + metric_type: gauge + description: Delta of count of disk write IO operations - name: instance.memory.balloon.ram_size.value type: long + metric_type: gauge description: The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family. - name: instance.memory.balloon.ram_used.value type: long + metric_type: gauge description: Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family. - name: instance.memory.balloon.swap_in.bytes type: long - description: The amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. + metric_type: gauge + description: Delta of the amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. - name: instance.memory.balloon.swap_out.bytes type: long - description: The amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. + metric_type: gauge + description: Delta of the amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. - name: instance.network.ingress.bytes type: long - description: Count of bytes received from the network + metric_type: gauge + description: Delta of count of bytes received from the network - name: instance.network.ingress.packets.count type: long - description: Count of packets received from the network + metric_type: gauge + description: Delta of count of packets received from the network - name: instance.network.egress.bytes type: long - description: Count of bytes sent over the network + metric_type: gauge + description: Delta of count of bytes sent over the network - name: instance.network.egress.packets.count type: long - description: Count of packets sent over the network + metric_type: gauge + description: Delta of count of packets sent over the network - name: instance.uptime.sec type: long - description: Number of seconds the VM has been running. + metric_type: gauge + description: Delta of number of seconds the VM has been running. - name: instance.uptime_total.sec type: long + metric_type: gauge description: Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. diff --git a/packages/gcp/data_stream/dataproc/fields/fields.yml b/packages/gcp/data_stream/dataproc/fields/fields.yml index e7086b59772..9305f0e3ec2 100644 --- a/packages/gcp/data_stream/dataproc/fields/fields.yml +++ b/packages/gcp/data_stream/dataproc/fields/fields.yml @@ -4,57 +4,75 @@ fields: - name: batch.spark.executors.count type: long + metric_type: gauge description: Indicates the number of Batch Spark executors. - name: cluster.hdfs.datanodes.count type: long + metric_type: gauge description: Indicates the number of HDFS DataNodes that are running inside a cluster. - name: cluster.hdfs.storage_capacity.value type: double + metric_type: gauge description: Indicates capacity of HDFS system running on cluster in GB. - name: cluster.hdfs.storage_utilization.value type: double + metric_type: gauge description: The percentage of HDFS storage currently used. - name: cluster.hdfs.unhealthy_blocks.count type: long + metric_type: gauge description: Indicates the number of unhealthy blocks inside the cluster. - name: cluster.job.failed.count type: long - description: Indicates the number of jobs that have failed on a cluster. + metric_type: gauge + description: Indicates the delta of the number of jobs that have failed on a cluster. - name: cluster.job.running.count type: long + metric_type: gauge description: Indicates the number of jobs that are running on a cluster. - name: cluster.job.submitted.count type: long - description: Indicates the number of jobs that have been submitted to a cluster. + metric_type: gauge + description: Indicates the delta of the number of jobs that have been submitted to a cluster. - name: cluster.operation.failed.count type: long - description: Indicates the number of operations that have failed on a cluster. + metric_type: gauge + description: Indicates the delta of the number of operations that have failed on a cluster. - name: cluster.operation.running.count type: long + metric_type: gauge description: Indicates the number of operations that are running on a cluster. - name: cluster.operation.submitted.count type: long - description: Indicates the number of operations that have been submitted to a cluster. + metric_type: gauge + description: Indicates the delta of the number of operations that have been submitted to a cluster. - name: cluster.yarn.allocated_memory_percentage.value type: double + metric_type: gauge description: The percentage of YARN memory is allocated. - name: cluster.yarn.apps.count type: long + metric_type: gauge description: Indicates the number of active YARN applications. - name: cluster.yarn.containers.count type: long + metric_type: gauge description: Indicates the number of YARN containers. - name: cluster.yarn.memory_size.value type: double + metric_type: gauge description: Indicates the YARN memory size in GB. - name: cluster.yarn.nodemanagers.count type: long + metric_type: gauge description: Indicates the number of YARN NodeManagers running inside cluster. - name: cluster.yarn.pending_memory_size.value type: double + metric_type: gauge description: The current memory request, in GB, that is pending to be fulfilled by the scheduler. - name: cluster.yarn.virtual_cores.count type: long + metric_type: gauge description: Indicates the number of virtual cores in YARN. - name: cluster.job.completion_time.value type: object diff --git a/packages/gcp/data_stream/firestore/fields/fields.yml b/packages/gcp/data_stream/firestore/fields/fields.yml index e470f84b87a..8de175c7709 100644 --- a/packages/gcp/data_stream/firestore/fields/fields.yml +++ b/packages/gcp/data_stream/firestore/fields/fields.yml @@ -4,10 +4,13 @@ fields: - name: document.delete.count type: long - description: The number of successful document deletes. + metric_type: gauge + description: Delta of the number of successful document deletes. - name: document.read.count type: long - description: The number of successful document reads from queries or lookups. + metric_type: gauge + description: Delta of the number of successful document reads from queries or lookups. - name: document.write.count type: long - description: The number of successful document writes. + metric_type: gauge + description: Delta of the number of successful document writes. diff --git a/packages/gcp/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json b/packages/gcp/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json index 8cfc80dd9c0..26e4c8089fa 100644 --- a/packages/gcp/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/gcp/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json @@ -21,11 +21,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1dobeotg13df9f5", "kind": "event", "original": "{\"insertId\":\"1dobeotg13df9f5\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.128.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"10.142.0.10\",\"src_port\":57794},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"local-test\",\"region\":\"us-central1\",\"vm_name\":\"local-adrian-test\",\"zone\":\"us-central1-a\"},\"remote_instance\":{\"project_id\":\"remote-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_vpc\":{\"project_id\":\"remote-beats\",\"subnetwork_name\":\"mysubnet\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"mysubnet\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-06T16:41:45.009675991Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"12345667\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-06T16:41:38.394575419Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -126,11 +131,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1dobeotg13df9f7", "kind": "event", "original": "{\"insertId\":\"1dobeotg13df9f7\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.128.0.10\",\"dest_port\":57794,\"protocol\":6,\"src_ip\":\"10.142.0.16\",\"src_port\":80},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"local-test\",\"region\":\"us-central1\",\"vm_name\":\"local-adrian-test\",\"zone\":\"us-central1-a\"},\"remote_instance\":{\"project_id\":\"remote-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_vpc\":{\"project_id\":\"remote-beats\",\"subnetwork_name\":\"mysubnet\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"EGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"mysubnet\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-06T16:41:45.009675991Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"892378332\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-06T16:41:38.394575419Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -242,11 +252,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "4zuj4nfn4llkb", "kind": "event", "original": "{\"insertId\":\"4zuj4nfn4llkb\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":53,\"protocol\":17,\"src_ip\":\"10.128.0.16\",\"src_port\":60094},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"rule_details\":{\"action\":\"DENY\",\"destination_range\":[\"8.8.8.0/24\"],\"direction\":\"EGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"ALL\"}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-1\",\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-12T12:35:24.466374097Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-12T12:35:17.214711274Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "firewall": { @@ -331,11 +346,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1f21ciqfpfssuo", "kind": "event", "original": "{\"insertId\":\"1f21ciqfpfssuo\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.2\",\"dest_port\":3389,\"protocol\":6,\"src_ip\":\"192.168.2.126\",\"src_port\":64853},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-windows\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"continent\":\"Asia\",\"country\":\"omn\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"3389\"]}],\"priority\":1000,\"reference\":\"network:windows-isolated/firewall:windows-isolated-allow-rdp\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow-rdp\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"windows-isolated\",\"vpc_name\":\"windows-isolated\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-10-30T13:52:54.473174731Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"3238409883146034900\",\"subnetwork_name\":\"windows-isolated\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-10-30T13:52:42.191988835Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -426,11 +446,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "8vcfeailjd", "kind": "event", "original": "{\"insertId\":\"8vcfeailjd\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":8080,\"protocol\":6,\"src_ip\":\"192.168.2.219\",\"src_port\":2897},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Krasnodar\",\"continent\":\"Europe\",\"country\":\"rus\",\"region\":\"Krasnodar Krai\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:31:22.738796433Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:31:19.421478847Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -524,11 +549,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1bqgmw9feiabij", "kind": "event", "original": "{\"insertId\":\"1bqgmw9feiabij\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.14\",\"src_port\":61000},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"continent\":\"Europe\",\"country\":\"deu\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:41:35.727004321Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:41:31.079508196Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -620,11 +650,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1jrxaqbfe48bir", "kind": "event", "original": "{\"insertId\":\"1jrxaqbfe48bir\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.14\",\"src_port\":61000},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"continent\":\"Europe\",\"country\":\"deu\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:41:40.791816098Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:41:34.190831607Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -716,11 +751,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1fw7drlfe2ty27", "kind": "event", "original": "{\"insertId\":\"1fw7drlfe2ty27\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":8080,\"protocol\":6,\"src_ip\":\"192.168.2.151\",\"src_port\":62551},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Berdychiv\",\"continent\":\"Europe\",\"country\":\"ukr\",\"region\":\"Zhytomyr Oblast\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:48:47.038820509Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:48:41.449552758Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -814,11 +854,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1yre751fekaxzs", "kind": "event", "original": "{\"insertId\":\"1yre751fekaxzs\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":8080,\"protocol\":6,\"src_ip\":\"192.168.2.241\",\"src_port\":44542},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Vicenza\",\"continent\":\"Europe\",\"country\":\"ita\",\"region\":\"Veneto\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T13:10:30.804549999Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T13:10:24.214995318Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -912,11 +957,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "5kanfzfiqepkh", "kind": "event", "original": "{\"insertId\":\"5kanfzfiqepkh\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.114\",\"src_port\":41293},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Tula\",\"continent\":\"Europe\",\"country\":\"rus\",\"region\":\"Tula Oblast\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T13:35:28.934918322Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T13:35:23.504719962Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -1010,11 +1060,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "59z0t8fiow9vg", "kind": "event", "original": "{\"insertId\":\"59z0t8fiow9vg\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.251\",\"src_port\":59106},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Stavropol\",\"continent\":\"Europe\",\"country\":\"rus\",\"region\":\"Stavropol Krai\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T13:36:54.238077643Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T13:36:52.135887769Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -1108,11 +1163,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1y7e4yzff816cq", "kind": "event", "original": "{\"insertId\":\"1y7e4yzff816cq\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.189\",\"src_port\":61000},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Violès\",\"continent\":\"Europe\",\"country\":\"fra\",\"region\":\"Provence-Alpes-Côte d'Azur\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T14:06:26.357446279Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T14:06:16.59353182Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -1206,11 +1266,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "lx5jlsfggpr0q", "kind": "event", "original": "{\"insertId\":\"lx5jlsfggpr0q\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"192.168.2.189\",\"src_port\":61000},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"Violès\",\"continent\":\"Europe\",\"country\":\"fra\",\"region\":\"Provence-Alpes-Côte d'Azur\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T14:06:28.203068653Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T14:06:22.930570324Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -1304,11 +1369,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "18ynfbufer19m1", "kind": "event", "original": "{\"insertId\":\"18ynfbufer19m1\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":8080,\"protocol\":6,\"src_ip\":\"192.168.2.200\",\"src_port\":42716},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"city\":\"İzmir\",\"continent\":\"Asia\",\"country\":\"tur\",\"region\":\"İzmir\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T14:32:14.038485761Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T14:32:07.407039908Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { @@ -1413,11 +1483,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "tzddthfsr6fv5", "kind": "event", "original": "{\"insertId\":\"tzddthfsr6fv5\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"10.28.0.16\",\"src_port\":46418},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"rule_details\":{\"action\":\"DENY\",\"destination_range\":[\"8.8.8.0/24\"],\"direction\":\"EGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"ALL\"}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-1\",\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-12T12:41:28.971534988Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-12T12:41:20.972747063Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "firewall": { @@ -1513,11 +1588,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1k2b7kefsnhzq7", "kind": "event", "original": "{\"insertId\":\"1k2b7kefsnhzq7\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":80,\"protocol\":17,\"src_ip\":\"10.28.0.16\",\"src_port\":58725},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"rule_details\":{\"action\":\"DENY\",\"destination_range\":[\"8.8.8.0/24\"],\"direction\":\"EGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"ALL\"}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-1\",\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-12T12:42:33.671883883Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-12T12:42:26.50532921Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "firewall": { @@ -1602,11 +1682,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1sdfuwxfk8hq1c", "kind": "event", "original": "{\"insertId\":\"1sdfuwxfk8hq1c\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.10\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.114\",\"src_port\":44666},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-kibana\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"remote_vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"9200\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:allow9200\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow9200\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:54:15.188832255Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:54:13.531819246Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -1710,11 +1795,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1sdfuwxfk8hq1b", "kind": "event", "original": "{\"insertId\":\"1sdfuwxfk8hq1b\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.10\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.114\",\"src_port\":44668},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-kibana\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"remote_vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"9200\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:allow9200\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow9200\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:54:15.188832255Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:54:13.551617516Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -1818,11 +1908,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "yot1ojetjdiw", "kind": "event", "original": "{\"insertId\":\"yot1ojetjdiw\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.2\",\"dest_port\":3389,\"protocol\":6,\"src_ip\":\"192.168.2.7\",\"src_port\":1683},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-windows\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"city\":\"Almelo\",\"continent\":\"Europe\",\"country\":\"nld\",\"region\":\"Overijssel\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"3389\"]}],\"priority\":1000,\"reference\":\"network:windows-isolated/firewall:windows-isolated-allow-rdp\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow-rdp\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"windows-isolated\",\"vpc_name\":\"windows-isolated\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:54:28.477733837Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"3238409883146034900\",\"subnetwork_name\":\"windows-isolated\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:54:15.771161946Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -1915,11 +2010,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "5a27u1g22jks9e", "kind": "event", "original": "{\"insertId\":\"5a27u1g22jks9e\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.10\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.114\",\"src_port\":45068},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-kibana\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"remote_vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"9200\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:allow9200\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow9200\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:54:45.189726185Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:54:35.850729583Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -2023,11 +2123,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "5a27u1g22jks8t", "kind": "event", "original": "{\"insertId\":\"5a27u1g22jks8t\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.42.0.10\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.114\",\"src_port\":45062},\"disposition\":\"ALLOWED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-kibana\",\"zone\":\"us-east1-b\"},\"remote_location\":{\"continent\":\"America\",\"country\":\"usa\"},\"remote_vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"ALLOW\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"9200\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:allow9200\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"allow9200\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-11T12:54:45.189726185Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-11T12:54:35.85023465Z\"}", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -2131,11 +2236,16 @@ }, "event": { "action": "firewall-rule", - "category": "network", + "category": [ + "network" + ], "id": "1dobeotg13df9f5", "kind": "event", "original": "{\"insertId\":\"1dobeotg13df9f5\",\"jsonPayload\":{\"connection\":{\"dest_ip\":\"10.28.0.16\",\"dest_port\":80,\"protocol\":6,\"src_ip\":\"10.42.0.10\",\"src_port\":57794},\"disposition\":\"DENIED\",\"instance\":{\"project_id\":\"test-beats\",\"region\":\"us-central1\",\"vm_name\":\"adrian-test\",\"zone\":\"us-central1-a\"},\"remote_instance\":{\"project_id\":\"test-beats\",\"region\":\"us-east1\",\"vm_name\":\"test-es\",\"zone\":\"us-east1-b\"},\"remote_vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"rule_details\":{\"action\":\"DENY\",\"direction\":\"INGRESS\",\"ip_port_info\":[{\"ip_protocol\":\"TCP\",\"port_range\":[\"80\",\"8080\"]}],\"priority\":1000,\"reference\":\"network:default/firewall:adrian-test-3\",\"source_range\":[\"0.0.0.0/0\"],\"target_tag\":[\"adrian-test\"]},\"vpc\":{\"project_id\":\"test-beats\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"}},\"logName\":\"projects/test-beats/logs/compute.googleapis.com%2Ffirewall\",\"receiveTimestamp\":\"2019-11-06T16:41:45.009675991Z\",\"resource\":{\"labels\":{\"location\":\"us-central1-a\",\"project_id\":\"test-beats\",\"subnetwork_id\":\"1266623735137648253\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-11-06T16:41:38.394575419Z\"}", - "type": "connection" + "type": [ + "denied", + "connection" + ] }, "gcp": { "destination": { diff --git a/packages/gcp/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml index 0a4547ef836..b1303093790 100644 --- a/packages/gcp/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ b/packages/gcp/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: - set: field: event.kind value: event - - set: + - append: field: event.category value: network - set: @@ -48,16 +48,16 @@ processors: copy_from: json.insertId ignore_empty_value: true ignore_failure: true - - rename: + - lowercase: field: json.jsonPayload.disposition - target_field: event.type if: ctx?.json?.jsonPayload?.disposition != null - - set: + - append: field: event.type - value: connection - if: ctx?.event?.type != null - - lowercase: + value: '{{json.jsonPayload.disposition}}' + if: ctx?.json?.jsonPayload?.disposition != null + - append: field: event.type + value: connection - set: field: network.direction value: inbound diff --git a/packages/gcp/data_stream/firewall/fields/fields.yml b/packages/gcp/data_stream/firewall/fields/fields.yml index 98681562b2e..64d8ca21a8e 100644 --- a/packages/gcp/data_stream/firewall/fields/fields.yml +++ b/packages/gcp/data_stream/firewall/fields/fields.yml @@ -31,7 +31,7 @@ description: | List of all the target tags that the firewall rule applies to. - name: ip_port_info - type: array + type: nested description: | List of ip protocols and applicable port ranges for rules. - name: source_service_account diff --git a/packages/gcp/data_stream/firewall/sample_event.json b/packages/gcp/data_stream/firewall/sample_event.json index 624bc0035d5..1358f50c6df 100644 --- a/packages/gcp/data_stream/firewall/sample_event.json +++ b/packages/gcp/data_stream/firewall/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-10-30T13:52:42.191Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "cf009128-e43c-42e4-9158-9b088bd6f3f5", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { "availability_zone": "us-east1-b", @@ -30,20 +30,25 @@ "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "firewall-rule", "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:01:23.807Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:55:10.718Z", "dataset": "gcp.firewall", "id": "1f21ciqfpfssuo", - "ingested": "2023-01-13T15:01:24Z", + "ingested": "2023-07-19T18:55:14Z", "kind": "event", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { diff --git a/packages/gcp/data_stream/gke/fields/fields.yml b/packages/gcp/data_stream/gke/fields/fields.yml index ccef93d523b..2732122e916 100644 --- a/packages/gcp/data_stream/gke/fields/fields.yml +++ b/packages/gcp/data_stream/gke/fields/fields.yml @@ -4,121 +4,161 @@ fields: - name: container.cpu.core_usage_time.sec type: double + metric_type: counter description: Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds. - name: container.cpu.limit_cores.value type: double + metric_type: gauge description: CPU cores limit of the container. Sampled every 60 seconds. - name: container.cpu.limit_utilization.pct type: double + metric_type: gauge description: The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. - name: container.cpu.request_cores.value type: double + metric_type: gauge description: Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: container.cpu.request_utilization.pct type: double + metric_type: gauge description: The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. - name: container.ephemeral_storage.limit.bytes type: long + metric_type: gauge description: Local ephemeral storage limit in bytes. Sampled every 60 seconds. - name: container.ephemeral_storage.request.bytes type: long + metric_type: gauge description: Local ephemeral storage request in bytes. Sampled every 60 seconds. - name: container.ephemeral_storage.used.bytes type: long + metric_type: gauge description: Local ephemeral storage usage in bytes. Sampled every 60 seconds. - name: container.memory.limit.bytes type: long + metric_type: gauge description: Memory limit of the container in bytes. Sampled every 60 seconds. - name: container.memory.limit_utilization.pct type: double + metric_type: gauge description: The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: container.memory.page_fault.count type: long + metric_type: counter description: Number of page faults, broken down by type, major and minor. - name: container.memory.request.bytes type: long + metric_type: gauge description: Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: container.memory.request_utilization.pct type: double + metric_type: gauge description: The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. - name: container.memory.used.bytes type: long + metric_type: gauge description: Memory usage in bytes. Sampled every 60 seconds. - name: container.restart.count type: long + metric_type: counter description: Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: container.uptime.sec type: double + metric_type: gauge description: Time in seconds that the container has been running. Sampled every 60 seconds. - name: node.cpu.allocatable_cores.value type: double + metric_type: gauge description: Number of allocatable CPU cores on the node. Sampled every 60 seconds. - name: node.cpu.allocatable_utilization.pct type: double + metric_type: gauge description: The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. - name: node.cpu.core_usage_time.sec type: double + metric_type: counter description: Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds. - name: node.cpu.total_cores.value type: double + metric_type: gauge description: Total number of CPU cores on the node. Sampled every 60 seconds. - name: node.ephemeral_storage.allocatable.bytes type: long + metric_type: gauge description: Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds. - name: node.ephemeral_storage.inodes_free.value type: long + metric_type: gauge description: Free number of inodes on local ephemeral storage. Sampled every 60 seconds. - name: node.ephemeral_storage.inodes_total.value type: long + metric_type: gauge description: Total number of inodes on local ephemeral storage. Sampled every 60 seconds. - name: node.ephemeral_storage.total.bytes type: long + metric_type: gauge description: Total ephemeral storage bytes on the node. Sampled every 60 seconds. - name: node.ephemeral_storage.used.bytes type: long + metric_type: gauge description: Local ephemeral storage bytes used by the node. Sampled every 60 seconds. - name: node.memory.allocatable.bytes type: long + metric_type: gauge description: Cumulative memory bytes used by the node. Sampled every 60 seconds. - name: node.memory.allocatable_utilization.pct type: double + metric_type: gauge description: The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: node.memory.total.bytes type: long + metric_type: gauge description: Number of bytes of memory allocatable on the node. Sampled every 60 seconds. - name: node.memory.used.bytes type: long + metric_type: gauge description: Cumulative memory bytes used by the node. Sampled every 60 seconds. - name: node.network.received_bytes.count type: long + metric_type: counter description: Cumulative number of bytes received by the node over the network. Sampled every 60 seconds. - name: node.network.sent_bytes.count type: long + metric_type: counter description: Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds. - name: node.pid_limit.value type: long + metric_type: gauge description: The max PID of OS on the node. Sampled every 60 seconds. - name: node.pid_used.value type: long + metric_type: gauge description: The number of running process in the OS on the node. Sampled every 60 seconds. - name: node_daemon.cpu.core_usage_time.sec type: double + metric_type: counter description: Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds. - name: node_daemon.memory.used.bytes type: long + metric_type: gauge description: Memory usage by the system daemon in bytes. Sampled every 60 seconds. - name: pod.network.received.bytes type: long + metric_type: counter description: Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds. - name: pod.network.sent.bytes type: long + metric_type: counter description: Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds. - name: pod.volume.total.bytes type: long + metric_type: gauge description: Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. - name: pod.volume.used.bytes type: long + metric_type: gauge description: Number of disk bytes used by the pod. Sampled every 60 seconds. - name: pod.volume.utilization.pct type: double + metric_type: gauge description: The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. diff --git a/packages/gcp/data_stream/loadbalancing_metrics/fields/fields.yml b/packages/gcp/data_stream/loadbalancing_metrics/fields/fields.yml index 2e8929f684d..a0adde53597 100644 --- a/packages/gcp/data_stream/loadbalancing_metrics/fields/fields.yml +++ b/packages/gcp/data_stream/loadbalancing_metrics/fields/fields.yml @@ -1,63 +1,82 @@ -- name: gcp.loadbalancing +- name: gcp.loadbalancing_metrics description: Google Cloud Load Balancing metrics type: group fields: - name: https.backend_request.bytes type: long - description: The number of bytes sent as requests from HTTP/S load balancer to backends. + metric_type: gauge + description: Delta of the number of bytes sent as requests from HTTP/S load balancer to backends. - name: https.backend_request.count type: long - description: The number of requests served by backends of HTTP/S load balancer. + metric_type: gauge + description: Delta of the number of requests served by backends of HTTP/S load balancer. - name: https.backend_response.bytes type: long - description: The number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. + metric_type: gauge + description: Delta of the number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. - name: https.request.bytes type: long - description: The number of bytes sent as requests from clients to HTTP/S load balancer. + metric_type: gauge + description: Delta of the number of bytes sent as requests from clients to HTTP/S load balancer. - name: https.request.count type: long - description: The number of requests served by HTTP/S load balancer. + metric_type: gauge + description: Delta of the number of requests served by HTTP/S load balancer. - name: https.response.bytes type: long - description: The number of bytes sent as responses from HTTP/S load balancer to clients. + metric_type: gauge + description: Delta of the number of bytes sent as responses from HTTP/S load balancer to clients. - name: l3.external.egress.bytes type: long - description: The number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. + metric_type: gauge + description: Delta of the number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. - name: l3.external.egress_packets.count type: long - description: The number of packets sent from external TCP/UDP network load balancer backend to client of the flow. + metric_type: gauge + description: Delta of the number of packets sent from external TCP/UDP network load balancer backend to client of the flow. - name: l3.external.ingress.bytes type: long - description: The number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. + metric_type: gauge + description: Delta of the number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. - name: l3.external.ingress_packets.count type: long - description: The number of packets sent from client to external TCP/UDP network load balancer backend. + metric_type: gauge + description: Delta of the number of packets sent from client to external TCP/UDP network load balancer backend. - name: l3.internal.egress.bytes type: long - description: The number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). + metric_type: gauge + description: Delta of the number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). - name: l3.internal.egress_packets.count type: long - description: The number of packets sent from ILB backend to client of the flow. + metric_type: gauge + description: Delta of the number of packets sent from ILB backend to client of the flow. - name: l3.internal.ingress.bytes type: long - description: The number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). + metric_type: gauge + description: Delta of the number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). - name: l3.internal.ingress_packets.count type: long - description: The number of packets sent from client to ILB backend. + metric_type: gauge + description: Delta of the number of packets sent from client to ILB backend. - name: tcp_ssl_proxy.closed_connections.value type: long - description: Number of connections that were terminated over TCP/SSL proxy. + metric_type: gauge + description: Delta of the number of connections that were terminated over TCP/SSL proxy. - name: tcp_ssl_proxy.egress.bytes type: long - description: Number of bytes sent from VM to client using proxy. + metric_type: gauge + description: Delta of the number of bytes sent from VM to client using proxy. - name: tcp_ssl_proxy.ingress.bytes type: long - description: Number of bytes sent from client to VM using proxy. + metric_type: gauge + description: Delta of the number of bytes sent from client to VM using proxy. - name: tcp_ssl_proxy.new_connections.value type: long - description: Number of connections that were created over TCP/SSL proxy. + metric_type: gauge + description: Delta of the number of connections that were created over TCP/SSL proxy. - name: tcp_ssl_proxy.open_connections.value type: long + metric_type: gauge description: Current number of outstanding connections through the TCP/SSL proxy. - name: https.backend_latencies.value type: object diff --git a/packages/gcp/data_stream/loadbalancing_metrics/sample_event.json b/packages/gcp/data_stream/loadbalancing_metrics/sample_event.json index a0e5d35b492..fa163f981b5 100644 --- a/packages/gcp/data_stream/loadbalancing_metrics/sample_event.json +++ b/packages/gcp/data_stream/loadbalancing_metrics/sample_event.json @@ -34,7 +34,7 @@ "region": "us-central1" } }, - "loadbalancing": { + "loadbalancing_metrics": { "l3": { "internal": { "egress_packets": { diff --git a/packages/gcp/data_stream/pubsub/fields/fields.yml b/packages/gcp/data_stream/pubsub/fields/fields.yml index 18b09ae2c1b..8421083f8bc 100644 --- a/packages/gcp/data_stream/pubsub/fields/fields.yml +++ b/packages/gcp/data_stream/pubsub/fields/fields.yml @@ -4,145 +4,191 @@ fields: - name: snapshot.backlog.bytes type: long + metric_type: gauge description: Total byte size of the messages retained in a snapshot. - name: snapshot.backlog_bytes_by_region.bytes type: long + metric_type: gauge description: Total byte size of the messages retained in a snapshot, broken down by Cloud region. - name: snapshot.config_updates.count type: long - description: Cumulative count of configuration changes, grouped by operation type and result. + metric_type: gauge + description: Delta of the cumulative count of configuration changes, grouped by operation type and result. - name: snapshot.num_messages.value type: long + metric_type: gauge description: Number of messages retained in a snapshot. - name: snapshot.num_messages_by_region.value type: long + metric_type: gauge description: Number of messages retained in a snapshot, broken down by Cloud region. - name: snapshot.oldest_message_age.sec type: long + metric_type: gauge description: Age (in seconds) of the oldest message retained in a snapshot. - name: snapshot.oldest_message_age_by_region.sec type: long + metric_type: gauge description: Age (in seconds) of the oldest message retained in a snapshot, broken down by Cloud region. - name: subscription.ack_message.count type: long - description: Cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type. + metric_type: gauge + description: Delta of the cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type. - name: subscription.backlog.bytes type: long + metric_type: gauge description: Total byte size of the unacknowledged messages (a.k.a. backlog messages) in a subscription. - name: subscription.byte_cost.bytes type: long - description: Cumulative cost of operations, measured in bytes. This is used to measure quota utilization. + metric_type: gauge + description: Delta of the cumulative cost of operations, measured in bytes. This is used to measure quota utilization. - name: subscription.config_updates.count type: long - description: Cumulative count of configuration changes for each subscription, grouped by operation type and result. + metric_type: gauge + description: Delta of the cumulative count of configuration changes for each subscription, grouped by operation type and result. - name: subscription.dead_letter_message.count type: long - description: Cumulative count of messages published to dead letter topic, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of messages published to dead letter topic, grouped by result. - name: subscription.mod_ack_deadline_message.count type: long - description: Cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type. + metric_type: gauge + description: Delta of the cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type. - name: subscription.mod_ack_deadline_message_operation.count type: long - description: Cumulative count of ModifyAckDeadline message operations, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of ModifyAckDeadline message operations, grouped by result. - name: subscription.mod_ack_deadline_request.count type: long - description: Cumulative count of ModifyAckDeadline requests, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of ModifyAckDeadline requests, grouped by result. - name: subscription.num_outstanding_messages.value type: long + metric_type: gauge description: Number of messages delivered to a subscription's push endpoint, but not yet acknowledged. - name: subscription.num_undelivered_messages.value type: long + metric_type: gauge description: Number of unacknowledged messages (a.k.a. backlog messages) in a subscription. - name: subscription.oldest_retained_acked_message_age.sec type: long + metric_type: gauge description: Age (in seconds) of the oldest acknowledged message retained in a subscription. - name: subscription.oldest_retained_acked_message_age_by_region.value type: long + metric_type: gauge description: Age (in seconds) of the oldest acknowledged message retained in a subscription, broken down by Cloud region. - name: subscription.oldest_unacked_message_age.sec type: long + metric_type: gauge description: Age (in seconds) of the oldest unacknowledged message (a.k.a. backlog message) in a subscription. - name: subscription.oldest_unacked_message_age_by_region.value type: long + metric_type: gauge description: Age (in seconds) of the oldest unacknowledged message in a subscription, broken down by Cloud region. - name: subscription.pull_ack_message_operation.count type: long - description: Cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. + metric_type: gauge + description: Delta of the cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. - name: subscription.pull_ack_request.count type: long - description: Cumulative count of acknowledge requests, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of acknowledge requests, grouped by result. - name: subscription.pull_message_operation.count type: long - description: Cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. + metric_type: gauge + description: Delta of the cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. - name: subscription.pull_request.count type: long - description: Cumulative count of pull requests, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of pull requests, grouped by result. - name: subscription.push_request.count type: long - description: Cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times. + metric_type: gauge + description: Delta of the cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times. - name: subscription.retained_acked.bytes type: long + metric_type: gauge description: Total byte size of the acknowledged messages retained in a subscription. - name: subscription.retained_acked_bytes_by_region.bytes type: long + metric_type: gauge description: Total byte size of the acknowledged messages retained in a subscription, broken down by Cloud region. - name: subscription.seek_request.count type: long - description: Cumulative count of seek attempts, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of seek attempts, grouped by result. - name: subscription.sent_message.count type: long - description: Cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type. + metric_type: gauge + description: Delta of the cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type. - name: subscription.streaming_pull_ack_message_operation.count type: long - description: Cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. + metric_type: gauge + description: Delta of the cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. - name: subscription.streaming_pull_ack_request.count type: long - description: Cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result. - name: subscription.streaming_pull_message_operation.count type: long - description: Cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count + metric_type: gauge + description: Delta of the cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count - name: subscription.streaming_pull_mod_ack_deadline_message_operation.count type: long - description: Cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result. - name: subscription.streaming_pull_mod_ack_deadline_request.count type: long - description: Cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result. - name: subscription.streaming_pull_response.count type: long - description: Cumulative count of streaming pull responses, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of streaming pull responses, grouped by result. - name: subscription.unacked_bytes_by_region.bytes type: long + metric_type: gauge description: Total byte size of the unacknowledged messages in a subscription, broken down by Cloud region. - name: topic.byte_cost.bytes type: long - description: Cost of operations, measured in bytes. This is used to measure utilization for quotas. + metric_type: gauge + description: Delta of the cost of operations, measured in bytes. This is used to measure utilization for quotas. - name: topic.config_updates.count type: long - description: Cumulative count of configuration changes, grouped by operation type and result. + metric_type: gauge + description: Delta of the cumulative count of configuration changes, grouped by operation type and result. - name: topic.message_sizes.bytes type: object object_type: histogram description: Distribution of publish message sizes (in bytes) - name: topic.oldest_retained_acked_message_age_by_region.value type: long + metric_type: gauge description: Age (in seconds) of the oldest acknowledged message retained in a topic, broken down by Cloud region. - name: topic.oldest_unacked_message_age_by_region.value type: long + metric_type: gauge description: Age (in seconds) of the oldest unacknowledged message in a topic, broken down by Cloud region. - name: topic.retained_acked_bytes_by_region.bytes type: long + metric_type: gauge description: Total byte size of the acknowledged messages retained in a topic, broken down by Cloud region. - name: topic.send_message_operation.count type: long - description: Cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. + metric_type: gauge + description: Delta of the cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. - name: topic.send_request.count type: long - description: Cumulative count of publish requests, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of publish requests, grouped by result. - name: topic.streaming_pull_response.count type: long - description: Cumulative count of streaming pull responses, grouped by result. + metric_type: gauge + description: Delta of the cumulative count of streaming pull responses, grouped by result. - name: topic.unacked_bytes_by_region.bytes type: long + metric_type: gauge description: Total byte size of the unacknowledged messages in a topic, broken down by Cloud region. - name: subscription.ack_latencies.value type: object diff --git a/packages/gcp/data_stream/redis/fields/fields.yml b/packages/gcp/data_stream/redis/fields/fields.yml index 42c190c92ee..cc2f6206fac 100644 --- a/packages/gcp/data_stream/redis/fields/fields.yml +++ b/packages/gcp/data_stream/redis/fields/fields.yml @@ -12,13 +12,13 @@ description: Number of client connections. - name: commands.calls.count type: long - metric_type: counter - description: Total number of calls for this command in one minute. + metric_type: gauge + description: Delta of the number of calls for this command in one minute. - name: commands.total_time.us type: long unit: micros - metric_type: counter - description: The amount of time in microseconds that this command took in the last second. + metric_type: gauge + description: Delta of the amount of time in microseconds that this command took in the last second. - name: commands.usec_per_call.sec type: double unit: s @@ -38,7 +38,8 @@ metric_type: gauge description: Number of keys with an expiration in this database. - name: persistence.rdb.bgsave_in_progress - type: boolean + type: long + metric_type: gauge description: Flag indicating a RDB save is on-going. - name: replication.master.slaves.lag.sec type: long @@ -75,8 +76,8 @@ description: Cache Hit ratio as a fraction. - name: stats.connections.total.count type: long - metric_type: counter - description: Total number of connections accepted by the server. + metric_type: gauge + description: Delta of the total number of connections accepted by the server. - name: stats.cpu_utilization.sec type: double unit: s @@ -84,20 +85,20 @@ description: CPU-seconds consumed by the Redis server, broken down by system/user space and parent/child relationship. - name: stats.evicted_keys.count type: long - metric_type: counter - description: Number of evicted keys due to maxmemory limit. + metric_type: gauge + description: Delta of the number of evicted keys due to maxmemory limit. - name: stats.expired_keys.count type: long - metric_type: counter - description: Total number of key expiration events. + metric_type: gauge + description: Delta of the total number of key expiration events. - name: stats.keyspace_hits.count type: long - metric_type: counter - description: Number of successful lookup of keys in the main dictionary. + metric_type: gauge + description: Delta of the number of successful lookup of keys in the main dictionary. - name: stats.keyspace_misses.count type: long - metric_type: counter - description: Number of failed lookup of keys in the main dictionary. + metric_type: gauge + description: Delta of the number of failed lookup of keys in the main dictionary. - name: stats.memory.maxmemory.mb type: long unit: m @@ -124,8 +125,8 @@ - name: stats.network_traffic.bytes type: long unit: byte - metric_type: counter - description: Total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). + metric_type: gauge + description: Delta of the total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). - name: stats.pubsub.channels.count type: long metric_type: gauge diff --git a/packages/gcp/data_stream/storage/fields/fields.yml b/packages/gcp/data_stream/storage/fields/fields.yml index 5e8d4e279be..589ed7b5844 100644 --- a/packages/gcp/data_stream/storage/fields/fields.yml +++ b/packages/gcp/data_stream/storage/fields/fields.yml @@ -4,28 +4,37 @@ fields: - name: api.request.count type: long + metric_type: gauge description: Delta count of API calls, grouped by the API method name and response code. - name: authz.acl_based_object_access.count type: long + metric_type: gauge description: Delta count of requests that result in an object being granted access solely due to object ACLs. - name: authz.acl_operations.count type: long + metric_type: gauge description: Usage of ACL operations broken down by type. - name: authz.object_specific_acl_mutation.count type: long + metric_type: gauge description: Delta count of changes made to object specific ACLs. - name: network.received.bytes type: long + metric_type: gauge description: Delta count of bytes received over the network, grouped by the API method name and response code. - name: network.sent.bytes type: long + metric_type: gauge description: Delta count of bytes sent over the network, grouped by the API method name and response code. - name: storage.object.count type: long + metric_type: gauge description: Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. - name: storage.total_byte_seconds.bytes type: long + metric_type: gauge description: Delta count of bytes received over the network, grouped by the API method name and response code. - name: storage.total.bytes type: long + metric_type: gauge description: Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. diff --git a/packages/gcp/data_stream/vpcflow/_dev/test/pipeline/test-vpcflow.log-expected.json b/packages/gcp/data_stream/vpcflow/_dev/test/pipeline/test-vpcflow.log-expected.json index 59f3c2c0365..1da94295410 100644 --- a/packages/gcp/data_stream/vpcflow/_dev/test/pipeline/test-vpcflow.log-expected.json +++ b/packages/gcp/data_stream/vpcflow/_dev/test/pipeline/test-vpcflow.log-expected.json @@ -26,13 +26,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:37.301953198Z", "id": "ut8lbrffooxyw", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyw\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33478,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:45:37.301953198Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:45:37.186193305Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -104,13 +108,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "ut8lbrffooxzb", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxzb\",\"jsonPayload\":{\"bytes_sent\":\"173663\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33970,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"68\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466657665Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.466657665Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -219,13 +227,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821143836Z", "id": "ut8lbrffooxze", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxze\",\"jsonPayload\":{\"bytes_sent\":\"155707\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33576,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821143836Z\",\"packets_sent\":\"78\",\"reporter\":\"SRC\",\"rtt_msec\":\"201\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510622432Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:20.510622432Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -313,13 +325,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:46.031032701Z", "id": "ut8lbrffooxyz", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyz\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"192.168.2.23\",\"dest_port\":59679,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":22},\"dest_location\":{\"asn\":49505,\"city\":\"Saint Petersburg\",\"continent\":\"Europe\",\"country\":\"rus\",\"region\":\"Saint Petersburg\"},\"end_time\":\"2019-06-14T03:40:46.031032701Z\",\"packets_sent\":\"1\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:45.860349247Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:45.860349247Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -389,13 +405,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:37.048196137Z", "id": "ut8lbrffooxz6", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz6\",\"jsonPayload\":{\"bytes_sent\":\"1784\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":50646,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:40:37.048196137Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:36.895188084Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:36.895188084Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -462,13 +482,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:37.048196137Z", "id": "ut8lbrffooxzf", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxzf\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":50646},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:37.048196137Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:40:36.895188084Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:36.895188084Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -546,13 +570,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "ut8lbrffooxz1", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz1\",\"jsonPayload\":{\"bytes_sent\":\"186151\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33692,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"251\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -661,13 +689,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821308944Z", "id": "ut8lbrffooxyp", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyp\",\"jsonPayload\":{\"bytes_sent\":\"15169\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33880},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821308944Z\",\"packets_sent\":\"92\",\"reporter\":\"SRC\",\"rtt_msec\":\"3\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.469099728Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.469099728Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -752,13 +784,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "ut8lbrffooxzd", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxzd\",\"jsonPayload\":{\"bytes_sent\":\"250864\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33554,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"247\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500506974Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:39:59.500506974Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -855,13 +891,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821308944Z", "id": "ut8lbrffooxz8", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz8\",\"jsonPayload\":{\"bytes_sent\":\"167939\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33880,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821308944Z\",\"packets_sent\":\"63\",\"reporter\":\"DEST\",\"rtt_msec\":\"3\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.469099728Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.469099728Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -953,13 +993,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:46.031032701Z", "id": "ut8lbrffooxyt", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyt\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"192.168.2.23\",\"src_port\":59679},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:46.031032701Z\",\"packets_sent\":\"3\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":49505,\"city\":\"Saint Petersburg\",\"continent\":\"Europe\",\"country\":\"rus\",\"region\":\"Saint Petersburg\"},\"start_time\":\"2019-06-14T03:40:45.860349247Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:45.860349247Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1036,13 +1080,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821056075Z", "id": "ut8lbrffooxz5", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz5\",\"jsonPayload\":{\"bytes_sent\":\"11773\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33576},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821056075Z\",\"packets_sent\":\"94\",\"reporter\":\"DEST\",\"rtt_msec\":\"201\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510622432Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:20.510622432Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1139,13 +1187,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.393910944Z", "id": "ut8lbrffooxza", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxza\",\"jsonPayload\":{\"bytes_sent\":\"65699\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33562},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.393910944Z\",\"packets_sent\":\"356\",\"reporter\":\"DEST\",\"rtt_msec\":\"192\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074897435Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:01.074897435Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1254,13 +1306,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "ut8lbrffooxyq", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyq\",\"jsonPayload\":{\"bytes_sent\":\"66029\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33692},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"361\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1357,13 +1413,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565272745Z", "id": "ut8lbrffooxz2", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz2\",\"jsonPayload\":{\"bytes_sent\":\"65154\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33542},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565272745Z\",\"packets_sent\":\"360\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150720950Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.150720950Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1460,13 +1520,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "ut8lbrffooxyo", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyo\",\"jsonPayload\":{\"bytes_sent\":\"13643\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33970},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"99\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466657665Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.466657665Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1546,13 +1610,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:29.432367659Z", "id": "ut8lbrffooxzc", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxzc\",\"jsonPayload\":{\"bytes_sent\":\"34509840\",\"connection\":{\"dest_ip\":\"10.49.136.133\",\"dest_port\":46864,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":9243},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"simianhacker-demo\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:29.432367659Z\",\"packets_sent\":\"8690\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"start_time\":\"2019-06-14T03:40:17.343890802Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:17.343890802Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1630,13 +1698,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:39.076420731Z", "id": "ut8lbrffooxz7", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz7\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":34836},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:48:39.076420731Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:48:38.961050187Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:48:38.961050187Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1731,13 +1803,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "ut8lbrffooxyu", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyu\",\"jsonPayload\":{\"bytes_sent\":\"63671\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33554},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"367\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500506974Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:39:59.500506974Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -1828,13 +1904,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220714119Z", "id": "ut8lbrffooxyv", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyv\",\"jsonPayload\":{\"bytes_sent\":\"51075\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65320,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220714119Z\",\"packets_sent\":\"608\",\"reporter\":\"SRC\",\"rtt_msec\":\"220\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.560917237Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:00.560917237Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -1918,13 +1998,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.393910944Z", "id": "ut8lbrffooxz0", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz0\",\"jsonPayload\":{\"bytes_sent\":\"197840\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33562,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.393910944Z\",\"packets_sent\":\"258\",\"reporter\":\"SRC\",\"rtt_msec\":\"192\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074897435Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:01.074897435Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2015,13 +2099,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:58.716492806Z", "id": "ut8lbrffooxys", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxys\",\"jsonPayload\":{\"bytes_sent\":\"173805495\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":9243,\"protocol\":6,\"src_ip\":\"10.49.136.133\",\"src_port\":46864},\"end_time\":\"2019-06-14T03:49:58.716492806Z\",\"packets_sent\":\"44438\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"simianhacker-demo\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:17.306085222Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:17.306085222Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -2088,13 +2176,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:37.301953198Z", "id": "ut8lbrffooxyx", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyx\",\"jsonPayload\":{\"bytes_sent\":\"1468\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33478},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:45:37.301953198Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:45:37.186193305Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:45:37.186193305Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2189,13 +2281,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.393651211Z", "id": "ut8lbrffooxz4", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz4\",\"jsonPayload\":{\"bytes_sent\":\"159704\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33548,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.393651211Z\",\"packets_sent\":\"241\",\"reporter\":\"SRC\",\"rtt_msec\":\"50\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147252064Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:05.147252064Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2275,13 +2371,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220714119Z", "id": "ut8lbrffooxz3", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz3\",\"jsonPayload\":{\"bytes_sent\":\"70775\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65320},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220714119Z\",\"packets_sent\":\"732\",\"reporter\":\"DEST\",\"rtt_msec\":\"220\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.560917237Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:00.560917237Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2364,13 +2464,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565272745Z", "id": "ut8lbrffooxz9", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxz9\",\"jsonPayload\":{\"bytes_sent\":\"281147\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33542,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565272745Z\",\"packets_sent\":\"246\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150720950Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:08.150720950Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2467,13 +2571,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:48.537763242Z", "id": "ut8lbrffooxyr", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyr\",\"jsonPayload\":{\"bytes_sent\":\"63590\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33548},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:48.537763242Z\",\"packets_sent\":\"340\",\"reporter\":\"DEST\",\"rtt_msec\":\"50\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147252064Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:40:05.147252064Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2576,13 +2684,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:39.076420731Z", "id": "ut8lbrffooxyy", "kind": "event", "original": "{\"insertId\":\"ut8lbrffooxyy\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":34836,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:48:39.076420731Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:48:38.961050187Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:10.845445834Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:10.845445834Z\"}", "start": "2019-06-14T03:48:38.961050187Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -2649,13 +2761,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:52.361155668Z", "id": "1ulp77rfdvho4g", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4g\",\"jsonPayload\":{\"bytes_sent\":\"1239\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"192.168.2.165\",\"src_port\":59623},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:52.361155668Z\",\"packets_sent\":\"18\",\"reporter\":\"DEST\",\"rtt_msec\":\"233\",\"src_location\":{\"asn\":45899,\"city\":\"Vĩnh Yên\",\"continent\":\"Asia\",\"country\":\"vnm\",\"region\":\"Vinh Phuc Province\"},\"start_time\":\"2019-06-14T03:40:46.541094678Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:46.541094678Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2747,13 +2863,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.213244028Z", "id": "1ulp77rfdvho5r", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5r\",\"jsonPayload\":{\"bytes_sent\":\"63853\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33552},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.213244028Z\",\"packets_sent\":\"363\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075811571Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:06.075811571Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2833,13 +2953,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:20.745658276Z", "id": "1ulp77rfdvho5k", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5k\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":33924},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:46:20.745658276Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:46:20.634435179Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:46:20.634435179Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -2934,13 +3058,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597088427Z", "id": "1ulp77rfdvho55", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho55\",\"jsonPayload\":{\"bytes_sent\":\"252397\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33534,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597088427Z\",\"packets_sent\":\"260\",\"reporter\":\"SRC\",\"rtt_msec\":\"311\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075942176Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:06.075942176Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3037,13 +3165,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565117754Z", "id": "1ulp77rfdvho60", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho60\",\"jsonPayload\":{\"bytes_sent\":\"205787\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33694,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565117754Z\",\"packets_sent\":\"265\",\"reporter\":\"SRC\",\"rtt_msec\":\"216\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.566551903Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:05.566551903Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3134,13 +3266,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220748025Z", "id": "1ulp77rfdvho49", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho49\",\"jsonPayload\":{\"bytes_sent\":\"106409\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65263,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220748025Z\",\"packets_sent\":\"607\",\"reporter\":\"SRC\",\"rtt_msec\":\"87\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.270990648Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:01.270990648Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -3212,13 +3348,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597088427Z", "id": "1ulp77rfdvho4t", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4t\",\"jsonPayload\":{\"bytes_sent\":\"61242\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33534},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597088427Z\",\"packets_sent\":\"356\",\"reporter\":\"DEST\",\"rtt_msec\":\"311\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075942176Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:06.075942176Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3327,13 +3467,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.705469925Z", "id": "1ulp77rfdvho68", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho68\",\"jsonPayload\":{\"bytes_sent\":\"248826\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":49680,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"siem-windows\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"windows-isolated\",\"vpc_name\":\"windows-isolated\"},\"end_time\":\"2019-06-14T03:49:55.705469925Z\",\"packets_sent\":\"735\",\"reporter\":\"SRC\",\"rtt_msec\":\"113\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.711043814Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:59.711043814Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3419,13 +3563,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:11.779780615Z", "id": "1ulp77rfdvho5n", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5n\",\"jsonPayload\":{\"bytes_sent\":\"1777\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":33862,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:46:11.779780615Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:46:11.655143526Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:46:11.655143526Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -3503,13 +3651,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.312105537Z", "id": "1ulp77rfdvho5l", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5l\",\"jsonPayload\":{\"bytes_sent\":\"116845\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65321,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.312105537Z\",\"packets_sent\":\"594\",\"reporter\":\"SRC\",\"rtt_msec\":\"219\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.843986502Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:59.843986502Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -3581,13 +3733,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.461087350Z", "id": "1ulp77rfdvho65", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho65\",\"jsonPayload\":{\"bytes_sent\":\"4614\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33524},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.461087350Z\",\"packets_sent\":\"58\",\"reporter\":\"DEST\",\"rtt_msec\":\"0\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:24.790136141Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:24.790136141Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3691,13 +3847,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:18.224268993Z", "id": "1ulp77rfdvho4b", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4b\",\"jsonPayload\":{\"bytes_sent\":\"50379\",\"connection\":{\"dest_ip\":\"192.168.2.177\",\"dest_port\":60112,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:18.224268993Z\",\"packets_sent\":\"130\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:14.031541248Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:14.031541248Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3782,13 +3942,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.213244028Z", "id": "1ulp77rfdvho4m", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4m\",\"jsonPayload\":{\"bytes_sent\":\"200417\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33552,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.213244028Z\",\"packets_sent\":\"250\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075811571Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:06.075811571Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3897,13 +4061,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.461087350Z", "id": "1ulp77rfdvho5t", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5t\",\"jsonPayload\":{\"bytes_sent\":\"30233\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33524,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.461087350Z\",\"packets_sent\":\"37\",\"reporter\":\"SRC\",\"rtt_msec\":\"0\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:24.790136141Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:24.790136141Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -3988,13 +4156,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565451051Z", "id": "1ulp77rfdvho50", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho50\",\"jsonPayload\":{\"bytes_sent\":\"160693\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33548,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565451051Z\",\"packets_sent\":\"237\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147072949Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:05.147072949Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4091,13 +4263,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565117754Z", "id": "1ulp77rfdvho63", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho63\",\"jsonPayload\":{\"bytes_sent\":\"59903\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33694},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565117754Z\",\"packets_sent\":\"353\",\"reporter\":\"DEST\",\"rtt_msec\":\"216\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.566551903Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:05.566551903Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4200,13 +4376,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:20.745658276Z", "id": "1ulp77rfdvho4r", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4r\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":33924,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:46:20.745658276Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:46:20.634545217Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:46:20.634545217Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -4284,13 +4464,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.318940798Z", "id": "1ulp77rfdvho4i", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4i\",\"jsonPayload\":{\"bytes_sent\":\"129335\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65271,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:55.318940798Z\",\"packets_sent\":\"605\",\"reporter\":\"SRC\",\"rtt_msec\":\"89\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.155378070Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:00.155378070Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -4357,13 +4541,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:11.779780615Z", "id": "1ulp77rfdvho5v", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5v\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":33862},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:46:11.779780615Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:46:11.655143526Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:46:11.655143526Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4436,13 +4624,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.312105537Z", "id": "1ulp77rfdvho5i", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5i\",\"jsonPayload\":{\"bytes_sent\":\"75477\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65321},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.312105537Z\",\"packets_sent\":\"737\",\"reporter\":\"DEST\",\"rtt_msec\":\"219\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.843986502Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:59.843986502Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4531,13 +4723,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220838853Z", "id": "1ulp77rfdvho5c", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5c\",\"jsonPayload\":{\"bytes_sent\":\"102119\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65316,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220838853Z\",\"packets_sent\":\"600\",\"reporter\":\"SRC\",\"rtt_msec\":\"86\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.565831992Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:00.565831992Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -4609,13 +4805,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.705469925Z", "id": "1ulp77rfdvho5p", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5p\",\"jsonPayload\":{\"bytes_sent\":\"1541638\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":49680},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.705469925Z\",\"packets_sent\":\"949\",\"reporter\":\"DEST\",\"rtt_msec\":\"113\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"siem-windows\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"windows-isolated\",\"vpc_name\":\"windows-isolated\"},\"start_time\":\"2019-06-14T03:39:59.711043814Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:59.711043814Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4712,13 +4912,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:18.224268993Z", "id": "1ulp77rfdvho4y", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4y\",\"jsonPayload\":{\"bytes_sent\":\"755901\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.177\",\"src_port\":60112},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:18.224268993Z\",\"packets_sent\":\"227\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:14.031541248Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:14.031541248Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4822,13 +5026,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.394676451Z", "id": "1ulp77rfdvho4o", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4o\",\"jsonPayload\":{\"bytes_sent\":\"248715\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33558,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.394676451Z\",\"packets_sent\":\"270\",\"reporter\":\"SRC\",\"rtt_msec\":\"144\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:58.492572765Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:58.492572765Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4908,13 +5116,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220838853Z", "id": "1ulp77rfdvho5g", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5g\",\"jsonPayload\":{\"bytes_sent\":\"69757\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65316},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220838853Z\",\"packets_sent\":\"709\",\"reporter\":\"DEST\",\"rtt_msec\":\"86\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.565831992Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:00.565831992Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -4992,13 +5204,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220748025Z", "id": "1ulp77rfdvho59", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho59\",\"jsonPayload\":{\"bytes_sent\":\"69440\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65263},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220748025Z\",\"packets_sent\":\"728\",\"reporter\":\"DEST\",\"rtt_msec\":\"87\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:01.270990648Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:01.270990648Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5076,13 +5292,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:20.569744903Z", "id": "1ulp77rfdvho57", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho57\",\"jsonPayload\":{\"bytes_sent\":\"1457\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":50438},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:20.569744903Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:40:20.454046087Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:20.454046087Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5161,13 +5381,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:20.569744903Z", "id": "1ulp77rfdvho5e", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5e\",\"jsonPayload\":{\"bytes_sent\":\"1784\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":50438,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:40:20.569744903Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.454046087Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:20.454046087Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -5242,13 +5466,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:52.361155668Z", "id": "1ulp77rfdvho4d", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4d\",\"jsonPayload\":{\"bytes_sent\":\"2395\",\"connection\":{\"dest_ip\":\"192.168.2.165\",\"dest_port\":59623,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":22},\"dest_location\":{\"asn\":45899,\"city\":\"Vĩnh Yên\",\"continent\":\"Asia\",\"country\":\"vnm\",\"region\":\"Vinh Phuc Province\"},\"end_time\":\"2019-06-14T03:40:52.361155668Z\",\"packets_sent\":\"11\",\"reporter\":\"SRC\",\"rtt_msec\":\"233\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:46.541094678Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:46.541094678Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -5320,13 +5548,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:48.538257098Z", "id": "1ulp77rfdvho5y", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho5y\",\"jsonPayload\":{\"bytes_sent\":\"60335\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33558},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:48.538257098Z\",\"packets_sent\":\"353\",\"reporter\":\"DEST\",\"rtt_msec\":\"144\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:58.492572765Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:39:58.492572765Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5435,13 +5667,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565451051Z", "id": "1ulp77rfdvho6a", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho6a\",\"jsonPayload\":{\"bytes_sent\":\"65565\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33548},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565451051Z\",\"packets_sent\":\"354\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147072949Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:05.147072949Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5521,13 +5757,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.318940798Z", "id": "1ulp77rfdvho4v", "kind": "event", "original": "{\"insertId\":\"1ulp77rfdvho4v\",\"jsonPayload\":{\"bytes_sent\":\"70174\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65271},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.318940798Z\",\"packets_sent\":\"717\",\"reporter\":\"DEST\",\"rtt_msec\":\"89\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.155378070Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:11.981912845Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:11.981912845Z\"}", "start": "2019-06-14T03:40:00.155378070Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5605,13 +5845,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:51.355687385Z", "id": "bnj3cofh3cdk1", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk1\",\"jsonPayload\":{\"bytes_sent\":\"1461\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":34178},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:46:51.355687385Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:46:51.237256499Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:46:51.237256499Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5689,13 +5933,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:51.090104692Z", "id": "bnj3cofh3cdjx", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdjx\",\"jsonPayload\":{\"bytes_sent\":\"1460\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":33602},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:45:51.090104692Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:45:50.954948790Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:45:50.954948790Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5778,13 +6026,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565131125Z", "id": "bnj3cofh3cdju", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdju\",\"jsonPayload\":{\"bytes_sent\":\"66736\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33554},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565131125Z\",\"packets_sent\":\"366\",\"reporter\":\"DEST\",\"rtt_msec\":\"224\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:02.143837873Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:02.143837873Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -5887,13 +6139,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:51.090104692Z", "id": "bnj3cofh3cdjz", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdjz\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":33602,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:45:51.090104692Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:45:50.954948790Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:45:50.954948790Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -5960,13 +6216,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:40.888804332Z", "id": "bnj3cofh3cdkk", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkk\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":52454},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:42:40.888804332Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:42:40.779893091Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:42:40.779893091Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6049,13 +6309,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597279654Z", "id": "bnj3cofh3cdk0", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk0\",\"jsonPayload\":{\"bytes_sent\":\"259510\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33534,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597279654Z\",\"packets_sent\":\"251\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075756033Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:06.075756033Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6158,13 +6422,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:11.183868408Z", "id": "bnj3cofh3cdk8", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk8\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":52260,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:42:11.183868408Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:42:11.063146265Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:42:11.063146265Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -6248,13 +6516,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565300944Z", "id": "bnj3cofh3cdkp", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkp\",\"jsonPayload\":{\"bytes_sent\":\"65069\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33530},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565300944Z\",\"packets_sent\":\"361\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140119099Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:00.140119099Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6351,13 +6623,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565335113Z", "id": "bnj3cofh3cdkc", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkc\",\"jsonPayload\":{\"bytes_sent\":\"60530\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33556},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565335113Z\",\"packets_sent\":\"366\",\"reporter\":\"SRC\",\"rtt_msec\":\"15\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6442,13 +6718,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821047175Z", "id": "bnj3cofh3cdkm", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkm\",\"jsonPayload\":{\"bytes_sent\":\"11384\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33570},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821047175Z\",\"packets_sent\":\"86\",\"reporter\":\"DEST\",\"rtt_msec\":\"230\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.469473010Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:08.469473010Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6557,13 +6837,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565131125Z", "id": "bnj3cofh3cdjy", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdjy\",\"jsonPayload\":{\"bytes_sent\":\"272063\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33554,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565131125Z\",\"packets_sent\":\"247\",\"reporter\":\"SRC\",\"rtt_msec\":\"224\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:02.143837873Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:02.143837873Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6654,13 +6938,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:50.822333871Z", "id": "bnj3cofh3cdjv", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdjv\",\"jsonPayload\":{\"bytes_sent\":\"1791\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":53706,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:43:50.822333871Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"43\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:43:50.703302550Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:43:50.703302550Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -6732,13 +7020,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789039435Z", "id": "bnj3cofh3cdkh", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkh\",\"jsonPayload\":{\"bytes_sent\":\"18295\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33858},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789039435Z\",\"packets_sent\":\"118\",\"reporter\":\"DEST\",\"rtt_msec\":\"253\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.458515996Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:08.458515996Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6830,13 +7122,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:40.243022993Z", "id": "bnj3cofh3cdkg", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkg\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":33064},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:44:40.243022993Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:44:40.125336665Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:44:40.125336665Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -6919,13 +7215,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565335113Z", "id": "bnj3cofh3cdk7", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk7\",\"jsonPayload\":{\"bytes_sent\":\"165290\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33556,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565335113Z\",\"packets_sent\":\"251\",\"reporter\":\"DEST\",\"rtt_msec\":\"15\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7017,13 +7317,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:50.822333871Z", "id": "bnj3cofh3cdk9", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk9\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":53706},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:43:50.822333871Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"43\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:43:50.703302550Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:43:50.703302550Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7101,13 +7405,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:11.183868408Z", "id": "bnj3cofh3cdkj", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkj\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":52260},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:42:11.183868408Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:42:11.063146265Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:42:11.063146265Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7196,13 +7504,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:37.827345444Z", "id": "bnj3cofh3cdki", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdki\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":34090,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:46:37.827345444Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:46:37.712749588Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:46:37.712749588Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -7280,13 +7592,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:51.355687385Z", "id": "bnj3cofh3cdkd", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkd\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":34178,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:46:51.355687385Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:46:51.237256499Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:46:51.237256499Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -7364,13 +7680,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:40.243022993Z", "id": "bnj3cofh3cdjw", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdjw\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":33064,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:44:40.243022993Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:44:40.125336665Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:44:40.125336665Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -7437,13 +7757,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:50.757255245Z", "id": "bnj3cofh3cdk3", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk3\",\"jsonPayload\":{\"bytes_sent\":\"1461\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":34906},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:48:50.757255245Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:48:50.642206049Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:48:50.642206049Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7532,13 +7856,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:36.982303071Z", "id": "bnj3cofh3cdkb", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkb\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":58216,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:49:36.982303071Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:49:36.865198297Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:49:36.865198297Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -7622,13 +7950,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597279654Z", "id": "bnj3cofh3cdk4", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk4\",\"jsonPayload\":{\"bytes_sent\":\"60222\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33534},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597279654Z\",\"packets_sent\":\"361\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075756033Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:06.075756033Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7725,13 +8057,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565335113Z", "id": "bnj3cofh3cdkf", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkf\",\"jsonPayload\":{\"bytes_sent\":\"61810\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33510},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565335113Z\",\"packets_sent\":\"358\",\"reporter\":\"SRC\",\"rtt_msec\":\"16\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500418290Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:39:59.500418290Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7811,13 +8147,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:36.982303071Z", "id": "bnj3cofh3cdkl", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkl\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":58216},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:36.982303071Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:49:36.865198297Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:49:36.865198297Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -7900,13 +8240,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565335113Z", "id": "bnj3cofh3cdk2", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk2\",\"jsonPayload\":{\"bytes_sent\":\"136558\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33510,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565335113Z\",\"packets_sent\":\"243\",\"reporter\":\"DEST\",\"rtt_msec\":\"16\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500418290Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:39:59.500418290Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8009,13 +8353,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:50.757255245Z", "id": "bnj3cofh3cdko", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdko\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":34906,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:48:50.757255245Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:48:50.642206049Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:48:50.642206049Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -8093,13 +8441,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:40.888804332Z", "id": "bnj3cofh3cdke", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdke\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":52454,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:42:40.888804332Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:42:40.779893091Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:42:40.779893091Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -8166,13 +8518,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:46:37.827345444Z", "id": "bnj3cofh3cdka", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdka\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":34090},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:46:37.827345444Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:46:37.712749588Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:46:37.712749588Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8255,13 +8611,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565300944Z", "id": "bnj3cofh3cdkn", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdkn\",\"jsonPayload\":{\"bytes_sent\":\"170396\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33530,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565300944Z\",\"packets_sent\":\"246\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140119099Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:00.140119099Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8370,13 +8730,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821129119Z", "id": "bnj3cofh3cdk5", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk5\",\"jsonPayload\":{\"bytes_sent\":\"171610\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33570,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821129119Z\",\"packets_sent\":\"71\",\"reporter\":\"SRC\",\"rtt_msec\":\"230\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.469473010Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:08.469473010Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8473,13 +8837,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933164456Z", "id": "bnj3cofh3cdk6", "kind": "event", "original": "{\"insertId\":\"bnj3cofh3cdk6\",\"jsonPayload\":{\"bytes_sent\":\"15186\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33858,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933164456Z\",\"packets_sent\":\"75\",\"reporter\":\"SRC\",\"rtt_msec\":\"253\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.458515996Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:13.921248755Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:13.921248755Z\"}", "start": "2019-06-14T03:40:08.458515996Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8576,13 +8944,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565116665Z", "id": "y4wffpfk2ero3", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero3\",\"jsonPayload\":{\"bytes_sent\":\"208416\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33590,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565116665Z\",\"packets_sent\":\"249\",\"reporter\":\"SRC\",\"rtt_msec\":\"109\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147151100Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:05.147151100Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8674,13 +9046,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:54.108975753Z", "id": "y4wffpfk2eroh", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroh\",\"jsonPayload\":{\"bytes_sent\":\"90977\",\"connection\":{\"dest_ip\":\"192.168.2.177\",\"dest_port\":60108,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:54.108975753Z\",\"packets_sent\":\"357\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.762958327Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:00.762958327Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8777,13 +9153,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565156020Z", "id": "y4wffpfk2erom", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erom\",\"jsonPayload\":{\"bytes_sent\":\"187301\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33536,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565156020Z\",\"packets_sent\":\"242\",\"reporter\":\"SRC\",\"rtt_msec\":\"194\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150481417Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.150481417Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8868,13 +9248,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "y4wffpfk2ero9", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero9\",\"jsonPayload\":{\"bytes_sent\":\"139106\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33560,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"244\",\"reporter\":\"DEST\",\"rtt_msec\":\"11\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075859688Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:06.075859688Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -8971,13 +9355,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:54.108975753Z", "id": "y4wffpfk2erog", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erog\",\"jsonPayload\":{\"bytes_sent\":\"1733360\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.177\",\"src_port\":60108},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:54.108975753Z\",\"packets_sent\":\"708\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.762958327Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:00.762958327Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9081,13 +9469,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933099658Z", "id": "y4wffpfk2ero7", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero7\",\"jsonPayload\":{\"bytes_sent\":\"149157\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33874,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933099658Z\",\"packets_sent\":\"74\",\"reporter\":\"SRC\",\"rtt_msec\":\"142\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.513551480Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:20.513551480Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9172,13 +9564,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.965119632Z", "id": "y4wffpfk2eroe", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroe\",\"jsonPayload\":{\"bytes_sent\":\"11108\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33968},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.965119632Z\",\"packets_sent\":\"95\",\"reporter\":\"DEST\",\"rtt_msec\":\"201\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.480430427Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.480430427Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9275,13 +9671,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565116665Z", "id": "y4wffpfk2eroa", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroa\",\"jsonPayload\":{\"bytes_sent\":\"67337\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33590},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565116665Z\",\"packets_sent\":\"351\",\"reporter\":\"DEST\",\"rtt_msec\":\"109\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.147151100Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:05.147151100Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9378,13 +9778,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "y4wffpfk2eroi", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroi\",\"jsonPayload\":{\"bytes_sent\":\"136375\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33538,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"246\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500483335Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:39:59.500483335Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9493,13 +9897,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.393929808Z", "id": "y4wffpfk2ero8", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero8\",\"jsonPayload\":{\"bytes_sent\":\"181424\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33690,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.393929808Z\",\"packets_sent\":\"241\",\"reporter\":\"SRC\",\"rtt_msec\":\"196\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075867049Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:06.075867049Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9584,13 +9992,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933099658Z", "id": "y4wffpfk2erol", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erol\",\"jsonPayload\":{\"bytes_sent\":\"9303\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33874},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933099658Z\",\"packets_sent\":\"94\",\"reporter\":\"DEST\",\"rtt_msec\":\"142\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.513551480Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:20.513551480Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9699,13 +10111,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821149051Z", "id": "y4wffpfk2ero4", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero4\",\"jsonPayload\":{\"bytes_sent\":\"142871\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33572,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821149051Z\",\"packets_sent\":\"77\",\"reporter\":\"SRC\",\"rtt_msec\":\"335\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470754779Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.470754779Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9802,13 +10218,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.965119632Z", "id": "y4wffpfk2eror", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eror\",\"jsonPayload\":{\"bytes_sent\":\"158811\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33968,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.965119632Z\",\"packets_sent\":\"69\",\"reporter\":\"SRC\",\"rtt_msec\":\"201\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.480430427Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.480430427Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -9893,13 +10313,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821047175Z", "id": "y4wffpfk2erob", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erob\",\"jsonPayload\":{\"bytes_sent\":\"13455\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33880},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821047175Z\",\"packets_sent\":\"81\",\"reporter\":\"DEST\",\"rtt_msec\":\"252\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470071135Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.470071135Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10002,13 +10426,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:22.156322353Z", "id": "y4wffpfk2erox", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erox\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":57300,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:48:22.156322353Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:48:22.044604322Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:48:22.044604322Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -10075,13 +10503,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220720811Z", "id": "y4wffpfk2eroc", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroc\",\"jsonPayload\":{\"bytes_sent\":\"71014\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65315},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220720811Z\",\"packets_sent\":\"728\",\"reporter\":\"DEST\",\"rtt_msec\":\"210\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.844068405Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:39:59.844068405Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10176,13 +10608,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "y4wffpfk2erok", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erok\",\"jsonPayload\":{\"bytes_sent\":\"60749\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33538},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"362\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500483335Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:39:59.500483335Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10279,13 +10715,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821138391Z", "id": "y4wffpfk2eros", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eros\",\"jsonPayload\":{\"bytes_sent\":\"160451\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33880,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821138391Z\",\"packets_sent\":\"66\",\"reporter\":\"SRC\",\"rtt_msec\":\"252\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470071135Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.470071135Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10370,13 +10810,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821291282Z", "id": "y4wffpfk2erod", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erod\",\"jsonPayload\":{\"bytes_sent\":\"169173\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33574,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821291282Z\",\"packets_sent\":\"64\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466811088Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.466811088Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10479,13 +10923,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220720811Z", "id": "y4wffpfk2ero6", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero6\",\"jsonPayload\":{\"bytes_sent\":\"118762\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65315,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220720811Z\",\"packets_sent\":\"615\",\"reporter\":\"SRC\",\"rtt_msec\":\"210\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.844068405Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:39:59.844068405Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -10569,13 +11017,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "y4wffpfk2eron", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eron\",\"jsonPayload\":{\"bytes_sent\":\"11137\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33576},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"96\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510464198Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:20.510464198Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10655,13 +11107,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:22.156322353Z", "id": "y4wffpfk2eroy", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroy\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":57300},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:48:22.156322353Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:48:22.044604322Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:48:22.044604322Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10750,13 +11206,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:12.142682672Z", "id": "y4wffpfk2erof", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erof\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":54662,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:45:12.142682672Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:45:12.027895189Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:45:12.027895189Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -10828,13 +11288,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821056075Z", "id": "y4wffpfk2erov", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erov\",\"jsonPayload\":{\"bytes_sent\":\"11674\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33572},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821056075Z\",\"packets_sent\":\"96\",\"reporter\":\"DEST\",\"rtt_msec\":\"335\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470754779Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.470754779Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -10931,13 +11395,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789112562Z", "id": "y4wffpfk2erop", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erop\",\"jsonPayload\":{\"bytes_sent\":\"62831\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33540},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789112562Z\",\"packets_sent\":\"346\",\"reporter\":\"DEST\",\"rtt_msec\":\"313\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074813982Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:01.074813982Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11046,13 +11514,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821291282Z", "id": "y4wffpfk2erou", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erou\",\"jsonPayload\":{\"bytes_sent\":\"15169\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33574},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821291282Z\",\"packets_sent\":\"93\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466811088Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.466811088Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11132,13 +11604,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:12.142682672Z", "id": "y4wffpfk2eroj", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroj\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":54662},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:45:12.142682672Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:45:12.027895189Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:45:12.027895189Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11233,13 +11709,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "y4wffpfk2erow", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erow\",\"jsonPayload\":{\"bytes_sent\":\"64588\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33560},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"362\",\"reporter\":\"SRC\",\"rtt_msec\":\"11\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075859688Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:06.075859688Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11324,13 +11804,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565156020Z", "id": "y4wffpfk2erot", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2erot\",\"jsonPayload\":{\"bytes_sent\":\"67315\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33536},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565156020Z\",\"packets_sent\":\"354\",\"reporter\":\"DEST\",\"rtt_msec\":\"194\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150481417Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:08.150481417Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11427,13 +11911,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "y4wffpfk2eroq", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroq\",\"jsonPayload\":{\"bytes_sent\":\"175633\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33576,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"67\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510464198Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:20.510464198Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11542,13 +12030,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789112562Z", "id": "y4wffpfk2ero5", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2ero5\",\"jsonPayload\":{\"bytes_sent\":\"116981\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33540,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789112562Z\",\"packets_sent\":\"234\",\"reporter\":\"SRC\",\"rtt_msec\":\"313\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074813982Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:01.074813982Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11633,13 +12125,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:48.542406314Z", "id": "y4wffpfk2eroo", "kind": "event", "original": "{\"insertId\":\"y4wffpfk2eroo\",\"jsonPayload\":{\"bytes_sent\":\"67789\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33690},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:48.542406314Z\",\"packets_sent\":\"344\",\"reporter\":\"DEST\",\"rtt_msec\":\"196\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075867049Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.453102376Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.453102376Z\"}", "start": "2019-06-14T03:40:06.075867049Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11748,13 +12244,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565124617Z", "id": "ptjoddfhmrhg9", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhg9\",\"jsonPayload\":{\"bytes_sent\":\"136166\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33538,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565124617Z\",\"packets_sent\":\"245\",\"reporter\":\"SRC\",\"rtt_msec\":\"250\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074952616Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:01.074952616Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11834,13 +12334,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220614265Z", "id": "ptjoddfhmrhgh", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgh\",\"jsonPayload\":{\"bytes_sent\":\"68262\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65257},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220614265Z\",\"packets_sent\":\"718\",\"reporter\":\"DEST\",\"rtt_msec\":\"220\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.403388091Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:39:59.403388091Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -11918,13 +12422,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:20.952481728Z", "id": "ptjoddfhmrhgj", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgj\",\"jsonPayload\":{\"bytes_sent\":\"1457\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":52328},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:42:20.952481728Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:42:20.842840991Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:42:20.842840991Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12002,13 +12510,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:50.702194466Z", "id": "ptjoddfhmrhgr", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgr\",\"jsonPayload\":{\"bytes_sent\":\"1460\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":59790},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:50.702194466Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:40:50.590894439Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:50.590894439Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12086,13 +12598,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220599950Z", "id": "ptjoddfhmrhgn", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgn\",\"jsonPayload\":{\"bytes_sent\":\"73681\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65317},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220599950Z\",\"packets_sent\":\"728\",\"reporter\":\"DEST\",\"rtt_msec\":\"62\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.740491697Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:39:59.740491697Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12181,13 +12697,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220599950Z", "id": "ptjoddfhmrhga", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhga\",\"jsonPayload\":{\"bytes_sent\":\"92566\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65317,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220599950Z\",\"packets_sent\":\"596\",\"reporter\":\"SRC\",\"rtt_msec\":\"62\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.740491697Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:39:59.740491697Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -12259,13 +12779,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565137912Z", "id": "ptjoddfhmrhgk", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgk\",\"jsonPayload\":{\"bytes_sent\":\"66094\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33692},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565137912Z\",\"packets_sent\":\"360\",\"reporter\":\"DEST\",\"rtt_msec\":\"181\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.558259934Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:00.558259934Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12357,13 +12881,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220741828Z", "id": "ptjoddfhmrhgm", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgm\",\"jsonPayload\":{\"bytes_sent\":\"4900\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65262},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220741828Z\",\"packets_sent\":\"542\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.251430011Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:00.251430011Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12449,13 +12977,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:20.952481728Z", "id": "ptjoddfhmrhgd", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgd\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":52328,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:42:20.952481728Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:42:20.842840991Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:42:20.842840991Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -12527,13 +13059,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.213081491Z", "id": "ptjoddfhmrhgl", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgl\",\"jsonPayload\":{\"bytes_sent\":\"63280\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33552},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.213081491Z\",\"packets_sent\":\"361\",\"reporter\":\"DEST\",\"rtt_msec\":\"21\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075957044Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:06.075957044Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12636,13 +13172,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:35.841633589Z", "id": "ptjoddfhmrhgi", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgi\",\"jsonPayload\":{\"bytes_sent\":\"774029\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":37292,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":24940,\"city\":\"Bucharest\",\"continent\":\"Europe\",\"country\":\"rou\",\"region\":\"Bucharest\"},\"end_time\":\"2019-06-14T03:49:35.841633589Z\",\"packets_sent\":\"403\",\"reporter\":\"SRC\",\"rtt_msec\":\"102\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:35.048156283Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:35.048156283Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -12714,13 +13254,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933338264Z", "id": "ptjoddfhmrhgo", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgo\",\"jsonPayload\":{\"bytes_sent\":\"359272\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33876,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933338264Z\",\"packets_sent\":\"66\",\"reporter\":\"DEST\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466706102Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:08.466706102Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12809,13 +13353,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:35.841633589Z", "id": "ptjoddfhmrhgp", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgp\",\"jsonPayload\":{\"bytes_sent\":\"310476\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":37292},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:35.841633589Z\",\"packets_sent\":\"214\",\"reporter\":\"DEST\",\"rtt_msec\":\"102\",\"src_location\":{\"asn\":24940,\"city\":\"Bucharest\",\"continent\":\"Europe\",\"country\":\"rou\",\"region\":\"Bucharest\"},\"start_time\":\"2019-06-14T03:40:35.048156283Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:35.048156283Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -12904,13 +13452,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:50.702194466Z", "id": "ptjoddfhmrhg8", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhg8\",\"jsonPayload\":{\"bytes_sent\":\"1784\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":59790,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:40:50.702194466Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:50.590894439Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:50.590894439Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -12994,13 +13546,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.213081491Z", "id": "ptjoddfhmrhgf", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgf\",\"jsonPayload\":{\"bytes_sent\":\"209716\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33552,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.213081491Z\",\"packets_sent\":\"262\",\"reporter\":\"SRC\",\"rtt_msec\":\"21\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075957044Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:06.075957044Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13097,13 +13653,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565214145Z", "id": "ptjoddfhmrhgg", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgg\",\"jsonPayload\":{\"bytes_sent\":\"165643\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33556,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565214145Z\",\"packets_sent\":\"256\",\"reporter\":\"SRC\",\"rtt_msec\":\"133\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:03.062674441Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:03.062674441Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13194,13 +13754,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220614265Z", "id": "ptjoddfhmrhgb", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgb\",\"jsonPayload\":{\"bytes_sent\":\"65890\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65257,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220614265Z\",\"packets_sent\":\"593\",\"reporter\":\"SRC\",\"rtt_msec\":\"220\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.403388091Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:39:59.403388091Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -13272,13 +13836,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565124617Z", "id": "ptjoddfhmrhgs", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgs\",\"jsonPayload\":{\"bytes_sent\":\"62620\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33538},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565124617Z\",\"packets_sent\":\"358\",\"reporter\":\"DEST\",\"rtt_msec\":\"250\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074952616Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:01.074952616Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13387,13 +13955,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565137912Z", "id": "ptjoddfhmrhge", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhge\",\"jsonPayload\":{\"bytes_sent\":\"185520\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33692,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565137912Z\",\"packets_sent\":\"249\",\"reporter\":\"SRC\",\"rtt_msec\":\"181\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.558259934Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:00.558259934Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13484,13 +14056,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220741828Z", "id": "ptjoddfhmrhgc", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgc\",\"jsonPayload\":{\"bytes_sent\":\"33269\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65262,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220741828Z\",\"packets_sent\":\"517\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.251430011Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:00.251430011Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -13559,13 +14135,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565214145Z", "id": "ptjoddfhmrhg7", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhg7\",\"jsonPayload\":{\"bytes_sent\":\"58811\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33556},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565214145Z\",\"packets_sent\":\"358\",\"reporter\":\"DEST\",\"rtt_msec\":\"133\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:03.062674441Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:03.062674441Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13674,13 +14254,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933338264Z", "id": "ptjoddfhmrhgq", "kind": "event", "original": "{\"insertId\":\"ptjoddfhmrhgq\",\"jsonPayload\":{\"bytes_sent\":\"5220\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33876},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933338264Z\",\"packets_sent\":\"86\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466706102Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:15.857334727Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:15.857334727Z\"}", "start": "2019-06-14T03:40:08.466706102Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13757,13 +14341,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:13.478093057Z", "id": "bxuq05fhgmw9d", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9d\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":41818},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:13.478093057Z\",\"packets_sent\":\"4\",\"reporter\":\"DEST\",\"rtt_msec\":\"1350\",\"src_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"start_time\":\"2019-06-14T03:40:11.031370298Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:11.031370298Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13858,13 +14446,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.461240929Z", "id": "bxuq05fhgmw90", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw90\",\"jsonPayload\":{\"bytes_sent\":\"4580\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33524},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.461240929Z\",\"packets_sent\":\"60\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:24.789945697Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:24.789945697Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -13941,13 +14533,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.408936364Z", "id": "bxuq05fhgmw8w", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8w\",\"jsonPayload\":{\"bytes_sent\":\"270437\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65322},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:55.408936364Z\",\"packets_sent\":\"668\",\"reporter\":\"DEST\",\"rtt_msec\":\"92\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.703392247Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:39:59.703392247Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14036,13 +14632,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:55.408936364Z", "id": "bxuq05fhgmw94", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw94\",\"jsonPayload\":{\"bytes_sent\":\"19019\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65322,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:55.408936364Z\",\"packets_sent\":\"604\",\"reporter\":\"SRC\",\"rtt_msec\":\"92\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.703392247Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:39:59.703392247Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -14114,13 +14714,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789269849Z", "id": "bxuq05fhgmw8x", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8x\",\"jsonPayload\":{\"bytes_sent\":\"16208\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33568,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789269849Z\",\"packets_sent\":\"80\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.455711202Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:08.455711202Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14229,13 +14833,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789269849Z", "id": "bxuq05fhgmw8v", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8v\",\"jsonPayload\":{\"bytes_sent\":\"9800\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33568},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789269849Z\",\"packets_sent\":\"120\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.455711202Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:08.455711202Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14315,13 +14923,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:09.114674887Z", "id": "bxuq05fhgmw8z", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8z\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":58026},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:09.114674887Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"40\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:49:08.995009558Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:49:08.995009558Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14399,13 +15011,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597223164Z", "id": "bxuq05fhgmw9b", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9b\",\"jsonPayload\":{\"bytes_sent\":\"19506\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33564,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597223164Z\",\"packets_sent\":\"180\",\"reporter\":\"DEST\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.866699945Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:08.866699945Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14494,13 +15110,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:07.811355936Z", "id": "bxuq05fhgmw8y", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8y\",\"jsonPayload\":{\"bytes_sent\":\"1496\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":32882},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:44:07.811355936Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:44:07.689331553Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:44:07.689331553Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14590,13 +15210,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:52.101129310Z", "id": "bxuq05fhgmw9e", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9e\",\"jsonPayload\":{\"bytes_sent\":\"155675\",\"connection\":{\"dest_ip\":\"192.168.2.177\",\"dest_port\":60126,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:52.101129310Z\",\"packets_sent\":\"288\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:02.019841536Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:02.019841536Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14687,13 +15311,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:07.811355936Z", "id": "bxuq05fhgmw98", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw98\",\"jsonPayload\":{\"bytes_sent\":\"1791\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":32882,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:44:07.811355936Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:44:07.689331553Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:44:07.689331553Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -14760,13 +15388,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:02.085146013Z", "id": "bxuq05fhgmw96", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw96\",\"jsonPayload\":{\"bytes_sent\":\"28304484\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":39568},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:02.085146013Z\",\"packets_sent\":\"2400\",\"reporter\":\"DEST\",\"rtt_msec\":\"15\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:40:00.480787267Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:00.480787267Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -14855,13 +15487,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:02.085146013Z", "id": "bxuq05fhgmw99", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw99\",\"jsonPayload\":{\"bytes_sent\":\"2962242\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":39568,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:49:02.085146013Z\",\"packets_sent\":\"1340\",\"reporter\":\"SRC\",\"rtt_msec\":\"15\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.480787267Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:00.480787267Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -14934,13 +15570,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:09.114674887Z", "id": "bxuq05fhgmw93", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw93\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":58026,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:49:09.114674887Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"40\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:49:08.995009558Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:49:08.995009558Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -15024,13 +15664,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933323342Z", "id": "bxuq05fhgmw9f", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9f\",\"jsonPayload\":{\"bytes_sent\":\"9611\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33874},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933323342Z\",\"packets_sent\":\"101\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510575555Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:20.510575555Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15127,13 +15771,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597223164Z", "id": "bxuq05fhgmw9j", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9j\",\"jsonPayload\":{\"bytes_sent\":\"318481\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33564},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597223164Z\",\"packets_sent\":\"181\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.866699945Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:08.866699945Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15215,13 +15863,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933323342Z", "id": "bxuq05fhgmw97", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw97\",\"jsonPayload\":{\"bytes_sent\":\"139359\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33874,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933323342Z\",\"packets_sent\":\"70\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510575555Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:20.510575555Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15313,13 +15965,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:50.942543211Z", "id": "bxuq05fhgmw9i", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9i\",\"jsonPayload\":{\"bytes_sent\":\"1461\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":60640},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:42:50.942543211Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:42:50.830164366Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:42:50.830164366Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15408,13 +16064,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:16.809366809Z", "id": "bxuq05fhgmw9c", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9c\",\"jsonPayload\":{\"bytes_sent\":\"45\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":41818,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":22},\"dest_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"end_time\":\"2019-06-14T03:43:16.809366809Z\",\"packets_sent\":\"9\",\"reporter\":\"SRC\",\"rtt_msec\":\"1350\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:11.031370298Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:11.031370298Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -15492,13 +16152,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:50.942543211Z", "id": "bxuq05fhgmw9h", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9h\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":60640,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:42:50.942543211Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:42:50.830164366Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:42:50.830164366Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -15570,13 +16234,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "bxuq05fhgmw92", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw92\",\"jsonPayload\":{\"bytes_sent\":\"358920\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33966,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"61\",\"reporter\":\"DEST\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510534141Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:20.510534141Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15670,13 +16338,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:45.312543839Z", "id": "bxuq05fhgmw8u", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw8u\",\"jsonPayload\":{\"bytes_sent\":\"653827\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":53104},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:45.312543839Z\",\"packets_sent\":\"286\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.188944581Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:00.188944581Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15785,13 +16457,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "bxuq05fhgmw9g", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9g\",\"jsonPayload\":{\"bytes_sent\":\"5220\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33966},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"81\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510534141Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:20.510534141Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15873,13 +16549,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.461240929Z", "id": "bxuq05fhgmw91", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw91\",\"jsonPayload\":{\"bytes_sent\":\"31140\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33524,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.461240929Z\",\"packets_sent\":\"40\",\"reporter\":\"DEST\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:24.789945697Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:24.789945697Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -15973,13 +16653,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:52.101129310Z", "id": "bxuq05fhgmw95", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw95\",\"jsonPayload\":{\"bytes_sent\":\"1610630\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.177\",\"src_port\":60126},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:52.101129310Z\",\"packets_sent\":\"509\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:02.019841536Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:02.019841536Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16083,13 +16767,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:45.312543839Z", "id": "bxuq05fhgmw9a", "kind": "event", "original": "{\"insertId\":\"bxuq05fhgmw9a\",\"jsonPayload\":{\"bytes_sent\":\"37145\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":53104,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:45.312543839Z\",\"packets_sent\":\"158\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.188944581Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:16.593800036Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:16.593800036Z\"}", "start": "2019-06-14T03:40:00.188944581Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16169,13 +16857,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:20.748121914Z", "id": "198begsfh44xy3", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy3\",\"jsonPayload\":{\"bytes_sent\":\"1460\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":53972},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:44:20.748121914Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:44:20.634231041Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:44:20.634231041Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16253,13 +16945,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:20.632737426Z", "id": "198begsfh44xxt", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxt\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":58100},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:20.632737426Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:49:20.512264850Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:49:20.512264850Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16335,13 +17031,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:20.632777660Z", "id": "198begsfh44xy8", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy8\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":58100,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:49:20.632777660Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:49:20.512407536Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:49:20.512407536Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -16416,13 +17116,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:11.032929292Z", "id": "198begsfh44xy9", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy9\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":60756,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:43:11.032929292Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:43:10.912193869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:43:10.912193869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -16489,13 +17193,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:12.064908439Z", "id": "198begsfh44xxr", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxr\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":14236},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:12.064908439Z\",\"packets_sent\":\"3\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"start_time\":\"2019-06-14T03:40:08.247072525Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:08.247072525Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16581,13 +17289,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:39.207635184Z", "id": "198begsfh44xy2", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy2\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":60122,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:41:39.207635184Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:41:39.087226326Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:41:39.087226326Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -16665,13 +17377,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:20.748121914Z", "id": "198begsfh44xy6", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy6\",\"jsonPayload\":{\"bytes_sent\":\"1782\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":53972,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:44:20.748121914Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:44:20.634231041Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:44:20.634231041Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -16743,13 +17459,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:52.205089801Z", "id": "198begsfh44xxx", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxx\",\"jsonPayload\":{\"bytes_sent\":\"68545\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33530},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:52.205089801Z\",\"packets_sent\":\"368\",\"reporter\":\"DEST\",\"rtt_msec\":\"163\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140301693Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.140301693Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16841,13 +17561,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220838853Z", "id": "198begsfh44xy4", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy4\",\"jsonPayload\":{\"bytes_sent\":\"74613\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65274},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220838853Z\",\"packets_sent\":\"745\",\"reporter\":\"DEST\",\"rtt_msec\":\"209\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:01.270996793Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:01.270996793Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -16925,13 +17649,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.312105537Z", "id": "198begsfh44xy1", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy1\",\"jsonPayload\":{\"bytes_sent\":\"74942\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":53879},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.312105537Z\",\"packets_sent\":\"726\",\"reporter\":\"DEST\",\"rtt_msec\":\"176\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.760414869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.760414869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17009,13 +17737,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:38.299054333Z", "id": "198begsfh44xxp", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxp\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":34450},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:47:38.299054333Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:47:38.189569840Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:47:38.189569840Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17104,13 +17836,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220838853Z", "id": "198begsfh44xxv", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxv\",\"jsonPayload\":{\"bytes_sent\":\"121593\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65274,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220838853Z\",\"packets_sent\":\"610\",\"reporter\":\"SRC\",\"rtt_msec\":\"209\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.270996793Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:01.270996793Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -17177,13 +17913,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:39.777977145Z", "id": "198begsfh44xy7", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy7\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":60968},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:43:39.777977145Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:43:39.653136947Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:43:39.653136947Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17278,13 +18018,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:52.205194199Z", "id": "198begsfh44xxs", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxs\",\"jsonPayload\":{\"bytes_sent\":\"177471\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33530,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:52.205194199Z\",\"packets_sent\":\"246\",\"reporter\":\"SRC\",\"rtt_msec\":\"163\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140301693Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.140301693Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17375,13 +18119,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316847800Z", "id": "198begsfh44xxq", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxq\",\"jsonPayload\":{\"bytes_sent\":\"53315\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65275,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.316847800Z\",\"packets_sent\":\"588\",\"reporter\":\"SRC\",\"rtt_msec\":\"82\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.565734921Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.565734921Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -17459,13 +18207,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:38.299054333Z", "id": "198begsfh44xxz", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxz\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":34450,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:47:38.299054333Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:47:38.189569840Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:47:38.189569840Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -17532,13 +18284,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:39.207635184Z", "id": "198begsfh44xxy", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxy\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":60122},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:41:39.207635184Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:41:39.087226326Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:41:39.087226326Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17627,13 +18383,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.312105537Z", "id": "198begsfh44xxu", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxu\",\"jsonPayload\":{\"bytes_sent\":\"102119\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":53879,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.312105537Z\",\"packets_sent\":\"608\",\"reporter\":\"SRC\",\"rtt_msec\":\"176\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.760414869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.760414869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -17711,13 +18471,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:39.777977145Z", "id": "198begsfh44xxo", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxo\",\"jsonPayload\":{\"bytes_sent\":\"1794\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":60968,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:43:39.777977145Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:43:39.653136947Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:43:39.653136947Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -17784,13 +18548,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:11.032929292Z", "id": "198begsfh44xy0", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy0\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":60756},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:43:11.032929292Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:43:10.912193869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:43:10.912193869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17868,13 +18636,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316847800Z", "id": "198begsfh44xxw", "kind": "event", "original": "{\"insertId\":\"198begsfh44xxw\",\"jsonPayload\":{\"bytes_sent\":\"67013\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65275},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.316847800Z\",\"packets_sent\":\"710\",\"reporter\":\"DEST\",\"rtt_msec\":\"82\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.565734921Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:00.565734921Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -17963,13 +18735,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:09.257387426Z", "id": "198begsfh44xy5", "kind": "event", "original": "{\"insertId\":\"198begsfh44xy5\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":14236,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":22},\"dest_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"end_time\":\"2019-06-14T03:40:09.257387426Z\",\"packets_sent\":\"1\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.247072525Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.291787305Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.291787305Z\"}", "start": "2019-06-14T03:40:08.247072525Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -18038,13 +18814,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108524Z", "id": "19im82tfdygznq", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznq\",\"jsonPayload\":{\"bytes_sent\":\"64427\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33542},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108524Z\",\"packets_sent\":\"351\",\"reporter\":\"DEST\",\"rtt_msec\":\"173\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150870105Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.150870105Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18141,13 +18921,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "19im82tfdygzn6", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzn6\",\"jsonPayload\":{\"bytes_sent\":\"183366\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33690,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"242\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075665334Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:06.075665334Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18244,13 +19028,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:49.549471457Z", "id": "19im82tfdygznk", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznk\",\"jsonPayload\":{\"bytes_sent\":\"185295\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33562,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:49.549471457Z\",\"packets_sent\":\"244\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18342,13 +19130,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220725956Z", "id": "19im82tfdygznm", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznm\",\"jsonPayload\":{\"bytes_sent\":\"68961\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":49438},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220725956Z\",\"packets_sent\":\"711\",\"reporter\":\"DEST\",\"rtt_msec\":\"114\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.398463104Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.398463104Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18443,13 +19235,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565272745Z", "id": "19im82tfdygzob", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzob\",\"jsonPayload\":{\"bytes_sent\":\"62072\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33532},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565272745Z\",\"packets_sent\":\"360\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.072372604Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.072372604Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18534,13 +19330,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "19im82tfdygznc", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznc\",\"jsonPayload\":{\"bytes_sent\":\"198326\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33590,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"246\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.146956782Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:05.146956782Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18649,13 +19449,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "19im82tfdygznj", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznj\",\"jsonPayload\":{\"bytes_sent\":\"61436\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33550},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"362\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18752,13 +19556,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "19im82tfdygzo5", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo5\",\"jsonPayload\":{\"bytes_sent\":\"66791\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33690},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"355\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.075665334Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:06.075665334Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18838,13 +19646,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:20.708994883Z", "id": "19im82tfdygzod", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzod\",\"jsonPayload\":{\"bytes_sent\":\"1457\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":54812},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:45:20.708994883Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:45:20.595119257Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:45:20.595119257Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -18939,13 +19751,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:49.549471457Z", "id": "19im82tfdygzna", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzna\",\"jsonPayload\":{\"bytes_sent\":\"64466\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33562},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:49.549471457Z\",\"packets_sent\":\"363\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19030,13 +19846,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.965294083Z", "id": "19im82tfdygzng", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzng\",\"jsonPayload\":{\"bytes_sent\":\"174524\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33968,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.965294083Z\",\"packets_sent\":\"66\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.480272197Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.480272197Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19128,13 +19948,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:58.592579489Z", "id": "19im82tfdygzo1", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo1\",\"jsonPayload\":{\"bytes_sent\":\"181624065\",\"connection\":{\"dest_ip\":\"10.49.136.133\",\"dest_port\":52780,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":9243},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"simianhacker-demo\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:58.592579489Z\",\"packets_sent\":\"28344\",\"reporter\":\"DEST\",\"rtt_msec\":\"91\",\"src_location\":{\"asn\":16509,\"city\":\"Boardman\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Oregon\"},\"start_time\":\"2019-06-14T03:40:17.183499423Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:17.183499423Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19212,13 +20036,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:20.754300982Z", "id": "19im82tfdygzo8", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo8\",\"jsonPayload\":{\"bytes_sent\":\"1460\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":51348},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:41:20.754300982Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:41:20.630975303Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:41:20.630975303Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19299,13 +20127,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:22.081121292Z", "id": "19im82tfdygzoa", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzoa\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"192.168.2.12\",\"dest_port\":44128,\"protocol\":6,\"src_ip\":\"10.73.186.17\",\"src_port\":22},\"dest_location\":{\"asn\":4837,\"city\":\"Binzhou\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Shandong\"},\"end_time\":\"2019-06-14T03:45:22.081121292Z\",\"packets_sent\":\"1\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"infraops-docker-data\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:45:22.080963433Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:45:22.080963433Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -19386,13 +20218,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.965294083Z", "id": "19im82tfdygzn7", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzn7\",\"jsonPayload\":{\"bytes_sent\":\"11137\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33968},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.965294083Z\",\"packets_sent\":\"95\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.480272197Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.480272197Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19483,13 +20319,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:20.708994883Z", "id": "19im82tfdygznf", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznf\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":54812,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:45:20.708994883Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:45:20.595119257Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:45:20.595119257Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -19573,13 +20413,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597079770Z", "id": "19im82tfdygzni", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzni\",\"jsonPayload\":{\"bytes_sent\":\"21792\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33564,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597079770Z\",\"packets_sent\":\"186\",\"reporter\":\"SRC\",\"rtt_msec\":\"340\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.866944869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.866944869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19670,13 +20514,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220725956Z", "id": "19im82tfdygzns", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzns\",\"jsonPayload\":{\"bytes_sent\":\"74370\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":49438,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220725956Z\",\"packets_sent\":\"580\",\"reporter\":\"SRC\",\"rtt_msec\":\"114\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.398463104Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.398463104Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -19748,13 +20596,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "19im82tfdygznp", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznp\",\"jsonPayload\":{\"bytes_sent\":\"138337\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33550,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"244\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500498059Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:39:59.500498059Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19858,13 +20710,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:46.020466750Z", "id": "19im82tfdygzo9", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo9\",\"jsonPayload\":{\"bytes_sent\":\"30062\",\"connection\":{\"dest_ip\":\"192.168.2.177\",\"dest_port\":60110,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:46.020466750Z\",\"packets_sent\":\"124\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:10.874529937Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:10.874529937Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -19950,13 +20806,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:20.754300982Z", "id": "19im82tfdygzo3", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo3\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":51348,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:41:20.754300982Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:41:20.630975303Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:41:20.630975303Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -20040,13 +20900,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565026127Z", "id": "19im82tfdygznz", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznz\",\"jsonPayload\":{\"bytes_sent\":\"152218\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33560,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565026127Z\",\"packets_sent\":\"243\",\"reporter\":\"SRC\",\"rtt_msec\":\"116\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.076060079Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:06.076060079Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20143,13 +21007,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565078274Z", "id": "19im82tfdygzo4", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo4\",\"jsonPayload\":{\"bytes_sent\":\"143085\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33510,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565078274Z\",\"packets_sent\":\"249\",\"reporter\":\"SRC\",\"rtt_msec\":\"352\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074688714Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:01.074688714Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20234,13 +21102,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565078274Z", "id": "19im82tfdygznt", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznt\",\"jsonPayload\":{\"bytes_sent\":\"61245\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33510},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565078274Z\",\"packets_sent\":\"356\",\"reporter\":\"DEST\",\"rtt_msec\":\"352\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.074688714Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:01.074688714Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20337,13 +21209,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108524Z", "id": "19im82tfdygznu", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznu\",\"jsonPayload\":{\"bytes_sent\":\"65919\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33532},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108524Z\",\"packets_sent\":\"361\",\"reporter\":\"DEST\",\"rtt_msec\":\"270\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.072555233Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.072555233Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20446,13 +21322,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:40.058368408Z", "id": "19im82tfdygzo6", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo6\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":41822,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":22},\"dest_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"end_time\":\"2019-06-14T03:40:40.058368408Z\",\"packets_sent\":\"4\",\"reporter\":\"SRC\",\"rtt_msec\":\"1439\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:12.068494835Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:12.068494835Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -20536,13 +21416,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108524Z", "id": "19im82tfdygzno", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzno\",\"jsonPayload\":{\"bytes_sent\":\"188997\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33532,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108524Z\",\"packets_sent\":\"251\",\"reporter\":\"SRC\",\"rtt_msec\":\"270\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.072555233Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.072555233Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20639,13 +21523,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789035952Z", "id": "19im82tfdygzo0", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo0\",\"jsonPayload\":{\"bytes_sent\":\"16783\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33568,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789035952Z\",\"packets_sent\":\"79\",\"reporter\":\"SRC\",\"rtt_msec\":\"506\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.456732113Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.456732113Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20742,13 +21630,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789258875Z", "id": "19im82tfdygznd", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznd\",\"jsonPayload\":{\"bytes_sent\":\"18120\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33858},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789258875Z\",\"packets_sent\":\"120\",\"reporter\":\"SRC\",\"rtt_msec\":\"4\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.458361534Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.458361534Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20845,13 +21737,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565319136Z", "id": "19im82tfdygzn8", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzn8\",\"jsonPayload\":{\"bytes_sent\":\"64071\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33558},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565319136Z\",\"packets_sent\":\"368\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140109489Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:00.140109489Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -20948,13 +21844,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.401543207Z", "id": "19im82tfdygznw", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznw\",\"jsonPayload\":{\"bytes_sent\":\"175465\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":53106,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.401543207Z\",\"packets_sent\":\"337\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.020290305Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:01.020290305Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21045,13 +21945,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:58.592579489Z", "id": "19im82tfdygzo2", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo2\",\"jsonPayload\":{\"bytes_sent\":\"1987804\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":9243,\"protocol\":6,\"src_ip\":\"10.49.136.133\",\"src_port\":52780},\"dest_location\":{\"asn\":16509,\"city\":\"Boardman\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Oregon\"},\"end_time\":\"2019-06-14T03:49:58.592579489Z\",\"packets_sent\":\"26428\",\"reporter\":\"SRC\",\"rtt_msec\":\"91\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"simianhacker-demo\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:17.183499423Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:17.183499423Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -21123,13 +22027,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565272745Z", "id": "19im82tfdygzn9", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzn9\",\"jsonPayload\":{\"bytes_sent\":\"206824\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33532,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565272745Z\",\"packets_sent\":\"242\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.072372604Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.072372604Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21226,13 +22134,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789258875Z", "id": "19im82tfdygznh", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznh\",\"jsonPayload\":{\"bytes_sent\":\"14287\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33858,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789258875Z\",\"packets_sent\":\"80\",\"reporter\":\"DEST\",\"rtt_msec\":\"4\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.458361534Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.458361534Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21329,13 +22241,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108649Z", "id": "19im82tfdygzny", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzny\",\"jsonPayload\":{\"bytes_sent\":\"59376\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33550},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108649Z\",\"packets_sent\":\"354\",\"reporter\":\"DEST\",\"rtt_msec\":\"250\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.496238286Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.496238286Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21432,13 +22348,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789035952Z", "id": "19im82tfdygzoe", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzoe\",\"jsonPayload\":{\"bytes_sent\":\"11214\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33568},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789035952Z\",\"packets_sent\":\"120\",\"reporter\":\"DEST\",\"rtt_msec\":\"506\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.456732113Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.456732113Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21535,13 +22455,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.401543207Z", "id": "19im82tfdygznn", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznn\",\"jsonPayload\":{\"bytes_sent\":\"1763338\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":53106},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.401543207Z\",\"packets_sent\":\"598\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.020290305Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:01.020290305Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21650,13 +22574,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565287007Z", "id": "19im82tfdygznl", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznl\",\"jsonPayload\":{\"bytes_sent\":\"67239\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33590},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565287007Z\",\"packets_sent\":\"363\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.146956782Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:05.146956782Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21741,13 +22669,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565319136Z", "id": "19im82tfdygznv", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznv\",\"jsonPayload\":{\"bytes_sent\":\"250327\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33558,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565319136Z\",\"packets_sent\":\"247\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.140109489Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:00.140109489Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21839,13 +22771,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:45:22.318564382Z", "id": "19im82tfdygzoc", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzoc\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"10.73.186.17\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"192.168.2.12\",\"src_port\":44128},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"infraops-docker-data\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:45:22.318564382Z\",\"packets_sent\":\"2\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":4837,\"city\":\"Binzhou\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Shandong\"},\"start_time\":\"2019-06-14T03:45:22.080963433Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:45:22.080963433Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -21934,13 +22870,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108524Z", "id": "19im82tfdygzof", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzof\",\"jsonPayload\":{\"bytes_sent\":\"266531\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33542,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108524Z\",\"packets_sent\":\"253\",\"reporter\":\"SRC\",\"rtt_msec\":\"173\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150870105Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.150870105Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22025,13 +22965,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565026127Z", "id": "19im82tfdygznr", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznr\",\"jsonPayload\":{\"bytes_sent\":\"65184\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33560},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565026127Z\",\"packets_sent\":\"358\",\"reporter\":\"DEST\",\"rtt_msec\":\"116\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:06.076060079Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:06.076060079Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22128,13 +23072,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.597079770Z", "id": "19im82tfdygznx", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznx\",\"jsonPayload\":{\"bytes_sent\":\"319459\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33564},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.597079770Z\",\"packets_sent\":\"180\",\"reporter\":\"DEST\",\"rtt_msec\":\"340\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.866944869Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:08.866944869Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22231,13 +23179,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:46.020466750Z", "id": "19im82tfdygzo7", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzo7\",\"jsonPayload\":{\"bytes_sent\":\"519100\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"192.168.2.177\",\"src_port\":60110},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:46.020466750Z\",\"packets_sent\":\"224\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"suricata-iowa\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:10.874529937Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:10.874529937Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22341,13 +23293,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565108649Z", "id": "19im82tfdygznb", "kind": "event", "original": "{\"insertId\":\"19im82tfdygznb\",\"jsonPayload\":{\"bytes_sent\":\"139513\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33550,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565108649Z\",\"packets_sent\":\"243\",\"reporter\":\"SRC\",\"rtt_msec\":\"250\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:02.143811431Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:02.143811431Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22427,13 +23383,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:40.058226439Z", "id": "19im82tfdygzne", "kind": "event", "original": "{\"insertId\":\"19im82tfdygzne\",\"jsonPayload\":{\"bytes_sent\":\"0\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":41822},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:40.058226439Z\",\"packets_sent\":\"8\",\"reporter\":\"DEST\",\"rtt_msec\":\"1439\",\"src_location\":{\"asn\":4837,\"city\":\"Shangqiu\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Henan\"},\"start_time\":\"2019-06-14T03:40:12.068494835Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.553477088Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.553477088Z\"}", "start": "2019-06-14T03:40:12.068494835Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22528,13 +23488,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821291282Z", "id": "1gq7q7afe373fw", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fw\",\"jsonPayload\":{\"bytes_sent\":\"11109\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33572},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821291282Z\",\"packets_sent\":\"105\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466742414Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.466742414Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22631,13 +23595,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821154389Z", "id": "1gq7q7afe373et", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373et\",\"jsonPayload\":{\"bytes_sent\":\"173496\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33970,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821154389Z\",\"packets_sent\":\"81\",\"reporter\":\"SRC\",\"rtt_msec\":\"308\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470006631Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.470006631Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22722,13 +23690,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565319136Z", "id": "1gq7q7afe373f4", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f4\",\"jsonPayload\":{\"bytes_sent\":\"182861\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33536,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565319136Z\",\"packets_sent\":\"245\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150282980Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.150282980Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22837,13 +23809,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "1gq7q7afe373eo", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373eo\",\"jsonPayload\":{\"bytes_sent\":\"12145\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33570},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"94\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466779642Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.466779642Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -22934,13 +23910,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220617595Z", "id": "1gq7q7afe373fb", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fb\",\"jsonPayload\":{\"bytes_sent\":\"178669\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65319,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220617595Z\",\"packets_sent\":\"634\",\"reporter\":\"SRC\",\"rtt_msec\":\"62\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.740597880Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:39:59.740597880Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -23024,13 +24004,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789258875Z", "id": "1gq7q7afe373fs", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fs\",\"jsonPayload\":{\"bytes_sent\":\"62066\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33540},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789258875Z\",\"packets_sent\":\"359\",\"reporter\":\"SRC\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500483335Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:39:59.500483335Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23115,13 +24099,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821056075Z", "id": "1gq7q7afe373ei", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ei\",\"jsonPayload\":{\"bytes_sent\":\"13440\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33970},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821056075Z\",\"packets_sent\":\"96\",\"reporter\":\"DEST\",\"rtt_msec\":\"308\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.470006631Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.470006631Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23230,13 +24218,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:50.800931420Z", "id": "1gq7q7afe373ez", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ez\",\"jsonPayload\":{\"bytes_sent\":\"368131\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33966,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:50.800931420Z\",\"packets_sent\":\"76\",\"reporter\":\"SRC\",\"rtt_msec\":\"0\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510698570Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:20.510698570Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23333,13 +24325,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565319136Z", "id": "1gq7q7afe373fh", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fh\",\"jsonPayload\":{\"bytes_sent\":\"66258\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33536},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565319136Z\",\"packets_sent\":\"365\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.150282980Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.150282980Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23419,13 +24415,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220621567Z", "id": "1gq7q7afe373es", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373es\",\"jsonPayload\":{\"bytes_sent\":\"76976\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65276},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220621567Z\",\"packets_sent\":\"749\",\"reporter\":\"DEST\",\"rtt_msec\":\"156\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.760349279Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:00.760349279Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23503,13 +24503,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220617595Z", "id": "1gq7q7afe373fu", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fu\",\"jsonPayload\":{\"bytes_sent\":\"72967\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65319},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220617595Z\",\"packets_sent\":\"747\",\"reporter\":\"DEST\",\"rtt_msec\":\"62\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.740597880Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:39:59.740597880Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23587,13 +24591,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:08.797851544Z", "id": "1gq7q7afe373f2", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f2\",\"jsonPayload\":{\"bytes_sent\":\"1464\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":50364},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:40:08.797851544Z\",\"packets_sent\":\"9\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:40:08.412738626Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.412738626Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23682,13 +24690,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:40:08.797851544Z", "id": "1gq7q7afe373ee", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ee\",\"jsonPayload\":{\"bytes_sent\":\"1784\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":50364,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:40:08.797851544Z\",\"packets_sent\":\"8\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.412738626Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.412738626Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -23755,13 +24767,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:50.919744677Z", "id": "1gq7q7afe373ey", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ey\",\"jsonPayload\":{\"bytes_sent\":\"1457\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33126},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:44:50.919744677Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:44:50.809605761Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:44:50.809605761Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23839,13 +24855,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220599950Z", "id": "1gq7q7afe373e7", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373e7\",\"jsonPayload\":{\"bytes_sent\":\"73215\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65318},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.220599950Z\",\"packets_sent\":\"747\",\"reporter\":\"DEST\",\"rtt_msec\":\"96\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.760345858Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:00.760345858Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -23934,13 +24954,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:20.813699795Z", "id": "1gq7q7afe373f8", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f8\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":53096,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:43:20.813699795Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:43:20.700692281Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:43:20.700692281Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -24012,13 +25036,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821302149Z", "id": "1gq7q7afe373ec", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ec\",\"jsonPayload\":{\"bytes_sent\":\"176465\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33570,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821302149Z\",\"packets_sent\":\"65\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466779642Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.466779642Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24121,13 +25149,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:50.919744677Z", "id": "1gq7q7afe373f5", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f5\",\"jsonPayload\":{\"bytes_sent\":\"1776\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33126,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:44:50.919744677Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:44:50.809605761Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:44:50.809605761Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -24194,13 +25226,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:20.566586739Z", "id": "1gq7q7afe373f6", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f6\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":56478},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:47:20.566586739Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:47:20.450631492Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:47:20.450631492Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24295,13 +25331,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:53.081386115Z", "id": "1gq7q7afe373fo", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fo\",\"jsonPayload\":{\"bytes_sent\":\"32764\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":52430,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:53.081386115Z\",\"packets_sent\":\"228\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:07.968717244Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:07.968717244Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24392,13 +25432,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:51.162931667Z", "id": "1gq7q7afe373ek", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ek\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":34536,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:47:51.162931667Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:47:51.050074134Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:47:51.050074134Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -24470,13 +25514,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821291282Z", "id": "1gq7q7afe373fj", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fj\",\"jsonPayload\":{\"bytes_sent\":\"137855\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33572,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821291282Z\",\"packets_sent\":\"72\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466742414Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:08.466742414Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24573,13 +25621,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.789258875Z", "id": "1gq7q7afe373fm", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fm\",\"jsonPayload\":{\"bytes_sent\":\"125197\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33540,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.789258875Z\",\"packets_sent\":\"242\",\"reporter\":\"DEST\",\"rtt_msec\":\"2\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.500483335Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:39:59.500483335Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24676,13 +25728,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.219496168Z", "id": "1gq7q7afe373eg", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373eg\",\"jsonPayload\":{\"bytes_sent\":\"917832\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":53096},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.219496168Z\",\"packets_sent\":\"230\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.853096315Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:01.853096315Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24791,13 +25847,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.219496168Z", "id": "1gq7q7afe373fc", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fc\",\"jsonPayload\":{\"bytes_sent\":\"55572\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":53096,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.219496168Z\",\"packets_sent\":\"133\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:01.853096315Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:01.853096315Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24882,13 +25942,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821049800Z", "id": "1gq7q7afe373eq", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373eq\",\"jsonPayload\":{\"bytes_sent\":\"4615\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33966},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821049800Z\",\"packets_sent\":\"75\",\"reporter\":\"DEST\",\"rtt_msec\":\"0\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:20.510698570Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:20.510698570Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -24991,13 +26055,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220599950Z", "id": "1gq7q7afe373ev", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ev\",\"jsonPayload\":{\"bytes_sent\":\"75612\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65318,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220599950Z\",\"packets_sent\":\"583\",\"reporter\":\"SRC\",\"rtt_msec\":\"96\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.760345858Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:00.760345858Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -25064,13 +26132,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:51.162931667Z", "id": "1gq7q7afe373em", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373em\",\"jsonPayload\":{\"bytes_sent\":\"1461\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":34536},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:47:51.162931667Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:47:51.050074134Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:47:51.050074134Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25159,13 +26231,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:20.566586739Z", "id": "1gq7q7afe373ew", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ew\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":56478,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:47:20.566586739Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:47:20.450631492Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:47:20.450631492Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -25249,13 +26325,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "1gq7q7afe373e9", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373e9\",\"jsonPayload\":{\"bytes_sent\":\"64140\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":33694},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"371\",\"reporter\":\"SRC\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.566359759Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:05.566359759Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25335,13 +26415,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:43:20.813699795Z", "id": "1gq7q7afe373f9", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f9\",\"jsonPayload\":{\"bytes_sent\":\"1458\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":53096},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:43:20.813699795Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:43:20.700692281Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:43:20.700692281Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25424,13 +26508,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:59.565311154Z", "id": "1gq7q7afe373f1", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373f1\",\"jsonPayload\":{\"bytes_sent\":\"231764\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":33694,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:59.565311154Z\",\"packets_sent\":\"251\",\"reporter\":\"DEST\",\"rtt_msec\":\"1\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:05.566359759Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:05.566359759Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25533,13 +26621,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.220621567Z", "id": "1gq7q7afe373ff", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373ff\",\"jsonPayload\":{\"bytes_sent\":\"107878\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65276,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.220621567Z\",\"packets_sent\":\"614\",\"reporter\":\"SRC\",\"rtt_msec\":\"156\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.760349279Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:00.760349279Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -25611,13 +26703,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:53.081386115Z", "id": "1gq7q7afe373fq", "kind": "event", "original": "{\"insertId\":\"1gq7q7afe373fq\",\"jsonPayload\":{\"bytes_sent\":\"595838\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":52430},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:53.081386115Z\",\"packets_sent\":\"299\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-central1\",\"vm_name\":\"zeek-nsm\",\"zone\":\"us-central1-a\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:07.968717244Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:17.76361854Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:17.76361854Z\"}", "start": "2019-06-14T03:40:07.968717244Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25720,13 +26816,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:10.630345069Z", "id": "14iipwlfd8t01n", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01n\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":56410,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:47:10.630345069Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"37\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:47:10.514594429Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:47:10.514594429Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -25799,13 +26899,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:50.757658840Z", "id": "14iipwlfd8t01j", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01j\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":51950,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:41:50.757658840Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:41:50.645030007Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:41:50.645030007Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -25889,13 +26993,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933154111Z", "id": "14iipwlfd8t01o", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01o\",\"jsonPayload\":{\"bytes_sent\":\"361966\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33876,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933154111Z\",\"packets_sent\":\"80\",\"reporter\":\"SRC\",\"rtt_msec\":\"34\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466868771Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:08.466868771Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -25975,13 +27083,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:50.757658840Z", "id": "14iipwlfd8t01p", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01p\",\"jsonPayload\":{\"bytes_sent\":\"1457\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":51950},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:41:50.757658840Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:41:50.645030007Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:41:50.645030007Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26060,13 +27172,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:50.856250208Z", "id": "14iipwlfd8t01e", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01e\",\"jsonPayload\":{\"bytes_sent\":\"1781\",\"connection\":{\"dest_ip\":\"192.168.2.117\",\"dest_port\":58658,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:49:50.856250208Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:49:50.733935895Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:49:50.733935895Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26133,13 +27249,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:08.213471928Z", "id": "14iipwlfd8t01q", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01q\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":59924},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:41:08.213471928Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:41:08.092659117Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:41:08.092659117Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26217,13 +27337,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:50.856250208Z", "id": "14iipwlfd8t01i", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01i\",\"jsonPayload\":{\"bytes_sent\":\"1461\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"192.168.2.117\",\"src_port\":58658},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:50.856250208Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"36\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:49:50.733935895Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:49:50.733935895Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26307,13 +27431,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316981133Z", "id": "14iipwlfd8t01k", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01k\",\"jsonPayload\":{\"bytes_sent\":\"123732\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65272,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.316981133Z\",\"packets_sent\":\"618\",\"reporter\":\"SRC\",\"rtt_msec\":\"123\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:39:59.403442252Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:39:59.403442252Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26380,13 +27508,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316930467Z", "id": "14iipwlfd8t01f", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01f\",\"jsonPayload\":{\"bytes_sent\":\"76342\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65273},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.316930467Z\",\"packets_sent\":\"710\",\"reporter\":\"DEST\",\"rtt_msec\":\"115\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.155378287Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:00.155378287Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26472,13 +27604,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:44:23.955039461Z", "id": "14iipwlfd8t018", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t018\",\"jsonPayload\":{\"bytes_sent\":\"9761\",\"connection\":{\"dest_ip\":\"192.168.2.73\",\"dest_port\":45224,\"protocol\":6,\"src_ip\":\"10.73.186.17\",\"src_port\":22},\"dest_location\":{\"asn\":4847,\"city\":\"Beijing\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Beijing\"},\"end_time\":\"2019-06-14T03:44:23.955039461Z\",\"packets_sent\":\"13\",\"reporter\":\"SRC\",\"rtt_msec\":\"242\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"infraops-docker-data\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:42:23.705320616Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:42:23.705320616Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26545,13 +27681,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:47:10.630345069Z", "id": "14iipwlfd8t01a", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01a\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":56410},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:47:10.630345069Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"rtt_msec\":\"37\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:47:10.514594429Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:47:10.514594429Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26640,13 +27780,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316890309Z", "id": "14iipwlfd8t017", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t017\",\"jsonPayload\":{\"bytes_sent\":\"51612\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65277,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.316890309Z\",\"packets_sent\":\"615\",\"reporter\":\"SRC\",\"rtt_msec\":\"95\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.760385211Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:00.760385211Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26713,13 +27857,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316981133Z", "id": "14iipwlfd8t01m", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01m\",\"jsonPayload\":{\"bytes_sent\":\"74330\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65272},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.316981133Z\",\"packets_sent\":\"745\",\"reporter\":\"DEST\",\"rtt_msec\":\"123\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:39:59.403442252Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:39:59.403442252Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -26808,13 +27956,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:41:08.213471928Z", "id": "14iipwlfd8t015", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t015\",\"jsonPayload\":{\"bytes_sent\":\"1784\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":59924,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:41:08.213471928Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"rtt_msec\":\"36\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:41:08.092659117Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:41:08.092659117Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26892,13 +28044,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316930467Z", "id": "14iipwlfd8t01h", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01h\",\"jsonPayload\":{\"bytes_sent\":\"76622\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":65273,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"end_time\":\"2019-06-14T03:49:56.316930467Z\",\"packets_sent\":\"599\",\"reporter\":\"SRC\",\"rtt_msec\":\"115\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:00.155378287Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:00.155378287Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -26965,13 +28121,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:42:24.922448897Z", "id": "14iipwlfd8t019", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t019\",\"jsonPayload\":{\"bytes_sent\":\"42\",\"connection\":{\"dest_ip\":\"10.73.186.17\",\"dest_port\":22,\"protocol\":6,\"src_ip\":\"192.168.2.73\",\"src_port\":45224},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"infraops-docker-data\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:42:24.922448897Z\",\"packets_sent\":\"5\",\"reporter\":\"DEST\",\"rtt_msec\":\"242\",\"src_location\":{\"asn\":4847,\"city\":\"Beijing\",\"continent\":\"Asia\",\"country\":\"chn\",\"region\":\"Beijing\"},\"start_time\":\"2019-06-14T03:42:23.705320616Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:42:23.705320616Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -27046,13 +28206,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:56.316890309Z", "id": "14iipwlfd8t016", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t016\",\"jsonPayload\":{\"bytes_sent\":\"75263\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":65277},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:56.316890309Z\",\"packets_sent\":\"729\",\"reporter\":\"DEST\",\"rtt_msec\":\"95\",\"src_location\":{\"asn\":33652,\"city\":\"Broomfield\",\"continent\":\"America\",\"country\":\"usa\",\"region\":\"Colorado\"},\"start_time\":\"2019-06-14T03:40:00.760385211Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:00.760385211Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -27141,13 +28305,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:10.529592195Z", "id": "14iipwlfd8t01c", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01c\",\"jsonPayload\":{\"bytes_sent\":\"1780\",\"connection\":{\"dest_ip\":\"67.43.156.14\",\"dest_port\":34646,\"protocol\":6,\"src_ip\":\"10.87.40.76\",\"src_port\":5601},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"end_time\":\"2019-06-14T03:48:10.529592195Z\",\"packets_sent\":\"7\",\"reporter\":\"SRC\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:48:10.413494375Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:48:10.413494375Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "source": { @@ -27211,13 +28379,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:48:10.529541195Z", "id": "14iipwlfd8t01d", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01d\",\"jsonPayload\":{\"bytes_sent\":\"1467\",\"connection\":{\"dest_ip\":\"10.87.40.76\",\"dest_port\":5601,\"protocol\":6,\"src_ip\":\"67.43.156.14\",\"src_port\":34646},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:48:10.529541195Z\",\"packets_sent\":\"7\",\"reporter\":\"DEST\",\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"start_time\":\"2019-06-14T03:48:10.413397239Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:48:10.413397239Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -27297,13 +28469,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:37.933154111Z", "id": "14iipwlfd8t01g", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01g\",\"jsonPayload\":{\"bytes_sent\":\"5044\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33876},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:37.933154111Z\",\"packets_sent\":\"87\",\"reporter\":\"DEST\",\"rtt_msec\":\"34\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.466868771Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:08.466868771Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -27400,13 +28576,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821056075Z", "id": "14iipwlfd8t01l", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01l\",\"jsonPayload\":{\"bytes_sent\":\"14132\",\"connection\":{\"dest_ip\":\"10.139.99.242\",\"dest_port\":9200,\"protocol\":6,\"src_ip\":\"67.43.156.13\",\"src_port\":33574},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821056075Z\",\"packets_sent\":\"91\",\"reporter\":\"DEST\",\"rtt_msec\":\"509\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"src_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.468484109Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:08.468484109Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -27515,13 +28695,17 @@ "version": "8.8.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "end": "2019-06-14T03:49:51.821129119Z", "id": "14iipwlfd8t01b", "kind": "event", "original": "{\"insertId\":\"14iipwlfd8t01b\",\"jsonPayload\":{\"bytes_sent\":\"151213\",\"connection\":{\"dest_ip\":\"67.43.156.13\",\"dest_port\":33574,\"protocol\":6,\"src_ip\":\"10.139.99.242\",\"src_port\":9200},\"dest_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"kibana\",\"zone\":\"us-east1-b\"},\"dest_location\":{\"asn\":15169,\"continent\":\"America\",\"country\":\"usa\"},\"dest_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"end_time\":\"2019-06-14T03:49:51.821129119Z\",\"packets_sent\":\"68\",\"reporter\":\"SRC\",\"rtt_msec\":\"509\",\"src_instance\":{\"project_id\":\"my-sample-project\",\"region\":\"us-east1\",\"vm_name\":\"elasticsearch\",\"zone\":\"us-east1-b\"},\"src_vpc\":{\"project_id\":\"my-sample-project\",\"subnetwork_name\":\"default\",\"vpc_name\":\"default\"},\"start_time\":\"2019-06-14T03:40:08.468484109Z\"},\"logName\":\"projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows\",\"receiveTimestamp\":\"2019-06-14T03:50:19.219174745Z\",\"resource\":{\"labels\":{\"location\":\"us-east1-b\",\"project_id\":\"my-sample-project\",\"subnetwork_id\":\"758019854043528829\",\"subnetwork_name\":\"default\"},\"type\":\"gce_subnetwork\"},\"timestamp\":\"2019-06-14T03:50:19.219174745Z\"}", "start": "2019-06-14T03:40:08.468484109Z", - "type": "connection" + "type": [ + "connection" + ] }, "gcp": { "destination": { diff --git a/packages/gcp/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml b/packages/gcp/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml index 3190cccc517..d818638857f 100644 --- a/packages/gcp/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/gcp/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml @@ -26,10 +26,10 @@ processors: - set: field: event.kind value: event - - set: + - append: field: event.category value: network - - set: + - append: field: event.type value: connection - set: diff --git a/packages/gcp/data_stream/vpcflow/sample_event.json b/packages/gcp/data_stream/vpcflow/sample_event.json index 460ecbba53b..58ab1b2b73b 100644 --- a/packages/gcp/data_stream/vpcflow/sample_event.json +++ b/packages/gcp/data_stream/vpcflow/sample_event.json @@ -1,14 +1,19 @@ { "@timestamp": "2019-06-14T03:50:10.845Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "a47f1e8b-f681-4e3b-87cd-6b2d54144577", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { - "provider": "gcp" + "availability_zone": "us-east1-b", + "project": { + "id": "my-sample-project" + }, + "provider": "gcp", + "region": "us-east1" }, "data_stream": { "dataset": "gcp.vpcflow", @@ -16,30 +21,46 @@ "type": "logs" }, "destination": { - "address": "10.87.40.76", + "address": "67.43.156.13", + "as": { + "number": 35908 + }, "domain": "kibana", - "ip": "10.87.40.76", - "port": 5601 + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.13", + "port": 33548 }, "ecs": { "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:03:19.118Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:56:47.758Z", "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:40:37.048196137Z", - "id": "ut8lbrffooxzf", - "ingested": "2023-01-13T15:03:20Z", + "end": "2019-06-14T03:49:56.393651211Z", + "id": "ut8lbrffooxz4", + "ingested": "2023-07-19T18:56:51Z", "kind": "event", - "start": "2019-06-14T03:40:36.895188084Z", - "type": "connection" + "start": "2019-06-14T03:40:05.147252064Z", + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -54,10 +75,22 @@ "vpc_name": "default" } }, + "source": { + "instance": { + "project_id": "my-sample-project", + "region": "us-east1", + "zone": "us-east1-b" + }, + "vpc": { + "project_id": "my-sample-project", + "subnetwork_name": "default", + "vpc_name": "default" + } + }, "vpcflow": { - "reporter": "DEST", + "reporter": "SRC", "rtt": { - "ms": 36 + "ms": 50 } } }, @@ -68,33 +101,28 @@ "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" }, "network": { - "bytes": 1464, - "community_id": "1:++9/JiESSUdwTGGcxwXk4RA0lY8=", - "direction": "inbound", + "bytes": 159704, + "community_id": "1:+S3/6PF+UXU7wlJD68HIrz0Mo6c=", + "direction": "internal", "iana_number": "6", - "packets": 7, + "name": "default", + "packets": 241, "transport": "tcp", "type": "ipv4" }, "related": { "ip": [ - "192.168.2.117", - "10.87.40.76" + "10.139.99.242", + "67.43.156.13" ] }, "source": { - "address": "192.168.2.117", - "as": { - "number": 15169 - }, - "bytes": 1464, - "geo": { - "continent_name": "America", - "country_name": "usa" - }, - "ip": "192.168.2.117", - "packets": 7, - "port": 50646 + "address": "10.139.99.242", + "bytes": 159704, + "domain": "elasticsearch", + "ip": "10.139.99.242", + "packets": 241, + "port": 9200 }, "tags": [ "forwarded", diff --git a/packages/gcp/docs/README.md b/packages/gcp/docs/README.md index 154da3b370f..f81903280ee 100644 --- a/packages/gcp/docs/README.md +++ b/packages/gcp/docs/README.md @@ -271,7 +271,7 @@ The `audit` dataset collects audit logs of administrative activities and accesse | gcp.audit.request_metadata.caller_ip | The IP address of the caller. | ip | | gcp.audit.request_metadata.caller_supplied_user_agent | The user agent of the caller. This information is not authenticated and should be treated accordingly. | keyword | | gcp.audit.request_metadata.raw.caller_ip | The raw IP address of the caller. | keyword | -| gcp.audit.resource_location.current_locations | Current locations of the resource. | array | +| gcp.audit.resource_location.current_locations | Current locations of the resource. | keyword | | gcp.audit.resource_name | The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. | keyword | | gcp.audit.response | | flattened | | gcp.audit.service_name | The name of the API service performing the operation. For example, datastore.googleapis.com. | keyword | @@ -358,11 +358,11 @@ An example event for `audit` looks as following: { "@timestamp": "2019-12-19T00:44:25.051Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "7780bdcf-661a-4891-83bd-dd5233873f9d", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "client": { "user": { @@ -384,9 +384,9 @@ An example event for `audit` looks as following: "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "beta.compute.instances.aggregatedList", @@ -395,10 +395,10 @@ An example event for `audit` looks as following: "network", "configuration" ], - "created": "2023-01-13T14:59:20.459Z", + "created": "2023-07-19T18:53:36.388Z", "dataset": "gcp.audit", "id": "yonau2dg2zi", - "ingested": "2023-01-13T14:59:21Z", + "ingested": "2023-07-19T18:53:40Z", "kind": "event", "outcome": "success", "provider": "data_access", @@ -540,7 +540,7 @@ The `firewall` dataset collects logs from Firewall Rules in your Virtual Private | gcp.firewall.rule_details.action | Action that the rule performs on match. | keyword | | gcp.firewall.rule_details.destination_range | List of destination ranges that the firewall applies to. | keyword | | gcp.firewall.rule_details.direction | Direction of traffic that matches this rule. | keyword | -| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | array | +| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | nested | | gcp.firewall.rule_details.priority | The priority for the firewall rule. | long | | gcp.firewall.rule_details.reference | Reference to the firewall rule. | keyword | | gcp.firewall.rule_details.source_range | List of source ranges that the firewall rule applies to. | keyword | @@ -611,11 +611,11 @@ An example event for `firewall` looks as following: { "@timestamp": "2019-10-30T13:52:42.191Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "cf009128-e43c-42e4-9158-9b088bd6f3f5", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { "availability_zone": "us-east1-b", @@ -640,20 +640,25 @@ An example event for `firewall` looks as following: "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "firewall-rule", "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:01:23.807Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:55:10.718Z", "dataset": "gcp.firewall", "id": "1f21ciqfpfssuo", - "ingested": "2023-01-13T15:01:24Z", + "ingested": "2023-07-19T18:55:14Z", "kind": "event", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { @@ -859,14 +864,19 @@ An example event for `vpcflow` looks as following: { "@timestamp": "2019-06-14T03:50:10.845Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "a47f1e8b-f681-4e3b-87cd-6b2d54144577", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { - "provider": "gcp" + "availability_zone": "us-east1-b", + "project": { + "id": "my-sample-project" + }, + "provider": "gcp", + "region": "us-east1" }, "data_stream": { "dataset": "gcp.vpcflow", @@ -874,30 +884,46 @@ An example event for `vpcflow` looks as following: "type": "logs" }, "destination": { - "address": "10.87.40.76", + "address": "67.43.156.13", + "as": { + "number": 35908 + }, "domain": "kibana", - "ip": "10.87.40.76", - "port": 5601 + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.13", + "port": 33548 }, "ecs": { "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:03:19.118Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:56:47.758Z", "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:40:37.048196137Z", - "id": "ut8lbrffooxzf", - "ingested": "2023-01-13T15:03:20Z", + "end": "2019-06-14T03:49:56.393651211Z", + "id": "ut8lbrffooxz4", + "ingested": "2023-07-19T18:56:51Z", "kind": "event", - "start": "2019-06-14T03:40:36.895188084Z", - "type": "connection" + "start": "2019-06-14T03:40:05.147252064Z", + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -912,10 +938,22 @@ An example event for `vpcflow` looks as following: "vpc_name": "default" } }, + "source": { + "instance": { + "project_id": "my-sample-project", + "region": "us-east1", + "zone": "us-east1-b" + }, + "vpc": { + "project_id": "my-sample-project", + "subnetwork_name": "default", + "vpc_name": "default" + } + }, "vpcflow": { - "reporter": "DEST", + "reporter": "SRC", "rtt": { - "ms": 36 + "ms": 50 } } }, @@ -926,33 +964,28 @@ An example event for `vpcflow` looks as following: "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" }, "network": { - "bytes": 1464, - "community_id": "1:++9/JiESSUdwTGGcxwXk4RA0lY8=", - "direction": "inbound", + "bytes": 159704, + "community_id": "1:+S3/6PF+UXU7wlJD68HIrz0Mo6c=", + "direction": "internal", "iana_number": "6", - "packets": 7, + "name": "default", + "packets": 241, "transport": "tcp", "type": "ipv4" }, "related": { "ip": [ - "192.168.2.117", - "10.87.40.76" + "10.139.99.242", + "67.43.156.13" ] }, "source": { - "address": "192.168.2.117", - "as": { - "number": 15169 - }, - "bytes": 1464, - "geo": { - "continent_name": "America", - "country_name": "usa" - }, - "ip": "192.168.2.117", - "packets": 7, - "port": 50646 + "address": "10.139.99.242", + "bytes": 159704, + "domain": "elasticsearch", + "ip": "10.139.99.242", + "packets": 241, + "port": 9200 }, "tags": [ "forwarded", @@ -1523,75 +1556,75 @@ The `compute` dataset is designed to fetch metrics for [Compute Engine](https:// **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.compute.firewall.dropped.bytes | Incoming bytes dropped by the firewall | long | -| gcp.compute.firewall.dropped_packets_count.value | Incoming packets dropped by the firewall | long | -| gcp.compute.instance.cpu.reserved_cores.value | Number of cores reserved on the host of the instance | double | -| gcp.compute.instance.cpu.usage.pct | The fraction of the allocated CPU that is currently in use on the instance | double | -| gcp.compute.instance.cpu.usage_time.sec | Usage for all cores in seconds | double | -| gcp.compute.instance.disk.read.bytes | Count of bytes read from disk | long | -| gcp.compute.instance.disk.read_ops_count.value | Count of disk read IO operations | long | -| gcp.compute.instance.disk.write.bytes | Count of bytes written to disk | long | -| gcp.compute.instance.disk.write_ops_count.value | Count of disk write IO operations | long | -| gcp.compute.instance.memory.balloon.ram_size.value | The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.ram_used.value | Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.swap_in.bytes | The amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.swap_out.bytes | The amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.network.egress.bytes | Count of bytes sent over the network | long | -| gcp.compute.instance.network.egress.packets.count | Count of packets sent over the network | long | -| gcp.compute.instance.network.ingress.bytes | Count of bytes received from the network | long | -| gcp.compute.instance.network.ingress.packets.count | Count of packets received from the network | long | -| gcp.compute.instance.uptime.sec | Number of seconds the VM has been running. | long | -| gcp.compute.instance.uptime_total.sec | Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.compute.firewall.dropped.bytes | Delta of incoming bytes dropped by the firewall | long | gauge | +| gcp.compute.firewall.dropped_packets_count.value | Delta of incoming packets dropped by the firewall | long | gauge | +| gcp.compute.instance.cpu.reserved_cores.value | Number of cores reserved on the host of the instance | double | gauge | +| gcp.compute.instance.cpu.usage.pct | The fraction of the allocated CPU that is currently in use on the instance | double | gauge | +| gcp.compute.instance.cpu.usage_time.sec | Delta of usage for all cores in seconds | double | gauge | +| gcp.compute.instance.disk.read.bytes | Delta of count of bytes read from disk | long | gauge | +| gcp.compute.instance.disk.read_ops_count.value | Delta of count of disk read IO operations | long | gauge | +| gcp.compute.instance.disk.write.bytes | Delta of count of bytes written to disk | long | gauge | +| gcp.compute.instance.disk.write_ops_count.value | Delta of count of disk write IO operations | long | gauge | +| gcp.compute.instance.memory.balloon.ram_size.value | The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.ram_used.value | Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.swap_in.bytes | Delta of the amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.swap_out.bytes | Delta of the amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.network.egress.bytes | Delta of count of bytes sent over the network | long | gauge | +| gcp.compute.instance.network.egress.packets.count | Delta of count of packets sent over the network | long | gauge | +| gcp.compute.instance.network.ingress.bytes | Delta of count of bytes received from the network | long | gauge | +| gcp.compute.instance.network.ingress.packets.count | Delta of count of packets received from the network | long | gauge | +| gcp.compute.instance.uptime.sec | Delta of number of seconds the VM has been running. | long | gauge | +| gcp.compute.instance.uptime_total.sec | Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `compute` looks as following: @@ -1689,78 +1722,78 @@ The `dataproc` dataset is designed to fetch metrics from [Dataproc](https://clou **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.dataproc.batch.spark.executors.count | Indicates the number of Batch Spark executors. | long | -| gcp.dataproc.cluster.hdfs.datanodes.count | Indicates the number of HDFS DataNodes that are running inside a cluster. | long | -| gcp.dataproc.cluster.hdfs.storage_capacity.value | Indicates capacity of HDFS system running on cluster in GB. | double | -| gcp.dataproc.cluster.hdfs.storage_utilization.value | The percentage of HDFS storage currently used. | double | -| gcp.dataproc.cluster.hdfs.unhealthy_blocks.count | Indicates the number of unhealthy blocks inside the cluster. | long | -| gcp.dataproc.cluster.job.completion_time.value | The time jobs took to complete from the time the user submits a job to the time Dataproc reports it is completed. | object | -| gcp.dataproc.cluster.job.duration.value | The time jobs have spent in a given state. | object | -| gcp.dataproc.cluster.job.failed.count | Indicates the number of jobs that have failed on a cluster. | long | -| gcp.dataproc.cluster.job.running.count | Indicates the number of jobs that are running on a cluster. | long | -| gcp.dataproc.cluster.job.submitted.count | Indicates the number of jobs that have been submitted to a cluster. | long | -| gcp.dataproc.cluster.operation.completion_time.value | The time operations took to complete from the time the user submits a operation to the time Dataproc reports it is completed. | object | -| gcp.dataproc.cluster.operation.duration.value | The time operations have spent in a given state. | object | -| gcp.dataproc.cluster.operation.failed.count | Indicates the number of operations that have failed on a cluster. | long | -| gcp.dataproc.cluster.operation.running.count | Indicates the number of operations that are running on a cluster. | long | -| gcp.dataproc.cluster.operation.submitted.count | Indicates the number of operations that have been submitted to a cluster. | long | -| gcp.dataproc.cluster.yarn.allocated_memory_percentage.value | The percentage of YARN memory is allocated. | double | -| gcp.dataproc.cluster.yarn.apps.count | Indicates the number of active YARN applications. | long | -| gcp.dataproc.cluster.yarn.containers.count | Indicates the number of YARN containers. | long | -| gcp.dataproc.cluster.yarn.memory_size.value | Indicates the YARN memory size in GB. | double | -| gcp.dataproc.cluster.yarn.nodemanagers.count | Indicates the number of YARN NodeManagers running inside cluster. | long | -| gcp.dataproc.cluster.yarn.pending_memory_size.value | The current memory request, in GB, that is pending to be fulfilled by the scheduler. | double | -| gcp.dataproc.cluster.yarn.virtual_cores.count | Indicates the number of virtual cores in YARN. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.dataproc.batch.spark.executors.count | Indicates the number of Batch Spark executors. | long | gauge | +| gcp.dataproc.cluster.hdfs.datanodes.count | Indicates the number of HDFS DataNodes that are running inside a cluster. | long | gauge | +| gcp.dataproc.cluster.hdfs.storage_capacity.value | Indicates capacity of HDFS system running on cluster in GB. | double | gauge | +| gcp.dataproc.cluster.hdfs.storage_utilization.value | The percentage of HDFS storage currently used. | double | gauge | +| gcp.dataproc.cluster.hdfs.unhealthy_blocks.count | Indicates the number of unhealthy blocks inside the cluster. | long | gauge | +| gcp.dataproc.cluster.job.completion_time.value | The time jobs took to complete from the time the user submits a job to the time Dataproc reports it is completed. | object | | +| gcp.dataproc.cluster.job.duration.value | The time jobs have spent in a given state. | object | | +| gcp.dataproc.cluster.job.failed.count | Indicates the delta of the number of jobs that have failed on a cluster. | long | gauge | +| gcp.dataproc.cluster.job.running.count | Indicates the number of jobs that are running on a cluster. | long | gauge | +| gcp.dataproc.cluster.job.submitted.count | Indicates the delta of the number of jobs that have been submitted to a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.completion_time.value | The time operations took to complete from the time the user submits a operation to the time Dataproc reports it is completed. | object | | +| gcp.dataproc.cluster.operation.duration.value | The time operations have spent in a given state. | object | | +| gcp.dataproc.cluster.operation.failed.count | Indicates the delta of the number of operations that have failed on a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.running.count | Indicates the number of operations that are running on a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.submitted.count | Indicates the delta of the number of operations that have been submitted to a cluster. | long | gauge | +| gcp.dataproc.cluster.yarn.allocated_memory_percentage.value | The percentage of YARN memory is allocated. | double | gauge | +| gcp.dataproc.cluster.yarn.apps.count | Indicates the number of active YARN applications. | long | gauge | +| gcp.dataproc.cluster.yarn.containers.count | Indicates the number of YARN containers. | long | gauge | +| gcp.dataproc.cluster.yarn.memory_size.value | Indicates the YARN memory size in GB. | double | gauge | +| gcp.dataproc.cluster.yarn.nodemanagers.count | Indicates the number of YARN NodeManagers running inside cluster. | long | gauge | +| gcp.dataproc.cluster.yarn.pending_memory_size.value | The current memory request, in GB, that is pending to be fulfilled by the scheduler. | double | gauge | +| gcp.dataproc.cluster.yarn.virtual_cores.count | Indicates the number of virtual cores in YARN. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `dataproc` looks as following: @@ -1825,59 +1858,59 @@ The `firestore` dataset fetches metrics from [Firestore](https://cloud.google.co **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.firestore.document.delete.count | The number of successful document deletes. | long | -| gcp.firestore.document.read.count | The number of successful document reads from queries or lookups. | long | -| gcp.firestore.document.write.count | The number of successful document writes. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.firestore.document.delete.count | Delta of the number of successful document deletes. | long | gauge | +| gcp.firestore.document.read.count | Delta of the number of successful document reads from queries or lookups. | long | gauge | +| gcp.firestore.document.write.count | Delta of the number of successful document writes. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `firestore` looks as following: @@ -1946,96 +1979,96 @@ The `gke` dataset is designed to fetch metrics from [GKE](https://cloud.google.c **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.gke.container.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds. | double | -| gcp.gke.container.cpu.limit_cores.value | CPU cores limit of the container. Sampled every 60 seconds. | double | -| gcp.gke.container.cpu.limit_utilization.pct | The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.cpu.request_cores.value | Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.container.cpu.request_utilization.pct | The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.ephemeral_storage.limit.bytes | Local ephemeral storage limit in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.ephemeral_storage.request.bytes | Local ephemeral storage request in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.ephemeral_storage.used.bytes | Local ephemeral storage usage in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.memory.limit.bytes | Memory limit of the container in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.memory.limit_utilization.pct | The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.container.memory.page_fault.count | Number of page faults, broken down by type, major and minor. | long | -| gcp.gke.container.memory.request.bytes | Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.container.memory.request_utilization.pct | The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.memory.used.bytes | Memory usage in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.restart.count | Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.container.uptime.sec | Time in seconds that the container has been running. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.allocatable_cores.value | Number of allocatable CPU cores on the node. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.allocatable_utilization.pct | The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.node.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.total_cores.value | Total number of CPU cores on the node. Sampled every 60 seconds. | double | -| gcp.gke.node.ephemeral_storage.allocatable.bytes | Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.inodes_free.value | Free number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.inodes_total.value | Total number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.total.bytes | Total ephemeral storage bytes on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.used.bytes | Local ephemeral storage bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.allocatable.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.allocatable_utilization.pct | The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.node.memory.total.bytes | Number of bytes of memory allocatable on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.used.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.network.received_bytes.count | Cumulative number of bytes received by the node over the network. Sampled every 60 seconds. | long | -| gcp.gke.node.network.sent_bytes.count | Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds. | long | -| gcp.gke.node.pid_limit.value | The max PID of OS on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.pid_used.value | The number of running process in the OS on the node. Sampled every 60 seconds. | long | -| gcp.gke.node_daemon.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds. | double | -| gcp.gke.node_daemon.memory.used.bytes | Memory usage by the system daemon in bytes. Sampled every 60 seconds. | long | -| gcp.gke.pod.network.received.bytes | Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds. | long | -| gcp.gke.pod.network.sent.bytes | Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds. | long | -| gcp.gke.pod.volume.total.bytes | Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.pod.volume.used.bytes | Number of disk bytes used by the pod. Sampled every 60 seconds. | long | -| gcp.gke.pod.volume.utilization.pct | The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.gke.container.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.container.cpu.limit_cores.value | CPU cores limit of the container. Sampled every 60 seconds. | double | gauge | +| gcp.gke.container.cpu.limit_utilization.pct | The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.cpu.request_cores.value | Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.container.cpu.request_utilization.pct | The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.ephemeral_storage.limit.bytes | Local ephemeral storage limit in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.ephemeral_storage.request.bytes | Local ephemeral storage request in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.ephemeral_storage.used.bytes | Local ephemeral storage usage in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.memory.limit.bytes | Memory limit of the container in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.memory.limit_utilization.pct | The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.container.memory.page_fault.count | Number of page faults, broken down by type, major and minor. | long | counter | +| gcp.gke.container.memory.request.bytes | Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.gke.container.memory.request_utilization.pct | The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.memory.used.bytes | Memory usage in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.restart.count | Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | counter | +| gcp.gke.container.uptime.sec | Time in seconds that the container has been running. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.cpu.allocatable_cores.value | Number of allocatable CPU cores on the node. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.cpu.allocatable_utilization.pct | The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.node.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.node.cpu.total_cores.value | Total number of CPU cores on the node. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.ephemeral_storage.allocatable.bytes | Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.inodes_free.value | Free number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.inodes_total.value | Total number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.total.bytes | Total ephemeral storage bytes on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.used.bytes | Local ephemeral storage bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.allocatable.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.allocatable_utilization.pct | The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.node.memory.total.bytes | Number of bytes of memory allocatable on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.used.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.network.received_bytes.count | Cumulative number of bytes received by the node over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.node.network.sent_bytes.count | Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.node.pid_limit.value | The max PID of OS on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.pid_used.value | The number of running process in the OS on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node_daemon.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.node_daemon.memory.used.bytes | Memory usage by the system daemon in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.pod.network.received.bytes | Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.pod.network.sent.bytes | Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.pod.volume.total.bytes | Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.gke.pod.volume.used.bytes | Number of disk bytes used by the pod. Sampled every 60 seconds. | long | gauge | +| gcp.gke.pod.volume.utilization.pct | The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `gke` looks as following: @@ -2100,85 +2133,85 @@ The `loadbalancing_metrics` dataset is designed to fetch HTTPS, HTTP, and Layer **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.loadbalancing.https.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.backend_request.bytes | The number of bytes sent as requests from HTTP/S load balancer to backends. | long | -| gcp.loadbalancing.https.backend_request.count | The number of requests served by backends of HTTP/S load balancer. | long | -| gcp.loadbalancing.https.backend_response.bytes | The number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. | long | -| gcp.loadbalancing.https.external.regional.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.external.regional.total_latencies.value | A distribution of the latency calculated from when the request was received by the proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.https.frontend_tcp_rtt.value | A distribution of the RTT measured for each connection between client and proxy. | object | -| gcp.loadbalancing.https.internal.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the internal HTTP/S load balancer proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.internal.total_latencies.value | A distribution of the latency calculated from when the request was received by the internal HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.https.request.bytes | The number of bytes sent as requests from clients to HTTP/S load balancer. | long | -| gcp.loadbalancing.https.request.count | The number of requests served by HTTP/S load balancer. | long | -| gcp.loadbalancing.https.response.bytes | The number of bytes sent as responses from HTTP/S load balancer to clients. | long | -| gcp.loadbalancing.https.total_latencies.value | A distribution of the latency calculated from when the request was received by the external HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.l3.external.egress.bytes | The number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. | long | -| gcp.loadbalancing.l3.external.egress_packets.count | The number of packets sent from external TCP/UDP network load balancer backend to client of the flow. | long | -| gcp.loadbalancing.l3.external.ingress.bytes | The number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. | long | -| gcp.loadbalancing.l3.external.ingress_packets.count | The number of packets sent from client to external TCP/UDP network load balancer backend. | long | -| gcp.loadbalancing.l3.external.rtt_latencies.value | A distribution of the round trip time latency, measured over TCP connections for the external network load balancer. | object | -| gcp.loadbalancing.l3.internal.egress.bytes | The number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). | long | -| gcp.loadbalancing.l3.internal.egress_packets.count | The number of packets sent from ILB backend to client of the flow. | long | -| gcp.loadbalancing.l3.internal.ingress.bytes | The number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). | long | -| gcp.loadbalancing.l3.internal.ingress_packets.count | The number of packets sent from client to ILB backend. | long | -| gcp.loadbalancing.l3.internal.rtt_latencies.value | A distribution of RTT measured over TCP connections for internal TCP/UDP load balancer flows. | object | -| gcp.loadbalancing.tcp_ssl_proxy.closed_connections.value | Number of connections that were terminated over TCP/SSL proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.egress.bytes | Number of bytes sent from VM to client using proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.frontend_tcp_rtt.value | A distribution of the smoothed RTT (in ms) measured by the proxy's TCP stack, each minute application layer bytes pass from proxy to client. | object | -| gcp.loadbalancing.tcp_ssl_proxy.ingress.bytes | Number of bytes sent from client to VM using proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.new_connections.value | Number of connections that were created over TCP/SSL proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.open_connections.value | Current number of outstanding connections through the TCP/SSL proxy. | long | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.loadbalancing_metrics.https.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.backend_request.bytes | Delta of the number of bytes sent as requests from HTTP/S load balancer to backends. | long | gauge | +| gcp.loadbalancing_metrics.https.backend_request.count | Delta of the number of requests served by backends of HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.backend_response.bytes | Delta of the number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.external.regional.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.external.regional.total_latencies.value | A distribution of the latency calculated from when the request was received by the proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.https.frontend_tcp_rtt.value | A distribution of the RTT measured for each connection between client and proxy. | object | | +| gcp.loadbalancing_metrics.https.internal.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the internal HTTP/S load balancer proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.internal.total_latencies.value | A distribution of the latency calculated from when the request was received by the internal HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.https.request.bytes | Delta of the number of bytes sent as requests from clients to HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.request.count | Delta of the number of requests served by HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.response.bytes | Delta of the number of bytes sent as responses from HTTP/S load balancer to clients. | long | gauge | +| gcp.loadbalancing_metrics.https.total_latencies.value | A distribution of the latency calculated from when the request was received by the external HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.l3.external.egress.bytes | Delta of the number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.egress_packets.count | Delta of the number of packets sent from external TCP/UDP network load balancer backend to client of the flow. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.ingress.bytes | Delta of the number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.ingress_packets.count | Delta of the number of packets sent from client to external TCP/UDP network load balancer backend. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.rtt_latencies.value | A distribution of the round trip time latency, measured over TCP connections for the external network load balancer. | object | | +| gcp.loadbalancing_metrics.l3.internal.egress.bytes | Delta of the number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.egress_packets.count | Delta of the number of packets sent from ILB backend to client of the flow. | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.ingress.bytes | Delta of the number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.ingress_packets.count | Delta of the number of packets sent from client to ILB backend. | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.rtt_latencies.value | A distribution of RTT measured over TCP connections for internal TCP/UDP load balancer flows. | object | | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.closed_connections.value | Delta of the number of connections that were terminated over TCP/SSL proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.egress.bytes | Delta of the number of bytes sent from VM to client using proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.frontend_tcp_rtt.value | A distribution of the smoothed RTT (in ms) measured by the proxy's TCP stack, each minute application layer bytes pass from proxy to client. | object | | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.ingress.bytes | Delta of the number of bytes sent from client to VM using proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.new_connections.value | Delta of the number of connections that were created over TCP/SSL proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.open_connections.value | Current number of outstanding connections through the TCP/SSL proxy. | long | gauge | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `loadbalancing` looks as following: @@ -2220,7 +2253,7 @@ An example event for `loadbalancing` looks as following: "region": "us-central1" } }, - "loadbalancing": { + "loadbalancing_metrics": { "l3": { "internal": { "egress_packets": { @@ -2283,13 +2316,13 @@ The `redis` dataset is designed to fetch metrics from [GCP Memorystore](https:// | gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | | | gcp.redis.clients.blocked.count | Number of blocked clients. | long | | gauge | | gcp.redis.clients.connected.count | Number of client connections. | long | | gauge | -| gcp.redis.commands.calls.count | Total number of calls for this command in one minute. | long | | counter | -| gcp.redis.commands.total_time.us | The amount of time in microseconds that this command took in the last second. | long | micros | counter | +| gcp.redis.commands.calls.count | Delta of the number of calls for this command in one minute. | long | | gauge | +| gcp.redis.commands.total_time.us | Delta of the amount of time in microseconds that this command took in the last second. | long | micros | gauge | | gcp.redis.commands.usec_per_call.sec | Average time per call over 1 minute by command. | double | s | gauge | | gcp.redis.keyspace.avg_ttl.sec | Average TTL for keys in this database. | double | s | gauge | | gcp.redis.keyspace.keys.count | Number of keys stored in this database. | long | | gauge | | gcp.redis.keyspace.keys_with_expiration.count | Number of keys with an expiration in this database. | long | | gauge | -| gcp.redis.persistence.rdb.bgsave_in_progress | Flag indicating a RDB save is on-going. | boolean | | | +| gcp.redis.persistence.rdb.bgsave_in_progress | Flag indicating a RDB save is on-going. | long | | gauge | | gcp.redis.replication.master.slaves.lag.sec | The number of seconds that replica is lagging behind primary. | long | s | gauge | | gcp.redis.replication.master.slaves.offset.bytes | The number of bytes that have been acknowledged by replicas. | long | byte | gauge | | gcp.redis.replication.master_repl_offset.bytes | The number of bytes that master has produced and sent to replicas. | long | byte | gauge | @@ -2297,18 +2330,18 @@ The `redis` dataset is designed to fetch metrics from [GCP Memorystore](https:// | gcp.redis.replication.role | Returns a value indicating the node role. 1 indicates primary and 0 indicates replica. | long | | gauge | | gcp.redis.server.uptime.sec | Uptime in seconds. | long | s | gauge | | gcp.redis.stats.cache_hit_ratio | Cache Hit ratio as a fraction. | double | | gauge | -| gcp.redis.stats.connections.total.count | Total number of connections accepted by the server. | long | | counter | +| gcp.redis.stats.connections.total.count | Delta of the total number of connections accepted by the server. | long | | gauge | | gcp.redis.stats.cpu_utilization.sec | CPU-seconds consumed by the Redis server, broken down by system/user space and parent/child relationship. | double | s | gauge | -| gcp.redis.stats.evicted_keys.count | Number of evicted keys due to maxmemory limit. | long | | counter | -| gcp.redis.stats.expired_keys.count | Total number of key expiration events. | long | | counter | -| gcp.redis.stats.keyspace_hits.count | Number of successful lookup of keys in the main dictionary. | long | | counter | -| gcp.redis.stats.keyspace_misses.count | Number of failed lookup of keys in the main dictionary. | long | | counter | +| gcp.redis.stats.evicted_keys.count | Delta of the number of evicted keys due to maxmemory limit. | long | | gauge | +| gcp.redis.stats.expired_keys.count | Delta of the total number of key expiration events. | long | | gauge | +| gcp.redis.stats.keyspace_hits.count | Delta of the number of successful lookup of keys in the main dictionary. | long | | gauge | +| gcp.redis.stats.keyspace_misses.count | Delta of the number of failed lookup of keys in the main dictionary. | long | | gauge | | gcp.redis.stats.memory.maxmemory.mb | Maximum amount of memory Redis can consume. | long | m | gauge | | gcp.redis.stats.memory.system_memory_overload_duration.us | The amount of time in microseconds the instance is in system memory overload mode. | long | micros | gauge | | gcp.redis.stats.memory.system_memory_usage_ratio | Memory usage as a ratio of maximum system memory. | double | | gauge | | gcp.redis.stats.memory.usage.bytes | Total number of bytes allocated by Redis. | long | byte | gauge | | gcp.redis.stats.memory.usage_ratio | Memory usage as a ratio of maximum memory. | double | | gauge | -| gcp.redis.stats.network_traffic.bytes | Total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). | long | byte | counter | +| gcp.redis.stats.network_traffic.bytes | Delta of the total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). | long | byte | gauge | | gcp.redis.stats.pubsub.channels.count | Global number of pub/sub channels with client subscriptions. | long | | gauge | | gcp.redis.stats.pubsub.patterns.count | Global number of pub/sub pattern with client subscriptions. | long | | gauge | | gcp.redis.stats.reject_connections.count | Number of connections rejected because of maxclients limit. | long | | gauge | @@ -2392,65 +2425,65 @@ The `storage` dataset fetches metrics from [Storage](https://cloud.google.com/st **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | -| gcp.storage.authz.acl_based_object_access.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | -| gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | -| gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | -| gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | -| gcp.storage.network.sent.bytes | Delta count of bytes sent over the network, grouped by the API method name and response code. | long | -| gcp.storage.storage.object.count | Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | -| gcp.storage.storage.total.bytes | Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | -| gcp.storage.storage.total_byte_seconds.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | gauge | +| gcp.storage.authz.acl_based_object_access.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | gauge | +| gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | gauge | +| gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | gauge | +| gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | gauge | +| gcp.storage.network.sent.bytes | Delta count of bytes sent over the network, grouped by the API method name and response code. | long | gauge | +| gcp.storage.storage.object.count | Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | gauge | +| gcp.storage.storage.total.bytes | Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | gauge | +| gcp.storage.storage.total_byte_seconds.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | gauge | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | An example event for `storage` looks as following: diff --git a/packages/gcp/docs/audit.md b/packages/gcp/docs/audit.md index 36098c134ae..09038d51761 100644 --- a/packages/gcp/docs/audit.md +++ b/packages/gcp/docs/audit.md @@ -60,7 +60,7 @@ The `audit` dataset collects audit logs of administrative activities and accesse | gcp.audit.request_metadata.caller_ip | The IP address of the caller. | ip | | gcp.audit.request_metadata.caller_supplied_user_agent | The user agent of the caller. This information is not authenticated and should be treated accordingly. | keyword | | gcp.audit.request_metadata.raw.caller_ip | The raw IP address of the caller. | keyword | -| gcp.audit.resource_location.current_locations | Current locations of the resource. | array | +| gcp.audit.resource_location.current_locations | Current locations of the resource. | keyword | | gcp.audit.resource_name | The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. For example, 'shelves/SHELF_ID/books'. | keyword | | gcp.audit.response | | flattened | | gcp.audit.service_name | The name of the API service performing the operation. For example, datastore.googleapis.com. | keyword | @@ -147,11 +147,11 @@ An example event for `audit` looks as following: { "@timestamp": "2019-12-19T00:44:25.051Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "7780bdcf-661a-4891-83bd-dd5233873f9d", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "client": { "user": { @@ -173,9 +173,9 @@ An example event for `audit` looks as following: "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "beta.compute.instances.aggregatedList", @@ -184,10 +184,10 @@ An example event for `audit` looks as following: "network", "configuration" ], - "created": "2023-01-13T14:59:20.459Z", + "created": "2023-07-19T18:53:36.388Z", "dataset": "gcp.audit", "id": "yonau2dg2zi", - "ingested": "2023-01-13T14:59:21Z", + "ingested": "2023-07-19T18:53:40Z", "kind": "event", "outcome": "success", "provider": "data_access", diff --git a/packages/gcp/docs/cloudsql.md b/packages/gcp/docs/cloudsql.md new file mode 100644 index 00000000000..4c6a800ab01 --- /dev/null +++ b/packages/gcp/docs/cloudsql.md @@ -0,0 +1,446 @@ +# CloudSQL + +The `cloudsql` dataset fetches metrics from [CloudSQL](https://cloud.google.com/sql) in Google Cloud Platform. It contains all metrics exported from the [GCP CloudSQL Monitoring API](https://cloud.google.com/monitoring/api/metrics_gcp#gcp-cloudsql). + +`gcp.labels.cloudsql.name` label is utilized to identify the type of Google Cloud SQL database that generated the metrics. In the pipelines, this label is crucial for distinguishing between various Cloud SQL database types and directing the metrics to their respective destinations. Current valid values are `mysql`, `postgres` and `sqlserver`. Other values will be dropped. + +## MySQL Metrics + +CloudSQL MySQL metrics. + +An example event for `cloudsql_mysql` looks as following: + +```json +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_mysql", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_mysql": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | | +| error.message | Error message. | match_only_text | | | +| event.dataset | Event dataset | constant_keyword | | | +| event.module | Event module | constant_keyword | | | +| gcp.cloudsql_mysql.database.auto_failover_request.count | Delta of number of instance auto-failover requests. | long | | gauge | +| gcp.cloudsql_mysql.database.available_for_failover | This is \> 0 if the failover operation is available on the instance. | long | | gauge | +| gcp.cloudsql_mysql.database.cpu.reserved_cores.count | Number of cores reserved for the database. | double | | gauge | +| gcp.cloudsql_mysql.database.cpu.usage_time.sec | Delta CPU usage time in seconds. | double | s | gauge | +| gcp.cloudsql_mysql.database.cpu.utilization.pct | Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. | double | percent | gauge | +| gcp.cloudsql_mysql.database.disk.bytes_used.bytes | Data utilization in bytes. | long | byte | gauge | +| gcp.cloudsql_mysql.database.disk.quota.bytes | Maximum data disk size in bytes. | long | byte | gauge | +| gcp.cloudsql_mysql.database.disk.read_ops.count | Delta count of data disk read IO operations. | long | | gauge | +| gcp.cloudsql_mysql.database.disk.utilization.pct | The fraction of the disk quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_mysql.database.disk.write_ops.count | Delta count of data disk write IO operations. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_dirty.count | Number of unflushed pages in the InnoDB buffer pool. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_free.count | Number of unused pages in the InnoDB buffer pool. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_buffer_pool_pages_total.count | Total number of pages in the InnoDB buffer pool. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_data_fsyncs.count | Delta count of InnoDB fsync() calls. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_os_log_fsyncs.count | Delta count of InnoDB fsync() calls to the log file. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_pages_read.count | Delta count of InnoDB pages read. | long | | gauge | +| gcp.cloudsql_mysql.database.innodb_pages_written.count | Delta count of InnoDB pages written. | long | | gauge | +| gcp.cloudsql_mysql.database.instance_state | The current serving state of the Cloud SQL instance. | boolean | | | +| gcp.cloudsql_mysql.database.memory.quota.bytes | Maximum RAM size in bytes. | long | byte | gauge | +| gcp.cloudsql_mysql.database.memory.total_usage.bytes | Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_mysql.database.memory.usage.bytes | RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_mysql.database.memory.utilization.pct | The fraction of the memory quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_mysql.database.network.connections.count | Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. | long | | gauge | +| gcp.cloudsql_mysql.database.network.received_bytes.count | Delta count of bytes received through the network. | long | | gauge | +| gcp.cloudsql_mysql.database.network.sent_bytes.count | Delta count of bytes sent through the network. | long | | gauge | +| gcp.cloudsql_mysql.database.queries.count | Delta count of statements executed by the server. | long | | gauge | +| gcp.cloudsql_mysql.database.questions.count | Delta count of statements executed by the server sent by the client. | long | | gauge | +| gcp.cloudsql_mysql.database.received_bytes.count | Delta count of bytes received by MySQL process. | long | | gauge | +| gcp.cloudsql_mysql.database.replication.last_io_errno | The error number of the most recent error that caused the I/O thread to stop. | long | | gauge | +| gcp.cloudsql_mysql.database.replication.last_sql_errno | The error number of the most recent error that caused the SQL thread to stop. | long | | gauge | +| gcp.cloudsql_mysql.database.replication.network_lag.sec | Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. | long | s | gauge | +| gcp.cloudsql_mysql.database.replication.replica_lag.sec | Number of seconds the read replica is behind its primary (approximation). | double | s | gauge | +| gcp.cloudsql_mysql.database.replication.seconds_behind_master.sec | Number of seconds the read replica is behind its primary (approximation). | long | s | gauge | +| gcp.cloudsql_mysql.database.replication.slave_io_running | Indicates whether the I/O thread for reading the primary's binary log is running. Possible values are Yes, No and Connecting. | keyword | | | +| gcp.cloudsql_mysql.database.replication.slave_io_running_state | Indicates whether the I/O thread for reading the primary's binary log is running. Possible values are Yes, No and Connecting, and the values are exposed through the 'state' field. | boolean | | | +| gcp.cloudsql_mysql.database.replication.slave_sql_running | Indicates whether the SQL thread for executing events in the relay log is running. | keyword | | | +| gcp.cloudsql_mysql.database.replication.slave_sql_running_state | Indicates whether the SQL thread for executing events in the relay log is running. Possible values are Yes / No, and the values are exposed through the 'state' field. | boolean | | | +| gcp.cloudsql_mysql.database.sent_bytes.count | Delta count of bytes sent by MySQL process. | long | | gauge | +| gcp.cloudsql_mysql.database.up | Indicates if the server is up or not. | long | | gauge | +| gcp.cloudsql_mysql.database.uptime.sec | Delta count of the time in seconds the instance has been running. | long | s | gauge | +| gcp.labels.metadata.\* | | object | | | +| gcp.labels.metrics.\* | | object | | | +| gcp.labels.resource.\* | | object | | | +| gcp.labels.system.\* | | object | | | +| gcp.labels.user.\* | | object | | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + + +## PostgreSQL Metrics + +CloudSQL PostgreSQL metrics. + +An example event for `cloudsql_postgresql` looks as following: + +```json +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_postgresql", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_postgresql": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | | +| error.message | Error message. | match_only_text | | | +| event.dataset | Event dataset | constant_keyword | | | +| event.module | Event module | constant_keyword | | | +| gcp.cloudsql_postgresql.database.auto_failover_request.count | Delta of number of instance auto-failover requests. | long | | gauge | +| gcp.cloudsql_postgresql.database.available_for_failover | This is \> 0 if the failover operation is available on the instance. | long | | gauge | +| gcp.cloudsql_postgresql.database.cpu.reserved_cores.count | Number of cores reserved for the database. | double | | gauge | +| gcp.cloudsql_postgresql.database.cpu.usage_time.sec | Delta CPU usage time in seconds. | double | s | gauge | +| gcp.cloudsql_postgresql.database.cpu.utilization.pct | Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. | double | percent | gauge | +| gcp.cloudsql_postgresql.database.disk.bytes_used.bytes | Data utilization in bytes. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.disk.quota.bytes | Maximum data disk size in bytes. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.disk.read_ops.count | Delta count of data disk read IO operations. | long | | gauge | +| gcp.cloudsql_postgresql.database.disk.utilization.pct | The fraction of the disk quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_postgresql.database.disk.write_ops.count | Delta count of data disk write IO operations. | long | | gauge | +| gcp.cloudsql_postgresql.database.insights.aggregate.execution_time | Accumulated query execution time per user per database. This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.aggregate.io_time | Accumulated IO time per user per database. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.aggregate.latencies | Query latency distribution per user per database. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.aggregate.lock_time | Accumulated lock wait time per user per database. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.aggregate.row.count | Total number of rows affected during query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.aggregate.shared_blk_access.count | Shared blocks (regular tables & indexed) accessed by statement execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.perquery.execution_time | Accumulated execution times per user per database per query.This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.perquery.io_time | Accumulated IO time per user per database per query. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.perquery.latencies | Query latency distribution per user per database per query. | histogram | | | +| gcp.cloudsql_postgresql.database.insights.perquery.lock_time | Accumulated lock wait time per user per database per query. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.perquery.row.count | Total number of rows affected during query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.perquery.shared_blk_access.count | Shared blocks (regular tables & indexed) accesssed by statement execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.pertag.execution_time | Accumulated execution times per user per database per tag.This is the sum of cpu time, io wait time, lock wait time, process context switch, and scheduling for all the processes involved in the query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.pertag.io_time | Accumulated IO write time per user per database per tag. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.pertag.latencies | Query latency distribution per user per database per tag. | histogram | | | +| gcp.cloudsql_postgresql.database.insights.pertag.lock_time | Accumulated lock wait time per user per database per tag. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.pertag.row.count | Total number of rows affected during query execution. | long | | counter | +| gcp.cloudsql_postgresql.database.insights.pertag.shared_blk_access.count | Shared blocks (regular tables & indexed) accessed by statement execution. | long | | counter | +| gcp.cloudsql_postgresql.database.instance_state | The current serving state of the Cloud SQL instance. | boolean | | | +| gcp.cloudsql_postgresql.database.memory.quota.bytes | Maximum RAM size in bytes. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.memory.total_usage.bytes | Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.memory.usage.bytes | RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.memory.utilization.pct | The fraction of the memory quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_postgresql.database.network.connections.count | Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. | long | | gauge | +| gcp.cloudsql_postgresql.database.network.received_bytes.count | Delta count of bytes received through the network. | long | | gauge | +| gcp.cloudsql_postgresql.database.network.sent_bytes.count | Delta count of bytes sent through the network. | long | | gauge | +| gcp.cloudsql_postgresql.database.num_backends.count | Number of connections to the Cloud SQL PostgreSQL instance. | long | | gauge | +| gcp.cloudsql_postgresql.database.replication.network_lag.sec | Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. | long | s | gauge | +| gcp.cloudsql_postgresql.database.replication.replica_byte_lag.bytes | Replication lag in bytes. Reported from the master per replica. | long | byte | gauge | +| gcp.cloudsql_postgresql.database.replication.replica_lag.sec | Number of seconds the read replica is behind its primary (approximation). | double | s | gauge | +| gcp.cloudsql_postgresql.database.transaction.count | Delta count of number of transactions. | long | | gauge | +| gcp.cloudsql_postgresql.database.transaction_id.count | Delta count of transaction ID. | long | | gauge | +| gcp.cloudsql_postgresql.database.transaction_id_utilization.pct | Current utilization represented as a percentage of transaction IDs consumed by the Cloud SQL PostgreSQL instance. Values are typically numbers between 0.0 and 1.0. Charts display the values as a percentage between 0% and 100%. | double | percent | gauge | +| gcp.cloudsql_postgresql.database.up | Indicates if the server is up or not. | long | | gauge | +| gcp.cloudsql_postgresql.database.uptime.sec | Delta count of the time in seconds the instance has been running. | long | s | gauge | +| gcp.cloudsql_postgresql.database.vacuum.oldest_transaction_age | Age of the oldest transaction yet to be vacuumed in the Cloud SQL PostgreSQL instance, measured in number of transactions that have happened since the oldest transaction. | long | | gauge | +| gcp.labels.metadata.\* | | object | | | +| gcp.labels.metrics.\* | | object | | | +| gcp.labels.resource.\* | | object | | | +| gcp.labels.system.\* | | object | | | +| gcp.labels.user.\* | | object | | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + + + +## SQL Server Metrics + +CloudSQL SQL Server metrics. + +An example event for `cloudsql_sqlserver` looks as following: + +```json +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.cloudsql_sqlserver", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "cloudsql_sqlserver": { + "database": { + "up": 1 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "metrics", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} +``` + +**Exported fields** + +| Field | Description | Type | Unit | Metric Type | +|---|---|---|---|---| +| @timestamp | Event timestamp. | date | | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.instance.name | Instance name of the host machine. | keyword | | | +| cloud.machine.type | Machine type of the host machine. | keyword | | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | +| container.image.name | Name of the image the container was built on. | keyword | | | +| container.labels | Image labels. | object | | | +| container.name | Container name. | keyword | | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | | +| data_stream.type | Data stream type. | constant_keyword | | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | | +| error.message | Error message. | match_only_text | | | +| event.dataset | Event dataset | constant_keyword | | | +| event.module | Event module | constant_keyword | | | +| gcp.cloudsql_sqlserver.database.audits_size.bytes | Tracks the size in bytes of stored SQLServer audit files on an instance. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.audits_upload.count | Delta count of total number of SQLServer audit file uploads to a GCS bucket and whether or not an upload was successful. | long | | gauge | +| gcp.cloudsql_sqlserver.database.auto_failover_request.count | Delta of number of instance auto-failover requests. | long | | gauge | +| gcp.cloudsql_sqlserver.database.available_for_failover | This is \> 0 if the failover operation is available on the instance. | long | | gauge | +| gcp.cloudsql_sqlserver.database.cpu.reserved_cores.count | Number of cores reserved for the database. | double | | gauge | +| gcp.cloudsql_sqlserver.database.cpu.usage_time.sec | Delta CPU usage time in seconds. | double | s | gauge | +| gcp.cloudsql_sqlserver.database.cpu.utilization.pct | Current CPU utilization represented as a percentage of the reserved CPU that is currently in use. | double | percent | gauge | +| gcp.cloudsql_sqlserver.database.disk.bytes_used.bytes | Data utilization in bytes. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.disk.quota.bytes | Maximum data disk size in bytes. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.disk.read_ops.count | Delta count of data disk read IO operations. | long | | gauge | +| gcp.cloudsql_sqlserver.database.disk.utilization.pct | The fraction of the disk quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_sqlserver.database.disk.write_ops.count | Delta count of data disk write IO operations. | long | | gauge | +| gcp.cloudsql_sqlserver.database.instance_state | The current serving state of the Cloud SQL instance. | boolean | | | +| gcp.cloudsql_sqlserver.database.memory.quota.bytes | Maximum RAM size in bytes. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.memory.total_usage.bytes | Total RAM usage in bytes. This metric reports the RAM usage of the database process, including the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.memory.usage.bytes | RAM usage in bytes. This metric reports the RAM usage of the server, excluding the buffer/cache. | long | byte | gauge | +| gcp.cloudsql_sqlserver.database.memory.utilization.pct | The fraction of the memory quota that is currently in use. | double | percent | gauge | +| gcp.cloudsql_sqlserver.database.network.connections.count | Number of connections to databases on the Cloud SQL instance. Only applicable to MySQL and SQL Server. | long | | gauge | +| gcp.cloudsql_sqlserver.database.network.received_bytes.count | Delta count of bytes received through the network. | long | | gauge | +| gcp.cloudsql_sqlserver.database.network.sent_bytes.count | Delta count of bytes sent through the network. | long | | gauge | +| gcp.cloudsql_sqlserver.database.replication.network_lag.sec | Indicates time taken from primary binary log to IO thread on replica. Only applicable to replicas. | long | s | gauge | +| gcp.cloudsql_sqlserver.database.replication.replica_lag.sec | Number of seconds the read replica is behind its primary (approximation). | double | s | gauge | +| gcp.cloudsql_sqlserver.database.up | Indicates if the server is up or not. | long | | gauge | +| gcp.cloudsql_sqlserver.database.uptime.sec | Delta count of the time in seconds the instance has been running. | long | s | gauge | +| gcp.labels.metadata.\* | | object | | | +| gcp.labels.metrics.\* | | object | | | +| gcp.labels.resource.\* | | object | | | +| gcp.labels.system.\* | | object | | | +| gcp.labels.user.\* | | object | | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | | +| host.architecture | Operating system architecture. | keyword | | | +| host.containerized | If the host is a container. | boolean | | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | +| host.ip | Host ip addresses. | ip | | | +| host.mac | Host mac addresses. | keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | +| host.os.build | OS build information. | keyword | | | +| host.os.codename | OS codename, if any. | keyword | | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | | +| host.os.name | Operating system name, without the version. | keyword | | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | | +| host.os.version | Operating system version as a raw string. | keyword | | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | + diff --git a/packages/gcp/docs/compute.md b/packages/gcp/docs/compute.md index 34b3d0eee8c..a62b13a1cc2 100644 --- a/packages/gcp/docs/compute.md +++ b/packages/gcp/docs/compute.md @@ -101,72 +101,72 @@ An example event for `compute` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.compute.firewall.dropped.bytes | Incoming bytes dropped by the firewall | long | -| gcp.compute.firewall.dropped_packets_count.value | Incoming packets dropped by the firewall | long | -| gcp.compute.instance.cpu.reserved_cores.value | Number of cores reserved on the host of the instance | double | -| gcp.compute.instance.cpu.usage.pct | The fraction of the allocated CPU that is currently in use on the instance | double | -| gcp.compute.instance.cpu.usage_time.sec | Usage for all cores in seconds | double | -| gcp.compute.instance.disk.read.bytes | Count of bytes read from disk | long | -| gcp.compute.instance.disk.read_ops_count.value | Count of disk read IO operations | long | -| gcp.compute.instance.disk.write.bytes | Count of bytes written to disk | long | -| gcp.compute.instance.disk.write_ops_count.value | Count of disk write IO operations | long | -| gcp.compute.instance.memory.balloon.ram_size.value | The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.ram_used.value | Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.swap_in.bytes | The amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.memory.balloon.swap_out.bytes | The amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. | long | -| gcp.compute.instance.network.egress.bytes | Count of bytes sent over the network | long | -| gcp.compute.instance.network.egress.packets.count | Count of packets sent over the network | long | -| gcp.compute.instance.network.ingress.bytes | Count of bytes received from the network | long | -| gcp.compute.instance.network.ingress.packets.count | Count of packets received from the network | long | -| gcp.compute.instance.uptime.sec | Number of seconds the VM has been running. | long | -| gcp.compute.instance.uptime_total.sec | Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.compute.firewall.dropped.bytes | Delta of incoming bytes dropped by the firewall | long | gauge | +| gcp.compute.firewall.dropped_packets_count.value | Delta of incoming packets dropped by the firewall | long | gauge | +| gcp.compute.instance.cpu.reserved_cores.value | Number of cores reserved on the host of the instance | double | gauge | +| gcp.compute.instance.cpu.usage.pct | The fraction of the allocated CPU that is currently in use on the instance | double | gauge | +| gcp.compute.instance.cpu.usage_time.sec | Delta of usage for all cores in seconds | double | gauge | +| gcp.compute.instance.disk.read.bytes | Delta of count of bytes read from disk | long | gauge | +| gcp.compute.instance.disk.read_ops_count.value | Delta of count of disk read IO operations | long | gauge | +| gcp.compute.instance.disk.write.bytes | Delta of count of bytes written to disk | long | gauge | +| gcp.compute.instance.disk.write_ops_count.value | Delta of count of disk write IO operations | long | gauge | +| gcp.compute.instance.memory.balloon.ram_size.value | The total amount of memory in the VM. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.ram_used.value | Memory currently used in the VM. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.swap_in.bytes | Delta of the amount of memory read into the guest from its own swap space. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.memory.balloon.swap_out.bytes | Delta of the amount of memory written from the guest to its own swap space. This metric is only available for VMs that belong to the e2 family. | long | gauge | +| gcp.compute.instance.network.egress.bytes | Delta of count of bytes sent over the network | long | gauge | +| gcp.compute.instance.network.egress.packets.count | Delta of count of packets sent over the network | long | gauge | +| gcp.compute.instance.network.ingress.bytes | Delta of count of bytes received from the network | long | gauge | +| gcp.compute.instance.network.ingress.packets.count | Delta of count of packets received from the network | long | gauge | +| gcp.compute.instance.uptime.sec | Delta of number of seconds the VM has been running. | long | gauge | +| gcp.compute.instance.uptime_total.sec | Elapsed time since the VM was started, in seconds. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/dataproc.md b/packages/gcp/docs/dataproc.md index 0b90005cea8..97c2b4518eb 100644 --- a/packages/gcp/docs/dataproc.md +++ b/packages/gcp/docs/dataproc.md @@ -68,75 +68,75 @@ An example event for `dataproc` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.dataproc.batch.spark.executors.count | Indicates the number of Batch Spark executors. | long | -| gcp.dataproc.cluster.hdfs.datanodes.count | Indicates the number of HDFS DataNodes that are running inside a cluster. | long | -| gcp.dataproc.cluster.hdfs.storage_capacity.value | Indicates capacity of HDFS system running on cluster in GB. | double | -| gcp.dataproc.cluster.hdfs.storage_utilization.value | The percentage of HDFS storage currently used. | double | -| gcp.dataproc.cluster.hdfs.unhealthy_blocks.count | Indicates the number of unhealthy blocks inside the cluster. | long | -| gcp.dataproc.cluster.job.completion_time.value | The time jobs took to complete from the time the user submits a job to the time Dataproc reports it is completed. | object | -| gcp.dataproc.cluster.job.duration.value | The time jobs have spent in a given state. | object | -| gcp.dataproc.cluster.job.failed.count | Indicates the number of jobs that have failed on a cluster. | long | -| gcp.dataproc.cluster.job.running.count | Indicates the number of jobs that are running on a cluster. | long | -| gcp.dataproc.cluster.job.submitted.count | Indicates the number of jobs that have been submitted to a cluster. | long | -| gcp.dataproc.cluster.operation.completion_time.value | The time operations took to complete from the time the user submits a operation to the time Dataproc reports it is completed. | object | -| gcp.dataproc.cluster.operation.duration.value | The time operations have spent in a given state. | object | -| gcp.dataproc.cluster.operation.failed.count | Indicates the number of operations that have failed on a cluster. | long | -| gcp.dataproc.cluster.operation.running.count | Indicates the number of operations that are running on a cluster. | long | -| gcp.dataproc.cluster.operation.submitted.count | Indicates the number of operations that have been submitted to a cluster. | long | -| gcp.dataproc.cluster.yarn.allocated_memory_percentage.value | The percentage of YARN memory is allocated. | double | -| gcp.dataproc.cluster.yarn.apps.count | Indicates the number of active YARN applications. | long | -| gcp.dataproc.cluster.yarn.containers.count | Indicates the number of YARN containers. | long | -| gcp.dataproc.cluster.yarn.memory_size.value | Indicates the YARN memory size in GB. | double | -| gcp.dataproc.cluster.yarn.nodemanagers.count | Indicates the number of YARN NodeManagers running inside cluster. | long | -| gcp.dataproc.cluster.yarn.pending_memory_size.value | The current memory request, in GB, that is pending to be fulfilled by the scheduler. | double | -| gcp.dataproc.cluster.yarn.virtual_cores.count | Indicates the number of virtual cores in YARN. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.dataproc.batch.spark.executors.count | Indicates the number of Batch Spark executors. | long | gauge | +| gcp.dataproc.cluster.hdfs.datanodes.count | Indicates the number of HDFS DataNodes that are running inside a cluster. | long | gauge | +| gcp.dataproc.cluster.hdfs.storage_capacity.value | Indicates capacity of HDFS system running on cluster in GB. | double | gauge | +| gcp.dataproc.cluster.hdfs.storage_utilization.value | The percentage of HDFS storage currently used. | double | gauge | +| gcp.dataproc.cluster.hdfs.unhealthy_blocks.count | Indicates the number of unhealthy blocks inside the cluster. | long | gauge | +| gcp.dataproc.cluster.job.completion_time.value | The time jobs took to complete from the time the user submits a job to the time Dataproc reports it is completed. | object | | +| gcp.dataproc.cluster.job.duration.value | The time jobs have spent in a given state. | object | | +| gcp.dataproc.cluster.job.failed.count | Indicates the delta of the number of jobs that have failed on a cluster. | long | gauge | +| gcp.dataproc.cluster.job.running.count | Indicates the number of jobs that are running on a cluster. | long | gauge | +| gcp.dataproc.cluster.job.submitted.count | Indicates the delta of the number of jobs that have been submitted to a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.completion_time.value | The time operations took to complete from the time the user submits a operation to the time Dataproc reports it is completed. | object | | +| gcp.dataproc.cluster.operation.duration.value | The time operations have spent in a given state. | object | | +| gcp.dataproc.cluster.operation.failed.count | Indicates the delta of the number of operations that have failed on a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.running.count | Indicates the number of operations that are running on a cluster. | long | gauge | +| gcp.dataproc.cluster.operation.submitted.count | Indicates the delta of the number of operations that have been submitted to a cluster. | long | gauge | +| gcp.dataproc.cluster.yarn.allocated_memory_percentage.value | The percentage of YARN memory is allocated. | double | gauge | +| gcp.dataproc.cluster.yarn.apps.count | Indicates the number of active YARN applications. | long | gauge | +| gcp.dataproc.cluster.yarn.containers.count | Indicates the number of YARN containers. | long | gauge | +| gcp.dataproc.cluster.yarn.memory_size.value | Indicates the YARN memory size in GB. | double | gauge | +| gcp.dataproc.cluster.yarn.nodemanagers.count | Indicates the number of YARN NodeManagers running inside cluster. | long | gauge | +| gcp.dataproc.cluster.yarn.pending_memory_size.value | The current memory request, in GB, that is pending to be fulfilled by the scheduler. | double | gauge | +| gcp.dataproc.cluster.yarn.virtual_cores.count | Indicates the number of virtual cores in YARN. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/firestore.md b/packages/gcp/docs/firestore.md index 2b8c97370e5..6f18845ff98 100644 --- a/packages/gcp/docs/firestore.md +++ b/packages/gcp/docs/firestore.md @@ -72,56 +72,56 @@ An example event for `firestore` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.firestore.document.delete.count | The number of successful document deletes. | long | -| gcp.firestore.document.read.count | The number of successful document reads from queries or lookups. | long | -| gcp.firestore.document.write.count | The number of successful document writes. | long | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.firestore.document.delete.count | Delta of the number of successful document deletes. | long | gauge | +| gcp.firestore.document.read.count | Delta of the number of successful document reads from queries or lookups. | long | gauge | +| gcp.firestore.document.write.count | Delta of the number of successful document writes. | long | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/firewall.md b/packages/gcp/docs/firewall.md index dee96ab592e..4c52a115e67 100644 --- a/packages/gcp/docs/firewall.md +++ b/packages/gcp/docs/firewall.md @@ -62,7 +62,7 @@ The `firewall` dataset collects logs from Firewall Rules in your Virtual Private | gcp.firewall.rule_details.action | Action that the rule performs on match. | keyword | | gcp.firewall.rule_details.destination_range | List of destination ranges that the firewall applies to. | keyword | | gcp.firewall.rule_details.direction | Direction of traffic that matches this rule. | keyword | -| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | array | +| gcp.firewall.rule_details.ip_port_info | List of ip protocols and applicable port ranges for rules. | nested | | gcp.firewall.rule_details.priority | The priority for the firewall rule. | long | | gcp.firewall.rule_details.reference | Reference to the firewall rule. | keyword | | gcp.firewall.rule_details.source_range | List of source ranges that the firewall rule applies to. | keyword | @@ -133,11 +133,11 @@ An example event for `firewall` looks as following: { "@timestamp": "2019-10-30T13:52:42.191Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "cf009128-e43c-42e4-9158-9b088bd6f3f5", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { "availability_zone": "us-east1-b", @@ -162,20 +162,25 @@ An example event for `firewall` looks as following: "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "firewall-rule", "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:01:23.807Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:55:10.718Z", "dataset": "gcp.firewall", "id": "1f21ciqfpfssuo", - "ingested": "2023-01-13T15:01:24Z", + "ingested": "2023-07-19T18:55:14Z", "kind": "event", - "type": "connection" + "type": [ + "allowed", + "connection" + ] }, "gcp": { "destination": { diff --git a/packages/gcp/docs/gke.md b/packages/gcp/docs/gke.md index 58c31a0c39a..d36acb25fc3 100644 --- a/packages/gcp/docs/gke.md +++ b/packages/gcp/docs/gke.md @@ -68,93 +68,93 @@ An example event for `gke` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.gke.container.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds. | double | -| gcp.gke.container.cpu.limit_cores.value | CPU cores limit of the container. Sampled every 60 seconds. | double | -| gcp.gke.container.cpu.limit_utilization.pct | The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.cpu.request_cores.value | Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.container.cpu.request_utilization.pct | The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.ephemeral_storage.limit.bytes | Local ephemeral storage limit in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.ephemeral_storage.request.bytes | Local ephemeral storage request in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.ephemeral_storage.used.bytes | Local ephemeral storage usage in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.memory.limit.bytes | Memory limit of the container in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.memory.limit_utilization.pct | The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.container.memory.page_fault.count | Number of page faults, broken down by type, major and minor. | long | -| gcp.gke.container.memory.request.bytes | Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.container.memory.request_utilization.pct | The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.container.memory.used.bytes | Memory usage in bytes. Sampled every 60 seconds. | long | -| gcp.gke.container.restart.count | Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.container.uptime.sec | Time in seconds that the container has been running. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.allocatable_cores.value | Number of allocatable CPU cores on the node. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.allocatable_utilization.pct | The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | -| gcp.gke.node.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds. | double | -| gcp.gke.node.cpu.total_cores.value | Total number of CPU cores on the node. Sampled every 60 seconds. | double | -| gcp.gke.node.ephemeral_storage.allocatable.bytes | Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.inodes_free.value | Free number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.inodes_total.value | Total number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.total.bytes | Total ephemeral storage bytes on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.ephemeral_storage.used.bytes | Local ephemeral storage bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.allocatable.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.allocatable_utilization.pct | The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.gke.node.memory.total.bytes | Number of bytes of memory allocatable on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.memory.used.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | -| gcp.gke.node.network.received_bytes.count | Cumulative number of bytes received by the node over the network. Sampled every 60 seconds. | long | -| gcp.gke.node.network.sent_bytes.count | Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds. | long | -| gcp.gke.node.pid_limit.value | The max PID of OS on the node. Sampled every 60 seconds. | long | -| gcp.gke.node.pid_used.value | The number of running process in the OS on the node. Sampled every 60 seconds. | long | -| gcp.gke.node_daemon.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds. | double | -| gcp.gke.node_daemon.memory.used.bytes | Memory usage by the system daemon in bytes. Sampled every 60 seconds. | long | -| gcp.gke.pod.network.received.bytes | Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds. | long | -| gcp.gke.pod.network.sent.bytes | Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds. | long | -| gcp.gke.pod.volume.total.bytes | Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | -| gcp.gke.pod.volume.used.bytes | Number of disk bytes used by the pod. Sampled every 60 seconds. | long | -| gcp.gke.pod.volume.utilization.pct | The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.gke.container.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the container in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.container.cpu.limit_cores.value | CPU cores limit of the container. Sampled every 60 seconds. | double | gauge | +| gcp.gke.container.cpu.limit_utilization.pct | The fraction of the CPU limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.cpu.request_cores.value | Number of CPU cores requested by the container. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.container.cpu.request_utilization.pct | The fraction of the requested CPU that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.ephemeral_storage.limit.bytes | Local ephemeral storage limit in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.ephemeral_storage.request.bytes | Local ephemeral storage request in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.ephemeral_storage.used.bytes | Local ephemeral storage usage in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.memory.limit.bytes | Memory limit of the container in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.memory.limit_utilization.pct | The fraction of the memory limit that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed the limit. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.container.memory.page_fault.count | Number of page faults, broken down by type, major and minor. | long | counter | +| gcp.gke.container.memory.request.bytes | Memory request of the container in bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.gke.container.memory.request_utilization.pct | The fraction of the requested memory that is currently in use on the instance. This value can be greater than 1 as usage can exceed the request. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.container.memory.used.bytes | Memory usage in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.container.restart.count | Number of times the container has restarted. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | counter | +| gcp.gke.container.uptime.sec | Time in seconds that the container has been running. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.cpu.allocatable_cores.value | Number of allocatable CPU cores on the node. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.cpu.allocatable_utilization.pct | The fraction of the allocatable CPU that is currently in use on the instance. Sampled every 60 seconds. After sampling, data is not visible for up to 240 seconds. | double | gauge | +| gcp.gke.node.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used on the node in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.node.cpu.total_cores.value | Total number of CPU cores on the node. Sampled every 60 seconds. | double | gauge | +| gcp.gke.node.ephemeral_storage.allocatable.bytes | Local ephemeral storage bytes allocatable on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.inodes_free.value | Free number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.inodes_total.value | Total number of inodes on local ephemeral storage. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.total.bytes | Total ephemeral storage bytes on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.ephemeral_storage.used.bytes | Local ephemeral storage bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.allocatable.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.allocatable_utilization.pct | The fraction of the allocatable memory that is currently in use on the instance. This value cannot exceed 1 as usage cannot exceed allocatable memory bytes. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.gke.node.memory.total.bytes | Number of bytes of memory allocatable on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.memory.used.bytes | Cumulative memory bytes used by the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.network.received_bytes.count | Cumulative number of bytes received by the node over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.node.network.sent_bytes.count | Cumulative number of bytes transmitted by the node over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.node.pid_limit.value | The max PID of OS on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node.pid_used.value | The number of running process in the OS on the node. Sampled every 60 seconds. | long | gauge | +| gcp.gke.node_daemon.cpu.core_usage_time.sec | Cumulative CPU usage on all cores used by the node level system daemon in seconds. Sampled every 60 seconds. | double | counter | +| gcp.gke.node_daemon.memory.used.bytes | Memory usage by the system daemon in bytes. Sampled every 60 seconds. | long | gauge | +| gcp.gke.pod.network.received.bytes | Cumulative number of bytes received by the pod over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.pod.network.sent.bytes | Cumulative number of bytes transmitted by the pod over the network. Sampled every 60 seconds. | long | counter | +| gcp.gke.pod.volume.total.bytes | Total number of disk bytes available to the pod. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | long | gauge | +| gcp.gke.pod.volume.used.bytes | Number of disk bytes used by the pod. Sampled every 60 seconds. | long | gauge | +| gcp.gke.pod.volume.utilization.pct | The fraction of the volume that is currently being used by the instance. This value cannot be greater than 1 as usage cannot exceed the total available volume space. Sampled every 60 seconds. After sampling, data is not visible for up to 120 seconds. | double | gauge | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/loadbalancing.md b/packages/gcp/docs/loadbalancing.md index c4b8293affa..17d19b32223 100644 --- a/packages/gcp/docs/loadbalancing.md +++ b/packages/gcp/docs/loadbalancing.md @@ -292,7 +292,7 @@ An example event for `loadbalancing` looks as following: "region": "us-central1" } }, - "loadbalancing": { + "loadbalancing_metrics": { "l3": { "internal": { "egress_packets": { @@ -317,82 +317,82 @@ An example event for `loadbalancing` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.loadbalancing.https.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.backend_request.bytes | The number of bytes sent as requests from HTTP/S load balancer to backends. | long | -| gcp.loadbalancing.https.backend_request.count | The number of requests served by backends of HTTP/S load balancer. | long | -| gcp.loadbalancing.https.backend_response.bytes | The number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. | long | -| gcp.loadbalancing.https.external.regional.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.external.regional.total_latencies.value | A distribution of the latency calculated from when the request was received by the proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.https.frontend_tcp_rtt.value | A distribution of the RTT measured for each connection between client and proxy. | object | -| gcp.loadbalancing.https.internal.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the internal HTTP/S load balancer proxy to the backend until the proxy received from the backend the last byte of response. | object | -| gcp.loadbalancing.https.internal.total_latencies.value | A distribution of the latency calculated from when the request was received by the internal HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.https.request.bytes | The number of bytes sent as requests from clients to HTTP/S load balancer. | long | -| gcp.loadbalancing.https.request.count | The number of requests served by HTTP/S load balancer. | long | -| gcp.loadbalancing.https.response.bytes | The number of bytes sent as responses from HTTP/S load balancer to clients. | long | -| gcp.loadbalancing.https.total_latencies.value | A distribution of the latency calculated from when the request was received by the external HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | -| gcp.loadbalancing.l3.external.egress.bytes | The number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. | long | -| gcp.loadbalancing.l3.external.egress_packets.count | The number of packets sent from external TCP/UDP network load balancer backend to client of the flow. | long | -| gcp.loadbalancing.l3.external.ingress.bytes | The number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. | long | -| gcp.loadbalancing.l3.external.ingress_packets.count | The number of packets sent from client to external TCP/UDP network load balancer backend. | long | -| gcp.loadbalancing.l3.external.rtt_latencies.value | A distribution of the round trip time latency, measured over TCP connections for the external network load balancer. | object | -| gcp.loadbalancing.l3.internal.egress.bytes | The number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). | long | -| gcp.loadbalancing.l3.internal.egress_packets.count | The number of packets sent from ILB backend to client of the flow. | long | -| gcp.loadbalancing.l3.internal.ingress.bytes | The number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). | long | -| gcp.loadbalancing.l3.internal.ingress_packets.count | The number of packets sent from client to ILB backend. | long | -| gcp.loadbalancing.l3.internal.rtt_latencies.value | A distribution of RTT measured over TCP connections for internal TCP/UDP load balancer flows. | object | -| gcp.loadbalancing.tcp_ssl_proxy.closed_connections.value | Number of connections that were terminated over TCP/SSL proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.egress.bytes | Number of bytes sent from VM to client using proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.frontend_tcp_rtt.value | A distribution of the smoothed RTT (in ms) measured by the proxy's TCP stack, each minute application layer bytes pass from proxy to client. | object | -| gcp.loadbalancing.tcp_ssl_proxy.ingress.bytes | Number of bytes sent from client to VM using proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.new_connections.value | Number of connections that were created over TCP/SSL proxy. | long | -| gcp.loadbalancing.tcp_ssl_proxy.open_connections.value | Current number of outstanding connections through the TCP/SSL proxy. | long | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.loadbalancing_metrics.https.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.backend_request.bytes | Delta of the number of bytes sent as requests from HTTP/S load balancer to backends. | long | gauge | +| gcp.loadbalancing_metrics.https.backend_request.count | Delta of the number of requests served by backends of HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.backend_response.bytes | Delta of the number of bytes sent as responses from backends (or cache) to external HTTP(S) load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.external.regional.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.external.regional.total_latencies.value | A distribution of the latency calculated from when the request was received by the proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.https.frontend_tcp_rtt.value | A distribution of the RTT measured for each connection between client and proxy. | object | | +| gcp.loadbalancing_metrics.https.internal.backend_latencies.value | A distribution of the latency calculated from when the request was sent by the internal HTTP/S load balancer proxy to the backend until the proxy received from the backend the last byte of response. | object | | +| gcp.loadbalancing_metrics.https.internal.total_latencies.value | A distribution of the latency calculated from when the request was received by the internal HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.https.request.bytes | Delta of the number of bytes sent as requests from clients to HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.request.count | Delta of the number of requests served by HTTP/S load balancer. | long | gauge | +| gcp.loadbalancing_metrics.https.response.bytes | Delta of the number of bytes sent as responses from HTTP/S load balancer to clients. | long | gauge | +| gcp.loadbalancing_metrics.https.total_latencies.value | A distribution of the latency calculated from when the request was received by the external HTTP/S load balancer proxy until the proxy got ACK from client on last response byte. | object | | +| gcp.loadbalancing_metrics.l3.external.egress.bytes | Delta of the number of bytes sent from external TCP/UDP network load balancer backend to client of the flow. For TCP flows it's counting bytes on application stream only. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.egress_packets.count | Delta of the number of packets sent from external TCP/UDP network load balancer backend to client of the flow. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.ingress.bytes | Delta of the number of bytes sent from client to external TCP/UDP network load balancer backend. For TCP flows it's counting bytes on application stream only. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.ingress_packets.count | Delta of the number of packets sent from client to external TCP/UDP network load balancer backend. | long | gauge | +| gcp.loadbalancing_metrics.l3.external.rtt_latencies.value | A distribution of the round trip time latency, measured over TCP connections for the external network load balancer. | object | | +| gcp.loadbalancing_metrics.l3.internal.egress.bytes | Delta of the number of bytes sent from ILB backend to client (for TCP flows it's counting bytes on application stream only). | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.egress_packets.count | Delta of the number of packets sent from ILB backend to client of the flow. | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.ingress.bytes | Delta of the number of bytes sent from client to ILB backend (for TCP flows it's counting bytes on application stream only). | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.ingress_packets.count | Delta of the number of packets sent from client to ILB backend. | long | gauge | +| gcp.loadbalancing_metrics.l3.internal.rtt_latencies.value | A distribution of RTT measured over TCP connections for internal TCP/UDP load balancer flows. | object | | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.closed_connections.value | Delta of the number of connections that were terminated over TCP/SSL proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.egress.bytes | Delta of the number of bytes sent from VM to client using proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.frontend_tcp_rtt.value | A distribution of the smoothed RTT (in ms) measured by the proxy's TCP stack, each minute application layer bytes pass from proxy to client. | object | | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.ingress.bytes | Delta of the number of bytes sent from client to VM using proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.new_connections.value | Delta of the number of connections that were created over TCP/SSL proxy. | long | gauge | +| gcp.loadbalancing_metrics.tcp_ssl_proxy.open_connections.value | Current number of outstanding connections through the TCP/SSL proxy. | long | gauge | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/pubsub.md b/packages/gcp/docs/pubsub.md index ffce8028d99..b1e7012e1cd 100644 --- a/packages/gcp/docs/pubsub.md +++ b/packages/gcp/docs/pubsub.md @@ -66,102 +66,102 @@ An example event for `pubsub` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| gcp.pubsub.snapshot.backlog.bytes | Total byte size of the messages retained in a snapshot. | long | -| gcp.pubsub.snapshot.backlog_bytes_by_region.bytes | Total byte size of the messages retained in a snapshot, broken down by Cloud region. | long | -| gcp.pubsub.snapshot.config_updates.count | Cumulative count of configuration changes, grouped by operation type and result. | long | -| gcp.pubsub.snapshot.num_messages.value | Number of messages retained in a snapshot. | long | -| gcp.pubsub.snapshot.num_messages_by_region.value | Number of messages retained in a snapshot, broken down by Cloud region. | long | -| gcp.pubsub.snapshot.oldest_message_age.sec | Age (in seconds) of the oldest message retained in a snapshot. | long | -| gcp.pubsub.snapshot.oldest_message_age_by_region.sec | Age (in seconds) of the oldest message retained in a snapshot, broken down by Cloud region. | long | -| gcp.pubsub.subscription.ack_latencies.value | Distribution of ack latencies in milliseconds. The ack latency is the time between when Cloud Pub/Sub sends a message to a subscriber client and when Cloud Pub/Sub receives an Acknowledge request for that message. | object | -| gcp.pubsub.subscription.ack_message.count | Cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type. | long | -| gcp.pubsub.subscription.backlog.bytes | Total byte size of the unacknowledged messages (a.k.a. backlog messages) in a subscription. | long | -| gcp.pubsub.subscription.byte_cost.bytes | Cumulative cost of operations, measured in bytes. This is used to measure quota utilization. | long | -| gcp.pubsub.subscription.config_updates.count | Cumulative count of configuration changes for each subscription, grouped by operation type and result. | long | -| gcp.pubsub.subscription.dead_letter_message.count | Cumulative count of messages published to dead letter topic, grouped by result. | long | -| gcp.pubsub.subscription.mod_ack_deadline_message.count | Cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type. | long | -| gcp.pubsub.subscription.mod_ack_deadline_message_operation.count | Cumulative count of ModifyAckDeadline message operations, grouped by result. | long | -| gcp.pubsub.subscription.mod_ack_deadline_request.count | Cumulative count of ModifyAckDeadline requests, grouped by result. | long | -| gcp.pubsub.subscription.num_outstanding_messages.value | Number of messages delivered to a subscription's push endpoint, but not yet acknowledged. | long | -| gcp.pubsub.subscription.num_undelivered_messages.value | Number of unacknowledged messages (a.k.a. backlog messages) in a subscription. | long | -| gcp.pubsub.subscription.oldest_retained_acked_message_age.sec | Age (in seconds) of the oldest acknowledged message retained in a subscription. | long | -| gcp.pubsub.subscription.oldest_retained_acked_message_age_by_region.value | Age (in seconds) of the oldest acknowledged message retained in a subscription, broken down by Cloud region. | long | -| gcp.pubsub.subscription.oldest_unacked_message_age.sec | Age (in seconds) of the oldest unacknowledged message (a.k.a. backlog message) in a subscription. | long | -| gcp.pubsub.subscription.oldest_unacked_message_age_by_region.value | Age (in seconds) of the oldest unacknowledged message in a subscription, broken down by Cloud region. | long | -| gcp.pubsub.subscription.pull_ack_message_operation.count | Cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | -| gcp.pubsub.subscription.pull_ack_request.count | Cumulative count of acknowledge requests, grouped by result. | long | -| gcp.pubsub.subscription.pull_message_operation.count | Cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | -| gcp.pubsub.subscription.pull_request.count | Cumulative count of pull requests, grouped by result. | long | -| gcp.pubsub.subscription.push_request.count | Cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times. | long | -| gcp.pubsub.subscription.push_request_latencies.value | Distribution of push request latencies (in microseconds), grouped by result. | object | -| gcp.pubsub.subscription.retained_acked.bytes | Total byte size of the acknowledged messages retained in a subscription. | long | -| gcp.pubsub.subscription.retained_acked_bytes_by_region.bytes | Total byte size of the acknowledged messages retained in a subscription, broken down by Cloud region. | long | -| gcp.pubsub.subscription.seek_request.count | Cumulative count of seek attempts, grouped by result. | long | -| gcp.pubsub.subscription.sent_message.count | Cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type. | long | -| gcp.pubsub.subscription.streaming_pull_ack_message_operation.count | Cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | -| gcp.pubsub.subscription.streaming_pull_ack_request.count | Cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result. | long | -| gcp.pubsub.subscription.streaming_pull_message_operation.count | Cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric \subscription/mod_ack_deadline_message_operation_count | long | -| gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_message_operation.count | Cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result. | long | -| gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_request.count | Cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result. | long | -| gcp.pubsub.subscription.streaming_pull_response.count | Cumulative count of streaming pull responses, grouped by result. | long | -| gcp.pubsub.subscription.unacked_bytes_by_region.bytes | Total byte size of the unacknowledged messages in a subscription, broken down by Cloud region. | long | -| gcp.pubsub.topic.byte_cost.bytes | Cost of operations, measured in bytes. This is used to measure utilization for quotas. | long | -| gcp.pubsub.topic.config_updates.count | Cumulative count of configuration changes, grouped by operation type and result. | long | -| gcp.pubsub.topic.message_sizes.bytes | Distribution of publish message sizes (in bytes) | object | -| gcp.pubsub.topic.oldest_retained_acked_message_age_by_region.value | Age (in seconds) of the oldest acknowledged message retained in a topic, broken down by Cloud region. | long | -| gcp.pubsub.topic.oldest_unacked_message_age_by_region.value | Age (in seconds) of the oldest unacknowledged message in a topic, broken down by Cloud region. | long | -| gcp.pubsub.topic.retained_acked_bytes_by_region.bytes | Total byte size of the acknowledged messages retained in a topic, broken down by Cloud region. | long | -| gcp.pubsub.topic.send_message_operation.count | Cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | -| gcp.pubsub.topic.send_request.count | Cumulative count of publish requests, grouped by result. | long | -| gcp.pubsub.topic.streaming_pull_response.count | Cumulative count of streaming pull responses, grouped by result. | long | -| gcp.pubsub.topic.unacked_bytes_by_region.bytes | Total byte size of the unacknowledged messages in a topic, broken down by Cloud region. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| gcp.pubsub.snapshot.backlog.bytes | Total byte size of the messages retained in a snapshot. | long | gauge | +| gcp.pubsub.snapshot.backlog_bytes_by_region.bytes | Total byte size of the messages retained in a snapshot, broken down by Cloud region. | long | gauge | +| gcp.pubsub.snapshot.config_updates.count | Delta of the cumulative count of configuration changes, grouped by operation type and result. | long | gauge | +| gcp.pubsub.snapshot.num_messages.value | Number of messages retained in a snapshot. | long | gauge | +| gcp.pubsub.snapshot.num_messages_by_region.value | Number of messages retained in a snapshot, broken down by Cloud region. | long | gauge | +| gcp.pubsub.snapshot.oldest_message_age.sec | Age (in seconds) of the oldest message retained in a snapshot. | long | gauge | +| gcp.pubsub.snapshot.oldest_message_age_by_region.sec | Age (in seconds) of the oldest message retained in a snapshot, broken down by Cloud region. | long | gauge | +| gcp.pubsub.subscription.ack_latencies.value | Distribution of ack latencies in milliseconds. The ack latency is the time between when Cloud Pub/Sub sends a message to a subscriber client and when Cloud Pub/Sub receives an Acknowledge request for that message. | object | | +| gcp.pubsub.subscription.ack_message.count | Delta of the cumulative count of messages acknowledged by Acknowledge requests, grouped by delivery type. | long | gauge | +| gcp.pubsub.subscription.backlog.bytes | Total byte size of the unacknowledged messages (a.k.a. backlog messages) in a subscription. | long | gauge | +| gcp.pubsub.subscription.byte_cost.bytes | Delta of the cumulative cost of operations, measured in bytes. This is used to measure quota utilization. | long | gauge | +| gcp.pubsub.subscription.config_updates.count | Delta of the cumulative count of configuration changes for each subscription, grouped by operation type and result. | long | gauge | +| gcp.pubsub.subscription.dead_letter_message.count | Delta of the cumulative count of messages published to dead letter topic, grouped by result. | long | gauge | +| gcp.pubsub.subscription.mod_ack_deadline_message.count | Delta of the cumulative count of messages whose deadline was updated by ModifyAckDeadline requests, grouped by delivery type. | long | gauge | +| gcp.pubsub.subscription.mod_ack_deadline_message_operation.count | Delta of the cumulative count of ModifyAckDeadline message operations, grouped by result. | long | gauge | +| gcp.pubsub.subscription.mod_ack_deadline_request.count | Delta of the cumulative count of ModifyAckDeadline requests, grouped by result. | long | gauge | +| gcp.pubsub.subscription.num_outstanding_messages.value | Number of messages delivered to a subscription's push endpoint, but not yet acknowledged. | long | gauge | +| gcp.pubsub.subscription.num_undelivered_messages.value | Number of unacknowledged messages (a.k.a. backlog messages) in a subscription. | long | gauge | +| gcp.pubsub.subscription.oldest_retained_acked_message_age.sec | Age (in seconds) of the oldest acknowledged message retained in a subscription. | long | gauge | +| gcp.pubsub.subscription.oldest_retained_acked_message_age_by_region.value | Age (in seconds) of the oldest acknowledged message retained in a subscription, broken down by Cloud region. | long | gauge | +| gcp.pubsub.subscription.oldest_unacked_message_age.sec | Age (in seconds) of the oldest unacknowledged message (a.k.a. backlog message) in a subscription. | long | gauge | +| gcp.pubsub.subscription.oldest_unacked_message_age_by_region.value | Age (in seconds) of the oldest unacknowledged message in a subscription, broken down by Cloud region. | long | gauge | +| gcp.pubsub.subscription.pull_ack_message_operation.count | Delta of the cumulative count of acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | gauge | +| gcp.pubsub.subscription.pull_ack_request.count | Delta of the cumulative count of acknowledge requests, grouped by result. | long | gauge | +| gcp.pubsub.subscription.pull_message_operation.count | Delta of the cumulative count of pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | gauge | +| gcp.pubsub.subscription.pull_request.count | Delta of the cumulative count of pull requests, grouped by result. | long | gauge | +| gcp.pubsub.subscription.push_request.count | Delta of the cumulative count of push attempts, grouped by result. Unlike pulls, the push server implementation does not batch user messages. So each request only contains one user message. The push server retries on errors, so a given user message can appear multiple times. | long | gauge | +| gcp.pubsub.subscription.push_request_latencies.value | Distribution of push request latencies (in microseconds), grouped by result. | object | | +| gcp.pubsub.subscription.retained_acked.bytes | Total byte size of the acknowledged messages retained in a subscription. | long | gauge | +| gcp.pubsub.subscription.retained_acked_bytes_by_region.bytes | Total byte size of the acknowledged messages retained in a subscription, broken down by Cloud region. | long | gauge | +| gcp.pubsub.subscription.seek_request.count | Delta of the cumulative count of seek attempts, grouped by result. | long | gauge | +| gcp.pubsub.subscription.sent_message.count | Delta of the cumulative count of messages sent by Cloud Pub/Sub to subscriber clients, grouped by delivery type. | long | gauge | +| gcp.pubsub.subscription.streaming_pull_ack_message_operation.count | Delta of the cumulative count of StreamingPull acknowledge message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | gauge | +| gcp.pubsub.subscription.streaming_pull_ack_request.count | Delta of the cumulative count of streaming pull requests with non-empty acknowledge ids, grouped by result. | long | gauge | +| gcp.pubsub.subscription.streaming_pull_message_operation.count | Delta of the cumulative count of streaming pull message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric \subscription/mod_ack_deadline_message_operation_count | long | gauge | +| gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_message_operation.count | Delta of the cumulative count of StreamingPull ModifyAckDeadline operations, grouped by result. | long | gauge | +| gcp.pubsub.subscription.streaming_pull_mod_ack_deadline_request.count | Delta of the cumulative count of streaming pull requests with non-empty ModifyAckDeadline fields, grouped by result. | long | gauge | +| gcp.pubsub.subscription.streaming_pull_response.count | Delta of the cumulative count of streaming pull responses, grouped by result. | long | gauge | +| gcp.pubsub.subscription.unacked_bytes_by_region.bytes | Total byte size of the unacknowledged messages in a subscription, broken down by Cloud region. | long | gauge | +| gcp.pubsub.topic.byte_cost.bytes | Delta of the cost of operations, measured in bytes. This is used to measure utilization for quotas. | long | gauge | +| gcp.pubsub.topic.config_updates.count | Delta of the cumulative count of configuration changes, grouped by operation type and result. | long | gauge | +| gcp.pubsub.topic.message_sizes.bytes | Distribution of publish message sizes (in bytes) | object | | +| gcp.pubsub.topic.oldest_retained_acked_message_age_by_region.value | Age (in seconds) of the oldest acknowledged message retained in a topic, broken down by Cloud region. | long | gauge | +| gcp.pubsub.topic.oldest_unacked_message_age_by_region.value | Age (in seconds) of the oldest unacknowledged message in a topic, broken down by Cloud region. | long | gauge | +| gcp.pubsub.topic.retained_acked_bytes_by_region.bytes | Total byte size of the acknowledged messages retained in a topic, broken down by Cloud region. | long | gauge | +| gcp.pubsub.topic.send_message_operation.count | Delta of the cumulative count of publish message operations, grouped by result. For a definition of message operations, see Cloud Pub/Sub metric subscription/mod_ack_deadline_message_operation_count. | long | gauge | +| gcp.pubsub.topic.send_request.count | Delta of the cumulative count of publish requests, grouped by result. | long | gauge | +| gcp.pubsub.topic.streaming_pull_response.count | Delta of the cumulative count of streaming pull responses, grouped by result. | long | gauge | +| gcp.pubsub.topic.unacked_bytes_by_region.bytes | Total byte size of the unacknowledged messages in a topic, broken down by Cloud region. | long | gauge | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/redis.md b/packages/gcp/docs/redis.md index 35a2a193c76..dac9bcfaa4b 100644 --- a/packages/gcp/docs/redis.md +++ b/packages/gcp/docs/redis.md @@ -98,13 +98,13 @@ An example event for `redis` looks as following: | gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | | | gcp.redis.clients.blocked.count | Number of blocked clients. | long | | gauge | | gcp.redis.clients.connected.count | Number of client connections. | long | | gauge | -| gcp.redis.commands.calls.count | Total number of calls for this command in one minute. | long | | counter | -| gcp.redis.commands.total_time.us | The amount of time in microseconds that this command took in the last second. | long | micros | counter | +| gcp.redis.commands.calls.count | Delta of the number of calls for this command in one minute. | long | | gauge | +| gcp.redis.commands.total_time.us | Delta of the amount of time in microseconds that this command took in the last second. | long | micros | gauge | | gcp.redis.commands.usec_per_call.sec | Average time per call over 1 minute by command. | double | s | gauge | | gcp.redis.keyspace.avg_ttl.sec | Average TTL for keys in this database. | double | s | gauge | | gcp.redis.keyspace.keys.count | Number of keys stored in this database. | long | | gauge | | gcp.redis.keyspace.keys_with_expiration.count | Number of keys with an expiration in this database. | long | | gauge | -| gcp.redis.persistence.rdb.bgsave_in_progress | Flag indicating a RDB save is on-going. | boolean | | | +| gcp.redis.persistence.rdb.bgsave_in_progress | Flag indicating a RDB save is on-going. | long | | gauge | | gcp.redis.replication.master.slaves.lag.sec | The number of seconds that replica is lagging behind primary. | long | s | gauge | | gcp.redis.replication.master.slaves.offset.bytes | The number of bytes that have been acknowledged by replicas. | long | byte | gauge | | gcp.redis.replication.master_repl_offset.bytes | The number of bytes that master has produced and sent to replicas. | long | byte | gauge | @@ -112,18 +112,18 @@ An example event for `redis` looks as following: | gcp.redis.replication.role | Returns a value indicating the node role. 1 indicates primary and 0 indicates replica. | long | | gauge | | gcp.redis.server.uptime.sec | Uptime in seconds. | long | s | gauge | | gcp.redis.stats.cache_hit_ratio | Cache Hit ratio as a fraction. | double | | gauge | -| gcp.redis.stats.connections.total.count | Total number of connections accepted by the server. | long | | counter | +| gcp.redis.stats.connections.total.count | Delta of the total number of connections accepted by the server. | long | | gauge | | gcp.redis.stats.cpu_utilization.sec | CPU-seconds consumed by the Redis server, broken down by system/user space and parent/child relationship. | double | s | gauge | -| gcp.redis.stats.evicted_keys.count | Number of evicted keys due to maxmemory limit. | long | | counter | -| gcp.redis.stats.expired_keys.count | Total number of key expiration events. | long | | counter | -| gcp.redis.stats.keyspace_hits.count | Number of successful lookup of keys in the main dictionary. | long | | counter | -| gcp.redis.stats.keyspace_misses.count | Number of failed lookup of keys in the main dictionary. | long | | counter | +| gcp.redis.stats.evicted_keys.count | Delta of the number of evicted keys due to maxmemory limit. | long | | gauge | +| gcp.redis.stats.expired_keys.count | Delta of the total number of key expiration events. | long | | gauge | +| gcp.redis.stats.keyspace_hits.count | Delta of the number of successful lookup of keys in the main dictionary. | long | | gauge | +| gcp.redis.stats.keyspace_misses.count | Delta of the number of failed lookup of keys in the main dictionary. | long | | gauge | | gcp.redis.stats.memory.maxmemory.mb | Maximum amount of memory Redis can consume. | long | m | gauge | | gcp.redis.stats.memory.system_memory_overload_duration.us | The amount of time in microseconds the instance is in system memory overload mode. | long | micros | gauge | | gcp.redis.stats.memory.system_memory_usage_ratio | Memory usage as a ratio of maximum system memory. | double | | gauge | | gcp.redis.stats.memory.usage.bytes | Total number of bytes allocated by Redis. | long | byte | gauge | | gcp.redis.stats.memory.usage_ratio | Memory usage as a ratio of maximum memory. | double | | gauge | -| gcp.redis.stats.network_traffic.bytes | Total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). | long | byte | counter | +| gcp.redis.stats.network_traffic.bytes | Delta of the total number of bytes sent to/from redis (includes bytes from commands themselves, payload data, and delimiters). | long | byte | gauge | | gcp.redis.stats.pubsub.channels.count | Global number of pub/sub channels with client subscriptions. | long | | gauge | | gcp.redis.stats.pubsub.patterns.count | Global number of pub/sub pattern with client subscriptions. | long | | gauge | | gcp.redis.stats.reject_connections.count | Number of connections rejected because of maxclients limit. | long | | gauge | diff --git a/packages/gcp/docs/storage.md b/packages/gcp/docs/storage.md index fca7e1a230e..17fdbb405af 100644 --- a/packages/gcp/docs/storage.md +++ b/packages/gcp/docs/storage.md @@ -71,62 +71,62 @@ An example event for `storage` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| gcp.labels.metadata.\* | | object | -| gcp.labels.metrics.\* | | object | -| gcp.labels.resource.\* | | object | -| gcp.labels.system.\* | | object | -| gcp.labels.user.\* | | object | -| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | -| gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | -| gcp.storage.authz.acl_based_object_access.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | -| gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | -| gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | -| gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | -| gcp.storage.network.sent.bytes | Delta count of bytes sent over the network, grouped by the API method name and response code. | long | -| gcp.storage.storage.object.count | Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | -| gcp.storage.storage.total.bytes | Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | -| gcp.storage.storage.total_byte_seconds.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| gcp.labels.metadata.\* | | object | | +| gcp.labels.metrics.\* | | object | | +| gcp.labels.resource.\* | | object | | +| gcp.labels.system.\* | | object | | +| gcp.labels.user.\* | | object | | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | +| gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | gauge | +| gcp.storage.authz.acl_based_object_access.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | gauge | +| gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | gauge | +| gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | gauge | +| gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | gauge | +| gcp.storage.network.sent.bytes | Delta count of bytes sent over the network, grouped by the API method name and response code. | long | gauge | +| gcp.storage.storage.object.count | Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | gauge | +| gcp.storage.storage.total.bytes | Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | gauge | +| gcp.storage.storage.total_byte_seconds.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | gauge | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/gcp/docs/vpcflow.md b/packages/gcp/docs/vpcflow.md index ce4146f24ae..4ab6a60c49e 100644 --- a/packages/gcp/docs/vpcflow.md +++ b/packages/gcp/docs/vpcflow.md @@ -130,14 +130,19 @@ An example event for `vpcflow` looks as following: { "@timestamp": "2019-06-14T03:50:10.845Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "a47f1e8b-f681-4e3b-87cd-6b2d54144577", + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "cloud": { - "provider": "gcp" + "availability_zone": "us-east1-b", + "project": { + "id": "my-sample-project" + }, + "provider": "gcp", + "region": "us-east1" }, "data_stream": { "dataset": "gcp.vpcflow", @@ -145,30 +150,46 @@ An example event for `vpcflow` looks as following: "type": "logs" }, "destination": { - "address": "10.87.40.76", + "address": "67.43.156.13", + "as": { + "number": 35908 + }, "domain": "kibana", - "ip": "10.87.40.76", - "port": 5601 + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.13", + "port": 33548 }, "ecs": { "version": "8.8.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "5872ddcf-0f11-4ff9-84ce-30e042fe8327", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "category": "network", - "created": "2023-01-13T15:03:19.118Z", + "category": [ + "network" + ], + "created": "2023-07-19T18:56:47.758Z", "dataset": "gcp.vpcflow", - "end": "2019-06-14T03:40:37.048196137Z", - "id": "ut8lbrffooxzf", - "ingested": "2023-01-13T15:03:20Z", + "end": "2019-06-14T03:49:56.393651211Z", + "id": "ut8lbrffooxz4", + "ingested": "2023-07-19T18:56:51Z", "kind": "event", - "start": "2019-06-14T03:40:36.895188084Z", - "type": "connection" + "start": "2019-06-14T03:40:05.147252064Z", + "type": [ + "connection" + ] }, "gcp": { "destination": { @@ -183,10 +204,22 @@ An example event for `vpcflow` looks as following: "vpc_name": "default" } }, + "source": { + "instance": { + "project_id": "my-sample-project", + "region": "us-east1", + "zone": "us-east1-b" + }, + "vpc": { + "project_id": "my-sample-project", + "subnetwork_name": "default", + "vpc_name": "default" + } + }, "vpcflow": { - "reporter": "DEST", + "reporter": "SRC", "rtt": { - "ms": 36 + "ms": 50 } } }, @@ -197,33 +230,28 @@ An example event for `vpcflow` looks as following: "logger": "projects/my-sample-project/logs/compute.googleapis.com%2Fvpc_flows" }, "network": { - "bytes": 1464, - "community_id": "1:++9/JiESSUdwTGGcxwXk4RA0lY8=", - "direction": "inbound", + "bytes": 159704, + "community_id": "1:+S3/6PF+UXU7wlJD68HIrz0Mo6c=", + "direction": "internal", "iana_number": "6", - "packets": 7, + "name": "default", + "packets": 241, "transport": "tcp", "type": "ipv4" }, "related": { "ip": [ - "192.168.2.117", - "10.87.40.76" + "10.139.99.242", + "67.43.156.13" ] }, "source": { - "address": "192.168.2.117", - "as": { - "number": 15169 - }, - "bytes": 1464, - "geo": { - "continent_name": "America", - "country_name": "usa" - }, - "ip": "192.168.2.117", - "packets": 7, - "port": 50646 + "address": "10.139.99.242", + "bytes": 159704, + "domain": "elasticsearch", + "ip": "10.139.99.242", + "packets": 241, + "port": 9200 }, "tags": [ "forwarded", diff --git a/packages/gcp/img/gcp-billing.png b/packages/gcp/img/gcp-billing.png index b697c285a11..c4717302035 100644 Binary files a/packages/gcp/img/gcp-billing.png and b/packages/gcp/img/gcp-billing.png differ diff --git a/packages/gcp/kibana/dashboard/gcp-2b3773d0-3a16-11ee-8736-83dacf143f01.json b/packages/gcp/kibana/dashboard/gcp-2b3773d0-3a16-11ee-8736-83dacf143f01.json new file mode 100644 index 00000000000..04ba8b6d064 --- /dev/null +++ b/packages/gcp/kibana/dashboard/gcp-2b3773d0-3a16-11ee-8736-83dacf143f01.json @@ -0,0 +1,2106 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"581838e6-e49e-4252-b460-80716b0819b9\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"581838e6-e49e-4252-b460-80716b0819b9\",\"fieldName\":\"gcp.labels.resource.region\",\"title\":\"Region\",\"selectedOptions\":[],\"enhancements\":{}}},\"49ce5766-f900-4de5-a320-053cd8551ff0\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"49ce5766-f900-4de5-a320-053cd8551ff0\",\"fieldName\":\"gcp.labels.resource.database_id\",\"title\":\"Database ID\",\"enhancements\":{}}},\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\",\"fieldName\":\"gcp.labels.cloudsql.version\",\"title\":\"SQL Server Version\",\"enhancements\":{}}}}" + }, + "description": "Overview of GCP CloudSQL SQL Server Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.cloudsql_sqlserver" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.cloudsql_sqlserver" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Database Up", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.up" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "2394df1e-4fab-4519-94e7-2521427302f6", + "w": 6, + "x": 0, + "y": 0 + }, + "panelIndex": "2394df1e-4fab-4519-94e7-2521427302f6", + "title": "Database Up", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.network.connections.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.network.connections.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "905d7d75-61b3-4661-9525-2aa6c536155b", + "w": 21, + "x": 6, + "y": 0 + }, + "panelIndex": "905d7d75-61b3-4661-9525-2aa6c536155b", + "title": "Database Network Connections", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.cpu.utilization.pct", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.cpu.utilization.pct" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "w": 21, + "x": 27, + "y": 0 + }, + "panelIndex": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "title": "CPU Utilization", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.cloudsql_postgresql.database.uptime.sec: *" + }, + "isBucketed": false, + "label": "Database Uptime", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.uptime.sec" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70", + "showBar": false, + "subtitle": "Seconds" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "3d162bd4-3d81-4934-8b6d-13a85b95cf07", + "w": 6, + "x": 0, + "y": 7 + }, + "panelIndex": "3d162bd4-3d81-4934-8b6d-13a85b95cf07", + "title": "Database Uptime", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.network.sent_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.network.sent_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "816f766c-a733-40f4-b3b1-1997753c1610", + "w": 24, + "x": 0, + "y": 14 + }, + "panelIndex": "816f766c-a733-40f4-b3b1-1997753c1610", + "title": "Network Sent Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.network.received_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.network.received_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "w": 24, + "x": 24, + "y": 14 + }, + "panelIndex": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "title": "Network Received Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.disk.bytes_used.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.disk.bytes_used.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "w": 24, + "x": 0, + "y": 29 + }, + "panelIndex": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "title": "Disk Bytes Used", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.disk.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.disk.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "w": 24, + "x": 24, + "y": 29 + }, + "panelIndex": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "title": "Disk Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.disk.read_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.disk.read_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "w": 24, + "x": 0, + "y": 44 + }, + "panelIndex": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "title": "Disk Read Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.disk.write_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.disk.write_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "title": "Disk Write Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.memory.total_usage.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.memory.total_usage.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "625ccc7d-052a-42e0-b363-7821285be839", + "w": 24, + "x": 0, + "y": 59 + }, + "panelIndex": "625ccc7d-052a-42e0-b363-7821285be839", + "title": "Memory Total Usage", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.memory.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.memory.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "w": 24, + "x": 24, + "y": 59 + }, + "panelIndex": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "title": "Memory Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.audits_size.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.audits_size.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "w": 24, + "x": 0, + "y": 74 + }, + "panelIndex": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "title": "Audits Size", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_sqlserver.database.audits_upload.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_sqlserver.database.audits_upload.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "w": 24, + "x": 24, + "y": 74 + }, + "panelIndex": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "title": "Audits Upload Count", + "type": "lens", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Metrics GCP] CloudSQL SQL Server Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-08-13T20:26:29.420Z", + "id": "gcp-2b3773d0-3a16-11ee-8736-83dacf143f01", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2394df1e-4fab-4519-94e7-2521427302f6:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "905d7d75-61b3-4661-9525-2aa6c536155b:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "dd61c1f2-905d-4bf5-9171-02cf054e90a3:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3d162bd4-3d81-4934-8b6d-13a85b95cf07:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "816f766c-a733-40f4-b3b1-1997753c1610:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a07fcee5-14df-488c-bbbe-6cf03c657bf9:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "943c31e3-0b2d-4633-80e8-afa7204bf1c8:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ec6b8d60-073f-4594-a8e1-0ee636f95d34:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "cce0e37e-dfe8-4d54-bde9-2b380730166a:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "625ccc7d-052a-42e0-b363-7821285be839:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1f7f2ce0-a803-4ac2-bd66-232742252876:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9eab5155-2c28-4850-b9c8-b9f179915cbe:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0e4d41bb-da80-4b91-89be-945be1c5ae70:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_581838e6-e49e-4252-b460-80716b0819b9:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_49ce5766-f900-4de5-a320-053cd8551ff0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_cd090427-fd35-45fc-bef0-d94ccc18e3ab:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf.json b/packages/gcp/kibana/dashboard/gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf.json index 2dada268897..4c13a6817c2 100644 --- a/packages/gcp/kibana/dashboard/gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf.json +++ b/packages/gcp/kibana/dashboard/gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf.json @@ -1,644 +1,957 @@ { - "id": "gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxNCwxXQ==", - "attributes": { - "description": "Overview of the audit log data from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.audit" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.audit" - } + "attributes": { + "description": "Overview of the audit log data from Google Cloud.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "search", - "gridData": { - "h": 9, - "i": "95ebbda8-9b00-4b23-b116-72569ea031e3", - "w": 48, - "x": 0, - "y": 29 - }, - "panelIndex": "95ebbda8-9b00-4b23-b116-72569ea031e3", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Audit Event List", - "panelRefName": "panel_95ebbda8-9b00-4b23-b116-72569ea031e3" - }, - { - "version": "7.17.0", - "type": "map", - "gridData": { - "h": 15, - "i": "68d8455e-9e37-48fa-ae7c-ee1022c52dff", - "w": 24, - "x": 0, - "y": 0 }, - "panelIndex": "68d8455e-9e37-48fa-ae7c-ee1022c52dff", - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"866b5ce1-6ca0-47db-a6f2-54c5e0dcd2f0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"279da950-e9a7-4287-ab37-25906e448455\",\"joins\":[],\"label\":\"Source Locations\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"79ec6461-7561-45e4-a6a2-9d6fbd4cf986\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\",\"indexPatternId\":\"logs-*\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"settings\":{\"autoFitToDataBounds\":false},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"zoom\":1.97}", - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "title": "Audit Source Locations [Logs GCP]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "enhancements": {}, - "hiddenLayers": [], - "hidePanelTitles": false, - "isLayerTOCOpen": false, - "mapCenter": { - "lat": 32.1625, - "lon": -48.67493, - "zoom": 1.97 - }, - "openTOCDetails": [] + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "title": "Audit Source Locations" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "9f857560-27dd-4dfc-8b9d-814d0877fa0c", - "w": 24, - "x": 24, - "y": 0 - }, - "panelIndex": "9f857560-27dd-4dfc-8b9d-814d0877fa0c", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "95ebbda8-9b00-4b23-b116-72569ea031e3", + "w": 48, + "x": 0, + "y": 29 }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "panelIndex": "95ebbda8-9b00-4b23-b116-72569ea031e3", + "panelRefName": "panel_95ebbda8-9b00-4b23-b116-72569ea031e3", + "title": "Audit Event List", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"alpha\":1,\"id\":\"866b5ce1-6ca0-47db-a6f2-54c5e0dcd2f0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"279da950-e9a7-4287-ab37-25906e448455\",\"joins\":[],\"label\":\"Source Locations\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"79ec6461-7561-45e4-a6a2-9d6fbd4cf986\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1.97,\"center\":{\"lon\":-48.67493,\"lat\":32.1625},\"timeFilters\":{\"from\":\"now-10y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"gcp.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"gcp.audit\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "Audit Source Locations [Logs GCP]", + "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}" }, - "useNormalizedEsInterval": true, - "used_interval": "30d" - }, - "schema": "segment", - "type": "date_histogram" + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": false, + "mapCenter": { + "lat": 32.1625, + "lon": -48.67493, + "zoom": 1.97 + }, + "openTOCDetails": [] }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": true, - "missingBucketLabel": "[unknown]", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "savedSearchId": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 15, + "i": "68d8455e-9e37-48fa-ae7c-ee1022c52dff", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "68d8455e-9e37-48fa-ae7c-ee1022c52dff", + "title": "Audit Source Locations", + "type": "map", + "version": "8.7.1" }, - "description": "", - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e3b96831-165b-4e86-b25d-12740953faae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "43b3dd3e-fe0c-41e3-a5a7-4f0fddf1e899", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e3b96831-165b-4e86-b25d-12740953faae": { + "columnOrder": [ + "1cab7906-caa2-4d3d-93e1-ee2a0090929a", + "75226198-29ed-4e83-9dd0-2d3f0a153f68", + "8912b24e-e984-4edf-8707-08708a78bb29" + ], + "columns": { + "1cab7906-caa2-4d3d-93e1-ee2a0090929a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "75226198-29ed-4e83-9dd0-2d3f0a153f68": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "8912b24e-e984-4edf-8707-08708a78bb29", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "8912b24e-e984-4edf-8707-08708a78bb29": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "43b3dd3e-fe0c-41e3-a5a7-4f0fddf1e899", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "8912b24e-e984-4edf-8707-08708a78bb29" + ], + "isHistogram": true, + "layerId": "e3b96831-165b-4e86-b25d-12740953faae", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "75226198-29ed-4e83-9dd0-2d3f0a153f68", + "xAccessor": "1cab7906-caa2-4d3d-93e1-ee2a0090929a", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "8912b24e-e984-4edf-8707-08708a78bb29" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Audit Events Outcome over time [Logs GCP] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9f857560-27dd-4dfc-8b9d-814d0877fa0c", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "9f857560-27dd-4dfc-8b9d-814d0877fa0c", + "title": "[Logs GCP] Audit Events Outcome over time", + "type": "lens", + "version": "8.7.1" }, - "title": "Audit Events Outcome over time [Logs GCP]", - "type": "histogram", - "uiState": {} - } - }, - "title": "Audit Events Outcome over time" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3", - "w": 12, - "x": 0, - "y": 15 - }, - "panelIndex": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2f965ac-19da-47f0-bccd-9ecb4b576163", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3cfa5f4a-fb79-4c4f-8114-472a5f640e75", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2f965ac-19da-47f0-bccd-9ecb4b576163": { + "columnOrder": [ + "391663ec-d77d-452b-b573-1873f7ced9a7", + "b4b71eff-1e3c-41db-a3c3-c14c9516b290" + ], + "columns": { + "391663ec-d77d-452b-b573-1873f7ced9a7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b4b71eff-1e3c-41db-a3c3-c14c9516b290", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "b4b71eff-1e3c-41db-a3c3-c14c9516b290": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3cfa5f4a-fb79-4c4f-8114-472a5f640e75", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "d2f965ac-19da-47f0-bccd-9ecb4b576163", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "b4b71eff-1e3c-41db-a3c3-c14c9516b290" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "391663ec-d77d-452b-b573-1873f7ced9a7" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Audit Event Action [Logs GCP] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "savedSearchId": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 14, + "i": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3", + "w": 12, + "x": 0, + "y": 15 + }, + "panelIndex": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3", + "title": "[Logs GCP] Audit Event Action", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2778c4aa-2032-45ad-ab7a-fc3102a0918e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88dea866-150e-4ea9-af28-c3e0728646d7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2778c4aa-2032-45ad-ab7a-fc3102a0918e": { + "columnOrder": [ + "ea0fffd8-c3c2-4e69-bc35-ac6e629eb318", + "bf82789e-ba30-48de-a893-56a9a6826a64" + ], + "columns": { + "bf82789e-ba30-48de-a893-56a9a6826a64": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ea0fffd8-c3c2-4e69-bc35-ac6e629eb318": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Agent", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf82789e-ba30-48de-a893-56a9a6826a64", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "user_agent.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "88dea866-150e-4ea9-af28-c3e0728646d7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "2778c4aa-2032-45ad-ab7a-fc3102a0918e", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "bf82789e-ba30-48de-a893-56a9a6826a64" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ea0fffd8-c3c2-4e69-bc35-ac6e629eb318" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Audit User Agent [Logs GCP] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177", + "w": 12, + "x": 24, + "y": 15 + }, + "panelIndex": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177", + "title": "[Logs GCP] Audit User Agent", + "type": "lens", + "version": "8.7.1" }, - "description": "", - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "truncateLegend": true, - "type": "pie" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bd2de5fe-57d1-4e91-9268-46586c15a834", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4b15c217-bafd-4d2a-bf5b-bddf2485e8e0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bd2de5fe-57d1-4e91-9268-46586c15a834": { + "columnOrder": [ + "24bc8144-b413-4938-9704-58ce44830665", + "6940605b-e177-46ee-999d-01a011a87f08" + ], + "columns": { + "24bc8144-b413-4938-9704-58ce44830665": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resource Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6940605b-e177-46ee-999d-01a011a87f08", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "gcp.audit.resource_name" + }, + "6940605b-e177-46ee-999d-01a011a87f08": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4b15c217-bafd-4d2a-bf5b-bddf2485e8e0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "bd2de5fe-57d1-4e91-9268-46586c15a834", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "6940605b-e177-46ee-999d-01a011a87f08" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "24bc8144-b413-4938-9704-58ce44830665" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Audit Resource Name [Logs GCP] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "80c40a0a-c2f5-4e8b-9268-fa281d46295d", + "w": 12, + "x": 36, + "y": 15 + }, + "panelIndex": "80c40a0a-c2f5-4e8b-9268-fa281d46295d", + "title": "[Logs GCP] Audit Resource Name", + "type": "lens", + "version": "8.7.1" }, - "title": "Audit Event Action [Logs GCP]", - "type": "pie", - "uiState": { - "vis": { - "legendOpen": true - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2f965ac-19da-47f0-bccd-9ecb4b576163", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a96add48-346c-4756-8e8e-3c6e760e2d2f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2f965ac-19da-47f0-bccd-9ecb4b576163": { + "columnOrder": [ + "391663ec-d77d-452b-b573-1873f7ced9a7", + "b4b71eff-1e3c-41db-a3c3-c14c9516b290" + ], + "columns": { + "391663ec-d77d-452b-b573-1873f7ced9a7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Users", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b4b71eff-1e3c-41db-a3c3-c14c9516b290", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 15 + }, + "scale": "ordinal", + "sourceField": "client.user.email" + }, + "b4b71eff-1e3c-41db-a3c3-c14c9516b290": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a96add48-346c-4756-8e8e-3c6e760e2d2f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "d2f965ac-19da-47f0-bccd-9ecb4b576163", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "b4b71eff-1e3c-41db-a3c3-c14c9516b290" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "391663ec-d77d-452b-b573-1873f7ced9a7" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Audit Event Action [Logs GCP] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "65544fcc-cd1d-4e52-8109-cd09d104fe4d", + "w": 12, + "x": 12, + "y": 15 + }, + "panelIndex": "65544fcc-cd1d-4e52-8109-cd09d104fe4d", + "title": "[Logs GCP] Audit Event Email", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs GCP] Audit", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T14:56:32.569Z", + "id": "gcp-48e12760-cbe4-11ec-b519-85ccf621cbbf", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", + "name": "95ebbda8-9b00-4b23-b116-72569ea031e3:panel_95ebbda8-9b00-4b23-b116-72569ea031e3", + "type": "search" }, - "title": "Audit Event Action" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "c84d3240-c7fe-49cd-9a47-7c4acc95cc3d", - "w": 12, - "x": 12, - "y": 15 + { + "id": "logs-*", + "name": "68d8455e-9e37-48fa-ae7c-ee1022c52dff:layer_1_source_index_pattern", + "type": "index-pattern" }, - "panelIndex": "c84d3240-c7fe-49cd-9a47-7c4acc95cc3d", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user.email", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 15 - }, - "schema": "segment", - "type": "terms" - } - ], - "savedSearchId": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "maxFontSize": 30, - "minFontSize": 10, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "title": "Audit Top User Email [Logs GCP]", - "type": "tagcloud", - "uiState": {} - } + { + "id": "logs-*", + "name": "9f857560-27dd-4dfc-8b9d-814d0877fa0c:indexpattern-datasource-layer-e3b96831-165b-4e86-b25d-12740953faae", + "type": "index-pattern" }, - "title": "Audit Top User Email" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177", - "w": 12, - "x": 24, - "y": 15 + { + "id": "logs-*", + "name": "9f857560-27dd-4dfc-8b9d-814d0877fa0c:43b3dd3e-fe0c-41e3-a5a7-4f0fddf1e899", + "type": "index-pattern" }, - "panelIndex": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user_agent.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "savedSearchId": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "truncateLegend": true, - "type": "pie" - }, - "title": "Audit User Agent [Logs GCP]", - "type": "pie", - "uiState": { - "vis": { - "legendOpen": true - } - } - } + { + "id": "logs-*", + "name": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3:indexpattern-datasource-layer-d2f965ac-19da-47f0-bccd-9ecb4b576163", + "type": "index-pattern" }, - "title": "Audit User Agent" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "80c40a0a-c2f5-4e8b-9268-fa281d46295d", - "w": 12, - "x": 36, - "y": 15 + { + "id": "logs-*", + "name": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3:3cfa5f4a-fb79-4c4f-8114-472a5f640e75", + "type": "index-pattern" }, - "panelIndex": "80c40a0a-c2f5-4e8b-9268-fa281d46295d", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "gcp.audit.resource_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "savedSearchId": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "truncateLegend": true, - "type": "pie" - }, - "title": "Audit Resource Name [Logs GCP]", - "type": "pie", - "uiState": { - "vis": { - "legendOpen": true - } - } - } + { + "id": "logs-*", + "name": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177:indexpattern-datasource-layer-2778c4aa-2032-45ad-ab7a-fc3102a0918e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177:88dea866-150e-4ea9-af28-c3e0728646d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "80c40a0a-c2f5-4e8b-9268-fa281d46295d:indexpattern-datasource-layer-bd2de5fe-57d1-4e91-9268-46586c15a834", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "80c40a0a-c2f5-4e8b-9268-fa281d46295d:4b15c217-bafd-4d2a-bf5b-bddf2485e8e0", + "type": "index-pattern" }, - "title": "Audit Resource Name" - } + { + "id": "logs-*", + "name": "65544fcc-cd1d-4e52-8109-cd09d104fe4d:indexpattern-datasource-layer-d2f965ac-19da-47f0-bccd-9ecb4b576163", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "65544fcc-cd1d-4e52-8109-cd09d104fe4d:a96add48-346c-4756-8e8e-3c6e760e2d2f", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs GCP] Audit", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "95ebbda8-9b00-4b23-b116-72569ea031e3:panel_95ebbda8-9b00-4b23-b116-72569ea031e3", - "type": "search" - }, - { - "id": "logs-*", - "name": "68d8455e-9e37-48fa-ae7c-ee1022c52dff:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "9f857560-27dd-4dfc-8b9d-814d0877fa0c:search_0", - "type": "search" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "4e8256f8-eb9f-4d9d-8712-f237d7d653f3:search_0", - "type": "search" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "c84d3240-c7fe-49cd-9a47-7c4acc95cc3d:search_0", - "type": "search" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "9ba4db1f-9ea5-4bb0-b7d2-afc82a7ca177:search_0", - "type": "search" - }, - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "80c40a0a-c2f5-4e8b-9268-fa281d46295d:search_0", - "type": "search" - }, - { - "id": "gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "name": "tag-gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "type": "tag" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-6041d970-a6ae-11ea-950e-d57608e3aa51.json b/packages/gcp/kibana/dashboard/gcp-6041d970-a6ae-11ea-950e-d57608e3aa51.json index ed6618e1991..06a9b06700f 100644 --- a/packages/gcp/kibana/dashboard/gcp-6041d970-a6ae-11ea-950e-d57608e3aa51.json +++ b/packages/gcp/kibana/dashboard/gcp-6041d970-a6ae-11ea-950e-d57608e3aa51.json @@ -1,529 +1,918 @@ { - "id": "gcp-6041d970-a6ae-11ea-950e-d57608e3aa51", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxNSwxXQ==", - "attributes": { - "description": "Overview of Google Cloud Load Balancing TCP SSL Proxy Metrics\n\n", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "02422b42-6d8c-4924-acc1-0d7f4fb9a1b1", - "w": 10, - "x": 0, - "y": 0 + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"c2672750-bad8-40d1-99c1-9a94d3b18409\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c2672750-bad8-40d1-99c1-9a94d3b18409\",\"fieldName\":\"gcp.labels.resource.backend_name\",\"title\":\"Backend Name\",\"enhancements\":{}}},\"4e4eafe0-bb23-4c26-bbe6-15046e4ebf8c\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"4e4eafe0-bb23-4c26-bbe6-15046e4ebf8c\",\"fieldName\":\"gcp.labels.metrics.client_country\",\"title\":\"Client Country\",\"enhancements\":{}}},\"d5d4091d-103a-4d71-9612-a320b229122d\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"d5d4091d-103a-4d71-9612-a320b229122d\",\"fieldName\":\"gcp.labels.metrics.proxy_continent\",\"title\":\"Proxy Continent\",\"enhancements\":{}}}}" }, - "panelIndex": "02422b42-6d8c-4924-acc1-0d7f4fb9a1b1", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy Filters [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "gcp.labels.resource.backend_name", - "id": "1588881306802", - "indexPatternRefName": "control_0_index_pattern", - "label": "Backend Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.client_country", - "id": "1588881320708", - "indexPatternRefName": "control_1_index_pattern", - "label": "Client Country", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.proxy_continent", - "id": "1588881383318", - "indexPatternRefName": "control_2_index_pattern", - "label": "Proxy Continent", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { + "description": "Overview of Google Cloud Load Balancing TCP SSL Proxy Metrics\n\n", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "title": "Filters" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "da16e443-8524-47ea-83e1-6a16250ed61c", - "w": 13, - "x": 10, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "da16e443-8524-47ea-83e1-6a16250ed61c", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy Open Connections [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "cd2ddc00-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "bar_color_rules": [ - { - "id": "d26268d0-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "hide_last_value_indicator": true, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": ">=15m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": 1, - "metrics": [ - { - "field": "gcp.loadbalancing.tcp_ssl_proxy.open_connections.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "top_n", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "426eb053-ea79-40d9-9c36-e22761f0dff3": { + "columnOrder": [ + "2fb1057f-c77f-4ee5-b350-1520108cf671", + "5078b795-adbb-47b3-9c3e-5fd4cac42c36" + ], + "columns": { + "2fb1057f-c77f-4ee5-b350-1520108cf671": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5078b795-adbb-47b3-9c3e-5fd4cac42c36", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + }, + "5078b795-adbb-47b3-9c3e-5fd4cac42c36": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.tcp_ssl_proxy.open_connections.value last 15m", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "reducedTimeRange": "15m", + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.tcp_ssl_proxy.open_connections.value" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-426eb053-ea79-40d9-9c36-e22761f0dff3", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "5078b795-adbb-47b3-9c3e-5fd4cac42c36" + ], + "layerId": "426eb053-ea79-40d9-9c36-e22761f0dff3", + "layerType": "data", + "seriesType": "bar_horizontal", + "xAccessor": "2fb1057f-c77f-4ee5-b350-1520108cf671", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "5078b795-adbb-47b3-9c3e-5fd4cac42c36" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "valueLabels": "show", + "yLeftExtent": { + "mode": "full", + "niceValues": true + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "da16e443-8524-47ea-83e1-6a16250ed61c", + "w": 16, + "x": 0, + "y": 0 + }, + "panelIndex": "da16e443-8524-47ea-83e1-6a16250ed61c", + "title": "Open Connections", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Open Connections" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "305f8fc3-e763-4b2c-8998-9e0e057ce713", - "w": 13, - "x": 23, - "y": 0 - }, - "panelIndex": "305f8fc3-e763-4b2c-8998-9e0e057ce713", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy Closed Connections [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "cd2ddc00-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "bar_color_rules": [ - { - "id": "d26268d0-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "hide_last_value_indicator": true, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": 1, - "metrics": [ - { - "field": "gcp.loadbalancing.tcp_ssl_proxy.closed_connections.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "top_n", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ef39ec58-cae6-480d-990e-afa8a3fef28d": { + "columnOrder": [ + "d1a30f0c-c6d5-4408-b4bf-9efab025d85b", + "74ff94a1-2d47-48bd-8519-56975519fe74" + ], + "columns": { + "74ff94a1-2d47-48bd-8519-56975519fe74": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.tcp_ssl_proxy.new_connections.value last \u003e=15m", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "reducedTimeRange": "15m", + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.tcp_ssl_proxy.new_connections.value" + }, + "d1a30f0c-c6d5-4408-b4bf-9efab025d85b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "74ff94a1-2d47-48bd-8519-56975519fe74", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-ef39ec58-cae6-480d-990e-afa8a3fef28d", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "74ff94a1-2d47-48bd-8519-56975519fe74" + ], + "layerId": "ef39ec58-cae6-480d-990e-afa8a3fef28d", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "xAccessor": "d1a30f0c-c6d5-4408-b4bf-9efab025d85b", + "yConfig": [ + { + "axisMode": "left", + "color": "#54b399", + "forAccessor": "74ff94a1-2d47-48bd-8519-56975519fe74" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": false + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "e4fe30c7-906a-4878-bec7-7a78a06d98d0", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "e4fe30c7-906a-4878-bec7-7a78a06d98d0", + "title": "New Connections", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Closed Connections" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "e4fe30c7-906a-4878-bec7-7a78a06d98d0", - "w": 12, - "x": 36, - "y": 0 - }, - "panelIndex": "e4fe30c7-906a-4878-bec7-7a78a06d98d0", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy New Connections [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "cd2ddc00-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "bar_color_rules": [ - { - "id": "d26268d0-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "hide_last_value_indicator": true, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": ">=15m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.tcp_ssl_proxy.new_connections.value", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "top_n", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "674e8369-b87d-477f-aace-9e0049a64f8a": { + "columnOrder": [ + "2ffd1822-6936-4a39-86b9-865686179210", + "ef945037-09a9-48d3-9dea-5da527d7faf0" + ], + "columns": { + "2ffd1822-6936-4a39-86b9-865686179210": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ef945037-09a9-48d3-9dea-5da527d7faf0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + }, + "ef945037-09a9-48d3-9dea-5da527d7faf0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.tcp_ssl_proxy.closed_connections.value last 1s", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "reducedTimeRange": "1s", + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.tcp_ssl_proxy.closed_connections.value" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-674e8369-b87d-477f-aace-9e0049a64f8a", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": false + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ef945037-09a9-48d3-9dea-5da527d7faf0" + ], + "layerId": "674e8369-b87d-477f-aace-9e0049a64f8a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "xAccessor": "2ffd1822-6936-4a39-86b9-865686179210", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "ef945037-09a9-48d3-9dea-5da527d7faf0" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": false + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "305f8fc3-e763-4b2c-8998-9e0e057ce713", + "w": 16, + "x": 16, + "y": 0 + }, + "panelIndex": "305f8fc3-e763-4b2c-8998-9e0e057ce713", + "title": "Closed Connections", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "New Connections" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "c2bec6ee-96e8-440c-bfa4-6e0def7b0095", - "w": 23, - "x": 0, - "y": 16 - }, - "panelIndex": "c2bec6ee-96e8-440c-bfa4-6e0def7b0095", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy Egress Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "cd2ddc00-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "bar_color_rules": [ - { - "id": "d26268d0-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": ">=1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.tcp_ssl_proxy.egress.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "4f4aefcd-7553-4018-b5ad-0ab1c3e67d4c": { + "columnOrder": [ + "e43aa8fa-cc08-4030-8a24-320bd53324d6", + "8359cbc4-a600-4887-b3e6-6ef971c9d43d", + "c3de8c89-ee51-4c88-a595-e759ee848123" + ], + "columns": { + "8359cbc4-a600-4887-b3e6-6ef971c9d43d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c3de8c89-ee51-4c88-a595-e759ee848123": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.tcp_ssl_proxy.egress.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.tcp_ssl_proxy.egress.bytes" + }, + "e43aa8fa-cc08-4030-8a24-320bd53324d6": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c3de8c89-ee51-4c88-a595-e759ee848123", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4f4aefcd-7553-4018-b5ad-0ab1c3e67d4c", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c3de8c89-ee51-4c88-a595-e759ee848123" + ], + "layerId": "4f4aefcd-7553-4018-b5ad-0ab1c3e67d4c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "e43aa8fa-cc08-4030-8a24-320bd53324d6", + "xAccessor": "8359cbc4-a600-4887-b3e6-6ef971c9d43d", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "c3de8c89-ee51-4c88-a595-e759ee848123" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "c2bec6ee-96e8-440c-bfa4-6e0def7b0095", + "w": 23, + "x": 0, + "y": 16 + }, + "panelIndex": "c2bec6ee-96e8-440c-bfa4-6e0def7b0095", + "title": "Egress Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "c5f1c643-0d2a-46a0-95b3-30dc65024cae": { + "columnOrder": [ + "0db3051b-e0de-4cea-b8de-44dce341dba3", + "8c91d4b3-0612-4fc3-861e-4f3aae9a1bfd", + "e8f4dc6f-52af-442f-ad90-aac919639671" + ], + "columns": { + "0db3051b-e0de-4cea-b8de-44dce341dba3": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e8f4dc6f-52af-442f-ad90-aac919639671", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + }, + "8c91d4b3-0612-4fc3-861e-4f3aae9a1bfd": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e8f4dc6f-52af-442f-ad90-aac919639671": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.tcp_ssl_proxy.ingress.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.tcp_ssl_proxy.ingress.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-c5f1c643-0d2a-46a0-95b3-30dc65024cae", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e8f4dc6f-52af-442f-ad90-aac919639671" + ], + "layerId": "c5f1c643-0d2a-46a0-95b3-30dc65024cae", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "0db3051b-e0de-4cea-b8de-44dce341dba3", + "xAccessor": "8c91d4b3-0612-4fc3-861e-4f3aae9a1bfd", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "e8f4dc6f-52af-442f-ad90-aac919639671" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "fbaeaa8f-262d-41b1-a621-d6dbff52ff59", + "w": 25, + "x": 23, + "y": 16 + }, + "panelIndex": "fbaeaa8f-262d-41b1-a621-d6dbff52ff59", + "title": "Ingress Bytes", + "type": "lens", + "version": "8.7.1" } - } - }, - "title": "Egress Bytes" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 16, - "i": "fbaeaa8f-262d-41b1-a621-d6dbff52ff59", - "w": 25, - "x": 23, - "y": 16 + ], + "timeRestore": false, + "title": "[Metrics GCP] Load Balancing TCP SSL Proxy Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-17T13:12:15.456Z", + "id": "gcp-6041d970-a6ae-11ea-950e-d57608e3aa51", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "controlGroup_c2672750-bad8-40d1-99c1-9a94d3b18409:optionsListDataView", + "type": "index-pattern" }, - "panelIndex": "fbaeaa8f-262d-41b1-a621-d6dbff52ff59", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing TCP SSL Proxy Ingress Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "cd2ddc00-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "bar_color_rules": [ - { - "id": "d26268d0-a6a9-11ea-9765-5f34a0c2e541" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": ">=1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.tcp_ssl_proxy.ingress.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + { + "id": "metrics-*", + "name": "controlGroup_4e4eafe0-bb23-4c26-bbe6-15046e4ebf8c:optionsListDataView", + "type": "index-pattern" }, - "title": "Ingress Bytes" - } + { + "id": "metrics-*", + "name": "controlGroup_d5d4091d-103a-4d71-9612-a320b229122d:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Metrics GCP] Load Balancing TCP SSL Proxy Overview", - "version": 1 - }, - "references": [ - { - "type": "index-pattern", - "name": "02422b42-6d8c-4924-acc1-0d7f4fb9a1b1:control_0_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "02422b42-6d8c-4924-acc1-0d7f4fb9a1b1:control_1_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "02422b42-6d8c-4924-acc1-0d7f4fb9a1b1:control_2_index_pattern", - "id": "metrics-*" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json b/packages/gcp/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json deleted file mode 100644 index 1f486563a5a..00000000000 --- a/packages/gcp/kibana/dashboard/gcp-6576c480-73a2-11ea-a345-f985c61fe654.json +++ /dev/null @@ -1,564 +0,0 @@ -{ - "id": "gcp-6576c480-73a2-11ea-a345-f985c61fe654", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2023-01-13T15:03:06.156Z", - "version": "WzExMDIsMV0=", - "attributes": { - "description": "Overview of audit events from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "8.4.0", - "type": "map", - "gridData": { - "h": 15, - "i": "a808a985-5cf3-463a-9aad-5159cb64cef1", - "w": 24, - "x": 0, - "y": 0 - }, - "panelIndex": "a808a985-5cf3-463a-9aad-5159cb64cef1", - "embeddableConfig": { - "enhancements": {}, - "hiddenLayers": [], - "isLayerTOCOpen": false, - "mapCenter": { - "lat": 32.1625, - "lon": -48.67493, - "zoom": 1.97 - }, - "openTOCDetails": [], - "attributes": { - "title": "Audit Source Locations [Logs GCP]", - "description": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"settings\":{\"autoFitToDataBounds\":false},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"zoom\":1.97}", - "layerListJSON": "[{\"alpha\":1,\"id\":\"866b5ce1-6ca0-47db-a6f2-54c5e0dcd2f0\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"279da950-e9a7-4287-ab37-25906e448455\",\"joins\":[],\"label\":\"Source Locations\",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:gcp.audit\"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":true,\"geoField\":\"source.geo.location\",\"id\":\"79ec6461-7561-45e4-a6a2-9d6fbd4cf986\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]" - } - } - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "9e7025b6-c3bf-424f-b541-d22d00e1fa64", - "w": 24, - "x": 24, - "y": 0 - }, - "panelIndex": "9e7025b6-c3bf-424f-b541-d22d00e1fa64", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit Events Outcome over time [Logs GCP]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ], - "legendSize": "auto" - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-7d", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": true, - "missingBucketLabel": "[unknown]", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "5b6a8479-2c18-495e-88fa-9e3239277e3d", - "w": 12, - "x": 0, - "y": 15 - }, - "panelIndex": "5b6a8479-2c18-495e-88fa-9e3239277e3d", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit Event Action [Logs GCP]", - "description": "", - "uiState": {}, - "params": { - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie", - "legendDisplay": "show", - "legendSize": "auto" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "46da4e61-e0bb-4595-a2c7-05210bfbea64", - "w": 12, - "x": 12, - "y": 15 - }, - "panelIndex": "46da4e61-e0bb-4595-a2c7-05210bfbea64", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit Top User Email [Logs GCP]", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user.email", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 15 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "4d698f07-2caf-45c0-bd48-51ea72ea79b0", - "w": 12, - "x": 24, - "y": 15 - }, - "panelIndex": "4d698f07-2caf-45c0-bd48-51ea72ea79b0", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit User Agent [Logs GCP]", - "description": "", - "uiState": {}, - "params": { - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie", - "legendDisplay": "show", - "legendSize": "auto" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user_agent.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } - }, - { - "version": "8.5.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "c5e31da0-d4c8-4554-ab32-61da2495ab6c", - "w": 12, - "x": 36, - "y": 15 - }, - "panelIndex": "c5e31da0-d4c8-4554-ab32-61da2495ab6c", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit Resource Name [Logs GCP]", - "description": "", - "uiState": {}, - "params": { - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie", - "legendDisplay": "show", - "legendSize": "auto" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "gcp.audit.resource_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } - }, - { - "version": "8.0.0-SNAPSHOT", - "type": "search", - "gridData": { - "h": 9, - "i": "95ebbda8-9b00-4b23-b116-72569ea031e3", - "w": 48, - "x": 0, - "y": 29 - }, - "panelIndex": "95ebbda8-9b00-4b23-b116-72569ea031e3", - "embeddableConfig": { - "enhancements": {} - }, - "panelRefName": "panel_95ebbda8-9b00-4b23-b116-72569ea031e3" - } - ], - "timeRestore": false, - "title": "[Logs GCP] Audit", - "version": 1 - }, - "references": [ - { - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", - "name": "95ebbda8-9b00-4b23-b116-72569ea031e3:panel_95ebbda8-9b00-4b23-b116-72569ea031e3", - "type": "search" - }, - { - "type": "index-pattern", - "name": "a808a985-5cf3-463a-9aad-5159cb64cef1:layer_1_source_index_pattern", - "id": "logs-*" - }, - { - "type": "search", - "name": "9e7025b6-c3bf-424f-b541-d22d00e1fa64:search_0", - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654" - }, - { - "type": "search", - "name": "5b6a8479-2c18-495e-88fa-9e3239277e3d:search_0", - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654" - }, - { - "type": "search", - "name": "46da4e61-e0bb-4595-a2c7-05210bfbea64:search_0", - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654" - }, - { - "type": "search", - "name": "4d698f07-2caf-45c0-bd48-51ea72ea79b0:search_0", - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654" - }, - { - "type": "search", - "name": "c5e31da0-d4c8-4554-ab32-61da2495ab6c:search_0", - "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654" - } - ], - "migrationVersion": { - "dashboard": "8.5.0" - }, - "coreMigrationVersion": "8.5.1" -} \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78.json b/packages/gcp/kibana/dashboard/gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78.json index e25a5709343..d831ac11715 100644 --- a/packages/gcp/kibana/dashboard/gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78.json +++ b/packages/gcp/kibana/dashboard/gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78.json @@ -1,720 +1,652 @@ { - "id": "gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxNiwxXQ==", - "attributes": { - "description": "Overview of Google Cloud Billing Metrics", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 14, - "i": "2552123b-6ad6-4d63-89c3-0672ab428580", - "w": 8, - "x": 0, - "y": 0 + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"c8db2d02-9ade-449a-b3e0-e07575b49172\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c8db2d02-9ade-449a-b3e0-e07575b49172\",\"fieldName\":\"cloud.provider\",\"title\":\"Cloud Provider \",\"singleSelect\":true,\"enhancements\":{}}},\"dad54e4a-f4bf-4b07-8f8f-e98ee11282fb\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"dad54e4a-f4bf-4b07-8f8f-e98ee11282fb\",\"fieldName\":\"cloud.account.id\",\"title\":\"Account ID\",\"enhancements\":{}}},\"9721b881-e34f-489f-9c79-5ad7c1ba1f93\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"9721b881-e34f-489f-9c79-5ad7c1ba1f93\",\"fieldName\":\"gcp.billing.invoice_month\",\"title\":\"Invoice Month\",\"enhancements\":{}}}}" }, - "panelIndex": "2552123b-6ad6-4d63-89c3-0672ab428580", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Account ID Filter [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "cloud.provider", - "id": "1598550838945", - "indexPatternRefName": "control_0_index_pattern", - "label": "Cloud Provider ", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "cloud.account.id", - "id": "1598893530938", - "indexPatternRefName": "control_1_index_pattern", - "label": "Account ID", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "1598550838945", - "type": "list" - }, - { - "fieldName": "gcp.billing.invoice_month", - "id": "1598988595566", - "indexPatternRefName": "control_2_index_pattern", - "label": "Invoice Month", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { + "description": "Overview of Google Cloud Billing Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "title": "Filters" - }, - { - "version": "7.16.0", - "type": "lens", - "gridData": { - "h": 20, - "i": "2d3d3b79-0656-45c2-b051-4489484b625c", - "w": 10, - "x": 8, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "2d3d3b79-0656-45c2-b051-4489484b625c", - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "e12171da-25a4-41ea-86d3-8fd71205c263": { - "columnOrder": [ - "6011e524-4646-410b-8d1c-06c281e8f7ed", - "f8ab301c-f139-4573-b233-ed8a3f717e24" - ], - "columns": { - "6011e524-4646-410b-8d1c-06c281e8f7ed": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Invoice Month", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "f8ab301c-f139-4573-b233-ed8a3f717e24", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4cb00ce3-c62e-46f3-90ce-b69c876b9605", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "4cb00ce3-c62e-46f3-90ce-b69c876b9605": { + "columnOrder": [ + "2f66b924-5392-4e5e-93fe-5b23a87068c1" + ], + "columns": { + "2f66b924-5392-4e5e-93fe-5b23a87068c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "gcp.billing.project_id" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 12 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.invoice_month" + "visualization": { + "accessor": "2f66b924-5392-4e5e-93fe-5b23a87068c1", + "layerId": "4cb00ce3-c62e-46f3-90ce-b69c876b9605", + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" + } }, - "f8ab301c-f139-4573-b233-ed8a3f717e24": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Total Billing Cost", - "operationType": "sum", - "scale": "ratio", - "sourceField": "gcp.billing.total" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "6011e524-4646-410b-8d1c-06c281e8f7ed" - }, - { - "columnId": "f8ab301c-f139-4573-b233-ed8a3f717e24" - } - ], - "layerId": "e12171da-25a4-41ea-86d3-8fd71205c263", - "layerType": "data" - } + "title": "Total Number Of Projects [Metrics GCP]", + "visualizationType": "lnsLegacyMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 8, + "i": "9eedb0c7-2089-4e0f-af98-721034203aad", + "w": 18, + "x": 0, + "y": 0 + }, + "panelIndex": "9eedb0c7-2089-4e0f-af98-721034203aad", + "title": "Total Number Of Projects", + "type": "lens", + "version": "8.7.1" }, - "title": "Total Cost Table [Metrics GCP]", - "visualizationType": "lnsDatatable", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-e12171da-25a4-41ea-86d3-8fd71205c263", - "type": "index-pattern" - } - ] - } - }, - "title": "Cost Per Month" - }, - { - "version": "7.16.0", - "type": "lens", - "gridData": { - "h": 20, - "i": "b737e597-cc4d-4437-859c-6d491679599d", - "w": 30, - "x": 18, - "y": 0 - }, - "panelIndex": "b737e597-cc4d-4437-859c-6d491679599d", - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "4ca843af-63d7-46b9-a719-51a81eebf1f7": { - "columnOrder": [ - "2477291e-9021-4eb2-9fce-8da1ee792c49", - "10b91492-efef-490d-bc7a-c2074b2eae84" - ], - "columns": { - "10b91492-efef-490d-bc7a-c2074b2eae84": { - "dataType": "number", - "isBucketed": false, - "label": "Maximum of gcp.billing.total", - "operationType": "max", - "scale": "ratio", - "sourceField": "gcp.billing.total" - }, - "2477291e-9021-4eb2-9fce-8da1ee792c49": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Cost Per Project ID", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "10b91492-efef-490d-bc7a-c2074b2eae84", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 20 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.project_id" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "2477291e-9021-4eb2-9fce-8da1ee792c49" - ], - "layerId": "4ca843af-63d7-46b9-a719-51a81eebf1f7", - "layerType": "data", - "legendDisplay": "default", - "metric": "10b91492-efef-490d-bc7a-c2074b2eae84", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" - } - }, - "title": "Cost Per Project ID [Metrics GCP]", - "visualizationType": "lnsPie", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "type": "index-pattern" - } - ] - } - }, - "title": "Cost Per Project ID" - }, - { - "version": "7.16.0", - "type": "lens", - "gridData": { - "h": 6, - "i": "9eedb0c7-2089-4e0f-af98-721034203aad", - "w": 8, - "x": 0, - "y": 14 - }, - "panelIndex": "9eedb0c7-2089-4e0f-af98-721034203aad", - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "4cb00ce3-c62e-46f3-90ce-b69c876b9605": { - "columnOrder": [ - "2f66b924-5392-4e5e-93fe-5b23a87068c1" - ], - "columns": { - "2f66b924-5392-4e5e-93fe-5b23a87068c1": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "gcp.billing.project_id" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "2f66b924-5392-4e5e-93fe-5b23a87068c1", - "layerId": "4cb00ce3-c62e-46f3-90ce-b69c876b9605", - "layerType": "data" - } - }, - "title": "Total Number Of Projects [Metrics GCP]", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-4cb00ce3-c62e-46f3-90ce-b69c876b9605", - "type": "index-pattern" - } - ] - } - }, - "title": "Total Number Of Projects" - }, - { - "version": "7.16.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a", - "w": 48, - "x": 0, - "y": 20 - }, - "panelIndex": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a", - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "4ca843af-63d7-46b9-a719-51a81eebf1f7": { - "columnOrder": [ - "e25f49de-f161-4be8-a8fc-519188a7776c", - "b92edf5e-58bc-4382-9cd5-19db2c332c93", - "af747bf6-66e9-4760-bbd8-3dae9c97159d" - ], - "columns": { - "af747bf6-66e9-4760-bbd8-3dae9c97159d": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Total Billing Cost", - "operationType": "max", - "scale": "ratio", - "sourceField": "gcp.billing.total" - }, - "b92edf5e-58bc-4382-9cd5-19db2c332c93": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Invoice Month", - "operationType": "terms", - "params": { - "orderBy": { - "type": "alphabetical" + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "4ca843af-63d7-46b9-a719-51a81eebf1f7": { + "columnOrder": [ + "2477291e-9021-4eb2-9fce-8da1ee792c49", + "10b91492-efef-490d-bc7a-c2074b2eae84" + ], + "columns": { + "10b91492-efef-490d-bc7a-c2074b2eae84": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of gcp.billing.total", + "operationType": "max", + "scale": "ratio", + "sourceField": "gcp.billing.total" + }, + "2477291e-9021-4eb2-9fce-8da1ee792c49": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cost Per Project ID", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "10b91492-efef-490d-bc7a-c2074b2eae84", + "type": "column" + }, + "orderDirection": "desc", + "size": 20 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.project_id" + } + } + } + } + } }, - "orderDirection": "asc", - "size": 5 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.invoice_month" - }, - "e25f49de-f161-4be8-a8fc-519188a7776c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Monthly Cost", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "af747bf6-66e9-4760-bbd8-3dae9c97159d", - "type": "column" + "filters": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "size": 10 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.project_id" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "fittingFunction": "None", - "layers": [ - { - "accessors": [ - "af747bf6-66e9-4760-bbd8-3dae9c97159d" - ], - "layerId": "4ca843af-63d7-46b9-a719-51a81eebf1f7", - "layerType": "data", - "seriesType": "bar_stacked", - "splitAccessor": "b92edf5e-58bc-4382-9cd5-19db2c332c93", - "xAccessor": "e25f49de-f161-4be8-a8fc-519188a7776c" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "4ca843af-63d7-46b9-a719-51a81eebf1f7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "10b91492-efef-490d-bc7a-c2074b2eae84" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2477291e-9021-4eb2-9fce-8da1ee792c49" + ] + } + ], + "shape": "pie" + } + }, + "title": "Cost Per Project ID [Metrics GCP]", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 20, + "i": "b737e597-cc4d-4437-859c-6d491679599d", + "w": 30, + "x": 18, + "y": 0 }, - "preferredSeriesType": "bar_stacked" - } + "panelIndex": "b737e597-cc4d-4437-859c-6d491679599d", + "title": "Cost Per Project ID", + "type": "lens", + "version": "8.7.1" }, - "title": "Monthly Cost Per Project [Metrics GCP]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "type": "index-pattern" - } - ] - } - }, - "title": "Cost Per Invoice Month" - }, - { - "version": "7.16.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d", - "w": 48, - "x": 0, - "y": 35 - }, - "panelIndex": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d", - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "325e60ce-0fbd-42b0-82f6-b10df31fef6c": { - "columnOrder": [ - "faaaaf23-f362-4a00-be9e-8a155208a39e", - "c4bc659c-3e7c-41f2-bc38-32d9edee95e8", - "3041fc1b-ceb8-4188-b55d-d354819f267e" - ], - "columns": { - "3041fc1b-ceb8-4188-b55d-d354819f267e": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Total Billing", - "operationType": "max", - "scale": "ratio", - "sourceField": "gcp.billing.total" - }, - "c4bc659c-3e7c-41f2-bc38-32d9edee95e8": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "faaaaf23-f362-4a00-be9e-8a155208a39e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Project ID", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "3041fc1b-ceb8-4188-b55d-d354819f267e", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 10 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.project_id" - } - } - }, - "4ca843af-63d7-46b9-a719-51a81eebf1f7": { - "columnOrder": [ - "1164563d-d2b3-4067-bc7b-d694179182ed", - "10b91492-efef-490d-bc7a-c2074b2eae84" - ], - "columns": { - "10b91492-efef-490d-bc7a-c2074b2eae84": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Total Billing Cost", - "operationType": "sum", - "scale": "ratio", - "sourceField": "gcp.billing.total" - }, - "1164563d-d2b3-4067-bc7b-d694179182ed": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e12171da-25a4-41ea-86d3-8fd71205c263", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "e12171da-25a4-41ea-86d3-8fd71205c263": { + "columnOrder": [ + "6011e524-4646-410b-8d1c-06c281e8f7ed", + "f8ab301c-f139-4573-b233-ed8a3f717e24" + ], + "columns": { + "6011e524-4646-410b-8d1c-06c281e8f7ed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Invoice Month", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "f8ab301c-f139-4573-b233-ed8a3f717e24", + "type": "column" + }, + "orderDirection": "desc", + "size": 12 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.invoice_month" + }, + "f8ab301c-f139-4573-b233-ed8a3f717e24": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Billing Cost", + "operationType": "sum", + "scale": "ratio", + "sourceField": "gcp.billing.total" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "6011e524-4646-410b-8d1c-06c281e8f7ed" + }, + { + "columnId": "f8ab301c-f139-4573-b233-ed8a3f717e24" + } + ], + "layerId": "e12171da-25a4-41ea-86d3-8fd71205c263", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } }, - "e25f49de-f161-4be8-a8fc-519188a7776c": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Cost", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "10b91492-efef-490d-bc7a-c2074b2eae84", - "type": "column" + "title": "Total Cost Table [Metrics GCP]", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "2d3d3b79-0656-45c2-b051-4489484b625c", + "w": 18, + "x": 0, + "y": 8 + }, + "panelIndex": "2d3d3b79-0656-45c2-b051-4489484b625c", + "title": "Cost Per Month", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 15 - }, - "scale": "ordinal", - "sourceField": "gcp.billing.project_id" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "fittingFunction": "None", - "layers": [ - { - "accessors": [ - "3041fc1b-ceb8-4188-b55d-d354819f267e" - ], - "layerId": "325e60ce-0fbd-42b0-82f6-b10df31fef6c", - "layerType": "data", - "seriesType": "bar_stacked", - "splitAccessor": "faaaaf23-f362-4a00-be9e-8a155208a39e", - "xAccessor": "c4bc659c-3e7c-41f2-bc38-32d9edee95e8" - } - ], - "legend": { - "isVisible": true, - "position": "right" + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "4ca843af-63d7-46b9-a719-51a81eebf1f7": { + "columnOrder": [ + "e25f49de-f161-4be8-a8fc-519188a7776c", + "b92edf5e-58bc-4382-9cd5-19db2c332c93", + "af747bf6-66e9-4760-bbd8-3dae9c97159d" + ], + "columns": { + "af747bf6-66e9-4760-bbd8-3dae9c97159d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Billing Cost", + "operationType": "max", + "scale": "ratio", + "sourceField": "gcp.billing.total" + }, + "b92edf5e-58bc-4382-9cd5-19db2c332c93": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Invoice Month", + "operationType": "terms", + "params": { + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "size": 5 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.invoice_month" + }, + "e25f49de-f161-4be8-a8fc-519188a7776c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Monthly Cost", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "af747bf6-66e9-4760-bbd8-3dae9c97159d", + "type": "column" + }, + "orderDirection": "desc", + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.project_id" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "af747bf6-66e9-4760-bbd8-3dae9c97159d" + ], + "layerId": "4ca843af-63d7-46b9-a719-51a81eebf1f7", + "layerType": "data", + "seriesType": "bar_stacked", + "splitAccessor": "b92edf5e-58bc-4382-9cd5-19db2c332c93", + "xAccessor": "e25f49de-f161-4be8-a8fc-519188a7776c" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked" + } + }, + "title": "Monthly Cost Per Project [Metrics GCP]", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a", + "w": 48, + "x": 0, + "y": 20 }, - "preferredSeriesType": "bar_stacked" - } + "panelIndex": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a", + "title": "Cost Per Invoice Month", + "type": "lens", + "version": "8.7.1" }, - "title": "Total Cost Bar Chart [Metrics GCP]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-325e60ce-0fbd-42b0-82f6-b10df31fef6c", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "type": "index-pattern" - } - ] - } - }, - "title": "Total Billing Cost" - } - ], - "timeRestore": false, - "title": "[Metrics GCP] Billing Overview", - "version": 1 - }, - "references": [ - { - "type": "index-pattern", - "name": "2552123b-6ad6-4d63-89c3-0672ab428580:control_0_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2552123b-6ad6-4d63-89c3-0672ab428580:control_1_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2552123b-6ad6-4d63-89c3-0672ab428580:control_2_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2d3d3b79-0656-45c2-b051-4489484b625c:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "2d3d3b79-0656-45c2-b051-4489484b625c:indexpattern-datasource-layer-e12171da-25a4-41ea-86d3-8fd71205c263", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "b737e597-cc4d-4437-859c-6d491679599d:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "b737e597-cc4d-4437-859c-6d491679599d:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "9eedb0c7-2089-4e0f-af98-721034203aad:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "9eedb0c7-2089-4e0f-af98-721034203aad:indexpattern-datasource-layer-4cb00ce3-c62e-46f3-90ce-b69c876b9605", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-current-indexpattern", - "id": "metrics-*" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-325e60ce-0fbd-42b0-82f6-b10df31fef6c", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "325e60ce-0fbd-42b0-82f6-b10df31fef6c": { + "columnOrder": [ + "faaaaf23-f362-4a00-be9e-8a155208a39e", + "c4bc659c-3e7c-41f2-bc38-32d9edee95e8", + "3041fc1b-ceb8-4188-b55d-d354819f267e" + ], + "columns": { + "3041fc1b-ceb8-4188-b55d-d354819f267e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Billing", + "operationType": "max", + "scale": "ratio", + "sourceField": "gcp.billing.total" + }, + "c4bc659c-3e7c-41f2-bc38-32d9edee95e8": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "faaaaf23-f362-4a00-be9e-8a155208a39e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Project ID", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "3041fc1b-ceb8-4188-b55d-d354819f267e", + "type": "column" + }, + "orderDirection": "desc", + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.project_id" + } + } + }, + "4ca843af-63d7-46b9-a719-51a81eebf1f7": { + "columnOrder": [ + "1164563d-d2b3-4067-bc7b-d694179182ed", + "10b91492-efef-490d-bc7a-c2074b2eae84" + ], + "columns": { + "10b91492-efef-490d-bc7a-c2074b2eae84": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Billing Cost", + "operationType": "sum", + "scale": "ratio", + "sourceField": "gcp.billing.total" + }, + "1164563d-d2b3-4067-bc7b-d694179182ed": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e25f49de-f161-4be8-a8fc-519188a7776c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cost", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "10b91492-efef-490d-bc7a-c2074b2eae84", + "type": "column" + }, + "orderDirection": "desc", + "size": 15 + }, + "scale": "ordinal", + "sourceField": "gcp.billing.project_id" + } + } + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "fittingFunction": "None", + "layers": [ + { + "accessors": [ + "3041fc1b-ceb8-4188-b55d-d354819f267e" + ], + "layerId": "325e60ce-0fbd-42b0-82f6-b10df31fef6c", + "layerType": "data", + "seriesType": "bar_stacked", + "splitAccessor": "faaaaf23-f362-4a00-be9e-8a155208a39e", + "xAccessor": "c4bc659c-3e7c-41f2-bc38-32d9edee95e8" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked" + } + }, + "title": "Total Cost Bar Chart [Metrics GCP]", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d", + "w": 48, + "x": 0, + "y": 35 + }, + "panelIndex": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d", + "title": "Total Billing Cost", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Metrics GCP] Billing Overview", + "version": 1 }, - { - "type": "index-pattern", - "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-layer-325e60ce-0fbd-42b0-82f6-b10df31fef6c", - "id": "metrics-*" + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-03T08:19:14.639Z", + "id": "gcp-76c9e920-e890-11ea-bf8c-d13ebf358a78", + "migrationVersion": { + "dashboard": "8.7.0" }, - { - "type": "index-pattern", - "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", - "id": "metrics-*" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "references": [ + { + "id": "metrics-*", + "name": "9eedb0c7-2089-4e0f-af98-721034203aad:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9eedb0c7-2089-4e0f-af98-721034203aad:indexpattern-datasource-layer-4cb00ce3-c62e-46f3-90ce-b69c876b9605", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b737e597-cc4d-4437-859c-6d491679599d:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b737e597-cc4d-4437-859c-6d491679599d:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2d3d3b79-0656-45c2-b051-4489484b625c:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2d3d3b79-0656-45c2-b051-4489484b625c:indexpattern-datasource-layer-e12171da-25a4-41ea-86d3-8fd71205c263", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f4d0ebcb-ac15-4c31-ab57-7f22e0c3e02a:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-layer-325e60ce-0fbd-42b0-82f6-b10df31fef6c", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "991e60a8-68eb-4c2b-ac9a-b553e90dd49d:indexpattern-datasource-layer-4ca843af-63d7-46b9-a719-51a81eebf1f7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_c8db2d02-9ade-449a-b3e0-e07575b49172:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_dad54e4a-f4bf-4b07-8f8f-e98ee11282fb:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_9721b881-e34f-489f-9c79-5ad7c1ba1f93:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json b/packages/gcp/kibana/dashboard/gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json index a3d271940ec..2a8cf6292f2 100644 --- a/packages/gcp/kibana/dashboard/gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json +++ b/packages/gcp/kibana/dashboard/gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf.json @@ -1,1754 +1,1904 @@ { - "id": "gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxNywxXQ==", - "attributes": { - "description": "Overview of the firewall log data from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.firewall" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.firewall" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 5, - "i": "11594540-5527-4301-aa08-24093d75d4b4", - "w": 40, - "x": 0, - "y": 0 - }, - "panelIndex": "11594540-5527-4301-aa08-24093d75d4b4", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Overview of the firewall log data from Google Cloud.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "# GCP Firewall dashboard", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - } - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "77c85299-e3b8-4338-9113-a3b56ba741c7", - "w": 7, - "x": 0, - "y": 5 - }, - "panelIndex": "77c85299-e3b8-4338-9113-a3b56ba741c7", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3a32ec4e-e826-4732-a33c-af6e11d7218e", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "3a32ec4e-e826-4732-a33c-af6e11d7218e": { - "columnOrder": [ - "3938f412-fdf3-4714-a1d5-a06e36a8128b", - "fc59d35f-50a2-491b-b243-d55c3a2c936b" - ], - "columns": { - "3938f412-fdf3-4714-a1d5-a06e36a8128b": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of cloud.project.id", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "fc59d35f-50a2-491b-b243-d55c3a2c936b", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "cloud.project.id" - }, - "fc59d35f-50a2-491b-b243-d55c3a2c936b": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "3938f412-fdf3-4714-a1d5-a06e36a8128b" - ], - "layerId": "3a32ec4e-e826-4732-a33c-af6e11d7218e", - "layerType": "data", - "legendDisplay": "default", - "metric": "fc59d35f-50a2-491b-b243-d55c3a2c936b", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false + } }, - "title": "GCP Project" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6", - "w": 7, - "x": 7, - "y": 5 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2f350b92-4c75-4171-887e-1787cc418027", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "2f350b92-4c75-4171-887e-1787cc418027": { - "columnOrder": [ - "772e05df-b7e8-4757-bcbf-35d17f2faec7", - "e93ea5b6-65da-4993-a462-fb610a41824b" - ], - "columns": { - "772e05df-b7e8-4757-bcbf-35d17f2faec7": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of cloud.region", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "e93ea5b6-65da-4993-a462-fb610a41824b", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3a32ec4e-e826-4732-a33c-af6e11d7218e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "917600a0-613f-48df-8da5-86ea26a2614c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3a32ec4e-e826-4732-a33c-af6e11d7218e": { + "columnOrder": [ + "3938f412-fdf3-4714-a1d5-a06e36a8128b", + "fc59d35f-50a2-491b-b243-d55c3a2c936b" + ], + "columns": { + "3938f412-fdf3-4714-a1d5-a06e36a8128b": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cloud.project.id", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "fc59d35f-50a2-491b-b243-d55c3a2c936b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.project.id" + }, + "fc59d35f-50a2-491b-b243-d55c3a2c936b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "917600a0-613f-48df-8da5-86ea26a2614c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "cloud.region" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "3a32ec4e-e826-4732-a33c-af6e11d7218e", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "fc59d35f-50a2-491b-b243-d55c3a2c936b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "3938f412-fdf3-4714-a1d5-a06e36a8128b" + ] + } + ], + "shape": "donut" + } }, - "e93ea5b6-65da-4993-a462-fb610a41824b": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "772e05df-b7e8-4757-bcbf-35d17f2faec7" - ], - "layerId": "2f350b92-4c75-4171-887e-1787cc418027", - "layerType": "data", - "legendDisplay": "default", - "metric": "e93ea5b6-65da-4993-a462-fb610a41824b", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "77c85299-e3b8-4338-9113-a3b56ba741c7", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "77c85299-e3b8-4338-9113-a3b56ba741c7", + "title": "GCP Project", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "GCP region" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "fe15fb67-185b-426d-a575-86a6570e9b39", - "w": 7, - "x": 14, - "y": 5 - }, - "panelIndex": "fe15fb67-185b-426d-a575-86a6570e9b39", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-654ef7b2-0b28-4fc9-82a4-95e925db36a6", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "654ef7b2-0b28-4fc9-82a4-95e925db36a6": { - "columnOrder": [ - "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31", - "95c9e43b-8993-46f0-b21f-09a26f940dbb" - ], - "columns": { - "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of gcp.firewall.rule_details.direction", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "95c9e43b-8993-46f0-b21f-09a26f940dbb", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2f350b92-4c75-4171-887e-1787cc418027", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9fc7d90c-6a67-45c5-be92-3fec7871dfc9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2f350b92-4c75-4171-887e-1787cc418027": { + "columnOrder": [ + "772e05df-b7e8-4757-bcbf-35d17f2faec7", + "e93ea5b6-65da-4993-a462-fb610a41824b" + ], + "columns": { + "772e05df-b7e8-4757-bcbf-35d17f2faec7": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cloud.region", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "e93ea5b6-65da-4993-a462-fb610a41824b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.region" + }, + "e93ea5b6-65da-4993-a462-fb610a41824b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "gcp.firewall.rule_details.direction" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9fc7d90c-6a67-45c5-be92-3fec7871dfc9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "2f350b92-4c75-4171-887e-1787cc418027", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "e93ea5b6-65da-4993-a462-fb610a41824b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "772e05df-b7e8-4757-bcbf-35d17f2faec7" + ] + } + ], + "shape": "donut" + } }, - "95c9e43b-8993-46f0-b21f-09a26f940dbb": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31" - ], - "layerId": "654ef7b2-0b28-4fc9-82a4-95e925db36a6", - "layerType": "data", - "legendDisplay": "default", - "metric": "95c9e43b-8993-46f0-b21f-09a26f940dbb", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6", + "title": "GCP region", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Rule direction" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "5e11178e-7303-48dc-8549-73e80f5c9b2c", - "w": 7, - "x": 21, - "y": 5 - }, - "panelIndex": "5e11178e-7303-48dc-8549-73e80f5c9b2c", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-1f9dacfe-adbe-4312-8752-e6ef33190614", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "1f9dacfe-adbe-4312-8752-e6ef33190614": { - "columnOrder": [ - "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2", - "513d8907-d730-452a-8949-a1253e54092f" - ], - "columns": { - "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of gcp.firewall.rule_details.action", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "513d8907-d730-452a-8949-a1253e54092f", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-654ef7b2-0b28-4fc9-82a4-95e925db36a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13a20dda-d7f4-41e4-adea-8aff30111125", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "654ef7b2-0b28-4fc9-82a4-95e925db36a6": { + "columnOrder": [ + "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31", + "95c9e43b-8993-46f0-b21f-09a26f940dbb" + ], + "columns": { + "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of gcp.firewall.rule_details.direction", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "95c9e43b-8993-46f0-b21f-09a26f940dbb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "gcp.firewall.rule_details.direction" + }, + "95c9e43b-8993-46f0-b21f-09a26f940dbb": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "13a20dda-d7f4-41e4-adea-8aff30111125", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "gcp.firewall.rule_details.action" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "654ef7b2-0b28-4fc9-82a4-95e925db36a6", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "95c9e43b-8993-46f0-b21f-09a26f940dbb" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "1ffd51e6-7ef8-4109-ad72-3d5e90bbdb31" + ] + } + ], + "shape": "pie" + } }, - "513d8907-d730-452a-8949-a1253e54092f": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2" - ], - "layerId": "1f9dacfe-adbe-4312-8752-e6ef33190614", - "layerType": "data", - "legendDisplay": "default", - "metric": "513d8907-d730-452a-8949-a1253e54092f", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "fe15fb67-185b-426d-a575-86a6570e9b39", + "w": 8, + "x": 16, + "y": 0 + }, + "panelIndex": "fe15fb67-185b-426d-a575-86a6570e9b39", + "title": "Rule direction", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Rule action" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "735c4030-d5b3-459c-9000-427ca5cb9d70", - "w": 9, - "x": 28, - "y": 5 - }, - "panelIndex": "735c4030-d5b3-459c-9000-427ca5cb9d70", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9c02e90f-5fb4-4c58-9c74-bf76f2b246fc": { - "columnOrder": [ - "b24ed9f4-2bd9-42fd-8924-f63ad2780146", - "6ce82469-1771-4f1a-96af-1387e676492f" - ], - "columns": { - "6ce82469-1771-4f1a-96af-1387e676492f": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "b24ed9f4-2bd9-42fd-8924-f63ad2780146": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of gcp.firewall.rule_details.ip_port_info.ip_protocol", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "6ce82469-1771-4f1a-96af-1387e676492f", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1f9dacfe-adbe-4312-8752-e6ef33190614", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": false, - "size": 7 - }, - "scale": "ordinal", - "sourceField": "gcp.firewall.rule_details.ip_port_info.ip_protocol" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "b24ed9f4-2bd9-42fd-8924-f63ad2780146" - ], - "layerId": "9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", - "layerType": "data", - "legendDisplay": "default", - "metric": "6ce82469-1771-4f1a-96af-1387e676492f", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Protocols" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "b8028d6f-bf4e-43a0-b19a-65047c757821", - "w": 11, - "x": 37, - "y": 5 - }, - "panelIndex": "b8028d6f-bf4e-43a0-b19a-65047c757821", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-49f72f3e-4ec2-418f-8183-30f7ca58c8e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "49f72f3e-4ec2-418f-8183-30f7ca58c8e7": { - "columnOrder": [ - "9162c285-d838-46ea-99c3-54cf59ec1a1d", - "5783f5fa-33c4-407f-8ee6-b0e7d693e993" - ], - "columns": { - "5783f5fa-33c4-407f-8ee6-b0e7d693e993": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "9162c285-d838-46ea-99c3-54cf59ec1a1d": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Target Tag", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "5783f5fa-33c4-407f-8ee6-b0e7d693e993", - "type": "column" + { + "id": "logs-*", + "name": "23fc92ff-ea76-4e2a-9310-9aa7db29ccdb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1f9dacfe-adbe-4312-8752-e6ef33190614": { + "columnOrder": [ + "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2", + "513d8907-d730-452a-8949-a1253e54092f" + ], + "columns": { + "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of gcp.firewall.rule_details.action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "513d8907-d730-452a-8949-a1253e54092f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "gcp.firewall.rule_details.action" + }, + "513d8907-d730-452a-8949-a1253e54092f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "gcp.firewall.rule_details.target_tag" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "9162c285-d838-46ea-99c3-54cf59ec1a1d" - ], - "layerId": "49f72f3e-4ec2-418f-8183-30f7ca58c8e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "5783f5fa-33c4-407f-8ee6-b0e7d693e993", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "donut" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Target Tag" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 10, - "i": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296", - "w": 48, - "x": 0, - "y": 16 - }, - "panelIndex": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-942bb851-a16a-4422-afaf-8521bb72644f", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "942bb851-a16a-4422-afaf-8521bb72644f": { - "columnOrder": [ - "ad5cb314-cb12-40c6-a623-d6ffdf0ee027", - "a2c30dbc-5784-423d-a343-177a03140465", - "da23fc0e-33d4-4361-8ddb-67862b6e0951" - ], - "columns": { - "a2c30dbc-5784-423d-a343-177a03140465": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - }, - "ad5cb314-cb12-40c6-a623-d6ffdf0ee027": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of gcp.firewall.rule_details.action", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "da23fc0e-33d4-4361-8ddb-67862b6e0951", - "type": "column" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "23fc92ff-ea76-4e2a-9310-9aa7db29ccdb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 3 - }, - "scale": "ordinal", - "sourceField": "gcp.firewall.rule_details.action" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "1f9dacfe-adbe-4312-8752-e6ef33190614", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "513d8907-d730-452a-8949-a1253e54092f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "428cb2ae-d9d0-4f84-8771-9045dc7ad6b2" + ] + } + ], + "shape": "pie" + } }, - "da23fc0e-33d4-4361-8ddb-67862b6e0951": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 11, + "i": "5e11178e-7303-48dc-8549-73e80f5c9b2c", + "w": 8, + "x": 24, + "y": 0 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "5e11178e-7303-48dc-8549-73e80f5c9b2c", + "title": "Rule action", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1d06d2aa-1d79-4322-a98d-3b012910b97b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9c02e90f-5fb4-4c58-9c74-bf76f2b246fc": { + "columnOrder": [ + "b24ed9f4-2bd9-42fd-8924-f63ad2780146", + "6ce82469-1771-4f1a-96af-1387e676492f" + ], + "columns": { + "6ce82469-1771-4f1a-96af-1387e676492f": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "b24ed9f4-2bd9-42fd-8924-f63ad2780146": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of gcp.firewall.rule_details.ip_port_info.ip_protocol", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "6ce82469-1771-4f1a-96af-1387e676492f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 7 + }, + "scale": "ordinal", + "sourceField": "gcp.firewall.rule_details.ip_port_info.ip_protocol" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1d06d2aa-1d79-4322-a98d-3b012910b97b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "6ce82469-1771-4f1a-96af-1387e676492f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "b24ed9f4-2bd9-42fd-8924-f63ad2780146" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "da23fc0e-33d4-4361-8ddb-67862b6e0951" - ], - "layerId": "942bb851-a16a-4422-afaf-8521bb72644f", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "ad5cb314-cb12-40c6-a623-d6ffdf0ee027", - "xAccessor": "a2c30dbc-5784-423d-a343-177a03140465" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 11, + "i": "735c4030-d5b3-459c-9000-427ca5cb9d70", + "w": 8, + "x": 32, + "y": 0 }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "735c4030-d5b3-459c-9000-427ca5cb9d70", + "title": "Protocols", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-49f72f3e-4ec2-418f-8183-30f7ca58c8e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1518d141-10d3-459d-9fc2-f4aa855cd235", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "49f72f3e-4ec2-418f-8183-30f7ca58c8e7": { + "columnOrder": [ + "9162c285-d838-46ea-99c3-54cf59ec1a1d", + "5783f5fa-33c4-407f-8ee6-b0e7d693e993" + ], + "columns": { + "5783f5fa-33c4-407f-8ee6-b0e7d693e993": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "9162c285-d838-46ea-99c3-54cf59ec1a1d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Target Tag", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "5783f5fa-33c4-407f-8ee6-b0e7d693e993", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "gcp.firewall.rule_details.target_tag" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1518d141-10d3-459d-9fc2-f4aa855cd235", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "49f72f3e-4ec2-418f-8183-30f7ca58c8e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "5783f5fa-33c4-407f-8ee6-b0e7d693e993" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "9162c285-d838-46ea-99c3-54cf59ec1a1d" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 11, + "i": "b8028d6f-bf4e-43a0-b19a-65047c757821", + "w": 8, + "x": 40, + "y": 0 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "b8028d6f-bf4e-43a0-b19a-65047c757821", + "title": "Target Tag", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Firewall events over time" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 13, - "i": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3", - "w": 24, - "x": 0, - "y": 26 - }, - "panelIndex": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-609d8521-e339-49d2-8564-713fd932c285", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "609d8521-e339-49d2-8564-713fd932c285": { - "columnOrder": [ - "f9145218-da9e-43c9-9e22-c707834256cc", - "426e0fb0-db17-4e02-8fc8-60d472e450f2", - "d2e14e21-2c9b-46b9-8508-288c81cbc712" - ], - "columns": { - "426e0fb0-db17-4e02-8fc8-60d472e450f2": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Priority", - "operationType": "range", - "params": { - "maxBars": "auto", - "ranges": [ - { - "from": 0, - "label": "", - "to": 1000 - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-942bb851-a16a-4422-afaf-8521bb72644f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84c18667-75dc-4425-8f07-1fc70bea1d55", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "942bb851-a16a-4422-afaf-8521bb72644f": { + "columnOrder": [ + "ad5cb314-cb12-40c6-a623-d6ffdf0ee027", + "a2c30dbc-5784-423d-a343-177a03140465", + "da23fc0e-33d4-4361-8ddb-67862b6e0951" + ], + "columns": { + "a2c30dbc-5784-423d-a343-177a03140465": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ad5cb314-cb12-40c6-a623-d6ffdf0ee027": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of gcp.firewall.rule_details.action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "da23fc0e-33d4-4361-8ddb-67862b6e0951", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "gcp.firewall.rule_details.action" + }, + "da23fc0e-33d4-4361-8ddb-67862b6e0951": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "84c18667-75dc-4425-8f07-1fc70bea1d55", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } ], - "type": "histogram" - }, - "scale": "interval", - "sourceField": "gcp.firewall.rule_details.priority" - }, - "d2e14e21-2c9b-46b9-8508-288c81cbc712": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "f9145218-da9e-43c9-9e22-c707834256cc": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "VM", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "d2e14e21-2c9b-46b9-8508-288c81cbc712", - "type": "column" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "cloud.instance.name" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "da23fc0e-33d4-4361-8ddb-67862b6e0951" + ], + "layerId": "942bb851-a16a-4422-afaf-8521bb72644f", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "ad5cb314-cb12-40c6-a623-d6ffdf0ee027", + "xAccessor": "a2c30dbc-5784-423d-a343-177a03140465" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 10, + "i": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296", + "w": 48, + "x": 0, + "y": 11 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296", + "title": "Firewall events over time", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-609d8521-e339-49d2-8564-713fd932c285", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5350e9b4-b6d0-4ecb-b61a-d858ab6a49a8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "609d8521-e339-49d2-8564-713fd932c285": { + "columnOrder": [ + "f9145218-da9e-43c9-9e22-c707834256cc", + "426e0fb0-db17-4e02-8fc8-60d472e450f2", + "d2e14e21-2c9b-46b9-8508-288c81cbc712" + ], + "columns": { + "426e0fb0-db17-4e02-8fc8-60d472e450f2": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Priority", + "operationType": "range", + "params": { + "maxBars": "auto", + "ranges": [ + { + "from": 0, + "label": "", + "to": 1000 + } + ], + "type": "histogram" + }, + "scale": "interval", + "sourceField": "gcp.firewall.rule_details.priority" + }, + "d2e14e21-2c9b-46b9-8508-288c81cbc712": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "f9145218-da9e-43c9-9e22-c707834256cc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "VM", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "d2e14e21-2c9b-46b9-8508-288c81cbc712", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.instance.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5350e9b4-b6d0-4ecb-b61a-d858ab6a49a8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d2e14e21-2c9b-46b9-8508-288c81cbc712" + ], + "layerId": "609d8521-e339-49d2-8564-713fd932c285", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "splitAccessor": "426e0fb0-db17-4e02-8fc8-60d472e450f2", + "xAccessor": "f9145218-da9e-43c9-9e22-c707834256cc" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "d2e14e21-2c9b-46b9-8508-288c81cbc712" - ], - "layerId": "609d8521-e339-49d2-8564-713fd932c285", - "layerType": "data", - "position": "top", - "seriesType": "bar_horizontal", - "showGridlines": false, - "splitAccessor": "426e0fb0-db17-4e02-8fc8-60d472e450f2", - "xAccessor": "f9145218-da9e-43c9-9e22-c707834256cc" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 13, + "i": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3", + "w": 24, + "x": 0, + "y": 21 }, - "preferredSeriesType": "bar_horizontal", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3", + "title": "Top VMs", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1559a734-d79f-47af-95f1-0278d058a38c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eefc04f6-67b4-4e6b-9351-f1484bbbb807", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1559a734-d79f-47af-95f1-0278d058a38c": { + "columnOrder": [ + "45e4569d-d389-4118-8079-431dd014760b", + "d7154085-306d-4cf4-89bf-522a2a4dc723" + ], + "columns": { + "45e4569d-d389-4118-8079-431dd014760b": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of rule.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "d7154085-306d-4cf4-89bf-522a2a4dc723", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "rule.name" + }, + "d7154085-306d-4cf4-89bf-522a2a4dc723": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "eefc04f6-67b4-4e6b-9351-f1484bbbb807", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "1559a734-d79f-47af-95f1-0278d058a38c", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "d7154085-306d-4cf4-89bf-522a2a4dc723" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "45e4569d-d389-4118-8079-431dd014760b" + ] + } + ], + "shape": "treemap" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 13, + "i": "c704818b-a568-4142-92f0-3ff09f0fb8e6", + "w": 24, + "x": 24, + "y": 21 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "c704818b-a568-4142-92f0-3ff09f0fb8e6", + "title": "Firewall rules", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Top VMs" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 13, - "i": "c704818b-a568-4142-92f0-3ff09f0fb8e6", - "w": 24, - "x": 24, - "y": 26 - }, - "panelIndex": "c704818b-a568-4142-92f0-3ff09f0fb8e6", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-1559a734-d79f-47af-95f1-0278d058a38c", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "1559a734-d79f-47af-95f1-0278d058a38c": { - "columnOrder": [ - "45e4569d-d389-4118-8079-431dd014760b", - "d7154085-306d-4cf4-89bf-522a2a4dc723" - ], - "columns": { - "45e4569d-d389-4118-8079-431dd014760b": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of rule.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "d7154085-306d-4cf4-89bf-522a2a4dc723", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "rule.name" + { + "id": "logs-*", + "name": "c39a889b-ec8e-4b85-b88f-383a1c8e81cf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ced29d00-2d8b-43b9-bcc5-361f940b534c": { + "columnOrder": [ + "3d150b77-0069-4770-8e55-38e152a4e97c", + "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c", + "4ed872b0-f56b-4d53-b5a6-82d6f177fadc" + ], + "columns": { + "3d150b77-0069-4770-8e55-38e152a4e97c": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination Port", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.port" + }, + "4ed872b0-f56b-4d53-b5a6-82d6f177fadc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.port" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c39a889b-ec8e-4b85-b88f-383a1c8e81cf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isYAxisLabelVisible": true, + "type": "lens_heatmap_grid" + }, + "layerId": "ced29d00-2d8b-43b9-bcc5-361f940b534c", + "layerType": "data", + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "type": "lens_heatmap_legendConfig" + }, + "palette": { + "accessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "name": "cool", + "params": { + "continuity": "above", + "name": "cool", + "rangeMax": null, + "rangeMin": 0, + "reverse": false, + "stops": [ + { + "color": "#e0e8f2", + "stop": 0 + }, + { + "color": "#c2d2e6", + "stop": 20 + }, + { + "color": "#a2bcd9", + "stop": 40 + }, + { + "color": "#82a7cd", + "stop": 60 + }, + { + "color": "#6092c0", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "title": "Empty Heatmap chart", + "valueAccessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "xAccessor": "3d150b77-0069-4770-8e55-38e152a4e97c", + "yAccessor": "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c" + } }, - "d7154085-306d-4cf4-89bf-522a2a4dc723": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "45e4569d-d389-4118-8079-431dd014760b" - ], - "layerId": "1559a734-d79f-47af-95f1-0278d058a38c", - "layerType": "data", - "legendDisplay": "default", - "metric": "d7154085-306d-4cf4-89bf-522a2a4dc723", - "nestedLegend": false, - "numberDisplay": "percent", - "percentDecimals": 2 - } - ], - "shape": "treemap" - } + "title": "", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f5d8c4eb-716d-4286-9f82-4cff620b3b11", + "w": 24, + "x": 0, + "y": 34 + }, + "panelIndex": "f5d8c4eb-716d-4286-9f82-4cff620b3b11", + "title": "Events between Ports", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Firewall rules" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "f5d8c4eb-716d-4286-9f82-4cff620b3b11", - "w": 24, - "x": 0, - "y": 39 - }, - "panelIndex": "f5d8c4eb-716d-4286-9f82-4cff620b3b11", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "ced29d00-2d8b-43b9-bcc5-361f940b534c": { - "columnOrder": [ - "3d150b77-0069-4770-8e55-38e152a4e97c", - "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c", - "4ed872b0-f56b-4d53-b5a6-82d6f177fadc" - ], - "columns": { - "3d150b77-0069-4770-8e55-38e152a4e97c": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Destination Port", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2a2409bf-8225-4d5b-8fb4-3667bc1a8da4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ced29d00-2d8b-43b9-bcc5-361f940b534c": { + "columnOrder": [ + "3d150b77-0069-4770-8e55-38e152a4e97c", + "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c", + "4ed872b0-f56b-4d53-b5a6-82d6f177fadc" + ], + "columns": { + "3d150b77-0069-4770-8e55-38e152a4e97c": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "4ed872b0-f56b-4d53-b5a6-82d6f177fadc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {} + } + } + } }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "destination.port" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2a2409bf-8225-4d5b-8fb4-3667bc1a8da4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isYAxisLabelVisible": true, + "type": "lens_heatmap_grid" + }, + "layerId": "ced29d00-2d8b-43b9-bcc5-361f940b534c", + "layerType": "data", + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "type": "lens_heatmap_legendConfig" + }, + "palette": { + "accessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "name": "cool", + "params": { + "continuity": "above", + "name": "cool", + "rangeMax": null, + "rangeMin": 0, + "reverse": false, + "stops": [ + { + "color": "#e0e8f2", + "stop": 0 + }, + { + "color": "#c2d2e6", + "stop": 20 + }, + { + "color": "#a2bcd9", + "stop": 40 + }, + { + "color": "#82a7cd", + "stop": 60 + }, + { + "color": "#6092c0", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "title": "Empty Heatmap chart", + "valueAccessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", + "xAccessor": "3d150b77-0069-4770-8e55-38e152a4e97c", + "yAccessor": "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c" + } }, - "4ed872b0-f56b-4d53-b5a6-82d6f177fadc": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "params": { - "format": { - "id": "number", - "params": { - "decimals": 2 - } + "title": "", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5", + "w": 24, + "x": 24, + "y": 34 + }, + "panelIndex": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5", + "title": "Events between IPs", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } } - }, - "scale": "ratio", - "sourceField": "Records" }, - "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "source.port" - } - }, - "incompleteColumns": {} + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.domain\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.domain\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination domain", + "type": "vega", + "uiState": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "gridConfig": { - "isCellLabelVisible": false, - "isXAxisLabelVisible": true, - "isYAxisLabelVisible": true, - "type": "lens_heatmap_grid" }, - "layerId": "ced29d00-2d8b-43b9-bcc5-361f940b534c", - "layerType": "data", - "legend": { - "isVisible": true, - "maxLines": 1, - "position": "right", - "shouldTruncate": true, - "type": "lens_heatmap_legendConfig" + "gridData": { + "h": 15, + "i": "899f49c0-9400-452b-b833-5b59e3ad0338", + "w": 24, + "x": 0, + "y": 49 }, - "palette": { - "accessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "name": "negative", - "params": { - "name": "negative", - "rangeMax": 80, - "rangeMin": 0, - "reverse": false, - "stops": [ - { - "color": "#fbddd6", - "stop": 0 - }, - { - "color": "#f3bbaf", - "stop": 20 - }, - { - "color": "#e99a89", - "stop": 40 - }, - { - "color": "#db7965", - "stop": 60 - }, - { - "color": "#cc5642", - "stop": 80 - } - ] - }, - "type": "palette" - }, - "shape": "heatmap", - "title": "Empty Heatmap chart", - "valueAccessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "xAccessor": "3d150b77-0069-4770-8e55-38e152a4e97c", - "yAccessor": "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c" - } + "panelIndex": "899f49c0-9400-452b-b833-5b59e3ad0338", + "title": "Sankey Source to Destination domain", + "type": "visualization", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsHeatmap" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Events between Ports" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5", - "w": 24, - "x": 24, - "y": 39 - }, - "panelIndex": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "ced29d00-2d8b-43b9-bcc5-361f940b534c": { - "columnOrder": [ - "3d150b77-0069-4770-8e55-38e152a4e97c", - "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c", - "4ed872b0-f56b-4d53-b5a6-82d6f177fadc" - ], - "columns": { - "3d150b77-0069-4770-8e55-38e152a4e97c": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Destination IP", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "destination.ip" - }, - "4ed872b0-f56b-4d53-b5a6-82d6f177fadc": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Events", - "operationType": "count", - "params": { - "format": { - "id": "number", - "params": { - "decimals": 2 - } + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.firewall" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.firewall" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } } - }, - "scale": "ratio", - "sourceField": "Records" }, - "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c": { - "customLabel": true, - "dataType": "ip", - "isBucketed": true, - "label": "Source IP", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "source.ip" - } - }, - "incompleteColumns": {} + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.vpc_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.vpc_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination VPC", + "type": "vega", + "uiState": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.firewall\" " - }, - "visualization": { - "gridConfig": { - "isCellLabelVisible": false, - "isXAxisLabelVisible": true, - "isYAxisLabelVisible": true, - "type": "lens_heatmap_grid" - }, - "layerId": "ced29d00-2d8b-43b9-bcc5-361f940b534c", - "layerType": "data", - "legend": { - "isVisible": true, - "maxLines": 1, - "position": "right", - "shouldTruncate": true, - "type": "lens_heatmap_legendConfig" }, - "palette": { - "accessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "name": "negative", - "params": { - "name": "negative", - "rangeMax": 80, - "rangeMin": 0, - "reverse": false, - "stops": [ - { - "color": "#fbddd6", - "stop": 0 - }, - { - "color": "#f3bbaf", - "stop": 20 - }, - { - "color": "#e99a89", - "stop": 40 - }, - { - "color": "#db7965", - "stop": 60 - }, - { - "color": "#cc5642", - "stop": 80 - } - ] - }, - "type": "palette" + "gridData": { + "h": 15, + "i": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9", + "w": 24, + "x": 24, + "y": 49 }, - "shape": "heatmap", - "title": "Empty Heatmap chart", - "valueAccessor": "4ed872b0-f56b-4d53-b5a6-82d6f177fadc", - "xAccessor": "3d150b77-0069-4770-8e55-38e152a4e97c", - "yAccessor": "8aa7938e-eccd-4b41-8147-ac09a0ba4b1c" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsHeatmap" - }, - "enhancements": {}, - "hidePanelTitles": false + "panelIndex": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9", + "title": "Sankey Source to Destination VPC", + "type": "visualization", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Logs GCP] Firewall", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T15:39:34.883Z", + "id": "gcp-8a1fb690-cbeb-11ec-b519-85ccf621cbbf", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "77c85299-e3b8-4338-9113-a3b56ba741c7:indexpattern-datasource-layer-3a32ec4e-e826-4732-a33c-af6e11d7218e", + "type": "index-pattern" }, - "title": "Events between IPs" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "899f49c0-9400-452b-b833-5b59e3ad0338", - "w": 24, - "x": 0, - "y": 54 + { + "id": "logs-*", + "name": "77c85299-e3b8-4338-9113-a3b56ba741c7:917600a0-613f-48df-8da5-86ea26a2614c", + "type": "index-pattern" }, - "panelIndex": "899f49c0-9400-452b-b833-5b59e3ad0338", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": true, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.firewall" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.firewall" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.domain\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.domain\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination domain", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6:indexpattern-datasource-layer-2f350b92-4c75-4171-887e-1787cc418027", + "type": "index-pattern" }, - "title": "Sankey Source to Destination domain" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9", - "w": 24, - "x": 24, - "y": 54 + { + "id": "logs-*", + "name": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6:9fc7d90c-6a67-45c5-be92-3fec7871dfc9", + "type": "index-pattern" }, - "panelIndex": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": true, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.firewall" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.firewall" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.vpc_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.vpc_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination VPC", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "fe15fb67-185b-426d-a575-86a6570e9b39:indexpattern-datasource-layer-654ef7b2-0b28-4fc9-82a4-95e925db36a6", + "type": "index-pattern" }, - "title": "Sankey Source to Destination VPC" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 5, - "i": "fb39f126-e3c2-4ae0-a484-a39accee7efd", - "w": 8, - "x": 40, - "y": 0 + { + "id": "logs-*", + "name": "fe15fb67-185b-426d-a575-86a6570e9b39:13a20dda-d7f4-41e4-adea-8aff30111125", + "type": "index-pattern" }, - "panelIndex": "fb39f126-e3c2-4ae0-a484-a39accee7efd", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "", - "interval": "", - "isModelInvalid": false, - "markdown": "[Detection Engine](security/detections)\r\n\r\n[Network overview](security/network/flows)", - "markdown_css": "#markdown-61ca57f0-469d-11e7-af02-69e470af7417 a{background-color:#07C;color:#fff;padding:8px 12px;height:40px;display:inline-block;font-family:Inter UI,-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol;font-weight:400;letter-spacing:-0.005em;font-size:1rem;line-height:1.5;text-decoration:none;border-radius:4px;vertical-align:middle;width:100%;text-align:center}", - "markdown_less": "a {\n background-color: #07C;\n color: #fff;\n padding: 8px 12px;\n height: 40px;\n display: inline-block;\n font-family: Inter UI,-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol;\n font-weight: 400;\n letter-spacing: -.005em;\n font-size: 1rem;\n line-height: 1.5;\n text-decoration: none;\n border-radius: 4px;\n vertical-align: middle;\n width: 100%;\n text-align: center;\n}", - "markdown_openLinksInNewTab": 1, - "markdown_vertical_align": "middle", - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "markdown", - "use_kibana_indexes": true - }, - "title": "Nav Buttons", - "type": "metrics", - "uiState": {} - } + { + "id": "logs-*", + "name": "5e11178e-7303-48dc-8549-73e80f5c9b2c:indexpattern-datasource-layer-1f9dacfe-adbe-4312-8752-e6ef33190614", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e11178e-7303-48dc-8549-73e80f5c9b2c:23fc92ff-ea76-4e2a-9310-9aa7db29ccdb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "735c4030-d5b3-459c-9000-427ca5cb9d70:indexpattern-datasource-layer-9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "735c4030-d5b3-459c-9000-427ca5cb9d70:1d06d2aa-1d79-4322-a98d-3b012910b97b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b8028d6f-bf4e-43a0-b19a-65047c757821:indexpattern-datasource-layer-49f72f3e-4ec2-418f-8183-30f7ca58c8e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b8028d6f-bf4e-43a0-b19a-65047c757821:1518d141-10d3-459d-9fc2-f4aa855cd235", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296:indexpattern-datasource-layer-942bb851-a16a-4422-afaf-8521bb72644f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296:84c18667-75dc-4425-8f07-1fc70bea1d55", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3:indexpattern-datasource-layer-609d8521-e339-49d2-8564-713fd932c285", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3:5350e9b4-b6d0-4ecb-b61a-d858ab6a49a8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c704818b-a568-4142-92f0-3ff09f0fb8e6:indexpattern-datasource-layer-1559a734-d79f-47af-95f1-0278d058a38c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c704818b-a568-4142-92f0-3ff09f0fb8e6:eefc04f6-67b4-4e6b-9351-f1484bbbb807", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5d8c4eb-716d-4286-9f82-4cff620b3b11:indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5d8c4eb-716d-4286-9f82-4cff620b3b11:c39a889b-ec8e-4b85-b88f-383a1c8e81cf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5:indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5:2a2409bf-8225-4d5b-8fb4-3667bc1a8da4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "899f49c0-9400-452b-b833-5b59e3ad0338:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } - } ], - "timeRestore": false, - "title": "[Logs GCP] Firewall", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "77c85299-e3b8-4338-9113-a3b56ba741c7:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "77c85299-e3b8-4338-9113-a3b56ba741c7:indexpattern-datasource-layer-3a32ec4e-e826-4732-a33c-af6e11d7218e", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0fc7a288-d3c6-4f18-8d0e-ca3c0f66aeb6:indexpattern-datasource-layer-2f350b92-4c75-4171-887e-1787cc418027", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fe15fb67-185b-426d-a575-86a6570e9b39:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fe15fb67-185b-426d-a575-86a6570e9b39:indexpattern-datasource-layer-654ef7b2-0b28-4fc9-82a4-95e925db36a6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "5e11178e-7303-48dc-8549-73e80f5c9b2c:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "5e11178e-7303-48dc-8549-73e80f5c9b2c:indexpattern-datasource-layer-1f9dacfe-adbe-4312-8752-e6ef33190614", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "735c4030-d5b3-459c-9000-427ca5cb9d70:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "735c4030-d5b3-459c-9000-427ca5cb9d70:indexpattern-datasource-layer-9c02e90f-5fb4-4c58-9c74-bf76f2b246fc", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b8028d6f-bf4e-43a0-b19a-65047c757821:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b8028d6f-bf4e-43a0-b19a-65047c757821:indexpattern-datasource-layer-49f72f3e-4ec2-418f-8183-30f7ca58c8e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "63b2dd96-9ce1-43cc-add3-7bc34ff4b296:indexpattern-datasource-layer-942bb851-a16a-4422-afaf-8521bb72644f", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e9a02bc3-c20c-4a38-8c75-2db4923c60a3:indexpattern-datasource-layer-609d8521-e339-49d2-8564-713fd932c285", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c704818b-a568-4142-92f0-3ff09f0fb8e6:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c704818b-a568-4142-92f0-3ff09f0fb8e6:indexpattern-datasource-layer-1559a734-d79f-47af-95f1-0278d058a38c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f5d8c4eb-716d-4286-9f82-4cff620b3b11:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f5d8c4eb-716d-4286-9f82-4cff620b3b11:indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bfc4e50a-001c-4d8a-9074-8b1c969eabd5:indexpattern-datasource-layer-ced29d00-2d8b-43b9-bcc5-361f940b534c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "899f49c0-9400-452b-b833-5b59e3ad0338:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "6f5213ce-73ea-4438-88e4-b5cb5506a9c9:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "name": "tag-gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "type": "tag" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87.json b/packages/gcp/kibana/dashboard/gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87.json index 81a1e9717c8..776274ce7cc 100644 --- a/packages/gcp/kibana/dashboard/gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87.json +++ b/packages/gcp/kibana/dashboard/gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87.json @@ -1,438 +1,821 @@ { - "id": "gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxOCwxXQ==", - "attributes": { - "description": "Overview of GCP Load Balancing L3 Metrics", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 6, - "i": "8b86e712-4709-458a-b8e9-40e79305b1aa", - "w": 48, - "x": 0, - "y": 0 + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"19b17b1a-02e7-425b-bdaf-789f36fb52b8\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"19b17b1a-02e7-425b-bdaf-789f36fb52b8\",\"fieldName\":\"gcp.labels.resource.backend_name\",\"title\":\"Backend Name\",\"enhancements\":{}}},\"682e20de-617f-479c-9f35-1282a76f0834\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"682e20de-617f-479c-9f35-1282a76f0834\",\"fieldName\":\"gcp.labels.metrics.client_zone\",\"title\":\"Client Zone\",\"enhancements\":{}}},\"519ec7d3-cef1-40ff-99a0-6370f278f54c\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"519ec7d3-cef1-40ff-99a0-6370f278f54c\",\"fieldName\":\"gcp.labels.metrics.client_network\",\"title\":\"Client Network\",\"enhancements\":{}}},\"e43dc646-7457-4b36-b7c3-b5acb7725a5e\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e43dc646-7457-4b36-b7c3-b5acb7725a5e\",\"fieldName\":\"gcp.labels.metrics.client_subnetwork\",\"title\":\"Client Sub-network\",\"enhancements\":{}}}}" }, - "panelIndex": "8b86e712-4709-458a-b8e9-40e79305b1aa", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing L3 Filters [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "gcp.labels.resource.backend_name", - "id": "1588881306802", - "indexPatternRefName": "control_0_index_pattern", - "label": "Backend Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.client_zone", - "id": "1588881320708", - "indexPatternRefName": "control_1_index_pattern", - "label": "Client Zone", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.client_network", - "id": "1588881383318", - "indexPatternRefName": "control_2_index_pattern", - "label": "Client Network", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.client_subnetwork", - "id": "1588881498842", - "indexPatternRefName": "control_3_index_pattern", - "label": "Client Sub-network", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" + "description": "Overview of GCP Load Balancing L3 Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": {} } - } }, - "title": "Filters" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "44d18a84-d060-4149-825d-eacc61f946f3", - "w": 24, - "x": 24, - "y": 6 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "44d18a84-d060-4149-825d-eacc61f946f3", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing L3 Egress Packets [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.l3.internal.egress_packets.count : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.l3.internal.egress_packets.count", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "205dc823-a3a8-4703-b44a-065f57cadda7": { + "columnOrder": [ + "bd6c80c0-b05f-447b-af97-5558546f69dc", + "bc5a2ed6-a226-4b9c-9653-ac17abfb954f", + "9efe475f-1479-47ef-b4b6-8191b4ab7717" + ], + "columns": { + "9efe475f-1479-47ef-b4b6-8191b4ab7717": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.l3.internal.egress.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.l3.internal.egress.bytes" + }, + "bc5a2ed6-a226-4b9c-9653-ac17abfb954f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "bd6c80c0-b05f-447b-af97-5558546f69dc": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9efe475f-1479-47ef-b4b6-8191b4ab7717", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-205dc823-a3a8-4703-b44a-065f57cadda7", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "9efe475f-1479-47ef-b4b6-8191b4ab7717" + ], + "layerId": "205dc823-a3a8-4703-b44a-065f57cadda7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "bd6c80c0-b05f-447b-af97-5558546f69dc", + "xAccessor": "bc5a2ed6-a226-4b9c-9653-ac17abfb954f", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "9efe475f-1479-47ef-b4b6-8191b4ab7717" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c38aeaae-69a7-4a6c-a35a-4bf5c8f70e86", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "c38aeaae-69a7-4a6c-a35a-4bf5c8f70e86", + "title": "Egress Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Egress Packets" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "c38aeaae-69a7-4a6c-a35a-4bf5c8f70e86", - "w": 24, - "x": 0, - "y": 6 - }, - "panelIndex": "c38aeaae-69a7-4a6c-a35a-4bf5c8f70e86", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing L3 Egress Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.l3.internal.egress.bytes : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.l3.internal.egress.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "9ea6939b-acf8-4012-a7b2-cf0aa66d7d9b": { + "columnOrder": [ + "f2f02443-fc69-4615-aefd-52af51be76db", + "95e5d4bb-3927-4868-8ec2-fef69824aa24", + "3db8370a-da10-4da8-9021-8abf693a3bcd" + ], + "columns": { + "3db8370a-da10-4da8-9021-8abf693a3bcd": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.l3.internal.egress_packets.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.l3.internal.egress_packets.count" + }, + "95e5d4bb-3927-4868-8ec2-fef69824aa24": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f2f02443-fc69-4615-aefd-52af51be76db": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3db8370a-da10-4da8-9021-8abf693a3bcd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-9ea6939b-acf8-4012-a7b2-cf0aa66d7d9b", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3db8370a-da10-4da8-9021-8abf693a3bcd" + ], + "layerId": "9ea6939b-acf8-4012-a7b2-cf0aa66d7d9b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "f2f02443-fc69-4615-aefd-52af51be76db", + "xAccessor": "95e5d4bb-3927-4868-8ec2-fef69824aa24", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "3db8370a-da10-4da8-9021-8abf693a3bcd" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "44d18a84-d060-4149-825d-eacc61f946f3", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "44d18a84-d060-4149-825d-eacc61f946f3", + "title": "Egress Packets", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Egress Bytes" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "c5782327-dc55-466d-97d8-b79618f0b47a", - "w": 24, - "x": 24, - "y": 21 - }, - "panelIndex": "c5782327-dc55-466d-97d8-b79618f0b47a", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing L3 Ingress Packets [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.l3.internal.ingress_packets.count : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.l3.internal.ingress_packets.count", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "fe5b16c4-9ed6-4f46-a83f-e74df7076900": { + "columnOrder": [ + "996b126b-dc05-41ef-a883-f993f47f57a8", + "aa2732dc-1da0-4e7f-92a0-f5c1de9a847f", + "82c464f8-722e-4d6e-af93-e2f0df674cac" + ], + "columns": { + "82c464f8-722e-4d6e-af93-e2f0df674cac": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.l3.internal.ingress.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.l3.internal.ingress.bytes" + }, + "996b126b-dc05-41ef-a883-f993f47f57a8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "82c464f8-722e-4d6e-af93-e2f0df674cac", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + }, + "aa2732dc-1da0-4e7f-92a0-f5c1de9a847f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-fe5b16c4-9ed6-4f46-a83f-e74df7076900", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "82c464f8-722e-4d6e-af93-e2f0df674cac" + ], + "layerId": "fe5b16c4-9ed6-4f46-a83f-e74df7076900", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "996b126b-dc05-41ef-a883-f993f47f57a8", + "xAccessor": "aa2732dc-1da0-4e7f-92a0-f5c1de9a847f", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "82c464f8-722e-4d6e-af93-e2f0df674cac" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "beaf5f45-5217-4aed-b663-69e5e9ca35c3", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "beaf5f45-5217-4aed-b663-69e5e9ca35c3", + "title": "Ingress Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "ce05284e-1e46-4eaa-8619-6805f3fb3d62": { + "columnOrder": [ + "bb83411b-9f22-4265-85ea-3c147c7236d9", + "cdcccb10-fd37-4a36-be85-7dcfcd9cf346", + "faf901e9-16d2-4609-beb9-b75e38381e31" + ], + "columns": { + "bb83411b-9f22-4265-85ea-3c147c7236d9": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.backend_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "faf901e9-16d2-4609-beb9-b75e38381e31", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.backend_name" + }, + "cdcccb10-fd37-4a36-be85-7dcfcd9cf346": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "faf901e9-16d2-4609-beb9-b75e38381e31": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.l3.internal.ingress_packets.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.l3.internal.ingress_packets.count" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-ce05284e-1e46-4eaa-8619-6805f3fb3d62", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "faf901e9-16d2-4609-beb9-b75e38381e31" + ], + "layerId": "ce05284e-1e46-4eaa-8619-6805f3fb3d62", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "bb83411b-9f22-4265-85ea-3c147c7236d9", + "xAccessor": "cdcccb10-fd37-4a36-be85-7dcfcd9cf346", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "faf901e9-16d2-4609-beb9-b75e38381e31" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c5782327-dc55-466d-97d8-b79618f0b47a", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "c5782327-dc55-466d-97d8-b79618f0b47a", + "title": "Ingress Packets", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Metrics GCP] Load Balancing L3 Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-18T06:53:59.299Z", + "id": "gcp-8f9c6cc0-909d-11ea-8180-7b0dacd9df87", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "controlGroup_19b17b1a-02e7-425b-bdaf-789f36fb52b8:optionsListDataView", + "type": "index-pattern" }, - "title": "Ingress Packets" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "beaf5f45-5217-4aed-b663-69e5e9ca35c3", - "w": 24, - "x": 0, - "y": 21 + { + "id": "metrics-*", + "name": "controlGroup_682e20de-617f-479c-9f35-1282a76f0834:optionsListDataView", + "type": "index-pattern" }, - "panelIndex": "beaf5f45-5217-4aed-b663-69e5e9ca35c3", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing L3 Ingress Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.l3.internal.ingress.bytes : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.l3.internal.ingress.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.backend_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + { + "id": "metrics-*", + "name": "controlGroup_519ec7d3-cef1-40ff-99a0-6370f278f54c:optionsListDataView", + "type": "index-pattern" }, - "title": "Ingress Bytes" - } + { + "id": "metrics-*", + "name": "controlGroup_e43dc646-7457-4b36-b7c3-b5acb7725a5e:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Metrics GCP] Load Balancing L3 Overview", - "version": 1 - }, - "references": [ - { - "type": "index-pattern", - "name": "8b86e712-4709-458a-b8e9-40e79305b1aa:control_0_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "8b86e712-4709-458a-b8e9-40e79305b1aa:control_1_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "8b86e712-4709-458a-b8e9-40e79305b1aa:control_2_index_pattern", - "id": "metrics-*" - }, - { - "type": "index-pattern", - "name": "8b86e712-4709-458a-b8e9-40e79305b1aa:control_3_index_pattern", - "id": "metrics-*" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f.json b/packages/gcp/kibana/dashboard/gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f.json index 2b9d97a0c4e..4dd823d8ee0 100644 --- a/packages/gcp/kibana/dashboard/gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f.json +++ b/packages/gcp/kibana/dashboard/gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f.json @@ -1,1724 +1,1830 @@ { - "id": "gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcxOSwxXQ==", - "attributes": { - "description": "Overview of the VPC flow log data from Google Cloud.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 5, - "i": "a6977559-b547-4175-a1aa-f59715042492", - "w": 40, - "x": 0, - "y": 0 - }, - "panelIndex": "a6977559-b547-4175-a1aa-f59715042492", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Overview of the VPC flow log data from Google Cloud.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "# Google VPC Flow dashboard", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - } - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "fd65090b-d291-4771-865d-c5fa77a1b2a2", - "w": 8, - "x": 40, - "y": 5 + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "fd65090b-d291-4771-865d-c5fa77a1b2a2", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of gcp.vpcflow.reporter", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c601ab58-c4c4-45aa-b9ba-852226356372", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of gcp.vpcflow.reporter", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "gcp.vpcflow.reporter" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c601ab58-c4c4-45aa-b9ba-852226356372", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "gcp.vpcflow.reporter" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "fd65090b-d291-4771-865d-c5fa77a1b2a2", + "w": 8, + "x": 40, + "y": 0 + }, + "panelIndex": "fd65090b-d291-4771-865d-c5fa77a1b2a2", + "title": "Bytes per reporter", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes per reporter" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "4489b109-a7f8-4a9d-b85f-0fe613368eda", - "w": 8, - "x": 0, - "y": 5 - }, - "panelIndex": "4489b109-a7f8-4a9d-b85f-0fe613368eda", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of cloud.project.id", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "cloud.project.id" + { + "id": "logs-*", + "name": "0aee1bff-9d1f-4651-b126-437df4cb99ba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cloud.project.id", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.project.id" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0aee1bff-9d1f-4651-b126-437df4cb99ba", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "4489b109-a7f8-4a9d-b85f-0fe613368eda", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "4489b109-a7f8-4a9d-b85f-0fe613368eda", + "title": "Bytes per project", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes per project" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "061ff6b2-a70a-42dc-87fd-45d185b277ac", - "w": 8, - "x": 8, - "y": 5 - }, - "panelIndex": "061ff6b2-a70a-42dc-87fd-45d185b277ac", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of network.name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "network.name" + { + "id": "logs-*", + "name": "78c11486-badb-4c46-8f7f-9483b88fc07f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of network.name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.name" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "78c11486-badb-4c46-8f7f-9483b88fc07f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "061ff6b2-a70a-42dc-87fd-45d185b277ac", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "061ff6b2-a70a-42dc-87fd-45d185b277ac", + "title": "Bytes per sub-network", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes per sub-network" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5", - "w": 8, - "x": 16, - "y": 5 - }, - "panelIndex": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of cloud.region", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a00f7a8d-d0aa-4fa6-8a94-1ba7c7a6262a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of cloud.region", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.region" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a00f7a8d-d0aa-4fa6-8a94-1ba7c7a6262a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "cloud.region" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5", + "w": 8, + "x": 16, + "y": 0 + }, + "panelIndex": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5", + "title": "Bytes per region / zone", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes per region / zone" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "9714edf3-3894-4567-b8ec-99b863f4fa74", - "w": 8, - "x": 24, - "y": 5 - }, - "panelIndex": "9714edf3-3894-4567-b8ec-99b863f4fa74", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a0ef9781-cada-4dac-a5c6-50b6d36aaace", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of source.geo.continent_name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "source.geo.continent_name" - }, - "a0ef9781-cada-4dac-a5c6-50b6d36aaace": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of destination.geo.continent_name", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "id": "logs-*", + "name": "5e9dfc1a-83f4-4bbd-a979-fb0c917938b5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a0ef9781-cada-4dac-a5c6-50b6d36aaace", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of source.geo.continent_name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.geo.continent_name" + }, + "a0ef9781-cada-4dac-a5c6-50b6d36aaace": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of destination.geo.continent_name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.geo.continent_name" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5e9dfc1a-83f4-4bbd-a979-fb0c917938b5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "destination.geo.continent_name" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a0ef9781-cada-4dac-a5c6-50b6d36aaace" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "event.dataset : \"gcp.vpcflow\" " - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a0ef9781-cada-4dac-a5c6-50b6d36aaace" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "9714edf3-3894-4567-b8ec-99b863f4fa74", + "w": 8, + "x": 24, + "y": 0 + }, + "panelIndex": "9714edf3-3894-4567-b8ec-99b863f4fa74", + "title": "Bytes Source vs. Destination", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes Source vs. Destination" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 11, - "i": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e", - "w": 8, - "x": 32, - "y": 5 - }, - "panelIndex": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "9622b1fb-f543-4d05-b868-366fa865f9e7": { - "columnOrder": [ - "93e747d6-f202-45f4-9813-129bb91a9306", - "a5152707-6084-46e1-a5a1-b3eb150a1a05" - ], - "columns": { - "93e747d6-f202-45f4-9813-129bb91a9306": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of network.direction", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0708bf23-f9ba-4b7f-a706-40d436cd13af", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9622b1fb-f543-4d05-b868-366fa865f9e7": { + "columnOrder": [ + "93e747d6-f202-45f4-9813-129bb91a9306", + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "columns": { + "93e747d6-f202-45f4-9813-129bb91a9306": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of network.direction", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "a5152707-6084-46e1-a5a1-b3eb150a1a05", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + }, + "a5152707-6084-46e1-a5a1-b3eb150a1a05": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "network.direction" + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0708bf23-f9ba-4b7f-a706-40d436cd13af", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "a5152707-6084-46e1-a5a1-b3eb150a1a05" + ], + "nestedLegend": false, + "numberDisplay": "value", + "primaryGroups": [ + "93e747d6-f202-45f4-9813-129bb91a9306" + ] + } + ], + "shape": "donut" + } }, - "a5152707-6084-46e1-a5a1-b3eb150a1a05": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "93e747d6-f202-45f4-9813-129bb91a9306" - ], - "layerId": "9622b1fb-f543-4d05-b868-366fa865f9e7", - "layerType": "data", - "legendDisplay": "default", - "metric": "a5152707-6084-46e1-a5a1-b3eb150a1a05", - "nestedLegend": false, - "numberDisplay": "value" - } - ], - "shape": "donut" - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e", + "w": 8, + "x": 32, + "y": 0 + }, + "panelIndex": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e", + "title": "Bytes per direction", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Bytes per direction" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 7, - "i": "289e8233-5d54-49c7-9b3a-30bab73711bb", - "w": 24, - "x": 24, - "y": 46 - }, - "panelIndex": "289e8233-5d54-49c7-9b3a-30bab73711bb", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "102a3f02-3222-48bb-8c57-b29990ae1d97": { - "columnOrder": [ - "d25096dc-6121-497e-b444-42e92618a871", - "5cb970e1-fff0-4b8c-8c74-7dc834bd2942", - "0647e623-e5b9-4b20-afdf-eba0badc2297" - ], - "columns": { - "0647e623-e5b9-4b20-afdf-eba0badc2297": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } }, - "5cb970e1-fff0-4b8c-8c74-7dc834bd2942": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.geo.country_iso_code\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.geo.country_iso_code\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" }, - "d25096dc-6121-497e-b444-42e92618a871": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of source.domain", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "0647e623-e5b9-4b20-afdf-eba0badc2297", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "source.domain" - } - }, - "incompleteColumns": {} + "title": "[GCP] Sankey Source to Destination country", + "type": "vega", + "uiState": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "8700819e-d34e-4ac8-8b65-e053db64f7b8", + "w": 24, + "x": 0, + "y": 11 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "8700819e-d34e-4ac8-8b65-e053db64f7b8", + "title": "Sankey Source to Destination country", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.project_id\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.project_id\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination project", + "type": "vega", + "uiState": {} + } }, - "layers": [ - { - "accessors": [ - "0647e623-e5b9-4b20-afdf-eba0badc2297" - ], - "layerId": "102a3f02-3222-48bb-8c57-b29990ae1d97", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "d25096dc-6121-497e-b444-42e92618a871", - "xAccessor": "5cb970e1-fff0-4b8c-8c74-7dc834bd2942" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "6d32c209-a24d-4bf4-8651-83a187ed7946", + "w": 24, + "x": 24, + "y": 11 }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "6d32c209-a24d-4bf4-8651-83a187ed7946", + "title": "Sankey Source to Destination project", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.subnetwork_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.subnetwork_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination subnetwork", + "type": "vega", + "uiState": {} + } }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 15, + "i": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a", + "w": 24, + "x": 0, + "y": 26 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a", + "title": "Sankey Source to Destination subnetwork", + "type": "visualization", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Sum of bytes per source" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 8, - "i": "9d413864-ae26-4e79-a93d-df49fbad4913", - "w": 24, - "x": 24, - "y": 53 - }, - "panelIndex": "9d413864-ae26-4e79-a93d-df49fbad4913", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "102a3f02-3222-48bb-8c57-b29990ae1d97": { - "columnOrder": [ - "d25096dc-6121-497e-b444-42e92618a871", - "5cb970e1-fff0-4b8c-8c74-7dc834bd2942", - "0647e623-e5b9-4b20-afdf-eba0badc2297" - ], - "columns": { - "0647e623-e5b9-4b20-afdf-eba0badc2297": { - "dataType": "number", - "isBucketed": false, - "label": "Sum of network.bytes", - "operationType": "sum", - "scale": "ratio", - "sourceField": "network.bytes" + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } }, - "5cb970e1-fff0-4b8c-8c74-7dc834bd2942": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.vpc_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.vpc_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" }, - "d25096dc-6121-497e-b444-42e92618a871": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of destination.domain", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "0647e623-e5b9-4b20-afdf-eba0badc2297", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "destination.domain" - } - }, - "incompleteColumns": {} + "title": "[GCP] Sankey Source to Destination VPC", + "type": "vega", + "uiState": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6", + "w": 24, + "x": 24, + "y": 26 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6", + "title": "Sankey Source to Destination VPC", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.domain\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.domain\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination domain", + "type": "vega", + "uiState": {} + } }, - "layers": [ - { - "accessors": [ - "0647e623-e5b9-4b20-afdf-eba0badc2297" - ], - "layerId": "102a3f02-3222-48bb-8c57-b29990ae1d97", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "d25096dc-6121-497e-b444-42e92618a871", - "xAccessor": "5cb970e1-fff0-4b8c-8c74-7dc834bd2942" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7", + "w": 24, + "x": 0, + "y": 41 }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7", + "title": "Sankey Source to Destination domain", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "775d2dae-4f98-4d6f-8928-58b9f84d2c98", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "102a3f02-3222-48bb-8c57-b29990ae1d97": { + "columnOrder": [ + "d25096dc-6121-497e-b444-42e92618a871", + "5cb970e1-fff0-4b8c-8c74-7dc834bd2942", + "0647e623-e5b9-4b20-afdf-eba0badc2297" + ], + "columns": { + "0647e623-e5b9-4b20-afdf-eba0badc2297": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of network.bytes", + "operationType": "sum", + "scale": "ratio", + "sourceField": "network.bytes" + }, + "5cb970e1-fff0-4b8c-8c74-7dc834bd2942": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d25096dc-6121-497e-b444-42e92618a871": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of source.domain", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "0647e623-e5b9-4b20-afdf-eba0badc2297", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.domain" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "775d2dae-4f98-4d6f-8928-58b9f84d2c98", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0647e623-e5b9-4b20-afdf-eba0badc2297" + ], + "layerId": "102a3f02-3222-48bb-8c57-b29990ae1d97", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "d25096dc-6121-497e-b444-42e92618a871", + "xAccessor": "5cb970e1-fff0-4b8c-8c74-7dc834bd2942" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 7, + "i": "289e8233-5d54-49c7-9b3a-30bab73711bb", + "w": 24, + "x": 24, + "y": 41 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "289e8233-5d54-49c7-9b3a-30bab73711bb", + "title": "Sum of bytes per source", + "type": "lens", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "title": "Sum of bytes per destination" - }, - { - "version": "7.17.0", - "type": "lens", - "gridData": { - "h": 15, - "i": "fcaf1c3c-64a6-47ce-90a2-8226e788c062", - "w": 24, - "x": 24, - "y": 61 - }, - "panelIndex": "fcaf1c3c-64a6-47ce-90a2-8226e788c062", - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97": { - "columnOrder": [ - "06178db9-8ae7-4706-b479-29aea6be4d75", - "313bb272-53cc-4d90-890e-d0952e9fd07f", - "bbc2b648-d5e5-4ee1-baed-be4d1497e963" - ], - "columns": { - "06178db9-8ae7-4706-b479-29aea6be4d75": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Source AS Org", - "operationType": "terms", - "params": { - "missingBucket": true, - "orderBy": { - "columnId": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "source.as.organization.name" - }, - "313bb272-53cc-4d90-890e-d0952e9fd07f": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Destination AS Org", - "operationType": "terms", - "params": { - "missingBucket": true, - "orderBy": { - "columnId": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", - "type": "column" + { + "id": "logs-*", + "name": "1a4ef3f1-b9e4-474b-bf32-2c86d1258905", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "102a3f02-3222-48bb-8c57-b29990ae1d97": { + "columnOrder": [ + "d25096dc-6121-497e-b444-42e92618a871", + "5cb970e1-fff0-4b8c-8c74-7dc834bd2942", + "0647e623-e5b9-4b20-afdf-eba0badc2297" + ], + "columns": { + "0647e623-e5b9-4b20-afdf-eba0badc2297": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "5cb970e1-fff0-4b8c-8c74-7dc834bd2942": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d25096dc-6121-497e-b444-42e92618a871": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of destination.domain", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "0647e623-e5b9-4b20-afdf-eba0badc2297", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.domain" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1a4ef3f1-b9e4-474b-bf32-2c86d1258905", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "destination.as.organization.name" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0647e623-e5b9-4b20-afdf-eba0badc2297" + ], + "layerId": "102a3f02-3222-48bb-8c57-b29990ae1d97", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "d25096dc-6121-497e-b444-42e92618a871", + "xAccessor": "5cb970e1-fff0-4b8c-8c74-7dc834bd2942" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } }, - "bbc2b648-d5e5-4ee1-baed-be4d1497e963": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Total bytes", - "operationType": "sum", - "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "9d413864-ae26-4e79-a93d-df49fbad4913", + "w": 24, + "x": 24, + "y": 48 + }, + "panelIndex": "9d413864-ae26-4e79-a93d-df49fbad4913", + "title": "Sum of bytes per destination", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } } - }, - "scale": "ratio", - "sourceField": "network.bytes" - } - }, - "incompleteColumns": {} + }, + "description": "", + "params": { + "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.as.organization.name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.as.organization.name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -\u003e stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' \u0026#x2192; ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" + }, + "title": "[GCP] Sankey Source to Destination subnetwork", + "type": "vega", + "uiState": {} } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "gridConfig": { - "isCellLabelVisible": false, - "isXAxisLabelVisible": true, - "isYAxisLabelVisible": true, - "type": "lens_heatmap_grid" }, - "layerId": "8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", - "layerType": "data", - "legend": { - "isVisible": false, - "maxLines": 2, - "position": "right", - "shouldTruncate": false, - "type": "lens_heatmap_legendConfig" + "gridData": { + "h": 15, + "i": "eedf536b-4b23-4689-957b-482f4d7a3332", + "w": 24, + "x": 0, + "y": 56 }, - "palette": { - "accessor": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", - "name": "negative", - "params": { - "name": "negative", - "rangeMax": 80, - "rangeMin": 0, - "reverse": false, - "stops": [ - { - "color": "#fbddd6", - "stop": 0 - }, - { - "color": "#f3bbaf", - "stop": 20 - }, - { - "color": "#e99a89", - "stop": 40 - }, - { - "color": "#db7965", - "stop": 60 - }, - { - "color": "#cc5642", - "stop": 80 - } - ] - }, - "type": "palette" - }, - "shape": "heatmap", - "valueAccessor": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", - "xAccessor": "313bb272-53cc-4d90-890e-d0952e9fd07f", - "yAccessor": "06178db9-8ae7-4706-b479-29aea6be4d75" - } + "panelIndex": "eedf536b-4b23-4689-957b-482f4d7a3332", + "title": "Sankey Source to Destination autonomous system (AS) org name", + "type": "visualization", + "version": "8.7.1" }, - "title": "", - "type": "lens", - "visualizationType": "lnsHeatmap" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "abef953e-0b21-4e7f-b488-92850705970c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97": { + "columnOrder": [ + "06178db9-8ae7-4706-b479-29aea6be4d75", + "313bb272-53cc-4d90-890e-d0952e9fd07f", + "bbc2b648-d5e5-4ee1-baed-be4d1497e963" + ], + "columns": { + "06178db9-8ae7-4706-b479-29aea6be4d75": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source AS Org", + "operationType": "terms", + "params": { + "missingBucket": true, + "orderBy": { + "columnId": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.as.organization.name" + }, + "313bb272-53cc-4d90-890e-d0952e9fd07f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination AS Org", + "operationType": "terms", + "params": { + "missingBucket": true, + "orderBy": { + "columnId": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + }, + "bbc2b648-d5e5-4ee1-baed-be4d1497e963": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total bytes", + "operationType": "sum", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "abef953e-0b21-4e7f-b488-92850705970c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.vpcflow" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.vpcflow" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "lens_heatmap_grid" + }, + "layerId": "8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", + "layerType": "data", + "legend": { + "isVisible": false, + "legendSize": "auto", + "maxLines": 2, + "position": "right", + "shouldTruncate": false, + "type": "lens_heatmap_legendConfig" + }, + "palette": { + "accessor": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", + "name": "negative", + "params": { + "name": "negative", + "rangeMax": 80, + "rangeMin": 0, + "reverse": false, + "stops": [ + { + "color": "#fbddd6", + "stop": 0 + }, + { + "color": "#f3bbaf", + "stop": 20 + }, + { + "color": "#e99a89", + "stop": 40 + }, + { + "color": "#db7965", + "stop": 60 + }, + { + "color": "#cc5642", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "bbc2b648-d5e5-4ee1-baed-be4d1497e963", + "xAccessor": "313bb272-53cc-4d90-890e-d0952e9fd07f", + "yAccessor": "06178db9-8ae7-4706-b479-29aea6be4d75" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "fcaf1c3c-64a6-47ce-90a2-8226e788c062", + "w": 24, + "x": 24, + "y": 56 + }, + "panelIndex": "fcaf1c3c-64a6-47ce-90a2-8226e788c062", + "title": "Sum of bytes between source and destination", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Logs GCP] VPC Flow", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T15:43:54.052Z", + "id": "gcp-9484a4cd-685f-450e-aeaa-728fbdbea20f", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "fd65090b-d291-4771-865d-c5fa77a1b2a2:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sum of bytes between source and destination" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "eedf536b-4b23-4689-957b-482f4d7a3332", - "w": 24, - "x": 0, - "y": 61 + { + "id": "logs-*", + "name": "fd65090b-d291-4771-865d-c5fa77a1b2a2:c601ab58-c4c4-45aa-b9ba-852226356372", + "type": "index-pattern" }, - "panelIndex": "eedf536b-4b23-4689-957b-482f4d7a3332", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.as.organization.name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.as.organization.name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination subnetwork", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "4489b109-a7f8-4a9d-b85f-0fe613368eda:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sankey Source to Destination autonomous system (AS) org name" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7", - "w": 24, - "x": 0, - "y": 46 + { + "id": "logs-*", + "name": "4489b109-a7f8-4a9d-b85f-0fe613368eda:0aee1bff-9d1f-4651-b126-437df4cb99ba", + "type": "index-pattern" }, - "panelIndex": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.domain\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.domain\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination domain", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "061ff6b2-a70a-42dc-87fd-45d185b277ac:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sankey Source to Destination domain" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a", - "w": 24, - "x": 0, - "y": 31 + { + "id": "logs-*", + "name": "061ff6b2-a70a-42dc-87fd-45d185b277ac:78c11486-badb-4c46-8f7f-9483b88fc07f", + "type": "index-pattern" }, - "panelIndex": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": true, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.subnetwork_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.subnetwork_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination subnetwork", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sankey Source to Destination subnetwork" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6", - "w": 24, - "x": 24, - "y": 31 + { + "id": "logs-*", + "name": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5:a00f7a8d-d0aa-4fa6-8a94-1ba7c7a6262a", + "type": "index-pattern" }, - "panelIndex": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.vpc_name\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.vpc_name\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination VPC", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "9714edf3-3894-4567-b8ec-99b863f4fa74:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sankey Source to Destination VPC" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "8700819e-d34e-4ac8-8b65-e053db64f7b8", - "w": 24, - "x": 0, - "y": 16 + { + "id": "logs-*", + "name": "9714edf3-3894-4567-b8ec-99b863f4fa74:5e9dfc1a-83f4-4bbd-a979-fb0c917938b5", + "type": "index-pattern" }, - "panelIndex": "8700819e-d34e-4ac8-8b65-e053db64f7b8", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"source.geo.country_iso_code\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"destination.geo.country_iso_code\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination country", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", + "type": "index-pattern" }, - "title": "Sankey Source to Destination country" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "6d32c209-a24d-4bf4-8651-83a187ed7946", - "w": 24, - "x": 24, - "y": 16 + { + "id": "logs-*", + "name": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e:0708bf23-f9ba-4b7f-a706-40d436cd13af", + "type": "index-pattern" }, - "panelIndex": "6d32c209-a24d-4bf4-8651-83a187ed7946", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": true, - "index": "logs-*", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "gcp.vpcflow" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "gcp.vpcflow" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "spec": "{\r\n $schema: https://vega.github.io/schema/vega/v3.0.json\r\n data: [\r\n {\r\n // query ES based on the currently selected time range and filter string\r\n name: rawData\r\n url: {\r\n %context%: true\r\n %timefield%: @timestamp\r\n index: logs*\r\n body: {\r\n size: 0\r\n aggs: {\r\n table: {\r\n composite: {\r\n size: 10000\r\n sources: [\r\n {\r\n stk1: {\r\n terms: {field: \"gcp.source.vpc.project_id\"}\r\n }\r\n }\r\n {\r\n stk2: {\r\n terms: {field: \"gcp.destination.vpc.project_id\"}\r\n }\r\n }\r\n ]\r\n }\r\n }\r\n }\r\n }\r\n }\r\n // From the result, take just the data we are interested in\r\n format: {property: \"aggregations.table.buckets\"}\r\n // Convert key.stk1 -> stk1 for simpler access below\r\n transform: [\r\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\r\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\r\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\r\n ]\r\n }\r\n {\r\n name: nodes\r\n source: rawData\r\n transform: [\r\n // when a country is selected, filter out unrelated data\r\n {\r\n type: filter\r\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\r\n }\r\n // Set new key for later lookups - identifies each node\r\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\r\n // instead of each table row, create two new rows,\r\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\r\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\r\n {\r\n type: fold\r\n fields: [\"stk1\", \"stk2\"]\r\n as: [\"stack\", \"grpId\"]\r\n }\r\n // Create a sortkey, different for stk1 and stk2 stacks.\r\n // Space separator ensures proper sort order in some corner cases.\r\n {\r\n type: formula\r\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\r\n as: sortField\r\n }\r\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\r\n // independently for each stack, and ensuring they are in the proper order,\r\n // alphabetical from the top (reversed on the y axis)\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"sortField\", order: \"descending\"}\r\n field: size\r\n }\r\n // calculate vertical center point for each node, used to draw edges\r\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\r\n ]\r\n }\r\n {\r\n name: groups\r\n source: nodes\r\n transform: [\r\n // combine all nodes into country groups, summing up the doc counts\r\n {\r\n type: aggregate\r\n groupby: [\"stack\", \"grpId\"]\r\n fields: [\"size\"]\r\n ops: [\"sum\"]\r\n as: [\"total\"]\r\n }\r\n // re-calculate the stacking y0,y1 values\r\n {\r\n type: stack\r\n groupby: [\"stack\"]\r\n sort: {field: \"grpId\", order: \"descending\"}\r\n field: total\r\n }\r\n // project y0 and y1 values to screen coordinates\r\n // doing it once here instead of doing it several times in marks\r\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\r\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\r\n // boolean flag if the label should be on the right of the stack\r\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\r\n // Calculate traffic percentage for this country using \"y\" scale\r\n // domain upper bound, which represents the total traffic\r\n {\r\n type: formula\r\n expr: datum.total/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n {\r\n // This is a temp lookup table with all the 'stk2' stack nodes\r\n name: destinationNodes\r\n source: nodes\r\n transform: [\r\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\r\n ]\r\n }\r\n {\r\n name: edges\r\n source: nodes\r\n transform: [\r\n // we only want nodes from the left stack\r\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\r\n // find corresponding node from the right stack, keep it as \"target\"\r\n {\r\n type: lookup\r\n from: destinationNodes\r\n key: key\r\n fields: [\"key\"]\r\n as: [\"target\"]\r\n }\r\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\r\n {\r\n type: linkpath\r\n orient: horizontal\r\n shape: diagonal\r\n sourceY: {expr: \"scale('y', datum.yc)\"}\r\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\r\n targetY: {expr: \"scale('y', datum.target.yc)\"}\r\n targetX: {expr: \"scale('x', 'stk2')\"}\r\n }\r\n // A little trick to calculate the thickness of the line.\r\n // The value needs to be the same as the hight of the node, but scaling\r\n // size to screen's height gives inversed value because screen's Y\r\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\r\n // is at the bottom. So subtracting scaled doc count from screen height\r\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\r\n {\r\n type: formula\r\n expr: range('y')[0]-scale('y', datum.size)\r\n as: strokeWidth\r\n }\r\n // Tooltip needs individual link's percentage of all traffic\r\n {\r\n type: formula\r\n expr: datum.size/domain('y')[1]\r\n as: percentage\r\n }\r\n ]\r\n }\r\n ]\r\n scales: [\r\n {\r\n // calculates horizontal stack positioning\r\n name: x\r\n type: band\r\n range: width\r\n domain: [\"stk1\", \"stk2\"]\r\n paddingOuter: 0.05\r\n paddingInner: 0.95\r\n }\r\n {\r\n // this scale goes up as high as the highest y1 value of all nodes\r\n name: y\r\n type: linear\r\n range: height\r\n domain: {data: \"nodes\", field: \"y1\"}\r\n }\r\n {\r\n // use rawData to ensure the colors stay the same when clicking.\r\n name: color\r\n type: ordinal\r\n range: category\r\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\r\n }\r\n {\r\n // this scale is used to map internal ids (stk1, stk2) to stack names\r\n name: stackNames\r\n type: ordinal\r\n range: [\"Source\", \"Destination\"]\r\n domain: [\"stk1\", \"stk2\"]\r\n }\r\n ]\r\n axes: [\r\n {\r\n // x axis should use custom label formatting to print proper stack names\r\n orient: bottom\r\n scale: x\r\n encode: {\r\n labels: {\r\n update: {\r\n text: {scale: \"stackNames\", field: \"value\"}\r\n }\r\n }\r\n }\r\n }\r\n {orient: \"left\", scale: \"y\"}\r\n ]\r\n marks: [\r\n {\r\n // draw the connecting line between stacks\r\n type: path\r\n name: edgeMark\r\n from: {data: \"edges\"}\r\n // this prevents some autosizing issues with large strokeWidth for paths\r\n clip: true\r\n encode: {\r\n update: {\r\n // By default use color of the left node, except when showing traffic\r\n // from just one country, in which case use destination color.\r\n stroke: [\r\n {\r\n test: groupSelector && groupSelector.stack=='stk1'\r\n scale: color\r\n field: stk2\r\n }\r\n {scale: \"color\", field: \"stk1\"}\r\n ]\r\n strokeWidth: {field: \"strokeWidth\"}\r\n path: {field: \"path\"}\r\n // when showing all traffic, and hovering over a country,\r\n // highlight the traffic from that country.\r\n strokeOpacity: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\r\n }\r\n // Ensure that the hover-selected edges show on top\r\n zindex: {\r\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\r\n }\r\n // format tooltip string\r\n tooltip: {\r\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n // Simple mouseover highlighting of a single line\r\n hover: {\r\n strokeOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw stack groups (countries)\r\n type: rect\r\n name: groupMark\r\n from: {data: \"groups\"}\r\n encode: {\r\n enter: {\r\n fill: {scale: \"color\", field: \"grpId\"}\r\n width: {scale: \"x\", band: 1}\r\n }\r\n update: {\r\n x: {scale: \"x\", field: \"stack\"}\r\n y: {field: \"scaledY0\"}\r\n y2: {field: \"scaledY1\"}\r\n fillOpacity: {value: 0.6}\r\n tooltip: {\r\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\r\n }\r\n }\r\n hover: {\r\n fillOpacity: {value: 1}\r\n }\r\n }\r\n }\r\n {\r\n // draw country code labels on the inner side of the stack\r\n type: text\r\n from: {data: \"groups\"}\r\n // don't process events for the labels - otherwise line mouseover is unclean\r\n interactive: false\r\n encode: {\r\n update: {\r\n // depending on which stack it is, position x with some padding\r\n x: {\r\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\r\n }\r\n // middle of the group\r\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\r\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n // only show text label if the group's height is large enough\r\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\r\n }\r\n }\r\n }\r\n {\r\n // Create a \"show all\" button. Shown only when a country is selected.\r\n type: group\r\n data: [\r\n // We need to make the button show only when groupSelector signal is true.\r\n // Each mark is drawn as many times as there are elements in the backing data.\r\n // Which means that if values list is empty, it will not be drawn.\r\n // Here I create a data source with one empty object, and filter that list\r\n // based on the signal value. This can only be done in a group.\r\n {\r\n name: dataForShowAll\r\n values: [{}]\r\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\r\n }\r\n ]\r\n // Set button size and positioning\r\n encode: {\r\n enter: {\r\n xc: {signal: \"width/2\"}\r\n y: {value: 30}\r\n width: {value: 80}\r\n height: {value: 30}\r\n }\r\n }\r\n marks: [\r\n {\r\n // This group is shown as a button with rounded corners.\r\n type: group\r\n // mark name allows signal capturing\r\n name: groupReset\r\n // Only shows button if dataForShowAll has values.\r\n from: {data: \"dataForShowAll\"}\r\n encode: {\r\n enter: {\r\n cornerRadius: {value: 6}\r\n fill: {value: \"#f5f5f5\"}\r\n stroke: {value: \"#c1c1c1\"}\r\n strokeWidth: {value: 2}\r\n // use parent group's size\r\n height: {\r\n field: {group: \"height\"}\r\n }\r\n width: {\r\n field: {group: \"width\"}\r\n }\r\n }\r\n update: {\r\n // groups are transparent by default\r\n opacity: {value: 1}\r\n }\r\n hover: {\r\n opacity: {value: 0.7}\r\n }\r\n }\r\n marks: [\r\n {\r\n type: text\r\n // if true, it will prevent clicking on the button when over text.\r\n interactive: false\r\n encode: {\r\n enter: {\r\n // center text in the paren group\r\n xc: {\r\n field: {group: \"width\"}\r\n mult: 0.5\r\n }\r\n yc: {\r\n field: {group: \"height\"}\r\n mult: 0.5\r\n offset: 2\r\n }\r\n align: {value: \"center\"}\r\n baseline: {value: \"middle\"}\r\n fontWeight: {value: \"bold\"}\r\n text: {value: \"Show All\"}\r\n }\r\n }\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n ]\r\n signals: [\r\n {\r\n // used to highlight traffic to/from the same country\r\n name: groupHover\r\n value: {}\r\n on: [\r\n {\r\n events: @groupMark:mouseover\r\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {events: \"mouseout\", update: \"{}\"}\r\n ]\r\n }\r\n // used to filter only the data related to the selected country\r\n {\r\n name: groupSelector\r\n value: false\r\n on: [\r\n {\r\n // Clicking groupMark sets this signal to the filter values\r\n events: @groupMark:click!\r\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\r\n }\r\n {\r\n // Clicking \"show all\" button, or double-clicking anywhere resets it\r\n events: [\r\n {type: \"click\", markname: \"groupReset\"}\r\n {type: \"dblclick\"}\r\n ]\r\n update: \"false\"\r\n }\r\n ]\r\n }\r\n ]\r\n}" - }, - "title": "[GCP] Sankey Source to Destination project", - "type": "vega", - "uiState": {} - } + { + "id": "logs-*", + "name": "8700819e-d34e-4ac8-8b65-e053db64f7b8:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "title": "Sankey Source to Destination project" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 5, - "i": "f3e1d305-2615-45a8-a2a9-ced28af362d1", - "w": 8, - "x": 40, - "y": 0 + { + "id": "logs-*", + "name": "6d32c209-a24d-4bf4-8651-83a187ed7946:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "panelIndex": "f3e1d305-2615-45a8-a2a9-ced28af362d1", - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "", - "interval": "", - "isModelInvalid": false, - "markdown": "[Detection Engine](security/detections)\r\n\r\n[Network overview](security/network/flows)", - "markdown_css": "#markdown-61ca57f0-469d-11e7-af02-69e470af7417 a{background-color:#07C;color:#fff;padding:8px 12px;height:40px;display:inline-block;font-family:Inter UI,-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol;font-weight:400;letter-spacing:-0.005em;font-size:1rem;line-height:1.5;text-decoration:none;border-radius:4px;vertical-align:middle;width:100%;text-align:center}", - "markdown_less": "a {\n background-color: #07C;\n color: #fff;\n padding: 8px 12px;\n height: 40px;\n display: inline-block;\n font-family: Inter UI,-apple-system,BlinkMacSystemFont,Segoe UI,Helvetica,Arial,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol;\n font-weight: 400;\n letter-spacing: -.005em;\n font-size: 1rem;\n line-height: 1.5;\n text-decoration: none;\n border-radius: 4px;\n vertical-align: middle;\n width: 100%;\n text-align: center;\n}", - "markdown_openLinksInNewTab": 1, - "markdown_vertical_align": "middle", - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" - } - ], - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "markdown", - "use_kibana_indexes": true - }, - "title": "Nav Buttons", - "type": "metrics", - "uiState": {} - } + { + "id": "logs-*", + "name": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "289e8233-5d54-49c7-9b3a-30bab73711bb:indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "289e8233-5d54-49c7-9b3a-30bab73711bb:775d2dae-4f98-4d6f-8928-58b9f84d2c98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9d413864-ae26-4e79-a93d-df49fbad4913:indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9d413864-ae26-4e79-a93d-df49fbad4913:1a4ef3f1-b9e4-474b-bf32-2c86d1258905", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eedf536b-4b23-4689-957b-482f4d7a3332:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fcaf1c3c-64a6-47ce-90a2-8226e788c062:indexpattern-datasource-layer-8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fcaf1c3c-64a6-47ce-90a2-8226e788c062:abef953e-0b21-4e7f-b488-92850705970c", + "type": "index-pattern" } - } ], - "timeRestore": false, - "title": "[Logs GCP] VPC Flow", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fd65090b-d291-4771-865d-c5fa77a1b2a2:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fd65090b-d291-4771-865d-c5fa77a1b2a2:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4489b109-a7f8-4a9d-b85f-0fe613368eda:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4489b109-a7f8-4a9d-b85f-0fe613368eda:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "061ff6b2-a70a-42dc-87fd-45d185b277ac:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "061ff6b2-a70a-42dc-87fd-45d185b277ac:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "42eee1cd-e816-4f6e-a700-401e8ff1a2f5:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9714edf3-3894-4567-b8ec-99b863f4fa74:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9714edf3-3894-4567-b8ec-99b863f4fa74:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "efe8857e-d137-4c24-ad83-dd7ddbea8c9e:indexpattern-datasource-layer-9622b1fb-f543-4d05-b868-366fa865f9e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "289e8233-5d54-49c7-9b3a-30bab73711bb:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "289e8233-5d54-49c7-9b3a-30bab73711bb:indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9d413864-ae26-4e79-a93d-df49fbad4913:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9d413864-ae26-4e79-a93d-df49fbad4913:indexpattern-datasource-layer-102a3f02-3222-48bb-8c57-b29990ae1d97", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fcaf1c3c-64a6-47ce-90a2-8226e788c062:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "fcaf1c3c-64a6-47ce-90a2-8226e788c062:indexpattern-datasource-layer-8929ffe2-4cf7-40b7-8e2c-1ee52bdd8d97", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "eedf536b-4b23-4689-957b-482f4d7a3332:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "69f30a2e-79ff-4615-a83f-0aaf9b466ba7:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0f9ac1ed-f75b-4788-a9fe-9277d5e0551a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4a23ce96-6f3b-4ae0-bec2-dc1594cedef6:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8700819e-d34e-4ac8-8b65-e053db64f7b8:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "6d32c209-a24d-4bf4-8651-83a187ed7946:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "name": "tag-gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "type": "tag" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87.json b/packages/gcp/kibana/dashboard/gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87.json index e50bfe0221d..22b6b581f70 100644 --- a/packages/gcp/kibana/dashboard/gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87.json +++ b/packages/gcp/kibana/dashboard/gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87.json @@ -1,570 +1,1200 @@ { - "id": "gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-14T09:47:20.533Z", - "version": "WzcyMCwxXQ==", - "attributes": { - "description": "Overview of GCP Load Balancing HTTPS Metrics", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 6, - "i": "f89112f9-0f3a-4712-a317-23230cd66213", - "w": 48, - "x": 0, - "y": 0 + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"c535cbec-5efe-4b1c-ad48-fae93ef20ee4\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c535cbec-5efe-4b1c-ad48-fae93ef20ee4\",\"fieldName\":\"gcp.labels.resource.url_map_name\",\"title\":\"URL Map Name\",\"enhancements\":{}}},\"595eea0d-c2b9-497d-af62-2da94e5df5bf\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"595eea0d-c2b9-497d-af62-2da94e5df5bf\",\"fieldName\":\"gcp.labels.resource.region\",\"title\":\"Region\",\"enhancements\":{}}},\"9b9e3b6f-6224-41ab-b57e-7595f56a956a\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"9b9e3b6f-6224-41ab-b57e-7595f56a956a\",\"fieldName\":\"gcp.labels.metrics.client_country\",\"title\":\"Client Country\",\"enhancements\":{}}}}" }, - "panelIndex": "f89112f9-0f3a-4712-a317-23230cd66213", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Filters [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "gcp.labels.resource.url_map_name", - "id": "1588961027791", - "indexPatternRefName": "control_0_index_pattern", - "label": "URL Map Name", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.resource.region", - "id": "1588961077426", - "indexPatternRefName": "control_1_index_pattern", - "label": "Region", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "gcp.labels.metrics.client_country", - "id": "1588961157559", - "indexPatternRefName": "control_2_index_pattern", - "label": "Client Country", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Filters" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "8f4baaa9-6f4d-40fa-a77f-9f68f83a379c", - "w": 24, - "x": 24, - "y": 6 - }, - "panelIndex": "8f4baaa9-6f4d-40fa-a77f-9f68f83a379c", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Backend Request Count [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { + "description": "Overview of GCP Load Balancing HTTPS Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { "language": "kuery", - "query": "gcp.loadbalancing.https.backend_request.count : * " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.backend_request.count", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" + "query": "" } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 - }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} } - } }, - "title": "Backend Request Count" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "10490530-a766-4f87-824a-3fc18bf2e85b", - "w": 24, - "x": 0, - "y": 6 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "10490530-a766-4f87-824a-3fc18bf2e85b", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Request Count [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.request.count : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.request.count : * " - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.request.count", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "7c5c0d54-899a-4c8b-b145-642af9f3ecf8": { + "columnOrder": [ + "684ce09f-0d0f-47f9-8d88-9ab1c42f18c3", + "93dc7086-3a62-4a8e-9517-257ef6e9a0c1", + "3ce813df-0038-423e-b402-dfe9162bb6c2" + ], + "columns": { + "3ce813df-0038-423e-b402-dfe9162bb6c2": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.loadbalancing_metrics.https.request.count : * " + }, + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.request.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.request.count" + }, + "684ce09f-0d0f-47f9-8d88-9ab1c42f18c3": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "93dc7086-3a62-4a8e-9517-257ef6e9a0c1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3ce813df-0038-423e-b402-dfe9162bb6c2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-7c5c0d54-899a-4c8b-b145-642af9f3ecf8", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3ce813df-0038-423e-b402-dfe9162bb6c2" + ], + "layerId": "7c5c0d54-899a-4c8b-b145-642af9f3ecf8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "93dc7086-3a62-4a8e-9517-257ef6e9a0c1", + "xAccessor": "684ce09f-0d0f-47f9-8d88-9ab1c42f18c3", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "3ce813df-0038-423e-b402-dfe9162bb6c2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "10490530-a766-4f87-824a-3fc18bf2e85b", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "10490530-a766-4f87-824a-3fc18bf2e85b", + "title": "Request Count", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Request Count" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "e737b020-eb94-4eb1-b53d-50fa551df648", - "w": 24, - "x": 24, - "y": 21 - }, - "panelIndex": "e737b020-eb94-4eb1-b53d-50fa551df648", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Backend Request Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.backend_request.bytes : * " - }, - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.backend_request.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e1f0f6de-caec-475b-b782-a24edec42fa7": { + "columnOrder": [ + "a109a6bf-8099-419e-8c5e-59963a88df34", + "a6b2c5b2-ea72-462d-967a-d78681248552", + "89074a07-b61b-4698-a834-b254107da225" + ], + "columns": { + "89074a07-b61b-4698-a834-b254107da225": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.loadbalancing_metrics.https.backend_request.count : * " + }, + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.backend_request.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.backend_request.count" + }, + "a109a6bf-8099-419e-8c5e-59963a88df34": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a6b2c5b2-ea72-462d-967a-d78681248552": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "89074a07-b61b-4698-a834-b254107da225", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e1f0f6de-caec-475b-b782-a24edec42fa7", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "89074a07-b61b-4698-a834-b254107da225" + ], + "layerId": "e1f0f6de-caec-475b-b782-a24edec42fa7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "a6b2c5b2-ea72-462d-967a-d78681248552", + "xAccessor": "a109a6bf-8099-419e-8c5e-59963a88df34", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "89074a07-b61b-4698-a834-b254107da225" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "8f4baaa9-6f4d-40fa-a77f-9f68f83a379c", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "8f4baaa9-6f4d-40fa-a77f-9f68f83a379c", + "title": "Backend Request Count", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Backend Request Bytes" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "b90db52e-982e-4360-b5ed-71147ba79246", - "w": 24, - "x": 0, - "y": 21 - }, - "panelIndex": "b90db52e-982e-4360-b5ed-71147ba79246", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Request Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.request.bytes : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.request.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "966ca6da-5b05-410e-a150-3109af300fa5": { + "columnOrder": [ + "f0b43dce-7252-4c2b-bd23-40845b5e90b7", + "8c27a1d4-8232-42c1-9aca-fbf067ed7006", + "3cbe7ff2-6bad-4a6f-a25d-42dcc0efe4e0" + ], + "columns": { + "3cbe7ff2-6bad-4a6f-a25d-42dcc0efe4e0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.request.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.request.bytes" + }, + "8c27a1d4-8232-42c1-9aca-fbf067ed7006": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3cbe7ff2-6bad-4a6f-a25d-42dcc0efe4e0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + }, + "f0b43dce-7252-4c2b-bd23-40845b5e90b7": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-966ca6da-5b05-410e-a150-3109af300fa5", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "3cbe7ff2-6bad-4a6f-a25d-42dcc0efe4e0" + ], + "layerId": "966ca6da-5b05-410e-a150-3109af300fa5", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "8c27a1d4-8232-42c1-9aca-fbf067ed7006", + "xAccessor": "f0b43dce-7252-4c2b-bd23-40845b5e90b7", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "3cbe7ff2-6bad-4a6f-a25d-42dcc0efe4e0" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b90db52e-982e-4360-b5ed-71147ba79246", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "b90db52e-982e-4360-b5ed-71147ba79246", + "title": "Request Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Request Bytes" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "a2a5c845-d426-425f-b2e6-e8df6038fd9d", - "w": 24, - "x": 24, - "y": 36 - }, - "panelIndex": "a2a5c845-d426-425f-b2e6-e8df6038fd9d", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Backend Response Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.backend_response.bytes : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.backend_response.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "73136403-cbcd-4c9e-9f27-9aed80ff625f": { + "columnOrder": [ + "f3b08f7d-1fae-49ca-904f-cf5a752ecd42", + "d967ee7b-e4d5-4d6c-84f8-02fabbad3ed1", + "e8557dbc-a7af-4b80-b955-f13b99e2ce2b" + ], + "columns": { + "d967ee7b-e4d5-4d6c-84f8-02fabbad3ed1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e8557dbc-a7af-4b80-b955-f13b99e2ce2b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + }, + "e8557dbc-a7af-4b80-b955-f13b99e2ce2b": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.loadbalancing_metrics.https.backend_request.bytes : * " + }, + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.backend_request.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.backend_request.bytes" + }, + "f3b08f7d-1fae-49ca-904f-cf5a752ecd42": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-73136403-cbcd-4c9e-9f27-9aed80ff625f", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "e8557dbc-a7af-4b80-b955-f13b99e2ce2b" + ], + "layerId": "73136403-cbcd-4c9e-9f27-9aed80ff625f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "d967ee7b-e4d5-4d6c-84f8-02fabbad3ed1", + "xAccessor": "f3b08f7d-1fae-49ca-904f-cf5a752ecd42", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "e8557dbc-a7af-4b80-b955-f13b99e2ce2b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e737b020-eb94-4eb1-b53d-50fa551df648", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "e737b020-eb94-4eb1-b53d-50fa551df648", + "title": "Backend Request Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "title": "Backend Response Bytes" - }, - { - "version": "7.17.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "2bf5bf09-e743-4c6d-8251-d12c9c70f273", - "w": 24, - "x": 0, - "y": 36 - }, - "panelIndex": "2bf5bf09-e743-4c6d-8251-d12c9c70f273", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Load Balancing HTTPS Response Bytes [Metrics GCP]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.response.bytes : * " - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "1m", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "filter": { - "language": "kuery", - "query": "gcp.loadbalancing.https.response.bytes : * " - }, - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": "2", - "metrics": [ - { - "field": "gcp.loadbalancing.https.response.bytes", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "3", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "gcp.labels.resource.url_map_name", - "terms_order_by": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": null, - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "5cee01c5-7b80-42d1-a004-0f7321dba263": { + "columnOrder": [ + "c3f208c0-6dc3-407c-bf18-6c967b7bc365", + "5bf2c42a-7601-43f9-8e87-20b9d1f460e1", + "cd1a9cd3-d5ac-4b74-a457-672c52a77ca6" + ], + "columns": { + "5bf2c42a-7601-43f9-8e87-20b9d1f460e1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cd1a9cd3-d5ac-4b74-a457-672c52a77ca6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + }, + "c3f208c0-6dc3-407c-bf18-6c967b7bc365": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cd1a9cd3-d5ac-4b74-a457-672c52a77ca6": { + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.loadbalancing_metrics.https.response.bytes : * " + }, + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.response.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.response.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-5cee01c5-7b80-42d1-a004-0f7321dba263", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "cd1a9cd3-d5ac-4b74-a457-672c52a77ca6" + ], + "layerId": "5cee01c5-7b80-42d1-a004-0f7321dba263", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "5bf2c42a-7601-43f9-8e87-20b9d1f460e1", + "xAccessor": "c3f208c0-6dc3-407c-bf18-6c967b7bc365", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "cd1a9cd3-d5ac-4b74-a457-672c52a77ca6" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2bf5bf09-e743-4c6d-8251-d12c9c70f273", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "2bf5bf09-e743-4c6d-8251-d12c9c70f273", + "title": "Response Bytes", + "type": "lens", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "2ceb399d-760c-4be9-82c9-baa5cb792a01": { + "columnOrder": [ + "0de13042-b2c8-439c-99cd-891d578305c3", + "95a34127-3ab1-48bc-90ed-28109e3466b0", + "933be65e-78aa-48ca-b1cc-dd0f90c921cd" + ], + "columns": { + "0de13042-b2c8-439c-99cd-891d578305c3": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "1m" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "933be65e-78aa-48ca-b1cc-dd0f90c921cd": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.loadbalancing_metrics.https.backend_response.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.loadbalancing_metrics.https.backend_response.bytes" + }, + "95a34127-3ab1-48bc-90ed-28109e3466b0": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.url_map_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "933be65e-78aa-48ca-b1cc-dd0f90c921cd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.url_map_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-2ceb399d-760c-4be9-82c9-baa5cb792a01", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "933be65e-78aa-48ca-b1cc-dd0f90c921cd" + ], + "layerId": "2ceb399d-760c-4be9-82c9-baa5cb792a01", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "95a34127-3ab1-48bc-90ed-28109e3466b0", + "xAccessor": "0de13042-b2c8-439c-99cd-891d578305c3", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "933be65e-78aa-48ca-b1cc-dd0f90c921cd" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a2a5c845-d426-425f-b2e6-e8df6038fd9d", + "w": 24, + "x": 24, + "y": 30 + }, + "panelIndex": "a2a5c845-d426-425f-b2e6-e8df6038fd9d", + "title": "Backend Response Bytes", + "type": "lens", + "version": "8.7.1" } - } - }, - "title": "Response Bytes" - } - ], - "timeRestore": false, - "title": "[Metrics GCP] Load Balancing HTTPS Overview", - "version": 1 - }, - "references": [ - { - "type": "index-pattern", - "name": "f89112f9-0f3a-4712-a317-23230cd66213:control_0_index_pattern", - "id": "metrics-*" + ], + "timeRestore": false, + "title": "[Metrics GCP] Load Balancing HTTPS Overview", + "version": 1 }, - { - "type": "index-pattern", - "name": "f89112f9-0f3a-4712-a317-23230cd66213:control_1_index_pattern", - "id": "metrics-*" + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-16T09:18:06.384Z", + "id": "gcp-aa5b8bd0-9157-11ea-8180-7b0dacd9df87", + "migrationVersion": { + "dashboard": "8.7.0" }, - { - "type": "index-pattern", - "name": "f89112f9-0f3a-4712-a317-23230cd66213:control_2_index_pattern", - "id": "metrics-*" - } - ], - "migrationVersion": { - "dashboard": "7.17.3" - }, - "coreMigrationVersion": "7.17.6" + "references": [ + { + "id": "metrics-*", + "name": "controlGroup_c535cbec-5efe-4b1c-ad48-fae93ef20ee4:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_595eea0d-c2b9-497d-af62-2da94e5df5bf:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_9b9e3b6f-6224-41ab-b57e-7595f56a956a:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" } \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-c355cbb0-3a18-11ee-8736-83dacf143f01.json b/packages/gcp/kibana/dashboard/gcp-c355cbb0-3a18-11ee-8736-83dacf143f01.json new file mode 100644 index 00000000000..3a9e49cff18 --- /dev/null +++ b/packages/gcp/kibana/dashboard/gcp-c355cbb0-3a18-11ee-8736-83dacf143f01.json @@ -0,0 +1,2971 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"581838e6-e49e-4252-b460-80716b0819b9\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"581838e6-e49e-4252-b460-80716b0819b9\",\"fieldName\":\"gcp.labels.resource.region\",\"title\":\"Region\",\"selectedOptions\":[],\"enhancements\":{}}},\"49ce5766-f900-4de5-a320-053cd8551ff0\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"49ce5766-f900-4de5-a320-053cd8551ff0\",\"fieldName\":\"gcp.labels.resource.database_id\",\"title\":\"Database ID\",\"enhancements\":{}}},\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\",\"fieldName\":\"gcp.labels.cloudsql.version\",\"title\":\"MySQL Version\",\"enhancements\":{}}}}" + }, + "description": "Overview of GCP CloudSQL MySQL Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.cloudsql_mysql" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.cloudsql_mysql" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Database Up", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.up" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "2394df1e-4fab-4519-94e7-2521427302f6", + "w": 6, + "x": 0, + "y": 0 + }, + "panelIndex": "2394df1e-4fab-4519-94e7-2521427302f6", + "title": "Database Up", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.network.connections.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.network.connections.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "905d7d75-61b3-4661-9525-2aa6c536155b", + "w": 21, + "x": 6, + "y": 0 + }, + "panelIndex": "905d7d75-61b3-4661-9525-2aa6c536155b", + "title": "Database Network Connections", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.cpu.utilization.pct", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.cpu.utilization.pct" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "w": 21, + "x": 27, + "y": 0 + }, + "panelIndex": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "title": "CPU Utilization", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Database Uptime", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.uptime.sec" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70", + "subtitle": "Seconds" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "a813ec51-1532-4df4-b759-a4e235e77985", + "w": 6, + "x": 0, + "y": 7 + }, + "panelIndex": "a813ec51-1532-4df4-b759-a4e235e77985", + "title": "Database Uptime", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.network.received_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.network.received_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "w": 24, + "x": 24, + "y": 14 + }, + "panelIndex": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "title": "Network Received Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.network.sent_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.network.sent_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "816f766c-a733-40f4-b3b1-1997753c1610", + "w": 24, + "x": 0, + "y": 14 + }, + "panelIndex": "816f766c-a733-40f4-b3b1-1997753c1610", + "title": "Network Sent Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.disk.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.disk.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "w": 24, + "x": 24, + "y": 29 + }, + "panelIndex": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "title": "Disk Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.disk.bytes_used.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.disk.bytes_used.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "w": 24, + "x": 0, + "y": 29 + }, + "panelIndex": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "title": "Disk Bytes Used", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.disk.write_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.disk.write_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "title": "Disk Write Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.disk.read_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.disk.read_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "w": 24, + "x": 0, + "y": 44 + }, + "panelIndex": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "title": "Disk Read Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.memory.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.memory.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "w": 24, + "x": 24, + "y": 59 + }, + "panelIndex": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "title": "Memory Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.memory.total_usage.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.memory.total_usage.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "625ccc7d-052a-42e0-b363-7821285be839", + "w": 24, + "x": 0, + "y": 59 + }, + "panelIndex": "625ccc7d-052a-42e0-b363-7821285be839", + "title": "Memory Total Usage", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.questions.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.questions.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "w": 24, + "x": 24, + "y": 74 + }, + "panelIndex": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "title": "Questions", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.queries.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.queries.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "w": 24, + "x": 0, + "y": 74 + }, + "panelIndex": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "title": "Queries", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.sent_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.sent_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "da60b92c-bb30-4eba-be39-74c07fbe2e85", + "w": 24, + "x": 24, + "y": 89 + }, + "panelIndex": "da60b92c-bb30-4eba-be39-74c07fbe2e85", + "title": "Sent Bytes Count", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.received_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.received_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cd8bd813-6760-47b2-9edb-2c302a953fd5", + "w": 24, + "x": 0, + "y": 89 + }, + "panelIndex": "cd8bd813-6760-47b2-9edb-2c302a953fd5", + "title": "Received Bytes Count", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.innodb_data_fsyncs.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.innodb_data_fsyncs.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3c0342f2-e5e6-4faa-ad04-8ae6bef892b5", + "w": 24, + "x": 0, + "y": 104 + }, + "panelIndex": "3c0342f2-e5e6-4faa-ad04-8ae6bef892b5", + "title": "InnoDB Data Fsyncs", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.innodb_os_log_fsyncs.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.innodb_os_log_fsyncs.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7cf052f7-b95d-4450-8a15-0b944210286b", + "w": 24, + "x": 24, + "y": 104 + }, + "panelIndex": "7cf052f7-b95d-4450-8a15-0b944210286b", + "title": "InnoDB OS Log Fsyncs", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.innodb_pages_read.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.innodb_pages_read.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "29224149-0d76-4291-b440-5727adef4b27", + "w": 24, + "x": 0, + "y": 119 + }, + "panelIndex": "29224149-0d76-4291-b440-5727adef4b27", + "title": "InnoDB Pages Read", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_mysql.database.innodb_pages_written.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_mysql.database.innodb_pages_written.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b9fd037e-e185-48df-8af9-a971b24caf92", + "w": 24, + "x": 24, + "y": 119 + }, + "panelIndex": "b9fd037e-e185-48df-8af9-a971b24caf92", + "title": "InnoDB Pages Written", + "type": "lens", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Metrics GCP] CloudSQL MySQL Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-08-13T20:52:27.686Z", + "id": "gcp-c355cbb0-3a18-11ee-8736-83dacf143f01", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2394df1e-4fab-4519-94e7-2521427302f6:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "905d7d75-61b3-4661-9525-2aa6c536155b:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "dd61c1f2-905d-4bf5-9171-02cf054e90a3:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a813ec51-1532-4df4-b759-a4e235e77985:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a07fcee5-14df-488c-bbbe-6cf03c657bf9:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "816f766c-a733-40f4-b3b1-1997753c1610:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ec6b8d60-073f-4594-a8e1-0ee636f95d34:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "943c31e3-0b2d-4633-80e8-afa7204bf1c8:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "cce0e37e-dfe8-4d54-bde9-2b380730166a:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1f7f2ce0-a803-4ac2-bd66-232742252876:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "625ccc7d-052a-42e0-b363-7821285be839:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0e4d41bb-da80-4b91-89be-945be1c5ae70:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9eab5155-2c28-4850-b9c8-b9f179915cbe:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "da60b92c-bb30-4eba-be39-74c07fbe2e85:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "cd8bd813-6760-47b2-9edb-2c302a953fd5:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3c0342f2-e5e6-4faa-ad04-8ae6bef892b5:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "7cf052f7-b95d-4450-8a15-0b944210286b:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "29224149-0d76-4291-b440-5727adef4b27:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b9fd037e-e185-48df-8af9-a971b24caf92:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_581838e6-e49e-4252-b460-80716b0819b9:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_49ce5766-f900-4de5-a320-053cd8551ff0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_cd090427-fd35-45fc-bef0-d94ccc18e3ab:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/gcp/kibana/dashboard/gcp-ddc19780-3a0a-11ee-8736-83dacf143f01.json b/packages/gcp/kibana/dashboard/gcp-ddc19780-3a0a-11ee-8736-83dacf143f01.json new file mode 100644 index 00000000000..c6c6dfe7ff6 --- /dev/null +++ b/packages/gcp/kibana/dashboard/gcp-ddc19780-3a0a-11ee-8736-83dacf143f01.json @@ -0,0 +1,2805 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"581838e6-e49e-4252-b460-80716b0819b9\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"581838e6-e49e-4252-b460-80716b0819b9\",\"fieldName\":\"gcp.labels.resource.region\",\"title\":\"Region\",\"selectedOptions\":[],\"enhancements\":{}}},\"49ce5766-f900-4de5-a320-053cd8551ff0\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"49ce5766-f900-4de5-a320-053cd8551ff0\",\"fieldName\":\"gcp.labels.resource.database_id\",\"title\":\"Database ID\",\"enhancements\":{}}},\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"cd090427-fd35-45fc-bef0-d94ccc18e3ab\",\"fieldName\":\"gcp.labels.cloudsql.version\",\"title\":\"PostgreSQL Version\",\"enhancements\":{}}}}" + }, + "description": "Overview of GCP CloudSQL PostgreSQL Metrics", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "gcp.cloudsql_postgresql" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "gcp.cloudsql_postgresql" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Database Up", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.up" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "2394df1e-4fab-4519-94e7-2521427302f6", + "w": 6, + "x": 0, + "y": 0 + }, + "panelIndex": "2394df1e-4fab-4519-94e7-2521427302f6", + "title": "Database Up", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.network.connections.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.network.connections.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "905d7d75-61b3-4661-9525-2aa6c536155b", + "w": 21, + "x": 6, + "y": 0 + }, + "panelIndex": "905d7d75-61b3-4661-9525-2aa6c536155b", + "title": "Database Network Connections", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.cpu.utilization.pct", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "percent", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.cpu.utilization.pct" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "w": 21, + "x": 27, + "y": 0 + }, + "panelIndex": "dd61c1f2-905d-4bf5-9171-02cf054e90a3", + "title": "CPU Utilization", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aafb021a-7312-4cf7-be09-71a6544eb716": { + "columnOrder": [ + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70" + ], + "columns": { + "a0dea9fa-fff9-4136-bfd1-9a20658d6f70": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "gcp.cloudsql_postgresql.database.uptime.sec: *" + }, + "isBucketed": false, + "label": "Database Uptime", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.uptime.sec" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "aafb021a-7312-4cf7-be09-71a6544eb716", + "layerType": "data", + "metricAccessor": "a0dea9fa-fff9-4136-bfd1-9a20658d6f70", + "showBar": false, + "subtitle": "Seconds" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "3d162bd4-3d81-4934-8b6d-13a85b95cf07", + "w": 6, + "x": 0, + "y": 7 + }, + "panelIndex": "3d162bd4-3d81-4934-8b6d-13a85b95cf07", + "title": "Database Uptime", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.network.sent_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.network.sent_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "816f766c-a733-40f4-b3b1-1997753c1610", + "w": 24, + "x": 0, + "y": 14 + }, + "panelIndex": "816f766c-a733-40f4-b3b1-1997753c1610", + "title": "Network Sent Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.network.received_bytes.count", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.network.received_bytes.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "w": 24, + "x": 24, + "y": 14 + }, + "panelIndex": "a07fcee5-14df-488c-bbbe-6cf03c657bf9", + "title": "Network Received Bytes", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.transaction.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.transaction.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e0604618-6723-458c-a5a9-5571e37225a0", + "w": 16, + "x": 0, + "y": 29 + }, + "panelIndex": "e0604618-6723-458c-a5a9-5571e37225a0", + "title": "Transaction Count", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.disk.bytes_used.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.disk.bytes_used.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "w": 16, + "x": 16, + "y": 29 + }, + "panelIndex": "943c31e3-0b2d-4633-80e8-afa7204bf1c8", + "title": "Disk Bytes Used", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.disk.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.disk.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "w": 16, + "x": 32, + "y": 29 + }, + "panelIndex": "ec6b8d60-073f-4594-a8e1-0ee636f95d34", + "title": "Disk Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.disk.read_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.disk.read_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "w": 24, + "x": 0, + "y": 44 + }, + "panelIndex": "cce0e37e-dfe8-4d54-bde9-2b380730166a", + "title": "Disk Read Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.disk.write_ops.count", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.disk.write_ops.count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "w": 24, + "x": 24, + "y": 44 + }, + "panelIndex": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c", + "title": "Disk Write Ops", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.memory.quota.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.memory.quota.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "w": 24, + "x": 24, + "y": 59 + }, + "panelIndex": "1f7f2ce0-a803-4ac2-bd66-232742252876", + "title": "Memory Quota", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.memory.total_usage.bytes", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.memory.total_usage.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "625ccc7d-052a-42e0-b363-7821285be839", + "w": 24, + "x": 0, + "y": 59 + }, + "panelIndex": "625ccc7d-052a-42e0-b363-7821285be839", + "title": "Memory Total Usage", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.insights.aggregate.latencies", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.insights.aggregate.latencies" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "be3a85ee-7657-4472-9c12-e2c3c5a0b631", + "w": 16, + "x": 32, + "y": 74 + }, + "panelIndex": "be3a85ee-7657-4472-9c12-e2c3c5a0b631", + "title": "Insights Aggregate Latencies", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.insights.aggregate.execution_time", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.insights.aggregate.execution_time" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "w": 16, + "x": 0, + "y": 74 + }, + "panelIndex": "9eab5155-2c28-4850-b9c8-b9f179915cbe", + "title": "Insights Aggregate Execution Time", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.insights.aggregate.io_time", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.insights.aggregate.io_time" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "w": 16, + "x": 16, + "y": 74 + }, + "panelIndex": "0e4d41bb-da80-4b91-89be-945be1c5ae70", + "title": "Insights Aggregate IO Time", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.replication.replica_lag.sec", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.replication.replica_lag.sec" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "22bf9e3d-ede8-4915-98f5-683e2df9b3c1", + "w": 16, + "x": 32, + "y": 89 + }, + "panelIndex": "22bf9e3d-ede8-4915-98f5-683e2df9b3c1", + "title": "Replication Replica Lag", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.insights.aggregate.lock_time", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.insights.aggregate.lock_time" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ca3f94c3-e5ad-4816-91f4-2bc359934d81", + "w": 16, + "x": 0, + "y": 89 + }, + "panelIndex": "ca3f94c3-e5ad-4816-91f4-2bc359934d81", + "title": "Insights Aggregate Lock Time", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d35506e-aad3-47f0-bb51-e502533ad86e": { + "columnOrder": [ + "133ea24e-720e-441c-8b92-5989d9920866", + "4af0f24b-db77-44d1-8a9a-40edc585a607", + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "columns": { + "133ea24e-720e-441c-8b92-5989d9920866": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of gcp.labels.resource.database_id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a527b6bd-49c3-430e-9cbc-d151c62d47b0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "gcp.labels.resource.database_id" + }, + "4af0f24b-db77-44d1-8a9a-40edc585a607": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "60s" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a527b6bd-49c3-430e-9cbc-d151c62d47b0": { + "dataType": "number", + "isBucketed": false, + "label": "Average of gcp.cloudsql_postgresql.database.replication.network_lag.sec", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "gcp.cloudsql_postgresql.database.replication.network_lag.sec" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "a527b6bd-49c3-430e-9cbc-d151c62d47b0" + ], + "collapseFn": "", + "layerId": "1d35506e-aad3-47f0-bb51-e502533ad86e", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "133ea24e-720e-441c-8b92-5989d9920866", + "xAccessor": "4af0f24b-db77-44d1-8a9a-40edc585a607" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0d7290e9-7376-4c73-8df5-29c8f5cc107d", + "w": 16, + "x": 16, + "y": 89 + }, + "panelIndex": "0d7290e9-7376-4c73-8df5-29c8f5cc107d", + "title": "Replication Network Lag", + "type": "lens", + "version": "8.7.0" + } + ], + "timeRestore": false, + "title": "[Metrics GCP] CloudSQL PostgreSQL Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-08-13T20:21:44.175Z", + "id": "gcp-ddc19780-3a0a-11ee-8736-83dacf143f01", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "metrics-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "2394df1e-4fab-4519-94e7-2521427302f6:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "905d7d75-61b3-4661-9525-2aa6c536155b:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "dd61c1f2-905d-4bf5-9171-02cf054e90a3:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "3d162bd4-3d81-4934-8b6d-13a85b95cf07:indexpattern-datasource-layer-aafb021a-7312-4cf7-be09-71a6544eb716", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "816f766c-a733-40f4-b3b1-1997753c1610:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "a07fcee5-14df-488c-bbbe-6cf03c657bf9:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "e0604618-6723-458c-a5a9-5571e37225a0:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "943c31e3-0b2d-4633-80e8-afa7204bf1c8:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ec6b8d60-073f-4594-a8e1-0ee636f95d34:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "cce0e37e-dfe8-4d54-bde9-2b380730166a:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c9c66b06-62ed-4fcb-badd-1ad044aadc5c:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "1f7f2ce0-a803-4ac2-bd66-232742252876:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "625ccc7d-052a-42e0-b363-7821285be839:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "be3a85ee-7657-4472-9c12-e2c3c5a0b631:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9eab5155-2c28-4850-b9c8-b9f179915cbe:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0e4d41bb-da80-4b91-89be-945be1c5ae70:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "22bf9e3d-ede8-4915-98f5-683e2df9b3c1:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ca3f94c3-e5ad-4816-91f4-2bc359934d81:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "0d7290e9-7376-4c73-8df5-29c8f5cc107d:indexpattern-datasource-layer-1d35506e-aad3-47f0-bb51-e502533ad86e", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_581838e6-e49e-4252-b460-80716b0819b9:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_49ce5766-f900-4de5-a320-053cd8551ff0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "controlGroup_cd090427-fd35-45fc-bef0-d94ccc18e3ab:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/gcp/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json b/packages/gcp/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json index 072ca094685..f29347eb9d9 100644 --- a/packages/gcp/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json +++ b/packages/gcp/kibana/search/gcp-d88364c0-73a1-11ea-a345-f985c61fe654.json @@ -1,16 +1,19 @@ { "attributes": { "columns": [ + "event.action", "user.email", "service.name", "gcp.audit.type", - "event.action", "event.outcome", "source.ip", "source.geo.region_name" ], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -45,14 +48,22 @@ "version": true } }, - "sort": [], + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, "title": "Audit [Logs GCP]", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T14:20:13.203Z", "id": "gcp-d88364c0-73a1-11ea-a345-f985c61fe654", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/gcp/kibana/tag/gcp-e1a359e5-543d-44c2-ab81-628138719e28.json b/packages/gcp/kibana/tag/gcp-e1a359e5-543d-44c2-ab81-628138719e28.json deleted file mode 100644 index 5f9cb58c693..00000000000 --- a/packages/gcp/kibana/tag/gcp-e1a359e5-543d-44c2-ab81-628138719e28.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "attributes": { - "color": "#6092C0", - "description": "All assets to monitor GCP", - "name": "GCP" - }, - "coreMigrationVersion": "7.17.0", - "id": "gcp-e1a359e5-543d-44c2-ab81-628138719e28", - "references": [], - "type": "tag" -} \ No newline at end of file diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index c89aed05202..b3b2e70b01a 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -1,7 +1,6 @@ name: gcp title: Google Cloud Platform -version: "2.22.0" -release: ga +version: "2.29.0" description: Collect logs and metrics from Google Cloud Platform with Elastic Agent. type: integration icons: @@ -9,12 +8,11 @@ icons: title: logo gcp size: 32x32 type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: 2.7.0 categories: - google_cloud conditions: - kibana.version: ^8.6.0 + kibana.version: ^8.7.1 screenshots: - src: /img/filebeat-gcp-audit.png title: filebeat gcp audit @@ -239,5 +237,17 @@ policy_templates: - type: gcp/metrics title: Collect GCP Cloud Run Metrics description: Collect GCP Cloud Run Metrics + - name: cloudsql + title: Google Cloud Platform (GCP) CloudSQL metrics + description: Collect CloudSQL metrics from Google Cloud Platform (GCP) with Elastic Agent + data_streams: + - cloudsql_mysql + - cloudsql_postgresql + - cloudsql_sqlserver + inputs: + - type: gcp/metrics + title: Collect GCP CloudSQL Metrics + description: Collect GCP CloudSQL Metrics + input_group: metrics owner: - github: elastic/security-external-integrations + github: elastic/obs-cloud-monitoring diff --git a/packages/gcp_pubsub/_dev/build/build.yml b/packages/gcp_pubsub/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/gcp_pubsub/_dev/build/build.yml +++ b/packages/gcp_pubsub/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/gcp_pubsub/changelog.yml b/packages/gcp_pubsub/changelog.yml index 0f23aa8d966..449f8e54808 100644 --- a/packages/gcp_pubsub/changelog.yml +++ b/packages/gcp_pubsub/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.7.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/gcp_pubsub/kibana/tags.yml b/packages/gcp_pubsub/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/gcp_pubsub/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/gcp_pubsub/manifest.yml b/packages/gcp_pubsub/manifest.yml index dcd7f68ea67..9aa16020996 100644 --- a/packages/gcp_pubsub/manifest.yml +++ b/packages/gcp_pubsub/manifest.yml @@ -1,6 +1,6 @@ name: gcp_pubsub title: Custom Google Pub/Sub Logs -version: "1.7.0" +version: "1.10.0" description: Collect Logs from Google Pub/Sub topics type: integration icons: @@ -8,13 +8,14 @@ icons: title: logo gcp size: 32x32 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" categories: - observability - google_cloud - custom conditions: - kibana.version: ^7.16.0 || ^8.0.0 + kibana: + version: ^7.16.0 || ^8.0.0 policy_templates: - name: gcp title: Custom Google Pub/Sub Logs @@ -25,3 +26,4 @@ policy_templates: description: Collect Logs from Google Pub/Sub topics owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/github/_dev/build/build.yml b/packages/github/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/github/_dev/build/build.yml +++ b/packages/github/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/github/changelog.yml b/packages/github/changelog.yml index cc5f5e4e643..1ed152144bb 100644 --- a/packages/github/changelog.yml +++ b/packages/github/changelog.yml @@ -1,4 +1,54 @@ # newer versions go on top +- version: 1.22.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.21.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.20.1" + changes: + - description: Make datastreams agree on type of `github.repository.description`. + type: bugfix + link: https://github.com/elastic/integrations/pull/7714 +- version: "1.20.0" + changes: + - description: Add support for `github.permission` and `github.repository_public` fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/7553 +- version: "1.19.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.18.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.17.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6986 +- version: "1.16.0" + changes: + - description: Convert dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6883 +- version: "1.15.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 +- version: "1.14.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log b/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log index 1523b6f6235..9e32198319d 100644 --- a/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log +++ b/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log @@ -186,4 +186,6 @@ {"actor":"github-actor","org":"Example-Org","created_at":1632712526255,"action":"org.audit_log_git_event_export","actor_location":{"country_code":"US"}} {"@timestamp":1655872622832,"action":"git.clone","actor":"github-actions[bot]","actor_location":{"country_code":"US"},"business":"redacted","org":"redacted","repo":"redacted/redacted","repository":"redacted/redacted","repository_public":false,"transport_protocol":1,"transport_protocol_name":"http","user":""} {"@timestamp":1674454840535,"action":"hook.create","active":true,"actor":"userdeserve","actor_id":23123,"actor_location":{"country_code":"US"},"business":"deserve","business_id":3231,"created_at":1674454840535,"events":["push"],"hashed_token":"12387sdjbqas17827ty1o2u313","hook_id":23122678,"name":"webhook","oauth_application":null,"oauth_application_id":null,"operation_type":"create","org":"trustfactors","org_id":324235623,"programmatic_access_type":"Authentication token created before 2021-04-05","public_repo":false,"repo":"org/repo","repo_id":266143714,"token_id":213123634,"token_scopes":"repo","user_agent":"AWS CodePipeline"} -{"@timestamp":1674454784795,"action":"pull_request.create_review_request","actor":"user-deserve","actor_id":231231,"actor_location":{"country_code":"IN"},"business":"deserve","business_id":31213,"created_at":1674454784795,"operation_type":"create","org":"trustfactors","org_id":23131,"public_repo":false,"pull_request_id":678456,"pull_request_title":"Token Permission Feature --\\u003e Dev","pull_request_url":"https://github.com/org/repo/pull/2408","repo":"org/repo","repo_id":62324324,"user":"user-deserve","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","user_id":43246232} \ No newline at end of file +{"@timestamp":1674454784795,"action":"pull_request.create_review_request","actor":"user-deserve","actor_id":231231,"actor_location":{"country_code":"IT"},"business":"deserve","business_id":31213,"created_at":1674454784795,"operation_type":"create","org":"trustfactors","org_id":23131,"public_repo":false,"pull_request_id":678456,"pull_request_title":"Token Permission Feature --\\u003e Dev","pull_request_url":"https://github.com/org/repo/pull/3423","repo":"org/repo","repo_id":4354361,"user":"user-deserve","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","user_id":34523423} +{"@timestamp":1692655003441,"_document_id":"l-qlCkgECpbC74A-ELsoJA","action":"org.add_member","actor":"github-actor","actor_id":34525324,"business":"big-biz","business_id":23462,"created_at":1692655003441,"operation_type":"create","org":"github-org","org_id":34151345,"permission":"admin","user":"github_user","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36","user_id":4562345} +{"@timestamp":1692989148721,"action":"git.clone","business":"big-biz","business_id":23462,"org":"github-org","org_id":34151345,"repo":"github-org/4","repository":"github-org/4","repository_public":true,"transport_protocol":1,"transport_protocol_name":"http","user_id":0} diff --git a/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log-expected.json b/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log-expected.json index 6066ca6de37..68ccac6a94c 100644 --- a/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log-expected.json +++ b/packages/github/data_stream/audit/_dev/test/pipeline/test-audit-json.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-03-04T23:24:11.067Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -36,7 +36,7 @@ { "@timestamp": "2020-03-04T23:24:11.273Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -69,7 +69,7 @@ { "@timestamp": "2020-03-04T23:24:11.179Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -107,7 +107,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -152,7 +152,7 @@ { "@timestamp": "2020-03-04T23:24:11.101Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -185,7 +185,7 @@ { "@timestamp": "2020-03-04T23:24:11.214Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -218,7 +218,7 @@ { "@timestamp": "2020-03-04T23:24:11.364Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -256,7 +256,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -301,7 +301,7 @@ { "@timestamp": "2020-03-04T23:42:30.878Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -347,7 +347,7 @@ { "@timestamp": "2020-03-04T23:24:11.144Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -380,7 +380,7 @@ { "@timestamp": "2020-03-04T23:24:11.325Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -413,7 +413,7 @@ { "@timestamp": "2020-03-05T02:45:22.166Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -464,7 +464,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.create", @@ -498,7 +498,7 @@ { "@timestamp": "2020-03-04T23:24:11.399Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "organization_default_label.create", @@ -531,7 +531,7 @@ { "@timestamp": "2020-03-04T23:24:08.566Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -582,7 +582,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.oauth_app_access_approved", @@ -625,7 +625,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.create", @@ -670,7 +670,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -722,7 +722,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -774,7 +774,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -824,7 +824,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -863,7 +863,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -915,7 +915,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -967,7 +967,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.create", @@ -1012,7 +1012,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -1062,7 +1062,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -1101,7 +1101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -1153,7 +1153,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -1198,7 +1198,7 @@ { "@timestamp": "2021-01-25T22:02:24.633Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -1249,7 +1249,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -1288,7 +1288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -1340,7 +1340,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -1386,7 +1386,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -1425,7 +1425,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -1472,7 +1472,7 @@ { "@timestamp": "2021-01-26T01:10:57.848Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.actions_enabled", @@ -1511,7 +1511,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repository_vulnerability_alerts.disable", @@ -1549,7 +1549,7 @@ { "@timestamp": "2021-01-25T21:57:02.014Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -1600,7 +1600,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -1646,7 +1646,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -1685,7 +1685,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -1737,7 +1737,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "integration_installation.create", @@ -1770,7 +1770,7 @@ { "@timestamp": "2021-01-25T21:57:36.834Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -1821,7 +1821,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.create", @@ -1860,7 +1860,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.invite_member", @@ -1910,7 +1910,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.create", @@ -1953,7 +1953,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -2000,7 +2000,7 @@ { "@timestamp": "2021-01-25T22:00:13.018Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.add_member", @@ -2051,7 +2051,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -2103,7 +2103,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -2142,7 +2142,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2181,7 +2181,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2220,7 +2220,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflows.delete_workflow_run", @@ -2259,7 +2259,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2298,7 +2298,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2337,7 +2337,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2376,7 +2376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2415,7 +2415,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2454,7 +2454,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2493,7 +2493,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.add_member", @@ -2536,7 +2536,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -2573,7 +2573,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2612,7 +2612,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -2649,7 +2649,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.transfer", @@ -2693,7 +2693,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "workflows.delete_workflow_run", @@ -2732,7 +2732,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2771,7 +2771,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -2808,7 +2808,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2847,7 +2847,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -2893,7 +2893,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -2932,7 +2932,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -2969,7 +2969,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3006,7 +3006,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -3045,7 +3045,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -3091,7 +3091,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -3128,7 +3128,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3165,7 +3165,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3202,7 +3202,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3239,7 +3239,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3276,7 +3276,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -3313,7 +3313,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -3350,7 +3350,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3387,7 +3387,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3424,7 +3424,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3461,7 +3461,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3498,7 +3498,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3535,7 +3535,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3572,7 +3572,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3609,7 +3609,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3646,7 +3646,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3683,7 +3683,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -3720,7 +3720,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3757,7 +3757,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -3794,7 +3794,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -3831,7 +3831,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.rejected_ref_update", @@ -3870,7 +3870,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3907,7 +3907,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -3944,7 +3944,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -3981,7 +3981,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -4018,7 +4018,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -4057,7 +4057,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.create", @@ -4096,7 +4096,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.add_member", @@ -4134,7 +4134,7 @@ { "@timestamp": "2021-07-03T03:33:42.495Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.update_default_branch", @@ -4173,7 +4173,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.remove_member", @@ -4225,7 +4225,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -4277,7 +4277,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.add_member", @@ -4320,7 +4320,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.remove_member", @@ -4372,7 +4372,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.create", @@ -4411,7 +4411,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.remove_member", @@ -4463,7 +4463,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.update_repository_permission", @@ -4508,7 +4508,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.remove_member", @@ -4560,7 +4560,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -4606,7 +4606,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.destroy", @@ -4645,7 +4645,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.remove_member", @@ -4697,7 +4697,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "project.create", @@ -4731,7 +4731,7 @@ { "@timestamp": "2021-09-20T13:54:28.095Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.actions_enabled", @@ -4770,7 +4770,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -4809,7 +4809,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_required_status_checks_enforcement_level", @@ -4848,7 +4848,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -4887,7 +4887,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -4926,7 +4926,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -4965,7 +4965,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review.submit", @@ -5002,7 +5002,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5041,7 +5041,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -5080,7 +5080,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -5119,7 +5119,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -5171,7 +5171,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "required_status_check.create", @@ -5210,7 +5210,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5249,7 +5249,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5288,7 +5288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -5327,7 +5327,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5366,7 +5366,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5405,7 +5405,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.create", @@ -5448,7 +5448,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5487,7 +5487,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -5533,7 +5533,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -5579,7 +5579,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.create", @@ -5618,7 +5618,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_linear_history_requirement_enforcement_level", @@ -5657,7 +5657,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -5696,7 +5696,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5735,7 +5735,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -5774,7 +5774,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -5808,7 +5808,7 @@ { "@timestamp": "2021-09-17T16:59:20.413Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.actions_enabled", @@ -5847,7 +5847,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -5886,7 +5886,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.create", @@ -5929,7 +5929,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -5968,7 +5968,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "required_status_check.create", @@ -6007,7 +6007,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.rename", @@ -6046,7 +6046,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6085,7 +6085,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6124,7 +6124,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_admin_enforced", @@ -6163,7 +6163,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6202,7 +6202,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.access", @@ -6241,7 +6241,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6280,7 +6280,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -6319,7 +6319,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -6358,7 +6358,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -6397,7 +6397,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_linear_history_requirement_enforcement_level", @@ -6436,7 +6436,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_required_status_checks_enforcement_level", @@ -6475,7 +6475,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6514,7 +6514,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "project.create", @@ -6553,7 +6553,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.audit_log_export", @@ -6596,7 +6596,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_member", @@ -6648,7 +6648,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6687,7 +6687,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_linear_history_requirement_enforcement_level", @@ -6726,7 +6726,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.merge", @@ -6765,7 +6765,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -6804,7 +6804,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -6843,7 +6843,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -6882,7 +6882,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request_review_comment.create", @@ -6919,7 +6919,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repository_vulnerability_alerts.disable", @@ -6962,7 +6962,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -7008,7 +7008,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -7047,7 +7047,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -7086,7 +7086,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.create", @@ -7131,7 +7131,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "team.add_repository", @@ -7177,7 +7177,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -7216,7 +7216,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -7255,7 +7255,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -7294,7 +7294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_pull_request_reviews_enforcement_level", @@ -7333,7 +7333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.update_admin_enforced", @@ -7372,7 +7372,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -7411,7 +7411,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "repo.change_merge_setting", @@ -7450,7 +7450,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create", @@ -7489,7 +7489,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "protected_branch.policy_override", @@ -7528,7 +7528,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.ready_for_review", @@ -7567,7 +7567,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.audit_log_git_event_export", @@ -7610,7 +7610,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "git.clone", @@ -7627,7 +7627,8 @@ "github": { "category": "git", "org": "redacted", - "repo": "redacted/redacted" + "repo": "redacted/redacted", + "repository_public": false }, "related": { "user": [ @@ -7649,7 +7650,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "hook.create", @@ -7684,11 +7685,11 @@ "@timestamp": "2023-01-23T06:19:44.795Z", "client": { "geo": { - "country_iso_code": "IN" + "country_iso_code": "IT" } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pull_request.create_review_request", @@ -7697,7 +7698,7 @@ "web" ], "kind": "event", - "original": "{\"@timestamp\":1674454784795,\"action\":\"pull_request.create_review_request\",\"actor\":\"user-deserve\",\"actor_id\":231231,\"actor_location\":{\"country_code\":\"IN\"},\"business\":\"deserve\",\"business_id\":31213,\"created_at\":1674454784795,\"operation_type\":\"create\",\"org\":\"trustfactors\",\"org_id\":23131,\"public_repo\":false,\"pull_request_id\":678456,\"pull_request_title\":\"Token Permission Feature --\\\\u003e Dev\",\"pull_request_url\":\"https://github.com/org/repo/pull/2408\",\"repo\":\"org/repo\",\"repo_id\":62324324,\"user\":\"user-deserve\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"user_id\":43246232}", + "original": "{\"@timestamp\":1674454784795,\"action\":\"pull_request.create_review_request\",\"actor\":\"user-deserve\",\"actor_id\":231231,\"actor_location\":{\"country_code\":\"IT\"},\"business\":\"deserve\",\"business_id\":31213,\"created_at\":1674454784795,\"operation_type\":\"create\",\"org\":\"trustfactors\",\"org_id\":23131,\"public_repo\":false,\"pull_request_id\":678456,\"pull_request_title\":\"Token Permission Feature --\\\\u003e Dev\",\"pull_request_url\":\"https://github.com/org/repo/pull/3423\",\"repo\":\"org/repo\",\"repo_id\":4354361,\"user\":\"user-deserve\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\",\"user_id\":34523423}", "type": [ "creation" ] @@ -7722,6 +7723,81 @@ "name": "user-deserve" } } + }, + { + "@timestamp": "2023-08-21T21:56:43.441Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "org.add_member", + "category": [ + "configuration", + "web", + "iam" + ], + "id": "l-qlCkgECpbC74A-ELsoJA", + "kind": "event", + "original": "{\"@timestamp\":1692655003441,\"_document_id\":\"l-qlCkgECpbC74A-ELsoJA\",\"action\":\"org.add_member\",\"actor\":\"github-actor\",\"actor_id\":34525324,\"business\":\"big-biz\",\"business_id\":23462,\"created_at\":1692655003441,\"operation_type\":\"create\",\"org\":\"github-org\",\"org_id\":34151345,\"permission\":\"admin\",\"user\":\"github_user\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36\",\"user_id\":4562345}", + "type": [ + "group", + "user", + "creation" + ] + }, + "github": { + "category": "org", + "org": "github-org", + "permission": "admin" + }, + "group": { + "name": "github-org" + }, + "related": { + "user": [ + "github-actor", + "github_user" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "name": "github-actor", + "target": { + "group": { + "name": "github-org" + }, + "name": "github_user" + } + } + }, + { + "@timestamp": "2023-08-25T18:45:48.721Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "git.clone", + "category": [ + "configuration", + "web" + ], + "kind": "event", + "original": "{\"@timestamp\":1692989148721,\"action\":\"git.clone\",\"business\":\"big-biz\",\"business_id\":23462,\"org\":\"github-org\",\"org_id\":34151345,\"repo\":\"github-org/4\",\"repository\":\"github-org/4\",\"repository_public\":true,\"transport_protocol\":1,\"transport_protocol_name\":\"http\",\"user_id\":0}", + "type": [ + "change" + ] + }, + "github": { + "category": "git", + "org": "github-org", + "repo": "github-org/4", + "repository_public": true + }, + "tags": [ + "preserve_original_event" + ] } ] } \ No newline at end of file diff --git a/packages/github/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 4a6dadc600a..72aeae8973a 100644 --- a/packages/github/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -6,7 +6,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: @@ -70,6 +70,12 @@ processors: field: json.repo target_field: github.repo ignore_missing: true +- convert: + field: json.repository_public + target_field: github.repository_public + type: boolean + ignore_missing: true + ignore_failure: true - rename: field: json.team target_field: github.team @@ -79,6 +85,10 @@ processors: target_field: github.team ignore_missing: true if: ctx.github?.team == null +- rename: + field: json.permission + target_field: github.permission + ignore_missing: true - set: field: group.name copy_from: github.team diff --git a/packages/github/data_stream/audit/fields/fields.yml b/packages/github/data_stream/audit/fields/fields.yml index 59930fc9dcb..e56ee51458e 100644 --- a/packages/github/data_stream/audit/fields/fields.yml +++ b/packages/github/data_stream/audit/fields/fields.yml @@ -15,3 +15,11 @@ type: keyword description: >- GitHub action category +- name: github.permission + type: keyword + description: >- + GitHub user permissions for the event. +- name: github.repository_public + type: boolean + description: >- + Whether the GitHub repository is publicly visible. diff --git a/packages/github/data_stream/audit/manifest.yml b/packages/github/data_stream/audit/manifest.yml index de63b29b30d..4ad7e893718 100644 --- a/packages/github/data_stream/audit/manifest.yml +++ b/packages/github/data_stream/audit/manifest.yml @@ -20,6 +20,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -30,7 +31,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -39,7 +40,7 @@ streams: required: true show_user: true default: 730h # 30 days - description: Initial interval to poll for events. Default is 730 hours (30 days). + description: Initial interval to poll for events. Default is 730 hours (30 days). Supported units for this parameter are h/m/s. - name: api_url type: text title: API URL. diff --git a/packages/github/data_stream/audit/sample_event.json b/packages/github/data_stream/audit/sample_event.json index aff1de008fb..8c37c629cba 100644 --- a/packages/github/data_stream/audit/sample_event.json +++ b/packages/github/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-11-18T17:05:48.837Z", "agent": { - "ephemeral_id": "b290281f-0eee-49e8-aafc-bb85d4d0c6c4", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "39fbfc30-ef11-4c8c-9b89-af6c312ba558", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.audit", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "repo.destroy", @@ -27,10 +27,10 @@ "configuration", "web" ], - "created": "2023-02-23T17:27:07.020Z", + "created": "2023-07-17T20:07:53.610Z", "dataset": "github.audit", "id": "LwW2vpJZCDS-WUmo9Z-ifw", - "ingested": "2023-02-23T17:27:08Z", + "ingested": "2023-07-17T20:07:54Z", "kind": "event", "original": "{\"@timestamp\":1605719148837,\"_document_id\":\"LwW2vpJZCDS-WUmo9Z-ifw\",\"action\":\"repo.destroy\",\"actor\":\"monalisa\",\"created_at\":1605719148837,\"org\":\"mona-org\",\"repo\":\"mona-org/mona-test-repo\",\"visibility\":\"private\"}", "type": [ diff --git a/packages/github/data_stream/code_scanning/_dev/test/pipeline/test-ghas-code-scanning-json.log-expected.json b/packages/github/data_stream/code_scanning/_dev/test/pipeline/test-ghas-code-scanning-json.log-expected.json index ef6c2dd36c2..5df5163f439 100644 --- a/packages/github/data_stream/code_scanning/_dev/test/pipeline/test-ghas-code-scanning-json.log-expected.json +++ b/packages/github/data_stream/code_scanning/_dev/test/pipeline/test-ghas-code-scanning-json.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-13T12:29:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -80,7 +80,7 @@ { "@timestamp": "2020-02-13T12:29:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -168,7 +168,7 @@ { "@timestamp": "2022-06-29T18:03:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -236,7 +236,7 @@ { "@timestamp": "2022-07-07T17:10:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -317,7 +317,7 @@ { "@timestamp": "2022-06-29T18:03:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -385,7 +385,7 @@ { "@timestamp": "2022-06-29T18:03:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -453,7 +453,7 @@ { "@timestamp": "2022-08-01T23:53:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -520,7 +520,7 @@ { "@timestamp": "2022-08-01T23:53:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", @@ -601,7 +601,7 @@ { "@timestamp": "2022-08-01T23:53:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "code_scanning", diff --git a/packages/github/data_stream/code_scanning/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/code_scanning/elasticsearch/ingest_pipeline/default.yml index 279ad97c5fc..4374fa9feb5 100644 --- a/packages/github/data_stream/code_scanning/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/code_scanning/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing GitHub audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.action value: "code_scanning" diff --git a/packages/github/data_stream/code_scanning/manifest.yml b/packages/github/data_stream/code_scanning/manifest.yml index 9c94782a4d6..76f50bf3931 100644 --- a/packages/github/data_stream/code_scanning/manifest.yml +++ b/packages/github/data_stream/code_scanning/manifest.yml @@ -27,6 +27,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -37,7 +38,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. + description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 10m - name: api_url type: text diff --git a/packages/github/data_stream/code_scanning/sample_event.json b/packages/github/data_stream/code_scanning/sample_event.json index f77946e4be2..35ecff45069 100644 --- a/packages/github/data_stream/code_scanning/sample_event.json +++ b/packages/github/data_stream/code_scanning/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-06-29T18:03:27.000Z", "agent": { - "ephemeral_id": "f5851d69-1f67-451b-be80-a7a62f30df3b", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "43277076-e7e1-4818-97e4-9f70a909fb8d", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.code_scanning", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "code_scanning", "agent_id_status": "verified", "created": "2022-06-29T18:03:27.000Z", "dataset": "github.code_scanning", - "ingested": "2023-02-23T17:27:54Z", + "ingested": "2023-07-17T20:08:46Z", "kind": "alert", "original": "{\"created_at\":\"2022-06-29T18:03:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/code-scanning/91\",\"most_recent_instance\":{\"analysis_key\":\".github/workflows/codeql-analysis.yml:analyze\",\"category\":\".github/workflows/codeql-analysis.yml:analyze/language:javascript\",\"classifications\":[],\"commit_sha\":\"3244e8b15cc1b8f2732eecd69fc1890b737f0dda\",\"location\":{\"end_column\":50,\"end_line\":67,\"path\":\"routes/chatbot.ts\",\"start_column\":23,\"start_line\":67},\"message\":{\"text\":\"(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.\"},\"ref\":\"refs/heads/master\",\"state\":\"open\"},\"number\":90,\"rule\":{\"description\":\"SQL database query built from user-controlled sources (experimental)\",\"id\":\"js/ml-powered/sql-injection\",\"security_severity_level\":\"high\",\"severity\":\"error\",\"tags\":[\"experimental\",\"external/cwe/cwe-089\",\"security\"]},\"state\":\"open\",\"tool\":{\"name\":\"CodeQL\",\"version\":\"2.9.4\"},\"updated_at\":\"2022-06-29T18:03:27Z\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/code-scanning/alerts/91\"}" }, diff --git a/packages/github/data_stream/dependabot/_dev/test/pipeline/test-ghas-dependabot-json.log-expected.json b/packages/github/data_stream/dependabot/_dev/test/pipeline/test-ghas-dependabot-json.log-expected.json index 9bca5e6a004..f50ec6af127 100644 --- a/packages/github/data_stream/dependabot/_dev/test/pipeline/test-ghas-dependabot-json.log-expected.json +++ b/packages/github/data_stream/dependabot/_dev/test/pipeline/test-ghas-dependabot-json.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -110,7 +110,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -218,7 +218,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -330,7 +330,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -438,7 +438,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -527,7 +527,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -636,7 +636,7 @@ { "@timestamp": "2022-07-12T03:02:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", @@ -753,7 +753,7 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dependabot", diff --git a/packages/github/data_stream/dependabot/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/dependabot/elasticsearch/ingest_pipeline/default.yml index 04b43ae845c..8747d3f8d3a 100644 --- a/packages/github/data_stream/dependabot/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/dependabot/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing GitHub audit logs processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.action value: "dependabot" diff --git a/packages/github/data_stream/dependabot/fields/fields.yml b/packages/github/data_stream/dependabot/fields/fields.yml index 1e0910de72b..c4e603bb107 100644 --- a/packages/github/data_stream/dependabot/fields/fields.yml +++ b/packages/github/data_stream/dependabot/fields/fields.yml @@ -289,7 +289,7 @@ fields: - name: description - type: keyword + type: text description: > The description of the repository. diff --git a/packages/github/data_stream/dependabot/manifest.yml b/packages/github/data_stream/dependabot/manifest.yml index 2bc6f10ba63..b8c760c1081 100644 --- a/packages/github/data_stream/dependabot/manifest.yml +++ b/packages/github/data_stream/dependabot/manifest.yml @@ -27,6 +27,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -37,7 +38,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. + description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 10m - name: api_url type: text diff --git a/packages/github/data_stream/dependabot/sample_event.json b/packages/github/data_stream/dependabot/sample_event.json index b4168b0aaca..e4b96e2fa1d 100644 --- a/packages/github/data_stream/dependabot/sample_event.json +++ b/packages/github/data_stream/dependabot/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-07-11T11:39:07.000Z", "agent": { - "ephemeral_id": "e923b2a8-7ed8-4aa8-94a7-7f928b339241", - "id": "da8ad14f-576e-470c-a40d-15eda3748307", + "ephemeral_id": "be806890-bf40-4bea-8f53-b545e1f62668", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.8.2" }, "data_stream": { "dataset": "github.dependabot", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "da8ad14f-576e-470c-a40d-15eda3748307", - "snapshot": true, - "version": "8.8.0" + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "dependabot", "agent_id_status": "verified", "created": "2022-07-11T11:39:07.000Z", "dataset": "github.dependabot", - "ingested": "2023-04-27T10:01:15Z", + "ingested": "2023-07-17T20:09:41Z", "kind": "alert", "original": "{\"createdAt\":\"2022-07-11T11:39:07Z\",\"dependabotUpdate\":{\"error\":{\"body\":\"The currently installed version can't be determined.\\n\\nTo resolve the issue add a supported lockfile (package-lock.json or yarn.lock).\",\"errorType\":\"dependency_file_not_supported\",\"title\":\"Dependabot can't update vulnerable dependencies without a lockfile\"},\"pullRequest\":null},\"dependencyScope\":\"RUNTIME\",\"dismissReason\":null,\"dismissedAt\":null,\"dismisser\":null,\"fixedAt\":null,\"number\":1,\"repository\":{\"description\":\"OWASP Juice Shop: Probably the most modern and sophisticated insecure web application\",\"isInOrganization\":false,\"isPrivate\":false,\"name\":\"sample_repo\",\"owner\":{\"login\":\"sample_owner\",\"url\":\"https://github.com/sample_owner\"},\"url\":\"https://github.com/sample_owner/sample_repo\"},\"securityAdvisory\":{\"classification\":\"GENERAL\",\"cvss\":{\"score\":0,\"vectorString\":null},\"cwes\":{\"nodes\":[{\"cweId\":\"CWE-20\",\"description\":\"The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.\",\"name\":\"Improper Input Validation\"}]},\"description\":\"Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.\\n\\n\\n\\n\\n## Recommendation\\n\\nUpdate to version 4.2.2 or later.\",\"ghsaId\":\"GHSA-c7hr-j4mj-j2w6\",\"identifiers\":[{\"type\":\"GHSA\",\"value\":\"GHSA-c7hr-j4mj-j2w6\"},{\"type\":\"CVE\",\"value\":\"CVE-2015-9235\"}],\"origin\":\"UNSPECIFIED\",\"permalink\":\"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6\",\"publishedAt\":\"2018-10-09T00:38:30Z\",\"references\":[{\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2015-9235\"},{\"url\":\"https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687\"},{\"url\":\"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/\"},{\"url\":\"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6\"},{\"url\":\"https://www.npmjs.com/advisories/17\"},{\"url\":\"https://www.timmclean.net/2015/02/25/jwt-alg-none.html\"},{\"url\":\"https://nodesecurity.io/advisories/17\"}],\"severity\":\"CRITICAL\",\"summary\":\"Verification Bypass in jsonwebtoken\",\"updatedAt\":\"2021-01-08T19:00:39Z\",\"withdrawnAt\":null},\"securityVulnerability\":{\"firstPatchedVersion\":{\"identifier\":\"4.2.2\"},\"package\":{\"ecosystem\":\"NPM\",\"name\":\"jsonwebtoken\"},\"severity\":\"CRITICAL\",\"updatedAt\":\"2018-11-30T19:54:28Z\",\"vulnerableVersionRange\":\"\\u003c 4.2.2\"},\"state\":\"OPEN\",\"vulnerableManifestFilename\":\"package.json\",\"vulnerableManifestPath\":\"package.json\",\"vulnerableRequirements\":\"= 0.4.0\"}", "start": "2022-07-11T11:39:07Z" diff --git a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json index a46a11a82e9..973b032578a 100644 --- a/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json +++ b/packages/github/data_stream/issues/_dev/test/pipeline/test-github-issues-json.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "event", @@ -110,7 +110,7 @@ { "@timestamp": "2022-11-23T15:06:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "event", @@ -203,7 +203,7 @@ { "@timestamp": "2022-11-23T13:03:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "event", @@ -277,7 +277,7 @@ { "@timestamp": "2022-11-23T10:57:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "event", @@ -363,7 +363,7 @@ { "@timestamp": "2022-11-23T10:44:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "event", diff --git a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml index 58b58e36d8a..2e9a3af39b0 100644 --- a/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/issues/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing GitHub audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.action value: "event" diff --git a/packages/github/data_stream/issues/fields/fields.yml b/packages/github/data_stream/issues/fields/fields.yml index b695247e0ef..8c6a62d8055 100644 --- a/packages/github/data_stream/issues/fields/fields.yml +++ b/packages/github/data_stream/issues/fields/fields.yml @@ -81,12 +81,14 @@ - name: site_admin type: boolean - name: assignees - type: array - description: "Information of users who were assigned the issue\n \n" + type: flattened + description: > + Information of users who were assigned the issue + - name: labels - type: array + type: group description: > - Information of user who was assigned the issue + Information of labels assigned to the issue fields: - name: name diff --git a/packages/github/data_stream/issues/manifest.yml b/packages/github/data_stream/issues/manifest.yml index 1295875bedb..886e2092fd8 100644 --- a/packages/github/data_stream/issues/manifest.yml +++ b/packages/github/data_stream/issues/manifest.yml @@ -58,6 +58,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -68,7 +69,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. + description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 10m - name: api_url type: text diff --git a/packages/github/data_stream/issues/sample_event.json b/packages/github/data_stream/issues/sample_event.json index d89f56b52ab..14a09a7ab7b 100644 --- a/packages/github/data_stream/issues/sample_event.json +++ b/packages/github/data_stream/issues/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "65c36540-ba95-4866-b299-09bea561974f", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "4e1dee80-55cc-46a2-8b69-043e6fc581a7", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.issues", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "event", "agent_id_status": "verified", "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2023-02-23T17:29:38Z", + "ingested": "2023-07-17T20:10:35Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}" }, diff --git a/packages/github/data_stream/secret_scanning/_dev/test/pipeline/test-ghas-secret-scanning-json.log-expected.json b/packages/github/data_stream/secret_scanning/_dev/test/pipeline/test-ghas-secret-scanning-json.log-expected.json index 55ed86cf32f..9ba7696e057 100644 --- a/packages/github/data_stream/secret_scanning/_dev/test/pipeline/test-ghas-secret-scanning-json.log-expected.json +++ b/packages/github/data_stream/secret_scanning/_dev/test/pipeline/test-ghas-secret-scanning-json.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-11-07T02:47:13.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -65,7 +65,7 @@ { "@timestamp": "2020-11-06T18:18:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -103,7 +103,7 @@ { "@timestamp": "2022-07-07T12:56:24.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -152,7 +152,7 @@ { "@timestamp": "2022-07-07T12:54:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -191,7 +191,7 @@ { "@timestamp": "2022-07-07T12:48:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -230,7 +230,7 @@ { "@timestamp": "2022-07-07T10:52:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -269,7 +269,7 @@ { "@timestamp": "2022-07-07T12:45:43.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -322,7 +322,7 @@ { "@timestamp": "2022-07-07T09:47:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", @@ -361,7 +361,7 @@ { "@timestamp": "2022-07-07T10:13:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret_scanning", diff --git a/packages/github/data_stream/secret_scanning/elasticsearch/ingest_pipeline/default.yml b/packages/github/data_stream/secret_scanning/elasticsearch/ingest_pipeline/default.yml index 4a9c73e14ac..44bdb212b76 100644 --- a/packages/github/data_stream/secret_scanning/elasticsearch/ingest_pipeline/default.yml +++ b/packages/github/data_stream/secret_scanning/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing GitHub audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.action value: "secret_scanning" diff --git a/packages/github/data_stream/secret_scanning/manifest.yml b/packages/github/data_stream/secret_scanning/manifest.yml index 767165e233f..a74acf45cf3 100644 --- a/packages/github/data_stream/secret_scanning/manifest.yml +++ b/packages/github/data_stream/secret_scanning/manifest.yml @@ -27,6 +27,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -37,7 +38,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. + description: Interval at which the alerts will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 10m - name: hide_secret required: true diff --git a/packages/github/data_stream/secret_scanning/sample_event.json b/packages/github/data_stream/secret_scanning/sample_event.json index 9b95fc41f13..2bcb8d54db6 100644 --- a/packages/github/data_stream/secret_scanning/sample_event.json +++ b/packages/github/data_stream/secret_scanning/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-06-30T18:07:27.000Z", "agent": { - "ephemeral_id": "144198a9-4a8e-4b47-9102-402a7b3a1052", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "5054567d-5106-49d8-969d-3aa3e1c83063", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.secret_scanning", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "secret_scanning", "agent_id_status": "verified", "created": "2022-06-30T18:07:27Z", "dataset": "github.secret_scanning", - "ingested": "2023-02-23T17:30:34Z", + "ingested": "2023-07-17T20:11:28Z", "original": "{\"created_at\":\"2022-06-30T18:07:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/secret-scanning/3\",\"number\":3,\"push_protection_bypassed\":true,\"push_protection_bypassed_by\":{\"html_url\":\"https://github.com/sample_owner\",\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"resolution\":\"revoked\",\"resolved_by\":{\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"secret\":\"npm_2vYJ3QzGXoGbEgMYduYS1k2M4D0wDu2opJbl\",\"secret_type\":\"npm_access_token\",\"secret_type_display_name\":\"npm Access Token\",\"state\":\"open\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/secret-scanning/alerts/3\"}" }, "github": { diff --git a/packages/github/docs/README.md b/packages/github/docs/README.md index 2c57b3d8219..38625dc1dc4 100644 --- a/packages/github/docs/README.md +++ b/packages/github/docs/README.md @@ -28,18 +28,20 @@ To use this integration, the following prerequisites must be met: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | github.category | GitHub action category | keyword | | github.org | GitHub organization name | keyword | +| github.permission | GitHub user permissions for the event. | keyword | | github.repo | GitHub repository name | keyword | +| github.repository_public | Whether the GitHub repository is publicly visible. | boolean | | github.team | GitHub team name | keyword | | group.name | Name of the group. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -76,11 +78,11 @@ An example event for `audit` looks as following: { "@timestamp": "2020-11-18T17:05:48.837Z", "agent": { - "ephemeral_id": "b290281f-0eee-49e8-aafc-bb85d4d0c6c4", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "39fbfc30-ef11-4c8c-9b89-af6c312ba558", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.audit", @@ -88,12 +90,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "repo.destroy", @@ -102,10 +104,10 @@ An example event for `audit` looks as following: "configuration", "web" ], - "created": "2023-02-23T17:27:07.020Z", + "created": "2023-07-17T20:07:53.610Z", "dataset": "github.audit", "id": "LwW2vpJZCDS-WUmo9Z-ifw", - "ingested": "2023-02-23T17:27:08Z", + "ingested": "2023-07-17T20:07:54Z", "kind": "event", "original": "{\"@timestamp\":1605719148837,\"_document_id\":\"LwW2vpJZCDS-WUmo9Z-ifw\",\"action\":\"repo.destroy\",\"actor\":\"monalisa\",\"created_at\":1605719148837,\"org\":\"mona-org\",\"repo\":\"mona-org/mona-test-repo\",\"visibility\":\"private\"}", "type": [ @@ -155,9 +157,9 @@ Or use a personal access token with the `security_events` scope for private repo | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | | error.message | Error message. | match_only_text | | | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | | | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | | | event.dataset | Event dataset | constant_keyword | | | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | | | event.module | Event module | constant_keyword | | | | github.code_scanning.created_at | The time that the alert was created in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ` | date | | | | github.code_scanning.dismissed_at | The time that the alert was dismissed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ`. | date | | | @@ -246,11 +248,11 @@ An example event for `code_scanning` looks as following: { "@timestamp": "2022-06-29T18:03:27.000Z", "agent": { - "ephemeral_id": "f5851d69-1f67-451b-be80-a7a62f30df3b", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "43277076-e7e1-4818-97e4-9f70a909fb8d", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.code_scanning", @@ -258,19 +260,19 @@ An example event for `code_scanning` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "code_scanning", "agent_id_status": "verified", "created": "2022-06-29T18:03:27.000Z", "dataset": "github.code_scanning", - "ingested": "2023-02-23T17:27:54Z", + "ingested": "2023-07-17T20:08:46Z", "kind": "alert", "original": "{\"created_at\":\"2022-06-29T18:03:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/code-scanning/91\",\"most_recent_instance\":{\"analysis_key\":\".github/workflows/codeql-analysis.yml:analyze\",\"category\":\".github/workflows/codeql-analysis.yml:analyze/language:javascript\",\"classifications\":[],\"commit_sha\":\"3244e8b15cc1b8f2732eecd69fc1890b737f0dda\",\"location\":{\"end_column\":50,\"end_line\":67,\"path\":\"routes/chatbot.ts\",\"start_column\":23,\"start_line\":67},\"message\":{\"text\":\"(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.(Experimental) This may be a database query that depends on a user-provided value. Identified using machine learning.\"},\"ref\":\"refs/heads/master\",\"state\":\"open\"},\"number\":90,\"rule\":{\"description\":\"SQL database query built from user-controlled sources (experimental)\",\"id\":\"js/ml-powered/sql-injection\",\"security_severity_level\":\"high\",\"severity\":\"error\",\"tags\":[\"experimental\",\"external/cwe/cwe-089\",\"security\"]},\"state\":\"open\",\"tool\":{\"name\":\"CodeQL\",\"version\":\"2.9.4\"},\"updated_at\":\"2022-06-29T18:03:27Z\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/code-scanning/alerts/91\"}" }, @@ -354,7 +356,7 @@ Or you must be an administrator for the repository or for the organization that | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | | error.message | Error message. | match_only_text | | | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | | | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | | | event.dataset | Event dataset | constant_keyword | | | | event.module | Event module | constant_keyword | | | | github.repository.html_url | The URL to view the repository on GitHub.com. | keyword | | | @@ -423,11 +425,11 @@ An example event for `secret_scanning` looks as following: { "@timestamp": "2022-06-30T18:07:27.000Z", "agent": { - "ephemeral_id": "144198a9-4a8e-4b47-9102-402a7b3a1052", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "5054567d-5106-49d8-969d-3aa3e1c83063", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.secret_scanning", @@ -435,19 +437,19 @@ An example event for `secret_scanning` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "secret_scanning", "agent_id_status": "verified", "created": "2022-06-30T18:07:27Z", "dataset": "github.secret_scanning", - "ingested": "2023-02-23T17:30:34Z", + "ingested": "2023-07-17T20:11:28Z", "original": "{\"created_at\":\"2022-06-30T18:07:27Z\",\"html_url\":\"https://github.com/sample_owner/sample_repo/security/secret-scanning/3\",\"number\":3,\"push_protection_bypassed\":true,\"push_protection_bypassed_by\":{\"html_url\":\"https://github.com/sample_owner\",\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"resolution\":\"revoked\",\"resolved_by\":{\"login\":\"sample_owner\",\"type\":\"User\",\"url\":\"https://api.github.com/users/sample_owner\"},\"secret\":\"npm_2vYJ3QzGXoGbEgMYduYS1k2M4D0wDu2opJbl\",\"secret_type\":\"npm_access_token\",\"secret_type_display_name\":\"npm Access Token\",\"state\":\"open\",\"url\":\"https://api.github.com/repos/sample_owner/sample_repo/secret-scanning/alerts/3\"}" }, "github": { @@ -514,13 +516,13 @@ To use this integration, you must be an administrator for the repository or for | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | github.dependabot.created_at | When was the alert created | date | | github.dependabot.dependabot_update.error.body | The body of the error. | text | | github.dependabot.dependabot_update.error.error_type | The error code. | keyword | @@ -564,7 +566,7 @@ To use this integration, you must be an administrator for the repository or for | github.dependabot.vulnerable_manifest_filename | The vulnerable manifest filename. | keyword | | github.dependabot.vulnerable_manifest_path | The vulnerable manifest path. | keyword | | github.dependabot.vulnerable_requirements | The vulnerable requirements. | keyword | -| github.repository.description | The description of the repository. | keyword | +| github.repository.description | The description of the repository. | text | | github.repository.is_in_organization | Indicates if a repository is either owned by an organization, or is a private fork of an organization repository. | boolean | | github.repository.is_private | Identifies if the repository is private or internal. | boolean | | github.repository.name | Identifies if the repository is private or internal. | keyword | @@ -610,11 +612,11 @@ An example event for `dependabot` looks as following: { "@timestamp": "2022-07-11T11:39:07.000Z", "agent": { - "ephemeral_id": "e923b2a8-7ed8-4aa8-94a7-7f928b339241", - "id": "da8ad14f-576e-470c-a40d-15eda3748307", + "ephemeral_id": "be806890-bf40-4bea-8f53-b545e1f62668", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.8.2" }, "data_stream": { "dataset": "github.dependabot", @@ -622,19 +624,19 @@ An example event for `dependabot` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "da8ad14f-576e-470c-a40d-15eda3748307", - "snapshot": true, - "version": "8.8.0" + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "dependabot", "agent_id_status": "verified", "created": "2022-07-11T11:39:07.000Z", "dataset": "github.dependabot", - "ingested": "2023-04-27T10:01:15Z", + "ingested": "2023-07-17T20:09:41Z", "kind": "alert", "original": "{\"createdAt\":\"2022-07-11T11:39:07Z\",\"dependabotUpdate\":{\"error\":{\"body\":\"The currently installed version can't be determined.\\n\\nTo resolve the issue add a supported lockfile (package-lock.json or yarn.lock).\",\"errorType\":\"dependency_file_not_supported\",\"title\":\"Dependabot can't update vulnerable dependencies without a lockfile\"},\"pullRequest\":null},\"dependencyScope\":\"RUNTIME\",\"dismissReason\":null,\"dismissedAt\":null,\"dismisser\":null,\"fixedAt\":null,\"number\":1,\"repository\":{\"description\":\"OWASP Juice Shop: Probably the most modern and sophisticated insecure web application\",\"isInOrganization\":false,\"isPrivate\":false,\"name\":\"sample_repo\",\"owner\":{\"login\":\"sample_owner\",\"url\":\"https://github.com/sample_owner\"},\"url\":\"https://github.com/sample_owner/sample_repo\"},\"securityAdvisory\":{\"classification\":\"GENERAL\",\"cvss\":{\"score\":0,\"vectorString\":null},\"cwes\":{\"nodes\":[{\"cweId\":\"CWE-20\",\"description\":\"The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.\",\"name\":\"Improper Input Validation\"}]},\"description\":\"Versions 4.2.1 and earlier of `jsonwebtoken` are affected by a verification bypass vulnerability. This is a result of weak validation of the JWT algorithm type, occuring when an attacker is allowed to arbitrarily specify the JWT algorithm.\\n\\n\\n\\n\\n## Recommendation\\n\\nUpdate to version 4.2.2 or later.\",\"ghsaId\":\"GHSA-c7hr-j4mj-j2w6\",\"identifiers\":[{\"type\":\"GHSA\",\"value\":\"GHSA-c7hr-j4mj-j2w6\"},{\"type\":\"CVE\",\"value\":\"CVE-2015-9235\"}],\"origin\":\"UNSPECIFIED\",\"permalink\":\"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6\",\"publishedAt\":\"2018-10-09T00:38:30Z\",\"references\":[{\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2015-9235\"},{\"url\":\"https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687\"},{\"url\":\"https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/\"},{\"url\":\"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6\"},{\"url\":\"https://www.npmjs.com/advisories/17\"},{\"url\":\"https://www.timmclean.net/2015/02/25/jwt-alg-none.html\"},{\"url\":\"https://nodesecurity.io/advisories/17\"}],\"severity\":\"CRITICAL\",\"summary\":\"Verification Bypass in jsonwebtoken\",\"updatedAt\":\"2021-01-08T19:00:39Z\",\"withdrawnAt\":null},\"securityVulnerability\":{\"firstPatchedVersion\":{\"identifier\":\"4.2.2\"},\"package\":{\"ecosystem\":\"NPM\",\"name\":\"jsonwebtoken\"},\"severity\":\"CRITICAL\",\"updatedAt\":\"2018-11-30T19:54:28Z\",\"vulnerableVersionRange\":\"\\u003c 4.2.2\"},\"state\":\"OPEN\",\"vulnerableManifestFilename\":\"package.json\",\"vulnerableManifestPath\":\"package.json\",\"vulnerableRequirements\":\"= 0.4.0\"}", "start": "2022-07-11T11:39:07Z" @@ -760,9 +762,9 @@ To use this integration, users must use Github Apps or Personal Access Token wit | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | | | error.message | Error message. | match_only_text | | | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | | | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | | | event.dataset | Event dataset | constant_keyword | | | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | | | event.module | Event module | constant_keyword | | | | github.issues.active_lock_reason | | keyword | | | | github.issues.assignee.email | | keyword | | | @@ -773,7 +775,7 @@ To use this integration, users must use Github Apps or Personal Access Token wit | github.issues.assignee.site_admin | | boolean | | | | github.issues.assignee.type | | keyword | | | | github.issues.assignee.url | | keyword | | | -| github.issues.assignees | Information of users who were assigned the issue | array | | | +| github.issues.assignees | Information of users who were assigned the issue | flattened | | | | github.issues.author_association | | keyword | | | | github.issues.body | | text | | | | github.issues.closed_at | The time that the issue was closed in ISO 8601 format: `YYYY-MM-DDTHH:MM:SSZ` | date | | | @@ -860,11 +862,11 @@ An example event for `issues` looks as following: { "@timestamp": "2011-04-22T13:33:48.000Z", "agent": { - "ephemeral_id": "65c36540-ba95-4866-b299-09bea561974f", - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "ephemeral_id": "4e1dee80-55cc-46a2-8b69-043e6fc581a7", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.3" + "version": "8.8.2" }, "data_stream": { "dataset": "github.issues", @@ -872,19 +874,19 @@ An example event for `issues` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a16136da-2b7a-4bd4-b3bf-996e86e74a2e", + "id": "be3f80ae-4090-4151-99c4-6a6454fd8148", "snapshot": false, - "version": "8.4.3" + "version": "8.8.2" }, "event": { "action": "event", "agent_id_status": "verified", "created": "2011-04-22T13:33:48.000Z", "dataset": "github.issues", - "ingested": "2023-02-23T17:29:38Z", + "ingested": "2023-07-17T20:10:35Z", "kind": "event", "original": "{\"active_lock_reason\":\"too heated\",\"assignee\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"assignees\":[{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}],\"author_association\":\"COLLABORATOR\",\"body\":\"I'm having a problem with this.\",\"closed_at\":null,\"closed_by\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"comments\":0,\"comments_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/comments\",\"created_at\":\"2011-04-22T13:33:48Z\",\"events_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/events\",\"html_url\":\"https://github.com/octocat/Hello-World/issues/1347\",\"id\":1,\"labels\":[{\"color\":\"f29513\",\"default\":true,\"description\":\"Something isn't working\",\"id\":208045946,\"name\":\"bug\",\"node_id\":\"MDU6TGFiZWwyMDgwNDU5NDY=\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/labels/bug\"}],\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347/labels{/name}\",\"locked\":true,\"milestone\":{\"closed_at\":\"2013-02-12T13:22:01Z\",\"closed_issues\":8,\"created_at\":\"2011-04-10T20:09:31Z\",\"creator\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"},\"description\":\"Tracking milestone for version 1.0\",\"due_on\":\"2012-10-09T23:39:01Z\",\"html_url\":\"https://github.com/octocat/Hello-World/milestones/v1.0\",\"id\":1002604,\"labels_url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1/labels\",\"node_id\":\"MDk6TWlsZXN0b25lMTAwMjYwNA==\",\"number\":1,\"open_issues\":4,\"state\":\"open\",\"title\":\"v1.0\",\"updated_at\":\"2014-03-03T18:58:10Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/milestones/1\"},\"node_id\":\"MDU6SXNzdWUx\",\"number\":1347,\"pull_request\":{\"diff_url\":\"https://github.com/octocat/Hello-World/pull/1347.diff\",\"html_url\":\"https://github.com/octocat/Hello-World/pull/1347\",\"patch_url\":\"https://github.com/octocat/Hello-World/pull/1347.patch\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/pulls/1347\"},\"repository_url\":\"https://api.github.com/repos/octocat/Hello-World\",\"state\":\"open\",\"state_reason\":\"completed\",\"title\":\"Found a bug\",\"updated_at\":\"2011-04-22T13:33:48Z\",\"url\":\"https://api.github.com/repos/octocat/Hello-World/issues/1347\",\"user\":{\"avatar_url\":\"https://github.com/images/error/octocat_happy.gif\",\"events_url\":\"https://api.github.com/users/octocat/events{/privacy}\",\"followers_url\":\"https://api.github.com/users/octocat/followers\",\"following_url\":\"https://api.github.com/users/octocat/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/octocat/gists{/gist_id}\",\"gravatar_id\":\"\",\"html_url\":\"https://github.com/octocat\",\"id\":1,\"login\":\"octocat\",\"node_id\":\"MDQ6VXNlcjE=\",\"organizations_url\":\"https://api.github.com/users/octocat/orgs\",\"received_events_url\":\"https://api.github.com/users/octocat/received_events\",\"repos_url\":\"https://api.github.com/users/octocat/repos\",\"site_admin\":false,\"starred_url\":\"https://api.github.com/users/octocat/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/octocat/subscriptions\",\"type\":\"User\",\"url\":\"https://api.github.com/users/octocat\"}}" }, diff --git a/packages/github/kibana/dashboard/github-4da91aa0-12fc-11ed-af77-016e1a977d80.json b/packages/github/kibana/dashboard/github-4da91aa0-12fc-11ed-af77-016e1a977d80.json index 10d04c87796..f863b8dfd5a 100644 --- a/packages/github/kibana/dashboard/github-4da91aa0-12fc-11ed-af77-016e1a977d80.json +++ b/packages/github/kibana/dashboard/github-4da91aa0-12fc-11ed-af77-016e1a977d80.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"93a8183f-ab74-4636-9f63-9e30c35bfa6b\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.owner.login\",\"title\":\"Owner/Organization\",\"id\":\"93a8183f-ab74-4636-9f63-9e30c35bfa6b\",\"enhancements\":{}}},\"965171e3-e02b-49ff-a2f7-6ddfa5159eee\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.name\",\"title\":\"Repository\",\"id\":\"965171e3-e02b-49ff-a2f7-6ddfa5159eee\",\"enhancements\":{}}},\"8fb8d319-c120-4bcb-849d-6d45f3f5406a\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.state\",\"title\":\"State\",\"id\":\"8fb8d319-c120-4bcb-849d-6d45f3f5406a\",\"enhancements\":{}}},\"3d506940-8d8f-4f4f-8fa8-5ac070d1dc36\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.severity\",\"title\":\"Severity\",\"id\":\"3d506940-8d8f-4f4f-8fa8-5ac070d1dc36\",\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -49,6 +48,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -71,7 +71,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f8b858f-a1ee-4d69-a100-d59282acd94d": { "columnOrder": [ @@ -139,7 +139,7 @@ } }, "title": "Total Alerts Created [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -152,7 +152,7 @@ }, "panelIndex": "dc15f49d-29b1-4e2e-8787-51ffbab5b4ac", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -172,7 +172,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -307,7 +307,7 @@ } }, "title": "Alerts Found/Fixed Ratio [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -321,7 +321,7 @@ }, "panelIndex": "85cbbb74-4d3c-44e0-98f6-be076e31aea3", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -341,7 +341,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cbc5557e-f6b9-4140-90b2-3100f33083c4": { "columnOrder": [ @@ -420,16 +420,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.54, - "groups": [ - "3ef214a7-820c-42e3-b2b0-5daa7566fedc" - ], "layerId": "cbc5557e-f6b9-4140-90b2-3100f33083c4", "layerType": "data", "legendDisplay": "show", "legendPosition": "right", - "metric": "4525c4ae-5f82-4b4d-9867-48e4aba462fd", + "metrics": [ + "4525c4ae-5f82-4b4d-9867-48e4aba462fd" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "3ef214a7-820c-42e3-b2b0-5daa7566fedc" + ], "truncateLegend": true } ], @@ -454,7 +456,7 @@ }, "panelIndex": "1b501988-f932-4d80-8625-d2a1c8cd7321", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -479,7 +481,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -617,7 +619,7 @@ } }, "title": "Open Alerts Count [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -630,7 +632,7 @@ }, "panelIndex": "12c18b92-9f7b-4832-b85f-aad64720ea87", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -655,7 +657,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -735,7 +737,7 @@ } }, "title": "Mean Time to Resolution [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -750,7 +752,7 @@ "panelIndex": "7131e4d3-c168-480d-9496-1463ceaaa97a", "title": "Mean Time To Resolution [GitHub Code Scanning]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -775,7 +777,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -928,7 +930,7 @@ } }, "title": "Resolved/Dismissed Alerts Count [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -942,7 +944,7 @@ }, "panelIndex": "c3e8ea64-b6f9-470c-9004-02f8909672eb", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -962,7 +964,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d8a21374-4117-4796-96e2-ecd47f2babd2": { "columnOrder": [ @@ -1086,7 +1088,7 @@ } }, "title": "Alert/Commit Ratio [GitHub Code Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -1099,7 +1101,7 @@ }, "panelIndex": "46dc58eb-4994-442d-a6b4-4b3699b74bf1", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1119,7 +1121,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2592c6ef-cf07-4080-b4fe-014cc142e3c8": { "columnOrder": [ @@ -1305,7 +1307,7 @@ }, "panelIndex": "9a3577e8-d452-46cc-b2dd-9424ec80c871", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1325,7 +1327,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91e1a389-34e8-4332-9dbb-bd883d71dd85": { "columnOrder": [ @@ -1432,16 +1434,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", - "8cca4d83-a822-4b67-97cd-27649e1d7c68" - ], "layerId": "91e1a389-34e8-4332-9dbb-bd883d71dd85", "layerType": "data", "legendDisplay": "default", - "metric": "c53bee8d-06ca-4728-b6bc-2761d77a9ef5", + "metrics": [ + "c53bee8d-06ca-4728-b6bc-2761d77a9ef5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", + "8cca4d83-a822-4b67-97cd-27649e1d7c68" + ] } ], "shape": "pie" @@ -1463,7 +1467,7 @@ "panelIndex": "ae814e70-2e8e-43df-b62e-e32d1c26f676", "title": "Alerts % by owner and by repository [GitHub Code Scanning]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1483,7 +1487,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1621,7 +1625,7 @@ "panelIndex": "4e77167a-4642-4cbb-8430-2197e2f31666", "title": "Tool Contribution [GitHub Code Scanning]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1641,7 +1645,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1719,17 +1723,19 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "257a7d8d-1315-4775-97d9-e679c0f3aa79" - ], "layerId": "631035e6-8678-47ee-9a8c-c6a87f6c1757", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 2, "legendPosition": "right", - "metric": "e1d8072b-7268-444a-864e-ef1117b17b65", + "metrics": [ + "e1d8072b-7268-444a-864e-ef1117b17b65" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "257a7d8d-1315-4775-97d9-e679c0f3aa79" + ], "truncateLegend": true } ], @@ -1750,7 +1756,7 @@ }, "panelIndex": "5135da2a-0093-4b71-a35a-c2b8877d22dd", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1770,7 +1776,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1922,7 +1928,7 @@ }, "panelIndex": "7a3f8c53-407b-4862-9dc3-10dccfe06426", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1942,7 +1948,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "04d54e71-2f6e-462a-8858-74d8668335df": { "columnOrder": [ @@ -2082,7 +2088,7 @@ }, "panelIndex": "9653b170-7606-461f-9ac4-bf58547f30db", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2102,7 +2108,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "04d54e71-2f6e-462a-8858-74d8668335df": { "columnOrder": [ @@ -2183,16 +2189,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "713d9fda-d630-485d-b2af-f6aa22ea7a71" - ], "layerId": "04d54e71-2f6e-462a-8858-74d8668335df", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 1, - "metric": "21ef31d9-60e5-4fe1-8767-950697790bab", + "metrics": [ + "21ef31d9-60e5-4fe1-8767-950697790bab" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "713d9fda-d630-485d-b2af-f6aa22ea7a71" + ] } ], "palette": { @@ -2217,7 +2225,7 @@ }, "panelIndex": "563a073c-7de0-4095-b0ac-127caed562f2", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2237,7 +2245,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -2390,7 +2398,7 @@ }, "panelIndex": "d5326dec-bbfa-4a0c-b820-f6d915d5a9c5", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2410,7 +2418,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "04d54e71-2f6e-462a-8858-74d8668335df": { "columnOrder": [ @@ -2548,7 +2556,7 @@ }, "panelIndex": "c8b71fb6-3611-4788-a05f-fc9336b277f5", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2568,7 +2576,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5a3e567-da48-48df-902a-28bb45019016": { "columnOrder": [ @@ -2704,7 +2712,7 @@ }, "panelIndex": "26c79a62-100e-4eb4-b878-621e2be8570d", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2724,7 +2732,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "17dc082e-1cb5-4483-901a-9c220d911bac": { "columnOrder": [ @@ -2858,7 +2866,7 @@ }, "panelIndex": "41578b87-d820-42df-92d5-69af2643d793", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2878,7 +2886,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2321cd3f-039b-44be-90a5-03028195d49e": { "columnOrder": [ @@ -3008,7 +3016,7 @@ }, "panelIndex": "4f4ecefc-738e-4b86-8013-4b78bcb6d79b", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -3028,7 +3036,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ebd4f001-671a-4772-a2c4-b07f94e34845": { "columnOrder": [ @@ -3150,17 +3158,18 @@ }, "panelIndex": "234754b7-9ffa-44b0-b7f7-7ed6ec6a6d32", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] Code Scanning Alerts", "version": 1 }, - "coreMigrationVersion": "8.4.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:35:24.333Z", "id": "github-4da91aa0-12fc-11ed-af77-016e1a977d80", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/github/kibana/dashboard/github-591d69e0-17b6-11ed-809a-7b4be950fe9c.json b/packages/github/kibana/dashboard/github-591d69e0-17b6-11ed-809a-7b4be950fe9c.json index 96459148280..dcddc767945 100644 --- a/packages/github/kibana/dashboard/github-591d69e0-17b6-11ed-809a-7b4be950fe9c.json +++ b/packages/github/kibana/dashboard/github-591d69e0-17b6-11ed-809a-7b4be950fe9c.json @@ -71,7 +71,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f8b858f-a1ee-4d69-a100-d59282acd94d": { "columnOrder": [ @@ -139,9 +139,10 @@ } }, "title": "Total Secrets Found [GitHub Secret Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 5, @@ -152,7 +153,7 @@ }, "panelIndex": "77e597be-8cdc-4fa3-9dee-4e4ed1103e55", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -172,7 +173,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -307,9 +308,10 @@ } }, "title": "Secrets Found/Fixed Ratio [GitHub Secret Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 5, @@ -320,7 +322,7 @@ }, "panelIndex": "277a4af7-61c6-40d9-80a6-2d73df097618", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -340,7 +342,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cbc5557e-f6b9-4140-90b2-3100f33083c4": { "columnOrder": [ @@ -427,16 +429,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "3ef214a7-820c-42e3-b2b0-5daa7566fedc" - ], "layerId": "cbc5557e-f6b9-4140-90b2-3100f33083c4", "layerType": "data", "legendDisplay": "show", "legendPosition": "right", - "metric": "4525c4ae-5f82-4b4d-9867-48e4aba462fd", + "metrics": [ + "4525c4ae-5f82-4b4d-9867-48e4aba462fd" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "3ef214a7-820c-42e3-b2b0-5daa7566fedc" + ], "truncateLegend": true } ], @@ -450,7 +454,8 @@ "title": "Open vs Fixed/Resolved Secrets[GitHub Secret Scanning]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -461,7 +466,7 @@ }, "panelIndex": "51a087d0-9c56-4047-9404-b4b7b37497b0", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -486,7 +491,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -624,9 +629,10 @@ } }, "title": "Open Secrets Count [GitHub Secret Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 5, @@ -637,7 +643,7 @@ }, "panelIndex": "3c9e482b-4cd2-43e2-a1aa-5a6d66050c16", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -662,7 +668,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -742,9 +748,10 @@ } }, "title": "Mean Time to Resolution [GitHub Secret Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 10, @@ -755,7 +762,7 @@ }, "panelIndex": "e6cb0087-c5ba-49f2-8ae9-b206d2346609", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -780,7 +787,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -933,9 +940,10 @@ } }, "title": "Fixed Secrets Count [GitHub Secret Scanning]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 5, @@ -946,7 +954,7 @@ }, "panelIndex": "892ed6dd-afe7-4685-bebb-5f1a70b44692", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -966,7 +974,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2592c6ef-cf07-4080-b4fe-014cc142e3c8": { "columnOrder": [ @@ -1141,7 +1149,8 @@ "title": "Found Secrets count by owner and by repository [GitHub Secret Scanning]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 12, @@ -1152,7 +1161,7 @@ }, "panelIndex": "429f2ded-1aca-42cd-9190-9afddb03eabf", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -1172,7 +1181,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91e1a389-34e8-4332-9dbb-bd883d71dd85": { "columnOrder": [ @@ -1279,16 +1288,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", - "8cca4d83-a822-4b67-97cd-27649e1d7c68" - ], "layerId": "91e1a389-34e8-4332-9dbb-bd883d71dd85", "layerType": "data", "legendDisplay": "default", - "metric": "c53bee8d-06ca-4728-b6bc-2761d77a9ef5", + "metrics": [ + "c53bee8d-06ca-4728-b6bc-2761d77a9ef5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", + "8cca4d83-a822-4b67-97cd-27649e1d7c68" + ] } ], "shape": "pie" @@ -1297,7 +1308,8 @@ "title": "Found Secrets % by owner and by repository [GitHub Secret Scanning]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 12, @@ -1308,7 +1320,7 @@ }, "panelIndex": "a7adc099-113f-4113-b592-24b5ceff484e", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -1333,7 +1345,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1487,7 +1499,8 @@ "title": "Open Secrets Count by Type [GitHub Secret Scanning]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 13, @@ -1498,7 +1511,7 @@ }, "panelIndex": "883397dd-0064-48f2-b257-c8ed4295b0b9", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -1523,7 +1536,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1631,17 +1644,19 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "257a7d8d-1315-4775-97d9-e679c0f3aa79" - ], "layerId": "631035e6-8678-47ee-9a8c-c6a87f6c1757", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 5, "legendPosition": "right", - "metric": "e1d8072b-7268-444a-864e-ef1117b17b65", + "metrics": [ + "e1d8072b-7268-444a-864e-ef1117b17b65" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "257a7d8d-1315-4775-97d9-e679c0f3aa79" + ], "truncateLegend": true } ], @@ -1651,7 +1666,8 @@ "title": "Open Secrets % by Type [GitHub Secret Scanning]", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 13, @@ -1662,7 +1678,7 @@ }, "panelIndex": "d0ec4a50-b9da-4775-9f64-5389f898aee3", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -1687,7 +1703,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "725aa594-f41c-4b3e-a6cf-8c115b602f57": { "columnOrder": [ @@ -1980,7 +1996,8 @@ "title": "Fixed Secrets [GitHub Secret Scanning]", "visualizationType": "lnsDatatable" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 15, @@ -1991,7 +2008,7 @@ }, "panelIndex": "7cccdf3a-7c20-4bb6-8adb-3b2d83c7a0b8", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -2016,7 +2033,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "725aa594-f41c-4b3e-a6cf-8c115b602f57": { "columnOrder": [ @@ -2262,7 +2279,8 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": false, + "type": "lens" }, "gridData": { "h": 15, @@ -2273,7 +2291,7 @@ }, "panelIndex": "991aa388-e5d6-469b-911a-1cbcd1b84417", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -2293,7 +2311,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2321cd3f-039b-44be-90a5-03028195d49e": { "columnOrder": [ @@ -2420,7 +2438,8 @@ "title": "Top users resolving secrets [GitHub Secret Scanning]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 11, @@ -2431,7 +2450,7 @@ }, "panelIndex": "ff2747ad-ec9c-44a5-b8f9-9347be86c98b", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" }, { "embeddableConfig": { @@ -2451,7 +2470,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ebd4f001-671a-4772-a2c4-b07f94e34845": { "columnOrder": [ @@ -2562,7 +2581,8 @@ "title": "Events Timeline [GitHub Secret Scanning]", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "type": "lens" }, "gridData": { "h": 11, @@ -2573,17 +2593,18 @@ }, "panelIndex": "36cee00b-70b3-4bb5-a4b3-2448061135f8", "type": "lens", - "version": "8.3.0" + "version": "8.7.0" } ], "timeRestore": false, "title": "[GitHub] Secret Scanning Alerts", "version": 1 }, - "coreMigrationVersion": "8.4.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:33:52.035Z", "id": "github-591d69e0-17b6-11ed-809a-7b4be950fe9c", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/github/kibana/dashboard/github-6197be80-220c-11ed-88c4-e3caca48250a.json b/packages/github/kibana/dashboard/github-6197be80-220c-11ed-88c4-e3caca48250a.json index e3240769f3a..1661ac30ed5 100644 --- a/packages/github/kibana/dashboard/github-6197be80-220c-11ed-88c4-e3caca48250a.json +++ b/packages/github/kibana/dashboard/github-6197be80-220c-11ed-88c4-e3caca48250a.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"2132f9ab-9cce-423a-beed-e02e6d4d5ed9\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.state\",\"title\":\"State\",\"id\":\"2132f9ab-9cce-423a-beed-e02e6d4d5ed9\",\"enhancements\":{},\"selectedOptions\":[]}},\"2f1b6c0b-96fc-479a-b7ef-145c84df585e\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.severity\",\"title\":\"Severity\",\"id\":\"2f1b6c0b-96fc-479a-b7ef-145c84df585e\",\"enhancements\":{},\"selectedOptions\":[]}},\"91415c25-696a-4928-92e3-2c578e14c7a3\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.owner.login\",\"title\":\"Owner/Organization\",\"id\":\"91415c25-696a-4928-92e3-2c578e14c7a3\",\"enhancements\":{}}},\"a1e7b5ed-b636-4db8-87e1-779863061f45\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.name\",\"title\":\"Repository\",\"id\":\"a1e7b5ed-b636-4db8-87e1-779863061f45\",\"enhancements\":{},\"selectedOptions\":[]}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -49,6 +48,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -71,7 +71,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f8b858f-a1ee-4d69-a100-d59282acd94d": { "columnOrder": [ @@ -139,7 +139,7 @@ } }, "title": "Total Alerts Created [GitHub Dependabot]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -152,7 +152,7 @@ }, "panelIndex": "a7d99fc1-400a-4e55-8bbb-76d9aad7eedc", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -172,7 +172,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -307,7 +307,7 @@ } }, "title": "Alerts Found/Fixed Ratio [GitHub Dependabot]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -321,7 +321,7 @@ }, "panelIndex": "85cbbb74-4d3c-44e0-98f6-be076e31aea3", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -341,7 +341,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cbc5557e-f6b9-4140-90b2-3100f33083c4": { "columnOrder": [ @@ -421,16 +421,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.54, - "groups": [ - "3ef214a7-820c-42e3-b2b0-5daa7566fedc" - ], "layerId": "cbc5557e-f6b9-4140-90b2-3100f33083c4", "layerType": "data", "legendDisplay": "show", "legendPosition": "right", - "metric": "4525c4ae-5f82-4b4d-9867-48e4aba462fd", + "metrics": [ + "4525c4ae-5f82-4b4d-9867-48e4aba462fd" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "3ef214a7-820c-42e3-b2b0-5daa7566fedc" + ], "truncateLegend": true } ], @@ -455,7 +457,7 @@ }, "panelIndex": "1b501988-f932-4d80-8625-d2a1c8cd7321", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -480,7 +482,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -625,7 +627,7 @@ } }, "title": "Open Alerts Count [GitHub Dependabot]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -638,7 +640,7 @@ }, "panelIndex": "12c18b92-9f7b-4832-b85f-aad64720ea87", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -663,7 +665,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -816,7 +818,7 @@ } }, "title": "Resolved/Dismissed Alerts Count [GitHub Dependabot]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -830,7 +832,7 @@ }, "panelIndex": "c3e8ea64-b6f9-470c-9004-02f8909672eb", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -855,7 +857,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -935,7 +937,7 @@ } }, "title": "Mean Time to Resolution [GitHub Dependabot]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -950,7 +952,7 @@ "panelIndex": "7131e4d3-c168-480d-9496-1463ceaaa97a", "title": "Mean Time To Resolution [GitHub Dependabot]", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -970,7 +972,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2592c6ef-cf07-4080-b4fe-014cc142e3c8": { "columnOrder": [ @@ -1156,7 +1158,7 @@ }, "panelIndex": "9a3577e8-d452-46cc-b2dd-9424ec80c871", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1176,7 +1178,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91e1a389-34e8-4332-9dbb-bd883d71dd85": { "columnOrder": [ @@ -1283,16 +1285,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", - "8cca4d83-a822-4b67-97cd-27649e1d7c68" - ], "layerId": "91e1a389-34e8-4332-9dbb-bd883d71dd85", "layerType": "data", "legendDisplay": "default", - "metric": "c53bee8d-06ca-4728-b6bc-2761d77a9ef5", + "metrics": [ + "c53bee8d-06ca-4728-b6bc-2761d77a9ef5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", + "8cca4d83-a822-4b67-97cd-27649e1d7c68" + ] } ], "shape": "pie" @@ -1313,7 +1317,7 @@ }, "panelIndex": "ae814e70-2e8e-43df-b62e-e32d1c26f676", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1333,7 +1337,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "04d54e71-2f6e-462a-8858-74d8668335df": { "columnOrder": [ @@ -1473,7 +1477,7 @@ }, "panelIndex": "9653b170-7606-461f-9ac4-bf58547f30db", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1493,7 +1497,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "04d54e71-2f6e-462a-8858-74d8668335df": { "columnOrder": [ @@ -1574,16 +1578,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "713d9fda-d630-485d-b2af-f6aa22ea7a71" - ], "layerId": "04d54e71-2f6e-462a-8858-74d8668335df", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 1, - "metric": "21ef31d9-60e5-4fe1-8767-950697790bab", + "metrics": [ + "21ef31d9-60e5-4fe1-8767-950697790bab" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "713d9fda-d630-485d-b2af-f6aa22ea7a71" + ] } ], "palette": { @@ -1608,7 +1614,7 @@ }, "panelIndex": "563a073c-7de0-4095-b0ac-127caed562f2", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1628,7 +1634,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1781,7 +1787,7 @@ }, "panelIndex": "d5326dec-bbfa-4a0c-b820-f6d915d5a9c5", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1801,7 +1807,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "17dc082e-1cb5-4483-901a-9c220d911bac": { "columnOrder": [ @@ -1936,7 +1942,7 @@ }, "panelIndex": "41578b87-d820-42df-92d5-69af2643d793", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1956,7 +1962,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2321cd3f-039b-44be-90a5-03028195d49e": { "columnOrder": [ @@ -2087,7 +2093,7 @@ }, "panelIndex": "4f4ecefc-738e-4b86-8013-4b78bcb6d79b", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2107,7 +2113,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ebd4f001-671a-4772-a2c4-b07f94e34845": { "columnOrder": [ @@ -2229,17 +2235,18 @@ }, "panelIndex": "12673c47-9148-47a4-a8ab-07a7f06304c7", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] Dependabot Alerts", "version": 1 }, - "coreMigrationVersion": "8.4.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:36:35.072Z", "id": "github-6197be80-220c-11ed-88c4-e3caca48250a", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { @@ -2247,111 +2254,6 @@ "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" }, - { - "id": "logs-*", - "name": "85cbbb74-4d3c-44e0-98f6-be076e31aea3:indexpattern-datasource-layer-df5f2c10-bc9b-4a7e-be41-d13240c21d95", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "85cbbb74-4d3c-44e0-98f6-be076e31aea3:bff2e3f5-8f9b-49f4-ba88-b0e937089c2f", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "85cbbb74-4d3c-44e0-98f6-be076e31aea3:960abe90-416f-4075-aaef-2cc0a3af1707", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3e8ea64-b6f9-470c-9004-02f8909672eb:indexpattern-datasource-layer-df5f2c10-bc9b-4a7e-be41-d13240c21d95", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3e8ea64-b6f9-470c-9004-02f8909672eb:17e2088a-3bc2-4868-bc76-7cf83644301c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3e8ea64-b6f9-470c-9004-02f8909672eb:ba32e691-eaea-469b-8dd5-3aeb2fbc2cd7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7131e4d3-c168-480d-9496-1463ceaaa97a:indexpattern-datasource-layer-df5f2c10-bc9b-4a7e-be41-d13240c21d95", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7131e4d3-c168-480d-9496-1463ceaaa97a:dd40a269-9585-4d63-ad58-7a70f2bf3cfc", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7131e4d3-c168-480d-9496-1463ceaaa97a:0922f2e7-6ee9-45a2-baa6-42dde24c181d", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9a3577e8-d452-46cc-b2dd-9424ec80c871:indexpattern-datasource-layer-2592c6ef-cf07-4080-b4fe-014cc142e3c8", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ae814e70-2e8e-43df-b62e-e32d1c26f676:indexpattern-datasource-layer-91e1a389-34e8-4332-9dbb-bd883d71dd85", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9653b170-7606-461f-9ac4-bf58547f30db:indexpattern-datasource-layer-04d54e71-2f6e-462a-8858-74d8668335df", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "9653b170-7606-461f-9ac4-bf58547f30db:6ff40899-6691-449c-afa9-e266b9f272f6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "563a073c-7de0-4095-b0ac-127caed562f2:indexpattern-datasource-layer-04d54e71-2f6e-462a-8858-74d8668335df", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "563a073c-7de0-4095-b0ac-127caed562f2:351f20af-163e-47d3-831f-f02b469287b3", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d5326dec-bbfa-4a0c-b820-f6d915d5a9c5:indexpattern-datasource-layer-631035e6-8678-47ee-9a8c-c6a87f6c1757", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d5326dec-bbfa-4a0c-b820-f6d915d5a9c5:a9c37a5a-574a-411d-9420-2e53045288f3", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_2132f9ab-9cce-423a-beed-e02e6d4d5ed9:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_2f1b6c0b-96fc-479a-b7ef-145c84df585e:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_91415c25-696a-4928-92e3-2c578e14c7a3:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_a1e7b5ed-b636-4db8-87e1-779863061f45:optionsListDataView", - "type": "index-pattern" - }, { "id": "logs-*", "name": "a7d99fc1-400a-4e55-8bbb-76d9aad7eedc:indexpattern-datasource-layer-3f8b858f-a1ee-4d69-a100-d59282acd94d", @@ -2506,6 +2408,26 @@ "id": "logs-*", "name": "12673c47-9148-47a4-a8ab-07a7f06304c7:349014a7-1097-4c4b-9805-13b39d46d0bd", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2132f9ab-9cce-423a-beed-e02e6d4d5ed9:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2f1b6c0b-96fc-479a-b7ef-145c84df585e:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_91415c25-696a-4928-92e3-2c578e14c7a3:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_a1e7b5ed-b636-4db8-87e1-779863061f45:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/github/kibana/dashboard/github-6a6d7c40-17ab-11ed-809a-7b4be950fe9c.json b/packages/github/kibana/dashboard/github-6a6d7c40-17ab-11ed-809a-7b4be950fe9c.json index d41423c1065..ee27defaac5 100644 --- a/packages/github/kibana/dashboard/github-6a6d7c40-17ab-11ed-809a-7b4be950fe9c.json +++ b/packages/github/kibana/dashboard/github-6a6d7c40-17ab-11ed-809a-7b4be950fe9c.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"2b7c10cd-1a6d-4dff-8cf9-848904b101d7\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.owner.login\",\"title\":\"Owner/ Organization\",\"id\":\"2b7c10cd-1a6d-4dff-8cf9-848904b101d7\",\"enhancements\":{},\"selectedOptions\":[]}},\"05d7ed66-221a-437a-9e07-5094ce9d57e0\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.name\",\"title\":\"Repository\",\"id\":\"05d7ed66-221a-437a-9e07-5094ce9d57e0\",\"enhancements\":{}}},\"b1a338bb-89af-425e-91eb-1c8a32641422\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.state\",\"title\":\"State\",\"id\":\"b1a338bb-89af-425e-91eb-1c8a32641422\",\"selectedOptions\":[],\"enhancements\":{}}},\"5c430006-8043-4e34-96dd-34b596dcba61\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.severity\",\"title\":\"Severity\",\"id\":\"5c430006-8043-4e34-96dd-34b596dcba61\",\"enhancements\":{},\"selectedOptions\":[]}},\"81297eab-88c0-477b-8132-39cbb430b6c7\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"event.action\",\"title\":\"Alert Type\",\"id\":\"81297eab-88c0-477b-8132-39cbb430b6c7\",\"selectedOptions\":[],\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +19,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -42,7 +42,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f8b858f-a1ee-4d69-a100-d59282acd94d": { "columnOrder": [ @@ -122,7 +122,7 @@ } }, "title": "Total Alerts Count [GitHub Advanced Security]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -135,7 +135,7 @@ }, "panelIndex": "908a8fcb-8a78-41ae-bb14-c0fba31aa562", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -155,7 +155,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e125b149-a8ea-47b7-914c-508a7972c074": { "columnOrder": [ @@ -335,7 +335,7 @@ }, "panelIndex": "84209174-8b73-47ed-9324-45e7713370d0", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -355,7 +355,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e125b149-a8ea-47b7-914c-508a7972c074": { "columnOrder": [ @@ -479,16 +479,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "25824925-c28e-4f16-b354-5e6e25ecea6a" - ], "layerId": "e125b149-a8ea-47b7-914c-508a7972c074", "layerType": "data", "legendDisplay": "show", - "metric": "aaa67d72-aba4-4af4-a4f5-66e37fffed84", + "metrics": [ + "aaa67d72-aba4-4af4-a4f5-66e37fffed84" + ], "nestedLegend": false, "numberDisplay": "percent", - "percentDecimals": 1 + "percentDecimals": 1, + "primaryGroups": [ + "25824925-c28e-4f16-b354-5e6e25ecea6a" + ] } ], "palette": { @@ -512,7 +514,7 @@ }, "panelIndex": "5ef67f15-a8c1-4ce5-a676-3a27f61fa7dd", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -537,7 +539,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -694,7 +696,7 @@ } }, "title": "Open Alerts Count [GitHub Advanced Security]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -707,7 +709,7 @@ }, "panelIndex": "c5e57455-3945-4457-973f-7b6a1e5579d8", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -732,7 +734,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -897,7 +899,7 @@ } }, "title": "Resolved/Dismissed Alerts Count [GitHub Advanced Security]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -910,7 +912,7 @@ }, "panelIndex": "c15d5d40-d18a-4960-8b6d-d47da3611f99", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -935,7 +937,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2592c6ef-cf07-4080-b4fe-014cc142e3c8": { "columnOrder": [ @@ -1154,7 +1156,7 @@ }, "panelIndex": "5f8d7b7b-c370-4e38-ae2a-80f1495598fe", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1179,7 +1181,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91e1a389-34e8-4332-9dbb-bd883d71dd85": { "columnOrder": [ @@ -1322,16 +1324,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", - "e0343042-35ac-4a43-9fe5-639da6a8ee6e" - ], "layerId": "91e1a389-34e8-4332-9dbb-bd883d71dd85", "layerType": "data", "legendDisplay": "default", - "metric": "c53bee8d-06ca-4728-b6bc-2761d77a9ef5", + "metrics": [ + "c53bee8d-06ca-4728-b6bc-2761d77a9ef5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "894fb0b1-f0bd-4dbe-885b-0b41c339e84f", + "e0343042-35ac-4a43-9fe5-639da6a8ee6e" + ] } ], "shape": "pie" @@ -1351,7 +1355,7 @@ }, "panelIndex": "35bcc34c-a0d8-40fd-aa9d-52f0df0ebc5a", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1376,7 +1380,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a1e90df6-e435-44e9-b298-d77ce349f33b": { "columnOrder": [ @@ -1545,7 +1549,7 @@ }, "panelIndex": "54ab8e3f-ba53-4cf0-8769-745688302f45", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1570,7 +1574,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91e1a389-34e8-4332-9dbb-bd883d71dd85": { "columnOrder": [ @@ -1700,17 +1704,19 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "894fb0b1-f0bd-4dbe-885b-0b41c339e84f" - ], "layerId": "91e1a389-34e8-4332-9dbb-bd883d71dd85", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 5, - "metric": "c53bee8d-06ca-4728-b6bc-2761d77a9ef5", + "metrics": [ + "c53bee8d-06ca-4728-b6bc-2761d77a9ef5" + ], "nestedLegend": false, "numberDisplay": "percent", - "percentDecimals": 1 + "percentDecimals": 1, + "primaryGroups": [ + "894fb0b1-f0bd-4dbe-885b-0b41c339e84f" + ] } ], "shape": "donut" @@ -1731,59 +1737,20 @@ }, "panelIndex": "96fbd44d-b93e-4605-86ef-d5c3dd36660f", "type": "lens", - "version": "8.3.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] Advanced Security Overview", "version": 1 }, - "coreMigrationVersion": "8.4.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:36:57.825Z", "id": "github-6a6d7c40-17ab-11ed-809a-7b4be950fe9c", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ - { - "id": "logs-*", - "name": "96fbd44d-b93e-4605-86ef-d5c3dd36660f:indexpattern-datasource-layer-91e1a389-34e8-4332-9dbb-bd883d71dd85", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "96fbd44d-b93e-4605-86ef-d5c3dd36660f:7593b627-5a3f-46a0-a8f9-33e6b6acc9a5", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "96fbd44d-b93e-4605-86ef-d5c3dd36660f:3aea78d1-4e8f-47cb-a54b-11acf0506c06", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_2b7c10cd-1a6d-4dff-8cf9-848904b101d7:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_05d7ed66-221a-437a-9e07-5094ce9d57e0:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_b1a338bb-89af-425e-91eb-1c8a32641422:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_5c430006-8043-4e34-96dd-34b596dcba61:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_81297eab-88c0-477b-8132-39cbb430b6c7:optionsListDataView", - "type": "index-pattern" - }, { "id": "logs-*", "name": "908a8fcb-8a78-41ae-bb14-c0fba31aa562:indexpattern-datasource-layer-3f8b858f-a1ee-4d69-a100-d59282acd94d", @@ -1903,6 +1870,31 @@ "id": "logs-*", "name": "96fbd44d-b93e-4605-86ef-d5c3dd36660f:14e0ee55-38aa-4727-a0a5-a9af42b8b0ca", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2b7c10cd-1a6d-4dff-8cf9-848904b101d7:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_05d7ed66-221a-437a-9e07-5094ce9d57e0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_b1a338bb-89af-425e-91eb-1c8a32641422:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5c430006-8043-4e34-96dd-34b596dcba61:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_81297eab-88c0-477b-8132-39cbb430b6c7:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/github/kibana/dashboard/github-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json b/packages/github/kibana/dashboard/github-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json index eee16a0936f..3fa42f91735 100644 --- a/packages/github/kibana/dashboard/github-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json +++ b/packages/github/kibana/dashboard/github-8bfd8310-205c-11ec-8b10-11a4c5e322a0.json @@ -1,14 +1,6 @@ { - "id": "github-8bfd8310-205c-11ec-8b10-11a4c5e322a0", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-06T09:28:45.116Z", - "version": "WzM3NzQsMV0=", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -21,32 +13,54 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.3.0", - "type": "visualization", - "gridData": { - "h": 7, - "i": "af01806a-78b1-4068-8d69-fa2ca952f365", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "af01806a-78b1-4068-8d69-fa2ca952f365", "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Controls Audit [GitHub]", + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, "description": "", - "uiState": {}, "params": { "controls": [ { "fieldName": "github.org", "id": "1632831213212", - "indexPatternRefName": "control_0_index_pattern", + "indexPatternRefName": "control_af01806a-78b1-4068-8d69-fa2ca952f365_0_index_pattern", "label": "Organization", "options": { "dynamicOptions": true, @@ -61,7 +75,7 @@ { "fieldName": "github.repo", "id": "1632831234336", - "indexPatternRefName": "control_1_index_pattern", + "indexPatternRefName": "control_af01806a-78b1-4068-8d69-fa2ca952f365_1_index_pattern", "label": "Repository", "options": { "dynamicOptions": true, @@ -76,7 +90,7 @@ { "fieldName": "user.name", "id": "1632872599896", - "indexPatternRefName": "control_2_index_pattern", + "indexPatternRefName": "control_af01806a-78b1-4068-8d69-fa2ca952f365_2_index_pattern", "label": "Actor", "options": { "dynamicOptions": true, @@ -91,7 +105,7 @@ { "fieldName": "user.target.name", "id": "1632872564349", - "indexPatternRefName": "control_3_index_pattern", + "indexPatternRefName": "control_af01806a-78b1-4068-8d69-fa2ca952f365_3_index_pattern", "label": "Users", "options": { "dynamicOptions": true, @@ -106,7 +120,7 @@ { "fieldName": "event.action", "id": "1632874177516", - "indexPatternRefName": "control_4_index_pattern", + "indexPatternRefName": "control_af01806a-78b1-4068-8d69-fa2ca952f365_4_index_pattern", "label": "Action", "options": { "dynamicOptions": true, @@ -123,291 +137,425 @@ "updateFiltersOnChange": false, "useTimeFilter": false }, + "title": "Controls Audit [GitHub]", "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "github.audit" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "github.audit" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } + "uiState": {} } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, "gridData": { - "h": 15, - "i": "7d42442c-83c9-420d-8ef4-883eeb150687", - "w": 24, + "h": 7, + "i": "af01806a-78b1-4068-8d69-fa2ca952f365", + "w": 48, "x": 0, - "y": 7 + "y": 0 }, - "panelIndex": "7d42442c-83c9-420d-8ef4-883eeb150687", + "panelIndex": "af01806a-78b1-4068-8d69-fa2ca952f365", + "type": "visualization", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "vis": { - "legendOpen": false - }, - "savedVis": { - "title": "User Changes [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addTooltip": true, - "distinctColors": false, - "isDonut": false, - "labels": { - "last_level": false, - "percentDecimals": 0, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "value" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-70d0f323-600e-463d-a2d8-125f87473829", + "type": "index-pattern" }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "default", - "type": "palette" + { + "id": "logs-*", + "name": "fa424852-09dd-4127-aa6e-1227c42dda3a", + "type": "index-pattern" }, - "truncateLegend": true, - "type": "pie", - "legendDisplay": "hide", - "legendSize": "auto" - }, - "type": "pie", - "data": { - "aggs": [ + { + "id": "logs-*", + "name": "1dc692d3-3450-46f3-8202-1feb63baf4f1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "70d0f323-600e-463d-a2d8-125f87473829": { + "columnOrder": [ + "5e4dcd38-05f3-48f7-b36f-77fddc913665", + "4e2f1780-f1dc-4de5-aa8f-f95a532631ad" + ], + "columns": { + "4e2f1780-f1dc-4de5-aa8f-f95a532631ad": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5e4dcd38-05f3-48f7-b36f-77fddc913665": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4e2f1780-f1dc-4de5-aa8f-f95a532631ad", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fa424852-09dd-4127-aa6e-1227c42dda3a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "exists": { + "field": "user.target.name" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1dc692d3-3450-46f3-8202-1feb63baf4f1", + "key": "user.target.name", + "negate": false, + "type": "exists", + "value": "exists" + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "70d0f323-600e-463d-a2d8-125f87473829", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "4e2f1780-f1dc-4de5-aa8f-f95a532631ad" + ], + "nestedLegend": false, + "numberDisplay": "value", + "percentDecimals": 0, + "primaryGroups": [ + "5e4dcd38-05f3-48f7-b36f-77fddc913665" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" } - } - } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, + "title": "User Changes [GitHub]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 15, - "i": "76db3a0d-7562-4436-acd5-3cbfd4f6d044", + "i": "7d42442c-83c9-420d-8ef4-883eeb150687", "w": 24, - "x": 24, + "x": 0, "y": 7 }, - "panelIndex": "76db3a0d-7562-4436-acd5-3cbfd4f6d044", + "panelIndex": "7d42442c-83c9-420d-8ef4-883eeb150687", + "title": "User Changes [GitHub]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Change Timeline [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1adde96a-a403-4ac0-973a-b0f8bd2e2824", + "type": "index-pattern" }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" + { + "id": "logs-*", + "name": "2a0a0723-52e6-4d76-ae64-cef593eebea0", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "eafee05c-228a-456a-b8f7-9628d35a805d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1adde96a-a403-4ac0-973a-b0f8bd2e2824": { + "columnOrder": [ + "3815a45b-a25a-492e-930b-1c5230d1970f", + "65731541-38c6-4a6a-96b4-a8800379a2e7", + "b6efbd5e-d62b-4a1e-9c20-7da324eb37fb" + ], + "columns": { + "3815a45b-a25a-492e-930b-1c5230d1970f": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "65731541-38c6-4a6a-96b4-a8800379a2e7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6efbd5e-d62b-4a1e-9c20-7da324eb37fb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "b6efbd5e-d62b-4a1e-9c20-7da324eb37fb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ], - "legendSize": "auto" - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-18M", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "2a0a0723-52e6-4d76-ae64-cef593eebea0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" }, - "useNormalizedEsInterval": true, - "used_interval": "1w" + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "exists": { + "field": "user.target.name" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "eafee05c-228a-456a-b8f7-9628d35a805d", + "key": "user.target.name", + "negate": false, + "type": "exists", + "value": "exists" + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "b6efbd5e-d62b-4a1e-9c20-7da324eb37fb" + ], + "isHistogram": true, + "layerId": "1adde96a-a403-4ac0-973a-b0f8bd2e2824", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "65731541-38c6-4a6a-96b4-a8800379a2e7", + "xAccessor": "3815a45b-a25a-492e-930b-1c5230d1970f", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "b6efbd5e-d62b-4a1e-9c20-7da324eb37fb" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } - } + }, + "title": "User Change Timeline [GitHub]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "76db3a0d-7562-4436-acd5-3cbfd4f6d044", + "w": 24, + "x": 24, + "y": 7 + }, + "panelIndex": "76db3a0d-7562-4436-acd5-3cbfd4f6d044", + "title": "User Change Timeline [GitHub]", + "type": "lens", + "version": "8.7.1" }, { - "version": "7.16.0", - "type": "search", + "embeddableConfig": { + "enhancements": {} + }, "gridData": { "h": 15, "i": "1e435c96-c37f-4eb5-a4e5-2d446b2bf464", @@ -416,65 +564,87 @@ "y": 22 }, "panelIndex": "1e435c96-c37f-4eb5-a4e5-2d446b2bf464", - "embeddableConfig": { - "enhancements": {} - }, - "panelRefName": "panel_1e435c96-c37f-4eb5-a4e5-2d446b2bf464" + "panelRefName": "panel_1e435c96-c37f-4eb5-a4e5-2d446b2bf464", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] User Change Audit", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:51:00.272Z", + "id": "github-8bfd8310-205c-11ec-8b10-11a4c5e322a0", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "github-173f1050-20ae-11ec-8b10-11a4c5e322a0", - "name": "1e435c96-c37f-4eb5-a4e5-2d446b2bf464:panel_1e435c96-c37f-4eb5-a4e5-2d446b2bf464", - "type": "search" + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_af01806a-78b1-4068-8d69-fa2ca952f365_0_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_af01806a-78b1-4068-8d69-fa2ca952f365_1_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_af01806a-78b1-4068-8d69-fa2ca952f365_2_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_af01806a-78b1-4068-8d69-fa2ca952f365_3_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_af01806a-78b1-4068-8d69-fa2ca952f365_4_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "7d42442c-83c9-420d-8ef4-883eeb150687:indexpattern-datasource-layer-70d0f323-600e-463d-a2d8-125f87473829", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "7d42442c-83c9-420d-8ef4-883eeb150687:fa424852-09dd-4127-aa6e-1227c42dda3a", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_3_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "7d42442c-83c9-420d-8ef4-883eeb150687:1dc692d3-3450-46f3-8202-1feb63baf4f1", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "af01806a-78b1-4068-8d69-fa2ca952f365:control_4_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "76db3a0d-7562-4436-acd5-3cbfd4f6d044:indexpattern-datasource-layer-1adde96a-a403-4ac0-973a-b0f8bd2e2824", + "type": "index-pattern" }, { - "type": "search", - "name": "7d42442c-83c9-420d-8ef4-883eeb150687:search_0", - "id": "github-173f1050-20ae-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "76db3a0d-7562-4436-acd5-3cbfd4f6d044:2a0a0723-52e6-4d76-ae64-cef593eebea0", + "type": "index-pattern" }, { - "type": "search", - "name": "76db3a0d-7562-4436-acd5-3cbfd4f6d044:search_0", - "id": "github-173f1050-20ae-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "76db3a0d-7562-4436-acd5-3cbfd4f6d044:eafee05c-228a-456a-b8f7-9628d35a805d", + "type": "index-pattern" + }, + { + "id": "github-173f1050-20ae-11ec-8b10-11a4c5e322a0", + "name": "1e435c96-c37f-4eb5-a4e5-2d446b2bf464:panel_1e435c96-c37f-4eb5-a4e5-2d446b2bf464", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.4.0" - }, - "coreMigrationVersion": "8.4.1" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/github/kibana/dashboard/github-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json b/packages/github/kibana/dashboard/github-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json index c0981d3916e..3411474d2a8 100644 --- a/packages/github/kibana/dashboard/github-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json +++ b/packages/github/kibana/dashboard/github-dcee84c0-2059-11ec-8b10-11a4c5e322a0.json @@ -1,14 +1,6 @@ { - "id": "github-dcee84c0-2059-11ec-8b10-11a4c5e322a0", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-09-06T09:28:45.116Z", - "version": "WzM3NzUsMV0=", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -21,32 +13,54 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.3.0", - "type": "visualization", - "gridData": { - "h": 7, - "i": "63210180-c999-4d93-8d7a-f2fcb810ad1b", - "w": 41, - "x": 0, - "y": 0 - }, - "panelIndex": "63210180-c999-4d93-8d7a-f2fcb810ad1b", "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Controls Audit [GitHub]", + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, "description": "", - "uiState": {}, "params": { "controls": [ { "fieldName": "github.org", "id": "1632831213212", - "indexPatternRefName": "control_0_index_pattern", + "indexPatternRefName": "control_63210180-c999-4d93-8d7a-f2fcb810ad1b_0_index_pattern", "label": "Organization", "options": { "dynamicOptions": true, @@ -61,7 +75,7 @@ { "fieldName": "github.repo", "id": "1632831234336", - "indexPatternRefName": "control_1_index_pattern", + "indexPatternRefName": "control_63210180-c999-4d93-8d7a-f2fcb810ad1b_1_index_pattern", "label": "Repository", "options": { "dynamicOptions": true, @@ -76,7 +90,7 @@ { "fieldName": "user.name", "id": "1632872599896", - "indexPatternRefName": "control_2_index_pattern", + "indexPatternRefName": "control_63210180-c999-4d93-8d7a-f2fcb810ad1b_2_index_pattern", "label": "Actor", "options": { "dynamicOptions": true, @@ -91,7 +105,7 @@ { "fieldName": "user.target.name", "id": "1632872564349", - "indexPatternRefName": "control_3_index_pattern", + "indexPatternRefName": "control_63210180-c999-4d93-8d7a-f2fcb810ad1b_3_index_pattern", "label": "Users", "options": { "dynamicOptions": true, @@ -106,7 +120,7 @@ { "fieldName": "event.action", "id": "1632874177516", - "indexPatternRefName": "control_4_index_pattern", + "indexPatternRefName": "control_63210180-c999-4d93-8d7a-f2fcb810ad1b_4_index_pattern", "label": "Action", "options": { "dynamicOptions": true, @@ -123,45 +137,109 @@ "updateFiltersOnChange": false, "useTimeFilter": false }, + "title": "Controls Audit [GitHub]", "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "github.audit" + "uiState": {} + } + }, + "gridData": { + "h": 7, + "i": "63210180-c999-4d93-8d7a-f2fcb810ad1b", + "w": 41, + "x": 0, + "y": 0 + }, + "panelIndex": "63210180-c999-4d93-8d7a-f2fcb810ad1b", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-da4ff15d-0a19-4f61-ab0a-950f3ca2e669", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bc78bac0-ec45-470a-8e0e-eb88d11c18ca", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "da4ff15d-0a19-4f61-ab0a-950f3ca2e669": { + "columnOrder": [ + "56211c81-03e9-4988-9279-db6dce591f40" + ], + "columns": { + "56211c81-03e9-4988-9279-db6dce591f40": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": " ", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "type": "phrase" + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "bc78bac0-ec45-470a-8e0e-eb88d11c18ca", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" }, - "query": { - "match_phrase": { - "data_stream.dataset": "github.audit" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" } } - ], - "query": { - "language": "kuery", - "query": "" } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "da4ff15d-0a19-4f61-ab0a-950f3ca2e669", + "layerType": "data", + "metricAccessor": "56211c81-03e9-4988-9279-db6dce591f40" } - } - } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, + "title": "Total Events [GitHub]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 7, "i": "b37e0c71-2cc3-4895-b839-383ce53561a8", @@ -170,239 +248,222 @@ "y": 0 }, "panelIndex": "b37e0c71-2cc3-4895-b839-383ce53561a8", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Total Events [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": " " - }, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } + "title": "Total Events [GitHub]", + "type": "lens", + "version": "8.7.1" }, { - "version": "8.3.0", - "type": "visualization", - "gridData": { - "h": 19, - "i": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9", - "w": 48, - "x": 0, - "y": 7 - }, - "panelIndex": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9", "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Events over time [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": { - "show": false - }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e8200e92-8f9c-4d54-a8b6-0fb14f13f000", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "787cc67f-02cd-4f97-9ef4-d38d23a4cde9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e8200e92-8f9c-4d54-a8b6-0fb14f13f000": { + "columnOrder": [ + "51dc99f3-31b9-4e69-abff-403f9e50649a", + "44cbae66-9689-43e7-b565-7f3e662291da", + "cb7e4666-386c-4250-b23c-8241a0d81db5" + ], + "columns": { + "44cbae66-9689-43e7-b565-7f3e662291da": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cb7e4666-386c-4250-b23c-8241a0d81db5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "51dc99f3-31b9-4e69-abff-403f9e50649a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cb7e4666-386c-4250-b23c-8241a0d81db5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "787cc67f-02cd-4f97-9ef4-d38d23a4cde9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } } ], - "legendSize": "auto" - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-18M", - "to": "now" + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "cb7e4666-386c-4250-b23c-8241a0d81db5" + ], + "isHistogram": true, + "layerId": "e8200e92-8f9c-4d54-a8b6-0fb14f13f000", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "useNormalizedEsInterval": true, - "used_interval": "1w" - }, - "schema": "segment", - "type": "date_histogram" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "44cbae66-9689-43e7-b565-7f3e662291da", + "xAccessor": "51dc99f3-31b9-4e69-abff-403f9e50649a", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "cb7e4666-386c-4250-b23c-8241a0d81db5" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } - } - }, - { - "version": "8.4.0", - "type": "map", + }, + "title": "Events over time [GitHub]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { - "h": 18, - "i": "88887e58-b192-4c9b-85c7-14d18a6c1c0d", - "w": 37, + "h": 19, + "i": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9", + "w": 48, "x": 0, - "y": 26 + "y": 7 }, - "panelIndex": "88887e58-b192-4c9b-85c7-14d18a6c1c0d", + "panelIndex": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9", + "title": "Events over time [GitHub]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"alpha\":0.75,\"id\":\"a427cb7d-077b-4c8a-8741-74f8f03283e2\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"id\":\"world_countries\",\"tooltipProperties\":[\"name\"],\"type\":\"EMS_FILE\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#6092C0\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#4379aa\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true},{\"alpha\":0.75,\"id\":\"a0ea096b-e0eb-43dd-8f75-c0d8c0e4ac9a\",\"includeInFitToBounds\":true,\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"id\":\"167d9148-ad58-4fa1-99eb-c3e75fc75f96\",\"indexPatternTitle\":\"logs-*\",\"term\":\"client.geo.country_iso_code\",\"type\":\"ES_TERM_SOURCE\",\"indexPatternRefName\":\"layer_1_join_0_index_pattern\"}}],\"label\":\"Events by Country\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"id\":\"world_countries\",\"tooltipProperties\":[\"name\"],\"type\":\"EMS_FILE\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"center\":{\"lat\":0,\"lon\":-29.82486},\"filters\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"github.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"github.audit\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-18M\",\"to\":\"now\"},\"zoom\":0.56}", + "title": "Activity Map by Actor Location [GitHub]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, "enhancements": {}, "hiddenLayers": [], "isLayerTOCOpen": false, @@ -417,19 +478,159 @@ "lon": -30.5613, "zoom": 1 }, - "openTOCDetails": [], - "attributes": { - "title": "Activity Map by Actor Location [GitHub]", - "description": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}", - "mapStateJSON": "{\"center\":{\"lat\":0,\"lon\":-29.82486},\"filters\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"github.audit\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"github.audit\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-18M\",\"to\":\"now\"},\"zoom\":0.56}", - "layerListJSON": "[{\"alpha\":0.75,\"id\":\"a427cb7d-077b-4c8a-8741-74f8f03283e2\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"id\":\"world_countries\",\"tooltipProperties\":[\"name\"],\"type\":\"EMS_FILE\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#6092C0\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#4379aa\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true},{\"alpha\":0.75,\"id\":\"a0ea096b-e0eb-43dd-8f75-c0d8c0e4ac9a\",\"includeInFitToBounds\":true,\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"id\":\"167d9148-ad58-4fa1-99eb-c3e75fc75f96\",\"indexPatternRefName\":\"layer_1_join_0_index_pattern\",\"indexPatternTitle\":\"logs-*\",\"term\":\"client.geo.country_iso_code\",\"type\":\"ES_TERM_SOURCE\"}}],\"label\":\"Events by Country\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"id\":\"world_countries\",\"tooltipProperties\":[\"name\"],\"type\":\"EMS_FILE\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]" - } - } + "openTOCDetails": [] + }, + "gridData": { + "h": 18, + "i": "88887e58-b192-4c9b-85c7-14d18a6c1c0d", + "w": 37, + "x": 0, + "y": 26 + }, + "panelIndex": "88887e58-b192-4c9b-85c7-14d18a6c1c0d", + "type": "map", + "version": "8.7.1" }, { - "version": "8.3.0", - "type": "visualization", + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-aa3d0200-6de4-47c4-8f9e-a567ef6a74e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1cc01bb5-77b2-46ff-aeb9-c7eb71ce283b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aa3d0200-6de4-47c4-8f9e-a567ef6a74e9": { + "columnOrder": [ + "47aa4508-6c20-4853-a575-8f9504f868ff", + "25522b35-a0a5-4a78-a186-85e76b69a960" + ], + "columns": { + "25522b35-a0a5-4a78-a186-85e76b69a960": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "47aa4508-6c20-4853-a575-8f9504f868ff": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "github.org: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "25522b35-a0a5-4a78-a186-85e76b69a960", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "github.org" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1cc01bb5-77b2-46ff-aeb9-c7eb71ce283b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "aa3d0200-6de4-47c4-8f9e-a567ef6a74e9", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "25522b35-a0a5-4a78-a186-85e76b69a960" + ], + "nestedLegend": false, + "numberDisplay": "value", + "percentDecimals": 2, + "primaryGroups": [ + "47aa4508-6c20-4853-a575-8f9504f868ff" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "Events per Organization [GitHub]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 18, "i": "0c469087-fb3f-46d3-8962-c49d2e50f70c", @@ -438,81 +639,182 @@ "y": 26 }, "panelIndex": "0c469087-fb3f-46d3-8962-c49d2e50f70c", + "title": "Events per Organization [GitHub]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "vis": { - "legendOpen": false - }, - "savedVis": { - "title": "Events per Organization [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addTooltip": true, - "distinctColors": false, - "isDonut": false, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "value" - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-59c2e1bc-bea3-495d-898a-9377d1ddd420", + "type": "index-pattern" }, - "truncateLegend": true, - "type": "pie", - "legendDisplay": "hide", - "legendSize": "auto" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "dc71ba8b-d1ee-4a56-9179-0cce9f1b6487", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "59c2e1bc-bea3-495d-898a-9377d1ddd420": { + "columnOrder": [ + "7d85533a-e6e3-414a-ac1c-3027b911b017", + "e745fbd4-a74e-433c-b076-6816e1a4a33a" + ], + "columns": { + "7d85533a-e6e3-414a-ac1c-3027b911b017": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of event.action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e745fbd4-a74e-433c-b076-6816e1a4a33a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "e745fbd4-a74e-433c-b076-6816e1a4a33a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "github.org", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "dc71ba8b-d1ee-4a56-9179-0cce9f1b6487", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": -45, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "e745fbd4-a74e-433c-b076-6816e1a4a33a" + ], + "isHistogram": false, + "layerId": "59c2e1bc-bea3-495d-898a-9377d1ddd420", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "simpleView": false, + "xAccessor": "7d85533a-e6e3-414a-ac1c-3027b911b017", + "xScaleType": "ordinal", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "e745fbd4-a74e-433c-b076-6816e1a4a33a" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, + "title": "Top 5 Event Types [GitHub]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 19, "i": "108cd1b7-ce79-4558-ae38-5f1bb93961fe", @@ -521,143 +823,184 @@ "y": 44 }, "panelIndex": "108cd1b7-ce79-4558-ae38-5f1bb93961fe", + "title": "Top 5 Event Types [GitHub]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 5 Event Types [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 200 - }, - "position": "left", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": {}, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-adbf181b-c680-4806-bbbd-783726399aaf", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "39398171-5476-4c1d-a36f-ccedbb89ac49", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "adbf181b-c680-4806-bbbd-783726399aaf": { + "columnOrder": [ + "70c42e9f-34a0-4521-bc2d-248956a1ca4e", + "043281e2-b556-42d9-b42f-fa4343000831" + ], + "columns": { + "043281e2-b556-42d9-b42f-fa4343000831": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "70c42e9f-34a0-4521-bc2d-248956a1ca4e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "user.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "043281e2-b556-42d9-b42f-fa4343000831", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": true, - "rotate": 75, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "bottom", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "39398171-5476-4c1d-a36f-ccedbb89ac49", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } } ], - "legendSize": "auto" - }, - "type": "horizontal_bar", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "" - }, - "schema": "metric", - "type": "count" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "", - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": -45, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "043281e2-b556-42d9-b42f-fa4343000831" + ], + "isHistogram": false, + "layerId": "adbf181b-c680-4806-bbbd-783726399aaf", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "simpleView": false, + "xAccessor": "70c42e9f-34a0-4521-bc2d-248956a1ca4e", + "xScaleType": "ordinal", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "043281e2-b556-42d9-b42f-fa4343000831" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, + "title": "Top 5 Active Users [GitHub]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 19, "i": "9ed1cfce-9337-4813-8df5-14a1280bb351", @@ -666,140 +1009,184 @@ "y": 44 }, "panelIndex": "9ed1cfce-9337-4813-8df5-14a1280bb351", + "title": "Top 5 Active Users [GitHub]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 5 Active Users [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 200 - }, - "position": "left", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": {}, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e9e065b1-17fe-4831-bb21-e4f619d86abd", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "849e8382-efe4-4ffa-8ca8-6600890390fb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e9e065b1-17fe-4831-bb21-e4f619d86abd": { + "columnOrder": [ + "f2aa9a27-90d7-40cf-b02a-cbdfab927f30", + "c0357c52-590c-442e-95be-d9bdfbf63809" + ], + "columns": { + "c0357c52-590c-442e-95be-d9bdfbf63809": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f2aa9a27-90d7-40cf-b02a-cbdfab927f30": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Repository", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c0357c52-590c-442e-95be-d9bdfbf63809", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "github.repo" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": true, - "rotate": 75, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "bottom", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "849e8382-efe4-4ffa-8ca8-6600890390fb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "github.audit" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "data_stream.dataset": "github.audit" + } + } } ], - "legendSize": "auto" - }, - "type": "horizontal_bar", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "c0357c52-590c-442e-95be-d9bdfbf63809" + ], + "isHistogram": false, + "layerId": "e9e065b1-17fe-4831-bb21-e4f619d86abd", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "f2aa9a27-90d7-40cf-b02a-cbdfab927f30", + "xScaleType": "ordinal", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "c0357c52-590c-442e-95be-d9bdfbf63809" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } - } - }, - { - "version": "8.3.0", - "type": "visualization", + }, + "title": "Top 10 Active Repositories [GitHub]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 17, "i": "d48a66a5-50e7-4cab-9b16-767bfa427860", @@ -808,214 +1195,117 @@ "y": 63 }, "panelIndex": "d48a66a5-50e7-4cab-9b16-767bfa427860", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 10 Active Repositories [GitHub]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": { - "show": false - }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ], - "legendSize": "auto" - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Repository", - "field": "github.repo", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - } + "title": "Top 10 Active Repositories [GitHub]", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] Audit Log Activity", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:53:57.891Z", + "id": "github-dcee84c0-2059-11ec-8b10-11a4c5e322a0", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", + "id": "logs-*", "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_63210180-c999-4d93-8d7a-f2fcb810ad1b_0_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_63210180-c999-4d93-8d7a-f2fcb810ad1b_1_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_63210180-c999-4d93-8d7a-f2fcb810ad1b_2_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_63210180-c999-4d93-8d7a-f2fcb810ad1b_3_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_63210180-c999-4d93-8d7a-f2fcb810ad1b_4_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_3_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "b37e0c71-2cc3-4895-b839-383ce53561a8:indexpattern-datasource-layer-da4ff15d-0a19-4f61-ab0a-950f3ca2e669", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63210180-c999-4d93-8d7a-f2fcb810ad1b:control_4_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "b37e0c71-2cc3-4895-b839-383ce53561a8:bc78bac0-ec45-470a-8e0e-eb88d11c18ca", + "type": "index-pattern" }, { - "type": "search", - "name": "b37e0c71-2cc3-4895-b839-383ce53561a8:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9:indexpattern-datasource-layer-e8200e92-8f9c-4d54-a8b6-0fb14f13f000", + "type": "index-pattern" }, { - "type": "search", - "name": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "fb1ebb7a-c8bf-419d-be8f-ff5d2a741cc9:787cc67f-02cd-4f97-9ef4-d38d23a4cde9", + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "88887e58-b192-4c9b-85c7-14d18a6c1c0d:layer_1_join_0_index_pattern", - "id": "logs-*" + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0c469087-fb3f-46d3-8962-c49d2e50f70c:indexpattern-datasource-layer-aa3d0200-6de4-47c4-8f9e-a567ef6a74e9", + "type": "index-pattern" }, { - "type": "search", - "name": "0c469087-fb3f-46d3-8962-c49d2e50f70c:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "0c469087-fb3f-46d3-8962-c49d2e50f70c:1cc01bb5-77b2-46ff-aeb9-c7eb71ce283b", + "type": "index-pattern" }, { - "type": "search", - "name": "108cd1b7-ce79-4558-ae38-5f1bb93961fe:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "108cd1b7-ce79-4558-ae38-5f1bb93961fe:indexpattern-datasource-layer-59c2e1bc-bea3-495d-898a-9377d1ddd420", + "type": "index-pattern" }, { - "type": "search", - "name": "9ed1cfce-9337-4813-8df5-14a1280bb351:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "108cd1b7-ce79-4558-ae38-5f1bb93961fe:dc71ba8b-d1ee-4a56-9179-0cce9f1b6487", + "type": "index-pattern" }, { - "type": "search", - "name": "d48a66a5-50e7-4cab-9b16-767bfa427860:search_0", - "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0" + "id": "logs-*", + "name": "9ed1cfce-9337-4813-8df5-14a1280bb351:indexpattern-datasource-layer-adbf181b-c680-4806-bbbd-783726399aaf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9ed1cfce-9337-4813-8df5-14a1280bb351:39398171-5476-4c1d-a36f-ccedbb89ac49", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d48a66a5-50e7-4cab-9b16-767bfa427860:indexpattern-datasource-layer-e9e065b1-17fe-4831-bb21-e4f619d86abd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d48a66a5-50e7-4cab-9b16-767bfa427860:849e8382-efe4-4ffa-8ca8-6600890390fb", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.4.0" - }, - "coreMigrationVersion": "8.4.1" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/github/kibana/dashboard/github-f0104680-ae18-11ed-83fa-df5d96a45724.json b/packages/github/kibana/dashboard/github-f0104680-ae18-11ed-83fa-df5d96a45724.json index be0a1074684..d1a364c50d5 100644 --- a/packages/github/kibana/dashboard/github-f0104680-ae18-11ed-83fa-df5d96a45724.json +++ b/packages/github/kibana/dashboard/github-f0104680-ae18-11ed-83fa-df5d96a45724.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"93a8183f-ab74-4636-9f63-9e30c35bfa6b\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.owner.login\",\"title\":\"Owner/Organization\",\"id\":\"93a8183f-ab74-4636-9f63-9e30c35bfa6b\",\"enhancements\":{}}},\"965171e3-e02b-49ff-a2f7-6ddfa5159eee\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.repository.name\",\"title\":\"Repository\",\"id\":\"965171e3-e02b-49ff-a2f7-6ddfa5159eee\",\"enhancements\":{}}},\"8fb8d319-c120-4bcb-849d-6d45f3f5406a\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"github.state\",\"title\":\"State\",\"id\":\"8fb8d319-c120-4bcb-849d-6d45f3f5406a\",\"enhancements\":{},\"selectedOptions\":[]}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -42,6 +41,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -64,7 +64,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f8b858f-a1ee-4d69-a100-d59282acd94d": { "columnOrder": [ @@ -133,7 +133,7 @@ }, "title": "Total Alerts Created [GitHub Code Scanning]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -148,7 +148,7 @@ "panelIndex": "dc15f49d-29b1-4e2e-8787-51ffbab5b4ac", "title": "Total Issues Created [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -168,7 +168,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -304,7 +304,7 @@ }, "title": "Alerts Found/Fixed Ratio [GitHub Code Scanning]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -319,7 +319,7 @@ "panelIndex": "85cbbb74-4d3c-44e0-98f6-be076e31aea3", "title": "Issues Created/Closed Ratio [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -339,7 +339,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cbc5557e-f6b9-4140-90b2-3100f33083c4": { "columnOrder": [ @@ -418,16 +418,18 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.54, - "groups": [ - "3ef214a7-820c-42e3-b2b0-5daa7566fedc" - ], "layerId": "cbc5557e-f6b9-4140-90b2-3100f33083c4", "layerType": "data", "legendDisplay": "show", "legendPosition": "right", - "metric": "4525c4ae-5f82-4b4d-9867-48e4aba462fd", + "metrics": [ + "4525c4ae-5f82-4b4d-9867-48e4aba462fd" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "3ef214a7-820c-42e3-b2b0-5daa7566fedc" + ], "truncateLegend": true } ], @@ -455,7 +457,7 @@ "panelIndex": "1b501988-f932-4d80-8625-d2a1c8cd7321", "title": "Open vs Closed [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -480,7 +482,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -619,7 +621,7 @@ }, "title": "Open Alerts Count [GitHub Code Scanning]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -634,7 +636,7 @@ "panelIndex": "12c18b92-9f7b-4832-b85f-aad64720ea87", "title": "Open Issues Count [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -659,7 +661,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -801,7 +803,7 @@ }, "title": "Mean Time to Resolution [GitHub Code Scanning]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -816,7 +818,7 @@ "panelIndex": "7131e4d3-c168-480d-9496-1463ceaaa97a", "title": "Mean Time To Close Issues [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -841,7 +843,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df5f2c10-bc9b-4a7e-be41-d13240c21d95": { "columnOrder": [ @@ -989,7 +991,7 @@ }, "title": "Resolved/Dismissed Alerts Count [GitHub Code Scanning]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -1004,7 +1006,7 @@ "panelIndex": "c3e8ea64-b6f9-470c-9004-02f8909672eb", "title": "Closed Issues Count [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1024,7 +1026,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1163,7 +1165,7 @@ "panelIndex": "4e77167a-4642-4cbb-8430-2197e2f31666", "title": "Top Issues by labels [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1183,7 +1185,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1261,17 +1263,19 @@ { "categoryDisplay": "default", "emptySizeRatio": 0.3, - "groups": [ - "257a7d8d-1315-4775-97d9-e679c0f3aa79" - ], "layerId": "631035e6-8678-47ee-9a8c-c6a87f6c1757", "layerType": "data", "legendDisplay": "default", "legendMaxLines": 2, "legendPosition": "right", - "metric": "e1d8072b-7268-444a-864e-ef1117b17b65", + "metrics": [ + "e1d8072b-7268-444a-864e-ef1117b17b65" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "257a7d8d-1315-4775-97d9-e679c0f3aa79" + ], "truncateLegend": true } ], @@ -1295,7 +1299,7 @@ "panelIndex": "5135da2a-0093-4b71-a35a-c2b8877d22dd", "title": "Top Issues % by labels [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1315,7 +1319,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1420,7 +1424,7 @@ "panelIndex": "342298f7-3cf9-4d79-9654-901a769ac7c7", "title": "Issues Count by labels [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1440,7 +1444,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1579,7 +1583,7 @@ "panelIndex": "ca116a6a-6146-40d8-b9d3-83c775d22456", "title": "Top Users Creating Issues [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1599,7 +1603,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1738,7 +1742,7 @@ "panelIndex": "4f987036-b757-47ce-967c-c417b7c95f3a", "title": "Top users with assigned issues [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1763,7 +1767,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "631035e6-8678-47ee-9a8c-c6a87f6c1757": { "columnOrder": [ @@ -1921,7 +1925,7 @@ "panelIndex": "0cc3c355-192b-4fc8-be0e-0a899c6ffcff", "title": "Top users closing the issues [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1941,7 +1945,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ebd4f001-671a-4772-a2c4-b07f94e34845": { "columnOrder": [ @@ -2066,17 +2070,18 @@ "panelIndex": "234754b7-9ffa-44b0-b7f7-7ed6ec6a6d32", "title": "Events Timeline [GitHub Issues]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[GitHub] Issues", "version": 1 }, - "coreMigrationVersion": "8.4.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:37:27.152Z", "id": "github-f0104680-ae18-11ed-83fa-df5d96a45724", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/github/kibana/search/github-173f1050-20ae-11ec-8b10-11a4c5e322a0.json b/packages/github/kibana/search/github-173f1050-20ae-11ec-8b10-11a4c5e322a0.json index 0a69df3afd5..72547fd2049 100644 --- a/packages/github/kibana/search/github-173f1050-20ae-11ec-8b10-11a4c5e322a0.json +++ b/packages/github/kibana/search/github-173f1050-20ae-11ec-8b10-11a4c5e322a0.json @@ -66,10 +66,11 @@ "title": "GitHub Audit Users", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:48:57.400Z", "id": "github-173f1050-20ae-11ec-8b10-11a4c5e322a0", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/github/kibana/search/github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json b/packages/github/kibana/search/github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json index 319ca6ecb31..e90e54c96da 100644 --- a/packages/github/kibana/search/github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json +++ b/packages/github/kibana/search/github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0.json @@ -44,10 +44,11 @@ "title": "GitHub Audit", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T01:33:52.035Z", "id": "github-a5f3d9b0-20af-11ec-8b10-11a4c5e322a0", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/github/kibana/tags.yml b/packages/github/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/github/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/github/manifest.yml b/packages/github/manifest.yml index 22beed8ce3c..d64e6b39b29 100644 --- a/packages/github/manifest.yml +++ b/packages/github/manifest.yml @@ -1,14 +1,13 @@ name: github title: GitHub -version: "1.13.0" -release: ga +version: "1.22.0" description: Collect logs from GitHub with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [security, "productivity_security"] conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/github.svg title: GitHub @@ -41,3 +40,4 @@ policy_templates: description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/golang/_dev/build/docs/README.md b/packages/golang/_dev/build/docs/README.md index c11dbba6fcf..bb653fa6fdf 100644 --- a/packages/golang/_dev/build/docs/README.md +++ b/packages/golang/_dev/build/docs/README.md @@ -35,6 +35,100 @@ You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommen For step-by-step instructions on how to set up an integration, see the [Getting started](https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html) guide. +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Heap`` and ``Expvar`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> Golang -> Integration policies` open the configuration of Golang and disable the `Collect Golang metrics` toggle to reindex metrics data stream and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-golang.heap-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-golang.heap-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-golang.heap +``` +3. Go to `Integrations -> Golang -> Settings` and click on `Reinstall Golang`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-golang.heap-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> Golang -> Integration policies` and open configuration of integration and enable the `Collect Golang metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Logs reference ### expvar diff --git a/packages/golang/changelog.yml b/packages/golang/changelog.yml index e6e2eb4f365..5e89d0702f0 100644 --- a/packages/golang/changelog.yml +++ b/packages/golang/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "0.4.3" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "0.4.2" + changes: + - description: Add metric_type for expvar data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7528 +- version: "0.4.1" + changes: + - description: Resolve the conflict in host.ip field. + type: bugfix + link: https://github.com/elastic/integrations/pull/7494 - version: "0.4.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/golang/data_stream/expvar/elasticsearch/ingest_pipeline/default.yml b/packages/golang/data_stream/expvar/elasticsearch/ingest_pipeline/default.yml index f62ba37bb82..9cfbad75d27 100644 --- a/packages/golang/data_stream/expvar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/golang/data_stream/expvar/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/golang/data_stream/expvar/fields/ecs.yml b/packages/golang/data_stream/expvar/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/golang/data_stream/expvar/fields/ecs.yml +++ b/packages/golang/data_stream/expvar/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/golang/data_stream/expvar/fields/fields.yml b/packages/golang/data_stream/expvar/fields/fields.yml index e428b4f0ade..99e5b5d9576 100644 --- a/packages/golang/data_stream/expvar/fields/fields.yml +++ b/packages/golang/data_stream/expvar/fields/fields.yml @@ -22,6 +22,7 @@ - name: last_finished.ns type: long description: The time the last garbage collection finished. + metric_type: counter unit: nanos - name: metadata.memory.bytes type: long diff --git a/packages/golang/data_stream/heap/elasticsearch/ingest_pipeline/default.yml b/packages/golang/data_stream/heap/elasticsearch/ingest_pipeline/default.yml index fcfd6c633bf..674a3273134 100644 --- a/packages/golang/data_stream/heap/elasticsearch/ingest_pipeline/default.yml +++ b/packages/golang/data_stream/heap/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/golang/data_stream/heap/fields/ecs.yml b/packages/golang/data_stream/heap/fields/ecs.yml index aa9d34a2dae..012a5d2d953 100644 --- a/packages/golang/data_stream/heap/fields/ecs.yml +++ b/packages/golang/data_stream/heap/fields/ecs.yml @@ -18,5 +18,7 @@ name: event.original - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address diff --git a/packages/golang/docs/README.md b/packages/golang/docs/README.md index 84c80a469df..33e534fad53 100644 --- a/packages/golang/docs/README.md +++ b/packages/golang/docs/README.md @@ -35,6 +35,100 @@ You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommen For step-by-step instructions on how to set up an integration, see the [Getting started](https://www.elastic.co/guide/en/welcome-to-elastic/current/getting-started-observability.html) guide. +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Heap`` and ``Expvar`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> Golang -> Integration policies` open the configuration of Golang and disable the `Collect Golang metrics` toggle to reindex metrics data stream and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-golang.heap-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-golang.heap-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-golang.heap +``` +3. Go to `Integrations -> Golang -> Settings` and click on `Reinstall Golang`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-golang.heap-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> Golang -> Integration policies` and open configuration of integration and enable the `Collect Golang metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Logs reference ### expvar @@ -164,7 +258,7 @@ An example event for `expvar` looks as following: | golang.expvar.buck_hash_sys.bytes | Bytes of memory in profiling bucket hash tables. | long | byte | gauge | | golang.expvar.cmdline | The cmdline of this Go program start with. | keyword | | | | golang.expvar.gc.forced | The number of GC cycles that were forced by the application calling the GC function. | long | | counter | -| golang.expvar.gc.last_finished.ns | The time the last garbage collection finished. | long | nanos | | +| golang.expvar.gc.last_finished.ns | The time the last garbage collection finished. | long | nanos | counter | | golang.expvar.gc.metadata.memory.bytes | Bytes of memory in garbage collection metadata. | long | byte | gauge | | golang.expvar.mcache.allocated.bytes | Bytes of allocated mcache structures. | long | byte | gauge | | golang.expvar.mcache.obtained.bytes | Bytes of memory obtained from the OS for mcache structures. | long | byte | gauge | @@ -174,6 +268,7 @@ An example event for `expvar` looks as following: | golang.expvar.obtained.total.bytes | The total bytes of memory obtained from the OS. | long | byte | gauge | | golang.expvar.pointer.lookups | The number of pointer lookups performed by the runtime. | long | | gauge | | golang.expvar.stack.bytes | Bytes in stack spans. | long | byte | gauge | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -318,6 +413,7 @@ An example event for `heap` looks as following: | golang.heap.system.released.bytes | Bytes of physical memory returned to the OS. | long | byte | gauge | | golang.heap.system.stack.bytes | Bytes of stack memory obtained from the OS. | long | byte | gauge | | golang.heap.system.total.bytes | Bytes of heap memory obtained from the OS. | long | byte | gauge | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | diff --git a/packages/golang/manifest.yml b/packages/golang/manifest.yml index c4d626b1139..a1b4a13c628 100644 --- a/packages/golang/manifest.yml +++ b/packages/golang/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: golang title: Golang -version: "0.4.0" +version: "0.4.3" description: This Elastic integration collects metrics from Golang applications. type: integration categories: diff --git a/packages/google_cloud_storage/_dev/build/build.yml b/packages/google_cloud_storage/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/google_cloud_storage/_dev/build/build.yml +++ b/packages/google_cloud_storage/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/google_cloud_storage/changelog.yml b/packages/google_cloud_storage/changelog.yml index 6f9d2ec841c..ca5a6b43ef0 100644 --- a/packages/google_cloud_storage/changelog.yml +++ b/packages/google_cloud_storage/changelog.yml @@ -1,3 +1,18 @@ +- version: 0.7.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "0.4.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/google_cloud_storage/kibana/tags.yml b/packages/google_cloud_storage/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/google_cloud_storage/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/google_cloud_storage/manifest.yml b/packages/google_cloud_storage/manifest.yml index 8a802b7d1fe..cc8485a6936 100644 --- a/packages/google_cloud_storage/manifest.yml +++ b/packages/google_cloud_storage/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: google_cloud_storage title: Custom GCS (Google Cloud Storage) Input description: Collect JSON data from configured GCS Bucket with Elastic Agent. type: integration -version: "0.4.0" +version: "0.7.0" conditions: - kibana.version: "^8.6.2" + kibana: + version: "^8.6.2" categories: - custom - cloud @@ -22,3 +23,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/google_scc/_dev/build/build.yml b/packages/google_scc/_dev/build/build.yml new file mode 100644 index 00000000000..c1af686e524 --- /dev/null +++ b/packages/google_scc/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/google_scc/_dev/build/docs/README.md b/packages/google_scc/_dev/build/docs/README.md new file mode 100644 index 00000000000..be4bd4ddd8b --- /dev/null +++ b/packages/google_scc/_dev/build/docs/README.md @@ -0,0 +1,146 @@ +# Google Security Command Center + +## Overview + +The [Google Security Command Center](https://cloud.google.com/security-command-center) integration allows users to monitor finding, audit, asset, and source. Security Command Center Premium provides comprehensive threat detection for Google Cloud that includes Event Threat Detection, Container Threat Detection, and Virtual Machine Threat Detection as built-in services. + +Use the Google SCC integration to collect and parse data from the Google SCC REST API (finding, asset, and source) or GCP Pub/Sub (finding, asset, and audit). Then visualize that data through search, correlation, and visualization within Elastic Security. + +## Data streams + +The Google SCC integration collects four types of data: finding, audit, asset, and source. + +**Finding** is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding. + +**Audit** logs created by Security Command Center as part of Cloud Audit Logs. + +**Asset** lists assets with time and resource types and returns paged results in response. + +**Source** is an entity or a mechanism that can produce a finding. A source is like a container of findings that come from the same scanner, logger, monitor, and other tools. + +## Compatibility + +This module has been tested against the latest Google SCC API version **v1**. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.8.0**. + +## Prerequisites + + - Create Google SCC service account [Steps to create](https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount). + - Permissions required for Service Account: + - Cloud Asset Viewer at Organization Level + - Pub/Sub Subscriber at Project Level + - Security Center Admin Editor at Organization Level + - **Security Command Center API** and **Cloud Asset API** must be enabled. + +This integration will make use of the following *oauth2 scope*: + +- `https://www.googleapis.com/auth/cloud-platform` + +Once Service Account credentials are downloaded as a JSON file, then the integration can be setup to collect data. + +If installing in GCP-Cloud Environment, No need to provide any credentials and make sure the account linked with the VM has all the required IAM permissions. Steps to [Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc). + +## Setup + +### To create GCP Pub/Sub, follow the below steps: + +- [Create Topic for Pub/sub](https://cloud.google.com/pubsub/docs/create-topic#create_a_topic). +- [Create Subscription for topic](https://cloud.google.com/pubsub/docs/create-subscription#create_subscriptions) + +### To collect data from GCP Pub/Sub, follow the below steps: + +- [Configure to export finding to GCP Pub/Sub](https://cloud.google.com/security-command-center/docs/how-to-notifications). +- [Configure to export asset to GCP Pub/Sub](https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes). +- [Configure to export audit to GCP Pub/Sub](https://cloud.google.com/logging/docs/export/configure_export_v2?_ga=2.110932226.-66737431.1679995682#overview). + +**NOTE**: + - **Sink destination** must be **Pub/Sub topic** while exporting audit logs to GCP Pub/Sub. + - Create unique Pub/Sub topic per data-stream. + +### Enabling the integration in Elastic: +1. In Kibana go to **Management > Integrations**. +2. In "Search for integrations" search bar, type **Google Security Command Center**. +3. Click on the **Google Security Command Center** integration from the search results. +4. Click on the **Add Google Security Command Center** Integration button to add the integration. +5. While adding the integration, if you want to **collect logs via Rest API**, turn on the toggle and then put the following details: + - credentials type + - credentials JSON/file + - parent type + - id + - To collect **asset logs**, put the following details: + - content type + + or if you want to **collect logs via GCP Pub/Sub**, turn on the toggle and then put the following details: + - credentials type + - credentials JSON/file + - project id + - To collect **asset, audit, or finding logs**, put the following details: + - topic + - subscription name + +## Logs reference + +### Asset + +This is the `Asset` dataset. + +#### Example + +{{event "asset"}} + +{{fields "asset"}} + +### Finding + +This is the `Finding` dataset. + +#### Example + +{{event "finding"}} + +{{fields "finding"}} + +### Source + +This is the `Source` dataset. + +#### Example + +{{event "source"}} + +{{fields "source"}} + +### Audit + +This is the `Audit` dataset. + +#### Example + +{{event "audit"}} + +{{fields "audit"}} \ No newline at end of file diff --git a/packages/google_scc/_dev/deploy/docker/docker-compose.yml b/packages/google_scc/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..3deb8387e1d --- /dev/null +++ b/packages/google_scc/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,62 @@ +version: '2.3' +services: + google_scc: + image: docker.elastic.co/observability/stream:v0.10.0 + hostname: google_scc + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config.yml + gcppubsub-emulator: + image: google/cloud-sdk:emulators + command: gcloud beta emulators pubsub start --host-port=0.0.0.0:8681 + ports: + - "8681/tcp" + gcppubsub-audit: + image: docker.elastic.co/observability/stream:v0.10.0 + volumes: + - ./files:/files:ro + command: + - log + - --retry=30 + - --addr=gcppubsub-emulator:8681 + - -p=gcppubsub + - --gcppubsub-clear=true + - --gcppubsub-project=audit + - /files/audit.log + depends_on: + - gcppubsub-emulator + gcppubsub-asset: + image: docker.elastic.co/observability/stream:v0.10.0 + volumes: + - ./files:/files:ro + command: + - log + - --retry=30 + - --addr=gcppubsub-emulator:8681 + - -p=gcppubsub + - --gcppubsub-clear=true + - --gcppubsub-project=asset + - /files/asset.log + depends_on: + - gcppubsub-emulator + gcppubsub-finding: + image: docker.elastic.co/observability/stream:v0.10.0 + volumes: + - ./files:/files:ro + command: + - log + - --retry=30 + - --addr=gcppubsub-emulator:8681 + - -p=gcppubsub + - --gcppubsub-clear=true + - --gcppubsub-project=finding + - /files/finding.log + depends_on: + - gcppubsub-emulator diff --git a/packages/google_scc/_dev/deploy/docker/files/asset.log b/packages/google_scc/_dev/deploy/docker/files/asset.log new file mode 100644 index 00000000000..708bfdab399 --- /dev/null +++ b/packages/google_scc/_dev/deploy/docker/files/asset.log @@ -0,0 +1 @@ +{"asset":{"ancestors":["projects/123456987522","folders/123456987520","organizations/523456987520"],"assetType":"logging.googleapis.com/LogBucket","name":"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default","resource":{"data":{"description":"Default bucket","lifecycleState":"ACTIVE","name":"projects/123456987522/locations/global/buckets/_Default","retentionDays":30},"discoveryDocumentUri":"https://logging.googleapis.com/$discovery/rest","discoveryName":"LogBucket","location":"global","parent":"//cloudresourcemanager.googleapis.com/projects/123456987522","version":"v2"},"updateTime":"2023-05-28T06:59:48.052491Z"},"priorAsset":{"ancestors":["projects/123456987522","folders/123456987520","organizations/523456987520"],"assetType":"logging.googleapis.com/LogBucket","name":"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default","resource":{"data":{"analyticsEnabled":true,"description":"Default bucket","lifecycleState":"ACTIVE","name":"projects/123456987522/locations/global/buckets/_Default","retentionDays":30},"discoveryDocumentUri":"https://logging.googleapis.com/$discovery/rest","discoveryName":"LogBucket","location":"global","parent":"//cloudresourcemanager.googleapis.com/projects/123456987522","version":"v2"},"updateTime":"2023-05-27T18:53:48.843904Z"},"priorAssetState":"PRESENT","window":{"startTime":"2023-05-28T06:59:48.052491Z"}} diff --git a/packages/google_scc/_dev/deploy/docker/files/audit.log b/packages/google_scc/_dev/deploy/docker/files/audit.log new file mode 100644 index 00000000000..308fdc98704 --- /dev/null +++ b/packages/google_scc/_dev/deploy/docker/files/audit.log @@ -0,0 +1 @@ +{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"test-user@example.net"},"requestMetadata":{"callerIp":"175.16.199.1","requestAttributes":{},"destinationAttributes":{}},"serviceName":"login.googleapis.com","methodName":"google.login.LoginService.loginFailure","resourceName":"organizations/123"},"insertId":"-nahbepd4l1x","resource":{"type":"audited_resource"},"httpRequest":{"remoteIp":"FE80::0202:B3FF:FE1E:1010"},"timestamp":"2021-09-24T16:16:57.183212Z","severity":"NOTICE","logName":"organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access","receiveTimestamp":"2021-09-24T17:51:25.034361197Z"} diff --git a/packages/google_scc/_dev/deploy/docker/files/config.yml b/packages/google_scc/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..12b71999da8 --- /dev/null +++ b/packages/google_scc/_dev/deploy/docker/files/config.yml @@ -0,0 +1,59 @@ +rules: + - path: /token + methods: [POST] + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: > + {"access_token": "1/fFAGRNJru1FTz70BzhT3Zg","expires_in": 3920,"token_type": "Bearer", "scope": "https://www.googleapis.com/auth/admin.reports.audit.readonly","refresh_token": "1//xEoDL4iW3cxlI7yDbSRFYNG01kVKM2C-259HOF2aQbI"} + + - path: /v1/organizations/xxxx/sources/-/findings + methods: [GET] + request_headers: + Accept: + - "application/json" + Authorization: + - "Bearer 1/fFAGRNJru1FTz70BzhT3Zg" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: > + {"listFindingsResults":[{"finding":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","parent":"organizations/515665165161/sources/98481484454154454545","resourceName":"//cloudresourcemanager.googleapis.com/projects/45455445554","state":"ACTIVE","category":"application","externalUri":"http://www.adwait.com","securityMarks":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks"},"eventTime":"2023-06-02T05:17:41.936Z","createTime":"2020-02-19T13:37:43.858Z","severity":"CRITICAL","canonicalName":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","mute":"UNMUTED","muteUpdateTime":"2022-03-23T05:50:21.804Z","externalSystems":{"test":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test","assignees":["primary"],"externalUid":"test_scc_finding_2","status":"updated1","externalSystemUpdateTime":"2022-01-05T05:00:35.674Z"}},"muteInitiator":"Unmuted by john@gmail.com"},"resource":{"name":"//cloudresourcemanager.googleapis.com/projects/45455445554"}}]} + + - path: /v1/organizations/xxxx/sources + methods: [GET] + request_headers: + Accept: + - "application/json" + Authorization: + - "Bearer 1/fFAGRNJru1FTz70BzhT3Zg" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: > + {"sources":[{"name":"organizations/595779152576/sources/10134421585261057824","displayName":"Cloudflare Security Events","description":"Extend your security view from the edge.","canonicalName":"organizations/595779152576/sources/10134421585261057824"}]} + + - path: /v1/organizations/xxxx/assets + methods: [GET] + request_headers: + Accept: + - "application/json" + Authorization: + - "Bearer 1/fFAGRNJru1FTz70BzhT3Zg" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: > + {"assets":[{"name":"//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD","assetType":"cloudbilling.googleapis.com/BillingAccount","resource":{"version":"v1","discoveryDocumentUri":"https://cloudbilling.googleapis.com/$discovery/rest","discoveryName":"BillingAccount","data":{"displayName":"New","name":"billingAccounts/012345-A08098-1Ab2CD"},"location":"global"},"ancestors":["organizations/523456987520"],"updateTime":"2022-11-17T12:20:17.601902Z"}]} + diff --git a/packages/google_scc/_dev/deploy/docker/files/finding.log b/packages/google_scc/_dev/deploy/docker/files/finding.log new file mode 100644 index 00000000000..64ac420a54b --- /dev/null +++ b/packages/google_scc/_dev/deploy/docker/files/finding.log @@ -0,0 +1 @@ +{"finding":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","parent":"organizations/515665165161/sources/98481484454154454545","resourceName":"//cloudresourcemanager.googleapis.com/projects/45455445554","state":"ACTIVE","category":"application","externalUri":"http://www.adwait.com","sourceProperties":{},"securityMarks":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks"},"eventTime":"2023-06-02T05:17:41.936Z","createTime":"2020-02-19T13:37:43.858Z","severity":"CRITICAL","canonicalName":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","mute":"UNMUTED","muteUpdateTime":"2022-03-23T05:50:21.804Z","externalSystems":{"test":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test","assignees":["primary"],"externalUid":"test_scc_finding_2","status":"updated1","externalSystemUpdateTime":"2022-01-05T05:00:35.674Z"}},"muteInitiator":"Unmuted by john@gmail.com"},"resource":{"name":"//cloudresourcemanager.googleapis.com/projects/45455445554"}} diff --git a/packages/google_scc/changelog.yml b/packages/google_scc/changelog.yml new file mode 100644 index 00000000000..a8627a134a7 --- /dev/null +++ b/packages/google_scc/changelog.yml @@ -0,0 +1,31 @@ +# newer versions go on top +- version: 0.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.3.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "0.2.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "0.1.1" + changes: + - description: Update field description. + type: bugfix + link: https://github.com/elastic/integrations/issues/6918 +- version: "0.1.0" + changes: + - description: Initial release. + type: enhancement + link: https://github.com/elastic/integrations/pull/6645 diff --git a/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log new file mode 100644 index 00000000000..4e931edfeb6 --- /dev/null +++ b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log @@ -0,0 +1,7 @@ +{"asset":{"ancestors":["projects/123456987522","folders/123456987520","organizations/523456987520"],"assetType":"logging.googleapis.com/LogBucket","name":"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default","resource":{"data":{"description":"Default bucket","lifecycleState":"ACTIVE","name":"projects/123456987522/locations/global/buckets/_Default","retentionDays":30},"discoveryDocumentUri":"https://logging.googleapis.com/$discovery/rest","discoveryName":"LogBucket","location":"global","parent":"//cloudresourcemanager.googleapis.com/projects/123456987522","version":"v2"},"updateTime":"2023-05-28T06:59:48.052491Z"},"priorAsset":{"ancestors":["projects/123456987522","folders/123456987520","organizations/523456987520"],"assetType":"logging.googleapis.com/LogBucket","name":"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default","resource":{"data":{"analyticsEnabled":true,"description":"Default bucket","lifecycleState":"ACTIVE","name":"projects/123456987522/locations/global/buckets/_Default","retentionDays":30},"discoveryDocumentUri":"https://logging.googleapis.com/$discovery/rest","discoveryName":"LogBucket","location":"global","parent":"//cloudresourcemanager.googleapis.com/projects/123456987522","version":"v2"},"updateTime":"2023-05-27T18:53:48.843904Z"},"priorAssetState":"PRESENT","window":{"startTime":"2023-05-28T06:59:48.052491Z"}} +{"accessPolicy":{"name":"accessPolicies/566544646546","parent":"organizations/566544646546","title":"default policy"},"ancestors":["organizations/566544646546"],"assetType":"cloudresourcemanager.googleapis.com/Organization","name":"//cloudresourcemanager.googleapis.com/organizations/566544646546","updateTime":"2022-11-01T19:57:24.719132Z"} +{"ancestors":["organizations/123456789552"],"assetType":"cloudbilling.googleapis.com/BillingAccount","iamPolicy":{"bindings":[{"members":["user:john@gmail.com"],"role":"roles/billing.admin"},{"members":["user:oliver@gmail.com"],"role":"roles/billing.creator"}],"etag":"JaX00WEvXYZ="},"name":"//cloudbilling.googleapis.com/billingAccounts/0182C5-AFE44E-367FB0","updateTime":"2023-03-02T07:00:10.354898Z"} +{"name":"//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD","assetType":"cloudbilling.googleapis.com/BillingAccount","resource":{"version":"v1","discoveryDocumentUri":"https://cloudbilling.googleapis.com/$discovery/rest","discoveryName":"BillingAccount","data":{"displayName":"New","name":"billingAccounts/012345-A08098-1Ab2CD"},"location":"global"},"ancestors":["organizations/523456987520"],"updateTime":"2022-11-17T12:20:17.601902Z"} +{"name":"//pubsub.googleapis.com/projects/test-12345/subscriptions/test-sub","assetType":"pubsub.googleapis.com/Subscription","ancestors":["projects/64848464654","folders/64848464654","organizations/64848464654"],"updateTime":"2023-04-11T17:22:50.122626Z","relatedAsset":{"asset":"//pubsub.googleapis.com/projects/test-12345/topics/test","assetType":"pubsub.googleapis.com/Topic","ancestors":["projects/64848464654","folders/64848464654","organizations/64848464654"],"relationshipType":"PUBSUB_SUBSCRIPTION_TO_TOPIC"}} +{"updateTime":"2014-10-02T15:01:23Z","name":"string","assetType":"string","resource":{"version":"string","discoveryDocumentUri":"string","discoveryName":"string","resourceUrl":"string","parent":"string","data":{},"location":"string"},"iamPolicy":{"bindings":[{"role":"roles/resourcemanager.organizationAdmin","members":["user:mike@example.com","group:admins@example.com","domain:google.com","serviceAccount:my-project-id@appspot.gserviceaccount.com"]},{"role":"roles/resourcemanager.organizationViewer","members":["user:eve@example.com"],"condition":{"title":"expirable access","description":"Does not grant access after Sep 2020","expression":"request.time < timestamp('2020-10-01T00:00:00.000Z')"}}],"auditConfigs":[{"service":"sampleservice.googleapis.com","auditLogConfigs":[{"logType":"DATA_READ"},{"logType":"DATA_WRITE","exemptedMembers":["user:aliya@example.com"]}]}],"etag":"BwWWja0YfJA=","version":3},"orgPolicy":[{"version":1,"constraint":"string","etag":"string","updateTime":"2014-10-02T15:01:23Z","listPolicy":{"allowedValues":["string"],"deniedValues":["string"],"allValues":"ALL_VALUES_UNSPECIFIED","suggestedValue":"string","inheritFromParent":true},"booleanPolicy":{"enforced":true},"restoreDefault":{"name":"string","parent":"string","title":"string","scopes":["string"],"etag":"string"}}],"osInventory":{"name":"string","osInfo":{"hostname":"string","longName":"string","shortName":"string","version":"string","architecture":"string","kernelVersion":"string","kernelRelease":"string","osconfigAgentVersion":"string"},"items":{"string":{"id":"string","originType":"ORIGIN_TYPE_UNSPECIFIED","createTime":"2014-10-02T15:01:23Z","updateTime":"2014-10-02T15:01:23Z","type":"TYPE_UNSPECIFIED","installedPackage":{"yumPackage":{"packageName":"string","architecture":"string","version":"string"},"aptPackage":{"packageName":"string","architecture":"string","version":"string"},"zypperPackage":{"packageName":"string","architecture":"string","version":"string"},"googetPackage":{"packageName":"string","architecture":"string","version":"string"},"zypperPatch":{"patchName":"string","category":"string","severity":"string","summary":"string"},"wuaPackage":{"title":"string","description":"string","categories":[{"id":"string","name":"string"}],"kbArticleIds":["string"],"supportUrl":"string","moreInfoUrls":["string"],"updateId":"string","revisionNumber":2,"lastDeploymentChangeTime":"2014-10-02T15:01:23Z"},"qfePackage":{"caption":"string","description":"string","hotFixId":"string","installTime":"2014-10-02T15:01:23Z"},"cosPackage":{"packageName":"string","architecture":"string","version":"string"},"windowsApplication":{"displayName":"string","displayVersion":"string","publisher":"string","installDate":{"year":2,"month":2,"day":2},"helpLink":"string"}},"availablePackage":{"yumPackage":{"packageName":"string","architecture":"string","version":"string"},"aptPackage":{"packageName":"string","architecture":"string","version":"string"},"zypperPackage":{"packageName":"string","architecture":"string","version":"string"},"googetPackage":{"packageName":"string","architecture":"string","version":"string"},"zypperPatch":{"patchName":"string","category":"string","severity":"string","summary":"string"},"wuaPackage":{"title":"string","description":"string","categories":[{"id":"string","name":"string"}],"kbArticleIds":["string"],"supportUrl":"string","moreInfoUrls":["string"],"updateId":"string","revisionNumber":2,"lastDeploymentChangeTime":"2014-10-02T15:01:23Z"},"qfePackage":{"caption":"string","description":"string","hotFixId":"string","installTime":"2014-10-02T15:01:23Z"},"cosPackage":{"packageName":"string","architecture":"string","version":"string"},"windowsApplication":{"displayName":"string","displayVersion":"string","publisher":"string","installDate":{"year":2,"month":2,"day":2},"helpLink":"string"}}}},"updateTime":"2014-10-02T15:01:23Z"},"relatedAssets":{"relationshipAttributes":{"type":"string","sourceResourceType":"string","targetResourceType":"string","action":"string"},"assets":[{"asset":"string","assetType":"string","ancestors":["string"],"relationshipType":"string"}]},"relatedAsset":{"asset":"string","assetType":"string","ancestors":["string"],"relationshipType":"string"},"ancestors":["string"],"accessPolicy":{"name":"string","parent":"string","title":"string","scopes":["string"],"etag":"string"},"accessLevel":{"name":"string","title":"string","description":"string","basic":{"conditions":[{"ipSubnetworks":["10.0.0.0/24","10.0.0.1/25"],"devicePolicy":{"requireScreenlock":true,"allowedEncryptionStatuses":["ENCRYPTION_UNSPECIFIED"],"osConstraints":[{"osType":"IOS","minimumVersion":"string","requireVerifiedChromeOs":true}],"allowedDeviceManagementLevels":["NONE"],"requireAdminApproval":true,"requireCorpOwned":true},"requiredAccessLevels":["string"],"negate":true,"members":["string"],"regions":["string"]}],"combiningFunction":"AND"},"custom":{"expr":{"expression":"string","title":"string","description":"string","location":"string"}}},"servicePerimeter":{"name":"string","title":"string","description":"string","perimeterType":"PERIMETER_TYPE_REGULAR","status":{"resources":["string"],"accessLevels":["string"],"restrictedServices":["string"],"vpcAccessibleServices":{"enableRestriction":true,"allowedServices":["string"]},"ingressPolicies":[{"ingressFrom":{"sources":[{"accessLevel":"string","resource":"string"}],"identities":["string"],"identityType":"IDENTITY_TYPE_UNSPECIFIED"},"ingressTo":{"operations":[{"serviceName":"string","methodSelectors":[{"method":"string","permission":"string"}]}],"resources":["string"]}}],"egressPolicies":[{"egressFrom":{"identities":["string"],"identityType":"ANY_IDENTITY"},"egressTo":{"resources":["string"],"operations":[{"serviceName":"string","methodSelectors":[{"method":"string","permission":"string"}]}],"externalResources":["string"]}}]},"spec":{"resources":["string"],"accessLevels":["string"],"restrictedServices":["string"],"vpcAccessibleServices":{"enableRestriction":true,"allowedServices":["string"]},"ingressPolicies":[{"ingressFrom":{"sources":[{"accessLevel":"string","resource":"string"}],"identities":["string"],"identityType":"IDENTITY_TYPE_UNSPECIFIED"},"ingressTo":{"operations":[{"serviceName":"string","methodSelectors":[{"method":"string","permission":"string"}]}],"resources":["string"]}}],"egressPolicies":[{"egressFrom":{"identities":["string"],"identityType":"ANY_IDENTITY"},"egressTo":{"resources":["string"],"operations":[{"serviceName":"string","methodSelectors":[{"method":"string","permission":"string"}]}],"externalResources":["string"]}}]},"useExplicitDryRunSpec":true}} +{"assets": [],"readTime": "2023-06-12T09:44:42.505Z","totalSize": 0} diff --git a/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json new file mode 100644 index 00000000000..4a8a41f9423 --- /dev/null +++ b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json @@ -0,0 +1,684 @@ +{ + "expected": [ + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"asset\":{\"ancestors\":[\"projects/123456987522\",\"folders/123456987520\",\"organizations/523456987520\"],\"assetType\":\"logging.googleapis.com/LogBucket\",\"name\":\"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default\",\"resource\":{\"data\":{\"description\":\"Default bucket\",\"lifecycleState\":\"ACTIVE\",\"name\":\"projects/123456987522/locations/global/buckets/_Default\",\"retentionDays\":30},\"discoveryDocumentUri\":\"https://logging.googleapis.com/$discovery/rest\",\"discoveryName\":\"LogBucket\",\"location\":\"global\",\"parent\":\"//cloudresourcemanager.googleapis.com/projects/123456987522\",\"version\":\"v2\"},\"updateTime\":\"2023-05-28T06:59:48.052491Z\"},\"priorAsset\":{\"ancestors\":[\"projects/123456987522\",\"folders/123456987520\",\"organizations/523456987520\"],\"assetType\":\"logging.googleapis.com/LogBucket\",\"name\":\"//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default\",\"resource\":{\"data\":{\"analyticsEnabled\":true,\"description\":\"Default bucket\",\"lifecycleState\":\"ACTIVE\",\"name\":\"projects/123456987522/locations/global/buckets/_Default\",\"retentionDays\":30},\"discoveryDocumentUri\":\"https://logging.googleapis.com/$discovery/rest\",\"discoveryName\":\"LogBucket\",\"location\":\"global\",\"parent\":\"//cloudresourcemanager.googleapis.com/projects/123456987522\",\"version\":\"v2\"},\"updateTime\":\"2023-05-27T18:53:48.843904Z\"},\"priorAssetState\":\"PRESENT\",\"window\":{\"startTime\":\"2023-05-28T06:59:48.052491Z\"}}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "prior": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "resource": { + "data": { + "analyticsEnabled": true, + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "type": "logging.googleapis.com/LogBucket", + "update_time": "2023-05-27T18:53:48.843Z" + }, + "prior_asset_state": "PRESENT", + "resource": { + "data": { + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "type": "logging.googleapis.com/LogBucket", + "update_time": "2023-05-28T06:59:48.052Z", + "window": { + "start_time": "2023-05-28T06:59:48.052Z" + } + } + }, + "host": { + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "type": "logging.googleapis.com/LogBucket" + }, + "related": { + "hosts": [ + "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"accessPolicy\":{\"name\":\"accessPolicies/566544646546\",\"parent\":\"organizations/566544646546\",\"title\":\"default policy\"},\"ancestors\":[\"organizations/566544646546\"],\"assetType\":\"cloudresourcemanager.googleapis.com/Organization\",\"name\":\"//cloudresourcemanager.googleapis.com/organizations/566544646546\",\"updateTime\":\"2022-11-01T19:57:24.719132Z\"}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "access_policy": { + "name": "accessPolicies/566544646546", + "parent": "organizations/566544646546", + "title": "default policy" + }, + "ancestors": [ + "organizations/566544646546" + ], + "name": "//cloudresourcemanager.googleapis.com/organizations/566544646546", + "type": "cloudresourcemanager.googleapis.com/Organization", + "update_time": "2022-11-01T19:57:24.719Z" + } + }, + "host": { + "name": "//cloudresourcemanager.googleapis.com/organizations/566544646546", + "type": "cloudresourcemanager.googleapis.com/Organization" + }, + "related": { + "hosts": [ + "//cloudresourcemanager.googleapis.com/organizations/566544646546" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"ancestors\":[\"organizations/123456789552\"],\"assetType\":\"cloudbilling.googleapis.com/BillingAccount\",\"iamPolicy\":{\"bindings\":[{\"members\":[\"user:john@gmail.com\"],\"role\":\"roles/billing.admin\"},{\"members\":[\"user:oliver@gmail.com\"],\"role\":\"roles/billing.creator\"}],\"etag\":\"JaX00WEvXYZ=\"},\"name\":\"//cloudbilling.googleapis.com/billingAccounts/0182C5-AFE44E-367FB0\",\"updateTime\":\"2023-03-02T07:00:10.354898Z\"}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "organizations/123456789552" + ], + "iam_policy": { + "bindings": [ + { + "members": [ + "user:john@gmail.com" + ], + "role": "roles/billing.admin" + }, + { + "members": [ + "user:oliver@gmail.com" + ], + "role": "roles/billing.creator" + } + ], + "etag": "JaX00WEvXYZ=" + }, + "name": "//cloudbilling.googleapis.com/billingAccounts/0182C5-AFE44E-367FB0", + "type": "cloudbilling.googleapis.com/BillingAccount", + "update_time": "2023-03-02T07:00:10.354Z" + } + }, + "host": { + "name": "//cloudbilling.googleapis.com/billingAccounts/0182C5-AFE44E-367FB0", + "type": "cloudbilling.googleapis.com/BillingAccount" + }, + "related": { + "hosts": [ + "//cloudbilling.googleapis.com/billingAccounts/0182C5-AFE44E-367FB0" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"name\":\"//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD\",\"assetType\":\"cloudbilling.googleapis.com/BillingAccount\",\"resource\":{\"version\":\"v1\",\"discoveryDocumentUri\":\"https://cloudbilling.googleapis.com/$discovery/rest\",\"discoveryName\":\"BillingAccount\",\"data\":{\"displayName\":\"New\",\"name\":\"billingAccounts/012345-A08098-1Ab2CD\"},\"location\":\"global\"},\"ancestors\":[\"organizations/523456987520\"],\"updateTime\":\"2022-11-17T12:20:17.601902Z\"}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "organizations/523456987520" + ], + "name": "//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD", + "resource": { + "data": { + "displayName": "New", + "name": "billingAccounts/012345-A08098-1Ab2CD" + }, + "discovery": { + "document_uri": "https://cloudbilling.googleapis.com/$discovery/rest", + "name": "BillingAccount" + }, + "location": "global", + "version": "v1" + }, + "type": "cloudbilling.googleapis.com/BillingAccount", + "update_time": "2022-11-17T12:20:17.601Z" + } + }, + "host": { + "name": "//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD", + "type": "cloudbilling.googleapis.com/BillingAccount" + }, + "related": { + "hosts": [ + "//cloudbilling.googleapis.com/billingAccounts/012345-A08098-1Ab2CD" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"name\":\"//pubsub.googleapis.com/projects/test-12345/subscriptions/test-sub\",\"assetType\":\"pubsub.googleapis.com/Subscription\",\"ancestors\":[\"projects/64848464654\",\"folders/64848464654\",\"organizations/64848464654\"],\"updateTime\":\"2023-04-11T17:22:50.122626Z\",\"relatedAsset\":{\"asset\":\"//pubsub.googleapis.com/projects/test-12345/topics/test\",\"assetType\":\"pubsub.googleapis.com/Topic\",\"ancestors\":[\"projects/64848464654\",\"folders/64848464654\",\"organizations/64848464654\"],\"relationshipType\":\"PUBSUB_SUBSCRIPTION_TO_TOPIC\"}}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "projects/64848464654", + "folders/64848464654", + "organizations/64848464654" + ], + "name": "//pubsub.googleapis.com/projects/test-12345/subscriptions/test-sub", + "related_asset": { + "ancestors": [ + "projects/64848464654", + "folders/64848464654", + "organizations/64848464654" + ], + "name": "//pubsub.googleapis.com/projects/test-12345/topics/test", + "relationship_type": "PUBSUB_SUBSCRIPTION_TO_TOPIC", + "type": "pubsub.googleapis.com/Topic" + }, + "type": "pubsub.googleapis.com/Subscription", + "update_time": "2023-04-11T17:22:50.122Z" + } + }, + "host": { + "name": "//pubsub.googleapis.com/projects/test-12345/subscriptions/test-sub", + "type": "pubsub.googleapis.com/Subscription" + }, + "related": { + "hosts": [ + "//pubsub.googleapis.com/projects/test-12345/subscriptions/test-sub" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "event", + "original": "{\"updateTime\":\"2014-10-02T15:01:23Z\",\"name\":\"string\",\"assetType\":\"string\",\"resource\":{\"version\":\"string\",\"discoveryDocumentUri\":\"string\",\"discoveryName\":\"string\",\"resourceUrl\":\"string\",\"parent\":\"string\",\"data\":{},\"location\":\"string\"},\"iamPolicy\":{\"bindings\":[{\"role\":\"roles/resourcemanager.organizationAdmin\",\"members\":[\"user:mike@example.com\",\"group:admins@example.com\",\"domain:google.com\",\"serviceAccount:my-project-id@appspot.gserviceaccount.com\"]},{\"role\":\"roles/resourcemanager.organizationViewer\",\"members\":[\"user:eve@example.com\"],\"condition\":{\"title\":\"expirable access\",\"description\":\"Does not grant access after Sep 2020\",\"expression\":\"request.time \u003c timestamp('2020-10-01T00:00:00.000Z')\"}}],\"auditConfigs\":[{\"service\":\"sampleservice.googleapis.com\",\"auditLogConfigs\":[{\"logType\":\"DATA_READ\"},{\"logType\":\"DATA_WRITE\",\"exemptedMembers\":[\"user:aliya@example.com\"]}]}],\"etag\":\"BwWWja0YfJA=\",\"version\":3},\"orgPolicy\":[{\"version\":1,\"constraint\":\"string\",\"etag\":\"string\",\"updateTime\":\"2014-10-02T15:01:23Z\",\"listPolicy\":{\"allowedValues\":[\"string\"],\"deniedValues\":[\"string\"],\"allValues\":\"ALL_VALUES_UNSPECIFIED\",\"suggestedValue\":\"string\",\"inheritFromParent\":true},\"booleanPolicy\":{\"enforced\":true},\"restoreDefault\":{\"name\":\"string\",\"parent\":\"string\",\"title\":\"string\",\"scopes\":[\"string\"],\"etag\":\"string\"}}],\"osInventory\":{\"name\":\"string\",\"osInfo\":{\"hostname\":\"string\",\"longName\":\"string\",\"shortName\":\"string\",\"version\":\"string\",\"architecture\":\"string\",\"kernelVersion\":\"string\",\"kernelRelease\":\"string\",\"osconfigAgentVersion\":\"string\"},\"items\":{\"string\":{\"id\":\"string\",\"originType\":\"ORIGIN_TYPE_UNSPECIFIED\",\"createTime\":\"2014-10-02T15:01:23Z\",\"updateTime\":\"2014-10-02T15:01:23Z\",\"type\":\"TYPE_UNSPECIFIED\",\"installedPackage\":{\"yumPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"aptPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"zypperPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"googetPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"zypperPatch\":{\"patchName\":\"string\",\"category\":\"string\",\"severity\":\"string\",\"summary\":\"string\"},\"wuaPackage\":{\"title\":\"string\",\"description\":\"string\",\"categories\":[{\"id\":\"string\",\"name\":\"string\"}],\"kbArticleIds\":[\"string\"],\"supportUrl\":\"string\",\"moreInfoUrls\":[\"string\"],\"updateId\":\"string\",\"revisionNumber\":2,\"lastDeploymentChangeTime\":\"2014-10-02T15:01:23Z\"},\"qfePackage\":{\"caption\":\"string\",\"description\":\"string\",\"hotFixId\":\"string\",\"installTime\":\"2014-10-02T15:01:23Z\"},\"cosPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"windowsApplication\":{\"displayName\":\"string\",\"displayVersion\":\"string\",\"publisher\":\"string\",\"installDate\":{\"year\":2,\"month\":2,\"day\":2},\"helpLink\":\"string\"}},\"availablePackage\":{\"yumPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"aptPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"zypperPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"googetPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"zypperPatch\":{\"patchName\":\"string\",\"category\":\"string\",\"severity\":\"string\",\"summary\":\"string\"},\"wuaPackage\":{\"title\":\"string\",\"description\":\"string\",\"categories\":[{\"id\":\"string\",\"name\":\"string\"}],\"kbArticleIds\":[\"string\"],\"supportUrl\":\"string\",\"moreInfoUrls\":[\"string\"],\"updateId\":\"string\",\"revisionNumber\":2,\"lastDeploymentChangeTime\":\"2014-10-02T15:01:23Z\"},\"qfePackage\":{\"caption\":\"string\",\"description\":\"string\",\"hotFixId\":\"string\",\"installTime\":\"2014-10-02T15:01:23Z\"},\"cosPackage\":{\"packageName\":\"string\",\"architecture\":\"string\",\"version\":\"string\"},\"windowsApplication\":{\"displayName\":\"string\",\"displayVersion\":\"string\",\"publisher\":\"string\",\"installDate\":{\"year\":2,\"month\":2,\"day\":2},\"helpLink\":\"string\"}}}},\"updateTime\":\"2014-10-02T15:01:23Z\"},\"relatedAssets\":{\"relationshipAttributes\":{\"type\":\"string\",\"sourceResourceType\":\"string\",\"targetResourceType\":\"string\",\"action\":\"string\"},\"assets\":[{\"asset\":\"string\",\"assetType\":\"string\",\"ancestors\":[\"string\"],\"relationshipType\":\"string\"}]},\"relatedAsset\":{\"asset\":\"string\",\"assetType\":\"string\",\"ancestors\":[\"string\"],\"relationshipType\":\"string\"},\"ancestors\":[\"string\"],\"accessPolicy\":{\"name\":\"string\",\"parent\":\"string\",\"title\":\"string\",\"scopes\":[\"string\"],\"etag\":\"string\"},\"accessLevel\":{\"name\":\"string\",\"title\":\"string\",\"description\":\"string\",\"basic\":{\"conditions\":[{\"ipSubnetworks\":[\"10.0.0.0/24\",\"10.0.0.1/25\"],\"devicePolicy\":{\"requireScreenlock\":true,\"allowedEncryptionStatuses\":[\"ENCRYPTION_UNSPECIFIED\"],\"osConstraints\":[{\"osType\":\"IOS\",\"minimumVersion\":\"string\",\"requireVerifiedChromeOs\":true}],\"allowedDeviceManagementLevels\":[\"NONE\"],\"requireAdminApproval\":true,\"requireCorpOwned\":true},\"requiredAccessLevels\":[\"string\"],\"negate\":true,\"members\":[\"string\"],\"regions\":[\"string\"]}],\"combiningFunction\":\"AND\"},\"custom\":{\"expr\":{\"expression\":\"string\",\"title\":\"string\",\"description\":\"string\",\"location\":\"string\"}}},\"servicePerimeter\":{\"name\":\"string\",\"title\":\"string\",\"description\":\"string\",\"perimeterType\":\"PERIMETER_TYPE_REGULAR\",\"status\":{\"resources\":[\"string\"],\"accessLevels\":[\"string\"],\"restrictedServices\":[\"string\"],\"vpcAccessibleServices\":{\"enableRestriction\":true,\"allowedServices\":[\"string\"]},\"ingressPolicies\":[{\"ingressFrom\":{\"sources\":[{\"accessLevel\":\"string\",\"resource\":\"string\"}],\"identities\":[\"string\"],\"identityType\":\"IDENTITY_TYPE_UNSPECIFIED\"},\"ingressTo\":{\"operations\":[{\"serviceName\":\"string\",\"methodSelectors\":[{\"method\":\"string\",\"permission\":\"string\"}]}],\"resources\":[\"string\"]}}],\"egressPolicies\":[{\"egressFrom\":{\"identities\":[\"string\"],\"identityType\":\"ANY_IDENTITY\"},\"egressTo\":{\"resources\":[\"string\"],\"operations\":[{\"serviceName\":\"string\",\"methodSelectors\":[{\"method\":\"string\",\"permission\":\"string\"}]}],\"externalResources\":[\"string\"]}}]},\"spec\":{\"resources\":[\"string\"],\"accessLevels\":[\"string\"],\"restrictedServices\":[\"string\"],\"vpcAccessibleServices\":{\"enableRestriction\":true,\"allowedServices\":[\"string\"]},\"ingressPolicies\":[{\"ingressFrom\":{\"sources\":[{\"accessLevel\":\"string\",\"resource\":\"string\"}],\"identities\":[\"string\"],\"identityType\":\"IDENTITY_TYPE_UNSPECIFIED\"},\"ingressTo\":{\"operations\":[{\"serviceName\":\"string\",\"methodSelectors\":[{\"method\":\"string\",\"permission\":\"string\"}]}],\"resources\":[\"string\"]}}],\"egressPolicies\":[{\"egressFrom\":{\"identities\":[\"string\"],\"identityType\":\"ANY_IDENTITY\"},\"egressTo\":{\"resources\":[\"string\"],\"operations\":[{\"serviceName\":\"string\",\"methodSelectors\":[{\"method\":\"string\",\"permission\":\"string\"}]}],\"externalResources\":[\"string\"]}}]},\"useExplicitDryRunSpec\":true}}", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "access_level": { + "basic": { + "combining_function": "AND", + "conditions": [ + { + "device_policy": { + "allowed_device_management_levels": [ + "NONE" + ], + "allowed_encryption_statuses": [ + "ENCRYPTION_UNSPECIFIED" + ], + "os_constraints": [ + { + "minimum_version": "string", + "os_type": "IOS", + "require_verified_chrome_os": true + } + ], + "require_admin_approval": true, + "require_corp_owned": true, + "require_screenlock": true + }, + "members": [ + "string" + ], + "negate": true, + "regions": [ + "string" + ], + "required_access_levels": [ + "string" + ], + "sub_networks": [ + "10.0.0.0/24", + "10.0.0.1/25" + ] + } + ] + }, + "custom": { + "expression": { + "description": "string", + "location": "string", + "text": "string", + "title": "string" + } + }, + "description": "string", + "name": "string", + "title": "string" + }, + "access_policy": { + "etag": "string", + "name": "string", + "parent": "string", + "scopes": [ + "string" + ], + "title": "string" + }, + "ancestors": [ + "string" + ], + "iam_policy": { + "audit_configs": [ + { + "audit_log_configs": [ + { + "log_type": "DATA_READ" + }, + { + "exemted_members": [ + "user:aliya@example.com" + ], + "log_type": "DATA_WRITE" + } + ], + "service": "sampleservice.googleapis.com" + } + ], + "bindings": [ + { + "members": [ + "user:mike@example.com", + "group:admins@example.com", + "domain:google.com", + "serviceAccount:my-project-id@appspot.gserviceaccount.com" + ], + "role": "roles/resourcemanager.organizationAdmin" + }, + { + "condition": { + "description": "Does not grant access after Sep 2020", + "expression": "request.time \u003c timestamp('2020-10-01T00:00:00.000Z')", + "title": "expirable access" + }, + "members": [ + "user:eve@example.com" + ], + "role": "roles/resourcemanager.organizationViewer" + } + ], + "etag": "BwWWja0YfJA=", + "version": "3" + }, + "name": "string", + "organization_policy": [ + { + "boolean_policy": { + "enforced": true + }, + "constraint": "string", + "etag": "string", + "list_policy": { + "all_values": "ALL_VALUES_UNSPECIFIED", + "allowed_values": [ + "string" + ], + "denied_values": [ + "string" + ], + "inherit_from_parent": true, + "suggested_value": "string" + }, + "restore_default": { + "etag": "string", + "name": "string", + "parent": "string", + "scopes": [ + "string" + ], + "title": "string" + }, + "update_time": "2014-10-02T15:01:23.000Z", + "version": "1" + } + ], + "os_inventory": { + "name": "string", + "os_info": { + "architecture": "string", + "hostname": "string", + "kernel": { + "release": "string", + "version": "string" + }, + "long_name": "string", + "os_config_agent_version": "string", + "short_name": "string", + "version": "string" + }, + "update_time": "2014-10-02T15:01:23.000Z" + }, + "related_asset": { + "ancestors": [ + "string" + ], + "name": "string", + "relationship_type": "string", + "type": "string" + }, + "related_assets": { + "assets": [ + { + "ancestors": [ + "string" + ], + "name": "string", + "relationship_type": "string", + "type": "string" + } + ], + "relationship_attributes": { + "action": "string", + "source_resource_type": "string", + "target_resource_type": "string", + "type": "string" + } + }, + "resource": { + "discovery": { + "document_uri": "string", + "name": "string" + }, + "location": "string", + "parent": "string", + "url": "string", + "version": "string" + }, + "service_perimeter": { + "description": "string", + "name": "string", + "spec": { + "access_levels": [ + "string" + ], + "egress_policies": [ + { + "egress_from": { + "identities": [ + "string" + ], + "identity_type": "ANY_IDENTITY" + }, + "egress_to": { + "externalResources": [ + "string" + ], + "operations": [ + { + "method_selectors": [ + { + "method": "string", + "permission": "string" + } + ], + "service_name": "string" + } + ], + "resources": [ + "string" + ] + } + } + ], + "ingress_policies": [ + { + "ingress_from": { + "identities": [ + "string" + ], + "identity_type": "IDENTITY_TYPE_UNSPECIFIED", + "sources": [ + { + "access_level": "string", + "resource": "string" + } + ] + }, + "ingress_to": { + "operations": [ + { + "method_selectors": [ + { + "method": "string", + "permission": "string" + } + ], + "service_name": "string" + } + ], + "resources": [ + "string" + ] + } + } + ], + "resources": [ + "string" + ], + "restricted_services": [ + "string" + ], + "vpc_accessible_services": { + "allowed_services": [ + "string" + ], + "enable_restriction": true + } + }, + "status": { + "access_levels": [ + "string" + ], + "egress_policies": [ + { + "egress_from": { + "identities": [ + "string" + ], + "identity_type": "ANY_IDENTITY" + }, + "egress_to": { + "externalResources": [ + "string" + ], + "operations": [ + { + "method_selectors": [ + { + "method": "string", + "permission": "string" + } + ], + "service_name": "string" + } + ], + "resources": [ + "string" + ] + } + } + ], + "ingress_policies": [ + { + "ingress_from": { + "identities": [ + "string" + ], + "identity_type": "IDENTITY_TYPE_UNSPECIFIED", + "sources": [ + { + "access_level": "string", + "resource": "string" + } + ] + }, + "ingress_to": { + "operations": [ + { + "method_selectors": [ + { + "method": "string", + "permission": "string" + } + ], + "service_name": "string" + } + ], + "resources": [ + "string" + ] + } + } + ], + "resources": [ + "string" + ], + "restricted_services": [ + "string" + ], + "vpc_accessible_services": { + "allowed_services": [ + "string" + ], + "enable_restriction": true + } + }, + "title": "string", + "type": "PERIMETER_TYPE_REGULAR", + "use_explicit_dry_run_spec": true + }, + "type": "string", + "update_time": "2014-10-02T15:01:23.000Z" + } + }, + "host": { + "architecture": "string", + "hostname": "string", + "name": "string", + "os": { + "family": "string", + "full": "string", + "kernel": "string", + "version": "string" + }, + "type": "string" + }, + "message": "string", + "related": { + "hosts": [ + "string" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + null + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-common-config.yml b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/google_scc/data_stream/asset/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/google_scc/data_stream/asset/_dev/test/system/test-default-config.yml b/packages/google_scc/data_stream/asset/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..c8fb25a2d2c --- /dev/null +++ b/packages/google_scc/data_stream/asset/_dev/test/system/test-default-config.yml @@ -0,0 +1,27 @@ +input: httpjson +service: google_scc +vars: + credentials_type: credentials_json + credentials: | + { + "type": "service_account", + "project_id": "system-tests", + "private_key_id": "a2ef9c637b4176ec994606cb08724a1b79bc0666", + "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC9SzdiBfhGcQrN\nLKofn3198cwOJ3DclRM3On9qVEHKIY3aCcLZgst4HyBtkefZeSVgIRPWhStWY8CK\nPBXZHM9jAifSQiHjNU4o7v5EMIKuCrwKAgbXFnJSEwXe7CfzrytKZfkVndPf+ZrH\nnUSwAmbNrB5/VOqtBF0QrG48FCz/ipZph5AJ5h5kFVyDZvwJSaDfDWUHTvZfO3tw\nlSnwVTWztT0d+CDYOyWH34NJVfTKirA3xifDgVcxLKoC7850FsZqJ05HpiOUrHc5\nJRRiy4HurdcPKKBvpVrtbvftBMsiG0RvnqXgTSI7iMNPjUtpjLC9GlZ6B+8egUEd\ndtdPoDG1AgMBAAECggEAP2ks+ldJnj9MAQNPUhyZa1FOrAcmVZ5Su5OLD1F+YHnx\nDPNsJHUeN/UlZc8UvdNJY/RwstIVfHEaFLSgFQUDrAUS1ep1c6ltr2SwJKOjgy3x\nY+Dd7buFPF1HADBYCdfKRrf2QvmF+mehI/FZCyUizw8zgDAwFRl7G5THsLSJhmiQ\nwDc9WbPFLyswtmeKoAqMiHHqV63PtJunqvGbrDTHh9f4P5JVtreMoPWzE9czQ2ZI\n5nBHOFP/EA6twyRalqOsm3XoFmyrWMmJtm/JJsDlGr/LZcVbtghxybEYo8p/VLpo\nJmBSJgM17rwGhniDWXWXXOfx2fkNZEhVIeGvZYJRgQKBgQDOHnepihIu650pTfRD\nfcUyPN9oYLzI2mwv70H3FzJQftt3pqmWhlX2adaXYJ65/8xwr6SmkHmYjTvfuCoT\nSFApzv9fnYcD6vCsk5AhLpbarWR3MEU1SCvaiFuRNrdTcR8MGSglWPLLVXCI6f/g\nF9kZ/Ngz7MkvD2bNT/WjNj3LMQKBgQDrGmPo0gvfk+QoFtL05+dDDrB2IxUokdqa\nRzdecC8wV01l8lIj4TDqo7W1wwxdEUvCbUYriE2BoXi1v3jF+wfluqJOL30Ex5kb\nUO5At+DWakxzgy3v0F32AOZRISAGMdbrNFaLpjD9t9NGbL8kiestfs2QuTISHJwU\nfD47jFDlxQKBgHrczGVh6O7RAVByqCxm1tnYUS8torpzAFQeYQrBZ/t1cqrCzInu\nL2V/tytqq5KheKKfAB1NNz4IyezUITh3PVl+itja1HUwYR/todc1pzRYcO9e9ZIK\nICHWcAaCQArb/i6+/CAvAiLUHg1utlhEvuNvxQxGk7Gak6PEit4r4e+xAoGBAIOR\nrT/p7IMefJyCyWQNM7qvScmTMJAXr8KPAEl1drMS6FmZFqbFq15kZ5hko1KiD0er\nZ42NJfLZrnfnw2roZS8HFzWyFcDLAr/qtqq5PLZBnq82RkrizPKS5lGYvBc7ZQ8T\npytXwir66N2MlhuYo2g+gkPvoDnKkP5V2W3xxIQRAoGBAIDayGKqE1iZwF72R0xQ\nVg8y2x9JoxY1lDGA8oLzYKcp7OslI6sPhv/NGnkQBwV964dcffnn6dezFyKKBGir\nDSiM9duWTttlzzUhUQMHCua2z/LXjz1XMb0LoSEOVdk00TDgRMSFhBLhr3ZXmoLb\nIqi7is4z2mP8pbcIIlmloogE\n-----END PRIVATE KEY-----", + "client_email": "foo@bar.com", + "client_id": "007155790781103885639", + "auth_uri": "http://google_scc:8090/o/oauth2/auth", + "token_uri": "http://google_scc:8090/token", + "auth_provider_x509_cert_url": "http://google_scc:8090/oauth2/v1/certs", + "client_x509_cert_url": "http://google_scc:8090/robot/v1/metadata/x509/foo%40bar.com" + } + parent_type: organizations + id: xxxx +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + content_type: RESOURCE + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/google_scc/data_stream/asset/_dev/test/system/test-pubsub-config.yml b/packages/google_scc/data_stream/asset/_dev/test/system/test-pubsub-config.yml new file mode 100644 index 00000000000..79c70099fd0 --- /dev/null +++ b/packages/google_scc/data_stream/asset/_dev/test/system/test-pubsub-config.yml @@ -0,0 +1,12 @@ +service: gcppubsub-emulator +input: gcp-pubsub +vars: + credentials_type: credentials_json + credentials: >- + {"type":"service_account","project_id":"asset","private_key_id":"x","private_key":"","client_email":"foo@bar.com","client_id":"0","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://foo.bar/path"} + project_id: asset +data_stream: + vars: + alternative_host: "{{Hostname}}:{{Port}}" + topic: topic + subscription_name: subscription diff --git a/packages/google_scc/data_stream/asset/agent/stream/gcp-pubsub.yml.hbs b/packages/google_scc/data_stream/asset/agent/stream/gcp-pubsub.yml.hbs new file mode 100644 index 00000000000..f953d6fe651 --- /dev/null +++ b/packages/google_scc/data_stream/asset/agent/stream/gcp-pubsub.yml.hbs @@ -0,0 +1,39 @@ +{{#if project_id}} +project_id: {{project_id}} +{{/if}} +{{#if topic}} +topic: {{topic}} +{{/if}} +{{#if subscription_name}} +subscription.name: {{subscription_name}} +{{/if}} +{{#if alternative_host}} +alternative_host: {{alternative_host}} +{{/if}} +{{#if subscription_create}} +subscription.create: {{subscription_create}} +{{/if}} +{{#if subscription_num_goroutines}} +subscription.num_goroutines: {{subscription_num_goroutines}} +{{/if}} +{{#if subscription_max_outstanding_messages}} +subscription.max_outstanding_messages: {{subscription_max_outstanding_messages}} +{{/if}} +{{credentials_type}}: {{credentials}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/asset/agent/stream/httpjson.yml.hbs b/packages/google_scc/data_stream/asset/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..a8154a9ff17 --- /dev/null +++ b/packages/google_scc/data_stream/asset/agent/stream/httpjson.yml.hbs @@ -0,0 +1,59 @@ +config_version: '2' +interval: {{interval}} +request.method: GET +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +auth.oauth2.provider: google +auth.oauth2.google.{{credentials_type}}: {{credentials}} +auth.oauth2.scopes: + - https://www.googleapis.com/auth/cloud-platform + +{{#if proxy_url}} +request.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +request.timeout: {{http_client_timeout}} +{{/if}} +request.url: {{url}}/v1/{{parent_type}}/{{id}}/assets +request.transforms: + - set: + target: url.params.pageSize + value: {{batch_size}} + - set: + target: url.params.contentType + value: {{content_type}} + - set: + target: url.params.readTime + value: '[[formatDate (now) "RFC3339"]]' +response.pagination: + - set: + target: url.params.readTime + value: '[[formatDate (parseDate .last_response.body.readTime) "RFC3339"]]' + fail_on_template_error: true + - set: + target: url.params.pageToken + value: '[[if index .last_response.body "nextPageToken"]][[.last_response.body.nextPageToken]][[end]]' + fail_on_template_error: true +response.split: + target: body.assets +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..43e13961610 --- /dev/null +++ b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,180 @@ +--- +description: Pipeline for processing Asset logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - set: + field: event.kind + tag: set_event_kind + value: event + - set: + field: event.category + tag: set_event_category + value: [host] + - set: + field: event.type + tag: set_event_type + value: [info] + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - json: + field: event.original + tag: 'json_decoding' + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - drop: + if: ctx.json?.assets != null && ctx.json.assets.isEmpty() + tag: drop_assets + - rename: + field: json + target_field: json.asset + tag: rename_json + if: ctx.json?.asset == null + ignore_missing: true + - rename: + field: json.priorAssetState + target_field: google_scc.asset.prior_asset_state + tag: rename_priorAssetState + ignore_missing: true + - date: + field: json.window.startTime + target_field: google_scc.asset.window.start_time + tag: date_window_startTime + formats: + - ISO8601 + if: ctx.json?.window?.startTime != null && ctx.json.window.startTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - pipeline: + name: '{{ IngestPipeline "pipeline_asset" }}' + tag: pipeline_to_asset + - pipeline: + name: '{{ IngestPipeline "pipeline_prior_asset" }}' + tag: pipeline_to_prior_asset + - set: + field: host.architecture + tag: set_host_architecture + copy_from: google_scc.asset.os_inventory.os_info.architecture + ignore_empty_value: true + - set: + field: host.hostname + tag: set_host_hostname + copy_from: google_scc.asset.os_inventory.os_info.hostname + ignore_empty_value: true + - set: + field: host.name + tag: set_host_name + copy_from: google_scc.asset.name + ignore_empty_value: true + - set: + field: host.os.family + tag: set_host_os_family + copy_from: google_scc.asset.os_inventory.os_info.short_name + ignore_empty_value: true + - set: + field: host.os.full + tag: set_host_os_full + copy_from: google_scc.asset.os_inventory.os_info.long_name + ignore_empty_value: true + - set: + field: host.os.kernel + tag: set_host_os_kernal + copy_from: google_scc.asset.os_inventory.os_info.kernel.version + ignore_empty_value: true + - set: + field: host.os.version + tag: set_host_os_version + copy_from: google_scc.asset.os_inventory.os_info.version + ignore_empty_value: true + - set: + field: message + tag: set_message + copy_from: google_scc.asset.access_level.description + ignore_empty_value: true + - set: + field: message + tag: set_message + copy_from: google_scc.asset.service_perimeter.description + ignore_empty_value: true + - set: + field: host.type + tag: set_host_type + copy_from: google_scc.asset.type + ignore_empty_value: true + - append: + field: related.hosts + tag: append_host_hostname_into_related_hosts + value: '{{{host.hostname}}}' + allow_duplicates: false + if: ctx.host?.hostname != null + - append: + field: related.hosts + tag: append_host_name_into_related_hosts + value: '{{{host.name}}}' + allow_duplicates: false + if: ctx.host?.name != null + - remove: + field: + - json + tag: remove_json + ignore_missing: true + - remove: + field: + - google_scc.asset.os_inventory.os_info.architecture + - google_scc.asset.os_inventory.os_info.hostname + - google_scc.asset.name + - google_scc.asset.os_inventory.os_info.short_name + - google_scc.asset.os_inventory.os_info.long_name + - google_scc.asset.os_inventory.os_info.kernel.version + - google_scc.asset.os_inventory.os_info.version + - google_scc.asset.type + - google_scc.asset.access_level.description + - google_scc.asset.service_perimeter.description + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: event.original + tag: remove_event_original + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_asset.yml b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_asset.yml new file mode 100644 index 00000000000..bcddbc0c678 --- /dev/null +++ b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_asset.yml @@ -0,0 +1,880 @@ +--- +processors: + - rename: + field: json.asset.osInventory.osInfo.architecture + target_field: google_scc.asset.os_inventory.os_info.architecture + tag: rename_asset_osInventory_osInfo_architecture + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.hostname + target_field: google_scc.asset.os_inventory.os_info.hostname + tag: rename_asset_osInventory_osInfo_hostname + ignore_missing: true + - rename: + field: json.asset.name + target_field: google_scc.asset.name + tag: rename_asset_name + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.shortName + target_field: google_scc.asset.os_inventory.os_info.short_name + tag: rename_asset_osInventory_osInfo_shortName + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.longName + target_field: google_scc.asset.os_inventory.os_info.long_name + tag: rename_asset_osInventory_osInfo_longName + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.kernelVersion + target_field: google_scc.asset.os_inventory.os_info.kernel.version + tag: rename_asset_osInventory_osInfo_kernelVersion + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.version + target_field: google_scc.asset.os_inventory.os_info.version + tag: rename_asset_osInventory_osInfo_version + ignore_missing: true + - rename: + field: json.asset.assetType + target_field: google_scc.asset.type + tag: rename_asset_assetType + ignore_missing: true + - rename: + field: json.asset.accessLevel.basic.combiningFunction + target_field: json.asset.accessLevel.basic.combining_function + tag: rename_asset_accessLevel_basic_combiningFunction + ignore_missing: true + - rename: + field: json.asset.accessLevel.custom.expr.expression + target_field: json.asset.accessLevel.custom.expr.text + tag: rename_asset_accessLevel_custom_expr_expression + ignore_missing: true + - rename: + field: json.asset.accessLevel.custom.expr + target_field: json.asset.accessLevel.custom.expression + tag: rename_asset_accessLevel_custom_expr + ignore_missing: true + - foreach: + field: json.asset.accessLevel.basic.conditions + if: ctx.json?.asset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.devicePolicy.osConstraints + ignore_failure: true + processor: + convert: + field: _ingest._value.requireVerifiedChromeOs + tag: convert_requireVerifiedChromeOs_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireCorpOwned + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.asset.accessLevel.basic.conditions + if: ctx.json?.asset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.devicePolicy.requireScreenlock + tag: convert_devicePolicy_requireScreenlock_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireScreenlock + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.asset.accessLevel.basic.conditions + if: ctx.json?.asset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.devicePolicy.requireAdminApproval + tag: convert_devicePolicy_requireAdminApproval_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireAdminApproval + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.asset.accessLevel.basic.conditions + if: ctx.json?.asset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.negate + tag: convert_negate_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.negate + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the accessLevel.basic.conditions objects. + if: ctx.json?.asset?.accessLevel?.basic?.conditions != null + params: + "conditions": "conditions" + "requiredAccessLevels": "required_access_levels" + "devicePolicy": "device_policy" + "requireScreenlock": "require_screenlock" + "allowedEncryptionStatuses": "allowed_encryption_statuses" + "osConstraints": "os_constraints" + "osType": "os_type" + "minimumVersion": "minimum_version" + "requireVerifiedChromeOs": "require_verified_chrome_os" + "allowedDeviceManagementLevels": "allowed_device_management_levels" + "requireAdminApproval": "require_admin_approval" + "requireCorpOwned": "require_corp_owned" + "ipSubnetworks": "sub_networks" + tag: painless_to_rename_fields_under_accessLevel_basic_conditions_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def conditions = new ArrayList(); + for(entity in ctx.json.asset.accessLevel.basic.conditions){ + conditions.add(renameKeys(entity, params)); + } + ctx.json.asset.accessLevel.basic.remove('conditions'); + ctx.json.asset.accessLevel.basic.put('conditions',conditions); + - rename: + field: json.asset.accessLevel + target_field: google_scc.asset.access_level + tag: rename_asset_accessLevel + ignore_missing: true + - rename: + field: json.asset.accessPolicy + target_field: google_scc.asset.access_policy + tag: rename_asset_accessPolicy + ignore_missing: true + - rename: + field: json.asset.ancestors + target_field: google_scc.asset.ancestors + tag: rename_asset_ancestors + ignore_missing: true + - script: + lang: painless + description: This script processor rename the fields under the iamPolicy.auditConfigs objects. + if: ctx.json?.asset?.iamPolicy?.auditConfigs != null + params: + "auditConfigs": "audit_configs" + "auditLogConfigs": "audit_log_configs" + "logType": "log_type" + "exemptedMembers": "exemted_members" + tag: painless_to_rename_fields_under_iamPolicy_auditConfigs_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def audit_configs = new ArrayList(); + for(entity in ctx.json.asset.iamPolicy.auditConfigs){ + audit_configs.add(renameKeys(entity, params)); + } + ctx.json.asset.iamPolicy.remove('auditConfigs'); + ctx.json.asset.iamPolicy.put('audit_configs',audit_configs); + - convert: + field: json.asset.iamPolicy.version + tag: convert_asset_iamPolicy_version + if: ctx.json?.asset?.iamPolicy?.version != '' + type: string + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.asset.iamPolicy + target_field: google_scc.asset.iam_policy + tag: rename_asset_iamPolicy + ignore_missing: true + - foreach: + field: json.asset.orgPolicy + if: ctx.json?.asset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.version + tag: convert_asset_orgPolicy_version + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.version + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.asset.orgPolicy + if: ctx.json?.asset?.orgPolicy instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.updateTime + target_field: _ingest._value.updateTime + tag: date_updateTime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.updateTime + ignore_missing: true + - foreach: + field: json.asset.orgPolicy + if: ctx.json?.asset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.listPolicy.inheritFromParent + tag: convert_orgPolicy_listPolicy_inheritFromParent_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.listPolicy.inheritFromParent + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.asset.orgPolicy + if: ctx.json?.asset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.booleanPolicy.enforced + tag: convert_orgPolicy_booleanPolicy_enforced_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.inbooleanPolicy.enforcedheritFromParent + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the orgPolicy objects. + if: ctx.json?.asset?.orgPolicy != null + params: + "orgPolicy": "organization_policy" + "listPolicy": "list_policy" + "allowedValues": "allowed_values" + "deniedValues": "denied_values" + "allValues": "all_values" + "suggestedValue": "suggested_value" + "restoreDefault": "restore_default" + "updateTime": "update_time" + "inheritFromParent": "inherit_from_parent" + "booleanPolicy": "boolean_policy" + tag: painless_to_rename_fields_under_orgPolicy_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def organization_policy = new ArrayList(); + for(entity in ctx.json.asset.orgPolicy){ + organization_policy.add(renameKeys(entity, params)); + } + ctx.json.asset.remove('orgPolicy'); + ctx.google_scc.asset.put('organization_policy',organization_policy); + - rename: + field: json.asset.osInventory.name + target_field: google_scc.asset.os_inventory.name + tag: rename_asset_osInventory_name + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.kernelRelease + target_field: google_scc.asset.os_inventory.os_info.kernel.release + tag: rename_asset_osInventory_osInfo_kernelRelease + ignore_missing: true + - rename: + field: json.asset.osInventory.osInfo.osconfigAgentVersion + target_field: google_scc.asset.os_inventory.os_info.os_config_agent_version + tag: rename_asset_osInventory_osInfo_osconfigAgentVersion + ignore_missing: true + - date: + field: json.asset.osInventory.updateTime + target_field: google_scc.asset.os_inventory.update_time + tag: date_asset_osInventory_updateTime + formats: + - ISO8601 + if: ctx.json?.asset?.osInventory?.updateTime != null && ctx.json.asset.osInventory.updateTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.asset.relatedAsset.ancestors + target_field: google_scc.asset.related_asset.ancestors + tag: rename_asset_relatedAsset_ancestors + ignore_missing: true + - rename: + field: json.asset.relatedAsset.asset + target_field: google_scc.asset.related_asset.name + tag: rename_asset_relatedAsset_asset + ignore_missing: true + - rename: + field: json.asset.relatedAsset.relationshipType + target_field: google_scc.asset.related_asset.relationship_type + tag: rename_asset_relatedAsset_relationshipType + ignore_missing: true + - rename: + field: json.asset.relatedAsset.assetType + target_field: google_scc.asset.related_asset.type + tag: rename_asset_relatedAsset_assetType + ignore_missing: true + - rename: + field: json.asset.relatedAssets.relationshipAttributes.action + target_field: json.asset.relatedAssets.relationship_attributes.action + tag: rename_asset_relatedAssets_relationshipAttributes_action + ignore_missing: true + - rename: + field: json.asset.relatedAssets.relationshipAttributes.sourceResourceType + target_field: json.asset.relatedAssets.relationship_attributes.source_resource_type + tag: rename_asset_relatedAssets_relationshipAttributes_sourceResourceType + ignore_missing: true + - rename: + field: json.asset.relatedAssets.relationshipAttributes.targetResourceType + target_field: json.asset.relatedAssets.relationship_attributes.target_resource_type + tag: rename_asset_relatedAssets_relationshipAttributes_targetResourceType + ignore_missing: true + - rename: + field: json.asset.relatedAssets.relationshipAttributes.type + target_field: json.asset.relatedAssets.relationship_attributes.type + tag: rename_asset_relatedAssets_relationshipAttributes_type + ignore_missing: true + - script: + lang: painless + description: This script processor rename the fields under the relatedAssets.assets objects. + if: ctx.json?.asset?.relatedAssets?.assets != null + params: + "assets": "assets" + "assetType": "type" + "asset": "name" + "relationshipType": "relationship_type" + tag: painless_to_rename_fields_under_relatedAssets_assets_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def assets = new ArrayList(); + for(entity in ctx.json.asset.relatedAssets.assets){ + assets.add(renameKeys(entity, params)); + } + ctx.json.asset.relatedAssets.put('assets',assets); + - rename: + field: json.asset.relatedAssets + target_field: google_scc.asset.related_assets + tag: rename_asset_relatedAssets + ignore_missing: true + - rename: + field: json.asset.resource.discoveryDocumentUri + target_field: google_scc.asset.resource.discovery.document_uri + tag: rename_asset_resource_discoveryDocumentUri + ignore_missing: true + - rename: + field: json.asset.resource.discoveryName + target_field: google_scc.asset.resource.discovery.name + tag: rename_asset_resource_discoveryName + ignore_missing: true + - rename: + field: json.asset.resource.location + target_field: google_scc.asset.resource.location + tag: rename_asset_resource_location + ignore_missing: true + - rename: + field: json.asset.resource.parent + target_field: google_scc.asset.resource.parent + tag: rename_asset_resource_parent + ignore_missing: true + - rename: + field: json.asset.resource.resourceUrl + target_field: google_scc.asset.resource.url + tag: rename_asset_resource_resourceUrl + ignore_missing: true + - rename: + field: json.asset.resource.version + target_field: google_scc.asset.resource.version + tag: rename_asset_resource_version + ignore_missing: true + - rename: + field: json.asset.resource.data + target_field: google_scc.asset.resource.data + tag: rename_asset_resource_data + ignore_missing: true + - rename: + field: json.asset.servicePerimeter.spec.accessLevels + target_field: json.asset.servicePerimeter.spec.access_levels + tag: rename_asset_servicePerimeter_spec_accessLevels + ignore_missing: true + - rename: + field: json.asset.servicePerimeter.spec.restrictedServices + target_field: json.asset.servicePerimeter.spec.restricted_services + tag: rename_asset_servicePerimeter_spec_restrictedServices + ignore_missing: true + - rename: + field: json.asset.servicePerimeter.spec.vpcAccessibleServices.allowedServices + target_field: json.asset.servicePerimeter.spec.vpc_accessible_services.allowed_services + tag: rename_asset_servicePerimeter_spec_vpcAccessibleServices_allowedServices + ignore_missing: true + - convert: + field: json.asset.servicePerimeter.spec.vpcAccessibleServices.enableRestriction + target_field: json.asset.servicePerimeter.spec.vpc_accessible_services.enable_restriction + tag: convert_asset_servicePerimeter_spec_vpcAccessibleServices_enableRestriction_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.asset?.servicePerimeter?.spec?.vpcAccessibleServices?.enableRestriction != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.asset.servicePerimeter.status.restrictedServices + target_field: json.asset.servicePerimeter.status.restricted_services + tag: rename_asset_servicePerimeter_status_restrictedServices + ignore_missing: true + - rename: + field: json.asset.servicePerimeter.status.vpcAccessibleServices.allowedServices + target_field: json.asset.servicePerimeter.status.vpc_accessible_services.allowed_services + tag: rename_asset_servicePerimeter_status_vpcAccessibleServices_allowedServices + ignore_missing: true + - convert: + field: json.asset.servicePerimeter.status.vpcAccessibleServices.enableRestriction + target_field: json.asset.servicePerimeter.status.vpc_accessible_services.enable_restriction + tag: convert_asset_servicePerimeter_status_vpcAccessibleServices_enableRestriction_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.asset?.servicePerimeter?.status?.vpcAccessibleServices?.enableRestriction != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.asset.servicePerimeter.status.accessLevels + target_field: json.asset.servicePerimeter.status.access_levels + tag: rename_asset_servicePerimeter_status_accessLevels + ignore_missing: true + - rename: + field: json.asset.servicePerimeter.perimeterType + target_field: json.asset.servicePerimeter.type + tag: rename_asset_servicePerimeter_perimeterType + ignore_missing: true + - convert: + field: json.asset.servicePerimeter.useExplicitDryRunSpec + target_field: json.asset.servicePerimeter.use_explicit_dry_run_spec + tag: convert_asset_servicePerimeter_useExplicitDryRunSpec_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.asset?.servicePerimeter?.useExplicitDryRunSpec != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.status.egressPolicies objects. + if: ctx.json?.asset?.servicePerimeter?.status?.egressPolicies != null + params: + "egressPolicies": "egress_policies" + "egressFrom": "egress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "egressTo": "egress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_status_egressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def egress_policies = new ArrayList(); + for(entity in ctx.json.asset.servicePerimeter.status.egressPolicies){ + egress_policies.add(renameKeys(entity, params)); + } + ctx.json.asset.servicePerimeter.status.remove('egressPolicies'); + ctx.json.asset.servicePerimeter.status.put('egress_policies',egress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.spec.egressPolicies objects. + if: ctx.json?.asset?.servicePerimeter?.spec?.egressPolicies != null + params: + "egressPolicies": "egress_policies" + "egressFrom": "egress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "egressTo": "egress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_spec_egressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def egress_policies = new ArrayList(); + for(entity in ctx.json.asset.servicePerimeter.spec.egressPolicies){ + egress_policies.add(renameKeys(entity, params)); + } + ctx.json.asset.servicePerimeter.spec.remove('egressPolicies'); + ctx.json.asset.servicePerimeter.spec.put('egress_policies',egress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.spec.ingressPolicies objects. + if: ctx.json?.asset?.servicePerimeter?.spec?.ingressPolicies != null + params: + "ingressPolicies": "ingress_policies" + "ingressFrom": "ingress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "ingressTo": "ingress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_spec_ingressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def ingress_policies = new ArrayList(); + for(entity in ctx.json.asset.servicePerimeter.spec.ingressPolicies){ + ingress_policies.add(renameKeys(entity, params)); + } + ctx.json.asset.servicePerimeter.spec.remove('ingressPolicies'); + ctx.json.asset.servicePerimeter.spec.put('ingress_policies',ingress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.status.ingressPolicies objects. + if: ctx.json?.asset?.servicePerimeter?.status?.ingressPolicies != null + params: + "ingressPolicies": "ingress_policies" + "ingressFrom": "ingress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "ingressTo": "ingress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_status_ingressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def ingress_policies = new ArrayList(); + for(entity in ctx.json.asset.servicePerimeter.status.ingressPolicies){ + ingress_policies.add(renameKeys(entity, params)); + } + ctx.json.asset.servicePerimeter.status.remove('ingressPolicies'); + ctx.json.asset.servicePerimeter.status.put('ingress_policies',ingress_policies); + - rename: + field: json.asset.servicePerimeter + target_field: google_scc.asset.service_perimeter + tag: rename_asset_servicePerimeter + ignore_missing: true + - date: + field: json.asset.updateTime + target_field: google_scc.asset.update_time + tag: date_asset_updateTime + formats: + - ISO8601 + if: ctx.json?.asset?.updateTime != null && ctx.json.asset.updateTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: + - google_scc.asset.service_perimeter.spec.vpcAccessibleServices.enableRestriction + - google_scc.asset.service_perimeter.status.vpcAccessibleServices.enableRestriction + - google_scc.asset.service_perimeter.useExplicitDryRunSpec + tag: remove_converted_fields + ignore_missing: true +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_prior_asset.yml b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_prior_asset.yml new file mode 100644 index 00000000000..c2861991dfc --- /dev/null +++ b/packages/google_scc/data_stream/asset/elasticsearch/ingest_pipeline/pipeline_prior_asset.yml @@ -0,0 +1,880 @@ +--- +processors: + - rename: + field: json.priorAsset.osInventory.osInfo.architecture + target_field: google_scc.asset.prior.os_inventory.os_info.architecture + tag: rename_priorAsset_osInventory_osInfo_architecture + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.hostname + target_field: google_scc.asset.prior.os_inventory.os_info.hostname + tag: rename_priorAsset_osInventory_osInfo_hostname + ignore_missing: true + - rename: + field: json.priorAsset.name + target_field: google_scc.asset.prior.name + tag: rename_priorAsset_name + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.shortName + target_field: google_scc.asset.prior.os_inventory.os_info.short_name + tag: rename_priorAsset_osInventory_osInfo_shortName + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.longName + target_field: google_scc.asset.prior.os_inventory.os_info.long_name + tag: rename_priorAsset_osInventory_osInfo_longName + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.kernelVersion + target_field: google_scc.asset.prior.os_inventory.os_info.kernel.version + tag: rename_priorAsset_osInventory_osInfo_kernelVersion + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.version + target_field: google_scc.asset.prior.os_inventory.os_info.version + tag: rename_priorAsset_osInventory_osInfo_version + ignore_missing: true + - rename: + field: json.priorAsset.assetType + target_field: google_scc.asset.prior.type + tag: rename_priorAsset_assetType + ignore_missing: true + - rename: + field: json.priorAsset.accessLevel.basic.combiningFunction + target_field: json.priorAsset.accessLevel.basic.combining_function + tag: rename_priorAsset_accessLevel_basic_combiningFunction + ignore_missing: true + - rename: + field: json.priorAsset.accessLevel.custom.expr.expression + target_field: json.priorAsset.accessLevel.custom.expr.text + tag: rename_priorAsset_accessLevel_custom_expr_expression + ignore_missing: true + - rename: + field: json.priorAsset.accessLevel.custom.expr + target_field: json.priorAsset.accessLevel.custom.expression + tag: rename_priorAsset_accessLevel_custom_expr + ignore_missing: true + - foreach: + field: json.priorAsset.accessLevel.basic.conditions + if: ctx.json?.priorAsset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.devicePolicy.osConstraints + ignore_failure: true + processor: + convert: + field: _ingest._value.requireVerifiedChromeOs + tag: convert_requireVerifiedChromeOs_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireCorpOwned + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.priorAsset.accessLevel.basic.conditions + if: ctx.json?.priorAsset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.devicePolicy.requireScreenlock + tag: convert_devicePolicy_requireScreenlock_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireScreenlock + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.priorAsset.accessLevel.basic.conditions + if: ctx.json?.priorAsset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.devicePolicy.requireAdminApproval + tag: convert_devicePolicy_requireAdminApproval_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.devicePolicy.requireAdminApproval + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.priorAsset.accessLevel.basic.conditions + if: ctx.json?.priorAsset?.accessLevel?.basic?.conditions instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.negate + tag: convert_negate_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.negate + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the accessLevel.basic.conditions objects. + if: ctx.json?.priorAsset?.accessLevel?.basic?.conditions != null + params: + "conditions": "conditions" + "requiredAccessLevels": "required_access_levels" + "devicePolicy": "device_policy" + "requireScreenlock": "require_screenlock" + "allowedEncryptionStatuses": "allowed_encryption_statuses" + "osConstraints": "os_constraints" + "osType": "os_type" + "minimumVersion": "minimum_version" + "requireVerifiedChromeOs": "require_verified_chrome_os" + "allowedDeviceManagementLevels": "allowed_device_management_levels" + "requireAdminApproval": "require_admin_approval" + "requireCorpOwned": "require_corp_owned" + "ipSubnetworks": "sub_networks" + tag: painless_to_rename_fields_under_accessLevel_basic_conditions_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def conditions = new ArrayList(); + for(entity in ctx.json.priorAsset.accessLevel.basic.conditions){ + conditions.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.accessLevel.basic.remove('conditions'); + ctx.json.priorAsset.accessLevel.basic.put('conditions',conditions); + - rename: + field: json.priorAsset.accessLevel + target_field: google_scc.asset.prior.access_level + tag: rename_priorAsset_accessLevel + ignore_missing: true + - rename: + field: json.priorAsset.accessPolicy + target_field: google_scc.asset.prior.access_policy + tag: rename_priorAsset_accessPolicy + ignore_missing: true + - rename: + field: json.priorAsset.ancestors + target_field: google_scc.asset.prior.ancestors + tag: rename_priorAsset_ancestors + ignore_missing: true + - script: + lang: painless + description: This script processor rename the fields under the iamPolicy.auditConfigs objects. + if: ctx.json?.priorAsset?.iamPolicy?.auditConfigs != null + params: + "auditConfigs": "audit_configs" + "auditLogConfigs": "audit_log_configs" + "logType": "log_type" + "exemptedMembers": "exemted_members" + tag: painless_to_rename_fields_under_iamPolicy_auditConfigs_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def audit_configs = new ArrayList(); + for(entity in ctx.json.priorAsset.iamPolicy.auditConfigs){ + audit_configs.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.iamPolicy.remove('auditConfigs'); + ctx.json.priorAsset.iamPolicy.put('audit_configs',audit_configs); + - convert: + field: json.priorAsset.iamPolicy.version + tag: convert_priorAsset_iamPolicy_version + if: ctx.json?.priorAsset?.iamPolicy?.version != '' + type: string + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.priorAsset.iamPolicy + target_field: google_scc.asset.prior.iam_policy + tag: rename_priorAsset_iamPolicy + ignore_missing: true + - foreach: + field: json.priorAsset.orgPolicy + if: ctx.json?.priorAsset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.version + tag: convert_priorAsset_orgPolicy_version + type: string + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.version + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.priorAsset.orgPolicy + if: ctx.json?.priorAsset?.orgPolicy instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.updateTime + target_field: _ingest._value.updateTime + tag: date_updateTime + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.updateTime + ignore_missing: true + - foreach: + field: json.priorAsset.orgPolicy + if: ctx.json?.priorAsset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.listPolicy.inheritFromParent + tag: convert_orgPolicy_listPolicy_inheritFromParent_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.listPolicy.inheritFromParent + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.priorAsset.orgPolicy + if: ctx.json?.priorAsset?.orgPolicy instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.booleanPolicy.enforced + tag: convert_orgPolicy_booleanPolicy_enforced_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.inbooleanPolicy.enforcedheritFromParent + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the orgPolicy objects. + if: ctx.json?.priorAsset?.orgPolicy != null + params: + "orgPolicy": "organization_policy" + "listPolicy": "list_policy" + "allowedValues": "allowed_values" + "deniedValues": "denied_values" + "allValues": "all_values" + "suggestedValue": "suggested_value" + "restoreDefault": "restore_default" + "updateTime": "update_time" + "inheritFromParent": "inherit_from_parent" + "booleanPolicy": "boolean_policy" + tag: painless_to_rename_fields_under_orgPolicy_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def organization_policy = new ArrayList(); + for(entity in ctx.json.priorAsset.orgPolicy){ + organization_policy.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.remove('orgPolicy'); + ctx.google_scc.asset.prior.put('organization_policy',organization_policy); + - rename: + field: json.priorAsset.osInventory.name + target_field: google_scc.asset.prior.os_inventory.name + tag: rename_priorAsset_osInventory_name + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.kernelRelease + target_field: google_scc.asset.prior.os_inventory.os_info.kernel.release + tag: rename_priorAsset_osInventory_osInfo_kernelRelease + ignore_missing: true + - rename: + field: json.priorAsset.osInventory.osInfo.osconfigAgentVersion + target_field: google_scc.asset.prior.os_inventory.os_info.os_config_agent_version + tag: rename_priorAsset_osInventory_osInfo_osconfigAgentVersion + ignore_missing: true + - date: + field: json.priorAsset.osInventory.updateTime + target_field: google_scc.asset.prior.os_inventory.update_time + tag: date_priorAsset_osInventory_updateTime + formats: + - ISO8601 + if: ctx.json?.priorAsset?.osInventory?.updateTime != null && ctx.json.priorAsset.osInventory.updateTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.priorAsset.relatedAsset.ancestors + target_field: google_scc.asset.prior.related_asset.ancestors + tag: rename_priorAsset_relatedAsset_ancestors + ignore_missing: true + - rename: + field: json.priorAsset.relatedAsset.asset + target_field: google_scc.asset.prior.related_asset.name + tag: rename_priorAsset_relatedAsset_asset + ignore_missing: true + - rename: + field: json.priorAsset.relatedAsset.relationshipType + target_field: google_scc.asset.prior.related_asset.relationship_type + tag: rename_priorAsset_relatedAsset_relationshipType + ignore_missing: true + - rename: + field: json.priorAsset.relatedAsset.assetType + target_field: google_scc.asset.prior.related_asset.type + tag: rename_priorAsset_relatedAsset_assetType + ignore_missing: true + - rename: + field: json.priorAsset.relatedAssets.relationshipAttributes.action + target_field: json.priorAsset.relatedAssets.relationship_attributes.action + tag: rename_priorAsset_relatedAssets_relationshipAttributes_action + ignore_missing: true + - rename: + field: json.priorAsset.relatedAssets.relationshipAttributes.sourceResourceType + target_field: json.priorAsset.relatedAssets.relationship_attributes.source_resource_type + tag: rename_priorAsset_relatedAssets_relationshipAttributes_sourceResourceType + ignore_missing: true + - rename: + field: json.priorAsset.relatedAssets.relationshipAttributes.targetResourceType + target_field: json.priorAsset.relatedAssets.relationship_attributes.target_resource_type + tag: rename_priorAsset_relatedAssets_relationshipAttributes_targetResourceType + ignore_missing: true + - rename: + field: json.priorAsset.relatedAssets.relationshipAttributes.type + target_field: json.priorAsset.relatedAssets.relationship_attributes.type + tag: rename_priorAsset_relatedAssets_relationshipAttributes_type + ignore_missing: true + - script: + lang: painless + description: This script processor rename the fields under the relatedAssets.assets objects. + if: ctx.json?.priorAsset?.relatedAssets?.assets != null + params: + "assets": "assets" + "assetType": "type" + "asset": "name" + "relationshipType": "relationship_type" + tag: painless_to_rename_fields_under_relatedAssets_assets_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def assets = new ArrayList(); + for(entity in ctx.json.priorAsset.relatedAssets.assets){ + assets.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.relatedAssets.put('assets',assets); + - rename: + field: json.priorAsset.relatedAssets + target_field: google_scc.asset.prior.related_assets + tag: rename_priorAsset_relatedAssets + ignore_missing: true + - rename: + field: json.priorAsset.resource.discoveryDocumentUri + target_field: google_scc.asset.prior.resource.discovery.document_uri + tag: rename_priorAsset_resource_discoveryDocumentUri + ignore_missing: true + - rename: + field: json.priorAsset.resource.discoveryName + target_field: google_scc.asset.prior.resource.discovery.name + tag: rename_priorAsset_resource_discoveryName + ignore_missing: true + - rename: + field: json.priorAsset.resource.location + target_field: google_scc.asset.prior.resource.location + tag: rename_priorAsset_resource_location + ignore_missing: true + - rename: + field: json.priorAsset.resource.parent + target_field: google_scc.asset.prior.resource.parent + tag: rename_priorAsset_resource_parent + ignore_missing: true + - rename: + field: json.priorAsset.resource.resourceUrl + target_field: google_scc.asset.prior.resource.url + tag: rename_priorAsset_resource_resourceUrl + ignore_missing: true + - rename: + field: json.priorAsset.resource.version + target_field: google_scc.asset.prior.resource.version + tag: rename_priorAsset_resource_version + ignore_missing: true + - rename: + field: json.priorAsset.resource.data + target_field: google_scc.asset.prior.resource.data + tag: rename_priorAsset_resource_data + ignore_missing: true + - rename: + field: json.priorAsset.servicePerimeter.spec.accessLevels + target_field: json.priorAsset.servicePerimeter.spec.access_levels + tag: rename_priorAsset_servicePerimeter_spec_accessLevels + ignore_missing: true + - rename: + field: json.priorAsset.servicePerimeter.spec.restrictedServices + target_field: json.priorAsset.servicePerimeter.spec.restricted_services + tag: rename_priorAsset_servicePerimeter_spec_restrictedServices + ignore_missing: true + - rename: + field: json.priorAsset.servicePerimeter.spec.vpcAccessibleServices.allowedServices + target_field: json.priorAsset.servicePerimeter.spec.vpc_accessible_services.allowed_services + tag: rename_priorAsset_servicePerimeter_spec_vpcAccessibleServices_allowedServices + ignore_missing: true + - convert: + field: json.priorAsset.servicePerimeter.spec.vpcAccessibleServices.enableRestriction + target_field: json.priorAsset.servicePerimeter.spec.vpc_accessible_services.enable_restriction + tag: convert_priorAsset_servicePerimeter_spec_vpcAccessibleServices_enableRestriction_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.priorAsset?.servicePerimeter?.spec?.vpcAccessibleServices?.enableRestriction != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.priorAsset.servicePerimeter.status.restrictedServices + target_field: json.priorAsset.servicePerimeter.status.restricted_services + tag: rename_priorAsset_servicePerimeter_status_restrictedServices + ignore_missing: true + - rename: + field: json.priorAsset.servicePerimeter.status.vpcAccessibleServices.allowedServices + target_field: json.priorAsset.servicePerimeter.status.vpc_accessible_services.allowed_services + tag: rename_priorAsset_servicePerimeter_status_vpcAccessibleServices_allowedServices + ignore_missing: true + - convert: + field: json.priorAsset.servicePerimeter.status.vpcAccessibleServices.enableRestriction + target_field: json.priorAsset.servicePerimeter.status.vpc_accessible_services.enable_restriction + tag: convert_priorAsset_servicePerimeter_status_vpcAccessibleServices_enableRestriction_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.priorAsset?.servicePerimeter?.status?.vpcAccessibleServices?.enableRestriction != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.priorAsset.servicePerimeter.status.accessLevels + target_field: json.priorAsset.servicePerimeter.status.access_levels + tag: rename_priorAsset_servicePerimeter_status_accessLevels + ignore_missing: true + - rename: + field: json.priorAsset.servicePerimeter.perimeterType + target_field: json.priorAsset.servicePerimeter.type + tag: rename_priorAsset_servicePerimeter_perimeterType + ignore_missing: true + - convert: + field: json.priorAsset.servicePerimeter.useExplicitDryRunSpec + target_field: json.priorAsset.servicePerimeter.use_explicit_dry_run_spec + tag: convert_priorAsset_servicePerimeter_useExplicitDryRunSpec_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.priorAsset?.servicePerimeter?.useExplicitDryRunSpec != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.status.egressPolicies objects. + if: ctx.json?.priorAsset?.servicePerimeter?.status?.egressPolicies != null + params: + "egressPolicies": "egress_policies" + "egressFrom": "egress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "egressTo": "egress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_status_egressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def egress_policies = new ArrayList(); + for(entity in ctx.json.priorAsset.servicePerimeter.status.egressPolicies){ + egress_policies.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.servicePerimeter.status.remove('egressPolicies'); + ctx.json.priorAsset.servicePerimeter.status.put('egress_policies',egress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.spec.egressPolicies objects. + if: ctx.json?.priorAsset?.servicePerimeter?.spec?.egressPolicies != null + params: + "egressPolicies": "egress_policies" + "egressFrom": "egress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "egressTo": "egress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_spec_egressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def egress_policies = new ArrayList(); + for(entity in ctx.json.priorAsset.servicePerimeter.spec.egressPolicies){ + egress_policies.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.servicePerimeter.spec.remove('egressPolicies'); + ctx.json.priorAsset.servicePerimeter.spec.put('egress_policies',egress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.spec.ingressPolicies objects. + if: ctx.json?.priorAsset?.servicePerimeter?.spec?.ingressPolicies != null + params: + "ingressPolicies": "ingress_policies" + "ingressFrom": "ingress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "ingressTo": "ingress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_spec_ingressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def ingress_policies = new ArrayList(); + for(entity in ctx.json.priorAsset.servicePerimeter.spec.ingressPolicies){ + ingress_policies.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.servicePerimeter.spec.remove('ingressPolicies'); + ctx.json.priorAsset.servicePerimeter.spec.put('ingress_policies',ingress_policies); + - script: + lang: painless + description: This script processor rename the fields under the servicePerimeter.status.ingressPolicies objects. + if: ctx.json?.priorAsset?.servicePerimeter?.status?.ingressPolicies != null + params: + "ingressPolicies": "ingress_policies" + "ingressFrom": "ingress_from" + "sources": "sources" + "accessLevel": "access_level" + "identityType": "identity_type" + "ingressTo": "ingress_to" + "operations": "operations" + "methodSelectors": "method_selectors" + "serviceName": "service_name" + tag: painless_to_rename_fields_under_servicePerimeter_status_ingressPolicies_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def ingress_policies = new ArrayList(); + for(entity in ctx.json.priorAsset.servicePerimeter.status.ingressPolicies){ + ingress_policies.add(renameKeys(entity, params)); + } + ctx.json.priorAsset.servicePerimeter.status.remove('ingressPolicies'); + ctx.json.priorAsset.servicePerimeter.status.put('ingress_policies',ingress_policies); + - rename: + field: json.priorAsset.servicePerimeter + target_field: google_scc.asset.prior.service_perimeter + tag: rename_priorAsset_servicePerimeter + ignore_missing: true + - date: + field: json.priorAsset.updateTime + target_field: google_scc.asset.prior.update_time + tag: date_priorAsset_updateTime + formats: + - ISO8601 + if: ctx.json?.priorAsset?.updateTime != null && ctx.json.priorAsset.updateTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: + - google_scc.asset.prior.service_perimeter.spec.vpcAccessibleServices.enableRestriction + - google_scc.asset.prior.service_perimeter.status.vpcAccessibleServices.enableRestriction + - google_scc.asset.prior.service_perimeter.useExplicitDryRunSpec + tag: remove_converted_fields + ignore_missing: true +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/asset/fields/base-fields.yml b/packages/google_scc/data_stream/asset/fields/base-fields.yml new file mode 100644 index 00000000000..312916fd915 --- /dev/null +++ b/packages/google_scc/data_stream/asset/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: google_scc +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: google_scc.asset +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/google_scc/data_stream/asset/fields/beats.yml b/packages/google_scc/data_stream/asset/fields/beats.yml new file mode 100644 index 00000000000..2d5ae254634 --- /dev/null +++ b/packages/google_scc/data_stream/asset/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/google_scc/data_stream/asset/fields/fields.yml b/packages/google_scc/data_stream/asset/fields/fields.yml new file mode 100644 index 00000000000..c8714d9dca1 --- /dev/null +++ b/packages/google_scc/data_stream/asset/fields/fields.yml @@ -0,0 +1,1161 @@ +- name: google_scc + type: group + fields: + - name: asset + type: group + fields: + - name: access_level + type: group + fields: + - name: basic + type: group + fields: + - name: combining_function + type: keyword + description: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied. Default behavior is AND. + - name: conditions + type: group + fields: + - name: device_policy + type: group + fields: + - name: allowed_device_management_levels + type: keyword + description: Allowed device management levels, an empty list allows all management levels. + - name: allowed_encryption_statuses + type: keyword + description: Allowed encryptions statuses, an empty list allows all statuses. + - name: os_constraints + type: group + fields: + - name: minimum_version + type: keyword + description: 'The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch". Examples: "10.5.301", "9.2.1".' + - name: os_type + type: keyword + description: Required. The allowed OS type. + - name: require_verified_chrome_os + type: boolean + description: Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request. + - name: require_admin_approval + type: boolean + description: Whether the device needs to be approved by the customer admin. + - name: require_corp_owned + type: boolean + description: Whether the device needs to be corp owned. + - name: require_screenlock + type: boolean + description: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false. + - name: members + type: keyword + description: 'The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: user:{emailid} serviceAccount:{emailid} If not specified, a request may come from any user.' + - name: negate + type: boolean + description: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false. + - name: regions + type: keyword + description: The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes. + - name: required_access_levels + type: keyword + description: 'A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME".' + - name: custom + type: group + fields: + - name: expression + type: group + fields: + - name: description + type: keyword + description: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. + - name: location + type: keyword + description: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. + - name: text + type: keyword + description: Textual representation of an expression in Common Expression Language syntax. + - name: title + type: keyword + description: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. + - name: description + type: keyword + description: Description of the AccessLevel and its use. Does not affect behavior. + - name: name + type: keyword + description: 'Required. Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and ''_''. Format: accessPolicies/{accessPolicy}/accessLevels/{accessLevel}. The maximum length of the accessLevel component is 50 characters.' + - name: title + type: keyword + description: Human readable title. Must be unique within the Policy. + - name: access_policy + type: group + fields: + - name: etag + type: keyword + description: Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. + - name: name + type: keyword + description: 'Output only. Resource name of the AccessPolicy. Format: accessPolicies/{accessPolicy}.' + - name: parent + type: keyword + description: 'Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/{organization_id}.' + - name: scopes + type: keyword + description: 'The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/{folder_number} or projects/{project_number}.' + - name: title + type: keyword + description: Required. Human readable title. Does not affect behavior. + - name: ancestors + type: keyword + description: "The ancestry path of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. If the asset is a project, folder, or organization, the ancestry path starts from the asset itself. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: iam_policy + type: group + fields: + - name: audit_configs + type: group + fields: + - name: audit_log_configs + type: group + fields: + - name: exemted_members + type: keyword + description: Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members. + - name: log_type + type: keyword + description: The log type that this config enables. + - name: service + type: keyword + description: Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services. + - name: bindings + type: group + fields: + - name: condition + type: flattened + description: "The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation." + - name: members + type: keyword + description: |- + Specifies the principals requesting access for a Google Cloud resource. members can have the following values: + + allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. + + allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. + + user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . + + serviceAccount:{emailid}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com. + + serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa]. + + group:{emailid}: An email address that represents a Google group. For example, admins@example.com. + + deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. + + deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. + + deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. + + domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com. + - name: role + type: keyword + description: Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner. + - name: etag + type: keyword + description: "etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. A base64-encoded string." + - name: version + type: keyword + description: "Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: Getting a policy that includes a conditional role binding.Adding a conditional role binding to a policy.Changing a conditional role binding in a policy.Removing any role binding, with or without a condition, from a policy that includes conditions.Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: organization_policy + type: group + fields: + - name: boolean_policy + type: group + fields: + - name: enforced + type: boolean + description: If true, then the Policy is enforced. If false, then any configuration is acceptable. + - name: constraint + type: keyword + description: "The name of the Constraint the Policy is configuring, for example, constraints/serviceuser.services. A list of available constraints is available. Immutable after creation." + - name: etag + type: keyword + description: "An opaque tag indicating the current version of the Policy, used for concurrency control. When the Policy is returned from either a policies.get or a ListOrgPolicy request, this etag indicates the version of the current Policy to use when executing a read-modify-write loop. When the Policy is returned from a policies.getEffectivePolicy request, the etag will be unset. When the Policy is used in a SetOrgPolicy method, use the etag value that was returned from a GetOrgPolicy request as part of a read-modify-write loop for concurrency control. Not setting the etagin a SetOrgPolicy request will result in an unconditional write of the Policy. A base64-encoded string." + - name: list_policy + type: group + fields: + - name: all_values + type: keyword + description: The policy allValues state. + - name: allowed_values + type: keyword + description: List of values allowed at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. + - name: denied_values + type: keyword + description: List of values denied at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. + - name: inherit_from_parent + type: boolean + description: Determines the inheritance behavior for this Policy. + - name: suggested_value + type: keyword + description: Optional. The Google Cloud Console will try to default to a configuration that matches the value specified in this Policy. If suggestedValue is not set, it will inherit the value specified higher in the hierarchy, unless inheritFromParent is false. + - name: restore_default + type: group + fields: + - name: etag + type: keyword + description: Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. + - name: name + type: keyword + description: 'Output only. Resource name of the AccessPolicy. Format: accessPolicies/{accessPolicy}.' + - name: parent + type: keyword + description: 'Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/{organization_id}.' + - name: scopes + type: keyword + description: 'The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/{folder_number} or projects/{project_number}.' + - name: title + type: keyword + description: Required. Human readable title. Does not affect behavior. + - name: update_time + type: date + description: "The time stamp the Policy was previously updated. This is set by the server, not specified by the caller, and represents the last time a call to SetOrgPolicy was made for that Policy. Any value set by the client will be ignored. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: version + type: keyword + description: Version of the Policy. Default version is 0. + - name: os_inventory + type: group + fields: + - name: items + type: flattened + - name: name + type: keyword + description: "Output only. The Inventory API resource name. Format: projects/{project_number}/locations/{location}/instances/{instance_id}/inventory." + - name: os_info + type: group + fields: + - name: architecture + type: keyword + description: The system architecture of the operating system. + - name: hostname + type: keyword + description: The VM hostname. + - name: kernel + type: group + fields: + - name: release + type: keyword + description: The kernel release of the operating system. + - name: version + type: keyword + description: The kernel version of the operating system. + - name: long_name + type: keyword + description: The operating system long name. For example 'Debian GNU/Linux 9' or 'Microsoft Window Server 2019 Datacenter'. + - name: os_config_agent_version + type: keyword + description: The current version of the OS Config agent running on the VM. + - name: short_name + type: keyword + description: The operating system short name. For example, 'windows' or 'debian'. + - name: version + type: keyword + description: The version of the operating system. + - name: update_time + type: date + description: "Output only. Timestamp of the last reported inventory for the VM. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: prior + type: group + fields: + - name: access_level + type: group + fields: + - name: basic + type: group + fields: + - name: combining_function + type: keyword + description: How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied. Default behavior is AND. + - name: conditions + type: group + fields: + - name: device_policy + type: group + fields: + - name: allowed_device_management_levels + type: keyword + description: Allowed device management levels, an empty list allows all management levels. + - name: allowed_encryption_statuses + type: keyword + description: Allowed encryptions statuses, an empty list allows all statuses. + - name: os_constraints + type: group + fields: + - name: minimum_version + type: keyword + description: 'The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch". Examples: "10.5.301", "9.2.1".' + - name: os_type + type: keyword + description: Required. The allowed OS type. + - name: require_verified_chrome_os + type: boolean + description: Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request. + - name: require_admin_approval + type: boolean + description: Whether the device needs to be approved by the customer admin. + - name: require_corp_owned + type: boolean + description: Whether the device needs to be corp owned. + - name: require_screenlock + type: boolean + description: Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false. + - name: sub_networks + type: keyword + description: CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed. + - name: members + type: keyword + description: 'The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: user:{emailid} serviceAccount:{emailid} If not specified, a request may come from any user.' + - name: negate + type: boolean + description: Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false. + - name: regions + type: keyword + description: The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes. + - name: required_access_levels + type: keyword + description: 'A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME".' + - name: custom + type: group + fields: + - name: expression + type: group + fields: + - name: description + type: keyword + description: Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. + - name: location + type: keyword + description: Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. + - name: text + type: keyword + description: Textual representation of an expression in Common Expression Language syntax. + - name: title + type: keyword + description: Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. + - name: description + type: keyword + description: Description of the AccessLevel and its use. Does not affect behavior. + - name: name + type: keyword + description: 'Required. Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and ''_''. Format: accessPolicies/{accessPolicy}/accessLevels/{accessLevel}. The maximum length of the accessLevel component is 50 characters.' + - name: title + type: keyword + description: Human readable title. Must be unique within the Policy. + - name: access_policy + type: group + fields: + - name: etag + type: keyword + description: Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. + - name: name + type: keyword + description: 'Output only. Resource name of the AccessPolicy. Format: accessPolicies/{accessPolicy}.' + - name: parent + type: keyword + description: 'Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/{organization_id}' + - name: scopes + type: keyword + description: 'The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/{folder_number} or projects/{project_number}.' + - name: title + type: keyword + description: Required. Human readable title. Does not affect behavior. + - name: ancestors + type: keyword + description: "The ancestry path of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. If the asset is a project, folder, or organization, the ancestry path starts from the asset itself. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: iam_policy + type: group + fields: + - name: audit_configs + type: group + fields: + - name: audit_log_configs + type: group + fields: + - name: exemted_members + type: keyword + description: Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members. + - name: log_type + type: keyword + description: The log type that this config enables. + - name: service + type: keyword + description: Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services. + - name: bindings + type: group + fields: + - name: condition + type: flattened + description: "The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation." + - name: members + type: keyword + description: |- + Specifies the principals requesting access for a Google Cloud resource. members can have the following values: + + allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. + + allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. + + user:{emailid}: An email address that represents a specific Google account. For example, alice@example.com . + + serviceAccount:{emailid}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com. + + serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa]. + + group:{emailid}: An email address that represents a Google group. For example, admins@example.com. + + deleted:user:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:{emailid} and the recovered user retains the role in the binding. + + deleted:serviceAccount:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:{emailid} and the undeleted service account retains the role in the binding. + + deleted:group:{emailid}?uid={uniqueid}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:{emailid} and the recovered group retains the role in the binding. + + domain:{domain}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com. + - name: role + type: keyword + description: Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner. + - name: etag + type: keyword + description: "etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. A base64-encoded string." + - name: version + type: keyword + description: "Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: Getting a policy that includes a conditional role binding.Adding a conditional role binding to a policy.Changing a conditional role binding in a policy.Removing any role binding, with or without a condition, from a policy that includes conditions.Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: organization_policy + type: group + fields: + - name: boolean_policy + type: group + fields: + - name: enforced + type: boolean + description: If true, then the Policy is enforced. If false, then any configuration is acceptable. + - name: constraint + type: keyword + description: "The name of the Constraint the Policy is configuring, for example, constraints/serviceuser.services. A list of available constraints is available. Immutable after creation." + - name: etag + type: keyword + description: "An opaque tag indicating the current version of the Policy, used for concurrency control. When the Policy is returned from either a policies.get or a ListOrgPolicy request, this etag indicates the version of the current Policy to use when executing a read-modify-write loop. When the Policy is returned from a policies.getEffectivePolicy request, the etag will be unset. When the Policy is used in a SetOrgPolicy method, use the etag value that was returned from a GetOrgPolicy request as part of a read-modify-write loop for concurrency control. Not setting the etagin a SetOrgPolicy request will result in an unconditional write of the Policy. A base64-encoded string." + - name: list_policy + type: group + fields: + - name: all_values + type: keyword + description: The policy allValues state. + - name: allowed_values + type: keyword + description: List of values allowed at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. + - name: denied_values + type: keyword + description: List of values denied at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. + - name: inherit_from_parent + type: boolean + description: Determines the inheritance behavior for this Policy. + - name: suggested_value + type: keyword + description: Optional. The Google Cloud Console will try to default to a configuration that matches the value specified in this Policy. If suggestedValue is not set, it will inherit the value specified higher in the hierarchy, unless inheritFromParent is false. + - name: restore_default + type: group + fields: + - name: etag + type: keyword + description: Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. + - name: name + type: keyword + description: 'Output only. Resource name of the AccessPolicy. Format: accessPolicies/{accessPolicy}.' + - name: parent + type: keyword + description: 'Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/{organization_id}.' + - name: scopes + type: keyword + description: 'The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/{folder_number} or projects/{project_number}' + - name: title + type: keyword + description: Required. Human readable title. Does not affect behavior. + - name: update_time + type: date + description: "The time stamp the Policy was previously updated. This is set by the server, not specified by the caller, and represents the last time a call to SetOrgPolicy was made for that Policy. Any value set by the client will be ignored. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: version + type: keyword + description: Version of the Policy. Default version is 0. + - name: os_inventory + type: group + fields: + - name: items + type: flattened + - name: name + type: keyword + description: "Output only. The Inventory API resource name. Format: projects/{project_number}/locations/{location}/instances/{instance_id}/inventory." + - name: os_info + type: group + fields: + - name: architecture + type: keyword + description: The system architecture of the operating system. + - name: hostname + type: keyword + description: The VM hostname. + - name: kernel + type: group + fields: + - name: release + type: keyword + description: The kernel release of the operating system. + - name: version + type: keyword + description: The kernel version of the operating system. + - name: long_name + type: keyword + description: The operating system long name. For example 'Debian GNU/Linux 9' or 'Microsoft Window Server 2019 Datacenter'. + - name: os_config_agent_version + type: keyword + description: The current version of the OS Config agent running on the VM. + - name: short_name + type: keyword + description: The operating system short name. For example, 'windows' or 'debian'. + - name: version + type: keyword + description: The version of the operating system. + - name: update_time + type: date + description: "Output only. Timestamp of the last reported inventory for the VM. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: related_asset + type: group + fields: + - name: ancestors + type: keyword + description: "The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: relationship_type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP' + - name: type + type: keyword + description: "The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information." + - name: related_assets + type: group + fields: + - name: assets + type: group + fields: + - name: ancestors + type: keyword + description: "The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: relationship_type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP' + - name: type + type: keyword + description: "The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information." + - name: relationship_attributes + type: group + fields: + - name: action + type: keyword + description: The detail of the relationship, e.g. contains, attaches. + - name: source_resource_type + type: keyword + description: 'The source asset type. Example: compute.googleapis.com/Instance.' + - name: target_resource_type + type: keyword + description: 'The target asset type. Example: compute.googleapis.com/Disk.' + - name: type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP.' + - name: resource + type: group + fields: + - name: data + type: flattened + description: The content of the resource, in which some sensitive fields are removed and may not be present. + - name: discovery + type: group + fields: + - name: document_uri + type: keyword + description: |- + The URL of the discovery document containing the resource's JSON schema. Example: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest + + This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. + - name: name + type: keyword + description: |- + The JSON schema name listed in the discovery document. Example: Project + + This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. + - name: location + type: keyword + description: The location of the resource in Google Cloud, such as its zone and region. For more information, see https://cloud.google.com/about/locations/. + - name: parent + type: keyword + description: |- + The full name of the immediate parent of this resource. See Resource Names for more information. + + For Google Cloud assets, this value is the parent resource defined in the Cloud IAM policy hierarchy. Example: //cloudresourcemanager.googleapis.com/projects/my_project_123 + + For third-party assets, this field may be set differently. + - name: url + type: keyword + description: |- + The REST URL for accessing the resource. An HTTP GET request using this URL returns the resource itself. Example:https://cloudresourcemanager.googleapis.com/v1/projects/my-project-1233 + + This value is unspecified for resources without a REST API. + - name: version + type: keyword + description: 'The API version. Example: v1.' + - name: service_perimeter + type: group + fields: + - name: description + type: keyword + description: Description of the ServicePerimeter and its use. Does not affect behavior. + - name: name + type: keyword + description: 'Required. Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and ''_''. Format: accessPolicies/{accessPolicy}/servicePerimeters/{servicePerimeter}.' + - name: spec + type: group + fields: + - name: access_levels + type: keyword + description: 'A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.' + - name: egress_policies + type: group + fields: + - name: egress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: egress_to + type: group + fields: + - name: external_resources + type: keyword + description: 'A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently ''*'' is not allowed.' + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. + - name: ingress_policies + type: group + fields: + - name: ingress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: sources + type: group + fields: + - name: access_level + type: keyword + description: 'An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for accessLevel, then all IngressSources will be allowed.' + - name: resource + type: keyword + description: 'A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/{project_number} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.' + - name: ingress_to + type: group + fields: + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed. + - name: resources + type: keyword + description: 'A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}.' + - name: restricted_services + type: keyword + description: Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. + - name: vpc_accessible_services + type: group + fields: + - name: allowed_services + type: keyword + description: The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. + - name: enable_restriction + type: boolean + description: Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. + - name: status + type: group + fields: + - name: access_levels + type: keyword + description: 'A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.' + - name: egress_policies + type: group + fields: + - name: egress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: egress_to + type: group + fields: + - name: external_resources + type: keyword + description: 'A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently ''*'' is not allowed.' + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. + - name: ingress_policies + type: group + fields: + - name: ingress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: sources + type: group + fields: + - name: access_level + type: keyword + description: 'An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for accessLevel, then all IngressSources will be allowed.' + - name: resource + type: keyword + description: 'A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/{project_number} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.' + - name: ingress_to + type: group + fields: + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed. + - name: resources + type: keyword + description: 'A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}.' + - name: restricted_services + type: keyword + description: Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. + - name: vpc_accessible_services + type: group + fields: + - name: allowed_services + type: keyword + description: The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. + - name: enable_restriction + type: boolean + description: Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. + - name: title + type: keyword + description: Human readable title. Must be unique within the Policy. + - name: type + type: keyword + description: Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. + - name: use_explicit_dry_run_spec + type: boolean + description: Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. useExplicitDryRunSpec must bet set to True if any of the fields in the spec are set to non-default values. + - name: type + type: keyword + description: 'The type of the asset. Example: compute.googleapis.com/Disk.See Supported asset types for more information.' + - name: update_time + type: date + description: "The last update timestamp of an asset. updateTime is updated when create/update/delete operation is performed. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: prior_asset_state + type: keyword + - name: related_asset + type: group + fields: + - name: ancestors + type: keyword + description: "The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: relationship_type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP.' + - name: type + type: keyword + description: "The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information." + - name: related_assets + type: group + fields: + - name: assets + type: group + fields: + - name: ancestors + type: keyword + description: "The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: [\"projects/123456789\", \"folders/5432\", \"organizations/1234\"]." + - name: name + type: keyword + description: "The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information." + - name: relationship_type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP.' + - name: type + type: keyword + description: "The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information." + - name: relationship_attributes + type: group + fields: + - name: action + type: keyword + description: The detail of the relationship, e.g. contains, attaches. + - name: source_resource_type + type: keyword + description: 'The source asset type. Example: compute.googleapis.com/Instance.' + - name: target_resource_type + type: keyword + description: 'The target asset type. Example: compute.googleapis.com/Disk.' + - name: type + type: keyword + description: 'The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP.' + - name: resource + type: group + fields: + - name: data + type: flattened + description: The content of the resource, in which some sensitive fields are removed and may not be present. + - name: discovery + type: group + fields: + - name: document_uri + type: keyword + description: |- + The URL of the discovery document containing the resource's JSON schema. Example: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest + + This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. + - name: name + type: keyword + description: |- + The JSON schema name listed in the discovery document. Example: Project + + This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. + - name: location + type: keyword + description: The location of the resource in Google Cloud, such as its zone and region. For more information, see https://cloud.google.com/about/locations/. + - name: parent + type: keyword + description: |- + The full name of the immediate parent of this resource. See Resource Names for more information. + + For Google Cloud assets, this value is the parent resource defined in the Cloud IAM policy hierarchy. Example: //cloudresourcemanager.googleapis.com/projects/my_project_123 + + For third-party assets, this field may be set differently. + - name: url + type: keyword + description: |- + The REST URL for accessing the resource. An HTTP GET request using this URL returns the resource itself. Example:https://cloudresourcemanager.googleapis.com/v1/projects/my-project-1233 + + This value is unspecified for resources without a REST API. + - name: version + type: keyword + description: 'The API version. Example: v1.' + - name: service_perimeter + type: group + fields: + - name: description + type: keyword + description: Description of the ServicePerimeter and its use. Does not affect behavior. + - name: name + type: keyword + description: 'Required. Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and ''_''. Format: accessPolicies/{accessPolicy}/servicePerimeters/{servicePerimeter}.' + - name: spec + type: group + fields: + - name: access_levels + type: keyword + description: 'A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.' + - name: egress_policies + type: group + fields: + - name: egress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: egress_to + type: group + fields: + - name: external_resources + type: keyword + description: 'A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently ''*'' is not allowed.' + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. + - name: ingress_policies + type: group + fields: + - name: ingress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: sources + type: group + fields: + - name: access_level + type: keyword + description: 'An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for accessLevel, then all IngressSources will be allowed.' + - name: resource + type: keyword + description: 'A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/{project_number} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.' + - name: ingress_to + type: group + fields: + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed. + - name: resources + type: keyword + description: 'A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}.' + - name: restricted_services + type: keyword + description: Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. + - name: vpc_accessible_services + type: group + fields: + - name: allowed_services + type: keyword + description: The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. + - name: enable_restriction + type: boolean + description: Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. + - name: status + type: group + fields: + - name: access_levels + type: keyword + description: 'A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty.' + - name: egress_policies + type: group + fields: + - name: egress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: egress_to + type: group + fields: + - name: external_resources + type: keyword + description: 'A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently ''*'' is not allowed.' + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If * is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. + - name: ingress_policies + type: group + fields: + - name: ingress_from + type: group + fields: + - name: identities + type: keyword + description: A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. + - name: identity_type + type: keyword + description: Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. + - name: sources + type: group + fields: + - name: access_level + type: keyword + description: 'An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single * is specified for accessLevel, then all IngressSources will be allowed.' + - name: resource + type: keyword + description: 'A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/{project_number} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. * is not allowed, the case of allowing all Google Cloud resources only is not supported.' + - name: ingress_to + type: group + fields: + - name: operations + type: group + fields: + - name: method_selectors + type: group + fields: + - name: method + type: keyword + description: Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If * used as value for method, then ALL methods and permissions are allowed. + - name: permission + type: keyword + description: Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. + - name: service_name + type: keyword + description: The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to * will allow all methods AND permissions for all services. + - name: resources + type: keyword + description: A list of resources, currently only projects in the form projects/, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single * is specified, then access to all resources inside the perimeter are allowed. + - name: resources + type: keyword + description: 'A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/{project_number}.' + - name: restricted_services + type: keyword + description: Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. + - name: vpc_accessible_services + type: group + fields: + - name: allowed_services + type: keyword + description: The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. + - name: enable_restriction + type: boolean + description: Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. + - name: title + type: keyword + description: Human readable title. Must be unique within the Policy. + - name: type + type: keyword + description: Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. + - name: use_explicit_dry_run_spec + type: boolean + description: Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. useExplicitDryRunSpec must bet set to True if any of the fields in the spec are set to non-default values. + - name: type + type: keyword + description: 'The type of the asset. Example: compute.googleapis.com/Disk.See Supported asset types for more information.' + - name: update_time + type: date + description: "The last update timestamp of an asset. updateTime is updated when create/update/delete operation is performed. A timestamp in RFC3339 UTC \"Zulu\" format, with nanosecond resolution and up to nine fractional digits. Examples: \"2014-10-02T15:01:23Z\" and \"2014-10-02T15:01:23.045123456Z\"." + - name: window + type: group + fields: + - name: start_time + type: date diff --git a/packages/google_scc/data_stream/asset/manifest.yml b/packages/google_scc/data_stream/asset/manifest.yml new file mode 100644 index 00000000000..e232090f0f9 --- /dev/null +++ b/packages/google_scc/data_stream/asset/manifest.yml @@ -0,0 +1,180 @@ +title: Collect Asset logs from Google Security Command Center. +type: logs +streams: + - input: httpjson + enabled: false + title: Asset logs + description: Collect Asset logs from Google Security Command Center. + template_path: httpjson.yml.hbs + vars: + - name: url + type: text + title: Google SCC API Host + description: The Google SCC API Host. + multi: false + required: true + show_user: false + default: https://cloudasset.googleapis.com + - name: interval + type: text + title: Interval + description: "Duration between requests to the Google SCC API. NOTE: Supported units for this parameter are h/m/s." + default: 1h + multi: false + required: true + show_user: true + - name: content_type + type: select + title: Content Type + description: Asset content type. If not specified, no content but the asset name will be returned. + multi: false + options: + - value: RESOURCE + text: RESOURCE + - value: IAM_POLICY + text: IAM_POLICY + - value: ORG_POLICY + text: ORG_POLICY + - value: ACCESS_POLICY + text: ACCESS_POLICY + - value: OS_INVENTORY + text: OS_INVENTORY + - value: RELATIONSHIP + text: RELATIONSHIP + - value: CONTENT_TYPE_UNSPECIFIED + text: CONTENT_TYPE_UNSPECIFIED + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the Google SCC API. The maximum supported batch size value is 1000. + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-asset + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.asset fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: gcp-pubsub + enabled: false + title: Asset logs + description: Collect Asset logs from Google Security Command Center. + template_path: gcp-pubsub.yml.hbs + vars: + - name: topic + type: text + title: Topic + multi: false + required: true + show_user: true + description: Name of the topic where the logs are written to. + - name: subscription_name + type: text + title: Subscription Name + multi: false + required: true + show_user: true + description: Use the short subscription name here, not the full-blown path with the project ID. You can find it as 'Subscription ID' on the Google Cloud Console. + - name: subscription_create + type: bool + title: Subscription Create + description: If true, the integration will create the subscription on start. + multi: false + required: false + show_user: false + default: true + - name: subscription_num_goroutines + type: text + title: Subscription Num Goroutines + description: Number of goroutines created to read from the subscription. This does not limit the number of messages that can be processed concurrently or the maximum number of goroutines the input will create. + multi: false + required: false + show_user: false + default: 1 + - name: subscription_max_outstanding_messages + type: text + title: Subscription Max Outstanding Messages + description: The maximum number of unprocessed messages (unacknowledged but not yet expired). If the value is negative, then there will be no limit on the number of unprocessed messages. Default is 1000. + multi: false + required: false + show_user: false + default: 1000 + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-asset + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.asset fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: alternative_host + type: text + title: Alternative host + multi: false + required: false + show_user: false + description: "Overrides the default Pub/Sub service address and disables TLS. For testing." diff --git a/packages/google_scc/data_stream/asset/sample_event.json b/packages/google_scc/data_stream/asset/sample_event.json new file mode 100644 index 00000000000..86c67a2219f --- /dev/null +++ b/packages/google_scc/data_stream/asset/sample_event.json @@ -0,0 +1,108 @@ +{ + "@timestamp": "2023-07-03T06:24:10.638Z", + "agent": { + "ephemeral_id": "7ab58b6a-e33a-470d-b529-80d7f867ce64", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.asset", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "created": "2023-07-03T06:24:26.934Z", + "dataset": "google_scc.asset", + "id": "f14c38ac40-2", + "ingested": "2023-07-03T06:24:30Z", + "kind": "event", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "prior": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "resource": { + "data": { + "analyticsEnabled": true, + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "type": "logging.googleapis.com/LogBucket", + "update_time": "2023-05-27T18:53:48.843Z" + }, + "prior_asset_state": "PRESENT", + "resource": { + "data": { + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "update_time": "2023-05-28T06:59:48.052Z", + "window": { + "start_time": "2023-05-28T06:59:48.052Z" + } + } + }, + "host": { + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "type": "logging.googleapis.com/LogBucket" + }, + "input": { + "type": "gcp-pubsub" + }, + "related": { + "hosts": [ + "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default" + ] + }, + "tags": [ + "forwarded", + "google_scc-asset" + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log new file mode 100644 index 00000000000..308fdc98704 --- /dev/null +++ b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log @@ -0,0 +1 @@ +{"protoPayload":{"@type":"type.googleapis.com/google.cloud.audit.AuditLog","authenticationInfo":{"principalEmail":"test-user@example.net"},"requestMetadata":{"callerIp":"175.16.199.1","requestAttributes":{},"destinationAttributes":{}},"serviceName":"login.googleapis.com","methodName":"google.login.LoginService.loginFailure","resourceName":"organizations/123"},"insertId":"-nahbepd4l1x","resource":{"type":"audited_resource"},"httpRequest":{"remoteIp":"FE80::0202:B3FF:FE1E:1010"},"timestamp":"2021-09-24T16:16:57.183212Z","severity":"NOTICE","logName":"organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access","receiveTimestamp":"2021-09-24T17:51:25.034361197Z"} diff --git a/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json new file mode 100644 index 00000000000..808017cb9dc --- /dev/null +++ b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -0,0 +1,79 @@ +{ + "expected": [ + { + "@timestamp": "2021-09-24T16:16:57.183Z", + "cloud": { + "service": { + "name": "login.googleapis.com" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "google.login.LoginService.loginFailure", + "id": "-nahbepd4l1x", + "kind": "event", + "original": "{\"protoPayload\":{\"@type\":\"type.googleapis.com/google.cloud.audit.AuditLog\",\"authenticationInfo\":{\"principalEmail\":\"test-user@example.net\"},\"requestMetadata\":{\"callerIp\":\"175.16.199.1\",\"requestAttributes\":{},\"destinationAttributes\":{}},\"serviceName\":\"login.googleapis.com\",\"methodName\":\"google.login.LoginService.loginFailure\",\"resourceName\":\"organizations/123\"},\"insertId\":\"-nahbepd4l1x\",\"resource\":{\"type\":\"audited_resource\"},\"httpRequest\":{\"remoteIp\":\"FE80::0202:B3FF:FE1E:1010\"},\"timestamp\":\"2021-09-24T16:16:57.183212Z\",\"severity\":\"NOTICE\",\"logName\":\"organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access\",\"receiveTimestamp\":\"2021-09-24T17:51:25.034361197Z\"}", + "severity": 300 + }, + "google_scc": { + "audit": { + "http_request": { + "remote": { + "ip": "FE80::0202:B3FF:FE1E", + "port": 1010 + } + }, + "insert_id": "-nahbepd4l1x", + "log_name": "organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access", + "proto_payload": { + "authentication_info": { + "principal_email": "test-user@example.net" + }, + "method_name": "google.login.LoginService.loginFailure", + "request_metadata": { + "caller": { + "ip": "175.16.199.1" + } + }, + "resource_name": "organizations/123", + "service_name": "login.googleapis.com", + "type": "type.googleapis.com/google.cloud.audit.AuditLog" + }, + "receive_timestamp": "2021-09-24T17:51:25.034Z", + "resource": { + "type": "audited_resource" + }, + "severity": { + "code": 300, + "value": "NOTICE" + }, + "timestamp": "2021-09-24T16:16:57.183Z" + } + }, + "log": { + "level": "NOTICE" + }, + "related": { + "ip": [ + "175.16.199.1", + "FE80::0202:B3FF:FE1E" + ], + "user": [ + "test-user@example.net" + ] + }, + "source": { + "ip": "175.16.199.1", + "user": { + "email": "test-user@example.net" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + } + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-common-config.yml b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/google_scc/data_stream/audit/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/google_scc/data_stream/audit/_dev/test/system/test-pubsub-config.yml b/packages/google_scc/data_stream/audit/_dev/test/system/test-pubsub-config.yml new file mode 100644 index 00000000000..13f6ba4a7a8 --- /dev/null +++ b/packages/google_scc/data_stream/audit/_dev/test/system/test-pubsub-config.yml @@ -0,0 +1,12 @@ +service: gcppubsub-emulator +input: gcp-pubsub +vars: + credentials_type: credentials_json + credentials: >- + {"type":"service_account","project_id":"audit","private_key_id":"x","private_key":"","client_email":"foo@bar.com","client_id":"0","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://foo.bar/path"} + project_id: audit +data_stream: + vars: + alternative_host: "{{Hostname}}:{{Port}}" + topic: topic + subscription_name: subscription diff --git a/packages/google_scc/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs b/packages/google_scc/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs new file mode 100644 index 00000000000..f953d6fe651 --- /dev/null +++ b/packages/google_scc/data_stream/audit/agent/stream/gcp-pubsub.yml.hbs @@ -0,0 +1,39 @@ +{{#if project_id}} +project_id: {{project_id}} +{{/if}} +{{#if topic}} +topic: {{topic}} +{{/if}} +{{#if subscription_name}} +subscription.name: {{subscription_name}} +{{/if}} +{{#if alternative_host}} +alternative_host: {{alternative_host}} +{{/if}} +{{#if subscription_create}} +subscription.create: {{subscription_create}} +{{/if}} +{{#if subscription_num_goroutines}} +subscription.num_goroutines: {{subscription_num_goroutines}} +{{/if}} +{{#if subscription_max_outstanding_messages}} +subscription.max_outstanding_messages: {{subscription_max_outstanding_messages}} +{{/if}} +{{credentials_type}}: {{credentials}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/google_scc/data_stream/audit/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..a82df84e72e --- /dev/null +++ b/packages/google_scc/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,958 @@ +--- +description: Pipeline for processing Audit logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - json: + field: event.original + target_field: json + tag: json_event_original + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.timestamp + target_field: google_scc.audit.timestamp + tag: date_audit_timestamp + formats: + - ISO8601 + if: ctx.json?.timestamp != null && ctx.json.timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.timestamp + tag: date_timestamp + formats: + - ISO8601 + if: ctx.json?.timestamp != null && ctx.json.timestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.protoPayload.serviceName + target_field: google_scc.audit.proto_payload.service_name + tag: rename_service_name + ignore_missing: true + - set: + field: cloud.service.name + copy_from: google_scc.audit.proto_payload.service_name + tag: set_cloud_service_name + ignore_empty_value: true + - convert: + field: json.protoPayload.requestMetadata.destinationAttributes.ip + target_field: google_scc.audit.proto_payload.request_metadata.destination_attributes.ip + tag: convert_destination_attributes_ip + type: ip + ignore_missing: true + if: ctx.json?.protoPayload?.requestMetadata?.destinationAttributes?.ip != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + value: '{{{google_scc.audit.proto_payload.request_metadata.destination_attributes.ip}}}' + tag: append_destination_attributes_ip_into_related_ip + allow_duplicates: false + if: ctx.google_scc?.audit?.proto_payload?.request_metadata?.destination_attributes?.ip != null + - set: + field: destination.ip + copy_from: google_scc.audit.proto_payload.request_metadata.destination_attributes.ip + tag: set_destination_ip + ignore_empty_value: true + - convert: + field: json.protoPayload.requestMetadata.destinationAttributes.port + target_field: google_scc.audit.proto_payload.request_metadata.destination_attributes.port + tag: convert_destination_attributes_port + type: long + ignore_missing: true + if: ctx.json?.protoPayload?.requestMetadata?.destinationAttributes?.port != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.port + copy_from: google_scc.audit.proto_payload.request_metadata.destination_attributes.port + tag: set_destination_port + ignore_empty_value: true + - rename: + field: json.protoPayload.methodName + target_field: google_scc.audit.proto_payload.method_name + tag: rename_method_name + ignore_missing: true + - set: + field: event.action + copy_from: google_scc.audit.proto_payload.method_name + tag: set_event_action + ignore_empty_value: true + - rename: + field: json.insertId + target_field: google_scc.audit.insert_id + tag: rename_insert_id + ignore_missing: true + - set: + field: event.id + copy_from: google_scc.audit.insert_id + tag: set_event_id + ignore_empty_value: true + - convert: + field: json.protoPayload.requestMetadata.requestAttributes.size + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.size + tag: convert_request_attributes_size + type: long + ignore_missing: true + if: ctx.json?.protoPayload?.requestMetadata?.requestAttributes?.size != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: http.request.bytes + copy_from: google_scc.audit.proto_payload.request_metadata.request_attributes.size + tag: set_http_request_bytes + ignore_empty_value: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.id + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.id + tag: rename_request_attributes_id + ignore_missing: true + - set: + field: http.request.id + copy_from: google_scc.audit.proto_payload.request_metadata.request_attributes.id + tag: set_http_request_id + ignore_empty_value: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.method + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.method + tag: rename_request_attributes_method + ignore_missing: true + - set: + field: http.request.method + copy_from: google_scc.audit.proto_payload.request_metadata.request_attributes.method + tag: set_http_request_method + ignore_empty_value: true + - rename: + field: json.labels + target_field: google_scc.audit.labels + tag: rename_audit_labels + ignore_missing: true + - set: + field: labels + copy_from: google_scc.audit.labels + tag: set_labels + ignore_empty_value: true + - rename: + field: json.severity + target_field: google_scc.audit.severity.value + tag: rename_audit_severity + ignore_missing: true + - set: + field: log.level + copy_from: google_scc.audit.severity.value + tag: set_log_level + ignore_empty_value: true + - script: + lang: painless + description: Set Event Severity. + tag: painless_audit_severity_value + if: ctx.google_scc?.audit?.severity?.value != null + # Event Severity Numeric Values + # https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#LogSeverity + params: + 'DEFAULT': 0 + 'DEBUG': 100 + 'INFO': 200 + 'NOTICE': 300 + 'WARNING': 400 + 'ERROR': 500 + 'CRITICAL': 600 + 'ALERT': 700 + 'EMERGENCY': 800 + source: |- + ctx.google_scc.audit.severity.put('code',params.get(ctx.google_scc.audit.severity.value)); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.severity + copy_from: google_scc.audit.severity.code + tag: set_event_severity + ignore_empty_value: true + - convert: + field: json.sourceLocation.line + target_field: google_scc.audit.source_location.line + tag: convert_source_location_line + type: long + ignore_missing: true + if: ctx.json?.sourceLocation?.line != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: log.origin.file.line + copy_from: google_scc.audit.source_location.line + tag: set_log_origin_file_line + ignore_empty_value: true + - rename: + field: json.sourceLocation.file + target_field: google_scc.audit.source_location.file + tag: rename_source_location_file + ignore_missing: true + - set: + field: log.origin.file.name + copy_from: google_scc.audit.source_location.file + tag: set_log_origin_file_name + ignore_empty_value: true + - rename: + field: json.sourceLocation.function + target_field: google_scc.audit.source_location.function + tag: rename_source_location_function + ignore_missing: true + - set: + field: log.origin.function + copy_from: google_scc.audit.source_location.function + tag: set_log_origin_function + ignore_empty_value: true + - convert: + field: json.protoPayload.requestMetadata.callerIp + target_field: google_scc.audit.proto_payload.request_metadata.caller.ip + tag: convert_request_metadata_caller_ip + type: ip + ignore_missing: true + if: ctx.json?.protoPayload?.requestMetadata?.callerIp != '' + on_failure: + - rename: + field: json.protoPayload.requestMetadata.callerIp + tag: rename_protoPayload_requestMetadata_callerIp + target_field: google_scc.audit.proto_payload.request_metadata.caller.ip_value + - append: + field: related.ip + value: '{{{google_scc.audit.proto_payload.request_metadata.caller.ip}}}' + tag: append_request_metadata_caller_ip_into_related_ip + allow_duplicates: false + if: ctx.google_scc?.audit?.proto_payload?.request_metadata?.caller?.ip != null + - set: + field: source.ip + copy_from: google_scc.audit.proto_payload.request_metadata.caller.ip + tag: set_source_ip + ignore_empty_value: true + - rename: + field: json.protoPayload.authenticationInfo.principalEmail + target_field: google_scc.audit.proto_payload.authentication_info.principal_email + tag: rename_authentication_info_principal_email + ignore_missing: true + - set: + field: source.user.email + copy_from: google_scc.audit.proto_payload.authentication_info.principal_email + tag: set_source_user_email + ignore_empty_value: true + - append: + field: related.user + value: '{{{google_scc.audit.proto_payload.authentication_info.principal_email}}}' + tag: append_authentication_info_principal_email_to_related_user + allow_duplicates: false + if: ctx.google_scc?.audit?.proto_payload?.authentication_info?.principal_email != null + - rename: + field: json.protoPayload.requestMetadata.callerSuppliedUserAgent + target_field: google_scc.audit.proto_payload.request_metadata.caller.supplied_user_agent + tag: rename_request_metadata_caller_supplied_user_agent + ignore_missing: true + - user_agent: + field: google_scc.audit.proto_payload.request_metadata.caller.supplied_user_agent + ignore_missing: true + - convert: + field: json.httpRequest.cacheFillBytes + target_field: google_scc.audit.http_request.cache.fill_bytes + tag: convert_http_request_cache_fill_bytes + type: long + ignore_missing: true + if: ctx.json?.httpRequest?.cacheFillBytes != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.httpRequest.cacheHit + target_field: google_scc.audit.http_request.cache.hit + tag: convert_http_request_cache_hit + type: boolean + ignore_missing: true + if: ctx.json?.httpRequest?.cacheHit != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.httpRequest.cacheLookup + target_field: google_scc.audit.http_request.cache.look_up + tag: convert_http_request_cache_look_up + type: boolean + ignore_missing: true + if: ctx.json?.httpRequest?.cacheLookup != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.httpRequest.cacheValidatedWithOriginServer + target_field: google_scc.audit.http_request.cache.validated_with_origin_server + tag: convert_http_request_cache_validated_with_origin_server + type: boolean + ignore_missing: true + if: ctx.json?.httpRequest?.cacheValidatedWithOriginServer != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.httpRequest.latency + target_field: google_scc.audit.http_request.latency + tag: rename_http_request_latency + ignore_missing: true + - rename: + field: json.httpRequest.protocol + target_field: google_scc.audit.http_request.protocol + tag: rename_http_request_protocol + ignore_missing: true + - rename: + field: json.httpRequest.referer + target_field: google_scc.audit.http_request.referer + tag: rename_http_request_referer + ignore_missing: true + - grok: + field: json.httpRequest.remoteIp + patterns: + - '^%{IP:google_scc.audit.http_request.remote.ip}:%{NUMBER:google_scc.audit.http_request.remote.port:long}$' + - '^%{IP:google_scc.audit.http_request.remote.ip}$' + tag: grok_extract_remote_ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + value: '{{{google_scc.audit.http_request.remote.ip}}}' + tag: append_http_request_remote_ip_into_related_ip + allow_duplicates: false + if: ctx.google_scc?.audit?.http_request?.remote?.ip != null + - rename: + field: json.httpRequest.requestMethod + target_field: google_scc.audit.http_request.request_method + tag: rename_http_request_method + ignore_missing: true + - convert: + field: json.httpRequest.requestSize + target_field: google_scc.audit.http_request.request_size + tag: convert_http_request_size + type: long + ignore_missing: true + if: ctx.json?.httpRequest?.requestSize != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.httpRequest.requestUrl + target_field: google_scc.audit.http_request.request_url + tag: rename_http_request_url + ignore_missing: true + - convert: + field: json.httpRequest.responseSize + target_field: google_scc.audit.http_request.response_size + tag: convert_http_response_size + type: long + ignore_missing: true + if: ctx.json?.httpRequest?.responseSize != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - grok: + field: json.httpRequest.serverIp + patterns: + - '^%{IP:google_scc.audit.http_request.server.ip}:%{NUMBER:google_scc.audit.http_request.server.port:long}$' + - '^%{IP:google_scc.audit.http_request.server.ip}$' + tag: grok_extract_server_ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + value: '{{{google_scc.audit.http_request.server.ip}}}' + tag: append_http_request_server_ip_into_related_ip + allow_duplicates: false + if: ctx.google_scc?.audit?.http_request?.server?.ip != null + - convert: + field: json.httpRequest.status + target_field: google_scc.audit.http_request.status + tag: convert_http_request_status + type: long + ignore_missing: true + if: ctx.json?.httpRequest?.status != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.httpRequest.userAgent + target_field: google_scc.audit.http_request.user_agent + tag: rename_http_request_user_agent + ignore_missing: true + - rename: + field: json.logName + target_field: google_scc.audit.log_name + tag: rename_audit_log_name + ignore_missing: true + - convert: + field: json.operation.first + target_field: google_scc.audit.operation.first + tag: convert_operation_first + type: boolean + ignore_missing: true + if: ctx.json?.operation?.first != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.operation.id + target_field: google_scc.audit.operation.id + tag: rename_operation_id + ignore_missing: true + - convert: + field: json.operation.last + target_field: google_scc.audit.operation.last + tag: convert_operation_last + type: boolean + ignore_missing: true + if: ctx.json?.operation?.last != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.operation.producer + target_field: google_scc.audit.operation.producer + tag: rename_operation_producer + ignore_missing: true + - rename: + field: json.protoPayload.authenticationInfo.authoritySelector + target_field: google_scc.audit.proto_payload.authentication_info.authority_selector + tag: rename_authentication_info_authority_selector + ignore_missing: true + - rename: + field: json.protoPayload.authenticationInfo.principalSubject + target_field: google_scc.audit.proto_payload.authentication_info.principal_subject + tag: rename_authentication_info_principal_subject + ignore_missing: true + - foreach: + field: json.protoPayload.authenticationInfo.serviceAccountDelegationInfo + if: ctx.json?.protoPayload?.authenticationInfo?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.firstPartyPrincipal.principalEmail + target_field: _ingest._value.first_party_principal.email + tag: rename_authentication_info_service_account_delegation_info_first_party_principal_email + ignore_missing: true + - foreach: + field: json.protoPayload.authenticationInfo.serviceAccountDelegationInfo + if: ctx.json?.protoPayload?.authenticationInfo?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.firstPartyPrincipal.serviceMetadata + target_field: _ingest._value.first_party_principal.service_metadata + tag: rename_authentication_info_service_account_delegation_info_first_party_principal_service_metadata + ignore_missing: true + - foreach: + field: json.protoPayload.authenticationInfo.serviceAccountDelegationInfo + if: ctx.json?.protoPayload?.authenticationInfo?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.principalSubject + target_field: _ingest._value.principal_subject + tag: rename_authentication_info_service_account_delegation_info_principal_subject + ignore_missing: true + - foreach: + field: json.protoPayload.authenticationInfo.serviceAccountDelegationInfo + if: ctx.json?.protoPayload?.authenticationInfo?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.thirdPartyPrincipal.thirdPartyClaims + target_field: _ingest._value.third_party_principal.claims + tag: rename_authentication_info_service_account_delegation_info_third_party_principal_claims + ignore_missing: true + - rename: + field: json.protoPayload.authenticationInfo.serviceAccountDelegationInfo + target_field: google_scc.audit.proto_payload.authentication_info.service_account_delegation_info + tag: rename_authentication_info_service_account_key_name + ignore_missing: true + - rename: + field: json.protoPayload.authenticationInfo.serviceAccountKeyName + target_field: google_scc.audit.proto_payload.authentication_info.service_account_key_name + tag: rename_authentication_info_service_account_key_name + ignore_missing: true + - rename: + field: json.protoPayload.authenticationInfo.thirdPartyPrincipal + target_field: google_scc.audit.proto_payload.authentication_info.third_party_principal + tag: rename_authentication_info_third_party_principal + ignore_missing: true + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.granted + type: boolean + tag: convert_authorization_info_granted + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.granted + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.resourceAttributes.createTime + target_field: _ingest._value.resourceAttributes.create_time + tag: date_authorization_info_resource_attributes_create_time + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.resourceAttributes.createTime + ignore_missing: true + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.resourceAttributes.deleteTime + target_field: _ingest._value.resourceAttributes.delete_time + tag: date_authorization_info_resource_attributes_delete_time + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.resourceAttributes.deleteTime + ignore_missing: true + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.resourceAttributes.updateTime + target_field: _ingest._value.resourceAttributes.update_time + tag: date_authorization_info_resource_attributes_update_time + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.resourceAttributes.updateTime + ignore_missing: true + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.resourceAttributes.displayName + target_field: _ingest._value.resourceAttributes.display_name + tag: rename_authorization_info_resource_attributes_display_name + ignore_missing: true + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.resourceAttributes.updateTime + - _ingest._value.resourceAttributes.deleteTime + - _ingest._value.resourceAttributes.createTime + ignore_missing: true + tag: remove_authorization_info_resource_attributes_fields + - foreach: + field: json.protoPayload.authorizationInfo + if: ctx.json?.protoPayload?.authorizationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.resourceAttributes + target_field: _ingest._value.resource_attributes + tag: rename_authorization_info_resource_attributes + ignore_missing: true + - rename: + field: json.protoPayload.authorizationInfo + target_field: google_scc.audit.proto_payload.authorization_info + tag: rename_authorization_info + ignore_missing: true + - rename: + field: json.protoPayload.metadata + target_field: google_scc.audit.proto_payload.metadata + tag: rename_metadata + ignore_missing: true + - convert: + field: json.protoPayload.numResponseItems + target_field: google_scc.audit.proto_payload.num_response_items + tag: convert_num_response_items + type: long + ignore_missing: true + if: ctx.json?.protoPayload?.numResponseItems != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.payload + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.payload + tag: rename_org_policy_violation_info_payload + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.resourceTags + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.resource.tags + tag: rename_org_policy_violation_info_resource_tags + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.resourceType + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.resource.type + tag: rename_org_policy_violation_info_resource_type + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.violationInfo.checkedValue + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.checked_value + tag: rename_org_policy_violation_info_checked_value + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.violationInfo.constraint + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.constraint + tag: rename_org_policy_violation_info_constraint + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.violationInfo.errorMessage + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.error_message + tag: rename_org_policy_violation_info_error_message + ignore_missing: true + - rename: + field: json.protoPayload.policyViolationInfo.orgPolicyViolationInfo.violationInfo.policyType + target_field: google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.policy_type + tag: rename_org_policy_violation_info_policy_type + ignore_missing: true + - rename: + field: json.protoPayload.request + target_field: google_scc.audit.proto_payload.request + tag: rename_request + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.callerNetwork + target_field: google_scc.audit.proto_payload.request_metadata.caller.network + tag: rename_request_metadata_caller_network + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.destinationAttributes.labels + target_field: google_scc.audit.proto_payload.request_metadata.destination_attributes.labels + tag: rename_request_metadata_destination_attributes_labels + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.destinationAttributes.principal + target_field: google_scc.audit.proto_payload.request_metadata.destination_attributes.principal + tag: rename_request_metadata_destination_attributes_principal + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.destinationAttributes.regionCode + target_field: google_scc.audit.proto_payload.request_metadata.destination_attributes.region_code + tag: rename_request_metadata_destination_attributes_region_code + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.auth.accessLevels + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.auth.access_levels + tag: rename_request_metadata_destination_attributes_auth_access_levels + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.auth.audiences + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.auth.audiences + tag: rename_request_metadata_destination_attributes_auth_audiences + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.auth.claims + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.auth.claims + tag: rename_request_metadata_destination_attributes_auth_claims + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.auth.presenter + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.auth.presenter + tag: rename_request_metadata_destination_attributes_auth_presenter + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.auth.principal + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.auth.principal + tag: rename_request_metadata_destination_attributes_auth_principal + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.headers + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.headers + tag: rename_request_metadata_destination_attributes_headers + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.host + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.host + tag: rename_request_metadata_destination_attributes_host + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.path + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.path + tag: rename_request_metadata_destination_attributes_path + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.protocol + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.protocol + tag: rename_request_metadata_destination_attributes_protocol + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.query + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.query + tag: rename_request_metadata_destination_attributes_query + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.reason + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.reason + tag: rename_request_metadata_destination_attributes_reason + ignore_missing: true + - rename: + field: json.protoPayload.requestMetadata.requestAttributes.scheme + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.schema + tag: rename_request_metadata_destination_attributes_schema + ignore_missing: true + - date: + field: json.protoPayload.requestMetadata.requestAttributes.time + target_field: google_scc.audit.proto_payload.request_metadata.request_attributes.time + tag: date_request_metadata_destination_attributes_time + formats: + - ISO8601 + if: ctx.json?.protoPayload?.requestMetadata?.requestAttributes?.time != null && ctx.json.protoPayload.requestMetadata.requestAttributes.time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.protoPayload.resourceLocation.currentLocations + target_field: google_scc.audit.proto_payload.resource_location.current_locations + tag: rename_resource_location_current_locations + ignore_missing: true + - rename: + field: json.protoPayload.resourceLocation.originalLocations + target_field: google_scc.audit.proto_payload.resource_location.original_locations + tag: rename_resource_location_original_locations + ignore_missing: true + - rename: + field: json.protoPayload.resourceName + target_field: google_scc.audit.proto_payload.resource_name + tag: rename_resource_name + ignore_missing: true + - rename: + field: json.protoPayload.resourceOriginalState + target_field: google_scc.audit.proto_payload.resource_original_state + tag: rename_resource_original_state + ignore_missing: true + - rename: + field: json.protoPayload.response + target_field: google_scc.audit.proto_payload.response + tag: rename_response + ignore_missing: true + - rename: + field: json.protoPayload.serviceData + target_field: google_scc.audit.proto_payload.service_data + tag: rename_service_data + ignore_missing: true + - convert: + field: json.protoPayload.status.code + target_field: google_scc.audit.proto_payload.status.code + tag: convert_status_code + type: long + ignore_missing: true + if: ctx.json?.protoPayload?.status?.code != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.protoPayload.status.details + target_field: google_scc.audit.proto_payload.status.details + tag: rename_status_details + ignore_missing: true + - rename: + field: json.protoPayload.status.message + target_field: google_scc.audit.proto_payload.status.message + tag: rename_status_message + ignore_missing: true + - rename: + field: json.protoPayload.@type + target_field: google_scc.audit.proto_payload.type + tag: rename_type + ignore_missing: true + - date: + field: json.receiveTimestamp + target_field: google_scc.audit.receive_timestamp + tag: date_receive_timestamp + formats: + - ISO8601 + if: ctx.json?.receiveTimestamp != null && ctx.json.receiveTimestamp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.resource.labels + target_field: google_scc.audit.resource.labels + tag: rename_resource_labels + ignore_missing: true + - rename: + field: json.resource.type + target_field: google_scc.audit.resource.type + tag: rename_resource_type + ignore_missing: true + - rename: + field: json.spanId + target_field: google_scc.audit.span_id + tag: rename_span_id + ignore_missing: true + - convert: + field: json.split.index + target_field: google_scc.audit.split.index + tag: convert_split_index + type: long + ignore_missing: true + if: ctx.json?.split?.index != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.split.totalSplits + target_field: google_scc.audit.split.total_splits + tag: convert_split_total + type: long + ignore_missing: true + if: ctx.json?.split?.totalSplits != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.split.uid + target_field: google_scc.audit.split.uid + tag: rename_split_uid + ignore_missing: true + - rename: + field: json.trace + target_field: google_scc.audit.trace + tag: rename_trace + ignore_missing: true + - convert: + field: json.traceSampled + target_field: google_scc.audit.trace_sampled + tag: convert_trace_sampled + type: boolean + ignore_missing: true + if: ctx.json?.traceSampled != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: + - json + tag: remove_json + ignore_missing: true + - remove: + field: + - google_scc.audit.timestamp + - google_scc.audit.proto_payload.service_name + - google_scc.audit.proto_payload.request_metadata.destination_attributes.ip + - google_scc.audit.proto_payload.request_metadata.destination_attributes.port + - google_scc.audit.proto_payload.method_name + - google_scc.audit.insert_id + - google_scc.audit.severity.code + - google_scc.audit.proto_payload.request_metadata.request_attributes.size + - google_scc.audit.proto_payload.request_metadata.request_attributes.id + - google_scc.audit.proto_payload.request_metadata.request_attributes.method + - google_scc.audit.labels + - google_scc.audit.severity.value + - google_scc.audit.source_location.line + - google_scc.audit.source_location.file + - google_scc.audit.source_location.function + - google_scc.audit.proto_payload.request_metadata.caller.ip + - google_scc.audit.proto_payload.authentication_info.principal_email + - google_scc.audit.proto_payload.request_metadata.caller.supplied_user_agent + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: + - event.original + tag: remove_original_event + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/audit/fields/base-fields.yml b/packages/google_scc/data_stream/audit/fields/base-fields.yml new file mode 100644 index 00000000000..52819db9337 --- /dev/null +++ b/packages/google_scc/data_stream/audit/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: google_scc +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: google_scc.audit +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/google_scc/data_stream/audit/fields/beats.yml b/packages/google_scc/data_stream/audit/fields/beats.yml new file mode 100644 index 00000000000..2d5ae254634 --- /dev/null +++ b/packages/google_scc/data_stream/audit/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/google_scc/data_stream/audit/fields/fields.yml b/packages/google_scc/data_stream/audit/fields/fields.yml new file mode 100644 index 00000000000..06891684ac3 --- /dev/null +++ b/packages/google_scc/data_stream/audit/fields/fields.yml @@ -0,0 +1,419 @@ +- name: google_scc + type: group + fields: + - name: audit + type: group + fields: + - name: http_request + type: group + fields: + - name: cache + type: group + fields: + - name: fill_bytes + type: long + description: The number of HTTP response bytes inserted into cache. Set only when a cache fill was attempted. + - name: hit + type: boolean + description: Whether or not an entity was served from cache (with or without validation). + - name: look_up + type: boolean + description: Whether or not a cache lookup was attempted. + - name: validated_with_origin_server + type: boolean + description: Whether or not the response was validated with the origin server before being served from cache. This field is only meaningful if cacheHit is True. + - name: latency + type: keyword + description: The request processing latency on the server, from the time the request was received until the response was sent. + - name: protocol + type: keyword + description: Protocol used for the request. + - name: referer + type: keyword + description: The referer URL of the request. + - name: remote + type: group + fields: + - name: ip + type: ip + description: The IP address (IPv4 or IPv6) of the client that issued the HTTP request. + - name: port + type: long + description: The Port of the client that issued the HTTP request. + - name: request_method + type: keyword + description: The request method. + - name: request_size + type: long + description: The size of the HTTP request message in bytes, including the request headers and the request body. + - name: request_url + type: keyword + description: The scheme (http, https), the host name, the path and the query portion of the URL that was requested. + - name: response_size + type: long + description: The size of the HTTP response message sent back to the client, in bytes, including the response headers and the response body. + - name: server + type: group + fields: + - name: ip + type: ip + description: The IP address (IPv4 or IPv6) of the origin server that the request was sent to. This field can include port information. + - name: port + type: long + description: The Port of the origin server that the request was sent to. + - name: status + type: long + description: The response code indicating the status of response. + - name: user_agent + type: keyword + description: The user agent sent by the client. + - name: insert_id + type: keyword + description: A unique identifier for the log entry. + - name: labels + type: object + object_type: keyword + description: A map of key, value pairs that provides additional information about the log entry. The labels can be user-defined or system-defined. + - name: log_name + type: keyword + description: The resource name of the log to which this log entry belongs. + - name: operation + type: group + fields: + - name: first + type: boolean + description: Set this to True if this is the first log entry in the operation. + - name: id + type: keyword + description: An arbitrary operation identifier. + - name: last + type: boolean + description: Set this to True if this is the last log entry in the operation. + - name: producer + type: keyword + description: An arbitrary producer identifier. + - name: proto_payload + type: group + fields: + - name: authentication_info + type: group + fields: + - name: authority_selector + type: keyword + description: The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. + - name: principal_email + type: keyword + description: The email address of the authenticated user (or service account on behalf of third party principal) making the request. + - name: principal_subject + type: keyword + description: String representation of identity of requesting party. Populated for both first and third party identities. + - name: service_account_delegation_info + type: group + fields: + - name: first_party_principal + type: group + fields: + - name: email + type: keyword + description: The email address of a Google account. + - name: service_metadata + type: object + description: Metadata about the service that uses the service account. + - name: principal_subject + type: keyword + description: A string representing the principalSubject associated with the identity. + - name: third_party_principal + type: group + fields: + - name: claims + type: object + description: Metadata about third party identity. + - name: service_account_key_name + type: keyword + description: The name of the service account key used to create or exchange credentials for authenticating the service account making the request. This is a scheme-less URI full resource name. + - name: third_party_principal + type: flattened + description: The third party identification (if any) of the authenticated user making the request. + - name: authorization_info + type: group + fields: + - name: granted + type: boolean + description: Whether or not authorization for resource and permission was granted. + - name: permission + type: keyword + description: The required IAM permission. + - name: resource + type: keyword + description: The resource being accessed, as a REST-style or cloud resource string. + - name: resource_attributes + type: group + fields: + - name: annotations + type: flattened + description: Annotations is an unstructured key-value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. + - name: create_time + type: date + description: The timestamp when the resource was created. + - name: delete_time + type: date + description: The timestamp when the resource was last deleted. + - name: display_name + type: keyword + description: The display name set by clients. + - name: etag + type: keyword + description: An opaque value that uniquely identifies a version or generation of a resource. + - name: labels + type: object + object_type: keyword + description: The labels or tags on the resource, such as AWS resource tags and Kubernetes resource labels. + - name: location + type: keyword + description: The location of the resource. + - name: name + type: keyword + description: The stable identifier (name) of a resource on the service. A resource can be logically identified as "//{resource.service}/{resource.name}". + - name: service + type: keyword + description: The name of the service that this resource belongs to, such as pubsub.googleapis.com. The service may be different from the DNS hostname that actually serves the request. + - name: type + type: keyword + description: The type of the resource. The syntax is platform-specific because different platforms define their resources differently. + - name: uid + type: keyword + description: The unique identifier of the resource. + - name: update_time + type: date + description: The timestamp when the resource was last updated. + - name: metadata + type: object + description: Other service-specific data about the request, response, and other information associated with the current audited event. + - name: method_name + type: keyword + description: The name of the service method or operation. For API calls, this should be the name of the API method. + - name: num_response_items + type: long + description: The number of items returned from a List or Query API method, if applicable. + - name: policy_violation_info + type: group + fields: + - name: org_policy_violation_info + type: group + fields: + - name: payload + type: flattened + description: Resource payload that is currently in scope and is subjected to orgpolicy conditions. + - name: resource + type: group + fields: + - name: tags + type: object + description: Tags referenced on the resource at the time of evaluation. + - name: type + type: keyword + description: Resource type that the orgpolicy is checked against. + - name: violation_info + type: group + fields: + - name: checked_value + type: keyword + description: Value that is being checked for the policy. + - name: constraint + type: keyword + description: Constraint name. + - name: error_message + type: keyword + description: Error message that policy is indicating. + - name: policy_type + type: keyword + description: Indicates the type of the policy. + - name: request + type: flattened + description: The operation request. + - name: request_metadata + type: group + fields: + - name: caller + type: group + fields: + - name: ip + type: ip + description: The IP address of the caller. + - name: ip_value + type: keyword + - name: network + type: keyword + description: The network of the caller. + - name: supplied_user_agent + type: keyword + description: The user agent of the caller. + - name: destination_attributes + type: group + fields: + - name: ip + type: ip + description: The IP address of the peer. + - name: labels + type: object + object_type: keyword + description: The labels associated with the peer. + - name: port + type: long + description: The network port of the peer. + - name: principal + type: keyword + description: The identity of this peer. + - name: region_code + type: keyword + description: The CLDR country/region code associated with the above IP address. + - name: request_attributes + type: group + fields: + - name: auth + type: group + fields: + - name: access_levels + type: keyword + description: A list of access level resource names that allow resources to be accessed by authenticated requester. + - name: audiences + type: keyword + description: The intended audience(s) for this authentication information. + - name: claims + type: flattened + description: Structured claims presented with the credential. + - name: presenter + type: keyword + description: The authorized presenter of the credential. + - name: principal + type: keyword + description: The authenticated principal. + - name: headers + type: flattened + description: The HTTP request headers. + - name: host + type: keyword + description: The HTTP request Host header value. + - name: id + type: keyword + description: The unique ID for a request, which can be propagated to downstream systems. + - name: method + type: keyword + description: The HTTP request method, such as GET, POST. + - name: path + type: keyword + description: The HTTP URL path, excluding the query parameters. + - name: protocol + type: keyword + description: The network protocol used with the request, such as "http/1.1", "spdy/3", "h2", "h2c", "webrtc", "tcp", "udp", "quic". + - name: query + type: keyword + description: The HTTP URL query in the format of name1=value1&name2=value2, as it appears in the first line of the HTTP request. + - name: reason + type: keyword + description: A special parameter for request reason. It is used by security systems to associate auditing information with a request. + - name: schema + type: keyword + description: The HTTP URL scheme, such as http and https. + - name: size + type: long + description: The HTTP request size in bytes. + - name: time + type: date + description: The timestamp when the destination service receives the last byte of the request. + - name: resource_location + type: group + fields: + - name: current_locations + type: keyword + description: The locations of a resource after the execution of the operation. + - name: original_locations + type: keyword + description: The locations of a resource prior to the execution of the operation. + - name: resource_name + type: keyword + description: The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. + - name: resource_original_state + type: flattened + description: The resource's original state before mutation. + - name: response + type: flattened + description: The operation response. + - name: service_data + type: object + description: Other service-specific data about the request, response, and other activities. + - name: service_name + type: keyword + description: The name of the API service performing the operation. + - name: status + type: group + fields: + - name: code + type: long + description: The status code, which should be an enum value of google.rpc.Code. + - name: details + type: nested + description: A list of messages that carry the error details. + - name: message + type: keyword + description: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. + - name: type + type: keyword + - name: receive_timestamp + type: date + description: The time the log entry was received by Logging. + - name: resource + type: group + fields: + - name: labels + type: object + object_type: keyword + description: Values for all of the labels listed in the associated monitored resource descriptor. + - name: type + type: keyword + description: The monitored resource type. + - name: severity + type: group + fields: + - name: code + type: long + description: The severity of the log entry. + - name: value + type: keyword + description: The severity of the log entry. + - name: source_location + type: group + fields: + - name: file + type: keyword + description: Source file name. Depending on the runtime environment, this might be a simple name or a fully-qualified name. + - name: function + type: keyword + description: Human-readable name of the function or method being invoked, with optional context such as the class or package name. + - name: line + type: long + description: Line within the source file. 1-based; 0 indicates no line number available. + - name: span_id + type: keyword + description: The ID of the Cloud Trace span associated with the current operation in which the log is being written. + - name: split + type: group + fields: + - name: index + type: long + description: The index of this LogEntry in the sequence of split log entries. Log entries are given |index| values 0, 1, ..., n-1 for a sequence of n log entries. + - name: total_splits + type: long + description: The total number of log entries that the original LogEntry was split into. + - name: uid + type: keyword + description: A globally unique identifier for all log entries in a sequence of split log entries. All log entries with the same |LogSplit.uid| are assumed to be part of the same sequence of split log entries. + - name: timestamp + type: date + description: The time the event described by the log entry occurred. + - name: trace + type: keyword + description: The REST resource name of the trace being written to Cloud Trace in association with this log entry. + - name: trace_sampled + type: boolean + description: The sampling decision of the trace associated with the log entry. diff --git a/packages/google_scc/data_stream/audit/manifest.yml b/packages/google_scc/data_stream/audit/manifest.yml new file mode 100644 index 00000000000..0dd1dd6e8e2 --- /dev/null +++ b/packages/google_scc/data_stream/audit/manifest.yml @@ -0,0 +1,87 @@ +title: Collect Audit logs from Google Security Command Center. +type: logs +streams: + - input: gcp-pubsub + enabled: false + title: Audit logs + description: Collect Audit logs from Google Security Command Center. + template_path: gcp-pubsub.yml.hbs + vars: + - name: topic + type: text + title: Topic + multi: false + required: true + show_user: true + description: Name of the topic where the logs are written to. + - name: subscription_name + type: text + title: Subscription Name + multi: false + required: true + show_user: true + description: Use the short subscription name here, not the full-blown path with the project ID. You can find it as 'Subscription ID' on the Google Cloud Console. + - name: subscription_create + type: bool + title: Subscription Create + description: If true, the integration will create the subscription on start. + multi: false + required: false + show_user: false + default: true + - name: subscription_num_goroutines + type: text + title: Subscription Num Goroutines + description: Number of goroutines created to read from the subscription. This does not limit the number of messages that can be processed concurrently or the maximum number of goroutines the input will create. + multi: false + required: false + show_user: false + default: 1 + - name: subscription_max_outstanding_messages + type: text + title: Subscription Max Outstanding Messages + description: The maximum number of unprocessed messages (unacknowledged but not yet expired). If the value is negative, then there will be no limit on the number of unprocessed messages. Default is 1000. + multi: false + required: false + show_user: false + default: 1000 + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-audit + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.audit fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: alternative_host + type: text + title: Alternative host + multi: false + required: false + show_user: false + description: "Overrides the default Pub/Sub service address and disables TLS. For testing." diff --git a/packages/google_scc/data_stream/audit/sample_event.json b/packages/google_scc/data_stream/audit/sample_event.json new file mode 100644 index 00000000000..7af6b058ff0 --- /dev/null +++ b/packages/google_scc/data_stream/audit/sample_event.json @@ -0,0 +1,82 @@ +{ + "@timestamp": "2021-09-24T16:16:57.183Z", + "agent": { + "ephemeral_id": "1d64ed9e-03f2-4eea-9e8a-b9a630236e12", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "cloud": { + "service": { + "name": "login.googleapis.com" + } + }, + "data_stream": { + "dataset": "google_scc.audit", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "action": "google.login.LoginService.loginFailure", + "agent_id_status": "verified", + "created": "2023-07-03T06:26:31.858Z", + "dataset": "google_scc.audit", + "id": "-nahbepd4l1x", + "ingested": "2023-07-03T06:26:35Z", + "kind": "event", + "severity": 300 + }, + "google_scc": { + "audit": { + "http_request": { + "remote": { + "ip": "FE80::0202:B3FF:FE1E", + "port": 1010 + } + }, + "log_name": "organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access", + "proto_payload": { + "resource_name": "organizations/123", + "type": "type.googleapis.com/google.cloud.audit.AuditLog" + }, + "receive_timestamp": "2021-09-24T17:51:25.034Z", + "resource": { + "type": "audited_resource" + } + } + }, + "input": { + "type": "gcp-pubsub" + }, + "log": { + "level": "NOTICE" + }, + "related": { + "ip": [ + "175.16.199.1", + "FE80::0202:B3FF:FE1E" + ], + "user": [ + "test-user@example.net" + ] + }, + "source": { + "ip": "175.16.199.1", + "user": { + "email": "test-user@example.net" + } + }, + "tags": [ + "forwarded", + "google_scc-audit" + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-common-config.yml b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log new file mode 100644 index 00000000000..c0ff377df1d --- /dev/null +++ b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log @@ -0,0 +1,2 @@ +{"finding":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","parent":"organizations/515665165161/sources/98481484454154454545","resourceName":"//cloudresourcemanager.googleapis.com/projects/45455445554","state":"ACTIVE","category":"application","externalUri":"http://www.adwait.com","sourceProperties":{},"securityMarks":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks"},"eventTime":"2023-06-02T05:17:41.936Z","createTime":"2020-02-19T13:37:43.858Z","severity":"CRITICAL","canonicalName":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545","mute":"UNMUTED","muteUpdateTime":"2022-03-23T05:50:21.804Z","externalSystems":{"test":{"name":"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test","assignees":["primary"],"externalUid":"test_scc_finding_2","status":"updated1","externalSystemUpdateTime":"2022-01-05T05:00:35.674Z"}},"muteInitiator":"Unmuted by john@gmail.com"},"resource":{"name":"//cloudresourcemanager.googleapis.com/projects/45455445554"}} +{"listFindingsResults": [],"readTime": "2023-06-12T09:44:42.505Z","totalSize": 0} diff --git a/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log-expected.json b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log-expected.json new file mode 100644 index 00000000000..9a498890dbb --- /dev/null +++ b/packages/google_scc/data_stream/finding/_dev/test/pipeline/test-finding.log-expected.json @@ -0,0 +1,65 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-02T05:17:41.936Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "created": "2020-02-19T13:37:43.858Z", + "kind": "event", + "original": "{\"finding\":{\"name\":\"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545\",\"parent\":\"organizations/515665165161/sources/98481484454154454545\",\"resourceName\":\"//cloudresourcemanager.googleapis.com/projects/45455445554\",\"state\":\"ACTIVE\",\"category\":\"application\",\"externalUri\":\"http://www.adwait.com\",\"sourceProperties\":{},\"securityMarks\":{\"name\":\"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks\"},\"eventTime\":\"2023-06-02T05:17:41.936Z\",\"createTime\":\"2020-02-19T13:37:43.858Z\",\"severity\":\"CRITICAL\",\"canonicalName\":\"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545\",\"mute\":\"UNMUTED\",\"muteUpdateTime\":\"2022-03-23T05:50:21.804Z\",\"externalSystems\":{\"test\":{\"name\":\"organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test\",\"assignees\":[\"primary\"],\"externalUid\":\"test_scc_finding_2\",\"status\":\"updated1\",\"externalSystemUpdateTime\":\"2022-01-05T05:00:35.674Z\"}},\"muteInitiator\":\"Unmuted by john@gmail.com\"},\"resource\":{\"name\":\"//cloudresourcemanager.googleapis.com/projects/45455445554\"}}" + }, + "google_scc": { + "finding": { + "canonical_name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "category": "application", + "create_time": "2020-02-19T13:37:43.858Z", + "event_time": "2023-06-02T05:17:41.936Z", + "external_systems": { + "test": { + "assignees": [ + "primary" + ], + "externalSystemUpdateTime": "2022-01-05T05:00:35.674Z", + "externalUid": "test_scc_finding_2", + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test", + "status": "updated1" + } + }, + "external_uri": "http://www.adwait.com", + "mute": { + "initiator": "Unmuted by john@gmail.com", + "state": "UNMUTED", + "update_time": "2022-03-23T05:50:21.804Z" + }, + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "parent": "organizations/515665165161/sources/98481484454154454545", + "resource": { + "name": "//cloudresourcemanager.googleapis.com/projects/45455445554" + }, + "resource_name": "//cloudresourcemanager.googleapis.com/projects/45455445554", + "security_marks": { + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks" + }, + "severity": "CRITICAL", + "source_id": "98481484454154454545", + "state": "ACTIVE" + } + }, + "organization": { + "id": "515665165161" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "www.adwait.com", + "original": "http://www.adwait.com", + "scheme": "http" + } + }, + null + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/finding/_dev/test/system/test-default-config.yml b/packages/google_scc/data_stream/finding/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..36766db0d82 --- /dev/null +++ b/packages/google_scc/data_stream/finding/_dev/test/system/test-default-config.yml @@ -0,0 +1,26 @@ +input: httpjson +service: google_scc +vars: + credentials_type: credentials_json + credentials: | + { + "type": "service_account", + "project_id": "system-tests", + "private_key_id": "a2ef9c637b4176ec994606cb08724a1b79bc0666", + "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC9SzdiBfhGcQrN\nLKofn3198cwOJ3DclRM3On9qVEHKIY3aCcLZgst4HyBtkefZeSVgIRPWhStWY8CK\nPBXZHM9jAifSQiHjNU4o7v5EMIKuCrwKAgbXFnJSEwXe7CfzrytKZfkVndPf+ZrH\nnUSwAmbNrB5/VOqtBF0QrG48FCz/ipZph5AJ5h5kFVyDZvwJSaDfDWUHTvZfO3tw\nlSnwVTWztT0d+CDYOyWH34NJVfTKirA3xifDgVcxLKoC7850FsZqJ05HpiOUrHc5\nJRRiy4HurdcPKKBvpVrtbvftBMsiG0RvnqXgTSI7iMNPjUtpjLC9GlZ6B+8egUEd\ndtdPoDG1AgMBAAECggEAP2ks+ldJnj9MAQNPUhyZa1FOrAcmVZ5Su5OLD1F+YHnx\nDPNsJHUeN/UlZc8UvdNJY/RwstIVfHEaFLSgFQUDrAUS1ep1c6ltr2SwJKOjgy3x\nY+Dd7buFPF1HADBYCdfKRrf2QvmF+mehI/FZCyUizw8zgDAwFRl7G5THsLSJhmiQ\nwDc9WbPFLyswtmeKoAqMiHHqV63PtJunqvGbrDTHh9f4P5JVtreMoPWzE9czQ2ZI\n5nBHOFP/EA6twyRalqOsm3XoFmyrWMmJtm/JJsDlGr/LZcVbtghxybEYo8p/VLpo\nJmBSJgM17rwGhniDWXWXXOfx2fkNZEhVIeGvZYJRgQKBgQDOHnepihIu650pTfRD\nfcUyPN9oYLzI2mwv70H3FzJQftt3pqmWhlX2adaXYJ65/8xwr6SmkHmYjTvfuCoT\nSFApzv9fnYcD6vCsk5AhLpbarWR3MEU1SCvaiFuRNrdTcR8MGSglWPLLVXCI6f/g\nF9kZ/Ngz7MkvD2bNT/WjNj3LMQKBgQDrGmPo0gvfk+QoFtL05+dDDrB2IxUokdqa\nRzdecC8wV01l8lIj4TDqo7W1wwxdEUvCbUYriE2BoXi1v3jF+wfluqJOL30Ex5kb\nUO5At+DWakxzgy3v0F32AOZRISAGMdbrNFaLpjD9t9NGbL8kiestfs2QuTISHJwU\nfD47jFDlxQKBgHrczGVh6O7RAVByqCxm1tnYUS8torpzAFQeYQrBZ/t1cqrCzInu\nL2V/tytqq5KheKKfAB1NNz4IyezUITh3PVl+itja1HUwYR/todc1pzRYcO9e9ZIK\nICHWcAaCQArb/i6+/CAvAiLUHg1utlhEvuNvxQxGk7Gak6PEit4r4e+xAoGBAIOR\nrT/p7IMefJyCyWQNM7qvScmTMJAXr8KPAEl1drMS6FmZFqbFq15kZ5hko1KiD0er\nZ42NJfLZrnfnw2roZS8HFzWyFcDLAr/qtqq5PLZBnq82RkrizPKS5lGYvBc7ZQ8T\npytXwir66N2MlhuYo2g+gkPvoDnKkP5V2W3xxIQRAoGBAIDayGKqE1iZwF72R0xQ\nVg8y2x9JoxY1lDGA8oLzYKcp7OslI6sPhv/NGnkQBwV964dcffnn6dezFyKKBGir\nDSiM9duWTttlzzUhUQMHCua2z/LXjz1XMb0LoSEOVdk00TDgRMSFhBLhr3ZXmoLb\nIqi7is4z2mP8pbcIIlmloogE\n-----END PRIVATE KEY-----", + "client_email": "foo@bar.com", + "client_id": "007155790781103885639", + "auth_uri": "http://google_scc:8090/o/oauth2/auth", + "token_uri": "http://google_scc:8090/token", + "auth_provider_x509_cert_url": "http://google_scc:8090/oauth2/v1/certs", + "client_x509_cert_url": "http://google_scc:8090/robot/v1/metadata/x509/foo%40bar.com" + } + parent_type: organizations + id: xxxx +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/google_scc/data_stream/finding/_dev/test/system/test-pubsub-config.yml b/packages/google_scc/data_stream/finding/_dev/test/system/test-pubsub-config.yml new file mode 100644 index 00000000000..f33a8477a29 --- /dev/null +++ b/packages/google_scc/data_stream/finding/_dev/test/system/test-pubsub-config.yml @@ -0,0 +1,12 @@ +service: gcppubsub-emulator +input: gcp-pubsub +vars: + credentials_type: credentials_json + credentials: >- + {"type":"service_account","project_id":"finding","private_key_id":"x","private_key":"","client_email":"foo@bar.com","client_id":"0","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_x509_cert_url":"https://foo.bar/path"} + project_id: finding +data_stream: + vars: + alternative_host: "{{Hostname}}:{{Port}}" + topic: topic + subscription_name: subscription diff --git a/packages/google_scc/data_stream/finding/agent/stream/gcp-pubsub.yml.hbs b/packages/google_scc/data_stream/finding/agent/stream/gcp-pubsub.yml.hbs new file mode 100644 index 00000000000..f953d6fe651 --- /dev/null +++ b/packages/google_scc/data_stream/finding/agent/stream/gcp-pubsub.yml.hbs @@ -0,0 +1,39 @@ +{{#if project_id}} +project_id: {{project_id}} +{{/if}} +{{#if topic}} +topic: {{topic}} +{{/if}} +{{#if subscription_name}} +subscription.name: {{subscription_name}} +{{/if}} +{{#if alternative_host}} +alternative_host: {{alternative_host}} +{{/if}} +{{#if subscription_create}} +subscription.create: {{subscription_create}} +{{/if}} +{{#if subscription_num_goroutines}} +subscription.num_goroutines: {{subscription_num_goroutines}} +{{/if}} +{{#if subscription_max_outstanding_messages}} +subscription.max_outstanding_messages: {{subscription_max_outstanding_messages}} +{{/if}} +{{credentials_type}}: {{credentials}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/finding/agent/stream/httpjson.yml.hbs b/packages/google_scc/data_stream/finding/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..6ab4dd5414b --- /dev/null +++ b/packages/google_scc/data_stream/finding/agent/stream/httpjson.yml.hbs @@ -0,0 +1,63 @@ +config_version: '2' +interval: {{interval}} +request.method: GET +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +auth.oauth2.provider: google +auth.oauth2.google.{{credentials_type}}: {{credentials}} +auth.oauth2.scopes: + - https://www.googleapis.com/auth/cloud-platform + +{{#if proxy_url}} +request.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +request.timeout: {{http_client_timeout}} +{{/if}} +request.url: {{url}}/v1/{{parent_type}}/{{id}}/sources/-/findings +request.transforms: + - set: + target: url.params.pageSize + value: {{batch_size}} + - set: + target: url.params.filter + value: '[[sprintf "eventTime >= %q" (formatDate (parseDate .cursor.last_event_time) "RFC3339")]]' + default: '[[sprintf "eventTime >= %q" (formatDate (now (parseDuration "-{{initial_interval}}")) "RFC3339")]]' + - set: + target: url.params.orderBy + value: 'eventTime asc' +response.pagination: + - set: + target: url.params.filter + value: '[[(.last_response.url.params.Get "filter")]]' + fail_on_template_error: true + - set: + target: url.params.pageToken + value: '[[if index .last_response.body "nextPageToken"]][[.last_response.body.nextPageToken]][[end]]' + fail_on_template_error: true +cursor: + last_event_time: + value: '[[.last_event.finding.eventTime]]' +response.split: + target: body.listFindingsResults +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/finding/elasticsearch/ingest_pipeline/default.yml b/packages/google_scc/data_stream/finding/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..2675225c7db --- /dev/null +++ b/packages/google_scc/data_stream/finding/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,1893 @@ +--- +description: Pipeline for processing Finding logs. +processors: + - set: + field: ecs.version + value: 8.9.0 + tag: set_ecs_version + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - json: + field: event.original + tag: 'json_decoding' + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - drop: + if: ctx.json?.listFindingsResults != null && ctx.json.listFindingsResults.isEmpty() + tag: drop_listFindingsResults + - fingerprint: + fields: + - json.finding.eventTime + - json.finding.createTime + tag: fingerprint_processor + target_field: _id + ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - set: + field: event.kind + tag: set_event_kind + value: alert + if: ctx.json?.finding?.findingClass != null && ['THREAT','VULNERABILITY','MISCONFIGURATION'].contains(ctx.json.finding.findingClass.toLowerCase()) + - set: + field: event.category + tag: set_event_category + value: [vulnerability] + if: ctx.json?.finding?.findingClass == 'VULNERABILITY' + - set: + field: event.category + tag: set_event_category + value: [threat] + if: ctx.json?.finding?.findingClass == 'THREAT' + - set: + field: event.type + tag: set_event_type + value: [info] + if: ctx.json?.finding?.findingClass == 'VULNERABILITY' + - set: + field: event.type + tag: set_event_type + value: [indicator] + if: ctx.json?.finding?.findingClass == 'THREAT' + - date: + field: json.finding.eventTime + target_field: google_scc.finding.event_time + tag: date_finding_eventTime + formats: + - ISO8601 + if: ctx.json?.finding?.eventTime != null && ctx.json.finding.eventTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: google_scc.finding.event_time + tag: date_timestamp + formats: + - ISO8601 + if: ctx.google_scc?.finding?.event_time != null && ctx.google_scc.finding.event_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.finding.createTime + target_field: google_scc.finding.create_time + tag: date_finding_createTime + formats: + - ISO8601 + if: ctx.json?.finding?.createTime != null && ctx.json.finding.createTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: google_scc.finding.create_time + target_field: event.created + tag: date_event_created + formats: + - ISO8601 + if: ctx.google_scc?.finding?.create_time != null && ctx.google_scc.finding.create_time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.finding.description + target_field: google_scc.finding.description + tag: rename_finding_description + ignore_missing: true + - set: + field: message + tag: set_message + copy_from: google_scc.finding.description + ignore_empty_value: true + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.destinationIp + target_field: _ingest._value.destination.ip + tag: convert_destinationIp_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.destinationIp + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_destination_ip_to_related_ip + value: '{{{_ingest._value.destination.ip}}}' + allow_duplicates: false + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: destination.ip + tag: append_destination_ip_to_destination_ip + value: '{{{_ingest._value.destination.ip}}}' + allow_duplicates: false + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.destinationPort + target_field: _ingest._value.destination.port + tag: convert_destinationPort_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.destinationPort + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: destination.port + tag: append_destination_port_to_destination_port + value: '{{{_ingest._value.destination.port}}}' + allow_duplicates: false + - convert: + field: destination.port + tag: convert_destination_port_to_long + type: long + ignore_missing: true + if: ctx.destination?.port != '' + on_failure: + - remove: + field: destination.port + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.sourceIp + target_field: _ingest._value.source.ip + tag: convert_sourceIp_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.sourceIp + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_source_ip_to_related_ip + value: '{{{_ingest._value.source.ip}}}' + allow_duplicates: false + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: source.ip + tag: append_source_ip_to_source_ip + value: '{{{_ingest._value.source.ip}}}' + allow_duplicates: false + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.sourcePort + target_field: _ingest._value.source.port + tag: convert_source_port_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.sourcePort + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: source.port + tag: append_source_port_to_source_port + value: '{{{_ingest._value.source.port}}}' + allow_duplicates: false + - convert: + field: source.port + tag: convert_source_port_to_long + type: long + ignore_missing: true + if: ctx.source?.port != '' + on_failure: + - remove: + field: source.port + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + append: + field: network.transport + tag: append_protocol_to_network_transport + value: '{{{_ingest._value.protocol}}}' + allow_duplicates: false + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + lowercase: + field: network.transport + tag: lowercase_network_transport + - foreach: + field: json.finding.connections + if: ctx.json?.finding?.connections instanceof List + ignore_failure: true + processor: + remove: + field: + - _ingest._value.sourcePort + - _ingest._value.sourceIp + - _ingest._value.destinationPort + - _ingest._value.destinationIp + tag: remove_sourcePort_sourceIp_destinationPort_destinationIp + ignore_missing: true + - rename: + field: json.finding.connections + target_field: google_scc.finding.connections + tag: rename_finding_connections + ignore_missing: true + - rename: + field: json.finding.mitreAttack.additionalTactics + target_field: google_scc.finding.mitre_attack.additional.tactics + tag: rename_finding_mitreAttack_additionalTactics + ignore_missing: true + - foreach: + field: google_scc.finding.mitre_attack.additional.tactics + if: ctx.google_scc?.finding?.mitre_attack?.additional?.tactics instanceof List + ignore_failure: true + processor: + append: + field: threat.tactic.name + tag: append_additional_tactics_to_threat_tactic_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.finding.mitreAttack.primaryTactic + target_field: google_scc.finding.mitre_attack.primary.tactic + tag: rename_finding_mitreAttack_primaryTactic + ignore_missing: true + - append: + field: threat.tactic.name + tag: append_primary_tactics_to_threat_tactic_name + value: '{{{google_scc.finding.mitre_attack.primary.tactic}}}' + allow_duplicates: false + if: ctx.google_scc?.finding?.mitre_attack?.primary?.tactic != null + - rename: + field: json.finding.mitreAttack.additionalTechniques + target_field: google_scc.finding.mitre_attack.additional.techniques + tag: rename_finding_mitreAttack_additionalTechniques + ignore_missing: true + - foreach: + field: google_scc.finding.mitre_attack.additional.techniques + if: ctx.google_scc?.finding?.mitre_attack?.additional?.techniques instanceof List + ignore_failure: true + processor: + append: + field: threat.technique.name + tag: append_mitre_attack_additional_technique_to_threat_technique_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.finding.mitreAttack.primaryTechniques + target_field: google_scc.finding.mitre_attack.primary.techniques + tag: rename_finding_mitreAttack_primaryTechniques + ignore_missing: true + - foreach: + field: google_scc.finding.mitre_attack.primary.techniques + if: ctx.google_scc?.finding?.mitre_attack?.primary?.techniques instanceof List + ignore_failure: true + processor: + append: + field: threat.technique.name + tag: append_mitre_attack_primary_technique_to_threat_technique_name + value: '{{{_ingest._value}}}' + allow_duplicates: false + - script: + lang: painless + description: Set Threat Tactic ID and Threat Technique ID + tag: painless_set_threat_tactic_id_and_threat_technique_id + # Threat Tactic Enums + # https://cloud.google.com/security-command-center/docs/reference/rest/v1/organizations.sources.findings#Tactic + # Threat Technique Enums + # https://cloud.google.com/security-command-center/docs/reference/rest/v1/organizations.sources.findings#technique + params: + tactic: + 'RECONNAISSANCE': 'TA0043' + 'RESOURCE_DEVELOPMENT': 'TA0042' + 'INITIAL_ACCESS': 'TA0001' + 'EXECUTION': 'TA0002' + 'PERSISTENCE': 'TA0003' + 'PRIVILEGE_ESCALATION': 'TA0004' + 'DEFENSE_EVASION': 'TA0005' + 'CREDENTIAL_ACCESS': 'TA0006' + 'DISCOVERY': 'TA0007' + 'LATERAL_MOVEMENT': 'TA0008' + 'COLLECTION': 'TA0009' + 'COMMAND_AND_CONTROL': 'TA0011' + 'EXFILTRATION': 'TA0010' + 'IMPACT': 'TA0040' + technique: + 'ACTIVE_SCANNING': 'T1595' + 'SCANNING_IP_BLOCKS': 'T1595.001' + 'INGRESS_TOOL_TRANSFER': 'T1105' + 'NATIVE_API': 'T1106' + 'SHARED_MODULES': 'T1129' + 'COMMAND_AND_SCRIPTING_INTERPRETER': 'T1059' + 'UNIX_SHELL': 'T1059.004' + 'RESOURCE_HIJACKING': 'T1496' + 'PROXY': 'T1090' + 'EXTERNAL_PROXY': 'T1090.002' + 'MULTI_HOP_PROXY': 'T1090.003' + 'DYNAMIC_RESOLUTION': 'T1568' + 'UNSECURED_CREDENTIALS': 'T1552' + 'VALID_ACCOUNTS': 'T1078' + 'LOCAL_ACCOUNTS': 'T1078.003' + 'CLOUD_ACCOUNTS': 'T1078.004' + 'NETWORK_DENIAL_OF_SERVICE': 'T1498' + 'PERMISSION_GROUPS_DISCOVERY': 'T1069' + 'CLOUD_GROUPS': 'T1069.003' + 'EXFILTRATION_OVER_WEB_SERVICE': 'T1567' + 'EXFILTRATION_TO_CLOUD_STORAGE': 'T1567.002' + 'ACCOUNT_MANIPULATION': 'T1098' + 'SSH_AUTHORIZED_KEYS': 'T1098.004' + 'CREATE_OR_MODIFY_SYSTEM_PROCESS': 'T1543' + 'STEAL_WEB_SESSION_COOKIE': 'T1539' + 'MODIFY_CLOUD_COMPUTE_INFRASTRUCTURE': 'T1578' + 'EXPLOIT_PUBLIC_FACING_APPLICATION': 'T1190' + 'MODIFY_AUTHENTICATION_PROCESS': 'T1556' + 'DATA_DESTRUCTION': 'T1485' + 'DOMAIN_POLICY_MODIFICATION': 'T1484' + 'IMPAIR_DEFENSES': 'T1562' + 'NETWORK_SERVICE_DISCOVERY': 'T1046' + 'ACCESS_TOKEN_MANIPULATION': 'T1134' + 'ABUSE_ELEVATION_CONTROL_MECHANISM': 'T1548' + 'DEFAULT_ACCOUNTS': 'T1078.001' + source: |- + if(ctx.threat?.tactic?.name instanceof List){ + def list = new ArrayList(); + for(def value : ctx.threat.tactic.name){ + list.add(params.tactic.get(value)); + } + ctx.threat.tactic.put('id',list); + } + if(ctx.threat?.technique?.name instanceof List){ + def list = new ArrayList(); + for(def value : ctx.threat.technique.name){ + list.add(params.technique.get(value)); + } + ctx.threat.technique.put('id',list); + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.finding.externalUri + target_field: google_scc.finding.external_uri + tag: rename_finding_externalUri + ignore_missing: true + - set: + field: url.original + copy_from: google_scc.finding.external_uri + tag: set_url_original + ignore_empty_value: true + - uri_parts: + field: url.original + if: ctx.google_scc?.finding?.external_uri != null && ctx.google_scc.finding.external_uri != '' + tag: uri_parts_processor + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.finding.database.userName + target_field: google_scc.finding.database.user_name + tag: rename_finding_database_userName + ignore_missing: true + - set: + field: user.name + tag: set_user_name + copy_from: google_scc.finding.database.user_name + ignore_empty_value: true + - append: + field: related.user + tag: append_user_name_to_related_user + value: '{{{user.name}}}' + allow_duplicates: false + if: ctx.user?.name != null + - set: + field: vulnerability.classification + value: CVSS + if: ctx.json?.finding?.vulnerability != null + tag: set_vulnerability_classification + - set: + field: vulnerability.enumeration + value: CVE + if: ctx.json?.finding?.vulnerability != null + tag: set_vulnerability_enumeration + - set: + field: vulnerability.score.version + value: '3.1' + if: ctx.json?.finding?.vulnerability != null + tag: set_vulnerability_score_version + - rename: + field: json.finding.vulnerability.cve.id + target_field: google_scc.finding.vulnerability.cve.id + tag: rename_finding_vulnerability_cve_id + ignore_missing: true + - set: + field: vulnerability.id + tag: set_vulnerability_id + copy_from: google_scc.finding.vulnerability.cve.id + ignore_empty_value: true + - foreach: + field: json.finding.vulnerability.cve.references + if: ctx.json?.finding?.vulnerability?.cve?.references instanceof List + ignore_failure: true + processor: + set: + field: vulnerability.reference + tag: set_vulnerability_reference + value: '{{{_ingest._value.uri}}}' + - convert: + field: json.finding.vulnerability.cve.cvssv3.baseScore + target_field: google_scc.finding.vulnerability.cve.cvssv3.base_score + tag: convert_finding_vulnerability_cve_cvssv3_baseScore_to_long + type: long + ignore_missing: true + if: ctx.json?.finding?.vulnerability?.cve?.cvssv3?.baseScore != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: vulnerability.score.base + tag: set_vulnerability_score_base + copy_from: google_scc.finding.vulnerability.cve.cvssv3.base_score + ignore_empty_value: true + - rename: + field: json.notificationConfigName + target_field: google_scc.finding.notification_config_name + tag: rename_notificationConfigName + ignore_missing: true + - convert: + field: json.finding.access.callerIp + target_field: google_scc.finding.access.caller_ip + tag: convert_finding_access_callerIp_to_ip + type: ip + ignore_missing: true + if: ctx.json?.finding?.access?.callerIp != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_finding_access_caller_ip_to_related_ip + value: '{{{google_scc.finding.access.caller_ip}}}' + allow_duplicates: false + if: ctx.google_scc?.finding?.access?.caller_ip != null + - rename: + field: json.finding.access.callerIpGeo.regionCode + target_field: google_scc.finding.access.caller_ip_geo.region_code + tag: rename_finding_access_callerIpGeo_regionCode + ignore_missing: true + - rename: + field: json.finding.access.methodName + target_field: google_scc.finding.access.method_name + tag: rename_finding_access_methodName + ignore_missing: true + - rename: + field: json.finding.access.principalEmail + target_field: google_scc.finding.access.principal.email + tag: rename_finding_access_principalEmail + ignore_missing: true + - rename: + field: json.finding.access.principalSubject + target_field: google_scc.finding.access.principal.subject + tag: rename_finding_access_principalSubject + ignore_missing: true + - foreach: + field: json.finding.access.serviceAccountDelegationInfo + if: ctx.json?.finding?.access?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.principalEmail + target_field: _ingest._value.principal.email + tag: rename_finding_access_serviceAccountDelegationInfo_principalEmail + ignore_missing: true + - foreach: + field: json.finding.access.serviceAccountDelegationInfo + if: ctx.json?.finding?.access?.serviceAccountDelegationInfo instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.principalSubject + target_field: _ingest._value.principal.subject + tag: rename_finding_access_serviceAccountDelegationInfo_principalSubject + ignore_missing: true + - rename: + field: json.finding.access.serviceAccountDelegationInfo + target_field: google_scc.finding.access.service_account.delegation_info + tag: rename_finding_access_serviceAccountDelegationInfo + ignore_missing: true + - rename: + field: json.finding.access.serviceAccountKeyName + target_field: google_scc.finding.access.service_account.key_name + tag: rename_finding_access_serviceAccountKeyName + ignore_missing: true + - rename: + field: json.finding.access.serviceName + target_field: google_scc.finding.access.service_name + tag: rename_finding_access_serviceName + ignore_missing: true + - rename: + field: json.finding.access.userName + target_field: google_scc.finding.access.user_name + tag: rename_finding_access_userName + ignore_missing: true + - rename: + field: json.finding.access.userAgentFamily + target_field: google_scc.finding.access.user_agent_family + tag: rename_finding_access_userAgentFamily + ignore_missing: true + - rename: + field: json.finding.canonicalName + target_field: google_scc.finding.canonical_name + tag: rename_finding_canonicalName + ignore_missing: true + - rename: + field: json.finding.category + target_field: google_scc.finding.category + tag: rename_finding_category + ignore_missing: true + - rename: + field: json.finding.parentDisplayName + target_field: google_scc.finding.parent_display_name + tag: rename_finding_parentDisplayName + ignore_missing: true + - rename: + field: json.finding.findingClass + target_field: google_scc.finding.class + tag: rename_finding_findingClass + ignore_missing: true + - rename: + field: json.finding.cloudDlpDataProfile.dataProfile + target_field: google_scc.finding.cloud_dlp.data_profile.value + tag: rename_finding_cloudDlpDataProfile_dataProfile + ignore_missing: true + - convert: + field: json.finding.cloudDlpInspection.fullScan + target_field: google_scc.finding.cloud_dlp.inspection.full_scan + tag: convert_finding_cloudDlpInspection_fullScan_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.cloudDlpInspection?.fullScan != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.cloudDlpInspection.infoTypeCount + target_field: google_scc.finding.cloud_dlp.inspection.info_type.count + tag: convert_finding_cloudDlpInspection_fullScan_to_boolean + type: long + ignore_missing: true + if: ctx.json?.finding?.cloudDlpInspection?.infoTypeCount != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.finding.cloudDlpInspection.infoType + target_field: google_scc.finding.cloud_dlp.inspection.info_type.value + tag: rename_finding_cloudDlpInspection_infoType + ignore_missing: true + - rename: + field: json.finding.cloudDlpInspection.inspectJob + target_field: google_scc.finding.cloud_dlp.inspection.inspect_job + tag: rename_finding_cloudDlpInspection_inspectJob + ignore_missing: true + - rename: + field: json.finding.compliances + target_field: google_scc.finding.compliances + tag: rename_finding_compliances + ignore_missing: true + - rename: + field: json.finding.contacts.billing.contacts + target_field: google_scc.finding.contacts.billing + tag: rename_finding_contacts_billing_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.legal.contacts + target_field: google_scc.finding.contacts.legal + tag: rename_finding_contacts_legal_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.security.contacts + target_field: google_scc.finding.contacts.security + tag: rename_finding_contacts_security_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.all.contacts + target_field: google_scc.finding.contacts.all + tag: rename_finding_contacts_all_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.product_updates.contacts + target_field: google_scc.finding.contacts.product_updates + tag: rename_finding_contacts_product_updates_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.suspension.contacts + target_field: google_scc.finding.contacts.suspension + tag: rename_finding_contacts_suspension_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.technical.contacts + target_field: google_scc.finding.contacts.technical + tag: rename_finding_contacts_technical_contacts + ignore_missing: true + - rename: + field: json.finding.contacts.technical_incidents.contacts + target_field: google_scc.finding.contacts.technical_incidents + tag: rename_finding_contacts_technical_incidents_contacts + ignore_missing: true + - foreach: + field: json.finding.containers + if: ctx.json?.finding?.containers instanceof List + ignore_failure: true + processor: + append: + field: container.name + tag: append_finding_containers_name_to_conatiner_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - foreach: + field: json.finding.containers + if: ctx.json?.finding?.containers instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.imageId + target_field: _ingest._value.image_id + tag: rename_imageId + ignore_missing: true + - rename: + field: json.finding.containers + target_field: google_scc.finding.containers + tag: rename_finding_containers + ignore_missing: true + - rename: + field: json.finding.database.displayName + target_field: google_scc.finding.database.display_name + tag: rename_finding_database_displayName + ignore_missing: true + - rename: + field: json.finding.database.grantees + target_field: google_scc.finding.database.grantees + tag: rename_finding_database_grantees + ignore_missing: true + - rename: + field: json.finding.database.name + target_field: google_scc.finding.database.name + tag: rename_finding_database_name + ignore_missing: true + - rename: + field: json.finding.database.query + target_field: google_scc.finding.database.query + tag: rename_finding_database_query + ignore_missing: true + - rename: + field: json.finding.exfiltration + target_field: google_scc.finding.exfiltration + tag: rename_finding_exfiltration + ignore_missing: true + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.size + tag: convert_file_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.size + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.hashedSize + tag: convert_file_hashedSize_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.hashedSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.partiallyHashed + tag: convert_file_partiallyHashed_to boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.partiallyHashed + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + append: + field: file.path + tag: append_files_path_to_file_path + value: '{{{_ingest._value.path}}}' + allow_duplicates: false + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + append: + field: file.size + tag: append_files_size_to_file_size + value: '{{{_ingest._value.size}}}' + allow_duplicates: false + - convert: + field: file.size + tag: convert_file_size_to_long + type: long + ignore_missing: true + if: ctx.file?.size != '' + on_failure: + - remove: + field: file.size + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + append: + field: file.hash.sha256 + tag: append_files_sha256_to_file_hash_sha256 + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - foreach: + field: json.finding.files + if: ctx.json?.finding?.files instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_files_sha256_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - script: + lang: painless + description: This script processor rename the fields under the files objects. + if: ctx.json?.finding?.files != null + params: + "files": "files" + "hashedSize": "hashed_size" + "partiallyHashed": "partially_hashed" + tag: painless_to_rename_fields_under_files_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def files = new ArrayList(); + for(entity in ctx.json.finding.files){ + files.add(renameKeys(entity, params)); + } + ctx.json.finding.remove('files'); + ctx.google_scc.finding.put('files',files); + - rename: + field: json.finding.iamBindings + target_field: google_scc.finding.iam_bindings + tag: rename_finding_iamBindings + ignore_missing: true + - foreach: + field: google_scc.finding.iam_bindings + if: ctx.google_scc?.finding?.iam_bindings instanceof List + ignore_failure: true + processor: + append: + field: user.roles + tag: append_iam_bindings_role_to_user_roles + value: '{{{_ingest._value.role}}}' + allow_duplicates: false + - foreach: + field: json.finding.indicator.ipAddresses + if: ctx.json?.finding?.indicator?.ipAddresses instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value + tag: convert_finding_indicator_ipAddresses_to_ip + type: ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.indicator.ipAddresses + if: ctx.json?.finding?.indicator?.ipAddresses instanceof List + ignore_failure: true + processor: + append: + field: related.ip + tag: append_finding_indicator_ipAddresses_related_ip + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.finding.indicator.ipAddresses + target_field: google_scc.finding.indicator.ip_addresses + tag: rename_finding_indicator_ipAddresses + ignore_missing: true + - rename: + field: json.finding.indicator.domains + target_field: google_scc.finding.indicator.domains + tag: rename_finding_indicator_domains + ignore_missing: true + - foreach: + field: json.finding.indicator.signatures + if: ctx.json?.finding?.indicator?.signatures instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.memoryHashSignature.detections + ignore_failure: true + processor: + convert: + field: _ingest._value.percentPagesMatched + tag: convert_finding_indicator_signatures_percentPagesMatched_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.percentPagesMatched + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}''Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the indicator.signatures objects. + if: ctx.json?.finding?.indicator?.signatures != null + params: + "signatures": "signatures" + "memoryHashSignature": "memory_hash_signature" + "binaryFamily": "binary_family" + "detections": "detections" + "binary": "binary" + "percentPagesMatched": "percent_pages_matched" + "yaraRuleSignature": "yara" + "yaraRule": "rule" + tag: painless_to_rename_fields_under_indicator_signatures_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def signatures = new ArrayList(); + for(entity in ctx.json.finding.indicator.signatures){ + signatures.add(renameKeys(entity, params)); + } + ctx.json.finding.indicator.remove('signatures'); + ctx.google_scc.finding.indicator.put('signatures',signatures); + - rename: + field: json.finding.indicator.uris + target_field: google_scc.finding.indicator.uris + tag: rename_finding_indicator_uris + ignore_missing: true + - rename: + field: json.finding.kernelRootkit.name + target_field: google_scc.finding.kernel_root_kit.name + tag: rename_finding_kernelRootkit_name + ignore_missing: true + - convert: + field: json.finding.kernelRootkit.unexpectedCodeModification + target_field: google_scc.finding.kernel_root_kit.unexpected.code_modification + tag: convert_finding_kernelRootkit_unexpectedCodeModification_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedCodeModification != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedFtraceHandler + target_field: google_scc.finding.kernel_root_kit.unexpected.ftrace_handler + tag: convert_finding_kernelRootkit_unexpectedFtraceHandler_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedFtraceHandler != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedInterruptHandler + target_field: google_scc.finding.kernel_root_kit.unexpected.interrupt_handler + tag: convert_finding_kernelRootkit_unexpectedInterruptHandler_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedInterruptHandler != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedKernelCodePages + target_field: google_scc.finding.kernel_root_kit.unexpected.kernel_code_pages + tag: convert_finding_kernelRootkit_unexpectedKernelCodePages_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedKernelCodePages != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedKprobeHandler + target_field: google_scc.finding.kernel_root_kit.unexpected.kprobe_handler + tag: convert_finding_kernelRootkit_unexpectedKprobeHandler_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedKprobeHandler != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedProcessesInRunqueue + target_field: google_scc.finding.kernel_root_kit.unexpected.processes_in_runqueue + tag: convert_finding_kernelRootkit_unexpectedProcessesInRunqueue_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedProcessesInRunqueue != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedReadOnlyDataModification + target_field: google_scc.finding.kernel_root_kit.unexpected.read_only_data_modification + tag: convert_finding_kernelRootkit_unexpectedReadOnlyDataModification_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedReadOnlyDataModification != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.finding.kernelRootkit.unexpectedSystemCallHandler + target_field: google_scc.finding.kernel_root_kit.unexpected.system_call_handler + tag: convert_finding_kernelRootkit_unexpectedSystemCallHandler_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.kernelRootkit?.unexpectedSystemCallHandler != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script processor rename the fields under the kubernetes objects. + if: ctx.json?.finding?.kubernetes != null + params: + "pods": "pods" + "accessReviews": "access_reviews" + "nodePools": "node_pools" + "bindings": "bindings" + "subjects": "subjects" + "roles": "roles" + "ns": "namespace" + "containers": "containers" + "imageId": "image_id" + tag: painless_to_rename_fields_under_kubernetes_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def pods = new ArrayList(); + for(entity in ctx.json.finding.kubernetes.pods){ + pods.add(renameKeys(entity, params)); + } + ctx.json.finding.kubernetes.remove('pods'); + ctx.json.finding.kubernetes.put('pods',pods); + + def node_pools = new ArrayList(); + for(entity in ctx.json.finding.kubernetes.nodePools){ + node_pools.add(renameKeys(entity, params)); + } + ctx.json.finding.kubernetes.remove('nodePools'); + ctx.json.finding.kubernetes.put('node_pools',node_pools); + + def roles = new ArrayList(); + for(entity in ctx.json.finding.kubernetes.roles){ + roles.add(renameKeys(entity, params)); + } + ctx.json.finding.kubernetes.remove('roles'); + ctx.json.finding.kubernetes.put('roles',roles); + + def bindings = new ArrayList(); + for(entity in ctx.json.finding.kubernetes.bindings){ + bindings.add(renameKeys(entity, params)); + } + ctx.json.finding.kubernetes.remove('bindings'); + ctx.json.finding.kubernetes.put('bindings',bindings); + + def access_reviews = new ArrayList(); + for(entity in ctx.json.finding.kubernetes.accessReviews){ + access_reviews.add(renameKeys(entity, params)); + } + ctx.json.finding.kubernetes.remove('accessReviews'); + ctx.json.finding.kubernetes.put('access_reviews',access_reviews); + - rename: + field: json.finding.kubernetes + target_field: google_scc.finding.kubernetes + tag: rename_finding_kubernetes + ignore_missing: true + - rename: + field: json.finding.mitreAttack.version + target_field: google_scc.finding.mitre_attack.version + tag: rename_finding_mitreAttack_version + ignore_missing: true + - rename: + field: json.finding.muteInitiator + target_field: google_scc.finding.mute.initiator + tag: rename_finding_muteInitiator + ignore_missing: true + - rename: + field: json.finding.mute + target_field: google_scc.finding.mute.state + tag: rename_finding_mute + ignore_missing: true + - date: + field: json.finding.muteUpdateTime + target_field: google_scc.finding.mute.update_time + tag: date_finding_muteUpdateTime + formats: + - ISO8601 + if: ctx.json?.finding?.muteUpdateTime != null && ctx.json.finding.muteUpdateTime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.finding.externalSystems + target_field: google_scc.finding.external_systems + tag: rename_finding_externalSystems + ignore_missing: true + - rename: + field: json.finding.name + target_field: google_scc.finding.name + tag: rename_finding_name + ignore_missing: true + - rename: + field: json.finding.nextSteps + target_field: google_scc.finding.next_steps + tag: rename_finding_nextSteps + ignore_missing: true + - rename: + field: json.finding.moduleName + target_field: google_scc.finding.module_name + tag: rename_finding_moduleName + ignore_missing: true + - rename: + field: json.finding.parent + target_field: google_scc.finding.parent + tag: rename_finding_parent + ignore_missing: true + - grok: + description: Extract Organization ID. + field: google_scc.finding.parent + tag: grok_to_extract_organization_id + if: ctx.google_scc?.finding?.parent != null + patterns: + - '^organizations/%{DATA:organization.id}/sources/%{DATA:google_scc.finding.source_id}$' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.binary.size + tag: convert_finding_processes_binary_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.binary.size + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.binary.hashedSize + tag: convert_finding_processes_binary_hashedSize_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.binary.hashedSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.binary.partiallyHashed + tag: convert_finding_processes_binary_partiallyHashed_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.binary.partiallyHashed + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.libraries + ignore_failure: true + processor: + convert: + field: _ingest._value.hashedSize + tag: convert_finding_processes_libraries_hashedSize_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.hashedSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.libraries + ignore_failure: true + processor: + convert: + field: _ingest._value.size + tag: convert_finding_processes_libraries_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.size + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.libraries + ignore_failure: true + processor: + convert: + field: _ingest._value.partiallyHashed + tag: convert_finding_processes_libraries_partiallyHashed_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.partiallyHashed + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.script.hashedSize + tag: convert_finding_processes_script_hashedSize_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.script.hashedSize + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.script.size + tag: convert_finding_processes_script_size_to_long + type: long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.script.size + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.script.partiallyHashed + tag: convert_finding_processes_script_partiallyHashed_to_boolean + type: boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.script.partiallyHashed + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_finding_processes_script_sha256_to_related_hash + value: '{{{_ingest._value.script.sha256}}}' + allow_duplicates: false + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + append: + field: related.hash + tag: append_finding_processes_binary_sha256_to_related_hash + value: '{{{_ingest._value.binary.sha256}}}' + allow_duplicates: false + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.libraries + ignore_failure: true + processor: + append: + field: related.hash + tag: append_finding_processes_libraries_sha256_to_related_hash + value: '{{{_ingest._value.sha256}}}' + allow_duplicates: false + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + append: + field: process.parent.pid + tag: append_finding_processes_parentPid_to_parent_pid + value: '{{{_ingest._value.parentPid}}}' + allow_duplicates: false + - convert: + field: process.parent.pid + tag: convert_process_parent_pid_to_long + type: long + ignore_missing: true + if: ctx.process?.parent?.pid != '' + on_failure: + - remove: + field: process.parent.pid + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + append: + field: process.pid + tag: append_finding_processes_pid_to_process_pid + value: '{{{_ingest._value.pid}}}' + allow_duplicates: false + - convert: + field: process.pid + tag: convert_process_pid_to_long + type: long + ignore_missing: true + if: ctx.process?.pid != '' + on_failure: + - remove: + field: process.pid + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.finding.processes + if: ctx.json?.finding?.processes instanceof List + ignore_failure: true + processor: + append: + field: process.name + tag: append_finding_processes_name_to_process_name + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + - script: + lang: painless + description: This script processor rename the fields under the processes objects. + if: ctx.json?.finding?.processes != null + params: + "processes": "processes" + "binary": "binary" + "libraries": "libraries" + "script": "script" + "hashedSize": "hashed_size" + "partiallyHashed": "partially_hashed" + "argumentsTruncated": "arguments_truncated" + "envVariables": "environment_variables" + "val": "value" + "envVariablesTruncated": "environment_variables_truncated" + "parentPid": "parent.pid" + tag: painless_to_rename_fields_under_processes_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + + def processes = new ArrayList(); + for(entity in ctx.json.finding.processes){ + processes.add(renameKeys(entity, params)); + } + ctx.json.finding.remove('processes'); + ctx.google_scc.finding.put('processes',processes); + - foreach: + field: google_scc.finding.processes + if: ctx.google_scc?.finding?.processes instanceof List + ignore_failure: true + processor: + dot_expander: + field: parent.pid + tag: dot_expander_parent_pid + path: _ingest._value + override: true + - rename: + field: json.resource.displayName + target_field: google_scc.finding.resource.display_name + tag: rename_resource_displayName + ignore_missing: true + - foreach: + field: json.resource.folders + if: ctx.json?.resource?.folders instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.resourceFolderDisplayName + target_field: _ingest._value.display_name + tag: rename_resourceFolderDisplayName + ignore_missing: true + - foreach: + field: json.resource.folders + if: ctx.json?.resource?.folders instanceof List + ignore_failure: true + processor: + rename: + field: _ingest._value.resourceFolder + target_field: _ingest._value.name + tag: rename_resourceFolder + ignore_missing: true + - rename: + field: json.resource.folders + target_field: google_scc.finding.resource.folders + tag: rename_resource_folders + ignore_missing: true + - rename: + field: json.finding.resourceName + target_field: google_scc.finding.resource_name + tag: rename_finding_resourceName + ignore_missing: true + - rename: + field: json.resource.name + target_field: google_scc.finding.resource.name + tag: rename_resource_name + ignore_missing: true + - rename: + field: json.resource.parentDisplayName + target_field: google_scc.finding.resource.parent.display_name + tag: rename_resource_parentDisplayName + ignore_missing: true + - rename: + field: json.resource.parentName + target_field: google_scc.finding.resource.parent.name + tag: rename_resource_parentName + ignore_missing: true + - rename: + field: json.resource.parent + target_field: google_scc.finding.resource.parent.name + tag: rename_resource_parent + ignore_missing: true + - rename: + field: json.resource.projectDisplayName + target_field: google_scc.finding.resource.project.display_name + tag: rename_resource_projectDisplayName + ignore_missing: true + - rename: + field: json.resource.projectName + target_field: google_scc.finding.resource.project.name + tag: rename_resource_projectName + ignore_missing: true + - rename: + field: json.resource.project + target_field: google_scc.finding.resource.project.name + tag: rename_resource_project + ignore_missing: true + - rename: + field: json.resource.type + target_field: google_scc.finding.resource.type + tag: rename_resource_type + ignore_missing: true + - rename: + field: json.finding.securityMarks.canonicalName + target_field: google_scc.finding.security_marks.canonical_name + tag: rename_finding_securityMarks_canonicalName + ignore_missing: true + - rename: + field: json.finding.securityMarks.name + target_field: google_scc.finding.security_marks.name + tag: rename_finding_securityMarks_name + ignore_missing: true + - rename: + field: json.finding.securityMarks.marks + target_field: google_scc.finding.security_marks.value + tag: rename_finding_securityMarks_marks + ignore_missing: true + - rename: + field: json.finding.severity + target_field: google_scc.finding.severity + tag: rename_finding_severity + ignore_missing: true + - rename: + field: json.finding.sourceProperties.supporting_data + target_field: google_scc.finding.source_properties_supporting_data + tag: rename_finding_sourceProperties_supporting_data + ignore_missing: true + - rename: + field: json.finding.sourceProperties + target_field: google_scc.finding.source_properties + tag: rename_finding_sourceProperties + ignore_missing: true + - rename: + field: json.finding.state + target_field: google_scc.finding.state + tag: rename_finding_state + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.attackComplexity + target_field: google_scc.finding.vulnerability.cve.cvssv3.attack.complexity + tag: rename_finding_vulnerability_cve_cvssv3_attackComplexity + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.attackVector + target_field: google_scc.finding.vulnerability.cve.cvssv3.attack.vector + tag: rename_finding_vulnerability_cve_cvssv3_attackVector + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.availabilityImpact + target_field: google_scc.finding.vulnerability.cve.cvssv3.availability_impact + tag: rename_finding_vulnerability_cve_cvssv3_availabilityImpact + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.confidentialityImpact + target_field: google_scc.finding.vulnerability.cve.cvssv3.confidentiality_impact + tag: rename_finding_vulnerability_cve_cvssv3_confidentialityImpact + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.integrityImpact + target_field: google_scc.finding.vulnerability.cve.cvssv3.integrity_impact + tag: rename_finding_vulnerability_cve_cvssv3_integrityImpact + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.privilegesRequired + target_field: google_scc.finding.vulnerability.cve.cvssv3.privileges_required + tag: rename_finding_vulnerability_cve_cvssv3_privilegesRequired + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.scope + target_field: google_scc.finding.vulnerability.cve.cvssv3.scope + tag: rename_finding_vulnerability_cve_cvssv3_scope + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.cvssv3.userInteraction + target_field: google_scc.finding.vulnerability.cve.cvssv3.user_interaction + tag: rename_finding_vulnerability_cve_cvssv3_userInteraction + ignore_missing: true + - rename: + field: json.finding.vulnerability.cve.references + target_field: google_scc.finding.vulnerability.cve.references + tag: rename_finding_vulnerability_cve_references + ignore_missing: true + - convert: + field: json.finding.vulnerability.cve.upstreamFixAvailable + target_field: google_scc.finding.vulnerability.cve.upstream_fix_available + tag: convert_finding_vulnerability_cve_upstreamFixAvailable_to_boolean + type: boolean + ignore_missing: true + if: ctx.json?.finding?.vulnerability?.cve?.upstreamFixAvailable != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: json + tag: remove_json + ignore_missing: true + - foreach: + field: google_scc.finding.vulnerability.cve.references + if: ctx.google_scc?.finding?.vulnerability?.cve?.references instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.uri + tag: remove_remove_duplicate_custom_fields_from_vulnerability_cve_references_array + ignore_missing: true + - foreach: + field: google_scc.finding.connections + if: ctx.google_scc?.finding?.connections instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.destination.ip + - _ingest._value.destination.port + - _ingest._value.source.ip + - _ingest._value.source.port + - _ingest._value.protocol + tag: remove_remove_duplicate_custom_fields_from_connections_array + ignore_missing: true + - foreach: + field: google_scc.finding.containers + if: ctx.google_scc?.finding?.containers instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.name + tag: remove_remove_duplicate_custom_fields_from_containers_array + ignore_missing: true + - foreach: + field: google_scc.finding.files + if: ctx.google_scc?.finding?.files instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.path + - _ingest._value.size + - _ingest._value.sha256 + tag: remove_remove_duplicate_custom_fields_from_files_array + ignore_missing: true + - foreach: + field: google_scc.finding.processes + if: ctx.google_scc?.finding?.processes instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.name + - _ingest._value.pid + - _ingest._value.parent.pid + tag: remove_remove_duplicate_custom_fields_from_processes_array + ignore_missing: true + - foreach: + field: google_scc.finding.iam_bindings + if: ctx.google_scc?.finding?.iam_bindings instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.role + tag: remove_remove_duplicate_custom_fields_from_iam_bindings_array + ignore_missing: true + - remove: + field: + - google_scc.finding.event_time + - google_scc.finding.create_time + - google_scc.finding.description + - google_scc.finding.mitre_attack.additional.tactics + - google_scc.finding.mitre_attack.primary.tactic + - google_scc.finding.mitre_attack.additional.techniques + - google_scc.finding.mitre_attack.primary.techniques + - google_scc.finding.external_uri + - google_scc.finding.database.user_name + - google_scc.finding.vulnerability.cve.id + - google_scc.finding.vulnerability.cve.cvssv3.base_score + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: event.original + tag: remove_event_original + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/finding/fields/base-fields.yml b/packages/google_scc/data_stream/finding/fields/base-fields.yml new file mode 100644 index 00000000000..92f3f46aab5 --- /dev/null +++ b/packages/google_scc/data_stream/finding/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: google_scc +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: google_scc.finding +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/google_scc/data_stream/finding/fields/beats.yml b/packages/google_scc/data_stream/finding/fields/beats.yml new file mode 100644 index 00000000000..2d5ae254634 --- /dev/null +++ b/packages/google_scc/data_stream/finding/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/google_scc/data_stream/finding/fields/fields.yml b/packages/google_scc/data_stream/finding/fields/fields.yml new file mode 100644 index 00000000000..c7180485200 --- /dev/null +++ b/packages/google_scc/data_stream/finding/fields/fields.yml @@ -0,0 +1,752 @@ +- name: google_scc + type: group + fields: + - name: finding + type: group + fields: + - name: access + type: group + fields: + - name: caller_ip + type: ip + description: Caller's IP address, such as "1.1.1.1". + - name: caller_ip_geo + type: group + fields: + - name: region_code + type: keyword + description: A CLDR. + - name: method_name + type: keyword + description: The method that the service account called, e.g. "SetIamPolicy". + - name: principal + type: group + fields: + - name: email + type: keyword + description: Associated email, such as "foo@google.com". + - name: subject + type: keyword + description: A string that represents the principalSubject that is associated with the identity. Unlike principalEmail, principalSubject supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format is principal://iam.googleapis.com/{identity pool name}/subject/{subject}. Some GKE identities, such as GKE_WORKLOAD, FREEFORM, and GKE_HUB_WORKLOAD, still use the legacy format serviceAccount:{identity pool name}[{subject}]. + - name: service_account + type: group + fields: + - name: delegation_info + type: group + fields: + - name: principal + type: group + fields: + - name: email + type: keyword + description: The email address of a Google account. + - name: subject + type: keyword + description: A string representing the principalSubject associated with the identity. As compared to principalEmail, supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format will be principal://iam.googleapis.com/{identity pool name}/subject/{subject} except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD) that are still in the legacy format serviceAccount:{identity pool name}[{subject}]. + - name: key_name + type: keyword + description: |- + The name of the service account key that was used to create or exchange credentials for authenticating the service account that made the request. This is a scheme-less URI full resource name. For example: + + "//iam.googleapis.com/projects/{PROJECT_ID}/serviceAccounts/{ACCOUNT}/keys/{key}". + - name: service_name + type: keyword + description: This is the API service that the service account made a call to, e.g. "iam.googleapis.com". + - name: user_agent_family + type: keyword + description: Type of user agent associated with the finding, for example, operating system shells and embedded or stand-alone applications. + - name: user_name + type: keyword + description: A string that represents a username. The username provided depends on the type of the finding and is likely not an IAM principal. For example, this can be a system username if the finding is related to a virtual machine, or it can be an application login username. + - name: canonical_name + type: keyword + description: The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}/findings/{findingId}", "folders/{folder_id}/sources/{source_id}/findings/{findingId}" or "projects/{project_number}/sources/{source_id}/findings/{findingId}", depending on the closest CRM ancestor of the resource associated with the finding. + - name: category + type: keyword + description: 'The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION".' + - name: class + type: keyword + description: The class of the finding. + - name: cloud_dlp + type: group + fields: + - name: data_profile + type: group + fields: + - name: value + type: keyword + description: Name of the data profile, for example, projects/123/locations/europe/tableProfiles/8383929. + - name: inspection + type: group + fields: + - name: full_scan + type: boolean + description: Whether Cloud DLP scanned the complete resource or a sampled subset. + - name: info_type + type: group + fields: + - name: count + type: long + description: The number of times Cloud DLP found this infoType within this job and resource. + - name: value + type: keyword + description: The type of information (or infoType) found, for example, EMAIL_ADDRESS or STREET_ADDRESS. + - name: inspect_job + type: keyword + description: Name of the inspection job, for example, projects/123/locations/europe/dlpJobs/i-8383929. + - name: compliances + type: group + fields: + - name: ids + type: keyword + description: Policies within the standard or benchmark, for example, A.12.4.1. + - name: standard + type: keyword + description: Industry-wide compliance standards or benchmarks, such as "cis", "pci", and "owasp". + - name: version + type: keyword + description: Version of the standard or benchmark, for example, "1.1". + - name: connections + type: group + fields: + - name: destination + type: group + fields: + - name: ip + type: ip + description: Destination IP address. Not present for sockets that are listening and not connected. + - name: port + type: long + description: Destination port. Not present for sockets that are listening and not connected. + - name: protocol + type: keyword + description: IANA Internet Protocol Number such as TCP(6) and UDP(17). + - name: source + type: group + fields: + - name: ip + type: ip + description: Source IP address. + - name: port + type: long + description: Source port. + - name: contacts + type: group + fields: + - name: all + type: group + fields: + - name: email + type: keyword + - name: billing + type: group + fields: + - name: email + type: keyword + - name: legal + type: group + fields: + - name: email + type: keyword + - name: product_updates + type: group + fields: + - name: email + type: keyword + - name: security + type: group + fields: + - name: email + type: keyword + - name: suspension + type: group + fields: + - name: email + type: keyword + - name: technical + type: group + fields: + - name: email + type: keyword + - name: technical_incidents + type: group + fields: + - name: email + type: keyword + - name: containers + type: group + fields: + - name: image_id + type: keyword + description: Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest. + - name: labels + type: group + fields: + - name: name + type: keyword + description: Name of the label. + - name: value + type: keyword + description: Value that corresponds to the label's name. + - name: name + type: keyword + description: Name of the container. + - name: uri + type: keyword + description: Container image URI provided when configuring a pod or container. May identify a container image version using mutable tags. + - name: create_time + type: date + description: The time at which the finding was created in Security Command Center. + - name: database + type: group + fields: + - name: display_name + type: keyword + description: The human-readable name of the database that the user connected to. + - name: grantees + type: keyword + description: The target usernames, roles, or groups of an SQL privilege grant, which is not an IAM policy change. + - name: name + type: keyword + description: The full resource name of the database that the user connected to, if it is supported by Cloud Asset Inventory. (https://google.aip.dev/122#full-resource-names) + - name: query + type: keyword + description: The SQL statement that is associated with the database access. + - name: user_name + type: keyword + description: The username used to connect to the database. The username might not be an IAM principal and does not have a set format. + - name: description + type: keyword + description: Contains more details about the finding. + - name: event_time + type: date + description: The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp. + - name: exfiltration + type: group + fields: + - name: sources + type: group + fields: + - name: components + type: keyword + description: Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same CloudSQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket. + - name: name + type: keyword + description: The resource's full resource name. + - name: targets + type: group + fields: + - name: components + type: keyword + description: Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same CloudSQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket. + - name: name + type: keyword + description: The resource's full resource name. + - name: external_systems + type: flattened + description: Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields. + - name: external_uri + type: keyword + description: The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL. + - name: files + type: group + fields: + - name: contents + type: keyword + description: Prefix of the file contents as a JSON-encoded string. + - name: hashed_size + type: long + description: The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. + - name: partially_hashed + type: boolean + description: True when the hash covers only a prefix of the file. + - name: path + type: keyword + description: Absolute path of the file as a JSON encoded string. + - name: sha256 + type: keyword + description: SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. + - name: size + type: long + description: Size of the file in bytes. + - name: iam_bindings + type: group + fields: + - name: action + type: keyword + description: The action that was performed on a Binding. + - name: member + type: keyword + description: A single identity requesting access for a Cloud Platform resource, for example, "foo@google.com". + - name: role + type: keyword + description: Role that is assigned to "members". For example, "roles/viewer", "roles/editor", or "roles/owner". + - name: indicator + type: group + fields: + - name: domains + type: keyword + description: List of domains associated with the finding. + - name: ip_addresses + type: ip + description: List of IP addresses associated with the finding. + - name: signatures + type: group + fields: + - name: memory_hash_signature + type: group + fields: + - name: binary_family + type: keyword + description: The binary family. + - name: detections + type: group + fields: + - name: binary + type: keyword + description: The name of the binary associated with the memory hash signature detection. + - name: percent_pages_matched + type: long + description: The percentage of memory page hashes in the signature that matched. + - name: yara + type: group + fields: + - name: rule + type: keyword + description: The name of the YARA rule. + - name: uris + type: keyword + description: The list of URIs that are associated with a finding. + - name: kernel_root_kit + type: group + fields: + - name: name + type: keyword + description: Rootkit name, when available. + - name: unexpected + type: group + fields: + - name: code_modification + type: boolean + description: True if unexpected modifications of kernel code memory are present. + - name: ftrace_handler + type: boolean + description: True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range. + - name: interrupt_handler + type: boolean + description: True if interrupt handlers that are are not in the expected kernel or module code regions are present. + - name: kernel_code_pages + type: boolean + description: True if kernel code pages that are not in the expected kernel or module code regions are present. + - name: kprobe_handler + type: boolean + description: True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range. + - name: processes_in_runqueue + type: boolean + description: True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list. + - name: read_only_data_modification + type: boolean + description: True if unexpected modifications of kernel read-only data memory are present. + - name: system_call_handler + type: boolean + description: True if system call handlers that are are not in the expected kernel or module code regions are present. + - name: kubernetes + type: group + fields: + - name: access_reviews + type: group + fields: + - name: group + type: keyword + description: The API group of the resource. "*" means all. + - name: name + type: keyword + description: The name of the resource being requested. Empty means all. + - name: namespace + type: keyword + description: Namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces. Both are represented by "" (empty). + - name: resource + type: keyword + description: The optional resource type requested. "*" means all. + - name: subresource + type: keyword + description: The optional subresource type. + - name: verb + type: keyword + description: A Kubernetes resource API verb, like get, list, watch, create, update, delete, proxy. "*" means all. + - name: version + type: keyword + description: The API version of the resource. "*" means all. + - name: bindings + type: group + fields: + - name: name + type: keyword + description: Name for the binding. + - name: namespace + type: keyword + description: Namespace for the binding. + - name: role + type: group + fields: + - name: kind + type: keyword + description: Role type. + - name: name + type: keyword + description: Role name. + - name: namespace + type: keyword + description: Role namespace. + - name: subjects + type: group + fields: + - name: kind + type: keyword + description: Authentication type for the subject. + - name: name + type: keyword + description: Name for the subject. + - name: namespace + type: keyword + description: Namespace for the subject. + - name: node_pools + type: group + fields: + - name: name + type: keyword + description: Kubernetes node pool name. + - name: nodes + type: group + fields: + - name: name + type: keyword + description: Full resource name of the Compute Engine VM running the cluster node. + - name: nodes + type: group + fields: + - name: name + type: keyword + description: Full resource name of the Compute Engine VM running the cluster node. + - name: pods + type: group + fields: + - name: containers + type: group + fields: + - name: image_id + type: keyword + description: Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest. + - name: labels + type: group + fields: + - name: name + type: keyword + description: Name of the label. + - name: value + type: keyword + description: Value that corresponds to the label's name. + - name: name + type: keyword + description: Name of the container. + - name: uri + type: keyword + description: Container image URI provided when configuring a pod or container. May identify a container image version using mutable tags. + - name: labels + type: group + fields: + - name: name + type: keyword + description: Name of the label. + - name: value + type: keyword + description: Value that corresponds to the label's name. + - name: name + type: keyword + description: Kubernetes Pod name. + - name: namespace + type: keyword + description: Kubernetes Pod namespace. + - name: roles + type: group + fields: + - name: kind + type: keyword + description: Role type. + - name: name + type: keyword + description: Role name. + - name: namespace + type: keyword + description: Role namespace. + - name: mitre_attack + type: group + fields: + - name: additional + type: group + fields: + - name: tactics + type: keyword + description: Additional MITRE ATT&CK tactics related to this finding, if any. + - name: techniques + type: keyword + description: Additional MITRE ATT&CK techniques related to this finding, if any, along with any of their respective parent techniques. + - name: primary + type: group + fields: + - name: tactic + type: keyword + description: The MITRE ATT&CK tactic most closely represented by this finding, if any. + - name: techniques + type: keyword + description: The MITRE ATT&CK technique most closely represented by this finding, if any. primaryTechniques is a repeated field because there are multiple levels of MITRE ATT&CK techniques. If the technique most closely represented by this finding is a sub-technique (e.g. SCANNING_IP_BLOCKS), both the sub-technique and its parent technique(s) will be listed (e.g. SCANNING_IP_BLOCKS, ACTIVE_SCANNING). + - name: version + type: keyword + description: The MITRE ATT&CK version referenced by the above fields. E.g. "8". + - name: module_name + type: keyword + description: 'Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885.' + - name: mute + type: group + fields: + - name: initiator + type: keyword + description: Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding. + - name: state + type: keyword + description: Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute. + - name: update_time + type: date + description: Output only. The most recent time this finding was muted or unmuted. + - name: name + type: keyword + description: 'The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}/findings/{findingId}".' + - name: next_steps + type: keyword + description: Steps to address the finding. + - name: notification_config_name + type: keyword + - name: parent + type: keyword + description: 'The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/{organization_id}/sources/{source_id}".' + - name: parent_display_name + type: keyword + description: Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics". + - name: processes + type: group + fields: + - name: args + type: keyword + description: Process arguments as JSON encoded strings. + - name: arguments_truncated + type: boolean + description: True if args is incomplete. + - name: binary + type: group + fields: + - name: contents + type: keyword + description: Prefix of the file contents as a JSON encoded string. + - name: hashed_size + type: long + description: The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. + - name: partially_hashed + type: boolean + description: True when the hash covers only a prefix of the file. + - name: path + type: keyword + description: Absolute path of the file as a JSON encoded string. + - name: sha256 + type: keyword + description: SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. + - name: size + type: long + description: Size of the file in bytes. + - name: environment_variables + type: group + fields: + - name: name + type: keyword + description: Environment variable name as a JSON encoded string. + - name: value + type: keyword + description: Environment variable value as a JSON encoded string. + - name: environment_variables_truncated + type: boolean + description: True if envVariables is incomplete. + - name: libraries + type: group + fields: + - name: contents + type: keyword + description: Prefix of the file contents as a JSON encoded string. + - name: hashed_size + type: long + description: The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. + - name: partially_hashed + type: boolean + description: True when the hash covers only a prefix of the file. + - name: path + type: keyword + description: Absolute path of the file as a JSON encoded string. + - name: sha256 + type: keyword + description: SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. + - name: size + type: long + description: Size of the file in bytes. + - name: name + type: keyword + description: The process name, as displayed in utilities like top and ps. This name can be accessed through /proc/[pid]/comm and changed with prctl(PR_SET_NAME). + - name: parent + type: group + fields: + - name: pid + type: long + description: The parent process ID. + - name: pid + type: long + description: The process ID. + - name: script + type: group + fields: + - name: contents + type: keyword + description: Prefix of the file contents as a JSON encoded string. + - name: hashed_size + type: long + description: The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. + - name: partially_hashed + type: boolean + description: True when the hash covers only a prefix of the file. + - name: path + type: keyword + description: Absolute path of the file as a JSON encoded string. + - name: sha256 + type: keyword + description: SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. + - name: size + type: long + description: Size of the file in bytes. + - name: resource + type: group + fields: + - name: display_name + type: keyword + description: The human readable name of the resource. + - name: folders + type: group + fields: + - name: display_name + type: keyword + description: The user defined display name for this folder. + - name: name + type: keyword + description: "Full resource name of this folder. See: https://cloud.google.com/apis/design/resource_names#full_resource_name" + - name: name + type: keyword + description: 'For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time.' + - name: parent + type: group + fields: + - name: display_name + type: keyword + description: The human readable name of resource's parent. + - name: name + type: keyword + description: The full resource name of resource's parent. + - name: project + type: group + fields: + - name: display_name + type: keyword + description: The project ID that the resource belongs to. + - name: name + type: keyword + description: The full resource name of project that the resource belongs to. + - name: type + type: keyword + description: The full resource type of the resource. + - name: resource_name + type: keyword + description: "For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time." + - name: security_marks + type: group + fields: + - name: canonical_name + type: keyword + description: 'The canonical name of the marks. Examples: "organizations/{organization_id}/assets/{asset_id}/securityMarks" "folders/{folder_id}/assets/{asset_id}/securityMarks" "projects/{project_number}/assets/{asset_id}/securityMarks" "organizations/{organization_id}/sources/{source_id}/findings/{findingId}/securityMarks" "folders/{folder_id}/sources/{source_id}/findings/{findingId}/securityMarks" "projects/{project_number}/sources/{source_id}/findings/{findingId}/securityMarks".' + - name: name + type: keyword + description: 'The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Examples: "organizations/{organization_id}/assets/{asset_id}/securityMarks" "organizations/{organization_id}/sources/{source_id}/findings/{findingId}/securityMarks".' + - name: value + type: flattened + description: "Mutable user specified security marks belonging to the parent resource. Constraints are as follows:Keys and values are treated as case insensitive. Keys must be between 1 - 256 characters (inclusive). Keys must be letters, numbers, underscores, or dashes. Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive)." + - name: severity + type: keyword + description: The severity of the finding. This field is managed by the source that writes the finding. + - name: source_id + type: keyword + - name: source_properties_supporting_data + type: keyword + ignore_above: 1024 + - name: source_properties + type: flattened + description: Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only. + - name: state + type: keyword + description: The state of the finding. + - name: vulnerability + type: group + fields: + - name: cve + type: group + fields: + - name: cvssv3 + type: group + fields: + - name: attack + type: group + fields: + - name: complexity + type: keyword + description: This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability. + - name: vector + type: keyword + description: Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible. + - name: availability_impact + type: keyword + description: This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. + - name: base_score + type: long + description: The base score is a function of the base metric scores. + - name: confidentiality_impact + type: keyword + description: This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. + - name: integrity_impact + type: keyword + description: This metric measures the impact to integrity of a successfully exploited vulnerability. + - name: privileges_required + type: keyword + description: This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. + - name: scope + type: keyword + description: The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope. + - name: user_interaction + type: keyword + description: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component. + - name: id + type: keyword + description: The unique identifier for the vulnerability, for example, CVE-2021-34527. + - name: references + type: group + fields: + - name: source + type: keyword + description: Source of the reference, for example, NVD. + - name: uri + type: keyword + description: URI for the source, for example, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527. + - name: upstream_fix_available + type: boolean + description: Whether upstream fix is available for the CVE. diff --git a/packages/google_scc/data_stream/finding/manifest.yml b/packages/google_scc/data_stream/finding/manifest.yml new file mode 100644 index 00000000000..dc9112a101e --- /dev/null +++ b/packages/google_scc/data_stream/finding/manifest.yml @@ -0,0 +1,166 @@ +title: Collect Finding logs from Google Security Command Center. +type: logs +streams: + - input: httpjson + enabled: false + title: Finding logs + description: Collect Finding logs from Google Security Command Center. + template_path: httpjson.yml.hbs + vars: + - name: url + type: text + title: Google SCC API Host + description: The Google SCC API Host. + multi: false + required: true + show_user: false + default: https://securitycenter.googleapis.com + - name: initial_interval + type: text + title: Initial Interval + description: "How far back to pull the activities from Google SCC. NOTE: Supported units for this parameter are h/m/s." + multi: false + required: true + show_user: true + default: 24h + - name: interval + type: text + title: Interval + description: "Duration between requests to the Google SCC API. NOTE: Supported units for this parameter are h/m/s." + default: 5m + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the Google SCC API. The maximum supported batch size value is 1000. + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-finding + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.finding fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - input: gcp-pubsub + enabled: false + title: Finding logs + description: Collect Finding logs from Google Security Command Center. + template_path: gcp-pubsub.yml.hbs + vars: + - name: topic + type: text + title: Topic + multi: false + required: true + show_user: true + description: Name of the topic where the logs are written to. + - name: subscription_name + type: text + title: Subscription Name + multi: false + required: true + show_user: true + description: Use the short subscription name here, not the full-blown path with the project ID. You can find it as 'Subscription ID' on the Google Cloud Console. + - name: subscription_create + type: bool + title: Subscription Create + description: If true, the integration will create the subscription on start. + multi: false + required: false + show_user: false + default: true + - name: subscription_num_goroutines + type: text + title: Subscription Num Goroutines + description: Number of goroutines created to read from the subscription. This does not limit the number of messages that can be processed concurrently or the maximum number of goroutines the input will create. + multi: false + required: false + show_user: false + default: 1 + - name: subscription_max_outstanding_messages + type: text + title: Subscription Max Outstanding Messages + description: The maximum number of unprocessed messages (unacknowledged but not yet expired). If the value is negative, then there will be no limit on the number of unprocessed messages. Default is 1000. + multi: false + required: false + show_user: false + default: 1000 + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-finding + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.finding fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: alternative_host + type: text + title: Alternative host + multi: false + required: false + show_user: false + description: "Overrides the default Pub/Sub service address and disables TLS. For testing." diff --git a/packages/google_scc/data_stream/finding/sample_event.json b/packages/google_scc/data_stream/finding/sample_event.json new file mode 100644 index 00000000000..bb12d46ffdc --- /dev/null +++ b/packages/google_scc/data_stream/finding/sample_event.json @@ -0,0 +1,80 @@ +{ + "@timestamp": "2023-06-02T05:17:41.936Z", + "agent": { + "ephemeral_id": "3595a791-e9ba-4a51-9eb2-18219952e440", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.finding", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "created": "2020-02-19T13:37:43.858Z", + "dataset": "google_scc.finding", + "id": "67d5908d21-1", + "ingested": "2023-07-03T06:30:14Z", + "kind": "event" + }, + "google_scc": { + "finding": { + "canonical_name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "category": "application", + "external_systems": { + "test": { + "assignees": [ + "primary" + ], + "externalSystemUpdateTime": "2022-01-05T05:00:35.674Z", + "externalUid": "test_scc_finding_2", + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test", + "status": "updated1" + } + }, + "mute": { + "initiator": "Unmuted by john@gmail.com", + "state": "UNMUTED", + "update_time": "2022-03-23T05:50:21.804Z" + }, + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "parent": "organizations/515665165161/sources/98481484454154454545", + "resource": { + "name": "//cloudresourcemanager.googleapis.com/projects/45455445554" + }, + "resource_name": "//cloudresourcemanager.googleapis.com/projects/45455445554", + "security_marks": { + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks" + }, + "severity": "CRITICAL", + "source_id": "98481484454154454545", + "state": "ACTIVE" + } + }, + "input": { + "type": "gcp-pubsub" + }, + "organization": { + "id": "515665165161" + }, + "tags": [ + "forwarded", + "google_scc-finding" + ], + "url": { + "domain": "www.adwait.com", + "original": "http://www.adwait.com", + "scheme": "http" + } +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/source/_dev/test/pipeline/test-common-config.yml b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log new file mode 100644 index 00000000000..d3c914b9ffd --- /dev/null +++ b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log @@ -0,0 +1,2 @@ +{"name":"organizations/595779152576/sources/10134421585261057824","displayName":"Cloudflare Security Events","description":"Extend your security view from the edge.","canonicalName":"organizations/595779152576/sources/10134421585261057824"} +{"sources":[]} \ No newline at end of file diff --git a/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log-expected.json b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log-expected.json new file mode 100644 index 00000000000..ddec893fbec --- /dev/null +++ b/packages/google_scc/data_stream/source/_dev/test/pipeline/test-source.log-expected.json @@ -0,0 +1,31 @@ +{ + "expected": [ + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "kind": "event", + "original": "{\"name\":\"organizations/595779152576/sources/10134421585261057824\",\"displayName\":\"Cloudflare Security Events\",\"description\":\"Extend your security view from the edge.\",\"canonicalName\":\"organizations/595779152576/sources/10134421585261057824\"}" + }, + "google_scc": { + "source": { + "canonical_name": "organizations/595779152576/sources/10134421585261057824", + "description": "Extend your security view from the edge.", + "display_name": "Cloudflare Security Events", + "id": "10134421585261057824", + "name": "organizations/595779152576/sources/10134421585261057824" + } + }, + "message": "Extend your security view from the edge.", + "organization": { + "id": "595779152576" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + null + ] +} \ No newline at end of file diff --git a/packages/google_scc/data_stream/source/_dev/test/system/test-default-config.yml b/packages/google_scc/data_stream/source/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..36766db0d82 --- /dev/null +++ b/packages/google_scc/data_stream/source/_dev/test/system/test-default-config.yml @@ -0,0 +1,26 @@ +input: httpjson +service: google_scc +vars: + credentials_type: credentials_json + credentials: | + { + "type": "service_account", + "project_id": "system-tests", + "private_key_id": "a2ef9c637b4176ec994606cb08724a1b79bc0666", + "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC9SzdiBfhGcQrN\nLKofn3198cwOJ3DclRM3On9qVEHKIY3aCcLZgst4HyBtkefZeSVgIRPWhStWY8CK\nPBXZHM9jAifSQiHjNU4o7v5EMIKuCrwKAgbXFnJSEwXe7CfzrytKZfkVndPf+ZrH\nnUSwAmbNrB5/VOqtBF0QrG48FCz/ipZph5AJ5h5kFVyDZvwJSaDfDWUHTvZfO3tw\nlSnwVTWztT0d+CDYOyWH34NJVfTKirA3xifDgVcxLKoC7850FsZqJ05HpiOUrHc5\nJRRiy4HurdcPKKBvpVrtbvftBMsiG0RvnqXgTSI7iMNPjUtpjLC9GlZ6B+8egUEd\ndtdPoDG1AgMBAAECggEAP2ks+ldJnj9MAQNPUhyZa1FOrAcmVZ5Su5OLD1F+YHnx\nDPNsJHUeN/UlZc8UvdNJY/RwstIVfHEaFLSgFQUDrAUS1ep1c6ltr2SwJKOjgy3x\nY+Dd7buFPF1HADBYCdfKRrf2QvmF+mehI/FZCyUizw8zgDAwFRl7G5THsLSJhmiQ\nwDc9WbPFLyswtmeKoAqMiHHqV63PtJunqvGbrDTHh9f4P5JVtreMoPWzE9czQ2ZI\n5nBHOFP/EA6twyRalqOsm3XoFmyrWMmJtm/JJsDlGr/LZcVbtghxybEYo8p/VLpo\nJmBSJgM17rwGhniDWXWXXOfx2fkNZEhVIeGvZYJRgQKBgQDOHnepihIu650pTfRD\nfcUyPN9oYLzI2mwv70H3FzJQftt3pqmWhlX2adaXYJ65/8xwr6SmkHmYjTvfuCoT\nSFApzv9fnYcD6vCsk5AhLpbarWR3MEU1SCvaiFuRNrdTcR8MGSglWPLLVXCI6f/g\nF9kZ/Ngz7MkvD2bNT/WjNj3LMQKBgQDrGmPo0gvfk+QoFtL05+dDDrB2IxUokdqa\nRzdecC8wV01l8lIj4TDqo7W1wwxdEUvCbUYriE2BoXi1v3jF+wfluqJOL30Ex5kb\nUO5At+DWakxzgy3v0F32AOZRISAGMdbrNFaLpjD9t9NGbL8kiestfs2QuTISHJwU\nfD47jFDlxQKBgHrczGVh6O7RAVByqCxm1tnYUS8torpzAFQeYQrBZ/t1cqrCzInu\nL2V/tytqq5KheKKfAB1NNz4IyezUITh3PVl+itja1HUwYR/todc1pzRYcO9e9ZIK\nICHWcAaCQArb/i6+/CAvAiLUHg1utlhEvuNvxQxGk7Gak6PEit4r4e+xAoGBAIOR\nrT/p7IMefJyCyWQNM7qvScmTMJAXr8KPAEl1drMS6FmZFqbFq15kZ5hko1KiD0er\nZ42NJfLZrnfnw2roZS8HFzWyFcDLAr/qtqq5PLZBnq82RkrizPKS5lGYvBc7ZQ8T\npytXwir66N2MlhuYo2g+gkPvoDnKkP5V2W3xxIQRAoGBAIDayGKqE1iZwF72R0xQ\nVg8y2x9JoxY1lDGA8oLzYKcp7OslI6sPhv/NGnkQBwV964dcffnn6dezFyKKBGir\nDSiM9duWTttlzzUhUQMHCua2z/LXjz1XMb0LoSEOVdk00TDgRMSFhBLhr3ZXmoLb\nIqi7is4z2mP8pbcIIlmloogE\n-----END PRIVATE KEY-----", + "client_email": "foo@bar.com", + "client_id": "007155790781103885639", + "auth_uri": "http://google_scc:8090/o/oauth2/auth", + "token_uri": "http://google_scc:8090/token", + "auth_provider_x509_cert_url": "http://google_scc:8090/oauth2/v1/certs", + "client_x509_cert_url": "http://google_scc:8090/robot/v1/metadata/x509/foo%40bar.com" + } + parent_type: organizations + id: xxxx +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/google_scc/data_stream/source/agent/stream/httpjson.yml.hbs b/packages/google_scc/data_stream/source/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..7fc27f84c38 --- /dev/null +++ b/packages/google_scc/data_stream/source/agent/stream/httpjson.yml.hbs @@ -0,0 +1,49 @@ +config_version: '2' +interval: {{interval}} +request.method: GET +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +auth.oauth2.provider: google +auth.oauth2.google.{{credentials_type}}: {{credentials}} +auth.oauth2.scopes: + - https://www.googleapis.com/auth/cloud-platform + +{{#if proxy_url}} +request.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +request.timeout: {{http_client_timeout}} +{{/if}} +request.url: {{url}}/v1/{{parent_type}}/{{id}}/sources +request.transforms: + - set: + target: url.params.pageSize + value: {{batch_size}} +response.pagination: + - set: + target: url.params.pageToken + value: '[[if index .last_response.body "nextPageToken"]][[.last_response.body.nextPageToken]][[end]]' + fail_on_template_error: true +response.split: + target: body.sources +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/google_scc/data_stream/source/elasticsearch/ingest_pipeline/default.yml b/packages/google_scc/data_stream/source/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..7a2341add72 --- /dev/null +++ b/packages/google_scc/data_stream/source/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,108 @@ +--- +description: Pipeline for processing Source logs. +processors: + - set: + field: ecs.version + value: 8.9.0 + tag: set_ecs_version + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - set: + field: event.kind + tag: set_event_kind + value: event + - json: + field: event.original + tag: 'json_decoding' + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - drop: + if: ctx.json?.sources != null && ctx.json.sources.isEmpty() + tag: drop_sources + - rename: + field: json.description + target_field: google_scc.source.description + tag: rename_description + ignore_missing: true + - set: + field: message + tag: set_message + copy_from: google_scc.source.description + ignore_empty_value: true + - rename: + field: json.canonicalName + target_field: google_scc.source.canonical_name + tag: rename_canonicalName + ignore_missing: true + - rename: + field: json.displayName + target_field: google_scc.source.display_name + tag: rename_displayName + ignore_missing: true + - rename: + field: json.name + target_field: google_scc.source.name + tag: rename_name + ignore_missing: true + - grok: + description: Extract Source ID and Organization ID. + field: google_scc.source.name + tag: grok_to_extract_source_id_and_organization_id + if: ctx.google_scc?.source?.name != null + patterns: + - '^organizations/%{DATA:organization.id}/sources/%{DATA:google_scc.source.id}$' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - remove: + field: json + tag: remove_json + ignore_missing: true + - remove: + field: + - google_scc.source.description + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: event.original + tag: remove_event_original + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/google_scc/data_stream/source/fields/base-fields.yml b/packages/google_scc/data_stream/source/fields/base-fields.yml new file mode 100644 index 00000000000..24fb311d88f --- /dev/null +++ b/packages/google_scc/data_stream/source/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: google_scc +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: google_scc.source +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/google_scc/data_stream/source/fields/beats.yml b/packages/google_scc/data_stream/source/fields/beats.yml new file mode 100644 index 00000000000..2d5ae254634 --- /dev/null +++ b/packages/google_scc/data_stream/source/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/google_scc/data_stream/source/fields/fields.yml b/packages/google_scc/data_stream/source/fields/fields.yml new file mode 100644 index 00000000000..18268040d17 --- /dev/null +++ b/packages/google_scc/data_stream/source/fields/fields.yml @@ -0,0 +1,20 @@ +- name: google_scc + type: group + fields: + - name: source + type: group + fields: + - name: canonical_name + type: keyword + description: The canonical name of the finding. It's either "organizations/{organization_id}/sources/{source_id}", "folders/{folder_id}/sources/{source_id}" or "projects/{project_number}/sources/{source_id}", depending on the closest CRM ancestor of the resource associated with the finding. + - name: description + type: keyword + description: 'The description of the source (max of 1024 characters). Example: "Web Security Scanner is a web security scanner for common vulnerabilities in App Engine applications. It can automatically scan and detect four common vulnerabilities, including cross-site-scripting (XSS), Flash injection, mixed content (HTTP in HTTPS), and outdated or insecure libraries."' + - name: display_name + type: keyword + description: The source's display name. A source's display name must be unique amongst its siblings, for example, two sources with the same parent can't share the same display name. The display name must have a length between 1 and 64 characters (inclusive). + - name: id + type: keyword + - name: name + type: keyword + description: 'The relative resource name of this source. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/{organization_id}/sources/{source_id}".' diff --git a/packages/google_scc/data_stream/source/manifest.yml b/packages/google_scc/data_stream/source/manifest.yml new file mode 100644 index 00000000000..e7965250b7a --- /dev/null +++ b/packages/google_scc/data_stream/source/manifest.yml @@ -0,0 +1,74 @@ +title: Collect Source logs from Google Security Command Center. +type: logs +streams: + - input: httpjson + enabled: false + title: Source logs + description: Collect Source logs from Google Security Command Center. + template_path: httpjson.yml.hbs + vars: + - name: url + type: text + title: Google SCC API Host + description: The Google SCC API Host. + multi: false + required: true + show_user: false + default: https://securitycenter.googleapis.com + - name: interval + type: text + title: Interval + description: "Duration between requests to the Google SCC API. NOTE: Supported units for this parameter are h/m/s." + default: 1h + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: Batch size for the response of the Google SCC API. The maximum supported batch size value is 1000. + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: true + show_user: false + default: 30s + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - google_scc-source + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve google_scc.source fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/google_scc/data_stream/source/sample_event.json b/packages/google_scc/data_stream/source/sample_event.json new file mode 100644 index 00000000000..8ba9621f9bf --- /dev/null +++ b/packages/google_scc/data_stream/source/sample_event.json @@ -0,0 +1,53 @@ +{ + "@timestamp": "2023-07-03T06:32:03.193Z", + "agent": { + "ephemeral_id": "498f9d2e-09a7-4616-8ee1-8c60809852c3", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.source", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-07-03T06:32:03.193Z", + "dataset": "google_scc.source", + "ingested": "2023-07-03T06:32:06Z", + "kind": "event", + "original": "{\"canonicalName\":\"organizations/595779152576/sources/10134421585261057824\",\"description\":\"Extend your security view from the edge.\",\"displayName\":\"Cloudflare Security Events\",\"name\":\"organizations/595779152576/sources/10134421585261057824\"}" + }, + "google_scc": { + "source": { + "canonical_name": "organizations/595779152576/sources/10134421585261057824", + "description": "Extend your security view from the edge.", + "display_name": "Cloudflare Security Events", + "id": "10134421585261057824", + "name": "organizations/595779152576/sources/10134421585261057824" + } + }, + "input": { + "type": "httpjson" + }, + "message": "Extend your security view from the edge.", + "organization": { + "id": "595779152576" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "google_scc-source" + ] +} \ No newline at end of file diff --git a/packages/google_scc/docs/README.md b/packages/google_scc/docs/README.md new file mode 100644 index 00000000000..bfd6cd0f519 --- /dev/null +++ b/packages/google_scc/docs/README.md @@ -0,0 +1,1084 @@ +# Google Security Command Center + +## Overview + +The [Google Security Command Center](https://cloud.google.com/security-command-center) integration allows users to monitor finding, audit, asset, and source. Security Command Center Premium provides comprehensive threat detection for Google Cloud that includes Event Threat Detection, Container Threat Detection, and Virtual Machine Threat Detection as built-in services. + +Use the Google SCC integration to collect and parse data from the Google SCC REST API (finding, asset, and source) or GCP Pub/Sub (finding, asset, and audit). Then visualize that data through search, correlation, and visualization within Elastic Security. + +## Data streams + +The Google SCC integration collects four types of data: finding, audit, asset, and source. + +**Finding** is a record of assessment data like security, risk, health, or privacy, that is ingested into Security Command Center for presentation, notification, analysis, policy testing, and enforcement. For example, a cross-site scripting (XSS) vulnerability in an App Engine application is a finding. + +**Audit** logs created by Security Command Center as part of Cloud Audit Logs. + +**Asset** lists assets with time and resource types and returns paged results in response. + +**Source** is an entity or a mechanism that can produce a finding. A source is like a container of findings that come from the same scanner, logger, monitor, and other tools. + +## Compatibility + +This module has been tested against the latest Google SCC API version **v1**. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the GCP Pub/Sub or REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.8.0**. + +## Prerequisites + + - Create Google SCC service account [Steps to create](https://developers.google.com/identity/protocols/oauth2/service-account#creatinganaccount). + - Permissions required for Service Account: + - Cloud Asset Viewer at Organization Level + - Pub/Sub Subscriber at Project Level + - Security Center Admin Editor at Organization Level + - **Security Command Center API** and **Cloud Asset API** must be enabled. + +This integration will make use of the following *oauth2 scope*: + +- `https://www.googleapis.com/auth/cloud-platform` + +Once Service Account credentials are downloaded as a JSON file, then the integration can be setup to collect data. + +If installing in GCP-Cloud Environment, No need to provide any credentials and make sure the account linked with the VM has all the required IAM permissions. Steps to [Set up Application Default Credentials](https://cloud.google.com/docs/authentication/provide-credentials-adc). + +## Setup + +### To create GCP Pub/Sub, follow the below steps: + +- [Create Topic for Pub/sub](https://cloud.google.com/pubsub/docs/create-topic#create_a_topic). +- [Create Subscription for topic](https://cloud.google.com/pubsub/docs/create-subscription#create_subscriptions) + +### To collect data from GCP Pub/Sub, follow the below steps: + +- [Configure to export finding to GCP Pub/Sub](https://cloud.google.com/security-command-center/docs/how-to-notifications). +- [Configure to export asset to GCP Pub/Sub](https://cloud.google.com/asset-inventory/docs/monitoring-asset-changes). +- [Configure to export audit to GCP Pub/Sub](https://cloud.google.com/logging/docs/export/configure_export_v2?_ga=2.110932226.-66737431.1679995682#overview). + +**NOTE**: + - **Sink destination** must be **Pub/Sub topic** while exporting audit logs to GCP Pub/Sub. + - Create unique Pub/Sub topic per data-stream. + +### Enabling the integration in Elastic: +1. In Kibana go to **Management > Integrations**. +2. In "Search for integrations" search bar, type **Google Security Command Center**. +3. Click on the **Google Security Command Center** integration from the search results. +4. Click on the **Add Google Security Command Center** Integration button to add the integration. +5. While adding the integration, if you want to **collect logs via Rest API**, turn on the toggle and then put the following details: + - credentials type + - credentials JSON/file + - parent type + - id + - To collect **asset logs**, put the following details: + - content type + + or if you want to **collect logs via GCP Pub/Sub**, turn on the toggle and then put the following details: + - credentials type + - credentials JSON/file + - project id + - To collect **asset, audit, or finding logs**, put the following details: + - topic + - subscription name + +## Logs reference + +### Asset + +This is the `Asset` dataset. + +#### Example + +An example event for `asset` looks as following: + +```json +{ + "@timestamp": "2023-07-03T06:24:10.638Z", + "agent": { + "ephemeral_id": "7ab58b6a-e33a-470d-b529-80d7f867ce64", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.asset", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "created": "2023-07-03T06:24:26.934Z", + "dataset": "google_scc.asset", + "id": "f14c38ac40-2", + "ingested": "2023-07-03T06:24:30Z", + "kind": "event", + "type": [ + "info" + ] + }, + "google_scc": { + "asset": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "prior": { + "ancestors": [ + "projects/123456987522", + "folders/123456987520", + "organizations/523456987520" + ], + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "resource": { + "data": { + "analyticsEnabled": true, + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "type": "logging.googleapis.com/LogBucket", + "update_time": "2023-05-27T18:53:48.843Z" + }, + "prior_asset_state": "PRESENT", + "resource": { + "data": { + "description": "Default bucket", + "lifecycleState": "ACTIVE", + "name": "projects/123456987522/locations/global/buckets/_Default", + "retentionDays": 30 + }, + "discovery": { + "document_uri": "https://logging.googleapis.com/$discovery/rest", + "name": "LogBucket" + }, + "location": "global", + "parent": "//cloudresourcemanager.googleapis.com/projects/123456987522", + "version": "v2" + }, + "update_time": "2023-05-28T06:59:48.052Z", + "window": { + "start_time": "2023-05-28T06:59:48.052Z" + } + } + }, + "host": { + "name": "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default", + "type": "logging.googleapis.com/LogBucket" + }, + "input": { + "type": "gcp-pubsub" + }, + "related": { + "hosts": [ + "//logging.googleapis.com/projects/123456987522/locations/global/buckets/_Default" + ] + }, + "tags": [ + "forwarded", + "google_scc-asset" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| google_scc.asset.access_level.basic.combining_function | How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied. Default behavior is AND. | keyword | +| google_scc.asset.access_level.basic.conditions.device_policy.allowed_device_management_levels | Allowed device management levels, an empty list allows all management levels. | keyword | +| google_scc.asset.access_level.basic.conditions.device_policy.allowed_encryption_statuses | Allowed encryptions statuses, an empty list allows all statuses. | keyword | +| google_scc.asset.access_level.basic.conditions.device_policy.os_constraints.minimum_version | The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch". Examples: "10.5.301", "9.2.1". | keyword | +| google_scc.asset.access_level.basic.conditions.device_policy.os_constraints.os_type | Required. The allowed OS type. | keyword | +| google_scc.asset.access_level.basic.conditions.device_policy.os_constraints.require_verified_chrome_os | Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request. | boolean | +| google_scc.asset.access_level.basic.conditions.device_policy.require_admin_approval | Whether the device needs to be approved by the customer admin. | boolean | +| google_scc.asset.access_level.basic.conditions.device_policy.require_corp_owned | Whether the device needs to be corp owned. | boolean | +| google_scc.asset.access_level.basic.conditions.device_policy.require_screenlock | Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false. | boolean | +| google_scc.asset.access_level.basic.conditions.members | The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: user:\{emailid\} serviceAccount:\{emailid\} If not specified, a request may come from any user. | keyword | +| google_scc.asset.access_level.basic.conditions.negate | Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false. | boolean | +| google_scc.asset.access_level.basic.conditions.regions | The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes. | keyword | +| google_scc.asset.access_level.basic.conditions.required_access_levels | A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME". | keyword | +| google_scc.asset.access_level.custom.expression.description | Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. | keyword | +| google_scc.asset.access_level.custom.expression.location | Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. | keyword | +| google_scc.asset.access_level.custom.expression.text | Textual representation of an expression in Common Expression Language syntax. | keyword | +| google_scc.asset.access_level.custom.expression.title | Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. | keyword | +| google_scc.asset.access_level.description | Description of the AccessLevel and its use. Does not affect behavior. | keyword | +| google_scc.asset.access_level.name | Required. Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and '_'. Format: accessPolicies/\{accessPolicy\}/accessLevels/\{accessLevel\}. The maximum length of the accessLevel component is 50 characters. | keyword | +| google_scc.asset.access_level.title | Human readable title. Must be unique within the Policy. | keyword | +| google_scc.asset.access_policy.etag | Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. | keyword | +| google_scc.asset.access_policy.name | Output only. Resource name of the AccessPolicy. Format: accessPolicies/\{accessPolicy\}. | keyword | +| google_scc.asset.access_policy.parent | Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/\{organization_id\}. | keyword | +| google_scc.asset.access_policy.scopes | The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/\{folder_number\} or projects/\{project_number\}. | keyword | +| google_scc.asset.access_policy.title | Required. Human readable title. Does not affect behavior. | keyword | +| google_scc.asset.ancestors | The ancestry path of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. If the asset is a project, folder, or organization, the ancestry path starts from the asset itself. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.iam_policy.audit_configs.audit_log_configs.exemted_members | Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members. | keyword | +| google_scc.asset.iam_policy.audit_configs.audit_log_configs.log_type | The log type that this config enables. | keyword | +| google_scc.asset.iam_policy.audit_configs.service | Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services. | keyword | +| google_scc.asset.iam_policy.bindings.condition | The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. | flattened | +| google_scc.asset.iam_policy.bindings.members | Specifies the principals requesting access for a Google Cloud resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:\{emailid\}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:\{emailid\}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com. serviceAccount:\{projectid\}.svc.id.goog[\{namespace\}/\{kubernetes-sa\}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa]. group:\{emailid\}: An email address that represents a Google group. For example, admins@example.com. deleted:user:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:\{emailid\} and the recovered user retains the role in the binding. deleted:serviceAccount:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:\{emailid\} and the undeleted service account retains the role in the binding. deleted:group:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:\{emailid\} and the recovered group retains the role in the binding. domain:\{domain\}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com. | keyword | +| google_scc.asset.iam_policy.bindings.role | Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner. | keyword | +| google_scc.asset.iam_policy.etag | etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. A base64-encoded string. | keyword | +| google_scc.asset.iam_policy.version | Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: Getting a policy that includes a conditional role binding.Adding a conditional role binding to a policy.Changing a conditional role binding in a policy.Removing any role binding, with or without a condition, from a policy that includes conditions.Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation. | keyword | +| google_scc.asset.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.organization_policy.boolean_policy.enforced | If true, then the Policy is enforced. If false, then any configuration is acceptable. | boolean | +| google_scc.asset.organization_policy.constraint | The name of the Constraint the Policy is configuring, for example, constraints/serviceuser.services. A list of available constraints is available. Immutable after creation. | keyword | +| google_scc.asset.organization_policy.etag | An opaque tag indicating the current version of the Policy, used for concurrency control. When the Policy is returned from either a policies.get or a ListOrgPolicy request, this etag indicates the version of the current Policy to use when executing a read-modify-write loop. When the Policy is returned from a policies.getEffectivePolicy request, the etag will be unset. When the Policy is used in a SetOrgPolicy method, use the etag value that was returned from a GetOrgPolicy request as part of a read-modify-write loop for concurrency control. Not setting the etagin a SetOrgPolicy request will result in an unconditional write of the Policy. A base64-encoded string. | keyword | +| google_scc.asset.organization_policy.list_policy.all_values | The policy allValues state. | keyword | +| google_scc.asset.organization_policy.list_policy.allowed_values | List of values allowed at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. | keyword | +| google_scc.asset.organization_policy.list_policy.denied_values | List of values denied at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. | keyword | +| google_scc.asset.organization_policy.list_policy.inherit_from_parent | Determines the inheritance behavior for this Policy. | boolean | +| google_scc.asset.organization_policy.list_policy.suggested_value | Optional. The Google Cloud Console will try to default to a configuration that matches the value specified in this Policy. If suggestedValue is not set, it will inherit the value specified higher in the hierarchy, unless inheritFromParent is false. | keyword | +| google_scc.asset.organization_policy.restore_default.etag | Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. | keyword | +| google_scc.asset.organization_policy.restore_default.name | Output only. Resource name of the AccessPolicy. Format: accessPolicies/\{accessPolicy\}. | keyword | +| google_scc.asset.organization_policy.restore_default.parent | Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/\{organization_id\}. | keyword | +| google_scc.asset.organization_policy.restore_default.scopes | The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/\{folder_number\} or projects/\{project_number\}. | keyword | +| google_scc.asset.organization_policy.restore_default.title | Required. Human readable title. Does not affect behavior. | keyword | +| google_scc.asset.organization_policy.update_time | The time stamp the Policy was previously updated. This is set by the server, not specified by the caller, and represents the last time a call to SetOrgPolicy was made for that Policy. Any value set by the client will be ignored. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.organization_policy.version | Version of the Policy. Default version is 0. | keyword | +| google_scc.asset.os_inventory.items | | flattened | +| google_scc.asset.os_inventory.name | Output only. The Inventory API resource name. Format: projects/\{project_number\}/locations/\{location\}/instances/\{instance_id\}/inventory. | keyword | +| google_scc.asset.os_inventory.os_info.architecture | The system architecture of the operating system. | keyword | +| google_scc.asset.os_inventory.os_info.hostname | The VM hostname. | keyword | +| google_scc.asset.os_inventory.os_info.kernel.release | The kernel release of the operating system. | keyword | +| google_scc.asset.os_inventory.os_info.kernel.version | The kernel version of the operating system. | keyword | +| google_scc.asset.os_inventory.os_info.long_name | The operating system long name. For example 'Debian GNU/Linux 9' or 'Microsoft Window Server 2019 Datacenter'. | keyword | +| google_scc.asset.os_inventory.os_info.os_config_agent_version | The current version of the OS Config agent running on the VM. | keyword | +| google_scc.asset.os_inventory.os_info.short_name | The operating system short name. For example, 'windows' or 'debian'. | keyword | +| google_scc.asset.os_inventory.os_info.version | The version of the operating system. | keyword | +| google_scc.asset.os_inventory.update_time | Output only. Timestamp of the last reported inventory for the VM. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.prior.access_level.basic.combining_function | How the conditions list should be combined to determine if a request is granted this AccessLevel. If AND is used, each Condition in conditions must be satisfied for the AccessLevel to be applied. If OR is used, at least one Condition in conditions must be satisfied for the AccessLevel to be applied. Default behavior is AND. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.allowed_device_management_levels | Allowed device management levels, an empty list allows all management levels. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.allowed_encryption_statuses | Allowed encryptions statuses, an empty list allows all statuses. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.os_constraints.minimum_version | The minimum allowed OS version. If not set, any version of this OS satisfies the constraint. Format: "major.minor.patch". Examples: "10.5.301", "9.2.1". | keyword | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.os_constraints.os_type | Required. The allowed OS type. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.os_constraints.require_verified_chrome_os | Only allows requests from devices with a verified Chrome OS. Verifications includes requirements that the device is enterprise-managed, conformant to domain policies, and the caller has permission to call the API targeted by the request. | boolean | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.require_admin_approval | Whether the device needs to be approved by the customer admin. | boolean | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.require_corp_owned | Whether the device needs to be corp owned. | boolean | +| google_scc.asset.prior.access_level.basic.conditions.device_policy.require_screenlock | Whether or not screenlock is required for the DevicePolicy to be true. Defaults to false. | boolean | +| google_scc.asset.prior.access_level.basic.conditions.members | The request must be made by one of the provided user or service accounts. Groups are not supported. Syntax: user:\{emailid\} serviceAccount:\{emailid\} If not specified, a request may come from any user. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.negate | Whether to negate the Condition. If true, the Condition becomes a NAND over its non-empty fields, each field must be false for the Condition overall to be satisfied. Defaults to false. | boolean | +| google_scc.asset.prior.access_level.basic.conditions.regions | The request must originate from one of the provided countries/regions. Must be valid ISO 3166-1 alpha-2 codes. | keyword | +| google_scc.asset.prior.access_level.basic.conditions.required_access_levels | A list of other access levels defined in the same Policy, referenced by resource name. Referencing an AccessLevel which does not exist is an error. All access levels listed must be granted for the Condition to be true. Example: "accessPolicies/MY_POLICY/accessLevels/LEVEL_NAME". | keyword | +| google_scc.asset.prior.access_level.basic.conditions.sub_networks | CIDR block IP subnetwork specification. May be IPv4 or IPv6. Note that for a CIDR IP address block, the specified IP address portion must be properly truncated (i.e. all the host bits must be zero) or the input is considered malformed. For example, "192.0.2.0/24" is accepted but "192.0.2.1/24" is not. Similarly, for IPv6, "2001:db8::/32" is accepted whereas "2001:db8::1/32" is not. The originating IP of a request must be in one of the listed subnets in order for this Condition to be true. If empty, all IP addresses are allowed. | keyword | +| google_scc.asset.prior.access_level.custom.expression.description | Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI. | keyword | +| google_scc.asset.prior.access_level.custom.expression.location | Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file. | keyword | +| google_scc.asset.prior.access_level.custom.expression.text | Textual representation of an expression in Common Expression Language syntax. | keyword | +| google_scc.asset.prior.access_level.custom.expression.title | Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression. | keyword | +| google_scc.asset.prior.access_level.description | Description of the AccessLevel and its use. Does not affect behavior. | keyword | +| google_scc.asset.prior.access_level.name | Required. Resource name for the Access Level. The shortName component must begin with a letter and only include alphanumeric and '_'. Format: accessPolicies/\{accessPolicy\}/accessLevels/\{accessLevel\}. The maximum length of the accessLevel component is 50 characters. | keyword | +| google_scc.asset.prior.access_level.title | Human readable title. Must be unique within the Policy. | keyword | +| google_scc.asset.prior.access_policy.etag | Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. | keyword | +| google_scc.asset.prior.access_policy.name | Output only. Resource name of the AccessPolicy. Format: accessPolicies/\{accessPolicy\}. | keyword | +| google_scc.asset.prior.access_policy.parent | Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/\{organization_id\} | keyword | +| google_scc.asset.prior.access_policy.scopes | The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/\{folder_number\} or projects/\{project_number\}. | keyword | +| google_scc.asset.prior.access_policy.title | Required. Human readable title. Does not affect behavior. | keyword | +| google_scc.asset.prior.ancestors | The ancestry path of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. If the asset is a project, folder, or organization, the ancestry path starts from the asset itself. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.prior.iam_policy.audit_configs.audit_log_configs.exemted_members | Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members. | keyword | +| google_scc.asset.prior.iam_policy.audit_configs.audit_log_configs.log_type | The log type that this config enables. | keyword | +| google_scc.asset.prior.iam_policy.audit_configs.service | Specifies a service that will be enabled for audit logging. For example, storage.googleapis.com, cloudsql.googleapis.com. allServices is a special value that covers all services. | keyword | +| google_scc.asset.prior.iam_policy.bindings.condition | The condition that is associated with this binding. If the condition evaluates to true, then this binding applies to the current request. If the condition evaluates to false, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the IAM documentation. | flattened | +| google_scc.asset.prior.iam_policy.bindings.members | Specifies the principals requesting access for a Google Cloud resource. members can have the following values: allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account. allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account. user:\{emailid\}: An email address that represents a specific Google account. For example, alice@example.com . serviceAccount:\{emailid\}: An email address that represents a Google service account. For example, my-other-app@appspot.gserviceaccount.com. serviceAccount:\{projectid\}.svc.id.goog[\{namespace\}/\{kubernetes-sa\}]: An identifier for a Kubernetes service account. For example, my-project.svc.id.goog[my-namespace/my-kubernetes-sa]. group:\{emailid\}: An email address that represents a Google group. For example, admins@example.com. deleted:user:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a user that has been recently deleted. For example, alice@example.com?uid=123456789012345678901. If the user is recovered, this value reverts to user:\{emailid\} and the recovered user retains the role in the binding. deleted:serviceAccount:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901. If the service account is undeleted, this value reverts to serviceAccount:\{emailid\} and the undeleted service account retains the role in the binding. deleted:group:\{emailid\}?uid=\{uniqueid\}: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, admins@example.com?uid=123456789012345678901. If the group is recovered, this value reverts to group:\{emailid\} and the recovered group retains the role in the binding. domain:\{domain\}: The G Suite domain (primary) that represents all the users of that domain. For example, google.com or example.com. | keyword | +| google_scc.asset.prior.iam_policy.bindings.role | Role that is assigned to the list of members, or principals. For example, roles/viewer, roles/editor, or roles/owner. | keyword | +| google_scc.asset.prior.iam_policy.etag | etag is used for optimistic concurrency control as a way to help prevent simultaneous updates of a policy from overwriting each other. It is strongly suggested that systems make use of the etag in the read-modify-write cycle to perform policy updates in order to avoid race conditions: An etag is returned in the response to getIamPolicy, and systems are expected to put that etag in the request to setIamPolicy to ensure that their change will be applied to the same version of the policy. Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. A base64-encoded string. | keyword | +| google_scc.asset.prior.iam_policy.version | Specifies the format of the policy. Valid values are 0, 1, and 3. Requests that specify an invalid value are rejected. Any operation that affects conditional role bindings must specify version 3. This requirement applies to the following operations: Getting a policy that includes a conditional role binding.Adding a conditional role binding to a policy.Changing a conditional role binding in a policy.Removing any role binding, with or without a condition, from a policy that includes conditions.Important: If you use IAM Conditions, you must include the etag field whenever you call setIamPolicy. If you omit this field, then IAM allows you to overwrite a version 3 policy with a version 1 policy, and all of the conditions in the version 3 policy are lost. If a policy does not include any conditions, operations on that policy may specify any valid version or leave the field unset. To learn which resources support conditions in their IAM policies, see the IAM documentation. | keyword | +| google_scc.asset.prior.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.prior.organization_policy.boolean_policy.enforced | If true, then the Policy is enforced. If false, then any configuration is acceptable. | boolean | +| google_scc.asset.prior.organization_policy.constraint | The name of the Constraint the Policy is configuring, for example, constraints/serviceuser.services. A list of available constraints is available. Immutable after creation. | keyword | +| google_scc.asset.prior.organization_policy.etag | An opaque tag indicating the current version of the Policy, used for concurrency control. When the Policy is returned from either a policies.get or a ListOrgPolicy request, this etag indicates the version of the current Policy to use when executing a read-modify-write loop. When the Policy is returned from a policies.getEffectivePolicy request, the etag will be unset. When the Policy is used in a SetOrgPolicy method, use the etag value that was returned from a GetOrgPolicy request as part of a read-modify-write loop for concurrency control. Not setting the etagin a SetOrgPolicy request will result in an unconditional write of the Policy. A base64-encoded string. | keyword | +| google_scc.asset.prior.organization_policy.list_policy.all_values | The policy allValues state. | keyword | +| google_scc.asset.prior.organization_policy.list_policy.allowed_values | List of values allowed at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. | keyword | +| google_scc.asset.prior.organization_policy.list_policy.denied_values | List of values denied at this resource. Can only be set if allValues is set to ALL_VALUES_UNSPECIFIED. | keyword | +| google_scc.asset.prior.organization_policy.list_policy.inherit_from_parent | Determines the inheritance behavior for this Policy. | boolean | +| google_scc.asset.prior.organization_policy.list_policy.suggested_value | Optional. The Google Cloud Console will try to default to a configuration that matches the value specified in this Policy. If suggestedValue is not set, it will inherit the value specified higher in the hierarchy, unless inheritFromParent is false. | keyword | +| google_scc.asset.prior.organization_policy.restore_default.etag | Output only. An opaque identifier for the current version of the AccessPolicy. This will always be a strongly validated etag, meaning that two Access Polices will be identical if and only if their etags are identical. Clients should not expect this to be in any specific format. | keyword | +| google_scc.asset.prior.organization_policy.restore_default.name | Output only. Resource name of the AccessPolicy. Format: accessPolicies/\{accessPolicy\}. | keyword | +| google_scc.asset.prior.organization_policy.restore_default.parent | Required. The parent of this AccessPolicy in the Cloud Resource Hierarchy. Currently immutable once created. Format: organizations/\{organization_id\}. | keyword | +| google_scc.asset.prior.organization_policy.restore_default.scopes | The scopes of a policy define which resources an ACM policy can restrict, and where ACM resources can be referenced. For example, a policy with scopes=["folders/123"] has the following behavior: - vpcsc perimeters can only restrict projects within folders/123 - access levels can only be referenced by resources within folders/123. If empty, there are no limitations on which resources can be restricted by an ACM policy, and there are no limitations on where ACM resources can be referenced. Only one policy can include a given scope (attempting to create a second policy which includes "folders/123" will result in an error). Currently, scopes cannot be modified after a policy is created. Currently, policies can only have a single scope. Format: list of folders/\{folder_number\} or projects/\{project_number\} | keyword | +| google_scc.asset.prior.organization_policy.restore_default.title | Required. Human readable title. Does not affect behavior. | keyword | +| google_scc.asset.prior.organization_policy.update_time | The time stamp the Policy was previously updated. This is set by the server, not specified by the caller, and represents the last time a call to SetOrgPolicy was made for that Policy. Any value set by the client will be ignored. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.prior.organization_policy.version | Version of the Policy. Default version is 0. | keyword | +| google_scc.asset.prior.os_inventory.items | | flattened | +| google_scc.asset.prior.os_inventory.name | Output only. The Inventory API resource name. Format: projects/\{project_number\}/locations/\{location\}/instances/\{instance_id\}/inventory. | keyword | +| google_scc.asset.prior.os_inventory.os_info.architecture | The system architecture of the operating system. | keyword | +| google_scc.asset.prior.os_inventory.os_info.hostname | The VM hostname. | keyword | +| google_scc.asset.prior.os_inventory.os_info.kernel.release | The kernel release of the operating system. | keyword | +| google_scc.asset.prior.os_inventory.os_info.kernel.version | The kernel version of the operating system. | keyword | +| google_scc.asset.prior.os_inventory.os_info.long_name | The operating system long name. For example 'Debian GNU/Linux 9' or 'Microsoft Window Server 2019 Datacenter'. | keyword | +| google_scc.asset.prior.os_inventory.os_info.os_config_agent_version | The current version of the OS Config agent running on the VM. | keyword | +| google_scc.asset.prior.os_inventory.os_info.short_name | The operating system short name. For example, 'windows' or 'debian'. | keyword | +| google_scc.asset.prior.os_inventory.os_info.version | The version of the operating system. | keyword | +| google_scc.asset.prior.os_inventory.update_time | Output only. Timestamp of the last reported inventory for the VM. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.prior.related_asset.ancestors | The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.prior.related_asset.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.prior.related_asset.relationship_type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP | keyword | +| google_scc.asset.prior.related_asset.type | The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information. | keyword | +| google_scc.asset.prior.related_assets.assets.ancestors | The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.prior.related_assets.assets.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.prior.related_assets.assets.relationship_type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP | keyword | +| google_scc.asset.prior.related_assets.assets.type | The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information. | keyword | +| google_scc.asset.prior.related_assets.relationship_attributes.action | The detail of the relationship, e.g. contains, attaches. | keyword | +| google_scc.asset.prior.related_assets.relationship_attributes.source_resource_type | The source asset type. Example: compute.googleapis.com/Instance. | keyword | +| google_scc.asset.prior.related_assets.relationship_attributes.target_resource_type | The target asset type. Example: compute.googleapis.com/Disk. | keyword | +| google_scc.asset.prior.related_assets.relationship_attributes.type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP. | keyword | +| google_scc.asset.prior.resource.data | The content of the resource, in which some sensitive fields are removed and may not be present. | flattened | +| google_scc.asset.prior.resource.discovery.document_uri | The URL of the discovery document containing the resource's JSON schema. Example: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. | keyword | +| google_scc.asset.prior.resource.discovery.name | The JSON schema name listed in the discovery document. Example: Project This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. | keyword | +| google_scc.asset.prior.resource.location | The location of the resource in Google Cloud, such as its zone and region. For more information, see https://cloud.google.com/about/locations/. | keyword | +| google_scc.asset.prior.resource.parent | The full name of the immediate parent of this resource. See Resource Names for more information. For Google Cloud assets, this value is the parent resource defined in the Cloud IAM policy hierarchy. Example: //cloudresourcemanager.googleapis.com/projects/my_project_123 For third-party assets, this field may be set differently. | keyword | +| google_scc.asset.prior.resource.url | The REST URL for accessing the resource. An HTTP GET request using this URL returns the resource itself. Example:https://cloudresourcemanager.googleapis.com/v1/projects/my-project-1233 This value is unspecified for resources without a REST API. | keyword | +| google_scc.asset.prior.resource.version | The API version. Example: v1. | keyword | +| google_scc.asset.prior.service_perimeter.description | Description of the ServicePerimeter and its use. Does not affect behavior. | keyword | +| google_scc.asset.prior.service_perimeter.name | Required. Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and '_'. Format: accessPolicies/\{accessPolicy\}/servicePerimeters/\{servicePerimeter\}. | keyword | +| google_scc.asset.prior.service_perimeter.spec.access_levels | A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_from.identities | A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_from.identity_type | Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_to.external_resources | A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '\*' is not allowed. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.prior.service_perimeter.spec.egress_policies.egress_to.resources | A list of resources, currently only projects in the form projects/\, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If \* is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_from.identities | A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_from.identity_type | Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_from.sources.access_level | An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single \* is specified for accessLevel, then all IngressSources will be allowed. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_from.sources.resource | A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/\{project_number\} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. \* is not allowed, the case of allowing all Google Cloud resources only is not supported. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.prior.service_perimeter.spec.ingress_policies.ingress_to.resources | A list of resources, currently only projects in the form projects/\, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single \* is specified, then access to all resources inside the perimeter are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.spec.resources | A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/\{project_number\}. | keyword | +| google_scc.asset.prior.service_perimeter.spec.restricted_services | Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. | keyword | +| google_scc.asset.prior.service_perimeter.spec.vpc_accessible_services.allowed_services | The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. | keyword | +| google_scc.asset.prior.service_perimeter.spec.vpc_accessible_services.enable_restriction | Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. | boolean | +| google_scc.asset.prior.service_perimeter.status.access_levels | A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_from.identities | A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_from.identity_type | Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_to.external_resources | A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '\*' is not allowed. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.prior.service_perimeter.status.egress_policies.egress_to.resources | A list of resources, currently only projects in the form projects/\, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If \* is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_from.identities | A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_from.identity_type | Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_from.sources.access_level | An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single \* is specified for accessLevel, then all IngressSources will be allowed. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_from.sources.resource | A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/\{project_number\} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. \* is not allowed, the case of allowing all Google Cloud resources only is not supported. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.prior.service_perimeter.status.ingress_policies.ingress_to.resources | A list of resources, currently only projects in the form projects/\, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single \* is specified, then access to all resources inside the perimeter are allowed. | keyword | +| google_scc.asset.prior.service_perimeter.status.resources | A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/\{project_number\}. | keyword | +| google_scc.asset.prior.service_perimeter.status.restricted_services | Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. | keyword | +| google_scc.asset.prior.service_perimeter.status.vpc_accessible_services.allowed_services | The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. | keyword | +| google_scc.asset.prior.service_perimeter.status.vpc_accessible_services.enable_restriction | Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. | boolean | +| google_scc.asset.prior.service_perimeter.title | Human readable title. Must be unique within the Policy. | keyword | +| google_scc.asset.prior.service_perimeter.type | Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. | keyword | +| google_scc.asset.prior.service_perimeter.use_explicit_dry_run_spec | Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. useExplicitDryRunSpec must bet set to True if any of the fields in the spec are set to non-default values. | boolean | +| google_scc.asset.prior.type | The type of the asset. Example: compute.googleapis.com/Disk.See Supported asset types for more information. | keyword | +| google_scc.asset.prior.update_time | The last update timestamp of an asset. updateTime is updated when create/update/delete operation is performed. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.prior_asset_state | | keyword | +| google_scc.asset.related_asset.ancestors | The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.related_asset.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.related_asset.relationship_type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP. | keyword | +| google_scc.asset.related_asset.type | The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information. | keyword | +| google_scc.asset.related_assets.assets.ancestors | The ancestors of an asset in Google Cloud resource hierarchy, represented as a list of relative resource names. An ancestry path starts with the closest ancestor in the hierarchy and ends at root. Example: ["projects/123456789", "folders/5432", "organizations/1234"]. | keyword | +| google_scc.asset.related_assets.assets.name | The full name of the asset. Example: //compute.googleapis.com/projects/my_project_123/zones/zone1/instances/instance1. See Resource names for more information. | keyword | +| google_scc.asset.related_assets.assets.relationship_type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP. | keyword | +| google_scc.asset.related_assets.assets.type | The type of the asset. Example: compute.googleapis.com/Disk. See Supported asset types for more information. | keyword | +| google_scc.asset.related_assets.relationship_attributes.action | The detail of the relationship, e.g. contains, attaches. | keyword | +| google_scc.asset.related_assets.relationship_attributes.source_resource_type | The source asset type. Example: compute.googleapis.com/Instance. | keyword | +| google_scc.asset.related_assets.relationship_attributes.target_resource_type | The target asset type. Example: compute.googleapis.com/Disk. | keyword | +| google_scc.asset.related_assets.relationship_attributes.type | The unique identifier of the relationship type. Example: INSTANCE_TO_INSTANCEGROUP. | keyword | +| google_scc.asset.resource.data | The content of the resource, in which some sensitive fields are removed and may not be present. | flattened | +| google_scc.asset.resource.discovery.document_uri | The URL of the discovery document containing the resource's JSON schema. Example: https://www.googleapis.com/discovery/v1/apis/compute/v1/rest This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. | keyword | +| google_scc.asset.resource.discovery.name | The JSON schema name listed in the discovery document. Example: Project This value is unspecified for resources that do not have an API based on a discovery document, such as Cloud Bigtable. | keyword | +| google_scc.asset.resource.location | The location of the resource in Google Cloud, such as its zone and region. For more information, see https://cloud.google.com/about/locations/. | keyword | +| google_scc.asset.resource.parent | The full name of the immediate parent of this resource. See Resource Names for more information. For Google Cloud assets, this value is the parent resource defined in the Cloud IAM policy hierarchy. Example: //cloudresourcemanager.googleapis.com/projects/my_project_123 For third-party assets, this field may be set differently. | keyword | +| google_scc.asset.resource.url | The REST URL for accessing the resource. An HTTP GET request using this URL returns the resource itself. Example:https://cloudresourcemanager.googleapis.com/v1/projects/my-project-1233 This value is unspecified for resources without a REST API. | keyword | +| google_scc.asset.resource.version | The API version. Example: v1. | keyword | +| google_scc.asset.service_perimeter.description | Description of the ServicePerimeter and its use. Does not affect behavior. | keyword | +| google_scc.asset.service_perimeter.name | Required. Resource name for the ServicePerimeter. The shortName component must begin with a letter and only include alphanumeric and '_'. Format: accessPolicies/\{accessPolicy\}/servicePerimeters/\{servicePerimeter\}. | keyword | +| google_scc.asset.service_perimeter.spec.access_levels | A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_from.identities | A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_from.identity_type | Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_to.external_resources | A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '\*' is not allowed. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.service_perimeter.spec.egress_policies.egress_to.resources | A list of resources, currently only projects in the form projects/\, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If \* is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_from.identities | A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_from.identity_type | Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_from.sources.access_level | An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single \* is specified for accessLevel, then all IngressSources will be allowed. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_from.sources.resource | A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/\{project_number\} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. \* is not allowed, the case of allowing all Google Cloud resources only is not supported. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.service_perimeter.spec.ingress_policies.ingress_to.resources | A list of resources, currently only projects in the form projects/\, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single \* is specified, then access to all resources inside the perimeter are allowed. | keyword | +| google_scc.asset.service_perimeter.spec.resources | A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/\{project_number\}. | keyword | +| google_scc.asset.service_perimeter.spec.restricted_services | Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. | keyword | +| google_scc.asset.service_perimeter.spec.vpc_accessible_services.allowed_services | The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. | keyword | +| google_scc.asset.service_perimeter.spec.vpc_accessible_services.enable_restriction | Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. | boolean | +| google_scc.asset.service_perimeter.status.access_levels | A list of AccessLevel resource names that allow resources within the ServicePerimeter to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel is a syntax error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: "accessPolicies/MY_POLICY/accessLevels/MY_LEVEL". For Service Perimeter Bridge, must be empty. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_from.identities | A list of identities that are allowed access through this [EgressPolicy]. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_from.identity_type | Specifies the type of identities that are allowed access to outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_to.external_resources | A list of external resources that are allowed to be accessed. Only AWS and Azure resources are supported. For Amazon S3, the supported format is s3://BUCKET_NAME. For Azure Storage, the supported format is azure://myaccount.blob.core.windows.net/CONTAINER_NAME. A request matches if it contains an external resource in this list (Example: s3://bucket/path). Currently '\*' is not allowed. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.service_perimeter.status.egress_policies.egress_to.resources | A list of resources, currently only projects in the form projects/\, that are allowed to be accessed by sources defined in the corresponding EgressFrom. A request matches if it contains a resource in this list. If \* is specified for resources, then this EgressTo rule will authorize access to all resources outside the perimeter. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_from.identities | A list of identities that are allowed access through this ingress policy. Should be in the format of email address. The email address should represent individual user or service account only. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_from.identity_type | Specifies the type of identities that are allowed access from outside the perimeter. If left unspecified, then members of identities field will be allowed access. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_from.sources.access_level | An AccessLevel resource name that allow resources within the ServicePerimeters to be accessed from the internet. AccessLevels listed must be in the same policy as this ServicePerimeter. Referencing a nonexistent AccessLevel will cause an error. If no AccessLevel names are listed, resources within the perimeter can only be accessed via Google Cloud calls with request origins within the perimeter. Example: accessPolicies/MY_POLICY/accessLevels/MY_LEVEL. If a single \* is specified for accessLevel, then all IngressSources will be allowed. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_from.sources.resource | A Google Cloud resource that is allowed to ingress the perimeter. Requests from these resources will be allowed to access perimeter data. Currently only projects are allowed. Format: projects/\{project_number\} The project may be in any Google Cloud organization, not just the organization that the perimeter is defined in. \* is not allowed, the case of allowing all Google Cloud resources only is not supported. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_to.operations.method_selectors.method | Value for method should be a valid method name for the corresponding serviceName in ApiOperation. If \* used as value for method, then ALL methods and permissions are allowed. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_to.operations.method_selectors.permission | Value for permission should be a valid Cloud IAM permission for the corresponding serviceName in ApiOperation. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_to.operations.service_name | The name of the API whose methods or permissions the IngressPolicy or EgressPolicy want to allow. A single ApiOperation with serviceName field set to \* will allow all methods AND permissions for all services. | keyword | +| google_scc.asset.service_perimeter.status.ingress_policies.ingress_to.resources | A list of resources, currently only projects in the form projects/\, protected by this ServicePerimeter that are allowed to be accessed by sources defined in the corresponding IngressFrom. If a single \* is specified, then access to all resources inside the perimeter are allowed. | keyword | +| google_scc.asset.service_perimeter.status.resources | A list of Google Cloud resources that are inside of the service perimeter. Currently only projects are allowed. Format: projects/\{project_number\}. | keyword | +| google_scc.asset.service_perimeter.status.restricted_services | Google Cloud services that are subject to the Service Perimeter restrictions. For example, if storage.googleapis.com is specified, access to the storage buckets inside the perimeter must meet the perimeter's access restrictions. | keyword | +| google_scc.asset.service_perimeter.status.vpc_accessible_services.allowed_services | The list of APIs usable within the Service Perimeter. Must be empty unless 'enableRestriction' is True. You can specify a list of individual services, as well as include the 'RESTRICTED-SERVICES' value, which automatically includes all of the services protected by the perimeter. | keyword | +| google_scc.asset.service_perimeter.status.vpc_accessible_services.enable_restriction | Whether to restrict API calls within the Service Perimeter to the list of APIs specified in 'allowedServices'. | boolean | +| google_scc.asset.service_perimeter.title | Human readable title. Must be unique within the Policy. | keyword | +| google_scc.asset.service_perimeter.type | Perimeter type indicator. A single project is allowed to be a member of single regular perimeter, but multiple service perimeter bridges. A project cannot be a included in a perimeter bridge without being included in regular perimeter. For perimeter bridges, the restricted service list as well as access level lists must be empty. | keyword | +| google_scc.asset.service_perimeter.use_explicit_dry_run_spec | Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists for all Service Perimeters, and that spec is identical to the status for those Service Perimeters. When this flag is set, it inhibits the generation of the implicit spec, thereby allowing the user to explicitly provide a configuration ("spec") to use in a dry-run version of the Service Perimeter. This allows the user to test changes to the enforced config ("status") without actually enforcing them. This testing is done through analyzing the differences between currently enforced and suggested restrictions. useExplicitDryRunSpec must bet set to True if any of the fields in the spec are set to non-default values. | boolean | +| google_scc.asset.type | The type of the asset. Example: compute.googleapis.com/Disk.See Supported asset types for more information. | keyword | +| google_scc.asset.update_time | The last update timestamp of an asset. updateTime is updated when create/update/delete operation is performed. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z". | date | +| google_scc.asset.window.start_time | | date | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | + + +### Finding + +This is the `Finding` dataset. + +#### Example + +An example event for `finding` looks as following: + +```json +{ + "@timestamp": "2023-06-02T05:17:41.936Z", + "agent": { + "ephemeral_id": "3595a791-e9ba-4a51-9eb2-18219952e440", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.finding", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "created": "2020-02-19T13:37:43.858Z", + "dataset": "google_scc.finding", + "id": "67d5908d21-1", + "ingested": "2023-07-03T06:30:14Z", + "kind": "event" + }, + "google_scc": { + "finding": { + "canonical_name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "category": "application", + "external_systems": { + "test": { + "assignees": [ + "primary" + ], + "externalSystemUpdateTime": "2022-01-05T05:00:35.674Z", + "externalUid": "test_scc_finding_2", + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/externalSystems/test", + "status": "updated1" + } + }, + "mute": { + "initiator": "Unmuted by john@gmail.com", + "state": "UNMUTED", + "update_time": "2022-03-23T05:50:21.804Z" + }, + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545", + "parent": "organizations/515665165161/sources/98481484454154454545", + "resource": { + "name": "//cloudresourcemanager.googleapis.com/projects/45455445554" + }, + "resource_name": "//cloudresourcemanager.googleapis.com/projects/45455445554", + "security_marks": { + "name": "organizations/515665165161/sources/98481484454154454545/findings/414rfrhjebhrbhjbr444454hv54545/securityMarks" + }, + "severity": "CRITICAL", + "source_id": "98481484454154454545", + "state": "ACTIVE" + } + }, + "input": { + "type": "gcp-pubsub" + }, + "organization": { + "id": "515665165161" + }, + "tags": [ + "forwarded", + "google_scc-finding" + ], + "url": { + "domain": "www.adwait.com", + "original": "http://www.adwait.com", + "scheme": "http" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| google_scc.finding.access.caller_ip | Caller's IP address, such as "1.1.1.1". | ip | +| google_scc.finding.access.caller_ip_geo.region_code | A CLDR. | keyword | +| google_scc.finding.access.method_name | The method that the service account called, e.g. "SetIamPolicy". | keyword | +| google_scc.finding.access.principal.email | Associated email, such as "foo@google.com". | keyword | +| google_scc.finding.access.principal.subject | A string that represents the principalSubject that is associated with the identity. Unlike principalEmail, principalSubject supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format is principal://iam.googleapis.com/\{identity pool name\}/subject/\{subject\}. Some GKE identities, such as GKE_WORKLOAD, FREEFORM, and GKE_HUB_WORKLOAD, still use the legacy format serviceAccount:\{identity pool name\}[\{subject\}]. | keyword | +| google_scc.finding.access.service_account.delegation_info.principal.email | The email address of a Google account. | keyword | +| google_scc.finding.access.service_account.delegation_info.principal.subject | A string representing the principalSubject associated with the identity. As compared to principalEmail, supports principals that aren't associated with email addresses, such as third party principals. For most identities, the format will be principal://iam.googleapis.com/\{identity pool name\}/subject/\{subject\} except for some GKE identities (GKE_WORKLOAD, FREEFORM, GKE_HUB_WORKLOAD) that are still in the legacy format serviceAccount:\{identity pool name\}[\{subject\}]. | keyword | +| google_scc.finding.access.service_account.key_name | The name of the service account key that was used to create or exchange credentials for authenticating the service account that made the request. This is a scheme-less URI full resource name. For example: "//iam.googleapis.com/projects/\{PROJECT_ID\}/serviceAccounts/\{ACCOUNT\}/keys/\{key\}". | keyword | +| google_scc.finding.access.service_name | This is the API service that the service account made a call to, e.g. "iam.googleapis.com". | keyword | +| google_scc.finding.access.user_agent_family | Type of user agent associated with the finding, for example, operating system shells and embedded or stand-alone applications. | keyword | +| google_scc.finding.access.user_name | A string that represents a username. The username provided depends on the type of the finding and is likely not an IAM principal. For example, this can be a system username if the finding is related to a virtual machine, or it can be an application login username. | keyword | +| google_scc.finding.canonical_name | The canonical name of the finding. It's either "organizations/\{organization_id\}/sources/\{source_id\}/findings/\{findingId\}", "folders/\{folder_id\}/sources/\{source_id\}/findings/\{findingId\}" or "projects/\{project_number\}/sources/\{source_id\}/findings/\{findingId\}", depending on the closest CRM ancestor of the resource associated with the finding. | keyword | +| google_scc.finding.category | The additional taxonomy group within findings from a given source. This field is immutable after creation time. Example: "XSS_FLASH_INJECTION". | keyword | +| google_scc.finding.class | The class of the finding. | keyword | +| google_scc.finding.cloud_dlp.data_profile.value | Name of the data profile, for example, projects/123/locations/europe/tableProfiles/8383929. | keyword | +| google_scc.finding.cloud_dlp.inspection.full_scan | Whether Cloud DLP scanned the complete resource or a sampled subset. | boolean | +| google_scc.finding.cloud_dlp.inspection.info_type.count | The number of times Cloud DLP found this infoType within this job and resource. | long | +| google_scc.finding.cloud_dlp.inspection.info_type.value | The type of information (or infoType) found, for example, EMAIL_ADDRESS or STREET_ADDRESS. | keyword | +| google_scc.finding.cloud_dlp.inspection.inspect_job | Name of the inspection job, for example, projects/123/locations/europe/dlpJobs/i-8383929. | keyword | +| google_scc.finding.compliances.ids | Policies within the standard or benchmark, for example, A.12.4.1. | keyword | +| google_scc.finding.compliances.standard | Industry-wide compliance standards or benchmarks, such as "cis", "pci", and "owasp". | keyword | +| google_scc.finding.compliances.version | Version of the standard or benchmark, for example, "1.1". | keyword | +| google_scc.finding.connections.destination.ip | Destination IP address. Not present for sockets that are listening and not connected. | ip | +| google_scc.finding.connections.destination.port | Destination port. Not present for sockets that are listening and not connected. | long | +| google_scc.finding.connections.protocol | IANA Internet Protocol Number such as TCP(6) and UDP(17). | keyword | +| google_scc.finding.connections.source.ip | Source IP address. | ip | +| google_scc.finding.connections.source.port | Source port. | long | +| google_scc.finding.contacts.all.email | | keyword | +| google_scc.finding.contacts.billing.email | | keyword | +| google_scc.finding.contacts.legal.email | | keyword | +| google_scc.finding.contacts.product_updates.email | | keyword | +| google_scc.finding.contacts.security.email | | keyword | +| google_scc.finding.contacts.suspension.email | | keyword | +| google_scc.finding.contacts.technical.email | | keyword | +| google_scc.finding.contacts.technical_incidents.email | | keyword | +| google_scc.finding.containers.image_id | Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest. | keyword | +| google_scc.finding.containers.labels.name | Name of the label. | keyword | +| google_scc.finding.containers.labels.value | Value that corresponds to the label's name. | keyword | +| google_scc.finding.containers.name | Name of the container. | keyword | +| google_scc.finding.containers.uri | Container image URI provided when configuring a pod or container. May identify a container image version using mutable tags. | keyword | +| google_scc.finding.create_time | The time at which the finding was created in Security Command Center. | date | +| google_scc.finding.database.display_name | The human-readable name of the database that the user connected to. | keyword | +| google_scc.finding.database.grantees | The target usernames, roles, or groups of an SQL privilege grant, which is not an IAM policy change. | keyword | +| google_scc.finding.database.name | The full resource name of the database that the user connected to, if it is supported by Cloud Asset Inventory. (https://google.aip.dev/122#full-resource-names) | keyword | +| google_scc.finding.database.query | The SQL statement that is associated with the database access. | keyword | +| google_scc.finding.database.user_name | The username used to connect to the database. The username might not be an IAM principal and does not have a set format. | keyword | +| google_scc.finding.description | Contains more details about the finding. | keyword | +| google_scc.finding.event_time | The time the finding was first detected. If an existing finding is updated, then this is the time the update occurred. For example, if the finding represents an open firewall, this property captures the time the detector believes the firewall became open. The accuracy is determined by the detector. If the finding is later resolved, then this time reflects when the finding was resolved. This must not be set to a value greater than the current timestamp. | date | +| google_scc.finding.exfiltration.sources.components | Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same CloudSQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket. | keyword | +| google_scc.finding.exfiltration.sources.name | The resource's full resource name. | keyword | +| google_scc.finding.exfiltration.targets.components | Subcomponents of the asset that was exfiltrated, like URIs used during exfiltration, table names, databases, and filenames. For example, multiple tables might have been exfiltrated from the same CloudSQL instance, or multiple files might have been exfiltrated from the same Cloud Storage bucket. | keyword | +| google_scc.finding.exfiltration.targets.name | The resource's full resource name. | keyword | +| google_scc.finding.external_systems | Output only. Third party SIEM/SOAR fields within SCC, contains external system information and external system finding fields. | flattened | +| google_scc.finding.external_uri | The URI that, if available, points to a web page outside of Security Command Center where additional information about the finding can be found. This field is guaranteed to be either empty or a well formed URL. | keyword | +| google_scc.finding.files.contents | Prefix of the file contents as a JSON-encoded string. | keyword | +| google_scc.finding.files.hashed_size | The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. | long | +| google_scc.finding.files.partially_hashed | True when the hash covers only a prefix of the file. | boolean | +| google_scc.finding.files.path | Absolute path of the file as a JSON encoded string. | keyword | +| google_scc.finding.files.sha256 | SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. | keyword | +| google_scc.finding.files.size | Size of the file in bytes. | long | +| google_scc.finding.iam_bindings.action | The action that was performed on a Binding. | keyword | +| google_scc.finding.iam_bindings.member | A single identity requesting access for a Cloud Platform resource, for example, "foo@google.com". | keyword | +| google_scc.finding.iam_bindings.role | Role that is assigned to "members". For example, "roles/viewer", "roles/editor", or "roles/owner". | keyword | +| google_scc.finding.indicator.domains | List of domains associated with the finding. | keyword | +| google_scc.finding.indicator.ip_addresses | List of IP addresses associated with the finding. | ip | +| google_scc.finding.indicator.signatures.memory_hash_signature.binary_family | The binary family. | keyword | +| google_scc.finding.indicator.signatures.memory_hash_signature.detections.binary | The name of the binary associated with the memory hash signature detection. | keyword | +| google_scc.finding.indicator.signatures.memory_hash_signature.detections.percent_pages_matched | The percentage of memory page hashes in the signature that matched. | long | +| google_scc.finding.indicator.signatures.yara.rule | The name of the YARA rule. | keyword | +| google_scc.finding.indicator.uris | The list of URIs that are associated with a finding. | keyword | +| google_scc.finding.kernel_root_kit.name | Rootkit name, when available. | keyword | +| google_scc.finding.kernel_root_kit.unexpected.code_modification | True if unexpected modifications of kernel code memory are present. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.ftrace_handler | True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.interrupt_handler | True if interrupt handlers that are are not in the expected kernel or module code regions are present. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.kernel_code_pages | True if kernel code pages that are not in the expected kernel or module code regions are present. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.kprobe_handler | True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.processes_in_runqueue | True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.read_only_data_modification | True if unexpected modifications of kernel read-only data memory are present. | boolean | +| google_scc.finding.kernel_root_kit.unexpected.system_call_handler | True if system call handlers that are are not in the expected kernel or module code regions are present. | boolean | +| google_scc.finding.kubernetes.access_reviews.group | The API group of the resource. "\*" means all. | keyword | +| google_scc.finding.kubernetes.access_reviews.name | The name of the resource being requested. Empty means all. | keyword | +| google_scc.finding.kubernetes.access_reviews.namespace | Namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces. Both are represented by "" (empty). | keyword | +| google_scc.finding.kubernetes.access_reviews.resource | The optional resource type requested. "\*" means all. | keyword | +| google_scc.finding.kubernetes.access_reviews.subresource | The optional subresource type. | keyword | +| google_scc.finding.kubernetes.access_reviews.verb | A Kubernetes resource API verb, like get, list, watch, create, update, delete, proxy. "\*" means all. | keyword | +| google_scc.finding.kubernetes.access_reviews.version | The API version of the resource. "\*" means all. | keyword | +| google_scc.finding.kubernetes.bindings.name | Name for the binding. | keyword | +| google_scc.finding.kubernetes.bindings.namespace | Namespace for the binding. | keyword | +| google_scc.finding.kubernetes.bindings.role.kind | Role type. | keyword | +| google_scc.finding.kubernetes.bindings.role.name | Role name. | keyword | +| google_scc.finding.kubernetes.bindings.role.namespace | Role namespace. | keyword | +| google_scc.finding.kubernetes.bindings.subjects.kind | Authentication type for the subject. | keyword | +| google_scc.finding.kubernetes.bindings.subjects.name | Name for the subject. | keyword | +| google_scc.finding.kubernetes.bindings.subjects.namespace | Namespace for the subject. | keyword | +| google_scc.finding.kubernetes.node_pools.name | Kubernetes node pool name. | keyword | +| google_scc.finding.kubernetes.node_pools.nodes.name | Full resource name of the Compute Engine VM running the cluster node. | keyword | +| google_scc.finding.kubernetes.nodes.name | Full resource name of the Compute Engine VM running the cluster node. | keyword | +| google_scc.finding.kubernetes.pods.containers.image_id | Optional container image ID, if provided by the container runtime. Uniquely identifies the container image launched using a container image digest. | keyword | +| google_scc.finding.kubernetes.pods.containers.labels.name | Name of the label. | keyword | +| google_scc.finding.kubernetes.pods.containers.labels.value | Value that corresponds to the label's name. | keyword | +| google_scc.finding.kubernetes.pods.containers.name | Name of the container. | keyword | +| google_scc.finding.kubernetes.pods.containers.uri | Container image URI provided when configuring a pod or container. May identify a container image version using mutable tags. | keyword | +| google_scc.finding.kubernetes.pods.labels.name | Name of the label. | keyword | +| google_scc.finding.kubernetes.pods.labels.value | Value that corresponds to the label's name. | keyword | +| google_scc.finding.kubernetes.pods.name | Kubernetes Pod name. | keyword | +| google_scc.finding.kubernetes.pods.namespace | Kubernetes Pod namespace. | keyword | +| google_scc.finding.kubernetes.roles.kind | Role type. | keyword | +| google_scc.finding.kubernetes.roles.name | Role name. | keyword | +| google_scc.finding.kubernetes.roles.namespace | Role namespace. | keyword | +| google_scc.finding.mitre_attack.additional.tactics | Additional MITRE ATT&CK tactics related to this finding, if any. | keyword | +| google_scc.finding.mitre_attack.additional.techniques | Additional MITRE ATT&CK techniques related to this finding, if any, along with any of their respective parent techniques. | keyword | +| google_scc.finding.mitre_attack.primary.tactic | The MITRE ATT&CK tactic most closely represented by this finding, if any. | keyword | +| google_scc.finding.mitre_attack.primary.techniques | The MITRE ATT&CK technique most closely represented by this finding, if any. primaryTechniques is a repeated field because there are multiple levels of MITRE ATT&CK techniques. If the technique most closely represented by this finding is a sub-technique (e.g. SCANNING_IP_BLOCKS), both the sub-technique and its parent technique(s) will be listed (e.g. SCANNING_IP_BLOCKS, ACTIVE_SCANNING). | keyword | +| google_scc.finding.mitre_attack.version | The MITRE ATT&CK version referenced by the above fields. E.g. "8". | keyword | +| google_scc.finding.module_name | Unique identifier of the module which generated the finding. Example: folders/598186756061/securityHealthAnalyticsSettings/customModules/56799441161885. | keyword | +| google_scc.finding.mute.initiator | Records additional information about the mute operation, for example, the mute configuration that muted the finding and the user who muted the finding. | keyword | +| google_scc.finding.mute.state | Indicates the mute state of a finding (either muted, unmuted or undefined). Unlike other attributes of a finding, a finding provider shouldn't set the value of mute. | keyword | +| google_scc.finding.mute.update_time | Output only. The most recent time this finding was muted or unmuted. | date | +| google_scc.finding.name | The relative resource name of this finding. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/\{organization_id\}/sources/\{source_id\}/findings/\{findingId\}". | keyword | +| google_scc.finding.next_steps | Steps to address the finding. | keyword | +| google_scc.finding.notification_config_name | | keyword | +| google_scc.finding.parent | The relative resource name of the source the finding belongs to. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name This field is immutable after creation time. For example: "organizations/\{organization_id\}/sources/\{source_id\}". | keyword | +| google_scc.finding.parent_display_name | Output only. The human readable display name of the finding source such as "Event Threat Detection" or "Security Health Analytics". | keyword | +| google_scc.finding.processes.args | Process arguments as JSON encoded strings. | keyword | +| google_scc.finding.processes.arguments_truncated | True if args is incomplete. | boolean | +| google_scc.finding.processes.binary.contents | Prefix of the file contents as a JSON encoded string. | keyword | +| google_scc.finding.processes.binary.hashed_size | The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. | long | +| google_scc.finding.processes.binary.partially_hashed | True when the hash covers only a prefix of the file. | boolean | +| google_scc.finding.processes.binary.path | Absolute path of the file as a JSON encoded string. | keyword | +| google_scc.finding.processes.binary.sha256 | SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. | keyword | +| google_scc.finding.processes.binary.size | Size of the file in bytes. | long | +| google_scc.finding.processes.environment_variables.name | Environment variable name as a JSON encoded string. | keyword | +| google_scc.finding.processes.environment_variables.value | Environment variable value as a JSON encoded string. | keyword | +| google_scc.finding.processes.environment_variables_truncated | True if envVariables is incomplete. | boolean | +| google_scc.finding.processes.libraries.contents | Prefix of the file contents as a JSON encoded string. | keyword | +| google_scc.finding.processes.libraries.hashed_size | The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. | long | +| google_scc.finding.processes.libraries.partially_hashed | True when the hash covers only a prefix of the file. | boolean | +| google_scc.finding.processes.libraries.path | Absolute path of the file as a JSON encoded string. | keyword | +| google_scc.finding.processes.libraries.sha256 | SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. | keyword | +| google_scc.finding.processes.libraries.size | Size of the file in bytes. | long | +| google_scc.finding.processes.name | The process name, as displayed in utilities like top and ps. This name can be accessed through /proc/[pid]/comm and changed with prctl(PR_SET_NAME). | keyword | +| google_scc.finding.processes.parent.pid | The parent process ID. | long | +| google_scc.finding.processes.pid | The process ID. | long | +| google_scc.finding.processes.script.contents | Prefix of the file contents as a JSON encoded string. | keyword | +| google_scc.finding.processes.script.hashed_size | The length in bytes of the file prefix that was hashed. If hashedSize == size, any hashes reported represent the entire file. | long | +| google_scc.finding.processes.script.partially_hashed | True when the hash covers only a prefix of the file. | boolean | +| google_scc.finding.processes.script.path | Absolute path of the file as a JSON encoded string. | keyword | +| google_scc.finding.processes.script.sha256 | SHA256 hash of the first hashedSize bytes of the file encoded as a hex string. If hashedSize == size, sha256 represents the SHA256 hash of the entire file. | keyword | +| google_scc.finding.processes.script.size | Size of the file in bytes. | long | +| google_scc.finding.resource.display_name | The human readable name of the resource. | keyword | +| google_scc.finding.resource.folders.display_name | The user defined display name for this folder. | keyword | +| google_scc.finding.resource.folders.name | Full resource name of this folder. See: https://cloud.google.com/apis/design/resource_names#full_resource_name | keyword | +| google_scc.finding.resource.name | For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time. | keyword | +| google_scc.finding.resource.parent.display_name | The human readable name of resource's parent. | keyword | +| google_scc.finding.resource.parent.name | The full resource name of resource's parent. | keyword | +| google_scc.finding.resource.project.display_name | The project ID that the resource belongs to. | keyword | +| google_scc.finding.resource.project.name | The full resource name of project that the resource belongs to. | keyword | +| google_scc.finding.resource.type | The full resource type of the resource. | keyword | +| google_scc.finding.resource_name | For findings on Google Cloud resources, the full resource name of the Google Cloud resource this finding is for. See: https://cloud.google.com/apis/design/resource_names#full_resource_name When the finding is for a non-Google Cloud resource, the resourceName can be a customer or partner defined string. This field is immutable after creation time. | keyword | +| google_scc.finding.security_marks.canonical_name | The canonical name of the marks. Examples: "organizations/\{organization_id\}/assets/\{asset_id\}/securityMarks" "folders/\{folder_id\}/assets/\{asset_id\}/securityMarks" "projects/\{project_number\}/assets/\{asset_id\}/securityMarks" "organizations/\{organization_id\}/sources/\{source_id\}/findings/\{findingId\}/securityMarks" "folders/\{folder_id\}/sources/\{source_id\}/findings/\{findingId\}/securityMarks" "projects/\{project_number\}/sources/\{source_id\}/findings/\{findingId\}/securityMarks". | keyword | +| google_scc.finding.security_marks.name | The relative resource name of the SecurityMarks. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Examples: "organizations/\{organization_id\}/assets/\{asset_id\}/securityMarks" "organizations/\{organization_id\}/sources/\{source_id\}/findings/\{findingId\}/securityMarks". | keyword | +| google_scc.finding.security_marks.value | Mutable user specified security marks belonging to the parent resource. Constraints are as follows:Keys and values are treated as case insensitive. Keys must be between 1 - 256 characters (inclusive). Keys must be letters, numbers, underscores, or dashes. Values have leading and trailing whitespace trimmed, remaining characters must be between 1 - 4096 characters (inclusive). | flattened | +| google_scc.finding.severity | The severity of the finding. This field is managed by the source that writes the finding. | keyword | +| google_scc.finding.source_id | | keyword | +| google_scc.finding.source_properties | Source specific properties. These properties are managed by the source that writes the finding. The key names in the sourceProperties map must be between 1 and 255 characters, and must start with a letter and contain alphanumeric characters or underscores only. | flattened | +| google_scc.finding.source_properties_supporting_data | | keyword | +| google_scc.finding.state | The state of the finding. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.attack.complexity | This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.attack.vector | Base Metrics Represents the intrinsic characteristics of a vulnerability that are constant over time and across user environments. This metric reflects the context by which vulnerability exploitation is possible. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.availability_impact | This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.base_score | The base score is a function of the base metric scores. | long | +| google_scc.finding.vulnerability.cve.cvssv3.confidentiality_impact | This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.integrity_impact | This metric measures the impact to integrity of a successfully exploited vulnerability. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.privileges_required | This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.scope | The Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope. | keyword | +| google_scc.finding.vulnerability.cve.cvssv3.user_interaction | This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component. | keyword | +| google_scc.finding.vulnerability.cve.id | The unique identifier for the vulnerability, for example, CVE-2021-34527. | keyword | +| google_scc.finding.vulnerability.cve.references.source | Source of the reference, for example, NVD. | keyword | +| google_scc.finding.vulnerability.cve.references.uri | URI for the source, for example, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34527. | keyword | +| google_scc.finding.vulnerability.cve.upstream_fix_available | Whether upstream fix is available for the CVE. | boolean | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | + + +### Source + +This is the `Source` dataset. + +#### Example + +An example event for `source` looks as following: + +```json +{ + "@timestamp": "2023-07-03T06:32:03.193Z", + "agent": { + "ephemeral_id": "498f9d2e-09a7-4616-8ee1-8c60809852c3", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "google_scc.source", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-07-03T06:32:03.193Z", + "dataset": "google_scc.source", + "ingested": "2023-07-03T06:32:06Z", + "kind": "event", + "original": "{\"canonicalName\":\"organizations/595779152576/sources/10134421585261057824\",\"description\":\"Extend your security view from the edge.\",\"displayName\":\"Cloudflare Security Events\",\"name\":\"organizations/595779152576/sources/10134421585261057824\"}" + }, + "google_scc": { + "source": { + "canonical_name": "organizations/595779152576/sources/10134421585261057824", + "description": "Extend your security view from the edge.", + "display_name": "Cloudflare Security Events", + "id": "10134421585261057824", + "name": "organizations/595779152576/sources/10134421585261057824" + } + }, + "input": { + "type": "httpjson" + }, + "message": "Extend your security view from the edge.", + "organization": { + "id": "595779152576" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded", + "google_scc-source" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| google_scc.source.canonical_name | The canonical name of the finding. It's either "organizations/\{organization_id\}/sources/\{source_id\}", "folders/\{folder_id\}/sources/\{source_id\}" or "projects/\{project_number\}/sources/\{source_id\}", depending on the closest CRM ancestor of the resource associated with the finding. | keyword | +| google_scc.source.description | The description of the source (max of 1024 characters). Example: "Web Security Scanner is a web security scanner for common vulnerabilities in App Engine applications. It can automatically scan and detect four common vulnerabilities, including cross-site-scripting (XSS), Flash injection, mixed content (HTTP in HTTPS), and outdated or insecure libraries." | keyword | +| google_scc.source.display_name | The source's display name. A source's display name must be unique amongst its siblings, for example, two sources with the same parent can't share the same display name. The display name must have a length between 1 and 64 characters (inclusive). | keyword | +| google_scc.source.id | | keyword | +| google_scc.source.name | The relative resource name of this source. See: https://cloud.google.com/apis/design/resource_names#relative_resource_name Example: "organizations/\{organization_id\}/sources/\{source_id\}". | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | + + +### Audit + +This is the `Audit` dataset. + +#### Example + +An example event for `audit` looks as following: + +```json +{ + "@timestamp": "2021-09-24T16:16:57.183Z", + "agent": { + "ephemeral_id": "1d64ed9e-03f2-4eea-9e8a-b9a630236e12", + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "cloud": { + "service": { + "name": "login.googleapis.com" + } + }, + "data_stream": { + "dataset": "google_scc.audit", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c00a899-0103-47cf-a91d-fa52a48711c8", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "action": "google.login.LoginService.loginFailure", + "agent_id_status": "verified", + "created": "2023-07-03T06:26:31.858Z", + "dataset": "google_scc.audit", + "id": "-nahbepd4l1x", + "ingested": "2023-07-03T06:26:35Z", + "kind": "event", + "severity": 300 + }, + "google_scc": { + "audit": { + "http_request": { + "remote": { + "ip": "FE80::0202:B3FF:FE1E", + "port": 1010 + } + }, + "log_name": "organizations/123/logs/cloudaudit.googleapis.com%2Fdata_access", + "proto_payload": { + "resource_name": "organizations/123", + "type": "type.googleapis.com/google.cloud.audit.AuditLog" + }, + "receive_timestamp": "2021-09-24T17:51:25.034Z", + "resource": { + "type": "audited_resource" + } + } + }, + "input": { + "type": "gcp-pubsub" + }, + "log": { + "level": "NOTICE" + }, + "related": { + "ip": [ + "175.16.199.1", + "FE80::0202:B3FF:FE1E" + ], + "user": [ + "test-user@example.net" + ] + }, + "source": { + "ip": "175.16.199.1", + "user": { + "email": "test-user@example.net" + } + }, + "tags": [ + "forwarded", + "google_scc-audit" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| google_scc.audit.http_request.cache.fill_bytes | The number of HTTP response bytes inserted into cache. Set only when a cache fill was attempted. | long | +| google_scc.audit.http_request.cache.hit | Whether or not an entity was served from cache (with or without validation). | boolean | +| google_scc.audit.http_request.cache.look_up | Whether or not a cache lookup was attempted. | boolean | +| google_scc.audit.http_request.cache.validated_with_origin_server | Whether or not the response was validated with the origin server before being served from cache. This field is only meaningful if cacheHit is True. | boolean | +| google_scc.audit.http_request.latency | The request processing latency on the server, from the time the request was received until the response was sent. | keyword | +| google_scc.audit.http_request.protocol | Protocol used for the request. | keyword | +| google_scc.audit.http_request.referer | The referer URL of the request. | keyword | +| google_scc.audit.http_request.remote.ip | The IP address (IPv4 or IPv6) of the client that issued the HTTP request. | ip | +| google_scc.audit.http_request.remote.port | The Port of the client that issued the HTTP request. | long | +| google_scc.audit.http_request.request_method | The request method. | keyword | +| google_scc.audit.http_request.request_size | The size of the HTTP request message in bytes, including the request headers and the request body. | long | +| google_scc.audit.http_request.request_url | The scheme (http, https), the host name, the path and the query portion of the URL that was requested. | keyword | +| google_scc.audit.http_request.response_size | The size of the HTTP response message sent back to the client, in bytes, including the response headers and the response body. | long | +| google_scc.audit.http_request.server.ip | The IP address (IPv4 or IPv6) of the origin server that the request was sent to. This field can include port information. | ip | +| google_scc.audit.http_request.server.port | The Port of the origin server that the request was sent to. | long | +| google_scc.audit.http_request.status | The response code indicating the status of response. | long | +| google_scc.audit.http_request.user_agent | The user agent sent by the client. | keyword | +| google_scc.audit.insert_id | A unique identifier for the log entry. | keyword | +| google_scc.audit.labels | A map of key, value pairs that provides additional information about the log entry. The labels can be user-defined or system-defined. | object | +| google_scc.audit.log_name | The resource name of the log to which this log entry belongs. | keyword | +| google_scc.audit.operation.first | Set this to True if this is the first log entry in the operation. | boolean | +| google_scc.audit.operation.id | An arbitrary operation identifier. | keyword | +| google_scc.audit.operation.last | Set this to True if this is the last log entry in the operation. | boolean | +| google_scc.audit.operation.producer | An arbitrary producer identifier. | keyword | +| google_scc.audit.proto_payload.authentication_info.authority_selector | The authority selector specified by the requestor, if any. It is not guaranteed that the principal was allowed to use this authority. | keyword | +| google_scc.audit.proto_payload.authentication_info.principal_email | The email address of the authenticated user (or service account on behalf of third party principal) making the request. | keyword | +| google_scc.audit.proto_payload.authentication_info.principal_subject | String representation of identity of requesting party. Populated for both first and third party identities. | keyword | +| google_scc.audit.proto_payload.authentication_info.service_account_delegation_info.first_party_principal.email | The email address of a Google account. | keyword | +| google_scc.audit.proto_payload.authentication_info.service_account_delegation_info.first_party_principal.service_metadata | Metadata about the service that uses the service account. | object | +| google_scc.audit.proto_payload.authentication_info.service_account_delegation_info.principal_subject | A string representing the principalSubject associated with the identity. | keyword | +| google_scc.audit.proto_payload.authentication_info.service_account_delegation_info.third_party_principal.claims | Metadata about third party identity. | object | +| google_scc.audit.proto_payload.authentication_info.service_account_key_name | The name of the service account key used to create or exchange credentials for authenticating the service account making the request. This is a scheme-less URI full resource name. | keyword | +| google_scc.audit.proto_payload.authentication_info.third_party_principal | The third party identification (if any) of the authenticated user making the request. | flattened | +| google_scc.audit.proto_payload.authorization_info.granted | Whether or not authorization for resource and permission was granted. | boolean | +| google_scc.audit.proto_payload.authorization_info.permission | The required IAM permission. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource | The resource being accessed, as a REST-style or cloud resource string. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.annotations | Annotations is an unstructured key-value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. | flattened | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.create_time | The timestamp when the resource was created. | date | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.delete_time | The timestamp when the resource was last deleted. | date | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.display_name | The display name set by clients. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.etag | An opaque value that uniquely identifies a version or generation of a resource. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.labels | The labels or tags on the resource, such as AWS resource tags and Kubernetes resource labels. | object | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.location | The location of the resource. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.name | The stable identifier (name) of a resource on the service. A resource can be logically identified as "//\{resource.service\}/\{resource.name\}". | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.service | The name of the service that this resource belongs to, such as pubsub.googleapis.com. The service may be different from the DNS hostname that actually serves the request. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.type | The type of the resource. The syntax is platform-specific because different platforms define their resources differently. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.uid | The unique identifier of the resource. | keyword | +| google_scc.audit.proto_payload.authorization_info.resource_attributes.update_time | The timestamp when the resource was last updated. | date | +| google_scc.audit.proto_payload.metadata | Other service-specific data about the request, response, and other information associated with the current audited event. | object | +| google_scc.audit.proto_payload.method_name | The name of the service method or operation. For API calls, this should be the name of the API method. | keyword | +| google_scc.audit.proto_payload.num_response_items | The number of items returned from a List or Query API method, if applicable. | long | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.payload | Resource payload that is currently in scope and is subjected to orgpolicy conditions. | flattened | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.resource.tags | Tags referenced on the resource at the time of evaluation. | object | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.resource.type | Resource type that the orgpolicy is checked against. | keyword | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.checked_value | Value that is being checked for the policy. | keyword | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.constraint | Constraint name. | keyword | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.error_message | Error message that policy is indicating. | keyword | +| google_scc.audit.proto_payload.policy_violation_info.org_policy_violation_info.violation_info.policy_type | Indicates the type of the policy. | keyword | +| google_scc.audit.proto_payload.request | The operation request. | flattened | +| google_scc.audit.proto_payload.request_metadata.caller.ip | The IP address of the caller. | ip | +| google_scc.audit.proto_payload.request_metadata.caller.ip_value | | keyword | +| google_scc.audit.proto_payload.request_metadata.caller.network | The network of the caller. | keyword | +| google_scc.audit.proto_payload.request_metadata.caller.supplied_user_agent | The user agent of the caller. | keyword | +| google_scc.audit.proto_payload.request_metadata.destination_attributes.ip | The IP address of the peer. | ip | +| google_scc.audit.proto_payload.request_metadata.destination_attributes.labels | The labels associated with the peer. | object | +| google_scc.audit.proto_payload.request_metadata.destination_attributes.port | The network port of the peer. | long | +| google_scc.audit.proto_payload.request_metadata.destination_attributes.principal | The identity of this peer. | keyword | +| google_scc.audit.proto_payload.request_metadata.destination_attributes.region_code | The CLDR country/region code associated with the above IP address. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.auth.access_levels | A list of access level resource names that allow resources to be accessed by authenticated requester. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.auth.audiences | The intended audience(s) for this authentication information. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.auth.claims | Structured claims presented with the credential. | flattened | +| google_scc.audit.proto_payload.request_metadata.request_attributes.auth.presenter | The authorized presenter of the credential. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.auth.principal | The authenticated principal. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.headers | The HTTP request headers. | flattened | +| google_scc.audit.proto_payload.request_metadata.request_attributes.host | The HTTP request Host header value. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.id | The unique ID for a request, which can be propagated to downstream systems. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.method | The HTTP request method, such as GET, POST. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.path | The HTTP URL path, excluding the query parameters. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.protocol | The network protocol used with the request, such as "http/1.1", "spdy/3", "h2", "h2c", "webrtc", "tcp", "udp", "quic". | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.query | The HTTP URL query in the format of name1=value1&name2=value2, as it appears in the first line of the HTTP request. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.reason | A special parameter for request reason. It is used by security systems to associate auditing information with a request. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.schema | The HTTP URL scheme, such as http and https. | keyword | +| google_scc.audit.proto_payload.request_metadata.request_attributes.size | The HTTP request size in bytes. | long | +| google_scc.audit.proto_payload.request_metadata.request_attributes.time | The timestamp when the destination service receives the last byte of the request. | date | +| google_scc.audit.proto_payload.resource_location.current_locations | The locations of a resource after the execution of the operation. | keyword | +| google_scc.audit.proto_payload.resource_location.original_locations | The locations of a resource prior to the execution of the operation. | keyword | +| google_scc.audit.proto_payload.resource_name | The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. | keyword | +| google_scc.audit.proto_payload.resource_original_state | The resource's original state before mutation. | flattened | +| google_scc.audit.proto_payload.response | The operation response. | flattened | +| google_scc.audit.proto_payload.service_data | Other service-specific data about the request, response, and other activities. | object | +| google_scc.audit.proto_payload.service_name | The name of the API service performing the operation. | keyword | +| google_scc.audit.proto_payload.status.code | The status code, which should be an enum value of google.rpc.Code. | long | +| google_scc.audit.proto_payload.status.details | A list of messages that carry the error details. | nested | +| google_scc.audit.proto_payload.status.message | A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client. | keyword | +| google_scc.audit.proto_payload.type | | keyword | +| google_scc.audit.receive_timestamp | The time the log entry was received by Logging. | date | +| google_scc.audit.resource.labels | Values for all of the labels listed in the associated monitored resource descriptor. | object | +| google_scc.audit.resource.type | The monitored resource type. | keyword | +| google_scc.audit.severity.code | The severity of the log entry. | long | +| google_scc.audit.severity.value | The severity of the log entry. | keyword | +| google_scc.audit.source_location.file | Source file name. Depending on the runtime environment, this might be a simple name or a fully-qualified name. | keyword | +| google_scc.audit.source_location.function | Human-readable name of the function or method being invoked, with optional context such as the class or package name. | keyword | +| google_scc.audit.source_location.line | Line within the source file. 1-based; 0 indicates no line number available. | long | +| google_scc.audit.span_id | The ID of the Cloud Trace span associated with the current operation in which the log is being written. | keyword | +| google_scc.audit.split.index | The index of this LogEntry in the sequence of split log entries. Log entries are given |index| values 0, 1, ..., n-1 for a sequence of n log entries. | long | +| google_scc.audit.split.total_splits | The total number of log entries that the original LogEntry was split into. | long | +| google_scc.audit.split.uid | A globally unique identifier for all log entries in a sequence of split log entries. All log entries with the same |LogSplit.uid| are assumed to be part of the same sequence of split log entries. | keyword | +| google_scc.audit.timestamp | The time the event described by the log entry occurred. | date | +| google_scc.audit.trace | The REST resource name of the trace being written to Cloud Trace in association with this log entry. | keyword | +| google_scc.audit.trace_sampled | The sampling decision of the trace associated with the log entry. | boolean | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | diff --git a/packages/google_scc/img/google-scc-asset-screenshot.png b/packages/google_scc/img/google-scc-asset-screenshot.png new file mode 100644 index 00000000000..b7c91ed232c Binary files /dev/null and b/packages/google_scc/img/google-scc-asset-screenshot.png differ diff --git a/packages/google_scc/img/google-scc-audit-screenshot.png b/packages/google_scc/img/google-scc-audit-screenshot.png new file mode 100644 index 00000000000..ef47e50d1a6 Binary files /dev/null and b/packages/google_scc/img/google-scc-audit-screenshot.png differ diff --git a/packages/google_scc/img/google-scc-finding-screenshot.png b/packages/google_scc/img/google-scc-finding-screenshot.png new file mode 100644 index 00000000000..b0cb8cc003a Binary files /dev/null and b/packages/google_scc/img/google-scc-finding-screenshot.png differ diff --git a/packages/google_scc/img/google-scc-logo.svg b/packages/google_scc/img/google-scc-logo.svg new file mode 100644 index 00000000000..95b25eebf95 --- /dev/null +++ b/packages/google_scc/img/google-scc-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/google_scc/img/google-scc-overview-screenshot.png b/packages/google_scc/img/google-scc-overview-screenshot.png new file mode 100644 index 00000000000..fe729eccca5 Binary files /dev/null and b/packages/google_scc/img/google-scc-overview-screenshot.png differ diff --git a/packages/google_scc/img/google-scc-source-screenshot.png b/packages/google_scc/img/google-scc-source-screenshot.png new file mode 100644 index 00000000000..09e1a0f1fbb Binary files /dev/null and b/packages/google_scc/img/google-scc-source-screenshot.png differ diff --git a/packages/google_scc/kibana/dashboard/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/dashboard/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..1ffd7df8262 --- /dev/null +++ b/packages/google_scc/kibana/dashboard/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a.json @@ -0,0 +1,232 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ec946c5a-eace-4c73-b05e-4f965a8b4a5e\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ec946c5a-eace-4c73-b05e-4f965a8b4a5e\",\"fieldName\":\"organization.id\",\"title\":\"Organization Id\",\"enhancements\":{}}}}" + }, + "description": "Overview of Google SCC Source.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Google SCC** \n\n[Overview Dashboard](/app/dashboards#/view/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a) \n[Audit](/app/dashboards#/view/google_scc-47d98700-0878-11ee-8e98-37b34c549462) \n[Finding](/app/dashboards#/view/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a) \n[Asset](/app/dashboards#/view/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a) \n**[Source](/app/dashboards#/view/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a)** \n \n\n**Overview**\n\nThis dashboard shows a overview of source.\n\n\n\n[**Integration Page**](/app/integrations/detail/google_scc/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 15, + "i": "81a8537a-a78b-4032-a3c4-a88ca833d11c", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "81a8537a-a78b-4032-a3c4-a88ca833d11c", + "title": "Table of Contents", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0b588128-0606-4d82-816f-08c4df975833", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "313ca43a-cc9e-452b-b03b-842713353241", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0b588128-0606-4d82-816f-08c4df975833": { + "columnOrder": [ + "e521f086-89b5-42bf-abf9-0993805ee90b" + ], + "columns": { + "e521f086-89b5-42bf-abf9-0993805ee90b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Sources", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "313ca43a-cc9e-452b-b03b-842713353241", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.source" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.source" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "0b588128-0606-4d82-816f-08c4df975833", + "layerType": "data", + "metricAccessor": "e521f086-89b5-42bf-abf9-0993805ee90b", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 15, + "i": "dfd30ced-26eb-48cc-856d-429d2ec4b2ca", + "w": 11, + "x": 8, + "y": 0 + }, + "panelIndex": "dfd30ced-26eb-48cc-856d-429d2ec4b2ca", + "title": "Total Sources [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "7195e909-47c3-436c-99cd-5bb1277c2a5e", + "w": 29, + "x": 19, + "y": 0 + }, + "panelIndex": "7195e909-47c3-436c-99cd-5bb1277c2a5e", + "panelRefName": "panel_7195e909-47c3-436c-99cd-5bb1277c2a5e", + "type": "search", + "version": "8.8.0" + } + ], + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "timeFrom": "now-1h", + "timeRestore": true, + "timeTo": "now", + "title": "[Logs Google SCC] Source", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "dfd30ced-26eb-48cc-856d-429d2ec4b2ca:indexpattern-datasource-layer-0b588128-0606-4d82-816f-08c4df975833", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dfd30ced-26eb-48cc-856d-429d2ec4b2ca:313ca43a-cc9e-452b-b03b-842713353241", + "type": "index-pattern" + }, + { + "id": "google_scc-78724c60-05ff-11ee-af70-a35c241bca6a", + "name": "7195e909-47c3-436c-99cd-5bb1277c2a5e:panel_7195e909-47c3-436c-99cd-5bb1277c2a5e", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_ec946c5a-eace-4c73-b05e-4f965a8b4a5e:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.7.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/dashboard/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/dashboard/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..c209950fc2a --- /dev/null +++ b/packages/google_scc/kibana/dashboard/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a.json @@ -0,0 +1,1246 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"67763feb-aad1-4f6b-8b9f-d61b69ad3f39\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"67763feb-aad1-4f6b-8b9f-d61b69ad3f39\",\"fieldName\":\"google_scc.finding.class\",\"title\":\"Finding Class\",\"enhancements\":{}}},\"e803491f-d788-48f7-883e-c057653d0511\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"e803491f-d788-48f7-883e-c057653d0511\",\"fieldName\":\"organization.id\",\"title\":\"Organization Id\",\"enhancements\":{}}},\"886defc7-d5d7-4262-80bb-8b19131db6f0\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"886defc7-d5d7-4262-80bb-8b19131db6f0\",\"fieldName\":\"google_scc.finding.severity\",\"title\":\"Severity\",\"enhancements\":{}}},\"22a135ba-6405-4589-abe0-570e73eae4b2\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"22a135ba-6405-4589-abe0-570e73eae4b2\",\"fieldName\":\"google_scc.finding.category\",\"title\":\"Category\",\"enhancements\":{}}},\"357d6c0b-3dfe-4aad-a295-6ec3e8de8ce2\":{\"type\":\"optionsListControl\",\"order\":4,\"grow\":true,\"width\":\"small\",\"explicitInput\":{\"id\":\"357d6c0b-3dfe-4aad-a295-6ec3e8de8ce2\",\"fieldName\":\"google_scc.finding.resource.name\",\"title\":\"Resource Name\",\"enhancements\":{}}}}" + }, + "description": "Overview of Google SCC Finding.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Google SCC** \n\n[Overview Dashboard](/app/dashboards#/view/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a) \n[Audit](/app/dashboards#/view/google_scc-47d98700-0878-11ee-8e98-37b34c549462) \n**[Finding](/app/dashboards#/view/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a)** \n[Asset](/app/dashboards#/view/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a) \n[Source](/app/dashboards#/view/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a) \n \n\n**Overview**\n\nThis dashboard shows a overview of findings.\n\n\n\n[**Integration Page**](/app/integrations/detail/google_scc/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 45, + "i": "fefacbc6-a7bf-4c56-ac87-f55ec7469a5c", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "fefacbc6-a7bf-4c56-ac87-f55ec7469a5c", + "title": "Table of Contents", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-33b22684-ae01-44bb-9c3e-c7d6a8538584", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "646e4482-4694-463d-a108-0cd7c3332eb2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "33b22684-ae01-44bb-9c3e-c7d6a8538584": { + "columnOrder": [ + "40a7b519-3beb-4fdb-9e0d-08a2e1a3f4d6" + ], + "columns": { + "40a7b519-3beb-4fdb-9e0d-08a2e1a3f4d6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Findings", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "646e4482-4694-463d-a108-0cd7c3332eb2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "33b22684-ae01-44bb-9c3e-c7d6a8538584", + "layerType": "data", + "metricAccessor": "40a7b519-3beb-4fdb-9e0d-08a2e1a3f4d6" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 15, + "i": "042291b8-3e68-4279-a4c6-2e7fd48515ae", + "w": 12, + "x": 8, + "y": 0 + }, + "panelIndex": "042291b8-3e68-4279-a4c6-2e7fd48515ae", + "title": "Total Findings [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5cf6558b-071a-496d-bd2e-e84b231a2855", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bff474b3-c123-4d16-9e8a-e582b60e4339", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5cf6558b-071a-496d-bd2e-e84b231a2855": { + "columnOrder": [ + "3eb3b485-6755-4600-8127-a863c766696e", + "a0afbba3-c1fd-4616-a323-5fc2752c22cc" + ], + "columns": { + "3eb3b485-6755-4600-8127-a863c766696e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a0afbba3-c1fd-4616-a323-5fc2752c22cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + }, + "a0afbba3-c1fd-4616-a323-5fc2752c22cc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bff474b3-c123-4d16-9e8a-e582b60e4339", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "5cf6558b-071a-496d-bd2e-e84b231a2855", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "a0afbba3-c1fd-4616-a323-5fc2752c22cc" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "3eb3b485-6755-4600-8127-a863c766696e" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "eda7d656-b3f9-4b9c-8b0e-a320bd9a6b63", + "w": 14, + "x": 20, + "y": 0 + }, + "panelIndex": "eda7d656-b3f9-4b9c-8b0e-a320bd9a6b63", + "title": "Distribution of Finding by Severity [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c4775ae1-cba7-413c-bead-c549182c37d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "df1a5ceb-13f7-4800-82a7-c62398887b83", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c4775ae1-cba7-413c-bead-c549182c37d1": { + "columnOrder": [ + "d4898be5-bde5-41c8-a2bf-0716c2d7b245", + "4e6d3151-74b3-4214-b8a6-e3e4a6a6b80a" + ], + "columns": { + "4e6d3151-74b3-4214-b8a6-e3e4a6a6b80a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d4898be5-bde5-41c8-a2bf-0716c2d7b245": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "State", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4e6d3151-74b3-4214-b8a6-e3e4a6a6b80a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.state" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "df1a5ceb-13f7-4800-82a7-c62398887b83", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c4775ae1-cba7-413c-bead-c549182c37d1", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "4e6d3151-74b3-4214-b8a6-e3e4a6a6b80a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d4898be5-bde5-41c8-a2bf-0716c2d7b245" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e180636d-78cc-4888-8a6b-6f71e7dddecf", + "w": 14, + "x": 34, + "y": 0 + }, + "panelIndex": "e180636d-78cc-4888-8a6b-6f71e7dddecf", + "title": "Distribution of Finding by State [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-56f270c0-848f-4b3f-8737-4741d15f19dc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "70e57c92-1b5d-4eaa-89e7-613d7da36e5f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "56f270c0-848f-4b3f-8737-4741d15f19dc": { + "columnOrder": [ + "c5686d0f-aed9-44cf-8a07-fe81bb6cbcce", + "cf7f81cd-adf8-4dd1-8185-4f998c13615c" + ], + "columns": { + "c5686d0f-aed9-44cf-8a07-fe81bb6cbcce": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Mute State", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cf7f81cd-adf8-4dd1-8185-4f998c13615c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.mute.state" + }, + "cf7f81cd-adf8-4dd1-8185-4f998c13615c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "70e57c92-1b5d-4eaa-89e7-613d7da36e5f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "56f270c0-848f-4b3f-8737-4741d15f19dc", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "cf7f81cd-adf8-4dd1-8185-4f998c13615c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "c5686d0f-aed9-44cf-8a07-fe81bb6cbcce" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "546784d8-13eb-40ca-a869-bafe57c8c707", + "w": 19, + "x": 8, + "y": 15 + }, + "panelIndex": "546784d8-13eb-40ca-a869-bafe57c8c707", + "title": "Distribution of Finding by Mute State [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e062e915-3888-4b9c-8449-1eb226ccc64a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00c44389-6992-4572-9391-0b2f868055e4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e062e915-3888-4b9c-8449-1eb226ccc64a": { + "columnOrder": [ + "73532dd9-278c-4ece-9d04-b86c7b31bd2e", + "73b071b5-6fa3-409e-a8e6-166fb01e4d79" + ], + "columns": { + "73532dd9-278c-4ece-9d04-b86c7b31bd2e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Tactic", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "73b071b5-6fa3-409e-a8e6-166fb01e4d79", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.tactic.name" + }, + "73b071b5-6fa3-409e-a8e6-166fb01e4d79": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "00c44389-6992-4572-9391-0b2f868055e4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "73b071b5-6fa3-409e-a8e6-166fb01e4d79" + ], + "layerId": "e062e915-3888-4b9c-8449-1eb226ccc64a", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "73532dd9-278c-4ece-9d04-b86c7b31bd2e" + } + ], + "legend": { + "isVisible": false, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c6b63a5a-5e7a-49c7-939f-8d0176fc9777", + "w": 21, + "x": 27, + "y": 15 + }, + "panelIndex": "c6b63a5a-5e7a-49c7-939f-8d0176fc9777", + "title": "Distribution of Finding by Threat Tactic [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ba19cbc1-d8da-4aca-afbd-16d0fcd3f31d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "79b64ce4-fa75-41d3-8f93-1ab822076a3d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ba19cbc1-d8da-4aca-afbd-16d0fcd3f31d": { + "columnOrder": [ + "5d990257-84f6-4a24-924c-339d0b362525", + "2143f6f1-e8d0-47d5-a41d-95a29da5e654" + ], + "columns": { + "2143f6f1-e8d0-47d5-a41d-95a29da5e654": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5d990257-84f6-4a24-924c-339d0b362525": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Technique", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2143f6f1-e8d0-47d5-a41d-95a29da5e654", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "79b64ce4-fa75-41d3-8f93-1ab822076a3d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2143f6f1-e8d0-47d5-a41d-95a29da5e654" + ], + "layerId": "ba19cbc1-d8da-4aca-afbd-16d0fcd3f31d", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "5d990257-84f6-4a24-924c-339d0b362525" + } + ], + "legend": { + "isVisible": false, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c1a9633d-7f61-431a-9c2d-7d1260e7e6d4", + "w": 19, + "x": 8, + "y": 30 + }, + "panelIndex": "c1a9633d-7f61-431a-9c2d-7d1260e7e6d4", + "title": "Distribution of Finding by Threat Technique [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-04ca3957-954e-4e81-96b6-d04b2bd13f96", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "915c5144-6d74-4df7-91dd-cd5af946ed0a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "04ca3957-954e-4e81-96b6-d04b2bd13f96": { + "columnOrder": [ + "7ef27664-1118-4915-96ab-539f79e4ced1", + "f225f9ba-921d-4231-9100-59aa2e0c5a3f" + ], + "columns": { + "7ef27664-1118-4915-96ab-539f79e4ced1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "accuracyMode": true, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f225f9ba-921d-4231-9100-59aa2e0c5a3f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.category" + }, + "f225f9ba-921d-4231-9100-59aa2e0c5a3f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "915c5144-6d74-4df7-91dd-cd5af946ed0a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7ef27664-1118-4915-96ab-539f79e4ced1" + }, + { + "columnId": "f225f9ba-921d-4231-9100-59aa2e0c5a3f" + } + ], + "layerId": "04ca3957-954e-4e81-96b6-d04b2bd13f96", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3691946b-95de-4133-bb21-421d851c4fd4", + "w": 21, + "x": 27, + "y": 30 + }, + "panelIndex": "3691946b-95de-4133-bb21-421d851c4fd4", + "title": "Top 10 Categories [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "96e21412-d687-4454-999b-a8d57b069a8a", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "96e21412-d687-4454-999b-a8d57b069a8a", + "panelRefName": "panel_96e21412-d687-4454-999b-a8d57b069a8a", + "type": "search", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Logs Google SCC] Finding", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T13:37:19.332Z", + "id": "google_scc-1216f720-05f7-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "042291b8-3e68-4279-a4c6-2e7fd48515ae:indexpattern-datasource-layer-33b22684-ae01-44bb-9c3e-c7d6a8538584", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "042291b8-3e68-4279-a4c6-2e7fd48515ae:646e4482-4694-463d-a108-0cd7c3332eb2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eda7d656-b3f9-4b9c-8b0e-a320bd9a6b63:indexpattern-datasource-layer-5cf6558b-071a-496d-bd2e-e84b231a2855", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eda7d656-b3f9-4b9c-8b0e-a320bd9a6b63:bff474b3-c123-4d16-9e8a-e582b60e4339", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e180636d-78cc-4888-8a6b-6f71e7dddecf:indexpattern-datasource-layer-c4775ae1-cba7-413c-bead-c549182c37d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e180636d-78cc-4888-8a6b-6f71e7dddecf:df1a5ceb-13f7-4800-82a7-c62398887b83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "546784d8-13eb-40ca-a869-bafe57c8c707:indexpattern-datasource-layer-56f270c0-848f-4b3f-8737-4741d15f19dc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "546784d8-13eb-40ca-a869-bafe57c8c707:70e57c92-1b5d-4eaa-89e7-613d7da36e5f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c6b63a5a-5e7a-49c7-939f-8d0176fc9777:indexpattern-datasource-layer-e062e915-3888-4b9c-8449-1eb226ccc64a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c6b63a5a-5e7a-49c7-939f-8d0176fc9777:00c44389-6992-4572-9391-0b2f868055e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c1a9633d-7f61-431a-9c2d-7d1260e7e6d4:indexpattern-datasource-layer-ba19cbc1-d8da-4aca-afbd-16d0fcd3f31d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c1a9633d-7f61-431a-9c2d-7d1260e7e6d4:79b64ce4-fa75-41d3-8f93-1ab822076a3d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3691946b-95de-4133-bb21-421d851c4fd4:indexpattern-datasource-layer-04ca3957-954e-4e81-96b6-d04b2bd13f96", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3691946b-95de-4133-bb21-421d851c4fd4:915c5144-6d74-4df7-91dd-cd5af946ed0a", + "type": "index-pattern" + }, + { + "id": "google_scc-d7d33900-05f3-11ee-af70-a35c241bca6a", + "name": "96e21412-d687-4454-999b-a8d57b069a8a:panel_96e21412-d687-4454-999b-a8d57b069a8a", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_67763feb-aad1-4f6b-8b9f-d61b69ad3f39:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e803491f-d788-48f7-883e-c057653d0511:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_886defc7-d5d7-4262-80bb-8b19131db6f0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_22a135ba-6405-4589-abe0-570e73eae4b2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_357d6c0b-3dfe-4aad-a295-6ec3e8de8ce2:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.7.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/dashboard/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/dashboard/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..1f92cd6458e --- /dev/null +++ b/packages/google_scc/kibana/dashboard/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a.json @@ -0,0 +1,237 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"cd536b24-0b08-47cc-befc-6f9ce86cc316\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"cd536b24-0b08-47cc-befc-6f9ce86cc316\",\"fieldName\":\"host.name\",\"title\":\"Asset Name\",\"enhancements\":{}}},\"3d914083-0a39-4471-bfd9-7dca39769fc7\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"3d914083-0a39-4471-bfd9-7dca39769fc7\",\"fieldName\":\"host.type\",\"title\":\"Asset Type\",\"enhancements\":{}}}}" + }, + "description": "Overview of Google SCC Asset.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Google SCC** \n\n[Overview Dashboard](/app/dashboards#/view/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a) \n[Audit](/app/dashboards#/view/google_scc-47d98700-0878-11ee-8e98-37b34c549462) \n[Finding](/app/dashboards#/view/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a) \n**[Asset](/app/dashboards#/view/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a)** \n[Source](/app/dashboards#/view/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a) \n \n\n**Overview**\n\nThis dashboard shows a overview of asset.\n\n\n\n[**Integration Page**](/app/integrations/detail/google_scc/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 15, + "i": "35d30d4a-c823-458b-9bfe-ac1d2fa59cfc", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "35d30d4a-c823-458b-9bfe-ac1d2fa59cfc", + "title": "Table of Contents", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-43a53a3a-e50b-4c29-a491-93536e6f69de", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da625311-6789-48af-8acf-789898c412c8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "43a53a3a-e50b-4c29-a491-93536e6f69de": { + "columnOrder": [ + "679f617f-4c75-4168-9733-944f6c75e0a1" + ], + "columns": { + "679f617f-4c75-4168-9733-944f6c75e0a1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Assets", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "da625311-6789-48af-8acf-789898c412c8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.asset" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.asset" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "43a53a3a-e50b-4c29-a491-93536e6f69de", + "layerType": "data", + "metricAccessor": "679f617f-4c75-4168-9733-944f6c75e0a1" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 15, + "i": "3779a4ed-d61d-4e67-a4ac-221b97da5197", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "3779a4ed-d61d-4e67-a4ac-221b97da5197", + "title": "Total Assets [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "753a580f-3848-460a-ab6e-4cf3f39602d0", + "w": 32, + "x": 16, + "y": 0 + }, + "panelIndex": "753a580f-3848-460a-ab6e-4cf3f39602d0", + "panelRefName": "panel_753a580f-3848-460a-ab6e-4cf3f39602d0", + "type": "search", + "version": "8.8.0" + } + ], + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "timeFrom": "now-1h", + "timeRestore": true, + "timeTo": "now", + "title": "[Logs Google SCC] Asset", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "3779a4ed-d61d-4e67-a4ac-221b97da5197:indexpattern-datasource-layer-43a53a3a-e50b-4c29-a491-93536e6f69de", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3779a4ed-d61d-4e67-a4ac-221b97da5197:da625311-6789-48af-8acf-789898c412c8", + "type": "index-pattern" + }, + { + "id": "google_scc-96641630-05e7-11ee-af70-a35c241bca6a", + "name": "753a580f-3848-460a-ab6e-4cf3f39602d0:panel_753a580f-3848-460a-ab6e-4cf3f39602d0", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_cd536b24-0b08-47cc-befc-6f9ce86cc316:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_3d914083-0a39-4471-bfd9-7dca39769fc7:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.7.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/dashboard/google_scc-47d98700-0878-11ee-8e98-37b34c549462.json b/packages/google_scc/kibana/dashboard/google_scc-47d98700-0878-11ee-8e98-37b34c549462.json new file mode 100644 index 00000000000..d6d7a022f74 --- /dev/null +++ b/packages/google_scc/kibana/dashboard/google_scc-47d98700-0878-11ee-8e98-37b34c549462.json @@ -0,0 +1,556 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"92a7bda8-fc3f-45db-ae81-f3a453f3a3b2\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"92a7bda8-fc3f-45db-ae81-f3a453f3a3b2\",\"fieldName\":\"log.level\",\"title\":\"Severity\",\"enhancements\":{}}},\"c1549c83-a9db-49b9-924d-780bb563ab74\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c1549c83-a9db-49b9-924d-780bb563ab74\",\"fieldName\":\"google_scc.audit.log_name\",\"title\":\"Log Type\",\"enhancements\":{}}},\"75bd558b-44f6-417c-a541-2378fd81394d\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"75bd558b-44f6-417c-a541-2378fd81394d\",\"fieldName\":\"google_scc.audit.resource.type\",\"title\":\"Resource Type\",\"enhancements\":{}}}}" + }, + "description": "Overview of Google SCC Audit.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Google SCC** \n\n[Overview Dashboard](/app/dashboards#/view/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a) \n**[Audit](/app/dashboards#/view/google_scc-47d98700-0878-11ee-8e98-37b34c549462)** \n[Finding](/app/dashboards#/view/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a) \n[Asset](/app/dashboards#/view/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a) \n[Source](/app/dashboards#/view/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a) \n \n\n**Overview**\n\nThis dashboard shows a overview of audit.\n\n\n\n[**Integration Page**](/app/integrations/detail/google_scc/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 15, + "i": "04070abc-05e0-459b-9d64-7b55b6781711", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "04070abc-05e0-459b-9d64-7b55b6781711", + "title": "Table of Contents", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a9a0456e-01cc-4bf2-a164-43d2863d18eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f29be650-bc81-4e3c-8136-584c30c3bf31", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a9a0456e-01cc-4bf2-a164-43d2863d18eb": { + "columnOrder": [ + "5ea749d8-3a02-4106-9f10-d6890795432a" + ], + "columns": { + "5ea749d8-3a02-4106-9f10-d6890795432a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Audit", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f29be650-bc81-4e3c-8136-584c30c3bf31", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "a9a0456e-01cc-4bf2-a164-43d2863d18eb", + "layerType": "data", + "metricAccessor": "5ea749d8-3a02-4106-9f10-d6890795432a" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 15, + "i": "b2e9dc3e-afd5-4aef-ac5e-84fb914449ca", + "w": 10, + "x": 10, + "y": 0 + }, + "panelIndex": "b2e9dc3e-afd5-4aef-ac5e-84fb914449ca", + "title": "Total Audit Logs [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6e707044-4211-4a4e-82c0-333b6cee6c57", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67e550a9-f2a7-4ed8-9f66-378073a915f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6e707044-4211-4a4e-82c0-333b6cee6c57": { + "columnOrder": [ + "bda9d8fe-595e-46ea-89d2-cb0e5c0775cb", + "9e3baf99-043f-4690-b885-afae993487b8" + ], + "columns": { + "9e3baf99-043f-4690-b885-afae993487b8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "bda9d8fe-595e-46ea-89d2-cb0e5c0775cb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9e3baf99-043f-4690-b885-afae993487b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "67e550a9-f2a7-4ed8-9f66-378073a915f8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "6e707044-4211-4a4e-82c0-333b6cee6c57", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "9e3baf99-043f-4690-b885-afae993487b8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "bda9d8fe-595e-46ea-89d2-cb0e5c0775cb" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cac65b2b-c5fe-4489-bfcb-d1a3938c5596", + "w": 14, + "x": 20, + "y": 0 + }, + "panelIndex": "cac65b2b-c5fe-4489-bfcb-d1a3938c5596", + "title": "Distribution of Audit Logs by Severity [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c4478c34-2bdf-4f2b-94bc-5b7021ab508a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7bc024bf-a6fa-4272-8f8a-24b96b93effa", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c4478c34-2bdf-4f2b-94bc-5b7021ab508a": { + "columnOrder": [ + "12633e7d-0c91-498d-afc3-bba1151aaa08", + "76efbbbd-b9a8-48d8-9029-f16068c5119c" + ], + "columns": { + "12633e7d-0c91-498d-afc3-bba1151aaa08": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resource Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "76efbbbd-b9a8-48d8-9029-f16068c5119c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.audit.resource.type" + }, + "76efbbbd-b9a8-48d8-9029-f16068c5119c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7bc024bf-a6fa-4272-8f8a-24b96b93effa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.audit" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c4478c34-2bdf-4f2b-94bc-5b7021ab508a", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "76efbbbd-b9a8-48d8-9029-f16068c5119c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "12633e7d-0c91-498d-afc3-bba1151aaa08" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3e54165b-8af3-4dca-9e1f-2c99048fc501", + "w": 14, + "x": 34, + "y": 0 + }, + "panelIndex": "3e54165b-8af3-4dca-9e1f-2c99048fc501", + "title": "Distribution of Audit Logs by Resource Type [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "c7a6fc07-6e9d-4967-87fd-017d2f8a5320", + "w": 48, + "x": 0, + "y": 15 + }, + "panelIndex": "c7a6fc07-6e9d-4967-87fd-017d2f8a5320", + "panelRefName": "panel_c7a6fc07-6e9d-4967-87fd-017d2f8a5320", + "type": "search", + "version": "8.8.0" + } + ], + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "timeFrom": "now-1y/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Logs Google SCC] Audit", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:15:40.448Z", + "id": "google_scc-47d98700-0878-11ee-8e98-37b34c549462", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "b2e9dc3e-afd5-4aef-ac5e-84fb914449ca:indexpattern-datasource-layer-a9a0456e-01cc-4bf2-a164-43d2863d18eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b2e9dc3e-afd5-4aef-ac5e-84fb914449ca:f29be650-bc81-4e3c-8136-584c30c3bf31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cac65b2b-c5fe-4489-bfcb-d1a3938c5596:indexpattern-datasource-layer-6e707044-4211-4a4e-82c0-333b6cee6c57", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cac65b2b-c5fe-4489-bfcb-d1a3938c5596:67e550a9-f2a7-4ed8-9f66-378073a915f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e54165b-8af3-4dca-9e1f-2c99048fc501:indexpattern-datasource-layer-c4478c34-2bdf-4f2b-94bc-5b7021ab508a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e54165b-8af3-4dca-9e1f-2c99048fc501:7bc024bf-a6fa-4272-8f8a-24b96b93effa", + "type": "index-pattern" + }, + { + "id": "google_scc-c57ada30-0876-11ee-8e98-37b34c549462", + "name": "c7a6fc07-6e9d-4967-87fd-017d2f8a5320:panel_c7a6fc07-6e9d-4967-87fd-017d2f8a5320", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_92a7bda8-fc3f-45db-ae81-f3a453f3a3b2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c1549c83-a9db-49b9-924d-780bb563ab74:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_75bd558b-44f6-417c-a541-2378fd81394d:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.7.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/dashboard/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/dashboard/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..b402c58a642 --- /dev/null +++ b/packages/google_scc/kibana/dashboard/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a.json @@ -0,0 +1,2141 @@ +{ + "attributes": { + "description": "Overview of Google Security Command Center.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Google SCC** \n\n**[Overview Dashboard](/app/dashboards#/view/google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a)** \n[Audit](/app/dashboards#/view/google_scc-47d98700-0878-11ee-8e98-37b34c549462) \n[Finding](/app/dashboards#/view/google_scc-1216f720-05f7-11ee-af70-a35c241bca6a) \n[Asset](/app/dashboards#/view/google_scc-279e2ae0-05e9-11ee-af70-a35c241bca6a) \n[Source](/app/dashboards#/view/google_scc-0d6620a0-05f4-11ee-af70-a35c241bca6a) \n \n\n**Overview**\n\nThis dashboard shows a overview of threat and vulnerability, top 10 assets and different finding class.\n\n\n\n[**Integration Page**](/app/integrations/detail/google_scc/overview)\n\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 75, + "i": "637468d9-c5c2-4215-8e31-cc706cf3b5d3", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "637468d9-c5c2-4215-8e31-cc706cf3b5d3", + "title": "Table of Contents", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f34514df-1e64-474d-8d78-9015107e6a1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7a755caf-3210-4b5a-b2dc-aa7364fb6a4e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c063250f-94f7-4801-b245-192637c38453", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f34514df-1e64-474d-8d78-9015107e6a1b": { + "columnOrder": [ + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4", + "013a31a5-7986-4854-9663-4666197d6efb" + ], + "columns": { + "013a31a5-7986-4854-9663-4666197d6efb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "013a31a5-7986-4854-9663-4666197d6efb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "7a755caf-3210-4b5a-b2dc-aa7364fb6a4e", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "VULNERABILITY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "VULNERABILITY" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c063250f-94f7-4801-b245-192637c38453", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "f34514df-1e64-474d-8d78-9015107e6a1b", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "013a31a5-7986-4854-9663-4666197d6efb" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "3f0d0184-402c-4bd0-bff2-f5e9c8473c7c", + "w": 20, + "x": 8, + "y": 0 + }, + "panelIndex": "3f0d0184-402c-4bd0-bff2-f5e9c8473c7c", + "title": "Distribution of Vulnerabilities by Severity [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f34514df-1e64-474d-8d78-9015107e6a1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b362aa2c-c6eb-44ae-a07e-a06f8f9088e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6fc4577c-6990-49bc-b361-17e0731dddb3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f34514df-1e64-474d-8d78-9015107e6a1b": { + "columnOrder": [ + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4", + "013a31a5-7986-4854-9663-4666197d6efb" + ], + "columns": { + "013a31a5-7986-4854-9663-4666197d6efb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "013a31a5-7986-4854-9663-4666197d6efb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "b362aa2c-c6eb-44ae-a07e-a06f8f9088e3", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "6fc4577c-6990-49bc-b361-17e0731dddb3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "f34514df-1e64-474d-8d78-9015107e6a1b", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "013a31a5-7986-4854-9663-4666197d6efb" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "47d796c8-bbed-4112-8cf4-1e7d0cacfda4" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "900e1b41-74b2-407f-b02e-6a5709a9f78e", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "900e1b41-74b2-407f-b02e-6a5709a9f78e", + "title": "Distribution of Threats by Severity [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2a627f98-307a-4a43-a31b-c1713f56a55c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a68a63c5-5213-4036-9c0a-f49d61a3ec3c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "212b890d-a562-4eb6-b6ae-058476da9629", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2a627f98-307a-4a43-a31b-c1713f56a55c": { + "columnOrder": [ + "5b3c5b6f-5737-4b84-a481-c4442a1349cf", + "132c334d-1d56-4e21-af30-704d24354085" + ], + "columns": { + "132c334d-1d56-4e21-af30-704d24354085": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Vulnerabilities", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5b3c5b6f-5737-4b84-a481-c4442a1349cf": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "a68a63c5-5213-4036-9c0a-f49d61a3ec3c", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "VULNERABILITY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "VULNERABILITY" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "212b890d-a562-4eb6-b6ae-058476da9629", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "132c334d-1d56-4e21-af30-704d24354085" + ], + "layerId": "2a627f98-307a-4a43-a31b-c1713f56a55c", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "5b3c5b6f-5737-4b84-a481-c4442a1349cf" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ee737cc7-0f0a-4bf1-a096-7ab168857a46", + "w": 20, + "x": 8, + "y": 15 + }, + "panelIndex": "ee737cc7-0f0a-4bf1-a096-7ab168857a46", + "title": "Vulnerabilities Over Time [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-46591297-6a15-4ac5-8cc8-42375c733a03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "75163b0b-6b83-4546-8666-b5570961510e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2837fb00-5aa5-4734-9af2-cd04d5fb86a5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "46591297-6a15-4ac5-8cc8-42375c733a03": { + "columnOrder": [ + "d57d4737-4fa6-4f23-9211-12fe213da73b", + "b866ad37-7398-4e62-955a-16233f780545" + ], + "columns": { + "b866ad37-7398-4e62-955a-16233f780545": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Threats", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d57d4737-4fa6-4f23-9211-12fe213da73b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "75163b0b-6b83-4546-8666-b5570961510e", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2837fb00-5aa5-4734-9af2-cd04d5fb86a5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "b866ad37-7398-4e62-955a-16233f780545" + ], + "layerId": "46591297-6a15-4ac5-8cc8-42375c733a03", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "d57d4737-4fa6-4f23-9211-12fe213da73b" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "51e9490c-9ec7-4584-824f-15d7cf2a7c76", + "w": 20, + "x": 28, + "y": 15 + }, + "panelIndex": "51e9490c-9ec7-4584-824f-15d7cf2a7c76", + "title": "Threats Over Time [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e5ce0d0d-5146-4820-b1b9-8b3e4a808645", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "890544c9-35e5-488a-b3e8-c815abbea4bf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0": { + "columnOrder": [ + "42b4402a-b5fa-47e0-a3a4-c48970e27254", + "df302724-c08d-40d3-928f-77116d770d50", + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "columns": { + "42b4402a-b5fa-47e0-a3a4-c48970e27254": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + }, + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "df302724-c08d-40d3-928f-77116d770d50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.category" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "e5ce0d0d-5146-4820-b1b9-8b3e4a808645", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "VULNERABILITY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "VULNERABILITY" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "890544c9-35e5-488a-b3e8-c815abbea4bf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "layerId": "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_percentage_stacked", + "showGridlines": false, + "splitAccessor": "df302724-c08d-40d3-928f-77116d770d50", + "xAccessor": "42b4402a-b5fa-47e0-a3a4-c48970e27254" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_percentage_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "57baa938-850f-4426-b004-7548b2c9d005", + "w": 20, + "x": 8, + "y": 30 + }, + "panelIndex": "57baa938-850f-4426-b004-7548b2c9d005", + "title": "Top 5 Categories by Severity for Vulnerabilities [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58f64d29-842e-47fc-aaa4-826b9430110e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50ffbbfb-4428-421e-94f9-315589709374", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0": { + "columnOrder": [ + "42b4402a-b5fa-47e0-a3a4-c48970e27254", + "df302724-c08d-40d3-928f-77116d770d50", + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "columns": { + "42b4402a-b5fa-47e0-a3a4-c48970e27254": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + }, + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "df302724-c08d-40d3-928f-77116d770d50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.category" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "58f64d29-842e-47fc-aaa4-826b9430110e", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "50ffbbfb-4428-421e-94f9-315589709374", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "layerId": "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_percentage_stacked", + "showGridlines": false, + "splitAccessor": "df302724-c08d-40d3-928f-77116d770d50", + "xAccessor": "42b4402a-b5fa-47e0-a3a4-c48970e27254" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_percentage_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7676ce4c-a7e6-4843-9adb-61af3c5dbfed", + "w": 20, + "x": 28, + "y": 30 + }, + "panelIndex": "7676ce4c-a7e6-4843-9adb-61af3c5dbfed", + "title": "Top 5 Categories by Severity for Threats [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9710836a-e190-4dce-a7bb-987d73d8aebb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a96e40f-7cf4-4263-a643-74cf0c7bf92f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0": { + "columnOrder": [ + "42b4402a-b5fa-47e0-a3a4-c48970e27254", + "df302724-c08d-40d3-928f-77116d770d50", + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "columns": { + "42b4402a-b5fa-47e0-a3a4-c48970e27254": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + }, + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "df302724-c08d-40d3-928f-77116d770d50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Project", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.resource.project.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "9710836a-e190-4dce-a7bb-987d73d8aebb", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "VULNERABILITY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "VULNERABILITY" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5a96e40f-7cf4-4263-a643-74cf0c7bf92f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "layerId": "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_percentage_stacked", + "showGridlines": false, + "splitAccessor": "df302724-c08d-40d3-928f-77116d770d50", + "xAccessor": "42b4402a-b5fa-47e0-a3a4-c48970e27254" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_percentage_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "54849140-8efe-46ee-81c3-6accea5aad75", + "w": 20, + "x": 8, + "y": 45 + }, + "panelIndex": "54849140-8efe-46ee-81c3-6accea5aad75", + "title": "Top 5 Projects by Severity for Vulnerabilities [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-702eedcf-6c36-4518-bca0-dd643faf1095", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e718c354-1213-4a7f-aa1f-1414df86b7e0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "702eedcf-6c36-4518-bca0-dd643faf1095": { + "columnOrder": [ + "50660fd9-0062-4e12-aa8a-6cd64af51648", + "0edcc462-48c6-4eda-b71e-2769384b3985" + ], + "columns": { + "0edcc462-48c6-4eda-b71e-2769384b3985": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "50660fd9-0062-4e12-aa8a-6cd64af51648": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Asset Type", + "operationType": "terms", + "params": { + "accuracyMode": true, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0edcc462-48c6-4eda-b71e-2769384b3985", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.type" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e718c354-1213-4a7f-aa1f-1414df86b7e0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.asset" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.asset" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "50660fd9-0062-4e12-aa8a-6cd64af51648" + }, + { + "columnId": "0edcc462-48c6-4eda-b71e-2769384b3985" + } + ], + "layerId": "702eedcf-6c36-4518-bca0-dd643faf1095", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "6dd32bfc-6f19-48e4-b2ca-a08ce9c5eba9", + "w": 20, + "x": 28, + "y": 60 + }, + "panelIndex": "6dd32bfc-6f19-48e4-b2ca-a08ce9c5eba9", + "title": "Top 10 Asset Type [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dcc87497-a982-45ae-b1a4-90772423fd27", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c130f2b0-1586-4068-8185-0543ee65b110", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0": { + "columnOrder": [ + "42b4402a-b5fa-47e0-a3a4-c48970e27254", + "df302724-c08d-40d3-928f-77116d770d50", + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "columns": { + "42b4402a-b5fa-47e0-a3a4-c48970e27254": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.severity" + }, + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "df302724-c08d-40d3-928f-77116d770d50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Project", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "782fe2c5-d6ee-4239-acee-7a02c6fffa1e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.resource.project.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "google_scc.finding.class", + "index": "dcc87497-a982-45ae-b1a4-90772423fd27", + "key": "google_scc.finding.class", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "google_scc.finding.class": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c130f2b0-1586-4068-8185-0543ee65b110", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "782fe2c5-d6ee-4239-acee-7a02c6fffa1e" + ], + "layerId": "d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_percentage_stacked", + "showGridlines": false, + "splitAccessor": "df302724-c08d-40d3-928f-77116d770d50", + "xAccessor": "42b4402a-b5fa-47e0-a3a4-c48970e27254" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_percentage_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show", + "yLeftExtent": { + "mode": "full", + "niceValues": true + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "d423badd-6233-4e45-bbb1-65027aee53e8", + "w": 20, + "x": 28, + "y": 45 + }, + "panelIndex": "d423badd-6233-4e45-bbb1-65027aee53e8", + "title": "Top 5 Projects by Severity for Threats [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-057c536a-eeb6-44f2-9f38-7c41d7d3b6b1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1547d46d-92b3-4125-9f93-738609bbdaec", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "057c536a-eeb6-44f2-9f38-7c41d7d3b6b1": { + "columnOrder": [ + "e794ab9c-e39c-4673-9503-18f5c47b0953", + "21ecf62b-66b9-4f01-9ccf-435bce1c8448" + ], + "columns": { + "21ecf62b-66b9-4f01-9ccf-435bce1c8448": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e794ab9c-e39c-4673-9503-18f5c47b0953": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Finding Class", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "21ecf62b-66b9-4f01-9ccf-435bce1c8448", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "google_scc.finding.class" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1547d46d-92b3-4125-9f93-738609bbdaec", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "057c536a-eeb6-44f2-9f38-7c41d7d3b6b1", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "21ecf62b-66b9-4f01-9ccf-435bce1c8448" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "e794ab9c-e39c-4673-9503-18f5c47b0953" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "789daaf2-58af-4a30-8764-2341cfbc2788", + "w": 20, + "x": 8, + "y": 60 + }, + "panelIndex": "789daaf2-58af-4a30-8764-2341cfbc2788", + "title": "Distribution of Finding by Class [Logs Google SCC]", + "type": "lens", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Logs Google SCC] Overview Dashboard", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-62ec9780-05c6-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "3f0d0184-402c-4bd0-bff2-f5e9c8473c7c:indexpattern-datasource-layer-f34514df-1e64-474d-8d78-9015107e6a1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3f0d0184-402c-4bd0-bff2-f5e9c8473c7c:7a755caf-3210-4b5a-b2dc-aa7364fb6a4e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3f0d0184-402c-4bd0-bff2-f5e9c8473c7c:c063250f-94f7-4801-b245-192637c38453", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "900e1b41-74b2-407f-b02e-6a5709a9f78e:indexpattern-datasource-layer-f34514df-1e64-474d-8d78-9015107e6a1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "900e1b41-74b2-407f-b02e-6a5709a9f78e:b362aa2c-c6eb-44ae-a07e-a06f8f9088e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "900e1b41-74b2-407f-b02e-6a5709a9f78e:6fc4577c-6990-49bc-b361-17e0731dddb3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee737cc7-0f0a-4bf1-a096-7ab168857a46:indexpattern-datasource-layer-2a627f98-307a-4a43-a31b-c1713f56a55c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee737cc7-0f0a-4bf1-a096-7ab168857a46:a68a63c5-5213-4036-9c0a-f49d61a3ec3c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee737cc7-0f0a-4bf1-a096-7ab168857a46:212b890d-a562-4eb6-b6ae-058476da9629", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51e9490c-9ec7-4584-824f-15d7cf2a7c76:indexpattern-datasource-layer-46591297-6a15-4ac5-8cc8-42375c733a03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51e9490c-9ec7-4584-824f-15d7cf2a7c76:75163b0b-6b83-4546-8666-b5570961510e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51e9490c-9ec7-4584-824f-15d7cf2a7c76:2837fb00-5aa5-4734-9af2-cd04d5fb86a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57baa938-850f-4426-b004-7548b2c9d005:indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57baa938-850f-4426-b004-7548b2c9d005:e5ce0d0d-5146-4820-b1b9-8b3e4a808645", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57baa938-850f-4426-b004-7548b2c9d005:890544c9-35e5-488a-b3e8-c815abbea4bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7676ce4c-a7e6-4843-9adb-61af3c5dbfed:indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7676ce4c-a7e6-4843-9adb-61af3c5dbfed:58f64d29-842e-47fc-aaa4-826b9430110e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7676ce4c-a7e6-4843-9adb-61af3c5dbfed:50ffbbfb-4428-421e-94f9-315589709374", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54849140-8efe-46ee-81c3-6accea5aad75:indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54849140-8efe-46ee-81c3-6accea5aad75:9710836a-e190-4dce-a7bb-987d73d8aebb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54849140-8efe-46ee-81c3-6accea5aad75:5a96e40f-7cf4-4263-a643-74cf0c7bf92f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6dd32bfc-6f19-48e4-b2ca-a08ce9c5eba9:indexpattern-datasource-layer-702eedcf-6c36-4518-bca0-dd643faf1095", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6dd32bfc-6f19-48e4-b2ca-a08ce9c5eba9:e718c354-1213-4a7f-aa1f-1414df86b7e0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d423badd-6233-4e45-bbb1-65027aee53e8:indexpattern-datasource-layer-d2b5b882-c73c-4c1f-b8a0-ead0ebf9f0b0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d423badd-6233-4e45-bbb1-65027aee53e8:dcc87497-a982-45ae-b1a4-90772423fd27", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d423badd-6233-4e45-bbb1-65027aee53e8:c130f2b0-1586-4068-8185-0543ee65b110", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "789daaf2-58af-4a30-8764-2341cfbc2788:indexpattern-datasource-layer-057c536a-eeb6-44f2-9f38-7c41d7d3b6b1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "789daaf2-58af-4a30-8764-2341cfbc2788:1547d46d-92b3-4125-9f93-738609bbdaec", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.7.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/search/google_scc-78724c60-05ff-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/search/google_scc-78724c60-05ff-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..9492570e2fc --- /dev/null +++ b/packages/google_scc/kibana/search/google_scc-78724c60-05ff-11ee-af70-a35c241bca6a.json @@ -0,0 +1,76 @@ +{ + "attributes": { + "columns": [ + "organization.id", + "google_scc.source.name", + "google_scc.source.display_name", + "message" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.source" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.source" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Source Essentials Details [Logs Google SCC]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-78724c60-05ff-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "search": "8.0.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/search/google_scc-96641630-05e7-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/search/google_scc-96641630-05e7-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..e34810e2159 --- /dev/null +++ b/packages/google_scc/kibana/search/google_scc-96641630-05e7-11ee-af70-a35c241bca6a.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "columns": [ + "google_scc.asset.update_time", + "host.name", + "host.type", + "google_scc.asset.iam_policy.bindings.members", + "google_scc.asset.resource.parent" + ], + "description": "", + "grid": { + "columns": { + "google_scc.asset.iam_policy.bindings.members": { + "width": 313 + }, + "google_scc.asset.resource.parent": { + "width": 234 + }, + "google_scc.asset.update_time": { + "width": 206 + }, + "google_scc.finding.parent": { + "width": 204 + }, + "host.name": { + "width": 88 + }, + "host.type": { + "width": 82 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.asset" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.asset" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Assets Essentials Details [Logs Google SCC]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-96641630-05e7-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "search": "8.0.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/search/google_scc-c57ada30-0876-11ee-8e98-37b34c549462.json b/packages/google_scc/kibana/search/google_scc-c57ada30-0876-11ee-8e98-37b34c549462.json new file mode 100644 index 00000000000..280c0822314 --- /dev/null +++ b/packages/google_scc/kibana/search/google_scc-c57ada30-0876-11ee-8e98-37b34c549462.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "columns": [ + "event.id", + "google_scc.audit.log_name", + "google_scc.audit.proto_payload.resource_name", + "google_scc.audit.resource.type", + "google_scc.audit.resource.labels.method", + "log.level", + "google_scc.audit.resource.labels.project_id" + ], + "description": "", + "grid": { + "columns": { + "event.id": { + "width": 111 + }, + "google_scc.audit.log_name": { + "width": 209 + }, + "google_scc.audit.proto_payload.resource_name": { + "width": 310 + }, + "google_scc.audit.resource.labels.method": { + "width": 271 + }, + "google_scc.audit.resource.labels.project_id": { + "width": 290 + }, + "google_scc.audit.resource.type": { + "width": 212 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.audit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.audit" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"google_scc.audit\" " + } + } + }, + "sort": [], + "timeRestore": false, + "title": "Audit Essentials Details [Logs Google SCC]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T12:00:39.792Z", + "id": "google_scc-c57ada30-0876-11ee-8e98-37b34c549462", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "search": "8.0.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/search/google_scc-d7d33900-05f3-11ee-af70-a35c241bca6a.json b/packages/google_scc/kibana/search/google_scc-d7d33900-05f3-11ee-af70-a35c241bca6a.json new file mode 100644 index 00000000000..fc94c60ec47 --- /dev/null +++ b/packages/google_scc/kibana/search/google_scc-d7d33900-05f3-11ee-af70-a35c241bca6a.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "columns": [ + "organization.id", + "google_scc.finding.name", + "google_scc.finding.category", + "google_scc.finding.class", + "google_scc.finding.severity", + "google_scc.finding.resource.project.name", + "event.created", + "google_scc.finding.security_marks.name", + "google_scc.finding.parent" + ], + "description": "", + "grid": { + "columns": { + "event.created": { + "width": 117 + }, + "google_scc.asset.resource.parent": { + "width": 130 + }, + "google_scc.finding.category": { + "width": 200 + }, + "google_scc.finding.class": { + "width": 180 + }, + "google_scc.finding.name": { + "width": 192 + }, + "google_scc.finding.parent": { + "width": 199 + }, + "google_scc.finding.resource.project.name": { + "width": 276 + }, + "google_scc.finding.security_marks.name": { + "width": 270 + }, + "google_scc.finding.severity": { + "width": 201 + }, + "organization.id": { + "width": 104 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_scc.finding" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "google_scc.finding" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Finding Essentials Details [Logs Google SCC]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-03T13:34:09.707Z", + "id": "google_scc-d7d33900-05f3-11ee-af70-a35c241bca6a", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "search": "8.0.0" + } +} \ No newline at end of file diff --git a/packages/google_scc/kibana/tags.yml b/packages/google_scc/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/google_scc/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/google_scc/manifest.yml b/packages/google_scc/manifest.yml new file mode 100644 index 00000000000..c31d9911586 --- /dev/null +++ b/packages/google_scc/manifest.yml @@ -0,0 +1,162 @@ +format_version: "3.0.0" +name: google_scc +title: Google Security Command Center +version: "0.5.0" +description: Collect logs from Google Security Command Center with Elastic Agent. +type: integration +categories: + - google_cloud + - security +conditions: + kibana: + version: ^8.8.0 + elastic: + subscription: basic +screenshots: + - src: /img/google-scc-overview-screenshot.png + title: Google SCC Overview Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/google-scc-asset-screenshot.png + title: Google SCC Asset Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/google-scc-audit-screenshot.png + title: Google SCC Audit Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/google-scc-finding-screenshot.png + title: Google SCC Finding Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/google-scc-source-screenshot.png + title: Google SCC Source Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/google-scc-logo.svg + title: Google SCC logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: google_scc + title: Google SCC logs + description: Collect logs from Google SCC. + inputs: + - type: httpjson + title: Collect Google SCC logs via API + description: Collecting Google SCC logs via API. + vars: + - name: credentials_type + type: select + title: Credentials Type + description: "Credentials Type of the Google SCC. Note: This is required field if not installed in GCP-Cloud Environment." + multi: false + options: + - value: credentials_file + text: Credentials File + - value: credentials_json + text: Credentials JSON + required: false + show_user: true + - name: credentials + type: password + title: Credentials JSON/File + multi: false + required: false + show_user: true + description: "Path to a JSON or JSON blob file containing the credentials and key used to subscribe. Note: This is required field if not installed in GCP-Cloud Environment." + - name: parent_type + type: select + title: Parent Type + description: Parent Type of the Google SCC. + multi: false + options: + - value: organizations + text: Organization + - value: projects + text: Project + - value: folders + text: Folder + required: true + show_user: true + - name: id + type: text + title: ID + description: ID of the selected parent type. + required: true + show_user: true + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- + - type: gcp-pubsub + title: Collect Google SCC logs via GCP Pub/Sub + description: Collecting Google SCC logs via GCP Pub/Sub. + vars: + - name: credentials_type + type: select + title: Credentials Type + description: Credentials Type of the Google SCC. + multi: false + options: + - value: credentials_file + text: Credentials File + - value: credentials_json + text: Credentials JSON + required: true + show_user: true + - name: credentials + type: password + title: Credentials JSON/File + multi: false + required: true + show_user: true + description: Path to a JSON or JSON blob file containing the credentials and key used to subscribe. + - name: project_id + type: text + title: Project ID + description: Project ID of the Google SCC. + required: true +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/google_workspace/_dev/build/build.yml b/packages/google_workspace/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/google_workspace/_dev/build/build.yml +++ b/packages/google_workspace/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/google_workspace/changelog.yml b/packages/google_workspace/changelog.yml index 51bb6594c97..761c3e708a5 100644 --- a/packages/google_workspace/changelog.yml +++ b/packages/google_workspace/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 2.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "2.12.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "2.11.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6914 - version: "2.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/google_workspace/data_stream/access_transparency/_dev/test/pipeline/test-access-transparency.log-expected.json b/packages/google_workspace/data_stream/access_transparency/_dev/test/pipeline/test-access-transparency.log-expected.json index 445f3b0cbbf..ca5d48a4828 100644 --- a/packages/google_workspace/data_stream/access_transparency/_dev/test/pipeline/test-access-transparency.log-expected.json +++ b/packages/google_workspace/data_stream/access_transparency/_dev/test/pipeline/test-access-transparency.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-01T06:24:42.442Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACCESS", diff --git a/packages/google_workspace/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml index 0baebf158d6..e75a7b8d9e3 100644 --- a/packages/google_workspace/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/access_transparency/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace access transparency logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/access_transparency/sample_event.json b/packages/google_workspace/data_stream/access_transparency/sample_event.json index 481887a8126..c50978ac70e 100644 --- a/packages/google_workspace/data_stream/access_transparency/sample_event.json +++ b/packages/google_workspace/data_stream/access_transparency/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log-expected.json index 7b966a09235..d55cc14cb04 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-application.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_APPLICATION_SETTING", @@ -103,7 +103,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_APPLICATION_SETTING", @@ -202,7 +202,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_APPLICATION_SETTING", @@ -301,7 +301,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REORDER_GROUP_BASED_POLICIES_EVENT", @@ -388,7 +388,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GPLUS_PREMIUM_FEATURES", @@ -467,7 +467,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_MANAGED_CONFIGURATION", @@ -545,7 +545,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_MANAGED_CONFIGURATION", @@ -623,7 +623,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_MANAGED_CONFIGURATION", @@ -702,7 +702,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FLASHLIGHT_EDU_NON_FEATURED_SERVICES_SELECTED", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-calendar.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-calendar.log-expected.json index b822bc700fe..55a40e110c4 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-calendar.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-calendar.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_BUILDING", @@ -81,7 +81,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_BUILDING", @@ -159,7 +159,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_BUILDING", @@ -242,7 +242,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_CALENDAR_RESOURCE", @@ -320,7 +320,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_CALENDAR_RESOURCE", @@ -398,7 +398,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_CALENDAR_RESOURCE_FEATURE", @@ -476,7 +476,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_CALENDAR_RESOURCE_FEATURE", @@ -554,7 +554,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_CALENDAR_RESOURCE_FEATURE", @@ -638,7 +638,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME_CALENDAR_RESOURCE", @@ -717,7 +717,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_CALENDAR_RESOURCE", @@ -800,7 +800,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CALENDAR_SETTING", @@ -899,7 +899,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CANCEL_CALENDAR_EVENTS", @@ -982,7 +982,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RELEASE_CALENDAR_RESOURCES", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chat.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chat.log-expected.json index 69806f33105..75d96f2ecab 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chat.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chat.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MEET_INTEROP_CREATE_GATEWAY", @@ -80,7 +80,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MEET_INTEROP_DELETE_GATEWAY", @@ -157,7 +157,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MEET_INTEROP_MODIFY_GATEWAY", @@ -235,7 +235,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHAT_SETTING", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chromeos.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chromeos.log-expected.json index 583b0daaaae..34a77c38c4c 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chromeos.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-chromeos.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_ANDROID_APPLICATION_SETTING", @@ -105,7 +105,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DEVICE_STATE", @@ -185,7 +185,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_APPLICATION_SETTING", @@ -287,7 +287,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SEND_CHROME_OS_DEVICE_COMMAND", @@ -365,7 +365,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_DEVICE_ANNOTATION", @@ -442,7 +442,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_DEVICE_SETTING", @@ -525,7 +525,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_DEVICE_STATE", @@ -607,7 +607,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_PUBLIC_SESSION_SETTING", @@ -690,7 +690,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INSERT_CHROME_OS_PRINT_SERVER", @@ -767,7 +767,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_CHROME_OS_PRINT_SERVER", @@ -844,7 +844,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_CHROME_OS_PRINT_SERVER", @@ -923,7 +923,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INSERT_CHROME_OS_PRINTER", @@ -1000,7 +1000,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_CHROME_OS_PRINTER", @@ -1077,7 +1077,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_CHROME_OS_PRINTER", @@ -1156,7 +1156,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_SETTING", @@ -1239,7 +1239,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CHROME_OS_USER_SETTING", @@ -1322,7 +1322,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ISSUE_DEVICE_COMMAND", @@ -1404,7 +1404,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOVE_DEVICE_TO_ORG_UNIT_DETAILED", @@ -1484,7 +1484,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_CHROME_OS_APPLICATION_SETTINGS", @@ -1561,7 +1561,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_DEVICE", @@ -1639,7 +1639,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CONTACTS_SETTING", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-contacts.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-contacts.log-expected.json index 44786671a22..d7696f958d6 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-contacts.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-contacts.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CONTACTS_SETTING", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-delegatedadmin.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-delegatedadmin.log-expected.json index 967b760ef8f..c2a55e56927 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-delegatedadmin.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-delegatedadmin.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ASSIGN_ROLE", @@ -92,7 +92,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_ROLE", @@ -170,7 +170,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_ROLE", @@ -248,7 +248,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_PRIVILEGE", @@ -329,7 +329,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_PRIVILEGE", @@ -410,7 +410,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME_ROLE", @@ -488,7 +488,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_ROLE", @@ -566,7 +566,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNASSIGN_ROLE", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log-expected.json index 425099e5b42..6cacbbe5af3 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TRANSFER_DOCUMENT_OWNERSHIP", @@ -90,7 +90,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DRIVE_DATA_RESTORE", @@ -176,7 +176,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DOCS_SETTING", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-domain.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-domain.log-expected.json index 264a8d7ebc6..af7674d29a3 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-domain.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-domain.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ACCOUNT_AUTO_RENEWAL", @@ -81,7 +81,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_APPLICATION", @@ -160,7 +160,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_APPLICATION_TO_WHITELIST", @@ -238,7 +238,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ADVERTISEMENT_OPTION", @@ -317,7 +317,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_ALERT", @@ -394,7 +394,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ALERT_CRITERIA", @@ -471,7 +471,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_ALERT", @@ -548,7 +548,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ALERT_RECEIVERS_CHANGED", @@ -627,7 +627,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME_ALERT", @@ -703,7 +703,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ALERT_STATUS_CHANGED", @@ -782,7 +782,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_DOMAIN_ALIAS", @@ -860,7 +860,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_DOMAIN_ALIAS", @@ -938,7 +938,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SKIP_DOMAIN_ALIAS_MX", @@ -1016,7 +1016,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VERIFY_DOMAIN_ALIAS_MX", @@ -1094,7 +1094,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VERIFY_DOMAIN_ALIAS", @@ -1173,7 +1173,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_OAUTH_ACCESS_TO_ALL_APIS", @@ -1252,7 +1252,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_ALLOW_ADMIN_PASSWORD_RESET", @@ -1331,7 +1331,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_API_ACCESS", @@ -1411,7 +1411,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AUTHORIZE_API_CLIENT_ACCESS", @@ -1497,7 +1497,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_API_CLIENT_ACCESS", @@ -1579,7 +1579,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_LICENSES_REDEEMED", @@ -1658,7 +1658,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_AUTO_ADD_NEW_SERVICE", @@ -1736,7 +1736,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_PRIMARY_DOMAIN", @@ -1814,7 +1814,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_WHITELIST_SETTING", @@ -1894,7 +1894,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMMUNICATION_PREFERENCES_SETTING_CHANGE", @@ -1977,7 +1977,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CONFLICT_ACCOUNT_ACTION", @@ -2056,7 +2056,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_FEEDBACK_SOLICITATION", @@ -2136,7 +2136,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_CONTACT_SHARING", @@ -2215,7 +2215,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_PLAY_FOR_WORK_TOKEN", @@ -2292,7 +2292,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_USE_CUSTOM_LOGO", @@ -2371,7 +2371,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CUSTOM_LOGO", @@ -2448,7 +2448,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DATA_LOCALIZATION_FOR_RUSSIA", @@ -2527,7 +2527,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DATA_LOCALIZATION_SETTING", @@ -2607,7 +2607,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DATA_PROTECTION_OFFICER_CONTACT_INFO", @@ -2684,7 +2684,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_PLAY_FOR_WORK_TOKEN", @@ -2761,7 +2761,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VIEW_DNS_LOGIN_DETAILS", @@ -2838,7 +2838,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DOMAIN_DEFAULT_LOCALE", @@ -2917,7 +2917,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DOMAIN_DEFAULT_TIMEZONE", @@ -2996,7 +2996,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DOMAIN_NAME", @@ -3074,7 +3074,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_ENABLE_PRE_RELEASE_FEATURES", @@ -3152,7 +3152,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_DOMAIN_SUPPORT_MESSAGE", @@ -3231,7 +3231,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_TRUSTED_DOMAINS", @@ -3308,7 +3308,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_TRUSTED_DOMAINS", @@ -3385,7 +3385,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_EDU_TYPE", @@ -3464,7 +3464,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_ENABLE_OAUTH_CONSUMER_KEY", @@ -3543,7 +3543,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_SSO_ENABLED", @@ -3622,7 +3622,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_SSL", @@ -3701,7 +3701,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_EU_REPRESENTATIVE_CONTACT_INFO", @@ -3778,7 +3778,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GENERATE_TRANSFER_TOKEN", @@ -3850,7 +3850,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_LOGIN_BACKGROUND_COLOR", @@ -3929,7 +3929,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_LOGIN_BORDER_COLOR", @@ -4008,7 +4008,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_LOGIN_ACTIVITY_TRACE", @@ -4087,7 +4087,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PLAY_FOR_WORK_ENROLL", @@ -4165,7 +4165,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PLAY_FOR_WORK_UNENROLL", @@ -4242,7 +4242,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MX_RECORD_VERIFICATION_CLAIM", @@ -4328,7 +4328,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_NEW_APP_FEATURES", @@ -4407,7 +4407,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_USE_NEXT_GEN_CONTROL_PANEL", @@ -4486,7 +4486,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPLOAD_OAUTH_CERTIFICATE", @@ -4563,7 +4563,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REGENERATE_OAUTH_CONSUMER_SECRET", @@ -4640,7 +4640,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_OPEN_ID_ENABLED", @@ -4719,7 +4719,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ORGANIZATION_NAME", @@ -4798,7 +4798,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_OUTBOUND_RELAY", @@ -4881,7 +4881,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_PASSWORD_MAX_LENGTH", @@ -4960,7 +4960,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_PASSWORD_MIN_LENGTH", @@ -5039,7 +5039,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_DOMAIN_PRIMARY_ADMIN_EMAIL", @@ -5118,7 +5118,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_SERVICE_OR_FEATURE_NOTIFICATIONS", @@ -5198,7 +5198,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_APPLICATION", @@ -5276,7 +5276,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_APPLICATION_FROM_WHITELIST", @@ -5354,7 +5354,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_RENEW_DOMAIN_REGISTRATION", @@ -5433,7 +5433,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_RESELLER_ACCESS", @@ -5509,7 +5509,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RULE_ACTIONS_CHANGED", @@ -5586,7 +5586,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_RULE", @@ -5663,7 +5663,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_RULE_CRITERIA", @@ -5740,7 +5740,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_RULE", @@ -5817,7 +5817,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME_RULE", @@ -5893,7 +5893,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RULE_STATUS_CHANGED", @@ -5972,7 +5972,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_SECONDARY_DOMAIN", @@ -6050,7 +6050,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_SECONDARY_DOMAIN", @@ -6128,7 +6128,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SKIP_SECONDARY_DOMAIN_MX", @@ -6206,7 +6206,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VERIFY_SECONDARY_DOMAIN_MX", @@ -6284,7 +6284,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VERIFY_SECONDARY_DOMAIN", @@ -6362,7 +6362,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_DOMAIN_SECONDARY_EMAIL", @@ -6441,7 +6441,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_SSO_SETTINGS", @@ -6519,7 +6519,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GENERATE_PIN", @@ -6591,7 +6591,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_RULE", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-gmail.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-gmail.log-expected.json index 6691727124e..f88d4ac531e 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-gmail.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-gmail.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DROP_FROM_QUARANTINE", @@ -83,7 +83,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EMAIL_LOG_SEARCH", @@ -172,7 +172,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EMAIL_UNDELETE", @@ -258,7 +258,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_EMAIL_SETTING", @@ -357,7 +357,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_GMAIL_SETTING", @@ -442,7 +442,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_GMAIL_SETTING", @@ -527,7 +527,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_GMAIL_SETTING", @@ -612,7 +612,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REJECT_FROM_QUARANTINE", @@ -692,7 +692,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RELEASE_FROM_QUARANTINE", @@ -772,7 +772,7 @@ { "@timestamp": "2022-03-07T04:48:46.816Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EMAIL_LOG_SEARCH", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-groups.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-groups.log-expected.json index d48e0c4cca5..45ead6b9742 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-groups.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-groups.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_GROUP", @@ -90,7 +90,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_GROUP", @@ -177,7 +177,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_GROUP_DESCRIPTION", @@ -265,7 +265,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_LIST_DOWNLOAD", @@ -338,7 +338,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_GROUP_MEMBER", @@ -433,7 +433,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_GROUP_MEMBER", @@ -528,7 +528,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_GROUP_MEMBER", @@ -625,7 +625,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS", @@ -722,7 +722,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_GROUP_MEMBER_DELIVERY_SETTINGS_CAN_EMAIL_OVERRIDE", @@ -819,7 +819,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_MEMBER_BULK_UPLOAD", @@ -898,7 +898,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GROUP_MEMBERS_DOWNLOAD", @@ -971,7 +971,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_GROUP_NAME", @@ -1060,7 +1060,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_GROUP_SETTING", @@ -1153,7 +1153,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "WHITELISTED_GROUPS_UPDATED", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-licenses.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-licenses.log-expected.json index 7fab869fbef..fa61e075ddc 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-licenses.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-licenses.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ORG_USERS_LICENSE_ASSIGNMENT", @@ -84,7 +84,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ORG_ALL_USERS_LICENSE_ASSIGNMENT", @@ -165,7 +165,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_LICENSE_ASSIGNMENT", @@ -252,7 +252,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_LICENSE_AUTO_ASSIGN", @@ -331,7 +331,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_LICENSE_REASSIGNMENT", @@ -419,7 +419,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ORG_LICENSE_REVOKE", @@ -500,7 +500,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_LICENSE_REVOKE", @@ -587,7 +587,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_DYNAMIC_LICENSE", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-mobile.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-mobile.log-expected.json index 91312b167d3..2f27ea5d168 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-mobile.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-mobile.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_CANCELLED", @@ -97,7 +97,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACTION_REQUESTED", @@ -191,7 +191,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_MOBILE_CERTIFICATE", @@ -276,7 +276,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMPANY_DEVICES_BULK_CREATION", @@ -353,7 +353,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMPANY_OWNED_DEVICE_BLOCKED", @@ -431,7 +431,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMPANY_DEVICE_DELETION", @@ -509,7 +509,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMPANY_OWNED_DEVICE_UNBLOCKED", @@ -587,7 +587,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "COMPANY_OWNED_DEVICE_WIPED", @@ -665,7 +665,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_APPLICATION_PERMISSION_GRANT", @@ -756,7 +756,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_APPLICATION_PRIORITY_ORDER", @@ -836,7 +836,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_MOBILE_APPLICATION_FROM_WHITELIST", @@ -922,7 +922,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_APPLICATION_SETTINGS", @@ -1014,7 +1014,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_MOBILE_APPLICATION_TO_WHITELIST", @@ -1100,7 +1100,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_APPROVE", @@ -1188,7 +1188,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_BLOCK", @@ -1276,7 +1276,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_DELETE", @@ -1364,7 +1364,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_WIPE", @@ -1452,7 +1452,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_SETTING", @@ -1538,7 +1538,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ADMIN_RESTRICTIONS_PIN", @@ -1618,7 +1618,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_WIRELESS_NETWORK", @@ -1701,7 +1701,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_MOBILE_WIRELESS_NETWORK", @@ -1784,7 +1784,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_MOBILE_WIRELESS_NETWORK", @@ -1867,7 +1867,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_MOBILE_WIRELESS_NETWORK_PASSWORD", @@ -1950,7 +1950,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_MOBILE_CERTIFICATE", @@ -2035,7 +2035,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENROLL_FOR_GOOGLE_DEVICE_MANAGEMENT", @@ -2107,7 +2107,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USE_GOOGLE_MOBILE_MANAGEMENT", @@ -2179,7 +2179,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_NON_IOS", @@ -2251,7 +2251,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USE_GOOGLE_MOBILE_MANAGEMENT_FOR_IOS", @@ -2323,7 +2323,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_ACCOUNT_WIPE", @@ -2411,7 +2411,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_CANCEL_WIPE_THEN_APPROVE", @@ -2499,7 +2499,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOBILE_DEVICE_CANCEL_WIPE_THEN_BLOCK", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-org.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-org.log-expected.json index 5cbc02ffe72..90cf4e25eb3 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-org.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-org.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_LICENSES_ENABLED", @@ -86,7 +86,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_APPLICATION_LICENSE_RESERVATION_CREATED", @@ -170,7 +170,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_APPLICATION_LICENSE_RESERVATION_DELETED", @@ -253,7 +253,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_APPLICATION_LICENSE_RESERVATION_UPDATED", @@ -338,7 +338,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_DEVICE_ENROLLMENT_TOKEN", @@ -415,7 +415,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ASSIGN_CUSTOM_LOGO", @@ -492,7 +492,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNASSIGN_CUSTOM_LOGO", @@ -569,7 +569,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_ENROLLMENT_TOKEN", @@ -646,7 +646,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_ENROLLMENT_TOKEN", @@ -723,7 +723,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHROME_LICENSES_ALLOWED", @@ -806,7 +806,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_ORG_UNIT", @@ -883,7 +883,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_ORG_UNIT", @@ -960,7 +960,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EDIT_ORG_UNIT_DESCRIPTION", @@ -1037,7 +1037,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOVE_ORG_UNIT", @@ -1115,7 +1115,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EDIT_ORG_UNIT_NAME", @@ -1193,7 +1193,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_DEVICE_ENROLLMENT_TOKEN", @@ -1270,7 +1270,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_SERVICE_ENABLED", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-security.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-security.log-expected.json index 3b8cdeb9c69..2b551059113 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-security.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-security.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ALLOW_STRONG_AUTHENTICATION", @@ -83,7 +83,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ALLOW_SERVICE_FOR_OAUTH2_ACCESS", @@ -166,7 +166,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DISALLOW_SERVICE_FOR_OAUTH2_ACCESS", @@ -249,7 +249,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_APP_ACCESS_SETTINGS_COLLECTION_ID", @@ -335,7 +335,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_TO_TRUSTED_OAUTH2_APPS", @@ -419,7 +419,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_FROM_TRUSTED_OAUTH2_APPS", @@ -503,7 +503,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BLOCK_ON_DEVICE_ACCESS", @@ -585,7 +585,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_TWO_STEP_VERIFICATION_ENROLLMENT_PERIOD_DURATION", @@ -678,7 +678,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_TWO_STEP_VERIFICATION_FREQUENCY", @@ -771,7 +771,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_TWO_STEP_VERIFICATION_GRACE_PERIOD_DURATION", @@ -864,7 +864,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_TWO_STEP_VERIFICATION_START_DATE", @@ -957,7 +957,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_ALLOWED_TWO_STEP_VERIFICATION_METHODS", @@ -1049,7 +1049,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_CAA_ENABLEMENT", @@ -1124,7 +1124,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CAA_ERROR_MESSAGE", @@ -1202,7 +1202,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_CAA_APP_ASSIGNMENTS", @@ -1292,7 +1292,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNTRUST_DOMAIN_OWNED_OAUTH2_APPS", @@ -1369,7 +1369,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TRUST_DOMAIN_OWNED_OAUTH2_APPS", @@ -1446,7 +1446,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_NON_ADMIN_USER_PASSWORD_RECOVERY", @@ -1539,7 +1539,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENFORCE_STRONG_AUTHENTICATION", @@ -1638,7 +1638,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_ERROR_MSG_FOR_RESTRICTED_OAUTH2_APPS", @@ -1718,7 +1718,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "WEAK_PROGRAMMATIC_LOGIN_SETTINGS_CHANGED", @@ -1811,7 +1811,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SESSION_CONTROL_SETTINGS_CHANGE", @@ -1894,7 +1894,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_SESSION_LENGTH", @@ -1971,7 +1971,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNBLOCK_ON_DEVICE_ACCESS", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-sites.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-sites.log-expected.json index 8ec75507b56..6ac45eba858 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-sites.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-sites.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_WEB_ADDRESS", @@ -91,7 +91,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_WEB_ADDRESS", @@ -179,7 +179,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_SITES_SETTING", @@ -265,7 +265,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_SITES_WEB_ADDRESS_MAPPING_UPDATES", @@ -349,7 +349,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VIEW_SITE_DETAILS", diff --git a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-user.log-expected.json b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-user.log-expected.json index 25d05bf8f9f..f21182012ee 100644 --- a/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-user.log-expected.json +++ b/packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-user.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_2SV_SCRATCH_CODES", @@ -87,7 +87,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GENERATE_2SV_SCRATCH_CODES", @@ -171,7 +171,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_3LO_DEVICE_TOKENS", @@ -259,7 +259,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_3LO_TOKEN", @@ -346,7 +346,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_RECOVERY_EMAIL", @@ -430,7 +430,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_RECOVERY_PHONE", @@ -514,7 +514,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GRANT_ADMIN_PRIVILEGE", @@ -598,7 +598,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_ADMIN_PRIVILEGE", @@ -682,7 +682,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_ASP", @@ -769,7 +769,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TOGGLE_AUTOMATIC_CONTACT_SHARING", @@ -854,7 +854,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BULK_UPLOAD", @@ -935,7 +935,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BULK_UPLOAD_NOTIFICATION_SENT", @@ -1022,7 +1022,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CANCEL_USER_INVITE", @@ -1109,7 +1109,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_CUSTOM_FIELD", @@ -1198,7 +1198,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_EXTERNAL_ID", @@ -1284,7 +1284,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_GENDER", @@ -1370,7 +1370,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_IM", @@ -1456,7 +1456,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ENABLE_USER_IP_WHITELIST", @@ -1542,7 +1542,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_KEYWORD", @@ -1628,7 +1628,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_LANGUAGE", @@ -1714,7 +1714,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_LOCATION", @@ -1800,7 +1800,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_ORGANIZATION", @@ -1886,7 +1886,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_PHONE_NUMBER", @@ -1972,7 +1972,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_RECOVERY_EMAIL", @@ -2056,7 +2056,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_RECOVERY_PHONE", @@ -2140,7 +2140,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_RELATION", @@ -2226,7 +2226,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_USER_ADDRESS", @@ -2312,7 +2312,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_EMAIL_MONITOR", @@ -2408,7 +2408,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_DATA_TRANSFER_REQUEST", @@ -2496,7 +2496,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GRANT_DELEGATED_ADMIN_PRIVILEGES", @@ -2581,7 +2581,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_ACCOUNT_INFO_DUMP", @@ -2668,7 +2668,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_EMAIL_MONITOR", @@ -2755,7 +2755,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_MAILBOX_DUMP", @@ -2842,7 +2842,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_FIRST_NAME", @@ -2928,7 +2928,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GMAIL_RESET_USER", @@ -3013,7 +3013,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_LAST_NAME", @@ -3099,7 +3099,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MAIL_ROUTING_DESTINATION_ADDED", @@ -3184,7 +3184,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MAIL_ROUTING_DESTINATION_REMOVED", @@ -3269,7 +3269,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD_NICKNAME", @@ -3354,7 +3354,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_NICKNAME", @@ -3439,7 +3439,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_PASSWORD", @@ -3523,7 +3523,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CHANGE_PASSWORD_ON_NEXT_LOGIN", @@ -3609,7 +3609,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DOWNLOAD_PENDING_INVITES_LIST", @@ -3681,7 +3681,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_RECOVERY_EMAIL", @@ -3765,7 +3765,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REMOVE_RECOVERY_PHONE", @@ -3849,7 +3849,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REQUEST_ACCOUNT_INFO", @@ -3933,7 +3933,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REQUEST_MAILBOX_DUMP", @@ -4025,7 +4025,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RESEND_USER_INVITE", @@ -4112,7 +4112,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RESET_SIGNIN_COOKIES", @@ -4196,7 +4196,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SECURITY_KEY_REGISTERED_FOR_USER", @@ -4280,7 +4280,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REVOKE_SECURITY_KEY", @@ -4364,7 +4364,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_INVITE", @@ -4451,7 +4451,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "VIEW_TEMP_PASSWORD", @@ -4538,7 +4538,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TURN_OFF_2_STEP_VERIFICATION", @@ -4622,7 +4622,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNBLOCK_USER_SESSION", @@ -4706,7 +4706,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNENROLL_USER_FROM_TITANIUM", @@ -4790,7 +4790,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ARCHIVE_USER", @@ -4874,7 +4874,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE_BIRTHDATE", @@ -4959,7 +4959,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE_USER", @@ -5043,7 +5043,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE_USER", @@ -5127,7 +5127,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DOWNGRADE_USER_FROM_GPLUS", @@ -5211,7 +5211,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_ENROLLED_IN_TWO_STEP_VERIFICATION", @@ -5295,7 +5295,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DOWNLOAD_USERLIST_CSV", @@ -5367,7 +5367,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "MOVE_USER_TO_ORG_UNIT", @@ -5455,7 +5455,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER_PUT_IN_TWO_STEP_VERIFICATION_GRACE_PERIOD", @@ -5540,7 +5540,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RENAME_USER", @@ -5625,7 +5625,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNENROLL_USER_FROM_STRONG_AUTH", @@ -5709,7 +5709,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SUSPEND_USER", @@ -5793,7 +5793,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNARCHIVE_USER", @@ -5877,7 +5877,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNDELETE_USER", @@ -5961,7 +5961,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UNSUSPEND_USER", @@ -6045,7 +6045,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPGRADE_USER_TO_GPLUS", @@ -6129,7 +6129,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USERS_BULK_UPLOAD", @@ -6207,7 +6207,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USERS_BULK_UPLOAD_NOTIFICATION_SENT", diff --git a/packages/google_workspace/data_stream/admin/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/admin/elasticsearch/ingest_pipeline/default.yml index 4e146c17e26..a8d467896bb 100644 --- a/packages/google_workspace/data_stream/admin/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/admin/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: iam diff --git a/packages/google_workspace/data_stream/admin/sample_event.json b/packages/google_workspace/data_stream/admin/sample_event.json index d5fde8193df..3a39a42a936 100644 --- a/packages/google_workspace/data_stream/admin/sample_event.json +++ b/packages/google_workspace/data_stream/admin/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json b/packages/google_workspace/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json index b9917268933..c01a2205566 100644 --- a/packages/google_workspace/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json +++ b/packages/google_workspace/data_stream/alert/_dev/test/pipeline/test-alert.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-07-10T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -159,7 +159,7 @@ { "@timestamp": "2022-07-11T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Domain wide takeout", @@ -232,7 +232,7 @@ { "@timestamp": "2022-07-12T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -376,7 +376,7 @@ { "@timestamp": "2022-07-13T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Google identity", @@ -453,7 +453,7 @@ { "@timestamp": "2022-07-14T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Google Operations", @@ -546,7 +546,7 @@ { "@timestamp": "2022-07-15T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "State Sponsored Attack", @@ -613,7 +613,7 @@ { "@timestamp": "2022-07-16T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "State Sponsored Attack", @@ -703,7 +703,7 @@ { "@timestamp": "2022-07-17T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AppMaker Editor", @@ -782,7 +782,7 @@ { "@timestamp": "2022-07-18T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Security Center rules", @@ -874,7 +874,7 @@ { "@timestamp": "2022-07-19T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Data Loss Prevention", @@ -1009,7 +1009,7 @@ { "@timestamp": "2022-07-20T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Apps outage", @@ -1095,7 +1095,7 @@ { "@timestamp": "2022-07-21T10:49:29.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Sensitive Admin Action", @@ -1207,7 +1207,7 @@ { "@timestamp": "2021-08-10T14:06:29.101Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Google identity", @@ -1272,7 +1272,7 @@ { "@timestamp": "2022-07-27T03:31:28.440Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Reporting Rule", diff --git a/packages/google_workspace/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index d369f5561e8..888ad0638df 100644 --- a/packages/google_workspace/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Google Workspace Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/alert/sample_event.json b/packages/google_workspace/data_stream/alert/sample_event.json index b48a3ca7a61..ee0137505d4 100644 --- a/packages/google_workspace/data_stream/alert/sample_event.json +++ b/packages/google_workspace/data_stream/alert/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json index b50075f3981..0ccf844d526 100644 --- a/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json +++ b/packages/google_workspace/data_stream/context_aware_access/_dev/test/pipeline/test-context-aware-access.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-01T06:24:42.442Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ACCESS_DENY_EVENT", diff --git a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml index 8ca425c700d..7f2417740fd 100644 --- a/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/context_aware_access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace context aware access logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/context_aware_access/sample_event.json b/packages/google_workspace/data_stream/context_aware_access/sample_event.json index aba59b538c7..849ed1360f7 100644 --- a/packages/google_workspace/data_stream/context_aware_access/sample_event.json +++ b/packages/google_workspace/data_stream/context_aware_access/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json index d1f85af1f71..a6b83bd01d3 100644 --- a/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/google_workspace/data_stream/device/_dev/test/pipeline/test-device.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "APPLICATION_EVENT", diff --git a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml index add417e1c23..0d5d6b8e41d 100644 --- a/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace device logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/device/sample_event.json b/packages/google_workspace/data_stream/device/sample_event.json index 695b76d1d40..19ac05342e5 100644 --- a/packages/google_workspace/data_stream/device/sample_event.json +++ b/packages/google_workspace/data_stream/device/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/drive/_dev/test/pipeline/test-drive.log-expected.json b/packages/google_workspace/data_stream/drive/_dev/test/pipeline/test-drive.log-expected.json index 07fb4e7c11a..998a393c004 100644 --- a/packages/google_workspace/data_stream/drive/_dev/test/pipeline/test-drive.log-expected.json +++ b/packages/google_workspace/data_stream/drive/_dev/test/pipeline/test-drive.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add_to_folder", @@ -97,7 +97,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "approval_canceled", @@ -191,7 +191,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "approval_comment_added", @@ -285,7 +285,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "approval_requested", @@ -379,7 +379,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "approval_reviewer_responded", @@ -473,7 +473,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -565,7 +565,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -657,7 +657,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "download", @@ -749,7 +749,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "edit", @@ -841,7 +841,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add_lock", @@ -933,7 +933,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move", @@ -1029,7 +1029,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "preview", @@ -1121,7 +1121,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "print", @@ -1213,7 +1213,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove_from_folder", @@ -1307,7 +1307,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rename", @@ -1401,7 +1401,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "untrash", @@ -1493,7 +1493,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sheets_import_range", @@ -1585,7 +1585,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "trash", @@ -1677,7 +1677,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove_lock", @@ -1769,7 +1769,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "upload", @@ -1861,7 +1861,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "view", @@ -1954,7 +1954,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_acl_editors", @@ -2052,7 +2052,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_document_access_scope", @@ -2151,7 +2151,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_document_visibility", @@ -2250,7 +2250,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "shared_drive_membership_change", @@ -2349,7 +2349,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "shared_drive_settings_change", @@ -2448,7 +2448,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sheets_import_range_access_change", @@ -2542,7 +2542,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_user_access", diff --git a/packages/google_workspace/data_stream/drive/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/drive/elasticsearch/ingest_pipeline/default.yml index 74a5583e714..32bacd93cec 100644 --- a/packages/google_workspace/data_stream/drive/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/drive/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: file diff --git a/packages/google_workspace/data_stream/drive/sample_event.json b/packages/google_workspace/data_stream/drive/sample_event.json index f6540263c91..51835993e80 100644 --- a/packages/google_workspace/data_stream/drive/sample_event.json +++ b/packages/google_workspace/data_stream/drive/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json index 8011e57f00f..0af7455808b 100644 --- a/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json +++ b/packages/google_workspace/data_stream/gcp/_dev/test/pipeline/test-gcp.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-01T06:24:42.442Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "IMPORT_SSH_PUBLIC_KEY", diff --git a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml index 4720e5bc407..d20defeab6e 100644 --- a/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/gcp/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace GCP logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/gcp/sample_event.json b/packages/google_workspace/data_stream/gcp/sample_event.json index 0293fe6fd4d..89dbc3cf368 100644 --- a/packages/google_workspace/data_stream/gcp/sample_event.json +++ b/packages/google_workspace/data_stream/gcp/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json index 703658278ff..87f46796a40 100644 --- a/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json +++ b/packages/google_workspace/data_stream/group_enterprise/_dev/test/pipeline/test-group-enterprise.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add_info_setting", diff --git a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml index 79a1923ae0d..9da270c2fb2 100644 --- a/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/group_enterprise/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace group enterprise logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/group_enterprise/sample_event.json b/packages/google_workspace/data_stream/group_enterprise/sample_event.json index d7467316581..8f3ab4a2281 100644 --- a/packages/google_workspace/data_stream/group_enterprise/sample_event.json +++ b/packages/google_workspace/data_stream/group_enterprise/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/groups/_dev/test/pipeline/test-groups.log-expected.json b/packages/google_workspace/data_stream/groups/_dev/test/pipeline/test-groups.log-expected.json index 8a9d726534c..f1c1a10c8cb 100644 --- a/packages/google_workspace/data_stream/groups/_dev/test/pipeline/test-groups.log-expected.json +++ b/packages/google_workspace/data_stream/groups/_dev/test/pipeline/test-groups.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_acl_permission", @@ -97,7 +97,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept_invitation", @@ -184,7 +184,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "approve_join_request", @@ -278,7 +278,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "join", @@ -365,7 +365,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "request_to_join", @@ -452,7 +452,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_basic_setting", @@ -542,7 +542,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create_group", @@ -628,7 +628,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete_group", @@ -714,7 +714,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_identity_setting", @@ -804,7 +804,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add_info_setting", @@ -893,7 +893,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_info_setting", @@ -983,7 +983,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove_info_setting", @@ -1072,7 +1072,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_new_members_restrictions_setting", @@ -1162,7 +1162,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_post_replies_setting", @@ -1252,7 +1252,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_spam_moderation_setting", @@ -1342,7 +1342,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "change_topic_setting", @@ -1432,7 +1432,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "moderate_message", @@ -1523,7 +1523,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "always_post_from_user", @@ -1617,7 +1617,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add_user", @@ -1712,7 +1712,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ban_user_with_moderation", @@ -1807,7 +1807,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "revoke_invitation", @@ -1901,7 +1901,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "invite_user", @@ -1995,7 +1995,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reject_join_request", @@ -2089,7 +2089,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reinvite_user", @@ -2183,7 +2183,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove_user", diff --git a/packages/google_workspace/data_stream/groups/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/groups/elasticsearch/ingest_pipeline/default.yml index 941d1b78a85..a5fd939ea92 100644 --- a/packages/google_workspace/data_stream/groups/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/groups/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: iam diff --git a/packages/google_workspace/data_stream/groups/sample_event.json b/packages/google_workspace/data_stream/groups/sample_event.json index 0f9f78bde89..cf53ab39b36 100644 --- a/packages/google_workspace/data_stream/groups/sample_event.json +++ b/packages/google_workspace/data_stream/groups/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log-expected.json b/packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log-expected.json index aa36ecd654f..faa98ab1e95 100644 --- a/packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log-expected.json +++ b/packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account_disabled_password_leak", @@ -84,7 +84,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "suspicious_login", @@ -166,7 +166,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "suspicious_login_less_secure_app", @@ -248,7 +248,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "suspicious_programmatic_login", @@ -330,7 +330,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account_disabled_generic", @@ -411,7 +411,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account_disabled_spamming_through_relay", @@ -492,7 +492,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account_disabled_spamming", @@ -573,7 +573,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account_disabled_hijacked", @@ -656,7 +656,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "gov_attack_warning", @@ -728,7 +728,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_failure", @@ -807,7 +807,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_challenge", @@ -885,7 +885,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_verification", @@ -963,7 +963,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logout", @@ -1039,7 +1039,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_success", diff --git a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml index ecdb401ab28..2caf00739f6 100644 --- a/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/login/sample_event.json b/packages/google_workspace/data_stream/login/sample_event.json index 9ae1af6effa..4d5427b8948 100644 --- a/packages/google_workspace/data_stream/login/sample_event.json +++ b/packages/google_workspace/data_stream/login/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json index 5f8bc15bfd2..d9cc62ee707 100644 --- a/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json +++ b/packages/google_workspace/data_stream/rules/_dev/test/pipeline/test-rules.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rule_match", @@ -117,7 +117,7 @@ { "@timestamp": "2020-11-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rule_match", diff --git a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml index 6f99f2e444f..185ca351efd 100644 --- a/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/rules/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace rules logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/rules/sample_event.json b/packages/google_workspace/data_stream/rules/sample_event.json index 605b142851d..41097f592fb 100644 --- a/packages/google_workspace/data_stream/rules/sample_event.json +++ b/packages/google_workspace/data_stream/rules/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/saml/_dev/test/pipeline/test-saml.log-expected.json b/packages/google_workspace/data_stream/saml/_dev/test/pipeline/test-saml.log-expected.json index 93026954c61..d0759a507b4 100644 --- a/packages/google_workspace/data_stream/saml/_dev/test/pipeline/test-saml.log-expected.json +++ b/packages/google_workspace/data_stream/saml/_dev/test/pipeline/test-saml.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_failure", @@ -85,7 +85,7 @@ { "@timestamp": "2020-10-02T15:00:01.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_success", diff --git a/packages/google_workspace/data_stream/saml/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/saml/elasticsearch/ingest_pipeline/default.yml index 0ed86bd7d36..c5e648d7224 100644 --- a/packages/google_workspace/data_stream/saml/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/saml/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/google_workspace/data_stream/saml/sample_event.json b/packages/google_workspace/data_stream/saml/sample_event.json index d79a3f3cb7a..5ddb069a13e 100644 --- a/packages/google_workspace/data_stream/saml/sample_event.json +++ b/packages/google_workspace/data_stream/saml/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/token/_dev/test/pipeline/test-token.log-expected.json b/packages/google_workspace/data_stream/token/_dev/test/pipeline/test-token.log-expected.json index aeb4db8c7ca..40e1ef1a2f9 100644 --- a/packages/google_workspace/data_stream/token/_dev/test/pipeline/test-token.log-expected.json +++ b/packages/google_workspace/data_stream/token/_dev/test/pipeline/test-token.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-01-01T06:24:42.442Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize", diff --git a/packages/google_workspace/data_stream/token/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/token/elasticsearch/ingest_pipeline/default.yml index e5f635bf137..e914269f8f6 100644 --- a/packages/google_workspace/data_stream/token/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/token/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace token logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/google_workspace/data_stream/token/sample_event.json b/packages/google_workspace/data_stream/token/sample_event.json index 7203510f8c6..541f3711f37 100644 --- a/packages/google_workspace/data_stream/token/sample_event.json +++ b/packages/google_workspace/data_stream/token/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/data_stream/user_accounts/_dev/test/pipeline/test-user-accounts.log-expected.json b/packages/google_workspace/data_stream/user_accounts/_dev/test/pipeline/test-user-accounts.log-expected.json index 4625e60fd86..793566f135f 100644 --- a/packages/google_workspace/data_stream/user_accounts/_dev/test/pipeline/test-user-accounts.log-expected.json +++ b/packages/google_workspace/data_stream/user_accounts/_dev/test/pipeline/test-user-accounts.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "2sv_disable", @@ -76,7 +76,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "2sv_enroll", @@ -149,7 +149,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password_edit", @@ -222,7 +222,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recovery_email_edit", @@ -295,7 +295,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recovery_phone_edit", @@ -368,7 +368,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recovery_secret_qa_edit", @@ -441,7 +441,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "titanium_enroll", @@ -514,7 +514,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "titanium_unenroll", @@ -587,7 +587,7 @@ { "@timestamp": "2020-10-02T15:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "email_forwarding_out_of_domain", diff --git a/packages/google_workspace/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml b/packages/google_workspace/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml index 3b68ba2442a..4978d107a33 100644 --- a/packages/google_workspace/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/google_workspace/data_stream/user_accounts/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing google_workspace logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/google_workspace/data_stream/user_accounts/sample_event.json b/packages/google_workspace/data_stream/user_accounts/sample_event.json index 99fd18460e6..b9bb2dbff89 100644 --- a/packages/google_workspace/data_stream/user_accounts/sample_event.json +++ b/packages/google_workspace/data_stream/user_accounts/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/docs/README.md b/packages/google_workspace/docs/README.md index 5383e7d3d62..096371c63b1 100644 --- a/packages/google_workspace/docs/README.md +++ b/packages/google_workspace/docs/README.md @@ -162,7 +162,7 @@ An example event for `saml` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -299,7 +299,7 @@ An example event for `user_accounts` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -422,7 +422,7 @@ An example event for `login` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -560,7 +560,7 @@ An example event for `rules` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -766,7 +766,7 @@ An example event for `admin` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -997,7 +997,7 @@ An example event for `drive` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -1164,7 +1164,7 @@ An example event for `groups` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -1318,7 +1318,7 @@ An example event for `alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -1633,7 +1633,7 @@ An example event for `device` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -1892,7 +1892,7 @@ An example event for `group_enterprise` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -2070,7 +2070,7 @@ An example event for `token` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -2277,7 +2277,7 @@ An example event for `access_transparency` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -2447,7 +2447,7 @@ An example event for `context_aware_access` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", @@ -2606,7 +2606,7 @@ An example event for `gcp` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f7070b0b-fbce-4ea8-a8b4-9591ca3f2b72", diff --git a/packages/google_workspace/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json b/packages/google_workspace/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json index 880f8f602ac..9a28409a000 100644 --- a/packages/google_workspace/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json +++ b/packages/google_workspace/kibana/dashboard/google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Overview of Google Workspace Rules.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -52,7 +52,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "49d52ffc-77d4-4564-b467-21113069fd3f": { "columnOrder": [ @@ -90,7 +90,7 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -105,7 +105,7 @@ "panelIndex": "123197a0-8c1a-4b5f-9328-f42cff317429", "title": "Total Severity [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -119,7 +119,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91b13cbe-d02c-49f3-bdc7-60e804a3576a": { "columnOrder": [ @@ -176,15 +176,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c792ccd0-e339-4a57-9b77-8ec01540876c" - ], "layerId": "91b13cbe-d02c-49f3-bdc7-60e804a3576a", "layerType": "data", "legendDisplay": "default", - "metric": "fb52ca0a-d8cc-4d5f-83c0-c28cefb0f8ce", + "metrics": [ + "fb52ca0a-d8cc-4d5f-83c0-c28cefb0f8ce" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c792ccd0-e339-4a57-9b77-8ec01540876c" + ] } ], "shape": "pie" @@ -207,7 +209,7 @@ "panelIndex": "a995f12f-5ce4-4fbf-9d8c-411ee0fe691f", "title": "Distribution of Rules by Severity [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -221,7 +223,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "788b8016-043d-4d6d-945c-3f2e1dc365d3": { "columnOrder": [ @@ -295,7 +297,7 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetricNew" + "visualizationType": "lnsMetric" }, "enhancements": {} }, @@ -308,7 +310,7 @@ }, "panelIndex": "c82a2b25-eb5e-40b2-b3b2-650d74c936f9", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -322,7 +324,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "568a0980-a917-48ad-bde5-ebb17d8e623a": { "columnOrder": [ @@ -379,15 +381,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "959dbeaa-f55c-45e8-9b38-b98952a1612b" - ], "layerId": "568a0980-a917-48ad-bde5-ebb17d8e623a", "layerType": "data", "legendDisplay": "default", - "metric": "414f2299-b09f-409a-8855-ff346d86f770", + "metrics": [ + "414f2299-b09f-409a-8855-ff346d86f770" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "959dbeaa-f55c-45e8-9b38-b98952a1612b" + ] } ], "shape": "pie" @@ -410,7 +414,7 @@ "panelIndex": "3c4011fa-9c5c-48e6-abae-693bf685851e", "title": "Distribution of Rules by Device Type [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -424,7 +428,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e0b93956-6fd4-4842-a441-e185bd29c77c": { "columnOrder": [ @@ -481,15 +485,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "37b9483a-d496-4993-99e3-a2487dfcc9de" - ], "layerId": "e0b93956-6fd4-4842-a441-e185bd29c77c", "layerType": "data", "legendDisplay": "default", - "metric": "5be194b7-6d94-4677-b820-ebe7fdc33582", + "metrics": [ + "5be194b7-6d94-4677-b820-ebe7fdc33582" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "37b9483a-d496-4993-99e3-a2487dfcc9de" + ] } ], "shape": "pie" @@ -512,7 +518,7 @@ "panelIndex": "6cb8bd6f-be16-43ef-85dc-1f5007ca46ef", "title": "Distribution of Rules by Event Action [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -526,7 +532,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b04c4c24-d9f1-4a60-9b0f-8bd4fb9f80a4": { "columnOrder": [ @@ -583,15 +589,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "087501c1-0b44-4947-824d-23d688acd8b0" - ], "layerId": "b04c4c24-d9f1-4a60-9b0f-8bd4fb9f80a4", "layerType": "data", "legendDisplay": "default", - "metric": "c9367b78-19e4-4f77-aeb3-bc453bc5a289", + "metrics": [ + "c9367b78-19e4-4f77-aeb3-bc453bc5a289" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "087501c1-0b44-4947-824d-23d688acd8b0" + ] } ], "shape": "pie" @@ -614,7 +622,7 @@ "panelIndex": "a2806b00-58d7-4fb8-97c4-59c3da0220a0", "title": "Distribution of Rules by Rule Type [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -628,7 +636,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f2ade8d5-c408-4496-afd1-cecb15659a59": { "columnOrder": [ @@ -739,7 +747,7 @@ "panelIndex": "4e8cd032-411a-4a42-92b4-ee98a8f803af", "title": "Distribution of Rules by Data Source [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -753,7 +761,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "58c070e1-e2d0-4496-8b94-249b85491fb2": { "columnOrder": [ @@ -810,15 +818,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "a87c4d55-df7d-4f2c-9921-aa3749be256e" - ], "layerId": "58c070e1-e2d0-4496-8b94-249b85491fb2", "layerType": "data", "legendDisplay": "default", - "metric": "e5c683c3-dba5-44ca-a638-fe7a80eccee6", + "metrics": [ + "e5c683c3-dba5-44ca-a638-fe7a80eccee6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "a87c4d55-df7d-4f2c-9921-aa3749be256e" + ] } ], "shape": "pie" @@ -841,7 +851,7 @@ "panelIndex": "554995d9-c1b1-4a58-9bea-a82cefc57583", "title": "Distribution of Rules by Resource Type [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -855,7 +865,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "47571350-d5fe-468c-b53e-aab0f4883775": { "columnOrder": [ @@ -940,7 +950,7 @@ "panelIndex": "1759911d-52c6-4cae-895c-d6bc9c90d8ed", "title": "Top 10 Organization Domain [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -954,7 +964,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c032fb76-0265-4e61-9008-5ae30772f62f": { "columnOrder": [ @@ -1039,7 +1049,7 @@ "panelIndex": "bede3b5c-48c7-48b9-94fd-0d60bcd6761f", "title": "Top 10 User IP [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1053,7 +1063,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2b72303a-7466-4238-acdc-376df532b930": { "columnOrder": [ @@ -1136,130 +1146,217 @@ "panelIndex": "918fbb38-c024-4a02-9451-e24d2f821105", "title": "Top 10 Trigger of the Rule Evaluation [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b54a111e-6e78-4a5f-85f0-25ca75d8a8c0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1385e8ae-8493-4b2a-8e9d-0622e3415752", + "type": "index-pattern" } - }, - "description": "", - "id": "", - "params": { - "annotations": [], - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "767fa210-34e3-11ed-99ee-6d37de6553b1" - } - ], - "bar_color_rules": [ - { - "id": "7412e7d0-34e3-11ed-99ee-6d37de6553b1" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b54a111e-6e78-4a5f-85f0-25ca75d8a8c0": { + "columnOrder": [ + "6ebec1fd-805f-4a2d-b0a7-d5a4e23aa4d5", + "c4085abf-16cd-4fb5-8149-33f5d9b4f2f0", + "067cca01-9d38-48df-a5d2-130190e2b166", + "7368f97b-373a-4fa9-b67c-76128f9aba27" + ], + "columns": { + "067cca01-9d38-48df-a5d2-130190e2b166": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "google_workspace.rules.severity: \"MEDIUM\"" + }, + "isBucketed": false, + "label": "Medium severity", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "6ebec1fd-805f-4a2d-b0a7-d5a4e23aa4d5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7368f97b-373a-4fa9-b67c-76128f9aba27": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "High severity", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c4085abf-16cd-4fb5-8149-33f5d9b4f2f0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "google_workspace.rules.severity: \"LOW\"" + }, + "isBucketed": false, + "label": "Low severity", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "filter": { - "language": "kuery", - "query": "" }, - "gauge_color_rules": [ + "filters": [ { - "id": "789059a0-34e3-11ed-99ee-6d37de6553b1" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "27f31679-7606-4f1e-b1d3-acc503edc784", - "index_pattern_ref_name": "metrics_a770d1b0-ce49-4e7c-9b2f-d61438af1415_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "default", - "id": "e8e519c9-71f7-4662-8cbc-7b22c4b7965d", - "label": "Triggered Rules by Severity", - "line_width": 1, - "metrics": [ - { - "agg_with": "noop", - "field": "google_workspace.rules.matched.trigger", - "id": "86d42c61-1989-446d-b39c-638c17283ab1", - "order": "desc", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "series_index_pattern": { - "id": "logs-*" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1385e8ae-8493-4b2a-8e9d-0622e3415752", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "google_workspace.rules" + }, + "type": "phrase" }, - "split_mode": "terms", - "stacked": "none", - "terms_field": "google_workspace.rules.severity", - "terms_size": "10", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "google_workspace.rules" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c4085abf-16cd-4fb5-8149-33f5d9b4f2f0", + "067cca01-9d38-48df-a5d2-130190e2b166", + "7368f97b-373a-4fa9-b67c-76128f9aba27" + ], + "layerId": "b54a111e-6e78-4a5f-85f0-25ca75d8a8c0", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "xAccessor": "6ebec1fd-805f-4a2d-b0a7-d5a4e23aa4d5", + "yConfig": [ + { + "color": "#da8b45", + "forAccessor": "067cca01-9d38-48df-a5d2-130190e2b166" + }, + { + "color": "#e7664c", + "forAccessor": "7368f97b-373a-4fa9-b67c-76128f9aba27" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yTitle": "Count" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, - "i": "a770d1b0-ce49-4e7c-9b2f-d61438af1415", + "i": "0feb30f3-8ffe-471a-a25d-79b8d1f54d58", "w": 48, "x": 0, "y": 75 }, - "panelIndex": "a770d1b0-ce49-4e7c-9b2f-d61438af1415", + "panelIndex": "0feb30f3-8ffe-471a-a25d-79b8d1f54d58", "title": "Triggered Rules by Severity Over Time [Logs Google Workspace]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Google Workspace] Rules", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T10:27:23.321Z", "id": "google_workspace-3be0b490-3430-11ed-9f31-c9178ccae8cd", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1324,7 +1421,12 @@ }, { "id": "logs-*", - "name": "a770d1b0-ce49-4e7c-9b2f-d61438af1415:metrics_a770d1b0-ce49-4e7c-9b2f-d61438af1415_0_index_pattern", + "name": "0feb30f3-8ffe-471a-a25d-79b8d1f54d58:indexpattern-datasource-layer-b54a111e-6e78-4a5f-85f0-25ca75d8a8c0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0feb30f3-8ffe-471a-a25d-79b8d1f54d58:1385e8ae-8493-4b2a-8e9d-0622e3415752", "type": "index-pattern" } ], diff --git a/packages/google_workspace/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json b/packages/google_workspace/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json index a67e31ff9c8..01b9a9e4e29 100644 --- a/packages/google_workspace/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json +++ b/packages/google_workspace/kibana/dashboard/google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Overview of Google Workspace Drive.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -78,7 +78,7 @@ "panelIndex": "88d9b7a3-a631-4079-a36f-0ce9401f59d8", "title": "Drive Activity by Location [Logs Google Workspace]", "type": "map", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -97,7 +97,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "23370ea2-03f9-4302-8b0c-4c4ee6a81318": { "columnOrder": [ @@ -176,15 +176,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d6471b8e-6e22-459d-a682-9b0a04757f64" - ], "layerId": "23370ea2-03f9-4302-8b0c-4c4ee6a81318", "layerType": "data", "legendDisplay": "default", - "metric": "bd04ef7a-ea8e-4f46-b6e7-f824cacc5885", + "metrics": [ + "bd04ef7a-ea8e-4f46-b6e7-f824cacc5885" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d6471b8e-6e22-459d-a682-9b0a04757f64" + ] } ], "shape": "pie" @@ -207,7 +209,7 @@ "panelIndex": "13fdbdfd-2204-42e6-a0df-5ec6abd24eb2", "title": "Distribution of Document Downloads by Title [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -221,7 +223,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "18651fd1-ac7a-4ab0-8610-1e890b4b9846": { "columnOrder": [ @@ -278,15 +280,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1871eda3-319f-46ab-949b-2e2bf749c54d" - ], "layerId": "18651fd1-ac7a-4ab0-8610-1e890b4b9846", "layerType": "data", "legendDisplay": "default", - "metric": "0aab9f3f-951e-4d6f-8597-64dc7f874ef9", + "metrics": [ + "0aab9f3f-951e-4d6f-8597-64dc7f874ef9" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1871eda3-319f-46ab-949b-2e2bf749c54d" + ] } ], "shape": "pie" @@ -309,77 +313,175 @@ "panelIndex": "d59d4f9e-73e8-48ab-9f31-3f36a9b49d0e", "title": "Distribution of Drive Events by Event Action [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4721a8fd-d8f8-46c7-bb67-0f58ddcbbf46", + "type": "index-pattern" } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "8b7f0824-9e4a-41c8-b2b9-b0a7d9a00273", - "index_pattern_ref_name": "metrics_f334e21c-1d4d-426c-953e-dbb45d99219e_0_index_pattern", - "interval": "", - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "default", - "id": "65ff96dc-8f2a-4a60-92a3-ad0f249b245d", - "label": "Country Name", - "line_width": 1, - "metrics": [ - { - "id": "e68be7b0-708a-400b-badb-0175c3224d21", - "type": "count" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4721a8fd-d8f8-46c7-bb67-0f58ddcbbf46": { + "columnOrder": [ + "04a94f43-284c-439c-9334-920d730b9b1e", + "04b9d728-f91c-4086-b0da-97738067fae9", + "b6120c8b-d77d-474e-a750-0c296ba72880" + ], + "columns": { + "04a94f43-284c-439c-9334-920d730b9b1e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "04b9d728-f91c-4086-b0da-97738067fae9": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of source.geo.country_name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + }, + "b6120c8b-d77d-474e-a750-0c296ba72880": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Country Name", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "terms", - "stacked": "none", - "terms_field": "source.geo.country_name", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": true + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6120c8b-d77d-474e-a750-0c296ba72880" + ], + "layerId": "4721a8fd-d8f8-46c7-bb67-0f58ddcbbf46", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "04b9d728-f91c-4086-b0da-97738067fae9", + "xAccessor": "04a94f43-284c-439c-9334-920d730b9b1e", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "b6120c8b-d77d-474e-a750-0c296ba72880" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "title": "", - "type": "metrics", - "uiState": {} - } + "title": "Drive Activity by Country Over Time [Logs Google Workspace] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -390,8 +492,8 @@ }, "panelIndex": "f334e21c-1d4d-426c-953e-dbb45d99219e", "title": "Drive Activity by Country Over Time [Logs Google Workspace]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -410,7 +512,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "aacc9a6c-42f7-426a-b5c2-030c3d002d6e": { "columnOrder": [ @@ -517,7 +619,7 @@ "panelIndex": "5abea4dd-c858-4dfd-bc80-d949ef49a10b", "title": "Top 10 Uploads by Title [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -531,7 +633,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "065ef144-3d40-40fa-ba4a-df4b27642fff": { "columnOrder": [ @@ -644,7 +746,7 @@ "panelIndex": "4bc634ec-bd01-47a4-9f99-5e43edc2de2a", "title": "Distribution of Drive Events by Document Type [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -663,7 +765,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "944c8671-ceff-4edc-b04e-850f6442d26a": { "columnOrder": [ @@ -770,7 +872,7 @@ "panelIndex": "2606ea99-ab2d-4a46-9528-f254bd341971", "title": "Top 10 Viewed Documents [Logs Google Workspace]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -786,7 +888,7 @@ "panelIndex": "c0550726-6ce7-4d12-a078-3903beb1b4f8", "panelRefName": "panel_c0550726-6ce7-4d12-a078-3903beb1b4f8", "type": "search", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -802,17 +904,18 @@ "panelIndex": "cb11b1b1-3767-4eeb-92b3-b05d38a01d78", "panelRefName": "panel_cb11b1b1-3767-4eeb-92b3-b05d38a01d78", "type": "search", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Google Workspace] Drive", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T11:52:52.520Z", "id": "google_workspace-f8210e80-3b28-11ed-8bdd-f5c5df6c1370", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { @@ -842,7 +945,7 @@ }, { "id": "logs-*", - "name": "f334e21c-1d4d-426c-953e-dbb45d99219e:metrics_f334e21c-1d4d-426c-953e-dbb45d99219e_0_index_pattern", + "name": "f334e21c-1d4d-426c-953e-dbb45d99219e:indexpattern-datasource-layer-4721a8fd-d8f8-46c7-bb67-0f58ddcbbf46", "type": "index-pattern" }, { diff --git a/packages/google_workspace/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json b/packages/google_workspace/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json index 2509c306b59..82bce8d63c8 100644 --- a/packages/google_workspace/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json +++ b/packages/google_workspace/kibana/search/google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370.json @@ -78,7 +78,8 @@ ], "title": "Documents Shared Outside of the Organization [Logs Google Workspace]" }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T11:50:53.983Z", "id": "google_workspace-1cac9ed0-3b2f-11ed-8bdd-f5c5df6c1370", "migrationVersion": { "search": "8.0.0" diff --git a/packages/google_workspace/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json b/packages/google_workspace/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json index 06f9d398bb0..89b39c57f5d 100644 --- a/packages/google_workspace/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json +++ b/packages/google_workspace/kibana/search/google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370.json @@ -78,7 +78,8 @@ ], "title": "ACL Changes [Logs Google Workspace]" }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T11:50:53.983Z", "id": "google_workspace-2c40f770-3b24-11ed-8bdd-f5c5df6c1370", "migrationVersion": { "search": "8.0.0" diff --git a/packages/google_workspace/kibana/tags.yml b/packages/google_workspace/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/google_workspace/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/google_workspace/manifest.yml b/packages/google_workspace/manifest.yml index 10fdc53a45f..528a7b9e884 100644 --- a/packages/google_workspace/manifest.yml +++ b/packages/google_workspace/manifest.yml @@ -1,17 +1,19 @@ name: google_workspace title: Google Workspace -version: "2.10.0" +version: "2.15.0" source: license: Elastic-2.0 description: Collect logs from Google Workspace with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: - security - productivity_security conditions: - kibana.version: ^8.7.1 - elastic.subscription: basic + kibana: + version: ^8.7.1 + elastic: + subscription: basic screenshots: - src: /img/google-workspace-rules-screenshot.png title: Google Workspace Rules Screenshot @@ -96,7 +98,7 @@ policy_templates: - name: http_client_timeout type: text title: Http Client Timeout - description: 'Duration of the time limit on HTTP requests. NOTE: Valid time units are ns, us, ms, s, m, h.' + description: 'Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h.' multi: false required: true show_user: true @@ -121,3 +123,4 @@ policy_templates: description: "Collecting access_transparency, admin, alert, context_aware_access, device, drive, gcp, groups, group_enterprise, login, rules, saml, token and user accounts logs (input: httpjson)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/hadoop/_dev/build/docs/README.md b/packages/hadoop/_dev/build/docs/README.md index c335a87bf02..da33b0b5023 100644 --- a/packages/hadoop/_dev/build/docs/README.md +++ b/packages/hadoop/_dev/build/docs/README.md @@ -10,6 +10,15 @@ This integration is used to collect [Hadoop](https://hadoop.apache.org/) metrics This integration uses Resource Manager API and JMX API to collect above metrics. +## Compatibility + +This integration has been tested against Hadoop version `3.3.6`. + +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Application`` data stream's indices. +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Cluster``, ``Datanode``, ``Namenode`` and ``Node Manager`` data stream's indices. + ## application This data stream collects Application metrics. diff --git a/packages/hadoop/changelog.yml b/packages/hadoop/changelog.yml index 1a5324953a2..e327cd22839 100644 --- a/packages/hadoop/changelog.yml +++ b/packages/hadoop/changelog.yml @@ -1,4 +1,64 @@ # newer versions go on top +- version: "1.1.8" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.1.7" + changes: + - description: Add metric_type mapping for `namenode` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7722 +- version: "1.1.6" + changes: + - description: Add dimension mapping for `namenode` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7720 +- version: "1.1.5" + changes: + - description: Add metric_type mapping for `datanode` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7717 +- version: "1.1.4" + changes: + - description: Add dimension mapping for `datanode` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7676 +- version: "1.1.3" + changes: + - description: Add metric_type mapping for `node_manager` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7644 +- version: "1.1.2" + changes: + - description: Add dimension mapping for `node_manager` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7642 +- version: "1.1.1" + changes: + - description: Add metric_type mapping for `cluster` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7632 +- version: "1.1.0" + changes: + - description: Add dimension mapping for `cluster` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7631 +- version: "1.0.0" + changes: + - description: Make Hadoop GA. + type: enhancement + link: https://github.com/elastic/integrations/pull/7673 +- version: "0.9.1" + changes: + - description: Resolve host.ip field conflict. + type: bugfix + link: https://github.com/elastic/integrations/pull/7564 +- version: "0.9.0" + changes: + - description: Add support for HTTP request trace logging in application data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7343 - version: "0.8.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/hadoop/data_stream/application/agent/stream/stream.yml.hbs b/packages/hadoop/data_stream/application/agent/stream/stream.yml.hbs index e6f46d1cacd..4965280f4ab 100644 --- a/packages/hadoop/data_stream/application/agent/stream/stream.yml.hbs +++ b/packages/hadoop/data_stream/application/agent/stream/stream.yml.hbs @@ -1,6 +1,9 @@ config_version: 2 type: httpjson interval: {{period}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{hostname}}/ws/v1/cluster/apps {{#if ssl}} diff --git a/packages/hadoop/data_stream/application/elasticsearch/ingest_pipeline/default.yml b/packages/hadoop/data_stream/application/elasticsearch/ingest_pipeline/default.yml index 4eb013e5045..8d311b5ddb0 100644 --- a/packages/hadoop/data_stream/application/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hadoop/data_stream/application/elasticsearch/ingest_pipeline/default.yml @@ -20,6 +20,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/hadoop/data_stream/application/fields/ecs.yml b/packages/hadoop/data_stream/application/fields/ecs.yml index 5791df0a4fb..2e12b75bb4e 100644 --- a/packages/hadoop/data_stream/application/fields/ecs.yml +++ b/packages/hadoop/data_stream/application/fields/ecs.yml @@ -10,5 +10,7 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: tags diff --git a/packages/hadoop/data_stream/application/manifest.yml b/packages/hadoop/data_stream/application/manifest.yml index 5e360b5c4ff..053cd592f9a 100644 --- a/packages/hadoop/data_stream/application/manifest.yml +++ b/packages/hadoop/data_stream/application/manifest.yml @@ -50,4 +50,10 @@ streams: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. diff --git a/packages/hadoop/data_stream/cluster/fields/ecs.yml b/packages/hadoop/data_stream/cluster/fields/ecs.yml index 24b3090c872..62135f84260 100644 --- a/packages/hadoop/data_stream/cluster/fields/ecs.yml +++ b/packages/hadoop/data_stream/cluster/fields/ecs.yml @@ -10,9 +10,36 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/hadoop/data_stream/cluster/fields/fields.yml b/packages/hadoop/data_stream/cluster/fields/fields.yml index 8465291c74f..49d2b427369 100644 --- a/packages/hadoop/data_stream/cluster/fields/fields.yml +++ b/packages/hadoop/data_stream/cluster/fields/fields.yml @@ -7,120 +7,154 @@ - name: launch_delay_avg_time description: Application Main Launch Delay Average Time (Milliseconds) type: long + metric_type: gauge - name: launch_delay_num_ops description: Application Main Launch Delay Operations (Number of Operations) type: long + metric_type: gauge - name: register_delay_avg_time description: Application Main Register Delay Average Time (Milliseconds) type: long + metric_type: gauge - name: register_delay_num_ops description: Application Main Register Delay Operations (Number of Operations) type: long + metric_type: gauge - name: applications type: group fields: - name: completed description: The number of applications completed type: long + metric_type: counter - name: failed description: The number of applications failed type: long + metric_type: counter - name: killed description: The number of applications killed type: long + metric_type: counter - name: pending description: The number of applications pending type: long + metric_type: gauge - name: running description: The number of applications running type: long + metric_type: gauge - name: submitted description: The number of applications submitted type: long + metric_type: counter - name: containers type: group fields: - name: allocated description: The number of containers allocated type: long + metric_type: gauge - name: pending description: The number of containers pending type: long + metric_type: gauge - name: reserved description: The number of containers reserved type: long + metric_type: gauge - name: memory type: group fields: - name: allocated description: The amount of memory allocated in MB type: long + metric_type: gauge - name: available description: The amount of memory available in MB type: long + metric_type: gauge - name: reserved description: The amount of memory reserved in MB type: long + metric_type: gauge - name: total description: The amount of total memory in MB type: long + metric_type: gauge - name: nodes type: group fields: - name: active description: The number of active nodes type: long + metric_type: gauge - name: decommissioned description: The number of nodes decommissioned type: long + metric_type: gauge - name: decommissioning description: The number of nodes being decommissioned type: long + metric_type: gauge - name: lost description: The number of lost nodes type: long + metric_type: gauge - name: rebooted description: The number of nodes rebooted type: long + metric_type: gauge - name: shutdown description: The number of nodes shut down type: long + metric_type: gauge - name: total description: The total number of nodes type: long + metric_type: gauge - name: unhealthy description: The number of unhealthy nodes type: long + metric_type: gauge - name: node_managers type: group fields: - name: num_active description: Number of Node Managers Active type: long + metric_type: gauge - name: num_decommissioned description: Number of Node Managers Decommissioned type: long + metric_type: gauge - name: num_lost description: Number of Node Managers Lost type: long + metric_type: gauge - name: num_rebooted description: Number of Node Managers Rebooted type: long + metric_type: gauge - name: num_unhealthy description: Number of Node Managers Unhealthy type: long + metric_type: gauge - name: virtual_cores type: group fields: - name: allocated description: The number of allocated virtual cores type: long + metric_type: gauge - name: available description: The number of available virtual cores type: long + metric_type: gauge - name: reserved description: The number of reserved virtual cores type: long + metric_type: gauge - name: total description: The total number of virtual cores type: long + metric_type: gauge diff --git a/packages/hadoop/data_stream/datanode/fields/ecs.yml b/packages/hadoop/data_stream/datanode/fields/ecs.yml index 24b3090c872..62135f84260 100644 --- a/packages/hadoop/data_stream/datanode/fields/ecs.yml +++ b/packages/hadoop/data_stream/datanode/fields/ecs.yml @@ -10,9 +10,36 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/hadoop/data_stream/datanode/fields/fields.yml b/packages/hadoop/data_stream/datanode/fields/fields.yml index 0033060ae9f..ce49c2a94a5 100644 --- a/packages/hadoop/data_stream/datanode/fields/fields.yml +++ b/packages/hadoop/data_stream/datanode/fields/fields.yml @@ -7,48 +7,59 @@ - name: cached description: The number of blocks cached type: long + metric_type: gauge - name: failed type: group fields: - name: to_cache description: The number of blocks that failed to cache type: long + metric_type: gauge - name: to_uncache description: The number of failed blocks to remove from cache type: long + metric_type: gauge - name: bytes type: group fields: - name: read description: Data read type: long + metric_type: counter - name: written description: Data written type: long + metric_type: counter - name: cache type: group fields: - name: capacity description: Cache capacity in bytes type: long + metric_type: gauge - name: used description: Cache used in bytes type: long + metric_type: gauge - name: dfs_used description: Distributed File System Used type: long + metric_type: gauge - name: disk_space type: group fields: - name: capacity description: Disk capacity in bytes type: long + metric_type: gauge - name: remaining description: The remaining disk space left in bytes type: long + metric_type: gauge - name: estimated_capacity_lost_total description: The estimated capacity lost in bytes type: long + metric_type: gauge - name: last_volume_failure_date description: The date/time of the last volume failure in milliseconds since epoch type: date @@ -57,4 +68,5 @@ fields: - name: failed type: long + metric_type: gauge description: Number of failed volumes diff --git a/packages/hadoop/data_stream/namenode/fields/ecs.yml b/packages/hadoop/data_stream/namenode/fields/ecs.yml index 24b3090c872..62135f84260 100644 --- a/packages/hadoop/data_stream/namenode/fields/ecs.yml +++ b/packages/hadoop/data_stream/namenode/fields/ecs.yml @@ -10,9 +10,36 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/hadoop/data_stream/namenode/fields/fields.yml b/packages/hadoop/data_stream/namenode/fields/fields.yml index e2141f4b509..b1bff5bc7ea 100644 --- a/packages/hadoop/data_stream/namenode/fields/fields.yml +++ b/packages/hadoop/data_stream/namenode/fields/fields.yml @@ -8,72 +8,94 @@ - name: corrupt description: Current number of blocks with corrupt replicas. type: long + metric_type: gauge - name: missing_repl_one description: Current number of missing blocks with replication factor 1 type: long + metric_type: gauge - name: pending_deletion description: Current number of blocks pending deletion type: long + metric_type: gauge - name: pending_replication description: Current number of blocks pending to be replicated type: long + metric_type: gauge - name: scheduled_replication description: Current number of blocks scheduled for replications type: long + metric_type: gauge - name: total description: Current number of allocated blocks in the system type: long + metric_type: gauge - name: under_replicated description: Current number of blocks under replicated type: long + metric_type: gauge - name: capacity type: group fields: - name: remaining description: Current remaining capacity in bytes type: long + metric_type: gauge - name: total description: Current raw capacity of DataNodes in bytes type: long + metric_type: gauge - name: used description: Current used capacity across all DataNodes in bytes type: long + metric_type: gauge - name: estimated_capacity_lost_total description: An estimate of the total capacity lost due to volume failures type: long + metric_type: gauge - name: files_total description: Current number of files and directories type: long + metric_type: gauge - name: lock_queue_length description: Number of threads waiting to acquire FSNameSystem lock type: long + metric_type: gauge - name: nodes type: group fields: - name: num_live_data description: Number of datanodes which are currently live type: long + metric_type: gauge - name: num_dead_data description: Number of datanodes which are currently dead type: long + metric_type: gauge - name: num_decom_live_data description: Number of datanodes which have been decommissioned and are now live type: long + metric_type: gauge - name: num_decom_dead_data description: Number of datanodes which have been decommissioned and are now dead type: long + metric_type: gauge - name: num_decommissioning_data description: Number of datanodes in decommissioning state type: long + metric_type: gauge - name: num_stale_storages description: Number of storages marked as content stale type: long + metric_type: gauge - name: stale_data_nodes description: Current number of DataNodes marked stale due to delayed heartbeat type: long + metric_type: gauge - name: total_load description: Current number of connections type: long + metric_type: gauge - name: volume_failures_total description: Total number of volume failures across all Datanodes type: long + metric_type: gauge diff --git a/packages/hadoop/data_stream/node_manager/fields/ecs.yml b/packages/hadoop/data_stream/node_manager/fields/ecs.yml index 24b3090c872..62135f84260 100644 --- a/packages/hadoop/data_stream/node_manager/fields/ecs.yml +++ b/packages/hadoop/data_stream/node_manager/fields/ecs.yml @@ -10,9 +10,36 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/hadoop/data_stream/node_manager/fields/fields.yml b/packages/hadoop/data_stream/node_manager/fields/fields.yml index 01083ad8b87..3feb4585fe4 100644 --- a/packages/hadoop/data_stream/node_manager/fields/fields.yml +++ b/packages/hadoop/data_stream/node_manager/fields/fields.yml @@ -4,30 +4,39 @@ - name: allocated_containers description: Containers Allocated type: long + metric_type: gauge - name: containers type: group fields: - name: completed description: Containers Completed type: long + metric_type: counter - name: failed description: Containers Failed type: long + metric_type: counter - name: initing description: Containers Initializing type: long + metric_type: gauge - name: killed description: Containers Killed type: long + metric_type: counter - name: launched description: Containers Launched type: long + metric_type: counter - name: running description: Containers Running type: long + metric_type: gauge - name: container_launch_duration_avg_time description: Container Launch Duration Average Time (Seconds) type: long + metric_type: gauge - name: container_launch_duration_num_ops description: Container Launch Duration Operations (Operations) type: long + metric_type: counter diff --git a/packages/hadoop/docs/README.md b/packages/hadoop/docs/README.md index 2f97e2a44a7..7bf64ec95dd 100644 --- a/packages/hadoop/docs/README.md +++ b/packages/hadoop/docs/README.md @@ -10,6 +10,15 @@ This integration is used to collect [Hadoop](https://hadoop.apache.org/) metrics This integration uses Resource Manager API and JMX API to collect above metrics. +## Compatibility + +This integration has been tested against Hadoop version `3.3.6`. + +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Application`` data stream's indices. +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``Cluster``, ``Datanode``, ``Namenode`` and ``Node Manager`` data stream's indices. + ## application This data stream collects Application metrics. @@ -100,6 +109,7 @@ An example event for `application` looks as following: | hadoop.application.time.finished | Application finished time | date | | hadoop.application.time.started | Application start time | date | | hadoop.application.vcore_seconds | The amount of CPU resources the application has allocated | long | +| host.ip | Host ip addresses. | ip | | input.type | Type of Filebeat input. | keyword | | tags | User defined tags | keyword | @@ -197,55 +207,64 @@ An example event for `cluster` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| hadoop.cluster.application_main.launch_delay_avg_time | Application Main Launch Delay Average Time (Milliseconds) | long | -| hadoop.cluster.application_main.launch_delay_num_ops | Application Main Launch Delay Operations (Number of Operations) | long | -| hadoop.cluster.application_main.register_delay_avg_time | Application Main Register Delay Average Time (Milliseconds) | long | -| hadoop.cluster.application_main.register_delay_num_ops | Application Main Register Delay Operations (Number of Operations) | long | -| hadoop.cluster.applications.completed | The number of applications completed | long | -| hadoop.cluster.applications.failed | The number of applications failed | long | -| hadoop.cluster.applications.killed | The number of applications killed | long | -| hadoop.cluster.applications.pending | The number of applications pending | long | -| hadoop.cluster.applications.running | The number of applications running | long | -| hadoop.cluster.applications.submitted | The number of applications submitted | long | -| hadoop.cluster.containers.allocated | The number of containers allocated | long | -| hadoop.cluster.containers.pending | The number of containers pending | long | -| hadoop.cluster.containers.reserved | The number of containers reserved | long | -| hadoop.cluster.memory.allocated | The amount of memory allocated in MB | long | -| hadoop.cluster.memory.available | The amount of memory available in MB | long | -| hadoop.cluster.memory.reserved | The amount of memory reserved in MB | long | -| hadoop.cluster.memory.total | The amount of total memory in MB | long | -| hadoop.cluster.node_managers.num_active | Number of Node Managers Active | long | -| hadoop.cluster.node_managers.num_decommissioned | Number of Node Managers Decommissioned | long | -| hadoop.cluster.node_managers.num_lost | Number of Node Managers Lost | long | -| hadoop.cluster.node_managers.num_rebooted | Number of Node Managers Rebooted | long | -| hadoop.cluster.node_managers.num_unhealthy | Number of Node Managers Unhealthy | long | -| hadoop.cluster.nodes.active | The number of active nodes | long | -| hadoop.cluster.nodes.decommissioned | The number of nodes decommissioned | long | -| hadoop.cluster.nodes.decommissioning | The number of nodes being decommissioned | long | -| hadoop.cluster.nodes.lost | The number of lost nodes | long | -| hadoop.cluster.nodes.rebooted | The number of nodes rebooted | long | -| hadoop.cluster.nodes.shutdown | The number of nodes shut down | long | -| hadoop.cluster.nodes.total | The total number of nodes | long | -| hadoop.cluster.nodes.unhealthy | The number of unhealthy nodes | long | -| hadoop.cluster.virtual_cores.allocated | The number of allocated virtual cores | long | -| hadoop.cluster.virtual_cores.available | The number of available virtual cores | long | -| hadoop.cluster.virtual_cores.reserved | The number of reserved virtual cores | long | -| hadoop.cluster.virtual_cores.total | The total number of virtual cores | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| tags | List of keywords used to tag each event. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| hadoop.cluster.application_main.launch_delay_avg_time | Application Main Launch Delay Average Time (Milliseconds) | long | gauge | +| hadoop.cluster.application_main.launch_delay_num_ops | Application Main Launch Delay Operations (Number of Operations) | long | gauge | +| hadoop.cluster.application_main.register_delay_avg_time | Application Main Register Delay Average Time (Milliseconds) | long | gauge | +| hadoop.cluster.application_main.register_delay_num_ops | Application Main Register Delay Operations (Number of Operations) | long | gauge | +| hadoop.cluster.applications.completed | The number of applications completed | long | counter | +| hadoop.cluster.applications.failed | The number of applications failed | long | counter | +| hadoop.cluster.applications.killed | The number of applications killed | long | counter | +| hadoop.cluster.applications.pending | The number of applications pending | long | gauge | +| hadoop.cluster.applications.running | The number of applications running | long | gauge | +| hadoop.cluster.applications.submitted | The number of applications submitted | long | counter | +| hadoop.cluster.containers.allocated | The number of containers allocated | long | gauge | +| hadoop.cluster.containers.pending | The number of containers pending | long | gauge | +| hadoop.cluster.containers.reserved | The number of containers reserved | long | gauge | +| hadoop.cluster.memory.allocated | The amount of memory allocated in MB | long | gauge | +| hadoop.cluster.memory.available | The amount of memory available in MB | long | gauge | +| hadoop.cluster.memory.reserved | The amount of memory reserved in MB | long | gauge | +| hadoop.cluster.memory.total | The amount of total memory in MB | long | gauge | +| hadoop.cluster.node_managers.num_active | Number of Node Managers Active | long | gauge | +| hadoop.cluster.node_managers.num_decommissioned | Number of Node Managers Decommissioned | long | gauge | +| hadoop.cluster.node_managers.num_lost | Number of Node Managers Lost | long | gauge | +| hadoop.cluster.node_managers.num_rebooted | Number of Node Managers Rebooted | long | gauge | +| hadoop.cluster.node_managers.num_unhealthy | Number of Node Managers Unhealthy | long | gauge | +| hadoop.cluster.nodes.active | The number of active nodes | long | gauge | +| hadoop.cluster.nodes.decommissioned | The number of nodes decommissioned | long | gauge | +| hadoop.cluster.nodes.decommissioning | The number of nodes being decommissioned | long | gauge | +| hadoop.cluster.nodes.lost | The number of lost nodes | long | gauge | +| hadoop.cluster.nodes.rebooted | The number of nodes rebooted | long | gauge | +| hadoop.cluster.nodes.shutdown | The number of nodes shut down | long | gauge | +| hadoop.cluster.nodes.total | The total number of nodes | long | gauge | +| hadoop.cluster.nodes.unhealthy | The number of unhealthy nodes | long | gauge | +| hadoop.cluster.virtual_cores.allocated | The number of allocated virtual cores | long | gauge | +| hadoop.cluster.virtual_cores.available | The number of available virtual cores | long | gauge | +| hadoop.cluster.virtual_cores.reserved | The number of reserved virtual cores | long | gauge | +| hadoop.cluster.virtual_cores.total | The total number of virtual cores | long | gauge | +| host.ip | Host ip addresses. | ip | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | +| tags | List of keywords used to tag each event. | keyword | | ## datanode @@ -350,34 +369,43 @@ An example event for `datanode` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| hadoop.datanode.blocks.cached | The number of blocks cached | long | -| hadoop.datanode.blocks.failed.to_cache | The number of blocks that failed to cache | long | -| hadoop.datanode.blocks.failed.to_uncache | The number of failed blocks to remove from cache | long | -| hadoop.datanode.bytes.read | Data read | long | -| hadoop.datanode.bytes.written | Data written | long | -| hadoop.datanode.cache.capacity | Cache capacity in bytes | long | -| hadoop.datanode.cache.used | Cache used in bytes | long | -| hadoop.datanode.dfs_used | Distributed File System Used | long | -| hadoop.datanode.disk_space.capacity | Disk capacity in bytes | long | -| hadoop.datanode.disk_space.remaining | The remaining disk space left in bytes | long | -| hadoop.datanode.estimated_capacity_lost_total | The estimated capacity lost in bytes | long | -| hadoop.datanode.last_volume_failure_date | The date/time of the last volume failure in milliseconds since epoch | date | -| hadoop.datanode.volumes.failed | Number of failed volumes | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| tags | List of keywords used to tag each event. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| hadoop.datanode.blocks.cached | The number of blocks cached | long | gauge | +| hadoop.datanode.blocks.failed.to_cache | The number of blocks that failed to cache | long | gauge | +| hadoop.datanode.blocks.failed.to_uncache | The number of failed blocks to remove from cache | long | gauge | +| hadoop.datanode.bytes.read | Data read | long | counter | +| hadoop.datanode.bytes.written | Data written | long | counter | +| hadoop.datanode.cache.capacity | Cache capacity in bytes | long | gauge | +| hadoop.datanode.cache.used | Cache used in bytes | long | gauge | +| hadoop.datanode.dfs_used | Distributed File System Used | long | gauge | +| hadoop.datanode.disk_space.capacity | Disk capacity in bytes | long | gauge | +| hadoop.datanode.disk_space.remaining | The remaining disk space left in bytes | long | gauge | +| hadoop.datanode.estimated_capacity_lost_total | The estimated capacity lost in bytes | long | gauge | +| hadoop.datanode.last_volume_failure_date | The date/time of the last volume failure in milliseconds since epoch | date | | +| hadoop.datanode.volumes.failed | Number of failed volumes | long | gauge | +| host.ip | Host ip addresses. | ip | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | +| tags | List of keywords used to tag each event. | keyword | | ## namenode @@ -488,43 +516,52 @@ An example event for `namenode` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| hadoop.namenode.blocks.corrupt | Current number of blocks with corrupt replicas. | long | -| hadoop.namenode.blocks.missing_repl_one | Current number of missing blocks with replication factor 1 | long | -| hadoop.namenode.blocks.pending_deletion | Current number of blocks pending deletion | long | -| hadoop.namenode.blocks.pending_replication | Current number of blocks pending to be replicated | long | -| hadoop.namenode.blocks.scheduled_replication | Current number of blocks scheduled for replications | long | -| hadoop.namenode.blocks.total | Current number of allocated blocks in the system | long | -| hadoop.namenode.blocks.under_replicated | Current number of blocks under replicated | long | -| hadoop.namenode.capacity.remaining | Current remaining capacity in bytes | long | -| hadoop.namenode.capacity.total | Current raw capacity of DataNodes in bytes | long | -| hadoop.namenode.capacity.used | Current used capacity across all DataNodes in bytes | long | -| hadoop.namenode.estimated_capacity_lost_total | An estimate of the total capacity lost due to volume failures | long | -| hadoop.namenode.files_total | Current number of files and directories | long | -| hadoop.namenode.lock_queue_length | Number of threads waiting to acquire FSNameSystem lock | long | -| hadoop.namenode.nodes.num_dead_data | Number of datanodes which are currently dead | long | -| hadoop.namenode.nodes.num_decom_dead_data | Number of datanodes which have been decommissioned and are now dead | long | -| hadoop.namenode.nodes.num_decom_live_data | Number of datanodes which have been decommissioned and are now live | long | -| hadoop.namenode.nodes.num_decommissioning_data | Number of datanodes in decommissioning state | long | -| hadoop.namenode.nodes.num_live_data | Number of datanodes which are currently live | long | -| hadoop.namenode.num_stale_storages | Number of storages marked as content stale | long | -| hadoop.namenode.stale_data_nodes | Current number of DataNodes marked stale due to delayed heartbeat | long | -| hadoop.namenode.total_load | Current number of connections | long | -| hadoop.namenode.volume_failures_total | Total number of volume failures across all Datanodes | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| tags | List of keywords used to tag each event. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| hadoop.namenode.blocks.corrupt | Current number of blocks with corrupt replicas. | long | gauge | +| hadoop.namenode.blocks.missing_repl_one | Current number of missing blocks with replication factor 1 | long | gauge | +| hadoop.namenode.blocks.pending_deletion | Current number of blocks pending deletion | long | gauge | +| hadoop.namenode.blocks.pending_replication | Current number of blocks pending to be replicated | long | gauge | +| hadoop.namenode.blocks.scheduled_replication | Current number of blocks scheduled for replications | long | gauge | +| hadoop.namenode.blocks.total | Current number of allocated blocks in the system | long | gauge | +| hadoop.namenode.blocks.under_replicated | Current number of blocks under replicated | long | gauge | +| hadoop.namenode.capacity.remaining | Current remaining capacity in bytes | long | gauge | +| hadoop.namenode.capacity.total | Current raw capacity of DataNodes in bytes | long | gauge | +| hadoop.namenode.capacity.used | Current used capacity across all DataNodes in bytes | long | gauge | +| hadoop.namenode.estimated_capacity_lost_total | An estimate of the total capacity lost due to volume failures | long | gauge | +| hadoop.namenode.files_total | Current number of files and directories | long | gauge | +| hadoop.namenode.lock_queue_length | Number of threads waiting to acquire FSNameSystem lock | long | gauge | +| hadoop.namenode.nodes.num_dead_data | Number of datanodes which are currently dead | long | gauge | +| hadoop.namenode.nodes.num_decom_dead_data | Number of datanodes which have been decommissioned and are now dead | long | gauge | +| hadoop.namenode.nodes.num_decom_live_data | Number of datanodes which have been decommissioned and are now live | long | gauge | +| hadoop.namenode.nodes.num_decommissioning_data | Number of datanodes in decommissioning state | long | gauge | +| hadoop.namenode.nodes.num_live_data | Number of datanodes which are currently live | long | gauge | +| hadoop.namenode.num_stale_storages | Number of storages marked as content stale | long | gauge | +| hadoop.namenode.stale_data_nodes | Current number of DataNodes marked stale due to delayed heartbeat | long | gauge | +| hadoop.namenode.total_load | Current number of connections | long | gauge | +| hadoop.namenode.volume_failures_total | Total number of volume failures across all Datanodes | long | gauge | +| host.ip | Host ip addresses. | ip | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | +| tags | List of keywords used to tag each event. | keyword | | ## node_manager @@ -617,28 +654,37 @@ An example event for `node_manager` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| hadoop.node_manager.allocated_containers | Containers Allocated | long | -| hadoop.node_manager.container_launch_duration_avg_time | Container Launch Duration Average Time (Seconds) | long | -| hadoop.node_manager.container_launch_duration_num_ops | Container Launch Duration Operations (Operations) | long | -| hadoop.node_manager.containers.completed | Containers Completed | long | -| hadoop.node_manager.containers.failed | Containers Failed | long | -| hadoop.node_manager.containers.initing | Containers Initializing | long | -| hadoop.node_manager.containers.killed | Containers Killed | long | -| hadoop.node_manager.containers.launched | Containers Launched | long | -| hadoop.node_manager.containers.running | Containers Running | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| tags | List of keywords used to tag each event. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | +| hadoop.node_manager.allocated_containers | Containers Allocated | long | gauge | +| hadoop.node_manager.container_launch_duration_avg_time | Container Launch Duration Average Time (Seconds) | long | gauge | +| hadoop.node_manager.container_launch_duration_num_ops | Container Launch Duration Operations (Operations) | long | counter | +| hadoop.node_manager.containers.completed | Containers Completed | long | counter | +| hadoop.node_manager.containers.failed | Containers Failed | long | counter | +| hadoop.node_manager.containers.initing | Containers Initializing | long | gauge | +| hadoop.node_manager.containers.killed | Containers Killed | long | counter | +| hadoop.node_manager.containers.launched | Containers Launched | long | counter | +| hadoop.node_manager.containers.running | Containers Running | long | gauge | +| host.ip | Host ip addresses. | ip | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | +| tags | List of keywords used to tag each event. | keyword | | diff --git a/packages/hadoop/img/hadoop-application-dashboard-screenshot.png b/packages/hadoop/img/hadoop-application-dashboard-screenshot.png index 58b2e0948d3..719a7db2526 100644 Binary files a/packages/hadoop/img/hadoop-application-dashboard-screenshot.png and b/packages/hadoop/img/hadoop-application-dashboard-screenshot.png differ diff --git a/packages/hadoop/kibana/dashboard/hadoop-3e16f2c0-cd28-11ec-be30-1d9331f0b107.json b/packages/hadoop/kibana/dashboard/hadoop-3e16f2c0-cd28-11ec-be30-1d9331f0b107.json index 4467d863183..1a8e0128739 100644 --- a/packages/hadoop/kibana/dashboard/hadoop-3e16f2c0-cd28-11ec-be30-1d9331f0b107.json +++ b/packages/hadoop/kibana/dashboard/hadoop-3e16f2c0-cd28-11ec-be30-1d9331f0b107.json @@ -327,7 +327,7 @@ "y": 0 }, "panelIndex": "8b49723a-7ec3-4b6a-8b5f-879f2dd4f5b0", - "title": "The number of virtual cores the application has allocated [Metrics Hadoop]", + "title": "Number of Virtual Cores Allocated [Metrics Hadoop]", "type": "lens", "version": "8.3.0" }, @@ -516,7 +516,7 @@ "y": 12 }, "panelIndex": "ba4756f0-4674-4b0a-880d-54a5cfb4cb3f", - "title": "The amount of memory the application has allocated [Metrics Hadoop]", + "title": "Amount of Memory Allocated [Metrics Hadoop]", "type": "lens", "version": "8.3.0" }, diff --git a/packages/hadoop/manifest.yml b/packages/hadoop/manifest.yml index d980c50df67..57319bd2a1c 100644 --- a/packages/hadoop/manifest.yml +++ b/packages/hadoop/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: hadoop title: Hadoop -version: "0.8.0" +version: "1.1.8" license: basic description: Collect metrics from Apache Hadoop with Elastic Agent. type: integration diff --git a/packages/haproxy/changelog.yml b/packages/haproxy/changelog.yml index e7efe2877f7..9f310549dff 100644 --- a/packages/haproxy/changelog.yml +++ b/packages/haproxy/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.8.3" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.8.2" + changes: + - description: Add dimensions mapping for `info` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7201 +- version: "1.8.1" + changes: + - description: Add `metric_type` mapping for the 'stat' datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7183 +- version: "1.8.0" + changes: + - description: Add `metric_type` mapping for `info` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7164 - version: "1.7.2" changes: - description: Add missing event.duration field mapping. diff --git a/packages/haproxy/data_stream/info/fields/agent.yml b/packages/haproxy/data_stream/info/fields/agent.yml index da4e652c53b..a073ae0efb5 100644 --- a/packages/haproxy/data_stream/info/fields/agent.yml +++ b/packages/haproxy/data_stream/info/fields/agent.yml @@ -9,6 +9,7 @@ level: extended type: keyword ignore_above: 1024 + dimension: true description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' @@ -17,6 +18,7 @@ level: extended type: keyword ignore_above: 1024 + dimension: true description: Availability zone in which this host is running. example: us-east-1c - name: instance.id @@ -25,6 +27,7 @@ ignore_above: 1024 description: Instance ID of the host machine. example: i-1234567890abcdef0 + dimension: true - name: instance.name level: extended type: keyword @@ -42,10 +45,12 @@ ignore_above: 1024 description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. example: aws + dimension: true - name: region level: extended type: keyword ignore_above: 1024 + dimension: true description: Region in which this host is running. example: us-east-1 - name: project.id @@ -67,6 +72,7 @@ type: keyword ignore_above: 1024 description: Unique container id. + dimension: true - name: image.name level: extended type: keyword @@ -134,6 +140,7 @@ level: core type: keyword ignore_above: 1024 + dimension: true description: 'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' @@ -196,3 +203,11 @@ description: > OS codename, if any. +- name: agent + title: Agent + type: group + fields: + - name: id + type: keyword + ignore_above: 1024 + dimension: true \ No newline at end of file diff --git a/packages/haproxy/data_stream/info/fields/ecs.yml b/packages/haproxy/data_stream/info/fields/ecs.yml index 89b163a3aa1..56e74650a37 100644 --- a/packages/haproxy/data_stream/info/fields/ecs.yml +++ b/packages/haproxy/data_stream/info/fields/ecs.yml @@ -2,7 +2,9 @@ name: process - external: ecs name: process.pid + dimension: true - external: ecs name: service.address + dimension: true - external: ecs name: service.type diff --git a/packages/haproxy/data_stream/info/fields/fields.yml b/packages/haproxy/data_stream/info/fields/fields.yml index 3dd7be4f410..e707e34900f 100644 --- a/packages/haproxy/data_stream/info/fields/fields.yml +++ b/packages/haproxy/data_stream/info/fields/fields.yml @@ -3,55 +3,69 @@ fields: - name: processes type: long + metric_type: gauge description: | Number of processes. - name: process_num type: long + metric_type: gauge description: | Process number. - name: threads type: long + metric_type: gauge description: | Number of threads. - name: run_queue type: long + metric_type: gauge - name: stopping type: long + metric_type: gauge description: | Number of stopping jobs. - name: jobs type: long + metric_type: gauge description: | Number of all jobs. - name: unstoppable_jobs type: long + metric_type: gauge description: | Number of unstoppable jobs. - name: listeners type: long + metric_type: gauge description: | Number of listeners. - name: dropped_logs type: long + metric_type: gauge description: | Number of dropped logs. - name: busy_polling type: long + metric_type: gauge description: | Number of busy polling. - name: failed_resolutions type: long + metric_type: gauge description: | Number of failed resolutions. - name: tasks type: long + metric_type: gauge - name: uptime.sec type: long + metric_type: gauge description: | Current uptime in seconds. - name: memory.max.bytes type: long format: bytes + metric_type: gauge description: | Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes). - name: bytes @@ -62,10 +76,12 @@ fields: - name: total type: long + metric_type: gauge description: | Number of bytes sent out. - name: rate type: long + metric_type: gauge description: | Average bytes output rate. - name: peers @@ -73,10 +89,12 @@ fields: - name: active type: long + metric_type: gauge description: | Number of active peers. - name: connected type: long + metric_type: gauge description: | Number of connected peers. - name: pool @@ -84,18 +102,22 @@ fields: - name: allocated type: long + metric_type: gauge description: | Size of the allocated pool. - name: used type: long + metric_type: gauge description: | Number of members used from the allocated pool. - name: failed type: long + metric_type: counter description: | Number of failed connections to pool members. - name: ulimit_n type: long + metric_type: gauge description: | Maximum number of open files for the process. - name: compress @@ -106,14 +128,17 @@ fields: - name: in type: long + metric_type: gauge description: | Incoming compressed data in bits per second. - name: out type: long + metric_type: gauge description: | Outgoing compressed data in bits per second. - name: rate_limit type: long + metric_type: gauge description: | Rate limit of compressed data in bits per second. - name: connection @@ -124,52 +149,65 @@ fields: - name: value type: long + metric_type: gauge description: | Number of connections in the last second. - name: limit type: long + metric_type: gauge description: | Rate limit of connections. - name: max type: long + metric_type: gauge description: | Maximum rate of connections. - name: current type: long + metric_type: gauge description: | Current connections. - name: total type: long + metric_type: counter description: | Total connections. - name: ssl.current type: long + metric_type: gauge description: | Current SSL connections. - name: ssl.total type: long + metric_type: counter description: | Total SSL connections. - name: ssl.max type: long + metric_type: gauge description: | Maximum SSL connections. - name: max type: long + metric_type: gauge description: | Maximum connections. - name: hard_max type: long + metric_type: gauge - name: requests.total type: long + metric_type: counter description: | Total number of requests. - name: sockets.max type: long + metric_type: gauge description: | Maximum number of sockets. - name: requests.max type: long + metric_type: gauge description: | Maximum number of requests. - name: pipes @@ -177,14 +215,17 @@ fields: - name: used type: integer + metric_type: gauge description: | Number of used pipes during kernel-based tcp splicing. - name: free type: integer + metric_type: gauge description: | Number of free pipes. - name: max type: integer + metric_type: gauge description: | Maximum number of used pipes. - name: session @@ -192,14 +233,17 @@ fields: - name: rate.value type: integer + metric_type: gauge description: | Rate of session per seconds. - name: rate.limit type: integer + metric_type: gauge description: | Rate limit of sessions. - name: rate.max type: integer + metric_type: gauge description: | Maximum rate of sessions. - name: ssl @@ -207,14 +251,17 @@ fields: - name: rate.value type: integer + metric_type: gauge description: | Rate of SSL requests. - name: rate.limit type: integer + metric_type: gauge description: | Rate limit of SSL requests. - name: rate.max type: integer + metric_type: gauge description: | Maximum rate of SSL requests. - name: frontend @@ -222,15 +269,18 @@ fields: - name: key_rate.value type: integer + metric_type: gauge description: | Key rate of SSL frontend. - name: key_rate.max type: integer + metric_type: gauge description: | Maximum key rate of SSL frontend. - name: session_reuse.pct type: scaled_float format: percent + metric_type: gauge description: | Rate of reuse of SSL frontend sessions. - name: backend @@ -238,18 +288,22 @@ fields: - name: key_rate.value type: integer + metric_type: gauge description: | Key rate of SSL backend sessions. - name: key_rate.max type: integer + metric_type: gauge description: | Maximum key rate of SSL backend sessions. - name: cached_lookups type: long + metric_type: counter description: | Number of SSL cache lookups. - name: cache_misses type: long + metric_type: counter description: | Number of SSL cache misses. - name: zlib_mem_usage @@ -257,14 +311,17 @@ fields: - name: value type: integer + metric_type: gauge description: | Memory usage of zlib. - name: max type: integer + metric_type: gauge description: | Maximum memory usage of zlib. - name: idle.pct type: scaled_float format: percent + metric_type: gauge description: | Percentage of idle time. diff --git a/packages/haproxy/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/haproxy/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 4968d6a1385..52190bfc0c7 100644 --- a/packages/haproxy/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/haproxy/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -9,6 +9,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/haproxy/data_stream/stat/fields/fields.yml b/packages/haproxy/data_stream/stat/fields/fields.yml index bb6decaa82a..316eae43fb5 100644 --- a/packages/haproxy/data_stream/stat/fields/fields.yml +++ b/packages/haproxy/data_stream/stat/fields/fields.yml @@ -7,10 +7,12 @@ Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...). - name: weight type: long + metric_type: gauge description: | Total weight (for backends), or server weight (for servers). - name: downtime type: long + metric_type: counter description: | Total downtime (in seconds). For backends, this value is the downtime for the whole backend, not the sum of the downtime for the servers. - name: component_type @@ -24,24 +26,29 @@ - name: in.bytes type: long format: bytes + metric_type: counter description: | Bytes in. - name: out.bytes type: long format: bytes + metric_type: counter description: | Bytes out. - name: last_change type: integer + metric_type: gauge description: | Number of seconds since the last UP->DOWN or DOWN->UP transition. - name: throttle.pct type: scaled_float format: percent + metric_type: gauge description: | Current throttle percentage for the server when slowstart is active, or no value if slowstart is inactive. - name: selected.total type: long + metric_type: counter description: | Total number of times a server was selected, either for new sessions, or when re-dispatching. For servers, this field reports the the number of times the server was selected. - name: tracked.id @@ -61,30 +68,37 @@ fields: - name: total type: long + metric_type: counter description: | Cumulative number of connections. - name: retried type: long + metric_type: counter description: | Number of times a connection to a server was retried. - name: time.avg type: long + metric_type: gauge description: | Average connect time in ms over the last 1024 requests. - name: rate type: long + metric_type: gauge description: | Number of connections over the last second. - name: rate_max type: long + metric_type: gauge description: | Highest value of connection.rate. - name: attempt.total type: long + metric_type: counter description: | Number of connection establishment attempts. - name: reuse.total type: long + metric_type: counter description: | Number of connection reuses. - name: idle @@ -92,10 +106,12 @@ fields: - name: total type: long + metric_type: gauge description: | Number of idle connections available for reuse. - name: limit type: long + metric_type: gauge description: | Limit on idle connections available for reuse. - name: cache @@ -103,10 +119,12 @@ fields: - name: lookup.total type: long + metric_type: counter description: | Number of cache lookups. - name: hits type: long + metric_type: counter description: | Number of cache hits. - name: request @@ -114,6 +132,7 @@ fields: - name: denied type: long + metric_type: counter description: | Requests denied because of security concerns. @@ -121,22 +140,27 @@ * For HTTP this is because of a matched http-request or tarpit rule. - name: denied_by_connection_rules type: long + metric_type: counter description: | Requests denied because of TCP request connection rules. - name: denied_by_session_rules type: long + metric_type: counter description: | Requests denied because of TCP request session rules. - name: queued.current type: long + metric_type: gauge description: | Current queued requests. For backends, this field reports the number of requests queued without a server assigned. - name: queued.max type: long + metric_type: gauge description: | Maximum value of queued.current. - name: errors type: long + metric_type: counter description: | Request errors. Some of the possible causes are: @@ -148,10 +172,12 @@ * request was tarpitted. - name: redispatched type: long + metric_type: counter description: | Number of times a request was redispatched to another server. For servers, this field reports the number of times the server was switched away from. - name: connection.errors type: long + metric_type: counter description: | Number of requests that encountered an error trying to connect to a server. For backends, this field reports the sum of the stat for all backend servers, plus any connection errors not associated with a particular server (such as the backend having no active servers). - name: rate @@ -159,18 +185,22 @@ fields: - name: value type: long + metric_type: gauge description: | Number of HTTP requests per second over the last elapsed second. - name: max type: long + metric_type: gauge description: | Maximum number of HTTP requests per second. - name: total type: long + metric_type: counter description: | Total number of HTTP requests received. - name: intercepted type: long + metric_type: counter description: | Number of intercepted requests. - name: response @@ -178,15 +208,18 @@ fields: - name: errors type: long + metric_type: counter description: | Number of response errors. This value includes the number of data transfers aborted by the server (haproxy.stat.server.aborted). Some other errors are: * write errors on the client socket (won't be counted for the server stat) * failure applying filters to the response - name: time.avg type: long + metric_type: gauge description: | Average response time in ms over the last 1024 requests (0 for TCP). - name: denied type: integer + metric_type: counter description: | Responses denied because of security concerns. For HTTP this is because of a matched http-request rule, or "option checkcache". - name: http @@ -194,26 +227,32 @@ fields: - name: 1xx type: long + metric_type: counter description: | HTTP responses with 1xx code. - name: 2xx type: long + metric_type: counter description: | HTTP responses with 2xx code. - name: 3xx type: long + metric_type: counter description: | HTTP responses with 3xx code. - name: 4xx type: long + metric_type: counter description: | HTTP responses with 4xx code. - name: 5xx type: long + metric_type: counter description: | HTTP responses with 5xx code. - name: other type: long + metric_type: counter description: | HTTP responses with other codes (protocol error). - name: header @@ -227,6 +266,7 @@ fields: - name: total type: long + metric_type: counter description: | Number of failed header rewrite warnings. - name: session @@ -234,18 +274,22 @@ fields: - name: current type: long + metric_type: gauge description: | Number of current sessions. - name: max type: long + metric_type: gauge description: | Maximum number of sessions. - name: limit type: long + metric_type: gauge description: | Configured session limit. - name: total type: long + metric_type: counter description: | Number of all sessions. - name: rate @@ -253,14 +297,17 @@ fields: - name: value type: integer + metric_type: gauge description: | Number of sessions per second over the last elapsed second. - name: limit type: integer + metric_type: gauge description: | Configured limit on new sessions per second. - name: max type: integer + metric_type: gauge description: | Maximum number of new sessions per second. - name: check @@ -293,6 +340,7 @@ Layer 5-7 code, if available. - name: duration type: long + metric_type: gauge description: | Time in ms that it took to finish the last health check. - name: health.last @@ -306,15 +354,18 @@ - name: agent.last type: integer - name: failed + metric_type: counter type: long description: | Number of checks that failed while the server was up. - name: down type: long + metric_type: counter description: | Number of UP->DOWN transitions. For backends, this value is the number of transitions to the whole backend being down, rather than the sum of the transitions for each server. - name: client.aborted type: integer + metric_type: counter description: | Number of data transfers aborted by the client. - name: server @@ -326,14 +377,17 @@ Server ID (unique inside a proxy). - name: aborted type: integer + metric_type: counter description: | Number of data transfers aborted by the server. This value is included in haproxy.stat.response.errors. - name: active type: integer + metric_type: gauge description: | Number of backend servers that are active, meaning that they are healthy and can receive requests from the load balancer. - name: backup type: integer + metric_type: gauge description: | Number of backend servers that are backup servers. - name: compressor @@ -342,21 +396,25 @@ - name: in.bytes type: long format: bytes + metric_type: counter description: | Number of HTTP response bytes fed to the compressor. - name: out.bytes type: integer format: bytes + metric_type: counter description: | Number of HTTP response bytes emitted by the compressor. - name: bypassed.bytes type: long format: bytes + metric_type: counter description: | Number of bytes that bypassed the HTTP compressor (CPU/BW limit). - name: response.bytes type: long format: bytes + metric_type: counter description: | Number of HTTP responses that were compressed. - name: proxy @@ -383,6 +441,7 @@ Configured queue limit (maxqueue) for the server, or nothing if the value of maxqueue is 0 (meaning no limit). - name: time.avg type: integer + metric_type: gauge description: | The average queue time in ms over the last 1024 requests. - name: agent diff --git a/packages/haproxy/docs/README.md b/packages/haproxy/docs/README.md index cc2321528db..1e244fb6bc7 100644 --- a/packages/haproxy/docs/README.md +++ b/packages/haproxy/docs/README.md @@ -428,105 +428,106 @@ The fields reported are: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| haproxy.info.busy_polling | Number of busy polling. | long | -| haproxy.info.bytes.out.rate | Average bytes output rate. | long | -| haproxy.info.bytes.out.total | Number of bytes sent out. | long | -| haproxy.info.compress.bps.in | Incoming compressed data in bits per second. | long | -| haproxy.info.compress.bps.out | Outgoing compressed data in bits per second. | long | -| haproxy.info.compress.bps.rate_limit | Rate limit of compressed data in bits per second. | long | -| haproxy.info.connection.current | Current connections. | long | -| haproxy.info.connection.hard_max | | long | -| haproxy.info.connection.max | Maximum connections. | long | -| haproxy.info.connection.rate.limit | Rate limit of connections. | long | -| haproxy.info.connection.rate.max | Maximum rate of connections. | long | -| haproxy.info.connection.rate.value | Number of connections in the last second. | long | -| haproxy.info.connection.ssl.current | Current SSL connections. | long | -| haproxy.info.connection.ssl.max | Maximum SSL connections. | long | -| haproxy.info.connection.ssl.total | Total SSL connections. | long | -| haproxy.info.connection.total | Total connections. | long | -| haproxy.info.dropped_logs | Number of dropped logs. | long | -| haproxy.info.failed_resolutions | Number of failed resolutions. | long | -| haproxy.info.idle.pct | Percentage of idle time. | scaled_float | -| haproxy.info.jobs | Number of all jobs. | long | -| haproxy.info.listeners | Number of listeners. | long | -| haproxy.info.memory.max.bytes | Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes). | long | -| haproxy.info.peers.active | Number of active peers. | long | -| haproxy.info.peers.connected | Number of connected peers. | long | -| haproxy.info.pipes.free | Number of free pipes. | integer | -| haproxy.info.pipes.max | Maximum number of used pipes. | integer | -| haproxy.info.pipes.used | Number of used pipes during kernel-based tcp splicing. | integer | -| haproxy.info.pool.allocated | Size of the allocated pool. | long | -| haproxy.info.pool.failed | Number of failed connections to pool members. | long | -| haproxy.info.pool.used | Number of members used from the allocated pool. | long | -| haproxy.info.process_num | Process number. | long | -| haproxy.info.processes | Number of processes. | long | -| haproxy.info.requests.max | Maximum number of requests. | long | -| haproxy.info.requests.total | Total number of requests. | long | -| haproxy.info.run_queue | | long | -| haproxy.info.session.rate.limit | Rate limit of sessions. | integer | -| haproxy.info.session.rate.max | Maximum rate of sessions. | integer | -| haproxy.info.session.rate.value | Rate of session per seconds. | integer | -| haproxy.info.sockets.max | Maximum number of sockets. | long | -| haproxy.info.ssl.backend.key_rate.max | Maximum key rate of SSL backend sessions. | integer | -| haproxy.info.ssl.backend.key_rate.value | Key rate of SSL backend sessions. | integer | -| haproxy.info.ssl.cache_misses | Number of SSL cache misses. | long | -| haproxy.info.ssl.cached_lookups | Number of SSL cache lookups. | long | -| haproxy.info.ssl.frontend.key_rate.max | Maximum key rate of SSL frontend. | integer | -| haproxy.info.ssl.frontend.key_rate.value | Key rate of SSL frontend. | integer | -| haproxy.info.ssl.frontend.session_reuse.pct | Rate of reuse of SSL frontend sessions. | scaled_float | -| haproxy.info.ssl.rate.limit | Rate limit of SSL requests. | integer | -| haproxy.info.ssl.rate.max | Maximum rate of SSL requests. | integer | -| haproxy.info.ssl.rate.value | Rate of SSL requests. | integer | -| haproxy.info.stopping | Number of stopping jobs. | long | -| haproxy.info.tasks | | long | -| haproxy.info.threads | Number of threads. | long | -| haproxy.info.ulimit_n | Maximum number of open files for the process. | long | -| haproxy.info.unstoppable_jobs | Number of unstoppable jobs. | long | -| haproxy.info.uptime.sec | Current uptime in seconds. | long | -| haproxy.info.zlib_mem_usage.max | Maximum memory usage of zlib. | integer | -| haproxy.info.zlib_mem_usage.value | Memory usage of zlib. | integer | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| process | These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. | group | -| process.pid | Process id. | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| haproxy.info.busy_polling | Number of busy polling. | long | gauge | +| haproxy.info.bytes.out.rate | Average bytes output rate. | long | gauge | +| haproxy.info.bytes.out.total | Number of bytes sent out. | long | gauge | +| haproxy.info.compress.bps.in | Incoming compressed data in bits per second. | long | gauge | +| haproxy.info.compress.bps.out | Outgoing compressed data in bits per second. | long | gauge | +| haproxy.info.compress.bps.rate_limit | Rate limit of compressed data in bits per second. | long | gauge | +| haproxy.info.connection.current | Current connections. | long | gauge | +| haproxy.info.connection.hard_max | | long | gauge | +| haproxy.info.connection.max | Maximum connections. | long | gauge | +| haproxy.info.connection.rate.limit | Rate limit of connections. | long | gauge | +| haproxy.info.connection.rate.max | Maximum rate of connections. | long | gauge | +| haproxy.info.connection.rate.value | Number of connections in the last second. | long | gauge | +| haproxy.info.connection.ssl.current | Current SSL connections. | long | gauge | +| haproxy.info.connection.ssl.max | Maximum SSL connections. | long | gauge | +| haproxy.info.connection.ssl.total | Total SSL connections. | long | counter | +| haproxy.info.connection.total | Total connections. | long | counter | +| haproxy.info.dropped_logs | Number of dropped logs. | long | gauge | +| haproxy.info.failed_resolutions | Number of failed resolutions. | long | gauge | +| haproxy.info.idle.pct | Percentage of idle time. | scaled_float | gauge | +| haproxy.info.jobs | Number of all jobs. | long | gauge | +| haproxy.info.listeners | Number of listeners. | long | gauge | +| haproxy.info.memory.max.bytes | Maximum amount of memory usage in bytes (the 'Memmax_MB' value converted to bytes). | long | gauge | +| haproxy.info.peers.active | Number of active peers. | long | gauge | +| haproxy.info.peers.connected | Number of connected peers. | long | gauge | +| haproxy.info.pipes.free | Number of free pipes. | integer | gauge | +| haproxy.info.pipes.max | Maximum number of used pipes. | integer | gauge | +| haproxy.info.pipes.used | Number of used pipes during kernel-based tcp splicing. | integer | gauge | +| haproxy.info.pool.allocated | Size of the allocated pool. | long | gauge | +| haproxy.info.pool.failed | Number of failed connections to pool members. | long | counter | +| haproxy.info.pool.used | Number of members used from the allocated pool. | long | gauge | +| haproxy.info.process_num | Process number. | long | gauge | +| haproxy.info.processes | Number of processes. | long | gauge | +| haproxy.info.requests.max | Maximum number of requests. | long | gauge | +| haproxy.info.requests.total | Total number of requests. | long | counter | +| haproxy.info.run_queue | | long | gauge | +| haproxy.info.session.rate.limit | Rate limit of sessions. | integer | gauge | +| haproxy.info.session.rate.max | Maximum rate of sessions. | integer | gauge | +| haproxy.info.session.rate.value | Rate of session per seconds. | integer | gauge | +| haproxy.info.sockets.max | Maximum number of sockets. | long | gauge | +| haproxy.info.ssl.backend.key_rate.max | Maximum key rate of SSL backend sessions. | integer | gauge | +| haproxy.info.ssl.backend.key_rate.value | Key rate of SSL backend sessions. | integer | gauge | +| haproxy.info.ssl.cache_misses | Number of SSL cache misses. | long | counter | +| haproxy.info.ssl.cached_lookups | Number of SSL cache lookups. | long | counter | +| haproxy.info.ssl.frontend.key_rate.max | Maximum key rate of SSL frontend. | integer | gauge | +| haproxy.info.ssl.frontend.key_rate.value | Key rate of SSL frontend. | integer | gauge | +| haproxy.info.ssl.frontend.session_reuse.pct | Rate of reuse of SSL frontend sessions. | scaled_float | gauge | +| haproxy.info.ssl.rate.limit | Rate limit of SSL requests. | integer | gauge | +| haproxy.info.ssl.rate.max | Maximum rate of SSL requests. | integer | gauge | +| haproxy.info.ssl.rate.value | Rate of SSL requests. | integer | gauge | +| haproxy.info.stopping | Number of stopping jobs. | long | gauge | +| haproxy.info.tasks | | long | gauge | +| haproxy.info.threads | Number of threads. | long | gauge | +| haproxy.info.ulimit_n | Maximum number of open files for the process. | long | gauge | +| haproxy.info.unstoppable_jobs | Number of unstoppable jobs. | long | gauge | +| haproxy.info.uptime.sec | Current uptime in seconds. | long | gauge | +| haproxy.info.zlib_mem_usage.max | Maximum memory usage of zlib. | integer | gauge | +| haproxy.info.zlib_mem_usage.value | Memory usage of zlib. | integer | gauge | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| process | These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. | group | | +| process.pid | Process id. | long | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | ### stat @@ -627,133 +628,133 @@ The fields reported are: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| haproxy.stat.agent.check.description | Human readable version of check. | keyword | -| haproxy.stat.agent.check.fall | Fall value of server. | integer | -| haproxy.stat.agent.check.health | Health parameter of server. Between 0 and `agent.check.rise`+`agent.check.fall`-1. | integer | -| haproxy.stat.agent.check.rise | Rise value of server. | integer | -| haproxy.stat.agent.code | Value reported by agent. | integer | -| haproxy.stat.agent.description | Human readable version of agent.status. | keyword | -| haproxy.stat.agent.duration | Duration of the last check in ms. | integer | -| haproxy.stat.agent.fall | Fall value of agent. | integer | -| haproxy.stat.agent.health | Health parameter of agent. Between 0 and `agent.rise`+`agent.fall`-1. | integer | -| haproxy.stat.agent.rise | Rise value of agent. | integer | -| haproxy.stat.agent.status | Status of the last health check. One of: UNK -\> unknown INI -\> initializing SOCKERR -\> socket error L4OK -\> check passed on layer 4, no upper layers enabled L4TOUT -\> layer 1-4 timeout L4CON -\> layer 1-4 connection problem, for example "Connection refused" (tcp rst) or "No route to host" (icmp) L7OK -\> agent reported "up" L7STS -\> agent reported "fail", "stop" or "down" | keyword | -| haproxy.stat.check.agent.last | | integer | -| haproxy.stat.check.code | Layer 5-7 code, if available. | long | -| haproxy.stat.check.down | Number of UP-\>DOWN transitions. For backends, this value is the number of transitions to the whole backend being down, rather than the sum of the transitions for each server. | long | -| haproxy.stat.check.duration | Time in ms that it took to finish the last health check. | long | -| haproxy.stat.check.failed | Number of checks that failed while the server was up. | long | -| haproxy.stat.check.health.fail | Number of failed checks. | long | -| haproxy.stat.check.health.last | The result of the last health check. | keyword | -| haproxy.stat.check.status | Status of the last health check. One of: UNK -\> unknown INI -\> initializing SOCKERR -\> socket error L4OK -\> check passed on layer 4, no upper layers testing enabled L4TOUT -\> layer 1-4 timeout L4CON -\> layer 1-4 connection problem, for example "Connection refused" (tcp rst) or "No route to host" (icmp) L6OK -\> check passed on layer 6 L6TOUT -\> layer 6 (SSL) timeout L6RSP -\> layer 6 invalid response - protocol error L7OK -\> check passed on layer 7 L7OKC -\> check conditionally passed on layer 7, for example 404 with disable-on-404 L7TOUT -\> layer 7 (HTTP/SMTP) timeout L7RSP -\> layer 7 invalid response - protocol error L7STS -\> layer 7 response error, for example HTTP 5xx | keyword | -| haproxy.stat.client.aborted | Number of data transfers aborted by the client. | integer | -| haproxy.stat.component_type | Component type (0=frontend, 1=backend, 2=server, or 3=socket/listener). | integer | -| haproxy.stat.compressor.bypassed.bytes | Number of bytes that bypassed the HTTP compressor (CPU/BW limit). | long | -| haproxy.stat.compressor.in.bytes | Number of HTTP response bytes fed to the compressor. | long | -| haproxy.stat.compressor.out.bytes | Number of HTTP response bytes emitted by the compressor. | integer | -| haproxy.stat.compressor.response.bytes | Number of HTTP responses that were compressed. | long | -| haproxy.stat.connection.attempt.total | Number of connection establishment attempts. | long | -| haproxy.stat.connection.cache.hits | Number of cache hits. | long | -| haproxy.stat.connection.cache.lookup.total | Number of cache lookups. | long | -| haproxy.stat.connection.idle.limit | Limit on idle connections available for reuse. | long | -| haproxy.stat.connection.idle.total | Number of idle connections available for reuse. | long | -| haproxy.stat.connection.rate | Number of connections over the last second. | long | -| haproxy.stat.connection.rate_max | Highest value of connection.rate. | long | -| haproxy.stat.connection.retried | Number of times a connection to a server was retried. | long | -| haproxy.stat.connection.reuse.total | Number of connection reuses. | long | -| haproxy.stat.connection.time.avg | Average connect time in ms over the last 1024 requests. | long | -| haproxy.stat.connection.total | Cumulative number of connections. | long | -| haproxy.stat.cookie | Cookie value of the server or the name of the cookie of the backend. | keyword | -| haproxy.stat.downtime | Total downtime (in seconds). For backends, this value is the downtime for the whole backend, not the sum of the downtime for the servers. | long | -| haproxy.stat.header.rewrite.failed.total | Number of failed header rewrite warnings. | long | -| haproxy.stat.in.bytes | Bytes in. | long | -| haproxy.stat.last_change | Number of seconds since the last UP-\>DOWN or DOWN-\>UP transition. | integer | -| haproxy.stat.load_balancing_algorithm | Load balancing algorithm. | keyword | -| haproxy.stat.out.bytes | Bytes out. | long | -| haproxy.stat.proxy.id | Unique proxy ID. | integer | -| haproxy.stat.proxy.mode | Proxy mode (tcp, http, health, unknown). | keyword | -| haproxy.stat.proxy.name | Proxy name. | keyword | -| haproxy.stat.queue.limit | Configured queue limit (maxqueue) for the server, or nothing if the value of maxqueue is 0 (meaning no limit). | integer | -| haproxy.stat.queue.time.avg | The average queue time in ms over the last 1024 requests. | integer | -| haproxy.stat.request.connection.errors | Number of requests that encountered an error trying to connect to a server. For backends, this field reports the sum of the stat for all backend servers, plus any connection errors not associated with a particular server (such as the backend having no active servers). | long | -| haproxy.stat.request.denied | Requests denied because of security concerns. \* For TCP this is because of a matched tcp-request content rule. \* For HTTP this is because of a matched http-request or tarpit rule. | long | -| haproxy.stat.request.denied_by_connection_rules | Requests denied because of TCP request connection rules. | long | -| haproxy.stat.request.denied_by_session_rules | Requests denied because of TCP request session rules. | long | -| haproxy.stat.request.errors | Request errors. Some of the possible causes are: \* early termination from the client, before the request has been sent \* read error from the client \* client timeout \* client closed connection \* various bad requests from the client. \* request was tarpitted. | long | -| haproxy.stat.request.intercepted | Number of intercepted requests. | long | -| haproxy.stat.request.queued.current | Current queued requests. For backends, this field reports the number of requests queued without a server assigned. | long | -| haproxy.stat.request.queued.max | Maximum value of queued.current. | long | -| haproxy.stat.request.rate.max | Maximum number of HTTP requests per second. | long | -| haproxy.stat.request.rate.value | Number of HTTP requests per second over the last elapsed second. | long | -| haproxy.stat.request.redispatched | Number of times a request was redispatched to another server. For servers, this field reports the number of times the server was switched away from. | long | -| haproxy.stat.request.total | Total number of HTTP requests received. | long | -| haproxy.stat.response.denied | Responses denied because of security concerns. For HTTP this is because of a matched http-request rule, or "option checkcache". | integer | -| haproxy.stat.response.errors | Number of response errors. This value includes the number of data transfers aborted by the server (haproxy.stat.server.aborted). Some other errors are: \* write errors on the client socket (won't be counted for the server stat) \* failure applying filters to the response | long | -| haproxy.stat.response.http.1xx | HTTP responses with 1xx code. | long | -| haproxy.stat.response.http.2xx | HTTP responses with 2xx code. | long | -| haproxy.stat.response.http.3xx | HTTP responses with 3xx code. | long | -| haproxy.stat.response.http.4xx | HTTP responses with 4xx code. | long | -| haproxy.stat.response.http.5xx | HTTP responses with 5xx code. | long | -| haproxy.stat.response.http.other | HTTP responses with other codes (protocol error). | long | -| haproxy.stat.response.time.avg | Average response time in ms over the last 1024 requests (0 for TCP). | long | -| haproxy.stat.selected.total | Total number of times a server was selected, either for new sessions, or when re-dispatching. For servers, this field reports the the number of times the server was selected. | long | -| haproxy.stat.server.aborted | Number of data transfers aborted by the server. This value is included in haproxy.stat.response.errors. | integer | -| haproxy.stat.server.active | Number of backend servers that are active, meaning that they are healthy and can receive requests from the load balancer. | integer | -| haproxy.stat.server.backup | Number of backend servers that are backup servers. | integer | -| haproxy.stat.server.id | Server ID (unique inside a proxy). | integer | -| haproxy.stat.service_name | Service name (FRONTEND for frontend, BACKEND for backend, or any name for server/listener). | keyword | -| haproxy.stat.session.current | Number of current sessions. | long | -| haproxy.stat.session.limit | Configured session limit. | long | -| haproxy.stat.session.max | Maximum number of sessions. | long | -| haproxy.stat.session.rate.limit | Configured limit on new sessions per second. | integer | -| haproxy.stat.session.rate.max | Maximum number of new sessions per second. | integer | -| haproxy.stat.session.rate.value | Number of sessions per second over the last elapsed second. | integer | -| haproxy.stat.session.total | Number of all sessions. | long | -| haproxy.stat.source.address | Address of the source. | text | -| haproxy.stat.status | Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...). | keyword | -| haproxy.stat.throttle.pct | Current throttle percentage for the server when slowstart is active, or no value if slowstart is inactive. | scaled_float | -| haproxy.stat.tracked.id | ID of the proxy/server if tracking is enabled. | long | -| haproxy.stat.weight | Total weight (for backends), or server weight (for servers). | long | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| process | These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. | group | -| process.pid | Process id. | long | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| haproxy.stat.agent.check.description | Human readable version of check. | keyword | | +| haproxy.stat.agent.check.fall | Fall value of server. | integer | | +| haproxy.stat.agent.check.health | Health parameter of server. Between 0 and `agent.check.rise`+`agent.check.fall`-1. | integer | | +| haproxy.stat.agent.check.rise | Rise value of server. | integer | | +| haproxy.stat.agent.code | Value reported by agent. | integer | | +| haproxy.stat.agent.description | Human readable version of agent.status. | keyword | | +| haproxy.stat.agent.duration | Duration of the last check in ms. | integer | | +| haproxy.stat.agent.fall | Fall value of agent. | integer | | +| haproxy.stat.agent.health | Health parameter of agent. Between 0 and `agent.rise`+`agent.fall`-1. | integer | | +| haproxy.stat.agent.rise | Rise value of agent. | integer | | +| haproxy.stat.agent.status | Status of the last health check. One of: UNK -\> unknown INI -\> initializing SOCKERR -\> socket error L4OK -\> check passed on layer 4, no upper layers enabled L4TOUT -\> layer 1-4 timeout L4CON -\> layer 1-4 connection problem, for example "Connection refused" (tcp rst) or "No route to host" (icmp) L7OK -\> agent reported "up" L7STS -\> agent reported "fail", "stop" or "down" | keyword | | +| haproxy.stat.check.agent.last | | integer | | +| haproxy.stat.check.code | Layer 5-7 code, if available. | long | | +| haproxy.stat.check.down | Number of UP-\>DOWN transitions. For backends, this value is the number of transitions to the whole backend being down, rather than the sum of the transitions for each server. | long | counter | +| haproxy.stat.check.duration | Time in ms that it took to finish the last health check. | long | gauge | +| haproxy.stat.check.failed | Number of checks that failed while the server was up. | long | counter | +| haproxy.stat.check.health.fail | Number of failed checks. | long | | +| haproxy.stat.check.health.last | The result of the last health check. | keyword | | +| haproxy.stat.check.status | Status of the last health check. One of: UNK -\> unknown INI -\> initializing SOCKERR -\> socket error L4OK -\> check passed on layer 4, no upper layers testing enabled L4TOUT -\> layer 1-4 timeout L4CON -\> layer 1-4 connection problem, for example "Connection refused" (tcp rst) or "No route to host" (icmp) L6OK -\> check passed on layer 6 L6TOUT -\> layer 6 (SSL) timeout L6RSP -\> layer 6 invalid response - protocol error L7OK -\> check passed on layer 7 L7OKC -\> check conditionally passed on layer 7, for example 404 with disable-on-404 L7TOUT -\> layer 7 (HTTP/SMTP) timeout L7RSP -\> layer 7 invalid response - protocol error L7STS -\> layer 7 response error, for example HTTP 5xx | keyword | | +| haproxy.stat.client.aborted | Number of data transfers aborted by the client. | integer | counter | +| haproxy.stat.component_type | Component type (0=frontend, 1=backend, 2=server, or 3=socket/listener). | integer | | +| haproxy.stat.compressor.bypassed.bytes | Number of bytes that bypassed the HTTP compressor (CPU/BW limit). | long | counter | +| haproxy.stat.compressor.in.bytes | Number of HTTP response bytes fed to the compressor. | long | counter | +| haproxy.stat.compressor.out.bytes | Number of HTTP response bytes emitted by the compressor. | integer | counter | +| haproxy.stat.compressor.response.bytes | Number of HTTP responses that were compressed. | long | counter | +| haproxy.stat.connection.attempt.total | Number of connection establishment attempts. | long | counter | +| haproxy.stat.connection.cache.hits | Number of cache hits. | long | counter | +| haproxy.stat.connection.cache.lookup.total | Number of cache lookups. | long | counter | +| haproxy.stat.connection.idle.limit | Limit on idle connections available for reuse. | long | gauge | +| haproxy.stat.connection.idle.total | Number of idle connections available for reuse. | long | gauge | +| haproxy.stat.connection.rate | Number of connections over the last second. | long | gauge | +| haproxy.stat.connection.rate_max | Highest value of connection.rate. | long | gauge | +| haproxy.stat.connection.retried | Number of times a connection to a server was retried. | long | counter | +| haproxy.stat.connection.reuse.total | Number of connection reuses. | long | counter | +| haproxy.stat.connection.time.avg | Average connect time in ms over the last 1024 requests. | long | gauge | +| haproxy.stat.connection.total | Cumulative number of connections. | long | counter | +| haproxy.stat.cookie | Cookie value of the server or the name of the cookie of the backend. | keyword | | +| haproxy.stat.downtime | Total downtime (in seconds). For backends, this value is the downtime for the whole backend, not the sum of the downtime for the servers. | long | counter | +| haproxy.stat.header.rewrite.failed.total | Number of failed header rewrite warnings. | long | counter | +| haproxy.stat.in.bytes | Bytes in. | long | counter | +| haproxy.stat.last_change | Number of seconds since the last UP-\>DOWN or DOWN-\>UP transition. | integer | gauge | +| haproxy.stat.load_balancing_algorithm | Load balancing algorithm. | keyword | | +| haproxy.stat.out.bytes | Bytes out. | long | counter | +| haproxy.stat.proxy.id | Unique proxy ID. | integer | | +| haproxy.stat.proxy.mode | Proxy mode (tcp, http, health, unknown). | keyword | | +| haproxy.stat.proxy.name | Proxy name. | keyword | | +| haproxy.stat.queue.limit | Configured queue limit (maxqueue) for the server, or nothing if the value of maxqueue is 0 (meaning no limit). | integer | | +| haproxy.stat.queue.time.avg | The average queue time in ms over the last 1024 requests. | integer | gauge | +| haproxy.stat.request.connection.errors | Number of requests that encountered an error trying to connect to a server. For backends, this field reports the sum of the stat for all backend servers, plus any connection errors not associated with a particular server (such as the backend having no active servers). | long | counter | +| haproxy.stat.request.denied | Requests denied because of security concerns. \* For TCP this is because of a matched tcp-request content rule. \* For HTTP this is because of a matched http-request or tarpit rule. | long | counter | +| haproxy.stat.request.denied_by_connection_rules | Requests denied because of TCP request connection rules. | long | counter | +| haproxy.stat.request.denied_by_session_rules | Requests denied because of TCP request session rules. | long | counter | +| haproxy.stat.request.errors | Request errors. Some of the possible causes are: \* early termination from the client, before the request has been sent \* read error from the client \* client timeout \* client closed connection \* various bad requests from the client. \* request was tarpitted. | long | counter | +| haproxy.stat.request.intercepted | Number of intercepted requests. | long | counter | +| haproxy.stat.request.queued.current | Current queued requests. For backends, this field reports the number of requests queued without a server assigned. | long | gauge | +| haproxy.stat.request.queued.max | Maximum value of queued.current. | long | gauge | +| haproxy.stat.request.rate.max | Maximum number of HTTP requests per second. | long | gauge | +| haproxy.stat.request.rate.value | Number of HTTP requests per second over the last elapsed second. | long | gauge | +| haproxy.stat.request.redispatched | Number of times a request was redispatched to another server. For servers, this field reports the number of times the server was switched away from. | long | counter | +| haproxy.stat.request.total | Total number of HTTP requests received. | long | counter | +| haproxy.stat.response.denied | Responses denied because of security concerns. For HTTP this is because of a matched http-request rule, or "option checkcache". | integer | counter | +| haproxy.stat.response.errors | Number of response errors. This value includes the number of data transfers aborted by the server (haproxy.stat.server.aborted). Some other errors are: \* write errors on the client socket (won't be counted for the server stat) \* failure applying filters to the response | long | counter | +| haproxy.stat.response.http.1xx | HTTP responses with 1xx code. | long | counter | +| haproxy.stat.response.http.2xx | HTTP responses with 2xx code. | long | counter | +| haproxy.stat.response.http.3xx | HTTP responses with 3xx code. | long | counter | +| haproxy.stat.response.http.4xx | HTTP responses with 4xx code. | long | counter | +| haproxy.stat.response.http.5xx | HTTP responses with 5xx code. | long | counter | +| haproxy.stat.response.http.other | HTTP responses with other codes (protocol error). | long | counter | +| haproxy.stat.response.time.avg | Average response time in ms over the last 1024 requests (0 for TCP). | long | gauge | +| haproxy.stat.selected.total | Total number of times a server was selected, either for new sessions, or when re-dispatching. For servers, this field reports the the number of times the server was selected. | long | counter | +| haproxy.stat.server.aborted | Number of data transfers aborted by the server. This value is included in haproxy.stat.response.errors. | integer | counter | +| haproxy.stat.server.active | Number of backend servers that are active, meaning that they are healthy and can receive requests from the load balancer. | integer | gauge | +| haproxy.stat.server.backup | Number of backend servers that are backup servers. | integer | gauge | +| haproxy.stat.server.id | Server ID (unique inside a proxy). | integer | | +| haproxy.stat.service_name | Service name (FRONTEND for frontend, BACKEND for backend, or any name for server/listener). | keyword | | +| haproxy.stat.session.current | Number of current sessions. | long | gauge | +| haproxy.stat.session.limit | Configured session limit. | long | gauge | +| haproxy.stat.session.max | Maximum number of sessions. | long | gauge | +| haproxy.stat.session.rate.limit | Configured limit on new sessions per second. | integer | gauge | +| haproxy.stat.session.rate.max | Maximum number of new sessions per second. | integer | gauge | +| haproxy.stat.session.rate.value | Number of sessions per second over the last elapsed second. | integer | gauge | +| haproxy.stat.session.total | Number of all sessions. | long | counter | +| haproxy.stat.source.address | Address of the source. | text | | +| haproxy.stat.status | Status (UP, DOWN, NOLB, MAINT, or MAINT(via)...). | keyword | | +| haproxy.stat.throttle.pct | Current throttle percentage for the server when slowstart is active, or no value if slowstart is inactive. | scaled_float | gauge | +| haproxy.stat.tracked.id | ID of the proxy/server if tracking is enabled. | long | | +| haproxy.stat.weight | Total weight (for backends), or server weight (for servers). | long | gauge | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| process | These fields contain information about a process. These fields can help you correlate metrics information with a process id/name from a log message. The `process.pid` often stays in the metric itself and is copied to the global field for correlation. | group | | +| process.pid | Process id. | long | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | diff --git a/packages/haproxy/manifest.yml b/packages/haproxy/manifest.yml index 3dde4f3bb3b..4286222c9a8 100644 --- a/packages/haproxy/manifest.yml +++ b/packages/haproxy/manifest.yml @@ -1,6 +1,6 @@ name: haproxy title: HAProxy -version: "1.7.2" +version: "1.8.3" description: Collect logs and metrics from HAProxy servers with Elastic Agent. type: integration icons: diff --git a/packages/hashicorp_vault/_dev/build/build.yml b/packages/hashicorp_vault/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/hashicorp_vault/_dev/build/build.yml +++ b/packages/hashicorp_vault/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/hashicorp_vault/changelog.yml b/packages/hashicorp_vault/changelog.yml index b8ddb909bf9..f756b280981 100644 --- a/packages/hashicorp_vault/changelog.yml +++ b/packages/hashicorp_vault/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.13.0" + changes: + - description: Update package spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/1 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 2fb9a95c9bf..2aecdac7fd6 100644 --- a/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-12-01T20:29:04.356Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -93,7 +93,7 @@ { "@timestamp": "2020-12-01T20:29:04.360Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -202,7 +202,7 @@ { "@timestamp": "2021-07-19T17:19:00.673Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -260,7 +260,7 @@ { "@timestamp": "2021-07-19T17:19:00.674Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -324,7 +324,7 @@ { "@timestamp": "2021-06-29T17:26:11.402Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -407,7 +407,7 @@ { "@timestamp": "2021-06-29T17:26:11.409Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -504,7 +504,7 @@ { "@timestamp": "2021-06-29T18:01:29.545Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -585,7 +585,7 @@ { "@timestamp": "2021-06-29T18:01:29.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -710,7 +710,7 @@ { "@timestamp": "2021-12-30T17:11:12.468Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "help", diff --git a/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-faked-all-fields.log-expected.json b/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-faked-all-fields.log-expected.json index 6550bd9b5a6..65b410591d4 100644 --- a/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-faked-all-fields.log-expected.json +++ b/packages/hashicorp_vault/data_stream/audit/_dev/test/pipeline/test-faked-all-fields.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-04-09T21:04:29.640Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -69,7 +69,7 @@ { "@timestamp": "2018-04-09T21:04:29.642Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -163,7 +163,7 @@ { "@timestamp": "2021-07-21T12:37:50.936Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -252,7 +252,7 @@ { "@timestamp": "2021-07-21T12:37:50.936Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", diff --git a/packages/hashicorp_vault/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/hashicorp_vault/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index d83e4334796..cfb16349f5e 100644 --- a/packages/hashicorp_vault/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hashicorp_vault/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Hashicorp Vault audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/hashicorp_vault/data_stream/audit/fields/fields.yml b/packages/hashicorp_vault/data_stream/audit/fields/fields.yml index 7160926e50d..fba63956091 100644 --- a/packages/hashicorp_vault/data_stream/audit/fields/fields.yml +++ b/packages/hashicorp_vault/data_stream/audit/fields/fields.yml @@ -47,14 +47,14 @@ - name: policy_results.allowed type: boolean - name: policy_results.granting_policies - type: array - object_type: object - - name: policy_results.granting_policies.name - type: keyword - - name: policy_results.granting_policies.namespace_id - type: keyword - - name: policy_results.granting_policies.type - type: keyword + type: group + fields: + - name: name + type: keyword + - name: namespace_id + type: keyword + - name: type + type: keyword - name: remaining_uses type: long - name: token_issue_time diff --git a/packages/hashicorp_vault/data_stream/audit/sample_event.json b/packages/hashicorp_vault/data_stream/audit/sample_event.json index 217ac9653fc..98bbbbfb542 100644 --- a/packages/hashicorp_vault/data_stream/audit/sample_event.json +++ b/packages/hashicorp_vault/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-08-18T17:07:22.769Z", + "@timestamp": "2023-07-20T13:39:22.108Z", "agent": { - "ephemeral_id": "623671b3-bcc9-4060-9806-e1cb0b945aae", - "id": "03109bfa-7015-46bd-9433-3879357210cd", + "ephemeral_id": "a7c83396-040f-439b-a855-c30ecdf1e604", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.8.2" }, "data_stream": { "dataset": "hashicorp_vault.audit", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "03109bfa-7015-46bd-9433-3879357210cd", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.3.2" + "version": "8.8.2" }, "event": { "action": "update", @@ -27,10 +27,10 @@ "authentication" ], "dataset": "hashicorp_vault.audit", - "id": "e54c706f-1a3d-9662-3705-872e05c9c39f", - "ingested": "2022-08-18T17:07:55Z", + "id": "07b55e76-c58c-7911-f1a2-a19692c37e43", + "ingested": "2023-07-20T13:39:50Z", "kind": "event", - "original": "{\"time\":\"2022-08-18T17:07:22.76907021Z\",\"type\":\"request\",\"auth\":{\"token_type\":\"default\"},\"request\":{\"id\":\"e54c706f-1a3d-9662-3705-872e05c9c39f\",\"operation\":\"update\",\"namespace\":{\"id\":\"root\"},\"path\":\"sys/audit/test\"}}", + "original": "{\"time\":\"2023-07-20T13:39:22.1089946Z\",\"type\":\"request\",\"auth\":{\"token_type\":\"default\"},\"request\":{\"id\":\"07b55e76-c58c-7911-f1a2-a19692c37e43\",\"operation\":\"update\",\"namespace\":{\"id\":\"root\"},\"path\":\"sys/audit/test\"}}", "outcome": "success", "type": [ "change" @@ -42,7 +42,7 @@ "token_type": "default" }, "request": { - "id": "e54c706f-1a3d-9662-3705-872e05c9c39f", + "id": "07b55e76-c58c-7911-f1a2-a19692c37e43", "namespace": { "id": "root" }, @@ -54,23 +54,24 @@ }, "host": { "architecture": "x86_64", - "containerized": false, + "containerized": true, "hostname": "docker-fleet-agent", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.23.0.7" + "172.22.0.10" ], "mac": [ - "02:42:ac:17:00:07" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", - "kernel": "5.10.76-linuxkit", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { diff --git a/packages/hashicorp_vault/data_stream/log/_dev/test/pipeline/test-log.log-expected.json b/packages/hashicorp_vault/data_stream/log/_dev/test/pipeline/test-log.log-expected.json index 244c7eb902c..00008b39452 100644 --- a/packages/hashicorp_vault/data_stream/log/_dev/test/pipeline/test-log.log-expected.json +++ b/packages/hashicorp_vault/data_stream/log/_dev/test/pipeline/test-log.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-07-16T06:30:48.194Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -27,7 +27,7 @@ { "@timestamp": "2021-07-16T06:33:08.867Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -50,7 +50,7 @@ { "@timestamp": "2021-07-09T17:20:27.184Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -77,7 +77,7 @@ { "@timestamp": "2021-07-09T17:20:27.190Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -100,7 +100,7 @@ { "@timestamp": "2021-07-09T17:20:27.182Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -127,7 +127,7 @@ { "@timestamp": "2021-07-09T17:20:27.212Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -151,7 +151,7 @@ { "@timestamp": "2021-07-09T17:04:06.945Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -175,7 +175,7 @@ { "@timestamp": "2021-07-16T19:05:02.795Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -198,7 +198,7 @@ { "@timestamp": "2021-07-09T17:01:42.203Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -222,7 +222,7 @@ { "@timestamp": "2021-07-22T17:33:20.689Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -245,7 +245,7 @@ { "@timestamp": "2021-07-22T17:33:20.689Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -272,7 +272,7 @@ { "@timestamp": "2021-07-22T17:33:20.691Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/hashicorp_vault/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/hashicorp_vault/data_stream/log/elasticsearch/ingest_pipeline/default.yml index a34dc98e478..abe63b07610 100644 --- a/packages/hashicorp_vault/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hashicorp_vault/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Hashicorp Vault operational logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/hashicorp_vault/data_stream/log/sample_event.json b/packages/hashicorp_vault/data_stream/log/sample_event.json index 9d69ed3398e..5495a27c36f 100644 --- a/packages/hashicorp_vault/data_stream/log/sample_event.json +++ b/packages/hashicorp_vault/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-01-13T01:56:49.423Z", + "@timestamp": "2023-07-20T13:40:29.312Z", "agent": { - "ephemeral_id": "519f95f7-ce93-4b23-b4ba-cb55bee8d69c", - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "ephemeral_id": "a7c83396-040f-439b-a855-c30ecdf1e604", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.2" }, "data_stream": { "dataset": "hashicorp_vault.log", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "dataset": "hashicorp_vault.log", - "ingested": "2022-01-13T01:57:16Z", + "ingested": "2023-07-20T13:40:57Z", "kind": "event", - "original": "{\"@level\":\"info\",\"@message\":\"proxy environment\",\"@timestamp\":\"2022-01-13T01:56:49.423084Z\",\"http_proxy\":\"\",\"https_proxy\":\"\",\"no_proxy\":\"\"}" + "original": "{\"@level\":\"info\",\"@message\":\"proxy environment\",\"@timestamp\":\"2023-07-20T13:40:29.312131Z\",\"http_proxy\":\"\",\"https_proxy\":\"\",\"no_proxy\":\"\"}" }, "hashicorp_vault": { "log": { @@ -38,22 +38,22 @@ "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "4ccba669f0df47fa3f57a9e4169ae7f1", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.18.0.4" + "172.22.0.10" ], "mac": [ - "02:42:ac:12:00:04" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-44-generic", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -64,7 +64,7 @@ "path": "/tmp/service_logs/log.json" }, "level": "info", - "offset": 679 + "offset": 709 }, "message": "proxy environment", "tags": [ diff --git a/packages/hashicorp_vault/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml b/packages/hashicorp_vault/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml index 639c9a0ecf3..df928788269 100644 --- a/packages/hashicorp_vault/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hashicorp_vault/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml @@ -11,7 +11,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: service.type value: hashicorp_vault diff --git a/packages/hashicorp_vault/data_stream/metrics/sample_event.json b/packages/hashicorp_vault/data_stream/metrics/sample_event.json index d84a3e56b03..205f8da921f 100644 --- a/packages/hashicorp_vault/data_stream/metrics/sample_event.json +++ b/packages/hashicorp_vault/data_stream/metrics/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-01-13T01:58:13.388Z", + "@timestamp": "2023-07-20T13:42:02.506Z", "agent": { - "ephemeral_id": "6c9fb82b-59c7-43dd-b429-5d5a8f60f994", - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "ephemeral_id": "08f3f73e-194c-4c7b-b9a9-5de2971266e7", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "metricbeat", - "version": "8.0.0-beta1" + "version": "8.8.2" }, "data_stream": { "dataset": "hashicorp_vault.metrics", @@ -13,132 +13,23 @@ "type": "metrics" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", - "duration": 2522433, - "ingested": "2022-01-13T01:58:13Z", + "duration": 8463400, + "ingested": "2023-07-20T13:42:03Z", "kind": "metric" }, "hashicorp_vault": { "metrics": { - "go_gc_duration_seconds_count": { - "counter": 6, - "rate": 0 - }, - "go_gc_duration_seconds_sum": { - "counter": 0.000178341, - "rate": 0 - }, - "go_goroutines": { - "value": 235 - }, - "go_memstats_alloc_bytes": { - "value": 12255384 - }, - "go_memstats_alloc_bytes_total": { - "counter": 34001072, - "rate": 0 - }, - "go_memstats_buck_hash_sys_bytes": { - "value": 1463139 - }, - "go_memstats_frees_total": { - "counter": 150857, - "rate": 0 - }, - "go_memstats_gc_cpu_fraction": { - "value": 0.0019060616740776953 - }, - "go_memstats_gc_sys_bytes": { - "value": 5881672 - }, - "go_memstats_heap_alloc_bytes": { - "value": 12255384 - }, - "go_memstats_heap_idle_bytes": { - "value": 50307072 - }, - "go_memstats_heap_inuse_bytes": { - "value": 15523840 - }, - "go_memstats_heap_objects": { - "value": 47319 - }, - "go_memstats_heap_released_bytes": { - "value": 44326912 - }, - "go_memstats_heap_sys_bytes": { - "value": 65830912 - }, - "go_memstats_last_gc_time_seconds": { - "value": 1642039090.5779526 - }, - "go_memstats_lookups_total": { - "counter": 0, - "rate": 0 - }, - "go_memstats_mallocs_total": { - "counter": 198176, - "rate": 0 - }, - "go_memstats_mcache_inuse_bytes": { - "value": 1200 - }, - "go_memstats_mcache_sys_bytes": { - "value": 16384 - }, - "go_memstats_mspan_inuse_bytes": { - "value": 175440 - }, - "go_memstats_mspan_sys_bytes": { - "value": 196608 - }, - "go_memstats_next_gc_bytes": { - "value": 24046448 - }, - "go_memstats_other_sys_bytes": { - "value": 389469 - }, - "go_memstats_stack_inuse_bytes": { - "value": 1277952 - }, - "go_memstats_stack_sys_bytes": { - "value": 1277952 - }, - "go_memstats_sys_bytes": { - "value": 75056136 - }, - "go_threads": { - "value": 6 - }, - "process_cpu_seconds_total": { - "counter": 0.12, - "rate": 0 - }, - "process_max_fds": { - "value": 1048576 - }, - "process_open_fds": { - "value": 12 - }, - "process_resident_memory_bytes": { - "value": 94257152 - }, - "process_start_time_seconds": { - "value": 1642039069.4 - }, - "process_virtual_memory_bytes": { - "value": 852996096 - }, - "process_virtual_memory_max_bytes": { - "value": -1 + "vault_barrier_get": { + "value": 0.06210000067949295 } } }, @@ -146,27 +37,29 @@ "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "4ccba669f0df47fa3f57a9e4169ae7f1", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.18.0.4" + "172.22.0.10" ], "mac": [ - "02:42:ac:12:00:04" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-44-generic", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "labels": { + "host": "hashicorp_vault", "instance": "hashicorp_vault:8200", - "job": "hashicorp_vault" + "job": "hashicorp_vault", + "quantile": "0.9" }, "metricset": { "period": 5000 diff --git a/packages/hashicorp_vault/docs/README.md b/packages/hashicorp_vault/docs/README.md index 80b61179536..d4cf1a2c86f 100644 --- a/packages/hashicorp_vault/docs/README.md +++ b/packages/hashicorp_vault/docs/README.md @@ -83,13 +83,13 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2022-08-18T17:07:22.769Z", + "@timestamp": "2023-07-20T13:39:22.108Z", "agent": { - "ephemeral_id": "623671b3-bcc9-4060-9806-e1cb0b945aae", - "id": "03109bfa-7015-46bd-9433-3879357210cd", + "ephemeral_id": "a7c83396-040f-439b-a855-c30ecdf1e604", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.8.2" }, "data_stream": { "dataset": "hashicorp_vault.audit", @@ -97,12 +97,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "03109bfa-7015-46bd-9433-3879357210cd", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.3.2" + "version": "8.8.2" }, "event": { "action": "update", @@ -111,10 +111,10 @@ An example event for `audit` looks as following: "authentication" ], "dataset": "hashicorp_vault.audit", - "id": "e54c706f-1a3d-9662-3705-872e05c9c39f", - "ingested": "2022-08-18T17:07:55Z", + "id": "07b55e76-c58c-7911-f1a2-a19692c37e43", + "ingested": "2023-07-20T13:39:50Z", "kind": "event", - "original": "{\"time\":\"2022-08-18T17:07:22.76907021Z\",\"type\":\"request\",\"auth\":{\"token_type\":\"default\"},\"request\":{\"id\":\"e54c706f-1a3d-9662-3705-872e05c9c39f\",\"operation\":\"update\",\"namespace\":{\"id\":\"root\"},\"path\":\"sys/audit/test\"}}", + "original": "{\"time\":\"2023-07-20T13:39:22.1089946Z\",\"type\":\"request\",\"auth\":{\"token_type\":\"default\"},\"request\":{\"id\":\"07b55e76-c58c-7911-f1a2-a19692c37e43\",\"operation\":\"update\",\"namespace\":{\"id\":\"root\"},\"path\":\"sys/audit/test\"}}", "outcome": "success", "type": [ "change" @@ -126,7 +126,7 @@ An example event for `audit` looks as following: "token_type": "default" }, "request": { - "id": "e54c706f-1a3d-9662-3705-872e05c9c39f", + "id": "07b55e76-c58c-7911-f1a2-a19692c37e43", "namespace": { "id": "root" }, @@ -138,23 +138,24 @@ An example event for `audit` looks as following: }, "host": { "architecture": "x86_64", - "containerized": false, + "containerized": true, "hostname": "docker-fleet-agent", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.23.0.7" + "172.22.0.10" ], "mac": [ - "02:42:ac:17:00:07" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", - "kernel": "5.10.76-linuxkit", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -186,7 +187,7 @@ An example event for `audit` looks as following: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -201,7 +202,6 @@ An example event for `audit` looks as following: | hashicorp_vault.audit.auth.no_default_policy | Indicates that the default policy should not be added by core when creating a token. The default policy will still be added if it's explicitly defined. | boolean | | hashicorp_vault.audit.auth.policies | Policies is the list of policies that the authenticated user is associated with. | keyword | | hashicorp_vault.audit.auth.policy_results.allowed | | boolean | -| hashicorp_vault.audit.auth.policy_results.granting_policies | | array | | hashicorp_vault.audit.auth.policy_results.granting_policies.name | | keyword | | hashicorp_vault.audit.auth.policy_results.granting_policies.namespace_id | | keyword | | hashicorp_vault.audit.auth.policy_results.granting_policies.type | | keyword | @@ -317,13 +317,13 @@ An example event for `log` looks as following: ```json { - "@timestamp": "2022-01-13T01:56:49.423Z", + "@timestamp": "2023-07-20T13:40:29.312Z", "agent": { - "ephemeral_id": "519f95f7-ce93-4b23-b4ba-cb55bee8d69c", - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "ephemeral_id": "a7c83396-040f-439b-a855-c30ecdf1e604", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.2" }, "data_stream": { "dataset": "hashicorp_vault.log", @@ -331,19 +331,19 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "9878d192-22ad-49b6-a6c2-9959b0815d04", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "dataset": "hashicorp_vault.log", - "ingested": "2022-01-13T01:57:16Z", + "ingested": "2023-07-20T13:40:57Z", "kind": "event", - "original": "{\"@level\":\"info\",\"@message\":\"proxy environment\",\"@timestamp\":\"2022-01-13T01:56:49.423084Z\",\"http_proxy\":\"\",\"https_proxy\":\"\",\"no_proxy\":\"\"}" + "original": "{\"@level\":\"info\",\"@message\":\"proxy environment\",\"@timestamp\":\"2023-07-20T13:40:29.312131Z\",\"http_proxy\":\"\",\"https_proxy\":\"\",\"no_proxy\":\"\"}" }, "hashicorp_vault": { "log": { @@ -356,22 +356,22 @@ An example event for `log` looks as following: "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "4ccba669f0df47fa3f57a9e4169ae7f1", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.18.0.4" + "172.22.0.10" ], "mac": [ - "02:42:ac:12:00:04" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-44-generic", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -382,7 +382,7 @@ An example event for `log` looks as following: "path": "/tmp/service_logs/log.json" }, "level": "info", - "offset": 679 + "offset": 709 }, "message": "proxy environment", "tags": [ @@ -402,7 +402,7 @@ An example event for `log` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | @@ -446,8 +446,8 @@ telemetry { | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | hashicorp_vault.metrics.\*.\* | Hashicorp Vault telemetry data from the Prometheus endpoint. | | | labels | Custom key/value pairs. Can be used to add meta information to events. Should not contain nested objects. All values are stored as keyword. Example: `docker` and `k8s` labels. | object | diff --git a/packages/hashicorp_vault/kibana/tags.yml b/packages/hashicorp_vault/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/hashicorp_vault/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/hashicorp_vault/manifest.yml b/packages/hashicorp_vault/manifest.yml index d0431a15463..c94044b0398 100644 --- a/packages/hashicorp_vault/manifest.yml +++ b/packages/hashicorp_vault/manifest.yml @@ -1,14 +1,12 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: hashicorp_vault title: Hashicorp Vault -version: "1.12.0" -license: basic +version: "1.15.0" description: Collect logs and metrics from Hashicorp Vault with Elastic Agent. type: integration categories: - security - iam -release: ga conditions: kibana.version: "^7.17.0 || ^8.0.0" screenshots: diff --git a/packages/hid_bravura_monitor/_dev/build/build.yml b/packages/hid_bravura_monitor/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/hid_bravura_monitor/_dev/build/build.yml +++ b/packages/hid_bravura_monitor/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/hid_bravura_monitor/changelog.yml b/packages/hid_bravura_monitor/changelog.yml index d2eae61bb52..1d1a32656d6 100644 --- a/packages/hid_bravura_monitor/changelog.yml +++ b/packages/hid_bravura_monitor/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.11.1" + changes: + - description: For field type consistency, use the ECS value for message and tags. + type: bugfix + link: https://github.com/elastic/integrations/pull/7873 +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.1" + changes: + - description: Make `winlog.time_created` a date. + type: bugfix + link: https://github.com/elastic/integrations/pull/7714 +- version: "1.10.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.9.1" + changes: + - description: Add missing lens visualization + type: enhancement + link: https://github.com/elastic/integrations/pull/7016 +- version: "1.9.0" + changes: + - description: Convert dashboards to Lens + type: enhancement + link: https://github.com/elastic/integrations/pull/6980 +- version: "1.8.1" + changes: + - description: Add ECS error.code mapping. + type: bugfix + link: https://github.com/elastic/integrations/issues/6766 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-common-config.yml b/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-common-config.yml index 008bb435357..32bf8bb64fd 100644 --- a/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-common-config.yml +++ b/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-common-config.yml @@ -1,5 +1,3 @@ -dynamic_fields: - event.ingested: "^.*$" multiline: first_line_pattern: ^[[:cntrl:]] negate: true diff --git a/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-hid-bravura-monitor.log-expected.json b/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-hid-bravura-monitor.log-expected.json index 61447cc053d..569bed9241f 100644 --- a/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-hid-bravura-monitor.log-expected.json +++ b/packages/hid_bravura_monitor/data_stream/log/_dev/test/pipeline/test-hid-bravura-monitor.log-expected.json @@ -3,10 +3,9 @@ { "@timestamp": "2021-01-16T00:38:18.515Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610112056Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -33,10 +32,9 @@ { "@timestamp": "2021-01-16T00:35:25.258Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610120699Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -63,10 +61,9 @@ { "@timestamp": "2021-01-27T00:31:24.499Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610121956Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -93,10 +90,9 @@ { "@timestamp": "2021-01-16T00:35:34.317Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610122717Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -123,10 +119,9 @@ { "@timestamp": "2021-02-05T08:41:11.845Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610123443Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -160,10 +155,9 @@ { "@timestamp": "2021-01-16T11:54:34.234Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610124137Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -197,10 +191,9 @@ { "@timestamp": "2021-10-21T19:13:31.679Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610124828Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -227,10 +220,9 @@ { "@timestamp": "2021-01-16T00:35:32.941Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610125538Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -269,10 +261,9 @@ { "@timestamp": "2021-01-16T11:54:18.663Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610126213Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -308,10 +299,9 @@ { "@timestamp": "2021-02-05T08:41:11.845Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610126906Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -345,10 +335,9 @@ { "@timestamp": "2021-02-05T08:41:11.845Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610127599Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -380,10 +369,9 @@ { "@timestamp": "2021-02-05T08:43:13.839Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610128423Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -416,10 +404,9 @@ { "@timestamp": "2021-01-16T11:54:25.839Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610129129Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -452,10 +439,9 @@ { "@timestamp": "2021-01-27T14:36:47.026Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610129816Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -489,10 +475,9 @@ { "@timestamp": "2021-02-04T18:03:38.605Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610130572Z", "timezone": "UTC" }, "hid_bravura_monitor": { @@ -527,10 +512,9 @@ { "@timestamp": "2021-01-16T00:35:32.958Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "ingested": "2023-05-25T20:28:48.610131254Z", "timezone": "UTC" }, "hid_bravura_monitor": { diff --git a/packages/hid_bravura_monitor/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/hid_bravura_monitor/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 667837414da..fd341035e5f 100644 --- a/packages/hid_bravura_monitor/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hid_bravura_monitor/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,11 +3,8 @@ description: Pipeline for parsing hid_bravura_monitor logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' description: Set ecs.version to 1.12.0 - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - rename: field: message target_field: event.original diff --git a/packages/hid_bravura_monitor/data_stream/log/manifest.yml b/packages/hid_bravura_monitor/data_stream/log/manifest.yml index 9fb3ecad05d..b6d462360a9 100644 --- a/packages/hid_bravura_monitor/data_stream/log/manifest.yml +++ b/packages/hid_bravura_monitor/data_stream/log/manifest.yml @@ -62,9 +62,8 @@ streams: multi: false required: false show_user: false - description: > + description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - template_path: filestream.yml.hbs title: Bravura Monitor description: Collect Bravura Security Fabric logs using filestream input diff --git a/packages/hid_bravura_monitor/data_stream/log/sample_event.json b/packages/hid_bravura_monitor/data_stream/log/sample_event.json index 5e6415f2c3f..a920ac8b184 100644 --- a/packages/hid_bravura_monitor/data_stream/log/sample_event.json +++ b/packages/hid_bravura_monitor/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "02ab444e-ca97-437b-85dc-d580f055047c", diff --git a/packages/hid_bravura_monitor/data_stream/winlog/_dev/test/pipeline/test-hid-bravura-monitor-events.json-expected.json b/packages/hid_bravura_monitor/data_stream/winlog/_dev/test/pipeline/test-hid-bravura-monitor-events.json-expected.json index 77d7c66389a..2fa02aaeec0 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/_dev/test/pipeline/test-hid-bravura-monitor-events.json-expected.json +++ b/packages/hid_bravura_monitor/data_stream/winlog/_dev/test/pipeline/test-hid-bravura-monitor-events.json-expected.json @@ -3,11 +3,10 @@ { "@timestamp": "2020-05-13T09:04:04.755Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "118", - "ingested": "2023-05-25T20:28:48.834270180Z", "kind": "event", "provider": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" }, @@ -46,11 +45,10 @@ { "@timestamp": "2021-11-03T20:05:14.092Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "64", - "ingested": "2023-05-25T20:28:48.834279809Z", "kind": "event", "provider": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" }, @@ -92,11 +90,10 @@ { "@timestamp": "2021-11-03T20:05:14.092Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "94", - "ingested": "2023-05-25T20:28:48.834281223Z", "kind": "event", "provider": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" }, diff --git a/packages/hid_bravura_monitor/data_stream/winlog/elasticsearch/ingest_pipeline/default.yml b/packages/hid_bravura_monitor/data_stream/winlog/elasticsearch/ingest_pipeline/default.yml index 9305970d9e9..889ac617c14 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/elasticsearch/ingest_pipeline/default.yml +++ b/packages/hid_bravura_monitor/data_stream/winlog/elasticsearch/ingest_pipeline/default.yml @@ -1,10 +1,6 @@ --- description: Pipeline for Bravura Security Fabric events processors: - - set: - field: event.ingested - value: '{{_ingest.timestamp}}' - - convert: field: event.code type: string @@ -355,7 +351,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: log.level diff --git a/packages/hid_bravura_monitor/data_stream/winlog/fields/base-fields.yml b/packages/hid_bravura_monitor/data_stream/winlog/fields/base-fields.yml index ecf4acb535d..402f240b6be 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/fields/base-fields.yml +++ b/packages/hid_bravura_monitor/data_stream/winlog/fields/base-fields.yml @@ -19,8 +19,3 @@ type: constant_keyword description: Event dataset. value: hid_bravura_monitor.winlog -- name: tags - description: List of keywords used to tag each event. - example: '["production", "env2"]' - ignore_above: 1024 - type: keyword diff --git a/packages/hid_bravura_monitor/data_stream/winlog/fields/ecs.yml b/packages/hid_bravura_monitor/data_stream/winlog/fields/ecs.yml index 6e6c455ef16..c0a1667ddf5 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/fields/ecs.yml +++ b/packages/hid_bravura_monitor/data_stream/winlog/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: ecs.version +- external: ecs + name: error.code - external: ecs name: event.action - external: ecs @@ -32,6 +34,8 @@ name: log.file.path - external: ecs name: log.level +- external: ecs + name: message - external: ecs name: process.args - external: ecs @@ -70,6 +74,8 @@ name: source.ip - external: ecs name: source.port +- external: ecs + name: tags - external: ecs name: user.domain - external: ecs diff --git a/packages/hid_bravura_monitor/data_stream/winlog/fields/fields.yml b/packages/hid_bravura_monitor/data_stream/winlog/fields/fields.yml index c2676bab52f..4220dcce483 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/fields/fields.yml +++ b/packages/hid_bravura_monitor/data_stream/winlog/fields/fields.yml @@ -1,6 +1,3 @@ - name: winlog.symbolic_id type: keyword description: Symbolic event id -- name: message - type: keyword - description: initial raw message diff --git a/packages/hid_bravura_monitor/data_stream/winlog/fields/winlog.yml b/packages/hid_bravura_monitor/data_stream/winlog/fields/winlog.yml index 9d6d57c7473..41148c7735c 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/fields/winlog.yml +++ b/packages/hid_bravura_monitor/data_stream/winlog/fields/winlog.yml @@ -5,7 +5,6 @@ fields: - name: api - required: true type: keyword description: > The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. @@ -14,19 +13,16 @@ - name: activity_id type: keyword - required: false description: > A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. - name: channel type: keyword - required: true description: > The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. - name: computer_name type: keyword - required: true description: > The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. @@ -45,7 +41,6 @@ - name: event_data type: object object_type: keyword - required: false description: > The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. @@ -227,92 +222,75 @@ type: keyword - name: event_id type: keyword - required: true description: > The event identifier. The value is specific to the source of the event. - name: keywords type: keyword - required: false description: > The keywords are used to classify an event. - name: level type: keyword - required: false description: > The event severity. Levels are Critical, Error, Warning and Information, Verbose - name: outcome type: keyword - required: false description: > Success or Failure of the event. - name: record_id type: keyword - required: true description: > The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. - name: related_activity_id type: keyword - required: false description: > A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. - name: opcode type: keyword - required: false description: > The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. - name: provider_guid type: keyword - required: false description: > A globally unique identifier that identifies the provider that logged the event. - name: process.pid type: long - required: false description: > The process_id of the Client Server Runtime Process. - name: provider_name type: keyword - required: true description: > The source of the event log record (the application or service that logged the record). - name: task type: keyword - required: false description: > The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. - name: time_created - type: keyword - required: false + type: date description: > Time event was created - name: trustAttribute type: keyword - required: false - name: trustDirection type: keyword - required: false - name: trustType type: keyword - required: false - name: process.thread.id type: long - required: false - name: user_data type: object object_type: keyword - required: false description: > The event specific data. This field is mutually exclusive with `event_data`. @@ -328,17 +306,14 @@ - name: user.domain type: keyword - required: false description: > The domain that the account associated with this event is a member of. - name: user.type type: keyword - required: false description: > The type of account associated with this event. - name: version type: long - required: false description: The version number of the event's definition. diff --git a/packages/hid_bravura_monitor/data_stream/winlog/sample_event.json b/packages/hid_bravura_monitor/data_stream/winlog/sample_event.json index 12b693a52e3..d8c325b8e72 100644 --- a/packages/hid_bravura_monitor/data_stream/winlog/sample_event.json +++ b/packages/hid_bravura_monitor/data_stream/winlog/sample_event.json @@ -85,6 +85,6 @@ "type": "filebeat" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" } } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/docs/README.md b/packages/hid_bravura_monitor/docs/README.md index 6a5395d7c3e..624301acb7b 100644 --- a/packages/hid_bravura_monitor/docs/README.md +++ b/packages/hid_bravura_monitor/docs/README.md @@ -167,7 +167,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "02ab444e-ca97-437b-85dc-d580f055047c", @@ -285,16 +285,16 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | @@ -523,7 +523,7 @@ An example event for `winlog` looks as following: "type": "filebeat" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" } } ``` @@ -550,13 +550,14 @@ An example event for `winlog` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -585,7 +586,7 @@ An example event for `winlog` looks as following: | input.type | Type of Filebeat input. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| message | initial raw message | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | | process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | | process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | @@ -714,7 +715,7 @@ An example event for `winlog` looks as following: | winlog.related_activity_id | A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. | keyword | | winlog.symbolic_id | Symbolic event id | keyword | | winlog.task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. | keyword | -| winlog.time_created | Time event was created | keyword | +| winlog.time_created | Time event was created | date | | winlog.trustAttribute | | keyword | | winlog.trustDirection | | keyword | | winlog.trustType | | keyword | diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499.json index 180fce6a7b0..d07ad25ca14 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY2OCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,162 +12,242 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Bravura Security Fabric: Log issues histogram", - "description": "", - "uiState": { - "vis": { - "colors": { - "Error": "#BF1B00", - "Warning": "#E5AC0E" - } - } - }, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-52740bd6-f519-4b0a-8b0e-85c14786883f", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "d9eda1a8-3014-429f-a9ca-d4c2f0f1154c", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "9378222b-6d1a-4d54-82dd-f3af373e882e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "52740bd6-f519-4b0a-8b0e-85c14786883f": { + "columnOrder": [ + "f6a20dce-89aa-4b0c-a4a3-01ab9b9bd4a3", + "cc6c1d0f-e837-4886-bb07-d7fd6d9b9f70", + "f059c9f9-1165-407a-948e-16bdf7b00ad3" + ], + "columns": { + "cc6c1d0f-e837-4886-bb07-d7fd6d9b9f70": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "log.level: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f059c9f9-1165-407a-948e-16bdf7b00ad3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "f059c9f9-1165-407a-948e-16bdf7b00ad3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f6a20dce-89aa-4b0c-a4a3-01ab9b9bd4a3": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "$state": { + "store": "appState" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "d9eda1a8-3014-429f-a9ca-d4c2f0f1154c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9378222b-6d1a-4d54-82dd-f3af373e882e", + "key": "log.level", + "negate": false, + "params": [ + "Warning", + "Error" + ], + "type": "phrases", + "value": "Warning, Error" }, - "schema": "group", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Warning" + } + }, + { + "match_phrase": { + "log.level": "Error" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "f059c9f9-1165-407a-948e-16bdf7b00ad3" + ], + "isHistogram": true, + "layerId": "52740bd6-f519-4b0a-8b0e-85c14786883f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "cc6c1d0f-e837-4886-bb07-d7fd6d9b9f70", + "xAccessor": "f6a20dce-89aa-4b0c-a4a3-01ab9b9bd4a3", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "f059c9f9-1165-407a-948e-16bdf7b00ad3" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Bravura Security Fabric: Log issues histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -185,75 +257,178 @@ "y": 0 }, "panelIndex": "16ceee80-adfc-4ecd-99f4-3f3160dce1f4", - "version": "8.0.0", - "type": "visualization" + "title": "Bravura Security Fabric: Log issues histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Bravura Security Fabric: Errors/Warnings by node", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b207bc7c-fedf-473a-b23e-2284a65200da", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60ba1555-b583-4f1b-b100-41ce5da01e72", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dd4e54bf-b32c-4d9c-a282-2df058ca9e2d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b207bc7c-fedf-473a-b23e-2284a65200da": { + "columnOrder": [ + "01ea4f68-92c4-4046-9b6d-c14cb25fb716", + "bf028560-ed82-47fd-9b22-0c8901aa01f5" + ], + "columns": { + "01ea4f68-92c4-4046-9b6d-c14cb25fb716": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Instance", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf028560-ed82-47fd-9b22-0c8901aa01f5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + }, + "bf028560-ed82-47fd-9b22-0c8901aa01f5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "60ba1555-b583-4f1b-b100-41ce5da01e72", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Instance", - "field": "agent.hostname", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "dd4e54bf-b32c-4d9c-a282-2df058ca9e2d", + "key": "log.level", + "negate": false, + "params": [ + "Warning", + "Error" + ], + "type": "phrases", + "value": "Warning, Error" }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Warning" + } + }, + { + "match_phrase": { + "log.level": "Error" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "bf028560-ed82-47fd-9b22-0c8901aa01f5" + }, + { + "alignment": "left", + "columnId": "01ea4f68-92c4-4046-9b6d-c14cb25fb716" + } + ], + "headerRowHeight": "single", + "layerId": "b207bc7c-fedf-473a-b23e-2284a65200da", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Bravura Security Fabric: Errors/Warnings by node (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -263,75 +438,178 @@ "y": 15 }, "panelIndex": "b64ac48c-d9e4-4dfa-9ddd-05117c054c44", - "version": "8.0.0", - "type": "visualization" + "title": "Bravura Security Fabric: Errors/Warnings by node", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Bravura Security Fabric: Errors/Warnings by level", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c2dff8ef-1fe2-4acd-a960-15335897ad92", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0930b064-cb3b-4ac6-bebd-01c8c1d40a7b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1d7668e3-fb39-43ca-806a-dcf36121e089", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c2dff8ef-1fe2-4acd-a960-15335897ad92": { + "columnOrder": [ + "36f170fd-cad0-4df3-a18b-a55738f527d2", + "d935d1e4-51a7-4899-9327-d2acfa561aad" + ], + "columns": { + "36f170fd-cad0-4df3-a18b-a55738f527d2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Level", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d935d1e4-51a7-4899-9327-d2acfa561aad", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "d935d1e4-51a7-4899-9327-d2acfa561aad": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0930b064-cb3b-4ac6-bebd-01c8c1d40a7b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Level", - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "1d7668e3-fb39-43ca-806a-dcf36121e089", + "key": "log.level", + "negate": false, + "params": [ + "Warning", + "Error" + ], + "type": "phrases", + "value": "Warning, Error" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Warning" + } + }, + { + "match_phrase": { + "log.level": "Error" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "d935d1e4-51a7-4899-9327-d2acfa561aad" + }, + { + "alignment": "left", + "columnId": "36f170fd-cad0-4df3-a18b-a55738f527d2" + } + ], + "headerRowHeight": "single", + "layerId": "c2dff8ef-1fe2-4acd-a960-15335897ad92", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Bravura Security Fabric: Errors/Warnings by level (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -341,75 +619,181 @@ "y": 15 }, "panelIndex": "8b200051-1ac1-4008-b031-ba62127cb7b4", - "version": "8.0.0", - "type": "visualization" + "title": "Bravura Security Fabric: Errors/Warnings by level", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Bravura Security Fabric: Errors/Warnings by process", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e826808a-7a1b-4326-9cf4-ae67dc36d34d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e7e956ae-37e3-4014-9dc6-bf425f2870d3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3ae7a6ae-e32e-4781-a8f2-32a401d38b71", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e826808a-7a1b-4326-9cf4-ae67dc36d34d": { + "columnOrder": [ + "44dc2adb-1946-4661-9254-0755560cde8a", + "2934754e-8d2c-48e5-a282-80302a6b8f72" + ], + "columns": { + "2934754e-8d2c-48e5-a282-80302a6b8f72": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "44dc2adb-1946-4661-9254-0755560cde8a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2934754e-8d2c-48e5-a282-80302a6b8f72", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e7e956ae-37e3-4014-9dc6-bf425f2870d3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Process", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "3ae7a6ae-e32e-4781-a8f2-32a401d38b71", + "key": "log.level", + "negate": false, + "params": [ + "Warning", + "Error" + ], + "type": "phrases", + "value": [ + "Warning", + "Error" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Warning" + } + }, + { + "match_phrase": { + "log.level": "Error" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "2934754e-8d2c-48e5-a282-80302a6b8f72" + }, + { + "alignment": "left", + "columnId": "44dc2adb-1946-4661-9254-0755560cde8a" + } + ], + "headerRowHeight": "single", + "layerId": "e826808a-7a1b-4326-9cf4-ae67dc36d34d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -419,38 +803,82 @@ "y": 15 }, "panelIndex": "9cd7264a-0271-4e4a-9fe7-67f7fc60d349", - "version": "8.0.0", - "type": "visualization" + "title": "Bravura Security Fabric: Errors/Warnings by process", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Log issues - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T08:08:23.960Z", + "id": "hid_bravura_monitor-0665f160-f956-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "search", - "name": "16ceee80-adfc-4ecd-99f4-3f3160dce1f4:search_0", - "id": "hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "16ceee80-adfc-4ecd-99f4-3f3160dce1f4:indexpattern-datasource-layer-52740bd6-f519-4b0a-8b0e-85c14786883f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16ceee80-adfc-4ecd-99f4-3f3160dce1f4:d9eda1a8-3014-429f-a9ca-d4c2f0f1154c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16ceee80-adfc-4ecd-99f4-3f3160dce1f4:9378222b-6d1a-4d54-82dd-f3af373e882e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b64ac48c-d9e4-4dfa-9ddd-05117c054c44:indexpattern-datasource-layer-b207bc7c-fedf-473a-b23e-2284a65200da", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b64ac48c-d9e4-4dfa-9ddd-05117c054c44:60ba1555-b583-4f1b-b100-41ce5da01e72", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b64ac48c-d9e4-4dfa-9ddd-05117c054c44:dd4e54bf-b32c-4d9c-a282-2df058ca9e2d", + "type": "index-pattern" }, { - "type": "search", - "name": "b64ac48c-d9e4-4dfa-9ddd-05117c054c44:search_0", - "id": "hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "8b200051-1ac1-4008-b031-ba62127cb7b4:indexpattern-datasource-layer-c2dff8ef-1fe2-4acd-a960-15335897ad92", + "type": "index-pattern" }, { - "type": "search", - "name": "8b200051-1ac1-4008-b031-ba62127cb7b4:search_0", - "id": "hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "8b200051-1ac1-4008-b031-ba62127cb7b4:0930b064-cb3b-4ac6-bebd-01c8c1d40a7b", + "type": "index-pattern" }, { - "type": "search", - "name": "9cd7264a-0271-4e4a-9fe7-67f7fc60d349:search_0", - "id": "hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "8b200051-1ac1-4008-b031-ba62127cb7b4:1d7668e3-fb39-43ca-806a-dcf36121e089", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9cd7264a-0271-4e4a-9fe7-67f7fc60d349:indexpattern-datasource-layer-e826808a-7a1b-4326-9cf4-ae67dc36d34d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9cd7264a-0271-4e4a-9fe7-67f7fc60d349:e7e956ae-37e3-4014-9dc6-bf425f2870d3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9cd7264a-0271-4e4a-9fe7-67f7fc60d349:3ae7a6ae-e32e-4781-a8f2-32a401d38b71", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499.json index a7595635f20..dc04f55f64c 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY2OSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,98 +12,210 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 10 Disabled Profiles", - "description": "", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bb212cb2-0aa1-47fe-ae75-5ea010d8b498", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d03973b8-7809-4d23-942b-a4c18e1c595c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d13ca39-cae5-4fb3-a7aa-b119027ad631", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d596e134-f7ec-4b8b-83f4-05d07aba0726", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bb212cb2-0aa1-47fe-ae75-5ea010d8b498": { + "columnOrder": [ + "7d085112-33f4-4e16-acf5-50fcb1d2c913", + "fdd4143b-ca7c-41a4-9cd6-583eaad27e5f" + ], + "columns": { + "7d085112-33f4-4e16-acf5-50fcb1d2c913": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Profile", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fdd4143b-ca7c-41a4-9cd6-583eaad27e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "winlog.event_data.Profile" + }, + "fdd4143b-ca7c-41a4-9cd6-583eaad27e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d03973b8-7809-4d23-942b-a4c18e1c595c", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Profile", - "field": "winlog.event_data.Profile", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8d13ca39-cae5-4fb3-a7aa-b119027ad631", + "key": "event.code", + "negate": false, + "params": [ + "30", + "31" + ], + "type": "phrases", + "value": [ + "30", + "31" + ] }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "30" + } + }, + { + "match_phrase": { + "event.code": "31" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d596e134-f7ec-4b8b-83f4-05d07aba0726", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "30", - "31" - ], - "type": "phrases", - "value": "30, 31" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "30" - } - }, - { - "match_phrase": { - "event.code": "31" - } - } - ] - } - } + "alignment": "left", + "columnId": "fdd4143b-ca7c-41a4-9cd6-583eaad27e5f" + }, + { + "alignment": "left", + "columnId": "7d085112-33f4-4e16-acf5-50fcb1d2c913" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "bb212cb2-0aa1-47fe-ae75-5ea010d8b498", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Top 10 Disabled Profiles (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -121,174 +225,243 @@ "y": 0 }, "panelIndex": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6", - "version": "8.0.0", - "type": "visualization" + "title": "Top 10 Disabled Profiles", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Disabled Profiles Trend", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "fittingFunction": "zero", - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-65802bcc-35de-478a-ae19-a322eeb56847", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "6690701d-0819-4b28-9c05-60b77d037d0d", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "line", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "4c09fb79-dc6e-4ac5-a720-a32512210940", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "02308bbe-91fd-4b96-a9b5-aae2c8237711", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "65802bcc-35de-478a-ae19-a322eeb56847": { + "columnOrder": [ + "41baf020-4eba-4abe-8779-f64f6189dd59", + "ad4b114f-524f-4bed-a523-e2e9b05ce34b" + ], + "columns": { + "41baf020-4eba-4abe-8779-f64f6189dd59": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ad4b114f-524f-4bed-a523-e2e9b05ce34b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "line", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "6690701d-0819-4b28-9c05-60b77d037d0d", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "line", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4c09fb79-dc6e-4ac5-a720-a32512210940", + "key": "event.code", + "negate": false, + "params": [ + "30", + "31" + ], + "type": "phrases", + "value": [ + "30", + "31" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "30" + } + }, + { + "match_phrase": { + "event.code": "31" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "02308bbe-91fd-4b96-a9b5-aae2c8237711", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "ad4b114f-524f-4bed-a523-e2e9b05ce34b" + ], + "isHistogram": true, + "layerId": "65802bcc-35de-478a-ae19-a322eeb56847", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "30", - "31" - ], - "type": "phrases", - "value": "30, 31" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "30" - } - }, - { - "match_phrase": { - "event.code": "31" - } - } - ] + "seriesType": "line", + "simpleView": false, + "xAccessor": "41baf020-4eba-4abe-8779-f64f6189dd59", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "ad4b114f-524f-4bed-a523-e2e9b05ce34b" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Disabled Profiles Trend (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -298,38 +471,62 @@ "y": 0 }, "panelIndex": "3b23d41e-170f-4423-8ba8-2971e9b68782", - "version": "8.0.0", - "type": "visualization" + "title": "Disabled Profiles Trend", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Administrative - Disabled Profiles", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T08:20:49.801Z", + "id": "hid_bravura_monitor-0db75ff0-f9f4-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:indexpattern-datasource-layer-bb212cb2-0aa1-47fe-ae75-5ea010d8b498", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:d03973b8-7809-4d23-942b-a4c18e1c595c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:8d13ca39-cae5-4fb3-a7aa-b119027ad631", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:d596e134-f7ec-4b8b-83f4-05d07aba0726", + "type": "index-pattern" }, { - "type": "search", - "name": "6a0834a4-8c2b-4484-9f5e-c55faf0deac6:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:indexpattern-datasource-layer-65802bcc-35de-478a-ae19-a322eeb56847", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:6690701d-0819-4b28-9c05-60b77d037d0d", + "type": "index-pattern" }, { - "type": "search", - "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:4c09fb79-dc6e-4ac5-a720-a32512210940", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3b23d41e-170f-4423-8ba8-2971e9b68782:02308bbe-91fd-4b96-a9b5-aae2c8237711", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499.json index 1ab28b10ea3..ad01084b737 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3MCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -27,15 +22,6 @@ "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Database: Discovery: Help", - "description": "", - "uiState": {}, - "params": { - "fontSize": 12, - "markdown": "Discovery stored procedures are involved with loading data from integrations ( Connectors and LWS ) into the product database to learn about changes in the environment we are managing Identities and Access in. \n\nSome general rules of thumbs:\n\n* LWS stored procdures need to be quick. None should take a second.\n* Iddiscover.exe stored procedures can run for much longer. Minutes to hours in large environments to process large changes in bulk. \n\nStrategies for improving the performance of these stored procedures include:\n\n* Rebuild fragmented database indexes\n* Review if database is low on RAM, CPU, or I/O bandwidth.\n\nIf you continue to encounter problems developers will require database execution plans to review the operation of these procedures. ", - "openLinksInNewTab": false - }, - "type": "markdown", "data": { "aggs": [], "searchSource": { @@ -45,7 +31,16 @@ "query": "" } } - } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "Discovery stored procedures are involved with loading data from integrations ( Connectors and LWS ) into the product database to learn about changes in the environment we are managing Identities and Access in. \n\nSome general rules of thumbs:\n\n* LWS stored procdures need to be quick. None should take a second.\n* Iddiscover.exe stored procedures can run for much longer. Minutes to hours in large environments to process large changes in bulk. \n\nStrategies for improving the performance of these stored procedures include:\n\n* Rebuild fragmented database indexes\n* Review if database is low on RAM, CPU, or I/O bandwidth.\n\nIf you continue to encounter problems developers will require database execution plans to review the operation of these procedures. ", + "openLinksInNewTab": false + }, + "title": "Database: Discovery: Help", + "type": "markdown", + "uiState": {} } }, "gridData": { @@ -56,133 +51,306 @@ "y": 0 }, "panelIndex": "6d898178-6f51-4199-ae7e-44bd35e60bc8", - "version": "8.0.0", - "type": "visualization" + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Discovery procedures", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ea5d746b-9fb7-473a-8a25-621094e42437", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fada49bd-ed17-4b68-b3c7-fe821c1e63c6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f10b0b71-ff50-4ea0-b78d-e12669dd5d35", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "65dff8b3-4198-4897-aa8d-fb26162f3b00", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ea5d746b-9fb7-473a-8a25-621094e42437": { + "columnOrder": [ + "9eebe4d3-939a-42f4-8d79-ac9d09bb282a", + "89b3fa2b-8edf-45ea-b897-e283157e0414", + "636e16cc-2808-407c-aecf-9166380f4f26", + "2c3ef64f-9835-4f3e-8327-3f320fd57daa", + "f6f1cf28-a8ec-4382-8983-c83a8f222b05", + "8fa584f9-e4d8-46d7-8d87-cd422d8d56c2", + "182aacfe-b0e1-464f-9069-55cf045962b7" + ], + "columns": { + "182aacfe-b0e1-464f-9069-55cf045962b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "2c3ef64f-9835-4f3e-8327-3f320fd57daa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "636e16cc-2808-407c-aecf-9166380f4f26": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "89b3fa2b-8edf-45ea-b897-e283157e0414": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "636e16cc-2808-407c-aecf-9166380f4f26", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "8fa584f9-e4d8-46d7-8d87-cd422d8d56c2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "9eebe4d3-939a-42f4-8d79-ac9d09bb282a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "636e16cc-2808-407c-aecf-9166380f4f26", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + }, + "f6f1cf28-a8ec-4382-8983-c83a8f222b05": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "row": true, - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "fada49bd-ed17-4b68-b3c7-fe821c1e63c6", + "key": "log.logger", + "negate": false, + "params": [ + "iddiscover.exe", + "pamlws.exe" + ], + "type": "phrases", + "value": [ + "iddiscover.exe", + "pamlws.exe" + ] }, - "schema": "metric", - "type": "min" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.logger": "iddiscover.exe" + } + }, + { + "match_phrase": { + "log.logger": "pamlws.exe" + } + } + ] + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "f10b0b71-ff50-4ea0-b78d-e12669dd5d35", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfSproc" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfSproc" + } + } }, { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Function", - "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "7", - "params": { - "customLabel": "Process", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "65dff8b3-4198-4897-aa8d-fb26162f3b00", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "split", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "636e16cc-2808-407c-aecf-9166380f4f26" + }, + { + "alignment": "left", + "columnId": "2c3ef64f-9835-4f3e-8327-3f320fd57daa" + }, + { + "alignment": "left", + "columnId": "f6f1cf28-a8ec-4382-8983-c83a8f222b05" + }, + { + "alignment": "left", + "columnId": "8fa584f9-e4d8-46d7-8d87-cd422d8d56c2" + }, + { + "alignment": "left", + "columnId": "182aacfe-b0e1-464f-9069-55cf045962b7" + }, + { + "alignment": "left", + "columnId": "9eebe4d3-939a-42f4-8d79-ac9d09bb282a" + }, + { + "alignment": "left", + "columnId": "89b3fa2b-8edf-45ea-b897-e283157e0414" + } + ], + "headerRowHeight": "single", + "layerId": "ea5d746b-9fb7-473a-8a25-621094e42437", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -192,12 +360,14 @@ "y": 0 }, "panelIndex": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Discovery procedures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -207,28 +377,47 @@ "y": 25 }, "panelIndex": "70c9467e-31cb-4617-beab-2e7012046222", - "panelRefName": "panel_2", - "version": "8.0.0" + "panelRefName": "panel_70c9467e-31cb-4617-beab-2e7012046222", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Discovery", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T08:25:48.728Z", + "id": "hid_bravura_monitor-1a431f90-fa01-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa", - "name": "panel_2", - "type": "search" + "id": "logs-*", + "name": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee:indexpattern-datasource-layer-ea5d746b-9fb7-473a-8a25-621094e42437", + "type": "index-pattern" }, { - "type": "search", - "name": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee:search_0", - "id": "hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee:fada49bd-ed17-4b68-b3c7-fe821c1e63c6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee:f10b0b71-ff50-4ea0-b78d-e12669dd5d35", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "47c424ec-b1cc-4ab1-abfc-e9d0382a79ee:65dff8b3-4198-4897-aa8d-fb26162f3b00", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa", + "name": "70c9467e-31cb-4617-beab-2e7012046222:panel_70c9467e-31cb-4617-beab-2e7012046222", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3.json index 9954b580942..600d85a0331 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3MSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,709 +12,1948 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Problem Count", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d74250f-7fd4-48b5-a238-b976b109dee1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dddd8ef1-24a8-4014-a9bf-cc51c5fcc3e0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "30bfbb05-75b0-45cd-80e5-3213d4a958c8": { + "columnOrder": [ + "99059ace-7174-47bf-933b-4ec0b309f18e" + ], + "columns": { + "99059ace-7174-47bf-933b-4ec0b309f18e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Critical", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 59, - "labelColor": false, - "subText": "" - }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4d74250f-7fd4-48b5-a238-b976b109dee1", + "key": "log.level", + "negate": false, + "params": { + "query": "critical" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.level": "critical" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "asc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dddd8ef1-24a8-4014-a9bf-cc51c5fcc3e0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "layerType": "data", + "metricAccessor": "99059ace-7174-47bf-933b-4ec0b309f18e", + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#209280", + "stop": null + }, + { + "color": "#cc5642", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#209280", + "stop": 1 + }, + { + "color": "#cc5642", + "stop": 4 + } + ] + }, + "type": "palette" + }, + "showBar": false } - } - } + }, + "title": "Problem Count (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 21, - "i": "a3abfe8b-3ddd-492a-b081-2e3a3d76e84f", + "h": 8, + "i": "bfb80e97-0dee-4e02-b3d9-0d6f465512fe", "w": 10, "x": 0, "y": 0 }, - "panelIndex": "a3abfe8b-3ddd-492a-b081-2e3a3d76e84f", - "version": "8.0.0", - "type": "visualization" + "panelIndex": "bfb80e97-0dee-4e02-b3d9-0d6f465512fe", + "title": "Problem Count (critical)", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Problem Provider Distribution", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5edd75bf-bdfc-4182-ba67-c808d23837e8", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-53cc4189-2803-46f0-8b8d-de4255195dc0", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "dbad77aa-f87d-4988-a8cc-a9f2d1f7d17a", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" + { + "id": "logs-*", + "name": "0ab5d1f1-66e2-4c70-9dd3-586092d28479", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "53cc4189-2803-46f0-8b8d-de4255195dc0": { + "columnOrder": [ + "79b92990-8c5e-4772-b0f9-6cb0e746d282", + "03deda69-d1d9-450f-abb1-7aa24b3df5ea", + "abe44019-1b0d-4cec-96a1-132450eb9f3f" + ], + "columns": { + "03deda69-d1d9-450f-abb1-7aa24b3df5ea": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "79b92990-8c5e-4772-b0f9-6cb0e746d282": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Winlog Providers", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "abe44019-1b0d-4cec-96a1-132450eb9f3f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "winlog.provider_name" + }, + "abe44019-1b0d-4cec-96a1-132450eb9f3f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "linkToLayers": [], + "sampling": 1 + }, + "5edd75bf-bdfc-4182-ba67-c808d23837e8": { + "columnOrder": [ + "54909126-c7f1-4008-ae30-955a81f43a51", + "bf7c4547-c23e-47e0-b974-c70e74cc233c", + "fce854a1-76be-4daf-9f24-0b7836dd8af0" + ], + "columns": { + "54909126-c7f1-4008-ae30-955a81f43a51": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Winlog Channels", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fce854a1-76be-4daf-9f24-0b7836dd8af0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "winlog.channel" + }, + "bf7c4547-c23e-47e0-b974-c70e74cc233c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fce854a1-76be-4daf-9f24-0b7836dd8af0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "dbad77aa-f87d-4988-a8cc-a9f2d1f7d17a", + "key": "log.level", + "negate": false, + "params": [ + "warning", + "critical", + "error" + ], + "type": "phrases", + "value": [ + "warning", + "critical", + "error" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "warning" + } + }, + { + "match_phrase": { + "log.level": "critical" + } + }, + { + "match_phrase": { + "log.level": "error" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0ab5d1f1-66e2-4c70-9dd3-586092d28479", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "winlog.channel", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 - }, - "schema": "group", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "field": "winlog.provider_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "fce854a1-76be-4daf-9f24-0b7836dd8af0" + ], + "layerId": "5edd75bf-bdfc-4182-ba67-c808d23837e8", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "splitAccessor": "54909126-c7f1-4008-ae30-955a81f43a51", + "xAccessor": "bf7c4547-c23e-47e0-b974-c70e74cc233c" + }, + { + "accessors": [ + "abe44019-1b0d-4cec-96a1-132450eb9f3f" + ], + "layerId": "53cc4189-2803-46f0-8b8d-de4255195dc0", + "layerType": "data", + "seriesType": "bar", + "splitAccessor": "79b92990-8c5e-4772-b0f9-6cb0e746d282", + "xAccessor": "03deda69-d1d9-450f-abb1-7aa24b3df5ea" + } + ], + "legend": { + "isVisible": true, + "legendSize": "large", + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": false } - } - } + }, + "title": "Problem Count (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 21, - "i": "31e162b4-565d-4dce-90f1-e0a43ed54a70", + "h": 24, + "i": "096e73ee-4b15-41c8-92dd-0bb37628b357", "w": 38, "x": 10, "y": 0 }, - "panelIndex": "31e162b4-565d-4dce-90f1-e0a43ed54a70", - "version": "8.0.0", - "type": "visualization" + "panelIndex": "096e73ee-4b15-41c8-92dd-0bb37628b357", + "title": "Problem Provider Distribution", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Problem Distribution", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "022fc5e9-3f02-4583-8ebf-24b413b80804", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bf5e144b-1364-47c8-8be7-bb2876ce0c17", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "30bfbb05-75b0-45cd-80e5-3213d4a958c8": { + "columnOrder": [ + "99059ace-7174-47bf-933b-4ec0b309f18e" + ], + "columns": { + "99059ace-7174-47bf-933b-4ec0b309f18e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Errors", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "022fc5e9-3f02-4583-8ebf-24b413b80804", + "key": "log.level", + "negate": false, + "params": { + "query": "error" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.level": "error" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bf5e144b-1364-47c8-8be7-bb2876ce0c17", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } } } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "layerType": "data", + "metricAccessor": "99059ace-7174-47bf-933b-4ec0b309f18e", + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#209280", + "stop": null + }, + { + "color": "#cc5642", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#209280", + "stop": 1 + }, + { + "color": "#cc5642", + "stop": 4 + } + ] + }, + "type": "palette" + }, + "showBar": false } }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "title": "Problem Count (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "d8c8ad15-e32a-4cd9-97f3-d29d17d6953b", + "w": 10, + "x": 0, + "y": 8 + }, + "panelIndex": "d8c8ad15-e32a-4cd9-97f3-d29d17d6953b", + "title": "Problem Count (error)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6880c78b-981f-419a-8100-c6eb91ca23e6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "41c78206-fb9e-48e5-9b2f-9435fbd1317f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "30bfbb05-75b0-45cd-80e5-3213d4a958c8": { + "columnOrder": [ + "99059ace-7174-47bf-933b-4ec0b309f18e" + ], + "columns": { + "99059ace-7174-47bf-933b-4ec0b309f18e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Warnings", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "6880c78b-981f-419a-8100-c6eb91ca23e6", + "key": "log.level", + "negate": false, + "params": { + "query": "warning" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.level": "warning" + } + } }, { - "enabled": true, - "id": "2", + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "41c78206-fb9e-48e5-9b2f-9435fbd1317f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "layerType": "data", + "metricAccessor": "99059ace-7174-47bf-933b-4ec0b309f18e", + "palette": { + "name": "custom", "params": { - "customLabel": "User", - "field": "winlog.user.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "colorStops": [ + { + "color": "#54B399", + "stop": null + }, + { + "color": "#FEC514", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#54B399", + "stop": 1 + }, + { + "color": "#FEC514", + "stop": 2 + } + ] + }, + "type": "palette" }, + "showBar": false + } + }, + "title": "Problem Count (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "4fb85878-312a-40ca-beb4-b3fa903ac10e", + "w": 10, + "x": 0, + "y": 16 + }, + "panelIndex": "4fb85878-312a-40ca-beb4-b3fa903ac10e", + "title": "Problem Count (warning)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cbd03b3c-c61a-4810-961b-82656d1c0ba5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "441eb87d-f746-4cae-b291-f05ac14d9ae4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7e0859a-5953-4d7b-9189-17c7498740e5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cbd03b3c-c61a-4810-961b-82656d1c0ba5": { + "columnOrder": [ + "22b19259-36af-47ea-95b6-ac2744c84cb5", + "650f7332-9e67-42e1-91ec-ff01b19a3880", + "3dc9c18e-0f4c-4875-89cc-fd46132c4536" + ], + "columns": { + "22b19259-36af-47ea-95b6-ac2744c84cb5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3dc9c18e-0f4c-4875-89cc-fd46132c4536", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "winlog.user.name" + }, + "3dc9c18e-0f4c-4875-89cc-fd46132c4536": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "650f7332-9e67-42e1-91ec-ff01b19a3880": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3dc9c18e-0f4c-4875-89cc-fd46132c4536", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Severity", - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "441eb87d-f746-4cae-b291-f05ac14d9ae4", + "key": "log.level", + "negate": false, + "params": [ + "error", + "warning", + "critical" + ], + "type": "phrases", + "value": [ + "error", + "warning", + "critical" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "error" + } + }, + { + "match_phrase": { + "log.level": "warning" + } + }, + { + "match_phrase": { + "log.level": "critical" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a7e0859a-5953-4d7b-9189-17c7498740e5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "3dc9c18e-0f4c-4875-89cc-fd46132c4536" + }, + { + "alignment": "left", + "columnId": "22b19259-36af-47ea-95b6-ac2744c84cb5" + }, + { + "alignment": "left", + "columnId": "650f7332-9e67-42e1-91ec-ff01b19a3880" + } + ], + "headerRowHeight": "single", + "layerId": "cbd03b3c-c61a-4810-961b-82656d1c0ba5", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} }, "gridData": { "h": 21, "i": "21a44db8-a29a-4a18-b63e-ca0da9606909", "w": 10, "x": 0, - "y": 21 + "y": 24 }, "panelIndex": "21a44db8-a29a-4a18-b63e-ca0da9606909", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Problem Heat Map", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Yellow to Red", - "colorsNumber": 10, - "colorsRange": [], - "enableHover": true, - "invertColors": false, - "legendPosition": "right", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ] - }, - "type": "heatmap", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7cd02bfa-583d-4b32-b2a1-2e659518dd47", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bee9c833-b3c0-43f6-8228-c91c6ba12706", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "97f392a4-8de6-4fad-a5d7-b376daf0dad5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7cd02bfa-583d-4b32-b2a1-2e659518dd47": { + "columnOrder": [ + "151f0b92-b9cb-4914-a5ab-3a0340f20bac", + "72eb4a0f-6a6e-4e56-9fa1-62bf281e2b9b", + "a8744d8a-797c-450d-a5d5-745cbc58d10f" + ], + "columns": { + "151f0b92-b9cb-4914-a5ab-3a0340f20bac": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Log Level", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "72eb4a0f-6a6e-4e56-9fa1-62bf281e2b9b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a8744d8a-797c-450d-a5d5-745cbc58d10f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "a8744d8a-797c-450d-a5d5-745cbc58d10f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "asc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "bee9c833-b3c0-43f6-8228-c91c6ba12706", + "key": "log.level", + "negate": false, + "params": [ + "error", + "warning", + "critical" + ], + "type": "phrases", + "value": [ + "error", + "warning", + "critical" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "error" + } + }, + { + "match_phrase": { + "log.level": "warning" + } + }, + { + "match_phrase": { + "log.level": "critical" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "group", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "97f392a4-8de6-4fad-a5d7-b376daf0dad5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "heatmap_grid" + }, + "layerId": "7cd02bfa-583d-4b32-b2a1-2e659518dd47", + "layerType": "data", + "legend": { + "position": "right", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "a8744d8a-797c-450d-a5d5-745cbc58d10f", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#FFFFCC", + "stop": 0 + }, + { + "color": "#FFF1A9", + "stop": 10 + }, + { + "color": "#FEE187", + "stop": 20 + }, + { + "color": "#FEC865", + "stop": 30 + }, + { + "color": "#FEAB4C", + "stop": 40 + }, + { + "color": "#FD873C", + "stop": 50 + }, + { + "color": "#F95C2E", + "stop": 60 + }, + { + "color": "#EC3023", + "stop": 70 + }, + { + "color": "#D31020", + "stop": 80 + }, + { + "color": "#AF0126", + "stop": 90 + } + ], + "continuity": "none", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": 100, + "rangeMin": 0, + "rangeType": "percent", + "reverse": false, + "stops": [ + { + "color": "#FFFFCC", + "stop": 10 + }, + { + "color": "#FFF1A9", + "stop": 20 + }, + { + "color": "#FEE187", + "stop": 30 + }, + { + "color": "#FEC865", + "stop": 40 + }, + { + "color": "#FEAB4C", + "stop": 50 + }, + { + "color": "#FD873C", + "stop": 60 + }, + { + "color": "#F95C2E", + "stop": 70 + }, + { + "color": "#EC3023", + "stop": 80 + }, + { + "color": "#D31020", + "stop": 90 + }, + { + "color": "#AF0126", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "a8744d8a-797c-450d-a5d5-745cbc58d10f", + "xAccessor": "151f0b92-b9cb-4914-a5ab-3a0340f20bac", + "yAccessor": "72eb4a0f-6a6e-4e56-9fa1-62bf281e2b9b" } - } - } + }, + "title": "Problem Heat Map (converted)", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 21, "i": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf", "w": 38, "x": 10, - "y": 21 + "y": 24 }, "panelIndex": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf", - "version": "8.0.0", - "type": "visualization" + "title": "Problem Heat Map", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Problem Events", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 3, - "direction": "desc" - } - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-378f6c0c-3481-4b26-89b0-1d391263a497", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "093bf987-c2e0-4575-9e5d-674b4db71243", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "575c90c2-67e8-46a3-a4b4-396f276f9a36", + "type": "index-pattern" } - }, - "params": { - "perPage": 20, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event ID", - "field": "winlog.event_id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "378f6c0c-3481-4b26-89b0-1d391263a497": { + "columnOrder": [ + "c0f7270e-eae6-42c6-9af3-d66d4760770b", + "c47af372-6b35-4413-9740-db69a284caf1", + "d39485e5-1915-41af-89e9-6b74013c06f3", + "7fc31d57-7f84-4579-95b0-7072b7fc9629" + ], + "columns": { + "7fc31d57-7f84-4579-95b0-7072b7fc9629": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c0f7270e-eae6-42c6-9af3-d66d4760770b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7fc31d57-7f84-4579-95b0-7072b7fc9629", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "winlog.event_id" + }, + "c47af372-6b35-4413-9740-db69a284caf1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7fc31d57-7f84-4579-95b0-7072b7fc9629", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "winlog.provider_name" + }, + "d39485e5-1915-41af-89e9-6b74013c06f3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Log", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7fc31d57-7f84-4579-95b0-7072b7fc9629", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "winlog.channel" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event Source", - "field": "winlog.provider_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "093bf987-c2e0-4575-9e5d-674b4db71243", + "key": "log.level", + "negate": false, + "params": [ + "error", + "warning", + "critical" + ], + "type": "phrases", + "value": [ + "error", + "warning", + "critical" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "error" + } + }, + { + "match_phrase": { + "log.level": "warning" + } + }, + { + "match_phrase": { + "log.level": "critical" + } + } + ] + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Event Log", - "field": "winlog.channel", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "575c90c2-67e8-46a3-a4b4-396f276f9a36", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "7fc31d57-7f84-4579-95b0-7072b7fc9629" + }, + { + "alignment": "left", + "columnId": "c0f7270e-eae6-42c6-9af3-d66d4760770b" + }, + { + "alignment": "left", + "columnId": "c47af372-6b35-4413-9740-db69a284caf1" + }, + { + "alignment": "left", + "columnId": "d39485e5-1915-41af-89e9-6b74013c06f3" + } + ], + "headerRowHeight": "single", + "layerId": "378f6c0c-3481-4b26-89b0-1d391263a497", + "layerType": "data", + "paging": { + "enabled": true, + "size": 20 + }, + "rowHeight": "single" } - } - } + }, + "title": "Problem Events (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 27, "i": "1494c062-2f24-4571-8e69-793a894392d7", "w": 24, "x": 0, - "y": 42 + "y": 45 }, "panelIndex": "1494c062-2f24-4571-8e69-793a894392d7", - "version": "8.0.0", - "type": "visualization" + "title": "Problem Events", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Problem Distribution", - "description": "", - "uiState": { - "vis": { - "colors": { - "error": "#EF843C", - "warning": "#EAB839" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d1877e37-95ee-428b-a986-febc93e9d96b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b80810ff-1c71-4615-aa72-9fa7c5b416ee", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "47e630c7-6562-425d-94d6-f21ff8b061e6", + "type": "index-pattern" } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d1877e37-95ee-428b-a986-febc93e9d96b": { + "columnOrder": [ + "fc6588e1-0195-4955-8643-98a770d3b5dc", + "97a5ecc6-9761-4aa5-a3e5-6ff332e4ad19", + "377dcb95-c5a9-4256-902a-984be4e6403c" + ], + "columns": { + "377dcb95-c5a9-4256-902a-984be4e6403c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "97a5ecc6-9761-4aa5-a3e5-6ff332e4ad19": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "log.level: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "377dcb95-c5a9-4256-902a-984be4e6403c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "fc6588e1-0195-4955-8643-98a770d3b5dc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "377dcb95-c5a9-4256-902a-984be4e6403c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "segment", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b80810ff-1c71-4615-aa72-9fa7c5b416ee", + "key": "log.level", + "negate": false, + "params": [ + "error", + "warning", + "critical" + ], + "type": "phrases", + "value": [ + "error", + "warning", + "critical" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "error" + } + }, + { + "match_phrase": { + "log.level": "warning" + } + }, + { + "match_phrase": { + "log.level": "critical" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "47e630c7-6562-425d-94d6-f21ff8b061e6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "d1877e37-95ee-428b-a986-febc93e9d96b", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "377dcb95-c5a9-4256-902a-984be4e6403c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "fc6588e1-0195-4955-8643-98a770d3b5dc", + "97a5ecc6-9761-4aa5-a3e5-6ff332e4ad19" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" } - } - } + }, + "title": "Problem Distribution (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} }, "gridData": { "h": 27, "i": "5fb347ad-ad70-4cfb-8023-f61468be8a07", "w": 24, "x": 24, - "y": 42 + "y": 45 }, "panelIndex": "5fb347ad-ad70-4cfb-8023-f61468be8a07", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Windows Event Analysis - Problems", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:08:49.880Z", + "id": "hid_bravura_monitor-23a89d20-fa07-11eb-96cd-db0fb11a40f3", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "search", - "name": "a3abfe8b-3ddd-492a-b081-2e3a3d76e84f:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "bfb80e97-0dee-4e02-b3d9-0d6f465512fe:indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bfb80e97-0dee-4e02-b3d9-0d6f465512fe:4d74250f-7fd4-48b5-a238-b976b109dee1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bfb80e97-0dee-4e02-b3d9-0d6f465512fe:dddd8ef1-24a8-4014-a9bf-cc51c5fcc3e0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "096e73ee-4b15-41c8-92dd-0bb37628b357:indexpattern-datasource-layer-5edd75bf-bdfc-4182-ba67-c808d23837e8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "096e73ee-4b15-41c8-92dd-0bb37628b357:indexpattern-datasource-layer-53cc4189-2803-46f0-8b8d-de4255195dc0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "096e73ee-4b15-41c8-92dd-0bb37628b357:dbad77aa-f87d-4988-a8cc-a9f2d1f7d17a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "096e73ee-4b15-41c8-92dd-0bb37628b357:0ab5d1f1-66e2-4c70-9dd3-586092d28479", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8c8ad15-e32a-4cd9-97f3-d29d17d6953b:indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8c8ad15-e32a-4cd9-97f3-d29d17d6953b:022fc5e9-3f02-4583-8ebf-24b413b80804", + "type": "index-pattern" }, { - "type": "search", - "name": "31e162b4-565d-4dce-90f1-e0a43ed54a70:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "d8c8ad15-e32a-4cd9-97f3-d29d17d6953b:bf5e144b-1364-47c8-8be7-bb2876ce0c17", + "type": "index-pattern" }, { - "type": "search", - "name": "21a44db8-a29a-4a18-b63e-ca0da9606909:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4fb85878-312a-40ca-beb4-b3fa903ac10e:indexpattern-datasource-layer-30bfbb05-75b0-45cd-80e5-3213d4a958c8", + "type": "index-pattern" }, { - "type": "search", - "name": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4fb85878-312a-40ca-beb4-b3fa903ac10e:6880c78b-981f-419a-8100-c6eb91ca23e6", + "type": "index-pattern" }, { - "type": "search", - "name": "1494c062-2f24-4571-8e69-793a894392d7:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4fb85878-312a-40ca-beb4-b3fa903ac10e:41c78206-fb9e-48e5-9b2f-9435fbd1317f", + "type": "index-pattern" }, { - "type": "search", - "name": "5fb347ad-ad70-4cfb-8023-f61468be8a07:search_0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "21a44db8-a29a-4a18-b63e-ca0da9606909:indexpattern-datasource-layer-cbd03b3c-c61a-4810-961b-82656d1c0ba5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "21a44db8-a29a-4a18-b63e-ca0da9606909:441eb87d-f746-4cae-b291-f05ac14d9ae4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "21a44db8-a29a-4a18-b63e-ca0da9606909:a7e0859a-5953-4d7b-9189-17c7498740e5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf:indexpattern-datasource-layer-7cd02bfa-583d-4b32-b2a1-2e659518dd47", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf:bee9c833-b3c0-43f6-8228-c91c6ba12706", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "efaeb9a6-ef0b-4f77-b397-1c8577f38cbf:97f392a4-8de6-4fad-a5d7-b376daf0dad5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1494c062-2f24-4571-8e69-793a894392d7:indexpattern-datasource-layer-378f6c0c-3481-4b26-89b0-1d391263a497", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1494c062-2f24-4571-8e69-793a894392d7:093bf987-c2e0-4575-9e5d-674b4db71243", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1494c062-2f24-4571-8e69-793a894392d7:575c90c2-67e8-46a3-a4b4-396f276f9a36", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5fb347ad-ad70-4cfb-8023-f61468be8a07:indexpattern-datasource-layer-d1877e37-95ee-428b-a986-febc93e9d96b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5fb347ad-ad70-4cfb-8023-f61468be8a07:b80810ff-1c71-4615-aa72-9fa7c5b416ee", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5fb347ad-ad70-4cfb-8023-f61468be8a07:47e630c7-6562-425d-94d6-f21ff8b061e6", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499.json index 14a564795c1..d3cf1626c33 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3MiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,186 +12,228 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Discovery Runtimes", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "fittingFunction": "zero", - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-940792b3-556a-4446-902b-9b643588f44a", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "bf9fbd82-7430-4a63-8aa5-2c994e69bbca", + "type": "index-pattern" }, - "radiusRatio": 9, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Sum of Duration (ms)" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "line", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "c2065b83-1c61-4a54-bb14-4db472bb42d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7cb2ac61-2e30-4304-9615-0ed4c62571bb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "940792b3-556a-4446-902b-9b643588f44a": { + "columnOrder": [ + "5b9e5ac8-7f86-4874-b063-87eb5baea0ad", + "942f5534-6b07-4f1c-bc78-87868c54ae1a" + ], + "columns": { + "5b9e5ac8-7f86-4874-b063-87eb5baea0ad": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "942f5534-6b07-4f1c-bc78-87868c54ae1a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sum of Duration (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "line", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Sum of Duration (ms)" + "meta": { + "alias": null, + "disabled": false, + "index": "bf9fbd82-7430-4a63-8aa5-2c994e69bbca", + "key": "log.logger", + "negate": false, + "params": { + "query": "psupdate.exe" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "line", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "log.logger": "psupdate.exe" + } + } + }, { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Sum of Duration (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "sum" + "meta": { + "alias": null, + "disabled": false, + "index": "c2065b83-1c61-4a54-bb14-4db472bb42d1", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "2021-01-11T07:00:00.000Z", - "to": "2021-01-18T07:00:00.000Z" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7cb2ac61-2e30-4304-9615-0ed4c62571bb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "psupdate.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "psupdate.exe" - } - } - }, + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" + "accessors": [ + "942f5534-6b07-4f1c-bc78-87868c54ae1a" + ], + "isHistogram": true, + "layerId": "940792b3-556a-4446-902b-9b643588f44a", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" + "seriesType": "line", + "simpleView": false, + "xAccessor": "5b9e5ac8-7f86-4874-b063-87eb5baea0ad", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "942f5534-6b07-4f1c-bc78-87868c54ae1a" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Sum of Duration (ms)" } - } - } + }, + "title": "Discovery Runtimes (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -209,115 +243,233 @@ "y": 0 }, "panelIndex": "27066e19-96ff-46db-989c-2ed0650bfb32", - "version": "8.0.0", - "type": "visualization" + "title": "Discovery Runtimes", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Discovery Events", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a480e33c-8ba4-442f-afd8-2d853a818dc1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fdb29819-8bb8-41c7-ba24-e98d3d0e3b57", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1b5ccbd9-c5d4-4728-852c-f0fa8ee9e9f3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a480e33c-8ba4-442f-afd8-2d853a818dc1": { + "columnOrder": [ + "3ed98567-ac8e-4a73-aed8-1ba842530079", + "8baba596-6146-46c9-b183-e05a3ffc225d", + "4e122f78-9447-448a-88c0-4b30527a3cef", + "c1055f75-b3aa-4c62-9249-d1783e9e93d0", + "fc65f068-44dc-48bc-b320-712f53025ec4", + "facac4f5-10fc-4c06-8985-0a05e02bd4f5" + ], + "columns": { + "3ed98567-ac8e-4a73-aed8-1ba842530079": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8baba596-6146-46c9-b183-e05a3ffc225d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.event" + }, + "4e122f78-9447-448a-88c0-4b30527a3cef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "8baba596-6146-46c9-b183-e05a3ffc225d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c1055f75-b3aa-4c62-9249-d1783e9e93d0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "facac4f5-10fc-4c06-8985-0a05e02bd4f5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "fc65f068-44dc-48bc-b320-712f53025ec4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event", - "field": "hid_bravura_monitor.perf.event", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Min (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "fdb29819-8bb8-41c7-ba24-e98d3d0e3b57", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfPsupdate" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfPsupdate" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Max (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1b5ccbd9-c5d4-4728-852c-f0fa8ee9e9f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "8baba596-6146-46c9-b183-e05a3ffc225d" + }, + { + "alignment": "left", + "columnId": "4e122f78-9447-448a-88c0-4b30527a3cef" + }, + { + "alignment": "left", + "columnId": "c1055f75-b3aa-4c62-9249-d1783e9e93d0" + }, + { + "alignment": "left", + "columnId": "fc65f068-44dc-48bc-b320-712f53025ec4" + }, + { + "alignment": "left", + "columnId": "facac4f5-10fc-4c06-8985-0a05e02bd4f5" + }, + { + "alignment": "left", + "columnId": "3ed98567-ac8e-4a73-aed8-1ba842530079" + } + ], + "headerRowHeight": "single", + "layerId": "a480e33c-8ba4-442f-afd8-2d853a818dc1", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Discovery Events (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -327,138 +479,222 @@ "y": 15 }, "panelIndex": "9a662dac-12e2-44ce-ad7d-eaca9ec5b478", - "version": "8.0.0", - "type": "visualization" + "title": "Discovery Events", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Discovery Runtime Table", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6fcd0d2c-50b5-4407-a52e-6a71932e9184", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9a7599d-a0ce-4344-9710-790e8c81052f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "428848af-0b5e-44c7-8fb0-4f6407ba2439", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "66f2599a-a7d1-4e76-ac3a-23c326634f99", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6fcd0d2c-50b5-4407-a52e-6a71932e9184": { + "columnOrder": [ + "a8ee1be4-5ae4-421c-9f88-c9fdd9d6866d", + "adc854ef-f3b0-426f-9c84-b338fc51d864", + "8f39a9ad-8038-4b76-b49a-78db220e69fd" + ], + "columns": { + "8f39a9ad-8038-4b76-b49a-78db220e69fd": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Runtime (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "a8ee1be4-5ae4-421c-9f88-c9fdd9d6866d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Discovery ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8f39a9ad-8038-4b76-b49a-78db220e69fd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "user.id" + }, + "adc854ef-f3b0-426f-9c84-b338fc51d864": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8f39a9ad-8038-4b76-b49a-78db220e69fd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Runtime (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "sum" + "meta": { + "alias": null, + "disabled": false, + "index": "f9a7599d-a0ce-4344-9710-790e8c81052f", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Discovery ID", - "field": "user.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "428848af-0b5e-44c7-8fb0-4f6407ba2439", + "key": "hid_bravura_monitor.perf.exe", + "negate": false, + "params": { + "query": "psupdate.exe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.exe": "psupdate.exe" + } + } }, { - "enabled": true, - "id": "4", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "66f2599a-a7d1-4e76-ac3a-23c326634f99", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } - } + "alignment": "left", + "columnId": "8f39a9ad-8038-4b76-b49a-78db220e69fd" }, { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "hid_bravura_monitor.perf.exe", - "negate": false, - "params": { - "query": "psupdate.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.exe": "psupdate.exe" - } - } + "alignment": "left", + "columnId": "a8ee1be4-5ae4-421c-9f88-c9fdd9d6866d" + }, + { + "alignment": "left", + "columnId": "adc854ef-f3b0-426f-9c84-b338fc51d864" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "6fcd0d2c-50b5-4407-a52e-6a71932e9184", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Discovery Runtime Table (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -468,53 +704,77 @@ "y": 15 }, "panelIndex": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78", - "version": "8.0.0", - "type": "visualization" + "title": "Discovery Runtime Table", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Discovery - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:10:45.157Z", + "id": "hid_bravura_monitor-28db2060-fa02-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "27066e19-96ff-46db-989c-2ed0650bfb32:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "27066e19-96ff-46db-989c-2ed0650bfb32:indexpattern-datasource-layer-940792b3-556a-4446-902b-9b643588f44a", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "27066e19-96ff-46db-989c-2ed0650bfb32:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "27066e19-96ff-46db-989c-2ed0650bfb32:bf9fbd82-7430-4a63-8aa5-2c994e69bbca", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "27066e19-96ff-46db-989c-2ed0650bfb32:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "27066e19-96ff-46db-989c-2ed0650bfb32:c2065b83-1c61-4a54-bb14-4db472bb42d1", + "type": "index-pattern" }, { - "type": "search", - "name": "9a662dac-12e2-44ce-ad7d-eaca9ec5b478:search_0", - "id": "hid_bravura_monitor-dd637750-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "27066e19-96ff-46db-989c-2ed0650bfb32:7cb2ac61-2e30-4304-9615-0ed4c62571bb", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "9a662dac-12e2-44ce-ad7d-eaca9ec5b478:indexpattern-datasource-layer-a480e33c-8ba4-442f-afd8-2d853a818dc1", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "9a662dac-12e2-44ce-ad7d-eaca9ec5b478:fdb29819-8bb8-41c7-ba24-e98d3d0e3b57", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "9a662dac-12e2-44ce-ad7d-eaca9ec5b478:1b5ccbd9-c5d4-4728-852c-f0fa8ee9e9f3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:indexpattern-datasource-layer-6fcd0d2c-50b5-4407-a52e-6a71932e9184", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:f9a7599d-a0ce-4344-9710-790e8c81052f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:428848af-0b5e-44c7-8fb0-4f6407ba2439", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51a5c05f-6a26-4138-9f95-f4c6b01c4d78:66f2599a-a7d1-4e76-ac3a-23c326634f99", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499.json index c6d2adf28ad..09ae0fb5981 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3MywxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,98 +12,210 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 10 Unlocked Profiles", - "description": "", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-90bce21e-0b67-404f-8573-e548e485279a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a7a3341-f1b1-460a-b098-0e01a91d6ed3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ac04fc57-e936-49d5-bcda-a7e4efb52729", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7535d714-e664-4058-ba66-685707815acf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "90bce21e-0b67-404f-8573-e548e485279a": { + "columnOrder": [ + "42faae30-1827-45eb-bb1e-ae8eaf3d71db", + "62e2d746-5f9d-4fce-9493-3c7023e36d0f" + ], + "columns": { + "42faae30-1827-45eb-bb1e-ae8eaf3d71db": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Profile", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "62e2d746-5f9d-4fce-9493-3c7023e36d0f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "winlog.event_data.Profile" + }, + "62e2d746-5f9d-4fce-9493-3c7023e36d0f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0a7a3341-f1b1-460a-b098-0e01a91d6ed3", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Profile", - "field": "winlog.event_data.Profile", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ac04fc57-e936-49d5-bcda-a7e4efb52729", + "key": "event.code", + "negate": false, + "params": [ + "32", + "33" + ], + "type": "phrases", + "value": [ + "32", + "33" + ] }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "32" + } + }, + { + "match_phrase": { + "event.code": "33" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7535d714-e664-4058-ba66-685707815acf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "32", - "33" - ], - "type": "phrases", - "value": "32, 33" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "32" - } - }, - { - "match_phrase": { - "event.code": "33" - } - } - ] - } - } + "alignment": "left", + "columnId": "62e2d746-5f9d-4fce-9493-3c7023e36d0f" + }, + { + "alignment": "left", + "columnId": "42faae30-1827-45eb-bb1e-ae8eaf3d71db" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "90bce21e-0b67-404f-8573-e548e485279a", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Top 10 Unlocked Profiles (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -121,174 +225,243 @@ "y": 0 }, "panelIndex": "292870cf-80ba-4071-ac33-6ddc10eef5ee", - "version": "8.0.0", - "type": "visualization" + "title": "Top 10 Unlocked Profiles", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unlocked Profile Trend", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "fittingFunction": "zero", - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6e1680fd-7f67-49f3-b348-8773152b75f4", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "39fe2a14-bd9d-4f9f-8776-c2edb1f34c86", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "line", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "24cf4d95-1bff-4d5a-83cd-50d098d7fed0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c0e53976-97d0-4252-9a25-ce33ba446b66", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6e1680fd-7f67-49f3-b348-8773152b75f4": { + "columnOrder": [ + "8c1fab55-757c-436f-b65a-2f97ad7caed7", + "e951319c-47df-4a1d-8d49-3c0dbb363af0" + ], + "columns": { + "8c1fab55-757c-436f-b65a-2f97ad7caed7": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e951319c-47df-4a1d-8d49-3c0dbb363af0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "line", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "39fe2a14-bd9d-4f9f-8776-c2edb1f34c86", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "line", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "24cf4d95-1bff-4d5a-83cd-50d098d7fed0", + "key": "event.code", + "negate": false, + "params": [ + "32", + "33" + ], + "type": "phrases", + "value": [ + "32", + "33" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "32" + } + }, + { + "match_phrase": { + "event.code": "33" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c0e53976-97d0-4252-9a25-ce33ba446b66", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "e951319c-47df-4a1d-8d49-3c0dbb363af0" + ], + "isHistogram": true, + "layerId": "6e1680fd-7f67-49f3-b348-8773152b75f4", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "32", - "33" - ], - "type": "phrases", - "value": "32, 33" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "32" - } - }, - { - "match_phrase": { - "event.code": "33" - } - } - ] + "seriesType": "line", + "simpleView": false, + "xAccessor": "8c1fab55-757c-436f-b65a-2f97ad7caed7", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "e951319c-47df-4a1d-8d49-3c0dbb363af0" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Unlocked Profile Trend (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -298,38 +471,62 @@ "y": 0 }, "panelIndex": "c81e1947-6ef2-4f8f-8497-c6defed48569", - "version": "8.0.0", - "type": "visualization" + "title": "Unlocked Profile Trend", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Administrative - Unlocked Profiles", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:12:10.425Z", + "id": "hid_bravura_monitor-3f403100-f9f4-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:indexpattern-datasource-layer-90bce21e-0b67-404f-8573-e548e485279a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:0a7a3341-f1b1-460a-b098-0e01a91d6ed3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:ac04fc57-e936-49d5-bcda-a7e4efb52729", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:7535d714-e664-4058-ba66-685707815acf", + "type": "index-pattern" }, { - "type": "search", - "name": "292870cf-80ba-4071-ac33-6ddc10eef5ee:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:indexpattern-datasource-layer-6e1680fd-7f67-49f3-b348-8773152b75f4", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:39fe2a14-bd9d-4f9f-8776-c2edb1f34c86", + "type": "index-pattern" }, { - "type": "search", - "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:24cf4d95-1bff-4d5a-83cd-50d098d7fed0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c81e1947-6ef2-4f8f-8497-c6defed48569:c0e53976-97d0-4252-9a25-ce33ba446b66", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499.json index 8144504311c..ce425528600 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3NCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,155 +12,320 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Issues: Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5e83db9d-230e-4bc1-85da-abaf76985252", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "d3deac51-5bb5-4227-98d0-6b1a695b7537", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "761e161a-2745-447d-9120-a554c2c6541e", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "f45a3fc4-95e4-4892-9f85-ddc85ccc97b9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4858427e-0202-4062-8e86-e20ba1eabddc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5e83db9d-230e-4bc1-85da-abaf76985252": { + "columnOrder": [ + "53994597-e5ab-465e-97a3-a2ad39202a91", + "666dcbdc-e4b7-464d-b9c6-cd307be56737", + "099293c2-d5ae-4fe1-9931-0d92e67c3c51" + ], + "columns": { + "099293c2-d5ae-4fe1-9931-0d92e67c3c51": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "53994597-e5ab-465e-97a3-a2ad39202a91": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "666dcbdc-e4b7-464d-b9c6-cd307be56737": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "099293c2-d5ae-4fe1-9931-0d92e67c3c51", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d3deac51-5bb5-4227-98d0-6b1a695b7537", + "key": "log.logger", + "negate": false, + "params": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ], + "type": "phrases", + "value": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.logger": "ajaxsvc.exe" + } + }, + { + "match_phrase": { + "log.logger": "psf.exe" + } + }, + { + "match_phrase": { + "log.logger": "psa.exe" + } + } + ] + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "761e161a-2745-447d-9120-a554c2c6541e", + "key": "log.level", + "negate": false, + "params": [ + "Error", + "Warning" + ], + "type": "phrases", + "value": [ + "Error", + "Warning" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Error" + } + }, + { + "match_phrase": { + "log.level": "Warning" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" - }, - "useNormalizedEsInterval": true + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f45a3fc4-95e4-4892-9f85-ddc85ccc97b9", + "key": "user.id", + "negate": false, + "type": "exists", + "value": "exists" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "exists": { + "field": "user.id" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 - }, - "schema": "group", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4858427e-0202-4062-8e86-e20ba1eabddc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "099293c2-d5ae-4fe1-9931-0d92e67c3c51" + ], + "isHistogram": true, + "layerId": "5e83db9d-230e-4bc1-85da-abaf76985252", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "666dcbdc-e4b7-464d-b9c6-cd307be56737", + "xAccessor": "53994597-e5ab-465e-97a3-a2ad39202a91", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "099293c2-d5ae-4fe1-9931-0d92e67c3c51" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Users: Issues: Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, @@ -178,75 +335,256 @@ "y": 0 }, "panelIndex": "aed09807-f936-4881-960d-30039d3fb5cd", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Issues: Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Issues: Nodes", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fb4eca21-ee6c-4b27-a7d4-88f2cef5d013", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7147c707-54bc-45ba-8919-ad90b9c114c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "388abcfa-4069-4677-b99c-5eaf9a02d6a9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4efb0bff-9723-40cb-bf68-0452c3397114", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1d51593d-d4cc-4809-9e88-ed718907af01", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fb4eca21-ee6c-4b27-a7d4-88f2cef5d013": { + "columnOrder": [ + "c1842cb8-dde1-4e33-9486-7a67fd461a89", + "c7225717-9e14-4dce-a527-f2f64dfb1aef" + ], + "columns": { + "c1842cb8-dde1-4e33-9486-7a67fd461a89": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c7225717-9e14-4dce-a527-f2f64dfb1aef", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "c7225717-9e14-4dce-a527-f2f64dfb1aef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7147c707-54bc-45ba-8919-ad90b9c114c7", + "key": "log.logger", + "negate": false, + "params": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ], + "type": "phrases", + "value": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.logger": "ajaxsvc.exe" + } + }, + { + "match_phrase": { + "log.logger": "psf.exe" + } + }, + { + "match_phrase": { + "log.logger": "psa.exe" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "388abcfa-4069-4677-b99c-5eaf9a02d6a9", + "key": "log.level", + "negate": false, + "params": [ + "Error", + "Warning" + ], + "type": "phrases", + "value": [ + "Error", + "Warning" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Error" + } + }, + { + "match_phrase": { + "log.level": "Warning" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4efb0bff-9723-40cb-bf68-0452c3397114", + "key": "user.id", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "user.id" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1d51593d-d4cc-4809-9e88-ed718907af01", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "c7225717-9e14-4dce-a527-f2f64dfb1aef" + }, + { + "alignment": "left", + "columnId": "c1842cb8-dde1-4e33-9486-7a67fd461a89" + } + ], + "headerRowHeight": "single", + "layerId": "fb4eca21-ee6c-4b27-a7d4-88f2cef5d013", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Issues: Nodes (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -256,75 +594,256 @@ "y": 14 }, "panelIndex": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Issues: Nodes", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Issues: Processes", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ace16157-04dd-4e1d-a9d7-1035d1bf0763", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "565c6207-4660-435a-9347-a762793b1a58", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d1da0385-cf9a-4d6d-97e1-09b6d013e406", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7482d623-ce82-4314-82b4-8f8f99b3695a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d593cdc8-d987-456b-8b3a-2cc5edcd7a8d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ace16157-04dd-4e1d-a9d7-1035d1bf0763": { + "columnOrder": [ + "6d18a492-119f-4268-8b11-fad34009afde", + "6fc4816c-4b88-4b8b-b623-7d070bf3e53c" + ], + "columns": { + "6d18a492-119f-4268-8b11-fad34009afde": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6fc4816c-4b88-4b8b-b623-7d070bf3e53c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "6fc4816c-4b88-4b8b-b623-7d070bf3e53c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "565c6207-4660-435a-9347-a762793b1a58", + "key": "log.logger", + "negate": false, + "params": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ], + "type": "phrases", + "value": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.logger": "ajaxsvc.exe" + } + }, + { + "match_phrase": { + "log.logger": "psf.exe" + } + }, + { + "match_phrase": { + "log.logger": "psa.exe" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Process", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d1da0385-cf9a-4d6d-97e1-09b6d013e406", + "key": "log.level", + "negate": false, + "params": [ + "Error", + "Warning" + ], + "type": "phrases", + "value": [ + "Error", + "Warning" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Error" + } + }, + { + "match_phrase": { + "log.level": "Warning" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7482d623-ce82-4314-82b4-8f8f99b3695a", + "key": "user.id", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "user.id" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d593cdc8-d987-456b-8b3a-2cc5edcd7a8d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "6fc4816c-4b88-4b8b-b623-7d070bf3e53c" + }, + { + "alignment": "left", + "columnId": "6d18a492-119f-4268-8b11-fad34009afde" + } + ], + "headerRowHeight": "single", + "layerId": "ace16157-04dd-4e1d-a9d7-1035d1bf0763", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Issues: Processes (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -334,75 +853,256 @@ "y": 14 }, "panelIndex": "ded4c445-2a0a-448c-9318-38b166d11d73", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Issues: Processes", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Issues: Affected users", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a7064fca-44c7-4fe2-9e73-ed07401e0e00", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c9a8213e-99d8-4018-a453-582d2277f935", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b282b44e-8e5e-4313-840e-a7cb57eb65fe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e629de64-8e07-487b-a548-742a463375f2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8fcfd8cd-a6e5-4efd-9eec-6bf828a82aa6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a7064fca-44c7-4fe2-9e73-ed07401e0e00": { + "columnOrder": [ + "4e028d2b-ca6f-4d0d-922b-010294f3281c", + "6e74981c-986c-4213-abdd-bcf957982c01" + ], + "columns": { + "4e028d2b-ca6f-4d0d-922b-010294f3281c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Users", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6e74981c-986c-4213-abdd-bcf957982c01", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "user.id" + }, + "6e74981c-986c-4213-abdd-bcf957982c01": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c9a8213e-99d8-4018-a453-582d2277f935", + "key": "log.logger", + "negate": false, + "params": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ], + "type": "phrases", + "value": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.logger": "ajaxsvc.exe" + } + }, + { + "match_phrase": { + "log.logger": "psf.exe" + } + }, + { + "match_phrase": { + "log.logger": "psa.exe" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Users", - "field": "user.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b282b44e-8e5e-4313-840e-a7cb57eb65fe", + "key": "log.level", + "negate": false, + "params": [ + "Error", + "Warning" + ], + "type": "phrases", + "value": [ + "Error", + "Warning" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "log.level": "Error" + } + }, + { + "match_phrase": { + "log.level": "Warning" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e629de64-8e07-487b-a548-742a463375f2", + "key": "user.id", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "user.id" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8fcfd8cd-a6e5-4efd-9eec-6bf828a82aa6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "6e74981c-986c-4213-abdd-bcf957982c01" + }, + { + "alignment": "left", + "columnId": "4e028d2b-ca6f-4d0d-922b-010294f3281c" + } + ], + "headerRowHeight": "single", + "layerId": "a7064fca-44c7-4fe2-9e73-ed07401e0e00", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Issues: Affected users (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -412,8 +1112,9 @@ "y": 14 }, "panelIndex": "a58e223b-2453-4dcd-9de5-8a6101d9964d", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Issues: Affected users", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -427,43 +1128,127 @@ "y": 34 }, "panelIndex": "4909f0f5-c8df-40f8-bc49-df24cb056b8c", - "panelRefName": "panel_4", - "version": "8.0.0" + "panelRefName": "panel_4909f0f5-c8df-40f8-bc49-df24cb056b8c", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Users - Issues", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:16:00.317Z", + "id": "hid_bravura_monitor-49fa7e40-f9fc-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa", - "name": "panel_4", - "type": "search" + "id": "logs-*", + "name": "aed09807-f936-4881-960d-30039d3fb5cd:indexpattern-datasource-layer-5e83db9d-230e-4bc1-85da-abaf76985252", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed09807-f936-4881-960d-30039d3fb5cd:d3deac51-5bb5-4227-98d0-6b1a695b7537", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed09807-f936-4881-960d-30039d3fb5cd:761e161a-2745-447d-9120-a554c2c6541e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed09807-f936-4881-960d-30039d3fb5cd:f45a3fc4-95e4-4892-9f85-ddc85ccc97b9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed09807-f936-4881-960d-30039d3fb5cd:4858427e-0202-4062-8e86-e20ba1eabddc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:indexpattern-datasource-layer-fb4eca21-ee6c-4b27-a7d4-88f2cef5d013", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:7147c707-54bc-45ba-8919-ad90b9c114c7", + "type": "index-pattern" }, { - "type": "search", - "name": "aed09807-f936-4881-960d-30039d3fb5cd:search_0", - "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:388abcfa-4069-4677-b99c-5eaf9a02d6a9", + "type": "index-pattern" }, { - "type": "search", - "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:search_0", - "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:4efb0bff-9723-40cb-bf68-0452c3397114", + "type": "index-pattern" }, { - "type": "search", - "name": "ded4c445-2a0a-448c-9318-38b166d11d73:search_0", - "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "fa9c7f19-26bc-489f-ad23-1774eaf8dcc6:1d51593d-d4cc-4809-9e88-ed718907af01", + "type": "index-pattern" }, { - "type": "search", - "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:search_0", - "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "ded4c445-2a0a-448c-9318-38b166d11d73:indexpattern-datasource-layer-ace16157-04dd-4e1d-a9d7-1035d1bf0763", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ded4c445-2a0a-448c-9318-38b166d11d73:565c6207-4660-435a-9347-a762793b1a58", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ded4c445-2a0a-448c-9318-38b166d11d73:d1da0385-cf9a-4d6d-97e1-09b6d013e406", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ded4c445-2a0a-448c-9318-38b166d11d73:7482d623-ce82-4314-82b4-8f8f99b3695a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ded4c445-2a0a-448c-9318-38b166d11d73:d593cdc8-d987-456b-8b3a-2cc5edcd7a8d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:indexpattern-datasource-layer-a7064fca-44c7-4fe2-9e73-ed07401e0e00", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:c9a8213e-99d8-4018-a453-582d2277f935", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:b282b44e-8e5e-4313-840e-a7cb57eb65fe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:e629de64-8e07-487b-a548-742a463375f2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a58e223b-2453-4dcd-9de5-8a6101d9964d:8fcfd8cd-a6e5-4efd-9eec-6bf828a82aa6", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa", + "name": "4909f0f5-c8df-40f8-bc49-df24cb056b8c:panel_4909f0f5-c8df-40f8-bc49-df24cb056b8c", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499.json index 7e3fc33d625..ab5a7e448bb 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3NSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -27,15 +22,6 @@ "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Database: Search: Help", - "description": "", - "uiState": {}, - "params": { - "fontSize": 12, - "markdown": "Search engines need to return quickly since users are waiting on their results. There is a direct correlation between search time and user experience.\n\nAs a general rule, Search stored procedures should take less than a second to run on average. \n\nSearch stored procedure performance is impacted by elements such as:\n\n* Data size. Larger data consumes more CPU, Ram, Disk I/O on the database server. \n* Policies such as acls, filtering, etc. \n* Indexes. Sometimes they fragment degrading overall performance. \n* Table/Index Locking with other database actions.\n\nStrategies for improving database search performance include:\n\n* Rebuild fragmented database indexes.\n* Evaluate if more RAM/CPU\n\nWhen these don't work, Developers will need database execution plans to review options.", - "openLinksInNewTab": false - }, - "type": "markdown", "data": { "aggs": [], "searchSource": { @@ -45,7 +31,16 @@ "query": "" } } - } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "Search engines need to return quickly since users are waiting on their results. There is a direct correlation between search time and user experience.\n\nAs a general rule, Search stored procedures should take less than a second to run on average. \n\nSearch stored procedure performance is impacted by elements such as:\n\n* Data size. Larger data consumes more CPU, Ram, Disk I/O on the database server. \n* Policies such as acls, filtering, etc. \n* Indexes. Sometimes they fragment degrading overall performance. \n* Table/Index Locking with other database actions.\n\nStrategies for improving database search performance include:\n\n* Rebuild fragmented database indexes.\n* Evaluate if more RAM/CPU\n\nWhen these don't work, Developers will need database execution plans to review options.", + "openLinksInNewTab": false + }, + "title": "Database: Search: Help", + "type": "markdown", + "uiState": {} } }, "gridData": { @@ -56,115 +51,259 @@ "y": 0 }, "panelIndex": "63969223-a0de-4d10-aa3a-5a7de19681c2", - "version": "8.0.0", - "type": "visualization" + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Search performance", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3027c2e0-3ee2-4628-91b1-2c28d276c461", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e0dd302c-b450-40c9-855e-a81ac58364a2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3be21db3-f6c3-49a1-ad32-d5f83c0bb27e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "192d10d1-3226-448c-8a4c-422b8ecd3118", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3027c2e0-3ee2-4628-91b1-2c28d276c461": { + "columnOrder": [ + "da5dd4ff-e3ee-403a-a1e6-c7eadaa26974", + "ce05821e-85cc-4987-ac16-e3ca24f37061", + "22ca0003-240e-43f4-9dbb-78e64a95ce5b", + "f36108a9-b972-4dea-844a-1dae702d61d5", + "05803017-f483-45d0-a5eb-2634535a7817", + "eaca3a4b-7756-400d-9613-3434a6fb248f" + ], + "columns": { + "05803017-f483-45d0-a5eb-2634535a7817": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "22ca0003-240e-43f4-9dbb-78e64a95ce5b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "ce05821e-85cc-4987-ac16-e3ca24f37061": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "da5dd4ff-e3ee-403a-a1e6-c7eadaa26974": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ce05821e-85cc-4987-ac16-e3ca24f37061", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + }, + "eaca3a4b-7756-400d-9613-3434a6fb248f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "f36108a9-b972-4dea-844a-1dae702d61d5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "e0dd302c-b450-40c9-855e-a81ac58364a2", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfSproc" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfSproc" + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3be21db3-f6c3-49a1-ad32-d5f83c0bb27e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Function", + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "index": "192d10d1-3226-448c-8a4c-422b8ecd3118", + "key": "hid_bravura_monitor.perf.function", + "negate": false, + "params": { + "query": "*Search*" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.function": "*Search*" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ce05821e-85cc-4987-ac16-e3ca24f37061" + }, + { + "alignment": "left", + "columnId": "22ca0003-240e-43f4-9dbb-78e64a95ce5b" + }, + { + "alignment": "left", + "columnId": "f36108a9-b972-4dea-844a-1dae702d61d5" + }, + { + "alignment": "left", + "columnId": "05803017-f483-45d0-a5eb-2634535a7817" + }, + { + "alignment": "left", + "columnId": "eaca3a4b-7756-400d-9613-3434a6fb248f" + }, + { + "alignment": "left", + "columnId": "da5dd4ff-e3ee-403a-a1e6-c7eadaa26974" + } + ], + "headerRowHeight": "single", + "layerId": "3027c2e0-3ee2-4628-91b1-2c28d276c461", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Database: Search performance (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -174,8 +313,9 @@ "y": 0 }, "panelIndex": "37dcff04-67ca-46e6-bea3-b6be4a08bce8", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Search performance", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -189,28 +329,47 @@ "y": 25 }, "panelIndex": "250f87a6-96dc-417f-a704-ee29e9669992", - "panelRefName": "panel_2", - "version": "8.0.0" + "panelRefName": "panel_250f87a6-96dc-417f-a704-ee29e9669992", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Search", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:17:41.371Z", + "id": "hid_bravura_monitor-4bf327b0-fa01-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa", - "name": "panel_2", - "type": "search" + "id": "logs-*", + "name": "37dcff04-67ca-46e6-bea3-b6be4a08bce8:indexpattern-datasource-layer-3027c2e0-3ee2-4628-91b1-2c28d276c461", + "type": "index-pattern" }, { - "type": "search", - "name": "37dcff04-67ca-46e6-bea3-b6be4a08bce8:search_0", - "id": "hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "37dcff04-67ca-46e6-bea3-b6be4a08bce8:e0dd302c-b450-40c9-855e-a81ac58364a2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "37dcff04-67ca-46e6-bea3-b6be4a08bce8:3be21db3-f6c3-49a1-ad32-d5f83c0bb27e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "37dcff04-67ca-46e6-bea3-b6be4a08bce8:192d10d1-3226-448c-8a4c-422b8ecd3118", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa", + "name": "250f87a6-96dc-417f-a704-ee29e9669992:panel_250f87a6-96dc-417f-a704-ee29e9669992", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499.json index 7ab53037a87..49e47bbba30 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3NiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,218 +12,544 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 17, - "i": "d09c2c16-f29a-48e2-bb74-471b6de1fc03", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "d09c2c16-f29a-48e2-bb74-471b6de1fc03", "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "annotations": [], - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "24e4b310-069e-11ec-8d63-433b7d9c06cf" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" } - ], - "bar_color_rules": [ - { - "id": "015e0b70-069f-11ec-8d63-433b7d9c06cf" + }, + "datasourceStates": { + "formBased": { + "layers": { + "de0a5895-ec4c-4015-8385-63f5f9e97ce5": { + "columnOrder": [ + "f5edf20a-f4ee-4878-bccc-54445d2809a5", + "23f23d0c-c5dd-410b-bf3f-10980e1e64e4", + "c0cd0e15-9c9a-41d2-bf40-68ca39e469df" + ], + "columns": { + "23f23d0c-c5dd-410b-bf3f-10980e1e64e4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Executables", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.exe" + }, + "c0cd0e15-9c9a-41d2-bf40-68ca39e469df": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Average Duration", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "f5edf20a-f4ee-4878-bccc-54445d2809a5": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "hid_bravura_monitor.perf.kind: PerfExe AND NOT (hid_bravura_monitor.perf.exe: *plugin*)" }, - "gauge_color_rules": [ + "filters": [ { - "id": "040388f0-069f-11ec-8d63-433b7d9c06cf" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "max_bars": 80, - "series": [ + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "hid_bravura_monitor.perf.kind", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "hid_bravura_monitor.perf.exe", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "hid_bravura_monitor.perf.exe", + "negate": true, + "params": { + "query": "*plugin*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.exe": "*plugin*" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "" + "$state": { + "store": "appState" }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": 1, - "metrics": [ - { - "field": "hid_bravura_monitor.perf.duration", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_exclude": "", - "terms_field": "hid_bravura_monitor.perf.exe", - "type": "timeseries" + } + } + ], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-de0a5895-ec4c-4015-8385-63f5f9e97ce5", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": false + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c0cd0e15-9c9a-41d2-bf40-68ca39e469df" + ], + "layerId": "de0a5895-ec4c-4015-8385-63f5f9e97ce5", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "23f23d0c-c5dd-410b-bf3f-10980e1e64e4", + "xAccessor": "f5edf20a-f4ee-4878-bccc-54445d2809a5", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "c0cd0e15-9c9a-41d2-bf40-68ca39e469df" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "title": "Executable Average Duration", - "type": "metrics", - "uiState": {} + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "visualization" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "d09c2c16-f29a-48e2-bb74-471b6de1fc03", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "d09c2c16-f29a-48e2-bb74-471b6de1fc03", + "title": "Executable Average Duration", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Executables: Performance", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-607ccecd-9554-43ef-9610-ddc3060abd80", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b66e1dd3-b23c-43d2-8e0c-f7c5bd362669", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "312bff66-486f-40a1-8dd6-1ca9cfb4cc6c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "607ccecd-9554-43ef-9610-ddc3060abd80": { + "columnOrder": [ + "0177a508-a124-4d2e-9a9b-7a760b68e792", + "7dd9aa1b-9147-4a88-90ed-637c7959881b", + "b031c759-1934-4ee2-9ffb-dde07fa03e1b", + "9653b1bb-246c-4f5f-aac0-252c53379058", + "b83eecbc-9f3f-4884-81ff-509dd26215a4", + "e754b9fb-fc72-461b-b704-699053908858" + ], + "columns": { + "0177a508-a124-4d2e-9a9b-7a760b68e792": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7dd9aa1b-9147-4a88-90ed-637c7959881b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "7dd9aa1b-9147-4a88-90ed-637c7959881b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "9653b1bb-246c-4f5f-aac0-252c53379058": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "b031c759-1934-4ee2-9ffb-dde07fa03e1b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "b83eecbc-9f3f-4884-81ff-509dd26215a4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "e754b9fb-fc72-461b-b704-699053908858": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Process", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "b66e1dd3-b23c-43d2-8e0c-f7c5bd362669", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "index": "logs-*", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "log.logger", + "index": "logs-*", + "key": "log.logger", + "negate": true, + "params": { + "query": "plugin_*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.logger": "plugin_*" + } + } + } + ], + "relation": "AND", + "type": "combined" }, - "schema": "metric", - "type": "avg" + "query": {} }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "min" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" - }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "312bff66-486f-40a1-8dd6-1ca9cfb4cc6c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "7dd9aa1b-9147-4a88-90ed-637c7959881b" + }, + { + "alignment": "left", + "columnId": "b031c759-1934-4ee2-9ffb-dde07fa03e1b" + }, + { + "alignment": "left", + "columnId": "9653b1bb-246c-4f5f-aac0-252c53379058" + }, + { + "alignment": "left", + "columnId": "b83eecbc-9f3f-4884-81ff-509dd26215a4" + }, + { + "alignment": "left", + "columnId": "e754b9fb-fc72-461b-b704-699053908858" + }, + { + "alignment": "left", + "columnId": "0177a508-a124-4d2e-9a9b-7a760b68e792" + } + ], + "headerRowHeight": "single", + "layerId": "607ccecd-9554-43ef-9610-ddc3060abd80", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Executables: Performance (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -241,23 +559,37 @@ "y": 17 }, "panelIndex": "198257f3-2b86-41f1-83cf-2090465b56a8", - "version": "8.0.0", - "type": "visualization" + "title": "Executables: Performance", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Processes - Executables", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T09:22:04.317Z", + "id": "hid_bravura_monitor-4ee19fa0-fa02-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "search", - "name": "198257f3-2b86-41f1-83cf-2090465b56a8:search_0", - "id": "hid_bravura_monitor-95032a30-2eab-11eb-b6a1-bdb7d768b585" + "id": "logs-*", + "name": "198257f3-2b86-41f1-83cf-2090465b56a8:indexpattern-datasource-layer-607ccecd-9554-43ef-9610-ddc3060abd80", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "198257f3-2b86-41f1-83cf-2090465b56a8:b66e1dd3-b23c-43d2-8e0c-f7c5bd362669", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "198257f3-2b86-41f1-83cf-2090465b56a8:312bff66-486f-40a1-8dd6-1ca9cfb4cc6c", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499.json index 9e469384285..3ba9101610a 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3NywxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,75 +12,167 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Workflow: Operations per Node", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d7bee938-dd7f-4e13-ace9-8ab8f5f5d8ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "73c76c3d-cc88-4675-8ccd-fa4e260a5a47", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e1a7849f-e85f-4822-be13-1e6bdcbbb112", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d7bee938-dd7f-4e13-ace9-8ab8f5f5d8ef": { + "columnOrder": [ + "15870142-31b7-4b6c-84aa-10c6200496e0", + "0b5fecc6-7817-4bc5-a419-bd5516846470" + ], + "columns": { + "0b5fecc6-7817-4bc5-a419-bd5516846470": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "15870142-31b7-4b6c-84aa-10c6200496e0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0b5fecc6-7817-4bc5-a419-bd5516846470", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "73c76c3d-cc88-4675-8ccd-fa4e260a5a47", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDWFM" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDWFM" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e1a7849f-e85f-4822-be13-1e6bdcbbb112", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "0b5fecc6-7817-4bc5-a419-bd5516846470" + }, + { + "alignment": "left", + "columnId": "15870142-31b7-4b6c-84aa-10c6200496e0" + } + ], + "headerRowHeight": "single", + "layerId": "d7bee938-dd7f-4e13-ace9-8ab8f5f5d8ef", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Workflow: Operations per Node (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -98,156 +182,227 @@ "y": 0 }, "panelIndex": "2852a22c-425f-45b2-b953-6b0f3d214447", - "version": "8.0.0", - "type": "visualization" + "title": "Workflow: Operations per Node", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Workflow: Operation Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f109d90b-10a8-483d-abbc-c775dd9524e0", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "233fc59d-5118-43e7-8215-713afcc0ab45", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "40790ed7-6168-423b-b297-784938349553", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f109d90b-10a8-483d-abbc-c775dd9524e0": { + "columnOrder": [ + "c3eeaac0-5b26-4fa1-811d-49c583285235", + "fe0f0dc0-76b4-4a68-bff8-5cb8391d8176", + "ebed3678-9723-4894-ac2d-99d9a1129e99" + ], + "columns": { + "c3eeaac0-5b26-4fa1-811d-49c583285235": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ebed3678-9723-4894-ac2d-99d9a1129e99": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fe0f0dc0-76b4-4a68-bff8-5cb8391d8176": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ebed3678-9723-4894-ac2d-99d9a1129e99", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.event" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "233fc59d-5118-43e7-8215-713afcc0ab45", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDWFM" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDWFM" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event", - "field": "hid_bravura_monitor.perf.event", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 20 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "40790ed7-6168-423b-b297-784938349553", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "ebed3678-9723-4894-ac2d-99d9a1129e99" + ], + "isHistogram": true, + "layerId": "f109d90b-10a8-483d-abbc-c775dd9524e0", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "fe0f0dc0-76b4-4a68-bff8-5cb8391d8176", + "xAccessor": "c3eeaac0-5b26-4fa1-811d-49c583285235", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "ebed3678-9723-4894-ac2d-99d9a1129e99" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Workflow: Operation Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -257,115 +412,233 @@ "y": 0 }, "panelIndex": "9e84cdcf-b3f1-44b5-bdc4-67bb7cb7b7ac", - "version": "8.0.0", - "type": "visualization" + "title": "Workflow: Operation Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Workflow: Operations", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0711f7c8-ff09-47dd-ab7e-d3b67fc85f4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f8f19560-1f64-4c63-85bd-74fc9b1014c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e679ec0-9aac-48d1-8a8c-9f320424388e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0711f7c8-ff09-47dd-ab7e-d3b67fc85f4d": { + "columnOrder": [ + "28034959-967a-48d8-9e7a-a869581cdf8a", + "bce86ece-b2e0-4b1b-a39e-527902864a30", + "a793a957-11ec-4c67-ab61-34f2e90e8140", + "d4583dae-e374-4133-a464-0b63ae29da35", + "63cfa705-c55e-44f2-973f-51dd0ef873f1", + "6a266149-fb9c-4801-b75b-4a3d7d7daf9e" + ], + "columns": { + "28034959-967a-48d8-9e7a-a869581cdf8a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bce86ece-b2e0-4b1b-a39e-527902864a30", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.event" + }, + "63cfa705-c55e-44f2-973f-51dd0ef873f1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "6a266149-fb9c-4801-b75b-4a3d7d7daf9e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "a793a957-11ec-4c67-ab61-34f2e90e8140": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "bce86ece-b2e0-4b1b-a39e-527902864a30": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d4583dae-e374-4133-a464-0b63ae29da35": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event", - "field": "hid_bravura_monitor.perf.event", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Min (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "f8f19560-1f64-4c63-85bd-74fc9b1014c8", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDWFM" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDWFM" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Max (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3e679ec0-9aac-48d1-8a8c-9f320424388e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "bce86ece-b2e0-4b1b-a39e-527902864a30" + }, + { + "alignment": "left", + "columnId": "a793a957-11ec-4c67-ab61-34f2e90e8140" + }, + { + "alignment": "left", + "columnId": "d4583dae-e374-4133-a464-0b63ae29da35" + }, + { + "alignment": "left", + "columnId": "63cfa705-c55e-44f2-973f-51dd0ef873f1" + }, + { + "alignment": "left", + "columnId": "6a266149-fb9c-4801-b75b-4a3d7d7daf9e" + }, + { + "alignment": "left", + "columnId": "28034959-967a-48d8-9e7a-a869581cdf8a" + } + ], + "headerRowHeight": "single", + "layerId": "0711f7c8-ff09-47dd-ab7e-d3b67fc85f4d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Workflow: Operations (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -375,8 +648,9 @@ "y": 20 }, "panelIndex": "c3a20836-de82-44e2-a23c-38ac861cc7df", - "version": "8.0.0", - "type": "visualization" + "title": "Workflow: Operations", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -390,38 +664,72 @@ "y": 35 }, "panelIndex": "aa105229-2ee8-417b-a85b-ab83300357ee", - "panelRefName": "panel_3", - "version": "8.0.0" + "panelRefName": "panel_aa105229-2ee8-417b-a85b-ab83300357ee", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Workflow - Summary (Logs)", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:28:00.646Z", + "id": "hid_bravura_monitor-52cf42a0-fa04-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289", - "name": "panel_3", - "type": "search" + "id": "logs-*", + "name": "2852a22c-425f-45b2-b953-6b0f3d214447:indexpattern-datasource-layer-d7bee938-dd7f-4e13-ace9-8ab8f5f5d8ef", + "type": "index-pattern" }, { - "type": "search", - "name": "2852a22c-425f-45b2-b953-6b0f3d214447:search_0", - "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "2852a22c-425f-45b2-b953-6b0f3d214447:73c76c3d-cc88-4675-8ccd-fa4e260a5a47", + "type": "index-pattern" }, { - "type": "search", - "name": "9e84cdcf-b3f1-44b5-bdc4-67bb7cb7b7ac:search_0", - "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "2852a22c-425f-45b2-b953-6b0f3d214447:e1a7849f-e85f-4822-be13-1e6bdcbbb112", + "type": "index-pattern" }, { - "type": "search", - "name": "c3a20836-de82-44e2-a23c-38ac861cc7df:search_0", - "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "9e84cdcf-b3f1-44b5-bdc4-67bb7cb7b7ac:indexpattern-datasource-layer-f109d90b-10a8-483d-abbc-c775dd9524e0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9e84cdcf-b3f1-44b5-bdc4-67bb7cb7b7ac:233fc59d-5118-43e7-8215-713afcc0ab45", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9e84cdcf-b3f1-44b5-bdc4-67bb7cb7b7ac:40790ed7-6168-423b-b297-784938349553", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a20836-de82-44e2-a23c-38ac861cc7df:indexpattern-datasource-layer-0711f7c8-ff09-47dd-ab7e-d3b67fc85f4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a20836-de82-44e2-a23c-38ac861cc7df:f8f19560-1f64-4c63-85bd-74fc9b1014c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a20836-de82-44e2-a23c-38ac861cc7df:3e679ec0-9aac-48d1-8a8c-9f320424388e", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289", + "name": "aa105229-2ee8-417b-a85b-ab83300357ee:panel_aa105229-2ee8-417b-a85b-ab83300357ee", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499.json index 65fa2c5edb7..4c5acb574b4 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3OCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,79 +12,430 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Administrative Summary Table", - "description": "", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1d88263b-e6e7-4d37-96f8-aab22804a538", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0d81934-56be-4538-b4be-4b7bbac1d618", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bf24b850-2c7a-45f5-b16e-eceec3055f3a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "348ddca0-46f8-4bd7-88bb-4efafc61eeed", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d88263b-e6e7-4d37-96f8-aab22804a538": { + "columnOrder": [ + "61925dcf-f33a-4e4f-b0d7-d457a7d6404a", + "dd965abd-24cf-45de-aa9b-bfe5cd0ab59e", + "235835d9-f8fb-46b7-a59e-82052ff4eb7a" + ], + "columns": { + "235835d9-f8fb-46b7-a59e-82052ff4eb7a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "61925dcf-f33a-4e4f-b0d7-d457a7d6404a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "235835d9-f8fb-46b7-a59e-82052ff4eb7a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "event.code" + }, + "dd965abd-24cf-45de-aa9b-bfe5cd0ab59e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Integration", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "235835d9-f8fb-46b7-a59e-82052ff4eb7a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "winlog.event_data.Module" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b0d81934-56be-4538-b4be-4b7bbac1d618", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event Code", - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "bf24b850-2c7a-45f5-b16e-eceec3055f3a", + "key": "event.code", + "negate": false, + "params": [ + "28", + "29", + "30", + "31", + "32", + "33", + "52", + "53", + "54", + "55", + "56", + "57", + "58", + "59", + "60", + "61", + "62", + "63", + "64", + "65", + "66", + "67", + "68", + "69", + "70", + "71", + "72", + "73", + "121" + ], + "type": "phrases", + "value": [ + "28", + "29", + "30", + "31", + "32", + "33", + "52", + "53", + "54", + "55", + "56", + "57", + "58", + "59", + "60", + "61", + "62", + "63", + "64", + "65", + "66", + "67", + "68", + "69", + "70", + "71", + "72", + "73", + "121" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "28" + } + }, + { + "match_phrase": { + "event.code": "29" + } + }, + { + "match_phrase": { + "event.code": "30" + } + }, + { + "match_phrase": { + "event.code": "31" + } + }, + { + "match_phrase": { + "event.code": "32" + } + }, + { + "match_phrase": { + "event.code": "33" + } + }, + { + "match_phrase": { + "event.code": "52" + } + }, + { + "match_phrase": { + "event.code": "53" + } + }, + { + "match_phrase": { + "event.code": "54" + } + }, + { + "match_phrase": { + "event.code": "55" + } + }, + { + "match_phrase": { + "event.code": "56" + } + }, + { + "match_phrase": { + "event.code": "57" + } + }, + { + "match_phrase": { + "event.code": "58" + } + }, + { + "match_phrase": { + "event.code": "59" + } + }, + { + "match_phrase": { + "event.code": "60" + } + }, + { + "match_phrase": { + "event.code": "61" + } + }, + { + "match_phrase": { + "event.code": "62" + } + }, + { + "match_phrase": { + "event.code": "63" + } + }, + { + "match_phrase": { + "event.code": "64" + } + }, + { + "match_phrase": { + "event.code": "65" + } + }, + { + "match_phrase": { + "event.code": "66" + } + }, + { + "match_phrase": { + "event.code": "67" + } + }, + { + "match_phrase": { + "event.code": "68" + } + }, + { + "match_phrase": { + "event.code": "69" + } + }, + { + "match_phrase": { + "event.code": "70" + } + }, + { + "match_phrase": { + "event.code": "71" + } + }, + { + "match_phrase": { + "event.code": "72" + } + }, + { + "match_phrase": { + "event.code": "73" + } + }, + { + "match_phrase": { + "event.code": "121" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Integration", - "field": "winlog.event_data.Module", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "348ddca0-46f8-4bd7-88bb-4efafc61eeed", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "235835d9-f8fb-46b7-a59e-82052ff4eb7a" + }, + { + "alignment": "left", + "columnId": "61925dcf-f33a-4e4f-b0d7-d457a7d6404a" + }, + { + "alignment": "left", + "columnId": "dd965abd-24cf-45de-aa9b-bfe5cd0ab59e" + } + ], + "headerRowHeight": "single", + "layerId": "1d88263b-e6e7-4d37-96f8-aab22804a538", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -102,155 +445,459 @@ "y": 0 }, "panelIndex": "647b541e-ba69-4580-8b5c-82b99e9141db", - "version": "8.0.0", - "type": "visualization" + "title": "Administrative Summary Table", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Administrative Summary", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3597ffbf-b15e-437e-87fe-15855feb3865", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "3961142c-4326-46ae-81db-52eb0626c9d5", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "adf6ffb6-33b7-4420-b1e2-a792c250caf5", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "3033c1dd-049d-4bf6-8364-5929eea6d982", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3597ffbf-b15e-437e-87fe-15855feb3865": { + "columnOrder": [ + "2e4ce230-0115-4585-9915-78051013336d", + "d9b960cd-90ef-429c-8ba9-ef4b377fb595", + "571aae77-0b7e-495c-87a6-a08f531a847c" + ], + "columns": { + "2e4ce230-0115-4585-9915-78051013336d": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "571aae77-0b7e-495c-87a6-a08f531a847c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d9b960cd-90ef-429c-8ba9-ef4b377fb595": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "571aae77-0b7e-495c-87a6-a08f531a847c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "event.code" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "3961142c-4326-46ae-81db-52eb0626c9d5", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" - }, - "useNormalizedEsInterval": true + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "adf6ffb6-33b7-4420-b1e2-a792c250caf5", + "key": "event.code", + "negate": false, + "params": [ + "28", + "29", + "30", + "31", + "32", + "33", + "52", + "53", + "54", + "55", + "56", + "57", + "58", + "59", + "60", + "61", + "62", + "63", + "64", + "65", + "66", + "67", + "68", + "69", + "70", + "71", + "72", + "73", + "121" + ], + "type": "phrases", + "value": [ + "28", + "29", + "30", + "31", + "32", + "33", + "52", + "53", + "54", + "55", + "56", + "57", + "58", + "59", + "60", + "61", + "62", + "63", + "64", + "65", + "66", + "67", + "68", + "69", + "70", + "71", + "72", + "73", + "121" + ] }, - "schema": "segment", - "type": "date_histogram" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "28" + } + }, + { + "match_phrase": { + "event.code": "29" + } + }, + { + "match_phrase": { + "event.code": "30" + } + }, + { + "match_phrase": { + "event.code": "31" + } + }, + { + "match_phrase": { + "event.code": "32" + } + }, + { + "match_phrase": { + "event.code": "33" + } + }, + { + "match_phrase": { + "event.code": "52" + } + }, + { + "match_phrase": { + "event.code": "53" + } + }, + { + "match_phrase": { + "event.code": "54" + } + }, + { + "match_phrase": { + "event.code": "55" + } + }, + { + "match_phrase": { + "event.code": "56" + } + }, + { + "match_phrase": { + "event.code": "57" + } + }, + { + "match_phrase": { + "event.code": "58" + } + }, + { + "match_phrase": { + "event.code": "59" + } + }, + { + "match_phrase": { + "event.code": "60" + } + }, + { + "match_phrase": { + "event.code": "61" + } + }, + { + "match_phrase": { + "event.code": "62" + } + }, + { + "match_phrase": { + "event.code": "63" + } + }, + { + "match_phrase": { + "event.code": "64" + } + }, + { + "match_phrase": { + "event.code": "65" + } + }, + { + "match_phrase": { + "event.code": "66" + } + }, + { + "match_phrase": { + "event.code": "67" + } + }, + { + "match_phrase": { + "event.code": "68" + } + }, + { + "match_phrase": { + "event.code": "69" + } + }, + { + "match_phrase": { + "event.code": "70" + } + }, + { + "match_phrase": { + "event.code": "71" + } + }, + { + "match_phrase": { + "event.code": "72" + } + }, + { + "match_phrase": { + "event.code": "73" + } + }, + { + "match_phrase": { + "event.code": "121" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event", - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3033c1dd-049d-4bf6-8364-5929eea6d982", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "571aae77-0b7e-495c-87a6-a08f531a847c" + ], + "isHistogram": true, + "layerId": "3597ffbf-b15e-437e-87fe-15855feb3865", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "d9b960cd-90ef-429c-8ba9-ef4b377fb595", + "xAccessor": "2e4ce230-0115-4585-9915-78051013336d", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "571aae77-0b7e-495c-87a6-a08f531a847c" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Administrative Summary (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 20, @@ -260,8 +907,9 @@ "y": 0 }, "panelIndex": "3d4e7a89-9376-40e8-a110-aea6fad8704d", - "version": "8.0.0", - "type": "visualization" + "title": "Administrative Summary", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -275,33 +923,67 @@ "y": 20 }, "panelIndex": "c530e489-474a-4a2a-8498-860233140305", - "panelRefName": "panel_2", - "version": "7.11.0" + "panelRefName": "panel_c530e489-474a-4a2a-8498-860233140305", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Administrative - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:33:09.763Z", + "id": "hid_bravura_monitor-578cb360-f9f3-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215", - "name": "panel_2", - "type": "search" + "id": "logs-*", + "name": "647b541e-ba69-4580-8b5c-82b99e9141db:indexpattern-datasource-layer-1d88263b-e6e7-4d37-96f8-aab22804a538", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "647b541e-ba69-4580-8b5c-82b99e9141db:b0d81934-56be-4538-b4be-4b7bbac1d618", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "647b541e-ba69-4580-8b5c-82b99e9141db:bf24b850-2c7a-45f5-b16e-eceec3055f3a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "647b541e-ba69-4580-8b5c-82b99e9141db:348ddca0-46f8-4bd7-88bb-4efafc61eeed", + "type": "index-pattern" }, { - "type": "search", - "name": "647b541e-ba69-4580-8b5c-82b99e9141db:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "3d4e7a89-9376-40e8-a110-aea6fad8704d:indexpattern-datasource-layer-3597ffbf-b15e-437e-87fe-15855feb3865", + "type": "index-pattern" }, { - "type": "search", - "name": "3d4e7a89-9376-40e8-a110-aea6fad8704d:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "3d4e7a89-9376-40e8-a110-aea6fad8704d:3961142c-4326-46ae-81db-52eb0626c9d5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3d4e7a89-9376-40e8-a110-aea6fad8704d:adf6ffb6-33b7-4420-b1e2-a792c250caf5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3d4e7a89-9376-40e8-a110-aea6fad8704d:3033c1dd-049d-4bf6-8364-5929eea6d982", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215", + "name": "c530e489-474a-4a2a-8498-860233140305:panel_c530e489-474a-4a2a-8498-860233140305", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499.json index 028d77fd688..3292937c535 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY3OSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,196 +12,485 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 17, - "i": "9f0e186d-5e7d-495b-968b-65a909a63c78", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "9f0e186d-5e7d-495b-968b-65a909a63c78", "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "574aeda7-ee8d-461e-bebe-ddaa6e8e6ef2": { + "columnOrder": [ + "351a48ad-3de1-4fda-af96-7f6a592a81ad", + "e88ec152-3b3a-4dd6-bc37-8543633b839b", + "4ea3a035-cb85-47ea-b97c-b31811d9a13d" + ], + "columns": { + "351a48ad-3de1-4fda-af96-7f6a592a81ad": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4ea3a035-cb85-47ea-b97c-b31811d9a13d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average Duration", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "e88ec152-3b3a-4dd6-bc37-8543633b839b": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of hid_bravura_monitor.perf.exe", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.exe" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "filter": { - "language": "kuery", - "query": "hid_bravura_monitor.perf.kind: PerfExe AND hid_bravura_monitor.perf.exe: *plugin*" }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "max_bars": 70, - "series": [ + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "", - "line_width": 1, - "metrics": [ - { - "field": "hid_bravura_monitor.perf.duration", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "terms", - "stacked": "none", - "terms_field": "hid_bravura_monitor.perf.exe", - "type": "timeseries" + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "tooltip_mode": "show_all", - "type": "timeseries", - "use_kibana_indexes": false + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-574aeda7-ee8d-461e-bebe-ddaa6e8e6ef2", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "4ea3a035-cb85-47ea-b97c-b31811d9a13d" + ], + "layerId": "574aeda7-ee8d-461e-bebe-ddaa6e8e6ef2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "e88ec152-3b3a-4dd6-bc37-8543633b839b", + "xAccessor": "351a48ad-3de1-4fda-af96-7f6a592a81ad", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "4ea3a035-cb85-47ea-b97c-b31811d9a13d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "title": "", - "type": "metrics", - "uiState": {} + "title": "Plugin Average Duration (converted)", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "visualization" + "enhancements": {}, + "hidePanelTitles": false }, - "title": "Plugin Average Duration" + "gridData": { + "h": 17, + "i": "9f0e186d-5e7d-495b-968b-65a909a63c78", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "9f0e186d-5e7d-495b-968b-65a909a63c78", + "title": "Plugin Average Duration", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Plugin: Performance", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2d04559f-1b00-470a-a8f5-47337cae1934", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b6b951e-864f-4d2e-a5f6-9a17dca7c52f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0f2d197d-4bb8-4c42-b6c5-50d597b2e418", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2d04559f-1b00-470a-a8f5-47337cae1934": { + "columnOrder": [ + "7144d974-09c2-45cd-90f3-dbca003c7ff4", + "ddbfbef8-1119-43bd-99f5-3ad6419ddecc", + "25961f41-5efc-4660-b914-62a19526e0dc", + "c9f7eb76-6070-4b8a-9f93-6088e53416fd", + "e7d0b976-dae5-4fc8-9057-8cdd96e968e9", + "6e765a74-3fe9-41e4-b6bf-8813be923b27" + ], + "columns": { + "25961f41-5efc-4660-b914-62a19526e0dc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "6e765a74-3fe9-41e4-b6bf-8813be923b27": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "7144d974-09c2-45cd-90f3-dbca003c7ff4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Plugin", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ddbfbef8-1119-43bd-99f5-3ad6419ddecc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "c9f7eb76-6070-4b8a-9f93-6088e53416fd": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "ddbfbef8-1119-43bd-99f5-3ad6419ddecc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e7d0b976-dae5-4fc8-9057-8cdd96e968e9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" - }, - "schema": "metric", - "type": "avg" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "min" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "7b6b951e-864f-4d2e-a5f6-9a17dca7c52f", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "index": "logs-*", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "log.logger", + "index": "logs-*", + "key": "log.logger", + "negate": false, + "params": { + "query": "plugin_*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.logger": "plugin_*" + } + } + } + ], + "relation": "AND", + "type": "combined" }, - "schema": "metric", - "type": "max" + "query": {} }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Plugin", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0f2d197d-4bb8-4c42-b6c5-50d597b2e418", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ddbfbef8-1119-43bd-99f5-3ad6419ddecc" + }, + { + "alignment": "left", + "columnId": "25961f41-5efc-4660-b914-62a19526e0dc" + }, + { + "alignment": "left", + "columnId": "c9f7eb76-6070-4b8a-9f93-6088e53416fd" + }, + { + "alignment": "left", + "columnId": "e7d0b976-dae5-4fc8-9057-8cdd96e968e9" + }, + { + "alignment": "left", + "columnId": "6e765a74-3fe9-41e4-b6bf-8813be923b27" + }, + { + "alignment": "left", + "columnId": "7144d974-09c2-45cd-90f3-dbca003c7ff4" + } + ], + "headerRowHeight": "single", + "layerId": "2d04559f-1b00-470a-a8f5-47337cae1934", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Plugin: Performance (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -219,23 +500,37 @@ "y": 17 }, "panelIndex": "f71897e4-f55e-4fb5-93e1-8825546d3116", - "version": "8.0.0", - "type": "visualization" + "title": "Plugin: Performance", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Processes - Plugins", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:35:28.103Z", + "id": "hid_bravura_monitor-6ebde770-fa02-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "search", - "name": "f71897e4-f55e-4fb5-93e1-8825546d3116:search_0", - "id": "hid_bravura_monitor-39072a50-2f42-11eb-b6a1-bdb7d768b585" + "id": "logs-*", + "name": "f71897e4-f55e-4fb5-93e1-8825546d3116:indexpattern-datasource-layer-2d04559f-1b00-470a-a8f5-47337cae1934", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f71897e4-f55e-4fb5-93e1-8825546d3116:7b6b951e-864f-4d2e-a5f6-9a17dca7c52f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f71897e4-f55e-4fb5-93e1-8825546d3116:0f2d197d-4bb8-4c42-b6c5-50d597b2e418", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499.json index 35a335bd471..2271bfe9cd4 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,12 @@ { - "id": "hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4MCwxXQ==", "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"dd242ad5-6b23-45de-951b-6dce367706f6\":{\"type\":\"rangeSliderControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"dd242ad5-6b23-45de-951b-6dce367706f6\",\"fieldName\":\"hid_bravura_monitor.perf.result\",\"title\":\"Result Codes\",\"enhancements\":{}}}}" + }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +18,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -27,223 +28,255 @@ "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Bravura: Selector: Return Code", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "hid_bravura_monitor.perf.result", - "id": "1606164462534", - "indexPatternRefName": "control_0_index_pattern", - "label": "Return Code", - "options": { - "dynamicOptions": true, - "multiselect": false, - "order": "desc", - "size": 10, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", "data": { "aggs": [], "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" } } - } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "Success - 0\n\nUnknown Error - 1\n\nCannot Connect - 3\n\nInvalid Server - 5\n\nAccess Denied - 11\n\nVerify Failed - 14", + "openLinksInNewTab": false + }, + "title": "Connector Return Code: Legend", + "type": "markdown", + "uiState": {} } }, "gridData": { - "h": 7, - "i": "11dfd31e-217a-468c-b9a4-1d171916550b", + "h": 17, + "i": "8e87968f-419b-416a-88b4-69575d6ca6c8", "w": 12, "x": 0, "y": 0 }, - "panelIndex": "11dfd31e-217a-468c-b9a4-1d171916550b", - "version": "8.0.0", - "type": "visualization" + "panelIndex": "8e87968f-419b-416a-88b4-69575d6ca6c8", + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e64028cc-5310-4d46-8d08-c48d14f4976e", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "398f869b-b2c6-4f98-8454-bd9027e4af20", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "b791c871-5071-40cc-b187-9394b4b3a23e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e64028cc-5310-4d46-8d08-c48d14f4976e": { + "columnOrder": [ + "9fb1c744-fa8d-4936-a7bb-d86eb71b5497", + "56fe2770-ef0d-45c4-aedb-6e27ba5d91f5", + "1ccd07b2-5fdb-4c51-a32b-fa42eb9261c2" + ], + "columns": { + "1ccd07b2-5fdb-4c51-a32b-fa42eb9261c2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "56fe2770-ef0d-45c4-aedb-6e27ba5d91f5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "1ccd07b2-5fdb-4c51-a32b-fa42eb9261c2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "9fb1c744-fa8d-4936-a7bb-d86eb71b5497": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "398f869b-b2c6-4f98-8454-bd9027e4af20", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b791c871-5071-40cc-b187-9394b4b3a23e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "1ccd07b2-5fdb-4c51-a32b-fa42eb9261c2" + ], + "isHistogram": true, + "layerId": "e64028cc-5310-4d46-8d08-c48d14f4976e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "56fe2770-ef0d-45c4-aedb-6e27ba5d91f5", + "xAccessor": "9fb1c744-fa8d-4936-a7bb-d86eb71b5497", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "1ccd07b2-5fdb-4c51-a32b-fa42eb9261c2" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Connector Return Code: Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -253,189 +286,333 @@ "y": 0 }, "panelIndex": "ecfdce59-b9f9-4b92-bf44-fc2b0b30940e", - "version": "8.0.0", - "type": "visualization" + "title": "Connector Return Code: Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Legend", - "description": "", - "uiState": {}, - "params": { - "fontSize": 10, - "markdown": "Success - 0\n\nUnknown Error - 1\n\nCannot Connect - 3\n\nInvalid Server - 5\n\nAccess Denied - 11\n\nVerify Failed - 14", - "openLinksInNewTab": false - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-345484b1-683c-4684-ad7c-a34390688a96", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a1124a54-b931-4fb6-a09d-4f0c3e2dc7c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "466c0f28-9ca2-4dad-9160-71abca14d630", + "type": "index-pattern" } - } - } - }, - "gridData": { - "h": 10, - "i": "8e87968f-419b-416a-88b4-69575d6ca6c8", - "w": 12, - "x": 0, - "y": 7 - }, - "panelIndex": "8e87968f-419b-416a-88b4-69575d6ca6c8", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Operation count", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "345484b1-683c-4684-ad7c-a34390688a96": { + "columnOrder": [ + "032a16d1-939b-4fec-a9b4-18595d688c17", + "5cb141cc-4808-43ce-9cee-df7c9ef0284e" + ], + "columns": { + "032a16d1-939b-4fec-a9b4-18595d688c17": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Operation", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5cb141cc-4808-43ce-9cee-df7c9ef0284e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.operation" + }, + "5cb141cc-4808-43ce-9cee-df7c9ef0284e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a1124a54-b931-4fb6-a09d-4f0c3e2dc7c7", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Operation", - "field": "hid_bravura_monitor.perf.operation", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "466c0f28-9ca2-4dad-9160-71abca14d630", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "5cb141cc-4808-43ce-9cee-df7c9ef0284e" + }, + { + "alignment": "left", + "columnId": "032a16d1-939b-4fec-a9b4-18595d688c17" + } + ], + "headerRowHeight": "single", + "layerId": "345484b1-683c-4684-ad7c-a34390688a96", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector Return Code: Operation count (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 19, + "h": 26, "i": "d8250cb1-181e-4c67-8a07-2b5adaa631e1", "w": 12, "x": 0, "y": 17 }, "panelIndex": "d8250cb1-181e-4c67-8a07-2b5adaa631e1", - "version": "8.0.0", - "type": "visualization" + "title": "Connector Return Code: Operation count", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Executable Count", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-38aa1f2e-b428-40dc-bf69-079d55848779", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "66b65a69-bd5e-47af-85ab-477d73f8c266", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9934bdc8-a82f-45bd-9211-ecfeda042ed8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "38aa1f2e-b428-40dc-bf69-079d55848779": { + "columnOrder": [ + "b7901c12-eaec-4b64-a575-d71ef064214d", + "36d685e3-c213-41b0-b6b3-4a45d2c42bda" + ], + "columns": { + "36d685e3-c213-41b0-b6b3-4a45d2c42bda": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b7901c12-eaec-4b64-a575-d71ef064214d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Executable", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "36d685e3-c213-41b0-b6b3-4a45d2c42bda", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "66b65a69-bd5e-47af-85ab-477d73f8c266", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Executable", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9934bdc8-a82f-45bd-9211-ecfeda042ed8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "36d685e3-c213-41b0-b6b3-4a45d2c42bda" + }, + { + "alignment": "left", + "columnId": "b7901c12-eaec-4b64-a575-d71ef064214d" + } + ], + "headerRowHeight": "single", + "layerId": "38aa1f2e-b428-40dc-bf69-079d55848779", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector Return Code: Executable Count (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -445,75 +622,165 @@ "y": 17 }, "panelIndex": "10e16f9a-7072-491a-a67f-3b37e4d2d6fe", - "version": "8.0.0", - "type": "visualization" + "title": "Connector Return Code: Executable Count", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Node counts", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7694aaba-f9a5-4997-89fe-73afcdd2d20d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4686659-41da-4d9f-9e15-ff009112a539", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5c54da27-f9c7-4063-9a0b-d10959a9a85f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7694aaba-f9a5-4997-89fe-73afcdd2d20d": { + "columnOrder": [ + "78dafe73-f62f-4e8d-8bbe-a2f3e3ef28aa", + "dd8e7fc7-79af-424a-8647-ed26b23dffbb" + ], + "columns": { + "78dafe73-f62f-4e8d-8bbe-a2f3e3ef28aa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dd8e7fc7-79af-424a-8647-ed26b23dffbb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "dd8e7fc7-79af-424a-8647-ed26b23dffbb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a4686659-41da-4d9f-9e15-ff009112a539", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5c54da27-f9c7-4063-9a0b-d10959a9a85f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "dd8e7fc7-79af-424a-8647-ed26b23dffbb" + }, + { + "alignment": "left", + "columnId": "78dafe73-f62f-4e8d-8bbe-a2f3e3ef28aa" + } + ], + "headerRowHeight": "single", + "layerId": "7694aaba-f9a5-4997-89fe-73afcdd2d20d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector Return Code: Node counts (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -523,75 +790,165 @@ "y": 17 }, "panelIndex": "4e305609-b4cd-47c1-b927-9bbb1905f879", - "version": "8.0.0", - "type": "visualization" + "title": "Connector Return Code: Node counts", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector Return Code: Messages", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-86727cb2-d2e3-41c6-a57a-569eb63b65f0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "66f6e9d3-335c-42dc-9e50-24fa9f549cdc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7801baee-02c0-447c-98a6-3b2c0a9f3b32", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "86727cb2-d2e3-41c6-a57a-569eb63b65f0": { + "columnOrder": [ + "67116153-f57d-4954-bb1a-fd673eb367f9", + "30e8e1ae-a3f8-4876-a3e5-d12103ab7e5b" + ], + "columns": { + "30e8e1ae-a3f8-4876-a3e5-d12103ab7e5b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "67116153-f57d-4954-bb1a-fd673eb367f9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Message", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "30e8e1ae-a3f8-4876-a3e5-d12103ab7e5b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.message" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "66f6e9d3-335c-42dc-9e50-24fa9f549cdc", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Message", - "field": "hid_bravura_monitor.perf.message", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7801baee-02c0-447c-98a6-3b2c0a9f3b32", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "30e8e1ae-a3f8-4876-a3e5-d12103ab7e5b" + }, + { + "alignment": "left", + "columnId": "67116153-f57d-4954-bb1a-fd673eb367f9" + } + ], + "headerRowHeight": "single", + "layerId": "86727cb2-d2e3-41c6-a57a-569eb63b65f0", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector Return Code: Messages (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -601,8 +958,9 @@ "y": 17 }, "panelIndex": "50d3505b-77d3-4128-a8f2-dd42c7e33ac0", - "version": "8.0.0", - "type": "visualization" + "title": "Connector Return Code: Messages", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -613,61 +971,110 @@ "i": "5added44-f55b-4d64-bac0-af8514792e8c", "w": 48, "x": 0, - "y": 36 + "y": 43 }, "panelIndex": "5added44-f55b-4d64-bac0-af8514792e8c", - "panelRefName": "panel_7", - "version": "7.11.0" + "panelRefName": "panel_5added44-f55b-4d64-bac0-af8514792e8c", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Integrations - Connector Return Code", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:41:35.613Z", + "id": "hid_bravura_monitor-7c5c1ef0-fa03-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa", - "name": "panel_7", - "type": "search" + "id": "logs-*", + "name": "ecfdce59-b9f9-4b92-bf44-fc2b0b30940e:indexpattern-datasource-layer-e64028cc-5310-4d46-8d08-c48d14f4976e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ecfdce59-b9f9-4b92-bf44-fc2b0b30940e:398f869b-b2c6-4f98-8454-bd9027e4af20", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ecfdce59-b9f9-4b92-bf44-fc2b0b30940e:b791c871-5071-40cc-b187-9394b4b3a23e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8250cb1-181e-4c67-8a07-2b5adaa631e1:indexpattern-datasource-layer-345484b1-683c-4684-ad7c-a34390688a96", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8250cb1-181e-4c67-8a07-2b5adaa631e1:a1124a54-b931-4fb6-a09d-4f0c3e2dc7c7", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "11dfd31e-217a-468c-b9a4-1d171916550b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "d8250cb1-181e-4c67-8a07-2b5adaa631e1:466c0f28-9ca2-4dad-9160-71abca14d630", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "11dfd31e-217a-468c-b9a4-1d171916550b:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "10e16f9a-7072-491a-a67f-3b37e4d2d6fe:indexpattern-datasource-layer-38aa1f2e-b428-40dc-bf69-079d55848779", + "type": "index-pattern" }, { - "type": "search", - "name": "ecfdce59-b9f9-4b92-bf44-fc2b0b30940e:search_0", - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "10e16f9a-7072-491a-a67f-3b37e4d2d6fe:66b65a69-bd5e-47af-85ab-477d73f8c266", + "type": "index-pattern" }, { - "type": "search", - "name": "d8250cb1-181e-4c67-8a07-2b5adaa631e1:search_0", - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "10e16f9a-7072-491a-a67f-3b37e4d2d6fe:9934bdc8-a82f-45bd-9211-ecfeda042ed8", + "type": "index-pattern" }, { - "type": "search", - "name": "10e16f9a-7072-491a-a67f-3b37e4d2d6fe:search_0", - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4e305609-b4cd-47c1-b927-9bbb1905f879:indexpattern-datasource-layer-7694aaba-f9a5-4997-89fe-73afcdd2d20d", + "type": "index-pattern" }, { - "type": "search", - "name": "4e305609-b4cd-47c1-b927-9bbb1905f879:search_0", - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4e305609-b4cd-47c1-b927-9bbb1905f879:a4686659-41da-4d9f-9e15-ff009112a539", + "type": "index-pattern" }, { - "type": "search", - "name": "50d3505b-77d3-4128-a8f2-dd42c7e33ac0:search_0", - "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "4e305609-b4cd-47c1-b927-9bbb1905f879:5c54da27-f9c7-4063-9a0b-d10959a9a85f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50d3505b-77d3-4128-a8f2-dd42c7e33ac0:indexpattern-datasource-layer-86727cb2-d2e3-41c6-a57a-569eb63b65f0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50d3505b-77d3-4128-a8f2-dd42c7e33ac0:66f6e9d3-335c-42dc-9e50-24fa9f549cdc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50d3505b-77d3-4128-a8f2-dd42c7e33ac0:7801baee-02c0-447c-98a6-3b2c0a9f3b32", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa", + "name": "5added44-f55b-4d64-bac0-af8514792e8c:panel_5added44-f55b-4d64-bac0-af8514792e8c", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_dd242ad5-6b23-45de-951b-6dce367706f6:rangeSliderDataView", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499.json index 79cbe25386e..8cffff4d83f 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4MSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,76 +12,141 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dataset: Log Type Counts", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6c9738b2-c7c9-48a4-a906-8551e186368d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5b19a8f-d157-44aa-8721-437361a66a4b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6c9738b2-c7c9-48a4-a906-8551e186368d": { + "columnOrder": [ + "cfaa41de-89fa-412f-8be7-4a021d05bf88", + "a8c676d3-9be7-48e6-b86d-56236a84d458" + ], + "columns": { + "a8c676d3-9be7-48e6-b86d-56236a84d458": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cfaa41de-89fa-412f-8be7-4a021d05bf88": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Log Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a8c676d3-9be7-48e6-b86d-56236a84d458", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.kind" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Log Type", - "field": "hid_bravura_monitor.perf.kind", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f5b19a8f-d157-44aa-8721-437361a66a4b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "a8c676d3-9be7-48e6-b86d-56236a84d458" + }, + { + "alignment": "left", + "columnId": "cfaa41de-89fa-412f-8be7-4a021d05bf88" + } + ], + "headerRowHeight": "single", + "layerId": "6c9738b2-c7c9-48a4-a906-8551e186368d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Dataset: Log Type Counts (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -99,154 +156,200 @@ "y": 0 }, "panelIndex": "bbd62230-da7b-4a8d-8048-164a39c870a6", - "version": "8.0.0", - "type": "visualization" + "title": "Dataset: Log Type Counts", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dataset: Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-390db996-1f73-44b2-8c34-3037b60fc05d", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "32fcbd1d-621d-4c24-aa82-d5966f2fcb28", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "390db996-1f73-44b2-8c34-3037b60fc05d": { + "columnOrder": [ + "1dc33c3a-bf7b-4298-b6e6-443657be7b76", + "becf3fda-7f1b-45de-8182-e53a50f30fea", + "b09e0093-d0de-4a73-a414-e197e80c1a8a" + ], + "columns": { + "1dc33c3a-bf7b-4298-b6e6-443657be7b76": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b09e0093-d0de-4a73-a414-e197e80c1a8a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "becf3fda-7f1b-45de-8182-e53a50f30fea": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b09e0093-d0de-4a73-a414-e197e80c1a8a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "32fcbd1d-621d-4c24-aa82-d5966f2fcb28", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "b09e0093-d0de-4a73-a414-e197e80c1a8a" + ], + "isHistogram": true, + "layerId": "390db996-1f73-44b2-8c34-3037b60fc05d", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "becf3fda-7f1b-45de-8182-e53a50f30fea", + "xAccessor": "1dc33c3a-bf7b-4298-b6e6-443657be7b76", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "b09e0093-d0de-4a73-a414-e197e80c1a8a" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true }, - { - "enabled": true, - "id": "3", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Dataset: Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 25, @@ -256,28 +359,42 @@ "y": 0 }, "panelIndex": "006c196d-830d-4713-bf84-1bf393366bdc", - "version": "8.0.0", - "type": "visualization" + "title": "Dataset: Histogram", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Dataset - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:45:54.371Z", + "id": "hid_bravura_monitor-8187dcb0-fa04-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "bbd62230-da7b-4a8d-8048-164a39c870a6:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "bbd62230-da7b-4a8d-8048-164a39c870a6:indexpattern-datasource-layer-6c9738b2-c7c9-48a4-a906-8551e186368d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bbd62230-da7b-4a8d-8048-164a39c870a6:f5b19a8f-d157-44aa-8721-437361a66a4b", + "type": "index-pattern" }, { - "type": "search", - "name": "006c196d-830d-4713-bf84-1bf393366bdc:search_0", - "id": "hid_bravura_monitor-465760e0-25d7-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "006c196d-830d-4713-bf84-1bf393366bdc:indexpattern-datasource-layer-390db996-1f73-44b2-8c34-3037b60fc05d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "006c196d-830d-4713-bf84-1bf393366bdc:32fcbd1d-621d-4c24-aa82-d5966f2fcb28", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef.json index 4e2126c8c9b..606c22661ca 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4MiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,160 +12,228 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Replication Database Connection Failures", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7010afa4-2b0a-4de2-a6b3-54acca576cc5", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "d70d3b06-f9c3-45f1-975d-28c7c0c478cd", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "bd2b6ce5-10b9-49ce-a0e8-113de2b7be26", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "f4168741-3c70-4dd1-8230-cd4217754cd5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7010afa4-2b0a-4de2-a6b3-54acca576cc5": { + "columnOrder": [ + "77e3ca8b-4dc9-404f-a9e4-389db2bca00a", + "cbdf1e1c-e113-4d7b-aa6e-518aab9192ce" + ], + "columns": { + "77e3ca8b-4dc9-404f-a9e4-389db2bca00a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cbdf1e1c-e113-4d7b-aa6e-518aab9192ce": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "d70d3b06-f9c3-45f1-975d-28c7c0c478cd", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "bd2b6ce5-10b9-49ce-a0e8-113de2b7be26", + "key": "event.code", + "negate": false, + "params": { + "query": "6" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.code": "6" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f4168741-3c70-4dd1-8230-cd4217754cd5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "cbdf1e1c-e113-4d7b-aa6e-518aab9192ce" + ], + "isHistogram": true, + "layerId": "7010afa4-2b0a-4de2-a6b3-54acca576cc5", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "6" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "6" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "77e3ca8b-4dc9-404f-a9e4-389db2bca00a", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "cbdf1e1c-e113-4d7b-aa6e-518aab9192ce" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Replication Database Connection Failures (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -183,160 +243,226 @@ "y": 0 }, "panelIndex": "b525b8b8-13fc-4a51-82b0-233acc227625", - "version": "8.0.0", - "type": "visualization" + "title": "Replication Database Connection Failures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Replication Database Transaction Failures", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-53b6e74c-bd7a-412e-8b4d-9644476b4c1e", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "8fb475d2-e5a4-402e-af77-21a25ea9f409", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "aa6289ca-de4e-42f7-9021-3f125e5f1e24", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "53a3f631-bcd2-4abb-9cbc-dd081f4747fa", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "53b6e74c-bd7a-412e-8b4d-9644476b4c1e": { + "columnOrder": [ + "5fd0a3aa-f4bd-4ebd-b123-60ac0b576f1a", + "b5bad37d-66b5-4883-b64a-4f3d39b83b3f" + ], + "columns": { + "5fd0a3aa-f4bd-4ebd-b123-60ac0b576f1a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b5bad37d-66b5-4883-b64a-4f3d39b83b3f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "8fb475d2-e5a4-402e-af77-21a25ea9f409", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "aa6289ca-de4e-42f7-9021-3f125e5f1e24", + "key": "event.code", + "negate": false, + "params": { + "query": "8" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.code": "8" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "53a3f631-bcd2-4abb-9cbc-dd081f4747fa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "8" - }, - "type": "phrase" + "accessors": [ + "b5bad37d-66b5-4883-b64a-4f3d39b83b3f" + ], + "isHistogram": true, + "layerId": "53b6e74c-bd7a-412e-8b4d-9644476b4c1e", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "event.code": "8" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "5fd0a3aa-f4bd-4ebd-b123-60ac0b576f1a", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "b5bad37d-66b5-4883-b64a-4f3d39b83b3f" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Replication Database Transaction Failures (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -346,160 +472,226 @@ "y": 0 }, "panelIndex": "16f346a5-a0bf-421a-ba88-c678b4fffb2a", - "version": "8.0.0", - "type": "visualization" + "title": "Replication Database Transaction Failures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Replication Queue Insert Failures", - "description": "Failed to insert data into database replication queue", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-957022ec-8da3-4d65-9817-fee280a40904", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "90944850-5c98-40ee-a439-450b3f498042", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "1561325f-01ff-4b94-a1b3-62428293f796", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "1e06a6eb-8872-41d4-a9b0-1562793d39d8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "957022ec-8da3-4d65-9817-fee280a40904": { + "columnOrder": [ + "5f5b7d38-ead2-4899-a15b-86056c0cb1a7", + "321cdd24-a538-4587-8a85-e57a501c5138" + ], + "columns": { + "321cdd24-a538-4587-8a85-e57a501c5138": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5f5b7d38-ead2-4899-a15b-86056c0cb1a7": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "90944850-5c98-40ee-a439-450b3f498042", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "1561325f-01ff-4b94-a1b3-62428293f796", + "key": "event.code", + "negate": false, + "params": { + "query": "9" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.code": "9" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1e06a6eb-8872-41d4-a9b0-1562793d39d8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "9" - }, - "type": "phrase" + "accessors": [ + "321cdd24-a538-4587-8a85-e57a501c5138" + ], + "isHistogram": true, + "layerId": "957022ec-8da3-4d65-9817-fee280a40904", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "event.code": "9" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "5f5b7d38-ead2-4899-a15b-86056c0cb1a7", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "321cdd24-a538-4587-8a85-e57a501c5138" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Replication Queue Insert Failures (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -509,160 +701,226 @@ "y": 15 }, "panelIndex": "c23d8833-8154-4aa8-af8e-44dccd8cc199", - "version": "8.0.0", - "type": "visualization" + "title": "Replication Queue Insert Failures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Replication Database Stored Procedure Failures", - "description": "Failed to run stored procedure on replication database.", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-130b112c-983d-44c3-ac26-07d3816bc4d9", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "5e05844a-1f2e-42c1-92d1-450731321d74", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "d9ccf141-a077-4316-a45d-e64842257ed2", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "f1cc841a-e90a-4f28-b970-64e73c87d445", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "130b112c-983d-44c3-ac26-07d3816bc4d9": { + "columnOrder": [ + "ea9aa9c3-3fd0-4a63-837a-497b3e761de2", + "d49ec039-4d33-4519-9cd6-61a57f60dc3b" + ], + "columns": { + "d49ec039-4d33-4519-9cd6-61a57f60dc3b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ea9aa9c3-3fd0-4a63-837a-497b3e761de2": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "5e05844a-1f2e-42c1-92d1-450731321d74", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "d9ccf141-a077-4316-a45d-e64842257ed2", + "key": "event.code", + "negate": false, + "params": { + "query": "10" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.code": "10" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f1cc841a-e90a-4f28-b970-64e73c87d445", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "10" - }, - "type": "phrase" + "accessors": [ + "d49ec039-4d33-4519-9cd6-61a57f60dc3b" + ], + "isHistogram": true, + "layerId": "130b112c-983d-44c3-ac26-07d3816bc4d9", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "event.code": "10" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "ea9aa9c3-3fd0-4a63-837a-497b3e761de2", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "d49ec039-4d33-4519-9cd6-61a57f60dc3b" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Replication Database Stored Procedure Failures (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -672,160 +930,226 @@ "y": 15 }, "panelIndex": "085c710d-1038-4a6a-be6f-21039079b15b", - "version": "8.0.0", - "type": "visualization" + "title": "Replication Database Stored Procedure Failures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "File Replication Errors", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ea594e23-5787-40fb-9b2a-57a108d77816", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "5c25e380-29d5-48d5-bb87-c69c6b384f51", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "d1ef8bb0-3509-4957-bac3-5494aafad7a0", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "8dad062d-1d5e-4805-922b-32d83ed24961", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ea594e23-5787-40fb-9b2a-57a108d77816": { + "columnOrder": [ + "e7437b16-dda5-4ed4-923f-927715ae46b7", + "48e391d0-7e3b-4f68-b6a3-e768a589da8f" + ], + "columns": { + "48e391d0-7e3b-4f68-b6a3-e768a589da8f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e7437b16-dda5-4ed4-923f-927715ae46b7": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "5c25e380-29d5-48d5-bb87-c69c6b384f51", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } + }, { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "d1ef8bb0-3509-4957-bac3-5494aafad7a0", + "key": "event.code", + "negate": false, + "params": { + "query": "78" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.code": "78" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8dad062d-1d5e-4805-922b-32d83ed24961", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "48e391d0-7e3b-4f68-b6a3-e768a589da8f" + ], + "isHistogram": true, + "layerId": "ea594e23-5787-40fb-9b2a-57a108d77816", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "78" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "78" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "e7437b16-dda5-4ed4-923f-927715ae46b7", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "48e391d0-7e3b-4f68-b6a3-e768a589da8f" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "File Replication Errors (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -835,8 +1159,9 @@ "y": 15 }, "panelIndex": "33ae3b0f-db67-48f5-abb8-192c029c5d98", - "version": "8.0.0", - "type": "visualization" + "title": "File Replication Errors", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -850,73 +1175,127 @@ "y": 30 }, "panelIndex": "a70a3621-2a8e-48ed-8870-201731c7e08a", - "panelRefName": "panel_5", - "version": "8.0.0" + "panelRefName": "panel_a70a3621-2a8e-48ed-8870-201731c7e08a", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Replication (Windows Event)", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:48:57.187Z", + "id": "hid_bravura_monitor-91029280-0520-11ec-853c-2bf1ec8ddeef", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef", - "name": "panel_5", - "type": "search" + "id": "logs-*", + "name": "b525b8b8-13fc-4a51-82b0-233acc227625:indexpattern-datasource-layer-7010afa4-2b0a-4de2-a6b3-54acca576cc5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b525b8b8-13fc-4a51-82b0-233acc227625:d70d3b06-f9c3-45f1-975d-28c7c0c478cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b525b8b8-13fc-4a51-82b0-233acc227625:bd2b6ce5-10b9-49ce-a0e8-113de2b7be26", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b525b8b8-13fc-4a51-82b0-233acc227625:f4168741-3c70-4dd1-8230-cd4217754cd5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:indexpattern-datasource-layer-53b6e74c-bd7a-412e-8b4d-9644476b4c1e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:8fb475d2-e5a4-402e-af77-21a25ea9f409", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:aa6289ca-de4e-42f7-9021-3f125e5f1e24", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:53a3f631-bcd2-4abb-9cbc-dd081f4747fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:indexpattern-datasource-layer-957022ec-8da3-4d65-9817-fee280a40904", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b525b8b8-13fc-4a51-82b0-233acc227625:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:90944850-5c98-40ee-a439-450b3f498042", + "type": "index-pattern" }, { - "type": "search", - "name": "b525b8b8-13fc-4a51-82b0-233acc227625:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:1561325f-01ff-4b94-a1b3-62428293f796", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:1e06a6eb-8872-41d4-a9b0-1562793d39d8", + "type": "index-pattern" }, { - "type": "search", - "name": "16f346a5-a0bf-421a-ba88-c678b4fffb2a:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "085c710d-1038-4a6a-be6f-21039079b15b:indexpattern-datasource-layer-130b112c-983d-44c3-ac26-07d3816bc4d9", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "085c710d-1038-4a6a-be6f-21039079b15b:5e05844a-1f2e-42c1-92d1-450731321d74", + "type": "index-pattern" }, { - "type": "search", - "name": "c23d8833-8154-4aa8-af8e-44dccd8cc199:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "085c710d-1038-4a6a-be6f-21039079b15b:d9ccf141-a077-4316-a45d-e64842257ed2", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "085c710d-1038-4a6a-be6f-21039079b15b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "085c710d-1038-4a6a-be6f-21039079b15b:f1cc841a-e90a-4f28-b970-64e73c87d445", + "type": "index-pattern" }, { - "type": "search", - "name": "085c710d-1038-4a6a-be6f-21039079b15b:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:indexpattern-datasource-layer-ea594e23-5787-40fb-9b2a-57a108d77816", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:5c25e380-29d5-48d5-bb87-c69c6b384f51", + "type": "index-pattern" }, { - "type": "search", - "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:d1ef8bb0-3509-4957-bac3-5494aafad7a0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33ae3b0f-db67-48f5-abb8-192c029c5d98:8dad062d-1d5e-4805-922b-32d83ed24961", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef", + "name": "a70a3621-2a8e-48ed-8870-201731c7e08a:panel_a70a3621-2a8e-48ed-8870-201731c7e08a", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499.json index b3127b02a9a..6b5ba68943c 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4MywxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -27,15 +22,6 @@ "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Users: Pages: Help", - "description": "", - "uiState": {}, - "params": { - "fontSize": 12, - "markdown": "Transactions represent a UI page the user sees.\n\nWhat pages are people calling and what performance are they experiencing?", - "openLinksInNewTab": false - }, - "type": "markdown", "data": { "aggs": [], "searchSource": { @@ -45,7 +31,16 @@ "query": "" } } - } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "Transactions represent a UI page the user sees.\n\nWhat pages are people calling and what performance are they experiencing?", + "openLinksInNewTab": false + }, + "title": "Users: Pages: Help", + "type": "markdown", + "uiState": {} } }, "gridData": { @@ -56,184 +51,199 @@ "y": 0 }, "panelIndex": "486bc4b4-3c64-46f8-a319-01204f38c3be", - "version": "8.0.0", - "type": "visualization" + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Users: Summary: Node Usage", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-94a471f5-5de9-4277-9f9f-5daf9a646a07", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "row": true, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count of unique User ID" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "4b4385f1-91b9-4849-81ee-39679a57ca23", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "94a471f5-5de9-4277-9f9f-5daf9a646a07": { + "columnOrder": [ + "2ec7caa3-abbc-4b16-ae51-6b6d0cc2a230", + "7b1f90af-98b4-47f5-85b2-14b809b83d41", + "4050ac4e-47c1-428e-a085-f8ed2d264450" + ], + "columns": { + "2ec7caa3-abbc-4b16-ae51-6b6d0cc2a230": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4050ac4e-47c1-428e-a085-f8ed2d264450": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of unique User ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "7b1f90af-98b4-47f5-85b2-14b809b83d41": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4050ac4e-47c1-428e-a085-f8ed2d264450", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count of unique User ID" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count of unique User ID", - "field": "user.id" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "4b4385f1-91b9-4849-81ee-39679a57ca23", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "4050ac4e-47c1-428e-a085-f8ed2d264450" + ], + "isHistogram": true, + "layerId": "94a471f5-5de9-4277-9f9f-5daf9a646a07", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "hid_bravura_monitor.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "hid_bravura_monitor.log" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "7b1f90af-98b4-47f5-85b2-14b809b83d41", + "xAccessor": "2ec7caa3-abbc-4b16-ae51-6b6d0cc2a230", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "4050ac4e-47c1-428e-a085-f8ed2d264450" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count of unique User ID" } - } - } + }, + "title": "Users: Summary: Node Usage (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 10, @@ -243,142 +253,217 @@ "y": 0 }, "panelIndex": "b5abbb3d-eb82-45a8-a972-13b692b11c16", - "title": "Users: Pages: Node Usage", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Summary: Node Usage", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Users: Summary: User Logins", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d611bbeb-6dad-46e1-a086-72e24209c695", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ed3bc03-66ce-4f9c-81c9-cec01cc86192", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8b80917e-d970-4ec0-8c21-68c9bc8eabbe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16ec3daf-2483-444c-acb4-41f0e694e389", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a546ba66-9d4f-4eab-8ac0-23f2167b0fd7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d611bbeb-6dad-46e1-a086-72e24209c695": { + "columnOrder": [ + "175509c5-90f2-4ea6-9811-eb52cd23bcff", + "84f140ac-c729-4a1a-9f63-ad9c5a1930e9" + ], + "columns": { + "175509c5-90f2-4ea6-9811-eb52cd23bcff": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "84f140ac-c729-4a1a-9f63-ad9c5a1930e9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "user.id" + }, + "84f140ac-c729-4a1a-9f63-ad9c5a1930e9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8ed3bc03-66ce-4f9c-81c9-cec01cc86192", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "User Name", - "field": "user.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "8b80917e-d970-4ec0-8c21-68c9bc8eabbe", + "key": "log.logger", + "negate": false, + "params": { + "query": "psf.exe" }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.logger": "psf.exe" } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "16ec3daf-2483-444c-acb4-41f0e694e389", + "key": "hid_bravura_monitor.perf.transid", + "negate": false, + "params": { + "query": "C_AUTHCHAIN_LOGIN" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "psf.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "psf.exe" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.transid": "C_AUTHCHAIN_LOGIN" } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a546ba66-9d4f-4eab-8ac0-23f2167b0fd7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "key": "hid_bravura_monitor.perf.transid", - "negate": false, - "params": { - "query": "C_AUTHCHAIN_LOGIN" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.transid": "C_AUTHCHAIN_LOGIN" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "84f140ac-c729-4a1a-9f63-ad9c5a1930e9" + }, + { + "alignment": "left", + "columnId": "175509c5-90f2-4ea6-9811-eb52cd23bcff" + } + ], + "headerRowHeight": "single", + "layerId": "d611bbeb-6dad-46e1-a086-72e24209c695", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Summary: User Logins (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -388,172 +473,294 @@ "y": 10 }, "panelIndex": "f1b6be80-c65b-4d88-861a-e8a66275bd62", - "title": "Users: Pages: User Logins", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Summary: User Logins", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Pages: UI Transactions", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8c2c7500-05db-4aa0-908d-dafb4eed828e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "551deea3-46ff-437b-ba45-42b73dfd0a6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50ab6c7c-fda6-4d76-a135-acc97da4a560", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7165b4f3-6812-455c-9b89-d8078009f588", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8c2c7500-05db-4aa0-908d-dafb4eed828e": { + "columnOrder": [ + "a9834d5f-038c-4237-a2a9-ef5b0a3bda28", + "e9c3d5c1-125e-4611-aebb-29863e77a20c", + "277ad5aa-c8ee-4c92-8abd-0aa6bbbbe686", + "f58b8bdb-a555-442b-8164-2606de8364d7", + "59f205cb-8c65-422f-b08c-fa9403816da9", + "b1ab1e25-0e86-4f00-b979-152d83b35ee3", + "c7524305-569b-438e-aba7-b378c2274ebf" + ], + "columns": { + "277ad5aa-c8ee-4c92-8abd-0aa6bbbbe686": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "59f205cb-8c65-422f-b08c-fa9403816da9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "a9834d5f-038c-4237-a2a9-ef5b0a3bda28": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "UI Transaction", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "277ad5aa-c8ee-4c92-8abd-0aa6bbbbe686", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.transid" + }, + "b1ab1e25-0e86-4f00-b979-152d83b35ee3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "c7524305-569b-438e-aba7-b378c2274ebf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "e9c3d5c1-125e-4611-aebb-29863e77a20c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Executable", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "277ad5aa-c8ee-4c92-8abd-0aa6bbbbe686", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "f58b8bdb-a555-442b-8164-2606de8364d7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "UI Transaction", - "field": "hid_bravura_monitor.perf.transid", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Executable", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "meta": { + "alias": null, + "disabled": false, + "index": "551deea3-46ff-437b-ba45-42b73dfd0a6a", + "key": "hid_bravura_monitor.perf.transid", + "negate": false, + "type": "exists", + "value": "exists" }, - "schema": "bucket", - "type": "terms" + "query": { + "exists": { + "field": "hid_bravura_monitor.perf.transid" + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Min (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "50ab6c7c-fda6-4d76-a135-acc97da4a560", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } }, { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Max (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "7", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "hid_bravura_monitor.perf.duration", + "index": "7165b4f3-6812-455c-9b89-d8078009f588", + "key": "hid_bravura_monitor.perf.duration", + "negate": false, + "params": { + "gte": "1" + }, + "type": "range", + "value": { + "gte": "1" + } }, - "schema": "metric", - "type": "sum" + "query": { + "range": { + "hid_bravura_monitor.perf.duration": { + "gte": "1" + } + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Transaction is NULL", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.transid", - "negate": true, - "params": { - "query": "" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.transid": "" - } - } + "alignment": "left", + "columnId": "277ad5aa-c8ee-4c92-8abd-0aa6bbbbe686" }, { - "$state": { - "store": "appState" - }, - "exists": { - "field": "hid_bravura_monitor.perf.transid" - }, - "meta": { - "alias": "Transaction exists", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "hid_bravura_monitor.perf.transid", - "negate": false, - "type": "exists", - "value": "exists" - } + "alignment": "left", + "columnId": "f58b8bdb-a555-442b-8164-2606de8364d7" + }, + { + "alignment": "left", + "columnId": "59f205cb-8c65-422f-b08c-fa9403816da9" + }, + { + "alignment": "left", + "columnId": "b1ab1e25-0e86-4f00-b979-152d83b35ee3" + }, + { + "alignment": "left", + "columnId": "c7524305-569b-438e-aba7-b378c2274ebf" + }, + { + "alignment": "left", + "columnId": "a9834d5f-038c-4237-a2a9-ef5b0a3bda28" + }, + { + "alignment": "left", + "columnId": "e9c3d5c1-125e-4611-aebb-29863e77a20c" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "8c2c7500-05db-4aa0-908d-dafb4eed828e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Pages: UI Transactions (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -563,8 +770,9 @@ "y": 10 }, "panelIndex": "09961de3-ede6-4ecf-a45a-ebe3040366f0", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Pages: UI Transactions", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -578,63 +786,82 @@ "y": 28 }, "panelIndex": "144da17a-d86d-49a2-9dfa-db606fb73c54", - "panelRefName": "panel_4", - "version": "7.11.0" + "panelRefName": "panel_144da17a-d86d-49a2-9dfa-db606fb73c54", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Users - Pages", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:57:04.578Z", + "id": "hid_bravura_monitor-a8739000-f9fd-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243", - "name": "panel_4", - "type": "search" + "id": "logs-*", + "name": "b5abbb3d-eb82-45a8-a972-13b692b11c16:indexpattern-datasource-layer-94a471f5-5de9-4277-9f9f-5daf9a646a07", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b5abbb3d-eb82-45a8-a972-13b692b11c16:4b4385f1-91b9-4849-81ee-39679a57ca23", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:indexpattern-datasource-layer-d611bbeb-6dad-46e1-a086-72e24209c695", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:8ed3bc03-66ce-4f9c-81c9-cec01cc86192", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b5abbb3d-eb82-45a8-a972-13b692b11c16:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:8b80917e-d970-4ec0-8c21-68c9bc8eabbe", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:16ec3daf-2483-444c-acb4-41f0e694e389", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:a546ba66-9d4f-4eab-8ac0-23f2167b0fd7", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:indexpattern-datasource-layer-8c2c7500-05db-4aa0-908d-dafb4eed828e", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f1b6be80-c65b-4d88-861a-e8a66275bd62:kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:551deea3-46ff-437b-ba45-42b73dfd0a6a", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:50ab6c7c-fda6-4d76-a135-acc97da4a560", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:7165b4f3-6812-455c-9b89-d8078009f588", + "type": "index-pattern" }, { - "type": "search", - "name": "09961de3-ede6-4ecf-a45a-ebe3040366f0:search_0", - "id": "hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243" + "id": "hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243", + "name": "144da17a-d86d-49a2-9dfa-db606fb73c54:panel_144da17a-d86d-49a2-9dfa-db606fb73c54", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499.json index b789663f809..80e694c4578 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4NCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,98 +12,210 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Password Resets Started", - "description": "62 - Self-service password reset\n65 - Help-desk assisted password reset", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2f4f144e-2ed8-4855-b1b3-d8e60ecea9ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57ec3069-7fc4-4184-a471-a85a68665522", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa65a19f-f786-415d-87b0-9838fe00a649", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f165820e-be80-42e7-ac64-b1b2148ca1cf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2f4f144e-2ed8-4855-b1b3-d8e60ecea9ea": { + "columnOrder": [ + "2df64618-68f5-4ab6-94cd-99d4e20a1a41", + "2a7aa6e0-5d0d-4b11-8dfe-27d912739b38" + ], + "columns": { + "2a7aa6e0-5d0d-4b11-8dfe-27d912739b38": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2df64618-68f5-4ab6-94cd-99d4e20a1a41": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2a7aa6e0-5d0d-4b11-8dfe-27d912739b38", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.code" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "57ec3069-7fc4-4184-a471-a85a68665522", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event Code", - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fa65a19f-f786-415d-87b0-9838fe00a649", + "key": "event.code", + "negate": false, + "params": [ + "62", + "65" + ], + "type": "phrases", + "value": [ + "62", + "65" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "62" + } + }, + { + "match_phrase": { + "event.code": "65" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f165820e-be80-42e7-ac64-b1b2148ca1cf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "62", - "65" - ], - "type": "phrases", - "value": "62, 65" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "62" - } - }, - { - "match_phrase": { - "event.code": "65" - } - } - ] - } - } + "alignment": "left", + "columnId": "2a7aa6e0-5d0d-4b11-8dfe-27d912739b38" + }, + { + "alignment": "left", + "columnId": "2df64618-68f5-4ab6-94cd-99d4e20a1a41" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "2f4f144e-2ed8-4855-b1b3-d8e60ecea9ea", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Password Resets Started (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -121,203 +225,285 @@ "y": 0 }, "panelIndex": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1", - "version": "8.0.0", - "type": "visualization" + "title": "Password Resets Started", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Password Resets Trend", - "description": "63 - Self-service password reset successful.\n64 - Self-service password reset failed.\n66 - Help-desk assisted password reset successful.\n67 - Help-desk assisted password reset failed.", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "fittingFunction": "zero", - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-965b853d-59b5-4057-b39a-3ce1531e382e", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "cd327a24-3ef4-4845-ad0e-24c1b9ea0d73", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "line", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "d72b4a76-6966-4c54-bc06-79bd2d728c9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67d61420-efcd-4644-9417-b76b07eef6b6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "965b853d-59b5-4057-b39a-3ce1531e382e": { + "columnOrder": [ + "928569c6-ccb8-4d99-a7bb-4c9c9eb42cb7", + "e87f7913-d503-4269-a174-f4b2e31f826a", + "3efb12fa-4516-4450-99d3-971d619ca148" + ], + "columns": { + "3efb12fa-4516-4450-99d3-971d619ca148": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "928569c6-ccb8-4d99-a7bb-4c9c9eb42cb7": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e87f7913-d503-4269-a174-f4b2e31f826a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3efb12fa-4516-4450-99d3-971d619ca148", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.code" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "line", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "cd327a24-3ef4-4845-ad0e-24c1b9ea0d73", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "line", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" - }, - "useNormalizedEsInterval": true + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d72b4a76-6966-4c54-bc06-79bd2d728c9f", + "key": "event.code", + "negate": false, + "params": [ + "63", + "64", + "66", + "67" + ], + "type": "phrases", + "value": [ + "63", + "64", + "66", + "67" + ] }, - "schema": "segment", - "type": "date_histogram" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "63" + } + }, + { + "match_phrase": { + "event.code": "64" + } + }, + { + "match_phrase": { + "event.code": "66" + } + }, + { + "match_phrase": { + "event.code": "67" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event", - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "67d61420-efcd-4644-9417-b76b07eef6b6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "3efb12fa-4516-4450-99d3-971d619ca148" + ], + "isHistogram": true, + "layerId": "965b853d-59b5-4057-b39a-3ce1531e382e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "63", - "64", - "66", - "67" - ], - "type": "phrases", - "value": "63, 64, 66, 67" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "63" - } - }, - { - "match_phrase": { - "event.code": "64" - } - }, - { - "match_phrase": { - "event.code": "66" - } - }, - { - "match_phrase": { - "event.code": "67" - } - } - ] + "seriesType": "line", + "simpleView": false, + "splitAccessor": "e87f7913-d503-4269-a174-f4b2e31f826a", + "xAccessor": "928569c6-ccb8-4d99-a7bb-4c9c9eb42cb7", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "3efb12fa-4516-4450-99d3-971d619ca148" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Password Resets Trend (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -327,38 +513,62 @@ "y": 0 }, "panelIndex": "11298d56-d098-45e3-b23a-6992c24c5652", - "version": "8.0.0", - "type": "visualization" + "title": "Password Resets Trend", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Administrative - Password Resets", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T10:59:50.751Z", + "id": "hid_bravura_monitor-a9ea8420-f9f3-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:indexpattern-datasource-layer-2f4f144e-2ed8-4855-b1b3-d8e60ecea9ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:57ec3069-7fc4-4184-a471-a85a68665522", + "type": "index-pattern" }, { - "type": "search", - "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:fa65a19f-f786-415d-87b0-9838fe00a649", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "11298d56-d098-45e3-b23a-6992c24c5652:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "5d50c25d-870c-4aa5-a1f9-5c79904db3d1:f165820e-be80-42e7-ac64-b1b2148ca1cf", + "type": "index-pattern" }, { - "type": "search", - "name": "11298d56-d098-45e3-b23a-6992c24c5652:search_0", - "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "11298d56-d098-45e3-b23a-6992c24c5652:indexpattern-datasource-layer-965b853d-59b5-4057-b39a-3ce1531e382e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "11298d56-d098-45e3-b23a-6992c24c5652:cd327a24-3ef4-4845-ad0e-24c1b9ea0d73", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "11298d56-d098-45e3-b23a-6992c24c5652:d72b4a76-6966-4c54-bc06-79bd2d728c9f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "11298d56-d098-45e3-b23a-6992c24c5652:67d61420-efcd-4644-9417-b76b07eef6b6", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120.json index 955cd70cfba..8d5c6364b3c 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4NSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,84 +12,224 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 10 Requesters", - "description": "", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1a500a93-b538-40d1-8e9d-21f72f0590af", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ba08d772-0ae5-457f-8d71-cba854dfb58b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cf6d8362-79c1-4ddd-b74a-dc6b2d29020b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "97c0bfd0-0fd2-4952-aef5-b959d40d3e9a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1a500a93-b538-40d1-8e9d-21f72f0590af": { + "columnOrder": [ + "32b4e890-5cb8-44df-aaa2-20ce18148227", + "6291096b-30b1-45b2-8c37-4839967fe57e" + ], + "columns": { + "32b4e890-5cb8-44df-aaa2-20ce18148227": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Requester", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6291096b-30b1-45b2-8c37-4839967fe57e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "winlog.event_data.Requester" + }, + "6291096b-30b1-45b2-8c37-4839967fe57e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ba08d772-0ae5-457f-8d71-cba854dfb58b", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Requester", - "field": "winlog.event_data.Requester", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "cf6d8362-79c1-4ddd-b74a-dc6b2d29020b", + "key": "event.code", + "negate": false, + "params": [ + "81", + "82", + "83", + "84" + ], + "type": "phrases", + "value": [ + "81", + "82", + "83", + "84" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "81" + } + }, + { + "match_phrase": { + "event.code": "82" + } + }, + { + "match_phrase": { + "event.code": "83" + } + }, + { + "match_phrase": { + "event.code": "84" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "97c0bfd0-0fd2-4952-aef5-b959d40d3e9a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": true, - "params": { - "query": "85" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "85" - } - } + "alignment": "left", + "columnId": "6291096b-30b1-45b2-8c37-4839967fe57e" + }, + { + "alignment": "left", + "columnId": "32b4e890-5cb8-44df-aaa2-20ce18148227" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "1a500a93-b538-40d1-8e9d-21f72f0590af", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -107,156 +239,259 @@ "y": 0 }, "panelIndex": "84ac5874-8913-4514-8d51-f2b3cd522a49", - "version": "8.0.0", - "type": "visualization" + "title": "Top 10 Requesters", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Workflow Request Trend", - "description": "81 - Approved\n82 - Denied\n83 - Cancelled\n84 - Revoked\n85 - Processed", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "fittingFunction": "zero", - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-56632f6c-c794-44b2-a024-dcefefd9358c", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "c17e2688-49b6-4dc2-bd25-97d42fcef6e1", + "type": "index-pattern" }, - "radiusRatio": 9, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "line", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "ea77434a-aff9-474c-b59a-7cdbf1a08969", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "56632f6c-c794-44b2-a024-dcefefd9358c": { + "columnOrder": [ + "ab345b17-21a9-47de-95c4-4b412c759586", + "1f4db61e-0319-4a83-a787-ae0b2bee7508", + "911cbe1a-1fc3-447e-bd1a-68c1f7d18fca" + ], + "columns": { + "1f4db61e-0319-4a83-a787-ae0b2bee7508": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "911cbe1a-1fc3-447e-bd1a-68c1f7d18fca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.code" + }, + "911cbe1a-1fc3-447e-bd1a-68c1f7d18fca": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ab345b17-21a9-47de-95c4-4b412c759586": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "line", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "$state": { + "store": "appState" }, - "type": "value" - } - ] - }, - "type": "line", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "c17e2688-49b6-4dc2-bd25-97d42fcef6e1", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event Code", - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "ea77434a-aff9-474c-b59a-7cdbf1a08969", + "key": "event.code", + "negate": false, + "params": [ + "81", + "82", + "83", + "84", + "85" + ], + "type": "phrases", + "value": "81, 82, 83, 84, 85" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "81" + } + }, + { + "match_phrase": { + "event.code": "82" + } + }, + { + "match_phrase": { + "event.code": "83" + } + }, + { + "match_phrase": { + "event.code": "84" + } + }, + { + "match_phrase": { + "event.code": "85" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "911cbe1a-1fc3-447e-bd1a-68c1f7d18fca" + ], + "isHistogram": true, + "layerId": "56632f6c-c794-44b2-a024-dcefefd9358c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "simpleView": false, + "splitAccessor": "1f4db61e-0319-4a83-a787-ae0b2bee7508", + "xAccessor": "ab345b17-21a9-47de-95c4-4b412c759586", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "911cbe1a-1fc3-447e-bd1a-68c1f7d18fca" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Workflow Request Trend (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 30, @@ -266,84 +501,222 @@ "y": 0 }, "panelIndex": "9f39a308-2152-471a-911f-5bb8e316262e", - "version": "8.0.0", - "type": "visualization" + "title": "Workflow Request Trend", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top 10 Recipients", - "description": "", - "uiState": {}, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0e53d35b-a6a8-4863-b672-a111a3d71d18", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d35635d2-c428-49bc-a5d7-20ec4ac84ba0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7ba53832-31ce-4ee6-912d-5ba6b74780fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "70ebb9aa-fb03-4f93-8cbf-348c1925c953", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0e53d35b-a6a8-4863-b672-a111a3d71d18": { + "columnOrder": [ + "88d8c1f8-ad0b-48bd-b5f4-cc13f9305e26", + "3efdb945-9933-4860-9d73-dbc9958fecfa" + ], + "columns": { + "3efdb945-9933-4860-9d73-dbc9958fecfa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "88d8c1f8-ad0b-48bd-b5f4-cc13f9305e26": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Recipient", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3efdb945-9933-4860-9d73-dbc9958fecfa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "winlog.event_data.Recipient" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d35635d2-c428-49bc-a5d7-20ec4ac84ba0", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Recipient", - "field": "winlog.event_data.Recipient", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7ba53832-31ce-4ee6-912d-5ba6b74780fa", + "key": "event.code", + "negate": false, + "params": [ + "81", + "82", + "83", + "84" + ], + "type": "phrases", + "value": [ + "81", + "82", + "83", + "84" + ] }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "81" + } + }, + { + "match_phrase": { + "event.code": "82" + } + }, + { + "match_phrase": { + "event.code": "83" + } + }, + { + "match_phrase": { + "event.code": "84" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "70ebb9aa-fb03-4f93-8cbf-348c1925c953", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": true, - "params": { - "query": "85" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "85" - } - } + "alignment": "left", + "columnId": "3efdb945-9933-4860-9d73-dbc9958fecfa" + }, + { + "alignment": "left", + "columnId": "88d8c1f8-ad0b-48bd-b5f4-cc13f9305e26" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "0e53d35b-a6a8-4863-b672-a111a3d71d18", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -353,8 +726,9 @@ "y": 15 }, "panelIndex": "93f64f12-ac6d-4462-96c2-53d0c477a0ca", - "version": "8.0.0", - "type": "visualization" + "title": "Top 10 Recipients", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -368,48 +742,82 @@ "y": 30 }, "panelIndex": "87039932-a528-4dba-875e-bed137149330", - "panelRefName": "panel_3", - "version": "8.0.0" + "panelRefName": "panel_87039932-a528-4dba-875e-bed137149330", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Workflow - Summary (Windows Event)", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:32:31.093Z", + "id": "hid_bravura_monitor-b0fd1f50-06a2-11ec-a72d-e52b79e13120", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215", - "name": "panel_3", - "type": "search" + "id": "logs-*", + "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:indexpattern-datasource-layer-1a500a93-b538-40d1-8e9d-21f72f0590af", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:ba08d772-0ae5-457f-8d71-cba854dfb58b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:cf6d8362-79c1-4ddd-b74a-dc6b2d29020b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:97c0bfd0-0fd2-4952-aef5-b959d40d3e9a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9f39a308-2152-471a-911f-5bb8e316262e:indexpattern-datasource-layer-56632f6c-c794-44b2-a024-dcefefd9358c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9f39a308-2152-471a-911f-5bb8e316262e:c17e2688-49b6-4dc2-bd25-97d42fcef6e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9f39a308-2152-471a-911f-5bb8e316262e:ea77434a-aff9-474c-b59a-7cdbf1a08969", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:indexpattern-datasource-layer-0e53d35b-a6a8-4863-b672-a111a3d71d18", + "type": "index-pattern" }, { - "type": "search", - "name": "84ac5874-8913-4514-8d51-f2b3cd522a49:search_0", - "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:d35635d2-c428-49bc-a5d7-20ec4ac84ba0", + "type": "index-pattern" }, { - "type": "search", - "name": "9f39a308-2152-471a-911f-5bb8e316262e:search_0", - "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:7ba53832-31ce-4ee6-912d-5ba6b74780fa", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:70ebb9aa-fb03-4f93-8cbf-348c1925c953", + "type": "index-pattern" }, { - "type": "search", - "name": "93f64f12-ac6d-4462-96c2-53d0c477a0ca:search_0", - "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215" + "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215", + "name": "87039932-a528-4dba-875e-bed137149330:panel_87039932-a528-4dba-875e-bed137149330", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499.json index 0ffb7aa2f6a..ede385e6253 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4NiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,177 +12,229 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Operation Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-17c95859-356c-438b-87be-3029f3ced8e7", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "e9838715-1d00-417f-8d56-a779a2dbe085", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "7d38ba60-3cce-456f-956a-eaf0a39d00c3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "17c95859-356c-438b-87be-3029f3ced8e7": { + "columnOrder": [ + "cea0276d-2427-4f49-84d5-9485c4cd3527", + "ea538d3a-df03-4c99-a971-a821dc2527c7", + "41de53d0-9e75-4217-ac4e-97308b5d13b8" + ], + "columns": { + "41de53d0-9e75-4217-ac4e-97308b5d13b8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cea0276d-2427-4f49-84d5-9485c4cd3527": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ea538d3a-df03-4c99-a971-a821dc2527c7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Operation", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "41de53d0-9e75-4217-ac4e-97308b5d13b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.operation" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "e9838715-1d00-417f-8d56-a779a2dbe085", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "hid_bravura_monitor.perf.operation", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7d38ba60-3cce-456f-956a-eaf0a39d00c3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "41de53d0-9e75-4217-ac4e-97308b5d13b8" + ], + "isHistogram": true, + "layerId": "17c95859-356c-438b-87be-3029f3ced8e7", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "ea538d3a-df03-4c99-a971-a821dc2527c7", + "xAccessor": "cea0276d-2427-4f49-84d5-9485c4cd3527", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "41de53d0-9e75-4217-ac4e-97308b5d13b8" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Connector: Operation Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -200,138 +244,233 @@ "y": 0 }, "panelIndex": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Operation Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Target Performance", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9644014f-b8a1-4232-bb3d-b7c9a42ae17c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7be4bdd7-2c73-4534-ba75-01c876718784", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "76f42e46-8b37-4fd0-a430-bab7f4a26105", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9644014f-b8a1-4232-bb3d-b7c9a42ae17c": { + "columnOrder": [ + "086f15ed-8085-4731-b8d5-82e7ca287062", + "e2462ba1-e50d-421d-ad87-1d20f85fed90", + "dd7d94dc-63de-4a9c-87b8-ee687fb20019", + "ea1f3ab8-d55c-4013-9e45-df32567a926a", + "5453cde6-fd7c-4451-ac04-ea32b401082b", + "b78b5f12-58c7-4fb5-834d-f3301c324b3c" + ], + "columns": { + "086f15ed-8085-4731-b8d5-82e7ca287062": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Target ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e2462ba1-e50d-421d-ad87-1d20f85fed90", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.targetid" + }, + "5453cde6-fd7c-4451-ac04-ea32b401082b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "b78b5f12-58c7-4fb5-834d-f3301c324b3c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "dd7d94dc-63de-4a9c-87b8-ee687fb20019": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "e2462ba1-e50d-421d-ad87-1d20f85fed90": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ea1f3ab8-d55c-4013-9e45-df32567a926a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Target ID", - "field": "hid_bravura_monitor.perf.targetid", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Min (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "7be4bdd7-2c73-4534-ba75-01c876718784", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Max (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "76f42e46-8b37-4fd0-a430-bab7f4a26105", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "e2462ba1-e50d-421d-ad87-1d20f85fed90" + }, + { + "alignment": "left", + "columnId": "dd7d94dc-63de-4a9c-87b8-ee687fb20019" + }, + { + "alignment": "left", + "columnId": "ea1f3ab8-d55c-4013-9e45-df32567a926a" + }, + { + "alignment": "left", + "columnId": "5453cde6-fd7c-4451-ac04-ea32b401082b" + }, + { + "alignment": "left", + "columnId": "b78b5f12-58c7-4fb5-834d-f3301c324b3c" + }, + { + "alignment": "left", + "columnId": "086f15ed-8085-4731-b8d5-82e7ca287062" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "9644014f-b8a1-4232-bb3d-b7c9a42ae17c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector: Target Performance (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -341,38 +480,52 @@ "y": 15 }, "panelIndex": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Target Performance", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Integrations - Connector Performance", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:33:56.763Z", + "id": "hid_bravura_monitor-b66f3780-fa03-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd:indexpattern-datasource-layer-17c95859-356c-438b-87be-3029f3ced8e7", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd:e9838715-1d00-417f-8d56-a779a2dbe085", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "9ccdc869-ebc2-4871-a11a-8d594aff7ccd:7d38ba60-3cce-456f-956a-eaf0a39d00c3", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38:indexpattern-datasource-layer-9644014f-b8a1-4232-bb3d-b7c9a42ae17c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38:7be4bdd7-2c73-4534-ba75-01c876718784", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b68e2e9c-13fa-4a90-baa2-40caefe3cb38:76f42e46-8b37-4fd0-a430-bab7f4a26105", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499.json index 90034df53ca..c6fd63ad2af 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4NywxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,158 +12,202 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Replication: Total over time", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ff0bfe08-bf48-4dbf-a2db-24fdc7faeb31", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Total (ms)" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "cef24c4f-7a62-42f5-abe9-759016fb2984", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ff0bfe08-bf48-4dbf-a2db-24fdc7faeb31": { + "columnOrder": [ + "a8ed6fe1-fac5-4bd4-9dde-dd8b8c2093c8", + "65de395e-b1a3-411e-a0b5-db63e44d2828", + "7c89207a-3c1c-4099-a219-57f1ae46227a" + ], + "columns": { + "65de395e-b1a3-411e-a0b5-db63e44d2828": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7c89207a-3c1c-4099-a219-57f1ae46227a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "7c89207a-3c1c-4099-a219-57f1ae46227a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "a8ed6fe1-fac5-4bd4-9dde-dd8b8c2093c8": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Total (ms)" + "meta": { + "alias": null, + "disabled": false, + "index": "cef24c4f-7a62-42f5-abe9-759016fb2984", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfReplication" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfReplication" + } + } } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" - }, - "schema": "metric", - "type": "sum" + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "7c89207a-3c1c-4099-a219-57f1ae46227a" + ], + "isHistogram": true, + "layerId": "ff0bfe08-bf48-4dbf-a2db-24fdc7faeb31", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "65de395e-b1a3-411e-a0b5-db63e44d2828", + "xAccessor": "a8ed6fe1-fac5-4bd4-9dde-dd8b8c2093c8", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "7c89207a-3c1c-4099-a219-57f1ae46227a" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Total (ms)" } - } - } + }, + "title": "Database: Replication: Total over time (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -181,115 +217,233 @@ "y": 0 }, "panelIndex": "f5d8eb70-30ce-4899-9905-2aa35954d01d", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Replication: Total over time", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Replication: Stored Procedures", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b44489df-3ca6-4188-bdba-6217928a6c53", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "688eba65-ed39-47dc-a3c1-f11fb186093f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "38448c2a-5042-4c3e-81d3-ce554e6d64d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b44489df-3ca6-4188-bdba-6217928a6c53": { + "columnOrder": [ + "a5e55136-843f-4103-938f-f7538e4e1275", + "2d3f0dc4-aaf1-448a-996a-1329de6c8ada", + "2c578793-cf78-4b94-9920-b9e8aa113f39", + "11b4ee34-265c-4046-b013-03f5b4d10657", + "584a049d-a730-4d7f-9ae8-a9aed1fd3a31", + "dcfd740d-0da3-48b1-884a-b457524c3f41" + ], + "columns": { + "11b4ee34-265c-4046-b013-03f5b4d10657": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "2c578793-cf78-4b94-9920-b9e8aa113f39": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "2d3f0dc4-aaf1-448a-996a-1329de6c8ada": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "584a049d-a730-4d7f-9ae8-a9aed1fd3a31": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "a5e55136-843f-4103-938f-f7538e4e1275": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2d3f0dc4-aaf1-448a-996a-1329de6c8ada", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + }, + "dcfd740d-0da3-48b1-884a-b457524c3f41": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Function", - "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "688eba65-ed39-47dc-a3c1-f11fb186093f", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfReplication" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfReplication" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "38448c2a-5042-4c3e-81d3-ce554e6d64d2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "2d3f0dc4-aaf1-448a-996a-1329de6c8ada" + }, + { + "alignment": "left", + "columnId": "2c578793-cf78-4b94-9920-b9e8aa113f39" + }, + { + "alignment": "left", + "columnId": "11b4ee34-265c-4046-b013-03f5b4d10657" + }, + { + "alignment": "left", + "columnId": "584a049d-a730-4d7f-9ae8-a9aed1fd3a31" + }, + { + "alignment": "left", + "columnId": "dcfd740d-0da3-48b1-884a-b457524c3f41" + }, + { + "alignment": "left", + "columnId": "a5e55136-843f-4103-938f-f7538e4e1275" + } + ], + "headerRowHeight": "single", + "layerId": "b44489df-3ca6-4188-bdba-6217928a6c53", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Database: Replication: Stored Procedures (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -299,102 +453,213 @@ "y": 15 }, "panelIndex": "a5499566-62cb-421c-8276-7a9398643a06", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Replication: Stored Procedures", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Replication: Load by queue", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1653b3d6-752a-41dc-a3b3-4ba3a7593253", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "19f8eb06-4375-42b9-8aa4-0713ec48f747", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e4d3300a-43eb-4b9e-bb6b-312aa7e1230a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1653b3d6-752a-41dc-a3b3-4ba3a7593253": { + "columnOrder": [ + "342d9e51-4e71-4636-8b71-c9a643ea7b07", + "2524b80b-3333-4583-a23a-cb6ff6f2368a", + "8a4db593-7840-4cf2-a463-3bfce982b0eb", + "790cf3fa-423d-4cc3-b86b-f9290a0d9801" + ], + "columns": { + "2524b80b-3333-4583-a23a-cb6ff6f2368a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Queue", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8a4db593-7840-4cf2-a463-3bfce982b0eb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.receivequeue" + }, + "342d9e51-4e71-4636-8b71-c9a643ea7b07": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8a4db593-7840-4cf2-a463-3bfce982b0eb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "790cf3fa-423d-4cc3-b86b-f9290a0d9801": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "8a4db593-7840-4cf2-a463-3bfce982b0eb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "meta": { + "alias": null, + "disabled": false, + "index": "19f8eb06-4375-42b9-8aa4-0713ec48f747", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfReplication" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfReplication" + } + } }, { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Queue", - "field": "hid_bravura_monitor.perf.receivequeue", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e4d3300a-43eb-4b9e-bb6b-312aa7e1230a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "8a4db593-7840-4cf2-a463-3bfce982b0eb" + }, + { + "alignment": "left", + "columnId": "790cf3fa-423d-4cc3-b86b-f9290a0d9801" + }, + { + "alignment": "left", + "columnId": "342d9e51-4e71-4636-8b71-c9a643ea7b07" + }, + { + "alignment": "left", + "columnId": "2524b80b-3333-4583-a23a-cb6ff6f2368a" + } + ], + "headerRowHeight": "single", + "layerId": "1653b3d6-752a-41dc-a3b3-4ba3a7593253", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Database: Replication: Load by queue (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -404,8 +669,9 @@ "y": 15 }, "panelIndex": "5fc759c3-9678-4b3c-b0d5-dcfad77adfe8", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Replication: Load by queue", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -419,38 +685,67 @@ "y": 30 }, "panelIndex": "84970d7a-efbd-451d-9619-25381510ab94", - "panelRefName": "panel_3", - "version": "8.0.0" + "panelRefName": "panel_84970d7a-efbd-451d-9619-25381510ab94", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Replication (Logs)", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:35:49.304Z", + "id": "hid_bravura_monitor-b9bc5190-fa01-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a", - "name": "panel_3", - "type": "search" + "id": "logs-*", + "name": "f5d8eb70-30ce-4899-9905-2aa35954d01d:indexpattern-datasource-layer-ff0bfe08-bf48-4dbf-a2db-24fdc7faeb31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5d8eb70-30ce-4899-9905-2aa35954d01d:cef24c4f-7a62-42f5-abe9-759016fb2984", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5499566-62cb-421c-8276-7a9398643a06:indexpattern-datasource-layer-b44489df-3ca6-4188-bdba-6217928a6c53", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5499566-62cb-421c-8276-7a9398643a06:688eba65-ed39-47dc-a3c1-f11fb186093f", + "type": "index-pattern" }, { - "type": "search", - "name": "f5d8eb70-30ce-4899-9905-2aa35954d01d:search_0", - "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a" + "id": "logs-*", + "name": "a5499566-62cb-421c-8276-7a9398643a06:38448c2a-5042-4c3e-81d3-ce554e6d64d2", + "type": "index-pattern" }, { - "type": "search", - "name": "a5499566-62cb-421c-8276-7a9398643a06:search_0", - "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a" + "id": "logs-*", + "name": "5fc759c3-9678-4b3c-b0d5-dcfad77adfe8:indexpattern-datasource-layer-1653b3d6-752a-41dc-a3b3-4ba3a7593253", + "type": "index-pattern" }, { - "type": "search", - "name": "5fc759c3-9678-4b3c-b0d5-dcfad77adfe8:search_0", - "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a" + "id": "logs-*", + "name": "5fc759c3-9678-4b3c-b0d5-dcfad77adfe8:19f8eb06-4375-42b9-8aa4-0713ec48f747", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5fc759c3-9678-4b3c-b0d5-dcfad77adfe8:e4d3300a-43eb-4b9e-bb6b-312aa7e1230a", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a", + "name": "84970d7a-efbd-451d-9619-25381510ab94:panel_84970d7a-efbd-451d-9619-25381510ab94", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499.json index 982f2571363..de4cec1d570 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4OCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -27,15 +22,6 @@ "embeddableConfig": { "enhancements": {}, "savedVis": { - "title": "Users: API: Help", - "description": "", - "uiState": {}, - "params": { - "fontSize": 12, - "markdown": "Ajax is a REST like API used by the UI.\n\nWhat actions are people calling and what performance are they experiencing?", - "openLinksInNewTab": false - }, - "type": "markdown", "data": { "aggs": [], "searchSource": { @@ -45,7 +31,16 @@ "query": "" } } - } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "Ajax is a REST like API used by the UI.\n\nWhat actions are people calling and what performance are they experiencing?", + "openLinksInNewTab": false + }, + "title": "Users: API: Help", + "type": "markdown", + "uiState": {} } }, "gridData": { @@ -56,155 +51,226 @@ "y": 0 }, "panelIndex": "f71be298-074a-43c0-a3fe-1035fd98a8a7", - "version": "8.0.0", - "type": "visualization" + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: API: Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-48184ced-899d-49ff-b0d4-bfcd0e09f773", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "987256e2-9d41-4ade-8f1f-95e20e91f0d2", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "a5406507-caa1-480a-bac7-adce42e7dfb8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "48184ced-899d-49ff-b0d4-bfcd0e09f773": { + "columnOrder": [ + "5c5eadef-f32c-4706-bd32-31ca1d3b5819", + "a26e3a11-62ca-42be-be88-a3aacdf576d4", + "3e9e89a2-ea79-4140-8ce5-388e34a27c0c" + ], + "columns": { + "3e9e89a2-ea79-4140-8ce5-388e34a27c0c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "5c5eadef-f32c-4706-bd32-31ca1d3b5819": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a26e3a11-62ca-42be-be88-a3aacdf576d4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3e9e89a2-ea79-4140-8ce5-388e34a27c0c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "$state": { + "store": "appState" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "987256e2-9d41-4ade-8f1f-95e20e91f0d2", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfAjax" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfAjax" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a5406507-caa1-480a-bac7-adce42e7dfb8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "3e9e89a2-ea79-4140-8ce5-388e34a27c0c" + ], + "isHistogram": true, + "layerId": "48184ced-899d-49ff-b0d4-bfcd0e09f773", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "a26e3a11-62ca-42be-be88-a3aacdf576d4", + "xAccessor": "5c5eadef-f32c-4706-bd32-31ca1d3b5819", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "3e9e89a2-ea79-4140-8ce5-388e34a27c0c" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Users: API: Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 13, @@ -214,75 +280,165 @@ "y": 0 }, "panelIndex": "b80b0e2a-b786-48ec-88a5-bc8104ddbd42", - "version": "8.0.0", - "type": "visualization" + "title": "Users: API: Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: API: Users", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9fa49b05-fc8f-4162-8313-a8da485f3caa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "870d3055-95fe-42af-a35a-7ec296a4b83c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c326b8a1-c9fc-4013-9169-d1bfd4f3274b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9fa49b05-fc8f-4162-8313-a8da485f3caa": { + "columnOrder": [ + "88424577-0b59-47ce-8e8c-2c8c254366ed", + "e53bf0fc-31c5-4d88-8cc4-a62b86084feb" + ], + "columns": { + "88424577-0b59-47ce-8e8c-2c8c254366ed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e53bf0fc-31c5-4d88-8cc4-a62b86084feb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "user.id" + }, + "e53bf0fc-31c5-4d88-8cc4-a62b86084feb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "870d3055-95fe-42af-a35a-7ec296a4b83c", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfAjax" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfAjax" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "User", - "field": "user.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c326b8a1-c9fc-4013-9169-d1bfd4f3274b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "e53bf0fc-31c5-4d88-8cc4-a62b86084feb" + }, + { + "alignment": "left", + "columnId": "88424577-0b59-47ce-8e8c-2c8c254366ed" + } + ], + "headerRowHeight": "single", + "layerId": "9fa49b05-fc8f-4162-8313-a8da485f3caa", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: API: Users (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -292,75 +448,165 @@ "y": 13 }, "panelIndex": "60432682-b874-48c8-9b8b-3bbf4e650385", - "version": "8.0.0", - "type": "visualization" + "title": "Users: API: Users", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: API: Calls per Node", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0ae273b0-5ae6-4865-904d-d8fc70f4ad48", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51291bf6-9501-48f9-9e43-9cd59422c304", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bb754c3c-e6aa-469e-8764-359d698bdd3c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0ae273b0-5ae6-4865-904d-d8fc70f4ad48": { + "columnOrder": [ + "541c6c10-f837-47fa-9b81-994b8c9143cd", + "b036ca9c-6e83-4493-b9ed-ea9f45eb3f44" + ], + "columns": { + "541c6c10-f837-47fa-9b81-994b8c9143cd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b036ca9c-6e83-4493-b9ed-ea9f45eb3f44", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "b036ca9c-6e83-4493-b9ed-ea9f45eb3f44": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "51291bf6-9501-48f9-9e43-9cd59422c304", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfAjax" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfAjax" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bb754c3c-e6aa-469e-8764-359d698bdd3c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "b036ca9c-6e83-4493-b9ed-ea9f45eb3f44" + }, + { + "alignment": "left", + "columnId": "541c6c10-f837-47fa-9b81-994b8c9143cd" + } + ], + "headerRowHeight": "single", + "layerId": "0ae273b0-5ae6-4865-904d-d8fc70f4ad48", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: API: Calls per Node (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -370,115 +616,233 @@ "y": 13 }, "panelIndex": "2af36389-5601-4930-b3ec-b44c671c56ff", - "version": "8.0.0", - "type": "visualization" + "title": "Users: API: Calls per Node", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: API: Function Performance", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-819a875a-2ce9-459f-bcd3-e41b917daa51", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "de42656a-484a-41ba-be07-731a3a53add7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0b78552b-193a-4f69-a131-4d238db8cf74", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "819a875a-2ce9-459f-bcd3-e41b917daa51": { + "columnOrder": [ + "db7f323f-16fc-4133-9cd0-ffe07daf3359", + "c7f00dcc-6d50-4209-a043-b6499e492118", + "aee3ef97-1d12-4347-9cd5-4a687187e9fa", + "ca23b424-55c9-4b69-9f6f-08c881fc9c6c", + "16a7724d-1df1-4e1e-92ac-464317870de2", + "4de56c70-7b87-4e0c-91ff-43e3c721c971" + ], + "columns": { + "16a7724d-1df1-4e1e-92ac-464317870de2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "4de56c70-7b87-4e0c-91ff-43e3c721c971": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "aee3ef97-1d12-4347-9cd5-4a687187e9fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "c7f00dcc-6d50-4209-a043-b6499e492118": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ca23b424-55c9-4b69-9f6f-08c881fc9c6c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Minimum (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "db7f323f-16fc-4133-9cd0-ffe07daf3359": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c7f00dcc-6d50-4209-a043-b6499e492118", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" - }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Minimum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "min" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Maximum (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "de42656a-484a-41ba-be07-731a3a53add7", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfAjax" + }, + "type": "phrase" }, - "schema": "metric", - "type": "max" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfAjax" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Function", - "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0b78552b-193a-4f69-a131-4d238db8cf74", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "c7f00dcc-6d50-4209-a043-b6499e492118" + }, + { + "alignment": "left", + "columnId": "aee3ef97-1d12-4347-9cd5-4a687187e9fa" + }, + { + "alignment": "left", + "columnId": "ca23b424-55c9-4b69-9f6f-08c881fc9c6c" + }, + { + "alignment": "left", + "columnId": "16a7724d-1df1-4e1e-92ac-464317870de2" + }, + { + "alignment": "left", + "columnId": "4de56c70-7b87-4e0c-91ff-43e3c721c971" + }, + { + "alignment": "left", + "columnId": "db7f323f-16fc-4133-9cd0-ffe07daf3359" + } + ], + "headerRowHeight": "single", + "layerId": "819a875a-2ce9-459f-bcd3-e41b917daa51", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: API: Function Performance (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -488,8 +852,9 @@ "y": 13 }, "panelIndex": "ed2e421f-36f7-4501-9e4e-34ddae454f07", - "version": "8.0.0", - "type": "visualization" + "title": "Users: API: Function Performance", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -503,43 +868,87 @@ "y": 31 }, "panelIndex": "7dd049bb-de23-4838-9bec-3d66ef9c07bc", - "panelRefName": "panel_5", - "version": "8.0.0" + "panelRefName": "panel_7dd049bb-de23-4838-9bec-3d66ef9c07bc", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Users - API", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:37:57.748Z", + "id": "hid_bravura_monitor-c5417bd0-f9fc-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289", - "name": "panel_5", - "type": "search" + "id": "logs-*", + "name": "b80b0e2a-b786-48ec-88a5-bc8104ddbd42:indexpattern-datasource-layer-48184ced-899d-49ff-b0d4-bfcd0e09f773", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b80b0e2a-b786-48ec-88a5-bc8104ddbd42:987256e2-9d41-4ade-8f1f-95e20e91f0d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b80b0e2a-b786-48ec-88a5-bc8104ddbd42:a5406507-caa1-480a-bac7-adce42e7dfb8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60432682-b874-48c8-9b8b-3bbf4e650385:indexpattern-datasource-layer-9fa49b05-fc8f-4162-8313-a8da485f3caa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60432682-b874-48c8-9b8b-3bbf4e650385:870d3055-95fe-42af-a35a-7ec296a4b83c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60432682-b874-48c8-9b8b-3bbf4e650385:c326b8a1-c9fc-4013-9169-d1bfd4f3274b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2af36389-5601-4930-b3ec-b44c671c56ff:indexpattern-datasource-layer-0ae273b0-5ae6-4865-904d-d8fc70f4ad48", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2af36389-5601-4930-b3ec-b44c671c56ff:51291bf6-9501-48f9-9e43-9cd59422c304", + "type": "index-pattern" }, { - "type": "search", - "name": "b80b0e2a-b786-48ec-88a5-bc8104ddbd42:search_0", - "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "2af36389-5601-4930-b3ec-b44c671c56ff:bb754c3c-e6aa-469e-8764-359d698bdd3c", + "type": "index-pattern" }, { - "type": "search", - "name": "60432682-b874-48c8-9b8b-3bbf4e650385:search_0", - "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "ed2e421f-36f7-4501-9e4e-34ddae454f07:indexpattern-datasource-layer-819a875a-2ce9-459f-bcd3-e41b917daa51", + "type": "index-pattern" }, { - "type": "search", - "name": "2af36389-5601-4930-b3ec-b44c671c56ff:search_0", - "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "ed2e421f-36f7-4501-9e4e-34ddae454f07:de42656a-484a-41ba-be07-731a3a53add7", + "type": "index-pattern" }, { - "type": "search", - "name": "ed2e421f-36f7-4501-9e4e-34ddae454f07:search_0", - "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "ed2e421f-36f7-4501-9e4e-34ddae454f07:0b78552b-193a-4f69-a131-4d238db8cf74", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289", + "name": "7dd049bb-de23-4838-9bec-3d66ef9c07bc:panel_7dd049bb-de23-4838-9bec-3d66ef9c07bc", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3.json index 629be8f2a70..0f5851dcd3c 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY4OSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,75 +12,184 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Logins", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-28beeee9-52bc-4d20-8308-c0781c53879a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "424bba35-5ce1-42b3-834d-db7d0f582486", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "470f3e41-200a-4f74-a94e-e644b3ba1cab", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "28beeee9-52bc-4d20-8308-c0781c53879a": { + "columnOrder": [ + "80b71bb5-dce7-41ba-9ec6-07b553091bcc", + "af00cd8f-d3c1-4490-b1a1-cc5bdd868d55" + ], + "columns": { + "80b71bb5-dce7-41ba-9ec6-07b553091bcc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "af00cd8f-d3c1-4490-b1a1-cc5bdd868d55", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "af00cd8f-d3c1-4490-b1a1-cc5bdd868d55": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "424bba35-5ce1-42b3-834d-db7d0f582486", + "key": "event.action", + "negate": false, + "params": [ + "logged-in", + "logged-in-special" + ], + "type": "phrases", + "value": [ + "logged-in", + "logged-in-special" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.action": "logged-in" + } + }, + { + "match_phrase": { + "event.action": "logged-in-special" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "User", - "field": "user.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "470f3e41-200a-4f74-a94e-e644b3ba1cab", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "af00cd8f-d3c1-4490-b1a1-cc5bdd868d55" + }, + { + "alignment": "left", + "columnId": "80b71bb5-dce7-41ba-9ec6-07b553091bcc" + } + ], + "headerRowHeight": "single", + "layerId": "28beeee9-52bc-4d20-8308-c0781c53879a", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -98,154 +199,244 @@ "y": 0 }, "panelIndex": "5d934c5f-f909-4f75-a036-ac6253f5f974", - "version": "8.0.0", - "type": "visualization" + "title": "User Logins", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Login Attempts", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7e40bbf6-ed02-43c4-b734-6b1861674ecb", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "87b4e61c-d4e3-4276-988a-9ae53c450bd8", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "2239b070-f41c-406a-bbe6-f0a2727f47b1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7e40bbf6-ed02-43c4-b734-6b1861674ecb": { + "columnOrder": [ + "befd9832-6da9-472a-a3f5-e57961446f5b", + "0df2cbd4-5615-4d70-99b7-a60314ea8606", + "58f7e0d4-2504-4337-98b7-ad38ea8b248f" + ], + "columns": { + "0df2cbd4-5615-4d70-99b7-a60314ea8606": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "58f7e0d4-2504-4337-98b7-ad38ea8b248f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "58f7e0d4-2504-4337-98b7-ad38ea8b248f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "befd9832-6da9-472a-a3f5-e57961446f5b": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "meta": { + "alias": null, + "disabled": false, + "index": "87b4e61c-d4e3-4276-988a-9ae53c450bd8", + "key": "event.action", + "negate": false, + "params": [ + "logged-in", + "logged-in-special" + ], + "type": "phrases", + "value": [ + "logged-in", + "logged-in-special" + ] }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.action": "logged-in" + } + }, + { + "match_phrase": { + "event.action": "logged-in-special" + } + } + ] + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" - }, - "useNormalizedEsInterval": true + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2239b070-f41c-406a-bbe6-f0a2727f47b1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "58f7e0d4-2504-4337-98b7-ad38ea8b248f" + ], + "isHistogram": true, + "layerId": "7e40bbf6-ed02-43c4-b734-6b1861674ecb", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "0df2cbd4-5615-4d70-99b7-a60314ea8606", + "xAccessor": "befd9832-6da9-472a-a3f5-e57961446f5b", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "58f7e0d4-2504-4337-98b7-ad38ea8b248f" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -255,199 +446,317 @@ "y": 0 }, "panelIndex": "7d27410b-537a-4c95-a1d8-8a64f363b90c", - "version": "8.0.0", - "type": "visualization" + "title": "Login Attempts", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Login Activity", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d8ac7a72-2c00-4417-8b7a-f72f0895f153", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "066a0ad9-2d7e-4453-93b9-02d6bf0a0d86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0765a48f-c3ba-4064-b01e-e5c390538037", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d8ac7a72-2c00-4417-8b7a-f72f0895f153": { + "columnOrder": [ + "a476a41b-66ca-424b-b381-1e66b89b5c0b", + "eda7dc5f-60de-4eaa-be30-5da382315ec4", + "7883d2ed-a891-47f4-a793-787dc2cb035f", + "5b58fb3a-b3d6-4621-a8bc-8409a37f8d05", + "b765b757-9e68-4588-85e4-0d7185ca5f33" + ], + "columns": { + "5b58fb3a-b3d6-4621-a8bc-8409a37f8d05": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Outcome", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "b765b757-9e68-4588-85e4-0d7185ca5f33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "7883d2ed-a891-47f4-a793-787dc2cb035f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b765b757-9e68-4588-85e4-0d7185ca5f33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "a476a41b-66ca-424b-b381-1e66b89b5c0b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b765b757-9e68-4588-85e4-0d7185ca5f33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "winlog.event_id" + }, + "b765b757-9e68-4588-85e4-0d7185ca5f33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "eda7dc5f-60de-4eaa-be30-5da382315ec4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "b765b757-9e68-4588-85e4-0d7185ca5f33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.category" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Event ID", - "field": "winlog.event_id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Event Category", - "field": "event.category", - "missingBucket": true, - "missingBucketLabel": "N/A", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "index": "066a0ad9-2d7e-4453-93b9-02d6bf0a0d86", + "key": "winlog.event_id", + "negate": false, + "params": [ + "4740", + "4728", + "4732", + "4756", + "4735", + "4624", + "4625", + "4648" + ], + "type": "phrases", + "value": [ + "4740", + "4728", + "4732", + "4756", + "4735", + "4624", + "4625", + "4648" + ] }, - "schema": "bucket", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "winlog.event_id": "4740" + } + }, + { + "match_phrase": { + "winlog.event_id": "4728" + } + }, + { + "match_phrase": { + "winlog.event_id": "4732" + } + }, + { + "match_phrase": { + "winlog.event_id": "4756" + } + }, + { + "match_phrase": { + "winlog.event_id": "4735" + } + }, + { + "match_phrase": { + "winlog.event_id": "4624" + } + }, + { + "match_phrase": { + "winlog.event_id": "4625" + } + }, + { + "match_phrase": { + "winlog.event_id": "4648" + } + } + ] + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event Action", - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Event Outcome", - "field": "event.outcome", - "missingBucket": true, - "missingBucketLabel": "N/A", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0765a48f-c3ba-4064-b01e-e5c390538037", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "winlog.event_id", - "negate": false, - "params": [ - "4740", - "4728", - "4732", - "4756", - "4735", - "4624", - "4625", - "4648" - ], - "type": "phrases", - "value": "4740, 4728, 4732, 4756, 4735, 4624, 4625, 4648" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "winlog.event_id": "4740" - } - }, - { - "match_phrase": { - "winlog.event_id": "4728" - } - }, - { - "match_phrase": { - "winlog.event_id": "4732" - } - }, - { - "match_phrase": { - "winlog.event_id": "4756" - } - }, - { - "match_phrase": { - "winlog.event_id": "4735" - } - }, - { - "match_phrase": { - "winlog.event_id": "4624" - } - }, - { - "match_phrase": { - "winlog.event_id": "4625" - } - }, - { - "match_phrase": { - "winlog.event_id": "4648" - } - } - ] - } - } + "alignment": "left", + "columnId": "b765b757-9e68-4588-85e4-0d7185ca5f33" + }, + { + "alignment": "left", + "columnId": "a476a41b-66ca-424b-b381-1e66b89b5c0b" + }, + { + "alignment": "left", + "columnId": "eda7dc5f-60de-4eaa-be30-5da382315ec4" + }, + { + "alignment": "left", + "columnId": "7883d2ed-a891-47f4-a793-787dc2cb035f" + }, + { + "alignment": "left", + "columnId": "5b58fb3a-b3d6-4621-a8bc-8409a37f8d05" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "d8ac7a72-2c00-4417-8b7a-f72f0895f153", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -457,95 +766,191 @@ "y": 18 }, "panelIndex": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b", - "version": "8.0.0", - "type": "visualization" + "title": "Login Activity", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Provider Login Distribution", - "description": "", - "uiState": { - "vis": { - "colors": { - "failure": "#BF1B00", - "success": "#629E51" - } - } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-94b3fe21-2148-45ce-a3c4-8f44d72dad2d", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "8615e144-2bbd-4f2c-9215-d4c2651857de", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "94b3fe21-2148-45ce-a3c4-8f44d72dad2d": { + "columnOrder": [ + "cc44db0c-107c-4322-916e-326cf286305b", + "dfe7ecb4-4f5a-4164-817d-b01f8aba5c64", + "a7f32b39-47a3-4271-8cba-7e44d0aab239" + ], + "columns": { + "a7f32b39-47a3-4271-8cba-7e44d0aab239": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cc44db0c-107c-4322-916e-326cf286305b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Provider", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a7f32b39-47a3-4271-8cba-7e44d0aab239", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "winlog.provider_name" + }, + "dfe7ecb4-4f5a-4164-817d-b01f8aba5c64": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Outcome", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a7f32b39-47a3-4271-8cba-7e44d0aab239", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Provider", - "field": "winlog.provider_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Outcome", - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "index": "8615e144-2bbd-4f2c-9215-d4c2651857de", + "key": "event.action", + "negate": false, + "params": [ + "logged-in", + "logged-in-special" + ], + "type": "phrases", + "value": "logged-in, logged-in-special" }, - "schema": "segment", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.action": "logged-in" + } + }, + { + "match_phrase": { + "event.action": "logged-in-special" + } + } + ] + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "94b3fe21-2148-45ce-a3c4-8f44d72dad2d", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "a7f32b39-47a3-4271-8cba-7e44d0aab239" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "cc44db0c-107c-4322-916e-326cf286305b", + "dfe7ecb4-4f5a-4164-817d-b01f8aba5c64" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" } - } - } + }, + "title": "Provider Login Distribution (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -555,43 +960,77 @@ "y": 18 }, "panelIndex": "4c4f5228-f158-4ccc-afa5-e90d73bca46d", - "version": "8.0.0", - "type": "visualization" + "title": "Provider Login Distribution", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Windows Event Analysis - Logins", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:47:21.382Z", + "id": "hid_bravura_monitor-cc6c9cf0-fa06-11eb-96cd-db0fb11a40f3", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "search", - "name": "5d934c5f-f909-4f75-a036-ac6253f5f974:search_0", - "id": "hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "5d934c5f-f909-4f75-a036-ac6253f5f974:indexpattern-datasource-layer-28beeee9-52bc-4d20-8308-c0781c53879a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5d934c5f-f909-4f75-a036-ac6253f5f974:424bba35-5ce1-42b3-834d-db7d0f582486", + "type": "index-pattern" }, { - "type": "search", - "name": "7d27410b-537a-4c95-a1d8-8a64f363b90c:search_0", - "id": "hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "5d934c5f-f909-4f75-a036-ac6253f5f974:470f3e41-200a-4f74-a94e-e644b3ba1cab", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "7d27410b-537a-4c95-a1d8-8a64f363b90c:indexpattern-datasource-layer-7e40bbf6-ed02-43c4-b734-6b1861674ecb", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "7d27410b-537a-4c95-a1d8-8a64f363b90c:87b4e61c-d4e3-4276-988a-9ae53c450bd8", + "type": "index-pattern" }, { - "type": "search", - "name": "4c4f5228-f158-4ccc-afa5-e90d73bca46d:search_0", - "id": "hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa" + "id": "logs-*", + "name": "7d27410b-537a-4c95-a1d8-8a64f363b90c:2239b070-f41c-406a-bbe6-f0a2727f47b1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b:indexpattern-datasource-layer-d8ac7a72-2c00-4417-8b7a-f72f0895f153", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b:066a0ad9-2d7e-4453-93b9-02d6bf0a0d86", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27bdc4ea-7adc-4dee-9526-402fb6ec6d8b:0765a48f-c3ba-4064-b01e-e5c390538037", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4c4f5228-f158-4ccc-afa5-e90d73bca46d:indexpattern-datasource-layer-94b3fe21-2148-45ce-a3c4-8f44d72dad2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4c4f5228-f158-4ccc-afa5-e90d73bca46d:8615e144-2bbd-4f2c-9215-d4c2651857de", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499.json index 2c51728929d..f8986e49681 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5MCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,140 +12,219 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Summary: User Logins", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-14c167b5-d18d-4029-a5c7-39428cb3c3e5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "383e0c22-84b6-42cc-a399-3b87d163e700", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c96b7347-f46a-456f-a27a-c5e93608c689", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a68e28ca-5454-4302-be15-5c1f6a2f98f4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6bd3da9-0b12-4e86-8959-6368e920be4e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "14c167b5-d18d-4029-a5c7-39428cb3c3e5": { + "columnOrder": [ + "d43f07b6-b50d-4e73-b5c9-a33ac79de6fe", + "66eed3c7-5326-4fa1-80f6-abfb21992c88" + ], + "columns": { + "66eed3c7-5326-4fa1-80f6-abfb21992c88": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d43f07b6-b50d-4e73-b5c9-a33ac79de6fe": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66eed3c7-5326-4fa1-80f6-abfb21992c88", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "user.id" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "383e0c22-84b6-42cc-a399-3b87d163e700", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfExe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfExe" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "User Name", - "field": "user.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "c96b7347-f46a-456f-a27a-c5e93608c689", + "key": "log.logger", + "negate": false, + "params": { + "query": "psf.exe" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.logger": "psf.exe" } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "index": "a68e28ca-5454-4302-be15-5c1f6a2f98f4", + "key": "hid_bravura_monitor.perf.transid", + "negate": false, + "params": { + "query": "C_AUTHCHAIN_LOGIN" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "psf.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "psf.exe" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.transid": "C_AUTHCHAIN_LOGIN" } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "key": "hid_bravura_monitor.perf.transid", - "negate": false, - "params": { - "query": "C_AUTHCHAIN_LOGIN" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a6bd3da9-0b12-4e86-8959-6368e920be4e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.transid": "C_AUTHCHAIN_LOGIN" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "66eed3c7-5326-4fa1-80f6-abfb21992c88" + }, + { + "alignment": "left", + "columnId": "d43f07b6-b50d-4e73-b5c9-a33ac79de6fe" + } + ], + "headerRowHeight": "single", + "layerId": "14c167b5-d18d-4029-a5c7-39428cb3c3e5", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Users: Summary: User Logins (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -163,183 +234,200 @@ "y": 0 }, "panelIndex": "b8ac330d-572e-459e-9266-bd44fc9ac283", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Summary: User Logins", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Users: Summary: Node Usage", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0130c3c6-a5d5-48fb-aefb-99cd8a1499a5", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "row": true, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count of unique User ID" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "5c7bd1a4-4424-4e75-9757-fbe41c7cf32e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0130c3c6-a5d5-48fb-aefb-99cd8a1499a5": { + "columnOrder": [ + "595b1137-d12c-490b-9fef-d70585a68f75", + "adeb3820-a13b-4bb8-b007-e693c8feb39d", + "605312f0-cfbd-45e9-a184-3587e83f132a" + ], + "columns": { + "595b1137-d12c-490b-9fef-d70585a68f75": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "605312f0-cfbd-45e9-a184-3587e83f132a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of unique User ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "user.id" + }, + "adeb3820-a13b-4bb8-b007-e693c8feb39d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "605312f0-cfbd-45e9-a184-3587e83f132a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count of unique User ID" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count of unique User ID", - "field": "user.id" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "5c7bd1a4-4424-4e75-9757-fbe41c7cf32e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "hid_bravura_monitor.log" - }, - "type": "phrase" + "accessors": [ + "605312f0-cfbd-45e9-a184-3587e83f132a" + ], + "isHistogram": true, + "layerId": "0130c3c6-a5d5-48fb-aefb-99cd8a1499a5", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "data_stream.dataset": "hid_bravura_monitor.log" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "adeb3820-a13b-4bb8-b007-e693c8feb39d", + "xAccessor": "595b1137-d12c-490b-9fef-d70585a68f75", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "605312f0-cfbd-45e9-a184-3587e83f132a" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count of unique User ID" } - } - } + }, + "title": "Users: Summary: Node Usage (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 26, @@ -349,43 +437,57 @@ "y": 0 }, "panelIndex": "3316ec90-b61b-4f5a-9c43-02e7bda7604f", - "version": "8.0.0", - "type": "visualization" + "title": "Users: Summary: Node Usage", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Users - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:48:21.250Z", + "id": "hid_bravura_monitor-d17be4f0-f9fa-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:indexpattern-datasource-layer-14c167b5-d18d-4029-a5c7-39428cb3c3e5", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:383e0c22-84b6-42cc-a399-3b87d163e700", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:c96b7347-f46a-456f-a27a-c5e93608c689", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:a68e28ca-5454-4302-be15-5c1f6a2f98f4", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "3316ec90-b61b-4f5a-9c43-02e7bda7604f:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "b8ac330d-572e-459e-9266-bd44fc9ac283:a6bd3da9-0b12-4e86-8959-6368e920be4e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3316ec90-b61b-4f5a-9c43-02e7bda7604f:indexpattern-datasource-layer-0130c3c6-a5d5-48fb-aefb-99cd8a1499a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3316ec90-b61b-4f5a-9c43-02e7bda7604f:5c7bd1a4-4424-4e75-9757-fbe41c7cf32e", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499.json index e28638f09b4..f3eb4b511cd 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5MSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,177 +12,229 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Operation Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6eb2af65-f23b-4f43-9c0e-312331f09569", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "b21b7e20-a1e6-4cec-846b-0f83cc7fccde", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "1d2a89cb-4433-4558-aa3f-629d12febd7c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6eb2af65-f23b-4f43-9c0e-312331f09569": { + "columnOrder": [ + "542e6a30-7364-4233-bfb4-445820fd064b", + "971109b8-cfd6-4e88-bad6-43213c6ebe1a", + "4746d230-d737-45f7-966b-bcf6d9dc9987" + ], + "columns": { + "4746d230-d737-45f7-966b-bcf6d9dc9987": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "542e6a30-7364-4233-bfb4-445820fd064b": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "971109b8-cfd6-4e88-bad6-43213c6ebe1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "hid_bravura_monitor.perf.operation: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4746d230-d737-45f7-966b-bcf6d9dc9987", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.operation" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b21b7e20-a1e6-4cec-846b-0f83cc7fccde", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "hid_bravura_monitor.perf.operation", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "group", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1d2a89cb-4433-4558-aa3f-629d12febd7c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" + "accessors": [ + "4746d230-d737-45f7-966b-bcf6d9dc9987" + ], + "isHistogram": true, + "layerId": "6eb2af65-f23b-4f43-9c0e-312331f09569", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "971109b8-cfd6-4e88-bad6-43213c6ebe1a", + "xAccessor": "542e6a30-7364-4233-bfb4-445820fd064b", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "4746d230-d737-45f7-966b-bcf6d9dc9987" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Connector: Operation Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 13, @@ -200,101 +244,165 @@ "y": 0 }, "panelIndex": "a8b8efc3-5a4e-470b-9229-7ad661fb5012", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Operation Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Targets", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7183a4b4-ce8b-4eb0-8f68-96725057f0ab", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e1bdc00a-592a-41f5-ab9d-608c238b700b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f00e711d-c4eb-430f-b8cc-3dbda4e403f3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7183a4b4-ce8b-4eb0-8f68-96725057f0ab": { + "columnOrder": [ + "f490d9d3-663c-4074-8cf5-620629ed545f", + "fa6776cd-1da4-4541-8fda-de581a32b698" + ], + "columns": { + "f490d9d3-663c-4074-8cf5-620629ed545f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Connector", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fa6776cd-1da4-4541-8fda-de581a32b698", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "fa6776cd-1da4-4541-8fda-de581a32b698": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Targets", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.targetid" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Targets", - "field": "hid_bravura_monitor.perf.targetid" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e1bdc00a-592a-41f5-ab9d-608c238b700b", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" }, - "schema": "metric", - "type": "cardinality" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Connector", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f00e711d-c4eb-430f-b8cc-3dbda4e403f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "fa6776cd-1da4-4541-8fda-de581a32b698" + }, + { + "alignment": "left", + "columnId": "f490d9d3-663c-4074-8cf5-620629ed545f" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "7183a4b4-ce8b-4eb0-8f68-96725057f0ab", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector: Targets (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -304,98 +412,165 @@ "y": 13 }, "panelIndex": "aea7ed7d-82b6-4939-975e-fd4deb845e39", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Targets", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Operations Per Node", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8717d771-9487-4f9a-9b8f-648842bdcafd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2177b8fd-4535-47df-8b7a-4151c4d0f733", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ddd12a8b-b2ee-422a-8982-81a2dc3f79a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8717d771-9487-4f9a-9b8f-648842bdcafd": { + "columnOrder": [ + "fa536144-03b4-49ec-8324-eef17ab187a2", + "875f9597-aa5a-4d40-996f-57715196b92d" + ], + "columns": { + "875f9597-aa5a-4d40-996f-57715196b92d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fa536144-03b4-49ec-8324-eef17ab187a2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "875f9597-aa5a-4d40-996f-57715196b92d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "2177b8fd-4535-47df-8b7a-4151c4d0f733", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ddd12a8b-b2ee-422a-8982-81a2dc3f79a6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "875f9597-aa5a-4d40-996f-57715196b92d" + }, + { + "alignment": "left", + "columnId": "fa536144-03b4-49ec-8324-eef17ab187a2" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "8717d771-9487-4f9a-9b8f-648842bdcafd", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector: Operations Per Node (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -405,98 +580,165 @@ "y": 13 }, "panelIndex": "def5b420-7c49-4363-a30f-7c0c6c13929d", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Operations Per Node", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Operation List", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-66c1017c-046b-43dc-95aa-29c423c37036", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8513d7dc-505e-4a4a-a0de-65637019dda6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c06563ad-9185-47dd-a983-f877eb1f47ac", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "66c1017c-046b-43dc-95aa-29c423c37036": { + "columnOrder": [ + "27fd6ed7-c8b1-43ed-8c65-ec675003e15e", + "62639064-c110-4b81-925b-5d68bb53a0ee" + ], + "columns": { + "27fd6ed7-c8b1-43ed-8c65-ec675003e15e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Operation", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "62639064-c110-4b81-925b-5d68bb53a0ee", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.operation" + }, + "62639064-c110-4b81-925b-5d68bb53a0ee": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8513d7dc-505e-4a4a-a0de-65637019dda6", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Operation", - "field": "hid_bravura_monitor.perf.operation", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c06563ad-9185-47dd-a983-f877eb1f47ac", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "62639064-c110-4b81-925b-5d68bb53a0ee" + }, + { + "alignment": "left", + "columnId": "27fd6ed7-c8b1-43ed-8c65-ec675003e15e" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "66c1017c-046b-43dc-95aa-29c423c37036", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector: Operation List (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -506,98 +748,165 @@ "y": 13 }, "panelIndex": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Operation List", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Return Code", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4ac005d8-f865-40f0-9d93-34429f96177f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a69d3196-aef9-46c6-aa12-cb93be0f10d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "98c241ec-a7e9-4da0-ab2e-ce741f6e44ab", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4ac005d8-f865-40f0-9d93-34429f96177f": { + "columnOrder": [ + "e1a282ae-e868-4098-a698-a592c82a2477", + "fbf418cf-f272-466b-b0a4-370db89f70eb" + ], + "columns": { + "e1a282ae-e868-4098-a698-a592c82a2477": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Result", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "fbf418cf-f272-466b-b0a4-370db89f70eb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.result" + }, + "fbf418cf-f272-466b-b0a4-370db89f70eb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a69d3196-aef9-46c6-aa12-cb93be0f10d2", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Result", - "field": "hid_bravura_monitor.perf.result", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "98c241ec-a7e9-4da0-ab2e-ce741f6e44ab", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "fbf418cf-f272-466b-b0a4-370db89f70eb" + }, + { + "alignment": "left", + "columnId": "e1a282ae-e868-4098-a698-a592c82a2477" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "4ac005d8-f865-40f0-9d93-34429f96177f", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -607,98 +916,165 @@ "y": 13 }, "panelIndex": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Return Code", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector: Error Messages", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d20e3c18-f705-43dd-931f-a9f284f67063", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a0054c8-f97a-42ce-a9cd-74e2419e7aca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a5eceb6-0da8-486f-b27f-3464a6ef9c3c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d20e3c18-f705-43dd-931f-a9f284f67063": { + "columnOrder": [ + "8c0b4c45-8572-4c0d-ae3a-84548622ffed", + "88bfed9f-a95f-4442-8b8b-09ea3407134c" + ], + "columns": { + "88bfed9f-a95f-4442-8b8b-09ea3407134c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8c0b4c45-8572-4c0d-ae3a-84548622ffed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Message", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "88bfed9f-a95f-4442-8b8b-09ea3407134c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.message" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8a0054c8-f97a-42ce-a9cd-74e2419e7aca", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Message", - "field": "hid_bravura_monitor.perf.message", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "6a5eceb6-0da8-486f-b27f-3464a6ef9c3c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "88bfed9f-a95f-4442-8b8b-09ea3407134c" + }, + { + "alignment": "left", + "columnId": "8c0b4c45-8572-4c0d-ae3a-84548622ffed" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "d20e3c18-f705-43dd-931f-a9f284f67063", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector: Error Messages (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -708,132 +1084,200 @@ "y": 13 }, "panelIndex": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a", - "version": "8.0.0", - "type": "visualization" + "title": "Connector: Error Messages", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connector List", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ffcdf31e-12f5-4101-9911-0d36d3139206", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "94c46b2d-9a01-42c6-86a6-b639ce204d59", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ffcdf31e-12f5-4101-9911-0d36d3139206": { + "columnOrder": [ + "793dccab-3900-45c8-8fdb-dc580d5772ae", + "00877092-3d21-4a0f-a869-c793246ec298", + "450aa203-9921-483f-b0ed-3e04f16863fa", + "cf35a5ea-970a-4bc1-9888-d58545acc946" + ], + "columns": { + "00877092-3d21-4a0f-a869-c793246ec298": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cf35a5ea-970a-4bc1-9888-d58545acc946", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.address" + }, + "450aa203-9921-483f-b0ed-3e04f16863fa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cf35a5ea-970a-4bc1-9888-d58545acc946", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "log.logger" + }, + "793dccab-3900-45c8-8fdb-dc580d5772ae": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Target ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cf35a5ea-970a-4bc1-9888-d58545acc946", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.targetid" + }, + "cf35a5ea-970a-4bc1-9888-d58545acc946": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Target ID", - "field": "hid_bravura_monitor.perf.targetid", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Address", - "field": "hid_bravura_monitor.perf.address", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Process", - "field": "log.logger", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 - }, - "schema": "bucket", - "type": "terms" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "94c46b2d-9a01-42c6-86a6-b639ce204d59", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfConnector" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfConnector" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfConnector" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfConnector" - } - } + "alignment": "left", + "columnId": "cf35a5ea-970a-4bc1-9888-d58545acc946" + }, + { + "alignment": "left", + "columnId": "793dccab-3900-45c8-8fdb-dc580d5772ae" + }, + { + "alignment": "left", + "columnId": "00877092-3d21-4a0f-a869-c793246ec298" + }, + { + "alignment": "left", + "columnId": "450aa203-9921-483f-b0ed-3e04f16863fa" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "ffcdf31e-12f5-4101-9911-0d36d3139206", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Connector List (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -843,8 +1287,9 @@ "y": 29 }, "panelIndex": "1efe3f34-de43-4ffb-992d-8b21cbb771a0", - "version": "8.0.0", - "type": "visualization" + "title": "Connector List", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -858,93 +1303,127 @@ "y": 45 }, "panelIndex": "81a7ce31-d928-48c7-9b8d-acd00a43d08e", - "panelRefName": "panel_7", - "version": "8.0.0" + "panelRefName": "panel_81a7ce31-d928-48c7-9b8d-acd00a43d08e", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Integrations - Connectors", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T18:18:32.649Z", + "id": "hid_bravura_monitor-d3a33820-fa02-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289", - "name": "panel_7", - "type": "search" + "id": "logs-*", + "name": "a8b8efc3-5a4e-470b-9229-7ad661fb5012:indexpattern-datasource-layer-6eb2af65-f23b-4f43-9c0e-312331f09569", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8b8efc3-5a4e-470b-9229-7ad661fb5012:b21b7e20-a1e6-4cec-846b-0f83cc7fccde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8b8efc3-5a4e-470b-9229-7ad661fb5012:1d2a89cb-4433-4558-aa3f-629d12febd7c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aea7ed7d-82b6-4939-975e-fd4deb845e39:indexpattern-datasource-layer-7183a4b4-ce8b-4eb0-8f68-96725057f0ab", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aea7ed7d-82b6-4939-975e-fd4deb845e39:e1bdc00a-592a-41f5-ab9d-608c238b700b", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "a8b8efc3-5a4e-470b-9229-7ad661fb5012:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "aea7ed7d-82b6-4939-975e-fd4deb845e39:f00e711d-c4eb-430f-b8cc-3dbda4e403f3", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "a8b8efc3-5a4e-470b-9229-7ad661fb5012:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "def5b420-7c49-4363-a30f-7c0c6c13929d:indexpattern-datasource-layer-8717d771-9487-4f9a-9b8f-648842bdcafd", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "aea7ed7d-82b6-4939-975e-fd4deb845e39:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "def5b420-7c49-4363-a30f-7c0c6c13929d:2177b8fd-4535-47df-8b7a-4151c4d0f733", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "aea7ed7d-82b6-4939-975e-fd4deb845e39:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "def5b420-7c49-4363-a30f-7c0c6c13929d:ddd12a8b-b2ee-422a-8982-81a2dc3f79a6", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "def5b420-7c49-4363-a30f-7c0c6c13929d:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d:indexpattern-datasource-layer-66c1017c-046b-43dc-95aa-29c423c37036", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "def5b420-7c49-4363-a30f-7c0c6c13929d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d:8513d7dc-505e-4a4a-a0de-65637019dda6", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d:c06563ad-9185-47dd-a983-f877eb1f47ac", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f3e25e5c-0f66-4eb3-916e-8243184f2b0d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d:indexpattern-datasource-layer-4ac005d8-f865-40f0-9d93-34429f96177f", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d:a69d3196-aef9-46c6-aa12-cb93be0f10d2", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "c04915c9-e5d6-4c1f-815a-efc1c0b35c7d:98c241ec-a7e9-4da0-ab2e-ce741f6e44ab", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a:indexpattern-datasource-layer-d20e3c18-f705-43dd-931f-a9f284f67063", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a:8a0054c8-f97a-42ce-a9cd-74e2419e7aca", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "1efe3f34-de43-4ffb-992d-8b21cbb771a0:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "b7966004-1c02-4fa5-a8ce-5a3362adfb5a:6a5eceb6-0da8-486f-b27f-3464a6ef9c3c", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "1efe3f34-de43-4ffb-992d-8b21cbb771a0:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "1efe3f34-de43-4ffb-992d-8b21cbb771a0:indexpattern-datasource-layer-ffcdf31e-12f5-4101-9911-0d36d3139206", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1efe3f34-de43-4ffb-992d-8b21cbb771a0:94c46b2d-9a01-42c6-86a6-b639ce204d59", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289", + "name": "81a7ce31-d928-48c7-9b8d-acd00a43d08e:panel_81a7ce31-d928-48c7-9b8d-acd00a43d08e", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499.json index bb3d2b7337e..9472a2ea743 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5MiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,160 +12,201 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Login Success", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cfa1a191-90e9-4d5c-82b8-7ad78364690a", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "addc0be9-24fa-4b6a-980e-51ad3d5c44e6", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "2a343733-12ae-4a56-98d5-fdc2304eb131", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cfa1a191-90e9-4d5c-82b8-7ad78364690a": { + "columnOrder": [ + "d731c752-dd5c-42b2-adbe-e43c2f0120ab", + "2bfe5fbe-1986-494d-a9c8-f799e267e7ff" + ], + "columns": { + "2bfe5fbe-1986-494d-a9c8-f799e267e7ff": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d731c752-dd5c-42b2-adbe-e43c2f0120ab": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "addc0be9-24fa-4b6a-980e-51ad3d5c44e6", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "2a343733-12ae-4a56-98d5-fdc2304eb131", + "key": "event.code", + "negate": false, + "params": { + "query": "2" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "event.code": "2" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "2bfe5fbe-1986-494d-a9c8-f799e267e7ff" + ], + "isHistogram": true, + "layerId": "cfa1a191-90e9-4d5c-82b8-7ad78364690a", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "2" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "2" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "d731c752-dd5c-42b2-adbe-e43c2f0120ab", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "2bfe5fbe-1986-494d-a9c8-f799e267e7ff" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "User Login Success (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -183,160 +216,198 @@ "y": 0 }, "panelIndex": "5d1eb62a-f7dd-4f14-8961-96a768f70c07", - "version": "8.0.0", - "type": "visualization" + "title": "User Login Success", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Login Failures", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0fad87e2-7508-4f78-bf88-3c47a8eda6b0", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "bfbbb80f-2e8c-45b5-b795-3673caca063c", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "0a699586-cbd5-4347-837d-a54c6504521c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0fad87e2-7508-4f78-bf88-3c47a8eda6b0": { + "columnOrder": [ + "7c52d345-b1e1-4756-af30-1ffc03b2f94a", + "89032cdb-8bc2-4d9b-88bf-d7d0cc2a55d5" + ], + "columns": { + "7c52d345-b1e1-4756-af30-1ffc03b2f94a": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "89032cdb-8bc2-4d9b-88bf-d7d0cc2a55d5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "bfbbb80f-2e8c-45b5-b795-3673caca063c", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "0a699586-cbd5-4347-837d-a54c6504521c", + "key": "event.code", + "negate": false, + "params": { + "query": "1" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "event.code": "1" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "89032cdb-8bc2-4d9b-88bf-d7d0cc2a55d5" + ], + "isHistogram": true, + "layerId": "0fad87e2-7508-4f78-bf88-3c47a8eda6b0", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "1" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "1" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "7c52d345-b1e1-4756-af30-1ffc03b2f94a", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "89032cdb-8bc2-4d9b-88bf-d7d0cc2a55d5" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "User Login Failures (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} }, "gridData": { "h": 16, @@ -346,160 +417,198 @@ "y": 0 }, "panelIndex": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "User Login Lockout", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3dd17323-0a95-45bb-9407-2b6d9088ea8d", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "33b24f61-7c82-47be-8eed-a3929b2f4c1f", + "type": "index-pattern" }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "5cd92881-7fa5-419f-9935-fd2658abe5ef", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3dd17323-0a95-45bb-9407-2b6d9088ea8d": { + "columnOrder": [ + "a072d4b2-ac4a-4d4f-be84-8611b1f4b823", + "08a20a7d-5385-404f-bc27-2ba7b466f279" + ], + "columns": { + "08a20a7d-5385-404f-bc27-2ba7b466f279": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "a072d4b2-ac4a-4d4f-be84-8611b1f4b823": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "index": "33b24f61-7c82-47be-8eed-a3929b2f4c1f", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + }, + "type": "phrase" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.code", + "index": "5cd92881-7fa5-419f-9935-fd2658abe5ef", + "key": "event.code", + "negate": false, + "params": { + "query": "3" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "event.code": "3" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "08a20a7d-5385-404f-bc27-2ba7b466f279" + ], + "isHistogram": true, + "layerId": "3dd17323-0a95-45bb-9407-2b6d9088ea8d", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": { - "query": "3" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.code": "3" + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "a072d4b2-ac4a-4d4f-be84-8611b1f4b823", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "08a20a7d-5385-404f-bc27-2ba7b466f279" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "User Login Lockout (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -509,191 +618,243 @@ "y": 16 }, "panelIndex": "d68fe28e-8def-4ea8-b848-ef2b97430924", - "version": "8.0.0", - "type": "visualization" + "title": "User Login Lockout", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "IDAPI Login Attempts", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-56a867ef-137e-4c52-84a8-f1676368f6d2", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "2e81b90b-afaf-487b-a034-72f296021b95", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "7d9fa7d6-8411-471b-aa72-ea744d0e79a8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "56a867ef-137e-4c52-84a8-f1676368f6d2": { + "columnOrder": [ + "9975d8e8-983b-4158-af48-8d615700c999", + "8d82328e-9987-433a-bc27-6138d36a2c9a", + "5a9b6d12-6cff-425f-861a-ae8745062c19" + ], + "columns": { + "5a9b6d12-6cff-425f-861a-ae8745062c19": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8d82328e-9987-433a-bc27-6138d36a2c9a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5a9b6d12-6cff-425f-861a-ae8745062c19", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.code" + }, + "9975d8e8-983b-4158-af48-8d615700c999": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "2e81b90b-afaf-487b-a034-72f296021b95", + "key": "winlog.provider_name", + "negate": false, + "params": { + "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Event", + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "index": "7d9fa7d6-8411-471b-aa72-ea744d0e79a8", + "key": "event.code", + "negate": false, + "params": [ + "39", + "40" + ], + "type": "phrases", + "value": [ + "39", + "40" + ] }, - "schema": "group", - "type": "terms" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "39" + } + }, + { + "match_phrase": { + "event.code": "40" + } + } + ] + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "5a9b6d12-6cff-425f-861a-ae8745062c19" + ], + "isHistogram": true, + "layerId": "56a867ef-137e-4c52-84a8-f1676368f6d2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.code", - "negate": false, - "params": [ - "39", - "40" - ], - "type": "phrases", - "value": "39, 40" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.code": "39" - } - }, - { - "match_phrase": { - "event.code": "40" - } - } - ] + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "8d82328e-9987-433a-bc27-6138d36a2c9a", + "xAccessor": "9975d8e8-983b-4158-af48-8d615700c999", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "5a9b6d12-6cff-425f-861a-ae8745062c19" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "IDAPI Login Attempts (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} }, "gridData": { "h": 16, @@ -703,58 +864,81 @@ "y": 16 }, "panelIndex": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Users - Authentication", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:53:45.180Z", + "id": "hid_bravura_monitor-d59177c0-f9fb-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "5d1eb62a-f7dd-4f14-8961-96a768f70c07:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "5d1eb62a-f7dd-4f14-8961-96a768f70c07:indexpattern-datasource-layer-cfa1a191-90e9-4d5c-82b8-7ad78364690a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5d1eb62a-f7dd-4f14-8961-96a768f70c07:addc0be9-24fa-4b6a-980e-51ad3d5c44e6", + "type": "index-pattern" }, { - "type": "search", - "name": "5d1eb62a-f7dd-4f14-8961-96a768f70c07:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "5d1eb62a-f7dd-4f14-8961-96a768f70c07:2a343733-12ae-4a56-98d5-fdc2304eb131", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8:indexpattern-datasource-layer-0fad87e2-7508-4f78-bf88-3c47a8eda6b0", + "type": "index-pattern" }, { - "type": "search", - "name": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8:bfbbb80f-2e8c-45b5-b795-3673caca063c", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "d68fe28e-8def-4ea8-b848-ef2b97430924:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "013b41ba-55b7-4ed3-9c9e-5c3984651cd8:0a699586-cbd5-4347-837d-a54c6504521c", + "type": "index-pattern" }, { - "type": "search", - "name": "d68fe28e-8def-4ea8-b848-ef2b97430924:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "d68fe28e-8def-4ea8-b848-ef2b97430924:indexpattern-datasource-layer-3dd17323-0a95-45bb-9407-2b6d9088ea8d", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "d68fe28e-8def-4ea8-b848-ef2b97430924:33b24f61-7c82-47be-8eed-a3929b2f4c1f", + "type": "index-pattern" }, { - "type": "search", - "name": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8:search_0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215" + "id": "logs-*", + "name": "d68fe28e-8def-4ea8-b848-ef2b97430924:5cd92881-7fa5-419f-9935-fd2658abe5ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8:indexpattern-datasource-layer-56a867ef-137e-4c52-84a8-f1676368f6d2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8:2e81b90b-afaf-487b-a034-72f296021b95", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63b07db7-cd19-4cb8-839d-e7801ef7c5f8:7d9fa7d6-8411-471b-aa72-ea744d0e79a8", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499.json index 0aad9022515..447c02f8fab 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5MywxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,326 +12,439 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Severity Counts", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-293b9a9d-39fd-47af-a610-3188d9797a10", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "614d63ef-8a28-41cc-8193-3b76d26d01b3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "55b4a433-bdf8-413b-904f-9c4eb88a2797", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "293b9a9d-39fd-47af-a610-3188d9797a10": { + "columnOrder": [ + "31944417-f40f-4017-9e6a-2fb2e0aee261", + "9576c426-b666-4a1c-a841-fc61147860af" + ], + "columns": { + "31944417-f40f-4017-9e6a-2fb2e0aee261": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9576c426-b666-4a1c-a841-fc61147860af", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "9576c426-b666-4a1c-a841-fc61147860af": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 40, - "labelColor": false, - "subText": "" }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "614d63ef-8a28-41cc-8193-3b76d26d01b3", + "key": "log.logger", + "negate": false, + "params": { + "query": "iddb.exe" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "log.logger": "iddb.exe" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Severity", - "field": "log.level", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "55b4a433-bdf8-413b-904f-9c4eb88a2797", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "iddb.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "iddb.exe" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "31944417-f40f-4017-9e6a-2fb2e0aee261", + "color": "#6092C0", + "layerId": "293b9a9d-39fd-47af-a610-3188d9797a10", + "layerType": "data", + "metricAccessor": "9576c426-b666-4a1c-a841-fc61147860af" } - } - } + }, + "title": "Database: Severity Counts (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 26, + "h": 8, "i": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd", - "w": 11, + "w": 48, "x": 0, "y": 0 }, "panelIndex": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Severity Counts", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Log Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-736fdb55-6bb6-4a4f-982a-27aef952c995", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "dc3762c2-5c21-4adc-9a0b-dc827ba77aad", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "9210f161-008c-4dda-8da0-30975682590c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "736fdb55-6bb6-4a4f-982a-27aef952c995": { + "columnOrder": [ + "8f098f01-d2c1-435b-8727-46e7760b3d30", + "20872a72-37e1-43c5-832f-c419cf2073ac", + "12349716-87f9-4aaf-b049-221925deb653" + ], + "columns": { + "12349716-87f9-4aaf-b049-221925deb653": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "20872a72-37e1-43c5-832f-c419cf2073ac": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "12349716-87f9-4aaf-b049-221925deb653", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "8f098f01-d2c1-435b-8727-46e7760b3d30": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "$state": { + "store": "appState" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "dc3762c2-5c21-4adc-9a0b-dc827ba77aad", + "key": "log.logger", + "negate": false, + "params": { + "query": "iddb.exe" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "log.logger": "iddb.exe" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9210f161-008c-4dda-8da0-30975682590c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "12349716-87f9-4aaf-b049-221925deb653" + ], + "isHistogram": true, + "layerId": "736fdb55-6bb6-4a4f-982a-27aef952c995", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "iddb.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "iddb.exe" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "20872a72-37e1-43c5-832f-c419cf2073ac", + "xAccessor": "8f098f01-d2c1-435b-8727-46e7760b3d30", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "12349716-87f9-4aaf-b049-221925deb653" } - } + ] } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Database: Log Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 26, + "h": 19, "i": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1", - "w": 37, - "x": 11, - "y": 0 + "w": 48, + "x": 0, + "y": 8 }, "panelIndex": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Log Histogram", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:55:50.500Z", + "id": "hid_bravura_monitor-db22d850-fa00-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd:indexpattern-datasource-layer-293b9a9d-39fd-47af-a610-3188d9797a10", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd:614d63ef-8a28-41cc-8193-3b76d26d01b3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd:55b4a433-bdf8-413b-904f-9c4eb88a2797", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "ef0f2d41-363f-4573-b92a-9ecb0af8b1fd:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1:indexpattern-datasource-layer-736fdb55-6bb6-4a4f-982a-27aef952c995", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1:dc3762c2-5c21-4adc-9a0b-dc827ba77aad", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "bb8e09a0-aadf-48a8-a5a9-af581d3b42d1:9210f161-008c-4dda-8da0-30975682590c", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499.json index b9b60a744fd..3f3163ad383 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5NCwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,75 +12,167 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Host Usage", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dd4100ce-edfd-44ec-87fb-9a1f1364ffc8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f986bd8b-1f9b-4191-9957-2fd11d3537d6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4df4e8ea-e3f1-45c1-9cfb-21180eef5988", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dd4100ce-edfd-44ec-87fb-9a1f1364ffc8": { + "columnOrder": [ + "ab507025-aea2-4c4e-84fb-ef2ce7ab4f5e", + "ff2f401c-ba33-4e40-90c6-5ef6f974fecf" + ], + "columns": { + "ab507025-aea2-4c4e-84fb-ef2ce7ab4f5e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ff2f401c-ba33-4e40-90c6-5ef6f974fecf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "ff2f401c-ba33-4e40-90c6-5ef6f974fecf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f986bd8b-1f9b-4191-9957-2fd11d3537d6", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfSproc" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfSproc" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4df4e8ea-e3f1-45c1-9cfb-21180eef5988", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ff2f401c-ba33-4e40-90c6-5ef6f974fecf" + }, + { + "alignment": "left", + "columnId": "ab507025-aea2-4c4e-84fb-ef2ce7ab4f5e" + } + ], + "headerRowHeight": "single", + "layerId": "dd4100ce-edfd-44ec-87fb-9a1f1364ffc8", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Database: Host Usage (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -98,156 +182,227 @@ "y": 0 }, "panelIndex": "7fcb881a-1fac-40f3-8344-abc9d970bea0", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Host Usage", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Stored Procedure Histogram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7d846bf4-7705-44de-a29e-35df4f260513", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "7b2da3aa-6d16-46f2-8e98-7d4f5e826d0c", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "d53e8d70-c28a-4f80-a327-5de3b120e4d7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7d846bf4-7705-44de-a29e-35df4f260513": { + "columnOrder": [ + "ec51e285-a299-4638-a79a-47ab76e1c558", + "9a9b0bcc-9507-4385-95b7-367cbc25c7e9", + "175c8e7d-7710-498d-9f7d-47ffb638eed7" + ], + "columns": { + "175c8e7d-7710-498d-9f7d-47ffb638eed7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "9a9b0bcc-9507-4385-95b7-367cbc25c7e9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "175c8e7d-7710-498d-9f7d-47ffb638eed7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "ec51e285-a299-4638-a79a-47ab76e1c558": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "7b2da3aa-6d16-46f2-8e98-7d4f5e826d0c", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfSproc" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfSproc" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Node", - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d53e8d70-c28a-4f80-a327-5de3b120e4d7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "175c8e7d-7710-498d-9f7d-47ffb638eed7" + ], + "isHistogram": true, + "layerId": "7d846bf4-7705-44de-a29e-35df4f260513", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "9a9b0bcc-9507-4385-95b7-367cbc25c7e9", + "xAccessor": "ec51e285-a299-4638-a79a-47ab76e1c558", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "175c8e7d-7710-498d-9f7d-47ffb638eed7" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "Database: Stored Procedure Histogram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -257,116 +412,233 @@ "y": 0 }, "panelIndex": "41db8b4e-a061-4e68-a8dc-4fe557771bdc", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Stored Procedure Histogram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Database: Stored Procedure Runtime Statistics", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 5, - "direction": "desc" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ab5ae146-de1e-41a9-90e9-fceb53836587", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6948cd16-5aef-4199-89cb-61715dcdf94e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49a59c32-6712-4c97-a1d8-274e62ee3d57", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ab5ae146-de1e-41a9-90e9-fceb53836587": { + "columnOrder": [ + "eca56d8f-517c-4517-92ba-f044df4f9628", + "aca86f7b-efd6-47e9-a9c1-27e827238c83", + "ea2e9938-fd78-49fd-83dd-6e33eec8da15", + "32fc620c-6ff6-41ee-955b-b2d6c6e6cd70", + "1ae4d077-dc6b-494c-96a0-f79eec3426f1", + "9fd2a0e4-45fa-4fbe-8933-f863577554cf" + ], + "columns": { + "1ae4d077-dc6b-494c-96a0-f79eec3426f1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max (ms)", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "32fc620c-6ff6-41ee-955b-b2d6c6e6cd70": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min (ms)", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "9fd2a0e4-45fa-4fbe-8933-f863577554cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total (ms)", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "aca86f7b-efd6-47e9-a9c1-27e827238c83": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ea2e9938-fd78-49fd-83dd-6e33eec8da15": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average (ms)", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "eca56d8f-517c-4517-92ba-f044df4f9628": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "aca86f7b-efd6-47e9-a9c1-27e827238c83", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "row": true, - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Function", - "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 - }, - "schema": "bucket", - "type": "terms" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Average (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Min (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "6948cd16-5aef-4199-89cb-61715dcdf94e", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfSproc" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfSproc" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Max (ms)", - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Total (ms)", - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "49a59c32-6712-4c97-a1d8-274e62ee3d57", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "aca86f7b-efd6-47e9-a9c1-27e827238c83" + }, + { + "alignment": "left", + "columnId": "ea2e9938-fd78-49fd-83dd-6e33eec8da15" + }, + { + "alignment": "left", + "columnId": "32fc620c-6ff6-41ee-955b-b2d6c6e6cd70" + }, + { + "alignment": "left", + "columnId": "1ae4d077-dc6b-494c-96a0-f79eec3426f1" + }, + { + "alignment": "left", + "columnId": "9fd2a0e4-45fa-4fbe-8933-f863577554cf" + }, + { + "alignment": "left", + "columnId": "eca56d8f-517c-4517-92ba-f044df4f9628" + } + ], + "headerRowHeight": "single", + "layerId": "ab5ae146-de1e-41a9-90e9-fceb53836587", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Database: Stored Procedure Runtime Statistics (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -376,8 +648,9 @@ "y": 18 }, "panelIndex": "67513776-5611-456a-bafd-42938542c90a", - "version": "8.0.0", - "type": "visualization" + "title": "Database: Stored Procedure Runtime Statistics", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -391,38 +664,72 @@ "y": 35 }, "panelIndex": "25a4e2bd-b92e-445c-bec4-15ca828c88a8", - "panelRefName": "panel_3", - "version": "8.0.0" + "panelRefName": "panel_25a4e2bd-b92e-445c-bec4-15ca828c88a8", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] Database - Stored Procedure Performance", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:57:37.271Z", + "id": "hid_bravura_monitor-e9fa5320-fa01-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289", - "name": "panel_3", - "type": "search" + "id": "logs-*", + "name": "7fcb881a-1fac-40f3-8344-abc9d970bea0:indexpattern-datasource-layer-dd4100ce-edfd-44ec-87fb-9a1f1364ffc8", + "type": "index-pattern" }, { - "type": "search", - "name": "7fcb881a-1fac-40f3-8344-abc9d970bea0:search_0", - "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "7fcb881a-1fac-40f3-8344-abc9d970bea0:f986bd8b-1f9b-4191-9957-2fd11d3537d6", + "type": "index-pattern" }, { - "type": "search", - "name": "41db8b4e-a061-4e68-a8dc-4fe557771bdc:search_0", - "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "7fcb881a-1fac-40f3-8344-abc9d970bea0:4df4e8ea-e3f1-45c1-9cfb-21180eef5988", + "type": "index-pattern" }, { - "type": "search", - "name": "67513776-5611-456a-bafd-42938542c90a:search_0", - "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "41db8b4e-a061-4e68-a8dc-4fe557771bdc:indexpattern-datasource-layer-7d846bf4-7705-44de-a29e-35df4f260513", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "41db8b4e-a061-4e68-a8dc-4fe557771bdc:7b2da3aa-6d16-46f2-8e98-7d4f5e826d0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "41db8b4e-a061-4e68-a8dc-4fe557771bdc:d53e8d70-c28a-4f80-a327-5de3b120e4d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67513776-5611-456a-bafd-42938542c90a:indexpattern-datasource-layer-ab5ae146-de1e-41a9-90e9-fceb53836587", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67513776-5611-456a-bafd-42938542c90a:6948cd16-5aef-4199-89cb-61715dcdf94e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67513776-5611-456a-bafd-42938542c90a:49a59c32-6712-4c97-a1d8-274e62ee3d57", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289", + "name": "25a4e2bd-b92e-445c-bec4-15ca828c88a8:panel_25a4e2bd-b92e-445c-bec4-15ca828c88a8", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499.json b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499.json index 932b16b8a29..b7c9994557d 100644 --- a/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499.json +++ b/packages/hid_bravura_monitor/kibana/dashboard/hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499.json @@ -1,14 +1,6 @@ { - "id": "hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-21T21:15:03.667Z", - "version": "WzY5NSwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,154 +12,229 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "API: Calls per node historgram", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dff56bb3-b5c7-49e4-853f-d96ed962f1fc", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": { - "show": false + { + "id": "logs-*", + "name": "1f9a187c-8309-4267-8aaf-b1e9261bb155", + "type": "index-pattern" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "6e925e99-5392-4109-916e-db8cb239465d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dff56bb3-b5c7-49e4-853f-d96ed962f1fc": { + "columnOrder": [ + "890f1740-4c93-45ca-875b-0251dc3fcf8e", + "abf40799-7e92-48e7-8844-ac1f414f2525", + "f133748a-57fe-4922-ab31-17f289714cf3" + ], + "columns": { + "890f1740-4c93-45ca-875b-0251dc3fcf8e": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "abf40799-7e92-48e7-8844-ac1f414f2525": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f133748a-57fe-4922-ab31-17f289714cf3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "f133748a-57fe-4922-ab31-17f289714cf3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" + "$state": { + "store": "appState" }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90d", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "1f9a187c-8309-4267-8aaf-b1e9261bb155", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDAPI" }, - "useNormalizedEsInterval": true + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDAPI" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "6e925e99-5392-4109-916e-db8cb239465d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "f133748a-57fe-4922-ab31-17f289714cf3" + ], + "isHistogram": true, + "layerId": "dff56bb3-b5c7-49e4-853f-d96ed962f1fc", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "abf40799-7e92-48e7-8844-ac1f414f2525", + "xAccessor": "890f1740-4c93-45ca-875b-0251dc3fcf8e", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "f133748a-57fe-4922-ab31-17f289714cf3" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } - } - } + }, + "title": "API: Calls per node historgram (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, @@ -177,74 +244,165 @@ "y": 0 }, "panelIndex": "05d010e5-934c-4b70-ad98-d3b3a191b9e2", - "version": "8.0.0", - "type": "visualization" + "title": "API: Calls per node historgram", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "API: Calls per node", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-00c23fca-3318-43a2-83c0-5926effa1bf2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7dcd689c-dc2c-493e-8fdb-d80b7354eb05", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7c8a2f3-3e9a-4b85-942f-430151ed8858", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "00c23fca-3318-43a2-83c0-5926effa1bf2": { + "columnOrder": [ + "6d228855-6836-4b4f-8374-a46ba36484a4", + "d982ce08-6bd2-4558-9cfc-4f2219a95e25" + ], + "columns": { + "6d228855-6836-4b4f-8374-a46ba36484a4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d982ce08-6bd2-4558-9cfc-4f2219a95e25", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "d982ce08-6bd2-4558-9cfc-4f2219a95e25": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7dcd689c-dc2c-493e-8fdb-d80b7354eb05", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDAPI" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDAPI" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1000 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f7c8a2f3-3e9a-4b85-942f-430151ed8858", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "d982ce08-6bd2-4558-9cfc-4f2219a95e25" + }, + { + "alignment": "left", + "columnId": "6d228855-6836-4b4f-8374-a46ba36484a4" + } + ], + "headerRowHeight": "single", + "layerId": "00c23fca-3318-43a2-83c0-5926effa1bf2", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "API: Calls per node (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -254,110 +412,233 @@ "y": 14 }, "panelIndex": "8ffb10cd-0ea2-4036-8003-8c65e128a201", - "version": "8.0.0", - "type": "visualization" + "title": "API: Calls per node", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "API: Function runtimes", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 0, - "direction": "asc" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-02384009-e020-4acb-801b-661caab32ea0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "47d606c9-3ead-4718-aadb-363a86a80aff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0baaedb4-283e-40e6-ba84-11cc6be984f2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "02384009-e020-4acb-801b-661caab32ea0": { + "columnOrder": [ + "b9922d31-9d31-4015-b49a-a421aaae852e", + "819013c1-53cb-4052-8b12-e75ac32fb191", + "98426b8b-73a0-443e-bb11-bbda2f4a4164", + "bc41f849-1253-44f9-968b-8a761b24e5b7", + "3cab95c5-32e8-44bc-95a3-022fae7b441a", + "5ea6b4d2-f4c5-472d-8db0-ee8e8eebc073" + ], + "columns": { + "3cab95c5-32e8-44bc-95a3-022fae7b441a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "5ea6b4d2-f4c5-472d-8db0-ee8e8eebc073": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sum", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "819013c1-53cb-4052-8b12-e75ac32fb191": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "98426b8b-73a0-443e-bb11-bbda2f4a4164": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Average", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + }, + "b9922d31-9d31-4015-b49a-a421aaae852e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Function", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "819013c1-53cb-4052-8b12-e75ac32fb191", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "hid_bravura_monitor.perf.function" + }, + "bc41f849-1253-44f9-968b-8a761b24e5b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Min", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "hid_bravura_monitor.perf.duration" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "hid_bravura_monitor.perf.function", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, + "filters": [ { - "enabled": true, - "id": "3", - "params": { - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "avg" - }, - { - "enabled": true, - "id": "4", - "params": { - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "index": "47d606c9-3ead-4718-aadb-363a86a80aff", + "key": "hid_bravura_monitor.perf.kind", + "negate": false, + "params": { + "query": "PerfIDAPI" + }, + "type": "phrase" }, - "schema": "metric", - "type": "min" + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.kind": "PerfIDAPI" + } + } }, { - "enabled": true, - "id": "5", - "params": { - "field": "hid_bravura_monitor.perf.duration" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "6", - "params": { - "field": "hid_bravura_monitor.perf.duration" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0baaedb4-283e-40e6-ba84-11cc6be984f2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" }, - "schema": "metric", - "type": "sum" + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "819013c1-53cb-4052-8b12-e75ac32fb191" + }, + { + "alignment": "left", + "columnId": "98426b8b-73a0-443e-bb11-bbda2f4a4164" + }, + { + "alignment": "left", + "columnId": "bc41f849-1253-44f9-968b-8a761b24e5b7" + }, + { + "alignment": "left", + "columnId": "3cab95c5-32e8-44bc-95a3-022fae7b441a" + }, + { + "alignment": "left", + "columnId": "5ea6b4d2-f4c5-472d-8db0-ee8e8eebc073" + }, + { + "alignment": "left", + "columnId": "b9922d31-9d31-4015-b49a-a421aaae852e" + } + ], + "headerRowHeight": "single", + "layerId": "02384009-e020-4acb-801b-661caab32ea0", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "API: Function runtimes (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, @@ -367,8 +648,9 @@ "y": 14 }, "panelIndex": "674a1c30-76cd-429f-a9e6-941aef3e982d", - "version": "8.0.0", - "type": "visualization" + "title": "API: Function runtimes", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -382,38 +664,72 @@ "y": 33 }, "panelIndex": "a75010c7-9c3b-44c2-bf63-676e9aebd54e", - "panelRefName": "panel_3", - "version": "8.0.0" + "panelRefName": "panel_a75010c7-9c3b-44c2-bf63-676e9aebd54e", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Bravura Monitor] API - Summary", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T12:59:54.968Z", + "id": "hid_bravura_monitor-f8112090-fa03-11eb-a1ab-1964dffd1499", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289", - "name": "panel_3", - "type": "search" + "id": "logs-*", + "name": "05d010e5-934c-4b70-ad98-d3b3a191b9e2:indexpattern-datasource-layer-dff56bb3-b5c7-49e4-853f-d96ed962f1fc", + "type": "index-pattern" }, { - "type": "search", - "name": "05d010e5-934c-4b70-ad98-d3b3a191b9e2:search_0", - "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "05d010e5-934c-4b70-ad98-d3b3a191b9e2:1f9a187c-8309-4267-8aaf-b1e9261bb155", + "type": "index-pattern" }, { - "type": "search", - "name": "8ffb10cd-0ea2-4036-8003-8c65e128a201:search_0", - "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "05d010e5-934c-4b70-ad98-d3b3a191b9e2:6e925e99-5392-4109-916e-db8cb239465d", + "type": "index-pattern" }, { - "type": "search", - "name": "674a1c30-76cd-429f-a9e6-941aef3e982d:search_0", - "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289" + "id": "logs-*", + "name": "8ffb10cd-0ea2-4036-8003-8c65e128a201:indexpattern-datasource-layer-00c23fca-3318-43a2-83c0-5926effa1bf2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ffb10cd-0ea2-4036-8003-8c65e128a201:7dcd689c-dc2c-493e-8fdb-d80b7354eb05", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ffb10cd-0ea2-4036-8003-8c65e128a201:f7c8a2f3-3e9a-4b85-942f-430151ed8858", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "674a1c30-76cd-429f-a9e6-941aef3e982d:indexpattern-datasource-layer-02384009-e020-4acb-801b-661caab32ea0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "674a1c30-76cd-429f-a9e6-941aef3e982d:47d606c9-3ead-4718-aadb-363a86a80aff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "674a1c30-76cd-429f-a9e6-941aef3e982d:0baaedb4-283e-40e6-ba84-11cc6be984f2", + "type": "index-pattern" + }, + { + "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289", + "name": "a75010c7-9c3b-44c2-bf63-676e9aebd54e:panel_a75010c7-9c3b-44c2-bf63-676e9aebd54e", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa.json index bc05acdaeb9..01b35949e67 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1159,13 +1162,57 @@ "hid_bravura_monitor.perf.kind": "PerfSproc" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "hid_bravura_monitor.perf.function", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "hid_bravura_monitor.perf.function", + "negate": false, + "params": { + "query": "*Search*" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "hid_bravura_monitor.perf.function": "*Search*" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "hid_bravura_monitor.perf.function : *Search*" + "query": "" }, "version": true } @@ -1176,17 +1223,17 @@ "desc" ] ], + "timeRestore": false, "title": "Search Stored Procedures", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-046c7b20-2b6d-11eb-abcf-effcd51852fa", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1197,6 +1244,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215.json deleted file mode 100644 index e5947948b04..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "attributes": { - "columns": [ - "_source" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "winlog.provider_name", - "negate": false, - "params": { - "query": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "winlog.provider_name": "Hitachi-Hitachi ID Systems-Hitachi ID Suite" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [], - "title": "Bravura Security Windows Event Logs", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-089d63f0-d37c-11eb-9e70-edcbba448215", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa.json deleted file mode 100644 index 99d4786b043..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa.json +++ /dev/null @@ -1,87 +0,0 @@ -{ - "attributes": { - "columns": [ - "_source" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "log.level", - "negate": false, - "params": [ - "error", - "warning", - "critical" - ], - "type": "phrases", - "value": "error, warning, critical" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "log.level": "error" - } - }, - { - "match_phrase": { - "log.level": "warning" - } - }, - { - "match_phrase": { - "log.level": "critical" - } - } - ] - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [], - "title": "Windows Event Log Problems", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-1616ab00-22c8-11eb-abcf-effcd51852fa", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa.json deleted file mode 100644 index 40354fa8072..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa.json +++ /dev/null @@ -1,1068 +0,0 @@ -{ - "attributes": { - "columns": [], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "as.number", - "as.organization.name", - "as.organization.name.text", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.level", - "log.logger", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "message", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.domain", - "user.email", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.roles", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "winlog.activity_id", - "winlog.api", - "winlog.channel", - "winlog.computer_name", - "winlog.event_data.Address", - "winlog.event_data.AdvancedOptions", - "winlog.event_data.AlgorithmName", - "winlog.event_data.AppId", - "winlog.event_data.AuthenticationPackageName", - "winlog.event_data.Binary", - "winlog.event_data.BitlockerUserInputTime", - "winlog.event_data.BootAppStatus", - "winlog.event_data.BootMenuPolicy", - "winlog.event_data.BootMode", - "winlog.event_data.BootType", - "winlog.event_data.BugcheckCode", - "winlog.event_data.BugcheckParameter1", - "winlog.event_data.BugcheckParameter2", - "winlog.event_data.BugcheckParameter3", - "winlog.event_data.BugcheckParameter4", - "winlog.event_data.BuildVersion", - "winlog.event_data.CallerProcessId", - "winlog.event_data.CallerProcessName", - "winlog.event_data.Checkpoint", - "winlog.event_data.Company", - "winlog.event_data.Config", - "winlog.event_data.ConfigAccessPolicy", - "winlog.event_data.ConfigurationReader", - "winlog.event_data.ConnectedStandbyInProgress", - "winlog.event_data.CorruptionActionState", - "winlog.event_data.CreationUtcTime", - "winlog.event_data.CsEntryScenarioInstanceId", - "winlog.event_data.Default SD String:", - "winlog.event_data.Description", - "winlog.event_data.Detail", - "winlog.event_data.DeviceName", - "winlog.event_data.DeviceNameLength", - "winlog.event_data.DeviceTime", - "winlog.event_data.DeviceVersionMajor", - "winlog.event_data.DeviceVersionMinor", - "winlog.event_data.DirtyPages", - "winlog.event_data.DisableIntegrityChecks", - "winlog.event_data.DriveName", - "winlog.event_data.DriverName", - "winlog.event_data.DriverNameLength", - "winlog.event_data.DwordVal", - "winlog.event_data.ElevatedToken", - "winlog.event_data.EnableDisableReason", - "winlog.event_data.EntryCount", - "winlog.event_data.ErrorCode", - "winlog.event_data.ExtraInfo", - "winlog.event_data.ExtraInfoLength", - "winlog.event_data.ExtraInfoString", - "winlog.event_data.FailureName", - "winlog.event_data.FailureNameLength", - "winlog.event_data.FileVersion", - "winlog.event_data.FilterID", - "winlog.event_data.FinalStatus", - "winlog.event_data.FlightSigning", - "winlog.event_data.Group", - "winlog.event_data.HiveName", - "winlog.event_data.HiveNameLength", - "winlog.event_data.HypervisorDebug", - "winlog.event_data.HypervisorLaunchType", - "winlog.event_data.HypervisorLoadOptions", - "winlog.event_data.IdleImplementation", - "winlog.event_data.IdleStateCount", - "winlog.event_data.ImpersonationLevel", - "winlog.event_data.IntegrityLevel", - "winlog.event_data.Interface", - "winlog.event_data.IpAddress", - "winlog.event_data.IpPort", - "winlog.event_data.IsTestConfig", - "winlog.event_data.KernelDebug", - "winlog.event_data.KeyFilePath", - "winlog.event_data.KeyLength", - "winlog.event_data.KeyName", - "winlog.event_data.KeyType", - "winlog.event_data.KeysUpdated", - "winlog.event_data.LastBootGood", - "winlog.event_data.LastShutdownGood", - "winlog.event_data.ListenerAdapterProtocol", - "winlog.event_data.LmPackageName", - "winlog.event_data.LoadOptions", - "winlog.event_data.LogonGuid", - "winlog.event_data.LogonId", - "winlog.event_data.LogonProcessName", - "winlog.event_data.LogonType", - "winlog.event_data.MajorVersion", - "winlog.event_data.MandatoryLabel", - "winlog.event_data.MaximumPerformancePercent", - "winlog.event_data.MemberName", - "winlog.event_data.MemberSid", - "winlog.event_data.MinimumPerformancePercent", - "winlog.event_data.MinimumThrottlePercent", - "winlog.event_data.MinorVersion", - "winlog.event_data.NewProcessId", - "winlog.event_data.NewProcessName", - "winlog.event_data.NewSchemeGuid", - "winlog.event_data.NewSize", - "winlog.event_data.NewTime", - "winlog.event_data.NominalFrequency", - "winlog.event_data.Number", - "winlog.event_data.OldSchemeGuid", - "winlog.event_data.OldTime", - "winlog.event_data.Operation", - "winlog.event_data.OriginalFileName", - "winlog.event_data.OriginalSize", - "winlog.event_data.PackageName", - "winlog.event_data.Path", - "winlog.event_data.PerformanceImplementation", - "winlog.event_data.PowerButtonTimestamp", - "winlog.event_data.PreviousCreationUtcTime", - "winlog.event_data.PreviousTime", - "winlog.event_data.PrivilegeList", - "winlog.event_data.ProcessId", - "winlog.event_data.ProcessName", - "winlog.event_data.ProcessPath", - "winlog.event_data.ProcessPid", - "winlog.event_data.Product", - "winlog.event_data.ProtocolType", - "winlog.event_data.ProviderName", - "winlog.event_data.PuaCount", - "winlog.event_data.PuaPolicyId", - "winlog.event_data.QfeVersion", - "winlog.event_data.Reason", - "winlog.event_data.RemoteEventLogging", - "winlog.event_data.RestrictedAdminMode", - "winlog.event_data.ReturnCode", - "winlog.event_data.RunningMode", - "winlog.event_data.SchemaVersion", - "winlog.event_data.ScriptBlockText", - "winlog.event_data.ServiceName", - "winlog.event_data.ServiceVersion", - "winlog.event_data.ShutdownActionType", - "winlog.event_data.ShutdownEventCode", - "winlog.event_data.ShutdownReason", - "winlog.event_data.Signature", - "winlog.event_data.SignatureStatus", - "winlog.event_data.Signed", - "winlog.event_data.SleepInProgress", - "winlog.event_data.StartTime", - "winlog.event_data.State", - "winlog.event_data.Status", - "winlog.event_data.StopTime", - "winlog.event_data.SubjectDomainName", - "winlog.event_data.SubjectLogonId", - "winlog.event_data.SubjectUserName", - "winlog.event_data.SubjectUserSid", - "winlog.event_data.SystemSleepTransitionsToOn", - "winlog.event_data.TSId", - "winlog.event_data.TargetDomainName", - "winlog.event_data.TargetInfo", - "winlog.event_data.TargetLinkedLogonId", - "winlog.event_data.TargetLogonGuid", - "winlog.event_data.TargetLogonId", - "winlog.event_data.TargetOutboundDomainName", - "winlog.event_data.TargetOutboundUserName", - "winlog.event_data.TargetServerName", - "winlog.event_data.TargetSid", - "winlog.event_data.TargetUserName", - "winlog.event_data.TargetUserSid", - "winlog.event_data.TerminalSessionId", - "winlog.event_data.TestSigning", - "winlog.event_data.TimeSource", - "winlog.event_data.TokenElevationType", - "winlog.event_data.TransmittedServices", - "winlog.event_data.UserSid", - "winlog.event_data.Version", - "winlog.event_data.VirtualAccount", - "winlog.event_data.VsmLaunchType", - "winlog.event_data.VsmPolicy", - "winlog.event_data.Workstation", - "winlog.event_data.param1", - "winlog.event_data.param10", - "winlog.event_data.param11", - "winlog.event_data.param12", - "winlog.event_data.param2", - "winlog.event_data.param3", - "winlog.event_data.param4", - "winlog.event_data.param5", - "winlog.event_data.param6", - "winlog.event_data.param7", - "winlog.event_data.param8", - "winlog.event_data.param9", - "winlog.event_data.serviceGuid", - "winlog.event_data.updateGuid", - "winlog.event_data.updateRevisionNumber", - "winlog.event_data.updateTitle", - "winlog.event_id", - "winlog.keywords", - "winlog.logon.failure.status", - "winlog.logon.id", - "winlog.logon.type", - "winlog.opcode", - "winlog.process.pid", - "winlog.process.thread.id", - "winlog.provider_guid", - "winlog.provider_name", - "winlog.record_id", - "winlog.related_activity_id", - "winlog.task", - "winlog.user.domain", - "winlog.user.identifier", - "winlog.user.name", - "winlog.user.type", - "winlog.user_data.Reason", - "winlog.user_data.binaryData", - "winlog.user_data.binaryDataSize", - "winlog.user_data.param1", - "winlog.user_data.param2", - "winlog.user_data.xml_name", - "winlog.version", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.action", - "negate": false, - "params": [ - "logged-in", - "logged-in-special" - ], - "type": "phrases", - "value": "logged-in, logged-in-special" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "event.action": "logged-in" - } - }, - { - "match_phrase": { - "event.action": "logged-in-special" - } - } - ] - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Windows Event Log Logins", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-1a724dd0-2395-11eb-abcf-effcd51852fa", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a.json index ef3fc4fa40e..feabac40018 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -26,6 +29,28 @@ "hid_bravura_monitor.perf.kind": "PerfReplication" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -41,17 +66,17 @@ "desc" ] ], + "timeRestore": false, "title": "Database: Replication: Search", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-2e254220-df55-11eb-9b6e-d57491399e2a", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -62,6 +87,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289.json deleted file mode 100644 index 944a46be7d1..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289.json +++ /dev/null @@ -1,110 +0,0 @@ -{ - "attributes": { - "columns": [ - "message", - "host.name", - "log.level", - "log.logger" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "hid_bravura_monitor.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "hid_bravura_monitor.log" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "log.level", - "negate": false, - "params": [ - "Warning", - "Error" - ], - "type": "phrases", - "value": "Warning, Error" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "log.level": "Warning" - } - }, - { - "match_phrase": { - "log.level": "Error" - } - } - ] - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [], - "title": "Bravura Security Fabric Errors and Warnings", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-2ec4a850-1463-11eb-bb7b-bb041e8cf289", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-39072a50-2f42-11eb-b6a1-bdb7d768b585.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-39072a50-2f42-11eb-b6a1-bdb7d768b585.json deleted file mode 100644 index 6a1b9dc1a15..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-39072a50-2f42-11eb-b6a1-bdb7d768b585.json +++ /dev/null @@ -1,1203 +0,0 @@ -{ - "attributes": { - "columns": [], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "apache.access.ssl.cipher", - "apache.access.ssl.protocol", - "apache.error.integration", - "as.number", - "as.organization.name", - "as.organization.name.text", - "auditd.log.a0", - "auditd.log.addr", - "auditd.log.item", - "auditd.log.items", - "auditd.log.laddr", - "auditd.log.lport", - "auditd.log.new_auid", - "auditd.log.new_ses", - "auditd.log.old_auid", - "auditd.log.old_ses", - "auditd.log.rport", - "auditd.log.sequence", - "auditd.log.tty", - "azure.consumer_group", - "azure.enqueued_time", - "azure.eventhub", - "azure.offset", - "azure.partition_id", - "azure.sequence_number", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "elasticsearch.audit.action", - "elasticsearch.audit.event_type", - "elasticsearch.audit.indices", - "elasticsearch.audit.layer", - "elasticsearch.audit.message", - "elasticsearch.audit.origin.type", - "elasticsearch.audit.realm", - "elasticsearch.audit.request.id", - "elasticsearch.audit.request.name", - "elasticsearch.audit.url.params", - "elasticsearch.audit.user.realm", - "elasticsearch.audit.user.roles", - "elasticsearch.cluster.name", - "elasticsearch.cluster.uuid", - "elasticsearch.component", - "elasticsearch.gc.heap.size_kb", - "elasticsearch.gc.heap.used_kb", - "elasticsearch.gc.jvm_runtime_sec", - "elasticsearch.gc.old_gen.size_kb", - "elasticsearch.gc.old_gen.used_kb", - "elasticsearch.gc.phase.class_unload_time_sec", - "elasticsearch.gc.phase.cpu_time.real_sec", - "elasticsearch.gc.phase.cpu_time.sys_sec", - "elasticsearch.gc.phase.cpu_time.user_sec", - "elasticsearch.gc.phase.duration_sec", - "elasticsearch.gc.phase.name", - "elasticsearch.gc.phase.parallel_rescan_time_sec", - "elasticsearch.gc.phase.scrub_string_table_time_sec", - "elasticsearch.gc.phase.scrub_symbol_table_time_sec", - "elasticsearch.gc.phase.weak_refs_processing_time_sec", - "elasticsearch.gc.stopping_threads_time_sec", - "elasticsearch.gc.tags", - "elasticsearch.gc.threads_total_stop_time_sec", - "elasticsearch.gc.young_gen.size_kb", - "elasticsearch.gc.young_gen.used_kb", - "elasticsearch.index.id", - "elasticsearch.index.name", - "elasticsearch.node.id", - "elasticsearch.node.name", - "elasticsearch.server.gc.collection_duration.ms", - "elasticsearch.server.gc.observation_duration.ms", - "elasticsearch.server.gc.overhead_seq", - "elasticsearch.server.gc.young.one", - "elasticsearch.server.gc.young.two", - "elasticsearch.server.stacktrace", - "elasticsearch.shard.id", - "elasticsearch.slowlog.extra_source", - "elasticsearch.slowlog.id", - "elasticsearch.slowlog.logger", - "elasticsearch.slowlog.routing", - "elasticsearch.slowlog.search_type", - "elasticsearch.slowlog.source", - "elasticsearch.slowlog.source_query", - "elasticsearch.slowlog.stats", - "elasticsearch.slowlog.took", - "elasticsearch.slowlog.total_hits", - "elasticsearch.slowlog.total_shards", - "elasticsearch.slowlog.type", - "elasticsearch.slowlog.types", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "fileset.name", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "haproxy.backend_name", - "haproxy.backend_queue", - "haproxy.bind_name", - "haproxy.bytes_read", - "haproxy.connection_wait_time_ms", - "haproxy.connections.active", - "haproxy.connections.backend", - "haproxy.connections.frontend", - "haproxy.connections.retries", - "haproxy.connections.server", - "haproxy.error_message", - "haproxy.frontend_name", - "haproxy.http.request.captured_cookie", - "haproxy.http.request.captured_headers", - "haproxy.http.request.raw_request_line", - "haproxy.http.request.time_wait_ms", - "haproxy.http.request.time_wait_without_data_ms", - "haproxy.http.response.captured_cookie", - "haproxy.http.response.captured_headers", - "haproxy.mode", - "haproxy.server_name", - "haproxy.server_queue", - "haproxy.source", - "haproxy.tcp.connection_waiting_time_ms", - "haproxy.termination_state", - "haproxy.time_backend_connect", - "haproxy.time_queue", - "haproxy.total_waiting_time_ms", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "hid_bravura_monitor.instancename", - "hid_bravura_monitor.node", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.destination", - "hid_bravura_monitor.perf.duration", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.file", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.kernel", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.records", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.rule", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.type", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.request.id", - "hid_bravura_monitor.request.id", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "icinga.debug.facility", - "icinga.main.facility", - "icinga.startup.facility", - "icmp.code", - "icmp.type", - "igmp.type", - "iis.access.cookie", - "iis.access.server_name", - "iis.access.site_name", - "iis.access.sub_status", - "iis.access.win32_status", - "iis.error.queue_name", - "iis.error.reason_phrase", - "input.type", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kafka.block_timestamp", - "kafka.key", - "kafka.log.class", - "kafka.log.component", - "kafka.log.thread", - "kafka.log.trace.class", - "kafka.log.trace.message", - "kafka.offset", - "kafka.partition", - "kafka.topic", - "kibana.add_to_spaces", - "kibana.authentication_provider", - "kibana.authentication_realm", - "kibana.authentication_type", - "kibana.delete_from_spaces", - "kibana.log.state", - "kibana.log.tags", - "kibana.lookup_realm", - "kibana.saved_object.id", - "kibana.saved_object.type", - "kibana.session_id", - "kibana.space_id", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.flags", - "log.level", - "log.logger", - "log.offset", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.source.address", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "logstash.log.integration", - "logstash.log.pipeline_id", - "logstash.log.thread", - "logstash.log.thread.text", - "logstash.slowlog.event", - "logstash.slowlog.event.text", - "logstash.slowlog.integration", - "logstash.slowlog.plugin_name", - "logstash.slowlog.plugin_params", - "logstash.slowlog.plugin_params.text", - "logstash.slowlog.plugin_type", - "logstash.slowlog.thread", - "logstash.slowlog.thread.text", - "logstash.slowlog.took_in_millis", - "message", - "mongodb.log.component", - "mongodb.log.context", - "mysql.slowlog.bytes_received", - "mysql.slowlog.bytes_sent", - "mysql.slowlog.current_user", - "mysql.slowlog.filesort", - "mysql.slowlog.filesort_on_disk", - "mysql.slowlog.full_join", - "mysql.slowlog.full_scan", - "mysql.slowlog.innodb.io_r_bytes", - "mysql.slowlog.innodb.io_r_ops", - "mysql.slowlog.innodb.io_r_wait.sec", - "mysql.slowlog.innodb.pages_distinct", - "mysql.slowlog.innodb.queue_wait.sec", - "mysql.slowlog.innodb.rec_lock_wait.sec", - "mysql.slowlog.innodb.trx_id", - "mysql.slowlog.killed", - "mysql.slowlog.last_errno", - "mysql.slowlog.lock_time.sec", - "mysql.slowlog.log_slow_rate_limit", - "mysql.slowlog.log_slow_rate_type", - "mysql.slowlog.merge_passes", - "mysql.slowlog.priority_queue", - "mysql.slowlog.query", - "mysql.slowlog.query_cache_hit", - "mysql.slowlog.read_first", - "mysql.slowlog.read_key", - "mysql.slowlog.read_last", - "mysql.slowlog.read_next", - "mysql.slowlog.read_prev", - "mysql.slowlog.read_rnd", - "mysql.slowlog.read_rnd_next", - "mysql.slowlog.rows_affected", - "mysql.slowlog.rows_examined", - "mysql.slowlog.rows_sent", - "mysql.slowlog.schema", - "mysql.slowlog.sort_merge_passes", - "mysql.slowlog.sort_range_count", - "mysql.slowlog.sort_rows", - "mysql.slowlog.sort_scan_count", - "mysql.slowlog.tmp_disk_tables", - "mysql.slowlog.tmp_table", - "mysql.slowlog.tmp_table_on_disk", - "mysql.slowlog.tmp_table_sizes", - "mysql.slowlog.tmp_tables", - "mysql.thread_id", - "nats.log.client.id", - "nats.log.msg.bytes", - "nats.log.msg.error.message", - "nats.log.msg.max_messages", - "nats.log.msg.queue_group", - "nats.log.msg.reply_to", - "nats.log.msg.sid", - "nats.log.msg.subject", - "nats.log.msg.type", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "nginx.error.connection_id", - "nginx.ingress_controller.http.request.id", - "nginx.ingress_controller.http.request.length", - "nginx.ingress_controller.http.request.time", - "nginx.ingress_controller.upstream.alternative_name", - "nginx.ingress_controller.upstream.ip", - "nginx.ingress_controller.upstream.name", - "nginx.ingress_controller.upstream.port", - "nginx.ingress_controller.upstream.response.length", - "nginx.ingress_controller.upstream.response.length_list", - "nginx.ingress_controller.upstream.response.status_code", - "nginx.ingress_controller.upstream.response.status_code_list", - "nginx.ingress_controller.upstream.response.time", - "nginx.ingress_controller.upstream.response.time_list", - "nginx.ingress_controller.upstream_address_list", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "osquery.result.action", - "osquery.result.calendar_time", - "osquery.result.host_identifier", - "osquery.result.name", - "osquery.result.unix_time", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "postgresql.log.core_id", - "postgresql.log.database", - "postgresql.log.error.code", - "postgresql.log.query", - "postgresql.log.query_name", - "postgresql.log.query_step", - "postgresql.log.timestamp", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.program", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "redis.log.role", - "redis.slowlog.args", - "redis.slowlog.cmd", - "redis.slowlog.duration.us", - "redis.slowlog.id", - "redis.slowlog.key", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "santa.action", - "santa.certificate.common_name", - "santa.certificate.sha256", - "santa.decision", - "santa.disk.bsdname", - "santa.disk.bus", - "santa.disk.fs", - "santa.disk.model", - "santa.disk.mount", - "santa.disk.serial", - "santa.disk.volume", - "santa.mode", - "santa.reason", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "stream", - "syslog.facility", - "syslog.facility_label", - "syslog.priority", - "syslog.severity_label", - "system.auth.ssh.dropped_ip", - "system.auth.ssh.event", - "system.auth.ssh.method", - "system.auth.ssh.signature", - "system.auth.sudo.command", - "system.auth.sudo.error", - "system.auth.sudo.pwd", - "system.auth.sudo.tty", - "system.auth.sudo.user", - "system.auth.useradd.home", - "system.auth.useradd.shell", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "traefik.access.backend_url", - "traefik.access.frontend_name", - "traefik.access.geoip.city_name", - "traefik.access.geoip.continent_name", - "traefik.access.geoip.country_iso_code", - "traefik.access.geoip.location", - "traefik.access.geoip.region_iso_code", - "traefik.access.geoip.region_name", - "traefik.access.request_count", - "traefik.access.user_agent.device", - "traefik.access.user_agent.name", - "traefik.access.user_agent.original", - "traefik.access.user_agent.os", - "traefik.access.user_agent.os_name", - "traefik.access.user_identifier", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.audit.group.id", - "user.audit.group.name", - "user.audit.id", - "user.audit.name", - "user.domain", - "user.effective.group.id", - "user.effective.group.name", - "user.effective.id", - "user.effective.name", - "user.email", - "user.filesystem.group.id", - "user.filesystem.group.name", - "user.filesystem.id", - "user.filesystem.name", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.owner.group.id", - "user.owner.group.name", - "user.owner.id", - "user.owner.name", - "user.roles", - "user.saved.group.id", - "user.saved.group.name", - "user.saved.id", - "user.saved.name", - "user.terminal", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.full_name", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "log.logger: plugin_*" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "PerfExe - Plugins", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-39072a50-2f42-11eb-b6a1-bdb7d768b585", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa.json index c27dc82388c..d068f56d3c6 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1154,7 +1157,10 @@ "pamlws.exe" ], "type": "phrases", - "value": "iddiscover.exe, pamlws.exe" + "value": [ + "iddiscover.exe", + "pamlws.exe" + ] }, "query": { "bool": { @@ -1194,6 +1200,28 @@ "hid_bravura_monitor.perf.kind": "PerfSproc" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -1211,17 +1239,17 @@ "desc" ] ], + "timeRestore": false, "title": "Discovery Stored Procedures", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-3aa4b370-25db-11eb-abcf-effcd51852fa", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1237,6 +1265,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-4215e410-2f42-11eb-b6a1-bdb7d768b585.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-4215e410-2f42-11eb-b6a1-bdb7d768b585.json deleted file mode 100644 index 7610cef9fb4..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-4215e410-2f42-11eb-b6a1-bdb7d768b585.json +++ /dev/null @@ -1,1203 +0,0 @@ -{ - "attributes": { - "columns": [], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "apache.access.ssl.cipher", - "apache.access.ssl.protocol", - "apache.error.integration", - "as.number", - "as.organization.name", - "as.organization.name.text", - "auditd.log.a0", - "auditd.log.addr", - "auditd.log.item", - "auditd.log.items", - "auditd.log.laddr", - "auditd.log.lport", - "auditd.log.new_auid", - "auditd.log.new_ses", - "auditd.log.old_auid", - "auditd.log.old_ses", - "auditd.log.rport", - "auditd.log.sequence", - "auditd.log.tty", - "azure.consumer_group", - "azure.enqueued_time", - "azure.eventhub", - "azure.offset", - "azure.partition_id", - "azure.sequence_number", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "elasticsearch.audit.action", - "elasticsearch.audit.event_type", - "elasticsearch.audit.indices", - "elasticsearch.audit.layer", - "elasticsearch.audit.message", - "elasticsearch.audit.origin.type", - "elasticsearch.audit.realm", - "elasticsearch.audit.request.id", - "elasticsearch.audit.request.name", - "elasticsearch.audit.url.params", - "elasticsearch.audit.user.realm", - "elasticsearch.audit.user.roles", - "elasticsearch.cluster.name", - "elasticsearch.cluster.uuid", - "elasticsearch.component", - "elasticsearch.gc.heap.size_kb", - "elasticsearch.gc.heap.used_kb", - "elasticsearch.gc.jvm_runtime_sec", - "elasticsearch.gc.old_gen.size_kb", - "elasticsearch.gc.old_gen.used_kb", - "elasticsearch.gc.phase.class_unload_time_sec", - "elasticsearch.gc.phase.cpu_time.real_sec", - "elasticsearch.gc.phase.cpu_time.sys_sec", - "elasticsearch.gc.phase.cpu_time.user_sec", - "elasticsearch.gc.phase.duration_sec", - "elasticsearch.gc.phase.name", - "elasticsearch.gc.phase.parallel_rescan_time_sec", - "elasticsearch.gc.phase.scrub_string_table_time_sec", - "elasticsearch.gc.phase.scrub_symbol_table_time_sec", - "elasticsearch.gc.phase.weak_refs_processing_time_sec", - "elasticsearch.gc.stopping_threads_time_sec", - "elasticsearch.gc.tags", - "elasticsearch.gc.threads_total_stop_time_sec", - "elasticsearch.gc.young_gen.size_kb", - "elasticsearch.gc.young_gen.used_kb", - "elasticsearch.index.id", - "elasticsearch.index.name", - "elasticsearch.node.id", - "elasticsearch.node.name", - "elasticsearch.server.gc.collection_duration.ms", - "elasticsearch.server.gc.observation_duration.ms", - "elasticsearch.server.gc.overhead_seq", - "elasticsearch.server.gc.young.one", - "elasticsearch.server.gc.young.two", - "elasticsearch.server.stacktrace", - "elasticsearch.shard.id", - "elasticsearch.slowlog.extra_source", - "elasticsearch.slowlog.id", - "elasticsearch.slowlog.logger", - "elasticsearch.slowlog.routing", - "elasticsearch.slowlog.search_type", - "elasticsearch.slowlog.source", - "elasticsearch.slowlog.source_query", - "elasticsearch.slowlog.stats", - "elasticsearch.slowlog.took", - "elasticsearch.slowlog.total_hits", - "elasticsearch.slowlog.total_shards", - "elasticsearch.slowlog.type", - "elasticsearch.slowlog.types", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "fileset.name", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "haproxy.backend_name", - "haproxy.backend_queue", - "haproxy.bind_name", - "haproxy.bytes_read", - "haproxy.connection_wait_time_ms", - "haproxy.connections.active", - "haproxy.connections.backend", - "haproxy.connections.frontend", - "haproxy.connections.retries", - "haproxy.connections.server", - "haproxy.error_message", - "haproxy.frontend_name", - "haproxy.http.request.captured_cookie", - "haproxy.http.request.captured_headers", - "haproxy.http.request.raw_request_line", - "haproxy.http.request.time_wait_ms", - "haproxy.http.request.time_wait_without_data_ms", - "haproxy.http.response.captured_cookie", - "haproxy.http.response.captured_headers", - "haproxy.mode", - "haproxy.server_name", - "haproxy.server_queue", - "haproxy.source", - "haproxy.tcp.connection_waiting_time_ms", - "haproxy.termination_state", - "haproxy.time_backend_connect", - "haproxy.time_queue", - "haproxy.total_waiting_time_ms", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "hid_bravura_monitor.instancename", - "hid_bravura_monitor.node", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.destination", - "hid_bravura_monitor.perf.duration", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.file", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.kernel", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.records", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.rule", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.type", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.request.id", - "hid_bravura_monitor.request.id", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "icinga.debug.facility", - "icinga.main.facility", - "icinga.startup.facility", - "icmp.code", - "icmp.type", - "igmp.type", - "iis.access.cookie", - "iis.access.server_name", - "iis.access.site_name", - "iis.access.sub_status", - "iis.access.win32_status", - "iis.error.queue_name", - "iis.error.reason_phrase", - "input.type", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kafka.block_timestamp", - "kafka.key", - "kafka.log.class", - "kafka.log.component", - "kafka.log.thread", - "kafka.log.trace.class", - "kafka.log.trace.message", - "kafka.offset", - "kafka.partition", - "kafka.topic", - "kibana.add_to_spaces", - "kibana.authentication_provider", - "kibana.authentication_realm", - "kibana.authentication_type", - "kibana.delete_from_spaces", - "kibana.log.state", - "kibana.log.tags", - "kibana.lookup_realm", - "kibana.saved_object.id", - "kibana.saved_object.type", - "kibana.session_id", - "kibana.space_id", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.flags", - "log.level", - "log.logger", - "log.offset", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.source.address", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "logstash.log.integration", - "logstash.log.pipeline_id", - "logstash.log.thread", - "logstash.log.thread.text", - "logstash.slowlog.event", - "logstash.slowlog.event.text", - "logstash.slowlog.integration", - "logstash.slowlog.plugin_name", - "logstash.slowlog.plugin_params", - "logstash.slowlog.plugin_params.text", - "logstash.slowlog.plugin_type", - "logstash.slowlog.thread", - "logstash.slowlog.thread.text", - "logstash.slowlog.took_in_millis", - "message", - "mongodb.log.component", - "mongodb.log.context", - "mysql.slowlog.bytes_received", - "mysql.slowlog.bytes_sent", - "mysql.slowlog.current_user", - "mysql.slowlog.filesort", - "mysql.slowlog.filesort_on_disk", - "mysql.slowlog.full_join", - "mysql.slowlog.full_scan", - "mysql.slowlog.innodb.io_r_bytes", - "mysql.slowlog.innodb.io_r_ops", - "mysql.slowlog.innodb.io_r_wait.sec", - "mysql.slowlog.innodb.pages_distinct", - "mysql.slowlog.innodb.queue_wait.sec", - "mysql.slowlog.innodb.rec_lock_wait.sec", - "mysql.slowlog.innodb.trx_id", - "mysql.slowlog.killed", - "mysql.slowlog.last_errno", - "mysql.slowlog.lock_time.sec", - "mysql.slowlog.log_slow_rate_limit", - "mysql.slowlog.log_slow_rate_type", - "mysql.slowlog.merge_passes", - "mysql.slowlog.priority_queue", - "mysql.slowlog.query", - "mysql.slowlog.query_cache_hit", - "mysql.slowlog.read_first", - "mysql.slowlog.read_key", - "mysql.slowlog.read_last", - "mysql.slowlog.read_next", - "mysql.slowlog.read_prev", - "mysql.slowlog.read_rnd", - "mysql.slowlog.read_rnd_next", - "mysql.slowlog.rows_affected", - "mysql.slowlog.rows_examined", - "mysql.slowlog.rows_sent", - "mysql.slowlog.schema", - "mysql.slowlog.sort_merge_passes", - "mysql.slowlog.sort_range_count", - "mysql.slowlog.sort_rows", - "mysql.slowlog.sort_scan_count", - "mysql.slowlog.tmp_disk_tables", - "mysql.slowlog.tmp_table", - "mysql.slowlog.tmp_table_on_disk", - "mysql.slowlog.tmp_table_sizes", - "mysql.slowlog.tmp_tables", - "mysql.thread_id", - "nats.log.client.id", - "nats.log.msg.bytes", - "nats.log.msg.error.message", - "nats.log.msg.max_messages", - "nats.log.msg.queue_group", - "nats.log.msg.reply_to", - "nats.log.msg.sid", - "nats.log.msg.subject", - "nats.log.msg.type", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "nginx.error.connection_id", - "nginx.ingress_controller.http.request.id", - "nginx.ingress_controller.http.request.length", - "nginx.ingress_controller.http.request.time", - "nginx.ingress_controller.upstream.alternative_name", - "nginx.ingress_controller.upstream.ip", - "nginx.ingress_controller.upstream.name", - "nginx.ingress_controller.upstream.port", - "nginx.ingress_controller.upstream.response.length", - "nginx.ingress_controller.upstream.response.length_list", - "nginx.ingress_controller.upstream.response.status_code", - "nginx.ingress_controller.upstream.response.status_code_list", - "nginx.ingress_controller.upstream.response.time", - "nginx.ingress_controller.upstream.response.time_list", - "nginx.ingress_controller.upstream_address_list", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "osquery.result.action", - "osquery.result.calendar_time", - "osquery.result.host_identifier", - "osquery.result.name", - "osquery.result.unix_time", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "postgresql.log.core_id", - "postgresql.log.database", - "postgresql.log.error.code", - "postgresql.log.query", - "postgresql.log.query_name", - "postgresql.log.query_step", - "postgresql.log.timestamp", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.program", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "redis.log.role", - "redis.slowlog.args", - "redis.slowlog.cmd", - "redis.slowlog.duration.us", - "redis.slowlog.id", - "redis.slowlog.key", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "santa.action", - "santa.certificate.common_name", - "santa.certificate.sha256", - "santa.decision", - "santa.disk.bsdname", - "santa.disk.bus", - "santa.disk.fs", - "santa.disk.model", - "santa.disk.mount", - "santa.disk.serial", - "santa.disk.volume", - "santa.mode", - "santa.reason", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "stream", - "syslog.facility", - "syslog.facility_label", - "syslog.priority", - "syslog.severity_label", - "system.auth.ssh.dropped_ip", - "system.auth.ssh.event", - "system.auth.ssh.method", - "system.auth.ssh.signature", - "system.auth.sudo.command", - "system.auth.sudo.error", - "system.auth.sudo.pwd", - "system.auth.sudo.tty", - "system.auth.sudo.user", - "system.auth.useradd.home", - "system.auth.useradd.shell", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "traefik.access.backend_url", - "traefik.access.frontend_name", - "traefik.access.geoip.city_name", - "traefik.access.geoip.continent_name", - "traefik.access.geoip.country_iso_code", - "traefik.access.geoip.location", - "traefik.access.geoip.region_iso_code", - "traefik.access.geoip.region_name", - "traefik.access.request_count", - "traefik.access.user_agent.device", - "traefik.access.user_agent.name", - "traefik.access.user_agent.original", - "traefik.access.user_agent.os", - "traefik.access.user_agent.os_name", - "traefik.access.user_identifier", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.audit.group.id", - "user.audit.group.name", - "user.audit.id", - "user.audit.name", - "user.domain", - "user.effective.group.id", - "user.effective.group.name", - "user.effective.id", - "user.effective.name", - "user.email", - "user.filesystem.group.id", - "user.filesystem.group.name", - "user.filesystem.id", - "user.filesystem.name", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.owner.group.id", - "user.owner.group.name", - "user.owner.id", - "user.owner.name", - "user.roles", - "user.saved.group.id", - "user.saved.group.name", - "user.saved.id", - "user.saved.name", - "user.terminal", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.full_name", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "PerfExe", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-4215e410-2f42-11eb-b6a1-bdb7d768b585", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-465760e0-25d7-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-465760e0-25d7-11eb-abcf-effcd51852fa.json deleted file mode 100644 index eb2dba41c87..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-465760e0-25d7-11eb-abcf-effcd51852fa.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "attributes": { - "columns": [ - "_source" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "hid_bravura_monitor.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "hid_bravura_monitor.log" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [], - "title": "Dataset", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-465760e0-25d7-11eb-abcf-effcd51852fa", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215.json index 2d2277ccdbc..7b331397139 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215.json @@ -96,14 +96,12 @@ "title": "Bravura Security Windows Event Logs - Workflow", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-53be5e10-d909-11eb-9e70-edcbba448215", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa.json index 4ec7d37e5e5..dd566d7105d 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa.json @@ -1179,14 +1179,12 @@ "title": "Connector Return Code", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-55100560-1add-11eb-abcf-effcd51852fa", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243.json index 7b1a49e20a5..dcc3dd2a344 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -15,15 +18,13 @@ "disabled": false, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "key": "hid_bravura_monitor.perf.transid", - "negate": true, - "params": { - "query": "" - }, - "type": "phrase" + "negate": false, + "type": "exists", + "value": "exists" }, "query": { - "match_phrase": { - "hid_bravura_monitor.perf.transid": "" + "exists": { + "field": "hid_bravura_monitor.perf.transid" } } }, @@ -31,17 +32,22 @@ "$state": { "store": "appState" }, - "exists": { - "field": "hid_bravura_monitor.perf.transid" - }, "meta": { "alias": null, "disabled": false, + "field": "data_stream.dataset", "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "hid_bravura_monitor.perf.transid", + "key": "data_stream.dataset", "negate": false, - "type": "exists", - "value": "exists" + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } } } ], @@ -58,17 +64,17 @@ "desc" ] ], + "timeRestore": false, "title": "Users: Pages: Search", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-77cbe8b0-de89-11eb-a272-2d62b237e243", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289.json index b7dd1770c9c..b9d6f6eea35 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289.json @@ -7,7 +7,10 @@ "log.logger" ], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1164,6 +1167,28 @@ "hid_bravura_monitor.perf.kind": "PerfSproc" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -1181,17 +1206,17 @@ "desc" ] ], + "timeRestore": false, "title": "PerfSproc", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-83eacd90-1473-11eb-bb7b-bb041e8cf289", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1202,6 +1227,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-95032a30-2eab-11eb-b6a1-bdb7d768b585.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-95032a30-2eab-11eb-b6a1-bdb7d768b585.json deleted file mode 100644 index 5d6af905fc2..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-95032a30-2eab-11eb-b6a1-bdb7d768b585.json +++ /dev/null @@ -1,1210 +0,0 @@ -{ - "attributes": { - "columns": [ - "hid_bravura_monitor.perf.duration", - "log.logger", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.perf.kernel", - "process.pid", - "process.thread.id" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "apache.access.ssl.cipher", - "apache.access.ssl.protocol", - "apache.error.integration", - "as.number", - "as.organization.name", - "as.organization.name.text", - "auditd.log.a0", - "auditd.log.addr", - "auditd.log.item", - "auditd.log.items", - "auditd.log.laddr", - "auditd.log.lport", - "auditd.log.new_auid", - "auditd.log.new_ses", - "auditd.log.old_auid", - "auditd.log.old_ses", - "auditd.log.rport", - "auditd.log.sequence", - "auditd.log.tty", - "azure.consumer_group", - "azure.enqueued_time", - "azure.eventhub", - "azure.offset", - "azure.partition_id", - "azure.sequence_number", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "elasticsearch.audit.action", - "elasticsearch.audit.event_type", - "elasticsearch.audit.indices", - "elasticsearch.audit.layer", - "elasticsearch.audit.message", - "elasticsearch.audit.origin.type", - "elasticsearch.audit.realm", - "elasticsearch.audit.request.id", - "elasticsearch.audit.request.name", - "elasticsearch.audit.url.params", - "elasticsearch.audit.user.realm", - "elasticsearch.audit.user.roles", - "elasticsearch.cluster.name", - "elasticsearch.cluster.uuid", - "elasticsearch.component", - "elasticsearch.gc.heap.size_kb", - "elasticsearch.gc.heap.used_kb", - "elasticsearch.gc.jvm_runtime_sec", - "elasticsearch.gc.old_gen.size_kb", - "elasticsearch.gc.old_gen.used_kb", - "elasticsearch.gc.phase.class_unload_time_sec", - "elasticsearch.gc.phase.cpu_time.real_sec", - "elasticsearch.gc.phase.cpu_time.sys_sec", - "elasticsearch.gc.phase.cpu_time.user_sec", - "elasticsearch.gc.phase.duration_sec", - "elasticsearch.gc.phase.name", - "elasticsearch.gc.phase.parallel_rescan_time_sec", - "elasticsearch.gc.phase.scrub_string_table_time_sec", - "elasticsearch.gc.phase.scrub_symbol_table_time_sec", - "elasticsearch.gc.phase.weak_refs_processing_time_sec", - "elasticsearch.gc.stopping_threads_time_sec", - "elasticsearch.gc.tags", - "elasticsearch.gc.threads_total_stop_time_sec", - "elasticsearch.gc.young_gen.size_kb", - "elasticsearch.gc.young_gen.used_kb", - "elasticsearch.index.id", - "elasticsearch.index.name", - "elasticsearch.node.id", - "elasticsearch.node.name", - "elasticsearch.server.gc.collection_duration.ms", - "elasticsearch.server.gc.observation_duration.ms", - "elasticsearch.server.gc.overhead_seq", - "elasticsearch.server.gc.young.one", - "elasticsearch.server.gc.young.two", - "elasticsearch.server.stacktrace", - "elasticsearch.shard.id", - "elasticsearch.slowlog.extra_source", - "elasticsearch.slowlog.id", - "elasticsearch.slowlog.logger", - "elasticsearch.slowlog.routing", - "elasticsearch.slowlog.search_type", - "elasticsearch.slowlog.source", - "elasticsearch.slowlog.source_query", - "elasticsearch.slowlog.stats", - "elasticsearch.slowlog.took", - "elasticsearch.slowlog.total_hits", - "elasticsearch.slowlog.total_shards", - "elasticsearch.slowlog.type", - "elasticsearch.slowlog.types", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "fileset.name", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "haproxy.backend_name", - "haproxy.backend_queue", - "haproxy.bind_name", - "haproxy.bytes_read", - "haproxy.connection_wait_time_ms", - "haproxy.connections.active", - "haproxy.connections.backend", - "haproxy.connections.frontend", - "haproxy.connections.retries", - "haproxy.connections.server", - "haproxy.error_message", - "haproxy.frontend_name", - "haproxy.http.request.captured_cookie", - "haproxy.http.request.captured_headers", - "haproxy.http.request.raw_request_line", - "haproxy.http.request.time_wait_ms", - "haproxy.http.request.time_wait_without_data_ms", - "haproxy.http.response.captured_cookie", - "haproxy.http.response.captured_headers", - "haproxy.mode", - "haproxy.server_name", - "haproxy.server_queue", - "haproxy.source", - "haproxy.tcp.connection_waiting_time_ms", - "haproxy.termination_state", - "haproxy.time_backend_connect", - "haproxy.time_queue", - "haproxy.total_waiting_time_ms", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "hid_bravura_monitor.instancename", - "hid_bravura_monitor.node", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.destination", - "hid_bravura_monitor.perf.duration", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.file", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.kernel", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.records", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.rule", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.type", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.request.id", - "hid_bravura_monitor.request.id", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "icinga.debug.facility", - "icinga.main.facility", - "icinga.startup.facility", - "icmp.code", - "icmp.type", - "igmp.type", - "iis.access.cookie", - "iis.access.server_name", - "iis.access.site_name", - "iis.access.sub_status", - "iis.access.win32_status", - "iis.error.queue_name", - "iis.error.reason_phrase", - "input.type", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kafka.block_timestamp", - "kafka.key", - "kafka.log.class", - "kafka.log.component", - "kafka.log.thread", - "kafka.log.trace.class", - "kafka.log.trace.message", - "kafka.offset", - "kafka.partition", - "kafka.topic", - "kibana.add_to_spaces", - "kibana.authentication_provider", - "kibana.authentication_realm", - "kibana.authentication_type", - "kibana.delete_from_spaces", - "kibana.log.state", - "kibana.log.tags", - "kibana.lookup_realm", - "kibana.saved_object.id", - "kibana.saved_object.type", - "kibana.session_id", - "kibana.space_id", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.flags", - "log.level", - "log.logger", - "log.offset", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.source.address", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "logstash.log.integration", - "logstash.log.pipeline_id", - "logstash.log.thread", - "logstash.log.thread.text", - "logstash.slowlog.event", - "logstash.slowlog.event.text", - "logstash.slowlog.integration", - "logstash.slowlog.plugin_name", - "logstash.slowlog.plugin_params", - "logstash.slowlog.plugin_params.text", - "logstash.slowlog.plugin_type", - "logstash.slowlog.thread", - "logstash.slowlog.thread.text", - "logstash.slowlog.took_in_millis", - "message", - "mongodb.log.component", - "mongodb.log.context", - "mysql.slowlog.bytes_received", - "mysql.slowlog.bytes_sent", - "mysql.slowlog.current_user", - "mysql.slowlog.filesort", - "mysql.slowlog.filesort_on_disk", - "mysql.slowlog.full_join", - "mysql.slowlog.full_scan", - "mysql.slowlog.innodb.io_r_bytes", - "mysql.slowlog.innodb.io_r_ops", - "mysql.slowlog.innodb.io_r_wait.sec", - "mysql.slowlog.innodb.pages_distinct", - "mysql.slowlog.innodb.queue_wait.sec", - "mysql.slowlog.innodb.rec_lock_wait.sec", - "mysql.slowlog.innodb.trx_id", - "mysql.slowlog.killed", - "mysql.slowlog.last_errno", - "mysql.slowlog.lock_time.sec", - "mysql.slowlog.log_slow_rate_limit", - "mysql.slowlog.log_slow_rate_type", - "mysql.slowlog.merge_passes", - "mysql.slowlog.priority_queue", - "mysql.slowlog.query", - "mysql.slowlog.query_cache_hit", - "mysql.slowlog.read_first", - "mysql.slowlog.read_key", - "mysql.slowlog.read_last", - "mysql.slowlog.read_next", - "mysql.slowlog.read_prev", - "mysql.slowlog.read_rnd", - "mysql.slowlog.read_rnd_next", - "mysql.slowlog.rows_affected", - "mysql.slowlog.rows_examined", - "mysql.slowlog.rows_sent", - "mysql.slowlog.schema", - "mysql.slowlog.sort_merge_passes", - "mysql.slowlog.sort_range_count", - "mysql.slowlog.sort_rows", - "mysql.slowlog.sort_scan_count", - "mysql.slowlog.tmp_disk_tables", - "mysql.slowlog.tmp_table", - "mysql.slowlog.tmp_table_on_disk", - "mysql.slowlog.tmp_table_sizes", - "mysql.slowlog.tmp_tables", - "mysql.thread_id", - "nats.log.client.id", - "nats.log.msg.bytes", - "nats.log.msg.error.message", - "nats.log.msg.max_messages", - "nats.log.msg.queue_group", - "nats.log.msg.reply_to", - "nats.log.msg.sid", - "nats.log.msg.subject", - "nats.log.msg.type", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "nginx.error.connection_id", - "nginx.ingress_controller.http.request.id", - "nginx.ingress_controller.http.request.length", - "nginx.ingress_controller.http.request.time", - "nginx.ingress_controller.upstream.alternative_name", - "nginx.ingress_controller.upstream.ip", - "nginx.ingress_controller.upstream.name", - "nginx.ingress_controller.upstream.port", - "nginx.ingress_controller.upstream.response.length", - "nginx.ingress_controller.upstream.response.length_list", - "nginx.ingress_controller.upstream.response.status_code", - "nginx.ingress_controller.upstream.response.status_code_list", - "nginx.ingress_controller.upstream.response.time", - "nginx.ingress_controller.upstream.response.time_list", - "nginx.ingress_controller.upstream_address_list", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "osquery.result.action", - "osquery.result.calendar_time", - "osquery.result.host_identifier", - "osquery.result.name", - "osquery.result.unix_time", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "postgresql.log.core_id", - "postgresql.log.database", - "postgresql.log.error.code", - "postgresql.log.query", - "postgresql.log.query_name", - "postgresql.log.query_step", - "postgresql.log.timestamp", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.program", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "redis.log.role", - "redis.slowlog.args", - "redis.slowlog.cmd", - "redis.slowlog.duration.us", - "redis.slowlog.id", - "redis.slowlog.key", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "santa.action", - "santa.certificate.common_name", - "santa.certificate.sha256", - "santa.decision", - "santa.disk.bsdname", - "santa.disk.bus", - "santa.disk.fs", - "santa.disk.model", - "santa.disk.mount", - "santa.disk.serial", - "santa.disk.volume", - "santa.mode", - "santa.reason", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "stream", - "syslog.facility", - "syslog.facility_label", - "syslog.priority", - "syslog.severity_label", - "system.auth.ssh.dropped_ip", - "system.auth.ssh.event", - "system.auth.ssh.method", - "system.auth.ssh.signature", - "system.auth.sudo.command", - "system.auth.sudo.error", - "system.auth.sudo.pwd", - "system.auth.sudo.tty", - "system.auth.sudo.user", - "system.auth.useradd.home", - "system.auth.useradd.shell", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "traefik.access.backend_url", - "traefik.access.frontend_name", - "traefik.access.geoip.city_name", - "traefik.access.geoip.continent_name", - "traefik.access.geoip.country_iso_code", - "traefik.access.geoip.location", - "traefik.access.geoip.region_iso_code", - "traefik.access.geoip.region_name", - "traefik.access.request_count", - "traefik.access.user_agent.device", - "traefik.access.user_agent.name", - "traefik.access.user_agent.original", - "traefik.access.user_agent.os", - "traefik.access.user_agent.os_name", - "traefik.access.user_identifier", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.audit.group.id", - "user.audit.group.name", - "user.audit.id", - "user.audit.name", - "user.domain", - "user.effective.group.id", - "user.effective.group.name", - "user.effective.id", - "user.effective.name", - "user.email", - "user.filesystem.group.id", - "user.filesystem.group.name", - "user.filesystem.id", - "user.filesystem.name", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.owner.group.id", - "user.owner.group.name", - "user.owner.id", - "user.owner.name", - "user.roles", - "user.saved.group.id", - "user.saved.group.name", - "user.saved.id", - "user.saved.name", - "user.terminal", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.full_name", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfExe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfExe" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "NOT log.logger: plugin_*" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "PerfExe - Executables", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-95032a30-2eab-11eb-b6a1-bdb7d768b585", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289.json index 7d57cb64083..cc727a31499 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289.json @@ -9,7 +9,10 @@ "message" ], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1166,6 +1169,28 @@ "hid_bravura_monitor.perf.kind": "PerfIDAPI" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -1183,17 +1208,17 @@ "desc" ] ], + "timeRestore": false, "title": "PerfIDAPI", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-991d9760-1473-11eb-bb7b-bb041e8cf289", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1204,6 +1229,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef.json index bef32196019..3d7874a7e3e 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -45,7 +48,13 @@ "78" ], "type": "phrases", - "value": "8, 9, 10, 6, 78" + "value": [ + "8", + "9", + "10", + "6", + "78" + ] }, "query": { "bool": { @@ -79,6 +88,28 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -96,17 +127,17 @@ "desc" ] ], + "timeRestore": false, "title": "Bravura Security Windows Event Logs - Replication", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-9a787d10-0521-11ec-853c-2bf1ec8ddeef", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -122,6 +153,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa.json index 94be5c7cd76..8f1987eb5d8 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa.json @@ -1,10 +1,11 @@ { "attributes": { - "columns": [ - "_source" - ], + "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -24,7 +25,11 @@ "psa.exe" ], "type": "phrases", - "value": "ajaxsvc.exe, psf.exe, psa.exe" + "value": [ + "ajaxsvc.exe", + "psf.exe", + "psa.exe" + ] }, "query": { "bool": { @@ -64,7 +69,10 @@ "Warning" ], "type": "phrases", - "value": "Error, Warning" + "value": [ + "Error", + "Warning" + ] }, "query": { "bool": { @@ -88,9 +96,6 @@ "$state": { "store": "appState" }, - "exists": { - "field": "user.id" - }, "meta": { "alias": null, "disabled": false, @@ -99,6 +104,33 @@ "negate": false, "type": "exists", "value": "exists" + }, + "query": { + "exists": { + "field": "user.id" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } } } ], @@ -111,18 +143,23 @@ "version": true } }, - "sort": [], + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, "title": "User Issue Logs", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-9e4165d0-1a1a-11eb-abcf-effcd51852fa", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -143,6 +180,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[3].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289.json index ee024270e0f..4db48e89827 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289.json @@ -2,7 +2,10 @@ "attributes": { "columns": [], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1159,6 +1162,28 @@ "hid_bravura_monitor.perf.kind": "PerfAjax" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -1176,17 +1201,17 @@ "desc" ] ], + "timeRestore": false, "title": "PerfAjax", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-ad5f7180-1473-11eb-bb7b-bb041e8cf289", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1197,6 +1222,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-be8c8b60-874f-11eb-a5be-4d72a1654030.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-be8c8b60-874f-11eb-a5be-4d72a1654030.json deleted file mode 100644 index ef1bd035815..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-be8c8b60-874f-11eb-a5be-4d72a1654030.json +++ /dev/null @@ -1,1203 +0,0 @@ -{ - "attributes": { - "columns": [], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "apache.access.ssl.cipher", - "apache.access.ssl.protocol", - "apache.error.integration", - "as.number", - "as.organization.name", - "as.organization.name.text", - "auditd.log.a0", - "auditd.log.addr", - "auditd.log.item", - "auditd.log.items", - "auditd.log.laddr", - "auditd.log.lport", - "auditd.log.new_auid", - "auditd.log.new_ses", - "auditd.log.old_auid", - "auditd.log.old_ses", - "auditd.log.rport", - "auditd.log.sequence", - "auditd.log.tty", - "azure.consumer_group", - "azure.enqueued_time", - "azure.eventhub", - "azure.offset", - "azure.partition_id", - "azure.sequence_number", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "elasticsearch.audit.action", - "elasticsearch.audit.event_type", - "elasticsearch.audit.indices", - "elasticsearch.audit.layer", - "elasticsearch.audit.message", - "elasticsearch.audit.origin.type", - "elasticsearch.audit.realm", - "elasticsearch.audit.request.id", - "elasticsearch.audit.request.name", - "elasticsearch.audit.url.params", - "elasticsearch.audit.user.realm", - "elasticsearch.audit.user.roles", - "elasticsearch.cluster.name", - "elasticsearch.cluster.uuid", - "elasticsearch.component", - "elasticsearch.gc.heap.size_kb", - "elasticsearch.gc.heap.used_kb", - "elasticsearch.gc.jvm_runtime_sec", - "elasticsearch.gc.old_gen.size_kb", - "elasticsearch.gc.old_gen.used_kb", - "elasticsearch.gc.phase.class_unload_time_sec", - "elasticsearch.gc.phase.cpu_time.real_sec", - "elasticsearch.gc.phase.cpu_time.sys_sec", - "elasticsearch.gc.phase.cpu_time.user_sec", - "elasticsearch.gc.phase.duration_sec", - "elasticsearch.gc.phase.name", - "elasticsearch.gc.phase.parallel_rescan_time_sec", - "elasticsearch.gc.phase.scrub_string_table_time_sec", - "elasticsearch.gc.phase.scrub_symbol_table_time_sec", - "elasticsearch.gc.phase.weak_refs_processing_time_sec", - "elasticsearch.gc.stopping_threads_time_sec", - "elasticsearch.gc.tags", - "elasticsearch.gc.threads_total_stop_time_sec", - "elasticsearch.gc.young_gen.size_kb", - "elasticsearch.gc.young_gen.used_kb", - "elasticsearch.index.id", - "elasticsearch.index.name", - "elasticsearch.node.id", - "elasticsearch.node.name", - "elasticsearch.server.gc.collection_duration.ms", - "elasticsearch.server.gc.observation_duration.ms", - "elasticsearch.server.gc.overhead_seq", - "elasticsearch.server.gc.young.one", - "elasticsearch.server.gc.young.two", - "elasticsearch.server.stacktrace", - "elasticsearch.shard.id", - "elasticsearch.slowlog.extra_source", - "elasticsearch.slowlog.id", - "elasticsearch.slowlog.logger", - "elasticsearch.slowlog.routing", - "elasticsearch.slowlog.search_type", - "elasticsearch.slowlog.source", - "elasticsearch.slowlog.source_query", - "elasticsearch.slowlog.stats", - "elasticsearch.slowlog.took", - "elasticsearch.slowlog.total_hits", - "elasticsearch.slowlog.total_shards", - "elasticsearch.slowlog.type", - "elasticsearch.slowlog.types", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "fileset.name", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "haproxy.backend_name", - "haproxy.backend_queue", - "haproxy.bind_name", - "haproxy.bytes_read", - "haproxy.connection_wait_time_ms", - "haproxy.connections.active", - "haproxy.connections.backend", - "haproxy.connections.frontend", - "haproxy.connections.retries", - "haproxy.connections.server", - "haproxy.error_message", - "haproxy.frontend_name", - "haproxy.http.request.captured_cookie", - "haproxy.http.request.captured_headers", - "haproxy.http.request.raw_request_line", - "haproxy.http.request.time_wait_ms", - "haproxy.http.request.time_wait_without_data_ms", - "haproxy.http.response.captured_cookie", - "haproxy.http.response.captured_headers", - "haproxy.mode", - "haproxy.server_name", - "haproxy.server_queue", - "haproxy.source", - "haproxy.tcp.connection_waiting_time_ms", - "haproxy.termination_state", - "haproxy.time_backend_connect", - "haproxy.time_queue", - "haproxy.total_waiting_time_ms", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "hid_bravura_monitor.instancename", - "hid_bravura_monitor.node", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.destination", - "hid_bravura_monitor.perf.duration", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.file", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.kernel", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.records", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.rule", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.type", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.request.id", - "hid_bravura_monitor.request.id", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "icinga.debug.facility", - "icinga.main.facility", - "icinga.startup.facility", - "icmp.code", - "icmp.type", - "igmp.type", - "iis.access.cookie", - "iis.access.server_name", - "iis.access.site_name", - "iis.access.sub_status", - "iis.access.win32_status", - "iis.error.queue_name", - "iis.error.reason_phrase", - "input.type", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kafka.block_timestamp", - "kafka.key", - "kafka.log.class", - "kafka.log.component", - "kafka.log.thread", - "kafka.log.trace.class", - "kafka.log.trace.message", - "kafka.offset", - "kafka.partition", - "kafka.topic", - "kibana.add_to_spaces", - "kibana.authentication_provider", - "kibana.authentication_realm", - "kibana.authentication_type", - "kibana.delete_from_spaces", - "kibana.log.state", - "kibana.log.tags", - "kibana.lookup_realm", - "kibana.saved_object.id", - "kibana.saved_object.type", - "kibana.session_id", - "kibana.space_id", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.flags", - "log.level", - "log.logger", - "log.offset", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.source.address", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "logstash.log.integration", - "logstash.log.pipeline_id", - "logstash.log.thread", - "logstash.log.thread.text", - "logstash.slowlog.event", - "logstash.slowlog.event.text", - "logstash.slowlog.integration", - "logstash.slowlog.plugin_name", - "logstash.slowlog.plugin_params", - "logstash.slowlog.plugin_params.text", - "logstash.slowlog.plugin_type", - "logstash.slowlog.thread", - "logstash.slowlog.thread.text", - "logstash.slowlog.took_in_millis", - "message", - "mongodb.log.component", - "mongodb.log.context", - "mysql.slowlog.bytes_received", - "mysql.slowlog.bytes_sent", - "mysql.slowlog.current_user", - "mysql.slowlog.filesort", - "mysql.slowlog.filesort_on_disk", - "mysql.slowlog.full_join", - "mysql.slowlog.full_scan", - "mysql.slowlog.innodb.io_r_bytes", - "mysql.slowlog.innodb.io_r_ops", - "mysql.slowlog.innodb.io_r_wait.sec", - "mysql.slowlog.innodb.pages_distinct", - "mysql.slowlog.innodb.queue_wait.sec", - "mysql.slowlog.innodb.rec_lock_wait.sec", - "mysql.slowlog.innodb.trx_id", - "mysql.slowlog.killed", - "mysql.slowlog.last_errno", - "mysql.slowlog.lock_time.sec", - "mysql.slowlog.log_slow_rate_limit", - "mysql.slowlog.log_slow_rate_type", - "mysql.slowlog.merge_passes", - "mysql.slowlog.priority_queue", - "mysql.slowlog.query", - "mysql.slowlog.query_cache_hit", - "mysql.slowlog.read_first", - "mysql.slowlog.read_key", - "mysql.slowlog.read_last", - "mysql.slowlog.read_next", - "mysql.slowlog.read_prev", - "mysql.slowlog.read_rnd", - "mysql.slowlog.read_rnd_next", - "mysql.slowlog.rows_affected", - "mysql.slowlog.rows_examined", - "mysql.slowlog.rows_sent", - "mysql.slowlog.schema", - "mysql.slowlog.sort_merge_passes", - "mysql.slowlog.sort_range_count", - "mysql.slowlog.sort_rows", - "mysql.slowlog.sort_scan_count", - "mysql.slowlog.tmp_disk_tables", - "mysql.slowlog.tmp_table", - "mysql.slowlog.tmp_table_on_disk", - "mysql.slowlog.tmp_table_sizes", - "mysql.slowlog.tmp_tables", - "mysql.thread_id", - "nats.log.client.id", - "nats.log.msg.bytes", - "nats.log.msg.error.message", - "nats.log.msg.max_messages", - "nats.log.msg.queue_group", - "nats.log.msg.reply_to", - "nats.log.msg.sid", - "nats.log.msg.subject", - "nats.log.msg.type", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "nginx.error.connection_id", - "nginx.ingress_controller.http.request.id", - "nginx.ingress_controller.http.request.length", - "nginx.ingress_controller.http.request.time", - "nginx.ingress_controller.upstream.alternative_name", - "nginx.ingress_controller.upstream.ip", - "nginx.ingress_controller.upstream.name", - "nginx.ingress_controller.upstream.port", - "nginx.ingress_controller.upstream.response.length", - "nginx.ingress_controller.upstream.response.length_list", - "nginx.ingress_controller.upstream.response.status_code", - "nginx.ingress_controller.upstream.response.status_code_list", - "nginx.ingress_controller.upstream.response.time", - "nginx.ingress_controller.upstream.response.time_list", - "nginx.ingress_controller.upstream_address_list", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "osquery.result.action", - "osquery.result.calendar_time", - "osquery.result.host_identifier", - "osquery.result.name", - "osquery.result.unix_time", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "postgresql.log.core_id", - "postgresql.log.database", - "postgresql.log.error.code", - "postgresql.log.query", - "postgresql.log.query_name", - "postgresql.log.query_step", - "postgresql.log.timestamp", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.program", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "redis.log.role", - "redis.slowlog.args", - "redis.slowlog.cmd", - "redis.slowlog.duration.us", - "redis.slowlog.id", - "redis.slowlog.key", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "santa.action", - "santa.certificate.common_name", - "santa.certificate.sha256", - "santa.decision", - "santa.disk.bsdname", - "santa.disk.bus", - "santa.disk.fs", - "santa.disk.model", - "santa.disk.mount", - "santa.disk.serial", - "santa.disk.volume", - "santa.mode", - "santa.reason", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "stream", - "syslog.facility", - "syslog.facility_label", - "syslog.priority", - "syslog.severity_label", - "system.auth.ssh.dropped_ip", - "system.auth.ssh.event", - "system.auth.ssh.method", - "system.auth.ssh.signature", - "system.auth.sudo.command", - "system.auth.sudo.error", - "system.auth.sudo.pwd", - "system.auth.sudo.tty", - "system.auth.sudo.user", - "system.auth.useradd.home", - "system.auth.useradd.shell", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "traefik.access.backend_url", - "traefik.access.frontend_name", - "traefik.access.geoip.city_name", - "traefik.access.geoip.continent_name", - "traefik.access.geoip.country_iso_code", - "traefik.access.geoip.location", - "traefik.access.geoip.region_iso_code", - "traefik.access.geoip.region_name", - "traefik.access.request_count", - "traefik.access.user_agent.device", - "traefik.access.user_agent.name", - "traefik.access.user_agent.original", - "traefik.access.user_agent.os", - "traefik.access.user_agent.os_name", - "traefik.access.user_identifier", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.audit.group.id", - "user.audit.group.name", - "user.audit.id", - "user.audit.name", - "user.domain", - "user.effective.group.id", - "user.effective.group.name", - "user.effective.id", - "user.effective.name", - "user.email", - "user.filesystem.group.id", - "user.filesystem.group.name", - "user.filesystem.id", - "user.filesystem.name", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.owner.group.id", - "user.owner.group.name", - "user.owner.id", - "user.owner.name", - "user.roles", - "user.saved.group.id", - "user.saved.group.name", - "user.saved.id", - "user.saved.name", - "user.terminal", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.full_name", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "log.logger", - "negate": false, - "params": { - "query": "iddb.exe" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "log.logger": "iddb.exe" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Database Events", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-be8c8b60-874f-11eb-a5be-4d72a1654030", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289.json index 364f7adaebd..33756362509 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289.json @@ -1179,14 +1179,12 @@ "title": "PerfConnector", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T18:11:22.629Z", "id": "hid_bravura_monitor-bfc7f7c0-1473-11eb-bb7b-bb041e8cf289", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289.json index fdc11b138d6..88c8cd2f9f5 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289.json @@ -9,7 +9,10 @@ "process.thread.id" ], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "fieldsFromSource": [ @@ -1166,6 +1169,28 @@ "hid_bravura_monitor.perf.kind": "PerfIDWFM" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -1183,17 +1208,17 @@ "desc" ] ], + "timeRestore": false, "title": "PerfIDWFM", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-d1f2d8c0-1473-11eb-bb7b-bb041e8cf289", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -1204,6 +1229,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215.json index 2a6624870c8..fc24378f2b5 100644 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215.json +++ b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215.json @@ -4,7 +4,10 @@ "message" ], "description": "", + "grid": {}, + "hideChart": true, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -71,7 +74,37 @@ "121" ], "type": "phrases", - "value": "28, 29, 30, 31, 32, 33, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 121" + "value": [ + "28", + "29", + "30", + "31", + "32", + "33", + "52", + "53", + "54", + "55", + "56", + "57", + "58", + "59", + "60", + "61", + "62", + "63", + "64", + "65", + "66", + "67", + "68", + "69", + "70", + "71", + "72", + "73", + "121" + ] }, "query": { "bool": { @@ -225,6 +258,28 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "hid_bravura_monitor.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "hid_bravura_monitor.log" + } + } } ], "highlightAll": true, @@ -236,18 +291,23 @@ "version": true } }, - "sort": [], + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, "title": "Bravura Security Windows Event Logs - Administrative", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-17T07:44:48.922Z", "id": "hid_bravura_monitor-dca8bb20-d397-11eb-9e70-edcbba448215", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -263,6 +323,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dd637750-1473-11eb-bb7b-bb041e8cf289.json b/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dd637750-1473-11eb-bb7b-bb041e8cf289.json deleted file mode 100644 index c2f7c3ffbc9..00000000000 --- a/packages/hid_bravura_monitor/kibana/search/hid_bravura_monitor-dd637750-1473-11eb-bb7b-bb041e8cf289.json +++ /dev/null @@ -1,1205 +0,0 @@ -{ - "attributes": { - "columns": [ - "_source" - ], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "fieldsFromSource": [ - "@timestamp", - "_id", - "_index", - "_score", - "_source", - "_type", - "agent.build.original", - "agent.ephemeral_id", - "agent.hostname", - "agent.id", - "agent.name", - "agent.type", - "agent.version", - "apache.access.ssl.cipher", - "apache.access.ssl.protocol", - "apache.error.integration", - "as.number", - "as.organization.name", - "as.organization.name.text", - "auditd.log.a0", - "auditd.log.addr", - "auditd.log.item", - "auditd.log.items", - "auditd.log.laddr", - "auditd.log.lport", - "auditd.log.new_auid", - "auditd.log.new_ses", - "auditd.log.old_auid", - "auditd.log.old_ses", - "auditd.log.rport", - "auditd.log.sequence", - "auditd.log.tty", - "azure.consumer_group", - "azure.enqueued_time", - "azure.eventhub", - "azure.offset", - "azure.partition_id", - "azure.sequence_number", - "client.address", - "client.as.number", - "client.as.organization.name", - "client.as.organization.name.text", - "client.bytes", - "client.domain", - "client.geo.city_name", - "client.geo.continent_name", - "client.geo.country_iso_code", - "client.geo.country_name", - "client.geo.location", - "client.geo.name", - "client.geo.region_iso_code", - "client.geo.region_name", - "client.ip", - "client.mac", - "client.nat.ip", - "client.nat.port", - "client.packets", - "client.port", - "client.registered_domain", - "client.subdomain", - "client.top_level_domain", - "client.user.domain", - "client.user.email", - "client.user.full_name", - "client.user.full_name.text", - "client.user.group.domain", - "client.user.group.id", - "client.user.group.name", - "client.user.hash", - "client.user.id", - "client.user.name", - "client.user.name.text", - "client.user.roles", - "cloud.account.id", - "cloud.account.name", - "cloud.availability_zone", - "cloud.image.id", - "cloud.instance.id", - "cloud.instance.name", - "cloud.machine.type", - "cloud.project.id", - "cloud.project.name", - "cloud.provider", - "cloud.region", - "code_signature.exists", - "code_signature.status", - "code_signature.subject_name", - "code_signature.trusted", - "code_signature.valid", - "container.id", - "container.image.name", - "container.image.tag", - "container.name", - "container.runtime", - "destination.address", - "destination.as.number", - "destination.as.organization.name", - "destination.as.organization.name.text", - "destination.bytes", - "destination.domain", - "destination.geo.city_name", - "destination.geo.continent_name", - "destination.geo.country_iso_code", - "destination.geo.country_name", - "destination.geo.location", - "destination.geo.name", - "destination.geo.region_iso_code", - "destination.geo.region_name", - "destination.ip", - "destination.mac", - "destination.nat.ip", - "destination.nat.port", - "destination.packets", - "destination.port", - "destination.registered_domain", - "destination.subdomain", - "destination.top_level_domain", - "destination.user.domain", - "destination.user.email", - "destination.user.full_name", - "destination.user.full_name.text", - "destination.user.group.domain", - "destination.user.group.id", - "destination.user.group.name", - "destination.user.hash", - "destination.user.id", - "destination.user.name", - "destination.user.name.text", - "destination.user.roles", - "dll.code_signature.exists", - "dll.code_signature.status", - "dll.code_signature.subject_name", - "dll.code_signature.trusted", - "dll.code_signature.valid", - "dll.hash.md5", - "dll.hash.sha1", - "dll.hash.sha256", - "dll.hash.sha512", - "dll.name", - "dll.path", - "dll.pe.architecture", - "dll.pe.company", - "dll.pe.description", - "dll.pe.file_version", - "dll.pe.imphash", - "dll.pe.original_file_name", - "dll.pe.product", - "dns.answers.class", - "dns.answers.data", - "dns.answers.name", - "dns.answers.ttl", - "dns.answers.type", - "dns.header_flags", - "dns.id", - "dns.op_code", - "dns.question.class", - "dns.question.name", - "dns.question.registered_domain", - "dns.question.subdomain", - "dns.question.top_level_domain", - "dns.question.type", - "dns.resolved_ip", - "dns.response_code", - "dns.type", - "ecs.version", - "elasticsearch.audit.action", - "elasticsearch.audit.event_type", - "elasticsearch.audit.indices", - "elasticsearch.audit.layer", - "elasticsearch.audit.message", - "elasticsearch.audit.origin.type", - "elasticsearch.audit.realm", - "elasticsearch.audit.request.id", - "elasticsearch.audit.request.name", - "elasticsearch.audit.url.params", - "elasticsearch.audit.user.realm", - "elasticsearch.audit.user.roles", - "elasticsearch.cluster.name", - "elasticsearch.cluster.uuid", - "elasticsearch.component", - "elasticsearch.gc.heap.size_kb", - "elasticsearch.gc.heap.used_kb", - "elasticsearch.gc.jvm_runtime_sec", - "elasticsearch.gc.old_gen.size_kb", - "elasticsearch.gc.old_gen.used_kb", - "elasticsearch.gc.phase.class_unload_time_sec", - "elasticsearch.gc.phase.cpu_time.real_sec", - "elasticsearch.gc.phase.cpu_time.sys_sec", - "elasticsearch.gc.phase.cpu_time.user_sec", - "elasticsearch.gc.phase.duration_sec", - "elasticsearch.gc.phase.name", - "elasticsearch.gc.phase.parallel_rescan_time_sec", - "elasticsearch.gc.phase.scrub_string_table_time_sec", - "elasticsearch.gc.phase.scrub_symbol_table_time_sec", - "elasticsearch.gc.phase.weak_refs_processing_time_sec", - "elasticsearch.gc.stopping_threads_time_sec", - "elasticsearch.gc.tags", - "elasticsearch.gc.threads_total_stop_time_sec", - "elasticsearch.gc.young_gen.size_kb", - "elasticsearch.gc.young_gen.used_kb", - "elasticsearch.index.id", - "elasticsearch.index.name", - "elasticsearch.node.id", - "elasticsearch.node.name", - "elasticsearch.server.gc.collection_duration.ms", - "elasticsearch.server.gc.observation_duration.ms", - "elasticsearch.server.gc.overhead_seq", - "elasticsearch.server.gc.young.one", - "elasticsearch.server.gc.young.two", - "elasticsearch.server.stacktrace", - "elasticsearch.shard.id", - "elasticsearch.slowlog.extra_source", - "elasticsearch.slowlog.id", - "elasticsearch.slowlog.logger", - "elasticsearch.slowlog.routing", - "elasticsearch.slowlog.search_type", - "elasticsearch.slowlog.source", - "elasticsearch.slowlog.source_query", - "elasticsearch.slowlog.stats", - "elasticsearch.slowlog.took", - "elasticsearch.slowlog.total_hits", - "elasticsearch.slowlog.total_shards", - "elasticsearch.slowlog.type", - "elasticsearch.slowlog.types", - "error.code", - "error.id", - "error.message", - "error.stack_trace", - "error.stack_trace.text", - "error.type", - "event.action", - "event.category", - "event.code", - "event.created", - "data_stream.dataset", - "event.duration", - "event.end", - "event.hash", - "event.id", - "event.ingested", - "event.kind", - "event.integration", - "event.original", - "event.outcome", - "event.provider", - "event.reason", - "event.reference", - "event.risk_score", - "event.risk_score_norm", - "event.sequence", - "event.severity", - "event.start", - "event.timezone", - "event.type", - "event.url", - "file.accessed", - "file.attributes", - "file.code_signature.exists", - "file.code_signature.status", - "file.code_signature.subject_name", - "file.code_signature.trusted", - "file.code_signature.valid", - "file.created", - "file.ctime", - "file.device", - "file.directory", - "file.drive_letter", - "file.extension", - "file.gid", - "file.group", - "file.hash.md5", - "file.hash.sha1", - "file.hash.sha256", - "file.hash.sha512", - "file.inode", - "file.mime_type", - "file.mode", - "file.mtime", - "file.name", - "file.owner", - "file.path", - "file.path.text", - "file.pe.architecture", - "file.pe.company", - "file.pe.description", - "file.pe.file_version", - "file.pe.imphash", - "file.pe.original_file_name", - "file.pe.product", - "file.size", - "file.target_path", - "file.target_path.text", - "file.type", - "file.uid", - "file.x509.alternative_names", - "file.x509.issuer.common_name", - "file.x509.issuer.country", - "file.x509.issuer.distinguished_name", - "file.x509.issuer.locality", - "file.x509.issuer.organization", - "file.x509.issuer.organizational_unit", - "file.x509.issuer.state_or_province", - "file.x509.not_after", - "file.x509.not_before", - "file.x509.public_key_algorithm", - "file.x509.public_key_curve", - "file.x509.public_key_exponent", - "file.x509.public_key_size", - "file.x509.serial_number", - "file.x509.signature_algorithm", - "file.x509.subject.common_name", - "file.x509.subject.country", - "file.x509.subject.distinguished_name", - "file.x509.subject.locality", - "file.x509.subject.organization", - "file.x509.subject.organizational_unit", - "file.x509.subject.state_or_province", - "file.x509.version_number", - "fileset.name", - "geo.city_name", - "geo.continent_name", - "geo.country_iso_code", - "geo.country_name", - "geo.location", - "geo.name", - "geo.region_iso_code", - "geo.region_name", - "group.domain", - "group.id", - "group.name", - "haproxy.backend_name", - "haproxy.backend_queue", - "haproxy.bind_name", - "haproxy.bytes_read", - "haproxy.connection_wait_time_ms", - "haproxy.connections.active", - "haproxy.connections.backend", - "haproxy.connections.frontend", - "haproxy.connections.retries", - "haproxy.connections.server", - "haproxy.error_message", - "haproxy.frontend_name", - "haproxy.http.request.captured_cookie", - "haproxy.http.request.captured_headers", - "haproxy.http.request.raw_request_line", - "haproxy.http.request.time_wait_ms", - "haproxy.http.request.time_wait_without_data_ms", - "haproxy.http.response.captured_cookie", - "haproxy.http.response.captured_headers", - "haproxy.mode", - "haproxy.server_name", - "haproxy.server_queue", - "haproxy.source", - "haproxy.tcp.connection_waiting_time_ms", - "haproxy.termination_state", - "haproxy.time_backend_connect", - "haproxy.time_queue", - "haproxy.total_waiting_time_ms", - "hash.md5", - "hash.sha1", - "hash.sha256", - "hash.sha512", - "hid_bravura_monitor.instancename", - "hid_bravura_monitor.node", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.address", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.adminid", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.dbcommand", - "hid_bravura_monitor.perf.destination", - "hid_bravura_monitor.perf.duration", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.event", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.exe", - "hid_bravura_monitor.perf.file", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.function", - "hid_bravura_monitor.perf.kernel", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.kind", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.message", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.operation", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.receivequeue", - "hid_bravura_monitor.perf.records", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.result", - "hid_bravura_monitor.perf.rule", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sessionid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.sysid", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.table", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.targetid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.transid", - "hid_bravura_monitor.perf.type", - "hid_bravura_monitor.perf.user", - "hid_bravura_monitor.request.id", - "hid_bravura_monitor.request.id", - "host.architecture", - "host.containerized", - "host.domain", - "host.geo.city_name", - "host.geo.continent_name", - "host.geo.country_iso_code", - "host.geo.country_name", - "host.geo.location", - "host.geo.name", - "host.geo.region_iso_code", - "host.geo.region_name", - "host.hostname", - "host.id", - "host.ip", - "host.mac", - "host.name", - "host.os.build", - "host.os.codename", - "host.os.family", - "host.os.full", - "host.os.full.text", - "host.os.kernel", - "host.os.name", - "host.os.name.text", - "host.os.platform", - "host.os.version", - "host.type", - "host.uptime", - "host.user.domain", - "host.user.email", - "host.user.full_name", - "host.user.full_name.text", - "host.user.group.domain", - "host.user.group.id", - "host.user.group.name", - "host.user.hash", - "host.user.id", - "host.user.name", - "host.user.name.text", - "host.user.roles", - "http.request.body.bytes", - "http.request.body.content", - "http.request.body.content.text", - "http.request.bytes", - "http.request.method", - "http.request.mime_type", - "http.request.referrer", - "http.response.body.bytes", - "http.response.body.content", - "http.response.body.content.text", - "http.response.bytes", - "http.response.mime_type", - "http.response.status_code", - "http.version", - "icinga.debug.facility", - "icinga.main.facility", - "icinga.startup.facility", - "icmp.code", - "icmp.type", - "igmp.type", - "iis.access.cookie", - "iis.access.server_name", - "iis.access.site_name", - "iis.access.sub_status", - "iis.access.win32_status", - "iis.error.queue_name", - "iis.error.reason_phrase", - "input.type", - "interface.alias", - "interface.id", - "interface.name", - "jolokia.agent.id", - "jolokia.agent.version", - "jolokia.secured", - "jolokia.server.product", - "jolokia.server.vendor", - "jolokia.server.version", - "jolokia.url", - "kafka.block_timestamp", - "kafka.key", - "kafka.log.class", - "kafka.log.component", - "kafka.log.thread", - "kafka.log.trace.class", - "kafka.log.trace.message", - "kafka.offset", - "kafka.partition", - "kafka.topic", - "kibana.add_to_spaces", - "kibana.authentication_provider", - "kibana.authentication_realm", - "kibana.authentication_type", - "kibana.delete_from_spaces", - "kibana.log.state", - "kibana.log.tags", - "kibana.lookup_realm", - "kibana.saved_object.id", - "kibana.saved_object.type", - "kibana.session_id", - "kibana.space_id", - "kubernetes.container.image", - "kubernetes.container.name", - "kubernetes.deployment.name", - "kubernetes.namespace", - "kubernetes.node.hostname", - "kubernetes.node.name", - "kubernetes.pod.name", - "kubernetes.pod.uid", - "kubernetes.replicaset.name", - "kubernetes.statefulset.name", - "log.file.path", - "log.flags", - "log.level", - "log.logger", - "log.offset", - "log.origin.file.line", - "log.origin.file.name", - "log.origin.function", - "log.original", - "log.source.address", - "log.syslog.facility.code", - "log.syslog.facility.name", - "log.syslog.priority", - "log.syslog.severity.code", - "log.syslog.severity.name", - "logstash.log.integration", - "logstash.log.pipeline_id", - "logstash.log.thread", - "logstash.log.thread.text", - "logstash.slowlog.event", - "logstash.slowlog.event.text", - "logstash.slowlog.integration", - "logstash.slowlog.plugin_name", - "logstash.slowlog.plugin_params", - "logstash.slowlog.plugin_params.text", - "logstash.slowlog.plugin_type", - "logstash.slowlog.thread", - "logstash.slowlog.thread.text", - "logstash.slowlog.took_in_millis", - "message", - "mongodb.log.component", - "mongodb.log.context", - "mysql.slowlog.bytes_received", - "mysql.slowlog.bytes_sent", - "mysql.slowlog.current_user", - "mysql.slowlog.filesort", - "mysql.slowlog.filesort_on_disk", - "mysql.slowlog.full_join", - "mysql.slowlog.full_scan", - "mysql.slowlog.innodb.io_r_bytes", - "mysql.slowlog.innodb.io_r_ops", - "mysql.slowlog.innodb.io_r_wait.sec", - "mysql.slowlog.innodb.pages_distinct", - "mysql.slowlog.innodb.queue_wait.sec", - "mysql.slowlog.innodb.rec_lock_wait.sec", - "mysql.slowlog.innodb.trx_id", - "mysql.slowlog.killed", - "mysql.slowlog.last_errno", - "mysql.slowlog.lock_time.sec", - "mysql.slowlog.log_slow_rate_limit", - "mysql.slowlog.log_slow_rate_type", - "mysql.slowlog.merge_passes", - "mysql.slowlog.priority_queue", - "mysql.slowlog.query", - "mysql.slowlog.query_cache_hit", - "mysql.slowlog.read_first", - "mysql.slowlog.read_key", - "mysql.slowlog.read_last", - "mysql.slowlog.read_next", - "mysql.slowlog.read_prev", - "mysql.slowlog.read_rnd", - "mysql.slowlog.read_rnd_next", - "mysql.slowlog.rows_affected", - "mysql.slowlog.rows_examined", - "mysql.slowlog.rows_sent", - "mysql.slowlog.schema", - "mysql.slowlog.sort_merge_passes", - "mysql.slowlog.sort_range_count", - "mysql.slowlog.sort_rows", - "mysql.slowlog.sort_scan_count", - "mysql.slowlog.tmp_disk_tables", - "mysql.slowlog.tmp_table", - "mysql.slowlog.tmp_table_on_disk", - "mysql.slowlog.tmp_table_sizes", - "mysql.slowlog.tmp_tables", - "mysql.thread_id", - "nats.log.client.id", - "nats.log.msg.bytes", - "nats.log.msg.error.message", - "nats.log.msg.max_messages", - "nats.log.msg.queue_group", - "nats.log.msg.reply_to", - "nats.log.msg.sid", - "nats.log.msg.subject", - "nats.log.msg.type", - "network.application", - "network.bytes", - "network.community_id", - "network.direction", - "network.forwarded_ip", - "network.iana_number", - "network.inner.vlan.id", - "network.inner.vlan.name", - "network.name", - "network.packets", - "network.protocol", - "network.transport", - "network.type", - "network.vlan.id", - "network.vlan.name", - "nginx.error.connection_id", - "nginx.ingress_controller.http.request.id", - "nginx.ingress_controller.http.request.length", - "nginx.ingress_controller.http.request.time", - "nginx.ingress_controller.upstream.alternative_name", - "nginx.ingress_controller.upstream.ip", - "nginx.ingress_controller.upstream.name", - "nginx.ingress_controller.upstream.port", - "nginx.ingress_controller.upstream.response.length", - "nginx.ingress_controller.upstream.response.length_list", - "nginx.ingress_controller.upstream.response.status_code", - "nginx.ingress_controller.upstream.response.status_code_list", - "nginx.ingress_controller.upstream.response.time", - "nginx.ingress_controller.upstream.response.time_list", - "nginx.ingress_controller.upstream_address_list", - "observer.egress.interface.alias", - "observer.egress.interface.id", - "observer.egress.interface.name", - "observer.egress.vlan.id", - "observer.egress.vlan.name", - "observer.egress.zone", - "observer.geo.city_name", - "observer.geo.continent_name", - "observer.geo.country_iso_code", - "observer.geo.country_name", - "observer.geo.location", - "observer.geo.name", - "observer.geo.region_iso_code", - "observer.geo.region_name", - "observer.hostname", - "observer.ingress.interface.alias", - "observer.ingress.interface.id", - "observer.ingress.interface.name", - "observer.ingress.vlan.id", - "observer.ingress.vlan.name", - "observer.ingress.zone", - "observer.ip", - "observer.mac", - "observer.name", - "observer.os.family", - "observer.os.full", - "observer.os.full.text", - "observer.os.kernel", - "observer.os.name", - "observer.os.name.text", - "observer.os.platform", - "observer.os.version", - "observer.product", - "observer.serial_number", - "observer.type", - "observer.vendor", - "observer.version", - "organization.id", - "organization.name", - "organization.name.text", - "os.family", - "os.full", - "os.full.text", - "os.kernel", - "os.name", - "os.name.text", - "os.platform", - "os.version", - "osquery.result.action", - "osquery.result.calendar_time", - "osquery.result.host_identifier", - "osquery.result.name", - "osquery.result.unix_time", - "package.architecture", - "package.build_version", - "package.checksum", - "package.description", - "package.install_scope", - "package.installed", - "package.license", - "package.name", - "package.path", - "package.reference", - "package.size", - "package.type", - "package.version", - "pe.architecture", - "pe.company", - "pe.description", - "pe.file_version", - "pe.imphash", - "pe.original_file_name", - "pe.product", - "postgresql.log.core_id", - "postgresql.log.database", - "postgresql.log.error.code", - "postgresql.log.query", - "postgresql.log.query_name", - "postgresql.log.query_step", - "postgresql.log.timestamp", - "process.args", - "process.args_count", - "process.code_signature.exists", - "process.code_signature.status", - "process.code_signature.subject_name", - "process.code_signature.trusted", - "process.code_signature.valid", - "process.command_line", - "process.command_line.text", - "process.entity_id", - "process.executable", - "process.executable.text", - "process.exit_code", - "process.hash.md5", - "process.hash.sha1", - "process.hash.sha256", - "process.hash.sha512", - "process.name", - "process.name.text", - "process.parent.args", - "process.parent.args_count", - "process.parent.code_signature.exists", - "process.parent.code_signature.status", - "process.parent.code_signature.subject_name", - "process.parent.code_signature.trusted", - "process.parent.code_signature.valid", - "process.parent.command_line", - "process.parent.command_line.text", - "process.parent.entity_id", - "process.parent.executable", - "process.parent.executable.text", - "process.parent.exit_code", - "process.parent.hash.md5", - "process.parent.hash.sha1", - "process.parent.hash.sha256", - "process.parent.hash.sha512", - "process.parent.name", - "process.parent.name.text", - "process.parent.pe.architecture", - "process.parent.pe.company", - "process.parent.pe.description", - "process.parent.pe.file_version", - "process.parent.pe.imphash", - "process.parent.pe.original_file_name", - "process.parent.pe.product", - "process.parent.pgid", - "process.parent.pid", - "process.parent.ppid", - "process.parent.start", - "process.parent.thread.id", - "process.parent.thread.name", - "process.parent.title", - "process.parent.title.text", - "process.parent.uptime", - "process.parent.working_directory", - "process.parent.working_directory.text", - "process.pe.architecture", - "process.pe.company", - "process.pe.description", - "process.pe.file_version", - "process.pe.imphash", - "process.pe.original_file_name", - "process.pe.product", - "process.pgid", - "process.pid", - "process.ppid", - "process.program", - "process.start", - "process.thread.id", - "process.thread.name", - "process.title", - "process.title.text", - "process.uptime", - "process.working_directory", - "process.working_directory.text", - "redis.log.role", - "redis.slowlog.args", - "redis.slowlog.cmd", - "redis.slowlog.duration.us", - "redis.slowlog.id", - "redis.slowlog.key", - "registry.data.bytes", - "registry.data.strings", - "registry.data.type", - "registry.hive", - "registry.key", - "registry.path", - "registry.value", - "related.hash", - "related.hosts", - "related.ip", - "related.user", - "rule.author", - "rule.category", - "rule.description", - "rule.id", - "rule.license", - "rule.name", - "rule.reference", - "rule.ruleset", - "rule.uuid", - "rule.version", - "santa.action", - "santa.certificate.common_name", - "santa.certificate.sha256", - "santa.decision", - "santa.disk.bsdname", - "santa.disk.bus", - "santa.disk.fs", - "santa.disk.model", - "santa.disk.mount", - "santa.disk.serial", - "santa.disk.volume", - "santa.mode", - "santa.reason", - "server.address", - "server.as.number", - "server.as.organization.name", - "server.as.organization.name.text", - "server.bytes", - "server.domain", - "server.geo.city_name", - "server.geo.continent_name", - "server.geo.country_iso_code", - "server.geo.country_name", - "server.geo.location", - "server.geo.name", - "server.geo.region_iso_code", - "server.geo.region_name", - "server.ip", - "server.mac", - "server.nat.ip", - "server.nat.port", - "server.packets", - "server.port", - "server.registered_domain", - "server.subdomain", - "server.top_level_domain", - "server.user.domain", - "server.user.email", - "server.user.full_name", - "server.user.full_name.text", - "server.user.group.domain", - "server.user.group.id", - "server.user.group.name", - "server.user.hash", - "server.user.id", - "server.user.name", - "server.user.name.text", - "server.user.roles", - "service.ephemeral_id", - "service.id", - "service.name", - "service.node.name", - "service.state", - "service.type", - "service.version", - "source.address", - "source.as.number", - "source.as.organization.name", - "source.as.organization.name.text", - "source.bytes", - "source.domain", - "source.geo.city_name", - "source.geo.continent_name", - "source.geo.country_iso_code", - "source.geo.country_name", - "source.geo.location", - "source.geo.name", - "source.geo.region_iso_code", - "source.geo.region_name", - "source.ip", - "source.mac", - "source.nat.ip", - "source.nat.port", - "source.packets", - "source.port", - "source.registered_domain", - "source.subdomain", - "source.top_level_domain", - "source.user.domain", - "source.user.email", - "source.user.full_name", - "source.user.full_name.text", - "source.user.group.domain", - "source.user.group.id", - "source.user.group.name", - "source.user.hash", - "source.user.id", - "source.user.name", - "source.user.name.text", - "source.user.roles", - "span.id", - "stream", - "syslog.facility", - "syslog.facility_label", - "syslog.priority", - "syslog.severity_label", - "system.auth.ssh.dropped_ip", - "system.auth.ssh.event", - "system.auth.ssh.method", - "system.auth.ssh.signature", - "system.auth.sudo.command", - "system.auth.sudo.error", - "system.auth.sudo.pwd", - "system.auth.sudo.tty", - "system.auth.sudo.user", - "system.auth.useradd.home", - "system.auth.useradd.shell", - "tags", - "threat.framework", - "threat.tactic.id", - "threat.tactic.name", - "threat.tactic.reference", - "threat.technique.id", - "threat.technique.name", - "threat.technique.name.text", - "threat.technique.reference", - "threat.technique.subtechnique.id", - "threat.technique.subtechnique.name", - "threat.technique.subtechnique.name.text", - "threat.technique.subtechnique.reference", - "timeseries.instance", - "tls.cipher", - "tls.client.certificate", - "tls.client.certificate_chain", - "tls.client.hash.md5", - "tls.client.hash.sha1", - "tls.client.hash.sha256", - "tls.client.issuer", - "tls.client.ja3", - "tls.client.not_after", - "tls.client.not_before", - "tls.client.server_name", - "tls.client.subject", - "tls.client.supported_ciphers", - "tls.client.x509.alternative_names", - "tls.client.x509.issuer.common_name", - "tls.client.x509.issuer.country", - "tls.client.x509.issuer.distinguished_name", - "tls.client.x509.issuer.locality", - "tls.client.x509.issuer.organization", - "tls.client.x509.issuer.organizational_unit", - "tls.client.x509.issuer.state_or_province", - "tls.client.x509.not_after", - "tls.client.x509.not_before", - "tls.client.x509.public_key_algorithm", - "tls.client.x509.public_key_curve", - "tls.client.x509.public_key_exponent", - "tls.client.x509.public_key_size", - "tls.client.x509.serial_number", - "tls.client.x509.signature_algorithm", - "tls.client.x509.subject.common_name", - "tls.client.x509.subject.country", - "tls.client.x509.subject.distinguished_name", - "tls.client.x509.subject.locality", - "tls.client.x509.subject.organization", - "tls.client.x509.subject.organizational_unit", - "tls.client.x509.subject.state_or_province", - "tls.client.x509.version_number", - "tls.curve", - "tls.established", - "tls.next_protocol", - "tls.resumed", - "tls.server.certificate", - "tls.server.certificate_chain", - "tls.server.hash.md5", - "tls.server.hash.sha1", - "tls.server.hash.sha256", - "tls.server.issuer", - "tls.server.ja3s", - "tls.server.not_after", - "tls.server.not_before", - "tls.server.subject", - "tls.server.x509.alternative_names", - "tls.server.x509.issuer.common_name", - "tls.server.x509.issuer.country", - "tls.server.x509.issuer.distinguished_name", - "tls.server.x509.issuer.locality", - "tls.server.x509.issuer.organization", - "tls.server.x509.issuer.organizational_unit", - "tls.server.x509.issuer.state_or_province", - "tls.server.x509.not_after", - "tls.server.x509.not_before", - "tls.server.x509.public_key_algorithm", - "tls.server.x509.public_key_curve", - "tls.server.x509.public_key_exponent", - "tls.server.x509.public_key_size", - "tls.server.x509.serial_number", - "tls.server.x509.signature_algorithm", - "tls.server.x509.subject.common_name", - "tls.server.x509.subject.country", - "tls.server.x509.subject.distinguished_name", - "tls.server.x509.subject.locality", - "tls.server.x509.subject.organization", - "tls.server.x509.subject.organizational_unit", - "tls.server.x509.subject.state_or_province", - "tls.server.x509.version_number", - "tls.version", - "tls.version_protocol", - "trace.id", - "traefik.access.backend_url", - "traefik.access.frontend_name", - "traefik.access.geoip.city_name", - "traefik.access.geoip.continent_name", - "traefik.access.geoip.country_iso_code", - "traefik.access.geoip.location", - "traefik.access.geoip.region_iso_code", - "traefik.access.geoip.region_name", - "traefik.access.request_count", - "traefik.access.user_agent.device", - "traefik.access.user_agent.name", - "traefik.access.user_agent.original", - "traefik.access.user_agent.os", - "traefik.access.user_agent.os_name", - "traefik.access.user_identifier", - "transaction.id", - "url.domain", - "url.extension", - "url.fragment", - "url.full", - "url.full.text", - "url.original", - "url.original.text", - "url.password", - "url.path", - "url.port", - "url.query", - "url.registered_domain", - "url.scheme", - "url.subdomain", - "url.top_level_domain", - "url.username", - "user.audit.group.id", - "user.audit.group.name", - "user.audit.id", - "user.audit.name", - "user.domain", - "user.effective.group.id", - "user.effective.group.name", - "user.effective.id", - "user.effective.name", - "user.email", - "user.filesystem.group.id", - "user.filesystem.group.name", - "user.filesystem.id", - "user.filesystem.name", - "user.full_name", - "user.full_name.text", - "user.group.domain", - "user.group.id", - "user.group.name", - "user.hash", - "user.id", - "user.name", - "user.name.text", - "user.owner.group.id", - "user.owner.group.name", - "user.owner.id", - "user.owner.name", - "user.roles", - "user.saved.group.id", - "user.saved.group.name", - "user.saved.id", - "user.saved.name", - "user.terminal", - "user_agent.device.name", - "user_agent.name", - "user_agent.original", - "user_agent.original.text", - "user_agent.os.family", - "user_agent.os.full", - "user_agent.os.full.text", - "user_agent.os.full_name", - "user_agent.os.kernel", - "user_agent.os.name", - "user_agent.os.name.text", - "user_agent.os.platform", - "user_agent.os.version", - "user_agent.version", - "vlan.id", - "vlan.name", - "vulnerability.category", - "vulnerability.classification", - "vulnerability.description", - "vulnerability.description.text", - "vulnerability.enumeration", - "vulnerability.id", - "vulnerability.reference", - "vulnerability.report_id", - "vulnerability.scanner.vendor", - "vulnerability.score.base", - "vulnerability.score.environmental", - "vulnerability.score.temporal", - "vulnerability.score.version", - "vulnerability.severity", - "x509.alternative_names", - "x509.issuer.common_name", - "x509.issuer.country", - "x509.issuer.distinguished_name", - "x509.issuer.locality", - "x509.issuer.organization", - "x509.issuer.organizational_unit", - "x509.issuer.state_or_province", - "x509.not_after", - "x509.not_before", - "x509.public_key_algorithm", - "x509.public_key_curve", - "x509.public_key_exponent", - "x509.public_key_size", - "x509.serial_number", - "x509.signature_algorithm", - "x509.subject.common_name", - "x509.subject.country", - "x509.subject.distinguished_name", - "x509.subject.locality", - "x509.subject.organization", - "x509.subject.organizational_unit", - "x509.subject.state_or_province", - "x509.version_number" - ], - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "hid_bravura_monitor.perf.kind", - "negate": false, - "params": { - "query": "PerfPsupdate" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "hid_bravura_monitor.perf.kind": "PerfPsupdate" - } - } - } - ], - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "PerfPsupdate", - "version": 1 - }, - "coreMigrationVersion": "7.15.0", - "id": "hid_bravura_monitor-dd637750-1473-11eb-bb7b-bb041e8cf289", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/hid_bravura_monitor/kibana/tags.yml b/packages/hid_bravura_monitor/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/hid_bravura_monitor/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/hid_bravura_monitor/manifest.yml b/packages/hid_bravura_monitor/manifest.yml index c3112546d62..b0b9e47accb 100644 --- a/packages/hid_bravura_monitor/manifest.yml +++ b/packages/hid_bravura_monitor/manifest.yml @@ -1,8 +1,7 @@ name: hid_bravura_monitor title: Bravura Monitor -version: "1.8.0" +version: "1.12.0" categories: ["security", "iam"] -release: ga description: Collect logs from Bravura Security Fabric with Elastic Agent. type: integration icons: @@ -12,7 +11,7 @@ icons: type: image/svg+xml conditions: kibana: - version: ^8.1.0 + version: ^8.7.1 screenshots: - src: /img/kibana-hid_bravura_monitor-overview.png title: Kibana Bravura Monitor overview @@ -36,8 +35,8 @@ screenshots: type: image/png owner: github: elastic/security-external-integrations -format_version: 1.0.0 -license: basic + type: elastic +format_version: "3.0.0" policy_templates: - name: hid_bravura_monitor title: Bravura Monitor logs diff --git a/packages/http_endpoint/_dev/build/build.yml b/packages/http_endpoint/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/http_endpoint/_dev/build/build.yml +++ b/packages/http_endpoint/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/http_endpoint/changelog.yml b/packages/http_endpoint/changelog.yml index 8ca0fca1afe..11ef3017850 100644 --- a/packages/http_endpoint/changelog.yml +++ b/packages/http_endpoint/changelog.yml @@ -1,3 +1,18 @@ +- version: 1.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.9.1" changes: - description: Fix handling of include header config. diff --git a/packages/http_endpoint/kibana/tags.yml b/packages/http_endpoint/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/http_endpoint/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/http_endpoint/manifest.yml b/packages/http_endpoint/manifest.yml index 68b0a6629f8..43d6e0d9cfb 100644 --- a/packages/http_endpoint/manifest.yml +++ b/packages/http_endpoint/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: http_endpoint title: Custom HTTP Endpoint Logs description: Collect JSON data from listening HTTP port with Elastic Agent. type: integration -version: "1.9.1" +version: "1.12.0" conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" categories: - custom - observability @@ -22,3 +23,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/httpjson/_dev/build/build.yml b/packages/httpjson/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/httpjson/_dev/build/build.yml +++ b/packages/httpjson/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/httpjson/changelog.yml b/packages/httpjson/changelog.yml index d9f172956e5..db03fb8fb70 100644 --- a/packages/httpjson/changelog.yml +++ b/packages/httpjson/changelog.yml @@ -1,3 +1,18 @@ +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.12.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/httpjson/kibana/tags.yml b/packages/httpjson/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/httpjson/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/httpjson/manifest.yml b/packages/httpjson/manifest.yml index 07cc274fd9a..2abd5c88bb5 100644 --- a/packages/httpjson/manifest.yml +++ b/packages/httpjson/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: httpjson title: Custom API description: Collect custom events from an API endpoint with Elastic agent type: integration -version: "1.12.0" +version: "1.15.0" conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" categories: - custom policy_templates: @@ -18,3 +19,4 @@ policy_templates: description: Collect custom data from REST API's owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ibmmq/_dev/build/docs/README.md b/packages/ibmmq/_dev/build/docs/README.md index 6c2f36599c1..6a73e27e6ef 100755 --- a/packages/ibmmq/_dev/build/docs/README.md +++ b/packages/ibmmq/_dev/build/docs/README.md @@ -4,7 +4,8 @@ The IBM MQ Integration is used to fetch observability data from [IBM MQ web endp ## Compatibility -This integration has been tested against `IBM MQ v9.1` and `IBM MQ v9.2`. +This integration has been tested against `IBM MQ v9.1` and `IBM MQ v9.2`. The ibmmq `qmgr` data stream is compatible with a containerized distribution of IBM MQ (since version 9.1.0). +The Docker image starts the `runmqserver` process, which spawns the HTTP server exposing metrics in Prometheus format. ## Requirements diff --git a/packages/ibmmq/_dev/deploy/docker/docker-compose.yml b/packages/ibmmq/_dev/deploy/docker/docker-compose.yml index 1e280076a82..5307630253a 100755 --- a/packages/ibmmq/_dev/deploy/docker/docker-compose.yml +++ b/packages/ibmmq/_dev/deploy/docker/docker-compose.yml @@ -1,7 +1,7 @@ version: '2.3' services: ibmmq: - image: ibmcom/mq:${SERVICE_VERSION:-v9.2.4.0-r1-amd64} + image: ibmcom/mq:${SERVICE_VERSION:-9.2.4.0-r1-amd64} environment: - LICENSE=accept - MQ_QMGR_NAME=QM1 diff --git a/packages/ibmmq/changelog.yml b/packages/ibmmq/changelog.yml index 53e4e0a1775..3b6d397ca0f 100755 --- a/packages/ibmmq/changelog.yml +++ b/packages/ibmmq/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.2.2" + changes: + - description: Update the docker image. + type: bugfix + link: https://github.com/elastic/integrations/pull/7754 +- version: "1.2.1" + changes: + - description: Update description for compatibility + type: enhancement + link: https://github.com/elastic/integrations/pull/6928 - version: "1.2.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/ibmmq/docs/README.md b/packages/ibmmq/docs/README.md index 47d196f7035..6d47169f37b 100755 --- a/packages/ibmmq/docs/README.md +++ b/packages/ibmmq/docs/README.md @@ -4,7 +4,8 @@ The IBM MQ Integration is used to fetch observability data from [IBM MQ web endp ## Compatibility -This integration has been tested against `IBM MQ v9.1` and `IBM MQ v9.2`. +This integration has been tested against `IBM MQ v9.1` and `IBM MQ v9.2`. The ibmmq `qmgr` data stream is compatible with a containerized distribution of IBM MQ (since version 9.1.0). +The Docker image starts the `runmqserver` process, which spawns the HTTP server exposing metrics in Prometheus format. ## Requirements diff --git a/packages/ibmmq/manifest.yml b/packages/ibmmq/manifest.yml index a1b6a2cee7a..3c10916a00e 100755 --- a/packages/ibmmq/manifest.yml +++ b/packages/ibmmq/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: ibmmq title: IBM MQ -version: "1.2.0" +version: "1.2.2" license: basic description: Collect logs and metrics from IBM MQ with Elastic Agent. type: integration diff --git a/packages/iis/_dev/build/docs/README.md b/packages/iis/_dev/build/docs/README.md index c7c6b0836f7..4892fb28f3a 100644 --- a/packages/iis/_dev/build/docs/README.md +++ b/packages/iis/_dev/build/docs/README.md @@ -1,6 +1,6 @@ # IIS (Internet Information Services) integration -IIS (Internet Information Services) is a secure, reliable, and scalable Web server that provides an easy to manage platform for developing and hosting Web applications and services. For more information, see: [IIS Logging](https://docs.microsoft.com/en-us/windows/win32/http/iis-logging). +IIS (Internet Information Services) is a secure, reliable, and scalable Web server that provides an easy to manage platform for developing and hosting Web applications and services. For more information, see: [IIS Logging](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis). The `iis` package will periodically retrieve IIS related metrics using performance counters such as: @@ -48,7 +48,29 @@ The fields reported are: The IIS module has been tested with logs from version 7.5, 8 and version 10. ### access -This dataset will collect and parse access IIS logs. The supported log format is IIS (W3C). +This dataset will collect and parse access IIS logs. The supported log format is W3C. The W3C log format is customizable with different fields. + +The IIS ships logs with few fields by default and if the user is interested in customizing the selection, the IIS Manager provides ability to add new fields for logging. + +IIS integration offers certain field combinations shipped automatically into Elasticsearch using ingest pipelines. The supported formats are listed below, + +#### Default Logging: + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken + +#### Custom Logging: + + - Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status time-taken + + - Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(cookie) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(cookie) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken {{event "access"}} diff --git a/packages/iis/changelog.yml b/packages/iis/changelog.yml index 59e0735a4a3..e92a353b13b 100644 --- a/packages/iis/changelog.yml +++ b/packages/iis/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.15.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.15.0" + changes: + - description: Add ability to set condition for logs and metrics. + type: enhancement + link: https://github.com/elastic/integrations/pull/7372 +- version: "1.14.0" + changes: + - description: Update document with supported ingest patterns for access_log + type: enhancement + link: https://github.com/elastic/integrations/pull/6892 - version: "1.13.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/iis/data_stream/access/_dev/test/pipeline/test-iis-access-75.log-expected.json b/packages/iis/data_stream/access/_dev/test/pipeline/test-iis-access-75.log-expected.json index 4afcb546889..7b9e823d892 100644 --- a/packages/iis/data_stream/access/_dev/test/pipeline/test-iis-access-75.log-expected.json +++ b/packages/iis/data_stream/access/_dev/test/pipeline/test-iis-access-75.log-expected.json @@ -3,10 +3,7 @@ { "@timestamp": "2018-08-28T18:24:25.000Z", "destination": { - "address": [ - "10.100.220.70", - "10.100.220.70" - ], + "address": "10.100.220.70", "port": 80 }, "ecs": { @@ -36,10 +33,7 @@ } }, "source": { - "address": [ - "10.100.118.31", - "10.100.118.31" - ] + "address": "10.100.118.31" }, "tags": [ "preserve_original_event" diff --git a/packages/iis/data_stream/access/agent/stream/log.yml.hbs b/packages/iis/data_stream/access/agent/stream/log.yml.hbs index 94600962348..5c89731d8fc 100644 --- a/packages/iis/data_stream/access/agent/stream/log.yml.hbs +++ b/packages/iis/data_stream/access/agent/stream/log.yml.hbs @@ -20,4 +20,7 @@ exclude_lines: ["^#"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/iis/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/iis/data_stream/access/elasticsearch/ingest_pipeline/default.yml index c8138621789..700b7567cad 100644 --- a/packages/iis/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/iis/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -9,6 +9,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original ignore_missing: true @@ -172,6 +173,48 @@ processors: field: event.outcome value: failure if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400" + - script: + lang: painless + description: | + This script processor handles ctx.source[field] as per grok changes in ES 8.7+. + Read more: https://github.com/elastic/integrations/issues/6016 + source: | + for (field in params.fields) { + if (ctx.source[field] instanceof List) { + def vals = ctx.source[field]; + vals = vals.stream().distinct().collect(Collectors.toList()); + if (vals.size() == 1) { + ctx.source[field] = vals[0] + } else { + ctx.source[field] = vals + } + } + } + if: "ctx?.source != null" + params: + fields: + - "address" + - script: + lang: painless + description: | + This script processor handles ctx.destination[field] as per grok changes in ES 8.7+. + Read more: https://github.com/elastic/integrations/issues/6016 + source: | + for (field in params.fields) { + if (ctx.destination[field] instanceof List) { + def vals = ctx.destination[field]; + vals = vals.stream().distinct().collect(Collectors.toList()); + if (vals.size() == 1) { + ctx.destination[field] = vals[0] + } else { + ctx.destination[field] = vals + } + } + } + if: "ctx?.destination != null" + params: + fields: + - "address" - script: lang: painless description: This script processor iterates over the whole document to remove fields with null values. diff --git a/packages/iis/data_stream/application_pool/agent/stream/stream.yml.hbs b/packages/iis/data_stream/application_pool/agent/stream/stream.yml.hbs index 30f418ffde2..88c7ca17ec7 100644 --- a/packages/iis/data_stream/application_pool/agent/stream/stream.yml.hbs +++ b/packages/iis/data_stream/application_pool/agent/stream/stream.yml.hbs @@ -5,4 +5,7 @@ application_pool.name:: {{#each name as |app_pool_name i|}} - {{app_pool_name}} {{/each}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/iis/data_stream/application_pool/fields/agent.yml b/packages/iis/data_stream/application_pool/fields/agent.yml index 93773a936e2..b0461bdf77e 100644 --- a/packages/iis/data_stream/application_pool/fields/agent.yml +++ b/packages/iis/data_stream/application_pool/fields/agent.yml @@ -210,4 +210,4 @@ - name: id type: keyword ignore_above: 1024 - dimension: true \ No newline at end of file + dimension: true diff --git a/packages/iis/data_stream/application_pool/manifest.yml b/packages/iis/data_stream/application_pool/manifest.yml index e6bc177be3a..6474461a12b 100644 --- a/packages/iis/data_stream/application_pool/manifest.yml +++ b/packages/iis/data_stream/application_pool/manifest.yml @@ -12,4 +12,4 @@ streams: required: false show_user: true elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/iis/data_stream/error/agent/stream/log.yml.hbs b/packages/iis/data_stream/error/agent/stream/log.yml.hbs index 94600962348..5c89731d8fc 100644 --- a/packages/iis/data_stream/error/agent/stream/log.yml.hbs +++ b/packages/iis/data_stream/error/agent/stream/log.yml.hbs @@ -20,4 +20,7 @@ exclude_lines: ["^#"] {{#if processors}} processors: {{processors}} +{{/if}} +{{#if condition}} +condition: {{ condition }} {{/if}} \ No newline at end of file diff --git a/packages/iis/data_stream/error/elasticsearch/ingest_pipeline/default.yml b/packages/iis/data_stream/error/elasticsearch/ingest_pipeline/default.yml index 7ebca59cfbe..ebd08cf40bc 100644 --- a/packages/iis/data_stream/error/elasticsearch/ingest_pipeline/default.yml +++ b/packages/iis/data_stream/error/elasticsearch/ingest_pipeline/default.yml @@ -8,6 +8,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/iis/data_stream/webserver/agent/stream/stream.yml.hbs b/packages/iis/data_stream/webserver/agent/stream/stream.yml.hbs index 2013dc06bf1..a425b2b8af5 100644 --- a/packages/iis/data_stream/webserver/agent/stream/stream.yml.hbs +++ b/packages/iis/data_stream/webserver/agent/stream/stream.yml.hbs @@ -1,2 +1,5 @@ metricsets: ["webserver"] period: {{period}} +{{#if condition}} +condition: {{ condition }} +{{/if}} \ No newline at end of file diff --git a/packages/iis/data_stream/webserver/fields/agent.yml b/packages/iis/data_stream/webserver/fields/agent.yml index 93773a936e2..b0461bdf77e 100644 --- a/packages/iis/data_stream/webserver/fields/agent.yml +++ b/packages/iis/data_stream/webserver/fields/agent.yml @@ -210,4 +210,4 @@ - name: id type: keyword ignore_above: 1024 - dimension: true \ No newline at end of file + dimension: true diff --git a/packages/iis/data_stream/webserver/manifest.yml b/packages/iis/data_stream/webserver/manifest.yml index 38d51de6aca..49b6b8f64ec 100644 --- a/packages/iis/data_stream/webserver/manifest.yml +++ b/packages/iis/data_stream/webserver/manifest.yml @@ -5,4 +5,4 @@ streams: title: IIS web server metrics description: Collect IIS web server metrics elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/iis/data_stream/website/agent/stream/stream.yml.hbs b/packages/iis/data_stream/website/agent/stream/stream.yml.hbs index 288efb1386b..d205141cd88 100644 --- a/packages/iis/data_stream/website/agent/stream/stream.yml.hbs +++ b/packages/iis/data_stream/website/agent/stream/stream.yml.hbs @@ -1,2 +1,5 @@ metricsets: ["website"] period: {{period}} +{{#if condition}} +condition: {{ condition }} +{{/if}} \ No newline at end of file diff --git a/packages/iis/data_stream/website/fields/agent.yml b/packages/iis/data_stream/website/fields/agent.yml index 93773a936e2..b0461bdf77e 100644 --- a/packages/iis/data_stream/website/fields/agent.yml +++ b/packages/iis/data_stream/website/fields/agent.yml @@ -210,4 +210,4 @@ - name: id type: keyword ignore_above: 1024 - dimension: true \ No newline at end of file + dimension: true diff --git a/packages/iis/data_stream/website/manifest.yml b/packages/iis/data_stream/website/manifest.yml index df6b52d41d1..badfd98f902 100644 --- a/packages/iis/data_stream/website/manifest.yml +++ b/packages/iis/data_stream/website/manifest.yml @@ -5,4 +5,4 @@ streams: title: IIS website metrics description: Collect IIS website metrics elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/iis/docs/README.md b/packages/iis/docs/README.md index 05f8ef8a23a..58f86da9856 100644 --- a/packages/iis/docs/README.md +++ b/packages/iis/docs/README.md @@ -1,6 +1,6 @@ # IIS (Internet Information Services) integration -IIS (Internet Information Services) is a secure, reliable, and scalable Web server that provides an easy to manage platform for developing and hosting Web applications and services. For more information, see: [IIS Logging](https://docs.microsoft.com/en-us/windows/win32/http/iis-logging). +IIS (Internet Information Services) is a secure, reliable, and scalable Web server that provides an easy to manage platform for developing and hosting Web applications and services. For more information, see: [IIS Logging](https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis). The `iis` package will periodically retrieve IIS related metrics using performance counters such as: @@ -433,7 +433,29 @@ The fields reported are: The IIS module has been tested with logs from version 7.5, 8 and version 10. ### access -This dataset will collect and parse access IIS logs. The supported log format is IIS (W3C). +This dataset will collect and parse access IIS logs. The supported log format is W3C. The W3C log format is customizable with different fields. + +The IIS ships logs with few fields by default and if the user is interested in customizing the selection, the IIS Manager provides ability to add new fields for logging. + +IIS integration offers certain field combinations shipped automatically into Elasticsearch using ingest pipelines. The supported formats are listed below, + +#### Default Logging: + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken + +#### Custom Logging: + + - Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status time-taken + + - Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(cookie) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken + + - Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(cookie) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes, cs-bytes time-taken An example event for `access` looks as following: diff --git a/packages/iis/manifest.yml b/packages/iis/manifest.yml index 33eac8934a6..d52fab4ecb4 100644 --- a/packages/iis/manifest.yml +++ b/packages/iis/manifest.yml @@ -1,6 +1,6 @@ name: iis title: IIS -version: "1.13.0" +version: "1.15.1" description: Collect logs and metrics from Internet Information Services (IIS) servers with Elastic Agent. type: integration icons: @@ -45,6 +45,14 @@ policy_templates: - type: "logfile" title: "Collect IIS access and error logs (input: log)" description: "Collecting access and error logs from IIS instances (input: log)" + vars: + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false - type: iis/metrics title: Collect IIS application_pool, webserver and website metrics description: Collecting application_pool, webserver and website metrics from IIS instances @@ -56,5 +64,12 @@ policy_templates: multi: false show_user: true default: 10s + - name: condition + title: Condition + description: Condition to filter when to collect this input. See [Dynamic Input Configuration](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html) for details. + type: text + multi: false + required: false + show_user: false owner: github: elastic/obs-infraobs-integrations diff --git a/packages/imperva/_dev/build/build.yml b/packages/imperva/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/imperva/_dev/build/build.yml +++ b/packages/imperva/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/imperva/changelog.yml b/packages/imperva/changelog.yml index 316af3b15b6..9b2066c5ca5 100644 --- a/packages/imperva/changelog.yml +++ b/packages/imperva/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "0.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/imperva/data_stream/securesphere/_dev/test/pipeline/test-generated.log-expected.json b/packages/imperva/data_stream/securesphere/_dev/test/pipeline/test-generated.log-expected.json index ce7d5b1c0a9..984255d0bdb 100644 --- a/packages/imperva/data_stream/securesphere/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/imperva/data_stream/securesphere/_dev/test/pipeline/test-generated.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.70.155.35,dstPort=892,dbUsername=tatno,srcIP=10.81.122.126,srcPort=4141,creatTime=29 January 2016 06:09:59,srvGroup=uam,service=untutl,appName=rad,event#=taliqu,eventType=Login,usrGroup=ommod,usrAuth=True,application=\"scivel\",osUsername=aqui,srcHost=radipis5408.mail.local,dbName=enatuse,schemaName=magn,bindVar=equuntu,sqlError=failure,respSize=5910,respTime=10.347000,affRows=sum,action=\"cancel\",rawQuery=\"sit\"", "tags": [ @@ -11,7 +11,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=nimadmin,createTime=2016-02-12 13:12:33,eventType=erep,eventSev=low,username=temq,subsystem=ugiatqu,message=\"eacomm\"", "tags": [ @@ -20,7 +20,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.58.116.231,dstPort=996,dbUsername=qua,srcIP=10.159.182.171,srcPort=3947,creatTime=2016-02-26 20:15:08,srvGroup=apariat,service=mol,appName=pteursi,event#=onse,eventType=rumet,usrGroup=oll,usrAuth=erc,application=\"taliqu\",osUsername=temUten,srcHost=ccusan7572.api.home,dbName=aveniam,schemaName=uradi,bindVar=nimadmin,sqlError=failure,respSize=3626,respTime=79.328000,affRows=ender,action=\"accept\",rawQuery=\"ehenderi\"", "tags": [ @@ -29,7 +29,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.232.27.250,dstPort=7838,dbUsername=mquidol,srcIP=10.18.124.28,srcPort=7668,creatTime=12 March 2016 03:17:42,srvGroup=rsitamet,service=lupt,appName=xea,event#=qua,eventType=Login,usrGroup=luptatev,usrAuth=False,application=\"admi\",osUsername=modocons,srcHost=elaudant5931.internal.invalid,dbName=lores,schemaName=lapariat,bindVar=eddoei,sqlError=failure,respSize=6564,respTime=87.496000,affRows=nimadmin,action=\"cancel\",rawQuery=\"xercitat\"", "tags": [ @@ -38,7 +38,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=ationemu,event#=ice,createTime=2016-03-26 10:20:16,updateTime=estiae,alertSev=high,group=laborum,ruleName=\"tionof\",evntDesc=\"snostrud\",category=nama,disposition=quisnos,eventType=ite,proto=icmp,srcPort=2707,srcIP=10.6.137.200,dstPort=5697,dstIP=10.197.250.10,policyName=\"bor\",occurrences=7243,httpHost=hitect,webMethod=dol,url=\"https://internal.example.net/namali/taevit.html?nsecte=itame#eumfug\",webQuery=\"lit\",soapAction=asun,resultCode=estia,sessionID=eaq,username=occae,addUsername=ctetura,responseTime=labore,responseSize=texp,direction=external,dbUsername=adeseru,queryGroup=emoe,application=\"eaq\",srcHost=amest4147.mail.host,osUsername=intoc,schemaName=oluptas,dbName=tNequepo,hdrName=lup,action=cancel", "tags": [ @@ -47,7 +47,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=sperna,event#=eabilloi,createTime=2016-04-09 17:22:51,updateTime=estia,alertSev=medium,group=tlab,ruleName=\"volupt\",evntDesc=\"osqui\",category=xerc,disposition=iutali,eventType=fdeFi,proto=igmp,srcPort=1696,srcIP=10.179.124.125,dstPort=5473,dstIP=10.36.194.106,policyName=\"eprehend\",occurrences=2462,httpHost=dutper,webMethod=lamcolab,url=\"https://example.net/tlabo/uames.gif?mpo=offi#giatnu\",webQuery=\"ulapa\",soapAction=liqui,resultCode=quioffi,sessionID=uptate,username=ncidid,addUsername=quaturve,responseTime=sequa,responseSize=aera,direction=outbound,dbUsername=rvel,queryGroup=uid,application=\"onsecte\",srcHost=eratv6205.internal.lan,osUsername=reme,schemaName=acommod,dbName=uaUteni,hdrName=udantium,action=accept", "tags": [ @@ -56,7 +56,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.129.149.43,dstPort=3304,dbUsername=eveli,srcIP=10.211.105.204,srcPort=2742,creatTime=2016-04-24 00:25:25,srvGroup=aliquide,service=ofde,appName=equat,event#=derit,eventType=Logout,usrGroup=dexea,usrAuth=True,application=\"atcu\",osUsername=labor,srcHost=didunt1355.corp,dbName=udan,schemaName=orema,bindVar=invento,sqlError=failure,respSize=6855,respTime=74.098000,affRows=nofdeFin,action=\"accept\",rawQuery=\"rau\"", "tags": [ @@ -65,7 +65,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.214.191.180,dstPort=5848,dbUsername=ipsumdol,srcIP=10.112.250.193,srcPort=5705,creatTime=2016-05-08 07:27:59,srvGroup=urerepr,service=ese,appName=isaute,event#=ptatemq,eventType=Logout,usrGroup=luptatev,usrAuth=False,application=\"tlabore\",osUsername=Exc,srcHost=pora6854.www5.home,dbName=nevo,schemaName=ide,bindVar=aali,sqlError=success,respSize=6852,respTime=49.573000,affRows=etcons,action=\"cancel\",rawQuery=\"tenbyCi\"", "tags": [ @@ -74,7 +74,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.251.20.13,dstPort=264,dbUsername=iquipe,srcIP=10.192.34.76,srcPort=1450,creatTime=2016-05-22 14:30:33,srvGroup=upida,service=tvolupt,appName=eufugi,event#=pici,eventType=abor,usrGroup=utpe,usrAuth=onsequ,application=\"temqu\",osUsername=ovol,srcHost=ptasn6599.www.localhost,dbName=lore,schemaName=tnonpro,bindVar=ionemu,sqlError=success,respSize=3645,respTime=20.909000,affRows=tanimid,action=\"deny\",rawQuery=\"uamni\"", "tags": [ @@ -83,7 +83,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.74.105.218,dstPort=2438,dbUsername=archite,srcIP=10.59.138.212,srcPort=7829,creatTime=2016-06-05 21:33:08,srvGroup=asi,service=datatno,appName=siutali,event#=amnih,eventType=Logout,usrGroup=ium,usrAuth=True,application=\"esciuntN\",osUsername=idunt,srcHost=ptasnu6684.mail.lan,dbName=orumSe,schemaName=boree,bindVar=intoc,sqlError=success,respSize=248,respTime=158.450000,affRows=eeufugia,action=\"block\",rawQuery=\"ofdeFini\"", "tags": [ @@ -92,7 +92,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.168.159.13,dstPort=3319,dbUsername=inci,srcIP=10.230.173.4,srcPort=2631,creatTime=2016-06-20 04:35:42,srvGroup=avol,service=icero,appName=xer,event#=emipsumd,eventType=Logout,usrGroup=isisten,usrAuth=False,application=\"cusant\",osUsername=atemq,srcHost=rinre2977.api.corp,dbName=totamre,schemaName=isnostr,bindVar=umqu,sqlError=success,respSize=6135,respTime=86.668000,affRows=inesci,action=\"accept\",rawQuery=\"uia\"", "tags": [ @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.49.167.57,dstPort=2119,dbUsername=tali,srcIP=10.41.21.204,srcPort=3540,creatTime=4 July 2016 11:38:16,srvGroup=rpori,service=ice,appName=oles,event#=edic,eventType=Login,usrGroup=seq,usrAuth=True,application=\"tutlab\",osUsername=sau,srcHost=atevelit2450.local,dbName=aperia,schemaName=ccaeca,bindVar=umdolo,sqlError=failure,respSize=6818,respTime=115.224000,affRows=stenatu,action=\"block\",rawQuery=\"orumSe\"", "tags": [ @@ -110,7 +110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=dutp,event#=psaquaea,createTime=2016-07-18 18:40:50,updateTime=taevita,alertSev=high,group=siut,ruleName=\"tconsect\",evntDesc=\"aquae\",category=boreetdo,disposition=aturve,eventType=ditemp,proto=ipv6,srcPort=3406,srcIP=10.216.125.252,dstPort=5592,dstIP=10.62.147.186,policyName=\"eumiure\",occurrences=4603,httpHost=ima,webMethod=quasia,url=\"https://example.org/umwrit/uptate.html?ctetura=aveni#elit\",webQuery=\"seosqui\",soapAction=sequamni,resultCode=uradi,sessionID=tot,username=llamco,addUsername=nea,responseTime=psum,responseSize=tasnulap,direction=inbound,dbUsername=umSe,queryGroup=xeacomm,application=\"cinge\",srcHost=itla658.api.localhost,osUsername=lorsita,schemaName=dolore,dbName=uptate,hdrName=quidexea,action=\"accept\",errormsg=\"unknown\"", "tags": [ @@ -119,7 +119,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=ate,event#=odoconse,createTime=2016-08-02 01:43:25,updateTime=emp,alertSev=very-high,group=veli,ruleName=\"tenim\",evntDesc=\"rumet\",category=verita,disposition=sectet,eventType=etdo,proto=tcp,srcPort=3689,srcIP=10.52.125.9,dstPort=2538,dstIP=10.204.128.215,policyName=\"ama\",occurrences=332,httpHost=runtmol,webMethod=texpli,url=\"https://api.example.org/roidents/tem.txt?tametcon=liqua#mvele\",webQuery=\"isis\",soapAction=uasiar,resultCode=utlab,sessionID=emUteni,username=rum,addUsername=gnaaliqu,responseTime=teirured,responseSize=onemulla,direction=external,dbUsername=bor,queryGroup=rauto,application=\"ationev\",srcHost=umdolor4389.api.home,osUsername=paquioff,schemaName=nci,dbName=isau,hdrName=rautodi,action=deny", "tags": [ @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.200.68.129,dstPort=2558,dbUsername=icabo,srcIP=10.34.148.166,srcPort=3022,creatTime=2016-08-16 08:45:59,srvGroup=preh,service=ercit,appName=etMal,event#=qua,eventType=rsita,usrGroup=ate,usrAuth=ipsamvo,application=\"onula\",osUsername=miu,srcHost=rationev6444.localhost,dbName=tatem,schemaName=untutlab,bindVar=amcor,sqlError=failure,respSize=5427,respTime=176.685000,affRows=oremq,action=\"block\",rawQuery=\"uisaute\"", "tags": [ @@ -137,7 +137,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.226.101.180,dstPort=1000,dbUsername=siu,srcIP=10.134.5.40,srcPort=7284,creatTime=30 August 2016 15:48:33,srvGroup=llamc,service=nte,appName=mvel,event#=nof,eventType=Login,usrGroup=usmodi,usrAuth=False,application=\"mvolu\",osUsername=conse,srcHost=ipi7727.www5.domain,dbName=isiu,schemaName=licabo,bindVar=enimadmi,sqlError=success,respSize=6356,respTime=41.238000,affRows=xeaco,action=\"deny\",rawQuery=\"amcor\"", "tags": [ @@ -146,7 +146,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.126.26.131,dstPort=2595,dbUsername=velite,srcIP=10.30.98.10,srcPort=7576,creatTime=13 September 2016 22:51:07,srvGroup=itation,service=sequatD,appName=nimave,event#=isciv,eventType=Login,usrGroup=rroqu,usrAuth=False,application=\"nofd\",osUsername=dipisci,srcHost=spernatu5539.domain,dbName=quunt,schemaName=olori,bindVar=mquae,sqlError=unknown,respSize=7717,respTime=96.729000,affRows=cidunt,action=\"accept\",rawQuery=\"borisnis\"", "tags": [ @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.190.10.219,dstPort=5530,dbUsername=accusant,srcIP=10.233.120.207,srcPort=136,creatTime=2016-09-28 05:53:42,srvGroup=stenatu,service=inibu,appName=est,event#=uptatemU,eventType=Logout,usrGroup=leumiu,usrAuth=False,application=\"tla\",osUsername=item,srcHost=nimid372.api.corp,dbName=atcupid,schemaName=quamnih,bindVar=dminima,sqlError=success,respSize=3278,respTime=60.949000,affRows=tame,action=\"cancel\",rawQuery=\"reetd\"", "tags": [ @@ -164,7 +164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=sitam,createTime=2016-10-12 12:56:16,eventType=rad,eventSev=low,username=sequa,subsystem=iosamnis,message=\"volupt\"", "tags": [ @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.100.98.56,dstPort=1089,dbUsername=boru,srcIP=10.248.184.200,srcPort=5315,creatTime=2016-10-26 19:58:50,srvGroup=ptatem,service=ptatevel,appName=tenatuse,event#=psaqua,eventType=Logout,usrGroup=ullamcor,usrAuth=False,application=\"itationu\",osUsername=proident,srcHost=maliquam2147.internal.home,dbName=lores,schemaName=ritati,bindVar=orisni,sqlError=failure,respSize=5923,respTime=179.541000,affRows=sitam,action=\"deny\",rawQuery=\"mmodoc\"", "tags": [ @@ -182,7 +182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.197.6.245,dstPort=27,dbUsername=dtempo,srcIP=10.82.28.220,srcPort=3570,creatTime=10 November 2016 03:01:24,srvGroup=imad,service=tinvolup,appName=tsed,event#=inv,eventType=Login,usrGroup=rroq,usrAuth=False,application=\"rcit\",osUsername=aecatcup,srcHost=olabor2983.internal.localhost,dbName=citatio,schemaName=oluptat,bindVar=mveniamq,sqlError=success,respSize=3071,respTime=120.142000,affRows=eaqueips,action=\"allow\",rawQuery=\"aturve\"", "tags": [ @@ -191,7 +191,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.6.27.103,dstPort=3179,dbUsername=redol,srcIP=10.167.252.183,srcPort=2003,creatTime=24 November 2016 10:03:59,srvGroup=doei,service=cipitl,appName=caboNemo,event#=dexerc,eventType=Login,usrGroup=strumex,usrAuth=True,application=\"eprehend\",osUsername=asnu,srcHost=hitec2111.mail.corp,dbName=perspici,schemaName=ationul,bindVar=mquisn,sqlError=failure,respSize=6606,respTime=155.907000,affRows=emUte,action=\"cancel\",rawQuery=\"ccae\"", "tags": [ @@ -200,7 +200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=ntNe,event#=itanim,createTime=2016-12-08 17:06:33,updateTime=nesciun,alertSev=medium,group=mollita,ruleName=\"tatem\",evntDesc=\"iae\",category=quido,disposition=emip,eventType=inBC,proto=tcp,srcPort=6165,srcIP=10.88.45.111,dstPort=6735,dstIP=10.81.184.7,policyName=\"saquaea\",occurrences=6344,httpHost=eetd,webMethod=illu,url=\"https://mail.example.com/lorsi/repreh.gif?sitamet=utlabo#tetur\",webQuery=\"tionula\",soapAction=ritqu,resultCode=ecatcupi,sessionID=uamei,username=undeomni,addUsername=tas,responseTime=autfugi,responseSize=tasun,direction=external,dbUsername=eratv,queryGroup=ipsa,application=\"asuntexp\",srcHost=adminim2559.www5.invalid,osUsername=lmole,schemaName=iameaque,dbName=nderi,hdrName=ssusci,action=\"deny\",errormsg=\"failure\"", "tags": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.214.3.140,dstPort=6127,dbUsername=scipitl,srcIP=10.29.119.245,srcPort=1179,creatTime=2016-12-23 00:09:07,srvGroup=olli,service=rever,appName=ore,event#=offici,eventType=Logout,usrGroup=ection,usrAuth=False,application=\"roquisqu\",osUsername=edolorin,srcHost=dolorem6882.api.local,dbName=rsi,schemaName=taliqui,bindVar=mides,sqlError=success,respSize=5140,respTime=119.229000,affRows=tcu,action=\"cancel\",rawQuery=\"inrepreh\"", "tags": [ @@ -218,7 +218,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=dipiscin,event#=olup,createTime=2017-01-06 07:11:41,updateTime=aco,alertSev=medium,group=accusa,ruleName=\"natu\",evntDesc=\"liquid\",category=enim,disposition=Finibus,eventType=radi,proto=rdp,srcPort=2064,srcIP=10.218.123.234,dstPort=57,dstIP=10.110.133.7,policyName=\"radipisc\",occurrences=5347,httpHost=nibus,webMethod=vitaed,url=\"https://example.org/etconsec/elillum.htm?mporinc=onsectet#idolo\",webQuery=\"atemUte\",soapAction=docon,resultCode=mdolore,sessionID=eosquira,username=pta,addUsername=snos,responseTime=orsi,responseSize=tetura,direction=external,dbUsername=lorsita,queryGroup=eavol,application=\"osamnis\",srcHost=temaccu5302.test,osUsername=etconsec,schemaName=caboNem,dbName=urExcept,hdrName=rumetMal,action=\"allow\",errormsg=\"unknown\"", "tags": [ @@ -227,7 +227,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.105.190.170,dstPort=2519,dbUsername=doeiu,srcIP=10.182.152.242,srcPort=1877,creatTime=2017-01-20 14:14:16,srvGroup=orumw,service=redol,appName=ecillum,event#=isci,eventType=Logout,usrGroup=dolor,usrAuth=True,application=\"tiumto\",osUsername=litan,srcHost=nder347.www.corp,dbName=alorum,schemaName=mquisn,bindVar=atq,sqlError=unknown,respSize=3474,respTime=68.556000,affRows=ugiatquo,action=\"block\",rawQuery=\"equamnih\"", "tags": [ @@ -236,7 +236,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=citati,event#=uamei,createTime=2017-02-03 21:16:50,updateTime=eursinto,alertSev=low,group=tutla,ruleName=\"licaboNe\",evntDesc=\"tautfug\",category=giatquov,disposition=olu,eventType=rmagnido,proto=ipv6-icmp,srcPort=7647,srcIP=10.59.188.188,dstPort=7082,dstIP=10.123.166.197,policyName=\"ici\",occurrences=7102,httpHost=mips,webMethod=itae,url=\"https://internal.example.net/atnula/ditautf.jpg?iquidex=olup#remipsu\",webQuery=\"tan\",soapAction=quiac,resultCode=sunt,sessionID=autfugit,username=emUte,addUsername=iusmodi,responseTime=fdeFi,responseSize=Except,direction=inbound,dbUsername=equat,queryGroup=aliquid,application=\"usantiu\",srcHost=idunt4633.internal.host,osUsername=liquam,schemaName=min,dbName=oluptat,hdrName=odt,action=block", "tags": [ @@ -245,7 +245,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.72.75.207,dstPort=6336,dbUsername=urau,srcIP=10.201.168.116,srcPort=2037,creatTime=2017-02-18 04:19:24,srvGroup=utali,service=sed,appName=xeac,event#=umdolors,eventType=Logout,usrGroup=lumdo,usrAuth=False,application=\"acom\",osUsername=eFini,srcHost=ectob4634.mail.localhost,dbName=prehend,schemaName=eufug,bindVar=roquisq,sqlError=unknown,respSize=3348,respTime=79.765000,affRows=civelits,action=\"accept\",rawQuery=\"reet\"", "tags": [ @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.9.46.123,dstPort=586,dbUsername=mfu,srcIP=10.58.133.175,srcPort=1634,creatTime=4 March 2017 11:21:59,srvGroup=llumq,service=tenim,appName=eiusmo,event#=ainc,eventType=Login,usrGroup=miurerep,usrAuth=True,application=\"lestia\",osUsername=nde,srcHost=snu6436.www.local,dbName=texplica,schemaName=oco,bindVar=aboree,sqlError=unknown,respSize=3795,respTime=14.713000,affRows=edquian,action=\"block\",rawQuery=\"uames\"", "tags": [ @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.169.50.59,dstPort=7693,dbUsername=pta,srcIP=10.70.29.203,srcPort=5994,creatTime=18 March 2017 18:24:33,srvGroup=piciatis,service=destla,appName=fugitse,event#=minimve,eventType=Login,usrGroup=serrorsi,usrAuth=False,application=\"tametco\",osUsername=mquisnos,srcHost=lore7099.www.host,dbName=isn,schemaName=veniamq,bindVar=lup,sqlError=unknown,respSize=2358,respTime=94.460000,affRows=ipitlabo,action=\"block\",rawQuery=\"prehen\"", "tags": [ @@ -272,7 +272,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.165.182.111,dstPort=5525,dbUsername=ames,srcIP=10.137.85.123,srcPort=218,creatTime=2017-04-02 01:27:07,srvGroup=amquisno,service=modoc,appName=magnam,event#=uinesc,eventType=Logout,usrGroup=cid,usrAuth=True,application=\"emi\",osUsername=Bonorum,srcHost=lesti6939.api.local,dbName=idu,schemaName=sis,bindVar=idolo,sqlError=success,respSize=6401,respTime=171.434000,affRows=its,action=\"block\",rawQuery=\"edutp\"", "tags": [ @@ -281,7 +281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=enimadmi,createTime=2017-04-16 08:29:41,eventType=tateveli,eventSev=high,username=sumdolo,subsystem=idolorem,message=\"temvele\"", "tags": [ @@ -290,7 +290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=inimve,event#=uio,createTime=2017-04-30 15:32:16,updateTime=mexercit,alertSev=high,group=onofdeF,ruleName=\"ibusBo\",evntDesc=\"orin\",category=enia,disposition=iavol,eventType=natuserr,proto=rdp,srcPort=3327,srcIP=10.64.184.196,dstPort=6659,dstIP=10.173.178.109,policyName=\"tatemse\",occurrences=4493,httpHost=amqui,webMethod=lamco,url=\"https://www.example.net/hender/ptatemU.htm?mquisnos=tnulapa#madmi\",webQuery=\"tlabore\",soapAction=idunt,resultCode=expl,sessionID=olore,username=uian,addUsername=atuserro,responseTime=madminim,responseSize=tobeata,direction=inbound,dbUsername=ioff,queryGroup=oinBCS,application=\"itsedd\",srcHost=upt6017.api.localdomain,osUsername=nesci,schemaName=tam,dbName=sin,hdrName=idexeac,action=\"block\",errormsg=\"failure\"", "tags": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.90.50.149,dstPort=1936,dbUsername=olu,srcIP=10.168.225.209,srcPort=6,creatTime=2017-05-14 22:34:50,srvGroup=taliq,service=tautfugi,appName=fdeFinib,event#=uip,eventType=Logout,usrGroup=ectobea,usrAuth=True,application=\"dat\",osUsername=aUtenima,srcHost=turQuis4046.api.test,dbName=deomnisi,schemaName=olupta,bindVar=oll,sqlError=success,respSize=1127,respTime=55.870000,affRows=evelite,action=\"block\",rawQuery=\"iav\"", "tags": [ @@ -308,7 +308,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.59.182.36,dstPort=5792,dbUsername=mtota,srcIP=10.18.150.82,srcPort=6648,creatTime=29 May 2017 05:37:24,srvGroup=rit,service=eumfu,appName=lors,event#=oluptat,eventType=Login,usrGroup=enimad,usrAuth=True,application=\"tis\",osUsername=qua,srcHost=con6049.internal.lan,dbName=quelaud,schemaName=luptat,bindVar=rinrep,sqlError=unknown,respSize=6112,respTime=135.357000,affRows=nimv,action=\"allow\",rawQuery=\"tconse\"", "tags": [ @@ -317,7 +317,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=rem,createTime=2017-06-12 12:39:58,eventType=ulamcola,eventSev=very-high,username=llita,subsystem=ntsunt,message=\"nturmag\"", "tags": [ @@ -326,7 +326,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.228.229.144,dstPort=3236,dbUsername=ametcons,srcIP=10.151.240.35,srcPort=3197,creatTime=2017-06-26 19:42:33,srvGroup=roquisq,service=uasi,appName=maveniam,event#=uis,eventType=lill,usrGroup=remeum,usrAuth=mmod,application=\"taevit\",osUsername=ama,srcHost=tatnonp1371.www.invalid,dbName=xercit,schemaName=lam,bindVar=asnu,sqlError=failure,respSize=4325,respTime=168.492000,affRows=eriam,action=\"cancel\",rawQuery=\"aquae\"", "tags": [ @@ -335,7 +335,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.242.48.203,dstPort=1102,dbUsername=ese,srcIP=10.147.142.242,srcPort=2586,creatTime=2017-07-11 02:45:07,srvGroup=eca,service=ctionofd,appName=mpori,event#=olupt,eventType=Logout,usrGroup=ola,usrAuth=False,application=\"ptat\",osUsername=quasi,srcHost=tium3542.internal.invalid,dbName=squamest,schemaName=quisn,bindVar=pteu,sqlError=success,respSize=3970,respTime=11.548000,affRows=antium,action=\"block\",rawQuery=\"velillum\"", "tags": [ @@ -344,7 +344,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=lapari,event#=Mal,createTime=2017-07-25 09:47:41,updateTime=itinvo,alertSev=very-high,group=paq,ruleName=\"emipsumq\",evntDesc=\"culpaq\",category=quamq,disposition=usan,eventType=tdolo,proto=ipv6,srcPort=4723,srcIP=10.213.165.165,dstPort=3787,dstIP=10.254.10.98,policyName=\"adipisc\",occurrences=7365,httpHost=tasnul,webMethod=uptasn,url=\"https://example.net/itati/oidentsu.gif?eporroqu=aturve#temqui\",webQuery=\"lup\",soapAction=aeca,resultCode=isau,sessionID=giat,username=ttenb,addUsername=eirure,responseTime=boreetd,responseSize=tNe,direction=outbound,dbUsername=eeufug,queryGroup=ntin,application=\"iades\",srcHost=radipis3991.mail.invalid,osUsername=civeli,schemaName=eufugia,dbName=utlabore,hdrName=tamr,action=\"cancel\",errormsg=\"success\"", "tags": [ @@ -353,7 +353,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=onemul,createTime=2017-08-08 16:50:15,eventType=trudexe,eventSev=very-high,username=ura,subsystem=oreeufug,message=\"Quisa\"", "tags": [ @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=llitani,event#=uscipit,createTime=2017-08-22 23:52:50,updateTime=luptat,alertSev=very-high,group=etco,ruleName=\"iuntN\",evntDesc=\"utfugi\",category=ursintoc,disposition=tio,eventType=mmodicon,proto=ipv6,srcPort=5439,srcIP=10.116.1.130,dstPort=3402,dstIP=10.169.28.157,policyName=\"exeacomm\",occurrences=1295,httpHost=ionula,webMethod=pexeaco,url=\"https://api.example.org/uamqua/Neq.gif?eumiu=nim#pteurs\",webQuery=\"ercitati\",soapAction=atem,resultCode=serro,sessionID=lumquid,username=eturadip,addUsername=amquaera,responseTime=rsitamet,responseSize=leumiur,direction=internal,dbUsername=utod,queryGroup=olesti,application=\"edquia\",srcHost=ihi7294.www5.localhost,osUsername=reseo,schemaName=amco,dbName=ons,hdrName=onsecte,action=\"accept\",errormsg=\"unknown\"", "tags": [ @@ -371,7 +371,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.29.138.31,dstPort=5871,dbUsername=volupta,srcIP=10.45.69.152,srcPort=4083,creatTime=6 September 2017 06:55:24,srvGroup=emi,service=uaerat,appName=iduntu,event#=samvol,eventType=Login,usrGroup=equa,usrAuth=False,application=\"apari\",osUsername=tsunt,srcHost=caecat4920.api.host,dbName=enim,schemaName=umq,bindVar=sistena,sqlError=failure,respSize=744,respTime=33.416000,affRows=temquia,action=\"deny\",rawQuery=\"eumiu\"", "tags": [ @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.152.213.228,dstPort=3387,dbUsername=ptatev,srcIP=10.100.113.11,srcPort=6971,creatTime=2017-09-20 13:57:58,srvGroup=aliqu,service=sequine,appName=utaliqui,event#=isciv,eventType=Logout,usrGroup=osqu,usrAuth=False,application=\"ptatemse\",osUsername=itationu,srcHost=setquas6188.internal.local,dbName=magnaali,schemaName=velillum,bindVar=ionev,sqlError=success,respSize=7245,respTime=131.118000,affRows=ameaq,action=\"cancel\",rawQuery=\"Except\"", "tags": [ @@ -389,7 +389,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=uiac,createTime=2017-10-04 21:00:32,eventType=tquii,eventSev=low,username=reme,subsystem=emeumfu,message=\"inBCSedu\"", "tags": [ @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.208.33.55,dstPort=1849,dbUsername=ulapari,srcIP=10.248.102.129,srcPort=3510,creatTime=2017-10-19 04:03:07,srvGroup=iatn,service=saquaeab,appName=eli,event#=rissusci,eventType=Logout,usrGroup=ectetur,usrAuth=True,application=\"dictasun\",osUsername=inimv,srcHost=nibusBo3674.www5.localhost,dbName=ntut,schemaName=mremaper,bindVar=uteirur,sqlError=unknown,respSize=6433,respTime=111.360000,affRows=isni,action=\"accept\",rawQuery=\"quovo\"", "tags": [ @@ -407,7 +407,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.203.164.132,dstPort=6213,dbUsername=mporin,srcIP=10.109.230.216,srcPort=4447,creatTime=2017-11-02 11:05:41,srvGroup=uov,service=pariat,appName=icaboNe,event#=boreetd,eventType=Logout,usrGroup=uir,usrAuth=True,application=\"rumex\",osUsername=ectobea,srcHost=totamr7676.www5.home,dbName=imadm,schemaName=ibus,bindVar=lumdol,sqlError=success,respSize=547,respTime=166.971000,affRows=reprehe,action=\"block\",rawQuery=\"ihil\"", "tags": [ @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.151.203.60,dstPort=482,dbUsername=dol,srcIP=10.117.81.75,srcPort=3365,creatTime=16 November 2017 18:08:15,srvGroup=iciatis,service=agn,appName=cul,event#=tate,eventType=Login,usrGroup=psam,usrAuth=True,application=\"itaedi\",osUsername=exeac,srcHost=idents7231.mail.home,dbName=veniamqu,schemaName=iconsequ,bindVar=ueporr,sqlError=unknown,respSize=484,respTime=27.563000,affRows=tur,action=\"block\",rawQuery=\"onorumet\"", "tags": [ @@ -425,7 +425,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.224.217.153,dstPort=6339,dbUsername=eriti,srcIP=10.45.152.205,srcPort=6907,creatTime=1 December 2017 01:10:49,srvGroup=riame,service=datatn,appName=seq,event#=mquis,eventType=Login,usrGroup=tur,usrAuth=True,application=\"itation\",osUsername=utlabo,srcHost=tat50.mail.host,dbName=essequam,schemaName=imav,bindVar=mtot,sqlError=success,respSize=922,respTime=17.709000,affRows=prehend,action=\"allow\",rawQuery=\"liquid\"", "tags": [ @@ -434,7 +434,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=umq,event#=ipsu,createTime=2017-12-15 08:13:24,updateTime=oremip,alertSev=low,group=odit,ruleName=\"vol\",evntDesc=\"epteurs\",category=itse,disposition=rever,eventType=sBonoru,proto=udp,srcPort=2652,srcIP=10.60.164.100,dstPort=5119,dstIP=10.1.193.187,policyName=\"yCice\",occurrences=508,httpHost=ionem,webMethod=taevitae,url=\"https://api.example.net/quam/saute.htm?nostru=docons#emipsumq\",webQuery=\"orinr\",soapAction=ineavol,resultCode=umdo,sessionID=tass,username=ugi,addUsername=riat,responseTime=atvol,responseSize=emipsum,direction=internal,dbUsername=uameiu,queryGroup=quiado,application=\"conse\",srcHost=mips3283.corp,osUsername=hite,schemaName=adipis,dbName=abo,hdrName=suntex,action=\"allow\",errormsg=\"failure\"", "tags": [ @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.248.244.203,dstPort=806,dbUsername=mquamei,srcIP=10.146.228.234,srcPort=4346,creatTime=2017-12-29 15:15:58,srvGroup=rissusci,service=uaturQ,appName=iusmod,event#=susc,eventType=taed,usrGroup=eatae,usrAuth=siutali,application=\"oloremq\",osUsername=sum,srcHost=aliquip7229.mail.domain,dbName=doe,schemaName=eiusm,bindVar=oremipsu,sqlError=failure,respSize=3058,respTime=133.358000,affRows=llum,action=\"allow\",rawQuery=\"mto\"", "tags": [ @@ -452,7 +452,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.122.127.237,dstPort=1138,dbUsername=consecte,srcIP=10.86.121.152,srcPort=3971,creatTime=2018-01-12 22:18:32,srvGroup=mquamei,service=litesse,appName=fug,event#=liquid,eventType=Logout,usrGroup=uidex,usrAuth=False,application=\"umdolo\",osUsername=nimv,srcHost=fde7756.mail.corp,dbName=usmod,schemaName=ine,bindVar=qui,sqlError=success,respSize=2771,respTime=136.167000,affRows=orsitame,action=\"block\",rawQuery=\"ipex\"", "tags": [ @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.201.223.119,dstPort=3614,dbUsername=rcit,srcIP=10.204.223.184,srcPort=6092,creatTime=2018-01-27 05:21:06,srvGroup=giat,service=nculpa,appName=olupt,event#=tvol,eventType=Logout,usrGroup=ostru,usrAuth=True,application=\"mea\",osUsername=tuserror,srcHost=agnama5013.internal.example,dbName=boreetdo,schemaName=teni,bindVar=iin,sqlError=unknown,respSize=4113,respTime=161.837000,affRows=tNeq,action=\"block\",rawQuery=\"liq\"", "tags": [ @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.200.12.126,dstPort=2347,dbUsername=magnido,srcIP=10.223.56.33,srcPort=5899,creatTime=10 February 2018 12:23:41,srvGroup=ing,service=amal,appName=aliq,event#=utem,eventType=Login,usrGroup=oreetd,usrAuth=True,application=\"itatis\",osUsername=Nequepo,srcHost=edictas4693.home,dbName=borisnis,schemaName=elitsedd,bindVar=hitecto,sqlError=failure,respSize=3243,respTime=75.415000,affRows=imven,action=\"block\",rawQuery=\"hende\"", "tags": [ @@ -479,7 +479,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=deseru,event#=aquioff,createTime=2018-02-24 19:26:15,updateTime=cip,alertSev=very-high,group=onsequat,ruleName=\"tiumd\",evntDesc=\"atuse\",category=imad,disposition=tura,eventType=equuntur,proto=ipv6,srcPort=428,srcIP=10.94.89.177,dstPort=1752,dstIP=10.65.225.101,policyName=\"nulapari\",occurrences=2513,httpHost=ostrumex,webMethod=eruntmol,url=\"https://internal.example.com/imide/uiineav.htm?lloinve=eni#asia\",webQuery=\"edquiac\",soapAction=psamvolu,resultCode=teturad,sessionID=ritq,username=tuserror,addUsername=tla,responseTime=orroq,responseSize=modtempo,direction=outbound,dbUsername=uptate,queryGroup=sumqui,application=\"eritin\",srcHost=nibu2565.api.local,osUsername=citation,schemaName=emquel,dbName=rspiciat,hdrName=iavol,action=\"cancel\",errormsg=\"unknown\"", "tags": [ @@ -488,7 +488,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.65.174.196,dstPort=472,dbUsername=iin,srcIP=10.191.184.105,srcPort=6821,creatTime=2018-03-11 02:28:49,srvGroup=iat,service=orain,appName=equaturQ,event#=llu,eventType=quaUt,usrGroup=labor,usrAuth=oris,application=\"tatemse\",osUsername=uta,srcHost=tsun7120.home,dbName=per,schemaName=tione,bindVar=nibus,sqlError=unknown,respSize=5836,respTime=61.864000,affRows=olo,action=\"deny\",rawQuery=\"BCSedutp\"", "tags": [ @@ -497,7 +497,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=tdolor,event#=Ute,createTime=2018-03-25 09:31:24,updateTime=tura,alertSev=very-high,group=umSecti,ruleName=\"eabil\",evntDesc=\"ibusB\",category=rporis,disposition=etco,eventType=mip,proto=rdp,srcPort=6078,srcIP=10.224.148.48,dstPort=2803,dstIP=10.41.181.179,policyName=\"siarch\",occurrences=7468,httpHost=setq,webMethod=rumwr,url=\"https://api.example.com/ptatem/mporain.gif?corpo=commod#iumd\",webQuery=\"ntore\",soapAction=tect,resultCode=ion,sessionID=tutl,username=niam,addUsername=oru,responseTime=mcorp,responseSize=uelaud,direction=outbound,dbUsername=ameiu,queryGroup=utei,application=\"caecat\",srcHost=lumquid6940.mail.localdomain,osUsername=equepor,schemaName=iosamn,dbName=erspicia,hdrName=neavolup,action=\"deny\",errormsg=\"success\"", "tags": [ @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.21.208.103,dstPort=5543,dbUsername=imidest,srcIP=10.21.61.134,srcPort=6124,creatTime=2018-04-08 16:33:58,srvGroup=iacon,service=ncu,appName=quaturve,event#=ciad,eventType=Logout,usrGroup=diconseq,usrAuth=False,application=\"utod\",osUsername=ostr,srcHost=amcorp7299.api.example,dbName=uptatem,schemaName=mipsa,bindVar=nproide,sqlError=success,respSize=7766,respTime=91.186000,affRows=siutali,action=\"deny\",rawQuery=\"nemullam\"", "tags": [ @@ -515,7 +515,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.23.6.216,dstPort=4578,dbUsername=iarchit,srcIP=10.221.192.116,srcPort=4688,creatTime=2018-04-22 23:36:32,srvGroup=usBonor,service=mide,appName=sten,event#=enderi,eventType=Logout,usrGroup=labore,usrAuth=False,application=\"uasiarch\",osUsername=iamquisn,srcHost=magnama868.api.local,dbName=Section,schemaName=tevelite,bindVar=esciunt,sqlError=success,respSize=639,respTime=6.388000,affRows=borisnis,action=\"accept\",rawQuery=\"oremagn\"", "tags": [ @@ -524,7 +524,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=rcita,event#=ataev,createTime=2018-05-07 06:39:06,updateTime=oris,alertSev=very-high,group=tate,ruleName=\"tutlabo\",evntDesc=\"nto\",category=sciv,disposition=tlabo,eventType=nsequun,proto=ipv6,srcPort=2976,srcIP=10.191.142.143,dstPort=5850,dstIP=10.240.62.238,policyName=\"sintoc\",occurrences=7580,httpHost=laboris,webMethod=ali,url=\"https://www5.example.net/aUten/edutpers.gif?apariatu=mnisis#onsequa\",webQuery=\"sunt\",soapAction=orumSe,resultCode=olupta,sessionID=emveleum,username=modtempo,addUsername=mfugi,responseTime=roqui,responseSize=ntutlabo,direction=external,dbUsername=isq,queryGroup=eacommo,application=\"amqua\",srcHost=tionevol3157.mail.invalid,osUsername=nofde,schemaName=animide,dbName=Lore,hdrName=oin,action=cancel", "tags": [ @@ -533,7 +533,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=ecatcu,event#=entoreve,createTime=2018-05-21 13:41:41,updateTime=ion,alertSev=very-high,group=onev,ruleName=\"atu\",evntDesc=\"adeseru\",category=sitas,disposition=eni,eventType=cte,proto=igmp,srcPort=3124,srcIP=10.178.79.217,dstPort=7499,dstIP=10.111.22.134,policyName=\"datatno\",occurrences=3538,httpHost=siar,webMethod=orisnis,url=\"https://www.example.net/mvolup/pidat.jpg?ents=nsec#iaeco\",webQuery=\"ommodoco\",soapAction=ritinv,resultCode=rita,sessionID=oidents,username=ccusan,addUsername=inimav,responseTime=quel,responseSize=ugitsed,direction=external,dbUsername=idolor,queryGroup=xplic,application=\"stenat\",srcHost=mquis319.api.local,osUsername=inibusBo,schemaName=tqui,dbName=sequun,hdrName=nimadm,action=deny", "tags": [ @@ -542,7 +542,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.161.225.172,dstPort=3708,dbUsername=meaqu,srcIP=10.77.86.215,srcPort=6390,creatTime=4 June 2018 20:44:15,srvGroup=con,service=aeabil,appName=iumtot,event#=edicta,eventType=Login,usrGroup=itaspern,usrAuth=False,application=\"tau\",osUsername=rcit,srcHost=urad5712.api.host,dbName=sitamet,schemaName=xerc,bindVar=mcolabor,sqlError=success,respSize=7286,respTime=143.926000,affRows=evita,action=\"block\",rawQuery=\"ant\"", "tags": [ @@ -551,7 +551,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.186.133.184,dstPort=7864,dbUsername=boriosa,srcIP=10.211.161.187,srcPort=843,creatTime=2018-06-19 03:46:49,srvGroup=laud,service=uido,appName=uis,event#=msequin,eventType=autem,usrGroup=mporai,usrAuth=ipi,application=\"qua\",osUsername=acons,srcHost=enbyCic4659.www5.example,dbName=orroqui,schemaName=sci,bindVar=psamvolu,sqlError=unknown,respSize=1578,respTime=66.164000,affRows=temse,action=\"deny\",rawQuery=\"onevol\"", "tags": [ @@ -560,7 +560,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.160.147.230,dstPort=2126,dbUsername=nimvenia,srcIP=10.254.198.47,srcPort=3925,creatTime=2018-07-03 10:49:23,srvGroup=lit,service=quin,appName=adipisc,event#=sedqui,eventType=ueporroq,usrGroup=dolo,usrAuth=adm,application=\"dolor\",osUsername=ndeomnis,srcHost=inBCSed5308.api.corp,dbName=modicons,schemaName=illoin,bindVar=rinre,sqlError=unknown,respSize=5988,respTime=34.664000,affRows=olorem,action=\"cancel\",rawQuery=\"dquiaco\"", "tags": [ @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.40.24.93,dstPort=7487,dbUsername=mSecti,srcIP=10.182.197.243,srcPort=3687,creatTime=2018-07-17 17:51:58,srvGroup=xerci,service=qua,appName=iaecons,event#=pteurs,eventType=Logout,usrGroup=intocc,usrAuth=True,application=\"abo\",osUsername=orisnis,srcHost=reseo2067.api.localdomain,dbName=nsectetu,schemaName=exerci,bindVar=lit,sqlError=success,respSize=4129,respTime=171.277000,affRows=ono,action=\"cancel\",rawQuery=\"equuntu\"", "tags": [ @@ -578,7 +578,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.249.13.159,dstPort=3023,dbUsername=uisautei,srcIP=10.108.130.106,srcPort=7601,creatTime=1 August 2018 00:54:32,srvGroup=scinge,service=lum,appName=iinea,event#=xercit,eventType=Login,usrGroup=reh,usrAuth=False,application=\"velitess\",osUsername=colab,srcHost=itte6905.mail.invalid,dbName=tesseq,schemaName=exeacomm,bindVar=uptat,sqlError=success,respSize=1044,respTime=112.679000,affRows=ptatema,action=\"cancel\",rawQuery=\"cepteurs\"", "tags": [ @@ -587,7 +587,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=ioffic,event#=rumetMal,createTime=2018-08-15 07:57:06,updateTime=tiumtot,alertSev=very-high,group=caboNe,ruleName=\"ptate\",evntDesc=\"enimips\",category=Nequepor,disposition=nisiu,eventType=ptat,proto=ggp,srcPort=4082,srcIP=10.64.94.174,dstPort=3852,dstIP=10.39.244.49,policyName=\"ctas\",occurrences=7128,httpHost=sequ,webMethod=gna,url=\"https://internal.example.org/aev/uovolup.txt?aqueip=aqueip#rautod\",webQuery=\"tur\",soapAction=minimav,resultCode=uovo,sessionID=aven,username=Sedut,addUsername=stiaec,responseTime=rveli,responseSize=serr,direction=internal,dbUsername=uid,queryGroup=lamcor,application=\"rorsitv\",srcHost=caboNemo274.www.host,osUsername=estiae,schemaName=iunt,dbName=eFinibu,hdrName=uisaut,action=cancel", "tags": [ @@ -596,7 +596,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=odit,createTime=2018-08-29 14:59:40,eventType=ercitati,eventSev=very-high,username=imad,subsystem=olo,message=\"deserun\"", "tags": [ @@ -605,7 +605,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=scingeli,createTime=2018-09-12 22:02:15,eventType=uatDuis,eventSev=medium,username=apari,subsystem=itesseci,message=\"utali\"", "tags": [ @@ -614,7 +614,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.115.203.143,dstPort=6889,dbUsername=utoditau,srcIP=10.134.135.22,srcPort=1809,creatTime=27 September 2018 05:04:49,srvGroup=serror,service=itl,appName=Bonoru,event#=rumetMa,eventType=Login,usrGroup=entor,usrAuth=False,application=\"urere\",osUsername=involu,srcHost=qui5978.api.test,dbName=amre,schemaName=orpori,bindVar=sistena,sqlError=failure,respSize=7868,respTime=5.277000,affRows=borisn,action=\"cancel\",rawQuery=\"quatu\"", "tags": [ @@ -623,7 +623,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.43.244.252,dstPort=1752,dbUsername=inculp,srcIP=10.251.212.166,srcPort=3925,creatTime=11 October 2018 12:07:23,srvGroup=iur,service=aboNemo,appName=tsedquia,event#=ididun,eventType=Login,usrGroup=tatiset,usrAuth=False,application=\"enim\",osUsername=gnido,srcHost=iamq2577.internal.corp,dbName=uisa,schemaName=uptat,bindVar=siutal,sqlError=unknown,respSize=6947,respTime=144.976000,affRows=tempori,action=\"accept\",rawQuery=\"lamco\"", "tags": [ @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=nimve,createTime=2018-10-25 19:09:57,eventType=edutpe,eventSev=medium,username=isunde,subsystem=nimadm,message=\"cepte\"", "tags": [ @@ -641,7 +641,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.20.231.188,dstPort=1200,dbUsername=tesseq,srcIP=10.88.189.164,srcPort=1373,creatTime=2018-11-09 02:12:32,srvGroup=iusmod,service=aincid,appName=giatq,event#=tion,eventType=Logout,usrGroup=tNeque,usrAuth=False,application=\"uidolore\",osUsername=uatDuisa,srcHost=usB4127.localhost,dbName=ufugia,schemaName=mqu,bindVar=remagna,sqlError=failure,respSize=1623,respTime=33.468000,affRows=Uteni,action=\"cancel\",rawQuery=\"porinci\"", "tags": [ @@ -650,7 +650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=edd,createTime=2018-11-23 09:15:06,eventType=uianon,eventSev=low,username=quamquae,subsystem=aaliq,message=\"nos\"", "tags": [ @@ -659,7 +659,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.231.77.26,dstPort=7082,dbUsername=rehe,srcIP=10.225.11.197,srcPort=3513,creatTime=7 December 2018 16:17:40,srvGroup=siarchi,service=seddoeiu,appName=lorinrep,event#=isq,eventType=Login,usrGroup=quines,usrAuth=False,application=\"entsu\",osUsername=ineavol,srcHost=abor3266.mail.home,dbName=voluptat,schemaName=volu,bindVar=iutaliqu,sqlError=failure,respSize=3064,respTime=61.960000,affRows=iusmo,action=\"allow\",rawQuery=\"uovo\"", "tags": [ @@ -668,7 +668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.148.3.197,dstPort=979,dbUsername=usa,srcIP=10.106.166.105,srcPort=4567,creatTime=2018-12-21 23:20:14,srvGroup=oremagna,service=siuta,appName=amnihil,event#=nderit,eventType=ficia,usrGroup=tru,usrAuth=tionu,application=\"natuser\",osUsername=olupt,srcHost=eprehe2455.www.home,dbName=smo,schemaName=avolup,bindVar=litse,sqlError=failure,respSize=2658,respTime=84.894000,affRows=untutlab,action=\"allow\",rawQuery=\"byCicer\"", "tags": [ @@ -677,7 +677,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.172.121.239,dstPort=5339,dbUsername=iuta,srcIP=10.57.169.205,srcPort=3093,creatTime=2019-01-05 06:22:49,srvGroup=reeufugi,service=oloree,appName=xeaco,event#=urm,eventType=Logout,usrGroup=mpo,usrAuth=False,application=\"cept\",osUsername=ctas,srcHost=destla2110.www5.localdomain,dbName=inea,schemaName=ipsu,bindVar=iden,sqlError=failure,respSize=392,respTime=19.061000,affRows=reetd,action=\"cancel\",rawQuery=\"maven\"", "tags": [ @@ -686,7 +686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.129.234.200,dstPort=3833,dbUsername=tisundeo,srcIP=10.42.218.103,srcPort=3315,creatTime=19 January 2019 13:25:23,srvGroup=mnis,service=tametco,appName=snisiut,event#=lit,eventType=Login,usrGroup=laborio,usrAuth=False,application=\"aaliqu\",osUsername=tevelit,srcHost=exerc3694.api.home,dbName=consec,schemaName=dquia,bindVar=cep,sqlError=success,respSize=6709,respTime=34.273000,affRows=volupta,action=\"allow\",rawQuery=\"ipex\"", "tags": [ @@ -695,7 +695,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.111.132.221,dstPort=2262,dbUsername=ali,srcIP=10.76.121.224,srcPort=4305,creatTime=2019-02-02 20:27:57,srvGroup=xcep,service=ehen,appName=remap,event#=mUt,eventType=Logout,usrGroup=admi,usrAuth=True,application=\"siarch\",osUsername=oloremi,srcHost=ididu5928.www5.local,dbName=tNe,schemaName=scive,bindVar=tcupi,sqlError=unknown,respSize=6155,respTime=139.491000,affRows=Sed,action=\"cancel\",rawQuery=\"ita\"", "tags": [ @@ -704,7 +704,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.195.8.141,dstPort=4342,dbUsername=enimip,srcIP=10.17.214.21,srcPort=4821,creatTime=17 February 2019 03:30:32,srvGroup=umquiado,service=taspe,appName=empori,event#=mipsum,eventType=Login,usrGroup=tium,usrAuth=True,application=\"riaturE\",osUsername=ota,srcHost=boriosa7066.www.corp,dbName=Nequep,schemaName=dolo,bindVar=exeacom,sqlError=success,respSize=469,respTime=146.775000,affRows=eufugiat,action=\"accept\",rawQuery=\"non\"", "tags": [ @@ -713,7 +713,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.173.13.179,dstPort=1211,dbUsername=ptasn,srcIP=10.179.60.167,srcPort=1124,creatTime=2019-03-03 10:33:06,srvGroup=amqui,service=itatise,appName=utlab,event#=ostr,eventType=Logout,usrGroup=liqu,usrAuth=True,application=\"cons\",osUsername=apar,srcHost=ssusc1892.internal.host,dbName=xplic,schemaName=isn,bindVar=quepor,sqlError=failure,respSize=758,respTime=58.800000,affRows=etur,action=\"block\",rawQuery=\"cusan\"", "tags": [ @@ -722,7 +722,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.42.135.34,dstPort=4361,dbUsername=tiset,srcIP=10.178.190.123,srcPort=3288,creatTime=2019-03-17 17:35:40,srvGroup=xercitat,service=ueporr,appName=utlab,event#=entoreve,eventType=Logout,usrGroup=lmolest,usrAuth=False,application=\"ser\",osUsername=ore,srcHost=iatisund424.mail.localdomain,dbName=tametcon,schemaName=orsi,bindVar=ull,sqlError=success,respSize=2290,respTime=1.468000,affRows=etdolore,action=\"cancel\",rawQuery=\"ore\"", "tags": [ @@ -731,7 +731,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=ectetur,createTime=2019-04-01 00:38:14,eventType=cons,eventSev=medium,username=fugit,subsystem=dantiu,message=\"ntutla\"", "tags": [ @@ -740,7 +740,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.207.198.239,dstPort=4735,dbUsername=Loremips,srcIP=10.8.147.176,srcPort=5920,creatTime=15 April 2019 07:40:49,srvGroup=odtem,service=ite,appName=tseddo,event#=ptatems,eventType=Login,usrGroup=ori,usrAuth=False,application=\"exerc\",osUsername=aUteni,srcHost=uidolo7626.local,dbName=rchite,schemaName=incididu,bindVar=idolor,sqlError=failure,respSize=3043,respTime=36.712000,affRows=oinB,action=\"accept\",rawQuery=\"econsequ\"", "tags": [ @@ -749,7 +749,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.116.26.185,dstPort=595,dbUsername=oNe,srcIP=10.206.221.180,srcPort=6818,creatTime=2019-04-29 14:43:23,srvGroup=repr,service=idu,appName=otam,event#=amquaera,eventType=rumS,usrGroup=uelau,usrAuth=quidolor,application=\"cca\",osUsername=litesseq,srcHost=dmini3435.internal.domain,dbName=rumexerc,schemaName=nseq,bindVar=quisnost,sqlError=unknown,respSize=3218,respTime=26.485000,affRows=orisnisi,action=\"block\",rawQuery=\"nul\"", "tags": [ @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.86.180.150,dstPort=5495,dbUsername=mnisis,srcIP=10.253.127.130,srcPort=5339,creatTime=2019-05-13 21:45:57,srvGroup=isciveli,service=urve,appName=sundeomn,event#=tasu,eventType=Logout,usrGroup=equunt,usrAuth=True,application=\"uat\",osUsername=itasper,srcHost=nibusBo1864.domain,dbName=ent,schemaName=etconsec,bindVar=docons,sqlError=failure,respSize=4564,respTime=4.592000,affRows=mremap,action=\"allow\",rawQuery=\"sperna\"", "tags": [ @@ -767,7 +767,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=mexe,event#=sequatDu,createTime=2019-05-28 04:48:31,updateTime=ssuscip,alertSev=high,group=ciade,ruleName=\"busBonor\",evntDesc=\"enima\",category=emseq,disposition=osamni,eventType=umetMa,proto=ipv6-icmp,srcPort=4469,srcIP=10.220.175.201,dstPort=579,dstIP=10.158.161.5,policyName=\"eab\",occurrences=4098,httpHost=ciduntut,webMethod=atisu,url=\"https://internal.example.com/architec/incul.txt?aborios=mco#amnisiu\",webQuery=\"suntincu\",soapAction=lore,resultCode=equatu,sessionID=enbyCi,username=dolo,addUsername=adipi,responseTime=beata,responseSize=evelites,direction=inbound,dbUsername=tNeq,queryGroup=umtot,application=\"eumiurer\",srcHost=inv6528.www5.example,osUsername=rrors,schemaName=dolo,dbName=tsed,hdrName=corpori,action=allow", "tags": [ @@ -776,7 +776,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,event#=uioff,createTime=2019-06-11 11:51:06,eventType=ema,eventSev=low,username=mpo,subsystem=deritinv,message=\"ten\"", "tags": [ @@ -785,7 +785,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.150.27.144,dstPort=5627,dbUsername=res,srcIP=10.248.16.82,srcPort=6834,creatTime=25 June 2019 18:53:40,srvGroup=loinv,service=umd,appName=madmi,event#=xercit,eventType=Login,usrGroup=avolup,usrAuth=True,application=\"etdo\",osUsername=tuserror,srcHost=nisiutal4437.www.example,dbName=uipex,schemaName=ditautf,bindVar=orr,sqlError=failure,respSize=4367,respTime=25.972000,affRows=uptas,action=\"cancel\",rawQuery=\"osquira\"", "tags": [ @@ -794,7 +794,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.146.131.76,dstPort=2281,dbUsername=orsi,srcIP=10.173.19.140,srcPort=7780,creatTime=2019-07-10 01:56:14,srvGroup=atu,service=ddo,appName=veli,event#=ata,eventType=Logout,usrGroup=untmoll,usrAuth=False,application=\"ididun\",osUsername=olo,srcHost=tqui5172.www.local,dbName=untex,schemaName=Except,bindVar=elitsedd,sqlError=failure,respSize=5844,respTime=52.550000,affRows=cingel,action=\"allow\",rawQuery=\"seos\"", "tags": [ @@ -803,7 +803,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.69.5.227,dstPort=5845,dbUsername=doloreme,srcIP=10.171.175.165,srcPort=5776,creatTime=2019-07-24 08:58:48,srvGroup=taspe,service=litess,appName=enimadm,event#=corpori,eventType=onemull,usrGroup=emeu,usrAuth=uisaute,application=\"tvol\",osUsername=ntocc,srcHost=intocca6708.mail.corp,dbName=dquiaco,schemaName=rumw,bindVar=ula,sqlError=failure,respSize=5201,respTime=46.690000,affRows=quam,action=\"deny\",rawQuery=\"edquian\"", "tags": [ @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.213.214.118,dstPort=7851,dbUsername=ate,srcIP=10.253.175.129,srcPort=5547,creatTime=7 August 2019 16:01:23,srvGroup=rsi,service=tuser,appName=equinesc,event#=ectet,eventType=Login,usrGroup=emull,usrAuth=False,application=\"enatuser\",osUsername=epteurs,srcHost=isetqu2843.www.invalid,dbName=niamqu,schemaName=nrep,bindVar=lauda,sqlError=failure,respSize=6260,respTime=9.295000,affRows=aincidu,action=\"deny\",rawQuery=\"ipsamvol\"", "tags": [ @@ -821,7 +821,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=estquido,event#=eufugiat,createTime=2019-08-21 23:03:57,updateTime=minima,alertSev=high,group=bor,ruleName=\"uisnos\",evntDesc=\"loi\",category=tation,disposition=seddoe,eventType=adol,proto=rdp,srcPort=7756,srcIP=10.149.91.130,dstPort=3548,dstIP=10.89.26.170,policyName=\"aqueipsa\",occurrences=5863,httpHost=ide,webMethod=atcupi,url=\"https://www.example.com/sit/ugi.gif?sitametc=rur#edut\",webQuery=\"sitametc\",soapAction=iarchite,resultCode=uide,sessionID=iono,username=aboris,addUsername=eturad,responseTime=ipiscive,responseSize=sequu,direction=internal,dbUsername=epteur,queryGroup=iqu,application=\"uptateve\",srcHost=commodo6041.mail.localhost,osUsername=atus,schemaName=orumetMa,dbName=inventor,hdrName=dolo,action=block", "tags": [ @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=tmolli,event#=orumSe,createTime=2019-09-05 06:06:31,updateTime=mSe,alertSev=high,group=teturad,ruleName=\"alorumwr\",evntDesc=\"pis\",category=idol,disposition=mmodico,eventType=emaccu,proto=rdp,srcPort=5818,srcIP=10.52.106.68,dstPort=856,dstIP=10.81.108.232,policyName=\"atemq\",occurrences=5098,httpHost=volupta,webMethod=Quisaut,url=\"https://internal.example.net/obeatae/sedqui.jpg?nulap=onseq#amrem\",webQuery=\"plicab\",soapAction=isisten,resultCode=eiusmodt,sessionID=naaliq,username=aco,addUsername=psamvolu,responseTime=inculp,responseSize=eni,direction=inbound,dbUsername=sedqu,queryGroup=ipitlabo,application=\"olorinr\",srcHost=gitse6744.api.local,osUsername=neavolup,schemaName=uaturve,dbName=lapa,hdrName=uepor,action=\"allow\",errormsg=\"failure\"", "tags": [ @@ -839,7 +839,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=umquamei,event#=nih,createTime=2019-09-19 13:09:05,updateTime=tionev,alertSev=high,group=quia,ruleName=\"eabill\",evntDesc=\"itatiset\",category=uaerat,disposition=met,eventType=isno,proto=icmp,srcPort=2572,srcIP=10.230.48.97,dstPort=1991,dstIP=10.223.10.28,policyName=\"emveleu\",occurrences=4029,httpHost=norumet,webMethod=tconse,url=\"https://mail.example.com/iaturE/inc.htm?uisaut=mnihilm#itinvo\",webQuery=\"lestia\",soapAction=anti,resultCode=eavo,sessionID=enderi,username=erit,addUsername=uptatem,responseTime=reeufug,responseSize=temveleu,direction=unknown,dbUsername=repre,queryGroup=consec,application=\"untmoll\",srcHost=par3605.internal.localdomain,osUsername=usmodte,schemaName=untex,dbName=ommodi,hdrName=ntiu,action=\"deny\",errormsg=\"success\"", "tags": [ @@ -848,7 +848,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.115.42.231,dstPort=2143,dbUsername=res,srcIP=10.161.212.150,srcPort=2748,creatTime=3 October 2019 20:11:40,srvGroup=corporis,service=turExc,appName=urvelil,event#=ulapa,eventType=Login,usrGroup=abi,usrAuth=False,application=\"ameiusm\",osUsername=tasnul,srcHost=isau4356.www.home,dbName=niamqui,schemaName=sequamn,bindVar=onse,sqlError=failure,respSize=4846,respTime=6.993000,affRows=aliquaUt,action=\"deny\",rawQuery=\"natus\"", "tags": [ @@ -857,7 +857,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=emp,event#=suscipit,createTime=2019-10-18 03:14:14,updateTime=iaconseq,alertSev=medium,group=sciuntNe,ruleName=\"nevo\",evntDesc=\"stiaec\",category=officia,disposition=ametcon,eventType=gnid,proto=ipv6,srcPort=5677,srcIP=10.226.75.20,dstPort=3896,dstIP=10.247.108.144,policyName=\"iutaliqu\",occurrences=3711,httpHost=onsectet,webMethod=iat,url=\"https://www5.example.org/elaud/temsequ.htm?dolo=iciatisu#eip\",webQuery=\"iquaUte\",soapAction=aborumSe,resultCode=writt,sessionID=dent,username=tema,addUsername=saquaeab,responseTime=rpo,responseSize=inr,direction=internal,dbUsername=edquiac,queryGroup=olore,application=\"urEx\",srcHost=labo3477.www5.domain,osUsername=maccusan,schemaName=fugia,dbName=psa,hdrName=iset,action=\"block\",errormsg=\"success\"", "tags": [ @@ -866,7 +866,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.192.15.65,dstPort=3328,dbUsername=nimides,srcIP=10.97.22.61,srcPort=6420,creatTime=2019-11-01 10:16:48,srvGroup=labor,service=quelaud,appName=ira,event#=gna,eventType=aparia,usrGroup=ntoreve,usrAuth=remips,application=\"uptatemU\",osUsername=illumd,srcHost=itseddo2209.mail.domain,dbName=olu,schemaName=rExcep,bindVar=turExcep,sqlError=success,respSize=4173,respTime=166.270000,affRows=duntutla,action=\"block\",rawQuery=\"tmollit\"", "tags": [ @@ -875,7 +875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,alert#=venia,event#=Loremi,createTime=2019-11-15 17:19:22,updateTime=uisnostr,alertSev=medium,group=vol,ruleName=\"ommodi\",evntDesc=\"ritat\",category=dipi,disposition=asnulapa,eventType=atev,proto=tcp,srcPort=7469,srcIP=10.197.254.133,dstPort=2009,dstIP=10.116.76.161,policyName=\"tla\",occurrences=2608,httpHost=ender,webMethod=quid,url=\"https://mail.example.net/teturad/nimide.htm?ueporroq=writ#ema\",webQuery=\"ioffici\",soapAction=agni,resultCode=tat,sessionID=metconse,username=ide,addUsername=equu,responseTime=pernatur,responseSize=orem,direction=outbound,dbUsername=caecatc,queryGroup=iarc,application=\"emquia\",srcHost=duntutl3396.api.host,osUsername=idu,schemaName=trudex,dbName=ncul,hdrName=mcorpor,action=cancel", "tags": [ @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.28.77.79,dstPort=3615,dbUsername=upta,srcIP=10.144.14.15,srcPort=1150,creatTime=30 November 2019 00:21:57,srvGroup=consequ,service=min,appName=riame,event#=gnaal,eventType=Login,usrGroup=nti,usrAuth=True,application=\"tetura\",osUsername=utlab,srcHost=colabo6686.internal.invalid,dbName=uptass,schemaName=rspic,bindVar=itsedq,sqlError=success,respSize=4810,respTime=22.348000,affRows=iut,action=\"deny\",rawQuery=\"nemu\"", "tags": [ @@ -893,7 +893,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "%IMPERVA-Imperva,dstIP=10.248.177.182,dstPort=317,dbUsername=quei,srcIP=10.18.15.43,srcPort=2224,creatTime=2019-12-14 07:24:31,srvGroup=reetdol,service=umtotam,appName=itaedi,event#=ant,eventType=tiumt,usrGroup=taedicta,usrAuth=mveniamq,application=\"exerci\",osUsername=quaturve,srcHost=tsunti1164.www.example,dbName=equatur,schemaName=caecat,bindVar=oreetd,sqlError=unknown,respSize=983,respTime=113.318000,affRows=nderit,action=\"accept\",rawQuery=\"icer\"", "tags": [ diff --git a/packages/imperva/data_stream/securesphere/elasticsearch/ingest_pipeline/default.yml b/packages/imperva/data_stream/securesphere/elasticsearch/ingest_pipeline/default.yml index a0f0889abe0..2683719ea36 100644 --- a/packages/imperva/data_stream/securesphere/elasticsearch/ingest_pipeline/default.yml +++ b/packages/imperva/data_stream/securesphere/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Imperva SecureSphere processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # User agent - user_agent: field: user_agent.original diff --git a/packages/imperva/data_stream/securesphere/sample_event.json b/packages/imperva/data_stream/securesphere/sample_event.json index 72b814514e9..2399d293c01 100644 --- a/packages/imperva/data_stream/securesphere/sample_event.json +++ b/packages/imperva/data_stream/securesphere/sample_event.json @@ -19,7 +19,7 @@ "port": 892 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", diff --git a/packages/imperva/manifest.yml b/packages/imperva/manifest.yml index 015127beeb7..cb47abf9781 100644 --- a/packages/imperva/manifest.yml +++ b/packages/imperva/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.7.0 name: imperva title: Imperva SecureSphere Logs -version: "0.16.0" +version: "0.17.0" description: Collect SecureSphere logs from Imperva devices with Elastic Agent. categories: ["network", "security"] type: integration diff --git a/packages/infoblox_bloxone_ddi/_dev/build/build.yml b/packages/infoblox_bloxone_ddi/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/infoblox_bloxone_ddi/_dev/build/build.yml +++ b/packages/infoblox_bloxone_ddi/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/infoblox_bloxone_ddi/changelog.yml b/packages/infoblox_bloxone_ddi/changelog.yml index 943f30ce161..9b6de9e361d 100644 --- a/packages/infoblox_bloxone_ddi/changelog.yml +++ b/packages/infoblox_bloxone_ddi/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.7.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.6.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 - version: "1.5.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/_dev/test/pipeline/test-pipeline-dhcp-lease.log-expected.json b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/_dev/test/pipeline/test-pipeline-dhcp-lease.log-expected.json index c1554f962d8..e0006a589d9 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/_dev/test/pipeline/test-pipeline-dhcp-lease.log-expected.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/_dev/test/pipeline/test-pipeline-dhcp-lease.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -76,7 +76,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/elasticsearch/ingest_pipeline/default.yml b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/elasticsearch/ingest_pipeline/default.yml index 895a4d62585..30843506441 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/elasticsearch/ingest_pipeline/default.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing DHCP lease logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/manifest.yml b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/manifest.yml index e20b585cb8d..68f70169ee3 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/manifest.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Infoblox BloxOne DDI API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Infoblox BloxOne DDI API. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/sample_event.json b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/sample_event.json index 8bfdcd9b72b..ef0438369a4 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/sample_event.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dhcp_lease/sample_event.json @@ -19,7 +19,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_config/_dev/test/pipeline/test-pipeline-dns-config.log-expected.json b/packages/infoblox_bloxone_ddi/data_stream/dns_config/_dev/test/pipeline/test-pipeline-dns-config.log-expected.json index fd05dc9e92d..5d86f763608 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_config/_dev/test/pipeline/test-pipeline-dns-config.log-expected.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_config/_dev/test/pipeline/test-pipeline-dns-config.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -649,7 +649,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_config/elasticsearch/ingest_pipeline/default.yml b/packages/infoblox_bloxone_ddi/data_stream/dns_config/elasticsearch/ingest_pipeline/default.yml index 9574bd896cc..0ddd5ae5108 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_config/elasticsearch/ingest_pipeline/default.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_config/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing DNS config logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_config/manifest.yml b/packages/infoblox_bloxone_ddi/data_stream/dns_config/manifest.yml index df6534c41db..cecb208fb8c 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_config/manifest.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_config/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Infoblox BloxOne DDI API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Infoblox BloxOne DDI API. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_config/sample_event.json b/packages/infoblox_bloxone_ddi/data_stream/dns_config/sample_event.json index d3f734a193b..24f8c7bf0ae 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_config/sample_event.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_config/sample_event.json @@ -19,7 +19,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_data/_dev/test/pipeline/test-pipeline-dns-data.log-expected.json b/packages/infoblox_bloxone_ddi/data_stream/dns_data/_dev/test/pipeline/test-pipeline-dns-data.log-expected.json index 599dd2fe223..c89b0cf1648 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_data/_dev/test/pipeline/test-pipeline-dns-data.log-expected.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_data/_dev/test/pipeline/test-pipeline-dns-data.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -116,7 +116,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_data/elasticsearch/ingest_pipeline/default.yml b/packages/infoblox_bloxone_ddi/data_stream/dns_data/elasticsearch/ingest_pipeline/default.yml index 8aedc379e92..a4db04da8a0 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_data/elasticsearch/ingest_pipeline/default.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_data/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing DNS data logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_data/manifest.yml b/packages/infoblox_bloxone_ddi/data_stream/dns_data/manifest.yml index 3fc1d521c26..f165f4d058a 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_data/manifest.yml +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_data/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the BloxOne DDI API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the BloxOne DDI API. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/infoblox_bloxone_ddi/data_stream/dns_data/sample_event.json b/packages/infoblox_bloxone_ddi/data_stream/dns_data/sample_event.json index c20321510f3..7d7dd0e73a5 100644 --- a/packages/infoblox_bloxone_ddi/data_stream/dns_data/sample_event.json +++ b/packages/infoblox_bloxone_ddi/data_stream/dns_data/sample_event.json @@ -19,7 +19,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", diff --git a/packages/infoblox_bloxone_ddi/docs/README.md b/packages/infoblox_bloxone_ddi/docs/README.md index ad2592dcf98..e14c48063dd 100644 --- a/packages/infoblox_bloxone_ddi/docs/README.md +++ b/packages/infoblox_bloxone_ddi/docs/README.md @@ -73,7 +73,7 @@ An example event for `dhcp_lease` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", @@ -174,13 +174,13 @@ An example event for `dhcp_lease` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -255,7 +255,7 @@ An example event for `dns_config` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", @@ -930,10 +930,10 @@ An example event for `dns_config` looks as following: | dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1283,7 +1283,7 @@ An example event for `dns_data` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "e0bb9c9c-c3ad-47d7-882c-5fff0f458160", @@ -1433,10 +1433,10 @@ An example event for `dns_data` looks as following: | dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359.json b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359.json index 131915568d7..4ad26619c53 100644 --- a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359.json +++ b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Overview of Infoblox BloxOne DDI DHCP Lease.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0f39755d-9919-4b22-baf7-aaef264be212": { "columnOrder": [ @@ -90,7 +91,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -119,6 +120,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -149,7 +151,7 @@ "panelIndex": "787837bf-ae0a-4079-a028-2e31a1e3774e", "title": "Distribution of Events by Protocol [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -168,7 +170,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6c6f049f-acb4-4fcb-a794-5bc75829aa4c": { "columnOrder": [ @@ -183,7 +185,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "5575e5c2-6223-4317-9a33-5370ed22f610": { "customLabel": true, @@ -227,7 +229,9 @@ } ], "layerId": "6c6f049f-acb4-4fcb-a794-5bc75829aa4c", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -247,7 +251,7 @@ "panelIndex": "96e5e038-7865-4a0a-bdd3-8b915c7be91b", "title": "Top 10 Host Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -266,7 +270,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "19f9c3d5-3fd4-4142-92e2-1b3c57af397a": { "columnOrder": [ @@ -281,7 +285,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "f1f10540-9928-411e-afd6-9deed825c323": { "customLabel": true, @@ -317,15 +321,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f1f10540-9928-411e-afd6-9deed825c323" - ], "layerId": "19f9c3d5-3fd4-4142-92e2-1b3c57af397a", "layerType": "data", "legendDisplay": "default", - "metric": "17c881a1-b60e-430e-9836-de551602c8c3", + "legendSize": "auto", + "metrics": [ + "17c881a1-b60e-430e-9836-de551602c8c3" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f1f10540-9928-411e-afd6-9deed825c323" + ] } ], "shape": "pie" @@ -348,7 +355,7 @@ "panelIndex": "9baea1e0-7803-4bbe-b4e2-ed03e1589afa", "title": "Distribution of Events by Type [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -367,7 +374,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e0e5694c-e3bb-4186-9f26-7e734c94ad83": { "columnOrder": [ @@ -382,7 +389,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "bfb244af-5bbc-4f29-a50b-6d4bbabc1fcb": { "customLabel": true, @@ -418,15 +425,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "bfb244af-5bbc-4f29-a50b-6d4bbabc1fcb" - ], "layerId": "e0e5694c-e3bb-4186-9f26-7e734c94ad83", "layerType": "data", "legendDisplay": "default", - "metric": "a7b437d6-9d78-4392-980b-a8548cb5ac20", + "legendSize": "auto", + "metrics": [ + "a7b437d6-9d78-4392-980b-a8548cb5ac20" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bfb244af-5bbc-4f29-a50b-6d4bbabc1fcb" + ] } ], "shape": "pie" @@ -449,7 +459,7 @@ "panelIndex": "d9edc7fd-4587-4423-9f62-bb383b52ef28", "title": "Distribution of Events by Host [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -468,7 +478,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4f508d4b-b035-447c-98ea-d2072e82dd85": { "columnOrder": [ @@ -502,7 +512,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -531,6 +541,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -561,17 +572,18 @@ "panelIndex": "68968f24-d04d-4f57-a575-4a82672e67eb", "title": "Distribution of Events by State [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox BloxOne DDI] DHCP Lease", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:00:33.194Z", "id": "infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359.json b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359.json index 0149503e679..fffe59bbd2f 100644 --- a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359.json +++ b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Overview of Infoblox BloxOne DDI DNS Data.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "492dce9b-ecc9-466a-ad17-c801a56b2578": { "columnOrder": [ @@ -71,7 +72,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "f5b2adb7-c7f0-47d1-afef-cffbe74cbed3": { "customLabel": true, @@ -119,6 +120,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -149,7 +151,7 @@ "panelIndex": "d0d0f6b9-d632-47de-bcc6-54bce4e679f2", "title": "Distribution of Events by TTL Action [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -168,7 +170,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4948d9b6-bab5-48f2-a031-46e87a884637": { "columnOrder": [ @@ -183,7 +185,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "eb2e31f6-4e2c-4eaf-8120-fa19e2db7008": { "customLabel": true, @@ -227,7 +229,9 @@ } ], "layerId": "4948d9b6-bab5-48f2-a031-46e87a884637", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -247,7 +251,7 @@ "panelIndex": "7eb4f1b6-29ea-45f9-bab5-a0343594726b", "title": "Top 10 TTL Source Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -266,7 +270,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c0b7ca44-dfc2-4e69-9fdf-a67439d1b290": { "columnOrder": [ @@ -281,7 +285,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "af4e6514-1ab8-4963-994e-f25bee46936b": { "customLabel": true, @@ -317,15 +321,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "af4e6514-1ab8-4963-994e-f25bee46936b" - ], "layerId": "c0b7ca44-dfc2-4e69-9fdf-a67439d1b290", "layerType": "data", "legendDisplay": "default", - "metric": "83233299-085a-4f13-8916-0f254e2fbb7a", + "legendSize": "auto", + "metrics": [ + "83233299-085a-4f13-8916-0f254e2fbb7a" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "af4e6514-1ab8-4963-994e-f25bee46936b" + ] } ], "shape": "pie" @@ -348,7 +355,7 @@ "panelIndex": "a8079745-b78b-4daa-bb29-638e498e4c96", "title": "Distribution of Events by DNS Absolute Zone Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -367,7 +374,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "040c65c3-7b12-43b0-bfa5-e2c535634de6": { "columnOrder": [ @@ -401,7 +408,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -418,15 +425,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "232a8505-70be-447c-9286-218aeaabddc7" - ], "layerId": "040c65c3-7b12-43b0-bfa5-e2c535634de6", "layerType": "data", "legendDisplay": "default", - "metric": "ec8a44d6-1b97-4077-9e93-986973e7acff", + "legendSize": "auto", + "metrics": [ + "ec8a44d6-1b97-4077-9e93-986973e7acff" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "232a8505-70be-447c-9286-218aeaabddc7" + ] } ], "shape": "pie" @@ -449,7 +459,7 @@ "panelIndex": "fecabbc6-727d-4798-8eaa-f5f553a53d47", "title": "Distribution of Events by Type [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -468,7 +478,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7db7df97-c91b-417a-a146-72c6f2ac8d91": { "columnOrder": [ @@ -502,7 +512,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -519,15 +529,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "5a0c5a1b-a645-4579-a7b4-d24d4d128175" - ], "layerId": "7db7df97-c91b-417a-a146-72c6f2ac8d91", "layerType": "data", "legendDisplay": "default", - "metric": "e1bea059-147f-4dea-a55f-f3d1a5f41e2e", + "legendSize": "auto", + "metrics": [ + "e1bea059-147f-4dea-a55f-f3d1a5f41e2e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "5a0c5a1b-a645-4579-a7b4-d24d4d128175" + ] } ], "shape": "pie" @@ -550,7 +563,7 @@ "panelIndex": "63226a08-6f74-4817-9a08-21d93d3dc00f", "title": "Distribution of Events by View Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -569,7 +582,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a6b9c902-06c7-4274-8831-8fab7e860319": { "columnOrder": [ @@ -603,7 +616,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -628,7 +641,9 @@ } ], "layerId": "a6b9c902-06c7-4274-8831-8fab7e860319", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -648,7 +663,7 @@ "panelIndex": "8f0234c4-f3f1-48c8-8f43-4731cd958b70", "title": "Top 10 Host Address [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -667,7 +682,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1cb8734b-97ec-4693-916c-950178d12555": { "columnOrder": [ @@ -682,7 +697,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "9a412a97-ba89-4765-8f22-0413ec2db942": { "customLabel": true, @@ -718,15 +733,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "9a412a97-ba89-4765-8f22-0413ec2db942" - ], "layerId": "1cb8734b-97ec-4693-916c-950178d12555", "layerType": "data", "legendDisplay": "default", - "metric": "5324359a-19f9-4039-be9b-2817abe8d788", + "legendSize": "auto", + "metrics": [ + "5324359a-19f9-4039-be9b-2817abe8d788" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "9a412a97-ba89-4765-8f22-0413ec2db942" + ] } ], "shape": "pie" @@ -749,7 +767,7 @@ "panelIndex": "a549ae88-b384-4a37-bbe9-8d5fd54f1a2b", "title": "Distribution of Events by Resource Record Value [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -768,7 +786,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "42c0d34a-142e-4761-8619-137862ca3e49": { "columnOrder": [ @@ -783,7 +801,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "e47e7765-58a0-4694-ba84-1c973f735455": { "customLabel": true, @@ -831,6 +849,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -861,7 +880,7 @@ "panelIndex": "ab1a9322-c074-44d4-a12c-d6b4d394b8fd", "title": "Distribution of Events by Canonical Owner Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -880,7 +899,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9011083b-774e-4cc5-a099-ac6130fce672": { "columnOrder": [ @@ -895,7 +914,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b9a3ffe3-6c09-4a3f-bcb8-cff54b24a9b1": { "customLabel": true, @@ -931,15 +950,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b9a3ffe3-6c09-4a3f-bcb8-cff54b24a9b1" - ], "layerId": "9011083b-774e-4cc5-a099-ac6130fce672", "layerType": "data", "legendDisplay": "default", - "metric": "27a04a1c-883b-4514-bf1d-0f51885ed8f6", + "legendSize": "auto", + "metrics": [ + "27a04a1c-883b-4514-bf1d-0f51885ed8f6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b9a3ffe3-6c09-4a3f-bcb8-cff54b24a9b1" + ] } ], "shape": "pie" @@ -962,17 +984,18 @@ "panelIndex": "00a91cfd-1761-4308-8443-b2a2208c8630", "title": "Distribution of Events by Resource Record Type [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox BloxOne DDI] DNS Data", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:00:42.067Z", "id": "infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359.json b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359.json index cd66b75d493..1767d1915c3 100644 --- a/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359.json +++ b/packages/infoblox_bloxone_ddi/kibana/dashboard/infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Overview of Infoblox BloxOne DDI DNS Config.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cba386eb-2f07-4c35-9a1c-57937a5d37db": { "columnOrder": [ @@ -71,7 +72,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "46922848-22a1-4583-add0-66c83d05e7fc": { "customLabel": true, @@ -115,7 +116,9 @@ } ], "layerId": "cba386eb-2f07-4c35-9a1c-57937a5d37db", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -135,7 +138,7 @@ "panelIndex": "8a5670b8-9772-40e6-adc9-743fddfcb93a", "title": "Top 10 Custom Root Name Server FQDN [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -154,7 +157,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "49c44c59-cb39-48ca-8c38-6d604857fae7": { "columnOrder": [ @@ -188,7 +191,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -205,15 +208,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6945ac46-ff4f-4d1c-9314-1e8ddbf0d3a6" - ], "layerId": "49c44c59-cb39-48ca-8c38-6d604857fae7", "layerType": "data", "legendDisplay": "default", - "metric": "707209ce-b61a-4765-9303-530ed1a26b33", + "legendSize": "auto", + "metrics": [ + "707209ce-b61a-4765-9303-530ed1a26b33" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6945ac46-ff4f-4d1c-9314-1e8ddbf0d3a6" + ] } ], "shape": "pie" @@ -236,7 +242,7 @@ "panelIndex": "9367e11d-a6ff-4e4d-8c91-ab8c3aa3bd28", "title": "Distribution of Events by Outgoing Query Action [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -255,7 +261,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "dd5c94ed-e107-49e3-ab06-d9cb924653ed": { "columnOrder": [ @@ -270,7 +276,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "cc7b0f96-eddc-4c03-84fc-3d4d28167d63": { "customLabel": true, @@ -318,6 +324,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -348,80 +355,143 @@ "panelIndex": "d6f2c59a-ce94-4356-98af-91e7bc6cceed", "title": "Distribution of Events by ECS Block Action [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "" - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d90ac07a-579d-497e-b3b4-10913e5174d3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d90ac07a-579d-497e-b3b4-10913e5174d3": { + "columnOrder": [ + "ac666f11-85af-4d06-b512-3973d0033bf0", + "01cd35f7-1488-4e41-98c8-59521158d979" + ], + "columns": { + "01cd35f7-1488-4e41-98c8-59521158d979": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ac666f11-85af-4d06-b512-3973d0033bf0": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Custom Root Name Server Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "01cd35f7-1488-4e41-98c8-59521158d979", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "infoblox_bloxone_ddi.dns_config.custom_root_ns.address" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Custom Root Name Server Address", - "field": "infoblox_bloxone_ddi.dns_config.custom_root_ns.address", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + "textBased": { + "layers": {} } - } - }, - "description": "", - "id": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" }, - "scale": "linear", - "showLabel": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "01cd35f7-1488-4e41-98c8-59521158d979" + ], + "layerId": "d90ac07a-579d-497e-b3b4-10913e5174d3", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "ac666f11-85af-4d06-b512-3973d0033bf0" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, "title": "", - "type": "tagcloud", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "9d6f4983-8608-429b-95e7-56117041b778", + "i": "dd7a25f6-48ce-404d-8f68-cbfc6d8928df", "w": 24, "x": 24, "y": 15 }, - "panelIndex": "9d6f4983-8608-429b-95e7-56117041b778", + "panelIndex": "dd7a25f6-48ce-404d-8f68-cbfc6d8928df", "title": "Top Custom Root Name Server Address [Logs Infoblox BloxOne DDI]", - "type": "visualization", - "version": "7.17.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -440,7 +510,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "eb849a44-0dfe-427d-99dd-be95e3050965": { "columnOrder": [ @@ -474,7 +544,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -503,6 +573,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -533,7 +604,7 @@ "panelIndex": "f6643ae2-2e62-46ae-a200-5012ac25de36", "title": "Distribution of Events by ECS Zone Access [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -546,47 +617,47 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6b2013f5-e5d1-45e6-8760-439e960800f3", + "name": "indexpattern-datasource-layer-4f221e65-f5b8-446f-90d3-a05571f889ed", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "6b2013f5-e5d1-45e6-8760-439e960800f3": { + "4f221e65-f5b8-446f-90d3-a05571f889ed": { "columnOrder": [ - "bed778ca-a359-43be-ad4c-5e32e7ba22d8", - "6121b332-c55b-4b89-b3d3-45dbd76c1cfe" + "8235e883-949c-4216-ba74-cd53c5ad3b41", + "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c" ], "columns": { - "6121b332-c55b-4b89-b3d3-45dbd76c1cfe": { + "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "bed778ca-a359-43be-ad4c-5e32e7ba22d8": { + "8235e883-949c-4216-ba74-cd53c5ad3b41": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Outgoing Query Source", + "label": "Protocol Mname", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "6121b332-c55b-4b89-b3d3-45dbd76c1cfe", + "columnId": "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, - "size": 10 + "otherBucket": true, + "size": 5 }, "scale": "ordinal", - "sourceField": "infoblox_bloxone_ddi.dns_config.inheritance.sources.add_edns.option_in.outgoing_query.source" + "sourceField": "infoblox_bloxone_ddi.dns_config.zone_authority.protocol.mname" } }, "incompleteColumns": {} @@ -600,38 +671,44 @@ "query": "" }, "visualization": { - "columns": [ - { - "columnId": "bed778ca-a359-43be-ad4c-5e32e7ba22d8", - "isTransposed": false - }, + "layers": [ { - "columnId": "6121b332-c55b-4b89-b3d3-45dbd76c1cfe", - "isTransposed": false + "categoryDisplay": "default", + "layerId": "4f221e65-f5b8-446f-90d3-a05571f889ed", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "8235e883-949c-4216-ba74-cd53c5ad3b41" + ] } ], - "layerId": "6b2013f5-e5d1-45e6-8760-439e960800f3", - "layerType": "data" + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "3ef011d9-9870-4357-bf7b-8b4baa0ae570", + "i": "2f7542b5-9c17-4e1c-944d-3820afa497ce", "w": 24, - "x": 24, - "y": 30 + "x": 0, + "y": 45 }, - "panelIndex": "3ef011d9-9870-4357-bf7b-8b4baa0ae570", - "title": "Top 10 Outgoing Query Source [Logs Infoblox BloxOne DDI]", + "panelIndex": "2f7542b5-9c17-4e1c-944d-3820afa497ce", + "title": "Distribution of Events by Zone Authority Master Name [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -644,47 +721,47 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-4f221e65-f5b8-446f-90d3-a05571f889ed", + "name": "indexpattern-datasource-layer-6b2013f5-e5d1-45e6-8760-439e960800f3", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "4f221e65-f5b8-446f-90d3-a05571f889ed": { + "6b2013f5-e5d1-45e6-8760-439e960800f3": { "columnOrder": [ - "8235e883-949c-4216-ba74-cd53c5ad3b41", - "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c" + "bed778ca-a359-43be-ad4c-5e32e7ba22d8", + "6121b332-c55b-4b89-b3d3-45dbd76c1cfe" ], "columns": { - "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c": { + "6121b332-c55b-4b89-b3d3-45dbd76c1cfe": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "8235e883-949c-4216-ba74-cd53c5ad3b41": { + "bed778ca-a359-43be-ad4c-5e32e7ba22d8": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Protocol Mname", + "label": "Outgoing Query Source", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c", + "columnId": "6121b332-c55b-4b89-b3d3-45dbd76c1cfe", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, - "size": 5 + "otherBucket": false, + "size": 10 }, "scale": "ordinal", - "sourceField": "infoblox_bloxone_ddi.dns_config.zone_authority.protocol.mname" + "sourceField": "infoblox_bloxone_ddi.dns_config.inheritance.sources.add_edns.option_in.outgoing_query.source" } }, "incompleteColumns": {} @@ -698,41 +775,40 @@ "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "groups": [ - "8235e883-949c-4216-ba74-cd53c5ad3b41" - ], - "layerId": "4f221e65-f5b8-446f-90d3-a05571f889ed", - "layerType": "data", - "legendDisplay": "default", - "metric": "33c6bac1-bfb5-4b6c-a4e5-e85a5193621c", - "nestedLegend": false, - "numberDisplay": "percent" + "columnId": "bed778ca-a359-43be-ad4c-5e32e7ba22d8", + "isTransposed": false + }, + { + "columnId": "6121b332-c55b-4b89-b3d3-45dbd76c1cfe", + "isTransposed": false } ], - "shape": "pie" + "layerId": "6b2013f5-e5d1-45e6-8760-439e960800f3", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "2f7542b5-9c17-4e1c-944d-3820afa497ce", + "i": "3ef011d9-9870-4357-bf7b-8b4baa0ae570", "w": 24, - "x": 0, - "y": 45 + "x": 24, + "y": 30 }, - "panelIndex": "2f7542b5-9c17-4e1c-944d-3820afa497ce", - "title": "Distribution of Events by Zone Authority Master Name [Logs Infoblox BloxOne DDI]", + "panelIndex": "3ef011d9-9870-4357-bf7b-8b4baa0ae570", + "title": "Top 10 Outgoing Query Source [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -751,7 +827,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ca4bfffe-6a9f-413a-869c-58d1646363f2": { "columnOrder": [ @@ -766,7 +842,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "f15cb334-4cde-4a69-ac70-14739f098e98": { "customLabel": true, @@ -802,15 +878,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f15cb334-4cde-4a69-ac70-14739f098e98" - ], "layerId": "ca4bfffe-6a9f-413a-869c-58d1646363f2", "layerType": "data", "legendDisplay": "default", - "metric": "5f223db3-7560-49ec-a024-7266360e5e5f", + "legendSize": "auto", + "metrics": [ + "5f223db3-7560-49ec-a024-7266360e5e5f" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f15cb334-4cde-4a69-ac70-14739f098e98" + ] } ], "shape": "pie" @@ -833,7 +912,7 @@ "panelIndex": "2c27ed27-b814-4462-bd64-e99cd0d4f363", "title": "Distribution of Events by Default TTL source [Logs Infoblox BloxOne DDI]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -849,17 +928,18 @@ "panelIndex": "f288d1dd-c4dc-472c-a7ac-6c5173b348a1", "panelRefName": "panel_f288d1dd-c4dc-472c-a7ac-6c5173b348a1", "type": "search", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox BloxOne DDI] DNS Config", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:05:54.651Z", "id": "infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { @@ -899,7 +979,7 @@ }, { "id": "logs-*", - "name": "9d6f4983-8608-429b-95e7-56117041b778:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "dd7a25f6-48ce-404d-8f68-cbfc6d8928df:indexpattern-datasource-layer-d90ac07a-579d-497e-b3b4-10913e5174d3", "type": "index-pattern" }, { @@ -914,22 +994,22 @@ }, { "id": "logs-*", - "name": "3ef011d9-9870-4357-bf7b-8b4baa0ae570:indexpattern-datasource-current-indexpattern", + "name": "2f7542b5-9c17-4e1c-944d-3820afa497ce:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "3ef011d9-9870-4357-bf7b-8b4baa0ae570:indexpattern-datasource-layer-6b2013f5-e5d1-45e6-8760-439e960800f3", + "name": "2f7542b5-9c17-4e1c-944d-3820afa497ce:indexpattern-datasource-layer-4f221e65-f5b8-446f-90d3-a05571f889ed", "type": "index-pattern" }, { "id": "logs-*", - "name": "2f7542b5-9c17-4e1c-944d-3820afa497ce:indexpattern-datasource-current-indexpattern", + "name": "3ef011d9-9870-4357-bf7b-8b4baa0ae570:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "2f7542b5-9c17-4e1c-944d-3820afa497ce:indexpattern-datasource-layer-4f221e65-f5b8-446f-90d3-a05571f889ed", + "name": "3ef011d9-9870-4357-bf7b-8b4baa0ae570:indexpattern-datasource-layer-6b2013f5-e5d1-45e6-8760-439e960800f3", "type": "index-pattern" }, { diff --git a/packages/infoblox_bloxone_ddi/kibana/search/infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe.json b/packages/infoblox_bloxone_ddi/kibana/search/infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe.json index 0dfb5ee0c1d..829582770e2 100644 --- a/packages/infoblox_bloxone_ddi/kibana/search/infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe.json +++ b/packages/infoblox_bloxone_ddi/kibana/search/infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe.json @@ -26,10 +26,11 @@ ], "title": "DNS Config Events by Protocol Zone [Logs Infoblox BloxOne DDI]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T03:59:42.787Z", "id": "infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_bloxone_ddi/kibana/tags.yml b/packages/infoblox_bloxone_ddi/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/infoblox_bloxone_ddi/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/infoblox_bloxone_ddi/manifest.yml b/packages/infoblox_bloxone_ddi/manifest.yml index 2b030629463..94cbdd68127 100644 --- a/packages/infoblox_bloxone_ddi/manifest.yml +++ b/packages/infoblox_bloxone_ddi/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: infoblox_bloxone_ddi title: Infoblox BloxOne DDI -version: "1.5.0" +version: "1.10.0" description: Collect logs from Infoblox BloxOne DDI with Elastic Agent. type: integration categories: @@ -9,7 +9,8 @@ categories: - network - dns_security conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/infoblox-bloxone-ddi-screenshot.png title: Infoblox BloxOne DDI dashboard screenshot @@ -89,3 +90,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/infoblox_nios/_dev/build/build.yml b/packages/infoblox_nios/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/infoblox_nios/_dev/build/build.yml +++ b/packages/infoblox_nios/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/infoblox_nios/changelog.yml b/packages/infoblox_nios/changelog.yml index d23427d8011..f45239b4bcf 100644 --- a/packages/infoblox_nios/changelog.yml +++ b/packages/infoblox_nios/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.11.0" + changes: + - description: Update package spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7057 +- version: "1.10.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6901 - version: "1.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json index 13ac20b668a..fd7d460a49a 100644 --- a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-03-18T13:24:41.705Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logout", @@ -57,7 +57,7 @@ { "@timestamp": "2022-04-13T16:44:36.850Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_denied", @@ -70,7 +70,9 @@ }, "host": { "domain": "ns1.infoblox.localdomain", - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -112,7 +114,7 @@ { "@timestamp": "2022-03-21T08:53:51.087Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_allowed", @@ -128,7 +130,9 @@ }, "host": { "domain": "infoblox.localdomain", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -171,7 +175,7 @@ { "@timestamp": "2011-10-19T19:48:37.299Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_allowed", @@ -186,7 +190,9 @@ ] }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -224,7 +230,7 @@ { "@timestamp": "2011-10-19T14:02:32.750Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login_denied", @@ -236,7 +242,9 @@ "outcome": "failure" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -273,7 +281,7 @@ { "@timestamp": "2011-10-19T12:43:47.375Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "first_login", @@ -281,7 +289,9 @@ "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 12:43:47.375Z [user]: First_Login - - to=AdminConnector ip=10.0.0.2 auth=LOCAL group=admin-group apparently_via=GUI\\040first\\040login" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -321,7 +331,7 @@ { "@timestamp": "2011-10-19T13:07:33.343Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password_reset_error", @@ -329,7 +339,9 @@ "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 13:07:33.343Z [user]: Password_Reset_Error - - to=AdminConnector auth=LOCALgroup=admin-group apparently_via=GUI" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -366,7 +378,7 @@ { "@timestamp": "2022-03-21T17:19:02.204Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified", @@ -374,7 +386,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-21 17:19:02.204Z [admin]: Modified Network 192.168.0.0/24 network_view=default: Changed dhcp_members:[]-\u003e[[grid_member=Member:infoblox.localdomain]]" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -413,7 +427,7 @@ { "@timestamp": "2022-03-24T09:37:29.261Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -421,7 +435,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-24 09:37:29.261Z [admin]: Created Network 192.168.0.0/24 network_view=default: Set extensible_attributes=[],address=\"192.168.2.0\",auto_create_reversezone=False,cidr=24,comment=\"\",common_properties=[domain_name_servers=[],routers=[]],dhcp_members=[[grid_member=Member:infoblox.localdomain]],disabled=False,discovery_member=NULL,enable_discovery=False,enable_immediate_discovery=False,network_view=NetworkView:default,use_basic_polling_settings=False,use_member_enable_discovery=False,vlans=[]" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -460,7 +476,7 @@ { "@timestamp": "2022-03-18T11:46:38.877Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified", @@ -468,7 +484,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-18 11:46:38.877Z [admin]: Modified MemberDhcp infoblox.localdomain: Changed enable_service:False-\u003eTrue" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -507,7 +525,7 @@ { "@timestamp": "2022-03-29T19:29:20.468Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "called", @@ -515,7 +533,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-29 19:29:20.468Z [admin]: Called - RestartService: Args services=[\"ALL\"],parents=[],force=True,mode=\"GROUPED\"" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -553,7 +573,7 @@ { "@timestamp": "2022-03-29T18:30:58.656Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -561,7 +581,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-29 18:30:58.656Z [admin]: Created Ruleset Block: Set comment=\"\",disabled=True,name=\"Block\",type=\"BLACKLIST\"" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -600,7 +622,7 @@ { "@timestamp": "2022-03-24T09:28:24.476Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "called", @@ -608,7 +630,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-24 09:28:24.476Z [admin]: Called - TransferTrafficCapture message=Download\\040Traffic\\040capture\\040file: Args message=\"Download Traffic capture file\",members=[Member:infoblox.localdomain]" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -646,7 +670,7 @@ { "@timestamp": "2022-03-21T15:08:08.238Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -654,7 +678,9 @@ "original": "\u003c29\u003eMar 21 16:08:08 10.0.0.1 httpd: 2022-03-21 15:08:08.238Z [service_account_test]: Created HostAddress 10.0.0.1 network_view=default: Set address=\"10.0.0.1\",configure_for_dhcp=False,match_option=\"MAC_ADDRESS\",parent=HostRecord:._default.tld.domain.subdomain.hostrecord" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -693,7 +719,7 @@ { "@timestamp": "2022-03-21T15:08:08.239Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -701,7 +727,9 @@ "original": "\u003c29\u003eMar 21 16:08:08 10.0.0.1 httpd: 2022-03-21 15:08:08.239Z [service_account_test]: Created HostRecord somerecord.subdomain.domain.tld DnsView=default alias=somealias.subdomain.domain.tld address=10.0.0.1: Set extensible_attributes=[[name=\"NAC-Policy\",value=\"Host\"]],addresses=[address=\"10.0.0.1\"],aliases=[HostAlias:._default.tld.domain.subdomain.somealias.._default.tld.domain.subdomain.somehostrecord],fqdn=\"somerecord.subdomain.domain.tld\"" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -740,7 +768,7 @@ { "@timestamp": "2022-03-21T15:08:48.455Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", @@ -748,7 +776,9 @@ "original": "\u003c29\u003eMar 21 16:08:48 10.0.0.1 httpd: 2022-03-21 15:08:48.455Z [service_account_test]: Deleted HostRecord somerecord.subdomain.domain.tld DnsView=default address=10.0.0.0" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -787,7 +817,7 @@ { "@timestamp": "2022-03-22T13:26:54.596Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted", @@ -795,7 +825,9 @@ "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2022-03-22 13:26:54.596Z [some_admin_account]: Deleted CaaRecord somecaarecord.domain.tld DnsView=default " }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -834,7 +866,7 @@ { "@timestamp": "2022-03-22T13:26:54.596Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -842,7 +874,9 @@ "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2022-03-22 13:26:54.596Z [some_admin_account]: Created HostAddress 192.168.0.0 network_view=default: Set address=\"192.168.0.0\",configure_for_dhcp=True,mac_address=\"01:01:01:01:01:01\",match_option=\"MAC_ADDRESS\",network=Network:192.168.0.0/24\\054network_view\\075default,parent=HostRecord:._default.test.test3,reserved_interface=NULL,use_for_ea_inheritance=True" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -881,7 +915,7 @@ { "@timestamp": "2022-03-22T13:26:54.596Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified", @@ -889,7 +923,9 @@ "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2022-03-22 13:26:54.596Z [some_admin_account]: Modified Network 192.168.0.0/24 network_view=default: Changed dhcp_members:[]-\u003e[[grid_member=Member:infoblox.localdomain]]" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -928,7 +964,7 @@ { "@timestamp": "2022-03-18T12:40:05.241Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified", @@ -936,7 +972,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-18 12:40:05.241Z [adminuser]: Modified Grid Unibe-DNS-Grid: Changed backup_setting:[password=\"******\",restore_password=\"******\"]-\u003e[password=\"******\",restore_password=\"******\"],csp_api_config:[password=\"******\"]-\u003e[password=\"******\"],csp_settings:[csp_join_token=\"******\"]-\u003e[csp_join_token=\"******\"],download_member_conf:[[interface=\"ANY\",is_online=True,member=\"Member:Grid Master\"]]-\u003e[[interface=\"ANY\",is_online=True,member=NULL]],email_setting:[password=\"******\"]-\u003e[password=\"******\"],http_proxy_server_setting:NULL-\u003e[password=\"******\"],snmp_setting:[snmpv3_queries_users=NULL]-\u003e[snmpv3_queries_users=[]],syslog_servers:[[address=\"67.43.156.15\"],[address=\"67.43.156.15\"]]-\u003e[[address=\"67.43.156.15\"]]" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -975,14 +1013,16 @@ { "@timestamp": "2023-03-18T13:40:05.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-18T13:40:05.000Z", "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 syslog: any random text" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1007,7 +1047,7 @@ { "@timestamp": "2022-03-29T19:29:20.468Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "called", @@ -1015,7 +1055,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-29 19:29:20.468Z [admin]: Called - RestartService" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1050,7 +1092,7 @@ { "@timestamp": "2022-03-21T17:19:02.204Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified", @@ -1058,7 +1100,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-21 17:19:02.204Z [admin]: Modified Network" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1093,7 +1137,7 @@ { "@timestamp": "2022-03-29T18:30:58.656Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created", @@ -1101,7 +1145,9 @@ "original": "\u003c29\u003eMar 18 13:40:05 10.0.0.1 httpd: 2022-03-29 18:30:58.656Z [admin]: Created Ruleset" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { diff --git a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dhcp.log-expected.json b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dhcp.log-expected.json index fa3b99a0d94..7bfd663dfd2 100644 --- a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dhcp.log-expected.json +++ b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dhcp.log-expected.json @@ -7,7 +7,7 @@ "mac": "00-50-56-81-14-6C" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -15,7 +15,9 @@ "original": "\u003c30\u003eApr 18 05:02:05 10.50.1.227 dhcpd[2301]: DHCPREQUEST for 192.168.0.4 from 00:50:56:81:14:6c via eth3" }, "host": { - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -52,7 +54,7 @@ "mac": "00-50-56-81-14-6C" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -60,7 +62,9 @@ "original": "\u003c30\u003eApr 18 05:02:05 10.50.1.227 dhcpd[2301]: DHCPREQUEST for 192.168.0.4 from 00:50:56:81:14:6c via 192.168.0.2" }, "host": { - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -99,7 +103,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdiscover", @@ -148,7 +152,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdiscover", @@ -157,7 +161,9 @@ }, "host": { "domain": "infoblox.localdomain", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -199,7 +205,7 @@ "mac": "00-50-56-83-D0-F6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdiscover", @@ -207,7 +213,9 @@ "original": "\u003c30\u003eMar 27 08:32:59 10.0.0.1 dhcpd[2750]: DHCPDISCOVER from 00:50:56:83:d0:f6 via eth1 TransID 6214ab45: network 10.50.0.0/20: no free leases" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -249,7 +257,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdiscover", @@ -295,7 +303,7 @@ "mac": "00-00-00-00-00-00" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdiscover", @@ -347,7 +355,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -410,7 +418,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -472,7 +480,7 @@ "mac": "26-9A-76-87-8A-06" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -480,7 +488,9 @@ "original": "\u003c30\u003eMar 31 15:30:05 10.0.0.1 dhcpd[15752]: DHCPOFFER on 192.168.0.4 to 26:9a:76:87:8a:06 via eth2 relay 192.168.0.3 lease-duration 1795 uid 01:26:9a:76:87:8a:06" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -529,7 +539,7 @@ "mac": "00-00-00-00-00-00" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -590,7 +600,7 @@ "mac": "CC-BB-CC-DD-EE-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -648,7 +658,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -708,7 +718,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -765,7 +775,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -821,7 +831,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -872,7 +882,7 @@ "mac": "00-50-56-83-D3-83" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -929,7 +939,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -985,7 +995,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -1039,7 +1049,7 @@ "mac": "00-50-56-83-96-03" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -1092,7 +1102,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -1142,7 +1152,7 @@ "mac": "9A-DF-6E-F6-1F-23" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -1150,7 +1160,9 @@ "original": "\u003c30\u003eMar 31 15:30:06 10.0.0.1 dhcpd[15752]: DHCPREQUEST for 192.168.0.4 from 9a:df:6e:f6:1f:23 via 172.26.0.1 TransID 15ca711f uid 01:9a:df:6e:f6:1f:23 (RENEW)" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1195,7 +1207,7 @@ "mac": "00-00-00-00-00-00" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprequest", @@ -1253,7 +1265,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1314,7 +1326,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1374,7 +1386,7 @@ "mac": "9A-DF-6E-F6-1F-23" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpoffer", @@ -1382,7 +1394,9 @@ "original": "\u003c30\u003eJul 12 15:07:57 67.43.156.0 dhcpd[8061]: DHCPOFFER on 67.43.156.0 to 9a:df:6e:f6:1f:23 via eth2 relay 67.43.156.0 lease-duration 40977 offered-duration 43200 uid 01:9a:df:6e:f6:1f:23" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -1432,7 +1446,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1491,7 +1505,7 @@ "mac": "9A-DF-6E-F6-1F-23" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1499,7 +1513,9 @@ "original": "\u003c30\u003eMar 27 08:32:59 10.0.0.1 dhcpd[15752]: DHCPACK on 192.168.0.4 to 9a:df:6e:f6:1f:23 via eth2 relay 192.168.0.3 lease-duration 7257600 (RENEW) uid 01:9a:df:6e:f6:1f:23" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1549,7 +1565,7 @@ "mac": "00-00-00-00-00-00" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1610,7 +1626,7 @@ "mac": "9A-DF-6E-F6-1F-23" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1618,7 +1634,9 @@ "original": "\u003c30\u003eJul 12 15:10:48 67.43.156.0 dhcpd[13468]: DHCPACK on 67.43.156.0 to 9a:df:6e:f6:1f:23 via eth2 relay 67.43.156.0 lease-duration 7257600 (RENEW)" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -1665,7 +1683,7 @@ "mac": "CC-BB-CC-DD-EE-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -1723,7 +1741,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprelease", @@ -1779,7 +1797,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcprelease", @@ -1832,7 +1850,7 @@ "mac": "00-50-56-83-6C-A0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpexpire", @@ -1875,7 +1893,7 @@ "ip": "192.168.0.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpinform", @@ -1883,7 +1901,9 @@ "original": "\u003c30\u003eMar 18 13:35:15 10.0.0.1 dhcpd[18078]: DHCPINFORM from 192.168.0.4 via 192.168.0.2 TransID 5713b740" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1923,7 +1943,7 @@ "ip": "192.168.0.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpinform", @@ -1931,7 +1951,9 @@ "original": "\u003c30\u003eMar 18 13:35:15 10.0.0.1 dhcpd[18078]: DHCPINFORM from 192.168.0.4 via eth2 TransID 5713b740" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -1970,7 +1992,7 @@ "ip": "192.168.0.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpinform", @@ -2024,7 +2046,7 @@ "mac": "34-29-8F-71-B8-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdecline", @@ -2032,7 +2054,9 @@ "original": "\u003c30\u003eMar 18 11:44:52 10.0.0.1 dhcpd[32243]: DHCPDECLINE of 192.168.0.4 from 34:29:8f:71:b8:99 via 10.10.4.1 TransID 00000000: not found" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -2076,7 +2100,7 @@ "mac": "00-C0-DD-07-18-E2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpdecline", @@ -2129,7 +2153,7 @@ "mac": "F4-30-B9-17-AB-0E" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpnak", @@ -2178,7 +2202,7 @@ "ip": "192.168.0.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpleasequery", @@ -2223,7 +2247,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2262,7 +2286,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2301,7 +2325,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2340,7 +2364,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2379,7 +2403,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2418,7 +2442,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2457,7 +2481,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2496,7 +2520,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2535,7 +2559,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2574,7 +2598,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2613,7 +2637,7 @@ { "@timestamp": "2023-03-27T08:32:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-27T08:32:59.000Z", @@ -2656,7 +2680,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "encapsulated solicit", @@ -2664,7 +2688,9 @@ "original": "\u003c30\u003eJul 12 15:55:55 67.43.156.0 dhcpdv6[12271]: Encapsulated Solicit message from 2a02:cf40:: port 547 from client DUID 01:9a:df:6e:f6:1f:23:01:9a:df:6e:f6:1f:23, transaction ID 0x698AD400" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -2701,7 +2727,7 @@ "ip": "2a02:cf40::" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "advertise na", @@ -2709,7 +2735,9 @@ "original": "\u003c30\u003eJul 12 15:55:55 67.43.156.0 dhcpdv6[12271]: Advertise NA: address 2a02:cf40:: to client with duid 01:9a:df:6e:f6:1f:23:01:9a:df:6e:f6:1f:23 iaid = -1620146908 valid for 43200 seconds" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -2748,7 +2776,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "relay-forward", @@ -2756,7 +2784,9 @@ "original": "\u003c30\u003eJul 12 15:55:55 67.43.156.0 dhcpdv6[12271]: Relay-forward message from 2a02:cf40:: port 547, link address 2a02:cf40::1, peer address 2a02:cf40::2" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -2796,7 +2826,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "encapsulating advertise", @@ -2804,7 +2834,9 @@ "original": "\u003c30\u003eJul 12 15:55:55 67.43.156.0 dhcpdv6[12271]: Encapsulating Advertise message to send to 2a02:cf40:: port 547" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -2838,7 +2870,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sending relay-reply", @@ -2846,7 +2878,9 @@ "original": "\u003c30\u003eJul 12 15:55:55 67.43.156.0 dhcpdv6[12271]: Sending Relay-reply message to 2a02:cf40:: port 547" }, "host": { - "ip": "67.43.156.0" + "ip": [ + "67.43.156.0" + ] }, "infoblox_nios": { "log": { @@ -2880,7 +2914,7 @@ "mac": "00-50-56-83-96-03" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -2889,7 +2923,9 @@ }, "host": { "domain": "infoblox.localdomain", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -2940,7 +2976,7 @@ "mac": "CE-93-30-8E-DB-AC" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "release", @@ -2949,7 +2985,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -2986,7 +3024,7 @@ "mac": "9C-AD-97-7A-FD-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -2995,7 +3033,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -3035,7 +3075,7 @@ "mac": "4A-34-BF-D2-78-24" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -3044,7 +3084,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -3096,7 +3138,7 @@ "mac": "4A-34-BF-D2-78-24" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -3105,7 +3147,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -3163,7 +3207,7 @@ "mac": "4A-34-BF-D2-78-24" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -3172,7 +3216,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -3228,7 +3274,7 @@ "mac": "4A-34-BF-D2-78-24" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpack", @@ -3237,7 +3283,9 @@ }, "host": { "domain": "anudhcp.anu.edu.au", - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { diff --git a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json index 0cfc13b9fd7..001d7ce897e 100644 --- a/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/infoblox_nios/data_stream/log/_dev/test/pipeline/test-dns.log-expected.json @@ -41,7 +41,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -101,7 +101,7 @@ "response_code": "REFUSED" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -181,7 +181,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -244,7 +244,7 @@ "response_code": "NXDOMAIN" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -328,7 +328,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -380,7 +380,7 @@ "port": 59735 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-09T23:59:59.000Z", @@ -438,7 +438,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-09T23:59:59.000Z", @@ -484,7 +484,7 @@ { "@timestamp": "2023-03-11T23:51:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -532,7 +532,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -585,7 +585,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -640,7 +640,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -698,7 +698,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -745,7 +745,7 @@ "port": 46982 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -798,7 +798,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -851,7 +851,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -905,7 +905,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -959,7 +959,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -1002,7 +1002,7 @@ { "@timestamp": "2023-03-11T23:51:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -1047,7 +1047,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -1093,7 +1093,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -1139,7 +1139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-03-11T23:51:31.000Z", @@ -1191,14 +1191,16 @@ "response_code": "REFUSED" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-14T16:17:20.000Z", "original": "\u003c30\u003eApr 14 16:17:20 10.50.1.227 named[2588]: infoblox-responses: 14-Apr-2022 16:17:20.046 client 192.168.1.90#57738: UDP: query: settings-win.data.microsoft.com IN A response: REFUSED -" }, "host": { - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -1253,14 +1255,16 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-14T16:16:05.000Z", "original": "\u003c30\u003eApr 14 16:16:05 10.50.1.227 named[2588]: queries: client @0x7f97e40eb500 192.168.1.90#64727 (ocsp.digicert.com): query: ocsp.digicert.com IN A + (192.168.1.10)" }, "host": { - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -1306,14 +1310,16 @@ "port": 64727 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-04-14T16:16:05.000Z", "original": "\u003c30\u003eApr 14 16:16:05 10.50.1.227 named[2588]: query-errors: client @0x7f97e40eb500 192.168.1.90#64727 (ocsp.digicert.com): query failed (REFUSED) for ocsp.digicert.com/IN/A at query.c:10288" }, "host": { - "ip": "10.50.1.227" + "ip": [ + "10.50.1.227" + ] }, "infoblox_nios": { "log": { @@ -1382,7 +1388,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-10-04T10:18:07.000Z", @@ -1390,7 +1396,9 @@ }, "host": { "domain": "a1.foo.com", - "ip": "89.160.20.112" + "ip": [ + "89.160.20.112" + ] }, "infoblox_nios": { "log": { @@ -1467,7 +1475,7 @@ "response_code": "NOERROR" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-05-09T11:54:36.000Z", @@ -1475,7 +1483,9 @@ }, "host": { "domain": "a1.foo.com", - "ip": "89.160.20.112" + "ip": [ + "89.160.20.112" + ] }, "infoblox_nios": { "log": { diff --git a/packages/infoblox_nios/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/infoblox_nios/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 537a72a5efe..2e819dac958 100644 --- a/packages/infoblox_nios/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/infoblox_nios/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -7,12 +7,12 @@ processors: ignore_missing: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: field: event.original patterns: - - "^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\\s+%{NOTSPACE:host.domain}\\s+%{IP:host.ip}\\s+%{DATA:infoblox_nios.log.service_name}\\[?%{NUMBER:process.pid:long}?\\]?:\\s+%{GREEDYDATA:message}$" - - "^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\\s+(%{IP:host.ip}|%{NOTSPACE:host.domain})\\s+%{DATA:infoblox_nios.log.service_name}\\[?%{NUMBER:process.pid:long}?\\]?:\\s+%{GREEDYDATA:message}$" + - "^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\\s+%{NOTSPACE:host.domain}\\s+%{IP:_tmp.host.ip}\\s+%{DATA:infoblox_nios.log.service_name}\\[?%{NUMBER:process.pid:long}?\\]?:\\s+%{GREEDYDATA:message}$" + - "^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\\s+(%{IP:_tmp.host.ip}|%{NOTSPACE:host.domain})\\s+%{DATA:infoblox_nios.log.service_name}\\[?%{NUMBER:process.pid:long}?\\]?:\\s+%{GREEDYDATA:message}$" - "^%{GREEDYDATA:message}$" - rename: field: _conf.tz_offset @@ -79,21 +79,21 @@ processors: value: '{{{event.created}}}' if: "ctx['@timestamp'] == null && ctx.event?.created != null" - convert: - field: host.ip - if: ctx.host?.ip != null && ctx.host.ip != '' + field: _tmp.host.ip + if: ctx._tmp?.host?.ip != null && ctx._tmp.host.ip != '' type: ip ignore_missing: true on_failure: - remove: - field: host.ip + field: _tmp.host.ip ignore_missing: true - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - append: field: related.ip - value: '{{{host.ip}}}' - if: ctx.host?.ip != null + value: '{{{_tmp.host.ip}}}' + if: ctx._tmp?.host?.ip != null allow_duplicates: false ignore_failure: true - append: @@ -104,9 +104,8 @@ processors: ignore_failure: true - append: field: host.ip - value: '{{{host.ip}}}' - if: ctx.host?.ip != null - allow_duplicates: false + value: '{{{_tmp.host.ip}}}' + if: ctx._tmp?.host?.ip != null ignore_failure: true - lowercase: field: event.action @@ -135,7 +134,9 @@ processors: ignore_failure: true ignore_missing: true - remove: - field: _conf + field: + - _conf + - _tmp ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/infoblox_nios/data_stream/log/sample_event.json b/packages/infoblox_nios/data_stream/log/sample_event.json index 09f1b6884e0..51357afd7fe 100644 --- a/packages/infoblox_nios/data_stream/log/sample_event.json +++ b/packages/infoblox_nios/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2011-10-19T12:43:47.375Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "102cbca1-7eba-451e-977d-353ff4781b73", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "infoblox_nios.log", @@ -13,23 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "first_login", "agent_id_status": "verified", - "created": "2023-03-22T14:26:54.000Z", + "created": "2023-03-22T14:26:54.000+05:00", "dataset": "infoblox_nios.log", - "ingested": "2023-01-13T12:24:26Z", - "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 12:43:47.375Z [user]: First_Login - - to=AdminConnector ip=10.0.0.2 auth=LOCAL group=admin-group apparently_via=GUI\\040first\\040login" + "ingested": "2023-07-20T15:45:46Z", + "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 12:43:47.375Z [user]: First_Login - - to=AdminConnector ip=10.0.0.2 auth=LOCAL group=admin-group apparently_via=GUI\\040first\\040login", + "timezone": "+0500" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -49,7 +52,7 @@ }, "log": { "source": { - "address": "172.27.0.4:60381" + "address": "172.22.0.4:50640" }, "syslog": { "priority": 29 diff --git a/packages/infoblox_nios/docs/README.md b/packages/infoblox_nios/docs/README.md index 36e7d749c5c..6a49d9cf0ce 100644 --- a/packages/infoblox_nios/docs/README.md +++ b/packages/infoblox_nios/docs/README.md @@ -155,11 +155,11 @@ An example event for `log` looks as following: { "@timestamp": "2011-10-19T12:43:47.375Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "102cbca1-7eba-451e-977d-353ff4781b73", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "infoblox_nios.log", @@ -167,23 +167,26 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "first_login", "agent_id_status": "verified", - "created": "2023-03-22T14:26:54.000Z", + "created": "2023-03-22T14:26:54.000+05:00", "dataset": "infoblox_nios.log", - "ingested": "2023-01-13T12:24:26Z", - "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 12:43:47.375Z [user]: First_Login - - to=AdminConnector ip=10.0.0.2 auth=LOCAL group=admin-group apparently_via=GUI\\040first\\040login" + "ingested": "2023-07-20T15:45:46Z", + "original": "\u003c29\u003eMar 22 14:26:54 10.0.0.1 httpd: 2011-10-19 12:43:47.375Z [user]: First_Login - - to=AdminConnector ip=10.0.0.2 auth=LOCAL group=admin-group apparently_via=GUI\\040first\\040login", + "timezone": "+0500" }, "host": { - "ip": "10.0.0.1" + "ip": [ + "10.0.0.1" + ] }, "infoblox_nios": { "log": { @@ -203,7 +206,7 @@ An example event for `log` looks as following: }, "log": { "source": { - "address": "172.27.0.4:60381" + "address": "172.22.0.4:50640" }, "syslog": { "priority": 29 @@ -267,7 +270,7 @@ An example event for `log` looks as following: | dns.response_code | The DNS response code. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-27c573b0-b4d8-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-27c573b0-b4d8-11ec-80e1-4bd67c5762eb.json index 3ae9f3653d5..bb836fa136f 100644 --- a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-27c573b0-b4d8-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-27c573b0-b4d8-11ec-80e1-4bd67c5762eb.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -74,7 +75,7 @@ "panelIndex": "5ab31944-bb04-4fcd-9734-6dd0a050581b", "panelRefName": "panel_5ab31944-bb04-4fcd-9734-6dd0a050581b", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -90,7 +91,7 @@ "panelIndex": "2720e747-2fe6-431c-ba1c-ca7f7cb648ba", "panelRefName": "panel_2720e747-2fe6-431c-ba1c-ca7f7cb648ba", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -106,7 +107,7 @@ "panelIndex": "76c2205b-d288-41b8-bd79-33e76a42289a", "panelRefName": "panel_76c2205b-d288-41b8-bd79-33e76a42289a", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -122,87 +123,159 @@ "panelIndex": "76cacd94-5599-43e7-bcde-e1e19c7d8e96", "panelRefName": "panel_76cacd94-5599-43e7-bcde-e1e19c7d8e96", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-eb92e284-64a9-4660-836e-a8b020342375", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "99bb2283-08ad-483a-8912-5039ced3b47e", - "index_pattern_ref_name": "metrics_e1c539c2-d236-4767-86da-469124ac35fa_0_index_pattern", - "interval": "1d", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "d12231fe-9878-4b9f-860f-ff926684e751", - "label": "Count", - "line_width": 1, - "metrics": [ - { - "id": "6bd0749b-2071-4cb9-9287-2e7fe244c469", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": null, - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "event.action : \"dhcpack\"" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "eb92e284-64a9-4660-836e-a8b020342375": { + "columnOrder": [ + "da3fa8d4-3105-427f-b7e5-1080611812ec", + "b2e5a125-9de2-4db4-aa14-4f8b28a56e2e", + "92c27138-9608-4a75-9d12-ccc4db22b91d" + ], + "columns": { + "92c27138-9608-4a75-9d12-ccc4db22b91d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b2e5a125-9de2-4db4-aa14-4f8b28a56e2e": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "event.action : \"dhcpack\"" + }, + "label": "Count" + } + ] + }, + "scale": "ordinal" + }, + "da3fa8d4-3105-427f-b7e5-1080611812ec": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } }, - "id": "53443750-b50b-11ec-b3d6-27b037885c54", - "label": "Count" + "incompleteColumns": {} } - ], - "split_mode": "filters", - "stacked": "none", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 0, - "type": "timeseries", - "use_kibana_indexes": false + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "92c27138-9608-4a75-9d12-ccc4db22b91d" + ], + "layerId": "eb92e284-64a9-4660-836e-a8b020342375", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "b2e5a125-9de2-4db4-aa14-4f8b28a56e2e", + "xAccessor": "da3fa8d4-3105-427f-b7e5-1080611812ec", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "92c27138-9608-4a75-9d12-ccc4db22b91d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, "title": "Count of Leases Renewed Over Time [Logs Infoblox NIOS]", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -212,88 +285,161 @@ "y": 0 }, "panelIndex": "e1c539c2-d236-4767-86da-469124ac35fa", - "type": "visualization", - "version": "7.17.0" + "title": "Count of Leases Renewed Over Time [Logs Infoblox NIOS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f530920e-a6bf-4424-baf8-749ca427487e", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "99bb2283-08ad-483a-8912-5039ced3b47e", - "index_pattern_ref_name": "metrics_5767168a-28c2-49c8-9e1c-10210600e8ca_0_index_pattern", - "interval": "1d", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "d12231fe-9878-4b9f-860f-ff926684e751", - "label": "Count", - "line_width": 1, - "metrics": [ - { - "id": "6bd0749b-2071-4cb9-9287-2e7fe244c469", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": null, - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "event.action : \"dhcpdecline\"" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f530920e-a6bf-4424-baf8-749ca427487e": { + "columnOrder": [ + "972d3345-fdb7-4f1d-95f8-3870553df74e", + "15dcde3b-ebc2-4f4a-86fa-e95cebf8d4a9", + "fff8433c-c2ad-47e4-81ee-0b56c9c60b08" + ], + "columns": { + "15dcde3b-ebc2-4f4a-86fa-e95cebf8d4a9": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "event.action : \"dhcpdecline\"" + }, + "label": "Count" + } + ] + }, + "scale": "ordinal" + }, + "972d3345-fdb7-4f1d-95f8-3870553df74e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "fff8433c-c2ad-47e4-81ee-0b56c9c60b08": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } }, - "id": "53443750-b50b-11ec-b3d6-27b037885c54", - "label": "Count" + "incompleteColumns": {} } - ], - "split_mode": "filters", - "stacked": "none", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 0, - "type": "timeseries", - "use_kibana_indexes": false + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "fff8433c-c2ad-47e4-81ee-0b56c9c60b08" + ], + "layerId": "f530920e-a6bf-4424-baf8-749ca427487e", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "15dcde3b-ebc2-4f4a-86fa-e95cebf8d4a9", + "xAccessor": "972d3345-fdb7-4f1d-95f8-3870553df74e", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "fff8433c-c2ad-47e4-81ee-0b56c9c60b08" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, "title": "Count of Leases Declined Over Time [Logs Infoblox NIOS]", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -303,88 +449,161 @@ "y": 0 }, "panelIndex": "5767168a-28c2-49c8-9e1c-10210600e8ca", - "type": "visualization", - "version": "7.17.0" + "title": "Count of Leases Declined Over Time [Logs Infoblox NIOS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e3aabebc-971c-43b9-a7c1-e191b2784208", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "99bb2283-08ad-483a-8912-5039ced3b47e", - "index_pattern_ref_name": "metrics_4b06a1a7-f698-4add-a789-8ce4c11a7ab8_0_index_pattern", - "interval": "1d", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "d12231fe-9878-4b9f-860f-ff926684e751", - "label": "Count", - "line_width": 1, - "metrics": [ - { - "id": "6bd0749b-2071-4cb9-9287-2e7fe244c469", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": null, - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "event.action : \"dhcpexpire\"" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e3aabebc-971c-43b9-a7c1-e191b2784208": { + "columnOrder": [ + "4b0a2493-5854-4574-8956-4633dd212dea", + "5d20b8c3-b30e-4f36-a13e-46ec9a66cfd4", + "21daf641-cbf0-47dc-9faf-ffa698a61f68" + ], + "columns": { + "21daf641-cbf0-47dc-9faf-ffa698a61f68": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "4b0a2493-5854-4574-8956-4633dd212dea": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "5d20b8c3-b30e-4f36-a13e-46ec9a66cfd4": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "event.action : \"dhcpexpire\"" + }, + "label": "Count" + } + ] + }, + "scale": "ordinal" + } }, - "id": "53443750-b50b-11ec-b3d6-27b037885c54", - "label": "Count" + "incompleteColumns": {} } - ], - "split_mode": "filters", - "stacked": "none", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 0, - "type": "timeseries", - "use_kibana_indexes": false + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "21daf641-cbf0-47dc-9faf-ffa698a61f68" + ], + "layerId": "e3aabebc-971c-43b9-a7c1-e191b2784208", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "5d20b8c3-b30e-4f36-a13e-46ec9a66cfd4", + "xAccessor": "4b0a2493-5854-4574-8956-4633dd212dea", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "21daf641-cbf0-47dc-9faf-ffa698a61f68" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, "title": "Count of Leases Expired Over Time [Logs Infoblox NIOS]", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -394,88 +613,161 @@ "y": 15 }, "panelIndex": "4b06a1a7-f698-4add-a789-8ce4c11a7ab8", - "type": "visualization", - "version": "7.17.0" + "title": "Count of Leases Expired Over Time [Logs Infoblox NIOS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-30f11d80-9022-41b3-a67c-65192d046839", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "99bb2283-08ad-483a-8912-5039ced3b47e", - "index_pattern_ref_name": "metrics_1141be07-af74-407b-ab41-805d9abf7a9d_0_index_pattern", - "interval": "1d", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "d12231fe-9878-4b9f-860f-ff926684e751", - "label": "Count", - "line_width": 1, - "metrics": [ - { - "id": "6bd0749b-2071-4cb9-9287-2e7fe244c469", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_color_mode": null, - "split_filters": [ - { - "color": "#68BC00", - "filter": { - "language": "kuery", - "query": "event.action : \"dhcprelease\"" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "30f11d80-9022-41b3-a67c-65192d046839": { + "columnOrder": [ + "efa911ee-1bdd-4985-acba-bf6ca264de38", + "455d7562-cf9d-487b-a5b7-49b5ba8a560c", + "86eab379-ff8d-4bdb-b3cc-f233f8c3b60e" + ], + "columns": { + "455d7562-cf9d-487b-a5b7-49b5ba8a560c": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "event.action : \"dhcprelease\"" + }, + "label": "Count" + } + ] + }, + "scale": "ordinal" + }, + "86eab379-ff8d-4bdb-b3cc-f233f8c3b60e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "efa911ee-1bdd-4985-acba-bf6ca264de38": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } }, - "id": "53443750-b50b-11ec-b3d6-27b037885c54", - "label": "Count" + "incompleteColumns": {} } - ], - "split_mode": "filters", - "stacked": "none", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 0, - "type": "timeseries", - "use_kibana_indexes": false + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "86eab379-ff8d-4bdb-b3cc-f233f8c3b60e" + ], + "layerId": "30f11d80-9022-41b3-a67c-65192d046839", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "455d7562-cf9d-487b-a5b7-49b5ba8a560c", + "xAccessor": "efa911ee-1bdd-4985-acba-bf6ca264de38", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "86eab379-ff8d-4bdb-b3cc-f233f8c3b60e" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, "title": "Count of Leases Released Over Time [Logs Infoblox NIOS]", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -485,8 +777,9 @@ "y": 15 }, "panelIndex": "1141be07-af74-407b-ab41-805d9abf7a9d", - "type": "visualization", - "version": "7.17.0" + "title": "Count of Leases Released Over Time [Logs Infoblox NIOS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -506,7 +799,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "310773ab-50b9-45eb-b84b-d5ac4dd962ff": { "columnOrder": [ @@ -520,7 +813,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24491aaa-9a7c-4f4e-aea5-9621bc64c38a": { "customLabel": true, @@ -565,7 +858,9 @@ } ], "layerId": "310773ab-50b9-45eb-b84b-d5ac4dd962ff", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 MAC Address [Logs Infoblox NIOS]", @@ -585,17 +880,18 @@ "panelIndex": "489a5d78-23c6-4d68-bb5f-ac23c60785e4", "title": "Top 10 MAC Address [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox NIOS] DHCP", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:16:03.824Z", "id": "infoblox_nios-27c573b0-b4d8-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { @@ -630,22 +926,22 @@ }, { "id": "logs-*", - "name": "e1c539c2-d236-4767-86da-469124ac35fa:metrics_e1c539c2-d236-4767-86da-469124ac35fa_0_index_pattern", + "name": "e1c539c2-d236-4767-86da-469124ac35fa:indexpattern-datasource-layer-eb92e284-64a9-4660-836e-a8b020342375", "type": "index-pattern" }, { "id": "logs-*", - "name": "5767168a-28c2-49c8-9e1c-10210600e8ca:metrics_5767168a-28c2-49c8-9e1c-10210600e8ca_0_index_pattern", + "name": "5767168a-28c2-49c8-9e1c-10210600e8ca:indexpattern-datasource-layer-f530920e-a6bf-4424-baf8-749ca427487e", "type": "index-pattern" }, { "id": "logs-*", - "name": "4b06a1a7-f698-4add-a789-8ce4c11a7ab8:metrics_4b06a1a7-f698-4add-a789-8ce4c11a7ab8_0_index_pattern", + "name": "4b06a1a7-f698-4add-a789-8ce4c11a7ab8:indexpattern-datasource-layer-e3aabebc-971c-43b9-a7c1-e191b2784208", "type": "index-pattern" }, { "id": "logs-*", - "name": "1141be07-af74-407b-ab41-805d9abf7a9d:metrics_1141be07-af74-407b-ab41-805d9abf7a9d_0_index_pattern", + "name": "1141be07-af74-407b-ab41-805d9abf7a9d:indexpattern-datasource-layer-30f11d80-9022-41b3-a67c-65192d046839", "type": "index-pattern" }, { diff --git a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-c3abc8b0-b4dd-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-c3abc8b0-b4dd-11ec-80e1-4bd67c5762eb.json index 330decb8a2d..d7dfe031c92 100644 --- a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-c3abc8b0-b4dd-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-c3abc8b0-b4dd-11ec-80e1-4bd67c5762eb.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -74,7 +75,7 @@ "panelIndex": "efab2208-7c53-44d0-ab95-44e4f536b001", "panelRefName": "panel_efab2208-7c53-44d0-ab95-44e4f536b001", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -92,7 +93,7 @@ "panelRefName": "panel_ae1e8f76-fa42-4a6a-8a7e-08a96bd1e58d", "title": "Created and Deleted Objects [Logs Infoblox NIOS]", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -112,7 +113,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b651497c-3650-4eb9-ab9c-e90f27c1fc75": { "columnOrder": [ @@ -126,7 +127,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "fcb0dd34-08f1-4b12-a947-66514002a247": { "customLabel": true, @@ -194,6 +195,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right", "showSingleSeries": false }, @@ -229,7 +231,7 @@ "panelIndex": "a80ffa5e-4561-415e-9059-04eb43007744", "title": "Distribution of Audit Events by Event Action [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -253,7 +255,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3b197aef-e049-44df-a30f-fc807fdb1718": { "columnOrder": [ @@ -269,7 +271,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "6786ed8f-346e-419e-b8a7-1eea3d76b317": { "customLabel": true, @@ -342,7 +344,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "event.action", "negate": false, "params": { @@ -382,7 +384,9 @@ } ], "layerId": "3b197aef-e049-44df-a30f-fc807fdb1718", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 User Login Failures [Logs Infoblox NIOS]", @@ -402,7 +406,7 @@ "panelIndex": "5afac073-fbf9-4826-b39b-dc95b0000227", "title": "Top 10 User Login Failures [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -422,7 +426,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9688c841-6bb3-4369-8c27-894421c9ea56": { "columnOrder": [ @@ -455,7 +459,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -481,7 +485,9 @@ } ], "layerId": "9688c841-6bb3-4369-8c27-894421c9ea56", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Login User Name [Logs Infoblox NIOS]", @@ -501,17 +507,18 @@ "panelIndex": "ad53c5a5-b77c-4849-be52-76fe81addb10", "title": "Top 10 Login User Name [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox NIOS] Audit", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:12:25.556Z", "id": "infoblox_nios-c3abc8b0-b4dd-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-f8d86480-b4c9-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-f8d86480-b4c9-11ec-80e1-4bd67c5762eb.json index fa11ae5bb24..257342063fb 100644 --- a/packages/infoblox_nios/kibana/dashboard/infoblox_nios-f8d86480-b4c9-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/dashboard/infoblox_nios-f8d86480-b4c9-11ec-80e1-4bd67c5762eb.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -74,7 +75,7 @@ "panelIndex": "8c9c23a3-c26e-497a-9b62-99dbcf30c2ca", "panelRefName": "panel_8c9c23a3-c26e-497a-9b62-99dbcf30c2ca", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -90,7 +91,7 @@ "panelIndex": "33030bbb-3670-4b20-ab01-b0eb157ea4e5", "panelRefName": "panel_33030bbb-3670-4b20-ab01-b0eb157ea4e5", "type": "search", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -110,7 +111,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "362936ac-2262-4cd0-8e06-c28015a829c5": { "columnOrder": [ @@ -144,7 +145,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -161,17 +162,20 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "199ebb9a-2861-4db3-ac9d-d5801b764292" - ], "layerId": "362936ac-2262-4cd0-8e06-c28015a829c5", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 1, "legendPosition": "right", - "metric": "d759196e-f983-426d-bdd4-b6fea637f20d", + "legendSize": "auto", + "metrics": [ + "d759196e-f983-426d-bdd4-b6fea637f20d" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "199ebb9a-2861-4db3-ac9d-d5801b764292" + ], "truncateLegend": false } ], @@ -195,7 +199,7 @@ "panelIndex": "59c77ae9-b3de-409f-af9c-79d24f27fe0e", "title": "Distribution of DNS Events by Response Code [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -215,7 +219,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "362936ac-2262-4cd0-8e06-c28015a829c5": { "columnOrder": [ @@ -249,7 +253,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -266,17 +270,20 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "199ebb9a-2861-4db3-ac9d-d5801b764292" - ], "layerId": "362936ac-2262-4cd0-8e06-c28015a829c5", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 1, "legendPosition": "right", - "metric": "d759196e-f983-426d-bdd4-b6fea637f20d", + "legendSize": "auto", + "metrics": [ + "d759196e-f983-426d-bdd4-b6fea637f20d" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "199ebb9a-2861-4db3-ac9d-d5801b764292" + ], "truncateLegend": false } ], @@ -300,7 +307,7 @@ "panelIndex": "66c59159-c694-4f18-acdc-4a0ee8f24e44", "title": "Distribution of DNS Events by Response Flag [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -320,7 +327,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "362936ac-2262-4cd0-8e06-c28015a829c5": { "columnOrder": [ @@ -354,7 +361,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -371,17 +378,20 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "199ebb9a-2861-4db3-ac9d-d5801b764292" - ], "layerId": "362936ac-2262-4cd0-8e06-c28015a829c5", "layerType": "data", "legendDisplay": "show", "legendMaxLines": 1, "legendPosition": "right", - "metric": "d759196e-f983-426d-bdd4-b6fea637f20d", + "legendSize": "auto", + "metrics": [ + "d759196e-f983-426d-bdd4-b6fea637f20d" + ], "nestedLegend": false, "numberDisplay": "percent", + "primaryGroups": [ + "199ebb9a-2861-4db3-ac9d-d5801b764292" + ], "truncateLegend": false } ], @@ -405,7 +415,7 @@ "panelIndex": "3dbd8734-c5a9-4b69-82ab-441be9c681df", "title": "Distribution of DNS Events by Question Class [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -425,7 +435,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c7c1c1df-9311-48ff-8df3-6c0ac873f606": { "columnOrder": [ @@ -439,7 +449,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24e0ec78-4202-4d4d-9d1d-88df3ac6c639": { "customLabel": true, @@ -484,7 +494,9 @@ } ], "layerId": "c7c1c1df-9311-48ff-8df3-6c0ac873f606", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 IP Used by Client [Logs Infoblox NIOS]", @@ -504,7 +516,7 @@ "panelIndex": "37ef1ff2-63b4-4622-881b-94adbf10aa0e", "title": "Top 10 IP Used by Client [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -524,7 +536,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c7c1c1df-9311-48ff-8df3-6c0ac873f606": { "columnOrder": [ @@ -538,7 +550,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24e0ec78-4202-4d4d-9d1d-88df3ac6c639": { "customLabel": true, @@ -584,7 +596,9 @@ } ], "layerId": "c7c1c1df-9311-48ff-8df3-6c0ac873f606", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Port Used by Client [Logs Infoblox NIOS]", @@ -604,7 +618,7 @@ "panelIndex": "11a2277a-ad98-45b0-9ec8-dc304f8fc34c", "title": "Top 10 Port Used by Client [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -624,7 +638,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c7c1c1df-9311-48ff-8df3-6c0ac873f606": { "columnOrder": [ @@ -638,7 +652,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24e0ec78-4202-4d4d-9d1d-88df3ac6c639": { "customLabel": true, @@ -683,7 +697,9 @@ } ], "layerId": "c7c1c1df-9311-48ff-8df3-6c0ac873f606", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Answer Name [Logs Infoblox NIOS]", @@ -703,7 +719,7 @@ "panelIndex": "ae613e8d-a0c5-464d-90ad-ef352d122514", "title": "Top 10 Answer Name [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -723,7 +739,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c7c1c1df-9311-48ff-8df3-6c0ac873f606": { "columnOrder": [ @@ -737,7 +753,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24e0ec78-4202-4d4d-9d1d-88df3ac6c639": { "customLabel": true, @@ -782,7 +798,9 @@ } ], "layerId": "c7c1c1df-9311-48ff-8df3-6c0ac873f606", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Question Name [Logs Infoblox NIOS]", @@ -802,7 +820,7 @@ "panelIndex": "7b2fd611-413f-42a2-a4ae-6b14098521bd", "title": "Top 10 Question Name [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -822,7 +840,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c7c1c1df-9311-48ff-8df3-6c0ac873f606": { "columnOrder": [ @@ -836,7 +854,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24e0ec78-4202-4d4d-9d1d-88df3ac6c639": { "customLabel": true, @@ -881,7 +899,9 @@ } ], "layerId": "c7c1c1df-9311-48ff-8df3-6c0ac873f606", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Query Type [Logs Infoblox NIOS]", @@ -901,17 +921,18 @@ "panelIndex": "eff09424-7521-473d-88ab-368aa2d33b69", "title": "Top 10 Query Type [Logs Infoblox NIOS]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Infoblox NIOS] DNS", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:12:33.810Z", "id": "infoblox_nios-f8d86480-b4c9-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-4559ff50-b4e1-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-4559ff50-b4e1-11ec-80e1-4bd67c5762eb.json index e4df82c46fc..e0cd7eaad11 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-4559ff50-b4e1-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-4559ff50-b4e1-11ec-80e1-4bd67c5762eb.json @@ -47,10 +47,11 @@ ], "title": "Declined Leases [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-4559ff50-b4e1-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-5cc295e0-b4d6-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-5cc295e0-b4d6-11ec-80e1-4bd67c5762eb.json index 807c8c3e4f1..75312978712 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-5cc295e0-b4d6-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-5cc295e0-b4d6-11ec-80e1-4bd67c5762eb.json @@ -48,10 +48,11 @@ ], "title": "DNS Decline Response [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-5cc295e0-b4d6-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-7103abb0-b4e1-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-7103abb0-b4e1-11ec-80e1-4bd67c5762eb.json index 92a78f78afa..4e972b70272 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-7103abb0-b4e1-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-7103abb0-b4e1-11ec-80e1-4bd67c5762eb.json @@ -47,10 +47,11 @@ ], "title": "Expired Leases [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-7103abb0-b4e1-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-71f7a570-b4dd-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-71f7a570-b4dd-11ec-80e1-4bd67c5762eb.json index b970ba9c7b0..6b1fd84f4f7 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-71f7a570-b4dd-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-71f7a570-b4dd-11ec-80e1-4bd67c5762eb.json @@ -69,10 +69,11 @@ ], "title": "Renewed Leases [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-71f7a570-b4dd-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-854739b0-b735-11ec-8ec2-49017af276c3.json b/packages/infoblox_nios/kibana/search/infoblox_nios-854739b0-b735-11ec-8ec2-49017af276c3.json index 2144d5cd930..f75676f8256 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-854739b0-b735-11ec-8ec2-49017af276c3.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-854739b0-b735-11ec-8ec2-49017af276c3.json @@ -62,10 +62,11 @@ ], "title": "Created and Deleted Objects [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-854739b0-b735-11ec-8ec2-49017af276c3", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-8d55bb50-b4e1-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-8d55bb50-b4e1-11ec-80e1-4bd67c5762eb.json index 6256a5e46ef..4492bacfd58 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-8d55bb50-b4e1-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-8d55bb50-b4e1-11ec-80e1-4bd67c5762eb.json @@ -48,10 +48,11 @@ ], "title": "Released Leases [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-8d55bb50-b4e1-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-b3b496f0-b4e5-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-b3b496f0-b4e5-11ec-80e1-4bd67c5762eb.json index 055141c7e73..4335fb15c96 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-b3b496f0-b4e5-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-b3b496f0-b4e5-11ec-80e1-4bd67c5762eb.json @@ -70,10 +70,11 @@ ], "title": "Login Allowed [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-b3b496f0-b4e5-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/search/infoblox_nios-f3899090-b4d7-11ec-80e1-4bd67c5762eb.json b/packages/infoblox_nios/kibana/search/infoblox_nios-f3899090-b4d7-11ec-80e1-4bd67c5762eb.json index 5fad384c031..8f5ebc91205 100644 --- a/packages/infoblox_nios/kibana/search/infoblox_nios-f3899090-b4d7-11ec-80e1-4bd67c5762eb.json +++ b/packages/infoblox_nios/kibana/search/infoblox_nios-f3899090-b4d7-11ec-80e1-4bd67c5762eb.json @@ -26,10 +26,11 @@ ], "title": "DNS Query by Class [Logs Infoblox NIOS]" }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:11:18.003Z", "id": "infoblox_nios-f3899090-b4d7-11ec-80e1-4bd67c5762eb", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/infoblox_nios/kibana/tags.yml b/packages/infoblox_nios/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/infoblox_nios/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/infoblox_nios/manifest.yml b/packages/infoblox_nios/manifest.yml index 551d88c2494..b2064a18192 100644 --- a/packages/infoblox_nios/manifest.yml +++ b/packages/infoblox_nios/manifest.yml @@ -1,17 +1,15 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: infoblox_nios title: Infoblox NIOS -version: "1.9.0" -license: basic +version: "1.13.0" description: Collect logs from Infoblox NIOS with Elastic Agent. type: integration categories: - security - network - dns_security -release: ga conditions: - kibana.version: ^7.17.0 || ^8.0.0 + kibana.version: ^8.7.1 screenshots: - src: /img/infoblox-nios-screenshot.png title: Infoblox NIOS dashboard screenshot diff --git a/packages/iptables/_dev/build/build.yml b/packages/iptables/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/iptables/_dev/build/build.yml +++ b/packages/iptables/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/iptables/changelog.yml b/packages/iptables/changelog.yml index a0dc26a69cc..0f04a44943b 100644 --- a/packages/iptables/changelog.yml +++ b/packages/iptables/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 - version: "1.10.0" changes: - description: Convert dashboard to lens. diff --git a/packages/iptables/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json b/packages/iptables/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json index 23f0ab184f9..b4178f3edc2 100644 --- a/packages/iptables/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json +++ b/packages/iptables/data_stream/log/_dev/test/pipeline/test-iptables-raw.log-expected.json @@ -8,7 +8,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -108,7 +108,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -208,7 +208,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -302,7 +302,7 @@ "mac": "90-10-28-5F-62-24" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deny", @@ -359,7 +359,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -438,7 +438,7 @@ "port": 1433 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -502,7 +502,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -581,7 +581,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -660,7 +660,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -739,7 +739,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -803,7 +803,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -870,7 +870,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -937,7 +937,7 @@ "port": 139 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -1001,7 +1001,7 @@ "port": 8088 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop_input", @@ -1072,7 +1072,7 @@ "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1135,7 +1135,7 @@ "mac": "90-10-12-34-56-78" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1204,7 +1204,7 @@ "port": 48689 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -1272,7 +1272,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -1348,7 +1348,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -1431,7 +1431,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -1506,7 +1506,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -1581,7 +1581,7 @@ "port": 9000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1633,7 +1633,7 @@ "mac": "0A-EA-10-00-F0-06" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/iptables/data_stream/log/_dev/test/pipeline/test-journald.json-expected.json b/packages/iptables/data_stream/log/_dev/test/pipeline/test-journald.json-expected.json index 0ae6063cb07..df6d2bc2f58 100644 --- a/packages/iptables/data_stream/log/_dev/test/pipeline/test-journald.json-expected.json +++ b/packages/iptables/data_stream/log/_dev/test/pipeline/test-journald.json-expected.json @@ -20,7 +20,7 @@ "port": 40702 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/iptables/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json b/packages/iptables/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json index 29a171bda10..492a3e310c9 100644 --- a/packages/iptables/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json +++ b/packages/iptables/data_stream/log/_dev/test/pipeline/test-ubiquiti.log-expected.json @@ -20,7 +20,7 @@ "port": 48689 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -88,7 +88,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -164,7 +164,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -247,7 +247,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -322,7 +322,7 @@ "port": 1443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "accept", @@ -395,7 +395,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -437,7 +437,7 @@ "port": 7914 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -479,7 +479,7 @@ "port": 51179 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -520,7 +520,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -562,7 +562,7 @@ "port": 51182 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -603,7 +603,7 @@ "port": 49209 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/iptables/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/iptables/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 75c17b72ce7..add14ad25ee 100644 --- a/packages/iptables/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/iptables/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for iptables logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # These two fields are treated as immutable in the case reindexing. - set: diff --git a/packages/iptables/data_stream/log/sample_event.json b/packages/iptables/data_stream/log/sample_event.json index 5ecbfb8f693..1230adb27ee 100644 --- a/packages/iptables/data_stream/log/sample_event.json +++ b/packages/iptables/data_stream/log/sample_event.json @@ -18,7 +18,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e644293-3984-48e7-a63c-00be2338b58d", diff --git a/packages/iptables/docs/README.md b/packages/iptables/docs/README.md index edfe834a4cd..639e554191d 100644 --- a/packages/iptables/docs/README.md +++ b/packages/iptables/docs/README.md @@ -38,7 +38,7 @@ An example event for `log` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e644293-3984-48e7-a63c-00be2338b58d", @@ -182,7 +182,7 @@ An example event for `log` looks as following: | destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.module | Event module | constant_keyword | diff --git a/packages/iptables/kibana/tags.yml b/packages/iptables/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/iptables/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/iptables/manifest.yml b/packages/iptables/manifest.yml index 2b8c0680520..4a4f2c71e27 100644 --- a/packages/iptables/manifest.yml +++ b/packages/iptables/manifest.yml @@ -1,6 +1,6 @@ name: iptables title: Iptables -version: "1.10.0" +version: "1.13.0" description: Collect logs from Iptables with Elastic Agent. type: integration icons: @@ -8,12 +8,13 @@ icons: title: linux size: 299x354 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" categories: - network - security conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/kibana-iptables.png title: kibana iptables @@ -39,3 +40,4 @@ policy_templates: description: "Collecting application logs from iptables instances (input: journald)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/istio/changelog.yml b/packages/istio/changelog.yml index 8ee4a2525eb..361405d47e9 100644 --- a/packages/istio/changelog.yml +++ b/packages/istio/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "0.4.1" + changes: + - description: Revert the metric format to have type object again. + type: enhancement + link: https://github.com/elastic/integrations/pull/7607 +- version: "0.4.0" + changes: + - description: Enable TSDB by default for all metrics data streams. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7030 +- version: "0.3.2" + changes: + - description: Update "Pilot xds expired" visualization to use last value instead of average. + type: enhancement + link: https://github.com/elastic/integrations/pull/7007 +- version: "0.3.1" + changes: + - description: Add metric type. + type: enhancement + link: https://github.com/elastic/integrations/pull/6889 - version: "0.3.0" changes: - description: Set dimension fields. diff --git a/packages/istio/data_stream/istiod_metrics/fields/fields.yml b/packages/istio/data_stream/istiod_metrics/fields/fields.yml index 5c8298245b8..b169a631cbb 100644 --- a/packages/istio/data_stream/istiod_metrics/fields/fields.yml +++ b/packages/istio/data_stream/istiod_metrics/fields/fields.yml @@ -14,6 +14,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Istiod gauge metric @@ -21,6 +22,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: counter description: > Istiod counter metric @@ -28,6 +30,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Istiod rated counter metric diff --git a/packages/istio/data_stream/istiod_metrics/manifest.yml b/packages/istio/data_stream/istiod_metrics/manifest.yml index 96ac444dc69..672597f28b3 100644 --- a/packages/istio/data_stream/istiod_metrics/manifest.yml +++ b/packages/istio/data_stream/istiod_metrics/manifest.yml @@ -1,6 +1,8 @@ title: "Istiod Metrics" release: experimental type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: prometheus/metrics title: Istiod metrics diff --git a/packages/istio/data_stream/proxy_metrics/fields/fields.yml b/packages/istio/data_stream/proxy_metrics/fields/fields.yml index 6e4135bd29a..e50555d8cd3 100644 --- a/packages/istio/data_stream/proxy_metrics/fields/fields.yml +++ b/packages/istio/data_stream/proxy_metrics/fields/fields.yml @@ -14,6 +14,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Istio Proxy gauge metric @@ -21,6 +22,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: counter description: > Istio Proxy counter metric @@ -28,6 +30,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Istio Proxy rated counter metric diff --git a/packages/istio/data_stream/proxy_metrics/manifest.yml b/packages/istio/data_stream/proxy_metrics/manifest.yml index f4b46a370a4..a96f3e2443b 100644 --- a/packages/istio/data_stream/proxy_metrics/manifest.yml +++ b/packages/istio/data_stream/proxy_metrics/manifest.yml @@ -1,6 +1,8 @@ title: "Istio Proxy Metrics" release: experimental type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: prometheus/metrics title: Istio Proxy metrics diff --git a/packages/istio/docs/README.md b/packages/istio/docs/README.md index cf149bb19cf..4f38f9c8e6c 100644 --- a/packages/istio/docs/README.md +++ b/packages/istio/docs/README.md @@ -302,32 +302,32 @@ An example event for `istiod` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| istio.istiod.labels.\* | Istiod metric labels | object | -| istio.istiod.labels_id | Fingerprint generated by the labels. | keyword | -| istio.istiod.metrics.\*.counter | Istiod counter metric | object | -| istio.istiod.metrics.\*.histogram | Istiod histogram metric | object | -| istio.istiod.metrics.\*.rate | Istiod rated counter metric | object | -| istio.istiod.metrics.\*.value | Istiod gauge metric | object | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Event module | constant_keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| istio.istiod.labels.\* | Istiod metric labels | object | | +| istio.istiod.labels_id | Fingerprint generated by the labels. | keyword | | +| istio.istiod.metrics.\*.counter | Istiod counter metric | object | counter | +| istio.istiod.metrics.\*.histogram | Istiod histogram metric | object | | +| istio.istiod.metrics.\*.rate | Istiod rated counter metric | object | gauge | +| istio.istiod.metrics.\*.value | Istiod gauge metric | object | gauge | ### Proxy Metrics @@ -377,32 +377,32 @@ An example event for `proxy` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host, resource, or service is located. | keyword | -| container.id | Unique container id. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| error.message | Error message. | match_only_text | -| event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| istio.proxy.labels.\* | Istio Proxy metric labels | object | -| istio.proxy.labels_id | Fingerprint generated by the labels. | keyword | -| istio.proxy.metrics.\*.counter | Istio Proxy counter metric | object | -| istio.proxy.metrics.\*.histogram | Istio Proxy histogram metric | object | -| istio.proxy.metrics.\*.rate | Istio Proxy rated counter metric | object | -| istio.proxy.metrics.\*.value | Istio Proxy gauge metric | object | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | +| container.id | Unique container id. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| error.message | Error message. | match_only_text | | +| event.dataset | Event dataset | constant_keyword | | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | +| event.module | Event module | constant_keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| istio.proxy.labels.\* | Istio Proxy metric labels | object | | +| istio.proxy.labels_id | Fingerprint generated by the labels. | keyword | | +| istio.proxy.metrics.\*.counter | Istio Proxy counter metric | object | counter | +| istio.proxy.metrics.\*.histogram | Istio Proxy histogram metric | object | | +| istio.proxy.metrics.\*.rate | Istio Proxy rated counter metric | object | gauge | +| istio.proxy.metrics.\*.value | Istio Proxy gauge metric | object | gauge | diff --git a/packages/istio/kibana/dashboard/istio-f0f863b0-5941-11ed-bfb8-bbfe5b338339.json b/packages/istio/kibana/dashboard/istio-f0f863b0-5941-11ed-bfb8-bbfe5b338339.json index 4bc01d1ee25..35b96e431ed 100644 --- a/packages/istio/kibana/dashboard/istio-f0f863b0-5941-11ed-bfb8-bbfe5b338339.json +++ b/packages/istio/kibana/dashboard/istio-f0f863b0-5941-11ed-bfb8-bbfe5b338339.json @@ -2185,7 +2185,12 @@ }, { "id": "metrics-*", - "name": "5dd05ea2-58f7-478a-a08b-e1d651fd4f10", + "name": "88e72ef0-c31c-46c6-a0e7-e2cfa424ad93", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "89487cc8-7e06-4827-b380-1ac1fd1a3050", "type": "index-pattern" } ], @@ -2196,6 +2201,7 @@ "layers": { "31508df4-45f0-4539-b60e-fc221663e793": { "columnOrder": [ + "a00a0f0b-d1fc-4bac-977c-df6e5e8479ed", "6d984ee0-898e-4a49-beed-28b876a26871", "613f76d7-a700-4710-b92f-d75d20261c64" ], @@ -2203,14 +2209,18 @@ "613f76d7-a700-4710-b92f-d75d20261c64": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "istio.istiod.metrics.pilot_xds_expired_nonce.counter: *" + }, "isBucketed": false, "label": "pilot_xds_expired ", - "operationType": "average", + "operationType": "last_value", "params": { - "emptyAsNull": true, "format": { "id": "number" - } + }, + "sortField": "@timestamp" }, "scale": "ratio", "sourceField": "istio.istiod.metrics.pilot_xds_expired_nonce.counter" @@ -2227,6 +2237,31 @@ }, "scale": "interval", "sourceField": "@timestamp" + }, + "a00a0f0b-d1fc-4bac-977c-df6e5e8479ed": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of istio.istiod.labels.type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "613f76d7-a700-4710-b92f-d75d20261c64", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "istio.istiod.labels.type" } }, "incompleteColumns": {} @@ -2246,7 +2281,7 @@ "alias": null, "disabled": false, "field": "data_stream.dataset", - "index": "5dd05ea2-58f7-478a-a08b-e1d651fd4f10", + "index": "88e72ef0-c31c-46c6-a0e7-e2cfa424ad93", "key": "data_stream.dataset", "negate": false, "params": { @@ -2259,6 +2294,25 @@ "data_stream.dataset": "istio.istiod_metrics" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "89487cc8-7e06-4827-b380-1ac1fd1a3050", + "key": "istio.istiod.metrics.pilot_xds_expired_nonce.counter", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "istio.istiod.metrics.pilot_xds_expired_nonce.counter" + } + } } ], "internalReferences": [], @@ -2296,6 +2350,7 @@ "type": "palette" }, "seriesType": "line", + "splitAccessor": "a00a0f0b-d1fc-4bac-977c-df6e5e8479ed", "xAccessor": "6d984ee0-898e-4a49-beed-28b876a26871", "yConfig": [ { @@ -2739,7 +2794,7 @@ "version": 1 }, "coreMigrationVersion": "8.6.0", - "created_at": "2023-03-06T17:59:55.323Z", + "created_at": "2023-07-19T07:09:48.691Z", "id": "istio-f0f863b0-5941-11ed-bfb8-bbfe5b338339", "migrationVersion": { "dashboard": "8.6.0" @@ -2852,7 +2907,12 @@ }, { "id": "metrics-*", - "name": "dbf7b077-25b6-4760-893e-ebbd42b4c04d:5dd05ea2-58f7-478a-a08b-e1d651fd4f10", + "name": "dbf7b077-25b6-4760-893e-ebbd42b4c04d:88e72ef0-c31c-46c6-a0e7-e2cfa424ad93", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "dbf7b077-25b6-4760-893e-ebbd42b4c04d:89487cc8-7e06-4827-b380-1ac1fd1a3050", "type": "index-pattern" }, { @@ -2874,19 +2934,7 @@ "id": "metrics-*", "name": "115a531a-e8ef-497f-a3c9-9ccc82f8c974:9aa51899-fb25-42c0-9a06-8235e22c7054", "type": "index-pattern" - }, - { - "id": "fleet-managed-default", - "name": "tag-ref-fleet-managed-default", - "type": "tag" - }, - { - "id": "fleet-pkg-istio-default", - "name": "tag-ref-fleet-pkg-istio-default", - "type": "tag" } ], - "type": "dashboard", - "updated_at": "2023-03-06T17:59:55.323Z", - "version": "WzQ2ODIsMV0=" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/istio/manifest.yml b/packages/istio/manifest.yml index 99d14e2cbc2..391ffaccb01 100644 --- a/packages/istio/manifest.yml +++ b/packages/istio/manifest.yml @@ -3,7 +3,7 @@ name: istio title: Istio description: Collect logs and metrics from the service mesh Istio with Elastic Agent. type: integration -version: 0.3.0 +version: 0.4.1 release: beta license: basic categories: @@ -12,7 +12,7 @@ categories: - containers - kubernetes conditions: - kibana.version: "^8.6.0" + kibana.version: "^8.9.0" screenshots: - src: /img/istio_traffic.png title: Istio Traffic diff --git a/packages/jamf_compliance_reporter/_dev/build/build.yml b/packages/jamf_compliance_reporter/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/jamf_compliance_reporter/_dev/build/build.yml +++ b/packages/jamf_compliance_reporter/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/jamf_compliance_reporter/changelog.yml b/packages/jamf_compliance_reporter/changelog.yml index ac4798f17d2..866e56940b5 100644 --- a/packages/jamf_compliance_reporter/changelog.yml +++ b/packages/jamf_compliance_reporter/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.7.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.6.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.5.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7095 +- version: "1.4.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 - version: "1.3.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-app-metrics.log-expected.json b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-app-metrics.log-expected.json index 79951c76422..6e367cbaa42 100644 --- a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-app-metrics.log-expected.json +++ b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-app-metrics.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-10-15T18:30:27.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "app_metrics", diff --git a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-audit.log-expected.json b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-audit.log-expected.json index 0be5055ab5a..f815503853e 100644 --- a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-audit.log-expected.json +++ b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-10-04T01:56:59.281Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -143,7 +143,7 @@ { "@timestamp": "2019-10-15T18:33:10.518Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -274,7 +274,7 @@ { "@timestamp": "2019-10-15T18:31:00.736Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -419,7 +419,7 @@ { "@timestamp": "2019-10-04T02:06:53.885Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -563,7 +563,7 @@ { "@timestamp": "2019-10-13T07:35:04.499Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -726,7 +726,7 @@ { "@timestamp": "2019-10-15T18:34:41.174Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "150" @@ -867,7 +867,7 @@ { "@timestamp": "2019-10-15T18:30:12.223Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1045,7 +1045,7 @@ { "@timestamp": "2019-10-04T02:07:12.671Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1183,7 +1183,7 @@ { "@timestamp": "2019-10-02T16:21:03.400Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1320,7 +1320,7 @@ { "@timestamp": "2019-10-15T17:57:25.519Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1450,7 +1450,7 @@ { "@timestamp": "2019-10-04T02:07:20.363Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1629,7 +1629,7 @@ { "@timestamp": "2019-10-15T18:23:50.822Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1770,7 +1770,7 @@ { "@timestamp": "2019-10-10T21:16:18.957Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -1909,7 +1909,7 @@ { "@timestamp": "2019-10-10T21:17:59.235Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2042,7 +2042,7 @@ { "@timestamp": "2019-10-15T18:17:16.978Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2183,7 +2183,7 @@ { "@timestamp": "2019-10-15T17:37:31.350Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2343,7 +2343,7 @@ { "@timestamp": "2019-10-04T02:07:03.295Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2464,7 +2464,7 @@ { "@timestamp": "2019-10-15T18:34:40.882Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2619,7 +2619,7 @@ { "@timestamp": "2019-10-15T15:16:00.270Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2763,7 +2763,7 @@ { "@timestamp": "2019-10-10T17:56:24.088Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -2903,7 +2903,7 @@ { "@timestamp": "2019-10-15T18:25:30.525Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3018,7 +3018,7 @@ { "@timestamp": "2019-10-15T18:25:54.133Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3133,7 +3133,7 @@ { "@timestamp": "2019-10-15T18:33:06.553Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3248,7 +3248,7 @@ { "@timestamp": "2019-10-15T17:57:31.064Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3363,7 +3363,7 @@ { "@timestamp": "2019-10-04T02:07:15.007Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3497,7 +3497,7 @@ { "@timestamp": "2019-10-04T01:57:00.582Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3628,7 +3628,7 @@ { "@timestamp": "2019-10-13T22:24:19.201Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3757,7 +3757,7 @@ { "@timestamp": "2019-10-04T01:57:00.567Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -3888,7 +3888,7 @@ { "@timestamp": "2019-10-04T01:57:00.560Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4021,7 +4021,7 @@ { "@timestamp": "2019-10-15T15:16:00.338Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4159,7 +4159,7 @@ { "@timestamp": "2019-10-15T15:16:00.338Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4291,7 +4291,7 @@ { "@timestamp": "2019-10-15T16:59:30.567Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4424,7 +4424,7 @@ { "@timestamp": "2019-10-04T02:07:19.630Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4598,7 +4598,7 @@ { "@timestamp": "2019-10-04T02:07:19.468Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4724,7 +4724,7 @@ { "@timestamp": "2019-10-15T17:37:31.441Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "0" @@ -4879,7 +4879,7 @@ { "@timestamp": "2019-10-04T02:07:12.671Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "10" diff --git a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-event.log-expected.json b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-event.log-expected.json index 302fbea34f5..dbab8f1f1c3 100644 --- a/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-event.log-expected.json +++ b/packages/jamf_compliance_reporter/data_stream/log/_dev/test/pipeline/test-pipeline-event.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-10-14T01:49:46.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audio_video_device_event", @@ -61,7 +61,7 @@ { "@timestamp": "2019-10-12T14:32:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "audit_class_verification_event", @@ -117,7 +117,7 @@ { "@timestamp": "2019-10-12T14:32:01.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "compliance_reporter_tamper_event", @@ -201,7 +201,7 @@ { "@timestamp": "2019-10-15T18:34:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_event", @@ -285,7 +285,7 @@ { "@timestamp": "2019-10-12T14:32:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "gatekeeper_info_event", @@ -338,7 +338,7 @@ { "@timestamp": "2019-10-04T02:25:42.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "gatekeeper_manual_overrides", @@ -480,7 +480,7 @@ { "@timestamp": "2019-10-15T18:30:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "gatekeeper_quarantine_log", @@ -542,7 +542,7 @@ { "@timestamp": "2019-10-14T01:15:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "hardware_event", @@ -617,7 +617,7 @@ { "@timestamp": "2019-10-12T14:32:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "license_info_event", @@ -677,7 +677,7 @@ { "@timestamp": "2019-10-02T16:17:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "preference_list_event", @@ -781,7 +781,7 @@ { "@timestamp": "2019-10-06T23:37:31.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "print_event_information", @@ -844,7 +844,7 @@ { "@timestamp": "2020-07-10T19:32:06.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "prohibited_app_blocked", @@ -991,7 +991,7 @@ { "@timestamp": "2019-10-14T14:18:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "signal_event", @@ -1041,7 +1041,7 @@ { "@timestamp": "2019-10-15T18:19:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unified_log_event", @@ -1125,7 +1125,7 @@ { "@timestamp": "2019-10-12T14:32:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "xprotect_definitions_version_info", @@ -1180,7 +1180,7 @@ { "@timestamp": "2019-10-11T19:17:42.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "xprotect_event_log", diff --git a/packages/jamf_compliance_reporter/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/jamf_compliance_reporter/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 46f6a0a0c32..eefc1f6d2a3 100644 --- a/packages/jamf_compliance_reporter/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jamf_compliance_reporter/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Jamf Compliance Reporter logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/jamf_compliance_reporter/data_stream/log/sample_event.json b/packages/jamf_compliance_reporter/data_stream/log/sample_event.json index f6227833a46..8c198b5180d 100644 --- a/packages/jamf_compliance_reporter/data_stream/log/sample_event.json +++ b/packages/jamf_compliance_reporter/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-10-02T16:17:08.000Z", "agent": { - "ephemeral_id": "d5ffc842-05cf-43da-96fe-905f95ab2e41", - "id": "4f9748a6-cc5b-4160-bfdb-b533f9ba576a", + "ephemeral_id": "3210e168-0038-4c64-bf69-6bd94996ed48", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.2" }, "data_stream": { "dataset": "jamf_compliance_reporter.log", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "4f9748a6-cc5b-4160-bfdb-b533f9ba576a", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.4.0" + "version": "8.8.2" }, "event": { "action": "preference_list_event", @@ -27,7 +27,7 @@ "process" ], "dataset": "jamf_compliance_reporter.log", - "ingested": "2022-11-04T11:01:45Z", + "ingested": "2023-07-20T19:38:36Z", "kind": "event", "type": [ "info" @@ -45,7 +45,7 @@ } }, "input": { - "type": "tcp" + "type": "http_endpoint" }, "jamf_compliance_reporter": { "log": { @@ -109,11 +109,6 @@ } } }, - "log": { - "source": { - "address": "192.168.224.7:58764" - } - }, "related": { "hosts": [ "macbook_pro" diff --git a/packages/jamf_compliance_reporter/docs/README.md b/packages/jamf_compliance_reporter/docs/README.md index a6d734291b3..9a958fad4f5 100644 --- a/packages/jamf_compliance_reporter/docs/README.md +++ b/packages/jamf_compliance_reporter/docs/README.md @@ -69,11 +69,11 @@ An example event for `log` looks as following: { "@timestamp": "2019-10-02T16:17:08.000Z", "agent": { - "ephemeral_id": "d5ffc842-05cf-43da-96fe-905f95ab2e41", - "id": "4f9748a6-cc5b-4160-bfdb-b533f9ba576a", + "ephemeral_id": "3210e168-0038-4c64-bf69-6bd94996ed48", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.2" }, "data_stream": { "dataset": "jamf_compliance_reporter.log", @@ -81,12 +81,12 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "4f9748a6-cc5b-4160-bfdb-b533f9ba576a", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.4.0" + "version": "8.8.2" }, "event": { "action": "preference_list_event", @@ -95,7 +95,7 @@ An example event for `log` looks as following: "process" ], "dataset": "jamf_compliance_reporter.log", - "ingested": "2022-11-04T11:01:45Z", + "ingested": "2023-07-20T19:38:36Z", "kind": "event", "type": [ "info" @@ -113,7 +113,7 @@ An example event for `log` looks as following: } }, "input": { - "type": "tcp" + "type": "http_endpoint" }, "jamf_compliance_reporter": { "log": { @@ -177,11 +177,6 @@ An example event for `log` looks as following: } } }, - "log": { - "source": { - "address": "192.168.224.7:58764" - } - }, "related": { "hosts": [ "macbook_pro" @@ -226,9 +221,9 @@ An example event for `log` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Name of the dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-8351fc80-b58c-11ec-a813-df29637f29df.json b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-8351fc80-b58c-11ec-a813-df29637f29df.json index ebf2a67690a..93c76dc41a2 100644 --- a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-8351fc80-b58c-11ec-a813-df29637f29df.json +++ b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-8351fc80-b58c-11ec-a813-df29637f29df.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows audit logs collected by the Jamf Compliance Reporter integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -78,7 +79,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "75d7a5a3-51eb-4651-919f-aa2e631f733a": { "columnOrder": [ @@ -112,7 +113,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -157,6 +158,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar", @@ -191,7 +193,7 @@ "panelIndex": "31b29984-3ac9-42a8-a953-a9d3bd62ac7e", "title": "Distribution of Audit Events by Return Description [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -211,7 +213,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a9476fe9-d7bc-4cf9-9974-39a2c4602cfd": { "columnOrder": [ @@ -245,7 +247,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -262,15 +264,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "7d2929e4-764e-45a0-8242-966ca8499b94" - ], "layerId": "a9476fe9-d7bc-4cf9-9974-39a2c4602cfd", "layerType": "data", "legendDisplay": "default", - "metric": "9fa49f57-f6e3-4c76-b37b-1bc5d6bc72f8", + "legendSize": "auto", + "metrics": [ + "9fa49f57-f6e3-4c76-b37b-1bc5d6bc72f8" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "7d2929e4-764e-45a0-8242-966ca8499b94" + ] } ], "shape": "pie" @@ -293,7 +298,7 @@ "panelIndex": "e4990652-7cd9-495d-abef-683a370b7c76", "title": "Distribution of Audit Events by Host OS Version [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -313,7 +318,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "21b86cfe-db52-415d-82ed-c8b87d2224ee": { "columnOrder": [ @@ -347,7 +352,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -372,7 +377,9 @@ } ], "layerId": "21b86cfe-db52-415d-82ed-c8b87d2224ee", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", @@ -392,7 +399,7 @@ "panelIndex": "413d94dd-512a-46cc-b635-38f52627cd67", "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -412,7 +419,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "602a9bc7-89cd-42de-91ef-3ae97c4d8c47": { "columnOrder": [ @@ -446,7 +453,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -463,15 +470,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1ecde91a-d905-4e8e-827f-a41af5b2e675" - ], "layerId": "602a9bc7-89cd-42de-91ef-3ae97c4d8c47", "layerType": "data", "legendDisplay": "default", - "metric": "baa8de65-deac-4cf8-99e8-470b82de1c19", + "legendSize": "auto", + "metrics": [ + "baa8de65-deac-4cf8-99e8-470b82de1c19" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1ecde91a-d905-4e8e-827f-a41af5b2e675" + ] } ], "shape": "pie" @@ -494,7 +504,7 @@ "panelIndex": "3519cad4-7e76-4459-b44d-80623cabbcfb", "title": "Distribution of Audit Events by Event Name [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -514,7 +524,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0ac4d2d0-01d2-41ec-a398-f70992b9cdc5": { "columnOrder": [ @@ -529,7 +539,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "44ed01c4-ebd8-4de7-9c6d-28c6bb7df5bb": { "customLabel": true, @@ -571,7 +581,9 @@ } ], "layerId": "0ac4d2d0-01d2-41ec-a398-f70992b9cdc5", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Group Name [Logs Jamf Compliance Reporter]", @@ -591,7 +603,7 @@ "panelIndex": "186d3b1c-415b-43d7-9ad7-21238d2b07ef", "title": "Top 10 Group Name [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -611,7 +623,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3ecddbbb-2392-457a-ab8f-965a26f154db": { "columnOrder": [ @@ -645,7 +657,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -668,7 +680,9 @@ } ], "layerId": "3ecddbbb-2392-457a-ab8f-965a26f154db", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 User Name [Logs Jamf Compliance Reporter]", @@ -688,7 +702,7 @@ "panelIndex": "05f51b9b-ec7b-4834-99f7-68e797bc4fe2", "title": "Top 10 User Name [Logs Jamf Compliance Reporter] ", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -708,7 +722,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "54f391c9-12b8-4305-93dd-6710d4c2458d": { "columnOrder": [ @@ -723,7 +737,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "7af571ef-1ae1-456a-92d5-eb4ed16f2d3f": { "customLabel": true, @@ -768,7 +782,9 @@ } ], "layerId": "54f391c9-12b8-4305-93dd-6710d4c2458d", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Event Score [Logs Jamf Compliance Reporter]", @@ -788,7 +804,7 @@ "panelIndex": "83d65eb5-0d74-43ca-bbe9-ab5ec1aaec46", "title": "Top 10 Event Score [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -808,7 +824,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b3d2bd68-514b-486f-8741-933a0f0f1242": { "columnOrder": [ @@ -842,7 +858,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -867,7 +883,9 @@ } ], "layerId": "b3d2bd68-514b-486f-8741-933a0f0f1242", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Process User Name for AUE_KILL and AUE_TASK Audit Events [Logs Jamf Compliance Reporter]", @@ -887,17 +905,18 @@ "panelIndex": "d8a48988-c438-4031-b66b-297d6bbc3628", "title": "Top 10 Process User Name for AUE_KILL and AUE_TASK Audit Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Jamf Compliance Reporter] Audit", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:23:40.069Z", "id": "jamf_compliance_reporter-8351fc80-b58c-11ec-a813-df29637f29df", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd0ea730-b557-11ec-a813-df29637f29df.json b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd0ea730-b557-11ec-a813-df29637f29df.json index efeda3c26ab..e2c1f77255e 100644 --- a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd0ea730-b557-11ec-a813-df29637f29df.json +++ b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd0ea730-b557-11ec-a813-df29637f29df.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows events logs collected by the Jamf Compliance Reporter integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -78,7 +79,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "dcd69ebb-72a3-4bc6-8a68-aca6570839c4": { "columnOrder": [ @@ -92,7 +93,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "24d71291-5bf6-4b24-8093-d41a22d03ccb": { "customLabel": true, @@ -128,15 +129,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "24d71291-5bf6-4b24-8093-d41a22d03ccb" - ], "layerId": "dcd69ebb-72a3-4bc6-8a68-aca6570839c4", "layerType": "data", "legendDisplay": "default", - "metric": "218ddc14-154c-4fa9-bd43-d9206d2ec7f7", + "legendSize": "auto", + "metrics": [ + "218ddc14-154c-4fa9-bd43-d9206d2ec7f7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "24d71291-5bf6-4b24-8093-d41a22d03ccb" + ] } ], "shape": "pie" @@ -159,7 +163,7 @@ "panelIndex": "f28205e4-886e-4779-a8ea-db77dba9a68c", "title": "Distribution of Events by OS Version [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -179,7 +183,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7c7ea45e-c87f-4cb2-b9d6-89a48ce29ff1": { "columnOrder": [ @@ -212,7 +216,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -229,15 +233,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "0e74bed0-d28e-4e06-a2d5-82307342929f" - ], "layerId": "7c7ea45e-c87f-4cb2-b9d6-89a48ce29ff1", "layerType": "data", "legendDisplay": "default", - "metric": "9679ae52-ab95-4f5d-b3ae-6fa541a740e2", + "legendSize": "auto", + "metrics": [ + "9679ae52-ab95-4f5d-b3ae-6fa541a740e2" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "0e74bed0-d28e-4e06-a2d5-82307342929f" + ] } ], "shape": "pie" @@ -260,7 +267,7 @@ "panelIndex": "d6fd6b7c-d5ff-45ba-b34c-5e17f1d877e1", "title": "Distribution of Audio-Video Device Events by Device Status [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -280,7 +287,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "21cb8b72-ef0b-4afc-8b9f-6a0c7cc17217": { "columnOrder": [ @@ -313,7 +320,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -330,15 +337,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "0921b26e-7205-46b3-a34b-919c037be1e8" - ], "layerId": "21cb8b72-ef0b-4afc-8b9f-6a0c7cc17217", "layerType": "data", "legendDisplay": "default", - "metric": "f55e245c-4b5c-45be-a2c1-f25f1acdc0aa", + "legendSize": "auto", + "metrics": [ + "f55e245c-4b5c-45be-a2c1-f25f1acdc0aa" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "0921b26e-7205-46b3-a34b-919c037be1e8" + ] } ], "shape": "pie" @@ -361,7 +371,7 @@ "panelIndex": "d73f23b2-bd81-4c6f-86dd-bf792212a813", "title": "Distribution of Audit Class Verification Info Events by Restored Default [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -381,7 +391,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7b72f6ca-f0b1-4c09-b1ff-11990af5c585": { "columnOrder": [ @@ -395,7 +405,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b49b1b2a-c3cd-4bcf-88c2-4c4a356b72cf": { "customLabel": true, @@ -431,15 +441,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b49b1b2a-c3cd-4bcf-88c2-4c4a356b72cf" - ], "layerId": "7b72f6ca-f0b1-4c09-b1ff-11990af5c585", "layerType": "data", "legendDisplay": "default", - "metric": "5bae7737-7914-41f8-bcfd-e67162193c46", + "legendSize": "auto", + "metrics": [ + "5bae7737-7914-41f8-bcfd-e67162193c46" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b49b1b2a-c3cd-4bcf-88c2-4c4a356b72cf" + ] } ], "shape": "pie" @@ -462,7 +475,7 @@ "panelIndex": "18a9850d-21a1-45ea-85c3-a9c78f764f46", "title": "Distribution of Events by Item Created [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -482,7 +495,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "81b3e742-4ad8-4120-9b3b-a9893773795a": { "columnOrder": [ @@ -496,7 +509,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "86771b4a-0cac-452c-b89e-0f8aa2c65c78": { "customLabel": true, @@ -532,15 +545,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "86771b4a-0cac-452c-b89e-0f8aa2c65c78" - ], "layerId": "81b3e742-4ad8-4120-9b3b-a9893773795a", "layerType": "data", "legendDisplay": "default", - "metric": "20349cf6-37d1-4aaf-ba3d-f572e756e36d", + "legendSize": "auto", + "metrics": [ + "20349cf6-37d1-4aaf-ba3d-f572e756e36d" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "86771b4a-0cac-452c-b89e-0f8aa2c65c78" + ] } ], "shape": "pie" @@ -563,7 +579,7 @@ "panelIndex": "f990bb47-c91a-4c84-88c2-0ed775024099", "title": "Distribution of Events by Item Removed [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -583,7 +599,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ad610b62-5183-4e71-86d4-52beca5327d7": { "columnOrder": [ @@ -616,7 +632,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -633,15 +649,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "2f2be0d6-224d-4a5a-bcc2-d6b62913955b" - ], "layerId": "ad610b62-5183-4e71-86d4-52beca5327d7", "layerType": "data", "legendDisplay": "default", - "metric": "9608dee3-3f0b-4eaa-9af8-9b1d6ca38b38", + "legendSize": "auto", + "metrics": [ + "9608dee3-3f0b-4eaa-9af8-9b1d6ca38b38" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "2f2be0d6-224d-4a5a-bcc2-d6b62913955b" + ] } ], "shape": "pie" @@ -664,7 +683,7 @@ "panelIndex": "c80a59ad-5830-4463-9978-642de750f3ff", "title": "Distribution of Events by Item is File [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -684,7 +703,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "46eadc93-b435-41bd-8d5b-f31b5f6353e2": { "columnOrder": [ @@ -717,7 +736,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -734,15 +753,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "76bd9f5a-bbec-4a66-a070-df50aefd7bc4" - ], "layerId": "46eadc93-b435-41bd-8d5b-f31b5f6353e2", "layerType": "data", "legendDisplay": "default", - "metric": "7ee52937-5505-4880-9489-4386bf2f5f43", + "legendSize": "auto", + "metrics": [ + "7ee52937-5505-4880-9489-4386bf2f5f43" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "76bd9f5a-bbec-4a66-a070-df50aefd7bc4" + ] } ], "shape": "pie" @@ -765,7 +787,7 @@ "panelIndex": "2ba7af74-63e2-46b7-a37f-63415014804d", "title": "Distribution of Events by Item is Directory [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -785,7 +807,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e218b2a3-f801-4263-b10c-0d0a5c871703": { "columnOrder": [ @@ -818,7 +840,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -835,15 +857,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "233cd86a-9b66-4ddc-a4e6-b4e0cb2a12b3" - ], "layerId": "e218b2a3-f801-4263-b10c-0d0a5c871703", "layerType": "data", "legendDisplay": "default", - "metric": "2471e331-80ae-4d1c-befa-d5f5bf38c5fc", + "legendSize": "auto", + "metrics": [ + "2471e331-80ae-4d1c-befa-d5f5bf38c5fc" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "233cd86a-9b66-4ddc-a4e6-b4e0cb2a12b3" + ] } ], "shape": "pie" @@ -866,7 +891,7 @@ "panelIndex": "c294926e-9b33-4805-8ef9-bd4bcc2634d1", "title": "Distribution of Events by User Dropped [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -886,7 +911,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a031233f-898d-4756-bf10-f33c73a72081": { "columnOrder": [ @@ -901,7 +926,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "78e02bc2-9a25-4182-b865-96e07cb92680": { "customLabel": true, @@ -965,6 +990,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar", @@ -999,7 +1025,7 @@ "panelIndex": "a2a956f4-162b-47db-908e-dd1027c6f00c", "title": "Distribution of Hardware Events by IO Power Management Device Power State [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1019,7 +1045,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0ad21e03-f895-413e-a7e0-55a45a77146c": { "columnOrder": [ @@ -1034,7 +1060,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "fa04e8b1-655f-4f3b-b7b7-501ddc9fc324": { "customLabel": true, @@ -1070,15 +1096,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "fa04e8b1-655f-4f3b-b7b7-501ddc9fc324" - ], "layerId": "0ad21e03-f895-413e-a7e0-55a45a77146c", "layerType": "data", "legendDisplay": "default", - "metric": "a64a0339-f186-471d-9e43-a3b1559e89a7", + "legendSize": "auto", + "metrics": [ + "a64a0339-f186-471d-9e43-a3b1559e89a7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "fa04e8b1-655f-4f3b-b7b7-501ddc9fc324" + ] } ], "shape": "pie" @@ -1101,7 +1130,7 @@ "panelIndex": "e2121f67-3794-4e56-a0f5-5bdd6fb1213b", "title": "Distribution of Hardware Events by Device Status [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1121,7 +1150,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d31c80d7-fb2d-4cd8-8aef-59543b605404": { "columnOrder": [ @@ -1136,7 +1165,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c8fe4889-0293-4464-b8b4-c8f92c638cec": { "customLabel": true, @@ -1172,15 +1201,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c8fe4889-0293-4464-b8b4-c8f92c638cec" - ], "layerId": "d31c80d7-fb2d-4cd8-8aef-59543b605404", "layerType": "data", "legendDisplay": "default", - "metric": "42386a24-c912-46b5-8a86-27c1496123fc", + "legendSize": "auto", + "metrics": [ + "42386a24-c912-46b5-8a86-27c1496123fc" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c8fe4889-0293-4464-b8b4-c8f92c638cec" + ] } ], "shape": "pie" @@ -1203,7 +1235,7 @@ "panelIndex": "81f9f687-beb7-454d-8ed4-ea234a2c3272", "title": "Distribution of License Info Events by License Status [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1223,7 +1255,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "795c6a4c-3830-4cb3-be63-b55780d773d7": { "columnOrder": [ @@ -1238,7 +1270,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "985125ce-3b93-4b72-a077-0b3f200f0dbf": { "customLabel": true, @@ -1274,15 +1306,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "985125ce-3b93-4b72-a077-0b3f200f0dbf" - ], "layerId": "795c6a4c-3830-4cb3-be63-b55780d773d7", "layerType": "data", "legendDisplay": "default", - "metric": "357042c6-1675-414e-ba3e-6c74b1a6c740", + "legendSize": "auto", + "metrics": [ + "357042c6-1675-414e-ba3e-6c74b1a6c740" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "985125ce-3b93-4b72-a077-0b3f200f0dbf" + ] } ], "shape": "pie" @@ -1305,7 +1340,7 @@ "panelIndex": "51aeea4e-4bb1-4ce2-8738-dc582041496d", "title": "Distribution of License Info Events by License Type [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1325,7 +1360,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ae3e7f06-1bed-44cc-9880-7ff89d7743df": { "columnOrder": [ @@ -1359,7 +1394,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1376,15 +1411,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "3968784a-d4fb-4b89-9abd-250a07b2266c" - ], "layerId": "ae3e7f06-1bed-44cc-9880-7ff89d7743df", "layerType": "data", "legendDisplay": "default", - "metric": "d80ef2e1-cf94-4904-8ef7-207328f5a502", + "legendSize": "auto", + "metrics": [ + "d80ef2e1-cf94-4904-8ef7-207328f5a502" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "3968784a-d4fb-4b89-9abd-250a07b2266c" + ] } ], "shape": "pie" @@ -1407,7 +1445,7 @@ "panelIndex": "16a293c0-18f7-4ffb-b8f6-6e60afd5c4ac", "title": "Distribution of Prohibited App Blocked Events by Header Action [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1427,7 +1465,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "19353d2e-e7a5-425f-85f3-b7333b0abf21": { "columnOrder": [ @@ -1442,7 +1480,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4ffd24ec-c9ee-4d29-873b-896ef7c4096b": { "customLabel": true, @@ -1478,15 +1516,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "4ffd24ec-c9ee-4d29-873b-896ef7c4096b" - ], "layerId": "19353d2e-e7a5-425f-85f3-b7333b0abf21", "layerType": "data", "legendDisplay": "default", - "metric": "219edb2a-c4b4-42ce-824c-6e3437097d35", + "legendSize": "auto", + "metrics": [ + "219edb2a-c4b4-42ce-824c-6e3437097d35" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "4ffd24ec-c9ee-4d29-873b-896ef7c4096b" + ] } ], "shape": "pie" @@ -1509,7 +1550,7 @@ "panelIndex": "0379b610-4693-47f0-b86d-77fd3edee591", "title": "Distribution of Preference List Events by Audit Level [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1529,7 +1570,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "479ee952-5f14-4578-8a20-de63e17627c5": { "columnOrder": [ @@ -1563,7 +1604,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1608,6 +1649,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar", @@ -1642,7 +1684,7 @@ "panelIndex": "03a41353-2e3c-4a6c-9593-2b9a0a5f0e1a", "title": "Distribution of Preference List Events by License Version [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1662,7 +1704,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b4273567-51c1-40d5-abd8-8e33f06e1dcd": { "columnOrder": [ @@ -1677,7 +1719,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c14d4d84-ff8e-4553-bf3e-75b0e5ca8005": { "customLabel": true, @@ -1741,6 +1783,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar", @@ -1775,7 +1818,7 @@ "panelIndex": "d44ee3a0-59e0-46e1-85c8-c70c33353029", "title": "Distribution of Preference List Events by License Type [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1795,7 +1838,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e5f2943e-d6a7-4eb5-adf4-965ed238082c": { "columnOrder": [ @@ -1829,7 +1872,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1846,15 +1889,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1a74900b-aa29-4baa-a390-877af62b93b0" - ], "layerId": "e5f2943e-d6a7-4eb5-adf4-965ed238082c", "layerType": "data", "legendDisplay": "default", - "metric": "87b7cdc9-a3fe-4b6a-aba5-8e59ae730fa4", + "legendSize": "auto", + "metrics": [ + "87b7cdc9-a3fe-4b6a-aba5-8e59ae730fa4" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1a74900b-aa29-4baa-a390-877af62b93b0" + ] } ], "shape": "pie" @@ -1877,7 +1923,7 @@ "panelIndex": "8d99b054-cbe9-43cb-9977-7367eb5085c3", "title": "Distribution of Print Events Information by Job State [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1897,7 +1943,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ad2d2003-f5ae-4aa9-a78e-680c8bcba23c": { "columnOrder": [ @@ -1931,7 +1977,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1956,7 +2002,9 @@ } ], "layerId": "ad2d2003-f5ae-4aa9-a78e-680c8bcba23c", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", @@ -1976,7 +2024,7 @@ "panelIndex": "6f1b595d-131c-481b-a60b-8a32f6cf6042", "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1996,7 +2044,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4b411163-e685-45c0-a1b0-756ce6d0a1eb": { "columnOrder": [ @@ -2030,7 +2078,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -2055,7 +2103,9 @@ } ], "layerId": "4b411163-e685-45c0-a1b0-756ce6d0a1eb", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Audio Device Manufacturer of Audio-Video Device Events [Logs Jamf Compliance Reporter]", @@ -2075,7 +2125,7 @@ "panelIndex": "0bb50df3-d3d2-4f48-962a-0085fb070327", "title": "Top 10 Audio Device Manufacturer of Audio-Video Device Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2095,7 +2145,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9784b039-9999-4347-bbe5-b6429a3bc2eb": { "columnOrder": [ @@ -2129,7 +2179,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -2152,7 +2202,9 @@ } ], "layerId": "9784b039-9999-4347-bbe5-b6429a3bc2eb", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 USB Vendor Name of Hardware Events [Logs Jamf Compliance Reporter]", @@ -2172,7 +2224,7 @@ "panelIndex": "592418e3-3172-448b-915e-0d12808b46d7", "title": "Top 10 USB Vendor Name of Hardware Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2192,7 +2244,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f0047360-8ac5-42d2-b35f-fe490b61d3a7": { "columnOrder": [ @@ -2207,7 +2259,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c1044f5d-5db2-4c8f-9434-ff6e6dc9b8d7": { "customLabel": true, @@ -2251,7 +2303,9 @@ } ], "layerId": "f0047360-8ac5-42d2-b35f-fe490b61d3a7", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 USB Product Name of Hardware Events [Logs Jamf Compliance Reporter]", @@ -2271,7 +2325,7 @@ "panelIndex": "e87863af-fbee-466c-a3e8-a5880304a82a", "title": "Top 10 USB Product Name of Hardware Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2291,7 +2345,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "97ddbe50-1740-4998-b2ba-ff5e13a64e36": { "columnOrder": [ @@ -2306,7 +2360,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "e3a1bfeb-104f-4dd9-9f71-8326afccd2c2": { "customLabel": true, @@ -2348,7 +2402,9 @@ } ], "layerId": "97ddbe50-1740-4998-b2ba-ff5e13a64e36", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Quarantine Agent Bundle Identifier of Gatekeeper Quarantine Log Events [Logs Jamf Compliance Reporter]", @@ -2368,7 +2424,7 @@ "panelIndex": "b274f4a7-d788-4ff4-81ea-aed7756fedf9", "title": "Top 10 Quarantine Agent Bundle Identifier of Gatekeeper Quarantine Log Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2388,7 +2444,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6dba6e01-ce8c-4bb4-be06-6d9ee868f043": { "columnOrder": [ @@ -2422,7 +2478,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -2445,7 +2501,9 @@ } ], "layerId": "6dba6e01-ce8c-4bb4-be06-6d9ee868f043", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Quarantine Agent Name of Gatekeeper Quarantine Log Events [Logs Jamf Compliance Reporter]", @@ -2465,7 +2523,7 @@ "panelIndex": "5049dc95-bcb6-4e0e-8919-422050d8a54c", "title": "Top 10 Quarantine Agent Name of Gatekeeper Quarantine Log Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2485,7 +2543,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7e99d2b3-a231-4553-a927-3553d056cc16": { "columnOrder": [ @@ -2500,7 +2558,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "a0bea5bf-3444-46db-b6f0-953d21c31e16": { "customLabel": true, @@ -2542,7 +2600,9 @@ } ], "layerId": "7e99d2b3-a231-4553-a927-3553d056cc16", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Device Class of Hardware Events [Logs Jamf Compliance Reporter]", @@ -2562,7 +2622,7 @@ "panelIndex": "b26730ed-d34f-4ebe-8739-d6fc5fc220fa", "title": "Top 10 Device Class of Hardware Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2582,7 +2642,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c8a0c482-513b-4fca-8b1e-198b6c35a7d7": { "columnOrder": [ @@ -2616,7 +2676,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -2639,7 +2699,9 @@ } ], "layerId": "c8a0c482-513b-4fca-8b1e-198b6c35a7d7", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 Remote Endpoint Type by AWSKinesis Region of Preference List Events [Logs Jamf Compliance Reporter]", @@ -2659,17 +2721,18 @@ "panelIndex": "bb689dd4-ecdd-4b67-a91e-289347474dc2", "title": "Top 10 Remote Endpoint Type by AWSKinesis Region of Preference List Events [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Jamf Compliance Reporter] Event", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:23:46.565Z", "id": "jamf_compliance_reporter-dd0ea730-b557-11ec-a813-df29637f29df", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd28ec80-b584-11ec-a813-df29637f29df.json b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd28ec80-b584-11ec-a813-df29637f29df.json index 555a7e56156..099753ab531 100644 --- a/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd28ec80-b584-11ec-a813-df29637f29df.json +++ b/packages/jamf_compliance_reporter/kibana/dashboard/jamf_compliance_reporter-dd28ec80-b584-11ec-a813-df29637f29df.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows app metrics logs collected by the Jamf Compliance Reporter integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,88 +56,163 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-98ded84f-8942-4d53-a0c5-c1ca5bfa84a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd579c6a-c1f0-4eed-a6af-36498a58e62d", + "type": "index-pattern" } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 0, - "id": "fa25f9df-c199-49e4-b929-cfcedeadcf54", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "ccb0ffc8-0599-411d-a5e9-7cc3908789ab", - "label": "CPU Percentage", - "line_width": 1, - "metrics": [ - { - "field": "jamf_compliance_reporter.log.app_metric_info.cpu_percentage", - "id": "a832b9ad-31a4-4800-a774-ff440e3293a6", - "type": "avg" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "98ded84f-8942-4d53-a0c5-c1ca5bfa84a6": { + "columnOrder": [ + "4826251a-bce6-47d1-8184-8c793e6fc02b", + "4ee42989-e0d1-4b1f-adcf-9fe45ac93526" + ], + "columns": { + "4826251a-bce6-47d1-8184-8c793e6fc02b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4ee42989-e0d1-4b1f-adcf-9fe45ac93526": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "CPU Percentage", + "operationType": "median", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "jamf_compliance_reporter.log.app_metric_info.cpu_percentage" + } + }, + "incompleteColumns": {}, + "sampling": 1 } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cd579c6a-c1f0-4eed-a6af-36498a58e62d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "jamf_compliance_reporter.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "jamf_compliance_reporter.log" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "timeseries", - "use_kibana_indexes": false + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "emphasizeFitting": true, + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "4ee42989-e0d1-4b1f-adcf-9fe45ac93526" + ], + "layerId": "98ded84f-8942-4d53-a0c5-c1ca5bfa84a6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "4826251a-bce6-47d1-8184-8c793e6fc02b" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "title": "CPU Utilization Over Time [Logs Jamf Compliance Reporter]", - "type": "metrics", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "4dd382d1-e84a-4351-bced-36a6625b3e8e", + "i": "26b820bb-5de0-4979-a8a4-2f992aabe4e3", "w": 24, "x": 0, "y": 0 }, - "panelIndex": "4dd382d1-e84a-4351-bced-36a6625b3e8e", - "type": "visualization", - "version": "7.17.0" + "panelIndex": "26b820bb-5de0-4979-a8a4-2f992aabe4e3", + "title": "CPU Utilization Over Time [Logs Jamf Compliance Reporter]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -158,7 +232,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e3280c4e-9935-45c1-8716-c6be28f1b2bf": { "columnOrder": [ @@ -192,7 +266,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -209,15 +283,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "bc98875f-49d7-4a57-829e-5cb7ccb143d3" - ], "layerId": "e3280c4e-9935-45c1-8716-c6be28f1b2bf", "layerType": "data", "legendDisplay": "default", - "metric": "d388bcb3-cead-43bb-b177-34082d218734", + "legendSize": "auto", + "metrics": [ + "d388bcb3-cead-43bb-b177-34082d218734" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bc98875f-49d7-4a57-829e-5cb7ccb143d3" + ] } ], "shape": "pie" @@ -240,11 +317,12 @@ "panelIndex": "4a142331-39c2-428e-af3c-b693e89e68eb", "title": "Distribution of App Metrics Events by Host OS Version [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { + "description": "", "references": [ { "id": "logs-*", @@ -253,30 +331,30 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-47994ee6-4086-45d0-9b05-3607e2aff799", + "name": "indexpattern-datasource-layer-6aeac12b-c950-45ee-b62d-e16771eec500", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "47994ee6-4086-45d0-9b05-3607e2aff799": { + "6aeac12b-c950-45ee-b62d-e16771eec500": { "columnOrder": [ - "2075f97d-4358-41ce-a75b-e1e1d8284ce4", - "00c36b12-671f-424b-9768-895bce4a69e3" + "f88280b9-1eb1-42f2-abb7-aef75cf84910", + "adc701b8-ea7d-496f-87e5-fba5e78766cf" ], "columns": { - "00c36b12-671f-424b-9768-895bce4a69e3": { + "adc701b8-ea7d-496f-87e5-fba5e78766cf": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Maximum CPU Percentage ", + "operationType": "max", "scale": "ratio", - "sourceField": "Records" + "sourceField": "jamf_compliance_reporter.log.app_metric_info.cpu_percentage" }, - "2075f97d-4358-41ce-a75b-e1e1d8284ce4": { + "f88280b9-1eb1-42f2-abb7-aef75cf84910": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -285,7 +363,7 @@ "params": { "missingBucket": false, "orderBy": { - "columnId": "00c36b12-671f-424b-9768-895bce4a69e3", + "columnId": "adc701b8-ea7d-496f-87e5-fba5e78766cf", "type": "column" }, "orderDirection": "desc", @@ -309,19 +387,21 @@ "visualization": { "columns": [ { - "columnId": "2075f97d-4358-41ce-a75b-e1e1d8284ce4", + "columnId": "f88280b9-1eb1-42f2-abb7-aef75cf84910", "isTransposed": false }, { - "columnId": "00c36b12-671f-424b-9768-895bce4a69e3", + "columnId": "adc701b8-ea7d-496f-87e5-fba5e78766cf", "isTransposed": false } ], - "layerId": "47994ee6-4086-45d0-9b05-3607e2aff799", - "layerType": "data" + "layerId": "6aeac12b-c950-45ee-b62d-e16771eec500", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, - "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", + "title": "Max CPU Utilization per Host [Logs Jamf Compliance Reporter]", "type": "lens", "visualizationType": "lnsDatatable" }, @@ -330,20 +410,19 @@ }, "gridData": { "h": 15, - "i": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af", + "i": "74afe262-2bf2-4ea8-966c-2c51b623f27d", "w": 24, - "x": 0, + "x": 24, "y": 15 }, - "panelIndex": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af", - "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", + "panelIndex": "74afe262-2bf2-4ea8-966c-2c51b623f27d", + "title": "Max CPU Utilization per Host [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { - "description": "", "references": [ { "id": "logs-*", @@ -352,30 +431,30 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6aeac12b-c950-45ee-b62d-e16771eec500", + "name": "indexpattern-datasource-layer-47994ee6-4086-45d0-9b05-3607e2aff799", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "6aeac12b-c950-45ee-b62d-e16771eec500": { + "47994ee6-4086-45d0-9b05-3607e2aff799": { "columnOrder": [ - "f88280b9-1eb1-42f2-abb7-aef75cf84910", - "adc701b8-ea7d-496f-87e5-fba5e78766cf" + "2075f97d-4358-41ce-a75b-e1e1d8284ce4", + "00c36b12-671f-424b-9768-895bce4a69e3" ], "columns": { - "adc701b8-ea7d-496f-87e5-fba5e78766cf": { + "00c36b12-671f-424b-9768-895bce4a69e3": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Maximum CPU Percentage ", - "operationType": "max", + "label": "Count", + "operationType": "count", "scale": "ratio", - "sourceField": "jamf_compliance_reporter.log.app_metric_info.cpu_percentage" + "sourceField": "___records___" }, - "f88280b9-1eb1-42f2-abb7-aef75cf84910": { + "2075f97d-4358-41ce-a75b-e1e1d8284ce4": { "customLabel": true, "dataType": "string", "isBucketed": true, @@ -384,7 +463,7 @@ "params": { "missingBucket": false, "orderBy": { - "columnId": "adc701b8-ea7d-496f-87e5-fba5e78766cf", + "columnId": "00c36b12-671f-424b-9768-895bce4a69e3", "type": "column" }, "orderDirection": "desc", @@ -408,19 +487,21 @@ "visualization": { "columns": [ { - "columnId": "f88280b9-1eb1-42f2-abb7-aef75cf84910", + "columnId": "2075f97d-4358-41ce-a75b-e1e1d8284ce4", "isTransposed": false }, { - "columnId": "adc701b8-ea7d-496f-87e5-fba5e78766cf", + "columnId": "00c36b12-671f-424b-9768-895bce4a69e3", "isTransposed": false } ], - "layerId": "6aeac12b-c950-45ee-b62d-e16771eec500", - "layerType": "data" + "layerId": "47994ee6-4086-45d0-9b05-3607e2aff799", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, - "title": "Max CPU Utilization per Host [Logs Jamf Compliance Reporter]", + "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", "type": "lens", "visualizationType": "lnsDatatable" }, @@ -429,25 +510,26 @@ }, "gridData": { "h": 15, - "i": "74afe262-2bf2-4ea8-966c-2c51b623f27d", + "i": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af", "w": 24, - "x": 24, + "x": 0, "y": 15 }, - "panelIndex": "74afe262-2bf2-4ea8-966c-2c51b623f27d", - "title": "Max CPU Utilization per Host [Logs Jamf Compliance Reporter]", + "panelIndex": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af", + "title": "Top 10 Host Name [Logs Jamf Compliance Reporter]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Jamf Compliance Reporter] App Metrics", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:28:43.049Z", "id": "jamf_compliance_reporter-dd28ec80-b584-11ec-a813-df29637f29df", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { @@ -462,22 +544,22 @@ }, { "id": "logs-*", - "name": "4a142331-39c2-428e-af3c-b693e89e68eb:indexpattern-datasource-current-indexpattern", + "name": "26b820bb-5de0-4979-a8a4-2f992aabe4e3:indexpattern-datasource-layer-98ded84f-8942-4d53-a0c5-c1ca5bfa84a6", "type": "index-pattern" }, { "id": "logs-*", - "name": "4a142331-39c2-428e-af3c-b693e89e68eb:indexpattern-datasource-layer-e3280c4e-9935-45c1-8716-c6be28f1b2bf", + "name": "26b820bb-5de0-4979-a8a4-2f992aabe4e3:cd579c6a-c1f0-4eed-a6af-36498a58e62d", "type": "index-pattern" }, { "id": "logs-*", - "name": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af:indexpattern-datasource-current-indexpattern", + "name": "4a142331-39c2-428e-af3c-b693e89e68eb:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af:indexpattern-datasource-layer-47994ee6-4086-45d0-9b05-3607e2aff799", + "name": "4a142331-39c2-428e-af3c-b693e89e68eb:indexpattern-datasource-layer-e3280c4e-9935-45c1-8716-c6be28f1b2bf", "type": "index-pattern" }, { @@ -489,6 +571,16 @@ "id": "logs-*", "name": "74afe262-2bf2-4ea8-966c-2c51b623f27d:indexpattern-datasource-layer-6aeac12b-c950-45ee-b62d-e16771eec500", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d2f744c1-549b-4f27-aa67-f5a7ddaa85af:indexpattern-datasource-layer-47994ee6-4086-45d0-9b05-3607e2aff799", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/jamf_compliance_reporter/kibana/tags.yml b/packages/jamf_compliance_reporter/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/jamf_compliance_reporter/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/jamf_compliance_reporter/manifest.yml b/packages/jamf_compliance_reporter/manifest.yml index aad890e0d07..44fe0bdb6bb 100644 --- a/packages/jamf_compliance_reporter/manifest.yml +++ b/packages/jamf_compliance_reporter/manifest.yml @@ -1,15 +1,13 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: jamf_compliance_reporter title: Jamf Compliance Reporter -version: "1.3.0" -license: basic +version: "1.7.0" description: Collect logs from Jamf Compliance Reporter with Elastic Agent. type: integration categories: - security -release: ga conditions: - kibana.version: ^7.17.0 || ^8.0.0 + kibana.version: ^8.7.1 screenshots: - src: /img/jamf-compliance-reporter-screenshot.png title: Jamf Compliance Reporter Screenshot diff --git a/packages/jumpcloud/_dev/build/build.yml b/packages/jumpcloud/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/jumpcloud/_dev/build/build.yml +++ b/packages/jumpcloud/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/jumpcloud/_dev/deploy/docker/docker-compose.yml b/packages/jumpcloud/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..e2ab9d222ac --- /dev/null +++ b/packages/jumpcloud/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,15 @@ +version: '2.3' +services: + jumpcloud: + image: docker.elastic.co/observability/stream:v0.10.0 + hostname: jumpcloud + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config.yml diff --git a/packages/jumpcloud/_dev/deploy/docker/files/config.yml b/packages/jumpcloud/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..0ba2ca4ed40 --- /dev/null +++ b/packages/jumpcloud/_dev/deploy/docker/files/config.yml @@ -0,0 +1,13 @@ +rules: + - path: /insights/directory/v1/events + methods: ['POST'] + request_headers: + X-Api-Key: + - letmein + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: | + {"@version":"1","client_ip":"81.2.69.144","event_type":"admin_login_attempt","geoip":{"continent_code":"OC","country_code":"AU","latitude":-27.658,"longitude":152.8915,"region_code":"QLD","region_name":"Queensland","timezone":"Australia/Brisbane"},"id":"63c264c6c1bd55c1b7e901a4","initiated_by":{"email":"user.name@sub.domain.tld","id":"123456789abcdef123456789","type":"admin"},"mfa":true,"organization":"1234abcdef123456789abcde","provider":null,"service":"directory","success":true,"timestamp":"2023-01-14T08:16:06.495Z","useragent":{"device":"Mac","major":"109","minor":"0","name":"Chrome","os":"Mac OS X","os_full":"Mac OS X 10.15.7","os_major":"10","os_minor":"15","os_name":"Mac OS X","os_patch":"7","os_version":"10.15.7","patch":"0","version":"109.0.0.0"}} diff --git a/packages/jumpcloud/changelog.yml b/packages/jumpcloud/changelog.yml index 3f3318d11be..385f5b6043c 100644 --- a/packages/jumpcloud/changelog.yml +++ b/packages/jumpcloud/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.2" + changes: + - description: Remove version attribute from ingest node pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/7807 +- version: "1.2.1" + changes: + - description: Add missing field definitions for `input.type` and `jumpcloud.event.version`. + type: bugfix + link: https://github.com/elastic/integrations/pull/7199 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.1.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.0.0" changes: - description: Release JumpCloud as GA. diff --git a/packages/jumpcloud/data_stream/events/_dev/test/pipeline/test-events.json-expected.json b/packages/jumpcloud/data_stream/events/_dev/test/pipeline/test-events.json-expected.json index 1c7a8a7c98c..4b89cd0ccdd 100644 --- a/packages/jumpcloud/data_stream/events/_dev/test/pipeline/test-events.json-expected.json +++ b/packages/jumpcloud/data_stream/events/_dev/test/pipeline/test-events.json-expected.json @@ -18,7 +18,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "admin_login_attempt", diff --git a/packages/jumpcloud/data_stream/events/_dev/test/system/test-default-config.yml b/packages/jumpcloud/data_stream/events/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..b843d3305f4 --- /dev/null +++ b/packages/jumpcloud/data_stream/events/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: jumpcloud +data_stream: + vars: + url: http://{{Hostname}}:{{Port}}/insights/directory/v1/events + api_key: letmein + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/jumpcloud/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/jumpcloud/data_stream/events/elasticsearch/ingest_pipeline/default.yml index 84f66ffd706..e476d2d2048 100644 --- a/packages/jumpcloud/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/jumpcloud/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -1,10 +1,9 @@ --- -version: 1 description: Pipeline for JumpCloud Events processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message @@ -102,6 +101,11 @@ processors: field: message ignore_empty_value: true +- rename: + field: jumpcloud.event.@version + target_field: jumpcloud.event.version + ignore_missing: true + ### utilise host fields if they exist - set: @@ -324,7 +328,7 @@ processors: - remove: description: Remove jumpcloud fields that are no longer needed as they were mapped to ECS, unless instructed not to field: - - jumpcloud.event.@version + - jumpcloud.event.version - jumpcloud.event.timestamp - jumpcloud.event.client_ip - jumpcloud.event.src_ip diff --git a/packages/jumpcloud/data_stream/events/fields/agent.yml b/packages/jumpcloud/data_stream/events/fields/agent.yml new file mode 100644 index 00000000000..051c104fae2 --- /dev/null +++ b/packages/jumpcloud/data_stream/events/fields/agent.yml @@ -0,0 +1,2 @@ +- name: input.type + type: keyword diff --git a/packages/jumpcloud/data_stream/events/fields/fields.yml b/packages/jumpcloud/data_stream/events/fields/fields.yml index 14d288c5a5b..b304443951c 100644 --- a/packages/jumpcloud/data_stream/events/fields/fields.yml +++ b/packages/jumpcloud/data_stream/events/fields/fields.yml @@ -296,3 +296,5 @@ type: keyword - name: os_version type: keyword + - name: version + type: keyword diff --git a/packages/jumpcloud/data_stream/events/manifest.yml b/packages/jumpcloud/data_stream/events/manifest.yml index 43cd6cbb091..32d66e04efc 100644 --- a/packages/jumpcloud/data_stream/events/manifest.yml +++ b/packages/jumpcloud/data_stream/events/manifest.yml @@ -78,7 +78,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/jumpcloud/data_stream/events/sample_event.json b/packages/jumpcloud/data_stream/events/sample_event.json index f3f6b058606..02c24d8764e 100644 --- a/packages/jumpcloud/data_stream/events/sample_event.json +++ b/packages/jumpcloud/data_stream/events/sample_event.json @@ -1,5 +1,12 @@ { "@timestamp": "2023-01-14T08:16:06.495Z", + "agent": { + "ephemeral_id": "bcbcbf24-2cdd-480e-9b75-96c0bafe1473", + "id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.2" + }, "client": { "geo": { "city_name": "London", @@ -15,23 +22,43 @@ }, "ip": "81.2.69.144" }, + "data_stream": { + "dataset": "jumpcloud.events", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "admin_login_attempt", + "agent_id_status": "verified", "category": [ "authentication" ], + "created": "2023-08-01T09:12:24.427Z", + "dataset": "jumpcloud.events", "id": "63c264c6c1bd55c1b7e901a4", + "ingested": "2023-08-01T09:12:25Z", "module": "directory", + "original": "{\"@version\":\"1\",\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}", "outcome": "success", "type": [ "info" ] }, + "input": { + "type": "httpjson" + }, "jumpcloud": { "event": { + "client_ip": "81.2.69.144", + "event_type": "admin_login_attempt", "geoip": { "continent_code": "OC", "country_code": "AU", @@ -41,12 +68,33 @@ "region_name": "Queensland", "timezone": "Australia/Brisbane" }, + "id": "63c264c6c1bd55c1b7e901a4", "initiated_by": { + "email": "user.name@sub.domain.tld", + "id": "123456789abcdef123456789", "type": "admin" }, "mfa": true, "organization": "1234abcdef123456789abcde", - "success": true + "service": "directory", + "success": true, + "timestamp": "2023-01-14T08:16:06.495Z", + "useragent": { + "device": "Mac", + "major": "109", + "minor": "0", + "name": "Chrome", + "os": "Mac OS X", + "os_full": "Mac OS X 10.15.7", + "os_major": "10", + "os_minor": "15", + "os_name": "Mac OS X", + "os_patch": "7", + "os_version": "10.15.7", + "patch": "0", + "version": "109.0.0.0" + }, + "version": "1" } }, "source": { @@ -55,6 +103,11 @@ "id": "123456789abcdef123456789" } }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded" + ], "user_agent": { "device": { "name": "Mac" diff --git a/packages/jumpcloud/docs/README.md b/packages/jumpcloud/docs/README.md index 67ae5cbbb38..9ccc2ae1336 100644 --- a/packages/jumpcloud/docs/README.md +++ b/packages/jumpcloud/docs/README.md @@ -68,13 +68,14 @@ All JumpCloud Directory Insights events are available in the `jumpcloud.events` | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| input.type | | keyword | | jumpcloud.event.application.display_label | | keyword | | jumpcloud.event.application.id | | keyword | | jumpcloud.event.application.name | | keyword | @@ -181,6 +182,7 @@ All JumpCloud Directory Insights events are available in the `jumpcloud.events` | jumpcloud.event.useragent.patch | | keyword | | jumpcloud.event.useragent.version | | keyword | | jumpcloud.event.username | | keyword | +| jumpcloud.event.version | | keyword | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | process.name | Process name. Sometimes called program name or similar. | keyword | | process.name.text | Multi-field of `process.name`. | match_only_text | @@ -232,6 +234,13 @@ An example event for `events` looks as following: ```json { "@timestamp": "2023-01-14T08:16:06.495Z", + "agent": { + "ephemeral_id": "bcbcbf24-2cdd-480e-9b75-96c0bafe1473", + "id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.2" + }, "client": { "geo": { "city_name": "London", @@ -247,23 +256,43 @@ An example event for `events` looks as following: }, "ip": "81.2.69.144" }, + "data_stream": { + "dataset": "jumpcloud.events", + "namespace": "ep", + "type": "logs" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" + }, + "elastic_agent": { + "id": "25caf3f7-6754-40c9-8532-3f029a1a5c4d", + "snapshot": false, + "version": "8.8.2" }, "event": { "action": "admin_login_attempt", + "agent_id_status": "verified", "category": [ "authentication" ], + "created": "2023-08-01T09:12:24.427Z", + "dataset": "jumpcloud.events", "id": "63c264c6c1bd55c1b7e901a4", + "ingested": "2023-08-01T09:12:25Z", "module": "directory", + "original": "{\"@version\":\"1\",\"client_ip\":\"81.2.69.144\",\"event_type\":\"admin_login_attempt\",\"geoip\":{\"continent_code\":\"OC\",\"country_code\":\"AU\",\"latitude\":-27.658,\"longitude\":152.8915,\"region_code\":\"QLD\",\"region_name\":\"Queensland\",\"timezone\":\"Australia/Brisbane\"},\"id\":\"63c264c6c1bd55c1b7e901a4\",\"initiated_by\":{\"email\":\"user.name@sub.domain.tld\",\"id\":\"123456789abcdef123456789\",\"type\":\"admin\"},\"mfa\":true,\"organization\":\"1234abcdef123456789abcde\",\"provider\":null,\"service\":\"directory\",\"success\":true,\"timestamp\":\"2023-01-14T08:16:06.495Z\",\"useragent\":{\"device\":\"Mac\",\"major\":\"109\",\"minor\":\"0\",\"name\":\"Chrome\",\"os\":\"Mac OS X\",\"os_full\":\"Mac OS X 10.15.7\",\"os_major\":\"10\",\"os_minor\":\"15\",\"os_name\":\"Mac OS X\",\"os_patch\":\"7\",\"os_version\":\"10.15.7\",\"patch\":\"0\",\"version\":\"109.0.0.0\"}}", "outcome": "success", "type": [ "info" ] }, + "input": { + "type": "httpjson" + }, "jumpcloud": { "event": { + "client_ip": "81.2.69.144", + "event_type": "admin_login_attempt", "geoip": { "continent_code": "OC", "country_code": "AU", @@ -273,12 +302,33 @@ An example event for `events` looks as following: "region_name": "Queensland", "timezone": "Australia/Brisbane" }, + "id": "63c264c6c1bd55c1b7e901a4", "initiated_by": { + "email": "user.name@sub.domain.tld", + "id": "123456789abcdef123456789", "type": "admin" }, "mfa": true, "organization": "1234abcdef123456789abcde", - "success": true + "service": "directory", + "success": true, + "timestamp": "2023-01-14T08:16:06.495Z", + "useragent": { + "device": "Mac", + "major": "109", + "minor": "0", + "name": "Chrome", + "os": "Mac OS X", + "os_full": "Mac OS X 10.15.7", + "os_major": "10", + "os_minor": "15", + "os_name": "Mac OS X", + "os_patch": "7", + "os_version": "10.15.7", + "patch": "0", + "version": "109.0.0.0" + }, + "version": "1" } }, "source": { @@ -287,6 +337,11 @@ An example event for `events` looks as following: "id": "123456789abcdef123456789" } }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields", + "forwarded" + ], "user_agent": { "device": { "name": "Mac" diff --git a/packages/jumpcloud/kibana/tags.yml b/packages/jumpcloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/jumpcloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/jumpcloud/manifest.yml b/packages/jumpcloud/manifest.yml index db050e5d64d..8c1cdde5fa0 100644 --- a/packages/jumpcloud/manifest.yml +++ b/packages/jumpcloud/manifest.yml @@ -1,15 +1,17 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: jumpcloud title: "JumpCloud" -version: "1.0.0" +version: "1.4.0" description: "Collect logs from JumpCloud Directory as a Service" type: integration categories: - cloud - security conditions: - kibana.version: "^8.7.1" - elastic.subscription: "basic" + kibana: + version: "^8.7.1" + elastic: + subscription: "basic" screenshots: - src: /img/sample-screenshot.png title: Sample screenshot @@ -30,3 +32,4 @@ policy_templates: description: Collects JumpCloud Directory Insights Events via API owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/juniper_srx/_dev/build/build.yml b/packages/juniper_srx/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/juniper_srx/_dev/build/build.yml +++ b/packages/juniper_srx/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/juniper_srx/changelog.yml b/packages/juniper_srx/changelog.yml index 2ec7a93f71d..aaec89af29a 100644 --- a/packages/juniper_srx/changelog.yml +++ b/packages/juniper_srx/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.14.1" + changes: + - description: Fix system logs grok + type: bugfix + link: https://github.com/elastic/integrations/pull/7280 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7109 +- version: "1.13.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "1.13.0" changes: - description: Support system logs diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-atp.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-atp.log-expected.json index 942296121e5..ddfb164a2d7 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-atp.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-atp.log-expected.json @@ -23,7 +23,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware_detected", @@ -108,7 +108,7 @@ { "@timestamp": "2016-09-20T17:43:30.330Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware_detected", @@ -174,7 +174,7 @@ { "@timestamp": "2016-09-20T17:40:30.050Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -255,7 +255,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-flow.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-flow.log-expected.json index 3aee50d1155..a072032a7bd 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-flow.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-flow.log-expected.json @@ -30,7 +30,7 @@ "port": 10400 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -134,7 +134,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_deny", @@ -231,7 +231,7 @@ "port": 2003 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_deny", @@ -346,7 +346,7 @@ "port": 902 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -475,7 +475,7 @@ "port": 768 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -594,7 +594,7 @@ "port": 46384 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -707,7 +707,7 @@ "port": 46384 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -830,7 +830,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -950,7 +950,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -1072,7 +1072,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -1207,7 +1207,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -1320,7 +1320,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -1443,7 +1443,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1565,7 +1565,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1696,7 +1696,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -1829,7 +1829,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1969,7 +1969,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2107,7 +2107,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -2246,7 +2246,7 @@ "port": 768 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2358,7 +2358,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_deny", @@ -2466,7 +2466,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -2609,7 +2609,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2733,7 +2733,7 @@ "port": 8883 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -2863,7 +2863,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2981,7 +2981,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -3105,7 +3105,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3225,7 +3225,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3352,7 +3352,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", @@ -3495,7 +3495,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_close", diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-idp.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-idp.log-expected.json index d9d219a121c..753231e2f50 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-idp.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-idp.log-expected.json @@ -22,7 +22,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security_threat", @@ -153,7 +153,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security_threat", @@ -284,7 +284,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security_threat", @@ -406,7 +406,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "security_threat", @@ -513,7 +513,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application_ddos", @@ -592,7 +592,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application_ddos", @@ -690,7 +690,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application_ddos", diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-ids.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-ids.log-expected.json index 3f2493a07bc..32643e46c7c 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-ids.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-ids.log-expected.json @@ -23,7 +23,7 @@ "port": 1433 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sweep_detected", @@ -117,7 +117,7 @@ "port": 139 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack_detected", @@ -210,7 +210,7 @@ "port": 50010 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flood_detected", @@ -307,7 +307,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flood_detected", @@ -401,7 +401,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fragment_detected", @@ -493,7 +493,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -585,7 +585,7 @@ "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tunneling_screen", @@ -678,7 +678,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "tunneling_screen", @@ -772,7 +772,7 @@ "ip": "67.43.156.12" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flood_detected", @@ -834,7 +834,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flood_detected", @@ -913,7 +913,7 @@ "port": 10778 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "scan_detected", @@ -986,7 +986,7 @@ "port": 7 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "illegal_tcp_flag_detected", diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-secintel.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-secintel.log-expected.json index 808c9dfcf7d..bf80a822ea1 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-secintel.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-secintel.log-expected.json @@ -23,7 +23,7 @@ "port": 24039 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware_detected", @@ -130,7 +130,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "malware_detected", diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log index f7e182771cb..2a3dadbf708 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log @@ -1,6 +1,10 @@ <30>1 2023-05-04T15:27:30.846+10:00 AB1234-ABC2-AB-AB01C-ABC kmd 8961 KMD_PM_SA_ESTABLISHED [junos@1111.1.1.1.1.111 local-address="89.160.20.112" remote-address="67.43.156.0" local-initiator="ipv4(89.160.20.112-89.160.20.114)" remote-responder="ipv4(67.43.156.0)" argument1="outbound" index1="36090046" index2="0" mode="Tunnel" type="dynamic" traffic-selector-name="ASJLKN_JKHA" first-forwarding-class=""] <30>1 2023-05-04T15:27:26.461+10:00 AB1234-A-AB-AB01C-ABC kmd 13862 KMD_PM_SA_ESTABLISHED [junos@1111.1.1.1.1.111 local-address="89.160.20.112" remote-address="67.43.156.0" local-initiator="ipv4_subnet(any:0,[0..7\]=89.160.20.112/29)" remote-responder="ipv4_subnet(any:0,[0..7\]=67.43.156.0/24)" argument1="outbound" index1="3700499780" index2="0" mode="Tunnel" type="dynamic" traffic-selector-name="" first-forwarding-class=""] Local gateway: 89.160.20.115, Remote gateway: 67.43.156.1, Local ID: ipv4_subnet(any:0,[0..7]=89.160.20.114/29), Remote ID: ipv4_subnet(any:0,[0..7]=67.43.156.1/24), Direction: outbound, SPI: 0xdc912544, AUX-SPI: 0, Mode: Tunnel, Type: dynamic, Traffic-selector: FC Name: <27>1 2023-05-04T15:19:33.984+10:00 AB1234-A-AB-AB01C-ABC kmd 9159 - - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator +<27>1 2023-05-04T15:19:33.984+10:00 AB1234-A-AB-AB01C-ABC kmd 9159 asd2 - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator +<27>1 2023-07-04T12:22:36.461+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5, Role: Initiator +<30>1 2023-07-04T10:21:11.590+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder +<27>1 2023-07-04T11:48:31.702+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6 <158>1 2023-05-04T15:21:01.102+10:00 AB1234-ABC2-AB-AB01C-ABC kernel - - - FW: gr-0/0/0.14 A udp 127.0.0.1 89.160.20.112 49153 49153 <158>1 2023-05-04T15:18:05.010+10:00 AB1234-ABC2-AB-AB01C-ABC - - - - node1.fpc0 PFE_FW_SYSLOG_IP: FW: reth5.175 A pim 67.43.156.1 89.160.20.113 0 0 (1 packets) <158>1 2023-05-09T12:20:23.180+10:00 AAAA-A-AA-AAAAAA-AAAAAA-AAA - - - - AAAA-A-AA-AAAAAA-AAAAAA-AAA PFE_FW_SYSLOG_IP: FW: reth2.605 A udp 67.43.156.2 89.160.20.112 0 0 (1 packets) @@ -15,3 +19,4 @@ <166>1 2023-05-08T10:54:24.821+10:00 AB1234-A-AB-AB01C-ABC - - - - AB1234-A-AB-AB01C-ABC dpdk_eth_devstart (pid=0x4c6a1bc0): port 7 ifd xe-0/0/7, new dpdk_port_state=2 dpdk_swt_port_state 1 <166>1 2023-05-08T10:54:24.756+10:00 AB1234-A-AB-AB01C-ABC - - - - AB1234-A-AB-AB01C-ABC nh_fabric_fill_jnhinfo: Storing nh_id as 0x2dd and jnh as 0x58e302 <167>1 2023-05-08T10:54:24.704+10:00 AB1234-A-AB-AB01C-ABC - - - - AB1234-A-AB-AB01C-ABC Copying remote chassis chassis 1, IP: 81.2.69.192 +<166>1 2023-05-08T10:54:24.756+10:00 AB1234-A-AB-AB01C-ABC - - - - AB1234-A-AB-AB01C-ABC nh_fabric_fill_jnhinfo: ABCDE: Test default message 123456 diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log-expected.json index c720ad484de..a5ab1e900c2 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log-expected.json @@ -9,7 +9,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -73,7 +73,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -94,6 +94,18 @@ "mode": "Tunnel", "process": "kmd", "remote_responder": "ipv4_subnet(any:0,[0..7\\]=67.43.156.0/24)", + "system": { + "aux_spi": 0, + "direction": "outbound", + "local_gateway": "89.160.20.115", + "local_id": "ipv4_subnet(any:0,[0..7]=89.160.20.114/29)", + "mode": "Tunnel", + "remote_gateway": "67.43.156.1", + "remote_id": "ipv4_subnet(any:0,[0..7]=67.43.156.1/24)", + "spi": "0xdc912544", + "traffic_selector": "FC Name:", + "type": "dynamic" + }, "tag": "KMD_PM_SA_ESTABLISHED", "traffic_selector_name": "", "type": "dynamic" @@ -115,6 +127,8 @@ }, "related": { "ip": [ + "89.160.20.115", + "67.43.156.1", "89.160.20.112", "67.43.156.0" ] @@ -132,7 +146,7 @@ { "@timestamp": "2023-05-04T05:19:33.984Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -145,13 +159,74 @@ "juniper": { "srx": { "log_type": "system", + "negotiation": { + "err_msg": "Timed out", + "message": "failed with error: Timed out. IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator", + "type": "IKE" + }, + "process": "kmd", + "system": { + "ike_version": 1, + "local": "89.160.20.112/500", + "remote": "67.43.156.1/500", + "vpn": "IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW", + "vr_id": "5: Role: Initiator" + } + } + }, + "log": { + "level": "error" + }, + "message": "IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator", + "observer": { + "name": "AB1234-A-AB-AB01C-ABC", + "product": "SRX", + "type": "firewall", + "vendor": "Juniper" + }, + "process": { + "name": "kmd", + "pid": 9159 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-05-04T05:19:33.984Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "\u003c27\u003e1 2023-05-04T15:19:33.984+10:00 AB1234-A-AB-AB01C-ABC kmd 9159 asd2 - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator", + "severity": 27 + }, + "juniper": { + "srx": { + "log_type": "system", + "negotiation": { + "err_msg": "Timed out", + "message": "failed with error: Timed out. IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator", + "type": "IKE" + }, "process": "kmd", - "tag": "Role" + "system": { + "ike_version": 1, + "local": "89.160.20.112/500", + "remote": "67.43.156.1/500", + "vpn": "IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW", + "vr_id": "5: Role: Initiator" + } } }, "log": { "level": "error" }, + "message": "IKE Version: 1, VPN: IPSEC-AAAAA-AAA1-PROD-VPN Gateway: IKE-AAAAA-AAA1-GW, Local: 89.160.20.112/500, Remote: 67.43.156.1/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5: Role: Initiator", "observer": { "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", @@ -166,6 +241,158 @@ "preserve_original_event" ] }, + { + "@timestamp": "2023-07-04T02:22:36.461Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "\u003c27\u003e1 2023-07-04T12:22:36.461+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation failed with error: Timed out. IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5, Role: Initiator", + "severity": 27 + }, + "juniper": { + "srx": { + "log_type": "system", + "negotiation": { + "err_msg": "Timed out", + "message": "failed with error: Timed out. IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5, Role: Initiator", + "type": "IKE" + }, + "process": "kmd", + "system": { + "ike_version": 1, + "local": "10.11.22.444/500", + "remote": "198.1.124.8/500", + "role": "Initiator", + "vpn": "IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW", + "vr_id": "5" + } + } + }, + "log": { + "level": "error" + }, + "message": "IKE Version: 1, VPN: IPSEC-HORSEFACTS-TUN1-PROD-VPN Gateway: IKE-HORSEFACTS-TUN1-GW, Local: 10.11.22.444/500, Remote: 198.1.124.8/500, Local IKE-ID: Not-Available, Remote IKE-ID: Not-Available, VR-ID: 5, Role: Initiator", + "observer": { + "name": "AC004-PR-VPN01-DMZ", + "product": "SRX", + "type": "firewall", + "vendor": "Juniper" + }, + "process": { + "name": "kmd", + "pid": 9812 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-04T00:21:11.590Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "\u003c30\u003e1 2023-07-04T10:21:11.590+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IKE negotiation successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder", + "severity": 30 + }, + "juniper": { + "srx": { + "log_type": "system", + "negotiation": { + "message": "successfully completed. IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder", + "type": "IKE" + }, + "process": "kmd", + "system": { + "ike_version": 1, + "local": "10.8.10.115/9001", + "local_ike_id": "81.2.69.192", + "remote": "89.160.20.112/9001", + "remote_ike_id": "89.160.20.112", + "role": "Responder", + "vpn": "IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW", + "vr_id": "6" + } + } + }, + "log": { + "level": "informational" + }, + "message": "IKE Version: 1, VPN: IPSEC-NIKON-TUN1-PROD-VPN Gateway: IKE-NIKON-TUN1-GW, Local: 10.8.10.115/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 81.2.69.192, Remote IKE-ID: 89.160.20.112, VR-ID: 6, Role: Responder", + "observer": { + "name": "AC004-PR-VPN01-DMZ", + "product": "SRX", + "type": "firewall", + "vendor": "Juniper" + }, + "process": { + "name": "kmd", + "pid": 9812 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-07-04T01:48:31.702Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "\u003c27\u003e1 2023-07-04T11:48:31.702+10:00 AC004-PR-VPN01-DMZ kmd 9812 - - IPSec negotiation failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6", + "severity": 27 + }, + "juniper": { + "srx": { + "log_type": "system", + "negotiation": { + "err_msg": "Peer proposed traffic-selectors are not in configured range", + "message": "failed with error: Peer proposed traffic-selectors are not in configured range. IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6", + "type": "IPSec" + }, + "process": "kmd", + "system": { + "ike_version": 2, + "local": "10.32.64.128/9001", + "local_ike_id": "89.160.20.112", + "remote": "89.160.20.112/9001", + "remote_ike_id": "89.160.20.112", + "vpn": "IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW", + "vr_id": "6" + } + } + }, + "log": { + "level": "error" + }, + "message": "IKE Version: 2, VPN: IPSEC-INT-ORMB-TUN2-VPN Gateway: IKE-INT-ORMB-TUN2-GW, Local: 10.32.64.128/9001, Remote: 89.160.20.112/9001, Local IKE-ID: 89.160.20.112, Remote IKE-ID: 89.160.20.112, VR-ID: 6", + "observer": { + "name": "AC004-PR-VPN01-DMZ", + "product": "SRX", + "type": "firewall", + "vendor": "Juniper" + }, + "process": { + "name": "kmd", + "pid": 9812 + }, + "tags": [ + "preserve_original_event" + ] + }, { "@timestamp": "2023-05-04T05:21:01.102Z", "client": { @@ -177,7 +404,7 @@ "port": 49153 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -193,13 +420,13 @@ "juniper": { "srx": { "log_type": "system", - "process": "kernel", - "tag": "FW" + "process": "kernel" } }, "log": { "level": "informational" }, + "message": "FW: gr-0/0/0.14 A udp 127.0.0.1 89.160.20.112 49153 49153 ", "network": { "transport": "udp" }, @@ -247,7 +474,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -263,13 +490,13 @@ "juniper": { "srx": { "log_type": "system", - "process": "PFE_FW_SYSLOG_IP", - "tag": "FW" + "tag": "PFE_FW_SYSLOG_IP" } }, "log": { "level": "informational" }, + "message": "FW: reth5.175 A pim 67.43.156.1 89.160.20.113 0 0 (1 packets) ", "network": { "transport": "pim" }, @@ -284,9 +511,6 @@ "type": "firewall", "vendor": "Juniper" }, - "process": { - "name": "PFE_FW_SYSLOG_IP" - }, "related": { "ip": [ "67.43.156.1", @@ -318,7 +542,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -334,13 +558,13 @@ "juniper": { "srx": { "log_type": "system", - "process": "PFE_FW_SYSLOG_IP", - "tag": "FW" + "tag": "PFE_FW_SYSLOG_IP" } }, "log": { "level": "informational" }, + "message": "FW: reth2.605 A udp 67.43.156.2 89.160.20.112 0 0 (1 packets)", "network": { "transport": "udp" }, @@ -355,9 +579,6 @@ "type": "firewall", "vendor": "Juniper" }, - "process": { - "name": "PFE_FW_SYSLOG_IP" - }, "related": { "ip": [ "67.43.156.2", @@ -380,7 +601,7 @@ { "@timestamp": "2023-05-04T05:16:17.341Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -398,7 +619,7 @@ "log_type": "system", "process": "mib2d", "rtslib_dfwsm": { - "k_usr_d": "6a38769", + "k_usr_d": "6a38769 ", "u_data": "7a33678" }, "tag": "rtslib_dfwsm_get_async_cb" @@ -407,6 +628,7 @@ "log": { "level": "debug" }, + "message": "rtslib_dfwsm_get_async_cb:u_data:7a33678 k_usr_d:6a38769 ", "observer": { "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", @@ -430,7 +652,7 @@ "ip": "89.160.20.128" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -482,7 +704,7 @@ { "@timestamp": "2023-05-09T23:50:54.371Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -494,14 +716,23 @@ }, "juniper": { "srx": { - "log_type": "system" + "ip_mon_reth_scan": { + "trigger": "reth_scan" + }, + "log_type": "system", + "tag": "ip_mon_reth_scan" } }, "log": { "level": "informational" }, - "message": "- - - - AB1234-A-AB-AB01C-ABC ip_mon_reth_scan: interface st0.60 trigger reth_scan", + "message": "interface st0.60 trigger reth_scan", "observer": { + "ingress": { + "interface": { + "name": "st0.60" + } + }, "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", "type": "firewall", @@ -514,7 +745,7 @@ { "@timestamp": "2023-05-09T12:26:57.174Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -526,13 +757,14 @@ }, "juniper": { "srx": { - "log_type": "system" + "log_type": "system", + "tag": "ha_rto_stats_handler" } }, "log": { "level": "debug" }, - "message": "- - - - AB1234-ABC2-AB-AB01C-ABC ha_rto_stats_handler: Sending RTO counters to RE ", + "message": "Sending RTO counters to RE ", "observer": { "name": "AB1234-ABC2-AB-AB01C-ABC", "product": "SRX", @@ -546,7 +778,7 @@ { "@timestamp": "2023-05-09T13:03:52.466Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -591,7 +823,7 @@ { "@timestamp": "2023-05-08T04:25:07.466Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -639,7 +871,7 @@ "ip": "175.16.199.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -689,7 +921,7 @@ { "@timestamp": "2023-05-08T00:54:24.821Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -701,19 +933,28 @@ }, "juniper": { "srx": { - "log_type": "system" + "dpdk": { + "port_number": 8, + "port_state": 2, + "swt_port_state": 1 + }, + "log_type": "system", + "tag": "dpdk_eth_devstart" } }, "log": { "level": "informational" }, - "message": "- - - - AB1234-A-AB-AB01C-ABC dpdk_eth_devstart (pid=0x4c6b17c0): port 8 has already been started, dpdk_port_state=2 dpdk_swt_port_state 1", + "message": "port 8 has already been started, dpdk_port_state=2 dpdk_swt_port_state 1", "observer": { "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", "type": "firewall", "vendor": "Juniper" }, + "process": { + "pid": 1282086848 + }, "tags": [ "preserve_original_event" ] @@ -721,7 +962,7 @@ { "@timestamp": "2023-05-08T00:54:24.821Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -733,19 +974,33 @@ }, "juniper": { "srx": { - "log_type": "system" + "dpdk": { + "port_number": 7, + "port_state": 2, + "swt_port_state": 1 + }, + "log_type": "system", + "tag": "dpdk_eth_devstart" } }, "log": { "level": "informational" }, - "message": "- - - - AB1234-A-AB-AB01C-ABC dpdk_eth_devstart (pid=0x4c6a1bc0): port 7 ifd xe-0/0/7, new dpdk_port_state=2 dpdk_swt_port_state 1", + "message": "port 7 ifd xe-0/0/7, new dpdk_port_state=2 dpdk_swt_port_state 1", "observer": { + "ingress": { + "interface": { + "name": "xe-0/0/7" + } + }, "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", "type": "firewall", "vendor": "Juniper" }, + "process": { + "pid": 1282022336 + }, "tags": [ "preserve_original_event" ] @@ -753,7 +1008,7 @@ { "@timestamp": "2023-05-08T00:54:24.756Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -765,13 +1020,14 @@ }, "juniper": { "srx": { - "log_type": "system" + "log_type": "system", + "tag": "nh_fabric_fill_jnhinfo" } }, "log": { "level": "informational" }, - "message": "- - - - AB1234-A-AB-AB01C-ABC nh_fabric_fill_jnhinfo: Storing nh_id as 0x2dd and jnh as 0x58e302", + "message": "Storing nh_id as 0x2dd and jnh as 0x58e302", "observer": { "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", @@ -785,7 +1041,7 @@ { "@timestamp": "2023-05-08T00:54:24.704Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -803,7 +1059,40 @@ "log": { "level": "debug" }, - "message": "- - - - AB1234-A-AB-AB01C-ABC Copying remote chassis chassis 1, IP: 81.2.69.192", + "message": "Copying remote chassis chassis 1, IP: 81.2.69.192", + "observer": { + "name": "AB1234-A-AB-AB01C-ABC", + "product": "SRX", + "type": "firewall", + "vendor": "Juniper" + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-05-08T00:54:24.756Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "\u003c166\u003e1 2023-05-08T10:54:24.756+10:00 AB1234-A-AB-AB01C-ABC - - - - AB1234-A-AB-AB01C-ABC nh_fabric_fill_jnhinfo: ABCDE: Test default message 123456", + "severity": 166 + }, + "juniper": { + "srx": { + "log_type": "system", + "tag": "nh_fabric_fill_jnhinfo" + } + }, + "log": { + "level": "informational" + }, + "message": "ABCDE: Test default message 123456", "observer": { "name": "AB1234-A-AB-AB01C-ABC", "product": "SRX", diff --git a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-utm.log-expected.json b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-utm.log-expected.json index 3036fa29ee0..056e59da814 100644 --- a/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-utm.log-expected.json +++ b/packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-utm.log-expected.json @@ -23,7 +23,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "web_filter", @@ -116,7 +116,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -205,7 +205,7 @@ "port": 47095 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "virus_detected", @@ -308,7 +308,7 @@ "port": 33578 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -399,7 +399,7 @@ "port": 51727 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -459,7 +459,7 @@ "ip": "10.10.10.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "antispam_filter", @@ -533,7 +533,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "content_filter", @@ -631,7 +631,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "web_filter", @@ -724,7 +724,7 @@ "port": 47095 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "virus_detected", @@ -827,7 +827,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -919,7 +919,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "web_filter", @@ -1002,7 +1002,7 @@ "port": 58954 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 489d2480276..0c8c0310e9d 100644 --- a/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -5,7 +5,7 @@ description: Pipeline for parsing junipersrx firewall logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -13,22 +13,35 @@ processors: - grok: field: event.original patterns: - # SRX Traffic log pattern - - '^<%{POSINT:syslog_pri}>(\d{1,3}\s)?(?:%{TIMESTAMP_ISO8601:_temp_.raw_date})\s%{SYSLOGHOST:syslog_hostname}\s%{PROG:syslog_program}\s(?:%{POSINT:syslog_pid}|-)?\s%{WORD:tag}\s\[([^=]+?\s)?%{GREEDYDATA:_temp_.traffic_structured}\]\s?$' - # SRX System log patterns (further parsing done in system.yml) - - '^<%{POSINT:syslog_pri}>(\d{1,3}\s)?(?:%{CUSTOM_DATE:_temp_.raw_date})\s%{SYSLOGHOST:syslog_hostname}\s%{GREEDYDATA:_temp_.unparsed.message}$' + # 1. SRX Traffic structured log pattern + - '^%{SYSLOG_PREFIX}?%{TIMESTAMP_ISO8601:_temp_.raw_date}\s%{SYSLOGHOST:syslog_hostname}\s%{JUNIPER_TRAFFIC_PROCESS:syslog_program}\s(?:%{POSINT:syslog_pid}|-)?\s%{WORD:tag}\s\[([^=]+?\s)?%{GREEDYDATA:_temp_.traffic_structured}\]\s?$' + # 2. SRX System structured log pattern (captures all structured logs when syslog_program not in JUNIPER_TRAFFIC_PROCESS) + - '^%{SYSLOG_PREFIX}?%{CUSTOM_DATE:_temp_.raw_date}\s%{SYSLOGHOST:syslog_hostname}\s%{PROG:syslog_program}\s(?:%{POSINT:syslog_pid}|-)?\s%{WORD:tag}\s\[([^=]+?\s)?%{GREEDYDATA:_temp_.system_structured}\](?!=)\s?%{DATA:_temp_.unparsed.message}\s?$' + # 3. SRX System structured-brief and unstructured log patterns (further parsing done in system.yml) + - '^%{SYSLOG_PREFIX}?%{CUSTOM_DATE:_temp_.raw_date}\s%{SYSLOGHOST:syslog_hostname}\s%{GREEDYDATA:_temp_.unparsed.message}$' pattern_definitions: + SYSLOG_PREFIX: '<%{POSINT:syslog_pri}>(?:\d{1,3}\s)' CUSTOM_DATE: "%{TIMESTAMP_ISO8601}|(%{MONTH}%{SPACE}+%{MONTHDAY}%{SPACE}+%{TIME})" + JUNIPER_TRAFFIC_PROCESS: "RT_FLOW|RT_UTM|RT_IDP|RT_IDS|RT_AAMW|RT_SECINTEL" # split Juniper-SRX fields - kv: field: _temp_.traffic_structured - field_split: " (?=[a-z0-9\\_\\-]+=)" + field_split: ' (?=[a-z0-9\_\-]+=)' value_split: "=" prefix: "juniper.srx." ignore_missing: true ignore_failure: false - trim_value: "\"" + trim_value: '"' +# split Juniper-SRX fields + - kv: + field: _temp_.system_structured + field_split: ' (?=[a-z0-9\_\-]+=)' + value_split: "=" + prefix: "juniper.srx." + ignore_missing: true + ignore_failure: false + trim_value: '"' - rename: field: syslog_program @@ -108,7 +121,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' ##################### ## ECS Log Mapping ## @@ -339,7 +352,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: syslog_pid target_field: process.pid diff --git a/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/system.yml b/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/system.yml index 16ef8353f30..7b5ae8e6f09 100644 --- a/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/system.yml +++ b/packages/juniper_srx/data_stream/log/elasticsearch/ingest_pipeline/system.yml @@ -8,84 +8,74 @@ processors: if: ctx._temp_?.unparsed?.message != null && ctx._temp_?.unparsed?.message != "" tag: grok_unparsed_message patterns: -# # SRX System log patterns - - '^(?:%{PROG:syslog_program}|-)?\s(?:%{POSINT:syslog_pid}|-)?\s(?:%{WORD:tag}|-)?\s?((\[([^=]+?\s)?%{DATA:_temp_.system_structured}\"\])|-)?\s?(%{CUSTOM_PROG} )?%{CUSTOM_SYSTEM_TAG:_temp_.sub_tag}:%{DATA:_temp_.unparsed.syslog_structured}\s?$' - - '^(?:%{PROG:syslog_program})?\s(?:%{POSINT:syslog_pid})?\s(?:%{WORD:tag})?\s?(\[([^=]+?\s)?%{DATA:_temp_.system_structured}\"\])?\s?%{DATA:message}\s?$' - - '^(%{CUSTOM_PROG} )?%{CUSTOM_SYSTEM_TAG:_temp_.sub_tag}:%{DATA:_temp_.unparsed.syslog_structured}\s?$' + # 1. SRX System Structured Brief + - '^(?:%{PROG:syslog_program}|-)?\s(?:%{POSINT:syslog_pid}|-)?\s(?:%{WORD:tag}|-)?\s([-]+\s)?%{GREEDYDATA:_temp_.unparsed.system_structured_brief}\s?$' + # 2. SRX System Unstructured - '^%{GREEDYDATA:message}$' - pattern_definitions: - CUSTOM_DATE: "%{TIMESTAMP_ISO8601}|(%{MONTH}%{SPACE}+%{MONTHDAY}%{SPACE}+%{TIME})" - CUSTOM_PROG: "(%{DATA:_temp_.to_be_parsed})?%{PROG:_temp_.syslog_sub_program}(\\[%{POSINT:syslog_pid}\\]|\\s*\\(pid=%{DATA:syslog_pid}\\))?:" - CUSTOM_SYSTEM_TAG: "[A-Za-z_]+" - -# split k-v fields inside structured data -- kv: - field: _temp_.system_structured - if: 'ctx._temp_?.system_structured != null && ctx._temp_?.system_structured != ""' - field_split: " (?=[a-z0-9\\_\\-]+=)" - value_split: "=" - prefix: "juniper.srx." - ignore_missing: true - ignore_failure: false - trim_value: "\"" - - -# Converts all kebab-case key names to snake_case -- script: - lang: painless - if: ctx.juniper?.srx != null - source: >- - ctx.juniper.srx = ctx?.juniper?.srx.entrySet().stream().collect(Collectors.toMap(e -> e.getKey().replace('-', '_'), e -> e.getValue())); +# Parse different types of system_structured_brief messages +- grok: + if: "ctx._temp_?.unparsed?.system_structured_brief != null && ctx._temp_.unparsed.system_structured_brief != ''" + tag: "grok_system_structured_brief" + field: "_temp_.unparsed.system_structured_brief" + patterns: + # 1. Has word 'negotiation' + - '^%{WORD:_temp_.negotiation.type} negotiation %{GREEDYDATA:_temp_.negotiation.message}$' + # 2. Optionally contain hostname, tag, pid, and rest of message is parsed into _temp_.message_brief + - '^(%{SYSLOGHOST:syslog_hostname}\s)?(%{CUSTOM_TAG_BRIEF:_temp_.tag_brief}(\s\(pid=%{DATA:syslog_pid}\))?(:\s))?%{GREEDYDATA:_temp_.message_brief}$' + # 3. Match all + - '^%{GREEDYDATA:message}$' + pattern_definitions: + CUSTOM_TAG_BRIEF: "(?!FW)[A-Za-z_]+" + on_failure: + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" -# Removes all empty fields -- script: - lang: painless - if: ctx.juniper?.srx != null - params: - values: - - "None" - - "UNKNOWN" - - "N/A" - - "-" - source: >- - ctx?.juniper?.srx.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); - -# Clean up syslog_program & tag +# Cleanup process and tag fields. +# If juniper.srx.process and juniper.srx.tag fields are not already set, or has `-`, then set them using newly parsed grok pattern in system_structured_brief - set: field: juniper.srx.process value: "{{{syslog_program}}}" if: 'ctx.syslog_program != null && (ctx.juniper?.srx?.process == null || ctx.juniper?.srx?.process == "-")' -- set: - field: juniper.srx.process - value: "{{{_temp_.syslog_sub_program}}}" - if: 'ctx._temp_?.syslog_sub_program != null && (ctx.juniper?.srx?.process == null || ctx.juniper?.srx?.process == "-")' - set: field: juniper.srx.tag - value: "{{{tag}}}" - if: 'ctx.tag != null && (ctx.juniper?.srx?.tag == null || ctx.juniper?.srx?.tag == "-")' -- set: - field: juniper.srx.tag - value: "{{{_temp_.sub_tag}}}" - if: 'ctx._temp_?.sub_tag != null && (ctx.juniper?.srx?.tag == null || ctx.juniper?.srx?.tag == "-")' + value: "{{{_temp_.tag_brief}}}" + if: 'ctx._temp_?.tag_brief != null && (ctx.juniper?.srx?.tag == null || ctx.juniper.srx.tag == "-")' -#### Firewall (tag = FW) -# if: tag = FW && process = PFE_FW_SYSLOG_IP +# Handle negotiation messages +# 1. if: negotiation.message ~ /^failed.*/ - dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'FW' && ctx.juniper?.srx?.process == 'PFE_FW_SYSLOG_IP'" - tag: "dissect_sub_tag_fw_packets" - field: "_temp_.unparsed.syslog_structured" - pattern: " %{_temp_.fw.interface_name} %{_temp_.fw.filter_action} %{_temp_.fw.packet_protocol} %{_temp_.fw.src_addr} %{_temp_.fw.dst_addr} %{_temp_.fw.src_port} %{_temp_.fw.dst_port} (%{_temp_.fw.packets_num} packets)" + if: "ctx._temp_?.negotiation?.message != null && ctx._temp_.negotiation.message.startsWith('failed')" + tag: "dissect_neg_failed" + field: "_temp_.negotiation.message" + pattern: "failed with error: %{_temp_.negotiation.err_msg}. %{message}" on_failure: - append: field: error.message value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" -# if: tag = FW && process != PFE_FW_SYSLOG_IP +# 2. if: negotiation.message ~ /^success.*/ - dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'FW' && ctx.juniper?.srx?.process != 'PFE_FW_SYSLOG_IP'" - tag: "dissect_sub_tag_fw" - field: "_temp_.unparsed.syslog_structured" - pattern: " %{_temp_.fw.interface_name} %{_temp_.fw.filter_action} %{_temp_.fw.packet_protocol} %{_temp_.fw.src_addr} %{_temp_.fw.dst_addr} %{_temp_.fw.src_port} %{_temp_.fw.dst_port}" + if: "ctx._temp_?.negotiation?.message != null && ctx._temp_.negotiation.message.startsWith('success')" + tag: "dissect_neg_success" + field: "_temp_.negotiation.message" + pattern: "successfully completed. %{message}" + on_failure: + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" +- rename: + field: _temp_.negotiation + target_field: juniper.srx.negotiation + if: ctx._temp_?.negotiation != null + +# Handle Firewall messages (message_brief ~ /^FW:/) +- grok: + if: "ctx._temp_?.message_brief != null && ctx._temp_.message_brief.startsWith('FW:')" + tag: "grok_message_brief" + field: "_temp_.message_brief" + patterns: + - '^FW:\s%{NOTSPACE:_temp_.fw.interface_name}\s%{NOTSPACE:_temp_.fw.filter_action}\s%{NOTSPACE:_temp_.fw.packet_protocol}\s%{NOTSPACE:_temp_.fw.src_addr}\s%{NOTSPACE:_temp_.fw.dst_addr}\s%{NOTSPACE:_temp_.fw.src_port}\s%{NOTSPACE:_temp_.fw.dst_port}\s(\(%{NOTSPACE:_temp_.fw.packets_num} packets\))?\s?$' on_failure: - append: field: error.message @@ -93,17 +83,102 @@ processors: - rename: field: _temp_.fw target_field: juniper.srx.firewall - if: "ctx._temp_?.fw != null && ctx.juniper?.srx?.tag == 'FW' " + if: ctx._temp_?.fw != null - rename: field: juniper.srx.firewall.interface_name target_field: juniper.srx.interface_name if: "ctx.juniper?.srx?.firewall?.interface_name != null" +# Handle rtslib_dfwsm_get_async_cb messages (message_brief ~ /^rtslib_dfwsm_get_async_cb:/) +- dissect: + if: "ctx._temp_?.message_brief != null && ctx._temp_.message_brief.startsWith('rtslib_dfwsm_get_async_cb:')" + tag: "dissect_rtslib_dfwsmr" + field: "_temp_.message_brief" + pattern: "rtslib_dfwsm_get_async_cb:u_data:%{_temp_.rtslib_dfwsm.u_data} k_usr_d:%{_temp_.rtslib_dfwsm.k_usr_d}" + on_failure: + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" +- rename: + field: _temp_.rtslib_dfwsm + target_field: juniper.srx.rtslib_dfwsm + if: ctx._temp_?.rtslib_dfwsm != null + +# Handle ip_mon_reth_scan messages (tag_brief == ip_mon_reth_scan) +- dissect: + if: "ctx._temp_?.tag_brief != null && ctx._temp_.tag_brief == 'ip_mon_reth_scan'" + tag: "dissect_ip_mon_reth_scan" + field: "_temp_.message_brief" + pattern: "interface %{_temp_.ip_mon_reth_scan.interface_name} trigger %{_temp_.ip_mon_reth_scan.trigger}" + on_failure: + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" +- rename: + field: _temp_.ip_mon_reth_scan + target_field: juniper.srx.ip_mon_reth_scan + if: ctx._temp_?.ip_mon_reth_scan != null +- rename: + field: juniper.srx.ip_mon_reth_scan.interface_name + target_field: juniper.srx.interface_name + if: "ctx.juniper?.srx?.ip_mon_reth_scan?.interface_name != null" + +# Handle dpdk_eth_devstart messages (tag_brief == dpdk_eth_devstart) +- grok: + if: "ctx._temp_?.tag_brief != null && ctx._temp_.tag_brief == 'dpdk_eth_devstart'" + tag: "grok_dpdk_eth_devstart" + field: "_temp_.message_brief" + patterns: + - '^port %{POSINT:_temp_.dpdk.port_number} (has already been started|ifd %{DATA:_temp_.dpdk.interface_name}), (new\s)?dpdk_port_state=%{POSINT:_temp_.dpdk.port_state} dpdk_swt_port_state %{POSINT:_temp_.dpdk.swt_port_state}$' + on_failure: + - append: + field: error.message + value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" +- convert: + field: _temp_.dpdk.port_number + type: integer + tag: convert_dpdk_port_number_to_int + ignore_missing: true + if: "ctx._temp_?.dpdk?.port_number != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- convert: + field: _temp_.dpdk.port_state + type: integer + tag: convert_dpdk_port_state_to_int + ignore_missing: true + if: "ctx._temp_?.dpdk?.port_state != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- convert: + field: _temp_.dpdk.swt_port_state + type: integer + tag: convert_swt_port_state_to_int + ignore_missing: true + if: "ctx._temp_?.dpdk?.swt_port_state != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- rename: + field: _temp_.dpdk + target_field: juniper.srx.dpdk + if: ctx._temp_?.dpdk != null +- rename: + field: juniper.srx.dpdk.interface_name + target_field: juniper.srx.interface_name + if: "ctx.juniper?.srx?.dpdk?.interface_name != null" + + ### RTLOG_CONN_ERROR (tag = RTLOG_CONN_ERROR) - dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'RTLOG_CONN_ERROR'" - tag: "dissect_sub_tag_rtlog_conn_err" - field: "_temp_.unparsed.syslog_structured" + if: "ctx._temp_?.unparsed?.system_structured_brief != null && ctx.juniper?.srx?.tag == 'RTLOG_CONN_ERROR'" + tag: "dissect_tag_rtlog_conn_err" + field: "_temp_.unparsed.system_structured_brief" pattern: " Connection error %{_temp_.rtlog_conn_error.stream_name} %{_temp_.rtlog_conn_error.err_msg}" on_failure: - append: @@ -128,7 +203,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.rtlog_conn_error.major type: long @@ -138,7 +213,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.rtlog_conn_error.minor type: long @@ -148,7 +223,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.rtlog_conn_error.code type: long @@ -158,14 +233,14 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' # PING_TEST_COMPLETED # if: tag = PING_TEST_COMPLETED - dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'PING_TEST_COMPLETED'" - tag: "dissect_sub_tag_ping_test" - field: "_temp_.unparsed.syslog_structured" + if: "ctx._temp_?.unparsed?.system_structured_brief != null && ctx.juniper?.srx?.tag == 'PING_TEST_COMPLETED'" + tag: "dissect_tag_ping_test" + field: "_temp_.unparsed.system_structured_brief" pattern: " pingCtlOwnerIndex = %{_temp_.ping_test.owner}, pingCtlTestName = %{_temp_.ping_test.name}" on_failure: - append: @@ -176,28 +251,12 @@ processors: target_field: juniper.srx.ping_test if: "ctx._temp_?.ping_test != null && ctx.juniper?.srx?.tag == 'PING_TEST_COMPLETED' " -# IKE negotiation -# if: tag = IKE negotiation -- dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'IKE negotiation'" - tag: "dissect_sub_tag_ike_neg" - field: "_temp_.unparsed.syslog_structured" - pattern: " failed with error: %{_temp_.ike_negotiation.err_msg}\\. IKE Version: %{_temp_.ike_negotiation.version}, VPN: %{_temp_.ike_negotiation.vpn} Gateway: %{_temp_.ike_negotiation.gateway}, Local: %{_temp_.ike_negotiation.local.ip_range}, Remote: %{_temp_.ike_negotiation.remote.ip_range}, Local IKE-ID: %{_temp_.ike_negotiation.local.ike_id}, Remote IKE-ID: %{_temp_.ike_negotiation.remote.ike_id}, VR-ID: %{_temp_.ike_negotiation.vr_id}, Role: %{_temp_.ike_negotiation.role}" - on_failure: - - append: - field: error.message - value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" -- rename: - field: _temp_.ike_negotiation - target_field: juniper.srx.ike_negotiation - if: "ctx._temp_?.ike_negotiation != null && ctx.juniper?.srx?.tag == 'IKE negotiation' " - # KERN_ARP_ADDR_CHANGE # if: tag = KERN_ARP_ADDR_CHANGE - dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'KERN_ARP_ADDR_CHANGE'" - tag: "dissect_sub_tag_kern_arp_addr" - field: "_temp_.unparsed.syslog_structured" + if: "ctx._temp_?.unparsed?.system_structured_brief != null && ctx.juniper?.srx?.tag == 'KERN_ARP_ADDR_CHANGE'" + tag: "dissect_tag_kern_arp_addr" + field: "_temp_.unparsed.system_structured_brief" pattern: " arp info overwritten for %{_temp_.kern_arp_addr_change.ip} from %{_temp_.kern_arp_addr_change.mac1} to %{_temp_.kern_arp_addr_change.mac2}" on_failure: - append: @@ -216,29 +275,94 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' -# rtslib_dfwsm_get_async_cb -# if: tag = rtslib_dfwsm_get_async_cb -- dissect: - if: "ctx._temp_?.unparsed?.syslog_structured != null && ctx.juniper?.srx?.tag == 'rtslib_dfwsm_get_async_cb'" - tag: "dissect_sub_tag_rtslib_dfwsmr" - field: "_temp_.unparsed.syslog_structured" - pattern: "u_data:%{_temp_.rtslib_dfwsm.u_data} k_usr_d:%{_temp_.rtslib_dfwsm.k_usr_d}" +# After System Structured, Structured-Brief, and Unstructured messages: there are optional key-value pairs seperated by ", ". These should now be in `message` field +# split k-v fields inside message field. +- kv: + field: message + if: 'ctx.message != null && ctx.message != ""' + tag: "kv_message" + field_split: ',\s(?=[a-zA-Z0-9\_\-\s]+:)' + value_split: ":" + prefix: "juniper.srx.system." + ignore_missing: true + ignore_failure: true + trim_value: '"' + +# Cleanup parsed k-v root field `juniper.srx.system`. Removes spaces, lowercases, and converts fields into snake_case +- script: + lang: painless + tag: "script_cleanup_system" + if: ctx.juniper?.srx?.system != null + source: >- + ctx.juniper.srx.system = ctx.juniper.srx.system.entrySet().stream().collect(Collectors.toMap(e -> e.getKey().replace(' ', '_').replace('-', '_').toLowerCase(), e -> e.getValue().trim())); + +####################### +## SRX System Fields ## +####################### +- convert: + field: juniper.srx.system.aux_spi + type: integer + tag: convert_aux_spi_to_int + ignore_missing: true + if: "ctx.juniper?.srx?.system?.aux_spi != null" on_failure: - - append: - field: error.message - value: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" -- rename: - field: _temp_.rtslib_dfwsm - target_field: juniper.srx.rtslib_dfwsm - if: "ctx._temp_?.rtslib_dfwsm != null && ctx.juniper?.srx?.tag == 'rtslib_dfwsm_get_async_cb' " + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- convert: + field: juniper.srx.system.ike_version + type: integer + tag: convert_ike_version_to_int + ignore_missing: true + if: "ctx.juniper?.srx?.system?.ike_version != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- convert: + field: juniper.srx.system.local_gateway + type: ip + tag: convert_local_gateway_to_ip + ignore_missing: true + if: "ctx.juniper?.srx?.system?.local_gateway != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +- convert: + field: juniper.srx.system.remote_gateway + type: ip + tag: convert_remote_gateway_to_ip + ignore_missing: true + if: "ctx.juniper?.srx?.system?.remote_gateway != null" + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' +# Removes all empty fields +- script: + lang: painless + if: ctx.juniper?.srx?.system != null + params: + values: + - "None" + - "UNKNOWN" + - "N/A" + - "-" + - "Not-Available" + source: >- + ctx?.juniper?.srx?.system.entrySet().removeIf(entry -> params.values.contains(entry.getValue())); + +# Copy `message_brief` into `message` if not already exists. This ensures unpased/unstructured data to be present in `message`. +- set: + field: message + copy_from: _temp_.message_brief + if: "ctx._temp_?.message_brief != null && ctx.message == null" -######################### -## SRX System fields ## -######################### ####################### ## ECS Event Mapping ## @@ -329,7 +453,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.firewall.dst_port target_field: destination.port @@ -340,7 +464,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: server.port value: '{{destination.port}}' @@ -355,7 +479,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.nat_destination_port target_field: destination.nat.port @@ -366,7 +490,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: server.nat.port value: '{{destination.nat.port}}' @@ -381,7 +505,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.inbound_bytes target_field: destination.bytes @@ -392,7 +516,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: server.bytes value: '{{destination.bytes}}' @@ -407,7 +531,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.inbound_packets target_field: destination.packets @@ -418,7 +542,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: server.packets value: '{{destination.packets}}' @@ -433,7 +557,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' ############################### ## ECS Client/Source Mapping ## @@ -482,7 +606,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.firewall.src_port target_field: source.port @@ -493,7 +617,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: client.port value: '{{source.port}}' @@ -508,7 +632,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.nat_source_port target_field: source.nat.port @@ -519,7 +643,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: client.nat.port value: '{{source.nat.port}}' @@ -534,7 +658,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.outbound_bytes target_field: source.bytes @@ -545,7 +669,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: client.bytes value: '{{source.bytes}}' @@ -560,7 +684,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.outbound_packets target_field: source.packets @@ -571,7 +695,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: juniper.srx.firewall.packets_num target_field: source.packets @@ -582,7 +706,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: client.packets value: '{{source.packets}}' @@ -597,13 +721,27 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: juniper.srx.username target_field: source.user.name ignore_missing: true if: "ctx.juniper?.srx?.username != null" +######################### +## ECS Related Mapping ## +######################### +- append: + if: 'ctx.juniper?.srx?.system?.local_gateway != null' + field: related.ip + value: '{{juniper.srx.system.local_gateway}}' + allow_duplicates: false +- append: + if: 'ctx.juniper?.srx?.system?.remote_gateway != null' + field: related.ip + value: '{{juniper.srx.system.remote_gateway}}' + allow_duplicates: false + ###################### ## ECS Observer Mapping ## ###################### @@ -611,7 +749,11 @@ processors: field: juniper.srx.interface_name target_field: observer.ingress.interface.name ignore_missing: true - +- rename: + field: syslog_hostname + target_field: observer.name + ignore_missing: true + if: "ctx.syslog_hostname != null && ctx.observer?.name == null" ###################### ## ECS Rule Mapping ## ###################### @@ -649,6 +791,10 @@ processors: ignore_missing: true if: "ctx.juniper?.srx?.message != null" +- remove: + field: juniper.srx.process + if: "ctx.juniper?.srx?.process != null && ['-','N/A','UNKNOWN','None'].contains(ctx.juniper.srx.process)" + ############# ## Cleanup ## ############# @@ -657,6 +803,7 @@ processors: # message field can be removed if all dissect patterns are added. # - message - syslog_program + - syslog_hostname - tag - juniper.srx.destination_port - juniper.srx.nat_destination_port diff --git a/packages/juniper_srx/data_stream/log/fields/fields.yml b/packages/juniper_srx/data_stream/log/fields/fields.yml index 62292ca437f..3f5e6c1f2ef 100644 --- a/packages/juniper_srx/data_stream/log/fields/fields.yml +++ b/packages/juniper_srx/data_stream/log/fields/fields.yml @@ -416,36 +416,75 @@ type: keyword - name: first_forwarding_class type: keyword - - name: rtslib_dfwsm + - name: system type: group fields: - - name: k_usr_d + - name: aux_spi + type: integer + - name: direction type: keyword - - name: u_data + - name: ike_version + type: integer + - name: local type: keyword - - name: ike_negotiation - type: group - fields: - - name: err_msg + - name: local_gateway + type: ip + - name: local_id type: keyword - - name: gateway + - name: local_ike_id type: keyword - - name: local.ike_id + - name: mode type: keyword - - name: local.ip_range + - name: remote type: keyword - - name: remote.ike_id + - name: remote_gateway type: keyword - - name: remote.ip_range + - name: remote_id + type: keyword + - name: remote_ike_id type: keyword - name: role type: keyword - - name: version + - name: spi + type: keyword + - name: traffic_selector + type: keyword + - name: type type: keyword - name: vpn type: keyword - name: vr_id type: keyword + - name: rtslib_dfwsm + type: group + fields: + - name: k_usr_d + type: keyword + - name: u_data + type: keyword + - name: negotiation + type: group + fields: + - name: err_msg + type: keyword + - name: message + type: keyword + - name: type + type: keyword + - name: ip_mon_reth_scan + type: group + fields: + - name: trigger + type: keyword + - name: dpdk + type: group + fields: + - name: port_number + type: integer + - name: port_state + type: integer + - name: swt_port_state + type: integer - name: kern_arp_addr_change type: group fields: diff --git a/packages/juniper_srx/data_stream/log/sample_event.json b/packages/juniper_srx/data_stream/log/sample_event.json index 329812c0bc4..61cbf0ab388 100644 --- a/packages/juniper_srx/data_stream/log/sample_event.json +++ b/packages/juniper_srx/data_stream/log/sample_event.json @@ -33,7 +33,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", diff --git a/packages/juniper_srx/docs/README.md b/packages/juniper_srx/docs/README.md index 671880977d7..bda140a2608 100644 --- a/packages/juniper_srx/docs/README.md +++ b/packages/juniper_srx/docs/README.md @@ -192,14 +192,14 @@ The following processes and tags are supported: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.hash | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -210,7 +210,7 @@ The following processes and tags are supported: | event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | event.url | URL linking to an external system to continue investigation of this event. This URL links to another system where in-depth investigation of the specific occurrence of this event can take place. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | @@ -357,6 +357,9 @@ The following processes and tags are supported: | juniper.srx.context_value | context value | keyword | | juniper.srx.context_value_hit_rate | context value hit rate | integer | | juniper.srx.ddos_application_name | ddos application name | keyword | +| juniper.srx.dpdk.port_number | | integer | +| juniper.srx.dpdk.port_state | | integer | +| juniper.srx.dpdk.swt_port_state | | integer | | juniper.srx.dscp_value | apbr rule type | integer | | juniper.srx.dst_nat_rule_name | dst nat rule name | keyword | | juniper.srx.dst_nat_rule_type | dst nat rule type | keyword | @@ -376,21 +379,12 @@ The following processes and tags are supported: | juniper.srx.function_name | | keyword | | juniper.srx.hostname | hostname | keyword | | juniper.srx.icmp_type | icmp type | integer | -| juniper.srx.ike_negotiation.err_msg | | keyword | -| juniper.srx.ike_negotiation.gateway | | keyword | -| juniper.srx.ike_negotiation.local.ike_id | | keyword | -| juniper.srx.ike_negotiation.local.ip_range | | keyword | -| juniper.srx.ike_negotiation.remote.ike_id | | keyword | -| juniper.srx.ike_negotiation.remote.ip_range | | keyword | -| juniper.srx.ike_negotiation.role | | keyword | -| juniper.srx.ike_negotiation.version | | keyword | -| juniper.srx.ike_negotiation.vpn | | keyword | -| juniper.srx.ike_negotiation.vr_id | | keyword | | juniper.srx.inbound_bytes | bytes from server | integer | | juniper.srx.inbound_packets | packets from server | integer | | juniper.srx.index | index | keyword | | juniper.srx.index1 | | keyword | | juniper.srx.index2 | | keyword | +| juniper.srx.ip_mon_reth_scan.trigger | | keyword | | juniper.srx.kern_arp_addr_change.ip | | ip | | juniper.srx.kern_arp_addr_change.mac1 | | keyword | | juniper.srx.kern_arp_addr_change.mac2 | | keyword | @@ -403,6 +397,9 @@ The following processes and tags are supported: | juniper.srx.mode | | keyword | | juniper.srx.name | name | keyword | | juniper.srx.nat_connection_tag | nat connection tag | keyword | +| juniper.srx.negotiation.err_msg | | keyword | +| juniper.srx.negotiation.message | | keyword | +| juniper.srx.negotiation.type | | keyword | | juniper.srx.nested_application | nested application | keyword | | juniper.srx.obj | url path | keyword | | juniper.srx.occur_count | occur count | integer | @@ -453,6 +450,24 @@ The following processes and tags are supported: | juniper.srx.state | state | keyword | | juniper.srx.status | status | keyword | | juniper.srx.sub_category | sub category | keyword | +| juniper.srx.system.aux_spi | | integer | +| juniper.srx.system.direction | | keyword | +| juniper.srx.system.ike_version | | integer | +| juniper.srx.system.local | | keyword | +| juniper.srx.system.local_gateway | | ip | +| juniper.srx.system.local_id | | keyword | +| juniper.srx.system.local_ike_id | | keyword | +| juniper.srx.system.mode | | keyword | +| juniper.srx.system.remote | | keyword | +| juniper.srx.system.remote_gateway | | keyword | +| juniper.srx.system.remote_id | | keyword | +| juniper.srx.system.remote_ike_id | | keyword | +| juniper.srx.system.role | | keyword | +| juniper.srx.system.spi | | keyword | +| juniper.srx.system.traffic_selector | | keyword | +| juniper.srx.system.type | | keyword | +| juniper.srx.system.vpn | | keyword | +| juniper.srx.system.vr_id | | keyword | | juniper.srx.tag | system log message tag, which uniquely identifies the message. | keyword | | juniper.srx.temporary_filename | temporary_filename | keyword | | juniper.srx.tenant_id | tenant id | keyword | diff --git a/packages/juniper_srx/kibana/tags.yml b/packages/juniper_srx/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/juniper_srx/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/juniper_srx/manifest.yml b/packages/juniper_srx/manifest.yml index f83d96bf07e..ff766f61692 100644 --- a/packages/juniper_srx/manifest.yml +++ b/packages/juniper_srx/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: juniper_srx title: Juniper SRX -version: "1.13.0" +version: "1.15.0" description: Collect logs from Juniper SRX devices with Elastic Agent. categories: ["network", "security", "firewall_security"] type: integration diff --git a/packages/kafka/changelog.yml b/packages/kafka/changelog.yml index d03731bfe61..c24119537ca 100644 --- a/packages/kafka/changelog.yml +++ b/packages/kafka/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.9.2" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.9.1" + changes: + - description: Migrate visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/5594 +- version: "1.9.0" + changes: + - description: Revert changes to permissions to reroute events to logs-*-* for log datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/6803 - version: "1.8.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/kafka/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/kafka/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 474e3992643..1b335a12ec2 100644 --- a/packages/kafka/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/kafka/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -8,6 +8,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original trace_match: true diff --git a/packages/kafka/data_stream/log/manifest.yml b/packages/kafka/data_stream/log/manifest.yml index cd4e39e0eca..4c855f1d41b 100644 --- a/packages/kafka/data_stream/log/manifest.yml +++ b/packages/kafka/data_stream/log/manifest.yml @@ -48,6 +48,6 @@ streams: template_path: log.yml.hbs title: Kafka log logs (log) description: Collect Kafka log logs using log input -# Ensures agents have permissions to write data to `logs-*-*` -elasticsearch.dynamic_dataset: true -elasticsearch.dynamic_namespace: true \ No newline at end of file + +# Ensures agents have permissions to write data to `logs-kafka.log-*` +elasticsearch.dynamic_namespace: true diff --git a/packages/kafka/img/filebeat-kafka-logs-overview.png b/packages/kafka/img/filebeat-kafka-logs-overview.png index b04697a4b33..3b84d3d9a03 100644 Binary files a/packages/kafka/img/filebeat-kafka-logs-overview.png and b/packages/kafka/img/filebeat-kafka-logs-overview.png differ diff --git a/packages/kafka/img/metricbeat_kafka_dashboard.png b/packages/kafka/img/metricbeat_kafka_dashboard.png index ecf3fdfbe4d..df188021e3f 100644 Binary files a/packages/kafka/img/metricbeat_kafka_dashboard.png and b/packages/kafka/img/metricbeat_kafka_dashboard.png differ diff --git a/packages/kafka/kibana/dashboard/kafka-943caca0-87ee-11e7-ad9c-db80de0bf8d3.json b/packages/kafka/kibana/dashboard/kafka-943caca0-87ee-11e7-ad9c-db80de0bf8d3.json index 6612ba1ac04..633a6aa6aca 100644 --- a/packages/kafka/kibana/dashboard/kafka-943caca0-87ee-11e7-ad9c-db80de0bf8d3.json +++ b/packages/kafka/kibana/dashboard/kafka-943caca0-87ee-11e7-ad9c-db80de0bf8d3.json @@ -1,24 +1,188 @@ { "attributes": { "description": "Logs Kafka integration dashboard", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, "panelsJSON": [ { - "embeddableConfig": {}, + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d74d8027-0eee-45ec-941d-5e9e0b4e4ee9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d74d8027-0eee-45ec-941d-5e9e0b4e4ee9": { + "columnOrder": [ + "51bdb46e-db3c-4d92-a2b4-fc62b3cc40fe", + "1aa00862-932f-4a54-879b-6953bd6b4872", + "f9adaa44-69db-4cd1-a603-07771230c61a" + ], + "columns": { + "1aa00862-932f-4a54-879b-6953bd6b4872": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "kafka.log.trace.class: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f9adaa44-69db-4cd1-a603-07771230c61a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.log.trace.class" + }, + "51bdb46e-db3c-4d92-a2b4-fc62b3cc40fe": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f9adaa44-69db-4cd1-a603-07771230c61a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "kafka.log.trace.class:*" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "f9adaa44-69db-4cd1-a603-07771230c61a" + ], + "isHistogram": true, + "layerId": "d74d8027-0eee-45ec-941d-5e9e0b4e4ee9", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "1aa00862-932f-4a54-879b-6953bd6b4872", + "xAccessor": "51bdb46e-db3c-4d92-a2b4-fc62b3cc40fe", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "f9adaa44-69db-4cd1-a603-07771230c61a" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "xTitle": "", + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 12, "i": "1", @@ -27,8 +191,9 @@ "y": 0 }, "panelIndex": "1", - "panelRefName": "panel_0", - "version": "7.3.0" + "title": "Number of stracktraces by class [Logs Kafka]", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { @@ -37,6 +202,7 @@ "kafka.log.trace.class", "kafka.log.trace.full" ], + "enhancements": {}, "sort": [ "@timestamp", "desc" @@ -50,8 +216,9 @@ "y": 0 }, "panelIndex": "2", - "panelRefName": "panel_1", - "version": "7.3.0" + "panelRefName": "panel_2", + "type": "search", + "version": "8.7.0" }, { "embeddableConfig": { @@ -60,6 +227,7 @@ "kafka.log.component", "message" ], + "enhancements": {}, "sort": [ "@timestamp", "desc" @@ -73,11 +241,203 @@ "y": 20 }, "panelIndex": "3", - "panelRefName": "panel_2", - "version": "7.3.0" + "panelRefName": "panel_3", + "type": "search", + "version": "8.7.0" }, { - "embeddableConfig": {}, + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9f47bfb1-37f3-43f2-bee8-765df082d9e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0d3f3d8b-6a25-4de7-9fc3-2640ac541625", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f47bfb1-37f3-43f2-bee8-765df082d9e2": { + "columnOrder": [ + "1d25f2e2-da73-4042-8163-ee1b78ee89bc", + "87311701-a5a1-4bc1-88d3-3b7039781c00", + "e9254b85-f4fa-4067-82ec-016b8478c669" + ], + "columns": { + "1d25f2e2-da73-4042-8163-ee1b78ee89bc": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "87311701-a5a1-4bc1-88d3-3b7039781c00": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Log Level", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e9254b85-f4fa-4067-82ec-016b8478c669", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "e9254b85-f4fa-4067-82ec-016b8478c669": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0d3f3d8b-6a25-4de7-9fc3-2640ac541625", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "kafka.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": { + "query": "kafka.log" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "e9254b85-f4fa-4067-82ec-016b8478c669" + ], + "isHistogram": true, + "layerId": "9f47bfb1-37f3-43f2-bee8-765df082d9e2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "87311701-a5a1-4bc1-88d3-3b7039781c00", + "xAccessor": "1d25f2e2-da73-4042-8163-ee1b78ee89bc", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "e9254b85-f4fa-4067-82ec-016b8478c669" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "xTitle": "", + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 8, "i": "4", @@ -86,35 +446,46 @@ "y": 12 }, "panelIndex": "4", - "panelRefName": "panel_3", - "version": "7.3.0" + "title": "Log levels over time [Logs Kafka]", + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Logs Kafka] Overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-26T07:00:13.043Z", "id": "kafka-943caca0-87ee-11e7-ad9c-db80de0bf8d3", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "kafka-number-of-kafka-stracktraces-by-class", - "name": "panel_0", - "type": "visualization" + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-d74d8027-0eee-45ec-941d-5e9e0b4e4ee9", + "type": "index-pattern" }, { "id": "kafka-stacktraces", - "name": "panel_1", + "name": "2:panel_2", "type": "search" }, { "id": "kafka-all-kafka-logs", - "name": "panel_2", + "name": "3:panel_3", "type": "search" }, { - "id": "kafka-3f7c33c0-87ee-11e7-ad9c-db80de0bf8d3", - "name": "panel_3", - "type": "visualization" + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-9f47bfb1-37f3-43f2-bee8-765df082d9e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:0d3f3d8b-6a25-4de7-9fc3-2640ac541625", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/kafka/kibana/dashboard/kafka-ea488d90-8e63-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/dashboard/kafka-ea488d90-8e63-11e8-8fa2-3d5f811fbd0f.json index fb24c9d2dce..daa33307a32 100644 --- a/packages/kafka/kibana/dashboard/kafka-ea488d90-8e63-11e8-8fa2-3d5f811fbd0f.json +++ b/packages/kafka/kibana/dashboard/kafka-ea488d90-8e63-11e8-8fa2-3d5f811fbd0f.json @@ -1,220 +1,2120 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"aa887cf3-390b-4da6-8c02-43ec133b0971\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"title\":\"Topic Name\",\"fieldName\":\"kafka.topic.name\",\"id\":\"aa887cf3-390b-4da6-8c02-43ec133b0971\",\"selectedOptions\":[],\"enhancements\":{}}},\"bb5b4dfa-d433-48d7-8e16-7d2ad832565a\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"rangeSliderControl\",\"explicitInput\":{\"title\":\"Partition\",\"fieldName\":\"kafka.partition.id\",\"id\":\"bb5b4dfa-d433-48d7-8e16-7d2ad832565a\",\"value\":[\"\",\"\"],\"enhancements\":{}}}}" + }, "description": "Kafka analysis of topics and consumer groups", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false, "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "embeddableConfig": {}, + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e343bc30-40c9-44ef-95c4-e0f3c0c09e42": { + "columnOrder": [ + "b7102aca-084c-4804-87f0-e84917de750f", + "26f45bfa-6968-437a-bc86-8597977a9f38", + "45efad59-6952-4670-aecb-085462439a5b" + ], + "columns": { + "26f45bfa-6968-437a-bc86-8597977a9f38": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "45efad59-6952-4670-aecb-085462439a5b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "lucene", + "query": "metricset.name: consumergroup" + }, + "isBucketed": false, + "label": "Consumer Offsets", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "kafka.consumergroup.offset" + }, + "b7102aca-084c-4804-87f0-e84917de750f": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of kafka.consumergroup.id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.consumergroup.id" + } + }, + "incompleteColumns": {} + }, + "f5a5405c-7642-497b-8a1b-085809cb9434": { + "columnOrder": [ + "d5e7a98f-3830-4521-8d3a-1f006b0d543e", + "3f05b2ce-029d-4098-9893-eda6d42d766e", + "84ab538f-c208-4951-a008-33550334fd0c" + ], + "columns": { + "3f05b2ce-029d-4098-9893-eda6d42d766e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "84ab538f-c208-4951-a008-33550334fd0c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "lucene", + "query": "metricset.name: partition AND kafka.partition.partition.is_leader: true" + }, + "isBucketed": false, + "label": "Topic Offsets", + "operationType": "sum", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "kafka.partition.offset.newest" + }, + "d5e7a98f-3830-4521-8d3a-1f006b0d543e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of kafka.topic.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.topic.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e343bc30-40c9-44ef-95c4-e0f3c0c09e42", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-f5a5405c-7642-497b-8a1b-085809cb9434", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "NOT kafka.topic.name:__consumer_offsets" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "emphasizeFitting": true, + "endValue": "Zero", + "fillOpacity": 0.1, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "84ab538f-c208-4951-a008-33550334fd0c" + ], + "layerId": "f5a5405c-7642-497b-8a1b-085809cb9434", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar", + "splitAccessor": "d5e7a98f-3830-4521-8d3a-1f006b0d543e", + "xAccessor": "3f05b2ce-029d-4098-9893-eda6d42d766e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(244,78,59,1)", + "forAccessor": "84ab538f-c208-4951-a008-33550334fd0c" + } + ] + }, + { + "accessors": [ + "45efad59-6952-4670-aecb-085462439a5b" + ], + "layerId": "e343bc30-40c9-44ef-95c4-e0f3c0c09e42", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "b7102aca-084c-4804-87f0-e84917de750f", + "xAccessor": "26f45bfa-6968-437a-bc86-8597977a9f38", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(244,78,59,0.52)", + "forAccessor": "45efad59-6952-4670-aecb-085462439a5b" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 13, "i": "1", "w": 24, "x": 0, - "y": 20 + "y": 16 }, "panelIndex": "1", - "panelRefName": "panel_0", "title": "Kafka Topic \u0026 Consumer Offsets", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" }, { - "embeddableConfig": {}, - "gridData": { - "h": 6, - "i": "3", - "w": 16, - "x": 0, - "y": 0 + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "b76c820e-d1c2-4a0f-8196-fc993715d766": { + "columnOrder": [ + "63dbb107-abcd-4b40-af10-be0b4e2888b2", + "de007327-323d-48eb-b9a0-7c20a500fc35", + "ffd49773-5527-4cc4-8203-bc3b0a156bbe" + ], + "columns": { + "63dbb107-abcd-4b40-af10-be0b4e2888b2": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of kafka.topic.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.topic.name" + }, + "de007327-323d-48eb-b9a0-7c20a500fc35": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ffd49773-5527-4cc4-8203-bc3b0a156bbe": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Consumer Groups", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "kafka.consumergroup.consumer_lag" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-b76c820e-d1c2-4a0f-8196-fc993715d766", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "(metricset.name: consumergroup) AND NOT kafka.topic.name:__consumer_offsets" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.2, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ffd49773-5527-4cc4-8203-bc3b0a156bbe" + ], + "layerId": "b76c820e-d1c2-4a0f-8196-fc993715d766", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "63dbb107-abcd-4b40-af10-be0b4e2888b2", + "xAccessor": "de007327-323d-48eb-b9a0-7c20a500fc35", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,156,224,1)", + "forAccessor": "ffd49773-5527-4cc4-8203-bc3b0a156bbe" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "panelIndex": "3", - "panelRefName": "panel_1", - "title": "Kafka Controls", - "version": "7.3.0" - }, - { - "embeddableConfig": {}, "gridData": { "h": 14, "i": "6", "w": 24, "x": 0, - "y": 6 + "y": 29 }, "panelIndex": "6", - "panelRefName": "panel_2", "title": "Consumer Group Lag by Topic", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "spy": null + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "2bf9edb8-f8af-47d8-a670-66657b9deab4": { + "columnOrder": [ + "9e9c538c-395a-488a-a2f3-ba1c70cce5ed", + "6f0d8e89-44bb-4ea9-a556-0d0fa3298ae7", + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8", + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X0", + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X1", + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X2" + ], + "columns": { + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Consumer -\u003e Partition Reassignment", + "operationType": "formula", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + }, + "formula": "ifelse(differences(sum(kafka.partition.id)) \u003c 0, -1, 1)", + "isFormulaBroken": false + }, + "references": [ + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X2" + ], + "scale": "ratio" + }, + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Consumer -\u003e Partition Reassignment", + "operationType": "sum", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "kafka.partition.id" + }, + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Consumer -\u003e Partition Reassignment", + "operationType": "differences", + "references": [ + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X0" + ], + "scale": "ratio" + }, + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Consumer -\u003e Partition Reassignment", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + { + "args": [ + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X1", + 0 + ], + "location": { + "max": 47, + "min": 7 + }, + "name": "lt", + "text": "differences(sum(kafka.partition.id)) \u003c 0", + "type": "function" + }, + -1, + 1 + ], + "location": { + "max": 55, + "min": 0 + }, + "name": "ifelse", + "text": "ifelse(differences(sum(kafka.partition.id)) \u003c 0, -1, 1)", + "type": "function" + } + }, + "references": [ + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8X1" + ], + "scale": "ratio" + }, + "6f0d8e89-44bb-4ea9-a556-0d0fa3298ae7": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9e9c538c-395a-488a-a2f3-ba1c70cce5ed": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of kafka.consumergroup.id", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.consumergroup.id" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-2bf9edb8-f8af-47d8-a670-66657b9deab4", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "NOT kafka.topic.name:__consumer_offsets" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": false + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "4d836f5a-e8bc-47cd-aae7-9ae557625ed8" + ], + "layerId": "2bf9edb8-f8af-47d8-a670-66657b9deab4", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "splitAccessor": "9e9c538c-395a-488a-a2f3-ba1c70cce5ed", + "xAccessor": "6f0d8e89-44bb-4ea9-a556-0d0fa3298ae7", + "yConfig": [ + { + "axisMode": "right", + "color": "#68BC00", + "forAccessor": "4d836f5a-e8bc-47cd-aae7-9ae557625ed8" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "lowerBound": -1, + "mode": "custom", + "upperBound": 1 + }, + "yRightScale": "linear", + "yRightTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 6, - "i": "10", - "w": 25, - "x": 16, - "y": 0 - }, - "panelIndex": "10", - "panelRefName": "panel_3", - "title": "Kafka Metrics", - "version": "7.3.0" - }, - { - "embeddableConfig": {}, - "gridData": { - "h": 7, + "h": 10, "i": "12", "w": 24, "x": 0, - "y": 33 + "y": 6 }, "panelIndex": "12", - "panelRefName": "panel_4", "title": "Consumer Partition Reassignments", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" }, { - "embeddableConfig": {}, + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-830f7c05-123b-4860-b1c0-35c43878b6b5", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "9d1b6107-05fe-4216-9c22-22080fabf6e7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "830f7c05-123b-4860-b1c0-35c43878b6b5": { + "columnOrder": [ + "ae32c64d-c441-43cc-8d6f-0fa79bae2e46" + ], + "columns": { + "ae32c64d-c441-43cc-8d6f-0fa79bae2e46": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Consumer Groups", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.consumergroup.id" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9d1b6107-05fe-4216-9c22-22080fabf6e7", + "key": "kafka.topic.name", + "negate": true, + "params": { + "query": "__consumer_offsets" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "kafka.topic.name": { + "query": "__consumer_offsets" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "830f7c05-123b-4860-b1c0-35c43878b6b5", + "layerType": "data", + "metricAccessor": "ae32c64d-c441-43cc-8d6f-0fa79bae2e46" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 6, "i": "13", - "w": 7, - "x": 41, + "w": 8, + "x": 40, "y": 0 }, "panelIndex": "13", - "panelRefName": "panel_5", "title": "Consumer Metrics", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "spy": null, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-e2b7a1c1-c294-4776-8fbd-eb9f3dd589c4", + "type": "index-pattern" } - } - } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e2b7a1c1-c294-4776-8fbd-eb9f3dd589c4": { + "columnOrder": [ + "c3601537-b176-4146-9d26-6cd795c5a0e2", + "dfe5de7d-4bea-4bd6-9d99-0f2e79e91cb5", + "850948a3-e2d5-48ac-8f6a-40fbda645be7", + "34e80918-146b-4b09-8b12-33b480467857" + ], + "columns": { + "34e80918-146b-4b09-8b12-33b480467857": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Newest Offset", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.consumergroup.offset" + }, + "850948a3-e2d5-48ac-8f6a-40fbda645be7": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Partition", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "34e80918-146b-4b09-8b12-33b480467857", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 256 + }, + "scale": "ordinal", + "sourceField": "kafka.partition.id" + }, + "c3601537-b176-4146-9d26-6cd795c5a0e2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Consumer group client", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 64 + }, + "scale": "ordinal", + "sourceField": "kafka.consumergroup.client.id" + }, + "dfe5de7d-4bea-4bd6-9d99-0f2e79e91cb5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Topic", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "34e80918-146b-4b09-8b12-33b480467857", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 64 + }, + "scale": "ordinal", + "sourceField": "kafka.topic.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "34e80918-146b-4b09-8b12-33b480467857" + }, + { + "alignment": "left", + "columnId": "c3601537-b176-4146-9d26-6cd795c5a0e2" + }, + { + "alignment": "left", + "columnId": "dfe5de7d-4bea-4bd6-9d99-0f2e79e91cb5" + }, + { + "alignment": "left", + "columnId": "850948a3-e2d5-48ac-8f6a-40fbda645be7" + } + ], + "headerRowHeight": "single", + "layerId": "e2b7a1c1-c294-4776-8fbd-eb9f3dd589c4", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 13, + "h": 14, "i": "14", "w": 24, "x": 24, - "y": 27 + "y": 29 }, "panelIndex": "14", - "panelRefName": "panel_6", "title": "Kafka Consumer Group Clients", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ebc61b65-c863-436a-87c6-4283ed3e22a3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "209ac5d7-4976-45c6-914d-554e96a04b80", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c8601c8-031b-4b4f-8dd3-91fdedd7625f": { + "columnOrder": [ + "db07b802-fc70-49da-88ac-5617bff1fab9" + ], + "columns": { + "db07b802-fc70-49da-88ac-5617bff1fab9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": " Brokers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.broker.id" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Partition Metricset", + "disabled": false, + "index": "ebc61b65-c863-436a-87c6-4283ed3e22a3", + "key": "metricset.name", + "negate": false, + "params": { + "query": "partition" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "metricset.name": "partition" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "209ac5d7-4976-45c6-914d-554e96a04b80", + "key": "kafka.topic.name", + "negate": true, + "params": { + "query": "__consumer_offsets" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "kafka.topic.name": "__consumer_offsets" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "layerType": "data", + "metricAccessor": "db07b802-fc70-49da-88ac-5617bff1fab9" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 6, + "i": "ad4575fb-5b4f-4c42-8c50-c2b60b2c72f7", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "ad4575fb-5b4f-4c42-8c50-c2b60b2c72f7", + "title": "Kafka Metrics", + "type": "lens", + "version": "8.7.0" }, { - "embeddableConfig": {}, + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "78ae48ec-7c0a-4765-8859-6e03f5918e75", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "f1da74f7-5232-42df-9f63-7d2fa0a62c76", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c8601c8-031b-4b4f-8dd3-91fdedd7625f": { + "columnOrder": [ + "db07b802-fc70-49da-88ac-5617bff1fab9" + ], + "columns": { + "db07b802-fc70-49da-88ac-5617bff1fab9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Topics", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.topic.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Partition Metricset", + "disabled": false, + "index": "78ae48ec-7c0a-4765-8859-6e03f5918e75", + "key": "metricset.name", + "negate": false, + "params": { + "query": "partition" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "metricset.name": "partition" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f1da74f7-5232-42df-9f63-7d2fa0a62c76", + "key": "kafka.topic.name", + "negate": true, + "params": { + "query": "__consumer_offsets" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "kafka.topic.name": "__consumer_offsets" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "layerType": "data", + "metricAccessor": "db07b802-fc70-49da-88ac-5617bff1fab9" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 6, + "i": "02a0cadd-8e80-4380-b9a1-0d41cfef29d6", + "w": 10, + "x": 10, + "y": 0 + }, + "panelIndex": "02a0cadd-8e80-4380-b9a1-0d41cfef29d6", + "title": "Kafka Metrics", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "da6c65a2-27dc-481d-bc6c-dc1616367f54", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "85d5c138-1e66-41f8-b7cb-4506315cf1db", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c8601c8-031b-4b4f-8dd3-91fdedd7625f": { + "columnOrder": [ + "db07b802-fc70-49da-88ac-5617bff1fab9" + ], + "columns": { + "db07b802-fc70-49da-88ac-5617bff1fab9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Partitions", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.topic_id" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Partition Metricset", + "disabled": false, + "index": "da6c65a2-27dc-481d-bc6c-dc1616367f54", + "key": "metricset.name", + "negate": false, + "params": { + "query": "partition" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "metricset.name": "partition" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "85d5c138-1e66-41f8-b7cb-4506315cf1db", + "key": "kafka.topic.name", + "negate": true, + "params": { + "query": "__consumer_offsets" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "kafka.topic.name": "__consumer_offsets" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "layerType": "data", + "metricAccessor": "db07b802-fc70-49da-88ac-5617bff1fab9" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 6, + "i": "b7ca8c63-46bc-46f4-bf44-b211814b5a8b", + "w": 10, + "x": 20, + "y": 0 + }, + "panelIndex": "b7ca8c63-46bc-46f4-bf44-b211814b5a8b", + "title": "Kafka Metrics", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "c13f48df-9bb5-43ff-850d-54d8dc041e19", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "8f7d6f5f-3f7d-4b89-9386-9e79ce5babda", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c8601c8-031b-4b4f-8dd3-91fdedd7625f": { + "columnOrder": [ + "db07b802-fc70-49da-88ac-5617bff1fab9" + ], + "columns": { + "db07b802-fc70-49da-88ac-5617bff1fab9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Replicas", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.topic_broker_id" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Partition Metricset", + "disabled": false, + "index": "c13f48df-9bb5-43ff-850d-54d8dc041e19", + "key": "metricset.name", + "negate": false, + "params": { + "query": "partition" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "metricset.name": "partition" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8f7d6f5f-3f7d-4b89-9386-9e79ce5babda", + "key": "kafka.topic.name", + "negate": true, + "params": { + "query": "__consumer_offsets" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "kafka.topic.name": "__consumer_offsets" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "layerType": "data", + "metricAccessor": "db07b802-fc70-49da-88ac-5617bff1fab9" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 6, + "i": "3bf5acc4-bca8-4dae-bf9d-7b7f5de0ef2f", + "w": 10, + "x": 30, + "y": 0 + }, + "panelIndex": "3bf5acc4-bca8-4dae-bf9d-7b7f5de0ef2f", + "title": "Kafka Metrics", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-4861f473-2d68-4883-a7e9-ba3df76aac81", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4861f473-2d68-4883-a7e9-ba3df76aac81": { + "columnOrder": [ + "3cea9a18-83dc-4e71-b1d2-379f9f274ce6", + "e329dd2f-3787-458b-9aa7-a8078e17f68d", + "e3f29d35-5d89-417c-98c2-9bea7510680a", + "b2967600-3833-4e56-99db-02e8055c3d65" + ], + "columns": { + "3cea9a18-83dc-4e71-b1d2-379f9f274ce6": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Broker ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 256 + }, + "scale": "ordinal", + "sourceField": "kafka.partition.partition.replica" + }, + "b2967600-3833-4e56-99db-02e8055c3d65": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Replicas", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.topic_broker_id" + }, + "e329dd2f-3787-458b-9aa7-a8078e17f68d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Topics", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.topic.name" + }, + "e3f29d35-5d89-417c-98c2-9bea7510680a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "kafka.partition.partition.is_leader: true" + }, + "isBucketed": false, + "label": "Leader Partitions", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.topic_id" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "3cea9a18-83dc-4e71-b1d2-379f9f274ce6", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "e329dd2f-3787-458b-9aa7-a8078e17f68d", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "e3f29d35-5d89-417c-98c2-9bea7510680a", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "b2967600-3833-4e56-99db-02e8055c3d65", + "isTransposed": false + } + ], + "headerRowHeight": "auto", + "layerId": "4861f473-2d68-4883-a7e9-ba3df76aac81", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "auto", + "sorting": { + "columnId": "b2967600-3833-4e56-99db-02e8055c3d65", + "direction": "asc" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 10, - "i": "15", + "i": "6d18f7a0-9156-476a-9b3d-9c2924bc00f1", "w": 24, "x": 24, "y": 6 }, - "panelIndex": "15", - "panelRefName": "panel_7", + "panelIndex": "6d18f7a0-9156-476a-9b3d-9c2924bc00f1", "title": "Kafka Brokers", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "table": { - "sort": { - "column": "26d2cd90-d2f5-11e8-9dd4-c5f03280d7b0", - "order": "desc" - } - } + "attributes": { + "references": [ + { + "id": "metrics-*", + "name": "indexpattern-datasource-layer-8aa6d274-217d-41a4-9009-612a9c02c32e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8aa6d274-217d-41a4-9009-612a9c02c32e": { + "columnOrder": [ + "98bd535f-6f3d-4f42-8466-6d9e3dd77fc1", + "7db4fce9-8761-4cd0-ad38-3bd068ced454", + "7a28ae5e-f7fe-4901-83e6-d4b636c84715", + "77eb3a04-b681-4e46-8803-99f2430b2664", + "5f3ae81a-5ad5-45f3-a90c-4da99fa6a6d8", + "3727b6c1-c37b-41c1-89c5-0ffcb4d67f29", + "7522e2e1-a533-484d-a5f7-afd05f55b117" + ], + "columns": { + "3727b6c1-c37b-41c1-89c5-0ffcb4d67f29": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: partition" + }, + "isBucketed": false, + "label": "Newest Offset", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.offset.newest" + }, + "5f3ae81a-5ad5-45f3-a90c-4da99fa6a6d8": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: consumergroup" + }, + "isBucketed": false, + "label": "Consumers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.consumergroup.client.id" + }, + "7522e2e1-a533-484d-a5f7-afd05f55b117": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: partition" + }, + "isBucketed": false, + "label": "Oldest Offset", + "operationType": "min", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.offset.oldest" + }, + "77eb3a04-b681-4e46-8803-99f2430b2664": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: partition" + }, + "isBucketed": false, + "label": "Replicas", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.topic_broker_id" + }, + "7a28ae5e-f7fe-4901-83e6-d4b636c84715": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: partition" + }, + "isBucketed": false, + "label": "Partitions", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.partition.id" + }, + "7db4fce9-8761-4cd0-ad38-3bd068ced454": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": " metricset.name: partition" + }, + "isBucketed": false, + "label": "Brokers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "kafka.broker.id" + }, + "98bd535f-6f3d-4f42-8466-6d9e3dd77fc1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Topic Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "kafka.topic.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "NOT kafka.topic.name: __consumer_offsets" + }, + "visualization": { + "columns": [ + { + "columnId": "98bd535f-6f3d-4f42-8466-6d9e3dd77fc1", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "7db4fce9-8761-4cd0-ad38-3bd068ced454", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "7a28ae5e-f7fe-4901-83e6-d4b636c84715", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "77eb3a04-b681-4e46-8803-99f2430b2664", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "5f3ae81a-5ad5-45f3-a90c-4da99fa6a6d8", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "3727b6c1-c37b-41c1-89c5-0ffcb4d67f29", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "7522e2e1-a533-484d-a5f7-afd05f55b117", + "isTransposed": false + } + ], + "headerRowHeight": "auto", + "layerId": "8aa6d274-217d-41a4-9009-612a9c02c32e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "auto", + "sorting": { + "columnId": "5f3ae81a-5ad5-45f3-a90c-4da99fa6a6d8", + "direction": "desc" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 11, - "i": "16", + "h": 13, + "i": "6e580e38-ab32-407c-8d49-7373decc50f1", "w": 24, "x": 24, "y": 16 }, - "panelIndex": "16", - "panelRefName": "panel_8", + "panelIndex": "6e580e38-ab32-407c-8d49-7373decc50f1", "title": "Kafka Topic Details", - "version": "7.3.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Metrics Kafka] Overview", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-26T06:41:25.463Z", "id": "kafka-ea488d90-8e63-11e8-8fa2-3d5f811fbd0f", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "kafka-b9d12c80-8e63-11e8-8fa2-3d5f811fbd0f", - "name": "panel_0", - "type": "visualization" + "id": "metrics-*", + "name": "13:indexpattern-datasource-layer-830f7c05-123b-4860-b1c0-35c43878b6b5", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "13:9d1b6107-05fe-4216-9c22-22080fabf6e7", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "14:indexpattern-datasource-layer-e2b7a1c1-c294-4776-8fbd-eb9f3dd589c4", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ad4575fb-5b4f-4c42-8c50-c2b60b2c72f7:indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ad4575fb-5b4f-4c42-8c50-c2b60b2c72f7:ebc61b65-c863-436a-87c6-4283ed3e22a3", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "ad4575fb-5b4f-4c42-8c50-c2b60b2c72f7:209ac5d7-4976-45c6-914d-554e96a04b80", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "02a0cadd-8e80-4380-b9a1-0d41cfef29d6:indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "02a0cadd-8e80-4380-b9a1-0d41cfef29d6:78ae48ec-7c0a-4765-8859-6e03f5918e75", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "02a0cadd-8e80-4380-b9a1-0d41cfef29d6:f1da74f7-5232-42df-9f63-7d2fa0a62c76", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b7ca8c63-46bc-46f4-bf44-b211814b5a8b:indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" + }, + { + "id": "metrics-*", + "name": "b7ca8c63-46bc-46f4-bf44-b211814b5a8b:da6c65a2-27dc-481d-bc6c-dc1616367f54", + "type": "index-pattern" }, { - "id": "kafka-8d2f79a0-8e65-11e8-8fa2-3d5f811fbd0f", - "name": "panel_1", - "type": "visualization" + "id": "metrics-*", + "name": "b7ca8c63-46bc-46f4-bf44-b211814b5a8b:85d5c138-1e66-41f8-b7cb-4506315cf1db", + "type": "index-pattern" }, { - "id": "kafka-944188f0-8e79-11e8-8fa2-3d5f811fbd0f", - "name": "panel_2", - "type": "visualization" + "id": "metrics-*", + "name": "3bf5acc4-bca8-4dae-bf9d-7b7f5de0ef2f:indexpattern-datasource-layer-4c8601c8-031b-4b4f-8dd3-91fdedd7625f", + "type": "index-pattern" }, { - "id": "kafka-dc89f8d0-8e8e-11e8-8fa2-3d5f811fbd0f", - "name": "panel_3", - "type": "visualization" + "id": "metrics-*", + "name": "3bf5acc4-bca8-4dae-bf9d-7b7f5de0ef2f:c13f48df-9bb5-43ff-850d-54d8dc041e19", + "type": "index-pattern" }, { - "id": "kafka-587f2360-8f21-11e8-8fa2-3d5f811fbd0f", - "name": "panel_4", - "type": "visualization" + "id": "metrics-*", + "name": "3bf5acc4-bca8-4dae-bf9d-7b7f5de0ef2f:8f7d6f5f-3f7d-4b89-9386-9e79ce5babda", + "type": "index-pattern" }, { - "id": "kafka-1681f1a0-90e7-11e8-8fa2-3d5f811fbd0f", - "name": "panel_5", - "type": "visualization" + "id": "metrics-*", + "name": "6d18f7a0-9156-476a-9b3d-9c2924bc00f1:indexpattern-datasource-layer-4861f473-2d68-4883-a7e9-ba3df76aac81", + "type": "index-pattern" }, { - "id": "kafka-9a7576e0-d231-11e8-8766-dbbdc39e7ba9", - "name": "panel_6", - "type": "visualization" + "id": "metrics-*", + "name": "6e580e38-ab32-407c-8d49-7373decc50f1:indexpattern-datasource-layer-8aa6d274-217d-41a4-9009-612a9c02c32e", + "type": "index-pattern" }, { - "id": "kafka-27dd5960-d2ed-11e8-8766-dbbdc39e7ba9", - "name": "panel_7", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_aa887cf3-390b-4da6-8c02-43ec133b0971:optionsListDataView", + "type": "index-pattern" }, { - "id": "kafka-491fee50-d2f5-11e8-8766-dbbdc39e7ba9", - "name": "panel_8", - "type": "visualization" + "id": "metrics-*", + "name": "controlGroup_bb5b4dfa-d433-48d7-8e16-7d2ad832565a:rangeSliderDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/kafka/kibana/search/kafka-all-kafka-logs.json b/packages/kafka/kibana/search/kafka-all-kafka-logs.json index 00821575341..797ba0e9e17 100644 --- a/packages/kafka/kibana/search/kafka-all-kafka-logs.json +++ b/packages/kafka/kibana/search/kafka-all-kafka-logs.json @@ -6,7 +6,19 @@ "message" ], "description": "", + "grid": { + "columns": { + "kafka.log.component": { + "width": 195 + }, + "log.level": { + "width": 109 + } + } + }, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -21,18 +33,13 @@ "key": "data_stream.dataset", "negate": false, "params": { - "query": "kafka.log", - "type": "phrase" + "query": "kafka.log" }, - "type": "phrase", - "value": "log" + "type": "phrase" }, "query": { - "match": { - "data_stream.dataset": { - "query": "kafka.log", - "type": "phrase" - } + "match_phrase": { + "data_stream.dataset": "kafka.log" } } } @@ -52,10 +59,17 @@ "desc" ] ], + "timeRestore": false, "title": "All logs [Logs Kafka]", + "usesAdHocDataView": false, "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-26T06:39:08.427Z", "id": "kafka-all-kafka-logs", + "migrationVersion": { + "search": "8.0.0" + }, "references": [ { "id": "logs-*", diff --git a/packages/kafka/kibana/search/kafka-stacktraces.json b/packages/kafka/kibana/search/kafka-stacktraces.json index bef803f4fd8..ea0c75a8add 100644 --- a/packages/kafka/kibana/search/kafka-stacktraces.json +++ b/packages/kafka/kibana/search/kafka-stacktraces.json @@ -28,7 +28,12 @@ "title": "Stacktraces [Logs Kafka]", "version": 1 }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-26T06:39:08.427Z", "id": "kafka-stacktraces", + "migrationVersion": { + "search": "8.0.0" + }, "references": [ { "id": "logs-*", diff --git a/packages/kafka/kibana/visualization/kafka-1681f1a0-90e7-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-1681f1a0-90e7-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index e3cd3e5b96e..00000000000 --- a/packages/kafka/kibana/visualization/kafka-1681f1a0-90e7-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "kafka.topic.name", - "negate": true, - "params": { - "query": "__consumer_offsets", - "type": "phrase" - }, - "type": "phrase", - "value": "__consumer_offsets" - }, - "query": { - "match": { - "kafka.topic.name": { - "query": "__consumer_offsets", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Consumer Metrics [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Consumer Groups", - "field": "kafka.consumergroup.id" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 32, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "title": "Consumer Metrics [Metrics Kafka]", - "type": "metric" - } - }, - "id": "kafka-1681f1a0-90e7-11e8-8fa2-3d5f811fbd0f", - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-27dd5960-d2ed-11e8-8766-dbbdc39e7ba9.json b/packages/kafka/kibana/visualization/kafka-27dd5960-d2ed-11e8-8766-dbbdc39e7ba9.json deleted file mode 100644 index 811c1f72d54..00000000000 --- a/packages/kafka/kibana/visualization/kafka-27dd5960-d2ed-11e8-8766-dbbdc39e7ba9.json +++ /dev/null @@ -1,131 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Kafka Broker Details [Metrics Kafka]", - "uiStateJSON": { - "table": { - "sort": { - "column": "cf09c940-d2ec-11e8-88c8-af5b2a9ee6b2", - "order": "asc" - } - } - }, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "bar_color_rules": [ - { - "id": "7fb31e00-d2ec-11e8-88c8-af5b2a9ee6b2" - } - ], - "filter": "", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "pivot_id": "kafka.partition.partition.replica", - "pivot_label": "Broker ID", - "pivot_rows": "256", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Topics", - "line_width": 1, - "metrics": [ - { - "field": "kafka.topic.name", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "kafka.broker.id", - "terms_size": "100" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "7e9ee780-d2ef-11e8-9dd4-c5f03280d7b0" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": "kafka.partition.partition.is_leader: true" - }, - "formatter": "number", - "id": "b38e91a0-d2ec-11e8-88c8-af5b2a9ee6b2", - "label": "Leader Partitions", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.topic_id", - "id": "b38eb8b0-d2ec-11e8-88c8-af5b2a9ee6b2", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "d4d9d2c0-d2ec-11e8-88c8-af5b2a9ee6b2" - } - ], - "fill": 0.5, - "filter": "", - "formatter": "number", - "id": "cf09c940-d2ec-11e8-88c8-af5b2a9ee6b2", - "label": "Replicas", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.topic_broker_id", - "id": "cf09f050-d2ec-11e8-88c8-af5b2a9ee6b2", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "table" - }, - "title": "Kafka Broker Details [Metrics Kafka]", - "type": "metrics" - } - }, - "id": "kafka-27dd5960-d2ed-11e8-8766-dbbdc39e7ba9", - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-3f7c33c0-87ee-11e7-ad9c-db80de0bf8d3.json b/packages/kafka/kibana/visualization/kafka-3f7c33c0-87ee-11e7-ad9c-db80de0bf8d3.json deleted file mode 100644 index 5ad0919a54a..00000000000 --- a/packages/kafka/kibana/visualization/kafka-3f7c33c0-87ee-11e7-ad9c-db80de0bf8d3.json +++ /dev/null @@ -1,131 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Log levels over time [Logs Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1 - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Log Level", - "field": "log.level", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "@timestamp per day" - }, - "type": "category" - } - ], - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "legendPosition": "right", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "title": "Log levels over time [Logs Kafka]", - "type": "histogram" - } - }, - "id": "kafka-3f7c33c0-87ee-11e7-ad9c-db80de0bf8d3", - "references": [ - { - "id": "kafka-all-kafka-logs", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-491fee50-d2f5-11e8-8766-dbbdc39e7ba9.json b/packages/kafka/kibana/visualization/kafka-491fee50-d2f5-11e8-8766-dbbdc39e7ba9.json deleted file mode 100644 index 6121e099d14..00000000000 --- a/packages/kafka/kibana/visualization/kafka-491fee50-d2f5-11e8-8766-dbbdc39e7ba9.json +++ /dev/null @@ -1,236 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Kafka Topic Details [Metrics Kafka]", - "uiStateJSON": { - "table": { - "sort": { - "column": "_default_", - "order": "asc" - } - } - }, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "bar_color_rules": [ - { - "id": "f81e47a0-d2f3-11e8-9dd4-c5f03280d7b0" - } - ], - "filter": { - "language": "lucene", - "query": "NOT kafka.topic.name: __consumer_offsets" - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "pivot_id": "kafka.topic.name", - "pivot_label": "Topic Name", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "f07881d0-d2f5-11e8-95b9-eb9260148efc" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: partition" - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Brokers", - "line_width": 1, - "metrics": [ - { - "field": "kafka.broker.id", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "fb759e10-d2f5-11e8-95b9-eb9260148efc" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: partition" - }, - "formatter": "number", - "id": "7d640440-d2f4-11e8-9dd4-c5f03280d7b0", - "label": "Partitions", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.id", - "id": "7d640441-d2f4-11e8-9dd4-c5f03280d7b0", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "fdb1ab60-d2f5-11e8-95b9-eb9260148efc" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: partition" - }, - "formatter": "number", - "id": "ad26e260-d2f4-11e8-9dd4-c5f03280d7b0", - "label": "Replicas", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.topic_broker_id", - "id": "ad26e261-d2f4-11e8-9dd4-c5f03280d7b0", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "ff90f2b0-d2f5-11e8-95b9-eb9260148efc" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: consumergroup" - }, - "formatter": "number", - "id": "26d2cd90-d2f5-11e8-9dd4-c5f03280d7b0", - "label": "Consumers", - "line_width": 1, - "metrics": [ - { - "field": "kafka.consumergroup.client.id", - "id": "26d2cd91-d2f5-11e8-9dd4-c5f03280d7b0", - "type": "cardinality" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "ea4984e0-d2f4-11e8-9dd4-c5f03280d7b0" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: partition" - }, - "formatter": "number", - "id": "dc390e20-d2f4-11e8-9dd4-c5f03280d7b0", - "label": "Newest Offset", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.offset.newest", - "id": "dc393530-d2f4-11e8-9dd4-c5f03280d7b0", - "type": "max" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "043b67f0-d2f6-11e8-95b9-eb9260148efc" - } - ], - "fill": 0.5, - "filter": { - "language": "lucene", - "query": " metricset.name: partition" - }, - "formatter": "number", - "id": "11366c80-d2f5-11e8-9dd4-c5f03280d7b0", - "label": "Oldest Offset", - "line_width": 1, - "metrics": [ - { - "field": "kafka.partition.offset.oldest", - "id": "11366c81-d2f5-11e8-9dd4-c5f03280d7b0", - "type": "min" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "table" - }, - "title": "Kafka Topic Details [Metrics Kafka]", - "type": "metrics" - } - }, - "id": "kafka-491fee50-d2f5-11e8-8766-dbbdc39e7ba9", - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-587f2360-8f21-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-587f2360-8f21-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index 38411bb9517..00000000000 --- a/packages/kafka/kibana/visualization/kafka-587f2360-8f21-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,81 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Consumer Partition Reassignments [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_max": "1", - "axis_min": "-1", - "axis_position": "right", - "filter": { - "language": "lucene", - "query": "NOT kafka.topic.name:__consumer_offsets" - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "hide_in_legend": 0, - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Consumer -\u003e Partition Reassignment", - "line_width": "1", - "metrics": [ - { - "field": "kafka.partition.id", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "sum" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "6b69c760-8f20-11e8-8927-d7e991b5b6ab", - "type": "derivative", - "unit": "" - }, - { - "id": "976f9d80-8f20-11e8-8927-d7e991b5b6ab", - "script": "if (params.sum_partition \u003c 0) { return -1 } else if (params.sum_partition \u003e 0) { return 1 }", - "type": "calculation", - "variables": [ - { - "field": "6b69c760-8f20-11e8-8927-d7e991b5b6ab", - "id": "99cc2b20-8f20-11e8-8927-d7e991b5b6ab", - "name": "sum_partition" - } - ] - } - ], - "point_size": "20", - "seperate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "kafka.consumergroup.id", - "value_template": "" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Consumer Partition Reassignments [Metrics Kafka]", - "type": "metrics" - } - }, - "id": "kafka-587f2360-8f21-11e8-8fa2-3d5f811fbd0f", - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-8d2f79a0-8e65-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-8d2f79a0-8e65-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index 18328f0d976..00000000000 --- a/packages/kafka/kibana/visualization/kafka-8d2f79a0-8e65-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,65 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Kafka Controls [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "controls": [ - { - "fieldName": "kafka.topic.name", - "id": "1532342651170", - "indexPatternRefName": "control_0_index_pattern", - "label": "Topic Name", - "options": { - "multiselect": true, - "order": "desc", - "size": 10, - "type": "terms" - }, - "parent": "", - "type": "list" - }, - { - "fieldName": "kafka.partition.id", - "id": "1539799686678", - "indexPatternRefName": "control_1_index_pattern", - "label": "Partition", - "options": { - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "1532342651170", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": true, - "useTimeFilter": false - }, - "title": "Kafka Controls [Metrics Kafka]", - "type": "input_control_vis" - } - }, - "id": "kafka-8d2f79a0-8e65-11e8-8fa2-3d5f811fbd0f", - "references": [ - { - "id": "metrics-*", - "name": "control_0_index_pattern", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "control_1_index_pattern", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-944188f0-8e79-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-944188f0-8e79-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index aa856ef45c4..00000000000 --- a/packages/kafka/kibana/visualization/kafka-944188f0-8e79-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,88 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Kafka Consumer Group Lag vs Time [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "1966adf0-1298-11ea-abd7-b5bb8e05b5d6" - } - ], - "bar_color_rules": [ - { - "id": "1dbe6f50-1298-11ea-abd7-b5bb8e05b5d6" - } - ], - "default_index_pattern": "metrics-*", - "default_timefield": "@timestamp", - "filter": { - "language": "lucene", - "query": "(metricset.name: consumergroup) AND NOT kafka.topic.name:__consumer_offsets" - }, - "gauge_color_rules": [ - { - "id": "1eee15b0-1298-11ea-abd7-b5bb8e05b5d6" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,156,224,1)", - "fill": "0.2", - "formatter": "number", - "id": "0dcb8020-8e6d-11e8-bfab-6f29bad3a6f2", - "label": "Consumer Groups", - "line_width": 1, - "metrics": [ - { - "field": "kafka.consumergroup.consumer_lag", - "id": "0dcb8021-8e6d-11e8-bfab-6f29bad3a6f2", - "type": "max" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "kafka.topic.name", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Kafka Consumer Group Lag vs Time [Metrics Kafka]", - "type": "metrics" - } - }, - "id": "kafka-944188f0-8e79-11e8-8fa2-3d5f811fbd0f", - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-9a7576e0-d231-11e8-8766-dbbdc39e7ba9.json b/packages/kafka/kibana/visualization/kafka-9a7576e0-d231-11e8-8766-dbbdc39e7ba9.json deleted file mode 100644 index 582af9a1f1e..00000000000 --- a/packages/kafka/kibana/visualization/kafka-9a7576e0-d231-11e8-8766-dbbdc39e7ba9.json +++ /dev/null @@ -1,114 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Kafka Consumer Group Clients [Metrics Kafka]", - "uiStateJSON": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Newest Offset", - "field": "kafka.consumergroup.offset" - }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Consumer group client", - "field": "kafka.consumergroup.client.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_term", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 64 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Topic", - "field": "kafka.topic.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 64 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Partition", - "field": "kafka.partition.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 256 - }, - "schema": "bucket", - "type": "terms" - } - ], - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "Kafka Consumer Group Clients [Metrics Kafka]", - "type": "table" - } - }, - "id": "kafka-9a7576e0-d231-11e8-8766-dbbdc39e7ba9", - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-b9d12c80-8e63-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-b9d12c80-8e63-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index 67ace6d6b0b..00000000000 --- a/packages/kafka/kibana/visualization/kafka-b9d12c80-8e63-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,105 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Kafka Topic \u0026 Consumer Offsets [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "background_color_rules": [ - { - "id": "8b27e6a0-8e61-11e8-b741-c3e458b74a68" - } - ], - "filter": { - "language": "lucene", - "query": "NOT kafka.topic.name:__consumer_offsets" - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "series": [ - { - "axis_position": "right", - "chart_type": "bar", - "color": "rgba(244,78,59,1)", - "fill": "0.1", - "filter": { - "language": "lucene", - "query": "metricset.name: partition AND kafka.partition.partition.is_leader: true" - }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Topic Offsets", - "line_width": "0.5", - "metrics": [ - { - "field": "kafka.partition.offset.newest", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "sum" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "rainbow", - "split_mode": "terms", - "stacked": "none", - "terms_field": "kafka.topic.name", - "terms_order_by": "_term", - "value_template": "{{value}}" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(244,78,59,0.52)", - "fill": "0", - "filter": { - "language": "lucene", - "query": "metricset.name: consumergroup" - }, - "formatter": "number", - "id": "d43034c0-8f1e-11e8-8784-cd0acd161a28", - "label": "Consumer Offsets", - "line_width": "1", - "metrics": [ - { - "field": "kafka.consumergroup.offset", - "id": "d43034c1-8f1e-11e8-8784-cd0acd161a28", - "type": "sum" - } - ], - "point_size": "1.5", - "seperate_axis": 0, - "split_color_mode": "rainbow", - "split_filters": [ - { - "color": "#68BC00", - "id": "dd41ada0-8f1e-11e8-8784-cd0acd161a28" - } - ], - "split_mode": "terms", - "stacked": "none", - "terms_field": "kafka.consumergroup.id", - "terms_order_by": "_term", - "value_template": "{{value}}" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries" - }, - "title": "Kafka Topic \u0026 Consumer Offsets [Metrics Kafka]", - "type": "metrics" - } - }, - "id": "kafka-b9d12c80-8e63-11e8-8fa2-3d5f811fbd0f", - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-dc89f8d0-8e8e-11e8-8fa2-3d5f811fbd0f.json b/packages/kafka/kibana/visualization/kafka-dc89f8d0-8e8e-11e8-8fa2-3d5f811fbd0f.json deleted file mode 100644 index b39e38bf4c3..00000000000 --- a/packages/kafka/kibana/visualization/kafka-dc89f8d0-8e8e-11e8-8fa2-3d5f811fbd0f.json +++ /dev/null @@ -1,164 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Partition Metricset", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "metricset.name", - "negate": false, - "params": { - "query": "partition", - "type": "phrase" - }, - "type": "phrase", - "value": "partition" - }, - "query": { - "match": { - "metricset.name": { - "query": "partition", - "type": "phrase" - } - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "kafka.topic.name", - "negate": true, - "params": { - "query": "__consumer_offsets", - "type": "phrase" - }, - "type": "phrase", - "value": "__consumer_offsets" - }, - "query": { - "match": { - "kafka.topic.name": { - "query": "__consumer_offsets", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Kafka Metrics [Metrics Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Topics", - "field": "kafka.topic.name" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Brokers", - "field": "kafka.broker.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Partitions", - "field": "kafka.partition.topic_id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Replicas", - "field": "kafka.partition.topic_broker_id" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 32, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "title": "Kafka Metrics [Metrics Kafka]", - "type": "metric" - } - }, - "id": "kafka-dc89f8d0-8e8e-11e8-8fa2-3d5f811fbd0f", - "references": [ - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/kibana/visualization/kafka-number-of-kafka-stracktraces-by-class.json b/packages/kafka/kibana/visualization/kafka-number-of-kafka-stracktraces-by-class.json deleted file mode 100644 index 7647295e150..00000000000 --- a/packages/kafka/kibana/visualization/kafka-number-of-kafka-stracktraces-by-class.json +++ /dev/null @@ -1,130 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Number of stracktraces by class [Logs Kafka]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1 - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "kafka.log.trace.class", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "@timestamp per 30 minutes" - }, - "type": "category" - } - ], - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "legendPosition": "right", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "title": "Number of Kafka stracktraces by class [Logs Kafka]", - "type": "histogram" - } - }, - "id": "kafka-number-of-kafka-stracktraces-by-class", - "references": [ - { - "id": "kafka-stacktraces", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/kafka/manifest.yml b/packages/kafka/manifest.yml index b51c2220846..77a8b9115d2 100644 --- a/packages/kafka/manifest.yml +++ b/packages/kafka/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: kafka title: Kafka -version: "1.8.0" +version: "1.9.2" license: basic description: Collect logs and metrics from Kafka servers with Elastic Agent. type: integration diff --git a/packages/kafka_log/changelog.yml b/packages/kafka_log/changelog.yml index 0036a5d2a56..afed427d418 100644 --- a/packages/kafka_log/changelog.yml +++ b/packages/kafka_log/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.3.0" + changes: + - description: Add permissions to reroute events to logs-*-* for generic datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/6840 - version: "1.2.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/kafka_log/data_stream/generic/manifest.yml b/packages/kafka_log/data_stream/generic/manifest.yml index 5dc893b5d5d..975f8a8eef6 100644 --- a/packages/kafka_log/data_stream/generic/manifest.yml +++ b/packages/kafka_log/data_stream/generic/manifest.yml @@ -250,3 +250,7 @@ streams: - forwarded multi: true show_user: true +# Ensures agents have permissions to write data to `logs-*-*` +elasticsearch: + dynamic_dataset: true + dynamic_namespace: true diff --git a/packages/kafka_log/manifest.yml b/packages/kafka_log/manifest.yml index f472e09dbb2..a2d4cef7b43 100644 --- a/packages/kafka_log/manifest.yml +++ b/packages/kafka_log/manifest.yml @@ -3,7 +3,7 @@ name: kafka_log title: Custom Kafka Logs description: Collect data from kafka topic with Elastic Agent. type: integration -version: "1.2.0" +version: "1.3.0" release: ga conditions: kibana.version: "^7.16.0 || ^8.0.0" diff --git a/packages/keycloak/_dev/build/build.yml b/packages/keycloak/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/keycloak/_dev/build/build.yml +++ b/packages/keycloak/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/keycloak/changelog.yml b/packages/keycloak/changelog.yml index f1d0726a112..f2a1b8c2fac 100644 --- a/packages/keycloak/changelog.yml +++ b/packages/keycloak/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.11.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7120 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json b/packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json index a90b4721e17..21e40d53adb 100644 --- a/packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json +++ b/packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-22T21:01:42.548-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:42,548 INFO [org.keycloak.services] (ServerService Thread Pool -- 64) KC-SERVICES0009: Added user 'admin' to realm 'master'", @@ -26,7 +26,7 @@ { "@timestamp": "2021-10-22T21:01:42.667-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:42,667 INFO [org.jboss.resteasy.resteasy_jaxrs.i18n] (ServerService Thread Pool -- 64) RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication", @@ -49,7 +49,7 @@ { "@timestamp": "2021-10-22T21:01:42.912-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:42,912 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 64) WFLYUT002021-10-22 21: Registered web context: '/auth' for server 'default-server' ", @@ -72,7 +72,7 @@ { "@timestamp": "2021-10-22T21:01:43.208-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:43,208 INFO [org.jboss.as.server] (ServerService Thread Pool -- 46) WFLYSRV0010: Deployed \"keycloak-server.war\" (runtime-name : \"keycloak-server.war\") ", @@ -95,7 +95,7 @@ { "@timestamp": "2021-10-22T21:01:43.299-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:43,299 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0212: Resuming server", @@ -118,7 +118,7 @@ { "@timestamp": "2021-10-22T21:01:43.307-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:43,307 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0025: Keycloak 15.0.2 (WildFly Core 15.0.1.Final) started in 28315ms - Started 692 of 977 services (686 services are lazy, passive or on-demand)", @@ -141,7 +141,7 @@ { "@timestamp": "2021-10-22T21:01:43.327-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:43,327 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http management interface listening on http://127.0.0.1:9990/management", @@ -164,7 +164,7 @@ { "@timestamp": "2021-10-22T21:01:43.327-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "2021-10-22 21:01:43,327 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990", @@ -187,7 +187,7 @@ { "@timestamp": "2021-10-22T21:01:45.403-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN_ERROR", @@ -250,7 +250,7 @@ { "@timestamp": "2021-10-22T21:20:42.120-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN_ERROR", @@ -325,7 +325,7 @@ { "@timestamp": "2021-10-22T21:24:41.076-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN_ERROR", @@ -394,7 +394,7 @@ { "@timestamp": "2021-10-22T21:31:31.555-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN_ERROR", @@ -457,7 +457,7 @@ { "@timestamp": "2021-10-22T20:58:02.700-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN_ERROR", @@ -532,7 +532,7 @@ { "@timestamp": "2021-10-22T22:11:31.257-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGIN", @@ -608,7 +608,7 @@ { "@timestamp": "2021-10-22T22:11:32.131-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CODE_TO_TOKEN", @@ -666,7 +666,7 @@ { "@timestamp": "2021-10-22T22:12:09.871-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE-USER", @@ -734,7 +734,7 @@ { "@timestamp": "2021-10-22T22:12:13.599-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UPDATE-USER", @@ -802,7 +802,7 @@ { "@timestamp": "2021-10-22T22:14:29.031-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE-GROUP", @@ -869,7 +869,7 @@ { "@timestamp": "2021-10-22T22:16:12.150-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE-CLIENT_SCOPE", @@ -933,7 +933,7 @@ { "@timestamp": "2021-10-22T22:45:12.592-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "LOGOUT", @@ -1001,7 +1001,7 @@ { "@timestamp": "2021-10-22T22:46:14.913-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DELETE-GROUP", @@ -1068,7 +1068,7 @@ { "@timestamp": "2021-10-22T23:05:03.371-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "CREATE-GROUP", diff --git a/packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml index a6ec80cf11e..aeb69cb91e2 100644 --- a/packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing keycloak logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/keycloak/data_stream/log/sample_event.json b/packages/keycloak/data_stream/log/sample_event.json index 2b33f715156..7c4be680b8a 100644 --- a/packages/keycloak/data_stream/log/sample_event.json +++ b/packages/keycloak/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2021-10-22T21:01:42.667-05:00", + "@timestamp": "2021-10-22T21:01:42.667+05:00", "agent": { - "ephemeral_id": "3fa6009c-adab-4e39-9c43-05f16ba9ef47", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "5861dcd8-02a1-48fe-943d-45eb7fd83e5e", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.2" }, "data_stream": { "dataset": "keycloak.log", @@ -13,40 +13,40 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "dataset": "keycloak.log", - "ingested": "2022-01-01T23:08:55Z", + "ingested": "2023-07-24T13:27:46Z", "original": "2021-10-22 21:01:42,667 INFO [org.jboss.resteasy.resteasy_jaxrs.i18n] (ServerService Thread Pool -- 64) RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication", - "timezone": "-05:00" + "timezone": "+05:00" }, "host": { "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "4ccba669f0df47fa3f57a9e4169ae7f1", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.18.0.5" + "172.22.0.10" ], "mac": [ - "02:42:ac:12:00:05" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-43-generic", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -58,7 +58,7 @@ }, "level": "INFO", "logger": "org.jboss.resteasy.resteasy_jaxrs.i18n", - "offset": 928 + "offset": 658 }, "message": "RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication", "process": { diff --git a/packages/keycloak/docs/README.md b/packages/keycloak/docs/README.md index e7758e679c9..44534f425a1 100644 --- a/packages/keycloak/docs/README.md +++ b/packages/keycloak/docs/README.md @@ -47,11 +47,11 @@ to your configuration XML file (ie standalone.xml) under the path below | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -132,13 +132,13 @@ An example event for `log` looks as following: ```json { - "@timestamp": "2021-10-22T21:01:42.667-05:00", + "@timestamp": "2021-10-22T21:01:42.667+05:00", "agent": { - "ephemeral_id": "3fa6009c-adab-4e39-9c43-05f16ba9ef47", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "5861dcd8-02a1-48fe-943d-45eb7fd83e5e", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.2" }, "data_stream": { "dataset": "keycloak.log", @@ -146,40 +146,40 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "dataset": "keycloak.log", - "ingested": "2022-01-01T23:08:55Z", + "ingested": "2023-07-24T13:27:46Z", "original": "2021-10-22 21:01:42,667 INFO [org.jboss.resteasy.resteasy_jaxrs.i18n] (ServerService Thread Pool -- 64) RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication", - "timezone": "-05:00" + "timezone": "+05:00" }, "host": { "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", - "id": "4ccba669f0df47fa3f57a9e4169ae7f1", + "id": "f61391496aaa43bb94736676494450c5", "ip": [ - "172.18.0.5" + "172.22.0.10" ], "mac": [ - "02:42:ac:12:00:05" + "02-42-AC-16-00-0A" ], "name": "docker-fleet-agent", "os": { - "codename": "Core", - "family": "redhat", - "kernel": "5.11.0-43-generic", - "name": "CentOS Linux", - "platform": "centos", + "codename": "focal", + "family": "debian", + "kernel": "5.10.47-linuxkit", + "name": "Ubuntu", + "platform": "ubuntu", "type": "linux", - "version": "7 (Core)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -191,7 +191,7 @@ An example event for `log` looks as following: }, "level": "INFO", "logger": "org.jboss.resteasy.resteasy_jaxrs.i18n", - "offset": 928 + "offset": 658 }, "message": "RESTEASY002220: Adding singleton resource org.keycloak.services.resources.admin.AdminRoot from Application class org.keycloak.services.resources.KeycloakApplication", "process": { diff --git a/packages/keycloak/kibana/tags.yml b/packages/keycloak/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/keycloak/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/keycloak/manifest.yml b/packages/keycloak/manifest.yml index 29a0f8c04f4..2928e4127c7 100644 --- a/packages/keycloak/manifest.yml +++ b/packages/keycloak/manifest.yml @@ -1,11 +1,9 @@ name: keycloak title: Keycloak -version: "1.10.0" -release: ga +version: "1.13.0" description: Collect logs from Keycloak with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: [security, iam] conditions: kibana.version: "^7.16.0 || ^8.0.0" diff --git a/packages/kibana/_dev/build/docs/README.md b/packages/kibana/_dev/build/docs/README.md index 81a65563580..4a22973a990 100644 --- a/packages/kibana/_dev/build/docs/README.md +++ b/packages/kibana/_dev/build/docs/README.md @@ -8,7 +8,7 @@ If the Kibana instance is using a basepath in its URL, you must set the `basepat ## Compatibility -The `kibana` package works with Kibana 8.9.0 and later. +The `kibana` package works with Kibana 8.10.0 and later. ## Usage for Stack Monitoring @@ -37,6 +37,14 @@ This data stream uses the `/api/task_manager/_background_task_utilization` API o {{event "background_task_utilization"}} +### Task manager metrics + +This data stream uses the `/api/task_manager/metrics` API of Kibana, which is available starting in 8.10. + +{{fields "task_manager_metrics"}} + +{{event "task_manager_metrics"}} + ## Metrics ### Stats diff --git a/packages/kibana/_dev/deploy/docker/docker-compose.yml b/packages/kibana/_dev/deploy/docker/docker-compose.yml index 4792ac1127c..e5035a617ae 100644 --- a/packages/kibana/_dev/deploy/docker/docker-compose.yml +++ b/packages/kibana/_dev/deploy/docker/docker-compose.yml @@ -1,7 +1,7 @@ version: "2.3" services: elasticsearch: - image: "docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION:-8.9.0-SNAPSHOT}" + image: "docker.elastic.co/elasticsearch/elasticsearch:${ELASTIC_VERSION:-8.10.0-SNAPSHOT}" environment: - "ES_JAVA_OPTS=-Xms1g -Xmx1g" - "ELASTIC_PASSWORD=changeme" @@ -24,7 +24,7 @@ services: volumes: - "./scripts/setup.sh:/setup.sh" kibana: - image: "docker.elastic.co/kibana/kibana:${ELASTIC_VERSION:-8.9.0-SNAPSHOT}" + image: "docker.elastic.co/kibana/kibana:${ELASTIC_VERSION:-8.10.0-SNAPSHOT}" user: "1001:0" group_add: - "0" diff --git a/packages/kibana/_dev/deploy/variants.yml b/packages/kibana/_dev/deploy/variants.yml index e5d9048b139..e9a72014f18 100644 --- a/packages/kibana/_dev/deploy/variants.yml +++ b/packages/kibana/_dev/deploy/variants.yml @@ -1,4 +1,4 @@ variants: - kibana_8.9.0: - ELASTIC_VERSION: 8.9.0-SNAPSHOT -default: kibana_8.9.0 + kibana_8.10.0: + ELASTIC_VERSION: 8.10.0-SNAPSHOT +default: kibana_8.10.0 diff --git a/packages/kibana/changelog.yml b/packages/kibana/changelog.yml index 6dc308e1cae..2b5aabfdd15 100644 --- a/packages/kibana/changelog.yml +++ b/packages/kibana/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "2.4.0" + changes: + - description: Add task manager metric + type: enhancement + link: https://github.com/elastic/integrations/pull/7205 +- version: "2.3.6" + changes: + - description: Add basepath to kibana manifest + type: bugfix + link: https://github.com/elastic/integrations/issues/7359 - version: "2.3.5" changes: - description: Add background task utilization metric diff --git a/packages/kibana/data_stream/task_manager_metrics/_dev/test/system/test-default-config.yml b/packages/kibana/data_stream/task_manager_metrics/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..f338288755f --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/_dev/test/system/test-default-config.yml @@ -0,0 +1,8 @@ +type: http/metrics +dataset: kibana.task_manager_metrics +vars: + hosts: + - "http://{{Hostname}}:5601" + username: elastic + password: changeme +data_stream: ~ diff --git a/packages/kibana/data_stream/task_manager_metrics/agent/stream/stream.yml.hbs b/packages/kibana/data_stream/task_manager_metrics/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..a709b355adc --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/agent/stream/stream.yml.hbs @@ -0,0 +1,29 @@ +metricsets: ["json"] +hosts: +{{#each hosts}} + - {{this}} +{{/each}} +{{#if basepath}} +basepath: {{basepath}} +{{/if}} +{{#if username}} +username: {{username}} +{{/if}} +{{#if password}} +password: {{password}} +{{/if}} +period: {{period}} +{{#if ssl}} +ssl: {{ssl}} +{{/if}} +namespace: "task_manager_metrics" +path: "/api/task_manager/metrics" +method: "GET" +processors: + - rename: + fields: + - from: http.task_manager_metrics + to: kibana.task_manager_metrics + ignore_missing: true + fail_on_error: false + diff --git a/packages/kibana/data_stream/task_manager_metrics/fields/base-fields.yml b/packages/kibana/data_stream/task_manager_metrics/fields/base-fields.yml new file mode 100644 index 00000000000..6aee9859f69 --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/fields/base-fields.yml @@ -0,0 +1,9 @@ +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: data_stream.type + type: constant_keyword + description: Data stream type. diff --git a/packages/kibana/data_stream/task_manager_metrics/fields/ecs.yml b/packages/kibana/data_stream/task_manager_metrics/fields/ecs.yml new file mode 100644 index 00000000000..41a6a8f878a --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/fields/ecs.yml @@ -0,0 +1,54 @@ +- name: '@timestamp' + external: ecs +- name: agent.ephemeral_id + external: ecs +- name: agent.id + external: ecs +- name: agent.name + external: ecs +- name: agent.type + external: ecs +- name: agent.version + external: ecs +- name: ecs.version + external: ecs +- name: error.message + external: ecs +- name: event.agent_id_status + external: ecs +- name: event.dataset + external: ecs +- name: event.duration + external: ecs +- name: event.ingested + external: ecs +- name: event.module + external: ecs +- name: host.architecture + external: ecs +- name: host.hostname + external: ecs +- name: host.id + external: ecs +- name: host.ip + external: ecs +- name: host.mac + external: ecs +- name: host.name + external: ecs +- name: host.os.family + external: ecs +- name: host.os.kernel + external: ecs +- name: host.os.name + external: ecs +- name: host.os.platform + external: ecs +- name: host.os.type + external: ecs +- name: host.os.version + external: ecs +- name: service.address + external: ecs +- name: service.type + external: ecs diff --git a/packages/kibana/data_stream/task_manager_metrics/fields/fields.yml b/packages/kibana/data_stream/task_manager_metrics/fields/fields.yml new file mode 100644 index 00000000000..8440ea49082 --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/fields/fields.yml @@ -0,0 +1,48 @@ +- name: kibana + type: group + fields: + - name: task_manager_metrics + type: group + fields: + - name: last_update + type: date + - name: metrics + type: group + fields: + - name: task_claim + type: group + fields: + - name: timestamp + type: date + - name: value + type: group + fields: + - name: success + type: long + - name: total + type: long + - name: duration + type: histogram + - name: task_run + type: group + fields: + - name: timestamp + type: date + - name: value + type: group + fields: + - name: overall + type: group + fields: + - name: success + type: long + - name: total + type: long + - name: 'by_type.*.success' + type: long + - name: 'by_type.*.total' + type: long + - name: process_uuid + type: keyword + - name: timestamp + type: date diff --git a/packages/kibana/data_stream/task_manager_metrics/fields/package-fields.yml b/packages/kibana/data_stream/task_manager_metrics/fields/package-fields.yml new file mode 100644 index 00000000000..bf8a3120508 --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/fields/package-fields.yml @@ -0,0 +1,15 @@ +- name: timestamp + type: alias + path: '@timestamp' +- name: cluster_uuid + type: alias + path: kibana.elasticsearch.cluster.id +- name: kibana_stats.kibana.uuid + type: alias + path: service.id +- name: kibana_stats.kibana.version + type: alias + path: service.version +- name: kibana_stats.timestamp + type: alias + path: '@timestamp' diff --git a/packages/kibana/data_stream/task_manager_metrics/manifest.yml b/packages/kibana/data_stream/task_manager_metrics/manifest.yml new file mode 100644 index 00000000000..524fc51a863 --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/manifest.yml @@ -0,0 +1,17 @@ +type: metrics +title: Kibana task manager metrics +release: beta +dataset: kibana.task_manager_metrics +streams: + - input: http/metrics + template_path: stream.yml.hbs + title: Kibana task manager metrics + description: Collect task manager SLI metrics. + vars: + - name: period + type: text + title: Period + multi: false + required: true + show_user: true + default: 10s diff --git a/packages/kibana/data_stream/task_manager_metrics/sample_event.json b/packages/kibana/data_stream/task_manager_metrics/sample_event.json new file mode 100644 index 00000000000..22d25b87545 --- /dev/null +++ b/packages/kibana/data_stream/task_manager_metrics/sample_event.json @@ -0,0 +1,204 @@ +{ + "@timestamp": "2023-08-23T15:16:50.293Z", + "agent": { + "name": "docker-fleet-agent", + "id": "8e1f023e-e70d-40a7-905a-f1ff1271b631", + "type": "metricbeat", + "ephemeral_id": "7a40c3bb-4628-496b-ba5f-7f0fb82e1767", + "version": "8.10.0" + }, + "ecs": { + "version": "8.0.0" + }, + "data_stream": { + "namespace": "default", + "type": "metrics", + "dataset": "kibana.task_manager_metrics" + }, + "service": { + "address": "https://kibana:5601/api/task_manager/metrics", + "type": "http" + }, + "host": { + "hostname": "docker-fleet-agent", + "os": { + "kernel": "5.15.49-linuxkit", + "codename": "focal", + "name": "Ubuntu", + "family": "debian", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)", + "platform": "ubuntu" + }, + "containerized": false, + "ip": [ + "172.23.0.7" + ], + "name": "docker-fleet-agent", + "id": "0d43b8a597974fa28645b1e16ce2db8d", + "mac": [ + "02-42-AC-17-00-07" + ], + "architecture": "aarch64" + }, + "elastic_agent": { + "id": "8e1f023e-e70d-40a7-905a-f1ff1271b631", + "version": "8.10.0", + "snapshot": true + }, + "metricset": { + "period": 10000, + "name": "json" + }, + "http": {}, + "kibana": { + "task_manager_metrics": { + "last_update": "2023-08-23T15:16:49.213Z", + "process_uuid": "2b4126d2-f102-4d6c-9070-9763d142ed14", + "metrics": { + "task_run": { + "value": { + "overall": { + "total": 1, + "success": 1 + }, + "by_type": { + "cases-telemetry-task": { + "total": 0, + "success": 0 + }, + "apm-telemetry-task": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-saved-queries": { + "total": 0, + "success": 0 + }, + "security:telemetry-detection-rules": { + "total": 0, + "success": 0 + }, + "alerting_telemetry": { + "total": 0, + "success": 0 + }, + "alerts_invalidate_api_keys": { + "total": 0, + "success": 0 + }, + "security:endpoint-diagnostics": { + "total": 0, + "success": 0 + }, + "endpoint:user-artifact-packager": { + "total": 0, + "success": 0 + }, + "security:telemetry-filterlist-artifact": { + "total": 0, + "success": 0 + }, + "session_cleanup": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-configs": { + "total": 0, + "success": 0 + }, + "security:telemetry-timelines": { + "total": 0, + "success": 0 + }, + "Fleet-Usage-Sender": { + "total": 0, + "success": 0 + }, + "security:endpoint-meta-telemetry": { + "total": 0, + "success": 0 + }, + "ML:saved-objects-sync": { + "total": 0, + "success": 0 + }, + "security:telemetry-prebuilt-rule-alerts": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-packs": { + "total": 0, + "success": 0 + }, + "dashboard_telemetry": { + "total": 0, + "success": 0 + }, + "Fleet-Usage-Logger": { + "total": 0, + "success": 0 + }, + "security:telemetry-lists": { + "total": 0, + "success": 0 + }, + "actions_telemetry": { + "total": 0, + "success": 0 + }, + "apm-source-map-migration-task": { + "total": 0, + "success": 0 + }, + "security:telemetry-configuration": { + "total": 0, + "success": 0 + }, + "endpoint:metadata-check-transforms-task": { + "total": 0, + "success": 0 + }, + "fleet:check-deleted-files-task": { + "total": 0, + "success": 0 + }, + "alerting_health_check": { + "total": 0, + "success": 0 + }, + "reports:monitor": { + "total": 1, + "success": 1 + } + } + }, + "timestamp": "2023-08-23T15:16:46.327Z" + }, + "task_claim": { + "value": { + "duration": { + "counts": [ + 3 + ], + "values": [ + 100 + ] + }, + "total": 3, + "success": 3 + }, + "timestamp": "2023-08-23T15:16:49.213Z" + } + }, + "timestamp": "2023-08-23T15:16:49.213Z" + } + }, + "event": { + "duration": 19616583, + "agent_id_status": "verified", + "ingested": "2023-08-23T15:16:51Z", + "module": "http", + "dataset": "kibana.task_manager_metrics" + } +} \ No newline at end of file diff --git a/packages/kibana/docs/README.md b/packages/kibana/docs/README.md index 7fd4026f9c5..fef5f7bb005 100644 --- a/packages/kibana/docs/README.md +++ b/packages/kibana/docs/README.md @@ -8,7 +8,7 @@ If the Kibana instance is using a basepath in its URL, you must set the `basepat ## Compatibility -The `kibana` package works with Kibana 8.9.0 and later. +The `kibana` package works with Kibana 8.10.0 and later. ## Usage for Stack Monitoring @@ -261,6 +261,273 @@ An example event for `background_task_utilization` looks as following: } ``` +### Task manager metrics + +This data stream uses the `/api/task_manager/metrics` API of Kibana, which is available starting in 8.10. + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | +| agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | +| agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | +| agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | +| agent.version | Version of the agent. | keyword | +| cluster_uuid | | alias | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.message | Error message. | match_only_text | +| event.agent_id_status | Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. If no validation is performed then the field should be omitted. The allowed values are: `verified` - The `agent.id` field value matches expected value obtained from auth metadata. `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. `missing` - There was no `agent.id` field in the event to validate. `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. | keyword | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | +| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| kibana.task_manager_metrics.last_update | | date | +| kibana.task_manager_metrics.metrics.task_claim.timestamp | | date | +| kibana.task_manager_metrics.metrics.task_claim.value.duration | | histogram | +| kibana.task_manager_metrics.metrics.task_claim.value.success | | long | +| kibana.task_manager_metrics.metrics.task_claim.value.total | | long | +| kibana.task_manager_metrics.metrics.task_run.timestamp | | date | +| kibana.task_manager_metrics.metrics.task_run.value.by_type.\*.success | | long | +| kibana.task_manager_metrics.metrics.task_run.value.by_type.\*.total | | long | +| kibana.task_manager_metrics.metrics.task_run.value.overall.success | | long | +| kibana.task_manager_metrics.metrics.task_run.value.overall.total | | long | +| kibana.task_manager_metrics.process_uuid | | keyword | +| kibana.task_manager_metrics.timestamp | | date | +| kibana_stats.kibana.uuid | | alias | +| kibana_stats.kibana.version | | alias | +| kibana_stats.timestamp | | alias | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| timestamp | | alias | + + +An example event for `task_manager` looks as following: + +```json +{ + "@timestamp": "2023-08-23T15:16:50.293Z", + "agent": { + "name": "docker-fleet-agent", + "id": "8e1f023e-e70d-40a7-905a-f1ff1271b631", + "type": "metricbeat", + "ephemeral_id": "7a40c3bb-4628-496b-ba5f-7f0fb82e1767", + "version": "8.10.0" + }, + "ecs": { + "version": "8.0.0" + }, + "data_stream": { + "namespace": "default", + "type": "metrics", + "dataset": "kibana.task_manager_metrics" + }, + "service": { + "address": "https://kibana:5601/api/task_manager/metrics", + "type": "http" + }, + "host": { + "hostname": "docker-fleet-agent", + "os": { + "kernel": "5.15.49-linuxkit", + "codename": "focal", + "name": "Ubuntu", + "family": "debian", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)", + "platform": "ubuntu" + }, + "containerized": false, + "ip": [ + "172.23.0.7" + ], + "name": "docker-fleet-agent", + "id": "0d43b8a597974fa28645b1e16ce2db8d", + "mac": [ + "02-42-AC-17-00-07" + ], + "architecture": "aarch64" + }, + "elastic_agent": { + "id": "8e1f023e-e70d-40a7-905a-f1ff1271b631", + "version": "8.10.0", + "snapshot": true + }, + "metricset": { + "period": 10000, + "name": "json" + }, + "http": {}, + "kibana": { + "task_manager_metrics": { + "last_update": "2023-08-23T15:16:49.213Z", + "process_uuid": "2b4126d2-f102-4d6c-9070-9763d142ed14", + "metrics": { + "task_run": { + "value": { + "overall": { + "total": 1, + "success": 1 + }, + "by_type": { + "cases-telemetry-task": { + "total": 0, + "success": 0 + }, + "apm-telemetry-task": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-saved-queries": { + "total": 0, + "success": 0 + }, + "security:telemetry-detection-rules": { + "total": 0, + "success": 0 + }, + "alerting_telemetry": { + "total": 0, + "success": 0 + }, + "alerts_invalidate_api_keys": { + "total": 0, + "success": 0 + }, + "security:endpoint-diagnostics": { + "total": 0, + "success": 0 + }, + "endpoint:user-artifact-packager": { + "total": 0, + "success": 0 + }, + "security:telemetry-filterlist-artifact": { + "total": 0, + "success": 0 + }, + "session_cleanup": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-configs": { + "total": 0, + "success": 0 + }, + "security:telemetry-timelines": { + "total": 0, + "success": 0 + }, + "Fleet-Usage-Sender": { + "total": 0, + "success": 0 + }, + "security:endpoint-meta-telemetry": { + "total": 0, + "success": 0 + }, + "ML:saved-objects-sync": { + "total": 0, + "success": 0 + }, + "security:telemetry-prebuilt-rule-alerts": { + "total": 0, + "success": 0 + }, + "osquery:telemetry-packs": { + "total": 0, + "success": 0 + }, + "dashboard_telemetry": { + "total": 0, + "success": 0 + }, + "Fleet-Usage-Logger": { + "total": 0, + "success": 0 + }, + "security:telemetry-lists": { + "total": 0, + "success": 0 + }, + "actions_telemetry": { + "total": 0, + "success": 0 + }, + "apm-source-map-migration-task": { + "total": 0, + "success": 0 + }, + "security:telemetry-configuration": { + "total": 0, + "success": 0 + }, + "endpoint:metadata-check-transforms-task": { + "total": 0, + "success": 0 + }, + "fleet:check-deleted-files-task": { + "total": 0, + "success": 0 + }, + "alerting_health_check": { + "total": 0, + "success": 0 + }, + "reports:monitor": { + "total": 1, + "success": 1 + } + } + }, + "timestamp": "2023-08-23T15:16:46.327Z" + }, + "task_claim": { + "value": { + "duration": { + "counts": [ + 3 + ], + "values": [ + 100 + ] + }, + "total": 3, + "success": 3 + }, + "timestamp": "2023-08-23T15:16:49.213Z" + } + }, + "timestamp": "2023-08-23T15:16:49.213Z" + } + }, + "event": { + "duration": 19616583, + "agent_id_status": "verified", + "ingested": "2023-08-23T15:16:51Z", + "module": "http", + "dataset": "kibana.task_manager_metrics" + } +} +``` + ## Metrics ### Stats diff --git a/packages/kibana/manifest.yml b/packages/kibana/manifest.yml index fbe8ca4859d..3a8991b44af 100644 --- a/packages/kibana/manifest.yml +++ b/packages/kibana/manifest.yml @@ -1,6 +1,6 @@ name: kibana title: Kibana -version: 2.3.5 +version: 2.4.0 description: Collect logs and metrics from Kibana with Elastic Agent. type: integration icons: @@ -12,7 +12,7 @@ format_version: 1.0.0 license: basic categories: ["elastic_stack"] conditions: - kibana.version: ^8.9.0 + kibana.version: ^8.10.0 owner: github: elastic/infra-monitoring-ui policy_templates: @@ -43,6 +43,12 @@ policy_templates: show_user: true default: - http://localhost:5601 + - name: basepath + type: text + title: Base path + multi: false + required: false + show_user: false - name: username type: text title: Username @@ -80,6 +86,12 @@ policy_templates: show_user: true default: - http://localhost:5601 + - name: basepath + type: text + title: Base path + multi: false + required: false + show_user: false - name: username type: text title: Username diff --git a/packages/kubernetes/_dev/build/docs/README.md b/packages/kubernetes/_dev/build/docs/README.md index fda0c47e686..2fb37bdeb7f 100644 --- a/packages/kubernetes/_dev/build/docs/README.md +++ b/packages/kubernetes/_dev/build/docs/README.md @@ -84,6 +84,14 @@ the masters won't be visible. In these cases it won't be possible to use `schedu The container-logs dataset requires access to the log files in each Kubernetes node where the container logs are stored. This defaults to `/var/log/containers/*${kubernetes.container.id}.log`. +#### Routing + +The container-logs data stream allows routing logs to a different *dataset* or *namespace* using pod annotations. + +For example, suppose you are running Nginx on your Kubernetes cluster, and you want to drive the Nginx container logs into a dedicated dataset or namespace. By annotating the pod with `elastic.co/namespace: nginx`, the integration will send all the container logs to the `nginx` namespace. + +To learn more about routing container-logs, see https://docs.elastic.co/integrations/kubernetes/container-logs. + ### audit-logs The audit-logs dataset requires access to the log files on each Kubernetes node where the audit logs are stored. @@ -91,7 +99,7 @@ This defaults to `/var/log/kubernetes/kube-apiserver-audit.log`. ## Compatibility -The Kubernetes package is tested with Kubernetes [1.23.x - 1.26.x] versions +The Kubernetes package is tested with Kubernetes [1.25.x - 1.27.x] versions ## Dashboard diff --git a/packages/kubernetes/_dev/build/docs/container-logs.md b/packages/kubernetes/_dev/build/docs/container-logs.md index d18c6fee111..a47fc79bde2 100644 --- a/packages/kubernetes/_dev/build/docs/container-logs.md +++ b/packages/kubernetes/_dev/build/docs/container-logs.md @@ -6,3 +6,81 @@ It requires access to the log files in each Kubernetes node where the container This defaults to `/var/log/containers/*${kubernetes.container.id}.log`. By default only {{ url "filebeat-input-filestream-parsers" "container parser" }} is enabled. Additional log parsers can be added as an advanced options configuration. + + +## Rerouting based on pod annotations + +You can customize the routing of container logs events and sending them to different datasets and namespaces using pods' annotations. + +Routing customization can happen at: + +- pod definition time, e.g., using a deployment. +- pod runtime, annotating pods using `kubectl`. + + +### Set routing at pod definition time + +Here is an example of an Nginx deployment where we set both `elastic.co/dataset` and `elastic.co/namespace` annotations to route the container logs to specific datasets and namespace, respectively. + +```yaml +# nginx-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-deployment +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + annotations: + elastic.co/dataset: kubernetes.container_logs.nginx + elastic.co/namespace: nginx + labels: + app: nginx + app.kubernetes.io/name: myservice + app.kubernetes.io/version: v0.1.2 + app.kubernetes.io/instance: myservice-abcxzy + spec: + containers: + - name: nginx-container + image: nginx:latest + ports: + - containerPort: 80 +``` + + +### Set routing at runtime + +Suppose you want to change the container logs routing on a running container. In that case, you can annotate the pod using `kubectl`, and the integration will apply it immediately sending all the following documents to the new destination: + +Here is an example where we route the container logs for a pod running the Elastic Agent to the `kubernetes.container_logs.agents` dataset: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/dataset=kubernetes.container_logs.agents +``` + +Here's a similar example to change the namespace on a pod running Nginx: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/namespace=nginx +``` + +You can restore the standard routing by removing the annotations: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/dataset- +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/namespace- +``` + +### Annotations Reference + +Here are the annotations available to customize routing: + + +| Label | Description | +| ---------------------- | -------------------------------------------------------- | +| `elastic.co/dataset` | Defines the target data stream's dataset for this pod. | +| `elastic.co/namespace` | Defines the target data stream's namespace for this pod. | diff --git a/packages/kubernetes/changelog.yml b/packages/kubernetes/changelog.yml index ab4f7d6c0f6..5ddba99ff49 100644 --- a/packages/kubernetes/changelog.yml +++ b/packages/kubernetes/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.45.0" + changes: + - description: Reroute container logs based on pod annotations. + type: enhancement + link: https://github.com/elastic/integrations/pull/7118 +- version: "1.44.0" + changes: + - description: Introducing kubernetes.deployment.status.* metrics + type: enhancement + link: https://github.com/elastic/integrations/pull/6821 +- version: "1.43.1" + changes: + - description: Updating index pattern for adHocDataviews for CCS use case + type: enhancement + link: https://github.com/elastic/integrations/pull/6933 - version: "1.43.0" changes: - description: Expand index pattern for adHocDataviews for CCS use case diff --git a/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-common-config.yml b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..0f481f01759 --- /dev/null +++ b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,11 @@ +fields: + data_stream: + dataset: kubernetes.container_logs + namespace: default + kubernetes: + annotations: + elastic_co/dataset: kubernetes.container_logs.nginx + elastic_co/namespace: nginx + labels: + app_kubernetes_io/version: "v0.1.0" + app_kubernetes_io/name: "myservice" diff --git a/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log new file mode 100644 index 00000000000..4c8268b0be2 --- /dev/null +++ b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log @@ -0,0 +1,4 @@ +2023/07/25 15:24:11 [notice] 1#1: start worker process 33 +2023/07/25 15:24:11 [notice] 1#1: start worker process 34 +2023/07/25 15:24:11 [notice] 1#1: start worker process 35 +2023/07/25 15:24:11 [notice] 1#1: using the "epoll" event method \ No newline at end of file diff --git a/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log-expected.json b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log-expected.json new file mode 100644 index 00000000000..1060e297815 --- /dev/null +++ b/packages/kubernetes/data_stream/container_logs/_dev/test/pipeline/test-nginx.log-expected.json @@ -0,0 +1,92 @@ +{ + "expected": [ + { + "data_stream": { + "dataset": "kubernetes.container_logs.nginx", + "namespace": "nginx", + "type": "logs" + }, + "kubernetes": { + "annotations": { + "elastic_co/dataset": "kubernetes.container_logs.nginx", + "elastic_co/namespace": "nginx" + }, + "labels": { + "app_kubernetes_io/name": "myservice", + "app_kubernetes_io/version": "v0.1.0" + } + }, + "message": "2023/07/25 15:24:11 [notice] 1#1: start worker process 33", + "service": { + "name": "myservice", + "version": "v0.1.0" + } + }, + { + "data_stream": { + "dataset": "kubernetes.container_logs.nginx", + "namespace": "nginx", + "type": "logs" + }, + "kubernetes": { + "annotations": { + "elastic_co/dataset": "kubernetes.container_logs.nginx", + "elastic_co/namespace": "nginx" + }, + "labels": { + "app_kubernetes_io/name": "myservice", + "app_kubernetes_io/version": "v0.1.0" + } + }, + "message": "2023/07/25 15:24:11 [notice] 1#1: start worker process 34", + "service": { + "name": "myservice", + "version": "v0.1.0" + } + }, + { + "data_stream": { + "dataset": "kubernetes.container_logs.nginx", + "namespace": "nginx", + "type": "logs" + }, + "kubernetes": { + "annotations": { + "elastic_co/dataset": "kubernetes.container_logs.nginx", + "elastic_co/namespace": "nginx" + }, + "labels": { + "app_kubernetes_io/name": "myservice", + "app_kubernetes_io/version": "v0.1.0" + } + }, + "message": "2023/07/25 15:24:11 [notice] 1#1: start worker process 35", + "service": { + "name": "myservice", + "version": "v0.1.0" + } + }, + { + "data_stream": { + "dataset": "kubernetes.container_logs.nginx", + "namespace": "nginx", + "type": "logs" + }, + "kubernetes": { + "annotations": { + "elastic_co/dataset": "kubernetes.container_logs.nginx", + "elastic_co/namespace": "nginx" + }, + "labels": { + "app_kubernetes_io/name": "myservice", + "app_kubernetes_io/version": "v0.1.0" + } + }, + "message": "2023/07/25 15:24:11 [notice] 1#1: using the \"epoll\" event method", + "service": { + "name": "myservice", + "version": "v0.1.0" + } + } + ] +} \ No newline at end of file diff --git a/packages/kubernetes/data_stream/container_logs/agent/stream/stream.yml.hbs b/packages/kubernetes/data_stream/container_logs/agent/stream/stream.yml.hbs index b7359ee8c5d..abc6a5a9d74 100644 --- a/packages/kubernetes/data_stream/container_logs/agent/stream/stream.yml.hbs +++ b/packages/kubernetes/data_stream/container_logs/agent/stream/stream.yml.hbs @@ -15,8 +15,43 @@ parsers: format: {{ containerParserFormat }} {{ additionalParsersConfig }} -{{#if processors}} processors: +{{! + Why do we need to add the following processors? + ----------------------------------------------- + + The kubernetes provider supports[^1] pods annotations, making it possible to add + them to the event using the `include_annotations` configuration option. + + However, adding annotations to the event is disabled by default, and it is + not possible to enable it on Fleet-managed agents. + + The following processors are a workaround to add the annotations to the event + without using the `include_annotations` configuration option. + + + [^1]: https://github.com/elastic/elastic-agent/blob/37ec2bb7ee1d2cc6c0fccf2f0cd0a44eb3d61efd/internal/pkg/composable/providers/kubernetes/pod.go#L311-L315 +}} +- add_fields: + target: kubernetes + fields: + annotations.elastic_co/dataset: ${kubernetes.annotations.elastic.co/dataset|""} + annotations.elastic_co/namespace: ${kubernetes.annotations.elastic.co/namespace|""} +- drop_fields: + fields: + - kubernetes.annotations.elastic_co/dataset + when: + equals: + kubernetes.annotations.elastic_co/dataset: "" + ignore_missing: true +- drop_fields: + fields: + - kubernetes.annotations.elastic_co/namespace + when: + equals: + kubernetes.annotations.elastic_co/namespace: "" + ignore_missing: true +{{#if processors}} {{processors}} {{/if}} diff --git a/packages/kubernetes/data_stream/container_logs/elasticsearch/ingest_pipeline/default.yml b/packages/kubernetes/data_stream/container_logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..68f022de22c --- /dev/null +++ b/packages/kubernetes/data_stream/container_logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,23 @@ +--- +description: Pipeline for Kubernetes container logs +processors: + - set: + field: service.name + copy_from: kubernetes.labels.app_kubernetes_io/name + ignore_empty_value: true + - set: + field: service.name + copy_from: kubernetes.container.name + override: false + ignore_empty_value: true + - set: + field: service.version + copy_from: kubernetes.labels.app_kubernetes_io/version + ignore_empty_value: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/kubernetes/data_stream/container_logs/fields/ecs.yml b/packages/kubernetes/data_stream/container_logs/fields/ecs.yml index 32f8a586e74..e5533027809 100644 --- a/packages/kubernetes/data_stream/container_logs/fields/ecs.yml +++ b/packages/kubernetes/data_stream/container_logs/fields/ecs.yml @@ -22,3 +22,7 @@ name: orchestrator.cluster.name - external: ecs name: orchestrator.cluster.url +- external: ecs + name: service.name +- external: ecs + name: service.version diff --git a/packages/kubernetes/data_stream/container_logs/manifest.yml b/packages/kubernetes/data_stream/container_logs/manifest.yml index 5ecafb54d2e..d6f4a339f0c 100644 --- a/packages/kubernetes/data_stream/container_logs/manifest.yml +++ b/packages/kubernetes/data_stream/container_logs/manifest.yml @@ -1,5 +1,6 @@ title: "Kubernetes container logs" type: logs +dataset: kubernetes.container_logs streams: - input: filestream title: Collect Kubernetes container logs diff --git a/packages/kubernetes/data_stream/container_logs/routing_rules.yml b/packages/kubernetes/data_stream/container_logs/routing_rules.yml new file mode 100644 index 00000000000..d782f658233 --- /dev/null +++ b/packages/kubernetes/data_stream/container_logs/routing_rules.yml @@ -0,0 +1,11 @@ +# Route container logs events to the correct dataset and namespace +# based on pod annotations. +- source_dataset: kubernetes.container_logs + rules: + - target_dataset: + - "{{kubernetes.annotations.elastic_co/dataset}}" + - "{{data_stream.dataset}}" + namespace: + - "{{kubernetes.annotations.elastic_co/namespace}}" + - "{{data_stream.namespace}}" + if: "ctx.kubernetes?.annotations != null" diff --git a/packages/kubernetes/data_stream/pod/fields/fields.yml b/packages/kubernetes/data_stream/pod/fields/fields.yml index 3f18b91dffe..e10c881e106 100644 --- a/packages/kubernetes/data_stream/pod/fields/fields.yml +++ b/packages/kubernetes/data_stream/pod/fields/fields.yml @@ -139,6 +139,3 @@ metric_type: counter description: | Total major page faults - - name: ip - type: ip - description: Kubernetes pod IP diff --git a/packages/kubernetes/data_stream/state_deployment/fields/fields.yml b/packages/kubernetes/data_stream/state_deployment/fields/fields.yml index 51b6abb87e7..69d4ec687a6 100644 --- a/packages/kubernetes/data_stream/state_deployment/fields/fields.yml +++ b/packages/kubernetes/data_stream/state_deployment/fields/fields.yml @@ -5,6 +5,16 @@ type: boolean description: | Kubernetes deployment paused status + - name: status + type: group + fields: + - name: available + type: keyword + description: | + Deployment Available Condition status (true, false or unknown) + - name: progressing + type: keyword + description: Deployment Progresing Condition status (true, false or unknown) - name: replicas type: group fields: diff --git a/packages/kubernetes/data_stream/state_node/sample_event.json b/packages/kubernetes/data_stream/state_node/sample_event.json index 9b7f451ab60..889812074d4 100644 --- a/packages/kubernetes/data_stream/state_node/sample_event.json +++ b/packages/kubernetes/data_stream/state_node/sample_event.json @@ -81,7 +81,7 @@ "address": "kube-state-metrics:8080" }, "event": { - "dataset": "kubernetes.node", + "dataset": "kubernetes.state_node", "module": "kubernetes", "duration": 8194220 } diff --git a/packages/kubernetes/data_stream/state_persistentvolume/sample_event.json b/packages/kubernetes/data_stream/state_persistentvolume/sample_event.json index cbc6f7f8467..e412eebfddf 100644 --- a/packages/kubernetes/data_stream/state_persistentvolume/sample_event.json +++ b/packages/kubernetes/data_stream/state_persistentvolume/sample_event.json @@ -6,7 +6,7 @@ "event": { "module": "kubernetes", "duration": 12149615, - "dataset": "kubernetes.persistentvolume" + "dataset": "kubernetes.state_persistentvolume" }, "agent": { "version": "8.0.0", diff --git a/packages/kubernetes/data_stream/state_pod/fields/fields.yml b/packages/kubernetes/data_stream/state_pod/fields/fields.yml index 67d4cb4b223..f541d55d39a 100644 --- a/packages/kubernetes/data_stream/state_pod/fields/fields.yml +++ b/packages/kubernetes/data_stream/state_pod/fields/fields.yml @@ -1,10 +1,6 @@ - name: kubernetes.pod type: group fields: - - name: ip - type: ip - description: | - Kubernetes pod IP - name: host_ip type: ip description: | diff --git a/packages/kubernetes/data_stream/state_resourcequota/sample_event.json b/packages/kubernetes/data_stream/state_resourcequota/sample_event.json index d3603943f0a..f52f8d7998e 100644 --- a/packages/kubernetes/data_stream/state_resourcequota/sample_event.json +++ b/packages/kubernetes/data_stream/state_resourcequota/sample_event.json @@ -30,7 +30,7 @@ "type": "kubernetes" }, "event": { - "dataset": "kubernetes.resourcequota", + "dataset": "kubernetes.state_resourcequota", "module": "kubernetes", "duration": 6324269 }, diff --git a/packages/kubernetes/data_stream/state_storageclass/sample_event.json b/packages/kubernetes/data_stream/state_storageclass/sample_event.json index de074d381d9..79707de8b34 100644 --- a/packages/kubernetes/data_stream/state_storageclass/sample_event.json +++ b/packages/kubernetes/data_stream/state_storageclass/sample_event.json @@ -43,7 +43,7 @@ "event": { "module": "kubernetes", "duration": 5713503, - "dataset": "kubernetes.storageclass" + "dataset": "kubernetes.state_storageclass" }, "metricset": { "name": "state_storageclass", diff --git a/packages/kubernetes/docs/README.md b/packages/kubernetes/docs/README.md index 2afa2a42da8..f801d4b9188 100644 --- a/packages/kubernetes/docs/README.md +++ b/packages/kubernetes/docs/README.md @@ -84,6 +84,14 @@ the masters won't be visible. In these cases it won't be possible to use `schedu The container-logs dataset requires access to the log files in each Kubernetes node where the container logs are stored. This defaults to `/var/log/containers/*${kubernetes.container.id}.log`. +#### Routing + +The container-logs data stream allows routing logs to a different *dataset* or *namespace* using pod annotations. + +For example, suppose you are running Nginx on your Kubernetes cluster, and you want to drive the Nginx container logs into a dedicated dataset or namespace. By annotating the pod with `elastic.co/namespace: nginx`, the integration will send all the container logs to the `nginx` namespace. + +To learn more about routing container-logs, see https://docs.elastic.co/integrations/kubernetes/container-logs. + ### audit-logs The audit-logs dataset requires access to the log files on each Kubernetes node where the audit logs are stored. @@ -91,7 +99,7 @@ This defaults to `/var/log/kubernetes/kube-apiserver-audit.log`. ## Compatibility -The Kubernetes package is tested with Kubernetes [1.23.x - 1.26.x] versions +The Kubernetes package is tested with Kubernetes [1.25.x - 1.27.x] versions ## Dashboard diff --git a/packages/kubernetes/docs/container-logs.md b/packages/kubernetes/docs/container-logs.md index d410d066276..0c45b0ed4b7 100644 --- a/packages/kubernetes/docs/container-logs.md +++ b/packages/kubernetes/docs/container-logs.md @@ -6,3 +6,81 @@ It requires access to the log files in each Kubernetes node where the container This defaults to `/var/log/containers/*${kubernetes.container.id}.log`. By default only [container parser](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_parsers) is enabled. Additional log parsers can be added as an advanced options configuration. + + +## Rerouting based on pod annotations + +You can customize the routing of container logs events and sending them to different datasets and namespaces using pods' annotations. + +Routing customization can happen at: + +- pod definition time, e.g., using a deployment. +- pod runtime, annotating pods using `kubectl`. + + +### Set routing at pod definition time + +Here is an example of an Nginx deployment where we set both `elastic.co/dataset` and `elastic.co/namespace` annotations to route the container logs to specific datasets and namespace, respectively. + +```yaml +# nginx-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-deployment +spec: + replicas: 1 + selector: + matchLabels: + app: nginx + template: + metadata: + annotations: + elastic.co/dataset: kubernetes.container_logs.nginx + elastic.co/namespace: nginx + labels: + app: nginx + app.kubernetes.io/name: myservice + app.kubernetes.io/version: v0.1.2 + app.kubernetes.io/instance: myservice-abcxzy + spec: + containers: + - name: nginx-container + image: nginx:latest + ports: + - containerPort: 80 +``` + + +### Set routing at runtime + +Suppose you want to change the container logs routing on a running container. In that case, you can annotate the pod using `kubectl`, and the integration will apply it immediately sending all the following documents to the new destination: + +Here is an example where we route the container logs for a pod running the Elastic Agent to the `kubernetes.container_logs.agents` dataset: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/dataset=kubernetes.container_logs.agents +``` + +Here's a similar example to change the namespace on a pod running Nginx: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/namespace=nginx +``` + +You can restore the standard routing by removing the annotations: + +```shell +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/dataset- +kubectl annotate pods elastic-agent-managed-daemonset-6p22g elastic.co/namespace- +``` + +### Annotations Reference + +Here are the annotations available to customize routing: + + +| Label | Description | +| ---------------------- | -------------------------------------------------------- | +| `elastic.co/dataset` | Defines the target data stream's dataset for this pod. | +| `elastic.co/namespace` | Defines the target data stream's namespace for this pod. | diff --git a/packages/kubernetes/docs/kube-state-metrics.md b/packages/kubernetes/docs/kube-state-metrics.md index e9b98dcd536..d43c101d5dc 100644 --- a/packages/kubernetes/docs/kube-state-metrics.md +++ b/packages/kubernetes/docs/kube-state-metrics.md @@ -800,6 +800,8 @@ An example event for `state_deployment` looks as following: | kubernetes.deployment.replicas.desired | Deployment number of desired replicas (spec) | integer | gauge | | kubernetes.deployment.replicas.unavailable | Deployment unavailable replicas | integer | gauge | | kubernetes.deployment.replicas.updated | Deployment updated replicas | integer | gauge | +| kubernetes.deployment.status.available | Deployment Available Condition status (true, false or unknown) | keyword | | +| kubernetes.deployment.status.progressing | Deployment Progresing Condition status (true, false or unknown) | keyword | | | kubernetes.labels.\* | Kubernetes labels map | object | | | kubernetes.namespace | Kubernetes namespace | keyword | | | kubernetes.namespace_labels.\* | Kubernetes namespace labels map | object | | @@ -1134,7 +1136,7 @@ An example event for `state_node` looks as following: "address": "kube-state-metrics:8080" }, "event": { - "dataset": "kubernetes.node", + "dataset": "kubernetes.state_node", "module": "kubernetes", "duration": 8194220 } @@ -1229,7 +1231,7 @@ An example event for `state_persistentvolume` looks as following: "event": { "module": "kubernetes", "duration": 12149615, - "dataset": "kubernetes.persistentvolume" + "dataset": "kubernetes.state_persistentvolume" }, "agent": { "version": "8.0.0", @@ -1968,7 +1970,7 @@ An example event for `state_resourcequota` looks as following: "type": "kubernetes" }, "event": { - "dataset": "kubernetes.resourcequota", + "dataset": "kubernetes.state_resourcequota", "module": "kubernetes", "duration": 6324269 }, @@ -2481,7 +2483,7 @@ An example event for `state_storageclass` looks as following: "event": { "module": "kubernetes", "duration": 5713503, - "dataset": "kubernetes.storageclass" + "dataset": "kubernetes.state_storageclass" }, "metricset": { "name": "state_storageclass", diff --git a/packages/kubernetes/kibana/dashboard/kubernetes-f4dc26db-1b53-4ea2-a78b-1bfab8ea267c.json b/packages/kubernetes/kibana/dashboard/kubernetes-f4dc26db-1b53-4ea2-a78b-1bfab8ea267c.json index efe3f813f59..f7781716d29 100644 --- a/packages/kubernetes/kibana/dashboard/kubernetes-f4dc26db-1b53-4ea2-a78b-1bfab8ea267c.json +++ b/packages/kubernetes/kibana/dashboard/kubernetes-f4dc26db-1b53-4ea2-a78b-1bfab8ea267c.json @@ -144,7 +144,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "31c14ad9-51fd-465c-957c-b0171c23a0bb": { "allowNoIndex": false, @@ -168,7 +168,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "b0224778-49e2-4916-aa97-55d3b4ddf6c1": { "allowNoIndex": false, @@ -192,7 +192,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "d1e9a0d9-4696-43cb-b9f1-a4b0b9fe3732": { "allowNoIndex": false, @@ -216,7 +216,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "f8fa576a-6f91-4a11-a43d-7f3964869d7d": { "allowNoIndex": false, @@ -227,7 +227,7 @@ "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" } }, "datasourceStates": { @@ -1190,7 +1190,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "295ecdc5-f413-4f20-9f77-74927a10d33d": { "allowNoIndex": false, @@ -1214,7 +1214,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "f8fa576a-6f91-4a11-a43d-7f3964869d7d": { "allowNoIndex": false, @@ -1225,7 +1225,7 @@ "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" } }, "datasourceStates": { @@ -1480,7 +1480,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "dbfaeb6f-4fff-4043-8bf8-19d5345fd339": { "allowNoIndex": false, @@ -1498,7 +1498,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "f8fa576a-6f91-4a11-a43d-7f3964869d7d": { "allowNoIndex": false, @@ -1509,7 +1509,7 @@ "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" } }, "datasourceStates": { @@ -1942,7 +1942,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" } }, "datasourceStates": { @@ -2231,7 +2231,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "0fa53a1e-0589-4380-b700-70dd489a33de": { "allowNoIndex": false, @@ -2273,7 +2273,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "34c15200-5232-4a16-8fb0-36ca5a194638": { "allowNoIndex": false, @@ -2297,7 +2297,7 @@ }, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" }, "f8fa576a-6f91-4a11-a43d-7f3964869d7d": { "allowNoIndex": false, @@ -2308,7 +2308,7 @@ "runtimeFieldMap": {}, "sourceFilters": [], "timeFieldName": "@timestamp", - "title": "*metrics-*" + "title": "metrics-*,*:metrics-*" } }, "datasourceStates": { diff --git a/packages/kubernetes/manifest.yml b/packages/kubernetes/manifest.yml index aed6db1777c..75babbcc774 100644 --- a/packages/kubernetes/manifest.yml +++ b/packages/kubernetes/manifest.yml @@ -1,17 +1,15 @@ -format_version: 1.0.0 +format_version: 2.9.0 name: kubernetes title: Kubernetes -version: 1.43.0 -license: basic +version: 1.45.0 description: Collect logs and metrics from Kubernetes clusters with Elastic Agent. type: integration categories: - observability - containers - kubernetes -release: ga conditions: - kibana.version: "^8.8.0" + kibana.version: "^8.10.0" screenshots: - src: /img/metricbeat_kubernetes_overview.png title: Metricbeat Kubernetes Overview diff --git a/packages/lastpass/_dev/build/build.yml b/packages/lastpass/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/lastpass/_dev/build/build.yml +++ b/packages/lastpass/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/lastpass/changelog.yml b/packages/lastpass/changelog.yml index d8716b37ade..1a953a81ece 100644 --- a/packages/lastpass/changelog.yml +++ b/packages/lastpass/changelog.yml @@ -1,4 +1,37 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Allow user to specify timezone for event report events. + type: enhancement + link: https://github.com/elastic/integrations/pull/7386 + - description: Fix event.type for authorization events. + type: bugfix + link: https://github.com/elastic/integrations/pull/7386 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.6.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.5.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7121 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/lastpass/data_stream/detailed_shared_folder/_dev/test/pipeline/test-detailed-shared-folder.log-expected.json b/packages/lastpass/data_stream/detailed_shared_folder/_dev/test/pipeline/test-detailed-shared-folder.log-expected.json index 0175aa379c0..1e29162136f 100644 --- a/packages/lastpass/data_stream/detailed_shared_folder/_dev/test/pipeline/test-detailed-shared-folder.log-expected.json +++ b/packages/lastpass/data_stream/detailed_shared_folder/_dev/test/pipeline/test-detailed-shared-folder.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", diff --git a/packages/lastpass/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml b/packages/lastpass/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml index 186c3b5d56f..b1575653424 100644 --- a/packages/lastpass/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml +++ b/packages/lastpass/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Detailed Shared Folder logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/lastpass/data_stream/detailed_shared_folder/manifest.yml b/packages/lastpass/data_stream/detailed_shared_folder/manifest.yml index d5fbb0dd94e..2e0af72861f 100644 --- a/packages/lastpass/data_stream/detailed_shared_folder/manifest.yml +++ b/packages/lastpass/data_stream/detailed_shared_folder/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the LastPass API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the LastPass API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -17,7 +17,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/lastpass/data_stream/detailed_shared_folder/sample_event.json b/packages/lastpass/data_stream/detailed_shared_folder/sample_event.json index fb076af75a5..150888767db 100644 --- a/packages/lastpass/data_stream/detailed_shared_folder/sample_event.json +++ b/packages/lastpass/data_stream/detailed_shared_folder/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-01-13T12:25:09.044Z", + "@timestamp": "2023-07-24T13:38:49.667Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "0c9df2f5-7a57-46b5-af86-d72509a29876", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "lastpass.detailed_shared_folder", @@ -13,18 +13,18 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "agent_id_status": "verified", - "created": "2023-01-13T12:25:09.044Z", + "created": "2023-07-24T13:38:49.667Z", "dataset": "lastpass.detailed_shared_folder", - "ingested": "2023-01-13T12:25:10Z", + "ingested": "2023-07-24T13:38:52Z", "kind": "state", "original": "{\"id\":\"101\",\"score\":99,\"sharedfoldername\":\"ThisSFName\",\"users\":{\"can_administer\":true,\"give\":false,\"readonly\":true,\"sites\":[\"aaa.com\",\"bbb.com\"],\"username\":\"joe.user@lastpass.com\"}}", "type": [ diff --git a/packages/lastpass/data_stream/event_report/_dev/test/pipeline/test-event-report.log-expected.json b/packages/lastpass/data_stream/event_report/_dev/test/pipeline/test-event-report.log-expected.json index 8ee15951b9b..a30c832becc 100644 --- a/packages/lastpass/data_stream/event_report/_dev/test/pipeline/test-event-report.log-expected.json +++ b/packages/lastpass/data_stream/event_report/_dev/test/pipeline/test-event-report.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login verification email sent", @@ -13,6 +13,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login Verification Email Sent\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -58,7 +59,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "multifactor enabled", @@ -68,6 +69,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Multifactor Enabled\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -113,7 +115,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "enterprise api secret regenerated", @@ -123,6 +125,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Enterprise API Secret regenerated\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -168,7 +171,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "master password changed", @@ -178,6 +181,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Master Password Changed\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -223,7 +227,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "saml login", @@ -233,8 +237,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"SAML Login\",\"Data\":\"authorizationserver.oidc\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -282,7 +287,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete policy", @@ -292,6 +297,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Delete Policy\",\"Data\":\"Require passwordless verification via LastPass Authenticator\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -340,7 +346,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add policy", @@ -350,6 +356,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add Policy\",\"Data\":\"Require passwordless verification via LastPass Authenticator New value: 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -398,13 +405,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reporting", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Reporting\",\"Data\":\"Initiated by API\"}", "outcome": "unknown", + "timezone": "US/Eastern", "type": [ "info" ] @@ -453,13 +461,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "get user data", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Get User Data\",\"Data\":\"Initiated by API\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -508,13 +517,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "get shared folder data", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Get Shared Folder Data\",\"Data\":\"Initiated by API\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -563,7 +573,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log in", @@ -573,8 +583,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Log in\",\"Data\":\"lastpass.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -622,7 +633,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed login attempt", @@ -632,8 +643,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Failed Login Attempt\",\"Data\":\"lastpass.com\"}", "outcome": "failure", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -681,7 +693,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log in", @@ -691,8 +703,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Log in\",\"Data\":\"1.1.1.1:1234/example\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -740,7 +753,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login to admin console", @@ -750,8 +763,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login to Admin Console\",\"Data\":\"user1@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -801,7 +815,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee account created", @@ -811,6 +825,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee Account Created\",\"Data\":\"user2@example.com,user3@example.com,user4@example.com,user5@example.com,user6@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -876,13 +891,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee invited", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee Invited\",\"Data\":\"user2@example.com,user3@example.com,user4@example.com,user5@example.com,user6@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -948,7 +964,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "make admin", @@ -958,6 +974,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Make Admin\",\"Data\":\"user4@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "admin" ] @@ -1009,7 +1026,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login to admin console", @@ -1019,8 +1036,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login to Admin Console\",\"Data\":\"user1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -1067,7 +1085,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "make admin", @@ -1077,6 +1095,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Make Admin\",\"Data\":\"user4\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "admin" ] @@ -1125,13 +1144,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site added", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Site Added\",\"Data\":\"example.com/ServiceLogin\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1181,13 +1201,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted Sites\",\"Data\":\"example.com/ServiceLogin\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -1239,13 +1260,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site added", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Site Added\",\"Data\":\"example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1295,13 +1317,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted Sites\",\"Data\":\"example1.com,example2.com,example3.com,example4.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -1356,13 +1379,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Created Shared Folder\",\"Data\":\"temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1412,13 +1436,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted Shared Folder\",\"Data\":\"temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -1468,13 +1493,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add Secure Note\",\"Data\":\"Secure Note (Address) from temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1525,15 +1551,16 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Open Secure Note\",\"Data\":\"Secure Note (Address)\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -1581,15 +1608,16 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Open Secure Note\",\"Data\":\"Secure Note (Address) from temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -1638,13 +1666,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add to Shared Folder\",\"Data\":\"'temp-1' 'user1@example.com'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1697,7 +1726,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create group", @@ -1707,6 +1736,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Create Group\",\"Data\":\"'temp-group'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "group", "creation" @@ -1760,7 +1790,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "adding user to group", @@ -1770,6 +1800,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Adding User to Group\",\"Data\":\"user1@example.com - temp-group\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "group", "creation" @@ -1826,7 +1857,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created lastpass account", @@ -1836,6 +1867,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Created LastPass Account\",\"Data\":\"user1@example.com-Shared-temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -1888,13 +1920,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update folder permissions", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Update Folder Permissions\",\"Data\":\"'temp-1' 'user1@example.com' 'Read only:no Admin:no Hide PW:no'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -1952,7 +1985,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "master password reset by super admin", @@ -1962,6 +1995,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Master Password Reset by Super Admin\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2013,7 +2047,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee account deleted", @@ -2023,6 +2057,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee Account Deleted\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -2076,7 +2111,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "require password change", @@ -2086,6 +2121,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Require Password Change\",\"Data\":\"user3@example.com\"}", "outcome": "unknown", + "timezone": "US/Eastern", "type": [ "info" ] @@ -2137,7 +2173,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove admin", @@ -2147,6 +2183,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Remove Admin\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -2198,13 +2235,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "edit secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Edit Secure Note\",\"Data\":\"Secure Note (Wifi renamed)\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2254,13 +2292,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "renamed shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Renamed Shared Folder\",\"Data\":\"'test1' 'test2'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2311,13 +2350,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move to Shared Folder\",\"Data\":\"example.com to Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2368,13 +2408,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move to Shared Folder\",\"Data\":\" to Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2424,13 +2465,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from Shared Folder\",\"Data\":\"example.com from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2481,13 +2523,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from Shared Folder\",\"Data\":\" from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2537,13 +2580,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "limit shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Limit Shared Folder\",\"Data\":\"shared folder test@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2594,13 +2638,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Removed From Shared Folder\",\"Data\":\"'test1' 'test@example.com'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -2651,13 +2696,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete shared sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Delete Shared Sites\",\"Data\":\"example.com from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -2708,13 +2754,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from Shared Folder\",\"Data\":\" from INVALID SHARED FOLDER\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2763,7 +2810,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login verification email sent", @@ -2773,6 +2820,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login verification email sent\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -2818,7 +2866,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "multifactor enabled", @@ -2828,6 +2876,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Multifactor enabled\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -2873,7 +2922,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "enterprise api secret regenerated", @@ -2883,6 +2932,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Enterprise API secret regenerated\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2928,7 +2978,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "master password changed", @@ -2938,6 +2988,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Master password changed\",\"Data\":\"\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -2983,7 +3034,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "saml login", @@ -2993,8 +3044,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"SAML login\",\"Data\":\"authorizationserver.oidc\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3042,7 +3094,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete policy", @@ -3052,6 +3104,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Delete policy\",\"Data\":\"Require passwordless verification via LastPass Authenticator\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -3100,7 +3153,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add policy", @@ -3110,6 +3163,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add policy\",\"Data\":\"Require passwordless verification via LastPass Authenticator New value: 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -3158,13 +3212,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reporting", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Reporting\",\"Data\":\"Initiated by API\"}", "outcome": "unknown", + "timezone": "US/Eastern", "type": [ "info" ] @@ -3213,13 +3268,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "get user data", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Get user data\",\"Data\":\"Initiated by API\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -3268,13 +3324,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "get shared folder data", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Get shared folder data\",\"Data\":\"Initiated by API\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -3323,7 +3380,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log in", @@ -3333,8 +3390,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Log in\",\"Data\":\"lastpass.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3382,7 +3440,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "failed login attempt", @@ -3392,8 +3450,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Failed login attempt\",\"Data\":\"lastpass.com\"}", "outcome": "failure", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3441,7 +3500,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log in", @@ -3451,8 +3510,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Log in\",\"Data\":\"1.1.1.1:1234/example\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3500,7 +3560,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login to admin console", @@ -3510,8 +3570,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login to admin console\",\"Data\":\"user1@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3561,7 +3622,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee account created", @@ -3571,6 +3632,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee account created\",\"Data\":\"user2@example.com,user3@example.com,user4@example.com,user5@example.com,user6@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -3636,13 +3698,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee invited", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee invited\",\"Data\":\"user2@example.com,user3@example.com,user4@example.com,user5@example.com,user6@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "info" ] @@ -3708,7 +3771,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "make admin", @@ -3718,6 +3781,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Make admin\",\"Data\":\"user4@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "admin" ] @@ -3769,7 +3833,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login to admin console", @@ -3779,8 +3843,9 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Login to admin console\",\"Data\":\"user1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -3827,7 +3892,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "make admin", @@ -3837,6 +3902,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Make admin\",\"Data\":\"user4\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "admin" ] @@ -3885,13 +3951,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site added", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Site added\",\"Data\":\"example.com/ServiceLogin\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -3941,13 +4008,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted sites\",\"Data\":\"example.com/ServiceLogin\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -3999,13 +4067,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "site added", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Site added\",\"Data\":\"example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -4055,13 +4124,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted sites\",\"Data\":\"example1.com,example2.com,example3.com,example4.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -4116,13 +4186,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Created shared folder\",\"Data\":\"temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -4172,13 +4243,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Deleted shared folder\",\"Data\":\"temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -4228,13 +4300,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add secure note\",\"Data\":\"Secure Note (Address) from temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -4285,15 +4358,16 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Open secure note\",\"Data\":\"Secure Note (Address)\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -4341,15 +4415,16 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "open secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Open secure note\",\"Data\":\"Secure Note (Address) from temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ - "access" + "start" ] }, "lastpass": { @@ -4398,13 +4473,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Add to shared folder\",\"Data\":\"'temp-1' 'user1@example.com'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -4457,7 +4533,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create group", @@ -4467,6 +4543,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Create group\",\"Data\":\"'temp-group'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "group", "creation" @@ -4520,7 +4597,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "adding user to group", @@ -4530,6 +4607,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Adding user to group\",\"Data\":\"user1@example.com - temp-group\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "group", "creation" @@ -4586,7 +4664,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created lastpass account", @@ -4596,6 +4674,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Created LastPass account\",\"Data\":\"user1@example.com-Shared-temp-1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "creation" ] @@ -4648,13 +4727,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update folder permissions", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Update folder permissions\",\"Data\":\"'temp-1' 'user1@example.com' 'Read only:no Admin:no Hide PW:no'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -4712,7 +4792,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "master password reset by super admin", @@ -4722,6 +4802,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Master password reset by super admin\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -4773,7 +4854,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "employee account deleted", @@ -4783,6 +4864,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Employee account deleted\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -4836,7 +4918,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "require password change", @@ -4846,6 +4928,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Require password change\",\"Data\":\"user3@example.com\"}", "outcome": "unknown", + "timezone": "US/Eastern", "type": [ "info" ] @@ -4897,7 +4980,7 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove admin", @@ -4907,6 +4990,7 @@ "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Remove admin\",\"Data\":\"user3@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -4958,13 +5042,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "edit secure note", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Edit secure note\",\"Data\":\"Secure Note (Wifi renamed)\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5014,13 +5099,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "renamed shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Renamed shared folder\",\"Data\":\"'test1' 'test2'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5071,13 +5157,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move to shared folder\",\"Data\":\"example.com to Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5128,13 +5215,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move to shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move to shared folder\",\"Data\":\" to Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5184,13 +5272,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from shared folder\",\"Data\":\"example.com from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5241,13 +5330,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from shared folder\",\"Data\":\" from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5297,13 +5387,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "limit shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Limit shared folder\",\"Data\":\"shared folder test@example.com\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] @@ -5354,13 +5445,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Removed from shared folder\",\"Data\":\"'test1' 'test@example.com'\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -5411,13 +5503,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete shared sites", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Delete shared sites\",\"Data\":\"example.com from Shared Folder 1\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "deletion" ] @@ -5468,13 +5561,14 @@ { "@timestamp": "2015-07-17T09:51:51.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "move from shared folder", "kind": "event", "original": "{\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"test@example.com\",\"IP_Address\":\"67.43.156.0\",\"Action\":\"Move from shared folder\",\"Data\":\" from INVALID SHARED FOLDER\"}", "outcome": "success", + "timezone": "US/Eastern", "type": [ "change" ] diff --git a/packages/lastpass/data_stream/event_report/_dev/test/system/test-default-config.yml b/packages/lastpass/data_stream/event_report/_dev/test/system/test-default-config.yml index 233a74f860e..0cd7d3643a8 100644 --- a/packages/lastpass/data_stream/event_report/_dev/test/system/test-default-config.yml +++ b/packages/lastpass/data_stream/event_report/_dev/test/system/test-default-config.yml @@ -7,5 +7,6 @@ vars: enable_request_tracer: true data_stream: vars: + tz_offset: UTC preserve_original_event: true preserve_duplicate_custom_fields: true diff --git a/packages/lastpass/data_stream/event_report/agent/stream/httpjson.yml.hbs b/packages/lastpass/data_stream/event_report/agent/stream/httpjson.yml.hbs index c3dfb848410..9406289b9da 100644 --- a/packages/lastpass/data_stream/event_report/agent/stream/httpjson.yml.hbs +++ b/packages/lastpass/data_stream/event_report/agent/stream/httpjson.yml.hbs @@ -71,3 +71,9 @@ publisher_pipeline.disable_host: true processors: {{processors}} {{/if}} +fields_under_root: true +fields: + _conf: +{{#if tz_offset}} + tz_offset: "{{tz_offset}}" +{{/if}} diff --git a/packages/lastpass/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml b/packages/lastpass/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml index 830edc04153..ec16db84713 100644 --- a/packages/lastpass/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml +++ b/packages/lastpass/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Event Report logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -49,7 +49,7 @@ processors: - set: field: event.type if: ctx.event?.action?.contains('log in') || ctx.event?.action?.contains('login to admin console') || ctx.event?.action?.contains('saml login') || ctx.event?.action?.contains('open secure note') || ctx.event?.action?.contains('failed login attempt') - value: [access] + value: [start] - set: field: event.type if: ctx.event?.action?.contains('make admin') @@ -86,11 +86,22 @@ processors: field: event.outcome if: ctx.event?.action?.contains('require password change') || ctx.event?.action?.contains('reporting') value: unknown + # Set timezone based on config or locale. Defaults to US/Eastern due to + # https://support.lastpass.com/s/document-item?language=en_US&bundleId=lastpass&topicId=LastPass/api_event_reporting.html&_LANG=enus. + - rename: + field: _conf.tz_offset + target_field: event.timezone + if: ctx._conf?.tz_offset != null + ignore_failure: true + - set: + field: event.timezone + value: US/Eastern + override: false - date: field: json.Time - if: ctx.json?.Time != null && ctx.json.Time != '' + if: ctx.json?.Time != null && ctx.json.Time != '' && ctx.event?.timezone != null target_field: lastpass.event_report.time - timezone: "US/Eastern" + timezone: '{{{event.timezone}}}' formats: - ISO8601 - yyyy-MM-dd HH:mm:ss diff --git a/packages/lastpass/data_stream/event_report/manifest.yml b/packages/lastpass/data_stream/event_report/manifest.yml index 9a2b2122ad6..8d43afa06d6 100644 --- a/packages/lastpass/data_stream/event_report/manifest.yml +++ b/packages/lastpass/data_stream/event_report/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the event report from LastPass. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the event report from LastPass. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the LastPass API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the LastPass API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false @@ -39,6 +39,14 @@ streams: default: - forwarded - lastpass-event_report + - name: tz_offset + type: text + title: Timezone + multi: false + required: false + show_user: false + default: US/Eastern + description: IANA time zone or time offset (e.g. `America/Denver` or `-06:00`) to use when LastPass timestamps without a time zone. - name: preserve_original_event required: true show_user: true diff --git a/packages/lastpass/data_stream/event_report/sample_event.json b/packages/lastpass/data_stream/event_report/sample_event.json index 5b8d471df58..4bc77c2efe4 100644 --- a/packages/lastpass/data_stream/event_report/sample_event.json +++ b/packages/lastpass/data_stream/event_report/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2015-07-17T09:51:51.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "9ece9bbd-9d6c-4204-bd9f-3182e1a55f27", + "id": "02365282-f602-4b79-beec-adb210ac6467", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "data_stream": { "dataset": "lastpass.event_report", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "02365282-f602-4b79-beec-adb210ac6467", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "failed login attempt", @@ -26,14 +26,15 @@ "category": [ "authentication" ], - "created": "2023-01-13T12:25:45.230Z", + "created": "2023-08-14T22:51:42.186Z", "dataset": "lastpass.event_report", - "ingested": "2023-01-13T12:25:46Z", + "ingested": "2023-08-14T22:51:43Z", "kind": "event", "original": "{\"Action\":\"Failed Login Attempt\",\"Data\":\"\",\"IP_Address\":\"10.16.21.21\",\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"j.user@example.com\",\"id\":\"Event1\"}", "outcome": "failure", + "timezone": "UTC", "type": [ - "access" + "start" ] }, "input": { diff --git a/packages/lastpass/data_stream/user/_dev/test/pipeline/test-pipeline-user.log-expected.json b/packages/lastpass/data_stream/user/_dev/test/pipeline/test-pipeline-user.log-expected.json index fcb519fad5a..8170fc6738b 100644 --- a/packages/lastpass/data_stream/user/_dev/test/pipeline/test-pipeline-user.log-expected.json +++ b/packages/lastpass/data_stream/user/_dev/test/pipeline/test-pipeline-user.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/lastpass/data_stream/user/elasticsearch/ingest_pipeline/default.yml b/packages/lastpass/data_stream/user/elasticsearch/ingest_pipeline/default.yml index 60d294a79a4..fc805fe353c 100644 --- a/packages/lastpass/data_stream/user/elasticsearch/ingest_pipeline/default.yml +++ b/packages/lastpass/data_stream/user/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing User logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/lastpass/data_stream/user/manifest.yml b/packages/lastpass/data_stream/user/manifest.yml index 1b62503cb99..96d5a5b7362 100644 --- a/packages/lastpass/data_stream/user/manifest.yml +++ b/packages/lastpass/data_stream/user/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the LastPass API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the LastPass API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -17,7 +17,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/lastpass/data_stream/user/sample_event.json b/packages/lastpass/data_stream/user/sample_event.json index 950aa7a9e3b..51e0e8f4a19 100644 --- a/packages/lastpass/data_stream/user/sample_event.json +++ b/packages/lastpass/data_stream/user/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-01-13T12:26:19.400Z", + "@timestamp": "2023-07-24T13:40:43.764Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "7022fcec-d213-4320-8c7d-663b20b9d82c", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "lastpass.user", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": [ "iam" ], - "created": "2023-01-13T12:26:19.400Z", + "created": "2023-07-24T13:40:43.764Z", "dataset": "lastpass.user", - "ingested": "2023-01-13T12:26:20Z", + "ingested": "2023-07-24T13:40:46Z", "kind": "state", "original": "{\"admin\":false,\"applications\":0,\"attachments\":1,\"created\":\"2014-03-12 10:02:56\",\"disabled\":false,\"formfills\":2,\"fullname\":\"Ned Flanders\",\"groups\":[\"Domain Admins\",\"Dev Team\",\"Support Team\"],\"id\":\"101\",\"last_login\":\"2015-05-29 11:45:05\",\"last_pw_change\":\"2015-05-19 10:58:33\",\"linked\":\"personal.account@mydomain.com\",\"mpstrength\":\"100\",\"neverloggedin\":false,\"notes\":19,\"password_reset_required\":false,\"sites\":72,\"username\":\"user1@lastpass.com\"}", "type": [ diff --git a/packages/lastpass/docs/README.md b/packages/lastpass/docs/README.md index dcfa98228c9..9d476c87789 100644 --- a/packages/lastpass/docs/README.md +++ b/packages/lastpass/docs/README.md @@ -52,13 +52,13 @@ An example event for `detailed_shared_folder` looks as following: ```json { - "@timestamp": "2023-01-13T12:25:09.044Z", + "@timestamp": "2023-07-24T13:38:49.667Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "0c9df2f5-7a57-46b5-af86-d72509a29876", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "lastpass.detailed_shared_folder", @@ -66,18 +66,18 @@ An example event for `detailed_shared_folder` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "agent_id_status": "verified", - "created": "2023-01-13T12:25:09.044Z", + "created": "2023-07-24T13:38:49.667Z", "dataset": "lastpass.detailed_shared_folder", - "ingested": "2023-01-13T12:25:10Z", + "ingested": "2023-07-24T13:38:52Z", "kind": "state", "original": "{\"id\":\"101\",\"score\":99,\"sharedfoldername\":\"ThisSFName\",\"users\":{\"can_administer\":true,\"give\":false,\"readonly\":true,\"sites\":[\"aaa.com\",\"bbb.com\"],\"username\":\"joe.user@lastpass.com\"}}", "type": [ @@ -145,9 +145,9 @@ An example event for `detailed_shared_folder` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -197,11 +197,11 @@ An example event for `event_report` looks as following: { "@timestamp": "2015-07-17T09:51:51.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "9ece9bbd-9d6c-4204-bd9f-3182e1a55f27", + "id": "02365282-f602-4b79-beec-adb210ac6467", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.7.1" }, "data_stream": { "dataset": "lastpass.event_report", @@ -209,12 +209,12 @@ An example event for `event_report` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "02365282-f602-4b79-beec-adb210ac6467", + "snapshot": false, + "version": "8.7.1" }, "event": { "action": "failed login attempt", @@ -222,14 +222,15 @@ An example event for `event_report` looks as following: "category": [ "authentication" ], - "created": "2023-01-13T12:25:45.230Z", + "created": "2023-08-14T22:51:42.186Z", "dataset": "lastpass.event_report", - "ingested": "2023-01-13T12:25:46Z", + "ingested": "2023-08-14T22:51:43Z", "kind": "event", "original": "{\"Action\":\"Failed Login Attempt\",\"Data\":\"\",\"IP_Address\":\"10.16.21.21\",\"Time\":\"2015-07-17 09:51:51\",\"Username\":\"j.user@example.com\",\"id\":\"Event1\"}", "outcome": "failure", + "timezone": "UTC", "type": [ - "access" + "start" ] }, "input": { @@ -292,9 +293,9 @@ An example event for `event_report` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -358,13 +359,13 @@ An example event for `user` looks as following: ```json { - "@timestamp": "2023-01-13T12:26:19.400Z", + "@timestamp": "2023-07-24T13:40:43.764Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "7022fcec-d213-4320-8c7d-663b20b9d82c", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.8.2" }, "data_stream": { "dataset": "lastpass.user", @@ -372,21 +373,21 @@ An example event for `user` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", + "snapshot": false, + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": [ "iam" ], - "created": "2023-01-13T12:26:19.400Z", + "created": "2023-07-24T13:40:43.764Z", "dataset": "lastpass.user", - "ingested": "2023-01-13T12:26:20Z", + "ingested": "2023-07-24T13:40:46Z", "kind": "state", "original": "{\"admin\":false,\"applications\":0,\"attachments\":1,\"created\":\"2014-03-12 10:02:56\",\"disabled\":false,\"formfills\":2,\"fullname\":\"Ned Flanders\",\"groups\":[\"Domain Admins\",\"Dev Team\",\"Support Team\"],\"id\":\"101\",\"last_login\":\"2015-05-29 11:45:05\",\"last_pw_change\":\"2015-05-19 10:58:33\",\"linked\":\"personal.account@mydomain.com\",\"mpstrength\":\"100\",\"neverloggedin\":false,\"notes\":19,\"password_reset_required\":false,\"sites\":72,\"username\":\"user1@lastpass.com\"}", "type": [ @@ -471,9 +472,9 @@ An example event for `user` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/lastpass/kibana/tags.yml b/packages/lastpass/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/lastpass/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/lastpass/manifest.yml b/packages/lastpass/manifest.yml index c1d59365248..ab8a59470bb 100644 --- a/packages/lastpass/manifest.yml +++ b/packages/lastpass/manifest.yml @@ -1,17 +1,17 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: lastpass title: LastPass -version: "1.4.0" -release: ga -license: basic +version: "1.10.0" description: Collect logs from LastPass with Elastic Agent. type: integration categories: - security - credential_management conditions: - kibana.version: ^8.7.1 - elastic.subscription: basic + kibana: + version: ^8.7.1 + elastic: + subscription: basic screenshots: - src: /img/lastpass-dashboard-screenshot.png title: LastPass Detailed Shared Folder Dashboard Screenshot @@ -94,3 +94,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/log/agent/input/input.yml.hbs b/packages/log/agent/input/input.yml.hbs index fcf34e24ab1..0261a1cb901 100644 --- a/packages/log/agent/input/input.yml.hbs +++ b/packages/log/agent/input/input.yml.hbs @@ -3,6 +3,9 @@ paths: - {{this}} {{/each}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} data_stream: dataset: {{data_stream.dataset}} {{#if processors.length}} diff --git a/packages/log/changelog.yml b/packages/log/changelog.yml index 6426bf54d10..755eec84be3 100644 --- a/packages/log/changelog.yml +++ b/packages/log/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.2.0" + changes: + - description: Expose ignore_older option + type: enhancement + link: https://github.com/elastic/integrations/pull/7615 - version: "2.1.0" changes: - description: Add mapping for message field diff --git a/packages/log/manifest.yml b/packages/log/manifest.yml index d400053b858..75135016882 100644 --- a/packages/log/manifest.yml +++ b/packages/log/manifest.yml @@ -4,7 +4,7 @@ title: Custom Logs description: >- Collect custom logs with Elastic Agent. type: input -version: 2.1.0 +version: 2.2.0 categories: - custom - custom_logs @@ -24,6 +24,14 @@ policy_templates: description: Path to log files to be collected type: text multi: true + - name: ignore_older + type: text + title: Ignore events older than + default: 72h + required: false + show_user: false + description: >- + If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". - name: data_stream.dataset required: true title: Dataset name diff --git a/packages/logstash/changelog.yml b/packages/logstash/changelog.yml index b2bc26f330d..804193ab395 100644 --- a/packages/logstash/changelog.yml +++ b/packages/logstash/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "2.3.3" + changes: + - description: Introduce Logstash node dashboards into integration package + type: enhancement + link: https://github.com/elastic/integrations/pull/7704 - version: "2.3.2" changes: - description: Add missing event fields field mapping diff --git a/packages/logstash/kibana/dashboard/logstash-79270240-48ee-11ee-8cb5-99927777c522.json b/packages/logstash/kibana/dashboard/logstash-79270240-48ee-11ee-8cb5-99927777c522.json new file mode 100644 index 00000000000..fa2e4d23198 --- /dev/null +++ b/packages/logstash/kibana/dashboard/logstash-79270240-48ee-11ee-8cb5-99927777c522.json @@ -0,0 +1,1120 @@ +{ + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": true, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation** \n\n**Logstash Overview**\n\n**[Overview](/app/dashboards#/view/logstash-79270240-48ee-11ee-8cb5-99927777c522)** \n[Nodes Overview](/app/dashboards#/view/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a) \n[Node Overview](/app/dashboards#/view/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d) \n[Node Overview Advanced View](/app/dashboards#/view/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5) \n\nOverview\n\nThis Dashboard gives an overall view of Logstash", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 24, + "i": "67c48168-cf30-4dcb-a96e-8e0a38e6049d", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "67c48168-cf30-4dcb-a96e-8e0a38e6049d", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3eb7cb2b-67b2-4fc7-b311-9106826dbbfc": { + "columnOrder": [ + "a45f2761-e598-4ec1-8dff-95b395d0dd1e" + ], + "columns": { + "a45f2761-e598-4ec1-8dff-95b395d0dd1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": " ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "a45f2761-e598-4ec1-8dff-95b395d0dd1e", + "layerId": "3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "layerType": "data" + } + }, + "title": "Nodes", + "type": "lens", + "visualizationType": "lnsLegacyMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "e7bf7bee-710a-456a-995c-a570ee24cc05", + "w": 10, + "x": 8, + "y": 0 + }, + "panelIndex": "e7bf7bee-710a-456a-995c-a570ee24cc05", + "title": "Nodes", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d944a0ae-9030-413e-afd6-c4a57ff34ad0": { + "columnOrder": [ + "b1f83d95-ed15-4e15-8e1e-b912424a35b2", + "a98fb979-a039-4322-871f-1d32480fd158" + ], + "columns": { + "a98fb979-a039-4322-871f-1d32480fd158": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.jvm.mem.heap_used_in_bytes: *" + }, + "isBucketed": false, + "label": "Heap Used", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.mem.heap_used_in_bytes" + }, + "b1f83d95-ed15-4e15-8e1e-b912424a35b2": { + "dataType": "string", + "isBucketed": true, + "label": "Top 1000 values of logstash.node.stats.logstash.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a98fb979-a039-4322-871f-1d32480fd158", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "b1f83d95-ed15-4e15-8e1e-b912424a35b2", + "collapseFn": "sum", + "layerId": "d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "layerType": "data", + "metricAccessor": "a98fb979-a039-4322-871f-1d32480fd158", + "showBar": false + } + }, + "title": "Total JVM Heap Usage", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "e4763613-7bc1-417e-8173-802c6342173b", + "w": 10, + "x": 18, + "y": 0 + }, + "panelIndex": "e4763613-7bc1-417e-8173-802c6342173b", + "title": "Total JVM Heap Usage", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bfb76152-1d30-4689-87e3-cf3b5803fdbf": { + "columnOrder": [ + "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "9329ee1e-ade0-412e-86f4-9e901db45ab2" + ], + "columns": { + "8ab113dc-30a3-4109-9b26-9e436fcb4291": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Total Events Received", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9329ee1e-ade0-412e-86f4-9e901db45ab2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "9329ee1e-ade0-412e-86f4-9e901db45ab2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "collapseFn": "sum", + "layerId": "bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "layerType": "data", + "maxCols": 1000, + "metricAccessor": "9329ee1e-ade0-412e-86f4-9e901db45ab2" + } + }, + "title": "Total Events Received", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "eed5915d-7416-4c4d-94a1-c3564e7371b6", + "w": 10, + "x": 28, + "y": 0 + }, + "panelIndex": "eed5915d-7416-4c4d-94a1-c3564e7371b6", + "title": "Total Events Received", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425": { + "columnOrder": [ + "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "0c423bdf-578e-4f0a-bb27-180a24a133e1", + "cd7a8cba-084f-42b4-a4b5-334eee79e32e" + ], + "columns": { + "0c423bdf-578e-4f0a-bb27-180a24a133e1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in : *" + }, + "isBucketed": false, + "label": "Events Emitted Rate", + "operationType": "counter_rate", + "references": [ + "cd7a8cba-084f-42b4-a4b5-334eee79e32e" + ], + "scale": "ratio", + "timeScale": "s" + }, + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cd7a8cba-084f-42b4-a4b5-334eee79e32e": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of logstash.node.stats.events.out", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "ef4e5445-487e-4a0c-ac01-063e8c199a84": { + "dataType": "string", + "isBucketed": true, + "label": "Top 1000 values of logstash.node.stats.logstash.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "hideEndzones": true, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1" + ], + "collapseFn": "sum", + "layerId": "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "xAccessor": "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "0c423bdf-578e-4f0a-bb27-180a24a133e1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "a66223a5-9fdb-4335-8012-4ae2748928ac", + "w": 20, + "x": 8, + "y": 4 + }, + "panelIndex": "a66223a5-9fdb-4335-8012-4ae2748928ac", + "title": "Events Emitted Rate/s", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bfb76152-1d30-4689-87e3-cf3b5803fdbf": { + "columnOrder": [ + "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "9329ee1e-ade0-412e-86f4-9e901db45ab2" + ], + "columns": { + "8ab113dc-30a3-4109-9b26-9e436fcb4291": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Total Events Received", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9329ee1e-ade0-412e-86f4-9e901db45ab2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "9329ee1e-ade0-412e-86f4-9e901db45ab2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Events Emitted", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "collapseFn": "sum", + "layerId": "bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "layerType": "data", + "maxCols": 1000, + "metricAccessor": "9329ee1e-ade0-412e-86f4-9e901db45ab2" + } + }, + "title": "Total Events Emitted", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "d7c45290-1873-4a8d-9c12-4d009925d447", + "w": 10, + "x": 38, + "y": 0 + }, + "panelIndex": "d7c45290-1873-4a8d-9c12-4d009925d447", + "title": "Total Events Emitted", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425": { + "columnOrder": [ + "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "0c423bdf-578e-4f0a-bb27-180a24a133e1", + "cd7a8cba-084f-42b4-a4b5-334eee79e32e" + ], + "columns": { + "0c423bdf-578e-4f0a-bb27-180a24a133e1": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in : *" + }, + "isBucketed": false, + "label": "Events Received Rate", + "operationType": "counter_rate", + "references": [ + "cd7a8cba-084f-42b4-a4b5-334eee79e32e" + ], + "scale": "ratio", + "timeScale": "s" + }, + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cd7a8cba-084f-42b4-a4b5-334eee79e32e": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of logstash.node.stats.events.in", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + }, + "ef4e5445-487e-4a0c-ac01-063e8c199a84": { + "dataType": "string", + "isBucketed": true, + "label": "Top 1000 values of logstash.node.stats.logstash.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "hideEndzones": true, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1" + ], + "collapseFn": "sum", + "layerId": "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "xAccessor": "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "0c423bdf-578e-4f0a-bb27-180a24a133e1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "3df9851c-7ac3-4bed-ade1-7e3ee0509971", + "w": 20, + "x": 28, + "y": 4 + }, + "panelIndex": "3df9851c-7ac3-4bed-ade1-7e3ee0509971", + "title": "Events Received Rate/s", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425": { + "columnOrder": [ + "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "0c423bdf-578e-4f0a-bb27-180a24a133e1", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X0", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X1", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X2", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X3", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X4" + ], + "columns": { + "0c423bdf-578e-4f0a-bb27-180a24a133e1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event Latency (ms)", + "operationType": "formula", + "params": { + "formula": "counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "isFormulaBroken": false + }, + "references": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1X4" + ], + "scale": "ratio" + }, + "0c423bdf-578e-4f0a-bb27-180a24a133e1X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.duration_in_millis: *" + }, + "isBucketed": false, + "label": "Part of Event Latency (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.duration_in_millis" + }, + "0c423bdf-578e-4f0a-bb27-180a24a133e1X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Event Latency (ms)", + "operationType": "counter_rate", + "references": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1X0" + ], + "scale": "ratio", + "timeScale": "s" + }, + "0c423bdf-578e-4f0a-bb27-180a24a133e1X2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Part of Event Latency (ms)", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "0c423bdf-578e-4f0a-bb27-180a24a133e1X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Event Latency (ms)", + "operationType": "counter_rate", + "references": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1X2" + ], + "scale": "ratio", + "timeScale": "s" + }, + "0c423bdf-578e-4f0a-bb27-180a24a133e1X4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Event Latency (ms)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1X1", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X3" + ], + "location": { + "max": 128, + "min": 0 + }, + "name": "divide", + "text": "counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "type": "function" + } + }, + "references": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1X1", + "0c423bdf-578e-4f0a-bb27-180a24a133e1X3" + ], + "scale": "ratio" + }, + "43c45a77-5bb2-4f66-8bfd-77f3cf386a87": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ef4e5445-487e-4a0c-ac01-063e8c199a84": { + "dataType": "string", + "isBucketed": true, + "label": "Top 1000 values of logstash.node.stats.logstash.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "hideEndzones": true, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0c423bdf-578e-4f0a-bb27-180a24a133e1" + ], + "collapseFn": "avg", + "layerId": "9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "ef4e5445-487e-4a0c-ac01-063e8c199a84", + "xAccessor": "43c45a77-5bb2-4f66-8bfd-77f3cf386a87", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "0c423bdf-578e-4f0a-bb27-180a24a133e1" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "272e809f-0867-4ef2-aef3-626e954008c9", + "w": 20, + "x": 8, + "y": 14 + }, + "panelIndex": "272e809f-0867-4ef2-aef3-626e954008c9", + "title": "Events Latency (ms) average", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Metrics Logstash] Logstash Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-08T17:27:49.263Z", + "id": "logstash-79270240-48ee-11ee-8cb5-99927777c522", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logstash-sm-metrics", + "name": "e7bf7bee-710a-456a-995c-a570ee24cc05:indexpattern-datasource-layer-3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "e4763613-7bc1-417e-8173-802c6342173b:indexpattern-datasource-layer-d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "eed5915d-7416-4c4d-94a1-c3564e7371b6:indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "a66223a5-9fdb-4335-8012-4ae2748928ac:indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "d7c45290-1873-4a8d-9c12-4d009925d447:indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "3df9851c-7ac3-4bed-ade1-7e3ee0509971:indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "272e809f-0867-4ef2-aef3-626e954008c9:indexpattern-datasource-layer-9f4942e8-bd51-41fe-9e6b-c6ca7ee81425", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/logstash/kibana/dashboard/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d.json b/packages/logstash/kibana/dashboard/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d.json new file mode 100644 index 00000000000..86edfd102f5 --- /dev/null +++ b/packages/logstash/kibana/dashboard/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d.json @@ -0,0 +1,1402 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"f8b74dd1-8785-4fff-96ba-8d8cfb7615eb\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"f8b74dd1-8785-4fff-96ba-8d8cfb7615eb\",\"fieldName\":\"logstash.node.stats.logstash.name\",\"title\":\"Node Name\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": true, + "syncCursor": true, + "syncTooltips": true, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation** \n\n**Logstash Overview**\n\n[Overview](/app/dashboards#/view/logstash-79270240-48ee-11ee-8cb5-99927777c522) \n[Nodes Overview](/app/dashboards#/view/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a) \n**[Node Overview](/app/dashboards#/view/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d)** \n[Node Overview Advanced View](/app/dashboards#/view/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5) \n\nOverview\n\nThis Dashboard gives a view of the overall performance of a single Logstash Node. Should be used in conjunction with the node name\nfilter", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 31, + "i": "c2c433cf-50ce-4530-86e5-f82a240c57b8", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "c2c433cf-50ce-4530-86e5-f82a240c57b8", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-f589d4f8-9213-4405-a5cd-72e93d3e2594", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f589d4f8-9213-4405-a5cd-72e93d3e2594": { + "columnOrder": [ + "8839c86b-b108-4e3c-a54e-b0faf3e6dce3", + "02fa92fd-de65-435a-8545-33f4c95a2f87", + "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "054188a5-6571-42d8-864b-ef6797529e7a", + "3251a279-5a0c-4c21-af6c-bc6a03c01922", + "a51eda03-44a2-4173-be51-72948417a027", + "aeeea8f3-b17f-450f-84cd-349f2f5ad06f", + "bcffd9c0-96d0-4618-8842-c7477eb3847f", + "aedf8459-e9a5-4bfa-ac5a-18226112a6b7", + "0c44a76d-c3f5-40c3-b226-9898f1fd300f" + ], + "columns": { + "02fa92fd-de65-435a-8545-33f4c95a2f87": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.http_address: *" + }, + "isBucketed": false, + "label": "HTTP Address", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.http_address" + }, + "054188a5-6571-42d8-864b-ef6797529e7a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Events Emitted", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "0c44a76d-c3f5-40c3-b226-9898f1fd300f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Uptime", + "operationType": "median", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "ms" + } + } + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.uptime_in_millis" + }, + "3251a279-5a0c-4c21-af6c-bc6a03c01922": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.reloads.successes: *" + }, + "isBucketed": false, + "label": "Successful Config Reloads", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.successes" + }, + "8839c86b-b108-4e3c-a54e-b0faf3e6dce3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "a51eda03-44a2-4173-be51-72948417a027": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Failed Config Reloads", + "operationType": "median", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.failures" + }, + "aedf8459-e9a5-4bfa-ac5a-18226112a6b7": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.version: *" + }, + "isBucketed": false, + "label": "Version", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.version" + }, + "aeeea8f3-b17f-450f-84cd-349f2f5ad06f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.pipeline.workers: *" + }, + "isBucketed": false, + "label": "Default Pipeline Workers", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.pipeline.workers" + }, + "bcffd9c0-96d0-4618-8842-c7477eb3847f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Default Batch size", + "operationType": "median", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.pipeline.batch_size" + }, + "de46c77f-b93a-4aa6-88e3-5e3de6ac0334": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "8839c86b-b108-4e3c-a54e-b0faf3e6dce3", + "hidden": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "054188a5-6571-42d8-864b-ef6797529e7a", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "3251a279-5a0c-4c21-af6c-bc6a03c01922", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "a51eda03-44a2-4173-be51-72948417a027", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "aeeea8f3-b17f-450f-84cd-349f2f5ad06f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "bcffd9c0-96d0-4618-8842-c7477eb3847f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "aedf8459-e9a5-4bfa-ac5a-18226112a6b7", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "0c44a76d-c3f5-40c3-b226-9898f1fd300f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "02fa92fd-de65-435a-8545-33f4c95a2f87", + "isTransposed": false + } + ], + "layerId": "f589d4f8-9213-4405-a5cd-72e93d3e2594", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 4, + "i": "73a755c6-89a3-4f34-8daf-83feef5caa28", + "w": 40, + "x": 8, + "y": 0 + }, + "panelIndex": "73a755c6-89a3-4f34-8daf-83feef5caa28", + "title": "", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "336e8749-bfb1-4c0e-9f41-3892faebc198": { + "columnOrder": [ + "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b", + "9bc6c618-774d-4a65-afe5-64b00183a632" + ], + "columns": { + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received Rate/s", + "operationType": "counter_rate", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "references": [ + "9bc6c618-774d-4a65-afe5-64b00183a632" + ], + "scale": "ratio", + "timeScale": "s" + }, + "51d651dd-246b-40fc-aca2-f9e3cb50e23f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9bc6c618-774d-4a65-afe5-64b00183a632": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of logstash.node.stats.events.in", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + ], + "layerId": "336e8749-bfb1-4c0e-9f41-3892faebc198", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "63747092-edb6-4864-a9ad-27e5bdce2ad2", + "w": 20, + "x": 8, + "y": 4 + }, + "panelIndex": "63747092-edb6-4864-a9ad-27e5bdce2ad2", + "title": "Events Received Rate (/s)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0", + "27453153-fb68-4abc-a6f3-c4cfac27d66d" + ], + "columns": { + "27453153-fb68-4abc-a6f3-c4cfac27d66d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash_stats.jvm.mem.heap_used_in_bytes: *" + }, + "isBucketed": false, + "label": "JVM Heap (MB)", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash_stats.jvm.mem.heap_used_in_bytes" + }, + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.jvm.mem.heap_max_in_bytes: *" + }, + "isBucketed": false, + "label": "Max Heap", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.mem.heap_max_in_bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0", + "27453153-fb68-4abc-a6f3-c4cfac27d66d" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#255b98", + "forAccessor": "27453153-fb68-4abc-a6f3-c4cfac27d66d" + }, + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "9ea7a32a-ee7e-45d4-b0cf-273278e52cae", + "w": 20, + "x": 28, + "y": 4 + }, + "panelIndex": "9ea7a32a-ee7e-45d4-b0cf-273278e52cae", + "title": "JVM Heap (MB)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "336e8749-bfb1-4c0e-9f41-3892faebc198": { + "columnOrder": [ + "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b", + "9bc6c618-774d-4a65-afe5-64b00183a632" + ], + "columns": { + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Emitted Rate/s", + "operationType": "counter_rate", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "references": [ + "9bc6c618-774d-4a65-afe5-64b00183a632" + ], + "scale": "ratio", + "timeScale": "s" + }, + "51d651dd-246b-40fc-aca2-f9e3cb50e23f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9bc6c618-774d-4a65-afe5-64b00183a632": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of logstash.node.stats.events.out", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + ], + "layerId": "336e8749-bfb1-4c0e-9f41-3892faebc198", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "bac81244-9c35-4cf9-8ed4-3c7082a255ae", + "w": 20, + "x": 8, + "y": 13 + }, + "panelIndex": "bac81244-9c35-4cf9-8ed4-3c7082a255ae", + "title": "Events Emitted Rate (/s)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.process.cpu.percent: *" + }, + "isBucketed": false, + "label": "CPU Utilization (%)", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.process.cpu.percent" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "5a43f153-bec9-4420-96f8-0c2d4b032a43", + "w": 20, + "x": 28, + "y": 13 + }, + "panelIndex": "5a43f153-bec9-4420-96f8-0c2d4b032a43", + "title": "Process CPU Utilization (%)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "336e8749-bfb1-4c0e-9f41-3892faebc198": { + "columnOrder": [ + "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX0", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX1", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX2", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX3", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX4" + ], + "columns": { + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event Latency (ms)", + "operationType": "formula", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2, + "suffix": "ms" + } + }, + "formula": "counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "isFormulaBroken": false + }, + "references": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX4" + ], + "scale": "ratio" + }, + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.duration_in_millis: *" + }, + "isBucketed": false, + "label": "Part of counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.duration_in_millis" + }, + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "operationType": "counter_rate", + "references": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX0" + ], + "scale": "ratio", + "timeScale": "s" + }, + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Part of counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "operationType": "counter_rate", + "references": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX2" + ], + "scale": "ratio", + "timeScale": "s" + }, + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX1", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX3" + ], + "location": { + "max": 128, + "min": 0 + }, + "name": "divide", + "text": "counter_rate(last_value(logstash.node.stats.events.duration_in_millis))/counter_rate(last_value(logstash.node.stats.events.out))", + "type": "function" + } + }, + "references": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX1", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5bX3" + ], + "scale": "ratio" + }, + "51d651dd-246b-40fc-aca2-f9e3cb50e23f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + ], + "layerId": "336e8749-bfb1-4c0e-9f41-3892faebc198", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d", + "w": 20, + "x": 8, + "y": 22 + }, + "panelIndex": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d", + "title": "Events Latency (ms)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cpu.load_average.1m: *" + }, + "isBucketed": false, + "label": "Load Average", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cpu.load_average.1m" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1", + "w": 20, + "x": 28, + "y": 22 + }, + "panelIndex": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1", + "title": "System Load", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Metrics Logstash] Single Node Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-08T17:43:03.843Z", + "id": "logstash-9d450b10-4680-11ee-9ddc-919f87fe352d", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logstash-sm-metrics", + "name": "73a755c6-89a3-4f34-8daf-83feef5caa28:indexpattern-datasource-layer-f589d4f8-9213-4405-a5cd-72e93d3e2594", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "63747092-edb6-4864-a9ad-27e5bdce2ad2:indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "9ea7a32a-ee7e-45d4-b0cf-273278e52cae:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "bac81244-9c35-4cf9-8ed4-3c7082a255ae:indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "5a43f153-bec9-4420-96f8-0c2d4b032a43:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d:indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "controlGroup_f8b74dd1-8785-4fff-96ba-8d8cfb7615eb:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/logstash/kibana/dashboard/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5.json b/packages/logstash/kibana/dashboard/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5.json new file mode 100644 index 00000000000..9b0f6b91bba --- /dev/null +++ b/packages/logstash/kibana/dashboard/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5.json @@ -0,0 +1,1335 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"4b095518-7dc3-4d0e-a323-5d7846f65bff\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"4b095518-7dc3-4d0e-a323-5d7846f65bff\",\"fieldName\":\"logstash.node.stats.logstash.name\",\"title\":\"Node Name\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": true, + "syncCursor": true, + "syncTooltips": true, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation** \n\n**Logstash Overview**\n\n[Overview](/app/dashboards#/view/logstash-79270240-48ee-11ee-8cb5-99927777c522) \n[Nodes Overview](/app/dashboards#/view/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a) \n[Node Overview](/app/dashboards#/view/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d) \n**[Node Overview Advanced View](/app/dashboards#/view/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5)** \n\nOverview\n\nThis Dashboard gives an advanced view of the overall performance of a single Logstash Node. Should be used in conjunction with the node name\nfilter", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 34, + "i": "231de1ff-a22e-495c-9c97-20b20592ac46", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "231de1ff-a22e-495c-9c97-20b20592ac46", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-f589d4f8-9213-4405-a5cd-72e93d3e2594", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f589d4f8-9213-4405-a5cd-72e93d3e2594": { + "columnOrder": [ + "8839c86b-b108-4e3c-a54e-b0faf3e6dce3", + "02fa92fd-de65-435a-8545-33f4c95a2f87", + "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "054188a5-6571-42d8-864b-ef6797529e7a", + "3251a279-5a0c-4c21-af6c-bc6a03c01922", + "a51eda03-44a2-4173-be51-72948417a027", + "aeeea8f3-b17f-450f-84cd-349f2f5ad06f", + "bcffd9c0-96d0-4618-8842-c7477eb3847f", + "aedf8459-e9a5-4bfa-ac5a-18226112a6b7", + "0c44a76d-c3f5-40c3-b226-9898f1fd300f" + ], + "columns": { + "02fa92fd-de65-435a-8545-33f4c95a2f87": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.http_address: *" + }, + "isBucketed": false, + "label": "HTTP Address", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.http_address" + }, + "054188a5-6571-42d8-864b-ef6797529e7a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Events Emitted", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "0c44a76d-c3f5-40c3-b226-9898f1fd300f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Uptime", + "operationType": "median", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "ms" + } + } + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.uptime_in_millis" + }, + "3251a279-5a0c-4c21-af6c-bc6a03c01922": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.reloads.successes: *" + }, + "isBucketed": false, + "label": "Successful Config Reloads", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.successes" + }, + "8839c86b-b108-4e3c-a54e-b0faf3e6dce3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "a51eda03-44a2-4173-be51-72948417a027": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Failed Config Reloads", + "operationType": "median", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.failures" + }, + "aedf8459-e9a5-4bfa-ac5a-18226112a6b7": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.version: *" + }, + "isBucketed": false, + "label": "Version", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.version" + }, + "aeeea8f3-b17f-450f-84cd-349f2f5ad06f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.pipeline.workers: *" + }, + "isBucketed": false, + "label": "Default Pipeline Workers", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.pipeline.workers" + }, + "bcffd9c0-96d0-4618-8842-c7477eb3847f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Default Batch size", + "operationType": "median", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.pipeline.batch_size" + }, + "de46c77f-b93a-4aa6-88e3-5e3de6ac0334": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "8839c86b-b108-4e3c-a54e-b0faf3e6dce3", + "hidden": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "de46c77f-b93a-4aa6-88e3-5e3de6ac0334", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "054188a5-6571-42d8-864b-ef6797529e7a", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "3251a279-5a0c-4c21-af6c-bc6a03c01922", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "a51eda03-44a2-4173-be51-72948417a027", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "aeeea8f3-b17f-450f-84cd-349f2f5ad06f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "bcffd9c0-96d0-4618-8842-c7477eb3847f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "aedf8459-e9a5-4bfa-ac5a-18226112a6b7", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "0c44a76d-c3f5-40c3-b226-9898f1fd300f", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "02fa92fd-de65-435a-8545-33f4c95a2f87", + "isTransposed": false + } + ], + "layerId": "f589d4f8-9213-4405-a5cd-72e93d3e2594", + "layerType": "data" + } + }, + "title": "[Metrics Logstash] Node Summary Table", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "25758935-54d2-4161-a037-800740bee913", + "w": 40, + "x": 8, + "y": 0 + }, + "panelIndex": "25758935-54d2-4161-a037-800740bee913", + "title": "[Metrics Logstash] Node Summary Table", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cpu.percent: *" + }, + "isBucketed": false, + "label": "OS CPU Utilization (%)", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cpu.percent" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "5a43f153-bec9-4420-96f8-0c2d4b032a43", + "w": 20, + "x": 8, + "y": 4 + }, + "panelIndex": "5a43f153-bec9-4420-96f8-0c2d4b032a43", + "title": "OS CPU Utilization (%)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cpu.percent: *" + }, + "isBucketed": false, + "label": "OS CPU Utilization (%)", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cpu.percent" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "494716ff-128d-4a72-bf41-2f6f42dd5158", + "w": 20, + "x": 28, + "y": 4 + }, + "panelIndex": "494716ff-128d-4a72-bf41-2f6f42dd5158", + "title": "Process CPU Utilization (%)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "38a33c26-755e-4cf2-a5f2-739bf038af97", + "d2fb1c2f-f8d2-4b82-8d99-4aabfc642729" + ], + "columns": { + "38a33c26-755e-4cf2-a5f2-739bf038af97": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.process.open_file_descriptors: *" + }, + "isBucketed": false, + "label": "File Descriptors in use", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.process.open_file_descriptors" + }, + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d2fb1c2f-f8d2-4b82-8d99-4aabfc642729": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.process.max_file_descriptors: *" + }, + "isBucketed": false, + "label": "Max File Descriptors", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.process.max_file_descriptors" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "38a33c26-755e-4cf2-a5f2-739bf038af97", + "d2fb1c2f-f8d2-4b82-8d99-4aabfc642729" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#3078c0", + "forAccessor": "38a33c26-755e-4cf2-a5f2-739bf038af97" + }, + { + "color": "#ff0000", + "forAccessor": "d2fb1c2f-f8d2-4b82-8d99-4aabfc642729" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "92979e91-3f35-4715-b97a-f088bb2eae51", + "w": 20, + "x": 8, + "y": 14 + }, + "panelIndex": "92979e91-3f35-4715-b97a-f088bb2eae51", + "title": "Number of File Descriptors", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "336e8749-bfb1-4c0e-9f41-3892faebc198": { + "columnOrder": [ + "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b", + "7c151831-4457-4cec-a257-0e2fe2453e5a" + ], + "columns": { + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events Queued", + "operationType": "counter_rate", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "" + } + } + }, + "references": [ + "7c151831-4457-4cec-a257-0e2fe2453e5a" + ], + "scale": "ratio" + }, + "51d651dd-246b-40fc-aca2-f9e3cb50e23f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7c151831-4457-4cec-a257-0e2fe2453e5a": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of logstash.node.stats.queue.events_count", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.queue.events_count" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + ], + "layerId": "336e8749-bfb1-4c0e-9f41-3892faebc198", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "51d651dd-246b-40fc-aca2-f9e3cb50e23f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "107f10cc-d65f-4a1a-9f54-ce90c48f4a5b" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "dataBounds" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d", + "w": 20, + "x": 28, + "y": 14 + }, + "panelIndex": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d", + "title": "Persistent Queue Events", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0", + "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4c49f25e-d518-4d91-bcdc-69ea91729ca3": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cgroup.cpu.stat.time_throttled_nanos: *" + }, + "isBucketed": false, + "label": "CGroup Throttling (ns)", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": "ns" + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cgroup.cpu.stat.time_throttled_nanos" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cgroup.cpuacct.usage_nanos: *" + }, + "isBucketed": false, + "label": "CGroup CPU Performance (ns)", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 1, + "suffix": "ns" + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cgroup.cpuacct.usage_nanos" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0", + "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + }, + { + "color": "#6092c0", + "forAccessor": "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1", + "w": 20, + "x": 8, + "y": 24 + }, + "panelIndex": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1", + "title": "CGroup Cpu Performance (ns)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c03b1610-b629-4e6c-ae2a-0e460cd446d2": { + "columnOrder": [ + "467daee5-8948-4576-80fc-12bb76b01c0f", + "8b34584c-a413-4629-898d-cda409db5fe0", + "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + ], + "columns": { + "467daee5-8948-4576-80fc-12bb76b01c0f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "4c49f25e-d518-4d91-bcdc-69ea91729ca3": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cgroup.cpu.stat.number_of_times_throttled: *" + }, + "isBucketed": false, + "label": "CGroup Throttled Count", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "" + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cgroup.cpu.stat.number_of_times_throttled" + }, + "8b34584c-a413-4629-898d-cda409db5fe0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cgroup.cpu.stat.number_of_elapsed_periods: *" + }, + "isBucketed": false, + "label": "CGroup Elapsed Periods", + "operationType": "last_value", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "" + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cgroup.cpu.stat.number_of_elapsed_periods" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8b34584c-a413-4629-898d-cda409db5fe0", + "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + ], + "layerId": "c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "467daee5-8948-4576-80fc-12bb76b01c0f", + "yConfig": [ + { + "color": "#ff0000", + "forAccessor": "8b34584c-a413-4629-898d-cda409db5fe0" + }, + { + "color": "#6092c0", + "forAccessor": "4c49f25e-d518-4d91-bcdc-69ea91729ca3" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "71538b79-3608-4191-b3eb-0f898b7d7a3b", + "w": 20, + "x": 28, + "y": 24 + }, + "panelIndex": "71538b79-3608-4191-b3eb-0f898b7d7a3b", + "title": "CGroup CFS Stats", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Metrics Logstash] Single Node Advanced View", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-08T17:42:20.019Z", + "id": "logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logstash-sm-metrics", + "name": "25758935-54d2-4161-a037-800740bee913:indexpattern-datasource-layer-f589d4f8-9213-4405-a5cd-72e93d3e2594", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "5a43f153-bec9-4420-96f8-0c2d4b032a43:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "494716ff-128d-4a72-bf41-2f6f42dd5158:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "92979e91-3f35-4715-b97a-f088bb2eae51:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "5af28ec8-a9f0-49cb-9627-e13c0ac5ca1d:indexpattern-datasource-layer-336e8749-bfb1-4c0e-9f41-3892faebc198", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "c6fb1dc0-c51d-4c00-903c-d90ad3b77ce1:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "71538b79-3608-4191-b3eb-0f898b7d7a3b:indexpattern-datasource-layer-c03b1610-b629-4e6c-ae2a-0e460cd446d2", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "controlGroup_4b095518-7dc3-4d0e-a323-5d7846f65bff:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/logstash/kibana/dashboard/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a.json b/packages/logstash/kibana/dashboard/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a.json new file mode 100644 index 00000000000..189a8f21cea --- /dev/null +++ b/packages/logstash/kibana/dashboard/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a.json @@ -0,0 +1,942 @@ +{ + "attributes": { + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation** \n\n**Logstash Overview**\n\n[Overview](/app/dashboards#/view/logstash-79270240-48ee-11ee-8cb5-99927777c522) \n**[Nodes Overview](/app/dashboards#/view/logstash-ee860840-41ed-11ee-874b-fdb94cc3273a)** \n[Node Overview](/app/dashboards#/view/logstash-9d450b10-4680-11ee-9ddc-919f87fe352d) \n[Node Overview Advanced View](/app/dashboards#/view/logstash-a42d7060-45e6-11ee-957b-3720c0b0fbc5) \n\nOverview\n\nThis Dashboard gives an overall view of Logstash Nodes", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 24, + "i": "3175d525-4aa7-40b5-bc68-d89d105257de", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "3175d525-4aa7-40b5-bc68-d89d105257de", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3eb7cb2b-67b2-4fc7-b311-9106826dbbfc": { + "columnOrder": [ + "a45f2761-e598-4ec1-8dff-95b395d0dd1e" + ], + "columns": { + "a45f2761-e598-4ec1-8dff-95b395d0dd1e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": " ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "a45f2761-e598-4ec1-8dff-95b395d0dd1e", + "layerId": "3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "layerType": "data" + } + }, + "title": "Node Count", + "type": "lens", + "visualizationType": "lnsLegacyMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "8302492d-1d16-4955-91cd-c892d7002dbb", + "w": 10, + "x": 8, + "y": 0 + }, + "panelIndex": "8302492d-1d16-4955-91cd-c892d7002dbb", + "title": "Node Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d944a0ae-9030-413e-afd6-c4a57ff34ad0": { + "columnOrder": [ + "b1f83d95-ed15-4e15-8e1e-b912424a35b2", + "a98fb979-a039-4322-871f-1d32480fd158" + ], + "columns": { + "a98fb979-a039-4322-871f-1d32480fd158": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.jvm.mem.heap_used_in_bytes: *" + }, + "isBucketed": false, + "label": "Heap Used", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.mem.heap_used_in_bytes" + }, + "b1f83d95-ed15-4e15-8e1e-b912424a35b2": { + "dataType": "string", + "isBucketed": true, + "label": "Top 1000 values of logstash.node.stats.logstash.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a98fb979-a039-4322-871f-1d32480fd158", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "b1f83d95-ed15-4e15-8e1e-b912424a35b2", + "collapseFn": "sum", + "layerId": "d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "layerType": "data", + "metricAccessor": "a98fb979-a039-4322-871f-1d32480fd158", + "showBar": false + } + }, + "title": "Total JVM Heap Used", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "345f1c7e-4b91-4df2-8c09-22d2a8c5d6be", + "w": 10, + "x": 18, + "y": 0 + }, + "panelIndex": "345f1c7e-4b91-4df2-8c09-22d2a8c5d6be", + "title": "Total JVM Heap Used", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bfb76152-1d30-4689-87e3-cf3b5803fdbf": { + "columnOrder": [ + "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "9329ee1e-ade0-412e-86f4-9e901db45ab2" + ], + "columns": { + "8ab113dc-30a3-4109-9b26-9e436fcb4291": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Total Events Received", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9329ee1e-ade0-412e-86f4-9e901db45ab2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "9329ee1e-ade0-412e-86f4-9e901db45ab2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "collapseFn": "sum", + "layerId": "bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "layerType": "data", + "maxCols": 1000, + "metricAccessor": "9329ee1e-ade0-412e-86f4-9e901db45ab2" + } + }, + "title": "Total Events Received", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "b1f30ec6-50f8-4fb0-8ebf-c00b1df332ee", + "w": 10, + "x": 28, + "y": 0 + }, + "panelIndex": "b1f30ec6-50f8-4fb0-8ebf-c00b1df332ee", + "title": "Total Events Received", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bfb76152-1d30-4689-87e3-cf3b5803fdbf": { + "columnOrder": [ + "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "9329ee1e-ade0-412e-86f4-9e901db45ab2" + ], + "columns": { + "8ab113dc-30a3-4109-9b26-9e436fcb4291": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Total Events Received", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9329ee1e-ade0-412e-86f4-9e901db45ab2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + }, + "9329ee1e-ade0-412e-86f4-9e901db45ab2": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Events Emitted", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "8ab113dc-30a3-4109-9b26-9e436fcb4291", + "collapseFn": "sum", + "layerId": "bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "layerType": "data", + "maxCols": 1000, + "metricAccessor": "9329ee1e-ade0-412e-86f4-9e901db45ab2" + } + }, + "title": "Total Events Emitted", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "5eedee54-06fd-496e-8b1d-b3df3ff80341", + "w": 10, + "x": 38, + "y": 0 + }, + "panelIndex": "5eedee54-06fd-496e-8b1d-b3df3ff80341", + "title": "Total Events Emitted", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logstash-sm-metrics", + "name": "indexpattern-datasource-layer-61cb0aa6-308d-4fe2-b1cd-a0ba51fce18d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "61cb0aa6-308d-4fe2-b1cd-a0ba51fce18d": { + "columnOrder": [ + "f36af195-93a1-4233-a6a9-bdf89a2359ee", + "b941031e-2ea9-4a77-b021-5f796a26a9f8", + "92da7812-4df1-4a71-b298-3c345da4ad9f", + "63add2b7-e60d-40b2-aa2b-5bb35ec45a05", + "63add2b7-e60d-40b2-aa2b-5bb35ec45a05X0", + "962f5333-8a10-4e8b-a6ed-e87b82e88536", + "9ff1c1ce-b397-4aac-b113-278233869c9c", + "f081358b-f84e-4f40-9060-ee886dddf6a9", + "b2914750-9e7a-4c50-85c6-f72fbd4930a4", + "ceb9088c-e445-43d2-8db3-4c6469c358ca" + ], + "columns": { + "63add2b7-e60d-40b2-aa2b-5bb35ec45a05": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "JVM Heap Percentage Used", + "operationType": "formula", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0, + "suffix": "%" + } + }, + "formula": "last_value(logstash.node.stats.jvm.mem.heap_used_percent, kql='logstash.node.stats.jvm.mem.heap_used_percent: *')", + "isFormulaBroken": false + }, + "references": [ + "63add2b7-e60d-40b2-aa2b-5bb35ec45a05X0" + ], + "scale": "ratio" + }, + "63add2b7-e60d-40b2-aa2b-5bb35ec45a05X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.jvm.mem.heap_used_percent: *" + }, + "isBucketed": false, + "label": "Part of JVM Heap Percentage Used", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.jvm.mem.heap_used_percent" + }, + "92da7812-4df1-4a71-b298-3c345da4ad9f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.os.cpu.load_average.1m: *" + }, + "isBucketed": false, + "label": "Load Average", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.os.cpu.load_average.1m" + }, + "962f5333-8a10-4e8b-a6ed-e87b82e88536": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.in: *" + }, + "isBucketed": false, + "label": "Events Received", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.in" + }, + "9ff1c1ce-b397-4aac-b113-278233869c9c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.events.out: *" + }, + "isBucketed": false, + "label": "Events Emitted", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.events.out" + }, + "b2914750-9e7a-4c50-85c6-f72fbd4930a4": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.reloads.failures: *" + }, + "isBucketed": false, + "label": "Reload Failures", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.failures" + }, + "b941031e-2ea9-4a77-b021-5f796a26a9f8": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.process.cpu.percent: *" + }, + "isBucketed": false, + "label": "CPU Usage", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.process.cpu.percent" + }, + "ceb9088c-e445-43d2-8db3-4c6469c358ca": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.logstash.version: *" + }, + "isBucketed": false, + "label": "Version", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.version" + }, + "f081358b-f84e-4f40-9060-ee886dddf6a9": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "logstash.node.stats.reloads.successes: *" + }, + "isBucketed": false, + "label": "Reload Successes", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "logstash.node.stats.reloads.successes" + }, + "f36af195-93a1-4233-a6a9-bdf89a2359ee": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Node Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "logstash.node.stats.logstash.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "center", + "columnId": "f36af195-93a1-4233-a6a9-bdf89a2359ee", + "isTransposed": false + }, + { + "alignment": "center", + "colorMode": "cell", + "columnId": "b941031e-2ea9-4a77-b021-5f796a26a9f8", + "isTransposed": false, + "palette": { + "name": "positive", + "params": { + "rangeMax": null, + "rangeMin": 20, + "rangeType": "percent", + "stops": [ + { + "color": "#d6e9e4", + "stop": 20 + }, + { + "color": "#aed3ca", + "stop": 40 + }, + { + "color": "#85bdb1", + "stop": 60 + }, + { + "color": "#5aa898", + "stop": 80 + }, + { + "color": "#209280", + "stop": 100 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "colorMode": "cell", + "columnId": "63add2b7-e60d-40b2-aa2b-5bb35ec45a05", + "isTransposed": false, + "palette": { + "name": "positive", + "params": { + "stops": [ + { + "color": "#d6e9e4", + "stop": 20 + }, + { + "color": "#aed3ca", + "stop": 40 + }, + { + "color": "#85bdb1", + "stop": 60 + }, + { + "color": "#5aa898", + "stop": 80 + }, + { + "color": "#209280", + "stop": 100 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "colorMode": "cell", + "columnId": "92da7812-4df1-4a71-b298-3c345da4ad9f", + "isTransposed": false, + "palette": { + "name": "positive", + "params": { + "stops": [ + { + "color": "#d6e9e4", + "stop": 20 + }, + { + "color": "#aed3ca", + "stop": 40 + }, + { + "color": "#85bdb1", + "stop": 60 + }, + { + "color": "#5aa898", + "stop": 80 + }, + { + "color": "#209280", + "stop": 100 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "columnId": "962f5333-8a10-4e8b-a6ed-e87b82e88536", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "9ff1c1ce-b397-4aac-b113-278233869c9c", + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "f081358b-f84e-4f40-9060-ee886dddf6a9", + "isTransposed": false + }, + { + "alignment": "center", + "colorMode": "text", + "columnId": "b2914750-9e7a-4c50-85c6-f72fbd4930a4", + "isTransposed": false, + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#040404", + "stop": 0 + }, + { + "color": "#f20707", + "stop": 1 + } + ], + "continuity": "above", + "name": "custom", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "number", + "steps": 5, + "stops": [ + { + "color": "#040404", + "stop": 1 + }, + { + "color": "#f20707", + "stop": 2 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "columnId": "ceb9088c-e445-43d2-8db3-4c6469c358ca", + "isTransposed": false + } + ], + "layerId": "61cb0aa6-308d-4fe2-b1cd-a0ba51fce18d", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Go to Dashboard" + }, + "eventId": "1c4772e7-cf9a-417d-803f-3c7184b1ec82", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + } + }, + "gridData": { + "h": 10, + "i": "4a093412-9812-433a-bf8d-225e4a402339", + "w": 40, + "x": 8, + "y": 4 + }, + "panelIndex": "4a093412-9812-433a-bf8d-225e4a402339", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Metrics Logstash] Nodes Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-08T17:27:49.263Z", + "id": "logstash-ee860840-41ed-11ee-874b-fdb94cc3273a", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logstash-sm-metrics", + "name": "8302492d-1d16-4955-91cd-c892d7002dbb:indexpattern-datasource-layer-3eb7cb2b-67b2-4fc7-b311-9106826dbbfc", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "345f1c7e-4b91-4df2-8c09-22d2a8c5d6be:indexpattern-datasource-layer-d944a0ae-9030-413e-afd6-c4a57ff34ad0", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "b1f30ec6-50f8-4fb0-8ebf-c00b1df332ee:indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "5eedee54-06fd-496e-8b1d-b3df3ff80341:indexpattern-datasource-layer-bfb76152-1d30-4689-87e3-cf3b5803fdbf", + "type": "index-pattern" + }, + { + "id": "logstash-sm-metrics", + "name": "4a093412-9812-433a-bf8d-225e4a402339:indexpattern-datasource-layer-61cb0aa6-308d-4fe2-b1cd-a0ba51fce18d", + "type": "index-pattern" + }, + { + "id": "logstash-9d450b10-4680-11ee-9ddc-919f87fe352d", + "name": "4a093412-9812-433a-bf8d-225e4a402339:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:1c4772e7-cf9a-417d-803f-3c7184b1ec82:dashboardId", + "type": "dashboard" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/logstash/kibana/index_pattern/logstash-sm-metrics.json b/packages/logstash/kibana/index_pattern/logstash-sm-metrics.json new file mode 100644 index 00000000000..0b84ef99313 --- /dev/null +++ b/packages/logstash/kibana/index_pattern/logstash-sm-metrics.json @@ -0,0 +1,23 @@ +{ + "attributes": { + "fieldAttrs": "{}", + "fieldFormatMap": "{}", + "fields": "[]", + "name": "Logstash Stack Monitoring Metrics", + "runtimeFieldMap": "{}", + "sourceFilters": "[]", + "timeFieldName": "@timestamp", + "title": "metrics-*,metricbeat-*,.monitoring-*", + "typeMeta": "{}" + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-08T14:33:56.176Z", + "id": "logstash-sm-metrics", + "migrationVersion": { + "index-pattern": "8.0.0" + }, + "references": [], + "type": "index-pattern", + "updated_at": "2023-09-08T14:33:56.176Z", + "version": "WzEwNzMsMV0=" +} \ No newline at end of file diff --git a/packages/logstash/manifest.yml b/packages/logstash/manifest.yml index 42599db7894..375c8c6c7dc 100644 --- a/packages/logstash/manifest.yml +++ b/packages/logstash/manifest.yml @@ -1,6 +1,6 @@ name: logstash title: Logstash -version: 2.3.2 +version: 2.3.3 description: Collect logs and metrics from Logstash with Elastic Agent. type: integration icons: @@ -12,7 +12,7 @@ format_version: 1.0.0 license: basic categories: ["elastic_stack"] conditions: - kibana.version: ^8.5.0 + kibana.version: ^8.7.1 owner: github: elastic/infra-monitoring-ui screenshots: diff --git a/packages/lyve_cloud/_dev/build/build.yml b/packages/lyve_cloud/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/lyve_cloud/_dev/build/build.yml +++ b/packages/lyve_cloud/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/lyve_cloud/changelog.yml b/packages/lyve_cloud/changelog.yml index 1d37c6642f4..723951f120b 100644 --- a/packages/lyve_cloud/changelog.yml +++ b/packages/lyve_cloud/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.6.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.5.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.4.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7122 - version: "1.3.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/lyve_cloud/data_stream/audit/_dev/test/pipeline/test-audit-events.json-expected.json b/packages/lyve_cloud/data_stream/audit/_dev/test/pipeline/test-audit-events.json-expected.json index ff5e423d2fb..e6ce5d15752 100644 --- a/packages/lyve_cloud/data_stream/audit/_dev/test/pipeline/test-audit-events.json-expected.json +++ b/packages/lyve_cloud/data_stream/audit/_dev/test/pipeline/test-audit-events.json-expected.json @@ -21,7 +21,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"HeadObject\", \"bucket\": \"user-name-t10\", \"object\": \"c\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"601866322ns\"}, \"time\": \"2022-10-24T08:37:41.232759412Z\", \"version\": \"1\", \"requestID\": \"1720F4788755136D\", \"userAgent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -142,7 +142,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketLocation\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"27121602ns\", \"timeToFirstByte\": \"27072750ns\"}, \"time\": \"2022-10-20T12:52:42.974686686Z\", \"version\": \"1\", \"requestID\": \"171FC8111B3F560B\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"location\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -260,7 +260,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketObjectLockConfig\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"4281871ns\", \"timeToFirstByte\": \"4241444ns\"}, \"time\": \"2022-10-20T12:52:42.991884911Z\", \"version\": \"1\", \"requestID\": \"171FC8111DA28FBB\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"object-lock\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -378,7 +378,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketVersioning\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"11629964ns\", \"timeToFirstByte\": \"11592380ns\"}, \"time\": \"2022-10-20T12:52:42.987061593Z\", \"version\": \"1\", \"requestID\": \"171FC8111CE88EA9\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"versioning\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -496,7 +496,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketLifecycle\", \"bucket\": \"user-name-t10\", \"status\": \"Not Found\", \"statusCode\": 404, \"timeToResponse\": \"9060988ns\", \"timeToFirstByte\": \"9022818ns\"}, \"time\": \"2022-10-20T12:52:43.001490536Z\", \"version\": \"1\", \"requestID\": \"171FC8111DEBF8A3\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"lifecycle\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -614,7 +614,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketReplicationConfig\", \"bucket\": \"user-name-t10\", \"status\": \"Not Found\", \"statusCode\": 404, \"timeToResponse\": \"2397832ns\", \"timeToFirstByte\": \"2356303ns\"}, \"time\": \"2022-10-20T12:52:43.04373248Z\", \"version\": \"1\", \"requestID\": \"171FC81120D65691\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"replication\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -720,7 +720,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"ListObjectsV2\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"632390347ns\", \"timeToFirstByte\": \"632337102ns\"}, \"time\": \"2022-10-20T12:54:19.9977067Z\", \"version\": \"1\", \"requestID\": \"171FC8278E316C8A\", \"userAgent\": \"aws-cli/2.5.2 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/s3.ls\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"prefix\": \"\", \"list-type\": \"2\", \"encoding-type\": \"url\"}, \"requestHeader\": {\"X-Real-Ip\": \"10.213.135.134:23254\", \"User-Agent\": \"aws-cli/2.5.2 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/s3.ls\", \"X-Amz-Date\": \"20221020T125418Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221020/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 10.213.135.134\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"\", \"Vary\": \"Origin\", \"Content-Type\": \"application/xml\", \"Accept-Ranges\": \"bytes\", \"Content-Length\": \"557\", \"X-Amz-Request-Id\": \"171FC8278E316C8A\", \"X-Xss-Protection\": \"1; mode=block\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"Content-Security-Policy\": \"block-all-mixed-content\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -810,7 +810,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"DeleteObject\", \"bucket\": \"user-name-t10\", \"object\": \"accapi.go\", \"status\": \"No Content\", \"statusCode\": 204, \"timeToResponse\": \"42147881ns\"}, \"time\": \"2022-10-20T12:55:27.16794052Z\", \"version\": \"1\", \"requestID\": \"171FC8375508A9C8\", \"userAgent\": \"aws-cli/2.5.2 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/s3api.delete-object\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"versionId\": \"2802c0f7-4bde-4618-9a74-b020f2401191\"}, \"requestHeader\": {\"X-Real-Ip\": \"10.213.134.169:16912\", \"User-Agent\": \"aws-cli/2.5.2 Python/3.9.11 Windows/10 exe/AMD64 prompt/off command/s3api.delete-object\", \"X-Amz-Date\": \"20221020T125526Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221020/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 10.213.134.169\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"\", \"Vary\": \"Origin\", \"Accept-Ranges\": \"bytes\", \"Content-Length\": \"0\", \"X-Amz-Request-Id\": \"171FC8375508A9C8\", \"X-Xss-Protection\": \"1; mode=block\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"Content-Security-Policy\": \"block-all-mixed-content\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -911,7 +911,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"PutBucketObjectLockConfig\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"3517481471ns\"}, \"time\": \"2022-10-20T12:58:22.69646988Z\", \"version\": \"1\", \"requestID\": \"171FC85F6433DEC0\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"object-lock\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 81.2.69.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -1034,7 +1034,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"PutBucketLifecycle\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"1880737476ns\"}, \"time\": \"2022-10-20T12:58:24.57801948Z\", \"version\": \"1\", \"requestID\": \"171FC86035E84025\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"lifecycle\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"81.2.69.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"81.2.69.142, 89.160.20.128\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" diff --git a/packages/lyve_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/lyve_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 515005243b8..34e4291e91c 100644 --- a/packages/lyve_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/lyve_cloud/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: "message" target_field: "event.original" diff --git a/packages/lyve_cloud/data_stream/audit/fields/base-fields.yml b/packages/lyve_cloud/data_stream/audit/fields/base-fields.yml index 96e8530f7e4..4adfabd80bf 100644 --- a/packages/lyve_cloud/data_stream/audit/fields/base-fields.yml +++ b/packages/lyve_cloud/data_stream/audit/fields/base-fields.yml @@ -15,10 +15,6 @@ type: constant_keyword description: Event dataset value: lyve_cloud.audit -- name: container.id - description: Unique container id. - ignore_above: 1024 - type: keyword - name: input.type description: Type of Filebeat input. type: keyword diff --git a/packages/lyve_cloud/data_stream/audit/sample_event.json b/packages/lyve_cloud/data_stream/audit/sample_event.json index 4b45199d293..3c2abbd39c6 100644 --- a/packages/lyve_cloud/data_stream/audit/sample_event.json +++ b/packages/lyve_cloud/data_stream/audit/sample_event.json @@ -4,7 +4,7 @@ "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketLocation\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"27121602ns\", \"timeToFirstByte\": \"27072750ns\"}, \"time\": \"2022-10-20T12:52:42.974686686Z\", \"version\": \"1\", \"requestID\": \"171FC8111B3F560B\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"location\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"10.213.135.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"1.128.0.0, 10.213.135.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -59,7 +59,9 @@ "1.128.0.0", "10.213.135.144" ], - "user": "user-name-terraform" + "user": [ + "user-name-terraform" + ] }, "tags": [ "preserve_original_event" diff --git a/packages/lyve_cloud/docs/README.md b/packages/lyve_cloud/docs/README.md index 9e0264972e0..9c863919cc3 100644 --- a/packages/lyve_cloud/docs/README.md +++ b/packages/lyve_cloud/docs/README.md @@ -144,7 +144,7 @@ An example event for `audit` looks as following: "provider": "lyvecloud" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"auditEntry\": {\"api\": {\"name\": \"GetBucketLocation\", \"bucket\": \"user-name-t10\", \"status\": \"OK\", \"statusCode\": 200, \"timeToResponse\": \"27121602ns\", \"timeToFirstByte\": \"27072750ns\"}, \"time\": \"2022-10-20T12:52:42.974686686Z\", \"version\": \"1\", \"requestID\": \"171FC8111B3F560B\", \"userAgent\": \"MinIO (linux; amd64) minio-go/v7.0.15\", \"deploymentid\": \"8fe8887f-d1e2-4918-9e33-52bfba3b0de8\", \"requestQuery\": {\"location\": \"\"}, \"requestHeader\": {\"X-Real-Ip\": \"10.213.135.144:28911\", \"User-Agent\": \"aws-cli/2.7.7 Python/3.9.11 Linux/5.15.0-52-generic exe/x86_64.ubuntu.20 prompt/off command/s3api.head-object\", \"X-Amz-Date\": \"20221024T083808Z\", \"Authorization\": \"AWS4-HMAC-SHA256 Credential=\u003credacted\u003e/20221024/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-content-sha256;x-amz-date, Signature=\u003credacted\u003e\", \"Accept-Encoding\": \"identity\", \"X-Forwarded-For\": \"1.128.0.0, 10.213.135.144\", \"X-Forwarded-Host\": \"s3.us-east-1.lyvecloud.seagate.com\", \"X-Forwarded-Proto\": \"https\", \"X-Amz-Content-Sha256\": \"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}, \"responseHeader\": {\"ETag\": \"b1946ac92492d2347c6235b4d2611184\", \"Vary\": \"Origin\", \"Content-Type\": \"application/octet-stream\", \"Accept-Ranges\": \"bytes\", \"Last-Modified\": \"Sun, 23 Oct 2022 12:51:23 GMT\", \"Content-Length\": \"6\", \"X-Amz-Request-Id\": \"1720F4788755136D\", \"X-Xss-Protection\": \"1; mode=block\", \"x-amz-version-id\": \"ab44978d-0929-4c3a-8d52-17157c1fb6ad\", \"X-Amz-Bucket-Region\": \"us-east-1\", \"X-Amz-Object-Lock-Mode\": \"COMPLIANCE\", \"Content-Security-Policy\": \"block-all-mixed-content\", \"X-Amz-Server-Side-Encryption\": \"AES256\", \"X-Amz-Object-Lock-Retain-Until-Date\": \"2022-10-27T12:51:23.250Z\"}}, \"serviceAccountName\": \"user-name-terraform\", \"serviceAccountCreatorId\": \"name.last@company.com\"}" @@ -199,7 +199,9 @@ An example event for `audit` looks as following: "1.128.0.0", "10.213.135.144" ], - "user": "user-name-terraform" + "user": [ + "user-name-terraform" + ] }, "tags": [ "preserve_original_event" diff --git a/packages/lyve_cloud/kibana/tags.yml b/packages/lyve_cloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/lyve_cloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/lyve_cloud/manifest.yml b/packages/lyve_cloud/manifest.yml index 4c7ea618c8e..99acdc7c69c 100644 --- a/packages/lyve_cloud/manifest.yml +++ b/packages/lyve_cloud/manifest.yml @@ -1,8 +1,7 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: lyve_cloud title: Lyve Cloud -version: "1.3.0" -license: basic +version: "1.6.0" description: Collect S3 API audit log from Lyve Cloud with Elastic Agent. type: integration categories: diff --git a/packages/m365_defender/_dev/build/build.yml b/packages/m365_defender/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/m365_defender/_dev/build/build.yml +++ b/packages/m365_defender/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/m365_defender/_dev/deploy/docker/http-mock-config.yml b/packages/m365_defender/_dev/deploy/docker/http-mock-config.yml index 2f32197c9a2..e877980fc85 100644 --- a/packages/m365_defender/_dev/deploy/docker/http-mock-config.yml +++ b/packages/m365_defender/_dev/deploy/docker/http-mock-config.yml @@ -234,6 +234,91 @@ rules: }] }] }, + { + "incidentId": 924521, + "redirectIncidentId": null, + "incidentName": "Test 'Mimikatz' hacktool was detected on one endpoint", + "createdTime": "2020-09-06T12:18:03.6266667Z", + "lastUpdateTime": "2020-09-06T12:18:03.81Z", + "assignedTo": null, + "classification": "Unknown", + "determination": "NotAvailable", + "status": "Active", + "severity": "Low", + "tags": [], + "comments": [], + "alerts": [{ + "alertId": "da637349914833441527_393341063", + "incidentId": 924521, + "serviceSource": "MicrosoftDefenderATP", + "creationTime": "2020-09-06T12:18:03.3285366Z", + "lastUpdatedTime": "2020-09-06T12:18:04.2566667Z", + "resolvedTime": null, + "firstActivity": "2020-09-06T12:15:07.7272048Z", + "lastActivity": "2020-09-06T12:15:07.7272048Z", + "title": "'Mimikatz' hacktool was detected", + "description": "Readily available tools, such as hacking programs, can be used by unauthorized individuals to spy on users. When used by attackers, these tools are often installed without authorization and used to compromise targeted machines.\n\nThese tools are often used to collect personal information from browser records, record key presses, access email and instant messages, record voice and video conversations, and take screenshots.\n\nThis detection might indicate that Windows Defender Antivirus has stopped the tool from being installed and used effectively. However, it is prudent to check the machine for the files and processes associated with the detected tool.", + "category": "Malware", + "status": "New", + "severity": "Low", + "investigationId": null, + "investigationState": "UnsupportedOs", + "classification": null, + "determination": null, + "detectionSource": "WindowsDefenderAv", + "assignedTo": null, + "actorName": null, + "threatFamilyName": "Mimikatz", + "mitreTechniques": [], + "devices": [{ + "mdatpDeviceId": "24c222b0b60fe148eeece49ac83910cc6a7ef491", + "aadDeviceId": null, + "deviceDnsName": "user5cx.middleeast.corp.contoso.com", + "osPlatform": "WindowsServer2016", + "version": "1607", + "osProcessor": "x64", + "osBuild": 14393, + "healthStatus": "Active", + "riskScore": "High", + "rbacGroupName": "WDATP-Ring0", + "rbacGroupId": 9, + "firstSeen": "2020-02-06T14:16:01.9330135Z" + }], + "entities": [{ + "entityType": "File", + "sha1": "5de839186691aa96ee2ca6d74f0a38fb8d1bd6dd", + "sha256": null, + "fileName": "Detector.UnitTests.dll", + "filePath": "C:\\Agent\\_work\\_temp\\Deploy_SYSTEM 2020-09-06 12_14_54\\Out", + "processId": null, + "processCommandLine": null, + "processCreationTime": null, + "parentProcessId": null, + "parentProcessCreationTime": null, + "ipAddress": null, + "url": null, + "accountName": null, + "domainName": null, + "userSid": null, + "aadUserId": null, + "userPrincipalName": null, + "mailboxDisplayName": null, + "mailboxAddress": null, + "clusterBy": null, + "sender": null, + "recipient": null, + "subject": null, + "deliveryAction": null, + "securityGroupId": null, + "securityGroupName": null, + "registryHive": null, + "registryKey": null, + "registryValueType": null, + "registryValue": null, + "deviceId": "24c222b0b60fe148eeece49ac83910cc6a7ef491" + }] + }] + }, { "incidentId": 924518, "redirectIncidentId": null, diff --git a/packages/m365_defender/changelog.yml b/packages/m365_defender/changelog.yml index 41c127d6a48..b3b392b8a07 100644 --- a/packages/m365_defender/changelog.yml +++ b/packages/m365_defender/changelog.yml @@ -1,4 +1,59 @@ # newer versions go on top +- version: 2.2.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.1.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.0.1" + changes: + - description: Fix template snippet escaping and add event.kind for pipeline errors. + type: bugfix + link: https://github.com/elastic/integrations/pull/7707 +- version: "2.0.0" + changes: + - description: Major improvements in ECS field coverage and additional field mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/7522 +- version: "1.17.1" + changes: + - description: Fix fingerprint processor on `log` datastream to avoid document conflicts + type: bugfix + link: https://github.com/elastic/integrations/pull/7255 +- version: "1.17.0" + changes: + - description: Add support for newer Oauth Token Endpoint and fixes in some ECS mappings. + type: enhancement + link: https://github.com/elastic/integrations/pull/7119 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.15.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.14.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7123 +- version: "1.13.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6898 +- version: "1.12.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.11.2" changes: - description: Added the mapping for user.name field into the incident data stream. diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json index 2d7da102563..f48fac5c327 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json @@ -3,22 +3,29 @@ { "@timestamp": "2022-11-08T08:41:56.595Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "file" ], "id": "da638034938542195558_2006612345", - "kind": [ - "alert" - ], + "kind": "alert", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-AlertEvidence\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":\"a-domain\",\"AccountName\":\"account name\",\"AccountObjectId\":\"S-1-5-2\",\"AccountSid\":\"S-1-5-1\",\"AccountUpn\":null,\"AdditionalFields\":\"{\\\"$id\\\":\\\"1\\\",\\\"ProcessId\\\":\\\"1960\\\"}\",\"AlertId\":\"da638034938542195558_2006612345\",\"Application\":null,\"ApplicationId\":null,\"DeviceId\":\"08f8d2adebd88b1b7e509fcca55a665831912345\",\"DeviceName\":\"TestMachine1\",\"EmailSubject\":null,\"EntityType\":\"File\",\"EvidenceDirection\":null,\"EvidenceRole\":\"Related\",\"FileName\":\"ai_alternate_stream_s7f_48qa.txt:ai-8xNfG12345\",\"FileSize\":27436,\"FolderPath\":\"C:\\\\Windows\\\\Temp\",\"LocalIP\":\"81.2.69.192\",\"MachineGroup\":null,\"NetworkMessageId\":null,\"OAuthApplicationId\":null,\"ProcessCommandLine\":null,\"RegistryKey\":null,\"RegistryValueData\":null,\"RegistryValueName\":null,\"RemoteIP\":null,\"RemoteUrl\":null,\"SHA1\":\"eff06d27e192d18afb00237ca00c4e5dd4012345\",\"SHA256\":\"bd914e55d55a31b7bdc95fa617f9925ff3eba703afd7a8b70cea18dcae512345\",\"ServiceSource\":\"Microsoft Defender for Endpoint\",\"ThreatFamily\":null,\"Timestamp\":\"2022-11-08T08:41:56.5950497Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-08T08:44:14.9047460Z\"}", "provider": "Microsoft Defender for Endpoint", "type": [ "info" ] }, + "file": { + "directory": "C:\\Windows\\Temp", + "hash": { + "sha1": "eff06d27e192d18afb00237ca00c4e5dd4012345", + "sha256": "bd914e55d55a31b7bdc95fa617f9925ff3eba703afd7a8b70cea18dcae512345" + }, + "name": "ai_alternate_stream_s7f_48qa.txt:ai-8xNfG12345", + "size": 27436 + }, "host": { "id": "08f8d2adebd88b1b7e509fcca55a665831912345", "name": "testmachine1" @@ -69,59 +76,46 @@ }, "related": { "hash": [ - "eff06d27e192d18afb00237ca00c4e5dd4012345", - "bd914e55d55a31b7bdc95fa617f9925ff3eba703afd7a8b70cea18dcae512345" + "bd914e55d55a31b7bdc95fa617f9925ff3eba703afd7a8b70cea18dcae512345", + "eff06d27e192d18afb00237ca00c4e5dd4012345" ], "hosts": [ - "TestMachine1", - "08f8d2adebd88b1b7e509fcca55a665831912345", - "a-domain" + "testmachine1", + "a-domain", + "08f8d2adebd88b1b7e509fcca55a665831912345" ], "ip": [ "81.2.69.192" ], "user": [ - "account name", - "S-1-5-2" + "S-1-5-2", + "account name" ] }, + "source": { + "ip": "81.2.69.192" + }, "tags": [ "preserve_original_event", "preserve_duplicate_custom_fields" ], - "threat": { - "enrichments": { - "indicator": { - "file": { - "directory": "C:\\Windows\\Temp", - "hash": { - "sha1": "eff06d27e192d18afb00237ca00c4e5dd4012345", - "sha256": "bd914e55d55a31b7bdc95fa617f9925ff3eba703afd7a8b70cea18dcae512345" - }, - "name": "ai_alternate_stream_s7f_48qa.txt:ai-8xNfG12345", - "size": 27436 - } - } - } - }, "user": { "domain": "a-domain", + "id": "S-1-5-1", "name": "account name" } }, { "@timestamp": "2022-11-08T08:42:17.295Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "threat" ], "id": "da638034938542563831_172489803", - "kind": [ - "alert" - ], + "kind": "alert", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-AlertInfo\",\"operationName\":\"Publish\",\"properties\":{\"AlertId\":\"da638034938542563831_172489803\",\"AttackTechniques\":\"[\\\"Valid Accounts (T1078)\\\",\\\"Cloud Accounts (T1078.004)\\\"]\",\"Category\":\"Persistence\",\"DetectionSource\":\"EDR\",\"MachineGroup\":null,\"ServiceSource\":\"Microsoft Defender for Endpoint\",\"Severity\":\"Medium\",\"Timestamp\":\"2022-11-08T08:42:17.2954051Z\",\"Title\":\"Anomalous silent process exit monitor registration\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-08T08:44:14.7934901Z\"}", "provider": "Microsoft Defender for Endpoint", "severity": 3, @@ -178,16 +172,14 @@ { "@timestamp": "2022-11-08T08:42:17.295Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "threat" ], "id": "da638034938542563831_172489803", - "kind": [ - "alert" - ], + "kind": "alert", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-AlertInfo\",\"operationName\":\"Publish\",\"properties\":{\"AlertId\":\"da638034938542563831_172489803\",\"AttackTechniques\":\"\",\"Category\":\"Persistence\",\"DetectionSource\":\"EDR\",\"MachineGroup\":null,\"ServiceSource\":\"Microsoft Defender for Endpoint\",\"Severity\":\"Medium\",\"Timestamp\":\"2022-11-08T08:42:17.2954051Z\",\"Title\":\"Anomalous silent process exit monitor registration\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-08T08:44:14.7934901Z\"}", "provider": "Microsoft Defender for Endpoint", "severity": 3, diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log index f04ec1a7b3a..3a7d27e4c1c 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log @@ -1,6 +1,6 @@ {"Tenant":"DefaultTenant","category":"AdvancedHunting-IdentityLogonEvents","operationName":"Publish","properties":{"Timestamp":"2022-11-22T06:19:37Z","TargetDeviceName":"","DestinationIPAddress":"","DestinationPort":"","DeviceName":"testmachine5","IPAddress":"89.160.20.112","OSPlatform":"Windows 10","DeviceType":"Desktop","Protocol":"NTLM","AccountDomain":"","AccountSid":"S-1-5-21-1874808502-2282212345-3464712345-500","AccountName":"administrator1","AccountDisplayName":"","AccountObjectId":"","AccountUpn":"","ActionType":"LogonSuccess","AdditionalFields":"{\"CallerProcessID\":4248}","Application":"Office 365","DestinationDeviceName":"","FailureReason":"","Isp":"","Location":"","LogonType":"Login:resume","Port":"","ReportId":"1234","TargetAccountDisplayName":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-22T06:20:58.5237104Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-IdentityQueryEvents","operationName":"Publish","properties":{"Timestamp":"2022-11-22T06:19:37Z","TargetDeviceName":"","DestinationIPAddress":"","DestinationPort":"","DeviceName":"testmachine5","IPAddress":"","Protocol":"NTLM","AccountDomain":"testmachine6","AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountName":"administrator1","AccountDisplayName":"","AccountObjectId":"","AccountUpn":"","ActionType":"ProcessCreated","AdditionalFields":"{\"CallerProcessID\":4248}","Application":"","DestinationDeviceName":"","Location":"","Port":"","Query":"","QueryTarget":"","QueryType":"","ReportId":"1234","TargetAccountDisplayName":"","TargetAccountUpn":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-22T06:20:58.5237104Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-IdentityDirectoryEvents","operationName":"Publish","properties":{"Timestamp":"2022-11-22T06:19:37Z","TargetDeviceName":"","DestinationIPAddress":"","DestinationPort":"","DeviceName":"testmachine5","IPAddress":"","Protocol":"NTLM","AccountDomain":"testmachine6","AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountName":"administrator1","AccountDisplayName":"","AccountObjectId":"","AccountUpn":"","ActionType":"ProcessCreated","AdditionalFields":"{\"CallerProcessID\":4248}","Application":"","DestinationDeviceName":"","ISP":"","Location":"","Port":"","ReportId":"1234","TargetAccountDisplayName":"","TargetAccountUpn":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-22T06:20:58.5237104Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-CloudAppEvents","operationName":"Publish","properties":{"AccountDisplayName":"name","AccountId":"007c979b-47e7-4747-b9a3-58de6bd12345","AccountObjectId":"007c979b-47e7-4747-b9a3-58de6bdb275a","AccountType":"Admin","ActionType":"Write Deployments","ActivityObjects":"","ActivityType":"Basic","AdditionalFields":"{\"IsSatelliteProvider\":false}","AppInstanceId":0,"Application":"Microsoft Azure","ApplicationId":12260,"City":"","CountryCode":"","DeviceType":null,"IPAddress":"81.2.69.142","IPCategory":null,"IPTags":null,"ISP":"","IsAdminOperation":false,"IsAnonymousProxy":false,"IsExternalUser":false,"IsImpersonated":false,"OSPlatform":null,"ObjectId":"","ObjectName":"","ObjectType":"Resource","RawEventData":"{\"AccountMoniker\":\"MdsResourceStackRPFCentralUS\",\"AccountMonikerLocation\":\"centralus\"}","ReportId":"366c7d2f964643f736af67ec54d23d4d729b1f17478ea94b05ad53a47a812345","Timestamp":"2022-12-08T12:48:45.833Z","UserAgent":null,"UserAgentTags":null},"tenantId":"8df34af3-bc0e-4f36-b08e-27759e912345","time":"2022-12-08T12:52:23.6440369Z"} -{"time": "2023-06-21T11:55:44.4674988Z", "tenantId": "25cba38d-0984-4f37-b801-5ea07c659887", "operationName": "Publish", "category": "AdvancedHunting-IdentityQueryEvents", "properties": {"ActionType":"SAMR query","QueryTarget":"Server_Admin","Protocol":"Samr","AccountDisplayName":"D2WXA1303R$","AccountUpn":null,"AccountName":null,"AccountDomain":null,"AccountSid":null,"AccountObjectId":null,"Query":null,"IPAddress":"10.180.101.20","Location":null,"DeviceName":"d2wxa1303r.d300b.cenlar.com","QueryType":"QueryGroup","DestinationDeviceName":"d2win02r.d300b.cenlar.com","TargetAccountDisplayName":null,"TargetDeviceName":null,"Port":58210,"DestinationPort":445,"DestinationIPAddress":"10.180.100.81","TargetAccountUpn":null,"AdditionalFields":{"AttackTechniques":"Permission Groups Discovery (T1069), Account Discovery (T1087), Domain Groups (T1069.002), Domain Account (T1087.002)","Category":"Discovery","TO.DEVICE":"D2WIN02R","ACTOR.DEVICE":"D2WXA1303R","DestinationComputerOperatingSystemType":"windows","SourceComputerOperatingSystem":"windows server 2019 datacenter","Count":"1","SourceComputerOperatingSystemType":"windows","SourceAccountId":"b7c4b4f6-3240-4a67-8255-d5694015588c","SourceComputerOperatingSystemVersion":"10.0 (17763)","DestinationComputerOperatingSystem":"windows server 2012 datacenter","SourceComputerObjectGuid":"b7c4b4f6-3240-4a67-8255-d5694015588c","DestinationComputerOperatingSystemVersion":"6.2 (9200)","SourceAccountSid":"S-1-5-21-621940831-1238047941-1264475144-86894","FROM.DEVICE":"D2WXA1303R","DestinationComputerObjectGuid":"370f6773-bfd8-4356-8e83-e65a1a9b3469"},"ReportId":"5006fead-26b0-4443-8118-5838aef430eb_108408875_1687348229598_20940","Timestamp":"2023-06-21T11:50:29.598Z","Application":"Active Directory"}, "Tenant": "DefaultTenant"} -{"time": "2023-06-21T11:55:46.0067676Z", "tenantId": "25cba38d-0984-4f37-b801-5ea07c659887", "operationName": "Publish", "category": "AdvancedHunting-IdentityQueryEvents", "properties": {"ActionType":"DNS query","QueryTarget":"_grpc_config.useast-comms.dgsecure.com","Protocol":"Dns","AccountDisplayName":null,"AccountUpn":null,"AccountName":null,"AccountDomain":null,"AccountSid":null,"AccountObjectId":null,"Query":null,"IPAddress":"10.173.130.18","Location":null,"DeviceName":"d1wrpws12d.d300b.cenlar.com","QueryType":"Text","DestinationDeviceName":"d1win02p.d300b.cenlar.com","TargetAccountDisplayName":null,"TargetDeviceName":null,"Port":57396,"DestinationPort":53,"DestinationIPAddress":"10.170.100.81","TargetAccountUpn":null,"AdditionalFields":{"SourceComputerOperatingSystemVersion":"10.0 (19044)","TO.DEVICE":"D1WIN02P","DestinationComputerOperatingSystem":"windows server 2012 datacenter","DestinationComputerOperatingSystemType":"windows","SourceComputerObjectGuid":"73938f34-664b-4d63-9b31-ada0c8060676","DestinationComputerOperatingSystemVersion":"6.2 (9200)","SourceComputerOperatingSystem":"windows 10 enterprise","Count":"2","SourceComputerOperatingSystemType":"windows","FROM.DEVICE":"D1WRPWS12D","DestinationComputerObjectGuid":"dfa29ee1-8b5c-400b-8608-4f4330bf9ed2"},"ReportId":"8923586f-1fc6-4393-afa0-5579dba38b0a_108408875_1687348398643_20940","Timestamp":"2023-06-21T11:53:18.643Z","Application":"Active Directory"}, "Tenant": "DefaultTenant"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-IdentityQueryEvents","operationName":"Publish","properties":{"Timestamp":"2022-11-22T06:19:37Z","TargetDeviceName":"","DestinationIPAddress":"","DestinationPort":"","DeviceName":"testmachine5","IPAddress":"","Protocol":"NTLM","AccountDomain":"testmachine6","AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountName":"administrator1","AccountDisplayName":"","AccountObjectId":"","AccountUpn":"","ActionType":"ProcessCreated","AdditionalFields":"{\"CallerProcessID\":4248}","Application":"","DestinationDeviceName":"","IsAdminOperation":null,"Location":"","Port":"","Query":"","QueryTarget":"","QueryType":"","ReportId":"1234","TargetAccountDisplayName":"","TargetAccountUpn":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-22T06:20:58.5237104Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-IdentityDirectoryEvents","operationName":"Publish","properties":{"Timestamp":"2022-11-22T06:19:37Z","TargetDeviceName":"","DestinationIPAddress":"","DestinationPort":"","DeviceName":"testmachine5","IPAddress":"","Protocol":"NTLM","AccountDomain":"testmachine6","AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountName":"administrator1","AccountDisplayName":"","AccountObjectId":"","AccountUpn":"","ActionType":"ProcessCreated","AdditionalFields":"{\"CallerProcessID\":4248}","Application":"","DestinationDeviceName":"","IsAdminOperation":"","ISP":"","Location":"","Port":"","ReportId":"1234","TargetAccountDisplayName":"","TargetAccountUpn":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-22T06:20:58.5237104Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-CloudAppEvents","operationName":"Publish","properties":{"AccountDisplayName":"name","AccountId":"007c979b-47e7-4747-b9a3-58de6bd12345","AccountObjectId":"007c979b-47e7-4747-b9a3-58de6bdb275a","AccountType":"Admin","ActionType":"Write Deployments","ActivityObjects":"","ActivityType":"Basic","AdditionalFields":"{\"IsSatelliteProvider\":false}","AppInstanceId":0,"Application":"Microsoft Azure","ApplicationId":12260,"City":"","CountryCode":"","DeviceType":null,"IPAddress":"81.2.69.142","IPCategory":null,"IPTags":null,"ISP":"","IsAdminOperation":0,"IsAnonymousProxy":false,"IsExternalUser":false,"IsImpersonated":false,"OSPlatform":null,"ObjectId":"","ObjectName":"","ObjectType":"Resource","RawEventData":"{\"AccountMoniker\":\"MdsResourceStackRPFCentralUS\",\"AccountMonikerLocation\":\"centralus\"}","ReportId":"366c7d2f964643f736af67ec54d23d4d729b1f17478ea94b05ad53a47a812345","Timestamp":"2022-12-08T12:48:45.833Z","UserAgent":null,"UserAgentTags":null},"tenantId":"8df34af3-bc0e-4f36-b08e-27759e912345","time":"2022-12-08T12:52:23.6440369Z"} +{"time": "2023-06-21T11:55:44.4674988Z", "tenantId": "25cba38d-0984-4f37-b801-5ea07c659887", "operationName": "Publish", "category": "AdvancedHunting-IdentityQueryEvents", "properties": {"ActionType":"SAMR query","QueryTarget":"Server_Admin","Protocol":"Samr","AccountDisplayName":"D2WXA1303R$","AccountUpn":null,"AccountName":null,"AccountDomain":null,"AccountSid":null,"AccountObjectId":null,"Query":null,"IPAddress":"10.180.101.20","Location":null,"DeviceName":"d2wxa1303r.d300b.cenlar.com","QueryType":"QueryGroup","DestinationDeviceName":"d2win02r.d300b.cenlar.com","IsAdminOperation":"0","TargetAccountDisplayName":null,"TargetDeviceName":null,"Port":58210,"DestinationPort":445,"DestinationIPAddress":"10.180.100.81","TargetAccountUpn":null,"AdditionalFields":{"AttackTechniques":"Permission Groups Discovery (T1069), Account Discovery (T1087), Domain Groups (T1069.002), Domain Account (T1087.002)","Category":"Discovery","TO.DEVICE":"D2WIN02R","ACTOR.DEVICE":"D2WXA1303R","DestinationComputerOperatingSystemType":"windows","SourceComputerOperatingSystem":"windows server 2019 datacenter","Count":"1","SourceComputerOperatingSystemType":"windows","SourceAccountId":"b7c4b4f6-3240-4a67-8255-d5694015588c","SourceComputerOperatingSystemVersion":"10.0 (17763)","DestinationComputerOperatingSystem":"windows server 2012 datacenter","SourceComputerObjectGuid":"b7c4b4f6-3240-4a67-8255-d5694015588c","DestinationComputerOperatingSystemVersion":"6.2 (9200)","SourceAccountSid":"S-1-5-21-621940831-1238047941-1264475144-86894","FROM.DEVICE":"D2WXA1303R","DestinationComputerObjectGuid":"370f6773-bfd8-4356-8e83-e65a1a9b3469"},"ReportId":"5006fead-26b0-4443-8118-5838aef430eb_108408875_1687348229598_20940","Timestamp":"2023-06-21T11:50:29.598Z","Application":"Active Directory"}, "Tenant": "DefaultTenant"} +{"time": "2023-06-21T11:55:46.0067676Z", "tenantId": "25cba38d-0984-4f37-b801-5ea07c659887", "operationName": "Publish", "category": "AdvancedHunting-IdentityQueryEvents", "properties": {"ActionType":"DNS query","QueryTarget":"_grpc_config.useast-comms.dgsecure.com","Protocol":"Dns","AccountDisplayName":null,"AccountUpn":null,"AccountName":null,"AccountDomain":null,"AccountSid":null,"AccountObjectId":null,"Query":null,"IPAddress":"10.173.130.18","Location":null,"DeviceName":"d1wrpws12d.d300b.cenlar.com","QueryType":"Text","DestinationDeviceName":"d1win02p.d300b.cenlar.com","IsAdminOperation":false,"TargetAccountDisplayName":null,"TargetDeviceName":null,"Port":57396,"DestinationPort":53,"DestinationIPAddress":"10.170.100.81","TargetAccountUpn":null,"AdditionalFields":{"SourceComputerOperatingSystemVersion":"10.0 (19044)","TO.DEVICE":"D1WIN02P","DestinationComputerOperatingSystem":"windows server 2012 datacenter","DestinationComputerOperatingSystemType":"windows","SourceComputerObjectGuid":"73938f34-664b-4d63-9b31-ada0c8060676","DestinationComputerOperatingSystemVersion":"6.2 (9200)","SourceComputerOperatingSystem":"windows 10 enterprise","Count":"2","SourceComputerOperatingSystemType":"windows","FROM.DEVICE":"D1WRPWS12D","DestinationComputerObjectGuid":"dfa29ee1-8b5c-400b-8608-4f4330bf9ed2"},"ReportId":"8923586f-1fc6-4393-afa0-5579dba38b0a_108408875_1687348398643_20940","Timestamp":"2023-06-21T11:53:18.643Z","Application":"Active Directory"}, "Tenant": "DefaultTenant"} diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log-expected.json b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log-expected.json index 67781774360..a4fbf0925ab 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log-expected.json +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-app-and-identity.log-expected.json @@ -3,16 +3,15 @@ { "@timestamp": "2022-11-22T06:19:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logonsuccess", "category": [ "authentication" ], - "kind": [ - "event" - ], + "id": "1234", + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-IdentityLogonEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"TargetDeviceName\":\"\",\"DestinationIPAddress\":\"\",\"DestinationPort\":\"\",\"DeviceName\":\"testmachine5\",\"IPAddress\":\"89.160.20.112\",\"OSPlatform\":\"Windows 10\",\"DeviceType\":\"Desktop\",\"Protocol\":\"NTLM\",\"AccountDomain\":\"\",\"AccountSid\":\"S-1-5-21-1874808502-2282212345-3464712345-500\",\"AccountName\":\"administrator1\",\"AccountDisplayName\":\"\",\"AccountObjectId\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"LogonSuccess\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"Application\":\"Office 365\",\"DestinationDeviceName\":\"\",\"FailureReason\":\"\",\"Isp\":\"\",\"Location\":\"\",\"LogonType\":\"Login:resume\",\"Port\":\"\",\"ReportId\":\"1234\",\"TargetAccountDisplayName\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "outcome": "success", "type": [ @@ -74,6 +73,7 @@ "89.160.20.112" ], "user": [ + "S-1-5-21-1874808502-2282212345-3464712345-500", "administrator1" ] }, @@ -82,22 +82,20 @@ "preserve_duplicate_custom_fields" ], "user": { - "name": [ - "administrator1" - ] + "id": "S-1-5-21-1874808502-2282212345-3464712345-500", + "name": "administrator1" } }, { "@timestamp": "2022-11-22T06:19:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "processcreated", - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-IdentityQueryEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"TargetDeviceName\":\"\",\"DestinationIPAddress\":\"\",\"DestinationPort\":\"\",\"DeviceName\":\"testmachine5\",\"IPAddress\":\"\",\"Protocol\":\"NTLM\",\"AccountDomain\":\"testmachine6\",\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountName\":\"administrator1\",\"AccountDisplayName\":\"\",\"AccountObjectId\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"Application\":\"\",\"DestinationDeviceName\":\"\",\"Location\":\"\",\"Port\":\"\",\"Query\":\"\",\"QueryTarget\":\"\",\"QueryType\":\"\",\"ReportId\":\"1234\",\"TargetAccountDisplayName\":\"\",\"TargetAccountUpn\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", + "id": "1234", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-IdentityQueryEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"TargetDeviceName\":\"\",\"DestinationIPAddress\":\"\",\"DestinationPort\":\"\",\"DeviceName\":\"testmachine5\",\"IPAddress\":\"\",\"Protocol\":\"NTLM\",\"AccountDomain\":\"testmachine6\",\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountName\":\"administrator1\",\"AccountDisplayName\":\"\",\"AccountObjectId\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"Application\":\"\",\"DestinationDeviceName\":\"\",\"IsAdminOperation\":null,\"Location\":\"\",\"Port\":\"\",\"Query\":\"\",\"QueryTarget\":\"\",\"QueryType\":\"\",\"ReportId\":\"1234\",\"TargetAccountDisplayName\":\"\",\"TargetAccountUpn\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "type": [ "info" ] @@ -151,22 +149,19 @@ ], "user": { "domain": "testmachine6", - "name": [ - "administrator1" - ] + "name": "administrator1" } }, { "@timestamp": "2022-11-22T06:19:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "processcreated", - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-IdentityDirectoryEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"TargetDeviceName\":\"\",\"DestinationIPAddress\":\"\",\"DestinationPort\":\"\",\"DeviceName\":\"testmachine5\",\"IPAddress\":\"\",\"Protocol\":\"NTLM\",\"AccountDomain\":\"testmachine6\",\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountName\":\"administrator1\",\"AccountDisplayName\":\"\",\"AccountObjectId\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"Application\":\"\",\"DestinationDeviceName\":\"\",\"ISP\":\"\",\"Location\":\"\",\"Port\":\"\",\"ReportId\":\"1234\",\"TargetAccountDisplayName\":\"\",\"TargetAccountUpn\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", + "id": "1234", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-IdentityDirectoryEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"TargetDeviceName\":\"\",\"DestinationIPAddress\":\"\",\"DestinationPort\":\"\",\"DeviceName\":\"testmachine5\",\"IPAddress\":\"\",\"Protocol\":\"NTLM\",\"AccountDomain\":\"testmachine6\",\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountName\":\"administrator1\",\"AccountDisplayName\":\"\",\"AccountObjectId\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"Application\":\"\",\"DestinationDeviceName\":\"\",\"IsAdminOperation\":\"\",\"ISP\":\"\",\"Location\":\"\",\"Port\":\"\",\"ReportId\":\"1234\",\"TargetAccountDisplayName\":\"\",\"TargetAccountUpn\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "type": [ "info" ] @@ -220,22 +215,19 @@ ], "user": { "domain": "testmachine6", - "name": [ - "administrator1" - ] + "name": "administrator1" } }, { "@timestamp": "2022-12-08T12:48:45.833Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "write-deployments", - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-CloudAppEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDisplayName\":\"name\",\"AccountId\":\"007c979b-47e7-4747-b9a3-58de6bd12345\",\"AccountObjectId\":\"007c979b-47e7-4747-b9a3-58de6bdb275a\",\"AccountType\":\"Admin\",\"ActionType\":\"Write Deployments\",\"ActivityObjects\":\"\",\"ActivityType\":\"Basic\",\"AdditionalFields\":\"{\\\"IsSatelliteProvider\\\":false}\",\"AppInstanceId\":0,\"Application\":\"Microsoft Azure\",\"ApplicationId\":12260,\"City\":\"\",\"CountryCode\":\"\",\"DeviceType\":null,\"IPAddress\":\"81.2.69.142\",\"IPCategory\":null,\"IPTags\":null,\"ISP\":\"\",\"IsAdminOperation\":false,\"IsAnonymousProxy\":false,\"IsExternalUser\":false,\"IsImpersonated\":false,\"OSPlatform\":null,\"ObjectId\":\"\",\"ObjectName\":\"\",\"ObjectType\":\"Resource\",\"RawEventData\":\"{\\\"AccountMoniker\\\":\\\"MdsResourceStackRPFCentralUS\\\",\\\"AccountMonikerLocation\\\":\\\"centralus\\\"}\",\"ReportId\":\"366c7d2f964643f736af67ec54d23d4d729b1f17478ea94b05ad53a47a812345\",\"Timestamp\":\"2022-12-08T12:48:45.833Z\",\"UserAgent\":null,\"UserAgentTags\":null},\"tenantId\":\"8df34af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-12-08T12:52:23.6440369Z\"}", + "id": "366c7d2f964643f736af67ec54d23d4d729b1f17478ea94b05ad53a47a812345", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-CloudAppEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDisplayName\":\"name\",\"AccountId\":\"007c979b-47e7-4747-b9a3-58de6bd12345\",\"AccountObjectId\":\"007c979b-47e7-4747-b9a3-58de6bdb275a\",\"AccountType\":\"Admin\",\"ActionType\":\"Write Deployments\",\"ActivityObjects\":\"\",\"ActivityType\":\"Basic\",\"AdditionalFields\":\"{\\\"IsSatelliteProvider\\\":false}\",\"AppInstanceId\":0,\"Application\":\"Microsoft Azure\",\"ApplicationId\":12260,\"City\":\"\",\"CountryCode\":\"\",\"DeviceType\":null,\"IPAddress\":\"81.2.69.142\",\"IPCategory\":null,\"IPTags\":null,\"ISP\":\"\",\"IsAdminOperation\":0,\"IsAnonymousProxy\":false,\"IsExternalUser\":false,\"IsImpersonated\":false,\"OSPlatform\":null,\"ObjectId\":\"\",\"ObjectName\":\"\",\"ObjectType\":\"Resource\",\"RawEventData\":\"{\\\"AccountMoniker\\\":\\\"MdsResourceStackRPFCentralUS\\\",\\\"AccountMonikerLocation\\\":\\\"centralus\\\"}\",\"ReportId\":\"366c7d2f964643f736af67ec54d23d4d729b1f17478ea94b05ad53a47a812345\",\"Timestamp\":\"2022-12-08T12:48:45.833Z\",\"UserAgent\":null,\"UserAgentTags\":null},\"tenantId\":\"8df34af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-12-08T12:52:23.6440369Z\"}", "type": [ "info" ] @@ -300,12 +292,8 @@ "preserve_duplicate_custom_fields" ], "user": { - "id": [ - "007c979b-47e7-4747-b9a3-58de6bd12345" - ], - "name": [ - "name" - ] + "id": "007c979b-47e7-4747-b9a3-58de6bd12345", + "name": "name" } }, { @@ -315,14 +303,13 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "samr-query", - "kind": [ - "event" - ], - "original": "{\"time\": \"2023-06-21T11:55:44.4674988Z\", \"tenantId\": \"25cba38d-0984-4f37-b801-5ea07c659887\", \"operationName\": \"Publish\", \"category\": \"AdvancedHunting-IdentityQueryEvents\", \"properties\": {\"ActionType\":\"SAMR query\",\"QueryTarget\":\"Server_Admin\",\"Protocol\":\"Samr\",\"AccountDisplayName\":\"D2WXA1303R$\",\"AccountUpn\":null,\"AccountName\":null,\"AccountDomain\":null,\"AccountSid\":null,\"AccountObjectId\":null,\"Query\":null,\"IPAddress\":\"10.180.101.20\",\"Location\":null,\"DeviceName\":\"d2wxa1303r.d300b.cenlar.com\",\"QueryType\":\"QueryGroup\",\"DestinationDeviceName\":\"d2win02r.d300b.cenlar.com\",\"TargetAccountDisplayName\":null,\"TargetDeviceName\":null,\"Port\":58210,\"DestinationPort\":445,\"DestinationIPAddress\":\"10.180.100.81\",\"TargetAccountUpn\":null,\"AdditionalFields\":{\"AttackTechniques\":\"Permission Groups Discovery (T1069), Account Discovery (T1087), Domain Groups (T1069.002), Domain Account (T1087.002)\",\"Category\":\"Discovery\",\"TO.DEVICE\":\"D2WIN02R\",\"ACTOR.DEVICE\":\"D2WXA1303R\",\"DestinationComputerOperatingSystemType\":\"windows\",\"SourceComputerOperatingSystem\":\"windows server 2019 datacenter\",\"Count\":\"1\",\"SourceComputerOperatingSystemType\":\"windows\",\"SourceAccountId\":\"b7c4b4f6-3240-4a67-8255-d5694015588c\",\"SourceComputerOperatingSystemVersion\":\"10.0 (17763)\",\"DestinationComputerOperatingSystem\":\"windows server 2012 datacenter\",\"SourceComputerObjectGuid\":\"b7c4b4f6-3240-4a67-8255-d5694015588c\",\"DestinationComputerOperatingSystemVersion\":\"6.2 (9200)\",\"SourceAccountSid\":\"S-1-5-21-621940831-1238047941-1264475144-86894\",\"FROM.DEVICE\":\"D2WXA1303R\",\"DestinationComputerObjectGuid\":\"370f6773-bfd8-4356-8e83-e65a1a9b3469\"},\"ReportId\":\"5006fead-26b0-4443-8118-5838aef430eb_108408875_1687348229598_20940\",\"Timestamp\":\"2023-06-21T11:50:29.598Z\",\"Application\":\"Active Directory\"}, \"Tenant\": \"DefaultTenant\"}", + "id": "5006fead-26b0-4443-8118-5838aef430eb_108408875_1687348229598_20940", + "kind": "event", + "original": "{\"time\": \"2023-06-21T11:55:44.4674988Z\", \"tenantId\": \"25cba38d-0984-4f37-b801-5ea07c659887\", \"operationName\": \"Publish\", \"category\": \"AdvancedHunting-IdentityQueryEvents\", \"properties\": {\"ActionType\":\"SAMR query\",\"QueryTarget\":\"Server_Admin\",\"Protocol\":\"Samr\",\"AccountDisplayName\":\"D2WXA1303R$\",\"AccountUpn\":null,\"AccountName\":null,\"AccountDomain\":null,\"AccountSid\":null,\"AccountObjectId\":null,\"Query\":null,\"IPAddress\":\"10.180.101.20\",\"Location\":null,\"DeviceName\":\"d2wxa1303r.d300b.cenlar.com\",\"QueryType\":\"QueryGroup\",\"DestinationDeviceName\":\"d2win02r.d300b.cenlar.com\",\"IsAdminOperation\":\"0\",\"TargetAccountDisplayName\":null,\"TargetDeviceName\":null,\"Port\":58210,\"DestinationPort\":445,\"DestinationIPAddress\":\"10.180.100.81\",\"TargetAccountUpn\":null,\"AdditionalFields\":{\"AttackTechniques\":\"Permission Groups Discovery (T1069), Account Discovery (T1087), Domain Groups (T1069.002), Domain Account (T1087.002)\",\"Category\":\"Discovery\",\"TO.DEVICE\":\"D2WIN02R\",\"ACTOR.DEVICE\":\"D2WXA1303R\",\"DestinationComputerOperatingSystemType\":\"windows\",\"SourceComputerOperatingSystem\":\"windows server 2019 datacenter\",\"Count\":\"1\",\"SourceComputerOperatingSystemType\":\"windows\",\"SourceAccountId\":\"b7c4b4f6-3240-4a67-8255-d5694015588c\",\"SourceComputerOperatingSystemVersion\":\"10.0 (17763)\",\"DestinationComputerOperatingSystem\":\"windows server 2012 datacenter\",\"SourceComputerObjectGuid\":\"b7c4b4f6-3240-4a67-8255-d5694015588c\",\"DestinationComputerOperatingSystemVersion\":\"6.2 (9200)\",\"SourceAccountSid\":\"S-1-5-21-621940831-1238047941-1264475144-86894\",\"FROM.DEVICE\":\"D2WXA1303R\",\"DestinationComputerObjectGuid\":\"370f6773-bfd8-4356-8e83-e65a1a9b3469\"},\"ReportId\":\"5006fead-26b0-4443-8118-5838aef430eb_108408875_1687348229598_20940\",\"Timestamp\":\"2023-06-21T11:50:29.598Z\",\"Application\":\"Active Directory\"}, \"Tenant\": \"DefaultTenant\"}", "type": [ "info" ] @@ -368,6 +355,7 @@ "name": "d2wxa1303r.d300b.cenlar.com" }, "ip_address": "10.180.101.20", + "is_admin_operation": false, "operation_name": "Publish", "port": 58210, "protocol": "Samr", @@ -404,9 +392,7 @@ "preserve_duplicate_custom_fields" ], "user": { - "name": [ - "D2WXA1303R$" - ] + "name": "D2WXA1303R$" } }, { @@ -416,14 +402,13 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dns-query", - "kind": [ - "event" - ], - "original": "{\"time\": \"2023-06-21T11:55:46.0067676Z\", \"tenantId\": \"25cba38d-0984-4f37-b801-5ea07c659887\", \"operationName\": \"Publish\", \"category\": \"AdvancedHunting-IdentityQueryEvents\", \"properties\": {\"ActionType\":\"DNS query\",\"QueryTarget\":\"_grpc_config.useast-comms.dgsecure.com\",\"Protocol\":\"Dns\",\"AccountDisplayName\":null,\"AccountUpn\":null,\"AccountName\":null,\"AccountDomain\":null,\"AccountSid\":null,\"AccountObjectId\":null,\"Query\":null,\"IPAddress\":\"10.173.130.18\",\"Location\":null,\"DeviceName\":\"d1wrpws12d.d300b.cenlar.com\",\"QueryType\":\"Text\",\"DestinationDeviceName\":\"d1win02p.d300b.cenlar.com\",\"TargetAccountDisplayName\":null,\"TargetDeviceName\":null,\"Port\":57396,\"DestinationPort\":53,\"DestinationIPAddress\":\"10.170.100.81\",\"TargetAccountUpn\":null,\"AdditionalFields\":{\"SourceComputerOperatingSystemVersion\":\"10.0 (19044)\",\"TO.DEVICE\":\"D1WIN02P\",\"DestinationComputerOperatingSystem\":\"windows server 2012 datacenter\",\"DestinationComputerOperatingSystemType\":\"windows\",\"SourceComputerObjectGuid\":\"73938f34-664b-4d63-9b31-ada0c8060676\",\"DestinationComputerOperatingSystemVersion\":\"6.2 (9200)\",\"SourceComputerOperatingSystem\":\"windows 10 enterprise\",\"Count\":\"2\",\"SourceComputerOperatingSystemType\":\"windows\",\"FROM.DEVICE\":\"D1WRPWS12D\",\"DestinationComputerObjectGuid\":\"dfa29ee1-8b5c-400b-8608-4f4330bf9ed2\"},\"ReportId\":\"8923586f-1fc6-4393-afa0-5579dba38b0a_108408875_1687348398643_20940\",\"Timestamp\":\"2023-06-21T11:53:18.643Z\",\"Application\":\"Active Directory\"}, \"Tenant\": \"DefaultTenant\"}", + "id": "8923586f-1fc6-4393-afa0-5579dba38b0a_108408875_1687348398643_20940", + "kind": "event", + "original": "{\"time\": \"2023-06-21T11:55:46.0067676Z\", \"tenantId\": \"25cba38d-0984-4f37-b801-5ea07c659887\", \"operationName\": \"Publish\", \"category\": \"AdvancedHunting-IdentityQueryEvents\", \"properties\": {\"ActionType\":\"DNS query\",\"QueryTarget\":\"_grpc_config.useast-comms.dgsecure.com\",\"Protocol\":\"Dns\",\"AccountDisplayName\":null,\"AccountUpn\":null,\"AccountName\":null,\"AccountDomain\":null,\"AccountSid\":null,\"AccountObjectId\":null,\"Query\":null,\"IPAddress\":\"10.173.130.18\",\"Location\":null,\"DeviceName\":\"d1wrpws12d.d300b.cenlar.com\",\"QueryType\":\"Text\",\"DestinationDeviceName\":\"d1win02p.d300b.cenlar.com\",\"IsAdminOperation\":false,\"TargetAccountDisplayName\":null,\"TargetDeviceName\":null,\"Port\":57396,\"DestinationPort\":53,\"DestinationIPAddress\":\"10.170.100.81\",\"TargetAccountUpn\":null,\"AdditionalFields\":{\"SourceComputerOperatingSystemVersion\":\"10.0 (19044)\",\"TO.DEVICE\":\"D1WIN02P\",\"DestinationComputerOperatingSystem\":\"windows server 2012 datacenter\",\"DestinationComputerOperatingSystemType\":\"windows\",\"SourceComputerObjectGuid\":\"73938f34-664b-4d63-9b31-ada0c8060676\",\"DestinationComputerOperatingSystemVersion\":\"6.2 (9200)\",\"SourceComputerOperatingSystem\":\"windows 10 enterprise\",\"Count\":\"2\",\"SourceComputerOperatingSystemType\":\"windows\",\"FROM.DEVICE\":\"D1WRPWS12D\",\"DestinationComputerObjectGuid\":\"dfa29ee1-8b5c-400b-8608-4f4330bf9ed2\"},\"ReportId\":\"8923586f-1fc6-4393-afa0-5579dba38b0a_108408875_1687348398643_20940\",\"Timestamp\":\"2023-06-21T11:53:18.643Z\",\"Application\":\"Active Directory\"}, \"Tenant\": \"DefaultTenant\"}", "type": [ "info" ] @@ -461,6 +446,7 @@ "name": "d1wrpws12d.d300b.cenlar.com" }, "ip_address": "10.173.130.18", + "is_admin_operation": false, "operation_name": "Publish", "port": 57396, "protocol": "Dns", diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log index 650a828a2aa..7ff7c783014 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log @@ -1,10 +1,26 @@ -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceEvents","operationName":"Publish","properties":{"AccountDomain":null,"AccountName":null,"AccountSid":null,"ActionType":"DpapiAccessed","AdditionalFields":"{\"CallerProcessID\":4248}","AppGuardContainerId":"","DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":null,"FileOriginIP":null,"FileOriginUrl":null,"FileSize":329,"FolderPath":null,"InitiatingProcessAccountDomain":"testmachine5","InitiatingProcessAccountName":"administrator1","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-21-375308137-164487297-2828222098-111","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"\"backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca","InitiatingProcessCreationTime":"2022-11-07T17:07:41.698868Z","InitiatingProcessFileName":"backgroundtaskhost.exe","InitiatingProcessFileSize":19776,"InitiatingProcessFolderPath":"c:\\windows\\system32\\backgroundtaskhost.exe","InitiatingProcessId":4248,"InitiatingProcessLogonId":1431021,"InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-07T16:34:27.0112578Z","InitiatingProcessParentFileName":"svchost.exe","InitiatingProcessParentId":948,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Background Task Host","InitiatingProcessVersionInfoInternalFileName":"Background Task Host","InitiatingProcessVersionInfoOriginalFileName":"backgroundTaskHost.exe","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.546","LocalIP":null,"LocalPort":null,"LogonId":null,"MD5":null,"MachineGroup":"UnassignedGroup","ProcessCommandLine":null,"ProcessCreationTime":null,"ProcessId":null,"ProcessTokenElevation":null,"RegistryKey":null,"RegistryValueData":null,"RegistryValueName":null,"RemoteDeviceName":null,"RemoteIP":null,"RemotePort":null,"RemoteUrl":null,"ReportId":2833,"SHA1":null,"SHA256":null,"Timestamp":"2022-11-07T17:07:42.0259186Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:45:56.3057929Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceEvents","operationName":"Publish","properties":{"AccountDomain":null,"AccountName":null,"AccountSid":null,"ActionType":"DpapiAccessed","AdditionalFields":"{\"CallerProcessID\":4248}","AppGuardContainerId":null,"DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":null,"FileOriginIP":null,"FileOriginUrl":null,"FileSize":329,"FolderPath":null,"InitiatingProcessAccountDomain":"testmachine5","InitiatingProcessAccountName":"administrator1","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-21-375308137-164487297-2828222098-111","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"\"backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca","InitiatingProcessCreationTime":"2022-11-07T17:07:41.698868Z","InitiatingProcessFileName":"backgroundtaskhost.exe","InitiatingProcessFileSize":19776,"InitiatingProcessFolderPath":"c:\\windows\\system32\\backgroundtaskhost.exe","InitiatingProcessId":4248,"InitiatingProcessLogonId":1431021,"InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-07T16:34:27.0112578Z","InitiatingProcessParentFileName":"svchost.exe","InitiatingProcessParentId":948,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Background Task Host","InitiatingProcessVersionInfoInternalFileName":"Background Task Host","InitiatingProcessVersionInfoOriginalFileName":"backgroundTaskHost.exe","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.546","LocalIP":null,"LocalPort":null,"LogonId":null,"MD5":null,"MachineGroup":"UnassignedGroup","ProcessCommandLine":null,"ProcessCreationTime":null,"ProcessId":null,"ProcessTokenElevation":null,"RegistryKey":null,"RegistryValueData":null,"RegistryValueName":null,"RemoteDeviceName":null,"RemoteIP":null,"RemotePort":null,"RemoteUrl":null,"ReportId":2833,"SHA1":null,"SHA256":null,"Timestamp":"2022-11-07T17:07:42.0259186Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:45:56.3057929Z"} {"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceFileCertificateInfo","operationName":"Publish","properties":{"CertificateCountersignatureTime":"2022-05-25T15:28:57.628Z","CertificateCreationTime":"2021-09-02T18:23:41Z","CertificateExpirationTime":"2022-09-01T18:23:41Z","CertificateSerialNumber":"330000033b655faefadb75e9d6000000012345","CrlDistributionPointUrls":"[\"http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl\"]","DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","IsRootSignerMicrosoft":true,"IsSigned":true,"IsTrusted":true,"Issuer":"Microsoft Windows Production PCA 2011","IssuerHash":"580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d","MachineGroup":"UnassignedGroup","ReportId":2486,"SHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","SignatureType":"Embedded","Signer":"Microsoft Windows","SignerHash":"e168609353f30ff2373157b4eb8cd519d07a2bff","Timestamp":"2022-11-07T17:00:58.1501482Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:11:16.2074367Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceFileEvents","operationName":"Publish","properties":{"ActionType":"FileCreated","AdditionalFields":null,"AppGuardContainerId":"","DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":"VMAgentDisabler.dll","FileOriginIP":null,"FileOriginReferrerUrl":null,"FileOriginUrl":null,"FileSize":139848,"FolderPath":"C:\\Windows\\System32\\VMAgentDisabler.dll","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"WaAppAgent.exe","InitiatingProcessCreationTime":"2022-11-07T16:45:10.3952444Z","InitiatingProcessFileName":"WaAppAgent.exe","InitiatingProcessFileSize":91360,"InitiatingProcessFolderPath":"c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe","InitiatingProcessId":5692,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-07T16:34:26.5433488Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":812,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Microsoft Azure®","InitiatingProcessVersionInfoInternalFileName":"WaAppAgent","InitiatingProcessVersionInfoOriginalFileName":"WaAppAgent.exe","InitiatingProcessVersionInfoProductName":"Microsoft® CoReXT","InitiatingProcessVersionInfoProductVersion":"2.7.41491.1057","IsAzureInfoProtectionApplied":null,"MD5":"b41a36dcfd9295b503b6bbc90bc12345","MachineGroup":"UnassignedGroup","PreviousFileName":"","PreviousFolderPath":"","ReportId":112,"RequestAccountDomain":"NT AUTHORITY","RequestAccountName":"SYSTEM","RequestAccountSid":"S-1-5-18","RequestProtocol":"Local","RequestSourceIP":null,"RequestSourcePort":null,"SHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","SHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","SensitivityLabel":null,"SensitivitySubLabel":null,"ShareName":null,"Timestamp":"2022-11-07T16:45:21.2119114Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:20:21.0560538Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceImageLoadEvents","operationName":"Publish","properties":{"ActionType":"ImageLoaded","AppGuardContainerId":"","DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":"System.Management.ni.dll","FileSize":1458688,"FolderPath":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\8af759007c012da690062882e06694f1\\System.Management.ni.dll","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"WaAppAgent.exe","InitiatingProcessCreationTime":"2022-11-07T16:45:10.3952444Z","InitiatingProcessFileName":"waappagent.exe","InitiatingProcessFileSize":91360,"InitiatingProcessFolderPath":"c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe","InitiatingProcessId":5692,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"ac71a4a58ffeb96a5d4724c1849ac456","InitiatingProcessParentCreationTime":"2022-11-07T16:34:26.5433488Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":812,"InitiatingProcessSHA1":"2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a","InitiatingProcessSHA256":"1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Microsoft Azure®","InitiatingProcessVersionInfoInternalFileName":"WaAppAgent","InitiatingProcessVersionInfoOriginalFileName":"WaAppAgent.exe","InitiatingProcessVersionInfoProductName":"Microsoft® CoReXT","InitiatingProcessVersionInfoProductVersion":"2.7.41491.1057","MD5":"01a97134d9927a4001649b1d9ff25397","MachineGroup":"UnassignedGroup","ReportId":93,"SHA1":"1bc67905ae5c8e81014aa4290a338ace6a3b103e","SHA256":"62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a","Timestamp":"2022-11-07T16:45:19.295067Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:20:52.5604763Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceInfo","operationName":"Publish","properties":{"AadDeviceId":null,"AdditionalFields":"[]","ClientVersion":"10.8210.19041.2006","DeviceCategory":"Endpoint","DeviceId":"999b6fd7c532534ba50b3232fa992c38a2712345","DeviceName":"testmachine6","DeviceSubtype":null,"DeviceType":"Workstation","IsAzureADJoined":false,"JoinType":"","LoggedOnUsers":"[{\"UserName\":\"administrator1\"}]","MachineGroup":"UnassignedGroup","MergedDeviceIds":"","MergedToDeviceId":"","Model":"","OSArchitecture":null,"OSBuild":null,"OSDistribution":"","OSPlatform":null,"OSVersion":null,"OSVersionInfo":"","OnboardingStatus":"Onboarded","PublicIP":"81.2.69.142","RegistryDeviceTag":"evaluation","ReportId":12942,"Timestamp":"2022-11-08T05:56:25.8832339Z","Vendor":""},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-08T06:01:15.8987913Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceLogonEvents","operationName":"Publish","properties":{"AccountDomain":null,"AccountName":"administrator","AccountSid":null,"ActionType":"LogonFailed","AdditionalFields":"{\"IsLocalLogon\":true}","AppGuardContainerId":"","DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","FailureReason":"InvalidUserNameOrPassword","InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessFolderPath":null,"InitiatingProcessId":0,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessMD5":null,"InitiatingProcessParentCreationTime":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId":0,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessTokenElevation":"None","InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"IsLocalAdmin":null,"LogonId":null,"LogonType":"Network","MachineGroup":"UnassignedGroup","Protocol":"NTLM","RemoteDeviceName":"","RemoteIP":"67.43.156.1","RemoteIPType":"Public","RemotePort":0,"ReportId":3551,"Timestamp":"2022-11-09T17:47:28.8167685Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T17:51:33.5625286Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"ActionType":"NetworkSignatureInspected","AdditionalFields":"{\"SignatureName\":\"HTTP_Server\"}","AppGuardContainerId":"","DeviceId":"999b6fd7c532534ba50b3232fa992c38a2712345","DeviceName":"testmachine6","InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessFolderPath":null,"InitiatingProcessId":0,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessMD5":null,"InitiatingProcessParentCreationTime":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId":0,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessTokenElevation":"None","InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"LocalIP":"81.2.69.144","LocalIPType":null,"LocalPort":80,"MachineGroup":"UnassignedGroup","Protocol":null,"RemoteIP":"81.2.69.142","RemoteIPType":null,"RemotePort":50094,"RemoteUrl":null,"ReportId":2321,"Timestamp":"2022-11-09T17:43:28.18835Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T17:47:35.5577637Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkInfo","operationName":"Publish","properties":{"ConnectedNetworks":"[{\"Name\":\"Network\",\"Description\":\"Network\",\"IsConnectedToInternet\":true,\"Category\":\"Public\"}]","DefaultGateways":"[\"67.43.156.5\"]","DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","DnsAddresses":"[\"67.43.156.2\"]","IPAddresses":"[{\"IPAddress\":\"67.43.156.0\",\"SubnetPrefix\":26,\"AddressType\":\"Private\"},{\"IPAddress\":\"fe80::39f0:832a:89a1:f6e1\",\"SubnetPrefix\":64,\"AddressType\":\"Private\"}]","IPv4Dhcp":"67.43.156.2","IPv6Dhcp":"","MacAddress":"000D3A9EC781","MachineGroup":"UnassignedGroup","NetworkAdapterName":"{31D7786C-13B8-421D-A3D8-308787B9A9FF}","NetworkAdapterStatus":"Up","NetworkAdapterType":"Ethernet","NetworkAdapterVendor":null,"ReportId":4700,"Timestamp":"2022-11-09T17:54:53.5345682Z","TunnelType":"None"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T18:00:01.8319849Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceProcessEvents","operationName":"Publish","properties":{"AccountDomain":"testmachine6","AccountName":"administrator1","AccountObjectId":null,"AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountUpn":null,"ActionType":"ProcessCreated","AdditionalFields":null,"AppGuardContainerId":"","DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","FileName":"smartscreen.exe","FileSize":2387456,"FolderPath":"C:\\Windows\\System32\\smartscreen.exe","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"svchost.exe -k DcomLaunch -p","InitiatingProcessCreationTime":"2022-11-09T17:39:34.1193719Z","InitiatingProcessFileName":"svchost.exe","InitiatingProcessFileSize":55320,"InitiatingProcessFolderPath":"c:\\windows\\system32\\svchost.exe","InitiatingProcessId":996,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessLogonId":999,"InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-09T17:39:33.8279942Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":852,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessSignatureStatus":"Valid","InitiatingProcessSignerType":"OsVendor","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Host Process for Windows Services","InitiatingProcessVersionInfoInternalFileName":"svchost.exe","InitiatingProcessVersionInfoOriginalFileName":"svchost.exe","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.1806","LogonId":1443318,"MD5":"b9d697df9e883f0d99720b0430448cb1","MachineGroup":"UnassignedGroup","ProcessCommandLine":"smartscreen.exe -Embedding","ProcessCreationTime":"2022-11-09T17:59:52.0344972Z","ProcessId":6412,"ProcessIntegrityLevel":"High","ProcessTokenElevation":"TokenElevationTypeDefault","ProcessVersionInfoCompanyName":"Microsoft Corporation","ProcessVersionInfoFileDescription":"Windows Defender SmartScreen","ProcessVersionInfoInternalFileName":"smartscreen.exe","ProcessVersionInfoOriginalFileName":"smartscreen.exe","ProcessVersionInfoProductName":"Microsoft® Windows® Operating System","ProcessVersionInfoProductVersion":"10.0.19041.2251","ReportId":4824,"SHA1":"9dec87de894f5228033f87cf874441502bfa4f97","SHA256":"8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781","Timestamp":"2022-11-09T17:59:52.6265786Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T18:03:21.9948950Z"} -{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceRegistryEvents","operationName":"Publish","properties":{"ActionType":"RegistryValueSet","AppGuardContainerId":"","DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive","InitiatingProcessCreationTime":"2022-11-09T19:17:20.4156553Z","InitiatingProcessFileName":"powershell.exe","InitiatingProcessFileSize":452608,"InitiatingProcessFolderPath":"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe","InitiatingProcessId":5900,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"04029e121a0cfa5991749937dd22a1d9","InitiatingProcessParentCreationTime":"2022-11-09T19:16:54.9433819Z","InitiatingProcessParentFileName":"SenseIR.exe","InitiatingProcessParentId":5668,"InitiatingProcessSHA1":"f43d9bb316e30ae1a3494ac5b0624f6bea1bf054","InitiatingProcessSHA256":"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Windows PowerShell","InitiatingProcessVersionInfoInternalFileName":"POWERSHELL","InitiatingProcessVersionInfoOriginalFileName":"PowerShell.EXE","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.546","MachineGroup":"UnassignedGroup","PreviousRegistryKey":"","PreviousRegistryValueData":null,"PreviousRegistryValueName":"Blob","RegistryKey":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\Windows Live ID Token Issuer\\Certificates\\B68D8F953E551914324E557E6164D68B9926650C","RegistryValueData":null,"RegistryValueName":"Blob","RegistryValueType":"Binary","ReportId":6571,"Timestamp":"2022-11-09T19:17:43.5752234Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T19:23:21.8925266Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceFileEvents","operationName":"Publish","properties":{"ActionType":"FileCreated","AdditionalFields":null,"AppGuardContainerId":null,"DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":"VMAgentDisabler.dll","FileOriginIP":null,"FileOriginReferrerUrl":null,"FileOriginUrl":null,"FileSize":139848,"FolderPath":"C:\\Windows\\System32\\VMAgentDisabler.dll","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"WaAppAgent.exe","InitiatingProcessCreationTime":"2022-11-07T16:45:10.3952444Z","InitiatingProcessFileName":"WaAppAgent.exe","InitiatingProcessFileSize":91360,"InitiatingProcessFolderPath":"c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe","InitiatingProcessId":5692,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-07T16:34:26.5433488Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":812,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Microsoft Azure®","InitiatingProcessVersionInfoInternalFileName":"WaAppAgent","InitiatingProcessVersionInfoOriginalFileName":"WaAppAgent.exe","InitiatingProcessVersionInfoProductName":"Microsoft® CoReXT","InitiatingProcessVersionInfoProductVersion":"2.7.41491.1057","IsAzureInfoProtectionApplied":null,"MD5":"b41a36dcfd9295b503b6bbc90bc12345","MachineGroup":"UnassignedGroup","PreviousFileName":null,"PreviousFolderPath":null,"ReportId":112,"RequestAccountDomain":"NT AUTHORITY","RequestAccountName":"SYSTEM","RequestAccountSid":"S-1-5-18","RequestProtocol":"Local","RequestSourceIP":null,"RequestSourcePort":null,"SHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","SHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","SensitivityLabel":null,"SensitivitySubLabel":null,"ShareName":null,"Timestamp":"2022-11-07T16:45:21.2119114Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:20:21.0560538Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceImageLoadEvents","operationName":"Publish","properties":{"ActionType":"ImageLoaded","AppGuardContainerId":null,"DeviceId":"de6509d550e605faf3bbeac0905ab9590fe12345","DeviceName":"testmachine5","FileName":"System.Management.ni.dll","FileSize":1458688,"FolderPath":"C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\8af759007c012da690062882e06694f1\\System.Management.ni.dll","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"WaAppAgent.exe","InitiatingProcessCreationTime":"2022-11-07T16:45:10.3952444Z","InitiatingProcessFileName":"waappagent.exe","InitiatingProcessFileSize":91360,"InitiatingProcessFolderPath":"c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe","InitiatingProcessId":5692,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"ac71a4a58ffeb96a5d4724c1849ac456","InitiatingProcessParentCreationTime":"2022-11-07T16:34:26.5433488Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":812,"InitiatingProcessSHA1":"2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a","InitiatingProcessSHA256":"1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Microsoft Azure®","InitiatingProcessVersionInfoInternalFileName":"WaAppAgent","InitiatingProcessVersionInfoOriginalFileName":"WaAppAgent.exe","InitiatingProcessVersionInfoProductName":"Microsoft® CoReXT","InitiatingProcessVersionInfoProductVersion":"2.7.41491.1057","MD5":"01a97134d9927a4001649b1d9ff25397","MachineGroup":"UnassignedGroup","ReportId":93,"SHA1":"1bc67905ae5c8e81014aa4290a338ace6a3b103e","SHA256":"62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a","Timestamp":"2022-11-07T16:45:19.295067Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-07T17:20:52.5604763Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceInfo","operationName":"Publish","properties":{"AadDeviceId":null,"AdditionalFields":null,"AssetValue":"testvalue","IsInternetFacing":true,"DeviceManualTags":"testtags","DeviceDynamicTags":"testdynamictags","ExposureLevel":"testlevel","SensorHealthState":"somestatus","ExclusionReason":"somereason","IsExcluded":false,"ClientVersion":"10.8210.19041.2006","DeviceCategory":"Endpoint","DeviceId":"999b6fd7c532534ba50b3232fa992c38a2712345","DeviceName":"testmachine6","DeviceSubtype":null,"DeviceType":"Workstation","IsAzureADJoined":false,"JoinType":null,"LoggedOnUsers":"[{\"UserName\":\"administrator1\"}, {\"UserName\":\"administrator2\"}]","MachineGroup":"UnassignedGroup","MergedDeviceIds":null,"MergedToDeviceId":null,"Model":null,"OSArchitecture":null,"OSBuild":null,"OSDistribution":null,"OSPlatform":null,"OSVersion":null,"OSVersionInfo":null,"OnboardingStatus":"Onboarded","PublicIP":"81.2.69.142","RegistryDeviceTag":"evaluation","ReportId":12942,"Timestamp":"2022-11-08T05:56:25.8832339Z","Vendor":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-08T06:01:15.8987913Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceLogonEvents","operationName":"Publish","properties":{"AccountDomain":null,"AccountName":"administrator","AccountSid":null,"ActionType":"LogonFailed","AdditionalFields":"{\"IsLocalLogon\":true}","AppGuardContainerId":null,"DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","FailureReason":"InvalidUserNameOrPassword","InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessFolderPath":null,"InitiatingProcessId":0,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessMD5":null,"InitiatingProcessParentCreationTime":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId":0,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessTokenElevation":"None","InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"IsLocalAdmin":null,"LogonId":null,"LogonType":"Network","MachineGroup":"UnassignedGroup","Protocol":"NTLM","RemoteDeviceName":null,"RemoteIP":"67.43.156.1","RemoteIPType":"Public","RemotePort":0,"ReportId":3551,"Timestamp":"2022-11-09T17:47:28.8167685Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T17:51:33.5625286Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"ActionType":"NetworkSignatureInspected","AdditionalFields":"{\"SignatureName\":\"HTTP_Server\"}","AppGuardContainerId":null,"DeviceId":"999b6fd7c532534ba50b3232fa992c38a2712345","DeviceName":"testmachine6","InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessFolderPath":null,"InitiatingProcessId":0,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessMD5":null,"InitiatingProcessParentCreationTime":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId":0,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessTokenElevation":"None","InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"LocalIP":"81.2.69.144","LocalIPType":null,"LocalPort":80,"MachineGroup":"UnassignedGroup","Protocol":null,"RemoteIP":"81.2.69.142","RemoteIPType":null,"RemotePort":50094,"RemoteUrl":null,"ReportId":2321,"Timestamp":"2022-11-09T17:43:28.18835Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T17:47:35.5577637Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkInfo","operationName":"Publish","properties":{"ConnectedNetworks":"[{\"Name\":\"Network\",\"Description\":\"Network\",\"IsConnectedToInternet\":true,\"Category\":\"Public\"}, {\"Name\":\"Network2\",\"Description\":\"Network2\",\"IsConnectedToInternet\":true,\"Category\":\"Public2\"}]","DefaultGateways":"[\"67.43.156.5\"]","DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","DnsAddresses":"[\"67.43.156.2\"]","IPAddresses":"[{\"IPAddress\":\"67.43.156.0\",\"SubnetPrefix\":26,\"AddressType\":\"Private\"},{\"IPAddress\":\"fe80::39f0:832a:89a1:f6e1\",\"SubnetPrefix\":64,\"AddressType\":\"Private\"},{\"IPAddress\":\"67.43.156.1\",\"SubnetPrefix\":26,\"AddressType\":\"Private1\"},{\"IPAddress\":\"fe80::39f0:832a:89a1:f6e2\",\"SubnetPrefix\":64,\"AddressType\":\"Private2\"}]","IPv4Dhcp":"67.43.156.2","IPv6Dhcp":null,"MacAddress":"000D3A9EC781","MachineGroup":"UnassignedGroup","NetworkAdapterName":"{31D7786C-13B8-421D-A3D8-308787B9A9FF}","NetworkAdapterStatus":"Up","NetworkAdapterType":"Ethernet","NetworkAdapterVendor":null,"ReportId":4700,"Timestamp":"2022-11-09T17:54:53.5345682Z","TunnelType":"None"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T18:00:01.8319849Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceProcessEvents","operationName":"Publish","properties":{"AccountDomain":"testmachine6","AccountName":"administrator1","AccountObjectId":null,"AccountSid":"S-1-5-21-1874808502-2282282112-3464708742-500","AccountUpn":null,"ActionType":"ProcessCreated","AdditionalFields":"[]","AppGuardContainerId":null,"DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","FileName":"smartscreen.exe","FileSize":2387456,"FolderPath":"C:\\Windows\\System32\\smartscreen.exe","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"svchost.exe -k DcomLaunch -p","InitiatingProcessCreationTime":"2022-11-09T17:39:34.1193719Z","InitiatingProcessFileName":"svchost.exe","InitiatingProcessFileSize":55320,"InitiatingProcessFolderPath":"c:\\windows\\system32\\svchost.exe","NetworkAdapterName":"en01","InitiatingProcessId":996,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessLogonId":999,"InitiatingProcessMD5":"b7f884c1b74a263f746ee12a5f7c9f6a","InitiatingProcessParentCreationTime":"2022-11-09T17:39:33.8279942Z","InitiatingProcessParentFileName":"services.exe","InitiatingProcessParentId":852,"InitiatingProcessSHA1":"1bc5066ddf693fc034d6514618854e26a84fd0d1","InitiatingProcessSHA256":"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88","InitiatingProcessSignatureStatus":"Valid","InitiatingProcessSignerType":"OsVendor","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Host Process for Windows Services","InitiatingProcessVersionInfoInternalFileName":"svchost.exe","InitiatingProcessVersionInfoOriginalFileName":"svchost.exe","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.1806","LogonId":1443318,"MD5":"b9d697df9e883f0d99720b0430448cb1","MachineGroup":"UnassignedGroup","ProcessCommandLine":"smartscreen.exe -Embedding","ProcessCreationTime":"2022-11-09T17:59:52.0344972Z","ProcessId":6412,"ProcessIntegrityLevel":"High","ProcessTokenElevation":"TokenElevationTypeDefault","ProcessVersionInfoCompanyName":"Microsoft Corporation","ProcessVersionInfoFileDescription":"Windows Defender SmartScreen","ProcessVersionInfoInternalFileName":"smartscreen.exe","ProcessVersionInfoOriginalFileName":"smartscreen.exe","ProcessVersionInfoProductName":"Microsoft® Windows® Operating System","ProcessVersionInfoProductVersion":"10.0.19041.2251","ReportId":4824,"SHA1":"9dec87de894f5228033f87cf874441502bfa4f97","SHA256":"8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781","Timestamp":"2022-11-09T17:59:52.6265786Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T18:03:21.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceRegistryEvents","operationName":"Publish","properties":{"ActionType":"RegistryValueSet","AppGuardContainerId":null,"DeviceId":"999b6fd7c532534ba50b3232fa992c38a273d4fb","DeviceName":"testmachine6","InitiatingProcessAccountDomain":"nt authority","InitiatingProcessAccountName":"system","InitiatingProcessAccountObjectId":null,"InitiatingProcessAccountSid":"S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessCommandLine":"powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive","InitiatingProcessCreationTime":"2022-11-09T19:17:20.4156553Z","InitiatingProcessFileName":"powershell.exe","InitiatingProcessFileSize":452608,"InitiatingProcessFolderPath":"c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe","InitiatingProcessId":5900,"InitiatingProcessIntegrityLevel":"System","InitiatingProcessMD5":"04029e121a0cfa5991749937dd22a1d9","InitiatingProcessParentCreationTime":"2022-11-09T19:16:54.9433819Z","InitiatingProcessParentFileName":"SenseIR.exe","InitiatingProcessParentId":5668,"InitiatingProcessSHA1":"f43d9bb316e30ae1a3494ac5b0624f6bea1bf054","InitiatingProcessSHA256":"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f","InitiatingProcessTokenElevation":"TokenElevationTypeDefault","InitiatingProcessVersionInfoCompanyName":"Microsoft Corporation","InitiatingProcessVersionInfoFileDescription":"Windows PowerShell","InitiatingProcessVersionInfoInternalFileName":"POWERSHELL","InitiatingProcessVersionInfoOriginalFileName":"PowerShell.EXE","InitiatingProcessVersionInfoProductName":"Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion":"10.0.19041.546","MachineGroup":"UnassignedGroup","PreviousRegistryKey":null,"PreviousRegistryValueData":null,"PreviousRegistryValueName":"Blob","RegistryKey":"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\Windows Live ID Token Issuer\\Certificates\\B68D8F953E551914324E557E6164D68B9926650C","RegistryValueData":null,"RegistryValueName":"Blob","RegistryValueType":"Binary","ReportId":6571,"Timestamp":"2022-11-09T19:17:43.5752234Z"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2022-11-09T19:23:21.8925266Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:17:42.7782364Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "ConnectionFailed","RemoteIP": "175.16.199.0","RemotePort": 80,"RemoteUrl": "subdomain.domain.tld","LocalIP": "89.160.20.112","LocalPort": 50258,"Protocol": "Tcp","LocalIPType": "Private","RemoteIPType": "Public","InitiatingProcessSHA1": "3e44b0d0319d24fa51b472de23062b10c0c32ec3","InitiatingProcessSHA256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb","InitiatingProcessMD5": "df9b3bee634a5578481a8c7cf4f614a3","InitiatingProcessFileName": "msedgewebview2.exe","InitiatingProcessFileSize": 3657056,"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation","InitiatingProcessVersionInfoProductName": "Microsoft Edge WebView2","InitiatingProcessVersionInfoProductVersion": "114.0.1823.79","InitiatingProcessVersionInfoInternalFileName": "msedgewebview2_exe","InitiatingProcessVersionInfoOriginalFileName": "msedgewebview2.exe","InitiatingProcessVersionInfoFileDescription": "Microsoft Edge WebView2","InitiatingProcessId": 17916,"InitiatingProcessCommandLine": "\"msedgewebview2.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"C:\\Users\\username\\AppData\\Local\\Citrix\\SelfService\\CitrixWebControlCache\\EBWebView\" --webview-exe-name=SelfService.exe --webview-exe-version=22.3.1.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3456 --field-trial-handle=1824,i --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=MojoIpcz /prefetch:3 /pfhostedapp:1234","InitiatingProcessCreationTime": "2023-08-09T18:43:00.0810399Z","InitiatingProcessFolderPath": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\114.0.1823.79\\msedgewebview2.exe","InitiatingProcessParentFileName": "msedgewebview2.exe","InitiatingProcessParentId": 17808,"InitiatingProcessParentCreationTime": "2023-08-09T18:42:58.8197327Z","InitiatingProcessAccountDomain": "corporatedomain","InitiatingProcessAccountName": "username","InitiatingProcessAccountSid": "S-1-5-21-57989841-2025429265-839522115-329672","InitiatingProcessAccountUpn": "email@domain","InitiatingProcessAccountObjectId": "3600a12b-9d66-4dc3-9e2a-956c3623d0e4","InitiatingProcessIntegrityLevel": "Medium","InitiatingProcessTokenElevation": "TokenElevationTypeDefault","ReportId": 110313,"AppGuardContainerId":null,"AdditionalFields":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:21.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:10.7489034Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "DnsConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 53,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 54125,"Protocol": "Udp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 19542,"AppGuardContainerId":null,"AdditionalFields": { "direction": "Out", "trans_id": "18296", "rtt": "0.05926012992858887", "query": "janeslaptop1.corporatedomain", "qclass": "1", "qclass_name": "C_INTERNET", "qtype": "1", "qtype_name": "A", "rcode": "0", "uid": "CpeJkh3698EpWwy4Z9", "rcode_name": "NOERROR", "AA": "true", "TC": "false", "RD": "true", "RA": "true", "answers": "[\"89.160.20.112\"]", "TTLs": "[1200.0]", "rejected": "false", "ts": "133370937691236740"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:22.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:28.6231143Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "NtlmAuthenticationInspected","RemoteIP": "175.16.199.0","RemotePort": 135,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 55514,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 33108,"AppGuardContainerId":null,"AdditionalFields": { "direction": "In", "server_nb_computer_name": "hostname", "server_nb_domain_name": "corporatedomain", "server_dns_computer_name": "janeslaptop1.corporatedomain", "server_dns_domain_name": "corporatedomain", "server_tree_name": "corporatedomain", "uid": "Cd6CKC1yC7AvYHXnq", "server_version": "10.0 22621 15", "ts": "133370931234950000"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:23.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:46.7170048Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "NetworkSignatureInspected","RemoteIP": "175.16.199.0","RemotePort": 88,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 52629,"Protocol":null,"LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 33111,"AppGuardContainerId":null,"AdditionalFields": "{\"SignatureName\":\"Kerberos_TGS_REQ\",\"SignatureMatchedContent\":\"%05%A2%01%0C\"}"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:24.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:20:29.9404916Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "HttpConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 8080,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 65132,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 19673,"AppGuardContainerId":null,"AdditionalFields": "{\"direction\":\"Out\",\"host\":\"www.gstatic.com\",\"method\":\"CONNECT\",\"proxied\":\"[\\\"PROXY-CONNECTION -> keep-alive\\\"]\",\"request_body_len\":\"0\",\"response_body_len\":\"0\",\"status_code\":\"200\",\"status_msg\":\"Connection established\",\"tags\":\"[]\",\"trans_depth\":\"1\",\"uri\":\"www.gstatic.com:443\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0\"}"},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:25.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:55.9520799Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "ConnectionSuccess","RemoteIP": "175.16.199.0","RemotePort": 8080,"RemoteUrl": "url.com","LocalIP": "89.160.20.112","LocalPort": 50830,"Protocol": "Tcp","LocalIPType": "Private","RemoteIPType": "Private","InitiatingProcessSHA1": "071336f8df7d581188f59c3e8edd21e57f11c146","InitiatingProcessSHA256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb","InitiatingProcessMD5": "7448f851eb4e9b2fbfc46b2b49daf43f","InitiatingProcessFileName": "msoia.exe","InitiatingProcessFileSize": 8522792,"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation","InitiatingProcessVersionInfoProductName": "Microsoft Office","InitiatingProcessVersionInfoProductVersion": "16.0.123456.123456","InitiatingProcessVersionInfoInternalFileName": "msoia","InitiatingProcessVersionInfoOriginalFileName": "msoia.exe","InitiatingProcessVersionInfoFileDescription": "Office Telemetry Dashboard Agent (OTD msoia)","InitiatingProcessId": 65498,"InitiatingProcessCommandLine": "msoia.exe\" scan upload","InitiatingProcessCreationTime": "2023-07-19T12:16:56.1160286Z","InitiatingProcessFolderPath": "c:\\program files\\mozilla firefox\\firefox.exe","InitiatingProcessParentFileName": "firefox.exe","InitiatingProcessParentId": 65498,"InitiatingProcessParentCreationTime": "2023-07-19T12:16:56.0455613Z","InitiatingProcessAccountDomain": "corporatedomain","InitiatingProcessAccountName": "username","InitiatingProcessAccountSid": "S-1-5-21-57989841-2025429265-839522115-325552","InitiatingProcessAccountUpn": "email@domain","InitiatingProcessAccountObjectId": "e2157d1b-258b-4027-9f6f-76514c05c048","InitiatingProcessIntegrityLevel": "Medium","InitiatingProcessTokenElevation": "TokenElevationTypeDefault","ReportId": 29293,"AppGuardContainerId":null,"AdditionalFields":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:26.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:25.7414522Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "SslConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 8531,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 53645,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 6694,"AppGuardContainerId":null,"AdditionalFields": { "direction": "Out", "version": "TLSv12", "curve": "secp384r1", "server_name": "janeslaptop1.corporatedomain", "resumed": "false", "next_protocol": "h2", "established": "true", "subject": "CN=janeslaptop1.corporatedomain,O=Company,C=US", "uid": "CmHkX031vK8QoEJ3O7", "issuer": "CN=Company System CA 22,O=Company,C=US", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "ts": "133370123850310000"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:27.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T14:30:34.5955683Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "InboundConnectionAccepted","RemoteIP": "175.16.199.0","RemotePort": 54022,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 135,"Protocol": "Tcp","LocalIPType": "Private","RemoteIPType": "Private","InitiatingProcessSHA1": "0cb388ecf4055d73afc0ac4012b607753f899f08","InitiatingProcessSHA256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b","InitiatingProcessMD5": "122beaba9a49e1c60bf8446668a1de3e","InitiatingProcessFileName": "svchost.exe","InitiatingProcessFileSize": 79990,"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation","InitiatingProcessVersionInfoProductName": "Microsoft® Windows® Operating System","InitiatingProcessVersionInfoProductVersion": "10.0.22621.1","InitiatingProcessVersionInfoInternalFileName": "svchost.exe","InitiatingProcessVersionInfoOriginalFileName": "svchost.exe","InitiatingProcessVersionInfoFileDescription": "Host Process for Windows Services","InitiatingProcessId": 1772,"InitiatingProcessCommandLine": "svchost.exe -k RPCSS -p","InitiatingProcessCreationTime": "2023-07-19T14:29:02.5168183Z","InitiatingProcessFolderPath": "c:\\windows\\system32\\svchost.exe","InitiatingProcessParentFileName": "services.exe","InitiatingProcessParentId": 1152,"InitiatingProcessParentCreationTime": "2023-07-19T14:29:01.9698479Z","InitiatingProcessAccountDomain": "nt authority","InitiatingProcessAccountName": "network service","InitiatingProcessAccountSid": "S-1-5-12","InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel": "System","InitiatingProcessTokenElevation": "TokenElevationTypeDefault","ReportId": 884651,"AppGuardContainerId":null,"AdditionalFields":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:28.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:18:35.2391226Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "IcmpConnectionInspected","RemoteIP": "175.16.199.0","RemotePort":null,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort":null,"Protocol": "Icmp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 9846513,"AppGuardContainerId":null,"AdditionalFields": { "direction": "In", "conn_state": "OTH", "duration": "236.02695489659583", "missed_bytes": "0", "orig_bytes": "1344", "orig_ip_bytes": "2016", "orig_pkts": "24", "resp_bytes": "0", "resp_ip_bytes": "0", "resp_pkts": "0", "uid": "CoJ8an1SJN7SewZU9l"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:29.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:16:15.4903428Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "ConnectionRequest","RemoteIP": "175.16.199.0","RemotePort": 443,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 63295,"Protocol": "Tcp","LocalIPType": "Private","RemoteIPType": "Public","InitiatingProcessSHA1": "5c5a4e9be6721b7bc282d66fa863b6e8935d7252","InitiatingProcessSHA256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb","InitiatingProcessMD5": "323b1d0476181f99f76babcd87217f89","InitiatingProcessFileName": "telemetryd_v2","InitiatingProcessFileSize": 4934752,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 189,"InitiatingProcessCommandLine": "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/Frameworks/telemetryd_v2 13","InitiatingProcessCreationTime": "2023-07-18T16:38:50.74523Z","InitiatingProcessFolderPath": "/applications/microsoft defender.app/contents/macos/wdavdaemon_enterprise.app/contents/frameworks/telemetryd_v2","InitiatingProcessParentFileName": "wdavdaemon_enterprise","InitiatingProcessParentId": 654,"InitiatingProcessParentCreationTime": "2023-07-18T16:38:42.246421Z","InitiatingProcessAccountDomain": "macbookpro-123","InitiatingProcessAccountName": "root","InitiatingProcessAccountSid": "S-1-5-18","InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 654984,"AppGuardContainerId":null,"AdditionalFields": { "InitiatingProcessPosixEffectiveUser": {"Sid": "S-1-5-12","Name": "root","DomainName": "MacBookPro-123","LogonId": 0,"PosixUserId": 0,"PrimaryPosixGroup": { "Name": "wheel", "PosixGroupId": 0 } }, "InitiatingProcessPosixEffectiveGroup": {"Name": "_mdatp","PosixGroupId": 499 }, "InitiatingProcessPosixProcessGroupId": 362, "InitiatingProcessPosixSessionId": 0, "InitiatingProcessCurrentWorkingDirectory": "/Applications/Microsoft Defender.app/Contents/MacOS", "InitiatingProcessPosixFilePermissions": ["None"], "InitiatingProcessPosixRealUser": {"Sid": "S-1-5-12","Name": "root","DomainName": "MacBookPro-123","LogonId": 0,"PosixUserId": 0,"PrimaryPosixGroup": { "Name": "wheel", "PosixGroupId": 0 } }}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:30.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T07:43:20.8450859Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "ConnectionFound","RemoteIP": "2a02:cf40::","RemotePort": 8080,"RemoteUrl":null,"LocalIP": "2a02:cf40::","LocalPort": 61736,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName": "EXCEL.EXE","InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE","InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 654894,"AppGuardContainerId":null,"AdditionalFields":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:31.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T14:11:37.6987985Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "SshConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 22,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 49708,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 89741320,"AppGuardContainerId":null,"AdditionalFields": { "direction": "Out", "auth_attempts": "2", "auth_success": "true", "client": "SSH-2.0-PuTTY"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:32.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T14:18:19.7144334Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "InboundInternetScanInspected","RemoteIP": "175.16.199.0","RemotePort": 5432,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 46390,"Protocol": "Udp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 9841651,"AppGuardContainerId":null,"AdditionalFields": { "PublicScannedPort": 5432, "PublicScannedIp": "175.16.199.0"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:33.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T14:09:43.8734771Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "SmtpConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 25,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 60697,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 18984951960,"AppGuardContainerId":null,"AdditionalFields": { "direction": "Out", "fuids": "[]", "helo": "janeslaptop1.corporatedomain", "last_reply": "220 2.0.0 SMTP server ready", "path": "[\"89.160.20.112\",\"89.160.20.112\"]", "tls": "true", "trans_depth": "1", "uid": "0278e28ff5d8eff6d3"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:34.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceNetworkEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T12:12:10.0598052Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "FtpConnectionInspected","RemoteIP": "175.16.199.0","RemotePort": 21,"RemoteUrl":null,"LocalIP": "89.160.20.112","LocalPort": 56885,"Protocol": "Tcp","LocalIPType":null,"RemoteIPType":null,"InitiatingProcessSHA1":null,"InitiatingProcessSHA256":null,"InitiatingProcessMD5":null,"InitiatingProcessFileName":null,"InitiatingProcessFileSize":null,"InitiatingProcessVersionInfoCompanyName":null,"InitiatingProcessVersionInfoProductName":null,"InitiatingProcessVersionInfoProductVersion":null,"InitiatingProcessVersionInfoInternalFileName":null,"InitiatingProcessVersionInfoOriginalFileName":null,"InitiatingProcessVersionInfoFileDescription":null,"InitiatingProcessId": 0,"InitiatingProcessCommandLine":null,"InitiatingProcessCreationTime":null,"InitiatingProcessFolderPath":null,"InitiatingProcessParentFileName":null,"InitiatingProcessParentId": 0,"InitiatingProcessParentCreationTime":null,"InitiatingProcessAccountDomain":null,"InitiatingProcessAccountName":null,"InitiatingProcessAccountSid":null,"InitiatingProcessAccountUpn":null,"InitiatingProcessAccountObjectId":null,"InitiatingProcessIntegrityLevel":null,"InitiatingProcessTokenElevation": "None","ReportId": 98498,"AppGuardContainerId":null,"AdditionalFields": { "direction": "Out", "user": "", "reply_msg": "Service ready", "reply_code": "220", "cwd": ".", "command": "", "uid": "603f4dc5c8d46599fd"}},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:35.9948950Z"} +{"Tenant":"DefaultTenant","category":"AdvancedHunting-DeviceProcessEvents","operationName":"Publish","properties":{"Timestamp": "2023-07-19T14:02:19.4882081Z","DeviceId": "22bb10ffe3104214b20fc7de339a2b053e915e5c","DeviceName": "janeslaptop1.corporatedomain","ActionType": "ProcessCreated","FileName": "msedgewebview2.exe","FolderPath": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.79\\msedgewebview2.exe","SHA1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a","SHA256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354","MD5": "b21b158fce974aa46125820ce6b42e9d","FileSize": 3653056,"ProcessVersionInfoCompanyName": "Microsoft Corporation","ProcessVersionInfoProductName": "Microsoft Edge WebView2","ProcessVersionInfoProductVersion": "114.0.1732.12","ProcessVersionInfoInternalFileName": "msedgewebview2_exe","ProcessVersionInfoOriginalFileName": "msedgewebview2.exe","ProcessVersionInfoFileDescription": "Microsoft Edge WebView2","ProcessId": 5498762,"ProcessCommandLine": "\"msedgewebview2.exe\" --type=renderer --noerrdialogs --user-data-dir=\"C:\\Users\\JANEBLOGGS\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\4ee9dcb0-735b-442e-945c-177c665efe6b_ADAL\\2\\EBWebView\" --webview-exe-name=MSOUTLOOK.EXE","ProcessIntegrityLevel": "Low","ProcessTokenElevation": "TokenElevationTypeDefault","ProcessCreationTime": "2023-07-19T14:02:19.4882081Z","AccountDomain": "corporatedomain","AccountName": "janebloggs","AccountSid": "S-1-5-21-57989841-2025429265-839522115-962270","AccountUpn": "janebloggs@corporate.com","AccountObjectId": "4ee9dcb0-735b-442e-945c-177c665efe6b","LogonId": 3654987,"InitiatingProcessAccountDomain": "corporatedomain","InitiatingProcessAccountName": "janebloggs","InitiatingProcessAccountSid": "S-1-5-21-57989841-2025429265-839522115-962270","InitiatingProcessAccountUpn": "janebloggs@corporate.com","InitiatingProcessAccountObjectId": "4ee9dcb0-735b-442e-945c-177c665efe6b","InitiatingProcessLogonId": 3654987,"InitiatingProcessIntegrityLevel": "Medium","InitiatingProcessTokenElevation": "TokenElevationTypeDefault","InitiatingProcessSHA1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a","InitiatingProcessSHA256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354","InitiatingProcessMD5": "b21b158fce974aa46125820ce6b42e9d","InitiatingProcessFileName": "msedgewebview2.exe","InitiatingProcessFileSize": 5498762,"InitiatingProcessVersionInfoCompanyName": "Microsoft Corporation","InitiatingProcessVersionInfoProductName": "Microsoft Edge WebView2","InitiatingProcessVersionInfoProductVersion": "114.0.1732.12","InitiatingProcessVersionInfoInternalFileName": "msedgewebview2_exe","InitiatingProcessVersionInfoOriginalFileName": "msedgewebview2.exe","InitiatingProcessVersionInfoFileDescription": "Microsoft Edge WebView2","InitiatingProcessId": 65485,"InitiatingProcessCommandLine": "\"msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=MSOUTLOOK.EXE --webview-exe-version=16.0.15601.20706 --user-data-dir=\"C:\\Users\\USERNAME\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\2\\EBWebView\" --noerrdialogs","InitiatingProcessCreationTime":null},"tenantId":"12345af3-bc0e-4f36-b08e-27759e912345","time":"2023-07-19T18:03:21.9948950Z"} diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log-expected.json b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log-expected.json index f15786bc869..335b2763098 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-device.log-expected.json @@ -3,24 +3,19 @@ { "@timestamp": "2022-11-07T17:07:42.025Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dpapiaccessed", "category": [ "host" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":null,\"AccountName\":null,\"AccountSid\":null,\"ActionType\":\"DpapiAccessed\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"AppGuardContainerId\":\"\",\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":null,\"FileOriginIP\":null,\"FileOriginUrl\":null,\"FileSize\":329,\"FolderPath\":null,\"InitiatingProcessAccountDomain\":\"testmachine5\",\"InitiatingProcessAccountName\":\"administrator1\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-21-375308137-164487297-2828222098-111\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"\\\"backgroundTaskHost.exe\\\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca\",\"InitiatingProcessCreationTime\":\"2022-11-07T17:07:41.698868Z\",\"InitiatingProcessFileName\":\"backgroundtaskhost.exe\",\"InitiatingProcessFileSize\":19776,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\backgroundtaskhost.exe\",\"InitiatingProcessId\":4248,\"InitiatingProcessLogonId\":1431021,\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:27.0112578Z\",\"InitiatingProcessParentFileName\":\"svchost.exe\",\"InitiatingProcessParentId\":948,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Background Task Host\",\"InitiatingProcessVersionInfoInternalFileName\":\"Background Task Host\",\"InitiatingProcessVersionInfoOriginalFileName\":\"backgroundTaskHost.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.546\",\"LocalIP\":null,\"LocalPort\":null,\"LogonId\":null,\"MD5\":null,\"MachineGroup\":\"UnassignedGroup\",\"ProcessCommandLine\":null,\"ProcessCreationTime\":null,\"ProcessId\":null,\"ProcessTokenElevation\":null,\"RegistryKey\":null,\"RegistryValueData\":null,\"RegistryValueName\":null,\"RemoteDeviceName\":null,\"RemoteIP\":null,\"RemotePort\":null,\"RemoteUrl\":null,\"ReportId\":2833,\"SHA1\":null,\"SHA256\":null,\"Timestamp\":\"2022-11-07T17:07:42.0259186Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:45:56.3057929Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":null,\"AccountName\":null,\"AccountSid\":null,\"ActionType\":\"DpapiAccessed\",\"AdditionalFields\":\"{\\\"CallerProcessID\\\":4248}\",\"AppGuardContainerId\":null,\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":null,\"FileOriginIP\":null,\"FileOriginUrl\":null,\"FileSize\":329,\"FolderPath\":null,\"InitiatingProcessAccountDomain\":\"testmachine5\",\"InitiatingProcessAccountName\":\"administrator1\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-21-375308137-164487297-2828222098-111\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"\\\"backgroundTaskHost.exe\\\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca\",\"InitiatingProcessCreationTime\":\"2022-11-07T17:07:41.698868Z\",\"InitiatingProcessFileName\":\"backgroundtaskhost.exe\",\"InitiatingProcessFileSize\":19776,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\backgroundtaskhost.exe\",\"InitiatingProcessId\":4248,\"InitiatingProcessLogonId\":1431021,\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:27.0112578Z\",\"InitiatingProcessParentFileName\":\"svchost.exe\",\"InitiatingProcessParentId\":948,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Background Task Host\",\"InitiatingProcessVersionInfoInternalFileName\":\"Background Task Host\",\"InitiatingProcessVersionInfoOriginalFileName\":\"backgroundTaskHost.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.546\",\"LocalIP\":null,\"LocalPort\":null,\"LogonId\":null,\"MD5\":null,\"MachineGroup\":\"UnassignedGroup\",\"ProcessCommandLine\":null,\"ProcessCreationTime\":null,\"ProcessId\":null,\"ProcessTokenElevation\":null,\"RegistryKey\":null,\"RegistryValueData\":null,\"RegistryValueName\":null,\"RemoteDeviceName\":null,\"RemoteIP\":null,\"RemotePort\":null,\"RemoteUrl\":null,\"ReportId\":2833,\"SHA1\":null,\"SHA256\":null,\"Timestamp\":\"2022-11-07T17:07:42.0259186Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:45:56.3057929Z\"}", "type": [ "info" ] }, - "file": { - "size": 329 - }, "host": { "id": "de6509d550e605faf3bbeac0905ab9590fe12345", "name": "testmachine5" @@ -78,25 +73,48 @@ }, "process": { "command_line": "\"backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", - "hash": { - "md5": "b7f884c1b74a263f746ee12a5f7c9f6a", - "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1", - "sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" - }, "parent": { - "pid": 948 + "args": [ + "\"backgroundTaskHost.exe\"", + "-ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca" + ], + "args_count": 2, + "command_line": "\"backgroundTaskHost.exe\" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca", + "executable": "c:\\windows\\system32\\backgroundtaskhost.exe", + "group_leader": { + "name": "svchost.exe", + "pid": 948, + "start": "2022-11-07T16:34:27.011Z" + }, + "hash": { + "md5": "b7f884c1b74a263f746ee12a5f7c9f6a", + "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1", + "sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" + }, + "name": "backgroundtaskhost.exe", + "pe": { + "company": "Microsoft Corporation", + "description": "Background Task Host", + "file_version": "10.0.19041.546", + "original_file_name": "backgroundTaskHost.exe", + "product": "Microsoft® Windows® Operating System", + "sections": { + "physical_size": 19776 + } + }, + "pid": 4248, + "start": "2022-11-07T17:07:41.698Z" }, - "pid": 4248 + "pe": { + "sections": { + "physical_size": 329 + } + } }, "related": { - "hash": [ - "b7f884c1b74a263f746ee12a5f7c9f6a", - "1bc5066ddf693fc034d6514618854e26a84fd0d1", - "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" - ], "hosts": [ - "testmachine5", - "de6509d550e605faf3bbeac0905ab9590fe12345" + "de6509d550e605faf3bbeac0905ab9590fe12345", + "testmachine5" ], "user": [ "administrator1" @@ -110,25 +128,33 @@ { "@timestamp": "2022-11-07T17:00:58.150Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "file" ], - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceFileCertificateInfo\",\"operationName\":\"Publish\",\"properties\":{\"CertificateCountersignatureTime\":\"2022-05-25T15:28:57.628Z\",\"CertificateCreationTime\":\"2021-09-02T18:23:41Z\",\"CertificateExpirationTime\":\"2022-09-01T18:23:41Z\",\"CertificateSerialNumber\":\"330000033b655faefadb75e9d6000000012345\",\"CrlDistributionPointUrls\":\"[\\\"http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl\\\"]\",\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"IsRootSignerMicrosoft\":true,\"IsSigned\":true,\"IsTrusted\":true,\"Issuer\":\"Microsoft Windows Production PCA 2011\",\"IssuerHash\":\"580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d\",\"MachineGroup\":\"UnassignedGroup\",\"ReportId\":2486,\"SHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"SignatureType\":\"Embedded\",\"Signer\":\"Microsoft Windows\",\"SignerHash\":\"e168609353f30ff2373157b4eb8cd519d07a2bff\",\"Timestamp\":\"2022-11-07T17:00:58.1501482Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:11:16.2074367Z\"}", "type": [ "info" ] }, "file": { + "code_signature": { + "exists": true, + "subject_name": "Microsoft Windows", + "trusted": true + }, "hash": { "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1" }, "x509": { + "issuer": { + "common_name": [ + "Microsoft Windows Production PCA 2011" + ] + }, "not_after": "2022-09-01T18:23:41.000Z", "serial_number": "330000033b655faefadb75e9d6000000012345" } @@ -180,8 +206,8 @@ "e168609353f30ff2373157b4eb8cd519d07a2bff" ], "hosts": [ - "testmachine5", - "de6509d550e605faf3bbeac0905ab9590fe12345" + "de6509d550e605faf3bbeac0905ab9590fe12345", + "testmachine5" ] }, "tags": [ @@ -192,17 +218,15 @@ { "@timestamp": "2022-11-07T16:45:21.211Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "filecreated", "category": [ "file" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceFileEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"FileCreated\",\"AdditionalFields\":null,\"AppGuardContainerId\":\"\",\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":\"VMAgentDisabler.dll\",\"FileOriginIP\":null,\"FileOriginReferrerUrl\":null,\"FileOriginUrl\":null,\"FileSize\":139848,\"FolderPath\":\"C:\\\\Windows\\\\System32\\\\VMAgentDisabler.dll\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"WaAppAgent.exe\",\"InitiatingProcessCreationTime\":\"2022-11-07T16:45:10.3952444Z\",\"InitiatingProcessFileName\":\"WaAppAgent.exe\",\"InitiatingProcessFileSize\":91360,\"InitiatingProcessFolderPath\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1057_2022-11-07_163802\\\\waappagent.exe\",\"InitiatingProcessId\":5692,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:26.5433488Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":812,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Microsoft Azure®\",\"InitiatingProcessVersionInfoInternalFileName\":\"WaAppAgent\",\"InitiatingProcessVersionInfoOriginalFileName\":\"WaAppAgent.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® CoReXT\",\"InitiatingProcessVersionInfoProductVersion\":\"2.7.41491.1057\",\"IsAzureInfoProtectionApplied\":null,\"MD5\":\"b41a36dcfd9295b503b6bbc90bc12345\",\"MachineGroup\":\"UnassignedGroup\",\"PreviousFileName\":\"\",\"PreviousFolderPath\":\"\",\"ReportId\":112,\"RequestAccountDomain\":\"NT AUTHORITY\",\"RequestAccountName\":\"SYSTEM\",\"RequestAccountSid\":\"S-1-5-18\",\"RequestProtocol\":\"Local\",\"RequestSourceIP\":null,\"RequestSourcePort\":null,\"SHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"SHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"SensitivityLabel\":null,\"SensitivitySubLabel\":null,\"ShareName\":null,\"Timestamp\":\"2022-11-07T16:45:21.2119114Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:20:21.0560538Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceFileEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"FileCreated\",\"AdditionalFields\":null,\"AppGuardContainerId\":null,\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":\"VMAgentDisabler.dll\",\"FileOriginIP\":null,\"FileOriginReferrerUrl\":null,\"FileOriginUrl\":null,\"FileSize\":139848,\"FolderPath\":\"C:\\\\Windows\\\\System32\\\\VMAgentDisabler.dll\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"WaAppAgent.exe\",\"InitiatingProcessCreationTime\":\"2022-11-07T16:45:10.3952444Z\",\"InitiatingProcessFileName\":\"WaAppAgent.exe\",\"InitiatingProcessFileSize\":91360,\"InitiatingProcessFolderPath\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1057_2022-11-07_163802\\\\waappagent.exe\",\"InitiatingProcessId\":5692,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:26.5433488Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":812,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Microsoft Azure®\",\"InitiatingProcessVersionInfoInternalFileName\":\"WaAppAgent\",\"InitiatingProcessVersionInfoOriginalFileName\":\"WaAppAgent.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® CoReXT\",\"InitiatingProcessVersionInfoProductVersion\":\"2.7.41491.1057\",\"IsAzureInfoProtectionApplied\":null,\"MD5\":\"b41a36dcfd9295b503b6bbc90bc12345\",\"MachineGroup\":\"UnassignedGroup\",\"PreviousFileName\":null,\"PreviousFolderPath\":null,\"ReportId\":112,\"RequestAccountDomain\":\"NT AUTHORITY\",\"RequestAccountName\":\"SYSTEM\",\"RequestAccountSid\":\"S-1-5-18\",\"RequestProtocol\":\"Local\",\"RequestSourceIP\":null,\"RequestSourcePort\":null,\"SHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"SHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"SensitivityLabel\":null,\"SensitivitySubLabel\":null,\"ShareName\":null,\"Timestamp\":\"2022-11-07T16:45:21.2119114Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:20:21.0560538Z\"}", "type": [ "info" ] @@ -285,16 +309,35 @@ "protocol": "local" }, "process": { + "args": [ + "WaAppAgent.exe" + ], + "args_count": 1, "command_line": "WaAppAgent.exe", + "executable": "c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe", "hash": { "md5": "b7f884c1b74a263f746ee12a5f7c9f6a", "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1", "sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" }, + "name": "WaAppAgent.exe", "parent": { - "pid": 812 + "name": "services.exe", + "pid": 812, + "start": "2022-11-07T16:34:26.543Z" }, - "pid": 5692 + "pe": { + "company": "Microsoft Corporation", + "description": "Microsoft Azure®", + "file_version": "2.7.41491.1057", + "original_file_name": "WaAppAgent.exe", + "product": "Microsoft® CoReXT", + "sections": { + "physical_size": 91360 + } + }, + "pid": 5692, + "start": "2022-11-07T16:45:10.395Z" }, "related": { "hash": [ @@ -304,8 +347,8 @@ "b7f884c1b74a263f746ee12a5f7c9f6a" ], "hosts": [ - "testmachine5", "de6509d550e605faf3bbeac0905ab9590fe12345", + "testmachine5", "NT AUTHORITY", "nt authority" ], @@ -314,45 +357,45 @@ "system" ] }, - "source": { - "user": { - "domain": "NT AUTHORITY", - "name": "SYSTEM" - } - }, "tags": [ "preserve_original_event", "preserve_duplicate_custom_fields" - ] + ], + "user": { + "domain": "NT AUTHORITY", + "name": "SYSTEM" + } }, { "@timestamp": "2022-11-07T16:45:19.295Z", + "dll": { + "hash": { + "md5": "01a97134d9927a4001649b1d9ff25397", + "sha1": "1bc67905ae5c8e81014aa4290a338ace6a3b103e", + "sha256": "62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a" + }, + "name": "System.Management.ni.dll", + "path": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\8af759007c012da690062882e06694f1\\System.Management.ni.dll", + "pe": { + "sections": { + "physical_size": 1458688 + } + } + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "imageloaded", "category": [ "process" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceImageLoadEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"ImageLoaded\",\"AppGuardContainerId\":\"\",\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":\"System.Management.ni.dll\",\"FileSize\":1458688,\"FolderPath\":\"C:\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\System.Management\\\\8af759007c012da690062882e06694f1\\\\System.Management.ni.dll\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"WaAppAgent.exe\",\"InitiatingProcessCreationTime\":\"2022-11-07T16:45:10.3952444Z\",\"InitiatingProcessFileName\":\"waappagent.exe\",\"InitiatingProcessFileSize\":91360,\"InitiatingProcessFolderPath\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1057_2022-11-07_163802\\\\waappagent.exe\",\"InitiatingProcessId\":5692,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"ac71a4a58ffeb96a5d4724c1849ac456\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:26.5433488Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":812,\"InitiatingProcessSHA1\":\"2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a\",\"InitiatingProcessSHA256\":\"1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Microsoft Azure®\",\"InitiatingProcessVersionInfoInternalFileName\":\"WaAppAgent\",\"InitiatingProcessVersionInfoOriginalFileName\":\"WaAppAgent.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® CoReXT\",\"InitiatingProcessVersionInfoProductVersion\":\"2.7.41491.1057\",\"MD5\":\"01a97134d9927a4001649b1d9ff25397\",\"MachineGroup\":\"UnassignedGroup\",\"ReportId\":93,\"SHA1\":\"1bc67905ae5c8e81014aa4290a338ace6a3b103e\",\"SHA256\":\"62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a\",\"Timestamp\":\"2022-11-07T16:45:19.295067Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:20:52.5604763Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceImageLoadEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"ImageLoaded\",\"AppGuardContainerId\":null,\"DeviceId\":\"de6509d550e605faf3bbeac0905ab9590fe12345\",\"DeviceName\":\"testmachine5\",\"FileName\":\"System.Management.ni.dll\",\"FileSize\":1458688,\"FolderPath\":\"C:\\\\Windows\\\\assembly\\\\NativeImages_v4.0.30319_64\\\\System.Management\\\\8af759007c012da690062882e06694f1\\\\System.Management.ni.dll\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"WaAppAgent.exe\",\"InitiatingProcessCreationTime\":\"2022-11-07T16:45:10.3952444Z\",\"InitiatingProcessFileName\":\"waappagent.exe\",\"InitiatingProcessFileSize\":91360,\"InitiatingProcessFolderPath\":\"c:\\\\windowsazure\\\\guestagent_2.7.41491.1057_2022-11-07_163802\\\\waappagent.exe\",\"InitiatingProcessId\":5692,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"ac71a4a58ffeb96a5d4724c1849ac456\",\"InitiatingProcessParentCreationTime\":\"2022-11-07T16:34:26.5433488Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":812,\"InitiatingProcessSHA1\":\"2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a\",\"InitiatingProcessSHA256\":\"1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Microsoft Azure®\",\"InitiatingProcessVersionInfoInternalFileName\":\"WaAppAgent\",\"InitiatingProcessVersionInfoOriginalFileName\":\"WaAppAgent.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® CoReXT\",\"InitiatingProcessVersionInfoProductVersion\":\"2.7.41491.1057\",\"MD5\":\"01a97134d9927a4001649b1d9ff25397\",\"MachineGroup\":\"UnassignedGroup\",\"ReportId\":93,\"SHA1\":\"1bc67905ae5c8e81014aa4290a338ace6a3b103e\",\"SHA256\":\"62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a\",\"Timestamp\":\"2022-11-07T16:45:19.295067Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-07T17:20:52.5604763Z\"}", "type": [ "end" ] }, - "file": { - "directory": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Management\\8af759007c012da690062882e06694f1\\System.Management.ni.dll", - "hash": { - "md5": "01a97134d9927a4001649b1d9ff25397", - "sha1": "1bc67905ae5c8e81014aa4290a338ace6a3b103e", - "sha256": "62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a" - }, - "name": "System.Management.ni.dll", - "size": 1458688 - }, "host": { "id": "de6509d550e605faf3bbeac0905ab9590fe12345", "name": "testmachine5" @@ -413,28 +456,42 @@ }, "process": { "command_line": "WaAppAgent.exe", - "hash": { - "md5": "ac71a4a58ffeb96a5d4724c1849ac456", - "sha1": "2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a", - "sha256": "1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635" - }, "parent": { - "pid": 812 - }, - "pid": 5692 + "args": [ + "WaAppAgent.exe" + ], + "args_count": 1, + "command_line": "WaAppAgent.exe", + "executable": "c:\\windowsazure\\guestagent_2.7.41491.1057_2022-11-07_163802\\waappagent.exe", + "group_leader": { + "name": "services.exe", + "pid": 812, + "start": "2022-11-07T16:34:26.543Z" + }, + "hash": { + "md5": "ac71a4a58ffeb96a5d4724c1849ac456", + "sha1": "2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a", + "sha256": "1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635" + }, + "name": "waappagent.exe", + "pe": { + "company": "Microsoft Corporation", + "description": "Microsoft Azure®", + "file_version": "2.7.41491.1057", + "original_file_name": "WaAppAgent.exe", + "product": "Microsoft® CoReXT", + "sections": { + "physical_size": 91360 + } + }, + "pid": 5692, + "start": "2022-11-07T16:45:10.395Z" + } }, "related": { - "hash": [ - "01a97134d9927a4001649b1d9ff25397", - "1bc67905ae5c8e81014aa4290a338ace6a3b103e", - "62b9597b5cf263a7e76913613e1b565c0f7436ccc4ef515bf40f400a5023de8a", - "ac71a4a58ffeb96a5d4724c1849ac456", - "2f88f5bbdaae8a57287dcc12c7d2ea8cdc57260a", - "1addd6bc9893fb68076c44d9290f07c10d2cc98362d2c17d7e01e5e3a6374635" - ], "hosts": [ - "testmachine5", "de6509d550e605faf3bbeac0905ab9590fe12345", + "testmachine5", "nt authority" ], "user": [ @@ -449,21 +506,31 @@ { "@timestamp": "2022-11-08T05:56:25.883Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "host" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceInfo\",\"operationName\":\"Publish\",\"properties\":{\"AadDeviceId\":null,\"AdditionalFields\":\"[]\",\"ClientVersion\":\"10.8210.19041.2006\",\"DeviceCategory\":\"Endpoint\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a2712345\",\"DeviceName\":\"testmachine6\",\"DeviceSubtype\":null,\"DeviceType\":\"Workstation\",\"IsAzureADJoined\":false,\"JoinType\":\"\",\"LoggedOnUsers\":\"[{\\\"UserName\\\":\\\"administrator1\\\"}]\",\"MachineGroup\":\"UnassignedGroup\",\"MergedDeviceIds\":\"\",\"MergedToDeviceId\":\"\",\"Model\":\"\",\"OSArchitecture\":null,\"OSBuild\":null,\"OSDistribution\":\"\",\"OSPlatform\":null,\"OSVersion\":null,\"OSVersionInfo\":\"\",\"OnboardingStatus\":\"Onboarded\",\"PublicIP\":\"81.2.69.142\",\"RegistryDeviceTag\":\"evaluation\",\"ReportId\":12942,\"Timestamp\":\"2022-11-08T05:56:25.8832339Z\",\"Vendor\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-08T06:01:15.8987913Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceInfo\",\"operationName\":\"Publish\",\"properties\":{\"AadDeviceId\":null,\"AdditionalFields\":null,\"AssetValue\":\"testvalue\",\"IsInternetFacing\":true,\"DeviceManualTags\":\"testtags\",\"DeviceDynamicTags\":\"testdynamictags\",\"ExposureLevel\":\"testlevel\",\"SensorHealthState\":\"somestatus\",\"ExclusionReason\":\"somereason\",\"IsExcluded\":false,\"ClientVersion\":\"10.8210.19041.2006\",\"DeviceCategory\":\"Endpoint\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a2712345\",\"DeviceName\":\"testmachine6\",\"DeviceSubtype\":null,\"DeviceType\":\"Workstation\",\"IsAzureADJoined\":false,\"JoinType\":null,\"LoggedOnUsers\":\"[{\\\"UserName\\\":\\\"administrator1\\\"}, {\\\"UserName\\\":\\\"administrator2\\\"}]\",\"MachineGroup\":\"UnassignedGroup\",\"MergedDeviceIds\":null,\"MergedToDeviceId\":null,\"Model\":null,\"OSArchitecture\":null,\"OSBuild\":null,\"OSDistribution\":null,\"OSPlatform\":null,\"OSVersion\":null,\"OSVersionInfo\":null,\"OnboardingStatus\":\"Onboarded\",\"PublicIP\":\"81.2.69.142\",\"RegistryDeviceTag\":\"evaluation\",\"ReportId\":12942,\"Timestamp\":\"2022-11-08T05:56:25.8832339Z\",\"Vendor\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-08T06:01:15.8987913Z\"}", "type": [ "info" ] }, "host": { + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, "id": "999b6fd7c532534ba50b3232fa992c38a2712345", "ip": "81.2.69.142", "name": "testmachine6", @@ -471,6 +538,11 @@ }, "m365_defender": { "event": { + "active_users": [ + "administrator1", + "administrator2" + ], + "asset_value": "testvalue", "category": "AdvancedHunting-DeviceInfo", "client_version": "10.8210.19041.2006", "device": { @@ -479,34 +551,24 @@ "name": "testmachine6", "type": "Workstation" }, + "device_dynamic_tags": "testdynamictags", + "device_manual_tags": "testtags", + "exclusion_reason": "somereason", + "exposure_level": "testlevel", "is_azure_ad_joined": false, - "logged_on_users": [ - { - "UserName": "administrator1" - } - ], + "is_excluded": false, + "is_internet_facing": true, "machine_group": "UnassignedGroup", "onboarding_status": "Onboarded", "operation_name": "Publish", "public_ip": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, "value": "81.2.69.142" }, "registry": { "device_tag": "evaluation" }, "report_id": "12942", + "sensor_health_state": "somestatus", "tenant": { "id": "12345af3-bc0e-4f36-b08e-27759e912345", "name": "DefaultTenant" @@ -521,11 +583,15 @@ }, "related": { "hosts": [ - "testmachine6", - "999b6fd7c532534ba50b3232fa992c38a2712345" + "999b6fd7c532534ba50b3232fa992c38a2712345", + "testmachine6" ], "ip": [ "81.2.69.142" + ], + "user": [ + "administrator1", + "administrator2" ] }, "tags": [ @@ -536,17 +602,15 @@ { "@timestamp": "2022-11-09T17:47:28.816Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logonfailed", "category": [ "authentication" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceLogonEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":null,\"AccountName\":\"administrator\",\"AccountSid\":null,\"ActionType\":\"LogonFailed\",\"AdditionalFields\":\"{\\\"IsLocalLogon\\\":true}\",\"AppGuardContainerId\":\"\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"FailureReason\":\"InvalidUserNameOrPassword\",\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessId\":0,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\":0,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessTokenElevation\":\"None\",\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"IsLocalAdmin\":null,\"LogonId\":null,\"LogonType\":\"Network\",\"MachineGroup\":\"UnassignedGroup\",\"Protocol\":\"NTLM\",\"RemoteDeviceName\":\"\",\"RemoteIP\":\"67.43.156.1\",\"RemoteIPType\":\"Public\",\"RemotePort\":0,\"ReportId\":3551,\"Timestamp\":\"2022-11-09T17:47:28.8167685Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T17:51:33.5625286Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceLogonEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":null,\"AccountName\":\"administrator\",\"AccountSid\":null,\"ActionType\":\"LogonFailed\",\"AdditionalFields\":\"{\\\"IsLocalLogon\\\":true}\",\"AppGuardContainerId\":null,\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"FailureReason\":\"InvalidUserNameOrPassword\",\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessId\":0,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\":0,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessTokenElevation\":\"None\",\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"IsLocalAdmin\":null,\"LogonId\":null,\"LogonType\":\"Network\",\"MachineGroup\":\"UnassignedGroup\",\"Protocol\":\"NTLM\",\"RemoteDeviceName\":null,\"RemoteIP\":\"67.43.156.1\",\"RemoteIPType\":\"Public\",\"RemotePort\":0,\"ReportId\":3551,\"Timestamp\":\"2022-11-09T17:47:28.8167685Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T17:51:33.5625286Z\"}", "outcome": "failure", "type": [ "info" @@ -609,8 +673,8 @@ }, "related": { "hosts": [ - "testmachine6", - "999b6fd7c532534ba50b3232fa992c38a273d4fb" + "999b6fd7c532534ba50b3232fa992c38a273d4fb", + "testmachine6" ], "ip": [ "67.43.156.1" @@ -620,12 +684,8 @@ ] }, "source": { - "ip": [ - "67.43.156.1" - ], - "port": [ - 0 - ] + "ip": "67.43.156.1", + "port": 0 }, "tags": [ "preserve_original_event", @@ -637,18 +697,20 @@ }, { "@timestamp": "2022-11-09T17:43:28.188Z", + "destination": { + "ip": "81.2.69.142", + "port": 50094 + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "networksignatureinspected", "category": [ "network" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"NetworkSignatureInspected\",\"AdditionalFields\":\"{\\\"SignatureName\\\":\\\"HTTP_Server\\\"}\",\"AppGuardContainerId\":\"\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a2712345\",\"DeviceName\":\"testmachine6\",\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessId\":0,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\":0,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessTokenElevation\":\"None\",\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"LocalIP\":\"81.2.69.144\",\"LocalIPType\":null,\"LocalPort\":80,\"MachineGroup\":\"UnassignedGroup\",\"Protocol\":null,\"RemoteIP\":\"81.2.69.142\",\"RemoteIPType\":null,\"RemotePort\":50094,\"RemoteUrl\":null,\"ReportId\":2321,\"Timestamp\":\"2022-11-09T17:43:28.18835Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T17:47:35.5577637Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"NetworkSignatureInspected\",\"AdditionalFields\":\"{\\\"SignatureName\\\":\\\"HTTP_Server\\\"}\",\"AppGuardContainerId\":null,\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a2712345\",\"DeviceName\":\"testmachine6\",\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessId\":0,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\":0,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessTokenElevation\":\"None\",\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"LocalIP\":\"81.2.69.144\",\"LocalIPType\":null,\"LocalPort\":80,\"MachineGroup\":\"UnassignedGroup\",\"Protocol\":null,\"RemoteIP\":\"81.2.69.142\",\"RemoteIPType\":null,\"RemotePort\":50094,\"RemoteUrl\":null,\"ReportId\":2321,\"Timestamp\":\"2022-11-09T17:43:28.18835Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T17:47:35.5577637Z\"}", "type": [ "info" ] @@ -694,6 +756,9 @@ "timestamp": "2022-11-09T17:43:28.188Z" } }, + "network": { + "direction": "unknown" + }, "process": { "parent": { "pid": 0 @@ -702,23 +767,17 @@ }, "related": { "hosts": [ - "testmachine6", - "999b6fd7c532534ba50b3232fa992c38a2712345" + "999b6fd7c532534ba50b3232fa992c38a2712345", + "testmachine6" ], "ip": [ - "81.2.69.142", - "81.2.69.144" + "81.2.69.144", + "81.2.69.142" ] }, "source": { - "ip": [ - "81.2.69.142", - "81.2.69.144" - ], - "port": [ - 50094, - 80 - ] + "ip": "81.2.69.144", + "port": 80 }, "tags": [ "preserve_original_event", @@ -728,19 +787,14 @@ { "@timestamp": "2022-11-09T17:54:53.534Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ "network" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkInfo\",\"operationName\":\"Publish\",\"properties\":{\"ConnectedNetworks\":\"[{\\\"Name\\\":\\\"Network\\\",\\\"Description\\\":\\\"Network\\\",\\\"IsConnectedToInternet\\\":true,\\\"Category\\\":\\\"Public\\\"}]\",\"DefaultGateways\":\"[\\\"67.43.156.5\\\"]\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"DnsAddresses\":\"[\\\"67.43.156.2\\\"]\",\"IPAddresses\":\"[{\\\"IPAddress\\\":\\\"67.43.156.0\\\",\\\"SubnetPrefix\\\":26,\\\"AddressType\\\":\\\"Private\\\"},{\\\"IPAddress\\\":\\\"fe80::39f0:832a:89a1:f6e1\\\",\\\"SubnetPrefix\\\":64,\\\"AddressType\\\":\\\"Private\\\"}]\",\"IPv4Dhcp\":\"67.43.156.2\",\"IPv6Dhcp\":\"\",\"MacAddress\":\"000D3A9EC781\",\"MachineGroup\":\"UnassignedGroup\",\"NetworkAdapterName\":\"{31D7786C-13B8-421D-A3D8-308787B9A9FF}\",\"NetworkAdapterStatus\":\"Up\",\"NetworkAdapterType\":\"Ethernet\",\"NetworkAdapterVendor\":null,\"ReportId\":4700,\"Timestamp\":\"2022-11-09T17:54:53.5345682Z\",\"TunnelType\":\"None\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T18:00:01.8319849Z\"}", - "type": [ - "info" - ] + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkInfo\",\"operationName\":\"Publish\",\"properties\":{\"ConnectedNetworks\":\"[{\\\"Name\\\":\\\"Network\\\",\\\"Description\\\":\\\"Network\\\",\\\"IsConnectedToInternet\\\":true,\\\"Category\\\":\\\"Public\\\"}, {\\\"Name\\\":\\\"Network2\\\",\\\"Description\\\":\\\"Network2\\\",\\\"IsConnectedToInternet\\\":true,\\\"Category\\\":\\\"Public2\\\"}]\",\"DefaultGateways\":\"[\\\"67.43.156.5\\\"]\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"DnsAddresses\":\"[\\\"67.43.156.2\\\"]\",\"IPAddresses\":\"[{\\\"IPAddress\\\":\\\"67.43.156.0\\\",\\\"SubnetPrefix\\\":26,\\\"AddressType\\\":\\\"Private\\\"},{\\\"IPAddress\\\":\\\"fe80::39f0:832a:89a1:f6e1\\\",\\\"SubnetPrefix\\\":64,\\\"AddressType\\\":\\\"Private\\\"},{\\\"IPAddress\\\":\\\"67.43.156.1\\\",\\\"SubnetPrefix\\\":26,\\\"AddressType\\\":\\\"Private1\\\"},{\\\"IPAddress\\\":\\\"fe80::39f0:832a:89a1:f6e2\\\",\\\"SubnetPrefix\\\":64,\\\"AddressType\\\":\\\"Private2\\\"}]\",\"IPv4Dhcp\":\"67.43.156.2\",\"IPv6Dhcp\":null,\"MacAddress\":\"000D3A9EC781\",\"MachineGroup\":\"UnassignedGroup\",\"NetworkAdapterName\":\"{31D7786C-13B8-421D-A3D8-308787B9A9FF}\",\"NetworkAdapterStatus\":\"Up\",\"NetworkAdapterType\":\"Ethernet\",\"NetworkAdapterVendor\":null,\"ReportId\":4700,\"Timestamp\":\"2022-11-09T17:54:53.5345682Z\",\"TunnelType\":\"None\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T18:00:01.8319849Z\"}" }, "host": { "id": "999b6fd7c532534ba50b3232fa992c38a273d4fb", @@ -756,6 +810,12 @@ "Description": "Network", "IsConnectedToInternet": true, "Name": "Network" + }, + { + "Category": "Public2", + "Description": "Network2", + "IsConnectedToInternet": true, + "Name": "Network2" } ], "default_gateways": [ @@ -778,6 +838,16 @@ "AddressType": "Private", "IPAddress": "fe80::39f0:832a:89a1:f6e1", "SubnetPrefix": 64 + }, + { + "AddressType": "Private1", + "IPAddress": "67.43.156.1", + "SubnetPrefix": 26 + }, + { + "AddressType": "Private2", + "IPAddress": "fe80::39f0:832a:89a1:f6e2", + "SubnetPrefix": 64 } ], "ipv4_dhcp": "67.43.156.2", @@ -799,10 +869,13 @@ "tunnel_type": "None" } }, + "network": { + "direction": "unknown" + }, "related": { "hosts": [ - "testmachine6", - "999b6fd7c532534ba50b3232fa992c38a273d4fb" + "999b6fd7c532534ba50b3232fa992c38a273d4fb", + "testmachine6" ], "ip": [ "67.43.156.2" @@ -816,31 +889,19 @@ { "@timestamp": "2022-11-09T17:59:52.626Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "processcreated", "category": [ "process" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceProcessEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":\"testmachine6\",\"AccountName\":\"administrator1\",\"AccountObjectId\":null,\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountUpn\":null,\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":null,\"AppGuardContainerId\":\"\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"FileName\":\"smartscreen.exe\",\"FileSize\":2387456,\"FolderPath\":\"C:\\\\Windows\\\\System32\\\\smartscreen.exe\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"svchost.exe -k DcomLaunch -p\",\"InitiatingProcessCreationTime\":\"2022-11-09T17:39:34.1193719Z\",\"InitiatingProcessFileName\":\"svchost.exe\",\"InitiatingProcessFileSize\":55320,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\svchost.exe\",\"InitiatingProcessId\":996,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessLogonId\":999,\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-09T17:39:33.8279942Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":852,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessSignatureStatus\":\"Valid\",\"InitiatingProcessSignerType\":\"OsVendor\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Host Process for Windows Services\",\"InitiatingProcessVersionInfoInternalFileName\":\"svchost.exe\",\"InitiatingProcessVersionInfoOriginalFileName\":\"svchost.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.1806\",\"LogonId\":1443318,\"MD5\":\"b9d697df9e883f0d99720b0430448cb1\",\"MachineGroup\":\"UnassignedGroup\",\"ProcessCommandLine\":\"smartscreen.exe -Embedding\",\"ProcessCreationTime\":\"2022-11-09T17:59:52.0344972Z\",\"ProcessId\":6412,\"ProcessIntegrityLevel\":\"High\",\"ProcessTokenElevation\":\"TokenElevationTypeDefault\",\"ProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"ProcessVersionInfoFileDescription\":\"Windows Defender SmartScreen\",\"ProcessVersionInfoInternalFileName\":\"smartscreen.exe\",\"ProcessVersionInfoOriginalFileName\":\"smartscreen.exe\",\"ProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"ProcessVersionInfoProductVersion\":\"10.0.19041.2251\",\"ReportId\":4824,\"SHA1\":\"9dec87de894f5228033f87cf874441502bfa4f97\",\"SHA256\":\"8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781\",\"Timestamp\":\"2022-11-09T17:59:52.6265786Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T18:03:21.9948950Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceProcessEvents\",\"operationName\":\"Publish\",\"properties\":{\"AccountDomain\":\"testmachine6\",\"AccountName\":\"administrator1\",\"AccountObjectId\":null,\"AccountSid\":\"S-1-5-21-1874808502-2282282112-3464708742-500\",\"AccountUpn\":null,\"ActionType\":\"ProcessCreated\",\"AdditionalFields\":\"[]\",\"AppGuardContainerId\":null,\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"FileName\":\"smartscreen.exe\",\"FileSize\":2387456,\"FolderPath\":\"C:\\\\Windows\\\\System32\\\\smartscreen.exe\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"svchost.exe -k DcomLaunch -p\",\"InitiatingProcessCreationTime\":\"2022-11-09T17:39:34.1193719Z\",\"InitiatingProcessFileName\":\"svchost.exe\",\"InitiatingProcessFileSize\":55320,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\svchost.exe\",\"NetworkAdapterName\":\"en01\",\"InitiatingProcessId\":996,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessLogonId\":999,\"InitiatingProcessMD5\":\"b7f884c1b74a263f746ee12a5f7c9f6a\",\"InitiatingProcessParentCreationTime\":\"2022-11-09T17:39:33.8279942Z\",\"InitiatingProcessParentFileName\":\"services.exe\",\"InitiatingProcessParentId\":852,\"InitiatingProcessSHA1\":\"1bc5066ddf693fc034d6514618854e26a84fd0d1\",\"InitiatingProcessSHA256\":\"add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88\",\"InitiatingProcessSignatureStatus\":\"Valid\",\"InitiatingProcessSignerType\":\"OsVendor\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Host Process for Windows Services\",\"InitiatingProcessVersionInfoInternalFileName\":\"svchost.exe\",\"InitiatingProcessVersionInfoOriginalFileName\":\"svchost.exe\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.1806\",\"LogonId\":1443318,\"MD5\":\"b9d697df9e883f0d99720b0430448cb1\",\"MachineGroup\":\"UnassignedGroup\",\"ProcessCommandLine\":\"smartscreen.exe -Embedding\",\"ProcessCreationTime\":\"2022-11-09T17:59:52.0344972Z\",\"ProcessId\":6412,\"ProcessIntegrityLevel\":\"High\",\"ProcessTokenElevation\":\"TokenElevationTypeDefault\",\"ProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"ProcessVersionInfoFileDescription\":\"Windows Defender SmartScreen\",\"ProcessVersionInfoInternalFileName\":\"smartscreen.exe\",\"ProcessVersionInfoOriginalFileName\":\"smartscreen.exe\",\"ProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"ProcessVersionInfoProductVersion\":\"10.0.19041.2251\",\"ReportId\":4824,\"SHA1\":\"9dec87de894f5228033f87cf874441502bfa4f97\",\"SHA256\":\"8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781\",\"Timestamp\":\"2022-11-09T17:59:52.6265786Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T18:03:21.9948950Z\"}", "type": [ "end" ] }, - "file": { - "directory": "C:\\Windows\\System32\\smartscreen.exe", - "hash": { - "md5": "b9d697df9e883f0d99720b0430448cb1", - "sha1": "9dec87de894f5228033f87cf874441502bfa4f97", - "sha256": "8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781" - }, - "name": "smartscreen.exe", - "size": 2387456 - }, "host": { "id": "999b6fd7c532534ba50b3232fa992c38a273d4fb", "name": "testmachine6" @@ -898,6 +959,9 @@ }, "machine_group": "UnassignedGroup", "md5": "b9d697df9e883f0d99720b0430448cb1", + "network": { + "adapter_name": "en01" + }, "operation_name": "Publish", "process": { "command_line": "smartscreen.exe -Embedding", @@ -924,16 +988,68 @@ } }, "process": { + "args": [ + "smartscreen.exe", + "-Embedding" + ], + "args_count": 2, "command_line": "svchost.exe -k DcomLaunch -p", + "executable": "C:\\Windows\\System32\\smartscreen.exe", "hash": { - "md5": "b7f884c1b74a263f746ee12a5f7c9f6a", - "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1", - "sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" + "md5": "b9d697df9e883f0d99720b0430448cb1", + "sha1": "9dec87de894f5228033f87cf874441502bfa4f97", + "sha256": "8011a5f4ac65d85cbe593bdad886449e3807d950b234e77c675a0f7ca3b7c781" }, + "name": "smartscreen.exe", "parent": { - "pid": 852 + "args": [ + "svchost.exe", + "-k", + "DcomLaunch", + "-p" + ], + "args_count": 4, + "code_signature": { + "status": "Valid" + }, + "command_line": "svchost.exe -k DcomLaunch -p", + "executable": "c:\\windows\\system32\\svchost.exe", + "group_leader": { + "name": "services.exe", + "pid": 852, + "start": "2022-11-09T17:39:33.827Z" + }, + "hash": { + "md5": "b7f884c1b74a263f746ee12a5f7c9f6a", + "sha1": "1bc5066ddf693fc034d6514618854e26a84fd0d1", + "sha256": "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" + }, + "name": "svchost.exe", + "pe": { + "company": "Microsoft Corporation", + "description": "Host Process for Windows Services", + "file_version": "10.0.19041.1806", + "original_file_name": "svchost.exe", + "product": "Microsoft® Windows® Operating System", + "sections": { + "physical_size": 55320 + } + }, + "pid": 996, + "start": "2022-11-09T17:39:34.119Z" }, - "pid": 996 + "pe": { + "company": "Microsoft Corporation", + "description": "Windows Defender SmartScreen", + "file_version": "10.0.19041.2251", + "original_file_name": "smartscreen.exe", + "product": "Microsoft® Windows® Operating System", + "sections": { + "physical_size": 2387456 + } + }, + "pid": 6412, + "start": "2022-11-09T17:59:52.034Z" }, "related": { "hash": [ @@ -945,8 +1061,8 @@ "add683a6910abbbf0e28b557fad0ba998166394932ae2aca069d9aa19ea8fe88" ], "hosts": [ - "testmachine6", "999b6fd7c532534ba50b3232fa992c38a273d4fb", + "testmachine6", "nt authority" ], "user": [ @@ -960,23 +1076,22 @@ ], "user": { "domain": "testmachine6", + "id": "S-1-5-21-1874808502-2282282112-3464708742-500", "name": "administrator1" } }, { "@timestamp": "2022-11-09T19:17:43.575Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "registryvalueset", "category": [ "registry" ], - "kind": [ - "event" - ], - "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceRegistryEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"RegistryValueSet\",\"AppGuardContainerId\":\"\",\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive\",\"InitiatingProcessCreationTime\":\"2022-11-09T19:17:20.4156553Z\",\"InitiatingProcessFileName\":\"powershell.exe\",\"InitiatingProcessFileSize\":452608,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell.exe\",\"InitiatingProcessId\":5900,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"04029e121a0cfa5991749937dd22a1d9\",\"InitiatingProcessParentCreationTime\":\"2022-11-09T19:16:54.9433819Z\",\"InitiatingProcessParentFileName\":\"SenseIR.exe\",\"InitiatingProcessParentId\":5668,\"InitiatingProcessSHA1\":\"f43d9bb316e30ae1a3494ac5b0624f6bea1bf054\",\"InitiatingProcessSHA256\":\"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Windows PowerShell\",\"InitiatingProcessVersionInfoInternalFileName\":\"POWERSHELL\",\"InitiatingProcessVersionInfoOriginalFileName\":\"PowerShell.EXE\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.546\",\"MachineGroup\":\"UnassignedGroup\",\"PreviousRegistryKey\":\"\",\"PreviousRegistryValueData\":null,\"PreviousRegistryValueName\":\"Blob\",\"RegistryKey\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SystemCertificates\\\\Windows Live ID Token Issuer\\\\Certificates\\\\B68D8F953E551914324E557E6164D68B9926650C\",\"RegistryValueData\":null,\"RegistryValueName\":\"Blob\",\"RegistryValueType\":\"Binary\",\"ReportId\":6571,\"Timestamp\":\"2022-11-09T19:17:43.5752234Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T19:23:21.8925266Z\"}", + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceRegistryEvents\",\"operationName\":\"Publish\",\"properties\":{\"ActionType\":\"RegistryValueSet\",\"AppGuardContainerId\":null,\"DeviceId\":\"999b6fd7c532534ba50b3232fa992c38a273d4fb\",\"DeviceName\":\"testmachine6\",\"InitiatingProcessAccountDomain\":\"nt authority\",\"InitiatingProcessAccountName\":\"system\",\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessAccountSid\":\"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessCommandLine\":\"powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive\",\"InitiatingProcessCreationTime\":\"2022-11-09T19:17:20.4156553Z\",\"InitiatingProcessFileName\":\"powershell.exe\",\"InitiatingProcessFileSize\":452608,\"InitiatingProcessFolderPath\":\"c:\\\\windows\\\\system32\\\\windowspowershell\\\\v1.0\\\\powershell.exe\",\"InitiatingProcessId\":5900,\"InitiatingProcessIntegrityLevel\":\"System\",\"InitiatingProcessMD5\":\"04029e121a0cfa5991749937dd22a1d9\",\"InitiatingProcessParentCreationTime\":\"2022-11-09T19:16:54.9433819Z\",\"InitiatingProcessParentFileName\":\"SenseIR.exe\",\"InitiatingProcessParentId\":5668,\"InitiatingProcessSHA1\":\"f43d9bb316e30ae1a3494ac5b0624f6bea1bf054\",\"InitiatingProcessSHA256\":\"9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f\",\"InitiatingProcessTokenElevation\":\"TokenElevationTypeDefault\",\"InitiatingProcessVersionInfoCompanyName\":\"Microsoft Corporation\",\"InitiatingProcessVersionInfoFileDescription\":\"Windows PowerShell\",\"InitiatingProcessVersionInfoInternalFileName\":\"POWERSHELL\",\"InitiatingProcessVersionInfoOriginalFileName\":\"PowerShell.EXE\",\"InitiatingProcessVersionInfoProductName\":\"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\":\"10.0.19041.546\",\"MachineGroup\":\"UnassignedGroup\",\"PreviousRegistryKey\":null,\"PreviousRegistryValueData\":null,\"PreviousRegistryValueName\":\"Blob\",\"RegistryKey\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\SystemCertificates\\\\Windows Live ID Token Issuer\\\\Certificates\\\\B68D8F953E551914324E557E6164D68B9926650C\",\"RegistryValueData\":null,\"RegistryValueName\":\"Blob\",\"RegistryValueType\":\"Binary\",\"ReportId\":6571,\"Timestamp\":\"2022-11-09T19:17:43.5752234Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-09T19:23:21.8925266Z\"}", "type": [ "change" ] @@ -1040,16 +1155,39 @@ } }, "process": { + "args": [ + "powershell.exe", + "-ExecutionPolicy", + "AllSigned", + "-NoProfile", + "-NonInteractive" + ], + "args_count": 5, "command_line": "powershell.exe -ExecutionPolicy AllSigned -NoProfile -NonInteractive", + "executable": "c:\\windows\\system32\\windowspowershell\\v1.0\\powershell.exe", "hash": { "md5": "04029e121a0cfa5991749937dd22a1d9", "sha1": "f43d9bb316e30ae1a3494ac5b0624f6bea1bf054", "sha256": "9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f" }, + "name": "powershell.exe", "parent": { - "pid": 5668 + "name": "SenseIR.exe", + "pid": 5668, + "start": "2022-11-09T19:16:54.943Z" + }, + "pe": { + "company": "Microsoft Corporation", + "description": "Windows PowerShell", + "file_version": "10.0.19041.546", + "original_file_name": "PowerShell.EXE", + "product": "Microsoft® Windows® Operating System", + "sections": { + "physical_size": 452608 + } }, - "pid": 5900 + "pid": 5900, + "start": "2022-11-09T19:17:20.415Z" }, "registry": { "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\Windows Live ID Token Issuer\\Certificates\\B68D8F953E551914324E557E6164D68B9926650C", @@ -1062,8 +1200,8 @@ "9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f" ], "hosts": [ - "testmachine6", "999b6fd7c532534ba50b3232fa992c38a273d4fb", + "testmachine6", "nt authority" ], "user": [ @@ -1074,6 +1212,1849 @@ "preserve_original_event", "preserve_duplicate_custom_fields" ] + }, + { + "@timestamp": "2023-07-19T12:17:42.778Z", + "destination": { + "ip": "175.16.199.0", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connectionfailed", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:17:42.7782364Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"ConnectionFailed\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 80,\"RemoteUrl\": \"subdomain.domain.tld\",\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 50258,\"Protocol\": \"Tcp\",\"LocalIPType\": \"Private\",\"RemoteIPType\": \"Public\",\"InitiatingProcessSHA1\": \"3e44b0d0319d24fa51b472de23062b10c0c32ec3\",\"InitiatingProcessSHA256\": \"fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb\",\"InitiatingProcessMD5\": \"df9b3bee634a5578481a8c7cf4f614a3\",\"InitiatingProcessFileName\": \"msedgewebview2.exe\",\"InitiatingProcessFileSize\": 3657056,\"InitiatingProcessVersionInfoCompanyName\": \"Microsoft Corporation\",\"InitiatingProcessVersionInfoProductName\": \"Microsoft Edge WebView2\",\"InitiatingProcessVersionInfoProductVersion\": \"114.0.1823.79\",\"InitiatingProcessVersionInfoInternalFileName\": \"msedgewebview2_exe\",\"InitiatingProcessVersionInfoOriginalFileName\": \"msedgewebview2.exe\",\"InitiatingProcessVersionInfoFileDescription\": \"Microsoft Edge WebView2\",\"InitiatingProcessId\": 17916,\"InitiatingProcessCommandLine\": \"\\\"msedgewebview2.exe\\\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\\\"C:\\\\Users\\\\username\\\\AppData\\\\Local\\\\Citrix\\\\SelfService\\\\CitrixWebControlCache\\\\EBWebView\\\" --webview-exe-name=SelfService.exe --webview-exe-version=22.3.1.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3456 --field-trial-handle=1824,i --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=MojoIpcz /prefetch:3 /pfhostedapp:1234\",\"InitiatingProcessCreationTime\": \"2023-08-09T18:43:00.0810399Z\",\"InitiatingProcessFolderPath\": \"c:\\\\program files (x86)\\\\microsoft\\\\edgewebview\\\\application\\\\114.0.1823.79\\\\msedgewebview2.exe\",\"InitiatingProcessParentFileName\": \"msedgewebview2.exe\",\"InitiatingProcessParentId\": 17808,\"InitiatingProcessParentCreationTime\": \"2023-08-09T18:42:58.8197327Z\",\"InitiatingProcessAccountDomain\": \"corporatedomain\",\"InitiatingProcessAccountName\": \"username\",\"InitiatingProcessAccountSid\": \"S-1-5-21-57989841-2025429265-839522115-329672\",\"InitiatingProcessAccountUpn\": \"email@domain\",\"InitiatingProcessAccountObjectId\": \"3600a12b-9d66-4dc3-9e2a-956c3623d0e4\",\"InitiatingProcessIntegrityLevel\": \"Medium\",\"InitiatingProcessTokenElevation\": \"TokenElevationTypeDefault\",\"ReportId\": 110313,\"AppGuardContainerId\":null,\"AdditionalFields\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:21.9948950Z\"}", + "type": [ + "denied" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "ConnectionFailed" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "account_domain": "corporatedomain", + "account_name": "username", + "account_object_id": "3600a12b-9d66-4dc3-9e2a-956c3623d0e4", + "account_sid": "S-1-5-21-57989841-2025429265-839522115-329672", + "account_upn": "email@domain", + "command_line": "\"msedgewebview2.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"C:\\Users\\username\\AppData\\Local\\Citrix\\SelfService\\CitrixWebControlCache\\EBWebView\" --webview-exe-name=SelfService.exe --webview-exe-version=22.3.1.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3456 --field-trial-handle=1824,i --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=MojoIpcz /prefetch:3 /pfhostedapp:1234", + "creation_time": "2023-08-09T18:43:00.081Z", + "file_name": "msedgewebview2.exe", + "file_size": 3657056, + "folder_path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\114.0.1823.79\\msedgewebview2.exe", + "id": 17916, + "integrity_level": "Medium", + "md5": "df9b3bee634a5578481a8c7cf4f614a3", + "parent_creation_time": "2023-08-09T18:42:58.819Z", + "parent_file_name": "msedgewebview2.exe", + "parent_id": 17808, + "sha1": "3e44b0d0319d24fa51b472de23062b10c0c32ec3", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb", + "token_elevation": "TokenElevationTypeDefault", + "version_info_company_name": "Microsoft Corporation", + "version_info_file_description": "Microsoft Edge WebView2", + "version_info_internal_file_name": "msedgewebview2_exe", + "version_info_original_file_name": "msedgewebview2.exe", + "version_info_product_name": "Microsoft Edge WebView2", + "version_info_product_version": "114.0.1823.79" + }, + "local": { + "ip": "89.160.20.112", + "ip_type": "Private", + "port": 50258 + }, + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "ip_type": "Public", + "port": 80, + "url": "subdomain.domain.tld" + }, + "report_id": "110313", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:21.994Z", + "timestamp": "2023-07-19T12:17:42.778Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "tcp" + }, + "process": { + "args": [ + "\"msedgewebview2.exe\"", + "--type=utility", + "--utility-sub-type=network.mojom.NetworkService", + "--lang=en-US", + "--service-sandbox-type=none", + "--noerrdialogs", + "--user-data-dir=\"C:\\Users\\username\\AppData\\Local\\Citrix\\SelfService\\CitrixWebControlCache\\EBWebView\"", + "--webview-exe-name=SelfService.exe", + "--webview-exe-version=22.3.1.22", + "--embedded-browser-webview=1", + "--embedded-browser-webview-dpi-awareness=2", + "--mojo-platform-channel-handle=3456", + "--field-trial-handle=1824,i", + "--enable-features=msSingleSignOnOSForPrimaryAccountIsShared", + "--disable-features=MojoIpcz", + "/prefetch:3", + "/pfhostedapp:1234" + ], + "args_count": 17, + "command_line": "\"msedgewebview2.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir=\"C:\\Users\\username\\AppData\\Local\\Citrix\\SelfService\\CitrixWebControlCache\\EBWebView\" --webview-exe-name=SelfService.exe --webview-exe-version=22.3.1.22 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --mojo-platform-channel-handle=3456 --field-trial-handle=1824,i --enable-features=msSingleSignOnOSForPrimaryAccountIsShared --disable-features=MojoIpcz /prefetch:3 /pfhostedapp:1234", + "executable": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\114.0.1823.79\\msedgewebview2.exe", + "hash": { + "md5": "df9b3bee634a5578481a8c7cf4f614a3", + "sha1": "3e44b0d0319d24fa51b472de23062b10c0c32ec3", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + }, + "name": "msedgewebview2.exe", + "parent": { + "name": "msedgewebview2.exe", + "pid": 17808, + "start": "2023-08-09T18:42:58.819Z" + }, + "pe": { + "company": "Microsoft Corporation", + "description": "Microsoft Edge WebView2", + "file_version": "114.0.1823.79", + "original_file_name": "msedgewebview2.exe", + "product": "Microsoft Edge WebView2", + "sections": { + "physical_size": 3657056 + } + }, + "pid": 17916, + "start": "2023-08-09T18:43:00.081Z" + }, + "related": { + "hash": [ + "df9b3bee634a5578481a8c7cf4f614a3", + "3e44b0d0319d24fa51b472de23062b10c0c32ec3", + "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + ], + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain", + "corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ], + "user": [ + "username" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 50258 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "extension": "tld", + "original": "subdomain.domain.tld", + "path": "subdomain.domain.tld" + } + }, + { + "@timestamp": "2023-07-19T12:16:10.748Z", + "destination": { + "ip": "175.16.199.0", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "dnsconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:10.7489034Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"DnsConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 53,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 54125,\"Protocol\": \"Udp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 19542,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"Out\", \"trans_id\": \"18296\", \"rtt\": \"0.05926012992858887\", \"query\": \"janeslaptop1.corporatedomain\", \"qclass\": \"1\", \"qclass_name\": \"C_INTERNET\", \"qtype\": \"1\", \"qtype_name\": \"A\", \"rcode\": \"0\", \"uid\": \"CpeJkh3698EpWwy4Z9\", \"rcode_name\": \"NOERROR\", \"AA\": \"true\", \"TC\": \"false\", \"RD\": \"true\", \"RA\": \"true\", \"answers\": \"[\\\"89.160.20.112\\\"]\", \"TTLs\": \"[1200.0]\", \"rejected\": \"false\", \"ts\": \"133370937691236740\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:22.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "DnsConnectionInspected" + }, + "additional_fields": { + "AA": "true", + "RA": "true", + "RD": "true", + "TC": "false", + "TTLs": "[1200.0]", + "answers": "[\"89.160.20.112\"]", + "qclass": "1", + "qclass_name": "C_INTERNET", + "qtype": "1", + "qtype_name": "A", + "query": "janeslaptop1.corporatedomain", + "rcode": "0", + "rcode_name": "NOERROR", + "rejected": "false", + "rtt": "0.05926012992858887", + "trans_id": "18296", + "ts": "133370937691236740", + "uid": "CpeJkh3698EpWwy4Z9" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 54125 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Udp", + "remote": { + "ip": "175.16.199.0", + "port": 53 + }, + "report_id": "19542", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:22.994Z", + "timestamp": "2023-07-19T12:16:10.748Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "udp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 54125 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:16:28.623Z", + "destination": { + "ip": "89.160.20.112", + "port": 55514 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ntlmauthenticationinspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:28.6231143Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"NtlmAuthenticationInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 135,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 55514,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 33108,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"In\", \"server_nb_computer_name\": \"hostname\", \"server_nb_domain_name\": \"corporatedomain\", \"server_dns_computer_name\": \"janeslaptop1.corporatedomain\", \"server_dns_domain_name\": \"corporatedomain\", \"server_tree_name\": \"corporatedomain\", \"uid\": \"Cd6CKC1yC7AvYHXnq\", \"server_version\": \"10.0 22621 15\", \"ts\": \"133370931234950000\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:23.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "NtlmAuthenticationInspected" + }, + "additional_fields": { + "server_dns_computer_name": "janeslaptop1.corporatedomain", + "server_dns_domain_name": "corporatedomain", + "server_nb_computer_name": "hostname", + "server_nb_domain_name": "corporatedomain", + "server_tree_name": "corporatedomain", + "server_version": "10.0 22621 15", + "ts": "133370931234950000", + "uid": "Cd6CKC1yC7AvYHXnq" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 55514 + }, + "network_direction": "In", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 135 + }, + "report_id": "33108", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:23.994Z", + "timestamp": "2023-07-19T12:16:28.623Z" + } + }, + "network": { + "direction": "inbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "175.16.199.0", + "89.160.20.112" + ] + }, + "source": { + "ip": "175.16.199.0", + "port": 55514 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:16:46.717Z", + "destination": { + "ip": "175.16.199.0", + "port": 88 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "networksignatureinspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:46.7170048Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"NetworkSignatureInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 88,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 52629,\"Protocol\":null,\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 33111,\"AppGuardContainerId\":null,\"AdditionalFields\": \"{\\\"SignatureName\\\":\\\"Kerberos_TGS_REQ\\\",\\\"SignatureMatchedContent\\\":\\\"%05%A2%01%0C\\\"}\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:24.9948950Z\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "NetworkSignatureInspected" + }, + "additional_fields": { + "SignatureMatchedContent": "%05%A2%01%0C", + "SignatureName": "Kerberos_TGS_REQ" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 52629 + }, + "operation_name": "Publish", + "remote": { + "ip": "175.16.199.0", + "port": 88 + }, + "report_id": "33111", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:24.994Z", + "timestamp": "2023-07-19T12:16:46.717Z" + } + }, + "network": { + "direction": "unknown" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 52629 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:20:29.940Z", + "destination": { + "ip": "175.16.199.0", + "port": 8080 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "httpconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:20:29.9404916Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"HttpConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 8080,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 65132,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 19673,\"AppGuardContainerId\":null,\"AdditionalFields\": \"{\\\"direction\\\":\\\"Out\\\",\\\"host\\\":\\\"www.gstatic.com\\\",\\\"method\\\":\\\"CONNECT\\\",\\\"proxied\\\":\\\"[\\\\\\\"PROXY-CONNECTION -\u003e keep-alive\\\\\\\"]\\\",\\\"request_body_len\\\":\\\"0\\\",\\\"response_body_len\\\":\\\"0\\\",\\\"status_code\\\":\\\"200\\\",\\\"status_msg\\\":\\\"Connection established\\\",\\\"tags\\\":\\\"[]\\\",\\\"trans_depth\\\":\\\"1\\\",\\\"uri\\\":\\\"www.gstatic.com:443\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0\\\"}\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:25.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "HttpConnectionInspected" + }, + "additional_fields": { + "host": "www.gstatic.com", + "method": "CONNECT", + "proxied": "[\"PROXY-CONNECTION -\u003e keep-alive\"]", + "request_body_len": "0", + "response_body_len": "0", + "status_code": "200", + "status_msg": "Connection established", + "tags": "[]", + "trans_depth": "1", + "uri": "www.gstatic.com:443", + "user_agent": "Mozilla/5.0 (Windows NT 10.0" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 65132 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 8080 + }, + "report_id": "19673", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:25.994Z", + "timestamp": "2023-07-19T12:20:29.940Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 65132 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:16:55.952Z", + "destination": { + "ip": "175.16.199.0", + "port": 8080 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connectionsuccess", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:55.9520799Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"ConnectionSuccess\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 8080,\"RemoteUrl\": \"url.com\",\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 50830,\"Protocol\": \"Tcp\",\"LocalIPType\": \"Private\",\"RemoteIPType\": \"Private\",\"InitiatingProcessSHA1\": \"071336f8df7d581188f59c3e8edd21e57f11c146\",\"InitiatingProcessSHA256\": \"fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb\",\"InitiatingProcessMD5\": \"7448f851eb4e9b2fbfc46b2b49daf43f\",\"InitiatingProcessFileName\": \"msoia.exe\",\"InitiatingProcessFileSize\": 8522792,\"InitiatingProcessVersionInfoCompanyName\": \"Microsoft Corporation\",\"InitiatingProcessVersionInfoProductName\": \"Microsoft Office\",\"InitiatingProcessVersionInfoProductVersion\": \"16.0.123456.123456\",\"InitiatingProcessVersionInfoInternalFileName\": \"msoia\",\"InitiatingProcessVersionInfoOriginalFileName\": \"msoia.exe\",\"InitiatingProcessVersionInfoFileDescription\": \"Office Telemetry Dashboard Agent (OTD msoia)\",\"InitiatingProcessId\": 65498,\"InitiatingProcessCommandLine\": \"msoia.exe\\\" scan upload\",\"InitiatingProcessCreationTime\": \"2023-07-19T12:16:56.1160286Z\",\"InitiatingProcessFolderPath\": \"c:\\\\program files\\\\mozilla firefox\\\\firefox.exe\",\"InitiatingProcessParentFileName\": \"firefox.exe\",\"InitiatingProcessParentId\": 65498,\"InitiatingProcessParentCreationTime\": \"2023-07-19T12:16:56.0455613Z\",\"InitiatingProcessAccountDomain\": \"corporatedomain\",\"InitiatingProcessAccountName\": \"username\",\"InitiatingProcessAccountSid\": \"S-1-5-21-57989841-2025429265-839522115-325552\",\"InitiatingProcessAccountUpn\": \"email@domain\",\"InitiatingProcessAccountObjectId\": \"e2157d1b-258b-4027-9f6f-76514c05c048\",\"InitiatingProcessIntegrityLevel\": \"Medium\",\"InitiatingProcessTokenElevation\": \"TokenElevationTypeDefault\",\"ReportId\": 29293,\"AppGuardContainerId\":null,\"AdditionalFields\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:26.9948950Z\"}", + "type": [ + "end" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "ConnectionSuccess" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "account_domain": "corporatedomain", + "account_name": "username", + "account_object_id": "e2157d1b-258b-4027-9f6f-76514c05c048", + "account_sid": "S-1-5-21-57989841-2025429265-839522115-325552", + "account_upn": "email@domain", + "command_line": "msoia.exe\" scan upload", + "creation_time": "2023-07-19T12:16:56.116Z", + "file_name": "msoia.exe", + "file_size": 8522792, + "folder_path": "c:\\program files\\mozilla firefox\\firefox.exe", + "id": 65498, + "integrity_level": "Medium", + "md5": "7448f851eb4e9b2fbfc46b2b49daf43f", + "parent_creation_time": "2023-07-19T12:16:56.045Z", + "parent_file_name": "firefox.exe", + "parent_id": 65498, + "sha1": "071336f8df7d581188f59c3e8edd21e57f11c146", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb", + "token_elevation": "TokenElevationTypeDefault", + "version_info_company_name": "Microsoft Corporation", + "version_info_file_description": "Office Telemetry Dashboard Agent (OTD msoia)", + "version_info_internal_file_name": "msoia", + "version_info_original_file_name": "msoia.exe", + "version_info_product_name": "Microsoft Office", + "version_info_product_version": "16.0.123456.123456" + }, + "local": { + "ip": "89.160.20.112", + "ip_type": "Private", + "port": 50830 + }, + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "ip_type": "Private", + "port": 8080, + "url": "url.com" + }, + "report_id": "29293", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:26.994Z", + "timestamp": "2023-07-19T12:16:55.952Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "tcp" + }, + "process": { + "args": [ + "msoia.exe\"", + "scan", + "upload" + ], + "args_count": 3, + "command_line": "msoia.exe\" scan upload", + "executable": "c:\\program files\\mozilla firefox\\firefox.exe", + "hash": { + "md5": "7448f851eb4e9b2fbfc46b2b49daf43f", + "sha1": "071336f8df7d581188f59c3e8edd21e57f11c146", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + }, + "name": "msoia.exe", + "parent": { + "name": "firefox.exe", + "pid": 65498, + "start": "2023-07-19T12:16:56.045Z" + }, + "pe": { + "company": "Microsoft Corporation", + "description": "Office Telemetry Dashboard Agent (OTD msoia)", + "file_version": "16.0.123456.123456", + "original_file_name": "msoia.exe", + "product": "Microsoft Office", + "sections": { + "physical_size": 8522792 + } + }, + "pid": 65498, + "start": "2023-07-19T12:16:56.116Z" + }, + "related": { + "hash": [ + "7448f851eb4e9b2fbfc46b2b49daf43f", + "071336f8df7d581188f59c3e8edd21e57f11c146", + "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + ], + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain", + "corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ], + "user": [ + "username" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 50830 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "extension": "com", + "original": "url.com", + "path": "url.com" + } + }, + { + "@timestamp": "2023-07-19T12:16:25.741Z", + "destination": { + "ip": "175.16.199.0", + "port": 8531 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "sslconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:25.7414522Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"SslConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 8531,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 53645,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 6694,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"Out\", \"version\": \"TLSv12\", \"curve\": \"secp384r1\", \"server_name\": \"janeslaptop1.corporatedomain\", \"resumed\": \"false\", \"next_protocol\": \"h2\", \"established\": \"true\", \"subject\": \"CN=janeslaptop1.corporatedomain,O=Company,C=US\", \"uid\": \"CmHkX031vK8QoEJ3O7\", \"issuer\": \"CN=Company System CA 22,O=Company,C=US\", \"cipher\": \"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\", \"ts\": \"133370123850310000\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:27.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "SslConnectionInspected" + }, + "additional_fields": { + "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "curve": "secp384r1", + "established": "true", + "issuer": "CN=Company System CA 22,O=Company,C=US", + "next_protocol": "h2", + "resumed": "false", + "server_name": "janeslaptop1.corporatedomain", + "subject": "CN=janeslaptop1.corporatedomain,O=Company,C=US", + "ts": "133370123850310000", + "uid": "CmHkX031vK8QoEJ3O7", + "version": "TLSv12" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 53645 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 8531 + }, + "report_id": "6694", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:27.994Z", + "timestamp": "2023-07-19T12:16:25.741Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 53645 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T14:30:34.595Z", + "destination": { + "ip": "175.16.199.0", + "port": 54022 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "inboundconnectionaccepted", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T14:30:34.5955683Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"InboundConnectionAccepted\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 54022,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 135,\"Protocol\": \"Tcp\",\"LocalIPType\": \"Private\",\"RemoteIPType\": \"Private\",\"InitiatingProcessSHA1\": \"0cb388ecf4055d73afc0ac4012b607753f899f08\",\"InitiatingProcessSHA256\": \"949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b\",\"InitiatingProcessMD5\": \"122beaba9a49e1c60bf8446668a1de3e\",\"InitiatingProcessFileName\": \"svchost.exe\",\"InitiatingProcessFileSize\": 79990,\"InitiatingProcessVersionInfoCompanyName\": \"Microsoft Corporation\",\"InitiatingProcessVersionInfoProductName\": \"Microsoft® Windows® Operating System\",\"InitiatingProcessVersionInfoProductVersion\": \"10.0.22621.1\",\"InitiatingProcessVersionInfoInternalFileName\": \"svchost.exe\",\"InitiatingProcessVersionInfoOriginalFileName\": \"svchost.exe\",\"InitiatingProcessVersionInfoFileDescription\": \"Host Process for Windows Services\",\"InitiatingProcessId\": 1772,\"InitiatingProcessCommandLine\": \"svchost.exe -k RPCSS -p\",\"InitiatingProcessCreationTime\": \"2023-07-19T14:29:02.5168183Z\",\"InitiatingProcessFolderPath\": \"c:\\\\windows\\\\system32\\\\svchost.exe\",\"InitiatingProcessParentFileName\": \"services.exe\",\"InitiatingProcessParentId\": 1152,\"InitiatingProcessParentCreationTime\": \"2023-07-19T14:29:01.9698479Z\",\"InitiatingProcessAccountDomain\": \"nt authority\",\"InitiatingProcessAccountName\": \"network service\",\"InitiatingProcessAccountSid\": \"S-1-5-12\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\": \"System\",\"InitiatingProcessTokenElevation\": \"TokenElevationTypeDefault\",\"ReportId\": 884651,\"AppGuardContainerId\":null,\"AdditionalFields\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:28.9948950Z\"}", + "type": [ + "allowed" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "InboundConnectionAccepted" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "account_domain": "nt authority", + "account_name": "network service", + "account_sid": "S-1-5-12", + "command_line": "svchost.exe -k RPCSS -p", + "creation_time": "2023-07-19T14:29:02.516Z", + "file_name": "svchost.exe", + "file_size": 79990, + "folder_path": "c:\\windows\\system32\\svchost.exe", + "id": 1772, + "integrity_level": "System", + "md5": "122beaba9a49e1c60bf8446668a1de3e", + "parent_creation_time": "2023-07-19T14:29:01.969Z", + "parent_file_name": "services.exe", + "parent_id": 1152, + "sha1": "0cb388ecf4055d73afc0ac4012b607753f899f08", + "sha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b", + "token_elevation": "TokenElevationTypeDefault", + "version_info_company_name": "Microsoft Corporation", + "version_info_file_description": "Host Process for Windows Services", + "version_info_internal_file_name": "svchost.exe", + "version_info_original_file_name": "svchost.exe", + "version_info_product_name": "Microsoft® Windows® Operating System", + "version_info_product_version": "10.0.22621.1" + }, + "local": { + "ip": "89.160.20.112", + "ip_type": "Private", + "port": 135 + }, + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "ip_type": "Private", + "port": 54022 + }, + "report_id": "884651", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:28.994Z", + "timestamp": "2023-07-19T14:30:34.595Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "tcp" + }, + "process": { + "args": [ + "svchost.exe", + "-k", + "RPCSS", + "-p" + ], + "args_count": 4, + "command_line": "svchost.exe -k RPCSS -p", + "executable": "c:\\windows\\system32\\svchost.exe", + "hash": { + "md5": "122beaba9a49e1c60bf8446668a1de3e", + "sha1": "0cb388ecf4055d73afc0ac4012b607753f899f08", + "sha256": "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b" + }, + "name": "svchost.exe", + "parent": { + "name": "services.exe", + "pid": 1152, + "start": "2023-07-19T14:29:01.969Z" + }, + "pe": { + "company": "Microsoft Corporation", + "description": "Host Process for Windows Services", + "file_version": "10.0.22621.1", + "original_file_name": "svchost.exe", + "product": "Microsoft® Windows® Operating System", + "sections": { + "physical_size": 79990 + } + }, + "pid": 1772, + "start": "2023-07-19T14:29:02.516Z" + }, + "related": { + "hash": [ + "122beaba9a49e1c60bf8446668a1de3e", + "0cb388ecf4055d73afc0ac4012b607753f899f08", + "949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b" + ], + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain", + "nt authority" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ], + "user": [ + "network service" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 135 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:18:35.239Z", + "destination": { + "ip": "89.160.20.112" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "icmpconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:18:35.2391226Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"IcmpConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\":null,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\":null,\"Protocol\": \"Icmp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 9846513,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"In\", \"conn_state\": \"OTH\", \"duration\": \"236.02695489659583\", \"missed_bytes\": \"0\", \"orig_bytes\": \"1344\", \"orig_ip_bytes\": \"2016\", \"orig_pkts\": \"24\", \"resp_bytes\": \"0\", \"resp_ip_bytes\": \"0\", \"resp_pkts\": \"0\", \"uid\": \"CoJ8an1SJN7SewZU9l\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:29.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "IcmpConnectionInspected" + }, + "additional_fields": { + "conn_state": "OTH", + "duration": "236.02695489659583", + "missed_bytes": "0", + "orig_bytes": "1344", + "orig_ip_bytes": "2016", + "orig_pkts": "24", + "resp_bytes": "0", + "resp_ip_bytes": "0", + "resp_pkts": "0", + "uid": "CoJ8an1SJN7SewZU9l" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112" + }, + "network_direction": "In", + "operation_name": "Publish", + "protocol": "Icmp", + "remote": { + "ip": "175.16.199.0" + }, + "report_id": "9846513", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:29.994Z", + "timestamp": "2023-07-19T12:18:35.239Z" + } + }, + "network": { + "direction": "inbound", + "protocol": "icmp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "175.16.199.0", + "89.160.20.112" + ] + }, + "source": { + "ip": "175.16.199.0" + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:16:15.490Z", + "destination": { + "ip": "175.16.199.0", + "port": 443 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connectionrequest", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:16:15.4903428Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"ConnectionRequest\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 443,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 63295,\"Protocol\": \"Tcp\",\"LocalIPType\": \"Private\",\"RemoteIPType\": \"Public\",\"InitiatingProcessSHA1\": \"5c5a4e9be6721b7bc282d66fa863b6e8935d7252\",\"InitiatingProcessSHA256\": \"fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb\",\"InitiatingProcessMD5\": \"323b1d0476181f99f76babcd87217f89\",\"InitiatingProcessFileName\": \"telemetryd_v2\",\"InitiatingProcessFileSize\": 4934752,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 189,\"InitiatingProcessCommandLine\": \"/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/Frameworks/telemetryd_v2 13\",\"InitiatingProcessCreationTime\": \"2023-07-18T16:38:50.74523Z\",\"InitiatingProcessFolderPath\": \"/applications/microsoft defender.app/contents/macos/wdavdaemon_enterprise.app/contents/frameworks/telemetryd_v2\",\"InitiatingProcessParentFileName\": \"wdavdaemon_enterprise\",\"InitiatingProcessParentId\": 654,\"InitiatingProcessParentCreationTime\": \"2023-07-18T16:38:42.246421Z\",\"InitiatingProcessAccountDomain\": \"macbookpro-123\",\"InitiatingProcessAccountName\": \"root\",\"InitiatingProcessAccountSid\": \"S-1-5-18\",\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 654984,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"InitiatingProcessPosixEffectiveUser\": {\"Sid\": \"S-1-5-12\",\"Name\": \"root\",\"DomainName\": \"MacBookPro-123\",\"LogonId\": 0,\"PosixUserId\": 0,\"PrimaryPosixGroup\": { \"Name\": \"wheel\", \"PosixGroupId\": 0 } }, \"InitiatingProcessPosixEffectiveGroup\": {\"Name\": \"_mdatp\",\"PosixGroupId\": 499 }, \"InitiatingProcessPosixProcessGroupId\": 362, \"InitiatingProcessPosixSessionId\": 0, \"InitiatingProcessCurrentWorkingDirectory\": \"/Applications/Microsoft Defender.app/Contents/MacOS\", \"InitiatingProcessPosixFilePermissions\": [\"None\"], \"InitiatingProcessPosixRealUser\": {\"Sid\": \"S-1-5-12\",\"Name\": \"root\",\"DomainName\": \"MacBookPro-123\",\"LogonId\": 0,\"PosixUserId\": 0,\"PrimaryPosixGroup\": { \"Name\": \"wheel\", \"PosixGroupId\": 0 } }}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:30.9948950Z\"}", + "type": [ + "start" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "ConnectionRequest" + }, + "additional_fields": { + "InitiatingProcessCurrentWorkingDirectory": "/Applications/Microsoft Defender.app/Contents/MacOS", + "InitiatingProcessPosixEffectiveGroup": { + "Name": "_mdatp", + "PosixGroupId": 499 + }, + "InitiatingProcessPosixEffectiveUser": { + "DomainName": "MacBookPro-123", + "LogonId": 0, + "Name": "root", + "PosixUserId": 0, + "PrimaryPosixGroup": { + "Name": "wheel", + "PosixGroupId": 0 + }, + "Sid": "S-1-5-12" + }, + "InitiatingProcessPosixFilePermissions": [ + "None" + ], + "InitiatingProcessPosixProcessGroupId": 362, + "InitiatingProcessPosixRealUser": { + "DomainName": "MacBookPro-123", + "LogonId": 0, + "Name": "root", + "PosixUserId": 0, + "PrimaryPosixGroup": { + "Name": "wheel", + "PosixGroupId": 0 + }, + "Sid": "S-1-5-12" + }, + "InitiatingProcessPosixSessionId": 0 + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "account_domain": "macbookpro-123", + "account_name": "root", + "account_sid": "S-1-5-18", + "command_line": "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/Frameworks/telemetryd_v2 13", + "creation_time": "2023-07-18T16:38:50.745Z", + "file_name": "telemetryd_v2", + "file_size": 4934752, + "folder_path": "/applications/microsoft defender.app/contents/macos/wdavdaemon_enterprise.app/contents/frameworks/telemetryd_v2", + "id": 189, + "md5": "323b1d0476181f99f76babcd87217f89", + "parent_creation_time": "2023-07-18T16:38:42.246Z", + "parent_file_name": "wdavdaemon_enterprise", + "parent_id": 654, + "sha1": "5c5a4e9be6721b7bc282d66fa863b6e8935d7252", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb", + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "ip_type": "Private", + "port": 63295 + }, + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "ip_type": "Public", + "port": 443 + }, + "report_id": "654984", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:30.994Z", + "timestamp": "2023-07-19T12:16:15.490Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "tcp" + }, + "process": { + "args": [ + "/Applications/Microsoft", + "Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/Frameworks/telemetryd_v2", + "13" + ], + "args_count": 3, + "command_line": "/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/Frameworks/telemetryd_v2 13", + "executable": "/applications/microsoft defender.app/contents/macos/wdavdaemon_enterprise.app/contents/frameworks/telemetryd_v2", + "hash": { + "md5": "323b1d0476181f99f76babcd87217f89", + "sha1": "5c5a4e9be6721b7bc282d66fa863b6e8935d7252", + "sha256": "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + }, + "name": "telemetryd_v2", + "parent": { + "name": "wdavdaemon_enterprise", + "pid": 654, + "start": "2023-07-18T16:38:42.246Z" + }, + "pe": { + "sections": { + "physical_size": 4934752 + } + }, + "pid": 189, + "start": "2023-07-18T16:38:50.745Z" + }, + "related": { + "hash": [ + "323b1d0476181f99f76babcd87217f89", + "5c5a4e9be6721b7bc282d66fa863b6e8935d7252", + "fe0ddd41ed02f1faa59526c53178c8366d9c90a777619eaaf7b7e5656f3ea4cb" + ], + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain", + "macbookpro-123" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ], + "user": [ + "root" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 63295 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T07:43:20.845Z", + "destination": { + "ip": "2a02:cf40::", + "port": 8080 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "connectionfound", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T07:43:20.8450859Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"ConnectionFound\",\"RemoteIP\": \"2a02:cf40::\",\"RemotePort\": 8080,\"RemoteUrl\":null,\"LocalIP\": \"2a02:cf40::\",\"LocalPort\": 61736,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\": \"EXCEL.EXE\",\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\": \"C:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office16\\\\EXCEL.EXE\",\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 654894,\"AppGuardContainerId\":null,\"AdditionalFields\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:31.9948950Z\"}", + "type": [ + "info" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "ConnectionFound" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "file_name": "EXCEL.EXE", + "folder_path": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE", + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "2a02:cf40::", + "port": 61736 + }, + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "2a02:cf40::", + "port": 8080 + }, + "report_id": "654894", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:31.994Z", + "timestamp": "2023-07-19T07:43:20.845Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "tcp" + }, + "process": { + "executable": "C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE", + "name": "EXCEL.EXE", + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "2a02:cf40::" + ] + }, + "source": { + "ip": "2a02:cf40::", + "port": 61736 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T14:11:37.698Z", + "destination": { + "ip": "175.16.199.0", + "port": 22 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "sshconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T14:11:37.6987985Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"SshConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 22,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 49708,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 89741320,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"Out\", \"auth_attempts\": \"2\", \"auth_success\": \"true\", \"client\": \"SSH-2.0-PuTTY\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:32.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "SshConnectionInspected" + }, + "additional_fields": { + "auth_attempts": "2", + "auth_success": "true", + "client": "SSH-2.0-PuTTY" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 49708 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 22 + }, + "report_id": "89741320", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:32.994Z", + "timestamp": "2023-07-19T14:11:37.698Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 49708 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T14:18:19.714Z", + "destination": { + "ip": "175.16.199.0", + "port": 5432 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "inboundinternetscaninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T14:18:19.7144334Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"InboundInternetScanInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 5432,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 46390,\"Protocol\": \"Udp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 9841651,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"PublicScannedPort\": 5432, \"PublicScannedIp\": \"175.16.199.0\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:33.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "InboundInternetScanInspected" + }, + "additional_fields": { + "PublicScannedIp": "175.16.199.0", + "PublicScannedPort": 5432 + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 46390 + }, + "operation_name": "Publish", + "protocol": "Udp", + "remote": { + "ip": "175.16.199.0", + "port": 5432 + }, + "report_id": "9841651", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:33.994Z", + "timestamp": "2023-07-19T14:18:19.714Z" + } + }, + "network": { + "direction": "unknown", + "protocol": "udp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 46390 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T14:09:43.873Z", + "destination": { + "ip": "175.16.199.0", + "port": 25 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "smtpconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T14:09:43.8734771Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"SmtpConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 25,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 60697,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 18984951960,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"Out\", \"fuids\": \"[]\", \"helo\": \"janeslaptop1.corporatedomain\", \"last_reply\": \"220 2.0.0 SMTP server ready\", \"path\": \"[\\\"89.160.20.112\\\",\\\"89.160.20.112\\\"]\", \"tls\": \"true\", \"trans_depth\": \"1\", \"uid\": \"0278e28ff5d8eff6d3\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:34.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "SmtpConnectionInspected" + }, + "additional_fields": { + "fuids": "[]", + "helo": "janeslaptop1.corporatedomain", + "last_reply": "220 2.0.0 SMTP server ready", + "path": "[\"89.160.20.112\",\"89.160.20.112\"]", + "tls": "true", + "trans_depth": "1", + "uid": "0278e28ff5d8eff6d3" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 60697 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 25 + }, + "report_id": "18984951960", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:34.994Z", + "timestamp": "2023-07-19T14:09:43.873Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 60697 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T12:12:10.059Z", + "destination": { + "ip": "175.16.199.0", + "port": 21 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "ftpconnectioninspected", + "category": [ + "network" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceNetworkEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T12:12:10.0598052Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"FtpConnectionInspected\",\"RemoteIP\": \"175.16.199.0\",\"RemotePort\": 21,\"RemoteUrl\":null,\"LocalIP\": \"89.160.20.112\",\"LocalPort\": 56885,\"Protocol\": \"Tcp\",\"LocalIPType\":null,\"RemoteIPType\":null,\"InitiatingProcessSHA1\":null,\"InitiatingProcessSHA256\":null,\"InitiatingProcessMD5\":null,\"InitiatingProcessFileName\":null,\"InitiatingProcessFileSize\":null,\"InitiatingProcessVersionInfoCompanyName\":null,\"InitiatingProcessVersionInfoProductName\":null,\"InitiatingProcessVersionInfoProductVersion\":null,\"InitiatingProcessVersionInfoInternalFileName\":null,\"InitiatingProcessVersionInfoOriginalFileName\":null,\"InitiatingProcessVersionInfoFileDescription\":null,\"InitiatingProcessId\": 0,\"InitiatingProcessCommandLine\":null,\"InitiatingProcessCreationTime\":null,\"InitiatingProcessFolderPath\":null,\"InitiatingProcessParentFileName\":null,\"InitiatingProcessParentId\": 0,\"InitiatingProcessParentCreationTime\":null,\"InitiatingProcessAccountDomain\":null,\"InitiatingProcessAccountName\":null,\"InitiatingProcessAccountSid\":null,\"InitiatingProcessAccountUpn\":null,\"InitiatingProcessAccountObjectId\":null,\"InitiatingProcessIntegrityLevel\":null,\"InitiatingProcessTokenElevation\": \"None\",\"ReportId\": 98498,\"AppGuardContainerId\":null,\"AdditionalFields\": { \"direction\": \"Out\", \"user\": \"\u003cunknown\u003e\", \"reply_msg\": \"Service ready\", \"reply_code\": \"220\", \"cwd\": \".\", \"command\": \"\u003cinit\u003e\", \"uid\": \"603f4dc5c8d46599fd\"}},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:35.9948950Z\"}" + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "action": { + "type": "FtpConnectionInspected" + }, + "additional_fields": { + "command": "\u003cinit\u003e", + "cwd": ".", + "reply_code": "220", + "reply_msg": "Service ready", + "uid": "603f4dc5c8d46599fd", + "user": "\u003cunknown\u003e" + }, + "category": "AdvancedHunting-DeviceNetworkEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "initiating_process": { + "id": 0, + "parent_id": 0, + "token_elevation": "None" + }, + "local": { + "ip": "89.160.20.112", + "port": 56885 + }, + "network_direction": "Out", + "operation_name": "Publish", + "protocol": "Tcp", + "remote": { + "ip": "175.16.199.0", + "port": 21 + }, + "report_id": "98498", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:35.994Z", + "timestamp": "2023-07-19T12:12:10.059Z" + } + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "parent": { + "pid": 0 + }, + "pid": 0 + }, + "related": { + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain" + ], + "ip": [ + "89.160.20.112", + "175.16.199.0" + ] + }, + "source": { + "ip": "89.160.20.112", + "port": 56885 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-07-19T14:02:19.488Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "processcreated", + "category": [ + "process" + ], + "kind": "event", + "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-DeviceProcessEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\": \"2023-07-19T14:02:19.4882081Z\",\"DeviceId\": \"22bb10ffe3104214b20fc7de339a2b053e915e5c\",\"DeviceName\": \"janeslaptop1.corporatedomain\",\"ActionType\": \"ProcessCreated\",\"FileName\": \"msedgewebview2.exe\",\"FolderPath\": \"C:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\114.0.1823.79\\\\msedgewebview2.exe\",\"SHA1\": \"271eb137d3d8519cb42e5bccd690a3b9a3059f2a\",\"SHA256\": \"075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354\",\"MD5\": \"b21b158fce974aa46125820ce6b42e9d\",\"FileSize\": 3653056,\"ProcessVersionInfoCompanyName\": \"Microsoft Corporation\",\"ProcessVersionInfoProductName\": \"Microsoft Edge WebView2\",\"ProcessVersionInfoProductVersion\": \"114.0.1732.12\",\"ProcessVersionInfoInternalFileName\": \"msedgewebview2_exe\",\"ProcessVersionInfoOriginalFileName\": \"msedgewebview2.exe\",\"ProcessVersionInfoFileDescription\": \"Microsoft Edge WebView2\",\"ProcessId\": 5498762,\"ProcessCommandLine\": \"\\\"msedgewebview2.exe\\\" --type=renderer --noerrdialogs --user-data-dir=\\\"C:\\\\Users\\\\JANEBLOGGS\\\\AppData\\\\Local\\\\Microsoft\\\\Office\\\\16.0\\\\Wef\\\\webview2\\\\4ee9dcb0-735b-442e-945c-177c665efe6b_ADAL\\\\2\\\\EBWebView\\\" --webview-exe-name=MSOUTLOOK.EXE\",\"ProcessIntegrityLevel\": \"Low\",\"ProcessTokenElevation\": \"TokenElevationTypeDefault\",\"ProcessCreationTime\": \"2023-07-19T14:02:19.4882081Z\",\"AccountDomain\": \"corporatedomain\",\"AccountName\": \"janebloggs\",\"AccountSid\": \"S-1-5-21-57989841-2025429265-839522115-962270\",\"AccountUpn\": \"janebloggs@corporate.com\",\"AccountObjectId\": \"4ee9dcb0-735b-442e-945c-177c665efe6b\",\"LogonId\": 3654987,\"InitiatingProcessAccountDomain\": \"corporatedomain\",\"InitiatingProcessAccountName\": \"janebloggs\",\"InitiatingProcessAccountSid\": \"S-1-5-21-57989841-2025429265-839522115-962270\",\"InitiatingProcessAccountUpn\": \"janebloggs@corporate.com\",\"InitiatingProcessAccountObjectId\": \"4ee9dcb0-735b-442e-945c-177c665efe6b\",\"InitiatingProcessLogonId\": 3654987,\"InitiatingProcessIntegrityLevel\": \"Medium\",\"InitiatingProcessTokenElevation\": \"TokenElevationTypeDefault\",\"InitiatingProcessSHA1\": \"271eb137d3d8519cb42e5bccd690a3b9a3059f2a\",\"InitiatingProcessSHA256\": \"075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354\",\"InitiatingProcessMD5\": \"b21b158fce974aa46125820ce6b42e9d\",\"InitiatingProcessFileName\": \"msedgewebview2.exe\",\"InitiatingProcessFileSize\": 5498762,\"InitiatingProcessVersionInfoCompanyName\": \"Microsoft Corporation\",\"InitiatingProcessVersionInfoProductName\": \"Microsoft Edge WebView2\",\"InitiatingProcessVersionInfoProductVersion\": \"114.0.1732.12\",\"InitiatingProcessVersionInfoInternalFileName\": \"msedgewebview2_exe\",\"InitiatingProcessVersionInfoOriginalFileName\": \"msedgewebview2.exe\",\"InitiatingProcessVersionInfoFileDescription\": \"Microsoft Edge WebView2\",\"InitiatingProcessId\": 65485,\"InitiatingProcessCommandLine\": \"\\\"msedgewebview2.exe\\\" --embedded-browser-webview=1 --webview-exe-name=MSOUTLOOK.EXE --webview-exe-version=16.0.15601.20706 --user-data-dir=\\\"C:\\\\Users\\\\USERNAME\\\\AppData\\\\Local\\\\Microsoft\\\\Office\\\\16.0\\\\Wef\\\\webview2\\\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\\\2\\\\EBWebView\\\" --noerrdialogs\",\"InitiatingProcessCreationTime\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2023-07-19T18:03:21.9948950Z\"}", + "type": [ + "end" + ] + }, + "host": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "m365_defender": { + "event": { + "account": { + "domain": "corporatedomain", + "name": "janebloggs", + "object_id": "4ee9dcb0-735b-442e-945c-177c665efe6b", + "sid": "S-1-5-21-57989841-2025429265-839522115-962270", + "upn": "janebloggs@corporate.com" + }, + "action": { + "type": "ProcessCreated" + }, + "category": "AdvancedHunting-DeviceProcessEvents", + "device": { + "id": "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "name": "janeslaptop1.corporatedomain" + }, + "file": { + "name": "msedgewebview2.exe", + "size": 3653056 + }, + "folder_path": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.79\\msedgewebview2.exe", + "initiating_process": { + "account_domain": "corporatedomain", + "account_name": "janebloggs", + "account_object_id": "4ee9dcb0-735b-442e-945c-177c665efe6b", + "account_sid": "S-1-5-21-57989841-2025429265-839522115-962270", + "account_upn": "janebloggs@corporate.com", + "command_line": "\"msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=MSOUTLOOK.EXE --webview-exe-version=16.0.15601.20706 --user-data-dir=\"C:\\Users\\USERNAME\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\2\\EBWebView\" --noerrdialogs", + "file_name": "msedgewebview2.exe", + "file_size": 5498762, + "id": 65485, + "integrity_level": "Medium", + "logon_id": "3654987", + "md5": "b21b158fce974aa46125820ce6b42e9d", + "sha1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a", + "sha256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354", + "token_elevation": "TokenElevationTypeDefault", + "version_info_company_name": "Microsoft Corporation", + "version_info_file_description": "Microsoft Edge WebView2", + "version_info_internal_file_name": "msedgewebview2_exe", + "version_info_original_file_name": "msedgewebview2.exe", + "version_info_product_name": "Microsoft Edge WebView2", + "version_info_product_version": "114.0.1732.12" + }, + "logon": { + "id": "3654987" + }, + "md5": "b21b158fce974aa46125820ce6b42e9d", + "operation_name": "Publish", + "process": { + "command_line": "\"msedgewebview2.exe\" --type=renderer --noerrdialogs --user-data-dir=\"C:\\Users\\JANEBLOGGS\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\4ee9dcb0-735b-442e-945c-177c665efe6b_ADAL\\2\\EBWebView\" --webview-exe-name=MSOUTLOOK.EXE", + "creation_time": "2023-07-19T14:02:19.488Z", + "id": 5498762, + "integrity_level": "Low", + "token_elevation": "TokenElevationTypeDefault", + "version_info_company_name": "Microsoft Corporation", + "version_info_file_description": "Microsoft Edge WebView2", + "version_info_internal_file_name": "msedgewebview2_exe", + "version_info_original_file_name": "msedgewebview2.exe", + "version_info_product_name": "Microsoft Edge WebView2", + "version_info_product_version": "114.0.1732.12" + }, + "sha1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a", + "sha256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354", + "tenant": { + "id": "12345af3-bc0e-4f36-b08e-27759e912345", + "name": "DefaultTenant" + }, + "time": "2023-07-19T18:03:21.994Z", + "timestamp": "2023-07-19T14:02:19.488Z" + } + }, + "process": { + "args": [ + "\"msedgewebview2.exe\"", + "--type=renderer", + "--noerrdialogs", + "--user-data-dir=\"C:\\Users\\JANEBLOGGS\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\4ee9dcb0-735b-442e-945c-177c665efe6b_ADAL\\2\\EBWebView\"", + "--webview-exe-name=MSOUTLOOK.EXE" + ], + "args_count": 5, + "command_line": "\"msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=MSOUTLOOK.EXE --webview-exe-version=16.0.15601.20706 --user-data-dir=\"C:\\Users\\USERNAME\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\2\\EBWebView\" --noerrdialogs", + "executable": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\114.0.1823.79\\msedgewebview2.exe", + "hash": { + "md5": "b21b158fce974aa46125820ce6b42e9d", + "sha1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a", + "sha256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354" + }, + "name": "msedgewebview2.exe", + "parent": { + "args": [ + "\"msedgewebview2.exe\"", + "--embedded-browser-webview=1", + "--webview-exe-name=MSOUTLOOK.EXE", + "--webview-exe-version=16.0.15601.20706", + "--user-data-dir=\"C:\\Users\\USERNAME\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\2\\EBWebView\"", + "--noerrdialogs" + ], + "args_count": 6, + "command_line": "\"msedgewebview2.exe\" --embedded-browser-webview=1 --webview-exe-name=MSOUTLOOK.EXE --webview-exe-version=16.0.15601.20706 --user-data-dir=\"C:\\Users\\USERNAME\\AppData\\Local\\Microsoft\\Office\\16.0\\Wef\\webview2\\1234dcb0-735b-442e-945c-e6c5df94062c_ADAL\\2\\EBWebView\" --noerrdialogs", + "hash": { + "md5": "b21b158fce974aa46125820ce6b42e9d", + "sha1": "271eb137d3d8519cb42e5bccd690a3b9a3059f2a", + "sha256": "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354" + }, + "name": "msedgewebview2.exe", + "pe": { + "company": "Microsoft Corporation", + "description": "Microsoft Edge WebView2", + "file_version": "114.0.1732.12", + "original_file_name": "msedgewebview2.exe", + "product": "Microsoft Edge WebView2", + "sections": { + "physical_size": 5498762 + } + }, + "pid": 65485 + }, + "pe": { + "company": "Microsoft Corporation", + "description": "Microsoft Edge WebView2", + "file_version": "114.0.1732.12", + "original_file_name": "msedgewebview2.exe", + "product": "Microsoft Edge WebView2", + "sections": { + "physical_size": 3653056 + } + }, + "pid": 5498762, + "start": "2023-07-19T14:02:19.488Z" + }, + "related": { + "hash": [ + "b21b158fce974aa46125820ce6b42e9d", + "271eb137d3d8519cb42e5bccd690a3b9a3059f2a", + "075d1edc11548c9ebf7f238dea9393f26c5b83cd0362aa4cc24b1d8a6ebc6354" + ], + "hosts": [ + "22bb10ffe3104214b20fc7de339a2b053e915e5c", + "janeslaptop1.corporatedomain", + "corporatedomain" + ], + "user": [ + "janebloggs" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "user": { + "domain": "corporatedomain", + "id": "S-1-5-21-57989841-2025429265-839522115-962270", + "name": "janebloggs" + } } ] } \ No newline at end of file diff --git a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-email.log-expected.json b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-email.log-expected.json index 26d696d9a01..ee0dd36490d 100644 --- a/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-email.log-expected.json +++ b/packages/m365_defender/data_stream/event/_dev/test/pipeline/test-email.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-11-22T06:19:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -11,7 +11,7 @@ "test@testMSFTalerts.onmicrosoft.com" ] }, - "local_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", + "message_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", "to": { "address": [ "user@testmsftalerts.onmicrosoft.com" @@ -23,9 +23,7 @@ "email", "file" ], - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-EmailAttachmentInfo\",\"operationName\":\"Publish\",\"properties\":{\"DetectionMethods\":null,\"FileName\":\"AttachedImage\",\"FileSize\":1354,\"FileType\":\"png\",\"NetworkMessageId\":\"a194a8a6-d97c-4be1-ae31-08dacc512345\",\"RecipientEmailAddress\":\"user@testmsftalerts.onmicrosoft.com\",\"RecipientObjectId\":\"4c51aa92-70f3-446d-8c65-a1c5ee412345\",\"ReportId\":\"6571\",\"SHA256\":\"67ff7e5e56d160f3343b712e018f7aea4ac6c544f8c73d9b6509550fbd512345\",\"SenderDisplayName\":\"Test\",\"SenderFromAddress\":\"test@testMSFTalerts.onmicrosoft.com\",\"SenderObjectId\":\"007c979b-47e7-4747-b9a3-58de6bd12345\",\"ThreatNames\":null,\"ThreatTypes\":null,\"Timestamp\":\"2022-11-22T06:19:40Z\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:21:48.0672868Z\"}", "type": [ "info" @@ -87,7 +85,7 @@ { "@timestamp": "2022-11-22T06:19:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "Intra-org", @@ -96,7 +94,8 @@ "user@testMSFTalerts.onmicrosoft.com" ] }, - "local_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", + "local_id": "\\u003codspmicro-Share-aa027ba0-90b4-2000-ba44-ea7a298163ce-f7f97e88-ecd5-492d-b91f-d7e29a01d0d4-a5747f2a-025d-46a4-8e3c-c6bf4a2c53b9@8956DAA12345\\u003e", + "message_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", "subject": "test shared \"Test URL Click Document \" with you.", "to": { "address": [ @@ -108,9 +107,7 @@ "category": [ "email" ], - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-EmailEvents\",\"operationName\":\"Publish\",\"properties\":{\"AdditionalFields\":null,\"AttachmentCount\":4,\"AuthenticationDetails\":\"{\\\"DKIM\\\":\\\"none\\\",\\\"DMARC\\\":\\\"none\\\"}\",\"ConfidenceLevel\":null,\"Connectors\":null,\"DeliveryAction\":\"Delivered\",\"DeliveryLocation\":\"Inbox/folder\",\"DetectionMethods\":null,\"EmailAction\":null,\"EmailActionPolicy\":null,\"EmailActionPolicyGuid\":null,\"EmailClusterId\":383769773,\"EmailDirection\":\"Intra-org\",\"EmailLanguage\":\"en\",\"InternetMessageId\":\"\\\\u003codspmicro-Share-aa027ba0-90b4-2000-ba44-ea7a298163ce-f7f97e88-ecd5-492d-b91f-d7e29a01d0d4-a5747f2a-025d-46a4-8e3c-c6bf4a2c53b9@8956DAA12345\\\\u003e\",\"NetworkMessageId\":\"a194a8a6-d97c-4be1-ae31-08dacc512345\",\"OrgLevelAction\":null,\"OrgLevelPolicy\":null,\"RecipientEmailAddress\":\"user@testmsftalerts.onmicrosoft.com\",\"RecipientObjectId\":\"4c51aa92-70f3-446d-8c65-a1c5ee412345\",\"ReportId\":\"1234\",\"SenderDisplayName\":\"user\",\"SenderFromAddress\":\"user@testMSFTalerts.onmicrosoft.com\",\"SenderFromDomain\":\"testMSFTalerts.onmicrosoft.com\",\"SenderIPv4\":\"81.2.69.144\",\"SenderIPv6\":\"2a02:cf40::\",\"SenderMailFromAddress\":\"user@testMSFTalerts.onmicrosoft.com\",\"SenderMailFromDomain\":\"testMSFTalerts.onmicrosoft.com\",\"SenderObjectId\":\"007c979b-47e7-4747-b9a3-58de6bd12345\",\"Subject\":\"test shared \\\"Test URL Click Document \\\" with you.\",\"ThreatNames\":null,\"ThreatTypes\":null,\"Timestamp\":\"2022-11-22T06:19:40Z\",\"UrlCount\":0,\"UserLevelAction\":null,\"UserLevelPolicy\":null},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:21:48.0675195Z\"}", "type": [ "info" @@ -187,18 +184,16 @@ { "@timestamp": "2022-11-22T06:19:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { - "local_id": "a194a8a6-d97c-4be1-ae31-08dacc512345" + "message_id": "a194a8a6-d97c-4be1-ae31-08dacc512345" }, "event": { "category": [ "email" ], - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-EmailUrlInfo\",\"operationName\":\"Publish\",\"properties\":{\"NetworkMessageId\":\"a194a8a6-d97c-4be1-ae31-08dacc512345\",\"ReportId\":\"a194a8a6-d97c-4be1-ae31-08dacc51878a-7656544652607312345\",\"Timestamp\":\"2022-11-22T06:19:37Z\",\"Url\":\"http://myusername:mypassword@www.example.com:80/foo.gif?key1=val1\u0026key2=val2#fragment\",\"UrlDomain\":\"southcentralusr-notifyp.svc.ms\",\"UrlLocation\":\"Body\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "type": [ "info" @@ -248,10 +243,11 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { - "local_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", + "local_id": "\\u003codspmicro-Share-aa027ba0-90b4-2000-ba44-ea7a298163ce-f7f97e88-ecd5-492d-b91f-d7e29a01d0d4-a5747f2a-025d-46a4-8e3c-c6bf4a2c53b9@8956DAA12345\\u003e", + "message_id": "a194a8a6-d97c-4be1-ae31-08dacc512345", "to": { "address": [ "user@testmsftalerts.onmicrosoft.com" @@ -263,9 +259,7 @@ "category": [ "email" ], - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-EmailPostDeliveryEvents\",\"operationName\":\"Publish\",\"properties\":{\"NetworkMessageId\":\"a194a8a6-d97c-4be1-ae31-08dacc512345\",\"RecipientEmailAddress\":\"user@testmsftalerts.onmicrosoft.com\",\"ActionResult\":\"result\",\"ActionTrigger\":\"trigger\",\"ActionType\":\"DpapiAccessed\",\"Action\":\"action\",\"DeliveryLocation\":\"Inbox/folder\",\"DetectionMethods\":\"\",\"InternetMessageId\":\"\\\\u003codspmicro-Share-aa027ba0-90b4-2000-ba44-ea7a298163ce-f7f97e88-ecd5-492d-b91f-d7e29a01d0d4-a5747f2a-025d-46a4-8e3c-c6bf4a2c53b9@8956DAA12345\\\\u003e\",\"ReportId\":\"1234\",\"ThreatTypes\":\"threat type\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "type": [ "info" @@ -315,16 +309,14 @@ { "@timestamp": "2022-11-22T06:19:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { - "local_id": "a194a8a6-d97c-4be1-ae31-08dacc512345" + "message_id": "a194a8a6-d97c-4be1-ae31-08dacc512345" }, "event": { "action": "dpapiaccessed", - "kind": [ - "event" - ], + "kind": "event", "original": "{\"Tenant\":\"DefaultTenant\",\"category\":\"AdvancedHunting-UrlClickEvents\",\"operationName\":\"Publish\",\"properties\":{\"Timestamp\":\"2022-11-22T06:19:37Z\",\"IPAddress\":\"\",\"AccountUpn\":\"\",\"ActionType\":\"DpapiAccessed\",\"DetectionMethods\":\"\",\"IsClickedThrough\":true,\"NetworkMessageId\":\"a194a8a6-d97c-4be1-ae31-08dacc512345\",\"ReportId\":\"1234\",\"ThreatTypes\":\"type\",\"Url\":\"https://southcentralusr-notifyp.svc.ms/api/v2/tracking/method/View?mi=Kn90pV0CpEaOPMa_SixTuQ\",\"UrlChain\":\"\",\"Workload\":\"\"},\"tenantId\":\"12345af3-bc0e-4f36-b08e-27759e912345\",\"time\":\"2022-11-22T06:20:58.5237104Z\"}", "type": [ "info" diff --git a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/default.yml index 6648a7e1b9f..b125e0ef19f 100644 --- a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,79 +3,117 @@ description: Pipeline for processing Event logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' + tag: set_ecs_version - rename: field: message target_field: event.original + tag: rename_message_to_event_original ignore_missing: true - json: field: event.original + tag: json_event_original target_field: json on_failure: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - date: - field: json.properties.Timestamp - target_field: m365_defender.event.timestamp - formats: - - ISO8601 - if: ctx.json?.properties?.Timestamp != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: '@timestamp' - copy_from: m365_defender.event.timestamp - ignore_empty_value: true + + # Rename processors - rename: field: json.category target_field: m365_defender.event.category + tag: rename_json_category ignore_missing: true - rename: field: json.operationName target_field: m365_defender.event.operation_name + tag: rename_json_operationName ignore_missing: true - rename: field: json.Tenant target_field: m365_defender.event.tenant.name + tag: rename_json_Tenant ignore_missing: true - rename: field: json.tenantId target_field: m365_defender.event.tenant.id + tag: rename_json_tenantId ignore_missing: true + + # Date processors - date: field: json.time target_field: m365_defender.event.time formats: - ISO8601 + tag: date_json_time if: ctx.json?.time != null on_failure: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.Timestamp + target_field: m365_defender.event.timestamp + formats: + - ISO8601 + tag: date_json_properties_Timestamp + if: ctx.json?.properties?.Timestamp != null + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - set: + field: '@timestamp' + copy_from: m365_defender.event.timestamp + tag: set_timestamp + ignore_empty_value: true + + # Pipeline Processors + # ctx.m365_defender.event.category is created by Eventhub when retrieving data from M365 Defender. + # It represents the data table that it accessed, and is a required field for the pipeline to work. + # Two processors are added to catch if the field is missing, or if it is not a valid value rather than dropping the event. + - append: + field: error.message + value: 'Missing required field: m365_defender.event.category.' + tag: append_missing_required_field_m365_defender_event_category + if: ctx.m365_defender?.event?.category == null || ctx.m365_defender?.event?.category == "" + - append: + field: error.message + value: 'The event category {{{m365_defender.event.category}}} is not supported.' + tag: append_invalid_m365_defender_event_category + if: ctx.m365_defender?.event?.category != null && !['AdvancedHunting-AlertEvidence','AdvancedHunting-AlertInfo','AdvancedHunting-DeviceEvents','AdvancedHunting-DeviceFileCertificateInfo','AdvancedHunting-DeviceFileEvents','AdvancedHunting-DeviceImageLoadEvents','AdvancedHunting-DeviceInfo','AdvancedHunting-DeviceLogonEvents','AdvancedHunting-DeviceNetworkEvents','AdvancedHunting-DeviceNetworkInfo','AdvancedHunting-DeviceProcessEvents','AdvancedHunting-DeviceRegistryEvents','AdvancedHunting-EmailAttachmentInfo','AdvancedHunting-EmailEvents','AdvancedHunting-EmailPostDeliveryEvents','AdvancedHunting-EmailUrlInfo','AdvancedHunting-IdentityLogonEvents','AdvancedHunting-IdentityQueryEvents','AdvancedHunting-IdentityDirectoryEvents','AdvancedHunting-CloudAppEvents','AdvancedHunting-UrlClickEvents'].contains(ctx.m365_defender.event.category) - pipeline: name: '{{ IngestPipeline "pipeline_alert" }}' - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('alert') + tag: pipeline_alert + if: ctx.m365_defender?.event?.category != null && ctx.m365_defender.event.category.toLowerCase().contains('alert') - pipeline: name: '{{ IngestPipeline "pipeline_device" }}' - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('device') + tag: pipeline_device + if: ctx.m365_defender?.event?.category != null && ctx.m365_defender.event.category.toLowerCase().contains('device') - pipeline: name: '{{ IngestPipeline "pipeline_email" }}' - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('email') || ctx.m365_defender?.event?.category?.toLowerCase().contains('urlclickevents') + tag: pipeline_email + if: ctx.m365_defender?.event?.category != null && (ctx.m365_defender.event.category.toLowerCase().contains('email') || ctx.m365_defender.event.category.toLowerCase().contains('urlclickevents')) - pipeline: name: '{{ IngestPipeline "pipeline_app_and_identity" }}' - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('identity') || ctx.m365_defender?.event?.category?.toLowerCase().contains('cloudappevents') + tag: pipeline_app_and_identity + if: ctx.m365_defender?.event?.category != null && (ctx.m365_defender.event.category.toLowerCase().contains('identity') || ctx.m365_defender.event.category.toLowerCase().contains('cloudappevents')) + + # Cleanup - remove: field: json + tag: remove_json ignore_missing: true - remove: field: event.original + tag: remove_event_original if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) ignore_missing: true - script: description: Drops null/empty values recursively. + tag: script_drop_empty_fields lang: painless source: boolean dropEmptyFields(Object object) { @@ -91,15 +129,11 @@ processors: return false; } dropEmptyFields(ctx); - - append: - field: event.kind - value: pipeline_error - allow_duplicates: false - if: ctx.error?.message != null on_failure: - append: field: error.message - value: '{{{_ingest.on_failure_message}}}' + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" - set: field: event.kind value: pipeline_error diff --git a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_alert.yml b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_alert.yml index 4ae2c9835e9..76214e4fa6a 100644 --- a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_alert.yml +++ b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_alert.yml @@ -1,345 +1,446 @@ --- description: Pipeline for processing Alert Event logs. processors: + # Event categorization - set: field: event.kind - value: [alert] - - set: + value: alert + tag: set_event_kind + - append: field: event.category - value: [file] - if: ctx.json?.properties?.EntityType?.toLowerCase() == 'file' - - set: + value: file + tag: append_event_category_file + if: ctx.json?.properties?.EntityType != null && ctx.json.properties.EntityType.toLowerCase() == 'file' + - append: field: event.category - value: [process] - if: ctx.json?.properties?.EntityType?.toLowerCase() == 'process' - - set: + value: process + tag: append_event_category_process + if: ctx.json?.properties?.EntityType != null && ctx.json.properties.EntityType.toLowerCase() == 'process' + - append: field: event.category - value: [host] - if: ctx.json?.properties?.EntityType?.toLowerCase() == 'device' - - set: + value: host + tag: append_event_category_host + if: ctx.json?.properties?.EntityType != null && ctx.json.properties.EntityType.toLowerCase() == 'device' + - append: field: event.category - value: [iam] - if: ctx.json?.properties?.EntityType?.toLowerCase() == 'user' - - set: + value: iam + tag: append_event_category_iam + if: ctx.json?.properties?.EntityType != null && ctx.json.properties.EntityType.toLowerCase() == 'user' + - append: field: event.category - value: [malware] + value: malware + tag: append_event_category_malware if: ctx.json?.properties?.Category != null && ['malware','ransomware'].contains(ctx.json.properties.Category.toLowerCase()) - - set: + - append: field: event.category - value: [threat] + value: threat + tag: append_event_category_threat if: ctx.json?.properties?.Category != null && ['persistence','privilegeescalation','suspiciousactivity','threatmanagement'].contains(ctx.json.properties.Category.toLowerCase()) - - set: + - append: field: event.type - value: [indicator] + value: indicator + tag: append_event_type_indicator if: ctx.event?.category != null && ctx.event.category.contains('threat') - - set: + - append: field: event.type - value: [info] + value: info + tag: append_event_type_info if: ctx.event?.type == null + + # JSON Processors + - json: + field: json.properties.Categories + tag: json_properties_Categories + if: ctx.json?.properties?.Categories instanceof String && ctx.json.properties.Categories != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.AdditionalFields + tag: json_properties_AdditionalFields + if: ctx.json?.properties?.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.AttackTechniques + tag: json_properties_AttackTechniques + if: ctx.json?.properties?.AttackTechniques instanceof String && ctx.json.properties.AttackTechniques != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + + # Convert processors + - convert: + field: json.properties.RemoteIP + target_field: m365_defender.event.remote.ip + tag: convert_json_properties_RemoteIP + if: ctx.json?.properties?.RemoteIP != '' + type: ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.FileSize + target_field: m365_defender.event.file.size + tag: convert_json_properties_FileSize + if: ctx.json?.properties?.FileSize != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.LocalIP + target_field: m365_defender.event.local.ip + tag: convert_json_properties_LocalIP + if: ctx.json?.properties?.LocalIP != '' + type: ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + + # Rename processors - rename: field: json.properties.AlertId target_field: m365_defender.event.alert.id + tag: rename_json_properties_AlertId ignore_missing: true - - set: - field: event.id - copy_from: m365_defender.event.alert.id - ignore_empty_value: true - rename: field: json.properties.ServiceSource target_field: m365_defender.event.service_source + tag: rename_json_properties_ServiceSource ignore_missing: true - - set: - field: event.provider - copy_from: m365_defender.event.service_source - ignore_empty_value: true - rename: field: json.properties.DeviceName target_field: m365_defender.event.device.name + tag: rename_json_properties_DeviceName + ignore_missing: true + - rename: + field: json.properties.NetworkMessageId + target_field: m365_defender.event.network.message_id + tag: rename_json_properties_NetworkMessageId + ignore_missing: true + - rename: + field: json.properties.OAuthApplicationId + target_field: m365_defender.event.oauth_application_id + tag: rename_json_properties_OAuthApplicationId + ignore_missing: true + - rename: + field: json.properties.RemoteUrl + target_field: m365_defender.event.remote.url + tag: rename_json_properties_RemoteUrl + ignore_missing: true + - rename: + field: json.properties.AttackTechniques + target_field: m365_defender.event.attack_techniques + tag: rename_json_properties_AttackTechniques + ignore_missing: true + - rename: + field: json.properties.AccountObjectId + target_field: m365_defender.event.account.object_id + tag: rename_json_properties_AccountObjectId + ignore_missing: true + - rename: + field: json.properties.Category + target_field: m365_defender.event.alert.category + tag: rename_json_properties_Category + ignore_missing: true + - rename: + field: json.properties.Categories + target_field: m365_defender.event.alert.categories + tag: rename_json_properties_Categories + ignore_missing: true + - rename: + field: json.properties.DetectionSource + target_field: m365_defender.event.detection.source + tag: rename_json_properties_DetectionSource + ignore_missing: true + - rename: + field: json.properties.MachineGroup + target_field: m365_defender.event.machine_group + tag: rename_json_properties_MachineGroup ignore_missing: true - - set: - field: host.name - copy_from: m365_defender.event.device.name - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.name}}}' - if: ctx.host?.name != null - allow_duplicates: false - - lowercase: - field: host.name - if: ctx.host?.name != null - rename: field: json.properties.DeviceId target_field: m365_defender.event.device.id + tag: rename_json_properties_DeviceId ignore_missing: true - - set: - field: host.id - copy_from: m365_defender.event.device.id - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.id}}}' - if: ctx.host?.id != null - allow_duplicates: false - rename: field: json.properties.EvidenceDirection target_field: m365_defender.event.evidence.direction - ignore_missing: true - - set: - field: network.direction - copy_from: m365_defender.event.evidence.direction - ignore_empty_value: true - - lowercase: - field: network.direction + tag: rename_json_properties_EvidenceDirection ignore_missing: true - rename: field: json.properties.ProcessCommandLine target_field: m365_defender.event.process.command_line + tag: rename_json_properties_ProcessCommandLine ignore_missing: true - - set: - field: process.command_line - copy_from: m365_defender.event.process.command_line - ignore_empty_value: true - rename: field: json.properties.RegistryKey target_field: m365_defender.event.registry.key + tag: rename_json_properties_RegistryKey ignore_missing: true - - set: - field: registry.key - copy_from: m365_defender.event.registry.key - ignore_empty_value: true - rename: field: json.properties.RegistryValueName target_field: m365_defender.event.registry.value_name + tag: rename_json_properties_RegistryValueName ignore_missing: true - - set: - field: registry.value - copy_from: m365_defender.event.registry.value_name - ignore_empty_value: true - - convert: - field: json.properties.RemoteIP - target_field: m365_defender.event.remote.ip - if: ctx.json?.properties?.RemoteIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: source.ip - copy_from: m365_defender.event.remote.ip - ignore_empty_value: true - - append: - field: related.ip - value: '{{{source.ip}}}' - if: ctx.source?.ip != null - allow_duplicates: false - rename: - field: json.properties.FolderPath - target_field: m365_defender.event.folder_path + field: json.properties.RegistryValueData + target_field: m365_defender.event.registry.value_data + tag: rename_json_properties_RegistryValueData ignore_missing: true - - set: - field: threat.enrichments.indicator.file.directory - copy_from: m365_defender.event.folder_path - ignore_empty_value: true - rename: field: json.properties.SHA1 target_field: m365_defender.event.sha1 + tag: rename_json_properties_SHA1 + ignore_missing: true + - rename: + field: json.properties.FolderPath + target_field: m365_defender.event.folder_path + tag: rename_json_properties_FolderPath ignore_missing: true - - set: - field: threat.enrichments.indicator.file.hash.sha1 - copy_from: m365_defender.event.sha1 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{threat.enrichments.indicator.file.hash.sha1}}}' - if: ctx.threat?.enrichments?.indicator?.file?.hash?.sha1 != null - allow_duplicates: false - rename: field: json.properties.SHA256 target_field: m365_defender.event.sha256 + tag: rename_json_properties_SHA256 ignore_missing: true - - set: - field: threat.enrichments.indicator.file.hash.sha256 - copy_from: m365_defender.event.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{threat.enrichments.indicator.file.hash.sha256}}}' - if: ctx.threat?.enrichments?.indicator?.file?.hash?.sha256 != null - allow_duplicates: false - rename: field: json.properties.FileName target_field: m365_defender.event.file.name + tag: rename_json_properties_FileName ignore_missing: true - - set: - field: threat.enrichments.indicator.file.name - copy_from: m365_defender.event.file.name - ignore_empty_value: true - - convert: - field: json.properties.FileSize - target_field: m365_defender.event.file.size - if: ctx.json?.properties?.FileSize != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: threat.enrichments.indicator.file.size - copy_from: m365_defender.event.file.size - ignore_empty_value: true - rename: field: json.properties.ThreatFamily target_field: m365_defender.event.threat.family + tag: rename_json_properties_ThreatFamily ignore_missing: true - - set: - field: threat.group.name - copy_from: m365_defender.event.threat.family - ignore_empty_value: true - rename: field: json.properties.AccountSid target_field: m365_defender.event.account.sid + tag: rename_json_properties_AccountSid ignore_missing: true - rename: field: json.properties.AccountName target_field: m365_defender.event.account.name + tag: rename_json_properties_AccountName ignore_missing: true - - set: - field: user.name - copy_from: m365_defender.event.account.name - ignore_empty_value: true - - append: - field: related.user - value: '{{{user.name}}}' - if: ctx.user?.name != null - allow_duplicates: false - rename: field: json.properties.Title target_field: m365_defender.event.title + tag: rename_json_properties_Title ignore_missing: true - - set: - field: message - copy_from: m365_defender.event.title - ignore_empty_value: true - rename: field: json.properties.AccountDomain target_field: m365_defender.event.account.domain + tag: rename_json_properties_AccountDomain ignore_missing: true - - set: - field: user.domain - copy_from: m365_defender.event.account.domain - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{user.domain}}}' - if: ctx.user?.domain != null - allow_duplicates: false - rename: field: json.properties.AccountUpn target_field: m365_defender.event.account.upn + tag: rename_json_properties_AccountUpn ignore_missing: true - - json: - field: json.properties.AdditionalFields - if: ctx.json?.properties?.AdditionalFields != null && ctx.json.properties.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.AdditionalFields target_field: m365_defender.event.additional_fields + tag: rename_json_properties_AdditionalFields ignore_missing: true - rename: field: json.properties.Application target_field: m365_defender.event.application + tag: rename_json_properties_Application ignore_missing: true - rename: field: json.properties.ApplicationId target_field: m365_defender.event.application_id + tag: rename_json_properties_ApplicationId ignore_missing: true - rename: field: json.properties.EmailSubject target_field: m365_defender.event.email.subject + tag: rename_json_properties_EmailSubject ignore_missing: true - rename: field: json.properties.EntityType target_field: m365_defender.event.entity_type + tag: rename_json_properties_EntityType ignore_missing: true - rename: field: json.properties.EvidenceRole target_field: m365_defender.event.evidence.role + tag: rename_json_properties_EvidenceRole ignore_missing: true - - convert: - field: json.properties.LocalIP - target_field: m365_defender.event.local.ip - if: ctx.json?.properties?.LocalIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: related.ip - value: '{{{m365_defender.event.local.ip}}}' - if: ctx.m365_defender?.event?.local?.ip != null - allow_duplicates: false - - rename: - field: json.properties.NetworkMessageId - target_field: m365_defender.event.network.message_id - ignore_missing: true - - rename: - field: json.properties.OAuthApplicationId - target_field: m365_defender.event.oauth_application_id - ignore_missing: true - - rename: - field: json.properties.RegistryValueData - target_field: m365_defender.event.registry.value_data - ignore_missing: true - - rename: - field: json.properties.RemoteUrl - target_field: m365_defender.event.remote.url - ignore_missing: true + + # Event mapping + - set: + field: event.id + copy_from: m365_defender.event.alert.id + tag: set_event_id + ignore_empty_value: true + - set: + field: event.provider + copy_from: m365_defender.event.service_source + tag: set_event_provider + ignore_empty_value: true + - set: + field: event.reference + copy_from: m365_defender.event.remote.url + tag: set_event_reference + ignore_empty_value: true - lowercase: field: json.properties.Severity target_field: m365_defender.event.severity + tag: lowercase_json_properties_Severity ignore_missing: true - set: field: event.severity value: 1 + tag: set_event_severity_info if: ctx.m365_defender?.event?.severity == 'informational' - set: field: event.severity value: 2 + tag: set_event_severity_low if: ctx.m365_defender?.event?.severity == 'low' - set: field: event.severity value: 3 + tag: set_event_severity_medium if: ctx.m365_defender?.event?.severity == 'medium' - set: field: event.severity value: 4 + tag: set_event_severity_high if: ctx.m365_defender?.event?.severity == 'high' - - json: - field: json.properties.AttackTechniques - if: ctx.json?.properties?.AttackTechniques != null && ctx.json.properties.AttackTechniques instanceof String && ctx.json.properties.AttackTechniques != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.AttackTechniques - target_field: m365_defender.event.attack_techniques + + # Host mapping + - set: + field: host.name + copy_from: m365_defender.event.device.name + tag: set_host_name + ignore_empty_value: true + - lowercase: + field: host.name + tag: lowercase_host_name ignore_missing: true + - set: + field: host.id + copy_from: m365_defender.event.device.id + tag: set_host_id + ignore_empty_value: true + + # Network mapping + - set: + field: network.direction + copy_from: m365_defender.event.evidence.direction + tag: set_network_direction + ignore_empty_value: true + - lowercase: + field: network.direction + tag: lowercase_network_direction + ignore_missing: true + + # Process mapping + - set: + field: process.command_line + copy_from: m365_defender.event.process.command_line + tag: set_process_command_line + ignore_empty_value: true + - script: + description: Splits up the command line to populate more processor fields. + lang: painless + tag: script_split_command_line + if: ctx.process?.command_line != null && ctx.process.command_line != '' + source: | + def commandLine = ctx.process.command_line; + commandLine = commandLine.trim(); + if (commandLine != "") { + ctx.process.command_line = commandLine; + + def args = new ArrayList(); + for (def v : / /.split(commandLine)) { + if (v != "") { + args.add(v); + } + } + if (args.length > 0) { + ctx.process.executable = args[0]; + ctx.process.args = args; + ctx.process.args_count = args.length; + } + } + + # Threat mapping (Mapped to file unless threat category) + - set: + field: threat.indicator.registry.key + copy_from: m365_defender.event.registry.key + ignore_empty_value: true + tag: set_threat_indicator_registry_key + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - append: + field: threat.indicator.registry.data.strings + value: '{{{m365_defender.event.registry.value_data}}}' + allow_duplicates: false + tag: append_threat_indicator_registry_data_strings + if: ctx.event?.category != null && ctx.event.category.contains('threat') && ctx.m365_defender?.event?.registry?.value_data != null + - set: + field: threat.indicator.registry.value + copy_from: m365_defender.event.registry.value_name + tag: set_threat_indicator_registry_value + ignore_empty_value: true + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.indicator.file.directory + copy_from: m365_defender.event.folder_path + ignore_empty_value: true + tag: set_threat_indicator_file_directory + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.indicator.file.hash.sha1 + copy_from: m365_defender.event.sha1 + ignore_empty_value: true + tag: set_threat_indicator_file_hash_sha1 + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.indicator.file.hash.sha256 + copy_from: m365_defender.event.sha256 + ignore_empty_value: true + tag: set_threat_indicator_file_hash_sha256 + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.indicator.file.name + copy_from: m365_defender.event.file.name + ignore_empty_value: true + tag: set_threat_indicator_file_name + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.indicator.file.size + copy_from: m365_defender.event.file.size + ignore_empty_value: true + tag: set_threat_indicator_file_size + if: ctx.event?.category != null && ctx.event.category.contains('threat') + - set: + field: threat.group.name + copy_from: m365_defender.event.threat.family + tag: set_threat_group_name + ignore_empty_value: true + if: ctx.event?.category != null && ctx.event.category.contains('threat') - script: description: Extract threat subtechnique id & name. lang: painless - if: ctx.m365_defender?.event?.attack_techniques != null && ctx.m365_defender.event.attack_techniques != '' && ctx.m365_defender.event.attack_techniques instanceof List + tag: script_extract_subtechnique_id_name + if: ctx.m365_defender?.event?.attack_techniques instanceof List ignore_failure: true - source: + source: | def subtechnique_name = new ArrayList(); def subtechnique_id = new ArrayList(); if (!(ctx.threat instanceof HashMap)) { @@ -359,6 +460,7 @@ processors: ctx.threat.technique.subtechnique.name = subtechnique_name; - sort: field: m365_defender.event.attack_techniques + tag: sort_m365_defender_event_attack_techniques if: ctx.m365_defender?.event?.attack_techniques != null && ctx.m365_defender.event.attack_techniques != '' on_failure: - append: @@ -366,6 +468,7 @@ processors: value: '{{{_ingest.on_failure_message}}}' - sort: field: threat.technique.subtechnique.id + tag: sort_threat_technique_subtechnique_id if: ctx.threat?.technique?.subtechnique?.id != null && ctx.threat.technique.subtechnique.id != '' on_failure: - append: @@ -373,47 +476,184 @@ processors: value: '{{{_ingest.on_failure_message}}}' - sort: field: threat.technique.subtechnique.name + tag: sort_threat_technique_subtechnique_name if: ctx.threat?.technique?.subtechnique?.name != null && ctx.threat.technique.subtechnique.name != '' on_failure: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.AccountObjectId - target_field: m365_defender.event.account.object_id - ignore_missing: true + + + # File mapping (Unless category is threat) + - set: + field: file.directory + copy_from: m365_defender.event.folder_path + ignore_empty_value: true + tag: set_file_directory + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + - set: + field: file.hash.sha1 + copy_from: m365_defender.event.sha1 + ignore_empty_value: true + tag: set_file_hash_sha1 + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + - set: + field: file.hash.sha256 + copy_from: m365_defender.event.sha256 + ignore_empty_value: true + tag: set_file_hash_sha256 + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + - set: + field: file.name + copy_from: m365_defender.event.file.name + ignore_empty_value: true + tag: set_file_name + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + - set: + field: file.size + copy_from: m365_defender.event.file.size + ignore_empty_value: true + tag: set_file_size + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + + # Registry mapping + - set: + field: registry.key + copy_from: m365_defender.event.registry.key + ignore_empty_value: true + tag: set_registry_key + if: ctx.event?.category != null && !ctx.event.category.contains('threat') + - append: + field: registry.data.strings + value: '{{{m365_defender.event.registry.value_data}}}' + tag: append_registry_data_strings + allow_duplicates: false + if: ctx.event?.category != null && !ctx.event.category.contains('threat') && ctx.m365_defender?.event?.registry?.value_data != null + + # Destination mapping + - set: + field: destination.ip + copy_from: m365_defender.event.remote.ip + tag: set_destination_ip + ignore_empty_value: true + + # Source mapping + - set: + field: source.ip + copy_from: m365_defender.event.local.ip + tag: set_source_ip + ignore_empty_value: true + + # User mapping + - set: + field: user.id + copy_from: m365_defender.event.account.sid + tag: set_user_id + ignore_empty_value: true + - set: + field: user.name + copy_from: m365_defender.event.account.name + tag: set_user_name + ignore_empty_value: true + - set: + field: user.domain + copy_from: m365_defender.event.account.domain + tag: set_user_domain + ignore_empty_value: true + - set: + field: user.id + copy_from: m365_defender.event.account.object_id + ignore_empty_value: true + tag: set_user_id + if: ctx.user?.id == null + + # Email mapping + - set: + field: email.subject + copy_from: m365_defender.event.email.subject + tag: set_email_subject + ignore_empty_value: true + - set: + field: email.message_id + copy_from: m365_defender.event.network.message_id + tag: set_email_message_id + ignore_empty_value: true + + # General mapping + - set: + field: message + copy_from: m365_defender.event.title + tag: set_message + ignore_empty_value: true + + # Related mapping + ## Host + - append: + field: related.hosts + value: '{{{host.name}}}' + tag: append_related_hosts + if: ctx.host?.name != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{user.domain}}}' + tag: append_related_hosts + if: ctx.user?.domain != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{host.id}}}' + tag: append_related_hosts + if: ctx.host?.id != null + allow_duplicates: false + ## User - append: field: related.user value: '{{{m365_defender.event.account.object_id}}}' + tag: append_related_user if: ctx.m365_defender?.event?.account?.object_id != null allow_duplicates: false - - rename: - field: json.properties.Category - target_field: m365_defender.event.alert.category - ignore_missing: true - - json: - field: json.properties.Categories - if: ctx.json?.properties?.Categories != null && ctx.json.properties.Categories instanceof String && ctx.json.properties.Categories != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.Categories - target_field: m365_defender.event.alert.categories - ignore_missing: true - - rename: - field: json.properties.DetectionSource - target_field: m365_defender.event.detection.source - ignore_missing: true - - rename: - field: json.properties.MachineGroup - target_field: m365_defender.event.machine_group - ignore_missing: true + - append: + field: related.user + value: '{{{user.name}}}' + tag: append_related_user + if: ctx.user?.name != null + allow_duplicates: false + ## IP + - append: + field: related.ip + value: '{{{source.ip}}}' + tag: append_related_ip + if: ctx.source?.ip != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{destination.ip}}}' + tag: append_related_ip + if: ctx.destination?.ip != null + allow_duplicates: false + ## Hash + - append: + field: related.hash + value: '{{{m365_defender.event.sha256}}}' + tag: append_related_hash + if: ctx.m365_defender?.event?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{m365_defender.event.sha1}}}' + tag: append_related_hash + if: ctx.m365_defender?.event?.sha1 != null + allow_duplicates: false + + # Duplicate Custom fields are disabled by default and will therefore remove these fields. + # Can be enabled in the UI when configuring the integration. - remove: if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + tag: remove_duplicate_custom_fields field: - m365_defender.event.timestamp + - m365_defender.event.remote.url - m365_defender.event.alert.id - m365_defender.event.service_source - m365_defender.event.device.name @@ -422,6 +662,7 @@ processors: - m365_defender.event.process.command_line - m365_defender.event.registry.key - m365_defender.event.registry.value_name + - m365_defender.event.registry.value_data - m365_defender.event.remote.ip - m365_defender.event.folder_path - m365_defender.event.sha1 @@ -431,12 +672,17 @@ processors: - m365_defender.event.threat.family - m365_defender.event.account.name - m365_defender.event.account.domain + - m365_defender.event.account.sid + - m365_defender.event.account.object_id + - m365_defender.event.network.message_id + - m365_defender.event.email.subject - m365_defender.event.title ignore_missing: true on_failure: + - append: + field: error.message + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" - set: field: event.kind value: pipeline_error - - append: - field: error.message - value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_app_and_identity.yml b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_app_and_identity.yml index 4bdffa42fb6..889479b6d45 100644 --- a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_app_and_identity.yml +++ b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_app_and_identity.yml @@ -1,32 +1,58 @@ --- description: Pipeline for processing Apps & Identities Event logs. processors: + # ctx.m365_defender.event.category is required for the event to be processed correctly as documented in the initial pipeline. + # Rather than checking it in every processor we check it once here. + - fail: + message: 'Event does not contain a valid category.' + tag: fail_event_category + if: ctx.m365_defender.event.category == null || ctx.m365_defender.event.category == '' + # Event categorization - set: field: event.kind - value: [event] - - set: + value: event + tag: set_event_kind + - append: field: event.category - value: [authentication] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('identitylogonevents') - - set: - field: event.type - value: [info] - - rename: - field: json.properties.TargetDeviceName - target_field: m365_defender.event.target.device_name - ignore_missing: true - - set: - field: destination.domain - copy_from: m365_defender.event.target.device_name - ignore_empty_value: true + value: authentication + tag: append_event_category + if: ctx.m365_defender.event.category.toLowerCase().contains('identitylogonevents') - append: - field: related.hosts - value: '{{{destination.domain}}}' - if: ctx.destination?.domain != null - allow_duplicates: false + field: event.type + value: info + tag: append_event_type + + # Json Processors + - json: + field: json.properties.ActivityObjects + tag: json_properties_ActivityObjects + if: ctx.json?.properties?.ActivityObjects instanceof String && ctx.json.properties.ActivityObjects != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.RawEventData + tag: json_properties_RawEventData + if: ctx.json?.properties?.RawEventData instanceof String && ctx.json.properties.RawEventData != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.AdditionalFields + tag: json_properties_AdditionalFields + if: ctx.json?.properties?.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + + # Convert Processors - convert: field: json.properties.DestinationIPAddress target_field: m365_defender.event.destination.ip_address + tag: convert_json_properties_DestinationIPAddress if: ctx.json?.properties?.DestinationIPAddress != '' type: ip ignore_missing: true @@ -34,18 +60,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - set: - field: destination.ip - copy_from: m365_defender.event.destination.ip_address - ignore_empty_value: true - - append: - field: related.ip - value: '{{{destination.ip}}}' - if: ctx.destination?.ip != null - allow_duplicates: false - convert: field: json.properties.DestinationPort target_field: m365_defender.event.destination.port + tag: convert_json_properties_DestinationPort if: ctx.json?.properties?.DestinationPort != '' type: long ignore_missing: true @@ -53,29 +71,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - set: - field: destination.port - copy_from: m365_defender.event.destination.port - ignore_empty_value: true - - rename: - field: json.properties.DeviceName - target_field: m365_defender.event.device.name - ignore_missing: true - - set: - field: host.name - copy_from: m365_defender.event.device.name - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.name}}}' - if: ctx.host?.name != null - allow_duplicates: false - - lowercase: - field: host.name - if: ctx.host?.name != null - convert: field: json.properties.IPAddress target_field: m365_defender.event.ip_address + tag: convert_json_properties_IPAddress if: ctx.json?.properties?.IPAddress != '' type: ip ignore_missing: true @@ -83,386 +82,480 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - set: - field: host.ip - copy_from: m365_defender.event.ip_address - ignore_empty_value: true - - append: - field: related.ip - value: '{{{host.ip}}}' - if: ctx.host?.ip != null - allow_duplicates: false + - convert: + field: json.properties.ReportId + target_field: m365_defender.event.report_id + tag: convert_json_properties_ReportId + if: ctx.json?.properties?.ReportId != '' + type: string + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.AppInstanceId + target_field: m365_defender.event.app_instance_id + tag: convert_json_properties_AppInstanceId + if: ctx.json?.properties?.AppInstanceId != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.Port + target_field: m365_defender.event.port + tag: convert_json_properties_Port + if: ctx.json?.properties?.Port != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.ApplicationId + target_field: m365_defender.event.application_id + tag: convert_json_properties_ApplicationId + if: ctx.json?.properties?.ApplicationId != '' + type: string + ignore_missing: true + + # Numbers to boolean (Undocumented field types like string, numeric etc is possible, have to check all of them) + - script: + lang: painless + source: | + def isTruthy(def val) { + if (val == null) { + // Fast return if field is absent. + return null; + } + if (val instanceof Boolean) { + return val; + } + if (val instanceof Integer) { + if (val == 1) { + return true; + } + if (val == 0) { + return false; + } + return null; + } + if (val instanceof String) { + if (val == "1" || val == "true") { + return true; + } + if (val == "0" || val == "false") { + return false; + } + return null; + } + return null; + } + ctx.m365_defender.event.is_admin_operation = isTruthy(ctx.json?.properties?.IsAdminOperation); + ctx.m365_defender.event.is_anonymous_proxy = isTruthy(ctx.json?.properties?.IsAnonymousProxy); + ctx.m365_defender.event.is_external_user = isTruthy(ctx.json?.properties?.IsExternalUser); + ctx.m365_defender.event.is_impersonated = isTruthy(ctx.json?.properties?.IsImpersonated); + + + # Rename Processors - rename: - field: json.properties.OSPlatform - target_field: m365_defender.event.os.platform + field: json.properties.City + target_field: m365_defender.event.city + tag: rename_json_properties_City ignore_missing: true - - set: - field: host.os.name - copy_from: m365_defender.event.os.platform - ignore_empty_value: true - rename: - field: json.properties.ActionType - target_field: m365_defender.event.action.type + field: json.properties.AccountName + target_field: m365_defender.event.account.name + tag: rename_json_properties_AccountName ignore_missing: true - - set: - field: event.action - copy_from: m365_defender.event.action.type - ignore_empty_value: true - - lowercase: - field: event.action + - rename: + field: json.properties.AccountSid + target_field: m365_defender.event.account.sid + tag: rename_json_properties_AccountSid ignore_missing: true - - gsub: - field: event.action - pattern: ' ' - replacement: '-' + - rename: + field: json.properties.AccountDomain + target_field: m365_defender.event.account.domain + tag: rename_json_properties_AccountDomain ignore_missing: true - rename: field: json.properties.DeviceType target_field: m365_defender.event.device.type + tag: rename_json_properties_DeviceType ignore_missing: true - - set: - field: host.type - copy_from: m365_defender.event.device.type - ignore_empty_value: true - rename: - field: json.properties.Protocol - target_field: m365_defender.event.protocol - ignore_missing: true - - set: - field: network.protocol - copy_from: m365_defender.event.protocol - ignore_empty_value: true - - lowercase: - field: network.protocol + field: json.properties.ActionType + target_field: m365_defender.event.action.type + tag: rename_json_properties_ActionType ignore_missing: true - rename: - field: json.properties.AccountDomain - target_field: m365_defender.event.account.domain + field: json.properties.OSPlatform + target_field: m365_defender.event.os.platform + tag: rename_json_properties_OSPlatform ignore_missing: true - - set: - field: user.domain - copy_from: m365_defender.event.account.domain - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{user.domain}}}' - if: ctx.user?.domain != null - allow_duplicates: false - rename: - field: json.properties.AccountSid - target_field: m365_defender.event.account.sid + field: json.properties.DeviceName + target_field: m365_defender.event.device.name + tag: rename_json_properties_DeviceName ignore_missing: true - rename: - field: json.properties.AccountName - target_field: m365_defender.event.account.name + field: json.properties.TargetDeviceName + target_field: m365_defender.event.target.device_name + tag: rename_json_properties_TargetDeviceName ignore_missing: true - - append: - field: user.name - value: '{{{m365_defender.event.account.name}}}' - if: ctx.m365_defender?.event?.account?.name != null - allow_duplicates: false - - append: - field: related.user - value: '{{{m365_defender.event.account.name}}}' - if: ctx.m365_defender?.event?.account?.name != null - allow_duplicates: false - rename: - field: json.properties.City - target_field: m365_defender.event.city + field: json.properties.Isp + target_field: m365_defender.event.isp + tag: rename_json_properties_Isp ignore_missing: true - - set: - field: source.geo.city_name - copy_from: m365_defender.event.city - ignore_empty_value: true - rename: - field: json.properties.CountryCode - target_field: m365_defender.event.country_code + field: json.properties.ISP + target_field: m365_defender.event.isp + tag: rename_json_properties_ISP ignore_missing: true - - set: - field: source.geo.country_iso_code - copy_from: m365_defender.event.country_code - ignore_empty_value: true - rename: - field: json.properties.UserAgent - target_field: m365_defender.event.user_agent + field: json.properties.AdditionalFields + target_field: m365_defender.event.additional_fields + tag: rename_json_properties_AdditionalFields ignore_missing: true - - user_agent: - field: m365_defender.event.user_agent - if: ctx.m365_defender?.event?.user_agent != null && ctx.m365_defender.event.user_agent != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: - field: json.properties.AccountId - target_field: m365_defender.event.account.id + field: json.properties.AccountObjectId + target_field: m365_defender.event.account.object_id + tag: rename_json_properties_AccountObjectId ignore_missing: true - - append: - field: user.id - value: '{{{m365_defender.event.account.id}}}' - if: ctx.m365_defender?.event?.account?.id != null - allow_duplicates: false - - append: - field: related.user - value: '{{{m365_defender.event.account.id}}}' - if: ctx.m365_defender?.event?.account?.id != null - allow_duplicates: false - rename: field: json.properties.AccountDisplayName target_field: m365_defender.event.account.display_name + tag: rename_json_properties_AccountDisplayName ignore_missing: true - - append: - field: user.name - value: '{{{m365_defender.event.account.display_name}}}' - if: ctx.m365_defender?.event?.account?.display_name != null - allow_duplicates: false - - append: - field: related.user - value: '{{{m365_defender.event.account.display_name}}}' - if: ctx.m365_defender?.event?.account?.display_name != null - allow_duplicates: false - rename: - field: json.properties.AccountObjectId - target_field: m365_defender.event.account.object_id + field: json.properties.UserAgent + target_field: m365_defender.event.user_agent + tag: rename_json_properties_UserAgent ignore_missing: true - rename: - field: json.properties.AccountUpn - target_field: m365_defender.event.account.upn + field: json.properties.CountryCode + target_field: m365_defender.event.country_code + tag: rename_json_properties_CountryCode ignore_missing: true - - json: - field: json.properties.AdditionalFields - if: ctx.json?.properties?.AdditionalFields != null && ctx.json.properties.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: - field: json.properties.AdditionalFields - target_field: m365_defender.event.additional_fields + field: json.properties.Protocol + target_field: m365_defender.event.protocol + tag: rename_json_properties_Protocol + ignore_missing: true + - rename: + field: json.properties.AccountUpn + target_field: m365_defender.event.account.upn + tag: rename_json_properties_AccountUpn ignore_missing: true - rename: field: json.properties.Application target_field: m365_defender.event.application + tag: rename_json_properties_Application ignore_missing: true - rename: field: json.properties.DestinationDeviceName target_field: m365_defender.event.destination.device_name + tag: rename_json_properties_DestinationDeviceName ignore_missing: true - rename: field: json.properties.FailureReason target_field: m365_defender.event.failure_reason - ignore_missing: true - - set: - field: event.outcome - value: 'success' - if: (ctx.m365_defender?.event?.failure_reason == null || ctx.m365_defender.event.failure_reason == '') && ctx.m365_defender?.event?.category?.toLowerCase() == 'advancedhunting-identitylogonevents' - - set: - field: event.outcome - value: 'failure' - if: (ctx.m365_defender?.event?.failure_reason != null && ctx.m365_defender.event.failure_reason != '') && ctx.m365_defender?.event?.category?.toLowerCase() == 'advancedhunting-identitylogonevents' - - rename: - field: json.properties.Isp - target_field: m365_defender.event.isp - ignore_missing: true - - rename: - field: json.properties.ISP - target_field: m365_defender.event.isp + tag: rename_json_properties_FailureReason ignore_missing: true - rename: field: json.properties.Location target_field: m365_defender.event.location + tag: rename_json_properties_Location ignore_missing: true - rename: field: json.properties.AccountType target_field: m365_defender.event.account.type + tag: rename_json_properties_AccountType ignore_missing: true - - convert: - field: json.properties.AppInstanceId - target_field: m365_defender.event.app_instance_id - if: ctx.json?.properties?.AppInstanceId != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.LogonType target_field: m365_defender.event.logon.type + tag: rename_json_properties_LogonType ignore_missing: true - - convert: - field: json.properties.Port - target_field: m365_defender.event.port - if: ctx.json?.properties?.Port != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: - field: json.properties.ReportId - target_field: m365_defender.event.report_id + field: json.properties.AccountId + target_field: m365_defender.event.account.id + tag: rename_json_properties_AccountId ignore_missing: true - rename: field: json.properties.TargetAccountDisplayName target_field: m365_defender.event.target.account_display_name + tag: rename_json_properties_TargetAccountDisplayName ignore_missing: true - - append: - field: related.user - value: '{{{m365_defender.event.target.account_display_name}}}' - if: ctx.m365_defender?.event?.target?.account_display_name != null - allow_duplicates: false - rename: field: json.properties.Query target_field: m365_defender.event.query.value + tag: rename_json_properties_Query ignore_missing: true - rename: field: json.properties.QueryTarget target_field: m365_defender.event.query.target + tag: rename_json_properties_QueryTarget ignore_missing: true - rename: field: json.properties.QueryType target_field: m365_defender.event.query.type + tag: rename_json_properties_QueryType ignore_missing: true - rename: field: json.properties.TargetAccountUpn target_field: m365_defender.event.target.account_upn + tag: rename_json_properties_TargetAccountUpn ignore_missing: true - - json: - field: json.properties.ActivityObjects - if: ctx.json?.properties?.ActivityObjects != null && ctx.json.properties.ActivityObjects instanceof String && ctx.json.properties.ActivityObjects != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.ActivityObjects target_field: m365_defender.event.activity.objects + tag: rename_json_properties_ActivityObjects ignore_missing: true - rename: field: json.properties.ActivityType target_field: m365_defender.event.activity.type + tag: rename_json_properties_ActivityType ignore_missing: true - - convert: - field: json.properties.ApplicationId - target_field: m365_defender.event.application_id - if: ctx.json?.properties?.ApplicationId != '' - type: string - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.IPCategory target_field: m365_defender.event.ip_category + tag: rename_json_properties_IPCategory ignore_missing: true - rename: field: json.properties.IPTags target_field: m365_defender.event.ip_tags + tag: rename_json_properties_IPTags ignore_missing: true - - set: - field: json.properties.IsAdminOperation - value: true - if: ctx.json?.properties?.IsAdminOperation == 1 || ctx.json?.properties?.IsAdminOperation == '1' - - set: - field: json.properties.IsAdminOperation - value: false - if: ctx.json?.properties?.IsAdminOperation == 0 || ctx.json?.properties?.IsAdminOperation == '0' - - convert: - field: json.properties.IsAdminOperation - target_field: m365_defender.event.is_admin_operation - if: ctx.json?.properties?.IsAdminOperation != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: json.properties.IsAnonymousProxy - value: true - if: ctx.json?.properties?.IsAnonymousProxy == 1 || ctx.json?.properties?.IsAnonymousProxy == '1' - - set: - field: json.properties.IsAnonymousProxy - value: false - if: ctx.json?.properties?.IsAnonymousProxy == 0 || ctx.json?.properties?.IsAnonymousProxy == '0' - - convert: - field: json.properties.IsAnonymousProxy - target_field: m365_defender.event.is_anonymous_proxy - if: ctx.json?.properties?.IsAnonymousProxy != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: json.properties.IsExternalUser - value: true - if: ctx.json?.properties?.IsExternalUser == 1 || ctx.json?.properties?.IsExternalUser == '1' - - set: - field: json.properties.IsExternalUser - value: false - if: ctx.json?.properties?.IsExternalUser == 0 || ctx.json?.properties?.IsExternalUser == '0' - - convert: - field: json.properties.IsExternalUser - target_field: m365_defender.event.is_external_user - if: ctx.json?.properties?.IsExternalUser != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: json.properties.IsImpersonated - value: true - if: ctx.json?.properties?.IsImpersonated == 1 || ctx.json?.properties?.IsImpersonated == '1' - - set: - field: json.properties.IsImpersonated - value: false - if: ctx.json?.properties?.IsImpersonated == 0 || ctx.json?.properties?.IsImpersonated == '0' - - convert: - field: json.properties.IsImpersonated - target_field: m365_defender.event.is_impersonated - if: ctx.json?.properties?.IsImpersonated != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.ObjectId target_field: m365_defender.event.object.id + tag: rename_json_properties_ObjectId ignore_missing: true - rename: field: json.properties.ObjectName target_field: m365_defender.event.object.name + tag: rename_json_properties_ObjectName ignore_missing: true - rename: field: json.properties.ObjectType target_field: m365_defender.event.object.type + tag: rename_json_properties_ObjectType ignore_missing: true - - json: - field: json.properties.RawEventData - if: ctx.json?.properties?.RawEventData != null && ctx.json.properties.RawEventData instanceof String && ctx.json.properties.RawEventData != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.RawEventData target_field: m365_defender.event.raw_event_data + tag: rename_json_properties_RawEventData ignore_missing: true - rename: field: json.properties.UserAgentTags target_field: m365_defender.event.user_agent_tags + tag: rename_json_properties_UserAgentTags ignore_missing: true + + # Destination mapping + - set: + field: destination.domain + copy_from: m365_defender.event.target.device_name + tag: set_destination_domain + ignore_empty_value: true + - set: + field: destination.ip + copy_from: m365_defender.event.destination.ip_address + tag: set_destination_ip + ignore_empty_value: true + - set: + field: destination.port + copy_from: m365_defender.event.destination.port + tag: set_destination_port + ignore_empty_value: true + + # Source mapping + - set: + field: source.geo.city_name + copy_from: m365_defender.event.city + tag: set_source_geo_city_name + ignore_empty_value: true + - set: + field: source.geo.country_iso_code + copy_from: m365_defender.event.country_code + tag: set_source_geo_country_iso_code + ignore_empty_value: true + + # Host mapping + - set: + field: host.name + copy_from: m365_defender.event.device.name + tag: set_host_name + ignore_empty_value: true + - lowercase: + field: host.name + tag: lowercase_host_name + if: ctx.host?.name != null + - set: + field: host.ip + copy_from: m365_defender.event.ip_address + tag: set_host_ip + ignore_empty_value: true + - set: + field: host.os.name + copy_from: m365_defender.event.os.platform + tag: set_host_os_name + ignore_empty_value: true + - set: + field: host.type + copy_from: m365_defender.event.device.type + tag: set_host_type + ignore_empty_value: true + + # Event Outcome/Action mapping + - set: + field: event.action + copy_from: m365_defender.event.action.type + tag: set_event_action + ignore_empty_value: true + - lowercase: + field: event.action + tag: lowercase_event_action + ignore_missing: true + - gsub: + field: event.action + pattern: ' ' + replacement: '-' + tag: gsub_event_action + ignore_missing: true + - set: + field: event.outcome + value: 'success' + tag: set_event_outcome + if: (ctx.m365_defender?.event?.failure_reason == null || ctx.m365_defender.event.failure_reason == '') && ctx.m365_defender.event.category.toLowerCase() == 'advancedhunting-identitylogonevents' + - set: + field: event.outcome + value: 'failure' + tag: set_event_outcome + if: (ctx.m365_defender?.event?.failure_reason != null && ctx.m365_defender.event.failure_reason != '') && ctx.m365_defender.event.category.toLowerCase() == 'advancedhunting-identitylogonevents' + - set: + field: event.id + copy_from: m365_defender.event.report_id + tag: set_event_id + ignore_empty_value: true + + # Network Mapping + - set: + field: network.protocol + copy_from: m365_defender.event.protocol + tag: set_network_protocol + ignore_empty_value: true + - lowercase: + field: network.protocol + tag: lowercase_network_protocol + ignore_missing: true + + # User mapping + - set: + field: user.domain + copy_from: m365_defender.event.account.domain + tag: set_user_domain + ignore_empty_value: true + - set: + field: user.id + copy_from: m365_defender.event.account.sid + ignore_empty_value: true + tag: set_user_id + if: ctx.m365_defender.event.category.toLowerCase().contains('identitylogonevents') + - set: + field: user.name + copy_from: m365_defender.event.account.name + tag: set_user_name + if: ctx.m365_defender?.event?.account?.name != null + - set: + field: user.id + copy_from: m365_defender.event.account.id + ignore_empty_value: true + tag: set_user_id + if: ctx.m365_defender.event.category.toLowerCase().contains('cloudappevents') + - set: + field: user.name + copy_from: m365_defender.event.account.display_name + tag: set_user_name + if: ctx.m365_defender?.event?.account?.display_name != null && ctx.user?.name == null + + # User Agent mapping + - user_agent: + field: m365_defender.event.user_agent + tag: user_agent_m365_defender_event_user_agent + if: ctx.m365_defender?.event?.user_agent != null && ctx.m365_defender.event.user_agent != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + + # Related mapping + - append: + field: related.user + value: '{{{user.id}}}' + tag: append_related_user + if: ctx.user?.id != null + allow_duplicates: false + - append: + field: related.user + value: '{{{m365_defender.event.account.display_name}}}' + tag: append_related_user + if: ctx.m365_defender?.event?.account?.display_name != null + allow_duplicates: false + - append: + field: related.user + value: '{{{m365_defender.event.target.account_display_name}}}' + tag: append_related_user + if: ctx.m365_defender?.event?.target?.account_display_name != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{destination.domain}}}' + tag: append_related_hosts + if: ctx.destination?.domain != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{destination.ip}}}' + tag: append_related_ip + if: ctx.destination?.ip != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{host.name}}}' + tag: append_related_hosts + if: ctx.host?.name != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{host.ip}}}' + tag: append_related_ip + if: ctx.host?.ip != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{user.domain}}}' + tag: append_related_hosts + if: ctx.user?.domain != null + allow_duplicates: false + - append: + field: related.user + value: '{{{m365_defender.event.account.name}}}' + tag: append_related_user + if: ctx.m365_defender?.event?.account?.name != null + allow_duplicates: false + + # Duplicate Custom fields are disabled by default and will therefore remove these fields. + # Can be enabled in the UI when configuring the integration. - remove: if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + tag: remove_duplicate_custom_fields field: - m365_defender.event.target.device_name - m365_defender.event.destination.ip_address @@ -475,15 +568,18 @@ processors: - m365_defender.event.account.domain - m365_defender.event.city - m365_defender.event.country_code + - m365_defender.event.account.sid - m365_defender.event.account.id - m365_defender.event.account.display_name - m365_defender.event.account.name - m365_defender.event.action.type + - m365_defender.event.report_id ignore_missing: true on_failure: - - set: - field: event.kind - value: pipeline_error - append: field: error.message - value: '{{{ _ingest.on_failure_message }}}' + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_device.yml b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_device.yml index bc0bc9792ae..77e9731276f 100644 --- a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_device.yml +++ b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_device.yml @@ -1,1238 +1,1879 @@ --- description: Pipeline for processing Device Event logs. processors: + # ctx.m365_defender.event.category is required for the event to be processed correctly as documented in the initial pipeline. + # Rather than checking it in every processor we check it once here. + - fail: + message: 'Event does not contain a valid category.' + tag: fail_event_category + if: ctx.m365_defender.event.category == null || ctx.m365_defender.event.category == '' + # Event categorizations - set: field: event.kind - value: [event] + value: event + tag: set_event_kind - append: field: event.category - value: [authentication] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('devicelogonevents') - - set: + value: authentication + tag: append_event_category_authentication + if: ctx.m365_defender.event.category.toLowerCase().contains('devicelogonevents') + - append: field: event.category - value: [host] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceevents') || ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceinfo') - - set: + value: host + tag: append_event_category_host + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') || ctx.m365_defender.event.category.toLowerCase().contains('deviceinfo') + - append: field: event.category - value: [file] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('devicefileevents') || ctx.m365_defender?.event?.category?.toLowerCase().contains('devicefilecertificateinfo') - - set: + value: file + tag: append_event_category_file + if: ctx.m365_defender.event.category.toLowerCase().contains('devicefileevents') || ctx.m365_defender.event.category.toLowerCase().contains('devicefilecertificateinfo') + - append: field: event.category - value: [process] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceimageloadevents') || ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceprocessevents') - - set: + value: process + tag: append_event_category_process + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') || ctx.m365_defender.event.category.toLowerCase().contains('deviceprocessevents') + - append: field: event.category - value: [network] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('devicenetworkevents') || ctx.m365_defender?.event?.category?.toLowerCase().contains('devicenetworkinfo') - - set: + value: network + tag: append_event_category_network + if: ctx.m365_defender.event.category.toLowerCase().contains('devicenetworkevents') || ctx.m365_defender.event.category.toLowerCase().contains('devicenetworkinfo') + - append: field: event.category - value: [registry] - if: ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceregistryevents') - - set: + value: registry + tag: append_event_category_registry + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceregistryevents') + - append: field: event.type - value: [info] - if: (ctx.event?.category != null && (ctx.event.category.contains('authentication') || ctx.event.category.contains('host') || ctx.event.category.contains('file'))) || (ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('openprocess') || ctx.json.properties.ActionType.toLowerCase().contains('connectionfound') || ctx.json.properties.ActionType.toLowerCase().contains('networksignatureinspected'))) || ctx.m365_defender?.event?.category?.toLowerCase().contains('devicenetworkinfo') - - set: + value: info + tag: append_event_type_info + if: >- + (ctx.event?.category != null && + (ctx.event.category.contains('authentication') || + ctx.event.category.contains('host') || + ctx.event.category.contains('file'))) || (ctx.json?.properties?.ActionType + != null && + (ctx.json.properties.ActionType.toLowerCase().contains('openprocess') || + ctx.json.properties.ActionType.toLowerCase().contains('connectionfound') + || + ctx.json.properties.ActionType.toLowerCase().contains('networksignatureinspected') + || + ctx.json.properties.ActionType.toLowerCase().contains('devicenetworkinfo'))) + - append: field: event.type - value: [end] - if: (ctx.m365_defender?.event?.category?.toLowerCase().contains('deviceimageloadevents')) || (ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('processcreated') || ctx.json.properties.ActionType.toLowerCase().contains('connectionsuccess'))) - - set: + value: end + tag: append_event_type_end + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') || (ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('processcreated') || ctx.json.properties.ActionType.toLowerCase().contains('connectionsuccess'))) + - append: field: event.type - value: [denied] + value: denied + tag: append_event_type_denied if: ctx.json?.properties?.ActionType != null && ctx.json.properties.ActionType.toLowerCase().contains('connectionfailed') - - set: + - append: field: event.type - value: [start] + value: start + tag: append_event_type_start if: ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('connectionrequest') || ctx.json.properties.ActionType.toLowerCase().contains('listeningconnectioncreated')) - - set: + - append: field: event.type - value: [allowed] + value: allowed + tag: append_event_type_allowed if: ctx.json?.properties?.ActionType != null && ctx.json.properties.ActionType.toLowerCase().contains('inboundconnectionaccepted') - - set: + - append: field: event.type - value: [creation] + value: creation + tag: append_event_type_creation if: ctx.json?.properties?.ActionType != null && ctx.json.properties.ActionType.toLowerCase().contains('registrykeycreated') - - set: + - append: field: event.type - value: [deletion] + value: deletion + tag: append_event_type_deletion if: ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('registrykeydeleted') || ctx.json.properties.ActionType.toLowerCase().contains('registryvaluedeleted')) - - set: + - append: field: event.type - value: [change] + value: change + tag: append_event_type_change if: ctx.json?.properties?.ActionType != null && (ctx.json.properties.ActionType.toLowerCase().contains('registrykeyrenamed') || ctx.json.properties.ActionType.toLowerCase().contains('registryvalueset')) + + # AdditionalFields are flattened, as they can vary depending on the source, users can use custom pipelines to move fields away from AdditionalFields if required. + # We move the AdditionalFields.direction when it exists, as its required for source/destination mapping + - json: + field: json.properties.AdditionalFields + tag: json_json_properties_AdditionalFields + if: ctx.json?.properties?.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.AdditionalFields + target_field: m365_defender.event.additional_fields + tag: rename_json_properties_AdditionalFields + ignore_missing: true + - rename: + field: m365_defender.event.additional_fields.direction + target_field: m365_defender.event.network_direction + tag: rename_additional_fields_direction + ignore_missing: true + if: ctx.m365_defender?.event?.additional_fields instanceof Map + + # JSON processors to unpack JSON string fields before renaming them + - json: + field: json.properties.CrlDistributionPointUrls + tag: json_json_properties_CrlDistributionPointUrls + if: ctx.json?.properties?.CrlDistributionPointUrls instanceof String && ctx.json.properties.CrlDistributionPointUrls != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.LoggedOnUsers + tag: json_json_properties_LoggedOnUsers + if: ctx.json?.properties?.LoggedOnUsers instanceof String && ctx.json.properties.LoggedOnUsers != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.ConnectedNetworks + tag: json_json_properties_ConnectedNetworks + if: ctx.json?.properties?.ConnectedNetworks instanceof String && ctx.json.properties.ConnectedNetworks != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.DefaultGateways + tag: json_json_properties_DefaultGateways + if: ctx.json?.properties?.DefaultGateways instanceof String && ctx.json.properties.DefaultGateways != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.DnsAddresses + tag: json_json_properties_DnsAddresses + if: ctx.json?.properties?.DnsAddresses instanceof String && ctx.json.properties.DnsAddresses != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.IPAddresses + tag: json_json_properties_IPAddresses + if: ctx.json?.properties?.IPAddresses instanceof String && ctx.json.properties.IPAddresses != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + + # Date Processors + - date: + field: json.properties.CertificateExpirationTime + target_field: m365_defender.event.certificate.expiration_time + tag: date_json_properties_CertificateExpirationTime + formats: + - ISO8601 + if: ctx.json?.properties?.CertificateExpirationTime instanceof String && ctx.json.properties.CertificateExpirationTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.InitiatingProcessCreationTime + target_field: m365_defender.event.initiating_process.creation_time + tag: date_json_properties_InitiatingProcessCreationTime + formats: + - ISO8601 + if: ctx.json?.properties?.InitiatingProcessCreationTime instanceof String && ctx.json.properties.InitiatingProcessCreationTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.InitiatingProcessParentCreationTime + target_field: m365_defender.event.initiating_process.parent_creation_time + tag: date_json_properties_InitiatingProcessParentCreationTime + formats: + - ISO8601 + if: ctx.json?.properties?.InitiatingProcessParentCreationTime instanceof String && ctx.json.properties.InitiatingProcessParentCreationTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.ProcessCreationTime + target_field: m365_defender.event.process.creation_time + tag: date_json_properties_ProcessCreationTime + formats: + - ISO8601 + if: ctx.json?.properties?.ProcessCreationTime instanceof String && ctx.json.properties.ProcessCreationTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.CertificateCountersignatureTime + target_field: m365_defender.event.certificate.countersignature_time + tag: date_json_properties_CertificateCountersignatureTime + formats: + - ISO8601 + if: ctx.json?.properties?.CertificateCountersignatureTime instanceof String && ctx.json.properties.CertificateCountersignatureTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.properties.CertificateCreationTime + target_field: m365_defender.event.certificate.creation_time + tag: date_json_properties_CertificateCreationTime + formats: + - ISO8601 + if: ctx.json?.properties?.CertificateCreationTime instanceof String && ctx.json.properties.CertificateCreationTime != "" + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + # Convert processors + - convert: + field: json.properties.InitiatingProcessFileSize + target_field: m365_defender.event.initiating_process.file_size + tag: convert_json_properties_InitiatingProcessFileSize + if: ctx.json?.properties?.InitiatingProcessFileSize != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.InitiatingProcessLogonId + target_field: m365_defender.event.initiating_process.logon_id + tag: convert_json_properties_InitiatingProcessLogonId + if: ctx.json?.properties?.InitiatingProcessLogonId != '' + type: string + ignore_missing: true + - convert: + field: json.properties.LogonId + target_field: m365_defender.event.logon.id + tag: convert_json_properties_LogonId + if: ctx.json?.properties?.LogonId != '' + type: string + ignore_missing: true + - convert: + field: json.properties.ProcessId + target_field: m365_defender.event.process.id + tag: convert_json_properties_ProcessId + if: ctx.json?.properties?.ProcessId != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.ReportId + target_field: m365_defender.event.report_id + tag: convert_json_properties_ReportId + if: ctx.json?.properties?.ReportId != '' + type: string + ignore_missing: true + - convert: + field: json.properties.IPv4Dhcp + target_field: m365_defender.event.ipv4_dhcp + tag: convert_json_properties_IPv4Dhcp + if: ctx.json?.properties?.IPv4Dhcp != '' + type: ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.IPv6Dhcp + target_field: m365_defender.event.ipv6_dhcp + tag: convert_json_properties_IPv6Dhcp + if: ctx.json?.properties?.IPv6Dhcp != '' + type: ip + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + +# Numbers to boolean (Undocumented field types like string, numeric etc is possible, have to check all of them) + - script: + lang: painless + source: | + def isTruthy(def val) { + if (val == null) { + // Fast return if field is absent. + return null; + } + if (val instanceof Boolean) { + return val; + } + if (val instanceof Integer) { + if (val == 1) { + return true; + } + if (val == 0) { + return false; + } + return null; + } + if (val instanceof String) { + if (val == "1" || val == "true") { + return true; + } + if (val == "0" || val == "false") { + return false; + } + return null; + } + return null; + } + ctx.m365_defender.event.is_root_signer_microsoft = isTruthy(ctx.json?.properties?.IsRootSignerMicrosoft); + ctx.m365_defender.event.is_signed = isTruthy(ctx.json?.properties?.IsSigned); + ctx.m365_defender.event.is_trusted = isTruthy(ctx.json?.properties?.IsTrusted); + ctx.m365_defender.event.is_azure_info_protection_applied = isTruthy(ctx.json?.properties?.IsAzureInfoProtectionApplied); + ctx.m365_defender.event.is_azure_ad_joined = isTruthy(ctx.json?.properties?.IsAzureADJoined); + ctx.m365_defender.event.is_local_admin = isTruthy(ctx.json?.properties?.IsLocalAdmin); + + # Rename processors to map JSON fields to M365 Fields - rename: field: json.properties.FolderPath target_field: m365_defender.event.folder_path + tag: rename_json_properties_FolderPath ignore_missing: true - - set: - field: file.directory - copy_from: m365_defender.event.folder_path - ignore_empty_value: true - rename: field: json.properties.MD5 target_field: m365_defender.event.md5 + tag: rename_json_properties_MD5 ignore_missing: true - - set: - field: file.hash.md5 - copy_from: m365_defender.event.md5 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{file.hash.md5}}}' - if: ctx.file?.hash?.md5 != null - allow_duplicates: false - rename: field: json.properties.SHA1 target_field: m365_defender.event.sha1 + tag: rename_json_properties_SHA1 ignore_missing: true - - set: - field: file.hash.sha1 - copy_from: m365_defender.event.sha1 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{file.hash.sha1}}}' - if: ctx.file?.hash?.sha1 != null - allow_duplicates: false - rename: field: json.properties.SHA256 target_field: m365_defender.event.sha256 + tag: rename_json_properties_SHA256 ignore_missing: true - - set: - field: file.hash.sha256 - copy_from: m365_defender.event.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{file.hash.sha256}}}' - if: ctx.file?.hash?.sha256 != null - allow_duplicates: false - rename: field: json.properties.FileName target_field: m365_defender.event.file.name + tag: rename_json_properties_FileName ignore_missing: true - - set: - field: file.name - copy_from: m365_defender.event.file.name - ignore_empty_value: true - - convert: + - rename: field: json.properties.FileSize target_field: m365_defender.event.file.size - if: ctx.json?.properties?.FileSize != '' - type: long + tag: rename_json_properties_FileSize ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: file.size - copy_from: m365_defender.event.file.size - ignore_empty_value: true - rename: field: json.properties.DeviceName target_field: m365_defender.event.device.name + tag: rename_json_properties_DeviceName ignore_missing: true - - set: - field: host.name - copy_from: m365_defender.event.device.name - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.name}}}' - if: ctx.host?.name != null - allow_duplicates: false - - lowercase: - field: host.name - if: ctx.host?.name != null - rename: field: json.properties.DeviceId target_field: m365_defender.event.device.id + tag : rename_json_properties_DeviceId ignore_missing: true - - set: - field: host.id - copy_from: m365_defender.event.device.id - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{host.id}}}' - if: ctx.host?.id != null - allow_duplicates: false - rename: field: json.properties.InitiatingProcessCommandLine target_field: m365_defender.event.initiating_process.command_line + tag: rename_json_properties_InitiatingProcessCommandLine ignore_missing: true - - set: - field: process.command_line - copy_from: m365_defender.event.initiating_process.command_line - ignore_empty_value: true - rename: field: json.properties.InitiatingProcessMD5 target_field: m365_defender.event.initiating_process.md5 + tag: rename_json_properties_InitiatingProcessMD5 ignore_missing: true - - set: - field: process.hash.md5 - copy_from: m365_defender.event.initiating_process.md5 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{process.hash.md5}}}' - if: ctx.process?.hash?.md5 != null - allow_duplicates: false - rename: field: json.properties.InitiatingProcessSHA1 target_field: m365_defender.event.initiating_process.sha1 + tag: rename_json_properties_InitiatingProcessSHA1 ignore_missing: true - - set: - field: process.hash.sha1 - copy_from: m365_defender.event.initiating_process.sha1 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{process.hash.sha1}}}' - if: ctx.process?.hash?.sha1 != null - allow_duplicates: false - rename: field: json.properties.InitiatingProcessSHA256 target_field: m365_defender.event.initiating_process.sha256 + tag: rename_json_properties_InitiatingProcessSHA256 ignore_missing: true - - set: - field: process.hash.sha256 - copy_from: m365_defender.event.initiating_process.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{process.hash.sha256}}}' - if: ctx.process?.hash?.sha256 != null - allow_duplicates: false - - convert: + - rename: field: json.properties.InitiatingProcessParentId target_field: m365_defender.event.initiating_process.parent_id - if: ctx.json?.properties?.InitiatingProcessParentId != '' - type: long + tag: rename_json_properties_InitiatingProcessParentId ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: process.parent.pid - copy_from: m365_defender.event.initiating_process.parent_id - ignore_empty_value: true - - convert: + - rename: field: json.properties.InitiatingProcessId target_field: m365_defender.event.initiating_process.id - if: ctx.json?.properties?.InitiatingProcessId != '' - type: long + tag: rename_json_properties_InitiatingProcessId ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: process.pid - copy_from: m365_defender.event.initiating_process.id - ignore_empty_value: true - rename: field: json.properties.RegistryKey target_field: m365_defender.event.registry.key + tag: rename_json_properties_RegistryKey ignore_missing: true - - set: - field: registry.key - copy_from: m365_defender.event.registry.key - ignore_empty_value: true - rename: field: json.properties.RegistryValueName target_field: m365_defender.event.registry.value_name + tag: rename_json_properties_RegistryValueName ignore_missing: true - - set: - field: registry.value - copy_from: m365_defender.event.registry.value_name - ignore_empty_value: true - - convert: - field: json.properties.FileOriginIP - target_field: m365_defender.event.file.origin_ip - if: ctx.json?.properties?.FileOriginIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.file.origin_ip}}}' - if: ctx.m365_defender?.event?.file?.origin_ip != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.file.origin_ip}}}' - if: ctx.m365_defender?.event?.file?.origin_ip != null - allow_duplicates: false - - convert: - field: json.properties.RemoteIP - target_field: m365_defender.event.remote.ip - if: ctx.json?.properties?.RemoteIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.remote.ip}}}' - if: ctx.m365_defender?.event?.remote?.ip != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.remote.ip}}}' - if: ctx.m365_defender?.event?.remote?.ip != null - allow_duplicates: false - - convert: - field: json.properties.LocalIP - target_field: m365_defender.event.local.ip - if: ctx.json?.properties?.LocalIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.local.ip}}}' - if: ctx.m365_defender?.event?.local?.ip != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.local.ip}}}' - if: ctx.m365_defender?.event?.local?.ip != null - allow_duplicates: false - - convert: - field: json.properties.RequestSourceIP - target_field: m365_defender.event.request.source_ip - if: ctx.json?.properties?.RequestSourceIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.request.source_ip}}}' - if: ctx.m365_defender?.event?.request?.source_ip != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.request.source_ip}}}' - if: ctx.m365_defender?.event?.request?.source_ip != null - allow_duplicates: false - - convert: - field: json.properties.RemotePort - target_field: m365_defender.event.remote.port - if: ctx.json?.properties?.RemotePort != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.port - value: '{{{m365_defender.event.remote.port}}}' - if: ctx.m365_defender?.event?.remote?.port != null - allow_duplicates: false - - convert: - field: json.properties.LocalPort - target_field: m365_defender.event.local.port - if: ctx.json?.properties?.LocalPort != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.port - value: '{{{m365_defender.event.local.port}}}' - if: ctx.m365_defender?.event?.local?.port != null - allow_duplicates: false - - convert: - field: json.properties.RequestSourcePort - target_field: m365_defender.event.request.source_port - if: ctx.json?.properties?.RequestSourcePort != '' - type: long + - rename: + field: json.properties.CertificateSerialNumber + target_field: m365_defender.event.certificate.serial_number + tag: rename_json_properties_CertificateSerialNumber ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.port - value: '{{{m365_defender.event.request.source_port}}}' - if: ctx.m365_defender?.event?.request?.source_port != null - allow_duplicates: false - - foreach: - field: source.port - if: ctx.source?.port instanceof List - processor: - convert: - field: _ingest._value - type: long - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.AccountName target_field: m365_defender.event.account.name + tag: rename_json_properties_AccountName ignore_missing: true - - set: - field: user.name - copy_from: m365_defender.event.account.name - ignore_empty_value: true - - append: - field: related.user - value: '{{{user.name}}}' - if: ctx.user?.name != null - allow_duplicates: false - - date: - field: json.properties.CertificateExpirationTime - target_field: m365_defender.event.certificate.expiration_time - formats: - - ISO8601 - if: ctx.json?.properties?.CertificateExpirationTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: file.x509.not_after - copy_from: m365_defender.event.certificate.expiration_time - ignore_empty_value: true - - rename: - field: json.properties.CertificateSerialNumber - target_field: m365_defender.event.certificate.serial_number - ignore_missing: true - - set: - field: file.x509.serial_number - copy_from: m365_defender.event.certificate.serial_number - ignore_empty_value: true - rename: field: json.properties.RequestProtocol target_field: m365_defender.event.request.protocol - ignore_missing: true - - set: - field: network.protocol - copy_from: m365_defender.event.request.protocol - ignore_empty_value: true - - lowercase: - field: network.protocol + tag: rename_json_properties_RequestProtocol ignore_missing: true - rename: field: json.properties.ActionType target_field: m365_defender.event.action.type - ignore_missing: true - - set: - field: event.action - copy_from: m365_defender.event.action.type - ignore_empty_value: true - - lowercase: - field: event.action - ignore_missing: true - - gsub: - field: event.action - pattern: ' ' - replacement: '-' + tag: rename_json_properties_ActionType ignore_missing: true - rename: field: json.properties.RequestAccountDomain target_field: m365_defender.event.request.account_domain + tag: rename_json_properties_RequestAccountDomain ignore_missing: true - - set: - field: source.user.domain - copy_from: m365_defender.event.request.account_domain - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{source.user.domain}}}' - if: ctx.source?.user?.domain != null - allow_duplicates: false - rename: field: json.properties.RequestAccountName target_field: m365_defender.event.request.account_name + tag: rename_json_properties_RequestAccountName ignore_missing: true - - set: - field: source.user.name - copy_from: m365_defender.event.request.account_name - ignore_empty_value: true - - append: - field: related.user - value: '{{{m365_defender.event.request.account_name}}}' - if: ctx.m365_defender?.event?.request?.account_name != null - allow_duplicates: false - - convert: - field: json.properties.PublicIP - target_field: m365_defender.event.public_ip.value - if: ctx.json?.properties?.PublicIP != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: host.ip - copy_from: m365_defender.event.public_ip.value - ignore_empty_value: true - - append: - field: related.ip - value: '{{{m365_defender.event.public_ip.value}}}' - if: ctx.m365_defender?.event?.public_ip?.value != null - allow_duplicates: false - - geoip: - if: ctx.m365_defender?.event?.public_ip?.value != null - field: m365_defender.event.public_ip.value - target_field: m365_defender.event.public_ip.geo - rename: field: json.properties.OSArchitecture target_field: m365_defender.event.os.architecture + tag: rename_json_properties_OSArchitecture ignore_missing: true - - set: - field: host.architecture - copy_from: m365_defender.event.os.architecture - ignore_empty_value: true - rename: field: json.properties.OSPlatform target_field: m365_defender.event.os.platform + tag: rename_json_properties_OSPlatform ignore_missing: true - - set: - field: host.os.name - copy_from: m365_defender.event.os.platform - ignore_empty_value: true - rename: field: json.properties.OSDistribution target_field: m365_defender.event.os.distribution + tag: rename_json_properties_OSDistribution ignore_missing: true - - set: - field: host.os.platform - copy_from: m365_defender.event.os.distribution - ignore_empty_value: true - rename: field: json.properties.OSVersion target_field: m365_defender.event.os.version + tag: rename_json_properties_OSVersion ignore_missing: true - - set: - field: host.os.version - copy_from: m365_defender.event.os.version - ignore_empty_value: true - rename: field: json.properties.DeviceType target_field: m365_defender.event.device.type + tag: rename_json_properties_DeviceType ignore_missing: true - - set: - field: host.type - copy_from: m365_defender.event.device.type - ignore_empty_value: true - rename: field: json.properties.AccountDomain target_field: m365_defender.event.account.domain + tag: rename_json_properties_AccountDomain ignore_missing: true - - set: - field: user.domain - copy_from: m365_defender.event.account.domain - ignore_empty_value: true - - append: - field: related.hosts - value: '{{{user.domain}}}' - if: ctx.user?.domain != null - allow_duplicates: false - rename: field: json.properties.ClientVersion target_field: m365_defender.event.client_version + tag: rename_json_properties_ClientVersion ignore_missing: true - - set: - field: observer.version - copy_from: m365_defender.event.client_version - ignore_empty_value: true - rename: field: json.properties.DeviceCategory target_field: m365_defender.event.device.category + tag: rename_json_properties_DeviceCategory ignore_missing: true - - set: - field: observer.type - copy_from: m365_defender.event.device.category - ignore_empty_value: true - rename: field: json.properties.MacAddress target_field: m365_defender.event.mac_address - ignore_missing: true - - gsub: - field: m365_defender.event.mac_address - pattern: '[:.]' - replacement: '-' - ignore_missing: true - - uppercase: - field: m365_defender.event.mac_address - ignore_missing: true - - set: - field: host.mac - copy_from: m365_defender.event.mac_address - ignore_empty_value: true - - grok: - if: ctx.json?.properties?.NetworkAdapterName != null - field: json.properties.NetworkAdapterName - patterns: - - "^{%{DATA:m365_defender.event.network.adapter_name}}$" - - json: - field: json.properties.AdditionalFields - if: ctx.json?.properties?.AdditionalFields != null && ctx.json.properties.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.AdditionalFields - target_field: m365_defender.event.additional_fields + tag: rename_json_properties_MacAddress ignore_missing: true - rename: field: json.properties.AccountSid target_field: m365_defender.event.account.sid + tag: rename_json_properties_AccountSid ignore_missing: true - rename: field: json.properties.RequestAccountSid target_field: m365_defender.event.request.account_sid + tag: rename_json_properties_RequestAccountSid ignore_missing: true - rename: field: json.properties.AppGuardContainerId target_field: m365_defender.event.app_guard_container_id + tag: rename_json_properties_AppGuardContainerId ignore_missing: true - rename: field: json.properties.FileOriginUrl target_field: m365_defender.event.file.origin_url + tag: rename_json_properties_FileOriginUrl ignore_missing: true - rename: field: json.properties.InitiatingProcessAccountDomain target_field: m365_defender.event.initiating_process.account_domain + tag: rename_json_properties_InitiatingProcessAccountDomain ignore_missing: true - - append: - field: related.hosts - value: '{{{m365_defender.event.initiating_process.account_domain}}}' - if: ctx.m365_defender?.event?.initiating_process?.account_domain != null - allow_duplicates: false - rename: field: json.properties.InitiatingProcessAccountName target_field: m365_defender.event.initiating_process.account_name + tag: rename_json_properties_InitiatingProcessAccountName ignore_missing: true - - append: - field: related.user - value: '{{{m365_defender.event.initiating_process.account_name}}}' - if: ctx.m365_defender?.event?.initiating_process?.account_name != null - allow_duplicates: false - rename: field: json.properties.AccountObjectId target_field: m365_defender.event.account.object_id + tag: rename_json_properties_AccountObjectId ignore_missing: true - rename: field: json.properties.InitiatingProcessAccountObjectId target_field: m365_defender.event.initiating_process.account_object_id + tag: rename_json_properties_InitiatingProcessAccountObjectId ignore_missing: true - rename: field: json.properties.InitiatingProcessAccountSid target_field: m365_defender.event.initiating_process.account_sid + tag: rename_json_properties_InitiatingProcessAccountSid ignore_missing: true - rename: field: json.properties.AccountUpn target_field: m365_defender.event.account.upn + tag: rename_json_properties_AccountUpn ignore_missing: true - rename: field: json.properties.InitiatingProcessAccountUpn target_field: m365_defender.event.initiating_process.account_upn + tag: rename_json_properties_InitiatingProcessAccountUpn ignore_missing: true - - date: - field: json.properties.InitiatingProcessCreationTime - target_field: m365_defender.event.initiating_process.creation_time - formats: - - ISO8601 - if: ctx.json?.properties?.InitiatingProcessCreationTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.InitiatingProcessFileName target_field: m365_defender.event.initiating_process.file_name + tag: rename_json_properties_InitiatingProcessFileName ignore_missing: true - - convert: - field: json.properties.InitiatingProcessFileSize - target_field: m365_defender.event.initiating_process.file_size - if: ctx.json?.properties?.InitiatingProcessFileSize != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.InitiatingProcessFolderPath target_field: m365_defender.event.initiating_process.folder_path + tag: rename_json_properties_InitiatingProcessFolderPath ignore_missing: true - - convert: - field: json.properties.InitiatingProcessLogonId - target_field: m365_defender.event.initiating_process.logon_id - if: ctx.json?.properties?.InitiatingProcessLogonId != '' - type: string - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - date: - field: json.properties.InitiatingProcessParentCreationTime - target_field: m365_defender.event.initiating_process.parent_creation_time - formats: - - ISO8601 - if: ctx.json?.properties?.InitiatingProcessParentCreationTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.InitiatingProcessParentFileName target_field: m365_defender.event.initiating_process.parent_file_name + tag: rename_json_properties_InitiatingProcessParentFileName ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoCompanyName target_field: m365_defender.event.initiating_process.version_info_company_name + tag: rename_json_properties_InitiatingProcessVersionInfoCompanyName ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoFileDescription target_field: m365_defender.event.initiating_process.version_info_file_description + tag: rename_json_properties_InitiatingProcessVersionInfoFileDescription ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoInternalFileName target_field: m365_defender.event.initiating_process.version_info_internal_file_name + tag: rename_json_properties_InitiatingProcessVersionInfoInternalFileName ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoOriginalFileName target_field: m365_defender.event.initiating_process.version_info_original_file_name + tag: rename_json_properties_InitiatingProcessVersionInfoOriginalFileName ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoProductName target_field: m365_defender.event.initiating_process.version_info_product_name + tag: rename_json_properties_InitiatingProcessVersionInfoProductName ignore_missing: true - rename: field: json.properties.InitiatingProcessVersionInfoProductVersion target_field: m365_defender.event.initiating_process.version_info_product_version + tag: rename_json_properties_InitiatingProcessVersionInfoProductVersion ignore_missing: true - - convert: - field: json.properties.LogonId - target_field: m365_defender.event.logon.id - if: ctx.json?.properties?.LogonId != '' - type: string - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.ProcessCommandLine target_field: m365_defender.event.process.command_line + tag: rename_json_properties_ProcessCommandLine ignore_missing: true - - date: - field: json.properties.ProcessCreationTime - target_field: m365_defender.event.process.creation_time - formats: - - ISO8601 - if: ctx.json?.properties?.ProcessCreationTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - convert: - field: json.properties.ProcessId - target_field: m365_defender.event.process.id - if: ctx.json?.properties?.ProcessId != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.ProcessTokenElevation target_field: m365_defender.event.process.token_elevation + tag: rename_json_properties_ProcessTokenElevation ignore_missing: true - rename: field: json.properties.ProcessVersionInfoCompanyName target_field: m365_defender.event.process.version_info_company_name + tag: rename_json_properties_ProcessVersionInfoCompanyName ignore_missing: true - rename: field: json.properties.ProcessVersionInfoFileDescription target_field: m365_defender.event.process.version_info_file_description + tag: rename_json_properties_ProcessVersionInfoFileDescription ignore_missing: true - rename: field: json.properties.ProcessVersionInfoInternalFileName target_field: m365_defender.event.process.version_info_internal_file_name + tag: rename_json_properties_ProcessVersionInfoInternalFileName ignore_missing: true - rename: field: json.properties.ProcessVersionInfoOriginalFileName target_field: m365_defender.event.process.version_info_original_file_name + tag: rename_json_properties_ProcessVersionInfoOriginalFileName ignore_missing: true - rename: field: json.properties.ProcessVersionInfoProductName target_field: m365_defender.event.process.version_info_product_name + tag: rename_json_properties_ProcessVersionInfoProductName ignore_missing: true - rename: field: json.properties.ProcessVersionInfoProductVersion target_field: m365_defender.event.process.version_info_product_version + tag: rename_json_properties_ProcessVersionInfoProductVersion ignore_missing: true - rename: field: json.properties.RegistryValueData target_field: m365_defender.event.registry.value_data + tag: rename_json_properties_RegistryValueData ignore_missing: true - rename: field: json.properties.RemoteDeviceName target_field: m365_defender.event.remote.device_name + tag: rename_json_properties_RemoteDeviceName ignore_missing: true - rename: field: json.properties.RemoteUrl target_field: m365_defender.event.remote.url + tag: rename_json_properties_RemoteUrl ignore_missing: true - - convert: - field: json.properties.ReportId - target_field: m365_defender.event.report_id - if: ctx.json?.properties?.ReportId != '' - type: string - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - date: - field: json.properties.CertificateCountersignatureTime - target_field: m365_defender.event.certificate.countersignature_time - formats: - - ISO8601 - if: ctx.json?.properties?.CertificateCountersignatureTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - date: - field: json.properties.CertificateCreationTime - target_field: m365_defender.event.certificate.creation_time - formats: - - ISO8601 - if: ctx.json?.properties?.CertificateCreationTime != null - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - json: - field: json.properties.CrlDistributionPointUrls - if: ctx.json?.properties?.CrlDistributionPointUrls != null && ctx.json.properties.CrlDistributionPointUrls instanceof String && ctx.json.properties.CrlDistributionPointUrls != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.CrlDistributionPointUrls target_field: m365_defender.event.crl_distribution_point_urls + tag: rename_json_properties_CrlDistributionPointUrls ignore_missing: true - - set: - field: json.properties.IsRootSignerMicrosoft - value: true - if: ctx.json?.properties?.IsRootSignerMicrosoft == 1 || ctx.json?.properties?.IsRootSignerMicrosoft == '1' - - set: - field: json.properties.IsRootSignerMicrosoft - value: false - if: ctx.json?.properties?.IsRootSignerMicrosoft == 0 || ctx.json?.properties?.IsRootSignerMicrosoft == '0' - - convert: - field: json.properties.IsRootSignerMicrosoft - target_field: m365_defender.event.is_root_signer_microsoft - if: ctx.json?.properties?.IsRootSignerMicrosoft != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: json.properties.IsSigned - value: true - if: ctx.json?.properties?.IsSigned == 1 || ctx.json?.properties?.IsSigned == '1' - - set: - field: json.properties.IsSigned - value: false - if: ctx.json?.properties?.IsSigned == 0 || ctx.json?.properties?.IsSigned == '0' - - convert: - field: json.properties.IsSigned - target_field: m365_defender.event.is_signed - if: ctx.json?.properties?.IsSigned != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - set: - field: json.properties.IsTrusted - value: true - if: ctx.json?.properties?.IsTrusted == 1 || ctx.json?.properties?.IsTrusted == '1' - - set: - field: json.properties.IsTrusted - value: false - if: ctx.json?.properties?.IsTrusted == 0 || ctx.json?.properties?.IsTrusted == '0' - - convert: - field: json.properties.IsTrusted - target_field: m365_defender.event.is_trusted - if: ctx.json?.properties?.IsTrusted != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.Issuer target_field: m365_defender.event.issuer + tag: rename_json_properties_Issuer ignore_missing: true - rename: field: json.properties.IssuerHash target_field: m365_defender.event.issuer_hash + tag: rename_json_properties_IssuerHash ignore_missing: true - - append: - field: related.hash - value: '{{{m365_defender.event.issuer_hash}}}' - if: ctx.m365_defender?.event?.issuer_hash != null - allow_duplicates: false - rename: field: json.properties.SignatureType target_field: m365_defender.event.signature_type + tag: rename_json_properties_SignatureType ignore_missing: true - rename: field: json.properties.Signer target_field: m365_defender.event.signer + tag: rename_json_properties_Signer ignore_missing: true - rename: field: json.properties.SignerHash target_field: m365_defender.event.signer_hash + tag: rename_json_properties_SignerHash ignore_missing: true - - append: - field: related.hash - value: '{{{m365_defender.event.signer_hash}}}' - if: ctx.m365_defender?.event?.signer_hash != null - allow_duplicates: false - rename: field: json.properties.FileOriginReferrerUrl target_field: m365_defender.event.file.origin_referrer_url + tag: rename_json_properties_FileOriginReferrerUrl ignore_missing: true - rename: field: json.properties.InitiatingProcessIntegrityLevel target_field: m365_defender.event.initiating_process.integrity_level + tag: rename_json_properties_InitiatingProcessIntegrityLevel ignore_missing: true - rename: field: json.properties.InitiatingProcessTokenElevation target_field: m365_defender.event.initiating_process.token_elevation + tag: rename_json_properties_InitiatingProcessTokenElevation ignore_missing: true - - set: - field: json.properties.IsAzureInfoProtectionApplied - value: true - if: ctx.json?.properties?.IsAzureInfoProtectionApplied == 1 || ctx.json?.properties?.IsAzureInfoProtectionApplied == '1' - - set: - field: json.properties.IsAzureInfoProtectionApplied - value: false - if: ctx.json?.properties?.IsAzureInfoProtectionApplied == 0 || ctx.json?.properties?.IsAzureInfoProtectionApplied == '0' - - convert: - field: json.properties.IsAzureInfoProtectionApplied - target_field: m365_defender.event.is_azure_info_protection_applied - if: ctx.json?.properties?.IsAzureInfoProtectionApplied != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.PreviousFileName target_field: m365_defender.event.previous.file_name + tag: rename_json_properties_PreviousFileName ignore_missing: true - rename: field: json.properties.PreviousFolderPath target_field: m365_defender.event.previous.folder_path + tag: rename_json_properties_PreviousFolderPath ignore_missing: true - rename: field: json.properties.SensitivityLabel target_field: m365_defender.event.sensitivity.label + tag: rename_json_properties_SensitivityLabel ignore_missing: true - rename: field: json.properties.SensitivitySubLabel target_field: m365_defender.event.sensitivity.sub_label + tag: rename_json_properties_SensitivitySubLabel ignore_missing: true - rename: field: json.properties.ShareName target_field: m365_defender.event.share_name + tag: rename_json_properties_ShareName ignore_missing: true - rename: field: json.properties.FailureReason target_field: m365_defender.event.failure_reason + tag: rename_json_properties_FailureReason ignore_missing: true - - set: - field: event.outcome - value: 'success' - if: (ctx.m365_defender?.event?.failure_reason == null || ctx.m365_defender.event.failure_reason == '') && ctx.m365_defender?.event?.category?.toLowerCase().contains('devicelogonevents') - - set: - field: event.outcome - value: 'failure' - if: (ctx.m365_defender?.event?.failure_reason != null && ctx.m365_defender.event.failure_reason != '') && ctx.m365_defender?.event?.category?.toLowerCase().contains('devicelogonevents') - rename: field: json.properties.AadDeviceId target_field: m365_defender.event.aad_device_id + tag: rename_json_properties_AadDeviceId ignore_missing: true - rename: field: json.properties.DeviceSubType target_field: m365_defender.event.device.sub_type + tag: rename_json_properties_DeviceSubType ignore_missing: true - - set: - field: json.properties.IsAzureADJoined - value: true - if: ctx.json?.properties?.IsAzureADJoined == 1 || ctx.json?.properties?.IsAzureADJoined == '1' - - set: - field: json.properties.IsAzureADJoined - value: false - if: ctx.json?.properties?.IsAzureADJoined == 0 || ctx.json?.properties?.IsAzureADJoined == '0' - - convert: - field: json.properties.IsAzureADJoined - target_field: m365_defender.event.is_azure_ad_joined - if: ctx.json?.properties?.IsAzureADJoined != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.JoinType target_field: m365_defender.event.join_type - ignore_missing: true - - json: - field: json.properties.LoggedOnUsers - if: ctx.json?.properties?.LoggedOnUsers != null && ctx.json.properties.LoggedOnUsers instanceof String && ctx.json.properties.LoggedOnUsers != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.LoggedOnUsers - target_field: m365_defender.event.logged_on_users + tag: rename_json_properties_JoinType ignore_missing: true - rename: field: json.properties.MachineGroup + tag: rename_json_properties_MachineGroup target_field: m365_defender.event.machine_group ignore_missing: true - - json: - field: json.properties.MergedDeviceIds - if: ctx.json?.properties?.MergedDeviceIds != null && ctx.json.properties.MergedDeviceIds instanceof String && ctx.json.properties.MergedDeviceIds != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.MergedDeviceIds + tag: rename_json_properties_MergedDeviceIds target_field: m365_defender.event.merged_device_ids ignore_missing: true - rename: field: json.properties.MergedToDeviceId + tag: rename_json_properties_MergedToDeviceId target_field: m365_defender.event.merged_to_device_id ignore_missing: true + - rename: + field: json.properties.SensorHealthState + tag: rename_json_properties_SensorHealthState + target_field: m365_defender.event.sensor_health_state + ignore_missing: true + - rename: + field: json.properties.IsExcluded + tag: rename_json_properties_IsExcluded + target_field: m365_defender.event.is_excluded + ignore_missing: true + - rename: + field: json.properties.ExclusionReason + tag: rename_json_properties_ExclusionReason + target_field: m365_defender.event.exclusion_reason + ignore_missing: true + - rename: + field: json.properties.AssetValue + tag: rename_json_properties_AssetValue + target_field: m365_defender.event.asset_value + ignore_missing: true + - rename: + field: json.properties.ExposureLevel + tag: rename_json_properties_ExposureLevel + target_field: m365_defender.event.exposure_level + ignore_missing: true + - rename: + field: json.properties.IsInternetFacing + tag: rename_json_properties_IsInternetFacing + target_field: m365_defender.event.is_internet_facing + ignore_missing: true + - rename: + field: json.properties.DeviceManualTags + tag: rename_json_properties_DeviceManualTags + target_field: m365_defender.event.device_manual_tags + ignore_missing: true + - rename: + field: json.properties.DeviceDynamicTags + tag: rename_json_properties_DeviceDynamicTags + target_field: m365_defender.event.device_dynamic_tags + ignore_missing: true - rename: field: json.properties.Model target_field: m365_defender.event.model + tag: rename_json_properties_Model ignore_missing: true - rename: field: json.properties.OnboardingStatus target_field: m365_defender.event.onboarding_status + tag: rename_json_properties_OnboardingStatus ignore_missing: true - rename: field: json.properties.OSBuild target_field: m365_defender.event.os.build + tag: rename_json_properties_OSBuild ignore_missing: true - rename: field: json.properties.OSVersionInfo target_field: m365_defender.event.os.version_info + tag: rename_json_properties_OSVersionInfo ignore_missing: true - rename: field: json.properties.RegistryDeviceTag target_field: m365_defender.event.registry.device_tag + tag: rename_json_properties_RegistryDeviceTag ignore_missing: true - rename: field: json.properties.Vendor target_field: m365_defender.event.vendor + tag: rename_json_properties_Vendor ignore_missing: true - - set: - field: json.properties.IsLocalAdmin - value: true - if: ctx.json?.properties?.IsLocalAdmin == 1 || ctx.json?.properties?.IsLocalAdmin == '1' - - set: - field: json.properties.IsLocalAdmin - value: false - if: ctx.json?.properties?.IsLocalAdmin == 0 || ctx.json?.properties?.IsLocalAdmin == '0' - - convert: - field: json.properties.IsLocalAdmin - target_field: m365_defender.event.is_local_admin - if: ctx.json?.properties?.IsLocalAdmin != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.LogonType target_field: m365_defender.event.logon.type + tag: rename_json_properties_LogonType ignore_missing: true - rename: field: json.properties.Protocol target_field: m365_defender.event.protocol + tag: rename_json_properties_Protocol + ignore_missing: true + - rename: + field: json.properties.RemoteIPType + target_field: m365_defender.event.remote.ip_type + tag: rename_json_properties_RemoteIPType ignore_missing: true + - rename: + field: json.properties.RegistryValueType + target_field: m365_defender.event.registry.value_type + tag: rename_json_properties_RegistryValueType + ignore_missing: true + - rename: + field: json.properties.LocalIPType + target_field: m365_defender.event.local.ip_type + tag: rename_json_properties_LocalIPType + ignore_missing: true + - rename: + field: json.properties.ConnectedNetworks + target_field: m365_defender.event.connected_networks + tag: rename_json_properties_ConnectedNetworks + ignore_missing: true + - rename: + field: json.properties.DefaultGateways + target_field: m365_defender.event.default_gateways + tag: rename_json_properties_DefaultGateways + ignore_missing: true + - rename: + field: json.properties.DnsAddresses + target_field: m365_defender.event.dns_addresses + tag: rename_json_properties_DnsAddresses + ignore_missing: true + - rename: + field: json.properties.IPAddresses + target_field: m365_defender.event.ip_addresses + tag: rename_json_properties_IPAddresses + ignore_missing: true + - rename: + field: json.properties.NetworkAdapterStatus + target_field: m365_defender.event.network.adapter_status + tag: rename_json_properties_NetworkAdapterStatus + ignore_missing: true + - rename: + field: json.properties.NetworkAdapterType + target_field: m365_defender.event.network.adapter_type + tag: rename_json_properties_NetworkAdapterType + ignore_missing: true + - rename: + field: json.properties.NetworkAdapterVendor + target_field: m365_defender.event.network.adapter_vendor + tag: rename_json_properties_NetworkAdapterVendor + ignore_missing: true + - rename: + field: json.properties.TunnelType + target_field: m365_defender.event.tunnel_type + tag: rename_json_properties_TunnelType + ignore_missing: true + - rename: + field: json.properties.InitiatingProcessSignatureStatus + target_field: m365_defender.event.initiating_process.signature_status + tag: rename_json_properties_InitiatingProcessSignatureStatus + ignore_missing: true + - rename: + field: json.properties.InitiatingProcessSignerType + target_field: m365_defender.event.initiating_process.signer_type + tag: rename_json_properties_InitiatingProcessSignerType + ignore_missing: true + - rename: + field: json.properties.ProcessIntegrityLevel + target_field: m365_defender.event.process.integrity_level + tag: rename_json_properties_ProcessIntegrityLevel + ignore_missing: true + - rename: + field: json.properties.PreviousRegistryKey + target_field: m365_defender.event.previous.registry_key + tag: rename_json_properties_PreviousRegistryKey + ignore_missing: true + - rename: + field: json.properties.PreviousRegistryValueData + target_field: m365_defender.event.previous.registry_value_data + tag: rename_json_properties_PreviousRegistryValueData + ignore_missing: true + - rename: + field: json.properties.PreviousRegistryValueName + target_field: m365_defender.event.previous.registry_value_name + tag: rename_json_properties_PreviousRegistryValueName + ignore_missing: true + - rename: + field: json.properties.FileOriginIP + target_field: m365_defender.event.file.origin_ip + tag: rename_json_properties_FileOriginIp + ignore_missing: true + - rename: + field: json.properties.RemoteIP + target_field: m365_defender.event.remote.ip + tag: rename_json_properties_RemoteIP + ignore_missing: true + - rename: + field: json.properties.LocalIP + target_field: m365_defender.event.local.ip + tag: rename_json_properties_LocalIP + ignore_missing: true + - rename: + field: json.properties.RequestSourceIP + target_field: m365_defender.event.request.source_ip + tag: rename_json_properties_RequestSourceIP + ignore_missing: true + - rename: + field: json.properties.RequestSourcePort + target_field: m365_defender.event.request.source_port + tag: rename_json_properties_RequestSourcePort + ignore_missing: true + - rename: + field: json.properties.RemotePort + target_field: m365_defender.event.remote.port + tag: rename_json_properties_RemotePort + ignore_missing: true + - rename: + field: json.properties.LocalPort + target_field: m365_defender.event.local.port + tag: rename_json_properties_LocalPort + ignore_missing: true + - rename: + field: json.properties.PublicIP + target_field: m365_defender.event.public_ip.value + tag: rename_json_properties_PublicIP + ignore_missing: true + + # File mappings (Only when its not DeviceProcessEvent or DeviceEvent, else it means something else) + - set: + field: file.directory + copy_from: m365_defender.event.folder_path + ignore_empty_value: true + tag: set_file_directory + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.hash.md5 + copy_from: m365_defender.event.md5 + ignore_empty_value: true + tag: set_file_hash_md5 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.hash.sha1 + copy_from: m365_defender.event.sha1 + ignore_empty_value: true + tag: set_file_hash_sha1 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.hash.sha256 + copy_from: m365_defender.event.sha256 + ignore_empty_value: true + tag: set_file_hash_sha256 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.name + copy_from: m365_defender.event.file.name + ignore_empty_value: true + tag: set_file_name + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.size + copy_from: m365_defender.event.file.size + ignore_empty_value: true + tag: set_file_size + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: file.x509.not_after + copy_from: m365_defender.event.certificate.expiration_time + tag: set_file_x509_not_after + ignore_empty_value: true + - set: + field: file.x509.serial_number + copy_from: m365_defender.event.certificate.serial_number + tag: set_file_x509_serial_number + ignore_empty_value: true + - append: + field: file.x509.issuer.common_name + value: '{{{m365_defender.event.issuer}}}' + tag: append_file_x509_issuer_common_name + if: ctx.m365_defender?.event?.issuer != null + - set: + field: file.code_signature.subject_name + copy_from: m365_defender.event.signer + tag: set_file_code_signature_subject_name + ignore_empty_value: true + - set: + field: file.code_signature.exists + copy_from: m365_defender.event.is_signed + tag: set_file_code_signature_exists + ignore_empty_value: true + - set: + field: file.code_signature.trusted + copy_from: m365_defender.event.is_trusted + tag: set_file_code_signature_trusted + ignore_empty_value: true + + # DLL Mappings (Only when its DeviceImageLoadEvents, else it means something else) + - set: + field: dll.path + copy_from: m365_defender.event.folder_path + ignore_empty_value: true + tag: set_dll_path + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + - set: + field: dll.hash.md5 + copy_from: m365_defender.event.md5 + ignore_empty_value: true + tag: set_dll_md5 + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + - set: + field: dll.hash.sha1 + copy_from: m365_defender.event.sha1 + ignore_empty_value: true + tag: set_dll_sha1 + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + - set: + field: dll.hash.sha256 + copy_from: m365_defender.event.sha256 + ignore_empty_value: true + tag: set_dll_sha256 + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + - set: + field: dll.name + copy_from: m365_defender.event.file.name + ignore_empty_value: true + tag: set_dll_name + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + - set: + field: dll.pe.sections.physical_size + copy_from: m365_defender.event.file.size + ignore_empty_value: true + tag: set_dll_pe_size + if: ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') + + # Process mappings (Only when its Process category (but not DeviceImageLoadEvents), or DeviceEvent, else it means something else) + # Fields like InitatingProcess* related to process.* unless the type is DeviceProcessEvent or DeviceEvent, then it relates to process.parent.* + ## DeviceProcessEvent/DeviceEvent + - set: + field: process.executable + copy_from: m365_defender.event.folder_path + ignore_empty_value: true + tag: set_process_executable + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.hash.md5 + copy_from: m365_defender.event.md5 + ignore_empty_value: true + tag: set_process_hash_md5 + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.hash.sha1 + copy_from: m365_defender.event.sha1 + ignore_empty_value: true + tag: set_process_hash_sha1 + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.hash.sha256 + copy_from: m365_defender.event.sha256 + ignore_empty_value: true + tag: set_process_hash_sha256 + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.name + copy_from: m365_defender.event.file.name + ignore_empty_value: true + tag: set_process_name + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.pe.sections.physical_size + copy_from: m365_defender.event.file.size + ignore_empty_value: true + tag: set_process_pe_sections_physical_size + if: ctx.event?.category != null && !ctx.m365_defender.event.category.toLowerCase().contains('deviceimageloadevents') && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.command_line + copy_from: m365_defender.event.initiating_process.command_line + ignore_empty_value: true + tag: set_process_parent_command_line + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.hash.md5 + copy_from: m365_defender.event.initiating_process.md5 + ignore_empty_value: true + tag: set_process_parent_hash_md5 + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.hash.sha1 + copy_from: m365_defender.event.initiating_process.sha1 + ignore_empty_value: true + tag: set_process_parent_hash_sha1 + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.hash.sha256 + copy_from: m365_defender.event.initiating_process.sha256 + ignore_empty_value: true + tag: set_process_parent_hash_sha256 + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.group_leader.pid + copy_from: m365_defender.event.initiating_process.parent_id + ignore_empty_value: true + tag: set_process_parent_group_leader_pid + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pid + copy_from: m365_defender.event.initiating_process.id + ignore_empty_value: true + tag: set_process_parent_pid + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.start + copy_from: m365_defender.event.initiating_process.creation_time + ignore_empty_value: true + tag: set_process_parent_start + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.name + copy_from: m365_defender.event.initiating_process.file_name + ignore_empty_value: true + tag: set_process_parent_name + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.sections.physical_size + copy_from: m365_defender.event.initiating_process.file_size + ignore_empty_value: true + tag: set_process_parent_pe_sections_physical_size + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.executable + copy_from: m365_defender.event.initiating_process.folder_path + ignore_empty_value: true + tag: set_process_parent_executable + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.group_leader.start + copy_from: m365_defender.event.initiating_process.parent_creation_time + ignore_empty_value: true + tag: set_process_parent_group_leader_start + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.group_leader.name + copy_from: m365_defender.event.initiating_process.parent_file_name + ignore_empty_value: true + tag: set_process_parent_group_leader_name + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.company + copy_from: m365_defender.event.initiating_process.version_info_company_name + ignore_empty_value: true + tag: set_process_parent_pe_company + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.description + copy_from: m365_defender.event.initiating_process.version_info_file_description + ignore_empty_value: true + tag: set_process_parent_pe_description + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.original_file_name + copy_from: m365_defender.event.initiating_process.version_info_original_file_name + ignore_empty_value: true + tag: set_process_parent_pe_original_file_name + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.product + copy_from: m365_defender.event.initiating_process.version_info_product_name + ignore_empty_value: true + tag: set_process_parent_pe_product + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.pe.file_version + copy_from: m365_defender.event.initiating_process.version_info_product_version + ignore_empty_value: true + tag: set_process_parent_pe_file_version + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + - set: + field: process.parent.code_signature.status + copy_from: m365_defender.event.initiating_process.signature_status + tag: set_process_code_signature_status + ignore_empty_value: true + if: ctx.event?.category != null && (ctx.event.category.contains('process') || ctx.m365_defender.event.category.toLowerCase().contains('deviceevents')) + + ## All other DeviceEvent types that is not DeviceProcessEvent or DeviceEvent map InitiatingProcess* to process.* rather than process.parent.* + - set: + field: process.command_line + copy_from: m365_defender.event.initiating_process.command_line + ignore_empty_value: true + tag: set_process_command_line + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.hash.md5 + copy_from: m365_defender.event.initiating_process.md5 + ignore_empty_value: true + tag: set_process_hash_md5 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.hash.sha1 + copy_from: m365_defender.event.initiating_process.sha1 + ignore_empty_value: true + tag: set_process_hash_sha1 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.hash.sha256 + copy_from: m365_defender.event.initiating_process.sha256 + ignore_empty_value: true + tag: set_process_hash_sha256 + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.parent.pid + copy_from: m365_defender.event.initiating_process.parent_id + ignore_empty_value: true + tag: set_process_parent_pid + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pid + copy_from: m365_defender.event.initiating_process.id + ignore_empty_value: true + tag: set_process_pid + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.start + copy_from: m365_defender.event.initiating_process.creation_time + ignore_empty_value: true + tag: set_process_start + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.name + copy_from: m365_defender.event.initiating_process.file_name + ignore_empty_value: true + tag: set_process_name + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.sections.physical_size + copy_from: m365_defender.event.initiating_process.file_size + ignore_empty_value: true + tag: set_process_pe_sections_physical_size + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.executable + copy_from: m365_defender.event.initiating_process.folder_path + ignore_empty_value: true + tag: set_process_executable + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.parent.start + copy_from: m365_defender.event.initiating_process.parent_creation_time + ignore_empty_value: true + tag: set_process_parent_start + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.parent.name + copy_from: m365_defender.event.initiating_process.parent_file_name + ignore_empty_value: true + tag: set_process_parent_name + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.company + copy_from: m365_defender.event.initiating_process.version_info_company_name + ignore_empty_value: true + tag: set_process_pe_company + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.description + copy_from: m365_defender.event.initiating_process.version_info_file_description + ignore_empty_value: true + tag: set_process_pe_description + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.original_file_name + copy_from: m365_defender.event.initiating_process.version_info_original_file_name + ignore_empty_value: true + tag: set_process_pe_original_file_name + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.product + copy_from: m365_defender.event.initiating_process.version_info_product_name + ignore_empty_value: true + tag: set_process_pe_product + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.pe.file_version + copy_from: m365_defender.event.initiating_process.version_info_product_version + ignore_empty_value: true + tag: set_process_pe_file_version + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + - set: + field: process.code_signature.status + copy_from: m365_defender.event.initiating_process.signature_status + tag: set_process_code_signature_status + ignore_empty_value: true + if: ctx.event?.category != null && !ctx.event.category.contains('process') && !ctx.m365_defender.event.category.toLowerCase().contains('deviceevents') + ## m365_defender.event.process* fields will always map to process.*, so these do not require any logic. + - set: + field: process.command_line + copy_from: m365_defender.event.process.command_line + ignore_empty_value: true + tag: set_process_command_line + - set: + field: process.start + copy_from: m365_defender.event.process.creation_time + ignore_empty_value: true + tag: set_process_start + - set: + field: process.pid + copy_from: m365_defender.event.process.id + ignore_empty_value: true + tag: set_process_pid + - set: + field: process.pe.company + copy_from: m365_defender.event.process.version_info_company_name + tag: set_process_pe_company + ignore_empty_value: true + - set: + field: process.pe.description + copy_from: m365_defender.event.process.version_info_file_description + tag: set_process_pe_description + ignore_empty_value: true + - set: + field: process.pe.original_file_name + copy_from: m365_defender.event.process.version_info_original_file_name + tag: set_process_pe_original_file_name + ignore_empty_value: true + - set: + field: process.pe.product + copy_from: m365_defender.event.process.version_info_product_name + tag: set_process_pe_product + ignore_empty_value: true + - set: + field: process.pe.file_version + copy_from: m365_defender.event.process.version_info_product_version + tag: set_process_pe_file_version + ignore_empty_value: true + + # Host mappings + - set: + field: host.name + copy_from: m365_defender.event.device.name + tag: set_host_name + ignore_empty_value: true + - lowercase: + field: host.name + tag: lowercase_host_name + if: ctx.host?.name != null + - set: + field: host.id + copy_from: m365_defender.event.device.id + tag: set_host_id + ignore_empty_value: true + - set: + field: host.ip + copy_from: m365_defender.event.public_ip.value + tag: set_host_ip + ignore_empty_value: true + - set: + field: host.architecture + copy_from: m365_defender.event.os.architecture + tag: set_host_architecture + ignore_empty_value: true + - set: + field: host.os.full + copy_from: m365_defender.event.os.platform + tag: set_host_os_full + ignore_empty_value: true + - set: + field: host.os.platform + copy_from: m365_defender.event.os.distribution + tag: set_host_os_platform + ignore_empty_value: true + - set: + field: host.os.version + copy_from: m365_defender.event.os.version + tag: set_host_os_version + ignore_empty_value: true + - set: + field: host.type + copy_from: m365_defender.event.device.type + tag: set_host_type + ignore_empty_value: true + - gsub: + field: m365_defender.event.mac_address + pattern: '[:.]' + replacement: '-' + tag: gsub_m365_defender_event_mac_address + ignore_missing: true + - uppercase: + field: m365_defender.event.mac_address + tag: uppercase_m365_defender_event_mac_address + ignore_missing: true + - set: + field: host.mac + copy_from: m365_defender.event.mac_address + tag: set_host_mac + ignore_empty_value: true + + # Registry Mapping + - set: + field: registry.key + copy_from: m365_defender.event.registry.key + tag: set_registry_key + ignore_empty_value: true + - set: + field: registry.value + copy_from: m365_defender.event.registry.value_name + tag: set_registry_value + ignore_empty_value: true + - append: + field: registry.data.strings + value: '{{{m365_defender.event.registry.value_data}}}' + tag: append_registry_data_strings + allow_duplicates: false + if: ctx.m365_defender?.event?.registry?.value_data != null + + # Source Mapping (DeviceLoginEvent has different mappings than the rest. DeviceNetworkEvent might include a direction, which controls which field goes to source/destination) + - set: + field: source.ip + copy_from: m365_defender.event.remote.ip + ignore_empty_value: true + tag: set_source_ip + if: ctx.event?.category != null && ctx.event.category.contains('authentication') + - set: + field: source.ip + copy_from: m365_defender.event.remote.ip + ignore_empty_value: true + tag: set_source_ip + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'In' + - set: + field: source.ip + copy_from: m365_defender.event.local.ip + ignore_empty_value: true + tag: set_source_ip + if: ctx.event?.category != null && !ctx.event.category.contains('authentication') && ctx.m365_defender?.event?.network_direction == null + - set: + field: source.ip + copy_from: m365_defender.event.local.ip + ignore_empty_value: true + tag: set_source_ip + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'Out' + - set: + field: source.ip + copy_from: m365_defender.event.request.source_ip + ignore_empty_value: true + tag: set_source_ip + if: ctx.event?.category != null && ctx.event.category.contains('file') + - set: + field: source.port + copy_from: m365_defender.event.remote.port + ignore_empty_value: true + tag: set_source_port + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'In' + - set: + field: source.port + copy_from: m365_defender.event.remote.port + ignore_empty_value: true + tag: set_source_port + if: ctx.event?.category != null && ctx.event.category.contains('authentication') + - set: + field: source.port + copy_from: m365_defender.event.local.port + ignore_empty_value: true + tag: set_source_port + if: ctx.event?.category != null && !ctx.event.category.contains('authentication') + - set: + field: source.port + copy_from: m365_defender.event.local.port + ignore_empty_value: true + tag: set_source_port + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'Out' + - set: + field: source.port + copy_from: m365_defender.event.request.source_port + tag: set_source_port + ignore_empty_value: true + - set: + field: source.domain + copy_from: m365_defender.event.remote.device_name + tag: set_source_domain + ignore_empty_value: true + + # Destination Mapping (DeviceLoginEvent has different mappings than the rest. DeviceNetworkEvent might include a direction, which controls which field goes to source/destination) + - set: + field: destination.ip + copy_from: m365_defender.event.remote.ip + ignore_empty_value: true + tag: set_destination_ip + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'Out' + - set: + field: destination.ip + copy_from: m365_defender.event.remote.ip + ignore_empty_value: true + tag: set_destination_ip + if: ctx.event?.category != null && !ctx.event.category.contains('authentication') && ctx.m365_defender?.event?.network_direction == null + - set: + field: destination.ip + copy_from: m365_defender.event.local.ip + ignore_empty_value: true + tag: set_destination_ip + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'In' + - set: + field: destination.port + copy_from: m365_defender.event.remote.port + ignore_empty_value: true + tag: set_destination_port + if: ctx.event?.category != null && !ctx.event.category.contains('authentication') && ctx.m365_defender?.event?.network_direction == null + - set: + field: destination.port + copy_from: m365_defender.event.remote.port + ignore_empty_value: true + tag: set_destination_port + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'Out' + - set: + field: destination.port + copy_from: m365_defender.event.local.port + ignore_empty_value: true + tag: set_destination_port + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'In' + + # User fields (Duplicate fields like user.name never exists at the same time in different event types) + - set: + field: user.name + copy_from: m365_defender.event.account.name + tag: set_user_name + ignore_empty_value: true + - set: + field: user.domain + copy_from: m365_defender.event.request.account_domain + tag: set_user_domain + ignore_empty_value: true + - set: + field: user.name + copy_from: m365_defender.event.request.account_name + tag: set_user_name + ignore_empty_value: true + - set: + field: user.domain + copy_from: m365_defender.event.account.domain + tag: set_user_domain + ignore_empty_value: true + - set: + field: user.id + copy_from: m365_defender.event.account.sid + tag: set_user_id + ignore_empty_value: true + + # Network fields (Only one of them exists in an event) + - set: + field: network.protocol + copy_from: m365_defender.event.protocol + tag: set_network_protocol + ignore_empty_value: true - set: field: network.protocol - copy_from: m365_defender.event.protocol + copy_from: m365_defender.event.request.protocol + tag: set_network_protocol ignore_empty_value: true - lowercase: field: network.protocol + tag: lowercase_network_protocol ignore_missing: true - - rename: - field: json.properties.RemoteIPType - target_field: m365_defender.event.remote.ip_type - ignore_missing: true - - rename: - field: json.properties.RegistryValueType - target_field: m365_defender.event.registry.value_type - ignore_missing: true - - rename: - field: json.properties.LocalIPType - target_field: m365_defender.event.local.ip_type - ignore_missing: true - - json: - field: json.properties.ConnectedNetworks - if: ctx.json?.properties?.ConnectedNetworks != null && ctx.json.properties.ConnectedNetworks instanceof String && ctx.json.properties.ConnectedNetworks != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.ConnectedNetworks - target_field: m365_defender.event.connected_networks - ignore_missing: true - - json: - field: json.properties.DefaultGateways - if: ctx.json?.properties?.DefaultGateways != null && ctx.json.properties.DefaultGateways instanceof String && ctx.json.properties.DefaultGateways != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.DefaultGateways - target_field: m365_defender.event.default_gateways - ignore_missing: true - - json: - field: json.properties.DnsAddresses - if: ctx.json?.properties?.DnsAddresses != null && ctx.json.properties.DnsAddresses instanceof String && ctx.json.properties.DnsAddresses != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.DnsAddresses - target_field: m365_defender.event.dns_addresses - ignore_missing: true - - json: - field: json.properties.IPAddresses - if: ctx.json?.properties?.IPAddresses != null && ctx.json.properties.IPAddresses instanceof String && ctx.json.properties.IPAddresses != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.IPAddresses - target_field: m365_defender.event.ip_addresses + - set: + field: network.direction + value: inbound + tag: set_network_direction_inbound + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'In' + - set: + field: network.direction + value: outbound + tag: set_network_direction_outbound + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == 'Out' + - set: + field: network.direction + value: unknown + tag: set_network_direction_unknown + if: ctx.event?.category != null && ctx.event.category.contains('network') && ctx.m365_defender?.event?.network_direction == null + + # Event Outcome/Actions mapping + - set: + field: event.action + copy_from: m365_defender.event.action.type + tag: set_event_action + ignore_empty_value: true + - lowercase: + field: event.action + tag: lowercase_event_action ignore_missing: true - - convert: - field: json.properties.IPv4Dhcp - target_field: m365_defender.event.ipv4_dhcp - if: ctx.json?.properties?.IPv4Dhcp != '' - type: ip + - gsub: + field: event.action + pattern: ' ' + replacement: '-' + tag: gsub_event_action ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' + - set: + field: event.outcome + value: 'success' + tag: set_event_outcome_success + if: (ctx.m365_defender?.event?.failure_reason == null || ctx.m365_defender.event.failure_reason == '') && ctx.m365_defender.event.category.toLowerCase().contains('devicelogonevents') + - set: + field: event.outcome + value: 'failure' + tag: set_event_outcome_failure + if: (ctx.m365_defender?.event?.failure_reason != null && ctx.m365_defender.event.failure_reason != '') && ctx.m365_defender.event.category.toLowerCase().contains('devicelogonevents') + + # Observer mapping + - set: + field: observer.version + copy_from: m365_defender.event.client_version + tag: set_observer_version + ignore_empty_value: true + - set: + field: observer.type + copy_from: m365_defender.event.device.category + tag: set_observer_type + ignore_empty_value: true + + # URL/HTTP Fields + - uri_parts: + field: m365_defender.event.remote.url + target_field: url + ignore_failure: true + tag: uri_parts_m365_defender_event_remote_url + if: ctx.m365_defender?.event?.remote?.url != null && ctx.m365_defender.event.remote.url != '' + - set: + field: http.request.referrer + copy_from: m365_defender.event.file.origin_referrer_url + tag: set_http_request_referrer + ignore_empty_value: true + + # Custom Fields mapping + ## Network adapter name depends on platform, this existed from before to get interface names for windows + - grok: + if: ctx.json?.properties?.NetworkAdapterName != null && ctx.json?.properties?.NetworkAdapterName.startsWith('{') + field: json.properties.NetworkAdapterName + tag: grok_json_properties_NetworkAdapterName + patterns: + - "^{%{DATA:m365_defender.event.network.adapter_name}}$" + - set: + field: m365_defender.event.network.adapter_name + copy_from: json.properties.NetworkAdapterName + tag: set_m365_defender_event_network_adapter_name + if: ctx.json?.properties?.NetworkAdapterName != null && !ctx.json?.properties?.NetworkAdapterName.startsWith('{') + ignore_empty_value: true + ## LoggedOnUsers is an array of JSON objects, with a Username Key and a username value. + ## This makes the data hard to use for visualizations etc, so instead we convert it to an array of simply the usernames, and then append them to related users + - foreach: + field: json.properties.LoggedOnUsers + tag: foreach_json_properties_LoggedOnUsers + if: ctx.json?.properties?.LoggedOnUsers instanceof List + processor: + append: + field: m365_defender.event.active_users + value: '{{{_ingest._value.UserName}}}' + - foreach: + field: m365_defender.event.active_users + tag: foreach_m365_defender_event_active_users + if: ctx.m365_defender?.event?.active_users instanceof List + processor: + append: + field: related.user + value: '{{{_ingest._value}}}' + + ## This is an best effort attempt to parse command line into arguments. + ## Due to the fact that there is no way to know which OS it originates from, and no specific format these are supplied in the data itself, + ## there is no good way to get 100% coverage, but this implementation should cover almost all common scenarios. + - script: + description: Splits up the command line to populate more processor fields. + lang: painless + tag: script_split_command_line + if: ctx.process?.command_line != null && ctx.process.command_line != '' + source: | + def commandLine = ctx.process.command_line; + commandLine = commandLine.trim(); + if (commandLine != "") { + ctx.process.command_line = commandLine; + + def args = new ArrayList(); + for (def v : / /.split(commandLine)) { + if (v != "") { + args.add(v); + } + } + if (args.length > 0) { + ctx.process.args = args; + ctx.process.args_count = args.length; + } + } + - script: + description: Splits up the command line to populate more parent processor fields. + lang: painless + tag: script_split_parent_command_line + if: ctx.process?.parent?.command_line != null && ctx.process?.parent?.command_line != '' + source: | + def commandLine = ctx.process.parent.command_line; + commandLine = commandLine.trim(); + if (commandLine != "") { + ctx.process.command_line = commandLine; + + def args = new ArrayList(); + for (def v : / /.split(commandLine)) { + if (v != "") { + args.add(v); + } + } + if (args.length > 0) { + ctx.process.parent.args = args; + ctx.process.parent.args_count = args.length; + } + } + + # Geo mapping + - geoip: + if: ctx.m365_defender?.event?.public_ip?.value != null + field: host.ip + tag: geoip_host_ip + target_field: host.geo + + # Related fields + ## Hosts + - append: + field: related.hosts + value: '{{{host.id}}}' + tag: append_related_hosts + if: ctx.host?.id != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{host.name}}}' + if: ctx.host?.name != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{user.domain}}}' + if: ctx.user?.domain != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{m365_defender.event.initiating_process.account_domain}}}' + if: ctx.m365_defender?.event?.initiating_process?.account_domain != null + allow_duplicates: false + ## Users + - append: + field: related.user + value: '{{{user.name}}}' + if: ctx.user?.name != null + allow_duplicates: false + - append: + field: related.user + value: '{{{m365_defender.event.initiating_process.account_name}}}' + if: ctx.m365_defender?.event?.initiating_process?.account_name != null + allow_duplicates: false + ## IP + - append: + field: related.ip + value: '{{{m365_defender.event.file.origin_ip}}}' + if: ctx.m365_defender?.event?.file?.origin_ip != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{source.ip}}}' + if: ctx.source?.ip != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{destination.ip}}}' + if: ctx.destination?.ip != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{host.ip}}}' + if: ctx.host?.ip != null + allow_duplicates: false - append: field: related.ip value: '{{{m365_defender.event.ipv4_dhcp}}}' if: ctx.m365_defender?.event?.ipv4_dhcp != null allow_duplicates: false - - convert: - field: json.properties.IPv6Dhcp - target_field: m365_defender.event.ipv6_dhcp - if: ctx.json?.properties?.IPv6Dhcp != '' - type: ip - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{m365_defender.event.ipv6_dhcp}}}' if: ctx.m365_defender?.event?.ipv6_dhcp != null allow_duplicates: false - - rename: - field: json.properties.NetworkAdapterStatus - target_field: m365_defender.event.network.adapter_status - ignore_missing: true - - rename: - field: json.properties.NetworkAdapterType - target_field: m365_defender.event.network.adapter_type - ignore_missing: true - - rename: - field: json.properties.NetworkAdapterVendor - target_field: m365_defender.event.network.adapter_vendor - ignore_missing: true - - rename: - field: json.properties.TunnelType - target_field: m365_defender.event.tunnel_type - ignore_missing: true - - rename: - field: json.properties.InitiatingProcessSignatureStatus - target_field: m365_defender.event.initiating_process.signature_status - ignore_missing: true - - rename: - field: json.properties.InitiatingProcessSignerType - target_field: m365_defender.event.initiating_process.signer_type - ignore_missing: true - - rename: - field: json.properties.ProcessIntegrityLevel - target_field: m365_defender.event.process.integrity_level - ignore_missing: true - - rename: - field: json.properties.PreviousRegistryKey - target_field: m365_defender.event.previous.registry_key - ignore_missing: true - - rename: - field: json.properties.PreviousRegistryValueData - target_field: m365_defender.event.previous.registry_value_data - ignore_missing: true - - rename: - field: json.properties.PreviousRegistryValueName - target_field: m365_defender.event.previous.registry_value_name - ignore_missing: true + ## Hash + - append: + field: related.hash + value: '{{{file.hash.md5}}}' + if: ctx.file?.hash?.md5 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{file.hash.sha1}}}' + if: ctx.file?.hash?.sha1 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{file.hash.sha256}}}' + if: ctx.file?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.md5}}}' + if: ctx.process?.hash?.md5 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.sha1}}}' + if: ctx.process?.hash?.sha1 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.hash.sha256}}}' + if: ctx.process?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.parent.hash.md5}}}' + if: ctx.process?.hash?.md5 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.parent.hash.sha1}}}' + if: ctx.process?.hash?.sha1 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{process.parent.hash.sha256}}}' + if: ctx.process?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{m365_defender.event.issuer_hash}}}' + if: ctx.m365_defender?.event?.issuer_hash != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{m365_defender.event.signer_hash}}}' + if: ctx.m365_defender?.event?.signer_hash != null + allow_duplicates: false + + # Duplicate Custom fields are disabled by default and will therefore remove these fields. + # Can be enabled in the UI when configuring the integration. - remove: if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + tag: remove_duplicate_custom_fields field: - m365_defender.event.folder_path - m365_defender.event.md5 @@ -1240,17 +1881,33 @@ processors: - m365_defender.event.sha256 - m365_defender.event.file.name - m365_defender.event.file.size + - m365_defender.event.file.origin_referrer_url - m365_defender.event.device.name - m365_defender.event.device.id + - m365_defender.event.process.version_info_company_name + - m365_defender.event.process.version_info_product_name + - m365_defender.event.process.version_info_product_version + - m365_defender.event.process.version_info_file_description + - m365_defender.event.initiating_process.file_name + - m365_defender.event.initiating_process.version_info_product_version + - m365_defender.event.initiating_process.version_info_file_description + - m365_defender.event.initiating_process.version_info_original_file_name + - m365_defender.event.initiating_process.file_size + - m365_defender.event.initiating_process.version_info_company_name + - m365_defender.event.initiating_process.version_info_product_name + - m365_defender.event.initiating_process.folder_path - m365_defender.event.initiating_process.command_line - m365_defender.event.initiating_process.md5 - m365_defender.event.initiating_process.sha1 - m365_defender.event.initiating_process.sha256 - m365_defender.event.initiating_process.parent_id - m365_defender.event.initiating_process.id + - m365_defender.event.initiating_process.parent_file_name + - m365_defender.event.initiating_process.parent_creation_time + - m365_defender.event.initiating_process.signature_status - m365_defender.event.registry.key - m365_defender.event.registry.value_name - - m365_defender.event.file.origin_ip + - m365_defender.event.registry.value_data - m365_defender.event.public_ip.value - m365_defender.event.local.ip - m365_defender.event.remote.ip @@ -1259,6 +1916,7 @@ processors: - m365_defender.event.remote.port - m365_defender.event.request.source_port - m365_defender.event.account.name + - m365_defender.event.account.sid - m365_defender.event.certificate.expiration_time - m365_defender.event.certificate.serial_number - m365_defender.event.protocol @@ -1275,11 +1933,16 @@ processors: - m365_defender.event.client_version - m365_defender.event.device.category - m365_defender.event.action.type + - m365_defender.event.is_signed + - m365_defender.event.signer + - m365_defender.event.issuer + - m365_defender.event.is_trusted ignore_missing: true on_failure: - - set: - field: event.kind - value: pipeline_error - append: field: error.message - value: '{{{ _ingest.on_failure_message }}}' + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_email.yml b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_email.yml index 033161e6363..3f625d4883f 100644 --- a/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_email.yml +++ b/packages/m365_defender/data_stream/event/elasticsearch/ingest_pipeline/pipeline_email.yml @@ -1,109 +1,125 @@ --- description: Pipeline for processing Email Event logs. processors: + # ctx.m365_defender.event.category is required for the event to be processed correctly as documented in the initial pipeline. + # Rather than checking it in every processor we check it once here. + - fail: + message: 'Event does not contain a valid category.' + tag: fail_event_category + if: ctx.m365_defender.event.category == null || ctx.m365_defender.event.category == '' + # Event Categorization - set: field: event.kind - value: [event] - - set: + value: event + tag: set_event_kind + - append: field: event.category - value: [email] - if: '!ctx.m365_defender?.event?.category?.toLowerCase().contains("urlclickevents")' + value: email + tag: append_event_category + if: '!ctx.m365_defender.event.category.toLowerCase().contains("urlclickevents")' - append: field: event.category - value: [file] + value: file + tag: append_event_category if: ctx.json?.properties?.FileType != null - - set: + - append: field: event.type - value: [info] - if: '!ctx.m365_defender?.event?.category?.toLowerCase().contains("urlclickevents")' - - set: + value: info + tag: append_event_type + if: '!ctx.m365_defender.event.category.toLowerCase().contains("urlclickevents")' + - append: field: event.type - value: [info] + value: info + tag: append_event_type if: ctx.event?.type == null - - rename: - field: json.properties.SenderFromAddress - target_field: m365_defender.event.sender.from_address - ignore_missing: true - - append: - field: email.from.address - value: '{{{m365_defender.event.sender.from_address}}}' - if: ctx.m365_defender?.event?.sender?.from_address != null - allow_duplicates: false - - append: - field: related.user - value: '{{{m365_defender.event.sender.from_address}}}' - if: ctx.m365_defender?.event?.sender?.from_address != null - allow_duplicates: false - - rename: - field: json.properties.NetworkMessageId - target_field: m365_defender.event.network.message_id - ignore_missing: true - - set: - field: email.local_id - copy_from: m365_defender.event.network.message_id - ignore_empty_value: true - - rename: - field: json.properties.RecipientEmailAddress - target_field: m365_defender.event.recipient.email_address - ignore_missing: true - - append: - field: email.to.address - value: '{{{m365_defender.event.recipient.email_address}}}' - if: ctx.m365_defender?.event?.recipient?.email_address != null - allow_duplicates: false - - append: - field: related.user - value: '{{{m365_defender.event.recipient.email_address}}}' - if: ctx.m365_defender?.event?.recipient?.email_address != null - allow_duplicates: false - - rename: - field: json.properties.FileType - target_field: m365_defender.event.file.type - ignore_missing: true - - set: - field: file.extension - copy_from: m365_defender.event.file.type - ignore_empty_value: true - - rename: - field: json.properties.ActionType - target_field: m365_defender.event.action.type - ignore_missing: true - - set: - field: event.action - copy_from: m365_defender.event.action.type - ignore_empty_value: true - - lowercase: - field: event.action - ignore_missing: true - - gsub: - field: event.action - pattern: ' ' - replacement: '-' - ignore_missing: true - - rename: - field: json.properties.SHA256 - target_field: m365_defender.event.sha256 + + # JSON Processors + - json: + field: json.properties.DetectionMethods + tag: json_detection_methods + if: ctx.json?.properties?.DetectionMethods != null && ctx.json.properties.DetectionMethods instanceof String && ctx.json.properties.DetectionMethods != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.ConfidenceLevel + tag: json_confidence_level + if: ctx.json?.properties?.ConfidenceLevel != null && ctx.json.properties.ConfidenceLevel instanceof String && ctx.json.properties.ConfidenceLevel != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - json: + field: json.properties.AdditionalFields + tag: json_additional_fields + if: ctx.json?.properties?.AdditionalFields != null && ctx.json.properties.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + +# Numbers to boolean (Undocumented field types like string, numeric etc is possible, have to check all of them) + - script: + lang: painless + source: | + def isTruthy(def val) { + if (val == null) { + // Fast return if field is absent. + return null; + } + if (val instanceof Boolean) { + return val; + } + if (val instanceof Integer) { + if (val == 1) { + return true; + } + if (val == 0) { + return false; + } + return null; + } + if (val instanceof String) { + if (val == "1" || val == "true") { + return true; + } + if (val == "0" || val == "false") { + return false; + } + return null; + } + return null; + } + ctx.m365_defender.event.is_clicked_through = isTruthy(ctx.json?.properties?.IsClickedThrough); + + # Convert Processors + - convert: + field: json.properties.EmailClusterId + target_field: m365_defender.event.email.cluster_id + tag: convert_email_cluster_id + if: ctx.json?.properties?.EmailClusterId != '' + type: string ignore_missing: true - - set: - field: file.hash.sha256 - copy_from: m365_defender.event.sha256 - ignore_empty_value: true - - append: - field: related.hash - value: '{{{file.hash.sha256}}}' - if: ctx.file?.hash?.sha256 != null - allow_duplicates: false - - rename: - field: json.properties.FileName - target_field: m365_defender.event.file.name + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.IPAddress + target_field: m365_defender.event.ip_address + tag: convert_ip_address + if: ctx.json?.properties?.IPAddress != '' + type: ip ignore_missing: true - - set: - field: file.name - copy_from: m365_defender.event.file.name - ignore_empty_value: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' - convert: field: json.properties.FileSize target_field: m365_defender.event.file.size + tag: convert_file_size if: ctx.json?.properties?.FileSize != '' type: long ignore_missing: true @@ -111,29 +127,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - set: - field: file.size - copy_from: m365_defender.event.file.size - ignore_empty_value: true - - rename: - field: json.properties.EmailDirection - target_field: m365_defender.event.email.direction - ignore_missing: true - - set: - field: email.direction - copy_from: m365_defender.event.email.direction - ignore_empty_value: true - - rename: - field: json.properties.Subject - target_field: m365_defender.event.subject - ignore_missing: true - - set: - field: email.subject - copy_from: m365_defender.event.subject - ignore_empty_value: true - convert: field: json.properties.SenderIPv4 target_field: m365_defender.event.sender.ipv4 + tag: convert_sender_ipv4 if: ctx.json?.properties?.SenderIPv4 != '' type: ip ignore_missing: true @@ -141,19 +138,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.sender.ipv4}}}' - if: ctx.m365_defender?.event?.sender?.ipv4 != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.sender.ipv4}}}' - if: ctx.m365_defender?.event?.sender?.ipv4 != null - allow_duplicates: false - convert: field: json.properties.SenderIPv6 target_field: m365_defender.event.sender.ipv6 + tag: convert_sender_ipv6 if: ctx.json?.properties?.SenderIPv6 != '' type: ip ignore_missing: true @@ -161,209 +149,221 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - append: - field: source.ip - value: '{{{m365_defender.event.sender.ipv6}}}' - if: ctx.m365_defender?.event?.sender?.ipv6 != null - allow_duplicates: false - - append: - field: related.ip - value: '{{{m365_defender.event.sender.ipv6}}}' - if: ctx.m365_defender?.event?.sender?.ipv6 != null - allow_duplicates: false - convert: - field: json.properties.IPAddress - target_field: m365_defender.event.ip_address - if: ctx.json?.properties?.IPAddress != '' - type: ip + field: json.properties.AttachmentCount + target_field: m365_defender.event.attachment_count + tag: convert_attachment_count + if: ctx.json?.properties?.AttachmentCount != '' + type: long ignore_missing: true on_failure: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - set: - field: host.ip - copy_from: m365_defender.event.ip_address - ignore_empty_value: true - - append: - field: related.ip - value: '{{{m365_defender.event.ip_address}}}' - if: ctx.m365_defender?.event?.ip_address != null - allow_duplicates: false - - json: - field: json.properties.DetectionMethods - if: ctx.json?.properties?.DetectionMethods != null && ctx.json.properties.DetectionMethods instanceof String && ctx.json.properties.DetectionMethods != '' + - convert: + field: json.properties.BulkComplaintLevel + target_field: m365_defender.event.bulk_complaint_level + tag: convert_bulk_complaint_level + if: ctx.json?.properties?.BulkComplaintLevel != '' + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.ReportId + target_field: m365_defender.event.report_id + tag: convert_json_properties_ReportId + if: ctx.json?.properties?.ReportId != '' + type: string + ignore_missing: true + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.UrlCount + target_field: m365_defender.event.url_count + tag: convert_url_count + if: ctx.json?.properties?.UrlCount != '' + type: long + ignore_missing: true on_failure: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + + # Rename Processors + - rename: + field: json.properties.SenderFromAddress + target_field: m365_defender.event.sender.from_address + tag: rename_sender_from_address + ignore_missing: true + - rename: + field: json.properties.NetworkMessageId + target_field: m365_defender.event.network.message_id + tag: rename_network_message_id + ignore_missing: true + - rename: + field: json.properties.FileType + target_field: m365_defender.event.file.type + tag: rename_file_type + ignore_missing: true + - rename: + field: json.properties.RecipientEmailAddress + target_field: m365_defender.event.recipient.email_address + tag: rename_recipient_email_address + ignore_missing: true + - rename: + field: json.properties.ActionType + target_field: m365_defender.event.action.type + tag: rename_action_type + ignore_missing: true + - rename: + field: json.properties.SHA256 + target_field: m365_defender.event.sha256 + tag: rename_sha256 + ignore_missing: true + - rename: + field: json.properties.FileName + target_field: m365_defender.event.file.name + tag: rename_file_name + ignore_missing: true + - rename: + field: json.properties.EmailDirection + target_field: m365_defender.event.email.direction + tag: rename_email_direction + ignore_missing: true + - rename: + field: json.properties.Subject + target_field: m365_defender.event.subject + tag: rename_subject + ignore_missing: true - rename: field: json.properties.DetectionMethods target_field: m365_defender.event.detection.methods + tag: rename_detection_methods ignore_missing: true - rename: field: json.properties.RecipientObjectId target_field: m365_defender.event.recipient.object_id - ignore_missing: true - - rename: - field: json.properties.ReportId - target_field: m365_defender.event.report_id + tag: rename_recipient_object_id ignore_missing: true - rename: field: json.properties.SenderDisplayName target_field: m365_defender.event.sender.display_name + tag: rename_sender_display_name ignore_missing: true - rename: field: json.properties.SenderObjectId target_field: m365_defender.event.sender.object_id + tag: rename_sender_object_id ignore_missing: true - rename: field: json.properties.ThreatNames target_field: m365_defender.event.threat.names + tag: rename_threat_names ignore_missing: true - rename: field: json.properties.ThreatTypes target_field: m365_defender.event.threat.types + tag: rename_threat_types ignore_missing: true - - convert: - field: json.properties.AttachmentCount - target_field: m365_defender.event.attachment_count - if: ctx.json?.properties?.AttachmentCount != '' - type: long + - rename: + field: json.properties.ConfidenceLevel + target_field: m365_defender.event.confidence_level + tag: rename_confidence_level ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.AuthenticationDetails target_field: m365_defender.event.authentication_details + tag: rename_authentication_details ignore_missing: true - - convert: - field: json.properties.BulkComplaintLevel - target_field: m365_defender.event.bulk_complaint_level - if: ctx.json?.properties?.BulkComplaintLevel != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - json: - field: json.properties.ConfidenceLevel - if: ctx.json?.properties?.ConfidenceLevel != null && ctx.json.properties.ConfidenceLevel instanceof String && ctx.json.properties.ConfidenceLevel != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - - rename: - field: json.properties.ConfidenceLevel - target_field: m365_defender.event.confidence_level - ignore_missing: true - - json: - field: json.properties.AdditionalFields - if: ctx.json?.properties?.AdditionalFields != null && ctx.json.properties.AdditionalFields instanceof String && ctx.json.properties.AdditionalFields != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.AdditionalFields target_field: m365_defender.event.additional_fields + tag: rename_additional_fields ignore_missing: true - rename: field: json.properties.Connectors target_field: m365_defender.event.connectors + tag: rename_connectors ignore_missing: true - rename: field: json.properties.DeliveryAction target_field: m365_defender.event.delivery.action + tag: rename_delivery_action ignore_missing: true - rename: field: json.properties.DeliveryLocation target_field: m365_defender.event.delivery.location + tag: rename_delivery_location ignore_missing: true - rename: field: json.properties.EmailAction target_field: m365_defender.event.email.action + tag: rename_email_action ignore_missing: true - rename: field: json.properties.EmailActionPolicy target_field: m365_defender.event.email.action_policy + tag: rename_email_action_policy ignore_missing: true - rename: field: json.properties.EmailActionPolicyGuid target_field: m365_defender.event.email.action_policy_guid + tag: rename_email_action_policy_guid ignore_missing: true - - convert: - field: json.properties.EmailClusterId - target_field: m365_defender.event.email.cluster_id - if: ctx.json?.properties?.EmailClusterId != '' - type: string - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.EmailLanguage target_field: m365_defender.event.email.language + tag: rename_email_language ignore_missing: true - rename: field: json.properties.InternetMessageId target_field: m365_defender.event.internet_message_id + tag: rename_internet_message_id ignore_missing: true - rename: field: json.properties.OrgLevelAction target_field: m365_defender.event.org_level.action + tag: rename_org_level_action ignore_missing: true - rename: field: json.properties.OrgLevelPolicy target_field: m365_defender.event.org_level.policy + tag: rename_org_level_policy ignore_missing: true - rename: field: json.properties.SenderFromDomain target_field: m365_defender.event.sender.from_domain + tag: rename_sender_from_domain ignore_missing: true - - append: - field: related.hosts - value: '{{{m365_defender.event.sender.from_domain}}}' - if: ctx.m365_defender?.event?.sender?.from_domain != null - allow_duplicates: false - rename: field: json.properties.SenderMailFromAddress target_field: m365_defender.event.sender.mail_from_address + tag: rename_sender_mail_from_address ignore_missing: true - rename: field: json.properties.SenderMailFromDomain target_field: m365_defender.event.sender.mail_from_domain + tag: rename_sender_mail_from_domain ignore_missing: true - - append: - field: related.hosts - value: '{{{m365_defender.event.sender.mail_from_domain}}}' - if: ctx.m365_defender?.event?.sender?.mail_from_domain != null - allow_duplicates: false - - convert: - field: json.properties.UrlCount - target_field: m365_defender.event.url_count - if: ctx.json?.properties?.UrlCount != '' - type: long - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.UserLevelAction target_field: m365_defender.event.user_level_action + tag: rename_user_level_action ignore_missing: true - rename: field: json.properties.UserLevelPolicy target_field: m365_defender.event.user_level_policy + tag: rename_user_level_policy ignore_missing: true - rename: field: json.properties.ActionResult target_field: m365_defender.event.action.result + tag: rename_action_result ignore_missing: true - rename: field: json.properties.ActionTrigger @@ -372,64 +372,205 @@ processors: - rename: field: json.properties.Action target_field: m365_defender.event.action.value + tag: rename_action ignore_missing: true - rename: field: json.properties.Url target_field: m365_defender.event.url + tag: rename_url ignore_missing: true - - uri_parts: - if: ctx.m365_defender?.event?.url != null - field: m365_defender.event.url - on_failure: - - set: - field: url.original - copy_from: m365_defender.event.url - ignore_empty_value: true - rename: field: json.properties.UrlDomain target_field: m365_defender.event.url_domain + tag: rename_url_domain ignore_missing: true - - append: - field: related.hosts - value: '{{{m365_defender.event.url_domain}}}' - if: ctx.m365_defender?.event?.url_domain != null - allow_duplicates: false - rename: field: json.properties.UrlLocation target_field: m365_defender.event.url_location + tag: rename_url_location ignore_missing: true - rename: field: json.properties.AccountUpn target_field: m365_defender.event.account.upn + tag: rename_account_upn ignore_missing: true - - set: - field: json.properties.IsClickedThrough - value: true - if: ctx.json?.properties?.IsClickedThrough == 1 || ctx.json?.properties?.IsClickedThrough == '1' - - set: - field: json.properties.IsClickedThrough - value: false - if: ctx.json?.properties?.IsClickedThrough == 0 || ctx.json?.properties?.IsClickedThrough == '0' - - convert: - field: json.properties.IsClickedThrough - target_field: m365_defender.event.is_clicked_through - if: ctx.json?.properties?.IsClickedThrough != '' - type: boolean - ignore_missing: true - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.properties.UrlChain target_field: m365_defender.event.url_chain + tag: rename_url_chain ignore_missing: true - rename: field: json.properties.Workload target_field: m365_defender.event.workload + tag: rename_workload ignore_missing: true + + # File mappings + - set: + field: file.extension + copy_from: m365_defender.event.file.type + tag: set_file_extension + ignore_empty_value: true + - set: + field: file.hash.sha256 + copy_from: m365_defender.event.sha256 + tag: set_file_hash_sha256 + ignore_empty_value: true + - set: + field: file.name + copy_from: m365_defender.event.file.name + tag: set_file_name + ignore_empty_value: true + - set: + field: file.size + copy_from: m365_defender.event.file.size + tag: set_file_size + ignore_empty_value: true + + # Event Outcome/Action mappings + - set: + field: event.action + copy_from: m365_defender.event.action.type + tag: set_event_action + ignore_empty_value: true + - lowercase: + field: event.action + tag: lowercase_event_action + ignore_missing: true + - gsub: + field: event.action + pattern: ' ' + replacement: '-' + tag: gsub_event_action + ignore_missing: true + + # Email mappings + - append: + field: email.from.address + value: '{{{m365_defender.event.sender.from_address}}}' + tag: append_email_from_address + if: ctx.m365_defender?.event?.sender?.from_address != null + allow_duplicates: false + - append: + field: email.to.address + value: '{{{m365_defender.event.recipient.email_address}}}' + tag: append_email_to_address + if: ctx.m365_defender?.event?.recipient?.email_address != null + allow_duplicates: false + - set: + field: email.message_id + copy_from: m365_defender.event.network.message_id + tag: set_email_message_id + ignore_empty_value: true + - set: + field: email.direction + copy_from: m365_defender.event.email.direction + tag: set_email_direction + ignore_empty_value: true + - set: + field: email.subject + copy_from: m365_defender.event.subject + tag: set_email_subject + ignore_empty_value: true + - set: + field: email.local_id + copy_from: m365_defender.event.internet_message_id + tag: set_email_local_id + ignore_empty_value: true + + # Source mappings + - append: + field: source.ip + value: '{{{m365_defender.event.sender.ipv4}}}' + tag: append_source_ip + if: ctx.m365_defender?.event?.sender?.ipv4 != null + allow_duplicates: false + - append: + field: source.ip + value: '{{{m365_defender.event.sender.ipv6}}}' + tag: append_source_ip + if: ctx.m365_defender?.event?.sender?.ipv6 != null + allow_duplicates: false + + # Host mappings + - set: + field: host.ip + copy_from: m365_defender.event.ip_address + tag: set_host_ip + ignore_empty_value: true + + # URL mappings + - uri_parts: + if: ctx.m365_defender?.event?.url != null + tag: uri_parts_url + field: m365_defender.event.url + on_failure: + - set: + field: url.original + copy_from: m365_defender.event.url + ignore_empty_value: true + + # Related mappings + - append: + field: related.user + value: '{{{m365_defender.event.sender.from_address}}}' + tag: append_related_user + if: ctx.m365_defender?.event?.sender?.from_address != null + allow_duplicates: false + - append: + field: related.user + value: '{{{m365_defender.event.recipient.email_address}}}' + tag: append_related_user + if: ctx.m365_defender?.event?.recipient?.email_address != null + allow_duplicates: false + - append: + field: related.hash + value: '{{{file.hash.sha256}}}' + tag: append_related_hash + if: ctx.file?.hash?.sha256 != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{m365_defender.event.sender.ipv4}}}' + tag: append_related_ip + if: ctx.m365_defender?.event?.sender?.ipv4 != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{m365_defender.event.sender.ipv6}}}' + tag: append_related_ip + if: ctx.m365_defender?.event?.sender?.ipv6 != null + allow_duplicates: false + - append: + field: related.ip + value: '{{{m365_defender.event.ip_address}}}' + tag: append_related_ip + if: ctx.m365_defender?.event?.ip_address != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{m365_defender.event.sender.from_domain}}}' + tag: append_related_hosts + if: ctx.m365_defender?.event?.sender?.from_domain != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{m365_defender.event.sender.mail_from_domain}}}' + tag: append_related_hosts + if: ctx.m365_defender?.event?.sender?.mail_from_domain != null + allow_duplicates: false + - append: + field: related.hosts + value: '{{{m365_defender.event.url_domain}}}' + tag: append_related_hosts + if: ctx.m365_defender?.event?.url_domain != null + allow_duplicates: false + + # Duplicate Custom fields are disabled by default and will therefore remove these fields. + # Can be enabled in the UI when configuring the integration. - remove: if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + tag: remove_duplicate_custom_fields field: - m365_defender.event.sender.from_address - m365_defender.event.network.message_id @@ -446,9 +587,10 @@ processors: - m365_defender.event.action.type ignore_missing: true on_failure: - - set: - field: event.kind - value: pipeline_error - append: field: error.message - value: '{{{ _ingest.on_failure_message }}}' + value: |- + Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}" + - set: + field: event.kind + value: pipeline_error \ No newline at end of file diff --git a/packages/m365_defender/data_stream/event/fields/ecs.yml b/packages/m365_defender/data_stream/event/fields/ecs.yml index 19375911f32..f34e56c3dbc 100644 --- a/packages/m365_defender/data_stream/event/fields/ecs.yml +++ b/packages/m365_defender/data_stream/event/fields/ecs.yml @@ -1,33 +1,49 @@ +- external: ecs + name: ecs.version +- external: ecs + name: tags +- external: ecs + name: message - external: ecs name: destination.domain - external: ecs name: destination.ip - external: ecs name: destination.port -- external: ecs - name: ecs.version - external: ecs name: email.direction - external: ecs name: email.from.address - external: ecs name: email.local_id +- external: ecs + name: email.message_id - external: ecs name: email.subject - external: ecs name: email.to.address +- external: ecs + name: event.action +- external: ecs + name: event.outcome - external: ecs name: event.created - external: ecs name: event.id - external: ecs name: event.original -- external: ecs - name: event.outcome - external: ecs name: event.provider +- external: ecs + name: event.reference - external: ecs name: event.severity +- external: ecs + name: event.category +- external: ecs + name: event.type +- external: ecs + name: event.kind - external: ecs name: file.directory - external: ecs @@ -38,10 +54,6 @@ name: file.hash.sha1 - external: ecs name: file.hash.sha256 -- external: ecs - name: host.id -- external: ecs - name: host.name - external: ecs name: file.name - external: ecs @@ -51,17 +63,25 @@ - external: ecs name: file.x509.serial_number - external: ecs - name: host.id + name: file.x509.issuer.common_name - external: ecs - name: host.ip + name: file.code_signature.subject_name - external: ecs - name: host.name + name: file.code_signature.exists - external: ecs - name: host.type + name: file.code_signature.trusted - external: ecs - name: host.os.name + name: dll.path - external: ecs - name: message + name: dll.name +- external: ecs + name: dll.pe.sections.physical_size +- external: ecs + name: dll.hash.md5 +- external: ecs + name: dll.hash.sha1 +- external: ecs + name: dll.hash.sha256 - external: ecs name: network.direction - external: ecs @@ -72,20 +92,85 @@ name: observer.version - external: ecs name: process.command_line +- external: ecs + name: process.start +- external: ecs + name: process.args +- external: ecs + name: process.args_count - external: ecs name: process.hash.md5 - external: ecs name: process.hash.sha1 - external: ecs name: process.hash.sha256 +- external: ecs + name: process.pid +- external: ecs + name: process.executable +- external: ecs + name: process.name +- external: ecs + name: process.pe.sections.physical_size +- external: ecs + name: process.pe.company +- external: ecs + name: process.pe.description +- external: ecs + name: process.pe.original_file_name +- external: ecs + name: process.pe.product +- external: ecs + name: process.pe.file_version +- external: ecs + name: process.code_signature.status - external: ecs name: process.parent.pid - external: ecs - name: process.pid + name: process.parent.start +- external: ecs + name: process.parent.command_line +- external: ecs + name: process.parent.args +- external: ecs + name: process.parent.args_count +- external: ecs + name: process.parent.hash.md5 +- external: ecs + name: process.parent.hash.sha1 +- external: ecs + name: process.parent.hash.sha256 +- external: ecs + name: process.parent.executable +- external: ecs + name: process.parent.name +- external: ecs + name: process.parent.pe.sections.physical_size +- external: ecs + name: process.parent.pe.company +- external: ecs + name: process.parent.pe.description +- external: ecs + name: process.parent.pe.original_file_name +- external: ecs + name: process.parent.pe.product +- external: ecs + name: process.parent.pe.file_version +- external: ecs + name: process.parent.code_signature.status +- external: ecs + name: process.parent.group_leader.pid +- external: ecs + name: process.parent.group_leader.start +# Missing in ECS flatfile +- name: process.parent.group_leader.name + type: keyword - external: ecs name: registry.key - external: ecs name: registry.value +- external: ecs + name: registry.data.strings - external: ecs name: related.hash - external: ecs @@ -94,6 +179,14 @@ name: related.ip - external: ecs name: related.user +- external: ecs + name: host.os.full +- external: ecs + name: user.domain +- external: ecs + name: user.id +- external: ecs + name: user.name - external: ecs name: source.geo.city_name - external: ecs @@ -102,6 +195,8 @@ name: source.ip - external: ecs name: source.port +- external: ecs + name: source.domain - external: ecs name: source.user.domain - external: ecs @@ -109,17 +204,23 @@ - external: ecs name: source.user.name - external: ecs - name: threat.enrichments.indicator.file.directory + name: threat.indicator.file.directory +- external: ecs + name: threat.indicator.file.hash.sha1 +- external: ecs + name: threat.indicator.file.hash.sha256 - external: ecs - name: threat.enrichments.indicator.file.hash.sha1 + name: threat.indicator.file.name - external: ecs - name: threat.enrichments.indicator.file.hash.sha256 + name: threat.indicator.file.size - external: ecs - name: threat.enrichments.indicator.file.name + name: threat.indicator.registry.key - external: ecs - name: threat.enrichments.indicator.file.size + name: threat.indicator.registry.data.strings - external: ecs - name: threat.enrichments.indicator.type + name: threat.indicator.registry.value +- external: ecs + name: threat.indicator.type - external: ecs name: threat.group.name - external: ecs @@ -160,11 +261,3 @@ name: user_agent.os.version - external: ecs name: user_agent.version -- external: ecs - name: user.domain -- external: ecs - name: user.id -- external: ecs - name: user.name -- external: ecs - name: tags diff --git a/packages/m365_defender/data_stream/event/fields/fields.yml b/packages/m365_defender/data_stream/event/fields/fields.yml index 736c105a894..b45ed22676b 100644 --- a/packages/m365_defender/data_stream/event/fields/fields.yml +++ b/packages/m365_defender/data_stream/event/fields/fields.yml @@ -414,9 +414,9 @@ - name: location type: keyword description: City, country, or other geographic location associated with the event. - - name: logged_on_users - type: flattened - description: List of all users that are logged on the machine at the time of the event in JSON array format. + - name: active_users + type: keyword + description: An array of all users that are logged on the machine at the time of the event. - name: logon type: group fields: @@ -435,6 +435,30 @@ - name: md5 type: keyword description: MD5 hash of the file that the recorded action was applied to. + - name: sensor_health_state + type: keyword + description: Indicates health of the device's EDR sensor, if onboarded to Microsoft Defender For Endpoint. + - name: is_excluded + type: boolean + description: Determines if the device is currently excluded from Microsoft Defender for Vulnerability Management experiences. + - name: exclusion_reason + type: keyword + description: Indicates the reason for device exclusion. + - name: asset_value + type: keyword + description: Indicates the value of a device as assigned by the user. + - name: exposure_level + type: keyword + description: Indicates the exposure level of a device. + - name: is_internet_facing + type: boolean + description: Indicates whether the device is internet-facing. + - name: device_manual_tags + type: keyword + description: Device tags created manually using the portal UI or public API. + - name: device_dynamic_tags + type: keyword + description: Device tags assigned automatically using dynamic tagging rules. - name: merged_device_ids type: keyword description: Previous device IDs that have been assigned to the same device. @@ -461,6 +485,9 @@ - name: message_id type: keyword description: Unique identifier for the email, generated by Microsoft 365. + - name: network_direction + type: keyword + description: The network direction used in DeviceNetworkEvents. - name: object type: group fields: diff --git a/packages/m365_defender/data_stream/incident/_dev/test/pipeline/test-incident.log-expected.json b/packages/m365_defender/data_stream/incident/_dev/test/pipeline/test-incident.log-expected.json index d4d9c0db2bb..ca75afc9766 100644 --- a/packages/m365_defender/data_stream/incident/_dev/test/pipeline/test-incident.log-expected.json +++ b/packages/m365_defender/data_stream/incident/_dev/test/pipeline/test-incident.log-expected.json @@ -11,7 +11,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -327,7 +327,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -629,7 +629,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": [ @@ -787,11 +787,8 @@ "domain": [ "corp.example" ], - "email": [ - "user@example.com" - ], "id": [ - "f149b355-542f-4216-bce3-5347cf02a4aa" + "user@example.com" ], "name": [ "user" @@ -806,7 +803,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -997,7 +994,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1186,7 +1183,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2023-05-13T23:35:01.590Z", @@ -1197,11 +1194,6 @@ "severity": 2, "url": "https://security.microsoft.com/incidents/1922?tid=f65ad163-1b89-0000-b2a7-e70409495256" }, - "host": { - "ip": [ - "10.1.1.1" - ] - }, "m365_defender": { "incident": { "alert": { @@ -1277,6 +1269,11 @@ "10.1.1.1" ] }, + "source": { + "ip": [ + "10.1.1.1" + ] + }, "tags": [ "preserve_original_event", "preserve_duplicate_custom_fields" @@ -1297,7 +1294,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1493,7 +1490,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ @@ -1686,7 +1683,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": [ @@ -1949,11 +1946,8 @@ "domain": [ "corp.example" ], - "email": [ - "user3@example.com" - ], "id": [ - "6d4c2f48-1d1e-4c8f-8666-914b2085332c" + "user3@example.com" ], "name": [ "user3" @@ -1968,7 +1962,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": [ @@ -2119,11 +2113,8 @@ "domain": [ "corp.example" ], - "email": [ - "user4@example.com" - ], "id": [ - "12145719-f684-456e-b8ba-f2f7c67ada56" + "user4@example.com" ], "name": [ "user4" diff --git a/packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs b/packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs index 06c4d93a458..684fae227cc 100644 --- a/packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs +++ b/packages/m365_defender/data_stream/incident/agent/stream/httpjson.yml.hbs @@ -5,7 +5,7 @@ request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" {{/if}} auth.oauth2.client.id: {{client_id}} auth.oauth2.client.secret: {{client_secret}} -auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/oauth2/v2.0/token +auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/{{token_endpoint}} auth.oauth2.scopes: {{request_url}}/.default request.url: {{request_url}}/v1.0/security/incidents {{#if http_client_timeout}} diff --git a/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml b/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml index 98224bc104e..994e4673d1d 100644 --- a/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml +++ b/packages/m365_defender/data_stream/incident/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Incident logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -1413,7 +1413,7 @@ processors: ignore_failure: true processor: append: - field: host.ip + field: source.ip value: '{{{_ingest._value.ip_address}}}' allow_duplicates: false ignore_failure: true @@ -2098,9 +2098,8 @@ processors: ctx.user = new HashMap(); } def userDomain = new HashSet(); - def userId = new HashSet(); def userName = new HashSet(); - def userEmail = new HashSet(); + def userId = new HashSet(); if (!(ctx.process instanceof HashMap)) { ctx.process = new HashMap(); } @@ -2123,11 +2122,8 @@ processors: if (evidence?.user_account?.domain_name != null) { userDomain.add(evidence.user_account.domain_name); } - if (evidence?.user_account?.azure_ad_user_id != null) { - userId.add(evidence.user_account.azure_ad_user_id); - } if (evidence?.user_account?.user_principal_name != null) { - userEmail.add(evidence.user_account.user_principal_name); + userId.add(evidence.user_account.user_principal_name); } if (evidence?.user_account?.account_name != null) { userName.add(evidence.user_account.account_name); @@ -2158,14 +2154,11 @@ processors: if (!userDomain.isEmpty()) { ctx.user.domain = convertToOrderedArray(userDomain); } - if (!userId.isEmpty()) { - ctx.user.id = convertToOrderedArray(userId); - } if (!userName.isEmpty()) { ctx.user.name = convertToOrderedArray(userName); } - if (!userEmail.isEmpty()) { - ctx.user.email = convertToOrderedArray(userEmail); + if (!userId.isEmpty()) { + ctx.user.id = convertToOrderedArray(userId); } if (!processUserId.isEmpty()) { ctx.process.user.id = convertToOrderedArray(processUserId); @@ -2285,7 +2278,7 @@ processors: ignore_failure: true processor: remove: - field: + field: - _ingest._value.account_name ignore_missing: true - foreach: @@ -2348,6 +2341,9 @@ processors: } dropEmptyFields(ctx); on_failure: + - set: + field: event.kind + value: pipeline_error - append: field: error.message value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/m365_defender/data_stream/incident/fields/ecs.yml b/packages/m365_defender/data_stream/incident/fields/ecs.yml index daf6fea16a8..1652e216e7e 100644 --- a/packages/m365_defender/data_stream/incident/fields/ecs.yml +++ b/packages/m365_defender/data_stream/incident/fields/ecs.yml @@ -44,16 +44,6 @@ name: group.id - external: ecs name: group.name -- external: ecs - name: host.id -- external: ecs - name: host.ip -- external: ecs - name: host.name -- external: ecs - name: host.os.name -- external: ecs - name: host.os.version - external: ecs name: message - external: ecs @@ -94,6 +84,8 @@ name: related.ip - external: ecs name: related.user +- external: ecs + name: source.ip - external: ecs name: source.user.name - external: ecs @@ -106,8 +98,6 @@ name: threat.technique.subtechnique.id - external: ecs name: user.domain -- external: ecs - name: user.email - external: ecs name: user.id - external: ecs diff --git a/packages/m365_defender/data_stream/incident/manifest.yml b/packages/m365_defender/data_stream/incident/manifest.yml index f4cfa03b854..a99c797567d 100644 --- a/packages/m365_defender/data_stream/incident/manifest.yml +++ b/packages/m365_defender/data_stream/incident/manifest.yml @@ -17,7 +17,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the incidents from Microsoft 365 Defender. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the incidents from Microsoft 365 Defender. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -25,7 +25,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Microsoft Security Graph API V2. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Microsoft Security Graph API V2. Supported units for this parameter are h/m/s. default: 1m multi: false required: true @@ -41,7 +41,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/m365_defender/data_stream/incident/sample_event.json b/packages/m365_defender/data_stream/incident/sample_event.json index e785d55140c..ecb6c6039b0 100644 --- a/packages/m365_defender/data_stream/incident/sample_event.json +++ b/packages/m365_defender/data_stream/incident/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-09-30T09:35:45.113Z", "agent": { - "ephemeral_id": "f4a1fb8a-4b41-48ff-9e7d-618956a24d88", - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "ephemeral_id": "bfa54030-e0ce-4076-86d5-90314cd5425d", + "id": "b749ee7f-378d-45d8-8151-975dfa11ce57", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.2" }, "cloud": { "account": { @@ -21,12 +21,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "id": "b749ee7f-378d-45d8-8151-975dfa11ce57", "snapshot": false, - "version": "8.7.1" + "version": "8.8.2" }, "event": { "action": [ @@ -36,7 +36,7 @@ "created": "2021-08-13T08:43:35.553Z", "dataset": "m365_defender.incident", "id": "2972395", - "ingested": "2023-05-15T07:21:24Z", + "ingested": "2023-07-21T12:35:09Z", "kind": "alert", "original": "{\"@odata.type\":\"#microsoft.graph.security.incident\",\"alerts\":{\"@odata.type\":\"#microsoft.graph.security.alert\",\"actorDisplayName\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"assignedTo\":null,\"category\":\"DefenseEvasion\",\"classification\":\"unknown\",\"comments\":[],\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"description\":\"A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.\",\"detectionSource\":\"antivirus\",\"detectorId\":\"e0da400f-affd-43ef-b1d5-afc2eb6f2756\",\"determination\":\"unknown\",\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":null,\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"defenderAvStatus\":\"unknown\",\"deviceDnsName\":\"tempDns\",\"firstSeenDateTime\":\"2020-09-12T07:28:32.4321753Z\",\"healthStatus\":\"active\",\"loggedOnUsers\":[],\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22424,\"osPlatform\":\"Windows10\",\"rbacGroupId\":75,\"rbacGroupName\":\"UnassignedGroup\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"medium\",\"roles\":[\"compromised\"],\"tags\":[\"Test Machine\"],\"verdict\":\"unknown\",\"version\":\"Other\",\"vmMetadata\":{\"cloudProvider\":\"azure\",\"resourceId\":\"/subscriptions/8700d3a3-3bb7-4fbe-a090-488a1ad04161/resourceGroups/WdatpApi-EUS-STG/providers/Microsoft.Compute/virtualMachines/NirLaviTests\",\"subscriptionId\":\"8700d3a3-3bb7-4fbe-a090-488a1ad04161\",\"vmId\":\"ca1b0d41-5a3b-4d95-b48b-f220aed11d78\"}},{\"@odata.type\":\"#microsoft.graph.security.fileEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"fileDetails\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"parentProcessCreationDateTime\":\"2021-08-12T07:39:09.0909239Z\",\"parentProcessId\":668,\"parentProcessImageFile\":{\"fileName\":\"services.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":731744,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"\\\"MsSense.exe\\\"\",\"processCreationDateTime\":\"2021-08-12T12:43:19.0772577Z\",\"processId\":4780,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"SYSTEM\",\"azureAdUserId\":null,\"domainName\":\"NT AUTHORITY\",\"userPrincipalName\":null,\"userSid\":\"S-1-5-18\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.registryKeyEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"registryHive\":\"HKEY_LOCAL_MACHINE\",\"registryKey\":\"SYSTEM\\\\CONTROLSET001\\\\CONTROL\\\\WMI\\\\AUTOLOGGER\\\\SENSEAUDITLOGGER\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2021-04-26T07:45:50.116Z\",\"id\":\"da637551227677560813_-961444813\",\"incidentId\":\"28282\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"lastActivityDateTime\":\"2021-05-02T07:56:58.222Z\",\"lastUpdateDateTime\":\"2021-05-02T14:19:01.3266667Z\",\"mitreTechniques\":[\"T1564.001\"],\"providerAlertId\":\"da637551227677560813_-961444813\",\"recommendedActions\":\"Collect artifacts and determine scope\\n�\\tReview the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) \\n�\\tLook for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.\\n�\\tSubmit relevant files for deep analysis and review resulting detailed behavioral information.\\n�\\tSubmit undetected files to the MMPC malware portal\\n\\nInitiate containment \\u0026 mitigation \\n�\\tContact the user to verify intent and initiate local remediation actions as needed.\\n�\\tUpdate AV signatures and run a full scan. The scan might reveal and remove previously-undetected malware components.\\n�\\tEnsure that the machine has the latest security updates. In particular, ensure that you have installed the latest software, web browser, and Operating System versions.\\n�\\tIf credential theft is suspected, reset all relevant users passwords.\\n�\\tBlock communication with relevant URLs or IPs at the organization�s perimeter.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"low\",\"status\":\"new\",\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious execution of hidden file\"},\"assignedTo\":\"KaiC@contoso.onmicrosoft.com\",\"classification\":\"truePositive\",\"comments\":[{\"comment\":\"Demo incident\",\"createdBy\":\"DavidS@contoso.onmicrosoft.com\",\"createdTime\":\"2021-09-30T12:07:37.2756993Z\"}],\"createdDateTime\":\"2021-08-13T08:43:35.5533333Z\",\"determination\":\"multiStagedAttack\",\"displayName\":\"Multi-stage incident involving Initial access \\u0026 Command and control on multiple endpoints reported by multiple sources\",\"id\":\"2972395\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47\",\"lastUpdateDateTime\":\"2021-09-30T09:35:45.1133333Z\",\"redirectIncidentId\":null,\"severity\":\"medium\",\"status\":\"active\",\"tags\":[\"Demo\"],\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\"}", "provider": "microsoftDefenderForEndpoint", diff --git a/packages/m365_defender/data_stream/log/_dev/test/pipeline/test-m365-defender-ndjson.log-expected.json b/packages/m365_defender/data_stream/log/_dev/test/pipeline/test-m365-defender-ndjson.log-expected.json index ab279506428..d12a52fa25d 100644 --- a/packages/m365_defender/data_stream/log/_dev/test/pipeline/test-m365-defender-ndjson.log-expected.json +++ b/packages/m365_defender/data_stream/log/_dev/test/pipeline/test-m365-defender-ndjson.log-expected.json @@ -6,7 +6,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -127,7 +127,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -234,7 +234,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -342,7 +342,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -442,7 +442,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -543,7 +543,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -561,7 +561,6 @@ "start": "2020-06-30T10:09:10.8889583Z", "timezone": "UTC", "type": [ - "user", "end" ] }, @@ -640,7 +639,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -741,7 +740,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -757,7 +756,10 @@ "provider": "MicrosoftCloudAppSecurity", "severity": 3, "start": "2020-07-27T15:47:22.088Z", - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "info" + ] }, "m365_defender": { "alerts": { @@ -814,7 +816,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -832,7 +834,7 @@ "start": "2020-07-27T15:47:22.088Z", "timezone": "UTC", "type": [ - "user" + "info" ] }, "m365_defender": { @@ -894,7 +896,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SuspiciousActivity", @@ -910,7 +912,10 @@ "provider": "Microsoft365Defender", "severity": 4, "start": "2022-04-19T10:28:20.2406169Z", - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "info" + ] }, "file": { "hash": { @@ -987,7 +992,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "InitialAccess", @@ -1003,7 +1008,10 @@ "provider": "MicrosoftDefenderForOffice365", "severity": 1, "start": "2022-12-12T01:45:00Z", - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "info" + ] }, "m365_defender": { "alerts": { diff --git a/packages/m365_defender/data_stream/log/_dev/test/system/test-httpjson-config.yml b/packages/m365_defender/data_stream/log/_dev/test/system/test-httpjson-config.yml index 85357fc8cec..fb8b162ea48 100644 --- a/packages/m365_defender/data_stream/log/_dev/test/system/test-httpjson-config.yml +++ b/packages/m365_defender/data_stream/log/_dev/test/system/test-httpjson-config.yml @@ -10,3 +10,5 @@ data_stream: request_url: http://{{Hostname}}:{{Port}} preserve_original_event: true enable_request_tracer: true +assert: + hit_count: 11 diff --git a/packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs b/packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs index 1cea39621c1..cd47db30d8e 100644 --- a/packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs +++ b/packages/m365_defender/data_stream/log/agent/stream/httpjson.yml.hbs @@ -5,7 +5,7 @@ request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" {{/if}} auth.oauth2.client.id: {{client_id}} auth.oauth2.client.secret: {{client_secret}} -auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/oauth2/v2.0/token +auth.oauth2.token_url: {{login_url}}/{{tenant_id}}/{{token_endpoint}} auth.oauth2.scopes: - "{{request_url}}/.default" request.url: {{request_url}}/api/incidents diff --git a/packages/m365_defender/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/m365_defender/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 11ffd9bec46..9717a70175c 100644 --- a/packages/m365_defender/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/m365_defender/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing m365 defender logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -26,10 +26,10 @@ processors: if: "ctx.json?.alerts?.entities == null || ctx.json?.alerts?.entities instanceof List" - fingerprint: fields: + - json.incidentId - json.alerts.alertId - json.alerts.creationTime - - json.alerts.entities.deviceId - - json.alerts.entities.evidenceCreationTime + - json.alerts.entities target_field: _id ignore_missing: true - date: @@ -47,7 +47,7 @@ processors: value: azure - set: field: "@timestamp" - value: "{{json.lastUpdateTime}}" + value: "{{{json.lastUpdateTime}}}" if: ctx.json?.lastUpdateTime != null - rename: field: json.alerts.title @@ -95,17 +95,19 @@ processors: - append: field: event.type value: user - if: ctx.json?.alerts?.entities?.entityType == 'User' + if: ctx.json?.alerts?.entities?.entityType == 'User' && ctx.event?.category != null && ctx.event.category.contains('process') - append: field: event.type - value: - - creation - - start - if: ctx.json?.status == 'New' + value: start + if: ctx.json?.status == 'New' && ctx.event?.category != null && !ctx.event.category.contains('malware') - append: field: event.type value: end - if: ctx.json?.status == 'Resolved' + if: ctx.json?.status == 'Resolved' && ctx.event?.category != null && !ctx.event.category.contains('malware') + - append: + field: event.type + value: info + if: ctx.event?.category != null && ctx.event?.type == null - rename: field: json.alerts.alertId target_field: event.id @@ -255,19 +257,19 @@ processors: ######################### - append: field: related.ip - value: "{{json.alerts.entities.ipAddress}}" + value: "{{{json.alerts.entities.ipAddress}}}" if: ctx.json?.alerts?.entities?.ipAddress != null - append: field: related.user - value: "{{user.name}}" + value: "{{{user.name}}}" if: ctx.user?.name != null - append: field: related.hash - value: "{{file.hash.sha1}}" + value: "{{{file.hash.sha1}}}" if: ctx.file?.hash?.sha1 != null - append: field: related.hash - value: "{{file.hash.sha256}}" + value: "{{{file.hash.sha256}}}" if: ctx.file?.hash?.sha256 != null - foreach: field: json.alerts.devices @@ -275,7 +277,7 @@ processors: processor: append: field: related.hosts - value: "{{ _ingest._value.deviceDnsName }}" + value: "{{{ _ingest._value.deviceDnsName }}}" allow_duplicates: false ignore_failure: true - foreach: @@ -284,7 +286,7 @@ processors: processor: append: field: host.name - value: "{{ _ingest._value.deviceDnsName }}" + value: "{{{ _ingest._value.deviceDnsName }}}" allow_duplicates: false ignore_failure: true - lowercase: @@ -368,5 +370,8 @@ processors: ignore_missing: true on_failure: - set: + field: event.kind + value: pipeline_error + - append: field: error.message - value: "{{_ingest.on_failure_message}}" + value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/m365_defender/data_stream/log/fields/ecs.yml b/packages/m365_defender/data_stream/log/fields/ecs.yml index f74ac0e933b..103c84ac3c7 100644 --- a/packages/m365_defender/data_stream/log/fields/ecs.yml +++ b/packages/m365_defender/data_stream/log/fields/ecs.yml @@ -36,8 +36,6 @@ name: file.hash.sha1 - external: ecs name: file.path -- external: ecs - name: host.name - external: ecs name: process.pid - external: ecs diff --git a/packages/m365_defender/data_stream/log/manifest.yml b/packages/m365_defender/data_stream/log/manifest.yml index b305f6f6ef6..d9da6e01f83 100644 --- a/packages/m365_defender/data_stream/log/manifest.yml +++ b/packages/m365_defender/data_stream/log/manifest.yml @@ -13,7 +13,7 @@ streams: required: true show_user: true default: 5m - description: The interval between requests to the HTTP API. + description: The interval between requests to the HTTP API. Supported units for this parameter are h/m/s. - name: initial_interval type: text title: Initial Interval @@ -21,7 +21,7 @@ streams: required: true show_user: true default: 168h - description: How far back in time to look for alerts the first time running. Default is 1 week. + description: How far back in time to look for alerts the first time running. Default is 1 week. Supported units for this parameter are h/m/s. - name: request_url type: text title: API URL Endpoint diff --git a/packages/m365_defender/data_stream/log/sample_event.json b/packages/m365_defender/data_stream/log/sample_event.json index da57df1ada2..0e7d176d8f5 100644 --- a/packages/m365_defender/data_stream/log/sample_event.json +++ b/packages/m365_defender/data_stream/log/sample_event.json @@ -1,8 +1,8 @@ { "@timestamp": "2020-09-06T12:07:55.32Z", "agent": { - "ephemeral_id": "b1be6d20-78c1-402f-8e47-f116f78026a6", - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "ephemeral_id": "538b61a2-ee8e-4f0f-92b3-874bb25bd07c", + "id": "761cded5-abcb-4ec8-a5e6-f7546489e271", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.7.1" @@ -16,10 +16,10 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "id": "761cded5-abcb-4ec8-a5e6-f7546489e271", "snapshot": false, "version": "8.7.1" }, @@ -34,13 +34,16 @@ "duration": 0, "end": "2020-09-06T12:04:00Z", "id": "faf8edc936-85f8-a603-b800-08d8525cf099", - "ingested": "2023-05-15T07:21:59Z", + "ingested": "2023-08-08T07:59:58Z", "kind": "alert", "original": "{\"alerts\":{\"actorName\":null,\"alertId\":\"faf8edc936-85f8-a603-b800-08d8525cf099\",\"assignedTo\":\"Automation\",\"category\":\"InitialAccess\",\"classification\":null,\"creationTime\":\"2020-09-06T12:07:54.3716642Z\",\"description\":\"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.2\",\"detectionSource\":\"OfficeATP\",\"determination\":null,\"devices\":[],\"entities\":{\"aadUserId\":null,\"accountName\":null,\"clusterBy\":null,\"deliveryAction\":null,\"deviceId\":null,\"domainName\":null,\"entityType\":\"MailBox\",\"fileName\":null,\"filePath\":null,\"ipAddress\":null,\"mailboxAddress\":\"testUser3@contoso.com\",\"mailboxDisplayName\":\"test User3\",\"parentProcessCreationTime\":null,\"parentProcessId\":null,\"processCommandLine\":null,\"processCreationTime\":null,\"processId\":null,\"recipient\":null,\"registryHive\":null,\"registryKey\":null,\"registryValue\":null,\"registryValueType\":null,\"securityGroupId\":null,\"securityGroupName\":null,\"sender\":null,\"sha1\":null,\"sha256\":null,\"subject\":null,\"url\":null,\"userPrincipalName\":\"testUser3@contoso.com\",\"userSid\":null},\"firstActivity\":\"2020-09-06T12:04:00Z\",\"incidentId\":924518,\"investigationId\":null,\"investigationState\":\"Queued\",\"lastActivity\":\"2020-09-06T12:04:00Z\",\"lastUpdatedTime\":\"2020-09-06T12:37:40.88Z\",\"mitreTechniques\":[],\"resolvedTime\":null,\"serviceSource\":\"OfficeATP\",\"severity\":\"Informational\",\"status\":\"InProgress\",\"threatFamilyName\":null,\"title\":\"Email reported by user as malware or phish\"},\"assignedTo\":null,\"classification\":\"Unknown\",\"comments\":[],\"createdTime\":\"2020-09-06T12:07:55.1366667Z\",\"determination\":\"NotAvailable\",\"incidentId\":924518,\"incidentName\":\"Email reported by user as malware or phish\",\"lastUpdateTime\":\"2020-09-06T12:07:55.32Z\",\"redirectIncidentId\":null,\"severity\":\"Informational\",\"status\":\"Active\",\"tags\":[]}", "provider": "OfficeATP", "severity": 1, "start": "2020-09-06T12:04:00Z", - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "info" + ] }, "file": { "hash": {} diff --git a/packages/m365_defender/docs/README.md b/packages/m365_defender/docs/README.md index dca4753f8eb..9f441176606 100644 --- a/packages/m365_defender/docs/README.md +++ b/packages/m365_defender/docs/README.md @@ -103,21 +103,36 @@ This is the `event` dataset. | destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.port | Port of the destination. | long | +| dll.hash.md5 | MD5 hash. | keyword | +| dll.hash.sha1 | SHA1 hash. | keyword | +| dll.hash.sha256 | SHA256 hash. | keyword | +| dll.name | Name of the library. This generally maps to the name of the file on disk. | keyword | +| dll.path | Full file path of the library. | keyword | +| dll.pe.sections.physical_size | PE Section List physical size. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | email.direction | The direction of the message based on the sending and receiving domains. | keyword | | email.from.address | The email address of the sender, typically from the RFC 5322 `From:` header field. | keyword | | email.local_id | Unique identifier given to the email by the source that created the event. Identifier is not persistent across hops. | keyword | +| email.message_id | Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. | wildcard | | email.subject | A brief summary of the topic of the message. | keyword | | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.code_signature.exists | Boolean to capture if a signature is present. | boolean | +| file.code_signature.subject_name | Subject name of the code signer | keyword | +| file.code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | boolean | | file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | | file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | | file.hash.md5 | MD5 hash. | keyword | @@ -125,6 +140,7 @@ This is the `event` dataset. | file.hash.sha256 | SHA256 hash. | keyword | | file.name | Name of the file including the extension, without the directory. | keyword | | file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| file.x509.issuer.common_name | List of common name (CN) of issuing certificate authority. | keyword | | file.x509.not_after | Time at which the certificate is no longer considered valid. | date | | file.x509.serial_number | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -134,13 +150,15 @@ This is the `event` dataset. | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | host.ip | Host ip addresses. | ip | | host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | host.os.build | OS build information. | keyword | | host.os.codename | OS codename, if any. | keyword | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.full | Operating system name, including the version or code name. | keyword | +| host.os.full.text | Multi-field of `host.os.full`. | match_only_text | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.name.text | Multi-field of `host.os.name`. | text | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | @@ -159,6 +177,7 @@ This is the `event` dataset. | m365_defender.event.action.trigger | Indicates whether an action was triggered by an administrator (manually or through approval of a pending automated action), or by some special mechanism, such as a ZAP or Dynamic Delivery. | keyword | | m365_defender.event.action.type | Type of activity that triggered the event. See the [in-portal schema reference](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-schema-tables?view=o365-worldwide#get-schema-information-in-the-security-center) for details. | keyword | | m365_defender.event.action.value | Action taken on the entity. | keyword | +| m365_defender.event.active_users | An array of all users that are logged on the machine at the time of the event. | keyword | | m365_defender.event.activity.objects | List of objects, such as files or folders, that were involved in the recorded activity. | flattened | | m365_defender.event.activity.type | Type of activity that triggered the event. | keyword | | m365_defender.event.additional_fields | Additional information about the entity or event in JSON array format. | flattened | @@ -169,6 +188,7 @@ This is the `event` dataset. | m365_defender.event.app_instance_id | | long | | m365_defender.event.application | Application that performed the recorded action. | keyword | | m365_defender.event.application_id | Unique identifier for the application. | keyword | +| m365_defender.event.asset_value | Indicates the value of a device as assigned by the user. | keyword | | m365_defender.event.attachment_count | Number of attachments in the email. | long | | m365_defender.event.attack_techniques | MITRE ATT&CK techniques associated with the activity that triggered the alert. | keyword | | m365_defender.event.authentication_details | List of pass or fail verdicts by email authentication protocols like DMARC, DKIM, SPF or a combination of multiple authentication types (CompAuth). | keyword | @@ -198,6 +218,8 @@ This is the `event` dataset. | m365_defender.event.device.name | Fully qualified domain name (FQDN) of the device, machine or endpoint. | keyword | | m365_defender.event.device.sub_type | Additional modifier for certain types of devices, for example, a mobile device can be a tablet or a smartphone; only available if device discovery finds enough information about this attribute. | keyword | | m365_defender.event.device.type | Type of device based on purpose and functionality, such as network device, workstation, server, mobile, gaming console, or printer. | keyword | +| m365_defender.event.device_dynamic_tags | Device tags assigned automatically using dynamic tagging rules. | keyword | +| m365_defender.event.device_manual_tags | Device tags created manually using the portal UI or public API. | keyword | | m365_defender.event.dns_addresses | DNS server addresses in JSON array format. | keyword | | m365_defender.event.email.action | Final action taken on the email based on filter verdict, policies, and user actions: Move message to junk mail folder, Add X-header, Modify subject, Redirect message, Delete message, send to quarantine, No action taken, Bcc message. | keyword | | m365_defender.event.email.action_policy | Action policy that took effect: Antispam high-confidence, Antispam, Antispam bulk mail, Antispam phishing, Anti-phishing domain impersonation, Anti-phishing user impersonation, Anti-phishing spoof, Anti-phishing graph impersonation, Antimalware, Safe Attachments, Enterprise Transport Rules (ETR). | keyword | @@ -209,6 +231,8 @@ This is the `event` dataset. | m365_defender.event.entity_type | Type of object, such as a file, a process, a device, or a user. | keyword | | m365_defender.event.evidence.direction | Indicates whether the entity is the source or the destination of a network connection. | keyword | | m365_defender.event.evidence.role | How the entity is involved in an alert, indicating whether it is impacted or is merely related. | keyword | +| m365_defender.event.exclusion_reason | Indicates the reason for device exclusion. | keyword | +| m365_defender.event.exposure_level | Indicates the exposure level of a device. | keyword | | m365_defender.event.failure_reason | Information explaining why the recorded action failed. | keyword | | m365_defender.event.file.name | Name of the file that the recorded action was applied to. | keyword | | m365_defender.event.file.origin_ip | IP address where the file was downloaded from. | ip | @@ -257,8 +281,10 @@ This is the `event` dataset. | m365_defender.event.is_azure_ad_joined | Boolean indicator of whether machine is joined to the Azure Active Directory. | boolean | | m365_defender.event.is_azure_info_protection_applied | Indicates whether the file is encrypted by Azure Information Protection. | boolean | | m365_defender.event.is_clicked_through | Indicates whether the user was able to click through to the original URL or was not allowed. | boolean | +| m365_defender.event.is_excluded | Determines if the device is currently excluded from Microsoft Defender for Vulnerability Management experiences. | boolean | | m365_defender.event.is_external_user | Indicates whether a user inside the network doesn't belong to the organization's domain. | boolean | | m365_defender.event.is_impersonated | Indicates whether the activity was performed by one user for another (impersonated) user. | boolean | +| m365_defender.event.is_internet_facing | Indicates whether the device is internet-facing. | boolean | | m365_defender.event.is_local_admin | Boolean indicator of whether the user is a local administrator on the machine. | boolean | | m365_defender.event.is_root_signer_microsoft | Indicates whether the signer of the root certificate is Microsoft and if the file is included in Windows operating system. | boolean | | m365_defender.event.is_signed | Indicates whether the file is signed. | boolean | @@ -271,7 +297,6 @@ This is the `event` dataset. | m365_defender.event.local.ip_type | Type of IP address, for example Public, Private, Reserved, Loopback, Teredo, FourToSixMapping, and Broadcast. | keyword | | m365_defender.event.local.port | TCP port on the local machine used during communication. | long | | m365_defender.event.location | City, country, or other geographic location associated with the event. | keyword | -| m365_defender.event.logged_on_users | List of all users that are logged on the machine at the time of the event in JSON array format. | flattened | | m365_defender.event.logon.id | Identifier for a logon session. This identifier is unique on the same machine only between restarts. | keyword | | m365_defender.event.logon.type | Type of logon session, specifically: Interactive, Remote interactive (RDP) logons, Network, Batch, Service. | keyword | | m365_defender.event.mac_address | MAC address of the network adapter. | keyword | @@ -285,6 +310,7 @@ This is the `event` dataset. | m365_defender.event.network.adapter_type | Network adapter type. For the possible values, refer to this enumeration. | keyword | | m365_defender.event.network.adapter_vendor | | keyword | | m365_defender.event.network.message_id | Unique identifier for the email, generated by Microsoft 365. | keyword | +| m365_defender.event.network_direction | The network direction used in DeviceNetworkEvents. | keyword | | m365_defender.event.oauth_application_id | | keyword | | m365_defender.event.object.id | Unique identifier of the object that the recorded action was applied to. | keyword | | m365_defender.event.object.name | Name of the object that the recorded action was applied to. | keyword | @@ -358,6 +384,7 @@ This is the `event` dataset. | m365_defender.event.sender.object_id | Unique identifier for the sender's account in Azure AD. | keyword | | m365_defender.event.sensitivity.label | Label applied to an email, file, or other content to classify it for information protection. | keyword | | m365_defender.event.sensitivity.sub_label | Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently. | keyword | +| m365_defender.event.sensor_health_state | Indicates health of the device's EDR sensor, if onboarded to Microsoft Defender For Endpoint. | keyword | | m365_defender.event.service_source | Product or service that provided the alert information. | keyword | | m365_defender.event.severity | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert. | keyword | | m365_defender.event.sha1 | SHA-1 of the file that the recorded action was applied to. | keyword | @@ -395,19 +422,57 @@ This is the `event` dataset. | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | | observer.version | Observer version. | keyword | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | | process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | | process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | | process.hash.md5 | MD5 hash. | keyword | | process.hash.sha1 | SHA1 hash. | keyword | | process.hash.sha256 | SHA256 hash. | keyword | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.parent.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.parent.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.parent.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword | +| process.parent.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.parent.command_line.text | Multi-field of `process.parent.command_line`. | match_only_text | +| process.parent.executable | Absolute path to the process executable. | keyword | +| process.parent.executable.text | Multi-field of `process.parent.executable`. | match_only_text | +| process.parent.group_leader.name | | keyword | +| process.parent.group_leader.pid | Process id. | long | +| process.parent.group_leader.start | The time the process started. | date | +| process.parent.hash.md5 | MD5 hash. | keyword | +| process.parent.hash.sha1 | SHA1 hash. | keyword | +| process.parent.hash.sha256 | SHA256 hash. | keyword | +| process.parent.name | Process name. Sometimes called program name or similar. | keyword | +| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | +| process.parent.pe.company | Internal company name of the file, provided at compile-time. | keyword | +| process.parent.pe.description | Internal description of the file, provided at compile-time. | keyword | +| process.parent.pe.file_version | Internal version of the file, provided at compile-time. | keyword | +| process.parent.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | +| process.parent.pe.product | Internal product name of the file, provided at compile-time. | keyword | +| process.parent.pe.sections.physical_size | PE Section List physical size. | long | | process.parent.pid | Process id. | long | +| process.parent.start | The time the process started. | date | +| process.pe.company | Internal company name of the file, provided at compile-time. | keyword | +| process.pe.description | Internal description of the file, provided at compile-time. | keyword | +| process.pe.file_version | Internal version of the file, provided at compile-time. | keyword | +| process.pe.original_file_name | Internal name of the file, provided at compile-time. | keyword | +| process.pe.product | Internal product name of the file, provided at compile-time. | keyword | +| process.pe.sections.physical_size | PE Section List physical size. | long | | process.pid | Process id. | long | +| process.start | The time the process started. | date | +| registry.data.strings | Content when writing string types. Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | wildcard | | registry.key | Hive-relative path of keys. | keyword | | registry.value | Name of the value written. | keyword | | related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | | related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | | source.geo.country_iso_code | Country ISO code. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | @@ -417,13 +482,16 @@ This is the `event` dataset. | source.user.name | Short name or login of the user. | keyword | | source.user.name.text | Multi-field of `source.user.name`. | match_only_text | | tags | List of keywords used to tag each event. | keyword | -| threat.enrichments.indicator.file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| threat.enrichments.indicator.file.hash.sha1 | SHA1 hash. | keyword | -| threat.enrichments.indicator.file.hash.sha256 | SHA256 hash. | keyword | -| threat.enrichments.indicator.file.name | Name of the file including the extension, without the directory. | keyword | -| threat.enrichments.indicator.file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| threat.enrichments.indicator.type | Type of indicator as represented by Cyber Observable in STIX 2.0. | keyword | | threat.group.name | The name of the group for a set of related intrusion activity that are tracked by a common name in the security community. While not required, you can use a MITRE ATT&CK® group name. | keyword | +| threat.indicator.file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| threat.indicator.file.hash.sha1 | SHA1 hash. | keyword | +| threat.indicator.file.hash.sha256 | SHA256 hash. | keyword | +| threat.indicator.file.name | Name of the file including the extension, without the directory. | keyword | +| threat.indicator.file.size | File size in bytes. Only relevant when `file.type` is "file". | long | +| threat.indicator.registry.data.strings | Content when writing string types. Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | wildcard | +| threat.indicator.registry.key | Hive-relative path of keys. | keyword | +| threat.indicator.registry.value | Name of the value written. | keyword | +| threat.indicator.type | Type of indicator as represented by Cyber Observable in STIX 2.0. | keyword | | threat.technique.subtechnique.id | The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | keyword | | threat.technique.subtechnique.name | The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | keyword | | threat.technique.subtechnique.name.text | Multi-field of `threat.technique.subtechnique.name`. | match_only_text | @@ -467,11 +535,11 @@ An example event for `incident` looks as following: { "@timestamp": "2021-09-30T09:35:45.113Z", "agent": { - "ephemeral_id": "f4a1fb8a-4b41-48ff-9e7d-618956a24d88", - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "ephemeral_id": "bfa54030-e0ce-4076-86d5-90314cd5425d", + "id": "b749ee7f-378d-45d8-8151-975dfa11ce57", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.2" }, "cloud": { "account": { @@ -487,12 +555,12 @@ An example event for `incident` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "id": "b749ee7f-378d-45d8-8151-975dfa11ce57", "snapshot": false, - "version": "8.7.1" + "version": "8.8.2" }, "event": { "action": [ @@ -502,7 +570,7 @@ An example event for `incident` looks as following: "created": "2021-08-13T08:43:35.553Z", "dataset": "m365_defender.incident", "id": "2972395", - "ingested": "2023-05-15T07:21:24Z", + "ingested": "2023-07-21T12:35:09Z", "kind": "alert", "original": "{\"@odata.type\":\"#microsoft.graph.security.incident\",\"alerts\":{\"@odata.type\":\"#microsoft.graph.security.alert\",\"actorDisplayName\":null,\"alertWebUrl\":\"https://security.microsoft.com/alerts/da637551227677560813_-961444813?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"assignedTo\":null,\"category\":\"DefenseEvasion\",\"classification\":\"unknown\",\"comments\":[],\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"description\":\"A hidden file has been launched. This activity could indicate a compromised host. Attackers often hide files associated with malicious tools to evade file system inspection and defenses.\",\"detectionSource\":\"antivirus\",\"detectorId\":\"e0da400f-affd-43ef-b1d5-afc2eb6f2756\",\"determination\":\"unknown\",\"evidence\":[{\"@odata.type\":\"#microsoft.graph.security.deviceEvidence\",\"azureAdDeviceId\":null,\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"defenderAvStatus\":\"unknown\",\"deviceDnsName\":\"tempDns\",\"firstSeenDateTime\":\"2020-09-12T07:28:32.4321753Z\",\"healthStatus\":\"active\",\"loggedOnUsers\":[],\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"onboardingStatus\":\"onboarded\",\"osBuild\":22424,\"osPlatform\":\"Windows10\",\"rbacGroupId\":75,\"rbacGroupName\":\"UnassignedGroup\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"riskScore\":\"medium\",\"roles\":[\"compromised\"],\"tags\":[\"Test Machine\"],\"verdict\":\"unknown\",\"version\":\"Other\",\"vmMetadata\":{\"cloudProvider\":\"azure\",\"resourceId\":\"/subscriptions/8700d3a3-3bb7-4fbe-a090-488a1ad04161/resourceGroups/WdatpApi-EUS-STG/providers/Microsoft.Compute/virtualMachines/NirLaviTests\",\"subscriptionId\":\"8700d3a3-3bb7-4fbe-a090-488a1ad04161\",\"vmId\":\"ca1b0d41-5a3b-4d95-b48b-f220aed11d78\"}},{\"@odata.type\":\"#microsoft.graph.security.fileEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"fileDetails\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.processEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"detectionStatus\":\"detected\",\"imageFile\":{\"fileName\":\"MsSense.exe\",\"filePath\":\"C:\\\\Program Files\\\\temp\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":6136392,\"issuer\":null,\"sha1\":\"5f1e8acedc065031aad553b710838eb366cfee9a\",\"sha256\":\"8963a19fb992ad9a76576c5638fd68292cffb9aaac29eb8285f9abf6196a7dec\",\"signer\":null},\"mdeDeviceId\":\"73e7e2de709dff64ef64b1d0c30e67fab63279db\",\"parentProcessCreationDateTime\":\"2021-08-12T07:39:09.0909239Z\",\"parentProcessId\":668,\"parentProcessImageFile\":{\"fileName\":\"services.exe\",\"filePath\":\"C:\\\\Windows\\\\System32\",\"filePublisher\":\"Microsoft Corporation\",\"fileSize\":731744,\"issuer\":null,\"sha1\":null,\"sha256\":null,\"signer\":null},\"processCommandLine\":\"\\\"MsSense.exe\\\"\",\"processCreationDateTime\":\"2021-08-12T12:43:19.0772577Z\",\"processId\":4780,\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"userAccount\":{\"accountName\":\"SYSTEM\",\"azureAdUserId\":null,\"domainName\":\"NT AUTHORITY\",\"userPrincipalName\":null,\"userSid\":\"S-1-5-18\"},\"verdict\":\"unknown\"},{\"@odata.type\":\"#microsoft.graph.security.registryKeyEvidence\",\"createdDateTime\":\"2021-04-27T12:19:27.7211305Z\",\"registryHive\":\"HKEY_LOCAL_MACHINE\",\"registryKey\":\"SYSTEM\\\\CONTROLSET001\\\\CONTROL\\\\WMI\\\\AUTOLOGGER\\\\SENSEAUDITLOGGER\",\"remediationStatus\":\"none\",\"remediationStatusDetails\":null,\"roles\":[],\"tags\":[],\"verdict\":\"unknown\"}],\"firstActivityDateTime\":\"2021-04-26T07:45:50.116Z\",\"id\":\"da637551227677560813_-961444813\",\"incidentId\":\"28282\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/28282?tid=b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"lastActivityDateTime\":\"2021-05-02T07:56:58.222Z\",\"lastUpdateDateTime\":\"2021-05-02T14:19:01.3266667Z\",\"mitreTechniques\":[\"T1564.001\"],\"providerAlertId\":\"da637551227677560813_-961444813\",\"recommendedActions\":\"Collect artifacts and determine scope\\n�\\tReview the machine timeline for suspicious activities that may have occurred before and after the time of the alert, and record additional related artifacts (files, IPs/URLs) \\n�\\tLook for the presence of relevant artifacts on other systems. Identify commonalities and differences between potentially compromised systems.\\n�\\tSubmit relevant files for deep analysis and review resulting detailed behavioral information.\\n�\\tSubmit undetected files to the MMPC malware portal\\n\\nInitiate containment \\u0026 mitigation \\n�\\tContact the user to verify intent and initiate local remediation actions as needed.\\n�\\tUpdate AV signatures and run a full scan. The scan might reveal and remove previously-undetected malware components.\\n�\\tEnsure that the machine has the latest security updates. In particular, ensure that you have installed the latest software, web browser, and Operating System versions.\\n�\\tIf credential theft is suspected, reset all relevant users passwords.\\n�\\tBlock communication with relevant URLs or IPs at the organization�s perimeter.\",\"resolvedDateTime\":null,\"serviceSource\":\"microsoftDefenderForEndpoint\",\"severity\":\"low\",\"status\":\"new\",\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\",\"threatDisplayName\":null,\"threatFamilyName\":null,\"title\":\"Suspicious execution of hidden file\"},\"assignedTo\":\"KaiC@contoso.onmicrosoft.com\",\"classification\":\"truePositive\",\"comments\":[{\"comment\":\"Demo incident\",\"createdBy\":\"DavidS@contoso.onmicrosoft.com\",\"createdTime\":\"2021-09-30T12:07:37.2756993Z\"}],\"createdDateTime\":\"2021-08-13T08:43:35.5533333Z\",\"determination\":\"multiStagedAttack\",\"displayName\":\"Multi-stage incident involving Initial access \\u0026 Command and control on multiple endpoints reported by multiple sources\",\"id\":\"2972395\",\"incidentWebUrl\":\"https://security.microsoft.com/incidents/2972395?tid=12f988bf-16f1-11af-11ab-1d7cd011db47\",\"lastUpdateDateTime\":\"2021-09-30T09:35:45.1133333Z\",\"redirectIncidentId\":null,\"severity\":\"medium\",\"status\":\"active\",\"tags\":[\"Demo\"],\"tenantId\":\"b3c1b5fc-828c-45fa-a1e1-10d74f6d6e9c\"}", "provider": "microsoftDefenderForEndpoint", @@ -826,10 +894,10 @@ An example event for `incident` looks as following: | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -857,7 +925,7 @@ An example event for `incident` looks as following: | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | +| host.os.name.text | Multi-field of `host.os.name`. | text | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | @@ -1070,6 +1138,7 @@ An example event for `incident` looks as following: | related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.user.name | Short name or login of the user. | keyword | | source.user.name.text | Multi-field of `source.user.name`. | match_only_text | | tags | List of keywords used to tag each event. | keyword | @@ -1077,7 +1146,6 @@ An example event for `incident` looks as following: | threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | | threat.technique.subtechnique.id | The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | keyword | | user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.email | User email address. | keyword | | user.id | Unique identifier of the user. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -1095,8 +1163,8 @@ An example event for `log` looks as following: { "@timestamp": "2020-09-06T12:07:55.32Z", "agent": { - "ephemeral_id": "b1be6d20-78c1-402f-8e47-f116f78026a6", - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "ephemeral_id": "538b61a2-ee8e-4f0f-92b3-874bb25bd07c", + "id": "761cded5-abcb-4ec8-a5e6-f7546489e271", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.7.1" @@ -1110,10 +1178,10 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c36c87f4-60cc-47be-bdde-f160ddd0462c", + "id": "761cded5-abcb-4ec8-a5e6-f7546489e271", "snapshot": false, "version": "8.7.1" }, @@ -1128,13 +1196,16 @@ An example event for `log` looks as following: "duration": 0, "end": "2020-09-06T12:04:00Z", "id": "faf8edc936-85f8-a603-b800-08d8525cf099", - "ingested": "2023-05-15T07:21:59Z", + "ingested": "2023-08-08T07:59:58Z", "kind": "alert", "original": "{\"alerts\":{\"actorName\":null,\"alertId\":\"faf8edc936-85f8-a603-b800-08d8525cf099\",\"assignedTo\":\"Automation\",\"category\":\"InitialAccess\",\"classification\":null,\"creationTime\":\"2020-09-06T12:07:54.3716642Z\",\"description\":\"This alert is triggered when any email message is reported as malware or phish by users -V1.0.0.2\",\"detectionSource\":\"OfficeATP\",\"determination\":null,\"devices\":[],\"entities\":{\"aadUserId\":null,\"accountName\":null,\"clusterBy\":null,\"deliveryAction\":null,\"deviceId\":null,\"domainName\":null,\"entityType\":\"MailBox\",\"fileName\":null,\"filePath\":null,\"ipAddress\":null,\"mailboxAddress\":\"testUser3@contoso.com\",\"mailboxDisplayName\":\"test User3\",\"parentProcessCreationTime\":null,\"parentProcessId\":null,\"processCommandLine\":null,\"processCreationTime\":null,\"processId\":null,\"recipient\":null,\"registryHive\":null,\"registryKey\":null,\"registryValue\":null,\"registryValueType\":null,\"securityGroupId\":null,\"securityGroupName\":null,\"sender\":null,\"sha1\":null,\"sha256\":null,\"subject\":null,\"url\":null,\"userPrincipalName\":\"testUser3@contoso.com\",\"userSid\":null},\"firstActivity\":\"2020-09-06T12:04:00Z\",\"incidentId\":924518,\"investigationId\":null,\"investigationState\":\"Queued\",\"lastActivity\":\"2020-09-06T12:04:00Z\",\"lastUpdatedTime\":\"2020-09-06T12:37:40.88Z\",\"mitreTechniques\":[],\"resolvedTime\":null,\"serviceSource\":\"OfficeATP\",\"severity\":\"Informational\",\"status\":\"InProgress\",\"threatFamilyName\":null,\"title\":\"Email reported by user as malware or phish\"},\"assignedTo\":null,\"classification\":\"Unknown\",\"comments\":[],\"createdTime\":\"2020-09-06T12:07:55.1366667Z\",\"determination\":\"NotAvailable\",\"incidentId\":924518,\"incidentName\":\"Email reported by user as malware or phish\",\"lastUpdateTime\":\"2020-09-06T12:07:55.32Z\",\"redirectIncidentId\":null,\"severity\":\"Informational\",\"status\":\"Active\",\"tags\":[]}", "provider": "OfficeATP", "severity": 1, "start": "2020-09-06T12:04:00Z", - "timezone": "UTC" + "timezone": "UTC", + "type": [ + "info" + ] }, "file": { "hash": {} @@ -1225,15 +1296,15 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.sha1 | SHA1 hash. | keyword | @@ -1248,7 +1319,7 @@ An example event for `log` looks as following: | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | host.ip | Host ip addresses. | ip | | host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | host.os.build | OS build information. | keyword | | host.os.codename | OS codename, if any. | keyword | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | diff --git a/packages/m365_defender/img/m365-defender-dashboard-alert.png b/packages/m365_defender/img/m365-defender-dashboard-alert.png deleted file mode 100644 index 69409cb4895..00000000000 Binary files a/packages/m365_defender/img/m365-defender-dashboard-alert.png and /dev/null differ diff --git a/packages/m365_defender/img/m365-defender-dashboard-app-and-identity.png b/packages/m365_defender/img/m365-defender-dashboard-app-and-identity.png deleted file mode 100644 index dd2c108ce1b..00000000000 Binary files a/packages/m365_defender/img/m365-defender-dashboard-app-and-identity.png and /dev/null differ diff --git a/packages/m365_defender/img/m365-defender-dashboard-device.png b/packages/m365_defender/img/m365-defender-dashboard-device.png deleted file mode 100644 index 31a865b48e3..00000000000 Binary files a/packages/m365_defender/img/m365-defender-dashboard-device.png and /dev/null differ diff --git a/packages/m365_defender/img/m365-defender-dashboard-email.png b/packages/m365_defender/img/m365-defender-dashboard-email.png deleted file mode 100644 index fa2dc856107..00000000000 Binary files a/packages/m365_defender/img/m365-defender-dashboard-email.png and /dev/null differ diff --git a/packages/m365_defender/img/m365-defender-dashboard.png b/packages/m365_defender/img/m365-defender-dashboard.png deleted file mode 100644 index 10114c34e31..00000000000 Binary files a/packages/m365_defender/img/m365-defender-dashboard.png and /dev/null differ diff --git a/packages/m365_defender/img/m365-defender-events-alerts1.png b/packages/m365_defender/img/m365-defender-events-alerts1.png new file mode 100644 index 00000000000..a11e0765c52 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-alerts1.png differ diff --git a/packages/m365_defender/img/m365-defender-events-alerts2.png b/packages/m365_defender/img/m365-defender-events-alerts2.png new file mode 100644 index 00000000000..69b71a331bb Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-alerts2.png differ diff --git a/packages/m365_defender/img/m365-defender-events-app1.png b/packages/m365_defender/img/m365-defender-events-app1.png new file mode 100644 index 00000000000..a9d126f1cf0 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-app1.png differ diff --git a/packages/m365_defender/img/m365-defender-events-device1.png b/packages/m365_defender/img/m365-defender-events-device1.png new file mode 100644 index 00000000000..02bb5b102d1 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-device1.png differ diff --git a/packages/m365_defender/img/m365-defender-events-device2.png b/packages/m365_defender/img/m365-defender-events-device2.png new file mode 100644 index 00000000000..3435c67fcaa Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-device2.png differ diff --git a/packages/m365_defender/img/m365-defender-events-email1.png b/packages/m365_defender/img/m365-defender-events-email1.png new file mode 100644 index 00000000000..82c002c9e5d Binary files /dev/null and b/packages/m365_defender/img/m365-defender-events-email1.png differ diff --git a/packages/m365_defender/img/m365-defender-incident-alert1.png b/packages/m365_defender/img/m365-defender-incident-alert1.png new file mode 100644 index 00000000000..ffde9911c29 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-incident-alert1.png differ diff --git a/packages/m365_defender/img/m365-defender-incident-alert2.png b/packages/m365_defender/img/m365-defender-incident-alert2.png new file mode 100644 index 00000000000..27ab38cc080 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-incident-alert2.png differ diff --git a/packages/m365_defender/img/m365-defender-incidents-incidents1.png b/packages/m365_defender/img/m365-defender-incidents-incidents1.png new file mode 100644 index 00000000000..66b45cc077e Binary files /dev/null and b/packages/m365_defender/img/m365-defender-incidents-incidents1.png differ diff --git a/packages/m365_defender/img/m365-defender-incidents-incidents2.png b/packages/m365_defender/img/m365-defender-incidents-incidents2.png new file mode 100644 index 00000000000..322d1f5a866 Binary files /dev/null and b/packages/m365_defender/img/m365-defender-incidents-incidents2.png differ diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json b/packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json index 20363c06fc9..6c97e5cd576 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c.json @@ -1,66 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"d218fe98-720c-4475-b679-38ebec3e5ecb\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"d218fe98-720c-4475-b679-38ebec3e5ecb\",\"fieldName\":\"m365_defender.event.severity\",\"title\":\"Severity\",\"enhancements\":{}}},\"f8f04068-22e1-41e8-b1a1-0786df2a0d10\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"f8f04068-22e1-41e8-b1a1-0786df2a0d10\",\"fieldName\":\"host.name\",\"title\":\"Hostname\",\"enhancements\":{}}},\"0a666826-2535-479f-bfc7-55f386ebc9fc\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0a666826-2535-479f-bfc7-55f386ebc9fc\",\"fieldName\":\"user.name\",\"title\":\"Username\",\"enhancements\":{}}},\"0c0c21f4-2b5b-4945-bde3-de61ee7c1c22\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"0c0c21f4-2b5b-4945-bde3-de61ee7c1c22\",\"fieldName\":\"m365_defender.event.alert.category\",\"title\":\"Alert Category\",\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender Alert Events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.event" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.event" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Filter: Alert", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "m365_defender.event.category", - "negate": false, - "params": [ - "AdvancedHunting-AlertEvidence", - "AdvancedHunting-AlertInfo" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-AlertEvidence" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-AlertInfo" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -69,14 +18,16 @@ }, "optionsJSON": { "hidePanelTitles": false, - "syncColors": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": true, + "hidePanelTitles": false, "savedVis": { "data": { "aggs": [], @@ -92,8 +43,8 @@ "id": "", "params": { "fontSize": 12, - "markdown": "[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) |\n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) | \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) ", - "openLinksInNewTab": true + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n**[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c)** \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) \n\n#### Incident Datastream (Graph API) \n\n[Incidents](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06) \n[Alerts](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03) \n\n#### Description\n\nThis dashboard visualizes Alert type events according to the [Microsoft Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide). \nThe data is collected from a configured Event Hub, using the M365 Defender Event datastream.\n\nThe supported event types are:\n- AdvancedHunting-AlertEvidence\n- AdvancedHunting-AlertInfo\n\n", + "openLinksInNewTab": false }, "title": "", "type": "markdown", @@ -101,127 +52,667 @@ } }, "gridData": { - "h": 2, - "i": "5a7c7a42-12a4-49f3-a9be-cddff83fea6e", - "w": 48, + "h": 102, + "i": "709e2e0c-aff3-433c-bc03-3fc62f033873", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "5a7c7a42-12a4-49f3-a9be-cddff83fea6e", - "title": "Dashboards [Logs Microsoft 365 Defender]", + "panelIndex": "709e2e0c-aff3-433c-bc03-3fc62f033873", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4efb22f7-7fe1-4839-a7cc-3a28796b1f01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c54cb33e-e531-4f8b-9bae-fd7aab85f15d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c6f0141-f2b6-470a-b228-4d171ba5ec9c": { + "columnOrder": [ + "f9fc8f3a-2689-47a0-be9c-4b1475047b38" + ], + "columns": { + "f9fc8f3a-2689-47a0-be9c-4b1475047b38": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "High Severity", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Severity" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4efb22f7-7fe1-4839-a7cc-3a28796b1f01", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" }, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "filters": [ + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c54cb33e-e531-4f8b-9bae-fd7aab85f15d", + "negate": false, + "params": [ { - "input": { - "language": "kuery", - "query": "m365_defender.event.severity : \"high\" " + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] }, - "label": "High" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } }, { - "input": { - "language": "kuery", - "query": "m365_defender.event.severity : \"medium\"" + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.severity", + "index": "logs-*", + "key": "m365_defender.event.severity", + "negate": false, + "params": { + "query": "high" + }, + "type": "phrase" }, - "label": "Medium" + "query": { + "match_phrase": { + "m365_defender.event.severity": "high" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "layerType": "data", + "metricAccessor": "f9fc8f3a-2689-47a0-be9c-4b1475047b38", + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#54B399", + "stop": null + }, + { + "color": "#E7664C", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#54B399", + "stop": 1 + }, + { + "color": "#E7664C", + "stop": 2 + } + ] + }, + "type": "palette" + } + } + }, + "title": "Metric visualization (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "f7f48432-a963-4c54-860d-8a33a26940c5", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "f7f48432-a963-4c54-860d-8a33a26940c5", + "title": "High Severity Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "230120d9-5a47-4b72-a65b-199f629c9677", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7da7cd29-c402-4132-be2a-fe384cc2fc83", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c6f0141-f2b6-470a-b228-4d171ba5ec9c": { + "columnOrder": [ + "f9fc8f3a-2689-47a0-be9c-4b1475047b38" + ], + "columns": { + "f9fc8f3a-2689-47a0-be9c-4b1475047b38": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Medium Severity", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "230120d9-5a47-4b72-a65b-199f629c9677", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7da7cd29-c402-4132-be2a-fe384cc2fc83", + "negate": false, + "params": [ { - "input": { - "language": "kuery", - "query": "m365_defender.event.severity : \"low\" " + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] }, - "label": "Low" + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } }, { - "input": { - "language": "kuery", - "query": "m365_defender.event.severity : \"informational\"" + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.severity", + "index": "logs-*", + "key": "m365_defender.event.severity", + "negate": false, + "params": { + "query": "medium" + }, + "type": "phrase" }, - "label": "informational" + "query": { + "match_phrase": { + "m365_defender.event.severity": "medium" + } + } } - ] + ], + "relation": "AND", + "type": "combined" }, - "schema": "group", - "type": "filters" + "query": {} } ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "layerType": "data", + "metricAccessor": "f9fc8f3a-2689-47a0-be9c-4b1475047b38", + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#54B399", + "stop": null + }, + { + "color": "#FEC514", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#54B399", + "stop": 1 + }, + { + "color": "#FEC514", + "stop": 6 + } + ] + }, + "type": "palette" } } }, - "description": "", - "id": "", - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "title": "Metric visualization (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "a1fef86c-50fd-4344-a17b-1f52c2ab387c", + "w": 8, + "x": 16, + "y": 0 + }, + "panelIndex": "a1fef86c-50fd-4344-a17b-1f52c2ab387c", + "title": "Medium Severity Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e206428e-da03-4b11-be9d-b36108a6ea48", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1675684f-a4ff-4f9d-b66c-e6dad203bcfc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c6f0141-f2b6-470a-b228-4d171ba5ec9c": { + "columnOrder": [ + "f9fc8f3a-2689-47a0-be9c-4b1475047b38" + ], + "columns": { + "f9fc8f3a-2689-47a0-be9c-4b1475047b38": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Low Severity", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e206428e-da03-4b11-be9d-b36108a6ea48", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } }, - "useRanges": false + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1675684f-a4ff-4f9d-b66c-e6dad203bcfc", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.severity", + "index": "logs-*", + "key": "m365_defender.event.severity", + "negate": false, + "params": { + "query": "low" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.severity": "low" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "type": "metric" + "visualization": { + "layerId": "7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "layerType": "data", + "metricAccessor": "f9fc8f3a-2689-47a0-be9c-4b1475047b38", + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#54B399", + "stop": null + }, + { + "color": "#6092C0", + "stop": 1 + } + ], + "continuity": "all", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": null, + "rangeMin": null, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#54B399", + "stop": 1 + }, + { + "color": "#6092C0", + "stop": 6 + } + ] + }, + "type": "palette" + } + } }, - "title": "", - "type": "metric", - "uiState": {} - } + "title": "Metric visualization (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 10, - "i": "f7f48432-a963-4c54-860d-8a33a26940c5", - "w": 48, - "x": 0, - "y": 2 + "h": 8, + "i": "ab38b1be-424f-42fe-9eb3-f82a07760836", + "w": 8, + "x": 24, + "y": 0 }, - "panelIndex": "f7f48432-a963-4c54-860d-8a33a26940c5", - "title": "Alert Severity Information [Logs Microsoft 365 Defender]", - "type": "visualization", - "version": "7.16.0" + "panelIndex": "ab38b1be-424f-42fe-9eb3-f82a07760836", + "title": "Low Severity Count", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -229,100 +720,333 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0bfbdd96-9c40-4fe8-808c-86624470ce91", + "name": "4fecabd4-bd2e-4227-8bc1-003ddd79c784", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dc86f29d-ba20-4634-b43f-5e7f37f7c0ff", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "0bfbdd96-9c40-4fe8-808c-86624470ce91": { + "7c6f0141-f2b6-470a-b228-4d171ba5ec9c": { "columnOrder": [ - "96f53808-7c6b-4b58-9681-31185fb341b7", - "f99388d1-ad86-4951-9a54-adbcc9c30e54" + "f9fc8f3a-2689-47a0-be9c-4b1475047b38" ], "columns": { - "96f53808-7c6b-4b58-9681-31185fb341b7": { + "f9fc8f3a-2689-47a0-be9c-4b1475047b38": { "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Alert Category", - "operationType": "terms", + "dataType": "number", + "isBucketed": false, + "label": "Informational Severity", + "operationType": "count", "params": { - "missingBucket": false, - "orderBy": { - "columnId": "f99388d1-ad86-4951-9a54-adbcc9c30e54", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } }, - "scale": "ordinal", - "sourceField": "m365_defender.event.category" + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4fecabd4-bd2e-4227-8bc1-003ddd79c784", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "dc86f29d-ba20-4634-b43f-5e7f37f7c0ff", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] }, - "f99388d1-ad86-4951-9a54-adbcc9c30e54": { + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.severity", + "index": "logs-*", + "key": "m365_defender.event.severity", + "negate": false, + "params": { + "query": "informational" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.severity": "informational" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#54B399", + "layerId": "7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "layerType": "data", + "metricAccessor": "f9fc8f3a-2689-47a0-be9c-4b1475047b38" + } + }, + "title": "Metric visualization (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "94a17c51-33de-4974-bfc0-36895c851ccf", + "w": 8, + "x": 32, + "y": 0 + }, + "panelIndex": "94a17c51-33de-4974-bfc0-36895c851ccf", + "title": "Informational Severity Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8975462e-c404-4f9d-95aa-f11b196d7cdc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aca545c8-843d-4973-a51e-0209f215e0bc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7c6f0141-f2b6-470a-b228-4d171ba5ec9c": { + "columnOrder": [ + "f9fc8f3a-2689-47a0-be9c-4b1475047b38" + ], + "columns": { + "f9fc8f3a-2689-47a0-be9c-4b1475047b38": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Unique Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "host.name" } }, "incompleteColumns": {} } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8975462e-c404-4f9d-95aa-f11b196d7cdc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "aca545c8-843d-4973-a51e-0209f215e0bc", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "96f53808-7c6b-4b58-9681-31185fb341b7" - ], - "layerId": "0bfbdd96-9c40-4fe8-808c-86624470ce91", - "layerType": "data", - "legendDisplay": "default", - "metric": "f99388d1-ad86-4951-9a54-adbcc9c30e54", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" + "color": "#6092C0", + "layerId": "7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "layerType": "data", + "metricAccessor": "f9fc8f3a-2689-47a0-be9c-4b1475047b38" } }, - "title": "", + "title": "Metric visualization (converted)", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsMetric" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f", - "w": 24, - "x": 0, - "y": 12 + "h": 8, + "i": "95ac17ce-7f9e-459b-bd6c-ca7b7d4fc866", + "w": 8, + "x": 40, + "y": 0 }, - "panelIndex": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f", - "title": "Distribution of Alert Events by Category [Logs Microsoft 365 Defender]", + "panelIndex": "95ac17ce-7f9e-459b-bd6c-ca7b7d4fc866", + "title": "Unique Host Count", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -330,18 +1054,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f47a423f-8940-4b5b-8deb-c4351b75d7d5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f47a423f-8940-4b5b-8deb-c4351b75d7d5", + "name": "dd767c50-a8d0-4e54-b130-83bb0172e866", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a0587a17-8781-4f95-8227-b24c1878efb3", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f47a423f-8940-4b5b-8deb-c4351b75d7d5": { "columnOrder": [ @@ -356,8 +1086,16 @@ "isBucketed": false, "label": "Count", "operationType": "count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4b06f22b-cbf2-454e-9faa-cb77ece83c86": { "customLabel": true, @@ -385,6 +1123,7 @@ "label": "Timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -396,7 +1135,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dd767c50-a8d0-4e54-b130-83bb0172e866", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "a0587a17-8781-4f95-8227-b24c1878efb3", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -409,6 +1211,10 @@ ], "layerId": "f47a423f-8940-4b5b-8deb-c4351b75d7d5", "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, "position": "top", "seriesType": "line", "showGridlines": false, @@ -418,6 +1224,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -439,16 +1246,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 13, "i": "ed37facb-6a06-448e-8b27-33a266d36ede", - "w": 24, - "x": 24, - "y": 12 + "w": 40, + "x": 8, + "y": 8 }, "panelIndex": "ed37facb-6a06-448e-8b27-33a266d36ede", - "title": "Severity of Alerts Over Time [Logs Microsoft 365 Defender]", + "title": "Severity of Alerts Over Time", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -456,52 +1263,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0bfbdd96-9c40-4fe8-808c-86624470ce91", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-c947d589-efac-479f-a315-6eba984ef356", + "name": "ab89b686-98ed-4fc8-b0a3-a1890ab86f80", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "732867fa-c233-4ad1-93fc-4d313742241a", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "c947d589-efac-479f-a315-6eba984ef356": { + "0bfbdd96-9c40-4fe8-808c-86624470ce91": { "columnOrder": [ - "93a0f8fa-463d-4bf8-a124-1f32e5fc7723", - "a59d0987-6709-4870-8ec7-a2bde8631214" + "96f53808-7c6b-4b58-9681-31185fb341b7", + "f99388d1-ad86-4951-9a54-adbcc9c30e54" ], "columns": { - "93a0f8fa-463d-4bf8-a124-1f32e5fc7723": { + "96f53808-7c6b-4b58-9681-31185fb341b7": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "AlertEvidence Category", + "label": "Alert Category", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "a59d0987-6709-4870-8ec7-a2bde8631214", + "columnId": "f99388d1-ad86-4951-9a54-adbcc9c30e54", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.alert.categories" + "sourceField": "m365_defender.event.category" }, - "a59d0987-6709-4870-8ec7-a2bde8631214": { + "f99388d1-ad86-4951-9a54-adbcc9c30e54": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -509,7 +1322,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ab89b686-98ed-4fc8-b0a3-a1890ab86f80", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "732867fa-c233-4ad1-93fc-4d313742241a", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -518,17 +1394,25 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "93a0f8fa-463d-4bf8-a124-1f32e5fc7723" - ], - "layerId": "c947d589-efac-479f-a315-6eba984ef356", + "layerId": "0bfbdd96-9c40-4fe8-808c-86624470ce91", "layerType": "data", - "legendDisplay": "default", - "metric": "a59d0987-6709-4870-8ec7-a2bde8631214", + "legendDisplay": "show", + "legendSize": "large", + "metrics": [ + "f99388d1-ad86-4951-9a54-adbcc9c30e54" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "96f53808-7c6b-4b58-9681-31185fb341b7" + ], + "truncateLegend": false } ], + "palette": { + "name": "default", + "type": "palette" + }, "shape": "pie" } }, @@ -540,16 +1424,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "b36c4cb0-fb8d-4587-9175-e8993c4345f2", - "w": 24, - "x": 0, - "y": 27 + "h": 21, + "i": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f", + "w": 13, + "x": 8, + "y": 21 }, - "panelIndex": "b36c4cb0-fb8d-4587-9175-e8993c4345f2", - "title": "Distribution of Alert Events by AlertEvidence Category [Logs Microsoft 365 Defender]", + "panelIndex": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f", + "title": "Distribution of Alert Events by Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -557,18 +1441,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-43b1d1bf-cd29-446c-9ead-24eab1414c58", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-43b1d1bf-cd29-446c-9ead-24eab1414c58", + "name": "5aafb1a5-3f7b-4a73-84b9-ceef566285e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0f2208dd-51bf-439f-9d35-ac364facbe83", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "43b1d1bf-cd29-446c-9ead-24eab1414c58": { "columnOrder": [ @@ -582,8 +1472,16 @@ "isBucketed": false, "label": "Count", "operationType": "count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "f889e677-8053-4b7f-a3ee-e40f13196545": { "customLabel": true, @@ -610,47 +1508,133 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5aafb1a5-3f7b-4a73-84b9-ceef566285e9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "0f2208dd-51bf-439f-9d35-ac364facbe83", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { - "categoryDisplay": "default", - "groups": [ - "f889e677-8053-4b7f-a3ee-e40f13196545" + "accessors": [ + "c8e84e65-9c5a-4da4-aff7-c06d0019f616" ], "layerId": "43b1d1bf-cd29-446c-9ead-24eab1414c58", "layerType": "data", - "legendDisplay": "default", - "metric": "c8e84e65-9c5a-4da4-aff7-c06d0019f616", - "nestedLegend": false, - "numberDisplay": "percent" + "seriesType": "bar_horizontal", + "xAccessor": "f889e677-8053-4b7f-a3ee-e40f13196545" } ], - "shape": "pie" + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 21, "i": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45", - "w": 24, - "x": 24, - "y": 27 + "w": 14, + "x": 21, + "y": 21 }, "panelIndex": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45", - "title": "Distribution of Alert Events by AlertInfo Category [Logs Microsoft 365 Defender]", + "title": "Distribution of Alert Events by Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -658,52 +1642,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-526d57ca-b35a-482d-83c1-14aaf56e2fdb", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", + "name": "55aed830-d488-4e47-b8d8-1dfafdd59528", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6b0139b7-b8c2-4762-a3b3-c91b2ee0252b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9": { + "526d57ca-b35a-482d-83c1-14aaf56e2fdb": { "columnOrder": [ - "a0108b77-533b-4ac1-ab76-d243d753d912", - "da6a67f9-24ab-4e58-9c75-3edead9543d6" + "d5a2d011-e9ae-4e02-adda-9768c2555ca2", + "a0d68c67-c705-4999-9254-726420d4596f" ], "columns": { - "a0108b77-533b-4ac1-ab76-d243d753d912": { + "a0d68c67-c705-4999-9254-726420d4596f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "d5a2d011-e9ae-4e02-adda-9768c2555ca2": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Detection Source", + "label": "Entity Type", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "da6a67f9-24ab-4e58-9c75-3edead9543d6", + "columnId": "a0d68c67-c705-4999-9254-726420d4596f", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.detection.source" - }, - "da6a67f9-24ab-4e58-9c75-3edead9543d6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "sourceField": "m365_defender.event.entity_type" } }, "incompleteColumns": {} @@ -711,7 +1701,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "55aed830-d488-4e47-b8d8-1dfafdd59528", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "6b0139b7-b8c2-4762-a3b3-c91b2ee0252b", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -719,50 +1772,42 @@ "visualization": { "layers": [ { - "accessors": [ - "da6a67f9-24ab-4e58-9c75-3edead9543d6" - ], - "layerId": "7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "a0108b77-533b-4ac1-ab76-d243d753d912" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "categoryDisplay": "default", + "layerId": "526d57ca-b35a-482d-83c1-14aaf56e2fdb", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "a0d68c67-c705-4999-9254-726420d4596f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d5a2d011-e9ae-4e02-adda-9768c2555ca2" + ], + "truncateLegend": false + } + ], + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0", - "w": 24, - "x": 0, - "y": 42 + "h": 21, + "i": "1bdac8c4-40d5-4256-9678-d0be8da4e90f", + "w": 13, + "x": 35, + "y": 21 }, - "panelIndex": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0", - "title": "Distribution of Alert Events by Detection Source [Logs Microsoft 365 Defender]", + "panelIndex": "1bdac8c4-40d5-4256-9678-d0be8da4e90f", + "title": "Distribution of Alert Events by Entity Type", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -770,44 +1815,41 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-c947d589-efac-479f-a315-6eba984ef356", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-526d57ca-b35a-482d-83c1-14aaf56e2fdb", + "name": "d344b3e3-b4bb-4444-8a83-cd990daf366c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8344ce70-7278-436c-b9a3-d5c7136a7473", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "526d57ca-b35a-482d-83c1-14aaf56e2fdb": { + "c947d589-efac-479f-a315-6eba984ef356": { "columnOrder": [ - "d5a2d011-e9ae-4e02-adda-9768c2555ca2", - "a0d68c67-c705-4999-9254-726420d4596f" + "93a0f8fa-463d-4bf8-a124-1f32e5fc7723", + "a59d0987-6709-4870-8ec7-a2bde8631214" ], "columns": { - "a0d68c67-c705-4999-9254-726420d4596f": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "d5a2d011-e9ae-4e02-adda-9768c2555ca2": { + "93a0f8fa-463d-4bf8-a124-1f32e5fc7723": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Entity Type", + "label": "AlertEvidence Category", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "a0d68c67-c705-4999-9254-726420d4596f", + "columnId": "a59d0987-6709-4870-8ec7-a2bde8631214", "type": "column" }, "orderDirection": "desc", @@ -815,7 +1857,16 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.entity_type" + "sourceField": "m365_defender.event.alert.categories" + }, + "a59d0987-6709-4870-8ec7-a2bde8631214": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -823,7 +1874,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d344b3e3-b4bb-4444-8a83-cd990daf366c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "8344ce70-7278-436c-b9a3-d5c7136a7473", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -832,15 +1946,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d5a2d011-e9ae-4e02-adda-9768c2555ca2" - ], - "layerId": "526d57ca-b35a-482d-83c1-14aaf56e2fdb", + "layerId": "c947d589-efac-479f-a315-6eba984ef356", "layerType": "data", - "legendDisplay": "default", - "metric": "a0d68c67-c705-4999-9254-726420d4596f", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "a59d0987-6709-4870-8ec7-a2bde8631214" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "93a0f8fa-463d-4bf8-a124-1f32e5fc7723" + ] } ], "shape": "pie" @@ -854,16 +1971,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "1bdac8c4-40d5-4256-9678-d0be8da4e90f", - "w": 24, - "x": 24, + "h": 20, + "i": "b36c4cb0-fb8d-4587-9175-e8993c4345f2", + "w": 13, + "x": 8, "y": 42 }, - "panelIndex": "1bdac8c4-40d5-4256-9678-d0be8da4e90f", - "title": "Distribution of Alert Events by Entity Type [Logs Microsoft 365 Defender]", + "panelIndex": "b36c4cb0-fb8d-4587-9175-e8993c4345f2", + "title": "Distribution of Alert Events by AlertEvidence Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -871,18 +1988,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-85022ca8-d03d-46e1-a69a-00f3f3f296ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-85022ca8-d03d-46e1-a69a-00f3f3f296ce", + "name": "de5e97da-0b97-418f-b741-3dfa57711715", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "383b2756-a576-4684-9847-dc1754b36b06", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "85022ca8-d03d-46e1-a69a-00f3f3f296ce": { "columnOrder": [ @@ -897,7 +2020,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "561e7a47-3de8-416d-8c1b-0b27f2b8c430": { "customLabel": true, @@ -924,7 +2047,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "de5e97da-0b97-418f-b741-3dfa57711715", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "383b2756-a576-4684-9847-dc1754b36b06", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -933,15 +2119,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "561e7a47-3de8-416d-8c1b-0b27f2b8c430" - ], "layerId": "85022ca8-d03d-46e1-a69a-00f3f3f296ce", "layerType": "data", - "legendDisplay": "default", - "metric": "4b18a23e-a1f7-4e0c-ba99-bee954fcf901", + "legendDisplay": "show", + "metrics": [ + "4b18a23e-a1f7-4e0c-ba99-bee954fcf901" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "561e7a47-3de8-416d-8c1b-0b27f2b8c430" + ] } ], "shape": "pie" @@ -955,16 +2143,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 20, "i": "425863c5-767c-46b4-a8d5-f3457813c1c5", - "w": 24, - "x": 0, - "y": 57 + "w": 14, + "x": 21, + "y": 42 }, "panelIndex": "425863c5-767c-46b4-a8d5-f3457813c1c5", - "title": "Distribution of Alert Events by Service Source [Logs Microsoft 365 Defender]", + "title": "Distribution of Alert Events by Service Source", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -972,52 +2160,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-ded3c9d4-9e45-44b1-be3b-6efc126abff4", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-99c43573-42fe-4560-b82c-6747f72c15ca", + "name": "6176d98f-592e-4664-baec-1e77c1d163c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1a48a4d7-c5ba-4ffd-8644-7c3ab3ecca3d", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "99c43573-42fe-4560-b82c-6747f72c15ca": { + "ded3c9d4-9e45-44b1-be3b-6efc126abff4": { "columnOrder": [ - "b1160ab3-8939-40d7-8018-5409a8d05275", - "9776f18a-f97d-4b94-bc45-a80e67249a8d" + "990c5af3-5dc0-4548-af9d-d826084a38a0", + "60dd110b-2302-43cf-b91c-6ff59f47c024" ], "columns": { - "9776f18a-f97d-4b94-bc45-a80e67249a8d": { + "60dd110b-2302-43cf-b91c-6ff59f47c024": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "b1160ab3-8939-40d7-8018-5409a8d05275": { + "990c5af3-5dc0-4548-af9d-d826084a38a0": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Attack Technique", + "label": "Evidence Role", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "9776f18a-f97d-4b94-bc45-a80e67249a8d", + "columnId": "60dd110b-2302-43cf-b91c-6ff59f47c024", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, - "size": 10 + "otherBucket": true, + "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.attack_techniques" + "sourceField": "m365_defender.event.evidence.role" } }, "incompleteColumns": {} @@ -1025,43 +2219,112 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "6176d98f-592e-4664-baec-1e77c1d163c1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "1a48a4d7-c5ba-4ffd-8644-7c3ab3ecca3d", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "columnId": "b1160ab3-8939-40d7-8018-5409a8d05275" - }, + "layers": [ { - "columnId": "9776f18a-f97d-4b94-bc45-a80e67249a8d", - "isTransposed": false + "categoryDisplay": "default", + "layerId": "ded3c9d4-9e45-44b1-be3b-6efc126abff4", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "60dd110b-2302-43cf-b91c-6ff59f47c024" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "990c5af3-5dc0-4548-af9d-d826084a38a0" + ] } ], - "layerId": "99c43573-42fe-4560-b82c-6747f72c15ca", - "layerType": "data" + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b", - "w": 24, - "x": 24, - "y": 72 + "h": 20, + "i": "63038c1f-4fc2-4223-8093-1d531dcebf55", + "w": 13, + "x": 35, + "y": 42 }, - "panelIndex": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b", - "title": "Top 10 Attack Techniques that Triggered the Alert [Logs Microsoft 365 Defender]", + "panelIndex": "63038c1f-4fc2-4223-8093-1d531dcebf55", + "title": "Distribution of Alert Events by Evidence Role", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1069,52 +2332,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ded3c9d4-9e45-44b1-be3b-6efc126abff4", + "name": "d2375de7-1712-482f-aeb7-33384fa02bc7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "70cfab8a-fe0d-4182-8c85-8c7fea09f579", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "ded3c9d4-9e45-44b1-be3b-6efc126abff4": { + "7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9": { "columnOrder": [ - "990c5af3-5dc0-4548-af9d-d826084a38a0", - "60dd110b-2302-43cf-b91c-6ff59f47c024" + "a0108b77-533b-4ac1-ab76-d243d753d912", + "da6a67f9-24ab-4e58-9c75-3edead9543d6" ], "columns": { - "60dd110b-2302-43cf-b91c-6ff59f47c024": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "990c5af3-5dc0-4548-af9d-d826084a38a0": { + "a0108b77-533b-4ac1-ab76-d243d753d912": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Evidence Role", + "label": "Detection Source", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "60dd110b-2302-43cf-b91c-6ff59f47c024", + "columnId": "da6a67f9-24ab-4e58-9c75-3edead9543d6", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.evidence.role" + "sourceField": "m365_defender.event.detection.source" + }, + "da6a67f9-24ab-4e58-9c75-3edead9543d6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -1122,7 +2391,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d2375de7-1712-482f-aeb7-33384fa02bc7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "70cfab8a-fe0d-4182-8c85-8c7fea09f579", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1130,39 +2462,51 @@ "visualization": { "layers": [ { - "categoryDisplay": "default", - "groups": [ - "990c5af3-5dc0-4548-af9d-d826084a38a0" + "accessors": [ + "da6a67f9-24ab-4e58-9c75-3edead9543d6" ], - "layerId": "ded3c9d4-9e45-44b1-be3b-6efc126abff4", + "layerId": "7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", "layerType": "data", - "legendDisplay": "default", - "metric": "60dd110b-2302-43cf-b91c-6ff59f47c024", - "nestedLegend": false, - "numberDisplay": "percent" + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "a0108b77-533b-4ac1-ab76-d243d753d912" } ], - "shape": "pie" + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "63038c1f-4fc2-4223-8093-1d531dcebf55", - "w": 24, - "x": 0, - "y": 72 + "h": 19, + "i": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0", + "w": 16, + "x": 8, + "y": 62 }, - "panelIndex": "63038c1f-4fc2-4223-8093-1d531dcebf55", - "title": "Distribution of Alert Events by Evidence Role [Logs Microsoft 365 Defender]", + "panelIndex": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0", + "title": "Distribution of Alert Events by Detection Source", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1170,52 +2514,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-99c43573-42fe-4560-b82c-6747f72c15ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ac2a6d3c-a898-4b9a-8e7b-8911e9842496", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-5f8abf5a-28b8-4645-8cd9-c4e9ba781d5b", + "name": "12710ab1-d6d8-459d-b3cd-a80f30c738a7", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "5f8abf5a-28b8-4645-8cd9-c4e9ba781d5b": { + "99c43573-42fe-4560-b82c-6747f72c15ca": { "columnOrder": [ - "4d52046b-4ecb-4596-815f-5ae8c002ca2c", - "c7348f0f-3f29-40f3-8403-e8d5ef1124cd" + "b1160ab3-8939-40d7-8018-5409a8d05275", + "9776f18a-f97d-4b94-bc45-a80e67249a8d" ], "columns": { - "4d52046b-4ecb-4596-815f-5ae8c002ca2c": { + "9776f18a-f97d-4b94-bc45-a80e67249a8d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "b1160ab3-8939-40d7-8018-5409a8d05275": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Application", + "label": "Attack Technique", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "c7348f0f-3f29-40f3-8403-e8d5ef1124cd", + "columnId": "9776f18a-f97d-4b94-bc45-a80e67249a8d", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, - "size": 5 + "otherBucket": false, + "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.application" - }, - "c7348f0f-3f29-40f3-8403-e8d5ef1124cd": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "sourceField": "m365_defender.event.attack_techniques" } }, "incompleteColumns": {} @@ -1223,47 +2573,108 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ac2a6d3c-a898-4b9a-8e7b-8911e9842496", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "12710ab1-d6d8-459d-b3cd-a80f30c738a7", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertInfo", + "AdvancedHunting-AlertEvidence" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertInfo", + "AdvancedHunting-AlertEvidence" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "groups": [ - "4d52046b-4ecb-4596-815f-5ae8c002ca2c" - ], - "layerId": "5f8abf5a-28b8-4645-8cd9-c4e9ba781d5b", - "layerType": "data", - "legendDisplay": "default", - "metric": "c7348f0f-3f29-40f3-8403-e8d5ef1124cd", - "nestedLegend": false, - "numberDisplay": "percent" + "columnId": "b1160ab3-8939-40d7-8018-5409a8d05275" + }, + { + "columnId": "9776f18a-f97d-4b94-bc45-a80e67249a8d", + "isTransposed": false } ], - "shape": "pie" + "layerId": "99c43573-42fe-4560-b82c-6747f72c15ca", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "b5ea653b-40c9-4909-b801-ac6d91c0ded1", + "h": 19, + "i": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b", "w": 24, "x": 24, - "y": 57 + "y": 62 }, - "panelIndex": "b5ea653b-40c9-4909-b801-ac6d91c0ded1", - "title": "Distribution of Alert Events by Application [Logs Microsoft 365 Defender]", + "panelIndex": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b", + "title": "Top 10 Attack Techniques Used", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1271,18 +2682,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e45f17e1-69db-48e1-878c-c3ca4fcf6d50", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e45f17e1-69db-48e1-878c-c3ca4fcf6d50", + "name": "47eef4e7-c824-462a-94fb-1a84f2e758b9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0889a595-52b1-4f0c-8dff-4b918d988cc0", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e45f17e1-69db-48e1-878c-c3ca4fcf6d50": { "columnOrder": [ @@ -1297,7 +2714,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "2ce07d3c-213b-4a78-ac11-7e0657fe8d93": { "customLabel": true, @@ -1324,7 +2741,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "47eef4e7-c824-462a-94fb-1a84f2e758b9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "0889a595-52b1-4f0c-8dff-4b918d988cc0", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1341,7 +2821,9 @@ } ], "layerId": "e45f17e1-69db-48e1-878c-c3ca4fcf6d50", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1352,16 +2834,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 21, "i": "689534bf-7bd5-47c3-b2e4-05ad3e05065c", - "w": 24, - "x": 0, - "y": 87 + "w": 20, + "x": 8, + "y": 81 }, "panelIndex": "689534bf-7bd5-47c3-b2e4-05ad3e05065c", - "title": "Top 10 User with Highest Alert [Logs Microsoft 365 Defender]", + "title": "Top 10 User with Highest Alert", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1369,18 +2851,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-cc1cd5fe-470e-413d-b165-78bb959fdcae", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-cc1cd5fe-470e-413d-b165-78bb959fdcae", + "name": "15fd0bac-afc2-4816-83f0-ded325da7cae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5014c71f-1e32-4c12-a452-f4625f7125d3", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cc1cd5fe-470e-413d-b165-78bb959fdcae": { "columnOrder": [ @@ -1391,11 +2879,15 @@ "29d39975-6689-417e-8279-8e1b58339bcc": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, "isBucketed": false, - "label": "Count", + "label": "Alerts", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "3c99dee2-cbde-488f-9dd2-e1135ef3d9a2": { "customLabel": true, @@ -1411,10 +2903,14 @@ }, "orderDirection": "desc", "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", - "sourceField": "host.domain" + "sourceField": "host.name" } }, "incompleteColumns": {} @@ -1422,7 +2918,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "15fd0bac-afc2-4816-83f0-ded325da7cae", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "5014c71f-1e32-4c12-a452-f4625f7125d3", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-AlertEvidence", + "AdvancedHunting-AlertInfo" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertEvidence" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-AlertInfo" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1434,12 +2993,47 @@ "isTransposed": false }, { + "colorMode": "cell", "columnId": "29d39975-6689-417e-8279-8e1b58339bcc", - "isTransposed": false + "isTransposed": false, + "palette": { + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#54B399", + "stop": 0 + }, + { + "color": "#FEC514", + "stop": 1 + } + ], + "continuity": "above", + "name": "custom", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "number", + "steps": 5, + "stops": [ + { + "color": "#54B399", + "stop": 1 + }, + { + "color": "#FEC514", + "stop": 2 + } + ] + }, + "type": "palette" + } } ], "layerId": "cc1cd5fe-470e-413d-b165-78bb959fdcae", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1450,56 +3044,102 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 21, "i": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5", - "w": 24, - "x": 24, - "y": 87 + "w": 20, + "x": 28, + "y": 81 }, "panelIndex": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5", - "title": "Top 10 Device with Highest Alert [Logs Microsoft 365 Defender]", + "title": "Top 10 Device by Alert Count", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] Alert Events", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T09:11:03.790Z", "id": "m365_defender-2690a440-7235-11ed-8657-c59f6ece834c", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "f7f48432-a963-4c54-860d-8a33a26940c5:indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "f7f48432-a963-4c54-860d-8a33a26940c5:4efb22f7-7fe1-4839-a7cc-3a28796b1f01", "type": "index-pattern" }, { "id": "logs-*", - "name": "f7f48432-a963-4c54-860d-8a33a26940c5:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "f7f48432-a963-4c54-860d-8a33a26940c5:c54cb33e-e531-4f8b-9bae-fd7aab85f15d", "type": "index-pattern" }, { "id": "logs-*", - "name": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f:indexpattern-datasource-current-indexpattern", + "name": "a1fef86c-50fd-4344-a17b-1f52c2ab387c:indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", "type": "index-pattern" }, { "id": "logs-*", - "name": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f:indexpattern-datasource-layer-0bfbdd96-9c40-4fe8-808c-86624470ce91", + "name": "a1fef86c-50fd-4344-a17b-1f52c2ab387c:230120d9-5a47-4b72-a65b-199f629c9677", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a1fef86c-50fd-4344-a17b-1f52c2ab387c:7da7cd29-c402-4132-be2a-fe384cc2fc83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ab38b1be-424f-42fe-9eb3-f82a07760836:indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ab38b1be-424f-42fe-9eb3-f82a07760836:e206428e-da03-4b11-be9d-b36108a6ea48", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ab38b1be-424f-42fe-9eb3-f82a07760836:1675684f-a4ff-4f9d-b66c-e6dad203bcfc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "94a17c51-33de-4974-bfc0-36895c851ccf:indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "94a17c51-33de-4974-bfc0-36895c851ccf:4fecabd4-bd2e-4227-8bc1-003ddd79c784", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "94a17c51-33de-4974-bfc0-36895c851ccf:dc86f29d-ba20-4634-b43f-5e7f37f7c0ff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "95ac17ce-7f9e-459b-bd6c-ca7b7d4fc866:indexpattern-datasource-layer-7c6f0141-f2b6-470a-b228-4d171ba5ec9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "95ac17ce-7f9e-459b-bd6c-ca7b7d4fc866:8975462e-c404-4f9d-95aa-f11b196d7cdc", "type": "index-pattern" }, { "id": "logs-*", - "name": "ed37facb-6a06-448e-8b27-33a266d36ede:indexpattern-datasource-current-indexpattern", + "name": "95ac17ce-7f9e-459b-bd6c-ca7b7d4fc866:aca545c8-843d-4973-a51e-0209f215e0bc", "type": "index-pattern" }, { @@ -1509,37 +3149,42 @@ }, { "id": "logs-*", - "name": "b36c4cb0-fb8d-4587-9175-e8993c4345f2:indexpattern-datasource-current-indexpattern", + "name": "ed37facb-6a06-448e-8b27-33a266d36ede:dd767c50-a8d0-4e54-b130-83bb0172e866", "type": "index-pattern" }, { "id": "logs-*", - "name": "b36c4cb0-fb8d-4587-9175-e8993c4345f2:indexpattern-datasource-layer-c947d589-efac-479f-a315-6eba984ef356", + "name": "ed37facb-6a06-448e-8b27-33a266d36ede:a0587a17-8781-4f95-8227-b24c1878efb3", "type": "index-pattern" }, { "id": "logs-*", - "name": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45:indexpattern-datasource-current-indexpattern", + "name": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f:indexpattern-datasource-layer-0bfbdd96-9c40-4fe8-808c-86624470ce91", "type": "index-pattern" }, { "id": "logs-*", - "name": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45:indexpattern-datasource-layer-43b1d1bf-cd29-446c-9ead-24eab1414c58", + "name": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f:ab89b686-98ed-4fc8-b0a3-a1890ab86f80", "type": "index-pattern" }, { "id": "logs-*", - "name": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0:indexpattern-datasource-current-indexpattern", + "name": "17575d40-8cb8-4a3e-bc13-b8ef8a09123f:732867fa-c233-4ad1-93fc-4d313742241a", "type": "index-pattern" }, { "id": "logs-*", - "name": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0:indexpattern-datasource-layer-7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", + "name": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45:indexpattern-datasource-layer-43b1d1bf-cd29-446c-9ead-24eab1414c58", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45:5aafb1a5-3f7b-4a73-84b9-ceef566285e9", "type": "index-pattern" }, { "id": "logs-*", - "name": "1bdac8c4-40d5-4256-9678-d0be8da4e90f:indexpattern-datasource-current-indexpattern", + "name": "b8b9e1dc-f5e5-4cb4-b935-6f6bc8deeb45:0f2208dd-51bf-439f-9d35-ac364facbe83", "type": "index-pattern" }, { @@ -1549,27 +3194,42 @@ }, { "id": "logs-*", - "name": "425863c5-767c-46b4-a8d5-f3457813c1c5:indexpattern-datasource-current-indexpattern", + "name": "1bdac8c4-40d5-4256-9678-d0be8da4e90f:55aed830-d488-4e47-b8d8-1dfafdd59528", "type": "index-pattern" }, { "id": "logs-*", - "name": "425863c5-767c-46b4-a8d5-f3457813c1c5:indexpattern-datasource-layer-85022ca8-d03d-46e1-a69a-00f3f3f296ce", + "name": "1bdac8c4-40d5-4256-9678-d0be8da4e90f:6b0139b7-b8c2-4762-a3b3-c91b2ee0252b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b36c4cb0-fb8d-4587-9175-e8993c4345f2:indexpattern-datasource-layer-c947d589-efac-479f-a315-6eba984ef356", "type": "index-pattern" }, { "id": "logs-*", - "name": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b:indexpattern-datasource-current-indexpattern", + "name": "b36c4cb0-fb8d-4587-9175-e8993c4345f2:d344b3e3-b4bb-4444-8a83-cd990daf366c", "type": "index-pattern" }, { "id": "logs-*", - "name": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b:indexpattern-datasource-layer-99c43573-42fe-4560-b82c-6747f72c15ca", + "name": "b36c4cb0-fb8d-4587-9175-e8993c4345f2:8344ce70-7278-436c-b9a3-d5c7136a7473", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "425863c5-767c-46b4-a8d5-f3457813c1c5:indexpattern-datasource-layer-85022ca8-d03d-46e1-a69a-00f3f3f296ce", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "425863c5-767c-46b4-a8d5-f3457813c1c5:de5e97da-0b97-418f-b741-3dfa57711715", "type": "index-pattern" }, { "id": "logs-*", - "name": "63038c1f-4fc2-4223-8093-1d531dcebf55:indexpattern-datasource-current-indexpattern", + "name": "425863c5-767c-46b4-a8d5-f3457813c1c5:383b2756-a576-4684-9847-dc1754b36b06", "type": "index-pattern" }, { @@ -1579,17 +3239,42 @@ }, { "id": "logs-*", - "name": "b5ea653b-40c9-4909-b801-ac6d91c0ded1:indexpattern-datasource-current-indexpattern", + "name": "63038c1f-4fc2-4223-8093-1d531dcebf55:6176d98f-592e-4664-baec-1e77c1d163c1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63038c1f-4fc2-4223-8093-1d531dcebf55:1a48a4d7-c5ba-4ffd-8644-7c3ab3ecca3d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0:indexpattern-datasource-layer-7dcdc94e-03b5-4de3-ad69-86fc6fd75bb9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0:d2375de7-1712-482f-aeb7-33384fa02bc7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f7b0e2ea-30a7-4ea8-84a4-ea258a438dd0:70cfab8a-fe0d-4182-8c85-8c7fea09f579", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b:indexpattern-datasource-layer-99c43573-42fe-4560-b82c-6747f72c15ca", "type": "index-pattern" }, { "id": "logs-*", - "name": "b5ea653b-40c9-4909-b801-ac6d91c0ded1:indexpattern-datasource-layer-5f8abf5a-28b8-4645-8cd9-c4e9ba781d5b", + "name": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b:ac2a6d3c-a898-4b9a-8e7b-8911e9842496", "type": "index-pattern" }, { "id": "logs-*", - "name": "689534bf-7bd5-47c3-b2e4-05ad3e05065c:indexpattern-datasource-current-indexpattern", + "name": "aee72ecd-3e85-473d-ae8e-a4b8c30eb35b:12710ab1-d6d8-459d-b3cd-a80f30c738a7", "type": "index-pattern" }, { @@ -1599,13 +3284,48 @@ }, { "id": "logs-*", - "name": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5:indexpattern-datasource-current-indexpattern", + "name": "689534bf-7bd5-47c3-b2e4-05ad3e05065c:47eef4e7-c824-462a-94fb-1a84f2e758b9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "689534bf-7bd5-47c3-b2e4-05ad3e05065c:0889a595-52b1-4f0c-8dff-4b918d988cc0", "type": "index-pattern" }, { "id": "logs-*", "name": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5:indexpattern-datasource-layer-cc1cd5fe-470e-413d-b165-78bb959fdcae", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5:15fd0bac-afc2-4816-83f0-ded325da7cae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a6b9b07-4d25-4e16-9d75-7cef9ae0b6d5:5014c71f-1e32-4c12-a452-f4625f7125d3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_d218fe98-720c-4475-b679-38ebec3e5ecb:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f8f04068-22e1-41e8-b1a1-0786df2a0d10:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_0a666826-2535-479f-bfc7-55f386ebc9fc:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_0c0c21f4-2b5b-4945-bde3-de61ee7c1c22:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json b/packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json index 7fab4d94931..cf15b3d1b3c 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c.json @@ -1,84 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"c08dd0da-2066-4051-9e48-9330cecd79cf\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c08dd0da-2066-4051-9e48-9330cecd79cf\",\"fieldName\":\"m365_defender.event.threat.types\",\"title\":\"Threat Type\",\"enhancements\":{}}},\"e3da88be-2a0e-4df5-9231-4b235e35e372\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e3da88be-2a0e-4df5-9231-4b235e35e372\",\"fieldName\":\"m365_defender.event.delivery.action\",\"title\":\"Delivery Action\",\"enhancements\":{}}},\"40e768fd-58fd-485d-908f-816fd083d07b\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"40e768fd-58fd-485d-908f-816fd083d07b\",\"fieldName\":\"m365_defender.event.email.action\",\"title\":\"Email Action\",\"enhancements\":{}}},\"c723136d-6842-4824-8a78-20c7376d28a9\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"c723136d-6842-4824-8a78-20c7376d28a9\",\"fieldName\":\"email.direction\",\"title\":\"Email Direction\",\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender Email Events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.event" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.event" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Filter: Email", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "m365_defender.event.category", - "negate": false, - "params": [ - "AdvancedHunting-EmailAttachmentInfo", - "AdvancedHunting-EmailEvents", - "AdvancedHunting-EmailPostDeliveryEvents", - "AdvancedHunting-EmailUrlInfo", - "AdvancedHunting-UrlClickEvents" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-EmailEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -87,14 +18,16 @@ }, "optionsJSON": { "hidePanelTitles": false, - "syncColors": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": true, + "hidePanelTitles": false, "savedVis": { "data": { "aggs": [], @@ -110,8 +43,8 @@ "id": "", "params": { "fontSize": 12, - "markdown": "[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) | \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) |\n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c)", - "openLinksInNewTab": true + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) \n**[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c)** \n\n#### Incident Datastream (Graph API) \n\n[Incidents](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06) \n[Alerts](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03) \n\n#### Description\n\nThis dashboard visualizes Email type events according to the [Microsoft Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide). \nThe data is collected from a configured Event Hub, using the M365 Defender Event datastream. \n\nThe supported event types are:\n- AdvancedHunting-EmailAttachmentInfo\n- AdvancedHunting-EmailEvents\n- AdvancedHunting-EmailPostDeliveryEvents\n- AdvancedHunting-EmailUrlInfo\n- AdvancedHunting-UrlClickEvents\n\n", + "openLinksInNewTab": false }, "title": "", "type": "markdown", @@ -119,16 +52,16 @@ } }, "gridData": { - "h": 2, - "i": "50e3ae2b-7187-469b-a991-13ea4569492d", - "w": 48, + "h": 61, + "i": "8c2183c4-d577-4aa3-9328-cf6d46e631f7", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "50e3ae2b-7187-469b-a991-13ea4569492d", - "title": "Dashboards [Logs Microsoft 365 Defender]", + "panelIndex": "8c2183c4-d577-4aa3-9328-cf6d46e631f7", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -136,52 +69,66 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-df8ea671-9e96-4b30-85c3-e0eb634ee70e", + "name": "ce53b013-53d2-4f0a-870c-be6ae4da7787", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d5ceef9-87de-42b6-a981-574091ddaf77", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "df8ea671-9e96-4b30-85c3-e0eb634ee70e": { + "f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff": { "columnOrder": [ - "7feaef80-0ace-4508-8ea4-795a53a2ecd0", - "44fe2bf6-6c4f-481e-bda4-1e05796174aa" + "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7", + "2b83d7c5-391a-432d-9700-c78804a13fd4" ], "columns": { - "44fe2bf6-6c4f-481e-bda4-1e05796174aa": { + "2b83d7c5-391a-432d-9700-c78804a13fd4": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "7feaef80-0ace-4508-8ea4-795a53a2ecd0": { + "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Email Category", + "label": "Threat Name", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "44fe2bf6-6c4f-481e-bda4-1e05796174aa", + "columnId": "2b83d7c5-391a-432d-9700-c78804a13fd4", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.category" + "sourceField": "m365_defender.event.threat.names" } }, "incompleteColumns": {} @@ -189,47 +136,169 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ce53b013-53d2-4f0a-870c-be6ae4da7787", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "2d5ceef9-87de-42b6-a981-574091ddaf77", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { - "categoryDisplay": "default", - "groups": [ - "7feaef80-0ace-4508-8ea4-795a53a2ecd0" + "accessors": [ + "2b83d7c5-391a-432d-9700-c78804a13fd4" ], - "layerId": "df8ea671-9e96-4b30-85c3-e0eb634ee70e", + "layerId": "f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", "layerType": "data", - "legendDisplay": "default", - "metric": "44fe2bf6-6c4f-481e-bda4-1e05796174aa", - "nestedLegend": false, - "numberDisplay": "percent" + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "2b83d7c5-391a-432d-9700-c78804a13fd4" + } + ] } ], - "shape": "pie" + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "6939c76b-e05e-41fb-8728-69ce782d3d09", - "w": 24, - "x": 0, - "y": 2 + "h": 21, + "i": "5572c205-4f5b-4ac8-bc7d-695de2ef1321", + "w": 13, + "x": 8, + "y": 0 }, - "panelIndex": "6939c76b-e05e-41fb-8728-69ce782d3d09", - "title": "Distribution of Email Events by Category [Logs Microsoft 365 Defender]", + "panelIndex": "5572c205-4f5b-4ac8-bc7d-695de2ef1321", + "title": "Distribution of Email Events by Threat Name", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -237,44 +306,41 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-b48c5875-8d80-41ee-986b-171379a92ce9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", + "name": "481bdb7e-497b-467d-9e23-8a6f4c33805c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da05e88d-22e7-40a8-8819-2adb0cb106b1", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff": { + "b48c5875-8d80-41ee-986b-171379a92ce9": { "columnOrder": [ - "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7", - "2b83d7c5-391a-432d-9700-c78804a13fd4" + "163b7190-f109-4515-82d9-1fe32acd885b", + "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a" ], "columns": { - "2b83d7c5-391a-432d-9700-c78804a13fd4": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7": { + "163b7190-f109-4515-82d9-1fe32acd885b": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Threat Name", + "label": "Email Action", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "2b83d7c5-391a-432d-9700-c78804a13fd4", + "columnId": "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a", "type": "column" }, "orderDirection": "desc", @@ -282,7 +348,16 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.threat.names" + "sourceField": "m365_defender.event.email.action" + }, + "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -290,31 +365,142 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "481bdb7e-497b-467d-9e23-8a6f4c33805c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "da05e88d-22e7-40a8-8819-2adb0cb106b1", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { "accessors": [ - "2b83d7c5-391a-432d-9700-c78804a13fd4" + "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a" ], - "layerId": "f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", + "layerId": "b48c5875-8d80-41ee-986b-171379a92ce9", "layerType": "data", "position": "top", - "seriesType": "bar_stacked", + "seriesType": "bar_horizontal", "showGridlines": false, - "xAccessor": "4f5bbd91-692c-4e56-a5e7-1549c9cce4e7" + "xAccessor": "163b7190-f109-4515-82d9-1fe32acd885b", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a" + } + ] } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, "valueLabels": "hide", "yLeftExtent": { "mode": "full" @@ -332,16 +518,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "5572c205-4f5b-4ac8-bc7d-695de2ef1321", - "w": 24, - "x": 24, - "y": 2 + "h": 21, + "i": "34103476-8fd1-4170-b643-c0f4234d87bc", + "w": 13, + "x": 21, + "y": 0 }, - "panelIndex": "5572c205-4f5b-4ac8-bc7d-695de2ef1321", - "title": "Distribution of Email Events by Threat Name [Logs Microsoft 365 Defender]", + "panelIndex": "34103476-8fd1-4170-b643-c0f4234d87bc", + "title": "Distribution of Email Events by Email Action", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -349,35 +535,41 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-c2532b46-df13-456c-99b6-5204add46c0f", + "name": "9670499a-c325-43be-89a6-124b9a92e3fd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "06afd76a-eaa7-4b00-98b0-e89f14dfb1a2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "c2532b46-df13-456c-99b6-5204add46c0f": { + "e51ee8f9-b1dc-4f35-8d22-bde68fe347a9": { "columnOrder": [ - "301d9024-a2a3-4c2d-9df0-275de1d39f03", - "81716fd7-8ff7-46dd-913a-906e436c3ef4" + "d99047d5-6011-44ad-9807-478d1b8dbee5", + "e2ae488c-1542-473a-81d3-313d647305c4" ], "columns": { - "301d9024-a2a3-4c2d-9df0-275de1d39f03": { + "d99047d5-6011-44ad-9807-478d1b8dbee5": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Threat Type", + "label": "Email Direction", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "81716fd7-8ff7-46dd-913a-906e436c3ef4", + "columnId": "e2ae488c-1542-473a-81d3-313d647305c4", "type": "column" }, "orderDirection": "desc", @@ -385,16 +577,16 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.threat.types" + "sourceField": "email.direction" }, - "81716fd7-8ff7-46dd-913a-906e436c3ef4": { + "e2ae488c-1542-473a-81d3-313d647305c4": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -402,7 +594,91 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9670499a-c325-43be-89a6-124b9a92e3fd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "06afd76a-eaa7-4b00-98b0-e89f14dfb1a2", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -411,17 +687,24 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "301d9024-a2a3-4c2d-9df0-275de1d39f03" - ], - "layerId": "c2532b46-df13-456c-99b6-5204add46c0f", + "layerId": "e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", "layerType": "data", - "legendDisplay": "default", - "metric": "81716fd7-8ff7-46dd-913a-906e436c3ef4", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "e2ae488c-1542-473a-81d3-313d647305c4" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d99047d5-6011-44ad-9807-478d1b8dbee5" + ] } ], + "palette": { + "name": "default", + "type": "palette" + }, "shape": "pie" } }, @@ -433,16 +716,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "fcb067a8-62ac-4774-b7d9-613ee37eae05", - "w": 24, - "x": 0, - "y": 17 + "h": 21, + "i": "37e4845f-8d0a-49c0-8638-ff98d662c7bb", + "w": 14, + "x": 34, + "y": 0 }, - "panelIndex": "fcb067a8-62ac-4774-b7d9-613ee37eae05", - "title": "Distribution of Email Events by Threat Type [Logs Microsoft 365 Defender]", + "panelIndex": "37e4845f-8d0a-49c0-8638-ff98d662c7bb", + "title": "Distribution of Email Events by Email Direction", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -450,35 +733,41 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-c2532b46-df13-456c-99b6-5204add46c0f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", + "name": "32f22794-4658-4fb4-a680-c1425b1912a7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e37a7aca-04ae-40f7-83be-becb064e886c", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "e51ee8f9-b1dc-4f35-8d22-bde68fe347a9": { + "c2532b46-df13-456c-99b6-5204add46c0f": { "columnOrder": [ - "d99047d5-6011-44ad-9807-478d1b8dbee5", - "e2ae488c-1542-473a-81d3-313d647305c4" + "301d9024-a2a3-4c2d-9df0-275de1d39f03", + "81716fd7-8ff7-46dd-913a-906e436c3ef4" ], "columns": { - "d99047d5-6011-44ad-9807-478d1b8dbee5": { + "301d9024-a2a3-4c2d-9df0-275de1d39f03": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Email Direction", + "label": "Threat Type", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "e2ae488c-1542-473a-81d3-313d647305c4", + "columnId": "81716fd7-8ff7-46dd-913a-906e436c3ef4", "type": "column" }, "orderDirection": "desc", @@ -486,16 +775,16 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "email.direction" + "sourceField": "m365_defender.event.threat.types" }, - "e2ae488c-1542-473a-81d3-313d647305c4": { + "81716fd7-8ff7-46dd-913a-906e436c3ef4": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -503,7 +792,91 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "32f22794-4658-4fb4-a680-c1425b1912a7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "e37a7aca-04ae-40f7-83be-becb064e886c", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -512,15 +885,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d99047d5-6011-44ad-9807-478d1b8dbee5" - ], - "layerId": "e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", + "layerId": "c2532b46-df13-456c-99b6-5204add46c0f", "layerType": "data", - "legendDisplay": "default", - "metric": "e2ae488c-1542-473a-81d3-313d647305c4", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "81716fd7-8ff7-46dd-913a-906e436c3ef4" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "301d9024-a2a3-4c2d-9df0-275de1d39f03" + ] } ], "shape": "pie" @@ -534,16 +910,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "37e4845f-8d0a-49c0-8638-ff98d662c7bb", - "w": 24, - "x": 24, - "y": 17 + "h": 20, + "i": "fcb067a8-62ac-4774-b7d9-613ee37eae05", + "w": 13, + "x": 8, + "y": 21 }, - "panelIndex": "37e4845f-8d0a-49c0-8638-ff98d662c7bb", - "title": "Distribution of Email Events by Email Direction [Logs Microsoft 365 Defender]", + "panelIndex": "fcb067a8-62ac-4774-b7d9-613ee37eae05", + "title": "Distribution of Email Events by Threat Type", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -551,18 +927,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f67b6a79-93f1-49c2-82ab-8ad2cc4efb20", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f67b6a79-93f1-49c2-82ab-8ad2cc4efb20", + "name": "9c904203-9139-43f9-a387-ed83dbadd999", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0f128d3a-1eab-4c33-910c-3135d63eaa87", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f67b6a79-93f1-49c2-82ab-8ad2cc4efb20": { "columnOrder": [ @@ -596,7 +978,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -604,7 +986,91 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "9c904203-9139-43f9-a387-ed83dbadd999", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "0f128d3a-1eab-4c33-910c-3135d63eaa87", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -613,15 +1079,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1739a22d-801c-4a23-a306-e5660e495124" - ], "layerId": "f67b6a79-93f1-49c2-82ab-8ad2cc4efb20", "layerType": "data", - "legendDisplay": "default", - "metric": "96355e27-9e06-420d-ba3b-5b055b3698bf", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "96355e27-9e06-420d-ba3b-5b055b3698bf" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1739a22d-801c-4a23-a306-e5660e495124" + ] } ], "shape": "pie" @@ -635,16 +1104,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 20, "i": "089de1f6-3285-40ff-bde9-6e9e97efa3b9", - "w": 24, - "x": 0, - "y": 32 + "w": 13, + "x": 21, + "y": 21 }, "panelIndex": "089de1f6-3285-40ff-bde9-6e9e97efa3b9", - "title": "Distribution of Email Events by Delivery Action [Logs Microsoft 365 Defender]", + "title": "Distribution of Email Events by Delivery Action", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -652,52 +1121,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-df8ea671-9e96-4b30-85c3-e0eb634ee70e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-b48c5875-8d80-41ee-986b-171379a92ce9", + "name": "f5f2cf98-83fa-493e-b23e-449c841e6c01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1a6fbe17-c12d-414d-b84d-4c4fdf0f3513", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "b48c5875-8d80-41ee-986b-171379a92ce9": { + "df8ea671-9e96-4b30-85c3-e0eb634ee70e": { "columnOrder": [ - "163b7190-f109-4515-82d9-1fe32acd885b", - "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a" + "7feaef80-0ace-4508-8ea4-795a53a2ecd0", + "44fe2bf6-6c4f-481e-bda4-1e05796174aa" ], "columns": { - "163b7190-f109-4515-82d9-1fe32acd885b": { + "44fe2bf6-6c4f-481e-bda4-1e05796174aa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "7feaef80-0ace-4508-8ea4-795a53a2ecd0": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Email Action", + "label": "Email Category", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a", + "columnId": "44fe2bf6-6c4f-481e-bda4-1e05796174aa", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.email.action" - }, - "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "sourceField": "m365_defender.event.category" } }, "incompleteColumns": {} @@ -705,7 +1180,91 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f5f2cf98-83fa-493e-b23e-449c841e6c01", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "1a6fbe17-c12d-414d-b84d-4c4fdf0f3513", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -713,50 +1272,42 @@ "visualization": { "layers": [ { - "accessors": [ - "3f3f67b9-5e07-4d25-bb0b-7d3ec9ec7d1a" - ], - "layerId": "b48c5875-8d80-41ee-986b-171379a92ce9", + "categoryDisplay": "default", + "layerId": "df8ea671-9e96-4b30-85c3-e0eb634ee70e", "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "163b7190-f109-4515-82d9-1fe32acd885b" + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "44fe2bf6-6c4f-481e-bda4-1e05796174aa" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7feaef80-0ace-4508-8ea4-795a53a2ecd0" + ] } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "34103476-8fd1-4170-b643-c0f4234d87bc", - "w": 24, - "x": 24, - "y": 32 + "h": 20, + "i": "6939c76b-e05e-41fb-8728-69ce782d3d09", + "w": 14, + "x": 34, + "y": 21 }, - "panelIndex": "34103476-8fd1-4170-b643-c0f4234d87bc", - "title": "Distribution of Email Events by Email Action [Logs Microsoft 365 Defender]", + "panelIndex": "6939c76b-e05e-41fb-8728-69ce782d3d09", + "title": "Distribution of Email Events by Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -764,18 +1315,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-610fcf9a-637e-4ef0-a825-bdc2b3610bd3", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-610fcf9a-637e-4ef0-a825-bdc2b3610bd3", + "name": "e57d0deb-bd32-4979-9488-ec5a9bcb3ecf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cb76f0fc-ec12-40bd-ae7f-7c369fde19e4", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "610fcf9a-637e-4ef0-a825-bdc2b3610bd3": { "columnOrder": [ @@ -790,7 +1347,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "e320bee1-b830-456a-9f1a-28b386ca575e": { "customLabel": true, @@ -817,12 +1374,112 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e57d0deb-bd32-4979-9488-ec5a9bcb3ecf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "cb76f0fc-ec12-40bd-ae7f-7c369fde19e4", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { "accessors": [ @@ -831,17 +1488,28 @@ "layerId": "610fcf9a-637e-4ef0-a825-bdc2b3610bd3", "layerType": "data", "position": "top", - "seriesType": "bar_stacked", + "seriesType": "bar", "showGridlines": false, - "xAccessor": "e320bee1-b830-456a-9f1a-28b386ca575e" + "xAccessor": "e320bee1-b830-456a-9f1a-28b386ca575e", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "17692121-be89-417b-9056-d04fcd779955" + } + ] } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, "valueLabels": "hide", "yLeftExtent": { "mode": "full" @@ -859,16 +1527,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 20, "i": "3e82a1c4-532d-46aa-90a1-b4604cc81c54", - "w": 24, - "x": 0, - "y": 47 + "w": 20, + "x": 8, + "y": 41 }, "panelIndex": "3e82a1c4-532d-46aa-90a1-b4604cc81c54", - "title": "Distribution of Email Events by Email Language [Logs Microsoft 365 Defender]", + "title": "Distribution of Email Events by Email Language", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -876,18 +1544,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-939806bc-53d9-4a84-af61-05e5d5bb793b", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-939806bc-53d9-4a84-af61-05e5d5bb793b", + "name": "898d9cb3-9611-4db6-96dd-b8f30fc04028", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "19f5bd6d-ae69-44d2-aff3-566923b3b758", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "939806bc-53d9-4a84-af61-05e5d5bb793b": { "columnOrder": [ @@ -902,7 +1576,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c8fbe70d-cae7-4e74-a460-095660138c61": { "customLabel": true, @@ -929,12 +1603,112 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "898d9cb3-9611-4db6-96dd-b8f30fc04028", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "19f5bd6d-ae69-44d2-aff3-566923b3b758", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-EmailAttachmentInfo", + "AdvancedHunting-EmailEvents", + "AdvancedHunting-EmailPostDeliveryEvents", + "AdvancedHunting-EmailUrlInfo", + "AdvancedHunting-UrlClickEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailAttachmentInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailPostDeliveryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-EmailUrlInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-UrlClickEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { "accessors": [ @@ -943,17 +1717,28 @@ "layerId": "939806bc-53d9-4a84-af61-05e5d5bb793b", "layerType": "data", "position": "top", - "seriesType": "bar_stacked", + "seriesType": "bar", "showGridlines": false, - "xAccessor": "c8fbe70d-cae7-4e74-a460-095660138c61" + "xAccessor": "c8fbe70d-cae7-4e74-a460-095660138c61", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "ae765a17-b96d-4359-9271-20ac0caef8d9" + } + ] } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, "valueLabels": "hide", "yLeftExtent": { "mode": "full" @@ -971,81 +1756,87 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 20, "i": "3befe23e-92aa-4170-9cf9-3811301a65ac", - "w": 24, - "x": 24, - "y": 47 + "w": 20, + "x": 28, + "y": 41 }, "panelIndex": "3befe23e-92aa-4170-9cf9-3811301a65ac", - "title": "Distribution of Email Events by Delivery Location [Logs Microsoft 365 Defender]", + "title": "Distribution of Email Events by Delivery Location", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] Email Events", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T09:12:17.096Z", "id": "m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "5572c205-4f5b-4ac8-bc7d-695de2ef1321:indexpattern-datasource-layer-f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "5572c205-4f5b-4ac8-bc7d-695de2ef1321:ce53b013-53d2-4f0a-870c-be6ae4da7787", "type": "index-pattern" }, { "id": "logs-*", - "name": "6939c76b-e05e-41fb-8728-69ce782d3d09:indexpattern-datasource-current-indexpattern", + "name": "5572c205-4f5b-4ac8-bc7d-695de2ef1321:2d5ceef9-87de-42b6-a981-574091ddaf77", "type": "index-pattern" }, { "id": "logs-*", - "name": "6939c76b-e05e-41fb-8728-69ce782d3d09:indexpattern-datasource-layer-df8ea671-9e96-4b30-85c3-e0eb634ee70e", + "name": "34103476-8fd1-4170-b643-c0f4234d87bc:indexpattern-datasource-layer-b48c5875-8d80-41ee-986b-171379a92ce9", "type": "index-pattern" }, { "id": "logs-*", - "name": "5572c205-4f5b-4ac8-bc7d-695de2ef1321:indexpattern-datasource-current-indexpattern", + "name": "34103476-8fd1-4170-b643-c0f4234d87bc:481bdb7e-497b-467d-9e23-8a6f4c33805c", "type": "index-pattern" }, { "id": "logs-*", - "name": "5572c205-4f5b-4ac8-bc7d-695de2ef1321:indexpattern-datasource-layer-f3aaa0a4-ce4a-45cb-a01a-3c94599f57ff", + "name": "34103476-8fd1-4170-b643-c0f4234d87bc:da05e88d-22e7-40a8-8819-2adb0cb106b1", "type": "index-pattern" }, { "id": "logs-*", - "name": "fcb067a8-62ac-4774-b7d9-613ee37eae05:indexpattern-datasource-current-indexpattern", + "name": "37e4845f-8d0a-49c0-8638-ff98d662c7bb:indexpattern-datasource-layer-e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", "type": "index-pattern" }, { "id": "logs-*", - "name": "fcb067a8-62ac-4774-b7d9-613ee37eae05:indexpattern-datasource-layer-c2532b46-df13-456c-99b6-5204add46c0f", + "name": "37e4845f-8d0a-49c0-8638-ff98d662c7bb:9670499a-c325-43be-89a6-124b9a92e3fd", "type": "index-pattern" }, { "id": "logs-*", - "name": "37e4845f-8d0a-49c0-8638-ff98d662c7bb:indexpattern-datasource-current-indexpattern", + "name": "37e4845f-8d0a-49c0-8638-ff98d662c7bb:06afd76a-eaa7-4b00-98b0-e89f14dfb1a2", "type": "index-pattern" }, { "id": "logs-*", - "name": "37e4845f-8d0a-49c0-8638-ff98d662c7bb:indexpattern-datasource-layer-e51ee8f9-b1dc-4f35-8d22-bde68fe347a9", + "name": "fcb067a8-62ac-4774-b7d9-613ee37eae05:indexpattern-datasource-layer-c2532b46-df13-456c-99b6-5204add46c0f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fcb067a8-62ac-4774-b7d9-613ee37eae05:32f22794-4658-4fb4-a680-c1425b1912a7", "type": "index-pattern" }, { "id": "logs-*", - "name": "089de1f6-3285-40ff-bde9-6e9e97efa3b9:indexpattern-datasource-current-indexpattern", + "name": "fcb067a8-62ac-4774-b7d9-613ee37eae05:e37a7aca-04ae-40f7-83be-becb064e886c", "type": "index-pattern" }, { @@ -1055,17 +1846,27 @@ }, { "id": "logs-*", - "name": "34103476-8fd1-4170-b643-c0f4234d87bc:indexpattern-datasource-current-indexpattern", + "name": "089de1f6-3285-40ff-bde9-6e9e97efa3b9:9c904203-9139-43f9-a387-ed83dbadd999", "type": "index-pattern" }, { "id": "logs-*", - "name": "34103476-8fd1-4170-b643-c0f4234d87bc:indexpattern-datasource-layer-b48c5875-8d80-41ee-986b-171379a92ce9", + "name": "089de1f6-3285-40ff-bde9-6e9e97efa3b9:0f128d3a-1eab-4c33-910c-3135d63eaa87", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6939c76b-e05e-41fb-8728-69ce782d3d09:indexpattern-datasource-layer-df8ea671-9e96-4b30-85c3-e0eb634ee70e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6939c76b-e05e-41fb-8728-69ce782d3d09:f5f2cf98-83fa-493e-b23e-449c841e6c01", "type": "index-pattern" }, { "id": "logs-*", - "name": "3e82a1c4-532d-46aa-90a1-b4604cc81c54:indexpattern-datasource-current-indexpattern", + "name": "6939c76b-e05e-41fb-8728-69ce782d3d09:1a6fbe17-c12d-414d-b84d-4c4fdf0f3513", "type": "index-pattern" }, { @@ -1075,13 +1876,48 @@ }, { "id": "logs-*", - "name": "3befe23e-92aa-4170-9cf9-3811301a65ac:indexpattern-datasource-current-indexpattern", + "name": "3e82a1c4-532d-46aa-90a1-b4604cc81c54:e57d0deb-bd32-4979-9488-ec5a9bcb3ecf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e82a1c4-532d-46aa-90a1-b4604cc81c54:cb76f0fc-ec12-40bd-ae7f-7c369fde19e4", "type": "index-pattern" }, { "id": "logs-*", "name": "3befe23e-92aa-4170-9cf9-3811301a65ac:indexpattern-datasource-layer-939806bc-53d9-4a84-af61-05e5d5bb793b", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3befe23e-92aa-4170-9cf9-3811301a65ac:898d9cb3-9611-4db6-96dd-b8f30fc04028", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3befe23e-92aa-4170-9cf9-3811301a65ac:19f5bd6d-ae69-44d2-aff3-566923b3b758", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c08dd0da-2066-4051-9e48-9330cecd79cf:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e3da88be-2a0e-4df5-9231-4b235e35e372:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_40e768fd-58fd-485d-908f-816fd083d07b:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c723136d-6842-4824-8a78-20c7376d28a9:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json b/packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json index fce842b767d..8677d09a45f 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06.json @@ -1,32 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"72c489e6-c07a-4c74-8c35-d70b4b4e8ccd\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"72c489e6-c07a-4c74-8c35-d70b4b4e8ccd\",\"fieldName\":\"m365_defender.incident.severity\",\"title\":\"Severity\",\"enhancements\":{}}},\"4f83317b-ba18-4a9a-b682-b822f79ee030\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"4f83317b-ba18-4a9a-b682-b822f79ee030\",\"fieldName\":\"m365_defender.incident.status\",\"title\":\"Incident Status\",\"enhancements\":{}}},\"7aef0b74-b368-4a23-a713-02f3fcc672fc\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"7aef0b74-b368-4a23-a713-02f3fcc672fc\",\"fieldName\":\"source.user.name\",\"title\":\"Source Username\",\"enhancements\":{}}},\"d4d6a591-6a26-412e-b0bd-9f71329143ba\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"d4d6a591-6a26-412e-b0bd-9f71329143ba\",\"fieldName\":\"host.name\",\"title\":\"Hostname\",\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender Incidents", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.incident" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.incident" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -36,6 +19,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -45,59 +30,9 @@ "hidePanelTitles": false, "savedVis": { "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "field": "event.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "filters": [ - { - "input": { - "language": "kuery", - "query": "not (source.user.name : * )" - }, - "label": "Unassigned Incident" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.status : \"active\"" - }, - "label": "Active Incident" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.status : \"redirected\" " - }, - "label": "Redirected Incident" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.status : \"resolved\" " - }, - "label": "Resolved Incident" - } - ] - }, - "schema": "group", - "type": "filters" - } - ], + "aggs": [], "searchSource": { "filter": [], - "index": "logs-*", "query": { "language": "kuery", "query": "" @@ -107,49 +42,26 @@ "description": "", "id": "", "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" + "fontSize": 12, + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) \n\n#### Incident Datastream (Graph API) \n\n**[Incidents](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06)** \n[Alerts](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03) \n\n#### Description\n\nThis dashboard visualizes Incident type events collected from the MS Graph API using the Incident Datastream\n\n", + "openLinksInNewTab": false }, "title": "", - "type": "metric", + "type": "markdown", "uiState": {} } }, "gridData": { - "h": 10, - "i": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e", - "w": 48, + "h": 90, + "i": "84cd7862-0002-4303-9fc7-53e6cbb6e78e", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e", - "title": "Incident Counts [Logs Microsoft 365 Defender]", + "panelIndex": "84cd7862-0002-4303-9fc7-53e6cbb6e78e", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -157,104 +69,185 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-961a470c-6271-4d2f-b553-646b67834136", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-a3705125-6c5c-43a6-a594-6d384c293ec9", + "name": "22e1bd27-885c-4745-b12d-9381e438538f", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "a3705125-6c5c-43a6-a594-6d384c293ec9": { + "961a470c-6271-4d2f-b553-646b67834136": { "columnOrder": [ - "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b", - "6eb417d0-e42a-4c55-b918-529d3fdd4825" + "6bf7c6d1-08bd-4258-bddc-b6df02a448be", + "fee1e57d-1104-4aed-9686-37ba38f74f2e", + "fee1e57d-1104-4aed-9686-37ba38f74f2eX0", + "fee1e57d-1104-4aed-9686-37ba38f74f2eX1" ], "columns": { - "6eb417d0-e42a-4c55-b918-529d3fdd4825": { + "6bf7c6d1-08bd-4258-bddc-b6df02a448be": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "not (source.user.name : * )" + }, + "label": "Unassigned Incident" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.status : \"active\"" + }, + "label": "Active Incident" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.status : \"redirected\" " + }, + "label": "Redirected Incident" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.status : \"resolved\" " + }, + "label": "Resolved Incident" + } + ] + }, + "scale": "ordinal" + }, + "fee1e57d-1104-4aed-9686-37ba38f74f2e": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(event.id), 0)", + "isFormulaBroken": false + }, + "references": [ + "fee1e57d-1104-4aed-9686-37ba38f74f2eX1" + ], + "scale": "ratio" + }, + "fee1e57d-1104-4aed-9686-37ba38f74f2eX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, "scale": "ratio", "sourceField": "event.id" }, - "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b": { + "fee1e57d-1104-4aed-9686-37ba38f74f2eX1": { "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "Timestamp", - "operationType": "date_histogram", + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", + "operationType": "math", "params": { - "interval": "auto" + "tinymathAst": { + "args": [ + "fee1e57d-1104-4aed-9686-37ba38f74f2eX0", + 0 + ], + "location": { + "max": 35, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(event.id), 0)", + "type": "function" + } }, - "scale": "interval", - "sourceField": "@timestamp" + "references": [ + "fee1e57d-1104-4aed-9686-37ba38f74f2eX0" + ], + "scale": "ratio" } }, "incompleteColumns": {} } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "22e1bd27-885c-4745-b12d-9381e438538f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ - { - "accessors": [ - "6eb417d0-e42a-4c55-b918-529d3fdd4825" - ], - "layerId": "a3705125-6c5c-43a6-a594-6d384c293ec9", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "breakdownByAccessor": "6bf7c6d1-08bd-4258-bddc-b6df02a448be", + "color": "#6092C0", + "layerId": "961a470c-6271-4d2f-b553-646b67834136", + "layerType": "data", + "maxCols": 4, + "metricAccessor": "fee1e57d-1104-4aed-9686-37ba38f74f2e" } }, - "title": "", + "title": "Incident Counts [Logs Microsoft 365 Defender] (converted)", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsMetric" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53", - "w": 24, - "x": 0, - "y": 10 + "h": 8, + "i": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e", + "w": 40, + "x": 8, + "y": 0 }, - "panelIndex": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53", - "title": "Count of Incidents Over Time [Logs Microsoft 365 Defender]", + "panelIndex": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e", + "title": "Incident Counts [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -262,18 +255,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-19999c0c-be9d-43ba-994a-72fadb61fabc", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-19999c0c-be9d-43ba-994a-72fadb61fabc", + "name": "ce3e96ee-3a9d-477a-ac37-db9a950d836d", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "19999c0c-be9d-43ba-994a-72fadb61fabc": { "columnOrder": [ @@ -315,7 +309,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ce3e96ee-3a9d-477a-ac37-db9a950d836d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -324,15 +342,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "330afb86-6197-4204-b9d3-49fb9d878111" - ], "layerId": "19999c0c-be9d-43ba-994a-72fadb61fabc", "layerType": "data", - "legendDisplay": "default", - "metric": "8e73def1-b551-4bc3-9676-6bfe825f308f", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "8e73def1-b551-4bc3-9676-6bfe825f308f" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "330afb86-6197-4204-b9d3-49fb9d878111" + ] } ], "shape": "pie" @@ -346,16 +367,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 19, "i": "09a42be0-f530-4662-a284-5ad7d3264935", - "w": 24, - "x": 24, - "y": 10 + "w": 16, + "x": 8, + "y": 8 }, "panelIndex": "09a42be0-f530-4662-a284-5ad7d3264935", "title": "Distribution of Incidents by Severity [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -363,72 +384,67 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-7f55a9ab-9515-4d17-844d-c925b2ccdbd1", + "name": "b5cb2c9c-2731-4f8b-8001-4c674d131b67", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "7f55a9ab-9515-4d17-844d-c925b2ccdbd1": { + "f41e1d1a-0dc1-4416-b48b-a04c4e59d46c": { "columnOrder": [ - "2aac5941-40f3-49f3-b190-017c0344ccff", - "2a8142cf-a21f-4110-b91a-5c375ba86559", - "390fe35a-52fb-42e9-8dcf-2e647d8e4e51" + "d7cb197f-5b47-4ac1-a0c4-587c7b267a98", + "b59d6974-6241-4f24-a665-b75ddb367dca", + "df079051-f9c4-455e-9b45-991460a206a2" ], "columns": { - "2a8142cf-a21f-4110-b91a-5c375ba86559": { + "b59d6974-6241-4f24-a665-b75ddb367dca": { "customLabel": true, - "dataType": "string", + "dataType": "date", "isBucketed": true, - "label": "Incident ID", - "operationType": "terms", + "label": "Timestamp", + "operationType": "date_histogram", "params": { - "missingBucket": false, - "orderBy": { - "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ordinal", - "sourceField": "event.id" + "scale": "interval", + "sourceField": "@timestamp" }, - "2aac5941-40f3-49f3-b190-017c0344ccff": { + "d7cb197f-5b47-4ac1-a0c4-587c7b267a98": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Incident Name", + "label": "Severity", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51", + "columnId": "df079051-f9c4-455e-9b45-991460a206a2", "type": "column" }, "orderDirection": "desc", "otherBucket": false, - "size": 10 + "size": 6 }, "scale": "ordinal", - "sourceField": "m365_defender.incident.display_name" + "sourceField": "m365_defender.incident.severity" }, - "390fe35a-52fb-42e9-8dcf-2e647d8e4e51": { + "df079051-f9c4-455e-9b45-991460a206a2": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Alert Count", + "label": "Count", "operationType": "unique_count", "scale": "ratio", - "sourceField": "m365_defender.incident.alert.id" + "sourceField": "event.id" } }, "incompleteColumns": {} @@ -436,46 +452,84 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b5cb2c9c-2731-4f8b-8001-4c674d131b67", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "columnId": "2aac5941-40f3-49f3-b190-017c0344ccff" - }, - { - "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51" - }, + "layers": [ { - "columnId": "2a8142cf-a21f-4110-b91a-5c375ba86559", - "isTransposed": false + "accessors": [ + "df079051-f9c4-455e-9b45-991460a206a2" + ], + "layerId": "f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "d7cb197f-5b47-4ac1-a0c4-587c7b267a98", + "xAccessor": "b59d6974-6241-4f24-a665-b75ddb367dca" } ], - "layerId": "7f55a9ab-9515-4d17-844d-c925b2ccdbd1", - "layerType": "data" + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789", + "h": 19, + "i": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b", "w": 24, - "x": 0, - "y": 25 + "x": 24, + "y": 8 }, - "panelIndex": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789", - "title": "Incident with Highest Count of Alerts [Logs Microsoft 365 Defender]", + "panelIndex": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b", + "title": "Severity Over Time [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -483,65 +537,47 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-a3705125-6c5c-43a6-a594-6d384c293ec9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", + "name": "a77281bd-3237-4d8d-b908-18a4a562b070", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "f41e1d1a-0dc1-4416-b48b-a04c4e59d46c": { + "a3705125-6c5c-43a6-a594-6d384c293ec9": { "columnOrder": [ - "d7cb197f-5b47-4ac1-a0c4-587c7b267a98", - "b59d6974-6241-4f24-a665-b75ddb367dca", - "df079051-f9c4-455e-9b45-991460a206a2" + "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b", + "6eb417d0-e42a-4c55-b918-529d3fdd4825" ], "columns": { - "b59d6974-6241-4f24-a665-b75ddb367dca": { + "6eb417d0-e42a-4c55-b918-529d3fdd4825": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "event.id" + }, + "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b": { "customLabel": true, "dataType": "date", "isBucketed": true, "label": "Timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", "sourceField": "@timestamp" - }, - "d7cb197f-5b47-4ac1-a0c4-587c7b267a98": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Severity", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "df079051-f9c4-455e-9b45-991460a206a2", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 6 - }, - "scale": "ordinal", - "sourceField": "m365_defender.incident.severity" - }, - "df079051-f9c4-455e-9b45-991460a206a2": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "event.id" } }, "incompleteColumns": {} @@ -549,7 +585,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a77281bd-3237-4d8d-b908-18a4a562b070", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -558,19 +618,19 @@ "layers": [ { "accessors": [ - "df079051-f9c4-455e-9b45-991460a206a2" + "6eb417d0-e42a-4c55-b918-529d3fdd4825" ], - "layerId": "f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", + "layerId": "a3705125-6c5c-43a6-a594-6d384c293ec9", "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "d7cb197f-5b47-4ac1-a0c4-587c7b267a98", - "xAccessor": "b59d6974-6241-4f24-a665-b75ddb367dca" + "xAccessor": "c4f1dfee-74d4-4ffb-8a53-6daf6b7c339b" } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -592,98 +652,266 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b", - "w": 24, - "x": 24, - "y": 25 + "h": 16, + "i": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53", + "w": 40, + "x": 8, + "y": 27 }, - "panelIndex": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b", - "title": "Severity Over Time [Logs Microsoft 365 Defender]", + "panelIndex": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53", + "title": "Count of Incidents Over Time [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7f55a9ab-9515-4d17-844d-c925b2ccdbd1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "644633f8-cafb-4bfd-8a03-4a1e7c1146e7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7f55a9ab-9515-4d17-844d-c925b2ccdbd1": { + "columnOrder": [ + "2aac5941-40f3-49f3-b190-017c0344ccff", + "2a8142cf-a21f-4110-b91a-5c375ba86559", + "390fe35a-52fb-42e9-8dcf-2e647d8e4e51" + ], + "columns": { + "2a8142cf-a21f-4110-b91a-5c375ba86559": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Incident ID", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.id" + }, + "2aac5941-40f3-49f3-b190-017c0344ccff": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Incident Name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "m365_defender.incident.display_name" + }, + "390fe35a-52fb-42e9-8dcf-2e647d8e4e51": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Alert Count", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "m365_defender.incident.alert.id" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "644633f8-cafb-4bfd-8a03-4a1e7c1146e7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2aac5941-40f3-49f3-b190-017c0344ccff" + }, + { + "columnId": "390fe35a-52fb-42e9-8dcf-2e647d8e4e51" + }, + { + "columnId": "2a8142cf-a21f-4110-b91a-5c375ba86559", + "isTransposed": false + } + ], + "layerId": "7f55a9ab-9515-4d17-844d-c925b2ccdbd1", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789", + "w": 40, + "x": 8, + "y": 43 + }, + "panelIndex": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789", + "title": "Incident with Highest Count of Alerts [Logs Microsoft 365 Defender]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { "enhancements": {} }, "gridData": { - "h": 24, + "h": 32, "i": "b3cf43f7-84a7-4d89-b9ca-8bbac00f67a0", - "w": 48, - "x": 0, - "y": 40 + "w": 40, + "x": 8, + "y": 59 }, "panelIndex": "b3cf43f7-84a7-4d89-b9ca-8bbac00f67a0", "panelRefName": "panel_b3cf43f7-84a7-4d89-b9ca-8bbac00f67a0", "type": "search", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] Incident", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T08:56:36.875Z", "id": "m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e:indexpattern-datasource-layer-961a470c-6271-4d2f-b553-646b67834136", "type": "index-pattern" }, { "id": "logs-*", - "name": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "0bc0ee87-64be-46bf-89ac-3a3c17f3ab7e:22e1bd27-885c-4745-b12d-9381e438538f", "type": "index-pattern" }, { "id": "logs-*", - "name": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53:indexpattern-datasource-current-indexpattern", + "name": "09a42be0-f530-4662-a284-5ad7d3264935:indexpattern-datasource-layer-19999c0c-be9d-43ba-994a-72fadb61fabc", "type": "index-pattern" }, { "id": "logs-*", - "name": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53:indexpattern-datasource-layer-a3705125-6c5c-43a6-a594-6d384c293ec9", + "name": "09a42be0-f530-4662-a284-5ad7d3264935:ce3e96ee-3a9d-477a-ac37-db9a950d836d", "type": "index-pattern" }, { "id": "logs-*", - "name": "09a42be0-f530-4662-a284-5ad7d3264935:indexpattern-datasource-current-indexpattern", + "name": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b:indexpattern-datasource-layer-f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", "type": "index-pattern" }, { "id": "logs-*", - "name": "09a42be0-f530-4662-a284-5ad7d3264935:indexpattern-datasource-layer-19999c0c-be9d-43ba-994a-72fadb61fabc", + "name": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b:b5cb2c9c-2731-4f8b-8001-4c674d131b67", "type": "index-pattern" }, { "id": "logs-*", - "name": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789:indexpattern-datasource-current-indexpattern", + "name": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53:indexpattern-datasource-layer-a3705125-6c5c-43a6-a594-6d384c293ec9", "type": "index-pattern" }, { "id": "logs-*", - "name": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789:indexpattern-datasource-layer-7f55a9ab-9515-4d17-844d-c925b2ccdbd1", + "name": "e8dcdb05-dc55-4c3d-ba79-d043d3987e53:a77281bd-3237-4d8d-b908-18a4a562b070", "type": "index-pattern" }, { "id": "logs-*", - "name": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b:indexpattern-datasource-current-indexpattern", + "name": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789:indexpattern-datasource-layer-7f55a9ab-9515-4d17-844d-c925b2ccdbd1", "type": "index-pattern" }, { "id": "logs-*", - "name": "b2cc378e-bce4-4769-9778-2f7f4fcb0f9b:indexpattern-datasource-layer-f41e1d1a-0dc1-4416-b48b-a04c4e59d46c", + "name": "ae3a1a20-4ff4-4e3d-9bbc-ccb240662789:644633f8-cafb-4bfd-8a03-4a1e7c1146e7", "type": "index-pattern" }, { "id": "m365_defender-fcf25960-44af-11ed-8375-0168a9970c06", "name": "b3cf43f7-84a7-4d89-b9ca-8bbac00f67a0:panel_b3cf43f7-84a7-4d89-b9ca-8bbac00f67a0", "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_72c489e6-c07a-4c74-8c35-d70b4b4e8ccd:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_4f83317b-ba18-4a9a-b682-b822f79ee030:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_7aef0b74-b368-4a23-a713-02f3fcc672fc:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_d4d6a591-6a26-412e-b0bd-9f71329143ba:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json b/packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json index 996fd69795a..f47c5af7247 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c.json @@ -1,114 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"007a099d-f3bc-4c46-a48e-629e06a614e4\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"007a099d-f3bc-4c46-a48e-629e06a614e4\",\"fieldName\":\"host.name\",\"title\":\"Hostname\",\"enhancements\":{}}},\"d441e8a1-87f4-46b1-8dff-bf9bb88762d3\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"d441e8a1-87f4-46b1-8dff-bf9bb88762d3\",\"fieldName\":\"m365_defender.event.category\",\"title\":\"Event Type\",\"enhancements\":{}}},\"6fa76f5f-16ed-4419-8b16-fe5581d21067\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"6fa76f5f-16ed-4419-8b16-fe5581d21067\",\"fieldName\":\"host.os.full\",\"title\":\"OS Platform\",\"enhancements\":{}}},\"175fd1a8-7429-4e56-853b-057b124121de\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"175fd1a8-7429-4e56-853b-057b124121de\",\"fieldName\":\"host.type\",\"title\":\"Device Type\",\"selectedOptions\":[],\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender Device Events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.event" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.event" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Filter: Device", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "m365_defender.event.category", - "negate": false, - "params": [ - "AdvancedHunting-DeviceEvents", - "AdvancedHunting-DeviceFileCertificateInfo", - "AdvancedHunting-DeviceFileEvents", - "AdvancedHunting-DeviceImageLoadEvents", - "AdvancedHunting-DeviceInfo", - "AdvancedHunting-DeviceLogonEvents", - "AdvancedHunting-DeviceNetworkEvents", - "AdvancedHunting-DeviceNetworkInfo", - "AdvancedHunting-DeviceProcessEvents", - "AdvancedHunting-DeviceRegistryEvents" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceInfo" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -117,14 +18,16 @@ }, "optionsJSON": { "hidePanelTitles": false, - "syncColors": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": true, + "hidePanelTitles": false, "savedVis": { "data": { "aggs": [], @@ -140,8 +43,8 @@ "id": "", "params": { "fontSize": 12, - "markdown": "[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) | [App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) |\n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c)", - "openLinksInNewTab": true + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) \n**[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c)** \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) \n\n#### Incident Datastream (Graph API) \n\n[Incident Events](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06) \n[Log Events](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03) \n\n#### Description\n\nThis dashboard visualizes Device type events according to the [Microsoft Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide). \nThe data is collected from a configured Event Hub, using the M365 Defender Event datastream.\n\nThe supported event types are:\n- AdvancedHunting-DeviceEvents\n- AdvancedHunting-DeviceFileCertificateInfo\n- AdvancedHunting-DeviceFileEvents\n- AdvancedHunting-DeviceImageLoadEvents\n- AdvancedHunting-DeviceInfo\n- AdvancedHunting-DeviceLogonEvents\n- AdvancedHunting-DeviceNetworkEvents\n- AdvancedHunting-DeviceNetworkInfo\n- AdvancedHunting-DeviceProcessEvents\n- AdvancedHunting-DeviceRegistryEvents", + "openLinksInNewTab": false }, "title": "", "type": "markdown", @@ -149,16 +52,16 @@ } }, "gridData": { - "h": 2, - "i": "362bfb2d-9787-42ec-bc32-5c7c72d43e4f", - "w": 48, + "h": 82, + "i": "87171286-8e9b-4ee6-9669-02a89ac76bbc", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "362bfb2d-9787-42ec-bc32-5c7c72d43e4f", - "title": "Dashboards [Logs Microsoft 365 Defender]", + "panelIndex": "87171286-8e9b-4ee6-9669-02a89ac76bbc", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -166,18 +69,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "name": "e7b0412d-2f44-423e-9b0a-897f2884c618", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a0dd3daf-229c-4ea3-b328-cfc256bc6364", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ @@ -188,7 +97,7 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Number of Devices", + "label": "Unique Devices", "operationType": "unique_count", "scale": "ratio", "sourceField": "host.id" @@ -199,15 +108,136 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "e7b0412d-2f44-423e-9b0a-897f2884c618", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a0dd3daf-229c-4ea3-b328-cfc256bc6364", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "accessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "color": "#6092C0", "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", - "layerType": "data" + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "Based on host.id" } }, "title": "", @@ -215,19 +245,19 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": true + "hidePanelTitles": false }, "gridData": { - "h": 11, + "h": 7, "i": "eef7f556-05f9-4b08-bc1a-f87957c5919d", - "w": 16, - "x": 0, - "y": 2 + "w": 5, + "x": 8, + "y": 0 }, "panelIndex": "eef7f556-05f9-4b08-bc1a-f87957c5919d", - "title": "Count of Devices [Logs Microsoft 365 Defender]", + "title": "Unique Devices", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -235,32 +265,47 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bb4c45e4-7cbb-43a7-acea-e064d71d78dd", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-57bf0095-31d3-4abc-8a39-37efbc0a3efd", + "name": "1e2f916a-dbc2-40ef-817c-2f44e1a7a014", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "57bf0095-31d3-4abc-8a39-37efbc0a3efd": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "ac137775-8aaa-4467-ae67-7c47df5651f6" + "c26f4a59-33a0-48c9-8a07-9031a1053d36" ], "columns": { - "ac137775-8aaa-4467-ae67-7c47df5651f6": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Number of Domains", - "operationType": "unique_count", + "label": "Devices Not Onboarded", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, "scale": "ratio", - "sourceField": "user.domain" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -268,15 +313,93 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bb4c45e4-7cbb-43a7-acea-e064d71d78dd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1e2f916a-dbc2-40ef-817c-2f44e1a7a014", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.onboarding_status", + "index": "logs-*", + "key": "m365_defender.event.onboarding_status", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "m365_defender.event.onboarding_status" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.onboarding_status", + "index": "logs-*", + "key": "m365_defender.event.onboarding_status", + "negate": true, + "params": { + "query": "Onboarded" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.onboarding_status": "Onboarded" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "accessor": "ac137775-8aaa-4467-ae67-7c47df5651f6", - "layerId": "57bf0095-31d3-4abc-8a39-37efbc0a3efd", - "layerType": "data" + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" } }, "title": "", @@ -284,19 +407,19 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": true + "hidePanelTitles": false }, "gridData": { - "h": 11, - "i": "6896510c-66c5-47b7-ae3f-d0521dd24ea3", - "w": 16, - "x": 16, - "y": 2 + "h": 7, + "i": "d2da5421-b966-4fa6-9f0b-67cf5699fe07", + "w": 5, + "x": 13, + "y": 0 }, - "panelIndex": "6896510c-66c5-47b7-ae3f-d0521dd24ea3", - "title": "Count of Account Domain [Logs Microsoft 365 Defender]", + "panelIndex": "d2da5421-b966-4fa6-9f0b-67cf5699fe07", + "title": "Devices Not Onboarded", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -304,36 +427,47 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "28f49b0a-d5ff-4876-a5ae-407a013e33b2", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-dca2664e-3694-4056-8386-1b651bbb7e3b", + "name": "fa186e74-e31b-46d0-b565-5aa2d8927af3", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "dca2664e-3694-4056-8386-1b651bbb7e3b": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "5c35b47f-ce23-4f14-aa83-3925d5a38bf1" + "c26f4a59-33a0-48c9-8a07-9031a1053d36" ], "columns": { - "5c35b47f-ce23-4f14-aa83-3925d5a38bf1": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { "customLabel": true, "dataType": "number", - "filter": { - "language": "kuery", - "query": "m365_defender.event.is_signed : true and m365_defender.event.is_trusted : true" - }, "isBucketed": false, - "label": "Devices with Signed and Trusted Certificates", + "label": "Devices Onboarded", "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -341,15 +475,63 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "28f49b0a-d5ff-4876-a5ae-407a013e33b2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.onboarding_status", + "index": "fa186e74-e31b-46d0-b565-5aa2d8927af3", + "key": "m365_defender.event.onboarding_status", + "negate": false, + "params": { + "query": "Onboarded" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.onboarding_status": "Onboarded" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "accessor": "5c35b47f-ce23-4f14-aa83-3925d5a38bf1", - "layerId": "dca2664e-3694-4056-8386-1b651bbb7e3b", - "layerType": "data" + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" } }, "title": "", @@ -357,19 +539,19 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": true + "hidePanelTitles": false }, "gridData": { - "h": 11, - "i": "1797b9be-a8f4-4857-9660-be64394b90b3", - "w": 16, - "x": 32, - "y": 2 + "h": 7, + "i": "4cdcfcff-9592-43e6-abf5-cba2e4b82e1e", + "w": 5, + "x": 18, + "y": 0 }, - "panelIndex": "1797b9be-a8f4-4857-9660-be64394b90b3", - "title": "Count of Device having Signed and Trusted Certificate [Logs Microsoft 365 Defender]", + "panelIndex": "4cdcfcff-9592-43e6-abf5-cba2e4b82e1e", + "title": "Devices Onboarded", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -377,52 +559,47 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1c359492-1f19-4eaa-8168-b69c0280046e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0efca441-e712-4d30-a594-d35d6d172c88", + "name": "1898879e-99e7-472e-8eb0-1bcb24cd981e", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "0efca441-e712-4d30-a594-d35d6d172c88": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "339fddcc-51db-451b-8eeb-89d17fe53f88", - "8d657292-7680-4ed1-83fe-964929da5bee" + "c26f4a59-33a0-48c9-8a07-9031a1053d36" ], "columns": { - "339fddcc-51db-451b-8eeb-89d17fe53f88": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Device Category", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "8d657292-7680-4ed1-83fe-964929da5bee", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "m365_defender.event.category" - }, - "8d657292-7680-4ed1-83fe-964929da5bee": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", + "label": "File Signed", "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -430,189 +607,607 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1c359492-1f19-4eaa-8168-b69c0280046e", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": { + "query": "AdvancedHunting-DeviceFileCertificateInfo" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "file.code_signature.exists", + "index": "logs-*", + "key": "file.code_signature.exists", + "negate": false, + "params": { + "query": true + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "file.code_signature.exists": true + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1898879e-99e7-472e-8eb0-1bcb24cd981e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "8d657292-7680-4ed1-83fe-964929da5bee" - ], - "layerId": "0efca441-e712-4d30-a594-d35d6d172c88", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "339fddcc-51db-451b-8eeb-89d17fe53f88" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsMetric" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "0364cf09-1da8-459d-9267-db9ccab7b6b4", - "w": 48, - "x": 0, - "y": 22 + "h": 7, + "i": "bdad135a-5476-4fa5-b9e2-49abeba859ab", + "w": 5, + "x": 23, + "y": 0 }, - "panelIndex": "0364cf09-1da8-459d-9267-db9ccab7b6b4", - "title": "Distribution of Device Events by Category [Logs Microsoft 365 Defender]", + "panelIndex": "bdad135a-5476-4fa5-b9e2-49abeba859ab", + "title": "Files Signed", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Certificates" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "filters": [ - { - "input": { - "language": "kuery", - "query": "m365_defender.event.is_signed : true" - }, - "label": "Signed" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ea8e34b-c360-4515-8c9a-f74c86fe9d8b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48d451bc-c265-48c3-ba55-e5b1aa37638b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { + "columnOrder": [ + "c26f4a59-33a0-48c9-8a07-9031a1053d36" + ], + "columns": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "File Unsigned", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8ea8e34b-c360-4515-8c9a-f74c86fe9d8b", + "negate": false, + "params": [ { - "input": { - "language": "kuery", - "query": "m365_defender.event.is_signed: false" + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": { + "query": "AdvancedHunting-DeviceFileCertificateInfo" + }, + "type": "phrase" }, - "label": "Unsigned" + "query": { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + } }, { - "input": { - "language": "kuery", - "query": "m365_defender.event.is_trusted : true" + "meta": { + "alias": null, + "disabled": false, + "field": "file.code_signature.exists", + "index": "logs-*", + "key": "file.code_signature.exists", + "negate": false, + "params": { + "query": false + }, + "type": "phrase" }, - "label": "Trusted" + "query": { + "match_phrase": { + "file.code_signature.exists": false + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "48d451bc-c265-48c3-ba55-e5b1aa37638b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "43d8b62e-e75c-4bd4-9803-6218cf8e4f28", + "w": 5, + "x": 28, + "y": 0 + }, + "panelIndex": "43d8b62e-e75c-4bd4-9803-6218cf8e4f28", + "title": "Files Unsigned", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26f2a7e3-8f13-40e5-bce2-4b2dd3f08dc4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17012638-69b0-481b-928e-50bc42099035", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { + "columnOrder": [ + "c26f4a59-33a0-48c9-8a07-9031a1053d36" + ], + "columns": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Certificates Trusted", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "26f2a7e3-8f13-40e5-bce2-4b2dd3f08dc4", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": { + "query": "AdvancedHunting-DeviceFileCertificateInfo" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + } }, { - "input": { - "language": "kuery", - "query": "m365_defender.event.is_trusted : false" + "meta": { + "alias": null, + "disabled": false, + "field": "file.code_signature.trusted", + "index": "logs-*", + "key": "file.code_signature.trusted", + "negate": false, + "params": { + "query": true + }, + "type": "phrase" }, - "label": "Untrusted" + "query": { + "match_phrase": { + "file.code_signature.trusted": true + } + } } - ] + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "17012638-69b0-481b-928e-50bc42099035", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" }, - "schema": "group", - "type": "filters" + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } } ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" } }, - "description": "", - "id": "", - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "570f73ac-a3af-48ee-849c-1b64e737b002", + "w": 5, + "x": 33, + "y": 0 + }, + "panelIndex": "570f73ac-a3af-48ee-849c-1b64e737b002", + "title": "Files Trusted", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "953d90f0-317e-4df8-a189-000736037076", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4b2d8da6-d241-43ac-a9e0-4af12cbf58ff", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { + "columnOrder": [ + "c26f4a59-33a0-48c9-8a07-9031a1053d36" + ], + "columns": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Certificates Untrusted", + "operationType": "count", + "params": { + "emptyAsNull": false, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "953d90f0-317e-4df8-a189-000736037076", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": { + "query": "AdvancedHunting-DeviceFileCertificateInfo" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "file.code_signature.trusted", + "index": "logs-*", + "key": "file.code_signature.trusted", + "negate": false, + "params": { + "query": false + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "file.code_signature.trusted": false + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} }, - "useRanges": false + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4b2d8da6-d241-43ac-a9e0-4af12cbf58ff", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "type": "metric" + "visualization": { + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "" + } }, "title": "", - "type": "metric", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 9, - "i": "80e0a931-5bd5-47eb-9f59-35020d52d6dd", - "w": 48, - "x": 0, - "y": 13 + "h": 7, + "i": "69254ab7-fc20-4db8-952e-76e4f2ffa4e9", + "w": 5, + "x": 38, + "y": 0 }, - "panelIndex": "80e0a931-5bd5-47eb-9f59-35020d52d6dd", - "title": "Device Certificate Information [Logs Microsoft 365 Defender]", - "type": "visualization", - "version": "7.16.0" + "panelIndex": "69254ab7-fc20-4db8-952e-76e4f2ffa4e9", + "title": "Files Untrusted", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -620,80 +1215,405 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f2489da3-1ef2-46be-8809-45cd8fd6e08f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-b65faae4-3ea7-44ce-8c73-3400dc2a953d", + "name": "5b88ee69-8299-4ca0-8684-4eb31dc7eca7", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "b65faae4-3ea7-44ce-8c73-3400dc2a953d": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "094552d3-7ec0-4d65-ab8b-bd6fe38af648", - "655c4afe-7e74-4a50-8b28-cc66865fd01e", - "0415ec71-bfc5-430d-ac31-9fd76b32b3fc" + "c26f4a59-33a0-48c9-8a07-9031a1053d36" ], "columns": { - "0415ec71-bfc5-430d-ac31-9fd76b32b3fc": { + "c26f4a59-33a0-48c9-8a07-9031a1053d36": { "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count", - "operationType": "count", + "label": "Unique Domains", + "operationType": "unique_count", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "user.domain" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "f2489da3-1ef2-46be-8809-45cd8fd6e08f", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } }, - "094552d3-7ec0-4d65-ab8b-bd6fe38af648": { + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5b88ee69-8299-4ca0-8684-4eb31dc7eca7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "layerType": "data", + "metricAccessor": "c26f4a59-33a0-48c9-8a07-9031a1053d36", + "subtitle": "Based on user.domain" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "0a439ec0-b0dd-41df-b1de-b761b68d6ffb", + "w": 5, + "x": 43, + "y": 0 + }, + "panelIndex": "0a439ec0-b0dd-41df-b1de-b761b68d6ffb", + "title": "Unique Domains", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2873ea87-14a2-4aa2-8031-3f5f778f28d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "70ce4539-c1d4-4b7f-b4f7-b1f460d0d699", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { + "columnOrder": [ + "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "60a8e5dd-e24e-4494-b839-da383f2484f9" + ], + "columns": { + "437edb9b-5df4-44f3-9fc6-1d0052b3297d": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Device Type", + "label": "Device Category", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "0415ec71-bfc5-430d-ac31-9fd76b32b3fc", + "columnId": "60a8e5dd-e24e-4494-b839-da383f2484f9", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, "size": 10 }, "scale": "ordinal", - "sourceField": "host.type" + "sourceField": "m365_defender.event.category" }, - "655c4afe-7e74-4a50-8b28-cc66865fd01e": { + "60a8e5dd-e24e-4494-b839-da383f2484f9": { "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Device Category", - "operationType": "terms", + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", "params": { - "missingBucket": false, - "orderBy": { - "columnId": "0415ec71-bfc5-430d-ac31-9fd76b32b3fc", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } }, - "scale": "ordinal", - "sourceField": "observer.type" + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2873ea87-14a2-4aa2-8031-3f5f778f28d1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "70ce4539-c1d4-4b7f-b4f7-b1f460d0d699", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } } - }, - "incompleteColumns": {} + ] } } } - }, - "filters": [], + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -718,34 +1638,31 @@ "layers": [ { "accessors": [ - "0415ec71-bfc5-430d-ac31-9fd76b32b3fc" + "60a8e5dd-e24e-4494-b839-da383f2484f9" ], - "layerId": "b65faae4-3ea7-44ce-8c73-3400dc2a953d", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "655c4afe-7e74-4a50-8b28-cc66865fd01e", - "xAccessor": "094552d3-7ec0-4d65-ab8b-bd6fe38af648" + "seriesType": "bar_horizontal", + "xAccessor": "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "60a8e5dd-e24e-4494-b839-da383f2484f9" + } + ] } ], "legend": { "isVisible": true, "position": "right" }, - "preferredSeriesType": "bar_stacked", + "preferredSeriesType": "bar_horizontal", "tickLabelsVisibilitySettings": { "x": true, "yLeft": true, "yRight": true }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "valueLabels": "hide" } }, "title": "", @@ -756,16 +1673,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "892e0c11-6847-4be0-8c53-9256d5bed8ae", - "w": 24, - "x": 0, - "y": 37 + "h": 21, + "i": "7cd71879-68ac-454b-a135-c6bacac2d77f", + "w": 20, + "x": 8, + "y": 7 }, - "panelIndex": "892e0c11-6847-4be0-8c53-9256d5bed8ae", - "title": "Distribution of Device Type by Device Category [Logs Microsoft 365 Defender]", + "panelIndex": "7cd71879-68ac-454b-a135-c6bacac2d77f", + "title": "Distribution of Device Events by Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -773,51 +1690,75 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54cb0ac8-edd5-4b99-b467-4a5c49b87e05", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-33420593-65e7-42ea-a730-38fd3565b83b", + "name": "36724591-c980-454c-a773-fa1b2591b218", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "33420593-65e7-42ea-a730-38fd3565b83b": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "e27ef4a8-7d46-449c-bd7a-7757d9774251", - "725f0f83-71da-4630-ac05-930b2d558624" + "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "60a8e5dd-e24e-4494-b839-da383f2484f9" ], "columns": { - "725f0f83-71da-4630-ac05-930b2d558624": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "e27ef4a8-7d46-449c-bd7a-7757d9774251": { + "437edb9b-5df4-44f3-9fc6-1d0052b3297d": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Onboarding Status", + "label": "Protocol", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "725f0f83-71da-4630-ac05-930b2d558624", + "columnId": "60a8e5dd-e24e-4494-b839-da383f2484f9", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, - "size": 5 + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.onboarding_status" + "sourceField": "network.protocol" + }, + "60a8e5dd-e24e-4494-b839-da383f2484f9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -825,47 +1766,195 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "54cb0ac8-edd5-4b99-b467-4a5c49b87e05", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "36724591-c980-454c-a773-fa1b2591b218", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, "layers": [ { - "categoryDisplay": "default", - "groups": [ - "e27ef4a8-7d46-449c-bd7a-7757d9774251" + "accessors": [ + "60a8e5dd-e24e-4494-b839-da383f2484f9" ], - "layerId": "33420593-65e7-42ea-a730-38fd3565b83b", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", "layerType": "data", - "legendDisplay": "default", - "metric": "725f0f83-71da-4630-ac05-930b2d558624", - "nestedLegend": false, - "numberDisplay": "percent" + "seriesType": "bar_horizontal", + "xAccessor": "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "60a8e5dd-e24e-4494-b839-da383f2484f9" + } + ] } ], - "shape": "pie" + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "a70a967c-289d-4d84-8ac4-1dbb1959bbd8", - "w": 24, - "x": 24, - "y": 37 + "h": 21, + "i": "12d3fd1a-bd2b-4612-84ba-aa2bb2060d78", + "w": 20, + "x": 28, + "y": 7 }, - "panelIndex": "a70a967c-289d-4d84-8ac4-1dbb1959bbd8", - "title": "Distribution of Device by Device Onboarding Status [Logs Microsoft 365 Defender]", + "panelIndex": "12d3fd1a-bd2b-4612-84ba-aa2bb2060d78", + "title": "Distribution of Device Events by Protocol", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -873,18 +1962,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f76bb73e-d4b6-4fa1-9329-2e9942dd9eb4", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f76bb73e-d4b6-4fa1-9329-2e9942dd9eb4", + "name": "5fbe60d0-db91-4d90-8078-74267201081b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f76bb73e-d4b6-4fa1-9329-2e9942dd9eb4": { "columnOrder": [ @@ -918,7 +2008,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -926,7 +2016,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5fbe60d0-db91-4d90-8078-74267201081b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -935,17 +2049,24 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "848b4914-cfa6-41d7-9d50-bef5904481db" - ], "layerId": "f76bb73e-d4b6-4fa1-9329-2e9942dd9eb4", "layerType": "data", "legendDisplay": "default", - "metric": "85e428bc-ca74-4660-87e5-c1d916524038", + "legendSize": "auto", + "metrics": [ + "85e428bc-ca74-4660-87e5-c1d916524038" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "848b4914-cfa6-41d7-9d50-bef5904481db" + ] } ], + "palette": { + "name": "default", + "type": "palette" + }, "shape": "pie" } }, @@ -957,16 +2078,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 18, "i": "3a2f0c3d-bd6d-44e4-b6c3-25d7f55dd608", - "w": 24, - "x": 0, - "y": 52 + "w": 20, + "x": 8, + "y": 28 }, "panelIndex": "3a2f0c3d-bd6d-44e4-b6c3-25d7f55dd608", - "title": "Distribution of Device by Device Logon Type [Logs Microsoft 365 Defender]", + "title": "Distribution of Device by Device Logon Type", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -974,52 +2095,97 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-d355aad4-5b79-4044-bbec-66923b1a8c84", + "name": "40219299-d96a-4725-a046-807b4c1d3972", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "d355aad4-5b79-4044-bbec-66923b1a8c84": { + "06ee28b9-429b-42e8-a83b-3a3f4eb16745": { "columnOrder": [ - "9f35467e-45dc-4aba-a6e1-99f1f88a02c9", - "376b6e23-3da1-47fe-a01f-a6d86fd34c8b" + "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "6e332bea-d1ec-4479-84ec-b52332226a4f", + "60a8e5dd-e24e-4494-b839-da383f2484f9" ], "columns": { - "376b6e23-3da1-47fe-a01f-a6d86fd34c8b": { + "437edb9b-5df4-44f3-9fc6-1d0052b3297d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Device Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "60a8e5dd-e24e-4494-b839-da383f2484f9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.type" + }, + "60a8e5dd-e24e-4494-b839-da383f2484f9": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "9f35467e-45dc-4aba-a6e1-99f1f88a02c9": { + "6e332bea-d1ec-4479-84ec-b52332226a4f": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Protocol", + "label": "Observer Type", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "376b6e23-3da1-47fe-a01f-a6d86fd34c8b", + "columnId": "60a8e5dd-e24e-4494-b839-da383f2484f9", "type": "column" }, "orderDirection": "desc", "otherBucket": true, - "size": 10 + "parentFormat": { + "id": "terms" + }, + "size": 3 }, "scale": "ordinal", - "sourceField": "network.protocol" + "sourceField": "observer.type" } }, "incompleteColumns": {} @@ -1027,7 +2193,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "40219299-d96a-4725-a046-807b4c1d3972", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1050,154 +2240,58 @@ "yRight": 0 }, "layers": [ - { - "accessors": [ - "376b6e23-3da1-47fe-a01f-a6d86fd34c8b" - ], - "layerId": "d355aad4-5b79-4044-bbec-66923b1a8c84", - "layerType": "data", - "seriesType": "bar", - "xAccessor": "9f35467e-45dc-4aba-a6e1-99f1f88a02c9" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "f048ae61-3e8e-41e4-b15d-c6fa3c261b54", - "w": 24, - "x": 24, - "y": 52 - }, - "panelIndex": "f048ae61-3e8e-41e4-b15d-c6fa3c261b54", - "title": "Distribution of Device Events by Protocol [Logs Microsoft 365 Defender]", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-8a8196f6-a696-4337-9a13-bbf9f8c796d5", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "8a8196f6-a696-4337-9a13-bbf9f8c796d5": { - "columnOrder": [ - "0cbc25e1-515c-4691-bca0-2fcf599c4744", - "04877ea1-36c6-49ea-8150-dc864c4f1041" - ], - "columns": { - "04877ea1-36c6-49ea-8150-dc864c4f1041": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "0cbc25e1-515c-4691-bca0-2fcf599c4744": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "OS Platform", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "04877ea1-36c6-49ea-8150-dc864c4f1041", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "host.os.platform" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "0cbc25e1-515c-4691-bca0-2fcf599c4744" + { + "accessors": [ + "60a8e5dd-e24e-4494-b839-da383f2484f9" ], - "layerId": "8a8196f6-a696-4337-9a13-bbf9f8c796d5", + "layerId": "06ee28b9-429b-42e8-a83b-3a3f4eb16745", "layerType": "data", - "legendDisplay": "default", - "metric": "04877ea1-36c6-49ea-8150-dc864c4f1041", - "nestedLegend": false, - "numberDisplay": "percent" + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_horizontal", + "splitAccessor": "6e332bea-d1ec-4479-84ec-b52332226a4f", + "xAccessor": "437edb9b-5df4-44f3-9fc6-1d0052b3297d", + "yConfig": [ + { + "color": "#54b399", + "forAccessor": "60a8e5dd-e24e-4494-b839-da383f2484f9" + } + ] } ], - "shape": "pie" + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "a9117849-31e0-4fb5-8750-3545eb3cb61c", - "w": 24, - "x": 0, - "y": 67 + "h": 18, + "i": "de11f567-5bec-4717-a49c-98f6e34250e5", + "w": 20, + "x": 28, + "y": 28 }, - "panelIndex": "a9117849-31e0-4fb5-8750-3545eb3cb61c", - "title": "Distribution of Device Events by OS Platform [Logs Microsoft 365 Defender]", + "panelIndex": "de11f567-5bec-4717-a49c-98f6e34250e5", + "title": "Distribution of Device Type by Device Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1205,44 +2299,45 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-673b5af9-08a7-4b42-83e5-627b2f1bfa6e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-75887628-a5d8-46fc-83f2-7f2341d66647", + "name": "742728c6-cc98-4204-a3fa-65dda2935e22", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "75887628-a5d8-46fc-83f2-7f2341d66647": { + "673b5af9-08a7-4b42-83e5-627b2f1bfa6e": { "columnOrder": [ - "7c9827d1-c527-4553-a520-eeda632e2ebb", - "22456f06-a0fb-40e4-9849-c68f0d7eb120" + "72c3d801-754e-4172-9bc6-10f51ab34110", + "4d3ff440-84a4-4118-95bb-b5da7d406f3f" ], "columns": { - "22456f06-a0fb-40e4-9849-c68f0d7eb120": { + "4d3ff440-84a4-4118-95bb-b5da7d406f3f": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "7c9827d1-c527-4553-a520-eeda632e2ebb": { + "72c3d801-754e-4172-9bc6-10f51ab34110": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Failure Reason", + "label": "Certificate Issuer", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "22456f06-a0fb-40e4-9849-c68f0d7eb120", + "columnId": "4d3ff440-84a4-4118-95bb-b5da7d406f3f", "type": "column" }, "orderDirection": "desc", @@ -1250,7 +2345,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.failure_reason" + "sourceField": "m365_defender.event.issuer" } }, "incompleteColumns": {} @@ -1258,7 +2353,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "742728c6-cc98-4204-a3fa-65dda2935e22", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1266,16 +2385,18 @@ "visualization": { "columns": [ { - "columnId": "7c9827d1-c527-4553-a520-eeda632e2ebb", + "columnId": "72c3d801-754e-4172-9bc6-10f51ab34110", "isTransposed": false }, { - "columnId": "22456f06-a0fb-40e4-9849-c68f0d7eb120", + "columnId": "4d3ff440-84a4-4118-95bb-b5da7d406f3f", "isTransposed": false } ], - "layerId": "75887628-a5d8-46fc-83f2-7f2341d66647", - "layerType": "data" + "layerId": "673b5af9-08a7-4b42-83e5-627b2f1bfa6e", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1287,15 +2408,15 @@ }, "gridData": { "h": 15, - "i": "8dead8f3-eb81-4f31-80f3-6f839fd1e949", - "w": 24, - "x": 24, - "y": 67 + "i": "9c2c457e-9421-42e0-a162-011ea5beea7e", + "w": 20, + "x": 8, + "y": 46 }, - "panelIndex": "8dead8f3-eb81-4f31-80f3-6f839fd1e949", - "title": "Top 10 Failure Reason for Action Failed [Logs Microsoft 365 Defender]", + "panelIndex": "9c2c457e-9421-42e0-a162-011ea5beea7e", + "title": "Top 10 Certificate Issuer", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1303,44 +2424,45 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-75887628-a5d8-46fc-83f2-7f2341d66647", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-673b5af9-08a7-4b42-83e5-627b2f1bfa6e", + "name": "4c5dba88-1d1d-499d-999e-c8ee3078cbac", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "673b5af9-08a7-4b42-83e5-627b2f1bfa6e": { + "75887628-a5d8-46fc-83f2-7f2341d66647": { "columnOrder": [ - "72c3d801-754e-4172-9bc6-10f51ab34110", - "4d3ff440-84a4-4118-95bb-b5da7d406f3f" + "7c9827d1-c527-4553-a520-eeda632e2ebb", + "22456f06-a0fb-40e4-9849-c68f0d7eb120" ], "columns": { - "4d3ff440-84a4-4118-95bb-b5da7d406f3f": { + "22456f06-a0fb-40e4-9849-c68f0d7eb120": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, - "72c3d801-754e-4172-9bc6-10f51ab34110": { + "7c9827d1-c527-4553-a520-eeda632e2ebb": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Certificate Issuer", + "label": "Failure Reason", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "4d3ff440-84a4-4118-95bb-b5da7d406f3f", + "columnId": "22456f06-a0fb-40e4-9849-c68f0d7eb120", "type": "column" }, "orderDirection": "desc", @@ -1348,7 +2470,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.issuer" + "sourceField": "m365_defender.event.failure_reason" } }, "incompleteColumns": {} @@ -1356,7 +2478,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4c5dba88-1d1d-499d-999e-c8ee3078cbac", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1364,16 +2510,18 @@ "visualization": { "columns": [ { - "columnId": "72c3d801-754e-4172-9bc6-10f51ab34110", + "columnId": "7c9827d1-c527-4553-a520-eeda632e2ebb", "isTransposed": false }, { - "columnId": "4d3ff440-84a4-4118-95bb-b5da7d406f3f", + "columnId": "22456f06-a0fb-40e4-9849-c68f0d7eb120", "isTransposed": false } ], - "layerId": "673b5af9-08a7-4b42-83e5-627b2f1bfa6e", - "layerType": "data" + "layerId": "75887628-a5d8-46fc-83f2-7f2341d66647", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1385,15 +2533,15 @@ }, "gridData": { "h": 15, - "i": "9c2c457e-9421-42e0-a162-011ea5beea7e", - "w": 24, - "x": 0, - "y": 82 + "i": "8dead8f3-eb81-4f31-80f3-6f839fd1e949", + "w": 20, + "x": 28, + "y": 46 }, - "panelIndex": "9c2c457e-9421-42e0-a162-011ea5beea7e", - "title": "Top 10 Certificate Issuer [Logs Microsoft 365 Defender]", + "panelIndex": "8dead8f3-eb81-4f31-80f3-6f839fd1e949", + "title": "Top 10 Failure Reason for Action Failed", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1401,52 +2549,62 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-8a8196f6-a696-4337-9a13-bbf9f8c796d5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "99208529-678d-4c03-a45f-4d0848f8afb4", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f856b131-6bff-4ade-a5da-89160a4205df", + "name": "49888360-e306-4d83-9a96-a9941c1082b2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "f856b131-6bff-4ade-a5da-89160a4205df": { + "8a8196f6-a696-4337-9a13-bbf9f8c796d5": { "columnOrder": [ - "764ecbdf-fb0e-48a0-a21f-23638b1a8767", - "e34cf14c-4b50-4ef1-81d4-98b1ba2e0757" + "0cbc25e1-515c-4691-bca0-2fcf599c4744", + "04877ea1-36c6-49ea-8150-dc864c4f1041" ], "columns": { - "764ecbdf-fb0e-48a0-a21f-23638b1a8767": { + "04877ea1-36c6-49ea-8150-dc864c4f1041": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "0cbc25e1-515c-4691-bca0-2fcf599c4744": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Action Type", + "label": "OS Platform", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "e34cf14c-4b50-4ef1-81d4-98b1ba2e0757", + "columnId": "04877ea1-36c6-49ea-8150-dc864c4f1041", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, - "size": 10 + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 }, "scale": "ordinal", - "sourceField": "event.action" - }, - "e34cf14c-4b50-4ef1-81d4-98b1ba2e0757": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "sourceField": "host.os.platform" } }, "incompleteColumns": {} @@ -1454,149 +2612,348 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "99208529-678d-4c03-a45f-4d0848f8afb4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "49888360-e306-4d83-9a96-a9941c1082b2", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "columnId": "764ecbdf-fb0e-48a0-a21f-23638b1a8767" - }, + "layers": [ { - "columnId": "e34cf14c-4b50-4ef1-81d4-98b1ba2e0757", - "isTransposed": false + "categoryDisplay": "default", + "layerId": "8a8196f6-a696-4337-9a13-bbf9f8c796d5", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "04877ea1-36c6-49ea-8150-dc864c4f1041" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "0cbc25e1-515c-4691-bca0-2fcf599c4744" + ] } ], - "layerId": "f856b131-6bff-4ade-a5da-89160a4205df", - "layerType": "data" + "shape": "pie" } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "76577de8-c97b-440e-85d8-8958a6cf032c", - "w": 24, - "x": 24, - "y": 82 + "h": 21, + "i": "a9117849-31e0-4fb5-8750-3545eb3cb61c", + "w": 17, + "x": 8, + "y": 61 }, - "panelIndex": "76577de8-c97b-440e-85d8-8958a6cf032c", - "title": "Top 10 Action Type that Triggered the Device Events [Logs Microsoft 365 Defender]", + "panelIndex": "a9117849-31e0-4fb5-8750-3545eb3cb61c", + "title": "Distribution of Device Events by OS Platform", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 21, "i": "74765bd4-91fc-4fc6-940b-86d66ba812ef", - "w": 48, - "x": 0, - "y": 97 + "w": 23, + "x": 25, + "y": 61 }, "panelIndex": "74765bd4-91fc-4fc6-940b-86d66ba812ef", "panelRefName": "panel_74765bd4-91fc-4fc6-940b-86d66ba812ef", + "title": "Endpoint Status", "type": "search", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] Device Events", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T09:13:50.534Z", "id": "m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "eef7f556-05f9-4b08-bc1a-f87957c5919d:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "eef7f556-05f9-4b08-bc1a-f87957c5919d:e7b0412d-2f44-423e-9b0a-897f2884c618", "type": "index-pattern" }, { "id": "logs-*", - "name": "eef7f556-05f9-4b08-bc1a-f87957c5919d:indexpattern-datasource-current-indexpattern", + "name": "eef7f556-05f9-4b08-bc1a-f87957c5919d:a0dd3daf-229c-4ea3-b328-cfc256bc6364", "type": "index-pattern" }, { "id": "logs-*", - "name": "eef7f556-05f9-4b08-bc1a-f87957c5919d:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "name": "d2da5421-b966-4fa6-9f0b-67cf5699fe07:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d2da5421-b966-4fa6-9f0b-67cf5699fe07:bb4c45e4-7cbb-43a7-acea-e064d71d78dd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d2da5421-b966-4fa6-9f0b-67cf5699fe07:1e2f916a-dbc2-40ef-817c-2f44e1a7a014", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4cdcfcff-9592-43e6-abf5-cba2e4b82e1e:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "6896510c-66c5-47b7-ae3f-d0521dd24ea3:indexpattern-datasource-current-indexpattern", + "name": "4cdcfcff-9592-43e6-abf5-cba2e4b82e1e:28f49b0a-d5ff-4876-a5ae-407a013e33b2", "type": "index-pattern" }, { "id": "logs-*", - "name": "6896510c-66c5-47b7-ae3f-d0521dd24ea3:indexpattern-datasource-layer-57bf0095-31d3-4abc-8a39-37efbc0a3efd", + "name": "4cdcfcff-9592-43e6-abf5-cba2e4b82e1e:fa186e74-e31b-46d0-b565-5aa2d8927af3", "type": "index-pattern" }, { "id": "logs-*", - "name": "1797b9be-a8f4-4857-9660-be64394b90b3:indexpattern-datasource-current-indexpattern", + "name": "bdad135a-5476-4fa5-b9e2-49abeba859ab:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "1797b9be-a8f4-4857-9660-be64394b90b3:indexpattern-datasource-layer-dca2664e-3694-4056-8386-1b651bbb7e3b", + "name": "bdad135a-5476-4fa5-b9e2-49abeba859ab:1c359492-1f19-4eaa-8168-b69c0280046e", "type": "index-pattern" }, { "id": "logs-*", - "name": "0364cf09-1da8-459d-9267-db9ccab7b6b4:indexpattern-datasource-current-indexpattern", + "name": "bdad135a-5476-4fa5-b9e2-49abeba859ab:1898879e-99e7-472e-8eb0-1bcb24cd981e", "type": "index-pattern" }, { "id": "logs-*", - "name": "0364cf09-1da8-459d-9267-db9ccab7b6b4:indexpattern-datasource-layer-0efca441-e712-4d30-a594-d35d6d172c88", + "name": "43d8b62e-e75c-4bd4-9803-6218cf8e4f28:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "80e0a931-5bd5-47eb-9f59-35020d52d6dd:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "43d8b62e-e75c-4bd4-9803-6218cf8e4f28:8ea8e34b-c360-4515-8c9a-f74c86fe9d8b", "type": "index-pattern" }, { "id": "logs-*", - "name": "892e0c11-6847-4be0-8c53-9256d5bed8ae:indexpattern-datasource-current-indexpattern", + "name": "43d8b62e-e75c-4bd4-9803-6218cf8e4f28:48d451bc-c265-48c3-ba55-e5b1aa37638b", "type": "index-pattern" }, { "id": "logs-*", - "name": "892e0c11-6847-4be0-8c53-9256d5bed8ae:indexpattern-datasource-layer-b65faae4-3ea7-44ce-8c73-3400dc2a953d", + "name": "570f73ac-a3af-48ee-849c-1b64e737b002:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "a70a967c-289d-4d84-8ac4-1dbb1959bbd8:indexpattern-datasource-current-indexpattern", + "name": "570f73ac-a3af-48ee-849c-1b64e737b002:26f2a7e3-8f13-40e5-bce2-4b2dd3f08dc4", "type": "index-pattern" }, { "id": "logs-*", - "name": "a70a967c-289d-4d84-8ac4-1dbb1959bbd8:indexpattern-datasource-layer-33420593-65e7-42ea-a730-38fd3565b83b", + "name": "570f73ac-a3af-48ee-849c-1b64e737b002:17012638-69b0-481b-928e-50bc42099035", "type": "index-pattern" }, { "id": "logs-*", - "name": "3a2f0c3d-bd6d-44e4-b6c3-25d7f55dd608:indexpattern-datasource-current-indexpattern", + "name": "69254ab7-fc20-4db8-952e-76e4f2ffa4e9:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "69254ab7-fc20-4db8-952e-76e4f2ffa4e9:953d90f0-317e-4df8-a189-000736037076", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "69254ab7-fc20-4db8-952e-76e4f2ffa4e9:4b2d8da6-d241-43ac-a9e0-4af12cbf58ff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a439ec0-b0dd-41df-b1de-b761b68d6ffb:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a439ec0-b0dd-41df-b1de-b761b68d6ffb:f2489da3-1ef2-46be-8809-45cd8fd6e08f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a439ec0-b0dd-41df-b1de-b761b68d6ffb:5b88ee69-8299-4ca0-8684-4eb31dc7eca7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7cd71879-68ac-454b-a135-c6bacac2d77f:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7cd71879-68ac-454b-a135-c6bacac2d77f:2873ea87-14a2-4aa2-8031-3f5f778f28d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7cd71879-68ac-454b-a135-c6bacac2d77f:70ce4539-c1d4-4b7f-b4f7-b1f460d0d699", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12d3fd1a-bd2b-4612-84ba-aa2bb2060d78:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12d3fd1a-bd2b-4612-84ba-aa2bb2060d78:54cb0ac8-edd5-4b99-b467-4a5c49b87e05", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12d3fd1a-bd2b-4612-84ba-aa2bb2060d78:36724591-c980-454c-a773-fa1b2591b218", "type": "index-pattern" }, { @@ -1606,27 +2963,27 @@ }, { "id": "logs-*", - "name": "f048ae61-3e8e-41e4-b15d-c6fa3c261b54:indexpattern-datasource-current-indexpattern", + "name": "3a2f0c3d-bd6d-44e4-b6c3-25d7f55dd608:5fbe60d0-db91-4d90-8078-74267201081b", "type": "index-pattern" }, { "id": "logs-*", - "name": "f048ae61-3e8e-41e4-b15d-c6fa3c261b54:indexpattern-datasource-layer-d355aad4-5b79-4044-bbec-66923b1a8c84", + "name": "de11f567-5bec-4717-a49c-98f6e34250e5:indexpattern-datasource-layer-06ee28b9-429b-42e8-a83b-3a3f4eb16745", "type": "index-pattern" }, { "id": "logs-*", - "name": "a9117849-31e0-4fb5-8750-3545eb3cb61c:indexpattern-datasource-current-indexpattern", + "name": "de11f567-5bec-4717-a49c-98f6e34250e5:40219299-d96a-4725-a046-807b4c1d3972", "type": "index-pattern" }, { "id": "logs-*", - "name": "a9117849-31e0-4fb5-8750-3545eb3cb61c:indexpattern-datasource-layer-8a8196f6-a696-4337-9a13-bbf9f8c796d5", + "name": "9c2c457e-9421-42e0-a162-011ea5beea7e:indexpattern-datasource-layer-673b5af9-08a7-4b42-83e5-627b2f1bfa6e", "type": "index-pattern" }, { "id": "logs-*", - "name": "8dead8f3-eb81-4f31-80f3-6f839fd1e949:indexpattern-datasource-current-indexpattern", + "name": "9c2c457e-9421-42e0-a162-011ea5beea7e:742728c6-cc98-4204-a3fa-65dda2935e22", "type": "index-pattern" }, { @@ -1636,28 +2993,48 @@ }, { "id": "logs-*", - "name": "9c2c457e-9421-42e0-a162-011ea5beea7e:indexpattern-datasource-current-indexpattern", + "name": "8dead8f3-eb81-4f31-80f3-6f839fd1e949:4c5dba88-1d1d-499d-999e-c8ee3078cbac", "type": "index-pattern" }, { "id": "logs-*", - "name": "9c2c457e-9421-42e0-a162-011ea5beea7e:indexpattern-datasource-layer-673b5af9-08a7-4b42-83e5-627b2f1bfa6e", + "name": "a9117849-31e0-4fb5-8750-3545eb3cb61c:indexpattern-datasource-layer-8a8196f6-a696-4337-9a13-bbf9f8c796d5", "type": "index-pattern" }, { "id": "logs-*", - "name": "76577de8-c97b-440e-85d8-8958a6cf032c:indexpattern-datasource-current-indexpattern", + "name": "a9117849-31e0-4fb5-8750-3545eb3cb61c:99208529-678d-4c03-a45f-4d0848f8afb4", "type": "index-pattern" }, { "id": "logs-*", - "name": "76577de8-c97b-440e-85d8-8958a6cf032c:indexpattern-datasource-layer-f856b131-6bff-4ade-a5da-89160a4205df", + "name": "a9117849-31e0-4fb5-8750-3545eb3cb61c:49888360-e306-4d83-9a96-a9941c1082b2", "type": "index-pattern" }, { "id": "m365_defender-64a31410-722c-11ed-8657-c59f6ece834c", "name": "74765bd4-91fc-4fc6-940b-86d66ba812ef:panel_74765bd4-91fc-4fc6-940b-86d66ba812ef", "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_007a099d-f3bc-4c46-a48e-629e06a614e4:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_d441e8a1-87f4-46b1-8dff-bf9bb88762d3:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_6fa76f5f-16ed-4419-8b16-fe5581d21067:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_175fd1a8-7429-4e56-853b-057b124121de:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json b/packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json index 94443644221..3c3aae70729 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c.json @@ -1,78 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"6d8444c4-a17b-46fa-b942-248cdffc0d04\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"6d8444c4-a17b-46fa-b942-248cdffc0d04\",\"fieldName\":\"host.name\",\"title\":\"Device\",\"enhancements\":{}}},\"63481d94-05b9-4bb5-afc9-3d77d86dfea3\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"63481d94-05b9-4bb5-afc9-3d77d86dfea3\",\"fieldName\":\"m365_defender.event.application\",\"title\":\"Application\",\"enhancements\":{}}},\"22ed2462-d641-464c-94ee-955dfbce0a1d\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"22ed2462-d641-464c-94ee-955dfbce0a1d\",\"fieldName\":\"host.type\",\"title\":\"Device Type\",\"enhancements\":{}}},\"fdde8f41-b6db-435a-8128-3aee80ee3d3f\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"fdde8f41-b6db-435a-8128-3aee80ee3d3f\",\"fieldName\":\"m365_defender.event.action.type\",\"title\":\"Action Type\",\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender App \u0026 Identity Events.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.event" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.event" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Filter: App and Identity", - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "m365_defender.event.category", - "negate": false, - "params": [ - "AdvancedHunting-IdentityDirectoryEvents", - "AdvancedHunting-IdentityLogonEvents", - "AdvancedHunting-IdentityQueryEvents", - "AdvancedHunting-CloudAppEvents" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" - } - }, - { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -81,14 +18,16 @@ }, "optionsJSON": { "hidePanelTitles": false, - "syncColors": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { "enhancements": {}, - "hidePanelTitles": true, + "hidePanelTitles": false, "savedVis": { "data": { "aggs": [], @@ -104,8 +43,8 @@ "id": "", "params": { "fontSize": 12, - "markdown": "[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) | \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) | \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c)\n", - "openLinksInNewTab": true + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) \n**[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c)** \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) \n\n#### Incident Datastream (Graph API) \n\n[Incidents](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06) \n[Alerts](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03) \n\n#### Description\n\nThis dashboard visualizes CloudApp and Identity type events according to the [Microsoft Documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide). \nThe data is collected from a configured Event Hub, using the M365 Defender Event datastream. \n\nThe supported event types are:\n- AdvancedHunting-IdentityDirectoryEvents\n- AdvancedHunting-IdentityLogonEvents\n- AdvancedHunting-IdentityQueryEvents\n- AdvancedHunting-CloudAppEvents\n\n", + "openLinksInNewTab": false }, "title": "", "type": "markdown", @@ -113,16 +52,16 @@ } }, "gridData": { - "h": 2, - "i": "72ad93b2-bd38-4e32-86a5-fe3f7db541d4", - "w": 48, + "h": 56, + "i": "13f8e133-60be-4cd8-9c2e-85a29df58f4b", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "72ad93b2-bd38-4e32-86a5-fe3f7db541d4", - "title": "Dashboards [Logs Microsoft 365 Defender]", + "panelIndex": "13f8e133-60be-4cd8-9c2e-85a29df58f4b", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -130,35 +69,198 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e1d8f890-72ee-4e71-9f40-cafe67580296", + "name": "7b5d5c01-13c0-45b6-b669-02955e12824b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a12fd844-2e4e-4024-be43-1ebb89c7d559", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "e1d8f890-72ee-4e71-9f40-cafe67580296": { + "8bb7301a-d5ca-4fff-9c62-1ac0b991077a": { "columnOrder": [ - "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25", - "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784" + "5c22db1a-d4a0-47b3-a33a-56a0f8b16b62" ], "columns": { - "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25": { + "5c22db1a-d4a0-47b3-a33a-56a0f8b16b62": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique Devices", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7b5d5c01-13c0-45b6-b669-02955e12824b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "a12fd844-2e4e-4024-be43-1ebb89c7d559", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "8bb7301a-d5ca-4fff-9c62-1ac0b991077a", + "layerType": "data", + "metricAccessor": "5c22db1a-d4a0-47b3-a33a-56a0f8b16b62" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "b2f500b5-ac94-44b7-94e4-7321d9219bde", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "b2f500b5-ac94-44b7-94e4-7321d9219bde", + "title": "Unique Devices", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-344214e3-0de7-420e-ad4b-79e3fd4a1cca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af9367fc-057e-404d-970a-ac0c72ca1b92", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "344214e3-0de7-420e-ad4b-79e3fd4a1cca": { + "columnOrder": [ + "c8580074-e80b-47b3-b225-a4abdcf8d19d", + "57d0feb5-b53e-4f1e-9377-68f44665e71d" + ], + "columns": { + "57d0feb5-b53e-4f1e-9377-68f44665e71d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "c8580074-e80b-47b3-b225-a4abdcf8d19d": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "App and Identity Category", + "label": "Device Type", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784", + "columnId": "57d0feb5-b53e-4f1e-9377-68f44665e71d", "type": "column" }, "orderDirection": "desc", @@ -166,16 +268,208 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.category" + "sourceField": "host.type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "af9367fc-057e-404d-970a-ac0c72ca1b92", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" }, - "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784": { + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "logs-*", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-CloudAppEvents", + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-CloudAppEvents", + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + } + ] + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "344214e3-0de7-420e-ad4b-79e3fd4a1cca", + "layerType": "data", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "57d0feb5-b53e-4f1e-9377-68f44665e71d" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "c8580074-e80b-47b3-b225-a4abdcf8d19d" + ] + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 18, + "i": "af17ce71-1d52-4e54-bbd8-17fba8f77f41", + "w": 16, + "x": 16, + "y": 0 + }, + "panelIndex": "af17ce71-1d52-4e54-bbd8-17fba8f77f41", + "title": "Distribution of App and Identity Events by Device Type", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-255c9986-ae8d-47fa-835b-8d1b02821f3e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00da5dee-5d8e-48e8-afef-d1ed05a3f811", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4cfadb55-68b4-43d5-a555-05e32c71c6c6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "255c9986-ae8d-47fa-835b-8d1b02821f3e": { + "columnOrder": [ + "18a3b590-64d4-4aca-b00c-5968dcb84d6f", + "c89ecd4a-324c-4887-b24c-0ec762958d41" + ], + "columns": { + "18a3b590-64d4-4aca-b00c-5968dcb84d6f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c89ecd4a-324c-4887-b24c-0ec762958d41", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "m365_defender.event.application" + }, + "c89ecd4a-324c-4887-b24c-0ec762958d41": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -183,7 +477,84 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "00da5dee-5d8e-48e8-afef-d1ed05a3f811", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "4cfadb55-68b4-43d5-a555-05e32c71c6c6", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -192,15 +563,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25" - ], - "layerId": "e1d8f890-72ee-4e71-9f40-cafe67580296", + "layerId": "255c9986-ae8d-47fa-835b-8d1b02821f3e", "layerType": "data", - "legendDisplay": "default", - "metric": "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "c89ecd4a-324c-4887-b24c-0ec762958d41" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "18a3b590-64d4-4aca-b00c-5968dcb84d6f" + ] } ], "shape": "pie" @@ -214,16 +588,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "883f9d41-b2dc-43f5-a880-55af54651f72", - "w": 24, - "x": 0, - "y": 2 + "h": 18, + "i": "9a94aefa-34e6-47ea-baea-c73de0c92d1d", + "w": 16, + "x": 32, + "y": 0 }, - "panelIndex": "883f9d41-b2dc-43f5-a880-55af54651f72", - "title": "Distribution of App and Identity Events by Category [Logs Microsoft 365 Defender]", + "panelIndex": "9a94aefa-34e6-47ea-baea-c73de0c92d1d", + "title": "Distribution of App and Identity Events by Application", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -231,18 +605,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", + "name": "e4bc8c47-0bd3-402c-9ee9-c546d45cdbc4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b864fc7f-80fd-4339-b47b-772403f26d6d", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8bb7301a-d5ca-4fff-9c62-1ac0b991077a": { "columnOrder": [ @@ -253,10 +633,10 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Number of Devices", + "label": "Unique Applications", "operationType": "unique_count", "scale": "ratio", - "sourceField": "host.domain" + "sourceField": "m365_defender.event.application" } }, "incompleteColumns": {} @@ -264,15 +644,93 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e4bc8c47-0bd3-402c-9ee9-c546d45cdbc4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "b864fc7f-80fd-4339-b47b-772403f26d6d", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "accessor": "5c22db1a-d4a0-47b3-a33a-56a0f8b16b62", + "color": "#6092C0", "layerId": "8bb7301a-d5ca-4fff-9c62-1ac0b991077a", - "layerType": "data" + "layerType": "data", + "metricAccessor": "5c22db1a-d4a0-47b3-a33a-56a0f8b16b62" } }, "title": "", @@ -280,19 +738,19 @@ "visualizationType": "lnsMetric" }, "enhancements": {}, - "hidePanelTitles": true + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "b2f500b5-ac94-44b7-94e4-7321d9219bde", - "w": 24, - "x": 24, - "y": 2 + "h": 9, + "i": "ac91d103-a220-42fa-89df-573e85e381d4", + "w": 8, + "x": 8, + "y": 9 }, - "panelIndex": "b2f500b5-ac94-44b7-94e4-7321d9219bde", - "title": "Count of Devices [Logs Microsoft 365 Defender]", + "panelIndex": "ac91d103-a220-42fa-89df-573e85e381d4", + "title": "Unique Applications", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -300,52 +758,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-295c44b3-b261-4ddf-ac06-517e9516b678", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-099c9a83-029a-4f52-ab14-9ecf0aed4302", + "name": "26ba2ac1-affe-46d5-90bd-4f5b4129c502", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0590dba2-fba0-4304-912b-bee790b2c49b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "099c9a83-029a-4f52-ab14-9ecf0aed4302": { + "295c44b3-b261-4ddf-ac06-517e9516b678": { "columnOrder": [ - "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21", - "49e2bdd9-e9f5-4d8d-913e-d55b589a19da" + "5053df51-9330-46d9-bb59-8a6b8a7e88f6", + "e7669c00-6660-4e56-89ee-9413586e6bc4" ], "columns": { - "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21": { + "5053df51-9330-46d9-bb59-8a6b8a7e88f6": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "OS Platform", + "label": "Failure Reason", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "49e2bdd9-e9f5-4d8d-913e-d55b589a19da", + "columnId": "e7669c00-6660-4e56-89ee-9413586e6bc4", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "size": 10 }, "scale": "ordinal", - "sourceField": "host.os.name" + "sourceField": "m365_defender.event.failure_reason" }, - "49e2bdd9-e9f5-4d8d-913e-d55b589a19da": { + "e7669c00-6660-4e56-89ee-9413586e6bc4": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -353,58 +817,122 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "26ba2ac1-affe-46d5-90bd-4f5b4129c502", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "0590dba2-fba0-4304-912b-bee790b2c49b", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "accessors": [ - "49e2bdd9-e9f5-4d8d-913e-d55b589a19da" - ], - "layerId": "099c9a83-029a-4f52-ab14-9ecf0aed4302", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21" + "columnId": "5053df51-9330-46d9-bb59-8a6b8a7e88f6" + }, + { + "columnId": "e7669c00-6660-4e56-89ee-9413586e6bc4", + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" - } + "layerId": "295c44b3-b261-4ddf-ac06-517e9516b678", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "9026565f-e4e4-4648-88a0-b69e8fa1f190", - "w": 24, - "x": 0, - "y": 17 + "i": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99", + "w": 20, + "x": 8, + "y": 18 }, - "panelIndex": "9026565f-e4e4-4648-88a0-b69e8fa1f190", - "title": "Distribution of App and Identity Events by OS Platform [Logs Microsoft 365 Defender]", + "panelIndex": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99", + "title": "Top 10 Failure Reason for Action Failed", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -412,52 +940,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-8d6ae427-4608-445d-945a-fff8b3957c40", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-344214e3-0de7-420e-ad4b-79e3fd4a1cca", + "name": "331f7c9c-7a62-4453-ba1a-77fa4f1baeb4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1f47765e-3523-4927-a238-664b62577ebc", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "344214e3-0de7-420e-ad4b-79e3fd4a1cca": { + "8d6ae427-4608-445d-945a-fff8b3957c40": { "columnOrder": [ - "c8580074-e80b-47b3-b225-a4abdcf8d19d", - "57d0feb5-b53e-4f1e-9377-68f44665e71d" + "be1e92c2-44d8-47b8-91d2-33148b7f45d0", + "ce4e799a-3416-4246-9f3e-df8ed63302e2" ], "columns": { - "57d0feb5-b53e-4f1e-9377-68f44665e71d": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "c8580074-e80b-47b3-b225-a4abdcf8d19d": { + "be1e92c2-44d8-47b8-91d2-33148b7f45d0": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Device Type", + "label": "Action Type", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "57d0feb5-b53e-4f1e-9377-68f44665e71d", + "columnId": "ce4e799a-3416-4246-9f3e-df8ed63302e2", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, - "size": 5 + "otherBucket": false, + "size": 10 }, "scale": "ordinal", - "sourceField": "host.type" + "sourceField": "event.action" + }, + "ce4e799a-3416-4246-9f3e-df8ed63302e2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -465,47 +999,122 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "331f7c9c-7a62-4453-ba1a-77fa4f1baeb4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "1f47765e-3523-4927-a238-664b62577ebc", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "groups": [ - "c8580074-e80b-47b3-b225-a4abdcf8d19d" - ], - "layerId": "344214e3-0de7-420e-ad4b-79e3fd4a1cca", - "layerType": "data", - "legendDisplay": "default", - "metric": "57d0feb5-b53e-4f1e-9377-68f44665e71d", - "nestedLegend": false, - "numberDisplay": "percent" + "columnId": "be1e92c2-44d8-47b8-91d2-33148b7f45d0" + }, + { + "columnId": "ce4e799a-3416-4246-9f3e-df8ed63302e2", + "isTransposed": false } ], - "shape": "pie" + "layerId": "8d6ae427-4608-445d-945a-fff8b3957c40", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "af17ce71-1d52-4e54-bbd8-17fba8f77f41", - "w": 24, - "x": 24, - "y": 17 + "i": "2d53c4f6-39e7-456a-ad38-c0a28349854a", + "w": 20, + "x": 28, + "y": 18 }, - "panelIndex": "af17ce71-1d52-4e54-bbd8-17fba8f77f41", - "title": "Distribution of App and Identity Events by Device Type [Logs Microsoft 365 Defender]", + "panelIndex": "2d53c4f6-39e7-456a-ad38-c0a28349854a", + "title": "Top 10 Action Type that Triggered the Identity Events", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -513,52 +1122,58 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-099c9a83-029a-4f52-ab14-9ecf0aed4302", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-295c44b3-b261-4ddf-ac06-517e9516b678", + "name": "09dd464b-52e4-4840-a088-b1f87639b251", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07ac29d6-b0bf-4817-bd92-c8470127bd9c", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "295c44b3-b261-4ddf-ac06-517e9516b678": { + "099c9a83-029a-4f52-ab14-9ecf0aed4302": { "columnOrder": [ - "5053df51-9330-46d9-bb59-8a6b8a7e88f6", - "e7669c00-6660-4e56-89ee-9413586e6bc4" + "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21", + "49e2bdd9-e9f5-4d8d-913e-d55b589a19da" ], "columns": { - "5053df51-9330-46d9-bb59-8a6b8a7e88f6": { + "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Failure Reason", + "label": "OS Platform", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "e7669c00-6660-4e56-89ee-9413586e6bc4", + "columnId": "49e2bdd9-e9f5-4d8d-913e-d55b589a19da", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.event.failure_reason" + "sourceField": "host.os.name" }, - "e7669c00-6660-4e56-89ee-9413586e6bc4": { + "49e2bdd9-e9f5-4d8d-913e-d55b589a19da": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -566,43 +1181,156 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "09dd464b-52e4-4840-a088-b1f87639b251", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "07ac29d6-b0bf-4817-bd92-c8470127bd9c", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "columnId": "5053df51-9330-46d9-bb59-8a6b8a7e88f6" - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "columnId": "e7669c00-6660-4e56-89ee-9413586e6bc4", - "isTransposed": false + "accessors": [ + "49e2bdd9-e9f5-4d8d-913e-d55b589a19da" + ], + "layerId": "099c9a83-029a-4f52-ab14-9ecf0aed4302", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "18ff07e7-d3dc-4919-b66e-5fb0cf6b6b21" } ], - "layerId": "295c44b3-b261-4ddf-ac06-517e9516b678", - "layerType": "data" + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99", - "w": 24, - "x": 0, - "y": 47 + "h": 23, + "i": "9026565f-e4e4-4648-88a0-b69e8fa1f190", + "w": 12, + "x": 8, + "y": 33 }, - "panelIndex": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99", - "title": "Top 10 Failure Reason for Action Failed [Logs Microsoft 365 Defender]", + "panelIndex": "9026565f-e4e4-4648-88a0-b69e8fa1f190", + "title": "Distribution of App and Identity Events by OS Platform", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -610,35 +1338,41 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e1d8f890-72ee-4e71-9f40-cafe67580296", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-255c9986-ae8d-47fa-835b-8d1b02821f3e", + "name": "06f18f7a-92bc-4347-9328-3f706fc0a553", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b1d1eebe-158a-4fb1-a38b-a0a8138774d3", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "255c9986-ae8d-47fa-835b-8d1b02821f3e": { + "e1d8f890-72ee-4e71-9f40-cafe67580296": { "columnOrder": [ - "18a3b590-64d4-4aca-b00c-5968dcb84d6f", - "c89ecd4a-324c-4887-b24c-0ec762958d41" + "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25", + "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784" ], "columns": { - "18a3b590-64d4-4aca-b00c-5968dcb84d6f": { + "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Application", + "label": "App and Identity Category", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "c89ecd4a-324c-4887-b24c-0ec762958d41", + "columnId": "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784", "type": "column" }, "orderDirection": "desc", @@ -646,16 +1380,16 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "m365_defender.event.application" + "sourceField": "m365_defender.event.category" }, - "c89ecd4a-324c-4887-b24c-0ec762958d41": { + "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -663,7 +1397,84 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "06f18f7a-92bc-4347-9328-3f706fc0a553", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "b1d1eebe-158a-4fb1-a38b-a0a8138774d3", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -671,16 +1482,19 @@ "visualization": { "layers": [ { - "categoryDisplay": "default", - "groups": [ - "18a3b590-64d4-4aca-b00c-5968dcb84d6f" - ], - "layerId": "255c9986-ae8d-47fa-835b-8d1b02821f3e", + "categoryDisplay": "inside", + "layerId": "e1d8f890-72ee-4e71-9f40-cafe67580296", "layerType": "data", - "legendDisplay": "default", - "metric": "c89ecd4a-324c-4887-b24c-0ec762958d41", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "d7e0e9f5-9595-4dcd-b522-70d2fdd3a784" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "5c2d3a33-e5cc-49f1-a4dc-6e651dcacc25" + ] } ], "shape": "pie" @@ -694,16 +1508,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "9a94aefa-34e6-47ea-baea-c73de0c92d1d", - "w": 24, - "x": 24, - "y": 32 + "h": 23, + "i": "883f9d41-b2dc-43f5-a880-55af54651f72", + "w": 14, + "x": 20, + "y": 33 }, - "panelIndex": "9a94aefa-34e6-47ea-baea-c73de0c92d1d", - "title": "Distribution of App and Identity Events by Application [Logs Microsoft 365 Defender]", + "panelIndex": "883f9d41-b2dc-43f5-a880-55af54651f72", + "title": "Distribution of App and Identity Events by Category", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -711,18 +1525,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-b711b414-d1c9-4400-bf28-a3b4a5f317f4", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-b711b414-d1c9-4400-bf28-a3b4a5f317f4", + "name": "4661e569-c80c-417b-a2c7-16fed93818fe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "badf91cd-5405-466b-b1cf-619d2903ff04", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b711b414-d1c9-4400-bf28-a3b4a5f317f4": { "columnOrder": [ @@ -737,7 +1557,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "778b4031-c79b-430a-9cae-928e2328bcce": { "customLabel": true, @@ -764,7 +1584,84 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4661e569-c80c-417b-a2c7-16fed93818fe", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.category", + "index": "badf91cd-5405-466b-b1cf-619d2903ff04", + "key": "m365_defender.event.category", + "negate": false, + "params": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-IdentityDirectoryEvents", + "AdvancedHunting-IdentityLogonEvents", + "AdvancedHunting-IdentityQueryEvents", + "AdvancedHunting-CloudAppEvents" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityDirectoryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-IdentityQueryEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-CloudAppEvents" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -773,15 +1670,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "778b4031-c79b-430a-9cae-928e2328bcce" - ], "layerId": "b711b414-d1c9-4400-bf28-a3b4a5f317f4", "layerType": "data", - "legendDisplay": "default", - "metric": "4089693d-f337-4d10-9f77-acf0c4460024", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "4089693d-f337-4d10-9f77-acf0c4460024" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "778b4031-c79b-430a-9cae-928e2328bcce" + ] } ], "shape": "pie" @@ -795,178 +1695,82 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 23, "i": "0a57d124-a25c-4e66-9cf3-c29f6e7734b5", - "w": 24, - "x": 0, - "y": 32 + "w": 14, + "x": 34, + "y": 33 }, "panelIndex": "0a57d124-a25c-4e66-9cf3-c29f6e7734b5", - "title": "Distribution of Identity Events by Logon Type [Logs Microsoft 365 Defender]", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-8d6ae427-4608-445d-945a-fff8b3957c40", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "8d6ae427-4608-445d-945a-fff8b3957c40": { - "columnOrder": [ - "be1e92c2-44d8-47b8-91d2-33148b7f45d0", - "ce4e799a-3416-4246-9f3e-df8ed63302e2" - ], - "columns": { - "be1e92c2-44d8-47b8-91d2-33148b7f45d0": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Action Type", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "ce4e799a-3416-4246-9f3e-df8ed63302e2", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.action" - }, - "ce4e799a-3416-4246-9f3e-df8ed63302e2": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "be1e92c2-44d8-47b8-91d2-33148b7f45d0" - }, - { - "columnId": "ce4e799a-3416-4246-9f3e-df8ed63302e2", - "isTransposed": false - } - ], - "layerId": "8d6ae427-4608-445d-945a-fff8b3957c40", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "2d53c4f6-39e7-456a-ad38-c0a28349854a", - "w": 24, - "x": 24, - "y": 47 - }, - "panelIndex": "2d53c4f6-39e7-456a-ad38-c0a28349854a", - "title": "Top 10 Action Type that Triggered the Identity Events [Logs Microsoft 365 Defender]", + "title": "Distribution of Identity Events by Logon Type", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] App \u0026 Identity Events", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T09:11:12.088Z", "id": "m365_defender-d587df00-745f-11ed-8657-c59f6ece834c", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "b2f500b5-ac94-44b7-94e4-7321d9219bde:indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "b2f500b5-ac94-44b7-94e4-7321d9219bde:7b5d5c01-13c0-45b6-b669-02955e12824b", "type": "index-pattern" }, { "id": "logs-*", - "name": "883f9d41-b2dc-43f5-a880-55af54651f72:indexpattern-datasource-current-indexpattern", + "name": "b2f500b5-ac94-44b7-94e4-7321d9219bde:a12fd844-2e4e-4024-be43-1ebb89c7d559", "type": "index-pattern" }, { "id": "logs-*", - "name": "883f9d41-b2dc-43f5-a880-55af54651f72:indexpattern-datasource-layer-e1d8f890-72ee-4e71-9f40-cafe67580296", + "name": "af17ce71-1d52-4e54-bbd8-17fba8f77f41:indexpattern-datasource-layer-344214e3-0de7-420e-ad4b-79e3fd4a1cca", "type": "index-pattern" }, { "id": "logs-*", - "name": "b2f500b5-ac94-44b7-94e4-7321d9219bde:indexpattern-datasource-current-indexpattern", + "name": "af17ce71-1d52-4e54-bbd8-17fba8f77f41:af9367fc-057e-404d-970a-ac0c72ca1b92", "type": "index-pattern" }, { "id": "logs-*", - "name": "b2f500b5-ac94-44b7-94e4-7321d9219bde:indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", + "name": "9a94aefa-34e6-47ea-baea-c73de0c92d1d:indexpattern-datasource-layer-255c9986-ae8d-47fa-835b-8d1b02821f3e", "type": "index-pattern" }, { "id": "logs-*", - "name": "9026565f-e4e4-4648-88a0-b69e8fa1f190:indexpattern-datasource-current-indexpattern", + "name": "9a94aefa-34e6-47ea-baea-c73de0c92d1d:00da5dee-5d8e-48e8-afef-d1ed05a3f811", "type": "index-pattern" }, { "id": "logs-*", - "name": "9026565f-e4e4-4648-88a0-b69e8fa1f190:indexpattern-datasource-layer-099c9a83-029a-4f52-ab14-9ecf0aed4302", + "name": "9a94aefa-34e6-47ea-baea-c73de0c92d1d:4cfadb55-68b4-43d5-a555-05e32c71c6c6", "type": "index-pattern" }, { "id": "logs-*", - "name": "af17ce71-1d52-4e54-bbd8-17fba8f77f41:indexpattern-datasource-current-indexpattern", + "name": "ac91d103-a220-42fa-89df-573e85e381d4:indexpattern-datasource-layer-8bb7301a-d5ca-4fff-9c62-1ac0b991077a", "type": "index-pattern" }, { "id": "logs-*", - "name": "af17ce71-1d52-4e54-bbd8-17fba8f77f41:indexpattern-datasource-layer-344214e3-0de7-420e-ad4b-79e3fd4a1cca", + "name": "ac91d103-a220-42fa-89df-573e85e381d4:e4bc8c47-0bd3-402c-9ee9-c546d45cdbc4", "type": "index-pattern" }, { "id": "logs-*", - "name": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99:indexpattern-datasource-current-indexpattern", + "name": "ac91d103-a220-42fa-89df-573e85e381d4:b864fc7f-80fd-4339-b47b-772403f26d6d", "type": "index-pattern" }, { @@ -976,17 +1780,57 @@ }, { "id": "logs-*", - "name": "9a94aefa-34e6-47ea-baea-c73de0c92d1d:indexpattern-datasource-current-indexpattern", + "name": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99:26ba2ac1-affe-46d5-90bd-4f5b4129c502", "type": "index-pattern" }, { "id": "logs-*", - "name": "9a94aefa-34e6-47ea-baea-c73de0c92d1d:indexpattern-datasource-layer-255c9986-ae8d-47fa-835b-8d1b02821f3e", + "name": "4e8ac33a-12e8-4f6f-8d7d-1fc25589bc99:0590dba2-fba0-4304-912b-bee790b2c49b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d53c4f6-39e7-456a-ad38-c0a28349854a:indexpattern-datasource-layer-8d6ae427-4608-445d-945a-fff8b3957c40", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d53c4f6-39e7-456a-ad38-c0a28349854a:331f7c9c-7a62-4453-ba1a-77fa4f1baeb4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2d53c4f6-39e7-456a-ad38-c0a28349854a:1f47765e-3523-4927-a238-664b62577ebc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9026565f-e4e4-4648-88a0-b69e8fa1f190:indexpattern-datasource-layer-099c9a83-029a-4f52-ab14-9ecf0aed4302", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9026565f-e4e4-4648-88a0-b69e8fa1f190:09dd464b-52e4-4840-a088-b1f87639b251", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9026565f-e4e4-4648-88a0-b69e8fa1f190:07ac29d6-b0bf-4817-bd92-c8470127bd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "883f9d41-b2dc-43f5-a880-55af54651f72:indexpattern-datasource-layer-e1d8f890-72ee-4e71-9f40-cafe67580296", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "883f9d41-b2dc-43f5-a880-55af54651f72:06f18f7a-92bc-4347-9328-3f706fc0a553", "type": "index-pattern" }, { "id": "logs-*", - "name": "0a57d124-a25c-4e66-9cf3-c29f6e7734b5:indexpattern-datasource-current-indexpattern", + "name": "883f9d41-b2dc-43f5-a880-55af54651f72:b1d1eebe-158a-4fb1-a38b-a0a8138774d3", "type": "index-pattern" }, { @@ -996,12 +1840,32 @@ }, { "id": "logs-*", - "name": "2d53c4f6-39e7-456a-ad38-c0a28349854a:indexpattern-datasource-current-indexpattern", + "name": "0a57d124-a25c-4e66-9cf3-c29f6e7734b5:4661e569-c80c-417b-a2c7-16fed93818fe", "type": "index-pattern" }, { "id": "logs-*", - "name": "2d53c4f6-39e7-456a-ad38-c0a28349854a:indexpattern-datasource-layer-8d6ae427-4608-445d-945a-fff8b3957c40", + "name": "0a57d124-a25c-4e66-9cf3-c29f6e7734b5:badf91cd-5405-466b-b1cf-619d2903ff04", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_6d8444c4-a17b-46fa-b942-248cdffc0d04:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_63481d94-05b9-4bb5-afc9-3d77d86dfea3:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_22ed2462-d641-464c-94ee-955dfbce0a1d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fdde8f41-b6db-435a-8128-3aee80ee3d3f:optionsListDataView", "type": "index-pattern" } ], diff --git a/packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json b/packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json index 06e970e5f86..6e3c80aa2ed 100644 --- a/packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json +++ b/packages/m365_defender/kibana/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03.json @@ -1,32 +1,15 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"5779a7c6-acf5-4f7d-ac4c-caae9517d95e\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"5779a7c6-acf5-4f7d-ac4c-caae9517d95e\",\"fieldName\":\"event.provider\",\"title\":\"Service Source\",\"enhancements\":{}}},\"e61071e0-ba4d-4765-9267-e035395b221f\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"e61071e0-ba4d-4765-9267-e035395b221f\",\"fieldName\":\"m365_defender.incident.alert.severity\",\"title\":\"Severity\",\"selectedOptions\":[],\"enhancements\":{}}},\"ec5d23b5-535c-483a-88ad-279762f3d5ca\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"ec5d23b5-535c-483a-88ad-279762f3d5ca\",\"fieldName\":\"m365_defender.incident.alert.detection_source\",\"title\":\"Detection Source\",\"enhancements\":{}}},\"cef3df17-225a-4373-a231-caa594cd1bf4\":{\"type\":\"optionsListControl\",\"order\":3,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"cef3df17-225a-4373-a231-caa594cd1bf4\",\"fieldName\":\"m365_defender.incident.alert.evidence.roles\",\"title\":\"Evidence Role\",\"enhancements\":{}}}}" + }, "description": "Overview of Microsoft 365 Defender Alerts", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "m365_defender.incident" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "m365_defender.incident" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -36,6 +19,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -57,169 +42,225 @@ "description": "", "id": "", "params": { - "controls": [ - { - "fieldName": "event.provider", - "id": "1664862844575", - "indexPatternRefName": "control_9aa74a70-d9fb-4b5b-ba40-e5105e344dee_0_index_pattern", - "label": "Service Source", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false + "fontSize": 12, + "markdown": "### Navigation\n\n#### M365 Defender\n\n#### EventHub Datastream \n[Alert Events](#/dashboard/m365_defender-2690a440-7235-11ed-8657-c59f6ece834c) \n[Device Events](#/dashboard/m365_defender-c0b796d0-720a-11ed-8657-c59f6ece834c) \n[App \u0026 Identity Events](#/dashboard/m365_defender-d587df00-745f-11ed-8657-c59f6ece834c) \n[Email Events](#/dashboard/m365_defender-3caf3c00-7456-11ed-8657-c59f6ece834c) \n\n#### Incident Datastream (Graph API) \n\n[Incident Events](#/dashboard/m365_defender-ac54d310-44ab-11ed-8375-0168a9970c06) \n**[Alert Events](#/dashboard/m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03)** \n\n#### Description\n\nThis dashboard visualizes Alert type events collected from the MS Graph API using the Incident Datastream\n\n", + "openLinksInNewTab": false }, "title": "", - "type": "input_control_vis", + "type": "markdown", "uiState": {} } }, "gridData": { - "h": 10, - "i": "9aa74a70-d9fb-4b5b-ba40-e5105e344dee", - "w": 14, + "h": 134, + "i": "5852497b-14e8-4c1e-a9ab-fc387a3ae672", + "w": 8, "x": 0, "y": 0 }, - "panelIndex": "9aa74a70-d9fb-4b5b-ba40-e5105e344dee", - "title": "Service Source Filter [Logs Microsoft 365 Defender]", + "panelIndex": "5852497b-14e8-4c1e-a9ab-fc387a3ae672", + "title": "Table of Contents", "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "field": "m365_defender.incident.alert.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "filters": [ - { - "input": { - "language": "kuery", - "query": "" - }, - "label": "Total Alerts" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.alert.status : \"new\" " - }, - "label": "New Alerts" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.alert.status : \"inProgress\" " + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6ddc53cd-2bbd-4616-837b-3fbe0712ca7e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4dc6b906-d0f7-4c34-b48b-055f291cfc90", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6ddc53cd-2bbd-4616-837b-3fbe0712ca7e": { + "columnOrder": [ + "330da6b3-a0e3-41b9-8103-69b3381f1788", + "6400adfe-4702-4f13-923f-f94d87aa0ced", + "6400adfe-4702-4f13-923f-f94d87aa0cedX0", + "6400adfe-4702-4f13-923f-f94d87aa0cedX1" + ], + "columns": { + "330da6b3-a0e3-41b9-8103-69b3381f1788": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "" + }, + "label": "Total Alerts" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.alert.status : \"new\" " + }, + "label": "New Alerts" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.alert.status : \"inProgress\" " + }, + "label": "In Progress Alerts" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.alert.status : \"resolved\" " + }, + "label": "Resolved Alerts" + }, + { + "input": { + "language": "kuery", + "query": "m365_defender.incident.alert.severity : \"high\"" + }, + "label": "High Severity Alerts" + }, + { + "input": { + "language": "kuery", + "query": "not (m365_defender.incident.alert.assigned_to : * )" + }, + "label": "Unassigned Alerts" + } + ] + }, + "scale": "ordinal" }, - "label": "InProgress Alerts" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.alert.status : \"resolved\" " + "6400adfe-4702-4f13-923f-f94d87aa0ced": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(m365_defender.incident.alert.id), 0)", + "isFormulaBroken": false + }, + "references": [ + "6400adfe-4702-4f13-923f-f94d87aa0cedX1" + ], + "scale": "ratio" }, - "label": "Resolved Alerts" - }, - { - "input": { - "language": "kuery", - "query": "m365_defender.incident.alert.severity : \"high\"" + "6400adfe-4702-4f13-923f-f94d87aa0cedX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "m365_defender.incident.alert.id" }, - "label": "High Severity Alerts" + "6400adfe-4702-4f13-923f-f94d87aa0cedX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "6400adfe-4702-4f13-923f-f94d87aa0cedX0", + 0 + ], + "location": { + "max": 58, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(m365_defender.incident.alert.id), 0)", + "type": "function" + } + }, + "references": [ + "6400adfe-4702-4f13-923f-f94d87aa0cedX0" + ], + "scale": "ratio" + } }, - { - "input": { - "language": "kuery", - "query": "not (m365_defender.incident.alert.assigned_to : * )" - }, - "label": "Unassigned Alerts" - } - ] + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - "schema": "group", - "type": "filters" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4dc6b906-d0f7-4c34-b48b-055f291cfc90", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } } ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "type": "metric" + "visualization": { + "breakdownByAccessor": "330da6b3-a0e3-41b9-8103-69b3381f1788", + "color": "#6092C0", + "layerId": "6ddc53cd-2bbd-4616-837b-3fbe0712ca7e", + "layerType": "data", + "metricAccessor": "6400adfe-4702-4f13-923f-f94d87aa0ced" + } }, - "title": "", - "type": "metric", - "uiState": {} - } + "title": "Alert Counts [Logs Microsoft 365 Defender] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 10, + "h": 8, "i": "8ed4553a-d396-4ad7-b247-10e005d65086", - "w": 34, - "x": 14, + "w": 40, + "x": 8, "y": 0 }, "panelIndex": "8ed4553a-d396-4ad7-b247-10e005d65086", "title": "Alert Counts [Logs Microsoft 365 Defender]", - "type": "visualization", - "version": "7.16.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -227,18 +268,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-874da7c4-ebe5-4c5c-a302-094d287b81bb", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-874da7c4-ebe5-4c5c-a302-094d287b81bb", + "name": "2128586b-14fe-4907-84a9-4c193f8a2c5f", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "874da7c4-ebe5-4c5c-a302-094d287b81bb": { "columnOrder": [ @@ -280,7 +322,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2128586b-14fe-4907-84a9-4c193f8a2c5f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -289,15 +355,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "91075489-5815-4881-af42-d6e31205b1c5" - ], "layerId": "874da7c4-ebe5-4c5c-a302-094d287b81bb", "layerType": "data", - "legendDisplay": "default", - "metric": "2d7b439a-58f9-400c-b89a-c5ef01f6d82b", + "legendDisplay": "show", + "legendSize": "auto", + "metrics": [ + "2d7b439a-58f9-400c-b89a-c5ef01f6d82b" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "91075489-5815-4881-af42-d6e31205b1c5" + ] } ], "shape": "pie" @@ -311,16 +380,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 23, "i": "00c0b388-64b8-49c8-9ccb-de8e58030b4d", - "w": 24, - "x": 0, - "y": 10 + "w": 13, + "x": 8, + "y": 8 }, "panelIndex": "00c0b388-64b8-49c8-9ccb-de8e58030b4d", "title": "Distribution of Alerts by Severity [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -328,26 +397,27 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-2fa8c035-1708-4d32-88fc-b59af7751db4", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", + "name": "d7bb4468-3be1-458a-b9e0-bd84db7e308a", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d": { + "2fa8c035-1708-4d32-88fc-b59af7751db4": { "columnOrder": [ - "f65e2e2e-1d06-4965-871e-0c559e325343", - "26cd4cd0-0825-47aa-932b-e620a6329167" + "ccf17a24-dc07-4800-983f-8c507665a6a0", + "87199ce0-75a4-414f-860f-7c25177fb5b3" ], "columns": { - "26cd4cd0-0825-47aa-932b-e620a6329167": { + "87199ce0-75a4-414f-860f-7c25177fb5b3": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -356,17 +426,24 @@ "scale": "ratio", "sourceField": "m365_defender.incident.alert.id" }, - "f65e2e2e-1d06-4965-871e-0c559e325343": { + "ccf17a24-dc07-4800-983f-8c507665a6a0": { "customLabel": true, - "dataType": "date", + "dataType": "string", "isBucketed": true, - "label": "Timestamp", - "operationType": "date_histogram", + "label": "Attack Kill-Chain Category", + "operationType": "terms", "params": { - "interval": "auto" + "missingBucket": false, + "orderBy": { + "columnId": "87199ce0-75a4-414f-860f-7c25177fb5b3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 }, - "scale": "interval", - "sourceField": "m365_defender.incident.alert.last_update_datetime" + "scale": "ordinal", + "sourceField": "threat.tactic.name" } }, "incompleteColumns": {} @@ -374,7 +451,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d7bb4468-3be1-458a-b9e0-bd84db7e308a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -383,21 +484,22 @@ "layers": [ { "accessors": [ - "26cd4cd0-0825-47aa-932b-e620a6329167" + "87199ce0-75a4-414f-860f-7c25177fb5b3" ], - "layerId": "d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", + "layerId": "2fa8c035-1708-4d32-88fc-b59af7751db4", "layerType": "data", "position": "top", - "seriesType": "line", + "seriesType": "bar_stacked", "showGridlines": false, - "xAccessor": "f65e2e2e-1d06-4965-871e-0c559e325343" + "xAccessor": "ccf17a24-dc07-4800-983f-8c507665a6a0" } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, - "preferredSeriesType": "line", + "preferredSeriesType": "bar_stacked", "title": "Empty XY chart", "valueLabels": "hide", "yLeftExtent": { @@ -416,16 +518,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613", - "w": 24, - "x": 24, - "y": 10 + "h": 23, + "i": "8e4019a0-6594-4eaf-9358-c343b72aba84", + "w": 13, + "x": 21, + "y": 8 }, - "panelIndex": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613", - "title": "Count of Alerts Over Time [Logs Microsoft 365 Defender]", + "panelIndex": "8e4019a0-6594-4eaf-9358-c343b72aba84", + "title": "Distribution of Alerts by Category [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -433,26 +535,27 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-45d80486-c9c8-4d28-bbcd-5d29072c9cb9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-2fa8c035-1708-4d32-88fc-b59af7751db4", + "name": "57b64179-81e7-4d61-b50b-23d21323b9da", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "2fa8c035-1708-4d32-88fc-b59af7751db4": { + "45d80486-c9c8-4d28-bbcd-5d29072c9cb9": { "columnOrder": [ - "ccf17a24-dc07-4800-983f-8c507665a6a0", - "87199ce0-75a4-414f-860f-7c25177fb5b3" + "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6", + "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389" ], "columns": { - "87199ce0-75a4-414f-860f-7c25177fb5b3": { + "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -461,16 +564,16 @@ "scale": "ratio", "sourceField": "m365_defender.incident.alert.id" }, - "ccf17a24-dc07-4800-983f-8c507665a6a0": { + "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Attack Kill-Chain Category", + "label": "Determination", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "87199ce0-75a4-414f-860f-7c25177fb5b3", + "columnId": "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389", "type": "column" }, "orderDirection": "desc", @@ -478,7 +581,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "threat.tactic.name" + "sourceField": "m365_defender.incident.alert.determination" } }, "incompleteColumns": {} @@ -486,27 +589,208 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "57b64179-81e7-4d61-b50b-23d21323b9da", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ - { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { "accessors": [ - "87199ce0-75a4-414f-860f-7c25177fb5b3" + "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389" ], - "layerId": "2fa8c035-1708-4d32-88fc-b59af7751db4", + "layerId": "45d80486-c9c8-4d28-bbcd-5d29072c9cb9", + "layerType": "data", + "seriesType": "bar_stacked", + "xAccessor": "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 23, + "i": "1f836fdc-61f4-4cf4-a392-50276a2b77f1", + "w": 14, + "x": 34, + "y": 8 + }, + "panelIndex": "1f836fdc-61f4-4cf4-a392-50276a2b77f1", + "title": "Distribution of Alerts by Determination [Logs Microsoft 365 Defender]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bdba4af5-1396-46ec-ad04-59157e7697f9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a06ad11b-3d3e-48e1-bb6c-08f62f8b0b58", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bdba4af5-1396-46ec-ad04-59157e7697f9": { + "columnOrder": [ + "a643f53b-fe39-4a6d-8916-e6eee4a3d30b", + "cd1300db-e9d8-41c8-9407-0159ec6e9410" + ], + "columns": { + "a643f53b-fe39-4a6d-8916-e6eee4a3d30b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Service Source", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "cd1300db-e9d8-41c8-9407-0159ec6e9410", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.provider" + }, + "cd1300db-e9d8-41c8-9407-0159ec6e9410": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "m365_defender.incident.alert.id" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a06ad11b-3d3e-48e1-bb6c-08f62f8b0b58", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "cd1300db-e9d8-41c8-9407-0159ec6e9410" + ], + "layerId": "bdba4af5-1396-46ec-ad04-59157e7697f9", "layerType": "data", "position": "top", "seriesType": "bar_stacked", "showGridlines": false, - "xAccessor": "ccf17a24-dc07-4800-983f-8c507665a6a0" + "xAccessor": "a643f53b-fe39-4a6d-8916-e6eee4a3d30b" } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -522,22 +806,190 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 21, + "i": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae", + "w": 13, + "x": 8, + "y": 31 + }, + "panelIndex": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae", + "title": "Distribution of Alerts by Service Source [Logs Microsoft 365 Defender]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a0e68595-3ccc-4ff9-90fb-8087bc439020", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "742836c8-3532-4e18-b067-26e3af1b0e3b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "438f3787-c321-45a5-9cca-89571591b016", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a0e68595-3ccc-4ff9-90fb-8087bc439020": { + "columnOrder": [ + "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a", + "2c72b146-36c7-4143-baba-517b19d159bc" + ], + "columns": { + "2c72b146-36c7-4143-baba-517b19d159bc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "m365_defender.incident.alert.id" + }, + "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Email Sender IP", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "2c72b146-36c7-4143-baba-517b19d159bc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "m365_defender.incident.alert.evidence.sender_ip" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "742836c8-3532-4e18-b067-26e3af1b0e3b", + "key": "m365_defender.incident.alert.evidence.verdict", + "negate": false, + "params": [ + "malicious", + "suspicious" + ], + "type": "phrases", + "value": [ + "malicious", + "suspicious" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.incident.alert.evidence.verdict": "malicious" + } + }, + { + "match_phrase": { + "m365_defender.incident.alert.evidence.verdict": "suspicious" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "438f3787-c321-45a5-9cca-89571591b016", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a", + "isTransposed": false + }, + { + "columnId": "2c72b146-36c7-4143-baba-517b19d159bc", + "isTransposed": false + } + ], + "layerId": "a0e68595-3ccc-4ff9-90fb-8087bc439020", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "8e4019a0-6594-4eaf-9358-c343b72aba84", - "w": 24, - "x": 0, - "y": 25 + "h": 21, + "i": "6847c21e-2ec0-4af4-aa67-ec52b181b05e", + "w": 13, + "x": 21, + "y": 31 }, - "panelIndex": "8e4019a0-6594-4eaf-9358-c343b72aba84", - "title": "Distribution of Alerts by Category [Logs Microsoft 365 Defender]", + "panelIndex": "6847c21e-2ec0-4af4-aa67-ec52b181b05e", + "title": "Top 10 Email Sender IP with Suspicious or Malicious Verdict [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -545,18 +997,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-24cc5824-23e2-462f-b38f-4769ea95322a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-24cc5824-23e2-462f-b38f-4769ea95322a", + "name": "7a5d204e-cb61-4c0d-8923-28afeb2927a2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "24cc5824-23e2-462f-b38f-4769ea95322a": { "columnOrder": [ @@ -598,7 +1051,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7a5d204e-cb61-4c0d-8923-28afeb2927a2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -615,7 +1092,9 @@ } ], "layerId": "24cc5824-23e2-462f-b38f-4769ea95322a", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -626,16 +1105,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 21, "i": "51f47e38-eed6-42b3-8096-a39b914909da", - "w": 24, - "x": 24, - "y": 25 + "w": 14, + "x": 34, + "y": 31 }, "panelIndex": "51f47e38-eed6-42b3-8096-a39b914909da", "title": "Top 10 Detection Source that identified most of the Alerts [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -643,26 +1122,27 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-45d80486-c9c8-4d28-bbcd-5d29072c9cb9", + "name": "be5d6d70-2d76-4b3c-bc34-c27a83b81991", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "45d80486-c9c8-4d28-bbcd-5d29072c9cb9": { + "d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d": { "columnOrder": [ - "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6", - "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389" + "f65e2e2e-1d06-4965-871e-0c559e325343", + "26cd4cd0-0825-47aa-932b-e620a6329167" ], "columns": { - "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389": { + "26cd4cd0-0825-47aa-932b-e620a6329167": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -671,24 +1151,18 @@ "scale": "ratio", "sourceField": "m365_defender.incident.alert.id" }, - "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6": { + "f65e2e2e-1d06-4965-871e-0c559e325343": { "customLabel": true, - "dataType": "string", + "dataType": "date", "isBucketed": true, - "label": "Determination", - "operationType": "terms", + "label": "Timestamp", + "operationType": "date_histogram", "params": { - "missingBucket": false, - "orderBy": { - "columnId": "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 10 + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ordinal", - "sourceField": "m365_defender.incident.alert.determination" + "scale": "interval", + "sourceField": "m365_defender.incident.alert.last_update_datetime" } }, "incompleteColumns": {} @@ -696,49 +1170,56 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "be5d6d70-2d76-4b3c-bc34-c27a83b81991", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { "accessors": [ - "4315d7e5-cdd4-48a1-b1b6-cfb3cfe25389" + "26cd4cd0-0825-47aa-932b-e620a6329167" ], - "layerId": "45d80486-c9c8-4d28-bbcd-5d29072c9cb9", + "layerId": "d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", "layerType": "data", - "seriesType": "bar_stacked", - "xAccessor": "fe4ba4cc-3a4f-4dbf-b79d-a3b6550f08b6" + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "f65e2e2e-1d06-4965-871e-0c559e325343" } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, + "preferredSeriesType": "line", + "title": "Empty XY chart", "valueLabels": "hide", "yLeftExtent": { "mode": "full" @@ -757,15 +1238,15 @@ }, "gridData": { "h": 15, - "i": "1f836fdc-61f4-4cf4-a392-50276a2b77f1", - "w": 24, - "x": 0, - "y": 40 + "i": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613", + "w": 40, + "x": 8, + "y": 52 }, - "panelIndex": "1f836fdc-61f4-4cf4-a392-50276a2b77f1", - "title": "Distribution of Alerts by Determination [Logs Microsoft 365 Defender]", + "panelIndex": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613", + "title": "Count of Alerts Over Time [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -773,18 +1254,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-32a410b6-1ed8-4397-ab2e-151edec25e80", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-32a410b6-1ed8-4397-ab2e-151edec25e80", + "name": "dbc8860d-394c-46cb-a626-67a20c1862c8", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "32a410b6-1ed8-4397-ab2e-151edec25e80": { "columnOrder": [ @@ -828,6 +1310,7 @@ "label": "Timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -839,7 +1322,31 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dbc8860d-394c-46cb-a626-67a20c1862c8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -877,6 +1384,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -902,90 +1410,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 16, "i": "efd3aa63-5879-4383-87e4-6276e38b3c01", - "w": 24, - "x": 24, - "y": 40 + "w": 40, + "x": 8, + "y": 67 }, "panelIndex": "efd3aa63-5879-4383-87e4-6276e38b3c01", "title": "Severity Over Time [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "field": "m365_defender.incident.alert.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Mitre Techniques", - "field": "threat.technique.subtechnique.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "asc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "title": "", - "type": "tagcloud", - "uiState": {} - } - }, - "gridData": { - "h": 25, - "i": "01078074-2eca-4980-b815-9db6afd521a8", - "w": 48, - "x": 0, - "y": 55 - }, - "panelIndex": "01078074-2eca-4980-b815-9db6afd521a8", - "title": "Top Mitre Techniques [Logs Microsoft 365 Defender]", - "type": "visualization", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -993,111 +1427,141 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-5b675bca-2096-430a-ac1e-6a435a5c3e34", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-bdba4af5-1396-46ec-ad04-59157e7697f9", + "name": "75891f9a-3458-40d6-8d3c-63de61fb3f7d", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "bdba4af5-1396-46ec-ad04-59157e7697f9": { + "5b675bca-2096-430a-ac1e-6a435a5c3e34": { "columnOrder": [ - "a643f53b-fe39-4a6d-8916-e6eee4a3d30b", - "cd1300db-e9d8-41c8-9407-0159ec6e9410" + "d04bf6a5-66f9-4899-a4d1-e2c4ec7d4b74", + "f37bb823-c831-497e-8d7e-8c00acbc11ff" ], "columns": { - "a643f53b-fe39-4a6d-8916-e6eee4a3d30b": { + "d04bf6a5-66f9-4899-a4d1-e2c4ec7d4b74": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Service Source", + "label": "Mitre Technique", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "cd1300db-e9d8-41c8-9407-0159ec6e9410", + "columnId": "f37bb823-c831-497e-8d7e-8c00acbc11ff", "type": "column" }, "orderDirection": "desc", "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", - "sourceField": "event.provider" + "sourceField": "threat.technique.subtechnique.id" }, - "cd1300db-e9d8-41c8-9407-0159ec6e9410": { + "f37bb823-c831-497e-8d7e-8c00acbc11ff": { "customLabel": true, "dataType": "number", "isBucketed": false, "label": "Count", - "operationType": "unique_count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, "scale": "ratio", - "sourceField": "m365_defender.incident.alert.id" + "sourceField": "___records___" } }, - "incompleteColumns": {} + "incompleteColumns": {}, + "sampling": 1 } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "75891f9a-3458-40d6-8d3c-63de61fb3f7d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "accessors": [ - "cd1300db-e9d8-41c8-9407-0159ec6e9410" - ], - "layerId": "bdba4af5-1396-46ec-ad04-59157e7697f9", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "a643f53b-fe39-4a6d-8916-e6eee4a3d30b" + "columnId": "f37bb823-c831-497e-8d7e-8c00acbc11ff", + "isTransposed": false + }, + { + "columnId": "d04bf6a5-66f9-4899-a4d1-e2c4ec7d4b74", + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "title": "Empty XY chart", - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" + "layerId": "5b675bca-2096-430a-ac1e-6a435a5c3e34", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 } } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae", - "w": 24, - "x": 0, - "y": 80 + "h": 14, + "i": "7317b469-4895-497a-a263-14b58eaec52f", + "w": 20, + "x": 8, + "y": 83 }, - "panelIndex": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae", - "title": "Distribution of Alerts by Service Source [Logs Microsoft 365 Defender]", + "panelIndex": "7317b469-4895-497a-a263-14b58eaec52f", + "title": "Top Mitre Techniques [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1105,31 +1569,32 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-a0e68595-3ccc-4ff9-90fb-8087bc439020", + "name": "bfd73a62-e6c5-4126-9065-f4b17a1e4680", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "108199c0-a675-4fe1-87a9-4599aa85db91", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "a0e68595-3ccc-4ff9-90fb-8087bc439020": { + "bf6ca0e6-4c26-4cff-b35c-a1a578a38d20": { "columnOrder": [ - "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a", - "2c72b146-36c7-4143-baba-517b19d159bc" + "7048d5d3-a8bc-4b71-8b79-e51c6adc0350", + "471be050-ea96-4ce7-8cef-00ca90e6fbed" ], "columns": { - "2c72b146-36c7-4143-baba-517b19d159bc": { + "471be050-ea96-4ce7-8cef-00ca90e6fbed": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -1138,16 +1603,16 @@ "scale": "ratio", "sourceField": "m365_defender.incident.alert.id" }, - "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a": { + "7048d5d3-a8bc-4b71-8b79-e51c6adc0350": { "customLabel": true, - "dataType": "ip", + "dataType": "string", "isBucketed": true, - "label": "Email Sender IP", + "label": "User Account", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "columnId": "2c72b146-36c7-4143-baba-517b19d159bc", + "columnId": "471be050-ea96-4ce7-8cef-00ca90e6fbed", "type": "column" }, "orderDirection": "desc", @@ -1155,7 +1620,7 @@ "size": 10 }, "scale": "ordinal", - "sourceField": "m365_defender.incident.alert.evidence.sender_ip" + "sourceField": "m365_defender.incident.alert.evidence.user_account.account_name" } }, "incompleteColumns": {} @@ -1171,34 +1636,44 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "m365_defender.incident.alert.evidence.verdict", + "index": "bfd73a62-e6c5-4126-9065-f4b17a1e4680", + "key": "m365_defender.incident.alert.evidence.roles", "negate": false, - "params": [ - "malicious", - "suspicious" - ], - "type": "phrases" + "params": { + "query": "compromised" + }, + "type": "phrase" }, "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "m365_defender.incident.alert.evidence.verdict": "malicious" - } - }, - { - "match_phrase": { - "m365_defender.incident.alert.evidence.verdict": "suspicious" - } - } - ] + "match_phrase": { + "m365_defender.incident.alert.evidence.roles": "compromised" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "108199c0-a675-4fe1-87a9-4599aa85db91", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" } } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1206,16 +1681,18 @@ "visualization": { "columns": [ { - "columnId": "d8c5d781-6442-4a9f-b91b-8b7b29d8e73a", + "columnId": "7048d5d3-a8bc-4b71-8b79-e51c6adc0350", "isTransposed": false }, { - "columnId": "2c72b146-36c7-4143-baba-517b19d159bc", + "columnId": "471be050-ea96-4ce7-8cef-00ca90e6fbed", "isTransposed": false } ], - "layerId": "a0e68595-3ccc-4ff9-90fb-8087bc439020", - "layerType": "data" + "layerId": "bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1226,16 +1703,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "6847c21e-2ec0-4af4-aa67-ec52b181b05e", - "w": 24, - "x": 24, - "y": 80 + "h": 14, + "i": "d8b78c44-5d93-4a70-9d3d-0386581082d1", + "w": 20, + "x": 28, + "y": 83 }, - "panelIndex": "6847c21e-2ec0-4af4-aa67-ec52b181b05e", - "title": "Top 10 Email Sender IP with Suspicious or Malicious Verdict [Logs Microsoft 365 Defender]", + "panelIndex": "d8b78c44-5d93-4a70-9d3d-0386581082d1", + "title": "Top 10 User Account with Compromised Role [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1243,23 +1720,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-3f509783-a68e-46a5-a9ea-6c51a0bcf036", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-3f509783-a68e-46a5-a9ea-6c51a0bcf036", + "name": "eaea7ed4-6b0d-4522-8e92-34b831024614", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "8d4d1674-3434-45ae-b1f9-83b5c02ea1b3", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f509783-a68e-46a5-a9ea-6c51a0bcf036": { "columnOrder": [ @@ -1309,14 +1787,18 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "eaea7ed4-6b0d-4522-8e92-34b831024614", "key": "m365_defender.incident.alert.evidence.verdict", "negate": false, "params": [ "malicious", "suspicious" ], - "type": "phrases" + "type": "phrases", + "value": [ + "malicious", + "suspicious" + ] }, "query": { "bool": { @@ -1335,111 +1817,7 @@ ] } } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "3f1e354e-7c22-434e-9a0d-22e8b81f63b5", - "isTransposed": false - }, - { - "columnId": "82a086d9-d047-4bc2-a791-c13d1f056f9c", - "isTransposed": false - } - ], - "layerId": "3f509783-a68e-46a5-a9ea-6c51a0bcf036", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "34673480-15c2-4f75-ae86-637bc6875e78", - "w": 24, - "x": 0, - "y": 95 - }, - "panelIndex": "34673480-15c2-4f75-ae86-637bc6875e78", - "title": "Top 10 Process Commands with Suspicious or Malicious Verdict [Logs Microsoft 365 Defender]", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "bf6ca0e6-4c26-4cff-b35c-a1a578a38d20": { - "columnOrder": [ - "7048d5d3-a8bc-4b71-8b79-e51c6adc0350", - "471be050-ea96-4ce7-8cef-00ca90e6fbed" - ], - "columns": { - "471be050-ea96-4ce7-8cef-00ca90e6fbed": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "m365_defender.incident.alert.id" - }, - "7048d5d3-a8bc-4b71-8b79-e51c6adc0350": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "User Account", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "471be050-ea96-4ce7-8cef-00ca90e6fbed", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "m365_defender.incident.alert.evidence.user_account.account_name" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ + }, { "$state": { "store": "appState" @@ -1447,21 +1825,23 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "m365_defender.incident.alert.evidence.roles", + "field": "data_stream.dataset", + "index": "8d4d1674-3434-45ae-b1f9-83b5c02ea1b3", + "key": "data_stream.dataset", "negate": false, "params": { - "query": "compromised" + "query": "m365_defender.incident" }, "type": "phrase" }, "query": { "match_phrase": { - "m365_defender.incident.alert.evidence.roles": "compromised" + "data_stream.dataset": "m365_defender.incident" } } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1469,16 +1849,18 @@ "visualization": { "columns": [ { - "columnId": "7048d5d3-a8bc-4b71-8b79-e51c6adc0350", + "columnId": "3f1e354e-7c22-434e-9a0d-22e8b81f63b5", "isTransposed": false }, { - "columnId": "471be050-ea96-4ce7-8cef-00ca90e6fbed", + "columnId": "82a086d9-d047-4bc2-a791-c13d1f056f9c", "isTransposed": false } ], - "layerId": "bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", - "layerType": "data" + "layerId": "3f509783-a68e-46a5-a9ea-6c51a0bcf036", + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1489,16 +1871,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "d8b78c44-5d93-4a70-9d3d-0386581082d1", - "w": 24, - "x": 24, - "y": 95 + "h": 17, + "i": "34673480-15c2-4f75-ae86-637bc6875e78", + "w": 20, + "x": 8, + "y": 97 }, - "panelIndex": "d8b78c44-5d93-4a70-9d3d-0386581082d1", - "title": "Top 10 User Account with Compromised Role [Logs Microsoft 365 Defender]", + "panelIndex": "34673480-15c2-4f75-ae86-637bc6875e78", + "title": "Top 10 Process Commands with Suspicious or Malicious Verdict [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1506,23 +1888,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-6e6323ee-5d54-4720-85b5-f567b8ef9d21", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6e6323ee-5d54-4720-85b5-f567b8ef9d21", + "name": "dd37b426-93bd-4376-8f4d-831cfa0673d8", "type": "index-pattern" }, { "id": "logs-*", - "name": "filter-index-pattern-0", + "name": "5bd954c2-632c-40c9-a72f-47d8ed59a63b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6e6323ee-5d54-4720-85b5-f567b8ef9d21": { "columnOrder": [ @@ -1572,7 +1955,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "dd37b426-93bd-4376-8f4d-831cfa0673d8", "key": "m365_defender.incident.alert.evidence.roles", "negate": false, "params": { @@ -1585,8 +1968,31 @@ "m365_defender.incident.alert.evidence.roles": "attacked" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5bd954c2-632c-40c9-a72f-47d8ed59a63b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "m365_defender.incident" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "m365_defender.incident" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1603,7 +2009,9 @@ } ], "layerId": "6e6323ee-5d54-4720-85b5-f567b8ef9d21", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1614,198 +2022,219 @@ "hidePanelTitles": false }, "gridData": { - "h": 18, + "h": 17, "i": "664a1613-6c7e-40cd-91b2-43ce6c451ddb", - "w": 48, - "x": 0, - "y": 110 + "w": 20, + "x": 28, + "y": 97 }, "panelIndex": "664a1613-6c7e-40cd-91b2-43ce6c451ddb", "title": "Top 10 Most Attacked Device [Logs Microsoft 365 Defender]", "type": "lens", - "version": "7.16.0" + "version": "8.7.1" }, { "embeddableConfig": { "enhancements": {} }, "gridData": { - "h": 24, + "h": 20, "i": "b83be89c-7f77-406b-9028-1cfb0eb67e8d", - "w": 48, - "x": 0, - "y": 128 + "w": 40, + "x": 8, + "y": 114 }, "panelIndex": "b83be89c-7f77-406b-9028-1cfb0eb67e8d", "panelRefName": "panel_b83be89c-7f77-406b-9028-1cfb0eb67e8d", "type": "search", - "version": "7.16.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Microsoft 365 Defender] Alert", "version": 1 }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T08:41:26.216Z", "id": "m365_defender-d80d7840-4366-11ed-b1f2-e917f608bd03", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "8ed4553a-d396-4ad7-b247-10e005d65086:indexpattern-datasource-layer-6ddc53cd-2bbd-4616-837b-3fbe0712ca7e", "type": "index-pattern" }, { "id": "logs-*", - "name": "9aa74a70-d9fb-4b5b-ba40-e5105e344dee:control_9aa74a70-d9fb-4b5b-ba40-e5105e344dee_0_index_pattern", + "name": "8ed4553a-d396-4ad7-b247-10e005d65086:4dc6b906-d0f7-4c34-b48b-055f291cfc90", "type": "index-pattern" }, { "id": "logs-*", - "name": "8ed4553a-d396-4ad7-b247-10e005d65086:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "00c0b388-64b8-49c8-9ccb-de8e58030b4d:indexpattern-datasource-layer-874da7c4-ebe5-4c5c-a302-094d287b81bb", "type": "index-pattern" }, { "id": "logs-*", - "name": "00c0b388-64b8-49c8-9ccb-de8e58030b4d:indexpattern-datasource-current-indexpattern", + "name": "00c0b388-64b8-49c8-9ccb-de8e58030b4d:2128586b-14fe-4907-84a9-4c193f8a2c5f", "type": "index-pattern" }, { "id": "logs-*", - "name": "00c0b388-64b8-49c8-9ccb-de8e58030b4d:indexpattern-datasource-layer-874da7c4-ebe5-4c5c-a302-094d287b81bb", + "name": "8e4019a0-6594-4eaf-9358-c343b72aba84:indexpattern-datasource-layer-2fa8c035-1708-4d32-88fc-b59af7751db4", "type": "index-pattern" }, { "id": "logs-*", - "name": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613:indexpattern-datasource-current-indexpattern", + "name": "8e4019a0-6594-4eaf-9358-c343b72aba84:d7bb4468-3be1-458a-b9e0-bd84db7e308a", "type": "index-pattern" }, { "id": "logs-*", - "name": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613:indexpattern-datasource-layer-d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", + "name": "1f836fdc-61f4-4cf4-a392-50276a2b77f1:indexpattern-datasource-layer-45d80486-c9c8-4d28-bbcd-5d29072c9cb9", "type": "index-pattern" }, { "id": "logs-*", - "name": "8e4019a0-6594-4eaf-9358-c343b72aba84:indexpattern-datasource-current-indexpattern", + "name": "1f836fdc-61f4-4cf4-a392-50276a2b77f1:57b64179-81e7-4d61-b50b-23d21323b9da", "type": "index-pattern" }, { "id": "logs-*", - "name": "8e4019a0-6594-4eaf-9358-c343b72aba84:indexpattern-datasource-layer-2fa8c035-1708-4d32-88fc-b59af7751db4", + "name": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae:indexpattern-datasource-layer-bdba4af5-1396-46ec-ad04-59157e7697f9", "type": "index-pattern" }, { "id": "logs-*", - "name": "51f47e38-eed6-42b3-8096-a39b914909da:indexpattern-datasource-current-indexpattern", + "name": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae:a06ad11b-3d3e-48e1-bb6c-08f62f8b0b58", "type": "index-pattern" }, { "id": "logs-*", - "name": "51f47e38-eed6-42b3-8096-a39b914909da:indexpattern-datasource-layer-24cc5824-23e2-462f-b38f-4769ea95322a", + "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:indexpattern-datasource-layer-a0e68595-3ccc-4ff9-90fb-8087bc439020", "type": "index-pattern" }, { "id": "logs-*", - "name": "1f836fdc-61f4-4cf4-a392-50276a2b77f1:indexpattern-datasource-current-indexpattern", + "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:742836c8-3532-4e18-b067-26e3af1b0e3b", "type": "index-pattern" }, { "id": "logs-*", - "name": "1f836fdc-61f4-4cf4-a392-50276a2b77f1:indexpattern-datasource-layer-45d80486-c9c8-4d28-bbcd-5d29072c9cb9", + "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:438f3787-c321-45a5-9cca-89571591b016", "type": "index-pattern" }, { "id": "logs-*", - "name": "efd3aa63-5879-4383-87e4-6276e38b3c01:indexpattern-datasource-current-indexpattern", + "name": "51f47e38-eed6-42b3-8096-a39b914909da:indexpattern-datasource-layer-24cc5824-23e2-462f-b38f-4769ea95322a", "type": "index-pattern" }, { "id": "logs-*", - "name": "efd3aa63-5879-4383-87e4-6276e38b3c01:indexpattern-datasource-layer-32a410b6-1ed8-4397-ab2e-151edec25e80", + "name": "51f47e38-eed6-42b3-8096-a39b914909da:7a5d204e-cb61-4c0d-8923-28afeb2927a2", "type": "index-pattern" }, { "id": "logs-*", - "name": "01078074-2eca-4980-b815-9db6afd521a8:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613:indexpattern-datasource-layer-d2d7332c-5fbd-4acc-bef9-a1f2a2a6a25d", "type": "index-pattern" }, { "id": "logs-*", - "name": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae:indexpattern-datasource-current-indexpattern", + "name": "62846e2a-f412-4cf9-b8ea-b08bc7fbd613:be5d6d70-2d76-4b3c-bc34-c27a83b81991", "type": "index-pattern" }, { "id": "logs-*", - "name": "b5b7f2a4-1d6e-4812-8724-5a771014c3ae:indexpattern-datasource-layer-bdba4af5-1396-46ec-ad04-59157e7697f9", + "name": "efd3aa63-5879-4383-87e4-6276e38b3c01:indexpattern-datasource-layer-32a410b6-1ed8-4397-ab2e-151edec25e80", "type": "index-pattern" }, { "id": "logs-*", - "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:indexpattern-datasource-current-indexpattern", + "name": "efd3aa63-5879-4383-87e4-6276e38b3c01:dbc8860d-394c-46cb-a626-67a20c1862c8", "type": "index-pattern" }, { "id": "logs-*", - "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:indexpattern-datasource-layer-a0e68595-3ccc-4ff9-90fb-8087bc439020", + "name": "7317b469-4895-497a-a263-14b58eaec52f:indexpattern-datasource-layer-5b675bca-2096-430a-ac1e-6a435a5c3e34", "type": "index-pattern" }, { "id": "logs-*", - "name": "6847c21e-2ec0-4af4-aa67-ec52b181b05e:filter-index-pattern-0", + "name": "7317b469-4895-497a-a263-14b58eaec52f:75891f9a-3458-40d6-8d3c-63de61fb3f7d", "type": "index-pattern" }, { "id": "logs-*", - "name": "34673480-15c2-4f75-ae86-637bc6875e78:indexpattern-datasource-current-indexpattern", + "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:indexpattern-datasource-layer-bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", "type": "index-pattern" }, { "id": "logs-*", - "name": "34673480-15c2-4f75-ae86-637bc6875e78:indexpattern-datasource-layer-3f509783-a68e-46a5-a9ea-6c51a0bcf036", + "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:bfd73a62-e6c5-4126-9065-f4b17a1e4680", "type": "index-pattern" }, { "id": "logs-*", - "name": "34673480-15c2-4f75-ae86-637bc6875e78:filter-index-pattern-0", + "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:108199c0-a675-4fe1-87a9-4599aa85db91", "type": "index-pattern" }, { "id": "logs-*", - "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:indexpattern-datasource-current-indexpattern", + "name": "34673480-15c2-4f75-ae86-637bc6875e78:indexpattern-datasource-layer-3f509783-a68e-46a5-a9ea-6c51a0bcf036", "type": "index-pattern" }, { "id": "logs-*", - "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:indexpattern-datasource-layer-bf6ca0e6-4c26-4cff-b35c-a1a578a38d20", + "name": "34673480-15c2-4f75-ae86-637bc6875e78:eaea7ed4-6b0d-4522-8e92-34b831024614", "type": "index-pattern" }, { "id": "logs-*", - "name": "d8b78c44-5d93-4a70-9d3d-0386581082d1:filter-index-pattern-0", + "name": "34673480-15c2-4f75-ae86-637bc6875e78:8d4d1674-3434-45ae-b1f9-83b5c02ea1b3", "type": "index-pattern" }, { "id": "logs-*", - "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:indexpattern-datasource-current-indexpattern", + "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:indexpattern-datasource-layer-6e6323ee-5d54-4720-85b5-f567b8ef9d21", "type": "index-pattern" }, { "id": "logs-*", - "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:indexpattern-datasource-layer-6e6323ee-5d54-4720-85b5-f567b8ef9d21", + "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:dd37b426-93bd-4376-8f4d-831cfa0673d8", "type": "index-pattern" }, { "id": "logs-*", - "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:filter-index-pattern-0", + "name": "664a1613-6c7e-40cd-91b2-43ce6c451ddb:5bd954c2-632c-40c9-a72f-47d8ed59a63b", "type": "index-pattern" }, { "id": "m365_defender-989afc60-44a5-11ed-8375-0168a9970c06", "name": "b83be89c-7f77-406b-9028-1cfb0eb67e8d:panel_b83be89c-7f77-406b-9028-1cfb0eb67e8d", "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_5779a7c6-acf5-4f7d-ac4c-caae9517d95e:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e61071e0-ba4d-4765-9267-e035395b221f:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ec5d23b5-535c-483a-88ad-279762f3d5ca:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_cef3df17-225a-4373-a231-caa594cd1bf4:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/m365_defender/kibana/search/m365_defender-64a31410-722c-11ed-8657-c59f6ece834c.json b/packages/m365_defender/kibana/search/m365_defender-64a31410-722c-11ed-8657-c59f6ece834c.json index 7f034a5eeaf..3007ec1adea 100644 --- a/packages/m365_defender/kibana/search/m365_defender-64a31410-722c-11ed-8657-c59f6ece834c.json +++ b/packages/m365_defender/kibana/search/m365_defender-64a31410-722c-11ed-8657-c59f6ece834c.json @@ -1,17 +1,16 @@ { "attributes": { "columns": [ - "host.domain", + "host.name", "host.id", - "host.ip", - "host.mac", - "host.type", - "host.os.name", - "m365_defender.event.logged_on_users" + "m365_defender.event.sensor_health_state", + "observer.type", + "observer.version" ], "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -25,14 +24,107 @@ "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "key": "m365_defender.event.category", "negate": false, - "params": { - "query": "AdvancedHunting-DeviceInfo" - }, - "type": "phrase" + "params": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ], + "type": "phrases", + "value": [ + "AdvancedHunting-DeviceEvents", + "AdvancedHunting-DeviceFileCertificateInfo", + "AdvancedHunting-DeviceFileEvents", + "AdvancedHunting-DeviceImageLoadEvents", + "AdvancedHunting-DeviceInfo", + "AdvancedHunting-DeviceLogonEvents", + "AdvancedHunting-DeviceNetworkEvents", + "AdvancedHunting-DeviceNetworkInfo", + "AdvancedHunting-DeviceProcessEvents", + "AdvancedHunting-DeviceRegistryEvents" + ] }, "query": { - "match_phrase": { - "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileCertificateInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceFileEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceImageLoadEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceLogonEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceNetworkInfo" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceProcessEvents" + } + }, + { + "match_phrase": { + "m365_defender.event.category": "AdvancedHunting-DeviceRegistryEvents" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "m365_defender.event.sensor_health_state", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "m365_defender.event.sensor_health_state", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "m365_defender.event.sensor_health_state" } } } @@ -50,12 +142,15 @@ "desc" ] ], - "title": "DeviceInfo Events Essential Details [Logs Microsoft 365 Defender]" + "timeRestore": false, + "title": "Endpoint Status [Logs Microsoft 365 Defender]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T07:50:09.615Z", "id": "m365_defender-64a31410-722c-11ed-8657-c59f6ece834c", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { @@ -67,6 +162,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/m365_defender/kibana/search/m365_defender-989afc60-44a5-11ed-8375-0168a9970c06.json b/packages/m365_defender/kibana/search/m365_defender-989afc60-44a5-11ed-8375-0168a9970c06.json index 4dd53c5d108..1b288286d2f 100644 --- a/packages/m365_defender/kibana/search/m365_defender-989afc60-44a5-11ed-8375-0168a9970c06.json +++ b/packages/m365_defender/kibana/search/m365_defender-989afc60-44a5-11ed-8375-0168a9970c06.json @@ -51,10 +51,11 @@ ], "title": "Alerts Essential Details [Logs Microsoft 365 Defender]" }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T07:50:09.615Z", "id": "m365_defender-989afc60-44a5-11ed-8375-0168a9970c06", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/m365_defender/kibana/search/m365_defender-fcf25960-44af-11ed-8375-0168a9970c06.json b/packages/m365_defender/kibana/search/m365_defender-fcf25960-44af-11ed-8375-0168a9970c06.json index e0663bcc9c5..826d862b554 100644 --- a/packages/m365_defender/kibana/search/m365_defender-fcf25960-44af-11ed-8375-0168a9970c06.json +++ b/packages/m365_defender/kibana/search/m365_defender-fcf25960-44af-11ed-8375-0168a9970c06.json @@ -51,10 +51,11 @@ ], "title": "Incidents Essential Details [Logs Microsoft 365 Defender]" }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-09-04T07:50:09.615Z", "id": "m365_defender-fcf25960-44af-11ed-8375-0168a9970c06", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/m365_defender/kibana/tags.yml b/packages/m365_defender/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/m365_defender/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/m365_defender/manifest.yml b/packages/m365_defender/manifest.yml index b16e2d21f27..c50693b77f9 100644 --- a/packages/m365_defender/manifest.yml +++ b/packages/m365_defender/manifest.yml @@ -1,16 +1,17 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: m365_defender title: Microsoft M365 Defender -version: "1.11.2" +version: "2.2.0" description: Collect logs from Microsoft M365 Defender with Elastic Agent. categories: - "security" - "edr_xdr" -release: ga type: integration conditions: - elastic.subscription: basic - kibana.version: ^8.7.1 + elastic: + subscription: basic + kibana: + version: ^8.7.1 policy_templates: - name: m365_defender title: M365 Defender Logs @@ -26,7 +27,14 @@ policy_templates: required: true show_user: false default: https://login.microsoftonline.com - description: "URL of Login Server 'tenant-id/oauth2/token added automatically'." + description: "URL of Login Server 'tenant-id and token endpoint added automatically'." + - name: token_endpoint + type: text + title: OAuth Token endpoint + required: true + show_user: false + default: oauth2/v2.0/token + description: "Microsoft supports multiple Oauth2 URL endpoints, the default is oauth2/v2.0/token, but can also be oauth2/token" - name: enable_request_tracer type: bool title: Enable request tracing @@ -100,25 +108,30 @@ icons: size: 32x32 type: image/svg+xml screenshots: - - src: /img/m365-defender-dashboard.png - title: Microsoft 365 Defender Alert Dashboard Screenshot + - src: /img/m365-defender-incident-alert1.png + title: Microsoft 365 Defender (Incidents) Alerts Dashboard + size: 600x600 + type: image/png + - src: /img/m365-defender-incidents-incidents1.png + title: Microsoft 365 Defender (Incidents) Incidents Dashboard size: 600x600 type: image/png - - src: /img/m365-defender-dashboard-alert.png - title: Microsoft 365 Defender Alert Events Dashboard Screenshot + - src: /img/m365-defender-events-alerts1.png + title: Microsoft 365 Defender (Events) Alerts Dashboard size: 600x600 type: image/png - - src: /img/m365-defender-dashboard-app-and-identity.png - title: Microsoft 365 Defender App and Identity Events Dashboard Screenshot + - src: /img/m365-defender-events-device1.png + title: Microsoft 365 Defender (Events) Device Dashboard size: 600x600 type: image/png - - src: /img/m365-defender-dashboard-device.png - title: Microsoft 365 Defender Device Events Dashboard Screenshot + - src: /img/m365-defender-events-email1.png + title: Microsoft 365 Defender (Events) Email Dashboard size: 600x600 type: image/png - - src: /img/m365-defender-dashboard-email.png - title: Microsoft 365 Defender Email Events Dashboard Screenshot + - src: /img/m365-defender-events-app1.png + title: Microsoft 365 Defender (Events) App & Identity Dashboard size: 600x600 type: image/png owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/mattermost/_dev/build/build.yml b/packages/mattermost/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/mattermost/_dev/build/build.yml +++ b/packages/mattermost/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/mattermost/changelog.yml b/packages/mattermost/changelog.yml index 615b9096078..469f17c1909 100644 --- a/packages/mattermost/changelog.yml +++ b/packages/mattermost/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/mattermost/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/mattermost/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 83bcaaa334d..0ecacc3e67c 100644 --- a/packages/mattermost/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/mattermost/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-12-04T23:19:32.051Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updateConfig", @@ -85,7 +85,7 @@ { "@timestamp": "2021-12-04T23:19:48.599Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updateConfig", @@ -167,7 +167,7 @@ { "@timestamp": "2021-12-04T23:19:51.324Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Logout", @@ -250,7 +250,7 @@ { "@timestamp": "2021-12-04T23:19:58.729Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login", @@ -337,7 +337,7 @@ { "@timestamp": "2021-12-04T23:20:33.027Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchUser", @@ -433,7 +433,7 @@ { "@timestamp": "2021-12-04T23:20:37.771Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchUser", @@ -529,7 +529,7 @@ { "@timestamp": "2021-12-04T23:20:53.063Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updatePassword", @@ -620,7 +620,7 @@ { "@timestamp": "2021-12-04T23:28:18.032Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updatePreferences", @@ -703,7 +703,7 @@ { "@timestamp": "2021-12-04T23:28:19.342Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "createPost", @@ -797,7 +797,7 @@ { "@timestamp": "2021-12-05T00:01:23.974Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "createChannel", @@ -889,7 +889,7 @@ { "@timestamp": "2021-12-05T00:01:48.946Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchChannel", @@ -986,7 +986,7 @@ { "@timestamp": "2021-12-05T00:01:52.914Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleteChannel", @@ -1078,7 +1078,7 @@ { "@timestamp": "2021-12-05T00:02:01.482Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "api.channel.delete_channel.deleted.app_error" @@ -1178,7 +1178,7 @@ { "@timestamp": "2021-12-05T00:02:09.835Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "error": { "code": "app.channel.update.bad_id" @@ -1286,7 +1286,7 @@ { "@timestamp": "2021-12-05T00:02:25.202Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "restoreChannel", @@ -1378,7 +1378,7 @@ { "@timestamp": "2021-12-05T00:02:31.485Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "convertChannelToPrivate", @@ -1478,7 +1478,7 @@ { "@timestamp": "2021-12-05T00:02:56.786Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removeChannelMember", @@ -1573,7 +1573,7 @@ { "@timestamp": "2021-12-05T00:03:01.043Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "getConfig", @@ -1656,7 +1656,7 @@ { "@timestamp": "2021-12-05T00:03:13.849Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "createChannel", @@ -1748,7 +1748,7 @@ { "@timestamp": "2021-12-05T00:04:01.294Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleteChannel", @@ -1840,7 +1840,7 @@ { "@timestamp": "2021-12-05T00:12:11.211Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "getConfig", @@ -1923,7 +1923,7 @@ { "@timestamp": "2021-12-05T00:12:23.085Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchTeam", @@ -2025,7 +2025,7 @@ { "@timestamp": "2021-12-05T00:12:29.655Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchTeam", @@ -2127,7 +2127,7 @@ { "@timestamp": "2021-12-05T00:12:46.044Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "createTeam", @@ -2224,7 +2224,7 @@ { "@timestamp": "2021-12-05T00:18:13.183Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removeTeamMember", @@ -2329,7 +2329,7 @@ { "@timestamp": "2021-12-05T00:18:17.907Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "revokeAllSessionsForUser", @@ -2411,7 +2411,7 @@ { "@timestamp": "2021-12-05T01:02:56.163Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "patchUser", @@ -2511,7 +2511,7 @@ { "@timestamp": "2021-12-05T01:13:26.358Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "addTeamMembers", @@ -2614,7 +2614,7 @@ { "@timestamp": "2021-12-05T01:13:08.904Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "addTeamMembers", @@ -2722,7 +2722,7 @@ { "@timestamp": "2021-12-05T01:20:06.246Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "addTeamMembers", @@ -2833,7 +2833,7 @@ { "@timestamp": "2021-12-05T17:21:36.724Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleteTeam", @@ -2909,7 +2909,7 @@ { "@timestamp": "2021-12-05T17:24:33.077Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "updateUserActive", diff --git a/packages/mattermost/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/mattermost/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index dea9759a39e..38eed83fb44 100644 --- a/packages/mattermost/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mattermost/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Mattermost audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mattermost/data_stream/audit/sample_event.json b/packages/mattermost/data_stream/audit/sample_event.json index cdbfa62ad20..9329583aee8 100644 --- a/packages/mattermost/data_stream/audit/sample_event.json +++ b/packages/mattermost/data_stream/audit/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", diff --git a/packages/mattermost/docs/README.md b/packages/mattermost/docs/README.md index 4d7960c0d24..3c101c7aead 100644 --- a/packages/mattermost/docs/README.md +++ b/packages/mattermost/docs/README.md @@ -138,7 +138,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", diff --git a/packages/mattermost/kibana/tags.yml b/packages/mattermost/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/mattermost/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/mattermost/manifest.yml b/packages/mattermost/manifest.yml index 948591323af..be374e6923c 100644 --- a/packages/mattermost/manifest.yml +++ b/packages/mattermost/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: mattermost title: "Mattermost" -version: "1.10.0" +version: "1.13.0" description: Collect logs from Mattermost with Elastic Agent. type: integration categories: - security - productivity_security conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" icons: - src: /img/mattermost-logo.svg title: Mattermost logo @@ -24,3 +25,4 @@ policy_templates: description: Collect logs from Mattermost servers owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/memcached/changelog.yml b/packages/memcached/changelog.yml index f4d7903bd48..a73c01ca31d 100644 --- a/packages/memcached/changelog.yml +++ b/packages/memcached/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.2.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6983 +- version: "1.1.0" + changes: + - description: Add dimensions mapping for TSDB enablement. + type: enhancement + link: https://github.com/elastic/integrations/pull/6926 - version: "1.0.0" changes: - description: Make Memcached GA diff --git a/packages/memcached/data_stream/stats/fields/ecs.yml b/packages/memcached/data_stream/stats/fields/ecs.yml index 9dd2b30ddcd..fb70f692e9d 100644 --- a/packages/memcached/data_stream/stats/fields/ecs.yml +++ b/packages/memcached/data_stream/stats/fields/ecs.yml @@ -2,7 +2,32 @@ name: ecs.version - external: ecs name: service.address + dimension: true - external: ecs name: service.type - external: ecs name: tags +- external: ecs + name: agent.id + dimension: true +- external: ecs + name: cloud.account.id + dimension: true +- external: ecs + name: cloud.region + dimension: true +- external: ecs + name: cloud.availability_zone + dimension: true +- external: ecs + name: cloud.instance.id + dimension: true +- external: ecs + name: cloud.provider + dimension: true +- external: ecs + name: container.id + dimension: true +- external: ecs + name: host.name + dimension: true \ No newline at end of file diff --git a/packages/memcached/data_stream/stats/manifest.yml b/packages/memcached/data_stream/stats/manifest.yml index 490ce084ac2..4e660170fe3 100644 --- a/packages/memcached/data_stream/stats/manifest.yml +++ b/packages/memcached/data_stream/stats/manifest.yml @@ -21,3 +21,5 @@ streams: - memcached_stats title: Memcached stats metrics description: Collect Memcached stats metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/memcached/docs/README.md b/packages/memcached/docs/README.md index 151a1f5beaa..bd6778c34f1 100644 --- a/packages/memcached/docs/README.md +++ b/packages/memcached/docs/README.md @@ -11,6 +11,13 @@ The below metrics are fetched from memcached: | Field | Description | Type | Unit | Metric Type | |---|---|---|---|---| | @timestamp | Event timestamp. | date | | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | | +| cloud.availability_zone | Availability zone in which this host, resource, or service is located. | keyword | | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | | +| cloud.region | Region in which this host, resource, or service is located. | keyword | | | +| container.id | Unique container id. | keyword | | | | data_stream.dataset | Data stream dataset. | constant_keyword | | | | data_stream.namespace | Data stream namespace. | constant_keyword | | | | data_stream.type | Data stream type. | constant_keyword | | | @@ -19,6 +26,7 @@ The below metrics are fetched from memcached: | event.kind | Event kind | constant_keyword | | | | event.module | Event module | constant_keyword | | | | event.type | Event type | constant_keyword | | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | memcached.stats.cmd.get | Number of "get" commands received since server startup not counting if they were successful or not. | long | | counter | | memcached.stats.cmd.set | Number of "set" commands serviced since server startup. | long | | counter | | memcached.stats.connections.current | Number of open connections to this Memcached server, should be the same value on all servers during normal operation. | long | | counter | diff --git a/packages/memcached/kibana/dashboard/memcached-a36fa0b0-eccf-11ec-b66b-6bfdc9ecc703.json b/packages/memcached/kibana/dashboard/memcached-a36fa0b0-eccf-11ec-b66b-6bfdc9ecc703.json index 95e18a0c4bc..be222d0d99c 100644 --- a/packages/memcached/kibana/dashboard/memcached-a36fa0b0-eccf-11ec-b66b-6bfdc9ecc703.json +++ b/packages/memcached/kibana/dashboard/memcached-a36fa0b0-eccf-11ec-b66b-6bfdc9ecc703.json @@ -21,11 +21,6 @@ "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-0b4a67e5-9927-450e-b80a-d8e4d960ec81", @@ -33,6 +28,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -60,7 +56,10 @@ "dataType": "number", "isBucketed": false, "label": "Hits", - "operationType": "median", + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.get.hits" }, @@ -69,8 +68,10 @@ "dataType": "number", "isBucketed": false, "label": "Misses", - "operationType": "median", - "params": {}, + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.get.misses" } @@ -81,6 +82,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -116,6 +118,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "area_stacked", @@ -150,17 +153,12 @@ "panelIndex": "555d1c56-312e-4267-8eea-95ccb985af39", "title": "Cache Miss/Hits [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-9f7e3c47-6837-4646-b2af-26fa3dd97b1e", @@ -168,6 +166,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -182,7 +181,10 @@ "dataType": "number", "isBucketed": false, "label": "Total Connections", - "operationType": "median", + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.connections.total" }, @@ -205,6 +207,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -225,6 +228,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -255,17 +259,12 @@ "panelIndex": "3b4ee0c8-717b-4f79-8644-87ee2ca661b1", "title": "Total Connections [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-bed40a09-d5a3-43cf-b5bc-727bdf34f38f", @@ -273,6 +272,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -299,7 +299,10 @@ "dataType": "number", "isBucketed": false, "label": "Number of Threads", - "operationType": "median", + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.threads" } @@ -310,6 +313,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -330,6 +334,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -360,17 +365,12 @@ "panelIndex": "d4b70849-800d-4266-a70e-5756b96960f4", "title": "Threads [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-441e4c26-b3fc-406f-ad5f-70335cfcafcf", @@ -378,6 +378,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -393,7 +394,10 @@ "dataType": "number", "isBucketed": false, "label": "cmd_get", - "operationType": "median", + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.cmd.get" }, @@ -414,7 +418,10 @@ "dataType": "number", "isBucketed": false, "label": "cmd_set", - "operationType": "median", + "operationType": "max", + "params": { + "emptyAsNull": true + }, "scale": "ratio", "sourceField": "memcached.stats.cmd.set" } @@ -425,6 +432,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -446,6 +454,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "area", @@ -476,17 +485,12 @@ "panelIndex": "86353e77-b7f4-418e-a662-8b1358227016", "title": "Get/Set Commands [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-8b74c71e-904a-4edd-af4b-9c9bc7ebf83e", @@ -494,6 +498,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -515,7 +520,7 @@ "label": "Bytes Read (Kb)", "operationType": "formula", "params": { - "formula": "median(memcached.stats.read.bytes)/1000", + "formula": "max(memcached.stats.read.bytes)/1000", "isFormulaBroken": false }, "references": [ @@ -528,7 +533,7 @@ "dataType": "number", "isBucketed": false, "label": "Part of Bytes Read (Kb)", - "operationType": "median", + "operationType": "max", "params": { "emptyAsNull": false }, @@ -548,11 +553,11 @@ 1000 ], "location": { - "max": 39, + "max": 36, "min": 0 }, "name": "divide", - "text": "median(memcached.stats.read.bytes)/1000", + "text": "max(memcached.stats.read.bytes)/1000", "type": "function" } }, @@ -568,7 +573,7 @@ "label": "Bytes Written (Kb)", "operationType": "formula", "params": { - "formula": "median(memcached.stats.written.bytes)/1000", + "formula": "max(memcached.stats.written.bytes)/1000", "isFormulaBroken": false }, "references": [ @@ -580,8 +585,8 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of Bytes Written", - "operationType": "median", + "label": "Part of Bytes Written (Kb)", + "operationType": "max", "params": { "emptyAsNull": false }, @@ -592,7 +597,7 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of Bytes Written", + "label": "Part of Bytes Written (Kb)", "operationType": "math", "params": { "tinymathAst": { @@ -601,11 +606,11 @@ 1000 ], "location": { - "max": 42, + "max": 39, "min": 0 }, "name": "divide", - "text": "median(memcached.stats.written.bytes)/1000", + "text": "max(memcached.stats.written.bytes)/1000", "type": "function" } }, @@ -634,6 +639,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -655,6 +661,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -679,17 +686,12 @@ "panelIndex": "de7c1e7a-a67d-4c71-9acb-d7a45b8fd452", "title": "Bytes Read/Written [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { "attributes": { "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-22fd59e2-9190-4c20-9f62-c5394da65821", @@ -697,6 +699,7 @@ } ], "state": { + "adHocDataViews": {}, "datasourceStates": { "indexpattern": { "layers": { @@ -717,7 +720,7 @@ "label": "Hit Ratio", "operationType": "formula", "params": { - "formula": "median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", + "formula": "max(memcached.stats.get.misses)/(max(memcached.stats.get.misses)+max(memcached.stats.get.hits))", "isFormulaBroken": false }, "references": [ @@ -729,8 +732,8 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", - "operationType": "median", + "label": "Part of Hit Ratio", + "operationType": "max", "params": { "emptyAsNull": false }, @@ -741,8 +744,8 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", - "operationType": "median", + "label": "Part of Hit Ratio", + "operationType": "max", "params": { "emptyAsNull": false }, @@ -753,8 +756,8 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", - "operationType": "median", + "label": "Part of Hit Ratio", + "operationType": "max", "params": { "emptyAsNull": false }, @@ -765,7 +768,7 @@ "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Part of median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", + "label": "Part of Hit Ratio", "operationType": "math", "params": { "tinymathAst": { @@ -777,20 +780,20 @@ "254b63dc-089a-42a2-a116-6f61a1e10cf4X2" ], "location": { - "max": 103, - "min": 36 + "max": 94, + "min": 33 }, "name": "add", - "text": "median(memcached.stats.get.misses)+median(memcached.stats.get.hits)", + "text": "max(memcached.stats.get.misses)+max(memcached.stats.get.hits)", "type": "function" } ], "location": { - "max": 104, + "max": 95, "min": 0 }, "name": "divide", - "text": "median(memcached.stats.get.misses)/(median(memcached.stats.get.misses)+median(memcached.stats.get.hits))", + "text": "max(memcached.stats.get.misses)/(max(memcached.stats.get.misses)+max(memcached.stats.get.hits))", "type": "function" } }, @@ -821,6 +824,7 @@ } }, "filters": [], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -841,6 +845,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -865,7 +870,7 @@ "panelIndex": "dfd2fe2c-a1fd-46f9-846f-e17e1338f9c0", "title": "Cache Hit Ratio [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" }, { "embeddableConfig": { @@ -987,6 +992,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1011,74 +1017,44 @@ "panelIndex": "5061237a-3a71-485a-be3f-5d8e629e579e", "title": "Memory Utilization [Metrics Memcached] ", "type": "lens", - "version": "8.2.0" + "version": "8.5.3" } ], "timeRestore": false, "title": "[Metrics Memcached] Overview", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.5.3", "id": "memcached-a36fa0b0-eccf-11ec-b66b-6bfdc9ecc703", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.5.0" }, "references": [ - { - "id": "metrics-*", - "name": "555d1c56-312e-4267-8eea-95ccb985af39:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "555d1c56-312e-4267-8eea-95ccb985af39:indexpattern-datasource-layer-0b4a67e5-9927-450e-b80a-d8e4d960ec81", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "3b4ee0c8-717b-4f79-8644-87ee2ca661b1:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "3b4ee0c8-717b-4f79-8644-87ee2ca661b1:indexpattern-datasource-layer-9f7e3c47-6837-4646-b2af-26fa3dd97b1e", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "d4b70849-800d-4266-a70e-5756b96960f4:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "d4b70849-800d-4266-a70e-5756b96960f4:indexpattern-datasource-layer-bed40a09-d5a3-43cf-b5bc-727bdf34f38f", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "86353e77-b7f4-418e-a662-8b1358227016:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "86353e77-b7f4-418e-a662-8b1358227016:indexpattern-datasource-layer-441e4c26-b3fc-406f-ad5f-70335cfcafcf", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "de7c1e7a-a67d-4c71-9acb-d7a45b8fd452:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "de7c1e7a-a67d-4c71-9acb-d7a45b8fd452:indexpattern-datasource-layer-8b74c71e-904a-4edd-af4b-9c9bc7ebf83e", "type": "index-pattern" }, - { - "id": "metrics-*", - "name": "dfd2fe2c-a1fd-46f9-846f-e17e1338f9c0:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "dfd2fe2c-a1fd-46f9-846f-e17e1338f9c0:indexpattern-datasource-layer-22fd59e2-9190-4c20-9f62-c5394da65821", @@ -1093,6 +1069,16 @@ "id": "metrics-*", "name": "5061237a-3a71-485a-be3f-5d8e629e579e:indexpattern-datasource-layer-09bed68a-54a8-41fe-8e2f-6937efc350b4", "type": "index-pattern" + }, + { + "id": "memcached-fleet-managed-default", + "name": "tag-fleet-managed-default", + "type": "tag" + }, + { + "id": "memcached-fleet-pkg-memcached-default", + "name": "tag-fleet-pkg-memcached-default", + "type": "tag" } ], "type": "dashboard" diff --git a/packages/memcached/manifest.yml b/packages/memcached/manifest.yml index 38301d1a933..1a6a7d825ed 100644 --- a/packages/memcached/manifest.yml +++ b/packages/memcached/manifest.yml @@ -1,6 +1,6 @@ name: memcached title: Memcached -version: "1.0.0" +version: "1.2.0" description: Memcached Integration type: integration categories: @@ -21,7 +21,7 @@ screenshots: type: image/png conditions: kibana: - version: ^8.2.0 + version: ^8.8.0 format_version: 1.0.0 license: basic policy_templates: diff --git a/packages/microsoft_defender_cloud/_dev/build/build.yml b/packages/microsoft_defender_cloud/_dev/build/build.yml new file mode 100644 index 00000000000..c1af686e524 --- /dev/null +++ b/packages/microsoft_defender_cloud/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/microsoft_defender_cloud/_dev/build/docs/README.md b/packages/microsoft_defender_cloud/_dev/build/docs/README.md new file mode 100644 index 00000000000..bf5c701b2c3 --- /dev/null +++ b/packages/microsoft_defender_cloud/_dev/build/docs/README.md @@ -0,0 +1,72 @@ +# Microsoft Defender for Cloud + +The [Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) integration allows you to monitor security alert events. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for analyzing the resources and services that users are protecting through Microsoft Defender. + +Use the Microsoft Defender for Cloud integration to collect and parse data from **Azure Event Hub** and then visualize that data in Kibana. + +## Data streams + +The Microsoft Defender for Cloud integration collects one type of data: event. + +**Event** allows users to preserve a record of security events that occurred on the subscription, which includes real-time events that affect the security of the user's environment. For further information connected to security alerts and type, Refer to the page [here](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference). + +## Prerequisites + +To get started with Defender for Cloud, user must have a subscription to Microsoft Azure. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the **Azure Event Hub** and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.3.0**. + +## Setup + +### To collect data from Microsoft Azure Event Hub, follow the below steps: + +- Configure the Microsoft Defender for Cloud on Azure subscription. For more detail, refer to the link [here](https://learn.microsoft.com/en-us/azure/defender-for-cloud/get-started). + +### Enabling the integration in Elastic: + +1. In Kibana, go to Management > Integrations. +2. In the "Search for integrations" search bar, type Microsoft Defender for Cloud. +3. Click on the "Microsoft Defender for Cloud" integration from the search results. +4. Click on the Add Microsoft Defender for Cloud Integration button to add the integration. +5. While adding the integration, if you want to collect logs via **Azure Event Hub**, then you have to put the following details: + - eventhub + - consumer_group + - connection_string + - storage_account + - storage_account_key + - storage_account_container (optional) + - resource_manager_endpoint (optional) + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +{{fields "event"}} diff --git a/packages/microsoft_defender_cloud/changelog.yml b/packages/microsoft_defender_cloud/changelog.yml new file mode 100644 index 00000000000..dcfdfe975f0 --- /dev/null +++ b/packages/microsoft_defender_cloud/changelog.yml @@ -0,0 +1,21 @@ +# newer versions go on top +- version: 0.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "0.1.0" + changes: + - description: Initial release. + type: enhancement + link: https://github.com/elastic/integrations/pull/6593 diff --git a/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log new file mode 100644 index 00000000000..a5d4bb8c446 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log @@ -0,0 +1,5 @@ +{"securityEventDataEnrichment":{"action":"Write","apiVersion":"2019-01-01-preview","isSnapshot":false,"interval":"00:00:00"},"id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/regulatoryComplianceStandards/Microsoft-cloud-security-benchmark/regulatoryComplianceControls/LT.5/regulatoryComplianceAssessments/45cfe080-ceb1-a91e-9743-71551ed24e94","name":"45cfe080-ceb1-a91e-9743-71551ed24e94","type":"Microsoft.Security/regulatoryComplianceStandards/regulatoryComplianceControls/regulatoryComplianceAssessments","properties":{"description":"Log Analytics agent should be installed on virtual machine scale sets","state":"Skipped","passedResources":0,"failedResources":0,"skippedResources":1,"assessmentType":"AssessmentResult","assessmentDetailsLink":"https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/45cfe080-ceb1-a91e-9743-71551ed24e94/initiativeId/Microsoft-cloud-security-benchmark"}} +{"assessmentEventDataEnrichment":{"action":"Delete","apiVersion":"2019-01-01","isSnapshot":false},"securityEventDataEnrichment":{"action":"Delete","apiVersion":"2019-01-01","isSnapshot":false},"tenantId":"aa40685b-417d-4664-b4ec-8f7640719adb","type":"Microsoft.Security/assessments","kind":null,"location":null,"id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e","name":"7b3d4796-9400-2904-692b-4a5ede7f0a1e","tags":null,"properties":{"resourceDetails":{"source":"Azure","id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf"},"displayName":"CORS should not allow every resource to access Function Apps","status":{"code":"Healthy","statusChangeDate":"2023-05-09T13:19:49.3381028Z","firstEvaluationDate":"2023-05-09T13:19:49.3381028Z"},"additionalData":{"kind":"Functionapp"},"metadata":{"displayName":"CORS should not allow every resource to access Function Apps","assessmentType":"BuiltIn","policyDefinitionId":"/providers/microsoft.authorization/policydefinitions/0820b7b9-23aa-4725-a1ce-ae4558f718e5","description":"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.","remediationDescription":"To allow only required domains to interact with your web app, we recommend the following steps:
1. Go to the app service CORS page
2. Remove the \"*\" defined and instead specify explicit origins that should be allowed to make cross-origin calls
3. Click Save","categories":["AppServices"],"severity":"Low","userImpact":"Low","implementationEffort":"Low","threats":["MaliciousInsider","AccountBreach"]},"links":{"azurePortal":"portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/7b3d4796-9400-2904-692b-4a5ede7f0a1e/resourceId/%2fsubscriptions%2f12cabcb4-86e8-404f-a3d2-1dc9982f45ca%2fresourcegroups%2fmbranca-esf%2fproviders%2fmicrosoft.web%2fsites%2fmbranca-esf"}}} +{"securityEventDataEnrichment":{"action":"Insert","apiVersion":"2020-01-01","isSnapshot":false},"id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls/61702b76-1fab-41f2-bcbc-50b7870dcf38","name":"61702b76-1fab-41f2-bcbc-50b7870dcf38","type":"Microsoft.Security/secureScores/secureScoreControls","properties":{"displayName":"Apply system updates","healthyResourceCount":0,"unhealthyResourceCount":3,"notApplicableResourceCount":1,"score":{"max":6,"current":0,"percentage":0},"definition":{"id":"/providers/Microsoft.Security/secureScoreControlDefinitions/61702b76-1fab-41f2-bcbc-50b7870dcf38","name":"61702b76-1fab-41f2-bcbc-50b7870dcf38","type":"Microsoft.Security/secureScoreControlDefinitions","properties":{"source":{"sourceType":"BuiltIn"},"displayName":"Apply system updates","maxScore":6,"assessmentDefinitions":[{"id":"/providers/Microsoft.Security/assessmentMetadata/d1db3318-01ff-16de-29eb-28b344515626"},{"id":"/providers/Microsoft.Security/assessmentMetadata/27ac71b1-75c5-41c2-adc2-858f5db45b08"},{"id":"/providers/Microsoft.Security/assessmentMetadata/720a3e77-0b9a-4fa9-98b6-ddf0fd7e32c1"},{"id":"/providers/Microsoft.Security/assessmentMetadata/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27"},{"id":"/providers/Microsoft.Security/assessmentMetadata/e1145ab1-eb4f-43d8-911b-36ddf771d13f"},{"id":"/providers/Microsoft.Security/assessmentMetadata/90386950-71ca-4357-a12e-486d1679427c"},{"id":"/providers/Microsoft.Security/assessmentMetadata/45cfe080-ceb1-a91e-9743-71551ed24e94"},{"id":"/providers/Microsoft.Security/assessmentMetadata/bd20bd91-aaf1-7f14-b6e4-866de2f43146"},{"id":"/providers/Microsoft.Security/assessmentMetadata/bc85a7ee-7f43-47ab-8736-4faaec9346b5"},{"id":"/providers/Microsoft.Security/assessmentMetadata/11c3f3c8-3c13-48be-9ee5-67b6865e7462"},{"id":"/providers/Microsoft.Security/assessmentMetadata/643a00cb-3da3-43ef-b523-15a0f3198e45"},{"id":"/providers/Microsoft.Security/assessmentMetadata/d352afac-cebc-4e02-b474-7ef402fb1d65"}]}},"weight":3}} +{"$type":"subAssessmentEvent","SubAssessmentEventDataEnrichment":{"$type":"subAssessmentEventDataEnrichment","Action":"Delete","ApiVersion":"2020-01-01","IsSnapshot":false},"SecurityEventDataEnrichment":{"$type":"subAssessmentEventDataEnrichment","Action":"Delete","ApiVersion":"2020-01-01","IsSnapshot":false},"TenantId":"aa40685b-417d-4664-b4ec-8f7640719adb","Type":"Microsoft.Security/assessments/subAssessments","Id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372/providers/Microsoft.Security/assessments/c476dc48-8110-4139-91af-c8d940896b98/subassessments/93d2736e-7329-8806-3ef6-e71bb2203d11","Name":"93d2736e-7329-8806-3ef6-e71bb2203d11","Properties":{"$type":"response/subAssessmentProperties","Id":"93d2736e-7329-8806-3ef6-e71bb2203d11","DisplayName":"Ensure DCCP is disabled","Status":{"$type":"status","Code":"Unhealthy","Severity":"Low"},"Remediation":"Edit or create a file in the `/etc/modprobe.d/` directory ending in .conf and add `install dccp /bin/true` then unload the dccp module or run '/opt/microsoft/omsagent/plugin/omsremediate -r disable-unnecessary-kernel-mods'","Impact":"If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.","Category":"N/A","Description":"Ensure DCCP is disabled","TimeGenerated":"2023-05-12T09:58:32.2607101Z","ResourceDetails":{"$type":"resourceDetails/azure","Source":"Azure","Id":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372"},"AdditionalData":{"$type":"additionalData/general","AssessedResourceType":"GeneralVulnerability","Data":{"OsName":"Linux","RuleType":"Command","Vulnerability":"","AZID":"MSID 54","DataSourceType":"Not Applicable","DataSourceKey":"Not Applicable"}}}} +{"VendorName":"Microsoft","AlertType":"ARM_AnomalousServiceOperation.CredentialAccess","ProductName":"Microsoft Defender for Cloud","StartTimeUtc":"2023-05-11T13:15:45.0170422Z","EndTimeUtc":"2023-05-11T13:15:45.0170422Z","TimeGenerated":"2023-05-11T13:17:09.0170422Z","ProcessingEndTime":"2023-05-11T13:17:09.0170422Z","Severity":"Medium","Status":"New","ProviderAlertStatus":null,"ConfidenceLevel":null,"ConfidenceScore":null,"ConfidenceReasons":null,"IsIncident":false,"SystemAlertId":"2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d","CorrelationKey":null,"Intent":"PreAttack","AzureResourceId":"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM","WorkspaceId":"00000000-0000-0000-0000-000000000001","WorkspaceSubscriptionId":"00000000-0000-0000-0000-000000000001","WorkspaceResourceGroup":"Sample-RG","AgentId":null,"CompromisedEntity":"Sample-VM","AlertDisplayName":"[SAMPLE ALERT] Login from a suspicious IP","Description":"THIS IS A SAMPLE ALERT: Your resource has been accessed successfully from an IP address that Microsoft Threat Intelligence has associated with suspicious activity.","Entities":[{"$id":"5","Address":"81.2.69.142","Location":{"CountryCode":"US","CountryName":"United States","State":"Virginia","City":"Washington","Longitude":-78.17197,"Latitude":38.73078,"Asn":8075},"ThreatIntelligence":[{"ProviderName":"AlertSimulator","ThreatType":"Sample-Type","ThreatName":"Sample-Threat","Confidence":1,"ThreatDescription":""}],"Asset":false,"Type":"ip"},{"$id":"6","ImageId":"sample-image:v1","Asset":false,"Type":"container-image"},{"$ref":"6"},{"$id":"5","DnsDomain":"","NTDomain":"","HostName":"Sample-VM","NetBiosName":"Sample-VM","AzureID":"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM","OMSAgentID":"00000000-0000-0000-0000-000000000001","OSFamily":"Linux","OSVersion":"Linux","Asset":false,"Type":"host"},{"$id":"6","ProcessId":"0x1e49a","CommandLine":"","Host":{"$ref":"5"},"Asset":false,"Type":"process"},{"$id":"7","Name":"Sample-account","Host":{"$ref":"5"},"Sid":"","Asset":false,"Type":"account","LogonId":"0xbd6e"},{"$id":"9","ProcessId":"0x1e99b","CommandLine":"php","CreationTimeUtc":"2023-05-11T13:17:49.1333596Z","ImageFile":{"$ref":"8"},"Account":{"$ref":"7"},"ParentProcess":{"$ref":"6"},"Host":{"$ref":"5"},"Asset":false,"Type":"process"},{"$id":"5","DomainName":"sample.domain","IpAddresses":[{"$id":"6","Address":"81.2.69.142","Location":{"CountryCode":"US","CountryName":"United States","State":"California","City":"San Francisco","Longitude":0,"Latitude":0,"Asn":0},"Asset":false,"Type":"ip"}],"HostIpAddress":{"$ref":"6"},"Asset":false,"Type":"dns"},{"$id":"6","Address":"81.2.69.142","Location":{"CountryCode":"sample","CountryName":"united states","State":"texas","City":"san antonio","Longitude":0,"Latitude":0,"Asn":0,"Carrier":"sample","Organization":"sample-organization","OrganizationType":"sample-organization","CloudProvider":"Azure","SystemService":"sample"},"ThreatIntelligence":[{"ProviderName":"Sample-Provider","ThreatType":"Sample-Threat","ThreatName":"Sample-Threat","Confidence":0.8,"ThreatDescription":"Sample-Threat"}],"Asset":false,"Type":"ip"},{"$id":"5","HostName":"Sample-VM","AzureID":"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM","OMSAgentID":"00000000-0000-0000-0000-000000000000","Asset":false,"Type":"host"},{"$id":"7","Directory":"Sample-fileShare/dummy/path/to","Name":"Sample-Name","FileHashes":[{"$id":"8","Algorithm":"MD5","Value":"Sample-SHA","Asset":false,"Type":"filehash"}],"Asset":false,"Type":"file"},{"$id":"9","Name":"Sample-Name","Category":"Virus","Files":[{"$ref":"8"}],"Asset":false,"Type":"malware"},{"$id":"5","DomainName":"sample.domain","IpAddresses":[{"$id":"6","Address":"81.2.69.142","Location":{"CountryCode":"US","CountryName":"United States","State":"California","City":"San Francisco","Longitude":0,"Latitude":0,"Asn":0},"Asset":false,"Type":"ip"}],"HostIpAddress":{"$ref":"6"},"Asset":false,"Type":"dns"},{"$id":"7","Name":"Sample-account","NTDomain":"Sample-VM","Host":{"$ref":"5"},"Sid":"S-1-5-21-3061399664-1673012318-3185014992-20022","IsDomainJoined":false,"Asset":false,"Type":"account","LogonId":"0x427d8dd9"},{"$id":"7","Name":"Sample-namespace","Cluster":{"$ref":"5"},"Asset":false,"Type":"K8s-namespace"},{"$id":"8","Name":"sample-pod","Namespace":{"$ref":"7"},"Asset":false,"Type":"K8s-pod"},{"$id":"9","Name":"sample-container","Image":{"$ref":"4"},"Pod":{"$ref":"8"},"Asset":false,"Type":"container"},{"$id":"10","ProjectId":"012345678901","ResourceType":"GCP Resource","ResourceName":"Sample-Cluster","Location":"us-central1-c","LocationType":"Zonal","Asset":true,"Type":"gcp-resource","RelatedAzureResourceIds":["/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c"]},{"$id":"7","Name":"Sample-Name","BlobContainer":{"$ref":"5"},"Url":"https://Sample-Storage.blob.core.windows.net/Sample/Sample.txt","Etag":"Sample-Tag","Asset":false,"Type":"blob"},{"$id":"5","Name":"sample","UPNSuffix":"contoso.com","AadTenantId":"00000000-0000-0000-0000-000000000000","AadUserId":"00000000-0000-0000-0000-000000000000","Asset":false,"Type":"account"},{"$id":"5","CloudResource":{"$ref":"4"},"Asset":false,"Type":"K8s-cluster"},{"$id":"8","Directory":"https://Sample-Storage.blob.core.windows.net/Sample","Name":"Sample-Name","FileHashes":[{"$ref":"6"}],"Asset":false,"Type":"file"},{"$id":"10","ProjectId":"012345678901","ResourceType":"GCP Resource","ResourceName":"Sample-Cluster","Location":"us-central1-c","LocationType":"Zonal","Asset":true,"Type":"gcp-resource","RelatedAzureResourceIds":["/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c"]},{"$id":"6","SourceAddress":{"$ref":"5"},"Protocol":"Tcp","Asset":false,"Type":"network-connection"},{"$id":"7","Name":"Sample-Name","StorageResource":{"$ref":"4"},"Asset":false,"Type":"blob-container"},{"$id":"7","ContainerId":"cc8ec8580f4c","Image":{"$ref":"6"},"Asset":false,"Type":"container"},{"$id":"5","Address":"81.2.69.142","Location":{"CountryCode":"IN","CountryName":"United States","State":"Virginia","City":"Washington","Longitude":-78.17197,"Latitude":38.73078,"Asn":8075},"ThreatIntelligence":[{"ProviderName":"AlertSimulator","ThreatType":"Sample-Type","ThreatName":"Sample-Threat","Confidence":1,"ThreatDescription":""}],"Asset":false,"Type":"ip"}],"ExtendedLinks":[{"Href":"https://blog.netspi.com/gathering-bearer-tokens-azure/","Category":null,"Label":"NetSPI blogpost","Type":"webLink"},{"Href":"https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AZStorageKeysREST.ps1","Category":null,"Label":"MicroBurst source code","Type":"webLink"}],"ResourceIdentifiers":[{"$id":"2","AzureResourceId":"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca","Type":"AzureResource","AzureResourceTenantId":"aa40685b-417d-4664-b4ec-8f7640719adb"},{"$id":"3","AadTenantId":"aa40685b-417d-4664-b4ec-8f7640719adb","Type":"AAD"},{"$id":"3","WorkspaceId":"00000000-0000-0000-0000-000000000001","WorkspaceSubscriptionId":"00000000-0000-0000-0000-000000000001","WorkspaceResourceGroup":"Sample-RG","AgentId":"00000000-0000-0000-0000-00000000000","Type":"LogAnalytics"}],"RemediationSteps":["Go to the firewall settings in order to lock down the firewall as tightly as possible."],"ExtendedProperties":{"resourceType":"Virtual Machine","Investigation steps":"{\"displayValue\":\"How to investigate this alert using logs at your Log Analytics workspace.\",\"kind\":\"Link\",\"value\":\"https:\\/\\/go.microsoft.com\\/fwlink\\/?linkid=2091064\"}","Potential causes":"An attacker has accessed your database from a potentially suspicious IP; a legitimate user has accessed your database from a potentially suspicious IP.","Client principal name":"Sample-user","Alert Id":"00000000-0000-0000-0000-000000000000","Client IP address":"81.2.69.142","Client IP location":"Sample","Client application":"Sample-app","OMS workspace ID":"00000000-0000-0000-0000-000000000001","OMS agent ID":"00000000-0000-0000-0000-000000000001"},"AlertUri":"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d/subscriptionId/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus"} \ No newline at end of file diff --git a/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json new file mode 100644 index 00000000000..572a24eb15a --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-alert.log-expected.json @@ -0,0 +1,789 @@ +{ + "expected": [ + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "intrusion_detection" + ], + "kind": "alert", + "original": "{\"securityEventDataEnrichment\":{\"action\":\"Write\",\"apiVersion\":\"2019-01-01-preview\",\"isSnapshot\":false,\"interval\":\"00:00:00\"},\"id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/regulatoryComplianceStandards/Microsoft-cloud-security-benchmark/regulatoryComplianceControls/LT.5/regulatoryComplianceAssessments/45cfe080-ceb1-a91e-9743-71551ed24e94\",\"name\":\"45cfe080-ceb1-a91e-9743-71551ed24e94\",\"type\":\"Microsoft.Security/regulatoryComplianceStandards/regulatoryComplianceControls/regulatoryComplianceAssessments\",\"properties\":{\"description\":\"Log Analytics agent should be installed on virtual machine scale sets\",\"state\":\"Skipped\",\"passedResources\":0,\"failedResources\":0,\"skippedResources\":1,\"assessmentType\":\"AssessmentResult\",\"assessmentDetailsLink\":\"https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/45cfe080-ceb1-a91e-9743-71551ed24e94/initiativeId/Microsoft-cloud-security-benchmark\"}}", + "type": [ + "info" + ] + }, + "microsoft_defender_cloud": { + "event": { + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/regulatoryComplianceStandards/Microsoft-cloud-security-benchmark/regulatoryComplianceControls/LT.5/regulatoryComplianceAssessments/45cfe080-ceb1-a91e-9743-71551ed24e94", + "name": "45cfe080-ceb1-a91e-9743-71551ed24e94", + "properties": { + "assessment": { + "details_link": "https://portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/45cfe080-ceb1-a91e-9743-71551ed24e94/initiativeId/Microsoft-cloud-security-benchmark", + "type": "AssessmentResult" + }, + "description": "Log Analytics agent should be installed on virtual machine scale sets", + "failed_resources": 0, + "passed_resources": 0, + "skipped_resources": 1, + "state": "Skipped" + }, + "security_event_data_enrichment": { + "action": "Write", + "api_version": "2019-01-01-preview", + "interval": "00:00:00", + "is_snapshot": false + }, + "type": "Microsoft.Security/regulatoryComplianceStandards/regulatoryComplianceControls/regulatoryComplianceAssessments" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "intrusion_detection" + ], + "kind": "alert", + "original": "{\"assessmentEventDataEnrichment\":{\"action\":\"Delete\",\"apiVersion\":\"2019-01-01\",\"isSnapshot\":false},\"securityEventDataEnrichment\":{\"action\":\"Delete\",\"apiVersion\":\"2019-01-01\",\"isSnapshot\":false},\"tenantId\":\"aa40685b-417d-4664-b4ec-8f7640719adb\",\"type\":\"Microsoft.Security/assessments\",\"kind\":null,\"location\":null,\"id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\"name\":\"7b3d4796-9400-2904-692b-4a5ede7f0a1e\",\"tags\":null,\"properties\":{\"resourceDetails\":{\"source\":\"Azure\",\"id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf\"},\"displayName\":\"CORS should not allow every resource to access Function Apps\",\"status\":{\"code\":\"Healthy\",\"statusChangeDate\":\"2023-05-09T13:19:49.3381028Z\",\"firstEvaluationDate\":\"2023-05-09T13:19:49.3381028Z\"},\"additionalData\":{\"kind\":\"Functionapp\"},\"metadata\":{\"displayName\":\"CORS should not allow every resource to access Function Apps\",\"assessmentType\":\"BuiltIn\",\"policyDefinitionId\":\"/providers/microsoft.authorization/policydefinitions/0820b7b9-23aa-4725-a1ce-ae4558f718e5\",\"description\":\"Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.\",\"remediationDescription\":\"To allow only required domains to interact with your web app, we recommend the following steps:\u003cbr\u003e1. Go to the app service CORS page\u003cbr\u003e2. Remove the \\\"*\\\" defined and instead specify explicit origins that should be allowed to make cross-origin calls\u003cbr\u003e3. Click Save\",\"categories\":[\"AppServices\"],\"severity\":\"Low\",\"userImpact\":\"Low\",\"implementationEffort\":\"Low\",\"threats\":[\"MaliciousInsider\",\"AccountBreach\"]},\"links\":{\"azurePortal\":\"portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/7b3d4796-9400-2904-692b-4a5ede7f0a1e/resourceId/%2fsubscriptions%2f12cabcb4-86e8-404f-a3d2-1dc9982f45ca%2fresourcegroups%2fmbranca-esf%2fproviders%2fmicrosoft.web%2fsites%2fmbranca-esf\"}}}", + "type": [ + "info" + ] + }, + "microsoft_defender_cloud": { + "event": { + "assessment_event_data_enrichment": { + "action": "Delete", + "api_version": "2019-01-01", + "is_snapshot": false + }, + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf/providers/Microsoft.Security/assessments/7b3d4796-9400-2904-692b-4a5ede7f0a1e", + "name": "7b3d4796-9400-2904-692b-4a5ede7f0a1e", + "properties": { + "additional_data": { + "kind": "Functionapp" + }, + "display_name": "CORS should not allow every resource to access Function Apps", + "links": { + "azure_portal": "portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/7b3d4796-9400-2904-692b-4a5ede7f0a1e/resourceId/%2fsubscriptions%2f12cabcb4-86e8-404f-a3d2-1dc9982f45ca%2fresourcegroups%2fmbranca-esf%2fproviders%2fmicrosoft.web%2fsites%2fmbranca-esf" + }, + "metadata": { + "assessment_type": "BuiltIn", + "categories": [ + "AppServices" + ], + "description": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.", + "display_name": "CORS should not allow every resource to access Function Apps", + "implementation_effort": "Low", + "policy_definition_id": "/providers/microsoft.authorization/policydefinitions/0820b7b9-23aa-4725-a1ce-ae4558f718e5", + "remediation_description": "To allow only required domains to interact with your web app, we recommend the following steps:\u003cbr\u003e1. Go to the app service CORS page\u003cbr\u003e2. Remove the \"*\" defined and instead specify explicit origins that should be allowed to make cross-origin calls\u003cbr\u003e3. Click Save", + "severity": "Low", + "threats": [ + "MaliciousInsider", + "AccountBreach" + ], + "user_impact": "Low" + }, + "resource_details": { + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-esf/providers/microsoft.web/sites/mbranca-esf", + "source": "Azure" + }, + "status": { + "code": "Healthy", + "first_evaluation_date": "2023-05-09T13:19:49.338Z", + "status_change_date": "2023-05-09T13:19:49.338Z" + } + }, + "security_event_data_enrichment": { + "action": "Delete", + "api_version": "2019-01-01", + "is_snapshot": false + }, + "tenant_id": "aa40685b-417d-4664-b4ec-8f7640719adb", + "type": "Microsoft.Security/assessments" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "intrusion_detection" + ], + "kind": "alert", + "original": "{\"securityEventDataEnrichment\":{\"action\":\"Insert\",\"apiVersion\":\"2020-01-01\",\"isSnapshot\":false},\"id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls/61702b76-1fab-41f2-bcbc-50b7870dcf38\",\"name\":\"61702b76-1fab-41f2-bcbc-50b7870dcf38\",\"type\":\"Microsoft.Security/secureScores/secureScoreControls\",\"properties\":{\"displayName\":\"Apply system updates\",\"healthyResourceCount\":0,\"unhealthyResourceCount\":3,\"notApplicableResourceCount\":1,\"score\":{\"max\":6,\"current\":0,\"percentage\":0},\"definition\":{\"id\":\"/providers/Microsoft.Security/secureScoreControlDefinitions/61702b76-1fab-41f2-bcbc-50b7870dcf38\",\"name\":\"61702b76-1fab-41f2-bcbc-50b7870dcf38\",\"type\":\"Microsoft.Security/secureScoreControlDefinitions\",\"properties\":{\"source\":{\"sourceType\":\"BuiltIn\"},\"displayName\":\"Apply system updates\",\"maxScore\":6,\"assessmentDefinitions\":[{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/d1db3318-01ff-16de-29eb-28b344515626\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/27ac71b1-75c5-41c2-adc2-858f5db45b08\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/720a3e77-0b9a-4fa9-98b6-ddf0fd7e32c1\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/e1145ab1-eb4f-43d8-911b-36ddf771d13f\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/90386950-71ca-4357-a12e-486d1679427c\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/45cfe080-ceb1-a91e-9743-71551ed24e94\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/bd20bd91-aaf1-7f14-b6e4-866de2f43146\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/bc85a7ee-7f43-47ab-8736-4faaec9346b5\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/11c3f3c8-3c13-48be-9ee5-67b6865e7462\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/643a00cb-3da3-43ef-b523-15a0f3198e45\"},{\"id\":\"/providers/Microsoft.Security/assessmentMetadata/d352afac-cebc-4e02-b474-7ef402fb1d65\"}]}},\"weight\":3}}", + "type": [ + "info" + ] + }, + "microsoft_defender_cloud": { + "event": { + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/providers/Microsoft.Security/secureScores/ascScore/secureScoreControls/61702b76-1fab-41f2-bcbc-50b7870dcf38", + "name": "61702b76-1fab-41f2-bcbc-50b7870dcf38", + "properties": { + "assessment": { + "definitions": [ + "{id=/providers/Microsoft.Security/assessmentMetadata/d1db3318-01ff-16de-29eb-28b344515626}", + "{id=/providers/Microsoft.Security/assessmentMetadata/27ac71b1-75c5-41c2-adc2-858f5db45b08}", + "{id=/providers/Microsoft.Security/assessmentMetadata/720a3e77-0b9a-4fa9-98b6-ddf0fd7e32c1}", + "{id=/providers/Microsoft.Security/assessmentMetadata/4ab6e3c5-74dd-8b35-9ab9-f61b30875b27}", + "{id=/providers/Microsoft.Security/assessmentMetadata/e1145ab1-eb4f-43d8-911b-36ddf771d13f}", + "{id=/providers/Microsoft.Security/assessmentMetadata/90386950-71ca-4357-a12e-486d1679427c}", + "{id=/providers/Microsoft.Security/assessmentMetadata/45cfe080-ceb1-a91e-9743-71551ed24e94}", + "{id=/providers/Microsoft.Security/assessmentMetadata/bd20bd91-aaf1-7f14-b6e4-866de2f43146}", + "{id=/providers/Microsoft.Security/assessmentMetadata/bc85a7ee-7f43-47ab-8736-4faaec9346b5}", + "{id=/providers/Microsoft.Security/assessmentMetadata/11c3f3c8-3c13-48be-9ee5-67b6865e7462}", + "{id=/providers/Microsoft.Security/assessmentMetadata/643a00cb-3da3-43ef-b523-15a0f3198e45}", + "{id=/providers/Microsoft.Security/assessmentMetadata/d352afac-cebc-4e02-b474-7ef402fb1d65}" + ] + }, + "definition": { + "display_name": "Apply system updates", + "id": "/providers/Microsoft.Security/secureScoreControlDefinitions/61702b76-1fab-41f2-bcbc-50b7870dcf38", + "max_score": 6, + "name": "61702b76-1fab-41f2-bcbc-50b7870dcf38", + "source_type": "BuiltIn", + "type": "Microsoft.Security/secureScoreControlDefinitions" + }, + "display_name": "Apply system updates", + "healthy_resource_count": 0, + "not_applicable_resource_count": 1, + "score": { + "current": 0.0, + "max": 6, + "percentage": 0.0 + }, + "unhealthy_resource_count": 3, + "weight": 3 + }, + "security_event_data_enrichment": { + "action": "Insert", + "api_version": "2020-01-01", + "is_snapshot": false + }, + "type": "Microsoft.Security/secureScores/secureScoreControls" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "intrusion_detection" + ], + "kind": "alert", + "original": "{\"$type\":\"subAssessmentEvent\",\"SubAssessmentEventDataEnrichment\":{\"$type\":\"subAssessmentEventDataEnrichment\",\"Action\":\"Delete\",\"ApiVersion\":\"2020-01-01\",\"IsSnapshot\":false},\"SecurityEventDataEnrichment\":{\"$type\":\"subAssessmentEventDataEnrichment\",\"Action\":\"Delete\",\"ApiVersion\":\"2020-01-01\",\"IsSnapshot\":false},\"TenantId\":\"aa40685b-417d-4664-b4ec-8f7640719adb\",\"Type\":\"Microsoft.Security/assessments/subAssessments\",\"Id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372/providers/Microsoft.Security/assessments/c476dc48-8110-4139-91af-c8d940896b98/subassessments/93d2736e-7329-8806-3ef6-e71bb2203d11\",\"Name\":\"93d2736e-7329-8806-3ef6-e71bb2203d11\",\"Properties\":{\"$type\":\"response/subAssessmentProperties\",\"Id\":\"93d2736e-7329-8806-3ef6-e71bb2203d11\",\"DisplayName\":\"Ensure DCCP is disabled\",\"Status\":{\"$type\":\"status\",\"Code\":\"Unhealthy\",\"Severity\":\"Low\"},\"Remediation\":\"Edit or create a file in the `/etc/modprobe.d/` directory ending in .conf and add `install dccp /bin/true` then unload the dccp module or run '/opt/microsoft/omsagent/plugin/omsremediate -r disable-unnecessary-kernel-mods'\",\"Impact\":\"If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.\",\"Category\":\"N/A\",\"Description\":\"Ensure DCCP is disabled\",\"TimeGenerated\":\"2023-05-12T09:58:32.2607101Z\",\"ResourceDetails\":{\"$type\":\"resourceDetails/azure\",\"Source\":\"Azure\",\"Id\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372\"},\"AdditionalData\":{\"$type\":\"additionalData/general\",\"AssessedResourceType\":\"GeneralVulnerability\",\"Data\":{\"OsName\":\"Linux\",\"RuleType\":\"Command\",\"Vulnerability\":\"\",\"AZID\":\"MSID 54\",\"DataSourceType\":\"Not Applicable\",\"DataSourceKey\":\"Not Applicable\"}}}}", + "type": [ + "info" + ] + }, + "microsoft_defender_cloud": { + "event": { + "event_type": "subAssessmentEvent", + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372/providers/Microsoft.Security/assessments/c476dc48-8110-4139-91af-c8d940896b98/subassessments/93d2736e-7329-8806-3ef6-e71bb2203d11", + "name": "93d2736e-7329-8806-3ef6-e71bb2203d11", + "properties": { + "additional_data": { + "$type": "additionalData/general", + "assessedresourcetype": "GeneralVulnerability", + "data": { + "azid": "MSID 54", + "datasourcekey": "Not Applicable", + "datasourcetype": "Not Applicable", + "osname": "Linux", + "ruletype": "Command" + } + }, + "category": "N/A", + "description": "Ensure DCCP is disabled", + "display_name": "Ensure DCCP is disabled", + "id": "93d2736e-7329-8806-3ef6-e71bb2203d11", + "impact": "If the protocol is not required, it is recommended that the drivers not be installed to reduce the potential attack surface.", + "remediation": "Edit or create a file in the `/etc/modprobe.d/` directory ending in .conf and add `install dccp /bin/true` then unload the dccp module or run '/opt/microsoft/omsagent/plugin/omsremediate -r disable-unnecessary-kernel-mods'", + "resource_details": { + "id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourcegroups/mbranca-sdh-3372/providers/microsoft.compute/virtualmachines/sdh-3372", + "source": "Azure", + "type": "resourceDetails/azure" + }, + "status": { + "code": "Unhealthy", + "severity": "Low", + "type": "status" + }, + "time_generated": "2023-05-12T09:58:32.260Z", + "type": "response/subAssessmentProperties" + }, + "security_event_data_enrichment": { + "action": "Delete", + "api_version": "2020-01-01", + "is_snapshot": false, + "type": "subAssessmentEventDataEnrichment" + }, + "sub_assessment_event": { + "data_enrichment": { + "action": "Delete", + "api_version": "2020-01-01", + "is_snapshot": false, + "type": "subAssessmentEventDataEnrichment" + } + }, + "tenant_id": "aa40685b-417d-4664-b4ec-8f7640719adb", + "type": "Microsoft.Security/assessments/subAssessments" + } + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ] + }, + { + "@timestamp": "2023-05-11T13:17:09.017Z", + "cloud": { + "provider": [ + "Azure" + ] + }, + "container": { + "id": [ + "cc8ec8580f4c" + ] + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "threat" + ], + "end": "2023-05-11T13:15:45.017Z", + "kind": "alert", + "original": "{\"VendorName\":\"Microsoft\",\"AlertType\":\"ARM_AnomalousServiceOperation.CredentialAccess\",\"ProductName\":\"Microsoft Defender for Cloud\",\"StartTimeUtc\":\"2023-05-11T13:15:45.0170422Z\",\"EndTimeUtc\":\"2023-05-11T13:15:45.0170422Z\",\"TimeGenerated\":\"2023-05-11T13:17:09.0170422Z\",\"ProcessingEndTime\":\"2023-05-11T13:17:09.0170422Z\",\"Severity\":\"Medium\",\"Status\":\"New\",\"ProviderAlertStatus\":null,\"ConfidenceLevel\":null,\"ConfidenceScore\":null,\"ConfidenceReasons\":null,\"IsIncident\":false,\"SystemAlertId\":\"2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d\",\"CorrelationKey\":null,\"Intent\":\"PreAttack\",\"AzureResourceId\":\"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM\",\"WorkspaceId\":\"00000000-0000-0000-0000-000000000001\",\"WorkspaceSubscriptionId\":\"00000000-0000-0000-0000-000000000001\",\"WorkspaceResourceGroup\":\"Sample-RG\",\"AgentId\":null,\"CompromisedEntity\":\"Sample-VM\",\"AlertDisplayName\":\"[SAMPLE ALERT] Login from a suspicious IP\",\"Description\":\"THIS IS A SAMPLE ALERT: Your resource has been accessed successfully from an IP address that Microsoft Threat Intelligence has associated with suspicious activity.\",\"Entities\":[{\"$id\":\"5\",\"Address\":\"81.2.69.142\",\"Location\":{\"CountryCode\":\"US\",\"CountryName\":\"United States\",\"State\":\"Virginia\",\"City\":\"Washington\",\"Longitude\":-78.17197,\"Latitude\":38.73078,\"Asn\":8075},\"ThreatIntelligence\":[{\"ProviderName\":\"AlertSimulator\",\"ThreatType\":\"Sample-Type\",\"ThreatName\":\"Sample-Threat\",\"Confidence\":1,\"ThreatDescription\":\"\"}],\"Asset\":false,\"Type\":\"ip\"},{\"$id\":\"6\",\"ImageId\":\"sample-image:v1\",\"Asset\":false,\"Type\":\"container-image\"},{\"$ref\":\"6\"},{\"$id\":\"5\",\"DnsDomain\":\"\",\"NTDomain\":\"\",\"HostName\":\"Sample-VM\",\"NetBiosName\":\"Sample-VM\",\"AzureID\":\"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM\",\"OMSAgentID\":\"00000000-0000-0000-0000-000000000001\",\"OSFamily\":\"Linux\",\"OSVersion\":\"Linux\",\"Asset\":false,\"Type\":\"host\"},{\"$id\":\"6\",\"ProcessId\":\"0x1e49a\",\"CommandLine\":\"\",\"Host\":{\"$ref\":\"5\"},\"Asset\":false,\"Type\":\"process\"},{\"$id\":\"7\",\"Name\":\"Sample-account\",\"Host\":{\"$ref\":\"5\"},\"Sid\":\"\",\"Asset\":false,\"Type\":\"account\",\"LogonId\":\"0xbd6e\"},{\"$id\":\"9\",\"ProcessId\":\"0x1e99b\",\"CommandLine\":\"php\",\"CreationTimeUtc\":\"2023-05-11T13:17:49.1333596Z\",\"ImageFile\":{\"$ref\":\"8\"},\"Account\":{\"$ref\":\"7\"},\"ParentProcess\":{\"$ref\":\"6\"},\"Host\":{\"$ref\":\"5\"},\"Asset\":false,\"Type\":\"process\"},{\"$id\":\"5\",\"DomainName\":\"sample.domain\",\"IpAddresses\":[{\"$id\":\"6\",\"Address\":\"81.2.69.142\",\"Location\":{\"CountryCode\":\"US\",\"CountryName\":\"United States\",\"State\":\"California\",\"City\":\"San Francisco\",\"Longitude\":0,\"Latitude\":0,\"Asn\":0},\"Asset\":false,\"Type\":\"ip\"}],\"HostIpAddress\":{\"$ref\":\"6\"},\"Asset\":false,\"Type\":\"dns\"},{\"$id\":\"6\",\"Address\":\"81.2.69.142\",\"Location\":{\"CountryCode\":\"sample\",\"CountryName\":\"united states\",\"State\":\"texas\",\"City\":\"san antonio\",\"Longitude\":0,\"Latitude\":0,\"Asn\":0,\"Carrier\":\"sample\",\"Organization\":\"sample-organization\",\"OrganizationType\":\"sample-organization\",\"CloudProvider\":\"Azure\",\"SystemService\":\"sample\"},\"ThreatIntelligence\":[{\"ProviderName\":\"Sample-Provider\",\"ThreatType\":\"Sample-Threat\",\"ThreatName\":\"Sample-Threat\",\"Confidence\":0.8,\"ThreatDescription\":\"Sample-Threat\"}],\"Asset\":false,\"Type\":\"ip\"},{\"$id\":\"5\",\"HostName\":\"Sample-VM\",\"AzureID\":\"/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM\",\"OMSAgentID\":\"00000000-0000-0000-0000-000000000000\",\"Asset\":false,\"Type\":\"host\"},{\"$id\":\"7\",\"Directory\":\"Sample-fileShare/dummy/path/to\",\"Name\":\"Sample-Name\",\"FileHashes\":[{\"$id\":\"8\",\"Algorithm\":\"MD5\",\"Value\":\"Sample-SHA\",\"Asset\":false,\"Type\":\"filehash\"}],\"Asset\":false,\"Type\":\"file\"},{\"$id\":\"9\",\"Name\":\"Sample-Name\",\"Category\":\"Virus\",\"Files\":[{\"$ref\":\"8\"}],\"Asset\":false,\"Type\":\"malware\"},{\"$id\":\"5\",\"DomainName\":\"sample.domain\",\"IpAddresses\":[{\"$id\":\"6\",\"Address\":\"81.2.69.142\",\"Location\":{\"CountryCode\":\"US\",\"CountryName\":\"United States\",\"State\":\"California\",\"City\":\"San Francisco\",\"Longitude\":0,\"Latitude\":0,\"Asn\":0},\"Asset\":false,\"Type\":\"ip\"}],\"HostIpAddress\":{\"$ref\":\"6\"},\"Asset\":false,\"Type\":\"dns\"},{\"$id\":\"7\",\"Name\":\"Sample-account\",\"NTDomain\":\"Sample-VM\",\"Host\":{\"$ref\":\"5\"},\"Sid\":\"S-1-5-21-3061399664-1673012318-3185014992-20022\",\"IsDomainJoined\":false,\"Asset\":false,\"Type\":\"account\",\"LogonId\":\"0x427d8dd9\"},{\"$id\":\"7\",\"Name\":\"Sample-namespace\",\"Cluster\":{\"$ref\":\"5\"},\"Asset\":false,\"Type\":\"K8s-namespace\"},{\"$id\":\"8\",\"Name\":\"sample-pod\",\"Namespace\":{\"$ref\":\"7\"},\"Asset\":false,\"Type\":\"K8s-pod\"},{\"$id\":\"9\",\"Name\":\"sample-container\",\"Image\":{\"$ref\":\"4\"},\"Pod\":{\"$ref\":\"8\"},\"Asset\":false,\"Type\":\"container\"},{\"$id\":\"10\",\"ProjectId\":\"012345678901\",\"ResourceType\":\"GCP Resource\",\"ResourceName\":\"Sample-Cluster\",\"Location\":\"us-central1-c\",\"LocationType\":\"Zonal\",\"Asset\":true,\"Type\":\"gcp-resource\",\"RelatedAzureResourceIds\":[\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c\"]},{\"$id\":\"7\",\"Name\":\"Sample-Name\",\"BlobContainer\":{\"$ref\":\"5\"},\"Url\":\"https://Sample-Storage.blob.core.windows.net/Sample/Sample.txt\",\"Etag\":\"Sample-Tag\",\"Asset\":false,\"Type\":\"blob\"},{\"$id\":\"5\",\"Name\":\"sample\",\"UPNSuffix\":\"contoso.com\",\"AadTenantId\":\"00000000-0000-0000-0000-000000000000\",\"AadUserId\":\"00000000-0000-0000-0000-000000000000\",\"Asset\":false,\"Type\":\"account\"},{\"$id\":\"5\",\"CloudResource\":{\"$ref\":\"4\"},\"Asset\":false,\"Type\":\"K8s-cluster\"},{\"$id\":\"8\",\"Directory\":\"https://Sample-Storage.blob.core.windows.net/Sample\",\"Name\":\"Sample-Name\",\"FileHashes\":[{\"$ref\":\"6\"}],\"Asset\":false,\"Type\":\"file\"},{\"$id\":\"10\",\"ProjectId\":\"012345678901\",\"ResourceType\":\"GCP Resource\",\"ResourceName\":\"Sample-Cluster\",\"Location\":\"us-central1-c\",\"LocationType\":\"Zonal\",\"Asset\":true,\"Type\":\"gcp-resource\",\"RelatedAzureResourceIds\":[\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c\"]},{\"$id\":\"6\",\"SourceAddress\":{\"$ref\":\"5\"},\"Protocol\":\"Tcp\",\"Asset\":false,\"Type\":\"network-connection\"},{\"$id\":\"7\",\"Name\":\"Sample-Name\",\"StorageResource\":{\"$ref\":\"4\"},\"Asset\":false,\"Type\":\"blob-container\"},{\"$id\":\"7\",\"ContainerId\":\"cc8ec8580f4c\",\"Image\":{\"$ref\":\"6\"},\"Asset\":false,\"Type\":\"container\"},{\"$id\":\"5\",\"Address\":\"81.2.69.142\",\"Location\":{\"CountryCode\":\"IN\",\"CountryName\":\"United States\",\"State\":\"Virginia\",\"City\":\"Washington\",\"Longitude\":-78.17197,\"Latitude\":38.73078,\"Asn\":8075},\"ThreatIntelligence\":[{\"ProviderName\":\"AlertSimulator\",\"ThreatType\":\"Sample-Type\",\"ThreatName\":\"Sample-Threat\",\"Confidence\":1,\"ThreatDescription\":\"\"}],\"Asset\":false,\"Type\":\"ip\"}],\"ExtendedLinks\":[{\"Href\":\"https://blog.netspi.com/gathering-bearer-tokens-azure/\",\"Category\":null,\"Label\":\"NetSPI blogpost\",\"Type\":\"webLink\"},{\"Href\":\"https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AZStorageKeysREST.ps1\",\"Category\":null,\"Label\":\"MicroBurst source code\",\"Type\":\"webLink\"}],\"ResourceIdentifiers\":[{\"$id\":\"2\",\"AzureResourceId\":\"/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca\",\"Type\":\"AzureResource\",\"AzureResourceTenantId\":\"aa40685b-417d-4664-b4ec-8f7640719adb\"},{\"$id\":\"3\",\"AadTenantId\":\"aa40685b-417d-4664-b4ec-8f7640719adb\",\"Type\":\"AAD\"},{\"$id\":\"3\",\"WorkspaceId\":\"00000000-0000-0000-0000-000000000001\",\"WorkspaceSubscriptionId\":\"00000000-0000-0000-0000-000000000001\",\"WorkspaceResourceGroup\":\"Sample-RG\",\"AgentId\":\"00000000-0000-0000-0000-00000000000\",\"Type\":\"LogAnalytics\"}],\"RemediationSteps\":[\"Go to the firewall settings in order to lock down the firewall as tightly as possible.\"],\"ExtendedProperties\":{\"resourceType\":\"Virtual Machine\",\"Investigation steps\":\"{\\\"displayValue\\\":\\\"How to investigate this alert using logs at your Log Analytics workspace.\\\",\\\"kind\\\":\\\"Link\\\",\\\"value\\\":\\\"https:\\\\/\\\\/go.microsoft.com\\\\/fwlink\\\\/?linkid=2091064\\\"}\",\"Potential causes\":\"An attacker has accessed your database from a potentially suspicious IP; a legitimate user has accessed your database from a potentially suspicious IP.\",\"Client principal name\":\"Sample-user\",\"Alert Id\":\"00000000-0000-0000-0000-000000000000\",\"Client IP address\":\"81.2.69.142\",\"Client IP location\":\"Sample\",\"Client application\":\"Sample-app\",\"OMS workspace ID\":\"00000000-0000-0000-0000-000000000001\",\"OMS agent ID\":\"00000000-0000-0000-0000-000000000001\"},\"AlertUri\":\"https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d/subscriptionId/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus\"}", + "provider": "Microsoft Defender for Cloud", + "reference": "https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d/subscriptionId/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus", + "start": "2023-05-11T13:15:45.017Z", + "type": [ + "indicator" + ] + }, + "host": { + "domain": [ + "sample.domain" + ], + "geo": { + "city_name": [ + "Washington", + "san antonio" + ], + "country_iso_code": [ + "US", + "sample", + "IN" + ], + "country_name": [ + "United States", + "united states" + ] + }, + "hostname": [ + "Sample-VM" + ], + "os": { + "family": [ + "Linux" + ] + } + }, + "microsoft_defender_cloud": { + "event": { + "alert_type": "ARM_AnomalousServiceOperation.CredentialAccess", + "azure_resource_id": "/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM", + "compromised_entity": "Sample-VM", + "description": "THIS IS A SAMPLE ALERT: Your resource has been accessed successfully from an IP address that Microsoft Threat Intelligence has associated with suspicious activity.", + "display_name": "[SAMPLE ALERT] Login from a suspicious IP", + "end_time_utc": "2023-05-11T13:15:45.017Z", + "entities": [ + { + "address": "81.2.69.142", + "asset": false, + "id": "5", + "location": { + "asn": 8075, + "city": "Washington", + "country_code": "US", + "country_name": "United States", + "latitude": 38.73078, + "longitude": -78.17197, + "state": "Virginia" + }, + "threat_intelligence": [ + { + "confidence": 1.0, + "name": "Sample-Threat", + "provider_name": "AlertSimulator", + "type": "Sample-Type" + } + ], + "type": "ip" + }, + { + "asset": false, + "id": "6", + "image_id": "sample-image:v1", + "type": "container-image" + }, + { + "ref": "6" + }, + { + "asset": false, + "azure_id": "/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM", + "host_name": "Sample-VM", + "id": "5", + "net_bios_name": "Sample-VM", + "oms_agent_id": "00000000-0000-0000-0000-000000000001", + "os_family": "Linux", + "os_version": "Linux", + "type": "host" + }, + { + "asset": false, + "host": { + "ref": "5" + }, + "id": "6", + "process_id": "0x1e49a", + "type": "process" + }, + { + "asset": false, + "host": { + "ref": "5" + }, + "id": "7", + "logon_id": "0xbd6e", + "name": "Sample-account", + "type": "account" + }, + { + "account": { + "ref": "7" + }, + "asset": false, + "command_line": "php", + "creation_time_utc": "2023-05-11T13:17:49.133Z", + "host": { + "ref": "5" + }, + "id": "9", + "image_file": { + "ref": "8" + }, + "parent_process": { + "ref": "6" + }, + "process_id": "0x1e99b", + "type": "process" + }, + { + "asset": false, + "domain_name": "sample.domain", + "host_ip_address": { + "ref": "6" + }, + "id": "5", + "ip_addresses": [ + { + "address": "81.2.69.142", + "asset": false, + "id": "6", + "location": { + "asn": 0, + "city": "San Francisco", + "country_code": "US", + "country_name": "United States", + "latitude": 0, + "longitude": 0, + "state": "California" + }, + "type": "ip" + } + ], + "type": "dns" + }, + { + "address": "81.2.69.142", + "asset": false, + "id": "6", + "location": { + "asn": 0, + "carrier": "sample", + "city": "san antonio", + "cloud_provider": "Azure", + "country_code": "sample", + "country_name": "united states", + "latitude": 0.0, + "longitude": 0.0, + "organization": "sample-organization", + "organization_type": "sample-organization", + "state": "texas", + "system_service": "sample" + }, + "threat_intelligence": [ + { + "confidence": 0.8, + "description": "Sample-Threat", + "name": "Sample-Threat", + "provider_name": "Sample-Provider", + "type": "Sample-Threat" + } + ], + "type": "ip" + }, + { + "asset": false, + "azure_id": "/SUBSCRIPTIONS/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/RESOURCEGROUPS/Sample-RG/providers/Microsoft.Compute/virtualMachines/Sample-VM", + "host_name": "Sample-VM", + "id": "5", + "oms_agent_id": "00000000-0000-0000-0000-000000000000", + "type": "host" + }, + { + "asset": false, + "directory": "Sample-fileShare/dummy/path/to", + "file_hashes": [ + { + "algorithm": "MD5", + "asset": false, + "id": "8", + "type": "filehash", + "value": "Sample-SHA" + } + ], + "id": "7", + "name": "Sample-Name", + "type": "file" + }, + { + "asset": false, + "category": "Virus", + "files": [ + { + "ref": "8" + } + ], + "id": "9", + "name": "Sample-Name", + "type": "malware" + }, + { + "asset": false, + "domain_name": "sample.domain", + "host_ip_address": { + "ref": "6" + }, + "id": "5", + "ip_addresses": [ + { + "address": "81.2.69.142", + "asset": false, + "id": "6", + "location": { + "asn": 0, + "city": "San Francisco", + "country_code": "US", + "country_name": "United States", + "latitude": 0, + "longitude": 0, + "state": "California" + }, + "type": "ip" + } + ], + "type": "dns" + }, + { + "asset": false, + "host": { + "ref": "5" + }, + "id": "7", + "is_domain_joined": false, + "logon_id": "0x427d8dd9", + "name": "Sample-account", + "nt_domain": "Sample-VM", + "sid": "S-1-5-21-3061399664-1673012318-3185014992-20022", + "type": "account" + }, + { + "asset": false, + "cluster": { + "ref": "5" + }, + "id": "7", + "name": "Sample-namespace", + "type": "K8s-namespace" + }, + { + "asset": false, + "id": "8", + "name": "sample-pod", + "namespace": { + "ref": "7" + }, + "type": "K8s-pod" + }, + { + "asset": false, + "id": "9", + "image": { + "ref": "4" + }, + "name": "sample-container", + "pod": { + "ref": "8" + }, + "type": "container" + }, + { + "asset": true, + "id": "10", + "location_type": "Zonal", + "location_value": "us-central1-c", + "project_id": "012345678901", + "related_azure_resource_ids": [ + "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c" + ], + "resource_name": "Sample-Cluster", + "resource_type": "GCP Resource", + "type": "gcp-resource" + }, + { + "asset": false, + "blob_container": { + "ref": "5" + }, + "etag": "Sample-Tag", + "id": "7", + "name": "Sample-Name", + "type": "blob", + "url": "https://Sample-Storage.blob.core.windows.net/Sample/Sample.txt" + }, + { + "aad_tenant_id": "00000000-0000-0000-0000-000000000000", + "aad_user_id": "00000000-0000-0000-0000-000000000000", + "asset": false, + "id": "5", + "name": "sample", + "type": "account", + "upn_suffix": "contoso.com" + }, + { + "asset": false, + "cloud_resource": { + "ref": "4" + }, + "id": "5", + "type": "K8s-cluster" + }, + { + "asset": false, + "directory": "https://Sample-Storage.blob.core.windows.net/Sample", + "file_hashes": [ + { + "ref": "6" + } + ], + "id": "8", + "name": "Sample-Name", + "type": "file" + }, + { + "asset": true, + "id": "10", + "location_type": "Zonal", + "location_value": "us-central1-c", + "project_id": "012345678901", + "related_azure_resource_ids": [ + "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroups/Sample-RG/providers/Microsoft.Security/securityConnectors/gcp-connector/securityentitydata/gcp-clusters-sample-cluster-us-central1-c" + ], + "resource_name": "Sample-Cluster", + "resource_type": "GCP Resource", + "type": "gcp-resource" + }, + { + "asset": false, + "id": "6", + "protocol": "tcp", + "source_address": { + "ref": "5" + }, + "type": "network-connection" + }, + { + "asset": false, + "id": "7", + "name": "Sample-Name", + "storage_resource": { + "ref": "4" + }, + "type": "blob-container" + }, + { + "asset": false, + "container_id": "cc8ec8580f4c", + "id": "7", + "image": { + "ref": "6" + }, + "type": "container" + }, + { + "address": "81.2.69.142", + "asset": false, + "id": "5", + "location": { + "asn": 8075, + "city": "Washington", + "country_code": "IN", + "country_name": "United States", + "latitude": 38.73078, + "longitude": -78.17197, + "state": "Virginia" + }, + "threat_intelligence": [ + { + "confidence": 1.0, + "name": "Sample-Threat", + "provider_name": "AlertSimulator", + "type": "Sample-Type" + } + ], + "type": "ip" + } + ], + "extended_links": [ + { + "href": "https://blog.netspi.com/gathering-bearer-tokens-azure/", + "label": "NetSPI blogpost", + "type": "webLink" + }, + { + "href": "https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AZStorageKeysREST.ps1", + "label": "MicroBurst source code", + "type": "webLink" + } + ], + "extended_properties": { + "alert id": "00000000-0000-0000-0000-000000000000", + "client application": "Sample-app", + "client ip address": "81.2.69.142", + "client ip location": "Sample", + "client principal name": "Sample-user", + "investigation steps": "{\"displayValue\":\"How to investigate this alert using logs at your Log Analytics workspace.\",\"kind\":\"Link\",\"value\":\"https:\\/\\/go.microsoft.com\\/fwlink\\/?linkid=2091064\"}", + "oms agent id": "00000000-0000-0000-0000-000000000001", + "oms workspace id": "00000000-0000-0000-0000-000000000001", + "potential causes": "An attacker has accessed your database from a potentially suspicious IP; a legitimate user has accessed your database from a potentially suspicious IP.", + "resourcetype": "Virtual Machine" + }, + "intent": "PreAttack", + "is_incident": false, + "processing_end_time": "2023-05-11T13:17:09.017Z", + "product": { + "name": "Microsoft Defender for Cloud" + }, + "remediation_steps": [ + "Go to the firewall settings in order to lock down the firewall as tightly as possible." + ], + "resource_identifiers": [ + { + "azure_id": "/subscriptions/12cabcb4-86e8-404f-a3d2-1dc9982f45ca", + "azure_tenant_id": "aa40685b-417d-4664-b4ec-8f7640719adb", + "id": "2", + "type": "AzureResource" + }, + { + "aad_tenant_id": "aa40685b-417d-4664-b4ec-8f7640719adb", + "id": "3", + "type": "AAD" + }, + { + "agent_id": "00000000-0000-0000-0000-00000000000", + "id": "3", + "type": "LogAnalytics", + "workspace_id": "00000000-0000-0000-0000-000000000001", + "workspace_resource_group": "Sample-RG", + "workspace_subscription_id": "00000000-0000-0000-0000-000000000001" + } + ], + "severity": "Medium", + "start_time_utc": "2023-05-11T13:15:45.017Z", + "status": "New", + "system": { + "alert_id": "2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d" + }, + "time_generated": "2023-05-11T13:17:09.017Z", + "uri": "https://portal.azure.com/#blade/Microsoft_Azure_Security_AzureDefenderForData/AlertBlade/alertId/2517184898549829577_cdcf9f94-ec53-47a6-ab87-76130f87218d/subscriptionId/12cabcb4-86e8-404f-a3d2-1dc9982f45ca/resourceGroup/Sample-RG/referencedFrom/alertDeepLink/location/centralus", + "vendor_name": "Microsoft", + "workspace": { + "id": "00000000-0000-0000-0000-000000000001", + "resource_group": "Sample-RG", + "subscription_id": "00000000-0000-0000-0000-000000000001" + } + } + }, + "network": { + "transport": [ + "tcp" + ] + }, + "observer": { + "vendor": "Microsoft" + }, + "process": { + "entity_id": [ + "0x1e49a", + "0x1e99b" + ] + }, + "related": { + "hosts": [ + "sample.domain", + "Sample-VM" + ], + "ip": [ + "81.2.69.142" + ] + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "Sample-Storage.blob.core.windows.net", + "extension": "txt", + "original": "https://Sample-Storage.blob.core.windows.net/Sample/Sample.txt", + "path": "/Sample/Sample.txt", + "scheme": "https" + } + } + ] +} \ No newline at end of file diff --git a/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/microsoft_defender_cloud/data_stream/event/agent/stream/azure-eventhub.yml.hbs b/packages/microsoft_defender_cloud/data_stream/event/agent/stream/azure-eventhub.yml.hbs new file mode 100644 index 00000000000..89ae5dc4e22 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/agent/stream/azure-eventhub.yml.hbs @@ -0,0 +1,42 @@ +{{#if eventhub}} +eventhub: {{eventhub}} +{{/if}} +{{#if consumer_group}} +consumer_group: {{consumer_group}} +{{/if}} +{{#if connection_string}} +connection_string: {{connection_string}} +{{/if}} +{{#if storage_account}} +storage_account: {{storage_account}} +{{/if}} +{{#if storage_account_key}} +storage_account_key: {{storage_account_key}} +{{/if}} +{{#if storage_account_container }} +storage_account_container: {{storage_account_container}} +{{else}} +{{#if eventhub}} +storage_account_container: azure-eventhub-input-{{eventhub}} +{{/if}} +{{/if}} +{{#if resource_manager_endpoint}} +resource_manager_endpoint: {{resource_manager_endpoint}} +{{/if}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/microsoft_defender_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_defender_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..39b24067fad --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,1709 @@ +--- +description: Pipeline for processing Event(Alert and Recommendation) logs. +processors: + - set: + field: ecs.version + value: 8.9.0 + tag: set_ecs_version + - set: + field: event.kind + value: alert + tag: set_event_kind + - set: + field: event.category + value: [intrusion_detection] + tag: set_event_category + - set: + field: event.type + value: [info] + tag: set_event_type + - rename: + field: message + target_field: event.original + tag: rename_message + ignore_missing: true + - json: + field: event.original + target_field: json + tag: json_to_split_message + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script convert the json object key into lowercase. + if: ctx.json != null + tag: script_to_convert_json_object_key_into_lowercase + source: | + void handleMap(Map map) { + for (def x: map.values()) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + def keySet = map.keySet().toArray(); + for (def key: keySet) { + def lc = key.toLowerCase(); + map[lc] = map[key]; + if (key != lc) { + map.remove(key) + } + } + } + void handleList(List list) { + for (def x: list) { + if (x instanceof Map) { + handleMap(x); + } else if (x instanceof List) { + handleList(x); + } + } + } + handleMap(ctx); + - set: + field: event.type + value: [indicator] + tag: set_event_type + if: | + ctx.json?.alerttype != null && [ + 'arm_anomalousserviceoperation.credentialaccess', + 'arm_anomalousserviceoperation.collection', + 'arm_anomalousserviceoperation.defenseevasion', + 'arm_anomalousserviceoperation.execution', + 'arm_anomalousserviceoperation.impact', + 'arm_anomalousserviceoperation.initialaccess', + 'arm_anomalousserviceoperation.lateralmovement', + 'arm_anomalousserviceoperation.persistence', + 'arm_anomalousserviceoperation.privilegeescalation', + 'arm_unusedaccountpersistence', + 'arm_unusedapppowershellpersistence', + 'arm_unusedappibizapersistence', + 'arm_privilegedroledefinitioncreation', + 'arm_anomalousrbacroleassignment', + 'arm_anomalousoperation.credentialaccess', + 'arm_anomalousoperation.collection', + 'arm_anomalousoperation.defenseevasion', + 'arm_anomalousoperation.execution', + 'arm_anomalousoperation.impact', + 'arm_anomalousoperation.initialaccess', + 'arm_anomalousoperation.lateralmovement', + 'arm_anomalousoperation.persistence', + 'arm_anomalousoperation.privilegeescalation', + 'arm_microburst.runcodeonbehalf', + 'arm_netspi.maintainpersistence', + 'arm_powerzure.runcodeonbehalf', + 'arm_powerzure.maintainpersistence', + 'arm_anomalousclassicroleassignment' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [api] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'api_populationspikeinapitraffic', + 'api_spikeinapitraffic', + 'api_spikeinpayload', + 'api_spikeinlatency', + 'api_sprayinrequests', + 'api_parameterenumeration', + 'api_distributedparameterenumeration', + 'api_unseenparamtype', + 'api_unseenparam', + 'api_accessfromtorexitnode', + 'api_accessfromsuspiciousip', + 'api_accessfromsuspicioususeragent' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [authentication] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'vm_loginbruteforcesuccess', + 'vm_vmaccessunusualpasswordreset', + 'vm_sshkeyaddition', + 'vm_vmaccessunusualpasswordreset', + 'vm_vmaccessunusualsshreset', + 'sql.db_geoanomaly', + 'sql.vm_geoanomaly', + 'sql.dw_geoanomaly', + 'sql.mi_geoanomaly', + 'sql.db_principalanomaly', + 'sql.vm_principalanomaly', + 'sql.dw_principalanomaly', + 'sql.mi_principalanomaly', + 'sql.db_domainanomaly', + 'sql.vm_domainanomaly', + 'sql.dw_domainanomaly', + 'sql.mi_domainanomaly', + 'sql.db_bruteforce', + 'sql.vm_bruteforce', + 'sql.dw_bruteforce', + 'sql.mi_bruteforce', + 'sql.postgresql_bruteforce', + 'sql.mariadb_bruteforce', + 'sql.mysql_bruteforce', + 'sql.postgresql_principalanomaly', + 'sql.mariadb_principalanomaly', + 'sql.mysql_principalanomaly', + 'sql.mariadb_domainanomaly', + 'sql.postgresql_domainanomaly', + 'sql.mysql_domainanomaly', + 'sql.postgresql_datacenteranomaly', + 'sql.mariadb_datacenteranomaly', + 'sql.mysql_datacenteranomaly', + 'sql.postgresql_cloudprovideranomaly', + 'sql.mariadb_cloudprovideranomaly', + 'sql.mysql_cloudprovideranomaly', + 'sql.mariadb_geoanomaly', + 'sql.postgresql_geoanomaly', + 'sql.mysql_geoanomaly', + 'storage.blob_suspiciousapp', + 'storage.blob_suspiciousip', + 'storage.files_suspiciousip', + 'storage.blob_openacl', + 'storage.blob_toranomaly', + 'storage.files_toranomaly', + 'storage.blob_geoanomaly', + 'storage.files_geoanomaly', + 'storage.blob_anonymousaccessanomaly', + 'storage.blob_opencontainersscanning', + 'storage.blob_accessinspectionanomaly', + 'storage.files_accessinspectionanomaly', + 'cosmosdb_toranomaly', + 'cosmosdb_suspiciousip', + 'cosmosdb_geoanomaly', + 'kv_suspiciousipaccess', + 'kv_toraccess', + 'kv_accountvolumeaccessdeniedanomaly', + 'kv_useraccessdeniedanomaly', + 'kv_appanomaly', + 'kv_operationpatternanomaly', + 'kv_useranomaly', + 'kv_userappanomaly', + 'kv_accountvolumeanomaly', + 'kv_suspiciousipaccessdenied', + 'kv_unusualaccesssuspiciousip' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [configuration] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'k8s_exposedpostgrestrustauth', + 'k8s_exposedpostgresbroadiprange', + 'arm_azurite' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [malware] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'vm_ammalwarecampaignrelatedexclusion', + 'vm_filelessattacktoolkit', + 'vm_runbypsexec', + 'vm_svchostruninrareservicegroup', + 'vm_suspiciousactivity', + 'vm_loginbruteforcevaliduserfailed', + 'vm_customscriptextensionsuspiciousfailure', + 'vm_taskkillburst', + 'vm_vmaccessunusualsshreset', + 'vm_ambroadfilesexclusion', + 'vm_amdisablementandcodeexecution', + 'vm_amdisablement', + 'vm_amfileexclusionandcodeexecution', + 'vm_amtempfileexclusionandcodeexecution', + 'vm_amtempfileexclusion', + 'vm_amrealtimeprotectiondisabled', + 'vm_amtemprealtimeprotectiondisablement', + 'vm_amrealtimeprotectiondisablementandcodeexec', + 'vm_amtemporarilydisablement', + 'vm_unusualamfileexclusion', + 'vm_sshbruteforcefailed', + 'vm_filelessattackbehavior', + 'vm_filelessattacktechnique', + 'vm_mailserverexploitation', + 'vm_sshbruteforcesuccess', + 'vm_kubernetesdashboard', + 'vm_vmaccessunusualconfigreset', + 'vm_customscriptextensionunusualdeletion', + 'vm_customscriptextensionunusualexecution', + 'vm_harmfulapplication', + 'vm_suspiciousipanomaly', + 'appservices_base64encodedexecutableincommandlineparams', + 'appservices_suspectdownload', + 'appservices_eicar', + 'appservices_nmap', + 'appservices_phpinuploadfolder', + 'k8s_anomalouspoddeployment', + 'k8s_anomaloussecretaccess', + 'k8s_exposeddashboard', + 'k8s_exposedservice', + 'k8s_exposedredis', + 'sql.db_harmfulapplication', + 'sql.vm_harmfulapplication', + 'sql.mi_harmfulapplication', + 'sql.dw_harmfulapplication', + 'sql.db_suspiciousipanomaly', + 'sql.vm_suspiciousipanomaly', + 'sql.dw_suspiciousipanomaly', + 'sql.mi_suspiciousipanomaly', + 'sql.postgresql_suspiciousipanomaly', + 'sql.mariadb_suspiciousipanomaly', + 'sql.mysql_suspiciousipanomaly', + 'arm_operationfromsuspiciousip', + 'arm_operationfromsuspiciousproxyip', + 'arm_suspiciouscomputecreation', + 'arm_suspicious_vault_recovering', + 'arm_unusedaccountpersistence', + 'storage.files_widespreadeam', + 'storage.blob_malwarehashreputation', + 'storage.files_malwarehashreputation', + 'storage.blob_dataexfiltration.amountofdataanomaly', + 'storage.blob_dataexfiltration.numberofblobsanomaly', + 'storage.files_dataexfiltration.amountofdataanomaly', + 'storage.files_dataexfiltration.numberoffilesanomaly', + 'storage.blob_applicationanomaly', + 'storage.files_applicationanomaly', + 'storage.blob_dataexplorationanomaly', + 'storage.files_dataexplorationanomaly', + 'network_resourceipindicatedasmalicious' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [network] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'vm_filelessattackbehavior.windows', + 'vm_filelessattacktechnique.windows', + 'azuredns_threatintelsuspectdomain', + 'azuredns_protocolanomaly', + 'azuredns_darkweb', + 'azuredns_darkwebproxy', + 'azuredns_sinkholeddomain', + 'azuredns_phishingdomain', + 'azuredns_domaingenerationalgorithm', + 'azuredns_randomizeddomain', + 'azuredns_currencymining', + 'azuredns_suspiciousdomain', + 'azuredns_datainfiltration', + 'azuredns_dataexfiltration', + 'azuredns_dataobfuscation', + 'appservices_danglingdomain', + 'appservices_phishingcontent', + 'appservices_potentialdanglingdomain', + 'k8s_exposedkubeflow', + 'network_communicationwithc2', + 'network_ddos_detected', + 'network_ddos_mitigated', + 'sql_incoming_bf_onetoone', + 'ddos', + 'rdp_incoming_bf_manytoone', + 'rdp_incoming_bf_onetoone', + 'rdp_outgoing_bf_onetomany', + 'rdp_outgoing_bf_onetoone', + 'ssh_incoming_bf_manytoone', + 'ssh_incoming_bf_onetoone', + 'ssh_outgoing_bf_onetomany', + 'ssh_outgoing_bf_onetoone', + 'portscanning' + ].contains(ctx.json.alerttype.toLowerCase()) + - set: + field: event.category + value: [threat] + tag: set_event_category + if: | + ctx.json?.alerttype != null && [ + 'arm_anomalousserviceoperation.credentialaccess', + 'arm_anomalousserviceoperation.collection', + 'arm_anomalousserviceoperation.defenseevasion', + 'arm_anomalousserviceoperation.execution', + 'arm_anomalousserviceoperation.impact', + 'arm_anomalousserviceoperation.initialaccess', + 'arm_anomalousserviceoperation.lateralmovement', + 'arm_anomalousserviceoperation.persistence', + 'arm_anomalousserviceoperation.privilegeescalation', + 'arm_unusedapppowershellpersistence', + 'arm_unusedappibizapersistence', + 'arm_privilegedroledefinitioncreation', + 'arm_anomalousrbacroleassignment', + 'arm_anomalousoperation.credentialaccess', + 'arm_anomalousoperation.collection', + 'arm_anomalousoperation.defenseevasion', + 'arm_anomalousoperation.execution', + 'arm_anomalousoperation.impact', + 'arm_anomalousoperation.initialaccess', + 'arm_anomalousoperation.lateralmovement', + 'arm_anomalousoperation.persistence', + 'arm_anomalousoperation.privilegeescalation', + 'arm_microburst.runcodeonbehalf', + 'arm_netspi.maintainpersistence', + 'arm_powerzure.runcodeonbehalf', + 'arm_powerzure.maintainpersistence', + 'arm_anomalousclassicroleassignment' + ].contains(ctx.json.alerttype.toLowerCase()) + - rename: + field: json.$type + target_field: microsoft_defender_cloud.event.event_type + tag: rename_type + ignore_missing: true + - rename: + field: json.agentid + target_field: microsoft_defender_cloud.event.agent_id + tag: rename_agent_id + ignore_missing: true + - rename: + field: json.alertdisplayname + target_field: microsoft_defender_cloud.event.display_name + tag: rename_alert_display_name + ignore_missing: true + - rename: + field: json.alerttype + target_field: microsoft_defender_cloud.event.alert_type + tag: rename_alert_type + ignore_missing: true + - rename: + field: json.alerturi + target_field: microsoft_defender_cloud.event.uri + tag: rename_alert_uri + ignore_missing: true + - set: + field: event.reference + copy_from: microsoft_defender_cloud.event.uri + tag: set_event_reference + ignore_empty_value: true + - rename: + field: json.assessmenteventdataenrichment.action + target_field: microsoft_defender_cloud.event.assessment_event_data_enrichment.action + tag: rename_assessment_event_data_enrichment_action + ignore_missing: true + - rename: + field: json.assessmenteventdataenrichment.apiversion + target_field: microsoft_defender_cloud.event.assessment_event_data_enrichment.api_version + tag: rename_assessment_event_data_enrichment_api_version + ignore_missing: true + - convert: + field: json.assessmenteventdataenrichment.issnapshot + target_field: microsoft_defender_cloud.event.assessment_event_data_enrichment.is_snapshot + type: boolean + tag: convert_assessment_event_data_enrichment_is_snapshot_to_boolean + ignore_missing: true + if: ctx.json?.assessmenteventdataenrichment?.issnapshot != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.azureresourceid + target_field: microsoft_defender_cloud.event.azure_resource_id + tag: rename_azure_resource_id + ignore_missing: true + - rename: + field: json.compromisedentity + target_field: microsoft_defender_cloud.event.compromised_entity + tag: rename_compromised_entity + ignore_missing: true + - rename: + field: json.confidencelevel + target_field: microsoft_defender_cloud.event.confidence.level + tag: rename_confidence_level + ignore_missing: true + - rename: + field: json.confidencereasons + target_field: microsoft_defender_cloud.event.confidence.reasons + tag: rename_confidence_reasons + ignore_missing: true + - rename: + field: json.confidencescore + target_field: microsoft_defender_cloud.event.confidence.score + tag: rename_confidence_score + ignore_missing: true + - rename: + field: json.correlationkey + target_field: microsoft_defender_cloud.event.correlation_key + tag: rename_correlation_key + ignore_missing: true + - rename: + field: json.description + target_field: microsoft_defender_cloud.event.description + tag: rename_description + ignore_missing: true + - date: + field: json.endtimeutc + target_field: microsoft_defender_cloud.event.end_time_utc + tag: date_end_time_utc + formats: + - ISO8601 + if: ctx.json?.endtimeutc != null && ctx.json.endtimeutc != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.end + copy_from: microsoft_defender_cloud.event.end_time_utc + tag: set_event_end + ignore_empty_value: true + - script: + lang: painless + description: This script rename fields belongs to entities objects. + if: ctx.json?.entities != null + params: + "$id": "id" + "aadtenantid": "aad_tenant_id" + "aaduserid": "aad_user_id" + "$ref": "ref" + "amazonresourceid": "amazon_resource_id" + "azureid": "azure_id" + "files": "files" + "blobcontainer": "blob_container" + "cloudresource": "cloud_resource" + "commandline": "command_line" + "containerid": "container_id" + "creationtimeutc": "creation_time_utc" + "dnsdomain": "dns_domain" + "domainname": "domain_name" + "elevationtoken": "elevation_token" + "endtimeutc": "end_time_utc" + "filehashes": "file_hashes" + "hostipaddress": "host_ip_address" + "hostname": "host_name" + "imagefile": "image_file" + "imageid": "image_id" + "ipaddresses": "ip_addresses" + "countrycode": "country_code" + "countryname": "country_name" + "isdomainjoined": "is_domain_joined" + "isvalid": "is_valid" + "cloudprovider": "cloud_provider" + "organizationtype": "organization_type" + "systemservice": "system_service" + "logonid": "logon_id" + "netbiosname": "net_bios_name" + "ntdomain": "nt_domain" + "objectguid": "object_guid" + "omsagentid": "oms_agent_id" + "osfamily": "os_family" + "osversion": "os_version" + "parentprocess": "parent_process" + "processid": "process_id" + "projectid": "project_id" + "relatedazureresourceids": "related_azure_resource_ids" + "resourceid": "resource_id" + "resourcename": "resource_name" + "resourcetype": "resource_type" + "sessionid": "session_id" + "sourceaddress": "source_address" + "starttimeutc": "start_time_utc" + "storageresource": "storage_resource" + "threatintelligence": "threat_intelligence" + "providername": "provider_name" + "reportlink": "report_link" + "threatdescription": "description" + "threatname": "name" + "locationtype": "location_type" + "threattype": "type" + "upnsuffix": "upn_suffix" + tag: painless_to_rename_fields_under_entities_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + if (key=='location') { + updatedJson['location_value'] = value; + updatedJson.remove('location'); + } + } + } + return updatedJson; + } + def entities_obj = new ArrayList(); + for(entity in ctx.json.entities){ + entities_obj.add(renameKeys(entity, params)); + } + ctx.entities_obj=entities_obj; + - rename: + field: entities_obj + target_field: microsoft_defender_cloud.event.entities + tag: rename_entities_obj + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: cloud.provider + value: '{{{_ingest._value.location.cloud_provider}}}' + tag: append_location_cloud_provider_into_cloud_provider + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.creation_time_utc + target_field: _ingest._value.creation_time_utc + tag: date_entities_creation_time_utc + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.creation_time_utc + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.end_time_utc + target_field: _ingest._value.end_time_utc + tag: date_entities_end_time_utc + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.end_time_utc + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + date: + field: _ingest._value.start_time_utc + target_field: _ingest._value.start_time_utc + tag: date_entities_start_time_utc + formats: + - ISO8601 + on_failure: + - remove: + field: _ingest._value.start_time_utc + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: container.id + value: '{{{_ingest._value.container_id}}}' + tag: append_container_id_into_container_id + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.domain + value: '{{{_ingest._value.domain_name}}}' + tag: append_domain_name_into_host_domain + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: related.hosts + value: '{{{_ingest._value.domain_name}}}' + tag: append_domain_name_into_related_hosts + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.geo.city_name + value: '{{{_ingest._value.location.city}}}' + tag: append_location_city_into_host_geo_city_name + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.geo.country_iso_code + value: '{{{_ingest._value.location.country_code}}}' + tag: append_location_country_code_into_host_geo_country_iso_code + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.geo.country_name + value: '{{{_ingest._value.location.country_name}}}' + tag: append_location_country_name_into_host_geo_country_name + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.location.latitude + type: double + tag: convert_location_latitude_to_double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.location.latitude + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.location.longitude + type: double + tag: convert_location_longitude_to_double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.location.longitude + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.hostname + value: '{{{_ingest._value.host_name}}}' + tag: append_host_name_into_host_hostname + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: related.hosts + value: '{{{_ingest._value.host_name}}}' + tag: append_host_name_into_related_hosts + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: host.os.family + value: '{{{_ingest._value.os_family}}}' + tag: append_os_family_into_host_os_family + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + lowercase: + field: _ingest._value.protocol + tag: lowercase_protocol + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: network.transport + value: '{{{_ingest._value.protocol}}}' + tag: append_protocol_into_network_transport + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: process.entity_id + value: '{{{_ingest._value.process_id}}}' + tag: append_process_id_into_process_entity_id + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.address + type: ip + tag: convert_address_to_ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + append: + field: related.ip + value: '{{{_ingest._value.address}}}' + tag: append_address_into_related_ip + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.ip_addresses + ignore_missing: true + ignore_failure: true + processor: + convert: + field: _ingest._value.address + type: ip + tag: convert_ip_addresses_address_to_ip + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.address + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.ip_addresses + ignore_missing: true + ignore_failure: true + processor: + append: + field: related.ip + value: '{{{_ingest._value.address}}}' + tag: append_address_into_related_ip + allow_duplicates: false + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.asset + type: boolean + tag: convert_asset_to_boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.asset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.ip_addresses + ignore_missing: true + ignore_failure: true + processor: + convert: + field: _ingest._value.asset + type: boolean + tag: convert_ip_addresses_asset_to_boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.asset + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.ip_addresses + ignore_missing: true + ignore_failure: true + processor: + convert: + field: _ingest._value.location.asn + type: long + tag: convert_ip_addresses_location_asn_to_long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.location.asn + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.is_domain_joined + type: boolean + tag: convert_is_domain_joined_to_boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.is_domain_joined + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.is_valid + type: boolean + tag: convert_is_valid_to_boolean + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.is_valid + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + convert: + field: _ingest._value.location.asn + type: long + tag: convert_location_asn_to_long + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.location.asn + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + uri_parts: + field: _ingest._value.url + tag: uri_parts_url + ignore_failure: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value.threat_intelligence + ignore_missing: true + ignore_failure: true + processor: + convert: + field: _ingest._value.confidence + type: double + tag: convert_threat_intelligence_confidence_to_double + ignore_missing: true + on_failure: + - remove: + field: _ingest._value.confidence + ignore_missing: true + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + description: This script rename fields belongs to the resource identifier objects. + if: ctx.json?.resourceidentifiers != null + params: + "$id": "id" + "aadtenantid": "aad_tenant_id" + "agentid": "agent_id" + "azureresourceid": "azure_id" + "azureresourcetenantid": "azure_tenant_id" + "workspaceid": "workspace_id" + "workspaceresourcegroup": "workspace_resource_group" + "workspacesubscriptionid": "workspace_subscription_id" + tag: script_to_rename_fields_under_resource_identifiers_object + source: | + def renameKeys(Map json, Map keyMap) { + def updatedJson = new HashMap(); + for (def entry: json.entrySet()) { + def key = entry.getKey(); + def value = entry.getValue(); + if (value instanceof Map) { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = renameKeys(value, keyMap); + } else { + updatedJson[key] = renameKeys(value, keyMap); + } + } else if (value instanceof List) { + def updatedList = []; + for (def item: value) { + if (item instanceof Map) { + updatedList.add(renameKeys(item, keyMap)); + } else { + updatedList.add(item); + } + } + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = updatedList; + } else { + updatedJson[key] = value; + } + } else { + if (keyMap.containsKey(key)) { + updatedJson[keyMap[key]] = value; + } else { + updatedJson[key] = value; + } + } + } + return updatedJson; + } + def resource_identifier_obj = new ArrayList(); + for(entity in ctx.json.resourceidentifiers){ + resource_identifier_obj.add(renameKeys(entity, params)); + } + ctx.resource_identifier_obj=resource_identifier_obj; + - rename: + field: resource_identifier_obj + target_field: microsoft_defender_cloud.event.resource_identifiers + tag: rename_resource_identifier_obj + ignore_missing: true + - rename: + field: json.extendedlinks + target_field: microsoft_defender_cloud.event.extended_links + tag: rename_extended_links + ignore_missing: true + - rename: + field: json.extendedproperties + target_field: microsoft_defender_cloud.event.extended_properties + tag: rename_extended_properties + ignore_missing: true + - rename: + field: json.id + target_field: microsoft_defender_cloud.event.id + tag: rename_id + ignore_missing: true + - rename: + field: json.intent + target_field: microsoft_defender_cloud.event.intent + tag: rename_intent + ignore_missing: true + - convert: + field: json.isincident + target_field: microsoft_defender_cloud.event.is_incident + type: boolean + tag: convert_is_incident_to_boolean + ignore_missing: true + if: ctx.json?.isincident != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.kind + target_field: microsoft_defender_cloud.event.kind + tag: rename_kind + ignore_missing: true + - rename: + field: json.location + target_field: microsoft_defender_cloud.event.location + tag: rename_location + ignore_missing: true + - rename: + field: json.name + target_field: microsoft_defender_cloud.event.name + tag: rename_name + ignore_missing: true + - date: + field: json.processingendtime + target_field: microsoft_defender_cloud.event.processing_end_time + tag: date_processing_end_time + formats: + - ISO8601 + if: ctx.json?.processingendtime != null && ctx.json.processingendtime != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.productname + target_field: microsoft_defender_cloud.event.product.name + tag: rename_product_name + ignore_missing: true + - set: + field: event.provider + copy_from: microsoft_defender_cloud.event.product.name + tag: set_event_provider + ignore_empty_value: true + - rename: + field: json.properties.$type + target_field: microsoft_defender_cloud.event.properties.type + tag: rename_properties_type + ignore_missing: true + - rename: + field: json.properties.assessmentdetailslink + target_field: microsoft_defender_cloud.event.properties.assessment.details_link + tag: rename_properties_assessment_details_link + ignore_missing: true + - rename: + field: json.properties.assessmenttype + target_field: microsoft_defender_cloud.event.properties.assessment.type + tag: rename_properties.assessment_type + ignore_missing: true + - rename: + field: json.properties.category + target_field: microsoft_defender_cloud.event.properties.category + tag: rename_properties_category + ignore_missing: true + - rename: + field: json.properties.definition.id + target_field: microsoft_defender_cloud.event.properties.definition.id + tag: rename_properties_definition_id + ignore_missing: true + - rename: + field: json.properties.definition.name + target_field: microsoft_defender_cloud.event.properties.definition.name + tag: rename_properties_definition_name + ignore_missing: true + - convert: + field: json.properties.definition.properties.assessmentdefinitions + target_field: microsoft_defender_cloud.event.properties.assessment.definitions + type: string + tag: convert_properties_definition_properties_assessment_definitions_to_string + ignore_missing: true + if: ctx.json?.properties?.definition?.properties?.assessmentdefinitions != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.definition.properties.displayname + target_field: microsoft_defender_cloud.event.properties.definition.display_name + tag: rename_properties_definition_properties_display_name + ignore_missing: true + - convert: + field: json.properties.definition.properties.maxscore + target_field: microsoft_defender_cloud.event.properties.definition.max_score + type: long + tag: convert_properties_definition_properties_max_score_to_long + ignore_missing: true + if: ctx.json?.properties?.definition?.properties?.maxscore != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.definition.properties.source.sourcetype + target_field: microsoft_defender_cloud.event.properties.definition.source_type + tag: rename_properties_definition_properties_source_source_type + ignore_missing: true + - rename: + field: json.properties.definition.type + target_field: microsoft_defender_cloud.event.properties.definition.type + tag: rename_properties_definition_type + ignore_missing: true + - rename: + field: json.properties.description + target_field: microsoft_defender_cloud.event.properties.description + tag: rename_properties_description + ignore_missing: true + - rename: + field: json.properties.displayname + target_field: microsoft_defender_cloud.event.properties.display_name + tag: rename_properties_display_name + ignore_missing: true + - rename: + field: json.properties.environment + target_field: microsoft_defender_cloud.event.properties.environment + tag: rename_properties_environment + ignore_missing: true + - convert: + field: json.properties.failedresources + target_field: microsoft_defender_cloud.event.properties.failed_resources + type: long + tag: convert_properties_failed_resources_to_long + ignore_missing: true + if: ctx.json?.properties?.failedresources != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.healthyresourcecount + target_field: microsoft_defender_cloud.event.properties.healthy_resource_count + type: long + tag: convert_properties_healthy_resource_count_to_long + ignore_missing: true + if: ctx.json?.properties?.healthyresourcecount != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.id + target_field: microsoft_defender_cloud.event.properties.id + tag: rename_properties_id + ignore_missing: true + - rename: + field: json.properties.impact + target_field: microsoft_defender_cloud.event.properties.impact + tag: rename_properties_impact + ignore_missing: true + - rename: + field: json.properties.links.azureportal + target_field: microsoft_defender_cloud.event.properties.links.azure_portal + tag: rename_properties_links_azure_portal + ignore_missing: true + - rename: + field: json.properties.metadata.assessmenttype + target_field: microsoft_defender_cloud.event.properties.metadata.assessment_type + tag: rename_properties_metadata_assessment_type + ignore_missing: true + - rename: + field: json.properties.metadata.categories + target_field: microsoft_defender_cloud.event.properties.metadata.categories + tag: rename_properties_metadata_categories + ignore_missing: true + - rename: + field: json.properties.metadata.description + target_field: microsoft_defender_cloud.event.properties.metadata.description + tag: rename_properties_metadata_description + ignore_missing: true + - rename: + field: json.properties.metadata.displayname + target_field: microsoft_defender_cloud.event.properties.metadata.display_name + tag: rename_properties_metadata_display_name + ignore_missing: true + - rename: + field: json.properties.metadata.implementationeffort + target_field: microsoft_defender_cloud.event.properties.metadata.implementation_effort + tag: rename_properties_metadata_implementation_effort + ignore_missing: true + - rename: + field: json.properties.metadata.policydefinitionid + target_field: microsoft_defender_cloud.event.properties.metadata.policy_definition_id + tag: rename_properties_metadata_policy_definition_id + ignore_missing: true + - convert: + field: json.properties.metadata.preview + target_field: microsoft_defender_cloud.event.properties.metadata.preview + type: boolean + tag: convert_properties_metadata_preview_to_boolean + ignore_missing: true + if: ctx.json?.properties?.metadata?.preview != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.metadata.remediationdescription + target_field: microsoft_defender_cloud.event.properties.metadata.remediation_description + tag: rename_properties_metadata_remediation_description + ignore_missing: true + - rename: + field: json.properties.metadata.severity + target_field: microsoft_defender_cloud.event.properties.metadata.severity + tag: rename_properties_metadata_severity + ignore_missing: true + - rename: + field: json.properties.metadata.threats + target_field: microsoft_defender_cloud.event.properties.metadata.threats + tag: rename_properties_metadata_threats + ignore_missing: true + - rename: + field: json.properties.metadata.userimpact + target_field: microsoft_defender_cloud.event.properties.metadata.user_impact + tag: rename_properties_metadata_user_impact + ignore_missing: true + - convert: + field: json.properties.notapplicableresourcecount + target_field: microsoft_defender_cloud.event.properties.not_applicable_resource_count + type: long + tag: convert_properties_not_applicable_resource_count_to_long + ignore_missing: true + if: ctx.json?.properties?.notapplicableresourcecount != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.passedresources + target_field: microsoft_defender_cloud.event.properties.passed_resources + type: long + tag: convert_properties_passed_resources_to_long + ignore_missing: true + if: ctx.json?.properties?.passedresources != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.remediation + target_field: microsoft_defender_cloud.event.properties.remediation + tag: rename_properties_remediation + ignore_missing: true + - rename: + field: json.properties.resourcedetails.$type + target_field: microsoft_defender_cloud.event.properties.resource_details.type + tag: rename_properties_resourcedetails_type + ignore_missing: true + - rename: + field: json.properties.resourcedetails.id + target_field: microsoft_defender_cloud.event.properties.resource_details.id + tag: rename_properties_resource_details_id + ignore_missing: true + - rename: + field: json.properties.resourcedetails.machinename + target_field: microsoft_defender_cloud.event.properties.resource_details.machine_name + tag: rename_properties_resource_details_machine_name + ignore_missing: true + - rename: + field: json.properties.resourcedetails.source + target_field: microsoft_defender_cloud.event.properties.resource_details.source + tag: rename_properties_resource_details_source + ignore_missing: true + - rename: + field: json.properties.resourcedetails.sourcecomputerid + target_field: microsoft_defender_cloud.event.properties.resource_details.source_computer_id + tag: rename_properties_resource_details_source_computer_id + ignore_missing: true + - rename: + field: json.properties.resourcedetails.vmuuid + target_field: microsoft_defender_cloud.event.properties.resource_details.vm_uuid + tag: rename_properties_resource_details_vm_uuid + ignore_missing: true + - rename: + field: json.properties.resourcedetails.workspaceid + target_field: microsoft_defender_cloud.event.properties.resource_details.workspace_id + tag: rename_properties_resource_details_workspace_id + ignore_missing: true + - convert: + field: json.properties.score.current + target_field: microsoft_defender_cloud.event.properties.score.current + type: double + tag: convert_properties_score_current_to_double + ignore_missing: true + if: ctx.json?.properties?.score?.current != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.score.max + target_field: microsoft_defender_cloud.event.properties.score.max + type: long + tag: convert_properties_score_max_to_long + ignore_missing: true + if: ctx.json?.properties?.score?.max != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.score.percentage + target_field: microsoft_defender_cloud.event.properties.score.percentage + type: double + tag: convert_properties_score_percentage_to_double + ignore_missing: true + if: ctx.json?.properties?.score?.percentage != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.skippedresources + target_field: microsoft_defender_cloud.event.properties.skipped_resources + type: long + tag: convert_properties_skipped_resources_to_long + ignore_missing: true + if: ctx.json?.properties?.skippedresources != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.state + target_field: microsoft_defender_cloud.event.properties.state + tag: rename_properties_state + ignore_missing: true + - rename: + field: json.properties.status.$type + target_field: microsoft_defender_cloud.event.properties.status.type + tag: rename_properties_status_type + ignore_missing: true + - rename: + field: json.properties.additionaldata + target_field: microsoft_defender_cloud.event.properties.additional_data + tag: rename_properties_additional_data + ignore_missing: true + - rename: + field: json.properties.status.cause + target_field: microsoft_defender_cloud.event.properties.status.cause + tag: rename_properties_status_cause + ignore_missing: true + - rename: + field: json.properties.status.code + target_field: microsoft_defender_cloud.event.properties.status.code + tag: rename_properties_status_code + ignore_missing: true + - rename: + field: json.properties.status.description + target_field: microsoft_defender_cloud.event.properties.status.description + tag: rename_properties_status_description + ignore_missing: true + - date: + field: json.properties.status.firstevaluationdate + target_field: microsoft_defender_cloud.event.properties.status.first_evaluation_date + tag: date_properties_status_first_evaluation_date + formats: + - ISO8601 + if: ctx.json?.properties?.status?.firstevaluationdate != null && ctx.json.properties.status.firstevaluationdate != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.properties.status.severity + target_field: microsoft_defender_cloud.event.properties.status.severity + tag: rename_properties_status_severity + ignore_missing: true + - date: + field: json.properties.status.statuschangedate + target_field: microsoft_defender_cloud.event.properties.status.status_change_date + tag: date_properties_status_status_change_date + formats: + - ISO8601 + if: ctx.json?.properties?.status?.statuschangedate != null && ctx.json.properties.status.statuschangedate != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.properties.timegenerated + target_field: microsoft_defender_cloud.event.properties.time_generated + tag: date_properties_time_generated + formats: + - ISO8601 + if: ctx.json?.properties?.timegenerated != null && ctx.json.properties.timegenerated != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.unhealthyresourcecount + target_field: microsoft_defender_cloud.event.properties.unhealthy_resource_count + type: long + tag: convert_properties_unhealthy_resource_count_to_long + ignore_missing: true + if: ctx.json?.properties?.unhealthyresourcecount != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.properties.weight + target_field: microsoft_defender_cloud.event.properties.weight + type: long + tag: convert_properties_weight_to_long + ignore_missing: true + if: ctx.json?.properties?.weight != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.provideralertstatus + target_field: microsoft_defender_cloud.event.provider_alert_status + tag: rename_provider_alert_status + ignore_missing: true + - rename: + field: json.remediationsteps + target_field: microsoft_defender_cloud.event.remediation_steps + tag: rename_remediation_steps + ignore_missing: true + - rename: + field: json.securityeventdataenrichment.$type + target_field: microsoft_defender_cloud.event.security_event_data_enrichment.type + tag: rename_security_event_data_enrichment_type + ignore_missing: true + - rename: + field: json.securityeventdataenrichment.action + target_field: microsoft_defender_cloud.event.security_event_data_enrichment.action + tag: rename_security_event_data_enrichment_action + ignore_missing: true + - rename: + field: json.securityeventdataenrichment.apiversion + target_field: microsoft_defender_cloud.event.security_event_data_enrichment.api_version + tag: rename_security_event_data_enrichment_api_version + ignore_missing: true + - rename: + field: json.securityeventdataenrichment.interval + target_field: microsoft_defender_cloud.event.security_event_data_enrichment.interval + tag: rename_security_event_data_enrichment_interval + ignore_missing: true + - convert: + field: json.securityeventdataenrichment.issnapshot + target_field: microsoft_defender_cloud.event.security_event_data_enrichment.is_snapshot + type: boolean + tag: convert_security_event_data_enrichment_is_snapshot_to_boolean + ignore_missing: true + if: ctx.json?.securityeventdataenrichment?.issnapshot != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.severity + target_field: microsoft_defender_cloud.event.severity + tag: rename_severity + ignore_missing: true + - date: + field: json.starttimeutc + target_field: microsoft_defender_cloud.event.start_time_utc + tag: date_start_time_utc' + formats: + - ISO8601 + if: ctx.json?.starttimeutc != null && ctx.json.starttimeutc != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.start + copy_from: microsoft_defender_cloud.event.start_time_utc + tag: set_event_start + ignore_empty_value: true + - rename: + field: json.status + target_field: microsoft_defender_cloud.event.status + tag: rename_status + ignore_missing: true + - rename: + field: json.subassessmenteventdataenrichment.$type + target_field: microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.type + tag: rename_sub_assessment_event_data_enrichment_type + ignore_missing: true + - rename: + field: json.subassessmenteventdataenrichment.action + target_field: microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.action + tag: rename_sub_assessment_event_data_enrichment_action + ignore_missing: true + - rename: + field: json.subassessmenteventdataenrichment.apiversion + target_field: microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.api_version + tag: rename_sub_assessment_event_data_enrichment_api_version + ignore_missing: true + - convert: + field: json.subassessmenteventdataenrichment.issnapshot + target_field: microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.is_snapshot + type: boolean + tag: convert_sub_assessment_event_data_enrichmen_is_snapshot_to_boolean + ignore_missing: true + if: ctx.json?.subassessmenteventdataenrichment?.issnapshot != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.systemalertid + target_field: microsoft_defender_cloud.event.system.alert_id + tag: rename_system_alert_id + ignore_missing: true + - rename: + field: json.tags + target_field: microsoft_defender_cloud.event.tags + tag: rename_tags + ignore_missing: true + - rename: + field: json.tenantid + target_field: microsoft_defender_cloud.event.tenant_id + tag: rename_tenant_id + ignore_missing: true + - date: + field: json.timegenerated + target_field: microsoft_defender_cloud.event.time_generated + tag: date_time_generated_custom + formats: + - ISO8601 + if: ctx.json?.timegenerated != null && ctx.json.timegenerated != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.timegenerated + tag: date_time_generated + formats: + - ISO8601 + if: ctx.json?.timegenerated != null && ctx.json.timegenerated != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.type + target_field: microsoft_defender_cloud.event.type + tag: rename_type + ignore_missing: true + - rename: + field: json.vendorname + target_field: microsoft_defender_cloud.event.vendor_name + tag: rename_vendor_name + ignore_missing: true + - set: + field: observer.vendor + copy_from: microsoft_defender_cloud.event.vendor_name + tag: set_observer_vendor + ignore_empty_value: true + - rename: + field: json.workspaceid + target_field: microsoft_defender_cloud.event.workspace.id + tag: rename_workspace_id + ignore_missing: true + - rename: + field: json.workspaceresourcegroup + target_field: microsoft_defender_cloud.event.workspace.resource_group + tag: rename_workspace_resource_group + ignore_missing: true + - rename: + field: json.workspacesubscriptionid + target_field: microsoft_defender_cloud.event.workspace.subscription_id + tag: rename_workspace_subscription_id + ignore_missing: true + - foreach: + field: microsoft_defender_cloud.event.entities + if: ctx.microsoft_defender_cloud?.event?.entities instanceof List && (ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields'))) + ignore_failure: true + processor: + remove: + field: + - _ingest._value.location.cloud_provider + - _ingest._value.container_id + - _ingest._value.domain_name + - _ingest._value.location.city + - _ingest._value.location.country_code + - _ingest._value.location.country_name + - _ingest._value.host_name + - _ingest._value.os_family + - _ingest._value.protocol + - _ingest._value.process_id + ignore_missing: true + - remove: + field: json + tag: remove_json + ignore_missing: true + - remove: + field: + - microsoft_defender_cloud.event.uri + - microsoft_defender_cloud.event.end_time_utc + - microsoft_defender_cloud.event.product.name + - microsoft_defender_cloud.event.start_time_utc + - microsoft_defender_cloud.event.time_generated + - microsoft_defender_cloud.event.vendor_name + tag: remove_duplicate_custom_fields + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + - remove: + field: event.original + tag: remove_event_original + ignore_missing: true + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + - script: + lang: painless + description: Drops null/empty values recursively. + tag: painless_remove_null + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + - set: + field: event.kind + value: pipeline_error + tag: set_pipeline_error_into_event_kind + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/microsoft_defender_cloud/data_stream/event/fields/base-fields.yml b/packages/microsoft_defender_cloud/data_stream/event/fields/base-fields.yml new file mode 100644 index 00000000000..004de5cfade --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: microsoft_defender_cloud +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: microsoft_defender_cloud.event +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/microsoft_defender_cloud/data_stream/event/fields/beats.yml b/packages/microsoft_defender_cloud/data_stream/event/fields/beats.yml new file mode 100644 index 00000000000..2d5ae254634 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/microsoft_defender_cloud/data_stream/event/fields/fields.yml b/packages/microsoft_defender_cloud/data_stream/event/fields/fields.yml new file mode 100644 index 00000000000..41f47ef3247 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/fields/fields.yml @@ -0,0 +1,565 @@ +- name: microsoft_defender_cloud + type: group + fields: + - name: event + type: group + fields: + - name: agent_id + type: keyword + - name: alert_type + type: keyword + description: Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType). + - name: assessment_event_data_enrichment + type: group + fields: + - name: action + type: keyword + - name: api_version + type: keyword + - name: is_snapshot + type: boolean + - name: azure_resource_id + type: keyword + - name: compromised_entity + type: keyword + description: The display name of the resource most related to this alert. + - name: confidence + type: group + fields: + - name: level + type: keyword + - name: reasons + type: keyword + - name: score + type: keyword + - name: correlation_key + type: keyword + description: Key for corelating related alerts. Alerts with the same correlation key considered to be related. + - name: description + type: keyword + description: Description of the suspicious activity that was detected. + - name: display_name + type: keyword + description: The display name of the alert. + - name: end_time_utc + type: date + description: The UTC time of the last event or activity included in the alert in ISO8601 format. + - name: entities + type: group + description: A list of entities related to the alert. + fields: + - name: aad_tenant_id + type: keyword + - name: aad_user_id + type: keyword + - name: account + type: group + fields: + - name: ref + type: keyword + - name: address + type: ip + - name: algorithm + type: keyword + - name: amazon_resource_id + type: keyword + - name: asset + type: boolean + - name: azure_id + type: keyword + - name: blob_container + type: group + fields: + - name: ref + type: keyword + - name: category + type: keyword + - name: cloud_resource + type: group + fields: + - name: ref + type: keyword + - name: cluster + type: group + fields: + - name: ref + type: keyword + - name: command_line + type: keyword + - name: container_id + type: keyword + - name: creation_time_utc + type: date + - name: directory + type: keyword + - name: dns_domain + type: keyword + - name: domain_name + type: keyword + - name: elevation_token + type: keyword + - name: end_time_utc + type: date + - name: etag + type: keyword + - name: file_hashes + type: group + fields: + - name: ref + type: keyword + - name: files + type: group + fields: + - name: ref + type: keyword + - name: host + type: group + fields: + - name: ref + type: keyword + - name: host_ip_address + type: group + fields: + - name: ref + type: keyword + - name: host_name + type: keyword + - name: id + type: keyword + - name: image + type: group + fields: + - name: ref + type: keyword + - name: image_file + type: group + fields: + - name: ref + type: keyword + - name: image_id + type: keyword + - name: ip_addresses + type: group + fields: + - name: address + type: ip + - name: asset + type: boolean + - name: id + type: keyword + - name: location + type: group + fields: + - name: asn + type: long + - name: city + type: keyword + - name: country_code + type: keyword + - name: country_name + type: keyword + - name: latitude + type: double + - name: longitude + type: double + - name: state + type: keyword + - name: type + type: keyword + - name: is_domain_joined + type: boolean + - name: is_valid + type: boolean + - name: location + type: group + fields: + - name: asn + type: long + - name: carrier + type: keyword + - name: city + type: keyword + - name: cloud_provider + type: keyword + - name: country_code + type: keyword + - name: country_name + type: keyword + - name: latitude + type: double + - name: longitude + type: double + - name: organization + type: keyword + - name: organization_type + type: keyword + - name: state + type: keyword + - name: system_service + type: keyword + - name: location_type + type: keyword + - name: location_value + type: keyword + - name: logon_id + type: keyword + - name: name + type: keyword + - name: namespace + type: group + fields: + - name: ref + type: keyword + - name: net_bios_name + type: keyword + - name: nt_domain + type: keyword + - name: object_guid + type: keyword + - name: oms_agent_id + type: keyword + - name: os_family + type: keyword + - name: os_version + type: keyword + - name: parent_process + type: group + fields: + - name: ref + type: keyword + - name: pod + type: group + fields: + - name: ref + type: keyword + - name: process_id + type: keyword + - name: project_id + type: keyword + - name: protocol + type: keyword + - name: related_azure_resource_ids + type: keyword + - name: resource_id + type: keyword + - name: resource_name + type: keyword + - name: resource_type + type: keyword + - name: session_id + type: keyword + - name: sid + type: keyword + - name: source_address + type: group + fields: + - name: ref + type: keyword + - name: start_time_utc + type: date + - name: storage_resource + type: group + fields: + - name: ref + type: keyword + - name: threat_intelligence + type: group + fields: + - name: confidence + type: double + - name: description + type: keyword + - name: name + type: keyword + - name: provider_name + type: keyword + - name: report_link + type: keyword + - name: type + type: keyword + - name: type + type: keyword + - name: upn_suffix + type: keyword + - name: url + type: keyword + - name: value + type: keyword + - name: event_type + type: keyword + - name: extended_links + type: group + fields: + - name: category + type: keyword + description: Links related to the alert + - name: href + type: keyword + - name: label + type: keyword + - name: type + type: keyword + - name: extended_properties + type: flattened + description: Custom properties for the alert. + - name: id + type: keyword + description: Resource Id. + - name: intent + type: keyword + description: The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents. + - name: is_incident + type: boolean + description: This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert. + - name: kind + type: keyword + - name: location + type: keyword + - name: name + type: keyword + description: Resource name. + - name: processing_end_time + type: date + description: The UTC processing end time of the alert in ISO8601 format. + - name: product + type: group + fields: + - name: name + type: keyword + description: The name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on). + - name: properties + type: group + fields: + - name: additional_data + type: flattened + - name: assessment + type: group + fields: + - name: definitions + type: keyword + - name: details_link + type: keyword + - name: type + type: keyword + - name: category + type: keyword + - name: definition + type: group + fields: + - name: display_name + type: keyword + - name: id + type: keyword + - name: max_score + type: long + - name: name + type: keyword + - name: source_type + type: keyword + - name: type + type: keyword + - name: description + type: keyword + - name: display_name + type: keyword + - name: environment + type: keyword + - name: failed_resources + type: long + - name: healthy_resource_count + type: long + - name: id + type: keyword + - name: impact + type: keyword + - name: links + type: group + fields: + - name: azure_portal + type: keyword + - name: metadata + type: group + fields: + - name: assessment_type + type: keyword + - name: categories + type: keyword + - name: description + type: keyword + - name: display_name + type: keyword + - name: implementation_effort + type: keyword + - name: policy_definition_id + type: keyword + - name: preview + type: boolean + - name: remediation_description + type: keyword + - name: severity + type: keyword + - name: threats + type: keyword + - name: user_impact + type: keyword + - name: not_applicable_resource_count + type: long + - name: passed_resources + type: long + - name: remediation + type: keyword + - name: resource_details + type: group + fields: + - name: id + type: keyword + - name: machine_name + type: keyword + - name: source + type: keyword + - name: source_computer_id + type: keyword + - name: type + type: keyword + - name: vm_uuid + type: keyword + - name: workspace_id + type: keyword + - name: score + type: group + fields: + - name: current + type: double + - name: max + type: long + - name: percentage + type: double + - name: skipped_resources + type: long + - name: state + type: keyword + - name: status + type: group + fields: + - name: cause + type: keyword + - name: code + type: keyword + - name: description + type: keyword + - name: first_evaluation_date + type: date + - name: severity + type: keyword + - name: status_change_date + type: date + - name: type + type: keyword + - name: time_generated + type: date + - name: type + type: keyword + - name: unhealthy_resource_count + type: long + - name: weight + type: long + - name: provider_alert_status + type: keyword + - name: remediation_steps + type: keyword + description: Manual action items to take to remediate the alert. + - name: resource_identifiers + type: group + fields: + - name: aad_tenant_id + type: keyword + - name: agent_id + type: keyword + description: (optional) The LogAnalytics agent id reporting the event that this alert is based on. + - name: azure_id + type: keyword + description: ARM resource identifier for the cloud resource being alerted on + - name: azure_tenant_id + type: keyword + - name: id + type: keyword + description: The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert. + - name: type + type: keyword + description: There can be multiple identifiers of different type per alert, this field specify the identifier type. + - name: workspace_id + type: keyword + description: The LogAnalytics workspace id that stores this alert. + - name: workspace_resource_group + type: keyword + description: The azure resource group for the LogAnalytics workspace storing this alert + - name: workspace_subscription_id + type: keyword + description: The azure subscription id for the LogAnalytics workspace storing this alert. + - name: security_event_data_enrichment + type: group + fields: + - name: action + type: keyword + - name: api_version + type: keyword + - name: interval + type: keyword + - name: is_snapshot + type: boolean + - name: type + type: keyword + - name: severity + type: keyword + description: The risk level of the threat that was detected. + - name: start_time_utc + type: date + description: The UTC time of the first event or activity included in the alert in ISO8601 format. + - name: status + type: keyword + description: The life cycle status of the alert. + - name: sub_assessment_event + type: group + fields: + - name: data_enrichment + type: group + fields: + - name: action + type: keyword + - name: api_version + type: keyword + - name: is_snapshot + type: boolean + - name: type + type: keyword + - name: system + type: group + fields: + - name: alert_id + type: keyword + description: Unique identifier for the alert. + - name: tags + type: keyword + - name: tenant_id + type: keyword + - name: time_generated + type: date + description: The UTC time the alert was generated in ISO8601 format. + - name: type + type: keyword + description: Resource type. + - name: uri + type: keyword + description: A direct link to the alert page in Azure Portal. + - name: vendor_name + type: keyword + description: The name of the vendor that raises the alert. + - name: workspace + type: group + fields: + - name: id + type: keyword + - name: resource_group + type: keyword + - name: subscription_id + type: keyword diff --git a/packages/microsoft_defender_cloud/data_stream/event/manifest.yml b/packages/microsoft_defender_cloud/data_stream/event/manifest.yml new file mode 100644 index 00000000000..3bcc4ec4095 --- /dev/null +++ b/packages/microsoft_defender_cloud/data_stream/event/manifest.yml @@ -0,0 +1,98 @@ +title: Collect Event(Alert and Recommendation) logs from Microsoft Defender for Cloud. +type: logs +streams: + - input: azure-eventhub + title: Microsoft Defender for Cloud Event(Alert and Recommendation) + description: Collect Event(Alert and Recommendation) logs from Microsoft Defender for Cloud via Azure Event Hub. + template_path: azure-eventhub.yml.hbs + vars: + - name: eventhub + type: text + title: Azure Event Hub + multi: false + required: true + show_user: true + description: >- + Elastic recommends using one Azure Event Hub for each integration. Visit [Create an Azure Event Hub](https://docs.elastic.co/integrations/azure#create-an-event-hub) to learn more. Use Azure Event Hub names up to 30 characters long to avoid compatibility issues. + - name: consumer_group + type: text + title: Consumer Group + multi: false + required: true + show_user: true + default: $Default + description: >- + We recommend using a dedicated consumer group for the Azure Event Hub input. Reusing consumer groups among non-related consumers can cause unexpected behavior and possibly lost events. + - name: connection_string + type: password + title: Connection String + multi: false + required: true + show_user: true + description: >- + The connection string required to communicate with Azure Event Hubs. See [Get an Azure Event Hubs connection string](https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-get-connection-string) to learn more. + - name: storage_account + type: text + title: Storage Account + multi: false + required: true + show_user: true + description: >- + The name of the storage account where the consumer group's state/offsets will be stored and updated. + - name: storage_account_key + type: text + title: Storage Account Key + multi: false + required: true + show_user: true + description: >- + The storage account key will be used to authorise access to data in your storage account. + - name: storage_account_container + type: text + title: Storage Account Container + multi: false + required: false + show_user: false + description: >- + The storage account container where the integration stores the checkpoint data for the consumer group. It is an advanced option to use with extreme care. You must use a dedicated storage account container for each Azure log type. Do not reuse the same container name for more than one Azure log type. See [Container Names] (Naming and Referencing Containers, Blobs, and Metadata - Azure Storage) for details on naming rules from Microsoft. The integration generates a default container name if not specified. + - name: resource_manager_endpoint + type: text + title: Resource Manager Endpoint + multi: false + required: false + show_user: false + description: >- + By default, we are using the Azure public environment. To override this, users can provide a specific resource manager endpoint in order to use a different Azure environment. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - microsoft_defender_cloud-event + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserve a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve microsoft_defender_cloud.event fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/microsoft_defender_cloud/docs/README.md b/packages/microsoft_defender_cloud/docs/README.md new file mode 100644 index 00000000000..b676d49901c --- /dev/null +++ b/packages/microsoft_defender_cloud/docs/README.md @@ -0,0 +1,292 @@ +# Microsoft Defender for Cloud + +The [Microsoft Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction) integration allows you to monitor security alert events. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for analyzing the resources and services that users are protecting through Microsoft Defender. + +Use the Microsoft Defender for Cloud integration to collect and parse data from **Azure Event Hub** and then visualize that data in Kibana. + +## Data streams + +The Microsoft Defender for Cloud integration collects one type of data: event. + +**Event** allows users to preserve a record of security events that occurred on the subscription, which includes real-time events that affect the security of the user's environment. For further information connected to security alerts and type, Refer to the page [here](https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference). + +## Prerequisites + +To get started with Defender for Cloud, user must have a subscription to Microsoft Azure. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the **Azure Event Hub** and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.3.0**. + +## Setup + +### To collect data from Microsoft Azure Event Hub, follow the below steps: + +- Configure the Microsoft Defender for Cloud on Azure subscription. For more detail, refer to the link [here](https://learn.microsoft.com/en-us/azure/defender-for-cloud/get-started). + +### Enabling the integration in Elastic: + +1. In Kibana, go to Management > Integrations. +2. In the "Search for integrations" search bar, type Microsoft Defender for Cloud. +3. Click on the "Microsoft Defender for Cloud" integration from the search results. +4. Click on the Add Microsoft Defender for Cloud Integration button to add the integration. +5. While adding the integration, if you want to collect logs via **Azure Event Hub**, then you have to put the following details: + - eventhub + - consumer_group + - connection_string + - storage_account + - storage_account_key + - storage_account_container (optional) + - resource_manager_endpoint (optional) + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of Filebeat input. | keyword | +| log.offset | Log offset. | long | +| microsoft_defender_cloud.event.agent_id | | keyword | +| microsoft_defender_cloud.event.alert_type | Unique identifier for the detection logic (all alert instances from the same detection logic will have the same alertType). | keyword | +| microsoft_defender_cloud.event.assessment_event_data_enrichment.action | | keyword | +| microsoft_defender_cloud.event.assessment_event_data_enrichment.api_version | | keyword | +| microsoft_defender_cloud.event.assessment_event_data_enrichment.is_snapshot | | boolean | +| microsoft_defender_cloud.event.azure_resource_id | | keyword | +| microsoft_defender_cloud.event.compromised_entity | The display name of the resource most related to this alert. | keyword | +| microsoft_defender_cloud.event.confidence.level | | keyword | +| microsoft_defender_cloud.event.confidence.reasons | | keyword | +| microsoft_defender_cloud.event.confidence.score | | keyword | +| microsoft_defender_cloud.event.correlation_key | Key for corelating related alerts. Alerts with the same correlation key considered to be related. | keyword | +| microsoft_defender_cloud.event.description | Description of the suspicious activity that was detected. | keyword | +| microsoft_defender_cloud.event.display_name | The display name of the alert. | keyword | +| microsoft_defender_cloud.event.end_time_utc | The UTC time of the last event or activity included in the alert in ISO8601 format. | date | +| microsoft_defender_cloud.event.entities.aad_tenant_id | | keyword | +| microsoft_defender_cloud.event.entities.aad_user_id | | keyword | +| microsoft_defender_cloud.event.entities.account.ref | | keyword | +| microsoft_defender_cloud.event.entities.address | | ip | +| microsoft_defender_cloud.event.entities.algorithm | | keyword | +| microsoft_defender_cloud.event.entities.amazon_resource_id | | keyword | +| microsoft_defender_cloud.event.entities.asset | | boolean | +| microsoft_defender_cloud.event.entities.azure_id | | keyword | +| microsoft_defender_cloud.event.entities.blob_container.ref | | keyword | +| microsoft_defender_cloud.event.entities.category | | keyword | +| microsoft_defender_cloud.event.entities.cloud_resource.ref | | keyword | +| microsoft_defender_cloud.event.entities.cluster.ref | | keyword | +| microsoft_defender_cloud.event.entities.command_line | | keyword | +| microsoft_defender_cloud.event.entities.container_id | | keyword | +| microsoft_defender_cloud.event.entities.creation_time_utc | | date | +| microsoft_defender_cloud.event.entities.directory | | keyword | +| microsoft_defender_cloud.event.entities.dns_domain | | keyword | +| microsoft_defender_cloud.event.entities.domain_name | | keyword | +| microsoft_defender_cloud.event.entities.elevation_token | | keyword | +| microsoft_defender_cloud.event.entities.end_time_utc | | date | +| microsoft_defender_cloud.event.entities.etag | | keyword | +| microsoft_defender_cloud.event.entities.file_hashes.ref | | keyword | +| microsoft_defender_cloud.event.entities.files.ref | | keyword | +| microsoft_defender_cloud.event.entities.host.ref | | keyword | +| microsoft_defender_cloud.event.entities.host_ip_address.ref | | keyword | +| microsoft_defender_cloud.event.entities.host_name | | keyword | +| microsoft_defender_cloud.event.entities.id | | keyword | +| microsoft_defender_cloud.event.entities.image.ref | | keyword | +| microsoft_defender_cloud.event.entities.image_file.ref | | keyword | +| microsoft_defender_cloud.event.entities.image_id | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.address | | ip | +| microsoft_defender_cloud.event.entities.ip_addresses.asset | | boolean | +| microsoft_defender_cloud.event.entities.ip_addresses.id | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.location.asn | | long | +| microsoft_defender_cloud.event.entities.ip_addresses.location.city | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.location.country_code | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.location.country_name | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.location.latitude | | double | +| microsoft_defender_cloud.event.entities.ip_addresses.location.longitude | | double | +| microsoft_defender_cloud.event.entities.ip_addresses.location.state | | keyword | +| microsoft_defender_cloud.event.entities.ip_addresses.type | | keyword | +| microsoft_defender_cloud.event.entities.is_domain_joined | | boolean | +| microsoft_defender_cloud.event.entities.is_valid | | boolean | +| microsoft_defender_cloud.event.entities.location.asn | | long | +| microsoft_defender_cloud.event.entities.location.carrier | | keyword | +| microsoft_defender_cloud.event.entities.location.city | | keyword | +| microsoft_defender_cloud.event.entities.location.cloud_provider | | keyword | +| microsoft_defender_cloud.event.entities.location.country_code | | keyword | +| microsoft_defender_cloud.event.entities.location.country_name | | keyword | +| microsoft_defender_cloud.event.entities.location.latitude | | double | +| microsoft_defender_cloud.event.entities.location.longitude | | double | +| microsoft_defender_cloud.event.entities.location.organization | | keyword | +| microsoft_defender_cloud.event.entities.location.organization_type | | keyword | +| microsoft_defender_cloud.event.entities.location.state | | keyword | +| microsoft_defender_cloud.event.entities.location.system_service | | keyword | +| microsoft_defender_cloud.event.entities.location_type | | keyword | +| microsoft_defender_cloud.event.entities.location_value | | keyword | +| microsoft_defender_cloud.event.entities.logon_id | | keyword | +| microsoft_defender_cloud.event.entities.name | | keyword | +| microsoft_defender_cloud.event.entities.namespace.ref | | keyword | +| microsoft_defender_cloud.event.entities.net_bios_name | | keyword | +| microsoft_defender_cloud.event.entities.nt_domain | | keyword | +| microsoft_defender_cloud.event.entities.object_guid | | keyword | +| microsoft_defender_cloud.event.entities.oms_agent_id | | keyword | +| microsoft_defender_cloud.event.entities.os_family | | keyword | +| microsoft_defender_cloud.event.entities.os_version | | keyword | +| microsoft_defender_cloud.event.entities.parent_process.ref | | keyword | +| microsoft_defender_cloud.event.entities.pod.ref | | keyword | +| microsoft_defender_cloud.event.entities.process_id | | keyword | +| microsoft_defender_cloud.event.entities.project_id | | keyword | +| microsoft_defender_cloud.event.entities.protocol | | keyword | +| microsoft_defender_cloud.event.entities.related_azure_resource_ids | | keyword | +| microsoft_defender_cloud.event.entities.resource_id | | keyword | +| microsoft_defender_cloud.event.entities.resource_name | | keyword | +| microsoft_defender_cloud.event.entities.resource_type | | keyword | +| microsoft_defender_cloud.event.entities.session_id | | keyword | +| microsoft_defender_cloud.event.entities.sid | | keyword | +| microsoft_defender_cloud.event.entities.source_address.ref | | keyword | +| microsoft_defender_cloud.event.entities.start_time_utc | | date | +| microsoft_defender_cloud.event.entities.storage_resource.ref | | keyword | +| microsoft_defender_cloud.event.entities.threat_intelligence.confidence | | double | +| microsoft_defender_cloud.event.entities.threat_intelligence.description | | keyword | +| microsoft_defender_cloud.event.entities.threat_intelligence.name | | keyword | +| microsoft_defender_cloud.event.entities.threat_intelligence.provider_name | | keyword | +| microsoft_defender_cloud.event.entities.threat_intelligence.report_link | | keyword | +| microsoft_defender_cloud.event.entities.threat_intelligence.type | | keyword | +| microsoft_defender_cloud.event.entities.type | | keyword | +| microsoft_defender_cloud.event.entities.upn_suffix | | keyword | +| microsoft_defender_cloud.event.entities.url | | keyword | +| microsoft_defender_cloud.event.entities.value | | keyword | +| microsoft_defender_cloud.event.event_type | | keyword | +| microsoft_defender_cloud.event.extended_links.category | Links related to the alert | keyword | +| microsoft_defender_cloud.event.extended_links.href | | keyword | +| microsoft_defender_cloud.event.extended_links.label | | keyword | +| microsoft_defender_cloud.event.extended_links.type | | keyword | +| microsoft_defender_cloud.event.extended_properties | Custom properties for the alert. | flattened | +| microsoft_defender_cloud.event.id | Resource Id. | keyword | +| microsoft_defender_cloud.event.intent | The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents. | keyword | +| microsoft_defender_cloud.event.is_incident | This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert. | boolean | +| microsoft_defender_cloud.event.kind | | keyword | +| microsoft_defender_cloud.event.location | | keyword | +| microsoft_defender_cloud.event.name | Resource name. | keyword | +| microsoft_defender_cloud.event.processing_end_time | The UTC processing end time of the alert in ISO8601 format. | date | +| microsoft_defender_cloud.event.product.name | The name of the product which published this alert (Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Microsoft Defender for Office, Microsoft Defender for Cloud Apps, and so on). | keyword | +| microsoft_defender_cloud.event.properties.additional_data | | flattened | +| microsoft_defender_cloud.event.properties.assessment.definitions | | keyword | +| microsoft_defender_cloud.event.properties.assessment.details_link | | keyword | +| microsoft_defender_cloud.event.properties.assessment.type | | keyword | +| microsoft_defender_cloud.event.properties.category | | keyword | +| microsoft_defender_cloud.event.properties.definition.display_name | | keyword | +| microsoft_defender_cloud.event.properties.definition.id | | keyword | +| microsoft_defender_cloud.event.properties.definition.max_score | | long | +| microsoft_defender_cloud.event.properties.definition.name | | keyword | +| microsoft_defender_cloud.event.properties.definition.source_type | | keyword | +| microsoft_defender_cloud.event.properties.definition.type | | keyword | +| microsoft_defender_cloud.event.properties.description | | keyword | +| microsoft_defender_cloud.event.properties.display_name | | keyword | +| microsoft_defender_cloud.event.properties.environment | | keyword | +| microsoft_defender_cloud.event.properties.failed_resources | | long | +| microsoft_defender_cloud.event.properties.healthy_resource_count | | long | +| microsoft_defender_cloud.event.properties.id | | keyword | +| microsoft_defender_cloud.event.properties.impact | | keyword | +| microsoft_defender_cloud.event.properties.links.azure_portal | | keyword | +| microsoft_defender_cloud.event.properties.metadata.assessment_type | | keyword | +| microsoft_defender_cloud.event.properties.metadata.categories | | keyword | +| microsoft_defender_cloud.event.properties.metadata.description | | keyword | +| microsoft_defender_cloud.event.properties.metadata.display_name | | keyword | +| microsoft_defender_cloud.event.properties.metadata.implementation_effort | | keyword | +| microsoft_defender_cloud.event.properties.metadata.policy_definition_id | | keyword | +| microsoft_defender_cloud.event.properties.metadata.preview | | boolean | +| microsoft_defender_cloud.event.properties.metadata.remediation_description | | keyword | +| microsoft_defender_cloud.event.properties.metadata.severity | | keyword | +| microsoft_defender_cloud.event.properties.metadata.threats | | keyword | +| microsoft_defender_cloud.event.properties.metadata.user_impact | | keyword | +| microsoft_defender_cloud.event.properties.not_applicable_resource_count | | long | +| microsoft_defender_cloud.event.properties.passed_resources | | long | +| microsoft_defender_cloud.event.properties.remediation | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.id | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.machine_name | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.source | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.source_computer_id | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.type | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.vm_uuid | | keyword | +| microsoft_defender_cloud.event.properties.resource_details.workspace_id | | keyword | +| microsoft_defender_cloud.event.properties.score.current | | double | +| microsoft_defender_cloud.event.properties.score.max | | long | +| microsoft_defender_cloud.event.properties.score.percentage | | double | +| microsoft_defender_cloud.event.properties.skipped_resources | | long | +| microsoft_defender_cloud.event.properties.state | | keyword | +| microsoft_defender_cloud.event.properties.status.cause | | keyword | +| microsoft_defender_cloud.event.properties.status.code | | keyword | +| microsoft_defender_cloud.event.properties.status.description | | keyword | +| microsoft_defender_cloud.event.properties.status.first_evaluation_date | | date | +| microsoft_defender_cloud.event.properties.status.severity | | keyword | +| microsoft_defender_cloud.event.properties.status.status_change_date | | date | +| microsoft_defender_cloud.event.properties.status.type | | keyword | +| microsoft_defender_cloud.event.properties.time_generated | | date | +| microsoft_defender_cloud.event.properties.type | | keyword | +| microsoft_defender_cloud.event.properties.unhealthy_resource_count | | long | +| microsoft_defender_cloud.event.properties.weight | | long | +| microsoft_defender_cloud.event.provider_alert_status | | keyword | +| microsoft_defender_cloud.event.remediation_steps | Manual action items to take to remediate the alert. | keyword | +| microsoft_defender_cloud.event.resource_identifiers.aad_tenant_id | | keyword | +| microsoft_defender_cloud.event.resource_identifiers.agent_id | (optional) The LogAnalytics agent id reporting the event that this alert is based on. | keyword | +| microsoft_defender_cloud.event.resource_identifiers.azure_id | ARM resource identifier for the cloud resource being alerted on | keyword | +| microsoft_defender_cloud.event.resource_identifiers.azure_tenant_id | | keyword | +| microsoft_defender_cloud.event.resource_identifiers.id | The resource identifiers that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert. | keyword | +| microsoft_defender_cloud.event.resource_identifiers.type | There can be multiple identifiers of different type per alert, this field specify the identifier type. | keyword | +| microsoft_defender_cloud.event.resource_identifiers.workspace_id | The LogAnalytics workspace id that stores this alert. | keyword | +| microsoft_defender_cloud.event.resource_identifiers.workspace_resource_group | The azure resource group for the LogAnalytics workspace storing this alert | keyword | +| microsoft_defender_cloud.event.resource_identifiers.workspace_subscription_id | The azure subscription id for the LogAnalytics workspace storing this alert. | keyword | +| microsoft_defender_cloud.event.security_event_data_enrichment.action | | keyword | +| microsoft_defender_cloud.event.security_event_data_enrichment.api_version | | keyword | +| microsoft_defender_cloud.event.security_event_data_enrichment.interval | | keyword | +| microsoft_defender_cloud.event.security_event_data_enrichment.is_snapshot | | boolean | +| microsoft_defender_cloud.event.security_event_data_enrichment.type | | keyword | +| microsoft_defender_cloud.event.severity | The risk level of the threat that was detected. | keyword | +| microsoft_defender_cloud.event.start_time_utc | The UTC time of the first event or activity included in the alert in ISO8601 format. | date | +| microsoft_defender_cloud.event.status | The life cycle status of the alert. | keyword | +| microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.action | | keyword | +| microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.api_version | | keyword | +| microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.is_snapshot | | boolean | +| microsoft_defender_cloud.event.sub_assessment_event.data_enrichment.type | | keyword | +| microsoft_defender_cloud.event.system.alert_id | Unique identifier for the alert. | keyword | +| microsoft_defender_cloud.event.tags | | keyword | +| microsoft_defender_cloud.event.tenant_id | | keyword | +| microsoft_defender_cloud.event.time_generated | The UTC time the alert was generated in ISO8601 format. | date | +| microsoft_defender_cloud.event.type | Resource type. | keyword | +| microsoft_defender_cloud.event.uri | A direct link to the alert page in Azure Portal. | keyword | +| microsoft_defender_cloud.event.vendor_name | The name of the vendor that raises the alert. | keyword | +| microsoft_defender_cloud.event.workspace.id | | keyword | +| microsoft_defender_cloud.event.workspace.resource_group | | keyword | +| microsoft_defender_cloud.event.workspace.subscription_id | | keyword | +| tags | User defined tags. | keyword | + diff --git a/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-dashboard-event.png b/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-dashboard-event.png new file mode 100644 index 00000000000..10d4a13eb6f Binary files /dev/null and b/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-dashboard-event.png differ diff --git a/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-logo.svg b/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-logo.svg new file mode 100644 index 00000000000..5334aa7ca68 --- /dev/null +++ b/packages/microsoft_defender_cloud/img/microsoft-defender-cloud-logo.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/packages/microsoft_defender_cloud/kibana/dashboard/microsoft_defender_cloud-97eaf040-0516-11ee-b4db-89b3a5f6df7f.json b/packages/microsoft_defender_cloud/kibana/dashboard/microsoft_defender_cloud-97eaf040-0516-11ee-b4db-89b3a5f6df7f.json new file mode 100644 index 00000000000..47477980c0f --- /dev/null +++ b/packages/microsoft_defender_cloud/kibana/dashboard/microsoft_defender_cloud-97eaf040-0516-11ee-b4db-89b3a5f6df7f.json @@ -0,0 +1,2005 @@ +{ + "attributes": { + "description": "Overview of Microsoft Defender Cloud Events.", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"microsoft_defender_cloud.event\" " + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "acbbe59f-11b9-40ba-90ec-0f7556565d09": { + "columnOrder": [ + "7adeb506-87dc-4b89-82ce-0320f452671f" + ], + "columns": { + "7adeb506-87dc-4b89-82ce-0320f452671f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "microsoft_defender_cloud.event.properties.passed_resources: *" + }, + "isBucketed": false, + "label": "Passed Resources", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "microsoft_defender_cloud.event.properties.passed_resources" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "7adeb506-87dc-4b89-82ce-0320f452671f", + "colorMode": "None", + "layerId": "acbbe59f-11b9-40ba-90ec-0f7556565d09", + "layerType": "data", + "textAlign": "center" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "8bd11cf0-efa0-4296-b8cf-03fe8fdce840", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "8bd11cf0-efa0-4296-b8cf-03fe8fdce840", + "title": "Passed Resources [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "acbbe59f-11b9-40ba-90ec-0f7556565d09": { + "columnOrder": [ + "7adeb506-87dc-4b89-82ce-0320f452671f" + ], + "columns": { + "7adeb506-87dc-4b89-82ce-0320f452671f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "microsoft_defender_cloud.event.properties.failed_resources: *" + }, + "isBucketed": false, + "label": "Failed Resources", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "microsoft_defender_cloud.event.properties.failed_resources" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "7adeb506-87dc-4b89-82ce-0320f452671f", + "layerId": "acbbe59f-11b9-40ba-90ec-0f7556565d09", + "layerType": "data", + "textAlign": "center" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "8dff8fbb-f085-483c-a22c-4e1aec4bdf29", + "w": 8, + "x": 8, + "y": 0 + }, + "panelIndex": "8dff8fbb-f085-483c-a22c-4e1aec4bdf29", + "title": "Failed Resources [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "acbbe59f-11b9-40ba-90ec-0f7556565d09": { + "columnOrder": [ + "7adeb506-87dc-4b89-82ce-0320f452671f" + ], + "columns": { + "7adeb506-87dc-4b89-82ce-0320f452671f": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "microsoft_defender_cloud.event.properties.skipped_resources: *" + }, + "isBucketed": false, + "label": "Skipped Resources", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "microsoft_defender_cloud.event.properties.skipped_resources" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "7adeb506-87dc-4b89-82ce-0320f452671f", + "layerId": "acbbe59f-11b9-40ba-90ec-0f7556565d09", + "layerType": "data", + "textAlign": "center" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "5b67d941-caa4-4016-add5-99976279202d", + "w": 8, + "x": 16, + "y": 0 + }, + "panelIndex": "5b67d941-caa4-4016-add5-99976279202d", + "title": "Skipped Resources [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "767980ff-c7da-4dd3-b12a-b64c62dad0ef": { + "columnOrder": [ + "1a3593c9-64c3-4861-bbf5-2feb708ce992" + ], + "columns": { + "1a3593c9-64c3-4861-bbf5-2feb708ce992": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "microsoft_defender_cloud.event.properties.healthy_resource_count: *" + }, + "isBucketed": false, + "label": "Healthy Resources", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "microsoft_defender_cloud.event.properties.healthy_resource_count" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "1a3593c9-64c3-4861-bbf5-2feb708ce992", + "layerId": "767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "layerType": "data", + "textAlign": "center" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "0c1348f8-981d-455d-acac-9b0f1e13b50f", + "w": 12, + "x": 24, + "y": 0 + }, + "panelIndex": "0c1348f8-981d-455d-acac-9b0f1e13b50f", + "title": "Healthy Resource Count [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "767980ff-c7da-4dd3-b12a-b64c62dad0ef": { + "columnOrder": [ + "1a3593c9-64c3-4861-bbf5-2feb708ce992" + ], + "columns": { + "1a3593c9-64c3-4861-bbf5-2feb708ce992": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "microsoft_defender_cloud.event.properties.unhealthy_resource_count: *" + }, + "isBucketed": false, + "label": "Unhealthy Resources", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "microsoft_defender_cloud.event.properties.unhealthy_resource_count" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "1a3593c9-64c3-4861-bbf5-2feb708ce992", + "layerId": "767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "layerType": "data", + "textAlign": "center" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "91017bba-cc83-4756-bd93-a3edfbfaaa59", + "w": 12, + "x": 36, + "y": 0 + }, + "panelIndex": "91017bba-cc83-4756-bd93-a3edfbfaaa59", + "title": "Unhealthy Resource Count [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-115ac0b7-36c0-44d4-b881-b98e73571046", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "115ac0b7-36c0-44d4-b881-b98e73571046": { + "columnOrder": [ + "63c4742f-0aca-45d7-8e08-a64898b74291", + "0fb6bc78-09e8-44d3-85c2-de8055ed37bf", + "7c39093a-4123-4c20-976e-f243aac7fcb5" + ], + "columns": { + "0fb6bc78-09e8-44d3-85c2-de8055ed37bf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "7c39093a-4123-4c20-976e-f243aac7fcb5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.threat_intelligence.type" + }, + "63c4742f-0aca-45d7-8e08-a64898b74291": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Name", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "7c39093a-4123-4c20-976e-f243aac7fcb5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.threat_intelligence.name" + }, + "7c39093a-4123-4c20-976e-f243aac7fcb5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "63c4742f-0aca-45d7-8e08-a64898b74291", + "0fb6bc78-09e8-44d3-85c2-de8055ed37bf" + ], + "layerId": "115ac0b7-36c0-44d4-b881-b98e73571046", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "large", + "metric": "7c39093a-4123-4c20-976e-f243aac7fcb5", + "nestedLegend": true, + "numberDisplay": "percent", + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "ae1a1587-0e24-4b0d-85de-a91ab806e55f", + "w": 24, + "x": 0, + "y": 7 + }, + "panelIndex": "ae1a1587-0e24-4b0d-85de-a91ab806e55f", + "title": "Distribution of Events by Threat Name and Type [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-52cf6d7c-f870-4eab-b642-671d1a969cc9", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "52cf6d7c-f870-4eab-b642-671d1a969cc9": { + "columnOrder": [ + "97e2dbf5-4aa7-4e47-95a6-96d573a543ab", + "2b1fd69e-7f35-4e75-939e-3130448c4865" + ], + "columns": { + "2b1fd69e-7f35-4e75-939e-3130448c4865": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "97e2dbf5-4aa7-4e47-95a6-96d573a543ab": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Alert Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "2b1fd69e-7f35-4e75-939e-3130448c4865", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.alert_type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "97e2dbf5-4aa7-4e47-95a6-96d573a543ab", + "isTransposed": false + }, + { + "colorMode": "none", + "columnId": "2b1fd69e-7f35-4e75-939e-3130448c4865", + "isTransposed": false + } + ], + "layerId": "52cf6d7c-f870-4eab-b642-671d1a969cc9", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cfad8b8b-d456-4252-8230-cb4db37bbee2", + "w": 24, + "x": 24, + "y": 7 + }, + "panelIndex": "cfad8b8b-d456-4252-8230-cb4db37bbee2", + "title": "Top 10 Alert Type [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8c175422-6b74-44f9-9318-2c6906c6fe82", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "8c175422-6b74-44f9-9318-2c6906c6fe82": { + "columnOrder": [ + "9408cbb9-0cbe-430d-8e9d-c19c61a4b9a4", + "c371bfd2-6ebb-4cbd-a356-e1941371b799" + ], + "columns": { + "9408cbb9-0cbe-430d-8e9d-c19c61a4b9a4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c371bfd2-6ebb-4cbd-a356-e1941371b799", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.category" + }, + "c371bfd2-6ebb-4cbd-a356-e1941371b799": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "c371bfd2-6ebb-4cbd-a356-e1941371b799" + ], + "layerId": "8c175422-6b74-44f9-9318-2c6906c6fe82", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "9408cbb9-0cbe-430d-8e9d-c19c61a4b9a4" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "981628c3-c2c5-4ce2-b7f9-8474fc3e94d3", + "w": 24, + "x": 0, + "y": 22 + }, + "panelIndex": "981628c3-c2c5-4ce2-b7f9-8474fc3e94d3", + "title": "Distribution of Events by Category [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-748dc0f9-863f-4bb7-87c4-106cf9be896b", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "748dc0f9-863f-4bb7-87c4-106cf9be896b": { + "columnOrder": [ + "42554a67-cb89-42aa-9339-f644d22b96f9", + "31f22afe-2376-4ee5-85a5-0b6e0a00f150" + ], + "columns": { + "31f22afe-2376-4ee5-85a5-0b6e0a00f150": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "42554a67-cb89-42aa-9339-f644d22b96f9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "31f22afe-2376-4ee5-85a5-0b6e0a00f150", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.severity" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "42554a67-cb89-42aa-9339-f644d22b96f9" + ], + "layerId": "748dc0f9-863f-4bb7-87c4-106cf9be896b", + "layerType": "data", + "legendDisplay": "show", + "metric": "31f22afe-2376-4ee5-85a5-0b6e0a00f150", + "nestedLegend": false, + "numberDisplay": "percent", + "truncateLegend": true + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "12b6a8a5-a457-4156-a1de-ef47668af576", + "w": 24, + "x": 24, + "y": 22 + }, + "panelIndex": "12b6a8a5-a457-4156-a1de-ef47668af576", + "title": "Distribution of Events by Severity [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-64ce693c-c126-4e57-aeb8-34710815b8e7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "64ce693c-c126-4e57-aeb8-34710815b8e7": { + "columnOrder": [ + "79e40746-bf8c-4f0c-ba1f-a027ad1a68c8", + "bedf709d-d1a3-4629-be8d-189158591406" + ], + "columns": { + "79e40746-bf8c-4f0c-ba1f-a027ad1a68c8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "OS Family", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "bedf709d-d1a3-4629-be8d-189158591406", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.family" + }, + "bedf709d-d1a3-4629-be8d-189158591406": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "79e40746-bf8c-4f0c-ba1f-a027ad1a68c8" + ], + "layerId": "64ce693c-c126-4e57-aeb8-34710815b8e7", + "layerType": "data", + "legendDisplay": "show", + "metric": "bedf709d-d1a3-4629-be8d-189158591406", + "nestedLegend": false, + "numberDisplay": "percent", + "truncateLegend": true + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "e72b1c88-a609-4372-8ec6-00e715a8eed5", + "w": 24, + "x": 0, + "y": 37 + }, + "panelIndex": "e72b1c88-a609-4372-8ec6-00e715a8eed5", + "title": "Distribution of Events by OS Family [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-92693e73-87d6-49dd-808e-16f8f37e30f3", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "92693e73-87d6-49dd-808e-16f8f37e30f3": { + "columnOrder": [ + "04ae3adb-7c91-4a15-a19d-a32bddcb7b07", + "4e7f148b-38a1-4ff5-ab4e-0a64e2ad6c43" + ], + "columns": { + "04ae3adb-7c91-4a15-a19d-a32bddcb7b07": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cloud Provider", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "4e7f148b-38a1-4ff5-ab4e-0a64e2ad6c43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "cloud.provider" + }, + "4e7f148b-38a1-4ff5-ab4e-0a64e2ad6c43": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "04ae3adb-7c91-4a15-a19d-a32bddcb7b07", + "isTransposed": false + }, + { + "columnId": "4e7f148b-38a1-4ff5-ab4e-0a64e2ad6c43", + "isTransposed": false + } + ], + "layerId": "92693e73-87d6-49dd-808e-16f8f37e30f3", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a02873e2-2ef3-43e8-a34d-0112ecadd2c6", + "w": 24, + "x": 24, + "y": 37 + }, + "panelIndex": "a02873e2-2ef3-43e8-a34d-0112ecadd2c6", + "title": "Top 10 Cloud Provider Name [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-64e5452a-1001-488b-9b21-71c06fe5ded7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "64e5452a-1001-488b-9b21-71c06fe5ded7": { + "columnOrder": [ + "cdcce11e-1083-41f2-b474-d61cb30f784b", + "3366b7a9-ad73-4cb9-ab59-152bc67a22de" + ], + "columns": { + "3366b7a9-ad73-4cb9-ab59-152bc67a22de": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cdcce11e-1083-41f2-b474-d61cb30f784b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Compromised Entity", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "3366b7a9-ad73-4cb9-ab59-152bc67a22de", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.compromised_entity" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "cdcce11e-1083-41f2-b474-d61cb30f784b", + "isTransposed": false + }, + { + "columnId": "3366b7a9-ad73-4cb9-ab59-152bc67a22de", + "isTransposed": false + } + ], + "layerId": "64e5452a-1001-488b-9b21-71c06fe5ded7", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c6faa37e-a2ea-4d83-a3cd-850e3d6652b7", + "w": 24, + "x": 0, + "y": 52 + }, + "panelIndex": "c6faa37e-a2ea-4d83-a3cd-850e3d6652b7", + "title": "Top 10 Compromised Entities [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-59399110-9e41-48e8-a9fa-14cf4e0a2504", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "59399110-9e41-48e8-a9fa-14cf4e0a2504": { + "columnOrder": [ + "e051a0bb-7fd0-4424-b516-c2a1cbff50b9", + "f342ac9a-9882-4a98-ada1-c898f2ee5aa7" + ], + "columns": { + "e051a0bb-7fd0-4424-b516-c2a1cbff50b9": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resource Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f342ac9a-9882-4a98-ada1-c898f2ee5aa7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.resource_type" + }, + "f342ac9a-9882-4a98-ada1-c898f2ee5aa7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f342ac9a-9882-4a98-ada1-c898f2ee5aa7" + ], + "layerId": "59399110-9e41-48e8-a9fa-14cf4e0a2504", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "e051a0bb-7fd0-4424-b516-c2a1cbff50b9" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "43ece979-eb73-48a8-a6c7-51d3cc46bedc", + "w": 24, + "x": 24, + "y": 52 + }, + "panelIndex": "43ece979-eb73-48a8-a6c7-51d3cc46bedc", + "title": "Distribution of Events by Resource Type [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1e977a02-c588-4498-94a2-081c6e87d503", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "1e977a02-c588-4498-94a2-081c6e87d503": { + "columnOrder": [ + "0facc319-22b5-44b2-9713-24f56cb17f22", + "e1ac3a1d-7170-4f82-8949-0de76de177a3" + ], + "columns": { + "0facc319-22b5-44b2-9713-24f56cb17f22": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "State", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "e1ac3a1d-7170-4f82-8949-0de76de177a3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.properties.state" + }, + "e1ac3a1d-7170-4f82-8949-0de76de177a3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "0facc319-22b5-44b2-9713-24f56cb17f22" + ], + "layerId": "1e977a02-c588-4498-94a2-081c6e87d503", + "layerType": "data", + "legendDisplay": "show", + "metric": "e1ac3a1d-7170-4f82-8949-0de76de177a3", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2a17bba0-7b32-474f-bf33-9157f1a4dd1c", + "w": 24, + "x": 0, + "y": 67 + }, + "panelIndex": "2a17bba0-7b32-474f-bf33-9157f1a4dd1c", + "title": "Distribution of Events by State [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6c69ad0c-5de5-4a87-9913-dd5be8841d19", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "6c69ad0c-5de5-4a87-9913-dd5be8841d19": { + "columnOrder": [ + "28dae11b-ef49-47db-937b-eb9b59522bda", + "ecc7e57a-3164-4eef-86b6-9c964c23963f" + ], + "columns": { + "28dae11b-ef49-47db-937b-eb9b59522bda": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Security Data Enrichment Action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "ecc7e57a-3164-4eef-86b6-9c964c23963f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.security_event_data_enrichment.action" + }, + "ecc7e57a-3164-4eef-86b6-9c964c23963f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "28dae11b-ef49-47db-937b-eb9b59522bda" + ], + "layerId": "6c69ad0c-5de5-4a87-9913-dd5be8841d19", + "layerType": "data", + "legendDisplay": "show", + "metric": "ecc7e57a-3164-4eef-86b6-9c964c23963f", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "93b3492c-c314-4138-be92-f6d097d5242f", + "w": 24, + "x": 24, + "y": 67 + }, + "panelIndex": "93b3492c-c314-4138-be92-f6d097d5242f", + "title": "Distribution of Events by Security Data Enrichment Action [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-15a42d10-fc12-41a4-aefe-7647e6611f55", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "15a42d10-fc12-41a4-aefe-7647e6611f55": { + "columnOrder": [ + "0f9ac824-5ded-4998-b05f-ec88bcae5982", + "43cf4171-2174-4813-beff-148b2b4fe54c", + "b08b43d6-f15b-4ec1-b93e-f5619eeec8b1" + ], + "columns": { + "0f9ac824-5ded-4998-b05f-ec88bcae5982": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Organization", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "b08b43d6-f15b-4ec1-b93e-f5619eeec8b1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.location.organization" + }, + "43cf4171-2174-4813-beff-148b2b4fe54c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Organization Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "b08b43d6-f15b-4ec1-b93e-f5619eeec8b1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.entities.location.organization_type" + }, + "b08b43d6-f15b-4ec1-b93e-f5619eeec8b1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b08b43d6-f15b-4ec1-b93e-f5619eeec8b1" + ], + "layerId": "15a42d10-fc12-41a4-aefe-7647e6611f55", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "splitAccessor": "43cf4171-2174-4813-beff-148b2b4fe54c", + "xAccessor": "0f9ac824-5ded-4998-b05f-ec88bcae5982" + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "legendSize": "large", + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "a70f2bbc-8f08-4751-b949-2a9762c914b0", + "w": 48, + "x": 0, + "y": 82 + }, + "panelIndex": "a70f2bbc-8f08-4751-b949-2a9762c914b0", + "title": "Distribution of Events by Organization and Type [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2d8047f1-c79f-43d6-bae5-ff6a10ebe4f7", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "2d8047f1-c79f-43d6-bae5-ff6a10ebe4f7": { + "columnOrder": [ + "6d0f65c3-75fc-4d09-b54e-a0aa054a908e", + "f4906f07-af9d-4156-bc81-de6c4edbf813" + ], + "columns": { + "6d0f65c3-75fc-4d09-b54e-a0aa054a908e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "f4906f07-af9d-4156-bc81-de6c4edbf813", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.status" + }, + "f4906f07-af9d-4156-bc81-de6c4edbf813": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "groups": [ + "6d0f65c3-75fc-4d09-b54e-a0aa054a908e" + ], + "layerId": "2d8047f1-c79f-43d6-bae5-ff6a10ebe4f7", + "layerType": "data", + "legendDisplay": "show", + "metric": "f4906f07-af9d-4156-bc81-de6c4edbf813", + "nestedLegend": false, + "numberDisplay": "percent" + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cee6ff95-1946-43f7-b962-b4f4dd6ddf41", + "w": 24, + "x": 0, + "y": 98 + }, + "panelIndex": "cee6ff95-1946-43f7-b962-b4f4dd6ddf41", + "title": "Distribution of Events by Status [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-21e69043-a1c5-49c0-bf9e-f7c0be8bd4f8", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "21e69043-a1c5-49c0-bf9e-f7c0be8bd4f8": { + "columnOrder": [ + "5ebe994d-d4e2-468c-9437-c3adae9922cc", + "ad0ecbf8-d9c0-41ca-8b56-18f27a8323dc" + ], + "columns": { + "5ebe994d-d4e2-468c-9437-c3adae9922cc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Assessment Type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "ad0ecbf8-d9c0-41ca-8b56-18f27a8323dc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "microsoft_defender_cloud.event.properties.assessment.type" + }, + "ad0ecbf8-d9c0-41ca-8b56-18f27a8323dc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "ad0ecbf8-d9c0-41ca-8b56-18f27a8323dc" + ], + "layerId": "21e69043-a1c5-49c0-bf9e-f7c0be8bd4f8", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "5ebe994d-d4e2-468c-9437-c3adae9922cc" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "854789c8-cac6-4f03-bb4c-be8ce9a0eb7e", + "w": 24, + "x": 24, + "y": 98 + }, + "panelIndex": "854789c8-cac6-4f03-bb4c-be8ce9a0eb7e", + "title": "Distribution of Events by Assessment Type [Logs Microsoft Defender Cloud]", + "type": "lens", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "4da4352e-7c40-4b15-a4f1-49d5ae065248", + "w": 48, + "x": 0, + "y": 113 + }, + "panelIndex": "4da4352e-7c40-4b15-a4f1-49d5ae065248", + "panelRefName": "panel_4da4352e-7c40-4b15-a4f1-49d5ae065248", + "type": "search", + "version": "8.3.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"locale\":\"autoselect\",\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"fc3fc92a-72c1-40de-ae7d-f71bb4c04770\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"9888bf0b-d28b-43a3-9a28-026abd45a4ab\",\"indexPatternTitle\":\"logs-*\",\"term\":\"host.geo.country_iso_code\",\"metrics\":[{\"type\":\"count\"}],\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"indexPatternRefName\":\"layer_1_join_0_index_pattern\"}}],\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"iso2\"]},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"__kbnjoin__count__9888bf0b-d28b-43a3-9a28-026abd45a4ab\",\"origin\":\"join\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#3d3d3d\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__9888bf0b-d28b-43a3-9a28-026abd45a4ab\",\"origin\":\"join\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"802c791c-c543-48a2-ace4-99faa8dd1684\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\"}]", + "mapStateJSON": "{\"zoom\":0.67,\"center\":{\"lon\":-13.60336,\"lat\":12.45534},\"timeFilters\":{\"from\":\"now-1M\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": false, + "mapBuffer": { + "maxLat": 66.51326, + "maxLon": 135, + "minLat": -40.9799, + "minLon": -180 + }, + "mapCenter": { + "lat": 37.79971, + "lon": 1.5841, + "zoom": 2.07 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 17, + "i": "4698ec9b-ee37-4d0b-9070-7fd70bf9adfd", + "w": 48, + "x": 0, + "y": 128 + }, + "panelIndex": "4698ec9b-ee37-4d0b-9070-7fd70bf9adfd", + "title": "Distribution of Events by Country [Logs Microsoft Defender Cloud]", + "type": "map", + "version": "8.3.0" + } + ], + "timeRestore": false, + "title": "[Logs Microsoft Defender Cloud] Event", + "version": 1 + }, + "coreMigrationVersion": "8.3.0", + "id": "microsoft_defender_cloud-97eaf040-0516-11ee-b4db-89b3a5f6df7f", + "migrationVersion": { + "dashboard": "8.3.0" + }, + "references": [ + { + "id": "logs-*", + "name": "8bd11cf0-efa0-4296-b8cf-03fe8fdce840:indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8dff8fbb-f085-483c-a22c-4e1aec4bdf29:indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5b67d941-caa4-4016-add5-99976279202d:indexpattern-datasource-layer-acbbe59f-11b9-40ba-90ec-0f7556565d09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0c1348f8-981d-455d-acac-9b0f1e13b50f:indexpattern-datasource-layer-767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91017bba-cc83-4756-bd93-a3edfbfaaa59:indexpattern-datasource-layer-767980ff-c7da-4dd3-b12a-b64c62dad0ef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ae1a1587-0e24-4b0d-85de-a91ab806e55f:indexpattern-datasource-layer-115ac0b7-36c0-44d4-b881-b98e73571046", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfad8b8b-d456-4252-8230-cb4db37bbee2:indexpattern-datasource-layer-52cf6d7c-f870-4eab-b642-671d1a969cc9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "981628c3-c2c5-4ce2-b7f9-8474fc3e94d3:indexpattern-datasource-layer-8c175422-6b74-44f9-9318-2c6906c6fe82", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "12b6a8a5-a457-4156-a1de-ef47668af576:indexpattern-datasource-layer-748dc0f9-863f-4bb7-87c4-106cf9be896b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e72b1c88-a609-4372-8ec6-00e715a8eed5:indexpattern-datasource-layer-64ce693c-c126-4e57-aeb8-34710815b8e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a02873e2-2ef3-43e8-a34d-0112ecadd2c6:indexpattern-datasource-layer-92693e73-87d6-49dd-808e-16f8f37e30f3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c6faa37e-a2ea-4d83-a3cd-850e3d6652b7:indexpattern-datasource-layer-64e5452a-1001-488b-9b21-71c06fe5ded7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "43ece979-eb73-48a8-a6c7-51d3cc46bedc:indexpattern-datasource-layer-59399110-9e41-48e8-a9fa-14cf4e0a2504", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2a17bba0-7b32-474f-bf33-9157f1a4dd1c:indexpattern-datasource-layer-1e977a02-c588-4498-94a2-081c6e87d503", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "93b3492c-c314-4138-be92-f6d097d5242f:indexpattern-datasource-layer-6c69ad0c-5de5-4a87-9913-dd5be8841d19", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a70f2bbc-8f08-4751-b949-2a9762c914b0:indexpattern-datasource-layer-15a42d10-fc12-41a4-aefe-7647e6611f55", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cee6ff95-1946-43f7-b962-b4f4dd6ddf41:indexpattern-datasource-layer-2d8047f1-c79f-43d6-bae5-ff6a10ebe4f7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "854789c8-cac6-4f03-bb4c-be8ce9a0eb7e:indexpattern-datasource-layer-21e69043-a1c5-49c0-bf9e-f7c0be8bd4f8", + "type": "index-pattern" + }, + { + "id": "microsoft_defender_cloud-52f0f2f0-039f-11ee-bafb-95960de71508", + "name": "4da4352e-7c40-4b15-a4f1-49d5ae065248:panel_4da4352e-7c40-4b15-a4f1-49d5ae065248", + "type": "search" + }, + { + "id": "logs-*", + "name": "4698ec9b-ee37-4d0b-9070-7fd70bf9adfd:layer_1_join_0_index_pattern", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/microsoft_defender_cloud/kibana/search/microsoft_defender_cloud-52f0f2f0-039f-11ee-bafb-95960de71508.json b/packages/microsoft_defender_cloud/kibana/search/microsoft_defender_cloud-52f0f2f0-039f-11ee-bafb-95960de71508.json new file mode 100644 index 00000000000..f9ec4d8fe0e --- /dev/null +++ b/packages/microsoft_defender_cloud/kibana/search/microsoft_defender_cloud-52f0f2f0-039f-11ee-bafb-95960de71508.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "columns": [ + "microsoft_defender_cloud.event.alert_type", + "microsoft_defender_cloud.event.system.alert_id", + "microsoft_defender_cloud.event.display_name", + "microsoft_defender_cloud.event.description" + ], + "description": "", + "grid": {}, + "hideChart": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"microsoft_defender_cloud.event\" " + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "title": "Event Essential Details [Logs Microsoft Defender Cloud]" + }, + "coreMigrationVersion": "8.3.0", + "id": "microsoft_defender_cloud-52f0f2f0-039f-11ee-bafb-95960de71508", + "migrationVersion": { + "search": "8.0.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "search" +} \ No newline at end of file diff --git a/packages/microsoft_defender_cloud/kibana/tags.yml b/packages/microsoft_defender_cloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/microsoft_defender_cloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/microsoft_defender_cloud/manifest.yml b/packages/microsoft_defender_cloud/manifest.yml new file mode 100644 index 00000000000..4603c445db0 --- /dev/null +++ b/packages/microsoft_defender_cloud/manifest.yml @@ -0,0 +1,34 @@ +format_version: "3.0.0" +name: microsoft_defender_cloud +title: Microsoft Defender for Cloud +version: "0.4.0" +description: Collect logs from Microsoft Defender for Cloud with Elastic Agent. +type: integration +categories: + - security +conditions: + kibana: + version: ^8.3.0 + elastic: + subscription: basic +screenshots: + - src: /img/microsoft-defender-cloud-dashboard-event.png + title: Microsoft Defender for Cloud Event Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/microsoft-defender-cloud-logo.svg + title: Microsoft Defender for Cloud logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: microsoft_defender_cloud + title: Microsoft Defender for Cloud Logs + description: Collect logs from Microsoft Defender for Cloud. + inputs: + - type: azure-eventhub + title: Collect logs from Azure Event Hub + description: Collect logs from Azure Event Hub. +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/microsoft_defender_endpoint/_dev/build/build.yml b/packages/microsoft_defender_endpoint/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/microsoft_defender_endpoint/_dev/build/build.yml +++ b/packages/microsoft_defender_endpoint/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/microsoft_defender_endpoint/changelog.yml b/packages/microsoft_defender_endpoint/changelog.yml index 969d7727a70..100b5b131a4 100644 --- a/packages/microsoft_defender_endpoint/changelog.yml +++ b/packages/microsoft_defender_endpoint/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: "2.18.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "2.16.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7124 +- version: "2.15.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6900 +- version: "2.14.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "2.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/microsoft_defender_endpoint/data_stream/log/_dev/test/pipeline/test-defenderatp.log-expected.json b/packages/microsoft_defender_endpoint/data_stream/log/_dev/test/pipeline/test-defenderatp.log-expected.json index c86a7460497..fe6e80319a9 100644 --- a/packages/microsoft_defender_endpoint/data_stream/log/_dev/test/pipeline/test-defenderatp.log-expected.json +++ b/packages/microsoft_defender_endpoint/data_stream/log/_dev/test/pipeline/test-defenderatp.log-expected.json @@ -11,7 +11,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -75,7 +75,9 @@ "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "Malware" + "name": [ + "Malware" + ] } } }, @@ -90,7 +92,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DefenseEvasion", @@ -173,7 +175,9 @@ "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "DefenseEvasion" + "name": [ + "DefenseEvasion" + ] } }, "user": { @@ -192,7 +196,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DefenseEvasion", @@ -256,7 +260,9 @@ "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "DefenseEvasion" + "name": [ + "DefenseEvasion" + ] } }, "user": { @@ -276,7 +282,7 @@ "provider": "azure" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Malware", @@ -347,7 +353,9 @@ "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "Malware" + "name": [ + "Malware" + ] } } }, diff --git a/packages/microsoft_defender_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_defender_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 486d378d172..fe298f38457 100644 --- a/packages/microsoft_defender_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/microsoft_defender_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Microsoft Defender for Endpoint logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -162,10 +162,10 @@ processors: field: threat.framework value: MITRE ATT&CK if: ctx.json?.category != null - - rename: - field: json.category - target_field: threat.technique.name - ignore_missing: true + - append: + field: threat.technique.name + value: '{{{json.category}}}' + if: ctx.json?.category != null - rename: field: json.description target_field: rule.description @@ -304,6 +304,7 @@ processors: - json.alertCreationTime - json.severity - json.relatedUser + - json.category ignore_missing: true - rename: field: json diff --git a/packages/microsoft_defender_endpoint/data_stream/log/manifest.yml b/packages/microsoft_defender_endpoint/data_stream/log/manifest.yml index a382144d6b6..6f03015d5a2 100644 --- a/packages/microsoft_defender_endpoint/data_stream/log/manifest.yml +++ b/packages/microsoft_defender_endpoint/data_stream/log/manifest.yml @@ -41,7 +41,7 @@ streams: required: true show_user: true default: 5m - description: The interval between requests to the HTTP API. + description: The interval between requests to the HTTP API. Supported units for this parameter are h/m/s. - name: scopes type: text title: Oauth2 Scopes diff --git a/packages/microsoft_defender_endpoint/data_stream/log/sample_event.json b/packages/microsoft_defender_endpoint/data_stream/log/sample_event.json index de37c75cb73..447c114d010 100644 --- a/packages/microsoft_defender_endpoint/data_stream/log/sample_event.json +++ b/packages/microsoft_defender_endpoint/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-05-12T07:01:02.145Z", + "@timestamp": "2023-07-24T14:20:13.467Z", "agent": { - "ephemeral_id": "5ad04d6b-7576-496c-aadf-72e9c1e72eab", - "id": "26dd4270-014a-48d2-8f5d-6aa3f48a273c", + "ephemeral_id": "6602c8b6-3007-4b99-8871-28728195e542", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.2" }, "cloud": { "account": { @@ -22,12 +22,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "26dd4270-014a-48d2-8f5d-6aa3f48a273c", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.7.1" + "version": "8.8.2" }, "event": { "action": "Execution", @@ -40,7 +40,7 @@ "duration": 101466100, "end": "2021-01-26T20:31:33.0577322Z", "id": "da637472900382838869_1364969609", - "ingested": "2023-05-12T07:01:03Z", + "ingested": "2023-07-24T14:20:16Z", "kind": "alert", "provider": "defender_endpoint", "severity": 2, @@ -99,7 +99,9 @@ "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "Execution" + "name": [ + "Execution" + ] } }, "user": { diff --git a/packages/microsoft_defender_endpoint/docs/README.md b/packages/microsoft_defender_endpoint/docs/README.md index 9a9237261bf..00b885d6ad7 100644 --- a/packages/microsoft_defender_endpoint/docs/README.md +++ b/packages/microsoft_defender_endpoint/docs/README.md @@ -47,13 +47,13 @@ An example event for `log` looks as following: ```json { - "@timestamp": "2023-05-12T07:01:02.145Z", + "@timestamp": "2023-07-24T14:20:13.467Z", "agent": { - "ephemeral_id": "5ad04d6b-7576-496c-aadf-72e9c1e72eab", - "id": "26dd4270-014a-48d2-8f5d-6aa3f48a273c", + "ephemeral_id": "6602c8b6-3007-4b99-8871-28728195e542", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.2" }, "cloud": { "account": { @@ -70,12 +70,12 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "26dd4270-014a-48d2-8f5d-6aa3f48a273c", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.7.1" + "version": "8.8.2" }, "event": { "action": "Execution", @@ -88,7 +88,7 @@ An example event for `log` looks as following: "duration": 101466100, "end": "2021-01-26T20:31:33.0577322Z", "id": "da637472900382838869_1364969609", - "ingested": "2023-05-12T07:01:03Z", + "ingested": "2023-07-24T14:20:16Z", "kind": "alert", "provider": "defender_endpoint", "severity": 2, @@ -147,7 +147,9 @@ An example event for `log` looks as following: "threat": { "framework": "MITRE ATT\u0026CK", "technique": { - "name": "Execution" + "name": [ + "Execution" + ] } }, "user": { @@ -185,17 +187,17 @@ An example event for `log` looks as following: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | | file.hash.md5 | MD5 hash. | keyword | diff --git a/packages/microsoft_defender_endpoint/kibana/dashboard/microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55.json b/packages/microsoft_defender_endpoint/kibana/dashboard/microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55.json index 3b32e8e1767..27bd58f208d 100644 --- a/packages/microsoft_defender_endpoint/kibana/dashboard/microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55.json +++ b/packages/microsoft_defender_endpoint/kibana/dashboard/microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55.json @@ -1,14 +1,6 @@ { - "id": "microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T10:13:20.146Z", - "version": "WzY0OSwxXQ==", "attributes": { "description": "Microsoft Defender for Endpoint Alert Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,113 +12,121 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "New Incidents Counter [Microsoft Defender for Endpoint]", - "description": "Microsoft Defender for Endpoint Counter for new incidents", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 1 - }, - { - "from": 1, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6f3b1d3d-d380-4379-a7e5-dc05093f9b68", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a2355be1-31f6-49b9-8ff3-26c133738355", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3ef53932-0bc2-41b5-a0d6-37d986943009", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6f3b1d3d-d380-4379-a7e5-dc05093f9b68": { + "columnOrder": [ + "1c4eb908-ea12-4057-b405-0bd6d8feec82" + ], + "columns": { + "1c4eb908-ea12-4057-b405-0bd6d8feec82": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "New Incidents", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "microsoft.defender_endpoint.incidentId" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 30, - "labelColor": false, - "subText": "" - }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "New Incidents", - "field": "microsoft.defender_endpoint.incidentId" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "query", - "negate": false, - "type": "custom", - "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" - }, - "query": { - "prefix": { - "data_stream.dataset": "microsoft_defender_endpoint." - } + "meta": { + "alias": null, + "disabled": false, + "index": "a2355be1-31f6-49b9-8ff3-26c133738355", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "microsoft_defender_endpoint." } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "microsoft_defender_endpoint.log" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "3ef53932-0bc2-41b5-a0d6-37d986943009", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_defender_endpoint.log" }, - "query": { - "match_phrase": { - "data_stream.dataset": "microsoft_defender_endpoint.log" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_defender_endpoint.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " + }, + "visualization": { + "layerId": "6f3b1d3d-d380-4379-a7e5-dc05093f9b68", + "layerType": "data", + "metricAccessor": "1c4eb908-ea12-4057-b405-0bd6d8feec82" } - } - } + }, + "title": "New Incidents Counter [Microsoft Defender for Endpoint]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} }, "gridData": { "h": 6, @@ -136,16 +136,37 @@ "y": 0 }, "panelIndex": "8343f7ea-b977-44bf-bf81-6d41742093a4", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ac550ae9-6e17-4944-9545-25bbe83d9dbb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ac550ae9-6e17-4944-9545-25bbe83d9dbb": { "columnOrder": [ @@ -165,10 +186,10 @@ "type": "column" }, "orderDirection": "desc", - "size": 6, "parentFormat": { "id": "terms" - } + }, + "size": 6 }, "scale": "ordinal", "sourceField": "event.severity" @@ -195,6 +216,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "24h" }, "scale": "interval", @@ -213,13 +235,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.integration", "negate": false, "params": { "query": "microsoft_defender_endpoint" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -234,13 +256,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-1", "key": "data_stream.dataset", "negate": false, "params": { "query": "microsoft_defender_endpoint.log" }, - "type": "phrase", - "index": "filter-index-pattern-1" + "type": "phrase" }, "query": { "match_phrase": { @@ -260,23 +282,41 @@ "27212c7c-83ee-4292-a4c6-396d9b77dce6" ], "layerId": "ac550ae9-6e17-4944-9545-25bbe83d9dbb", + "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, "splitAccessor": "19ade524-0042-4ecd-ac59-9696c8c2e225", - "xAccessor": "677e5501-ca31-435c-8eab-38b5297e54c2", - "layerType": "data" + "xAccessor": "677e5501-ca31-435c-8eab-38b5297e54c2" } ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line" } }, "title": "New Incidents [Microsoft Defender for Endpoint]", - "visualizationType": "lnsXY", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 24, + "i": "74d36139-4d22-44d4-bfc8-020c575febb1", + "w": 25, + "x": 4, + "y": 0 + }, + "panelIndex": "74d36139-4d22-44d4-bfc8-020c575febb1", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { "references": [ { "id": "logs-*", @@ -285,7 +325,7 @@ }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ac550ae9-6e17-4944-9545-25bbe83d9dbb", + "name": "indexpattern-datasource-layer-f93e2634-0dd5-4aec-b6de-45284dd39630", "type": "index-pattern" }, { @@ -298,27 +338,10 @@ "name": "filter-index-pattern-1", "type": "index-pattern" } - ] - } - }, - "gridData": { - "h": 24, - "i": "74d36139-4d22-44d4-bfc8-020c575febb1", - "w": 25, - "x": 4, - "y": 0 - }, - "panelIndex": "74d36139-4d22-44d4-bfc8-020c575febb1", - "version": "8.1.0", - "type": "lens" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { + ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f93e2634-0dd5-4aec-b6de-45284dd39630": { "columnOrder": [ @@ -344,10 +367,10 @@ "type": "alphabetical" }, "orderDirection": "asc", - "size": 10, "parentFormat": { "id": "terms" - } + }, + "size": 10 }, "scale": "ordinal", "sourceField": "threat.technique.name" @@ -365,13 +388,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-0", "key": "event.integration", "negate": false, "params": { "query": "microsoft_defender_endpoint" }, - "type": "phrase", - "index": "filter-index-pattern-0" + "type": "phrase" }, "query": { "match_phrase": { @@ -386,13 +409,13 @@ "meta": { "alias": null, "disabled": false, + "index": "filter-index-pattern-1", "key": "data_stream.dataset", "negate": false, "params": { "query": "microsoft_defender_endpoint.log" }, - "type": "phrase", - "index": "filter-index-pattern-1" + "type": "phrase" }, "query": { "match_phrase": { @@ -409,45 +432,27 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "12ecaf1f-b957-4c15-8f43-8f043a7d1d51" - ], "layerId": "f93e2634-0dd5-4aec-b6de-45284dd39630", + "layerType": "data", "legendDisplay": "default", - "metric": "0f67be87-cc6f-48e7-8afd-d9401037d006", + "legendSize": "auto", + "metrics": [ + "0f67be87-cc6f-48e7-8afd-d9401037d006" + ], "nestedLegend": false, "numberDisplay": "percent", - "layerType": "data" + "primaryGroups": [ + "12ecaf1f-b957-4c15-8f43-8f043a7d1d51" + ] } ], "shape": "treemap" } }, "title": "Techniques [Microsoft Defender for Endpoint]", - "visualizationType": "lnsPie", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-f93e2634-0dd5-4aec-b6de-45284dd39630", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } + "visualizationType": "lnsPie" + }, + "enhancements": {} }, "gridData": { "h": 24, @@ -458,109 +463,118 @@ }, "panelIndex": "a3e140ed-a0ed-4da0-8142-72d68fd7c5e5", "title": "Techniques [Microsoft Defender for Endpoint]", - "version": "8.1.0", - "type": "lens" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Domains Counter [Microsoft Defender for Endpoint]", - "description": "Microsoft Defender for Endpoint counter for related domains", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-27c3333c-3758-430b-9646-d7241fb9e69f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0b4d55ed-d477-448e-8c28-f3ceb00f486e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "82f85919-a82b-469f-b4f4-ba751e7f1ce3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "27c3333c-3758-430b-9646-d7241fb9e69f": { + "columnOrder": [ + "90e40e27-903d-4365-a1c3-70bcc0ecac4c" + ], + "columns": { + "90e40e27-903d-4365-a1c3-70bcc0ecac4c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Related Domains", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "microsoft.defender_endpoint.evidence.domainName" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 30, - "labelColor": false, - "subText": "" - }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Related Domains", - "field": "microsoft.defender_endpoint.evidence.domainName" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "query", - "negate": false, - "type": "custom", - "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" - }, - "query": { - "prefix": { - "data_stream.dataset": "microsoft_defender_endpoint." - } + "meta": { + "alias": null, + "disabled": false, + "index": "0b4d55ed-d477-448e-8c28-f3ceb00f486e", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "microsoft_defender_endpoint." } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "microsoft_defender_endpoint.log" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "82f85919-a82b-469f-b4f4-ba751e7f1ce3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_defender_endpoint.log" }, - "query": { - "match_phrase": { - "data_stream.dataset": "microsoft_defender_endpoint.log" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_defender_endpoint.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " + }, + "visualization": { + "layerId": "27c3333c-3758-430b-9646-d7241fb9e69f", + "layerType": "data", + "metricAccessor": "90e40e27-903d-4365-a1c3-70bcc0ecac4c" } - } - } + }, + "title": "Domains Counter [Microsoft Defender for Endpoint]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} }, "gridData": { "h": 6, @@ -570,109 +584,118 @@ "y": 6 }, "panelIndex": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "IP Addresses Counter [Microsoft Defender for Endpoint]", - "description": "Microsoft Defender for Endpoint counter for related IP Addresses", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 30, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Related Networks", - "field": "microsoft.defender_endpoint.evidence.ipAddress" - }, - "schema": "metric", - "type": "cardinality" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4f2b01b8-7ea9-41f4-b3cf-16eb108e1aeb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "909ac47e-dd63-4016-9b8a-c23ea35a1cd8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "85beba80-b25c-406d-8ab3-5fd07e71de85", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4f2b01b8-7ea9-41f4-b3cf-16eb108e1aeb": { + "columnOrder": [ + "11407289-d07c-458c-881d-04afd2cc05ae" + ], + "columns": { + "11407289-d07c-458c-881d-04afd2cc05ae": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Related Networks", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "microsoft.defender_endpoint.evidence.ipAddress" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "query", - "negate": false, - "type": "custom", - "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" - }, - "query": { - "prefix": { - "data_stream.dataset": "microsoft_defender_endpoint." - } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "909ac47e-dd63-4016-9b8a-c23ea35a1cd8", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "microsoft_defender_endpoint." } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "microsoft_defender_endpoint.log" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "85beba80-b25c-406d-8ab3-5fd07e71de85", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_defender_endpoint.log" }, - "query": { - "match_phrase": { - "data_stream.dataset": "microsoft_defender_endpoint.log" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_defender_endpoint.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " + }, + "visualization": { + "layerId": "4f2b01b8-7ea9-41f4-b3cf-16eb108e1aeb", + "layerType": "data", + "metricAccessor": "11407289-d07c-458c-881d-04afd2cc05ae" } - } - } + }, + "title": "IP Addresses Counter [Microsoft Defender for Endpoint]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} }, "gridData": { "h": 6, @@ -682,109 +705,118 @@ "y": 12 }, "panelIndex": "16e7059b-70a5-4ea4-b622-9015d7430419", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Related Users Counter [Microsoft Defender for Endpoint]", - "description": "Microsoft Defender for Endpoint counter for related Users", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ff60ac70-be28-467b-a45a-866228cec82f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1d75e81f-b95c-4572-a346-99bb77409da1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e70b50f0-3a34-4fe8-be8c-632921ffb150", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ff60ac70-be28-467b-a45a-866228cec82f": { + "columnOrder": [ + "8b32b0d2-58f7-44f7-9e6f-51e1326f5442" + ], + "columns": { + "8b32b0d2-58f7-44f7-9e6f-51e1326f5442": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Related Users", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "user.name" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 30, - "labelColor": false, - "subText": "" }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Related Users", - "field": "user.name" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "query", - "negate": false, - "type": "custom", - "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" - }, - "query": { - "prefix": { - "data_stream.dataset": "microsoft_defender_endpoint." - } + "meta": { + "alias": null, + "disabled": false, + "index": "1d75e81f-b95c-4572-a346-99bb77409da1", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "microsoft_defender_endpoint." } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "microsoft_defender_endpoint.log" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "e70b50f0-3a34-4fe8-be8c-632921ffb150", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_defender_endpoint.log" }, - "query": { - "match_phrase": { - "data_stream.dataset": "microsoft_defender_endpoint.log" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_defender_endpoint.log" } } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"microsoft_defender_endpoint.log\" " + }, + "visualization": { + "layerId": "ff60ac70-be28-467b-a45a-866228cec82f", + "layerType": "data", + "metricAccessor": "8b32b0d2-58f7-44f7-9e6f-51e1326f5442" } - } - } + }, + "title": "Related Users Counter [Microsoft Defender for Endpoint]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} }, "gridData": { "h": 6, @@ -794,226 +826,345 @@ "y": 18 }, "panelIndex": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f", - "version": "8.0.0", - "type": "visualization" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Incident Table [Microsoft Defender for Endpoint]", - "description": "Microsoft Defender for Endpoint Incident Table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c1caf4c1-8bea-42c3-94dd-ba637430a6ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8a25b120-d54a-4da4-90aa-c967b46fe44c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e866794-f4df-4ea8-bc47-3b8c38d20bf6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c1caf4c1-8bea-42c3-94dd-ba637430a6ba": { + "columnOrder": [ + "ebcaf3dc-d60a-41ee-84eb-2f4d25e1dc1a", + "ec9ecaa3-f967-46c8-b65f-c1f7e354fa9b", + "9a4ebfb2-d306-48aa-a763-06df38f2b887", + "ac04e073-b26f-46d6-803f-2bdf853132d4", + "04a2d45a-a3df-45c5-be17-6d60f30a11b1", + "7f71ec4a-03ed-4a16-a120-5a1ac3ac504c", + "e2ecbfec-c8a1-4b98-93fc-c5fc99dcda19", + "f3348884-27c0-4692-a51d-8f935c95281a" + ], + "columns": { + "04a2d45a-a3df-45c5-be17-6d60f30a11b1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + }, + "7f71ec4a-03ed-4a16-a120-5a1ac3ac504c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "threat.technique.name" + }, + "9a4ebfb2-d306-48aa-a763-06df38f2b887": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Assigned To", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "microsoft.defender_endpoint.assignedTo" + }, + "ac04e073-b26f-46d6-803f-2bdf853132d4": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.severity" + }, + "e2ecbfec-c8a1-4b98-93fc-c5fc99dcda19": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Description", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "rule.description" + }, + "ebcaf3dc-d60a-41ee-84eb-2f4d25e1dc1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Incident ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "microsoft.defender_endpoint.incidentId" + }, + "ec9ecaa3-f967-46c8-b65f-c1f7e354fa9b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Current Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "microsoft.defender_endpoint.status" + }, + "f3348884-27c0-4692-a51d-8f935c95281a": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "@timestamp: *" + }, + "isBucketed": false, + "label": "Last @timestamp", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } } + }, + "textBased": { + "layers": {} } - } - }, - "params": { - "perPage": 10, - "percentageCol": "", - "row": true, - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null }, - "totalFunc": "sum", - "showToolbar": true - }, - "type": "table", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "8", - "params": { - "aggregate": "concat", - "field": "@timestamp", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Incident ID", - "field": "microsoft.defender_endpoint.incidentId", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 + "meta": { + "alias": null, + "disabled": false, + "index": "8a25b120-d54a-4da4-90aa-c967b46fe44c", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" }, - "schema": "bucket", - "type": "terms" + "query": { + "prefix": { + "data_stream.dataset": "microsoft_defender_endpoint." + } + } }, { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Current Status", - "field": "microsoft.defender_endpoint.status", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Assigned To", - "field": "microsoft.defender_endpoint.assignedTo", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + "meta": { + "alias": null, + "disabled": false, + "index": "0e866794-f4df-4ea8-bc47-3b8c38d20bf6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_defender_endpoint.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "9", - "params": { - "customLabel": "Severity", - "field": "event.severity", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_defender_endpoint.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "f3348884-27c0-4692-a51d-8f935c95281a" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Hostname", - "field": "host.hostname", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "ebcaf3dc-d60a-41ee-84eb-2f4d25e1dc1a" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "10", - "params": { - "customLabel": "Category", - "field": "threat.technique.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "ec9ecaa3-f967-46c8-b65f-c1f7e354fa9b" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "6", - "params": { - "customLabel": "Description", - "field": "rule.description", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "9a4ebfb2-d306-48aa-a763-06df38f2b887" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "query", - "negate": false, - "type": "custom", - "value": "{\"prefix\":{\"data_stream.dataset\":\"microsoft_defender_endpoint.\"}}" - }, - "query": { - "prefix": { - "data_stream.dataset": "microsoft_defender_endpoint." - } - } + "alignment": "left", + "columnId": "ac04e073-b26f-46d6-803f-2bdf853132d4" }, { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "microsoft_defender_endpoint.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "microsoft_defender_endpoint.log" - } - } + "alignment": "left", + "columnId": "04a2d45a-a3df-45c5-be17-6d60f30a11b1" + }, + { + "alignment": "left", + "columnId": "7f71ec4a-03ed-4a16-a120-5a1ac3ac504c" + }, + { + "alignment": "left", + "columnId": "e2ecbfec-c8a1-4b98-93fc-c5fc99dcda19" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "c1caf4c1-8bea-42c3-94dd-ba637430a6ba", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Incident Table [Microsoft Defender for Endpoint]", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -1023,133 +1174,137 @@ "y": 24 }, "panelIndex": "cb8de6bb-1096-427d-834e-210963aad3e5", - "version": "8.0.0", - "type": "visualization" + "title": "Incident Table [Microsoft Defender for Endpoint]", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Microsoft Defender for Endpoint] Overview", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T01:19:37.598Z", + "id": "microsoft_defender_endpoint-65402c30-ca6a-11ea-9d4d-9737a63aaa55", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", - "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:indexpattern-datasource-layer-6f3b1d3d-d380-4379-a7e5-dc05093f9b68", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:a2355be1-31f6-49b9-8ff3-26c133738355", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "8343f7ea-b977-44bf-bf81-6d41742093a4:3ef53932-0bc2-41b5-a0d6-37d986943009", + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "74d36139-4d22-44d4-bfc8-020c575febb1:indexpattern-datasource-current-indexpattern", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "74d36139-4d22-44d4-bfc8-020c575febb1:indexpattern-datasource-layer-ac550ae9-6e17-4944-9545-25bbe83d9dbb", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "74d36139-4d22-44d4-bfc8-020c575febb1:filter-index-pattern-0", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "74d36139-4d22-44d4-bfc8-020c575febb1:filter-index-pattern-1", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "a3e140ed-a0ed-4da0-8142-72d68fd7c5e5:indexpattern-datasource-current-indexpattern", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "a3e140ed-a0ed-4da0-8142-72d68fd7c5e5:indexpattern-datasource-layer-f93e2634-0dd5-4aec-b6de-45284dd39630", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "a3e140ed-a0ed-4da0-8142-72d68fd7c5e5:filter-index-pattern-0", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", + "id": "logs-*", "name": "a3e140ed-a0ed-4da0-8142-72d68fd7c5e5:filter-index-pattern-1", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:indexpattern-datasource-layer-27c3333c-3758-430b-9646-d7241fb9e69f", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:0b4d55ed-d477-448e-8c28-f3ceb00f486e", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "f3843ab0-8b0f-4f64-805c-4ab0d0965d8a:82f85919-a82b-469f-b4f4-ba751e7f1ce3", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "16e7059b-70a5-4ea4-b622-9015d7430419:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "16e7059b-70a5-4ea4-b622-9015d7430419:indexpattern-datasource-layer-4f2b01b8-7ea9-41f4-b3cf-16eb108e1aeb", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "16e7059b-70a5-4ea4-b622-9015d7430419:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "16e7059b-70a5-4ea4-b622-9015d7430419:909ac47e-dd63-4016-9b8a-c23ea35a1cd8", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "16e7059b-70a5-4ea4-b622-9015d7430419:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "16e7059b-70a5-4ea4-b622-9015d7430419:85beba80-b25c-406d-8ab3-5fd07e71de85", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:indexpattern-datasource-layer-ff60ac70-be28-467b-a45a-866228cec82f", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:1d75e81f-b95c-4572-a346-99bb77409da1", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "d8a5a667-ed0b-42ed-ae7d-edbfa722677f:e70b50f0-3a34-4fe8-be8c-632921ffb150", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "cb8de6bb-1096-427d-834e-210963aad3e5:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "cb8de6bb-1096-427d-834e-210963aad3e5:indexpattern-datasource-layer-c1caf4c1-8bea-42c3-94dd-ba637430a6ba", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "cb8de6bb-1096-427d-834e-210963aad3e5:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "cb8de6bb-1096-427d-834e-210963aad3e5:8a25b120-d54a-4da4-90aa-c967b46fe44c", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "cb8de6bb-1096-427d-834e-210963aad3e5:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "cb8de6bb-1096-427d-834e-210963aad3e5:0e866794-f4df-4ea8-bc47-3b8c38d20bf6", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/microsoft_defender_endpoint/kibana/tags.yml b/packages/microsoft_defender_endpoint/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/microsoft_defender_endpoint/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/microsoft_defender_endpoint/manifest.yml b/packages/microsoft_defender_endpoint/manifest.yml index a3767c34a58..03142746948 100644 --- a/packages/microsoft_defender_endpoint/manifest.yml +++ b/packages/microsoft_defender_endpoint/manifest.yml @@ -1,13 +1,11 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: microsoft_defender_endpoint title: Microsoft Defender for Endpoint -version: "2.13.0" +version: "2.18.0" description: Collect logs from Microsoft Defender for Endpoint with Elastic Agent. categories: - "security" - "edr_xdr" -release: ga -license: basic type: integration conditions: kibana.version: ^8.7.1 diff --git a/packages/microsoft_dhcp/_dev/build/build.yml b/packages/microsoft_dhcp/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/microsoft_dhcp/_dev/build/build.yml +++ b/packages/microsoft_dhcp/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/microsoft_dhcp/changelog.yml b/packages/microsoft_dhcp/changelog.yml index 55658541be5..7ca49ce565e 100644 --- a/packages/microsoft_dhcp/changelog.yml +++ b/packages/microsoft_dhcp/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.20.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.0" + changes: + - description: Add QResult description based on numerical value + type: enhancement + link: https://github.com/elastic/integrations/pull/7207 +- version: "1.17.0" + changes: + - description: Add long description to event.reason + type: enhancement + link: https://github.com/elastic/integrations/pull/7100 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.15.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7125 - version: "1.14.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json b/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json index 10507431084..399dbed728a 100644 --- a/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json +++ b/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-log.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-04-19T13:11:13.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log-end", @@ -14,6 +14,7 @@ "kind": "event", "original": "01,04/19/20,13:11:13,Stopped,,,", "outcome": "success", + "reason": "The log was stopped.", "timezone": "America/New_York", "type": [ "end" @@ -32,7 +33,7 @@ { "@timestamp": "2020-04-19T12:43:06.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log-start", @@ -43,6 +44,7 @@ "kind": "event", "original": "00,04/19/20,12:43:06,Started,,,", "outcome": "success", + "reason": "The log was started.", "timezone": "America/New_York", "type": [ "start" @@ -61,7 +63,7 @@ { "@timestamp": "2021-09-20T09:16:15.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -72,6 +74,7 @@ "kind": "event", "original": "30,09/20/21,09:16:15,DNS Update Request,172.28.43.169,057182593757.test.com,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "DNS update request to the named DNS server.", "timezone": "America/New_York", "type": [ "connection" @@ -79,7 +82,9 @@ }, "host": { "domain": "test.com", - "ip": "172.28.43.169", + "ip": [ + "172.28.43.169" + ], "name": "057182593757.test.com" }, "log": { @@ -92,6 +97,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -102,7 +108,7 @@ { "@timestamp": "2021-09-20T09:16:09.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -113,6 +119,7 @@ "kind": "event", "original": "30,09/20/21,09:16:09,DNS Update Request,172.28.53.173,1-07.test.com,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "DNS update request to the named DNS server.", "timezone": "America/New_York", "type": [ "connection" @@ -120,7 +127,9 @@ }, "host": { "domain": "test.com", - "ip": "172.28.53.173", + "ip": [ + "172.28.53.173" + ], "name": "1-07.test.com" }, "log": { @@ -133,6 +142,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -143,7 +153,7 @@ { "@timestamp": "2021-09-20T09:16:03.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -154,6 +164,7 @@ "kind": "event", "original": "32,09/20/21,09:16:03,DNS Update Successful,172.28.53.36,3-07.test.com,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "DNS update successful.", "timezone": "America/New_York", "type": [ "connection" @@ -161,7 +172,9 @@ }, "host": { "domain": "test.com", - "ip": "172.28.53.36", + "ip": [ + "172.28.53.36" + ], "name": "3-07.test.com" }, "log": { @@ -174,6 +187,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -184,7 +198,7 @@ { "@timestamp": "2021-09-20T09:18:01.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -194,6 +208,7 @@ "kind": "event", "original": "36,09/20/21,09:18:01,Packet dropped because of Client ID hash mismatch or standby server.,172.28.52.0,,76691ED45C90,,0,6,,,,,,,,,0", "outcome": "failure", + "reason": "Packet dropped because the server is in failover standby role or the hash of the client ID does not match.", "timezone": "America/New_York", "type": [ "connection", @@ -202,7 +217,9 @@ }, "host": { "id": "76691ED45C90", - "ip": "172.28.52.0", + "ip": [ + "172.28.52.0" + ], "mac": [ "76-69-1E-D4-5C-90" ] @@ -217,6 +234,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -227,7 +245,7 @@ { "@timestamp": "2021-09-20T09:18:00.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -238,6 +256,7 @@ "kind": "event", "original": "31,09/20/21,09:18:00,DNS Update Failed,172.28.43.159,035856103966.test.com,,,0,6,,,,,,,,,10054", "outcome": "failure", + "reason": "DNS update failed.", "timezone": "America/New_York", "type": [ "connection" @@ -245,7 +264,9 @@ }, "host": { "domain": "test.com", - "ip": "172.28.43.159", + "ip": [ + "172.28.43.159" + ], "name": "035856103966.test.com" }, "log": { @@ -258,6 +279,7 @@ "dhcp": { "dns_error_code": "10054", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -268,7 +290,7 @@ { "@timestamp": "2021-09-20T09:18:01.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -279,6 +301,7 @@ "kind": "event", "original": "31,09/20/21,09:18:01,DNS Update Failed,172.28.40.35,001100581357.test.com,,,0,6,,,,,,,,,10054", "outcome": "failure", + "reason": "DNS update failed.", "timezone": "America/New_York", "type": [ "connection" @@ -286,7 +309,9 @@ }, "host": { "domain": "test.com", - "ip": "172.28.40.35", + "ip": [ + "172.28.40.35" + ], "name": "001100581357.test.com" }, "log": { @@ -299,6 +324,7 @@ "dhcp": { "dns_error_code": "10054", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -309,7 +335,7 @@ { "@timestamp": "2001-01-01T01:01:01.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -320,6 +346,7 @@ "kind": "event", "original": "35,01/01/01,01:01:01,DNS update request failed,192.168.2.1,host.test.com,000000000000,", "outcome": "failure", + "reason": "DNS update request failed.", "timezone": "America/New_York", "type": [ "connection", @@ -329,7 +356,9 @@ "host": { "domain": "test.com", "id": "000000000000", - "ip": "192.168.2.1", + "ip": [ + "192.168.2.1" + ], "mac": [ "00-00-00-00-00-00" ], @@ -348,7 +377,7 @@ { "@timestamp": "2001-01-01T01:01:01.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-new", @@ -359,6 +388,7 @@ "kind": "event", "original": "10,01/01/01,01:01:01,Assign,192.168.2.10,host.test.com,000000000000,,17739,0,,,", "outcome": "success", + "reason": "A new IP address was leased to a client.", "timezone": "America/New_York", "type": [ "allowed", @@ -368,7 +398,9 @@ "host": { "domain": "test.com", "id": "000000000000", - "ip": "192.168.2.10", + "ip": [ + "192.168.2.10" + ], "mac": [ "00-00-00-00-00-00" ], @@ -383,6 +415,7 @@ "microsoft": { "dhcp": { "result": "0", + "result_description": "NoQuarantine", "transaction_id": "17739" } }, @@ -393,7 +426,7 @@ { "@timestamp": "2001-01-01T01:01:01.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-new", @@ -404,6 +437,7 @@ "kind": "event", "original": "10,01/01/01,01:01:01,Assign,192.168.2.20,host.test.com,000000000000,,3096562285,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0", "outcome": "success", + "reason": "A new IP address was leased to a client.", "timezone": "America/New_York", "type": [ "allowed", @@ -413,7 +447,9 @@ "host": { "domain": "test.com", "id": "000000000000", - "ip": "192.168.2.20", + "ip": [ + "192.168.2.20" + ], "mac": [ "00-00-00-00-00-00" ], @@ -429,6 +465,7 @@ "dhcp": { "dns_error_code": "0", "result": "0", + "result_description": "NoQuarantine", "transaction_id": "3096562285", "vendor": { "hex": "0x4D53465420352E30", @@ -443,7 +480,7 @@ { "@timestamp": "2020-11-20T00:00:05.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ip-cleanup-start", @@ -454,6 +491,7 @@ "kind": "event", "original": "24,11/20/20,00:00:05,Database Cleanup Begin,,,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "IP address cleanup operation has began.", "timezone": "America/New_York", "type": [ "start" @@ -469,6 +507,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -479,7 +518,7 @@ { "@timestamp": "2020-11-20T00:00:05.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -490,6 +529,7 @@ "kind": "event", "original": "30,11/20/20,00:00:05,DNS Update Request,10.10.10.10,hostname.test.com,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "DNS update request to the named DNS server.", "timezone": "America/New_York", "type": [ "connection" @@ -497,7 +537,9 @@ }, "host": { "domain": "test.com", - "ip": "10.10.10.10", + "ip": [ + "10.10.10.10" + ], "name": "hostname.test.com" }, "log": { @@ -510,6 +552,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -520,7 +563,7 @@ { "@timestamp": "2020-11-20T00:00:05.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-expire", @@ -531,13 +574,16 @@ "kind": "event", "original": "17,11/20/20,00:00:05,DNS record not deleted,67.43.156.15,,,,0,6,,,,,,,,,0", "outcome": "success", + "reason": "A lease was expired and DNS records for an expired leases have not been deleted.", "timezone": "America/New_York", "type": [ "connection" ] }, "host": { - "ip": "67.43.156.15" + "ip": [ + "67.43.156.15" + ] }, "log": { "file": { @@ -549,6 +595,7 @@ "dhcp": { "dns_error_code": "0", "result": "6", + "result_description": "No Quarantine Information", "transaction_id": "0" } }, @@ -559,7 +606,7 @@ { "@timestamp": "2020-04-19T12:43:54.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-server-detection", @@ -571,6 +618,7 @@ "kind": "event", "original": "55,04/19/20,12:43:54,Authorized(servicing),,domain.local,", "outcome": "success", + "reason": "The DHCP server was successfully authorized to start on the network.", "timezone": "America/New_York", "type": [ "allowed", @@ -594,7 +642,7 @@ { "@timestamp": "2020-04-19T12:43:21.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-server-detection", @@ -606,6 +654,7 @@ "kind": "event", "original": "60,04/19/20,12:43:21,No DC is DS Enabled,,DOMAIN.LOCAL,", "outcome": "success", + "reason": "No domain controller running Windows Server 2008 was located. For detecting whether the server is authorized, a domain controller that is enabled for AD DS is required.", "timezone": "America/New_York", "type": [ "connection" @@ -628,7 +677,7 @@ { "@timestamp": "2020-04-19T12:43:28.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rogue-server-detection", @@ -640,6 +689,7 @@ "kind": "event", "original": "63,04/19/20,12:43:28,Restarting rogue detection,,,", "outcome": "success", + "reason": "The DHCP server is trying once more to determine whether it is authorized to start and provide service on the network.", "timezone": "America/New_York", "type": [ "connection" @@ -658,7 +708,7 @@ { "@timestamp": "2022-10-02T00:00:33.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcp-new", @@ -669,6 +719,7 @@ "kind": "event", "original": "10,10/02/22,00:00:33,Assign,192.168.10.40,,653445372C132434342A381337302B566C616D31,,3327778676,0,,,,0x4850452E20485045204F6666696312336F6D6E65637420313825302A31325847542D345346502B20537769746368,COM. COM OfficeTele 2002-11ABC-4SFP+ Switch,,,0x0106766C323E3580,0", "outcome": "success", + "reason": "A new IP address was leased to a client.", "timezone": "America/New_York", "type": [ "allowed", @@ -677,7 +728,9 @@ }, "host": { "id": "653445372C132434342A381337302B566C616D31", - "ip": "192.168.10.40" + "ip": [ + "192.168.10.40" + ] }, "log": { "file": { @@ -690,6 +743,7 @@ "dns_error_code": "0", "relay_agent_info": "0x0106766C323E3580", "result": "0", + "result_description": "NoQuarantine", "transaction_id": "3327778676", "vendor": { "hex": "0x4850452E20485045204F6666696312336F6D6E65637420313825302A31325847542D345346502B20537769746368", diff --git a/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-logv6.log-expected.json b/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-logv6.log-expected.json index da7fa7467d9..3d9965157d1 100644 --- a/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-logv6.log-expected.json +++ b/packages/microsoft_dhcp/data_stream/log/_dev/test/pipeline/test-logv6.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-04T18:24:36.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log-start", @@ -32,7 +32,7 @@ { "@timestamp": "2021-11-04T18:24:36.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1103", @@ -54,7 +54,7 @@ { "@timestamp": "2021-11-04T18:40:37.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log-stop", @@ -83,7 +83,7 @@ { "@timestamp": "2021-12-06T12:25:21.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log-start", @@ -112,7 +112,7 @@ { "@timestamp": "2021-12-06T12:25:21.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1103", @@ -138,7 +138,7 @@ { "@timestamp": "2021-12-06T12:43:57.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-solicit", @@ -156,7 +156,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -180,7 +182,7 @@ { "@timestamp": "2021-12-06T12:43:57.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-request", @@ -198,7 +200,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -222,7 +226,7 @@ { "@timestamp": "2021-12-06T12:45:48.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-solicit", @@ -240,7 +244,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -264,7 +270,7 @@ { "@timestamp": "2021-12-06T12:45:49.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-request", @@ -282,7 +288,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -306,7 +314,7 @@ { "@timestamp": "2021-12-06T12:45:59.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-solicit", @@ -324,7 +332,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -348,7 +358,7 @@ { "@timestamp": "2021-12-06T12:46:00.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-request", @@ -366,7 +376,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -390,7 +402,7 @@ { "@timestamp": "2021-12-06T12:46:25.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-solicit", @@ -408,7 +420,9 @@ ] }, "host": { - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host" }, "log": { @@ -432,7 +446,7 @@ { "@timestamp": "2021-12-06T12:46:26.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-request", @@ -451,7 +465,9 @@ }, "host": { "domain": "local", - "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6", + "ip": [ + "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" + ], "name": "test-host.local" }, "log": { @@ -475,7 +491,7 @@ { "@timestamp": "2021-12-06T13:25:21.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "dhcpv6-stateless-clients-pruged", diff --git a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 593a5041b4a..ddcbac9a814 100644 --- a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,14 +3,14 @@ description: Pipeline for processing Microsoft DHCP Server logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event - set: field: event.timezone value: "{{{_conf.tz_offset}}}" - if: "ctx?._conf?.tz_offset != null && ctx._conf.tz_offset != 'local'" + if: "ctx._conf?.tz_offset != null && ctx._conf.tz_offset != 'local'" - set: field: event.original override: false @@ -24,10 +24,14 @@ processors: ignore_missing: true - pipeline: name: '{{ IngestPipeline "dhcp" }}' - if: "ctx?.log?.file?.path != null && !ctx.log.file.path.contains('V6')" + if: "ctx.log?.file?.path != null && !ctx.log.file.path.contains('V6')" - pipeline: name: '{{ IngestPipeline "dhcpv6" }}' - if: "ctx?.log?.file?.path != null && ctx.log.file.path.contains('V6')" + if: "ctx.log?.file?.path != null && ctx.log.file.path.contains('V6')" + - append: + field: host.ip + value: '{{{_tmp_.host.ip}}}' + if: ctx._tmp_?.host?.ip != null - foreach: field: observer.mac ignore_missing: true @@ -44,7 +48,7 @@ processors: field: _ingest._value - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true - remove: diff --git a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml index c7187ee3d66..856cba5419a 100644 --- a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml +++ b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml @@ -9,7 +9,7 @@ processors: - _tmp_.date - _tmp_.time - message - - host.ip + - _tmp_.host.ip - host.name - _tmp_.mac - user.name @@ -53,18 +53,21 @@ processors: action: log-start category: - process + reason: "The log was started." type: - start "01": action: log-end category: - process + reason: "The log was stopped." type: - end "02": action: log-pause category: - process + reason: "The log was temporarily paused due to low disk space." type: - change outcome: failure @@ -72,6 +75,7 @@ processors: action: dhcp-new category: - network + reason: "A new IP address was leased to a client." type: - allowed - connection @@ -79,6 +83,7 @@ processors: action: dhcp-renew category: - network + reason: "A lease was renewed by a client." type: - allowed - connection @@ -86,17 +91,20 @@ processors: action: dhcp-release category: - network + reason: "A lease was released by a client." type: - allowed - connection "13": category: - network + reason: "An IP address was found to be in use on the network." type: - connection "14": category: - network + reason: "A lease request could not be satisfied because the scope's address pool was exhausted." type: - connection - denied @@ -105,6 +113,7 @@ processors: action: dhcp-deny category: - network + reason: "A lease was denied." type: - connection - denied @@ -113,35 +122,41 @@ processors: action: dhcp-delete category: - network + reason: "A lease was deleted." type: - connection "17": action: dhcp-expire category: - network + reason: "A lease was expired and DNS records for an expired leases have not been deleted." type: - connection "18": action: dhcp-expire category: - network + reason: "A lease was expired and DNS records were deleted." type: - connection "20": category: - network + reason: "A BOOTP address was leased to a client." type: - allowed - connection "21": category: - network + reason: "A dynamic BOOTP address was leased to a client." type: - allowed - connection "22": category: - network + reason: "A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted." type: - connection - denied @@ -149,6 +164,7 @@ processors: "23": category: - network + reason: "A BOOTP IP address was deleted after checking to see it was not in use." type: - connection - denied @@ -157,24 +173,28 @@ processors: action: ip-cleanup-start category: - process + reason: "IP address cleanup operation has began." type: - start "25": action: ip-cleanup-end category: - process + reason: "IP address cleanup statistics." type: - start "30": action: dhcp-dns-update category: - network + reason: "DNS update request to the named DNS server." type: - connection "31": action: dhcp-dns-update category: - network + reason: "DNS update failed." type: - connection outcome: failure @@ -182,11 +202,13 @@ processors: action: dhcp-dns-update category: - network + reason: "DNS update successful." type: - connection "33": category: - network + reason: "Packet dropped due to NAP policy." type: - connection outcome: failure @@ -194,6 +216,7 @@ processors: action: dhcp-dns-update category: - network + reason: "DNS update request failed.as the DNS update request queue limit exceeded." type: - connection outcome: failure @@ -201,6 +224,7 @@ processors: action: dhcp-dns-update category: - network + reason: "DNS update request failed." type: - connection - denied @@ -208,6 +232,7 @@ processors: "36": category: - network + reason: "Packet dropped because the server is in failover standby role or the hash of the client ID does not match." type: - connection - denied @@ -217,6 +242,7 @@ processors: category: - authentication - network + reason: "The DHCP server could not locate the applicable domain for its configured Active Directory installation." type: - connection outcome: failure @@ -225,6 +251,7 @@ processors: category: - authentication - network + reason: "The DHCP server was authorized to start on the network." type: - allowed - connection @@ -233,6 +260,7 @@ processors: category: - authentication - network + reason: "The DHCP server was recently upgraded to a Windows Server 2008 operating system, and, therefore, the unauthorized DHCP server detection feature (used to determine whether the server has been authorized in Active Directory) was disabled." type: - connection "53": @@ -240,6 +268,7 @@ processors: category: - authentication - network + reason: "The DHCP server was authorized to start using previously cached information. AD DS could not be found at the time the server was started on the network." type: - allowed - connection @@ -248,6 +277,7 @@ processors: category: - authentication - network + reason: "The DHCP server was not authorized to start on the network. When this event occurs, it is likely followed by the server being stopped." type: - connection - denied @@ -257,6 +287,7 @@ processors: category: - authentication - network + reason: "The DHCP server was successfully authorized to start on the network." type: - allowed - connection @@ -265,6 +296,7 @@ processors: category: - authentication - network + reason: "The DHCP server was not authorized to start on the network and was shut down by the operating system. You must first authorize the server in the directory before starting it again." type: - connection - denied @@ -274,6 +306,7 @@ processors: category: - authentication - network + reason: "Another DHCP server exists and is authorized for service in the same domain." type: - connection "58": @@ -281,6 +314,7 @@ processors: category: - authentication - network + reason: "The DHCP server could not locate the specified domain." type: - connection outcome: failure @@ -289,6 +323,7 @@ processors: category: - authentication - network + reason: "A network-related failure prevented the server from determining if it is authorized." type: - connection outcome: failure @@ -297,6 +332,7 @@ processors: category: - authentication - network + reason: "No domain controller running Windows Server 2008 was located. For detecting whether the server is authorized, a domain controller that is enabled for AD DS is required." type: - connection "61": @@ -304,6 +340,7 @@ processors: category: - authentication - network + reason: "Another DHCP server was found on the network that belongs to the Active Directory domain." type: - connection "62": @@ -311,6 +348,7 @@ processors: category: - authentication - network + reason: "Another DHCP server was found on the network." type: - connection "63": @@ -318,6 +356,7 @@ processors: category: - authentication - network + reason: "The DHCP server is trying once more to determine whether it is authorized to start and provide service on the network." type: - connection "64": @@ -325,6 +364,7 @@ processors: category: - authentication - network + reason: "The DHCP server has its service bindings or network connections configured so that it is not enabled to provide service." type: - connection source: |- @@ -333,10 +373,33 @@ processors: } def hm = new HashMap(params[ctx.event.code]); hm.forEach((k, v) -> ctx.event[k] = v); + - script: + description: Set the QResult description based on numerical value. + lang: painless + tag: add_qresult_description + params: + "0": NoQuarantine + "1": Quarantine + "2": Drop Packet + "3": Probation + "6": No Quarantine Information + source: |- + if (ctx.microsoft?.dhcp?.result == null) { + return; + } + def desc = params.get(ctx.microsoft.dhcp.result); + if (desc == null) { + return; + } + ctx.microsoft.dhcp['result_description'] = desc; - set: field: event.outcome value: success if: ctx.event?.outcome == null + - set: + field: event.reason + value: '{{{event.reason}}}' + if: ctx.event?.reasson != null - uppercase: field: _tmp_.mac ignore_missing: true diff --git a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcpv6.yml b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcpv6.yml index 5e544179d5b..01e606edf73 100644 --- a/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcpv6.yml +++ b/packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/dhcpv6.yml @@ -8,7 +8,7 @@ processors: - _tmp_.date - _tmp_.time - message - - host.ip + - _tmp_.host.ip - host.name - microsoft.dhcp.error_code - microsoft.dhcp.duid.length diff --git a/packages/microsoft_dhcp/data_stream/log/fields/ecs.yml b/packages/microsoft_dhcp/data_stream/log/fields/ecs.yml index fa4d81c3383..09019934354 100644 --- a/packages/microsoft_dhcp/data_stream/log/fields/ecs.yml +++ b/packages/microsoft_dhcp/data_stream/log/fields/ecs.yml @@ -12,6 +12,8 @@ name: event.kind - external: ecs name: event.original +- external: ecs + name: event.reason - external: ecs name: event.outcome - external: ecs diff --git a/packages/microsoft_dhcp/data_stream/log/fields/fields.yml b/packages/microsoft_dhcp/data_stream/log/fields/fields.yml index 3d7eebb86cb..12ed27618e9 100644 --- a/packages/microsoft_dhcp/data_stream/log/fields/fields.yml +++ b/packages/microsoft_dhcp/data_stream/log/fields/fields.yml @@ -8,7 +8,11 @@ - name: result type: keyword description: | - The DHCP result type, for example "NoQuarantine", "Drop Packet" etc. + The DHCP result type in numerical value, for example "NoQuarantine" is 0, "Quaratine" is 1, "Drop Packet" is 2 etc. + - name: result_description + type: keyword + description: | + The DHCP result type from numerical value, for example, 0 is "NoQuarantine", 1 is "Quarantine", 2 is "Drop Packet" etc. - name: probation_time type: keyword description: | diff --git a/packages/microsoft_dhcp/data_stream/log/sample_event.json b/packages/microsoft_dhcp/data_stream/log/sample_event.json index d023234b55f..df6133d4c4d 100644 --- a/packages/microsoft_dhcp/data_stream/log/sample_event.json +++ b/packages/microsoft_dhcp/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2001-01-01T01:01:01.000-05:00", "agent": { - "ephemeral_id": "fda1baa6-c95d-450d-a7dd-3165831e1d50", - "id": "adbd9a6d-bd11-4b00-b9fa-3424ad2e6224", + "ephemeral_id": "a53c1bd7-936f-4ca8-8740-84d1504d537e", + "id": "4e45636b-5ca2-4145-9926-801ca8065d87", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.0" + "version": "8.9.0" }, "data_stream": { "dataset": "microsoft_dhcp.log", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "adbd9a6d-bd11-4b00-b9fa-3424ad2e6224", + "id": "4e45636b-5ca2-4145-9926-801ca8065d87", "snapshot": false, - "version": "8.7.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -28,10 +28,11 @@ ], "code": "35", "dataset": "microsoft_dhcp.log", - "ingested": "2023-05-02T11:37:37Z", + "ingested": "2023-08-01T16:33:06Z", "kind": "event", "original": "35,01/01/01,01:01:01,DNS update request failed,192.168.2.1,host.test.com,000000000000,", "outcome": "failure", + "reason": "DNS update request failed.", "timezone": "America/New_York", "type": [ "connection", @@ -41,7 +42,9 @@ "host": { "domain": "test.com", "id": "000000000000", - "ip": "192.168.2.1", + "ip": [ + "192.168.2.1" + ], "mac": [ "00-00-00-00-00-00" ], @@ -60,10 +63,10 @@ "observer": { "hostname": "docker-fleet-agent", "ip": [ - "172.20.0.7" + "192.168.16.7" ], "mac": [ - "02-42-AC-14-00-07" + "02-42-C0-A8-10-07" ] }, "tags": [ diff --git a/packages/microsoft_dhcp/docs/README.md b/packages/microsoft_dhcp/docs/README.md index c3b309b78bf..d910c0ef2c4 100644 --- a/packages/microsoft_dhcp/docs/README.md +++ b/packages/microsoft_dhcp/docs/README.md @@ -22,11 +22,11 @@ An example event for `log` looks as following: { "@timestamp": "2001-01-01T01:01:01.000-05:00", "agent": { - "ephemeral_id": "fda1baa6-c95d-450d-a7dd-3165831e1d50", - "id": "adbd9a6d-bd11-4b00-b9fa-3424ad2e6224", + "ephemeral_id": "a53c1bd7-936f-4ca8-8740-84d1504d537e", + "id": "4e45636b-5ca2-4145-9926-801ca8065d87", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.0" + "version": "8.9.0" }, "data_stream": { "dataset": "microsoft_dhcp.log", @@ -34,12 +34,12 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "adbd9a6d-bd11-4b00-b9fa-3424ad2e6224", + "id": "4e45636b-5ca2-4145-9926-801ca8065d87", "snapshot": false, - "version": "8.7.0" + "version": "8.9.0" }, "event": { "action": "dhcp-dns-update", @@ -49,10 +49,11 @@ An example event for `log` looks as following: ], "code": "35", "dataset": "microsoft_dhcp.log", - "ingested": "2023-05-02T11:37:37Z", + "ingested": "2023-08-01T16:33:06Z", "kind": "event", "original": "35,01/01/01,01:01:01,DNS update request failed,192.168.2.1,host.test.com,000000000000,", "outcome": "failure", + "reason": "DNS update request failed.", "timezone": "America/New_York", "type": [ "connection", @@ -62,7 +63,9 @@ An example event for `log` looks as following: "host": { "domain": "test.com", "id": "000000000000", - "ip": "192.168.2.1", + "ip": [ + "192.168.2.1" + ], "mac": [ "00-00-00-00-00-00" ], @@ -81,10 +84,10 @@ An example event for `log` looks as following: "observer": { "hostname": "docker-fleet-agent", "ip": [ - "172.20.0.7" + "192.168.16.7" ], "mac": [ - "02-42-AC-14-00-07" + "02-42-C0-A8-10-07" ] }, "tags": [ @@ -109,10 +112,11 @@ An example event for `log` looks as following: | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | @@ -131,7 +135,8 @@ An example event for `log` looks as following: | microsoft.dhcp.error_code | DHCP server error code. | keyword | | microsoft.dhcp.probation_time | The probation time before lease ends on specific IP. | keyword | | microsoft.dhcp.relay_agent_info | Information about DHCP relay agent used for the DHCP request. | keyword | -| microsoft.dhcp.result | The DHCP result type, for example "NoQuarantine", "Drop Packet" etc. | keyword | +| microsoft.dhcp.result | The DHCP result type in numerical value, for example "NoQuarantine" is 0, "Quaratine" is 1, "Drop Packet" is 2 etc. | keyword | +| microsoft.dhcp.result_description | The DHCP result type from numerical value, for example, 0 is "NoQuarantine", 1 is "Quarantine", 2 is "Drop Packet" etc. | keyword | | microsoft.dhcp.subnet_prefix | The number of bits for the subnet prefix. | keyword | | microsoft.dhcp.transaction_id | The DHCP transaction ID. | keyword | | microsoft.dhcp.user.hex | Hex representation of the user. | keyword | diff --git a/packages/microsoft_dhcp/kibana/tags.yml b/packages/microsoft_dhcp/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/microsoft_dhcp/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/microsoft_dhcp/manifest.yml b/packages/microsoft_dhcp/manifest.yml index 62eeeaf3860..6fd26116e3f 100644 --- a/packages/microsoft_dhcp/manifest.yml +++ b/packages/microsoft_dhcp/manifest.yml @@ -1,15 +1,14 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: microsoft_dhcp title: Microsoft DHCP -version: "1.14.0" -license: basic +version: "1.20.0" description: Collect logs from Microsoft DHCP with Elastic Agent. type: integration categories: - security -release: ga conditions: - kibana.version: ^7.14.0 || ^8.0.0 + kibana: + version: ^7.14.0 || ^8.0.0 icons: - src: /img/logo.svg title: Microsoft logo @@ -25,3 +24,4 @@ policy_templates: description: Collect DHCP logs from file. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/microsoft_exchange_online_message_trace/_dev/build/build.yml b/packages/microsoft_exchange_online_message_trace/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/microsoft_exchange_online_message_trace/_dev/build/build.yml +++ b/packages/microsoft_exchange_online_message_trace/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/microsoft_exchange_online_message_trace/changelog.yml b/packages/microsoft_exchange_online_message_trace/changelog.yml index 05c1e5105b5..87173772d51 100644 --- a/packages/microsoft_exchange_online_message_trace/changelog.yml +++ b/packages/microsoft_exchange_online_message_trace/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 1.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.9.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.8.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7128 +- version: "1.7.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6931 +- version: "1.6.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.5.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/microsoft_exchange_online_message_trace/data_stream/log/_dev/test/pipeline/test-log.log-expected.json b/packages/microsoft_exchange_online_message_trace/data_stream/log/_dev/test/pipeline/test-log.log-expected.json index 05c53668cbd..82894ba25e2 100644 --- a/packages/microsoft_exchange_online_message_trace/data_stream/log/_dev/test/pipeline/test-log.log-expected.json +++ b/packages/microsoft_exchange_online_message_trace/data_stream/log/_dev/test/pipeline/test-log.log-expected.json @@ -30,7 +30,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -41,13 +41,17 @@ "delivery_timestamp": "2022-09-05T18:10:13.4907658", "direction": "inbound", "from": { - "address": "azure-noreply@azure.microsoft.com" + "address": [ + "azure-noreply@azure.microsoft.com" + ] }, "local_id": "cf7a249a-5edd-4350-130a-08da8f69e0f6", "message_id": "\u003ca210cf91-4f2e-484c-8ada-3b27064ee5e3@az.uksouth.production.microsoft.com\u003e", "subject": "PIM: A privileged directory role was assigned outside of PIM", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { @@ -130,7 +134,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -141,13 +145,17 @@ "delivery_timestamp": "2022-10-21T17:25:30.6006882Z", "direction": "inbound", "from": { - "address": "noreply@azure.microsoft.com" + "address": [ + "noreply@azure.microsoft.com" + ] }, "local_id": "a6f62809-5cda-4454-0962-08dab38940d6", "message_id": "\u003cGVAP278MB037518E76F4082DFE9B607B3DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM\u003e", "subject": "testmail 1", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { @@ -229,7 +237,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -240,13 +248,17 @@ "delivery_timestamp": "2022-10-21T17:25:36.969376Z", "direction": "inbound", "from": { - "address": "noreply@azure.microsoft.com" + "address": [ + "noreply@azure.microsoft.com" + ] }, "local_id": "a5e6dc0f-23df-4b20-d240-08dab38944a1", "message_id": "\u003cGVAP278MB037586A65EF1FB2F844B0258DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM\u003e", "subject": "testmail 2", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { @@ -328,7 +340,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -339,13 +351,17 @@ "delivery_timestamp": "2022-10-21T17:25:36.969376Z", "direction": "internal", "from": { - "address": "noreply@contoso.com" + "address": [ + "noreply@contoso.com" + ] }, "local_id": "a5e6dc0f-23df-4b20-d240-08dab38944a1", "message_id": "\u003cGVAP278MB037586A65EF1FB2F844B0258DA2D9@GVAP278MB0375.CHEP278.PROD.OUTLOOK.COM\u003e", "subject": "testmail 2", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { diff --git a/packages/microsoft_exchange_online_message_trace/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_exchange_online_message_trace/data_stream/log/elasticsearch/ingest_pipeline/default.yml index caf2a2f1c90..445c5e31c13 100644 --- a/packages/microsoft_exchange_online_message_trace/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/microsoft_exchange_online_message_trace/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -8,7 +8,7 @@ processors: ignore_failure: true - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Parsing of payload json - json: field: event.original @@ -18,9 +18,13 @@ processors: copy_from: microsoft.online_message_trace.Status ignore_empty_value: true - set: - field: email.from.address + field: _temp_.email.from.address copy_from: microsoft.online_message_trace.SenderAddress ignore_empty_value: true + - append: + field: email.from.address + value: '{{{_temp_.email.from.address}}}' + if: ctx._temp_?.email?.from?.address != null - set: field: source.user.id copy_from: microsoft.online_message_trace.SenderAddress @@ -50,9 +54,13 @@ processors: copy_from: microsoft.online_message_trace.Subject ignore_empty_value: true - set: - field: email.to.address + field: _temp_.email.to.address copy_from: microsoft.online_message_trace.RecipientAddress ignore_empty_value: true + - append: + field: email.to.address + value: '{{{_temp_.email.to.address}}}' + if: ctx._temp_?.email?.to?.address != null - set: field: destination.user.id copy_from: microsoft.online_message_trace.RecipientAddress @@ -135,13 +143,13 @@ processors: # Extraction of domain - grok: - field: email.from.address + field: _temp_.email.from.address patterns: - "^%{DATA}@%{DATA:source.domain}$" ignore_failure: false ignore_missing: true - grok: - field: email.to.address + field: _temp_.email.to.address patterns: - "^%{DATA}@%{DATA:destination.domain}$" ignore_failure: false @@ -177,17 +185,17 @@ processors: # Extract Username from mail - append: field: related.user - value: '{{{email.to.address}}}' + value: '{{{_temp_.email.to.address}}}' allow_duplicates: false - if: ctx.email?.to?.address != null && ctx.email.to.address != "" + if: ctx._temp_?.email?.to?.address != null && ctx._temp_.email.to.address != "" - append: field: related.user - value: '{{{email.from.address}}}' + value: '{{{_temp_.email.from.address}}}' allow_duplicates: false - if: ctx.email?.from?.address != null && ctx.email.from.address != "" + if: ctx._temp_?.email?.from?.address != null && ctx._temp_.email.from.address != "" - dissect: - field: "email.to.address" + field: _temp_.email.to.address pattern: '%{_temp_.to_user_name}@%{_temp_.to_user_domain}' ignore_missing: true - append: @@ -197,7 +205,7 @@ processors: if: ctx._temp_?.to_user_name != null && ctx._temp_.to_user_name != "" - dissect: - field: "email.from.address" + field: _temp_.email.from.address pattern: '%{_temp_.from_user_name}@%{_temp_.from_user_domain}' ignore_missing: true - append: @@ -218,24 +226,24 @@ processors: if: ctx._temp_?.from_user_name != null && ctx._temp_.from_user_name != "" && ctx.email?.direction == "outbound" || ctx.email?.direction == "internal" - append: field: user.email - value: '{{{email.to.address}}}' + value: '{{{_temp_.email.to.address}}}' allow_duplicates: false - if: ctx.email?.to?.address != null && ctx.email.to.address != "" && ctx.email?.direction == "inbound" || ctx.email?.direction == "internal" + if: ctx._temp_?.email?.to?.address != null && ctx._temp_.email.to.address != "" && ctx.email?.direction == "inbound" || ctx.email?.direction == "internal" - append: field: user.email - value: '{{{email.from.address}}}' + value: '{{{_temp_.email.from.address}}}' allow_duplicates: false - if: ctx.email?.from?.address != null && ctx.email.from.address != "" && ctx.email?.direction == "outbound" || ctx.email?.direction == "internal" + if: ctx._temp_?.email?.from?.address != null && ctx._temp_.email.from.address != "" && ctx.email?.direction == "outbound" || ctx.email?.direction == "internal" - append: field: user.id - value: '{{{email.to.address}}}' + value: '{{{_temp_.email.to.address}}}' allow_duplicates: false - if: ctx.email?.to?.address != null && ctx.email.to.address != "" && ctx.email?.direction == "inbound" || ctx.email?.direction == "internal" + if: ctx._temp_?.email?.to?.address != null && ctx._temp_.email.to.address != "" && ctx.email?.direction == "inbound" || ctx.email?.direction == "internal" - append: field: user.id - value: '{{{email.from.address}}}' + value: '{{{_temp_.email.from.address}}}' allow_duplicates: false - if: ctx.email?.from?.address != null && ctx.email.from.address != "" && ctx.email?.direction == "outbound" || ctx.email?.direction == "internal" + if: ctx._temp_?.email?.from?.address != null && ctx._temp_.email.from.address != "" && ctx.email?.direction == "outbound" || ctx.email?.direction == "internal" - script: lang: painless description: Reduce user.* to keyword if a single element. diff --git a/packages/microsoft_exchange_online_message_trace/data_stream/log/sample_event.json b/packages/microsoft_exchange_online_message_trace/data_stream/log/sample_event.json index a6de23ba90e..6a1563724f1 100644 --- a/packages/microsoft_exchange_online_message_trace/data_stream/log/sample_event.json +++ b/packages/microsoft_exchange_online_message_trace/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-09-05T18:10:13.490Z", "agent": { - "ephemeral_id": "8de97862-77fa-4e44-91be-5d3947dd67aa", - "id": "6f0c420a-c434-4d40-90cb-956665a6fdd6", + "ephemeral_id": "f42c0a8e-b2c0-4772-ab85-278acafa95f5", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.8.2" }, "data_stream": { "dataset": "microsoft_exchange_online_message_trace.log", @@ -31,15 +31,21 @@ }, "ip": "216.160.83.56", "registered_domain": "contoso.com", - "top_level_domain": "com" + "top_level_domain": "com", + "user": { + "domain": "contoso.com", + "email": "linus@contoso.com", + "id": "linus@contoso.com", + "name": "linus" + } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6f0c420a-c434-4d40-90cb-956665a6fdd6", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.5.1" + "version": "8.8.2" }, "email": { "attachments": { @@ -49,21 +55,25 @@ }, "delivery_timestamp": "2022-09-05T18:10:13.4907658", "from": { - "address": "azure-noreply@microsoft.com" + "address": [ + "azure-noreply@microsoft.com" + ] }, "local_id": "cf7a249a-5edd-4350-130a-08da8f69e0f6", "message_id": "\u003ca210cf91-4f2e-484c-8ada-3b27064ee5e3@az.uksouth.production.microsoft.com\u003e", "subject": "PIM: A privileged directory role was assigned outside of PIM", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { "agent_id_status": "verified", - "created": "2023-02-05T23:16:02.721Z", + "created": "2023-07-24T14:46:09.199Z", "dataset": "microsoft_exchange_online_message_trace.log", "end": "2022-09-06T09:01:46.036Z", - "ingested": "2023-02-05T23:16:03Z", + "ingested": "2023-07-24T14:46:12Z", "original": "{\"EndDate\":\"2022-09-06T09:01:46.0369423Z\",\"FromIP\":\"81.2.69.144\",\"Index\":0,\"MessageId\":\"\\u003ca210cf91-4f2e-484c-8ada-3b27064ee5e3@az.uksouth.production.microsoft.com\\u003e\",\"MessageTraceId\":\"cf7a249a-5edd-4350-130a-08da8f69e0f6\",\"Organization\":\"contoso.com\",\"Received\":\"2022-09-05T18:10:13.4907658\",\"RecipientAddress\":\"linus@contoso.com\",\"SenderAddress\":\"azure-noreply@microsoft.com\",\"Size\":87891,\"StartDate\":\"2022-09-04T09:01:46.0369423Z\",\"Status\":\"Delivered\",\"Subject\":\"PIM: A privileged directory role was assigned outside of PIM\",\"ToIP\":\"216.160.83.56\"}", "outcome": "Delivered", "start": "2022-09-04T09:01:46.036Z" @@ -89,6 +99,14 @@ "ToIP": "216.160.83.56" } }, + "related": { + "user": [ + "linus@contoso.com", + "azure-noreply@microsoft.com", + "linus", + "azure-noreply" + ] + }, "source": { "domain": "microsoft.com", "geo": { @@ -105,7 +123,13 @@ }, "ip": "81.2.69.144", "registered_domain": "microsoft.com", - "top_level_domain": "com" + "top_level_domain": "com", + "user": { + "domain": "microsoft.com", + "email": "azure-noreply@microsoft.com", + "id": "azure-noreply@microsoft.com", + "name": "azure-noreply" + } }, "tags": [ "preserve_original_event", diff --git a/packages/microsoft_exchange_online_message_trace/docs/README.md b/packages/microsoft_exchange_online_message_trace/docs/README.md index 6fd72944f07..7679feba10c 100644 --- a/packages/microsoft_exchange_online_message_trace/docs/README.md +++ b/packages/microsoft_exchange_online_message_trace/docs/README.md @@ -119,11 +119,11 @@ An example event for `log` looks as following: { "@timestamp": "2022-09-05T18:10:13.490Z", "agent": { - "ephemeral_id": "8de97862-77fa-4e44-91be-5d3947dd67aa", - "id": "6f0c420a-c434-4d40-90cb-956665a6fdd6", + "ephemeral_id": "f42c0a8e-b2c0-4772-ab85-278acafa95f5", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.8.2" }, "data_stream": { "dataset": "microsoft_exchange_online_message_trace.log", @@ -149,15 +149,21 @@ An example event for `log` looks as following: }, "ip": "216.160.83.56", "registered_domain": "contoso.com", - "top_level_domain": "com" + "top_level_domain": "com", + "user": { + "domain": "contoso.com", + "email": "linus@contoso.com", + "id": "linus@contoso.com", + "name": "linus" + } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6f0c420a-c434-4d40-90cb-956665a6fdd6", + "id": "e4c29d91-bbb7-42b8-80fd-85ddb56d2300", "snapshot": false, - "version": "8.5.1" + "version": "8.8.2" }, "email": { "attachments": { @@ -167,21 +173,25 @@ An example event for `log` looks as following: }, "delivery_timestamp": "2022-09-05T18:10:13.4907658", "from": { - "address": "azure-noreply@microsoft.com" + "address": [ + "azure-noreply@microsoft.com" + ] }, "local_id": "cf7a249a-5edd-4350-130a-08da8f69e0f6", "message_id": "\u003ca210cf91-4f2e-484c-8ada-3b27064ee5e3@az.uksouth.production.microsoft.com\u003e", "subject": "PIM: A privileged directory role was assigned outside of PIM", "to": { - "address": "linus@contoso.com" + "address": [ + "linus@contoso.com" + ] } }, "event": { "agent_id_status": "verified", - "created": "2023-02-05T23:16:02.721Z", + "created": "2023-07-24T14:46:09.199Z", "dataset": "microsoft_exchange_online_message_trace.log", "end": "2022-09-06T09:01:46.036Z", - "ingested": "2023-02-05T23:16:03Z", + "ingested": "2023-07-24T14:46:12Z", "original": "{\"EndDate\":\"2022-09-06T09:01:46.0369423Z\",\"FromIP\":\"81.2.69.144\",\"Index\":0,\"MessageId\":\"\\u003ca210cf91-4f2e-484c-8ada-3b27064ee5e3@az.uksouth.production.microsoft.com\\u003e\",\"MessageTraceId\":\"cf7a249a-5edd-4350-130a-08da8f69e0f6\",\"Organization\":\"contoso.com\",\"Received\":\"2022-09-05T18:10:13.4907658\",\"RecipientAddress\":\"linus@contoso.com\",\"SenderAddress\":\"azure-noreply@microsoft.com\",\"Size\":87891,\"StartDate\":\"2022-09-04T09:01:46.0369423Z\",\"Status\":\"Delivered\",\"Subject\":\"PIM: A privileged directory role was assigned outside of PIM\",\"ToIP\":\"216.160.83.56\"}", "outcome": "Delivered", "start": "2022-09-04T09:01:46.036Z" @@ -207,6 +217,14 @@ An example event for `log` looks as following: "ToIP": "216.160.83.56" } }, + "related": { + "user": [ + "linus@contoso.com", + "azure-noreply@microsoft.com", + "linus", + "azure-noreply" + ] + }, "source": { "domain": "microsoft.com", "geo": { @@ -223,7 +241,13 @@ An example event for `log` looks as following: }, "ip": "81.2.69.144", "registered_domain": "microsoft.com", - "top_level_domain": "com" + "top_level_domain": "com", + "user": { + "domain": "microsoft.com", + "email": "azure-noreply@microsoft.com", + "id": "azure-noreply@microsoft.com", + "name": "azure-noreply" + } }, "tags": [ "preserve_original_event", @@ -270,10 +294,10 @@ An example event for `log` looks as following: | email.subject | A brief summary of the topic of the message. | keyword | | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | input.type | | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.offset | | long | diff --git a/packages/microsoft_exchange_online_message_trace/img/dashboard.png b/packages/microsoft_exchange_online_message_trace/img/dashboard.png index 97068f6847d..e3cc60a5fc5 100644 Binary files a/packages/microsoft_exchange_online_message_trace/img/dashboard.png and b/packages/microsoft_exchange_online_message_trace/img/dashboard.png differ diff --git a/packages/microsoft_exchange_online_message_trace/kibana/dashboard/microsoft_exchange_online_message_trace-10b79960-536a-11ed-869d-9d6d140defa1.json b/packages/microsoft_exchange_online_message_trace/kibana/dashboard/microsoft_exchange_online_message_trace-10b79960-536a-11ed-869d-9d6d140defa1.json index 90119eb5b45..1d57e893c9b 100644 --- a/packages/microsoft_exchange_online_message_trace/kibana/dashboard/microsoft_exchange_online_message_trace-10b79960-536a-11ed-869d-9d6d140defa1.json +++ b/packages/microsoft_exchange_online_message_trace/kibana/dashboard/microsoft_exchange_online_message_trace-10b79960-536a-11ed-869d-9d6d140defa1.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Microsoft Exchange Online Message Trace mail Flow Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -21,13 +22,14 @@ "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"2da95b9e-c6fa-4bdc-8e4b-96148f9c3fbc\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"sourceGeoField\":\"source.geo.location\",\"destGeoField\":\"destination.geo.location\",\"id\":\"33b8b5b0-6447-4411-9e81-796637474352\",\"type\":\"ES_PEW_PEW\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}]},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Green to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false}},\"lineWidth\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":1,\"maxSize\":10,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"61f1cadf-2a81-4d19-92fb-229fb19524fa\",\"label\":\"Mail Flow\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"VECTOR\",\"joins\":[],\"query\":{\"query\":\"event.dataset : \\\"microsoft_exchange_online_message_trace.log\\\" \",\"language\":\"kuery\"}}]", - "mapStateJSON": "{\"zoom\":1.48,\"center\":{\"lon\":-33.77637,\"lat\":39.09637},\"timeFilters\":{\"from\":\"2022-10-24T06:59:59.985Z\",\"to\":\"2022-10-24T07:25:10.451Z\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"2da95b9e-c6fa-4bdc-8e4b-96148f9c3fbc\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"sourceDescriptor\":{\"sourceGeoField\":\"source.geo.location\",\"destGeoField\":\"destination.geo.location\",\"id\":\"33b8b5b0-6447-4411-9e81-796637474352\",\"type\":\"ES_PEW_PEW\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}],\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Green to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false}},\"lineWidth\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":1,\"maxSize\":10,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"61f1cadf-2a81-4d19-92fb-229fb19524fa\",\"label\":\"Mail Flow\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[],\"query\":{\"query\":\"event.dataset : \\\"microsoft_exchange_online_message_trace.log\\\" \",\"language\":\"kuery\"}}]", + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1.48,\"center\":{\"lon\":-33.77637,\"lat\":39.09637},\"timeFilters\":{\"from\":\"now-3y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"microsoft_exchange_online_message_trace.log\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"microsoft_exchange_online_message_trace.log\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}" }, "enhancements": {}, "hiddenLayers": [], + "hidePanelTitles": false, "isLayerTOCOpen": false, "mapBuffer": { "maxLat": 85.05113, @@ -50,45 +52,9 @@ "y": 0 }, "panelIndex": "962d6720-eb53-431a-9a39-fce05507ce4e", + "title": "Traffic map [Microsoft Exchange Online Message Trace]", "type": "map", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "spec": "{\n $schema: https://vega.github.io/schema/vega/v5.0.json\n data: [\n {\n // query ES based on the currently selected time range and filter string\n name: rawData\n url: {\n %context%: true\n %timefield%: @timestamp\n index: logs-microsoft_exchange_online_message_trace.log-*\n body: {\n size: 0\n aggs: {\n table: {\n composite: {\n size: 10000\n sources: [\n {\n stk1: {\n terms: {field: \"source.geo.country_iso_code\"}\n }\n }\n {\n stk2: {\n terms: {field: \"destination.geo.country_iso_code\"}\n }\n }\n ]\n }\n }\n }\n }\n }\n // From the result, take just the data we are interested in\n format: {property: \"aggregations.table.buckets\"}\n // Convert key.stk1 -\u003e stk1 for simpler access below\n transform: [\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\n ]\n }\n {\n name: nodes\n source: rawData\n transform: [\n // when a country is selected, filter out unrelated data\n {\n type: filter\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\n }\n // Set new key for later lookups - identifies each node\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\n // instead of each table row, create two new rows,\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\n {\n type: fold\n fields: [\"stk1\", \"stk2\"]\n as: [\"stack\", \"grpId\"]\n }\n // Create a sortkey, different for stk1 and stk2 stacks.\n // Space separator ensures proper sort order in some corner cases.\n {\n type: formula\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\n as: sortField\n }\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\n // independently for each stack, and ensuring they are in the proper order,\n // alphabetical from the top (reversed on the y axis)\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"sortField\", order: \"descending\"}\n field: size\n }\n // calculate vertical center point for each node, used to draw edges\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\n ]\n }\n {\n name: groups\n source: nodes\n transform: [\n // combine all nodes into country groups, summing up the doc counts\n {\n type: aggregate\n groupby: [\"stack\", \"grpId\"]\n fields: [\"size\"]\n ops: [\"sum\"]\n as: [\"total\"]\n }\n // re-calculate the stacking y0,y1 values\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"grpId\", order: \"descending\"}\n field: total\n }\n // project y0 and y1 values to screen coordinates\n // doing it once here instead of doing it several times in marks\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\n // boolean flag if the label should be on the right of the stack\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\n // Calculate traffic percentage for this country using \"y\" scale\n // domain upper bound, which represents the total traffic\n {\n type: formula\n expr: datum.total/domain('y')[1]\n as: percentage\n }\n ]\n }\n {\n // This is a temp lookup table with all the 'stk2' stack nodes\n name: destinationNodes\n source: nodes\n transform: [\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\n ]\n }\n {\n name: edges\n source: nodes\n transform: [\n // we only want nodes from the left stack\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\n // find corresponding node from the right stack, keep it as \"target\"\n {\n type: lookup\n from: destinationNodes\n key: key\n fields: [\"key\"]\n as: [\"target\"]\n }\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\n {\n type: linkpath\n orient: horizontal\n shape: diagonal\n sourceY: {expr: \"scale('y', datum.yc)\"}\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\n targetY: {expr: \"scale('y', datum.target.yc)\"}\n targetX: {expr: \"scale('x', 'stk2')\"}\n }\n // A little trick to calculate the thickness of the line.\n // The value needs to be the same as the hight of the node, but scaling\n // size to screen's height gives inversed value because screen's Y\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\n // is at the bottom. So subtracting scaled doc count from screen height\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\n {\n type: formula\n expr: range('y')[0]-scale('y', datum.size)\n as: strokeWidth\n }\n // Tooltip needs individual link's percentage of all traffic\n {\n type: formula\n expr: datum.size/domain('y')[1]\n as: percentage\n }\n ]\n }\n ]\n scales: [\n {\n // calculates horizontal stack positioning\n name: x\n type: band\n range: width\n domain: [\"stk1\", \"stk2\"]\n paddingOuter: 0.05\n paddingInner: 0.95\n }\n {\n // this scale goes up as high as the highest y1 value of all nodes\n name: y\n type: linear\n range: height\n domain: {data: \"nodes\", field: \"y1\"}\n }\n {\n // use rawData to ensure the colors stay the same when clicking.\n name: color\n type: ordinal\n range: category\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\n }\n {\n // this scale is used to map internal ids (stk1, stk2) to stack names\n name: stackNames\n type: ordinal\n range: [\"Source\", \"Destination\"]\n domain: [\"stk1\", \"stk2\"]\n }\n ]\n axes: [\n {\n // x axis should use custom label formatting to print proper stack names\n orient: bottom\n scale: x\n encode: {\n labels: {\n update: {\n text: {scale: \"stackNames\", field: \"value\"}\n }\n }\n }\n }\n {orient: \"left\", scale: \"y\"}\n ]\n marks: [\n {\n // draw the connecting line between stacks\n type: path\n name: edgeMark\n from: {data: \"edges\"}\n // this prevents some autosizing issues with large strokeWidth for paths\n clip: true\n encode: {\n update: {\n // By default use color of the left node, except when showing traffic\n // from just one country, in which case use destination color.\n stroke: [\n {\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\n scale: color\n field: stk2\n }\n {scale: \"color\", field: \"stk1\"}\n ]\n strokeWidth: {field: \"strokeWidth\"}\n path: {field: \"path\"}\n // when showing all traffic, and hovering over a country,\n // highlight the traffic from that country.\n strokeOpacity: {\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\n }\n // Ensure that the hover-selected edges show on top\n zindex: {\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\n }\n // format tooltip string\n tooltip: {\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n // Simple mouseover highlighting of a single line\n hover: {\n strokeOpacity: {value: 1}\n }\n }\n }\n {\n // draw stack groups (countries)\n type: rect\n name: groupMark\n from: {data: \"groups\"}\n encode: {\n enter: {\n fill: {scale: \"color\", field: \"grpId\"}\n width: {scale: \"x\", band: 1}\n }\n update: {\n x: {scale: \"x\", field: \"stack\"}\n y: {field: \"scaledY0\"}\n y2: {field: \"scaledY1\"}\n fillOpacity: {value: 0.6}\n tooltip: {\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n hover: {\n fillOpacity: {value: 1}\n }\n }\n }\n {\n // draw country code labels on the inner side of the stack\n type: text\n from: {data: \"groups\"}\n // don't process events for the labels - otherwise line mouseover is unclean\n interactive: false\n encode: {\n update: {\n // depending on which stack it is, position x with some padding\n x: {\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\n }\n // middle of the group\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n // only show text label if the group's height is large enough\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\n }\n }\n }\n {\n // Create a \"show all\" button. Shown only when a country is selected.\n type: group\n data: [\n // We need to make the button show only when groupSelector signal is true.\n // Each mark is drawn as many times as there are elements in the backing data.\n // Which means that if values list is empty, it will not be drawn.\n // Here I create a data source with one empty object, and filter that list\n // based on the signal value. This can only be done in a group.\n {\n name: dataForShowAll\n values: [{}]\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\n }\n ]\n // Set button size and positioning\n encode: {\n enter: {\n xc: {signal: \"width/2\"}\n y: {value: 30}\n width: {value: 80}\n height: {value: 30}\n }\n }\n marks: [\n {\n // This group is shown as a button with rounded corners.\n type: group\n // mark name allows signal capturing\n name: groupReset\n // Only shows button if dataForShowAll has values.\n from: {data: \"dataForShowAll\"}\n encode: {\n enter: {\n cornerRadius: {value: 6}\n fill: {value: \"#f5f5f5\"}\n stroke: {value: \"#c1c1c1\"}\n strokeWidth: {value: 2}\n // use parent group's size\n height: {\n field: {group: \"height\"}\n }\n width: {\n field: {group: \"width\"}\n }\n }\n update: {\n // groups are transparent by default\n opacity: {value: 1}\n }\n hover: {\n opacity: {value: 0.7}\n }\n }\n marks: [\n {\n type: text\n // if true, it will prevent clicking on the button when over text.\n interactive: false\n encode: {\n enter: {\n // center text in the paren group\n xc: {\n field: {group: \"width\"}\n mult: 0.5\n }\n yc: {\n field: {group: \"height\"}\n mult: 0.5\n offset: 2\n }\n align: {value: \"center\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n text: {value: \"Show All\"}\n }\n }\n }\n ]\n }\n ]\n }\n ]\n signals: [\n {\n // used to highlight traffic to/from the same country\n name: groupHover\n value: {}\n on: [\n {\n events: @groupMark:mouseover\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\n }\n {events: \"mouseout\", update: \"{}\"}\n ]\n }\n // used to filter only the data related to the selected country\n {\n name: groupSelector\n value: false\n on: [\n {\n // Clicking groupMark sets this signal to the filter values\n events: @groupMark:click!\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\n }\n {\n // Clicking \"show all\" button, or double-clicking anywhere resets it\n events: [\n {type: \"click\", markname: \"groupReset\"}\n {type: \"dblclick\"}\n ]\n update: \"false\"\n }\n ]\n }\n ]\n}" - }, - "title": "", - "type": "vega", - "uiState": {} - } - }, - "gridData": { - "h": 15, - "i": "5f4dbbba-5840-492f-ab48-69721dbbba51", - "w": 24, - "x": 24, - "y": 0 - }, - "panelIndex": "5f4dbbba-5840-492f-ab48-69721dbbba51", - "title": "Mail Flow (Country)", - "type": "visualization", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -96,18 +62,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-cb547632-31dc-42a1-bfbe-b9bf17637acb", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-cb547632-31dc-42a1-bfbe-b9bf17637acb", + "name": "888edf7e-6193-4c2a-af73-6576c0d8508f", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cb547632-31dc-42a1-bfbe-b9bf17637acb": { "columnOrder": [ @@ -140,18 +107,20 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", "sourceField": "@timestamp" }, "e0f4fa4b-a79c-4128-b81e-575347b704a6": { + "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count of records", + "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -159,10 +128,34 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "888edf7e-6193-4c2a-af73-6576c0d8508f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" " + "query": "" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -197,6 +190,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "area_percentage_stacked", @@ -229,45 +223,168 @@ "y": 15 }, "panelIndex": "71c01d75-9955-4120-9fd7-ebf99b4319f0", - "title": "Mail Direction", + "title": "Mail Direction [Microsoft Exchange Online Message Trace]", "type": "lens", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b1566818-56fb-406d-a235-9b62ecc90a03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2d2540f-b49a-4b8a-a97a-f370617318bb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b1566818-56fb-406d-a235-9b62ecc90a03": { + "columnOrder": [ + "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa", + "d7263df5-c94b-43be-b984-0f1086278be3" + ], + "columns": { + "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d7263df5-c94b-43be-b984-0f1086278be3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "File size of email attachments", + "operationType": "sum", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "email.attachments.file.size" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e2d2540f-b49a-4b8a-a97a-f370617318bb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d7263df5-c94b-43be-b984-0f1086278be3" + ], + "layerId": "b1566818-56fb-406d-a235-9b62ecc90a03", + "layerType": "data", + "position": "top", + "seriesType": "area", + "showGridlines": false, + "xAccessor": "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" } } }, - "description": "", - "params": { - "spec": "{\n $schema: https://vega.github.io/schema/vega/v5.0.json\n data: [\n {\n // query ES based on the currently selected time range and filter string\n name: rawData\n url: {\n %context%: true\n %timefield%: @timestamp\n index: logs-microsoft_exchange_online_message_trace.log-*\n body: {\n size: 0\n aggs: {\n table: {\n composite: {\n size: 10000\n sources: [\n {\n stk1: {\n terms: {field: \"source.as.organization.name\"}\n }\n }\n {\n stk2: {\n terms: {field: \"destination.as.organization.name\"}\n }\n }\n ]\n }\n }\n }\n }\n }\n // From the result, take just the data we are interested in\n format: {property: \"aggregations.table.buckets\"}\n // Convert key.stk1 -\u003e stk1 for simpler access below\n transform: [\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\n ]\n }\n {\n name: nodes\n source: rawData\n transform: [\n // when a country is selected, filter out unrelated data\n {\n type: filter\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\n }\n // Set new key for later lookups - identifies each node\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\n // instead of each table row, create two new rows,\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\n {\n type: fold\n fields: [\"stk1\", \"stk2\"]\n as: [\"stack\", \"grpId\"]\n }\n // Create a sortkey, different for stk1 and stk2 stacks.\n // Space separator ensures proper sort order in some corner cases.\n {\n type: formula\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\n as: sortField\n }\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\n // independently for each stack, and ensuring they are in the proper order,\n // alphabetical from the top (reversed on the y axis)\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"sortField\", order: \"descending\"}\n field: size\n }\n // calculate vertical center point for each node, used to draw edges\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\n ]\n }\n {\n name: groups\n source: nodes\n transform: [\n // combine all nodes into country groups, summing up the doc counts\n {\n type: aggregate\n groupby: [\"stack\", \"grpId\"]\n fields: [\"size\"]\n ops: [\"sum\"]\n as: [\"total\"]\n }\n // re-calculate the stacking y0,y1 values\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"grpId\", order: \"descending\"}\n field: total\n }\n // project y0 and y1 values to screen coordinates\n // doing it once here instead of doing it several times in marks\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\n // boolean flag if the label should be on the right of the stack\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\n // Calculate traffic percentage for this country using \"y\" scale\n // domain upper bound, which represents the total traffic\n {\n type: formula\n expr: datum.total/domain('y')[1]\n as: percentage\n }\n ]\n }\n {\n // This is a temp lookup table with all the 'stk2' stack nodes\n name: destinationNodes\n source: nodes\n transform: [\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\n ]\n }\n {\n name: edges\n source: nodes\n transform: [\n // we only want nodes from the left stack\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\n // find corresponding node from the right stack, keep it as \"target\"\n {\n type: lookup\n from: destinationNodes\n key: key\n fields: [\"key\"]\n as: [\"target\"]\n }\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\n {\n type: linkpath\n orient: horizontal\n shape: diagonal\n sourceY: {expr: \"scale('y', datum.yc)\"}\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\n targetY: {expr: \"scale('y', datum.target.yc)\"}\n targetX: {expr: \"scale('x', 'stk2')\"}\n }\n // A little trick to calculate the thickness of the line.\n // The value needs to be the same as the hight of the node, but scaling\n // size to screen's height gives inversed value because screen's Y\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\n // is at the bottom. So subtracting scaled doc count from screen height\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\n {\n type: formula\n expr: range('y')[0]-scale('y', datum.size)\n as: strokeWidth\n }\n // Tooltip needs individual link's percentage of all traffic\n {\n type: formula\n expr: datum.size/domain('y')[1]\n as: percentage\n }\n ]\n }\n ]\n scales: [\n {\n // calculates horizontal stack positioning\n name: x\n type: band\n range: width\n domain: [\"stk1\", \"stk2\"]\n paddingOuter: 0.05\n paddingInner: 0.95\n }\n {\n // this scale goes up as high as the highest y1 value of all nodes\n name: y\n type: linear\n range: height\n domain: {data: \"nodes\", field: \"y1\"}\n }\n {\n // use rawData to ensure the colors stay the same when clicking.\n name: color\n type: ordinal\n range: category\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\n }\n {\n // this scale is used to map internal ids (stk1, stk2) to stack names\n name: stackNames\n type: ordinal\n range: [\"Source\", \"Destination\"]\n domain: [\"stk1\", \"stk2\"]\n }\n ]\n axes: [\n {\n // x axis should use custom label formatting to print proper stack names\n orient: bottom\n scale: x\n encode: {\n labels: {\n update: {\n text: {scale: \"stackNames\", field: \"value\"}\n }\n }\n }\n }\n {orient: \"left\", scale: \"y\"}\n ]\n marks: [\n {\n // draw the connecting line between stacks\n type: path\n name: edgeMark\n from: {data: \"edges\"}\n // this prevents some autosizing issues with large strokeWidth for paths\n clip: true\n encode: {\n update: {\n // By default use color of the left node, except when showing traffic\n // from just one country, in which case use destination color.\n stroke: [\n {\n test: groupSelector \u0026\u0026 groupSelector.stack=='stk1'\n scale: color\n field: stk2\n }\n {scale: \"color\", field: \"stk1\"}\n ]\n strokeWidth: {field: \"strokeWidth\"}\n path: {field: \"path\"}\n // when showing all traffic, and hovering over a country,\n // highlight the traffic from that country.\n strokeOpacity: {\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\n }\n // Ensure that the hover-selected edges show on top\n zindex: {\n signal: !groupSelector \u0026\u0026 (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\n }\n // format tooltip string\n tooltip: {\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n // Simple mouseover highlighting of a single line\n hover: {\n strokeOpacity: {value: 1}\n }\n }\n }\n {\n // draw stack groups (countries)\n type: rect\n name: groupMark\n from: {data: \"groups\"}\n encode: {\n enter: {\n fill: {scale: \"color\", field: \"grpId\"}\n width: {scale: \"x\", band: 1}\n }\n update: {\n x: {scale: \"x\", field: \"stack\"}\n y: {field: \"scaledY0\"}\n y2: {field: \"scaledY1\"}\n fillOpacity: {value: 0.6}\n tooltip: {\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n hover: {\n fillOpacity: {value: 1}\n }\n }\n }\n {\n // draw country code labels on the inner side of the stack\n type: text\n from: {data: \"groups\"}\n // don't process events for the labels - otherwise line mouseover is unclean\n interactive: false\n encode: {\n update: {\n // depending on which stack it is, position x with some padding\n x: {\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\n }\n // middle of the group\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n // only show text label if the group's height is large enough\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) \u003e 13 ? datum.grpId : ''\"}\n }\n }\n }\n {\n // Create a \"show all\" button. Shown only when a country is selected.\n type: group\n data: [\n // We need to make the button show only when groupSelector signal is true.\n // Each mark is drawn as many times as there are elements in the backing data.\n // Which means that if values list is empty, it will not be drawn.\n // Here I create a data source with one empty object, and filter that list\n // based on the signal value. This can only be done in a group.\n {\n name: dataForShowAll\n values: [{}]\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\n }\n ]\n // Set button size and positioning\n encode: {\n enter: {\n xc: {signal: \"width/2\"}\n y: {value: 30}\n width: {value: 80}\n height: {value: 30}\n }\n }\n marks: [\n {\n // This group is shown as a button with rounded corners.\n type: group\n // mark name allows signal capturing\n name: groupReset\n // Only shows button if dataForShowAll has values.\n from: {data: \"dataForShowAll\"}\n encode: {\n enter: {\n cornerRadius: {value: 6}\n fill: {value: \"#f5f5f5\"}\n stroke: {value: \"#c1c1c1\"}\n strokeWidth: {value: 2}\n // use parent group's size\n height: {\n field: {group: \"height\"}\n }\n width: {\n field: {group: \"width\"}\n }\n }\n update: {\n // groups are transparent by default\n opacity: {value: 1}\n }\n hover: {\n opacity: {value: 0.7}\n }\n }\n marks: [\n {\n type: text\n // if true, it will prevent clicking on the button when over text.\n interactive: false\n encode: {\n enter: {\n // center text in the paren group\n xc: {\n field: {group: \"width\"}\n mult: 0.5\n }\n yc: {\n field: {group: \"height\"}\n mult: 0.5\n offset: 2\n }\n align: {value: \"center\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n text: {value: \"Show All\"}\n }\n }\n }\n ]\n }\n ]\n }\n ]\n signals: [\n {\n // used to highlight traffic to/from the same country\n name: groupHover\n value: {}\n on: [\n {\n events: @groupMark:mouseover\n update: \"{stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\n }\n {events: \"mouseout\", update: \"{}\"}\n ]\n }\n // used to filter only the data related to the selected country\n {\n name: groupSelector\n value: false\n on: [\n {\n // Clicking groupMark sets this signal to the filter values\n events: @groupMark:click!\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' \u0026\u0026 datum.grpId, stk2:datum.stack=='stk2' \u0026\u0026 datum.grpId}\"\n }\n {\n // Clicking \"show all\" button, or double-clicking anywhere resets it\n events: [\n {type: \"click\", markname: \"groupReset\"}\n {type: \"dblclick\"}\n ]\n update: \"false\"\n }\n ]\n }\n ]\n}" - }, "title": "", - "type": "vega", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "974f08f7-b0ab-423a-ac99-cbf755b99c17", + "i": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c", "w": 24, "x": 24, - "y": 15 + "y": 30 }, - "panelIndex": "974f08f7-b0ab-423a-ac99-cbf755b99c17", - "title": "Mail Flow (AS)", - "type": "visualization", - "version": "8.0.0" + "panelIndex": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c", + "title": "Traffic [Microsoft Exchange Online Message Trace]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -275,18 +392,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-70bcbbe4-f13c-4195-8ba1-1677a2361c81", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-70bcbbe4-f13c-4195-8ba1-1677a2361c81", + "name": "0af8a07d-9dab-48aa-aa7f-b759141f0c9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ed0b57a7-1de2-431f-b05d-7ca6edbaa0e2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "70bcbbe4-f13c-4195-8ba1-1677a2361c81": { "columnOrder": [ @@ -319,18 +442,20 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", "sourceField": "@timestamp" }, "d863a9e2-141e-4e6a-81d1-106274aa75c8": { + "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count of records", + "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -338,10 +463,80 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0af8a07d-9dab-48aa-aa7f-b759141f0c9c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.outcome", + "index": "ed0b57a7-1de2-431f-b05d-7ca6edbaa0e2", + "key": "event.outcome", + "negate": false, + "params": [ + "Delivered", + "FilteredAsSpam", + "Quarantined" + ], + "type": "phrases", + "value": [ + "Delivered", + "FilteredAsSpam", + "Quarantined" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.outcome": "Delivered" + } + }, + { + "match_phrase": { + "event.outcome": "FilteredAsSpam" + } + }, + { + "match_phrase": { + "event.outcome": "Quarantined" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" and (event.outcome : \"Delivered\" or event.outcome: \"FilteredAsSpam\" or event.outcome : \"Quarantined\" )" + "query": "" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -376,6 +571,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -408,9 +604,9 @@ "y": 30 }, "panelIndex": "7b8f5d22-68a8-4e10-bbb7-16858e68749d", - "title": "Mail Status", + "title": "Mail Status [Microsoft Exchange Online Message Trace]", "type": "lens", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -418,18 +614,19 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-25ce29dc-65f6-4560-b323-17e3d58b17fb", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-25ce29dc-65f6-4560-b323-17e3d58b17fb", + "name": "d0dd97b2-c5f9-4508-869d-c0f2fe818866", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "25ce29dc-65f6-4560-b323-17e3d58b17fb": { "columnOrder": [ @@ -441,7 +638,7 @@ "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top Recipients", + "label": "Address", "operationType": "terms", "params": { "missingBucket": false, @@ -457,12 +654,13 @@ "sourceField": "email.to.address" }, "a9ebe8c9-d762-49e0-9494-95ded076529d": { + "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count of records", + "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -470,10 +668,34 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d0dd97b2-c5f9-4508-869d-c0f2fe818866", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" " + "query": "" }, "visualization": { "columns": [ @@ -485,7 +707,9 @@ } ], "layerId": "25ce29dc-65f6-4560-b323-17e3d58b17fb", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -503,9 +727,9 @@ "y": 45 }, "panelIndex": "952624da-7dad-45b7-a8a3-98853634f7b2", - "title": "Top Recipients", + "title": "Top Recipients [Microsoft Exchange Online Message Trace]", "type": "lens", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -513,18 +737,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-7415119f-c228-4398-8e06-0a5a45c19e24", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-7415119f-c228-4398-8e06-0a5a45c19e24", + "name": "14c0616b-7964-4c3b-9ff0-cdef0a3986f3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2df4a378-8fb8-4c87-9826-f7f75a7e1acf", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7415119f-c228-4398-8e06-0a5a45c19e24": { "columnOrder": [ @@ -533,18 +763,19 @@ ], "columns": { "48e6e8f0-1f07-46d1-9cd7-d3bbe2f8d615": { + "customLabel": true, "dataType": "number", "isBucketed": false, - "label": "Count of records", + "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "a06423a3-b607-4e14-9bdc-b97b6f28fad6": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Top Senders", + "label": "Email", "operationType": "terms", "params": { "missingBucket": false, @@ -565,10 +796,73 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "14c0616b-7964-4c3b-9ff0-cdef0a3986f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "email.direction", + "index": "2df4a378-8fb8-4c87-9826-f7f75a7e1acf", + "key": "email.direction", + "negate": false, + "params": [ + "outbound", + "internal" + ], + "type": "phrases", + "value": [ + "outbound", + "internal" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "email.direction": "outbound" + } + }, + { + "match_phrase": { + "email.direction": "internal" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" and (email.direction : \"outbound\" or email.direction : \"internal\" )" + "query": "" }, "visualization": { "columns": [ @@ -580,7 +874,9 @@ } ], "layerId": "7415119f-c228-4398-8e06-0a5a45c19e24", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -598,9 +894,9 @@ "y": 45 }, "panelIndex": "a81446a8-8849-4877-95bb-a6a51ecbaf87", - "title": "Top Senders", + "title": "Top Senders [Microsoft Exchange Online Message Trace]", "type": "lens", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -608,140 +904,359 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-3632a2b5-db4a-487c-a2e5-360c780c7010", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-b1566818-56fb-406d-a235-9b62ecc90a03", + "name": "45928779-c478-43cc-808d-aca4e2f3da9b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "b1566818-56fb-406d-a235-9b62ecc90a03": { + "3632a2b5-db4a-487c-a2e5-360c780c7010": { "columnOrder": [ - "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa", - "d7263df5-c94b-43be-b984-0f1086278be3" + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff", + "500bd77f-3178-4129-afe6-7419263c845a", + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5" ], "columns": { - "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa": { - "dataType": "date", + "500bd77f-3178-4129-afe6-7419263c845a": { + "customLabel": true, + "dataType": "string", "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", + "label": "Destination", + "operationType": "terms", "params": { - "interval": "auto" + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 }, - "scale": "interval", - "sourceField": "@timestamp" + "scale": "ordinal", + "sourceField": "destination.geo.country_iso_code" }, - "d7263df5-c94b-43be-b984-0f1086278be3": { + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5": { "dataType": "number", "isBucketed": false, - "label": "Sum of email.attachments.file.size", - "operationType": "sum", + "label": "Count of records", + "operationType": "count", "params": { - "format": { - "id": "bytes", - "params": { - "decimals": 2 - } - } + "emptyAsNull": true }, "scale": "ratio", - "sourceField": "email.attachments.file.size" + "sourceField": "___records___" + }, + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "accuracyMode": false, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_iso_code" } }, - "incompleteColumns": {} + "incompleteColumns": {}, + "sampling": 1 } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "45928779-c478-43cc-808d-aca4e2f3da9b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "event.dataset : \"microsoft_exchange_online_message_trace.log\" " + "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, "layers": [ { - "accessors": [ - "d7263df5-c94b-43be-b984-0f1086278be3" - ], - "layerId": "b1566818-56fb-406d-a235-9b62ecc90a03", + "allowMultipleMetrics": false, + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "3632a2b5-db4a-487c-a2e5-360c780c7010", "layerType": "data", - "position": "top", - "seriesType": "area", - "showGridlines": false, - "xAccessor": "0a09f8ad-9e04-41de-8ae8-29560c3bb2fa" + "legendDisplay": "show", + "legendMaxLines": 1, + "metrics": [ + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff", + "500bd77f-3178-4129-afe6-7419263c845a" + ], + "truncateLegend": true } ], - "legend": { - "isVisible": true, - "position": "right" + "palette": { + "name": "default", + "type": "palette" }, - "preferredSeriesType": "area", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "description": "It represents the traffic flow between source (inner donut) and the destination for each source (outer donut)", + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "1587f296-366b-45f4-8af4-465a5bd01708", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "1587f296-366b-45f4-8af4-465a5bd01708", + "title": "Top Destination countries by Source [Microsoft Exchange Online Message Trace]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3632a2b5-db4a-487c-a2e5-360c780c7010", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e76e0cca-6b3d-4dcc-b10f-27bb7cad2897", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3632a2b5-db4a-487c-a2e5-360c780c7010": { + "columnOrder": [ + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff", + "9f8419c4-bfa6-459c-b180-83267ad33bc7", + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5" + ], + "columns": { + "9f8419c4-bfa6-459c-b180-83267ad33bc7": { + "dataType": "string", + "isBucketed": true, + "label": "Top 3 values of destination.as.organization.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + }, + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of source.as.organization.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.as.organization.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - "yRightExtent": { - "mode": "full" + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e76e0cca-6b3d-4dcc-b10f-27bb7cad2897", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "microsoft_exchange_online_message_trace.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "microsoft_exchange_online_message_trace.log" + } + } } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "3632a2b5-db4a-487c-a2e5-360c780c7010", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "ad0f9c0e-1a2f-4ab8-a91b-b6ee82daf7c5" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "primaryGroups": [ + "ca598a94-8f6a-4f20-97c6-3ac98d0ecaff", + "9f8419c4-bfa6-459c-b180-83267ad33bc7" + ] + } + ], + "shape": "donut" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsPie" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c", + "i": "2e100eaa-3c92-4b1d-9df1-9a4e5471530f", "w": 24, "x": 24, - "y": 30 + "y": 15 }, - "panelIndex": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c", - "title": "Traffic", + "panelIndex": "2e100eaa-3c92-4b1d-9df1-9a4e5471530f", + "title": "Top Destination AS by Source [Microsoft Exchange Online Message Trace]", "type": "lens", - "version": "8.0.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Microsoft Exchange Online Message Trace] Overview", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T13:05:12.627Z", "id": "microsoft_exchange_online_message_trace-10b79960-536a-11ed-869d-9d6d140defa1", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -751,17 +1266,22 @@ }, { "id": "logs-*", - "name": "71c01d75-9955-4120-9fd7-ebf99b4319f0:indexpattern-datasource-current-indexpattern", + "name": "71c01d75-9955-4120-9fd7-ebf99b4319f0:indexpattern-datasource-layer-cb547632-31dc-42a1-bfbe-b9bf17637acb", "type": "index-pattern" }, { "id": "logs-*", - "name": "71c01d75-9955-4120-9fd7-ebf99b4319f0:indexpattern-datasource-layer-cb547632-31dc-42a1-bfbe-b9bf17637acb", + "name": "71c01d75-9955-4120-9fd7-ebf99b4319f0:888edf7e-6193-4c2a-af73-6576c0d8508f", "type": "index-pattern" }, { "id": "logs-*", - "name": "7b8f5d22-68a8-4e10-bbb7-16858e68749d:indexpattern-datasource-current-indexpattern", + "name": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c:indexpattern-datasource-layer-b1566818-56fb-406d-a235-9b62ecc90a03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c:e2d2540f-b49a-4b8a-a97a-f370617318bb", "type": "index-pattern" }, { @@ -771,7 +1291,12 @@ }, { "id": "logs-*", - "name": "952624da-7dad-45b7-a8a3-98853634f7b2:indexpattern-datasource-current-indexpattern", + "name": "7b8f5d22-68a8-4e10-bbb7-16858e68749d:0af8a07d-9dab-48aa-aa7f-b759141f0c9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b8f5d22-68a8-4e10-bbb7-16858e68749d:ed0b57a7-1de2-431f-b05d-7ca6edbaa0e2", "type": "index-pattern" }, { @@ -781,7 +1306,7 @@ }, { "id": "logs-*", - "name": "a81446a8-8849-4877-95bb-a6a51ecbaf87:indexpattern-datasource-current-indexpattern", + "name": "952624da-7dad-45b7-a8a3-98853634f7b2:d0dd97b2-c5f9-4508-869d-c0f2fe818866", "type": "index-pattern" }, { @@ -791,12 +1316,32 @@ }, { "id": "logs-*", - "name": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c:indexpattern-datasource-current-indexpattern", + "name": "a81446a8-8849-4877-95bb-a6a51ecbaf87:14c0616b-7964-4c3b-9ff0-cdef0a3986f3", "type": "index-pattern" }, { "id": "logs-*", - "name": "fa345782-8bdd-4bbb-a2aa-b76378acaf7c:indexpattern-datasource-layer-b1566818-56fb-406d-a235-9b62ecc90a03", + "name": "a81446a8-8849-4877-95bb-a6a51ecbaf87:2df4a378-8fb8-4c87-9826-f7f75a7e1acf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1587f296-366b-45f4-8af4-465a5bd01708:indexpattern-datasource-layer-3632a2b5-db4a-487c-a2e5-360c780c7010", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1587f296-366b-45f4-8af4-465a5bd01708:45928779-c478-43cc-808d-aca4e2f3da9b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2e100eaa-3c92-4b1d-9df1-9a4e5471530f:indexpattern-datasource-layer-3632a2b5-db4a-487c-a2e5-360c780c7010", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2e100eaa-3c92-4b1d-9df1-9a4e5471530f:e76e0cca-6b3d-4dcc-b10f-27bb7cad2897", "type": "index-pattern" } ], diff --git a/packages/microsoft_exchange_online_message_trace/kibana/tags.yml b/packages/microsoft_exchange_online_message_trace/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/microsoft_exchange_online_message_trace/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/microsoft_exchange_online_message_trace/manifest.yml b/packages/microsoft_exchange_online_message_trace/manifest.yml index 45d67c0c42a..4388d2688b7 100644 --- a/packages/microsoft_exchange_online_message_trace/manifest.yml +++ b/packages/microsoft_exchange_online_message_trace/manifest.yml @@ -1,17 +1,17 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: microsoft_exchange_online_message_trace title: "Microsoft Exchange Online Message Trace" -version: "1.5.0" -release: ga -license: basic +version: "1.12.0" description: "Microsoft Exchange Online Message Trace Integration" type: integration categories: - security - email_security conditions: - kibana.version: "^8.7.1" - elastic.subscription: "basic" + kibana: + version: "^8.7.1" + elastic: + subscription: "basic" icons: - src: /img/logo.svg title: Microsoft Exchange Online Logo @@ -112,7 +112,7 @@ policy_templates: - name: interval type: text title: Interval - description: Duration between requests to Exchange Online + description: Duration between requests to Exchange Online. Supported units for this parameter are h/m/s. default: 1m multi: false required: true @@ -120,7 +120,7 @@ policy_templates: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the initial log from Exchange Online + description: How far back to pull the initial log from Exchange Online. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -128,7 +128,7 @@ policy_templates: - name: request_timeout type: text title: Request Timeout - description: How long to wait for the request to timeout. + description: How long to wait for the request to timeout. Valid time units are ns, us, ms, s, m, h. default: 60s multi: false required: true @@ -181,3 +181,4 @@ policy_templates: show_user: true owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/microsoft_sqlserver/_dev/build/docs/README.md b/packages/microsoft_sqlserver/_dev/build/docs/README.md index f1029208246..acc36611542 100644 --- a/packages/microsoft_sqlserver/_dev/build/docs/README.md +++ b/packages/microsoft_sqlserver/_dev/build/docs/README.md @@ -1,55 +1,58 @@ # Microsoft SQL Server Integration -The Microsoft SQL Server integration package allows you to search, observe and visualize the SQL Server audit logs and metrics through Elasticsearch. +The Microsoft SQL Server integration package allows you to search, observe and visualize the SQL Server audit logs, as well as performance and transaction log metrics, through Elasticsearch. + +Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine. + +SQL Server audit lets you create server audits, which can contain server audit specifications for server-level events, and database audit specifications for database-level events. -Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine. -SQL Server audit lets you create server audits, which can contain server audit specifications for server level events, and database audit specifications for database level events. See: [SQL Server Audit page](https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine?view=sql-server-ver15) for more information on SQL Server auditing. `performance` metrics gathers the list of performance objects available on that server. Each server will have a different list of performance objects depending on the installed software. + `transaction_log` metrics collects all usage stats and the total space usage. ## Named Instance -Microsoft SQL Server has a feature that allows running multiple databases on the same host (or clustered hosts) with separate settings. Establish named instance connection by using the instance name along with the host name (Ex: `host/instance_name` or `host:named_instance_port`) to collect metrics. Details of the host configuration is provided below. +Microsoft SQL Server has a feature that allows running multiple databases on the same host (or clustered hosts) with separate settings. Establish a named instance connection by using the instance name along with the hostname (e.g. `host/instance_name` or `host:named_instance_port`) to collect metrics. Details of the host configuration are provided below. ### Query by Instance Name or Server Name in Kibana -The data can be visualized in Kibana by filtering based on the instance name and server name. The instance name can be filtered by `mssql.metrics.instance_name` and server name by `mssql.metrics.server_name` fields. +The data can be visualized in Kibana by filtering based on the instance name and server name. The instance name can be filtered by `mssql.metrics.instance_name` and the server name by `mssql.metrics.server_name` fields. ## Permission/Access required for tables -If you browse MSDN for the following tables, you will find a "Permissions" section which defines the permission needed for each table, e.g [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15) Permissions section. +If you browse MSDN for the following tables, you will find a "Permissions" section that defines the permission needed for each table, e.g. [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15) Permissions section. -### 1.transaction_log +### 1. transaction_log - [sys.databases](https://learn.microsoft.com/en-us/sql/relational-databases/system-compatibility-views/sys-sysdatabases-transact-sql?view=sql-server-ver16) - [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver16) - [sys.dm_db_log_stats (DB_ID)](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-stats-transact-sql?view=sql-server-ver16) -### 2.performance +### 2. performance - [sys.dm_os_performance_counters](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-os-performance-counters-transact-sql?view=sql-server-ver16) ## Host Configuration -Integration supports collecting metrics from single host. For multi host metrics, each host can be run as a new integration. +Integration supports collecting metrics from a single host. For multi-host metrics, each host can be run as a new integration. -As part of the input configuration, need to provide the user name, password and the host details. The host configuration supports both named instance or default(no-name) instance, as per the syntax below. +As part of the input configuration, need to provide the user name, password and host details. The host configuration supports both named instances or default(no-name) instances, as per the syntax below. ### Connecting to Default Instance (host) -* `host` ex: `localhost` (Instance name is not needed when connecting to default instance) or -* `host:port ` ex: `localhost:1433` +* `host` (e.g. `localhost` (Instance name is not needed when connecting to default instance)) +* `host:port` (e.g. `localhost:1433`) ### Connecting to Named Instance (host) -* `host/instance_name` ex: `localhost/namedinstance_01` or -* `host:named_instance_port` ex: `localhost:60873` +* `host/instance_name` (e.g. `localhost/namedinstance_01`) +* `host:named_instance_port` (e.g. `localhost:60873`) ## Compatibility -The package collects `performance` and `transaction_log` metrics, and `audit` events from the event log. Other log sources such as file are not supported. +The package collects `performance` and `transaction_log` metrics, and `audit` events from the event log. Other log sources such as files are not supported. ## Configuration @@ -61,53 +64,59 @@ See: [SQL Server Audit Action Groups and Actions](https://docs.microsoft.com/en- See: [Instructions on how to enable auditing for SQL Server](https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-server-audit-specification?view=sql-server-ver15). ->Note: For the integration package to be able to read and send audit events the event target must be configured to be Windows event log. +> Note: For the integration package to be able to read and send audit events the event target must be configured to be Windows event log. -### audit events +### Audit events -Enable to collect SQL Server audit events from the specified windows event log channel. +Collects SQL Server audit events from the specified windows event log channel. -### log +### Log The SQL Server `log` contains user-defined events and certain system events you can use for troubleshooting. See: [View the SQL Server error log in SQL Server Management Studio](https://docs.microsoft.com/en-us/sql/relational-databases/performance/view-the-sql-server-error-log-sql-server-management-studio?view=sql-server-ver16) -### performance metrics +### Performance metrics -Collects the `performance` counter metrics. Dynamic counter feature provides flexibility to collect metrics by providing the counter as an input. +Collects the `performance` counter metrics. The dynamic counter feature provides flexibility to collect metrics by providing the counter as an input. This input can be a regular expression which will filter results based on pattern. -For example, if %grant% is given as input, it will enable metrics collection for all of the counters with name like 'Memory Grants Pending', 'Active memory grants count' etc. -MSSQL supports limited set of RegExp, See [here] (https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms187489(v=sql.105)?redirectedfrom=MSDN) for details. +For example, if %grant% is given as input, it will enable metrics collection for all of the counters with names like 'Memory Grants Pending', 'Active memory grants count' etc. +MSSQL supports a limited set of regular expressions, See [here](https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms187489(v=sql.105)?redirectedfrom=MSDN) for details. ->Note: Dynamic counters will go through some basic ingest pipeline post-processing to make counter names in lower case and remove special characters and these fields will not have any static field mappings. +> Note: Dynamic counters will go through some basic ingest pipeline post-processing to make counter names in lowercase and remove special characters and these fields will not have any static field mappings. -The feature `merge_results` has been introduced in 8.4 beats which create a single event by combining the metrics together in a single event. See [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-sql.html#_example_merge_multiple_queries_to_single_event) for details. +The feature `merge_results` has been introduced in 8.4 beats which creates a single event by combining the metrics together in a single event. See [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-sql.html#_example_merge_multiple_queries_to_single_event) for details. See: [Instructions about each performance counter metrics](https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-os-performance-counters-transact-sql?view=sql-server-ver15) -### transaction_log metrics +### Transaction log metrics Collects system level `transaction_log` metrics information for SQL Server instance. -Metrics for user level databases can be collected by providing list of user dbs for which metrics is to be collected. +Metrics for user-level databases can be collected by providing a list of user databases for which metrics are to be collected. See: [Instructions and the operations supported by transaction log](https://docs.microsoft.com/en-us/sql/relational-databases/logs/the-transaction-log-sql-server?view=sql-server-ver15) +### Fetch from all databases + +To simplify the process of fetching metrics from all databases on the server, you can enable the `Fetch from all databases` toggle when configuring the integration. This field overrides manually entered database names in the `Databases` input and instead fetches the required `transaction_log` metrics from all databases, including system and user-defined databases. + +Keep in mind that this feature is disabled by default and needs to be manually enabled to be activated. + ### Password URL encoding -When there are special characters in password, pass the special characters by using URL encoding. +When the password contains special characters, pass these special characters using URL encoding. ## Logs ### audit -The SQL Server audit dataset provides events from the configured Windows event log channel. All SQL Server audit specific fields are available in the `sqlserver.audit` field group. +The SQL Server audit dataset provides events from the configured Windows event log channel. All SQL Server audit-specific fields are available in the `sqlserver.audit` field group. {{fields "audit"}} ### log -The Microsoft SQL Server `log` dataset parses error logs created by Microsoft SQL server. +The Microsoft SQL Server `log` dataset parses error logs created by the Microsoft SQL server. {{event "log"}} @@ -117,7 +126,7 @@ The Microsoft SQL Server `log` dataset parses error logs created by Microsoft SQ ### performance -The Microsoft SQL Server `performance` dataset provides metrics from the performance counter table. All `performance` metrics will be available in `sqlserver.metrics` field group. +The Microsoft SQL Server `performance` dataset provides metrics from the performance counter table. All `performance` metrics will be available in the `sqlserver.metrics` field group. {{event "performance"}} @@ -125,7 +134,7 @@ The Microsoft SQL Server `performance` dataset provides metrics from the perform ### transaction_log -The Microsoft SQL Server `transaction_log` dataset provides metrics from the log space usage and log stats tables of the system databases. All `transaction_log` metrics will be available in `sqlserver.metrics` field group. +The Microsoft SQL Server `transaction_log` dataset provides metrics from the log space usage and log stats tables of the system databases. All `transaction_log` metrics will be available in the `sqlserver.metrics` field group. {{event "transaction_log"}} diff --git a/packages/microsoft_sqlserver/changelog.yml b/packages/microsoft_sqlserver/changelog.yml index 011c3fa6829..737e017e490 100644 --- a/packages/microsoft_sqlserver/changelog.yml +++ b/packages/microsoft_sqlserver/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "2.2.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "2.2.0" + changes: + - description: Add support for fetch_from_all_databases for Microsoft SQL server + type: enhancement + link: https://github.com/elastic/integrations/pull/7500 +- version: "2.1.1" + changes: + - description: Add ecs mapping for error.code to avoid type conflicts + type: bugfix + link: https://github.com/elastic/integrations/pull/6868 - version: "2.1.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/microsoft_sqlserver/data_stream/audit/fields/ecs.yml b/packages/microsoft_sqlserver/data_stream/audit/fields/ecs.yml index 3b8cd392c98..838b684674f 100644 --- a/packages/microsoft_sqlserver/data_stream/audit/fields/ecs.yml +++ b/packages/microsoft_sqlserver/data_stream/audit/fields/ecs.yml @@ -1,5 +1,9 @@ - external: ecs name: message +- external: ecs + name: error.message +- external: ecs + name: error.code - external: ecs name: destination.user.domain - external: ecs diff --git a/packages/microsoft_sqlserver/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/microsoft_sqlserver/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 8b093137ddb..8c6d9798136 100644 --- a/packages/microsoft_sqlserver/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/microsoft_sqlserver/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -5,6 +5,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - set: field: ecs.version value: '8.6.0' diff --git a/packages/microsoft_sqlserver/data_stream/performance/manifest.yml b/packages/microsoft_sqlserver/data_stream/performance/manifest.yml index 11ed8f62bc2..1d1c443a396 100644 --- a/packages/microsoft_sqlserver/data_stream/performance/manifest.yml +++ b/packages/microsoft_sqlserver/data_stream/performance/manifest.yml @@ -21,4 +21,4 @@ streams: title: Microsoft SQL Server performance metrics description: Collect Microsoft SQL Server performance metrics elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/microsoft_sqlserver/data_stream/transaction_log/agent/stream/stream.yml.hbs b/packages/microsoft_sqlserver/data_stream/transaction_log/agent/stream/stream.yml.hbs index 71c6c2aa029..32db2e48adf 100644 --- a/packages/microsoft_sqlserver/data_stream/transaction_log/agent/stream/stream.yml.hbs +++ b/packages/microsoft_sqlserver/data_stream/transaction_log/agent/stream/stream.yml.hbs @@ -1,19 +1,30 @@ metricsets: ["query"] -# Specify hosts in the below format. TODO:hosts need to be updated to support multiple entries. +# Specify hosts in the below format. TODO: hosts need to be updated to support multiple entries. hosts: - sqlserver://{{username}}:{{password}}@{{hosts}} period: {{period}} driver: mssql raw_data.enabled: true -# Collect the transaction logs from the system database +fetch_from_all_databases: {{fetch_from_all_databases}} + +# Collect the transaction logs from the database(s) sql_queries: -{{#if databases}} -{{#each databases as |database_name i|}} - - query: "SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', database_id FROM sys.databases WHERE name='{{database_name}}';" - response_format: table - - query: "SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', l.database_id, l.total_log_size_mb, l.active_log_size_mb,l.log_backup_time,l.log_since_last_log_backup_mb,l.log_since_last_checkpoint_mb,l.log_recovery_size_mb from sys.dm_db_log_stats(DB_ID('{{database_name}}')) l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID('{{database_name}}') ;" - response_format: table - - query: "USE [{{database_name}}] ; SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', l.database_id, l.total_log_size_in_bytes As total_log_size_bytes, l.used_log_space_in_bytes As used_log_space_bytes, l.used_log_space_in_percent As used_log_space_pct, l.log_space_in_bytes_since_last_backup from sys.dm_db_log_space_usage l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID('{{database_name}}') ;" - response_format: table -{{/each}} +{{#if fetch_from_all_databases}} +- query: "SELECT @@servername AS server_name, @@servicename AS instance_name, DB_NAME() AS 'database_name', DB_ID() AS database_id;" + response_format: table +- query: "SELECT @@servername AS server_name, @@servicename AS instance_name, DB_NAME() AS 'database_name', l.database_id, l.total_log_size_mb, l.active_log_size_mb,l.log_backup_time,l.log_since_last_log_backup_mb,l.log_since_last_checkpoint_mb,l.log_recovery_size_mb from sys.dm_db_log_stats(DB_ID()) l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID();" + response_format: table +- query: "SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', l.database_id, l.total_log_size_in_bytes As total_log_size_bytes, l.used_log_space_in_bytes As used_log_space_bytes, l.used_log_space_in_percent As used_log_space_pct, l.log_space_in_bytes_since_last_backup from sys.dm_db_log_space_usage l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID();" + response_format: table +{{else}} + {{#if databases}} + {{#each databases as |database_name i|}} + - query: "SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', database_id FROM sys.databases WHERE name='{{database_name}}';" + response_format: table + - query: "SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', l.database_id, l.total_log_size_mb, l.active_log_size_mb,l.log_backup_time,l.log_since_last_log_backup_mb,l.log_since_last_checkpoint_mb,l.log_recovery_size_mb from sys.dm_db_log_stats(DB_ID('{{database_name}}')) l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID('{{database_name}}') ;" + response_format: table + - query: "USE [{{database_name}}]; SELECT @@servername AS server_name, @@servicename AS instance_name, name As 'database_name', l.database_id, l.total_log_size_in_bytes As total_log_size_bytes, l.used_log_space_in_bytes As used_log_space_bytes, l.used_log_space_in_percent As used_log_space_pct, l.log_space_in_bytes_since_last_backup from sys.dm_db_log_space_usage l INNER JOIN sys.databases s ON l.database_id = s.database_id WHERE s.database_id = DB_ID('{{database_name}}') ;" + response_format: table + {{/each}} + {{/if}} {{/if}} \ No newline at end of file diff --git a/packages/microsoft_sqlserver/data_stream/transaction_log/manifest.yml b/packages/microsoft_sqlserver/data_stream/transaction_log/manifest.yml index b30584614f6..57f6f6a7089 100644 --- a/packages/microsoft_sqlserver/data_stream/transaction_log/manifest.yml +++ b/packages/microsoft_sqlserver/data_stream/transaction_log/manifest.yml @@ -16,9 +16,17 @@ streams: multi: true required: true show_user: true - description: Default system databases are preloaded. For user defined databases please add additional rows and enter the database name. + description: Fetch the transaction_logs metrics from the provided databases. Both, user-defined and system database names can be provided as input, with the system databases already being included by default. default: ["master", "model", "tempdb", "msdb"] + - name: fetch_from_all_databases + type: bool + title: Fetch from all databases + multi: false + required: false + show_user: false + description: Option to enable fetching transaction_logs metrics from all databases, including both system and user-defined databases. This option overrides any database names provided in the 'Databases' field and instead considers all databases. + default: false title: Microsoft SQL Server transaction_log metrics description: Collect Microsoft SQL Server transaction_log metrics elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/microsoft_sqlserver/docs/README.md b/packages/microsoft_sqlserver/docs/README.md index 158592a508c..e907ec7b2bd 100644 --- a/packages/microsoft_sqlserver/docs/README.md +++ b/packages/microsoft_sqlserver/docs/README.md @@ -1,55 +1,58 @@ # Microsoft SQL Server Integration -The Microsoft SQL Server integration package allows you to search, observe and visualize the SQL Server audit logs and metrics through Elasticsearch. +The Microsoft SQL Server integration package allows you to search, observe and visualize the SQL Server audit logs, as well as performance and transaction log metrics, through Elasticsearch. + +Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine. + +SQL Server audit lets you create server audits, which can contain server audit specifications for server-level events, and database audit specifications for database-level events. -Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine. -SQL Server audit lets you create server audits, which can contain server audit specifications for server level events, and database audit specifications for database level events. See: [SQL Server Audit page](https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine?view=sql-server-ver15) for more information on SQL Server auditing. `performance` metrics gathers the list of performance objects available on that server. Each server will have a different list of performance objects depending on the installed software. + `transaction_log` metrics collects all usage stats and the total space usage. ## Named Instance -Microsoft SQL Server has a feature that allows running multiple databases on the same host (or clustered hosts) with separate settings. Establish named instance connection by using the instance name along with the host name (Ex: `host/instance_name` or `host:named_instance_port`) to collect metrics. Details of the host configuration is provided below. +Microsoft SQL Server has a feature that allows running multiple databases on the same host (or clustered hosts) with separate settings. Establish a named instance connection by using the instance name along with the hostname (e.g. `host/instance_name` or `host:named_instance_port`) to collect metrics. Details of the host configuration are provided below. ### Query by Instance Name or Server Name in Kibana -The data can be visualized in Kibana by filtering based on the instance name and server name. The instance name can be filtered by `mssql.metrics.instance_name` and server name by `mssql.metrics.server_name` fields. +The data can be visualized in Kibana by filtering based on the instance name and server name. The instance name can be filtered by `mssql.metrics.instance_name` and the server name by `mssql.metrics.server_name` fields. ## Permission/Access required for tables -If you browse MSDN for the following tables, you will find a "Permissions" section which defines the permission needed for each table, e.g [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15) Permissions section. +If you browse MSDN for the following tables, you will find a "Permissions" section that defines the permission needed for each table, e.g. [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver15) Permissions section. -### 1.transaction_log +### 1. transaction_log - [sys.databases](https://learn.microsoft.com/en-us/sql/relational-databases/system-compatibility-views/sys-sysdatabases-transact-sql?view=sql-server-ver16) - [sys.dm_db_log_space_usage](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-space-usage-transact-sql?view=sql-server-ver16) - [sys.dm_db_log_stats (DB_ID)](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-stats-transact-sql?view=sql-server-ver16) -### 2.performance +### 2. performance - [sys.dm_os_performance_counters](https://learn.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-os-performance-counters-transact-sql?view=sql-server-ver16) ## Host Configuration -Integration supports collecting metrics from single host. For multi host metrics, each host can be run as a new integration. +Integration supports collecting metrics from a single host. For multi-host metrics, each host can be run as a new integration. -As part of the input configuration, need to provide the user name, password and the host details. The host configuration supports both named instance or default(no-name) instance, as per the syntax below. +As part of the input configuration, need to provide the user name, password and host details. The host configuration supports both named instances or default(no-name) instances, as per the syntax below. ### Connecting to Default Instance (host) -* `host` ex: `localhost` (Instance name is not needed when connecting to default instance) or -* `host:port ` ex: `localhost:1433` +* `host` (e.g. `localhost` (Instance name is not needed when connecting to default instance)) +* `host:port` (e.g. `localhost:1433`) ### Connecting to Named Instance (host) -* `host/instance_name` ex: `localhost/namedinstance_01` or -* `host:named_instance_port` ex: `localhost:60873` +* `host/instance_name` (e.g. `localhost/namedinstance_01`) +* `host:named_instance_port` (e.g. `localhost:60873`) ## Compatibility -The package collects `performance` and `transaction_log` metrics, and `audit` events from the event log. Other log sources such as file are not supported. +The package collects `performance` and `transaction_log` metrics, and `audit` events from the event log. Other log sources such as files are not supported. ## Configuration @@ -61,47 +64,53 @@ See: [SQL Server Audit Action Groups and Actions](https://docs.microsoft.com/en- See: [Instructions on how to enable auditing for SQL Server](https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-server-audit-specification?view=sql-server-ver15). ->Note: For the integration package to be able to read and send audit events the event target must be configured to be Windows event log. +> Note: For the integration package to be able to read and send audit events the event target must be configured to be Windows event log. -### audit events +### Audit events -Enable to collect SQL Server audit events from the specified windows event log channel. +Collects SQL Server audit events from the specified windows event log channel. -### log +### Log The SQL Server `log` contains user-defined events and certain system events you can use for troubleshooting. See: [View the SQL Server error log in SQL Server Management Studio](https://docs.microsoft.com/en-us/sql/relational-databases/performance/view-the-sql-server-error-log-sql-server-management-studio?view=sql-server-ver16) -### performance metrics +### Performance metrics -Collects the `performance` counter metrics. Dynamic counter feature provides flexibility to collect metrics by providing the counter as an input. +Collects the `performance` counter metrics. The dynamic counter feature provides flexibility to collect metrics by providing the counter as an input. This input can be a regular expression which will filter results based on pattern. -For example, if %grant% is given as input, it will enable metrics collection for all of the counters with name like 'Memory Grants Pending', 'Active memory grants count' etc. -MSSQL supports limited set of RegExp, See [here] (https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms187489(v=sql.105)?redirectedfrom=MSDN) for details. +For example, if %grant% is given as input, it will enable metrics collection for all of the counters with names like 'Memory Grants Pending', 'Active memory grants count' etc. +MSSQL supports a limited set of regular expressions, See [here](https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2008-r2/ms187489(v=sql.105)?redirectedfrom=MSDN) for details. ->Note: Dynamic counters will go through some basic ingest pipeline post-processing to make counter names in lower case and remove special characters and these fields will not have any static field mappings. +> Note: Dynamic counters will go through some basic ingest pipeline post-processing to make counter names in lowercase and remove special characters and these fields will not have any static field mappings. -The feature `merge_results` has been introduced in 8.4 beats which create a single event by combining the metrics together in a single event. See [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-sql.html#_example_merge_multiple_queries_to_single_event) for details. +The feature `merge_results` has been introduced in 8.4 beats which creates a single event by combining the metrics together in a single event. See [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-sql.html#_example_merge_multiple_queries_to_single_event) for details. See: [Instructions about each performance counter metrics](https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-os-performance-counters-transact-sql?view=sql-server-ver15) -### transaction_log metrics +### Transaction log metrics Collects system level `transaction_log` metrics information for SQL Server instance. -Metrics for user level databases can be collected by providing list of user dbs for which metrics is to be collected. +Metrics for user-level databases can be collected by providing a list of user databases for which metrics are to be collected. See: [Instructions and the operations supported by transaction log](https://docs.microsoft.com/en-us/sql/relational-databases/logs/the-transaction-log-sql-server?view=sql-server-ver15) +### Fetch from all databases + +To simplify the process of fetching metrics from all databases on the server, you can enable the `Fetch from all databases` toggle when configuring the integration. This field overrides manually entered database names in the `Databases` input and instead fetches the required `transaction_log` metrics from all databases, including system and user-defined databases. + +Keep in mind that this feature is disabled by default and needs to be manually enabled to be activated. + ### Password URL encoding -When there are special characters in password, pass the special characters by using URL encoding. +When the password contains special characters, pass these special characters using URL encoding. ## Logs ### audit -The SQL Server audit dataset provides events from the configured Windows event log channel. All SQL Server audit specific fields are available in the `sqlserver.audit` field group. +The SQL Server audit dataset provides events from the configured Windows event log channel. All SQL Server audit-specific fields are available in the `sqlserver.audit` field group. **Exported fields** @@ -129,6 +138,8 @@ The SQL Server audit dataset provides events from the configured Windows event l | destination.user.name | Short name or login of the user. | keyword | | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | +| error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | @@ -264,7 +275,7 @@ The SQL Server audit dataset provides events from the configured Windows event l ### log -The Microsoft SQL Server `log` dataset parses error logs created by Microsoft SQL server. +The Microsoft SQL Server `log` dataset parses error logs created by the Microsoft SQL server. An example event for `log` looks as following: @@ -404,7 +415,7 @@ An example event for `log` looks as following: ### performance -The Microsoft SQL Server `performance` dataset provides metrics from the performance counter table. All `performance` metrics will be available in `sqlserver.metrics` field group. +The Microsoft SQL Server `performance` dataset provides metrics from the performance counter table. All `performance` metrics will be available in the `sqlserver.metrics` field group. An example event for `performance` looks as following: @@ -578,7 +589,7 @@ An example event for `performance` looks as following: ### transaction_log -The Microsoft SQL Server `transaction_log` dataset provides metrics from the log space usage and log stats tables of the system databases. All `transaction_log` metrics will be available in `sqlserver.metrics` field group. +The Microsoft SQL Server `transaction_log` dataset provides metrics from the log space usage and log stats tables of the system databases. All `transaction_log` metrics will be available in the `sqlserver.metrics` field group. An example event for `transaction_log` looks as following: diff --git a/packages/microsoft_sqlserver/manifest.yml b/packages/microsoft_sqlserver/manifest.yml index fb74f45a703..5f98b5e988d 100644 --- a/packages/microsoft_sqlserver/manifest.yml +++ b/packages/microsoft_sqlserver/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: microsoft_sqlserver title: "Microsoft SQL Server" -version: "2.1.0" +version: "2.2.1" license: basic description: Collect events from Microsoft SQL Server with Elastic Agent type: integration @@ -21,16 +21,16 @@ screenshots: size: 600x600 type: image/png - src: /img/sqlserver-transaction-dashboard.png - title: Microsoft SQL Server transaction log Dashboard + title: Microsoft SQL Server Transaction Log Dashboard size: 600x600 type: image/png - src: /img/sqlserver-errorlog-dashboard.png - title: Microsoft SQL Server Error log Dashboard + title: Microsoft SQL Server Error Log Dashboard size: 600x600 type: image/png icons: - src: /img/microsoft-sql-server-logo.svg - title: Microsof SQL Server + title: Microsoft SQL Server size: 32x32 type: image/svg+xml policy_templates: @@ -54,7 +54,7 @@ policy_templates: show_user: true default: - localhost - description: Host Name Ex - (DefaultInstance - host or host:port) (Named Instance - host/instanceName or host:NamedInstancePort) + description: Hostname (e.g. For `Default Instance`, use the format `host` or `host:port` and for `Named Instance` use the format `host/instanceName` or `host:NamedInstancePort`) - name: password type: password title: Password @@ -70,7 +70,7 @@ policy_templates: required: true show_user: true default: domain\username - description: "Domain users: Pre-encode username when passing backslash. Eg: {domain}%5C{username} instead of {domain}\\\\{username}" + description: "Domain users: Pre-encode username when passing backslash e.g. {domain}%5C{username} instead of {domain}\\\\{username}" title: Collect Microsoft SQL Server performance and transaction_log metrics description: Collecting performance and transaction_log metrics from Microsoft SQL Server instances owner: diff --git a/packages/mimecast/_dev/build/build.yml b/packages/mimecast/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/mimecast/_dev/build/build.yml +++ b/packages/mimecast/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/mimecast/_dev/build/docs/README.md b/packages/mimecast/_dev/build/docs/README.md index 0affe510be9..0285f796f86 100644 --- a/packages/mimecast/_dev/build/docs/README.md +++ b/packages/mimecast/_dev/build/docs/README.md @@ -15,6 +15,17 @@ to change the defaults. ## Logs +### Archive Search Logs + +This is the `mimecast.archive_search_logs` dataset. These logs contain Mimecast archive +search logs with the following details: search source, description and detailed +information about the search performed. More information about these logs is available [here]( +https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-archive-search-logs/). + +{{event "archive_search_logs"}} + +{{fields "archive_search_logs"}} + ### Audit Events This is the `mimecast.audit_events` dataset. These logs contain Mimecast audit diff --git a/packages/mimecast/_dev/deploy/docker/files/config.yml b/packages/mimecast/_dev/deploy/docker/files/config.yml index 2dd68ca27b2..951d8daf86d 100644 --- a/packages/mimecast/_dev/deploy/docker/files/config.yml +++ b/packages/mimecast/_dev/deploy/docker/files/config.yml @@ -1,4 +1,27 @@ rules: + - path: /api/archive/get-archive-search-logs + methods: ["POST"] + request_body: '{"meta":{"pagination":{"pageSize":"100","pageToken":"nextToken"}}}' + request_headers: + authorization: ["MC .*"] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"meta":{"pagination":{"pageSize":100,"totalCount":410},"status":200},"data":[{"logs":[{"createTime":"2023-09-01T14:56:42+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-01T14:56:41+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-01T14:49:07+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-01T14:49:00+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-01T14:48:57+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-01T14:48:50+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-15T13:16:05+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"[Route : outbound]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T18:28:56+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T18:27:37+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T18:16:38+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T18:16:29+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T18:12:39+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-08-02T15:53:16+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-07-19T20:58:43+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"1b471db32c0875e2ec5729e7166f10cec038f47894e88021352ca241782b1bc0 [User : dhamilton@mc-hapi.hamilton321.net]","searchReason":"","description":"Threat Remediation search"},{"createTime":"2023-07-07T15:16:48+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-08-01T20:58:33+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-06-16T14:20:39+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<291708accd1865c2-148171@nodered-mimecast-55569955-kthgt.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-06-15T20:27:20+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<291708accd1865c2-148171@nodered-mimecast-55569955-kthgt.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-05-23T14:49:48+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<291708accd1865c2-148171@nodered-mimecast-55569955-kthgt.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-04-07T18:36:43+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":" [User : dhamilton@mc-hapi.hamilton321.net]","searchReason":"","description":"Threat Remediation search"},{"createTime":"2022-04-07T18:36:02+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-04-07T18:26:44+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-04-07T14:11:35+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-03-17T18:01:04+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-03-17T16:01:47+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-03-07T14:46:35+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2022-02-28T15:50:50+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"special term","searchReason":"","description":"Audit [Page 1] - Depth 100"},{"createTime":"2021-10-06T13:08:06+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-10-06T13:03:02+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-10-06T13:02:29+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-10-05T15:10:35+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"hapi1.hamilton321.net AND !Devin","searchReason":"","description":"Audit [Page 1] - Depth 100"},{"createTime":"2021-10-05T15:09:22+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"hapi1.hamilton321.net AND !Devin","searchReason":"","description":"Audit [Page 1] - Depth 100"},{"createTime":"2021-08-18T15:03:12+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-08-18T14:49:20+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-08-18T14:47:04+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-08-18T14:47:01+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T22:02:45+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<882aa89.75a1c58-362766@h321a.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T21:37:58+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<882aa89.75a1c58-362766@h321a.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T21:37:54+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<882aa89.75a1c58-362766@h321a.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:43:59+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<94877f3c.486f7-124232@h321a.hamilton321.net>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:43:54+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<94877f3c.486f7-124232@h321a.hamilton321.nett>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:29:57+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:27:33+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:18:04+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:17:37+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:17:36+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:17:32+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-05-04T19:11:15+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-04-08T22:23:45+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<67311002-1617920404793@us-mta-167.us.mimecast.lan>","searchReason":"","description":"Message Tracking Search"},{"createTime":"2021-03-18T18:35:49+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"}]}],"fail":[]} + - path: /api/archive/get-archive-search-logs + methods: ["POST"] + request_headers: + authorization: ["MC .*"] + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"meta":{"pagination":{"pageSize":10,"totalCount":24562,"next":"nextToken"},"status":200},"data":[{"logs":[{"createTime":"2023-09-07T20:00:57+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T20:00:48+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T20:00:38+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T20:00:38+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T20:00:28+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T20:00:27+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T19:57:27+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T19:57:18+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T19:56:29+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"},{"createTime":"2023-09-07T19:56:17+0000","emailAddr":"api-d910278e-3850-4562-9bbb-bc044fe7a994@mc-hapi.hamilton321.net","source":"archive","searchText":"[Status : held]","searchReason":"","description":"Message Tracking Search"}]}],"fail":[]} - path: /api/audit/get-audit-events methods: ["POST"] request_body: /^\{"data":\[{"endDateTime":"(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})[+-](\d{4})","startDateTime":"2021-11-16T12:03:24\+0000"}],"meta":{"pagination":{"pageSize":"100"}}\}/ diff --git a/packages/mimecast/changelog.yml b/packages/mimecast/changelog.yml index a4dd7826288..64f946645b4 100644 --- a/packages/mimecast/changelog.yml +++ b/packages/mimecast/changelog.yml @@ -1,3 +1,33 @@ +- version: 1.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.0" + changes: + - description: Add support for Archive Search Logs + type: enhancement + link: https://github.com/elastic/integrations/pull/7750 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.13.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7165 +- version: "1.12.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log new file mode 100644 index 00000000000..d715d23b110 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log @@ -0,0 +1,9 @@ +{"createTime":"2023-09-01T14:56:42+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"} +{"createTime":"2023-08-15T13:16:05+0000","emailAddr":"dhamilton@dhmc.b41.one","source":"archive","searchText":"[Route : outbound]","searchReason":"","description":"Message Tracking Search"} +{"createTime":"2023-08-02T15:53:16+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"<75117693bccaae9e-67627@hapi.b41.one>","searchReason":"","description":"Message Tracking Search"} +{"createTime":"2023-07-19T20:58:43+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"1b471db32c0875e2ec5729e7166f10cec038f47894e88021352ca241782b1bc0 [User : dhamilton@mc-hapi.hamilton321.net]","searchReason":"","description":"Threat Remediation search"} +{"createTime":"2023-06-09T19:15:50+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"pete","searchReason":"","description":"Audit [Page 1] - Depth 100"} +{"createTime":"2022-08-01T20:58:33+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"} +{"createTime":"2022-03-07T14:46:35+0000","emailAddr":"dhamilton@mc-hapi.hamilton321.net","source":"archive","searchText":"","searchReason":"","description":"Message Tracking Search"} +{"createTime":"2021-05-04T22:02:45+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"<882aa89.75a1c58-362766@h321a.hamilton321.net>","searchReason":"sample search","description":"Message Tracking Search"} +{"createTime":"2021-04-08T22:23:38+0000","emailAddr":"admin_dhamilton@hapi1.hamilton321.net","source":"archive","searchText":"67311002-1617920404793@us-mta-167.us.mimecast.lan","searchReason":"","description":"Message Tracking Search","searchPath":"/foo/bar"} diff --git a/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log-expected.json b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log-expected.json new file mode 100644 index 00000000000..296a3440bba --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-archive-search-logs.log-expected.json @@ -0,0 +1,345 @@ +{ + "expected": [ + { + "@timestamp": "2023-09-01T14:56:42.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2023-09-01T14:56:42.000Z", + "kind": "event", + "original": "{\"createTime\":\"2023-09-01T14:56:42+0000\",\"emailAddr\":\"dhamilton@dhmc.b41.one\",\"source\":\"archive\",\"searchText\":\"\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@dhmc.b41.one" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dhmc.b41.one", + "email": "dhamilton@dhmc.b41.one", + "name": "dhamilton" + } + }, + { + "@timestamp": "2023-08-15T13:16:05.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2023-08-15T13:16:05.000Z", + "kind": "event", + "original": "{\"createTime\":\"2023-08-15T13:16:05+0000\",\"emailAddr\":\"dhamilton@dhmc.b41.one\",\"source\":\"archive\",\"searchText\":\"[Route : outbound]\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive", + "text": "[Route : outbound]" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@dhmc.b41.one" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "dhmc.b41.one", + "email": "dhamilton@dhmc.b41.one", + "name": "dhamilton" + } + }, + { + "@timestamp": "2023-08-02T15:53:16.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2023-08-02T15:53:16.000Z", + "kind": "event", + "original": "{\"createTime\":\"2023-08-02T15:53:16+0000\",\"emailAddr\":\"dhamilton@mc-hapi.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"\u003c75117693bccaae9e-67627@hapi.b41.one\u003e\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive", + "text": "\u003c75117693bccaae9e-67627@hapi.b41.one\u003e" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@mc-hapi.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "mc-hapi.hamilton321.net", + "email": "dhamilton@mc-hapi.hamilton321.net", + "name": "dhamilton" + } + }, + { + "@timestamp": "2023-07-19T20:58:43.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2023-07-19T20:58:43.000Z", + "kind": "event", + "original": "{\"createTime\":\"2023-07-19T20:58:43+0000\",\"emailAddr\":\"dhamilton@mc-hapi.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"1b471db32c0875e2ec5729e7166f10cec038f47894e88021352ca241782b1bc0 [User : dhamilton@mc-hapi.hamilton321.net]\",\"searchReason\":\"\",\"description\":\"Threat Remediation search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Threat Remediation search", + "source": "archive", + "text": "1b471db32c0875e2ec5729e7166f10cec038f47894e88021352ca241782b1bc0 [User : dhamilton@mc-hapi.hamilton321.net]" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@mc-hapi.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "mc-hapi.hamilton321.net", + "email": "dhamilton@mc-hapi.hamilton321.net", + "name": "dhamilton" + } + }, + { + "@timestamp": "2023-06-09T19:15:50.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2023-06-09T19:15:50.000Z", + "kind": "event", + "original": "{\"createTime\":\"2023-06-09T19:15:50+0000\",\"emailAddr\":\"dhamilton@mc-hapi.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"pete\",\"searchReason\":\"\",\"description\":\"Audit [Page 1] - Depth 100\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Audit [Page 1] - Depth 100", + "source": "archive", + "text": "pete" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@mc-hapi.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "mc-hapi.hamilton321.net", + "email": "dhamilton@mc-hapi.hamilton321.net", + "name": "dhamilton" + } + }, + { + "@timestamp": "2022-08-01T20:58:33.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2022-08-01T20:58:33.000Z", + "kind": "event", + "original": "{\"createTime\":\"2022-08-01T20:58:33+0000\",\"emailAddr\":\"dhamilton@mc-hapi.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@mc-hapi.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "mc-hapi.hamilton321.net", + "email": "dhamilton@mc-hapi.hamilton321.net", + "name": "dhamilton" + } + }, + { + "@timestamp": "2022-03-07T14:46:35.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2022-03-07T14:46:35.000Z", + "kind": "event", + "original": "{\"createTime\":\"2022-03-07T14:46:35+0000\",\"emailAddr\":\"dhamilton@mc-hapi.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive" + } + }, + "related": { + "user": [ + "dhamilton", + "dhamilton@mc-hapi.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "mc-hapi.hamilton321.net", + "email": "dhamilton@mc-hapi.hamilton321.net", + "name": "dhamilton" + } + }, + { + "@timestamp": "2021-05-04T22:02:45.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2021-05-04T22:02:45.000Z", + "kind": "event", + "original": "{\"createTime\":\"2021-05-04T22:02:45+0000\",\"emailAddr\":\"admin_dhamilton@hapi1.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"\u003c882aa89.75a1c58-362766@h321a.hamilton321.net\u003e\",\"searchReason\":\"sample search\",\"description\":\"Message Tracking Search\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "reason": "sample search", + "source": "archive", + "text": "\u003c882aa89.75a1c58-362766@h321a.hamilton321.net\u003e" + } + }, + "related": { + "user": [ + "admin_dhamilton", + "admin_dhamilton@hapi1.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "hapi1.hamilton321.net", + "email": "admin_dhamilton@hapi1.hamilton321.net", + "name": "admin_dhamilton" + } + }, + { + "@timestamp": "2021-04-08T22:23:38.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "api" + ], + "created": "2021-04-08T22:23:38.000Z", + "kind": "event", + "original": "{\"createTime\":\"2021-04-08T22:23:38+0000\",\"emailAddr\":\"admin_dhamilton@hapi1.hamilton321.net\",\"source\":\"archive\",\"searchText\":\"67311002-1617920404793@us-mta-167.us.mimecast.lan\",\"searchReason\":\"\",\"description\":\"Message Tracking Search\",\"searchPath\":\"/foo/bar\"}", + "type": [ + "admin" + ] + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "path": "/foo/bar", + "source": "archive", + "text": "67311002-1617920404793@us-mta-167.us.mimecast.lan" + } + }, + "related": { + "user": [ + "admin_dhamilton", + "admin_dhamilton@hapi1.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "domain": "hapi1.hamilton321.net", + "email": "admin_dhamilton@hapi1.hamilton321.net", + "name": "admin_dhamilton" + } + } + ] +} \ No newline at end of file diff --git a/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-common-config.yml b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/mimecast/data_stream/archive_search_logs/_dev/test/system/test-default-config.yml b/packages/mimecast/data_stream/archive_search_logs/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..3e1b8717e89 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/_dev/test/system/test-default-config.yml @@ -0,0 +1,13 @@ +input: httpjson +service: mimecast +vars: + api_key: test + api_url: http://{{Hostname}}:{{Port}} +request.method: "POST" +data_stream: + vars: + preserve_original_event: true + interval: 1m + enable_request_tracer: true +assert: + hit_count: 60 diff --git a/packages/mimecast/data_stream/archive_search_logs/agent/stream/httpjson.yml.hbs b/packages/mimecast/data_stream/archive_search_logs/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..a5e1a9e0874 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/agent/stream/httpjson.yml.hbs @@ -0,0 +1,60 @@ +config_version: "2" +interval: {{interval}} +request.url: {{api_url}}/api/archive/get-archive-search-logs +request.method: "POST" +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +request.transforms: +- set: + target: body.meta.pagination.pageSize + value: 100 +- set: + target: header.x-mc-app-id + value: {{app_id}} +- set: + target: header.x-mc-date + value: '[[formatDate (now) "RFC1123"]]' +- set: + target: header.x-mc-req-id + value: '[[uuid]]' +- set: + target: header.Authorization + value: 'MC {{access_key}}:[[hmacBase64 "sha1" (base64Decode "{{secret_key}}") (sprintf "%s:%s:/api/archive/get-archive-search-logs:{{app_key}}" (.header.Get "x-mc-date") (.header.Get "x-mc-req-id"))]]' + fail_on_template_error: true +response.decode_as: application/json +response.split: + target: body.data + split: + target: body.logs + keep_parent: false + ignore_empty_value: true + ignore_empty_value: true +response.pagination: +# pageToken already holds all required information from the previous filters +- delete: + target: body.data +- set: + target: body.meta.pagination.pageToken + value: >- + [[- if index .last_response.body.meta.pagination "next" -]] + [[- .last_response.body.meta.pagination.next -]] + [[- end -]] + fail_on_template_error: true +cursor: + next_date: + value: '[[.first_event.createTime]]' +tags: +{{#if preserve_original_event}} +- preserve_original_event +{{/if}} +{{#each tags as |tag|}} +- {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/mimecast/data_stream/archive_search_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/archive_search_logs/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..144de4b109e --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,155 @@ +--- +description: Pipeline for processing Mimecast archive_search_logs. +processors: + # Generic event/ecs fields we always want to populate. + - set: + field: ecs.version + value: '8.9.0' + - rename: + field: message + target_field: event.original + - json: + description: Parse 'message' JSON contents into a 'mimecast' object. + field: event.original + target_field: mimecast + - drop: + if: ctx.mimecast?.createTime == null || (ctx.mimecast?.data != null && ctx.mimecast.data.isEmpty()) + - fingerprint: + fields: + - mimecast.id + target_field: "_id" + ignore_missing: true + + - date: + description: Use 'mimecast.createTime' as the '@timestamp' + field: mimecast.createTime + timezone: UTC + formats: + - "yyyy-MM-dd'T'HH:mm:ssz" + - "yyyy-MM-dd'T'HH:mm:ssZ" + - "yyyy-MM-dd'T'HH:mm:ss.Sz" + - "yyyy-MM-dd'T'HH:mm:ss.SZ" + - "yyyy-MM-dd'T'HH:mm:ss.SSz" + - "yyyy-MM-dd'T'HH:mm:ss.SSZ" + - "yyyy-MM-dd'T'HH:mm:ss.SSSz" + - "yyyy-MM-dd'T'HH:mm:ss.SSSZ" + - "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSz" + - "yyyy-MM-dd'T'HH:mm:ss.SSSSSSSSSZ" + - "yyyy-MM-dd'T'HH:mm:ss z" + + ### + + # Search related fields + - rename: + field: mimecast.searchText + target_field: mimecast.search_details.text + ignore_missing: true + - rename: + field: mimecast.description + target_field: mimecast.search_details.description + ignore_missing: true + - rename: + field: mimecast.source + target_field: mimecast.search_details.source + ignore_missing: true + - rename: + field: mimecast.searchPath + target_field: mimecast.search_details.path + ignore_missing: true + - rename: + field: mimecast.searchReason + target_field: mimecast.search_details.reason + ignore_missing: true + + ### + + # User fields + - rename: + field: mimecast.emailAddr + target_field: user.email + ignore_missing: true + + - split: + field: user.email + separator: "@" + target_field: user.parts + if: 'ctx.user?.email != null' + - set: + field: user.name + copy_from: user.parts.0 + if: 'ctx.user?.parts?.length > 1' + - set: + field: user.domain + copy_from: user.parts.1 + if: 'ctx.user?.parts?.length > 1' + + - append: + field: related.user + value: "{{{user.name}}}" + allow_duplicates: false + if: 'ctx.user?.name !=null' + - append: + field: related.user + value: "{{{user.email}}}" + allow_duplicates: false + if: ctx.user?.email != null + + # Event related fields + # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down + - set: + field: event.created + copy_from: "@timestamp" + - set: + field: event.kind + value: event + - append: + field: event.category + value: [api] + - append: + field: event.type + value: [admin] + + # Cleanup + - script: + description: Drops null/empty values recursively + lang: painless + ignore_failure: true + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); + - remove: + description: Cleanup of repeated/unwanted/temporary fields. + field: + - mimecast.createTime + - mimecast.searchPath + - mimecast.searchText + - mimecast.description + - mimecast.searchReason + - mimecast.source + - user.parts + ignore_missing: true + - remove: + description: Remove 'event.original' if 'preserve_original_event' is not set. + field: event.original + if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + +# Error handling +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/mimecast/data_stream/archive_search_logs/fields/agent.yml b/packages/mimecast/data_stream/archive_search_logs/fields/agent.yml new file mode 100644 index 00000000000..c46a152ef14 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/fields/agent.yml @@ -0,0 +1,190 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + +- name: input.type + type: keyword + description: Input type +- name: log.offset + type: long + description: Log offset diff --git a/packages/mimecast/data_stream/archive_search_logs/fields/base-fields.yml b/packages/mimecast/data_stream/archive_search_logs/fields/base-fields.yml new file mode 100644 index 00000000000..e1842823ef1 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: mimecast +- name: event.dataset + type: constant_keyword + description: Event dataset + value: mimecast.archive_search_logs +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/mimecast/data_stream/archive_search_logs/fields/ecs.yml b/packages/mimecast/data_stream/archive_search_logs/fields/ecs.yml new file mode 100644 index 00000000000..571dd97bf81 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/fields/ecs.yml @@ -0,0 +1,22 @@ +- external: ecs + name: ecs.version +- external: ecs + name: event.action +- external: ecs + name: event.created +- external: ecs + name: event.id +- external: ecs + name: event.original +- external: ecs + name: event.reason +- external: ecs + name: related.user +- external: ecs + name: tags +- external: ecs + name: user.domain +- external: ecs + name: user.email +- external: ecs + name: user.name diff --git a/packages/mimecast/data_stream/archive_search_logs/fields/field.yml b/packages/mimecast/data_stream/archive_search_logs/fields/field.yml new file mode 100644 index 00000000000..f40bae3c83e --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/fields/field.yml @@ -0,0 +1,24 @@ +- name: mimecast + type: group + fields: + - name: search_details + type: group + fields: + - name: description + type: keyword + description: The description of the search if any. + - name: text + type: keyword + description: The text used in the search. + - name: source + type: keyword + description: The search source context + - name: reason + type: keyword + description: The search reason entered when the search was executed if any. + - name: path + type: keyword + description: The search path if any. + - name: email.address + type: keyword + description: The email address of the user who performed the search. diff --git a/packages/mimecast/data_stream/archive_search_logs/manifest.yml b/packages/mimecast/data_stream/archive_search_logs/manifest.yml new file mode 100644 index 00000000000..3af544a94d3 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/manifest.yml @@ -0,0 +1,50 @@ +title: "Archive Search Mimecast Logs" +type: logs +streams: + - input: httpjson + template_path: httpjson.yml.hbs + title: Archive Search Logs + description: Collect archive search logs + vars: + - name: interval + type: text + title: Interval + description: Duration between requests to the API. Supported units for this parameter are h/m/s. + multi: false + required: true + show_user: false + default: 5m + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - mimecast-archive-search-logs + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: > + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. + + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/mimecast/data_stream/archive_search_logs/sample_event.json b/packages/mimecast/data_stream/archive_search_logs/sample_event.json new file mode 100644 index 00000000000..1a5f6374b92 --- /dev/null +++ b/packages/mimecast/data_stream/archive_search_logs/sample_event.json @@ -0,0 +1,62 @@ +{ + "@timestamp": "2021-03-18T18:35:49.000Z", + "agent": { + "ephemeral_id": "ef42d9ea-67ec-4494-bad4-9d47b9ed68d2", + "id": "f81bb806-77be-4e89-9f08-d426b37fd611", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.2" + }, + "data_stream": { + "dataset": "mimecast.archive_search_logs", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "f81bb806-77be-4e89-9f08-d426b37fd611", + "snapshot": false, + "version": "8.8.2" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "api" + ], + "created": "2021-03-18T18:35:49.000Z", + "dataset": "mimecast.archive_search_logs", + "ingested": "2023-09-11T06:48:05Z", + "kind": "event", + "original": "{\"createTime\":\"2021-03-18T18:35:49+0000\",\"description\":\"Message Tracking Search\",\"emailAddr\":\"admin_dhamilton@hapi1.hamilton321.net\",\"searchReason\":\"\",\"searchText\":\"\",\"source\":\"archive\"}", + "type": [ + "admin" + ] + }, + "input": { + "type": "httpjson" + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive" + } + }, + "related": { + "user": [ + "admin_dhamilton", + "admin_dhamilton@hapi1.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "mimecast-archive-search-logs" + ], + "user": { + "domain": "hapi1.hamilton321.net", + "email": "admin_dhamilton@hapi1.hamilton321.net", + "name": "admin_dhamilton" + } +} \ No newline at end of file diff --git a/packages/mimecast/data_stream/audit_events/_dev/test/pipeline/test-audit-events.log-expected.json b/packages/mimecast/data_stream/audit_events/_dev/test/pipeline/test-audit-events.log-expected.json index 8f40f219019..c059582f247 100644 --- a/packages/mimecast/data_stream/audit_events/_dev/test/pipeline/test-audit-events.log-expected.json +++ b/packages/mimecast/data_stream/audit_events/_dev/test/pipeline/test-audit-events.log-expected.json @@ -18,7 +18,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "threat-intel-feed-download", @@ -71,7 +71,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "threat-intel-feed-download", @@ -124,7 +124,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logged-on", @@ -175,7 +175,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-requires-challenge", @@ -226,7 +226,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logged-on", @@ -276,7 +276,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mimecast-support-login", @@ -325,7 +325,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mimecast-support-login", @@ -374,7 +374,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -437,7 +437,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "search-action", @@ -486,7 +486,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -523,7 +523,7 @@ { "@timestamp": "2021-10-11T13:21:06.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "completed-directory-sync", @@ -564,7 +564,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "case-action", @@ -613,7 +613,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -664,7 +664,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "existing-archive-task-changed", @@ -713,7 +713,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connectors-management", @@ -762,7 +762,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "page-data-exports", @@ -816,7 +816,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "custom-report-definition-created", @@ -865,7 +865,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "folder-log-entry", @@ -896,7 +896,7 @@ { "@timestamp": "2021-10-12T19:56:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-password-changed", @@ -940,7 +940,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remediation-incident-adjustment", @@ -989,7 +989,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "archive-mailbox-restore", @@ -1038,7 +1038,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "archive-mailbox-restore", @@ -1087,7 +1087,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "archive-mailbox-export-download", @@ -1136,7 +1136,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "review-set-action", @@ -1185,7 +1185,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remediation-incident-adjustment", @@ -1234,7 +1234,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -1284,7 +1284,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -1335,7 +1335,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -1386,7 +1386,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user-logged-on", @@ -1435,7 +1435,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -1486,7 +1486,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", @@ -1536,7 +1536,7 @@ "ip": "67.43.156.3" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logon-authentication-failed", diff --git a/packages/mimecast/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml index b060e2d515c..3a7731dbf85 100644 --- a/packages/mimecast/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/audit_events/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mimecast/data_stream/audit_events/manifest.yml b/packages/mimecast/data_stream/audit_events/manifest.yml index c8fadb229d2..8c113306ea4 100644 --- a/packages/mimecast/data_stream/audit_events/manifest.yml +++ b/packages/mimecast/data_stream/audit_events/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/audit_events/sample_event.json b/packages/mimecast/data_stream/audit_events/sample_event.json index 7161b3e0baa..e5fb150885f 100644 --- a/packages/mimecast/data_stream/audit_events/sample_event.json +++ b/packages/mimecast/data_stream/audit_events/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-16T12:01:37.000Z", "agent": { - "ephemeral_id": "318ed660-ab02-48f6-bd87-53b29acaedab", - "id": "8c5473c5-468b-444c-b5c0-0783fde1f55e", + "ephemeral_id": "67b65934-b452-4461-a076-c9b053b6da1f", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.audit_events", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "8c5473c5-468b-444c-b5c0-0783fde1f55e", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.5.1" + "version": "8.9.0" }, "event": { "action": "search-action", "agent_id_status": "verified", - "created": "2023-01-16T22:59:08.657Z", + "created": "2023-07-27T14:56:43.376Z", "dataset": "mimecast.audit_events", - "id": "eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK1o", - "ingested": "2023-01-16T22:59:09Z", - "original": "{\"auditType\":\"Search Action\",\"category\":\"case_review_logs\",\"eventInfo\":\"Inspected Review Set Messages - Source: Review Set - Supervision - hot words, Case - GDPR/CCPA, Message Status: Pending, Date: 2021-11-16, Time: 12:01:37+0000, IP: 8.8.8.8, Application: mimecast-case-review\",\"eventTime\":\"2021-11-16T12:01:37+0000\",\"id\":\"eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK1o\",\"user\":\"johndoe@example.com\"}" + "id": "eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK2o", + "ingested": "2023-07-27T14:56:44Z", + "original": "{\"auditType\":\"Search Action\",\"category\":\"case_review_logs\",\"eventInfo\":\"Inspected Review Set Messages - Source: Review Set - Supervision - hot words, Case - GDPR/CCPA, Message Status: Pending, Date: 2021-11-16, Time: 12:01:37+0000, IP: 8.8.8.8, Application: mimecast-case-review\",\"eventTime\":\"2021-11-16T12:01:37+0000\",\"id\":\"eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK2o\",\"user\":\"johndoe@example.com\"}" }, "input": { "type": "httpjson" diff --git a/packages/mimecast/data_stream/dlp_logs/_dev/test/pipeline/test-dlp-logs.log-expected.json b/packages/mimecast/data_stream/dlp_logs/_dev/test/pipeline/test-dlp-logs.log-expected.json index 6422e8869c5..3f56c074921 100644 --- a/packages/mimecast/data_stream/dlp_logs/_dev/test/pipeline/test-dlp-logs.log-expected.json +++ b/packages/mimecast/data_stream/dlp_logs/_dev/test/pipeline/test-dlp-logs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-15T20:41:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -35,7 +35,7 @@ { "@timestamp": "2021-10-15T20:41:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -67,7 +67,7 @@ { "@timestamp": "2021-10-15T20:41:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -99,7 +99,7 @@ { "@timestamp": "2021-10-15T20:41:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -131,7 +131,7 @@ { "@timestamp": "2021-10-15T20:41:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -163,7 +163,7 @@ { "@timestamp": "2021-10-15T20:41:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -195,7 +195,7 @@ { "@timestamp": "2021-10-15T20:41:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -227,7 +227,7 @@ { "@timestamp": "2021-10-15T20:41:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -259,7 +259,7 @@ { "@timestamp": "2021-10-15T20:41:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -291,7 +291,7 @@ { "@timestamp": "2021-10-15T20:41:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -323,7 +323,7 @@ { "@timestamp": "2022-12-29T03:45:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", diff --git a/packages/mimecast/data_stream/dlp_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/dlp_logs/elasticsearch/ingest_pipeline/default.yml index ef72be354db..4ccb11ae0c5 100644 --- a/packages/mimecast/data_stream/dlp_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/dlp_logs/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mimecast/data_stream/dlp_logs/manifest.yml b/packages/mimecast/data_stream/dlp_logs/manifest.yml index cec80752daf..d8d11781dc2 100644 --- a/packages/mimecast/data_stream/dlp_logs/manifest.yml +++ b/packages/mimecast/data_stream/dlp_logs/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/dlp_logs/sample_event.json b/packages/mimecast/data_stream/dlp_logs/sample_event.json index 3a2ed76eda9..7ddbcec2f3c 100644 --- a/packages/mimecast/data_stream/dlp_logs/sample_event.json +++ b/packages/mimecast/data_stream/dlp_logs/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-18T21:41:18.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "b3630060-e536-4953-a9b4-74f78c6ac6c1", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.dlp_logs", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -27,7 +27,7 @@ "\u003c\u003e" ] }, - "message_id": "\u003c20211118214115.B346F10021D@mail.emailsec.ninja\u003e", + "message_id": "\u003c20211118214115.B346F10021D-2@mail.emailsec.ninja\u003e", "subject": "Undelivered Mail Returned to Sender", "to": { "address": [ @@ -40,8 +40,8 @@ "agent_id_status": "verified", "created": "2021-11-18T21:41:18+0000", "dataset": "mimecast.dlp_logs", - "ingested": "2023-01-13T15:05:15Z", - "original": "{\"action\":\"notification\",\"eventTime\":\"2021-11-18T21:41:18+0000\",\"messageId\":\"\\u003c20211118214115.B346F10021D@mail.emailsec.ninja\\u003e\",\"policy\":\"Content Inspection - Watermark\",\"recipientAddress\":\"johndoe@example.com\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Undelivered Mail Returned to Sender\"}" + "ingested": "2023-07-27T14:57:41Z", + "original": "{\"action\":\"notification\",\"eventTime\":\"2021-11-18T21:41:18+0000\",\"messageId\":\"\\u003c20211118214115.B346F10021D-2@mail.emailsec.ninja\\u003e\",\"policy\":\"Content Inspection - Watermark\",\"recipientAddress\":\"johndoe@example.com\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Undelivered Mail Returned to Sender\"}" }, "input": { "type": "httpjson" diff --git a/packages/mimecast/data_stream/siem_logs/_dev/test/pipeline/test-siem-logs.log-expected.json b/packages/mimecast/data_stream/siem_logs/_dev/test/pipeline/test-siem-logs.log-expected.json index 524d98731be..e7e1687ff7b 100644 --- a/packages/mimecast/data_stream/siem_logs/_dev/test/pipeline/test-siem-logs.log-expected.json +++ b/packages/mimecast/data_stream/siem_logs/_dev/test/pipeline/test-siem-logs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-18T08:02:43.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -40,7 +40,7 @@ { "@timestamp": "2021-10-19T06:06:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -56,7 +56,9 @@ }, "local_id": "29be076e-44cd-354d-a7c2-083d4a312371", "to": { - "address": "johndoe@example.com" + "address": [ + "johndoe@example.com" + ] } }, "error": { @@ -105,7 +107,7 @@ { "@timestamp": "2021-10-19T06:04:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -141,7 +143,7 @@ { "@timestamp": "2021-10-19T06:04:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -158,7 +160,9 @@ "local_id": "61dfe7da-4c6d-34e1-9667-69b04f0d564f", "message_id": "\u003c137188507-1634623494888@uk-mta-151.uk.mimecast.lan\u003e", "to": { - "address": "johndoejr@example.com" + "address": [ + "johndoejr@example.com" + ] } }, "event": { @@ -200,7 +204,7 @@ { "@timestamp": "2021-10-19T06:04:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -218,7 +222,9 @@ "message_id": "\u003c137188507-1634623494888@uk-mta-151.uk.mimecast.lan\u003e", "subject": "You have new held messages", "to": { - "address": "johndoejr@example.com" + "address": [ + "johndoejr@example.com" + ] } }, "error": { @@ -267,7 +273,7 @@ { "@timestamp": "2021-11-08T12:09:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "internal", @@ -278,7 +284,9 @@ }, "local_id": "CYSuuaBUMjOpk3k1Xhvy_Q", "to": { - "address": "o365_service_account@example.com" + "address": [ + "o365_service_account@example.com" + ] } }, "event": { @@ -299,7 +307,7 @@ { "@timestamp": "2021-11-08T12:10:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "internal", @@ -312,7 +320,9 @@ "message_id": "\u003c140943948-1636373419265@uk-mta-286.uk.mimecast.lan\u003e", "subject": "You have new held messages", "to": { - "address": "johndoejr@example.com" + "address": [ + "johndoejr@example.com" + ] } }, "event": { @@ -347,7 +357,7 @@ { "@timestamp": "2021-11-29T15:13:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -358,7 +368,9 @@ }, "subject": "DocuSign- Contract #45576744333", "to": { - "address": "aorchard@twotoeight.com" + "address": [ + "aorchard@twotoeight.com" + ] } }, "event": { @@ -399,7 +411,7 @@ { "@timestamp": "2023-02-14T13:18:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -413,7 +425,9 @@ "message_id": "\u003c8182967832.4@biz.net\u003e", "subject": "Totally not a scam! (Honest)", "to": { - "address": "big.wig@biz.com" + "address": [ + "big.wig@biz.com" + ] } }, "event": { diff --git a/packages/mimecast/data_stream/siem_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/siem_logs/elasticsearch/ingest_pipeline/default.yml index 1f801d3d14a..3ff204cdde6 100644 --- a/packages/mimecast/data_stream/siem_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/siem_logs/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -57,15 +57,11 @@ processors: field: mimecast.MsgId target_field: email.message_id ignore_missing: true - - rename: - field: mimecast.Rcpt - target_field: email.to.address - ignore_missing: true - append: field: email.to.address - value: "{{{mimecast.Rcpt}}}" + value: '{{{mimecast.Rcpt}}}' allow_duplicates: false - if: "ctx?.mimecast?.Rcpt != null" + if: ctx.mimecast?.Rcpt != null - append: field: email.from.address value: '{{{mimecast.headerFrom}}}' @@ -139,14 +135,11 @@ processors: field: mimecast.md5 target_field: email.attachments.file.hash.md5 ignore_missing: true - - rename: - field: mimecast.Recipient - target_field: email.to.address - ignore_missing: true - append: field: email.to.address - value: "{{{mimecast.Recipient}}}" - if: "ctx?.mimecast?.Recipient != null" + value: '{{{mimecast.Recipient}}}' + allow_duplicates: false + if: ctx.mimecast?.Recipient != null - rename: field: mimecast.SenderDomain target_field: source.domain @@ -195,14 +188,11 @@ processors: field: mimecast.reason target_field: event.reason ignore_missing: true - - rename: - field: mimecast.recipient - target_field: email.to.address - ignore_missing: true - append: field: email.to.address - value: "{{{mimecast.recipient}}}" - if: "ctx?.mimecast?.recipient != null" + value: '{{{mimecast.recipient}}}' + allow_duplicates: false + if: ctx.mimecast?.recipient != null - rename: field: mimecast.route target_field: email.direction @@ -310,16 +300,6 @@ processors: field: source.as.organization_name target_field: source.as.organization.name ignore_missing: true - - dissect: - field: email.from.address - pattern: "<%{email.from.address}>" - ignore_missing: true - ignore_failure: true - - dissect: - field: email.to.address - pattern: "<%{email.to.address}>" - ignore_missing: true - ignore_failure: true # Cleanup - remove: @@ -332,6 +312,8 @@ processors: - mimecast.log_type_part1 - mimecast.log_type_part2 - mimecast.log_type_parts + - mimecast.recipient + - mimecast.Rcpt - mimecast.sender - mimecast.Sender ignore_missing: true diff --git a/packages/mimecast/data_stream/siem_logs/manifest.yml b/packages/mimecast/data_stream/siem_logs/manifest.yml index 7988f7049e9..50b1c8be34a 100644 --- a/packages/mimecast/data_stream/siem_logs/manifest.yml +++ b/packages/mimecast/data_stream/siem_logs/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/siem_logs/sample_event.json b/packages/mimecast/data_stream/siem_logs/sample_event.json index 104088f7a4b..94f34cb4f82 100644 --- a/packages/mimecast/data_stream/siem_logs/sample_event.json +++ b/packages/mimecast/data_stream/siem_logs/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-12T12:15:46.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "c6e5221f-b305-4a75-acb4-7a43547a1e6d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.siem_logs", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "internal", @@ -29,14 +29,16 @@ }, "local_id": "fjihpfEgM_iRwemxhe3t_w", "to": { - "address": "o365_service_account@example.com" + "address": [ + "o365_service_account@example.com" + ] } }, "event": { "agent_id_status": "verified", "created": "2021-11-12T12:15:46+0000", "dataset": "mimecast.siem_logs", - "ingested": "2023-01-13T15:06:00Z", + "ingested": "2023-07-27T14:59:24Z", "original": "{\"Content-Disposition\":\"attachment; filename=\\\"jrnl_20211018093329655.json\\\"\",\"Dir\":\"Internal\",\"Rcpt\":\"o365_service_account@example.com\",\"RcptActType\":\"Jnl\",\"RcptHdrType\":\"Unknown\",\"Sender\":\"johndoe@example.com\",\"aCode\":\"fjihpfEgM_iRwemxhe3t_w\",\"acc\":\"ABC123\",\"datetime\":\"2021-11-12T12:15:46+0000\"}", "outcome": "unknown" }, diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/_dev/test/pipeline/test-threat-intel-malware-customer.log-expected.json b/packages/mimecast/data_stream/threat_intel_malware_customer/_dev/test/pipeline/test-threat-intel-malware-customer.log-expected.json index 03886140ea5..bc88d3356a7 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_customer/_dev/test/pipeline/test-threat-intel-malware-customer.log-expected.json +++ b/packages/mimecast/data_stream/threat_intel_malware_customer/_dev/test/pipeline/test-threat-intel-malware-customer.log-expected.json @@ -4,13 +4,17 @@ { "@timestamp": "2021-10-29T15:07:26.653Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--18c62174-0d31-4653-afe6-d104c57b6b2c\", \"created\": \"2021-10-29T15:07:26.653Z\", \"modified\": \"2021-10-29T15:07:26.653Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'c20d551424f2df6312f7fa700ed97cd199c3d5c8a0f4dfd683627f18913096de']\", \"valid_from\": \"2021-10-29T15:07:26.653Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--18c62174-0d31-4653-afe6-d104c57b6b2c", @@ -48,13 +52,17 @@ { "@timestamp": "2021-10-29T15:07:22.595Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--d70d0fc0-7fbe-4acc-9830-230a97ecdab3\", \"created\": \"2021-10-29T15:07:22.595Z\", \"modified\": \"2021-10-29T15:07:22.595Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '6a6cd489550ddc08871e14dec73f782bf2405378e9f4adeaa61f1574bea4dbbb']\", \"valid_from\": \"2021-10-29T15:07:22.595Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--d70d0fc0-7fbe-4acc-9830-230a97ecdab3", @@ -92,13 +100,17 @@ { "@timestamp": "2021-10-29T15:07:17.538Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--571f0b0a-7206-4a1f-9c5d-9c04e46e0976\", \"created\": \"2021-10-29T15:07:17.538Z\", \"modified\": \"2021-10-29T15:07:17.538Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '8042d56337b7e7be79688ca861b3c4ba928f95b0824f598ca79e63882dea0668']\", \"valid_from\": \"2021-10-29T15:07:17.538Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--571f0b0a-7206-4a1f-9c5d-9c04e46e0976", @@ -136,13 +148,17 @@ { "@timestamp": "2021-10-29T15:07:14.044Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--90b29bf9-ea1a-423b-8542-4c4590f4038c\", \"created\": \"2021-10-29T15:07:14.044Z\", \"modified\": \"2021-10-29T15:07:14.044Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'df086e1fe742f0992ecd2aec8a3a4b5be6023cca5ef8caf1da3d5b67e9359047']\", \"valid_from\": \"2021-10-29T15:07:14.044Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--90b29bf9-ea1a-423b-8542-4c4590f4038c", @@ -180,13 +196,17 @@ { "@timestamp": "2021-10-29T15:07:07.295Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--a84c0ac6-f99e-4d1e-b552-74e9023d1505\", \"created\": \"2021-10-29T15:07:07.295Z\", \"modified\": \"2021-10-29T15:07:07.295Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '5dbdcba2a373949359459e0e94954896bc06565d745dd36ee2b013dee1dcc283']\", \"valid_from\": \"2021-10-29T15:07:07.295Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--a84c0ac6-f99e-4d1e-b552-74e9023d1505", @@ -224,13 +244,17 @@ { "@timestamp": "2021-10-29T15:07:00.555Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--1fe76455-3ec3-4319-a34c-e4e8e8236ec0\", \"created\": \"2021-10-29T15:07:00.555Z\", \"modified\": \"2021-10-29T15:07:00.555Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'bcb910f6ab3144c97ca15845741c94479a8925f545ddf59e74253f50d862d10c']\", \"valid_from\": \"2021-10-29T15:07:00.555Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--1fe76455-3ec3-4319-a34c-e4e8e8236ec0", @@ -268,13 +292,17 @@ { "@timestamp": "2021-10-29T15:07:00.259Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_customer_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--3816deef-ba8f-40c4-ba11-a862b4322b11\", \"created\": \"2021-10-29T15:07:00.259Z\", \"modified\": \"2021-10-29T15:07:00.259Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'e87c5de5f07b36806521334cd25e756b66aa8376d2d52faf269b1878c62cf3dd']\", \"valid_from\": \"2021-10-29T15:07:00.259Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--3816deef-ba8f-40c4-ba11-a862b4322b11", diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/threat_intel_malware_customer/elasticsearch/ingest_pipeline/default.yml index 8415bb38541..a238ac443ae 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_customer/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/threat_intel_malware_customer/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/manifest.yml b/packages/mimecast/data_stream/threat_intel_malware_customer/manifest.yml index bc38ed0be29..621ced1a14b 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_customer/manifest.yml +++ b/packages/mimecast/data_stream/threat_intel_malware_customer/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/threat_intel_malware_customer/sample_event.json b/packages/mimecast/data_stream/threat_intel_malware_customer/sample_event.json index e9e177217c0..3a8ace1bff7 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_customer/sample_event.json +++ b/packages/mimecast/data_stream/threat_intel_malware_customer/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-19T01:28:37.099Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "1cb33560-ee01-4d6d-b63c-4d33848115e0", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.threat_intel_malware_customer", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-01-13T15:07:07.195Z", + "category": [ + "threat" + ], + "created": "2023-07-27T15:00:16.307Z", "dataset": "mimecast.threat_intel_malware_customer", - "ingested": "2023-01-13T15:07:08Z", + "ingested": "2023-07-27T15:00:17Z", "kind": "enrichment", "original": "{\"created\":\"2021-11-19T01:28:37.099Z\",\"id\":\"indicator--456ac916-4c4e-43be-b7a9-6678f6a845cd\",\"labels\":[\"malicious-activity\"],\"modified\":\"2021-11-19T01:28:37.099Z\",\"pattern\":\"[file:hashes.'SHA-256' = 'ec5a6c52acdc187fc6c1187f14cd685c686c2b283503a023c4a9d3a977b491be']\",\"type\":\"indicator\",\"valid_from\":\"2021-11-19T01:28:37.099Z\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/_dev/test/pipeline/test-threat-intel-malware-grid.log-expected.json b/packages/mimecast/data_stream/threat_intel_malware_grid/_dev/test/pipeline/test-threat-intel-malware-grid.log-expected.json index 491a4b32a86..811b28db589 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_grid/_dev/test/pipeline/test-threat-intel-malware-grid.log-expected.json +++ b/packages/mimecast/data_stream/threat_intel_malware_grid/_dev/test/pipeline/test-threat-intel-malware-grid.log-expected.json @@ -4,13 +4,17 @@ { "@timestamp": "2021-10-29T15:07:26.653Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--18c62174-0d31-4653-afe6-d104c57b6b2c\", \"created\": \"2021-10-29T15:07:26.653Z\", \"modified\": \"2021-10-29T15:07:26.653Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'c20d551424f2df6312f7fa700ed97cd199c3d5c8a0f4dfd683627f18913096de']\", \"valid_from\": \"2021-10-29T15:07:26.653Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--18c62174-0d31-4653-afe6-d104c57b6b2c", @@ -48,13 +52,17 @@ { "@timestamp": "2021-10-29T15:07:22.595Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--d70d0fc0-7fbe-4acc-9830-230a97ecdab3\", \"created\": \"2021-10-29T15:07:22.595Z\", \"modified\": \"2021-10-29T15:07:22.595Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '6a6cd489550ddc08871e14dec73f782bf2405378e9f4adeaa61f1574bea4dbbb']\", \"valid_from\": \"2021-10-29T15:07:22.595Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--d70d0fc0-7fbe-4acc-9830-230a97ecdab3", @@ -92,13 +100,17 @@ { "@timestamp": "2021-10-29T15:07:17.538Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--571f0b0a-7206-4a1f-9c5d-9c04e46e0976\", \"created\": \"2021-10-29T15:07:17.538Z\", \"modified\": \"2021-10-29T15:07:17.538Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '8042d56337b7e7be79688ca861b3c4ba928f95b0824f598ca79e63882dea0668']\", \"valid_from\": \"2021-10-29T15:07:17.538Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--571f0b0a-7206-4a1f-9c5d-9c04e46e0976", @@ -136,13 +148,17 @@ { "@timestamp": "2021-10-29T15:07:14.044Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--90b29bf9-ea1a-423b-8542-4c4590f4038c\", \"created\": \"2021-10-29T15:07:14.044Z\", \"modified\": \"2021-10-29T15:07:14.044Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'df086e1fe742f0992ecd2aec8a3a4b5be6023cca5ef8caf1da3d5b67e9359047']\", \"valid_from\": \"2021-10-29T15:07:14.044Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--90b29bf9-ea1a-423b-8542-4c4590f4038c", @@ -180,13 +196,17 @@ { "@timestamp": "2021-10-29T15:07:07.295Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--a84c0ac6-f99e-4d1e-b552-74e9023d1505\", \"created\": \"2021-10-29T15:07:07.295Z\", \"modified\": \"2021-10-29T15:07:07.295Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = '5dbdcba2a373949359459e0e94954896bc06565d745dd36ee2b013dee1dcc283']\", \"valid_from\": \"2021-10-29T15:07:07.295Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--a84c0ac6-f99e-4d1e-b552-74e9023d1505", @@ -224,13 +244,17 @@ { "@timestamp": "2021-10-29T15:07:00.555Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--1fe76455-3ec3-4319-a34c-e4e8e8236ec0\", \"created\": \"2021-10-29T15:07:00.555Z\", \"modified\": \"2021-10-29T15:07:00.555Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'bcb910f6ab3144c97ca15845741c94479a8925f545ddf59e74253f50d862d10c']\", \"valid_from\": \"2021-10-29T15:07:00.555Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--1fe76455-3ec3-4319-a34c-e4e8e8236ec0", @@ -268,13 +292,17 @@ { "@timestamp": "2021-10-29T15:07:00.259Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{ \"Content-Disposition\":\"attachment; filename=\\\"malware_grid_stix_20211028161801144.stix\\\"\",\"type\": \"indicator\", \"id\": \"indicator--3816deef-ba8f-40c4-ba11-a862b4322b11\", \"created\": \"2021-10-29T15:07:00.259Z\", \"modified\": \"2021-10-29T15:07:00.259Z\", \"labels\": [ \"malicious-activity\" ], \"pattern\": \"[file:hashes.'SHA-256' = 'e87c5de5f07b36806521334cd25e756b66aa8376d2d52faf269b1878c62cf3dd']\", \"valid_from\": \"2021-10-29T15:07:00.259Z\" }", - "type": "indicator" + "type": [ + "indicator" + ] }, "mimecast": { "id": "indicator--3816deef-ba8f-40c4-ba11-a862b4322b11", diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/threat_intel_malware_grid/elasticsearch/ingest_pipeline/default.yml index 01f52d974ab..68767c8e845 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_grid/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/threat_intel_malware_grid/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/manifest.yml b/packages/mimecast/data_stream/threat_intel_malware_grid/manifest.yml index 89eeef94b66..f19844ad3c1 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_grid/manifest.yml +++ b/packages/mimecast/data_stream/threat_intel_malware_grid/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/threat_intel_malware_grid/sample_event.json b/packages/mimecast/data_stream/threat_intel_malware_grid/sample_event.json index eb1502e0b34..7742792a182 100644 --- a/packages/mimecast/data_stream/threat_intel_malware_grid/sample_event.json +++ b/packages/mimecast/data_stream/threat_intel_malware_grid/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-19T01:28:37.099Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "f13ad74b-0d24-4bb8-b0f9-b72fc70a980a", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.threat_intel_malware_grid", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-01-13T15:08:03.217Z", + "category": [ + "threat" + ], + "created": "2023-07-27T15:01:03.091Z", "dataset": "mimecast.threat_intel_malware_grid", - "ingested": "2023-01-13T15:08:04Z", + "ingested": "2023-07-27T15:01:04Z", "kind": "enrichment", "original": "{\"created\":\"2021-11-19T01:28:37.099Z\",\"id\":\"indicator--456ac916-4c4e-43be-b7a9-6678f6a845cd\",\"labels\":[\"malicious-activity\"],\"modified\":\"2021-11-19T01:28:37.099Z\",\"pattern\":\"[file:hashes.'SHA-256' = 'ec5a6c52acdc187fc6c1187f14cd685c686c2b283503a023c4a9d3a977b491be']\",\"type\":\"indicator\",\"valid_from\":\"2021-11-19T01:28:37.099Z\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/mimecast/data_stream/ttp_ap_logs/_dev/test/pipeline/test-ttp-ap-logs.log-expected.json b/packages/mimecast/data_stream/ttp_ap_logs/_dev/test/pipeline/test-ttp-ap-logs.log-expected.json index bb3fc13c78b..2ba2a7c96e9 100644 --- a/packages/mimecast/data_stream/ttp_ap_logs/_dev/test/pipeline/test-ttp-ap-logs.log-expected.json +++ b/packages/mimecast/data_stream/ttp_ap_logs/_dev/test/pipeline/test-ttp-ap-logs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-14T18:54:32.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -54,7 +54,7 @@ { "@timestamp": "2021-10-14T11:24:23.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { @@ -105,7 +105,7 @@ { "@timestamp": "2021-10-14T11:24:23.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": { diff --git a/packages/mimecast/data_stream/ttp_ap_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/ttp_ap_logs/elasticsearch/ingest_pipeline/default.yml index 9794432a126..e92dc1d472e 100644 --- a/packages/mimecast/data_stream/ttp_ap_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/ttp_ap_logs/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mimecast/data_stream/ttp_ap_logs/manifest.yml b/packages/mimecast/data_stream/ttp_ap_logs/manifest.yml index 16c094cef78..bf5d4abeaa4 100644 --- a/packages/mimecast/data_stream/ttp_ap_logs/manifest.yml +++ b/packages/mimecast/data_stream/ttp_ap_logs/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/ttp_ap_logs/sample_event.json b/packages/mimecast/data_stream/ttp_ap_logs/sample_event.json index 025eab810af..378a7d55d54 100644 --- a/packages/mimecast/data_stream/ttp_ap_logs/sample_event.json +++ b/packages/mimecast/data_stream/ttp_ap_logs/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-24T11:54:27.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "f1e4b7e5-19a3-41bf-9ad5-c80de2f36ac9", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_ap_logs", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "attachments": { @@ -37,7 +37,7 @@ "\u003c\u003e" ] }, - "message_id": "\u003cCAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\u003e", + "message_id": "\u003c1-CAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\u003e", "subject": "Test Files", "to": { "address": [ @@ -50,14 +50,14 @@ "agent_id_status": "verified", "created": "2021-11-24T11:54:27+0000", "dataset": "mimecast.ttp_ap_logs", - "ingested": "2023-01-13T15:08:52Z", - "original": "{\"actionTriggered\":\"user release, none\",\"date\":\"2021-11-24T11:54:27+0000\",\"definition\":\"Inbound - Safe file with On-Demand Sandbox\",\"details\":\"Safe \\r\\nTime taken: 0 hrs, 0 min, 7 sec\",\"fileHash\":\"cabd7cb6e1822fd9e1fc9bcf144ee26ee6bfc855c4574ca967dd53dcc36a1254\",\"fileName\":\"Datasheet_Mimecast Targeted Threat Protection + Internal Email Protect (2).pdf\",\"fileType\":\"application/pdf\",\"messageId\":\"\\u003cCAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\\u003e\",\"recipientAddress\":\"johndoe@emample.com\",\"result\":\"safe\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Test Files\"}" + "ingested": "2023-07-27T15:03:13Z", + "original": "{\"actionTriggered\":\"user release, none\",\"date\":\"2021-11-24T11:54:27+0000\",\"definition\":\"Inbound - Safe file with On-Demand Sandbox\",\"details\":\"Safe\\r\\nTime taken: 0 hrs, 0 min, 7 sec\",\"fileHash\":\"cabd7cb6e1822fd9e1fc9bcf144ee26ee6bfc855c4574ca967dd53dcc36a1254\",\"fileName\":\"Datasheet_Mimecast Targeted Threat Protection + Internal Email Protect (2).pdf\",\"fileType\":\"application/pdf\",\"messageId\":\"\\u003c1-CAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\\u003e\",\"recipientAddress\":\"johndoe@emample.com\",\"result\":\"safe\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Test Files\"}" }, "input": { "type": "httpjson" }, "mimecast": { - "details": "Safe \r\nTime taken: 0 hrs, 0 min, 7 sec", + "details": "Safe\r\nTime taken: 0 hrs, 0 min, 7 sec", "result": "safe" }, "related": { diff --git a/packages/mimecast/data_stream/ttp_ip_logs/_dev/test/pipeline/test-ttp-ip-logs.log-expected.json b/packages/mimecast/data_stream/ttp_ip_logs/_dev/test/pipeline/test-ttp-ip-logs.log-expected.json index 5f4d5f371ed..4d5da3c6e7b 100644 --- a/packages/mimecast/data_stream/ttp_ip_logs/_dev/test/pipeline/test-ttp-ip-logs.log-expected.json +++ b/packages/mimecast/data_stream/ttp_ip_logs/_dev/test/pipeline/test-ttp-ip-logs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-15T17:10:46.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -59,7 +59,7 @@ { "@timestamp": "2021-10-15T06:16:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -115,7 +115,7 @@ { "@timestamp": "2021-10-13T16:12:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/mimecast/data_stream/ttp_ip_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/ttp_ip_logs/elasticsearch/ingest_pipeline/default.yml index 92371414bf5..637433f58d4 100644 --- a/packages/mimecast/data_stream/ttp_ip_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/ttp_ip_logs/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mimecast/data_stream/ttp_ip_logs/manifest.yml b/packages/mimecast/data_stream/ttp_ip_logs/manifest.yml index 192d22b0d65..41d97005c59 100644 --- a/packages/mimecast/data_stream/ttp_ip_logs/manifest.yml +++ b/packages/mimecast/data_stream/ttp_ip_logs/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/ttp_ip_logs/sample_event.json b/packages/mimecast/data_stream/ttp_ip_logs/sample_event.json index a6a318107ee..2b3c3044c3b 100644 --- a/packages/mimecast/data_stream/ttp_ip_logs/sample_event.json +++ b/packages/mimecast/data_stream/ttp_ip_logs/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-12T15:27:04.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "2c26c85b-6378-46cd-a2b8-222d87230852", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_ip_logs", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "from": { @@ -26,7 +26,7 @@ "johndoe@example.com" ] }, - "message_id": "\u003cMN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\u003e", + "message_id": "\u003c20-MN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\u003e", "subject": "Don't read, just fill out!", "to": { "address": [ @@ -40,8 +40,8 @@ "created": "2021-11-12T15:27:04+0000", "dataset": "mimecast.ttp_ip_logs", "id": "MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8", - "ingested": "2023-01-13T15:10:14Z", - "original": "{\"action\":\"none\",\"definition\":\"IP - 1 hit (Tag email)\",\"eventTime\":\"2021-11-12T15:27:04+0000\",\"hits\":1,\"id\":\"MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8\",\"identifiers\":[\"internal_user_name\"],\"impersonationResults\":[{\"checkerResult\":\"hit\",\"impersonationDomainSource\":\"internal_user_name\",\"similarDomain\":\"John Doe \\u003cjohndoe_cdw@example.com\\u003e\",\"stringSimilarToDomain\":\"John Doe\"}],\"messageId\":\"\\u003cMN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\\u003e\",\"recipientAddress\":\"johndoe@example.com\",\"senderAddress\":\"johndoe@example.com\",\"senderIpAddress\":\"8.8.8.8\",\"subject\":\"Don't read, just fill out!\",\"taggedExternal\":false,\"taggedMalicious\":true}" + "ingested": "2023-07-27T15:04:20Z", + "original": "{\"action\":\"none\",\"definition\":\"IP - 1 hit (Tag email)\",\"eventTime\":\"2021-11-12T15:27:04+0000\",\"hits\":1,\"id\":\"MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8\",\"identifiers\":[\"internal_user_name\"],\"impersonationResults\":[{\"checkerResult\":\"hit\",\"impersonationDomainSource\":\"internal_user_name\",\"similarDomain\":\"John Doe \\u003cjohndoe_cdw@example.com\\u003e\",\"stringSimilarToDomain\":\"John Doe\"}],\"messageId\":\"\\u003c20-MN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\\u003e\",\"recipientAddress\":\"johndoe@example.com\",\"senderAddress\":\"johndoe@example.com\",\"senderIpAddress\":\"8.8.8.8\",\"subject\":\"Don't read, just fill out!\",\"taggedExternal\":false,\"taggedMalicious\":true}" }, "input": { "type": "httpjson" diff --git a/packages/mimecast/data_stream/ttp_url_logs/_dev/test/pipeline/test-ttp-url-logs.log-expected.json b/packages/mimecast/data_stream/ttp_url_logs/_dev/test/pipeline/test-ttp-url-logs.log-expected.json index f3bf9d37056..5b68c50e781 100644 --- a/packages/mimecast/data_stream/ttp_url_logs/_dev/test/pipeline/test-ttp-url-logs.log-expected.json +++ b/packages/mimecast/data_stream/ttp_url_logs/_dev/test/pipeline/test-ttp-url-logs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-16T14:45:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -66,7 +66,7 @@ { "@timestamp": "2021-10-16T14:07:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -129,7 +129,7 @@ { "@timestamp": "2021-10-16T13:31:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -193,7 +193,7 @@ { "@timestamp": "2023-01-04T10:32:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "direction": "internal", diff --git a/packages/mimecast/data_stream/ttp_url_logs/elasticsearch/ingest_pipeline/default.yml b/packages/mimecast/data_stream/ttp_url_logs/elasticsearch/ingest_pipeline/default.yml index 89973aa409f..655a8f2a3cd 100644 --- a/packages/mimecast/data_stream/ttp_url_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mimecast/data_stream/ttp_url_logs/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: # Generic event/ecs fields we always want to populate. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/mimecast/data_stream/ttp_url_logs/manifest.yml b/packages/mimecast/data_stream/ttp_url_logs/manifest.yml index 2a20e107b7f..6db1b7d7aa9 100644 --- a/packages/mimecast/data_stream/ttp_url_logs/manifest.yml +++ b/packages/mimecast/data_stream/ttp_url_logs/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/mimecast/data_stream/ttp_url_logs/sample_event.json b/packages/mimecast/data_stream/ttp_url_logs/sample_event.json index f8384090453..4f0121131cf 100644 --- a/packages/mimecast/data_stream/ttp_url_logs/sample_event.json +++ b/packages/mimecast/data_stream/ttp_url_logs/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-10T03:49:53.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "ffba6f04-a3d6-4e55-8cbc-293b129d88d5", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_url_logs", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -27,7 +27,7 @@ "googlealerts-noreply@google.com" ] }, - "message_id": "\u003c000000000000a02a0a05d0671c06@google.com\u003e", + "message_id": "\u003c20-000000000000a02a0a05d0671c06@google.com\u003e", "subject": "Google Alert - china", "to": { "address": [ @@ -40,8 +40,8 @@ "agent_id_status": "verified", "created": "2021-11-10T03:49:53+0000", "dataset": "mimecast.ttp_url_logs", - "ingested": "2023-01-13T15:11:24Z", - "original": "{\"action\":\"allow\",\"actions\":\"Allow\",\"adminOverride\":\"N/A\",\"category\":\"Search Engines \\u0026 Portals\",\"creationMethod\":\"User Click\",\"date\":\"2021-11-10T03:49:53+0000\",\"emailPartsDescription\":[\"Body\"],\"fromUserEmailAddress\":\"googlealerts-noreply@google.com\",\"messageId\":\"\\u003c000000000000a02a0a05d0671c06@google.com\\u003e\",\"route\":\"inbound\",\"scanResult\":\"clean\",\"sendingIp\":\"8.8.8.8\",\"subject\":\"Google Alert - china\",\"ttpDefinition\":\"Inbound URL 'Aggressive'\",\"url\":\"https://www.google.co.za/alerts/share?hl=en\\u0026gl=US\\u0026ru=https://www.wsj.com/articles/u-s-tests-israels-iron-dome-in-guam-as-defense-against-chinese-cruise-missiles-11636455224\\u0026ss=tw\\u0026rt=U.S.+Tests+Israel%27s+Iron+Dome+in+Guam+as+Defense+Against+Chinese+Cruise+Missiles+-+WSJ\\u0026cd=KhQxNzg2NTc5NDQ3ODIzODUyNjI5NzIcZmQ4N2VjYzkxMGIxMWE4Yzpjby56YTplbjpVUw\\u0026ssp=AMJHsmW3CCK1S4TNPifSXszcyaNMwd6TDg\",\"userAwarenessAction\":\"Continue\",\"userEmailAddress\":\"johndoe@example.com\",\"userOverride\":\"None\"}" + "ingested": "2023-07-27T15:05:14Z", + "original": "{\"action\":\"allow\",\"actions\":\"Allow\",\"adminOverride\":\"N/A\",\"category\":\"Search Engines \\u0026 Portals\",\"creationMethod\":\"User Click\",\"date\":\"2021-11-10T03:49:53+0000\",\"emailPartsDescription\":[\"Body\"],\"fromUserEmailAddress\":\"googlealerts-noreply@google.com\",\"messageId\":\"\\u003c20-000000000000a02a0a05d0671c06@google.com\\u003e\",\"route\":\"inbound\",\"scanResult\":\"clean\",\"sendingIp\":\"8.8.8.8\",\"subject\":\"Google Alert - china\",\"ttpDefinition\":\"Inbound URL 'Aggressive'\",\"url\":\"https://www.google.co.za/alerts/share?hl=en\\u0026gl=US\\u0026ru=https://www.wsj.com/articles/u-s-tests-israels-iron-dome-in-guam-as-defense-against-chinese-cruise-missiles-11636455224\\u0026ss=tw\\u0026rt=U.S.+Tests+Israel%27s+Iron+Dome+in+Guam+as+Defense+Against+Chinese+Cruise+Missiles+-+WSJ\\u0026cd=KhQxNzg2NTc5NDQ3ODIzODUyNjI5NzIcZmQ4N2VjYzkxMGIxMWE4Yzpjby56YTplbjpVUw\\u0026ssp=AMJHsmW3CCK1S4TNPifSXszcyaNMwd6TDg\",\"userAwarenessAction\":\"Continue\",\"userEmailAddress\":\"johndoe@example.com\",\"userOverride\":\"None\"}" }, "input": { "type": "httpjson" diff --git a/packages/mimecast/docs/README.md b/packages/mimecast/docs/README.md index 3d67449092a..9cdd467a30c 100644 --- a/packages/mimecast/docs/README.md +++ b/packages/mimecast/docs/README.md @@ -15,6 +15,142 @@ to change the defaults. ## Logs +### Archive Search Logs + +This is the `mimecast.archive_search_logs` dataset. These logs contain Mimecast archive +search logs with the following details: search source, description and detailed +information about the search performed. More information about these logs is available [here]( +https://integrations.mimecast.com/documentation/endpoint-reference/logs-and-statistics/get-archive-search-logs/). + +An example event for `archive_search` looks as following: + +```json +{ + "@timestamp": "2021-03-18T18:35:49.000Z", + "agent": { + "ephemeral_id": "ef42d9ea-67ec-4494-bad4-9d47b9ed68d2", + "id": "f81bb806-77be-4e89-9f08-d426b37fd611", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.2" + }, + "data_stream": { + "dataset": "mimecast.archive_search_logs", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "f81bb806-77be-4e89-9f08-d426b37fd611", + "snapshot": false, + "version": "8.8.2" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "api" + ], + "created": "2021-03-18T18:35:49.000Z", + "dataset": "mimecast.archive_search_logs", + "ingested": "2023-09-11T06:48:05Z", + "kind": "event", + "original": "{\"createTime\":\"2021-03-18T18:35:49+0000\",\"description\":\"Message Tracking Search\",\"emailAddr\":\"admin_dhamilton@hapi1.hamilton321.net\",\"searchReason\":\"\",\"searchText\":\"\",\"source\":\"archive\"}", + "type": [ + "admin" + ] + }, + "input": { + "type": "httpjson" + }, + "mimecast": { + "search_details": { + "description": "Message Tracking Search", + "source": "archive" + } + }, + "related": { + "user": [ + "admin_dhamilton", + "admin_dhamilton@hapi1.hamilton321.net" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "mimecast-archive-search-logs" + ], + "user": { + "domain": "hapi1.hamilton321.net", + "email": "admin_dhamilton@hapi1.hamilton321.net", + "name": "admin_dhamilton" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.id | Unique ID to describe the event. | keyword | +| event.module | Event module | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Input type | keyword | +| log.offset | Log offset | long | +| mimecast.email.address | The email address of the user who performed the search. | keyword | +| mimecast.search_details.description | The description of the search if any. | keyword | +| mimecast.search_details.path | The search path if any. | keyword | +| mimecast.search_details.reason | The search reason entered when the search was executed if any. | keyword | +| mimecast.search_details.source | The search source context | keyword | +| mimecast.search_details.text | The text used in the search. | keyword | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + ### Audit Events This is the `mimecast.audit_events` dataset. These logs contain Mimecast audit @@ -28,11 +164,11 @@ An example event for `audit_events` looks as following: { "@timestamp": "2021-11-16T12:01:37.000Z", "agent": { - "ephemeral_id": "318ed660-ab02-48f6-bd87-53b29acaedab", - "id": "8c5473c5-468b-444c-b5c0-0783fde1f55e", + "ephemeral_id": "67b65934-b452-4461-a076-c9b053b6da1f", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.audit_events", @@ -40,21 +176,21 @@ An example event for `audit_events` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "8c5473c5-468b-444c-b5c0-0783fde1f55e", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.5.1" + "version": "8.9.0" }, "event": { "action": "search-action", "agent_id_status": "verified", - "created": "2023-01-16T22:59:08.657Z", + "created": "2023-07-27T14:56:43.376Z", "dataset": "mimecast.audit_events", - "id": "eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK1o", - "ingested": "2023-01-16T22:59:09Z", - "original": "{\"auditType\":\"Search Action\",\"category\":\"case_review_logs\",\"eventInfo\":\"Inspected Review Set Messages - Source: Review Set - Supervision - hot words, Case - GDPR/CCPA, Message Status: Pending, Date: 2021-11-16, Time: 12:01:37+0000, IP: 8.8.8.8, Application: mimecast-case-review\",\"eventTime\":\"2021-11-16T12:01:37+0000\",\"id\":\"eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK1o\",\"user\":\"johndoe@example.com\"}" + "id": "eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK2o", + "ingested": "2023-07-27T14:56:44Z", + "original": "{\"auditType\":\"Search Action\",\"category\":\"case_review_logs\",\"eventInfo\":\"Inspected Review Set Messages - Source: Review Set - Supervision - hot words, Case - GDPR/CCPA, Message Status: Pending, Date: 2021-11-16, Time: 12:01:37+0000, IP: 8.8.8.8, Application: mimecast-case-review\",\"eventTime\":\"2021-11-16T12:01:37+0000\",\"id\":\"eNqrVipOTS4tSs1MUbJSSg_xMDJPNkisSDdISQ00j0gzz44wDAtL89c2DXZ1C3eP9AyvijKL9I7Rd_WOzC0ztMg2dzFM1M73s6w09CqoDA1T0lFKLE3JLMnJTwcZaGxoaWFsYmhkoaOUXFpckp-bWpScn5IKtMnZxMzR3BSovCy1qDgzP0_JyrAWAAjKK2o\",\"user\":\"johndoe@example.com\"}" }, "input": { "type": "httpjson" @@ -121,7 +257,7 @@ An example event for `audit_events` looks as following: | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module | constant_keyword | @@ -180,11 +316,11 @@ An example event for `dlp` looks as following: { "@timestamp": "2021-11-18T21:41:18.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "b3630060-e536-4953-a9b4-74f78c6ac6c1", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.dlp_logs", @@ -192,12 +328,12 @@ An example event for `dlp` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -206,7 +342,7 @@ An example event for `dlp` looks as following: "\u003c\u003e" ] }, - "message_id": "\u003c20211118214115.B346F10021D@mail.emailsec.ninja\u003e", + "message_id": "\u003c20211118214115.B346F10021D-2@mail.emailsec.ninja\u003e", "subject": "Undelivered Mail Returned to Sender", "to": { "address": [ @@ -219,8 +355,8 @@ An example event for `dlp` looks as following: "agent_id_status": "verified", "created": "2021-11-18T21:41:18+0000", "dataset": "mimecast.dlp_logs", - "ingested": "2023-01-13T15:05:15Z", - "original": "{\"action\":\"notification\",\"eventTime\":\"2021-11-18T21:41:18+0000\",\"messageId\":\"\\u003c20211118214115.B346F10021D@mail.emailsec.ninja\\u003e\",\"policy\":\"Content Inspection - Watermark\",\"recipientAddress\":\"johndoe@example.com\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Undelivered Mail Returned to Sender\"}" + "ingested": "2023-07-27T14:57:41Z", + "original": "{\"action\":\"notification\",\"eventTime\":\"2021-11-18T21:41:18+0000\",\"messageId\":\"\\u003c20211118214115.B346F10021D-2@mail.emailsec.ninja\\u003e\",\"policy\":\"Content Inspection - Watermark\",\"recipientAddress\":\"johndoe@example.com\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Undelivered Mail Returned to Sender\"}" }, "input": { "type": "httpjson" @@ -265,7 +401,7 @@ An example event for `dlp` looks as following: | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | @@ -305,11 +441,11 @@ An example event for `siem` looks as following: { "@timestamp": "2021-11-12T12:15:46.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "c6e5221f-b305-4a75-acb4-7a43547a1e6d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.siem_logs", @@ -317,12 +453,12 @@ An example event for `siem` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "internal", @@ -333,14 +469,16 @@ An example event for `siem` looks as following: }, "local_id": "fjihpfEgM_iRwemxhe3t_w", "to": { - "address": "o365_service_account@example.com" + "address": [ + "o365_service_account@example.com" + ] } }, "event": { "agent_id_status": "verified", "created": "2021-11-12T12:15:46+0000", "dataset": "mimecast.siem_logs", - "ingested": "2023-01-13T15:06:00Z", + "ingested": "2023-07-27T14:59:24Z", "original": "{\"Content-Disposition\":\"attachment; filename=\\\"jrnl_20211018093329655.json\\\"\",\"Dir\":\"Internal\",\"Rcpt\":\"o365_service_account@example.com\",\"RcptActType\":\"Jnl\",\"RcptHdrType\":\"Unknown\",\"Sender\":\"johndoe@example.com\",\"aCode\":\"fjihpfEgM_iRwemxhe3t_w\",\"acc\":\"ABC123\",\"datetime\":\"2021-11-12T12:15:46+0000\"}", "outcome": "unknown" }, @@ -401,7 +539,7 @@ An example event for `siem` looks as following: | error.message | Error message. | match_only_text | | error.type | The type of the error, for example the class name of the exception. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module | constant_keyword | @@ -505,11 +643,11 @@ An example event for `threat_intel_malware_customer` looks as following: { "@timestamp": "2021-11-19T01:28:37.099Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "1cb33560-ee01-4d6d-b63c-4d33848115e0", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.threat_intel_malware_customer", @@ -517,22 +655,26 @@ An example event for `threat_intel_malware_customer` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-01-13T15:07:07.195Z", + "category": [ + "threat" + ], + "created": "2023-07-27T15:00:16.307Z", "dataset": "mimecast.threat_intel_malware_customer", - "ingested": "2023-01-13T15:07:08Z", + "ingested": "2023-07-27T15:00:17Z", "kind": "enrichment", "original": "{\"created\":\"2021-11-19T01:28:37.099Z\",\"id\":\"indicator--456ac916-4c4e-43be-b7a9-6678f6a845cd\",\"labels\":[\"malicious-activity\"],\"modified\":\"2021-11-19T01:28:37.099Z\",\"pattern\":\"[file:hashes.'SHA-256' = 'ec5a6c52acdc187fc6c1187f14cd685c686c2b283503a023c4a9d3a977b491be']\",\"type\":\"indicator\",\"valid_from\":\"2021-11-19T01:28:37.099Z\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" @@ -594,9 +736,9 @@ An example event for `threat_intel_malware_customer` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -657,11 +799,11 @@ An example event for `threat_intel_malware_grid` looks as following: { "@timestamp": "2021-11-19T01:28:37.099Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "f13ad74b-0d24-4bb8-b0f9-b72fc70a980a", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.threat_intel_malware_grid", @@ -669,22 +811,26 @@ An example event for `threat_intel_malware_grid` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-01-13T15:08:03.217Z", + "category": [ + "threat" + ], + "created": "2023-07-27T15:01:03.091Z", "dataset": "mimecast.threat_intel_malware_grid", - "ingested": "2023-01-13T15:08:04Z", + "ingested": "2023-07-27T15:01:04Z", "kind": "enrichment", "original": "{\"created\":\"2021-11-19T01:28:37.099Z\",\"id\":\"indicator--456ac916-4c4e-43be-b7a9-6678f6a845cd\",\"labels\":[\"malicious-activity\"],\"modified\":\"2021-11-19T01:28:37.099Z\",\"pattern\":\"[file:hashes.'SHA-256' = 'ec5a6c52acdc187fc6c1187f14cd685c686c2b283503a023c4a9d3a977b491be']\",\"type\":\"indicator\",\"valid_from\":\"2021-11-19T01:28:37.099Z\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" @@ -746,9 +892,9 @@ An example event for `threat_intel_malware_grid` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -812,11 +958,11 @@ An example event for `ttp_ap` looks as following: { "@timestamp": "2021-11-24T11:54:27.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "f1e4b7e5-19a3-41bf-9ad5-c80de2f36ac9", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_ap_logs", @@ -824,12 +970,12 @@ An example event for `ttp_ap` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "attachments": { @@ -848,7 +994,7 @@ An example event for `ttp_ap` looks as following: "\u003c\u003e" ] }, - "message_id": "\u003cCAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\u003e", + "message_id": "\u003c1-CAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\u003e", "subject": "Test Files", "to": { "address": [ @@ -861,14 +1007,14 @@ An example event for `ttp_ap` looks as following: "agent_id_status": "verified", "created": "2021-11-24T11:54:27+0000", "dataset": "mimecast.ttp_ap_logs", - "ingested": "2023-01-13T15:08:52Z", - "original": "{\"actionTriggered\":\"user release, none\",\"date\":\"2021-11-24T11:54:27+0000\",\"definition\":\"Inbound - Safe file with On-Demand Sandbox\",\"details\":\"Safe \\r\\nTime taken: 0 hrs, 0 min, 7 sec\",\"fileHash\":\"cabd7cb6e1822fd9e1fc9bcf144ee26ee6bfc855c4574ca967dd53dcc36a1254\",\"fileName\":\"Datasheet_Mimecast Targeted Threat Protection + Internal Email Protect (2).pdf\",\"fileType\":\"application/pdf\",\"messageId\":\"\\u003cCAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\\u003e\",\"recipientAddress\":\"johndoe@emample.com\",\"result\":\"safe\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Test Files\"}" + "ingested": "2023-07-27T15:03:13Z", + "original": "{\"actionTriggered\":\"user release, none\",\"date\":\"2021-11-24T11:54:27+0000\",\"definition\":\"Inbound - Safe file with On-Demand Sandbox\",\"details\":\"Safe\\r\\nTime taken: 0 hrs, 0 min, 7 sec\",\"fileHash\":\"cabd7cb6e1822fd9e1fc9bcf144ee26ee6bfc855c4574ca967dd53dcc36a1254\",\"fileName\":\"Datasheet_Mimecast Targeted Threat Protection + Internal Email Protect (2).pdf\",\"fileType\":\"application/pdf\",\"messageId\":\"\\u003c1-CAKUQxhimsCd1bvWQVs14Amuh1+Hnw_bmSuA7ot8hy4eDa9_ziQ@mail.gmail.com\\u003e\",\"recipientAddress\":\"johndoe@emample.com\",\"result\":\"safe\",\"route\":\"inbound\",\"senderAddress\":\"\\u003c\\u003e\",\"subject\":\"Test Files\"}" }, "input": { "type": "httpjson" }, "mimecast": { - "details": "Safe \r\nTime taken: 0 hrs, 0 min, 7 sec", + "details": "Safe\r\nTime taken: 0 hrs, 0 min, 7 sec", "result": "safe" }, "related": { @@ -920,7 +1066,7 @@ An example event for `ttp_ap` looks as following: | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | @@ -973,11 +1119,11 @@ An example event for `ttp_ip` looks as following: { "@timestamp": "2021-11-12T15:27:04.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "2c26c85b-6378-46cd-a2b8-222d87230852", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_ip_logs", @@ -985,12 +1131,12 @@ An example event for `ttp_ip` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "from": { @@ -998,7 +1144,7 @@ An example event for `ttp_ip` looks as following: "johndoe@example.com" ] }, - "message_id": "\u003cMN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\u003e", + "message_id": "\u003c20-MN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\u003e", "subject": "Don't read, just fill out!", "to": { "address": [ @@ -1012,8 +1158,8 @@ An example event for `ttp_ip` looks as following: "created": "2021-11-12T15:27:04+0000", "dataset": "mimecast.ttp_ip_logs", "id": "MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8", - "ingested": "2023-01-13T15:10:14Z", - "original": "{\"action\":\"none\",\"definition\":\"IP - 1 hit (Tag email)\",\"eventTime\":\"2021-11-12T15:27:04+0000\",\"hits\":1,\"id\":\"MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8\",\"identifiers\":[\"internal_user_name\"],\"impersonationResults\":[{\"checkerResult\":\"hit\",\"impersonationDomainSource\":\"internal_user_name\",\"similarDomain\":\"John Doe \\u003cjohndoe_cdw@example.com\\u003e\",\"stringSimilarToDomain\":\"John Doe\"}],\"messageId\":\"\\u003cMN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\\u003e\",\"recipientAddress\":\"johndoe@example.com\",\"senderAddress\":\"johndoe@example.com\",\"senderIpAddress\":\"8.8.8.8\",\"subject\":\"Don't read, just fill out!\",\"taggedExternal\":false,\"taggedMalicious\":true}" + "ingested": "2023-07-27T15:04:20Z", + "original": "{\"action\":\"none\",\"definition\":\"IP - 1 hit (Tag email)\",\"eventTime\":\"2021-11-12T15:27:04+0000\",\"hits\":1,\"id\":\"MTOKEN:eNqrVkouLS7Jz00tSs5PSVWyUnI2MXM0N1XSUcpMUbIyMjM3MzAw0FEqSy0qzszPU7Iy1FEqyQMrNDAwV6oFAGMiEg8\",\"identifiers\":[\"internal_user_name\"],\"impersonationResults\":[{\"checkerResult\":\"hit\",\"impersonationDomainSource\":\"internal_user_name\",\"similarDomain\":\"John Doe \\u003cjohndoe_cdw@example.com\\u003e\",\"stringSimilarToDomain\":\"John Doe\"}],\"messageId\":\"\\u003c20-MN2PR16MB2719879CA4DB60C265F7FD8FB0959@MN2PR16MB2719.namprd16.prod.outlook.com\\u003e\",\"recipientAddress\":\"johndoe@example.com\",\"senderAddress\":\"johndoe@example.com\",\"senderIpAddress\":\"8.8.8.8\",\"subject\":\"Don't read, just fill out!\",\"taggedExternal\":false,\"taggedMalicious\":true}" }, "input": { "type": "httpjson" @@ -1081,7 +1227,7 @@ An example event for `ttp_ip` looks as following: | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.module | Event module | constant_keyword | @@ -1147,11 +1293,11 @@ An example event for `ttp_url` looks as following: { "@timestamp": "2021-11-10T03:49:53.000Z", "agent": { - "ephemeral_id": "f4dde373-2ff7-464b-afdb-da94763f219b", - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", + "ephemeral_id": "ffba6f04-a3d6-4e55-8cbc-293b129d88d5", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mimecast.ttp_url_logs", @@ -1159,12 +1305,12 @@ An example event for `ttp_url` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5d3eee86-91a9-4afa-af92-c6b79bd866c0", - "snapshot": true, - "version": "8.6.0" + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", + "snapshot": false, + "version": "8.9.0" }, "email": { "direction": "inbound", @@ -1173,7 +1319,7 @@ An example event for `ttp_url` looks as following: "googlealerts-noreply@google.com" ] }, - "message_id": "\u003c000000000000a02a0a05d0671c06@google.com\u003e", + "message_id": "\u003c20-000000000000a02a0a05d0671c06@google.com\u003e", "subject": "Google Alert - china", "to": { "address": [ @@ -1186,8 +1332,8 @@ An example event for `ttp_url` looks as following: "agent_id_status": "verified", "created": "2021-11-10T03:49:53+0000", "dataset": "mimecast.ttp_url_logs", - "ingested": "2023-01-13T15:11:24Z", - "original": "{\"action\":\"allow\",\"actions\":\"Allow\",\"adminOverride\":\"N/A\",\"category\":\"Search Engines \\u0026 Portals\",\"creationMethod\":\"User Click\",\"date\":\"2021-11-10T03:49:53+0000\",\"emailPartsDescription\":[\"Body\"],\"fromUserEmailAddress\":\"googlealerts-noreply@google.com\",\"messageId\":\"\\u003c000000000000a02a0a05d0671c06@google.com\\u003e\",\"route\":\"inbound\",\"scanResult\":\"clean\",\"sendingIp\":\"8.8.8.8\",\"subject\":\"Google Alert - china\",\"ttpDefinition\":\"Inbound URL 'Aggressive'\",\"url\":\"https://www.google.co.za/alerts/share?hl=en\\u0026gl=US\\u0026ru=https://www.wsj.com/articles/u-s-tests-israels-iron-dome-in-guam-as-defense-against-chinese-cruise-missiles-11636455224\\u0026ss=tw\\u0026rt=U.S.+Tests+Israel%27s+Iron+Dome+in+Guam+as+Defense+Against+Chinese+Cruise+Missiles+-+WSJ\\u0026cd=KhQxNzg2NTc5NDQ3ODIzODUyNjI5NzIcZmQ4N2VjYzkxMGIxMWE4Yzpjby56YTplbjpVUw\\u0026ssp=AMJHsmW3CCK1S4TNPifSXszcyaNMwd6TDg\",\"userAwarenessAction\":\"Continue\",\"userEmailAddress\":\"johndoe@example.com\",\"userOverride\":\"None\"}" + "ingested": "2023-07-27T15:05:14Z", + "original": "{\"action\":\"allow\",\"actions\":\"Allow\",\"adminOverride\":\"N/A\",\"category\":\"Search Engines \\u0026 Portals\",\"creationMethod\":\"User Click\",\"date\":\"2021-11-10T03:49:53+0000\",\"emailPartsDescription\":[\"Body\"],\"fromUserEmailAddress\":\"googlealerts-noreply@google.com\",\"messageId\":\"\\u003c20-000000000000a02a0a05d0671c06@google.com\\u003e\",\"route\":\"inbound\",\"scanResult\":\"clean\",\"sendingIp\":\"8.8.8.8\",\"subject\":\"Google Alert - china\",\"ttpDefinition\":\"Inbound URL 'Aggressive'\",\"url\":\"https://www.google.co.za/alerts/share?hl=en\\u0026gl=US\\u0026ru=https://www.wsj.com/articles/u-s-tests-israels-iron-dome-in-guam-as-defense-against-chinese-cruise-missiles-11636455224\\u0026ss=tw\\u0026rt=U.S.+Tests+Israel%27s+Iron+Dome+in+Guam+as+Defense+Against+Chinese+Cruise+Missiles+-+WSJ\\u0026cd=KhQxNzg2NTc5NDQ3ODIzODUyNjI5NzIcZmQ4N2VjYzkxMGIxMWE4Yzpjby56YTplbjpVUw\\u0026ssp=AMJHsmW3CCK1S4TNPifSXszcyaNMwd6TDg\",\"userAwarenessAction\":\"Continue\",\"userEmailAddress\":\"johndoe@example.com\",\"userOverride\":\"None\"}" }, "input": { "type": "httpjson" @@ -1263,7 +1409,7 @@ An example event for `ttp_url` looks as following: | email.subject.text | Multi-field of `email.subject`. | match_only_text | | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | diff --git a/packages/mimecast/kibana/dashboard/mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5.json index fe8b1f5afe4..2e73b309e60 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5.json @@ -1,655 +1,655 @@ { - "id": "mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzMCwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.dlp_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.dlp_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-47e0f438-1420-40d4-a779-1845993eb7ea", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "47e0f438-1420-40d4-a779-1845993eb7ea": { - "columnOrder": [ - "031fd53e-b3ed-422e-b50a-6da93afe2752", - "6fb9dc4a-1056-4e74-a4e4-a469941b6efa" - ], - "columns": { - "031fd53e-b3ed-422e-b50a-6da93afe2752": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + "id": "mimecast-042d5620-5411-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzMCwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.dlp_logs" + }, + "type": "phrase" }, - "6fb9dc4a-1056-4e74-a4e4-a469941b6efa": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.dlp_logs" + } } - }, - "incompleteColumns": {} } - } + ], + "query": { + "language": "kuery", + "query": "" } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.dlp_logs" + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-47e0f438-1420-40d4-a779-1845993eb7ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "47e0f438-1420-40d4-a779-1845993eb7ea": { + "columnOrder": [ + "031fd53e-b3ed-422e-b50a-6da93afe2752", + "6fb9dc4a-1056-4e74-a4e4-a469941b6efa" + ], + "columns": { + "031fd53e-b3ed-422e-b50a-6da93afe2752": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6fb9dc4a-1056-4e74-a4e4-a469941b6efa": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.dlp_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.dlp_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"mimecast.dlp_logs\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6fb9dc4a-1056-4e74-a4e4-a469941b6efa" + ], + "layerId": "47e0f438-1420-40d4-a779-1845993eb7ea", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "031fd53e-b3ed-422e-b50a-6da93afe2752" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.dlp_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"mimecast.dlp_logs\"" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "enhancements": {}, + "hidePanelTitles": false }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "gridData": { + "h": 15, + "i": "15971769-d6c7-4cbd-a65b-41773cac89f9", + "w": 48, + "x": 0, + "y": 0 }, - "layers": [ - { - "accessors": [ - "6fb9dc4a-1056-4e74-a4e4-a469941b6efa" - ], - "layerId": "47e0f438-1420-40d4-a779-1845993eb7ea", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "031fd53e-b3ed-422e-b50a-6da93afe2752" - } - ], - "legend": { - "isVisible": true, - "position": "right", - "shouldTruncate": true, - "showSingleSeries": true - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "15971769-d6c7-4cbd-a65b-41773cac89f9", + "title": "DLP Logs Over Time", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0fff056b-7794-4070-8170-3657002b9253", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0fff056b-7794-4070-8170-3657002b9253": { + "columnOrder": [ + "e4eb146d-7546-4a24-ae35-eb2824b345a2", + "c9c6ab54-8f0d-49b4-bf62-33f88decd52c" + ], + "columns": { + "c9c6ab54-8f0d-49b4-bf62-33f88decd52c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "e4eb146d-7546-4a24-ae35-eb2824b345a2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Actions", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c9c6ab54-8f0d-49b4-bf62-33f88decd52c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.dlp_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.dlp_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e4eb146d-7546-4a24-ae35-eb2824b345a2" + }, + { + "columnId": "c9c6ab54-8f0d-49b4-bf62-33f88decd52c" + } + ], + "layerId": "0fff056b-7794-4070-8170-3657002b9253", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 15, + "i": "55a3cb4f-41e1-48a3-b3bb-e4b296503246", + "w": 24, + "x": 0, + "y": 15 }, - "yRightExtent": { - "mode": "full" - } - } + "panelIndex": "55a3cb4f-41e1-48a3-b3bb-e4b296503246", + "title": "DLP Logs - Action taken on message", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "15971769-d6c7-4cbd-a65b-41773cac89f9", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "15971769-d6c7-4cbd-a65b-41773cac89f9", - "title": "DLP Logs Over Time", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-0fff056b-7794-4070-8170-3657002b9253", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "0fff056b-7794-4070-8170-3657002b9253": { - "columnOrder": [ - "e4eb146d-7546-4a24-ae35-eb2824b345a2", - "c9c6ab54-8f0d-49b4-bf62-33f88decd52c" - ], - "columns": { - "c9c6ab54-8f0d-49b4-bf62-33f88decd52c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "e4eb146d-7546-4a24-ae35-eb2824b345a2": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Actions", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "c9c6ab54-8f0d-49b4-bf62-33f88decd52c", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "event.action" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.dlp_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-854e5002-cd2e-466a-ba28-04e926663f66", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "854e5002-cd2e-466a-ba28-04e926663f66": { + "columnOrder": [ + "5745adf7-04d2-4886-8dad-897d57705772", + "b9e528af-178d-488b-8997-fbaf60f2e4aa" + ], + "columns": { + "5745adf7-04d2-4886-8dad-897d57705772": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Policies", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "b9e528af-178d-488b-8997-fbaf60f2e4aa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "rule.name" + }, + "b9e528af-178d-488b-8997-fbaf60f2e4aa": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.dlp_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.dlp_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "5745adf7-04d2-4886-8dad-897d57705772" + }, + { + "columnId": "b9e528af-178d-488b-8997-fbaf60f2e4aa" + } + ], + "layerId": "854e5002-cd2e-466a-ba28-04e926663f66", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.dlp_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "e4eb146d-7546-4a24-ae35-eb2824b345a2" - }, - { - "columnId": "c9c6ab54-8f0d-49b4-bf62-33f88decd52c" - } - ], - "layerId": "0fff056b-7794-4070-8170-3657002b9253", - "layerType": "data" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "13693574-6de9-4ccc-afb9-cc1d99dd83b8", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "13693574-6de9-4ccc-afb9-cc1d99dd83b8", + "title": "DLP Logs - Policies triggered", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "55a3cb4f-41e1-48a3-b3bb-e4b296503246", - "w": 24, - "x": 0, - "y": 15 - }, - "panelIndex": "55a3cb4f-41e1-48a3-b3bb-e4b296503246", - "title": "DLP Logs - Action taken on message", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-854e5002-cd2e-466a-ba28-04e926663f66", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "854e5002-cd2e-466a-ba28-04e926663f66": { - "columnOrder": [ - "5745adf7-04d2-4886-8dad-897d57705772", - "b9e528af-178d-488b-8997-fbaf60f2e4aa" - ], - "columns": { - "5745adf7-04d2-4886-8dad-897d57705772": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Policies", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "b9e528af-178d-488b-8997-fbaf60f2e4aa", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "rule.name" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0f5b8670-33ce-47e6-ac1f-b29f55afaf24", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "0f5b8670-33ce-47e6-ac1f-b29f55afaf24": { + "columnOrder": [ + "7f11f183-c159-43db-8b95-cbb8fd2d8fd7", + "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1" + ], + "columns": { + "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "7f11f183-c159-43db-8b95-cbb8fd2d8fd7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Senders", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "email.from.address" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.dlp_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.dlp_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7f11f183-c159-43db-8b95-cbb8fd2d8fd7", + "isTransposed": false + }, + { + "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", + "isTransposed": false + } + ], + "layerId": "0f5b8670-33ce-47e6-ac1f-b29f55afaf24", + "layerType": "data", + "sorting": { + "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", + "direction": "desc" + } + } }, - "b9e528af-178d-488b-8997-fbaf60f2e4aa": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.dlp_logs" + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.dlp_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "5745adf7-04d2-4886-8dad-897d57705772" - }, - { - "columnId": "b9e528af-178d-488b-8997-fbaf60f2e4aa" - } - ], - "layerId": "854e5002-cd2e-466a-ba28-04e926663f66", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4a088ba2-68ed-418a-b167-7db8a7c592c2", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "4a088ba2-68ed-418a-b167-7db8a7c592c2", + "title": "DLP Logs - Senders that triggered DLP Policies", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 }, - "gridData": { - "h": 15, - "i": "13693574-6de9-4ccc-afb9-cc1d99dd83b8", - "w": 24, - "x": 24, - "y": 15 + "timeFrom": "now-7d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] DLP Logs Dashboard", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "panelIndex": "13693574-6de9-4ccc-afb9-cc1d99dd83b8", - "title": "DLP Logs - Policies triggered", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-0f5b8670-33ce-47e6-ac1f-b29f55afaf24", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "0f5b8670-33ce-47e6-ac1f-b29f55afaf24": { - "columnOrder": [ - "7f11f183-c159-43db-8b95-cbb8fd2d8fd7", - "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1" - ], - "columns": { - "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "7f11f183-c159-43db-8b95-cbb8fd2d8fd7": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Senders", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "email.from.address" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.dlp_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.dlp_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "7f11f183-c159-43db-8b95-cbb8fd2d8fd7", - "isTransposed": false - }, - { - "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", - "isTransposed": false - } - ], - "layerId": "0f5b8670-33ce-47e6-ac1f-b29f55afaf24", - "layerType": "data", - "sorting": { - "columnId": "0033ecfa-a5f3-4828-9fd8-ae82caf7c8f1", - "direction": "desc" - } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "id": "logs-*", + "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:indexpattern-datasource-layer-47e0f438-1420-40d4-a779-1845993eb7ea", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:indexpattern-datasource-layer-0fff056b-7794-4070-8170-3657002b9253", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "4a088ba2-68ed-418a-b167-7db8a7c592c2", - "w": 24, - "x": 0, - "y": 30 + { + "id": "logs-*", + "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "4a088ba2-68ed-418a-b167-7db8a7c592c2", - "title": "DLP Logs - Senders that triggered DLP Policies", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:indexpattern-datasource-layer-854e5002-cd2e-466a-ba28-04e926663f66", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:indexpattern-datasource-layer-0f5b8670-33ce-47e6-ac1f-b29f55afaf24", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:filter-index-pattern-0", + "type": "index-pattern" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-7d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] DLP Logs Dashboard", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:indexpattern-datasource-layer-47e0f438-1420-40d4-a779-1845993eb7ea", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "15971769-d6c7-4cbd-a65b-41773cac89f9:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:indexpattern-datasource-layer-0fff056b-7794-4070-8170-3657002b9253", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "55a3cb4f-41e1-48a3-b3bb-e4b296503246:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:indexpattern-datasource-layer-854e5002-cd2e-466a-ba28-04e926663f66", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "13693574-6de9-4ccc-afb9-cc1d99dd83b8:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:indexpattern-datasource-layer-0f5b8670-33ce-47e6-ac1f-b29f55afaf24", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "logs-*", - "name": "4a088ba2-68ed-418a-b167-7db8a7c592c2:filter-index-pattern-0", - "type": "index-pattern" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5.json index a51c88ad440..f5730dca57d 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5.json @@ -1,392 +1,392 @@ { - "id": "mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzMSwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_customer" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_customer" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-399531fb-a3b2-4881-aa91-9b3f9e7d34e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "399531fb-a3b2-4881-aa91-9b3f9e7d34e7": { - "columnOrder": [ - "d17db96e-f800-4bb6-ad48-2f10d7c1fc34", - "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3" - ], - "columns": { - "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-0ebd21e0-5422-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzMSwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_customer" + }, + "type": "phrase" }, - "d17db96e-f800-4bb6-ad48-2f10d7c1fc34": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_customer" + } } - }, - "incompleteColumns": {} } - } + ], + "query": { + "language": "kuery", + "query": "" } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_customer" + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-399531fb-a3b2-4881-aa91-9b3f9e7d34e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "399531fb-a3b2-4881-aa91-9b3f9e7d34e7": { + "columnOrder": [ + "d17db96e-f800-4bb6-ad48-2f10d7c1fc34", + "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3" + ], + "columns": { + "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "d17db96e-f800-4bb6-ad48-2f10d7c1fc34": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_customer" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_customer" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3" + ], + "layerId": "399531fb-a3b2-4881-aa91-9b3f9e7d34e7", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "d17db96e-f800-4bb6-ad48-2f10d7c1fc34" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_customer" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4", + "w": 24, + "x": 0, + "y": 0 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4", + "title": "[[Mimecast] Threat Intel Feed Targeted - over time", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-662c8260-62a4-4b11-8942-e7900c2fb1bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "662c8260-62a4-4b11-8942-e7900c2fb1bb": { + "columnOrder": [ + "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b", + "7c2cbcee-2579-4971-a811-12bbb4815d9e" + ], + "columns": { + "7c2cbcee-2579-4971-a811-12bbb4815d9e": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of threat.indicator.type", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "7c2cbcee-2579-4971-a811-12bbb4815d9e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "threat.indicator.type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_customer" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_customer" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b" + }, + { + "columnId": "7c2cbcee-2579-4971-a811-12bbb4815d9e" + } + ], + "layerId": "662c8260-62a4-4b11-8942-e7900c2fb1bb", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} }, - "layers": [ - { - "accessors": [ - "9ba4c455-c64a-4ce6-8d0e-a17e79390bd3" - ], - "layerId": "399531fb-a3b2-4881-aa91-9b3f9e7d34e7", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "d17db96e-f800-4bb6-ad48-2f10d7c1fc34" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 15, + "i": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee", + "w": 24, + "x": 24, + "y": 0 }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 15, + "i": "43ba8519-c31d-4884-861e-34bae3c8a782", + "w": 48, + "x": 0, + "y": 15 }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + "panelIndex": "43ba8519-c31d-4884-861e-34bae3c8a782", + "panelRefName": "panel_43ba8519-c31d-4884-861e-34bae3c8a782", + "type": "search", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 }, - "gridData": { - "h": 15, - "i": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4", - "w": 24, - "x": 0, - "y": 0 + "timeFrom": "now-7d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] Threat Intel Feed - Targeted Dashboard", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "panelIndex": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4", - "title": "[[Mimecast] Threat Intel Feed Targeted - over time", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-662c8260-62a4-4b11-8942-e7900c2fb1bb", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "662c8260-62a4-4b11-8942-e7900c2fb1bb": { - "columnOrder": [ - "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b", - "7c2cbcee-2579-4971-a811-12bbb4815d9e" - ], - "columns": { - "7c2cbcee-2579-4971-a811-12bbb4815d9e": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of threat.indicator.type", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "7c2cbcee-2579-4971-a811-12bbb4815d9e", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "threat.indicator.type" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_customer" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_customer" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "c9e207f1-1b64-4b4a-b6cb-ddc770733a8b" - }, - { - "columnId": "7c2cbcee-2579-4971-a811-12bbb4815d9e" - } - ], - "layerId": "662c8260-62a4-4b11-8942-e7900c2fb1bb", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} + { + "id": "logs-*", + "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:indexpattern-datasource-layer-399531fb-a3b2-4881-aa91-9b3f9e7d34e7", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee", - "w": 24, - "x": 24, - "y": 0 + { + "id": "logs-*", + "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "43ba8519-c31d-4884-861e-34bae3c8a782", - "w": 48, - "x": 0, - "y": 15 + { + "id": "logs-*", + "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:indexpattern-datasource-layer-662c8260-62a4-4b11-8942-e7900c2fb1bb", + "type": "index-pattern" }, - "panelIndex": "43ba8519-c31d-4884-861e-34bae3c8a782", - "panelRefName": "panel_43ba8519-c31d-4884-861e-34bae3c8a782", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "mimecast-bfb8e8f0-4084-11ec-b8da-95c3fba730d0", + "name": "43ba8519-c31d-4884-861e-34bae3c8a782:panel_43ba8519-c31d-4884-861e-34bae3c8a782", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-7d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] Threat Intel Feed - Targeted Dashboard", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:indexpattern-datasource-layer-399531fb-a3b2-4881-aa91-9b3f9e7d34e7", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3e4a96ab-a404-4d1d-932d-0d6439e5d7c4:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:indexpattern-datasource-layer-662c8260-62a4-4b11-8942-e7900c2fb1bb", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "044b5a8a-d8c5-4f7b-beae-7c612bd566ee:filter-index-pattern-0", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-bfb8e8f0-4084-11ec-b8da-95c3fba730d0", - "name": "43ba8519-c31d-4884-861e-34bae3c8a782:panel_43ba8519-c31d-4884-861e-34bae3c8a782", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5.json index 98978a6871d..0598e1893a2 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5.json @@ -1,397 +1,397 @@ { - "id": "mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzMiwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_grid" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_grid" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-482f4c89-6ca6-4520-826e-876c0256ae1b", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "482f4c89-6ca6-4520-826e-876c0256ae1b": { - "columnOrder": [ - "6035b29a-145b-48c5-9faf-0d33060bfda0", - "26106801-2a8f-464c-9a0e-439bb734b16b" - ], - "columns": { - "26106801-2a8f-464c-9a0e-439bb734b16b": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-6c61f080-541f-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzMiwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_grid" + }, + "type": "phrase" }, - "6035b29a-145b-48c5-9faf-0d33060bfda0": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_grid" + } } - }, - "incompleteColumns": {} } - } + ], + "query": { + "language": "kuery", + "query": "" } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_grid" + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-482f4c89-6ca6-4520-826e-876c0256ae1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "482f4c89-6ca6-4520-826e-876c0256ae1b": { + "columnOrder": [ + "6035b29a-145b-48c5-9faf-0d33060bfda0", + "26106801-2a8f-464c-9a0e-439bb734b16b" + ], + "columns": { + "26106801-2a8f-464c-9a0e-439bb734b16b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "6035b29a-145b-48c5-9faf-0d33060bfda0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_grid" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_grid" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "26106801-2a8f-464c-9a0e-439bb734b16b" + ], + "layerId": "482f4c89-6ca6-4520-826e-876c0256ae1b", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "6035b29a-145b-48c5-9faf-0d33060bfda0" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_grid" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 16, + "i": "174ad31a-31be-4bc0-b47a-a7692c6c02ae", + "w": 22, + "x": 0, + "y": 0 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 + "panelIndex": "174ad31a-31be-4bc0-b47a-a7692c6c02ae", + "title": "[Miemcast] Threat Intel Feed Regional- over time", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-231039d5-8ca6-4e3d-b6ce-304ff967550c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "231039d5-8ca6-4e3d-b6ce-304ff967550c": { + "columnOrder": [ + "e751fb41-0eb0-444c-858b-b2ffafe590cf", + "b642290b-f2dd-46a6-8641-ef25b6e6e794" + ], + "columns": { + "b642290b-f2dd-46a6-8641-ef25b6e6e794": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "count", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "e751fb41-0eb0-444c-858b-b2ffafe590cf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Indicator", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "b642290b-f2dd-46a6-8641-ef25b6e6e794", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "threat.indicator.type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.threat_intel_malware_grid" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.threat_intel_malware_grid" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e751fb41-0eb0-444c-858b-b2ffafe590cf" + }, + { + "columnId": "b642290b-f2dd-46a6-8641-ef25b6e6e794" + } + ], + "layerId": "231039d5-8ca6-4e3d-b6ce-304ff967550c", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "layers": [ - { - "accessors": [ - "26106801-2a8f-464c-9a0e-439bb734b16b" - ], - "layerId": "482f4c89-6ca6-4520-826e-876c0256ae1b", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "6035b29a-145b-48c5-9faf-0d33060bfda0" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "gridData": { + "h": 16, + "i": "c4041140-c71a-446f-bc68-3e3593202832", + "w": 25, + "x": 22, + "y": 0 }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "panelIndex": "c4041140-c71a-446f-bc68-3e3593202832", + "title": "[Regional] Threat Intel Feed Regional - count by indicator", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" + "gridData": { + "h": 22, + "i": "44ba0d50-0c94-4053-8364-058f0c5a6916", + "w": 47, + "x": 0, + "y": 16 }, - "yRightExtent": { - "mode": "full" - } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + "panelIndex": "44ba0d50-0c94-4053-8364-058f0c5a6916", + "panelRefName": "panel_44ba0d50-0c94-4053-8364-058f0c5a6916", + "title": "[Mimecast] Threat Intel Feed Regional - Most recent logs", + "type": "search", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 }, - "gridData": { - "h": 16, - "i": "174ad31a-31be-4bc0-b47a-a7692c6c02ae", - "w": 22, - "x": 0, - "y": 0 + "timeFrom": "now-7d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] Threat Intel Feed - Regional Dashboard", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "panelIndex": "174ad31a-31be-4bc0-b47a-a7692c6c02ae", - "title": "[Miemcast] Threat Intel Feed Regional- over time", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-231039d5-8ca6-4e3d-b6ce-304ff967550c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "231039d5-8ca6-4e3d-b6ce-304ff967550c": { - "columnOrder": [ - "e751fb41-0eb0-444c-858b-b2ffafe590cf", - "b642290b-f2dd-46a6-8641-ef25b6e6e794" - ], - "columns": { - "b642290b-f2dd-46a6-8641-ef25b6e6e794": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "e751fb41-0eb0-444c-858b-b2ffafe590cf": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Indicator", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "b642290b-f2dd-46a6-8641-ef25b6e6e794", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "threat.indicator.type" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.threat_intel_malware_grid" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.threat_intel_malware_grid" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "e751fb41-0eb0-444c-858b-b2ffafe590cf" - }, - { - "columnId": "b642290b-f2dd-46a6-8641-ef25b6e6e794" - } - ], - "layerId": "231039d5-8ca6-4e3d-b6ce-304ff967550c", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "id": "logs-*", + "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:indexpattern-datasource-layer-482f4c89-6ca6-4520-826e-876c0256ae1b", + "type": "index-pattern" }, - "gridData": { - "h": 16, - "i": "c4041140-c71a-446f-bc68-3e3593202832", - "w": 25, - "x": 22, - "y": 0 + { + "id": "logs-*", + "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "c4041140-c71a-446f-bc68-3e3593202832", - "title": "[Regional] Threat Intel Feed Regional - count by indicator", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false + { + "id": "logs-*", + "name": "c4041140-c71a-446f-bc68-3e3593202832:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "gridData": { - "h": 22, - "i": "44ba0d50-0c94-4053-8364-058f0c5a6916", - "w": 47, - "x": 0, - "y": 16 + { + "id": "logs-*", + "name": "c4041140-c71a-446f-bc68-3e3593202832:indexpattern-datasource-layer-231039d5-8ca6-4e3d-b6ce-304ff967550c", + "type": "index-pattern" }, - "panelIndex": "44ba0d50-0c94-4053-8364-058f0c5a6916", - "panelRefName": "panel_44ba0d50-0c94-4053-8364-058f0c5a6916", - "title": "[Mimecast] Threat Intel Feed Regional - Most recent logs", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "c4041140-c71a-446f-bc68-3e3593202832:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "mimecast-df42cb00-4084-11ec-b8da-95c3fba730d0", + "name": "44ba0d50-0c94-4053-8364-058f0c5a6916:panel_44ba0d50-0c94-4053-8364-058f0c5a6916", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-7d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] Threat Intel Feed - Regional Dashboard", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:indexpattern-datasource-layer-482f4c89-6ca6-4520-826e-876c0256ae1b", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "174ad31a-31be-4bc0-b47a-a7692c6c02ae:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c4041140-c71a-446f-bc68-3e3593202832:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c4041140-c71a-446f-bc68-3e3593202832:indexpattern-datasource-layer-231039d5-8ca6-4e3d-b6ce-304ff967550c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c4041140-c71a-446f-bc68-3e3593202832:filter-index-pattern-0", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-df42cb00-4084-11ec-b8da-95c3fba730d0", - "name": "44ba0d50-0c94-4053-8364-058f0c5a6916:panel_44ba0d50-0c94-4053-8364-058f0c5a6916", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5.json index 6f4c56a5aa1..c2b404ed475 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5.json @@ -1,620 +1,620 @@ { - "id": "mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzMywxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_url_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_url_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-7a34769f-5338-4cf1-8611-76ee68762548", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "7a34769f-5338-4cf1-8611-76ee68762548": { - "columnOrder": [ - "93e854a1-a782-4a03-97b8-b4f8a98b931e", - "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15", - "73bd76e9-d764-4c7c-bfb0-71205b4f7df5" - ], - "columns": { - "73bd76e9-d764-4c7c-bfb0-71205b4f7df5": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-7790e470-541a-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzMywxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" }, - "93e854a1-a782-4a03-97b8-b4f8a98b931e": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of mimecast.scanResult", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "73bd76e9-d764-4c7c-bfb0-71205b4f7df5", - "type": "column" + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_url_logs" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "mimecast.scanResult" + "type": "phrase" }, - "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15": { - "customLabel": true, - "dataType": "date", - "isBucketed": true, - "label": "timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_url_logs" + } } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_url_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_url_logs" } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "curveType": "CURVE_MONOTONE_X", - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "73bd76e9-d764-4c7c-bfb0-71205b4f7df5" - ], - "layerId": "7a34769f-5338-4cf1-8611-76ee68762548", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "93e854a1-a782-4a03-97b8-b4f8a98b931e", - "xAccessor": "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15" - } ], - "legend": { - "isVisible": true, - "position": "right", - "showSingleSeries": true - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" + "query": { + "language": "kuery", + "query": "" } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + } }, - "gridData": { - "h": 14, - "i": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73", - "title": "Clean vs malicious over time", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-76a01545-a0d3-4529-9185-e99aa33aa198", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "76a01545-a0d3-4529-9185-e99aa33aa198": { - "columnOrder": [ - "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd", - "1e318351-5ec1-484c-8a9f-dd79a8c26759" - ], - "columns": { - "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "url", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "1e318351-5ec1-484c-8a9f-dd79a8c26759", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7a34769f-5338-4cf1-8611-76ee68762548", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "url.original" + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7a34769f-5338-4cf1-8611-76ee68762548": { + "columnOrder": [ + "93e854a1-a782-4a03-97b8-b4f8a98b931e", + "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15", + "73bd76e9-d764-4c7c-bfb0-71205b4f7df5" + ], + "columns": { + "73bd76e9-d764-4c7c-bfb0-71205b4f7df5": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "93e854a1-a782-4a03-97b8-b4f8a98b931e": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of mimecast.scanResult", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "73bd76e9-d764-4c7c-bfb0-71205b4f7df5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "mimecast.scanResult" + }, + "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_url_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_url_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "CURVE_MONOTONE_X", + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "73bd76e9-d764-4c7c-bfb0-71205b4f7df5" + ], + "layerId": "7a34769f-5338-4cf1-8611-76ee68762548", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "93e854a1-a782-4a03-97b8-b4f8a98b931e", + "xAccessor": "a116654e-42ef-4dbf-9c3f-07dc0ab0eb15" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } }, - "1e318351-5ec1-484c-8a9f-dd79a8c26759": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_url_logs" + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_url_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.scanResult", - "negate": false, - "params": { - "query": "malicious" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.scanResult": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd", - "isTransposed": false - }, - { - "columnId": "1e318351-5ec1-484c-8a9f-dd79a8c26759", - "isTransposed": false - } - ], - "layerId": "76a01545-a0d3-4529-9185-e99aa33aa198", - "layerType": "data" - } + "gridData": { + "h": 14, + "i": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73", + "title": "Clean vs malicious over time", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "a4201043-b285-4608-b169-4eae313b2b6c", - "w": 24, - "x": 0, - "y": 14 - }, - "panelIndex": "a4201043-b285-4608-b169-4eae313b2b6c", - "title": "Top malicious URLs", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "2a0ae18b-3b74-4c61-8a14-3f87a634e8ba": { - "columnOrder": [ - "2b26e9ef-78d9-4173-97fa-ec7526af0773", - "2782be47-0178-4935-ac5b-05c8a15a61f2" - ], - "columns": { - "2782be47-0178-4935-ac5b-05c8a15a61f2": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "2b26e9ef-78d9-4173-97fa-ec7526af0773": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "category", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "2782be47-0178-4935-ac5b-05c8a15a61f2", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "mimecast.category" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_url_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-76a01545-a0d3-4529-9185-e99aa33aa198", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "76a01545-a0d3-4529-9185-e99aa33aa198": { + "columnOrder": [ + "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd", + "1e318351-5ec1-484c-8a9f-dd79a8c26759" + ], + "columns": { + "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "url", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "1e318351-5ec1-484c-8a9f-dd79a8c26759", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "1e318351-5ec1-484c-8a9f-dd79a8c26759": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "count", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_url_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_url_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.scanResult", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.scanResult": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "0f3030c5-e2c2-46b0-94d9-9fedf71bbedd", + "isTransposed": false + }, + { + "columnId": "1e318351-5ec1-484c-8a9f-dd79a8c26759", + "isTransposed": false + } + ], + "layerId": "76a01545-a0d3-4529-9185-e99aa33aa198", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_url_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a4201043-b285-4608-b169-4eae313b2b6c", + "w": 24, + "x": 0, + "y": 14 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.scanResult", - "negate": false, - "params": { - "query": "malicious" + "panelIndex": "a4201043-b285-4608-b169-4eae313b2b6c", + "title": "Top malicious URLs", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "2a0ae18b-3b74-4c61-8a14-3f87a634e8ba": { + "columnOrder": [ + "2b26e9ef-78d9-4173-97fa-ec7526af0773", + "2782be47-0178-4935-ac5b-05c8a15a61f2" + ], + "columns": { + "2782be47-0178-4935-ac5b-05c8a15a61f2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "count", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "2b26e9ef-78d9-4173-97fa-ec7526af0773": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "category", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "2782be47-0178-4935-ac5b-05c8a15a61f2", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "mimecast.category" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_url_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_url_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.scanResult", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.scanResult": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2b26e9ef-78d9-4173-97fa-ec7526af0773" + }, + { + "columnId": "2782be47-0178-4935-ac5b-05c8a15a61f2" + } + ], + "layerId": "2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.scanResult": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "2b26e9ef-78d9-4173-97fa-ec7526af0773" - }, - { - "columnId": "2782be47-0178-4935-ac5b-05c8a15a61f2" - } - ], - "layerId": "2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", - "layerType": "data" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "23fe1e17-6ce1-4d4e-abb5-2fd095420475", + "w": 24, + "x": 24, + "y": 14 + }, + "panelIndex": "23fe1e17-6ce1-4d4e-abb5-2fd095420475", + "title": "Top URL categories", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 19, + "i": "246c6a37-8605-4c92-8503-0fc545cef56f", + "w": 48, + "x": 0, + "y": 29 + }, + "panelIndex": "246c6a37-8605-4c92-8503-0fc545cef56f", + "panelRefName": "panel_246c6a37-8605-4c92-8503-0fc545cef56f", + "type": "search", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-7d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] TTP URL Protect Logs", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "23fe1e17-6ce1-4d4e-abb5-2fd095420475", - "w": 24, - "x": 24, - "y": 14 + { + "id": "logs-*", + "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "panelIndex": "23fe1e17-6ce1-4d4e-abb5-2fd095420475", - "title": "Top URL categories", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:indexpattern-datasource-layer-7a34769f-5338-4cf1-8611-76ee68762548", + "type": "index-pattern" }, - "gridData": { - "h": 19, - "i": "246c6a37-8605-4c92-8503-0fc545cef56f", - "w": 48, - "x": 0, - "y": 29 + { + "id": "logs-*", + "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "246c6a37-8605-4c92-8503-0fc545cef56f", - "panelRefName": "panel_246c6a37-8605-4c92-8503-0fc545cef56f", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "a4201043-b285-4608-b169-4eae313b2b6c:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4201043-b285-4608-b169-4eae313b2b6c:indexpattern-datasource-layer-76a01545-a0d3-4529-9185-e99aa33aa198", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4201043-b285-4608-b169-4eae313b2b6c:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4201043-b285-4608-b169-4eae313b2b6c:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:indexpattern-datasource-layer-2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "mimecast-fa36c5f0-3fef-11ec-8ace-9fcc35bfe253", + "name": "246c6a37-8605-4c92-8503-0fc545cef56f:panel_246c6a37-8605-4c92-8503-0fc545cef56f", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-7d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] TTP URL Protect Logs", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:indexpattern-datasource-layer-7a34769f-5338-4cf1-8611-76ee68762548", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23ab3e48-e6f2-4c70-a6f5-8dff355eeb73:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a4201043-b285-4608-b169-4eae313b2b6c:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a4201043-b285-4608-b169-4eae313b2b6c:indexpattern-datasource-layer-76a01545-a0d3-4529-9185-e99aa33aa198", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a4201043-b285-4608-b169-4eae313b2b6c:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a4201043-b285-4608-b169-4eae313b2b6c:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:indexpattern-datasource-layer-2a0ae18b-3b74-4c61-8a14-3f87a634e8ba", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "23fe1e17-6ce1-4d4e-abb5-2fd095420475:filter-index-pattern-1", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-fa36c5f0-3fef-11ec-8ace-9fcc35bfe253", - "name": "246c6a37-8605-4c92-8503-0fc545cef56f:panel_246c6a37-8605-4c92-8503-0fc545cef56f", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5.json index 12c6d3f4aa3..74b2a1a5466 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5.json @@ -1,798 +1,798 @@ { - "id": "mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzNCwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ap_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ap_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-7fd2fb45-58d3-499c-8b39-a65a1d337c30", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "7fd2fb45-58d3-499c-8b39-a65a1d337c30": { - "columnOrder": [ - "4c2264ac-1102-43db-b405-02295ddba570", - "29a6d63f-6b9e-42f5-a062-026e264b7905" - ], - "columns": { - "29a6d63f-6b9e-42f5-a062-026e264b7905": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-87fba310-5413-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzNCwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" }, - "4c2264ac-1102-43db-b405-02295ddba570": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1M" - }, - "scale": "interval", - "sourceField": "@timestamp" + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ap_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ap_logs" + } } - }, - "incompleteColumns": {} } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ap_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ap_logs" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.result", - "negate": false, - "params": { - "query": "malicious" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.result": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "29a6d63f-6b9e-42f5-a062-026e264b7905" - ], - "layerId": "7fd2fb45-58d3-499c-8b39-a65a1d337c30", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "4c2264ac-1102-43db-b405-02295ddba570" - } ], - "legend": { - "isInside": false, - "isVisible": true, - "position": "right", - "showSingleSeries": true - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" + "query": { + "language": "kuery", + "query": "" } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + } }, - "gridData": { - "h": 15, - "i": "0939e1a7-1ed7-41c8-8161-c82ee711824c", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "0939e1a7-1ed7-41c8-8161-c82ee711824c", - "title": "TTP AP Logs- Threats (attachments deemed malicious) over time", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cc987f4b-7570-4117-a216-abb8b85d6a74", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "cc987f4b-7570-4117-a216-abb8b85d6a74": { - "columnOrder": [ - "68fb7687-4b9e-4269-9514-d871fd23acf6", - "accab1cb-cf0c-4e6c-94c6-cc50396d0d58" - ], - "columns": { - "68fb7687-4b9e-4269-9514-d871fd23acf6": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Malicious files extensions", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "accab1cb-cf0c-4e6c-94c6-cc50396d0d58", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7fd2fb45-58d3-499c-8b39-a65a1d337c30", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "7fd2fb45-58d3-499c-8b39-a65a1d337c30": { + "columnOrder": [ + "4c2264ac-1102-43db-b405-02295ddba570", + "29a6d63f-6b9e-42f5-a062-026e264b7905" + ], + "columns": { + "29a6d63f-6b9e-42f5-a062-026e264b7905": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "4c2264ac-1102-43db-b405-02295ddba570": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1M" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ap_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ap_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.result", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.result": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "email.attachments.file.extension" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "29a6d63f-6b9e-42f5-a062-026e264b7905" + ], + "layerId": "7fd2fb45-58d3-499c-8b39-a65a1d337c30", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "4c2264ac-1102-43db-b405-02295ddba570" + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } }, - "accab1cb-cf0c-4e6c-94c6-cc50396d0d58": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ap_logs" + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ap_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.result", - "negate": false, - "params": { - "query": "malicious" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.result": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "68fb7687-4b9e-4269-9514-d871fd23acf6", - "isTransposed": false - }, - { - "columnId": "accab1cb-cf0c-4e6c-94c6-cc50396d0d58", - "isTransposed": false - } - ], - "layerId": "cc987f4b-7570-4117-a216-abb8b85d6a74", - "layerType": "data" - } + "gridData": { + "h": 15, + "i": "0939e1a7-1ed7-41c8-8161-c82ee711824c", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "0939e1a7-1ed7-41c8-8161-c82ee711824c", + "title": "TTP AP Logs- Threats (attachments deemed malicious) over time", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "00f684a9-e6f1-4fba-8693-4ff07ec1d480", - "w": 24, - "x": 0, - "y": 15 - }, - "panelIndex": "00f684a9-e6f1-4fba-8693-4ff07ec1d480", - "title": "TTP AP Logs - Threat extension types", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-675873f9-5e65-4f7d-a731-1e5170a98700", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "675873f9-5e65-4f7d-a731-1e5170a98700": { - "columnOrder": [ - "a413b181-ad13-4316-97ad-f563a54dd33d", - "757fdc1e-7a28-470c-a730-e3b9a67ec253" - ], - "columns": { - "757fdc1e-7a28-470c-a730-e3b9a67ec253": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "a413b181-ad13-4316-97ad-f563a54dd33d": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Threats detected by recipients", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "757fdc1e-7a28-470c-a730-e3b9a67ec253", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "email.to.address" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ap_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cc987f4b-7570-4117-a216-abb8b85d6a74", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "cc987f4b-7570-4117-a216-abb8b85d6a74": { + "columnOrder": [ + "68fb7687-4b9e-4269-9514-d871fd23acf6", + "accab1cb-cf0c-4e6c-94c6-cc50396d0d58" + ], + "columns": { + "68fb7687-4b9e-4269-9514-d871fd23acf6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Malicious files extensions", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "accab1cb-cf0c-4e6c-94c6-cc50396d0d58", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "email.attachments.file.extension" + }, + "accab1cb-cf0c-4e6c-94c6-cc50396d0d58": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ap_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ap_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.result", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.result": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "68fb7687-4b9e-4269-9514-d871fd23acf6", + "isTransposed": false + }, + { + "columnId": "accab1cb-cf0c-4e6c-94c6-cc50396d0d58", + "isTransposed": false + } + ], + "layerId": "cc987f4b-7570-4117-a216-abb8b85d6a74", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ap_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.result", - "negate": false, - "params": { - "query": "malicious" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.result": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "a413b181-ad13-4316-97ad-f563a54dd33d", - "isTransposed": false - }, - { - "columnId": "757fdc1e-7a28-470c-a730-e3b9a67ec253", - "isTransposed": false - } - ], - "layerId": "675873f9-5e65-4f7d-a731-1e5170a98700", - "layerType": "data" - } + "gridData": { + "h": 15, + "i": "00f684a9-e6f1-4fba-8693-4ff07ec1d480", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "00f684a9-e6f1-4fba-8693-4ff07ec1d480", + "title": "TTP AP Logs - Threat extension types", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "8d907c29-dd68-4333-9e75-562f38046280", - "w": 24, - "x": 24, - "y": 15 - }, - "panelIndex": "8d907c29-dd68-4333-9e75-562f38046280", - "title": "TTP AP Logs - Threat detected by recipients", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-55f1e965-a3d5-4941-820e-46277d3f3cba", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "55f1e965-a3d5-4941-820e-46277d3f3cba": { - "columnOrder": [ - "2984698c-20fb-4eca-975b-a42fcb4136a4", - "839e65a6-2bfb-4b3a-aa86-044a081338bf" - ], - "columns": { - "2984698c-20fb-4eca-975b-a42fcb4136a4": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Senders", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "839e65a6-2bfb-4b3a-aa86-044a081338bf", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-675873f9-5e65-4f7d-a731-1e5170a98700", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "email.from.address" + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "675873f9-5e65-4f7d-a731-1e5170a98700": { + "columnOrder": [ + "a413b181-ad13-4316-97ad-f563a54dd33d", + "757fdc1e-7a28-470c-a730-e3b9a67ec253" + ], + "columns": { + "757fdc1e-7a28-470c-a730-e3b9a67ec253": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "a413b181-ad13-4316-97ad-f563a54dd33d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threats detected by recipients", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "757fdc1e-7a28-470c-a730-e3b9a67ec253", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "email.to.address" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ap_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ap_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.result", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.result": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "a413b181-ad13-4316-97ad-f563a54dd33d", + "isTransposed": false + }, + { + "columnId": "757fdc1e-7a28-470c-a730-e3b9a67ec253", + "isTransposed": false + } + ], + "layerId": "675873f9-5e65-4f7d-a731-1e5170a98700", + "layerType": "data" + } }, - "839e65a6-2bfb-4b3a-aa86-044a081338bf": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ap_logs" + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ap_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "8d907c29-dd68-4333-9e75-562f38046280", + "w": 24, + "x": 24, + "y": 15 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.result", - "negate": false, - "params": { - "query": "malicious" + "panelIndex": "8d907c29-dd68-4333-9e75-562f38046280", + "title": "TTP AP Logs - Threat detected by recipients", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-55f1e965-a3d5-4941-820e-46277d3f3cba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "55f1e965-a3d5-4941-820e-46277d3f3cba": { + "columnOrder": [ + "2984698c-20fb-4eca-975b-a42fcb4136a4", + "839e65a6-2bfb-4b3a-aa86-044a081338bf" + ], + "columns": { + "2984698c-20fb-4eca-975b-a42fcb4136a4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Senders", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "839e65a6-2bfb-4b3a-aa86-044a081338bf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "email.from.address" + }, + "839e65a6-2bfb-4b3a-aa86-044a081338bf": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ap_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ap_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.result", + "negate": false, + "params": { + "query": "malicious" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.result": "malicious" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2984698c-20fb-4eca-975b-a42fcb4136a4" + }, + { + "columnId": "839e65a6-2bfb-4b3a-aa86-044a081338bf" + } + ], + "layerId": "55f1e965-a3d5-4941-820e-46277d3f3cba", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.result": "malicious" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "2984698c-20fb-4eca-975b-a42fcb4136a4" - }, - { - "columnId": "839e65a6-2bfb-4b3a-aa86-044a081338bf" - } - ], - "layerId": "55f1e965-a3d5-4941-820e-46277d3f3cba", - "layerType": "data" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c3a2a774-3d5f-42a3-be87-694d768aaf92", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "c3a2a774-3d5f-42a3-be87-694d768aaf92", + "title": "TTP AP Logs - Threat detected by senders", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "3da0947d-f5e2-4c52-8577-d313a6256c84", + "w": 24, + "x": 24, + "y": 30 + }, + "panelIndex": "3da0947d-f5e2-4c52-8577-d313a6256c84", + "panelRefName": "panel_3da0947d-f5e2-4c52-8577-d313a6256c84", + "type": "search", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-30d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] TTP Attachment Protect Logs", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:indexpattern-datasource-layer-7fd2fb45-58d3-499c-8b39-a65a1d337c30", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:filter-index-pattern-0", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "c3a2a774-3d5f-42a3-be87-694d768aaf92", - "w": 24, - "x": 0, - "y": 30 + { + "id": "logs-*", + "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:filter-index-pattern-1", + "type": "index-pattern" }, - "panelIndex": "c3a2a774-3d5f-42a3-be87-694d768aaf92", - "title": "TTP AP Logs - Threat detected by senders", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "3da0947d-f5e2-4c52-8577-d313a6256c84", - "w": 24, - "x": 24, - "y": 30 + { + "id": "logs-*", + "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:indexpattern-datasource-layer-cc987f4b-7570-4117-a216-abb8b85d6a74", + "type": "index-pattern" }, - "panelIndex": "3da0947d-f5e2-4c52-8577-d313a6256c84", - "panelRefName": "panel_3da0947d-f5e2-4c52-8577-d313a6256c84", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d907c29-dd68-4333-9e75-562f38046280:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d907c29-dd68-4333-9e75-562f38046280:indexpattern-datasource-layer-675873f9-5e65-4f7d-a731-1e5170a98700", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d907c29-dd68-4333-9e75-562f38046280:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d907c29-dd68-4333-9e75-562f38046280:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:indexpattern-datasource-layer-55f1e965-a3d5-4941-820e-46277d3f3cba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "mimecast-9749a210-3e4a-11ec-80fa-4dfb04910642", + "name": "3da0947d-f5e2-4c52-8577-d313a6256c84:panel_3da0947d-f5e2-4c52-8577-d313a6256c84", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-30d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] TTP Attachment Protect Logs", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:indexpattern-datasource-layer-7fd2fb45-58d3-499c-8b39-a65a1d337c30", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0939e1a7-1ed7-41c8-8161-c82ee711824c:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:indexpattern-datasource-layer-cc987f4b-7570-4117-a216-abb8b85d6a74", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "00f684a9-e6f1-4fba-8693-4ff07ec1d480:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8d907c29-dd68-4333-9e75-562f38046280:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8d907c29-dd68-4333-9e75-562f38046280:indexpattern-datasource-layer-675873f9-5e65-4f7d-a731-1e5170a98700", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8d907c29-dd68-4333-9e75-562f38046280:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8d907c29-dd68-4333-9e75-562f38046280:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:indexpattern-datasource-layer-55f1e965-a3d5-4941-820e-46277d3f3cba", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "c3a2a774-3d5f-42a3-be87-694d768aaf92:filter-index-pattern-1", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-9749a210-3e4a-11ec-80fa-4dfb04910642", - "name": "3da0947d-f5e2-4c52-8577-d313a6256c84:panel_3da0947d-f5e2-4c52-8577-d313a6256c84", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5.json index 277e6300e3c..5a7bbbbacf8 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5.json @@ -1,655 +1,655 @@ { - "id": "mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzNSwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.audit_events" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.audit_events" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-3732d54a-b698-4a66-baef-5d0674eff6c9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "3732d54a-b698-4a66-baef-5d0674eff6c9": { - "columnOrder": [ - "eaf6d751-71b7-431a-b597-6f58857c0ea9" - ], - "columns": { - "eaf6d751-71b7-431a-b597-6f58857c0ea9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "users logged on", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-b4585cb0-541c-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzNSwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.audit_events" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.audit_events" + } } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.audit_events" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.audit_events" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "event.action", - "negate": false, - "params": { - "query": "user-logged-on" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.action": "user-logged-on" } - } + ], + "query": { + "language": "kuery", + "query": "" } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "eaf6d751-71b7-431a-b597-6f58857c0ea9", - "layerId": "3732d54a-b698-4a66-baef-5d0674eff6c9", - "layerType": "data" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsMetric" - }, - "enhancements": {} + } }, - "gridData": { - "h": 15, - "i": "0668cb1c-3653-44fd-9011-207eee1d886c", - "w": 24, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "0668cb1c-3653-44fd-9011-207eee1d886c", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-d1772930-cd84-4843-ad0d-64b5bf4d1e9c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "d1772930-cd84-4843-ad0d-64b5bf4d1e9c": { - "columnOrder": [ - "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902" - ], - "columns": { - "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "login failed attempts", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.audit_events" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3732d54a-b698-4a66-baef-5d0674eff6c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "3732d54a-b698-4a66-baef-5d0674eff6c9": { + "columnOrder": [ + "eaf6d751-71b7-431a-b597-6f58857c0ea9" + ], + "columns": { + "eaf6d751-71b7-431a-b597-6f58857c0ea9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "users logged on", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.audit_events" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.audit_events" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "event.action", + "negate": false, + "params": { + "query": "user-logged-on" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.action": "user-logged-on" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "eaf6d751-71b7-431a-b597-6f58857c0ea9", + "layerId": "3732d54a-b698-4a66-baef-5d0674eff6c9", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.audit_events" - } - } + "enhancements": {} }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "event.action", - "negate": false, - "params": { - "query": "logon-authentication-failed" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.action": "logon-authentication-failed" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902", - "layerId": "d1772930-cd84-4843-ad0d-64b5bf4d1e9c", - "layerType": "data" - } + "gridData": { + "h": 15, + "i": "0668cb1c-3653-44fd-9011-207eee1d886c", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "0668cb1c-3653-44fd-9011-207eee1d886c", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsMetric" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "7c8c2048-f7b1-42f5-8558-61efea1be46d", - "w": 24, - "x": 24, - "y": 0 - }, - "panelIndex": "7c8c2048-f7b1-42f5-8558-61efea1be46d", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "e10fb6fc-8079-4a60-9ea5-f54da0eff2f6": { - "columnOrder": [ - "13c9775c-4b14-4314-a394-e97ffc0e1499", - "a7feab8c-0abd-49eb-96cb-f7a351fa44d3", - "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e", - "01f5144f-929b-4f88-8a0e-995d804e0037" - ], - "columns": { - "01f5144f-929b-4f88-8a0e-995d804e0037": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "count", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "src", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 3 - }, - "scale": "ordinal", - "sourceField": "client.ip" - }, - "13c9775c-4b14-4314-a394-e97ffc0e1499": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "user", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", - "type": "column" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d1772930-cd84-4843-ad0d-64b5bf4d1e9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "user.email" + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "d1772930-cd84-4843-ad0d-64b5bf4d1e9c": { + "columnOrder": [ + "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902" + ], + "columns": { + "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "login failed attempts", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.audit_events" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.audit_events" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "event.action", + "negate": false, + "params": { + "query": "logon-authentication-failed" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.action": "logon-authentication-failed" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "4abe2c7c-88ea-4177-8ea9-aaa8f34bc902", + "layerId": "d1772930-cd84-4843-ad0d-64b5bf4d1e9c", + "layerType": "data" + } }, - "a7feab8c-0abd-49eb-96cb-f7a351fa44d3": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "app", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", - "type": "column" + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "7c8c2048-f7b1-42f5-8558-61efea1be46d", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "7c8c2048-f7b1-42f5-8558-61efea1be46d", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 3 - }, - "scale": "ordinal", - "sourceField": "mimecast.application" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.audit_events" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e10fb6fc-8079-4a60-9ea5-f54da0eff2f6": { + "columnOrder": [ + "13c9775c-4b14-4314-a394-e97ffc0e1499", + "a7feab8c-0abd-49eb-96cb-f7a351fa44d3", + "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e", + "01f5144f-929b-4f88-8a0e-995d804e0037" + ], + "columns": { + "01f5144f-929b-4f88-8a0e-995d804e0037": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "count", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "src", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "13c9775c-4b14-4314-a394-e97ffc0e1499": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "user", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.email" + }, + "a7feab8c-0abd-49eb-96cb-f7a351fa44d3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "app", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "mimecast.application" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.audit_events" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.audit_events" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "event.action", + "negate": false, + "params": { + "query": "logon-authentication-failed" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.action": "logon-authentication-failed" + } + } + } + ], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"mimecast.audit_events\" " + }, + "visualization": { + "columns": [ + { + "columnId": "13c9775c-4b14-4314-a394-e97ffc0e1499", + "isTransposed": false + }, + { + "columnId": "a7feab8c-0abd-49eb-96cb-f7a351fa44d3", + "isTransposed": false + }, + { + "columnId": "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e", + "isTransposed": false + }, + { + "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", + "isTransposed": false + } + ], + "layerId": "e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.audit_events" - } - } + "enhancements": {}, + "hidePanelTitles": false }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "event.action", - "negate": false, - "params": { - "query": "logon-authentication-failed" + "gridData": { + "h": 15, + "i": "f6516880-2d97-4b93-87bb-92f35c377e3b", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "f6516880-2d97-4b93-87bb-92f35c377e3b", + "title": "[Mimecast] Failed authentication by user, app and src", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true},\"id\":\"6d200d4d-9645-457c-82ee-84bfb2da30ca\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"geoField\":\"client.geo.location\",\"filterByMapBounds\":true,\"scalingType\":\"CLUSTERS\",\"id\":\"d0374776-f76c-46ed-a656-a0a35583a2ba\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"tooltipProperties\":[],\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSplitField\":\"\",\"topHitsSize\":1},\"id\":\"84b4eec1-9626-4236-8164-b59027952799\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.5,\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#41937c\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"includeInFitToBounds\":true,\"type\":\"BLENDED_VECTOR\",\"joins\":[]}]", + "mapStateJSON": "{\"zoom\":0.83,\"center\":{\"lon\":4.00755,\"lat\":40.62529},\"timeFilters\":{\"from\":\"now-1y/d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"logs-*\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"data_stream.dataset\",\"params\":{\"query\":\"mimecast.audit_events\"}},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"mimecast.audit_events\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"index\":\"logs-*\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"event.action\",\"params\":{\"query\":\"logon-authentication-failed\"}},\"query\":{\"match_phrase\":{\"event.action\":\"logon-authentication-failed\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.action": "logon-authentication-failed" - } - } - } - ], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"mimecast.audit_events\" " - }, - "visualization": { - "columns": [ - { - "columnId": "13c9775c-4b14-4314-a394-e97ffc0e1499", - "isTransposed": false - }, - { - "columnId": "a7feab8c-0abd-49eb-96cb-f7a351fa44d3", - "isTransposed": false - }, - { - "columnId": "07a0c304-5e0b-4fc7-9b79-e81ddcbe766e", - "isTransposed": false - }, - { - "columnId": "01f5144f-929b-4f88-8a0e-995d804e0037", - "isTransposed": false - } - ], - "layerId": "e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", - "layerType": "data" - } + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": true, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 180, + "minLat": -85.05113, + "minLon": -180 + }, + "mapCenter": { + "lat": 45.66276, + "lon": 4.00755, + "zoom": 0.83 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 15, + "i": "314e1d17-5eaf-4341-854a-2956bbef1870", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "314e1d17-5eaf-4341-854a-2956bbef1870", + "title": "[Mimecast] Failed authentication by country", + "type": "map", + "version": "7.16.0-SNAPSHOT" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", + "w": 48, + "x": 0, + "y": 30 + }, + "panelIndex": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", + "panelRefName": "panel_5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", + "type": "search", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "8b954556-f449-4d03-88c5-9ba86af34244", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "8b954556-f449-4d03-88c5-9ba86af34244", + "panelRefName": "panel_8b954556-f449-4d03-88c5-9ba86af34244", + "type": "search", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-24h/h", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] Access Logs Dashboard", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "f6516880-2d97-4b93-87bb-92f35c377e3b", - "w": 24, - "x": 0, - "y": 15 + { + "id": "logs-*", + "name": "0668cb1c-3653-44fd-9011-207eee1d886c:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "panelIndex": "f6516880-2d97-4b93-87bb-92f35c377e3b", - "title": "[Mimecast] Failed authentication by user, app and src", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true},\"id\":\"6d200d4d-9645-457c-82ee-84bfb2da30ca\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"VECTOR_TILE\"},{\"sourceDescriptor\":{\"indexPatternId\":\"logs-*\",\"geoField\":\"client.geo.location\",\"filterByMapBounds\":true,\"scalingType\":\"CLUSTERS\",\"id\":\"d0374776-f76c-46ed-a656-a0a35583a2ba\",\"type\":\"ES_SEARCH\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"tooltipProperties\":[],\"sortField\":\"\",\"sortOrder\":\"desc\",\"topHitsSplitField\":\"\",\"topHitsSize\":1},\"id\":\"84b4eec1-9626-4236-8164-b59027952799\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.5,\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#54B399\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#41937c\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":6}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"STATIC\",\"options\":{\"value\":\"\"}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"includeInFitToBounds\":true,\"type\":\"BLENDED_VECTOR\",\"joins\":[]}]", - "mapStateJSON": "{\"zoom\":0.83,\"center\":{\"lon\":4.00755,\"lat\":40.62529},\"timeFilters\":{\"from\":\"now-1y/d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"logs-*\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"data_stream.dataset\",\"params\":{\"query\":\"mimecast.audit_events\"}},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"mimecast.audit_events\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"index\":\"logs-*\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"event.action\",\"params\":{\"query\":\"logon-authentication-failed\"}},\"query\":{\"match_phrase\":{\"event.action\":\"logon-authentication-failed\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "title": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "enhancements": {}, - "hiddenLayers": [], - "hidePanelTitles": false, - "isLayerTOCOpen": true, - "mapBuffer": { - "maxLat": 85.05113, - "maxLon": 180, - "minLat": -85.05113, - "minLon": -180 - }, - "mapCenter": { - "lat": 45.66276, - "lon": 4.00755, - "zoom": 0.83 - }, - "openTOCDetails": [] + { + "id": "logs-*", + "name": "0668cb1c-3653-44fd-9011-207eee1d886c:indexpattern-datasource-layer-3732d54a-b698-4a66-baef-5d0674eff6c9", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "314e1d17-5eaf-4341-854a-2956bbef1870", - "w": 24, - "x": 24, - "y": 15 + { + "id": "logs-*", + "name": "0668cb1c-3653-44fd-9011-207eee1d886c:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "314e1d17-5eaf-4341-854a-2956bbef1870", - "title": "[Mimecast] Failed authentication by country", - "type": "map", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "0668cb1c-3653-44fd-9011-207eee1d886c:filter-index-pattern-1", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", - "w": 48, - "x": 0, - "y": 30 + { + "id": "logs-*", + "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "panelIndex": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", - "panelRefName": "panel_5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", - "type": "search", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:indexpattern-datasource-layer-d1772930-cd84-4843-ad0d-64b5bf4d1e9c", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "8b954556-f449-4d03-88c5-9ba86af34244", - "w": 48, - "x": 0, - "y": 45 + { + "id": "logs-*", + "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "8b954556-f449-4d03-88c5-9ba86af34244", - "panelRefName": "panel_8b954556-f449-4d03-88c5-9ba86af34244", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:indexpattern-datasource-layer-e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "314e1d17-5eaf-4341-854a-2956bbef1870:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "mimecast-0d8b0660-3fdd-11ec-8ace-9fcc35bfe253", + "name": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79:panel_5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", + "type": "search" + }, + { + "id": "mimecast-96ac7780-541e-11ec-bd43-b5e1f9a9c8d5", + "name": "8b954556-f449-4d03-88c5-9ba86af34244:panel_8b954556-f449-4d03-88c5-9ba86af34244", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-24h/h", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] Access Logs Dashboard", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0668cb1c-3653-44fd-9011-207eee1d886c:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0668cb1c-3653-44fd-9011-207eee1d886c:indexpattern-datasource-layer-3732d54a-b698-4a66-baef-5d0674eff6c9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0668cb1c-3653-44fd-9011-207eee1d886c:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "0668cb1c-3653-44fd-9011-207eee1d886c:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:indexpattern-datasource-layer-d1772930-cd84-4843-ad0d-64b5bf4d1e9c", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "7c8c2048-f7b1-42f5-8558-61efea1be46d:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:indexpattern-datasource-layer-e10fb6fc-8079-4a60-9ea5-f54da0eff2f6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f6516880-2d97-4b93-87bb-92f35c377e3b:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "314e1d17-5eaf-4341-854a-2956bbef1870:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "mimecast-0d8b0660-3fdd-11ec-8ace-9fcc35bfe253", - "name": "5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79:panel_5e6b4ed3-3f2b-4ee4-b6e3-ba2ef880aa79", - "type": "search" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-96ac7780-541e-11ec-bd43-b5e1f9a9c8d5", - "name": "8b954556-f449-4d03-88c5-9ba86af34244:panel_8b954556-f449-4d03-88c5-9ba86af34244", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5.json index b5220910684..8ffa3b0a36c 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5.json @@ -1,851 +1,851 @@ { - "id": "mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzNiwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.siem_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.siem_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-1faf17aa-0298-4830-a031-00f1b48435b6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "1faf17aa-0298-4830-a031-00f1b48435b6": { - "columnOrder": [ - "95cdbe62-23e4-43ee-9bab-123bfc4a3e68", - "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be", - "2611cbf0-c905-44cc-a98e-25fbdcd5dbee" - ], - "columns": { - "2611cbf0-c905-44cc-a98e-25fbdcd5dbee": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "95cdbe62-23e4-43ee-9bab-123bfc4a3e68": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "1d" - }, - "scale": "interval", - "sourceField": "@timestamp" + "id": "mimecast-bca36430-540f-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzNiwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" }, - "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of email.direction", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "2611cbf0-c905-44cc-a98e-25fbdcd5dbee", - "type": "column" + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.siem_logs" }, - "orderDirection": "desc", - "otherBucket": false, - "size": 4 - }, - "scale": "ordinal", - "sourceField": "email.direction" + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.siem_logs" + } } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.siem_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.siem_logs" } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "2611cbf0-c905-44cc-a98e-25fbdcd5dbee" - ], - "layerId": "1faf17aa-0298-4830-a031-00f1b48435b6", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be", - "xAccessor": "95cdbe62-23e4-43ee-9bab-123bfc4a3e68" - } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yLeftExtent": { - "mode": "full" - }, - "yRightExtent": { - "mode": "full" + "query": { + "language": "kuery", + "query": "" } - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + } }, - "gridData": { - "h": 13, - "i": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728", - "title": "SIEM Logs - Email Activity Summary", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-8a4f8003-e917-44ab-9b50-c46553bacd59", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-2", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "8a4f8003-e917-44ab-9b50-c46553bacd59": { - "columnOrder": [ - "aaa283a2-4c24-432c-b7f3-a3304e800b51", - "826ba46a-7476-493d-a256-c717d69e7d2b" - ], - "columns": { - "826ba46a-7476-493d-a256-c717d69e7d2b": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "aaa283a2-4c24-432c-b7f3-a3304e800b51": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Held Reasons", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "826ba46a-7476-493d-a256-c717d69e7d2b", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "event.reason" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.siem_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1faf17aa-0298-4830-a031-00f1b48435b6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "1faf17aa-0298-4830-a031-00f1b48435b6": { + "columnOrder": [ + "95cdbe62-23e4-43ee-9bab-123bfc4a3e68", + "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be", + "2611cbf0-c905-44cc-a98e-25fbdcd5dbee" + ], + "columns": { + "2611cbf0-c905-44cc-a98e-25fbdcd5dbee": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "95cdbe62-23e4-43ee-9bab-123bfc4a3e68": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "1d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of email.direction", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "2611cbf0-c905-44cc-a98e-25fbdcd5dbee", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 4 + }, + "scale": "ordinal", + "sourceField": "email.direction" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.siem_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.siem_logs" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "2611cbf0-c905-44cc-a98e-25fbdcd5dbee" + ], + "layerId": "1faf17aa-0298-4830-a031-00f1b48435b6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "c9f7cf64-8a98-4e3c-b12c-a22d26ca20be", + "xAccessor": "95cdbe62-23e4-43ee-9bab-123bfc4a3e68" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yRightExtent": { + "mode": "full" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.siem_logs" - } - } + "enhancements": {}, + "hidePanelTitles": false }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.log_type", - "negate": false, - "params": { - "query": "process" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.log_type": "process" - } - } + "gridData": { + "h": 13, + "i": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728", + "w": 48, + "x": 0, + "y": 0 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-2", - "key": "event.action", - "negate": false, - "params": { - "query": "Hld" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.action": "Hld" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "aaa283a2-4c24-432c-b7f3-a3304e800b51", - "isTransposed": false - }, - { - "columnId": "826ba46a-7476-493d-a256-c717d69e7d2b", - "isTransposed": false - } - ], - "layerId": "8a4f8003-e917-44ab-9b50-c46553bacd59", - "layerType": "data" - } + "panelIndex": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728", + "title": "SIEM Logs - Email Activity Summary", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "3031d781-05b7-4504-b23b-bd4d3233b22b", - "w": 24, - "x": 24, - "y": 13 - }, - "panelIndex": "3031d781-05b7-4504-b23b-bd4d3233b22b", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-87e37d53-70f7-4337-86ed-832fcb7f9383", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-2", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "87e37d53-70f7-4337-86ed-832fcb7f9383": { - "columnOrder": [ - "482922c8-4843-45af-9b42-01c50685bfbe", - "9643e088-9c36-476d-a969-244e0d2ecc23" - ], - "columns": { - "482922c8-4843-45af-9b42-01c50685bfbe": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Delivery Failures", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "9643e088-9c36-476d-a969-244e0d2ecc23", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "error.type" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8a4f8003-e917-44ab-9b50-c46553bacd59", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-2", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "8a4f8003-e917-44ab-9b50-c46553bacd59": { + "columnOrder": [ + "aaa283a2-4c24-432c-b7f3-a3304e800b51", + "826ba46a-7476-493d-a256-c717d69e7d2b" + ], + "columns": { + "826ba46a-7476-493d-a256-c717d69e7d2b": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "aaa283a2-4c24-432c-b7f3-a3304e800b51": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Held Reasons", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "826ba46a-7476-493d-a256-c717d69e7d2b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.reason" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.siem_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.siem_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.log_type", + "negate": false, + "params": { + "query": "process" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.log_type": "process" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-2", + "key": "event.action", + "negate": false, + "params": { + "query": "Hld" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.action": "Hld" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "aaa283a2-4c24-432c-b7f3-a3304e800b51", + "isTransposed": false + }, + { + "columnId": "826ba46a-7476-493d-a256-c717d69e7d2b", + "isTransposed": false + } + ], + "layerId": "8a4f8003-e917-44ab-9b50-c46553bacd59", + "layerType": "data" + } }, - "9643e088-9c36-476d-a969-244e0d2ecc23": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.siem_logs" + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.siem_logs" - } - } + "enhancements": {} }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.log_type", - "negate": false, - "params": { - "query": "delivery" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.log_type": "delivery" - } - } + "gridData": { + "h": 15, + "i": "3031d781-05b7-4504-b23b-bd4d3233b22b", + "w": 24, + "x": 24, + "y": 13 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-2", - "key": "event.outcome", - "negate": false, - "params": { - "query": "failure" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.outcome": "failure" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "482922c8-4843-45af-9b42-01c50685bfbe", - "isTransposed": false - }, - { - "columnId": "9643e088-9c36-476d-a969-244e0d2ecc23", - "isTransposed": false - } - ], - "layerId": "87e37d53-70f7-4337-86ed-832fcb7f9383", - "layerType": "data" - } + "panelIndex": "3031d781-05b7-4504-b23b-bd4d3233b22b", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "a6ffda35-4fc4-4204-92c3-45d473823e00", - "w": 24, - "x": 0, - "y": 13 - }, - "panelIndex": "a6ffda35-4fc4-4204-92c3-45d473823e00", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-e55c6dff-df9b-4c78-96e4-af36202efbde", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-2", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "e55c6dff-df9b-4c78-96e4-af36202efbde": { - "columnOrder": [ - "f8efadab-8604-4947-8ef2-7f0d38db76f4", - "7f83a56b-b863-482d-962d-78a2e36940d5" - ], - "columns": { - "7f83a56b-b863-482d-962d-78a2e36940d5": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - }, - "f8efadab-8604-4947-8ef2-7f0d38db76f4": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Rejections reasons", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "7f83a56b-b863-482d-962d-78a2e36940d5", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "error.type" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.siem_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-87e37d53-70f7-4337-86ed-832fcb7f9383", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-2", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "87e37d53-70f7-4337-86ed-832fcb7f9383": { + "columnOrder": [ + "482922c8-4843-45af-9b42-01c50685bfbe", + "9643e088-9c36-476d-a969-244e0d2ecc23" + ], + "columns": { + "482922c8-4843-45af-9b42-01c50685bfbe": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Delivery Failures", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "9643e088-9c36-476d-a969-244e0d2ecc23", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "error.type" + }, + "9643e088-9c36-476d-a969-244e0d2ecc23": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.siem_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.siem_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.log_type", + "negate": false, + "params": { + "query": "delivery" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.log_type": "delivery" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-2", + "key": "event.outcome", + "negate": false, + "params": { + "query": "failure" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.outcome": "failure" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "482922c8-4843-45af-9b42-01c50685bfbe", + "isTransposed": false + }, + { + "columnId": "9643e088-9c36-476d-a969-244e0d2ecc23", + "isTransposed": false + } + ], + "layerId": "87e37d53-70f7-4337-86ed-832fcb7f9383", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.siem_logs" - } - } + "enhancements": {} }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.log_type", - "negate": false, - "params": { - "query": "receipt" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.log_type": "receipt" - } - } + "gridData": { + "h": 15, + "i": "a6ffda35-4fc4-4204-92c3-45d473823e00", + "w": 24, + "x": 0, + "y": 13 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-2", - "key": "event.action", - "negate": false, - "params": { - "query": "Rej" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.action": "Rej" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "f8efadab-8604-4947-8ef2-7f0d38db76f4" - }, - { - "columnId": "7f83a56b-b863-482d-962d-78a2e36940d5" - } - ], - "layerId": "e55c6dff-df9b-4c78-96e4-af36202efbde", - "layerType": "data" - } + "panelIndex": "a6ffda35-4fc4-4204-92c3-45d473823e00", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {} + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e55c6dff-df9b-4c78-96e4-af36202efbde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-2", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "e55c6dff-df9b-4c78-96e4-af36202efbde": { + "columnOrder": [ + "f8efadab-8604-4947-8ef2-7f0d38db76f4", + "7f83a56b-b863-482d-962d-78a2e36940d5" + ], + "columns": { + "7f83a56b-b863-482d-962d-78a2e36940d5": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "f8efadab-8604-4947-8ef2-7f0d38db76f4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Rejections reasons", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "7f83a56b-b863-482d-962d-78a2e36940d5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "error.type" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.siem_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.siem_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.log_type", + "negate": false, + "params": { + "query": "receipt" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.log_type": "receipt" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-2", + "key": "event.action", + "negate": false, + "params": { + "query": "Rej" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.action": "Rej" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "f8efadab-8604-4947-8ef2-7f0d38db76f4" + }, + { + "columnId": "7f83a56b-b863-482d-962d-78a2e36940d5" + } + ], + "layerId": "e55c6dff-df9b-4c78-96e4-af36202efbde", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "b356a564-3af3-4721-8885-930f4933fda7", + "w": 24, + "x": 0, + "y": 28 + }, + "panelIndex": "b356a564-3af3-4721-8885-930f4933fda7", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-7d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] SIEM Logs Dashboard", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:indexpattern-datasource-layer-1faf17aa-0298-4830-a031-00f1b48435b6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:indexpattern-datasource-layer-8a4f8003-e917-44ab-9b50-c46553bacd59", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "b356a564-3af3-4721-8885-930f4933fda7", - "w": 24, - "x": 0, - "y": 28 + { + "id": "logs-*", + "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-0", + "type": "index-pattern" }, - "panelIndex": "b356a564-3af3-4721-8885-930f4933fda7", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "logs-*", + "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:indexpattern-datasource-layer-87e37d53-70f7-4337-86ed-832fcb7f9383", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b356a564-3af3-4721-8885-930f4933fda7:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b356a564-3af3-4721-8885-930f4933fda7:indexpattern-datasource-layer-e55c6dff-df9b-4c78-96e4-af36202efbde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-2", + "type": "index-pattern" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-7d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] SIEM Logs Dashboard", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:indexpattern-datasource-layer-1faf17aa-0298-4830-a031-00f1b48435b6", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8f10a0bb-d41d-4e2b-8e95-e17790cf0728:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:indexpattern-datasource-layer-8a4f8003-e917-44ab-9b50-c46553bacd59", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "3031d781-05b7-4504-b23b-bd4d3233b22b:filter-index-pattern-2", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:indexpattern-datasource-layer-87e37d53-70f7-4337-86ed-832fcb7f9383", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a6ffda35-4fc4-4204-92c3-45d473823e00:filter-index-pattern-2", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b356a564-3af3-4721-8885-930f4933fda7:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b356a564-3af3-4721-8885-930f4933fda7:indexpattern-datasource-layer-e55c6dff-df9b-4c78-96e4-af36202efbde", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-1", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "logs-*", - "name": "b356a564-3af3-4721-8885-930f4933fda7:filter-index-pattern-2", - "type": "index-pattern" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5.json index 57798fd1317..b6f832fd182 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5.json @@ -1,1104 +1,1104 @@ { - "id": "mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzNywxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "10e24b74-6c1f-40d2-8d40-2ec39d2a437a": { - "columnOrder": [ - "922203eb-f986-4d8a-b662-c61723b140f5" - ], - "columns": { - "922203eb-f986-4d8a-b662-c61723b140f5": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + "id": "mimecast-f22e62f0-5417-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzNywxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } } - }, - "incompleteColumns": {} } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.identifiers", - "negate": false, - "params": { - "query": "similar_internal_domain" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.identifiers": "similar_internal_domain" - } - } + ], + "query": { + "language": "kuery", + "query": "" } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "922203eb-f986-4d8a-b662-c61723b140f5", - "layerId": "10e24b74-6c1f-40d2-8d40-2ec39d2a437a", - "layerType": "data" - } - }, - "title": "[Mimecast] SimilarInternalDomain", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-10e24b74-6c1f-40d2-8d40-2ec39d2a437a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } + } }, - "gridData": { - "h": 13, - "i": "fd58ca0b-aae6-4d02-9582-4431487f676d", - "w": 10, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true }, - "panelIndex": "fd58ca0b-aae6-4d02-9582-4431487f676d", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "4db9fb0a-46d2-4e86-9d51-b2dbb13522ad": { - "columnOrder": [ - "45ed899d-b0ba-4c0e-92f3-3b1331be047c" - ], - "columns": { - "45ed899d-b0ba-4c0e-92f3-3b1331be047c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "10e24b74-6c1f-40d2-8d40-2ec39d2a437a": { + "columnOrder": [ + "922203eb-f986-4d8a-b662-c61723b140f5" + ], + "columns": { + "922203eb-f986-4d8a-b662-c61723b140f5": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.identifiers", + "negate": false, + "params": { + "query": "similar_internal_domain" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.identifiers": "similar_internal_domain" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "922203eb-f986-4d8a-b662-c61723b140f5", + "layerId": "10e24b74-6c1f-40d2-8d40-2ec39d2a437a", + "layerType": "data" + } + }, + "title": "[Mimecast] SimilarInternalDomain", + "visualizationType": "lnsMetric", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-10e24b74-6c1f-40d2-8d40-2ec39d2a437a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ] } - } }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.identifiers", - "negate": false, - "params": { - "query": "reply_address_mismatch" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.identifiers": "reply_address_mismatch" - } - } - } - ], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"mimecast.ttp_ip_logs\" and mimecast.identifiers :\"reply_address_mismatch\" " - }, - "visualization": { - "accessor": "45ed899d-b0ba-4c0e-92f3-3b1331be047c", - "layerId": "4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", - "layerType": "data" - } - }, - "title": "[Mimecast] ReplyAddressMismatchCount", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 13, - "i": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d", - "w": 9, - "x": 10, - "y": 0 - }, - "panelIndex": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "2765d4bc-f979-4fab-9c1c-f1dd817397a9": { - "columnOrder": [ - "d26907e8-8968-43cf-bec1-174a1eb2e58c" - ], - "columns": { - "d26907e8-8968-43cf-bec1-174a1eb2e58c": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" - } - } + "gridData": { + "h": 13, + "i": "fd58ca0b-aae6-4d02-9582-4431487f676d", + "w": 10, + "x": 0, + "y": 0 }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.identifiers", - "negate": false, - "params": { - "query": "internal_user_name" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.identifiers": "internal_user_name" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "d26907e8-8968-43cf-bec1-174a1eb2e58c", - "layerId": "2765d4bc-f979-4fab-9c1c-f1dd817397a9", - "layerType": "data" - } + "panelIndex": "fd58ca0b-aae6-4d02-9582-4431487f676d", + "type": "lens", + "version": "7.16.0" }, - "title": "[Mimecast] InternalUserName", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2765d4bc-f979-4fab-9c1c-f1dd817397a9", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 13, - "i": "3de39cd9-d890-4300-848f-934dad8dc0e6", - "w": 9, - "x": 19, - "y": 0 - }, - "panelIndex": "3de39cd9-d890-4300-848f-934dad8dc0e6", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa": { - "columnOrder": [ - "5def3667-368a-4501-bd58-e87f1388d33a" - ], - "columns": { - "5def3667-368a-4501-bd58-e87f1388d33a": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" + { + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "4db9fb0a-46d2-4e86-9d51-b2dbb13522ad": { + "columnOrder": [ + "45ed899d-b0ba-4c0e-92f3-3b1331be047c" + ], + "columns": { + "45ed899d-b0ba-4c0e-92f3-3b1331be047c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.identifiers", + "negate": false, + "params": { + "query": "reply_address_mismatch" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.identifiers": "reply_address_mismatch" + } + } + } + ], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"mimecast.ttp_ip_logs\" and mimecast.identifiers :\"reply_address_mismatch\" " + }, + "visualization": { + "accessor": "45ed899d-b0ba-4c0e-92f3-3b1331be047c", + "layerId": "4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", + "layerType": "data" + } + }, + "title": "[Mimecast] ReplyAddressMismatchCount", + "visualizationType": "lnsMetric", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ] } - } }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.identifiers", - "negate": false, - "params": { - "query": "newly_observed_domain" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.identifiers": "newly_observed_domain" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "5def3667-368a-4501-bd58-e87f1388d33a", - "layerId": "2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", - "layerType": "data" - } + "gridData": { + "h": 13, + "i": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d", + "w": 9, + "x": 10, + "y": 0 + }, + "panelIndex": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d", + "type": "lens", + "version": "7.16.0" }, - "title": "[Mimecast] NewlyObservedDomainCount", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 13, - "i": "7b3289f7-cccd-4246-8927-befc10b8ec24", - "w": 9, - "x": 28, - "y": 0 - }, - "panelIndex": "7b3289f7-cccd-4246-8927-befc10b8ec24", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "b07c48c6-9c2e-4373-9b81-a516192f6271": { - "columnOrder": [ - "85cafc43-5331-4ca7-853e-17c557791de0" - ], - "columns": { - "85cafc43-5331-4ca7-853e-17c557791de0": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" + { + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "2765d4bc-f979-4fab-9c1c-f1dd817397a9": { + "columnOrder": [ + "d26907e8-8968-43cf-bec1-174a1eb2e58c" + ], + "columns": { + "d26907e8-8968-43cf-bec1-174a1eb2e58c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.identifiers", + "negate": false, + "params": { + "query": "internal_user_name" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.identifiers": "internal_user_name" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "d26907e8-8968-43cf-bec1-174a1eb2e58c", + "layerId": "2765d4bc-f979-4fab-9c1c-f1dd817397a9", + "layerType": "data" + } + }, + "title": "[Mimecast] InternalUserName", + "visualizationType": "lnsMetric", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2765d4bc-f979-4fab-9c1c-f1dd817397a9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ] } - } }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.identifiers", - "negate": false, - "params": { - "query": "advanced_similar_internal_domain" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.identifiers": "advanced_similar_internal_domain" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "85cafc43-5331-4ca7-853e-17c557791de0", - "layerId": "b07c48c6-9c2e-4373-9b81-a516192f6271", - "layerType": "data" - } + "gridData": { + "h": 13, + "i": "3de39cd9-d890-4300-848f-934dad8dc0e6", + "w": 9, + "x": 19, + "y": 0 + }, + "panelIndex": "3de39cd9-d890-4300-848f-934dad8dc0e6", + "type": "lens", + "version": "7.16.0" }, - "title": "[Mimecast] AdvancedSimilarInternalDomainCount", - "visualizationType": "lnsMetric", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b07c48c6-9c2e-4373-9b81-a516192f6271", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 13, - "i": "8df60631-ed88-490d-952b-33926d251709", - "w": 10, - "x": 37, - "y": 0 - }, - "panelIndex": "8df60631-ed88-490d-952b-33926d251709", - "type": "lens", - "version": "7.16.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340": { - "columnOrder": [ - "ff48f1ba-4593-40a2-88f0-a317519f65a0", - "379f2d4d-5cdb-495b-866b-a67eb523bd86" - ], - "columns": { - "379f2d4d-5cdb-495b-866b-a67eb523bd86": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + { + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa": { + "columnOrder": [ + "5def3667-368a-4501-bd58-e87f1388d33a" + ], + "columns": { + "5def3667-368a-4501-bd58-e87f1388d33a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.identifiers", + "negate": false, + "params": { + "query": "newly_observed_domain" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.identifiers": "newly_observed_domain" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "5def3667-368a-4501-bd58-e87f1388d33a", + "layerId": "2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", + "layerType": "data" + } }, - "ff48f1ba-4593-40a2-88f0-a317519f65a0": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Senders", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "379f2d4d-5cdb-495b-866b-a67eb523bd86", - "type": "column" + "title": "[Mimecast] NewlyObservedDomainCount", + "visualizationType": "lnsMetric", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": false, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "email.from.address" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ] } - } }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.taggedMalicious", - "negate": false, - "params": { - "query": true - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.taggedMalicious": true - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "ff48f1ba-4593-40a2-88f0-a317519f65a0" - }, - { - "columnId": "379f2d4d-5cdb-495b-866b-a67eb523bd86" - } - ], - "layerId": "cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", - "layerType": "data" - } + "gridData": { + "h": 13, + "i": "7b3289f7-cccd-4246-8927-befc10b8ec24", + "w": 9, + "x": 28, + "y": 0 + }, + "panelIndex": "7b3289f7-cccd-4246-8927-befc10b8ec24", + "type": "lens", + "version": "7.16.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e", - "w": 24, - "x": 0, - "y": 13 - }, - "panelIndex": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e", - "title": "Top potencial malious senders", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-ab543c4a-7b11-40f3-bca3-74ea65af48f4", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "filter-index-pattern-1", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "ab543c4a-7b11-40f3-bca3-74ea65af48f4": { - "columnOrder": [ - "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa", - "c09ef631-df6f-4df9-b8c2-9fa883d711e8" - ], - "columns": { - "c09ef631-df6f-4df9-b8c2-9fa883d711e8": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "Records" + { + "embeddableConfig": { + "enhancements": {}, + "attributes": { + "description": "", + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "b07c48c6-9c2e-4373-9b81-a516192f6271": { + "columnOrder": [ + "85cafc43-5331-4ca7-853e-17c557791de0" + ], + "columns": { + "85cafc43-5331-4ca7-853e-17c557791de0": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.identifiers", + "negate": false, + "params": { + "query": "advanced_similar_internal_domain" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.identifiers": "advanced_similar_internal_domain" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "accessor": "85cafc43-5331-4ca7-853e-17c557791de0", + "layerId": "b07c48c6-9c2e-4373-9b81-a516192f6271", + "layerType": "data" + } }, - "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Recipients", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "c09ef631-df6f-4df9-b8c2-9fa883d711e8", - "type": "column" + "title": "[Mimecast] AdvancedSimilarInternalDomainCount", + "visualizationType": "lnsMetric", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "email.to.address" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-0", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.ttp_ip_logs" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.ttp_ip_logs" + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b07c48c6-9c2e-4373-9b81-a516192f6271", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ] } - } }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "filter-index-pattern-1", - "key": "mimecast.taggedMalicious", - "negate": false, - "params": { - "query": true + "gridData": { + "h": 13, + "i": "8df60631-ed88-490d-952b-33926d251709", + "w": 10, + "x": 37, + "y": 0 + }, + "panelIndex": "8df60631-ed88-490d-952b-33926d251709", + "type": "lens", + "version": "7.16.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340": { + "columnOrder": [ + "ff48f1ba-4593-40a2-88f0-a317519f65a0", + "379f2d4d-5cdb-495b-866b-a67eb523bd86" + ], + "columns": { + "379f2d4d-5cdb-495b-866b-a67eb523bd86": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "ff48f1ba-4593-40a2-88f0-a317519f65a0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Senders", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "379f2d4d-5cdb-495b-866b-a67eb523bd86", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "email.from.address" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.taggedMalicious", + "negate": false, + "params": { + "query": true + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.taggedMalicious": true + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ff48f1ba-4593-40a2-88f0-a317519f65a0" + }, + { + "columnId": "379f2d4d-5cdb-495b-866b-a67eb523bd86" + } + ], + "layerId": "cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "mimecast.taggedMalicious": true - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa", - "isTransposed": false - }, - { - "columnId": "c09ef631-df6f-4df9-b8c2-9fa883d711e8", - "isTransposed": false - } - ], - "layerId": "ab543c4a-7b11-40f3-bca3-74ea65af48f4", - "layerType": "data" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e", + "w": 24, + "x": 0, + "y": 13 + }, + "panelIndex": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e", + "title": "Top potencial malious senders", + "type": "lens", + "version": "7.16.0-SNAPSHOT" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ab543c4a-7b11-40f3-bca3-74ea65af48f4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "filter-index-pattern-1", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "indexpattern": { + "layers": { + "ab543c4a-7b11-40f3-bca3-74ea65af48f4": { + "columnOrder": [ + "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa", + "c09ef631-df6f-4df9-b8c2-9fa883d711e8" + ], + "columns": { + "c09ef631-df6f-4df9-b8c2-9fa883d711e8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "Records" + }, + "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Recipients", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "c09ef631-df6f-4df9-b8c2-9fa883d711e8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "email.to.address" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.ttp_ip_logs" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.ttp_ip_logs" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "filter-index-pattern-1", + "key": "mimecast.taggedMalicious", + "negate": false, + "params": { + "query": true + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "mimecast.taggedMalicious": true + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "e4e885a4-eebd-48b5-bf7a-1c8acf4553fa", + "isTransposed": false + }, + { + "columnId": "c09ef631-df6f-4df9-b8c2-9fa883d711e8", + "isTransposed": false + } + ], + "layerId": "ab543c4a-7b11-40f3-bca3-74ea65af48f4", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "322232e8-3f6b-463d-8ab1-d0d16a8b66be", + "w": 24, + "x": 24, + "y": 13 + }, + "panelIndex": "322232e8-3f6b-463d-8ab1-d0d16a8b66be", + "title": "Top potencial malious recipients", + "type": "lens", + "version": "7.16.0-SNAPSHOT" + } + ], + "refreshInterval": { + "pause": true, + "value": 0 + }, + "timeFrom": "now-30d/d", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] TTP Impersonation Protect Logs", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:indexpattern-datasource-layer-cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:indexpattern-datasource-layer-ab543c4a-7b11-40f3-bca3-74ea65af48f4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:filter-index-pattern-0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:filter-index-pattern-1", + "type": "index-pattern" + }, + { + "type": "index-pattern", + "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:indexpattern-datasource-layer-10e24b74-6c1f-40d2-8d40-2ec39d2a437a", + "id": "logs-*" }, - "gridData": { - "h": 15, - "i": "322232e8-3f6b-463d-8ab1-d0d16a8b66be", - "w": 24, - "x": 24, - "y": 13 + { + "type": "index-pattern", + "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:filter-index-pattern-0", + "id": "logs-*" }, - "panelIndex": "322232e8-3f6b-463d-8ab1-d0d16a8b66be", - "title": "Top potencial malious recipients", - "type": "lens", - "version": "7.16.0-SNAPSHOT" - } + { + "type": "index-pattern", + "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:filter-index-pattern-1", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:indexpattern-datasource-layer-4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:filter-index-pattern-0", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:filter-index-pattern-1", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:indexpattern-datasource-layer-2765d4bc-f979-4fab-9c1c-f1dd817397a9", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:filter-index-pattern-0", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:filter-index-pattern-1", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:indexpattern-datasource-layer-2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:filter-index-pattern-0", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:filter-index-pattern-1", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "8df60631-ed88-490d-952b-33926d251709:indexpattern-datasource-current-indexpattern", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "8df60631-ed88-490d-952b-33926d251709:indexpattern-datasource-layer-b07c48c6-9c2e-4373-9b81-a516192f6271", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "8df60631-ed88-490d-952b-33926d251709:filter-index-pattern-0", + "id": "logs-*" + }, + { + "type": "index-pattern", + "name": "8df60631-ed88-490d-952b-33926d251709:filter-index-pattern-1", + "id": "logs-*" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-30d/d", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] TTP Impersonation Protect Logs", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:indexpattern-datasource-layer-cc0ca8f3-6cdf-46d7-a3a8-88a1818b2340", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "cfc0063f-6cf4-4eef-852d-4ec90c17a37e:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:indexpattern-datasource-layer-ab543c4a-7b11-40f3-bca3-74ea65af48f4", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:filter-index-pattern-0", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "322232e8-3f6b-463d-8ab1-d0d16a8b66be:filter-index-pattern-1", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:indexpattern-datasource-layer-10e24b74-6c1f-40d2-8d40-2ec39d2a437a", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:filter-index-pattern-0", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "fd58ca0b-aae6-4d02-9582-4431487f676d:filter-index-pattern-1", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:indexpattern-datasource-layer-4db9fb0a-46d2-4e86-9d51-b2dbb13522ad", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:filter-index-pattern-0", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "228c1edf-8ef3-4a4c-8d68-6f4d60b1685d:filter-index-pattern-1", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:indexpattern-datasource-layer-2765d4bc-f979-4fab-9c1c-f1dd817397a9", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:filter-index-pattern-0", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3de39cd9-d890-4300-848f-934dad8dc0e6:filter-index-pattern-1", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:indexpattern-datasource-layer-2a67dfff-4a02-4ee1-9b79-ae7dc549c8fa", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:filter-index-pattern-0", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7b3289f7-cccd-4246-8927-befc10b8ec24:filter-index-pattern-1", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "8df60631-ed88-490d-952b-33926d251709:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "8df60631-ed88-490d-952b-33926d251709:indexpattern-datasource-layer-b07c48c6-9c2e-4373-9b81-a516192f6271", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "8df60631-ed88-490d-952b-33926d251709:filter-index-pattern-0", - "id": "logs-*" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "type": "index-pattern", - "name": "8df60631-ed88-490d-952b-33926d251709:filter-index-pattern-1", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/dashboard/mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5.json b/packages/mimecast/kibana/dashboard/mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5.json index 21d0be7aa12..9772ca2ecc3 100644 --- a/packages/mimecast/kibana/dashboard/mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5.json +++ b/packages/mimecast/kibana/dashboard/mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5.json @@ -1,92 +1,92 @@ { - "id": "mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-10-27T20:30:51.209Z", - "version": "WzYzOCwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mimecast.audit_events" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mimecast.audit_events" - } + "id": "mimecast-f8933590-541b-11ec-bd43-b5e1f9a9c8d5", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2022-10-27T20:30:51.209Z", + "version": "WzYzOCwxXQ==", + "attributes": { + "description": "", + "hits": 0, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mimecast.audit_events" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mimecast.audit_events" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", + "panelRefName": "panel_ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", + "type": "search", + "version": "7.16.0-SNAPSHOT" } - } ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {} + "refreshInterval": { + "pause": true, + "value": 0 }, - "gridData": { - "h": 15, - "i": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", - "w": 48, - "x": 0, - "y": 0 + "timeFrom": "now-24h/h", + "timeRestore": true, + "timeTo": "now", + "title": "[Mimecast] Audit Events Logs", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "panelIndex": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", - "panelRefName": "panel_ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", - "type": "search", - "version": "7.16.0-SNAPSHOT" - } + { + "id": "mimecast-eb3179f0-51ed-11ec-a4ca-b3a74c021655", + "name": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1:panel_ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", + "type": "search" + } ], - "refreshInterval": { - "pause": true, - "value": 0 - }, - "timeFrom": "now-24h/h", - "timeRestore": true, - "timeTo": "now", - "title": "[Mimecast] Audit Events Logs", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "7.16.0" }, - { - "id": "mimecast-eb3179f0-51ed-11ec-a4ca-b3a74c021655", - "name": "ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1:panel_ad6d8a79-9568-4d8e-9edc-4d9fc858a0d1", - "type": "search" - } - ], - "migrationVersion": { - "dashboard": "7.16.0" - }, - "coreMigrationVersion": "7.16.0" + "coreMigrationVersion": "7.16.0" } \ No newline at end of file diff --git a/packages/mimecast/kibana/tags.yml b/packages/mimecast/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/mimecast/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/mimecast/manifest.yml b/packages/mimecast/manifest.yml index 4deaabbb0eb..ab0d6416d79 100644 --- a/packages/mimecast/manifest.yml +++ b/packages/mimecast/manifest.yml @@ -1,15 +1,14 @@ # -format_version: 1.0.0 +format_version: "3.0.0" name: mimecast title: "Mimecast" -version: "1.11.0" -license: basic +version: "1.17.0" description: Collect logs from Mimecast with Elastic Agent. type: integration categories: ["security", "email_security"] -release: ga conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" screenshots: - src: /img/mimecast.png title: Sample screenshot @@ -67,3 +66,4 @@ policy_templates: show_user: true owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/modsecurity/_dev/build/build.yml b/packages/modsecurity/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/modsecurity/_dev/build/build.yml +++ b/packages/modsecurity/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/modsecurity/changelog.yml b/packages/modsecurity/changelog.yml index 4e9df0e40ab..efcfec308c5 100644 --- a/packages/modsecurity/changelog.yml +++ b/packages/modsecurity/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.1" + changes: + - description: Make pipeline selection more robust when nginx is configured with `server_tokens off`. + type: bugfix + link: https://github.com/elastic/integrations/pull/7397 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-apache-audit.log-expected.json b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-apache-audit.log-expected.json index 99975df7e89..6b3dd43c361 100644 --- a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-apache-audit.log-expected.json +++ b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-apache-audit.log-expected.json @@ -6,7 +6,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -87,7 +87,7 @@ "ip": "172.21.50.216" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -200,7 +200,7 @@ "ip": "175.16.199.50" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -290,7 +290,7 @@ "ip": "172.26.0.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log index 324358d803e..4e9c7a11a61 100644 --- a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log +++ b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log @@ -4,3 +4,5 @@ {"transaction":{"client_ip":"67.43.156.15","time_stamp":"Fri May 14 15:12:18 2021","server_id":"c06217c4ac0d6f8892d2489cd5d92aaceec2508e","client_port":45952,"host_ip":"67.43.156.15","host_port":443,"id":"162100513893.802359","request":{"method":"GET","http_version":1.0,"uri":"/","headers":{"Host":"34.87.56.16","Connection":"close"}},"response":{"http_code":200,"headers":{"Vary":"Accept-Encoding, Origin","X-XSS-Protection":"1; mode=block","Set-Cookie":"_pmcapi_session=e1e011a4d0188a1453cc4b8b9f3e476c; path=/; HttpOnly","X-Permitted-Cross-Domain-Policies":"none","Cache-Control":"max-age=0, private, must-revalidate","ETag":"W/\"f7e5c631964147f2a3458c4f97647883\"","Strict-Transport-Security":"max-age=31536000; includeSubDomains","Status":"200 OK","Connection":"close","X-Powered-By":"Phusion Passenger 6.0.2","Content-Type":"text/html; charset=utf-8","Content-Length":"12475","Date":"Fri, 14 May 2021 15:12:18 GMT","Server":"nginx/1.14.0","X-Request-Id":"15fa3f35-b204-4b2a-bbd8-7aec1d8e4417","X-Download-Options":"noopen","X-Runtime":"0.026203","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN","Via":"1.1 google"}},"producer":{"modsecurity":"ModSecurity v3.0.2 (Linux)","connector":"ModSecurity-nginx v0.1.1-beta","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `^[\\d.:]+$' against variable `REQUEST_HEADERS:Host' (Value: `34.87.56.16' )","reference":"o0,11v21,11","ruleId":"920350","file":"/etc/nginx/modsec/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"733","data":"34.87.56.16","severity":"4","ver":"OWASP_CRS/3.0.0","rev":"2","tags":["application-multi","language-multi","platform-multi","attack-protocol","OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST","WASCTC/WASC-21","OWASP_TOP_10/A7","PCI/6.5.10"],"maturity":"9","accuracy":"9"}}]}} {"transaction":{"client_ip":"89.160.20.112","time_stamp":"Tue May 10 04:52:04 2022","server_id":"294c67855f507ac0bbd635cb1e19dd023f47b44b","client_port":41836,"host_ip":"10.0.1.175","host_port":443,"unique_id":"165215832450.639870","request":{"method":"POST","http_version":1.1,"uri":"/includes/ajax_newsletter.php","headers":{"Sec-Fetch-Site":"same-origin","User-Agent":"Mozilla/5.0 (Linux; Android 11; Redmi Note 8 Build/RKQ1.201004.002; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/101.0.4951.41 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/359.0.0.6.112;]/FB_MEXT_IAB","Origin":"https://test.com.mm","Content-Type":"application/x-www-form-urlencoded; charset=UTF-8","X-Requested-With":"XMLHttpRequest","Accept":"application/json, text/javascript, */*; q=0.01","Content-Length":"21","Sec-Fetch-Mode":"cors","Connection":"keep-alive","Host":"test.com.mm","Sec-Fetch-Dest":"empty","Referer":"https://test.com.mm/flights/search/1/MYT/RGN/30%20May%202022/30%20May%202022/1/0/0/Flexi/Y/Flexi/Flexi/ntl/mmk/l/mm","Accept-Encoding":"gzip, deflate","Cookie":"_gcl_au=1.1.212474799.1652158106; initialTrafficSource=utmcsr=l.facebook.com|utmcmd=referral|utmccn=(not set); __utmzzses=1; _ga=GA1.3.1379954204.1652158107; _gid=GA1.3.510502211.1652158107; _fbp=fb.2.1652158111233.186514842; PHPSESSID=6n82mlp0qo5fl2qif2o5khrhj2; fromCode=RGN; toCode=MDL; nationality=ntl; language=my; currency=4; baseCurrency=MMK; WZRK_S_R5Z-754-985Z=%7B%22p%22%3A2%7D","Accept-Language":"en-US,en;q=0.9"}},"response":{"body":"","http_code":400,"headers":{"Server":"nginx/1.16.1","Date":"Tue, 10 May 2022 04:52:05 GMT","Content-Length":"60","Expires":"Thu, 19 Nov 1981 08:52:00 GMT","Content-Type":"application/json","Connection":"keep-alive","Cache-Control":"no-store, no-cache, must-revalidate","Pragma":"no-cache","Set-Cookie":"fromCode=RGN; expires=Tue, 10-May-2022 05:07:05 GMT; Max-Age=900; path=/","Set-Cookie":"toCode=MDL; expires=Tue, 10-May-2022 05:07:05 GMT; Max-Age=900; path=/"}},"producer":{"modsecurity":"ModSecurity v3.0.4 (Linux)","connector":"ModSecurity-nginx v1.0.1","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\""]},"messages":[]}} {"transaction":{"client_ip":"89.160.20.112","time_stamp":"Mon May 9 09:41:59 2022","server_id":"294c67855f507ac0bbd635cb1e19dd023f47b44b","client_port":50463,"host_ip":"10.0.1.175","host_port":443,"unique_id":"165208931921.140928","request":{"method":"GET","http_version":1.1,"uri":"/admin/controller/extension/extension/alfacgiapi","headers":{"Host":"test.com.mm","Connection":"keep-alive","Cache-Control":"max-age=0","Accept-Encoding":"gzip, deflate","Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8","User-Agent":"wp_is_mobile","Accept-Language":"en-US,en;q=0.9,fr;q=0.8","referer":"www.bing.com","Upgrade-Insecure-Requests":"1"}},"response":{"body":"\r\n403 Forbidden\r\n\r\n

403 Forbidden

\r\n
nginx/1.16.1
\r\n\r\n\r\n","http_code":403,"headers":{"Server":"nginx/1.16.1","Date":"Mon, 09 May 2022 09:41:59 GMT","Content-Length":"153","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.4 (Linux)","connector":"ModSecurity-nginx v1.0.1","secrules_engine":"Enabled","components":["OWASP_CRS/3.0.2\""]},"messages":[]}} +{"transaction":{"client_ip":"89.160.20.112","time_stamp":"Thu Aug 17 15:17:06 2023","server_id":"633e8ea201a2f18b6696be2f10ee371db14db998","client_port":15734,"host_ip":"100.64.28.163","host_port":443,"unique_id":"169228542649.510815","request":{"method":"GET","http_version":1.1,"uri":"/","headers":{"Accept-Encoding":"gzip","User-Agent":"ias-ie/3.3 (former https://www.admantx.com + https://integralads.com/about-ias/)","Host":"10.0.1.175","Accept":"text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2","Connection":"keep-alive"}},"response":{"body":"\r\n406 Not Acceptable\r\n\r\n

406 Not Acceptable

\r\n
nginx
\r\n\r\n\r\n","http_code":406,"headers":{"Server":"","Server":"","Date":"Thu, 17 Aug 2023 15:17:06 GMT","Content-Length":"156","Content-Type":"text/html","Connection":"keep-alive","Strict-Transport-Security":"max-age=15724800; includeSubDomains"}},"producer":{"modsecurity":"ModSecurity v3.0.8 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.4\""]},"messages":[{"message":"Illegal Accept header: charset parameter","details":{"match":"Matched \"Operator `Rx' with parameter `^(?:(?:\\*|[^\\\"(),\\/:;<=>?![\\x5c\\]{}]+)\\/(?:\\*|[^\\\"(),\\/:;<=>?![\\x5c\\]{}]+))(?:\\s*+;\\s*+(?:(?:charset\\s*+=\\s*+(?:\\\"?(?:iso-8859-15?|windows-1252|utf-8)\\b\\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\\"(),\\/:;<=> (714 characters omitted)' against variable `REQUEST_HEADERS:Accept' (Value: `text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2' )","reference":"v252,52t:lowercase","ruleId":"920600","file":"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"1147","data":"text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2","severity":"2","ver":"OWASP_CRS/3.3.4","rev":"","tags":["application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 5)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )","reference":"","ruleId":"949110","file":"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"81","data":"","severity":"2","ver":"OWASP_CRS/3.3.4","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"}}]}} +{"transaction":{"client_ip":"89.160.20.112","time_stamp":"Thu Aug 17 15:17:07 2023","server_id":"108e6d222acad64cf2d3e9fcc43b0b6f405c7157","client_port":34610,"host_ip":"100.64.12.14","host_port":443,"unique_id":"169228542739.723714","request":{"method":"POST","http_version":2.0,"uri":"/api/v1/articles/871/views","headers":{"origin":"10.0.1.175","sec-ch-ua-mobile":"?1","traceparent":"00-4f2e47f2c63bfd5e968efd62b82502b9-c19ee717f3de0b68-01","user-agent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Mobile Safari/537.36","sec-fetch-site":"same-origin","accept":"application/json","sec-ch-ua":"\"Not/A)Brand\";v=\"99\", \"Google Chrome\";v=\"115\", \"Chromium\";v=\"115\"","sec-ch-ua-platform":"\"Android\"","referer":"www.bing.com","content-length":"0","sec-fetch-mode":"cors","host":"10.0.1.175","sec-fetch-dest":"empty","accept-encoding":"gzip, deflate, br","cookie":"monster","accept-language":"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,fi;q=0.6"}},"response":{"body":"","http_code":500,"headers":{"Server":"","Server":"","Date":"Thu, 17 Aug 2023 15:17:07 GMT","Content-Length":"2","Content-Type":"application/json; charset=utf-8","Connection":"close","ETag":"W/\"dda3a9b33849ca9d88844c0331e9b98f\"","Vary":"Accept-Encoding","Strict-Transport-Security":"max-age=15724800; includeSubDomains"}},"producer":{"modsecurity":"ModSecurity v3.0.8 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.4\""]},"messages":[]}} diff --git a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log-expected.json b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log-expected.json index fd9f1d0ad27..50dc1fc8574 100644 --- a/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/modsecurity/data_stream/auditlog/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-05-14T14:52:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -28,6 +28,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v0.1.1-beta", "details": [ { "details": { @@ -104,7 +105,7 @@ { "@timestamp": "2021-05-14T15:11:52.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -129,6 +130,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v0.1.1-beta", "details": [ { "details": { @@ -192,7 +194,7 @@ { "@timestamp": "2021-05-14T15:12:01.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -217,6 +219,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v0.1.1-beta", "details": [ { "details": { @@ -280,7 +283,7 @@ { "@timestamp": "2021-05-14T15:12:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -305,6 +308,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v0.1.1-beta", "details": [ { "details": { @@ -368,7 +372,7 @@ { "@timestamp": "2022-05-10T04:52:04.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -393,6 +397,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v1.0.1", "server": "nginx/1.16.1" } }, @@ -446,7 +451,7 @@ { "@timestamp": "2022-05-09T09:41:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -471,6 +476,7 @@ }, "modsec": { "audit": { + "connector": "ModSecurity-nginx v1.0.1", "server": "nginx/1.16.1" } }, @@ -513,6 +519,191 @@ "name": "Other", "original": "wp_is_mobile" } + }, + { + "@timestamp": "2023-08-17T15:17:06.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "event", + "original": "{\"transaction\":{\"client_ip\":\"89.160.20.112\",\"time_stamp\":\"Thu Aug 17 15:17:06 2023\",\"server_id\":\"633e8ea201a2f18b6696be2f10ee371db14db998\",\"client_port\":15734,\"host_ip\":\"100.64.28.163\",\"host_port\":443,\"unique_id\":\"169228542649.510815\",\"request\":{\"method\":\"GET\",\"http_version\":1.1,\"uri\":\"/\",\"headers\":{\"Accept-Encoding\":\"gzip\",\"User-Agent\":\"ias-ie/3.3 (former https://www.admantx.com + https://integralads.com/about-ias/)\",\"Host\":\"10.0.1.175\",\"Accept\":\"text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2\",\"Connection\":\"keep-alive\"}},\"response\":{\"body\":\"\u003chtml\u003e\\r\\n\u003chead\u003e\u003ctitle\u003e406 Not Acceptable\u003c/title\u003e\u003c/head\u003e\\r\\n\u003cbody\u003e\\r\\n\u003ccenter\u003e\u003ch1\u003e406 Not Acceptable\u003c/h1\u003e\u003c/center\u003e\\r\\n\u003chr\u003e\u003ccenter\u003enginx\u003c/center\u003e\\r\\n\u003c/body\u003e\\r\\n\u003c/html\u003e\\r\\n\",\"http_code\":406,\"headers\":{\"Server\":\"\",\"Server\":\"\",\"Date\":\"Thu, 17 Aug 2023 15:17:06 GMT\",\"Content-Length\":\"156\",\"Content-Type\":\"text/html\",\"Connection\":\"keep-alive\",\"Strict-Transport-Security\":\"max-age=15724800; includeSubDomains\"}},\"producer\":{\"modsecurity\":\"ModSecurity v3.0.8 (Linux)\",\"connector\":\"ModSecurity-nginx v1.0.3\",\"secrules_engine\":\"Enabled\",\"components\":[\"OWASP_CRS/3.3.4\\\"\"]},\"messages\":[{\"message\":\"Illegal Accept header: charset parameter\",\"details\":{\"match\":\"Matched \\\"Operator `Rx' with parameter `^(?:(?:\\\\*|[^\\\\\\\"(),\\\\/:;\u003c=\u003e?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\\\\\\"(),\\\\/:;\u003c=\u003e?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\\\\\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\\\\\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\\\\\\"(),\\\\/:;\u003c=\u003e (714 characters omitted)' against variable `REQUEST_HEADERS:Accept' (Value: `text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2' )\",\"reference\":\"v252,52t:lowercase\",\"ruleId\":\"920600\",\"file\":\"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\",\"lineNumber\":\"1147\",\"data\":\"text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2\",\"severity\":\"2\",\"ver\":\"OWASP_CRS/3.3.4\",\"rev\":\"\",\"tags\":[\"application-multi\",\"language-multi\",\"platform-multi\",\"attack-protocol\",\"paranoia-level/1\",\"OWASP_CRS\"],\"maturity\":\"0\",\"accuracy\":\"0\"}},{\"message\":\"Inbound Anomaly Score Exceeded (Total Score: 5)\",\"details\":{\"match\":\"Matched \\\"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )\",\"reference\":\"\",\"ruleId\":\"949110\",\"file\":\"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf\",\"lineNumber\":\"81\",\"data\":\"\",\"severity\":\"2\",\"ver\":\"OWASP_CRS/3.3.4\",\"rev\":\"\",\"tags\":[\"application-multi\",\"language-multi\",\"platform-multi\",\"attack-generic\"],\"maturity\":\"0\",\"accuracy\":\"0\"}}]}}", + "timezone": "UTC", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "GET" + }, + "response": { + "mime_type": "text/html", + "status_code": 406 + }, + "version": "1.1" + }, + "modsec": { + "audit": { + "connector": "ModSecurity-nginx v1.0.3", + "details": [ + { + "details": { + "accuracy": "0", + "data": "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2", + "file": "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf", + "lineNumber": "1147", + "match": "Matched \"Operator `Rx' with parameter `^(?:(?:\\*|[^\\\"(),\\/:;\u003c=\u003e?![\\x5c\\]{}]+)\\/(?:\\*|[^\\\"(),\\/:;\u003c=\u003e?![\\x5c\\]{}]+))(?:\\s*+;\\s*+(?:(?:charset\\s*+=\\s*+(?:\\\"?(?:iso-8859-15?|windows-1252|utf-8)\\b\\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\\"(),\\/:;\u003c=\u003e (714 characters omitted)' against variable `REQUEST_HEADERS:Accept' (Value: `text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2' )", + "maturity": "0", + "reference": "v252,52t:lowercase", + "rev": "", + "ruleId": "920600", + "severity": "2", + "tags": [ + "application-multi", + "language-multi", + "platform-multi", + "attack-protocol", + "paranoia-level/1", + "OWASP_CRS" + ], + "ver": "OWASP_CRS/3.3.4" + } + }, + { + "details": { + "accuracy": "0", + "data": "", + "file": "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf", + "lineNumber": "81", + "match": "Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )", + "maturity": "0", + "reference": "", + "rev": "", + "ruleId": "949110", + "severity": "2", + "tags": [ + "application-multi", + "language-multi", + "platform-multi", + "attack-generic" + ], + "ver": "OWASP_CRS/3.3.4" + } + } + ], + "messages": [ + "Illegal Accept header: charset parameter", + "Inbound Anomaly Score Exceeded (Total Score: 5)" + ] + } + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "port": 15734 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "10.0.1.175", + "original": "https://10.0.1.175:443/", + "path": "/", + "port": 443, + "scheme": "https" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "ias-ie/3.3 (former https://www.admantx.com + https://integralads.com/about-ias/)" + } + }, + { + "@timestamp": "2023-08-17T15:17:07.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "web" + ], + "kind": "event", + "original": "{\"transaction\":{\"client_ip\":\"89.160.20.112\",\"time_stamp\":\"Thu Aug 17 15:17:07 2023\",\"server_id\":\"108e6d222acad64cf2d3e9fcc43b0b6f405c7157\",\"client_port\":34610,\"host_ip\":\"100.64.12.14\",\"host_port\":443,\"unique_id\":\"169228542739.723714\",\"request\":{\"method\":\"POST\",\"http_version\":2.0,\"uri\":\"/api/v1/articles/871/views\",\"headers\":{\"origin\":\"10.0.1.175\",\"sec-ch-ua-mobile\":\"?1\",\"traceparent\":\"00-4f2e47f2c63bfd5e968efd62b82502b9-c19ee717f3de0b68-01\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Mobile Safari/537.36\",\"sec-fetch-site\":\"same-origin\",\"accept\":\"application/json\",\"sec-ch-ua\":\"\\\"Not/A)Brand\\\";v=\\\"99\\\", \\\"Google Chrome\\\";v=\\\"115\\\", \\\"Chromium\\\";v=\\\"115\\\"\",\"sec-ch-ua-platform\":\"\\\"Android\\\"\",\"referer\":\"www.bing.com\",\"content-length\":\"0\",\"sec-fetch-mode\":\"cors\",\"host\":\"10.0.1.175\",\"sec-fetch-dest\":\"empty\",\"accept-encoding\":\"gzip, deflate, br\",\"cookie\":\"monster\",\"accept-language\":\"fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7,fi;q=0.6\"}},\"response\":{\"body\":\"\",\"http_code\":500,\"headers\":{\"Server\":\"\",\"Server\":\"\",\"Date\":\"Thu, 17 Aug 2023 15:17:07 GMT\",\"Content-Length\":\"2\",\"Content-Type\":\"application/json; charset=utf-8\",\"Connection\":\"close\",\"ETag\":\"W/\\\"dda3a9b33849ca9d88844c0331e9b98f\\\"\",\"Vary\":\"Accept-Encoding\",\"Strict-Transport-Security\":\"max-age=15724800; includeSubDomains\"}},\"producer\":{\"modsecurity\":\"ModSecurity v3.0.8 (Linux)\",\"connector\":\"ModSecurity-nginx v1.0.3\",\"secrules_engine\":\"Enabled\",\"components\":[\"OWASP_CRS/3.3.4\\\"\"]},\"messages\":[]}}", + "timezone": "UTC", + "type": [ + "access" + ] + }, + "http": { + "request": { + "method": "POST" + }, + "response": { + "mime_type": "application/json; charset=utf-8", + "status_code": 500 + }, + "version": "2.0" + }, + "modsec": { + "audit": { + "connector": "ModSecurity-nginx v1.0.3" + } + }, + "source": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.112", + "port": 34610 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "10.0.1.175", + "original": "https://10.0.1.175:443/api/v1/articles/871/views", + "path": "/api/v1/articles/871/views", + "port": 443, + "scheme": "https" + } } ] } \ No newline at end of file diff --git a/packages/modsecurity/data_stream/auditlog/_dev/test/system/test-logfile-tz-config.yml b/packages/modsecurity/data_stream/auditlog/_dev/test/system/test-logfile-tz-config.yml index e8a673a5e60..9bcf1803cb0 100644 --- a/packages/modsecurity/data_stream/auditlog/_dev/test/system/test-logfile-tz-config.yml +++ b/packages/modsecurity/data_stream/auditlog/_dev/test/system/test-logfile-tz-config.yml @@ -5,4 +5,4 @@ data_stream: vars: paths: - "{{SERVICE_LOGS_DIR}}/modsec-audit-tz.log" - tz_offset: "+0500" \ No newline at end of file + tz_offset: "+0500" diff --git a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/apache-modsec.yml b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/apache-modsec.yml index c4e22eae9f9..0c117da73da 100644 --- a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/apache-modsec.yml +++ b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/apache-modsec.yml @@ -88,6 +88,10 @@ processors: field: json.request.request_line patterns: - "%{NOTSPACE:http.request.method} %{URIPATHPARAM:url.original}(?: HTTP/%{NUMBER:http.version})" + - rename: + field: json.transaction.request.headers.host + target_field: json.transaction.request.headers.Host + ignore_missing: true - set: field: _temps.url if: ctx.json.transaction.local_port == 443 diff --git a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml index 5fe102507ab..7cee20a36c9 100644 --- a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml +++ b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for modsecurity audit log. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -23,12 +23,16 @@ processors: field: modsec.audit.server copy_from: json.transaction.response.headers.Server ignore_empty_value: true + - set: + field: modsec.audit.connector + copy_from: json.transaction.producer.connector + ignore_empty_value: true - pipeline: name: '{{ IngestPipeline "nginx-modsec" }}' - if: ctx.modsec.audit.server.toLowerCase().contains('nginx') + if: (ctx.modsec?.audit?.server != null && ctx.modsec.audit.server.toLowerCase().contains('nginx')) || (ctx.modsec?.audit?.connector != null && ctx.modsec.audit.connector.toLowerCase().contains('nginx')) - pipeline: name: '{{ IngestPipeline "apache-modsec" }}' - if: ctx.modsec.audit.server.toLowerCase().contains('apache') + if: (ctx.modsec?.audit?.server != null && ctx.modsec.audit.server.toLowerCase().contains('apache')) || (ctx.modsec?.audit?.connector != null && ctx.modsec.audit.connector.toLowerCase().contains('apache')) on_failure: - set: diff --git a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/nginx-modsec.yml b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/nginx-modsec.yml index a65a2857d03..2ccf8c39c6e 100644 --- a/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/nginx-modsec.yml +++ b/packages/modsecurity/data_stream/auditlog/elasticsearch/ingest_pipeline/nginx-modsec.yml @@ -79,6 +79,10 @@ processors: target_field: http.version type: string ignore_missing: true + - rename: + field: json.transaction.request.headers.host + target_field: json.transaction.request.headers.Host + ignore_missing: true - set: field: _temps.url if: ctx.json.transaction.host_port == 443 diff --git a/packages/modsecurity/data_stream/auditlog/fields/fields.yml b/packages/modsecurity/data_stream/auditlog/fields/fields.yml index d17908753c1..f50f41bd9e7 100644 --- a/packages/modsecurity/data_stream/auditlog/fields/fields.yml +++ b/packages/modsecurity/data_stream/auditlog/fields/fields.yml @@ -1,6 +1,9 @@ - name: modsec.audit type: group fields: + - name: connector + type: keyword + description: The name of the connector between the web server and libmodsecurity. - name: server type: keyword description: Modsecurity server name. diff --git a/packages/modsecurity/data_stream/auditlog/sample_event.json b/packages/modsecurity/data_stream/auditlog/sample_event.json index 222ead51130..73cf95b9dd2 100644 --- a/packages/modsecurity/data_stream/auditlog/sample_event.json +++ b/packages/modsecurity/data_stream/auditlog/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "a27141ba-9754-4dc0-9468-bd32f5cbe036", diff --git a/packages/modsecurity/docs/README.md b/packages/modsecurity/docs/README.md index ddf612b7218..af267d8efae 100644 --- a/packages/modsecurity/docs/README.md +++ b/packages/modsecurity/docs/README.md @@ -87,6 +87,7 @@ The `Audit Log` dataset collects Modsecurity Audit logs. | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.offset | Log offset | long | | message | human-readable summary of the event | text | +| modsec.audit.connector | The name of the connector between the web server and libmodsecurity. | keyword | | modsec.audit.details | Modsecurity audit details. | flattened | | modsec.audit.messages | Modsecurity audit message. | keyword | | modsec.audit.server | Modsecurity server name. | keyword | diff --git a/packages/modsecurity/kibana/tags.yml b/packages/modsecurity/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/modsecurity/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/modsecurity/manifest.yml b/packages/modsecurity/manifest.yml index 498c0baa9f6..425cd5415c9 100644 --- a/packages/modsecurity/manifest.yml +++ b/packages/modsecurity/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: modsecurity title: "ModSecurity Audit" -version: "1.10.0" +version: "1.13.0" description: Collect logs from ModSecurity with Elastic Agent type: integration categories: @@ -9,7 +9,8 @@ categories: - network - web_application_firewall conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" icons: - src: /img/modsec.svg title: ModSecurity @@ -25,3 +26,4 @@ policy_templates: description: Collecting modsecurity audit logs owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/mongodb/changelog.yml b/packages/mongodb/changelog.yml index e631cb2f868..9cb84aeac8e 100644 --- a/packages/mongodb/changelog.yml +++ b/packages/mongodb/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.11.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6978 - version: "1.10.2" changes: - description: Fix mongodb logs overview dashboard and update filters for panels. diff --git a/packages/mongodb/data_stream/collstats/manifest.yml b/packages/mongodb/data_stream/collstats/manifest.yml index 2d74aed6954..acb9299c35c 100644 --- a/packages/mongodb/data_stream/collstats/manifest.yml +++ b/packages/mongodb/data_stream/collstats/manifest.yml @@ -12,3 +12,5 @@ streams: default: 10s title: MongoDB collstats metrics description: Collect MongoDB collstats metrics +elasticsearch: + index_mode: "time_series" diff --git a/packages/mongodb/data_stream/dbstats/manifest.yml b/packages/mongodb/data_stream/dbstats/manifest.yml index e9d66909cb2..149c7d639ed 100644 --- a/packages/mongodb/data_stream/dbstats/manifest.yml +++ b/packages/mongodb/data_stream/dbstats/manifest.yml @@ -12,3 +12,5 @@ streams: default: 10s title: MongoDB dbstats metrics description: Collect MongoDB dbstats metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mongodb/data_stream/metrics/manifest.yml b/packages/mongodb/data_stream/metrics/manifest.yml index 56686cfe09a..b5044e6c674 100644 --- a/packages/mongodb/data_stream/metrics/manifest.yml +++ b/packages/mongodb/data_stream/metrics/manifest.yml @@ -12,3 +12,5 @@ streams: default: 10s title: MongoDB metrics description: Collect MongoDB use and state metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mongodb/data_stream/replstatus/manifest.yml b/packages/mongodb/data_stream/replstatus/manifest.yml index 16785c2959c..59718c634d9 100644 --- a/packages/mongodb/data_stream/replstatus/manifest.yml +++ b/packages/mongodb/data_stream/replstatus/manifest.yml @@ -12,3 +12,5 @@ streams: default: 10s title: MongoDB replstatus metrics description: Collect MongoDB replstatus metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mongodb/data_stream/status/manifest.yml b/packages/mongodb/data_stream/status/manifest.yml index 2eb5de0b697..0d537342dd4 100644 --- a/packages/mongodb/data_stream/status/manifest.yml +++ b/packages/mongodb/data_stream/status/manifest.yml @@ -12,3 +12,5 @@ streams: default: 10s title: MongoDB status metrics description: Collect MongoDB status metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mongodb/manifest.yml b/packages/mongodb/manifest.yml index ce0c0d00b8d..ac8158f801f 100644 --- a/packages/mongodb/manifest.yml +++ b/packages/mongodb/manifest.yml @@ -1,6 +1,6 @@ name: mongodb title: MongoDB -version: "1.10.2" +version: "1.11.0" description: Collect logs and metrics from MongoDB instances with Elastic Agent. type: integration categories: @@ -15,7 +15,7 @@ format_version: 1.0.0 license: basic release: ga conditions: - kibana.version: "^8.1.0" + kibana.version: "^8.8.0" screenshots: - src: /img/filebeat-mongodb-overview.png title: filebeat mongodb overview diff --git a/packages/mysql/changelog.yml b/packages/mysql/changelog.yml index 3884049e08f..809fca63837 100644 --- a/packages/mysql/changelog.yml +++ b/packages/mysql/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.15.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6968 +- version: "1.14.0" + changes: + - description: Migrate Database Overview dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/5819 +- version: "1.13.0" + changes: + - description: Migrate Logs Overview dashboard visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/5818 - version: "1.12.4" changes: - description: Fix to correct the aggregate function used in dashboard for fields having `metric_type` value `counter`. diff --git a/packages/mysql/data_stream/galera_status/manifest.yml b/packages/mysql/data_stream/galera_status/manifest.yml index 51b87d1ead7..d14027212b5 100644 --- a/packages/mysql/data_stream/galera_status/manifest.yml +++ b/packages/mysql/data_stream/galera_status/manifest.yml @@ -19,3 +19,5 @@ streams: default: false title: MySQL galera_status metrics description: Collect MySQL galera_status metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mysql/data_stream/performance/manifest.yml b/packages/mysql/data_stream/performance/manifest.yml index 812deb6b9e7..658efb4d85a 100644 --- a/packages/mysql/data_stream/performance/manifest.yml +++ b/packages/mysql/data_stream/performance/manifest.yml @@ -19,3 +19,5 @@ streams: required: true show_user: true default: false +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mysql/data_stream/status/manifest.yml b/packages/mysql/data_stream/status/manifest.yml index c41a8554029..d6cdc9ebea5 100644 --- a/packages/mysql/data_stream/status/manifest.yml +++ b/packages/mysql/data_stream/status/manifest.yml @@ -19,3 +19,5 @@ streams: default: false title: MySQL status metrics description: Collect MySQL status metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/mysql/img/kibana-mysql.png b/packages/mysql/img/kibana-mysql.png index 13c5ea4d276..71216ec5ce7 100644 Binary files a/packages/mysql/img/kibana-mysql.png and b/packages/mysql/img/kibana-mysql.png differ diff --git a/packages/mysql/img/metricbeat-mysql.png b/packages/mysql/img/metricbeat-mysql.png index ee6ec195d46..6998fe5ee2c 100644 Binary files a/packages/mysql/img/metricbeat-mysql.png and b/packages/mysql/img/metricbeat-mysql.png differ diff --git a/packages/mysql/kibana/dashboard/mysql-57b3fb50-6309-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/dashboard/mysql-57b3fb50-6309-11ea-a83e-25b8612d00cc.json index eceb2821f6d..9d47eac1c22 100644 --- a/packages/mysql/kibana/dashboard/mysql-57b3fb50-6309-11ea-a83e-25b8612d00cc.json +++ b/packages/mysql/kibana/dashboard/mysql-57b3fb50-6309-11ea-a83e-25b8612d00cc.json @@ -1,25 +1,284 @@ { "attributes": { "description": "Overview of MySQL server", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false, + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "1279c157-d50e-46b3-88ba-a19cc8644cd8": { + "columnOrder": [ + "803990ad-0630-49b1-9dc9-d25c07dfaf35", + "151c0ed5-8e4a-401d-84f2-f519e6c6bb95" + ], + "columns": { + "151c0ed5-8e4a-401d-84f2-f519e6c6bb95": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Open Files", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.open.files" + }, + "803990ad-0630-49b1-9dc9-d25c07dfaf35": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "79f8760c-e21c-4077-8169-8886b6be9b3c": { + "columnOrder": [ + "b2ed4455-0976-4465-8d42-3a77628b700e", + "1c4e639e-14ae-4611-8dc1-fe51bb3e10c6" + ], + "columns": { + "1c4e639e-14ae-4611-8dc1-fe51bb3e10c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Open Tables", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.open.tables" + }, + "b2ed4455-0976-4465-8d42-3a77628b700e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "948b5c04-ccd8-48b0-aae1-8a543f182520": { + "columnOrder": [ + "d98b3522-b4e5-4e4f-aae6-4b0cf863294e", + "ff0466eb-6f17-475d-b9ba-b0b7462a7c7c" + ], + "columns": { + "d98b3522-b4e5-4e4f-aae6-4b0cf863294e": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ff0466eb-6f17-475d-b9ba-b0b7462a7c7c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Open Streams", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.open.streams" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-1279c157-d50e-46b3-88ba-a19cc8644cd8", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-79f8760c-e21c-4077-8169-8886b6be9b3c", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-948b5c04-ccd8-48b0-aae1-8a543f182520", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.3, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "1c4e639e-14ae-4611-8dc1-fe51bb3e10c6" + ], + "layerId": "79f8760c-e21c-4077-8169-8886b6be9b3c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "b2ed4455-0976-4465-8d42-3a77628b700e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "1c4e639e-14ae-4611-8dc1-fe51bb3e10c6" + } + ] + }, + { + "accessors": [ + "151c0ed5-8e4a-401d-84f2-f519e6c6bb95" + ], + "layerId": "1279c157-d50e-46b3-88ba-a19cc8644cd8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "803990ad-0630-49b1-9dc9-d25c07dfaf35", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "151c0ed5-8e4a-401d-84f2-f519e6c6bb95" + } + ] + }, + { + "accessors": [ + "ff0466eb-6f17-475d-b9ba-b0b7462a7c7c" + ], + "layerId": "948b5c04-ccd8-48b0-aae1-8a543f182520", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "d98b3522-b4e5-4e4f-aae6-4b0cf863294e", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(226,115,0,1)", + "forAccessor": "ff0466eb-6f17-475d-b9ba-b0b7462a7c7c" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -30,132 +289,2963 @@ "y": 38 }, "panelIndex": "14", - "panelRefName": "panel_14", "title": "Open Tables, Files, Streams", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "description": "", + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "b17585f0-c39f-4260-8610-86a1e7382c74": { + "columnOrder": [ + "f477d96b-3f62-4f9e-9c96-6154080b30ff" + ], + "columns": { + "f477d96b-3f62-4f9e-9c96-6154080b30ff": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Connections", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "mysql.status.threads.connected" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-b17585f0-c39f-4260-8610-86a1e7382c74", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "b17585f0-c39f-4260-8610-86a1e7382c74", + "layerType": "data", + "metricAccessor": "f477d96b-3f62-4f9e-9c96-6154080b30ff" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "050b110b-0b4d-404a-86c0-fa97f7eed2a0", - "w": 16, + "i": "d126fb61-605f-43af-b5d5-3fa3c128f726", + "w": 6, "x": 0, "y": 0 }, - "panelIndex": "050b110b-0b4d-404a-86c0-fa97f7eed2a0", - "panelRefName": "panel_050b110b-0b4d-404a-86c0-fa97f7eed2a0", - "title": "Rate of Questions", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "d126fb61-605f-43af-b5d5-3fa3c128f726", + "title": "Connected Threads", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "description": "", + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "a0d44b67-3523-462a-969c-46b6cff894de": { + "columnOrder": [ + "6e66f6f2-1980-4eea-95cd-02a001690536", + "9445f492-391e-4fbb-95b0-aee3296bf3cf" + ], + "columns": { + "6e66f6f2-1980-4eea-95cd-02a001690536": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9445f492-391e-4fbb-95b0-aee3296bf3cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Connected", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.threads.connected" + } + }, + "incompleteColumns": {} + }, + "bf806380-34bd-4505-89c2-53e0013c72a2": { + "columnOrder": [ + "bf1f79a5-eab3-4060-9f11-13687c8a68ab", + "73d03907-e382-4a22-88b4-ad63f9a57e3c" + ], + "columns": { + "73d03907-e382-4a22-88b4-ad63f9a57e3c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max Used Connections", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.max_used_connections" + }, + "bf1f79a5-eab3-4060-9f11-13687c8a68ab": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "e8d6fce5-8de1-4785-be35-7f24558b74bd": { + "columnOrder": [ + "5fc9a5d9-3fe9-4209-9ccf-ec341514e1d1", + "be0291da-acec-485e-bad3-1323eb0b9d8fX0", + "be0291da-acec-485e-bad3-1323eb0b9d8fX1", + "be0291da-acec-485e-bad3-1323eb0b9d8fX2", + "be0291da-acec-485e-bad3-1323eb0b9d8fX3", + "be0291da-acec-485e-bad3-1323eb0b9d8f" + ], + "columns": { + "5fc9a5d9-3fe9-4209-9ccf-ec341514e1d1": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "be0291da-acec-485e-bad3-1323eb0b9d8f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Connection rate", + "operationType": "formula", + "params": { + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.connections)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "be0291da-acec-485e-bad3-1323eb0b9d8fX3" + ], + "scale": "ratio" + }, + "be0291da-acec-485e-bad3-1323eb0b9d8fX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Connection rate", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.connections" + }, + "be0291da-acec-485e-bad3-1323eb0b9d8fX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Connection rate", + "operationType": "differences", + "references": [ + "be0291da-acec-485e-bad3-1323eb0b9d8fX0" + ], + "scale": "ratio" + }, + "be0291da-acec-485e-bad3-1323eb0b9d8fX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Connection rate", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "be0291da-acec-485e-bad3-1323eb0b9d8fX1" + ], + "scale": "ratio" + }, + "be0291da-acec-485e-bad3-1323eb0b9d8fX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Connection rate", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "be0291da-acec-485e-bad3-1323eb0b9d8fX2", + 0 + ], + "location": { + "max": 84, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.connections)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "be0291da-acec-485e-bad3-1323eb0b9d8fX2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-a0d44b67-3523-462a-969c-46b6cff894de", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-bf806380-34bd-4505-89c2-53e0013c72a2", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e8d6fce5-8de1-4785-be35-7f24558b74bd", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.2, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "be0291da-acec-485e-bad3-1323eb0b9d8f" + ], + "layerId": "e8d6fce5-8de1-4785-be35-7f24558b74bd", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "5fc9a5d9-3fe9-4209-9ccf-ec341514e1d1", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(198,135,31,1)", + "forAccessor": "be0291da-acec-485e-bad3-1323eb0b9d8f" + } + ] + }, + { + "accessors": [ + "9445f492-391e-4fbb-95b0-aee3296bf3cf" + ], + "layerId": "a0d44b67-3523-462a-969c-46b6cff894de", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "6e66f6f2-1980-4eea-95cd-02a001690536", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(115,216,255,0.89)", + "forAccessor": "9445f492-391e-4fbb-95b0-aee3296bf3cf" + } + ] + }, + { + "accessors": [ + "73d03907-e382-4a22-88b4-ad63f9a57e3c" + ], + "layerId": "bf806380-34bd-4505-89c2-53e0013c72a2", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "bf1f79a5-eab3-4060-9f11-13687c8a68ab", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "73d03907-e382-4a22-88b4-ad63f9a57e3c" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", - "w": 16, - "x": 16, + "i": "59586d96-3abd-48a3-a258-cfd620826ec2", + "w": 14, + "x": 6, "y": 0 }, - "panelIndex": "988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", - "panelRefName": "panel_988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", - "title": "Rate of SELECT statements", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "59586d96-3abd-48a3-a258-cfd620826ec2", + "title": "Connections", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "1362c750-4392-4e10-93c8-1634e5a39501": { + "columnOrder": [ + "abfa7518-4b57-4e40-b0e6-66f7d2d16eb7", + "674bd722-6067-47ad-a940-87ef1a34ba82", + "5085ba1b-5835-49bf-966e-59fbc4ad902f" + ], + "columns": { + "5085ba1b-5835-49bf-966e-59fbc4ad902f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Select", + "operationType": "differences", + "references": [ + "674bd722-6067-47ad-a940-87ef1a34ba82" + ], + "scale": "ratio" + }, + "674bd722-6067-47ad-a940-87ef1a34ba82": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.connection.errors.select" + }, + "abfa7518-4b57-4e40-b0e6-66f7d2d16eb7": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "26b61b6a-4a67-4524-b8be-5aedd4046e41": { + "columnOrder": [ + "401e9e20-cc44-44cc-a40d-1516bd9114ed", + "e7516d1a-b28b-4339-8947-aa22c8cd22a4", + "808a916a-1abe-4c07-a870-6d0e1fef7da2" + ], + "columns": { + "401e9e20-cc44-44cc-a40d-1516bd9114ed": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "808a916a-1abe-4c07-a870-6d0e1fef7da2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Peer Address", + "operationType": "differences", + "references": [ + "e7516d1a-b28b-4339-8947-aa22c8cd22a4" + ], + "scale": "ratio" + }, + "e7516d1a-b28b-4339-8947-aa22c8cd22a4": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.connection.errors.peer_address" + } + }, + "incompleteColumns": {} + }, + "2cb807c8-865c-43b6-8714-6b594b43b954": { + "columnOrder": [ + "e9c029c4-9460-41d8-951b-c45c2aa9e439", + "ffa46269-b2c2-4aa8-bfb8-020127511b53", + "04b5c722-67bd-4e7e-a325-a26c706b1e38" + ], + "columns": { + "04b5c722-67bd-4e7e-a325-a26c706b1e38": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Internal", + "operationType": "differences", + "references": [ + "ffa46269-b2c2-4aa8-bfb8-020127511b53" + ], + "scale": "ratio" + }, + "e9c029c4-9460-41d8-951b-c45c2aa9e439": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ffa46269-b2c2-4aa8-bfb8-020127511b53": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.connection.errors.internal" + } + }, + "incompleteColumns": {} + }, + "d6632c1f-9c3a-4aeb-b0b8-bf8c4b80c636": { + "columnOrder": [ + "7a0b2650-f9a8-4b06-bb33-b3713e494c8a", + "75d11d25-8358-4cb7-81eb-a64a8c2c6850", + "3b1af940-aa60-4511-8015-4ddfb9fd8a1f" + ], + "columns": { + "3b1af940-aa60-4511-8015-4ddfb9fd8a1f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Accept", + "operationType": "differences", + "references": [ + "75d11d25-8358-4cb7-81eb-a64a8c2c6850" + ], + "scale": "ratio" + }, + "75d11d25-8358-4cb7-81eb-a64a8c2c6850": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.connection.errors.accept" + }, + "7a0b2650-f9a8-4b06-bb33-b3713e494c8a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "f62eed7e-c13d-40dc-b34f-b59a5bc5bf0c": { + "columnOrder": [ + "b9fa2b8f-ff90-4138-a262-ec6ba989b4bc", + "ec346601-637a-4453-a717-21a1383f01ae", + "ce317d6b-d9ea-4901-8f45-6c5939a0c798" + ], + "columns": { + "b9fa2b8f-ff90-4138-a262-ec6ba989b4bc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ce317d6b-d9ea-4901-8f45-6c5939a0c798": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Max", + "operationType": "differences", + "references": [ + "ec346601-637a-4453-a717-21a1383f01ae" + ], + "scale": "ratio" + }, + "ec346601-637a-4453-a717-21a1383f01ae": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.connection.errors.max" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-1362c750-4392-4e10-93c8-1634e5a39501", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-26b61b6a-4a67-4524-b8be-5aedd4046e41", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-2cb807c8-865c-43b6-8714-6b594b43b954", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-d6632c1f-9c3a-4aeb-b0b8-bf8c4b80c636", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-f62eed7e-c13d-40dc-b34f-b59a5bc5bf0c", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ce317d6b-d9ea-4901-8f45-6c5939a0c798" + ], + "layerId": "f62eed7e-c13d-40dc-b34f-b59a5bc5bf0c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "b9fa2b8f-ff90-4138-a262-ec6ba989b4bc", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "ce317d6b-d9ea-4901-8f45-6c5939a0c798" + } + ] + }, + { + "accessors": [ + "3b1af940-aa60-4511-8015-4ddfb9fd8a1f" + ], + "layerId": "d6632c1f-9c3a-4aeb-b0b8-bf8c4b80c636", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "7a0b2650-f9a8-4b06-bb33-b3713e494c8a", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "3b1af940-aa60-4511-8015-4ddfb9fd8a1f" + } + ] + }, + { + "accessors": [ + "04b5c722-67bd-4e7e-a325-a26c706b1e38" + ], + "layerId": "2cb807c8-865c-43b6-8714-6b594b43b954", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "e9c029c4-9460-41d8-951b-c45c2aa9e439", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,196,0,1)", + "forAccessor": "04b5c722-67bd-4e7e-a325-a26c706b1e38" + } + ] + }, + { + "accessors": [ + "5085ba1b-5835-49bf-966e-59fbc4ad902f" + ], + "layerId": "1362c750-4392-4e10-93c8-1634e5a39501", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "abfa7518-4b57-4e40-b0e6-66f7d2d16eb7", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "5085ba1b-5835-49bf-966e-59fbc4ad902f" + } + ] + }, + { + "accessors": [ + "808a916a-1abe-4c07-a870-6d0e1fef7da2" + ], + "layerId": "26b61b6a-4a67-4524-b8be-5aedd4046e41", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "401e9e20-cc44-44cc-a40d-1516bd9114ed", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(253,161,255,1)", + "forAccessor": "808a916a-1abe-4c07-a870-6d0e1fef7da2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "a1f8fa38-a62f-4e05-adde-e995dae9ad83", - "w": 16, - "x": 32, + "i": "9487b742-3e7f-4d57-af32-014ad360235c", + "w": 14, + "x": 34, "y": 0 }, - "panelIndex": "a1f8fa38-a62f-4e05-adde-e995dae9ad83", - "panelRefName": "panel_a1f8fa38-a62f-4e05-adde-e995dae9ad83", - "title": "Rate of INSERT, UPDATE, DELETE", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "9487b742-3e7f-4d57-af32-014ad360235c", + "title": "Connection Errors", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "e4966935-b587-4950-938e-1f9a431c06e8": { + "columnOrder": [ + "01859025-7a0c-4911-ae95-432d1b6e35e9", + "a53b31be-968c-4602-845c-b524b399ff5dX0", + "a53b31be-968c-4602-845c-b524b399ff5dX1", + "a53b31be-968c-4602-845c-b524b399ff5dX2", + "a53b31be-968c-4602-845c-b524b399ff5dX3", + "a53b31be-968c-4602-845c-b524b399ff5d" + ], + "columns": { + "01859025-7a0c-4911-ae95-432d1b6e35e9": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a53b31be-968c-4602-845c-b524b399ff5d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SELECT", + "operationType": "formula", + "params": { + "format": { + "id": "number" + }, + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "a53b31be-968c-4602-845c-b524b399ff5dX3" + ], + "scale": "ratio" + }, + "a53b31be-968c-4602-845c-b524b399ff5dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.questions" + }, + "a53b31be-968c-4602-845c-b524b399ff5dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "operationType": "differences", + "references": [ + "a53b31be-968c-4602-845c-b524b399ff5dX0" + ], + "scale": "ratio" + }, + "a53b31be-968c-4602-845c-b524b399ff5dX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "a53b31be-968c-4602-845c-b524b399ff5dX1" + ], + "scale": "ratio" + }, + "a53b31be-968c-4602-845c-b524b399ff5dX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "a53b31be-968c-4602-845c-b524b399ff5dX2", + 0 + ], + "location": { + "max": 82, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.questions)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "a53b31be-968c-4602-845c-b524b399ff5dX2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-e4966935-b587-4950-938e-1f9a431c06e8", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.3, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a53b31be-968c-4602-845c-b524b399ff5d" + ], + "layerId": "e4966935-b587-4950-938e-1f9a431c06e8", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "01859025-7a0c-4911-ae95-432d1b6e35e9", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "a53b31be-968c-4602-845c-b524b399ff5d" + } + ] + } + ], + "legend": { + "isVisible": false, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, - "i": "d126fb61-605f-43af-b5d5-3fa3c128f726", - "w": 6, + "i": "050b110b-0b4d-404a-86c0-fa97f7eed2a0", + "w": 12, "x": 0, "y": 12 }, - "panelIndex": "d126fb61-605f-43af-b5d5-3fa3c128f726", - "panelRefName": "panel_d126fb61-605f-43af-b5d5-3fa3c128f726", - "title": "Connected Threads", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "050b110b-0b4d-404a-86c0-fa97f7eed2a0", + "title": "Statements Executed", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "5497a9ed-00e8-4d69-97a8-fd48aa7648fe": { + "columnOrder": [ + "9bd8e28d-70ab-48f6-a4c3-cc29776fddf2", + "12b50aa9-7273-4f42-9518-0056516452f3X0", + "12b50aa9-7273-4f42-9518-0056516452f3X1", + "12b50aa9-7273-4f42-9518-0056516452f3X2", + "12b50aa9-7273-4f42-9518-0056516452f3X3", + "12b50aa9-7273-4f42-9518-0056516452f3" + ], + "columns": { + "12b50aa9-7273-4f42-9518-0056516452f3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Aborted Connections", + "operationType": "formula", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.aborted.clients)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "12b50aa9-7273-4f42-9518-0056516452f3X3" + ], + "scale": "ratio" + }, + "12b50aa9-7273-4f42-9518-0056516452f3X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.aborted.clients" + }, + "12b50aa9-7273-4f42-9518-0056516452f3X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "differences", + "references": [ + "12b50aa9-7273-4f42-9518-0056516452f3X0" + ], + "scale": "ratio" + }, + "12b50aa9-7273-4f42-9518-0056516452f3X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "12b50aa9-7273-4f42-9518-0056516452f3X1" + ], + "scale": "ratio" + }, + "12b50aa9-7273-4f42-9518-0056516452f3X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "12b50aa9-7273-4f42-9518-0056516452f3X2", + 0 + ], + "location": { + "max": 88, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.aborted.clients)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "12b50aa9-7273-4f42-9518-0056516452f3X2" + ], + "scale": "ratio" + }, + "9bd8e28d-70ab-48f6-a4c3-cc29776fddf2": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "85ded1df-0c02-4ebd-b8c0-5318a5973805": { + "columnOrder": [ + "3543878b-63ed-49ac-a11b-bef1dc098d56", + "44b9fd61-c33a-48b5-9e3b-5221c331b82b", + "5d8a9938-1a86-4920-a6c1-8b1d65a57bdc", + "5f45a1dd-9484-461f-92b5-35bd5eb28161", + "3ab9c5bc-1873-4ac1-a329-4361ebccdca0", + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248", + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X0", + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X1", + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X2", + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X3" + ], + "columns": { + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Failed Attempts to Connect ", + "operationType": "formula", + "params": { + "format": { + "id": "number" + }, + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.aborted.connects)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X3" + ], + "scale": "ratio" + }, + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Failed Attempts to Connect ", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.aborted.connects" + }, + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Failed Attempts to Connect ", + "operationType": "differences", + "references": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X0" + ], + "scale": "ratio" + }, + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Failed Attempts to Connect ", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X1" + ], + "scale": "ratio" + }, + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Failed Attempts to Connect ", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X2", + 0 + ], + "location": { + "max": 89, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.aborted.connects)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248X2" + ], + "scale": "ratio" + }, + "3543878b-63ed-49ac-a11b-bef1dc098d56": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "3ab9c5bc-1873-4ac1-a329-4361ebccdca0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "5f45a1dd-9484-461f-92b5-35bd5eb28161", + 0 + ], + "location": { + "max": 88, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.aborted.clients)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "5f45a1dd-9484-461f-92b5-35bd5eb28161" + ], + "scale": "ratio" + }, + "44b9fd61-c33a-48b5-9e3b-5221c331b82b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.aborted.clients" + }, + "5d8a9938-1a86-4920-a6c1-8b1d65a57bdc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "differences", + "references": [ + "44b9fd61-c33a-48b5-9e3b-5221c331b82b" + ], + "scale": "ratio" + }, + "5f45a1dd-9484-461f-92b5-35bd5eb28161": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Aborted Connections", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "5d8a9938-1a86-4920-a6c1-8b1d65a57bdc" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-5497a9ed-00e8-4d69-97a8-fd48aa7648fe", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-85ded1df-0c02-4ebd-b8c0-5318a5973805", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.3, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "12b50aa9-7273-4f42-9518-0056516452f3" + ], + "layerId": "5497a9ed-00e8-4d69-97a8-fd48aa7648fe", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "9bd8e28d-70ab-48f6-a4c3-cc29776fddf2", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(176,188,0,1)", + "forAccessor": "12b50aa9-7273-4f42-9518-0056516452f3" + } + ] + }, + { + "accessors": [ + "072ace85-4f3f-4dc1-80aa-e1d0ae92c248" + ], + "layerId": "85ded1df-0c02-4ebd-b8c0-5318a5973805", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "3543878b-63ed-49ac-a11b-bef1dc098d56", + "yConfig": [ + { + "axisMode": "left", + "color": "#fb9e00", + "forAccessor": "072ace85-4f3f-4dc1-80aa-e1d0ae92c248" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "59586d96-3abd-48a3-a258-cfd620826ec2", + "i": "dd0cf202-fe22-4daf-8f25-09c64d412bf3", "w": 14, - "x": 6, + "x": 20, + "y": 0 + }, + "panelIndex": "dd0cf202-fe22-4daf-8f25-09c64d412bf3", + "title": "Aborted Connections Rate", + "type": "lens", + "version": "8.7.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "6604cca0-a8c6-4591-bb73-20eeec4b4fee": { + "columnOrder": [ + "614e1bef-63ee-4d5b-ac6e-7219a5deb403", + "49e6cd07-491f-4ad3-b14e-39355b68e460X0", + "49e6cd07-491f-4ad3-b14e-39355b68e460X1", + "49e6cd07-491f-4ad3-b14e-39355b68e460X2", + "49e6cd07-491f-4ad3-b14e-39355b68e460X3", + "49e6cd07-491f-4ad3-b14e-39355b68e460" + ], + "columns": { + "49e6cd07-491f-4ad3-b14e-39355b68e460": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "INSERT", + "operationType": "formula", + "params": { + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.command.insert)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460X3" + ], + "scale": "ratio" + }, + "49e6cd07-491f-4ad3-b14e-39355b68e460X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of INSERT", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.command.insert" + }, + "49e6cd07-491f-4ad3-b14e-39355b68e460X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of INSERT", + "operationType": "differences", + "references": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460X0" + ], + "scale": "ratio" + }, + "49e6cd07-491f-4ad3-b14e-39355b68e460X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of INSERT", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460X1" + ], + "scale": "ratio" + }, + "49e6cd07-491f-4ad3-b14e-39355b68e460X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of INSERT", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460X2", + 0 + ], + "location": { + "max": 87, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.command.insert)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460X2" + ], + "scale": "ratio" + }, + "614e1bef-63ee-4d5b-ac6e-7219a5deb403": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "6fe650a0-ecca-4467-adeb-9cb074085dec": { + "columnOrder": [ + "089b1f6b-9f13-4c46-b593-d91dcda71b6b", + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X0", + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X1", + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X2", + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X3", + "9919b6e4-7d75-4027-9e5f-84c91f2964d7" + ], + "columns": { + "089b1f6b-9f13-4c46-b593-d91dcda71b6b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9919b6e4-7d75-4027-9e5f-84c91f2964d7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "UPDATE", + "operationType": "formula", + "params": { + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.command.update)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X3" + ], + "scale": "ratio" + }, + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of UPDATE", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.command.update" + }, + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of UPDATE", + "operationType": "differences", + "references": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X0" + ], + "scale": "ratio" + }, + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of UPDATE", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X1" + ], + "scale": "ratio" + }, + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of UPDATE", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X2", + 0 + ], + "location": { + "max": 87, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.command.update)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7X2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + }, + "95a08036-6432-47d6-8390-1aa8a662951b": { + "columnOrder": [ + "051dc53b-5c94-4565-81c2-488776b5996d", + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX0", + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX1", + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX2", + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX3", + "ddd2910d-b617-4e96-bdfc-95dbe655c09d" + ], + "columns": { + "051dc53b-5c94-4565-81c2-488776b5996d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ddd2910d-b617-4e96-bdfc-95dbe655c09d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DELETE", + "operationType": "formula", + "params": { + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.command.delete)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX3" + ], + "scale": "ratio" + }, + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of DELETE", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.command.delete" + }, + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of DELETE", + "operationType": "differences", + "references": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX0" + ], + "scale": "ratio" + }, + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of DELETE", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX1" + ], + "scale": "ratio" + }, + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of DELETE", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX2", + 0 + ], + "location": { + "max": 87, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.command.delete)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09dX2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-6604cca0-a8c6-4591-bb73-20eeec4b4fee", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-6fe650a0-ecca-4467-adeb-9cb074085dec", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-95a08036-6432-47d6-8390-1aa8a662951b", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.3, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "49e6cd07-491f-4ad3-b14e-39355b68e460" + ], + "layerId": "6604cca0-a8c6-4591-bb73-20eeec4b4fee", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "614e1bef-63ee-4d5b-ac6e-7219a5deb403", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "49e6cd07-491f-4ad3-b14e-39355b68e460" + } + ] + }, + { + "accessors": [ + "9919b6e4-7d75-4027-9e5f-84c91f2964d7" + ], + "layerId": "6fe650a0-ecca-4467-adeb-9cb074085dec", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "089b1f6b-9f13-4c46-b593-d91dcda71b6b", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "9919b6e4-7d75-4027-9e5f-84c91f2964d7" + } + ] + }, + { + "accessors": [ + "ddd2910d-b617-4e96-bdfc-95dbe655c09d" + ], + "layerId": "95a08036-6432-47d6-8390-1aa8a662951b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "051dc53b-5c94-4565-81c2-488776b5996d", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(244,78,59,1)", + "forAccessor": "ddd2910d-b617-4e96-bdfc-95dbe655c09d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "a1f8fa38-a62f-4e05-adde-e995dae9ad83", + "w": 12, + "x": 36, "y": 12 }, - "panelIndex": "59586d96-3abd-48a3-a258-cfd620826ec2", - "panelRefName": "panel_59586d96-3abd-48a3-a258-cfd620826ec2", - "title": "Connections", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "a1f8fa38-a62f-4e05-adde-e995dae9ad83", + "title": "Rate of INSERT, UPDATE, DELETE", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "a50495bb-587e-48f3-b06a-cbcfbb9d0e04": { + "columnOrder": [ + "c6b16302-24b2-459d-b562-23aec32c4296", + "5c8cf1de-1175-40c2-aad4-10d962be4a10X0", + "5c8cf1de-1175-40c2-aad4-10d962be4a10X1", + "5c8cf1de-1175-40c2-aad4-10d962be4a10X2", + "5c8cf1de-1175-40c2-aad4-10d962be4a10X3", + "5c8cf1de-1175-40c2-aad4-10d962be4a10" + ], + "columns": { + "5c8cf1de-1175-40c2-aad4-10d962be4a10": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "SELECT", + "operationType": "formula", + "params": { + "format": { + "id": "number" + }, + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10X3" + ], + "scale": "ratio" + }, + "5c8cf1de-1175-40c2-aad4-10d962be4a10X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.command.select" + }, + "5c8cf1de-1175-40c2-aad4-10d962be4a10X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "operationType": "differences", + "references": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10X0" + ], + "scale": "ratio" + }, + "5c8cf1de-1175-40c2-aad4-10d962be4a10X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10X1" + ], + "scale": "ratio" + }, + "5c8cf1de-1175-40c2-aad4-10d962be4a10X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10X2", + 0 + ], + "location": { + "max": 87, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.command.select)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10X2" + ], + "scale": "ratio" + }, + "c6b16302-24b2-459d-b562-23aec32c4296": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-a50495bb-587e-48f3-b06a-cbcfbb9d0e04", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.3, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "5c8cf1de-1175-40c2-aad4-10d962be4a10" + ], + "layerId": "a50495bb-587e-48f3-b06a-cbcfbb9d0e04", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "c6b16302-24b2-459d-b562-23aec32c4296", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,156,224,1)", + "forAccessor": "5c8cf1de-1175-40c2-aad4-10d962be4a10" + } + ] + } + ], + "legend": { + "isVisible": false, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "dd0cf202-fe22-4daf-8f25-09c64d412bf3", - "w": 14, - "x": 20, + "i": "988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", + "w": 12, + "x": 12, "y": 12 }, - "panelIndex": "dd0cf202-fe22-4daf-8f25-09c64d412bf3", - "panelRefName": "panel_dd0cf202-fe22-4daf-8f25-09c64d412bf3", - "title": "Aborted Connections Rate", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", + "title": "Rate of SELECT statements", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": true, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "13c3d385-cdcc-4175-b592-2a8f75179d74": { + "columnOrder": [ + "938ca2fd-27c1-49b2-b39b-519856add629", + "a3b95231-c738-4ebd-95f3-1dbbd0377a02", + "cefe0fb6-3a76-4dc3-b51e-5141a779c306" + ], + "columns": { + "938ca2fd-27c1-49b2-b39b-519856add629": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a3b95231-c738-4ebd-95f3-1dbbd0377a02": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.command.insert" + }, + "cefe0fb6-3a76-4dc3-b51e-5141a779c306": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Insert", + "operationType": "differences", + "references": [ + "a3b95231-c738-4ebd-95f3-1dbbd0377a02" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + }, + "4765299f-9937-49c9-a6a6-9b282d39f6d3": { + "columnOrder": [ + "73ac4945-cabc-4ee0-bb1b-78b7cfae721d", + "1c04c66a-e9a2-44e3-8118-da3aa7f0cad3", + "52c5f4e7-a46d-4bbc-aa27-0f8a56d6c16f" + ], + "columns": { + "1c04c66a-e9a2-44e3-8118-da3aa7f0cad3": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.command.delete" + }, + "52c5f4e7-a46d-4bbc-aa27-0f8a56d6c16f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Delete", + "operationType": "differences", + "references": [ + "1c04c66a-e9a2-44e3-8118-da3aa7f0cad3" + ], + "scale": "ratio" + }, + "73ac4945-cabc-4ee0-bb1b-78b7cfae721d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "78b8339d-8d67-4001-8942-e5ddf3767d9c": { + "columnOrder": [ + "773da740-d3e6-4a3b-bbce-73282fa118c0", + "1b91336f-7d13-488d-b18a-f9d75a6d5e9f", + "bc18fa77-f4af-468b-a637-d48081f20bae" + ], + "columns": { + "1b91336f-7d13-488d-b18a-f9d75a6d5e9f": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.command.update" + }, + "773da740-d3e6-4a3b-bbce-73282fa118c0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "bc18fa77-f4af-468b-a637-d48081f20bae": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Update", + "operationType": "differences", + "references": [ + "1b91336f-7d13-488d-b18a-f9d75a6d5e9f" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + }, + "82a54224-450b-4555-beea-b4bf7998b5de": { + "columnOrder": [ + "1b870cdd-2bde-47e0-980f-7963753d54cb", + "db241901-7254-4b05-8408-db5594eb203e", + "86a9abb0-3ef7-454b-998a-f12918cdcad2" + ], + "columns": { + "1b870cdd-2bde-47e0-980f-7963753d54cb": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "86a9abb0-3ef7-454b-998a-f12918cdcad2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Select", + "operationType": "differences", + "references": [ + "db241901-7254-4b05-8408-db5594eb203e" + ], + "scale": "ratio" + }, + "db241901-7254-4b05-8408-db5594eb203e": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.command.select" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-13c3d385-cdcc-4175-b592-2a8f75179d74", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4765299f-9937-49c9-a6a6-9b282d39f6d3", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-78b8339d-8d67-4001-8942-e5ddf3767d9c", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-82a54224-450b-4555-beea-b4bf7998b5de", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "86a9abb0-3ef7-454b-998a-f12918cdcad2" + ], + "layerId": "82a54224-450b-4555-beea-b4bf7998b5de", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "1b870cdd-2bde-47e0-980f-7963753d54cb", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "86a9abb0-3ef7-454b-998a-f12918cdcad2" + } + ] + }, + { + "accessors": [ + "bc18fa77-f4af-468b-a637-d48081f20bae" + ], + "layerId": "78b8339d-8d67-4001-8942-e5ddf3767d9c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "773da740-d3e6-4a3b-bbce-73282fa118c0", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(219,223,0,1)", + "forAccessor": "bc18fa77-f4af-468b-a637-d48081f20bae" + } + ] + }, + { + "accessors": [ + "52c5f4e7-a46d-4bbc-aa27-0f8a56d6c16f" + ], + "layerId": "4765299f-9937-49c9-a6a6-9b282d39f6d3", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "73ac4945-cabc-4ee0-bb1b-78b7cfae721d", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(244,78,59,1)", + "forAccessor": "52c5f4e7-a46d-4bbc-aa27-0f8a56d6c16f" + } + ] + }, + { + "accessors": [ + "cefe0fb6-3a76-4dc3-b51e-5141a779c306" + ], + "layerId": "13c3d385-cdcc-4175-b592-2a8f75179d74", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "938ca2fd-27c1-49b2-b39b-519856add629", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "cefe0fb6-3a76-4dc3-b51e-5141a779c306" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 12, - "i": "ead16a55-a2d3-49ae-a09b-a0b03560e9a0", - "w": 14, - "x": 34, + "i": "00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", + "w": 12, + "x": 24, "y": 12 }, - "panelIndex": "ead16a55-a2d3-49ae-a09b-a0b03560e9a0", - "panelRefName": "panel_ead16a55-a2d3-49ae-a09b-a0b03560e9a0", - "title": "Thread Activity", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", + "title": "Commands Operations", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "2ceb51f0-879e-41bc-9d78-6ad24085fa4c": { + "columnOrder": [ + "37c5a597-4615-408c-bfb7-174d0b81167c", + "ea07fb1e-82ba-4e9c-94d5-2bd97397011e" + ], + "columns": { + "37c5a597-4615-408c-bfb7-174d0b81167c": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ea07fb1e-82ba-4e9c-94d5-2bd97397011e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Buffer Pool Pages Total", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.total" + } + }, + "incompleteColumns": {} + }, + "462e80de-4733-4854-9831-d30cf399ad77": { + "columnOrder": [ + "7d2dc744-283e-4bfc-bc32-183bd76f8433", + "a692fa9f-9ba0-439a-b028-66b07e29956e" + ], + "columns": { + "7d2dc744-283e-4bfc-bc32-183bd76f8433": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a692fa9f-9ba0-439a-b028-66b07e29956e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Buffer Pool Pages Free", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.free" + } + }, + "incompleteColumns": {} + }, + "d5d76c1d-5080-49fc-b142-3087281374a0": { + "columnOrder": [ + "74560282-2bca-4a8c-a33d-7bdfd2dfbeca", + "b785254b-8b7f-47c2-af83-4a588804b489" + ], + "columns": { + "74560282-2bca-4a8c-a33d-7bdfd2dfbeca": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b785254b-8b7f-47c2-af83-4a588804b489": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Buffer Pool Pages Data", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.data" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-2ceb51f0-879e-41bc-9d78-6ad24085fa4c", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-462e80de-4733-4854-9831-d30cf399ad77", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-d5d76c1d-5080-49fc-b142-3087281374a0", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b785254b-8b7f-47c2-af83-4a588804b489" + ], + "layerId": "d5d76c1d-5080-49fc-b142-3087281374a0", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "74560282-2bca-4a8c-a33d-7bdfd2dfbeca", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "b785254b-8b7f-47c2-af83-4a588804b489" + } + ] + }, + { + "accessors": [ + "a692fa9f-9ba0-439a-b028-66b07e29956e" + ], + "layerId": "462e80de-4733-4854-9831-d30cf399ad77", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "7d2dc744-283e-4bfc-bc32-183bd76f8433", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "a692fa9f-9ba0-439a-b028-66b07e29956e" + } + ] + }, + { + "accessors": [ + "ea07fb1e-82ba-4e9c-94d5-2bd97397011e" + ], + "layerId": "2ceb51f0-879e-41bc-9d78-6ad24085fa4c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "37c5a597-4615-408c-bfb7-174d0b81167c", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(102,102,102,1)", + "forAccessor": "ea07fb1e-82ba-4e9c-94d5-2bd97397011e" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -166,13 +3256,285 @@ "y": 24 }, "panelIndex": "24fc2926-610d-4910-8f3e-eb63ca69788c", - "panelRefName": "panel_24fc2926-610d-4910-8f3e-eb63ca69788c", "title": "Buffer Pool Pages", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "217a148f-fadb-4f64-9e12-56d89ed4c411": { + "columnOrder": [ + "4ce73dbb-ce4b-46d0-bfdb-b10dc7017fca", + "23713ff8-e196-46d8-b732-8f3001c34d9d", + "23713ff8-e196-46d8-b732-8f3001c34d9dX0", + "23713ff8-e196-46d8-b732-8f3001c34d9dX1", + "23713ff8-e196-46d8-b732-8f3001c34d9dX2", + "23713ff8-e196-46d8-b732-8f3001c34d9dX3", + "23713ff8-e196-46d8-b732-8f3001c34d9dX4" + ], + "columns": { + "23713ff8-e196-46d8-b732-8f3001c34d9d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Utilization", + "operationType": "formula", + "params": { + "format": { + "id": "percent", + "params": { + "decimals": 1 + } + }, + "formula": "ifelse(gt(max(mysql.status.innodb.buffer_pool.pages.total,kql='mysql.status.innodb.buffer_pool.pages.total:*'),0),(max(mysql.status.innodb.buffer_pool.pages.total)-max(mysql.status.innodb.buffer_pool.pages.free))/max(mysql.status.innodb.buffer_pool.pages.total),0)", + "isFormulaBroken": false + }, + "references": [ + "23713ff8-e196-46d8-b732-8f3001c34d9dX4" + ], + "scale": "ratio" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "mysql.status.innodb.buffer_pool.pages.total:*" + }, + "isBucketed": false, + "label": "Part of Utilization", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.total" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Utilization", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.total" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Utilization", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.free" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Utilization", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pages.total" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Utilization", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + { + "args": [ + "23713ff8-e196-46d8-b732-8f3001c34d9dX0", + 0 + ], + "location": { + "max": 113, + "min": 7 + }, + "name": "gt", + "text": "gt(max(mysql.status.innodb.buffer_pool.pages.total,kql='mysql.status.innodb.buffer_pool.pages.total:*'),0)", + "type": "function" + }, + { + "args": [ + { + "args": [ + "23713ff8-e196-46d8-b732-8f3001c34d9dX1", + "23713ff8-e196-46d8-b732-8f3001c34d9dX2" + ], + "location": { + "max": 211, + "min": 115 + }, + "name": "subtract", + "text": "max(mysql.status.innodb.buffer_pool.pages.total)-max(mysql.status.innodb.buffer_pool.pages.free)", + "type": "function" + }, + "23713ff8-e196-46d8-b732-8f3001c34d9dX3" + ], + "location": { + "max": 261, + "min": 114 + }, + "name": "divide", + "text": "(max(mysql.status.innodb.buffer_pool.pages.total)-max(mysql.status.innodb.buffer_pool.pages.free))/max(mysql.status.innodb.buffer_pool.pages.total)", + "type": "function" + }, + 0 + ], + "location": { + "max": 264, + "min": 0 + }, + "name": "ifelse", + "text": "ifelse(gt(max(mysql.status.innodb.buffer_pool.pages.total,kql='mysql.status.innodb.buffer_pool.pages.total:*'),0),(max(mysql.status.innodb.buffer_pool.pages.total)-max(mysql.status.innodb.buffer_pool.pages.free))/max(mysql.status.innodb.buffer_pool.pages.total),0)", + "type": "function" + } + }, + "references": [ + "23713ff8-e196-46d8-b732-8f3001c34d9dX0", + "23713ff8-e196-46d8-b732-8f3001c34d9dX1", + "23713ff8-e196-46d8-b732-8f3001c34d9dX2", + "23713ff8-e196-46d8-b732-8f3001c34d9dX3" + ], + "scale": "ratio" + }, + "4ce73dbb-ce4b-46d0-bfdb-b10dc7017fca": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-217a148f-fadb-4f64-9e12-56d89ed4c411", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.1, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "23713ff8-e196-46d8-b732-8f3001c34d9d" + ], + "layerId": "217a148f-fadb-4f64-9e12-56d89ed4c411", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "4ce73dbb-ce4b-46d0-bfdb-b10dc7017fca", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(226,115,0,1)", + "forAccessor": "23713ff8-e196-46d8-b732-8f3001c34d9d" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -183,13 +3545,265 @@ "y": 24 }, "panelIndex": "33c10c95-be67-492e-afb5-863f375cffc2", - "panelRefName": "panel_33c10c95-be67-492e-afb5-863f375cffc2", "title": "Buffer Pool Utilization", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "4519ae76-7fc9-4517-a9b0-244c347d693a": { + "columnOrder": [ + "883317d4-b4d9-4e7c-a564-37b30672432a", + "d8298535-8642-4b3d-bd9c-3096b5c668ff", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX0", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX1", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX2", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX3" + ], + "columns": { + "883317d4-b4d9-4e7c-a564-37b30672432a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d8298535-8642-4b3d-bd9c-3096b5c668ff": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Effeciency (lower is better)", + "operationType": "formula", + "params": { + "formula": "ifelse(gt(max(mysql.status.innodb.buffer_pool.read.requests,kql='mysql.status.innodb.buffer_pool.read.requests:*'),0),(max(mysql.status.innodb.buffer_pool.pool.reads)/max(mysql.status.innodb.buffer_pool.read.requests))*100,0)", + "isFormulaBroken": false + }, + "references": [ + "d8298535-8642-4b3d-bd9c-3096b5c668ffX3" + ], + "scale": "ratio" + }, + "d8298535-8642-4b3d-bd9c-3096b5c668ffX0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "mysql.status.innodb.buffer_pool.read.requests:*" + }, + "isBucketed": false, + "label": "Part of Effeciency (lower is better)", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.read.requests" + }, + "d8298535-8642-4b3d-bd9c-3096b5c668ffX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Effeciency (lower is better)", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.pool.reads" + }, + "d8298535-8642-4b3d-bd9c-3096b5c668ffX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Effeciency (lower is better)", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.innodb.buffer_pool.read.requests" + }, + "d8298535-8642-4b3d-bd9c-3096b5c668ffX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Effeciency (lower is better)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + { + "args": [ + "d8298535-8642-4b3d-bd9c-3096b5c668ffX0", + 0 + ], + "location": { + "max": 117, + "min": 7 + }, + "name": "gt", + "text": "gt(max(mysql.status.innodb.buffer_pool.read.requests,kql='mysql.status.innodb.buffer_pool.read.requests:*'),0)", + "type": "function" + }, + { + "args": [ + { + "args": [ + "d8298535-8642-4b3d-bd9c-3096b5c668ffX1", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX2" + ], + "location": { + "max": 217, + "min": 119 + }, + "name": "divide", + "text": "max(mysql.status.innodb.buffer_pool.pool.reads)/max(mysql.status.innodb.buffer_pool.read.requests)", + "type": "function" + }, + 100 + ], + "location": { + "max": 222, + "min": 118 + }, + "name": "multiply", + "text": "(max(mysql.status.innodb.buffer_pool.pool.reads)/max(mysql.status.innodb.buffer_pool.read.requests))*100", + "type": "function" + }, + 0 + ], + "location": { + "max": 225, + "min": 0 + }, + "name": "ifelse", + "text": "ifelse(gt(max(mysql.status.innodb.buffer_pool.read.requests,kql='mysql.status.innodb.buffer_pool.read.requests:*'),0),(max(mysql.status.innodb.buffer_pool.pool.reads)/max(mysql.status.innodb.buffer_pool.read.requests))*100,0)", + "type": "function" + } + }, + "references": [ + "d8298535-8642-4b3d-bd9c-3096b5c668ffX0", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX1", + "d8298535-8642-4b3d-bd9c-3096b5c668ffX2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-4519ae76-7fc9-4517-a9b0-244c347d693a", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.1, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d8298535-8642-4b3d-bd9c-3096b5c668ff" + ], + "layerId": "4519ae76-7fc9-4517-a9b0-244c347d693a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "883317d4-b4d9-4e7c-a564-37b30672432a", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(87,177,211,1)", + "forAccessor": "d8298535-8642-4b3d-bd9c-3096b5c668ff" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -200,190 +3814,1472 @@ "y": 24 }, "panelIndex": "d35d7c5e-8832-40e2-8c77-953ad320c853", - "panelRefName": "panel_d35d7c5e-8832-40e2-8c77-953ad320c853", "title": "Buffer Pool Efficiency", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "96cc1c20-95fd-419b-990c-8b6e12db9039": { + "columnOrder": [ + "5a51dbd0-200b-4609-b974-f7b83ad6e55a", + "088e7897-afd9-4edf-9e9e-e03cd0f6378e", + "7ea2afb9-afe6-44d6-a531-b07156d33f6c" + ], + "columns": { + "088e7897-afd9-4edf-9e9e-e03cd0f6378e": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.table.open_cache.hits" + }, + "5a51dbd0-200b-4609-b974-f7b83ad6e55a": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "7ea2afb9-afe6-44d6-a531-b07156d33f6c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hits", + "operationType": "differences", + "references": [ + "088e7897-afd9-4edf-9e9e-e03cd0f6378e" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + }, + "9eee4770-f2c7-4062-94e2-7e547783e799": { + "columnOrder": [ + "ce864954-322e-4713-a083-1f106ed1e6aa", + "eb65fec7-0c3d-48e9-ab0f-098033e298c8", + "34e6541a-1020-4680-989e-89420abff951" + ], + "columns": { + "34e6541a-1020-4680-989e-89420abff951": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Misses", + "operationType": "differences", + "references": [ + "eb65fec7-0c3d-48e9-ab0f-098033e298c8" + ], + "scale": "ratio" + }, + "ce864954-322e-4713-a083-1f106ed1e6aa": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "eb65fec7-0c3d-48e9-ab0f-098033e298c8": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.table.open_cache.misses" + } + }, + "incompleteColumns": {} + }, + "dbf21713-bc46-4f85-9831-4afe07a3895c": { + "columnOrder": [ + "90eeaa7e-0db8-4689-afc4-29fa266f0fff", + "5f3ff0ef-71f8-4be7-aecf-7a85c72b10b2", + "9757720d-3422-4a92-b1a1-92537dee8e0e" + ], + "columns": { + "5f3ff0ef-71f8-4be7-aecf-7a85c72b10b2": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.table.open_cache.overflows" + }, + "90eeaa7e-0db8-4689-afc4-29fa266f0fff": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9757720d-3422-4a92-b1a1-92537dee8e0e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Overflows", + "operationType": "differences", + "references": [ + "5f3ff0ef-71f8-4be7-aecf-7a85c72b10b2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-96cc1c20-95fd-419b-990c-8b6e12db9039", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-9eee4770-f2c7-4062-94e2-7e547783e799", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-dbf21713-bc46-4f85-9831-4afe07a3895c", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "7ea2afb9-afe6-44d6-a531-b07156d33f6c" + ], + "layerId": "96cc1c20-95fd-419b-990c-8b6e12db9039", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "5a51dbd0-200b-4609-b974-f7b83ad6e55a", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "7ea2afb9-afe6-44d6-a531-b07156d33f6c" + } + ] + }, + { + "accessors": [ + "34e6541a-1020-4680-989e-89420abff951" + ], + "layerId": "9eee4770-f2c7-4062-94e2-7e547783e799", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "ce864954-322e-4713-a083-1f106ed1e6aa", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(252,220,0,1)", + "forAccessor": "34e6541a-1020-4680-989e-89420abff951" + } + ] + }, + { + "accessors": [ + "9757720d-3422-4a92-b1a1-92537dee8e0e" + ], + "layerId": "dbf21713-bc46-4f85-9831-4afe07a3895c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "90eeaa7e-0db8-4689-afc4-29fa266f0fff", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(254,146,0,1)", + "forAccessor": "9757720d-3422-4a92-b1a1-92537dee8e0e" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 15, - "i": "3cd58868-0d03-4715-9ecc-9fba3cde47c1", + "i": "277c8209-3c5f-41f5-95f4-de0782917fba", "w": 15, "x": 0, "y": 38 }, - "panelIndex": "3cd58868-0d03-4715-9ecc-9fba3cde47c1", - "panelRefName": "panel_3cd58868-0d03-4715-9ecc-9fba3cde47c1", - "title": "Network Traffic", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "277c8209-3c5f-41f5-95f4-de0782917fba", + "title": "Open Tables Cache", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "04540318-d248-4927-b529-bc64fe7a8233": { + "columnOrder": [ + "b659f713-8c10-4a9f-987b-077861011d47", + "ae069673-b1ae-4708-8220-9827c832de40" + ], + "columns": { + "ae069673-b1ae-4708-8220-9827c832de40": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Avg Threads Running", + "operationType": "average", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.threads.running" + }, + "b659f713-8c10-4a9f-987b-077861011d47": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "3ca00093-1eea-4edf-b418-cde9f406d009": { + "columnOrder": [ + "4f19d63e-4ea7-4c1a-be79-c8e4f08f15ec", + "a2185e3c-7ef9-4e47-a47f-3dd8a0726ed2" + ], + "columns": { + "4f19d63e-4ea7-4c1a-be79-c8e4f08f15ec": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "a2185e3c-7ef9-4e47-a47f-3dd8a0726ed2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Peak Threads Running", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.threads.running" + } + }, + "incompleteColumns": {} + }, + "a13b343b-0070-400f-923f-5677a6e8a814": { + "columnOrder": [ + "fb9da3ec-96b2-42c4-ab63-fa4dd45d3059", + "918f27d7-52ec-4687-8dbc-9cd0483e8f47" + ], + "columns": { + "918f27d7-52ec-4687-8dbc-9cd0483e8f47": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Peak Threads Connected", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "mysql.status.threads.connected" + }, + "fb9da3ec-96b2-42c4-ab63-fa4dd45d3059": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-04540318-d248-4927-b529-bc64fe7a8233", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-3ca00093-1eea-4edf-b418-cde9f406d009", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-a13b343b-0070-400f-923f-5677a6e8a814", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ae069673-b1ae-4708-8220-9827c832de40" + ], + "layerId": "04540318-d248-4927-b529-bc64fe7a8233", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "b659f713-8c10-4a9f-987b-077861011d47", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(226,115,0,1)", + "forAccessor": "ae069673-b1ae-4708-8220-9827c832de40" + } + ] + }, + { + "accessors": [ + "a2185e3c-7ef9-4e47-a47f-3dd8a0726ed2" + ], + "layerId": "3ca00093-1eea-4edf-b418-cde9f406d009", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "4f19d63e-4ea7-4c1a-be79-c8e4f08f15ec", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(22,165,165,1)", + "forAccessor": "a2185e3c-7ef9-4e47-a47f-3dd8a0726ed2" + } + ] + }, + { + "accessors": [ + "918f27d7-52ec-4687-8dbc-9cd0483e8f47" + ], + "layerId": "a13b343b-0070-400f-923f-5677a6e8a814", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "line", + "xAccessor": "fb9da3ec-96b2-42c4-ab63-fa4dd45d3059", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(77,77,77,1)", + "forAccessor": "918f27d7-52ec-4687-8dbc-9cd0483e8f47" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 15, - "i": "277c8209-3c5f-41f5-95f4-de0782917fba", + "i": "ead16a55-a2d3-49ae-a09b-a0b03560e9a0", "w": 17, "x": 31, "y": 38 }, - "panelIndex": "277c8209-3c5f-41f5-95f4-de0782917fba", - "panelRefName": "panel_277c8209-3c5f-41f5-95f4-de0782917fba", - "title": "Open Tables Cache", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "ead16a55-a2d3-49ae-a09b-a0b03560e9a0", + "title": "Thread Activity", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "08ff42d2-69ea-4659-93ab-7ba66ac70091": { + "columnOrder": [ + "6749c35f-c824-4d52-9f73-36df149779e6", + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX0", + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX1", + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX2", + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX3", + "03b96ea7-fee9-4be0-88b2-822aa57d5aaa" + ], + "columns": { + "03b96ea7-fee9-4be0-88b2-822aa57d5aaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sent bytes", + "operationType": "formula", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + }, + "formula": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.sent)), unit='s'), 0)", + "isFormulaBroken": false + }, + "references": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX3" + ], + "scale": "ratio" + }, + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sent bytes", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.bytes.sent" + }, + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sent bytes", + "operationType": "differences", + "references": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX0" + ], + "scale": "ratio" + }, + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sent bytes", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX1" + ], + "scale": "ratio" + }, + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sent bytes", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX2", + 0 + ], + "location": { + "max": 83, + "min": 0 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.sent)), unit='s'), 0)", + "type": "function" + } + }, + "references": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaaX2" + ], + "scale": "ratio" + }, + "6749c35f-c824-4d52-9f73-36df149779e6": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "f78e7c21-b03f-4e94-98c8-aca774e1ce46": { + "columnOrder": [ + "d3f704ee-7d8a-408e-95bd-cb132e1d9e51", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X0", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X1", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X2", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X3", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X4", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X5", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X6", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X7", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X8", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X9" + ], + "columns": { + "975af8e1-9cc5-45d1-903f-32a94f5a07e0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Received bytes", + "operationType": "formula", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 1 + } + }, + "formula": "ifelse(gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0),ifelse(gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0),pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0) * -1,0),0)", + "isFormulaBroken": false + }, + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X9" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.bytes.received" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "differences", + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X0" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X1" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.bytes.received" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "differences", + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X3" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X4" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "mysql.status.bytes.received" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "differences", + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X6" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "normalize_by_unit", + "params": { + "unit": "s" + }, + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X7" + ], + "scale": "ratio" + }, + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Received bytes", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + { + "args": [ + { + "args": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X2", + 0 + ], + "location": { + "max": 97, + "min": 10 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0)", + "type": "function" + }, + 0 + ], + "location": { + "max": 100, + "min": 7 + }, + "name": "gt", + "text": "gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0)", + "type": "function" + }, + { + "args": [ + { + "args": [ + { + "args": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X5", + 0 + ], + "location": { + "max": 198, + "min": 111 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0)", + "type": "function" + }, + 0 + ], + "location": { + "max": 201, + "min": 108 + }, + "name": "gt", + "text": "gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0)", + "type": "function" + }, + { + "args": [ + { + "args": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X8", + 0 + ], + "location": { + "max": 290, + "min": 202 + }, + "name": "pick_max", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0) ", + "type": "function" + }, + -1 + ], + "location": { + "max": 294, + "min": 202 + }, + "name": "multiply", + "text": "pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0) * -1", + "type": "function" + }, + 0 + ], + "location": { + "max": 297, + "min": 101 + }, + "name": "ifelse", + "text": "ifelse(gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0),pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0) * -1,0)", + "type": "function" + }, + 0 + ], + "location": { + "max": 300, + "min": 0 + }, + "name": "ifelse", + "text": "ifelse(gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0),ifelse(gt(pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0),0),pick_max(normalize_by_unit(differences(max(mysql.status.bytes.received)), unit='s'), 0) * -1,0),0)", + "type": "function" + } + }, + "references": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X2", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X5", + "975af8e1-9cc5-45d1-903f-32a94f5a07e0X8" + ], + "scale": "ratio" + }, + "d3f704ee-7d8a-408e-95bd-cb132e1d9e51": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-08ff42d2-69ea-4659-93ab-7ba66ac70091", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-f78e7c21-b03f-4e94-98c8-aca774e1ce46", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "975af8e1-9cc5-45d1-903f-32a94f5a07e0" + ], + "layerId": "f78e7c21-b03f-4e94-98c8-aca774e1ce46", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "d3f704ee-7d8a-408e-95bd-cb132e1d9e51", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(0,98,177,1)", + "forAccessor": "975af8e1-9cc5-45d1-903f-32a94f5a07e0" + } + ] + }, + { + "accessors": [ + "03b96ea7-fee9-4be0-88b2-822aa57d5aaa" + ], + "layerId": "08ff42d2-69ea-4659-93ab-7ba66ac70091", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "6749c35f-c824-4d52-9f73-36df149779e6", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "03b96ea7-fee9-4be0-88b2-822aa57d5aaa" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "bottom", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 13, - "i": "9487b742-3e7f-4d57-af32-014ad360235c", - "w": 13, + "i": "3cd58868-0d03-4715-9ecc-9fba3cde47c1", + "w": 23, "x": 0, "y": 53 }, - "panelIndex": "9487b742-3e7f-4d57-af32-014ad360235c", - "panelRefName": "panel_9487b742-3e7f-4d57-af32-014ad360235c", - "title": "Connection Errors", - "type": "visualization", - "version": "7.7.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 13, - "i": "00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", - "w": 20, - "x": 13, - "y": 53 - }, - "panelIndex": "00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", - "panelRefName": "panel_00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", - "title": "Commands Operations", - "type": "visualization", - "version": "7.7.0" + "panelIndex": "3cd58868-0d03-4715-9ecc-9fba3cde47c1", + "title": "Network Traffic", + "type": "lens", + "version": "8.7.0" }, { "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_metrics-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "metrics-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "metrics-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "80eabeed-4131-40ab-8620-eec7d60725cc": { + "columnOrder": [ + "01223d21-bae9-4faf-968e-289ffe2d8f4d", + "f92f6374-15e3-4ac4-88c3-b8d64061aee5", + "44cf418c-9073-49be-abee-7a12defad88e" + ], + "columns": { + "01223d21-bae9-4faf-968e-289ffe2d8f4d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "44cf418c-9073-49be-abee-7a12defad88e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Misses", + "operationType": "differences", + "references": [ + "f92f6374-15e3-4ac4-88c3-b8d64061aee5" + ], + "scale": "ratio" + }, + "f92f6374-15e3-4ac4-88c3-b8d64061aee5": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.ssl.misses" + } + }, + "incompleteColumns": {} + }, + "cdf7992c-a16f-4871-8982-92e013803f3a": { + "columnOrder": [ + "fa228672-5a22-452d-a80e-d5b516cdec43", + "3537f269-a189-4d11-8453-00feaaf54510", + "1aa84545-a7f2-4b07-a224-801315547aa2" + ], + "columns": { + "1aa84545-a7f2-4b07-a224-801315547aa2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Size", + "operationType": "differences", + "references": [ + "3537f269-a189-4d11-8453-00feaaf54510" + ], + "scale": "ratio" + }, + "3537f269-a189-4d11-8453-00feaaf54510": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.ssl.size" + }, + "fa228672-5a22-452d-a80e-d5b516cdec43": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + }, + "fa0b502f-4c85-48a2-8a1d-8f54b3612414": { + "columnOrder": [ + "5fd2e1b4-403b-4778-9783-3fb68f9fd6bc", + "f70a4a80-84c1-4b27-96e0-43190ab83ce7", + "d60e069a-7a6a-4604-9999-3ffe6696c177" + ], + "columns": { + "5fd2e1b4-403b-4778-9783-3fb68f9fd6bc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d60e069a-7a6a-4604-9999-3ffe6696c177": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hits", + "operationType": "differences", + "references": [ + "f70a4a80-84c1-4b27-96e0-43190ab83ce7" + ], + "scale": "ratio" + }, + "f70a4a80-84c1-4b27-96e0-43190ab83ce7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "", + "operationType": "max", + "params": { + "emptyAsNull": true, + "format": { + "id": "number" + } + }, + "scale": "ratio", + "sourceField": "mysql.status.cache.ssl.hits" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-80eabeed-4131-40ab-8620-eec7d60725cc", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-cdf7992c-a16f-4871-8982-92e013803f3a", + "type": "index-pattern" + }, + { + "id": "tsvb_ad_hoc_metrics-*/@timestamp", + "name": "indexpattern-datasource-layer-fa0b502f-4c85-48a2-8a1d-8f54b3612414", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d60e069a-7a6a-4604-9999-3ffe6696c177" + ], + "layerId": "fa0b502f-4c85-48a2-8a1d-8f54b3612414", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "5fd2e1b4-403b-4778-9783-3fb68f9fd6bc", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "d60e069a-7a6a-4604-9999-3ffe6696c177" + } + ] + }, + { + "accessors": [ + "44cf418c-9073-49be-abee-7a12defad88e" + ], + "layerId": "80eabeed-4131-40ab-8620-eec7d60725cc", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "01223d21-bae9-4faf-968e-289ffe2d8f4d", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(253,161,255,1)", + "forAccessor": "44cf418c-9073-49be-abee-7a12defad88e" + } + ] + }, + { + "accessors": [ + "1aa84545-a7f2-4b07-a224-801315547aa2" + ], + "layerId": "cdf7992c-a16f-4871-8982-92e013803f3a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "fa228672-5a22-452d-a80e-d5b516cdec43", + "yConfig": [ + { + "axisMode": "left", + "color": "rgba(104,204,202,1)", + "forAccessor": "1aa84545-a7f2-4b07-a224-801315547aa2" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { "h": 13, "i": "cd4deb30-c0dd-4f23-8868-ecffd73b2406", - "w": 15, - "x": 33, + "w": 25, + "x": 23, "y": 53 }, "panelIndex": "cd4deb30-c0dd-4f23-8868-ecffd73b2406", - "panelRefName": "panel_cd4deb30-c0dd-4f23-8868-ecffd73b2406", "title": "SSL Cache", - "type": "visualization", - "version": "7.7.0" + "type": "lens", + "version": "8.7.0" } ], "timeRestore": false, "title": "[Metrics MySQL] Database Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-19T09:19:19.188Z", "id": "mysql-57b3fb50-6309-11ea-a83e-25b8612d00cc", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-aaa326b0-f1f5-11e7-85ab-594b1652e0d1", - "name": "14:panel_14", - "type": "visualization" - }, - { - "id": "mysql-4fa69a10-630b-11ea-a83e-25b8612d00cc", - "name": "050b110b-0b4d-404a-86c0-fa97f7eed2a0:panel_050b110b-0b4d-404a-86c0-fa97f7eed2a0", - "type": "visualization" - }, - { - "id": "mysql-7ea77d30-630a-11ea-a83e-25b8612d00cc", - "name": "988a61d7-ac3e-481e-a6ae-aa75aaa32a3a:panel_988a61d7-ac3e-481e-a6ae-aa75aaa32a3a", - "type": "visualization" - }, - { - "id": "mysql-779ee920-6309-11ea-a83e-25b8612d00cc", - "name": "a1f8fa38-a62f-4e05-adde-e995dae9ad83:panel_a1f8fa38-a62f-4e05-adde-e995dae9ad83", - "type": "visualization" - }, - { - "id": "mysql-fc6b5a40-630d-11ea-a83e-25b8612d00cc", - "name": "d126fb61-605f-43af-b5d5-3fa3c128f726:panel_d126fb61-605f-43af-b5d5-3fa3c128f726", - "type": "visualization" - }, - { - "id": "mysql-493e8460-630d-11ea-a83e-25b8612d00cc", - "name": "59586d96-3abd-48a3-a258-cfd620826ec2:panel_59586d96-3abd-48a3-a258-cfd620826ec2", - "type": "visualization" - }, - { - "id": "mysql-bf60bc10-639b-11ea-a83e-25b8612d00cc", - "name": "dd0cf202-fe22-4daf-8f25-09c64d412bf3:panel_dd0cf202-fe22-4daf-8f25-09c64d412bf3", - "type": "visualization" - }, - { - "id": "mysql-822df290-630f-11ea-a83e-25b8612d00cc", - "name": "ead16a55-a2d3-49ae-a09b-a0b03560e9a0:panel_ead16a55-a2d3-49ae-a09b-a0b03560e9a0", - "type": "visualization" - }, - { - "id": "mysql-98c7bca0-63a2-11ea-a83e-25b8612d00cc", - "name": "24fc2926-610d-4910-8f3e-eb63ca69788c:panel_24fc2926-610d-4910-8f3e-eb63ca69788c", - "type": "visualization" - }, - { - "id": "mysql-96d46630-63a4-11ea-a83e-25b8612d00cc", - "name": "33c10c95-be67-492e-afb5-863f375cffc2:panel_33c10c95-be67-492e-afb5-863f375cffc2", - "type": "visualization" - }, - { - "id": "mysql-a1e00160-63a4-11ea-a83e-25b8612d00cc", - "name": "d35d7c5e-8832-40e2-8c77-953ad320c853:panel_d35d7c5e-8832-40e2-8c77-953ad320c853", - "type": "visualization" - }, - { - "id": "mysql-c8661020-6310-11ea-a83e-25b8612d00cc", - "name": "3cd58868-0d03-4715-9ecc-9fba3cde47c1:panel_3cd58868-0d03-4715-9ecc-9fba3cde47c1", - "type": "visualization" - }, - { - "id": "mysql-cd72e030-c6a6-11ea-a106-5be590f42b74", - "name": "277c8209-3c5f-41f5-95f4-de0782917fba:panel_277c8209-3c5f-41f5-95f4-de0782917fba", - "type": "visualization" - }, - { - "id": "mysql-0774bbb0-c69c-11ea-a106-5be590f42b74", - "name": "9487b742-3e7f-4d57-af32-014ad360235c:panel_9487b742-3e7f-4d57-af32-014ad360235c", - "type": "visualization" - }, - { - "id": "mysql-3e5c4490-c6a1-11ea-a106-5be590f42b74", - "name": "00cd9f15-01bd-43f3-a8c5-43d6ff17dad3:panel_00cd9f15-01bd-43f3-a8c5-43d6ff17dad3", - "type": "visualization" - }, - { - "id": "mysql-8b276c80-c6ad-11ea-a106-5be590f42b74", - "name": "cd4deb30-c0dd-4f23-8868-ecffd73b2406:panel_cd4deb30-c0dd-4f23-8868-ecffd73b2406", - "type": "visualization" - } - ], + "references": [], "type": "dashboard" } \ No newline at end of file diff --git a/packages/mysql/kibana/dashboard/mysql-Logs-MySQL-Dashboard.json b/packages/mysql/kibana/dashboard/mysql-Logs-MySQL-Dashboard.json index c0636e82d71..46665fa68d6 100644 --- a/packages/mysql/kibana/dashboard/mysql-Logs-MySQL-Dashboard.json +++ b/packages/mysql/kibana/dashboard/mysql-Logs-MySQL-Dashboard.json @@ -1,48 +1,416 @@ { "attributes": { "description": "Overview dashboard for the Logs MySQL integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", "query": "" - }, - "version": true + } } }, "optionsJSON": { - "darkTheme": false + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-10c1edbd-866e-4186-83ac-465865085079", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "18d40a87-4926-44bc-b73b-e1e3b82b16c7", + "type": "index-pattern" } - } - } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "10c1edbd-866e-4186-83ac-465865085079": { + "columnOrder": [ + "62c48aeb-bfa7-4591-8917-b0106a31808d", + "39bfa269-307a-460e-8a07-0cfbaf089330", + "8e15aeab-dede-4f18-a5e9-30a128cab6e3", + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X0", + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X1" + ], + "columns": { + "39bfa269-307a-460e-8a07-0cfbaf089330": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "62c48aeb-bfa7-4591-8917-b0106a31808d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Query", + "operationType": "terms", + "params": { + "accuracyMode": false, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Maximum of event.duration", + "operationType": "max", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.duration" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "mysql.slowlog.query" + }, + "8e15aeab-dede-4f18-a5e9-30a128cab6e3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Query time (ms)", + "operationType": "formula", + "params": { + "format": { + "id": "number", + "params": { + "decimals": 2 + } + }, + "formula": "max(event.duration)/1000000", + "isFormulaBroken": false + }, + "references": [ + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X1" + ], + "scale": "ratio" + }, + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Query time", + "operationType": "max", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "event.duration" + }, + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Query time", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X0", + 1000000 + ], + "location": { + "max": 27, + "min": 0 + }, + "name": "divide", + "text": "max(event.duration)/1000000", + "type": "function" + } + }, + "references": [ + "8e15aeab-dede-4f18-a5e9-30a128cab6e3X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "18d40a87-4926-44bc-b73b-e1e3b82b16c7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mysql.slowlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mysql.slowlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "8e15aeab-dede-4f18-a5e9-30a128cab6e3" + }, + { + "alignment": "left", + "columnId": "62c48aeb-bfa7-4591-8917-b0106a31808d" + }, + { + "alignment": "left", + "columnId": "39bfa269-307a-460e-8a07-0cfbaf089330" + } + ], + "headerRowHeight": "single", + "layerId": "10c1edbd-866e-4186-83ac-465865085079", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} }, "gridData": { - "h": 16, + "h": 20, "i": "1", "w": 24, "x": 0, "y": 28 }, "panelIndex": "1", - "panelRefName": "panel_1", - "type": "visualization", - "version": "7.3.0" + "title": "Top slowest queries [Logs MySQL]", + "type": "lens", + "version": "8.8.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-08427b5d-ebe0-413b-99aa-adacd26642e0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db62e1d5-40a6-46f5-95b5-21ced452e4f3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "08427b5d-ebe0-413b-99aa-adacd26642e0": { + "columnOrder": [ + "439c739d-435d-4d0a-b18c-76135760aa64", + "942ea915-ee84-4750-b694-0f5dd3f1b100" + ], + "columns": { + "439c739d-435d-4d0a-b18c-76135760aa64": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "942ea915-ee84-4750-b694-0f5dd3f1b100": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Slow queries", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "db62e1d5-40a6-46f5-95b5-21ced452e4f3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mysql.slowlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mysql.slowlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "942ea915-ee84-4750-b694-0f5dd3f1b100" + ], + "isHistogram": true, + "layerId": "08427b5d-ebe0-413b-99aa-adacd26642e0", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "439c739d-435d-4d0a-b18c-76135760aa64", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "color": "#EF843C", + "forAccessor": "942ea915-ee84-4750-b694-0f5dd3f1b100" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "xTitle": "@timestamp per 30 seconds", + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Slow queries" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -53,12 +421,172 @@ "y": 0 }, "panelIndex": "2", - "panelRefName": "panel_2", - "type": "visualization", - "version": "7.3.0" + "title": "Slow queries over time [Logs MySQL]", + "type": "lens", + "version": "8.8.0" }, { "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-636ea26e-2240-4fd9-9c4f-30d2a6680854", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "583a31e6-2399-4d1e-b2a6-dc41ec29c736", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "636ea26e-2240-4fd9-9c4f-30d2a6680854": { + "columnOrder": [ + "1887890a-b607-40df-ae96-65010dfe1549", + "56288910-c42b-482a-9cfd-0ef16fe36e54" + ], + "columns": { + "1887890a-b607-40df-ae96-65010dfe1549": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "56288910-c42b-482a-9cfd-0ef16fe36e54": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Error logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "583a31e6-2399-4d1e-b2a6-dc41ec29c736", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mysql.error" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mysql.error" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "56288910-c42b-482a-9cfd-0ef16fe36e54" + ], + "isHistogram": true, + "layerId": "636ea26e-2240-4fd9-9c4f-30d2a6680854", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "1887890a-b607-40df-ae96-65010dfe1549", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "color": "#1F78C1", + "forAccessor": "56288910-c42b-482a-9cfd-0ef16fe36e54" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "xTitle": "@timestamp per 30 seconds", + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Error logs" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, "enhancements": {} }, "gridData": { @@ -69,9 +597,9 @@ "y": 0 }, "panelIndex": "3", - "panelRefName": "panel_3", - "type": "visualization", - "version": "7.3.0" + "title": "Error logs over time [Logs MySQL]", + "type": "lens", + "version": "8.8.0" }, { "embeddableConfig": { @@ -95,10 +623,146 @@ "panelIndex": "4", "panelRefName": "panel_4", "type": "search", - "version": "7.3.0" + "version": "8.8.0" }, { "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fa3445d7-f3eb-4b56-bdf1-be99771139f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "611fea97-3472-4dde-9487-c4b164238815", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fa3445d7-f3eb-4b56-bdf1-be99771139f8": { + "columnOrder": [ + "486f1788-075a-4a17-b6c9-c389b79e51a2", + "c354a143-0f64-4b37-9515-bf7e3fde8896" + ], + "columns": { + "486f1788-075a-4a17-b6c9-c389b79e51a2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "log.level: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c354a143-0f64-4b37-9515-bf7e3fde8896", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + }, + "c354a143-0f64-4b37-9515-bf7e3fde8896": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "611fea97-3472-4dde-9487-c4b164238815", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mysql.error" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mysql.error" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "fa3445d7-f3eb-4b56-bdf1-be99771139f8", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "bottom", + "legendSize": "auto", + "metrics": [ + "c354a143-0f64-4b37-9515-bf7e3fde8896" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "486f1788-075a-4a17-b6c9-c389b79e51a2" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, "enhancements": {} }, "gridData": { @@ -109,12 +773,148 @@ "y": 12 }, "panelIndex": "5", - "panelRefName": "panel_5", - "type": "visualization", - "version": "7.3.0" + "title": "Error logs levels breakdown [Logs MySQL]", + "type": "lens", + "version": "8.8.0" }, { "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3e618193-e77a-4e60-82e9-f97556db1c33", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9b1083c0-3720-4dc3-9bfc-74717c28d454", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3e618193-e77a-4e60-82e9-f97556db1c33": { + "columnOrder": [ + "3c069702-bf8b-4b75-be3a-cbadd56cb60f", + "7c2a5211-247e-49df-8450-cff3afe395a9" + ], + "columns": { + "3c069702-bf8b-4b75-be3a-cbadd56cb60f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "mysql.slowlog.query: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7c2a5211-247e-49df-8450-cff3afe395a9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "mysql.slowlog.query" + }, + "7c2a5211-247e-49df-8450-cff3afe395a9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9b1083c0-3720-4dc3-9bfc-74717c28d454", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "mysql.slowlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "mysql.slowlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "3e618193-e77a-4e60-82e9-f97556db1c33", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "bottom", + "legendSize": "auto", + "metrics": [ + "7c2a5211-247e-49df-8450-cff3afe395a9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "3c069702-bf8b-4b75-be3a-cbadd56cb60f" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, "enhancements": {} }, "gridData": { @@ -125,38 +925,51 @@ "y": 12 }, "panelIndex": "6", - "panelRefName": "panel_6", - "type": "visualization", - "version": "7.3.0" + "title": "Slow logs breakdown [Logs MySQL]", + "type": "lens", + "version": "8.8.0" } ], "timeRestore": false, "title": "[Logs MySQL] Overview", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:39:19.726Z", "id": "mysql-Logs-MySQL-Dashboard", "migrationVersion": { - "dashboard": "7.14.0" + "dashboard": "8.7.0" }, - "namespaces": [ - "default" - ], "references": [ { - "id": "mysql-slowest-queries", - "name": "1:panel_1", - "type": "visualization" + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-10c1edbd-866e-4186-83ac-465865085079", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1:18d40a87-4926-44bc-b73b-e1e3b82b16c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-08427b5d-ebe0-413b-99aa-adacd26642e0", + "type": "index-pattern" }, { - "id": "mysql-Slow-queries-over-time", - "name": "2:panel_2", - "type": "visualization" + "id": "logs-*", + "name": "2:db62e1d5-40a6-46f5-95b5-21ced452e4f3", + "type": "index-pattern" }, { - "id": "mysql-error-logs", - "name": "3:panel_3", - "type": "visualization" + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-636ea26e-2240-4fd9-9c4f-30d2a6680854", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3:583a31e6-2399-4d1e-b2a6-dc41ec29c736", + "type": "index-pattern" }, { "id": "mysql-Logs-MySQL-error-log", @@ -164,14 +977,24 @@ "type": "search" }, { - "id": "mysql-Error-logs-levels", - "name": "5:panel_5", - "type": "visualization" + "id": "logs-*", + "name": "5:indexpattern-datasource-layer-fa3445d7-f3eb-4b56-bdf1-be99771139f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5:611fea97-3472-4dde-9487-c4b164238815", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6:indexpattern-datasource-layer-3e618193-e77a-4e60-82e9-f97556db1c33", + "type": "index-pattern" }, { - "id": "mysql-Slow-logs-by-count", - "name": "6:panel_6", - "type": "visualization" + "id": "logs-*", + "name": "6:9b1083c0-3720-4dc3-9bfc-74717c28d454", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/mysql/kibana/search/mysql-Logs-MySQL-Slow-log.json b/packages/mysql/kibana/search/mysql-Logs-MySQL-Slow-log.json deleted file mode 100644 index 398979b0fa4..00000000000 --- a/packages/mysql/kibana/search/mysql-Logs-MySQL-Slow-log.json +++ /dev/null @@ -1,83 +0,0 @@ -{ - "attributes": { - "columns": [], - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "mysql.slowlog" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "mysql.slowlog" - } - } - } - ], - "highlight": { - "fields": { - "*": {} - }, - "fragment_size": 2147483647, - "post_tags": [ - "@/kibana-highlighted-field@" - ], - "pre_tags": [ - "@kibana-highlighted-field@" - ], - "require_field_match": false - }, - "highlightAll": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "sort": [ - [ - "@timestamp", - "desc" - ] - ], - "title": "Slow logs [Logs MySQL]", - "version": 1 - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-Logs-MySQL-Slow-log", - "migrationVersion": { - "search": "7.9.3" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "search" -} \ No newline at end of file diff --git a/packages/mysql/kibana/search/mysql-Logs-MySQL-error-log.json b/packages/mysql/kibana/search/mysql-Logs-MySQL-error-log.json index d6867cbead6..ea07af9746e 100644 --- a/packages/mysql/kibana/search/mysql-Logs-MySQL-error-log.json +++ b/packages/mysql/kibana/search/mysql-Logs-MySQL-error-log.json @@ -62,14 +62,12 @@ "title": "Error logs [Logs MySQL]", "version": 1 }, - "coreMigrationVersion": "7.14.0", + "coreMigrationVersion": "8.7.0", + "created_at": "2023-07-18T08:39:19.726Z", "id": "mysql-Logs-MySQL-error-log", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/mysql/kibana/visualization/mysql-0774bbb0-c69c-11ea-a106-5be590f42b74.json b/packages/mysql/kibana/visualization/mysql-0774bbb0-c69c-11ea-a106-5be590f42b74.json deleted file mode 100644 index af4b87dce8a..00000000000 --- a/packages/mysql/kibana/visualization/mysql-0774bbb0-c69c-11ea-a106-5be590f42b74.json +++ /dev/null @@ -1,195 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Connection Errors [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Max", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.connection.errors.max", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "percentiles": [ - { - "id": "968f0500-c69a-11ea-880f-352bebf10188", - "mode": "line", - "shade": 0.2, - "value": 50 - } - ], - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "a088e210-c69a-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "a61998a0-c69a-11ea-880f-352bebf10188", - "label": "Accept", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.connection.errors.accept", - "id": "a61998a1-c69a-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "a61998a1-c69a-11ea-880f-352bebf10188", - "id": "a8f8c3c0-c69a-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "b6a26260-c69a-11ea-880f-352bebf10188", - "label": "Internal", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.connection.errors.internal", - "id": "b6a26261-c69a-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "b6a26261-c69a-11ea-880f-352bebf10188", - "id": "c09d02c0-c69a-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": 0.5, - "formatter": "number", - "id": "c713d390-c69a-11ea-880f-352bebf10188", - "label": "Select", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.connection.errors.select", - "id": "c713d391-c69a-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "c713d391-c69a-11ea-880f-352bebf10188", - "id": "4ace8360-c69b-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(253,161,255,1)", - "fill": 0.5, - "formatter": "number", - "id": "50c798b0-c69b-11ea-880f-352bebf10188", - "label": "Peer Address", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.connection.errors.peer_address", - "id": "50c798b1-c69b-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "50c798b1-c69b-11ea-880f-352bebf10188", - "id": "78d49650-c69b-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Connection Errors [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-0774bbb0-c69c-11ea-a106-5be590f42b74", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-3e5c4490-c6a1-11ea-a106-5be590f42b74.json b/packages/mysql/kibana/visualization/mysql-3e5c4490-c6a1-11ea-a106-5be590f42b74.json deleted file mode 100644 index 55afca310be..00000000000 --- a/packages/mysql/kibana/visualization/mysql-3e5c4490-c6a1-11ea-a106-5be590f42b74.json +++ /dev/null @@ -1,158 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Commands Operations [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Select", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.select", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "e76f75d0-c6a0-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(219,223,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "ed3a0110-c6a0-11ea-880f-352bebf10188", - "label": "Update", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.update", - "id": "ed3a0111-c6a0-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "ed3a0111-c6a0-11ea-880f-352bebf10188", - "id": "f961e1b0-c6a0-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(244,78,59,1)", - "fill": 0.5, - "formatter": "number", - "id": "00b3f750-c6a1-11ea-880f-352bebf10188", - "label": "Delete", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.delete", - "id": "00b3f751-c6a1-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "00b3f751-c6a1-11ea-880f-352bebf10188", - "id": "09f46f70-c6a1-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "0f38dac0-c6a1-11ea-880f-352bebf10188", - "label": "Insert", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.insert", - "id": "0f38dac1-c6a1-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "0f38dac1-c6a1-11ea-880f-352bebf10188", - "id": "1d1cc340-c6a1-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Commands Operations [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-3e5c4490-c6a1-11ea-a106-5be590f42b74", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-493e8460-630d-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-493e8460-630d-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 5f9f7302f68..00000000000 --- a/packages/mysql/kibana/visualization/mysql-493e8460-630d-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,124 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Connections [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(198,135,31,1)", - "fill": "0.2", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Connection rate", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.connections", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "caee3e70-630c-11ea-99e6-b5eed31db613", - "type": "derivative", - "unit": "1s" - }, - { - "field": "caee3e70-630c-11ea-99e6-b5eed31db613", - "id": "d4eb4fd0-630c-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(115,216,255,0.89)", - "fill": "0.3", - "formatter": "number", - "id": "fe9af660-630b-11ea-99e6-b5eed31db613", - "label": "Connected", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.threads.connected", - "id": "fe9af661-630b-11ea-99e6-b5eed31db613", - "type": "max" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "number", - "id": "e3d46bf0-630f-11ea-99e6-b5eed31db613", - "label": "Max Used Connections", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.max_used_connections", - "id": "e3d46bf1-630f-11ea-99e6-b5eed31db613", - "type": "max" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Connections [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-493e8460-630d-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-4fa69a10-630b-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-4fa69a10-630b-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 8c7d6c6dca0..00000000000 --- a/packages/mysql/kibana/visualization/mysql-4fa69a10-630b-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,83 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Question rates [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "d61928d0-6309-11ea-99e6-b5eed31db613" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "right", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": "0.3", - "formatter": "'0.0a'", - "id": "3c2a2a40-f1f4-11e7-a752-236fe3270d99", - "label": "SELECT", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.questions", - "id": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "id": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "id": "82f59710-6309-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 0, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Question rates [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-4fa69a10-630b-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-779ee920-6309-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-779ee920-6309-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 5c88005efa5..00000000000 --- a/packages/mysql/kibana/visualization/mysql-779ee920-6309-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,153 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Insert, Update, Delete rates [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "d61928d0-6309-11ea-99e6-b5eed31db613" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": "0.3", - "formatter": "number", - "id": "3c2a2a40-f1f4-11e7-a752-236fe3270d99", - "label": "INSERT", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.insert", - "id": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "id": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "id": "82f59710-6309-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": "0.3", - "formatter": "number", - "id": "485ce050-f1f4-11e7-a752-236fe3270d99", - "label": "UPDATE", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.update", - "id": "485ce051-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "485ce051-f1f4-11e7-a752-236fe3270d99", - "id": "485ce052-f1f4-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "485ce052-f1f4-11e7-a752-236fe3270d99", - "id": "a4092660-6309-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(244,78,59,1)", - "fill": "0.3", - "formatter": "number", - "id": "543a4a70-f1f4-11e7-a752-236fe3270d99", - "label": "DELETE", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.delete", - "id": "543a4a71-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "543a4a71-f1f4-11e7-a752-236fe3270d99", - "id": "543a4a72-f1f4-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "543a4a72-f1f4-11e7-a752-236fe3270d99", - "id": "bae29b50-6309-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Insert, Update, Delete rates [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-779ee920-6309-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-7ea77d30-630a-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-7ea77d30-630a-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index a1cd38dee40..00000000000 --- a/packages/mysql/kibana/visualization/mysql-7ea77d30-630a-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,83 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "SELECT rates [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "d61928d0-6309-11ea-99e6-b5eed31db613" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "right", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,156,224,1)", - "fill": "0.3", - "formatter": "'0.0a'", - "id": "3c2a2a40-f1f4-11e7-a752-236fe3270d99", - "label": "SELECT", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.command.select", - "id": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "id": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "3c2a2a42-f1f4-11e7-a752-236fe3270d99", - "id": "82f59710-6309-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 0, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "SELECT rates [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-7ea77d30-630a-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-822df290-630f-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-822df290-630f-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 985d4ce6c03..00000000000 --- a/packages/mysql/kibana/visualization/mysql-822df290-630f-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,111 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Thread Activity [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(226,115,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Avg Threads Running", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.threads.running", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(22,165,165,1)", - "fill": "0", - "formatter": "number", - "id": "895f0820-630e-11ea-99e6-b5eed31db613", - "label": "Peak Threads Running", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.threads.running", - "id": "895f0821-630e-11ea-99e6-b5eed31db613", - "type": "max" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(77,77,77,1)", - "fill": "0", - "formatter": "number", - "id": "f8752460-630e-11ea-99e6-b5eed31db613", - "label": "Peak Threads Connected", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.threads.connected", - "id": "f8752461-630e-11ea-99e6-b5eed31db613", - "type": "max" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Thread Activity [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-822df290-630f-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-8b276c80-c6ad-11ea-a106-5be590f42b74.json b/packages/mysql/kibana/visualization/mysql-8b276c80-c6ad-11ea-a106-5be590f42b74.json deleted file mode 100644 index 048e0b0346e..00000000000 --- a/packages/mysql/kibana/visualization/mysql-8b276c80-c6ad-11ea-a106-5be590f42b74.json +++ /dev/null @@ -1,129 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "SSL Cache [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Hits", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.ssl.hits", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "1a353d40-c6ad-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(253,161,255,1)", - "fill": 0.5, - "formatter": "number", - "id": "2dd02900-c6ad-11ea-880f-352bebf10188", - "label": "Misses", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.ssl.misses", - "id": "2dd02901-c6ad-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "2dd02901-c6ad-11ea-880f-352bebf10188", - "id": "327cc120-c6ad-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(104,204,202,1)", - "fill": 0.5, - "formatter": "number", - "id": "3f459cb0-c6ad-11ea-880f-352bebf10188", - "label": "Size", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.ssl.size", - "id": "3f459cb1-c6ad-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "3f459cb1-c6ad-11ea-880f-352bebf10188", - "id": "426ccd50-c6ad-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "SSL Cache [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-8b276c80-c6ad-11ea-a106-5be590f42b74", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-96d46630-63a4-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-96d46630-63a4-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index e5f5e0477d6..00000000000 --- a/packages/mysql/kibana/visualization/mysql-96d46630-63a4-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,111 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Buffer Pool Utilization [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0f20fa60-63a3-11ea-90a2-c51229c5db5f" - } - ], - "bar_color_rules": [ - { - "id": "0e1ecca0-63a3-11ea-90a2-c51229c5db5f" - } - ], - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "07c08ce0-63a3-11ea-90a2-c51229c5db5f" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "515b9dd0-639f-11ea-96d8-1943b9bb65d9", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(226,115,0,1)", - "fill": "0.1", - "formatter": "percent", - "id": "256f1f40-63a3-11ea-90a2-c51229c5db5f", - "label": "Utilization", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.innodb.buffer_pool.pages.total", - "id": "256f1f41-63a3-11ea-90a2-c51229c5db5f", - "type": "max" - }, - { - "field": "mysql.status.innodb.buffer_pool.pages.free", - "id": "256f1f43-63a3-11ea-90a2-c51229c5db5f", - "type": "max" - }, - { - "id": "256f1f45-63a3-11ea-90a2-c51229c5db5f", - "script": "params.total != null \u0026\u0026 params.total \u003e 0 ? (params.total - params.free)/params.total : null", - "type": "calculation", - "variables": [ - { - "field": "256f1f41-63a3-11ea-90a2-c51229c5db5f", - "id": "256f1f42-63a3-11ea-90a2-c51229c5db5f", - "name": "total" - }, - { - "field": "256f1f43-63a3-11ea-90a2-c51229c5db5f", - "id": "256f1f44-63a3-11ea-90a2-c51229c5db5f", - "name": "free" - } - ] - } - ], - "point_size": "2", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Buffer Pool Utilization [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-96d46630-63a4-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-98c7bca0-63a2-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-98c7bca0-63a2-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index d03939f939e..00000000000 --- a/packages/mysql/kibana/visualization/mysql-98c7bca0-63a2-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,117 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Buffer Pool Pages [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "" - }, - "id": "515b9dd0-639f-11ea-96d8-1943b9bb65d9", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": "0", - "formatter": "'0.0a'", - "id": "37f2d600-63a0-11ea-90a2-c51229c5db5f", - "label": "Buffer Pool Pages Data", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.innodb.buffer_pool.pages.data", - "id": "37f2d601-63a0-11ea-90a2-c51229c5db5f", - "type": "avg" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(22,165,165,1)", - "fill": "0", - "formatter": "'0.0a'", - "id": "57ae9d80-63a0-11ea-90a2-c51229c5db5f", - "label": "Buffer Pool Pages Free", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.innodb.buffer_pool.pages.free", - "id": "57ae9d81-63a0-11ea-90a2-c51229c5db5f", - "type": "avg" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(102,102,102,1)", - "fill": "0", - "formatter": "'0.0a'", - "id": "c86cc470-63a0-11ea-90a2-c51229c5db5f", - "label": "Buffer Pool Pages Total", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.innodb.buffer_pool.pages.total", - "id": "c86ceb80-63a0-11ea-90a2-c51229c5db5f", - "type": "avg" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Buffer Pool Pages [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-98c7bca0-63a2-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-Error-logs-levels.json b/packages/mysql/kibana/visualization/mysql-Error-logs-levels.json deleted file mode 100644 index 2786b568276..00000000000 --- a/packages/mysql/kibana/visualization/mysql-Error-logs-levels.json +++ /dev/null @@ -1,76 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Error logs levels breakdown [Logs MySQL]", - "uiStateJSON": { - "vis": { - "colors": { - "ERROR": "#E24D42", - "Note": "#9AC48A", - "Warning": "#F9934E" - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "log.level", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": false, - "legendPosition": "bottom", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "shareYAxis": true, - "type": "pie" - }, - "title": "Error logs levels breakdown [Logs MySQL]", - "type": "pie" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-Error-logs-levels", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-Logs-MySQL-error-log", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-Slow-logs-by-count.json b/packages/mysql/kibana/visualization/mysql-Slow-logs-by-count.json deleted file mode 100644 index 86caf2d3df6..00000000000 --- a/packages/mysql/kibana/visualization/mysql-Slow-logs-by-count.json +++ /dev/null @@ -1,68 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Slow logs breakdown [Logs MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "mysql.slowlog.query", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": false, - "legendPosition": "bottom", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "shareYAxis": true, - "type": "pie" - }, - "title": "Slow logs breakdown [Logs MySQL]", - "type": "pie" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-Slow-logs-by-count", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-Logs-MySQL-Slow-log", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-Slow-queries-over-time.json b/packages/mysql/kibana/visualization/mysql-Slow-queries-over-time.json deleted file mode 100644 index 6236bb6ad20..00000000000 --- a/packages/mysql/kibana/visualization/mysql-Slow-queries-over-time.json +++ /dev/null @@ -1,146 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Slow queries over time [Logs MySQL]", - "uiStateJSON": { - "vis": { - "colors": { - "Slow queries": "#EF843C" - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Slow queries" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1 - }, - "schema": "segment", - "type": "date_histogram" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "@timestamp per 30 seconds" - }, - "type": "category" - } - ], - "defaultYExtents": false, - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "legendPosition": "right", - "mode": "stacked", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Slow queries" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "setYExtents": false, - "shareYAxis": true, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Slow queries" - }, - "type": "value" - } - ], - "yAxis": {} - }, - "title": "Slow queries over time [Logs MySQL]", - "type": "histogram" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-Slow-queries-over-time", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-Logs-MySQL-Slow-log", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-a1e00160-63a4-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-a1e00160-63a4-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index fc95744ba01..00000000000 --- a/packages/mysql/kibana/visualization/mysql-a1e00160-63a4-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,112 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Buffer Pool Efficiency [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_min": 0, - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0f20fa60-63a3-11ea-90a2-c51229c5db5f" - } - ], - "bar_color_rules": [ - { - "id": "0e1ecca0-63a3-11ea-90a2-c51229c5db5f" - } - ], - "filter": { - "language": "kuery", - "query": "" - }, - "gauge_color_rules": [ - { - "id": "07c08ce0-63a3-11ea-90a2-c51229c5db5f" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "id": "515b9dd0-639f-11ea-96d8-1943b9bb65d9", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(87,177,211,1)", - "fill": "0.1", - "formatter": "number", - "hidden": false, - "id": "a397d570-63a2-11ea-90a2-c51229c5db5f", - "label": "Effeciency (lower is better)", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.innodb.buffer_pool.pool.reads", - "id": "a397d571-63a2-11ea-90a2-c51229c5db5f", - "type": "max" - }, - { - "field": "mysql.status.innodb.buffer_pool.read.requests", - "id": "ad177970-63a2-11ea-90a2-c51229c5db5f", - "type": "max" - }, - { - "id": "af58ddf0-63a2-11ea-90a2-c51229c5db5f", - "script": "params.pool_read_requests != null \u0026\u0026 params.pool_read_requests \u003e 0 ? (params.pool_reads/params.pool_read_requests) * 100: null", - "type": "calculation", - "variables": [ - { - "field": "a397d571-63a2-11ea-90a2-c51229c5db5f", - "id": "b1b6cb20-63a2-11ea-90a2-c51229c5db5f", - "name": "pool_reads" - }, - { - "field": "ad177970-63a2-11ea-90a2-c51229c5db5f", - "id": "c3fe5be0-63a2-11ea-90a2-c51229c5db5f", - "name": "pool_read_requests" - } - ] - } - ], - "point_size": "2", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Buffer Pool Efficiency [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-a1e00160-63a4-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-aaa326b0-f1f5-11e7-85ab-594b1652e0d1.json b/packages/mysql/kibana/visualization/mysql-aaa326b0-f1f5-11e7-85ab-594b1652e0d1.json deleted file mode 100644 index 13182480dc3..00000000000 --- a/packages/mysql/kibana/visualization/mysql-aaa326b0-f1f5-11e7-85ab-594b1652e0d1.json +++ /dev/null @@ -1,112 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Open tables, files, streams [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(22,165,165,1)", - "fill": "0.3", - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Open Tables", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.open.tables", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "avg" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,196,0,1)", - "fill": "0.3", - "formatter": "number", - "id": "615a2400-6312-11ea-99e6-b5eed31db613", - "label": "Open Files", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.open.files", - "id": "615a2401-6312-11ea-99e6-b5eed31db613", - "type": "avg" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(226,115,0,1)", - "fill": "0.3", - "formatter": "number", - "id": "15d7bcd0-6313-11ea-99e6-b5eed31db613", - "label": "Open Streams", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.open.streams", - "id": "15d7bcd1-6313-11ea-99e6-b5eed31db613", - "type": "avg" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Open tables, files, streams [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-aaa326b0-f1f5-11e7-85ab-594b1652e0d1", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-bf60bc10-639b-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-bf60bc10-639b-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 4e67c23ceae..00000000000 --- a/packages/mysql/kibana/visualization/mysql-bf60bc10-639b-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,116 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Aborted Connections Rate [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "d61928d0-6309-11ea-99e6-b5eed31db613" - } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(176,188,0,1)", - "fill": "0.3", - "formatter": "'0.0a'", - "id": "3c2a2a40-f1f4-11e7-a752-236fe3270d99", - "label": "Aborted Connections", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.aborted.clients", - "id": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "3c2a2a41-f1f4-11e7-a752-236fe3270d99", - "id": "6d053540-639b-11ea-83d6-4f7a6fe5aed4", - "type": "derivative", - "unit": "1s" - }, - { - "field": "6d053540-639b-11ea-83d6-4f7a6fe5aed4", - "id": "7548afc0-639b-11ea-83d6-4f7a6fe5aed4", - "type": "positive_only", - "unit": "" - } - ], - "point_size": 1, - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(251,158,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "d6572ee0-639b-11ea-83d6-4f7a6fe5aed4", - "label": "Failed Attempts to Connect ", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.aborted.connects", - "id": "d6572ee1-639b-11ea-83d6-4f7a6fe5aed4", - "type": "max" - }, - { - "field": "d6572ee1-639b-11ea-83d6-4f7a6fe5aed4", - "id": "e4a63540-639b-11ea-83d6-4f7a6fe5aed4", - "type": "derivative", - "unit": "1s" - }, - { - "id": "ec492a00-639b-11ea-83d6-4f7a6fe5aed4", - "type": "positive_only" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Aborted Connections Rate [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-bf60bc10-639b-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-c8661020-6310-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-c8661020-6310-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 349c3239ca0..00000000000 --- a/packages/mysql/kibana/visualization/mysql-c8661020-6310-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,125 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Network Traffic [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(0,98,177,1)", - "fill": 0.5, - "formatter": "bytes", - "id": "2b1c2390-f1f7-11e7-a752-236fe3270d99", - "label": "Received bytes", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.bytes.received", - "id": "2b1c2391-f1f7-11e7-a752-236fe3270d99", - "type": "max" - }, - { - "field": "2b1c2391-f1f7-11e7-a752-236fe3270d99", - "id": "2b1c2392-f1f7-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "2b1c2392-f1f7-11e7-a752-236fe3270d99", - "id": "788d3c90-6310-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - }, - { - "id": "88f8e160-6310-11ea-99e6-b5eed31db613", - "script": "params.received != null \u0026\u0026 params.received \u003e 0 ? params.received * -1 : null", - "type": "calculation", - "variables": [ - { - "field": "788d3c90-6310-11ea-99e6-b5eed31db613", - "id": "8beb4660-6310-11ea-99e6-b5eed31db613", - "name": "received" - } - ] - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "bytes", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Sent bytes", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.bytes.sent", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "23cfda50-f1f7-11e7-a752-236fe3270d99", - "type": "derivative", - "unit": "1s" - }, - { - "field": "23cfda50-f1f7-11e7-a752-236fe3270d99", - "id": "ad26a900-6310-11ea-99e6-b5eed31db613", - "type": "positive_only", - "unit": "" - } - ], - "point_size": "0", - "seperate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Network Traffic [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-c8661020-6310-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-cd72e030-c6a6-11ea-a106-5be590f42b74.json b/packages/mysql/kibana/visualization/mysql-cd72e030-c6a6-11ea-a106-5be590f42b74.json deleted file mode 100644 index 884bfa38440..00000000000 --- a/packages/mysql/kibana/visualization/mysql-cd72e030-c6a6-11ea-a106-5be590f42b74.json +++ /dev/null @@ -1,129 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Open Tables Cache [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "", - "isModelInvalid": false, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Hits", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.table.open_cache.hits", - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "max" - }, - { - "field": "61ca57f2-469d-11e7-af02-69e470af7417", - "id": "534a23e0-c6a6-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "kibana", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(252,220,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "60ab20c0-c6a6-11ea-880f-352bebf10188", - "label": "Misses", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.table.open_cache.misses", - "id": "60ab47d0-c6a6-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "60ab47d0-c6a6-11ea-880f-352bebf10188", - "id": "6a1519e0-c6a6-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - }, - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(254,146,0,1)", - "fill": 0.5, - "formatter": "number", - "id": "69113e70-c6a6-11ea-880f-352bebf10188", - "label": "Overflows", - "line_width": 1, - "metrics": [ - { - "field": "mysql.status.cache.table.open_cache.overflows", - "id": "69113e71-c6a6-11ea-880f-352bebf10188", - "type": "max" - }, - { - "field": "69113e71-c6a6-11ea-880f-352bebf10188", - "id": "75a108a0-c6a6-11ea-880f-352bebf10188", - "type": "derivative", - "unit": "" - } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false - }, - "title": "Open Tables Cache [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-cd72e030-c6a6-11ea-a106-5be590f42b74", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-error-logs.json b/packages/mysql/kibana/visualization/mysql-error-logs.json deleted file mode 100644 index 99f3fd3deb4..00000000000 --- a/packages/mysql/kibana/visualization/mysql-error-logs.json +++ /dev/null @@ -1,147 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Error logs over time [Logs MySQL]", - "uiStateJSON": { - "vis": { - "colors": { - "Count": "#447EBC", - "Error logs": "#1F78C1" - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Error logs" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1 - }, - "schema": "segment", - "type": "date_histogram" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "@timestamp per 30 seconds" - }, - "type": "category" - } - ], - "defaultYExtents": false, - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "legendPosition": "right", - "mode": "stacked", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Error logs" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "setYExtents": false, - "shareYAxis": true, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Error logs" - }, - "type": "value" - } - ], - "yAxis": {} - }, - "title": "Error logs over time [Logs MySQL]", - "type": "histogram" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-error-logs", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-Logs-MySQL-error-log", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-fc6b5a40-630d-11ea-a83e-25b8612d00cc.json b/packages/mysql/kibana/visualization/mysql-fc6b5a40-630d-11ea-a83e-25b8612d00cc.json deleted file mode 100644 index 9de26c2a440..00000000000 --- a/packages/mysql/kibana/visualization/mysql-fc6b5a40-630d-11ea-a83e-25b8612d00cc.json +++ /dev/null @@ -1,80 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": {} - }, - "title": "Connected Threads [Metrics MySQL]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "d5fcf170-630d-11ea-99e6-b5eed31db613" - } - ], - "gauge_color_rules": [ - { - "id": "f1321f60-630d-11ea-99e6-b5eed31db613" - } - ], - "gauge_inner_width": 10, - "gauge_style": "half", - "gauge_width": 10, - "hide_last_value_indicator": true, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "metrics-*", - "interval": "auto", - "isModelInvalid": false, - "legend_position": "bottom", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "rgba(115,216,255,0.89)", - "fill": "0.3", - "formatter": "number", - "id": "fe9af660-630b-11ea-99e6-b5eed31db613", - "label": "Connections", - "line_width": "2", - "metrics": [ - { - "field": "mysql.status.threads.connected", - "id": "fe9af661-630b-11ea-99e6-b5eed31db613", - "type": "max" - } - ], - "point_size": "0", - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none", - "type": "timeseries" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "gauge", - "use_kibana_indexes": false - }, - "title": "Connected Threads [Metrics MySQL]", - "type": "metrics" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-fc6b5a40-630d-11ea-a83e-25b8612d00cc", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/kibana/visualization/mysql-slowest-queries.json b/packages/mysql/kibana/visualization/mysql-slowest-queries.json deleted file mode 100644 index f43b64747ee..00000000000 --- a/packages/mysql/kibana/visualization/mysql-slowest-queries.json +++ /dev/null @@ -1,93 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [] - } - }, - "savedSearchRefName": "search_0", - "title": "Top slowest queries [Logs MySQL]", - "uiStateJSON": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Query time", - "field": "event.duration" - }, - "schema": "metric", - "type": "max" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Query", - "field": "mysql.slowlog.query", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "User", - "field": "user.name", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - } - ], - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "Top slowest queries [Logs MySQL]", - "type": "table" - } - }, - "coreMigrationVersion": "7.14.0", - "id": "mysql-slowest-queries", - "migrationVersion": { - "visualization": "7.14.0" - }, - "namespaces": [ - "default" - ], - "references": [ - { - "id": "mysql-Logs-MySQL-Slow-log", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/mysql/manifest.yml b/packages/mysql/manifest.yml index ea324d61096..7bc47e1f92c 100644 --- a/packages/mysql/manifest.yml +++ b/packages/mysql/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: mysql title: MySQL -version: "1.12.4" +version: "1.15.0" license: basic description: Collect logs and metrics from MySQL servers with Elastic Agent. type: integration @@ -10,7 +10,7 @@ categories: - observability release: ga conditions: - kibana.version: "^8.8.0" + kibana.version: "^8.8.2" screenshots: - src: /img/kibana-mysql.png title: kibana mysql diff --git a/packages/mysql_enterprise/_dev/build/build.yml b/packages/mysql_enterprise/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/mysql_enterprise/_dev/build/build.yml +++ b/packages/mysql_enterprise/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/mysql_enterprise/changelog.yml b/packages/mysql_enterprise/changelog.yml index acf46a734ce..2595ed96a6d 100644 --- a/packages/mysql_enterprise/changelog.yml +++ b/packages/mysql_enterprise/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.11.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.10.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.9.0" + changes: + - description: Update package-spec to 2.9.0, ensure event.category and event.type are set properly. + type: enhancement + link: https://github.com/elastic/integrations/pull/7166 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.7.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/mysql_enterprise/data_stream/audit/_dev/test/pipeline/test-mysql-audit.log-expected.json b/packages/mysql_enterprise/data_stream/audit/_dev/test/pipeline/test-mysql-audit.log-expected.json index faa0c050085..a7bcf0924be 100644 --- a/packages/mysql_enterprise/data_stream/audit/_dev/test/pipeline/test-mysql-audit.log-expected.json +++ b/packages/mysql_enterprise/data_stream/audit/_dev/test/pipeline/test-mysql-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-10-19T19:21:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-startup", @@ -66,7 +66,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-connect", @@ -132,7 +132,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -143,8 +143,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:25:51\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 13, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"select\", \"query\": \"select @@version_comment limit 1\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -190,12 +189,13 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-disconnect", "category": [ - "database" + "database", + "network" ], "kind": "event", "original": "{ \"timestamp\": \"2020-10-19 19:25:52\", \"id\": 0, \"class\": \"connection\", \"event\": \"disconnect\", \"connection_id\": 13, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"connection_data\": { \"connection_type\": \"socket\" } },", @@ -246,7 +246,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-connect", @@ -312,7 +312,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -323,8 +323,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:27:45\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"select\", \"query\": \"select @@version_comment limit 1\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -370,7 +369,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -382,8 +381,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:27:50\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'password'\", \"status\": 1064 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -429,7 +427,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -441,8 +439,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:28:04\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'root'@'%' IDENTIFIED BY 'password'\", \"status\": 1064 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -488,7 +485,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -500,8 +497,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:28:27\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'root'@'hades.home' IDENTIFIED BY 'password'\", \"status\": 1064 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -547,7 +543,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -559,8 +555,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:28:54\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'root'@'%'\", \"status\": 1410 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -606,7 +601,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -619,7 +614,6 @@ "outcome": "failure", "type": [ "access", - "connection", "user", "creation" ] @@ -675,7 +669,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -688,7 +682,6 @@ "outcome": "success", "type": [ "access", - "connection", "user", "creation" ] @@ -744,7 +737,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -756,8 +749,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:30:18\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO ‘audit_test_user2’@’hades.home’\", \"status\": 1410 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -803,7 +795,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -815,8 +807,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:30:32\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'audit_test_user'@'hades.home'\", \"status\": 1410 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -862,7 +853,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -874,8 +865,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:30:49\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'audit_test_user'@'hades.home'\", \"status\": 1410 } },", "outcome": "failure", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -921,7 +911,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -933,8 +923,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:01\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"grant\", \"query\": \"GRANT ALL PRIVILEGES ON *.* TO 'audit_test_user2'@'hades.home'\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -981,7 +970,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-connect", @@ -1050,7 +1039,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1061,8 +1050,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:25\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"select\", \"query\": \"select @@version_comment limit 1\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1112,7 +1100,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1123,8 +1111,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:31\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"create_db\", \"query\": \"create database audit_test\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1174,7 +1161,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1185,8 +1172,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:40\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"select\", \"query\": \"SELECT DATABASE()\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1236,7 +1222,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1247,8 +1233,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:40\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Init DB\", \"sql_command\": \"error\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1297,7 +1282,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1308,8 +1293,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:40\", \"id\": 2, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"show_databases\", \"query\": \"show databases\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1359,7 +1343,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1370,8 +1354,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:40\", \"id\": 3, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"show_tables\", \"query\": \"show tables\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1421,7 +1404,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1432,8 +1415,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:47\", \"id\": 0, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"create_table\", \"query\": \"CREATE TABLE audit_test_table (firstname VARCHAR(20), lastname VARCHAR(20))\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1483,7 +1465,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-insert", @@ -1494,8 +1476,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:57\", \"id\": 0, \"class\": \"table_access\", \"event\": \"insert\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"table_access_data\": { \"db\": \"audit_test\", \"table\": \"audit_test_table\", \"query\": \"INSERT INTO audit_test_table values ('John', 'Smith')\", \"sql_command\": \"insert\" } },", "outcome": "unknown", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1545,7 +1526,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1556,8 +1537,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:31:57\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"insert\", \"query\": \"INSERT INTO audit_test_table values ('John', 'Smith')\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1607,7 +1587,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-read", @@ -1618,8 +1598,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:32:05\", \"id\": 0, \"class\": \"table_access\", \"event\": \"read\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"table_access_data\": { \"db\": \"audit_test\", \"table\": \"audit_test_table\", \"query\": \"select * from audit_test_table\", \"sql_command\": \"select\" } },", "outcome": "unknown", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1669,7 +1648,7 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1680,8 +1659,7 @@ "original": "{ \"timestamp\": \"2020-10-19 19:32:05\", \"id\": 1, \"class\": \"general\", \"event\": \"status\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"general_data\": { \"command\": \"Query\", \"sql_command\": \"select\", \"query\": \"select * from audit_test_table\", \"status\": 0 } },", "outcome": "success", "type": [ - "access", - "connection" + "access" ] }, "mysqlenterprise": { @@ -1731,12 +1709,13 @@ "ip": "192.168.2.5" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-disconnect", "category": [ - "database" + "database", + "network" ], "kind": "event", "original": "{ \"timestamp\": \"2020-10-19 19:32:10\", \"id\": 0, \"class\": \"connection\", \"event\": \"disconnect\", \"connection_id\": 16, \"account\": { \"user\": \"audit_test_user2\", \"host\": \"hades.home\" }, \"login\": { \"user\": \"audit_test_user2\", \"os\": \"\", \"ip\": \"192.168.2.5\", \"proxy\": \"\" }, \"connection_data\": { \"connection_type\": \"ssl\" } },", @@ -1790,12 +1769,13 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-disconnect", "category": [ - "database" + "database", + "network" ], "kind": "event", "original": "{ \"timestamp\": \"2020-10-19 19:32:12\", \"id\": 0, \"class\": \"connection\", \"event\": \"disconnect\", \"connection_id\": 15, \"account\": { \"user\": \"root\", \"host\": \"localhost\" }, \"login\": { \"user\": \"root\", \"os\": \"\", \"ip\": \"\", \"proxy\": \"\" }, \"connection_data\": { \"connection_type\": \"socket\" } },", @@ -1843,7 +1823,7 @@ { "@timestamp": "2020-10-19T19:32:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-shutdown", @@ -1878,7 +1858,7 @@ "ip": "192.168.7.76" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -1949,7 +1929,7 @@ "ip": "192.168.7.76" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", @@ -2007,7 +1987,7 @@ "ip": "192.168.7.76" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mysql-status", diff --git a/packages/mysql_enterprise/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/mysql_enterprise/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 3c8ba563782..c5f53742db7 100644 --- a/packages/mysql_enterprise/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/mysql_enterprise/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing MySQL Enterprise Audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.original copy_from: message @@ -35,7 +35,7 @@ processors: - append: field: event.category value: network - if: ctx?.mysqlenterprise?.audit?.event == 'connect' + if: ctx?.mysqlenterprise?.audit?.class == 'connection' - append: field: event.category value: iam @@ -47,7 +47,7 @@ processors: - append: field: event.type value: connection - if: ctx?.mysqlenterprise?.audit?.class != 'audit' + if: ctx?.mysqlenterprise?.audit?.class == 'connection' - append: field: event.type value: start diff --git a/packages/mysql_enterprise/data_stream/audit/sample_event.json b/packages/mysql_enterprise/data_stream/audit/sample_event.json index 061e5840d70..2f595b238a7 100644 --- a/packages/mysql_enterprise/data_stream/audit/sample_event.json +++ b/packages/mysql_enterprise/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-10-19T19:21:33.000Z", "agent": { - "ephemeral_id": "d192381e-e559-464a-876d-058ff4104145", - "id": "1202ee7c-96a3-47b6-8ddf-4fd17e23f288", + "ephemeral_id": "40541c95-7cce-4bef-be7b-3eb82f363f0f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mysql_enterprise.audit", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "1202ee7c-96a3-47b6-8ddf-4fd17e23f288", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.0.0" + "version": "8.9.0" }, "event": { "action": "mysql-startup", @@ -27,7 +27,7 @@ "database" ], "dataset": "mysql_enterprise.audit", - "ingested": "2022-02-24T08:19:02Z", + "ingested": "2023-07-31T15:48:08Z", "kind": "event", "outcome": "unknown", "timezone": "+00:00" @@ -36,22 +36,23 @@ "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", + "id": "61993a3120a949b68ffe69a69ae82866", "ip": [ - "192.168.192.4" + "192.168.176.7" ], "mac": [ - "02:42:c0:a8:c0:04" + "02-42-C0-A8-B0-07" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", "full": "x86_64-Linux", - "kernel": "5.10.60.1-microsoft-standard-WSL2", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.3 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -61,7 +62,7 @@ "file": { "path": "/tmp/service_logs/mysql_audit.log" }, - "offset": 462 + "offset": 0 }, "mysqlenterprise": { "audit": { diff --git a/packages/mysql_enterprise/docs/README.md b/packages/mysql_enterprise/docs/README.md index 91beddd7e93..c31628c046b 100644 --- a/packages/mysql_enterprise/docs/README.md +++ b/packages/mysql_enterprise/docs/README.md @@ -43,7 +43,7 @@ The `audit` dataset collects MySQL Enterprise Audit logs. | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -124,11 +124,11 @@ An example event for `audit` looks as following: { "@timestamp": "2020-10-19T19:21:33.000Z", "agent": { - "ephemeral_id": "d192381e-e559-464a-876d-058ff4104145", - "id": "1202ee7c-96a3-47b6-8ddf-4fd17e23f288", + "ephemeral_id": "40541c95-7cce-4bef-be7b-3eb82f363f0f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.0" }, "data_stream": { "dataset": "mysql_enterprise.audit", @@ -136,12 +136,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "1202ee7c-96a3-47b6-8ddf-4fd17e23f288", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.0.0" + "version": "8.9.0" }, "event": { "action": "mysql-startup", @@ -150,7 +150,7 @@ An example event for `audit` looks as following: "database" ], "dataset": "mysql_enterprise.audit", - "ingested": "2022-02-24T08:19:02Z", + "ingested": "2023-07-31T15:48:08Z", "kind": "event", "outcome": "unknown", "timezone": "+00:00" @@ -159,22 +159,23 @@ An example event for `audit` looks as following: "architecture": "x86_64", "containerized": true, "hostname": "docker-fleet-agent", + "id": "61993a3120a949b68ffe69a69ae82866", "ip": [ - "192.168.192.4" + "192.168.176.7" ], "mac": [ - "02:42:c0:a8:c0:04" + "02-42-C0-A8-B0-07" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", "full": "x86_64-Linux", - "kernel": "5.10.60.1-microsoft-standard-WSL2", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.3 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -184,7 +185,7 @@ An example event for `audit` looks as following: "file": { "path": "/tmp/service_logs/mysql_audit.log" }, - "offset": 462 + "offset": 0 }, "mysqlenterprise": { "audit": { diff --git a/packages/mysql_enterprise/kibana/tags.yml b/packages/mysql_enterprise/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/mysql_enterprise/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/mysql_enterprise/manifest.yml b/packages/mysql_enterprise/manifest.yml index 92783e0ad26..3f412911538 100644 --- a/packages/mysql_enterprise/manifest.yml +++ b/packages/mysql_enterprise/manifest.yml @@ -1,16 +1,15 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: mysql_enterprise title: "MySQL Enterprise" -version: "1.7.0" -license: basic +version: "1.11.0" description: Collect audit logs from MySQL Enterprise with Elastic Agent. type: integration categories: - security - datastore -release: ga conditions: - kibana.version: "^7.17.0 || ^8.0.0" + kibana: + version: "^7.17.0 || ^8.0.0" icons: - src: /img/logo_mysql.svg title: MySQL @@ -26,3 +25,4 @@ policy_templates: description: Collecting MySQL Enterprise audit logs owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/nagios_xi/changelog.yml b/packages/nagios_xi/changelog.yml index 9b3650581f0..e3b315204f5 100644 --- a/packages/nagios_xi/changelog.yml +++ b/packages/nagios_xi/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.1.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.1.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7342 - version: "1.0.0" changes: - description: Make Nagios XI GA diff --git a/packages/nagios_xi/data_stream/events/agent/stream/stream.yml.hbs b/packages/nagios_xi/data_stream/events/agent/stream/stream.yml.hbs index 297c6c9701f..a2d66af045b 100644 --- a/packages/nagios_xi/data_stream/events/agent/stream/stream.yml.hbs +++ b/packages/nagios_xi/data_stream/events/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{hostname}}/nagiosxi/api/v1/objects/logentries?apikey={{api_key}}&orderby=entry_time:a {{#if proxy_url }} diff --git a/packages/nagios_xi/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/nagios_xi/data_stream/events/elasticsearch/ingest_pipeline/default.yml index 78383567fb9..e7a7b752721 100644 --- a/packages/nagios_xi/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/nagios_xi/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -8,6 +8,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/nagios_xi/data_stream/host/agent/stream/stream.yml.hbs b/packages/nagios_xi/data_stream/host/agent/stream/stream.yml.hbs index 501f4710257..b0a3f06855d 100644 --- a/packages/nagios_xi/data_stream/host/agent/stream/stream.yml.hbs +++ b/packages/nagios_xi/data_stream/host/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{hostname}}/nagiosxi/api/v1/objects/hoststatus?apikey={{api_key}} {{#if proxy_url }} diff --git a/packages/nagios_xi/data_stream/host/elasticsearch/ingest_pipeline/default.yml b/packages/nagios_xi/data_stream/host/elasticsearch/ingest_pipeline/default.yml index 802a111e4b0..13b4afc11ce 100644 --- a/packages/nagios_xi/data_stream/host/elasticsearch/ingest_pipeline/default.yml +++ b/packages/nagios_xi/data_stream/host/elasticsearch/ingest_pipeline/default.yml @@ -8,6 +8,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/nagios_xi/data_stream/service/agent/stream/stream.yml.hbs b/packages/nagios_xi/data_stream/service/agent/stream/stream.yml.hbs index b41d5ba7481..c75c67327c0 100644 --- a/packages/nagios_xi/data_stream/service/agent/stream/stream.yml.hbs +++ b/packages/nagios_xi/data_stream/service/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{hostname}}/nagiosxi/api/v1/objects/servicestatus?apikey={{api_key}} {{#if proxy_url }} diff --git a/packages/nagios_xi/data_stream/service/elasticsearch/ingest_pipeline/default.yml b/packages/nagios_xi/data_stream/service/elasticsearch/ingest_pipeline/default.yml index 1d8ce37067f..776a310d272 100644 --- a/packages/nagios_xi/data_stream/service/elasticsearch/ingest_pipeline/default.yml +++ b/packages/nagios_xi/data_stream/service/elasticsearch/ingest_pipeline/default.yml @@ -8,6 +8,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/nagios_xi/manifest.yml b/packages/nagios_xi/manifest.yml index b7ba0adc5a3..337a4bbbeb6 100644 --- a/packages/nagios_xi/manifest.yml +++ b/packages/nagios_xi/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: nagios_xi title: "Nagios XI" -version: "1.0.0" +version: "1.1.1" license: basic description: Collect Logs and Metrics from Nagios XI with Elastic Agent. type: integration @@ -97,6 +97,13 @@ policy_templates: # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk # sxSmbIUfc2SGJGCJD4I= # -----END CERTIFICATE----- + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. title: Collect Nagios XI Metrics via API description: Collect Nagios XI Host metrics, Service metrics and System events. owner: diff --git a/packages/netflow/_dev/build/build.yml b/packages/netflow/_dev/build/build.yml index 074278e5b1f..c1af686e524 100644 --- a/packages/netflow/_dev/build/build.yml +++ b/packages/netflow/_dev/build/build.yml @@ -1,3 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/netflow/changelog.yml b/packages/netflow/changelog.yml index 533a8c37f22..33839a55c8e 100644 --- a/packages/netflow/changelog.yml +++ b/packages/netflow/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: "2.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.13.0" + changes: + - description: Use dynamic field definitions. + type: enhancement + link: https://github.com/elastic/integrations/pull/7657 +- version: "2.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "2.11.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "2.10.0" + changes: + - description: Converting dashboard visualizations to lens + type: enhancement + link: https://github.com/elastic/integrations/pull/7011 - version: "2.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/netflow/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json b/packages/netflow/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json index dacc772f513..e772f0a2b02 100644 --- a/packages/netflow/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json +++ b/packages/netflow/data_stream/log/_dev/test/pipeline/test-netflow-log-events.json-expected.json @@ -18,7 +18,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -96,7 +96,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -125,7 +127,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -203,7 +205,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -232,7 +236,7 @@ "packets": 1 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -310,7 +314,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -339,7 +345,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -417,7 +423,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -446,7 +454,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -524,7 +532,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -553,7 +563,7 @@ "packets": 18 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -631,7 +641,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 9437, @@ -660,7 +672,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -738,7 +750,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -767,7 +781,7 @@ "packets": 47 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -845,7 +859,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 36894, @@ -874,7 +890,7 @@ "packets": 20 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -952,7 +968,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 6400, @@ -981,7 +999,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1059,7 +1077,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1088,7 +1108,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1166,7 +1186,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1195,7 +1217,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1273,7 +1295,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1302,7 +1326,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1380,7 +1404,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1409,7 +1435,7 @@ "packets": 13 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1487,7 +1513,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 1571, @@ -1516,7 +1544,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1594,7 +1622,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1623,7 +1653,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1701,7 +1731,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1730,7 +1762,7 @@ "packets": 7 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1808,7 +1840,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 3409, @@ -1837,7 +1871,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -1915,7 +1949,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -1944,7 +1980,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2022,7 +2058,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -2051,7 +2089,7 @@ "packets": 15 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2129,7 +2167,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 6305, @@ -2158,7 +2198,7 @@ "packets": 10 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2236,7 +2276,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 1973, @@ -2265,7 +2307,7 @@ "packets": 4 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2343,7 +2385,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 2, @@ -2372,7 +2416,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2450,7 +2494,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -2479,7 +2525,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2557,7 +2603,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -2586,7 +2634,7 @@ "packets": 3 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2664,7 +2712,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 174, @@ -2693,7 +2743,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2771,7 +2821,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -2800,7 +2852,7 @@ "packets": 1 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2878,7 +2930,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 0, @@ -2907,7 +2961,7 @@ "packets": 19 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -2985,7 +3039,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 8989, @@ -3014,7 +3070,7 @@ "packets": 236 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3092,7 +3148,9 @@ "transport": "tcp" }, "observer": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "server": { "bytes": 233345, @@ -3111,7 +3169,7 @@ "port": 54594 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3160,7 +3218,9 @@ "type": "ipv4" }, "observer": { - "ip": "81.2.69.144" + "ip": [ + "81.2.69.144" + ] }, "related": { "ip": [ @@ -3184,7 +3244,7 @@ "port": 49180 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3233,7 +3293,9 @@ "type": "ipv4" }, "observer": { - "ip": "81.2.69.144" + "ip": [ + "81.2.69.144" + ] }, "related": { "ip": [ @@ -3293,7 +3355,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3342,7 +3404,9 @@ "type": "ipv4" }, "observer": { - "ip": "81.2.69.144" + "ip": [ + "81.2.69.144" + ] }, "related": { "ip": [ @@ -3366,7 +3430,7 @@ "port": 135 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3426,7 +3490,9 @@ ] }, "observer": { - "ip": "81.2.69.144" + "ip": [ + "81.2.69.144" + ] }, "related": { "ip": [ @@ -3447,7 +3513,7 @@ "port": 135 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "netflow_flow", @@ -3502,7 +3568,9 @@ "type": "ipv6" }, "observer": { - "ip": "81.2.69.144" + "ip": [ + "81.2.69.144" + ] }, "related": { "ip": [ diff --git a/packages/netflow/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/netflow/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 12c67b0dafd..001218244d5 100644 --- a/packages/netflow/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/netflow/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -4,13 +4,20 @@ description: Pipeline for NetFlow processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - convert: field: network.iana_number type: string ignore_missing: true ignore_failure: true - + - rename: + field: observer.ip + target_field: _tmp_.observer.ip + ignore_missing: true + - append: + field: observer.ip + value: '{{_tmp_.observer.ip}}' + if: ctx._tmp_?.observer?.ip != null - set: field: event.category value: @@ -95,6 +102,10 @@ processors: field: destination.as.organization_name target_field: destination.as.organization.name ignore_missing: true + - remove: + field: + - _tmp_ + ignore_missing: true on_failure: - set: field: event.kind diff --git a/packages/netflow/data_stream/log/manifest.yml b/packages/netflow/data_stream/log/manifest.yml index cce56f10146..92cac61dfa2 100644 --- a/packages/netflow/data_stream/log/manifest.yml +++ b/packages/netflow/data_stream/log/manifest.yml @@ -22,7 +22,7 @@ streams: default: 2055 - name: expiration_timeout type: text - title: Time duration before an idle session or unused template is expired + title: Time duration before an idle session or unused template is expired. Valid time units are h, m, s. multi: false required: true show_user: false @@ -80,7 +80,7 @@ streams: - forwarded - name: timeout type: text - title: Read timeout for socket operations + title: Read timeout for socket operations. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false diff --git a/packages/netflow/data_stream/log/sample_event.json b/packages/netflow/data_stream/log/sample_event.json index 6f14ed83aa5..affdb85a32b 100644 --- a/packages/netflow/data_stream/log/sample_event.json +++ b/packages/netflow/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-07-03T10:47:00.000Z", "agent": { - "ephemeral_id": "499040e3-2739-4333-bc0a-714aceaaa76b", - "id": "f98d63fc-e620-4d4d-b16e-814a105b1bc9", + "ephemeral_id": "305f6431-67ab-4e0f-8805-2b9d97ae3923", + "id": "246fcb7f-fa5e-4375-95d0-e7962f456b94", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.0" + "version": "8.7.1" }, "client": { "bytes": 719, @@ -21,12 +21,12 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "f98d63fc-e620-4d4d-b16e-814a105b1bc9", + "id": "246fcb7f-fa5e-4375-95d0-e7962f456b94", "snapshot": false, - "version": "8.2.0" + "version": "8.7.1" }, "event": { "action": "netflow_flow", @@ -35,9 +35,9 @@ "network", "session" ], - "created": "2022-05-12T09:08:00.955Z", + "created": "2023-07-19T13:23:37.227Z", "dataset": "netflow.log", - "ingested": "2022-05-12T09:08:01Z", + "ingested": "2023-07-19T13:23:38Z", "kind": "event", "type": [ "connection" @@ -73,7 +73,7 @@ "connection_sum_duration_seconds": 0, "egress_interface": 13, "exporter": { - "address": "192.168.208.4:56750", + "address": "172.28.0.4:42750", "source_id": 512, "timestamp": "2018-07-03T10:47:00.000Z", "uptime_millis": 0, @@ -104,7 +104,9 @@ "transport": "tcp" }, "observer": { - "ip": "192.168.208.4" + "ip": [ + "172.28.0.4" + ] }, "server": { "bytes": 0, diff --git a/packages/netflow/docs/README.md b/packages/netflow/docs/README.md index 22cf2ebdd27..fda9bc4ab8d 100644 --- a/packages/netflow/docs/README.md +++ b/packages/netflow/docs/README.md @@ -146,14 +146,14 @@ The `log` dataset collects netflow logs. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.hash | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -162,7 +162,7 @@ The `log` dataset collects netflow logs. | event.risk_score_norm | Normalized risk score or priority of the event, on a scale of 0 to 100. This is mainly useful if you use more than one system that assigns risk scores, and you want to see a normalized value across all systems. | float | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.accessed | Last time the file was accessed. Note that not all filesystems keep track of access time. | date | diff --git a/packages/netflow/img/netflow-conversation.png b/packages/netflow/img/netflow-conversation.png new file mode 100644 index 00000000000..0b12e0e2096 Binary files /dev/null and b/packages/netflow/img/netflow-conversation.png differ diff --git a/packages/netflow/img/netflow-geo.png b/packages/netflow/img/netflow-geo.png new file mode 100644 index 00000000000..9983c67a54e Binary files /dev/null and b/packages/netflow/img/netflow-geo.png differ diff --git a/packages/netflow/img/netflow-overview.png b/packages/netflow/img/netflow-overview.png new file mode 100644 index 00000000000..081697095e1 Binary files /dev/null and b/packages/netflow/img/netflow-overview.png differ diff --git a/packages/netflow/img/netflow-topn.png b/packages/netflow/img/netflow-topn.png new file mode 100644 index 00000000000..4a1d2df2941 Binary files /dev/null and b/packages/netflow/img/netflow-topn.png differ diff --git a/packages/netflow/img/traffic-analysis.png b/packages/netflow/img/traffic-analysis.png new file mode 100644 index 00000000000..6e168349442 Binary files /dev/null and b/packages/netflow/img/traffic-analysis.png differ diff --git a/packages/netflow/kibana/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c.json b/packages/netflow/kibana/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c.json index df0e881217b..18734697926 100644 --- a/packages/netflow/kibana/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c.json +++ b/packages/netflow/kibana/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c.json @@ -1,988 +1,1612 @@ { - "id": "netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2MCwxXQ==", - "attributes": { - "description": "Netflow Top N flows", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Netflow Top N flows", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 4, - "i": "1", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Sources [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + "gridData": { + "h": 4, + "i": "1", + "w": 48, + "x": 0, + "y": 0 }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "2", - "w": 24, - "x": 0, - "y": 4 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Destinations [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "panelIndex": "1", + "type": "visualization", + "version": "8.7.1" }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-42b4adca-87fd-4682-b7f1-8868c24e0589", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e0475a4d-c9ba-479c-bd04-c5098089bcde", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "42b4adca-87fd-4682-b7f1-8868c24e0589": { + "columnOrder": [ + "f1da2081-ed56-4b0c-bca4-ef7438824ffc", + "190f9376-a0a5-4b60-a0e0-7a07ab67a0be", + "c5f8dc77-f011-4ab6-ae52-b1accd1d43ca", + "9b61af61-8af0-4462-ae05-fbf27ddbd254" + ], + "columns": { + "190f9376-a0a5-4b60-a0e0-7a07ab67a0be": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "9b61af61-8af0-4462-ae05-fbf27ddbd254": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c5f8dc77-f011-4ab6-ae52-b1accd1d43ca": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "f1da2081-ed56-4b0c-bca4-ef7438824ffc": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "190f9376-a0a5-4b60-a0e0-7a07ab67a0be", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e0475a4d-c9ba-479c-bd04-c5098089bcde", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "190f9376-a0a5-4b60-a0e0-7a07ab67a0be", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "c5f8dc77-f011-4ab6-ae52-b1accd1d43ca", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "9b61af61-8af0-4462-ae05-fbf27ddbd254", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "f1da2081-ed56-4b0c-bca4-ef7438824ffc" + } + ], + "headerRowHeight": "single", + "layerId": "42b4adca-87fd-4682-b7f1-8868c24e0589", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Sources [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + "gridData": { + "h": 20, + "i": "2", + "w": 24, + "x": 0, + "y": 4 }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "3", - "w": 24, - "x": 24, - "y": 4 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Source Ports [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "panelIndex": "2", + "title": "[Logs Netflow] Top Sources", + "type": "lens", + "version": "8.7.1" }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-faad98be-c32b-421a-a3d1-c1162708a64c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "95c9263e-874b-4246-864a-9e3b9d5ed643", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "faad98be-c32b-421a-a3d1-c1162708a64c": { + "columnOrder": [ + "e359b476-1cd4-4bd7-9df7-2c715055db17", + "cfdceb19-e1c6-42f4-b6dd-b93bdb60d48b", + "e9575aa0-418c-44c8-98ac-d0d9bf464884", + "f553c991-a48b-471a-8769-e75890f1965a" + ], + "columns": { + "cfdceb19-e1c6-42f4-b6dd-b93bdb60d48b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "e359b476-1cd4-4bd7-9df7-2c715055db17": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cfdceb19-e1c6-42f4-b6dd-b93bdb60d48b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "e9575aa0-418c-44c8-98ac-d0d9bf464884": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "f553c991-a48b-471a-8769-e75890f1965a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "95c9263e-874b-4246-864a-9e3b9d5ed643", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "cfdceb19-e1c6-42f4-b6dd-b93bdb60d48b", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "e9575aa0-418c-44c8-98ac-d0d9bf464884", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "f553c991-a48b-471a-8769-e75890f1965a", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "e359b476-1cd4-4bd7-9df7-2c715055db17" + } + ], + "headerRowHeight": "single", + "layerId": "faad98be-c32b-421a-a3d1-c1162708a64c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Destinations [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + "gridData": { + "h": 20, + "i": "3", + "w": 24, + "x": 24, + "y": 4 }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Source", - "field": "source.port", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "4", - "w": 24, - "x": 0, - "y": 24 - }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Destination Ports [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "panelIndex": "3", + "title": "[Logs Netflow] Top Destinations", + "type": "lens", + "version": "8.7.1" }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-601bb73f-ea56-4d02-bafd-aa5bf3a450e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "700b406d-fd7c-4ce4-9884-fd0555e6f5de", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "601bb73f-ea56-4d02-bafd-aa5bf3a450e1": { + "columnOrder": [ + "b117fbfd-cb51-474d-bb0e-a27cd307cd3b", + "80c3fce6-a9a2-4619-bc50-9f588ed3fba6", + "aa6c5eb8-d9e5-48c0-a4b3-dffeab223905", + "d65885b7-034c-4dd8-a387-66b6d62f1be1" + ], + "columns": { + "80c3fce6-a9a2-4619-bc50-9f588ed3fba6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "aa6c5eb8-d9e5-48c0-a4b3-dffeab223905": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "b117fbfd-cb51-474d-bb0e-a27cd307cd3b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "80c3fce6-a9a2-4619-bc50-9f588ed3fba6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "source.port" + }, + "d65885b7-034c-4dd8-a387-66b6d62f1be1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "700b406d-fd7c-4ce4-9884-fd0555e6f5de", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "80c3fce6-a9a2-4619-bc50-9f588ed3fba6", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "aa6c5eb8-d9e5-48c0-a4b3-dffeab223905", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "d65885b7-034c-4dd8-a387-66b6d62f1be1", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "b117fbfd-cb51-474d-bb0e-a27cd307cd3b" + } + ], + "headerRowHeight": "single", + "layerId": "601bb73f-ea56-4d02-bafd-aa5bf3a450e1", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Source Ports [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + "gridData": { + "h": 20, + "i": "4", + "w": 24, + "x": 0, + "y": 24 }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Destination", - "field": "destination.port", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "5", - "w": 24, - "x": 24, - "y": 24 - }, - "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Protocols [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + "panelIndex": "4", + "title": "[Logs Netflow] Top Source Ports", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cdab8c5d-2d72-4294-9ae8-b5bac4c0e27b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5622e808-d026-419c-9f27-b2e568758fae", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cdab8c5d-2d72-4294-9ae8-b5bac4c0e27b": { + "columnOrder": [ + "d98853fc-1f63-472d-94de-e3ccde8639de", + "f1095d54-e9e3-4939-aeae-7c12dd0d2423", + "656dfa80-5921-49b9-b6ac-838c3d1c6e5d", + "ea54bee9-18f1-4cc2-a3e9-123de6cddff1" + ], + "columns": { + "656dfa80-5921-49b9-b6ac-838c3d1c6e5d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "d98853fc-1f63-472d-94de-e3ccde8639de": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f1095d54-e9e3-4939-aeae-7c12dd0d2423", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "destination.port" + }, + "ea54bee9-18f1-4cc2-a3e9-123de6cddff1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f1095d54-e9e3-4939-aeae-7c12dd0d2423": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5622e808-d026-419c-9f27-b2e568758fae", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "f1095d54-e9e3-4939-aeae-7c12dd0d2423", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "656dfa80-5921-49b9-b6ac-838c3d1c6e5d", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "ea54bee9-18f1-4cc2-a3e9-123de6cddff1", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "d98853fc-1f63-472d-94de-e3ccde8639de" + } + ], + "headerRowHeight": "single", + "layerId": "cdab8c5d-2d72-4294-9ae8-b5bac4c0e27b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Destination Ports [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 20, + "i": "5", + "w": 24, + "x": 24, + "y": 24 }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Protocol", - "field": "network.transport", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "6", - "w": 24, - "x": 0, - "y": 44 - }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Autonomous Systems [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + "panelIndex": "5", + "title": "[Logs Netflow] Top Destination Ports", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c70a7a0f-3941-489a-9747-5aecd56d2fef", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "938f5c8e-154a-4c9e-8aa8-0ef193a7ecb8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c70a7a0f-3941-489a-9747-5aecd56d2fef": { + "columnOrder": [ + "27aa7cb2-32b8-46bd-88b7-270e995e954f", + "96bc4449-a2c7-4384-98dd-8c1330d16347", + "40a85ff5-321a-43f7-876a-5ff7d9b493ab", + "cc7436e6-ecb2-48a7-96aa-483f23279635" + ], + "columns": { + "27aa7cb2-32b8-46bd-88b7-270e995e954f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "96bc4449-a2c7-4384-98dd-8c1330d16347", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "40a85ff5-321a-43f7-876a-5ff7d9b493ab": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "96bc4449-a2c7-4384-98dd-8c1330d16347": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "cc7436e6-ecb2-48a7-96aa-483f23279635": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "938f5c8e-154a-4c9e-8aa8-0ef193a7ecb8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "96bc4449-a2c7-4384-98dd-8c1330d16347", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "40a85ff5-321a-43f7-876a-5ff7d9b493ab", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "cc7436e6-ecb2-48a7-96aa-483f23279635", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "27aa7cb2-32b8-46bd-88b7-270e995e954f" + } + ], + "headerRowHeight": "single", + "layerId": "c70a7a0f-3941-489a-9747-5aecd56d2fef", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Protocols [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 20, + "i": "6", + "w": 24, + "x": 0, + "y": 44 }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Autonomous System", - "field": "destination.as.organization.name", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "7", - "w": 24, - "x": 24, - "y": 44 - }, - "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": 2, - "direction": "desc" - } - } - }, - "savedVis": { - "title": "Top Cities [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 2, - "direction": "desc" - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": true, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + "panelIndex": "6", + "title": "[Logs Netflow] Top Protocols", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8b7cb324-f831-4f12-b1b7-b3fd94130c44", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b74f6e3d-6151-4634-a4b3-580bac6cabac", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8b7cb324-f831-4f12-b1b7-b3fd94130c44": { + "columnOrder": [ + "3babe038-4a5d-40b8-b3b9-b3ebafab0435", + "b75b8ab9-e705-4ccf-98b7-2b5499ef8d4e", + "ea0eaff6-9708-4d99-9572-59f4fee31f2b", + "356dd3a5-3558-43fc-97cf-89a2f39498b7" + ], + "columns": { + "356dd3a5-3558-43fc-97cf-89a2f39498b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "3babe038-4a5d-40b8-b3b9-b3ebafab0435": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Autonomous System", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b75b8ab9-e705-4ccf-98b7-2b5499ef8d4e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + }, + "b75b8ab9-e705-4ccf-98b7-2b5499ef8d4e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "ea0eaff6-9708-4d99-9572-59f4fee31f2b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b74f6e3d-6151-4634-a4b3-580bac6cabac", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "b75b8ab9-e705-4ccf-98b7-2b5499ef8d4e", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "ea0eaff6-9708-4d99-9572-59f4fee31f2b", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "356dd3a5-3558-43fc-97cf-89a2f39498b7", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "3babe038-4a5d-40b8-b3b9-b3ebafab0435" + } + ], + "headerRowHeight": "single", + "layerId": "8b7cb324-f831-4f12-b1b7-b3fd94130c44", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Autonomous Systems [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 20, + "i": "7", + "w": 24, + "x": 24, + "y": 44 }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + "panelIndex": "7", + "title": "[Logs Netflow] Top Autonomous Systems", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-787d111d-67d4-443c-a30d-ca4bf64970c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0f10ec75-288b-4986-9b88-4c1ab95afde2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "787d111d-67d4-443c-a30d-ca4bf64970c8": { + "columnOrder": [ + "d8d8db53-fcc0-4f88-a5c9-328a4b7d4126", + "2541e989-3115-4452-8284-1678e1ec2368", + "a1a0933a-90f5-4aa7-9a68-dbefc4af5314", + "56acc25c-ca34-4119-838c-fe8920376e2d", + "4ff1c207-bf28-48e5-a4d0-c0c6c849647e" + ], + "columns": { + "2541e989-3115-4452-8284-1678e1ec2368": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "City", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a1a0933a-90f5-4aa7-9a68-dbefc4af5314", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "destination.geo.city_name" + }, + "4ff1c207-bf28-48e5-a4d0-c0c6c849647e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "56acc25c-ca34-4119-838c-fe8920376e2d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "a1a0933a-90f5-4aa7-9a68-dbefc4af5314": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "d8d8db53-fcc0-4f88-a5c9-328a4b7d4126": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a1a0933a-90f5-4aa7-9a68-dbefc4af5314", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0f10ec75-288b-4986-9b88-4c1ab95afde2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "a1a0933a-90f5-4aa7-9a68-dbefc4af5314", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "56acc25c-ca34-4119-838c-fe8920376e2d", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "4ff1c207-bf28-48e5-a4d0-c0c6c849647e", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "d8d8db53-fcc0-4f88-a5c9-328a4b7d4126" + }, + { + "alignment": "left", + "columnId": "2541e989-3115-4452-8284-1678e1ec2368" + } + ], + "headerRowHeight": "single", + "layerId": "787d111d-67d4-443c-a30d-ca4bf64970c8", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Cities [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Country", - "field": "destination.geo.country_name", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" + "gridData": { + "h": 20, + "i": "8", + "w": 24, + "x": 0, + "y": 64 }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "City", - "field": "destination.geo.city_name", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 20, - "i": "8", - "w": 24, - "x": 0, - "y": 64 - }, - "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - }, - "savedVis": { - "title": "Top Flow Exporters [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": true, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + "panelIndex": "8", + "title": "[Logs Netflow] Top Cities", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-80023e35-e84a-40cd-9fad-9b2d51a0a565", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7a90f19c-8c37-447d-bd6d-68194f794b07", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "80023e35-e84a-40cd-9fad-9b2d51a0a565": { + "columnOrder": [ + "1cb7d4a3-ad69-4cba-81c7-7cc7530188fd", + "f0db0387-09f5-4e36-85a7-48dd80f6038e", + "f7daaf43-4372-4915-bf76-d695b4b13769", + "4c0eda2b-e9b8-432a-a719-902b6b597eda" + ], + "columns": { + "1cb7d4a3-ad69-4cba-81c7-7cc7530188fd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Flow Exporter", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f0db0387-09f5-4e36-85a7-48dd80f6038e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "agent.name" + }, + "4c0eda2b-e9b8-432a-a719-902b6b597eda": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f0db0387-09f5-4e36-85a7-48dd80f6038e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "f7daaf43-4372-4915-bf76-d695b4b13769": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7a90f19c-8c37-447d-bd6d-68194f794b07", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "f0db0387-09f5-4e36-85a7-48dd80f6038e", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "f7daaf43-4372-4915-bf76-d695b4b13769", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "4c0eda2b-e9b8-432a-a719-902b6b597eda", + "summaryRow": "sum" + }, + { + "alignment": "left", + "columnId": "1cb7d4a3-ad69-4cba-81c7-7cc7530188fd" + } + ], + "headerRowHeight": "single", + "layerId": "80023e35-e84a-40cd-9fad-9b2d51a0a565", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Flow Exporters [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 20, + "i": "9", + "w": 24, + "x": 24, + "y": 64 }, - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Flow Exporter", - "field": "agent.name", - "order": "desc", - "orderBy": "2", - "size": 500 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "panelIndex": "9", + "title": "[Logs Netflow] Top Flow Exporters", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Top-N", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T08:30:26.083Z", + "id": "netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-42b4adca-87fd-4682-b7f1-8868c24e0589", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:e0475a4d-c9ba-479c-bd04-c5098089bcde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-faad98be-c32b-421a-a3d1-c1162708a64c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3:95c9263e-874b-4246-864a-9e3b9d5ed643", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-601bb73f-ea56-4d02-bafd-aa5bf3a450e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:700b406d-fd7c-4ce4-9884-fd0555e6f5de", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5:indexpattern-datasource-layer-cdab8c5d-2d72-4294-9ae8-b5bac4c0e27b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5:5622e808-d026-419c-9f27-b2e568758fae", + "type": "index-pattern" }, - "gridData": { - "h": 20, - "i": "9", - "w": 24, - "x": 24, - "y": 64 + { + "id": "logs-*", + "name": "6:indexpattern-datasource-layer-c70a7a0f-3941-489a-9747-5aecd56d2fef", + "type": "index-pattern" }, - "panelIndex": "9", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "6:938f5c8e-154a-4c9e-8aa8-0ef193a7ecb8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7:indexpattern-datasource-layer-8b7cb324-f831-4f12-b1b7-b3fd94130c44", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7:b74f6e3d-6151-4634-a4b3-580bac6cabac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8:indexpattern-datasource-layer-787d111d-67d4-443c-a30d-ca4bf64970c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8:0f10ec75-288b-4986-9b88-4c1ab95afde2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9:indexpattern-datasource-layer-80023e35-e84a-40cd-9fad-9b2d51a0a565", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9:7a90f19c-8c37-447d-bd6d-68194f794b07", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Top-N", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "4:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "5:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "6:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "8:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "9:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2.json b/packages/netflow/kibana/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2.json index e2b9e29acef..ca8da38ca33 100644 --- a/packages/netflow/kibana/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2.json +++ b/packages/netflow/kibana/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2.json @@ -1,1072 +1,1551 @@ { - "id": "netflow-34e26884-161a-4448-9556-43b5bf2f62a2", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2MSwxXQ==", - "attributes": { - "description": "Overview of Netflow", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" + "attributes": { + "description": "Overview of Netflow", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" } - } } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "IP Version and Protocols (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a32b39b0-abd0-4f86-8776-155af5088b08", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5271a3a3-d662-46fb-b463-860973830424", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a32b39b0-abd0-4f86-8776-155af5088b08": { + "columnOrder": [ + "0bfdb020-df4d-4faf-8b8f-4bc098e9236a", + "77704441-f0a3-4cb4-8240-4e82f0900481", + "36df3056-e07c-47f6-82eb-520b58f14dca" + ], + "columns": { + "0bfdb020-df4d-4faf-8b8f-4bc098e9236a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "IP Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "36df3056-e07c-47f6-82eb-520b58f14dca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.type" + }, + "36df3056-e07c-47f6-82eb-520b58f14dca": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "77704441-f0a3-4cb4-8240-4e82f0900481": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "36df3056-e07c-47f6-82eb-520b58f14dca", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "network.transport" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5271a3a3-d662-46fb-b463-860973830424", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "a32b39b0-abd0-4f86-8776-155af5088b08", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "36df3056-e07c-47f6-82eb-520b58f14dca" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "0bfdb020-df4d-4faf-8b8f-4bc098e9236a", + "77704441-f0a3-4cb4-8240-4e82f0900481" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "IP Version and Protocols (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "params": {} - }, - { - "accessor": 2, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "12", + "w": 16, + "x": 0, + "y": 4 + }, + "panelIndex": "12", + "title": "[Logs Netflow] IP Version and Protocols (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1d331db1-d01a-4636-ab7f-50e8ec30ff5a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "807cce7d-4e0f-4afc-8546-ac7bd63eb332", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d331db1-d01a-4636-ab7f-50e8ec30ff5a": { + "columnOrder": [ + "f4e044f9-9e16-43b4-9ba9-33daaf348ea4", + "d77631c2-6e82-481c-b4db-9538984051d5", + "d42e485d-5121-4077-aa6d-73471044a37e" + ], + "columns": { + "d42e485d-5121-4077-aa6d-73471044a37e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "d77631c2-6e82-481c-b4db-9538984051d5": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d42e485d-5121-4077-aa6d-73471044a37e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "f4e044f9-9e16-43b4-9ba9-33daaf348ea4": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d42e485d-5121-4077-aa6d-73471044a37e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "807cce7d-4e0f-4afc-8546-ac7bd63eb332", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "d77631c2-6e82-481c-b4db-9538984051d5", + "isTransposed": false + }, + { + "columnId": "f4e044f9-9e16-43b4-9ba9-33daaf348ea4" + }, + { + "columnId": "d42e485d-5121-4077-aa6d-73471044a37e" + } + ], + "layerId": "1d331db1-d01a-4636-ab7f-50e8ec30ff5a", + "layerType": "data" + } + }, + "title": "Destinations and Ports (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "params": {} - } - ], - "metric": { - "accessor": 1, - "aggType": "sum", - "format": { - "id": "bytes" - }, - "params": {} - } - }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "13", + "w": 16, + "x": 0, + "y": 18 + }, + "panelIndex": "13", + "title": "[Logs Netflow] Destinations and Ports (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-678eafcb-c91b-479c-8fbc-8bd2bbdf1bc9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c406a009-4d91-45e0-98c6-f5a96b8df3f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "678eafcb-c91b-479c-8fbc-8bd2bbdf1bc9": { + "columnOrder": [ + "324f880e-88d9-4cbd-9019-af59e63f804c", + "dba78490-d4b2-4bad-80aa-2eb2e4890cf7" + ], + "columns": { + "324f880e-88d9-4cbd-9019-af59e63f804c": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Type of Service", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dba78490-d4b2-4bad-80aa-2eb2e4890cf7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.ip_class_of_service" + }, + "dba78490-d4b2-4bad-80aa-2eb2e4890cf7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c406a009-4d91-45e0-98c6-f5a96b8df3f8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "678eafcb-c91b-479c-8fbc-8bd2bbdf1bc9", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "dba78490-d4b2-4bad-80aa-2eb2e4890cf7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "324f880e-88d9-4cbd-9019-af59e63f804c" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Types of Service (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "IP Version", - "field": "network.type", - "missingBucket": true, - "missingBucketLabel": "unset ip version", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 14, + "i": "15", + "w": 16, + "x": 16, + "y": 32 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Protocol", - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "12", - "w": 16, - "x": 0, - "y": 4 - }, - "panelIndex": "12", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations and Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "15", + "title": "[Logs Netflow] Types of Service (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 4, + "i": "17", + "w": 48, + "x": 0, + "y": 0 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Port", - "field": "destination.port", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "13", - "w": 16, - "x": 16, - "y": 4 - }, - "panelIndex": "13", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Sources and Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "17", + "type": "visualization", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0ac72630-c2c9-4631-abd3-1fa41c9ee1a8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ece6d36-a28a-47e6-8349-625c2d5b7dde", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0ac72630-c2c9-4631-abd3-1fa41c9ee1a8": { + "columnOrder": [ + "b6459f42-3b29-4140-b6a3-ac73bb1f93c8", + "b0746c72-8218-4a4f-82bd-583a7445c288" + ], + "columns": { + "b0746c72-8218-4a4f-82bd-583a7445c288": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "b6459f42-3b29-4140-b6a3-ac73bb1f93c8": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "VLAN", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0746c72-8218-4a4f-82bd-583a7445c288", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "netflow.vlan_id" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8ece6d36-a28a-47e6-8349-625c2d5b7dde", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "b6459f42-3b29-4140-b6a3-ac73bb1f93c8" + }, + { + "columnId": "b0746c72-8218-4a4f-82bd-583a7445c288" + } + ], + "layerId": "0ac72630-c2c9-4631-abd3-1fa41c9ee1a8", + "layerType": "data" + } + }, + "title": "VLANs (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 14, + "i": "21", + "w": 16, + "x": 16, + "y": 18 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Port", - "field": "source.port", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "14", - "w": 16, - "x": 32, - "y": 4 - }, - "panelIndex": "14", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Types of Service (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "21", + "title": "[Logs Netflow] VLANs (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1d928af4-d106-4b92-8bf8-a93d806bfcac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3c7ce74b-b430-42c8-971c-b2fd861de9e2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d928af4-d106-4b92-8bf8-a93d806bfcac": { + "columnOrder": [ + "4e6460a1-58ef-4e90-a82e-a3c722a53062", + "f535c54f-1bb6-49f4-9e8b-30563db0ab24" + ], + "columns": { + "4e6460a1-58ef-4e90-a82e-a3c722a53062": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Autonomous System", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f535c54f-1bb6-49f4-9e8b-30563db0ab24", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + }, + "f535c54f-1bb6-49f4-9e8b-30563db0ab24": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3c7ce74b-b430-42c8-971c-b2fd861de9e2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "1d928af4-d106-4b92-8bf8-a93d806bfcac", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "f535c54f-1bb6-49f4-9e8b-30563db0ab24" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "4e6460a1-58ef-4e90-a82e-a3c722a53062" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Autonomous Systems (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Type of Service", - "field": "netflow.ip_class_of_service", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "15", - "w": 16, - "x": 16, - "y": 12 - }, - "panelIndex": "15", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + "gridData": { + "h": 14, + "i": "22", + "w": 16, + "x": 16, + "y": 4 + }, + "panelIndex": "22", + "title": "[Logs Netflow] Autonomous Systems (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 4, - "i": "17", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "17", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "VLANs (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ad004840-3f8a-49af-a9e4-c37fca013fbd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "366e62ed-6136-49a1-b763-2db21f906e34", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ad004840-3f8a-49af-a9e4-c37fca013fbd": { + "columnOrder": [ + "6a1c559d-3971-4fda-abcc-f23e11d52b3a", + "7cd917d8-0e1a-4deb-b27d-d62ba4930ba9" + ], + "columns": { + "6a1c559d-3971-4fda-abcc-f23e11d52b3a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7cd917d8-0e1a-4deb-b27d-d62ba4930ba9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_name" + }, + "7cd917d8-0e1a-4deb-b27d-d62ba4930ba9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "366e62ed-6136-49a1-b763-2db21f906e34", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "ad004840-3f8a-49af-a9e4-c37fca013fbd", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7cd917d8-0e1a-4deb-b27d-d62ba4930ba9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "6a1c559d-3971-4fda-abcc-f23e11d52b3a" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Countries and Cities (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "25", + "w": 16, + "x": 32, + "y": 4 + }, + "panelIndex": "25", + "title": "[Logs Netflow] Top Countries (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-94664251-da8f-418a-9e0b-fd9d64b83d45", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b6793b85-6f31-49b7-b5f8-1281cd3fb02f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "94664251-da8f-418a-9e0b-fd9d64b83d45": { + "columnOrder": [ + "b642f8f9-43ff-4392-a928-7784f8990467", + "2ebcbc06-8dd5-47b7-bb21-ac3e46ca30e0" + ], + "columns": { + "2ebcbc06-8dd5-47b7-bb21-ac3e46ca30e0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "b642f8f9-43ff-4392-a928-7784f8990467": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Flow Exporter", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2ebcbc06-8dd5-47b7-bb21-ac3e46ca30e0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "agent.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b6793b85-6f31-49b7-b5f8-1281cd3fb02f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "b642f8f9-43ff-4392-a928-7784f8990467" + }, + { + "columnId": "2ebcbc06-8dd5-47b7-bb21-ac3e46ca30e0" + } + ], + "layerId": "94664251-da8f-418a-9e0b-fd9d64b83d45", + "layerType": "data" + } + }, + "title": "Flow Exporters (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "VLAN", - "field": "netflow.vlan_id", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "21", - "w": 16, - "x": 32, - "y": 12 - }, - "panelIndex": "21", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Autonomous Systems (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "gridData": { + "h": 14, + "i": "26", + "w": 16, + "x": 32, + "y": 18 + }, + "panelIndex": "26", + "title": "[Logs Netflow] Flow Exporters (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4c30555c-4ab4-4be7-b38a-d399a4bf6ed6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "461b7d41-55f0-499d-8ee6-b5f5d123cbc9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c30555c-4ab4-4be7-b38a-d399a4bf6ed6": { + "columnOrder": [ + "b99f2bb7-771f-43cd-abe5-a46b87705ccf", + "67d0e5f1-f75c-4aec-aca1-b468ec30e0cc" + ], + "columns": { + "67d0e5f1-f75c-4aec-aca1-b468ec30e0cc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "b99f2bb7-771f-43cd-abe5-a46b87705ccf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Direction", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "67d0e5f1-f75c-4aec-aca1-b468ec30e0cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "461b7d41-55f0-499d-8ee6-b5f5d123cbc9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "4c30555c-4ab4-4be7-b38a-d399a4bf6ed6", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "67d0e5f1-f75c-4aec-aca1-b468ec30e0cc" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "b99f2bb7-771f-43cd-abe5-a46b87705ccf" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Direction (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Autonomous System", - "field": "destination.as.organization.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "22", - "w": 16, - "x": 16, - "y": 20 - }, - "panelIndex": "22", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "TCP Flags (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "gridData": { + "h": 14, + "i": "27", + "w": 16, + "x": 0, + "y": 32 + }, + "panelIndex": "27", + "title": "[Logs Netflow] Direction (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c6a2f3df-0482-4c97-96b0-647aae3bd6ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d8a47584-e890-4729-8ee6-b39cf86cc2fd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c6a2f3df-0482-4c97-96b0-647aae3bd6ca": { + "columnOrder": [ + "ea502c33-8cc6-44b1-9b21-b01c819159fb", + "6122e4ed-3643-4649-a8c5-5a8363144846" + ], + "columns": { + "6122e4ed-3643-4649-a8c5-5a8363144846": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "ea502c33-8cc6-44b1-9b21-b01c819159fb": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6122e4ed-3643-4649-a8c5-5a8363144846", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.exporter.version" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d8a47584-e890-4729-8ee6-b39cf86cc2fd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "c6a2f3df-0482-4c97-96b0-647aae3bd6ca", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "6122e4ed-3643-4649-a8c5-5a8363144846" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ea502c33-8cc6-44b1-9b21-b01c819159fb" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Version (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "TCP Flags", - "field": "netflow.tcp_control_bits", - "order": "desc", - "orderBy": "1", - "size": 255 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 14, + "i": "29", + "w": 16, + "x": 32, + "y": 32 + }, + "panelIndex": "29", + "title": "[Logs Netflow] Version (bytes)", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T08:27:12.058Z", + "id": "netflow-34e26884-161a-4448-9556-43b5bf2f62a2", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "12:indexpattern-datasource-layer-a32b39b0-abd0-4f86-8776-155af5088b08", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "23", - "w": 16, - "x": 0, - "y": 12 + { + "id": "logs-*", + "name": "12:5271a3a3-d662-46fb-b463-860973830424", + "type": "index-pattern" }, - "panelIndex": "23", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Locality (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Locality", - "field": "flow.locality", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "13:indexpattern-datasource-layer-1d331db1-d01a-4636-ab7f-50e8ec30ff5a", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "24", - "w": 16, - "x": 0, - "y": 20 + { + "id": "logs-*", + "name": "13:807cce7d-4e0f-4afc-8546-ac7bd63eb332", + "type": "index-pattern" }, - "panelIndex": "24", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Countries and Cities (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Country", - "field": "destination.geo.country_name", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "City", - "field": "destination.geo.city_name", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "15:indexpattern-datasource-layer-678eafcb-c91b-479c-8fbc-8bd2bbdf1bc9", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "25", - "w": 16, - "x": 32, - "y": 20 + { + "id": "logs-*", + "name": "15:c406a009-4d91-45e0-98c6-f5a96b8df3f8", + "type": "index-pattern" }, - "panelIndex": "25", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Flow Exporters (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Flow Exporter", - "field": "agent.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "21:indexpattern-datasource-layer-0ac72630-c2c9-4631-abd3-1fa41c9ee1a8", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "26", - "w": 16, - "x": 0, - "y": 28 + { + "id": "logs-*", + "name": "21:8ece6d36-a28a-47e6-8349-625c2d5b7dde", + "type": "index-pattern" }, - "panelIndex": "26", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Direction (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Direction", - "field": "network.direction", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "22:indexpattern-datasource-layer-1d928af4-d106-4b92-8bf8-a93d806bfcac", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "27", - "w": 16, - "x": 16, - "y": 28 + { + "id": "logs-*", + "name": "22:3c7ce74b-b430-42c8-971c-b2fd861de9e2", + "type": "index-pattern" }, - "panelIndex": "27", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Version (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Version", - "field": "netflow.exporter.version", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "25:indexpattern-datasource-layer-ad004840-3f8a-49af-a9e4-c37fca013fbd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "25:366e62ed-6136-49a1-b763-2db21f906e34", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "29", - "w": 16, - "x": 32, - "y": 28 + { + "id": "logs-*", + "name": "26:indexpattern-datasource-layer-94664251-da8f-418a-9e0b-fd9d64b83d45", + "type": "index-pattern" }, - "panelIndex": "29", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "26:b6793b85-6f31-49b7-b5f8-1281cd3fb02f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27:indexpattern-datasource-layer-4c30555c-4ab4-4be7-b38a-d399a4bf6ed6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27:461b7d41-55f0-499d-8ee6-b5f5d123cbc9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "29:indexpattern-datasource-layer-c6a2f3df-0482-4c97-96b0-647aae3bd6ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "29:d8a47584-e890-4729-8ee6-b39cf86cc2fd", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Overview", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "12:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "13:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "14:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "15:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "21:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "22:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "23:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "24:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "25:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "26:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "27:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "29:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8.json b/packages/netflow/kibana/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8.json index 77b599cdfaa..bcc41f40fc4 100644 --- a/packages/netflow/kibana/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8.json +++ b/packages/netflow/kibana/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8.json @@ -1,2510 +1,3892 @@ { - "id": "netflow-38012abe-c611-4124-8497-381fcd85acc8", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2MiwxXQ==", - "attributes": { - "description": "Netflow traffic analysis", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Autonomous Systems (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "1", - "w": 24, - "x": 24, - "y": 84 - }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 4, - "i": "4", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Cities (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.geo.city_name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.geo.city_name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "5", - "w": 24, - "x": 24, - "y": 108 - }, - "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Countries (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.geo.country_name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.geo.country_name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "6", - "w": 24, - "x": 0, - "y": 108 - }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.port:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.port:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "7", - "w": 24, - "x": 24, - "y": 36 - }, - "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "TCP Flags (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"netflow.tcp_control_bits:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.tcp_control_bits:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "9", - "w": 24, - "x": 0, - "y": 84 - }, - "panelIndex": "9", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "VLANs (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"netflow.vlan_id:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.vlan_id:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "10", - "w": 24, - "x": 24, - "y": 60 - }, - "panelIndex": "10", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Types of Service (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"netflow.ip_class_of_service:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.ip_class_of_service:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "11", - "w": 24, - "x": 0, - "y": 60 - }, - "panelIndex": "11", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Source Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"source.port:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.port:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "12", - "w": 24, - "x": 0, - "y": 36 - }, - "panelIndex": "12", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Sources (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"source.ip:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.ip:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "13", - "w": 24, - "x": 0, - "y": 12 - }, - "panelIndex": "13", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.ip:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.ip:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Netflow traffic analysis", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } - }, - "gridData": { - "h": 8, - "i": "14", - "w": 24, - "x": 24, - "y": 12 }, - "panelIndex": "14", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "legendOpen": true - }, - "savedVis": { - "title": "Sources (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "15", - "w": 16, - "x": 0, - "y": 4 - }, - "panelIndex": "15", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Source Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 4, + "i": "4", + "w": 48, + "x": 0, + "y": 0 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Source Port", - "field": "source.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "16", - "w": 16, - "x": 0, - "y": 28 - }, - "panelIndex": "16", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "4", + "type": "visualization", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1cab711d-097d-480c-a9fb-2c55b91e224d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1cab711d-097d-480c-a9fb-2c55b91e224d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ba7efcae-97de-41b4-90e9-87a0b6991363" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "17", - "w": 16, - "x": 24, - "y": 4 - }, - "panelIndex": "17", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 16, + "i": "15", + "w": 9, + "x": 6, + "y": 4 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination Port", - "field": "destination.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "18", - "w": 16, - "x": 24, - "y": 28 - }, - "panelIndex": "18", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Types of Service (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "15", + "title": "[Logs Netflow] Sources (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1ac9ff91-70ef-4bb1-a9c3-08bfb89b1236", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45019342-7b8a-424c-8a06-59e71d2f630a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1ac9ff91-70ef-4bb1-a9c3-08bfb89b1236": { + "columnOrder": [ + "b356e425-6f88-42be-8dd8-774d3de2b309", + "e159c80c-9acd-4196-8d7e-2c771b02175c" + ], + "columns": { + "b356e425-6f88-42be-8dd8-774d3de2b309": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Source Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e159c80c-9acd-4196-8d7e-2c771b02175c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.port" + }, + "e159c80c-9acd-4196-8d7e-2c771b02175c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "45019342-7b8a-424c-8a06-59e71d2f630a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "1ac9ff91-70ef-4bb1-a9c3-08bfb89b1236", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "e159c80c-9acd-4196-8d7e-2c771b02175c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "b356e425-6f88-42be-8dd8-774d3de2b309" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Source Ports (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Type of Service", - "field": "netflow.ip_class_of_service", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "19", - "w": 16, - "x": 0, - "y": 52 - }, - "panelIndex": "19", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "VLANs (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 16, + "i": "16", + "w": 9, + "x": 15, + "y": 4 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "VLAN", - "field": "netflow.vlan_id", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "20", - "w": 16, - "x": 24, - "y": 52 - }, - "panelIndex": "20", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "TCP Flags (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "16", + "title": "[Logs Netflow] Source Ports (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2d387210-8b88-49f6-b380-078273c25b5a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3d2e484e-783b-4440-bc1c-8bcb82a6767d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2d387210-8b88-49f6-b380-078273c25b5a": { + "columnOrder": [ + "b77946a2-26c4-4b9e-ac1c-f1e435a84b6d", + "e77feccb-a619-4dee-8065-4f84295b5b2d" + ], + "columns": { + "b77946a2-26c4-4b9e-ac1c-f1e435a84b6d": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e77feccb-a619-4dee-8065-4f84295b5b2d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "e77feccb-a619-4dee-8065-4f84295b5b2d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3d2e484e-783b-4440-bc1c-8bcb82a6767d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "2d387210-8b88-49f6-b380-078273c25b5a", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "e77feccb-a619-4dee-8065-4f84295b5b2d" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "b77946a2-26c4-4b9e-ac1c-f1e435a84b6d" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destinations (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "TCP Flags", - "field": "netflow.tcp_control_bits", - "order": "desc", - "orderBy": "1", - "size": 255 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "21", - "w": 16, - "x": 0, - "y": 76 - }, - "panelIndex": "21", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Autonomous Systems (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 16, + "i": "17", + "w": 9, + "x": 39, + "y": 4 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Autonomous System", - "field": "destination.as.organization.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "22", - "w": 16, - "x": 24, - "y": 76 - }, - "panelIndex": "22", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Countries (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "17", + "title": "[Logs Netflow] Destinations (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1048ab56-2058-4214-8f0a-80e37157c1a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16b1167b-0cd7-493e-b225-fd6818d87b15", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1048ab56-2058-4214-8f0a-80e37157c1a6": { + "columnOrder": [ + "d55d27b5-f8a4-4825-b7aa-4b8422bc7179", + "66c29866-cab4-4af1-bc84-b2692a80f3dc" + ], + "columns": { + "66c29866-cab4-4af1-bc84-b2692a80f3dc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "d55d27b5-f8a4-4825-b7aa-4b8422bc7179": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66c29866-cab4-4af1-bc84-b2692a80f3dc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "16b1167b-0cd7-493e-b225-fd6818d87b15", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "1048ab56-2058-4214-8f0a-80e37157c1a6", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "66c29866-cab4-4af1-bc84-b2692a80f3dc" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "d55d27b5-f8a4-4825-b7aa-4b8422bc7179" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destination Ports (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Country", - "field": "destination.geo.country_name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "23", - "w": 16, - "x": 0, - "y": 100 - }, - "panelIndex": "23", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Cities (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + "gridData": { + "h": 16, + "i": "18", + "w": 9, + "x": 30, + "y": 4 }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "City", - "field": "destination.geo.city_name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "24", - "w": 16, - "x": 24, - "y": 100 - }, - "panelIndex": "24", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Sources (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"source.ip:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.ip:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" + "panelIndex": "18", + "title": "[Logs Netflow] Destination Ports (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "25", - "w": 24, - "x": 0, - "y": 20 - }, - "panelIndex": "25", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Destination Count [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "fontSize": "32", - "handleNoResults": true - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Destinations", - "field": "destination.ip" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "26", - "w": 8, - "x": 40, - "y": 4 - }, - "panelIndex": "26", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Source Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6c1284be-365c-43a6-852e-e815e2e9a7a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ce511757-6f27-461d-8692-ab2d6e7bdfb3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6c1284be-365c-43a6-852e-e815e2e9a7a3": { + "columnOrder": [ + "05b265d9-3f33-4926-b83a-27038b1c8c52", + "9b8a8fb8-eac2-452b-a424-c8744f3a9f2e" + ], + "columns": { + "05b265d9-3f33-4926-b83a-27038b1c8c52": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Type of Service", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9b8a8fb8-eac2-452b-a424-c8744f3a9f2e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "netflow.ip_class_of_service" + }, + "9b8a8fb8-eac2-452b-a424-c8744f3a9f2e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ce511757-6f27-461d-8692-ab2d6e7bdfb3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "6c1284be-365c-43a6-852e-e815e2e9a7a3", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "9b8a8fb8-eac2-452b-a424-c8744f3a9f2e" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "05b265d9-3f33-4926-b83a-27038b1c8c52" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Types of Service (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 14, + "i": "19", + "w": 10, + "x": 0, + "y": 57 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Sources", - "field": "source.ip" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "27", - "w": 8, - "x": 16, - "y": 4 - }, - "panelIndex": "27", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.ip:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.ip:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" + "panelIndex": "19", + "title": "[Logs Netflow] Types of Service (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "28", - "w": 24, - "x": 24, - "y": 20 - }, - "panelIndex": "28", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Destination Port Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-95382341-1244-4234-8730-a048364b7574", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b956fb26-9975-440c-957a-5a6b5e4c7faf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "95382341-1244-4234-8730-a048364b7574": { + "columnOrder": [ + "8684cc8b-d95d-4885-adac-fff93e628f0f", + "9c0f11ca-460b-4bea-8678-be3753fcf7ea" + ], + "columns": { + "8684cc8b-d95d-4885-adac-fff93e628f0f": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "VLAN", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c0f11ca-460b-4bea-8678-be3753fcf7ea", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.vlan_id" + }, + "9c0f11ca-460b-4bea-8678-be3753fcf7ea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b956fb26-9975-440c-957a-5a6b5e4c7faf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "95382341-1244-4234-8730-a048364b7574", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "9c0f11ca-460b-4bea-8678-be3753fcf7ea" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "8684cc8b-d95d-4885-adac-fff93e628f0f" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "VLANs (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "gridData": { + "h": 14, + "i": "20", + "w": 10, + "x": 0, + "y": 79 }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" - }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "20", + "title": "[Logs Netflow] VLANs (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Destination Ports", - "field": "destination.port" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "29", - "w": 8, - "x": 40, - "y": 28 - }, - "panelIndex": "29", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Source Port Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1b758e08-2446-48bb-9918-a14b822d0ef5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1dd2c076-4e0d-4610-8b4e-0d0786ae6ebc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1b758e08-2446-48bb-9918-a14b822d0ef5": { + "columnOrder": [ + "468481f4-9719-4067-8eba-d177b35a482f", + "a0fbc65d-8d7e-463b-b8bf-560535b5b6e8" + ], + "columns": { + "468481f4-9719-4067-8eba-d177b35a482f": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "TCP Flags", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a0fbc65d-8d7e-463b-b8bf-560535b5b6e8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.tcp_control_bits" + }, + "a0fbc65d-8d7e-463b-b8bf-560535b5b6e8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1dd2c076-4e0d-4610-8b4e-0d0786ae6ebc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "1b758e08-2446-48bb-9918-a14b822d0ef5", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "a0fbc65d-8d7e-463b-b8bf-560535b5b6e8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "468481f4-9719-4067-8eba-d177b35a482f" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "TCP Flags (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 14, + "i": "21", + "w": 10, + "x": 0, + "y": 101 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Source Ports", - "field": "source.port" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "30", - "w": 8, - "x": 16, - "y": 28 - }, - "panelIndex": "30", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Autonomous Systems (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" + "panelIndex": "21", + "title": "[Logs Netflow] TCP Flags (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "31", - "w": 24, - "x": 24, - "y": 92 - }, - "panelIndex": "31", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Cities (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.geo.city_name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.geo.city_name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "34", - "w": 24, - "x": 24, - "y": 116 - }, - "panelIndex": "34", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Countries (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.geo.country_name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.geo.country_name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "35", - "w": 24, - "x": 0, - "y": 116 - }, - "panelIndex": "35", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination Ports (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.port:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.port:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "38", - "w": 24, - "x": 24, - "y": 44 - }, - "panelIndex": "38", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Source Ports (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"source.port:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.port:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "42", - "w": 24, - "x": 0, - "y": 44 - }, - "panelIndex": "42", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "TCP Flags (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"netflow.tcp_control_bits:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.tcp_control_bits:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "44", - "w": 24, - "x": 0, - "y": 92 - }, - "panelIndex": "44", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Types of Service (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"netflow.ip_class_of_service:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.ip_class_of_service:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "45", - "w": 24, - "x": 0, - "y": 68 - }, - "panelIndex": "45", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "VLANs (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"netflow.vlan_id:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.vlan_id:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "47", - "w": 24, - "x": 24, - "y": 68 - }, - "panelIndex": "47", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "ToS Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-aad21337-f08a-46a0-8b67-d2264faf352f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "58dc65b2-56f7-4a1d-bf94-839042c1c653", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aad21337-f08a-46a0-8b67-d2264faf352f": { + "columnOrder": [ + "3ac443db-0d18-41ba-a4d3-5abe870bd753" + ], + "columns": { + "3ac443db-0d18-41ba-a4d3-5abe870bd753": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Destinations", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "destination.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "58dc65b2-56f7-4a1d-bf94-839042c1c653", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "aad21337-f08a-46a0-8b67-d2264faf352f", + "layerType": "data", + "metricAccessor": "3ac443db-0d18-41ba-a4d3-5abe870bd753" + } + }, + "title": "Destination Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 8, + "i": "26", + "w": 6, + "x": 24, + "y": 4 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "26", + "title": "[Logs Netflow] Destination Count", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Types of Service", - "field": "netflow.ip_class_of_service" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "48", - "w": 8, - "x": 16, - "y": 52 - }, - "panelIndex": "48", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "VLAN Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6b23250b-ef4b-4211-b889-cef0c8a40331", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ee68b4aa-b38a-4c69-bd62-26ef5398e608", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6b23250b-ef4b-4211-b889-cef0c8a40331": { + "columnOrder": [ + "48db4176-c18a-48a4-8605-bd2dd2d94e95" + ], + "columns": { + "48db4176-c18a-48a4-8605-bd2dd2d94e95": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sources", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ee68b4aa-b38a-4c69-bd62-26ef5398e608", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "6b23250b-ef4b-4211-b889-cef0c8a40331", + "layerType": "data", + "metricAccessor": "48db4176-c18a-48a4-8605-bd2dd2d94e95" + } + }, + "title": "Source Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "27", + "w": 6, + "x": 0, + "y": 4 + }, + "panelIndex": "27", + "title": "[Logs Netflow] Source Count", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e9d7d3d4-49ba-48da-a02c-1bb2e54884a8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "61050df4-dba1-47fb-b06b-c51951adb7b4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e9d7d3d4-49ba-48da-a02c-1bb2e54884a8": { + "columnOrder": [ + "3b9f9697-86fa-4c68-ba48-4c5b5be6134c" + ], + "columns": { + "3b9f9697-86fa-4c68-ba48-4c5b5be6134c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Destination Ports", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "destination.port" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "61050df4-dba1-47fb-b06b-c51951adb7b4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "e9d7d3d4-49ba-48da-a02c-1bb2e54884a8", + "layerType": "data", + "metricAccessor": "3b9f9697-86fa-4c68-ba48-4c5b5be6134c" + } + }, + "title": "Destination Port Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "29", + "w": 6, + "x": 24, + "y": 12 }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "panelIndex": "29", + "title": "[Logs Netflow] Destination Port Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6e8eac8d-8444-42bb-90c4-d3b1c419be94", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6e8eac8d-8444-42bb-90c4-d3b1c419be94": { + "columnOrder": [ + "8f361c76-49bd-4723-8e39-c61ddadec7d2" + ], + "columns": { + "8f361c76-49bd-4723-8e39-c61ddadec7d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Source Ports", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "source.port" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "6e8eac8d-8444-42bb-90c4-d3b1c419be94", + "layerType": "data", + "metricAccessor": "8f361c76-49bd-4723-8e39-c61ddadec7d2" + } + }, + "title": "Source Port Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 8, + "i": "30", + "w": 6, + "x": 0, + "y": 12 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "30", + "title": "[Logs Netflow] Source Port Count", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "VLANs", - "field": "netflow.vlan_id" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "49", - "w": 8, - "x": 40, - "y": 52 - }, - "panelIndex": "49", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Autonomous System Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e870aa43-8a63-4547-b933-ab9147b7802e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2f4682d5-6366-43b7-8828-a1e6240dc31b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e870aa43-8a63-4547-b933-ab9147b7802e": { + "columnOrder": [ + "4e806817-9594-43f2-bb37-3825df1575f5" + ], + "columns": { + "4e806817-9594-43f2-bb37-3825df1575f5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Types of Service", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "netflow.ip_class_of_service" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2f4682d5-6366-43b7-8828-a1e6240dc31b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "e870aa43-8a63-4547-b933-ab9147b7802e", + "layerType": "data", + "metricAccessor": "4e806817-9594-43f2-bb37-3825df1575f5" + } + }, + "title": "ToS Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 7, + "i": "48", + "w": 10, + "x": 0, + "y": 50 + }, + "panelIndex": "48", + "title": "[Logs Netflow] ToS Count", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7da7a80f-3f6e-47b7-99f6-a2c7924a2777", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "880ce52b-8997-4baa-a5c5-9d363e1eec56", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7da7a80f-3f6e-47b7-99f6-a2c7924a2777": { + "columnOrder": [ + "12212e5b-6da6-4446-ba64-1ad0d2cfd1ae" + ], + "columns": { + "12212e5b-6da6-4446-ba64-1ad0d2cfd1ae": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "VLANs", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "netflow.vlan_id" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "880ce52b-8997-4baa-a5c5-9d363e1eec56", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "7da7a80f-3f6e-47b7-99f6-a2c7924a2777", + "layerType": "data", + "metricAccessor": "12212e5b-6da6-4446-ba64-1ad0d2cfd1ae" + } + }, + "title": "VLAN Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "gridData": { + "h": 8, + "i": "49", + "w": 10, + "x": 0, + "y": 71 + }, + "panelIndex": "49", + "title": "[Logs Netflow] VLAN Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e16c0ae9-e03c-4742-a970-093973b57069", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dcdf1704-a1df-4640-85b2-bdf8e588426f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e16c0ae9-e03c-4742-a970-093973b57069": { + "columnOrder": [ + "7a8f7076-d7e9-41f1-9ac9-b8b9b79fc7b5" + ], + "columns": { + "7a8f7076-d7e9-41f1-9ac9-b8b9b79fc7b5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "TCP Flag States", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "netflow.tcp_control_bits" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dcdf1704-a1df-4640-85b2-bdf8e588426f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "e16c0ae9-e03c-4742-a970-093973b57069", + "layerType": "data", + "metricAccessor": "7a8f7076-d7e9-41f1-9ac9-b8b9b79fc7b5" + } + }, + "title": "TCP Flags Count [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 8, + "i": "53", + "w": 10, + "x": 0, + "y": 93 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "53", + "title": "[Logs Netflow] TCP Flags Count", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Autonomous Systems", - "field": "destination.as.organization.name" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "50", - "w": 8, - "x": 40, - "y": 76 - }, - "panelIndex": "50", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "City Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e68d9af6-ce7e-4938-a860-dde0ffe62662", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 5 values of source.ip", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e68d9af6-ce7e-4938-a860-dde0ffe62662", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a74fd437-6af1-45cf-a3dd-b9da4f0800c5", + "w": 24, + "x": 0, + "y": 20 + }, + "panelIndex": "a74fd437-6af1-45cf-a3dd-b9da4f0800c5", + "title": "[Logs Netflow] Sources (bytes)", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0d83992-011c-4437-b57a-7afd050ad8bf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 5 values of source.ip", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b0d83992-011c-4437-b57a-7afd050ad8bf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "gridData": { + "h": 15, + "i": "4225eddd-d189-410e-ad6a-c445a7c4abef", + "w": 24, + "x": 24, + "y": 20 }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "panelIndex": "4225eddd-d189-410e-ad6a-c445a7c4abef", + "title": "[Logs Netflow] Destination (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bf97a88a-94f1-4188-8757-602a7d3feac9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 5 values of source.ip", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bf97a88a-94f1-4188-8757-602a7d3feac9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "gridData": { + "h": 15, + "i": "885eebfd-1ad2-4026-9022-9391dd0a8e1a", + "w": 24, + "x": 0, + "y": 35 + }, + "panelIndex": "885eebfd-1ad2-4026-9022-9391dd0a8e1a", + "title": "[Logs Netflow] Sources (packets)", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Cities", - "field": "destination.geo.city_name" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "51", - "w": 8, - "x": 40, - "y": 100 - }, - "panelIndex": "51", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Country Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7021d78-1671-440f-8d11-5257cc2729cc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "ip", + "isBucketed": true, + "label": "Top 5 values of source.ip", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a7021d78-1671-440f-8d11-5257cc2729cc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b7f176ff-368c-4cee-b2bf-1733bf0d670f", + "w": 24, + "x": 24, + "y": 35 + }, + "panelIndex": "b7f176ff-368c-4cee-b2bf-1733bf0d670f", + "title": "[Logs Netflow] Destinations (packets)", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4a1e8aa7-c460-443e-83bf-7f1bbc85b014", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "number", + "isBucketed": true, + "label": "Top 5 values of netflow.ip_class_of_service", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.ip_class_of_service" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4a1e8aa7-c460-443e-83bf-7f1bbc85b014", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "48d2e3d2-d1e3-4ed2-a68b-6214d54c8c93", + "w": 38, + "x": 10, + "y": 50 }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "panelIndex": "48d2e3d2-d1e3-4ed2-a68b-6214d54c8c93", + "title": "[Logs Netflow] Services (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c4c65534-ccbd-4d77-8887-9f168a86aeb6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "dataType": "number", + "isBucketed": true, + "label": "Top 5 values of netflow.ip_class_of_service", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.ip_class_of_service" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c4c65534-ccbd-4d77-8887-9f168a86aeb6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 11, + "i": "0fd46505-9fcb-48cd-bef1-b2ebca96148d", + "w": 38, + "x": 10, + "y": 60 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "0fd46505-9fcb-48cd-bef1-b2ebca96148d", + "title": "[Logs Netflow] Services (packets)", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Countries", - "field": "destination.geo.country_name" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "52", - "w": 8, - "x": 16, - "y": 100 - }, - "panelIndex": "52", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "TCP Flags Count [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0263d326-434a-42ce-af58-757f4bfef004", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Vlans", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.vlan_id" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0263d326-434a-42ce-af58-757f4bfef004", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "54945796-e046-47e2-81a6-4a352595a069", + "w": 38, + "x": 10, + "y": 71 + }, + "panelIndex": "54945796-e046-47e2-81a6-4a352595a069", + "title": " [Logs Netflow] VLANs (bytes)", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0263d326-434a-42ce-af58-757f4bfef004", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Vlans", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.vlan_id" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0263d326-434a-42ce-af58-757f4bfef004", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "0a3aaeea-585e-4486-8371-777c827480b4", + "w": 38, + "x": 10, + "y": 82 }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "panelIndex": "0a3aaeea-585e-4486-8371-777c827480b4", + "title": "[Logs Netflow] VLANs (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "35355396-26a5-49bc-97af-8d44e2e324e4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Flags", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.tcp_control_bits" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "35355396-26a5-49bc-97af-8d44e2e324e4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 11, + "i": "a22d6b0c-165f-43f4-adae-72e575f31b5c", + "w": 38, + "x": 10, + "y": 93 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "a22d6b0c-165f-43f4-adae-72e575f31b5c", + "title": "[Logs Netflow] TCP Flags (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "TCP Flag States", - "field": "netflow.tcp_control_bits" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8c52318-586e-4c82-bf05-6c1d94319c21", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0cb5f801-d5de-4f1a-a795-09325dadec6a": { + "columnOrder": [ + "9a13f784-1095-4dba-a081-720654c92d4b", + "ba7efcae-97de-41b4-90e9-87a0b6991363", + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "columns": { + "9a13f784-1095-4dba-a081-720654c92d4b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Flags", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.tcp_control_bits" + }, + "ba7efcae-97de-41b4-90e9-87a0b6991363": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a8c52318-586e-4c82-bf05-6c1d94319c21", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "dc3dcfd6-f391-4eb7-a6c2-42ff421abbaa" + ], + "layerId": "0cb5f801-d5de-4f1a-a795-09325dadec6a", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9a13f784-1095-4dba-a081-720654c92d4b", + "xAccessor": "ba7efcae-97de-41b4-90e9-87a0b6991363" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "4025844a-48f0-4e53-93b2-7245df236e0f", + "w": 38, + "x": 10, + "y": 104 + }, + "panelIndex": "4025844a-48f0-4e53-93b2-7245df236e0f", + "title": "[Logs Netflow] TCP Flags (packets)", + "type": "lens", + "version": "8.7.1" } - } - }, - "gridData": { - "h": 8, - "i": "53", - "w": 8, - "x": 16, - "y": 76 - }, - "panelIndex": "53", - "type": "visualization", - "version": "8.0.0" - } - ], - "timeRestore": false, - "title": "[Logs Netflow] Traffic Analysis", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "15:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "16:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "17:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "18:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "19:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "20:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "21:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "22:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "23:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "24:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "26:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "27:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "29:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "30:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "48:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "49:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "50:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "51:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + ], + "timeRestore": false, + "title": "[Logs Netflow] Traffic Analysis", + "version": 1 }, - { - "type": "index-pattern", - "name": "52:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T09:29:25.515Z", + "id": "netflow-38012abe-c611-4124-8497-381fcd85acc8", + "migrationVersion": { + "dashboard": "8.7.0" }, - { - "type": "index-pattern", - "name": "53:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "references": [ + { + "id": "logs-*", + "name": "15:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "15:1cab711d-097d-480c-a9fb-2c55b91e224d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16:indexpattern-datasource-layer-1ac9ff91-70ef-4bb1-a9c3-08bfb89b1236", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "16:45019342-7b8a-424c-8a06-59e71d2f630a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17:indexpattern-datasource-layer-2d387210-8b88-49f6-b380-078273c25b5a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17:3d2e484e-783b-4440-bc1c-8bcb82a6767d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "18:indexpattern-datasource-layer-1048ab56-2058-4214-8f0a-80e37157c1a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "18:16b1167b-0cd7-493e-b225-fd6818d87b15", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "19:indexpattern-datasource-layer-6c1284be-365c-43a6-852e-e815e2e9a7a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "19:ce511757-6f27-461d-8692-ab2d6e7bdfb3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20:indexpattern-datasource-layer-95382341-1244-4234-8730-a048364b7574", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20:b956fb26-9975-440c-957a-5a6b5e4c7faf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "21:indexpattern-datasource-layer-1b758e08-2446-48bb-9918-a14b822d0ef5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "21:1dd2c076-4e0d-4610-8b4e-0d0786ae6ebc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26:indexpattern-datasource-layer-aad21337-f08a-46a0-8b67-d2264faf352f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "26:58dc65b2-56f7-4a1d-bf94-839042c1c653", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27:indexpattern-datasource-layer-6b23250b-ef4b-4211-b889-cef0c8a40331", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27:ee68b4aa-b38a-4c69-bd62-26ef5398e608", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "29:indexpattern-datasource-layer-e9d7d3d4-49ba-48da-a02c-1bb2e54884a8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "29:61050df4-dba1-47fb-b06b-c51951adb7b4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "30:indexpattern-datasource-layer-6e8eac8d-8444-42bb-90c4-d3b1c419be94", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48:indexpattern-datasource-layer-e870aa43-8a63-4547-b933-ab9147b7802e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48:2f4682d5-6366-43b7-8828-a1e6240dc31b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49:indexpattern-datasource-layer-7da7a80f-3f6e-47b7-99f6-a2c7924a2777", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49:880ce52b-8997-4baa-a5c5-9d363e1eec56", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53:indexpattern-datasource-layer-e16c0ae9-e03c-4742-a970-093973b57069", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53:dcdf1704-a1df-4640-85b2-bdf8e588426f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a74fd437-6af1-45cf-a3dd-b9da4f0800c5:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a74fd437-6af1-45cf-a3dd-b9da4f0800c5:e68d9af6-ce7e-4938-a860-dde0ffe62662", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4225eddd-d189-410e-ad6a-c445a7c4abef:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4225eddd-d189-410e-ad6a-c445a7c4abef:b0d83992-011c-4437-b57a-7afd050ad8bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "885eebfd-1ad2-4026-9022-9391dd0a8e1a:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "885eebfd-1ad2-4026-9022-9391dd0a8e1a:bf97a88a-94f1-4188-8757-602a7d3feac9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7f176ff-368c-4cee-b2bf-1733bf0d670f:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7f176ff-368c-4cee-b2bf-1733bf0d670f:a7021d78-1671-440f-8d11-5257cc2729cc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48d2e3d2-d1e3-4ed2-a68b-6214d54c8c93:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "48d2e3d2-d1e3-4ed2-a68b-6214d54c8c93:4a1e8aa7-c460-443e-83bf-7f1bbc85b014", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0fd46505-9fcb-48cd-bef1-b2ebca96148d:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0fd46505-9fcb-48cd-bef1-b2ebca96148d:c4c65534-ccbd-4d77-8887-9f168a86aeb6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54945796-e046-47e2-81a6-4a352595a069:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54945796-e046-47e2-81a6-4a352595a069:0263d326-434a-42ce-af58-757f4bfef004", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a3aaeea-585e-4486-8371-777c827480b4:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a3aaeea-585e-4486-8371-777c827480b4:0263d326-434a-42ce-af58-757f4bfef004", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a22d6b0c-165f-43f4-adae-72e575f31b5c:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a22d6b0c-165f-43f4-adae-72e575f31b5c:35355396-26a5-49bc-97af-8d44e2e324e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4025844a-48f0-4e53-93b2-7245df236e0f:indexpattern-datasource-layer-0cb5f801-d5de-4f1a-a795-09325dadec6a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4025844a-48f0-4e53-93b2-7245df236e0f:a8c52318-586e-4c82-bf05-6c1d94319c21", + "type": "index-pattern" + } + ], + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024.json b/packages/netflow/kibana/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024.json index fdf14e0990b..ed67bed179a 100644 --- a/packages/netflow/kibana/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024.json +++ b/packages/netflow/kibana/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024.json @@ -1,394 +1,763 @@ { - "id": "netflow-77326664-23be-4bf1-a126-6d7e60cfc024", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2MywxXQ==", - "attributes": { - "description": "Netflow geo location", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": { - "query": "netflow.log" - } - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Countries and Cities (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Country", - "field": "destination.geo.country_name", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "City", - "field": "destination.geo.city_name", - "order": "desc", - "orderBy": "1", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { + "attributes": { + "description": "Netflow geo location", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 8, - "i": "17", - "w": 16, - "x": 0, - "y": 4 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "17", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations and Sources (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-23eaa24c-e385-4abb-ad5a-5010256f85a0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b64a27c4-d81f-4f50-ab9e-4114f311e260", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "23eaa24c-e385-4abb-ad5a-5010256f85a0": { + "columnOrder": [ + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad", + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b" + ], + "columns": { + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7c37afe2-4a25-45f7-a325-02af0e3f2c9b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_name" + }, + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b64a27c4-d81f-4f50-ab9e-4114f311e260", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "23eaa24c-e385-4abb-ad5a-5010256f85a0", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Countries and Cities (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "17", + "w": 12, + "x": 0, + "y": 4 + }, + "panelIndex": "17", + "title": "[Logs Netflow] Countries (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-aba4a3ef-23da-4610-85b6-a413968fa7c2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "01ada46a-c945-4f3e-afd0-b825e6fda78c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aba4a3ef-23da-4610-85b6-a413968fa7c2": { + "columnOrder": [ + "d4bd55e0-3af0-442e-ae2e-c34a21937e44", + "0e05dfaf-992a-4786-a275-d780623cd9d6" + ], + "columns": { + "0e05dfaf-992a-4786-a275-d780623cd9d6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d4bd55e0-3af0-442e-ae2e-c34a21937e44": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0e05dfaf-992a-4786-a275-d780623cd9d6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "01ada46a-c945-4f3e-afd0-b825e6fda78c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "aba4a3ef-23da-4610-85b6-a413968fa7c2", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "0e05dfaf-992a-4786-a275-d780623cd9d6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "d4bd55e0-3af0-442e-ae2e-c34a21937e44" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destinations and Sources (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 17, + "i": "18", + "w": 12, + "x": 24, + "y": 4 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "18", - "w": 16, - "x": 0, - "y": 12 - }, - "panelIndex": "18", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination and Source Ports (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "18", + "title": "[Logs Netflow] Destinations (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e9f461de-4c85-422b-97bc-5c58e0206863", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49672c1f-7686-4771-bd1d-6f1da877e313", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e9f461de-4c85-422b-97bc-5c58e0206863": { + "columnOrder": [ + "e08820d1-190e-451b-aa00-461cb7807d18", + "84caad2b-9144-4ed5-98ad-9265baa058a1" + ], + "columns": { + "84caad2b-9144-4ed5-98ad-9265baa058a1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e08820d1-190e-451b-aa00-461cb7807d18": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "84caad2b-9144-4ed5-98ad-9265baa058a1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "49672c1f-7686-4771-bd1d-6f1da877e313", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "e9f461de-4c85-422b-97bc-5c58e0206863", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "84caad2b-9144-4ed5-98ad-9265baa058a1" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "e08820d1-190e-451b-aa00-461cb7807d18" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destination and Source Ports (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination Port", - "field": "destination.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 17, + "i": "19", + "w": 12, + "x": 36, + "y": 4 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source Port", - "field": "source.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "panelIndex": "19", + "title": "[Logs Netflow] Destination Ports (flow records)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "20", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "20", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-23eaa24c-e385-4abb-ad5a-5010256f85a0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17010fb9-9488-4ef6-8664-e8d6c3423410", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "23eaa24c-e385-4abb-ad5a-5010256f85a0": { + "columnOrder": [ + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad", + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b" + ], + "columns": { + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "City", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7c37afe2-4a25-45f7-a325-02af0e3f2c9b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.geo.city_name" + }, + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "17010fb9-9488-4ef6-8664-e8d6c3423410", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "inside", + "emptySizeRatio": 0.3, + "layerId": "23eaa24c-e385-4abb-ad5a-5010256f85a0", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7c37afe2-4a25-45f7-a325-02af0e3f2c9b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "3e4ff226-e8f0-4b19-b83e-e46d4b0f2bad" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Countries and Cities (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 17, + "i": "afaf7bd6-49b8-4ee2-b4e1-2ca2143b9a4c", + "w": 12, + "x": 12, + "y": 4 + }, + "panelIndex": "afaf7bd6-49b8-4ee2-b4e1-2ca2143b9a4c", + "title": "[Logs Netflow] Cities (flow records)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"9afd9bfb-ab56-4bc3-a8c6-e412c1bc7f24\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"85982ce7-be78-44ec-a692-96c118b3a187\",\"includeInFitToBounds\":true,\"label\":\"Destination Geo Location Heatmap [Logs Netflow]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"destination.geo.location\",\"id\":\"6972252f-e3a3-4886-abfb-bea957bc1c73\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"netflow.log\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"netflow.log\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "Destination Geo Location Heatmap [Logs Netflow]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "isLayerTOCOpen": true, + "mapBuffer": { + "maxLat": 66.51326, + "maxLon": 90, + "minLat": -66.51326, + "minLon": -90 + }, + "mapCenter": { + "lat": 16.40767, + "lon": 0, + "zoom": 1.78 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 27, + "i": "41aa0e4c-7e76-4715-bf20-c756e74ffe02", + "w": 48, + "x": 0, + "y": 21 + }, + "panelIndex": "41aa0e4c-7e76-4715-bf20-c756e74ffe02", + "type": "map", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Geo Location", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T09:35:13.956Z", + "id": "netflow-77326664-23be-4bf1-a126-6d7e60cfc024", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "17:indexpattern-datasource-layer-23eaa24c-e385-4abb-ad5a-5010256f85a0", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "19", - "w": 16, - "x": 0, - "y": 20 + { + "id": "logs-*", + "name": "17:b64a27c4-d81f-4f50-ab9e-4114f311e260", + "type": "index-pattern" }, - "panelIndex": "19", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "18:indexpattern-datasource-layer-aba4a3ef-23da-4610-85b6-a413968fa7c2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "18:01ada46a-c945-4f3e-afd0-b825e6fda78c", + "type": "index-pattern" }, - "gridData": { - "h": 4, - "i": "20", - "w": 48, - "x": 0, - "y": 0 + { + "id": "logs-*", + "name": "19:indexpattern-datasource-layer-e9f461de-4c85-422b-97bc-5c58e0206863", + "type": "index-pattern" }, - "panelIndex": "20", - "type": "visualization", - "version": "8.0.0" - }, - { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 24, - "i": "41aa0e4c-7e76-4715-bf20-c756e74ffe02", - "w": 32, - "x": 16, - "y": 4 + { + "id": "logs-*", + "name": "19:49672c1f-7686-4771-bd1d-6f1da877e313", + "type": "index-pattern" }, - "panelIndex": "41aa0e4c-7e76-4715-bf20-c756e74ffe02", - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"9afd9bfb-ab56-4bc3-a8c6-e412c1bc7f24\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"85982ce7-be78-44ec-a692-96c118b3a187\",\"includeInFitToBounds\":true,\"label\":\"Destination Geo Location Heatmap [Logs Netflow]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"destination.geo.location\",\"id\":\"6972252f-e3a3-4886-abfb-bea957bc1c73\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-24h\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], - "title": "Destination Geo Location Heatmap [Logs Netflow]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "enhancements": {}, - "hiddenLayers": [], - "isLayerTOCOpen": true, - "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 - }, - "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 - }, - "openTOCDetails": [], - "type": "map" + { + "id": "logs-*", + "name": "afaf7bd6-49b8-4ee2-b4e1-2ca2143b9a4c:indexpattern-datasource-layer-23eaa24c-e385-4abb-ad5a-5010256f85a0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "afaf7bd6-49b8-4ee2-b4e1-2ca2143b9a4c:17010fb9-9488-4ef6-8664-e8d6c3423410", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "41aa0e4c-7e76-4715-bf20-c756e74ffe02:layer_1_source_index_pattern", + "type": "index-pattern" } - } ], - "timeRestore": false, - "title": "[Logs Netflow] Geo Location", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "41aa0e4c-7e76-4715-bf20-c756e74ffe02:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "17:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "18:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "19:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365.json b/packages/netflow/kibana/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365.json index 3d115831250..1cb2de8b617 100644 --- a/packages/netflow/kibana/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365.json +++ b/packages/netflow/kibana/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365.json @@ -1,387 +1,427 @@ { - "id": "netflow-94972700-de4a-4272-9143-2fa8d4981365", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2NCwxXQ==", - "attributes": { - "description": "Netflow flow records", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Flow Records [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "legendOpen": true - } - }, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "defaultYExtents": false, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "legendPosition": "right", - "mode": "stacked", - "scale": "linear", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Flow Records" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "setYExtents": false, - "times": [], - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Timeline", - "extended_bounds": {}, - "field": "event.end", - "interval": "s", - "min_doc_count": 1 - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Version", - "field": "netflow.exporter.version", - "order": "desc", - "orderBy": "1", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { + "attributes": { + "description": "Netflow flow records", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 8, - "i": "2", - "w": 36, - "x": 12, - "y": 4 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - }, - "savedVis": { - "title": "Flow Records [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "fontSize": "32", - "gauge": { - "autoExtend": false, - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "gaugeColorMode": "None", - "gaugeStyle": "Full", - "gaugeType": "Metric", - "invertColors": false, - "labels": { - "color": "black", - "show": true + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5a9727c2-9290-4b96-8433-1c935f940183", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ec4ab51-fcfb-456f-a7a1-827294007e94", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5a9727c2-9290-4b96-8433-1c935f940183": { + "columnOrder": [ + "407ecb91-70e2-402d-9093-841b8d95524e", + "c0330834-0cc5-46b2-a614-eefd1b15b5fa", + "63e601c0-acf8-48e6-a3a8-c64d68bfe7c5" + ], + "columns": { + "407ecb91-70e2-402d-9093-841b8d95524e": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Timeline", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "ignoreTimeRange": false, + "includeEmptyRows": false, + "interval": "30s" + }, + "scale": "interval", + "sourceField": "event.end" + }, + "63e601c0-acf8-48e6-a3a8-c64d68bfe7c5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "c0330834-0cc5-46b2-a614-eefd1b15b5fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "63e601c0-acf8-48e6-a3a8-c64d68bfe7c5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "netflow.exporter.version" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8ec4ab51-fcfb-456f-a7a1-827294007e94", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "63e601c0-acf8-48e6-a3a8-c64d68bfe7c5" + ], + "isHistogram": true, + "layerId": "5a9727c2-9290-4b96-8433-1c935f940183", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "c0330834-0cc5-46b2-a614-eefd1b15b5fa", + "xAccessor": "407ecb91-70e2-402d-9093-841b8d95524e", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "63e601c0-acf8-48e6-a3a8-c64d68bfe7c5" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Flow Records [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "2", + "w": 36, + "x": 12, + "y": 4 }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": false, - "width": 2 + "panelIndex": "2", + "title": "[Logs Netflow] Flow Records", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e3838936-fa5d-4f5c-8089-b49b27dc0deb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0c428bc6-3a9e-4dec-a228-ec97fd8dc5dd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e3838936-fa5d-4f5c-8089-b49b27dc0deb": { + "columnOrder": [ + "85c25222-c999-4948-8bf6-9bdf6af9903b" + ], + "columns": { + "85c25222-c999-4948-8bf6-9bdf6af9903b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "0c428bc6-3a9e-4dec-a228-ec97fd8dc5dd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "e3838936-fa5d-4f5c-8089-b49b27dc0deb", + "layerType": "data", + "metricAccessor": "85c25222-c999-4948-8bf6-9bdf6af9903b" + } + }, + "title": "Flow Records [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {} }, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": "36", - "labelColor": false, - "subText": "" + "gridData": { + "h": 11, + "i": "3", + "w": 12, + "x": 0, + "y": 4 }, - "type": "simple", - "useRange": false, - "verticalSplit": false - }, - "handleNoResults": true, - "type": "gauge" + "panelIndex": "3", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "3", - "w": 12, - "x": 0, - "y": 4 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "4", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "4", + "type": "visualization", + "version": "8.7.1" }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + { + "embeddableConfig": { + "columns": [ + "source.ip", + "source.port", + "destination.ip", + "destination.port", + "network.transport", + "network.bytes", + "network.packets" + ], + "enhancements": {}, + "sort": [ + "@timestamp", + "desc" + ] + }, + "gridData": { + "h": 23, + "i": "5", + "w": 48, + "x": 0, + "y": 15 + }, + "panelIndex": "5", + "panelRefName": "panel_5", + "type": "search", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Flow records", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T09:38:28.784Z", + "id": "netflow-94972700-de4a-4272-9143-2fa8d4981365", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-5a9727c2-9290-4b96-8433-1c935f940183", + "type": "index-pattern" }, - "gridData": { - "h": 4, - "i": "4", - "w": 48, - "x": 0, - "y": 0 + { + "id": "logs-*", + "name": "2:8ec4ab51-fcfb-456f-a7a1-827294007e94", + "type": "index-pattern" }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "columns": [ - "source.ip", - "source.port", - "destination.ip", - "destination.port", - "network.transport", - "network.bytes", - "network.packets" - ], - "enhancements": {}, - "sort": [ - "@timestamp", - "desc" - ] + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-e3838936-fa5d-4f5c-8089-b49b27dc0deb", + "type": "index-pattern" }, - "gridData": { - "h": 16, - "i": "5", - "w": 48, - "x": 0, - "y": 12 + { + "id": "logs-*", + "name": "3:0c428bc6-3a9e-4dec-a228-ec97fd8dc5dd", + "type": "index-pattern" }, - "panelIndex": "5", - "panelRefName": "panel_5", - "type": "search", - "version": "7.3.0" - } + { + "id": "netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a", + "name": "5:panel_5", + "type": "search" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Flow records", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a", - "name": "5:panel_5", - "type": "search" - }, - { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32.json b/packages/netflow/kibana/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32.json index f2e48c4ae60..c747f5e2488 100644 --- a/packages/netflow/kibana/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32.json +++ b/packages/netflow/kibana/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32.json @@ -1,533 +1,912 @@ { - "id": "netflow-acd7a630-0c71-4840-bc9e-4a3801374a32", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2NSwxXQ==", - "attributes": { - "description": "Netflow conversation partners", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "vis": { - "params": { - "sort": { - "columnIndex": 2, - "direction": "desc" - } - } - }, - "savedVis": { - "title": "Conversation Partners [Logs Netflow]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 2, - "direction": "desc" - } - } - } - }, - "params": { - "perPage": 10, - "showMeticsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": 2, - "direction": "desc" - }, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Packets", - "field": "network.packets" - }, - "schema": "metric", - "type": "sum" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "attributes": { + "description": "Netflow conversation partners", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": { + "query": "netflow.log" + } + } + } + } + ], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 20, - "i": "1", - "w": 48, - "x": 0, - "y": 12 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "IP Version and Protocols (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-24cf9c44-7410-47c6-adbb-e2a80894087c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a9031730-af31-4593-9bd1-95324bc56282", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "24cf9c44-7410-47c6-adbb-e2a80894087c": { + "columnOrder": [ + "6205dc8d-034d-46ff-8f8a-6b65418bb3a1", + "01b7adc0-06f7-4dc6-aa55-7400afa7e07d", + "2832f683-832c-4d34-b80d-9598b45bf501", + "0c616dff-5b8f-4097-a5fb-0042e0f27e66", + "3b664ac2-e1aa-4c8a-bfd3-ad33be691293" + ], + "columns": { + "01b7adc0-06f7-4dc6-aa55-7400afa7e07d": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2832f683-832c-4d34-b80d-9598b45bf501", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "0c616dff-5b8f-4097-a5fb-0042e0f27e66": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "2832f683-832c-4d34-b80d-9598b45bf501": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "3b664ac2-e1aa-4c8a-bfd3-ad33be691293": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "6205dc8d-034d-46ff-8f8a-6b65418bb3a1": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2832f683-832c-4d34-b80d-9598b45bf501", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "source.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a9031730-af31-4593-9bd1-95324bc56282", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "2832f683-832c-4d34-b80d-9598b45bf501" + }, + { + "alignment": "left", + "columnId": "0c616dff-5b8f-4097-a5fb-0042e0f27e66" + }, + { + "alignment": "left", + "columnId": "3b664ac2-e1aa-4c8a-bfd3-ad33be691293" + }, + { + "alignment": "left", + "columnId": "6205dc8d-034d-46ff-8f8a-6b65418bb3a1" + }, + { + "alignment": "left", + "columnId": "01b7adc0-06f7-4dc6-aa55-7400afa7e07d" + } + ], + "headerRowHeight": "single", + "layerId": "24cf9c44-7410-47c6-adbb-e2a80894087c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Conversation Partners [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "params": {} - }, - { - "accessor": 2, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 20, + "i": "1", + "w": 48, + "x": 0, + "y": 24 + }, + "panelIndex": "1", + "title": "[Logs Netflow] Conversation Partners", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d838eccb-d87e-4c59-9fbf-91b5ff2eb593", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eef6405a-d699-424a-b418-c83d705eb8fc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d838eccb-d87e-4c59-9fbf-91b5ff2eb593": { + "columnOrder": [ + "9bdc2850-5971-4f21-b0c8-203b45975890", + "83f1d9f6-008f-4edd-b9fa-23102c3ece0b", + "45357f95-2276-4d6a-af19-fa264a3fb8ea" + ], + "columns": { + "45357f95-2276-4d6a-af19-fa264a3fb8ea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "83f1d9f6-008f-4edd-b9fa-23102c3ece0b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "45357f95-2276-4d6a-af19-fa264a3fb8ea", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "9bdc2850-5971-4f21-b0c8-203b45975890": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "IP Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "45357f95-2276-4d6a-af19-fa264a3fb8ea", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "network.type" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "eef6405a-d699-424a-b418-c83d705eb8fc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "d838eccb-d87e-4c59-9fbf-91b5ff2eb593", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "45357f95-2276-4d6a-af19-fa264a3fb8ea" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "9bdc2850-5971-4f21-b0c8-203b45975890", + "83f1d9f6-008f-4edd-b9fa-23102c3ece0b" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "IP Version and Protocols (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "params": {} - } - ], - "metric": { - "accessor": 1, - "aggType": "sum", - "format": { - "id": "bytes" - }, - "params": {} - } - }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 20, + "i": "2", + "w": 16, + "x": 32, + "y": 4 + }, + "panelIndex": "2", + "title": "[Logs Netflow] IP Version and Protocols (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bf4a5620-e081-4707-a709-afda49f1e90c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c21570d0-eda3-4a29-a37d-1230303ef1d7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bf4a5620-e081-4707-a709-afda49f1e90c": { + "columnOrder": [ + "1f65a04b-fde5-4fb1-91e4-ea902b1df944", + "229a91df-155d-4436-95df-050f3a73d05f", + "44e3914b-0e37-41c1-a1dc-c542b92ba01b" + ], + "columns": { + "1f65a04b-fde5-4fb1-91e4-ea902b1df944": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44e3914b-0e37-41c1-a1dc-c542b92ba01b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "229a91df-155d-4436-95df-050f3a73d05f": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44e3914b-0e37-41c1-a1dc-c542b92ba01b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "44e3914b-0e37-41c1-a1dc-c542b92ba01b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c21570d0-eda3-4a29-a37d-1230303ef1d7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "bf4a5620-e081-4707-a709-afda49f1e90c", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "44e3914b-0e37-41c1-a1dc-c542b92ba01b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "1f65a04b-fde5-4fb1-91e4-ea902b1df944", + "229a91df-155d-4436-95df-050f3a73d05f" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destinations and Sources (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "IP Version", - "field": "network.type", - "missingBucket": true, - "missingBucketLabel": "unset ip version", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 20, + "i": "3", + "w": 16, + "x": 0, + "y": 4 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Protocol", - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "2", - "w": 16, - "x": 32, - "y": 4 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations and Sources (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "3", + "title": "[Logs Netflow] Destinations and Sources (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-24f11490-5153-4265-a96a-10eee403681a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fbf0c525-8f94-4908-ad24-6a81948bede3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "24f11490-5153-4265-a96a-10eee403681a": { + "columnOrder": [ + "d6e9de67-0bf7-4787-a72f-b05ba23c1653", + "8924511f-c48f-4628-871c-43be6988b0c9", + "ff2b3be6-d9fa-4d8a-877a-dae734ccbb93" + ], + "columns": { + "8924511f-c48f-4628-871c-43be6988b0c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Source Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ff2b3be6-d9fa-4d8a-877a-dae734ccbb93", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.port" + }, + "d6e9de67-0bf7-4787-a72f-b05ba23c1653": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ff2b3be6-d9fa-4d8a-877a-dae734ccbb93", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + }, + "ff2b3be6-d9fa-4d8a-877a-dae734ccbb93": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "fbf0c525-8f94-4908-ad24-6a81948bede3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "24f11490-5153-4265-a96a-10eee403681a", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "ff2b3be6-d9fa-4d8a-877a-dae734ccbb93" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "d6e9de67-0bf7-4787-a72f-b05ba23c1653", + "8924511f-c48f-4628-871c-43be6988b0c9" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destination and Source Ports (bytes) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 20, + "i": "4", + "w": 16, + "x": 16, + "y": 4 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "3", - "w": 16, - "x": 0, - "y": 4 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination and Source Ports (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "4", + "title": "[Logs Netflow] Destination and Source Ports (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Bytes", - "field": "network.bytes" - }, - "schema": "metric", - "type": "sum" + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination Port", - "field": "destination.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 4, + "i": "5", + "w": 48, + "x": 0, + "y": 0 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source Port", - "field": "source.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "panelIndex": "5", + "type": "visualization", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Conversation Partners", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T09:42:39.428Z", + "id": "netflow-acd7a630-0c71-4840-bc9e-4a3801374a32", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "4", - "w": 16, - "x": 16, - "y": 4 + { + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-24cf9c44-7410-47c6-adbb-e2a80894087c", + "type": "index-pattern" }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "1:a9031730-af31-4593-9bd1-95324bc56282", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-d838eccb-d87e-4c59-9fbf-91b5ff2eb593", + "type": "index-pattern" }, - "gridData": { - "h": 4, - "i": "5", - "w": 48, - "x": 0, - "y": 0 + { + "id": "logs-*", + "name": "2:eef6405a-d699-424a-b418-c83d705eb8fc", + "type": "index-pattern" }, - "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-bf4a5620-e081-4707-a709-afda49f1e90c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3:c21570d0-eda3-4a29-a37d-1230303ef1d7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-24f11490-5153-4265-a96a-10eee403681a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:fbf0c525-8f94-4908-ad24-6a81948bede3", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Conversation Partners", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "1:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "4:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a.json b/packages/netflow/kibana/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a.json index 05f4ca86f23..7e55a21ff7a 100644 --- a/packages/netflow/kibana/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a.json +++ b/packages/netflow/kibana/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a.json @@ -1,495 +1,1158 @@ { - "id": "netflow-c64665f9-d222-421e-90b0-c7310d944b8a", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2NiwxXQ==", - "attributes": { - "description": "Autonomous systems Netflow", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Autonomous systems Netflow", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 4, - "i": "1", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination Autonomous Systems (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"destination.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "2", - "w": 24, - "x": 24, - "y": 12 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination Autonomous Systems (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"destination.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* destination.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "1", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "1", + "type": "visualization", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "3", - "w": 24, - "x": 24, - "y": 20 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Source Autonomous Systems (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"source.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "741b4fab-abc2-422f-bc96-cb0a1147f94d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ffaafa43-4c5e-4650-89f9-7399c6275ace", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ffaafa43-4c5e-4650-89f9-7399c6275ace": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "741b4fab-abc2-422f-bc96-cb0a1147f94d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ffaafa43-4c5e-4650-89f9-7399c6275ace" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 20, + "i": "6", + "w": 12, + "x": 0, + "y": 25 + }, + "panelIndex": "6", + "title": "[Logs Netflow] Destination AS (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "4", - "w": 24, - "x": 0, - "y": 12 - }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Source Autonomous Systems (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"source.as.organization.name:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* source.as.organization.name:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "551cdef4-bf8c-431c-a2d6-336c91ce3727", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ffaafa43-4c5e-4650-89f9-7399c6275ace", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ffaafa43-4c5e-4650-89f9-7399c6275ace": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "551cdef4-bf8c-431c-a2d6-336c91ce3727", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ffaafa43-4c5e-4650-89f9-7399c6275ace" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 21, + "i": "f61eed00-8d57-41bb-9b66-e04f49e42472", + "w": 12, + "x": 0, + "y": 4 + }, + "panelIndex": "f61eed00-8d57-41bb-9b66-e04f49e42472", + "title": "[Logs Netflow] Source AS (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "5", - "w": 24, - "x": 0, - "y": 20 - }, - "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination and Source ASs (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e616c1c-7e0d-4c2d-a9d5-f47ed26d4320", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "e1442a72-1d24-49d6-9cf6-159df845ff39", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "e1442a72-1d24-49d6-9cf6-159df845ff39": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec8dd35b-6194-4d46-81af-7bdff3995c1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5e616c1c-7e0d-4c2d-a9d5-f47ed26d4320", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "xAccessor": "e1442a72-1d24-49d6-9cf6-159df845ff39" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "6dbfb709-d468-458e-898a-c876afa775a3", + "w": 36, + "x": 12, + "y": 4 + }, + "panelIndex": "6dbfb709-d468-458e-898a-c876afa775a3", + "title": "[Logs Netflow] Source Autonomous Systems (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2c5f7633-d1b9-46e0-a95f-c6586efe8da9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "e1442a72-1d24-49d6-9cf6-159df845ff39", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "e1442a72-1d24-49d6-9cf6-159df845ff39": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec8dd35b-6194-4d46-81af-7bdff3995c1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2c5f7633-d1b9-46e0-a95f-c6586efe8da9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "xAccessor": "e1442a72-1d24-49d6-9cf6-159df845ff39" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination AS", - "field": "destination.as.organization.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 11, + "i": "3367d41e-f412-40f5-a6c9-62e572450d4b", + "w": 36, + "x": 12, + "y": 14 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source AS", - "field": "source.as.organization.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "6", - "w": 16, - "x": 0, - "y": 4 - }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destinations and Sources (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "3367d41e-f412-40f5-a6c9-62e572450d4b", + "title": "[Logs Netflow] Source Autonomous Systems (packets)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23cc1bde-9938-4b1c-bdac-6d55c33fa535", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "e1442a72-1d24-49d6-9cf6-159df845ff39", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "e1442a72-1d24-49d6-9cf6-159df845ff39": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec8dd35b-6194-4d46-81af-7bdff3995c1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "23cc1bde-9938-4b1c-bdac-6d55c33fa535", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "xAccessor": "e1442a72-1d24-49d6-9cf6-159df845ff39" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination", - "field": "destination.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 10, + "i": "f9b40d0c-2478-4d3e-8443-79db5bfa91aa", + "w": 36, + "x": 12, + "y": 25 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source", - "field": "source.ip", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "7", - "w": 16, - "x": 16, - "y": 4 - }, - "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Destination and Source Ports (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelIndex": "f9b40d0c-2478-4d3e-8443-79db5bfa91aa", + "title": "[Logs Netflow] Destination Autonomous Systems (bytes)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b52e292e-11ad-47c7-9daa-8c6ba4e29879", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd": { + "columnOrder": [ + "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "e1442a72-1d24-49d6-9cf6-159df845ff39", + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "columns": { + "6b5eeb40-16b0-4db0-8630-a171572df7c9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "e1442a72-1d24-49d6-9cf6-159df845ff39": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "ec8dd35b-6194-4d46-81af-7bdff3995c1a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Destination AS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b5eeb40-16b0-4db0-8630-a171572df7c9", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.as.organization.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b52e292e-11ad-47c7-9daa-8c6ba4e29879", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b5eeb40-16b0-4db0-8630-a171572df7c9" + ], + "layerId": "a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "ec8dd35b-6194-4d46-81af-7bdff3995c1a", + "xAccessor": "e1442a72-1d24-49d6-9cf6-159df845ff39" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Destination and Source ASs (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Destination Port", - "field": "destination.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 10, + "i": "ccfe3f6c-a009-4151-b0e5-f90ec7a7ee7d", + "w": 36, + "x": 12, + "y": 35 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Source Port", - "field": "source.port", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "panelIndex": "ccfe3f6c-a009-4151-b0e5-f90ec7a7ee7d", + "title": "[Logs Netflow] Destination Autonomous Systems packets)", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Autonomous Systems", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T10:03:55.308Z", + "id": "netflow-c64665f9-d222-421e-90b0-c7310d944b8a", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "6:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6:741b4fab-abc2-422f-bc96-cb0a1147f94d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f61eed00-8d57-41bb-9b66-e04f49e42472:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f61eed00-8d57-41bb-9b66-e04f49e42472:551cdef4-bf8c-431c-a2d6-336c91ce3727", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "8", - "w": 16, - "x": 32, - "y": 4 + { + "id": "logs-*", + "name": "6dbfb709-d468-458e-898a-c876afa775a3:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" }, - "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "6dbfb709-d468-458e-898a-c876afa775a3:5e616c1c-7e0d-4c2d-a9d5-f47ed26d4320", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3367d41e-f412-40f5-a6c9-62e572450d4b:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3367d41e-f412-40f5-a6c9-62e572450d4b:2c5f7633-d1b9-46e0-a95f-c6586efe8da9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9b40d0c-2478-4d3e-8443-79db5bfa91aa:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9b40d0c-2478-4d3e-8443-79db5bfa91aa:23cc1bde-9938-4b1c-bdac-6d55c33fa535", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ccfe3f6c-a009-4151-b0e5-f90ec7a7ee7d:indexpattern-datasource-layer-a56a9d1d-1aaf-4b09-8a20-aecef5bc19cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ccfe3f6c-a009-4151-b0e5-f90ec7a7ee7d:b52e292e-11ad-47c7-9daa-8c6ba4e29879", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Autonomous Systems", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "6:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "7:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "8:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425.json b/packages/netflow/kibana/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425.json index 36e5e9fffa1..e6bbc630ca7 100644 --- a/packages/netflow/kibana/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425.json +++ b/packages/netflow/kibana/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425.json @@ -1,452 +1,1301 @@ { - "id": "netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T11:33:33.125Z", - "version": "WzY2NywxXQ==", - "attributes": { - "description": "Netflow exporters", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "globalState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "netflow.log" - }, - "type": "phrase", - "value": "netflow.log" - }, - "query": { - "match": { - "data_stream.dataset": { - "query": "netflow.log", - "type": "phrase" - } - } - } - } - ], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Dashboard Navigation [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Netflow exporters", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 4, - "i": "1", - "w": 48, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Flow Exporters (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "markdown": "[Overview](#/dashboard/netflow-34e26884-161a-4448-9556-43b5bf2f62a2) | [Conversation Partners](#/dashboard/netflow-acd7a630-0c71-4840-bc9e-4a3801374a32) | [Traffic Analysis](#/dashboard/netflow-38012abe-c611-4124-8497-381fcd85acc8) | [Top-N](#/dashboard/netflow-14387a13-53bc-43a4-b9cd-63977aa8d87c) | [Geo Location](#/dashboard/netflow-77326664-23be-4bf1-a126-6d7e60cfc024) | [Autonomous Systems](#/dashboard/netflow-c64665f9-d222-421e-90b0-c7310d944b8a) | [Flow Exporters](#/dashboard/netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425) | [Raw Flow Records](#/dashboard/netflow-94972700-de4a-4272-9143-2fa8d4981365)\n***" + }, + "title": "Dashboard Navigation [Logs Netflow]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "1", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "1", + "type": "visualization", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-160452f4-8001-44ac-af3f-61b2c376de1f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d5c9aea2-16c8-47f2-b143-71f38ecc92cd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "160452f4-8001-44ac-af3f-61b2c376de1f": { + "columnOrder": [ + "cb4cd59c-676a-42c3-af9e-327b788550f4", + "8f228182-5479-4f1e-948c-cba191c320c6" + ], + "columns": { + "8f228182-5479-4f1e-948c-cba191c320c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "cb4cd59c-676a-42c3-af9e-327b788550f4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Flow Exporter", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8f228182-5479-4f1e-948c-cba191c320c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "agent.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d5c9aea2-16c8-47f2-b143-71f38ecc92cd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "cb4cd59c-676a-42c3-af9e-327b788550f4" + }, + { + "columnId": "8f228182-5479-4f1e-948c-cba191c320c6" + } + ], + "layerId": "160452f4-8001-44ac-af3f-61b2c376de1f", + "layerType": "data" + } + }, + "title": "Flow Exporters (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Flow Exporter", - "field": "agent.name", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "2", - "w": 16, - "x": 0, - "y": 4 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Ingress Interfaces (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "gridData": { + "h": 16, + "i": "2", + "w": 20, + "x": 28, + "y": 4 + }, + "panelIndex": "2", + "title": "[Logs Netflow] Flow Exporters (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a1684ebf-617a-4d24-95cc-7c646b4e287c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5426bbd-f728-4eb4-8f30-88898d947c0c": { + "columnOrder": [ + "86811a32-53b6-401d-97fc-bd81e24862dd", + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "columns": { + "86811a32-53b6-401d-97fc-bd81e24862dd": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Ingress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.ingress_interface" + }, + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a1684ebf-617a-4d24-95cc-7c646b4e287c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "b5426bbd-f728-4eb4-8f30-88898d947c0c", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "86811a32-53b6-401d-97fc-bd81e24862dd" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Ingress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Ingress Interface", - "field": "netflow.ingress_interface", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "3", - "w": 16, - "x": 16, - "y": 4 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Egress Interfaces (flow records) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - } + "gridData": { + "h": 16, + "i": "3", + "w": 14, + "x": 0, + "y": 4 + }, + "panelIndex": "3", + "title": "[Logs Netflow] Ingress Interfaces (flow records)", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Flow Records" - }, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d326ce08-ecfa-4370-923f-91edddb13425", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c0f96fd5-6266-4af6-9bfa-00c4b73b2a17", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d326ce08-ecfa-4370-923f-91edddb13425": { + "columnOrder": [ + "38aef50a-37bb-482e-ab40-7e1629493a70", + "2efd9402-35d0-423c-98e9-acbea0c8b2d4" + ], + "columns": { + "2efd9402-35d0-423c-98e9-acbea0c8b2d4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Flow Records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "38aef50a-37bb-482e-ab40-7e1629493a70": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Egress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2efd9402-35d0-423c-98e9-acbea0c8b2d4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "netflow.egress_interface" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c0f96fd5-6266-4af6-9bfa-00c4b73b2a17", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "d326ce08-ecfa-4370-923f-91edddb13425", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "2efd9402-35d0-423c-98e9-acbea0c8b2d4" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "38aef50a-37bb-482e-ab40-7e1629493a70" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Egress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Egress Interface", - "field": "netflow.egress_interface", - "order": "desc", - "orderBy": "1", - "size": 50 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 16, + "i": "4", + "w": 14, + "x": 14, + "y": 4 + }, + "panelIndex": "4", + "title": "[Logs Netflow] Egress Interfaces (flow records)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5ad3908-da29-4e95-9011-210de3cfe0ba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5426bbd-f728-4eb4-8f30-88898d947c0c": { + "columnOrder": [ + "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "a93c56a4-9ce3-452c-b707-144b6408f400", + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "columns": { + "9463bf21-fc2b-4a85-8459-a5b4a3252646": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Ingress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.ingress_interface" + }, + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "a93c56a4-9ce3-452c-b707-144b6408f400": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f5ad3908-da29-4e95-9011-210de3cfe0ba", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "layerId": "b5426bbd-f728-4eb4-8f30-88898d947c0c", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "xAccessor": "a93c56a4-9ce3-452c-b707-144b6408f400" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Ingress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 13, + "i": "044449a1-b73e-4c28-9235-4840ef1ced29", + "w": 24, + "x": 0, + "y": 20 + }, + "panelIndex": "044449a1-b73e-4c28-9235-4840ef1ced29", + "title": "[Logs Netflow] Ingress Interfaces (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d6c3a8af-fb44-407e-92b9-7cdc85099a10", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5426bbd-f728-4eb4-8f30-88898d947c0c": { + "columnOrder": [ + "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "a93c56a4-9ce3-452c-b707-144b6408f400", + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "columns": { + "9463bf21-fc2b-4a85-8459-a5b4a3252646": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Ingress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.egress_interface" + }, + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Bytes", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "network.bytes" + }, + "a93c56a4-9ce3-452c-b707-144b6408f400": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d6c3a8af-fb44-407e-92b9-7cdc85099a10", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "layerId": "b5426bbd-f728-4eb4-8f30-88898d947c0c", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "xAccessor": "a93c56a4-9ce3-452c-b707-144b6408f400" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Ingress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 13, + "i": "b0b2fe40-fafe-47d8-ae04-fcfd74b72305", + "w": 24, + "x": 24, + "y": 20 + }, + "panelIndex": "b0b2fe40-fafe-47d8-ae04-fcfd74b72305", + "title": "[Logs Netflow] Egress Interfaces (bytes)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8e6dd455-60ed-470b-810b-e1a570694877", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5426bbd-f728-4eb4-8f30-88898d947c0c": { + "columnOrder": [ + "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "a93c56a4-9ce3-452c-b707-144b6408f400", + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "columns": { + "9463bf21-fc2b-4a85-8459-a5b4a3252646": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Ingress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.ingress_interface" + }, + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "a93c56a4-9ce3-452c-b707-144b6408f400": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8e6dd455-60ed-470b-810b-e1a570694877", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "layerId": "b5426bbd-f728-4eb4-8f30-88898d947c0c", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "xAccessor": "a93c56a4-9ce3-452c-b707-144b6408f400" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Ingress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "9421f87e-f1dd-4c13-b3e9-ed5b64619a88", + "w": 24, + "x": 0, + "y": 33 + }, + "panelIndex": "9421f87e-f1dd-4c13-b3e9-ed5b64619a88", + "title": "[Logs Netflow] Ingress Interfaces (packets)", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "28cbb473-fb0e-4f16-992c-480a19fbe76c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5426bbd-f728-4eb4-8f30-88898d947c0c": { + "columnOrder": [ + "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "a93c56a4-9ce3-452c-b707-144b6408f400", + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "columns": { + "9463bf21-fc2b-4a85-8459-a5b4a3252646": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Egress Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "netflow.egress_interface" + }, + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packets", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "network.packets" + }, + "a93c56a4-9ce3-452c-b707-144b6408f400": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "28cbb473-fb0e-4f16-992c-480a19fbe76c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "netflow.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "netflow.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a2dbd227-4a9d-431a-a53f-a0fda38a2e5f" + ], + "layerId": "b5426bbd-f728-4eb4-8f30-88898d947c0c", + "layerType": "data", + "seriesType": "area_stacked", + "splitAccessor": "9463bf21-fc2b-4a85-8459-a5b4a3252646", + "xAccessor": "a93c56a4-9ce3-452c-b707-144b6408f400" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "Ingress Interfaces (flow records) [Logs Netflow] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "7b125c02-03f4-4ed5-8aab-cf90dd703ef7", + "w": 24, + "x": 24, + "y": 33 + }, + "panelIndex": "7b125c02-03f4-4ed5-8aab-cf90dd703ef7", + "title": "[Logs Netflow] Egress Interfaces (packets)", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Netflow] Flow Exporters", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T10:15:04.616Z", + "id": "netflow-feebb4e6-b13e-4e4e-b9fc-d3a178276425", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-160452f4-8001-44ac-af3f-61b2c376de1f", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "4", - "w": 16, - "x": 32, - "y": 4 + { + "id": "logs-*", + "name": "2:d5c9aea2-16c8-47f2-b143-71f38ecc92cd", + "type": "index-pattern" }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Egress Interfaces (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"netflow.egress_interface:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.egress_interface:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "5", - "w": 24, - "x": 24, - "y": 12 + { + "id": "logs-*", + "name": "3:a1684ebf-617a-4d24-95cc-7c646b4e287c", + "type": "index-pattern" }, - "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Egress Interfaces (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"netflow.egress_interface:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.egress_interface:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-d326ce08-ecfa-4370-923f-91edddb13425", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "6", - "w": 24, - "x": 24, - "y": 20 + { + "id": "logs-*", + "name": "4:c0f96fd5-6266-4af6-9bfa-00c4b73b2a17", + "type": "index-pattern" }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Ingress Interfaces (packets) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.packets\", split=\"netflow.ingress_interface:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.ingress_interface:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"packets / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "044449a1-b73e-4c28-9235-4840ef1ced29:indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "8", - "w": 24, - "x": 0, - "y": 20 + { + "id": "logs-*", + "name": "044449a1-b73e-4c28-9235-4840ef1ced29:f5ad3908-da29-4e95-9011-210de3cfe0ba", + "type": "index-pattern" }, - "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Ingress Interfaces (bytes) [Logs Netflow]", - "description": "", - "uiState": {}, - "params": { - "expression": ".es(index=\"logs-*\", metric=\"sum:network.bytes\", split=\"netflow.ingress_interface:10\", kibana=true).scale_interval(1s).fit(mode=scale).if(operator=\"lt\", if=0, then=0).trim(start=2,end=1).label(regex=\"^.* netflow.ingress_interface:(.+) > .*$\", label=\"$1\").lines(width=1, stack=true, fill=1).yaxis(label=\"bytes / sec\", min=0)", - "interval": "auto" - }, - "type": "timelion", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "b0b2fe40-fafe-47d8-ae04-fcfd74b72305:indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0b2fe40-fafe-47d8-ae04-fcfd74b72305:d6c3a8af-fb44-407e-92b9-7cdc85099a10", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9421f87e-f1dd-4c13-b3e9-ed5b64619a88:indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" }, - "gridData": { - "h": 8, - "i": "10", - "w": 24, - "x": 0, - "y": 12 + { + "id": "logs-*", + "name": "9421f87e-f1dd-4c13-b3e9-ed5b64619a88:8e6dd455-60ed-470b-810b-e1a570694877", + "type": "index-pattern" }, - "panelIndex": "10", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "7b125c02-03f4-4ed5-8aab-cf90dd703ef7:indexpattern-datasource-layer-b5426bbd-f728-4eb4-8f30-88898d947c0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b125c02-03f4-4ed5-8aab-cf90dd703ef7:28cbb473-fb0e-4f16-992c-480a19fbe76c", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Netflow] Flow Exporters", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "3:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "4:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/netflow/kibana/search/netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a.json b/packages/netflow/kibana/search/netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a.json index 9dcb289bcb3..5445be49116 100644 --- a/packages/netflow/kibana/search/netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a.json +++ b/packages/netflow/kibana/search/netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a.json @@ -50,7 +50,8 @@ "title": "Flow Records [Logs Netflow]", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-19T08:15:49.460Z", "id": "netflow-a34c6611-79d8-4b50-ae3f-8b328d28e24a", "migrationVersion": { "search": "8.0.0" diff --git a/packages/netflow/kibana/tags.yml b/packages/netflow/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/netflow/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/netflow/manifest.yml b/packages/netflow/manifest.yml index 473ed53c80f..763ac70292c 100644 --- a/packages/netflow/manifest.yml +++ b/packages/netflow/manifest.yml @@ -1,16 +1,30 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: netflow title: NetFlow Records -version: "2.9.0" -license: basic +version: "2.14.0" description: Collect flow records from NetFlow and IPFIX exporters with Elastic Agent. type: integration categories: - network - security -release: ga conditions: - kibana.version: ^8.1.0 + kibana.version: ^8.7.1 +screenshots: + - src: /img/netflow-overview.png + title: Netflow Overview Dashboard + type: image/png + - src: /img/netflow-topn.png + title: Netflow Top-N Dashboard + type: image/png + - src: /img/traffic-analysis.png + title: Netflow Traffic Analysis + type: image/png + - src: /img/netflow-conversation.png + title: Netflow Conversations + type: image/png + - src: /img/netflow-geo.png + title: Netflow Geo + type: image/png policy_templates: - name: netflow title: NetFlow logs diff --git a/packages/netscout/_dev/build/build.yml b/packages/netscout/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/netscout/_dev/build/build.yml +++ b/packages/netscout/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/netscout/changelog.yml b/packages/netscout/changelog.yml index 6f6497fc960..2dee859fe64 100644 --- a/packages/netscout/changelog.yml +++ b/packages/netscout/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "0.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/netscout/data_stream/sightline/_dev/test/pipeline/test-generated.log-expected.json b/packages/netscout/data_stream/sightline/_dev/test/pipeline/test-generated.log-expected.json index 044451e993f..fe9894f0329 100644 --- a/packages/netscout/data_stream/sightline/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/netscout/data_stream/sightline/_dev/test/pipeline/test-generated.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 29 06:09:59 pfsp: The configuration was changed on leader olab to version 1.6078 by rci", "tags": [ @@ -11,7 +11,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 12 13:12:33 pfsp: Alert Autoclassification was restarted on 2016-02-12 13:12:33 uredolor by tatemac", "tags": [ @@ -20,7 +20,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 26 20:15:08 ntsunti: Change Log: Username:nseq, Subsystem:itinvol, Setting Type:psa, Message:umq", "tags": [ @@ -29,7 +29,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 12 03:17:42 pfsp: Test syslog message", "tags": [ @@ -38,7 +38,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 26 10:20:16 pfsp: Alert Device ritquiin unreachable by controller umqui since 2016-03-26 10:20:16", "tags": [ @@ -47,7 +47,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 9 17:22:51 pfsp: Alert Host Detection alert riosam, start 2016-04-9 17:22:51 anonnu, duration 116.480000, direction external, host 10.51.132.10, signatures (utper), impact squame, importance medium, managed_objects (omm), (parent managed object iin)", "tags": [ @@ -56,7 +56,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 24 00:25:25 pfsp: Autoclassification was restarted on 2016-04-24 00:25:25 nim by incidi", "tags": [ @@ -65,7 +65,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 8 07:27:59 pfsp: Alert Peakflow device oloremqu unreachable by temvel since 2016-05-08 07:27:59", "tags": [ @@ -74,7 +74,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 22 14:30:33 pfsp: Autoclassification was restarted on 2016-05-22 14:30:33 serror by anti", "tags": [ @@ -83,7 +83,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 5 21:33:08 pfsp: script ufugiatn ran at 2016-06-05 21:33:08 tionulam, leader uameius", "tags": [ @@ -92,7 +92,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 20 04:35:42 pfsp: Alert Test syslog message", "tags": [ @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 4 11:38:16 pfsp: configuration was changed on leader uipexea to version 1.5162 by nci", "tags": [ @@ -110,7 +110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 18 18:40:50 pfsp: The SNMP restored for router mvolu, leader radip at 2016-07-18 18:40:50 tNequ", "tags": [ @@ -119,7 +119,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 2 01:43:25 tatno: Protection Mode: Changed protection mode to active for protection groupdquiac,URL:https://mail.example.net/uam/untutl.jpg?llu=uptassi#tamremap", "tags": [ @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 16 08:45:59 pfsp: Alert script estqui ran at 2016-08-16 08:45:59 uasiarch, leader emaper", "tags": [ @@ -137,7 +137,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 30 15:48:33 eum: Blocked Host: Blocked host10.66.171.247atsitby Blocked Countries usingudpdestination10.155.162.162,URL:https://www5.example.org/seq/olorema.jpg?quid=fug#uatDuis", "tags": [ @@ -146,7 +146,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 13 22:51:07 pfsp: Alert TMS 'eip' fault for resource 'lupta' on TMS iusmodt", "tags": [ @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 28 05:53:42 pfsp: Alert Autoclassification was restarted on 2016-09-28 05:53:42 atatnonp by uiano", "tags": [ @@ -164,7 +164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 12 12:56:16 temq: Blocked Host: Blocked host10.38.77.13ataquaeabby Blocked Countries usingipv6-icmpdestination10.179.26.34,URL:https://example.org/isiu/nimadmi.gif?ari=equun#suntinc", "tags": [ @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 26 19:58:50 pfsp: Hardware failure on tatevel since 2016-10-26 19:58:50 GMT: abilloi", "tags": [ @@ -182,7 +182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 10 03:01:24 pfsp: The anomaly ore id 2933 status tsed severity very-high classification enimad router incididu router_name eci interface aali interface_name \"lo5882\" porainc", "tags": [ @@ -191,7 +191,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 24 10:03:59 moll: anomaly: anomaly Bandwidth id 2902 status inim severity high classification deomni router tquovol router_name ntsuntin interface aecatcup interface_name \"lo4987\" oluptate", "tags": [ @@ -200,7 +200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 8 17:06:33 pfsp: Alert Autoclassification was restarted on 2016-12-08 17:06:33 iam by qua", "tags": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 23 00:09:07 pfsp: Test syslog message", "tags": [ @@ -218,7 +218,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 6 07:11:41 pfsp: Autoclassification was restarted on 2017-01-06 07:11:41 olupta by turveli", "tags": [ @@ -227,7 +227,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 20 14:14:16 pfsp: Alert Autoclassification was restarted on 2017-01-20 14:14:16 ntutl by caecatc", "tags": [ @@ -236,7 +236,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 3 21:16:50 pfsp: Alert GRE tunnel restored for destination 10.224.68.213, leader taed at 2017-02-03 21:16:50 lup", "tags": [ @@ -245,7 +245,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 18 04:19:24 pfsp: Alert Hardware failure on aperi since 2017-02-18 04:19:24 GMT: lor", "tags": [ @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 4 11:21:59 pfsp: The BGP Instability for router oin ended", "tags": [ @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 18 18:24:33 pfsp: Hardware failure on ritatis done at 2017-03-18 18:24:33 oloremi GMT: pitla", "tags": [ @@ -272,7 +272,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 2 01:27:07 eomnisis: Change Log: Username:mqui, Subsystem:civeli, Setting Type:errorsi, Message:des", "tags": [ @@ -281,7 +281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 16 08:29:41 pfsp: Device tdolorem unreachable by controller ono since 2017-04-16 08:29:41", "tags": [ @@ -290,7 +290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 30 15:32:16 pfsp: The GRE tunnel down for destination 10.60.185.151, leader uidolo since 2017-04-30 15:32:16 lumquido", "tags": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 14 22:34:50 Lor: Test: Test syslog message", "tags": [ @@ -308,7 +308,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 29 05:37:24 pfsp: Alert script modoco ran at 2017-05-29 05:37:24 , leader estqu", "tags": [ @@ -317,7 +317,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 12 12:39:58 intoccae: Protection Mode: Changed protection mode to active for protection groupents,URL:https://www.example.net/nse/sinto.gif?CSed=lupt#psaquae", "tags": [ @@ -326,7 +326,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 26 19:42:33 pfsp: The BGP Trap reetd: Prefix lumqui itinvo mdolore", "tags": [ @@ -335,7 +335,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 11 02:45:07 pfsp: Device mque reachable again by controller uovolup at 2017-07-11 02:45:07 samvolu", "tags": [ @@ -344,7 +344,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 25 09:47:41 pfsp: The Host Detection alert eirure, start 2017-07-25 09:47:41 conseq, duration 38.117000, stop 2017-07-25 09:47:41 mpori, , importance very-high, managed_objects (atu), is now unknown, (parent managed object lpaqui)", "tags": [ @@ -353,7 +353,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 8 16:50:15 pfsp: BGP Trap doloremi: Prefix luptasn hitect dol", "tags": [ @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 22 23:52:50 nsecte: BGP: ipv6 instability router tincu threshold ari (exercit) observed sci (quamnih)", "tags": [ @@ -371,7 +371,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 6 06:55:24 emoe: Protection Mode: Changed protection mode to active for protection groupeaq,URL:https://mail.example.net/corp/modtemp.jpg?oluptas=tNequepo#lup", "tags": [ @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 20 13:57:58 evita: Change Log: Username:suntexp, Subsystem:duntut, Setting Type:magni, Message:pisciv", "tags": [ @@ -389,7 +389,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 4 21:00:32 radipisc: Blocked Host: Blocked host10.136.232.108atabiby Blocked Countries usingrdpdestination10.168.131.247,URL:https://example.net/temqu/edol.jpg?ipi=reseos#pariatu", "tags": [ @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 19 04:03:07 pfsp: GRE tunnel restored for destination 10.209.182.237, leader tper at 2017-10-19 04:03:07 olor", "tags": [ @@ -407,7 +407,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 2 11:05:41 pfsp: Alert Device xerc reachable again by controller iutali at 2017-11-02 11:05:41 fdeFi", "tags": [ @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 16 18:08:15 pfsp: BGP down for router ati, leader tlabo since 2017-11-16 18:08:15 uames", "tags": [ @@ -425,7 +425,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 1 01:10:49 pfsp: script offi ran at 2017-12-01 01:10:49 , leader giatnu", "tags": [ @@ -434,7 +434,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 15 08:13:24 untex: Blocked Host: Blocked host10.83.23.104attisetqby Blocked Countries usingrdpdestination10.163.161.165,URL:https://www5.example.org/atem/gnido.txt?tmollita=fde#nsecte", "tags": [ @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 29 15:15:58 pfsp: GRE tunnel restored for destination 10.53.248.4, leader derit at 2017-12-29 15:15:58 dexea", "tags": [ @@ -452,7 +452,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 12 22:18:32 pfsp: Test syslog message", "tags": [ @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 27 05:21:06 pfsp: Alert Flow down for router tessec, leader olupta since 2018-01-27 05:21:06 litse", "tags": [ @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 10 12:23:41 pfsp: Alert Host Detection alert sperna, start 2018-02-10 12:23:41 sintocc, duration 24.633000, stop 2018-02-10 12:23:41 scivelit, , importance medium, managed_objects (ehen), is now success, (parent managed object quameius)", "tags": [ @@ -479,7 +479,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 24 19:26:15 ate: Change Log: Username:uiac, Subsystem:epte, Setting Type:idolo, Message:quinesc", "tags": [ @@ -488,7 +488,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 11 02:28:49 pfsp: BGP Instability for router iatisu ended", "tags": [ @@ -497,7 +497,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 25 09:31:24 evolu: Change Log: Username:ersp, Subsystem:tquov, Setting Type:diconseq, Message:inven", "tags": [ @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 8 16:33:58 pfsp: Test syslog message", "tags": [ @@ -515,7 +515,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 22 23:36:32 Sedutp: Test: Test syslog message", "tags": [ @@ -524,7 +524,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 7 06:39:06 ema: Change Log: Username:rsitv, Subsystem:iciade, Setting Type:ntiumt, Message:iquipe", "tags": [ @@ -533,7 +533,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 21 13:41:41 quin: Protection Mode: Changed protection mode to active for protection groupupida,URL:https://api.example.com/eufugi/pici.html?ccaecat=tquiin#tse", "tags": [ @@ -542,7 +542,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 4 20:44:15 minimav: Change Log: Username:udexerci, Subsystem:naal, Setting Type:lore, Message:tnonpro", "tags": [ @@ -551,7 +551,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 19 03:46:49 pfsp: The Device illoin unreachable by controller tanimid since 2018-06-19 03:46:49", "tags": [ @@ -560,7 +560,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 3 10:49:23 pfsp: configuration was changed on leader natuse to version 1.4425 by ati", "tags": [ @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 17 17:51:58 boree: anomaly: anomaly Bandwidth id 2366 status queips severity low classification itess router iscinge router_name ofdeFini interface irat interface_name \"enp0s4306\" aturauto", "tags": [ @@ -578,7 +578,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 1 00:54:32 pfsp: SNMP restored for router entsunt, leader ihilm at 2018-08-01 00:54:32 dmin", "tags": [ @@ -587,7 +587,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 15 07:57:06 pfsp: The Host Detection alert uscipitl, start 2018-08-15 07:57:06 uia, duration 29.657000, direction internal, host 10.54.49.84, signatures (ciad), impact tali, importance medium, managed_objects (mexe), (parent managed object its)", "tags": [ @@ -596,7 +596,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 29 14:59:40 pfsp: Alert Test syslog message", "tags": [ @@ -605,7 +605,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 12 22:02:15 pfsp: anomaly Bandwidth id 5089 status commodo severity medium classification tutlab router sau router_name atevelit interface meius interface_name \"lo4293\" labo", "tags": [ @@ -614,7 +614,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 27 05:04:49 pfsp: Alert script nre ran at 2018-09-27 05:04:49 veli, leader volupta", "tags": [ @@ -623,7 +623,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 11 12:07:23 pfsp: The BGP instability router uptate threshold mac (iumdol) observed tpersp (stla)", "tags": [ @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 25 19:09:57 pfsp: Alert TMS 'tem' fault for resource 'dol' on TMS proiden", "tags": [ @@ -641,7 +641,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 9 02:12:32 pfsp: Device isis reachable again by controller uasiar at 2018-11-09 02:12:32 utlab", "tags": [ @@ -650,7 +650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 23 09:15:06 pfsp: Alert script dantium ran at 2018-11-23 09:15:06 lor, leader velillu", "tags": [ @@ -659,7 +659,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 7 16:17:40 pfsp: The script tvolu ran at 2018-12-07 16:17:40 nreprehe, leader tetu", "tags": [ @@ -668,7 +668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 21 23:20:14 temporin: Blocked Host: Blocked host10.122.76.148atmiuby Blocked Countries usingipv6-icmpdestination10.28.226.128,URL:https://mail.example.org/idunt/luptat.txt?ica=lillum#remips", "tags": [ @@ -677,7 +677,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 5 06:22:49 cola: Protection Mode: Changed protection mode to active for protection groupamcor,URL:https://internal.example.com/ineavol/iosa.html?usc=rem#amvolupt", "tags": [ @@ -686,7 +686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "January 19 13:25:23 mnis: Protection Mode: Changed protection mode to active for protection groupequepor,URL:https://internal.example.org/quaUten/nisiut.txt?teturad=perspici#itation", "tags": [ @@ -695,7 +695,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 2 20:27:57 nimave: Protection Mode: Changed protection mode to active for protection groupisciv,URL:https://mail.example.org/nofd/dipisci.txt?ilmol=eri#quunt", "tags": [ @@ -704,7 +704,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "February 17 03:30:32 iosamnis: Blocked Host: Blocked host10.31.177.226atdeserunby Blocked Countries usingggpdestination10.98.209.10,URL:https://www.example.org/ptateve/enderi.html?toccaec=fugi#labo", "tags": [ @@ -713,7 +713,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 3 10:33:06 estl: Blocked Host: Blocked host10.44.47.27atmmodocby Blocked Countries usingigmpdestination10.179.210.218,URL:https://www.example.org/tanimi/rumSecti.jpg?emporain=ntiumto#umetMalo", "tags": [ @@ -722,7 +722,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "March 17 17:35:40 pfsp: Alert configuration was changed on leader emvele to version 1.2883 by lor", "tags": [ @@ -731,7 +731,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 1 00:38:14 pfsp: Alert BGP instability router iquamqua threshold sit (rumSect) observed ita (vitaed)", "tags": [ @@ -740,7 +740,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 15 07:40:49 pfsp: Alert Test syslog message", "tags": [ @@ -749,7 +749,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "April 29 14:43:23 numquam: Change Log: Username:tMal, Subsystem:ommodo, Setting Type:uptat, Message:idex", "tags": [ @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 13 21:45:57 pfsp: Alert configuration was changed on leader maveni to version 1.2552 by onu", "tags": [ @@ -767,7 +767,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "May 28 04:48:31 pfsp: Alert BGP Hijack for prefix tlaboree router norumet done", "tags": [ @@ -776,7 +776,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 11 11:51:06 pfsp: Host Detection alert col, start 2019-06-11 11:51:06 mve, duration 177.586000, stop 2019-06-11 11:51:06 tinvolup, , importance very-high, managed_objects (Sedutpe), is now failure, (parent managed object rroq)", "tags": [ @@ -785,7 +785,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "June 25 18:53:40 pfsp: script remipsum ran at 2019-06-25 18:53:40 , leader tempor", "tags": [ @@ -794,7 +794,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 10 01:56:14 ccae: Change Log: Username:orroqu, Subsystem:elitsed, Setting Type:labore, Message:uela", "tags": [ @@ -803,7 +803,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "July 24 08:58:48 uto: Test: Test syslog message", "tags": [ @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 7 16:01:23 remq: Change Log: Username:veniamq, Subsystem:occ, Setting Type:oloreseo, Message:iruredol", "tags": [ @@ -821,7 +821,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "August 21 23:03:57 cupi: Blocked Host: Blocked host10.151.129.181atduntby Blocked Countries usingggpdestination10.55.156.64,URL:https://www.example.net/itanim/nesciun.txt?mollita=tatem#iae", "tags": [ @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 5 06:06:31 eumi: Protection Mode: Changed protection mode to active for protection groupquasiarc,URL:https://www.example.net/rever/ore.jpg?oluptat=metco#acom", "tags": [ @@ -839,7 +839,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "September 19 13:09:05 pfsp: The Host Detection alert inBCSedu, start 2019-09-19 13:09:05 erspi, duration 77.637000, direction internal, host 10.46.77.76, signatures (iacons), impact occaec, importance medium, managed_objects (uov), (parent managed object quaeab)", "tags": [ @@ -848,7 +848,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 3 20:11:40 pfsp: Hardware failure on ntiu since 2019-10-03 20:11:40 GMT: radipisc", "tags": [ @@ -857,7 +857,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "October 18 03:14:14 pfsp: script vitaed ran at 2019-10-18 03:14:14 ser, leader etconsec", "tags": [ @@ -866,7 +866,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 1 10:16:48 upt: Blocked Host: Blocked host10.73.89.189atidoloby Blocked Countries usingicmpdestination10.166.90.130,URL:https://api.example.org/eosquira/pta.htm?econs=lmolesti#apariatu", "tags": [ @@ -875,7 +875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 15 17:19:22 pfsp: Alert script msequ ran at 2019-11-15 17:19:22 uat, leader lupta", "tags": [ @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "November 30 00:21:57 tlabori: Protection Mode: Changed protection mode to active for protection grouplaudan,URL:https://www5.example.com/atcupida/tessequa.htm?dolores=equamnih#taliqui", "tags": [ @@ -893,7 +893,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "December 14 07:24:31 destlabo: Change Log: Username:rcitat, Subsystem:dolorema, Setting Type:emagn, Message:radipis", "tags": [ diff --git a/packages/netscout/data_stream/sightline/elasticsearch/ingest_pipeline/default.yml b/packages/netscout/data_stream/sightline/elasticsearch/ingest_pipeline/default.yml index 5d37be2802b..f87640adb53 100644 --- a/packages/netscout/data_stream/sightline/elasticsearch/ingest_pipeline/default.yml +++ b/packages/netscout/data_stream/sightline/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Arbor Peakflow SP processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # User agent - user_agent: field: user_agent.original diff --git a/packages/netscout/data_stream/sightline/sample_event.json b/packages/netscout/data_stream/sightline/sample_event.json index fcc21cd1e54..089798468bd 100644 --- a/packages/netscout/data_stream/sightline/sample_event.json +++ b/packages/netscout/data_stream/sightline/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", diff --git a/packages/netscout/manifest.yml b/packages/netscout/manifest.yml index 9ea0e5f13e1..ba8c06368e5 100644 --- a/packages/netscout/manifest.yml +++ b/packages/netscout/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.7.0 name: netscout title: Arbor Peakflow SP Logs -version: "0.16.0" +version: "0.17.0" description: Collect and parse logs from Netscout Arbor Peakflow SP with Elastic Agent. categories: ["security", "network"] type: integration diff --git a/packages/netskope/_dev/build/build.yml b/packages/netskope/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/netskope/_dev/build/build.yml +++ b/packages/netskope/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/netskope/changelog.yml b/packages/netskope/changelog.yml index 78aa208b1cd..e03564d5b8c 100644 --- a/packages/netskope/changelog.yml +++ b/packages/netskope/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.10.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7168 +- version: "1.9.1" + changes: + - description: Remove `netskope.events.region` and `netskope.events.region.id` fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/6833 - version: "1.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/netskope/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json b/packages/netskope/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json index d911a17f3d7..1e29759d8f6 100644 --- a/packages/netskope/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json +++ b/packages/netskope/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json @@ -19,7 +19,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "f621f259f5fbde850ad5593a", @@ -172,7 +172,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5b052d559134cbd545cc1bdb", @@ -342,7 +342,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "d370a4733b213214d7efd44b", @@ -515,7 +515,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "f34166329a41b4ed7842ce18", @@ -634,7 +634,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "045b4a05e63667d3b25279e1", @@ -832,7 +832,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "9c4f8947f6326ff0ad79f4a3", @@ -1024,7 +1024,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -1189,7 +1189,7 @@ { "@timestamp": "2022-01-19T21:39:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "47eccb9569fe50460ad1200f", @@ -1243,7 +1243,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "f34166329a41b4ed7842ce18", @@ -1362,7 +1362,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "045b4a05e63667d3b25279e1", @@ -1560,7 +1560,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "9c4f8947f6326ff0ad79f4a3", @@ -1752,7 +1752,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -1933,7 +1933,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -2114,7 +2114,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "045b4a05e63667d3b25279e1", @@ -2312,7 +2312,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "9c4f8947f6326ff0ad79f4a3", @@ -2505,7 +2505,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -2687,7 +2687,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "9c4f8947f6326ff0ad79f4a3", @@ -2879,7 +2879,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -3062,7 +3062,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5b052d559134cbd545cc1bdb", @@ -3232,7 +3232,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "5b052d559134cbd545cc1bdb", @@ -3387,7 +3387,7 @@ { "@timestamp": "2022-01-19T21:39:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "47eccb9569fe50460ad1200f", @@ -3460,7 +3460,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "9c4f8947f6326ff0ad79f4a3", @@ -3654,7 +3654,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "045b4a05e63667d3b25279e1", @@ -3856,7 +3856,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "b999bebb17c193b3350f16b3", @@ -4026,7 +4026,7 @@ { "@timestamp": "2022-05-15T15:34:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "abc123a1a53aad", @@ -4097,7 +4097,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "123abb3426a0ffa82a", @@ -4217,7 +4217,7 @@ "ip": "81.2.69.142" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "abcd19518cee24e", diff --git a/packages/netskope/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/netskope/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 5091a9bdd52..de7401f9561 100644 --- a/packages/netskope/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/netskope/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Netskope alerts. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - json: field: message add_to_root: true diff --git a/packages/netskope/data_stream/alerts/fields/fields.yml b/packages/netskope/data_stream/alerts/fields/fields.yml index 5af1023fdb8..3b057012d45 100644 --- a/packages/netskope/data_stream/alerts/fields/fields.yml +++ b/packages/netskope/data_stream/alerts/fields/fields.yml @@ -32,7 +32,7 @@ description: | Action taken on the event for the policy. - name: activities - type: array + type: keyword description: | N/A - name: activity @@ -517,7 +517,7 @@ type: group fields: - name: list - type: array + type: keyword description: | N/A - name: type @@ -1095,7 +1095,7 @@ description: | N/A - name: security.group - type: array + type: keyword description: | N/A - name: new diff --git a/packages/netskope/data_stream/alerts/sample_event.json b/packages/netskope/data_stream/alerts/sample_event.json index 0340e9147cc..b8657a14a09 100644 --- a/packages/netskope/data_stream/alerts/sample_event.json +++ b/packages/netskope/data_stream/alerts/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-23T16:27:09.000Z", "agent": { - "ephemeral_id": "9574aad5-5325-431f-b252-84fc439b63c5", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "f351413b-f36f-45a3-aa1f-1334e718f39a", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "netskope.alerts", @@ -29,17 +29,17 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "id": "f621f259f5fbde850ad5593a", - "ingested": "2022-11-04T13:39:35Z" + "ingested": "2023-07-27T15:55:05Z" }, "file": { "hash": { @@ -56,7 +56,7 @@ }, "log": { "source": { - "address": "192.168.0.6:52200" + "address": "172.18.0.4:33326" } }, "netskope": { diff --git a/packages/netskope/data_stream/events/_dev/test/pipeline/test-events.log-expected.json b/packages/netskope/data_stream/events/_dev/test/pipeline/test-events.log-expected.json index 25eeb16087b..52e110bdc9d 100644 --- a/packages/netskope/data_stream/events/_dev/test/pipeline/test-events.log-expected.json +++ b/packages/netskope/data_stream/events/_dev/test/pipeline/test-events.log-expected.json @@ -24,7 +24,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -201,7 +201,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allow", @@ -318,7 +318,7 @@ { "@timestamp": "2022-01-30T05:44:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "c198aee5561d930a120e4fb4", @@ -376,7 +376,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "fd54bdb5916df42dc55712a4", @@ -522,7 +522,7 @@ { "@timestamp": "2021-12-24T00:29:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"@timestamp\":\"2021-12-24T00:29:56.000Z\",\"event.id\":\"613ee55ec9d868fc47654a73\",\"netskope\":{\"events\":{\"event_type\":\"infrastructure\",\"severity\":{\"level\":\"high\"},\"alarm\":{\"name\":\"No_events_from_device\",\"description\":\"Events from device not received in the last 24 hours\"},\"device\":{\"name\":\"device-1\"},\"metric_value\":43831789,\"serial\":\"FFFFFFFFFFFFFFFF\",\"supporting_data\":\"abc\"}}}" @@ -570,7 +570,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "004bad0deade8dd33fafb916", @@ -695,7 +695,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -873,7 +873,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allow", @@ -991,7 +991,7 @@ { "@timestamp": "2022-01-30T05:44:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "c198aee5561d930a120e4fb4", @@ -1050,7 +1050,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "fd54bdb5916df42dc55712a4", @@ -1197,7 +1197,7 @@ { "@timestamp": "2021-12-24T00:29:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"@timestamp\":\"2021-12-24T00:29:56.000Z\",\"event.id\":\"613ee55ec9d868fc47654a73\",\"netskope\":{\"events\":{\"event_type\":\"infrastructure\",\"severity\":{\"level\":\"high\"},\"alarm\":{\"name\":\"No_events_from_device\",\"description\":\"Events from device not received in the last 24 hours\"},\"device\":{\"name\":\"device-1\"},\"metric_value\":43831789,\"serial\":\"FFFFFFFFFFFFFFFF\",\"supporting_data\":\"abc\"}}}" @@ -1245,7 +1245,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "004bad0deade8dd33fafb916", @@ -1371,7 +1371,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -1540,7 +1540,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "004bad0deade8dd33fafb916", @@ -1667,7 +1667,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allow", @@ -1788,7 +1788,7 @@ { "@timestamp": "2022-01-30T05:44:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "c198aee5561d930a120e4fb4", @@ -1827,7 +1827,7 @@ { "@timestamp": "2021-09-12T11:31:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "123f357a5241c6f", @@ -1921,7 +1921,9 @@ "user@example.com", "Introspection" ], - "roles": "unknown" + "roles": [ + "unknown" + ] }, "user_agent": { "name": "unknown", @@ -1955,7 +1957,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -2087,7 +2089,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "123asd25fe48c2b3d", diff --git a/packages/netskope/data_stream/events/elasticsearch/ingest_pipeline/default.yml b/packages/netskope/data_stream/events/elasticsearch/ingest_pipeline/default.yml index 3fe6e32b30e..25c4697766b 100644 --- a/packages/netskope/data_stream/events/elasticsearch/ingest_pipeline/default.yml +++ b/packages/netskope/data_stream/events/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Netskope events. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - json: field: message add_to_root: true @@ -1039,6 +1039,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - set: + field: user.roles + value: ['{{{user.roles}}}'] + if: ctx.user?.roles instanceof String - script: if: ctx.file?.mime_type != null lang: painless diff --git a/packages/netskope/data_stream/events/fields/fields.yml b/packages/netskope/data_stream/events/fields/fields.yml index ba1c372bc7f..433531ea306 100644 --- a/packages/netskope/data_stream/events/fields/fields.yml +++ b/packages/netskope/data_stream/events/fields/fields.yml @@ -851,17 +851,6 @@ type: keyword - name: username type: keyword - - name: region - type: keyword - description: | - N/A - - name: region - type: group - fields: - - name: id - type: keyword - description: | - Region ID (as provided by the cloud provider). - name: repo type: keyword description: | diff --git a/packages/netskope/data_stream/events/sample_event.json b/packages/netskope/data_stream/events/sample_event.json index 244a4837ee7..800f6e21fc5 100644 --- a/packages/netskope/data_stream/events/sample_event.json +++ b/packages/netskope/data_stream/events/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-24T00:29:56.000Z", "agent": { - "ephemeral_id": "a31c2d61-519a-4322-ab78-f49af3a1f010", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "169a2d34-f013-46a1-8cfa-0688afe7cb78", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "netskope.events", @@ -13,17 +13,17 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "dataset": "netskope.events", - "ingested": "2022-11-04T13:41:21Z" + "ingested": "2023-07-27T15:55:55Z" }, "event.id": "613ee55ec9d868fc47654a73", "input": { @@ -31,7 +31,7 @@ }, "log": { "source": { - "address": "192.168.0.6:33808" + "address": "172.18.0.4:53214" } }, "netskope": { diff --git a/packages/netskope/docs/README.md b/packages/netskope/docs/README.md index 2f062b87787..42f2ecd7749 100644 --- a/packages/netskope/docs/README.md +++ b/packages/netskope/docs/README.md @@ -127,7 +127,7 @@ Default port: _9021_ | netskope.alerts.acked | Whether user acknowledged the alert or not. | boolean | | netskope.alerts.acting.role | N/A | keyword | | netskope.alerts.action | Action taken on the event for the policy. | keyword | -| netskope.alerts.activities | N/A | array | +| netskope.alerts.activities | N/A | keyword | | netskope.alerts.activity.name | Description of the user performed activity. | keyword | | netskope.alerts.activity.status | Displayed when the user is denied access while performing some activity. | keyword | | netskope.alerts.activity.type | Displayed when only admins can perform the activity in question. | keyword | @@ -225,7 +225,7 @@ Default port: _9021_ | netskope.alerts.encryption.service.key | N/A | keyword | | netskope.alerts.enterprise.id | EnterpriseID in case of Slack for Enterprise. | keyword | | netskope.alerts.enterprise.name | Enterprise name in case of Slack for Enterprise. | keyword | -| netskope.alerts.entity.list | N/A | array | +| netskope.alerts.entity.list | N/A | keyword | | netskope.alerts.entity.type | N/A | keyword | | netskope.alerts.entity.value | N/A | keyword | | netskope.alerts.event.detail | N/A | keyword | @@ -353,7 +353,7 @@ Default port: _9021_ | netskope.alerts.modified.timestamp | Timestamp corresponding to the modification time of the entity (file, etc.). | long | | netskope.alerts.netskope_pop | N/A | keyword | | netskope.alerts.network.name | N/A | keyword | -| netskope.alerts.network.security.group | N/A | array | +| netskope.alerts.network.security.group | N/A | keyword | | netskope.alerts.new.value | New value for a given file for salesforce.com. | keyword | | netskope.alerts.nonzero.entries | N/A | long | | netskope.alerts.nonzero.percentage | N/A | double | @@ -583,11 +583,11 @@ An example event for `alerts` looks as following: { "@timestamp": "2021-12-23T16:27:09.000Z", "agent": { - "ephemeral_id": "9574aad5-5325-431f-b252-84fc439b63c5", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "f351413b-f36f-45a3-aa1f-1334e718f39a", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "netskope.alerts", @@ -611,17 +611,17 @@ An example event for `alerts` looks as following: "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "id": "f621f259f5fbde850ad5593a", - "ingested": "2022-11-04T13:39:35Z" + "ingested": "2023-07-27T15:55:05Z" }, "file": { "hash": { @@ -638,7 +638,7 @@ An example event for `alerts` looks as following: }, "log": { "source": { - "address": "192.168.0.6:52200" + "address": "172.18.0.4:33326" } }, "netskope": { @@ -809,7 +809,7 @@ An example event for `alerts` looks as following: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.md5 | MD5 hash. | keyword | @@ -1029,8 +1029,6 @@ An example event for `alerts` looks as following: | netskope.events.referer.query | | keyword | | netskope.events.referer.scheme | | keyword | | netskope.events.referer.username | | keyword | -| netskope.events.region | N/A | keyword | -| netskope.events.region.id | Region ID (as provided by the cloud provider). | keyword | | netskope.events.repo | N/A | keyword | | netskope.events.request.count | Total number of HTTP requests (equal to number of transaction events for this page event) sent from client to server over one underlying TCP connection. | long | | netskope.events.request.id | Unique request ID for the event. | keyword | @@ -1182,11 +1180,11 @@ An example event for `events` looks as following: { "@timestamp": "2021-12-24T00:29:56.000Z", "agent": { - "ephemeral_id": "a31c2d61-519a-4322-ab78-f49af3a1f010", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "169a2d34-f013-46a1-8cfa-0688afe7cb78", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "netskope.events", @@ -1194,17 +1192,17 @@ An example event for `events` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "dataset": "netskope.events", - "ingested": "2022-11-04T13:41:21Z" + "ingested": "2023-07-27T15:55:55Z" }, "event.id": "613ee55ec9d868fc47654a73", "input": { @@ -1212,7 +1210,7 @@ An example event for `events` looks as following: }, "log": { "source": { - "address": "192.168.0.6:33808" + "address": "172.18.0.4:53214" } }, "netskope": { diff --git a/packages/netskope/kibana/tags.yml b/packages/netskope/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/netskope/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/netskope/manifest.yml b/packages/netskope/manifest.yml index 2f9234b50f8..efa554afaf2 100644 --- a/packages/netskope/manifest.yml +++ b/packages/netskope/manifest.yml @@ -1,16 +1,15 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: netskope title: "Netskope" -version: "1.9.0" -license: basic +version: "1.13.0" description: Collect logs from Netskope with Elastic Agent. type: integration categories: - security - network -release: ga conditions: - kibana.version: ^7.17.0 || ^8.0.0 + kibana: + version: ^7.17.0 || ^8.0.0 screenshots: - src: /img/netskope-alerts-screenshot.png title: Netskope Alert logs screenshot @@ -73,3 +72,4 @@ policy_templates: description: Collecting Netskope logs via TCP input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/network_traffic/LICENSE.txt b/packages/network_traffic/LICENSE.txt new file mode 100644 index 00000000000..7376ffc3ff1 --- /dev/null +++ b/packages/network_traffic/LICENSE.txt @@ -0,0 +1,223 @@ +ELASTIC LICENSE AGREEMENT + +PLEASE READ CAREFULLY THIS ELASTIC LICENSE AGREEMENT (THIS "AGREEMENT"), WHICH +CONSTITUTES A LEGALLY BINDING AGREEMENT AND GOVERNS ALL OF YOUR USE OF ALL OF +THE ELASTIC SOFTWARE WITH WHICH THIS AGREEMENT IS INCLUDED ("ELASTIC SOFTWARE") +THAT IS PROVIDED IN OBJECT CODE FORMAT, AND, IN ACCORDANCE WITH SECTION 2 BELOW, +CERTAIN OF THE ELASTIC SOFTWARE THAT IS PROVIDED IN SOURCE CODE FORMAT. BY +INSTALLING OR USING ANY OF THE ELASTIC SOFTWARE GOVERNED BY THIS AGREEMENT, YOU +ARE ASSENTING TO THE TERMS AND CONDITIONS OF THIS AGREEMENT. IF YOU DO NOT AGREE +WITH SUCH TERMS AND CONDITIONS, YOU MAY NOT INSTALL OR USE THE ELASTIC SOFTWARE +GOVERNED BY THIS AGREEMENT. IF YOU ARE INSTALLING OR USING THE SOFTWARE ON +BEHALF OF A LEGAL ENTITY, YOU REPRESENT AND WARRANT THAT YOU HAVE THE ACTUAL +AUTHORITY TO AGREE TO THE TERMS AND CONDITIONS OF THIS AGREEMENT ON BEHALF OF +SUCH ENTITY. + +Posted Date: April 20, 2018 + +This Agreement is entered into by and between Elasticsearch BV ("Elastic") and +You, or the legal entity on behalf of whom You are acting (as applicable, +"You"). + +1. OBJECT CODE END USER LICENSES, RESTRICTIONS AND THIRD PARTY OPEN SOURCE +SOFTWARE + + 1.1 Object Code End User License. Subject to the terms and conditions of + Section 1.2 of this Agreement, Elastic hereby grants to You, AT NO CHARGE and + for so long as you are not in breach of any provision of this Agreement, a + License to the Basic Features and Functions of the Elastic Software. + + 1.2 Reservation of Rights; Restrictions. As between Elastic and You, Elastic + and its licensors own all right, title and interest in and to the Elastic + Software, and except as expressly set forth in Sections 1.1, and 2.1 of this + Agreement, no other license to the Elastic Software is granted to You under + this Agreement, by implication, estoppel or otherwise. You agree not to: (i) + reverse engineer or decompile, decrypt, disassemble or otherwise reduce any + Elastic Software provided to You in Object Code, or any portion thereof, to + Source Code, except and only to the extent any such restriction is prohibited + by applicable law, (ii) except as expressly permitted in this Agreement, + prepare derivative works from, modify, copy or use the Elastic Software Object + Code or the Commercial Software Source Code in any manner; (iii) except as + expressly permitted in Section 1.1 above, transfer, sell, rent, lease, + distribute, sublicense, loan or otherwise transfer, Elastic Software Object + Code, in whole or in part, to any third party; (iv) use Elastic Software + Object Code for providing time-sharing services, any software-as-a-service, + service bureau services or as part of an application services provider or + other service offering (collectively, "SaaS Offering") where obtaining access + to the Elastic Software or the features and functions of the Elastic Software + is a primary reason or substantial motivation for users of the SaaS Offering + to access and/or use the SaaS Offering ("Prohibited SaaS Offering"); (v) + circumvent the limitations on use of Elastic Software provided to You in + Object Code format that are imposed or preserved by any License Key, or (vi) + alter or remove any Marks and Notices in the Elastic Software. If You have any + question as to whether a specific SaaS Offering constitutes a Prohibited SaaS + Offering, or are interested in obtaining Elastic's permission to engage in + commercial or non-commercial distribution of the Elastic Software, please + contact elastic_license@elastic.co. + + 1.3 Third Party Open Source Software. The Commercial Software may contain or + be provided with third party open source libraries, components, utilities and + other open source software (collectively, "Open Source Software"), which Open + Source Software may have applicable license terms as identified on a website + designated by Elastic. Notwithstanding anything to the contrary herein, use of + the Open Source Software shall be subject to the license terms and conditions + applicable to such Open Source Software, to the extent required by the + applicable licensor (which terms shall not restrict the license rights granted + to You hereunder, but may contain additional rights). To the extent any + condition of this Agreement conflicts with any license to the Open Source + Software, the Open Source Software license will govern with respect to such + Open Source Software only. Elastic may also separately provide you with + certain open source software that is licensed by Elastic. Your use of such + Elastic open source software will not be governed by this Agreement, but by + the applicable open source license terms. + +2. COMMERCIAL SOFTWARE SOURCE CODE + + 2.1 Limited License. Subject to the terms and conditions of Section 2.2 of + this Agreement, Elastic hereby grants to You, AT NO CHARGE and for so long as + you are not in breach of any provision of this Agreement, a limited, + non-exclusive, non-transferable, fully paid up royalty free right and license + to the Commercial Software in Source Code format, without the right to grant + or authorize sublicenses, to prepare Derivative Works of the Commercial + Software, provided You (i) do not hack the licensing mechanism, or otherwise + circumvent the intended limitations on the use of Elastic Software to enable + features other than Basic Features and Functions or those features You are + entitled to as part of a Subscription, and (ii) use the resulting object code + only for reasonable testing purposes. + + 2.2 Restrictions. Nothing in Section 2.1 grants You the right to (i) use the + Commercial Software Source Code other than in accordance with Section 2.1 + above, (ii) use a Derivative Work of the Commercial Software outside of a + Non-production Environment, in any production capacity, on a temporary or + permanent basis, or (iii) transfer, sell, rent, lease, distribute, sublicense, + loan or otherwise make available the Commercial Software Source Code, in whole + or in part, to any third party. Notwithstanding the foregoing, You may + maintain a copy of the repository in which the Source Code of the Commercial + Software resides and that copy may be publicly accessible, provided that you + include this Agreement with Your copy of the repository. + +3. TERMINATION + + 3.1 Termination. This Agreement will automatically terminate, whether or not + You receive notice of such Termination from Elastic, if You breach any of its + provisions. + + 3.2 Post Termination. Upon any termination of this Agreement, for any reason, + You shall promptly cease the use of the Elastic Software in Object Code format + and cease use of the Commercial Software in Source Code format. For the + avoidance of doubt, termination of this Agreement will not affect Your right + to use Elastic Software, in either Object Code or Source Code formats, made + available under the Apache License Version 2.0. + + 3.3 Survival. Sections 1.2, 2.2. 3.3, 4 and 5 shall survive any termination or + expiration of this Agreement. + +4. DISCLAIMER OF WARRANTIES AND LIMITATION OF LIABILITY + + 4.1 Disclaimer of Warranties. TO THE MAXIMUM EXTENT PERMITTED UNDER APPLICABLE + LAW, THE ELASTIC SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, + AND ELASTIC AND ITS LICENSORS MAKE NO WARRANTIES WHETHER EXPRESSED, IMPLIED OR + STATUTORY REGARDING OR RELATING TO THE ELASTIC SOFTWARE. TO THE MAXIMUM EXTENT + PERMITTED UNDER APPLICABLE LAW, ELASTIC AND ITS LICENSORS SPECIFICALLY + DISCLAIM ALL IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR + PURPOSE AND NON-INFRINGEMENT WITH RESPECT TO THE ELASTIC SOFTWARE, AND WITH + RESPECT TO THE USE OF THE FOREGOING. FURTHER, ELASTIC DOES NOT WARRANT RESULTS + OF USE OR THAT THE ELASTIC SOFTWARE WILL BE ERROR FREE OR THAT THE USE OF THE + ELASTIC SOFTWARE WILL BE UNINTERRUPTED. + + 4.2 Limitation of Liability. IN NO EVENT SHALL ELASTIC OR ITS LICENSORS BE + LIABLE TO YOU OR ANY THIRD PARTY FOR ANY DIRECT OR INDIRECT DAMAGES, + INCLUDING, WITHOUT LIMITATION, FOR ANY LOSS OF PROFITS, LOSS OF USE, BUSINESS + INTERRUPTION, LOSS OF DATA, COST OF SUBSTITUTE GOODS OR SERVICES, OR FOR ANY + SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OF ANY KIND, IN CONNECTION WITH + OR ARISING OUT OF THE USE OR INABILITY TO USE THE ELASTIC SOFTWARE, OR THE + PERFORMANCE OF OR FAILURE TO PERFORM THIS AGREEMENT, WHETHER ALLEGED AS A + BREACH OF CONTRACT OR TORTIOUS CONDUCT, INCLUDING NEGLIGENCE, EVEN IF ELASTIC + HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. + +5. MISCELLANEOUS + + This Agreement completely and exclusively states the entire agreement of the + parties regarding the subject matter herein, and it supersedes, and its terms + govern, all prior proposals, agreements, or other communications between the + parties, oral or written, regarding such subject matter. This Agreement may be + modified by Elastic from time to time, and any such modifications will be + effective upon the "Posted Date" set forth at the top of the modified + Agreement. If any provision hereof is held unenforceable, this Agreement will + continue without said provision and be interpreted to reflect the original + intent of the parties. This Agreement and any non-contractual obligation + arising out of or in connection with it, is governed exclusively by Dutch law. + This Agreement shall not be governed by the 1980 UN Convention on Contracts + for the International Sale of Goods. All disputes arising out of or in + connection with this Agreement, including its existence and validity, shall be + resolved by the courts with jurisdiction in Amsterdam, The Netherlands, except + where mandatory law provides for the courts at another location in The + Netherlands to have jurisdiction. The parties hereby irrevocably waive any and + all claims and defenses either might otherwise have in any such action or + proceeding in any of such courts based upon any alleged lack of personal + jurisdiction, improper venue, forum non conveniens or any similar claim or + defense. A breach or threatened breach, by You of Section 2 may cause + irreparable harm for which damages at law may not provide adequate relief, and + therefore Elastic shall be entitled to seek injunctive relief without being + required to post a bond. You may not assign this Agreement (including by + operation of law in connection with a merger or acquisition), in whole or in + part to any third party without the prior written consent of Elastic, which + may be withheld or granted by Elastic in its sole and absolute discretion. + Any assignment in violation of the preceding sentence is void. Notices to + Elastic may also be sent to legal@elastic.co. + +6. DEFINITIONS + + The following terms have the meanings ascribed: + + 6.1 "Affiliate" means, with respect to a party, any entity that controls, is + controlled by, or which is under common control with, such party, where + "control" means ownership of at least fifty percent (50%) of the outstanding + voting shares of the entity, or the contractual right to establish policy for, + and manage the operations of, the entity. + + 6.2 "Basic Features and Functions" means those features and functions of the + Elastic Software that are eligible for use under a Basic license, as set forth + at https://www.elastic.co/subscriptions, as may be modified by Elastic from + time to time. + + 6.3 "Commercial Software" means the Elastic Software Source Code in any file + containing a header stating the contents are subject to the Elastic License or + which is contained in the repository folder labeled "x-pack", unless a LICENSE + file present in the directory subtree declares a different license. + + 6.4 "Derivative Work of the Commercial Software" means, for purposes of this + Agreement, any modification(s) or enhancement(s) to the Commercial Software, + which represent, as a whole, an original work of authorship. + + 6.5 "License" means a limited, non-exclusive, non-transferable, fully paid up, + royalty free, right and license, without the right to grant or authorize + sublicenses, solely for Your internal business operations to (i) install and + use the applicable Features and Functions of the Elastic Software in Object + Code, and (ii) permit Contractors and Your Affiliates to use the Elastic + software as set forth in (i) above, provided that such use by Contractors must + be solely for Your benefit and/or the benefit of Your Affiliates, and You + shall be responsible for all acts and omissions of such Contractors and + Affiliates in connection with their use of the Elastic software that are + contrary to the terms and conditions of this Agreement. + + 6.6 "License Key" means a sequence of bytes, including but not limited to a + JSON blob, that is used to enable certain features and functions of the + Elastic Software. + + 6.7 "Marks and Notices" means all Elastic trademarks, trade names, logos and + notices present on the Documentation as originally provided by Elastic. + + 6.8 "Non-production Environment" means an environment for development, testing + or quality assurance, where software is not used for production purposes. + + 6.9 "Object Code" means any form resulting from mechanical transformation or + translation of Source Code form, including but not limited to compiled object + code, generated documentation, and conversions to other media types. + + 6.10 "Source Code" means the preferred form of computer software for making + modifications, including but not limited to software source code, + documentation source, and configuration files. + + 6.11 "Subscription" means the right to receive Support Services and a License + to the Commercial Software. diff --git a/packages/network_traffic/_dev/build/build.yml b/packages/network_traffic/_dev/build/build.yml index 074278e5b1f..c1af686e524 100755 --- a/packages/network_traffic/_dev/build/build.yml +++ b/packages/network_traffic/_dev/build/build.yml @@ -1,3 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/network_traffic/changelog.yml b/packages/network_traffic/changelog.yml index 660ab0b65a6..4831a531f5d 100644 --- a/packages/network_traffic/changelog.yml +++ b/packages/network_traffic/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 1.24.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.23.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.22.0" + changes: + - description: Use dynamic field definitions. + type: enhancement + link: https://github.com/elastic/integrations/pull/7657 +- version: "1.21.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.20.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.19.3" + changes: + - description: Fix license. + type: bugfix + link: https://github.com/elastic/integrations/pull/7157 +- version: "1.19.2" + changes: + - description: Fix field mapping for `tls.detailed.client_certificate_chain` and `tls.detailed.server_certificate_chain`. + type: bugfix + link: https://github.com/elastic/integrations/pull/6856 - version: "1.19.1" changes: - description: Fix indexing of memcached stats responses. diff --git a/packages/network_traffic/data_stream/amqp/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/amqp/elasticsearch/ingest_pipeline/default.yml index bc7047d89fa..20157b7e80d 100644 --- a/packages/network_traffic/data_stream/amqp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/amqp/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing amqp traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/amqp/manifest.yml b/packages/network_traffic/data_stream/amqp/manifest.yml index 4ec5b218e42..5638dea994f 100644 --- a/packages/network_traffic/data_stream/amqp/manifest.yml +++ b/packages/network_traffic/data_stream/amqp/manifest.yml @@ -98,7 +98,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/amqp/sample_event.json b/packages/network_traffic/data_stream/amqp/sample_event.json index 493a57c8dda..2abb9af3c02 100644 --- a/packages/network_traffic/data_stream/amqp/sample_event.json +++ b/packages/network_traffic/data_stream/amqp/sample_event.json @@ -29,7 +29,7 @@ "port": 5672 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "24617916-b7fd-4486-af56-1754af7b012c", diff --git a/packages/network_traffic/data_stream/cassandra/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/cassandra/elasticsearch/ingest_pipeline/default.yml index afdaaa57421..9eac9e8eddc 100644 --- a/packages/network_traffic/data_stream/cassandra/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/cassandra/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing cassandra traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/cassandra/sample_event.json b/packages/network_traffic/data_stream/cassandra/sample_event.json index f4aa0aa32de..a95f7b3204b 100644 --- a/packages/network_traffic/data_stream/cassandra/sample_event.json +++ b/packages/network_traffic/data_stream/cassandra/sample_event.json @@ -53,7 +53,7 @@ "port": 9042 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "adef13cd-055b-465e-bc3e-5f12f6a4c481", diff --git a/packages/network_traffic/data_stream/dhcpv4/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/dhcpv4/elasticsearch/ingest_pipeline/default.yml index 176b45379c4..497ba75e9ec 100644 --- a/packages/network_traffic/data_stream/dhcpv4/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/dhcpv4/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing dhcpv4 traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/dhcpv4/sample_event.json b/packages/network_traffic/data_stream/dhcpv4/sample_event.json index 595f2669eed..ec87a1a8bd6 100644 --- a/packages/network_traffic/data_stream/dhcpv4/sample_event.json +++ b/packages/network_traffic/data_stream/dhcpv4/sample_event.json @@ -41,7 +41,7 @@ "transaction_id": "0x00003d1d" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "9e89fcea-696e-4a75-9119-4c7bc3a85882", diff --git a/packages/network_traffic/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index 66c41e41389..259bb8a680d 100644 --- a/packages/network_traffic/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing dhcpv4 traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/dns/manifest.yml b/packages/network_traffic/data_stream/dns/manifest.yml index 09663525cdf..61a923e46ac 100644 --- a/packages/network_traffic/data_stream/dns/manifest.yml +++ b/packages/network_traffic/data_stream/dns/manifest.yml @@ -88,7 +88,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/dns/sample_event.json b/packages/network_traffic/data_stream/dns/sample_event.json index 86f627ea726..8d4eb135b92 100644 --- a/packages/network_traffic/data_stream/dns/sample_event.json +++ b/packages/network_traffic/data_stream/dns/sample_event.json @@ -82,7 +82,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "827ce6a9-85bd-4e07-9a7a-4896c17144cd", diff --git a/packages/network_traffic/data_stream/flow/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/flow/elasticsearch/ingest_pipeline/default.yml index ab6f5f3ad11..5b32ba3d7ee 100644 --- a/packages/network_traffic/data_stream/flow/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/flow/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing traffic flows processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set {host,source,destination}.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/flow/manifest.yml b/packages/network_traffic/data_stream/flow/manifest.yml index 07a38faff82..7ed659cc079 100644 --- a/packages/network_traffic/data_stream/flow/manifest.yml +++ b/packages/network_traffic/data_stream/flow/manifest.yml @@ -33,7 +33,7 @@ streams: - name: timeout type: text title: Flow timeout - description: Timeout configures the lifetime of a flow. If no packets have been received for a flow within the timeout time window, the flow is killed and reported. + description: Timeout configures the lifetime of a flow. If no packets have been received for a flow within the timeout time window, the flow is killed and reported. Valid time units are ns, us, ms, s, m, h. required: false show_user: false default: '30s' diff --git a/packages/network_traffic/data_stream/flow/sample_event.json b/packages/network_traffic/data_stream/flow/sample_event.json index 70ec359f606..3402cc4dcd0 100644 --- a/packages/network_traffic/data_stream/flow/sample_event.json +++ b/packages/network_traffic/data_stream/flow/sample_event.json @@ -19,7 +19,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c70d142e-4a17-4f44-8e4f-ae1b216f2ea2", diff --git a/packages/network_traffic/data_stream/http/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/http/elasticsearch/ingest_pipeline/default.yml index a2e708270f1..75f5a7e7ed5 100644 --- a/packages/network_traffic/data_stream/http/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/http/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing http traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/http/manifest.yml b/packages/network_traffic/data_stream/http/manifest.yml index 7d8d20f0d5a..1cde4543342 100644 --- a/packages/network_traffic/data_stream/http/manifest.yml +++ b/packages/network_traffic/data_stream/http/manifest.yml @@ -149,7 +149,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/http/sample_event.json b/packages/network_traffic/data_stream/http/sample_event.json index ba5a740ba4c..c1286596c9a 100644 --- a/packages/network_traffic/data_stream/http/sample_event.json +++ b/packages/network_traffic/data_stream/http/sample_event.json @@ -23,7 +23,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "20cb5c83-48bd-4c1e-ab57-1a86b91daedc", diff --git a/packages/network_traffic/data_stream/icmp/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/icmp/elasticsearch/ingest_pipeline/default.yml index 7527dd3d6ef..31748ced565 100644 --- a/packages/network_traffic/data_stream/icmp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/icmp/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing icmp traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/icmp/sample_event.json b/packages/network_traffic/data_stream/icmp/sample_event.json index f60c8a7b635..4a56cadd79c 100644 --- a/packages/network_traffic/data_stream/icmp/sample_event.json +++ b/packages/network_traffic/data_stream/icmp/sample_event.json @@ -21,7 +21,7 @@ "ip": "10.0.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "138c995b-c63c-44be-aba8-a8cb9a58872d", diff --git a/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json b/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json index f007e9f33af..4fa9d6c596b 100644 --- a/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json +++ b/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json @@ -1,655 +1,655 @@ { - "events": [ - { - "agent": { - "ephemeral_id": "1dc3d6c4-48d7-4268-968a-04bd7c3fd84a", - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "name": "docker-fleet-agent", - "type": "packetbeat", - "version": "8.7.1" - }, - "client": { - "bytes": 2005, - "ip": "192.168.188.37", - "port": 55322 - }, - "data_stream": { - "dataset": "network_traffic.memcached", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "bytes": 24, - "ip": "192.168.188.38", - "port": 11211 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "snapshot": false, - "version": "8.7.1" - }, - "event": { - "category": [ - "network" - ], - "dataset": "network_traffic.memcached", - "duration": 79472, - "end": "2023-06-08T14:58:19.574Z", - "kind": "event", - "start": "2023-06-08T14:58:19.574Z", - "type": [ - "connection", - "protocol" - ] - }, - "event.action": "memcache.stats", - "event.outcome": "success", - "host": { - "architecture": "x86_64", - "containerized": false, - "hostname": "docker-fleet-agent", - "id": "fd2c4b0943e444508c12855a04d117c7", - "ip": [ - "172.20.0.6" - ], - "mac": [ - "02-42-AC-14-00-06" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "6.3.6-arch1-1", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.6 LTS (Focal Fossa)" - } - }, - "memcache": { - "protocol_type": "binary", - "request": { - "command": "stats", - "opaque": 196608, - "opcode": "Stat", - "opcode_value": 16, - "quiet": false, - "type": "Stats", - "vbucket": 0 - }, - "response": { - "command": "stats", - "keys": [ - "pid" - ], - "opaque": 196608, - "opcode": "Stat", - "opcode_value": 16, - "stats": [ - { - "name": "pid", - "value": "1" - }, - { - "name": "uptime", - "value": "183329" - }, - { - "name": "time", - "value": "1440267261" - }, - { - "name": "version", - "value": "1.4.24" - }, - { - "name": "libevent", - "value": "2.0.21-stable" - }, - { - "name": "pointer_size", - "value": "64" - }, - { - "name": "rusage_user", - "value": "4.000000" - }, - { - "name": "rusage_system", - "value": "5.450000" - }, - { - "name": "curr_connections", - "value": "10" - }, - { - "name": "total_connections", - "value": "148" - }, - { - "name": "connection_structures", - "value": "11" - }, - { - "name": "reserved_fds", - "value": "20" - }, - { - "name": "cmd_get", - "value": "248" - }, - { - "name": "cmd_set", - "value": "252" - }, - { - "name": "cmd_flush", - "value": "0" - }, - { - "name": "cmd_touch", - "value": "0" - }, - { - "name": "get_hits", - "value": "192" - }, - { - "name": "get_misses", - "value": "56" - }, - { - "name": "delete_misses", - "value": "0" - }, - { - "name": "delete_hits", - "value": "28" - }, - { - "name": "incr_misses", - "value": "7" - }, - { - "name": "incr_hits", - "value": "26" - }, - { - "name": "decr_misses", - "value": "0" - }, - { - "name": "decr_hits", - "value": "21" - }, - { - "name": "cas_misses", - "value": "0" - }, - { - "name": "cas_hits", - "value": "0" - }, - { - "name": "cas_badval", - "value": "0" - }, - { - "name": "touch_hits", - "value": "0" - }, - { - "name": "touch_misses", - "value": "0" - }, - { - "name": "auth_cmds", - "value": "0" - }, - { - "name": "auth_errors", - "value": "0" - }, - { - "name": "bytes_read", - "value": "191781" - }, - { - "name": "bytes_written", - "value": "196745" - }, - { - "name": "limit_maxbytes", - "value": "67108864" - }, - { - "name": "accepting_conns", - "value": "1" - }, - { - "name": "listen_disabled_num", - "value": "0" - }, - { - "name": "threads", - "value": "4" - }, - { - "name": "conn_yields", - "value": "0" - }, - { - "name": "hash_power_level", - "value": "16" - }, - { - "name": "hash_bytes", - "value": "524288" - }, - { - "name": "hash_is_expanding", - "value": "0" - }, - { - "name": "malloc_fails", - "value": "0" - }, - { - "name": "bytes", - "value": "2885" - }, - { - "name": "curr_items", - "value": "10" - }, - { - "name": "total_items", - "value": "252" - }, - { - "name": "expired_unfetched", - "value": "0" - }, - { - "name": "evicted_unfetched", - "value": "0" - }, - { - "name": "evictions", - "value": "0" - }, - { - "name": "reclaimed", - "value": "0" - }, - { - "name": "crawler_reclaimed", - "value": "0" - }, - { - "name": "crawler_items_checked", - "value": "0" - }, - { - "name": "lrutail_reflocked", - "value": "0" - } - ], - "status": "Success", - "status_code": 0, - "type": "Stats" - } - }, - "network": { - "bytes": 2029, - "community_id": "1:60niiGfWxMl9SEmb67FS023acOU=", - "direction": "unknown", - "protocol": "memcache", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.188.37", - "192.168.188.38" - ] - }, - "server": { - "bytes": 24, - "ip": "192.168.188.38", - "port": 11211 - }, - "source": { - "bytes": 2005, - "ip": "192.168.188.37", - "port": 55322 - }, - "status": "OK", - "type": "memcache" - }, - { - "_conf": { - "geoip_enrich": true - }, - "agent": { - "ephemeral_id": "c580a71e-34de-454b-96b9-30272e2e1fe0", - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "name": "docker-fleet-agent", - "type": "packetbeat", - "version": "8.7.1" - }, - "client": { - "bytes": 1154, - "ip": "192.168.188.37", - "port": 55321 - }, - "data_stream": { - "dataset": "network_traffic.memcached", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "bytes": 8, - "ip": "192.168.188.38", - "port": 11211 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "snapshot": false, - "version": "8.7.1" - }, - "event": { - "category": [ - "network" - ], - "dataset": "network_traffic.memcached", - "duration": 39088, - "end": "2023-06-08T14:59:25.702Z", - "kind": "event", - "start": "2023-06-08T14:59:25.701Z", - "type": [ - "connection", - "protocol" - ] - }, - "event.action": "memcache.stats", - "event.outcome": "success", - "host": { - "architecture": "x86_64", - "containerized": false, - "hostname": "docker-fleet-agent", - "id": "fd2c4b0943e444508c12855a04d117c7", - "ip": [ - "172.20.0.6" - ], - "mac": [ - "02-42-AC-14-00-06" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "6.3.6-arch1-1", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.6 LTS (Focal Fossa)" - } - }, - "memcache": { - "protocol_type": "text", - "request": { - "command": "stats", - "raw_args": "", - "type": "Stats" + "events": [ + { + "agent": { + "ephemeral_id": "1dc3d6c4-48d7-4268-968a-04bd7c3fd84a", + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.7.1" + }, + "client": { + "bytes": 2005, + "ip": "192.168.188.37", + "port": 55322 + }, + "data_stream": { + "dataset": "network_traffic.memcached", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 24, + "ip": "192.168.188.38", + "port": 11211 + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "category": [ + "network" + ], + "dataset": "network_traffic.memcached", + "duration": 79472, + "end": "2023-06-08T14:58:19.574Z", + "kind": "event", + "start": "2023-06-08T14:58:19.574Z", + "type": [ + "connection", + "protocol" + ] + }, + "event.action": "memcache.stats", + "event.outcome": "success", + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "ip": [ + "172.20.0.6" + ], + "mac": [ + "02-42-AC-14-00-06" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "6.3.6-arch1-1", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "memcache": { + "protocol_type": "binary", + "request": { + "command": "stats", + "opaque": 196608, + "opcode": "Stat", + "opcode_value": 16, + "quiet": false, + "type": "Stats", + "vbucket": 0 + }, + "response": { + "command": "stats", + "keys": [ + "pid" + ], + "opaque": 196608, + "opcode": "Stat", + "opcode_value": 16, + "stats": [ + { + "name": "pid", + "value": "1" + }, + { + "name": "uptime", + "value": "183329" + }, + { + "name": "time", + "value": "1440267261" + }, + { + "name": "version", + "value": "1.4.24" + }, + { + "name": "libevent", + "value": "2.0.21-stable" + }, + { + "name": "pointer_size", + "value": "64" + }, + { + "name": "rusage_user", + "value": "4.000000" + }, + { + "name": "rusage_system", + "value": "5.450000" + }, + { + "name": "curr_connections", + "value": "10" + }, + { + "name": "total_connections", + "value": "148" + }, + { + "name": "connection_structures", + "value": "11" + }, + { + "name": "reserved_fds", + "value": "20" + }, + { + "name": "cmd_get", + "value": "248" + }, + { + "name": "cmd_set", + "value": "252" + }, + { + "name": "cmd_flush", + "value": "0" + }, + { + "name": "cmd_touch", + "value": "0" + }, + { + "name": "get_hits", + "value": "192" + }, + { + "name": "get_misses", + "value": "56" + }, + { + "name": "delete_misses", + "value": "0" + }, + { + "name": "delete_hits", + "value": "28" + }, + { + "name": "incr_misses", + "value": "7" + }, + { + "name": "incr_hits", + "value": "26" + }, + { + "name": "decr_misses", + "value": "0" + }, + { + "name": "decr_hits", + "value": "21" + }, + { + "name": "cas_misses", + "value": "0" + }, + { + "name": "cas_hits", + "value": "0" + }, + { + "name": "cas_badval", + "value": "0" + }, + { + "name": "touch_hits", + "value": "0" + }, + { + "name": "touch_misses", + "value": "0" + }, + { + "name": "auth_cmds", + "value": "0" + }, + { + "name": "auth_errors", + "value": "0" + }, + { + "name": "bytes_read", + "value": "191781" + }, + { + "name": "bytes_written", + "value": "196745" + }, + { + "name": "limit_maxbytes", + "value": "67108864" + }, + { + "name": "accepting_conns", + "value": "1" + }, + { + "name": "listen_disabled_num", + "value": "0" + }, + { + "name": "threads", + "value": "4" + }, + { + "name": "conn_yields", + "value": "0" + }, + { + "name": "hash_power_level", + "value": "16" + }, + { + "name": "hash_bytes", + "value": "524288" + }, + { + "name": "hash_is_expanding", + "value": "0" + }, + { + "name": "malloc_fails", + "value": "0" + }, + { + "name": "bytes", + "value": "2885" + }, + { + "name": "curr_items", + "value": "10" + }, + { + "name": "total_items", + "value": "252" + }, + { + "name": "expired_unfetched", + "value": "0" + }, + { + "name": "evicted_unfetched", + "value": "0" + }, + { + "name": "evictions", + "value": "0" + }, + { + "name": "reclaimed", + "value": "0" + }, + { + "name": "crawler_reclaimed", + "value": "0" + }, + { + "name": "crawler_items_checked", + "value": "0" + }, + { + "name": "lrutail_reflocked", + "value": "0" + } + ], + "status": "Success", + "status_code": 0, + "type": "Stats" + } + }, + "network": { + "bytes": 2029, + "community_id": "1:60niiGfWxMl9SEmb67FS023acOU=", + "direction": "unknown", + "protocol": "memcache", + "transport": "tcp", + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.188.37", + "192.168.188.38" + ] + }, + "server": { + "bytes": 24, + "ip": "192.168.188.38", + "port": 11211 + }, + "source": { + "bytes": 2005, + "ip": "192.168.188.37", + "port": 55322 + }, + "status": "OK", + "type": "memcache" }, - "response": { - "command": "STAT", - "stats": [ - { - "name": "pid", - "value": "1" - }, - { - "name": "uptime", - "value": "183323" - }, - { - "name": "time", - "value": "1440267255" - }, - { - "name": "version", - "value": "1.4.24" - }, - { - "name": "libevent", - "value": "2.0.21-stable" - }, - { - "name": "pointer_size", - "value": "64" - }, - { - "name": "rusage_user", - "value": "4.000000" - }, - { - "name": "rusage_system", - "value": "5.450000" - }, - { - "name": "curr_connections", - "value": "10" - }, - { - "name": "total_connections", - "value": "147" - }, - { - "name": "connection_structures", - "value": "11" - }, - { - "name": "reserved_fds", - "value": "20" - }, - { - "name": "cmd_get", - "value": "247" - }, - { - "name": "cmd_set", - "value": "251" - }, - { - "name": "cmd_flush", - "value": "0" - }, - { - "name": "cmd_touch", - "value": "0" - }, - { - "name": "get_hits", - "value": "191" - }, - { - "name": "get_misses", - "value": "56" - }, - { - "name": "delete_misses", - "value": "0" - }, - { - "name": "delete_hits", - "value": "28" - }, - { - "name": "incr_misses", - "value": "7" - }, - { - "name": "incr_hits", - "value": "26" - }, - { - "name": "decr_misses", - "value": "0" - }, - { - "name": "decr_hits", - "value": "21" - }, - { - "name": "cas_misses", - "value": "0" - }, - { - "name": "cas_hits", - "value": "0" - }, - { - "name": "cas_badval", - "value": "0" - }, - { - "name": "touch_hits", - "value": "0" - }, - { - "name": "touch_misses", - "value": "0" - }, - { - "name": "auth_cmds", - "value": "0" - }, - { - "name": "auth_errors", - "value": "0" - }, - { - "name": "bytes_read", - "value": "191686" - }, - { - "name": "bytes_written", - "value": "195533" - }, - { - "name": "limit_maxbytes", - "value": "67108864" - }, - { - "name": "accepting_conns", - "value": "1" - }, - { - "name": "listen_disabled_num", - "value": "0" - }, - { - "name": "threads", - "value": "4" - }, - { - "name": "conn_yields", - "value": "0" - }, - { - "name": "hash_power_level", - "value": "16" - }, - { - "name": "hash_bytes", - "value": "524288" - }, - { - "name": "hash_is_expanding", - "value": "0" - }, - { - "name": "malloc_fails", - "value": "0" - }, - { - "name": "bytes", - "value": "2885" - }, - { - "name": "curr_items", - "value": "10" - }, - { - "name": "total_items", - "value": "251" - }, - { - "name": "expired_unfetched", - "value": "0" - }, - { - "name": "evicted_unfetched", - "value": "0" - }, - { - "name": "evictions", - "value": "0" - }, - { - "name": "reclaimed", - "value": "0" - }, - { - "name": "crawler_reclaimed", - "value": "0" - }, - { - "name": "crawler_items_checked", - "value": "0" - }, - { - "name": "lrutail_reflocked", - "value": "0" - } - ], - "type": "Stats" + { + "_conf": { + "geoip_enrich": true + }, + "agent": { + "ephemeral_id": "c580a71e-34de-454b-96b9-30272e2e1fe0", + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.7.1" + }, + "client": { + "bytes": 1154, + "ip": "192.168.188.37", + "port": 55321 + }, + "data_stream": { + "dataset": "network_traffic.memcached", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 8, + "ip": "192.168.188.38", + "port": 11211 + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "category": [ + "network" + ], + "dataset": "network_traffic.memcached", + "duration": 39088, + "end": "2023-06-08T14:59:25.702Z", + "kind": "event", + "start": "2023-06-08T14:59:25.701Z", + "type": [ + "connection", + "protocol" + ] + }, + "event.action": "memcache.stats", + "event.outcome": "success", + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "ip": [ + "172.20.0.6" + ], + "mac": [ + "02-42-AC-14-00-06" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "6.3.6-arch1-1", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "memcache": { + "protocol_type": "text", + "request": { + "command": "stats", + "raw_args": "", + "type": "Stats" + }, + "response": { + "command": "STAT", + "stats": [ + { + "name": "pid", + "value": "1" + }, + { + "name": "uptime", + "value": "183323" + }, + { + "name": "time", + "value": "1440267255" + }, + { + "name": "version", + "value": "1.4.24" + }, + { + "name": "libevent", + "value": "2.0.21-stable" + }, + { + "name": "pointer_size", + "value": "64" + }, + { + "name": "rusage_user", + "value": "4.000000" + }, + { + "name": "rusage_system", + "value": "5.450000" + }, + { + "name": "curr_connections", + "value": "10" + }, + { + "name": "total_connections", + "value": "147" + }, + { + "name": "connection_structures", + "value": "11" + }, + { + "name": "reserved_fds", + "value": "20" + }, + { + "name": "cmd_get", + "value": "247" + }, + { + "name": "cmd_set", + "value": "251" + }, + { + "name": "cmd_flush", + "value": "0" + }, + { + "name": "cmd_touch", + "value": "0" + }, + { + "name": "get_hits", + "value": "191" + }, + { + "name": "get_misses", + "value": "56" + }, + { + "name": "delete_misses", + "value": "0" + }, + { + "name": "delete_hits", + "value": "28" + }, + { + "name": "incr_misses", + "value": "7" + }, + { + "name": "incr_hits", + "value": "26" + }, + { + "name": "decr_misses", + "value": "0" + }, + { + "name": "decr_hits", + "value": "21" + }, + { + "name": "cas_misses", + "value": "0" + }, + { + "name": "cas_hits", + "value": "0" + }, + { + "name": "cas_badval", + "value": "0" + }, + { + "name": "touch_hits", + "value": "0" + }, + { + "name": "touch_misses", + "value": "0" + }, + { + "name": "auth_cmds", + "value": "0" + }, + { + "name": "auth_errors", + "value": "0" + }, + { + "name": "bytes_read", + "value": "191686" + }, + { + "name": "bytes_written", + "value": "195533" + }, + { + "name": "limit_maxbytes", + "value": "67108864" + }, + { + "name": "accepting_conns", + "value": "1" + }, + { + "name": "listen_disabled_num", + "value": "0" + }, + { + "name": "threads", + "value": "4" + }, + { + "name": "conn_yields", + "value": "0" + }, + { + "name": "hash_power_level", + "value": "16" + }, + { + "name": "hash_bytes", + "value": "524288" + }, + { + "name": "hash_is_expanding", + "value": "0" + }, + { + "name": "malloc_fails", + "value": "0" + }, + { + "name": "bytes", + "value": "2885" + }, + { + "name": "curr_items", + "value": "10" + }, + { + "name": "total_items", + "value": "251" + }, + { + "name": "expired_unfetched", + "value": "0" + }, + { + "name": "evicted_unfetched", + "value": "0" + }, + { + "name": "evictions", + "value": "0" + }, + { + "name": "reclaimed", + "value": "0" + }, + { + "name": "crawler_reclaimed", + "value": "0" + }, + { + "name": "crawler_items_checked", + "value": "0" + }, + { + "name": "lrutail_reflocked", + "value": "0" + } + ], + "type": "Stats" + } + }, + "network": { + "bytes": 1162, + "community_id": "1:PB7vEs4V/pEYgD41A4BnjbXNw+w=", + "direction": "unknown", + "protocol": "memcache", + "transport": "tcp", + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.188.37", + "192.168.188.38" + ] + }, + "server": { + "bytes": 8, + "ip": "192.168.188.38", + "port": 11211 + }, + "source": { + "bytes": 1154, + "ip": "192.168.188.37", + "port": 55321 + }, + "status": "OK", + "type": "memcache" } - }, - "network": { - "bytes": 1162, - "community_id": "1:PB7vEs4V/pEYgD41A4BnjbXNw+w=", - "direction": "unknown", - "protocol": "memcache", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.188.37", - "192.168.188.38" - ] - }, - "server": { - "bytes": 8, - "ip": "192.168.188.38", - "port": 11211 - }, - "source": { - "bytes": 1154, - "ip": "192.168.188.37", - "port": 55321 - }, - "status": "OK", - "type": "memcache" - } - ] -} + ] +} \ No newline at end of file diff --git a/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json-expected.json b/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json-expected.json index beb962bb199..25bd3e322f6 100644 --- a/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json-expected.json +++ b/packages/network_traffic/data_stream/memcached/_dev/test/pipeline/test-stats-responses.json-expected.json @@ -1,346 +1,346 @@ { - "expected": [ - { - "agent": { - "ephemeral_id": "1dc3d6c4-48d7-4268-968a-04bd7c3fd84a", - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "name": "docker-fleet-agent", - "type": "packetbeat", - "version": "8.7.1" - }, - "client": { - "bytes": 2005, - "ip": "192.168.188.37", - "port": 55322 - }, - "data_stream": { - "dataset": "network_traffic.memcached", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "bytes": 24, - "ip": "192.168.188.38", - "port": 11211 - }, - "ecs": { - "version": "8.8.0" - }, - "elastic_agent": { - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "snapshot": false, - "version": "8.7.1" - }, - "event": { - "category": [ - "network" - ], - "dataset": "network_traffic.memcached", - "duration": 79472, - "end": "2023-06-08T14:58:19.574Z", - "kind": "event", - "start": "2023-06-08T14:58:19.574Z", - "type": [ - "connection", - "protocol" - ] - }, - "event.action": "memcache.stats", - "event.outcome": "success", - "host": { - "architecture": "x86_64", - "containerized": false, - "hostname": "docker-fleet-agent", - "id": "fd2c4b0943e444508c12855a04d117c7", - "ip": [ - "172.20.0.6" - ], - "mac": [ - "02-42-AC-14-00-06" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "6.3.6-arch1-1", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.6 LTS (Focal Fossa)" - } - }, - "memcache": { - "protocol_type": "binary", - "request": { - "command": "stats", - "opaque": 196608, - "opcode": "Stat", - "opcode_value": 16, - "quiet": false, - "type": "Stats", - "vbucket": 0 - }, - "response": { - "command": "stats", - "keys": [ - "pid" - ], - "opaque": 196608, - "opcode": "Stat", - "opcode_value": 16, - "status": "Success", - "status_code": 0, - "type": "Stats", - "stats": { - "pid": "1", - "uptime": "183329", - "time": "1440267261", - "version": "1.4.24", - "libevent": "2.0.21-stable", - "pointer_size": "64", - "rusage_user": "4.000000", - "rusage_system": "5.450000", - "curr_connections": "10", - "total_connections": "148", - "connection_structures": "11", - "reserved_fds": "20", - "cmd_get": "248", - "cmd_set": "252", - "cmd_flush": "0", - "cmd_touch": "0", - "get_hits": "192", - "get_misses": "56", - "delete_misses": "0", - "delete_hits": "28", - "incr_misses": "7", - "incr_hits": "26", - "decr_misses": "0", - "decr_hits": "21", - "cas_misses": "0", - "cas_hits": "0", - "cas_badval": "0", - "touch_hits": "0", - "touch_misses": "0", - "auth_cmds": "0", - "auth_errors": "0", - "bytes_read": "191781", - "bytes_written": "196745", - "limit_maxbytes": "67108864", - "accepting_conns": "1", - "listen_disabled_num": "0", - "threads": "4", - "conn_yields": "0", - "hash_power_level": "16", - "hash_bytes": "524288", - "hash_is_expanding": "0", - "malloc_fails": "0", - "bytes": "2885", - "curr_items": "10", - "total_items": "252", - "expired_unfetched": "0", - "evicted_unfetched": "0", - "evictions": "0", - "reclaimed": "0", - "crawler_reclaimed": "0", - "crawler_items_checked": "0", - "lrutail_reflocked": "0" - } - } - }, - "network": { - "bytes": 2029, - "community_id": "1:60niiGfWxMl9SEmb67FS023acOU=", - "direction": "unknown", - "protocol": "memcache", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.188.37", - "192.168.188.38" - ] - }, - "server": { - "bytes": 24, - "ip": "192.168.188.38", - "port": 11211 - }, - "source": { - "bytes": 2005, - "ip": "192.168.188.37", - "port": 55322 - }, - "status": "OK", - "tags": [ - "preserve_original_event" - ], - "type": "memcache" - }, - { - "agent": { - "ephemeral_id": "c580a71e-34de-454b-96b9-30272e2e1fe0", - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "name": "docker-fleet-agent", - "type": "packetbeat", - "version": "8.7.1" - }, - "client": { - "bytes": 1154, - "ip": "192.168.188.37", - "port": 55321 - }, - "data_stream": { - "dataset": "network_traffic.memcached", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "bytes": 8, - "ip": "192.168.188.38", - "port": 11211 - }, - "ecs": { - "version": "8.8.0" - }, - "elastic_agent": { - "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", - "snapshot": false, - "version": "8.7.1" - }, - "event": { - "category": [ - "network" - ], - "dataset": "network_traffic.memcached", - "duration": 39088, - "end": "2023-06-08T14:59:25.702Z", - "kind": "event", - "start": "2023-06-08T14:59:25.701Z", - "type": [ - "connection", - "protocol" - ] - }, - "event.action": "memcache.stats", - "event.outcome": "success", - "host": { - "architecture": "x86_64", - "containerized": false, - "hostname": "docker-fleet-agent", - "id": "fd2c4b0943e444508c12855a04d117c7", - "ip": [ - "172.20.0.6" - ], - "mac": [ - "02-42-AC-14-00-06" - ], - "name": "docker-fleet-agent", - "os": { - "codename": "focal", - "family": "debian", - "kernel": "6.3.6-arch1-1", - "name": "Ubuntu", - "platform": "ubuntu", - "type": "linux", - "version": "20.04.6 LTS (Focal Fossa)" - } - }, - "memcache": { - "protocol_type": "text", - "request": { - "command": "stats", - "raw_args": "", - "type": "Stats" + "expected": [ + { + "agent": { + "ephemeral_id": "1dc3d6c4-48d7-4268-968a-04bd7c3fd84a", + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.7.1" + }, + "client": { + "bytes": 2005, + "ip": "192.168.188.37", + "port": 55322 + }, + "data_stream": { + "dataset": "network_traffic.memcached", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 24, + "ip": "192.168.188.38", + "port": 11211 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "category": [ + "network" + ], + "dataset": "network_traffic.memcached", + "duration": 79472, + "end": "2023-06-08T14:58:19.574Z", + "kind": "event", + "start": "2023-06-08T14:58:19.574Z", + "type": [ + "connection", + "protocol" + ] + }, + "event.action": "memcache.stats", + "event.outcome": "success", + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "ip": [ + "172.20.0.6" + ], + "mac": [ + "02-42-AC-14-00-06" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "6.3.6-arch1-1", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "memcache": { + "protocol_type": "binary", + "request": { + "command": "stats", + "opaque": 196608, + "opcode": "Stat", + "opcode_value": 16, + "quiet": false, + "type": "Stats", + "vbucket": 0 + }, + "response": { + "command": "stats", + "keys": [ + "pid" + ], + "opaque": 196608, + "opcode": "Stat", + "opcode_value": 16, + "stats": { + "accepting_conns": "1", + "auth_cmds": "0", + "auth_errors": "0", + "bytes": "2885", + "bytes_read": "191781", + "bytes_written": "196745", + "cas_badval": "0", + "cas_hits": "0", + "cas_misses": "0", + "cmd_flush": "0", + "cmd_get": "248", + "cmd_set": "252", + "cmd_touch": "0", + "conn_yields": "0", + "connection_structures": "11", + "crawler_items_checked": "0", + "crawler_reclaimed": "0", + "curr_connections": "10", + "curr_items": "10", + "decr_hits": "21", + "decr_misses": "0", + "delete_hits": "28", + "delete_misses": "0", + "evicted_unfetched": "0", + "evictions": "0", + "expired_unfetched": "0", + "get_hits": "192", + "get_misses": "56", + "hash_bytes": "524288", + "hash_is_expanding": "0", + "hash_power_level": "16", + "incr_hits": "26", + "incr_misses": "7", + "libevent": "2.0.21-stable", + "limit_maxbytes": "67108864", + "listen_disabled_num": "0", + "lrutail_reflocked": "0", + "malloc_fails": "0", + "pid": "1", + "pointer_size": "64", + "reclaimed": "0", + "reserved_fds": "20", + "rusage_system": "5.450000", + "rusage_user": "4.000000", + "threads": "4", + "time": "1440267261", + "total_connections": "148", + "total_items": "252", + "touch_hits": "0", + "touch_misses": "0", + "uptime": "183329", + "version": "1.4.24" + }, + "status": "Success", + "status_code": 0, + "type": "Stats" + } + }, + "network": { + "bytes": 2029, + "community_id": "1:60niiGfWxMl9SEmb67FS023acOU=", + "direction": "unknown", + "protocol": "memcache", + "transport": "tcp", + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.188.37", + "192.168.188.38" + ] + }, + "server": { + "bytes": 24, + "ip": "192.168.188.38", + "port": 11211 + }, + "source": { + "bytes": 2005, + "ip": "192.168.188.37", + "port": 55322 + }, + "status": "OK", + "tags": [ + "preserve_original_event" + ], + "type": "memcache" }, - "response": { - "command": "STAT", - "type": "Stats", - "stats": { - "pid": "1", - "uptime": "183323", - "time": "1440267255", - "version": "1.4.24", - "libevent": "2.0.21-stable", - "pointer_size": "64", - "rusage_user": "4.000000", - "rusage_system": "5.450000", - "curr_connections": "10", - "total_connections": "147", - "connection_structures": "11", - "reserved_fds": "20", - "cmd_get": "247", - "cmd_set": "251", - "cmd_flush": "0", - "cmd_touch": "0", - "get_hits": "191", - "get_misses": "56", - "delete_misses": "0", - "delete_hits": "28", - "incr_misses": "7", - "incr_hits": "26", - "decr_misses": "0", - "decr_hits": "21", - "cas_misses": "0", - "cas_hits": "0", - "cas_badval": "0", - "touch_hits": "0", - "touch_misses": "0", - "auth_cmds": "0", - "auth_errors": "0", - "bytes_read": "191686", - "bytes_written": "195533", - "limit_maxbytes": "67108864", - "accepting_conns": "1", - "listen_disabled_num": "0", - "threads": "4", - "conn_yields": "0", - "hash_power_level": "16", - "hash_bytes": "524288", - "hash_is_expanding": "0", - "malloc_fails": "0", - "bytes": "2885", - "curr_items": "10", - "total_items": "251", - "expired_unfetched": "0", - "evicted_unfetched": "0", - "evictions": "0", - "reclaimed": "0", - "crawler_reclaimed": "0", - "crawler_items_checked": "0", - "lrutail_reflocked": "0" - } + { + "agent": { + "ephemeral_id": "c580a71e-34de-454b-96b9-30272e2e1fe0", + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "name": "docker-fleet-agent", + "type": "packetbeat", + "version": "8.7.1" + }, + "client": { + "bytes": 1154, + "ip": "192.168.188.37", + "port": 55321 + }, + "data_stream": { + "dataset": "network_traffic.memcached", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "bytes": 8, + "ip": "192.168.188.38", + "port": 11211 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "c1bac647-3e5b-4e76-9d6d-ff0be67c3d6e", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "category": [ + "network" + ], + "dataset": "network_traffic.memcached", + "duration": 39088, + "end": "2023-06-08T14:59:25.702Z", + "kind": "event", + "start": "2023-06-08T14:59:25.701Z", + "type": [ + "connection", + "protocol" + ] + }, + "event.action": "memcache.stats", + "event.outcome": "success", + "host": { + "architecture": "x86_64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "fd2c4b0943e444508c12855a04d117c7", + "ip": [ + "172.20.0.6" + ], + "mac": [ + "02-42-AC-14-00-06" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "6.3.6-arch1-1", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "memcache": { + "protocol_type": "text", + "request": { + "command": "stats", + "raw_args": "", + "type": "Stats" + }, + "response": { + "command": "STAT", + "stats": { + "accepting_conns": "1", + "auth_cmds": "0", + "auth_errors": "0", + "bytes": "2885", + "bytes_read": "191686", + "bytes_written": "195533", + "cas_badval": "0", + "cas_hits": "0", + "cas_misses": "0", + "cmd_flush": "0", + "cmd_get": "247", + "cmd_set": "251", + "cmd_touch": "0", + "conn_yields": "0", + "connection_structures": "11", + "crawler_items_checked": "0", + "crawler_reclaimed": "0", + "curr_connections": "10", + "curr_items": "10", + "decr_hits": "21", + "decr_misses": "0", + "delete_hits": "28", + "delete_misses": "0", + "evicted_unfetched": "0", + "evictions": "0", + "expired_unfetched": "0", + "get_hits": "191", + "get_misses": "56", + "hash_bytes": "524288", + "hash_is_expanding": "0", + "hash_power_level": "16", + "incr_hits": "26", + "incr_misses": "7", + "libevent": "2.0.21-stable", + "limit_maxbytes": "67108864", + "listen_disabled_num": "0", + "lrutail_reflocked": "0", + "malloc_fails": "0", + "pid": "1", + "pointer_size": "64", + "reclaimed": "0", + "reserved_fds": "20", + "rusage_system": "5.450000", + "rusage_user": "4.000000", + "threads": "4", + "time": "1440267255", + "total_connections": "147", + "total_items": "251", + "touch_hits": "0", + "touch_misses": "0", + "uptime": "183323", + "version": "1.4.24" + }, + "type": "Stats" + } + }, + "network": { + "bytes": 1162, + "community_id": "1:PB7vEs4V/pEYgD41A4BnjbXNw+w=", + "direction": "unknown", + "protocol": "memcache", + "transport": "tcp", + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.188.37", + "192.168.188.38" + ] + }, + "server": { + "bytes": 8, + "ip": "192.168.188.38", + "port": 11211 + }, + "source": { + "bytes": 1154, + "ip": "192.168.188.37", + "port": 55321 + }, + "status": "OK", + "tags": [ + "preserve_original_event" + ], + "type": "memcache" } - }, - "network": { - "bytes": 1162, - "community_id": "1:PB7vEs4V/pEYgD41A4BnjbXNw+w=", - "direction": "unknown", - "protocol": "memcache", - "transport": "tcp", - "type": "ipv4" - }, - "related": { - "ip": [ - "192.168.188.37", - "192.168.188.38" - ] - }, - "server": { - "bytes": 8, - "ip": "192.168.188.38", - "port": 11211 - }, - "source": { - "bytes": 1154, - "ip": "192.168.188.37", - "port": 55321 - }, - "status": "OK", - "tags": [ - "preserve_original_event" - ], - "type": "memcache" - } - ] -} + ] +} \ No newline at end of file diff --git a/packages/network_traffic/data_stream/memcached/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/memcached/elasticsearch/ingest_pipeline/default.yml index 8a351db0d71..9139b14175e 100644 --- a/packages/network_traffic/data_stream/memcached/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/memcached/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing memcached traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/memcached/manifest.yml b/packages/network_traffic/data_stream/memcached/manifest.yml index 2398e78ca7d..6383a4d3706 100644 --- a/packages/network_traffic/data_stream/memcached/manifest.yml +++ b/packages/network_traffic/data_stream/memcached/manifest.yml @@ -109,7 +109,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/memcached/sample_event.json b/packages/network_traffic/data_stream/memcached/sample_event.json index 15f64829780..4ffa3119939 100644 --- a/packages/network_traffic/data_stream/memcached/sample_event.json +++ b/packages/network_traffic/data_stream/memcached/sample_event.json @@ -22,7 +22,7 @@ "port": 11211 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f617d9af-c859-41da-b89c-a10379936378", diff --git a/packages/network_traffic/data_stream/mongodb/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/mongodb/elasticsearch/ingest_pipeline/default.yml index da378c3ac9f..f0e275455ef 100644 --- a/packages/network_traffic/data_stream/mongodb/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/mongodb/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing mongodb traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/mongodb/manifest.yml b/packages/network_traffic/data_stream/mongodb/manifest.yml index c876d333b52..f2be48571e5 100644 --- a/packages/network_traffic/data_stream/mongodb/manifest.yml +++ b/packages/network_traffic/data_stream/mongodb/manifest.yml @@ -79,7 +79,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/mongodb/sample_event.json b/packages/network_traffic/data_stream/mongodb/sample_event.json index 60b13ed4387..9e259f78546 100644 --- a/packages/network_traffic/data_stream/mongodb/sample_event.json +++ b/packages/network_traffic/data_stream/mongodb/sample_event.json @@ -23,7 +23,7 @@ "port": 27017 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml index 5d33a93c6d2..3906fd54539 100644 --- a/packages/network_traffic/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing mysql traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/mysql/manifest.yml b/packages/network_traffic/data_stream/mysql/manifest.yml index a9e5e2226ca..60e23ac19ef 100644 --- a/packages/network_traffic/data_stream/mysql/manifest.yml +++ b/packages/network_traffic/data_stream/mysql/manifest.yml @@ -60,7 +60,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/mysql/sample_event.json b/packages/network_traffic/data_stream/mysql/sample_event.json index f6003c0393c..55df3285bfc 100644 --- a/packages/network_traffic/data_stream/mysql/sample_event.json +++ b/packages/network_traffic/data_stream/mysql/sample_event.json @@ -23,7 +23,7 @@ "port": 3306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/nfs/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/nfs/elasticsearch/ingest_pipeline/default.yml index 59cb6b856b7..6c1a9554c08 100644 --- a/packages/network_traffic/data_stream/nfs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/nfs/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing nfs traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/nfs/manifest.yml b/packages/network_traffic/data_stream/nfs/manifest.yml index 55a6e3dfea8..ce3cbb0f4cc 100644 --- a/packages/network_traffic/data_stream/nfs/manifest.yml +++ b/packages/network_traffic/data_stream/nfs/manifest.yml @@ -60,7 +60,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/nfs/sample_event.json b/packages/network_traffic/data_stream/nfs/sample_event.json index 96209579901..8eb7fec4b64 100644 --- a/packages/network_traffic/data_stream/nfs/sample_event.json +++ b/packages/network_traffic/data_stream/nfs/sample_event.json @@ -24,7 +24,7 @@ "port": 2049 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/pgsql/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/pgsql/elasticsearch/ingest_pipeline/default.yml index dbab89bf766..54e4eff2967 100644 --- a/packages/network_traffic/data_stream/pgsql/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/pgsql/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing pgsql traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/pgsql/manifest.yml b/packages/network_traffic/data_stream/pgsql/manifest.yml index d74fc26094e..5b0e21625bc 100644 --- a/packages/network_traffic/data_stream/pgsql/manifest.yml +++ b/packages/network_traffic/data_stream/pgsql/manifest.yml @@ -60,7 +60,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/pgsql/sample_event.json b/packages/network_traffic/data_stream/pgsql/sample_event.json index ed46c0d6222..1a966fb05e1 100644 --- a/packages/network_traffic/data_stream/pgsql/sample_event.json +++ b/packages/network_traffic/data_stream/pgsql/sample_event.json @@ -23,7 +23,7 @@ "port": 5432 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/redis/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/redis/elasticsearch/ingest_pipeline/default.yml index 214923a8e5f..a37a1358d0a 100644 --- a/packages/network_traffic/data_stream/redis/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/redis/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing redis traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/redis/manifest.yml b/packages/network_traffic/data_stream/redis/manifest.yml index f315c160b98..9dd2efc3809 100644 --- a/packages/network_traffic/data_stream/redis/manifest.yml +++ b/packages/network_traffic/data_stream/redis/manifest.yml @@ -60,7 +60,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/redis/sample_event.json b/packages/network_traffic/data_stream/redis/sample_event.json index 51ed2c1f693..3096700227f 100644 --- a/packages/network_traffic/data_stream/redis/sample_event.json +++ b/packages/network_traffic/data_stream/redis/sample_event.json @@ -23,7 +23,7 @@ "port": 6380 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/sip/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/sip/elasticsearch/ingest_pipeline/default.yml index 887f5678eda..431c46d42c7 100644 --- a/packages/network_traffic/data_stream/sip/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/sip/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing sip traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/sip/sample_event.json b/packages/network_traffic/data_stream/sip/sample_event.json index a5ede4b5d85..85a8c06d915 100644 --- a/packages/network_traffic/data_stream/sip/sample_event.json +++ b/packages/network_traffic/data_stream/sip/sample_event.json @@ -21,7 +21,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/thrift/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/thrift/elasticsearch/ingest_pipeline/default.yml index aca0e2e03ce..3b2dc9eb49d 100644 --- a/packages/network_traffic/data_stream/thrift/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/thrift/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing thrift traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/thrift/manifest.yml b/packages/network_traffic/data_stream/thrift/manifest.yml index 98d6ee0eb9e..8e683249f7b 100644 --- a/packages/network_traffic/data_stream/thrift/manifest.yml +++ b/packages/network_traffic/data_stream/thrift/manifest.yml @@ -134,7 +134,7 @@ streams: title: Transaction Timeout description: |- Transaction timeout. Expired transactions will no longer be correlated to - incoming responses, but sent to Elasticsearch immediately. + incoming responses, but sent to Elasticsearch immediately. Valid time units are ns, us, ms, s, m, h. show_user: false multi: false required: false diff --git a/packages/network_traffic/data_stream/thrift/sample_event.json b/packages/network_traffic/data_stream/thrift/sample_event.json index fbc276b391a..40b14104290 100644 --- a/packages/network_traffic/data_stream/thrift/sample_event.json +++ b/packages/network_traffic/data_stream/thrift/sample_event.json @@ -23,7 +23,7 @@ "port": 9090 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", diff --git a/packages/network_traffic/data_stream/tls/elasticsearch/ingest_pipeline/default.yml b/packages/network_traffic/data_stream/tls/elasticsearch/ingest_pipeline/default.yml index 788dd33f887..6a706b62b84 100644 --- a/packages/network_traffic/data_stream/tls/elasticsearch/ingest_pipeline/default.yml +++ b/packages/network_traffic/data_stream/tls/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing tls traffic processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## # Set host.mac to dash separated upper case value # as per ECS recommendation diff --git a/packages/network_traffic/data_stream/tls/fields/protocol.yml b/packages/network_traffic/data_stream/tls/fields/protocol.yml index 1081073d98f..5a98fcea939 100644 --- a/packages/network_traffic/data_stream/tls/fields/protocol.yml +++ b/packages/network_traffic/data_stream/tls/fields/protocol.yml @@ -161,11 +161,65 @@ List of extensions that were left unparsed by Packetbeat. - name: server_certificate_chain - type: keyword + type: group description: Chain of trust for the server certificate. + fields: &certificate_object + - name: alternative_names + type: keyword + description: Subject alternative names (SANs) in the certificate. + - name: issuer + type: group + description: Issuer certificate metadata. + fields: &x509_attributes + - name: common_name + type: keyword + - name: country + type: keyword + - name: distinguished_name + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: postal_code + type: keyword + - name: serial_number + type: keyword + - name: state_or_province + type: keyword + - name: street_address + type: keyword + - name: subject + type: group + description: Subject certificate metadata. + fields: *x509_attributes + - name: not_after + type: date + description: End of the validity period (inclusive). + - name: not_before + type: date + description: Start of the validity period (inclusive). + - name: public_key_algorithm + type: keyword + description: Public key algorithm (e.g. RSA, DSA, ECDSA, Ed25519). + - name: public_key_size + type: long + description: Number of bits in the public key. + - name: serial_number + type: keyword + description: Base 10 representation of the certificate serial number. + - name: signature_algorithm + type: keyword + description: Signature algorithm (e.g. SHA256-RSA). + - name: version_number + type: keyword + description: The x509 certificate version. Version 3 is the latest and most common. - name: client_certificate_chain - type: keyword + type: group description: Chain of trust for the client certificate. + fields: *certificate_object - name: alert_types type: keyword description: > diff --git a/packages/network_traffic/data_stream/tls/sample_event.json b/packages/network_traffic/data_stream/tls/sample_event.json index dba4d175b03..f2a21c84603 100644 --- a/packages/network_traffic/data_stream/tls/sample_event.json +++ b/packages/network_traffic/data_stream/tls/sample_event.json @@ -22,7 +22,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8a4932f4-ce31-4183-b0c7-a7008f14e6fa", diff --git a/packages/network_traffic/docs/README.md b/packages/network_traffic/docs/README.md index dbe4e3ae038..c3b2a98e7ef 100644 --- a/packages/network_traffic/docs/README.md +++ b/packages/network_traffic/docs/README.md @@ -190,10 +190,10 @@ The default value is 10s. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -300,7 +300,7 @@ An example event for `flow` looks as following: "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c70d142e-4a17-4f44-8e4f-ae1b216f2ea2", @@ -494,10 +494,10 @@ Fields published for AMQP packets. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -611,7 +611,7 @@ An example event for `amqp` looks as following: "port": 5672 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "24617916-b7fd-4486-af56-1754af7b012c", @@ -839,10 +839,10 @@ Fields published for Apache Cassandra packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -980,7 +980,7 @@ An example event for `cassandra` looks as following: "port": 9042 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "adef13cd-055b-465e-bc3e-5f12f6a4c481", @@ -1143,10 +1143,10 @@ Fields published for DHCPv4 packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -1272,7 +1272,7 @@ An example event for `dhcpv4` looks as following: "transaction_id": "0x00003d1d" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "9e89fcea-696e-4a75-9119-4c7bc3a85882", @@ -1454,10 +1454,10 @@ Fields published for DNS packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -1624,7 +1624,7 @@ An example event for `dns` looks as following: "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "827ce6a9-85bd-4e07-9a7a-4896c17144cd", @@ -1892,10 +1892,10 @@ Fields published for HTTP packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -2025,7 +2025,7 @@ An example event for `http` looks as following: "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "20cb5c83-48bd-4c1e-ab57-1a86b91daedc", @@ -2197,10 +2197,10 @@ Fields published for ICMP packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -2313,7 +2313,7 @@ An example event for `icmp` looks as following: "ip": "10.0.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "138c995b-c63c-44be-aba8-a8cb9a58872d", @@ -2491,11 +2491,11 @@ Fields published for Memcached packets. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -2644,7 +2644,7 @@ An example event for `memcached` looks as following: "port": 11211 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "f617d9af-c859-41da-b89c-a10379936378", @@ -2816,10 +2816,10 @@ Fields published for MongoDB packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -2938,7 +2938,7 @@ An example event for `mongodb` looks as following: "port": 27017 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -3096,10 +3096,10 @@ Fields published for MySQL packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -3214,7 +3214,7 @@ An example event for `mysql` looks as following: "port": 3306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -3355,10 +3355,10 @@ Fields published for NFS packets. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -3483,7 +3483,7 @@ An example event for `nfs` looks as following: "port": 2049 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -3650,10 +3650,10 @@ Fields published for PostgreSQL packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -3766,7 +3766,7 @@ An example event for `pgsql` looks as following: "port": 5432 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -3912,11 +3912,11 @@ Fields published for Redis packets. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -4026,7 +4026,7 @@ An example event for `redis` looks as following: "port": 6380 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -4174,14 +4174,14 @@ Fields published for SIP packets. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -4366,7 +4366,7 @@ An example event for `sip` looks as following: "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -4666,10 +4666,10 @@ Fields published for Thrift packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -4781,7 +4781,7 @@ An example event for `thrift` looks as following: "port": 9090 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "6759a27a-e604-49ba-b36f-065c790b1724", @@ -4982,10 +4982,10 @@ Fields published for TLS packets. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | flow.final | Indicates if event is last event in flow. If final is false, the event reports an intermediate flow state only. | boolean | | flow.id | Internal flow ID based on connection meta data and address. | keyword | @@ -5103,7 +5103,34 @@ Fields published for TLS packets. | tls.client.x509.version_number | Version of x509 format. | keyword | | tls.curve | String indicating the curve used for the given cipher, when applicable. | keyword | | tls.detailed.alert_types | An array containing the TLS alert type for every alert received. | keyword | -| tls.detailed.client_certificate_chain | Chain of trust for the client certificate. | keyword | +| tls.detailed.client_certificate_chain.alternative_names | Subject alternative names (SANs) in the certificate. | keyword | +| tls.detailed.client_certificate_chain.issuer.common_name | | keyword | +| tls.detailed.client_certificate_chain.issuer.country | | keyword | +| tls.detailed.client_certificate_chain.issuer.distinguished_name | | keyword | +| tls.detailed.client_certificate_chain.issuer.locality | | keyword | +| tls.detailed.client_certificate_chain.issuer.organization | | keyword | +| tls.detailed.client_certificate_chain.issuer.organizational_unit | | keyword | +| tls.detailed.client_certificate_chain.issuer.postal_code | | keyword | +| tls.detailed.client_certificate_chain.issuer.serial_number | | keyword | +| tls.detailed.client_certificate_chain.issuer.state_or_province | | keyword | +| tls.detailed.client_certificate_chain.issuer.street_address | | keyword | +| tls.detailed.client_certificate_chain.not_after | End of the validity period (inclusive). | date | +| tls.detailed.client_certificate_chain.not_before | Start of the validity period (inclusive). | date | +| tls.detailed.client_certificate_chain.public_key_algorithm | Public key algorithm (e.g. RSA, DSA, ECDSA, Ed25519). | keyword | +| tls.detailed.client_certificate_chain.public_key_size | Number of bits in the public key. | long | +| tls.detailed.client_certificate_chain.serial_number | Base 10 representation of the certificate serial number. | keyword | +| tls.detailed.client_certificate_chain.signature_algorithm | Signature algorithm (e.g. SHA256-RSA). | keyword | +| tls.detailed.client_certificate_chain.subject.common_name | | keyword | +| tls.detailed.client_certificate_chain.subject.country | | keyword | +| tls.detailed.client_certificate_chain.subject.distinguished_name | | keyword | +| tls.detailed.client_certificate_chain.subject.locality | | keyword | +| tls.detailed.client_certificate_chain.subject.organization | | keyword | +| tls.detailed.client_certificate_chain.subject.organizational_unit | | keyword | +| tls.detailed.client_certificate_chain.subject.postal_code | | keyword | +| tls.detailed.client_certificate_chain.subject.serial_number | | keyword | +| tls.detailed.client_certificate_chain.subject.state_or_province | | keyword | +| tls.detailed.client_certificate_chain.subject.street_address | | keyword | +| tls.detailed.client_certificate_chain.version_number | The x509 certificate version. Version 3 is the latest and most common. | keyword | | tls.detailed.client_certificate_requested | Whether the server has requested the client to authenticate itself using a client certificate. | boolean | | tls.detailed.client_hello.extensions._unparsed_ | List of extensions that were left unparsed by Packetbeat. | keyword | | tls.detailed.client_hello.extensions.application_layer_protocol_negotiation | List of application-layer protocols the client is willing to use. | keyword | @@ -5122,7 +5149,34 @@ Fields published for TLS packets. | tls.detailed.client_hello.version | The version of the TLS protocol by which the client wishes to communicate during this session. | keyword | | tls.detailed.ocsp_response | The result of an OCSP request. | keyword | | tls.detailed.resumption_method | If the session has been resumed, the underlying method used. One of "id" for TLS session ID or "ticket" for TLS ticket extension. | keyword | -| tls.detailed.server_certificate_chain | Chain of trust for the server certificate. | keyword | +| tls.detailed.server_certificate_chain.alternative_names | Subject alternative names (SANs) in the certificate. | keyword | +| tls.detailed.server_certificate_chain.issuer.common_name | | keyword | +| tls.detailed.server_certificate_chain.issuer.country | | keyword | +| tls.detailed.server_certificate_chain.issuer.distinguished_name | | keyword | +| tls.detailed.server_certificate_chain.issuer.locality | | keyword | +| tls.detailed.server_certificate_chain.issuer.organization | | keyword | +| tls.detailed.server_certificate_chain.issuer.organizational_unit | | keyword | +| tls.detailed.server_certificate_chain.issuer.postal_code | | keyword | +| tls.detailed.server_certificate_chain.issuer.serial_number | | keyword | +| tls.detailed.server_certificate_chain.issuer.state_or_province | | keyword | +| tls.detailed.server_certificate_chain.issuer.street_address | | keyword | +| tls.detailed.server_certificate_chain.not_after | End of the validity period (inclusive). | date | +| tls.detailed.server_certificate_chain.not_before | Start of the validity period (inclusive). | date | +| tls.detailed.server_certificate_chain.public_key_algorithm | Public key algorithm (e.g. RSA, DSA, ECDSA, Ed25519). | keyword | +| tls.detailed.server_certificate_chain.public_key_size | Number of bits in the public key. | long | +| tls.detailed.server_certificate_chain.serial_number | Base 10 representation of the certificate serial number. | keyword | +| tls.detailed.server_certificate_chain.signature_algorithm | Signature algorithm (e.g. SHA256-RSA). | keyword | +| tls.detailed.server_certificate_chain.subject.common_name | | keyword | +| tls.detailed.server_certificate_chain.subject.country | | keyword | +| tls.detailed.server_certificate_chain.subject.distinguished_name | | keyword | +| tls.detailed.server_certificate_chain.subject.locality | | keyword | +| tls.detailed.server_certificate_chain.subject.organization | | keyword | +| tls.detailed.server_certificate_chain.subject.organizational_unit | | keyword | +| tls.detailed.server_certificate_chain.subject.postal_code | | keyword | +| tls.detailed.server_certificate_chain.subject.serial_number | | keyword | +| tls.detailed.server_certificate_chain.subject.state_or_province | | keyword | +| tls.detailed.server_certificate_chain.subject.street_address | | keyword | +| tls.detailed.server_certificate_chain.version_number | The x509 certificate version. Version 3 is the latest and most common. | keyword | | tls.detailed.server_hello.extensions._unparsed_ | List of extensions that were left unparsed by Packetbeat. | keyword | | tls.detailed.server_hello.extensions.application_layer_protocol_negotiation | Negotiated application layer protocol | keyword | | tls.detailed.server_hello.extensions.ec_points_formats | List of Elliptic Curve (EC) point formats. Indicates the set of point formats that the server can parse. | keyword | @@ -5203,7 +5257,7 @@ An example event for `tls` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8a4932f4-ce31-4183-b0c7-a7008f14e6fa", diff --git a/packages/network_traffic/kibana/tags.yml b/packages/network_traffic/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/network_traffic/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/network_traffic/manifest.yml b/packages/network_traffic/manifest.yml index 2ae5e111226..5427b7e3084 100644 --- a/packages/network_traffic/manifest.yml +++ b/packages/network_traffic/manifest.yml @@ -1,14 +1,15 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: network_traffic title: Network Packet Capture -version: "1.19.1" +version: "1.24.0" description: Capture and analyze network traffic from a host with Elastic Agent. type: integration categories: - network - security conditions: - kibana.version: ^8.6.2 + kibana: + version: ^8.6.2 policy_templates: - name: network title: Network Packet Capture @@ -41,3 +42,4 @@ policy_templates: default: false owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/nginx/changelog.yml b/packages/nginx/changelog.yml index 91ea83b1b07..d731243b538 100644 --- a/packages/nginx/changelog.yml +++ b/packages/nginx/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.15.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 - version: "1.15.0" changes: - description: Enable time series data streams for the metrics datasets. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html @@ -6,7 +11,7 @@ link: https://github.com/elastic/integrations/pull/6332 - version: "1.14.1-beta" changes: - - description: Add beta flag + - description: Add beta flag type: bugfix link: https://github.com/elastic/integrations/pull/6298 - version: "1.14.0" diff --git a/packages/nginx/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/nginx/data_stream/access/elasticsearch/ingest_pipeline/default.yml index c6456f6b225..c7b267bb7bd 100644 --- a/packages/nginx/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/nginx/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -15,6 +15,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/nginx/data_stream/error/elasticsearch/ingest_pipeline/default.yml b/packages/nginx/data_stream/error/elasticsearch/ingest_pipeline/default.yml index 58f6831f0a9..b3beb8b07f3 100644 --- a/packages/nginx/data_stream/error/elasticsearch/ingest_pipeline/default.yml +++ b/packages/nginx/data_stream/error/elasticsearch/ingest_pipeline/default.yml @@ -14,6 +14,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/nginx/manifest.yml b/packages/nginx/manifest.yml index b0ef1f2f95b..bf4140428c6 100644 --- a/packages/nginx/manifest.yml +++ b/packages/nginx/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: nginx title: Nginx -version: "1.15.0" +version: "1.15.1" license: basic description: Collect logs and metrics from Nginx HTTP servers with Elastic Agent. type: integration diff --git a/packages/o365/_dev/build/build.yml b/packages/o365/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/o365/_dev/build/build.yml +++ b/packages/o365/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/o365/_dev/build/docs/README.md b/packages/o365/_dev/build/docs/README.md index a45d3bf1d7e..e0bb267417f 100644 --- a/packages/o365/_dev/build/docs/README.md +++ b/packages/o365/_dev/build/docs/README.md @@ -2,20 +2,29 @@ This integration is for [Microsoft Office 365](https://docs.microsoft.com/en-us/previous-versions/office/office-365-api/). It currently supports user, admin, system, and policy actions and events from Office 365 and Azure AD activity logs exposed by the Office 365 Management Activity API. -## Configuration +## Setup To use this package you need to enable _Audit Log Search_ and register an application in Azure AD. -Once this application is registered note the _Application (client) ID_ and the _Directory (tenant) ID._ Then configure the authentication in the _Certificates & Secrets_ section. +Once this application is registered, note the _Application (client) ID_ and the _Directory (tenant) ID._ Then configure the authentication in the _Certificates & Secrets_ section. -To use client-secret authentication, add you secret to the _Client Secret (API key)_ field. +To use client-secret authentication, add your secret to the _Client Secret_ field. -To use certificate-based authentication, set the paths to the certificate and private key files. If the key file is protected with a passphrase, set this passphrase in the _Private key passphrase_ field. Paths must be absolute and files must exist in the host where _Elastic Agent_ is running. +**NOTE:** As Microsoft is no longer supporting Azure Active Directory Authentication Library (ADAL), the existing o365audit input is being deprecated in favor of new [CEL](https://www.elastic.co/guide/en/beats/filebeat/8.6/filebeat-input-cel.html) input in version `1.18.0`. Hence for versions `>= 1.18.0`, certificate based authentication (provided by earlier o365audit input) is no longer supported. +We request users upgrading from integration version `< 1.18.0` to `>= 1.18.0` to follow these steps: -Add your tenant ID(s) to the _Directory (tenant) IDs_ field, then add the hostname that this tenant identifies to the _Directory (tenant) domains_ field. For example: -- Directory IDs: `my-id-a` `my-id-b` -- Directory domains: `a.onmicrosoft.com` `b.onmicrosoft.com` +1. Upgrade the Elastic Stack version to `>= 8.7.1`. +2. Upgrade the integration navigating via `Integrations -> Microsoft 365 -> Settings -> Upgrade` +3. Upgrade the integration policy navigating via `Integrations -> Microsoft 365 -> integration policies -> Version (Upgrade)`. If `Upgrade` option doesn't appear under the `Version`, that means the policy is already upgraded in the previous step. Please go to the next step. +4. Modify the integration policy: + + * Disable existing configuration (marked as `Deprecated`) and enable `Collect Office 365 audit logs via CEL` configuration. + * Add the required parameters such as `Directory (tenant) ID`, `Application (client) ID`, `Client Secret` based on the previous configuration. + * Verify/Update `Initial Interval` configuration parameter to start fetching events from. This defaults to 7 days. Even if there is overlap in times, the events are not duplicated. + * Update the other configuration parameters as required and hit `Save Integration`. + +Please refer [Upgrade an integration](https://www.elastic.co/guide/en/fleet/current/upgrade-integration.html) in case of any issues while performing integration upgrade. ## Compatibility diff --git a/packages/o365/_dev/deploy/docker/config.yml b/packages/o365/_dev/deploy/docker/config.yml index ea713985d0b..f280e1a4a4f 100644 --- a/packages/o365/_dev/deploy/docker/config.yml +++ b/packages/o365/_dev/deploy/docker/config.yml @@ -1,4 +1,5 @@ rules: + # O365Audit Input Rules - path: /tenant-id/oauth2/token methods: [POST] query_params: @@ -238,3 +239,140 @@ rules: {"Workload":"Exchange","SensitiveInfoDetectionIsIncluded":false,"ObjectId":"","OrganizationId":"0e1dddce-163e-4b0b-9e33-87ba56ac4655","UserId":"DlpAgent","CreationTime":"2020-02-24T20:11:15","UserType":4,"Version":1,"PolicyDetails":[{"Rules":[{"Severity":"Low","RuleId":"8398c03a-a00d-42bb-8f80-ead0ad04e1df","RuleName":"Low volume of content detected test","Actions":["NotifyUser"],"ConditionsMatched":{"OtherConditions":[{"Name":"AccessScope","Value":"IncludeExternalUsers"}],"SensitiveInformation":[{"Count":1,"UniqueCount":1,"Confidence":75,"Location":"Message Body","SensitiveType":"419f449f-6d9d-4be1-a154-b531f7a91b41"},{"Count":1,"UniqueCount":1,"Confidence":75,"Location":"Message Body","SensitiveType":"b8fe86d1-c056-453b-bfaa-9fe698699ecc"}]},"RuleMode":"Enable"}],"PolicyName":"test","PolicyId":"88956b36-45b3-4828-bf53-78603c0e5f58"}],"ExchangeMetaData":{"From":"asr@testsiem2.onmicrosoft.com","CC":["asr@example.net"],"BCC":[],"To":["asr@example.org"],"FileSize":13310,"UniqueID":"8e103f2f-b293-4062-38b8-08d7b965b2fa","MessageID":"","RecipientCount":2,"Sent":"2020-02-24T20:11:14","Subject":"Here's the phony data"},"UserKey":"1153801116545789462","Operation":"DlpRuleMatch","IncidentId":"c1dc582b-fa61-6020-1800-08d7b966ec64","Id":"a42123a9-1c07-4dde-9be6-ac71cb9fd16b","RecordType":13}, {"Workload":"Exchange","SensitiveInfoDetectionIsIncluded":false,"ObjectId":"","OrganizationId":"0e1dddce-163e-4b0b-9e33-87ba56ac4655","UserId":"DlpAgent","CreationTime":"2020-02-24T20:11:15","UserType":4,"Version":1,"PolicyDetails":[{"Rules":[{"Severity":"Low","RuleId":"8398c03a-a00d-42bb-8f80-ead0ad04e1df","RuleName":"Low volume of content detected test","Actions":["NotifyUser"],"ConditionsMatched":{"OtherConditions":[{"Name":"AccessScope","Value":"IncludeExternalUsers"}],"SensitiveInformation":[{"Count":1,"UniqueCount":1,"Confidence":75,"Location":"Message Body","SensitiveType":"419f449f-6d9d-4be1-a154-b531f7a91b41"},{"Count":1,"UniqueCount":1,"Confidence":75,"Location":"Message Body","SensitiveType":"b8fe86d1-c056-453b-bfaa-9fe698699ecc"}]},"RuleMode":"Enable"}],"PolicyName":"test","PolicyId":"88956b36-45b3-4828-bf53-78603c0e5f58"}],"SharePointMetaData":{"From":"alice@testsiem2.onmicrosoft.com","itemCreationTime":"2020-02-20T11:23:45","UniqueID":"8e103f2f-b293-4062-38b8-08d7b965b2fa","FileName":"Company-Internal-Financial.docx","FileOwner":"alice@testsiem2.onmicrosoft.com","FilePathUrl":"https://example.net/testsiem2.onmicrosoft.com/sharepoint","LastModifiedTime":"2020-02-24T12:13:14Z"},"UserKey":"1153801116545789462","Operation":"DlpRuleMatch","IncidentId":"c1dc582b-fa61-6020-1800-08d7b966ec64","Id":"a42123a9-1c07-4dde-9be6-ac71cb9fd16b","RecordType":13} ] + # CEL Input Rules + - path: /test-cel-tenant-id/oauth2/v2.0/token + methods: [POST] + query_params: + client_id: test-cel-client-id + client_secret: test-cel-client-secret + grant_type: client_credentials + scope: https://manage.office.com/.default + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"access_token": "CELtoken","token_type": "Bearer","expires_in": 3600,"ext_expires_in": 3600} + - path: /api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/start + methods: [POST] + query_params: + contentType: "Audit.SharePoint" + PublisherIdentifier: test-cel-tenant-id + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"contentType": "Audit.SharePoint","status": "enabled","webhook": null} + - path: /api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/start + methods: [POST] + query_params: + contentType: "Audit.General" + PublisherIdentifier: test-cel-tenant-id + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"contentType": "Audit.General","status": "enabled","webhook": null} + - path: /api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/content + methods: [GET] + query_params: + contentType: "Audit.SharePoint" + startTime: "{startTime:.*}" + endTime: "{endTime:.*}" + PublisherIdentifier: test-cel-tenant-id + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + NextPageUri: + - 'http://{{ hostname }}:{{ env "PORT" }}/api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/content?contentType=Audit.SharePoint&startTime={{ .request.vars.startTime }}&endTime={{ .request.vars.endTime }}&nextPage=2023071100R022885001761' + body: |- + [{"contentType": "Audit.Sharepoint","contentId": "celid1","contentUri": "http://{{ hostname }}:{{ env "PORT" }}/api/v1.0/celsp1/activity/feed/audit/celid1","contentCreated": "{{ .request.vars.endTime }}","contentExpiration": "2199-05-30T17:35:00.000Z"}] + - path: /api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/content + methods: [GET] + query_params: + contentType: "Audit.SharePoint" + startTime: "{startTime:.*}" + endTime: "{endTime:.*}" + nextPage: "2023071100R022885001761" + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [{"contentType": "Audit.Sharepoint","contentId": "celid2","contentUri": "http://{{ hostname }}:{{ env "PORT" }}/api/v1.0/celsp1/activity/feed/audit/celid2","contentCreated": "{{ .request.vars.endTime }}","contentExpiration": "2199-05-30T17:35:00.000Z"}] + - path: /api/v1.0/celsp1/activity/feed/audit/celid1 + methods: [GET] + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [{"ListItemUniqueId":"59a8433d-9bb8-cfef-6edc-4c0fc8b86875","ItemType":"Page","Workload":"OneDrive","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","UserId":"asr@testsiem.onmicrosoft.com","CreationTime":"2020-02-07T16:43:53","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","ClientIP":"213.97.47.133","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","UserType":0,"Version":1,"EventSource":"SharePoint","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","UserKey":"i:0h.f|membership|1003200096971f55@live.com","CustomUniqueId":true,"Operation":"PageViewed","ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx","Id":"99d005e6-a4c6-46fd-117c-08d7abeceab5","CorrelationId":"622b339f-4000-a000-f25f-92b3478c7a25","RecordType":4},{"UserId":"asr@testsiem.onmicrosoft.com","ListItemUniqueId":"59a8433d-9bb8-cfef-6edc-4c0fc8b86875","RecordType":4,"ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx","Workload":"OneDrive","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","UserType":0,"CreationTime":"2020-02-07T16:43:53","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","ClientIP":"213.97.47.133","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","Version":1,"EventSource":"SharePoint","CustomUniqueId":true,"UserKey":"i:0h.f|membership|1003200096971f55@live.com","Operation":"PageViewed","Id":"99d005e6-a4c6-46fd-117c-08d7abeceab5","CorrelationId":"622b339f-4000-a000-f25f-92b3478c7a25","ItemType":"Page"},{"Workload":"OneDrive","Version":1,"RecordType":4,"ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","UserId":"asr@testsiem.onmicrosoft.com","CreationTime":"2020-02-07T16:43:53","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","Id":"99d005e6-a4c6-46fd-117c-08d7abeceab5","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","UserType":0,"ListItemUniqueId":"59a8433d-9bb8-cfef-6edc-4c0fc8b86875","EventSource":"SharePoint","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","UserKey":"i:0h.f|membership|1003200096971f55@live.com","CustomUniqueId":true,"ClientIP":"213.97.47.133","Operation":"PageViewed","CorrelationId":"622b339f-4000-a000-f25f-92b3478c7a25","ItemType":"Page"},{"SiteUrl":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","CreationTime":"2020-02-07T16:44:23","ListId":"2b6ad2bd-0fd7-4556-9c89-a97847085b85","Version":1,"SourceRelativeUrl":"Documents","RecordType":6,"UserId":"asr@testsiem.onmicrosoft.com","SourceFileExtension":"png","UserType":0,"EventSource":"SharePoint","UserKey":"i:0h.f|membership|1003200096971f55@live.com","ClientIP":"213.97.47.133","CorrelationId":"692b339f-902e-a000-f25f-95def5f17903","Workload":"OneDrive","ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/Documents/Screenshot.png","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","SourceFileName":"Screenshot.png","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","ItemType":"File","ListItemUniqueId":"7f06ab3a-bd98-41d3-a0b2-ad270d71e4d8","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","Operation":"FileModified","Id":"5b02fadb-8eac-4aff-af87-08d7abecfca3"}] + - path: /api/v1.0/celsp1/activity/feed/audit/celid2 + methods: [GET] + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [{"SourceRelativeUrl":"Documents","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","CreationTime":"2020-02-07T16:44:07","ListId":"2b6ad2bd-0fd7-4556-9c89-a97847085b85","Version":1,"RecordType":6,"UserId":"asr@testsiem.onmicrosoft.com","SourceFileExtension":"png","UserType":0,"EventSource":"SharePoint","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0","ClientIP":"213.97.47.133","CorrelationId":"652b339f-908c-a000-f25f-91423da7dd9b","Workload":"OneDrive","ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/Documents/Screenshot 2020-01-27 at 11.30.48.png","WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","SiteUrl":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/","SourceFileName":"Screenshot 2020-01-27 at 11.30.48.png","UserKey":"i:0h.f|membership|1003200096971f55@live.com","ItemType":"File","ListItemUniqueId":"4803608a-df7d-4f63-aa73-67aa33bb576e","Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","Operation":"FileDeleted","Id":"ec04aa09-0a43-4879-cdc8-08d7abecf327"},{"Site":"d5180cfc-3479-44d6-b410-8c985ac894e3","ItemType":"File","UserKey":"i:0h.f|membership|1003200096971f55@live.com","TargetUserOrGroupName":"4da1e7f54501bb99b6e0ab2ff8749842152ac02ff8c0c8017b0e40e6b67fecdd","OrganizationId":"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd","Operation":"SharingSet","EventData":"System.LimitedEdit","ListId":"2b6ad2bd-0fd7-4556-9c89-a97847085b85","RecordType":14,"Version":1,"WebId":"8c5c94bb-8396-470c-87d7-8999f440cd30","UserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:73.0) Gecko/20100101 Firefox/73.0","CorrelationId":"fe71359f-005f-9000-7cb1-ccf5124703db","ListItemUniqueId":"7f06ab3a-bd98-41d3-a0b2-ad270d71e4d8","ObjectId":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/Documents/Screenshot.png","SourceFileName":"Screenshot.png","SiteUrl":"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com","ClientIP":"79.159.10.151","SourceFileExtension":"png","Workload":"OneDrive","SourceRelativeUrl":"Documents/Screenshot.png","EventSource":"SharePoint","TargetUserOrGroupType":"SecurityGroup","UserId":"asr@testsiem.onmicrosoft.com","CreationTime":"2020-02-14T18:25:44","Id":"98633e47-3540-4e8a-bcfc-08d7b17b4e48","UserType":0}] + - path: /api/v1.0/test-cel-tenant-id/activity/feed/subscriptions/content + methods: [GET] + query_params: + contentType: "Audit.General" + startTime: "{startTime:.*}" + endTime: "{endTime:.*}" + PublisherIdentifier: test-cel-tenant-id + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [{"contentType": "Audit.General","contentId": "celid3","contentUri": "http://{{ hostname }}:{{ env "PORT" }}/api/v1.0/celgen1/activity/feed/audit/celid3","contentCreated": "{{ .request.vars.endTime }}","contentExpiration": "2199-05-30T17:35:00.000Z"}] + - path: /api/v1.0/celgen1/activity/feed/audit/celid3 + methods: [GET] + request_headers: + Authorization: + - "Bearer CELtoken" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [{"ObjectId":"Sales","Id":"2af7bbf1-d5d8-5cb0-8aca-f4ad8a087594","CreationTime":"2020-02-28T09:42:45","UserKey":"100320009d6edf94","YammerNetworkId":5846122497,"Operation":"GroupCreation","ClientIP":"79.159.10.151:12345","ActorYammerUserId":36787265537,"UserType":0,"ResultStatus":"TRUE","RecordType":22,"Workload":"Yammer","Version":1,"GroupName":"Sales","OrganizationId":"0e1dddce-163e-4b0b-9e33-87ba56ac4655","UserId":"alice@testsiem2.onmicrosoft.com","ActorUserId":"alice@testsiem2.onmicrosoft.com"},{"CreationTime":"2020-02-28T09:39:20","ActorUserId":"asr@testsiem2.onmicrosoft.com","ObjectId":"Company group","UserKey":"100320009d292e16","Id":"3f3e7f1c-84c1-55fc-9bb2-c8b8563eae06","ActorYammerUserId":36085768193,"ClientIP":"[fdfd::555]:12346","UserId":"asr@testsiem2.onmicrosoft.com","Operation":"GroupCreation","ResultStatus":"TRUE","UserType":0,"Workload":"Yammer","Version":1,"OrganizationId":"0e1dddce-163e-4b0b-9e33-87ba56ac4655","YammerNetworkId":5846122497,"RecordType":22,"GroupName":"Company group"}] diff --git a/packages/o365/_dev/deploy/docker/docker-compose.yml b/packages/o365/_dev/deploy/docker/docker-compose.yml index 9d5d5899e59..f2161671934 100644 --- a/packages/o365/_dev/deploy/docker/docker-compose.yml +++ b/packages/o365/_dev/deploy/docker/docker-compose.yml @@ -12,3 +12,15 @@ services: - http-server - --addr=:8080 - --config=/config.yml + o365-cel: + image: docker.elastic.co/observability/stream:v0.5.0 + ports: + - 8080 + environment: + PORT: "8080" + volumes: + - ./config.yml:/config.yml + command: + - http-server + - --addr=:8080 + - --config=/config.yml diff --git a/packages/o365/changelog.yml b/packages/o365/changelog.yml index ca724b0236f..bb04c61ad71 100644 --- a/packages/o365/changelog.yml +++ b/packages/o365/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.23.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.22.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.21.0" + changes: + - description: Increase CEL resource.tracer.maxsize to prevent loss of trace responses. + type: enhancement + link: https://github.com/elastic/integrations/pull/7580 +- version: "1.20.1" + changes: + - description: Fix timestamp error in CEL input + type: bugfix + link: https://github.com/elastic/integrations/pull/7432 +- version: "1.20.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.19.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7169 +- version: "1.18.0" + changes: + - description: Migrate to CEL input from o365audit input + type: enhancement + link: https://github.com/elastic/integrations/pull/6621 +- version: "1.17.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6902 - version: "1.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-events.json-expected.json index 6c94fa6a14a..0984890cff6 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-events.json-expected.json @@ -7,7 +7,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -189,7 +189,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -371,7 +371,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -553,7 +553,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -744,7 +744,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -935,7 +935,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -1139,7 +1139,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -1343,7 +1343,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -1547,7 +1547,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -1751,7 +1751,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -1955,7 +1955,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -2159,7 +2159,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -2363,7 +2363,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -2567,7 +2567,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -2771,7 +2771,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -2975,7 +2975,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -3179,7 +3179,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -3383,7 +3383,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -3587,7 +3587,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -3769,7 +3769,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -3951,7 +3951,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -4142,7 +4142,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -4324,7 +4324,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -4506,7 +4506,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -4688,7 +4688,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -4879,7 +4879,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -5083,7 +5083,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -5287,7 +5287,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -5491,7 +5491,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -5695,7 +5695,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -5899,7 +5899,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -6103,7 +6103,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -6307,7 +6307,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -6511,7 +6511,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -6718,7 +6718,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -6922,7 +6922,7 @@ "@timestamp": "2020-02-10T15:15:04.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "modified-user-account", @@ -7094,7 +7094,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove OAuth2PermissionGrant.", @@ -7298,7 +7298,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove OAuth2PermissionGrant.", @@ -7502,7 +7502,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove OAuth2PermissionGrant.", @@ -7706,7 +7706,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -7910,7 +7910,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -8114,7 +8114,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -8318,7 +8318,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -8522,7 +8522,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -8726,7 +8726,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -8930,7 +8930,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -9134,7 +9134,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -9338,7 +9338,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -9542,7 +9542,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Remove app role assignment from service principal.", @@ -9746,7 +9746,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -9950,7 +9950,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add a deletion-marked app role assignment grant to service principal as part of link removal.", @@ -10154,7 +10154,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -10361,7 +10361,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -10568,7 +10568,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -10772,7 +10772,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -10976,7 +10976,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -11180,7 +11180,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -11384,7 +11384,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -11588,7 +11588,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -11792,7 +11792,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -11996,7 +11996,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -12200,7 +12200,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -12404,7 +12404,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add application.", @@ -12598,7 +12598,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add application.", @@ -12792,7 +12792,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add application.", @@ -12986,7 +12986,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add application.", @@ -13180,7 +13180,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add owner to application.", @@ -13375,7 +13375,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add service principal.", @@ -13586,7 +13586,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add service principal.", @@ -13797,7 +13797,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add service principal.", @@ -14008,7 +14008,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add service principal.", @@ -14219,7 +14219,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -14391,7 +14391,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application – Certificates and secrets management ", @@ -14573,7 +14573,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application – Certificates and secrets management ", @@ -14755,7 +14755,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -14946,7 +14946,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -15137,7 +15137,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -15328,7 +15328,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -15510,7 +15510,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -15692,7 +15692,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update application.", @@ -15874,7 +15874,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -16065,7 +16065,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -16256,7 +16256,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update service principal.", @@ -16447,7 +16447,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -16651,7 +16651,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -16855,7 +16855,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -17059,7 +17059,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -17263,7 +17263,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -17467,7 +17467,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -17671,7 +17671,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -17875,7 +17875,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment to service principal.", @@ -18079,7 +18079,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -18283,7 +18283,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -18487,7 +18487,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add OAuth2PermissionGrant.", @@ -18691,7 +18691,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -18898,7 +18898,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -19105,7 +19105,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Consent to application.", @@ -19312,7 +19312,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment grant to user.", @@ -19512,7 +19512,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment grant to user.", @@ -19712,7 +19712,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add app role assignment grant to user.", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-sts-logon-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-sts-logon-events.json-expected.json index 7510b541a46..d9cd5ec052f 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-sts-logon-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-azuread-sts-logon-events.json-expected.json @@ -7,7 +7,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -137,7 +137,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -267,7 +267,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -397,7 +397,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -527,7 +527,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -657,7 +657,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -787,7 +787,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -917,7 +917,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1047,7 +1047,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1177,7 +1177,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1307,7 +1307,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1437,7 +1437,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1567,7 +1567,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1697,7 +1697,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1827,7 +1827,7 @@ "ip": "67.43.156.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -1957,7 +1957,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2087,7 +2087,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2217,7 +2217,7 @@ "ip": "67.43.156.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2347,7 +2347,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2477,7 +2477,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2607,7 +2607,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2737,7 +2737,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2867,7 +2867,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -2997,7 +2997,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3127,7 +3127,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3257,7 +3257,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3387,7 +3387,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3517,7 +3517,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3647,7 +3647,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3777,7 +3777,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -3906,7 +3906,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoginFailed", @@ -4037,7 +4037,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -4152,7 +4152,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -4282,7 +4282,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -4397,7 +4397,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoginFailed", @@ -4528,7 +4528,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -4643,7 +4643,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoginFailed", @@ -4774,7 +4774,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -4904,7 +4904,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5034,7 +5034,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5149,7 +5149,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoginFailed", @@ -5280,7 +5280,7 @@ "ip": "67.43.156.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5410,7 +5410,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5540,7 +5540,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5670,7 +5670,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5785,7 +5785,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -5915,7 +5915,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6045,7 +6045,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6175,7 +6175,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6305,7 +6305,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6435,7 +6435,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6565,7 +6565,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6695,7 +6695,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6825,7 +6825,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -6955,7 +6955,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7085,7 +7085,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7215,7 +7215,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7345,7 +7345,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7475,7 +7475,7 @@ "ip": "67.43.156.14" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7605,7 +7605,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7735,7 +7735,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7865,7 +7865,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -7995,7 +7995,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8125,7 +8125,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8255,7 +8255,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8385,7 +8385,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8515,7 +8515,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8645,7 +8645,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -8775,7 +8775,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-bad-ips.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-bad-ips.json-expected.json index 283e66ca20b..a8c8069a26e 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-bad-ips.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-bad-ips.json-expected.json @@ -7,7 +7,7 @@ "domain": "NOTANIPV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupCreation", @@ -74,7 +74,7 @@ "ip": "10.90.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupCreation", @@ -149,7 +149,7 @@ "domain": "INCORRECTIPV4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupCreation", @@ -211,7 +211,7 @@ { "@timestamp": "2020-02-28T09:42:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api-events.json-expected.json index 36991527a47..3888aa671f5 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-data-insights-api-events.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-10T15:13:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -49,7 +49,7 @@ { "@timestamp": "2020-02-12T21:38:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -95,7 +95,7 @@ { "@timestamp": "2020-02-10T15:13:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -141,7 +141,7 @@ { "@timestamp": "2020-02-12T10:53:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -187,7 +187,7 @@ { "@timestamp": "2020-02-12T21:38:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -233,7 +233,7 @@ { "@timestamp": "2020-02-12T10:53:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -279,7 +279,7 @@ { "@timestamp": "2020-02-10T15:13:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -325,7 +325,7 @@ { "@timestamp": "2020-02-12T10:53:26.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", @@ -371,7 +371,7 @@ { "@timestamp": "2020-02-12T21:38:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SearchDataInsightsSubscription", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-exchange-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-exchange-events.json-expected.json index d6278fbad72..c2fcaf90a58 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-exchange-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-exchange-events.json-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleMatch", @@ -182,7 +182,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleUndo", @@ -353,7 +353,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleMatch", @@ -527,7 +527,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleMatch", @@ -701,7 +701,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleMatch", @@ -819,7 +819,7 @@ { "@timestamp": "2020-02-24T20:11:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DlpRuleMatch", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-sharepoint-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-sharepoint-events.json-expected.json index fde31c2966f..26daecc0977 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-sharepoint-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-dlp-sharepoint-events.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-25T16:20:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -107,7 +107,7 @@ { "@timestamp": "2020-02-25T16:23:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -220,7 +220,7 @@ { "@timestamp": "2020-02-25T16:23:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -329,7 +329,7 @@ { "@timestamp": "2020-02-25T16:22:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -442,7 +442,7 @@ { "@timestamp": "2020-02-26T10:13:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -555,7 +555,7 @@ { "@timestamp": "2020-02-26T12:39:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", @@ -668,7 +668,7 @@ { "@timestamp": "2020-02-26T12:39:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DLPRuleMatch", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json index 8bf49767b92..e004122a7f5 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-admin-events.json-expected.json @@ -6,7 +6,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -73,7 +73,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -153,7 +153,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -233,7 +233,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Install-DefaultSharingPolicy", @@ -300,7 +300,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Install-AdminAuditLogConfig", @@ -367,7 +367,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -435,7 +435,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -504,7 +504,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-OwaMailboxPolicy", @@ -571,7 +571,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -651,7 +651,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -731,7 +731,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Enable-AddressListPaging", @@ -799,7 +799,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -879,7 +879,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -959,7 +959,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1039,7 +1039,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1119,7 +1119,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1199,7 +1199,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1279,7 +1279,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TenantObjectVersion", @@ -1346,7 +1346,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -1414,7 +1414,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -1482,7 +1482,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TenantObjectVersion", @@ -1549,7 +1549,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -1617,7 +1617,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1697,7 +1697,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1777,7 +1777,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1857,7 +1857,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -1937,7 +1937,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2017,7 +2017,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2097,7 +2097,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2177,7 +2177,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2257,7 +2257,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2339,7 +2339,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2419,7 +2419,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2499,7 +2499,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2579,7 +2579,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2659,7 +2659,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2739,7 +2739,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2819,7 +2819,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2899,7 +2899,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -2979,7 +2979,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3059,7 +3059,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3136,7 +3136,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-AdminAuditLogConfig", @@ -3205,7 +3205,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -3273,7 +3273,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TransportConfig", @@ -3341,7 +3341,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "New-ExchangeAssistanceConfig", @@ -3409,7 +3409,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3491,7 +3491,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3571,7 +3571,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3651,7 +3651,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3731,7 +3731,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3811,7 +3811,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3891,7 +3891,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -3971,7 +3971,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4051,7 +4051,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4131,7 +4131,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4211,7 +4211,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4291,7 +4291,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4371,7 +4371,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-RecipientEnforcementProvisioningPolicy", @@ -4440,7 +4440,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-AdminAuditLogConfig", @@ -4509,7 +4509,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4589,7 +4589,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4669,7 +4669,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-AdminAuditLogConfig", @@ -4738,7 +4738,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-OwaMailboxPolicy", @@ -4805,7 +4805,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4887,7 +4887,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -4967,7 +4967,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5047,7 +5047,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5127,7 +5127,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5207,7 +5207,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5287,7 +5287,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5367,7 +5367,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5447,7 +5447,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Enable-AddressListPaging", @@ -5515,7 +5515,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-AdminAuditLogConfig", @@ -5584,7 +5584,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-ExchangeAssistanceConfig", @@ -5652,7 +5652,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-RecipientEnforcementProvisioningPolicy", @@ -5721,7 +5721,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-TenantObjectVersion", @@ -5788,7 +5788,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add-MailboxPermission", @@ -5857,7 +5857,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -5924,7 +5924,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-AdminAuditLogConfig", @@ -5993,7 +5993,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6073,7 +6073,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6153,7 +6153,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6233,7 +6233,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6313,7 +6313,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6393,7 +6393,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6473,7 +6473,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6553,7 +6553,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6633,7 +6633,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Add-MailboxPermission", @@ -6702,7 +6702,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6782,7 +6782,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -6862,7 +6862,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Enable-AddressListPaging", @@ -6930,7 +6930,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -7010,7 +7010,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Install-ResourceConfig", @@ -7077,7 +7077,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-RecipientEnforcementProvisioningPolicy", @@ -7146,7 +7146,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -7223,7 +7223,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -7303,7 +7303,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-RecipientEnforcementProvisioningPolicy", @@ -7372,7 +7372,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -7452,7 +7452,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", @@ -7534,7 +7534,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-item-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-item-events.json-expected.json index 7884275ca5c..dccb6ff6e79 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-item-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-exchange-item-events.json-expected.json @@ -10,7 +10,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Create", @@ -101,7 +101,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Create", @@ -192,7 +192,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Create", @@ -283,7 +283,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", @@ -374,7 +374,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", @@ -465,7 +465,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", @@ -556,7 +556,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", @@ -647,7 +647,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", @@ -738,7 +738,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ModifyFolderPermissions", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-ip-formats-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-ip-formats-events.json-expected.json index f7bbe76b8c5..93341bec713 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-ip-formats-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-ip-formats-events.json-expected.json @@ -8,7 +8,7 @@ "port": 12345 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -52,7 +52,7 @@ "port": 12345 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -95,7 +95,7 @@ "ip": "10.11.12.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -137,7 +137,7 @@ "ip": "10.11.12.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -180,7 +180,7 @@ "port": 12345 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -224,7 +224,7 @@ "port": 12345 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -276,7 +276,7 @@ "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -327,7 +327,7 @@ "ip": "2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -378,7 +378,7 @@ "ip": "10.11.12.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -419,7 +419,7 @@ "domain": "localhost" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -449,7 +449,7 @@ "domain": "[localhost]:12345" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -479,7 +479,7 @@ "domain": "localhost:12345" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -509,7 +509,7 @@ "domain": "[cool.client.local]:12345" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -539,7 +539,7 @@ "domain": "cool.client.local" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -569,7 +569,7 @@ "domain": "cool.client.local:12345" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-modified-properites.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-modified-properites.json-expected.json index be0eba3e1d4..97c25f7ecd6 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-modified-properites.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-modified-properites.json-expected.json @@ -10,7 +10,7 @@ "ip": "1.128.3.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Update", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-ms-teams-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-ms-teams-events.json-expected.json index 3704035b73d..c6b5ca47e72 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-ms-teams-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-ms-teams-events.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-17T16:59:44.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-group-account-to", @@ -55,7 +55,7 @@ { "@timestamp": "2020-02-17T16:59:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-users-to-group", @@ -142,7 +142,7 @@ { "@timestamp": "2020-02-17T16:59:44.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added-users-to-group", @@ -211,7 +211,7 @@ { "@timestamp": "2020-02-17T16:59:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TeamsSessionStarted", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-parameter-string.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-parameter-string.json-expected.json index 851f3996888..861bc4e85e4 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-parameter-string.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-parameter-string.json-expected.json @@ -7,7 +7,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "UserLoggedIn", @@ -116,7 +116,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Set-Mailbox", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json index 779e2413133..594add9fcf6 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sec-comp-alerts-events.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-14T19:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AlertEntityGenerated", @@ -68,7 +68,7 @@ { "@timestamp": "2020-02-14T19:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AlertTriggered", @@ -130,7 +130,7 @@ { "@timestamp": "2020-02-14T19:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AlertTriggered", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepoint-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepoint-events.json-expected.json index d1a924e2363..3dae1808800 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepoint-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepoint-events.json-expected.json @@ -7,7 +7,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PageViewed", @@ -106,7 +106,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PageViewed", @@ -205,7 +205,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PageViewed", @@ -304,7 +304,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "PageViewed", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepointfileop-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepointfileop-events.json-expected.json index f1c8df49783..e317daf9586 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepointfileop-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sharepointfileop-events.json-expected.json @@ -7,7 +7,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileDeleted", @@ -116,7 +116,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileDeleted", @@ -225,7 +225,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileAccessed", @@ -334,7 +334,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileAccessed", @@ -443,7 +443,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileUploaded", @@ -553,7 +553,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileModified", @@ -662,7 +662,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileDeleted", @@ -771,7 +771,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileUploaded", @@ -881,7 +881,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileModified", @@ -990,7 +990,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileModified", @@ -1099,7 +1099,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "FileModified", @@ -1208,7 +1208,7 @@ "ip": "67.43.156.15" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SecureLinkUsed", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sp-sharing-op-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sp-sharing-op-events.json-expected.json index a6bf56be570..0a154e9bc1a 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-sp-sharing-op-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-sp-sharing-op-events.json-expected.json @@ -4,7 +4,7 @@ "@timestamp": "2020-02-17T16:59:50.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AddedToGroup", @@ -77,7 +77,7 @@ "@timestamp": "2020-02-17T16:59:50.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AddedToGroup", @@ -150,7 +150,7 @@ "@timestamp": "2020-02-17T16:59:50.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AddedToGroup", @@ -223,7 +223,7 @@ "@timestamp": "2020-02-17T16:59:50.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AddedToGroup", @@ -296,7 +296,7 @@ "@timestamp": "2020-02-17T16:59:49.000Z", "client": {}, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AddedToGroup", @@ -372,7 +372,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SharingInheritanceBroken", @@ -477,7 +477,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AnonymousLinkCreated", @@ -586,7 +586,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SharingSet", @@ -696,7 +696,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SharingSet", @@ -806,7 +806,7 @@ "ip": "67.43.156.13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SharingSet", diff --git a/packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json-expected.json b/packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json-expected.json index 3c6840af728..02c05ce2c94 100644 --- a/packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json-expected.json +++ b/packages/o365/data_stream/audit/_dev/test/pipeline/test-yammer-events.json-expected.json @@ -8,7 +8,7 @@ "port": 12345 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupCreation", @@ -97,7 +97,7 @@ "port": 12346 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GroupCreation", diff --git a/packages/o365/data_stream/audit/_dev/test/system/test-cel-config.yml b/packages/o365/data_stream/audit/_dev/test/system/test-cel-config.yml new file mode 100644 index 00000000000..63ff9c73842 --- /dev/null +++ b/packages/o365/data_stream/audit/_dev/test/system/test-cel-config.yml @@ -0,0 +1,14 @@ +input: cel +service: o365-cel +vars: ~ +policy_template: o365 +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + token_url: http://{{Hostname}}:{{Port}} + preserve_original_event: true + client_id: test-cel-client-id + client_secret: test-cel-client-secret + azure_tenant_id: test-cel-tenant-id + content_types: "Audit.SharePoint, Audit.General" + initial_interval: 12h diff --git a/packages/o365/data_stream/audit/_dev/test/system/test-default-config.yml b/packages/o365/data_stream/audit/_dev/test/system/test-o365audit-config.yml similarity index 100% rename from packages/o365/data_stream/audit/_dev/test/system/test-default-config.yml rename to packages/o365/data_stream/audit/_dev/test/system/test-o365audit-config.yml diff --git a/packages/o365/data_stream/audit/agent/stream/cel.yml.hbs b/packages/o365/data_stream/audit/agent/stream/cel.yml.hbs new file mode 100644 index 00000000000..b4d72f27956 --- /dev/null +++ b/packages/o365/data_stream/audit/agent/stream/cel.yml.hbs @@ -0,0 +1,191 @@ +interval: {{interval}} +auth.oauth2: + client.id: {{client_id}} + client.secret: {{client_secret}} + provider: azure + scopes: https://manage.office.com/.default + endpoint_params: + grant_type: client_credentials +{{#if token_url}} + token_url: {{token_url}}/{{azure_tenant_id}}/oauth2/v2.0/token +{{else if azure_tenant_id}} + azure.tenant_id: {{azure_tenant_id}} +{{/if}} + +resource.url: {{url}} +{{#if resource_ssl}} +resource.ssl: + {{resource_ssl}} +{{/if}} +{{#if resource_proxy_url}} +resource.proxy_url: {{resource_proxy_url}} +{{/if}} +{{#if resource_retry_max_attempts}} +resource.retry.max_attempts: {{resource_retry_max_attempts}} +{{/if}} +{{#if resource_retry_wait_min}} +resource.retry.wait_min: {{resource_retry_wait_min}} +{{/if}} +{{#if resource_retry_wait_max}} +resource.retry.wait_max: {{resource_retry_wait_max}} +{{/if}} +{{#if resource_redirect_forward_headers}} +resource.redirect.forward_headers: {{resource_redirect_forward_headers}} +{{/if}} +{{#if resource_redirect_headers_ban_list}} +resource.redirect.headers_ban_list: +{{#each resource_redirect_headers_ban_list as |item|}} + - {{item}} +{{/each}} +{{/if}} +{{#if resource_redirect_max_redirects}} +resource.redirect.max_redirects: {{resource_redirect_max_redirects}} +{{/if}} +{{#if resource_rate_limit_limit}} +resource.rate_limit.limit: {{resource_rate_limit_limit}} +{{/if}} +{{#if resource_rate_limit_burst}} +resource.rate_limit.burst: {{resource_rate_limit_burst}} +{{/if}} + +{{#if enable_request_tracer}} +resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" +resource.tracer.maxsize: 5 +{{/if}} + +state: + want_more: false + base: + list_contents_url: "{{url}}/api/v1.0/{{azure_tenant_id}}/activity/feed/subscriptions/content?contentType=" + list_contents_start_time: "{{initial_interval}}" + +redact: + fields: ~ + +program: | + "{{content_types}}".split(",").map(content_type_raw, content_type_raw.trim_space()).as(content_types, + content_types.map(content_type, + (request("POST", "{{url}}/api/v1.0/{{azure_tenant_id}}/activity/feed/subscriptions/start?contentType=" + content_type + "&PublisherIdentifier={{azure_tenant_id}}")) + .do_request().as(start_subs_resp, + bytes(start_subs_resp.Body).decode_json().as(start_subs_resp_body, + (has(start_subs_resp_body.status) && start_subs_resp_body.status == 'enabled') || (has(start_subs_resp_body.error) && has(start_subs_resp_body.error.code) && start_subs_resp_body.error.code == "AF20024") ? + // When start-subscription API returns success or if already started subscription, + (request("GET", + ( state.want_more && has(state.cursor) && has(state.cursor.content_types_state_as_list) && (state.cursor.content_types_state_as_list.filter(e, e.content_type == content_type)[0].next_page != "") ) ? + // if NextPageUri exists + state.cursor.content_types_state_as_list.filter(e, e.content_type == content_type)[0].next_page + : + ( has (state.cursor) && has(state.cursor.content_types_state_as_list)) ? + // if NextPageUri does not exist, but content_type_state_created_at exists in state + state.cursor.content_types_state_as_list.filter(e, e.content_type == content_type) + .as(content_type_state, content_type_state[0].content_created_at.as(content_type_state_created_at, + // if saved time inside state is more than 7 days old, then change it to 7 days. + (content_type_state_created_at.parse_time(time_layout.RFC3339).as(state_created_at, + state_created_at < (now() - duration("168h")) ? + now() - duration("168h") + : + state_created_at + )).as(state_created_at_calc, + (state.base.list_contents_url + content_type + "&PublisherIdentifier={{azure_tenant_id}}" + + "&startTime=" + (state_created_at_calc + duration("1s")).format(time_layout.RFC3339) + + "&endTime=" + ((state_created_at_calc + duration("24h")).as(calc_end_time, + calc_end_time <= now() ? calc_end_time : now())).format(time_layout.RFC3339) ) ))) + : + // initial run when no cursor state exists i.e., polling from initial_interval + state.base.list_contents_url + content_type + "&PublisherIdentifier={{azure_tenant_id}}" + + "&startTime=" + (now() - duration(state.base.list_contents_start_time)).format(time_layout.RFC3339) + + "&endTime=" + ((now() - duration(state.base.list_contents_start_time) + duration("24h")).as(calc_end_time, + calc_end_time <= now() ? calc_end_time : now())).format(time_layout.RFC3339) + )) + .do_request().as(list_contents_resp, + bytes(list_contents_resp.Body).decode_json().as(list_contents_resp_body, + ( type(list_contents_resp_body) != map && size(list_contents_resp_body) > 0 && has(list_contents_resp_body[0].contentUri) && list_contents_resp_body[0].contentUri != "" && has(list_contents_resp_body[0].contentCreated) && list_contents_resp_body[0].contentCreated != "" ) ? + // contents exist to consume + list_contents_resp_body.map(l1, + (request("GET", l1.contentUri)) + .do_request().as(content_resp, + bytes(content_resp.Body).decode_json()).map(content_resp_body, + content_resp_body.with({ "copy": {"o365audit" : content_resp_body}}) + ).map(content_resp_body_with_copy, content_resp_body_with_copy.copy)).flatten().drop_empty().as(contents, + ({ + "events_per_content_type": contents, + "content_type": content_type, + "content_created_at": { "temp" : list_contents_resp_body}.collate("temp.contentCreated").max(), + "next_page": (has(list_contents_resp.Header) && has(list_contents_resp.Header.NextPageUri) ) ? list_contents_resp.Header.NextPageUri[0] : (has(list_contents_resp.Header) && has(list_contents_resp.Header.Nextpageuri)) ? list_contents_resp.Header.Nextpageuri[0] : "", + // keep fetching more if (nextpageuri exists) or (max time returned date != today's date) + "want_more_content": ( (has(list_contents_resp.Header) && (has(list_contents_resp.Header.NextPageUri) && (list_contents_resp.Header.NextPageUri.size() > 0)) || (has(list_contents_resp.Header.Nextpageuri) && (list_contents_resp.Header.Nextpageuri.size() > 0)) ) || ( { "temp" : list_contents_resp_body}.collate("temp.contentCreated").max().split('T')[0] != now().format("2006-01-02") ) ) + }) + ) + : + // contents does not exist, or is empty array + ( + { + "events_per_content_type": size(list_contents_resp_body) == 0 ? [] : [list_contents_resp_body], + "content_type": content_type, + "content_created_at": + (has(list_contents_resp.StatusCode) && list_contents_resp.StatusCode == 200 ) ? + list_contents_resp.Request.URL.parse_url().RawQuery.parse_query().endTime[0] + : + list_contents_resp.Request.URL.parse_url().RawQuery.parse_query().startTime[0] + , + "next_page": "", + "want_more_content": ( + has(list_contents_resp.StatusCode) + && list_contents_resp.StatusCode == 200 + && (list_contents_resp.Request.URL.parse_url().RawQuery.parse_query().endTime[0].split('T')[0] != now().format("2006-01-02")) + ) + } + ) + ) + ) + : + // When start-subscription API produces error, such as Authentication error. + ( + { + "events_per_content_type": [], + "content_type": content_type, + "content_created_at": + ( has (state.cursor) && has(state.cursor.content_types_state_as_list)) ? + state.cursor.content_types_state_as_list.filter(e, e.content_type == content_type)[0].content_created_at + : + ( + (now() - duration(state.base.list_contents_start_time)).format(time_layout.RFC3339) + ) + , + "next_page": "", + "want_more_content": false + } + ) + ) + ) + ).as(events_list_raw, events_list_raw.flatten().drop_empty()).as(events_list, + { + "base": { + "list_contents_url": "{{url}}/api/v1.0/{{azure_tenant_id}}/activity/feed/subscriptions/content?contentType=", + "list_contents_start_time": "{{initial_interval}}" + }, + "events": events_list.collate("events_per_content_type"), + "want_more": events_list.collate("want_more_content").filter(e, e == true).size() > 0, + "cursor": { + "content_types_state_as_list": events_list.drop(["events_per_content_type"]), + } + } + ) + ) + +{{#if tags}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index b981155436c..e82593c61fe 100644 --- a/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/o365/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -2,9 +2,13 @@ description: Pipeline for Office 365 Audit logs processors: + - rename: + field: message + target_field: event.original + if: ctx.message != null && ctx.event?.original == null - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -24,10 +28,21 @@ processors: field: o365audit.CreationTime formats: - ISO8601 + if: ctx.o365audit?.CreationTime != null - rename: field: o365audit.Id target_field: event.id ignore_missing: true + - convert: + field: o365audit.ListBaseType + type: string + tag: convert-listbasetype-to-string + if: ctx.o365audit?.ListBaseType != null + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: field: o365audit.ClientIPAddress target_field: client._temp diff --git a/packages/o365/data_stream/audit/fields/fields.yml b/packages/o365/data_stream/audit/fields/fields.yml index 977c3fad15f..7745fd706bb 100644 --- a/packages/o365/data_stream/audit/fields/fields.yml +++ b/packages/o365/data_stream/audit/fields/fields.yml @@ -2,7 +2,7 @@ type: group fields: - name: Actor - type: array + type: group fields: - name: ID type: keyword @@ -21,7 +21,7 @@ - name: AlertId type: keyword - name: AlertLinks - type: array + type: flattened - name: AlertType type: keyword - name: AppId @@ -117,7 +117,7 @@ - name: MailboxOwnerUPN type: keyword - name: Members - type: array + type: flattened - name: Members.* type: object - name: ModifiedProperties.*.* @@ -139,7 +139,7 @@ - name: Parameters.* type: object - name: PolicyDetails - type: array + type: flattened - name: PolicyId type: keyword - name: RecordType @@ -171,7 +171,7 @@ - name: SupportTicketId type: keyword - name: Target - type: array + type: group fields: - name: ID type: keyword diff --git a/packages/o365/data_stream/audit/manifest.yml b/packages/o365/data_stream/audit/manifest.yml index 2c1315f9c13..0d870d244a5 100644 --- a/packages/o365/data_stream/audit/manifest.yml +++ b/packages/o365/data_stream/audit/manifest.yml @@ -1,9 +1,183 @@ type: logs title: Office 365 audit logs streams: + - input: cel + enabled: true + title: "Collect Office 365 audit logs via the Management Activity API using CEL Input" + description: "Collect audit logs from Office 365 via the Management Activity API via CEL Input" + template_path: cel.yml.hbs + vars: + - name: url + type: text + title: Base URL of Office Management API + show_user: true + required: false + default: https://manage.office.com + - name: interval + type: text + title: Interval + description: How often the API is polled, supports seconds, minutes and hours. + show_user: true + required: true + default: 3m + - name: azure_tenant_id + type: text + title: Directory (tenant) ID + description: Directory (tenant) ID + show_user: true + multi: false + required: true + - name: client_id + type: text + title: Application (client) ID + description: Client ID used for Oauth2 authentication + show_user: true + required: true + - name: client_secret + type: password + title: Client Secret + description: Client secret used for Oauth2 authentication + show_user: true + required: true + - name: token_url + type: text + title: Oauth2 Token URL + description: The Base URL endpoint that will be used to generate the tokens during the oauth2 flow. If not provided, above `Azure Tenant ID` will be used for oauth2 token generation. Default value - `https://login.microsoftonline.com` + show_user: true + required: false + default: https://login.microsoftonline.com + - name: content_types + type: text + title: Content Type + show_user: true + multi: false + required: true + default: "Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All" + description: "Comma seperated list of content types to fetch from Management API. \nSupported content types are - `Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All`.\n\nMore information can be found in the [documentation](https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#working-with-the-office-365-management-activity-api).\n" + - name: initial_interval + type: text + title: Initial Interval + description: Initial interval for the first API call. Default starts fetching events from 168h, i.e., 7 days ago. This value should not be more than 7 days ago. Supports following suffixes - "h" (hour), "m" (minute), "s" (second), "ms" (millisecond), "us" (microsecond), and "ns" (nanosecond) + show_user: true + required: true + default: 168h + - name: resource_ssl + type: yaml + title: Resource SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc, more examples found in the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) + multi: false + required: false + show_user: false + - name: resource_timeout + type: text + title: Resource Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. Default is "30"s. + show_user: false + multi: false + required: false + default: 60s + - name: resource_proxy_url + type: text + title: Resource Proxy + description: This specifies proxy configuration in the form of `http[s]://:@:`. + show_user: false + multi: false + required: false + - name: resource_retry_max_attempts + type: text + title: Resource Retry Max Attempts + description: The maximum number of retries for the HTTP client. Default is "5". + show_user: false + multi: false + required: false + - name: resource_retry_wait_min + type: text + title: Resource Retry Wait Min + description: The minimum time to wait before a retry is attempted. Default is "1s". + show_user: false + multi: false + required: false + - name: resource_retry_wait_max + type: text + title: Resource Retry Wait Max + description: The maximum time to wait before a retry is attempted. Default is "60s". + show_user: false + multi: false + required: false + - name: resource_redirect_forward_headers + type: bool + title: Resource Redirect Forward Headers + description: When set to true resource headers are forwarded in case of a redirect. Default is "false". + show_user: false + multi: false + required: false + - name: resource_redirect_headers_ban_list + type: text + title: Resource Redirect Headers Ban List + description: When Redirect Forward Headers is set to true, all headers except the ones defined in this list will be forwarded. All headers are forwarded by default. + show_user: false + multi: true + required: false + - name: resource_redirect_max_redirects + type: text + title: Resource Redirect Max Redirects + description: The maximum number of redirects to follow for a resource. Default is "10". + show_user: false + multi: false + required: false + - name: resource_rate_limit_limit + type: text + title: Resource Rate Limit + description: The value of the response that specifies the total limit. + show_user: false + multi: false + required: false + - name: resource_rate_limit_burst + type: text + title: Resource Rate Limit Burst + description: The maximum burst size. Burst is the maximum number of resource requests that can be made above the overall rate limit. + show_user: false + multi: false + required: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - o365-cel + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: > + The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details. + - input: o365audit - title: "Collect Office 365 audit logs" - description: "Collect audit logs from Office 365 via the Management Activity API" + enabled: false + title: "Collect Office 365 audit logs - Deprecated. Please disable this and use the CEL input instead." + description: "Collect audit logs from Office 365 via the Management Activity API using Filebeat's O365Audit Input" + template_path: o365audit.yml.hbs vars: - name: application_id type: text @@ -100,4 +274,3 @@ streams: description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - template_path: o365audit.yml.hbs diff --git a/packages/o365/data_stream/audit/sample_event.json b/packages/o365/data_stream/audit/sample_event.json index 826225038aa..cecd822e40b 100644 --- a/packages/o365/data_stream/audit/sample_event.json +++ b/packages/o365/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-02-07T16:43:53.000Z", "agent": { - "ephemeral_id": "d8eff6cd-2ba5-4930-9630-5f70e7bae64a", - "id": "daae9b35-e01e-4afc-a59d-da75f9702aa7", + "ephemeral_id": "79788e62-6885-49cb-b397-b329ddb0f349", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.9.0" }, "client": { "address": "213.97.47.133", @@ -17,12 +17,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "daae9b35-e01e-4afc-a59d-da75f9702aa7", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.5.1" + "version": "8.9.0" }, "event": { "action": "PageViewed", @@ -33,9 +33,8 @@ "code": "SharePoint", "dataset": "o365.audit", "id": "99d005e6-a4c6-46fd-117c-08d7abeceab5", - "ingested": "2023-01-29T22:48:55Z", + "ingested": "2023-07-27T16:10:06Z", "kind": "event", - "original": "{\"ListItemUniqueId\": \"59a8433d-9bb8-cfef-6edc-4c0fc8b86875\", \"ItemType\": \"Page\", \"Workload\": \"OneDrive\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"asr@testsiem.onmicrosoft.com\", \"CreationTime\": \"2020-02-07T16:43:53\", \"Site\": \"d5180cfc-3479-44d6-b410-8c985ac894e3\", \"ClientIP\": \"213.97.47.133\", \"WebId\": \"8c5c94bb-8396-470c-87d7-8999f440cd30\", \"UserType\": 0, \"Version\": 1, \"EventSource\": \"SharePoint\", \"UserAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0\", \"UserKey\": \"i:0h.f|membership|1003200096971f55@live.com\", \"CustomUniqueId\": true, \"Operation\": \"PageViewed\", \"ObjectId\": \"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx\", \"Id\": \"99d005e6-a4c6-46fd-117c-08d7abeceab5\", \"CorrelationId\": \"622b339f-4000-a000-f25f-92b3478c7a25\", \"RecordType\": 4}", "outcome": "success", "provider": "OneDrive", "type": [ @@ -47,7 +46,7 @@ "name": "testsiem.onmicrosoft.com" }, "input": { - "type": "o365audit" + "type": "cel" }, "network": { "type": "ipv4" @@ -85,9 +84,9 @@ "ip": "213.97.47.133" }, "tags": [ + "preserve_original_event", "forwarded", - "o365-audit", - "preserve_original_event" + "o365-cel" ], "user": { "domain": "testsiem.onmicrosoft.com", diff --git a/packages/o365/docs/README.md b/packages/o365/docs/README.md index 9c844dfa905..80c02a1c830 100644 --- a/packages/o365/docs/README.md +++ b/packages/o365/docs/README.md @@ -2,20 +2,29 @@ This integration is for [Microsoft Office 365](https://docs.microsoft.com/en-us/previous-versions/office/office-365-api/). It currently supports user, admin, system, and policy actions and events from Office 365 and Azure AD activity logs exposed by the Office 365 Management Activity API. -## Configuration +## Setup To use this package you need to enable _Audit Log Search_ and register an application in Azure AD. -Once this application is registered note the _Application (client) ID_ and the _Directory (tenant) ID._ Then configure the authentication in the _Certificates & Secrets_ section. +Once this application is registered, note the _Application (client) ID_ and the _Directory (tenant) ID._ Then configure the authentication in the _Certificates & Secrets_ section. -To use client-secret authentication, add you secret to the _Client Secret (API key)_ field. +To use client-secret authentication, add your secret to the _Client Secret_ field. -To use certificate-based authentication, set the paths to the certificate and private key files. If the key file is protected with a passphrase, set this passphrase in the _Private key passphrase_ field. Paths must be absolute and files must exist in the host where _Elastic Agent_ is running. +**NOTE:** As Microsoft is no longer supporting Azure Active Directory Authentication Library (ADAL), the existing o365audit input is being deprecated in favor of new [CEL](https://www.elastic.co/guide/en/beats/filebeat/8.6/filebeat-input-cel.html) input in version `1.18.0`. Hence for versions `>= 1.18.0`, certificate based authentication (provided by earlier o365audit input) is no longer supported. +We request users upgrading from integration version `< 1.18.0` to `>= 1.18.0` to follow these steps: -Add your tenant ID(s) to the _Directory (tenant) IDs_ field, then add the hostname that this tenant identifies to the _Directory (tenant) domains_ field. For example: -- Directory IDs: `my-id-a` `my-id-b` -- Directory domains: `a.onmicrosoft.com` `b.onmicrosoft.com` +1. Upgrade the Elastic Stack version to `>= 8.7.1`. +2. Upgrade the integration navigating via `Integrations -> Microsoft 365 -> Settings -> Upgrade` +3. Upgrade the integration policy navigating via `Integrations -> Microsoft 365 -> integration policies -> Version (Upgrade)`. If `Upgrade` option doesn't appear under the `Version`, that means the policy is already upgraded in the previous step. Please go to the next step. +4. Modify the integration policy: + + * Disable existing configuration (marked as `Deprecated`) and enable `Collect Office 365 audit logs via CEL` configuration. + * Add the required parameters such as `Directory (tenant) ID`, `Application (client) ID`, `Client Secret` based on the previous configuration. + * Verify/Update `Initial Interval` configuration parameter to start fetching events from. This defaults to 7 days. Even if there is overlap in times, the events are not duplicated. + * Update the other configuration parameters as required and hit `Save Integration`. + +Please refer [Upgrade an integration](https://www.elastic.co/guide/en/fleet/current/upgrade-integration.html) in case of any issues while performing integration upgrade. ## Compatibility @@ -33,11 +42,11 @@ An example event for `audit` looks as following: { "@timestamp": "2020-02-07T16:43:53.000Z", "agent": { - "ephemeral_id": "d8eff6cd-2ba5-4930-9630-5f70e7bae64a", - "id": "daae9b35-e01e-4afc-a59d-da75f9702aa7", + "ephemeral_id": "79788e62-6885-49cb-b397-b329ddb0f349", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.5.1" + "version": "8.9.0" }, "client": { "address": "213.97.47.133", @@ -49,12 +58,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "daae9b35-e01e-4afc-a59d-da75f9702aa7", + "id": "c0ee214c-57e5-4a60-80ba-e4dc247eb02e", "snapshot": false, - "version": "8.5.1" + "version": "8.9.0" }, "event": { "action": "PageViewed", @@ -65,9 +74,8 @@ An example event for `audit` looks as following: "code": "SharePoint", "dataset": "o365.audit", "id": "99d005e6-a4c6-46fd-117c-08d7abeceab5", - "ingested": "2023-01-29T22:48:55Z", + "ingested": "2023-07-27T16:10:06Z", "kind": "event", - "original": "{\"ListItemUniqueId\": \"59a8433d-9bb8-cfef-6edc-4c0fc8b86875\", \"ItemType\": \"Page\", \"Workload\": \"OneDrive\", \"OrganizationId\": \"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\", \"UserId\": \"asr@testsiem.onmicrosoft.com\", \"CreationTime\": \"2020-02-07T16:43:53\", \"Site\": \"d5180cfc-3479-44d6-b410-8c985ac894e3\", \"ClientIP\": \"213.97.47.133\", \"WebId\": \"8c5c94bb-8396-470c-87d7-8999f440cd30\", \"UserType\": 0, \"Version\": 1, \"EventSource\": \"SharePoint\", \"UserAgent\": \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0\", \"UserKey\": \"i:0h.f|membership|1003200096971f55@live.com\", \"CustomUniqueId\": true, \"Operation\": \"PageViewed\", \"ObjectId\": \"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx\", \"Id\": \"99d005e6-a4c6-46fd-117c-08d7abeceab5\", \"CorrelationId\": \"622b339f-4000-a000-f25f-92b3478c7a25\", \"RecordType\": 4}", "outcome": "success", "provider": "OneDrive", "type": [ @@ -79,7 +87,7 @@ An example event for `audit` looks as following: "name": "testsiem.onmicrosoft.com" }, "input": { - "type": "o365audit" + "type": "cel" }, "network": { "type": "ipv4" @@ -117,9 +125,9 @@ An example event for `audit` looks as following: "ip": "213.97.47.133" }, "tags": [ + "preserve_original_event", "forwarded", - "o365-audit", - "preserve_original_event" + "o365-cel" ], "user": { "domain": "testsiem.onmicrosoft.com", @@ -178,7 +186,7 @@ An example event for `audit` looks as following: | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -222,7 +230,7 @@ An example event for `audit` looks as following: | o365.audit.ActorYammerUserId | | keyword | | o365.audit.AlertEntityId | | keyword | | o365.audit.AlertId | | keyword | -| o365.audit.AlertLinks | | array | +| o365.audit.AlertLinks | | flattened | | o365.audit.AlertType | | keyword | | o365.audit.AppId | | keyword | | o365.audit.ApplicationDisplayName | | keyword | @@ -270,7 +278,7 @@ An example event for `audit` looks as following: | o365.audit.MailboxOwnerMasterAccountSid | | keyword | | o365.audit.MailboxOwnerSid | | keyword | | o365.audit.MailboxOwnerUPN | | keyword | -| o365.audit.Members | | array | +| o365.audit.Members | | flattened | | o365.audit.Members.\* | | object | | o365.audit.ModifiedProperties.\*.\* | | object | | o365.audit.Name | | keyword | @@ -281,7 +289,7 @@ An example event for `audit` looks as following: | o365.audit.OrganizationName | | keyword | | o365.audit.OriginatingServer | | keyword | | o365.audit.Parameters.\* | | object | -| o365.audit.PolicyDetails | | array | +| o365.audit.PolicyDetails | | flattened | | o365.audit.PolicyId | | keyword | | o365.audit.RecordType | | keyword | | o365.audit.ResultStatus | | keyword | diff --git a/packages/o365/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json b/packages/o365/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json index f08bfe63ab5..44cda5782bd 100644 --- a/packages/o365/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json +++ b/packages/o365/kibana/dashboard/o365-712e2c00-685d-11ea-8d6a-292ef5d68366.json @@ -1,14 +1,6 @@ { - "id": "o365-712e2c00-685d-11ea-8d6a-292ef5d68366", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-14T19:20:20.599Z", - "version": "WzY3MiwxXQ==", "attributes": { "description": "Sample dashboard for Office 365 Management Activity events", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,660 +12,568 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-051e93f9-a0af-4048-8b2b-c0f80afef037", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "051e93f9-a0af-4048-8b2b-c0f80afef037": { + "columnOrder": [ + "651eea76-1551-4c93-808c-ba8761a19ac8" + ], + "columns": { + "651eea76-1551-4c93-808c-ba8761a19ac8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"o365.audit\" " + }, + "visualization": { + "layerId": "051e93f9-a0af-4048-8b2b-c0f80afef037", + "layerType": "data", + "metricAccessor": "651eea76-1551-4c93-808c-ba8761a19ac8" + } + }, + "title": "Audit Event Count [Logs o365]", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { - "h": 6, + "h": 4, "i": "b6942e2a-81dc-40e4-a932-8b7a864b28bc", - "w": 10, + "w": 16, "x": 0, "y": 0 }, "panelIndex": "b6942e2a-81dc-40e4-a932-8b7a864b28bc", + "title": "Audit Event Count [Logs o365]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Audit Event Count [Logs o365]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "dimensions": { - "metrics": [ - { - "accessor": 0, - "format": { - "id": "number", - "params": {} - }, - "type": "vis_dimension" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5f7c5274-a250-4841-8da4-02409d1dec5a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5f7c5274-a250-4841-8da4-02409d1dec5a": { + "columnOrder": [ + "87032fc2-d81e-4659-8b1e-0bd5efcccee3", + "eb36454a-8e0c-4f53-9e2a-4a8463aa6da7", + "cb579715-5e7b-4e6b-8f7e-88555df49d8a" + ], + "columns": { + "87032fc2-d81e-4659-8b1e-0bd5efcccee3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.code: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cb579715-5e7b-4e6b-8f7e-88555df49d8a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "event.code" + }, + "cb579715-5e7b-4e6b-8f7e-88555df49d8a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "eb36454a-8e0c-4f53-9e2a-4a8463aa6da7": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } } - ] + }, + "textBased": { + "layers": {} + } }, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"o365.audit\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "from": 0, - "to": 10000, - "type": "range" + "accessors": [ + "cb579715-5e7b-4e6b-8f7e-88555df49d8a" + ], + "isHistogram": true, + "layerId": "5f7c5274-a250-4841-8da4-02409d1dec5a", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "87032fc2-d81e-4659-8b1e-0bd5efcccee3", + "xAccessor": "eb36454a-8e0c-4f53-9e2a-4a8463aa6da7", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "cb579715-5e7b-4e6b-8f7e-88555df49d8a" + } + ] } ], - "invertColors": false, - "labels": { - "show": true + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 40, - "labelColor": false, - "subText": "" + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - "useRanges": false - }, - "type": "metric" + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - } - ], - "searchSource": {} - } + "title": "Events Histogram [Logs o365]", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "visualization" + "enhancements": {} }, - "title": "Total audit events" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { - "h": 14, + "h": 16, "i": "9673e6df-4b1e-4771-b1c6-c41c9bfc7272", - "w": 38, - "x": 10, + "w": 32, + "x": 16, "y": 0 }, "panelIndex": "9673e6df-4b1e-4771-b1c6-c41c9bfc7272", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Events Histogram [Logs o365]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "dimensions": { - "series": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4f66319b-8f8c-4e74-b285-e81462d8508c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4f66319b-8f8c-4e74-b285-e81462d8508c": { + "columnOrder": [ + "75a89169-a1d1-4e53-9919-4f61905baef8", + "bb9cca99-aaa0-4087-be7a-08dabbbae3ff" + ], + "columns": { + "75a89169-a1d1-4e53-9919-4f61905baef8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.kind: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "bb9cca99-aaa0-4087-be7a-08dabbbae3ff", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.kind" + }, + "bb9cca99-aaa0-4087-be7a-08dabbbae3ff": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" } - } - }, - "label": "event.code: Descending", - "params": {} - } - ], - "x": { - "accessor": 1, - "aggType": "date_histogram", - "format": { - "id": "date", - "params": { - "pattern": "YYYY-MM-DD HH:mm" + }, + "incompleteColumns": {} } - }, - "label": "@timestamp per 12 hours", - "params": { - "bounds": { - "max": "2020-02-29T10:59:01.067Z", - "min": "2020-02-05T03:25:59.045Z" - }, - "date": true, - "format": "YYYY-MM-DD HH:mm", - "interval": "PT12H", - "intervalESUnit": "h", - "intervalESValue": 12 } }, - "y": [ - { - "accessor": 2, - "aggType": "count", - "format": { - "id": "number" - }, - "label": "Count", - "params": {} - } - ] - }, - "grid": { - "categoryLines": false - }, - "labels": { - "show": false - }, - "legendPosition": "right", - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1", - "circlesRadius": 1 + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ], - "palette": { - "type": "palette", - "name": "kibana_palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset:\"o365.audit\" " }, - "isVislibVis": true, - "detailedTooltip": true - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 50 - }, - "schema": "group", - "type": "terms" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "4f66319b-8f8c-4e74-b285-e81462d8508c", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "bb9cca99-aaa0-4087-be7a-08dabbbae3ff" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "75a89169-a1d1-4e53-9919-4f61905baef8" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "3", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "2020-02-05T03:25:59.045Z", - "to": "2020-02-29T10:59:01.067Z" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - } - ], - "searchSource": {} - } + "shape": "donut" + } + }, + "title": "Audit Event Type [Logs o365]", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" + "enhancements": {}, + "hidePanelTitles": false }, - "title": "Event histogram by service" - }, - { - "version": "8.1.0", - "type": "visualization", "gridData": { - "h": 8, + "h": 12, "i": "70ab7239-c65c-41da-8242-da61750745d7", - "w": 10, + "w": 16, "x": 0, - "y": 6 + "y": 4 }, "panelIndex": "70ab7239-c65c-41da-8242-da61750745d7", - "embeddableConfig": { - "colors": { - "alert": "#EF843C", - "event": "#7EB26D" - }, - "legendOpen": true, - "vis": { - "colors": { - "alert": "#E24D42", - "event": "#7EB26D" - }, - "legendOpen": true - }, - "enhancements": {}, - "savedVis": { - "title": "Audit Event Type [Logs o365]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "label": "Count", - "params": {} - } - }, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" - }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.kind", - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": true, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": {} - } - }, - "type": "visualization" - }, - "title": "Events by type" + "title": "Audit Event Type [Logs o365]", + "type": "lens", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 17, - "i": "775ced7d-7c58-44bc-8d4e-2a757d2c218c", - "w": 10, - "x": 0, - "y": 14 - }, - "panelIndex": "775ced7d-7c58-44bc-8d4e-2a757d2c218c", "embeddableConfig": { - "colors": { - "failure": "#E24D42", - "success": "#629E51" - }, - "legendOpen": false, - "vis": { - "colors": { - "failure": "#E24D42", - "success": "#629E51" - }, - "legendOpen": true - }, - "enhancements": {}, - "savedVis": { - "title": "Top Authentication Failures [Logs o365]", - "description": "", - "uiState": { - "vis": { - "colors": { - "failure": "#E24D42", - "success": "#629E51" - }, - "legendOpen": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0510317c-e0fb-49b5-b22c-80c0865aa5ff", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2c47b554-eafa-4209-ad42-afc5b207be0b", + "type": "index-pattern" } - }, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 200 - }, - "position": "left", - "scale": { - "type": "linear" - }, - "show": false, - "style": {}, - "title": {}, - "type": "category" - } - ], - "dimensions": { - "series": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" - } - } - }, - "label": "event.outcome: Ascending", - "params": {} - } - ], - "splitRow": [ - { - "accessor": 1, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other", - "parsedUrl": { - "basePath": "", - "origin": "http://localhost:5601", - "pathname": "/app/kibana" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0510317c-e0fb-49b5-b22c-80c0865aa5ff": { + "columnOrder": [ + "0888b348-2b9c-43e4-8e9f-dbd026bfa3fe", + "bf747ca6-4af4-4356-8aba-315e573c1e5c", + "9332e806-5841-415c-8d3d-9ccbb403100c" + ], + "columns": { + "0888b348-2b9c-43e4-8e9f-dbd026bfa3fe": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Outcome", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9332e806-5841-415c-8d3d-9ccbb403100c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 2 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "9332e806-5841-415c-8d3d-9ccbb403100c": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "bf747ca6-4af4-4356-8aba-315e573c1e5c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9332e806-5841-415c-8d3d-9ccbb403100c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" } - } - }, - "label": "user.name: Descending", - "params": {} - } - ], - "x": null, - "y": [ - { - "accessor": 2, - "aggType": "count", - "format": { - "id": "number" - }, - "label": "Count", - "params": {} + }, + "incompleteColumns": {}, + "sampling": 1 + } } - ] - }, - "grid": { - "categoryLines": false, - "valueAxis": "" - }, - "labels": { - "show": true - }, - "legendPosition": "bottom", - "orderBucketsBySum": true, - "row": true, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1", - "circlesRadius": 1 + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": true, - "rotate": 75, - "show": false, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "bottom", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": false, - "style": {}, - "title": { - "text": "Count" + "meta": { + "alias": null, + "disabled": false, + "field": "event.category", + "index": "2c47b554-eafa-4209-ad42-afc5b207be0b", + "key": "event.category", + "negate": false, + "params": { + "query": "authentication" + }, + "type": "phrase" }, - "type": "value" + "query": { + "match_phrase": { + "event.category": "authentication" + } + } } ], - "palette": { - "type": "palette", - "name": "kibana_palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "isVislibVis": true, - "detailedTooltip": true - }, - "type": "horizontal_bar", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "" - }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "asc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 2 - }, - "schema": "group", - "type": "terms" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "user.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 15 - }, - "schema": "split", - "type": "terms" - } - ], - "searchSource": { - "filter": [ + "visualization": { + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.category", - "negate": false, - "params": { - "query": "authentication" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "authentication" - } - } + "categoryDisplay": "default", + "layerId": "0510317c-e0fb-49b5-b22c-80c0865aa5ff", + "layerType": "data", + "legendDisplay": "default", + "legendPosition": "top", + "metrics": [ + "9332e806-5841-415c-8d3d-9ccbb403100c" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "0888b348-2b9c-43e4-8e9f-dbd026bfa3fe", + "bf747ca6-4af4-4356-8aba-315e573c1e5c" + ], + "truncateLegend": false } ], - "query": { - "language": "kuery", - "query": "" - } + "palette": { + "name": "status", + "type": "palette" + }, + "shape": "donut" } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" + "enhancements": {}, + "hidePanelTitles": false }, - "title": "Top users by authentication failures" - }, - { - "version": "8.1.0", - "type": "map", "gridData": { - "h": 17, - "i": "15fe975b-6b8b-4445-872d-e06c041e2c31", - "w": 38, - "x": 10, - "y": 14 + "h": 18, + "i": "9ae12e73-92f2-43a6-b847-2a7b1939709c", + "w": 16, + "x": 0, + "y": 16 }, - "panelIndex": "15fe975b-6b8b-4445-872d-e06c041e2c31", + "panelIndex": "9ae12e73-92f2-43a6-b847-2a7b1939709c", + "title": "Top users by authentication outcome", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"alpha\":1,\"id\":\"0b910b6c-77c8-4223-892a-1ebf69b0ccb4\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"acc53b7b-3411-406b-9371-6fa62b6b9365\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"geoField\":\"source.geo.location\",\"id\":\"3ba31ffc-7051-44bf-96a0-a684020cd2a3\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"airfield\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"maxSize\":32,\"minSize\":8},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}},\"type\":\"DYNAMIC\"},\"lineColor\":{\"options\":{\"color\":\"#FFF\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":0},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"center\":{\"lat\":30.87292,\"lon\":16.67387},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:\\\"o365.audit\\\" \"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"2020-02-05T03:25:59.045Z\",\"to\":\"2020-02-29T10:59:01.067Z\"},\"zoom\":2.88,\"settings\":{\"autoFitToDataBounds\":false}}", + "title": "Client Geo Map [Logs o365 audit]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, "hiddenLayers": [], "isLayerTOCOpen": false, "mapCenter": { @@ -681,80 +581,84 @@ "lon": -48.94209, "zoom": 1.88 }, - "openTOCDetails": [], - "enhancements": {}, - "attributes": { - "title": "Client Geo Map [Logs o365 audit]", - "description": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}", - "mapStateJSON": "{\"center\":{\"lat\":30.87292,\"lon\":16.67387},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset:\\\"o365.audit\\\" \"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"2020-02-05T03:25:59.045Z\",\"to\":\"2020-02-29T10:59:01.067Z\"},\"zoom\":2.88,\"settings\":{\"autoFitToDataBounds\":false}}", - "layerListJSON": "[{\"alpha\":1,\"id\":\"0b910b6c-77c8-4223-892a-1ebf69b0ccb4\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"acc53b7b-3411-406b-9371-6fa62b6b9365\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"geoField\":\"source.geo.location\",\"id\":\"3ba31ffc-7051-44bf-96a0-a684020cd2a3\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"airfield\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"maxSize\":32,\"minSize\":8},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}},\"type\":\"DYNAMIC\"},\"lineColor\":{\"options\":{\"color\":\"#FFF\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":0},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]" - }, - "type": "map" + "openTOCDetails": [] + }, + "gridData": { + "h": 18, + "i": "15fe975b-6b8b-4445-872d-e06c041e2c31", + "w": 32, + "x": 16, + "y": 16 }, - "title": "Client geolocation map" + "panelIndex": "15fe975b-6b8b-4445-872d-e06c041e2c31", + "title": "Client geolocation map", + "type": "map", + "version": "8.7.1" }, { - "version": "7.6.0", - "type": "search", + "embeddableConfig": { + "enhancements": {} + }, "gridData": { "h": 13, "i": "481f1778-caad-4971-b598-bb61c94bf998", "w": 48, "x": 0, - "y": 31 + "y": 34 }, "panelIndex": "481f1778-caad-4971-b598-bb61c94bf998", - "embeddableConfig": { - "enhancements": {} - }, + "panelRefName": "panel_481f1778-caad-4971-b598-bb61c94bf998", "title": "Data Loss Prevention alerts", - "panelRefName": "panel_481f1778-caad-4971-b598-bb61c94bf998" + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs o365] Audit Dashboard", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:43:17.837Z", + "id": "o365-712e2c00-685d-11ea-8d6a-292ef5d68366", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "name": "481f1778-caad-4971-b598-bb61c94bf998:panel_481f1778-caad-4971-b598-bb61c94bf998", - "type": "search", - "id": "o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366" + "id": "logs-*", + "name": "b6942e2a-81dc-40e4-a932-8b7a864b28bc:indexpattern-datasource-layer-051e93f9-a0af-4048-8b2b-c0f80afef037", + "type": "index-pattern" }, { - "type": "search", - "name": "b6942e2a-81dc-40e4-a932-8b7a864b28bc:search_0", - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366" + "id": "logs-*", + "name": "9673e6df-4b1e-4771-b1c6-c41c9bfc7272:indexpattern-datasource-layer-5f7c5274-a250-4841-8da4-02409d1dec5a", + "type": "index-pattern" }, { - "type": "search", - "name": "9673e6df-4b1e-4771-b1c6-c41c9bfc7272:search_0", - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366" + "id": "logs-*", + "name": "70ab7239-c65c-41da-8242-da61750745d7:indexpattern-datasource-layer-4f66319b-8f8c-4e74-b285-e81462d8508c", + "type": "index-pattern" }, { - "type": "search", - "name": "70ab7239-c65c-41da-8242-da61750745d7:search_0", - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366" + "id": "logs-*", + "name": "9ae12e73-92f2-43a6-b847-2a7b1939709c:indexpattern-datasource-layer-0510317c-e0fb-49b5-b22c-80c0865aa5ff", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "775ced7d-7c58-44bc-8d4e-2a757d2c218c:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "9ae12e73-92f2-43a6-b847-2a7b1939709c:2c47b554-eafa-4209-ad42-afc5b207be0b", + "type": "index-pattern" }, { - "type": "search", - "name": "775ced7d-7c58-44bc-8d4e-2a757d2c218c:search_0", - "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366" + "id": "logs-*", + "name": "15fe975b-6b8b-4445-872d-e06c041e2c31:layer_1_source_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "15fe975b-6b8b-4445-872d-e06c041e2c31:layer_1_source_index_pattern", - "id": "logs-*" + "id": "o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366", + "name": "481f1778-caad-4971-b598-bb61c94bf998:panel_481f1778-caad-4971-b598-bb61c94bf998", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/o365/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json b/packages/o365/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json index a4e3a638abe..d876845fff0 100644 --- a/packages/o365/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json +++ b/packages/o365/kibana/search/o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366.json @@ -110,13 +110,12 @@ "title": "Data Loss Prevention [Logs o365]", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:24:40.433Z", "id": "o365-8b8e5a10-6886-11ea-8d6a-292ef5d68366", "migrationVersion": { - "search": "7.4.0" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/o365/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json b/packages/o365/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json index 59c3f13a937..807c41cdabc 100644 --- a/packages/o365/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json +++ b/packages/o365/kibana/search/o365-fdc14020-6859-11ea-8d6a-292ef5d68366.json @@ -26,13 +26,12 @@ "title": "Audit Events [Logs O365]", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T02:24:40.433Z", "id": "o365-fdc14020-6859-11ea-8d6a-292ef5d68366", "migrationVersion": { - "search": "7.4.0" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", diff --git a/packages/o365/kibana/tags.yml b/packages/o365/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/o365/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/o365/manifest.yml b/packages/o365/manifest.yml index 53a32b44aec..aef08f80608 100644 --- a/packages/o365/manifest.yml +++ b/packages/o365/manifest.yml @@ -1,14 +1,13 @@ name: o365 title: Microsoft 365 -version: "1.16.0" -release: ga +version: "1.23.0" description: Collect logs from Microsoft 365 with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [security, productivity_security] conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 icons: - src: /img/logo-integrations-microsoft-365.svg title: Microsoft Office 365 @@ -29,7 +28,11 @@ policy_templates: description: Collect logs from Office 365 inputs: - type: o365audit - title: "Collect Office 365 audit logs" - description: "Collect audit logs from Office 365 via the Management Activity API" + title: "Collect Office 365 audit logs - Deprecated. Please disable this and use the CEL input instead." + description: "Collect audit logs from Office 365 via the Management Activity API using Filebeat's O365Audit Input" + - type: cel + title: "Collect Office 365 audit logs via Management Activity API using CEL Input" + description: "Collect audit logs from Office 365 via the Management Activity API using CEL Input" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/okta/_dev/build/build.yml b/packages/okta/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/okta/_dev/build/build.yml +++ b/packages/okta/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/okta/_dev/build/docs/README.md b/packages/okta/_dev/build/docs/README.md index c345c48aeae..c1b9bf33267 100644 --- a/packages/okta/_dev/build/docs/README.md +++ b/packages/okta/_dev/build/docs/README.md @@ -8,6 +8,27 @@ The Okta integration collects events from the Okta API, specifically reading fro The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems. This module is implemented using the httpjson input and is configured to paginate through the logs while honoring any rate-limiting headers sent by Okta. +## Types Of Authentication +### API Key +In this type of authentication, we only require an API Key for authenticating the client and polling for Okta System Logs. + +### Oauth2 +**In this type of authentication, we require the following information:** +1. Your Okta domain URL. [ Example: https://dev-123456.okta.com ] +2. Your Okta service app Client ID. +3. Your Okta service app JWK Private Key +4. The Okta scope that is required for OAuth2. [ By default this is set to `okta.logs.read` which should suffice for most use cases ] + +**Steps to acquire Okta Oauth2 credentials:** +1. Acquire an Okta dev or user account with privileges to mint tokens with the `okta.*` scopes. +2. Log into your Okta account, navigate to `Applications` on the left-hand side, click on the `Create App Integration` button and create an API Services application. +3. Click on the created app, note down the `Client ID` and select the option for `Public key/Private key`. +4. Generate your own `Private/Public key` pair in the `JWK` format (PEM is not supported at the moment) and save it in a credentials JSON file or copy it to use directly in the config. + +> **_NOTE:_** + Tokens with `okta.*` Scopes are generally minted from the Okta Org Auth server and not the default/custom authorization server. + The standard Okta Org Auth server endpoint to mint tokens is https://.okta.com/oauth2/v1/token + {{event "system"}} {{fields "system"}} \ No newline at end of file diff --git a/packages/okta/_dev/deploy/docker/docker-compose.yml b/packages/okta/_dev/deploy/docker/docker-compose.yml index 090df6840c5..7c3ff9daa98 100644 --- a/packages/okta/_dev/deploy/docker/docker-compose.yml +++ b/packages/okta/_dev/deploy/docker/docker-compose.yml @@ -12,3 +12,15 @@ services: - http-server - --addr=:8080 - --config=/files/config.yml + okta-oauth2: + image: docker.elastic.co/observability/stream:v0.7.0 + ports: + - 8080 + volumes: + - ./files:/files:ro + environment: + PORT: 8080 + command: + - http-server + - --addr=:8080 + - --config=/files/config_oauth2.yml diff --git a/packages/okta/_dev/deploy/docker/files/config_oauth2.yml b/packages/okta/_dev/deploy/docker/files/config_oauth2.yml new file mode 100644 index 00000000000..8117b3133f8 --- /dev/null +++ b/packages/okta/_dev/deploy/docker/files/config_oauth2.yml @@ -0,0 +1,590 @@ +rules: + # Oauth2 token endpoint + - path: /oauth2/v1/token + methods: [POST] + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + query_params: + grant_type: "client_credentials" + scope: "okta.logs.read" + client_assertion_type: "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" + client_assertion: "{client_assertion:.*}" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + {"token_type": "Bearer","expires_in": 3600,"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN","scope": "okta.logs.read"} + # Syetem log endpoint + - path: /api/v1/logs + methods: [GET] + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + query_params: + since: "{since:2020-02-14.*}" + responses: + - status_code: 200 + headers: + Link: + - '; rel="self"' + - '; rel="self"' + body: |- + [ + { + "actor": { + "alternateId": "xxxxxx@elastic.co", + "detailEntry": null, + "displayName": "xxxxxx", + "id": "00u1abvz4pYqdM8ms4x6", + "type": "User" + }, + "authenticationContext": { + "authenticationProvider": null, + "authenticationStep": 0, + "credentialProvider": null, + "credentialType": null, + "externalSessionId": "102nZHzd6OHSfGG51vsoc22gw", + "interface": null, + "issuer": null + }, + "client": { + "device": "Computer", + "geographicalContext": { + "city": "Dublin", + "country": "Ireland", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "id": null, + "ipAddress": "108.255.197.247", + "userAgent": { + "browser": "FIREFOX", + "os": "Mac OS X", + "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0" + }, + "zone": "null" + }, + "debugContext": { + "debugData": { + "authnRequestId": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "requestId": "XkccyyMli2Uay2I93ZgRzQAAB0c", + "requestUri": "/login/signout", + "threatSuspected": "false", + "url": "/login/signout?message=login_page_messages.session_has_expired" + } + }, + "displayMessage": "User logout from Okta", + "eventType": "user.session.end", + "legacyEventType": "core.user_auth.logout_success", + "outcome": { + "reason": null, + "result": "SUCCESS" + }, + "published": "2021-02-14T22:18:51.843Z", + "request": { + "ipChain": [ + { + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "ip": "108.255.197.247", + "source": null, + "version": "V4" + } + ] + }, + "securityContext": { + "asNumber": null, + "asOrg": null, + "domain": null, + "isProxy": null, + "isp": null + }, + "severity": "INFO", + "target": null, + "transaction": { + "detail": {}, + "id": "XkccyyMli2Uay2I93ZgRzQAAB0c", + "type": "WEB" + }, + "uuid": "faf7398a-4f78-11ea-97fb-5925e98228bd", + "version": "0" + } + ] + - path: /api/v1/logs + methods: [GET] + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + query_params: + since: "{since:.*}" + responses: + - status_code: 200 + headers: + Link: + - '; rel="next"' + - '; rel="self"' + body: |- + [ + { + "actor": { + "alternateId": "xxxxxx@elastic.co", + "detailEntry": null, + "displayName": "xxxxxx", + "id": "00u1abvz4pYqdM8ms4x6", + "type": "User" + }, + "authenticationContext": { + "authenticationProvider": null, + "authenticationStep": 0, + "credentialProvider": null, + "credentialType": null, + "externalSessionId": "102nZHzd6OHSfGG51vsoc22gw", + "interface": null, + "issuer": null + }, + "client": { + "device": "Computer", + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "id": null, + "ipAddress": "108.255.197.247", + "userAgent": { + "browser": "FIREFOX", + "os": "Mac OS X", + "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0" + }, + "zone": "null" + }, + "debugContext": { + "debugData": { + "authnRequestId": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "requestId": "XkccyyMli2Uay2I93ZgRzQAAB0c", + "requestUri": "/login/signout", + "threatSuspected": "false", + "url": "/login/signout?message=login_page_messages.session_has_expired" + } + }, + "displayMessage": "User logout from Okta", + "eventType": "user.session.end", + "legacyEventType": "core.user_auth.logout_success", + "outcome": { + "reason": null, + "result": "SUCCESS" + }, + "published": "2020-02-14T22:18:51.843Z", + "request": { + "ipChain": [ + { + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "ip": "108.255.197.247", + "source": null, + "version": "V4" + } + ] + }, + "securityContext": { + "asNumber": null, + "asOrg": null, + "domain": null, + "isProxy": null, + "isp": null + }, + "severity": "INFO", + "target": null, + "transaction": { + "detail": {}, + "id": "XkccyyMli2Uay2I93ZgRzQAAB0c", + "type": "WEB" + }, + "uuid": "faf7398a-4f77-11ea-97fb-5925e98228bd", + "version": "0" + }, + { + "actor": { + "alternateId": "xxxxxx@elastic.co", + "detailEntry": null, + "displayName": "xxxxxx", + "id": "00u1abvz4pYqdM8ms4x6", + "type": "User" + }, + "authenticationContext": { + "authenticationProvider": null, + "authenticationStep": 0, + "credentialProvider": null, + "credentialType": null, + "externalSessionId": "102bZDNFfWaQSyEZQuDgWt-uQ", + "interface": null, + "issuer": null + }, + "client": { + "device": "Computer", + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "id": null, + "ipAddress": "108.255.197.247", + "userAgent": { + "browser": "FIREFOX", + "os": "Mac OS X", + "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0" + }, + "zone": "null" + }, + "debugContext": { + "debugData": { + "deviceFingerprint": "541daf91d15bef64a7e08c946fd9a9d0", + "requestId": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "requestUri": "/api/v1/authn", + "threatSuspected": "false", + "url": "/api/v1/authn?" + } + }, + "displayMessage": "User login to Okta", + "eventType": "user.session.start", + "legacyEventType": "core.user_auth.login_success", + "outcome": { + "reason": null, + "result": "SUCCESS" + }, + "published": "2020-02-14T20:18:57.718Z", + "request": { + "ipChain": [ + { + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "ip": "108.255.197.247", + "source": null, + "version": "V4" + } + ] + }, + "securityContext": { + "asNumber": null, + "asOrg": null, + "domain": null, + "isProxy": null, + "isp": null + }, + "severity": "INFO", + "target": null, + "transaction": { + "detail": {}, + "id": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "type": "WEB" + }, + "uuid": "3aeede38-4f67-11ea-abd3-1f5d113f2546", + "version": "0" + } + ] + - path: /api/v1/logs + methods: [GET] + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + query_params: + after: "1" + responses: + - status_code: 200 + headers: + Link: + - '; rel="next"' + - '; rel="self"' + body: |- + [ + { + "actor": { + "alternateId": "xxxxxx@elastic.co", + "detailEntry": null, + "displayName": "xxxxxx", + "id": "00u1abvz4pYqdM8ms4x6", + "type": "User" + }, + "authenticationContext": { + "authenticationProvider": null, + "authenticationStep": 0, + "credentialProvider": null, + "credentialType": null, + "externalSessionId": "102bZDNFfWaQSyEZQuDgWt-uQ", + "interface": null, + "issuer": null + }, + "client": { + "device": "Computer", + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "id": null, + "ipAddress": "108.255.197.247", + "userAgent": { + "browser": "FIREFOX", + "os": "Mac OS X", + "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0" + }, + "zone": "null" + }, + "debugContext": { + "debugData": { + "deviceFingerprint": "541daf91d15bef64a7e08c946fd9a9d0", + "requestId": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "requestUri": "/api/v1/authn", + "threatSuspected": "false", + "url": "/api/v1/authn?" + } + }, + "displayMessage": "Evaluation of sign-on policy", + "eventType": "policy.evaluate_sign_on", + "legacyEventType": null, + "outcome": { + "reason": "Sign-on policy evaluation resulted in ALLOW", + "result": "ALLOW" + }, + "published": "2020-02-14T20:18:57.762Z", + "request": { + "ipChain": [ + { + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "ip": "108.255.197.247", + "source": null, + "version": "V4" + } + ] + }, + "securityContext": { + "asNumber": null, + "asOrg": null, + "domain": null, + "isProxy": null, + "isp": null + }, + "severity": "INFO", + "target": [ + { + "alternateId": "unknown", + "detailEntry": { + "policyType": "OktaSignOn" + }, + "displayName": "Default Policy", + "id": "00p1abvweGGDW10Ur4x6", + "type": "PolicyEntity" + }, + { + "alternateId": "00p1abvweGGDW10Ur4x6", + "detailEntry": null, + "displayName": "Default Rule", + "id": "0pr1abvwfqGFI4n064x6", + "type": "PolicyRule" + } + ], + "transaction": { + "detail": {}, + "id": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "type": "WEB" + }, + "uuid": "3af594f9-4f67-11ea-abd3-1f5d113f2546", + "version": "0" + } + ] + - path: /api/v1/logs + methods: [GET] + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + query_params: + after: "2" + responses: + - status_code: 200 + headers: + Link: + - '; rel="next"' + - '; rel="self"' + body: |- + [] + # "null" in ipAddress + - path: /api/v1/logs + methods: [GET] + request_headers: + request_headers: + Authorization: + - "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrN" + query_params: + after: "1" + responses: + - status_code: 200 + headers: + Link: + - '; rel="next"' + - '; rel="self"' + body: |- + [ + { + "actor": { + "alternateId": "xxxxxx@elastic.co", + "detailEntry": null, + "displayName": "xxxxxx", + "id": "00u1abvz4pYqdM8ms4x6", + "type": "User" + }, + "authenticationContext": { + "authenticationProvider": null, + "authenticationStep": 0, + "credentialProvider": null, + "credentialType": null, + "externalSessionId": "102bZDNFfWaQSyEZQuDgWt-uQ", + "interface": null, + "issuer": null + }, + "client": { + "device": "Computer", + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "id": null, + "ipAddress": "null", + "userAgent": { + "browser": "FIREFOX", + "os": "Mac OS X", + "rawUserAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0" + }, + "zone": "null" + }, + "debugContext": { + "debugData": { + "deviceFingerprint": "541daf91d15bef64a7e08c946fd9a9d0", + "requestId": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "requestUri": "/api/v1/authn", + "threatSuspected": "false", + "url": "/api/v1/authn?" + } + }, + "displayMessage": "Evaluation of sign-on policy", + "eventType": "policy.evaluate_sign_on", + "legacyEventType": null, + "outcome": { + "reason": "Sign-on policy evaluation resulted in ALLOW", + "result": "ALLOW" + }, + "published": "2020-02-14T20:18:57.762Z", + "request": { + "ipChain": [ + { + "geographicalContext": { + "city": "Dublin", + "country": "United States", + "geolocation": { + "lat": 37.7201, + "lon": -121.919 + }, + "postalCode": "94568", + "state": "California" + }, + "ip": "108.255.197.247", + "source": null, + "version": "V4" + } + ] + }, + "securityContext": { + "asNumber": null, + "asOrg": null, + "domain": null, + "isProxy": null, + "isp": null + }, + "severity": "INFO", + "target": [ + { + "alternateId": "unknown", + "detailEntry": { + "policyType": "OktaSignOn" + }, + "displayName": "Default Policy", + "id": "00p1abvweGGDW10Ur4x6", + "type": "PolicyEntity" + }, + { + "alternateId": "00p1abvweGGDW10Ur4x6", + "detailEntry": null, + "displayName": "Default Rule", + "id": "0pr1abvwfqGFI4n064x6", + "type": "PolicyRule" + } + ], + "transaction": { + "detail": {}, + "id": "XkcAsWb8WjwDP76xh@1v8wAABp0", + "type": "WEB" + }, + "uuid": "3af594f9-4f67-11ea-abd3-1f5d113f2546", + "version": "0" + } + ] diff --git a/packages/okta/changelog.yml b/packages/okta/changelog.yml index d1ce3d53ff4..af8e34f601a 100644 --- a/packages/okta/changelog.yml +++ b/packages/okta/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: "2.0.0" + changes: + - description: Added Okta Oauth2 support, refactored the UI accordingly & updated stack version to ^8.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7542 +- version: "1.28.0" + changes: + - description: Retain `okta.debug_context.debug_data.dt_hash` field. + type: enhancement + link: https://github.com/elastic/integrations/pull/7330 +- version: "1.27.0" + changes: + - description: Update package-spec 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7291 +- version: "1.26.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.25.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.24.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6903 +- version: "1.23.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.22.1" changes: - description: Fix a concurrent modification exception that occurred while modifying okta.target[].detailEntry. diff --git a/packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log-expected.json b/packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log-expected.json index 3bfc11251bb..8cab9d1e464 100644 --- a/packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log-expected.json +++ b/packages/okta/data_stream/system/_dev/test/pipeline/test-okta-system-events.log-expected.json @@ -20,7 +20,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.end", @@ -172,7 +172,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -324,7 +324,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.evaluate_sign_on", @@ -489,7 +489,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.end", @@ -641,7 +641,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -793,7 +793,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.evaluate_sign_on", @@ -958,7 +958,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.end", @@ -1109,7 +1109,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -1261,7 +1261,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.evaluate_sign_on", @@ -1425,7 +1425,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.end", @@ -1558,7 +1558,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -1692,7 +1692,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.evaluate_sign_on", @@ -1846,7 +1846,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -2035,7 +2035,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.verify", @@ -2210,7 +2210,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.verify", @@ -2242,6 +2242,7 @@ }, "debug_context": { "debug_data": { + "dt_hash": "751b157a5a24ed83129433243e8d42307434b047120c32d7a7f5a5d2d91726fa", "flattened": { "authnRequestId": "Y5elHFMngoYoVKvakwnp2wAAAKo", "behaviors": { @@ -2390,7 +2391,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.auth_via_mfa", @@ -2568,7 +2569,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.auth_via_mfa", @@ -2602,6 +2603,7 @@ "debug_context": { "debug_data": { "device_fingerprint": "id", + "dt_hash": "hash", "factor": "FIDO_WEBAUTHN", "flattened": { "authnRequestId": "id", @@ -2753,7 +2755,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.auth_via_mfa", @@ -2787,6 +2789,7 @@ "debug_context": { "debug_data": { "device_fingerprint": "id", + "dt_hash": "hash", "factor": "FIDO_WEBAUTHN", "flattened": { "authnRequestId": "id", @@ -2949,7 +2952,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "group.user_membership.add", @@ -2988,6 +2991,7 @@ }, "debug_context": { "debug_data": { + "dt_hash": "veqflnui3t7ql7k6v0nptw9lipilzybr", "flattened": { "dtHash": "veqflnui3t7ql7k6v0nptw9lipilzybr", "requestId": "3bsdgs8tyatf74aufwsvkt7lv1i9x0o9", @@ -3111,7 +3115,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "app.user_management", @@ -3210,7 +3214,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.sso", @@ -3339,7 +3343,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.sso", @@ -3482,7 +3486,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.authentication.auth_via_mfa", @@ -3516,6 +3520,7 @@ }, "debug_context": { "debug_data": { + "dt_hash": "abc123456abc", "factor": "SIGNED_NONCE", "flattened": { "dtHash": "abc123456abc", @@ -3650,7 +3655,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "device.user.add", diff --git a/packages/okta/data_stream/system/_dev/test/system/test-api-key-config.yml b/packages/okta/data_stream/system/_dev/test/system/test-api-key-config.yml new file mode 100644 index 00000000000..bc5c0d7b452 --- /dev/null +++ b/packages/okta/data_stream/system/_dev/test/system/test-api-key-config.yml @@ -0,0 +1,13 @@ +input: httpjson +service: okta +vars: + url: http://{{Hostname}}:{{Port}}/api/v1/logs + interval: 10s + api_key: testing + enable_request_tracer: true +policy_template: okta +data_stream: + vars: + preserve_original_event: true +assert: + hit_count: 4 diff --git a/packages/okta/data_stream/system/_dev/test/system/test-default-config.yml b/packages/okta/data_stream/system/_dev/test/system/test-default-config.yml deleted file mode 100644 index cb7c5d93c90..00000000000 --- a/packages/okta/data_stream/system/_dev/test/system/test-default-config.yml +++ /dev/null @@ -1,12 +0,0 @@ -input: httpjson -service: okta -vars: - url: http://{{Hostname}}:{{Port}}/api/v1/logs - api_key: testing - interval: 10s -data_stream: - vars: - preserve_original_event: true - enable_request_tracer: true -assert: - hit_count: 4 diff --git a/packages/okta/data_stream/system/_dev/test/system/test-oauth2-config.yml b/packages/okta/data_stream/system/_dev/test/system/test-oauth2-config.yml new file mode 100644 index 00000000000..cd8dc954383 --- /dev/null +++ b/packages/okta/data_stream/system/_dev/test/system/test-oauth2-config.yml @@ -0,0 +1,17 @@ +input: httpjson +service: okta-oauth2 +vars: + url: http://{{Hostname}}:{{Port}}/api/v1/logs + interval: 10s + enable_request_tracer: true + okta_domain_url: http://{{Hostname}}:{{Port}} + client_id: 0oaajljpeokFZLyKU5d7 + okta_scopes: + - okta.logs.read + jwk_json: '{ "d": "Cmhokw2MnZfX6da36nnsnQ7IPX9vE6se8_D1NgyL9j9rarYpexhlp45hswcAIFNgWA03NV848Gc0e84AW6wMbyD2E8LPI0Bd8lhdmzRE6L4or2Rxqqjk2Pr2aqGnqs4A0uTijAA7MfPF1zFFdR3EOVx499fEeTiMcLjO83IJCoNiOySDoQgt3KofX5bCbaDy2eiB83rzf0fEcWrWfTY65_Hc2c5lek-1uuF7NpELVzX80p5H-b9MOfLn0BdOGe-mJ2j5bXi-UCQ45Wxj2jdkoA_Qwb4MEtXZjp5LjcM75SrlGfVd99acML2wGZgYLGweJ0sAPDlKzGvj4ve-JT8nNw", "p": "8-UBb4psN0wRPktkh3S48L3ng4T5zR08t7nwXDYNajROrS2j7oq60dtlGY4IwgwcC0c9GDQP7NiN2IpU2uahYkGQ7lDyM_h7UfQWL5fMrsYiKgn2pUgSy5TTT8smkSLbJAD35nAH6PknsQ2PuvOlb4laiC0MXw1Rw4vT9HAEB9M", "q": "0DJkPEN0bECG_6lorlNJgIfoNahVevGKK-Yti1YZ5K-nQCuffPCwPG0oZZo_55y5LODe9W7psxnAt7wxkpAY4lK2hpHTWJSkPjqXWFYIP8trn4RZDShnJXli0i1XqPOqkiVzBZGx5nLtj2bUtmXfIU7-kneHGvLQ5EXcyQW1ISM", "dp": "Ye1PWEPSE5ndSo_m-2RoZXE6pdocmrjkijiEQ-IIHN6HwI0Ux1C4lk5rF4mqBo_qKrUd2Lv-sPB6c7mHPKVhoxwEX0vtE-TvTwacadufeYVgblS1zcNUmJ1XAzDkeV3vc1NYNhRBeM-hmjuBvGTbxh72VLsRvpCQhd186yaW17U", "dq": "jvSK7vZCUrJb_-CLCGgX6DFpuK5FQ43mmg4K58nPLb-Oz_kkId4CpPsu6dToXFi4raAad9wYi-n68i4-u6xF6eFxgyVOQVyPCkug7_7i2ysKUxXFL8u2R3z55edMca4eSQt91y0bQmlXxUeOd0-rzms3UcrQ8igYVyXBXCaXIJE", "qi": "iIY1Y4bzMYIFG7XH7gNP7C-mWi6QH4l9aGRTzPB_gPaFThvc0XKW0S0l82bfp_PPPWg4D4QpDCp7rZ6KhEA8BlNi86Vt3V6F3Hz5XiDa4ikgQNsAXiXLqf83R-y1-cwHjW70PP3U89hmalCRRFfVXcLHV77AVHqbrp9rAIo-X-I", "kty": "RSA", "e": "AQAB", "kid": "koeFQjkyiav_3Qwr3aRinCqCD2LaEHOjFnje7XlkbdI", "n": "xloTY8bAuI5AEo8JursCd7w0LmELCae7JOFaVo9njGrG8tRNqgIdjPyoGY_ABwKkmjcCMLGMA29llFDbry8rB4LTWai-h_jX4_uUUnl52mLX-lO6merL5HEPZF438Ql9Hrxs5yGzT8n865-E_3uwYSBrhTjvlZJeXYUeVHfKo8pJSSsw3RZEjBW4Tt0eFmCZnFErtTyk3oUPaYVP-8YLLAenhUDV4Lm1dC4dxqUj0Oh6XrWgIb-eYHGolMY9g9xbgyd4ir39RodA_1DOjzHWpNfCM-J5ZOtfpuKCAe5__u7L8FT0m56XOxcDoVVsz1J1VNrACWAGbhDWNjyHfL5E2Q" }' +policy_template: okta +data_stream: + vars: + preserve_original_event: true +assert: + hit_count: 4 diff --git a/packages/okta/data_stream/system/agent/stream/httpjson.yml.hbs b/packages/okta/data_stream/system/agent/stream/httpjson.yml.hbs index 0e23abb86b8..793e63f7936 100644 --- a/packages/okta/data_stream/system/agent/stream/httpjson.yml.hbs +++ b/packages/okta/data_stream/system/agent/stream/httpjson.yml.hbs @@ -15,15 +15,41 @@ request.timeout: {{http_client_timeout}} {{#if proxy_url }} request.proxy_url: {{proxy_url}} {{/if}} +{{! conditional auth.oauth2 section}} +{{#unless api_key}} +{{#if okta_domain_url}} +{{#if client_id}} +auth.oauth2.provider: okta +auth.oauth2.token_url: {{okta_domain_url}}/oauth2/v1/token +auth.oauth2.client.id: {{client_id}} +auth.oauth2.scopes: +{{#each okta_scopes as |scope|}} + - {{scope}} +{{/each}} +{{#if jwk_json}} +auth.oauth2.okta.jwk_json: {{jwk_json}} +{{/if}} +{{#if jwk_file}} +auth.oauth2.okta.jwk_file: {{jwk_file}} +{{/if}} +{{/if}} +{{/if}} +{{/unless}} request.rate_limit: limit: '[[.last_response.header.Get "X-Rate-Limit-Limit"]]' remaining: '[[.last_response.header.Get "X-Rate-Limit-Remaining"]]' reset: '[[.last_response.header.Get "X-Rate-Limit-Reset"]]' request.transforms: +{{#unless client_id}} +{{#unless okta_domain_url}} +{{#if api_key }} - set: target: header.Authorization value: "SSWS {{api_key}}" +{{/if}} +{{/unless}} +{{/unless}} - set: target: url.params.limit value: '1000' diff --git a/packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml b/packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml index 90cff4fa8af..38069b4324f 100644 --- a/packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml +++ b/packages/okta/data_stream/system/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Okta system logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # Keep message as event.original. # Warn if event.original has already been set. This is most likely due to logstash ecs_compatibility setting. - append: @@ -374,6 +374,11 @@ processors: target_field: okta.debug_context.debug_data.url ignore_missing: true ignore_failure: true + - rename: + field: json.debugContext.debugData.dtHash + target_field: okta.debug_context.debug_data.dt_hash + ignore_missing: true + ignore_failure: true - set: field: okta.debug_context.debug_data.risk_level value: "{{{okta.debug_context.debug_data.flattened.logOnlySecurityData.risk.level}}}" diff --git a/packages/okta/data_stream/system/fields/fields.yml b/packages/okta/data_stream/system/fields/fields.yml index e34f4bea5a3..8a6bf423a76 100644 --- a/packages/okta/data_stream/system/fields/fields.yml +++ b/packages/okta/data_stream/system/fields/fields.yml @@ -179,6 +179,10 @@ type: keyword description: | The fingerprint of the device. + - name: dt_hash + type: keyword + description: | + The device token hash - name: factor type: keyword description: | @@ -236,7 +240,7 @@ description: | The information about credential type. Must be one of OTP, SMS, PASSWORD, ASSERTION, IWA, EMAIL, OAUTH2, JWT, CERTIFICATE, PRE_SHARED_SYMMETRIC_KEY, OKTA_CLIENT_SESSION, DEVICE_UDID. - name: issuer - type: array + type: group description: | The information about the issuer. fields: diff --git a/packages/okta/data_stream/system/sample_event.json b/packages/okta/data_stream/system/sample_event.json index fe1169d94ec..2e826235649 100644 --- a/packages/okta/data_stream/system/sample_event.json +++ b/packages/okta/data_stream/system/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-02-14T20:18:57.718Z", "agent": { - "ephemeral_id": "3f562d57-6507-4263-ab9a-20c02bca1d39", - "id": "5223cc35-5786-4527-8d08-bb0418a81831", + "ephemeral_id": "3f42021e-4a96-4f9e-a171-f1270261873e", + "id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.0" }, "client": { "geo": { @@ -30,12 +30,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5223cc35-5786-4527-8d08-bb0418a81831", + "id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576", "snapshot": false, - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -44,10 +44,10 @@ "authentication", "session" ], - "created": "2023-05-26T15:12:31.660Z", + "created": "2023-08-09T18:07:16.315Z", "dataset": "okta.system", "id": "3aeede38-4f67-11ea-abd3-1f5d113f2546", - "ingested": "2023-05-26T15:12:32Z", + "ingested": "2023-08-09T18:07:17Z", "kind": "event", "original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}", "outcome": "success", diff --git a/packages/okta/docs/README.md b/packages/okta/docs/README.md index 897ae8cf58f..33231c423ad 100644 --- a/packages/okta/docs/README.md +++ b/packages/okta/docs/README.md @@ -8,17 +8,38 @@ The Okta integration collects events from the Okta API, specifically reading fro The Okta System Log records system events related to your organization in order to provide an audit trail that can be used to understand platform activity and to diagnose problems. This module is implemented using the httpjson input and is configured to paginate through the logs while honoring any rate-limiting headers sent by Okta. +## Types Of Authentication +### API Key +In this type of authentication, we only require an API Key for authenticating the client and polling for Okta System Logs. + +### Oauth2 +**In this type of authentication, we require the following information:** +1. Your Okta domain URL. [ Example: https://dev-123456.okta.com ] +2. Your Okta service app Client ID. +3. Your Okta service app JWK Private Key +4. The Okta scope that is required for OAuth2. [ By default this is set to `okta.logs.read` which should suffice for most use cases ] + +**Steps to acquire Okta Oauth2 credentials:** +1. Acquire an Okta dev or user account with privileges to mint tokens with the `okta.*` scopes. +2. Log into your Okta account, navigate to `Applications` on the left-hand side, click on the `Create App Integration` button and create an API Services application. +3. Click on the created app, note down the `Client ID` and select the option for `Public key/Private key`. +4. Generate your own `Private/Public key` pair in the `JWK` format (PEM is not supported at the moment) and save it in a credentials JSON file or copy it to use directly in the config. + +> **_NOTE:_** + Tokens with `okta.*` Scopes are generally minted from the Okta Org Auth server and not the default/custom authorization server. + The standard Okta Org Auth server endpoint to mint tokens is https://.okta.com/oauth2/v1/token + An example event for `system` looks as following: ```json { "@timestamp": "2020-02-14T20:18:57.718Z", "agent": { - "ephemeral_id": "3f562d57-6507-4263-ab9a-20c02bca1d39", - "id": "5223cc35-5786-4527-8d08-bb0418a81831", + "ephemeral_id": "3f42021e-4a96-4f9e-a171-f1270261873e", + "id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.0" }, "client": { "geo": { @@ -43,12 +64,12 @@ An example event for `system` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5223cc35-5786-4527-8d08-bb0418a81831", + "id": "12fae7e9-e1d1-4d7d-935d-77da8e90f576", "snapshot": false, - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.session.start", @@ -57,10 +78,10 @@ An example event for `system` looks as following: "authentication", "session" ], - "created": "2023-05-26T15:12:31.660Z", + "created": "2023-08-09T18:07:16.315Z", "dataset": "okta.system", "id": "3aeede38-4f67-11ea-abd3-1f5d113f2546", - "ingested": "2023-05-26T15:12:32Z", + "ingested": "2023-08-09T18:07:17Z", "kind": "event", "original": "{\"actor\":{\"alternateId\":\"xxxxxx@elastic.co\",\"detailEntry\":null,\"displayName\":\"xxxxxx\",\"id\":\"00u1abvz4pYqdM8ms4x6\",\"type\":\"User\"},\"authenticationContext\":{\"authenticationProvider\":null,\"authenticationStep\":0,\"credentialProvider\":null,\"credentialType\":null,\"externalSessionId\":\"102bZDNFfWaQSyEZQuDgWt-uQ\",\"interface\":null,\"issuer\":null},\"client\":{\"device\":\"Computer\",\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"id\":null,\"ipAddress\":\"108.255.197.247\",\"userAgent\":{\"browser\":\"FIREFOX\",\"os\":\"Mac OS X\",\"rawUserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0\"},\"zone\":\"null\"},\"debugContext\":{\"debugData\":{\"deviceFingerprint\":\"541daf91d15bef64a7e08c946fd9a9d0\",\"requestId\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"requestUri\":\"/api/v1/authn\",\"threatSuspected\":\"false\",\"url\":\"/api/v1/authn?\"}},\"displayMessage\":\"User login to Okta\",\"eventType\":\"user.session.start\",\"legacyEventType\":\"core.user_auth.login_success\",\"outcome\":{\"reason\":null,\"result\":\"SUCCESS\"},\"published\":\"2020-02-14T20:18:57.718Z\",\"request\":{\"ipChain\":[{\"geographicalContext\":{\"city\":\"Dublin\",\"country\":\"United States\",\"geolocation\":{\"lat\":37.7201,\"lon\":-121.919},\"postalCode\":\"94568\",\"state\":\"California\"},\"ip\":\"108.255.197.247\",\"source\":null,\"version\":\"V4\"}]},\"securityContext\":{\"asNumber\":null,\"asOrg\":null,\"domain\":null,\"isProxy\":null,\"isp\":null},\"severity\":\"INFO\",\"target\":null,\"transaction\":{\"detail\":{},\"id\":\"XkcAsWb8WjwDP76xh@1v8wAABp0\",\"type\":\"WEB\"},\"uuid\":\"3aeede38-4f67-11ea-abd3-1f5d113f2546\",\"version\":\"0\"}", "outcome": "success", @@ -230,11 +251,11 @@ An example event for `system` looks as following: | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -281,6 +302,7 @@ An example event for `system` looks as following: | okta.client.user_agent.raw_user_agent | The raw informaton of the user agent. | keyword | | okta.client.zone | The zone information of the client. | keyword | | okta.debug_context.debug_data.device_fingerprint | The fingerprint of the device. | keyword | +| okta.debug_context.debug_data.dt_hash | The device token hash | keyword | | okta.debug_context.debug_data.factor | The factor used for authentication. | keyword | | okta.debug_context.debug_data.flattened | The complete debug_data object. | flattened | | okta.debug_context.debug_data.request_id | The identifier of the request. | keyword | diff --git a/packages/okta/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json b/packages/okta/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json index d9f27196be6..80c57b7f015 100644 --- a/packages/okta/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json +++ b/packages/okta/kibana/dashboard/okta-749203a0-67b1-11ea-a76f-bf44814e437d.json @@ -1,14 +1,6 @@ { - "id": "okta-749203a0-67b1-11ea-a76f-bf44814e437d", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-14T19:11:12.643Z", - "version": "WzU3MCwxXQ==", "attributes": { "description": "Logs Okta integration Kibana dashboard", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,21 +12,22 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 22, - "i": "8013824b-5a66-494c-acc5-3df8b7678879", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "8013824b-5a66-494c-acc5-3df8b7678879", "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"alpha\":1,\"id\":\"6908e81b-1695-4445-aee4-8bc8c9f65600\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"dc52e707-92d7-4de7-becf-a3a8bfaa2c2d\",\"label\":\"Okta \",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"okta.system\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":false,\"geoField\":\"client.geo.location\",\"id\":\"4b8bd321-4b90-4d97-83e0-2b12bf091f66\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"center\":{\"lat\":26.54701,\"lon\":-44.69098},\"filters\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"okta.system\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"okta.system\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"now-15w\",\"to\":\"now\"},\"zoom\":2.75,\"settings\":{\"autoFitToDataBounds\":false}}", + "title": "Geolocation [Logs Okta]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, "hiddenLayers": [], "isLayerTOCOpen": false, "mapCenter": { @@ -42,287 +35,463 @@ "lon": -44.69098, "zoom": 2.75 }, - "openTOCDetails": [], - "enhancements": {}, - "attributes": { - "title": "Geolocation [Logs Okta]", - "description": "", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}", - "mapStateJSON": "{\"center\":{\"lat\":26.54701,\"lon\":-44.69098},\"filters\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"negate\":false,\"params\":{\"query\":\"okta.system\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"okta.system\"}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":false},\"timeFilters\":{\"from\":\"now-15w\",\"to\":\"now\"},\"zoom\":2.75,\"settings\":{\"autoFitToDataBounds\":false}}", - "layerListJSON": "[{\"alpha\":1,\"id\":\"6908e81b-1695-4445-aee4-8bc8c9f65600\",\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"dc52e707-92d7-4de7-becf-a3a8bfaa2c2d\",\"label\":\"Okta \",\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"data_stream.dataset : \\\"okta.system\\\" \"},\"sourceDescriptor\":{\"applyGlobalQuery\":true,\"filterByMapBounds\":false,\"geoField\":\"client.geo.location\",\"id\":\"4b8bd321-4b90-4d97-83e0-2b12bf091f66\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"scalingType\":\"LIMIT\",\"sortField\":\"\",\"sortOrder\":\"desc\",\"tooltipProperties\":[],\"topHitsSize\":1,\"type\":\"ES_SEARCH\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"#54B399\"},\"type\":\"STATIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"size\":6},\"type\":\"STATIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#41937c\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]" - }, - "type": "map" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "openTOCDetails": [] + }, "gridData": { - "h": 11, - "i": "c6a66fe5-21a2-4308-8563-d4a7f5135d25", - "w": 10, + "h": 22, + "i": "8013824b-5a66-494c-acc5-3df8b7678879", + "w": 48, "x": 0, - "y": 22 + "y": 0 }, - "panelIndex": "c6a66fe5-21a2-4308-8563-d4a7f5135d25", + "panelIndex": "8013824b-5a66-494c-acc5-3df8b7678879", + "type": "map", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event Outcome [Logs Okta]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0655d62c-1a87-4274-99c6-42a4b1abe8ca", + "type": "index-pattern" }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "09bc346d-6e85-4ed5-b36f-af55d2bafb0b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0655d62c-1a87-4274-99c6-42a4b1abe8ca": { + "columnOrder": [ + "66b348bf-fb42-474d-9778-bb899135575a", + "19e4e3ec-f87e-41e1-aabb-e6a174663c22" + ], + "columns": { + "19e4e3ec-f87e-41e1-aabb-e6a174663c22": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "66b348bf-fb42-474d-9778-bb899135575a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "19e4e3ec-f87e-41e1-aabb-e6a174663c22", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "09bc346d-6e85-4ed5-b36f-af55d2bafb0b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "okta.system" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "okta.system" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "okta.system" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "okta.system" - } - } + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "0655d62c-1a87-4274-99c6-42a4b1abe8ca", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "19e4e3ec-f87e-41e1-aabb-e6a174663c22" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "66b348bf-fb42-474d-9778-bb899135575a" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" } - } + }, + "title": "Event Outcome [Logs Okta]", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 11, - "i": "195db901-dc2b-4b7d-80c3-742e2712ac2a", - "w": 9, - "x": 10, + "i": "c6a66fe5-21a2-4308-8563-d4a7f5135d25", + "w": 10, + "x": 0, "y": 22 }, - "panelIndex": "195db901-dc2b-4b7d-80c3-742e2712ac2a", + "panelIndex": "c6a66fe5-21a2-4308-8563-d4a7f5135d25", + "title": "Event Outcome [Logs Okta]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Transaction Types [Logs Okta]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ddb67a60-ff6d-4d1b-8f84-e984b95f2946", + "type": "index-pattern" }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "657f2c29-1a1d-42a9-ab5d-d3f08cdb0b96", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ddb67a60-ff6d-4d1b-8f84-e984b95f2946": { + "columnOrder": [ + "bd86fc7d-8c3e-4030-90da-e45a4f085165", + "f6b03387-c863-433b-a166-7b0a79074147" + ], + "columns": { + "bd86fc7d-8c3e-4030-90da-e45a4f085165": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "okta.transaction.type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f6b03387-c863-433b-a166-7b0a79074147", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "okta.transaction.type" + }, + "f6b03387-c863-433b-a166-7b0a79074147": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "okta.transaction.type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "657f2c29-1a1d-42a9-ab5d-d3f08cdb0b96", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "okta.system" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "okta.system" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "okta.system" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "okta.system" - } - } + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "ddb67a60-ff6d-4d1b-8f84-e984b95f2946", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "f6b03387-c863-433b-a166-7b0a79074147" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "bd86fc7d-8c3e-4030-90da-e45a4f085165" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" } - } + }, + "title": "Transaction Types [Logs Okta]", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 11, - "i": "dc5128e2-0b4d-4dd5-bbc2-624f64467a77", - "w": 19, - "x": 29, + "i": "195db901-dc2b-4b7d-80c3-742e2712ac2a", + "w": 9, + "x": 10, "y": 22 }, - "panelIndex": "dc5128e2-0b4d-4dd5-bbc2-624f64467a77", + "panelIndex": "195db901-dc2b-4b7d-80c3-742e2712ac2a", + "title": "Transaction Types [Logs Okta]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Time Series [Logs Okta]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "abd68650-67c6-11ea-8c7d-ed286611413e" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-842bcf1d-e1b9-4ef7-a6b1-dab44e97bbc6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1ca7749f-9316-45e1-86b3-ad49657c7c93", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "842bcf1d-e1b9-4ef7-a6b1-dab44e97bbc6": { + "columnOrder": [ + "1904b7fd-7274-44fe-9bca-ec062f73be48", + "53c11bbf-9a73-4f3f-acee-5ca632e659e6" + ], + "columns": { + "1904b7fd-7274-44fe-9bca-ec062f73be48": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "okta.actor.type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "53c11bbf-9a73-4f3f-acee-5ca632e659e6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "okta.actor.type" + }, + "53c11bbf-9a73-4f3f-acee-5ca632e659e6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "", - "isModelInvalid": false, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "filter": { - "language": "kuery", - "query": "data_stream.dataset : \"okta.system\"" + "$state": { + "store": "appState" }, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" + "meta": { + "alias": null, + "disabled": false, + "index": "1ca7749f-9316-45e1-86b3-ad49657c7c93", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "okta.system" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "okta.system" } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "842bcf1d-e1b9-4ef7-a6b1-dab44e97bbc6", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "53c11bbf-9a73-4f3f-acee-5ca632e659e6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "1904b7fd-7274-44fe-9bca-ec062f73be48" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } + "title": "Actor Types [Logs Okta]", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 11, "i": "a25a43ed-3262-486c-a482-1fac52f26128", @@ -331,95 +500,137 @@ "y": 22 }, "panelIndex": "a25a43ed-3262-486c-a482-1fac52f26128", + "title": "Actor Types [Logs Okta]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Actor Types [Logs Okta]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5a112620-88d0-4113-9640-711d4df3d914", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5a112620-88d0-4113-9640-711d4df3d914": { + "columnOrder": [ + "2d8f6a87-64ad-425b-9ef0-055311c4711d", + "28d0f355-72ea-4dbe-9378-0826683e1196" + ], + "columns": { + "28d0f355-72ea-4dbe-9378-0826683e1196": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "2d8f6a87-64ad-425b-9ef0-055311c4711d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"okta.system\" " }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true }, - { - "enabled": true, - "id": "2", - "params": { - "field": "okta.actor.type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [ + "curveType": "LINEAR", + "emphasizeFitting": true, + "fittingFunction": "Zero", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "okta.system" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "okta.system" - } - } + "accessors": [ + "28d0f355-72ea-4dbe-9378-0826683e1196" + ], + "layerId": "5a112620-88d0-4113-9640-711d4df3d914", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "2d8f6a87-64ad-425b-9ef0-055311c4711d" } ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" } - } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" }, - "type": "visualization" - } + "enhancements": {} + }, + "gridData": { + "h": 11, + "i": "ba4cf558-6ada-407b-bf85-047e96d90d31", + "w": 19, + "x": 29, + "y": 22 + }, + "panelIndex": "ba4cf558-6ada-407b-bf85-047e96d90d31", + "type": "lens", + "version": "8.7.1" }, { - "version": "8.0.0-SNAPSHOT", - "type": "search", + "embeddableConfig": { + "enhancements": {} + }, "gridData": { "h": 16, "i": "c0d5bac3-7e50-4ef9-a401-5a596ec84ee9", @@ -428,60 +639,67 @@ "y": 33 }, "panelIndex": "c0d5bac3-7e50-4ef9-a401-5a596ec84ee9", - "embeddableConfig": { - "enhancements": {} - }, - "panelRefName": "panel_c0d5bac3-7e50-4ef9-a401-5a596ec84ee9" + "panelRefName": "panel_c0d5bac3-7e50-4ef9-a401-5a596ec84ee9", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Okta] Overview", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T03:10:17.256Z", + "id": "okta-749203a0-67b1-11ea-a76f-bf44814e437d", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "name": "c0d5bac3-7e50-4ef9-a401-5a596ec84ee9:panel_c0d5bac3-7e50-4ef9-a401-5a596ec84ee9", - "type": "search", - "id": "okta-21028750-67ca-11ea-a76f-bf44814e437d" + "id": "logs-*", + "name": "8013824b-5a66-494c-acc5-3df8b7678879:layer_1_source_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "8013824b-5a66-494c-acc5-3df8b7678879:layer_1_source_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "c6a66fe5-21a2-4308-8563-d4a7f5135d25:indexpattern-datasource-layer-0655d62c-1a87-4274-99c6-42a4b1abe8ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c6a66fe5-21a2-4308-8563-d4a7f5135d25:09bc346d-6e85-4ed5-b36f-af55d2bafb0b", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c6a66fe5-21a2-4308-8563-d4a7f5135d25:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "195db901-dc2b-4b7d-80c3-742e2712ac2a:indexpattern-datasource-layer-ddb67a60-ff6d-4d1b-8f84-e984b95f2946", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "c6a66fe5-21a2-4308-8563-d4a7f5135d25:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "195db901-dc2b-4b7d-80c3-742e2712ac2a:657f2c29-1a1d-42a9-ab5d-d3f08cdb0b96", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "195db901-dc2b-4b7d-80c3-742e2712ac2a:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "a25a43ed-3262-486c-a482-1fac52f26128:indexpattern-datasource-layer-842bcf1d-e1b9-4ef7-a6b1-dab44e97bbc6", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "195db901-dc2b-4b7d-80c3-742e2712ac2a:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "a25a43ed-3262-486c-a482-1fac52f26128:1ca7749f-9316-45e1-86b3-ad49657c7c93", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "a25a43ed-3262-486c-a482-1fac52f26128:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "ba4cf558-6ada-407b-bf85-047e96d90d31:indexpattern-datasource-layer-5a112620-88d0-4113-9640-711d4df3d914", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "a25a43ed-3262-486c-a482-1fac52f26128:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "okta-21028750-67ca-11ea-a76f-bf44814e437d", + "name": "c0d5bac3-7e50-4ef9-a401-5a596ec84ee9:panel_c0d5bac3-7e50-4ef9-a401-5a596ec84ee9", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/okta/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json b/packages/okta/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json index 87ee98392ad..0c0e7e5059c 100644 --- a/packages/okta/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json +++ b/packages/okta/kibana/search/okta-21028750-67ca-11ea-a76f-bf44814e437d.json @@ -73,13 +73,9 @@ "title": "Okta Failure Events", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T03:00:25.347Z", "id": "okta-21028750-67ca-11ea-a76f-bf44814e437d", - "migrationVersion": { - "search": "7.4.0" - }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -97,5 +93,6 @@ "type": "index-pattern" } ], - "type": "search" + "type": "search", + "typeMigrationVersion": "8.0.0" } \ No newline at end of file diff --git a/packages/okta/manifest.yml b/packages/okta/manifest.yml index 148fdd7c9bf..7026a446869 100644 --- a/packages/okta/manifest.yml +++ b/packages/okta/manifest.yml @@ -1,14 +1,12 @@ name: okta title: Okta -version: "1.22.1" -release: ga +version: "2.0.0" description: Collect and parse event logs from Okta API with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.9.0 categories: [security, iam] conditions: - kibana.version: ^8.7.1 + kibana.version: ^8.10.0 icons: - src: /img/okta-logo.svg title: Okta @@ -26,22 +24,10 @@ policy_templates: inputs: - type: httpjson vars: - - name: api_key - type: text - title: API Key - multi: false - required: true - show_user: true - - name: enable_request_tracer - type: bool - title: Enable request tracing - multi: false - required: false - show_user: false - description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -52,6 +38,7 @@ policy_templates: required: true show_user: true default: 60s + description: Interval at which logs are pulled. Supported units for this parameter are h/m/s. - name: initial_interval type: text title: Initial Interval @@ -59,17 +46,74 @@ policy_templates: required: true show_user: true default: 24h - - name: ssl - type: yaml - title: SSL + description: Initial Interval for first log pull. Supported units for this parameter are h/m/s. + - name: url + type: text + title: Okta System Log API URL + multi: false + required: true + show_user: true + description: This is the URL of your Okta System Log API. For example, https://dev-123456.okta.com/api/v1/logs. + - name: api_key + type: text + title: API Key multi: false required: false show_user: true - - name: url + description: "This is the API Key of your Okta service application. This is only required for the standard api key based authentication. \nDo not use this field if you are using OAuth2 authentication.\n" + - name: okta_domain_url type: text - title: Okta System Log API Url + title: Okta Domain URL multi: false - required: true + required: false + show_user: true + description: "This is the URL of your Okta domain. For example, https://dev-123456.okta.com. \nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\n" + - name: client_id + type: text + title: Client ID + multi: false + required: false + show_user: true + description: "This is the Client ID of your Okta service application. This is only required for OAuth2 authentication. \nDo not use this field if you are using API Key based authentication.\n" + - name: jwk_json + type: password + title: JWK JSON + multi: false + required: false + show_user: true + description: "This is the private JSON Web Key (JWK) of your Okta service application. \nThis is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication.\n" + - name: jwk_file + type: text + title: JWK File + multi: false + required: false + show_user: true + description: | + This is the path to the file containing the private JSON Web Key (JWK) of your Okta service application. + This is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication. + - name: okta_scopes + type: text + title: Okta Scopes + multi: true + required: false + show_user: true + default: + - okta.logs.read + description: | + This is the list of 'okta.*' scopes that your Okta service application has access to. + This is only required for OAuth2 authentication. Do not use this field if you are using API Key based authentication. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. + - name: ssl + type: yaml + title: SSL + multi: false + required: false show_user: true - name: proxy_url type: text diff --git a/packages/oracle/changelog.yml b/packages/oracle/changelog.yml index 91a800ce8ee..215d6afb9c1 100644 --- a/packages/oracle/changelog.yml +++ b/packages/oracle/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.20.2" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.20.1" + changes: + - description: Resolved `ORA-01476` error in `Performance` datastream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7718 +- version: "1.20.0" + changes: + - description: Add support for processors + type: enhancement + link: https://github.com/elastic/integrations/pull/6537 - version: "1.19.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/oracle/data_stream/database_audit/elasticsearch/ingest_pipeline/default.yml b/packages/oracle/data_stream/database_audit/elasticsearch/ingest_pipeline/default.yml index b3c25566941..d0e98ca191d 100644 --- a/packages/oracle/data_stream/database_audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle/data_stream/database_audit/elasticsearch/ingest_pipeline/default.yml @@ -35,6 +35,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' # First pattern for object, second for database audit events. - grok: field: event.original diff --git a/packages/oracle/data_stream/memory/agent/stream/stream.yml.hbs b/packages/oracle/data_stream/memory/agent/stream/stream.yml.hbs index fce8214842d..65facec33b2 100644 --- a/packages/oracle/data_stream/memory/agent/stream/stream.yml.hbs +++ b/packages/oracle/data_stream/memory/agent/stream/stream.yml.hbs @@ -11,4 +11,8 @@ sql_queries: - query: select name, value from V$PGASTAT where name in ('aggregate PGA auto target','global memory bound', 'total PGA allocated', 'total PGA used for auto workareas', 'total PGA inuse', 'maximum PGA allocated', 'total freeable PGA memory', 'cache hit percentage', 'aggregate PGA target parameter') response_format: variables - query: select 'sga free memory' as NAME, sum(decode(name,'free memory',bytes)) as VALUE from v$sgastat where pool = 'shared pool' union select 'sga total memory' as NAME, sum(bytes) as VALUE from v$sgastat where pool = 'shared pool' - response_format: variables \ No newline at end of file + response_format: variables +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/oracle/data_stream/memory/manifest.yml b/packages/oracle/data_stream/memory/manifest.yml index e9a811961ee..0cfba36c720 100644 --- a/packages/oracle/data_stream/memory/manifest.yml +++ b/packages/oracle/data_stream/memory/manifest.yml @@ -21,5 +21,13 @@ streams: show_user: false default: - oracle_memory_metrics + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/oracle/data_stream/performance/agent/stream/stream.yml.hbs b/packages/oracle/data_stream/performance/agent/stream/stream.yml.hbs index ca7431242a2..722ca1e7e06 100644 --- a/packages/oracle/data_stream/performance/agent/stream/stream.yml.hbs +++ b/packages/oracle/data_stream/performance/agent/stream/stream.yml.hbs @@ -7,7 +7,7 @@ hosts: raw_data.enabled: true driver: "oracle" sql_queries: - - query: SELECT name, physical_reads, db_block_gets, consistent_gets, 1 - (physical_reads / (db_block_gets + consistent_gets)) "Hit_Ratio" FROM V$BUFFER_POOL_STATISTICS + - query: SELECT name, physical_reads, db_block_gets, consistent_gets, 1 - (physical_reads / (db_block_gets + consistent_gets)) "Hit_Ratio" FROM V$BUFFER_POOL_STATISTICS where (db_block_gets + consistent_gets) > 0 response_format: table - query: SELECT sum(a.value) total_cur, avg(a.value) avg_cur, max(a.value) max_cur, S.username, s.machine FROM v$sesstat a, v$statname b, v$session s WHERE a.statistic# = b.statistic# AND s.sid = a.sid GROUP BY s.username, s.machine response_format: table @@ -21,3 +21,7 @@ sql_queries: response_format: variables - query: select WAIT_CLASS, TOTAL_WAITS, round(100 * (TOTAL_WAITS / SUM_WAITS),2) PCT_WAITS, ROUND((TIME_WAITED / 100),2) TIME_WAITED_SECS, round(100 * (TIME_WAITED / SUM_TIME),2) PCT_TIME from (select WAIT_CLASS, TOTAL_WAITS, TIME_WAITED from V$SYSTEM_WAIT_CLASS where WAIT_CLASS != 'Idle'), (select sum(TOTAL_WAITS) SUM_WAITS, sum(TIME_WAITED) SUM_TIME from V$SYSTEM_WAIT_CLASS where WAIT_CLASS != 'Idle') order by 5 desc response_format: table +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/oracle/data_stream/performance/manifest.yml b/packages/oracle/data_stream/performance/manifest.yml index 6d34d8bc2e9..3a646c2614d 100644 --- a/packages/oracle/data_stream/performance/manifest.yml +++ b/packages/oracle/data_stream/performance/manifest.yml @@ -22,5 +22,13 @@ streams: show_user: false default: - oracle_performance + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/oracle/data_stream/sysmetric/agent/stream/stream.yml.hbs b/packages/oracle/data_stream/sysmetric/agent/stream/stream.yml.hbs index e7e32004175..025cca49bd8 100644 --- a/packages/oracle/data_stream/sysmetric/agent/stream/stream.yml.hbs +++ b/packages/oracle/data_stream/sysmetric/agent/stream/stream.yml.hbs @@ -9,4 +9,8 @@ dynamic_metric_name_filter: "{{dynamic_metric_name_filter}}" driver: "oracle" sql_queries: - query: SELECT METRIC_NAME, VALUE FROM V$SYSMETRIC WHERE GROUP_ID = 2 and METRIC_NAME LIKE '{{dynamic_metric_name_filter}}' - response_format: variables \ No newline at end of file + response_format: variables +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/oracle/data_stream/sysmetric/manifest.yml b/packages/oracle/data_stream/sysmetric/manifest.yml index 8ee55f16995..c535970a95c 100644 --- a/packages/oracle/data_stream/sysmetric/manifest.yml +++ b/packages/oracle/data_stream/sysmetric/manifest.yml @@ -30,5 +30,13 @@ streams: show_user: false default: - oracle_sysmetrics + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/oracle/data_stream/system_statistics/agent/stream/stream.yml.hbs b/packages/oracle/data_stream/system_statistics/agent/stream/stream.yml.hbs index 5231d2fb1dc..2fa35dcc52c 100644 --- a/packages/oracle/data_stream/system_statistics/agent/stream/stream.yml.hbs +++ b/packages/oracle/data_stream/system_statistics/agent/stream/stream.yml.hbs @@ -87,4 +87,8 @@ sql_queries: 'java call heap live size', 'java call heap total size', 'java call heap used size') - response_format: variables \ No newline at end of file + response_format: variables +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/oracle/data_stream/system_statistics/manifest.yml b/packages/oracle/data_stream/system_statistics/manifest.yml index 3dda51faf34..e7265d2b016 100644 --- a/packages/oracle/data_stream/system_statistics/manifest.yml +++ b/packages/oracle/data_stream/system_statistics/manifest.yml @@ -21,5 +21,13 @@ streams: show_user: false default: - oracle_system_statistics_metrics + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/oracle/data_stream/tablespace/agent/stream/stream.yml.hbs b/packages/oracle/data_stream/tablespace/agent/stream/stream.yml.hbs index 3ca99fcfa65..4c3881b64bd 100644 --- a/packages/oracle/data_stream/tablespace/agent/stream/stream.yml.hbs +++ b/packages/oracle/data_stream/tablespace/agent/stream/stream.yml.hbs @@ -91,4 +91,7 @@ SELECT file_name, over() AS TOTAL_BYTES FROM details" response_format: table - +{{#if processors}} +processors: +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/oracle/data_stream/tablespace/manifest.yml b/packages/oracle/data_stream/tablespace/manifest.yml index 173e8791a47..57c133d7c41 100644 --- a/packages/oracle/data_stream/tablespace/manifest.yml +++ b/packages/oracle/data_stream/tablespace/manifest.yml @@ -22,5 +22,13 @@ streams: show_user: false default: - oracle_tablespace + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. elasticsearch: - index_mode: "time_series" \ No newline at end of file + index_mode: "time_series" diff --git a/packages/oracle/manifest.yml b/packages/oracle/manifest.yml index 9b9012ea1ed..8f2e7740f29 100644 --- a/packages/oracle/manifest.yml +++ b/packages/oracle/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: oracle title: "Oracle" -version: "1.19.0" +version: "1.20.2" license: basic description: Collect Oracle Audit Log, Performance metrics, Tablespace metrics, Sysmetrics metrics, System statistics metrics, memory metrics from Oracle database. type: integration diff --git a/packages/oracle_weblogic/changelog.yml b/packages/oracle_weblogic/changelog.yml index 939227880ce..28ff31a035d 100644 --- a/packages/oracle_weblogic/changelog.yml +++ b/packages/oracle_weblogic/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.0.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 - version: "1.0.0" changes: - description: Make Oracle Weblogic GA diff --git a/packages/oracle_weblogic/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 8ae0053aba1..a61093b849c 100644 --- a/packages/oracle_weblogic/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -35,7 +35,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - dissect: field: event.original pattern: '%{oracle_weblogic.access.host_address} %{} %{oracle_weblogic.access.authuser} [%{@timestamp}] "%{http.request.method} diff --git a/packages/oracle_weblogic/data_stream/admin_server/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/admin_server/elasticsearch/ingest_pipeline/default.yml index 760bca090e4..9b1453818c1 100644 --- a/packages/oracle_weblogic/data_stream/admin_server/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/admin_server/elasticsearch/ingest_pipeline/default.yml @@ -35,7 +35,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - dissect: field: event.original pattern: "####<%{@timestamp}> <%{log.level}> <%{oracle_weblogic.admin_server.subsystem}> <%{oracle_weblogic.admin_server.machine_name}> diff --git a/packages/oracle_weblogic/data_stream/deployed_application/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/deployed_application/elasticsearch/ingest_pipeline/default.yml index 056a9980312..034b92b3bf5 100644 --- a/packages/oracle_weblogic/data_stream/deployed_application/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/deployed_application/elasticsearch/ingest_pipeline/default.yml @@ -9,6 +9,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - rename: field: jolokia.metrics target_field: oracle_weblogic diff --git a/packages/oracle_weblogic/data_stream/domain/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/domain/elasticsearch/ingest_pipeline/default.yml index 493ad27ca57..006fafafc44 100644 --- a/packages/oracle_weblogic/data_stream/domain/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/domain/elasticsearch/ingest_pipeline/default.yml @@ -35,7 +35,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - dissect: field: event.original pattern: "####<%{@timestamp}> <%{log.level}> <%{oracle_weblogic.domain.subsystem}> <%{oracle_weblogic.domain.machine_name}> diff --git a/packages/oracle_weblogic/data_stream/managed_server/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/managed_server/elasticsearch/ingest_pipeline/default.yml index f77cb0317d8..1dd9fe83ab6 100644 --- a/packages/oracle_weblogic/data_stream/managed_server/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/managed_server/elasticsearch/ingest_pipeline/default.yml @@ -35,7 +35,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - dissect: field: event.original pattern: "####<%{@timestamp}> <%{log.level}> <%{oracle_weblogic.managed_server.subsystem}> <%{oracle_weblogic.managed_server.machine_name}> diff --git a/packages/oracle_weblogic/data_stream/threadpool/elasticsearch/ingest_pipeline/default.yml b/packages/oracle_weblogic/data_stream/threadpool/elasticsearch/ingest_pipeline/default.yml index 56992a437fd..72a1b719583 100644 --- a/packages/oracle_weblogic/data_stream/threadpool/elasticsearch/ingest_pipeline/default.yml +++ b/packages/oracle_weblogic/data_stream/threadpool/elasticsearch/ingest_pipeline/default.yml @@ -9,6 +9,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - rename: field: jolokia.metrics target_field: oracle_weblogic diff --git a/packages/oracle_weblogic/manifest.yml b/packages/oracle_weblogic/manifest.yml index addaaa5a34d..52e3ba1862c 100644 --- a/packages/oracle_weblogic/manifest.yml +++ b/packages/oracle_weblogic/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: oracle_weblogic title: Oracle WebLogic -version: "1.0.0" +version: "1.0.1" license: basic description: Collect logs and metrics from Oracle WebLogic with Elastic Agent. type: integration diff --git a/packages/osquery/_dev/build/build.yml b/packages/osquery/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/osquery/_dev/build/build.yml +++ b/packages/osquery/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/osquery/changelog.yml b/packages/osquery/changelog.yml index 8f17c1896c5..d58e97a9394 100644 --- a/packages/osquery/changelog.yml +++ b/packages/osquery/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.12.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6826 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/osquery/data_stream/result/_dev/test/pipeline/test-osquery.log-expected.json b/packages/osquery/data_stream/result/_dev/test/pipeline/test-osquery.log-expected.json index f3eccc9c219..82eddab843d 100644 --- a/packages/osquery/data_stream/result/_dev/test/pipeline/test-osquery.log-expected.json +++ b/packages/osquery/data_stream/result/_dev/test/pipeline/test-osquery.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed", @@ -69,7 +69,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129,7 +129,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -189,7 +189,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -249,7 +249,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -309,7 +309,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -369,7 +369,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -429,7 +429,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -489,7 +489,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -549,7 +549,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -609,7 +609,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -669,7 +669,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -729,7 +729,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -789,7 +789,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -849,7 +849,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -909,7 +909,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -969,7 +969,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1029,7 +1029,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1089,7 +1089,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1149,7 +1149,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1209,7 +1209,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1269,7 +1269,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1329,7 +1329,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1389,7 +1389,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1449,7 +1449,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1509,7 +1509,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1569,7 +1569,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1629,7 +1629,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1689,7 +1689,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1749,7 +1749,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1809,7 +1809,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1869,7 +1869,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1929,7 +1929,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -1989,7 +1989,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2049,7 +2049,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2109,7 +2109,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2169,7 +2169,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2229,7 +2229,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2289,7 +2289,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2349,7 +2349,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2409,7 +2409,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2469,7 +2469,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2529,7 +2529,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2589,7 +2589,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2649,7 +2649,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2709,7 +2709,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2769,7 +2769,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2829,7 +2829,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2889,7 +2889,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -2949,7 +2949,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3009,7 +3009,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3069,7 +3069,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3129,7 +3129,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3189,7 +3189,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3249,7 +3249,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3309,7 +3309,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3369,7 +3369,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3429,7 +3429,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3489,7 +3489,7 @@ { "@timestamp": "2018-01-08T14:51:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3549,7 +3549,7 @@ { "@timestamp": "2018-01-08T17:06:29.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3631,7 +3631,7 @@ { "@timestamp": "2018-01-08T17:19:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3713,7 +3713,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3768,7 +3768,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3823,7 +3823,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3878,7 +3878,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3933,7 +3933,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -3988,7 +3988,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4043,7 +4043,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4098,7 +4098,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4155,7 +4155,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4212,7 +4212,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4269,7 +4269,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4326,7 +4326,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4383,7 +4383,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4440,7 +4440,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4497,7 +4497,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4554,7 +4554,7 @@ { "@timestamp": "2017-12-28T14:39:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4611,7 +4611,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4692,7 +4692,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4770,7 +4770,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4848,7 +4848,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -4926,7 +4926,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5004,7 +5004,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5082,7 +5082,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5160,7 +5160,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5238,7 +5238,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5316,7 +5316,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5394,7 +5394,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5472,7 +5472,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5550,7 +5550,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5631,7 +5631,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5688,7 +5688,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5745,7 +5745,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5802,7 +5802,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5859,7 +5859,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5916,7 +5916,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -5973,7 +5973,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6030,7 +6030,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6087,7 +6087,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6144,7 +6144,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6201,7 +6201,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6258,7 +6258,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6315,7 +6315,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6372,7 +6372,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6429,7 +6429,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6486,7 +6486,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6543,7 +6543,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6600,7 +6600,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6657,7 +6657,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6714,7 +6714,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6771,7 +6771,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6828,7 +6828,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6885,7 +6885,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6942,7 +6942,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -6999,7 +6999,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7056,7 +7056,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7113,7 +7113,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7170,7 +7170,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7227,7 +7227,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7284,7 +7284,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7341,7 +7341,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7398,7 +7398,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7455,7 +7455,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7512,7 +7512,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7569,7 +7569,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7626,7 +7626,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7683,7 +7683,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7740,7 +7740,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7797,7 +7797,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7854,7 +7854,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7911,7 +7911,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -7968,7 +7968,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8025,7 +8025,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8082,7 +8082,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8139,7 +8139,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8196,7 +8196,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8253,7 +8253,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8310,7 +8310,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8367,7 +8367,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8424,7 +8424,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8481,7 +8481,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8538,7 +8538,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8595,7 +8595,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8652,7 +8652,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8709,7 +8709,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8766,7 +8766,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8823,7 +8823,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8880,7 +8880,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8937,7 +8937,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -8994,7 +8994,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9051,7 +9051,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9108,7 +9108,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9165,7 +9165,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9222,7 +9222,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9279,7 +9279,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9336,7 +9336,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9393,7 +9393,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9450,7 +9450,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9507,7 +9507,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9564,7 +9564,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9621,7 +9621,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9678,7 +9678,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9737,7 +9737,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9796,7 +9796,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9856,7 +9856,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9916,7 +9916,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -9976,7 +9976,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10035,7 +10035,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10094,7 +10094,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10152,7 +10152,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10210,7 +10210,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10269,7 +10269,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10328,7 +10328,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10386,7 +10386,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10447,7 +10447,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10505,7 +10505,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10564,7 +10564,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10623,7 +10623,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10681,7 +10681,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10739,7 +10739,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10797,7 +10797,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10856,7 +10856,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10915,7 +10915,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -10974,7 +10974,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11032,7 +11032,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11091,7 +11091,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11150,7 +11150,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11209,7 +11209,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11267,7 +11267,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11325,7 +11325,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11383,7 +11383,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11441,7 +11441,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11499,7 +11499,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11559,7 +11559,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11619,7 +11619,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11678,7 +11678,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11736,7 +11736,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11795,7 +11795,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11855,7 +11855,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11914,7 +11914,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -11972,7 +11972,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12032,7 +12032,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12092,7 +12092,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12151,7 +12151,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12211,7 +12211,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12270,7 +12270,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12329,7 +12329,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12388,7 +12388,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12447,7 +12447,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12506,7 +12506,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12565,7 +12565,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12623,7 +12623,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12681,7 +12681,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12740,7 +12740,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12801,7 +12801,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12860,7 +12860,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12918,7 +12918,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -12976,7 +12976,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13034,7 +13034,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13092,7 +13092,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13153,7 +13153,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13211,7 +13211,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13269,7 +13269,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13327,7 +13327,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13385,7 +13385,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13443,7 +13443,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13503,7 +13503,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13562,7 +13562,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13620,7 +13620,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13678,7 +13678,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13737,7 +13737,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13796,7 +13796,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13855,7 +13855,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13915,7 +13915,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -13974,7 +13974,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14034,7 +14034,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14092,7 +14092,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14151,7 +14151,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14211,7 +14211,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14270,7 +14270,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14329,7 +14329,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14387,7 +14387,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14445,7 +14445,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14506,7 +14506,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14565,7 +14565,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14624,7 +14624,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14682,7 +14682,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14740,7 +14740,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14799,7 +14799,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14858,7 +14858,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14916,7 +14916,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -14974,7 +14974,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15033,7 +15033,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15093,7 +15093,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15153,7 +15153,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15211,7 +15211,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15271,7 +15271,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15332,7 +15332,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15392,7 +15392,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15452,7 +15452,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15510,7 +15510,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15570,7 +15570,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15630,7 +15630,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15688,7 +15688,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15747,7 +15747,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15806,7 +15806,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15864,7 +15864,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15924,7 +15924,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -15983,7 +15983,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16044,7 +16044,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16104,7 +16104,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16164,7 +16164,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16223,7 +16223,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16282,7 +16282,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16340,7 +16340,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16398,7 +16398,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16457,7 +16457,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16515,7 +16515,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16573,7 +16573,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16633,7 +16633,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16691,7 +16691,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16752,7 +16752,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16811,7 +16811,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16869,7 +16869,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16928,7 +16928,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -16987,7 +16987,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17046,7 +17046,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17105,7 +17105,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17164,7 +17164,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17223,7 +17223,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17281,7 +17281,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17340,7 +17340,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17401,7 +17401,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17461,7 +17461,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17520,7 +17520,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17579,7 +17579,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17638,7 +17638,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17696,7 +17696,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17756,7 +17756,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17815,7 +17815,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17874,7 +17874,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17932,7 +17932,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -17991,7 +17991,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18049,7 +18049,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18107,7 +18107,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18166,7 +18166,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18226,7 +18226,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18285,7 +18285,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18346,7 +18346,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18404,7 +18404,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18464,7 +18464,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18523,7 +18523,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18581,7 +18581,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18639,7 +18639,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18699,7 +18699,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18759,7 +18759,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18817,7 +18817,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18878,7 +18878,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18937,7 +18937,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -18998,7 +18998,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19058,7 +19058,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19116,7 +19116,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19174,7 +19174,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19233,7 +19233,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19293,7 +19293,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19351,7 +19351,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19410,7 +19410,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19470,7 +19470,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19528,7 +19528,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19587,7 +19587,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19645,7 +19645,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19705,7 +19705,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19761,7 +19761,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19819,7 +19819,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19879,7 +19879,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19938,7 +19938,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -19996,7 +19996,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20055,7 +20055,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20117,7 +20117,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20175,7 +20175,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20235,7 +20235,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20295,7 +20295,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20354,7 +20354,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20412,7 +20412,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20470,7 +20470,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20530,7 +20530,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20588,7 +20588,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20647,7 +20647,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20706,7 +20706,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20764,7 +20764,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20824,7 +20824,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20882,7 +20882,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20940,7 +20940,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -20999,7 +20999,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21057,7 +21057,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21115,7 +21115,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21175,7 +21175,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21233,7 +21233,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21292,7 +21292,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21350,7 +21350,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21408,7 +21408,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21466,7 +21466,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21524,7 +21524,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21583,7 +21583,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21641,7 +21641,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21700,7 +21700,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21759,7 +21759,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21817,7 +21817,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21875,7 +21875,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21935,7 +21935,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -21993,7 +21993,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22053,7 +22053,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22113,7 +22113,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22173,7 +22173,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22231,7 +22231,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22289,7 +22289,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22349,7 +22349,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22407,7 +22407,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22468,7 +22468,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22529,7 +22529,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22587,7 +22587,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22647,7 +22647,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22706,7 +22706,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22765,7 +22765,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22823,7 +22823,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22881,7 +22881,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -22939,7 +22939,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23001,7 +23001,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23059,7 +23059,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23117,7 +23117,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23177,7 +23177,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23236,7 +23236,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23295,7 +23295,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23353,7 +23353,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23412,7 +23412,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23471,7 +23471,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23531,7 +23531,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23591,7 +23591,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23651,7 +23651,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23709,7 +23709,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23768,7 +23768,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23828,7 +23828,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23887,7 +23887,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -23945,7 +23945,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24004,7 +24004,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24062,7 +24062,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24122,7 +24122,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24181,7 +24181,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24239,7 +24239,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24299,7 +24299,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24358,7 +24358,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24416,7 +24416,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24475,7 +24475,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24534,7 +24534,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24592,7 +24592,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24652,7 +24652,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24710,7 +24710,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24769,7 +24769,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24828,7 +24828,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24887,7 +24887,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -24946,7 +24946,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25005,7 +25005,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25064,7 +25064,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25123,7 +25123,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25181,7 +25181,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25241,7 +25241,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25300,7 +25300,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25359,7 +25359,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25417,7 +25417,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25475,7 +25475,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25533,7 +25533,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25591,7 +25591,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25649,7 +25649,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25708,7 +25708,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25767,7 +25767,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25826,7 +25826,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25888,7 +25888,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -25947,7 +25947,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26005,7 +26005,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26064,7 +26064,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26122,7 +26122,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26180,7 +26180,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26238,7 +26238,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26298,7 +26298,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26356,7 +26356,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26415,7 +26415,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26473,7 +26473,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26531,7 +26531,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26589,7 +26589,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26648,7 +26648,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26707,7 +26707,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26769,7 +26769,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26828,7 +26828,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26887,7 +26887,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -26945,7 +26945,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27003,7 +27003,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27062,7 +27062,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27121,7 +27121,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27179,7 +27179,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27238,7 +27238,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27297,7 +27297,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27356,7 +27356,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27418,7 +27418,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27477,7 +27477,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27536,7 +27536,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27594,7 +27594,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27653,7 +27653,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27711,7 +27711,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27770,7 +27770,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27829,7 +27829,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27887,7 +27887,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -27945,7 +27945,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28003,7 +28003,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28062,7 +28062,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28120,7 +28120,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28179,7 +28179,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28241,7 +28241,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28302,7 +28302,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28362,7 +28362,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28422,7 +28422,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28481,7 +28481,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28542,7 +28542,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28601,7 +28601,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28660,7 +28660,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28720,7 +28720,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28781,7 +28781,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28840,7 +28840,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28902,7 +28902,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -28961,7 +28961,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29021,7 +29021,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29082,7 +29082,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29141,7 +29141,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29200,7 +29200,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29260,7 +29260,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29319,7 +29319,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29378,7 +29378,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29438,7 +29438,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29498,7 +29498,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29559,7 +29559,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29617,7 +29617,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29675,7 +29675,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29734,7 +29734,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29792,7 +29792,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29850,7 +29850,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29908,7 +29908,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -29966,7 +29966,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30026,7 +30026,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30084,7 +30084,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30142,7 +30142,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30200,7 +30200,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30259,7 +30259,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30318,7 +30318,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30378,7 +30378,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30438,7 +30438,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30496,7 +30496,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30554,7 +30554,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30612,7 +30612,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30670,7 +30670,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30728,7 +30728,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30786,7 +30786,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30844,7 +30844,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30902,7 +30902,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -30960,7 +30960,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31019,7 +31019,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31078,7 +31078,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31137,7 +31137,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31195,7 +31195,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31254,7 +31254,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31314,7 +31314,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31373,7 +31373,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31432,7 +31432,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31490,7 +31490,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31548,7 +31548,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31607,7 +31607,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31668,7 +31668,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31726,7 +31726,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31784,7 +31784,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31842,7 +31842,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31900,7 +31900,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -31958,7 +31958,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32016,7 +32016,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32075,7 +32075,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32135,7 +32135,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32193,7 +32193,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32253,7 +32253,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32313,7 +32313,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32372,7 +32372,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32431,7 +32431,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32490,7 +32490,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32549,7 +32549,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32608,7 +32608,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32667,7 +32667,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32726,7 +32726,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32787,7 +32787,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32845,7 +32845,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32904,7 +32904,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -32963,7 +32963,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33022,7 +33022,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33082,7 +33082,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33142,7 +33142,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33201,7 +33201,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33260,7 +33260,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33319,7 +33319,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33377,7 +33377,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33435,7 +33435,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33494,7 +33494,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33553,7 +33553,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33611,7 +33611,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33671,7 +33671,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33731,7 +33731,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33792,7 +33792,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33851,7 +33851,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33910,7 +33910,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -33969,7 +33969,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34029,7 +34029,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34090,7 +34090,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34149,7 +34149,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34208,7 +34208,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34267,7 +34267,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34326,7 +34326,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34384,7 +34384,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34442,7 +34442,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34502,7 +34502,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34561,7 +34561,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34619,7 +34619,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34679,7 +34679,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34737,7 +34737,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34795,7 +34795,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34853,7 +34853,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34912,7 +34912,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -34970,7 +34970,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35030,7 +35030,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35089,7 +35089,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35147,7 +35147,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35205,7 +35205,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35263,7 +35263,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35321,7 +35321,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35381,7 +35381,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35440,7 +35440,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35499,7 +35499,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35558,7 +35558,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35617,7 +35617,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35676,7 +35676,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35734,7 +35734,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35792,7 +35792,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35851,7 +35851,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35909,7 +35909,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -35967,7 +35967,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36025,7 +36025,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36083,7 +36083,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36141,7 +36141,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36199,7 +36199,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36258,7 +36258,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36316,7 +36316,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36378,7 +36378,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36436,7 +36436,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36494,7 +36494,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36553,7 +36553,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36612,7 +36612,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36671,7 +36671,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36730,7 +36730,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36789,7 +36789,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36848,7 +36848,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36906,7 +36906,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -36964,7 +36964,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37022,7 +37022,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37081,7 +37081,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37140,7 +37140,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37198,7 +37198,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37256,7 +37256,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37314,7 +37314,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37372,7 +37372,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37430,7 +37430,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37488,7 +37488,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37546,7 +37546,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37604,7 +37604,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37662,7 +37662,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37720,7 +37720,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37778,7 +37778,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37836,7 +37836,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37894,7 +37894,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -37952,7 +37952,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38010,7 +38010,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38068,7 +38068,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38129,7 +38129,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38187,7 +38187,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38245,7 +38245,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38304,7 +38304,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38363,7 +38363,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38423,7 +38423,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38481,7 +38481,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38539,7 +38539,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38597,7 +38597,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38655,7 +38655,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38713,7 +38713,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38771,7 +38771,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38829,7 +38829,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38888,7 +38888,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -38946,7 +38946,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39008,7 +39008,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39066,7 +39066,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39124,7 +39124,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39183,7 +39183,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39241,7 +39241,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39299,7 +39299,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39357,7 +39357,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39415,7 +39415,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39473,7 +39473,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39533,7 +39533,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39591,7 +39591,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39649,7 +39649,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39707,7 +39707,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39766,7 +39766,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39825,7 +39825,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39884,7 +39884,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -39943,7 +39943,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40004,7 +40004,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40063,7 +40063,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40121,7 +40121,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40181,7 +40181,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40239,7 +40239,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40297,7 +40297,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40355,7 +40355,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40413,7 +40413,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40471,7 +40471,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40530,7 +40530,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40588,7 +40588,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40646,7 +40646,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40704,7 +40704,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40762,7 +40762,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40820,7 +40820,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40878,7 +40878,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40936,7 +40936,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -40994,7 +40994,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41054,7 +41054,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41112,7 +41112,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41170,7 +41170,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41228,7 +41228,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41286,7 +41286,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41345,7 +41345,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41403,7 +41403,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41462,7 +41462,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41520,7 +41520,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41578,7 +41578,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41637,7 +41637,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41696,7 +41696,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41755,7 +41755,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41814,7 +41814,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41872,7 +41872,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41931,7 +41931,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -41989,7 +41989,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42047,7 +42047,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42105,7 +42105,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42163,7 +42163,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42221,7 +42221,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42280,7 +42280,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42339,7 +42339,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42397,7 +42397,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42455,7 +42455,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42513,7 +42513,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42572,7 +42572,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42631,7 +42631,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42691,7 +42691,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42751,7 +42751,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42810,7 +42810,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42869,7 +42869,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42927,7 +42927,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -42986,7 +42986,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43045,7 +43045,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43104,7 +43104,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43162,7 +43162,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43220,7 +43220,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43280,7 +43280,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43339,7 +43339,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43397,7 +43397,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43456,7 +43456,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43516,7 +43516,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43577,7 +43577,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43636,7 +43636,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43694,7 +43694,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43752,7 +43752,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43810,7 +43810,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43868,7 +43868,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43930,7 +43930,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -43988,7 +43988,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44048,7 +44048,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44108,7 +44108,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44169,7 +44169,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44228,7 +44228,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44286,7 +44286,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44344,7 +44344,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44403,7 +44403,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44462,7 +44462,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44520,7 +44520,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44578,7 +44578,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44636,7 +44636,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44694,7 +44694,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44752,7 +44752,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44810,7 +44810,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44868,7 +44868,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44926,7 +44926,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -44984,7 +44984,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45042,7 +45042,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45100,7 +45100,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45159,7 +45159,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45217,7 +45217,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45276,7 +45276,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45334,7 +45334,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45392,7 +45392,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45451,7 +45451,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45510,7 +45510,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45569,7 +45569,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45627,7 +45627,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45685,7 +45685,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45744,7 +45744,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45803,7 +45803,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45863,7 +45863,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45922,7 +45922,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -45980,7 +45980,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46040,7 +46040,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46098,7 +46098,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46156,7 +46156,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46215,7 +46215,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46274,7 +46274,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46332,7 +46332,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46390,7 +46390,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46448,7 +46448,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46508,7 +46508,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46567,7 +46567,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46627,7 +46627,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46687,7 +46687,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46747,7 +46747,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46806,7 +46806,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46867,7 +46867,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46927,7 +46927,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -46988,7 +46988,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47049,7 +47049,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47111,7 +47111,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47170,7 +47170,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47232,7 +47232,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47294,7 +47294,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47356,7 +47356,7 @@ { "@timestamp": "2017-12-28T14:39:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47416,7 +47416,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47472,7 +47472,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47528,7 +47528,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47584,7 +47584,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47640,7 +47640,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47696,7 +47696,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47752,7 +47752,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47808,7 +47808,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47864,7 +47864,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47920,7 +47920,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -47973,7 +47973,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48027,7 +48027,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48081,7 +48081,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48135,7 +48135,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48196,7 +48196,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48250,7 +48250,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48304,7 +48304,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48358,7 +48358,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48426,7 +48426,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48494,7 +48494,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48563,7 +48563,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48631,7 +48631,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48700,7 +48700,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48769,7 +48769,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48839,7 +48839,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48908,7 +48908,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -48977,7 +48977,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49045,7 +49045,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49115,7 +49115,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49183,7 +49183,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49253,7 +49253,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49320,7 +49320,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49387,7 +49387,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49455,7 +49455,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49525,7 +49525,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49594,7 +49594,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49664,7 +49664,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49732,7 +49732,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49801,7 +49801,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49869,7 +49869,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -49938,7 +49938,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50007,7 +50007,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50075,7 +50075,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50144,7 +50144,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50210,7 +50210,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50278,7 +50278,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50348,7 +50348,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50417,7 +50417,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50484,7 +50484,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50553,7 +50553,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50622,7 +50622,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50691,7 +50691,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50761,7 +50761,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50829,7 +50829,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50899,7 +50899,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -50969,7 +50969,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51038,7 +51038,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51106,7 +51106,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51175,7 +51175,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51244,7 +51244,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51313,7 +51313,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51379,7 +51379,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51446,7 +51446,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51513,7 +51513,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51574,7 +51574,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51640,7 +51640,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51708,7 +51708,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51778,7 +51778,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51847,7 +51847,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51914,7 +51914,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -51984,7 +51984,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52052,7 +52052,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52122,7 +52122,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52191,7 +52191,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52259,7 +52259,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52328,7 +52328,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52397,7 +52397,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52465,7 +52465,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52534,7 +52534,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52601,7 +52601,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52671,7 +52671,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52740,7 +52740,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52808,7 +52808,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52878,7 +52878,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -52948,7 +52948,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53017,7 +53017,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53084,7 +53084,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53149,7 +53149,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53218,7 +53218,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53287,7 +53287,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53356,7 +53356,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53426,7 +53426,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53494,7 +53494,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53563,7 +53563,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53629,7 +53629,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53695,7 +53695,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53762,7 +53762,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53829,7 +53829,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53896,7 +53896,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -53962,7 +53962,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54027,7 +54027,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54095,7 +54095,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54161,7 +54161,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54227,7 +54227,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54293,7 +54293,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54358,7 +54358,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54425,7 +54425,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54492,7 +54492,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54553,7 +54553,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54614,7 +54614,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54675,7 +54675,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54736,7 +54736,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54797,7 +54797,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54858,7 +54858,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54919,7 +54919,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -54980,7 +54980,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55046,7 +55046,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55112,7 +55112,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55179,7 +55179,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55246,7 +55246,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55312,7 +55312,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55380,7 +55380,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55448,7 +55448,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55513,7 +55513,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55581,7 +55581,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55647,7 +55647,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55716,7 +55716,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55783,7 +55783,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55848,7 +55848,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55916,7 +55916,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -55984,7 +55984,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56052,7 +56052,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56121,7 +56121,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56190,7 +56190,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56259,7 +56259,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56326,7 +56326,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56394,7 +56394,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56463,7 +56463,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56530,7 +56530,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56599,7 +56599,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56668,7 +56668,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56735,7 +56735,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56801,7 +56801,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56869,7 +56869,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -56938,7 +56938,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57005,7 +57005,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57071,7 +57071,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57139,7 +57139,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57208,7 +57208,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57276,7 +57276,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57343,7 +57343,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57411,7 +57411,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57478,7 +57478,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57545,7 +57545,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57612,7 +57612,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57679,7 +57679,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57746,7 +57746,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57813,7 +57813,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57880,7 +57880,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -57948,7 +57948,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58015,7 +58015,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58085,7 +58085,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58155,7 +58155,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58221,7 +58221,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58290,7 +58290,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58358,7 +58358,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58425,7 +58425,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58491,7 +58491,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58558,7 +58558,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58626,7 +58626,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58691,7 +58691,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58757,7 +58757,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58824,7 +58824,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58891,7 +58891,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -58959,7 +58959,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59026,7 +59026,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59093,7 +59093,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59159,7 +59159,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59228,7 +59228,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59296,7 +59296,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59363,7 +59363,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59432,7 +59432,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59500,7 +59500,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59568,7 +59568,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59636,7 +59636,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59704,7 +59704,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59772,7 +59772,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59842,7 +59842,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59909,7 +59909,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -59975,7 +59975,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60042,7 +60042,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60109,7 +60109,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60175,7 +60175,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60242,7 +60242,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60307,7 +60307,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60374,7 +60374,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60442,7 +60442,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60510,7 +60510,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60577,7 +60577,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60645,7 +60645,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60712,7 +60712,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60780,7 +60780,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60850,7 +60850,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60917,7 +60917,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -60984,7 +60984,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61052,7 +61052,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61118,7 +61118,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61186,7 +61186,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61252,7 +61252,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61316,7 +61316,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61384,7 +61384,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61454,7 +61454,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61522,7 +61522,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61590,7 +61590,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61657,7 +61657,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61724,7 +61724,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61791,7 +61791,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61857,7 +61857,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61923,7 +61923,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -61990,7 +61990,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62057,7 +62057,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62124,7 +62124,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62190,7 +62190,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62258,7 +62258,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62325,7 +62325,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62392,7 +62392,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62460,7 +62460,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62527,7 +62527,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62594,7 +62594,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62660,7 +62660,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62726,7 +62726,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62792,7 +62792,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62858,7 +62858,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62925,7 +62925,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -62991,7 +62991,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63057,7 +63057,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63123,7 +63123,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63189,7 +63189,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63255,7 +63255,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63321,7 +63321,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63387,7 +63387,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63453,7 +63453,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63519,7 +63519,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63585,7 +63585,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63651,7 +63651,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63717,7 +63717,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63786,7 +63786,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63853,7 +63853,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63920,7 +63920,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -63986,7 +63986,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64052,7 +64052,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64119,7 +64119,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64186,7 +64186,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64253,7 +64253,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64321,7 +64321,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64387,7 +64387,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64453,7 +64453,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64519,7 +64519,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64586,7 +64586,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64653,7 +64653,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64720,7 +64720,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64786,7 +64786,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64852,7 +64852,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64919,7 +64919,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -64985,7 +64985,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65053,7 +65053,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65120,7 +65120,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65187,7 +65187,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65255,7 +65255,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65322,7 +65322,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65390,7 +65390,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65458,7 +65458,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65526,7 +65526,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65592,7 +65592,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65657,7 +65657,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65722,7 +65722,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65790,7 +65790,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65857,7 +65857,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65922,7 +65922,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -65990,7 +65990,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66058,7 +66058,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66125,7 +66125,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66190,7 +66190,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66255,7 +66255,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66320,7 +66320,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66386,7 +66386,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66451,7 +66451,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66516,7 +66516,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66583,7 +66583,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66648,7 +66648,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66713,7 +66713,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66781,7 +66781,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66847,7 +66847,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66914,7 +66914,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -66980,7 +66980,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67047,7 +67047,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67116,7 +67116,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67184,7 +67184,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67252,7 +67252,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67321,7 +67321,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67389,7 +67389,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67457,7 +67457,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67525,7 +67525,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67592,7 +67592,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67657,7 +67657,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67724,7 +67724,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67791,7 +67791,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67856,7 +67856,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67922,7 +67922,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -67987,7 +67987,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68055,7 +68055,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68122,7 +68122,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68190,7 +68190,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68258,7 +68258,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68324,7 +68324,7 @@ { "@timestamp": "2017-12-28T14:39:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68390,7 +68390,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68451,7 +68451,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68511,7 +68511,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68572,7 +68572,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68633,7 +68633,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68694,7 +68694,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68755,7 +68755,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68815,7 +68815,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68875,7 +68875,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68935,7 +68935,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -68995,7 +68995,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69055,7 +69055,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69115,7 +69115,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69175,7 +69175,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69235,7 +69235,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69295,7 +69295,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69355,7 +69355,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69415,7 +69415,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69475,7 +69475,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69535,7 +69535,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69595,7 +69595,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69655,7 +69655,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69715,7 +69715,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69775,7 +69775,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69835,7 +69835,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69895,7 +69895,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -69955,7 +69955,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70015,7 +70015,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70075,7 +70075,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70135,7 +70135,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70195,7 +70195,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70255,7 +70255,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70315,7 +70315,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70375,7 +70375,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70435,7 +70435,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70495,7 +70495,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70555,7 +70555,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70615,7 +70615,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70675,7 +70675,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70735,7 +70735,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70795,7 +70795,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70855,7 +70855,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70915,7 +70915,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -70975,7 +70975,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71035,7 +71035,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71096,7 +71096,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71156,7 +71156,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71216,7 +71216,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71276,7 +71276,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71336,7 +71336,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71396,7 +71396,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71456,7 +71456,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71516,7 +71516,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71576,7 +71576,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71636,7 +71636,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71696,7 +71696,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71756,7 +71756,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71816,7 +71816,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71876,7 +71876,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71936,7 +71936,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -71996,7 +71996,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72056,7 +72056,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72116,7 +72116,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72176,7 +72176,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72236,7 +72236,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72296,7 +72296,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72356,7 +72356,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72416,7 +72416,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72476,7 +72476,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72536,7 +72536,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72596,7 +72596,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72656,7 +72656,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72716,7 +72716,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72776,7 +72776,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72836,7 +72836,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72896,7 +72896,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -72956,7 +72956,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73016,7 +73016,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73077,7 +73077,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73137,7 +73137,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73197,7 +73197,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73257,7 +73257,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73317,7 +73317,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73377,7 +73377,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73437,7 +73437,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73497,7 +73497,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73557,7 +73557,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73617,7 +73617,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73678,7 +73678,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73739,7 +73739,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73799,7 +73799,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73859,7 +73859,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73919,7 +73919,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -73979,7 +73979,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74039,7 +74039,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74099,7 +74099,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74159,7 +74159,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74219,7 +74219,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74279,7 +74279,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74340,7 +74340,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74401,7 +74401,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74459,7 +74459,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74517,7 +74517,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74575,7 +74575,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74633,7 +74633,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74691,7 +74691,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74749,7 +74749,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74807,7 +74807,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74865,7 +74865,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74923,7 +74923,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -74981,7 +74981,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75039,7 +75039,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75097,7 +75097,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75155,7 +75155,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75213,7 +75213,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75271,7 +75271,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75329,7 +75329,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75387,7 +75387,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75445,7 +75445,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75503,7 +75503,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75561,7 +75561,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75619,7 +75619,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75677,7 +75677,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75735,7 +75735,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75793,7 +75793,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75851,7 +75851,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75909,7 +75909,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -75967,7 +75967,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76025,7 +76025,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76083,7 +76083,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76141,7 +76141,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76199,7 +76199,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76257,7 +76257,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76315,7 +76315,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76373,7 +76373,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76431,7 +76431,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76489,7 +76489,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76547,7 +76547,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76605,7 +76605,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76663,7 +76663,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76721,7 +76721,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76779,7 +76779,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76837,7 +76837,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76895,7 +76895,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -76953,7 +76953,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77011,7 +77011,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77069,7 +77069,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77127,7 +77127,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77185,7 +77185,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77243,7 +77243,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77301,7 +77301,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77359,7 +77359,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77417,7 +77417,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77475,7 +77475,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77533,7 +77533,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77591,7 +77591,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77649,7 +77649,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77707,7 +77707,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77765,7 +77765,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77823,7 +77823,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77881,7 +77881,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77939,7 +77939,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -77997,7 +77997,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78055,7 +78055,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78113,7 +78113,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78171,7 +78171,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78229,7 +78229,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78287,7 +78287,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78345,7 +78345,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78403,7 +78403,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78461,7 +78461,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78519,7 +78519,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78577,7 +78577,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78635,7 +78635,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78693,7 +78693,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78751,7 +78751,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78809,7 +78809,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78867,7 +78867,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78925,7 +78925,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -78983,7 +78983,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79041,7 +79041,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79099,7 +79099,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79157,7 +79157,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79215,7 +79215,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79273,7 +79273,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79331,7 +79331,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79389,7 +79389,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79447,7 +79447,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79505,7 +79505,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79563,7 +79563,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79621,7 +79621,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79679,7 +79679,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79737,7 +79737,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79795,7 +79795,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79853,7 +79853,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79911,7 +79911,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -79969,7 +79969,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80027,7 +80027,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80085,7 +80085,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80143,7 +80143,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80201,7 +80201,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80259,7 +80259,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80317,7 +80317,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80375,7 +80375,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80433,7 +80433,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80491,7 +80491,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80549,7 +80549,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80607,7 +80607,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80665,7 +80665,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80723,7 +80723,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80781,7 +80781,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80839,7 +80839,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80897,7 +80897,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -80955,7 +80955,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81013,7 +81013,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81071,7 +81071,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81129,7 +81129,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81187,7 +81187,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81245,7 +81245,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81303,7 +81303,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81361,7 +81361,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81419,7 +81419,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81477,7 +81477,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81535,7 +81535,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81593,7 +81593,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81651,7 +81651,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81709,7 +81709,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81767,7 +81767,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81825,7 +81825,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81883,7 +81883,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81941,7 +81941,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -81999,7 +81999,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82057,7 +82057,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82115,7 +82115,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82173,7 +82173,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82231,7 +82231,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82289,7 +82289,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82347,7 +82347,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82405,7 +82405,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82463,7 +82463,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82521,7 +82521,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82579,7 +82579,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82637,7 +82637,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82695,7 +82695,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82753,7 +82753,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82811,7 +82811,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82869,7 +82869,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82927,7 +82927,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -82985,7 +82985,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83043,7 +83043,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83101,7 +83101,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83159,7 +83159,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83217,7 +83217,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83275,7 +83275,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83333,7 +83333,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83391,7 +83391,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83449,7 +83449,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83507,7 +83507,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83565,7 +83565,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83623,7 +83623,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83681,7 +83681,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83739,7 +83739,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83797,7 +83797,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83855,7 +83855,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83913,7 +83913,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -83971,7 +83971,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84029,7 +84029,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84087,7 +84087,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84145,7 +84145,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84203,7 +84203,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84261,7 +84261,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84319,7 +84319,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84377,7 +84377,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84435,7 +84435,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84493,7 +84493,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84551,7 +84551,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84609,7 +84609,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84667,7 +84667,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84725,7 +84725,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84783,7 +84783,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84841,7 +84841,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84899,7 +84899,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -84957,7 +84957,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85015,7 +85015,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85073,7 +85073,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85131,7 +85131,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85189,7 +85189,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85247,7 +85247,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85305,7 +85305,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85363,7 +85363,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85421,7 +85421,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85479,7 +85479,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85537,7 +85537,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85595,7 +85595,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85653,7 +85653,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85711,7 +85711,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85769,7 +85769,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85827,7 +85827,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85885,7 +85885,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -85943,7 +85943,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86001,7 +86001,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86059,7 +86059,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86117,7 +86117,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86175,7 +86175,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86233,7 +86233,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86291,7 +86291,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86349,7 +86349,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86407,7 +86407,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86465,7 +86465,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86523,7 +86523,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86581,7 +86581,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86639,7 +86639,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86697,7 +86697,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86755,7 +86755,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86813,7 +86813,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86871,7 +86871,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86929,7 +86929,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -86987,7 +86987,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87045,7 +87045,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87103,7 +87103,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87161,7 +87161,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87219,7 +87219,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87277,7 +87277,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87335,7 +87335,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87393,7 +87393,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87451,7 +87451,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87509,7 +87509,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87567,7 +87567,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87625,7 +87625,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87683,7 +87683,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87741,7 +87741,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87799,7 +87799,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87857,7 +87857,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87915,7 +87915,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -87973,7 +87973,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88031,7 +88031,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88089,7 +88089,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88147,7 +88147,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88205,7 +88205,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88263,7 +88263,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88321,7 +88321,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88379,7 +88379,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88437,7 +88437,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88495,7 +88495,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88553,7 +88553,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88611,7 +88611,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88669,7 +88669,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88727,7 +88727,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88785,7 +88785,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88843,7 +88843,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88901,7 +88901,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -88959,7 +88959,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89017,7 +89017,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89075,7 +89075,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89133,7 +89133,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89191,7 +89191,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89249,7 +89249,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89307,7 +89307,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89365,7 +89365,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89423,7 +89423,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89481,7 +89481,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89539,7 +89539,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89597,7 +89597,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89655,7 +89655,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89713,7 +89713,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89771,7 +89771,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89829,7 +89829,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89887,7 +89887,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -89945,7 +89945,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90003,7 +90003,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90061,7 +90061,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90119,7 +90119,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90177,7 +90177,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90235,7 +90235,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90293,7 +90293,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90351,7 +90351,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90409,7 +90409,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90467,7 +90467,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90525,7 +90525,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90583,7 +90583,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90641,7 +90641,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90699,7 +90699,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90757,7 +90757,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90815,7 +90815,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90873,7 +90873,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90931,7 +90931,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -90989,7 +90989,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91047,7 +91047,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91105,7 +91105,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91163,7 +91163,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91221,7 +91221,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91279,7 +91279,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91337,7 +91337,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91395,7 +91395,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91453,7 +91453,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91511,7 +91511,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91569,7 +91569,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91627,7 +91627,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91685,7 +91685,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91743,7 +91743,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91800,7 +91800,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91857,7 +91857,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91914,7 +91914,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -91971,7 +91971,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92028,7 +92028,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92085,7 +92085,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92142,7 +92142,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92199,7 +92199,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92256,7 +92256,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92313,7 +92313,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92370,7 +92370,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92427,7 +92427,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92484,7 +92484,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92541,7 +92541,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92598,7 +92598,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92655,7 +92655,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92712,7 +92712,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92769,7 +92769,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92824,7 +92824,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92883,7 +92883,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -92943,7 +92943,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93003,7 +93003,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93063,7 +93063,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93123,7 +93123,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93183,7 +93183,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93243,7 +93243,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93303,7 +93303,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93363,7 +93363,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93423,7 +93423,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93483,7 +93483,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93543,7 +93543,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93603,7 +93603,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93663,7 +93663,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93723,7 +93723,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93783,7 +93783,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93843,7 +93843,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93903,7 +93903,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -93963,7 +93963,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94023,7 +94023,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94083,7 +94083,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94143,7 +94143,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94203,7 +94203,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94263,7 +94263,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94323,7 +94323,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94383,7 +94383,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94443,7 +94443,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94503,7 +94503,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94563,7 +94563,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94623,7 +94623,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94683,7 +94683,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94743,7 +94743,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94803,7 +94803,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94863,7 +94863,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94923,7 +94923,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -94983,7 +94983,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95043,7 +95043,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95103,7 +95103,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95163,7 +95163,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95223,7 +95223,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95283,7 +95283,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95343,7 +95343,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95403,7 +95403,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95463,7 +95463,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95523,7 +95523,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95583,7 +95583,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95643,7 +95643,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95703,7 +95703,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95763,7 +95763,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95823,7 +95823,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95883,7 +95883,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -95943,7 +95943,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96003,7 +96003,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96063,7 +96063,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96123,7 +96123,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96183,7 +96183,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96243,7 +96243,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96303,7 +96303,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96363,7 +96363,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96423,7 +96423,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96483,7 +96483,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96543,7 +96543,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96603,7 +96603,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96663,7 +96663,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96723,7 +96723,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96783,7 +96783,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96843,7 +96843,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96903,7 +96903,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -96963,7 +96963,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97023,7 +97023,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97083,7 +97083,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97143,7 +97143,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97203,7 +97203,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97263,7 +97263,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97323,7 +97323,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97383,7 +97383,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97443,7 +97443,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97503,7 +97503,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97563,7 +97563,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97623,7 +97623,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97683,7 +97683,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97743,7 +97743,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97803,7 +97803,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97863,7 +97863,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97923,7 +97923,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -97983,7 +97983,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98042,7 +98042,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98102,7 +98102,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98162,7 +98162,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98221,7 +98221,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98281,7 +98281,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98341,7 +98341,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98401,7 +98401,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98461,7 +98461,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98521,7 +98521,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98580,7 +98580,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98640,7 +98640,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98700,7 +98700,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98760,7 +98760,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98820,7 +98820,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98879,7 +98879,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98939,7 +98939,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -98999,7 +98999,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99059,7 +99059,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99119,7 +99119,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99179,7 +99179,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99238,7 +99238,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99297,7 +99297,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99357,7 +99357,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99417,7 +99417,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99476,7 +99476,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99535,7 +99535,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99595,7 +99595,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99655,7 +99655,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99715,7 +99715,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99775,7 +99775,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99835,7 +99835,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99895,7 +99895,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -99955,7 +99955,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100009,7 +100009,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100063,7 +100063,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100117,7 +100117,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100171,7 +100171,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100225,7 +100225,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100279,7 +100279,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100333,7 +100333,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100387,7 +100387,7 @@ { "@timestamp": "2017-12-28T14:39:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100441,7 +100441,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100499,7 +100499,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100572,7 +100572,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100646,7 +100646,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100719,7 +100719,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100793,7 +100793,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100866,7 +100866,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -100939,7 +100939,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101012,7 +101012,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101085,7 +101085,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101158,7 +101158,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101230,7 +101230,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101302,7 +101302,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101375,7 +101375,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101448,7 +101448,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101521,7 +101521,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101594,7 +101594,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101668,7 +101668,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101740,7 +101740,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101814,7 +101814,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101886,7 +101886,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -101959,7 +101959,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102031,7 +102031,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102103,7 +102103,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102175,7 +102175,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102247,7 +102247,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102320,7 +102320,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102392,7 +102392,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102464,7 +102464,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102536,7 +102536,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102609,7 +102609,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102682,7 +102682,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102755,7 +102755,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102827,7 +102827,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102900,7 +102900,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -102973,7 +102973,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103031,7 +103031,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103097,7 +103097,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103163,7 +103163,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103229,7 +103229,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103295,7 +103295,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103361,7 +103361,7 @@ { "@timestamp": "2017-12-28T14:39:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103437,7 +103437,7 @@ { "@timestamp": "2017-12-28T14:39:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103495,7 +103495,7 @@ { "@timestamp": "2017-12-28T14:39:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103555,7 +103555,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed", @@ -103621,7 +103621,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed", @@ -103687,7 +103687,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103753,7 +103753,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103819,7 +103819,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "removed", @@ -103895,7 +103895,7 @@ { "@timestamp": "2017-12-28T14:40:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -103971,7 +103971,7 @@ { "@timestamp": "2017-12-07T12:21:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104028,7 +104028,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104087,7 +104087,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104146,7 +104146,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104205,7 +104205,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104264,7 +104264,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104323,7 +104323,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104382,7 +104382,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104441,7 +104441,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104500,7 +104500,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104559,7 +104559,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104618,7 +104618,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104677,7 +104677,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104736,7 +104736,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104795,7 +104795,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104854,7 +104854,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104913,7 +104913,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -104972,7 +104972,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105031,7 +105031,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105090,7 +105090,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105149,7 +105149,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105208,7 +105208,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105267,7 +105267,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105326,7 +105326,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105385,7 +105385,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105444,7 +105444,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105503,7 +105503,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105562,7 +105562,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105621,7 +105621,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105680,7 +105680,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105739,7 +105739,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105798,7 +105798,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105857,7 +105857,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105916,7 +105916,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -105975,7 +105975,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106034,7 +106034,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106093,7 +106093,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106152,7 +106152,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106211,7 +106211,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106270,7 +106270,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106329,7 +106329,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106388,7 +106388,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106447,7 +106447,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106506,7 +106506,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106565,7 +106565,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106624,7 +106624,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106683,7 +106683,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106742,7 +106742,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106801,7 +106801,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106860,7 +106860,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106919,7 +106919,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -106978,7 +106978,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107037,7 +107037,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107096,7 +107096,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107155,7 +107155,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107214,7 +107214,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107273,7 +107273,7 @@ { "@timestamp": "2017-12-07T17:57:15.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107332,7 +107332,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107385,7 +107385,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107439,7 +107439,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107493,7 +107493,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107546,7 +107546,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107599,7 +107599,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107652,7 +107652,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107705,7 +107705,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107758,7 +107758,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107811,7 +107811,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107864,7 +107864,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107917,7 +107917,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -107976,7 +107976,7 @@ { "@timestamp": "2017-12-07T17:57:18.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108052,7 +108052,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108105,7 +108105,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108159,7 +108159,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108213,7 +108213,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108266,7 +108266,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108319,7 +108319,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108372,7 +108372,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108425,7 +108425,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108478,7 +108478,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108531,7 +108531,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108584,7 +108584,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108637,7 +108637,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108696,7 +108696,7 @@ { "@timestamp": "2017-12-07T17:57:19.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108772,7 +108772,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108838,7 +108838,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108904,7 +108904,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -108970,7 +108970,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109036,7 +109036,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109102,7 +109102,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109168,7 +109168,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109234,7 +109234,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109300,7 +109300,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109366,7 +109366,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109432,7 +109432,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109498,7 +109498,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109564,7 +109564,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109630,7 +109630,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109696,7 +109696,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109762,7 +109762,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109828,7 +109828,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109894,7 +109894,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -109960,7 +109960,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110026,7 +110026,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110092,7 +110092,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110158,7 +110158,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110224,7 +110224,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110290,7 +110290,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110356,7 +110356,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110422,7 +110422,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110488,7 +110488,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110554,7 +110554,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110620,7 +110620,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110686,7 +110686,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110752,7 +110752,7 @@ { "@timestamp": "2017-12-07T17:57:21.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110818,7 +110818,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110877,7 +110877,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110936,7 +110936,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -110995,7 +110995,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111053,7 +111053,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111112,7 +111112,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111171,7 +111171,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111229,7 +111229,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111287,7 +111287,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111346,7 +111346,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111405,7 +111405,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111464,7 +111464,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111522,7 +111522,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111580,7 +111580,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111639,7 +111639,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111698,7 +111698,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111757,7 +111757,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111817,7 +111817,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111875,7 +111875,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111935,7 +111935,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -111994,7 +111994,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112054,7 +112054,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112114,7 +112114,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112173,7 +112173,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112232,7 +112232,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112290,7 +112290,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112348,7 +112348,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112408,7 +112408,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112467,7 +112467,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112526,7 +112526,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112585,7 +112585,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112643,7 +112643,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112702,7 +112702,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112760,7 +112760,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112819,7 +112819,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112878,7 +112878,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112937,7 +112937,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -112996,7 +112996,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113055,7 +113055,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113115,7 +113115,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113174,7 +113174,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113233,7 +113233,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113292,7 +113292,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113350,7 +113350,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113409,7 +113409,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113467,7 +113467,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113527,7 +113527,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113587,7 +113587,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113645,7 +113645,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113704,7 +113704,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113762,7 +113762,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113822,7 +113822,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113881,7 +113881,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113941,7 +113941,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -113999,7 +113999,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114059,7 +114059,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114119,7 +114119,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114178,7 +114178,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114236,7 +114236,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114296,7 +114296,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114355,7 +114355,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114415,7 +114415,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114474,7 +114474,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114533,7 +114533,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114592,7 +114592,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114651,7 +114651,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114710,7 +114710,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114769,7 +114769,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114828,7 +114828,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114887,7 +114887,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -114947,7 +114947,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115007,7 +115007,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115067,7 +115067,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115127,7 +115127,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115185,7 +115185,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115245,7 +115245,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115304,7 +115304,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115363,7 +115363,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115423,7 +115423,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115483,7 +115483,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115542,7 +115542,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115601,7 +115601,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115661,7 +115661,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115721,7 +115721,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115780,7 +115780,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115840,7 +115840,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115899,7 +115899,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -115959,7 +115959,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116018,7 +116018,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116078,7 +116078,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116138,7 +116138,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116196,7 +116196,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116256,7 +116256,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116316,7 +116316,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116376,7 +116376,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116436,7 +116436,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116495,7 +116495,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116554,7 +116554,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116613,7 +116613,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116671,7 +116671,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116729,7 +116729,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116787,7 +116787,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116847,7 +116847,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116906,7 +116906,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -116964,7 +116964,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117022,7 +117022,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117081,7 +117081,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117140,7 +117140,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117200,7 +117200,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117259,7 +117259,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117319,7 +117319,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117378,7 +117378,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117437,7 +117437,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117497,7 +117497,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117557,7 +117557,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117616,7 +117616,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117676,7 +117676,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117736,7 +117736,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117795,7 +117795,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117853,7 +117853,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117912,7 +117912,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -117971,7 +117971,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118031,7 +118031,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118090,7 +118090,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118150,7 +118150,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118209,7 +118209,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118268,7 +118268,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118328,7 +118328,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118388,7 +118388,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118448,7 +118448,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118508,7 +118508,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118567,7 +118567,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118626,7 +118626,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118686,7 +118686,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118746,7 +118746,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118806,7 +118806,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118866,7 +118866,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118926,7 +118926,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -118986,7 +118986,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119046,7 +119046,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119106,7 +119106,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119166,7 +119166,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119226,7 +119226,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119286,7 +119286,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119346,7 +119346,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119406,7 +119406,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119466,7 +119466,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119526,7 +119526,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119586,7 +119586,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119646,7 +119646,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119706,7 +119706,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119766,7 +119766,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119826,7 +119826,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119886,7 +119886,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -119946,7 +119946,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120005,7 +120005,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120065,7 +120065,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120125,7 +120125,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120185,7 +120185,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120245,7 +120245,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120305,7 +120305,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120365,7 +120365,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120425,7 +120425,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120485,7 +120485,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120545,7 +120545,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120604,7 +120604,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120664,7 +120664,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120724,7 +120724,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120784,7 +120784,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120844,7 +120844,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120904,7 +120904,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -120964,7 +120964,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121024,7 +121024,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121084,7 +121084,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121144,7 +121144,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121204,7 +121204,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121264,7 +121264,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121324,7 +121324,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121384,7 +121384,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121443,7 +121443,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121503,7 +121503,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121563,7 +121563,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121623,7 +121623,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121683,7 +121683,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121743,7 +121743,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121803,7 +121803,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121863,7 +121863,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121923,7 +121923,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -121983,7 +121983,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122043,7 +122043,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122103,7 +122103,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122162,7 +122162,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122222,7 +122222,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122282,7 +122282,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122342,7 +122342,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122402,7 +122402,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122462,7 +122462,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122522,7 +122522,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122582,7 +122582,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122642,7 +122642,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122702,7 +122702,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122762,7 +122762,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122822,7 +122822,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122882,7 +122882,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -122942,7 +122942,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123002,7 +123002,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123062,7 +123062,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123122,7 +123122,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123182,7 +123182,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123242,7 +123242,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123302,7 +123302,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123362,7 +123362,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123422,7 +123422,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123482,7 +123482,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123542,7 +123542,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123602,7 +123602,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123662,7 +123662,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123722,7 +123722,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123782,7 +123782,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123842,7 +123842,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123902,7 +123902,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -123962,7 +123962,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124022,7 +124022,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124082,7 +124082,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124142,7 +124142,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124202,7 +124202,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124262,7 +124262,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124322,7 +124322,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124382,7 +124382,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124442,7 +124442,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124502,7 +124502,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124562,7 +124562,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124622,7 +124622,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124682,7 +124682,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124742,7 +124742,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124802,7 +124802,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124862,7 +124862,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124922,7 +124922,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -124982,7 +124982,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125042,7 +125042,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125101,7 +125101,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125161,7 +125161,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125221,7 +125221,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125281,7 +125281,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125341,7 +125341,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125401,7 +125401,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125461,7 +125461,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125521,7 +125521,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125581,7 +125581,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125641,7 +125641,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125701,7 +125701,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125761,7 +125761,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125821,7 +125821,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125881,7 +125881,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -125941,7 +125941,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126001,7 +126001,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126061,7 +126061,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126121,7 +126121,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126181,7 +126181,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126241,7 +126241,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126301,7 +126301,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126361,7 +126361,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126421,7 +126421,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126481,7 +126481,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126541,7 +126541,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126601,7 +126601,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126661,7 +126661,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126721,7 +126721,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126781,7 +126781,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126841,7 +126841,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126901,7 +126901,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -126961,7 +126961,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127021,7 +127021,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127081,7 +127081,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127141,7 +127141,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127201,7 +127201,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127261,7 +127261,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127321,7 +127321,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127381,7 +127381,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127441,7 +127441,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127501,7 +127501,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127561,7 +127561,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127621,7 +127621,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127681,7 +127681,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127741,7 +127741,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127801,7 +127801,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127861,7 +127861,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127921,7 +127921,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -127981,7 +127981,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128041,7 +128041,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128101,7 +128101,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128161,7 +128161,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128221,7 +128221,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128281,7 +128281,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128341,7 +128341,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128401,7 +128401,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128461,7 +128461,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128521,7 +128521,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128581,7 +128581,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128641,7 +128641,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128701,7 +128701,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128761,7 +128761,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128821,7 +128821,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128881,7 +128881,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -128941,7 +128941,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129001,7 +129001,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129061,7 +129061,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129121,7 +129121,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129181,7 +129181,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129241,7 +129241,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129301,7 +129301,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129361,7 +129361,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129421,7 +129421,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129481,7 +129481,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129541,7 +129541,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129601,7 +129601,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129661,7 +129661,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129721,7 +129721,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129781,7 +129781,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129841,7 +129841,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129901,7 +129901,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -129960,7 +129960,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130019,7 +130019,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130078,7 +130078,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130137,7 +130137,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130197,7 +130197,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130257,7 +130257,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130317,7 +130317,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130377,7 +130377,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130437,7 +130437,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130497,7 +130497,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130557,7 +130557,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130617,7 +130617,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130677,7 +130677,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130737,7 +130737,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130797,7 +130797,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130857,7 +130857,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130917,7 +130917,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -130977,7 +130977,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131037,7 +131037,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131097,7 +131097,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131157,7 +131157,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131217,7 +131217,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131277,7 +131277,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131337,7 +131337,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131397,7 +131397,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131457,7 +131457,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131517,7 +131517,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131577,7 +131577,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131637,7 +131637,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131697,7 +131697,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131757,7 +131757,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131817,7 +131817,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131877,7 +131877,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131937,7 +131937,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -131997,7 +131997,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132057,7 +132057,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132117,7 +132117,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132177,7 +132177,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132237,7 +132237,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132296,7 +132296,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132356,7 +132356,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132416,7 +132416,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132476,7 +132476,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132536,7 +132536,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132596,7 +132596,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132656,7 +132656,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132716,7 +132716,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132776,7 +132776,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132834,7 +132834,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132894,7 +132894,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -132954,7 +132954,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133014,7 +133014,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133074,7 +133074,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133134,7 +133134,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133194,7 +133194,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133253,7 +133253,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133312,7 +133312,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133372,7 +133372,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133432,7 +133432,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133492,7 +133492,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133551,7 +133551,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133610,7 +133610,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133670,7 +133670,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133730,7 +133730,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", @@ -133789,7 +133789,7 @@ { "@timestamp": "2017-12-07T17:57:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "added", diff --git a/packages/osquery/data_stream/result/elasticsearch/ingest_pipeline/default.yml b/packages/osquery/data_stream/result/elasticsearch/ingest_pipeline/default.yml index 38ce9f49cb0..f69adf233e4 100644 --- a/packages/osquery/data_stream/result/elasticsearch/ingest_pipeline/default.yml +++ b/packages/osquery/data_stream/result/elasticsearch/ingest_pipeline/default.yml @@ -6,7 +6,7 @@ processors: target_field: "json" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/osquery/data_stream/result/sample_event.json b/packages/osquery/data_stream/result/sample_event.json index deb16adcb21..f836f955bf7 100644 --- a/packages/osquery/data_stream/result/sample_event.json +++ b/packages/osquery/data_stream/result/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "eaaf0f0c-2e54-4bd7-a0cc-9968349277bc", diff --git a/packages/osquery/docs/README.md b/packages/osquery/docs/README.md index d6815fde762..c34654d59fe 100644 --- a/packages/osquery/docs/README.md +++ b/packages/osquery/docs/README.md @@ -38,7 +38,7 @@ An example event for `result` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "eaaf0f0c-2e54-4bd7-a0cc-9968349277bc", diff --git a/packages/osquery/img/kibana-osquery-compatibility.png b/packages/osquery/img/kibana-osquery-compatibility.png deleted file mode 100644 index 13adb15eeb5..00000000000 Binary files a/packages/osquery/img/kibana-osquery-compatibility.png and /dev/null differ diff --git a/packages/osquery/img/osquery-compliance.png b/packages/osquery/img/osquery-compliance.png new file mode 100644 index 00000000000..34b6fc977c3 Binary files /dev/null and b/packages/osquery/img/osquery-compliance.png differ diff --git a/packages/osquery/kibana/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery/kibana/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05.json index 3b0d9806e33..e95fb8e592e 100644 --- a/packages/osquery/kibana/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery/kibana/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05.json @@ -1,34 +1,27 @@ { - "id": "osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-14T16:57:04.133Z", - "version": "WzU3OSwxXQ==", "attributes": { "description": "Dashboard for visualizing the data collected by the Osquery compliance pack.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", - "query": "data_stream.dataset:osquery.result" - }, - "version": true + "query": "" + } } }, "optionsJSON": { - "darkTheme": false, "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -38,94 +31,222 @@ "y": 15 }, "panelIndex": "1", - "panelRefName": "panel_0", - "version": "7.11.0-SNAPSHOT" + "panelRefName": "panel_1", + "type": "search", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 15, - "i": "2", - "w": 28, - "x": 20, - "y": 0 - }, - "panelIndex": "2", "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Mounts by type [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c4497503-fb1f-4878-9006-2bf5ea8ceb69", + "type": "index-pattern" }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + { + "id": "logs-*", + "name": "593beeff-14a5-4991-be9a-31228c30293b", + "type": "index-pattern" }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "64f3c159-6cd6-4b92-a34b-36609e24648d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c4497503-fb1f-4878-9006-2bf5ea8ceb69": { + "columnOrder": [ + "de74b472-8c7d-4ed6-a5a8-098561d335c7", + "49922560-65ed-4b10-bb78-48bfca219ef2", + "47f0c378-c46e-469c-85f4-07da71273ffe" + ], + "columns": { + "47f0c378-c46e-469c-85f4-07da71273ffe": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "49922560-65ed-4b10-bb78-48bfca219ef2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Result Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "47f0c378-c46e-469c-85f4-07da71273ffe", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.result.columns.type" + }, + "de74b472-8c7d-4ed6-a5a8-098561d335c7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Result Path", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "47f0c378-c46e-469c-85f4-07da71273ffe", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "osquery.result.columns.path" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "osquery.result.columns.path", - "order": "desc", - "orderBy": "1", - "size": 10 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "593beeff-14a5-4991-be9a-31228c30293b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "osquery.result.columns.type", - "order": "desc", - "orderBy": "1", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "64f3c159-6cd6-4b92-a34b-36609e24648d", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_it-compliance_mounts" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "osquery.result.name": "pack_it-compliance_mounts" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "c4497503-fb1f-4878-9006-2bf5ea8ceb69", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "47f0c378-c46e-469c-85f4-07da71273ffe" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "de74b472-8c7d-4ed6-a5a8-098561d335c7", + "49922560-65ed-4b10-bb78-48bfca219ef2" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" } - } + }, + "title": "Mounts by type [Logs Osquery] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "type": "visualization" - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2", + "w": 28, + "x": 20, + "y": 0 + }, + "panelIndex": "2", + "title": "Mounts by type [Logs Osquery]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 16, @@ -135,12 +256,234 @@ "y": 15 }, "panelIndex": "3", - "panelRefName": "panel_2", - "version": "7.11.0-SNAPSHOT" + "panelRefName": "panel_3", + "type": "search", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "visualization", + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7841f5e8-ab93-4591-8bee-64d00bdf1c4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8645c94b-7b99-4b63-af5f-ebd2fbb80d77", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e6a07c12-6244-48dd-ad11-b8d6de715479", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7841f5e8-ab93-4591-8bee-64d00bdf1c4d": { + "columnOrder": [ + "27b34e14-ca46-4201-8a06-27f85ab23c3a", + "8d01ef48-c52e-4a25-bd75-f2fc09186571", + "8e5bbe6f-6567-4e08-8c60-34bc659c93bc", + "4780305b-0fac-419f-83ce-dd03d797ac87" + ], + "columns": { + "27b34e14-ca46-4201-8a06-27f85ab23c3a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.result.columns.platform_like: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4780305b-0fac-419f-83ce-dd03d797ac87", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.result.columns.platform_like" + }, + "4780305b-0fac-419f-83ce-dd03d797ac87": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique count of osquery.result.host_identifier", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "osquery.result.host_identifier" + }, + "8d01ef48-c52e-4a25-bd75-f2fc09186571": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.result.columns.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4780305b-0fac-419f-83ce-dd03d797ac87", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.result.columns.name" + }, + "8e5bbe6f-6567-4e08-8c60-34bc659c93bc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.result.columns.version: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "4780305b-0fac-419f-83ce-dd03d797ac87", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.result.columns.version" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8645c94b-7b99-4b63-af5f-ebd2fbb80d77", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "e6a07c12-6244-48dd-ad11-b8d6de715479", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_it-compliance_os_version" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_it-compliance_os_version" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "7841f5e8-ab93-4591-8bee-64d00bdf1c4d", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "4780305b-0fac-419f-83ce-dd03d797ac87" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "27b34e14-ca46-4201-8a06-27f85ab23c3a", + "8d01ef48-c52e-4a25-bd75-f2fc09186571", + "8e5bbe6f-6567-4e08-8c60-34bc659c93bc" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "OS versions [Logs Osquery] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 11, "i": "4", @@ -149,94 +492,210 @@ "y": 4 }, "panelIndex": "4", + "title": "OS versions [Logs Osquery]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "OS versions [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-653543d7-a541-48ab-81ff-5726894bb186", + "type": "index-pattern" }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" + { + "id": "logs-*", + "name": "39350c68-1679-4995-ab1f-9ad419d248f2", + "type": "index-pattern" }, - "distinctColors": true - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "field": "osquery.result.host_identifier" - }, - "schema": "metric", - "type": "cardinality" + { + "id": "logs-*", + "name": "e17eb83f-a478-4fd7-832c-b491c7659bb7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "653543d7-a541-48ab-81ff-5726894bb186": { + "columnOrder": [ + "0737d4da-5df9-4766-93ff-7033272a4e82", + "e11a7574-4e5b-4993-896a-d4489fbe5bee", + "de2b768e-72b9-4e9e-93ab-333b7db8c9c9", + "0737d4da-5df9-4766-93ff-7033272a4e82X0" + ], + "columns": { + "0737d4da-5df9-4766-93ff-7033272a4e82": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Live Kernel integrations", + "operationType": "formula", + "params": { + "formula": "unique_count(osquery.result.columns.name)", + "isFormulaBroken": false + }, + "references": [ + "0737d4da-5df9-4766-93ff-7033272a4e82X0" + ], + "scale": "ratio" + }, + "0737d4da-5df9-4766-93ff-7033272a4e82X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Live Kernel integrations", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "osquery.result.columns.name" + }, + "de2b768e-72b9-4e9e-93ab-333b7db8c9c9": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 100", + "operationType": "static_value", + "params": { + "value": "100" + }, + "references": [], + "scale": "ratio" + }, + "e11a7574-4e5b-4993-896a-d4489fbe5bee": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 0", + "operationType": "static_value", + "params": { + "value": "0" + }, + "references": [], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "4", - "params": { - "field": "osquery.result.columns.platform_like", - "order": "desc", - "orderBy": "1", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "osquery.result.columns.name", - "order": "desc", - "orderBy": "1", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "39350c68-1679-4995-ab1f-9ad419d248f2", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_it-compliance_kernel_integrations" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "osquery.result.name": "pack_it-compliance_kernel_integrations" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "osquery.result.columns.version", - "order": "desc", - "orderBy": "1", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e17eb83f-a478-4fd7-832c-b491c7659bb7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "colorMode": "palette", + "labelMajorMode": "auto", + "labelMinor": "", + "layerId": "653543d7-a541-48ab-81ff-5726894bb186", + "layerType": "data", + "maxAccessor": "de2b768e-72b9-4e9e-93ab-333b7db8c9c9", + "metricAccessor": "0737d4da-5df9-4766-93ff-7033272a4e82", + "minAccessor": "e11a7574-4e5b-4993-896a-d4489fbe5bee", + "palette": { + "name": "positive", + "params": { + "continuity": "above", + "maxSteps": 5, + "name": "positive", + "progression": "fixed", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "number", + "reverse": false, + "stops": [ + { + "color": "#D6E9E480", + "stop": 0 + }, + { + "color": "#AED3CA80", + "stop": 20 + }, + { + "color": "#85BDB180", + "stop": 40 + }, + { + "color": "#5AA89880", + "stop": 60 + }, + { + "color": "#20928080", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "horizontalBullet", + "ticksPosition": "bands" } - } + }, + "title": "Number of Kernel integrations [Logs Osquery] (converted)", + "type": "lens", + "visualizationType": "lnsGauge" }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 11, "i": "5", @@ -245,127 +704,36 @@ "y": 4 }, "panelIndex": "5", + "title": "Number of Kernel integrations [Logs Osquery]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { "enhancements": {}, "hidePanelTitles": false, - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - }, - "legendOpen": false - }, "savedVis": { - "title": "Number of Kernel integrations [Logs Osquery]", - "description": "", - "uiState": { - "vis": { - "defaultColors": { - "0 - 100": "rgb(0,104,55)" - } - } - }, - "params": { - "addLegend": true, - "addTooltip": true, - "gauge": { - "alignment": "horizontal", - "backStyle": "Full", - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 100 - } - ], - "extendRange": true, - "gaugeColorMode": "Labels", - "gaugeStyle": "Full", - "gaugeType": "Arc", - "invertColors": false, - "labels": { - "color": "black", - "show": true - }, - "orientation": "vertical", - "percentageMode": false, - "scale": { - "color": "#333", - "labels": false, - "show": true - }, - "style": { - "bgColor": false, - "bgFill": "#eee", - "bgMask": false, - "bgWidth": 0.9, - "fontSize": 60, - "labelColor": true, - "mask": false, - "maskBars": 50, - "subText": "", - "width": 0.9 - }, - "type": "meter" - }, - "isDisplayWarning": false, - "type": "gauge" - }, - "type": "gauge", "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Live Kernel integrations", - "field": "osquery.result.columns.name" - }, - "schema": "metric", - "type": "cardinality" - } - ], + "aggs": [], "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "osquery.result.columns.status", - "negate": false, - "params": { - "query": "Live", - "type": "phrase" - }, - "type": "phrase", - "value": "Live" - }, - "query": { - "match": { - "osquery.result.columns.status": { - "query": "Live", - "type": "phrase" - } - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" } } - } - }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "**[Compliance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05)** | [OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)", + "openLinksInNewTab": false + }, + "title": "Navigation [Logs Osquery]", + "type": "markdown", + "uiState": {} + } + }, "gridData": { "h": 4, "i": "6", @@ -374,64 +742,76 @@ "y": 0 }, "panelIndex": "6", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Navigation [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 10, - "markdown": "[Compliance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": {} - } - }, - "type": "visualization" - } + "type": "visualization", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Osquery] Compliance pack", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-05T15:36:32.305Z", + "id": "osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05", - "name": "panel_0", + "name": "1:panel_1", "type": "search" }, + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-c4497503-fb1f-4878-9006-2bf5ea8ceb69", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:593beeff-14a5-4991-be9a-31228c30293b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:64f3c159-6cd6-4b92-a34b-36609e24648d", + "type": "index-pattern" + }, { "id": "osquery-3824b080-eb02-11e7-8f04-51231daa5b05", - "name": "panel_2", + "name": "3:panel_3", "type": "search" }, { - "type": "search", - "name": "2:search_0", - "id": "osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05" + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-7841f5e8-ab93-4591-8bee-64d00bdf1c4d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:8645c94b-7b99-4b63-af5f-ebd2fbb80d77", + "type": "index-pattern" }, { - "type": "search", - "name": "4:search_0", - "id": "osquery-b5d6baa0-eb02-11e7-8f04-51231daa5b05" + "id": "logs-*", + "name": "4:e6a07c12-6244-48dd-ad11-b8d6de715479", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "5:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "5:indexpattern-datasource-layer-653543d7-a541-48ab-81ff-5726894bb186", + "type": "index-pattern" }, { - "type": "search", - "name": "5:search_0", - "id": "osquery-f59e21e0-eb03-11e7-8f04-51231daa5b05" + "id": "logs-*", + "name": "5:39350c68-1679-4995-ab1f-9ad419d248f2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5:e17eb83f-a478-4fd7-832c-b491c7659bb7", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/osquery/kibana/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json b/packages/osquery/kibana/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json index d74a812e641..298d0ad2c31 100644 --- a/packages/osquery/kibana/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json +++ b/packages/osquery/kibana/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json @@ -1,194 +1,419 @@ { - "id": "osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-14T16:57:04.133Z", - "version": "WzU4MCwxXQ==", "attributes": { - "description": "This dashboard shows data collected by the OSSEC rootkit pack from osquery", - "hits": 0, + "description": "This dashboard shows data collected by the OSSEC rootkit pack from Osquery", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], - "highlightAll": true, "query": { "language": "kuery", - "query": "data_stream.dataset:osquery.result" - }, - "version": true + "query": "" + } } }, "optionsJSON": { - "darkTheme": false, "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { - "version": "8.1.0", - "type": "visualization", - "gridData": { - "h": 4, - "i": "1", - "w": 10, - "x": 19, - "y": 0 - }, - "panelIndex": "1", "embeddableConfig": { "enhancements": {}, "hidePanelTitles": false, "savedVis": { - "title": "Info OSSEC rootkit [Logs Osquery]", + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, "description": "", - "uiState": {}, "params": { "fontSize": 12, - "markdown": "This dashboard shows data collected by the ossec-rootkit pack from osquery." + "markdown": "This dashboard shows data collected by the ossec-rootkit pack from OSQuery.", + "openLinksInNewTab": false }, + "title": "Info OSSEC rootkit [Logs Osquery]", "type": "markdown", - "data": { - "aggs": [], - "searchSource": {} - } - }, - "type": "visualization" - } + "uiState": {} + } + }, + "gridData": { + "h": 5, + "i": "1", + "w": 12, + "x": 19, + "y": 0 + }, + "panelIndex": "1", + "type": "visualization", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "visualization", + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-50613f44-bfba-4785-a69e-317362abed5f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7574d1e-1f74-47cc-a509-bd7693c63b5d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "50613f44-bfba-4785-a69e-317362abed5f": { + "columnOrder": [ + "4878f3eb-2598-4146-84d7-0fef92a5307a", + "4878f3eb-2598-4146-84d7-0fef92a5307aX0", + "4878f3eb-2598-4146-84d7-0fef92a5307aX1" + ], + "columns": { + "4878f3eb-2598-4146-84d7-0fef92a5307a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Rootkits", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(osquery.result.name), 0)", + "isFormulaBroken": false + }, + "references": [ + "4878f3eb-2598-4146-84d7-0fef92a5307aX1" + ], + "scale": "ratio" + }, + "4878f3eb-2598-4146-84d7-0fef92a5307aX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Rootkits", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "osquery.result.name" + }, + "4878f3eb-2598-4146-84d7-0fef92a5307aX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Rootkits", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "4878f3eb-2598-4146-84d7-0fef92a5307aX0", + 0 + ], + "location": { + "max": 46, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(osquery.result.name), 0)", + "type": "function" + } + }, + "references": [ + "4878f3eb-2598-4146-84d7-0fef92a5307aX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a7574d1e-1f74-47cc-a509-bd7693c63b5d", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "logs-*", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "50613f44-bfba-4785-a69e-317362abed5f", + "layerType": "data", + "metricAccessor": "4878f3eb-2598-4146-84d7-0fef92a5307a" + } + }, + "title": "Number of rootkits found [Logs Osquery] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 5, "i": "2", - "w": 6, - "x": 37, + "w": 8, + "x": 40, "y": 0 }, "panelIndex": "2", + "title": "Number of rootkits found [Logs Osquery]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "title": "Number of rootkits found [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9f6ac958-42e5-42f3-90ab-620ec2b0659d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "57ecdaef-91a7-41e5-a96e-978c53b6aa25", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f6ac958-42e5-42f3-90ab-620ec2b0659d": { + "columnOrder": [ + "5b11be20-c99b-4aa3-aa40-ab457e74a365", + "5b11be20-c99b-4aa3-aa40-ab457e74a365X0", + "5b11be20-c99b-4aa3-aa40-ab457e74a365X1" + ], + "columns": { + "5b11be20-c99b-4aa3-aa40-ab457e74a365": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(agent.name), 0)", + "isFormulaBroken": false + }, + "references": [ + "5b11be20-c99b-4aa3-aa40-ab457e74a365X1" + ], + "scale": "ratio" + }, + "5b11be20-c99b-4aa3-aa40-ab457e74a365X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "agent.name" + }, + "5b11be20-c99b-4aa3-aa40-ab457e74a365X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "5b11be20-c99b-4aa3-aa40-ab457e74a365X0", + 0 + ], + "location": { + "max": 37, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(agent.name), 0)", + "type": "function" + } + }, + "references": [ + "5b11be20-c99b-4aa3-aa40-ab457e74a365X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } } - ], - "invertColors": false, - "labels": { - "show": true }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 40, - "labelColor": false, - "subText": "" - }, - "useRanges": false + "textBased": { + "layers": {} + } }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Rootkits", - "field": "osquery.result.name" + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "cardinality" + "meta": { + "alias": null, + "disabled": false, + "index": "57ecdaef-91a7-41e5-a96e-978c53b6aa25", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "logs-*", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "9f6ac958-42e5-42f3-90ab-620ec2b0659d", + "layerType": "data", + "metricAccessor": "5b11be20-c99b-4aa3-aa40-ab457e74a365" } - } + }, + "title": "Number of hosts infected [Logs Osquery] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + "enhancements": {}, + "hidePanelTitles": false + }, "gridData": { "h": 5, "i": "3", - "w": 6, + "w": 9, "x": 31, "y": 0 }, "panelIndex": "3", + "title": "Number of hosts infected [Logs Osquery]", + "type": "lens", + "version": "8.7.1" + }, + { "embeddableConfig": { "enhancements": {}, "hidePanelTitles": false, "savedVis": { - "title": "Number of hosts infected [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 40, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "type": "metric", "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Hosts", - "field": "agent.name" - }, - "schema": "metric", - "type": "cardinality" - } - ], + "aggs": [], "searchSource": { "filter": [], "query": { @@ -196,80 +421,83 @@ "query": "" } } - } - }, - "type": "visualization" - } - }, - { - "version": "8.1.0", - "type": "visualization", + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "[Compliance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05) | **[OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)**", + "openLinksInNewTab": false + }, + "title": "Navigation [Logs Osquery]", + "type": "markdown", + "uiState": {} + } + }, "gridData": { - "h": 4, + "h": 5, "i": "4", "w": 19, "x": 0, "y": 0 }, "panelIndex": "4", - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Navigation [Logs Osquery]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 10, - "markdown": "[Compliance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)" - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": {} - } - }, - "type": "visualization" - } + "type": "visualization", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 20, + "h": 21, "i": "5", - "w": 43, + "w": 48, "x": 0, "y": 5 }, "panelIndex": "5", - "panelRefName": "panel_4", - "version": "7.11.0-SNAPSHOT" + "panelRefName": "panel_5", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Osquery] OSSEC rootkit pack", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-05T15:40:07.447Z", + "id": "osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "id": "osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040", - "name": "panel_4", - "type": "search" + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-50613f44-bfba-4785-a69e-317362abed5f", + "type": "index-pattern" }, { - "type": "search", - "name": "2:search_0", - "id": "osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040" + "id": "logs-*", + "name": "2:a7574d1e-1f74-47cc-a509-bd7693c63b5d", + "type": "index-pattern" }, { - "type": "search", - "name": "3:search_0", - "id": "osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040" + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-9f6ac958-42e5-42f3-90ab-620ec2b0659d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3:57ecdaef-91a7-41e5-a96e-978c53b6aa25", + "type": "index-pattern" + }, + { + "id": "osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040", + "name": "5:panel_5", + "type": "search" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/osquery/kibana/search/osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040.json b/packages/osquery/kibana/search/osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040.json index d2ce2010b26..253786274fd 100644 --- a/packages/osquery/kibana/search/osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040.json +++ b/packages/osquery/kibana/search/osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040.json @@ -6,15 +6,73 @@ "agent.name" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "logs-*", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "osquery.result.name:pack_ossec-rootkit" + "query": "" }, "version": true } @@ -25,18 +83,27 @@ "desc" ] ], + "timeRestore": false, "title": "OSSEC Rootkits [Logs Osquery]", + "usesAdHocDataView": false, "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-05T15:08:40.640Z", "id": "osquery-0fe5dc00-f49b-11e7-8647-534bb4c21040", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/osquery/kibana/search/osquery-3824b080-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery/kibana/search/osquery-3824b080-eb02-11e7-8f04-51231daa5b05.json index 8ba403f628b..81f9c4ecb55 100644 --- a/packages/osquery/kibana/search/osquery-3824b080-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery/kibana/search/osquery-3824b080-eb02-11e7-8f04-51231daa5b05.json @@ -6,15 +6,73 @@ "osquery.result.columns.revision" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "logs-*", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_it-compliance_deb_packages" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_it-compliance_deb_packages" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "osquery.result.name:pack_it-compliance_deb_packages" + "query": "" }, "version": true } @@ -25,18 +83,27 @@ "desc" ] ], + "timeRestore": false, "title": "DEB packages installed [Logs Osquery]", + "usesAdHocDataView": false, "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-05T15:08:40.640Z", "id": "osquery-3824b080-eb02-11e7-8f04-51231daa5b05", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/osquery/kibana/search/osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05.json b/packages/osquery/kibana/search/osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05.json index 0936fc04871..c773bd59ab3 100644 --- a/packages/osquery/kibana/search/osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05.json +++ b/packages/osquery/kibana/search/osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05.json @@ -6,15 +6,73 @@ "osquery.result.columns.flags" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "logs-*", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "osquery.result" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "osquery.result" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "osquery.result.name", + "index": "logs-*", + "key": "osquery.result.name", + "negate": false, + "params": { + "query": "pack_it-compliance_mounts" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "osquery.result.name": "pack_it-compliance_mounts" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "osquery.result.name:pack_it-compliance_mounts" + "query": "" }, "version": true } @@ -25,18 +83,27 @@ "desc" ] ], + "timeRestore": false, "title": "Mounts [Logs Osquery]", + "usesAdHocDataView": false, "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-05T15:08:40.640Z", "id": "osquery-7a9482d0-eb00-11e7-8f04-51231daa5b05", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/osquery/kibana/tags.yml b/packages/osquery/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/osquery/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/osquery/manifest.yml b/packages/osquery/manifest.yml index b8237362ed1..a6196d691de 100644 --- a/packages/osquery/manifest.yml +++ b/packages/osquery/manifest.yml @@ -1,6 +1,6 @@ name: osquery title: Osquery Logs -version: "1.11.0" +version: "1.15.0" description: Collect logs from Osquery with Elastic Agent. type: integration icons: @@ -8,14 +8,15 @@ icons: title: logo osquery size: 32x32 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" categories: - security conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - - src: /img/kibana-osquery-compatibility.png - title: kibana osquery compatibility + - src: /img/osquery-compliance.png + title: Osquery Compliance Dashboard size: 2204x1097 type: image/png policy_templates: @@ -28,3 +29,4 @@ policy_templates: description: "Collecting result logs from Osquery instances (input: logfile)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/osquery_manager/changelog.yml b/packages/osquery_manager/changelog.yml index ea822be1f65..e852fc3b14f 100644 --- a/packages/osquery_manager/changelog.yml +++ b/packages/osquery_manager/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.9.0" + changes: + - description: Update schema for osquery 5.8.2 + type: enhancement + link: https://github.com/elastic/integrations/pull/7094 +- version: "1.8.4" + changes: + - description: Convert dashboards to Lens + type: enhancement + link: https://github.com/elastic/integrations/pull/6836 - version: "1.7.4" changes: - description: Fix elf.sections mapping diff --git a/packages/osquery_manager/data_stream/result/fields/osquery.yml b/packages/osquery_manager/data_stream/result/fields/osquery.yml index 0723c3ce14d..a95d1cc53a8 100644 --- a/packages/osquery_manager/data_stream/result/fields/osquery.yml +++ b/packages/osquery_manager/data_stream/result/fields/osquery.yml @@ -1576,6 +1576,7 @@ bpf_process_events.cmdline - Command line arguments docker_container_processes.cmdline - Complete argv es_process_events.cmdline - Command line arguments (argv) + process_etw_events.cmdline - Command Line process_events.cmdline - Command line arguments (argv) processes.cmdline - Complete argv type: keyword @@ -2489,6 +2490,7 @@ description: |- crashes.datetime - Date/Time at which the crash occurred powershell_events.datetime - System time at which the Powershell script event occurred + process_etw_events.datetime - Event timestamp in DATETIME format syslog_events.datetime - Time known to syslog time.datetime - Current date and time (ISO format) in UTC windows_crashes.datetime - Timestamp (log format) of the crash @@ -2617,6 +2619,7 @@ drivers.description - Driver description firefox_addons.description - Addon-supplied description string interface_details.description - Short description of the object a one-line string. + kernel_keys.description - The key description. keychain_acls.description - The description included with the ACL entry keychain_items.description - Optional item description logical_drives.description - The canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'. @@ -3201,6 +3204,7 @@ file_events.eid - Event ID hardware_events.eid - Event ID ntfs_journal_events.eid - Event ID + process_etw_events.eid - Event ID process_events.eid - Event ID process_file_events.eid - Event ID selinux_events.eid - Event ID @@ -3660,6 +3664,7 @@ bpf_process_events.exit_code - Exit code of the system call bpf_socket_events.exit_code - Exit code of the system call es_process_events.exit_code - Exit code of a process in case of an exit event + process_etw_events.exit_code - Exit Code - Present only on ProcessStop events type: keyword ignore_above: 1024 multi_fields: @@ -4034,7 +4039,7 @@ type: long default_field: false - name: flags - description: "device_partitions.flags - \ndns_cache.flags - DNS record flags\ninterface_details.flags - Flags (netdevice) for the device\nmounts.flags - Mounted device flags\npipes.flags - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes\nroutes.flags - Flags to describe route" + description: "device_partitions.flags - \ndns_cache.flags - DNS record flags\ninterface_details.flags - Flags (netdevice) for the device\nkernel_keys.flags - A set of flags describing the state of the key.\nmounts.flags - Mounted device flags\npipes.flags - The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes\nprocess_etw_events.flags - Process Flags\nroutes.flags - Flags to describe route" type: keyword ignore_above: 1024 - name: folder_id @@ -4196,6 +4201,7 @@ file.gid - Owning group ID file_events.gid - Owning group ID groups.gid - Unsigned int64 group ID + kernel_keys.gid - The group ID of the key. package_bom.gid - Expected group of file or directory process_events.gid - Group ID at process start process_file_events.gid - The gid of the process performing the action @@ -4465,6 +4471,14 @@ type: text norms: false default_field: false + - name: header_pid + description: process_etw_events.header_pid - Process ID of the process reporting the event + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: header_size description: smbios_tables.header_size - Header size in bytes type: keyword @@ -6161,6 +6175,15 @@ - name: number type: long default_field: false + - name: mandatory_label + description: process_etw_events.mandatory_label - Primary token mandatory label sid - Present only on ProcessStart events + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false - name: manifest_hash description: chrome_extensions.manifest_hash - The SHA256 hash of the manifest.json file type: keyword @@ -6492,6 +6515,14 @@ - name: number type: long default_field: false + - name: memory_cached + description: docker_container_stats.memory_cached - Memory cached + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: memory_device_handle description: memory_device_mapped_addresses.memory_device_handle - Handle of the memory device structure associated with this structure type: keyword @@ -7211,6 +7242,22 @@ type: text norms: false default_field: false + - name: number_of_efficiency_cores + description: cpu_info.number_of_efficiency_cores - The number of efficiency cores of the CPU. Only available on Apple Silicon + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false + - name: number_of_performance_cores + description: cpu_info.number_of_performance_cores - The number of performance cores of the CPU. Only available on Apple Silicon + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: object_name description: winbaseobj.object_name - Object Name type: keyword @@ -7713,6 +7760,14 @@ processes.parent - Process parent's PID type: keyword ignore_above: 1024 + - name: parent_process_sequence_number + description: process_etw_events.parent_process_sequence_number - Parent Process Sequence Number - Present only on ProcessStart events + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: parent_ref_number description: ntfs_journal_events.parent_ref_number - The ordinal that associates a journal record with a filename's parent directory type: keyword @@ -7903,6 +7958,7 @@ package_receipts.path - Path of receipt plist plist.path - (required) read preferences from a plist prefetch.path - Prefetch file path. + process_etw_events.path - Path of executed binary process_events.path - Path of executed file process_file_events.path - The path associated with the event process_memory_map.path - Path to mapped file or mapped type @@ -8087,6 +8143,7 @@ - name: permissions description: |- chrome_extensions.permissions - The permissions required by the extension + kernel_keys.permissions - The key permissions, expressed as four hexadecimalbytes containing, from left to right, thepossessor, user, group, and other permissions. process_memory_map.permissions - r=read, w=write, x=execute, p=private (cow) shared_memory.permissions - Memory segment permissions suid_bin.permissions - Binary permissions @@ -8184,6 +8241,7 @@ osquery_info.pid - Process (or thread/handle) ID pipes.pid - Process ID of the process to which the pipe belongs process_envs.pid - Process (or thread) ID + process_etw_events.pid - Process ID process_events.pid - Process (or thread) ID process_file_events.pid - Process ID process_memory_map.pid - Process (or thread) ID @@ -8236,6 +8294,7 @@ suid_bin.pid_with_namespace - Pids that contain a namespace user_ssh_keys.pid_with_namespace - Pids that contain a namespace users.pid_with_namespace - Pids that contain a namespace + yara.pid_with_namespace - Pids that contain a namespace yum_sources.pid_with_namespace - Pids that contain a namespace type: keyword ignore_above: 1024 @@ -8432,7 +8491,9 @@ type: long default_field: false - name: ppid - description: process_file_events.ppid - Parent process ID + description: |- + process_etw_events.ppid - Parent Process ID + process_file_events.ppid - Parent process ID type: keyword ignore_above: 1024 multi_fields: @@ -8562,6 +8623,14 @@ - name: number type: long default_field: false + - name: process_sequence_number + description: process_etw_events.process_sequence_number - Process Sequence Number - Present only on ProcessStart events + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: process_type description: launchd.process_type - Key describes the intended purpose of the job type: keyword @@ -9639,6 +9708,14 @@ - name: number type: long default_field: false + - name: secure_mode + description: "secureboot.secure_mode - Secure mode for Intel-based macOS: 0 disabled, 1 full security, 2 medium security" + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: secure_process description: processes.secure_process - Process is secure (IUM) yes=1, no=0 type: keyword @@ -9759,6 +9836,7 @@ authenticode.serial_number - The certificate serial number battery.serial_number - The battery's unique serial number curl_certificate.serial_number - Certificate serial number + kernel_keys.serial_number - The serial key of the key. memory_devices.serial_number - Serial number of memory device type: keyword ignore_above: 1024 @@ -9881,6 +9959,7 @@ - name: session_id description: |- logon_sessions.session_id - The Terminal Services session identifier. + process_etw_events.session_id - Session ID winbaseobj.session_id - Terminal Services Session Id type: keyword ignore_above: 1024 @@ -11120,6 +11199,7 @@ ntfs_journal_events.time - Time of file event package_install_history.time - Label date as UNIX timestamp powershell_events.time - Timestamp the event was received by the osquery event publisher + process_etw_events.time - Event timestamp in Unix format process_events.time - Time of execution in UNIX time process_file_events.time - Time of execution in UNIX time seccomp_events.time - Time of execution in UNIX time @@ -11151,10 +11231,19 @@ type: text norms: false default_field: false + - name: time_windows + description: process_etw_events.time_windows - Event timestamp in Windows format + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: timeout description: |- authorizations.timeout - Label top-level key curl_certificate.timeout - Set this value to the timeout in seconds to complete the TLS handshake (default 4s, use 0 for no timeout) + kernel_keys.timeout - The amount of time until the key will expire,expressed in human-readable form. The string perm heremeans that the key is permanent (no timeout). Thestring expd means that the key has already expired. type: keyword ignore_above: 1024 multi_fields: @@ -11202,6 +11291,23 @@ type: text norms: false default_field: false + - name: token_elevation_status + description: process_etw_events.token_elevation_status - Primary token elevation status - Present only on ProcessStart events + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false + - name: token_elevation_type + description: process_etw_events.token_elevation_type - Primary token elevation type - Present only on ProcessStart events + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false - name: total_seconds description: uptime.total_seconds - Total uptime seconds type: keyword @@ -11292,7 +11398,7 @@ type: long default_field: false - name: type - description: "apparmor_events.type - Event type\nappcompat_shims.type - Type of the SDB database.\nblock_devices.type - Block device type string\nbpf_socket_events.type - The socket type\ncrashes.type - Type of crash log\ndevice_file.type - File status\ndevice_firmware.type - Type of device\ndevice_partitions.type - \ndisk_encryption.type - Description of cipher type and mode if available\ndisk_info.type - The interface type of the disk.\ndns_cache.type - DNS record type\ndns_resolvers.type - Address type: sortlist, nameserver, search\ndocker_container_mounts.type - Type of mount (bind, volume)\ndocker_container_ports.type - Protocol (tcp, udp)\ndocker_volumes.type - Volume type\nfile.type - File status\nfirefox_addons.type - Extension, addon, webapp\nhardware_events.type - Type of hardware and hardware event\ninterface_addresses.type - Type of address. One of dhcp, manual, auto, other, unknown\ninterface_details.type - Interface type (includes virtual)\nkeychain_items.type - Keychain item type (class)\nlast.type - Entry type, according to ut_type types (utmp.h)\nlogged_in_users.type - Login type\nlogical_drives.type - Deprecated (always 'Unknown').\nlxd_certificates.type - Type of the certificate\nlxd_networks.type - Type of network\nmounts.type - Mounted device type\nntfs_acl_permissions.type - Type of access mode for the access control entry.\nnvram.type - Data type (CFData, CFString, etc)\nosquery_events.type - Either publisher or subscriber\nosquery_extensions.type - SDK extension type: core, extension, or module\nosquery_flags.type - Flag type\nprocess_open_pipes.type - Pipe Type: named vs unnamed/anonymous\nregistry.type - Type of the registry value, or 'subkey' if item is a subkey\nroutes.type - Type of route\nselinux_events.type - Event type\nshared_resources.type - Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.\nsmbios_tables.type - Table entry type\nsmc_keys.type - SMC-reported type literal type\nstartup_items.type - Startup Item or Login Item\nsystem_controls.type - Data type\nulimit_info.type - System resource to be limited\nuser_events.type - The file description for the process socket\nusers.type - Whether the account is roaming (domain), local, or a system profile\nwindows_crashes.type - Type of crash log\nwindows_security_products.type - Type of security product\nxprotect_meta.type - Either plugin or extension" + description: "apparmor_events.type - Event type\nappcompat_shims.type - Type of the SDB database.\nblock_devices.type - Block device type string\nbpf_socket_events.type - The socket type\ncrashes.type - Type of crash log\ndevice_file.type - File status\ndevice_firmware.type - Type of device\ndevice_partitions.type - \ndisk_encryption.type - Description of cipher type and mode if available\ndisk_info.type - The interface type of the disk.\ndns_cache.type - DNS record type\ndns_resolvers.type - Address type: sortlist, nameserver, search\ndocker_container_mounts.type - Type of mount (bind, volume)\ndocker_container_ports.type - Protocol (tcp, udp)\ndocker_volumes.type - Volume type\nfile.type - File status\nfirefox_addons.type - Extension, addon, webapp\nhardware_events.type - Type of hardware and hardware event\ninterface_addresses.type - Type of address. One of dhcp, manual, auto, other, unknown\ninterface_details.type - Interface type (includes virtual)\nkernel_keys.type - The key type.\nkeychain_items.type - Keychain item type (class)\nlast.type - Entry type, according to ut_type types (utmp.h)\nlogged_in_users.type - Login type\nlogical_drives.type - Deprecated (always 'Unknown').\nlxd_certificates.type - Type of the certificate\nlxd_networks.type - Type of network\nmounts.type - Mounted device type\nntfs_acl_permissions.type - Type of access mode for the access control entry.\nnvram.type - Data type (CFData, CFString, etc)\nosquery_events.type - Either publisher or subscriber\nosquery_extensions.type - SDK extension type: core, extension, or module\nosquery_flags.type - Flag type\nprocess_etw_events.type - Event Type (ProcessStart, ProcessStop)\nprocess_open_pipes.type - Pipe Type: named vs unnamed/anonymous\nregistry.type - Type of the registry value, or 'subkey' if item is a subkey\nroutes.type - Type of route\nselinux_events.type - Event type\nshared_resources.type - Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.\nsmbios_tables.type - Table entry type\nsmc_keys.type - SMC-reported type literal type\nstartup_items.type - Startup Item or Login Item\nsystem_controls.type - Data type\nulimit_info.type - System resource to be limited\nuser_events.type - The file description for the process socket\nusers.type - Whether the account is roaming (domain), local, or a system profile\nwindows_crashes.type - Type of crash log\nwindows_security_products.type - Type of security product\nxprotect_meta.type - Either plugin or extension" type: keyword ignore_above: 1024 multi_fields: @@ -11330,6 +11436,7 @@ file.uid - Owning user ID file_events.uid - Owning user ID firefox_addons.uid - The local user that owns the addon + kernel_keys.uid - The user ID of the key owner. known_hosts.uid - The local user that owns the known_hosts file launchd_overrides.uid - User ID applied to the override, 0 applies to all package_bom.uid - Expected user of file or directory @@ -11390,6 +11497,15 @@ type: text norms: false default_field: false + - name: unit_file_state + description: systemd_units.unit_file_state - Whether the unit file is enabled, e.g. `enabled`, `masked`, `disabled`, etc + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false - name: unix_time description: time.unix_time - Current UNIX time in UTC type: keyword @@ -11540,6 +11656,14 @@ type: text norms: false default_field: false + - name: usage + description: kernel_keys.usage - the number of threads and open file references thatrefer to this key. + type: keyword + ignore_above: 1024 + multi_fields: + - name: number + type: long + default_field: false - name: usb_address description: usb_devices.usb_address - USB Device used address type: keyword @@ -11663,6 +11787,7 @@ launchd.username - Run this daemon or agent as this username managed_policies.username - Policy applies only this user preferences.username - (optional) read preferences for a specific user + process_etw_events.username - User rights - primary token username rpm_package_files.username - File default username from info DB shadow.username - Username startup_items.username - The user associated with the startup item diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json index cda8feccf9d..d22949c150e 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json @@ -1,54 +1,808 @@ { "attributes": { "description": "Dashboard for visualizing the data collected by the Osquery compliance pack.", - "hits": 0, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"event.module:osquery_manager\"},\"version\":true}" + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } }, - "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"1\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"1\",\"panelRefName\":\"panel_0\",\"version\":\"7.11.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"2\",\"w\":28,\"x\":20,\"y\":0},\"panelIndex\":\"2\",\"panelRefName\":\"panel_1\",\"version\":\"7.11.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":16,\"i\":\"3\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"3\",\"panelRefName\":\"panel_2\",\"version\":\"7.11.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":11,\"i\":\"4\",\"w\":11,\"x\":0,\"y\":4},\"panelIndex\":\"4\",\"panelRefName\":\"panel_3\",\"version\":\"7.11.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"},\"legendOpen\":false}},\"gridData\":{\"h\":11,\"i\":\"5\",\"w\":9,\"x\":11,\"y\":4},\"panelIndex\":\"5\",\"panelRefName\":\"panel_4\",\"version\":\"7.11.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":4,\"i\":\"6\",\"w\":20,\"x\":0,\"y\":0},\"panelIndex\":\"6\",\"panelRefName\":\"panel_5\",\"version\":\"7.11.0-SNAPSHOT\"}]", + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "1", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "1", + "panelRefName": "panel_1", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "3", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "3", + "panelRefName": "panel_3", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "**[Compliance](#/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05)** | [OSSEC Rootkit](#/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "43889ecf-f6cc-4979-86ff-842becf7b181", + "w": 20, + "x": 0, + "y": 0 + }, + "panelIndex": "43889ecf-f6cc-4979-86ff-842becf7b181", + "title": "Navigation [Osquery Manager]", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b23918e2-e11a-4e5e-96b6-3cef10465756", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "39fef267-b554-42af-9ba2-8bdba8a25f43", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b23918e2-e11a-4e5e-96b6-3cef10465756": { + "columnOrder": [ + "d56db455-5e6c-4dd8-b7f6-1ed855fe8ce5", + "a33f884c-7db9-4e1c-b593-877ba9073b27", + "83fd9daa-7559-49e0-9de2-3ac7597893e5", + "a8d05ed0-5f87-464c-97f3-eb0c070cc67f" + ], + "columns": { + "83fd9daa-7559-49e0-9de2-3ac7597893e5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.version: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a8d05ed0-5f87-464c-97f3-eb0c070cc67f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.version" + }, + "a33f884c-7db9-4e1c-b593-877ba9073b27": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a8d05ed0-5f87-464c-97f3-eb0c070cc67f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.name" + }, + "a8d05ed0-5f87-464c-97f3-eb0c070cc67f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique count of host.hostname", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.hostname" + }, + "d56db455-5e6c-4dd8-b7f6-1ed855fe8ce5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.platform_like: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a8d05ed0-5f87-464c-97f3-eb0c070cc67f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.platform_like" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "39fef267-b554-42af-9ba2-8bdba8a25f43", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "b23918e2-e11a-4e5e-96b6-3cef10465756", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "a8d05ed0-5f87-464c-97f3-eb0c070cc67f" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "d56db455-5e6c-4dd8-b7f6-1ed855fe8ce5", + "a33f884c-7db9-4e1c-b593-877ba9073b27", + "83fd9daa-7559-49e0-9de2-3ac7597893e5" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "OS versions [Osquery Manager] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 11, + "i": "c92b4394-8f0e-4c9b-8624-e9b3f471e84e", + "w": 11, + "x": 0, + "y": 4 + }, + "panelIndex": "c92b4394-8f0e-4c9b-8624-e9b3f471e84e", + "title": "OS versions [Osquery Manager]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3a3d7e8b-91de-4cd8-90a9-3787bf9e14b1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2a7b29ad-904b-4124-b2e8-f7df6c7f80af", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3a3d7e8b-91de-4cd8-90a9-3787bf9e14b1": { + "columnOrder": [ + "0fade8d3-1602-4226-afc7-a354adc3047f", + "7d849795-c4d4-44dc-aa2c-e059891bb09e", + "7ad3a740-26c1-4749-864f-22eca54a6178" + ], + "columns": { + "0fade8d3-1602-4226-afc7-a354adc3047f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.path: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7ad3a740-26c1-4749-864f-22eca54a6178", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "osquery.path" + }, + "7ad3a740-26c1-4749-864f-22eca54a6178": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7d849795-c4d4-44dc-aa2c-e059891bb09e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "osquery.type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7ad3a740-26c1-4749-864f-22eca54a6178", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "osquery.type" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "2a7b29ad-904b-4124-b2e8-f7df6c7f80af", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_it-compliance_mounts" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "3a3d7e8b-91de-4cd8-90a9-3787bf9e14b1", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7ad3a740-26c1-4749-864f-22eca54a6178" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "0fade8d3-1602-4226-afc7-a354adc3047f", + "7d849795-c4d4-44dc-aa2c-e059891bb09e" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Mounts by type [Osquery Manager] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "6852e184-67e3-47a9-b8e2-16f7acf2f477", + "w": 28, + "x": 20, + "y": 0 + }, + "panelIndex": "6852e184-67e3-47a9-b8e2-16f7acf2f477", + "title": "Mounts by type [Osquery Manager]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a513d510-16de-4b56-a3df-a8351b148bcc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c8a3448f-77ea-4708-af0c-d3b0f844e5ae", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a513d510-16de-4b56-a3df-a8351b148bcc": { + "columnOrder": [ + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81c", + "125f1e7e-3fd6-47f4-a4bd-4caa32658da6", + "64ada418-f4c4-4980-86bf-08fe92516335", + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX0", + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX1" + ], + "columns": { + "125f1e7e-3fd6-47f4-a4bd-4caa32658da6": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 0", + "operationType": "static_value", + "params": { + "value": "0" + }, + "references": [], + "scale": "ratio" + }, + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Live Kernel integrations", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(osquery.name), 0)", + "isFormulaBroken": false + }, + "references": [ + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX1" + ], + "scale": "ratio" + }, + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Live Kernel integrations", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "osquery.name" + }, + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Live Kernel integrations", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX0", + 0 + ], + "location": { + "max": 39, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(osquery.name), 0)", + "type": "function" + } + }, + "references": [ + "160a3fcc-57b2-45d7-bdc2-4385f2cfa81cX0" + ], + "scale": "ratio" + }, + "64ada418-f4c4-4980-86bf-08fe92516335": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 100", + "operationType": "static_value", + "params": { + "value": "100" + }, + "references": [], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c8a3448f-77ea-4708-af0c-d3b0f844e5ae", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_it-compliance_kernel_integrations" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_it-compliance_kernel_integrations" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "colorMode": "palette", + "labelMajorMode": "auto", + "labelMinor": "", + "layerId": "a513d510-16de-4b56-a3df-a8351b148bcc", + "layerType": "data", + "maxAccessor": "64ada418-f4c4-4980-86bf-08fe92516335", + "metricAccessor": "160a3fcc-57b2-45d7-bdc2-4385f2cfa81c", + "minAccessor": "125f1e7e-3fd6-47f4-a4bd-4caa32658da6", + "palette": { + "name": "positive", + "params": { + "continuity": "above", + "maxSteps": 5, + "name": "positive", + "progression": "fixed", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "number", + "reverse": false, + "stops": [ + { + "color": "#D6E9E480", + "stop": 0 + }, + { + "color": "#AED3CA80", + "stop": 20 + }, + { + "color": "#85BDB180", + "stop": 40 + }, + { + "color": "#5AA89880", + "stop": 60 + }, + { + "color": "#20928080", + "stop": 80 + } + ] + }, + "type": "palette" + }, + "shape": "horizontalBullet", + "ticksPosition": "bands" + } + }, + "title": "Number of Kernel integrations [Osquery Manager] (converted)", + "type": "lens", + "visualizationType": "lnsGauge" + }, + "enhancements": {} + }, + "gridData": { + "h": 11, + "i": "c22bdfa4-4498-405b-bad8-3cf8bb363bc6", + "w": 9, + "x": 11, + "y": 4 + }, + "panelIndex": "c22bdfa4-4498-405b-bad8-3cf8bb363bc6", + "type": "lens", + "version": "8.7.1" + } + ], "timeRestore": false, "title": "[Osquery Manager] Compliance pack", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T06:40:35.459Z", "id": "osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05", - "name": "panel_0", + "name": "1:panel_1", "type": "search" }, - { - "id": "osquery_manager-a9fd8bb0-eb01-11e7-8f04-51231daa5b05", - "name": "panel_1", - "type": "visualization" - }, { "id": "osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05", - "name": "panel_2", + "name": "3:panel_3", "type": "search" }, { - "id": "osquery_manager-1da1ed30-eb03-11e7-8f04-51231daa5b05", - "name": "panel_3", - "type": "visualization" + "id": "logs-*", + "name": "c92b4394-8f0e-4c9b-8624-e9b3f471e84e:indexpattern-datasource-layer-b23918e2-e11a-4e5e-96b6-3cef10465756", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c92b4394-8f0e-4c9b-8624-e9b3f471e84e:39fef267-b554-42af-9ba2-8bdba8a25f43", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6852e184-67e3-47a9-b8e2-16f7acf2f477:indexpattern-datasource-layer-3a3d7e8b-91de-4cd8-90a9-3787bf9e14b1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6852e184-67e3-47a9-b8e2-16f7acf2f477:2a7b29ad-904b-4124-b2e8-f7df6c7f80af", + "type": "index-pattern" }, { - "id": "osquery_manager-240f3630-eb05-11e7-8f04-51231daa5b05", - "name": "panel_4", - "type": "visualization" + "id": "logs-*", + "name": "c22bdfa4-4498-405b-bad8-3cf8bb363bc6:indexpattern-datasource-layer-a513d510-16de-4b56-a3df-a8351b148bcc", + "type": "index-pattern" }, { - "id": "osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040", - "name": "panel_5", - "type": "visualization" + "id": "logs-*", + "name": "c22bdfa4-4498-405b-bad8-3cf8bb363bc6:c8a3448f-77ea-4708-af0c-d3b0f844e5ae", + "type": "index-pattern" } ], - "type": "dashboard", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxOSw2XQ==" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json index 8a55ba06852..6473471b675 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json @@ -1,49 +1,502 @@ { "attributes": { - "description": "This dashboard shows data collected by the OSSEC rootkit pack from osquery", - "hits": 0, + "description": "This dashboard shows data collected by the OSSEC rootkit pack from Osquery", "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"highlightAll\":true,\"query\":{\"language\":\"kuery\",\"query\":\"event.module:osquery_manager\"},\"version\":true,\"filter\":[]}" + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } }, - "optionsJSON": "{\"darkTheme\":false,\"hidePanelTitles\":false,\"useMargins\":true}", - "panelsJSON": "[{\"version\":\"8.2.0\",\"type\":\"visualization\",\"gridData\":{\"x\":7,\"y\":0,\"w\":24,\"h\":5,\"i\":\"1\"},\"panelIndex\":\"1\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_1\"},{\"version\":\"8.2.0\",\"type\":\"visualization\",\"gridData\":{\"x\":37,\"y\":0,\"w\":6,\"h\":5,\"i\":\"2\"},\"panelIndex\":\"2\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_2\"},{\"version\":\"8.2.0\",\"type\":\"visualization\",\"gridData\":{\"x\":31,\"y\":0,\"w\":6,\"h\":5,\"i\":\"3\"},\"panelIndex\":\"3\",\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false},\"panelRefName\":\"panel_3\"},{\"version\":\"8.2.0\",\"type\":\"visualization\",\"gridData\":{\"x\":0,\"y\":0,\"w\":7,\"h\":5,\"i\":\"4\"},\"panelIndex\":\"4\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_4\"},{\"version\":\"8.2.0\",\"type\":\"search\",\"gridData\":{\"x\":0,\"y\":5,\"w\":43,\"h\":20,\"i\":\"5\"},\"panelIndex\":\"5\",\"embeddableConfig\":{\"enhancements\":{}},\"panelRefName\":\"panel_5\"}]", + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 22, + "i": "5", + "w": 48, + "x": 0, + "y": 5 + }, + "panelIndex": "5", + "panelRefName": "panel_5", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 10, + "markdown": "[Compliance](#/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05) | **[OSSEC Rootkit](#/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040)**", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 5, + "i": "eb1abbec-3005-42e6-a903-de5492f4c6d6", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "eb1abbec-3005-42e6-a903-de5492f4c6d6", + "title": "Navigation [OSquery Manager]", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "This dashboard shows data collected by the ossec-rootkit pack from Osquery.", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 5, + "i": "8b185e72-9a3d-4fa3-98ca-e9649569790c", + "w": 24, + "x": 8, + "y": 0 + }, + "panelIndex": "8b185e72-9a3d-4fa3-98ca-e9649569790c", + "title": "Info OSSEC rootkit [Osquery Manager]", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-65394593-a1dd-49b2-b7b6-6fe4a9c16c8e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "637711a3-592b-4415-a27c-ff82348d89cf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "65394593-a1dd-49b2-b7b6-6fe4a9c16c8e": { + "columnOrder": [ + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51", + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X0", + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X1" + ], + "columns": { + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(agent.name), 0)", + "isFormulaBroken": false + }, + "references": [ + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X1" + ], + "scale": "ratio" + }, + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "agent.name" + }, + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X0", + 0 + ], + "location": { + "max": 37, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(agent.name), 0)", + "type": "function" + } + }, + "references": [ + "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "637711a3-592b-4415-a27c-ff82348d89cf", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "65394593-a1dd-49b2-b7b6-6fe4a9c16c8e", + "layerType": "data", + "metricAccessor": "8bd4a2cb-ecb9-43ec-8dee-ce0edd425f51" + } + }, + "title": "Number of hosts infected [Osquery Manager] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 5, + "i": "f3777bb8-bb13-4fec-86c4-cd517c5756fc", + "w": 8, + "x": 32, + "y": 0 + }, + "panelIndex": "f3777bb8-bb13-4fec-86c4-cd517c5756fc", + "title": "Number of hosts infected [Osquery Manager]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-289d280f-f6c0-4295-9dd8-d74d35b57c3a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c6062c0d-9a70-4cd8-8d12-82276581db93", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "289d280f-f6c0-4295-9dd8-d74d35b57c3a": { + "columnOrder": [ + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdf", + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX0", + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX1" + ], + "columns": { + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Rootkits", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(action_id), 0)", + "isFormulaBroken": false + }, + "references": [ + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX1" + ], + "scale": "ratio" + }, + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Rootkits", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "action_id" + }, + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Rootkits", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX0", + 0 + ], + "location": { + "max": 36, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(action_id), 0)", + "type": "function" + } + }, + "references": [ + "a4fc4087-3051-4d05-b7bf-661a8fc5bcdfX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c6062c0d-9a70-4cd8-8d12-82276581db93", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "289d280f-f6c0-4295-9dd8-d74d35b57c3a", + "layerType": "data", + "metricAccessor": "a4fc4087-3051-4d05-b7bf-661a8fc5bcdf" + } + }, + "title": "Number of rootkits found [Osquery Manager] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 5, + "i": "164f132e-38d8-43b7-9757-61987c93827f", + "w": 8, + "x": 40, + "y": 0 + }, + "panelIndex": "164f132e-38d8-43b7-9757-61987c93827f", + "title": "Number of rootkits found [Osquery Manager]", + "type": "lens", + "version": "8.7.1" + } + ], "timeRestore": false, "title": "[Osquery Manager] OSSEC rootkit pack", "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T06:29:36.383Z", "id": "osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { - "id": "osquery_manager-6ec10290-f4aa-11e7-8647-534bb4c21040", - "name": "1:panel_1", - "type": "visualization" + "id": "osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040", + "name": "5:panel_5", + "type": "search" }, { - "id": "osquery_manager-ffdbba50-f4a9-11e7-8647-534bb4c21040", - "name": "2:panel_2", - "type": "visualization" + "id": "logs-*", + "name": "f3777bb8-bb13-4fec-86c4-cd517c5756fc:indexpattern-datasource-layer-65394593-a1dd-49b2-b7b6-6fe4a9c16c8e", + "type": "index-pattern" }, { - "id": "osquery_manager-ab587180-f4a9-11e7-8647-534bb4c21040", - "name": "3:panel_3", - "type": "visualization" + "id": "logs-*", + "name": "f3777bb8-bb13-4fec-86c4-cd517c5756fc:637711a3-592b-4415-a27c-ff82348d89cf", + "type": "index-pattern" }, { - "id": "osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040", - "name": "4:panel_4", - "type": "visualization" + "id": "logs-*", + "name": "164f132e-38d8-43b7-9757-61987c93827f:indexpattern-datasource-layer-289d280f-f6c0-4295-9dd8-d74d35b57c3a", + "type": "index-pattern" }, { - "id": "osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040", - "name": "5:panel_5", - "type": "search" + "id": "logs-*", + "name": "164f132e-38d8-43b7-9757-61987c93827f:c6062c0d-9a70-4cd8-8d12-82276581db93", + "type": "index-pattern" } ], - "type": "dashboard", - "updated_at": "2022-03-18T16:52:59.542Z", - "version": "WzE2Nzk2MSw2XQ==" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json index 4950978ff21..972b8d13ee8 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json @@ -6,9 +6,76 @@ "agent.name" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_ossec-rootkit\"},\"version\":true}" + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_ossec-rootkit" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } }, "sort": [ [ @@ -16,10 +83,13 @@ "desc" ] ], + "timeRestore": false, "title": "OSSEC Rootkits [Osquery Manager]", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T05:48:25.376Z", "id": "osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040", "migrationVersion": { "search": "8.0.0" @@ -29,9 +99,12 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], - "type": "search", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkyMSw2XQ==" + "type": "search" } \ No newline at end of file diff --git a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json index 5570f08ede0..ef29d27b432 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json @@ -6,9 +6,76 @@ "osquery.revision" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_deb_packages\"},\"version\":true}" + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_it-compliance_deb_packages" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_it-compliance_deb_packages" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } }, "sort": [ [ @@ -16,10 +83,13 @@ "desc" ] ], + "timeRestore": false, "title": "DEB packages installed [Osquery Manager]", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T05:48:25.376Z", "id": "osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05", "migrationVersion": { "search": "8.0.0" @@ -29,9 +99,12 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], - "type": "search", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxMyw2XQ==" + "type": "search" } \ No newline at end of file diff --git a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json index a1a3952c55e..f19761c09b3 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json @@ -6,9 +6,76 @@ "osquery.flags" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_mounts\"},\"version\":true}" + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "negate": false, + "params": [ + { + "meta": { + "alias": null, + "disabled": false, + "field": "event.module", + "index": "logs-*", + "key": "event.module", + "negate": false, + "params": { + "query": "osquery_manager" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.module": "osquery_manager" + } + } + }, + { + "meta": { + "alias": null, + "disabled": false, + "field": "action_id", + "index": "logs-*", + "key": "action_id", + "negate": false, + "params": { + "query": "pack_it-compliance_mounts" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + } + } + ], + "relation": "AND", + "type": "combined" + }, + "query": {} + } + ], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } }, "sort": [ [ @@ -16,10 +83,13 @@ "desc" ] ], + "timeRestore": false, "title": "Mounts [Osquery Manager]", + "usesAdHocDataView": false, "version": 1 }, - "coreMigrationVersion": "8.2.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T05:48:25.376Z", "id": "osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05", "migrationVersion": { "search": "8.0.0" @@ -29,9 +99,12 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" } ], - "type": "search", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxMSw2XQ==" + "type": "search" } \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-1da1ed30-eb03-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/visualization/osquery_manager-1da1ed30-eb03-11e7-8f04-51231daa5b05.json deleted file mode 100644 index 83aa058b7e0..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-1da1ed30-eb03-11e7-8f04-51231daa5b05.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "OS versions [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"field\":\"host.hostname\"},\"schema\":\"metric\",\"type\":\"cardinality\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"field\":\"osquery.platform_like\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"osquery.name\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"osquery.version\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\"},\"title\":\"OS versions [Osquery Manager]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-1da1ed30-eb03-11e7-8f04-51231daa5b05", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [ - { - "id": "osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxNSw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-240f3630-eb05-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/visualization/osquery_manager-240f3630-eb05-11e7-8f04-51231daa5b05.json deleted file mode 100644 index 9f50f051ba8..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-240f3630-eb05-11e7-8f04-51231daa5b05.json +++ /dev/null @@ -1,33 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"osquery.status\",\"negate\":false,\"params\":{\"query\":\"Live\",\"type\":\"phrase\"},\"type\":\"phrase\",\"value\":\"Live\"},\"query\":{\"match\":{\"osquery.status\":{\"query\":\"Live\",\"type\":\"phrase\"}}}}],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Number of Kernel integrations [Osquery Manager]", - "uiStateJSON": "{\"vis\":{\"defaultColors\":{\"0 - 100\":\"rgb(0,104,55)\"}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Live Kernel integrations\",\"field\":\"osquery.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"gauge\":{\"alignment\":\"horizontal\",\"backStyle\":\"Full\",\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":100}],\"extendRange\":true,\"gaugeColorMode\":\"Labels\",\"gaugeStyle\":\"Full\",\"gaugeType\":\"Arc\",\"invertColors\":false,\"labels\":{\"color\":\"black\",\"show\":true},\"orientation\":\"vertical\",\"percentageMode\":false,\"scale\":{\"color\":\"#333\",\"labels\":false,\"show\":true},\"style\":{\"bgColor\":false,\"bgFill\":\"#eee\",\"bgMask\":false,\"bgWidth\":0.9,\"fontSize\":60,\"labelColor\":true,\"mask\":false,\"maskBars\":50,\"subText\":\"\",\"width\":0.9},\"type\":\"meter\"},\"isDisplayWarning\":false,\"type\":\"gauge\"},\"title\":\"Number of Kernel integrations [Osquery Manager]\",\"type\":\"gauge\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-240f3630-eb05-11e7-8f04-51231daa5b05", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxNyw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/visualization/osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040.json deleted file mode 100644 index caf9eb1fa2f..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}" - }, - "title": "Navigation [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"title\":\"Navigation [Osquery Manager]\",\"type\":\"markdown\",\"aggs\":[],\"params\":{\"fontSize\":10,\"markdown\":\"[Compliance](#/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040)\",\"openLinksInNewTab\":false}}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-2d6e0760-f4ab-11e7-8647-534bb4c21040", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2022-03-18T16:53:19.189Z", - "version": "WzE2Nzk2OSw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-6ec10290-f4aa-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/visualization/osquery_manager-6ec10290-f4aa-11e7-8647-534bb4c21040.json deleted file mode 100644 index 12c4baf64ba..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-6ec10290-f4aa-11e7-8647-534bb4c21040.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{}" - }, - "title": "Info OSSEC rootkit [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[],\"params\":{\"fontSize\":12,\"markdown\":\"This dashboard shows data collected by the ossec-rootkit pack from osquery.\"},\"title\":\"Info OSSEC rootkit [Osquery Manager]\",\"type\":\"markdown\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-6ec10290-f4aa-11e7-8647-534bb4c21040", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkyMCw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-a9fd8bb0-eb01-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/visualization/osquery_manager-a9fd8bb0-eb01-11e7-8f04-51231daa5b05.json deleted file mode 100644 index dce215b2b03..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-a9fd8bb0-eb01-11e7-8f04-51231daa5b05.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Mounts by type [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"osquery.path\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"field\":\"osquery.type\",\"order\":\"desc\",\"orderBy\":\"1\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addTooltip\":true,\"isDonut\":true,\"labels\":{\"last_level\":true,\"show\":false,\"truncate\":100,\"values\":true},\"legendPosition\":\"right\",\"type\":\"pie\",\"palette\":{\"type\":\"palette\",\"name\":\"kibana_palette\"},\"distinctColors\":true,\"legendDisplay\":\"show\"},\"title\":\"Mounts by type [Osquery Manager]\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-a9fd8bb0-eb01-11e7-8f04-51231daa5b05", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [ - { - "id": "osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkxMiw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-ab587180-f4a9-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/visualization/osquery_manager-ab587180-f4a9-11e7-8647-534bb4c21040.json deleted file mode 100644 index 73e47dac248..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-ab587180-f4a9-11e7-8647-534bb4c21040.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Number of hosts infected [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Hosts\",\"field\":\"agent.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":40,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Number of hosts infected [Osquery Manager]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-ab587180-f4a9-11e7-8647-534bb4c21040", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [ - { - "id": "osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkyMyw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/kibana/visualization/osquery_manager-ffdbba50-f4a9-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/visualization/osquery_manager-ffdbba50-f4a9-11e7-8647-534bb4c21040.json deleted file mode 100644 index be0596b2705..00000000000 --- a/packages/osquery_manager/kibana/visualization/osquery_manager-ffdbba50-f4a9-11e7-8647-534bb4c21040.json +++ /dev/null @@ -1,28 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "savedSearchRefName": "search_0", - "title": "Number of rootkits found [Osquery Manager]", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Rootkits\",\"field\":\"action_id\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":40,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"Number of rootkits found [Osquery Manager]\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "8.2.0", - "id": "osquery_manager-ffdbba50-f4a9-11e7-8647-534bb4c21040", - "migrationVersion": { - "visualization": "8.1.0" - }, - "references": [ - { - "id": "osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040", - "name": "search_0", - "type": "search" - } - ], - "type": "visualization", - "updated_at": "2022-03-18T16:51:37.575Z", - "version": "WzE2NzkyMiw2XQ==" -} \ No newline at end of file diff --git a/packages/osquery_manager/manifest.yml b/packages/osquery_manager/manifest.yml index 983caeb6f55..7a0befed1f0 100644 --- a/packages/osquery_manager/manifest.yml +++ b/packages/osquery_manager/manifest.yml @@ -1,15 +1,15 @@ format_version: 1.0.0 name: osquery_manager title: Osquery Manager -version: 1.7.4 +version: 1.9.0 license: basic -description: Deploy osquery with Elastic Agent, then run and schedule queries in Kibana +description: Deploy Osquery with Elastic Agent, then run and schedule queries in Kibana type: integration release: ga categories: - security conditions: - kibana.version: ^8.7.0 + kibana.version: ^8.10.0 icons: - src: /img/logo_osquery.svg title: logo osquery diff --git a/packages/panw/_dev/build/build.yml b/packages/panw/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/panw/_dev/build/build.yml +++ b/packages/panw/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/panw/changelog.yml b/packages/panw/changelog.yml index ab1f959c4d2..08680fb4a41 100644 --- a/packages/panw/changelog.yml +++ b/packages/panw/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "3.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "3.15.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7294 +- version: "3.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "3.13.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6876 - version: "3.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-authentication-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-authentication-sample.log-expected.json index 168acb5ca55..a4de5739285 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-authentication-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-authentication-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-11-23T00:44:44.000-04:30", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-config-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-config-sample.log-expected.json index dc593b0b3a0..6bb499799d1 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-config-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-config-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-25T20:25:39.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-set", @@ -17,7 +17,9 @@ "timezone": "-04:00" }, "host": { - "ip": "81.2.69.193" + "ip": [ + "81.2.69.193" + ] }, "message": "81.2.69.193,,set,admin,Web,Succeeded, config shared log-settings iptag match-list ip-tag,,\"iptag { match-list { ip-tag { send-syslog [ SYSLOG-1 ]; filter \"\"All Logs\"\"; } } } \",1234567890,0x0,0,0,0,0,,PA-VM,0,", "observer": { @@ -60,7 +62,7 @@ { "@timestamp": "2021-10-25T20:25:19.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-set", @@ -74,7 +76,9 @@ "timezone": "-04:00" }, "host": { - "ip": "81.2.69.193" + "ip": [ + "81.2.69.193" + ] }, "message": "81.2.69.193,,set,admin,Web,Succeeded, config shared log-settings globalprotect match-list globalProtect,,\"globalprotect { match-list { globalProtect { send-syslog [ SYSLOG-1 ]; filter \"\"All Logs\"\"; } } } \",1234567890,0x0,0,0,0,0,,PA-VM,0,", "observer": { diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-correlated-events-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-correlated-events-sample.log-expected.json index f86be9b7793..bc6f6918583 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-correlated-events-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-correlated-events-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-10-09T10:20:15.000-02:30", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-decryption-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-decryption-sample.log-expected.json index 6a9fd4bb964..fcb91b4021a 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-decryption-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-decryption-sample.log-expected.json @@ -23,7 +23,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -190,10 +190,14 @@ }, "x509": { "issuer": { - "common_name": "com.example.com" + "common_name": [ + "com.example.com" + ] }, "subject": { - "common_name": "com.example.com" + "common_name": [ + "com.example.com" + ] } } }, @@ -220,7 +224,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -387,10 +391,14 @@ }, "x509": { "issuer": { - "common_name": "com.example.com" + "common_name": [ + "com.example.com" + ] }, "subject": { - "common_name": "com.example.com" + "common_name": [ + "com.example.com" + ] } } } diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-globalprotect-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-globalprotect-sample.log-expected.json index 0acb2ba4ef7..07abbdc0393 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-globalprotect-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-globalprotect-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-03-24T11:30:00.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -19,7 +19,9 @@ }, "host": { "id": "09300aaa-23-4900-8aa9-32695452aa", - "ip": "81.2.69.193", + "ip": [ + "81.2.69.193" + ], "os": { "family": "OS", "full": "OS 10 Pro , 64-bit" @@ -84,7 +86,7 @@ { "@timestamp": "2021-03-24T11:29:49.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -100,7 +102,9 @@ }, "host": { "id": "e0957c11-93-437a-9e23-9f0c24059898", - "ip": "10.20.13.217", + "ip": [ + "10.20.13.217" + ], "name": "cp935", "os": { "family": "OS", @@ -184,7 +188,7 @@ { "@timestamp": "2021-04-07T17:41:30.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -200,7 +204,9 @@ }, "host": { "id": "523e8b-7efa-4397-a4d5-824dfa4d8a", - "ip": "67.43.156.14", + "ip": [ + "67.43.156.14" + ], "name": "host82878" }, "message": "vsys1,gateway-hip-check,host-info,,,domain\\user1,,HOST82878,1.128.3.4,0.0.0.0,67.43.156.14,0.0.0.0,523e8b-7efa-4397-a4d5-824dfa4d8a,F1SM2,5.2.4,,\"\",1,,,\"HIP report is not needed\",success,,0,,0,GlobalProtect_GW,6920071768563516860,0x0", @@ -274,7 +280,7 @@ { "@timestamp": "2021-04-07T17:41:29.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -290,7 +296,9 @@ }, "host": { "id": "7d01b5-f538-4fa3-a2a2-83980d1325", - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "host73486", "os": { "family": "OS", @@ -374,7 +382,7 @@ { "@timestamp": "2021-04-07T17:41:28.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -390,7 +398,9 @@ }, "host": { "id": "2ba9f01-b83b-4902-a1fb-1748c0365", - "ip": "0.0.0.0", + "ip": [ + "0.0.0.0" + ], "name": "hostp92413" }, "message": "vsys1,gateway-tunnel-latency,tunnel,,,,userlterso,HOSTP92413,81.2.69.143,0.0.0.0,0.0.0.0,0.0.0.0,2ba9f01-b83b-4902-a1fb-1748c0365,GJG98Y2,5.2.4,,\"\",1,,,\"Pre-tunnel latency: 67ms, Post-tunnel latency: 47ms\",success,,0,,0,GlobalProtect_GW,6920071768563516847,0x0", @@ -454,7 +464,7 @@ { "@timestamp": "2021-03-02T09:55:39.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -470,7 +480,9 @@ }, "host": { "id": "985e865f-7da3-43b4-89a9-299b1bb0c975", - "ip": "0.0.0.0", + "ip": [ + "0.0.0.0" + ], "name": "pc1234", "os": { "family": "OS", @@ -541,7 +553,7 @@ { "@timestamp": "2021-03-02T11:01:02.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -557,7 +569,9 @@ }, "host": { "id": "96c43d47-8bb5-4f78-8dfc-413a189a29e0", - "ip": "10.20.30.40", + "ip": [ + "10.20.30.40" + ], "name": "rechner123", "os": { "family": "OS", @@ -639,7 +653,7 @@ { "@timestamp": "2021-03-02T09:39:26.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -655,7 +669,9 @@ }, "host": { "id": "0183d851-7ea2-4a0d-80de-fde1e04ce12f", - "ip": "0.0.0.0", + "ip": [ + "0.0.0.0" + ], "os": { "family": "OS", "full": "OS 10 Enterprise, 64-bit" @@ -721,7 +737,7 @@ { "@timestamp": "2021-03-02T09:47:13.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -737,7 +753,9 @@ }, "host": { "id": "8cbc136b-e262-4cf8-912c-95ea132d9fef", - "ip": "0.0.0.0", + "ip": [ + "0.0.0.0" + ], "name": "pc12345", "os": { "family": "OS", @@ -810,7 +828,7 @@ { "@timestamp": "2021-10-22T11:10:05.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -826,7 +844,9 @@ }, "host": { "id": "8cbc136b-e262-4cf8-912c-95ea132d9fef", - "ip": "10.2.2.2", + "ip": [ + "10.2.2.2" + ], "name": "hostname" }, "message": "vsys1,gateway-hip-check,host-info,,,host\\\\user,,HOSTNAME,10.1.1.1,,10.2.2.2,fc00::1,8cbc136b-e262-4cf8-912c-95ea132d9fef,SERIALNR,5.2.6,,,1,,,HIP report is not needed,success,,0,,0,GlobalProtect_External_Gateway,1305925,true", @@ -888,7 +908,7 @@ { "@timestamp": "2021-11-09T16:45:14.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -904,7 +924,9 @@ }, "host": { "id": "8cbc136b-e262-4cf8-912c-95ea132d9fef", - "ip": "10.4.4.4", + "ip": [ + "10.4.4.4" + ], "name": "hostname" }, "message": "vsys1,gateway-tunnel-latency,tunnel,,,user,,HOSTNAME,10.3.3.3,,10.4.4.4,,8cbc136b-e262-4cf8-912c-95ea132d9fef,SERIALNR,5.2.8,,,1,,,\"Pre-tunnel latency: 35ms, Post-tunnel latency: 16ms\",success,,0,,0,GlobalProtect_External_Gateway,1041590,true", @@ -964,7 +986,7 @@ { "@timestamp": "2021-11-09T16:45:14.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -980,7 +1002,9 @@ }, "host": { "id": "8cbc136b-e262-4cf8-912c-95ea132d9fef", - "ip": "fc00::abcd", + "ip": [ + "fc00::abcd" + ], "name": "hostname" }, "message": "vsys1,gateway-tunnel-latency,tunnel,,,user,,HOSTNAME,,fc00::1234,,fc00::abcd,8cbc136b-e262-4cf8-912c-95ea132d9fef,SERIALNR,5.2.8,,,1,,,\"Pre-tunnel latency: 35ms, Post-tunnel latency: 16ms\",success,,0,,0,GlobalProtect_External_Gateway,1041590,true", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-gtp-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-gtp-sample.log-expected.json index 7b2842a976c..96a374a17cd 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-gtp-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-gtp-sample.log-expected.json @@ -20,7 +20,7 @@ "port": 9551 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-hipmatch-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-hipmatch-sample.log-expected.json index caf0ce57989..60e7e2d203f 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-hipmatch-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-hipmatch-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-03-02T10:06:25.000-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -78,7 +78,7 @@ { "@timestamp": "2019-10-09T10:20:15.000-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-other-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-other-sample.log-expected.json index 2e97ce6f8aa..85f80bc3e71 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-other-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-other-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2012-02-25T00:51:50.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-set", @@ -17,7 +17,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,set,admin,Web,Succeeded, config shared local-user-database user badguy,0,0x0", "observer": { @@ -51,7 +53,7 @@ { "@timestamp": "2012-02-25T00:53:22.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-set", @@ -65,7 +67,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,set,admin,Web,Succeeded, config mgt-config users badguy,0,0x0", "observer": { @@ -99,7 +103,7 @@ { "@timestamp": "2012-02-25T00:53:40.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-commit", @@ -113,7 +117,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,commit,admin,Web,Submitted,,0,0x0", "observer": { @@ -146,7 +152,7 @@ { "@timestamp": "2012-02-25T00:53:53.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -186,7 +192,7 @@ { "@timestamp": "2012-02-25T00:53:56.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -226,7 +232,7 @@ { "@timestamp": "2012-02-25T00:54:16.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -266,7 +272,7 @@ { "@timestamp": "2012-02-25T00:54:16.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -306,7 +312,7 @@ { "@timestamp": "2012-02-25T00:57:17.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-edit", @@ -320,7 +326,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,edit,badguy,Web,Succeeded, vsys vsys1 profiles url-filtering monzyspolicy,0,0x0", "observer": { @@ -354,7 +362,7 @@ { "@timestamp": "2012-02-25T00:57:36.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-commit", @@ -368,7 +376,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,commit,badguy,Web,Submitted,,0,0x0", "observer": { @@ -401,7 +411,7 @@ { "@timestamp": "2012-02-25T00:57:49.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -441,7 +451,7 @@ { "@timestamp": "2012-02-25T00:57:52.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -481,7 +491,7 @@ { "@timestamp": "2012-02-25T00:58:12.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -521,7 +531,7 @@ { "@timestamp": "2012-02-25T00:58:12.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -561,7 +571,7 @@ { "@timestamp": "2012-02-25T00:58:12.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -601,7 +611,7 @@ { "@timestamp": "2012-02-25T00:58:14.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -641,7 +651,7 @@ { "@timestamp": "2012-02-25T00:59:36.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -681,7 +691,7 @@ { "@timestamp": "2012-04-10T03:11:57.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -721,7 +731,7 @@ { "@timestamp": "2012-04-10T03:11:56.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -761,7 +771,7 @@ { "@timestamp": "2012-04-10T03:11:56.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -801,7 +811,7 @@ { "@timestamp": "2012-04-10T03:11:56.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -841,7 +851,7 @@ { "@timestamp": "2012-04-10T03:06:11.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -881,7 +891,7 @@ { "@timestamp": "2012-04-10T03:06:00.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -921,7 +931,7 @@ { "@timestamp": "2012-04-09T09:02:53.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -961,7 +971,7 @@ { "@timestamp": "2012-04-09T09:02:52.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1001,7 +1011,7 @@ { "@timestamp": "2012-04-09T09:02:52.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1041,7 +1051,7 @@ { "@timestamp": "2012-04-09T09:02:52.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1081,7 +1091,7 @@ { "@timestamp": "2012-04-09T09:00:55.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1121,7 +1131,7 @@ { "@timestamp": "2012-04-09T09:00:52.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1161,7 +1171,7 @@ { "@timestamp": "2012-04-09T09:00:35.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-commit", @@ -1175,7 +1185,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,commit,admin,Web,Submitted,,0,0x0", "observer": { @@ -1208,7 +1220,7 @@ { "@timestamp": "2012-04-09T09:00:20.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "cmd-edit", @@ -1222,7 +1234,9 @@ "timezone": "+05:45" }, "host": { - "ip": "192.168.0.2" + "ip": [ + "192.168.0.2" + ] }, "message": "192.168.0.2,,edit,admin,Web,Succeeded, vsys vsys1 profiles data-objects PII,0,0x0", "observer": { @@ -1256,7 +1270,7 @@ { "@timestamp": "2012-04-09T03:21:53.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1296,7 +1310,7 @@ { "@timestamp": "2012-04-09T03:21:53.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1336,7 +1350,7 @@ { "@timestamp": "2012-04-09T03:21:53.000+05:45", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1395,7 +1409,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-threat-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-threat-sample.log-expected.json index 877475d7eaa..737125d69d2 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-threat-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-threat-sample.log-expected.json @@ -21,7 +21,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -189,7 +189,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -358,7 +358,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -527,7 +527,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -696,7 +696,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -865,7 +865,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1034,7 +1034,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1202,7 +1202,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1370,7 +1370,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1538,7 +1538,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1707,7 +1707,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1874,7 +1874,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2042,7 +2042,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2211,7 +2211,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2378,7 +2378,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2546,7 +2546,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2714,7 +2714,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2881,7 +2881,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3048,7 +3048,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3215,7 +3215,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3383,7 +3383,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3550,7 +3550,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3718,7 +3718,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3885,7 +3885,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4052,7 +4052,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4219,7 +4219,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4386,7 +4386,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4553,7 +4553,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4720,7 +4720,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4887,7 +4887,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5054,7 +5054,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5221,7 +5221,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5388,7 +5388,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5555,7 +5555,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5722,7 +5722,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5889,7 +5889,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6055,7 +6055,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6222,7 +6222,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6388,7 +6388,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6554,7 +6554,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6720,7 +6720,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6887,7 +6887,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7053,7 +7053,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7211,7 +7211,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -7372,7 +7372,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7537,7 +7537,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7702,7 +7702,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7868,7 +7868,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8033,7 +8033,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8198,7 +8198,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8364,7 +8364,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8530,7 +8530,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8696,7 +8696,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8854,7 +8854,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -9021,7 +9021,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9179,7 +9179,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -9338,7 +9338,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -9505,7 +9505,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9663,7 +9663,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -9822,7 +9822,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -9989,7 +9989,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10155,7 +10155,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10321,7 +10321,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10479,7 +10479,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -10646,7 +10646,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10811,7 +10811,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -10963,7 +10963,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11119,7 +11119,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11282,7 +11282,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11434,7 +11434,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11597,7 +11597,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11749,7 +11749,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -11905,7 +11905,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -12064,7 +12064,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -12220,7 +12220,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -12376,7 +12376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -12532,7 +12532,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -12695,7 +12695,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -12847,7 +12847,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13003,7 +13003,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13159,7 +13159,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13315,7 +13315,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13471,7 +13471,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13627,7 +13627,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13783,7 +13783,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -13939,7 +13939,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14095,7 +14095,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14251,7 +14251,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14407,7 +14407,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14563,7 +14563,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14726,7 +14726,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -14878,7 +14878,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15034,7 +15034,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15197,7 +15197,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15349,7 +15349,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15505,7 +15505,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15661,7 +15661,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15817,7 +15817,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -15973,7 +15973,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -16129,7 +16129,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "data_match", @@ -16285,7 +16285,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -16445,7 +16445,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_match", @@ -16603,7 +16603,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -16839,7 +16839,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic-sample.log-expected.json index b18d185cd24..f2d9eabf50f 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic-sample.log-expected.json @@ -22,7 +22,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -143,7 +143,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -264,7 +264,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -385,7 +385,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -506,7 +506,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -627,7 +627,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -748,7 +748,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -869,7 +869,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -990,7 +990,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1111,7 +1111,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1232,7 +1232,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1353,7 +1353,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1474,7 +1474,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1595,7 +1595,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -1716,7 +1716,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1837,7 +1837,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1958,7 +1958,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2079,7 +2079,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2200,7 +2200,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2321,7 +2321,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2442,7 +2442,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2563,7 +2563,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -2684,7 +2684,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2805,7 +2805,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2926,7 +2926,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3047,7 +3047,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3168,7 +3168,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3289,7 +3289,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3410,7 +3410,7 @@ "port": 13069 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3531,7 +3531,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3652,7 +3652,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -3773,7 +3773,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3894,7 +3894,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4015,7 +4015,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4136,7 +4136,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4257,7 +4257,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4378,7 +4378,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4499,7 +4499,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4620,7 +4620,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4741,7 +4741,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -4850,7 +4850,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -4971,7 +4971,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5080,7 +5080,7 @@ "port": 40026 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5201,7 +5201,7 @@ "port": 40029 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5322,7 +5322,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5431,7 +5431,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -5552,7 +5552,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -5673,7 +5673,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -5794,7 +5794,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -5915,7 +5915,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6036,7 +6036,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6157,7 +6157,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6278,7 +6278,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6399,7 +6399,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6520,7 +6520,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6641,7 +6641,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -6762,7 +6762,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -6883,7 +6883,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7004,7 +7004,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7125,7 +7125,7 @@ "port": 40043 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7246,7 +7246,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7367,7 +7367,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7488,7 +7488,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7609,7 +7609,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7730,7 +7730,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7851,7 +7851,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -7972,7 +7972,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8093,7 +8093,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8214,7 +8214,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8335,7 +8335,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8456,7 +8456,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8577,7 +8577,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8698,7 +8698,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -8819,7 +8819,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8940,7 +8940,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -9061,7 +9061,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -9182,7 +9182,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -9293,7 +9293,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9414,7 +9414,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9535,7 +9535,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9646,7 +9646,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9757,7 +9757,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9878,7 +9878,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -9999,7 +9999,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10120,7 +10120,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10241,7 +10241,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10362,7 +10362,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10473,7 +10473,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10594,7 +10594,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10715,7 +10715,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10836,7 +10836,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -10957,7 +10957,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11078,7 +11078,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11199,7 +11199,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11320,7 +11320,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11441,7 +11441,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11552,7 +11552,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11673,7 +11673,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11794,7 +11794,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -11915,7 +11915,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic.json-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic.json-expected.json index 1beda6cd400..bc37502e996 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic.json-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-inc-traffic.json-expected.json @@ -22,7 +22,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -191,7 +191,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -213,7 +213,9 @@ ] }, "host": { - "ip": "127.0.0.1" + "ip": [ + "127.0.0.1" + ] }, "labels": { "captive_portal": true @@ -364,7 +366,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-ip-tag-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-ip-tag-sample.log-expected.json index cb2adc645ce..1a5b6eb5dbf 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-ip-tag-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-ip-tag-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-11-23T00:44:44.000+01:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-sctp-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-sctp-sample.log-expected.json index 570c549767f..3b26763dc99 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-sctp-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-sctp-sample.log-expected.json @@ -20,7 +20,7 @@ "port": 9551 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-system-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-system-sample.log-expected.json index 3858d46d47f..65a72be9c98 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-system-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-system-sample.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-26T15:05:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -53,7 +53,7 @@ { "@timestamp": "2021-10-26T14:49:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-threat-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-threat-sample.log-expected.json index 9bfc85d8b7f..d162dccac2f 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-threat-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-threat-sample.log-expected.json @@ -25,7 +25,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -185,7 +185,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -345,7 +345,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -505,7 +505,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -665,7 +665,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -825,7 +825,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -985,7 +985,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1145,7 +1145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1305,7 +1305,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1465,7 +1465,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1625,7 +1625,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1785,7 +1785,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -1945,7 +1945,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2105,7 +2105,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2265,7 +2265,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2425,7 +2425,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2585,7 +2585,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2745,7 +2745,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -2905,7 +2905,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3065,7 +3065,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3225,7 +3225,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3385,7 +3385,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3545,7 +3545,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3705,7 +3705,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -3865,7 +3865,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4025,7 +4025,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4185,7 +4185,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4345,7 +4345,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4505,7 +4505,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4665,7 +4665,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4825,7 +4825,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -4985,7 +4985,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5145,7 +5145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5305,7 +5305,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5465,7 +5465,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5625,7 +5625,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5785,7 +5785,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -5945,7 +5945,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6105,7 +6105,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6265,7 +6265,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6425,7 +6425,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6585,7 +6585,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6745,7 +6745,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -6905,7 +6905,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7065,7 +7065,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7225,7 +7225,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7385,7 +7385,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7545,7 +7545,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7705,7 +7705,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -7865,7 +7865,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8025,7 +8025,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8185,7 +8185,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8345,7 +8345,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8505,7 +8505,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8665,7 +8665,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8825,7 +8825,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -8985,7 +8985,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9145,7 +9145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9305,7 +9305,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9465,7 +9465,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9625,7 +9625,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9785,7 +9785,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -9945,7 +9945,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10105,7 +10105,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10265,7 +10265,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10425,7 +10425,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10585,7 +10585,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10745,7 +10745,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -10905,7 +10905,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11065,7 +11065,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11225,7 +11225,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11385,7 +11385,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11545,7 +11545,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11705,7 +11705,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -11865,7 +11865,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -12025,7 +12025,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -12184,7 +12184,7 @@ "port": 36524 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "virus_detected", @@ -12369,7 +12369,7 @@ "port": 36524 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "virus_detected", @@ -12554,7 +12554,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -12738,7 +12738,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -12919,7 +12919,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -13103,7 +13103,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -13287,7 +13287,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -13471,7 +13471,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -13655,7 +13655,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -13836,7 +13836,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14017,7 +14017,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14198,7 +14198,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14382,7 +14382,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14566,7 +14566,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14750,7 +14750,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -14936,7 +14936,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -15109,7 +15109,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -15298,7 +15298,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -15471,7 +15471,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -15657,7 +15657,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -15830,7 +15830,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16019,7 +16019,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16192,7 +16192,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16381,7 +16381,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16554,7 +16554,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16743,7 +16743,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -16916,7 +16916,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -17105,7 +17105,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -17278,7 +17278,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -17467,7 +17467,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -17645,7 +17645,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -17818,7 +17818,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18007,7 +18007,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18180,7 +18180,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18369,7 +18369,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18542,7 +18542,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18731,7 +18731,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -18904,7 +18904,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19090,7 +19090,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19263,7 +19263,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19452,7 +19452,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19625,7 +19625,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19814,7 +19814,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -19987,7 +19987,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -20176,7 +20176,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -20349,7 +20349,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -20533,7 +20533,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -20722,7 +20722,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -20900,7 +20900,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21073,7 +21073,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21262,7 +21262,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21435,7 +21435,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21624,7 +21624,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21797,7 +21797,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -21986,7 +21986,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -22159,7 +22159,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -22345,7 +22345,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -22518,7 +22518,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -22702,7 +22702,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -22891,7 +22891,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23069,7 +23069,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23242,7 +23242,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23431,7 +23431,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23604,7 +23604,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23788,7 +23788,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -23977,7 +23977,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -24155,7 +24155,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -24328,7 +24328,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -24517,7 +24517,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -24695,7 +24695,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -24868,7 +24868,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25052,7 +25052,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25241,7 +25241,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25419,7 +25419,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25592,7 +25592,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25773,7 +25773,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -25959,7 +25959,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -26132,7 +26132,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -26321,7 +26321,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -26494,7 +26494,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -26675,7 +26675,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -26864,7 +26864,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27042,7 +27042,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27215,7 +27215,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27404,7 +27404,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27577,7 +27577,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27766,7 +27766,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -27939,7 +27939,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -28128,7 +28128,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -28301,7 +28301,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -28490,7 +28490,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -28663,7 +28663,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -28852,7 +28852,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29025,7 +29025,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29209,7 +29209,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29398,7 +29398,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29571,7 +29571,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29757,7 +29757,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -29930,7 +29930,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -30114,7 +30114,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -30303,7 +30303,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -30476,7 +30476,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -30665,7 +30665,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -30838,7 +30838,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31027,7 +31027,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31205,7 +31205,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31378,7 +31378,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31567,7 +31567,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31740,7 +31740,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -31929,7 +31929,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", @@ -32102,7 +32102,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "spyware_detected", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log-expected.json index 9af8c279611..af097393e53 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-traffic-sample.log-expected.json @@ -26,7 +26,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -215,7 +215,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -398,7 +398,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -587,7 +587,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -770,7 +770,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -959,7 +959,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1148,7 +1148,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1331,7 +1331,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1520,7 +1520,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1709,7 +1709,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -1898,7 +1898,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2087,7 +2087,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2276,7 +2276,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2465,7 +2465,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2654,7 +2654,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -2843,7 +2843,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3026,7 +3026,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3215,7 +3215,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3404,7 +3404,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3593,7 +3593,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3776,7 +3776,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -3965,7 +3965,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -4154,7 +4154,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -4343,7 +4343,7 @@ "port": 4282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_dropped", @@ -4532,7 +4532,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_denied", @@ -4715,7 +4715,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4900,7 +4900,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -5086,7 +5086,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5275,7 +5275,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5464,7 +5464,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5647,7 +5647,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -5830,7 +5830,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6019,7 +6019,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6208,7 +6208,7 @@ "port": 4282 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6397,7 +6397,7 @@ "port": 17472 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6586,7 +6586,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6775,7 +6775,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -6964,7 +6964,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7153,7 +7153,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7342,7 +7342,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7531,7 +7531,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7720,7 +7720,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -7909,7 +7909,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8098,7 +8098,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8287,7 +8287,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8476,7 +8476,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8665,7 +8665,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -8854,7 +8854,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9043,7 +9043,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9232,7 +9232,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9411,7 +9411,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9600,7 +9600,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9789,7 +9789,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -9978,7 +9978,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10167,7 +10167,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10356,7 +10356,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10545,7 +10545,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10734,7 +10734,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -10923,7 +10923,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11112,7 +11112,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11301,7 +11301,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11490,7 +11490,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11679,7 +11679,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -11868,7 +11868,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -12057,7 +12057,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -12246,7 +12246,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -12435,7 +12435,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -12624,7 +12624,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -12813,7 +12813,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13002,7 +13002,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13191,7 +13191,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13380,7 +13380,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13569,7 +13569,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13758,7 +13758,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -13947,7 +13947,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -14136,7 +14136,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -14325,7 +14325,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -14514,7 +14514,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -14702,7 +14702,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -14890,7 +14890,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -15078,7 +15078,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -15266,7 +15266,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -15455,7 +15455,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -15644,7 +15644,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -15833,7 +15833,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16022,7 +16022,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16211,7 +16211,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16400,7 +16400,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16589,7 +16589,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16778,7 +16778,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -16967,7 +16967,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -17156,7 +17156,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -17345,7 +17345,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -17534,7 +17534,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -17723,7 +17723,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -17906,7 +17906,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -18095,7 +18095,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -18284,7 +18284,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -18473,7 +18473,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -18662,7 +18662,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -18850,7 +18850,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19027,7 +19027,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19200,7 +19200,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19377,7 +19377,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19554,7 +19554,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19722,7 +19722,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -19909,7 +19909,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -20087,7 +20087,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -20274,7 +20274,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -20461,7 +20461,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -20648,7 +20648,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -20834,7 +20834,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -21011,7 +21011,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -21189,7 +21189,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -21376,7 +21376,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -21554,7 +21554,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -21741,7 +21741,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -21914,7 +21914,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -22092,7 +22092,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -22279,7 +22279,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -22456,7 +22456,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -22633,7 +22633,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -22811,7 +22811,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -22999,7 +22999,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -23185,7 +23185,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -23363,7 +23363,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -23551,7 +23551,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -23737,7 +23737,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -23915,7 +23915,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -24093,7 +24093,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -24280,7 +24280,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -24457,7 +24457,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -24625,7 +24625,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -24812,7 +24812,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -24980,7 +24980,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -25167,7 +25167,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -25340,7 +25340,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -25518,7 +25518,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -25705,7 +25705,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -25882,7 +25882,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -26060,7 +26060,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -26248,7 +26248,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -26435,7 +26435,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -26613,7 +26613,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -26800,7 +26800,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -26968,7 +26968,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -27155,7 +27155,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -27332,7 +27332,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -27509,7 +27509,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -27682,7 +27682,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -27859,7 +27859,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -28037,7 +28037,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -28224,7 +28224,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -28410,7 +28410,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -28588,7 +28588,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -28775,7 +28775,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -28961,7 +28961,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -29139,7 +29139,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -29326,7 +29326,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -29513,7 +29513,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -29700,7 +29700,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -29887,7 +29887,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -30074,7 +30074,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -30260,7 +30260,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -30437,7 +30437,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -30615,7 +30615,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -30802,7 +30802,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -30980,7 +30980,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -31158,7 +31158,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -31345,7 +31345,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -31523,7 +31523,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -31710,7 +31710,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -31888,7 +31888,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -32075,7 +32075,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -32252,7 +32252,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -32425,7 +32425,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -32603,7 +32603,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -32790,7 +32790,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -32968,7 +32968,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -33155,7 +33155,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -33332,7 +33332,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -33509,7 +33509,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -33687,7 +33687,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -33874,7 +33874,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -34061,7 +34061,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -34247,7 +34247,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -34421,7 +34421,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -34608,7 +34608,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -34795,7 +34795,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -34981,7 +34981,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -35158,7 +35158,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -35335,7 +35335,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -35513,7 +35513,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -35700,7 +35700,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -35886,7 +35886,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -36063,7 +36063,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -36240,7 +36240,7 @@ "port": 30514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_terminated", @@ -36418,7 +36418,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -36605,7 +36605,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -36792,7 +36792,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", @@ -36991,7 +36991,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-tunnel-inspection-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-tunnel-inspection-sample.log-expected.json index 0a8b221bad8..ea52726b378 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-tunnel-inspection-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-tunnel-inspection-sample.log-expected.json @@ -29,7 +29,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow_started", diff --git a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-userid-sample.log-expected.json b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-userid-sample.log-expected.json index badad222ba5..948207b37fd 100644 --- a/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-userid-sample.log-expected.json +++ b/packages/panw/data_stream/panos/_dev/test/pipeline/test-panw-panos-userid-sample.log-expected.json @@ -6,7 +6,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -114,7 +114,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -210,7 +210,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -293,7 +293,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -376,7 +376,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -459,7 +459,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -542,7 +542,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -638,7 +638,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -734,7 +734,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -830,7 +830,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -924,7 +924,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1018,7 +1018,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1112,7 +1112,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1208,7 +1208,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1305,7 +1305,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1402,7 +1402,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml b/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml index c1cd913965a..efafd85fc92 100644 --- a/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml +++ b/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml @@ -242,10 +242,18 @@ processors: field: x509.subject.common_name copy_from: panw.panos.subject_common_name.value ignore_failure: true + - set: + field: x509.subject.common_name + value: ['{{{x509.subject.common_name}}}'] + if: ctx.x509?.subject?.common_name instanceof String - set: field: x509.issuer.common_name copy_from: panw.panos.issuer_common_name.value ignore_failure: true + - set: + field: x509.issuer.common_name + value: [ '{{{x509.issuer.common_name}}}' ] + if: ctx.x509?.issuer?.common_name instanceof String - set: field: rule.uuid copy_from: panw.panos.rule_uuid diff --git a/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml b/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml index 0f19d78575a..66ebd6a5cb9 100644 --- a/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml +++ b/packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Palo Alto Networks PAN-OS Logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Palo Alto Networks @@ -382,6 +382,10 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - convert: field: network.forwarded_ip type: ip diff --git a/packages/panw/data_stream/panos/sample_event.json b/packages/panw/data_stream/panos/sample_event.json index cbf4a1f283a..ddb6f94f54b 100644 --- a/packages/panw/data_stream/panos/sample_event.json +++ b/packages/panw/data_stream/panos/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2012-04-10T04:39:56.000Z", "agent": { - "ephemeral_id": "db66df65-23a5-4f27-9018-6f9258e37285", - "id": "dc5749af-742c-4ef4-9092-7bdc1f1dfcac", + "ephemeral_id": "14270b7f-dcde-4dce-a132-6579ebe118a0", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "panw.panos", @@ -31,12 +31,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "dc5749af-742c-4ef4-9092-7bdc1f1dfcac", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -48,7 +48,7 @@ ], "created": "2012-10-30T09:46:12.000Z", "dataset": "panw.panos", - "ingested": "2023-05-12T09:06:49Z", + "ingested": "2023-08-07T14:52:26Z", "kind": "alert", "original": "\u003c14\u003eNov 30 16:09:08 PA-220 1,2012/10/30 09:46:12,01606001116,THREAT,url,1,2012/04/10 04:39:56,192.168.0.2,175.16.199.1,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:58,25149,1,59309,80,0,0,0x208000,tcp,alert,\"lorexx.cn/loader.exe\",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html", "outcome": "success", @@ -68,7 +68,7 @@ "log": { "level": "informational", "source": { - "address": "172.21.0.4:42732" + "address": "192.168.176.4:41606" }, "syslog": { "facility": { diff --git a/packages/panw/docs/README.md b/packages/panw/docs/README.md index 5d55eee542e..c3625bd8d2b 100644 --- a/packages/panw/docs/README.md +++ b/packages/panw/docs/README.md @@ -34,11 +34,11 @@ An example event for `panos` looks as following: { "@timestamp": "2012-04-10T04:39:56.000Z", "agent": { - "ephemeral_id": "db66df65-23a5-4f27-9018-6f9258e37285", - "id": "dc5749af-742c-4ef4-9092-7bdc1f1dfcac", + "ephemeral_id": "14270b7f-dcde-4dce-a132-6579ebe118a0", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "panw.panos", @@ -64,12 +64,12 @@ An example event for `panos` looks as following: "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "dc5749af-742c-4ef4-9092-7bdc1f1dfcac", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "url_filtering", @@ -81,7 +81,7 @@ An example event for `panos` looks as following: ], "created": "2012-10-30T09:46:12.000Z", "dataset": "panw.panos", - "ingested": "2023-05-12T09:06:49Z", + "ingested": "2023-08-07T14:52:26Z", "kind": "alert", "original": "\u003c14\u003eNov 30 16:09:08 PA-220 1,2012/10/30 09:46:12,01606001116,THREAT,url,1,2012/04/10 04:39:56,192.168.0.2,175.16.199.1,0.0.0.0,0.0.0.0,rule1,crusher,,web-browsing,vsys1,trust,untrust,ethernet1/2,ethernet1/1,forwardAll,2012/04/10 04:39:58,25149,1,59309,80,0,0,0x208000,tcp,alert,\"lorexx.cn/loader.exe\",(9999),not-resolved,informational,client-to-server,0,0x0,192.168.0.0-192.168.255.255,United States,0,text/html", "outcome": "success", @@ -101,7 +101,7 @@ An example event for `panos` looks as following: "log": { "level": "informational", "source": { - "address": "172.21.0.4:42732" + "address": "192.168.176.4:41606" }, "syslog": { "facility": { @@ -262,17 +262,17 @@ An example event for `panos` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.name | Name of the file including the extension, without the directory. | keyword | diff --git a/packages/panw/img/filebeat-panw-threat.png b/packages/panw/img/filebeat-panw-threat.png deleted file mode 100644 index 46959b21a75..00000000000 Binary files a/packages/panw/img/filebeat-panw-threat.png and /dev/null differ diff --git a/packages/panw/img/filebeat-panw-traffic.png b/packages/panw/img/filebeat-panw-traffic.png deleted file mode 100644 index ef9d5f706ec..00000000000 Binary files a/packages/panw/img/filebeat-panw-traffic.png and /dev/null differ diff --git a/packages/panw/img/panw-threat.png b/packages/panw/img/panw-threat.png new file mode 100644 index 00000000000..a3d26a9e876 Binary files /dev/null and b/packages/panw/img/panw-threat.png differ diff --git a/packages/panw/img/panw-traffic.png b/packages/panw/img/panw-traffic.png new file mode 100644 index 00000000000..eedc872a961 Binary files /dev/null and b/packages/panw/img/panw-traffic.png differ diff --git a/packages/panw/kibana/dashboard/panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e.json index 6b7ba754712..2b7221a1c12 100644 --- a/packages/panw/kibana/dashboard/panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e.json @@ -1,72 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS HIP Match and Correlated Events Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": [ - "HIP-MATCH", - "HIPMATCH", - "CORRELATION" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "panw.panos.type": "HIP-MATCH" - } - }, - { - "match_phrase": { - "panw.panos.type": "HIPMATCH" - } - }, - { - "match_phrase": { - "panw.panos.type": "CORRELATION" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -76,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -85,23 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-c84bd12b-13d4-4cd1-99cb-e08d7d4f152b", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-c84bd12b-13d4-4cd1-99cb-e08d7d4f152b", + "name": "2ed8a933-1445-4b6e-857c-684ab495d1bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "83359769-e1cc-4aea-948f-483cec21606c", + "name": "ae15c692-ae08-4158-a53a-d68391d137c1", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c84bd12b-13d4-4cd1-99cb-e08d7d4f152b": { "columnOrder": [ @@ -157,14 +97,18 @@ "meta": { "alias": null, "disabled": false, - "index": "83359769-e1cc-4aea-948f-483cec21606c", + "index": "2ed8a933-1445-4b6e-857c-684ab495d1bf", "key": "panw.panos.type", "negate": false, "params": [ "HIP-MATCH", "HIPMATCH" ], - "type": "phrases" + "type": "phrases", + "value": [ + "HIP-MATCH", + "HIPMATCH" + ] }, "query": { "bool": { @@ -183,8 +127,31 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ae15c692-ae08-4158-a53a-d68391d137c1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -193,15 +160,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "213aacfe-f046-4624-b371-f854e932f413" - ], "layerId": "c84bd12b-13d4-4cd1-99cb-e08d7d4f152b", "layerType": "data", "legendDisplay": "default", - "metric": "bef17b31-4c6f-42cf-b272-cd400397487c", + "legendSize": "auto", + "metrics": [ + "bef17b31-4c6f-42cf-b272-cd400397487c" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "213aacfe-f046-4624-b371-f854e932f413" + ] } ], "shape": "pie" @@ -224,7 +194,7 @@ "panelIndex": "a022bf97-bef4-4918-ac28-4c48f0dbc048", "title": "Distribution of HIP Events by Operating System [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -232,23 +202,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-7f464e45-4071-44f2-b122-136cc384955a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-7f464e45-4071-44f2-b122-136cc384955a", + "name": "dfa30ce2-178d-4ccb-bfea-c6f940ad6f04", "type": "index-pattern" }, { "id": "logs-*", - "name": "e78b119a-21eb-4011-8514-0db6dfd3569c", + "name": "999acd4c-8942-485c-a5b9-7b216c95de58", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7f464e45-4071-44f2-b122-136cc384955a": { "columnOrder": [ @@ -304,14 +275,18 @@ "meta": { "alias": null, "disabled": false, - "index": "e78b119a-21eb-4011-8514-0db6dfd3569c", + "index": "dfa30ce2-178d-4ccb-bfea-c6f940ad6f04", "key": "panw.panos.type", "negate": false, "params": [ "HIP-MATCH", "HIPMATCH" ], - "type": "phrases" + "type": "phrases", + "value": [ + "HIP-MATCH", + "HIPMATCH" + ] }, "query": { "bool": { @@ -330,8 +305,31 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "999acd4c-8942-485c-a5b9-7b216c95de58", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -368,6 +366,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -396,7 +395,7 @@ "panelIndex": "c3058ed9-5860-4652-a8aa-86b0a2a46806", "title": "Distribution of HIP Events by HIP Match Name [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -404,23 +403,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-13017eeb-8282-4291-a21c-aad1432731cf", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-13017eeb-8282-4291-a21c-aad1432731cf", + "name": "a37a23d9-6dd3-48de-8eb8-800375bdd97e", "type": "index-pattern" }, { "id": "logs-*", - "name": "356e9104-efe9-45d0-91cb-bb1e1a4c4263", + "name": "76bdc137-ad5f-4e9a-bbbe-985d0889b3df", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "13017eeb-8282-4291-a21c-aad1432731cf": { "columnOrder": [ @@ -476,14 +476,18 @@ "meta": { "alias": null, "disabled": false, - "index": "356e9104-efe9-45d0-91cb-bb1e1a4c4263", + "index": "a37a23d9-6dd3-48de-8eb8-800375bdd97e", "key": "panw.panos.type", "negate": false, "params": [ "HIP-MATCH", "HIPMATCH" ], - "type": "phrases" + "type": "phrases", + "value": [ + "HIP-MATCH", + "HIPMATCH" + ] }, "query": { "bool": { @@ -502,8 +506,31 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "76bdc137-ad5f-4e9a-bbbe-985d0889b3df", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -512,15 +539,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c76c4451-34be-4ce1-b91c-9f4cd84cd693" - ], "layerId": "13017eeb-8282-4291-a21c-aad1432731cf", "layerType": "data", "legendDisplay": "default", - "metric": "12ec2de6-7681-4d61-8772-15389b3df118", + "legendSize": "auto", + "metrics": [ + "12ec2de6-7681-4d61-8772-15389b3df118" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c76c4451-34be-4ce1-b91c-9f4cd84cd693" + ] } ], "shape": "pie" @@ -543,7 +573,7 @@ "panelIndex": "2ec6098c-96f5-43d7-b068-7a155484fde2", "title": "Distribution of HIP Events by HIP Match Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -551,23 +581,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-ecea3039-c2bb-4d00-94c8-8cdc634e78e5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ecea3039-c2bb-4d00-94c8-8cdc634e78e5", + "name": "d5c55aee-b97a-4760-84a7-c1d0f2c581ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "f5203a4e-ee69-4af3-852e-888595bf53ee", + "name": "a1499a5f-54f5-48a5-9c4d-6030d90c413e", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ecea3039-c2bb-4d00-94c8-8cdc634e78e5": { "columnOrder": [ @@ -623,7 +654,7 @@ "meta": { "alias": null, "disabled": false, - "index": "f5203a4e-ee69-4af3-852e-888595bf53ee", + "index": "d5c55aee-b97a-4760-84a7-c1d0f2c581ce", "key": "panw.panos.type", "negate": false, "params": { @@ -636,8 +667,31 @@ "panw.panos.type": "CORRELATION" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a1499a5f-54f5-48a5-9c4d-6030d90c413e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -646,15 +700,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d4d2f14d-b7e3-4ad9-a00b-b6de8e0c3362" - ], "layerId": "ecea3039-c2bb-4d00-94c8-8cdc634e78e5", "layerType": "data", "legendDisplay": "default", - "metric": "50b7a409-5678-4e93-a760-f08c03f4f9a5", + "legendSize": "auto", + "metrics": [ + "50b7a409-5678-4e93-a760-f08c03f4f9a5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d4d2f14d-b7e3-4ad9-a00b-b6de8e0c3362" + ] } ], "shape": "pie" @@ -677,7 +734,7 @@ "panelIndex": "7d23e185-ac62-4c2a-9538-c8a08d972231", "title": "Distribution of Correlated Events by Severity [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -685,23 +742,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-d6ba7cff-ca10-4ab8-826f-dcfa8ce68d0e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-d6ba7cff-ca10-4ab8-826f-dcfa8ce68d0e", + "name": "11a78850-29cf-41ca-846c-64511fcc1241", "type": "index-pattern" }, { "id": "logs-*", - "name": "d8e1578c-79d2-49b1-8cf5-f27a8be486fb", + "name": "e7d47f06-e20d-438d-bd4c-daa9727e7800", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d6ba7cff-ca10-4ab8-826f-dcfa8ce68d0e": { "columnOrder": [ @@ -757,7 +815,7 @@ "meta": { "alias": null, "disabled": false, - "index": "d8e1578c-79d2-49b1-8cf5-f27a8be486fb", + "index": "11a78850-29cf-41ca-846c-64511fcc1241", "key": "panw.panos.type", "negate": false, "params": { @@ -770,8 +828,31 @@ "panw.panos.type": "CORRELATION" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e7d47f06-e20d-438d-bd4c-daa9727e7800", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -780,15 +861,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "db7c247a-7051-46f3-ac80-76737c7c839d" - ], "layerId": "d6ba7cff-ca10-4ab8-826f-dcfa8ce68d0e", "layerType": "data", "legendDisplay": "default", - "metric": "c1834fd1-09ac-4c72-9f98-e13000c3c28a", + "legendSize": "auto", + "metrics": [ + "c1834fd1-09ac-4c72-9f98-e13000c3c28a" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "db7c247a-7051-46f3-ac80-76737c7c839d" + ] } ], "shape": "pie" @@ -811,7 +895,7 @@ "panelIndex": "fd6b1cb2-9972-45bb-933f-dd4fae739199", "title": "Distribution of Correlated Events by Correlation Object Name [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -827,7 +911,7 @@ "panelIndex": "1d88372a-3942-430d-81da-769e97f4b550", "panelRefName": "panel_1d88372a-3942-430d-81da-769e97f4b550", "type": "search", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -843,34 +927,20 @@ "panelIndex": "184022a9-caeb-489e-b6a7-0449993693f5", "panelRefName": "panel_184022a9-caeb-489e-b6a7-0449993693f5", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] HIP Match and Correlated Events", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:41:45.789Z", "id": "panw-0c0fa830-dca5-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a022bf97-bef4-4918-ac28-4c48f0dbc048:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "logs-*", "name": "a022bf97-bef4-4918-ac28-4c48f0dbc048:indexpattern-datasource-layer-c84bd12b-13d4-4cd1-99cb-e08d7d4f152b", @@ -878,12 +948,12 @@ }, { "id": "logs-*", - "name": "a022bf97-bef4-4918-ac28-4c48f0dbc048:83359769-e1cc-4aea-948f-483cec21606c", + "name": "a022bf97-bef4-4918-ac28-4c48f0dbc048:2ed8a933-1445-4b6e-857c-684ab495d1bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "c3058ed9-5860-4652-a8aa-86b0a2a46806:indexpattern-datasource-current-indexpattern", + "name": "a022bf97-bef4-4918-ac28-4c48f0dbc048:ae15c692-ae08-4158-a53a-d68391d137c1", "type": "index-pattern" }, { @@ -893,12 +963,12 @@ }, { "id": "logs-*", - "name": "c3058ed9-5860-4652-a8aa-86b0a2a46806:e78b119a-21eb-4011-8514-0db6dfd3569c", + "name": "c3058ed9-5860-4652-a8aa-86b0a2a46806:dfa30ce2-178d-4ccb-bfea-c6f940ad6f04", "type": "index-pattern" }, { "id": "logs-*", - "name": "2ec6098c-96f5-43d7-b068-7a155484fde2:indexpattern-datasource-current-indexpattern", + "name": "c3058ed9-5860-4652-a8aa-86b0a2a46806:999acd4c-8942-485c-a5b9-7b216c95de58", "type": "index-pattern" }, { @@ -908,12 +978,12 @@ }, { "id": "logs-*", - "name": "2ec6098c-96f5-43d7-b068-7a155484fde2:356e9104-efe9-45d0-91cb-bb1e1a4c4263", + "name": "2ec6098c-96f5-43d7-b068-7a155484fde2:a37a23d9-6dd3-48de-8eb8-800375bdd97e", "type": "index-pattern" }, { "id": "logs-*", - "name": "7d23e185-ac62-4c2a-9538-c8a08d972231:indexpattern-datasource-current-indexpattern", + "name": "2ec6098c-96f5-43d7-b068-7a155484fde2:76bdc137-ad5f-4e9a-bbbe-985d0889b3df", "type": "index-pattern" }, { @@ -923,12 +993,12 @@ }, { "id": "logs-*", - "name": "7d23e185-ac62-4c2a-9538-c8a08d972231:f5203a4e-ee69-4af3-852e-888595bf53ee", + "name": "7d23e185-ac62-4c2a-9538-c8a08d972231:d5c55aee-b97a-4760-84a7-c1d0f2c581ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "fd6b1cb2-9972-45bb-933f-dd4fae739199:indexpattern-datasource-current-indexpattern", + "name": "7d23e185-ac62-4c2a-9538-c8a08d972231:a1499a5f-54f5-48a5-9c4d-6030d90c413e", "type": "index-pattern" }, { @@ -938,7 +1008,12 @@ }, { "id": "logs-*", - "name": "fd6b1cb2-9972-45bb-933f-dd4fae739199:d8e1578c-79d2-49b1-8cf5-f27a8be486fb", + "name": "fd6b1cb2-9972-45bb-933f-dd4fae739199:11a78850-29cf-41ca-846c-64511fcc1241", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd6b1cb2-9972-45bb-933f-dd4fae739199:e7d47f06-e20d-438d-bd4c-daa9727e7800", "type": "index-pattern" }, { diff --git a/packages/panw/kibana/dashboard/panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e.json index 4d6b94604b6..80c42bce97c 100644 --- a/packages/panw/kibana/dashboard/panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e.json @@ -1,53 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Decryption Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": { - "query": "DECRYPTION" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "panw.panos.type": "DECRYPTION" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -57,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -66,18 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0a1f2b2a-3817-47b2-9ded-a2772d821cc1", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0a1f2b2a-3817-47b2-9ded-a2772d821cc1", + "name": "5ab0d03d-58e9-498e-81d8-4774de2e9561", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "754ee7dc-b5de-4e1c-b487-3901a6855bc4", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0a1f2b2a-3817-47b2-9ded-a2772d821cc1": { "columnOrder": [ @@ -125,7 +89,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5ab0d03d-58e9-498e-81d8-4774de2e9561", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "754ee7dc-b5de-4e1c-b487-3901a6855bc4", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -162,6 +172,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -190,7 +201,7 @@ "panelIndex": "273c129c-8842-432b-b61c-1a5f51e62780", "title": "Distribution of Decryption Events by Application [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -198,18 +209,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e3456bbd-160b-404f-9528-7405677dea0f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e3456bbd-160b-404f-9528-7405677dea0f", + "name": "a611ae1a-f156-46de-a8d7-93acd5f11efa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00967a22-526f-45cc-b295-1f654cb15978", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e3456bbd-160b-404f-9528-7405677dea0f": { "columnOrder": [ @@ -257,7 +274,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a611ae1a-f156-46de-a8d7-93acd5f11efa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "00967a22-526f-45cc-b295-1f654cb15978", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -266,15 +329,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dd605c7a-a46e-4792-bc82-ca3ce60c9f36" - ], "layerId": "e3456bbd-160b-404f-9528-7405677dea0f", "layerType": "data", "legendDisplay": "default", - "metric": "96706faa-7161-41bf-a6af-99d770fbbec1", + "legendSize": "auto", + "metrics": [ + "96706faa-7161-41bf-a6af-99d770fbbec1" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "dd605c7a-a46e-4792-bc82-ca3ce60c9f36" + ] } ], "shape": "pie" @@ -297,7 +363,7 @@ "panelIndex": "60877c36-6915-4458-9734-0045530351d2", "title": "Distribution of Decryption Events by Action taken on Session [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -305,18 +371,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f", + "name": "7dc5a43e-4c2d-48b8-991c-31db317fcf8e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "15b510a9-1c16-4c9b-9cc4-ac9e43504674", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f": { "columnOrder": [ @@ -364,7 +436,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7dc5a43e-4c2d-48b8-991c-31db317fcf8e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "15b510a9-1c16-4c9b-9cc4-ac9e43504674", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -373,15 +491,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "2aa5f290-d9db-4440-a2f7-e70f7e4e60ff" - ], "layerId": "36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f", "layerType": "data", "legendDisplay": "default", - "metric": "38e78a86-5605-4737-ac42-9d7971a4eca2", + "legendSize": "auto", + "metrics": [ + "38e78a86-5605-4737-ac42-9d7971a4eca2" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "2aa5f290-d9db-4440-a2f7-e70f7e4e60ff" + ] } ], "shape": "pie" @@ -404,7 +525,7 @@ "panelIndex": "fc2e238c-bfdb-46bf-8058-4247a049c1f9", "title": "Distribution of Decryption Events by Chain Status [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -412,18 +533,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-10ee237f-72a3-4b39-985b-16d59be50d6a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-10ee237f-72a3-4b39-985b-16d59be50d6a", + "name": "218f2806-161b-41f1-86c1-6583fd6bac8b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8ed40189-83c5-4e48-8b65-6dffb4a7c9bb", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "10ee237f-72a3-4b39-985b-16d59be50d6a": { "columnOrder": [ @@ -471,7 +598,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "218f2806-161b-41f1-86c1-6583fd6bac8b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "8ed40189-83c5-4e48-8b65-6dffb4a7c9bb", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -508,6 +681,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -536,7 +710,7 @@ "panelIndex": "6591258a-e52b-45be-91e2-4f4e1b6b2ada", "title": "Distribution of Decryption Events by Proxy Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -544,18 +718,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-91f1752b-14fd-4366-a964-592e86a37d44", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-91f1752b-14fd-4366-a964-592e86a37d44", + "name": "3e6b8e7b-14a5-411a-8af9-a579ee4d873e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "54524147-f289-4118-98c0-4496dbdaa3b7", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91f1752b-14fd-4366-a964-592e86a37d44": { "columnOrder": [ @@ -603,7 +783,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3e6b8e7b-14a5-411a-8af9-a579ee4d873e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "54524147-f289-4118-98c0-4496dbdaa3b7", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -640,7 +866,7 @@ "panelIndex": "535ac774-beac-497a-8638-564774234ede", "title": "Top 10 Error [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -648,18 +874,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0a283787-56f6-4ce7-a9f0-91bdd61831ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0a283787-56f6-4ce7-a9f0-91bdd61831ce", + "name": "bda568b8-d1dd-4f29-8267-aa5c37392ccc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6ccc868f-6fed-4557-b9e5-faf6a12c898b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0a283787-56f6-4ce7-a9f0-91bdd61831ce": { "columnOrder": [ @@ -707,7 +939,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "bda568b8-d1dd-4f29-8267-aa5c37392ccc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "6ccc868f-6fed-4557-b9e5-faf6a12c898b", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -742,7 +1020,7 @@ "panelIndex": "e683dc3b-605f-41e5-8032-11433a7d70be", "title": "Top 10 Server Name Indication with most Failed Connections [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -750,18 +1028,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-9ad4ffee-bb6c-4326-aa74-a134b520da03", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-9ad4ffee-bb6c-4326-aa74-a134b520da03", + "name": "7016535d-a6fa-446f-a69c-d553028cd7c3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d22fd019-ffba-41db-b60d-26ce9af1fa3d", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9ad4ffee-bb6c-4326-aa74-a134b520da03": { "columnOrder": [ @@ -809,7 +1093,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7016535d-a6fa-446f-a69c-d553028cd7c3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "d22fd019-ffba-41db-b60d-26ce9af1fa3d", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -846,7 +1176,7 @@ "panelIndex": "b68d2d9e-6dee-47fb-8918-51e47b18ead0", "title": "Top 10 Source Address with most Failed Connections [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -854,18 +1184,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-261ac1f2-5198-4650-a17b-15c7b57ee371", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-261ac1f2-5198-4650-a17b-15c7b57ee371", + "name": "5123edc1-a51f-4784-b327-61bf73eed242", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "995377e7-e067-4e75-9c4d-1b312b30e892", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "261ac1f2-5198-4650-a17b-15c7b57ee371": { "columnOrder": [ @@ -913,7 +1249,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5123edc1-a51f-4784-b327-61bf73eed242", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "995377e7-e067-4e75-9c4d-1b312b30e892", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -950,7 +1332,7 @@ "panelIndex": "e31c9509-4414-4cf5-827a-3df1714c8f3f", "title": "Top 10 Destination Address with most Failed Connections [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -958,18 +1340,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-03ce0c58-ab6f-4550-bc18-39fd5cbee55a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-03ce0c58-ab6f-4550-bc18-39fd5cbee55a", + "name": "74ff52b5-181a-456a-aba9-6c38c1e77edb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b8142f83-b0b3-473f-a39f-a2600eb4c166", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "03ce0c58-ab6f-4550-bc18-39fd5cbee55a": { "columnOrder": [ @@ -1017,7 +1405,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "74ff52b5-181a-456a-aba9-6c38c1e77edb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "b8142f83-b0b3-473f-a39f-a2600eb4c166", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1052,6 +1486,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1080,7 +1515,7 @@ "panelIndex": "d57fec0d-1edb-4f4e-bd99-5dddec0bf3bd", "title": "Distribution of Decryption Events by Key Exchange Algorithm [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1088,18 +1523,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e26158f2-dce6-4e2e-9d82-1b9072dcb9e3", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e26158f2-dce6-4e2e-9d82-1b9072dcb9e3", + "name": "99b7a2ed-e196-4f62-9aeb-24dbdede28fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ecda6594-f0b6-4b72-a112-0f20d86b1fcf", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e26158f2-dce6-4e2e-9d82-1b9072dcb9e3": { "columnOrder": [ @@ -1147,7 +1588,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "99b7a2ed-e196-4f62-9aeb-24dbdede28fb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "ecda6594-f0b6-4b72-a112-0f20d86b1fcf", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1184,6 +1671,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1212,7 +1700,7 @@ "panelIndex": "298f3f11-1cbf-4a06-a02a-df2eecd1fa93", "title": "Distribution of Decryption Events by Encryption Algorithm [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1220,18 +1708,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-2bdbdf21-3cdc-4a09-9527-0cf6b034952b", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-2bdbdf21-3cdc-4a09-9527-0cf6b034952b", + "name": "36b3f065-ca87-45ac-9516-6674dbfd8459", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "24a7e8c0-80ad-4069-8727-3b36b5613202", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2bdbdf21-3cdc-4a09-9527-0cf6b034952b": { "columnOrder": [ @@ -1325,7 +1819,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "36b3f065-ca87-45ac-9516-6674dbfd8459", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "24a7e8c0-80ad-4069-8727-3b36b5613202", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1369,7 +1909,7 @@ "panelIndex": "01669ea1-9180-42ff-8cc8-05a23c12780e", "title": "Top 10 Decryption Events with Highest Application Risk [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1377,18 +1917,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0a46389d-3f5c-4328-b48a-fe24ecd5486c", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0a46389d-3f5c-4328-b48a-fe24ecd5486c", + "name": "967f48d5-4c00-448f-8aba-10ba6d1fb642", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6f0e0d06-6061-4320-a98d-1e3127279072", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0a46389d-3f5c-4328-b48a-fe24ecd5486c": { "columnOrder": [ @@ -1436,7 +1982,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "967f48d5-4c00-448f-8aba-10ba6d1fb642", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "6f0e0d06-6061-4320-a98d-1e3127279072", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1473,6 +2065,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1501,7 +2094,7 @@ "panelIndex": "91822551-bc1a-4aec-af03-80405ca46542", "title": "Distribution of Decryption Events by Hash Algorithm [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1517,62 +2110,63 @@ "panelIndex": "60d06a77-6706-46d9-b97f-1cc189450891", "panelRefName": "panel_60d06a77-6706-46d9-b97f-1cc189450891", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Decryption", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:39:38.483Z", "id": "panw-42d2b320-dcec-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "273c129c-8842-432b-b61c-1a5f51e62780:indexpattern-datasource-layer-0a1f2b2a-3817-47b2-9ded-a2772d821cc1", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "273c129c-8842-432b-b61c-1a5f51e62780:5ab0d03d-58e9-498e-81d8-4774de2e9561", "type": "index-pattern" }, { "id": "logs-*", - "name": "273c129c-8842-432b-b61c-1a5f51e62780:indexpattern-datasource-current-indexpattern", + "name": "273c129c-8842-432b-b61c-1a5f51e62780:754ee7dc-b5de-4e1c-b487-3901a6855bc4", "type": "index-pattern" }, { "id": "logs-*", - "name": "273c129c-8842-432b-b61c-1a5f51e62780:indexpattern-datasource-layer-0a1f2b2a-3817-47b2-9ded-a2772d821cc1", + "name": "60877c36-6915-4458-9734-0045530351d2:indexpattern-datasource-layer-e3456bbd-160b-404f-9528-7405677dea0f", "type": "index-pattern" }, { "id": "logs-*", - "name": "60877c36-6915-4458-9734-0045530351d2:indexpattern-datasource-current-indexpattern", + "name": "60877c36-6915-4458-9734-0045530351d2:a611ae1a-f156-46de-a8d7-93acd5f11efa", "type": "index-pattern" }, { "id": "logs-*", - "name": "60877c36-6915-4458-9734-0045530351d2:indexpattern-datasource-layer-e3456bbd-160b-404f-9528-7405677dea0f", + "name": "60877c36-6915-4458-9734-0045530351d2:00967a22-526f-45cc-b295-1f654cb15978", "type": "index-pattern" }, { "id": "logs-*", - "name": "fc2e238c-bfdb-46bf-8058-4247a049c1f9:indexpattern-datasource-current-indexpattern", + "name": "fc2e238c-bfdb-46bf-8058-4247a049c1f9:indexpattern-datasource-layer-36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f", "type": "index-pattern" }, { "id": "logs-*", - "name": "fc2e238c-bfdb-46bf-8058-4247a049c1f9:indexpattern-datasource-layer-36bcd8e7-dfb0-435b-9d4f-684c5de8bd6f", + "name": "fc2e238c-bfdb-46bf-8058-4247a049c1f9:7dc5a43e-4c2d-48b8-991c-31db317fcf8e", "type": "index-pattern" }, { "id": "logs-*", - "name": "6591258a-e52b-45be-91e2-4f4e1b6b2ada:indexpattern-datasource-current-indexpattern", + "name": "fc2e238c-bfdb-46bf-8058-4247a049c1f9:15b510a9-1c16-4c9b-9cc4-ac9e43504674", "type": "index-pattern" }, { @@ -1582,7 +2176,12 @@ }, { "id": "logs-*", - "name": "535ac774-beac-497a-8638-564774234ede:indexpattern-datasource-current-indexpattern", + "name": "6591258a-e52b-45be-91e2-4f4e1b6b2ada:218f2806-161b-41f1-86c1-6583fd6bac8b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6591258a-e52b-45be-91e2-4f4e1b6b2ada:8ed40189-83c5-4e48-8b65-6dffb4a7c9bb", "type": "index-pattern" }, { @@ -1592,7 +2191,12 @@ }, { "id": "logs-*", - "name": "e683dc3b-605f-41e5-8032-11433a7d70be:indexpattern-datasource-current-indexpattern", + "name": "535ac774-beac-497a-8638-564774234ede:3e6b8e7b-14a5-411a-8af9-a579ee4d873e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "535ac774-beac-497a-8638-564774234ede:54524147-f289-4118-98c0-4496dbdaa3b7", "type": "index-pattern" }, { @@ -1602,7 +2206,12 @@ }, { "id": "logs-*", - "name": "b68d2d9e-6dee-47fb-8918-51e47b18ead0:indexpattern-datasource-current-indexpattern", + "name": "e683dc3b-605f-41e5-8032-11433a7d70be:bda568b8-d1dd-4f29-8267-aa5c37392ccc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e683dc3b-605f-41e5-8032-11433a7d70be:6ccc868f-6fed-4557-b9e5-faf6a12c898b", "type": "index-pattern" }, { @@ -1612,7 +2221,12 @@ }, { "id": "logs-*", - "name": "e31c9509-4414-4cf5-827a-3df1714c8f3f:indexpattern-datasource-current-indexpattern", + "name": "b68d2d9e-6dee-47fb-8918-51e47b18ead0:7016535d-a6fa-446f-a69c-d553028cd7c3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b68d2d9e-6dee-47fb-8918-51e47b18ead0:d22fd019-ffba-41db-b60d-26ce9af1fa3d", "type": "index-pattern" }, { @@ -1622,7 +2236,12 @@ }, { "id": "logs-*", - "name": "d57fec0d-1edb-4f4e-bd99-5dddec0bf3bd:indexpattern-datasource-current-indexpattern", + "name": "e31c9509-4414-4cf5-827a-3df1714c8f3f:5123edc1-a51f-4784-b327-61bf73eed242", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e31c9509-4414-4cf5-827a-3df1714c8f3f:995377e7-e067-4e75-9c4d-1b312b30e892", "type": "index-pattern" }, { @@ -1632,7 +2251,12 @@ }, { "id": "logs-*", - "name": "298f3f11-1cbf-4a06-a02a-df2eecd1fa93:indexpattern-datasource-current-indexpattern", + "name": "d57fec0d-1edb-4f4e-bd99-5dddec0bf3bd:74ff52b5-181a-456a-aba9-6c38c1e77edb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d57fec0d-1edb-4f4e-bd99-5dddec0bf3bd:b8142f83-b0b3-473f-a39f-a2600eb4c166", "type": "index-pattern" }, { @@ -1642,7 +2266,12 @@ }, { "id": "logs-*", - "name": "01669ea1-9180-42ff-8cc8-05a23c12780e:indexpattern-datasource-current-indexpattern", + "name": "298f3f11-1cbf-4a06-a02a-df2eecd1fa93:99b7a2ed-e196-4f62-9aeb-24dbdede28fb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "298f3f11-1cbf-4a06-a02a-df2eecd1fa93:ecda6594-f0b6-4b72-a112-0f20d86b1fcf", "type": "index-pattern" }, { @@ -1652,7 +2281,12 @@ }, { "id": "logs-*", - "name": "91822551-bc1a-4aec-af03-80405ca46542:indexpattern-datasource-current-indexpattern", + "name": "01669ea1-9180-42ff-8cc8-05a23c12780e:36b3f065-ca87-45ac-9516-6674dbfd8459", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "01669ea1-9180-42ff-8cc8-05a23c12780e:24a7e8c0-80ad-4069-8727-3b36b5613202", "type": "index-pattern" }, { @@ -1660,6 +2294,16 @@ "name": "91822551-bc1a-4aec-af03-80405ca46542:indexpattern-datasource-layer-0a46389d-3f5c-4328-b48a-fe24ecd5486c", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "91822551-bc1a-4aec-af03-80405ca46542:967f48d5-4c00-448f-8aba-10ba6d1fb642", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91822551-bc1a-4aec-af03-80405ca46542:6f0e0d06-6061-4320-a98d-1e3127279072", + "type": "index-pattern" + }, { "id": "panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4", "name": "60d06a77-6706-46d9-b97f-1cc189450891:panel_60d06a77-6706-46d9-b97f-1cc189450891", diff --git a/packages/panw/kibana/dashboard/panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e.json index 9e9a030600b..027e819f6bd 100644 --- a/packages/panw/kibana/dashboard/panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e.json @@ -1,53 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Authentication Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": { - "query": "AUTHENTICATION" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "panw.panos.type": "AUTHENTICATION" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -57,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -66,18 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e52d1a17-8798-4630-9614-4cb542506555", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e52d1a17-8798-4630-9614-4cb542506555", + "name": "ab5c2bf2-6e7f-4ca2-a94e-05a787198d31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "add32f1c-131c-442f-842a-da26a85f52d0", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e52d1a17-8798-4630-9614-4cb542506555": { "columnOrder": [ @@ -125,7 +89,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "ab5c2bf2-6e7f-4ca2-a94e-05a787198d31", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "add32f1c-131c-442f-842a-da26a85f52d0", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "AUTHENTICATION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "AUTHENTICATION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -134,15 +144,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dfea1029-8c01-41c7-b84b-088f6e614cfc" - ], "layerId": "e52d1a17-8798-4630-9614-4cb542506555", "layerType": "data", "legendDisplay": "default", - "metric": "0c196e85-7a8b-439c-9011-fe2f81668719", + "legendSize": "auto", + "metrics": [ + "0c196e85-7a8b-439c-9011-fe2f81668719" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "dfea1029-8c01-41c7-b84b-088f6e614cfc" + ] } ], "shape": "pie" @@ -165,7 +178,7 @@ "panelIndex": "21b7d1ad-b200-4fce-b8cb-7847e32ab480", "title": "Distribution of Authentication Events by Client Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -173,18 +186,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-073d7d3a-fa2f-4f19-98cc-ea964520d7c5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-073d7d3a-fa2f-4f19-98cc-ea964520d7c5", + "name": "c107d7a9-e2fd-4787-ac6f-bae8f8816039", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d076ecfc-eb83-435f-bb0b-950f7cf42cfa", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "073d7d3a-fa2f-4f19-98cc-ea964520d7c5": { "columnOrder": [ @@ -232,7 +251,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c107d7a9-e2fd-4787-ac6f-bae8f8816039", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "d076ecfc-eb83-435f-bb0b-950f7cf42cfa", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "AUTHENTICATION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "AUTHENTICATION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -241,15 +306,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c5c05e1c-2dd6-4eb1-bf00-705ebf64f775" - ], "layerId": "073d7d3a-fa2f-4f19-98cc-ea964520d7c5", "layerType": "data", "legendDisplay": "default", - "metric": "b518d262-9d79-412e-b15d-9bc5be6261b3", + "legendSize": "auto", + "metrics": [ + "b518d262-9d79-412e-b15d-9bc5be6261b3" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c5c05e1c-2dd6-4eb1-bf00-705ebf64f775" + ] } ], "shape": "pie" @@ -272,7 +340,7 @@ "panelIndex": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee", "title": "Distribution of Authentication Events by Authentication Protocol [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -280,18 +348,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-6fa71679-0b9a-44c0-b19d-d810670058ec", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6fa71679-0b9a-44c0-b19d-d810670058ec", + "name": "f51e4cca-fc2d-494c-8f6f-c3cea8a985ca", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bd51c50c-1d54-4d83-85df-874ae4a44e19", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6fa71679-0b9a-44c0-b19d-d810670058ec": { "columnOrder": [ @@ -339,7 +413,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f51e4cca-fc2d-494c-8f6f-c3cea8a985ca", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "bd51c50c-1d54-4d83-85df-874ae4a44e19", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "AUTHENTICATION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "AUTHENTICATION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -376,6 +496,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -404,7 +525,7 @@ "panelIndex": "bdf830aa-fe16-49fb-bb72-17542e5932f5", "title": "Distribution of Authentication Events by Authentication Policy [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -412,18 +533,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-4811ae4b-f894-4276-b730-320888d3aeb6", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-4811ae4b-f894-4276-b730-320888d3aeb6", + "name": "4d4073b1-b9dd-4642-ae5f-7d0d4a590245", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c646a38c-c510-4eac-aeeb-ae76a9e31568", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4811ae4b-f894-4276-b730-320888d3aeb6": { "columnOrder": [ @@ -471,7 +598,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4d4073b1-b9dd-4642-ae5f-7d0d4a590245", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "c646a38c-c510-4eac-aeeb-ae76a9e31568", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "AUTHENTICATION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "AUTHENTICATION" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -480,15 +653,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "36af69fb-3b5d-4e0d-952a-7a8bdeda6e8e" - ], "layerId": "4811ae4b-f894-4276-b730-320888d3aeb6", "layerType": "data", "legendDisplay": "default", - "metric": "a5ed43f4-74ed-4671-a6db-b746ebcd4aa7", + "legendSize": "auto", + "metrics": [ + "a5ed43f4-74ed-4671-a6db-b746ebcd4aa7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "36af69fb-3b5d-4e0d-952a-7a8bdeda6e8e" + ] } ], "shape": "pie" @@ -511,7 +687,7 @@ "panelIndex": "249ca03f-fdfb-49c7-8eaa-b0f8a65f879c", "title": "Distribution of Authentication Events by Event Outcome [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -527,62 +703,63 @@ "panelIndex": "d56dc109-3cca-4989-a0d0-dc7ad005e962", "panelRefName": "panel_d56dc109-3cca-4989-a0d0-dc7ad005e962", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Authentication ", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:34:39.650Z", "id": "panw-4782db40-dccc-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "21b7d1ad-b200-4fce-b8cb-7847e32ab480:indexpattern-datasource-layer-e52d1a17-8798-4630-9614-4cb542506555", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "21b7d1ad-b200-4fce-b8cb-7847e32ab480:ab5c2bf2-6e7f-4ca2-a94e-05a787198d31", "type": "index-pattern" }, { "id": "logs-*", - "name": "21b7d1ad-b200-4fce-b8cb-7847e32ab480:indexpattern-datasource-current-indexpattern", + "name": "21b7d1ad-b200-4fce-b8cb-7847e32ab480:add32f1c-131c-442f-842a-da26a85f52d0", "type": "index-pattern" }, { "id": "logs-*", - "name": "21b7d1ad-b200-4fce-b8cb-7847e32ab480:indexpattern-datasource-layer-e52d1a17-8798-4630-9614-4cb542506555", + "name": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee:indexpattern-datasource-layer-073d7d3a-fa2f-4f19-98cc-ea964520d7c5", "type": "index-pattern" }, { "id": "logs-*", - "name": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee:indexpattern-datasource-current-indexpattern", + "name": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee:c107d7a9-e2fd-4787-ac6f-bae8f8816039", "type": "index-pattern" }, { "id": "logs-*", - "name": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee:indexpattern-datasource-layer-073d7d3a-fa2f-4f19-98cc-ea964520d7c5", + "name": "b88c12a4-6370-4960-8a73-cee4ea7cc8ee:d076ecfc-eb83-435f-bb0b-950f7cf42cfa", "type": "index-pattern" }, { "id": "logs-*", - "name": "bdf830aa-fe16-49fb-bb72-17542e5932f5:indexpattern-datasource-current-indexpattern", + "name": "bdf830aa-fe16-49fb-bb72-17542e5932f5:indexpattern-datasource-layer-6fa71679-0b9a-44c0-b19d-d810670058ec", "type": "index-pattern" }, { "id": "logs-*", - "name": "bdf830aa-fe16-49fb-bb72-17542e5932f5:indexpattern-datasource-layer-6fa71679-0b9a-44c0-b19d-d810670058ec", + "name": "bdf830aa-fe16-49fb-bb72-17542e5932f5:f51e4cca-fc2d-494c-8f6f-c3cea8a985ca", "type": "index-pattern" }, { "id": "logs-*", - "name": "249ca03f-fdfb-49c7-8eaa-b0f8a65f879c:indexpattern-datasource-current-indexpattern", + "name": "bdf830aa-fe16-49fb-bb72-17542e5932f5:bd51c50c-1d54-4d83-85df-874ae4a44e19", "type": "index-pattern" }, { @@ -590,6 +767,16 @@ "name": "249ca03f-fdfb-49c7-8eaa-b0f8a65f879c:indexpattern-datasource-layer-4811ae4b-f894-4276-b730-320888d3aeb6", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "249ca03f-fdfb-49c7-8eaa-b0f8a65f879c:4d4073b1-b9dd-4642-ae5f-7d0d4a590245", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "249ca03f-fdfb-49c7-8eaa-b0f8a65f879c:c646a38c-c510-4eac-aeeb-ae76a9e31568", + "type": "index-pattern" + }, { "id": "panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e", "name": "d56dc109-3cca-4989-a0d0-dc7ad005e962:panel_d56dc109-3cca-4989-a0d0-dc7ad005e962", diff --git a/packages/panw/kibana/dashboard/panw-772964e0-7591-11e9-aacf-79a3704914a0.json b/packages/panw/kibana/dashboard/panw-772964e0-7591-11e9-aacf-79a3704914a0.json index 6c568adc807..3829e7ca72f 100644 --- a/packages/panw/kibana/dashboard/panw-772964e0-7591-11e9-aacf-79a3704914a0.json +++ b/packages/panw/kibana/dashboard/panw-772964e0-7591-11e9-aacf-79a3704914a0.json @@ -1,53 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Threats Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": { - "query": "THREAT" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "panw.panos.type": "THREAT" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -56,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -65,132 +24,38 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-36228c56-1fc8-48db-a81d-241b52c9ff89", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-a3d05f76-dd3f-4d40-931b-a59e7ea49080", + "name": "3e898ef2-a25e-42eb-91b3-749b89f764e4", "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "a3d05f76-dd3f-4d40-931b-a59e7ea49080": { - "columnOrder": [ - "51d4cc4b-15ac-4906-a3a8-67de279ac6ed", - "06f548fe-cd57-4d0b-9388-08ed0073a7c7" - ], - "columns": { - "06f548fe-cd57-4d0b-9388-08ed0073a7c7": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "51d4cc4b-15ac-4906-a3a8-67de279ac6ed": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Severity", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "06f548fe-cd57-4d0b-9388-08ed0073a7c7", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "log.level" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "51d4cc4b-15ac-4906-a3a8-67de279ac6ed" - ], - "layerId": "a3d05f76-dd3f-4d40-931b-a59e7ea49080", - "layerType": "data", - "legendDisplay": "default", - "metric": "06f548fe-cd57-4d0b-9388-08ed0073a7c7", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" - } - }, - "title": "Distribution of Threat Events by Severity [Logs PANW]", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "67c826e3-7781-4aca-8ff9-bc67292b1ca1", - "w": 15, - "x": 0, - "y": 38 - }, - "panelIndex": "67c826e3-7781-4aca-8ff9-bc67292b1ca1", - "title": "Distribution of Threat Events by Severity [Logs PANW]", - "type": "lens", - "version": "8.2.1" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "2654df47-dfed-46b8-b98c-9672b00fcaa0", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-d5a1b5bb-cf67-41e9-a1ad-433316867264", + "name": "c475bc3c-30eb-4be6-b95c-f0eff49216bf", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "d5a1b5bb-cf67-41e9-a1ad-433316867264": { + "36228c56-1fc8-48db-a81d-241b52c9ff89": { "columnOrder": [ - "ecd723b0-2069-4cd2-9996-5dc76e2e73ad", - "0717629b-3eba-4193-a867-d36009af50a1" + "d8fef12a-9104-4edd-aa75-556bd8c62cc8", + "938bce09-30d0-4e44-8547-b9d31b44eacd", + "63cc9268-b646-4c5c-8cbc-30a3a9b6fb2a" ], "columns": { - "0717629b-3eba-4193-a867-d36009af50a1": { + "63cc9268-b646-4c5c-8cbc-30a3a9b6fb2a": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -202,35 +67,124 @@ "scale": "ratio", "sourceField": "___records___" }, - "ecd723b0-2069-4cd2-9996-5dc76e2e73ad": { + "938bce09-30d0-4e44-8547-b9d31b44eacd": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Threat Category", + "label": "event.outcome: Descending", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "0717629b-3eba-4193-a867-d36009af50a1", + "columnId": "63cc9268-b646-4c5c-8cbc-30a3a9b6fb2a", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 10 + "size": 5 }, "scale": "ordinal", - "sourceField": "panw.panos.threat_category" + "sourceField": "event.outcome" + }, + "d8fef12a-9104-4edd-aa75-556bd8c62cc8": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" } }, "incompleteColumns": {} } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3e898ef2-a25e-42eb-91b3-749b89f764e4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "2654df47-dfed-46b8-b98c-9672b00fcaa0", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.category", + "index": "c475bc3c-30eb-4be6-b95c-f0eff49216bf", + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -241,60 +195,86 @@ "yLeft": true, "yRight": true }, - "fittingFunction": "None", + "curveType": "LINEAR", "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, + "x": false, + "yLeft": false, "yRight": true }, "labelsOrientation": { "x": 0, "yLeft": 0, - "yRight": 0 + "yRight": -90 }, "layers": [ { "accessors": [ - "0717629b-3eba-4193-a867-d36009af50a1" + "63cc9268-b646-4c5c-8cbc-30a3a9b6fb2a" ], - "layerId": "d5a1b5bb-cf67-41e9-a1ad-433316867264", + "isHistogram": true, + "layerId": "36228c56-1fc8-48db-a81d-241b52c9ff89", "layerType": "data", - "position": "top", + "palette": { + "name": "default", + "type": "palette" + }, "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "ecd723b0-2069-4cd2-9996-5dc76e2e73ad" + "simpleView": false, + "splitAccessor": "938bce09-30d0-4e44-8547-b9d31b44eacd", + "xAccessor": "d8fef12a-9104-4edd-aa75-556bd8c62cc8", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "63cc9268-b646-4c5c-8cbc-30a3a9b6fb2a" + } + ] } ], "legend": { - "isVisible": true, - "position": "right" + "isVisible": false, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true }, "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, "tickLabelsVisibilitySettings": { "x": true, "yLeft": true, "yRight": true }, - "valueLabels": "hide" + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } }, - "title": "Distribution of Threat Events by Category [Logs PANW]", + "title": "Threat outcome histogram [Logs PANW] (converted)", "type": "lens", "visualizationType": "lnsXY" }, - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "f82c318d-bd14-496b-b394-622831db934c", - "w": 16, - "x": 15, - "y": 38 + "i": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe", + "w": 31, + "x": 0, + "y": 0 }, - "panelIndex": "f82c318d-bd14-496b-b394-622831db934c", - "title": "Distribution of Threat Events by Category [Logs PANW]", + "panelIndex": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe", + "title": "Threat outcome histogram [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -302,48 +282,90 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-9b4766f8-2b1a-417a-a3f7-2824bad6248e", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-1062c7c9-1b53-4e2e-bd44-cbfd4120e98f", + "name": "faa839b2-cac0-44db-8c33-de0344c3d48d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a0679efa-ab5f-42d3-857d-b1dd108d90f4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "baf2787c-9dd7-4400-97c1-af0533f0c664", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "1062c7c9-1b53-4e2e-bd44-cbfd4120e98f": { + "9b4766f8-2b1a-417a-a3f7-2824bad6248e": { "columnOrder": [ - "66cc3a68-d2bb-441c-8a00-478163b1b8e0", - "9f65908b-8654-4491-888f-d0991db0f7a8" + "2000c7df-d34e-4ded-b854-ae33cbdf4f83", + "9179d39a-c6b1-4234-8e54-632bba375e25", + "e12cb5a7-84d4-4966-a2a9-fb4f4ffa2ad0" ], "columns": { - "66cc3a68-d2bb-441c-8a00-478163b1b8e0": { + "2000c7df-d34e-4ded-b854-ae33cbdf4f83": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Network Direction", + "label": "event.action: Descending", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "9f65908b-8654-4491-888f-d0991db0f7a8", + "columnId": "e12cb5a7-84d4-4966-a2a9-fb4f4ffa2ad0", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, "size": 5 }, "scale": "ordinal", - "sourceField": "network.direction" + "sourceField": "event.action" }, - "9f65908b-8654-4491-888f-d0991db0f7a8": { + "9179d39a-c6b1-4234-8e54-632bba375e25": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "e12cb5a7-84d4-4966-a2a9-fb4f4ffa2ad0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "e12cb5a7-84d4-4966-a2a9-fb4f4ffa2ad0": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -359,9 +381,80 @@ "incompleteColumns": {} } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "faa839b2-cac0-44db-8c33-de0344c3d48d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "a0679efa-ab5f-42d3-857d-b1dd108d90f4", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.category", + "index": "baf2787c-9dd7-4400-97c1-af0533f0c664", + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -369,38 +462,54 @@ "visualization": { "layers": [ { - "categoryDisplay": "default", - "groups": [ - "66cc3a68-d2bb-441c-8a00-478163b1b8e0" - ], - "layerId": "1062c7c9-1b53-4e2e-bd44-cbfd4120e98f", + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "9b4766f8-2b1a-417a-a3f7-2824bad6248e", "layerType": "data", - "legendDisplay": "default", - "metric": "9f65908b-8654-4491-888f-d0991db0f7a8", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "e12cb5a7-84d4-4966-a2a9-fb4f4ffa2ad0" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "2000c7df-d34e-4ded-b854-ae33cbdf4f83", + "9179d39a-c6b1-4234-8e54-632bba375e25" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true } ], - "shape": "pie" + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" } }, - "title": "Distribution of Threat Events by Network Direction [Logs PANW]", + "title": "Outcome by threat type [Logs PANW] (converted)", "type": "lens", "visualizationType": "lnsPie" }, - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "c31f75c3-c6c8-4635-aa14-83a6d98a019f", + "i": "b3292515-c2df-40ad-9412-8a7118f359f2", "w": 17, "x": 31, - "y": 38 + "y": 0 }, - "panelIndex": "c31f75c3-c6c8-4635-aa14-83a6d98a019f", - "title": "Distribution of Threat Events by Network Direction [Logs PANW]", + "panelIndex": "b3292515-c2df-40ad-9412-8a7118f359f2", + "title": "Outcome by threat type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -408,28 +517,32 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-feec85a2-070e-4f52-8ce0-1af4b41619e2", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", + "name": "5fb3d1e8-34e5-44a8-af98-4a434e022ceb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f1428f06-99f2-4f83-9c07-f5112490e516", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7": { + "feec85a2-070e-4f52-8ce0-1af4b41619e2": { "columnOrder": [ - "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca", - "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff", - "cc06ff3e-e79f-4104-91c3-4f07d432abc0", - "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef" + "676fde01-5b25-4629-8356-9528b06048cf", + "1c62ec38-e3fc-44bd-8938-73a38c985780" ], "columns": { - "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef": { + "1c62ec38-e3fc-44bd-8938-73a38c985780": { "customLabel": true, "dataType": "number", "isBucketed": false, @@ -441,79 +554,258 @@ "scale": "ratio", "sourceField": "___records___" }, - "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff": { + "676fde01-5b25-4629-8356-9528b06048cf": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Application Category", + "label": "Threat name", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef", + "columnId": "1c62ec38-e3fc-44bd-8938-73a38c985780", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, "size": 10 }, "scale": "ordinal", - "sourceField": "panw.panos.application.category" - }, - "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca": { + "sourceField": "panw.panos.threat.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5fb3d1e8-34e5-44a8-af98-4a434e022ceb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "f1428f06-99f2-4f83-9c07-f5112490e516", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "1c62ec38-e3fc-44bd-8938-73a38c985780", + "isTransposed": false + }, + { + "columnId": "676fde01-5b25-4629-8356-9528b06048cf", + "isTransposed": false + } + ], + "layerId": "feec85a2-070e-4f52-8ce0-1af4b41619e2", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "1c0fcd88-863b-4bcf-aeee-89956b333f30", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "1c0fcd88-863b-4bcf-aeee-89956b333f30", + "title": "Top threats by name [Logs PANW]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-feec85a2-070e-4f52-8ce0-1af4b41619e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "769742bc-023a-4a13-8413-faeeefbd77c4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2c9d475-ece7-4f72-a116-bdb4d6a310e2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "feec85a2-070e-4f52-8ce0-1af4b41619e2": { + "columnOrder": [ + "676fde01-5b25-4629-8356-9528b06048cf", + "1c62ec38-e3fc-44bd-8938-73a38c985780" + ], + "columns": { + "1c62ec38-e3fc-44bd-8938-73a38c985780": { "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Application Risk Level", - "operationType": "terms", + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", "params": { - "missingBucket": false, - "orderBy": { - "fallback": false, - "type": "alphabetical" - }, - "orderDirection": "desc", - "otherBucket": false, - "parentFormat": { - "id": "terms" - }, - "size": 10 + "emptyAsNull": true }, - "scale": "ordinal", - "sourceField": "panw.panos.application.risk_level" + "scale": "ratio", + "sourceField": "___records___" }, - "cc06ff3e-e79f-4104-91c3-4f07d432abc0": { + "676fde01-5b25-4629-8356-9528b06048cf": { "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "Application Technology", + "label": "Threat resource", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef", + "columnId": "1c62ec38-e3fc-44bd-8938-73a38c985780", "type": "column" }, "orderDirection": "desc", - "otherBucket": false, + "otherBucket": true, "parentFormat": { "id": "terms" }, + "secondaryFields": [], "size": 10 }, "scale": "ordinal", - "sourceField": "panw.panos.application.technology" + "sourceField": "url.original" } }, - "incompleteColumns": {} + "incompleteColumns": {}, + "sampling": 1 } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "769742bc-023a-4a13-8413-faeeefbd77c4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "e2c9d475-ece7-4f72-a116-bdb4d6a310e2", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -521,25 +813,23 @@ "visualization": { "columns": [ { - "alignment": "left", - "columnId": "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca" - }, - { - "columnId": "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff" - }, - { - "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef" + "columnId": "1c62ec38-e3fc-44bd-8938-73a38c985780", + "isTransposed": false }, { - "columnId": "cc06ff3e-e79f-4104-91c3-4f07d432abc0", + "columnId": "676fde01-5b25-4629-8356-9528b06048cf", "isTransposed": false } ], - "layerId": "cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", - "layerType": "data" + "layerId": "feec85a2-070e-4f52-8ce0-1af4b41619e2", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } } }, - "title": "Top 10 Threat Events with Highest Application Risk [Logs PANW]", + "title": "", "type": "lens", "visualizationType": "lnsDatatable" }, @@ -548,15 +838,15 @@ }, "gridData": { "h": 15, - "i": "369cb2e5-09c2-484f-902f-d21ed0b12715", - "w": 29, - "x": 0, - "y": 53 + "i": "db2483d3-c317-4ef4-a820-b35b30d8b4f8", + "w": 24, + "x": 24, + "y": 15 }, - "panelIndex": "369cb2e5-09c2-484f-902f-d21ed0b12715", - "title": "Top 10 Threat Events with Highest Application Risk [Logs PANW]", + "panelIndex": "db2483d3-c317-4ef4-a820-b35b30d8b4f8", + "title": "Top threats by resource [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -564,781 +854,1403 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-72e10196-ed51-42bc-80a6-981eedaba054", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-8a11de6f-5795-4d18-b650-7f604d291bdb", + "name": "48449bb1-67db-4694-8be0-b757b6cc6f03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bc4c14c1-9a41-42ce-8b73-7f12fbfd5936", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6eba33ee-dc7e-4b97-8529-b9bcf229a929", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "8a11de6f-5795-4d18-b650-7f604d291bdb": { + "72e10196-ed51-42bc-80a6-981eedaba054": { "columnOrder": [ - "05b09057-70e7-4477-be13-7ba86fd871d2", - "e60a92a8-1680-463d-9fb1-9f3a4ebeb900" + "7d5995cb-1f35-48be-8e0a-1832ce26ef69", + "432fdf25-b549-4af4-9eea-ad90835db297" ], "columns": { - "05b09057-70e7-4477-be13-7ba86fd871d2": { + "432fdf25-b549-4af4-9eea-ad90835db297": { "customLabel": true, - "dataType": "string", + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7d5995cb-1f35-48be-8e0a-1832ce26ef69": { + "customLabel": true, + "dataType": "ip", "isBucketed": true, - "label": "Action", + "label": "Server IP", "operationType": "terms", "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, "missingBucket": false, "orderBy": { - "columnId": "e60a92a8-1680-463d-9fb1-9f3a4ebeb900", + "columnId": "432fdf25-b549-4af4-9eea-ad90835db297", "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, - "size": 5 + "size": 10 }, "scale": "ordinal", - "sourceField": "panw.panos.action" - }, - "e60a92a8-1680-463d-9fb1-9f3a4ebeb900": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" + "sourceField": "server.ip" } }, "incompleteColumns": {} } } + }, + "textBased": { + "layers": {} } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "48449bb1-67db-4694-8be0-b757b6cc6f03", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "bc4c14c1-9a41-42ce-8b73-7f12fbfd5936", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.category", + "index": "6eba33ee-dc7e-4b97-8529-b9bcf229a929", + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "layers": [ + "columns": [ { - "categoryDisplay": "default", - "groups": [ - "05b09057-70e7-4477-be13-7ba86fd871d2" - ], - "layerId": "8a11de6f-5795-4d18-b650-7f604d291bdb", - "layerType": "data", - "legendDisplay": "default", - "metric": "e60a92a8-1680-463d-9fb1-9f3a4ebeb900", - "nestedLegend": false, - "numberDisplay": "percent" + "alignment": "left", + "columnId": "432fdf25-b549-4af4-9eea-ad90835db297" + }, + { + "alignment": "left", + "columnId": "7d5995cb-1f35-48be-8e0a-1832ce26ef69" } ], - "shape": "pie" + "headerRowHeight": "single", + "layerId": "72e10196-ed51-42bc-80a6-981eedaba054", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } }, - "title": "Distribution of Threat Events by Action taken for Session [Logs PANW]", + "title": "Top attackers (servers) [Logs PANW] (converted)", "type": "lens", - "visualizationType": "lnsPie" + "visualizationType": "lnsDatatable" }, - "enhancements": {} + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "fb7712b0-5b15-47fa-9281-a0462cbe7df3", - "w": 19, - "x": 29, - "y": 53 - }, - "panelIndex": "fb7712b0-5b15-47fa-9281-a0462cbe7df3", - "title": "Distribution of Threat Events by Action taken for Session [Logs PANW]", - "type": "lens", - "version": "8.2.1" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 20, - "i": "1908844a-1839-46f9-ab71-8b49013e83dc", - "w": 48, - "x": 0, - "y": 68 + "h": 12, + "i": "23129235-e707-47ea-95d9-f41e61c8a895", + "w": 24, + "x": 24, + "y": 30 }, - "panelIndex": "1908844a-1839-46f9-ab71-8b49013e83dc", - "panelRefName": "panel_1908844a-1839-46f9-ab71-8b49013e83dc", - "type": "search", - "version": "8.2.1" + "panelIndex": "23129235-e707-47ea-95d9-f41e61c8a895", + "title": "Top attackers (servers) [Logs PANW]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-546186fe-711b-4078-abf5-705cbb8dcc7f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5be02fa7-510c-45b8-b4c6-c4f9365f06b7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cc2643e8-66d4-47ba-af56-7307768de1ce", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "443625d1-6d30-421a-ab08-823ef98ca9c2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "546186fe-711b-4078-abf5-705cbb8dcc7f": { + "columnOrder": [ + "e0fe59aa-578d-4177-a196-eeddd9a5d830", + "d45bfed3-ee42-4e83-af8e-d4fbdf1ec37e" + ], + "columns": { + "d45bfed3-ee42-4e83-af8e-d4fbdf1ec37e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e0fe59aa-578d-4177-a196-eeddd9a5d830": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Client IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d45bfed3-ee42-4e83-af8e-d4fbdf1ec37e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extendToTimeRange": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5be02fa7-510c-45b8-b4c6-c4f9365f06b7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" }, - "useNormalizedEsInterval": true, - "used_interval": "30s" + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "position": "bottom", - "scale": { - "type": "linear" + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "cc2643e8-66d4-47ba-af56-7307768de1ce", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + }, { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.category", + "index": "443625d1-6d30-421a-ab08-823ef98ca9c2", + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + "query": { + "match_phrase": { + "event.category": "threat" + } + } } ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "d45bfed3-ee42-4e83-af8e-d4fbdf1ec37e" }, - "type": "value" - } - ] - }, - "type": "histogram", - "uiState": { - "vis": { - "legendOpen": false + { + "alignment": "left", + "columnId": "e0fe59aa-578d-4177-a196-eeddd9a5d830" + } + ], + "headerRowHeight": "single", + "layerId": "546186fe-711b-4078-abf5-705cbb8dcc7f", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Top attackers (clients) [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe", - "w": 31, + "h": 12, + "i": "10996873-dcb7-4085-96fc-6a1f618df47f", + "w": 24, "x": 0, - "y": 0 + "y": 30 }, - "panelIndex": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe", - "title": "Threat outcome histogram [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "panelIndex": "10996873-dcb7-4085-96fc-6a1f618df47f", + "title": "Top attackers (clients) [Logs PANW]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1062c7c9-1b53-4e2e-bd44-cbfd4120e98f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3edd8e99-abe4-4e31-a61a-6798a98be2dd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "14c785a7-f03a-4134-84a8-e5a31e712579", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1062c7c9-1b53-4e2e-bd44-cbfd4120e98f": { + "columnOrder": [ + "66cc3a68-d2bb-441c-8a00-478163b1b8e0", + "9f65908b-8654-4491-888f-d0991db0f7a8" + ], + "columns": { + "66cc3a68-d2bb-441c-8a00-478163b1b8e0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Network Direction", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "9f65908b-8654-4491-888f-d0991db0f7a8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + }, + "9f65908b-8654-4491-888f-d0991db0f7a8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3edd8e99-abe4-4e31-a61a-6798a98be2dd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "event.outcome", - "missingBucket": true, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "14c785a7-f03a-4134-84a8-e5a31e712579", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendDisplay": "show", - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "truncateLegend": true, - "type": "pie" - }, - "type": "pie", - "uiState": { - "vis": { - "legendOpen": true + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "1062c7c9-1b53-4e2e-bd44-cbfd4120e98f", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "9f65908b-8654-4491-888f-d0991db0f7a8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "66cc3a68-d2bb-441c-8a00-478163b1b8e0" + ] + } + ], + "shape": "pie" } - } - } + }, + "title": "Distribution of Threat Events by Network Direction [Logs PANW]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} }, "gridData": { "h": 15, - "i": "b3292515-c2df-40ad-9412-8a7118f359f2", + "i": "c31f75c3-c6c8-4635-aa14-83a6d98a019f", "w": 17, "x": 31, - "y": 0 + "y": 42 }, - "panelIndex": "b3292515-c2df-40ad-9412-8a7118f359f2", - "title": "Outcome by threat type [Logs PANW]", - "type": "visualization", - "version": "8.2.1" - }, + "panelIndex": "c31f75c3-c6c8-4635-aa14-83a6d98a019f", + "title": "Distribution of Threat Events by Network Direction [Logs PANW]", + "type": "lens", + "version": "8.7.1" + }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a3d05f76-dd3f-4d40-931b-a59e7ea49080", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f0f541b-76f2-4c92-8111-400fd5116ad3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1b0c78a3-2313-45cb-927e-e68bf9afde08", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a3d05f76-dd3f-4d40-931b-a59e7ea49080": { + "columnOrder": [ + "51d4cc4b-15ac-4906-a3a8-67de279ac6ed", + "06f548fe-cd57-4d0b-9388-08ed0073a7c7" + ], + "columns": { + "06f548fe-cd57-4d0b-9388-08ed0073a7c7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "51d4cc4b-15ac-4906-a3a8-67de279ac6ed": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "06f548fe-cd57-4d0b-9388-08ed0073a7c7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "log.level" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "4f0f541b-76f2-4c92-8111-400fd5116ad3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "panw.panos.threat.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "1b0c78a3-2313-45cb-927e-e68bf9afde08", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "scale": "linear", - "showLabel": true + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "a3d05f76-dd3f-4d40-931b-a59e7ea49080", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "06f548fe-cd57-4d0b-9388-08ed0073a7c7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "51d4cc4b-15ac-4906-a3a8-67de279ac6ed" + ] + } + ], + "shape": "pie" + } }, - "type": "tagcloud", - "uiState": {} - } + "title": "Distribution of Threat Events by Severity [Logs PANW]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} }, "gridData": { "h": 15, - "i": "4fa92d5e-402a-4544-81dc-aa3303069cd8", - "w": 24, + "i": "67c826e3-7781-4aca-8ff9-bc67292b1ca1", + "w": 15, "x": 0, - "y": 15 + "y": 42 }, - "panelIndex": "4fa92d5e-402a-4544-81dc-aa3303069cd8", - "title": "Top threats by name [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "panelIndex": "67c826e3-7781-4aca-8ff9-bc67292b1ca1", + "title": "Distribution of Threat Events by Severity [Logs PANW]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d5a1b5bb-cf67-41e9-a1ad-433316867264", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b68ffcbc-4921-49a7-b08e-23959b78ec31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7568cf96-efab-40c3-a90e-b73c3cc25905", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d5a1b5bb-cf67-41e9-a1ad-433316867264": { + "columnOrder": [ + "ecd723b0-2069-4cd2-9996-5dc76e2e73ad", + "0717629b-3eba-4193-a867-d36009af50a1" + ], + "columns": { + "0717629b-3eba-4193-a867-d36009af50a1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ecd723b0-2069-4cd2-9996-5dc76e2e73ad": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Category", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "0717629b-3eba-4193-a867-d36009af50a1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "panw.panos.threat_category" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "$state": { + "store": "appState" }, - "schema": "metric", - "type": "count" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b68ffcbc-4921-49a7-b08e-23959b78ec31", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "url.original", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "7568cf96-efab-40c3-a90e-b73c3cc25905", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "scale": "linear", - "showLabel": true + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0717629b-3eba-4193-a867-d36009af50a1" + ], + "layerId": "d5a1b5bb-cf67-41e9-a1ad-433316867264", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "ecd723b0-2069-4cd2-9996-5dc76e2e73ad" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "type": "tagcloud", - "uiState": {} - } + "title": "Distribution of Threat Events by Category [Logs PANW]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} }, "gridData": { "h": 15, - "i": "43c73b91-ec1f-47ec-a10b-66465bd818c0", - "w": 24, - "x": 24, - "y": 15 + "i": "f82c318d-bd14-496b-b394-622831db934c", + "w": 16, + "x": 15, + "y": 42 }, - "panelIndex": "43c73b91-ec1f-47ec-a10b-66465bd818c0", - "title": "Top threats by resource [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "panelIndex": "f82c318d-bd14-496b-b394-622831db934c", + "title": "Distribution of Threat Events by Category [Logs PANW]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7d02aa11-ecf7-43eb-bc31-bfbaf13c76df", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "431ec35a-1535-4b98-9f70-c37786b20086", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7": { + "columnOrder": [ + "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca", + "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff", + "cc06ff3e-e79f-4104-91c3-4f07d432abc0", + "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef" + ], + "columns": { + "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application Category", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "panw.panos.application.category" + }, + "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application Risk Level", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "fallback": false, + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "panw.panos.application.risk_level" + }, + "cc06ff3e-e79f-4104-91c3-4f07d432abc0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Application Technology", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "panw.panos.application.technology" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7d02aa11-ecf7-43eb-bc31-bfbaf13c76df", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "431ec35a-1535-4b98-9f70-c37786b20086", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "network.direction", - "negate": false, - "params": { - "query": "inbound" - }, - "type": "phrase", - "value": "inbound" - }, - "query": { - "match": { - "network.direction": { - "query": "inbound", - "type": "phrase" - } - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" } } - ], - "query": { - "language": "kuery", - "query": "" } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "bbe53163-fdce-47bd-80ae-8b5e1a2d0dca" + }, + { + "columnId": "9b4e5f8c-4c3c-4317-8eed-973dcb9db8ff" + }, + { + "columnId": "1bc0aa2c-de2e-40d8-9ae9-cabdeb8985ef" + }, + { + "columnId": "cc06ff3e-e79f-4104-91c3-4f07d432abc0", + "isTransposed": false } - } + ], + "layerId": "cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", + "layerType": "data" } - } - } + }, + "title": "Top 10 Threat Events with Highest Application Risk [Logs PANW]", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 8, - "i": "10996873-dcb7-4085-96fc-6a1f618df47f", - "w": 24, + "h": 15, + "i": "369cb2e5-09c2-484f-902f-d21ed0b12715", + "w": 29, "x": 0, - "y": 30 + "y": 57 }, - "panelIndex": "10996873-dcb7-4085-96fc-6a1f618df47f", - "title": "Top attackers (clients) [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "panelIndex": "369cb2e5-09c2-484f-902f-d21ed0b12715", + "title": "Top 10 Threat Events with Highest Application Risk [Logs PANW]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8a11de6f-5795-4d18-b650-7f604d291bdb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "085cd3b2-f5f3-4451-8857-f79118cc28b8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6afbad6e-78e1-4c85-a120-393ac3be0bbb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8a11de6f-5795-4d18-b650-7f604d291bdb": { + "columnOrder": [ + "05b09057-70e7-4477-be13-7ba86fd871d2", + "e60a92a8-1680-463d-9fb1-9f3a4ebeb900" + ], + "columns": { + "05b09057-70e7-4477-be13-7ba86fd871d2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Action", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "e60a92a8-1680-463d-9fb1-9f3a4ebeb900", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "panw.panos.action" + }, + "e60a92a8-1680-463d-9fb1-9f3a4ebeb900": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "085cd3b2-f5f3-4451-8857-f79118cc28b8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "server.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "network.direction", - "negate": false, - "params": { - "query": "outbound" - }, - "type": "phrase", - "value": "outbound" + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "6afbad6e-78e1-4c85-a120-393ac3be0bbb", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" }, - "query": { - "match": { - "network.direction": { - "query": "outbound", - "type": "phrase" - } - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" } } - ], - "query": { - "language": "kuery", - "query": "" } - } - }, - "description": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "totalFunc": "sum" - }, - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "8a11de6f-5795-4d18-b650-7f604d291bdb", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "e60a92a8-1680-463d-9fb1-9f3a4ebeb900" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "05b09057-70e7-4477-be13-7ba86fd871d2" + ] } - } + ], + "shape": "pie" } - } - } + }, + "title": "Distribution of Threat Events by Action taken for Session [Logs PANW]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} }, "gridData": { - "h": 8, - "i": "23129235-e707-47ea-95d9-f41e61c8a895", - "w": 24, - "x": 24, - "y": 30 + "h": 15, + "i": "fb7712b0-5b15-47fa-9281-a0462cbe7df3", + "w": 19, + "x": 29, + "y": 57 }, - "panelIndex": "23129235-e707-47ea-95d9-f41e61c8a895", - "title": "Top attackers (servers) [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "panelIndex": "fb7712b0-5b15-47fa-9281-a0462cbe7df3", + "title": "Distribution of Threat Events by Action taken for Session [Logs PANW]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 20, + "i": "1908844a-1839-46f9-ab71-8b49013e83dc", + "w": 48, + "x": 0, + "y": 72 + }, + "panelIndex": "1908844a-1839-46f9-ab71-8b49013e83dc", + "panelRefName": "panel_1908844a-1839-46f9-ab71-8b49013e83dc", + "type": "search", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Threats Overview", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:31:33.388Z", "id": "panw-772964e0-7591-11e9-aacf-79a3704914a0", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe:indexpattern-datasource-layer-36228c56-1fc8-48db-a81d-241b52c9ff89", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe:3e898ef2-a25e-42eb-91b3-749b89f764e4", "type": "index-pattern" }, { "id": "logs-*", - "name": "67c826e3-7781-4aca-8ff9-bc67292b1ca1:indexpattern-datasource-current-indexpattern", + "name": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe:2654df47-dfed-46b8-b98c-9672b00fcaa0", "type": "index-pattern" }, { "id": "logs-*", - "name": "67c826e3-7781-4aca-8ff9-bc67292b1ca1:indexpattern-datasource-layer-a3d05f76-dd3f-4d40-931b-a59e7ea49080", + "name": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe:c475bc3c-30eb-4be6-b95c-f0eff49216bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "f82c318d-bd14-496b-b394-622831db934c:indexpattern-datasource-current-indexpattern", + "name": "b3292515-c2df-40ad-9412-8a7118f359f2:indexpattern-datasource-layer-9b4766f8-2b1a-417a-a3f7-2824bad6248e", "type": "index-pattern" }, { "id": "logs-*", - "name": "f82c318d-bd14-496b-b394-622831db934c:indexpattern-datasource-layer-d5a1b5bb-cf67-41e9-a1ad-433316867264", + "name": "b3292515-c2df-40ad-9412-8a7118f359f2:faa839b2-cac0-44db-8c33-de0344c3d48d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b3292515-c2df-40ad-9412-8a7118f359f2:a0679efa-ab5f-42d3-857d-b1dd108d90f4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b3292515-c2df-40ad-9412-8a7118f359f2:baf2787c-9dd7-4400-97c1-af0533f0c664", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1c0fcd88-863b-4bcf-aeee-89956b333f30:indexpattern-datasource-layer-feec85a2-070e-4f52-8ce0-1af4b41619e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1c0fcd88-863b-4bcf-aeee-89956b333f30:5fb3d1e8-34e5-44a8-af98-4a434e022ceb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1c0fcd88-863b-4bcf-aeee-89956b333f30:f1428f06-99f2-4f83-9c07-f5112490e516", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db2483d3-c317-4ef4-a820-b35b30d8b4f8:indexpattern-datasource-layer-feec85a2-070e-4f52-8ce0-1af4b41619e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db2483d3-c317-4ef4-a820-b35b30d8b4f8:769742bc-023a-4a13-8413-faeeefbd77c4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db2483d3-c317-4ef4-a820-b35b30d8b4f8:e2c9d475-ece7-4f72-a116-bdb4d6a310e2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23129235-e707-47ea-95d9-f41e61c8a895:indexpattern-datasource-layer-72e10196-ed51-42bc-80a6-981eedaba054", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23129235-e707-47ea-95d9-f41e61c8a895:48449bb1-67db-4694-8be0-b757b6cc6f03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23129235-e707-47ea-95d9-f41e61c8a895:bc4c14c1-9a41-42ce-8b73-7f12fbfd5936", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23129235-e707-47ea-95d9-f41e61c8a895:6eba33ee-dc7e-4b97-8529-b9bcf229a929", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "10996873-dcb7-4085-96fc-6a1f618df47f:indexpattern-datasource-layer-546186fe-711b-4078-abf5-705cbb8dcc7f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "10996873-dcb7-4085-96fc-6a1f618df47f:5be02fa7-510c-45b8-b4c6-c4f9365f06b7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "10996873-dcb7-4085-96fc-6a1f618df47f:cc2643e8-66d4-47ba-af56-7307768de1ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "c31f75c3-c6c8-4635-aa14-83a6d98a019f:indexpattern-datasource-current-indexpattern", + "name": "10996873-dcb7-4085-96fc-6a1f618df47f:443625d1-6d30-421a-ab08-823ef98ca9c2", "type": "index-pattern" }, { @@ -1348,68 +2260,78 @@ }, { "id": "logs-*", - "name": "369cb2e5-09c2-484f-902f-d21ed0b12715:indexpattern-datasource-current-indexpattern", + "name": "c31f75c3-c6c8-4635-aa14-83a6d98a019f:3edd8e99-abe4-4e31-a61a-6798a98be2dd", "type": "index-pattern" }, { "id": "logs-*", - "name": "369cb2e5-09c2-484f-902f-d21ed0b12715:indexpattern-datasource-layer-cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", + "name": "c31f75c3-c6c8-4635-aa14-83a6d98a019f:14c785a7-f03a-4134-84a8-e5a31e712579", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb7712b0-5b15-47fa-9281-a0462cbe7df3:indexpattern-datasource-current-indexpattern", + "name": "67c826e3-7781-4aca-8ff9-bc67292b1ca1:indexpattern-datasource-layer-a3d05f76-dd3f-4d40-931b-a59e7ea49080", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb7712b0-5b15-47fa-9281-a0462cbe7df3:indexpattern-datasource-layer-8a11de6f-5795-4d18-b650-7f604d291bdb", + "name": "67c826e3-7781-4aca-8ff9-bc67292b1ca1:4f0f541b-76f2-4c92-8111-400fd5116ad3", "type": "index-pattern" }, { - "id": "panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4", - "name": "1908844a-1839-46f9-ab71-8b49013e83dc:panel_1908844a-1839-46f9-ab71-8b49013e83dc", - "type": "search" + "id": "logs-*", + "name": "67c826e3-7781-4aca-8ff9-bc67292b1ca1:1b0c78a3-2313-45cb-927e-e68bf9afde08", + "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "3dea2152-2d20-4bba-a864-5ea1d3dc17fe:search_0", - "type": "search" + "id": "logs-*", + "name": "f82c318d-bd14-496b-b394-622831db934c:indexpattern-datasource-layer-d5a1b5bb-cf67-41e9-a1ad-433316867264", + "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "b3292515-c2df-40ad-9412-8a7118f359f2:search_0", - "type": "search" + "id": "logs-*", + "name": "f82c318d-bd14-496b-b394-622831db934c:b68ffcbc-4921-49a7-b08e-23959b78ec31", + "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "4fa92d5e-402a-4544-81dc-aa3303069cd8:search_0", - "type": "search" + "id": "logs-*", + "name": "f82c318d-bd14-496b-b394-622831db934c:7568cf96-efab-40c3-a90e-b73c3cc25905", + "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "43c73b91-ec1f-47ec-a10b-66465bd818c0:search_0", - "type": "search" + "id": "logs-*", + "name": "369cb2e5-09c2-484f-902f-d21ed0b12715:indexpattern-datasource-layer-cabdc807-0aea-4ae6-aaec-f3e1b4b5b5e7", + "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "10996873-dcb7-4085-96fc-6a1f618df47f:search_0", - "type": "search" + "id": "logs-*", + "name": "369cb2e5-09c2-484f-902f-d21ed0b12715:7d02aa11-ecf7-43eb-bc31-bfbaf13c76df", + "type": "index-pattern" }, { "id": "logs-*", - "name": "10996873-dcb7-4085-96fc-6a1f618df47f:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "369cb2e5-09c2-484f-902f-d21ed0b12715:431ec35a-1535-4b98-9f70-c37786b20086", "type": "index-pattern" }, { - "id": "panw-3cea1360-7569-11e9-976e-65a8f47cc4c1", - "name": "23129235-e707-47ea-95d9-f41e61c8a895:search_0", - "type": "search" + "id": "logs-*", + "name": "fb7712b0-5b15-47fa-9281-a0462cbe7df3:indexpattern-datasource-layer-8a11de6f-5795-4d18-b650-7f604d291bdb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fb7712b0-5b15-47fa-9281-a0462cbe7df3:085cd3b2-f5f3-4451-8857-f79118cc28b8", + "type": "index-pattern" }, { "id": "logs-*", - "name": "23129235-e707-47ea-95d9-f41e61c8a895:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "fb7712b0-5b15-47fa-9281-a0462cbe7df3:6afbad6e-78e1-4c85-a120-393ac3be0bbb", "type": "index-pattern" + }, + { + "id": "panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4", + "name": "1908844a-1839-46f9-ab71-8b49013e83dc:panel_1908844a-1839-46f9-ab71-8b49013e83dc", + "type": "search" } ], "type": "dashboard" diff --git a/packages/panw/kibana/dashboard/panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e.json index e12aa80866f..07eb67f0f8e 100644 --- a/packages/panw/kibana/dashboard/panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e.json @@ -1,66 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Tunnel Inspection Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": [ - "START", - "END" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "panw.panos.type": "START" - } - }, - { - "match_phrase": { - "panw.panos.type": "END" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -70,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,18 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-6d63676a-a9db-4c0c-86b0-8ccc7ad82fde", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "787906c7-85e4-4be6-b521-d14aefde77a6", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6d63676a-a9db-4c0c-86b0-8ccc7ad82fde", + "name": "8879747e-8f7b-4d4c-a4c1-e682171a0013", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6d63676a-a9db-4c0c-86b0-8ccc7ad82fde": { "columnOrder": [ @@ -138,7 +89,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "787906c7-85e4-4be6-b521-d14aefde77a6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "8879747e-8f7b-4d4c-a4c1-e682171a0013", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -175,6 +189,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -203,7 +218,7 @@ "panelIndex": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44", "title": "Distribution of Tunnel Inspection Events by Action taken on Session [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -211,18 +226,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-6df3a91b-cce2-4790-84a0-4858e371e552", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-6df3a91b-cce2-4790-84a0-4858e371e552", + "name": "3826135f-3107-4fc0-adac-eeb55bee410d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f9dab70-d180-49d2-b42e-c3ee4b4e14e2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6df3a91b-cce2-4790-84a0-4858e371e552": { "columnOrder": [ @@ -270,7 +291,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "3826135f-3107-4fc0-adac-eeb55bee410d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "4f9dab70-d180-49d2-b42e-c3ee4b4e14e2", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -279,15 +363,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "693d67bd-a405-4282-8457-50269406edaf" - ], "layerId": "6df3a91b-cce2-4790-84a0-4858e371e552", "layerType": "data", "legendDisplay": "default", - "metric": "59e84e50-c216-49c5-b864-e280fdde0a84", + "legendSize": "auto", + "metrics": [ + "59e84e50-c216-49c5-b864-e280fdde0a84" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "693d67bd-a405-4282-8457-50269406edaf" + ] } ], "shape": "pie" @@ -310,7 +397,7 @@ "panelIndex": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee", "title": "Distribution of Tunnel Inspection Events by Action Source [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -318,18 +405,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-5cb94a55-3162-4bcd-be88-ce2871be6a3d", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-5cb94a55-3162-4bcd-be88-ce2871be6a3d", + "name": "1117846f-c67d-4f3d-8832-4a6f31545ec7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9bacc7fb-afe1-4810-8196-caee11a6b9db", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "5cb94a55-3162-4bcd-be88-ce2871be6a3d": { "columnOrder": [ @@ -377,7 +470,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1117846f-c67d-4f3d-8832-4a6f31545ec7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "9bacc7fb-afe1-4810-8196-caee11a6b9db", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -414,6 +570,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -442,7 +599,7 @@ "panelIndex": "fb982903-1c86-4ad9-aded-2de46206551f", "title": "Distribution of Tunnel Inspection Events by Session End Reason [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -450,18 +607,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-70ca1329-cf39-4816-b13f-3dab3c4d6494", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-70ca1329-cf39-4816-b13f-3dab3c4d6494", + "name": "d23e150e-2d76-4107-b88f-bb4f54eee728", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6bacc025-dfc7-4552-8985-6052484ba708", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "70ca1329-cf39-4816-b13f-3dab3c4d6494": { "columnOrder": [ @@ -509,7 +672,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d23e150e-2d76-4107-b88f-bb4f54eee728", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "6bacc025-dfc7-4552-8985-6052484ba708", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -546,6 +772,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -574,7 +801,7 @@ "panelIndex": "fb233b78-36b6-4c60-9261-d2d66351615c", "title": "Distribution of Tunnel Inspection Events by Severity [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -582,18 +809,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-f9e58045-70b3-4aef-9d18-7e4d04b8b3ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-f9e58045-70b3-4aef-9d18-7e4d04b8b3ce", + "name": "dd582bb5-34e9-4c7b-8eb5-90030245d646", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2fbe290d-9229-4369-828f-088bf528ae88", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f9e58045-70b3-4aef-9d18-7e4d04b8b3ce": { "columnOrder": [ @@ -687,7 +920,70 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dd582bb5-34e9-4c7b-8eb5-90030245d646", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "2fbe290d-9229-4369-828f-088bf528ae88", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -731,7 +1027,7 @@ "panelIndex": "c643144e-e2db-4ead-9cd8-141294a75623", "title": "Top 10 Tunnel Inspection Events with Highest Application Risk [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -747,62 +1043,63 @@ "panelIndex": "ac84049b-504e-45a5-a13d-1980d05d97eb", "panelRefName": "panel_ac84049b-504e-45a5-a13d-1980d05d97eb", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Tunnel Inspection", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:16:38.910Z", "id": "panw-a663eea0-dd72-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44:indexpattern-datasource-layer-6d63676a-a9db-4c0c-86b0-8ccc7ad82fde", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44:787906c7-85e4-4be6-b521-d14aefde77a6", "type": "index-pattern" }, { "id": "logs-*", - "name": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44:indexpattern-datasource-current-indexpattern", + "name": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44:8879747e-8f7b-4d4c-a4c1-e682171a0013", "type": "index-pattern" }, { "id": "logs-*", - "name": "dd9f7550-60d1-47eb-8eeb-52083aa4ca44:indexpattern-datasource-layer-6d63676a-a9db-4c0c-86b0-8ccc7ad82fde", + "name": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee:indexpattern-datasource-layer-6df3a91b-cce2-4790-84a0-4858e371e552", "type": "index-pattern" }, { "id": "logs-*", - "name": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee:indexpattern-datasource-current-indexpattern", + "name": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee:3826135f-3107-4fc0-adac-eeb55bee410d", "type": "index-pattern" }, { "id": "logs-*", - "name": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee:indexpattern-datasource-layer-6df3a91b-cce2-4790-84a0-4858e371e552", + "name": "f5b59e4c-b2fe-4c84-b52f-716d9a4d6bee:4f9dab70-d180-49d2-b42e-c3ee4b4e14e2", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb982903-1c86-4ad9-aded-2de46206551f:indexpattern-datasource-current-indexpattern", + "name": "fb982903-1c86-4ad9-aded-2de46206551f:indexpattern-datasource-layer-5cb94a55-3162-4bcd-be88-ce2871be6a3d", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb982903-1c86-4ad9-aded-2de46206551f:indexpattern-datasource-layer-5cb94a55-3162-4bcd-be88-ce2871be6a3d", + "name": "fb982903-1c86-4ad9-aded-2de46206551f:1117846f-c67d-4f3d-8832-4a6f31545ec7", "type": "index-pattern" }, { "id": "logs-*", - "name": "fb233b78-36b6-4c60-9261-d2d66351615c:indexpattern-datasource-current-indexpattern", + "name": "fb982903-1c86-4ad9-aded-2de46206551f:9bacc7fb-afe1-4810-8196-caee11a6b9db", "type": "index-pattern" }, { @@ -812,7 +1109,12 @@ }, { "id": "logs-*", - "name": "c643144e-e2db-4ead-9cd8-141294a75623:indexpattern-datasource-current-indexpattern", + "name": "fb233b78-36b6-4c60-9261-d2d66351615c:d23e150e-2d76-4107-b88f-bb4f54eee728", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fb233b78-36b6-4c60-9261-d2d66351615c:6bacc025-dfc7-4552-8985-6052484ba708", "type": "index-pattern" }, { @@ -820,6 +1122,16 @@ "name": "c643144e-e2db-4ead-9cd8-141294a75623:indexpattern-datasource-layer-f9e58045-70b3-4aef-9d18-7e4d04b8b3ce", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "c643144e-e2db-4ead-9cd8-141294a75623:dd582bb5-34e9-4c7b-8eb5-90030245d646", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c643144e-e2db-4ead-9cd8-141294a75623:2fbe290d-9229-4369-828f-088bf528ae88", + "type": "index-pattern" + }, { "id": "panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4", "name": "ac84049b-504e-45a5-a13d-1980d05d97eb:panel_ac84049b-504e-45a5-a13d-1980d05d97eb", diff --git a/packages/panw/kibana/dashboard/panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e.json index 818da8d3781..9c87f0b455d 100644 --- a/packages/panw/kibana/dashboard/panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e.json @@ -1,66 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS IP-Tag and User-ID Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": [ - "IPTAG", - "USERID" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "panw.panos.type": "IPTAG" - } - }, - { - "match_phrase": { - "panw.panos.type": "USERID" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -70,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,23 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-00227f39-4c34-492b-883a-b0825797198d", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-00227f39-4c34-492b-883a-b0825797198d", + "name": "78b7e80c-ef68-40c5-95b7-35746b804466", "type": "index-pattern" }, { "id": "logs-*", - "name": "3012ec1f-12cb-4d6d-bc77-b9086c15aa74", + "name": "918b38f3-beb8-4e68-9b82-9b058b98f1cf", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "00227f39-4c34-492b-883a-b0825797198d": { "columnOrder": [ @@ -152,7 +98,7 @@ "meta": { "alias": null, "disabled": false, - "index": "3012ec1f-12cb-4d6d-bc77-b9086c15aa74", + "index": "78b7e80c-ef68-40c5-95b7-35746b804466", "key": "panw.panos.type", "negate": false, "params": { @@ -165,8 +111,31 @@ "panw.panos.type": "USERID" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "918b38f3-beb8-4e68-9b82-9b058b98f1cf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -203,7 +172,7 @@ "panelIndex": "61d5b8a1-e36b-46e2-a067-859e3824a38f", "title": "Top 10 Data Source for User ID [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -211,23 +180,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-dbe59458-a6f9-4a01-8db6-5546f2b20398", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-dbe59458-a6f9-4a01-8db6-5546f2b20398", + "name": "bb38042c-a552-4447-8c45-0264ead1b716", "type": "index-pattern" }, { "id": "logs-*", - "name": "e893bcf2-e5a6-42f7-96f3-d6c763b5772b", + "name": "b6029fee-71ca-483b-9986-6306574bd865", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "dbe59458-a6f9-4a01-8db6-5546f2b20398": { "columnOrder": [ @@ -283,7 +253,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e893bcf2-e5a6-42f7-96f3-d6c763b5772b", + "index": "bb38042c-a552-4447-8c45-0264ead1b716", "key": "panw.panos.type", "negate": false, "params": { @@ -296,8 +266,31 @@ "panw.panos.type": "USERID" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b6029fee-71ca-483b-9986-6306574bd865", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -306,15 +299,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "7566b611-84c5-4dea-9b39-faacdfe6b59e" - ], "layerId": "dbe59458-a6f9-4a01-8db6-5546f2b20398", "layerType": "data", "legendDisplay": "default", - "metric": "a9347045-127d-4b00-8d0a-4cc006048b01", + "legendSize": "auto", + "metrics": [ + "a9347045-127d-4b00-8d0a-4cc006048b01" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "7566b611-84c5-4dea-9b39-faacdfe6b59e" + ] } ], "shape": "pie" @@ -337,7 +333,7 @@ "panelIndex": "941c1cbf-1fc0-41be-9d8a-df76024585ed", "title": "Distribution of User-ID Events by Data Source Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -345,23 +341,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-ec158676-ba28-40a2-ab8d-84cd4d151a76", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ec158676-ba28-40a2-ab8d-84cd4d151a76", + "name": "189c2b24-d296-49ba-a045-746f5c84a3e4", "type": "index-pattern" }, { "id": "logs-*", - "name": "6c3d3e96-7718-4cbb-a30b-b5c4e8759db4", + "name": "e1954735-9bcf-4547-a495-2a38a5160b8b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ec158676-ba28-40a2-ab8d-84cd4d151a76": { "columnOrder": [ @@ -417,7 +414,7 @@ "meta": { "alias": null, "disabled": false, - "index": "6c3d3e96-7718-4cbb-a30b-b5c4e8759db4", + "index": "189c2b24-d296-49ba-a045-746f5c84a3e4", "key": "panw.panos.type", "negate": false, "params": { @@ -430,8 +427,31 @@ "panw.panos.type": "IPTAG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e1954735-9bcf-4547-a495-2a38a5160b8b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -466,7 +486,7 @@ "panelIndex": "35573a15-e15f-42e4-b243-ab139267a873", "title": "Top 10 Data Source for IP-Tag [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -474,23 +494,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-fc2c72df-2fcb-4a90-b990-d990352efd07", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-fc2c72df-2fcb-4a90-b990-d990352efd07", + "name": "aa232815-7af1-44aa-9602-1fb57da56e12", "type": "index-pattern" }, { "id": "logs-*", - "name": "320bbd19-a79c-4911-b474-e3f0a50ca542", + "name": "fa4c7549-f7d5-4c86-a9cd-58244b22726b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "fc2c72df-2fcb-4a90-b990-d990352efd07": { "columnOrder": [ @@ -546,7 +567,7 @@ "meta": { "alias": null, "disabled": false, - "index": "320bbd19-a79c-4911-b474-e3f0a50ca542", + "index": "aa232815-7af1-44aa-9602-1fb57da56e12", "key": "panw.panos.type", "negate": false, "params": { @@ -559,8 +580,31 @@ "panw.panos.type": "IPTAG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "fa4c7549-f7d5-4c86-a9cd-58244b22726b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -595,6 +639,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -623,7 +668,7 @@ "panelIndex": "e6730938-3631-4d17-9812-8e38d9d05c99", "title": "Distribution of IP-Tag Events by Data Source Sub-Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -631,23 +676,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-037c403c-bd13-4906-a005-9b22e2d1da06", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-037c403c-bd13-4906-a005-9b22e2d1da06", + "name": "59baccbc-0922-4615-baac-c6b97898a7cd", "type": "index-pattern" }, { "id": "logs-*", - "name": "fcbb1917-e89a-40ee-804b-d26a038532a5", + "name": "050c0240-c937-4a76-97b5-935f34bf62b2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "037c403c-bd13-4906-a005-9b22e2d1da06": { "columnOrder": [ @@ -703,7 +749,7 @@ "meta": { "alias": null, "disabled": false, - "index": "fcbb1917-e89a-40ee-804b-d26a038532a5", + "index": "59baccbc-0922-4615-baac-c6b97898a7cd", "key": "panw.panos.type", "negate": false, "params": { @@ -716,8 +762,31 @@ "panw.panos.type": "IPTAG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "050c0240-c937-4a76-97b5-935f34bf62b2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -726,15 +795,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f5b1dbed-702e-4c76-affe-eff39e446a1b" - ], "layerId": "037c403c-bd13-4906-a005-9b22e2d1da06", "layerType": "data", "legendDisplay": "default", - "metric": "820e7237-ee90-4e86-9d17-f49a00ed86e3", + "legendSize": "auto", + "metrics": [ + "820e7237-ee90-4e86-9d17-f49a00ed86e3" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f5b1dbed-702e-4c76-affe-eff39e446a1b" + ] } ], "shape": "pie" @@ -757,7 +829,7 @@ "panelIndex": "cb6b4fd6-7fc5-431d-b96a-1e72dbf6d270", "title": "Distribution of IP-Tag Events by Data Source Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -773,7 +845,7 @@ "panelIndex": "0882d210-3b7d-480e-b2e6-a75725e6b209", "panelRefName": "panel_0882d210-3b7d-480e-b2e6-a75725e6b209", "type": "search", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -789,34 +861,20 @@ "panelIndex": "81552440-e2d4-4843-86db-8c06c1ca8cac", "panelRefName": "panel_81552440-e2d4-4843-86db-8c06c1ca8cac", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] User-ID and IP-Tag", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:05:35.076Z", "id": "panw-a8dc42e0-dcc8-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "61d5b8a1-e36b-46e2-a067-859e3824a38f:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "logs-*", "name": "61d5b8a1-e36b-46e2-a067-859e3824a38f:indexpattern-datasource-layer-00227f39-4c34-492b-883a-b0825797198d", @@ -824,12 +882,12 @@ }, { "id": "logs-*", - "name": "61d5b8a1-e36b-46e2-a067-859e3824a38f:3012ec1f-12cb-4d6d-bc77-b9086c15aa74", + "name": "61d5b8a1-e36b-46e2-a067-859e3824a38f:78b7e80c-ef68-40c5-95b7-35746b804466", "type": "index-pattern" }, { "id": "logs-*", - "name": "941c1cbf-1fc0-41be-9d8a-df76024585ed:indexpattern-datasource-current-indexpattern", + "name": "61d5b8a1-e36b-46e2-a067-859e3824a38f:918b38f3-beb8-4e68-9b82-9b058b98f1cf", "type": "index-pattern" }, { @@ -839,12 +897,12 @@ }, { "id": "logs-*", - "name": "941c1cbf-1fc0-41be-9d8a-df76024585ed:e893bcf2-e5a6-42f7-96f3-d6c763b5772b", + "name": "941c1cbf-1fc0-41be-9d8a-df76024585ed:bb38042c-a552-4447-8c45-0264ead1b716", "type": "index-pattern" }, { "id": "logs-*", - "name": "35573a15-e15f-42e4-b243-ab139267a873:indexpattern-datasource-current-indexpattern", + "name": "941c1cbf-1fc0-41be-9d8a-df76024585ed:b6029fee-71ca-483b-9986-6306574bd865", "type": "index-pattern" }, { @@ -854,12 +912,12 @@ }, { "id": "logs-*", - "name": "35573a15-e15f-42e4-b243-ab139267a873:6c3d3e96-7718-4cbb-a30b-b5c4e8759db4", + "name": "35573a15-e15f-42e4-b243-ab139267a873:189c2b24-d296-49ba-a045-746f5c84a3e4", "type": "index-pattern" }, { "id": "logs-*", - "name": "e6730938-3631-4d17-9812-8e38d9d05c99:indexpattern-datasource-current-indexpattern", + "name": "35573a15-e15f-42e4-b243-ab139267a873:e1954735-9bcf-4547-a495-2a38a5160b8b", "type": "index-pattern" }, { @@ -869,12 +927,12 @@ }, { "id": "logs-*", - "name": "e6730938-3631-4d17-9812-8e38d9d05c99:320bbd19-a79c-4911-b474-e3f0a50ca542", + "name": "e6730938-3631-4d17-9812-8e38d9d05c99:aa232815-7af1-44aa-9602-1fb57da56e12", "type": "index-pattern" }, { "id": "logs-*", - "name": "cb6b4fd6-7fc5-431d-b96a-1e72dbf6d270:indexpattern-datasource-current-indexpattern", + "name": "e6730938-3631-4d17-9812-8e38d9d05c99:fa4c7549-f7d5-4c86-a9cd-58244b22726b", "type": "index-pattern" }, { @@ -884,7 +942,12 @@ }, { "id": "logs-*", - "name": "cb6b4fd6-7fc5-431d-b96a-1e72dbf6d270:fcbb1917-e89a-40ee-804b-d26a038532a5", + "name": "cb6b4fd6-7fc5-431d-b96a-1e72dbf6d270:59baccbc-0922-4615-baac-c6b97898a7cd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cb6b4fd6-7fc5-431d-b96a-1e72dbf6d270:050c0240-c937-4a76-97b5-935f34bf62b2", "type": "index-pattern" }, { diff --git a/packages/panw/kibana/dashboard/panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e.json index 8e87f4f6e89..e20487ed25e 100644 --- a/packages/panw/kibana/dashboard/panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e.json @@ -1,19 +1,20 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS GlobalProtect Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" } } }, "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -23,18 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-b885a331-0d6a-4c4b-ac16-69791da1415a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-b885a331-0d6a-4c4b-ac16-69791da1415a", + "name": "cb28b904-a042-41e7-821c-623680829b28", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e5e8ecd-086d-45fd-99ce-8b024f87a72a", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b885a331-0d6a-4c4b-ac16-69791da1415a": { "columnOrder": [ @@ -82,10 +89,56 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cb28b904-a042-41e7-821c-623680829b28", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "5e5e8ecd-086d-45fd-99ce-8b024f87a72a", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -119,6 +172,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -147,7 +201,7 @@ "panelIndex": "95e42d6f-5c27-4924-9b0b-2a349fcb3107", "title": "Distribution of GlobalProtect Events by Gateway [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -155,18 +209,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-fcde90cc-e6a9-46c6-a7c4-937c63d02ce6", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-fcde90cc-e6a9-46c6-a7c4-937c63d02ce6", + "name": "c9f9006d-91e2-4c85-9932-bba9faade6e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f0ee8109-857c-436c-8bd1-9f190e08ea06", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "fcde90cc-e6a9-46c6-a7c4-937c63d02ce6": { "columnOrder": [ @@ -214,24 +274,73 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c9f9006d-91e2-4c85-9932-bba9faade6e4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "f0ee8109-857c-436c-8bd1-9f190e08ea06", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" }, "visualization": { "layers": [ { "categoryDisplay": "default", - "groups": [ - "cbdcd122-6cd8-45fc-b91b-bf75092fa140" - ], "layerId": "fcde90cc-e6a9-46c6-a7c4-937c63d02ce6", "layerType": "data", "legendDisplay": "default", - "metric": "c93dde3a-8225-449d-8989-89d62f7e64e6", + "legendSize": "auto", + "metrics": [ + "c93dde3a-8225-449d-8989-89d62f7e64e6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "cbdcd122-6cd8-45fc-b91b-bf75092fa140" + ] } ], "shape": "pie" @@ -254,7 +363,7 @@ "panelIndex": "636c04bb-8acb-4fca-b5e2-001c56fdf058", "title": "Distribution of GlobalProtect Events by Connect Method to Gateway [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -262,18 +371,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-47129d2c-02d8-4672-90ef-320770c3e8e3", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-47129d2c-02d8-4672-90ef-320770c3e8e3", + "name": "be11c721-51ff-491a-a182-faed4677de27", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "96f4f20b-22e3-4715-b004-f16f1c7e35fb", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "47129d2c-02d8-4672-90ef-320770c3e8e3": { "columnOrder": [ @@ -321,24 +436,73 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "be11c721-51ff-491a-a182-faed4677de27", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "96f4f20b-22e3-4715-b004-f16f1c7e35fb", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" }, "visualization": { "layers": [ { "categoryDisplay": "default", - "groups": [ - "bdd142d5-00a0-4fc3-a229-a4f61ae67857" - ], "layerId": "47129d2c-02d8-4672-90ef-320770c3e8e3", "layerType": "data", "legendDisplay": "default", - "metric": "8cc22ce9-9823-482b-a3d3-28e91f46ad29", + "legendSize": "auto", + "metrics": [ + "8cc22ce9-9823-482b-a3d3-28e91f46ad29" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bdd142d5-00a0-4fc3-a229-a4f61ae67857" + ] } ], "shape": "pie" @@ -361,7 +525,7 @@ "panelIndex": "73f1567a-13b6-472f-ac8a-1995dc15f625", "title": "Distribution of GlobalProtect Events by Authentication Method [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -369,18 +533,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-70c151c6-d178-4fdd-8866-b2788dccbbcd", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-70c151c6-d178-4fdd-8866-b2788dccbbcd", + "name": "f9dc307c-2997-4e73-afb3-5b555067c9ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7989a55d-1ca7-4bc8-b82e-ded98b883fb1", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "70c151c6-d178-4fdd-8866-b2788dccbbcd": { "columnOrder": [ @@ -428,24 +598,73 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "f9dc307c-2997-4e73-afb3-5b555067c9ac", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "7989a55d-1ca7-4bc8-b82e-ded98b883fb1", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" }, "visualization": { "layers": [ { "categoryDisplay": "default", - "groups": [ - "39e018bf-de15-43bc-af87-5f7270f32d31" - ], "layerId": "70c151c6-d178-4fdd-8866-b2788dccbbcd", "layerType": "data", "legendDisplay": "default", - "metric": "87920d79-a632-45b3-a079-613ce967dac0", + "legendSize": "auto", + "metrics": [ + "87920d79-a632-45b3-a079-613ce967dac0" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "39e018bf-de15-43bc-af87-5f7270f32d31" + ] } ], "shape": "pie" @@ -468,7 +687,7 @@ "panelIndex": "5f85a927-93b7-48a4-87ca-c958a13a9609", "title": "Distribution of GlobalProtect Events by Gateway Selection Method [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -476,18 +695,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-939b1f80-7730-48d2-a3ad-05209f3b1c7f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-939b1f80-7730-48d2-a3ad-05209f3b1c7f", + "name": "e22e6b83-36af-4445-baa9-cdd267f0bb0f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e22b8a76-c098-4ec6-9f17-9688e576c212", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "939b1f80-7730-48d2-a3ad-05209f3b1c7f": { "columnOrder": [ @@ -558,25 +783,74 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e22e6b83-36af-4445-baa9-cdd267f0bb0f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "e22b8a76-c098-4ec6-9f17-9688e576c212", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\"" + "query": "" }, "visualization": { "layers": [ { "categoryDisplay": "default", - "groups": [ - "78099651-0ffc-4a94-af03-4ee36fe275e5", - "7e4a9873-3ac5-4c25-bd7c-dbe1f763bb49" - ], "layerId": "939b1f80-7730-48d2-a3ad-05209f3b1c7f", "layerType": "data", "legendDisplay": "default", - "metric": "0120c97f-ddd8-4167-aefb-434d8602e94d", + "legendSize": "auto", + "metrics": [ + "0120c97f-ddd8-4167-aefb-434d8602e94d" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "78099651-0ffc-4a94-af03-4ee36fe275e5", + "7e4a9873-3ac5-4c25-bd7c-dbe1f763bb49" + ] } ], "shape": "pie" @@ -599,7 +873,7 @@ "panelIndex": "84297b75-0138-4f95-b416-2e79c77afd4d", "title": "Distribution of GlobalProtect Events by Operating System and Client Version [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -615,32 +889,33 @@ "panelIndex": "81ef2c1c-2bea-4e89-97fa-7c90e465678f", "panelRefName": "panel_81ef2c1c-2bea-4e89-97fa-7c90e465678f", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Global Protect", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:09:11.975Z", "id": "panw-b1a9f7a0-dcaa-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "95e42d6f-5c27-4924-9b0b-2a349fcb3107:indexpattern-datasource-current-indexpattern", + "name": "95e42d6f-5c27-4924-9b0b-2a349fcb3107:indexpattern-datasource-layer-b885a331-0d6a-4c4b-ac16-69791da1415a", "type": "index-pattern" }, { "id": "logs-*", - "name": "95e42d6f-5c27-4924-9b0b-2a349fcb3107:indexpattern-datasource-layer-b885a331-0d6a-4c4b-ac16-69791da1415a", + "name": "95e42d6f-5c27-4924-9b0b-2a349fcb3107:cb28b904-a042-41e7-821c-623680829b28", "type": "index-pattern" }, { "id": "logs-*", - "name": "636c04bb-8acb-4fca-b5e2-001c56fdf058:indexpattern-datasource-current-indexpattern", + "name": "95e42d6f-5c27-4924-9b0b-2a349fcb3107:5e5e8ecd-086d-45fd-99ce-8b024f87a72a", "type": "index-pattern" }, { @@ -650,7 +925,12 @@ }, { "id": "logs-*", - "name": "73f1567a-13b6-472f-ac8a-1995dc15f625:indexpattern-datasource-current-indexpattern", + "name": "636c04bb-8acb-4fca-b5e2-001c56fdf058:c9f9006d-91e2-4c85-9932-bba9faade6e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "636c04bb-8acb-4fca-b5e2-001c56fdf058:f0ee8109-857c-436c-8bd1-9f190e08ea06", "type": "index-pattern" }, { @@ -660,7 +940,12 @@ }, { "id": "logs-*", - "name": "5f85a927-93b7-48a4-87ca-c958a13a9609:indexpattern-datasource-current-indexpattern", + "name": "73f1567a-13b6-472f-ac8a-1995dc15f625:be11c721-51ff-491a-a182-faed4677de27", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "73f1567a-13b6-472f-ac8a-1995dc15f625:96f4f20b-22e3-4715-b004-f16f1c7e35fb", "type": "index-pattern" }, { @@ -670,7 +955,12 @@ }, { "id": "logs-*", - "name": "84297b75-0138-4f95-b416-2e79c77afd4d:indexpattern-datasource-current-indexpattern", + "name": "5f85a927-93b7-48a4-87ca-c958a13a9609:f9dc307c-2997-4e73-afb3-5b555067c9ac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5f85a927-93b7-48a4-87ca-c958a13a9609:7989a55d-1ca7-4bc8-b82e-ded98b883fb1", "type": "index-pattern" }, { @@ -678,6 +968,16 @@ "name": "84297b75-0138-4f95-b416-2e79c77afd4d:indexpattern-datasource-layer-939b1f80-7730-48d2-a3ad-05209f3b1c7f", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "84297b75-0138-4f95-b416-2e79c77afd4d:e22e6b83-36af-4445-baa9-cdd267f0bb0f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84297b75-0138-4f95-b416-2e79c77afd4d:e22b8a76-c098-4ec6-9f17-9688e576c212", + "type": "index-pattern" + }, { "id": "panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4", "name": "81ef2c1c-2bea-4e89-97fa-7c90e465678f:panel_81ef2c1c-2bea-4e89-97fa-7c90e465678f", diff --git a/packages/panw/kibana/dashboard/panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e.json index 3a56e08a514..dc5890a9726 100644 --- a/packages/panw/kibana/dashboard/panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e.json @@ -1,66 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Config and System Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": [ - "CONFIG", - "SYSTEM" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "panw.panos.type": "CONFIG" - } - }, - { - "match_phrase": { - "panw.panos.type": "SYSTEM" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -70,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,23 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-2fae76dc-439c-42c6-81af-3652ed79395a", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-2fae76dc-439c-42c6-81af-3652ed79395a", + "name": "935a09df-fa7a-4ed6-b209-509cc9c6d503", "type": "index-pattern" }, { "id": "logs-*", - "name": "e88386a3-70bc-4d6b-a229-14119132de1c", + "name": "efd921a1-9c3b-4650-8e57-0c80ed3a4dd2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "2fae76dc-439c-42c6-81af-3652ed79395a": { "columnOrder": [ @@ -151,7 +97,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e88386a3-70bc-4d6b-a229-14119132de1c", + "index": "935a09df-fa7a-4ed6-b209-509cc9c6d503", "key": "panw.panos.type", "negate": false, "params": { @@ -164,8 +110,31 @@ "panw.panos.type": "CONFIG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "efd921a1-9c3b-4650-8e57-0c80ed3a4dd2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -174,15 +143,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ae5c7550-3c45-4df7-9be6-12d7e0cca95e" - ], "layerId": "2fae76dc-439c-42c6-81af-3652ed79395a", "layerType": "data", "legendDisplay": "default", - "metric": "21fa1b87-c70a-44fd-906e-f3f4b597c600", + "legendSize": "auto", + "metrics": [ + "21fa1b87-c70a-44fd-906e-f3f4b597c600" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ae5c7550-3c45-4df7-9be6-12d7e0cca95e" + ] } ], "shape": "pie" @@ -205,7 +177,7 @@ "panelIndex": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a", "title": "Distribution of Config Events by Client [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -213,23 +185,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-71288c95-38cf-4960-9e02-bad9022fed89", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-71288c95-38cf-4960-9e02-bad9022fed89", + "name": "31426e95-ddfa-409f-b1cf-b3a6a31d822e", "type": "index-pattern" }, { "id": "logs-*", - "name": "2ea09be8-894b-450d-b67a-e93fded385c0", + "name": "6558969d-5f5c-406f-a521-a4159fc1cb3b", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "71288c95-38cf-4960-9e02-bad9022fed89": { "columnOrder": [ @@ -285,7 +258,7 @@ "meta": { "alias": null, "disabled": false, - "index": "2ea09be8-894b-450d-b67a-e93fded385c0", + "index": "31426e95-ddfa-409f-b1cf-b3a6a31d822e", "key": "panw.panos.type", "negate": false, "params": { @@ -298,8 +271,31 @@ "panw.panos.type": "CONFIG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "6558969d-5f5c-406f-a521-a4159fc1cb3b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -308,15 +304,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dba2cfc5-3469-41f9-b48c-44bef1fec682" - ], "layerId": "71288c95-38cf-4960-9e02-bad9022fed89", "layerType": "data", "legendDisplay": "default", - "metric": "59530055-7bef-442b-a30a-2836f96aed1c", + "legendSize": "auto", + "metrics": [ + "59530055-7bef-442b-a30a-2836f96aed1c" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "dba2cfc5-3469-41f9-b48c-44bef1fec682" + ] } ], "shape": "pie" @@ -339,7 +338,7 @@ "panelIndex": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d", "title": "Distribution of Config Events by Result of Configuration Action [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -347,23 +346,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-e5736d39-58c7-4d25-b1a6-678a9343ce65", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-e5736d39-58c7-4d25-b1a6-678a9343ce65", + "name": "fe2ab826-9783-4162-b942-00d0678b94fa", "type": "index-pattern" }, { "id": "logs-*", - "name": "6ac7f225-dfd9-4eaf-8e77-07bb3e1440a8", + "name": "fbe359fb-dfc8-4a9a-b3fe-3f34c8cbd7e4", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e5736d39-58c7-4d25-b1a6-678a9343ce65": { "columnOrder": [ @@ -419,7 +419,7 @@ "meta": { "alias": null, "disabled": false, - "index": "6ac7f225-dfd9-4eaf-8e77-07bb3e1440a8", + "index": "fe2ab826-9783-4162-b942-00d0678b94fa", "key": "panw.panos.type", "negate": false, "params": { @@ -432,8 +432,31 @@ "panw.panos.type": "CONFIG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "fbe359fb-dfc8-4a9a-b3fe-3f34c8cbd7e4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -470,7 +493,7 @@ "panelIndex": "6de0f512-eff6-4299-8aa7-2945b991c526", "title": "Top 10 Command performed by the Admin [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -486,7 +509,7 @@ "panelIndex": "57e5f1fd-85cb-4ba3-ad08-397ef6d0d7f9", "panelRefName": "panel_57e5f1fd-85cb-4ba3-ad08-397ef6d0d7f9", "type": "search", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -494,23 +517,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0ad02752-8f13-4a8b-bf71-f85d01d0079f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0ad02752-8f13-4a8b-bf71-f85d01d0079f", + "name": "af712f8a-aa4c-4e3d-8a53-9a1201b954ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "45f5795d-6ad6-4eda-bcd4-c87b9bb95bd2", + "name": "60885b63-9563-4e96-87aa-8281c340594a", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0ad02752-8f13-4a8b-bf71-f85d01d0079f": { "columnOrder": [ @@ -566,7 +590,7 @@ "meta": { "alias": null, "disabled": false, - "index": "45f5795d-6ad6-4eda-bcd4-c87b9bb95bd2", + "index": "af712f8a-aa4c-4e3d-8a53-9a1201b954ce", "key": "panw.panos.type", "negate": false, "params": { @@ -579,8 +603,31 @@ "panw.panos.type": "SYSTEM" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "60885b63-9563-4e96-87aa-8281c340594a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -589,15 +636,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6c047f97-3b11-4f12-899b-4b613f618d42" - ], "layerId": "0ad02752-8f13-4a8b-bf71-f85d01d0079f", "layerType": "data", "legendDisplay": "default", - "metric": "3cd0a5b1-41f3-4793-b7a8-b23e9c3631f3", + "legendSize": "auto", + "metrics": [ + "3cd0a5b1-41f3-4793-b7a8-b23e9c3631f3" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6c047f97-3b11-4f12-899b-4b613f618d42" + ] } ], "shape": "pie" @@ -620,7 +670,7 @@ "panelIndex": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58", "title": "Distribution of System Events by Module [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -628,23 +678,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-cb623bef-dc47-4006-b664-410b86519536", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-cb623bef-dc47-4006-b664-410b86519536", + "name": "9cd7f601-5a04-4972-b1d5-64bd58dce177", "type": "index-pattern" }, { "id": "logs-*", - "name": "7bfe870b-f584-4b3d-9166-75bcd6c5f31e", + "name": "fd9a170d-0a2e-4d19-abd8-15387c1d6895", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cb623bef-dc47-4006-b664-410b86519536": { "columnOrder": [ @@ -700,7 +751,7 @@ "meta": { "alias": null, "disabled": false, - "index": "7bfe870b-f584-4b3d-9166-75bcd6c5f31e", + "index": "9cd7f601-5a04-4972-b1d5-64bd58dce177", "key": "panw.panos.type", "negate": false, "params": { @@ -713,8 +764,31 @@ "panw.panos.type": "SYSTEM" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "fd9a170d-0a2e-4d19-abd8-15387c1d6895", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -723,15 +797,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d1e12f64-ba47-4271-b8e9-59670d855c0c" - ], "layerId": "cb623bef-dc47-4006-b664-410b86519536", "layerType": "data", "legendDisplay": "default", - "metric": "b4c3d6f4-3083-4c14-ac7d-cdc7108f38ca", + "legendSize": "auto", + "metrics": [ + "b4c3d6f4-3083-4c14-ac7d-cdc7108f38ca" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d1e12f64-ba47-4271-b8e9-59670d855c0c" + ] } ], "shape": "pie" @@ -754,7 +831,7 @@ "panelIndex": "f58e08fd-d5da-4ce8-9b3b-06534e199357", "title": "Distribution of System Events by Severity [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -770,72 +847,63 @@ "panelIndex": "90cc1874-fa55-4459-98a9-0b8507f7de3b", "panelRefName": "panel_90cc1874-fa55-4459-98a9-0b8507f7de3b", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] System and Config", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:58:37.367Z", "id": "panw-d3e36450-dce1-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:indexpattern-datasource-current-indexpattern", + "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:indexpattern-datasource-layer-2fae76dc-439c-42c6-81af-3652ed79395a", "type": "index-pattern" }, { "id": "logs-*", - "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:indexpattern-datasource-layer-2fae76dc-439c-42c6-81af-3652ed79395a", + "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:935a09df-fa7a-4ed6-b209-509cc9c6d503", "type": "index-pattern" }, { "id": "logs-*", - "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:e88386a3-70bc-4d6b-a229-14119132de1c", + "name": "59c0b5a7-0e8a-4d6a-888b-09a251a5fd4a:efd921a1-9c3b-4650-8e57-0c80ed3a4dd2", "type": "index-pattern" }, { "id": "logs-*", - "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:indexpattern-datasource-current-indexpattern", + "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:indexpattern-datasource-layer-71288c95-38cf-4960-9e02-bad9022fed89", "type": "index-pattern" }, { "id": "logs-*", - "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:indexpattern-datasource-layer-71288c95-38cf-4960-9e02-bad9022fed89", + "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:31426e95-ddfa-409f-b1cf-b3a6a31d822e", "type": "index-pattern" }, { "id": "logs-*", - "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:2ea09be8-894b-450d-b67a-e93fded385c0", + "name": "fafbb55a-9be4-4df5-a9e3-cdb4d00a051d:6558969d-5f5c-406f-a521-a4159fc1cb3b", "type": "index-pattern" }, { "id": "logs-*", - "name": "6de0f512-eff6-4299-8aa7-2945b991c526:indexpattern-datasource-current-indexpattern", + "name": "6de0f512-eff6-4299-8aa7-2945b991c526:indexpattern-datasource-layer-e5736d39-58c7-4d25-b1a6-678a9343ce65", "type": "index-pattern" }, { "id": "logs-*", - "name": "6de0f512-eff6-4299-8aa7-2945b991c526:indexpattern-datasource-layer-e5736d39-58c7-4d25-b1a6-678a9343ce65", + "name": "6de0f512-eff6-4299-8aa7-2945b991c526:fe2ab826-9783-4162-b942-00d0678b94fa", "type": "index-pattern" }, { "id": "logs-*", - "name": "6de0f512-eff6-4299-8aa7-2945b991c526:6ac7f225-dfd9-4eaf-8e77-07bb3e1440a8", + "name": "6de0f512-eff6-4299-8aa7-2945b991c526:fbe359fb-dfc8-4a9a-b3fe-3f34c8cbd7e4", "type": "index-pattern" }, { @@ -845,32 +913,32 @@ }, { "id": "logs-*", - "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:indexpattern-datasource-current-indexpattern", + "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:indexpattern-datasource-layer-0ad02752-8f13-4a8b-bf71-f85d01d0079f", "type": "index-pattern" }, { "id": "logs-*", - "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:indexpattern-datasource-layer-0ad02752-8f13-4a8b-bf71-f85d01d0079f", + "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:af712f8a-aa4c-4e3d-8a53-9a1201b954ce", "type": "index-pattern" }, { "id": "logs-*", - "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:45f5795d-6ad6-4eda-bcd4-c87b9bb95bd2", + "name": "d299f2c7-bd4f-47f8-84bd-58e86fc21c58:60885b63-9563-4e96-87aa-8281c340594a", "type": "index-pattern" }, { "id": "logs-*", - "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:indexpattern-datasource-current-indexpattern", + "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:indexpattern-datasource-layer-cb623bef-dc47-4006-b664-410b86519536", "type": "index-pattern" }, { "id": "logs-*", - "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:indexpattern-datasource-layer-cb623bef-dc47-4006-b664-410b86519536", + "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:9cd7f601-5a04-4972-b1d5-64bd58dce177", "type": "index-pattern" }, { "id": "logs-*", - "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:7bfe870b-f584-4b3d-9166-75bcd6c5f31e", + "name": "f58e08fd-d5da-4ce8-9b3b-06534e199357:fd9a170d-0a2e-4d19-abd8-15387c1d6895", "type": "index-pattern" }, { diff --git a/packages/panw/kibana/dashboard/panw-e40ba240-7572-11e9-976e-65a8f47cc4c1.json b/packages/panw/kibana/dashboard/panw-e40ba240-7572-11e9-976e-65a8f47cc4c1.json index b42bbc59ef8..0f003eb46e4 100644 --- a/packages/panw/kibana/dashboard/panw-e40ba240-7572-11e9-976e-65a8f47cc4c1.json +++ b/packages/panw/kibana/dashboard/panw-e40ba240-7572-11e9-976e-65a8f47cc4c1.json @@ -1,53 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS Networks Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": { - "query": "TRAFFIC" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "panw.panos.type": "TRAFFIC" - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -56,6 +12,9 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -64,24 +23,23 @@ "attributes": { "description": "", "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"f1552cbe-a7ee-44aa-8267-84a5becc47b0\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"e05f7ca1-ad23-44f5-ba1e-fd4593862f64\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Source Flows Map [Logs PANW]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"source.geo.location\",\"id\":\"1a4eafd8-1bc1-42c8-9679-cffe5c9f7d81\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1,\"center\":{\"lon\":8.99751,\"lat\":25.26757},\"timeFilters\":{\"from\":\"2018-11-30T16:08:59.974Z\",\"to\":\"2018-11-30T16:10:00.944Z\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"panw.panos\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"panw.panos\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"panw.panos.type\",\"field\":\"panw.panos.type\",\"params\":{\"query\":\"TRAFFIC\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"panw.panos.type\":\"TRAFFIC\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "Source Flows Map [Logs PANW]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + "uiStateJSON": "{\"isLayerTOCOpen\":false,\"openTOCDetails\":[]}" }, "enhancements": {}, "hiddenLayers": [], "isLayerTOCOpen": true, "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 + "maxLat": 85.05113, + "maxLon": 360, + "minLat": -85.05113, + "minLon": -180 }, "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 + "lat": 24.31007, + "lon": 16.38032, + "zoom": 1 }, "openTOCDetails": [] }, @@ -94,15 +52,14 @@ }, "panelIndex": "c31e5ac3-5063-4124-9a6f-b01af9e160b4", "type": "map", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"b690c8fa-43ee-4991-9db5-9ea7243272d1\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"4fafc878-ca54-4363-9bd9-7b9af45ee80a\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Destination Flows Map [Logs PANW]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"destination.geo.location\",\"id\":\"846dde31-2090-4d3b-85d4-8a6e3bee3ec7\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1,\"center\":{\"lon\":10.40376,\"lat\":33.13755},\"timeFilters\":{\"from\":\"2018-11-30T16:08:59.974Z\",\"to\":\"2018-11-30T16:10:00.944Z\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"data_stream.dataset\",\"field\":\"data_stream.dataset\",\"params\":{\"query\":\"panw.panos\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"panw.panos\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"disabled\":false,\"negate\":false,\"alias\":null,\"index\":\"logs-*\",\"key\":\"panw.panos.type\",\"field\":\"panw.panos.type\",\"params\":{\"query\":\"TRAFFIC\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"panw.panos.type\":\"TRAFFIC\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "Destination Flows Map [Logs PANW]", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" }, @@ -110,15 +67,15 @@ "hiddenLayers": [], "isLayerTOCOpen": true, "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 + "maxLat": 85.05113, + "maxLon": 360, + "minLat": -85.05113, + "minLon": -180 }, "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 + "lat": 24.31007, + "lon": 16.38032, + "zoom": 1 }, "openTOCDetails": [] }, @@ -131,7 +88,7 @@ }, "panelIndex": "2b2d20f7-1d92-47e1-b44d-223c78a812a2", "type": "map", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -139,18 +96,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-1c2d6cb2-e621-4508-b091-68698e3cbdc5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-1c2d6cb2-e621-4508-b091-68698e3cbdc5", + "name": "1082dcd1-4d01-41f8-88aa-d2e004c2f107", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0960210a-1629-4872-9b8d-538840ef3cf0", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1c2d6cb2-e621-4508-b091-68698e3cbdc5": { "columnOrder": [ @@ -198,7 +161,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1082dcd1-4d01-41f8-88aa-d2e004c2f107", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "0960210a-1629-4872-9b8d-538840ef3cf0", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -235,6 +244,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -262,7 +272,7 @@ "panelIndex": "93b617ff-5dac-4353-a0ec-6c37ed4c2531", "title": "Distribution of Traffic Events by Action Source [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -270,18 +280,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-43b12ac6-d4db-411f-b08e-f5f4075e0be5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cec0b893-7b6f-4a6e-adfd-e2534e004091", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-43b12ac6-d4db-411f-b08e-f5f4075e0be5", + "name": "a3728121-873d-4210-9d05-e6c99f219f1e", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "43b12ac6-d4db-411f-b08e-f5f4075e0be5": { "columnOrder": [ @@ -329,7 +345,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cec0b893-7b6f-4a6e-adfd-e2534e004091", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "a3728121-873d-4210-9d05-e6c99f219f1e", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -338,15 +400,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "2d5e41f9-eeab-4d27-a10e-22832cee676f" - ], "layerId": "43b12ac6-d4db-411f-b08e-f5f4075e0be5", "layerType": "data", "legendDisplay": "default", - "metric": "4de61db4-2821-402e-873a-47127e6d9b40", + "legendSize": "auto", + "metrics": [ + "4de61db4-2821-402e-873a-47127e6d9b40" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "2d5e41f9-eeab-4d27-a10e-22832cee676f" + ] } ], "shape": "pie" @@ -368,7 +433,7 @@ "panelIndex": "5c9269a0-1965-4ad6-8490-2f9c73a5224d", "title": "Distribution of Traffic Events by Tunnel Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -376,18 +441,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-0104fc7a-d74d-4b79-96f9-5b21d7d0940d", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-0104fc7a-d74d-4b79-96f9-5b21d7d0940d", + "name": "d736d790-9438-4805-b54f-be47df2683eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e4a4aea8-d4b9-4b09-b761-859c4bb13284", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0104fc7a-d74d-4b79-96f9-5b21d7d0940d": { "columnOrder": [ @@ -435,7 +506,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d736d790-9438-4805-b54f-be47df2683eb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "e4a4aea8-d4b9-4b09-b761-859c4bb13284", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -444,15 +561,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "ff0392e1-30de-492d-a628-c7142a500f78" - ], "layerId": "0104fc7a-d74d-4b79-96f9-5b21d7d0940d", "layerType": "data", "legendDisplay": "default", - "metric": "da04cda5-8263-4e5d-8135-aa6dfd0f0f82", + "legendSize": "auto", + "metrics": [ + "da04cda5-8263-4e5d-8135-aa6dfd0f0f82" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "ff0392e1-30de-492d-a628-c7142a500f78" + ] } ], "shape": "pie" @@ -474,7 +594,7 @@ "panelIndex": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14", "title": "Distribution of Traffic Events by Action taken on Session [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -482,18 +602,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-80fb7018-784a-46f3-bf53-9ee5c04cc299", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-80fb7018-784a-46f3-bf53-9ee5c04cc299", + "name": "eb23da0c-c8ac-45a4-a41c-044d0507fa4e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "524d827c-bd75-4717-9af4-ff03b48b5aec", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "80fb7018-784a-46f3-bf53-9ee5c04cc299": { "columnOrder": [ @@ -587,7 +713,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "eb23da0c-c8ac-45a4-a41c-044d0507fa4e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "524d827c-bd75-4717-9af4-ff03b48b5aec", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -631,7 +803,7 @@ "panelIndex": "2921706d-6ceb-4030-bdb3-d18db36af7e5", "title": "Top 10 Traffic Events with Highest Application Risk [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -639,18 +811,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-3fa812b2-58e7-4e77-9cf8-5d748f3cbcfc", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-3fa812b2-58e7-4e77-9cf8-5d748f3cbcfc", + "name": "cbf084c9-ffa0-4e9c-a117-7cb643b84344", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d651160e-2ee6-451b-96cd-8a047b081ca2", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3fa812b2-58e7-4e77-9cf8-5d748f3cbcfc": { "columnOrder": [ @@ -698,7 +876,53 @@ } } }, - "filters": [], + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "cbf084c9-ffa0-4e9c-a117-7cb643b84344", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "d651160e-2ee6-451b-96cd-8a047b081ca2", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -735,6 +959,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -762,7 +987,7 @@ "panelIndex": "ed22ae2c-66ec-4426-87b6-2384aa38fe59", "title": "Distribution of Traffic Events by Session End Reason [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -778,189 +1003,226 @@ "panelIndex": "a2049bc0-48d4-40f0-882a-2191b99d6a8f", "panelRefName": "panel_a2049bc0-48d4-40f0-882a-2191b99d6a8f", "type": "search", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dcc0fb94-9303-431e-93a5-9713d183133c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "299be618-63f1-4bdf-a732-55c0a64db857", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a11d454-367f-4379-9327-9ae5eb84efe4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dcc0fb94-9303-431e-93a5-9713d183133c": { + "columnOrder": [ + "b3b30635-52cd-439f-bdb3-3345995d9431", + "aef8a406-13ea-43a3-9a4f-e9e723f039e6", + "3c36efbe-4365-4c34-8468-172b64fa3deb" + ], + "columns": { + "3c36efbe-4365-4c34-8468-172b64fa3deb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "aef8a406-13ea-43a3-9a4f-e9e723f039e6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "3c36efbe-4365-4c34-8468-172b64fa3deb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "b3b30635-52cd-439f-bdb3-3345995d9431": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extendToTimeRange": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-15m", - "to": "now" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "299be618-63f1-4bdf-a732-55c0a64db857", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" }, - "useNormalizedEsInterval": true, - "used_interval": "30s" + "type": "phrase" }, - "schema": "segment", - "type": "date_histogram" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "0a11d454-367f-4379-9327-9ae5eb84efe4", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.action", - "negate": true, - "params": { - "query": "flow_terminated" - }, - "type": "phrase", - "value": "flow_terminated" + "accessors": [ + "3c36efbe-4365-4c34-8468-172b64fa3deb" + ], + "isHistogram": true, + "layerId": "dcc0fb94-9303-431e-93a5-9713d183133c", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "query": { - "match": { - "event.action": { - "query": "flow_terminated", - "type": "phrase" - } + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "aef8a406-13ea-43a3-9a4f-e9e723f039e6", + "xAccessor": "b3b30635-52cd-439f-bdb3-3345995d9431", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "3c36efbe-4365-4c34-8468-172b64fa3deb" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": false, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } }, - "description": "", - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "uiState": { - "vis": { - "legendOpen": false - } - } - } + "title": "Flow Creation Histogram [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -971,184 +1233,238 @@ }, "panelIndex": "64dcfd5b-2640-432b-81b7-60405232b4a3", "title": "Flow Creation Histogram [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-65a4cb5a-41f5-4ace-877c-fade2d5f6f34", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dbb45061-6074-46bf-8aa9-07f3208aa268", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e9f4e0d-afd1-4a12-ac0e-1b1433771619", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "65a4cb5a-41f5-4ace-877c-fade2d5f6f34": { + "columnOrder": [ + "fd2b24cd-0665-4431-979d-1aeb6932b1eb", + "b925b8a5-aca6-4235-b6ff-855acc9ae740", + "2c0c74a8-0181-4a3b-a8ed-776dece7f815" + ], + "columns": { + "2c0c74a8-0181-4a3b-a8ed-776dece7f815": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b925b8a5-aca6-4235-b6ff-855acc9ae740": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c0c74a8-0181-4a3b-a8ed-776dece7f815", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "fd2b24cd-0665-4431-979d-1aeb6932b1eb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "observer.ingress.zone: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c0c74a8-0181-4a3b-a8ed-776dece7f815", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "observer.ingress.zone" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "observer.ingress.zone", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dbb45061-6074-46bf-8aa9-07f3208aa268", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "5e9f4e0d-afd1-4a12-ac0e-1b1433771619", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": -45, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.action", - "negate": true, - "params": { - "query": "flow_started" - }, - "type": "phrase", - "value": "flow_started" + "accessors": [ + "2c0c74a8-0181-4a3b-a8ed-776dece7f815" + ], + "isHistogram": false, + "layerId": "65a4cb5a-41f5-4ace-877c-fade2d5f6f34", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "query": { - "match": { - "event.action": { - "query": "flow_started", - "type": "phrase" - } + "seriesType": "bar_horizontal", + "simpleView": false, + "splitAccessor": "b925b8a5-aca6-4235-b6ff-855acc9ae740", + "xAccessor": "fd2b24cd-0665-4431-979d-1aeb6932b1eb", + "xScaleType": "ordinal", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "2c0c74a8-0181-4a3b-a8ed-776dece7f815" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": false, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } }, - "description": "", - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 200 - }, - "position": "left", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "truncateLegend": true, - "type": "horizontal_bar", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": true, - "rotate": 75, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "bottom", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "horizontal_bar", - "uiState": { - "vis": { - "legendOpen": false - } - } - } + "title": "Source Zone breakout [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1159,275 +1475,446 @@ }, "panelIndex": "49836c0a-6ee7-4ed7-adc9-444169243b4c", "title": "Source Zone breakout [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f7e049ec-c80f-4008-b744-8345ed70f965", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a581f776-a3a2-4edf-8209-9fb92df08bfa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60787863-31d8-4fcf-be52-54f177d770b4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f7e049ec-c80f-4008-b744-8345ed70f965": { + "columnOrder": [ + "23172c2b-ce08-43b4-8cc4-5716f831e418", + "e7a9c02c-89b3-4015-a403-bf9c7faf22dd", + "41835678-9e15-407b-b675-1c0012cd435f" + ], + "columns": { + "23172c2b-ce08-43b4-8cc4-5716f831e418": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "observer.egress.zone: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "41835678-9e15-407b-b675-1c0012cd435f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "observer.egress.zone" + }, + "41835678-9e15-407b-b675-1c0012cd435f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e7a9c02c-89b3-4015-a403-bf9c7faf22dd": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "41835678-9e15-407b-b675-1c0012cd435f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "observer.egress.zone", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "a581f776-a3a2-4edf-8209-9fb92df08bfa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "3", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "group", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "60787863-31d8-4fcf-be52-54f177d770b4", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": -45, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.action", - "negate": true, - "params": { - "query": "flow_started" - }, - "type": "phrase", - "value": "flow_started" + "accessors": [ + "41835678-9e15-407b-b675-1c0012cd435f" + ], + "isHistogram": false, + "layerId": "f7e049ec-c80f-4008-b744-8345ed70f965", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "query": { - "match": { - "event.action": { - "query": "flow_started", - "type": "phrase" - } + "seriesType": "bar_horizontal", + "simpleView": false, + "splitAccessor": "e7a9c02c-89b3-4015-a403-bf9c7faf22dd", + "xAccessor": "23172c2b-ce08-43b4-8cc4-5716f831e418", + "xScaleType": "ordinal", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "41835678-9e15-407b-b675-1c0012cd435f" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" } }, - "description": "", - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 200 - }, - "position": "left", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false + "title": "Destination Zone breakout [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4", + "w": 12, + "x": 36, + "y": 15 + }, + "panelIndex": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4", + "title": "Destination Zone breakout [Logs PANW]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9f9829e6-d592-49e8-a5e5-11dba09be853", + "type": "index-pattern" }, - "isVislibVis": true, - "labels": {}, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "kibana_palette", - "type": "palette" + { + "id": "logs-*", + "name": "7c3f54ff-e80d-4cde-87c2-8c2762777d11", + "type": "index-pattern" }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "normal", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "90b12605-8f79-48c2-939f-6ce4d281e23a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f9829e6-d592-49e8-a5e5-11dba09be853": { + "columnOrder": [ + "fe86d1dd-e349-4996-b503-345b6606ab01", + "87146e35-0d4a-43ed-9595-9ef7d2b30424", + "2e4ce806-fac4-4a32-80ee-e1e24c3b8a10" + ], + "columns": { + "2e4ce806-fac4-4a32-80ee-e1e24c3b8a10": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "87146e35-0d4a-43ed-9595-9ef7d2b30424": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.application: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2e4ce806-fac4-4a32-80ee-e1e24c3b8a10", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.application" + }, + "fe86d1dd-e349-4996-b503-345b6606ab01": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2e4ce806-fac4-4a32-80ee-e1e24c3b8a10", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "horizontal_bar", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": true, - "rotate": 75, - "show": true, - "truncate": 100 + "$state": { + "store": "appState" }, - "name": "LeftAxis-1", - "position": "bottom", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "horizontal_bar", - "uiState": {} - } - }, - "gridData": { - "h": 15, - "i": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4", - "w": 12, - "x": 36, - "y": 15 - }, - "panelIndex": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4", - "title": "Destination Zone breakout [Logs PANW]", - "type": "visualization", - "version": "8.2.1" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7c3f54ff-e80d-4cde-87c2-8c2762777d11", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "metric", - "type": "count" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "2", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "network.application", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "90b12605-8f79-48c2-939f-6ce4d281e23a", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendDisplay": "show", - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "truncateLegend": true, - "type": "pie" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "9f9829e6-d592-49e8-a5e5-11dba09be853", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "2e4ce806-fac4-4a32-80ee-e1e24c3b8a10" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "fe86d1dd-e349-4996-b503-345b6606ab01", + "87146e35-0d4a-43ed-9595-9ef7d2b30424" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "pie", - "uiState": {} - } + "title": "Network Application breakout [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1438,107 +1925,232 @@ }, "panelIndex": "c5a5b70d-b612-445f-8a8a-2fbdf682bd4d", "title": "Network Application breakout [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "emptyAsNull": false - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-aa61ea16-8838-49f6-bcb2-f55f5418da31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2259f37-6834-4cdc-af0d-c10564f6ba74", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9c263aea-b710-497a-9d21-ae8aa3d0353e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "aa61ea16-8838-49f6-bcb2-f55f5418da31": { + "columnOrder": [ + "ac1b7171-5b9e-4b62-afa3-6b5a6385e59d", + "19806906-9423-4297-ac66-37ccbaa2bf7c", + "df4e1544-fcfc-4bcd-89eb-90c03143fc14", + "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43" + ], + "columns": { + "19806906-9423-4297-ac66-37ccbaa2bf7c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.transport: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "ac1b7171-5b9e-4b62-afa3-6b5a6385e59d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.outcome: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.outcome" + }, + "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "df4e1544-fcfc-4bcd-89eb-90c03143fc14": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "destination.port: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.port" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "event.outcome", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e2259f37-6834-4cdc-af0d-c10564f6ba74", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } }, { - "enabled": true, - "id": "4", - "params": { - "field": "destination.port", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "index": "9c263aea-b710-497a-9d21-ae8aa3d0353e", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "addTooltip": true, - "distinctColors": true, - "emptySizeRatio": 0.3, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendDisplay": "show", - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "truncateLegend": true, - "type": "pie" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "aa61ea16-8838-49f6-bcb2-f55f5418da31", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "c85dec36-542b-4ec0-aaa7-f89e8ffa5d43" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ac1b7171-5b9e-4b62-afa3-6b5a6385e59d", + "19806906-9423-4297-ac66-37ccbaa2bf7c", + "df4e1544-fcfc-4bcd-89eb-90c03143fc14" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } }, - "type": "pie", - "uiState": {} - } + "title": "Event Outcome by Transport and Destination Port [Logs PANW] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1549,73 +2161,74 @@ }, "panelIndex": "60d64f0c-372d-40fd-b522-0d13a7513795", "title": "Event Outcome by Transport and Destination Port [Logs PANW]", - "type": "visualization", - "version": "8.2.1" + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] Network Flows", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:53:58.481Z", "id": "panw-e40ba240-7572-11e9-976e-65a8f47cc4c1", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "c31e5ac3-5063-4124-9a6f-b01af9e160b4:layer_1_source_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "2b2d20f7-1d92-47e1-b44d-223c78a812a2:layer_1_source_index_pattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "c31e5ac3-5063-4124-9a6f-b01af9e160b4:layer_1_source_index_pattern", + "name": "93b617ff-5dac-4353-a0ec-6c37ed4c2531:indexpattern-datasource-layer-1c2d6cb2-e621-4508-b091-68698e3cbdc5", "type": "index-pattern" }, { "id": "logs-*", - "name": "2b2d20f7-1d92-47e1-b44d-223c78a812a2:layer_1_source_index_pattern", + "name": "93b617ff-5dac-4353-a0ec-6c37ed4c2531:1082dcd1-4d01-41f8-88aa-d2e004c2f107", "type": "index-pattern" }, { "id": "logs-*", - "name": "93b617ff-5dac-4353-a0ec-6c37ed4c2531:indexpattern-datasource-current-indexpattern", + "name": "93b617ff-5dac-4353-a0ec-6c37ed4c2531:0960210a-1629-4872-9b8d-538840ef3cf0", "type": "index-pattern" }, { "id": "logs-*", - "name": "93b617ff-5dac-4353-a0ec-6c37ed4c2531:indexpattern-datasource-layer-1c2d6cb2-e621-4508-b091-68698e3cbdc5", + "name": "5c9269a0-1965-4ad6-8490-2f9c73a5224d:indexpattern-datasource-layer-43b12ac6-d4db-411f-b08e-f5f4075e0be5", "type": "index-pattern" }, { "id": "logs-*", - "name": "5c9269a0-1965-4ad6-8490-2f9c73a5224d:indexpattern-datasource-current-indexpattern", + "name": "5c9269a0-1965-4ad6-8490-2f9c73a5224d:cec0b893-7b6f-4a6e-adfd-e2534e004091", "type": "index-pattern" }, { "id": "logs-*", - "name": "5c9269a0-1965-4ad6-8490-2f9c73a5224d:indexpattern-datasource-layer-43b12ac6-d4db-411f-b08e-f5f4075e0be5", + "name": "5c9269a0-1965-4ad6-8490-2f9c73a5224d:a3728121-873d-4210-9d05-e6c99f219f1e", "type": "index-pattern" }, { "id": "logs-*", - "name": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14:indexpattern-datasource-current-indexpattern", + "name": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14:indexpattern-datasource-layer-0104fc7a-d74d-4b79-96f9-5b21d7d0940d", "type": "index-pattern" }, { "id": "logs-*", - "name": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14:indexpattern-datasource-layer-0104fc7a-d74d-4b79-96f9-5b21d7d0940d", + "name": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14:d736d790-9438-4805-b54f-be47df2683eb", "type": "index-pattern" }, { "id": "logs-*", - "name": "2921706d-6ceb-4030-bdb3-d18db36af7e5:indexpattern-datasource-current-indexpattern", + "name": "9fad24ef-e4b2-4d82-aebb-eebc302d4b14:e4a4aea8-d4b9-4b09-b761-859c4bb13284", "type": "index-pattern" }, { @@ -1625,7 +2238,12 @@ }, { "id": "logs-*", - "name": "ed22ae2c-66ec-4426-87b6-2384aa38fe59:indexpattern-datasource-current-indexpattern", + "name": "2921706d-6ceb-4030-bdb3-d18db36af7e5:eb23da0c-c8ac-45a4-a41c-044d0507fa4e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2921706d-6ceb-4030-bdb3-d18db36af7e5:524d827c-bd75-4717-9af4-ff03b48b5aec", "type": "index-pattern" }, { @@ -1633,50 +2251,95 @@ "name": "ed22ae2c-66ec-4426-87b6-2384aa38fe59:indexpattern-datasource-layer-3fa812b2-58e7-4e77-9cf8-5d748f3cbcfc", "type": "index-pattern" }, + { + "id": "logs-*", + "name": "ed22ae2c-66ec-4426-87b6-2384aa38fe59:cbf084c9-ffa0-4e9c-a117-7cb643b84344", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ed22ae2c-66ec-4426-87b6-2384aa38fe59:d651160e-2ee6-451b-96cd-8a047b081ca2", + "type": "index-pattern" + }, { "id": "panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4", "name": "a2049bc0-48d4-40f0-882a-2191b99d6a8f:panel_a2049bc0-48d4-40f0-882a-2191b99d6a8f", "type": "search" }, { - "id": "panw-290685e0-7569-11e9-976e-65a8f47cc4c1", - "name": "64dcfd5b-2640-432b-81b7-60405232b4a3:search_0", - "type": "search" + "id": "logs-*", + "name": "64dcfd5b-2640-432b-81b7-60405232b4a3:indexpattern-datasource-layer-dcc0fb94-9303-431e-93a5-9713d183133c", + "type": "index-pattern" }, { "id": "logs-*", - "name": "64dcfd5b-2640-432b-81b7-60405232b4a3:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "64dcfd5b-2640-432b-81b7-60405232b4a3:299be618-63f1-4bdf-a732-55c0a64db857", "type": "index-pattern" }, { - "id": "panw-290685e0-7569-11e9-976e-65a8f47cc4c1", - "name": "49836c0a-6ee7-4ed7-adc9-444169243b4c:search_0", - "type": "search" + "id": "logs-*", + "name": "64dcfd5b-2640-432b-81b7-60405232b4a3:0a11d454-367f-4379-9327-9ae5eb84efe4", + "type": "index-pattern" }, { "id": "logs-*", - "name": "49836c0a-6ee7-4ed7-adc9-444169243b4c:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "49836c0a-6ee7-4ed7-adc9-444169243b4c:indexpattern-datasource-layer-65a4cb5a-41f5-4ace-877c-fade2d5f6f34", "type": "index-pattern" }, { - "id": "panw-290685e0-7569-11e9-976e-65a8f47cc4c1", - "name": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4:search_0", - "type": "search" + "id": "logs-*", + "name": "49836c0a-6ee7-4ed7-adc9-444169243b4c:dbb45061-6074-46bf-8aa9-07f3208aa268", + "type": "index-pattern" }, { "id": "logs-*", - "name": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "49836c0a-6ee7-4ed7-adc9-444169243b4c:5e9f4e0d-afd1-4a12-ac0e-1b1433771619", "type": "index-pattern" }, { - "id": "panw-290685e0-7569-11e9-976e-65a8f47cc4c1", - "name": "c5a5b70d-b612-445f-8a8a-2fbdf682bd4d:search_0", - "type": "search" + "id": "logs-*", + "name": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4:indexpattern-datasource-layer-f7e049ec-c80f-4008-b744-8345ed70f965", + "type": "index-pattern" }, { - "id": "panw-290685e0-7569-11e9-976e-65a8f47cc4c1", - "name": "60d64f0c-372d-40fd-b522-0d13a7513795:search_0", - "type": "search" + "id": "logs-*", + "name": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4:a581f776-a3a2-4edf-8209-9fb92df08bfa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9165d23-d0b1-4a49-8a75-a461e7ea45a4:60787863-31d8-4fcf-be52-54f177d770b4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c5a5b70d-b612-445f-8a8a-2fbdf682bd4d:indexpattern-datasource-layer-9f9829e6-d592-49e8-a5e5-11dba09be853", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c5a5b70d-b612-445f-8a8a-2fbdf682bd4d:7c3f54ff-e80d-4cde-87c2-8c2762777d11", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c5a5b70d-b612-445f-8a8a-2fbdf682bd4d:90b12605-8f79-48c2-939f-6ce4d281e23a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60d64f0c-372d-40fd-b522-0d13a7513795:indexpattern-datasource-layer-aa61ea16-8838-49f6-bcb2-f55f5418da31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60d64f0c-372d-40fd-b522-0d13a7513795:e2259f37-6834-4cdc-af0d-c10564f6ba74", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60d64f0c-372d-40fd-b522-0d13a7513795:9c263aea-b710-497a-9d21-ae8aa3d0353e", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/panw/kibana/dashboard/panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/dashboard/panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e.json index 38927eaf7c5..ad78a9bb12a 100644 --- a/packages/panw/kibana/dashboard/panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/dashboard/panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e.json @@ -1,66 +1,9 @@ { "attributes": { "description": "Palo Alto Networks PAN-OS GTP and SCTP Overview", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "panw.panos" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "panw.panos" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "panw.panos.type", - "negate": false, - "params": [ - "GTP", - "SCTP" - ], - "type": "phrases" - }, - "query": { - "bool": { - "minimum_should_match": 1, - "should": [ - { - "match_phrase": { - "panw.panos.type": "GTP" - } - }, - { - "match_phrase": { - "panw.panos.type": "SCTP" - } - } - ] - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -70,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,23 +24,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-37953b09-6cff-411c-bdb4-b6ab4667cfbf", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-37953b09-6cff-411c-bdb4-b6ab4667cfbf", + "name": "67b8f026-0fd3-4f51-b4bc-d3813dd9edc7", "type": "index-pattern" }, { "id": "logs-*", - "name": "5bb2ab19-5281-40a9-bd21-38a3f432c795", + "name": "356121f1-2273-4cc2-8b2f-9d620aac5650", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "37953b09-6cff-411c-bdb4-b6ab4667cfbf": { "columnOrder": [ @@ -151,7 +97,7 @@ "meta": { "alias": null, "disabled": false, - "index": "5bb2ab19-5281-40a9-bd21-38a3f432c795", + "index": "67b8f026-0fd3-4f51-b4bc-d3813dd9edc7", "key": "panw.panos.type", "negate": false, "params": { @@ -164,8 +110,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "356121f1-2273-4cc2-8b2f-9d620aac5650", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -174,15 +143,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "2e42246b-8906-4ff5-b644-1e6d90928a2e" - ], "layerId": "37953b09-6cff-411c-bdb4-b6ab4667cfbf", "layerType": "data", "legendDisplay": "default", - "metric": "d9c80c61-73d9-4246-897e-aa458c07440f", + "legendSize": "auto", + "metrics": [ + "d9c80c61-73d9-4246-897e-aa458c07440f" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "2e42246b-8906-4ff5-b644-1e6d90928a2e" + ] } ], "shape": "pie" @@ -205,7 +177,7 @@ "panelIndex": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a", "title": "Distribution of GTP Events by Tunneling Protocol [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -213,23 +185,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-d945ceac-e350-45bc-8f86-8056e6b4777c", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-d945ceac-e350-45bc-8f86-8056e6b4777c", + "name": "4ab26128-95e0-4542-818d-e35eb37f33cb", "type": "index-pattern" }, { "id": "logs-*", - "name": "5c0c35f6-88c1-4520-a2b7-d31fc379208b", + "name": "43860b85-38cb-4e17-b9ba-e874737bb4af", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d945ceac-e350-45bc-8f86-8056e6b4777c": { "columnOrder": [ @@ -285,7 +258,7 @@ "meta": { "alias": null, "disabled": false, - "index": "5c0c35f6-88c1-4520-a2b7-d31fc379208b", + "index": "4ab26128-95e0-4542-818d-e35eb37f33cb", "key": "panw.panos.type", "negate": false, "params": { @@ -298,8 +271,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "43860b85-38cb-4e17-b9ba-e874737bb4af", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -308,15 +304,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d92fb0e9-ac4e-4d91-a9f3-ce057a107c64" - ], "layerId": "d945ceac-e350-45bc-8f86-8056e6b4777c", "layerType": "data", "legendDisplay": "default", - "metric": "6b2ca86a-28cd-4047-a4f8-e9a33c0341b8", + "legendSize": "auto", + "metrics": [ + "6b2ca86a-28cd-4047-a4f8-e9a33c0341b8" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d92fb0e9-ac4e-4d91-a9f3-ce057a107c64" + ] } ], "shape": "pie" @@ -339,7 +338,7 @@ "panelIndex": "6503dfff-48b2-4894-b16d-202fd2c279ac", "title": "Distribution of GTP Events by Action taken on Session [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -347,23 +346,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-95b34e65-f823-4168-acb3-6de1c847a6c9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-95b34e65-f823-4168-acb3-6de1c847a6c9", + "name": "2bb379c7-ca84-4772-ac5b-f072432e8fc4", "type": "index-pattern" }, { "id": "logs-*", - "name": "c88c184f-bf3a-4641-bad2-7c9859ed0bf1", + "name": "1a0a5774-6c96-402b-b270-5211f1684db5", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "95b34e65-f823-4168-acb3-6de1c847a6c9": { "columnOrder": [ @@ -419,7 +419,7 @@ "meta": { "alias": null, "disabled": false, - "index": "c88c184f-bf3a-4641-bad2-7c9859ed0bf1", + "index": "2bb379c7-ca84-4772-ac5b-f072432e8fc4", "key": "panw.panos.type", "negate": false, "params": { @@ -432,8 +432,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "1a0a5774-6c96-402b-b270-5211f1684db5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -442,15 +465,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "53c725ee-0984-4504-8f5c-5a88b7c7729e" - ], "layerId": "95b34e65-f823-4168-acb3-6de1c847a6c9", "layerType": "data", "legendDisplay": "default", - "metric": "6bb29f78-f893-4e4a-964d-9543503100b2", + "legendSize": "auto", + "metrics": [ + "6bb29f78-f893-4e4a-964d-9543503100b2" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "53c725ee-0984-4504-8f5c-5a88b7c7729e" + ] } ], "shape": "pie" @@ -473,7 +499,7 @@ "panelIndex": "d893cb39-94bb-4c57-9821-d14848a3cf62", "title": "Distribution of GTP Events by Radio Access Technology [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -481,23 +507,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-ab52534a-d6bd-4d65-9809-5e6151646028", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ab52534a-d6bd-4d65-9809-5e6151646028", + "name": "3ed986ab-0eb4-42dd-822a-16e065fcd666", "type": "index-pattern" }, { "id": "logs-*", - "name": "21271ce2-bb2e-4494-94ec-38b5f1ad8128", + "name": "24c5bae5-904e-4b4b-9809-a26f3e5b1c4a", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ab52534a-d6bd-4d65-9809-5e6151646028": { "columnOrder": [ @@ -553,7 +580,7 @@ "meta": { "alias": null, "disabled": false, - "index": "21271ce2-bb2e-4494-94ec-38b5f1ad8128", + "index": "3ed986ab-0eb4-42dd-822a-16e065fcd666", "key": "panw.panos.type", "negate": false, "params": { @@ -566,8 +593,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "24c5bae5-904e-4b4b-9809-a26f3e5b1c4a", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -576,15 +626,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "401aab5f-22de-48c0-93c0-1f85451b39ba" - ], "layerId": "ab52534a-d6bd-4d65-9809-5e6151646028", "layerType": "data", "legendDisplay": "default", - "metric": "73a018de-4600-4374-9d78-da2c48b8ec8e", + "legendSize": "auto", + "metrics": [ + "73a018de-4600-4374-9d78-da2c48b8ec8e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "401aab5f-22de-48c0-93c0-1f85451b39ba" + ] } ], "shape": "pie" @@ -607,7 +660,7 @@ "panelIndex": "62030e7d-6766-4a90-8bd1-04ea752de4b8", "title": "Distribution of GTP Events by GTP Message Type [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -615,23 +668,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-090bed90-65fa-4a6b-95cd-41cc89e205e1", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-090bed90-65fa-4a6b-95cd-41cc89e205e1", + "name": "7fb4e1dd-1e0b-479c-993f-7c1b645bc548", "type": "index-pattern" }, { "id": "logs-*", - "name": "f89e89c0-7461-4257-9c52-92cd2413af0b", + "name": "2f8fd556-e737-49bb-b193-f338f82faf59", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "090bed90-65fa-4a6b-95cd-41cc89e205e1": { "columnOrder": [ @@ -733,7 +787,7 @@ "meta": { "alias": null, "disabled": false, - "index": "f89e89c0-7461-4257-9c52-92cd2413af0b", + "index": "7fb4e1dd-1e0b-479c-993f-7c1b645bc548", "key": "panw.panos.type", "negate": false, "params": { @@ -746,8 +800,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2f8fd556-e737-49bb-b193-f338f82faf59", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -791,7 +868,7 @@ "panelIndex": "da1fdcfd-a120-4eb6-bd40-93731a66af2a", "title": "Top 10 GTP Events with Highest Application Risk [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -799,23 +876,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-7c5c56c1-1c2d-4b04-829c-e6708722edb5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-7c5c56c1-1c2d-4b04-829c-e6708722edb5", + "name": "bca8f73c-0eaa-4b0f-a77c-eb706c784b03", "type": "index-pattern" }, { "id": "logs-*", - "name": "d3570af2-fe86-4a39-82d1-f1760f66161f", + "name": "08879dd5-298c-497f-8473-36779ba32cf1", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7c5c56c1-1c2d-4b04-829c-e6708722edb5": { "columnOrder": [ @@ -871,7 +949,7 @@ "meta": { "alias": null, "disabled": false, - "index": "d3570af2-fe86-4a39-82d1-f1760f66161f", + "index": "bca8f73c-0eaa-4b0f-a77c-eb706c784b03", "key": "panw.panos.type", "negate": false, "params": { @@ -884,8 +962,31 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "08879dd5-298c-497f-8473-36779ba32cf1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -894,15 +995,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "a4e93049-e21a-40bb-ac4c-f14870d2be28" - ], "layerId": "7c5c56c1-1c2d-4b04-829c-e6708722edb5", "layerType": "data", "legendDisplay": "default", - "metric": "48311c6c-e2ad-4bbf-a1b6-34c6f4764d67", + "legendSize": "auto", + "metrics": [ + "48311c6c-e2ad-4bbf-a1b6-34c6f4764d67" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "a4e93049-e21a-40bb-ac4c-f14870d2be28" + ] } ], "shape": "pie" @@ -925,7 +1029,7 @@ "panelIndex": "3d040105-b7ad-4af9-95ef-b0b39df4f108", "title": "Distribution of GTP Events by Severity [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -941,7 +1045,7 @@ "panelIndex": "4abbd412-3516-4fdc-9796-c4c3aa34d48a", "panelRefName": "panel_4abbd412-3516-4fdc-9796-c4c3aa34d48a", "type": "search", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -949,23 +1053,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-8899e6ee-bb67-41c3-9d68-54d139f158c5", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-8899e6ee-bb67-41c3-9d68-54d139f158c5", + "name": "31dc9db2-0bfb-4ae6-b00c-1a45c5969d4e", "type": "index-pattern" }, { "id": "logs-*", - "name": "4f9ca6fe-a870-437b-9e8a-a88ae145f622", + "name": "44b748aa-6761-4243-bc9e-157832f78f61", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8899e6ee-bb67-41c3-9d68-54d139f158c5": { "columnOrder": [ @@ -1021,7 +1126,7 @@ "meta": { "alias": null, "disabled": false, - "index": "4f9ca6fe-a870-437b-9e8a-a88ae145f622", + "index": "31dc9db2-0bfb-4ae6-b00c-1a45c5969d4e", "key": "panw.panos.type", "negate": false, "params": { @@ -1034,8 +1139,31 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "44b748aa-6761-4243-bc9e-157832f78f61", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1044,15 +1172,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "6e89644d-eddc-4e20-9f14-e85dd45f27d2" - ], "layerId": "8899e6ee-bb67-41c3-9d68-54d139f158c5", "layerType": "data", "legendDisplay": "default", - "metric": "19764130-3b6d-4478-a9d0-0c5eadab7b7c", + "legendSize": "auto", + "metrics": [ + "19764130-3b6d-4478-a9d0-0c5eadab7b7c" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "6e89644d-eddc-4e20-9f14-e85dd45f27d2" + ] } ], "shape": "pie" @@ -1075,7 +1206,7 @@ "panelIndex": "5ed3e745-5f78-4873-bb42-8159bb09f8dc", "title": "Distribution of SCTP Events by SCTP Association End Reason [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1083,23 +1214,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-74cb4c8b-d3a7-42e0-af64-03572454b444", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-74cb4c8b-d3a7-42e0-af64-03572454b444", + "name": "6b64c045-e88c-44dc-bf8c-39578d672c1a", "type": "index-pattern" }, { "id": "logs-*", - "name": "ad6e3372-fb07-4c4f-b2f5-d8d393a58971", + "name": "27981639-bb82-4fd8-adb8-8bc22f48e134", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "74cb4c8b-d3a7-42e0-af64-03572454b444": { "columnOrder": [ @@ -1155,7 +1287,7 @@ "meta": { "alias": null, "disabled": false, - "index": "ad6e3372-fb07-4c4f-b2f5-d8d393a58971", + "index": "6b64c045-e88c-44dc-bf8c-39578d672c1a", "key": "panw.panos.type", "negate": false, "params": { @@ -1168,8 +1300,31 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "27981639-bb82-4fd8-adb8-8bc22f48e134", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1178,15 +1333,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "392aaef7-65c9-44cf-a61f-45eab7b41642" - ], "layerId": "74cb4c8b-d3a7-42e0-af64-03572454b444", "layerType": "data", "legendDisplay": "default", - "metric": "ccd030e5-3709-4fca-a2c2-5b9ec23d29c6", + "legendSize": "auto", + "metrics": [ + "ccd030e5-3709-4fca-a2c2-5b9ec23d29c6" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "392aaef7-65c9-44cf-a61f-45eab7b41642" + ] } ], "shape": "pie" @@ -1209,7 +1367,7 @@ "panelIndex": "facc00d8-cfd3-4475-8407-632ca7083abe", "title": "Distribution of SCTP Events by Operation Code [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1217,23 +1375,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-4c84f3fe-a72a-4ed6-9859-34f408db5ed0", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-4c84f3fe-a72a-4ed6-9859-34f408db5ed0", + "name": "d5a7c4aa-5ad2-4986-9958-dbf12942d4bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "1c6ed305-d92a-485d-b448-a32f7a67e5e3", + "name": "2be32915-0726-4e27-a656-33fb2bd027cd", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4c84f3fe-a72a-4ed6-9859-34f408db5ed0": { "columnOrder": [ @@ -1289,7 +1448,7 @@ "meta": { "alias": null, "disabled": false, - "index": "1c6ed305-d92a-485d-b448-a32f7a67e5e3", + "index": "d5a7c4aa-5ad2-4986-9958-dbf12942d4bf", "key": "panw.panos.type", "negate": false, "params": { @@ -1302,8 +1461,31 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "2be32915-0726-4e27-a656-33fb2bd027cd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1312,15 +1494,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "fc6926b0-8681-45e3-953a-4cd54adcdfdb" - ], "layerId": "4c84f3fe-a72a-4ed6-9859-34f408db5ed0", "layerType": "data", "legendDisplay": "default", - "metric": "5ab2e7c2-6c93-4948-a172-7628061d9ac8", + "legendSize": "auto", + "metrics": [ + "5ab2e7c2-6c93-4948-a172-7628061d9ac8" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "fc6926b0-8681-45e3-953a-4cd54adcdfdb" + ] } ], "shape": "pie" @@ -1343,7 +1528,7 @@ "panelIndex": "70be4044-e443-471d-afa2-8c9ad770c1cf", "title": "Distribution of SCTP Events by Severity [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1351,23 +1536,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-ab7a5671-1d41-43f4-8af3-cd2f9e20c48f", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-ab7a5671-1d41-43f4-8af3-cd2f9e20c48f", + "name": "a6eb2c63-08fe-4c64-a98c-aba3708cb731", "type": "index-pattern" }, { "id": "logs-*", - "name": "981373f4-2ead-4219-bcfa-1253137d31e9", + "name": "829ae096-7f1f-4cda-90ac-b9dd8f8b37ff", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "ab7a5671-1d41-43f4-8af3-cd2f9e20c48f": { "columnOrder": [ @@ -1423,7 +1609,7 @@ "meta": { "alias": null, "disabled": false, - "index": "981373f4-2ead-4219-bcfa-1253137d31e9", + "index": "a6eb2c63-08fe-4c64-a98c-aba3708cb731", "key": "panw.panos.type", "negate": false, "params": { @@ -1436,8 +1622,31 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "829ae096-7f1f-4cda-90ac-b9dd8f8b37ff", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1446,15 +1655,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "b44e1938-0591-40b2-b5f6-e02e9849da69" - ], "layerId": "ab7a5671-1d41-43f4-8af3-cd2f9e20c48f", "layerType": "data", "legendDisplay": "default", - "metric": "f5ff81ac-d2dd-419e-baef-ad6508a26281", + "legendSize": "auto", + "metrics": [ + "f5ff81ac-d2dd-419e-baef-ad6508a26281" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "b44e1938-0591-40b2-b5f6-e02e9849da69" + ] } ], "shape": "pie" @@ -1477,7 +1689,7 @@ "panelIndex": "7f515d29-459d-45c9-9e53-05f1822e90bf", "title": "Distribution of SCTP Events by Action taken on Session [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1485,23 +1697,24 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", + "name": "indexpattern-datasource-layer-34c3c1e6-8715-4350-a814-8d4a92963eb9", "type": "index-pattern" }, { "id": "logs-*", - "name": "indexpattern-datasource-layer-34c3c1e6-8715-4350-a814-8d4a92963eb9", + "name": "3fff1966-fa5e-45c1-9163-49d191513f0c", "type": "index-pattern" }, { "id": "logs-*", - "name": "2c2103e6-a7b0-4d5d-b795-db569d744c5f", + "name": "384f3a5b-c2e5-4c02-b38c-2ef74740c9ea", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "34c3c1e6-8715-4350-a814-8d4a92963eb9": { "columnOrder": [ @@ -1557,7 +1770,7 @@ "meta": { "alias": null, "disabled": false, - "index": "2c2103e6-a7b0-4d5d-b795-db569d744c5f", + "index": "3fff1966-fa5e-45c1-9163-49d191513f0c", "key": "panw.panos.type", "negate": false, "params": { @@ -1570,8 +1783,31 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "384f3a5b-c2e5-4c02-b38c-2ef74740c9ea", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -1580,15 +1816,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "9618fef3-ccaa-4691-ae3b-a5cc9f3aaf37" - ], "layerId": "34c3c1e6-8715-4350-a814-8d4a92963eb9", "layerType": "data", "legendDisplay": "default", - "metric": "fe38243b-d323-4825-898e-b06434925a09", + "legendSize": "auto", + "metrics": [ + "fe38243b-d323-4825-898e-b06434925a09" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "9618fef3-ccaa-4691-ae3b-a5cc9f3aaf37" + ] } ], "shape": "pie" @@ -1611,7 +1850,7 @@ "panelIndex": "38bf38e1-1bce-432d-9f95-1350427f72f4", "title": "Distribution of SCTP Events by SCTP Filter Matched [Logs PANW]", "type": "lens", - "version": "8.2.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1627,34 +1866,20 @@ "panelIndex": "72bdd19e-c6f3-471a-894e-6dde6b0dab68", "panelRefName": "panel_72bdd19e-c6f3-471a-894e-6dde6b0dab68", "type": "search", - "version": "8.2.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs PANW] GTP and SCTP", "version": 1 }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T15:03:05.150Z", "id": "panw-f84a1440-dcf7-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { - "dashboard": "8.2.0" + "dashboard": "8.7.0" }, "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "logs-*", "name": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a:indexpattern-datasource-layer-37953b09-6cff-411c-bdb4-b6ab4667cfbf", @@ -1662,12 +1887,12 @@ }, { "id": "logs-*", - "name": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a:5bb2ab19-5281-40a9-bd21-38a3f432c795", + "name": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a:67b8f026-0fd3-4f51-b4bc-d3813dd9edc7", "type": "index-pattern" }, { "id": "logs-*", - "name": "6503dfff-48b2-4894-b16d-202fd2c279ac:indexpattern-datasource-current-indexpattern", + "name": "d24a3e24-73f6-4e1f-84f7-5885b8bf817a:356121f1-2273-4cc2-8b2f-9d620aac5650", "type": "index-pattern" }, { @@ -1677,12 +1902,12 @@ }, { "id": "logs-*", - "name": "6503dfff-48b2-4894-b16d-202fd2c279ac:5c0c35f6-88c1-4520-a2b7-d31fc379208b", + "name": "6503dfff-48b2-4894-b16d-202fd2c279ac:4ab26128-95e0-4542-818d-e35eb37f33cb", "type": "index-pattern" }, { "id": "logs-*", - "name": "d893cb39-94bb-4c57-9821-d14848a3cf62:indexpattern-datasource-current-indexpattern", + "name": "6503dfff-48b2-4894-b16d-202fd2c279ac:43860b85-38cb-4e17-b9ba-e874737bb4af", "type": "index-pattern" }, { @@ -1692,12 +1917,12 @@ }, { "id": "logs-*", - "name": "d893cb39-94bb-4c57-9821-d14848a3cf62:c88c184f-bf3a-4641-bad2-7c9859ed0bf1", + "name": "d893cb39-94bb-4c57-9821-d14848a3cf62:2bb379c7-ca84-4772-ac5b-f072432e8fc4", "type": "index-pattern" }, { "id": "logs-*", - "name": "62030e7d-6766-4a90-8bd1-04ea752de4b8:indexpattern-datasource-current-indexpattern", + "name": "d893cb39-94bb-4c57-9821-d14848a3cf62:1a0a5774-6c96-402b-b270-5211f1684db5", "type": "index-pattern" }, { @@ -1707,12 +1932,12 @@ }, { "id": "logs-*", - "name": "62030e7d-6766-4a90-8bd1-04ea752de4b8:21271ce2-bb2e-4494-94ec-38b5f1ad8128", + "name": "62030e7d-6766-4a90-8bd1-04ea752de4b8:3ed986ab-0eb4-42dd-822a-16e065fcd666", "type": "index-pattern" }, { "id": "logs-*", - "name": "da1fdcfd-a120-4eb6-bd40-93731a66af2a:indexpattern-datasource-current-indexpattern", + "name": "62030e7d-6766-4a90-8bd1-04ea752de4b8:24c5bae5-904e-4b4b-9809-a26f3e5b1c4a", "type": "index-pattern" }, { @@ -1722,12 +1947,12 @@ }, { "id": "logs-*", - "name": "da1fdcfd-a120-4eb6-bd40-93731a66af2a:f89e89c0-7461-4257-9c52-92cd2413af0b", + "name": "da1fdcfd-a120-4eb6-bd40-93731a66af2a:7fb4e1dd-1e0b-479c-993f-7c1b645bc548", "type": "index-pattern" }, { "id": "logs-*", - "name": "3d040105-b7ad-4af9-95ef-b0b39df4f108:indexpattern-datasource-current-indexpattern", + "name": "da1fdcfd-a120-4eb6-bd40-93731a66af2a:2f8fd556-e737-49bb-b193-f338f82faf59", "type": "index-pattern" }, { @@ -1737,7 +1962,12 @@ }, { "id": "logs-*", - "name": "3d040105-b7ad-4af9-95ef-b0b39df4f108:d3570af2-fe86-4a39-82d1-f1760f66161f", + "name": "3d040105-b7ad-4af9-95ef-b0b39df4f108:bca8f73c-0eaa-4b0f-a77c-eb706c784b03", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3d040105-b7ad-4af9-95ef-b0b39df4f108:08879dd5-298c-497f-8473-36779ba32cf1", "type": "index-pattern" }, { @@ -1745,11 +1975,6 @@ "name": "4abbd412-3516-4fdc-9796-c4c3aa34d48a:panel_4abbd412-3516-4fdc-9796-c4c3aa34d48a", "type": "search" }, - { - "id": "logs-*", - "name": "5ed3e745-5f78-4873-bb42-8159bb09f8dc:indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "logs-*", "name": "5ed3e745-5f78-4873-bb42-8159bb09f8dc:indexpattern-datasource-layer-8899e6ee-bb67-41c3-9d68-54d139f158c5", @@ -1757,12 +1982,12 @@ }, { "id": "logs-*", - "name": "5ed3e745-5f78-4873-bb42-8159bb09f8dc:4f9ca6fe-a870-437b-9e8a-a88ae145f622", + "name": "5ed3e745-5f78-4873-bb42-8159bb09f8dc:31dc9db2-0bfb-4ae6-b00c-1a45c5969d4e", "type": "index-pattern" }, { "id": "logs-*", - "name": "facc00d8-cfd3-4475-8407-632ca7083abe:indexpattern-datasource-current-indexpattern", + "name": "5ed3e745-5f78-4873-bb42-8159bb09f8dc:44b748aa-6761-4243-bc9e-157832f78f61", "type": "index-pattern" }, { @@ -1772,12 +1997,12 @@ }, { "id": "logs-*", - "name": "facc00d8-cfd3-4475-8407-632ca7083abe:ad6e3372-fb07-4c4f-b2f5-d8d393a58971", + "name": "facc00d8-cfd3-4475-8407-632ca7083abe:6b64c045-e88c-44dc-bf8c-39578d672c1a", "type": "index-pattern" }, { "id": "logs-*", - "name": "70be4044-e443-471d-afa2-8c9ad770c1cf:indexpattern-datasource-current-indexpattern", + "name": "facc00d8-cfd3-4475-8407-632ca7083abe:27981639-bb82-4fd8-adb8-8bc22f48e134", "type": "index-pattern" }, { @@ -1787,12 +2012,12 @@ }, { "id": "logs-*", - "name": "70be4044-e443-471d-afa2-8c9ad770c1cf:1c6ed305-d92a-485d-b448-a32f7a67e5e3", + "name": "70be4044-e443-471d-afa2-8c9ad770c1cf:d5a7c4aa-5ad2-4986-9958-dbf12942d4bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "7f515d29-459d-45c9-9e53-05f1822e90bf:indexpattern-datasource-current-indexpattern", + "name": "70be4044-e443-471d-afa2-8c9ad770c1cf:2be32915-0726-4e27-a656-33fb2bd027cd", "type": "index-pattern" }, { @@ -1802,12 +2027,12 @@ }, { "id": "logs-*", - "name": "7f515d29-459d-45c9-9e53-05f1822e90bf:981373f4-2ead-4219-bcfa-1253137d31e9", + "name": "7f515d29-459d-45c9-9e53-05f1822e90bf:a6eb2c63-08fe-4c64-a98c-aba3708cb731", "type": "index-pattern" }, { "id": "logs-*", - "name": "38bf38e1-1bce-432d-9f95-1350427f72f4:indexpattern-datasource-current-indexpattern", + "name": "7f515d29-459d-45c9-9e53-05f1822e90bf:829ae096-7f1f-4cda-90ac-b9dd8f8b37ff", "type": "index-pattern" }, { @@ -1817,7 +2042,12 @@ }, { "id": "logs-*", - "name": "38bf38e1-1bce-432d-9f95-1350427f72f4:2c2103e6-a7b0-4d5d-b795-db569d744c5f", + "name": "38bf38e1-1bce-432d-9f95-1350427f72f4:3fff1966-fa5e-45c1-9163-49d191513f0c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "38bf38e1-1bce-432d-9f95-1350427f72f4:384f3a5b-c2e5-4c02-b38c-2ef74740c9ea", "type": "index-pattern" }, { diff --git a/packages/panw/kibana/search/panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4.json index ecdfb476e85..acd3bbbad88 100644 --- a/packages/panw/kibana/search/panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4.json @@ -10,6 +10,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -33,6 +34,28 @@ "panw.panos.type": "USERID" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -48,9 +71,12 @@ "desc" ] ], - "title": "User ID Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "User ID Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-0ffe1200-ddb9-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -65,6 +91,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4.json index 11cfdce9636..f85f059f36f 100644 --- a/packages/panw/kibana/search/panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4.json @@ -10,6 +10,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -33,6 +34,28 @@ "panw.panos.type": "IPTAG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -48,9 +71,12 @@ "desc" ] ], - "title": "IP Tag Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "IP Tag Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-1d9d5060-ddb9-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -65,6 +91,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4.json index 4091b44fb66..6301964bd62 100644 --- a/packages/panw/kibana/search/panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4.json @@ -10,13 +10,59 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "GLOBALPROTECT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "GLOBALPROTECT" + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", - "query": "data_stream.dataset : \"panw.panos\" and panw.panos.type : \"GLOBALPROTECT\" " + "query": "" } } }, @@ -26,9 +72,12 @@ "desc" ] ], - "title": "GlobalProtect Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "GlobalProtect Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-24a5cf50-ddb8-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -38,6 +87,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4.json index 8be70bce746..2880857a1d2 100644 --- a/packages/panw/kibana/search/panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4.json @@ -10,9 +10,55 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "THREAT" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "THREAT" + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", @@ -26,9 +72,12 @@ "desc" ] ], - "title": "Threat Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Threat Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-37acbca0-ddb1-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -38,6 +87,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4.json index 9a66a70d044..af9a7ab2518 100644 --- a/packages/panw/kibana/search/panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4.json @@ -11,6 +11,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -28,7 +29,11 @@ "HIP-MATCH", "HIPMATCH" ], - "type": "phrases" + "type": "phrases", + "value": [ + "HIP-MATCH", + "HIPMATCH" + ] }, "query": { "bool": { @@ -47,6 +52,28 @@ ] } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -62,9 +89,12 @@ "desc" ] ], - "title": "HIP Match Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "HIP Match Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-6d0ea500-ddb8-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -79,6 +109,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4.json index ab24dc848d4..6e65a9ec9dd 100644 --- a/packages/panw/kibana/search/panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4.json @@ -11,6 +11,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -34,6 +35,28 @@ "panw.panos.type": "CORRELATION" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -49,9 +72,12 @@ "desc" ] ], - "title": "Correlated Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Correlated Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-79d117f0-ddb8-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -66,6 +92,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4.json index bf2b5c50f98..202685f3680 100644 --- a/packages/panw/kibana/search/panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4.json @@ -12,6 +12,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,6 +36,28 @@ "panw.panos.type": "GTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -50,9 +73,12 @@ "desc" ] ], - "title": "GTP Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "GTP Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-89e2f970-ddb7-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -67,6 +93,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4.json index 59b155ec6ce..70cbba7a23f 100644 --- a/packages/panw/kibana/search/panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4.json @@ -11,9 +11,72 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": [ + "START", + "END" + ], + "type": "phrases", + "value": [ + "START", + "END" + ] + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "panw.panos.type": "START" + } + }, + { + "match_phrase": { + "panw.panos.type": "END" + } + } + ] + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", @@ -27,9 +90,12 @@ "desc" ] ], - "title": "Tunnel Inspection Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Tunnel Inspection Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-8dc6b590-ddb2-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -39,6 +105,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4.json index efd5bcd9681..274b2f0b4e6 100644 --- a/packages/panw/kibana/search/panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4.json @@ -12,6 +12,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -35,6 +36,28 @@ "panw.panos.type": "SCTP" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -50,9 +73,12 @@ "desc" ] ], - "title": "SCTP Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "SCTP Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-92083d90-ddb7-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -67,6 +93,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4.json index 593845e5aa5..305c4355b0b 100644 --- a/packages/panw/kibana/search/panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4.json @@ -11,9 +11,55 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "TRAFFIC" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "TRAFFIC" + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", @@ -27,9 +73,12 @@ "desc" ] ], - "title": "Traffic Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Traffic Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-9df5cdf0-ddaf-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -39,6 +88,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e.json b/packages/panw/kibana/search/panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e.json index 67ee199233c..b71ce2fe656 100644 --- a/packages/panw/kibana/search/panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e.json +++ b/packages/panw/kibana/search/panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e.json @@ -11,9 +11,55 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "AUTHENTICATION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "AUTHENTICATION" + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", @@ -27,9 +73,12 @@ "desc" ] ], - "title": "Authentication Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Authentication Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-a93a1c80-dcd7-11ec-8b8b-1fae02ab6a5e", "migrationVersion": { "search": "8.0.0" @@ -39,6 +88,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4.json index 290d5a9f37c..4315891cae6 100644 --- a/packages/panw/kibana/search/panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4.json @@ -10,6 +10,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -33,6 +34,28 @@ "panw.panos.type": "CONFIG" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -48,9 +71,12 @@ "desc" ] ], - "title": "Config Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Config Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-c53134a0-ddb8-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -65,6 +91,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4.json index 3dfcfaa5f82..ed52834e3a8 100644 --- a/packages/panw/kibana/search/panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4.json @@ -11,9 +11,55 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "panw.panos.type", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "panw.panos.type", + "negate": false, + "params": { + "query": "DECRYPTION" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "panw.panos.type": "DECRYPTION" + } + } + } + ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { "language": "kuery", @@ -27,9 +73,12 @@ "desc" ] ], - "title": "Decryption Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "Decryption Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-cfbe1f60-ddb7-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -39,6 +88,16 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/search/panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4.json b/packages/panw/kibana/search/panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4.json index 275049399e5..b9ac721db1c 100644 --- a/packages/panw/kibana/search/panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4.json +++ b/packages/panw/kibana/search/panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4.json @@ -10,6 +10,7 @@ "description": "", "grid": {}, "hideChart": false, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -33,6 +34,28 @@ "panw.panos.type": "SYSTEM" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "panw.panos" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "panw.panos" + } + } } ], "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", @@ -48,9 +71,12 @@ "desc" ] ], - "title": "System Events Essential Details [Logs PANW]" + "timeRestore": false, + "title": "System Events Essential Details [Logs PANW]", + "usesAdHocDataView": false }, - "coreMigrationVersion": "8.2.1", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T14:39:06.897Z", "id": "panw-d01e7260-ddb8-11ec-8e76-9b3b99f98cd4", "migrationVersion": { "search": "8.0.0" @@ -65,6 +91,11 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" } ], "type": "search" diff --git a/packages/panw/kibana/tags.yml b/packages/panw/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/panw/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/panw/manifest.yml b/packages/panw/manifest.yml index 1ee4df28c9a..92d30727196 100644 --- a/packages/panw/manifest.yml +++ b/packages/panw/manifest.yml @@ -1,25 +1,23 @@ name: panw title: Palo Alto Next-Gen Firewall -version: "3.12.0" -release: ga +version: "3.16.0" description: Collect logs from Palo Alto next-gen firewalls with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: [security, network] conditions: - kibana.version: ^8.2.1 + kibana.version: ^8.7.1 icons: - src: /img/logo-integrations-paloalto-networks.svg title: Palo Alto Networks size: 216x216 type: image/svg+xml screenshots: - - src: /img/filebeat-panw-traffic.png + - src: /img/panw-traffic.png title: Traffic Dashboard size: 2546x2888 type: image/png - - src: /img/filebeat-panw-threat.png + - src: /img/panw-threat.png title: Threat Dashboard size: 2546x2496 type: image/png diff --git a/packages/panw_cortex_xdr/_dev/build/build.yml b/packages/panw_cortex_xdr/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/panw_cortex_xdr/_dev/build/build.yml +++ b/packages/panw_cortex_xdr/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/panw_cortex_xdr/_dev/build/docs/README.md b/packages/panw_cortex_xdr/_dev/build/docs/README.md index c9611415f1d..d8e1d0385d6 100644 --- a/packages/panw_cortex_xdr/_dev/build/docs/README.md +++ b/packages/panw_cortex_xdr/_dev/build/docs/README.md @@ -1,6 +1,6 @@ # Palo Alto Cortex XDR Integration -The PANW XDR integration collects alerts with multiple events from the [Cortex XDR API,](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-alerts). +The PANW XDR integration collects alerts with multiple events from the [Cortex XDR Alerts API](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Alerts) and incidents from [Cortex XDR Incidents API](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/IncidentManagement). ## Logs @@ -14,3 +14,13 @@ The Palo Alto XDR integration requires both an API key and API key ID, both whic {{fields "alerts"}} +### Incidents + +The Cortex XDR Incidents API is used to retrieve incidents generated by Cortex XDR based on raw endpoint data. A single incident might include one or more local endpoint events, each event generating its own document on Elasticsearch. + +The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI. See: [Get Started with Cortex XDR API](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html) + +{{event "incidents"}} + +{{fields "incidents"}} + diff --git a/packages/panw_cortex_xdr/_dev/deploy/docker/http-mock-config.yml b/packages/panw_cortex_xdr/_dev/deploy/docker/http-mock-config.yml index 1257e907b04..36a24ea0ed2 100644 --- a/packages/panw_cortex_xdr/_dev/deploy/docker/http-mock-config.yml +++ b/packages/panw_cortex_xdr/_dev/deploy/docker/http-mock-config.yml @@ -158,3 +158,86 @@ rules: ] } } + - path: /public_api/v1/incidents/get_incidents + methods: + - POST + request_headers: + Authorization: testing-token + X-Xdr-Auth-Id: 1 + request_body: /.*/ + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: >- + { + + "reply": { + "total_count": 390, + "result_count": 1, + "incidents": [ + { + "incident_id": "893", + "incident_name": null, + "creation_time": 1691976000230, + "modification_time": 1691976000230, + "detection_time": null, + "status": "new", + "severity": "low", + "description": "'Large Upload (Generic)' generated by XDR Analytics detected on host test1234 involving user nt authority\\system", + "assigned_user_mail": null, + "assigned_user_pretty_name": null, + "alert_count": 1, + "low_severity_alert_count": 1, + "med_severity_alert_count": 0, + "high_severity_alert_count": 0, + "critical_severity_alert_count": 0, + "user_count": 1, + "host_count": 1, + "notes": null, + "resolve_comment": null, + "resolved_timestamp": null, + "manual_severity": null, + "manual_description": null, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=893", + "starred": false, + "hosts": [ + "test1234:b567c1a651e66999158aef5d864dad25" + ], + "users": [ + "nt authority\\system" + ], + "incident_sources": [ + "XDR Analytics" + ], + "rule_based_score": null, + "predicted_score": 5, + "manual_score": null, + "aggregated_score": 5, + "wildfire_hits": 0, + "alerts_grouping_status": "Enabled", + "mitre_tactics_ids_and_names": [ + "TA0010 - Exfiltration" + ], + "mitre_techniques_ids_and_names": [ + "T1048 - Exfiltration Over Alternative Protocol" + ], + "alert_categories": [ + "Exfiltration" + ], + "original_tags": [ + "DS:PANW/XDR Agent", + "EG:win-server-ex-ransomeware_report", + "EG:win-server-default" + ], + "tags": [ + "DS:PANW/XDR Agent", + "EG:win-server-default", + "EG:win-server-ex-ransomeware_report" + ] + } + ], + "restricted_incident_ids": [] + } + } diff --git a/packages/panw_cortex_xdr/changelog.yml b/packages/panw_cortex_xdr/changelog.yml index 365054cd3ca..dc116bf2854 100644 --- a/packages/panw_cortex_xdr/changelog.yml +++ b/packages/panw_cortex_xdr/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.20.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.0" + changes: + - description: Add incident type events + type: enhancement + link: https://github.com/elastic/integrations/pull/7389 +- version: "1.17.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7295 +- version: "1.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.15.0" + changes: + - description: Document SSL options + type: enhancement + link: https://github.com/elastic/integrations/pull/7190 +- version: "1.14.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.13.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr-bioc.log-expected.json b/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr-bioc.log-expected.json index 39e790eaabd..fab1ef61c10 100644 --- a/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr-bioc.log-expected.json +++ b/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr-bioc.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-05-06T19:15:14.182Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", @@ -576,7 +576,9 @@ }, "registry": { "data": { - "strings": "0" + "strings": [ + "0" + ] }, "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile", "path": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\EnableFirewall", @@ -621,7 +623,7 @@ { "@timestamp": "2020-05-06T19:15:14.182Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", @@ -1198,7 +1200,9 @@ }, "registry": { "data": { - "strings": "0" + "strings": [ + "0" + ] }, "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile", "path": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile\\EnableFirewall", diff --git a/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr.log-expected.json b/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr.log-expected.json index d2ea559a569..c3e403d4041 100644 --- a/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr.log-expected.json +++ b/packages/panw_cortex_xdr/data_stream/alerts/_dev/test/pipeline/test-panw-xdr.log-expected.json @@ -19,7 +19,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BLOCKED_9", @@ -124,7 +124,7 @@ { "@timestamp": "2020-02-21T08:36:19.588Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BLOCKED", @@ -217,7 +217,7 @@ { "@timestamp": "2022-07-23T04:07:14.982Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", @@ -366,7 +366,7 @@ { "@timestamp": "2022-07-23T04:07:14.982Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", @@ -537,7 +537,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", @@ -694,7 +694,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DETECTED", diff --git a/packages/panw_cortex_xdr/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/panw_cortex_xdr/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 5b4fa033127..5dc131c2948 100644 --- a/packages/panw_cortex_xdr/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/panw_cortex_xdr/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Palo Alto XDR API. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: alert @@ -320,6 +320,10 @@ processors: field: panw_cortex.xdr.events.action_registry_data target_field: registry.data.strings ignore_missing: true + - set: + field: registry.data.strings + value: ['{{{registry.data.strings}}}'] + if: ctx.registry?.data?.strings instanceof String #The Actor actor is the process that performed the action. - rename: field: panw_cortex.xdr.events.actor_process_os_pid diff --git a/packages/panw_cortex_xdr/data_stream/alerts/manifest.yml b/packages/panw_cortex_xdr/data_stream/alerts/manifest.yml index cf097326b76..82d8943c705 100644 --- a/packages/panw_cortex_xdr/data_stream/alerts/manifest.yml +++ b/packages/panw_cortex_xdr/data_stream/alerts/manifest.yml @@ -1,5 +1,5 @@ type: logs -title: Palo Alto Cortex XDR API +title: Palo Alto Cortex XDR Alerts API streams: - input: httpjson vars: @@ -44,6 +44,7 @@ streams: - name: request_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -55,7 +56,7 @@ streams: required: true show_user: true default: 5m - description: How often the API is polled for new alerts. + description: How often the API is polled for new alerts. Supported units for this parameter are h/m/s. - name: initial_interval type: text title: Initial Interval @@ -63,13 +64,17 @@ streams: required: true show_user: true default: 24h - description: How far back in time to look for alerts the first time running. + description: How far back in time to look for alerts the first time running. Supported units for this parameter are h/m/s. - name: ssl type: yaml title: SSL multi: false required: false show_user: true + description: i.e. certificate, keys, supported_protocols, verification_mode etc. See [SSL](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-server-config) for details. + default: | + #certificate: "/etc/server/cert.pem" + #key: "/etc/server/key.pem" - name: proxy_url type: text title: Proxy URL @@ -103,5 +108,5 @@ streams: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. template_path: httpjson.yml.hbs - title: Palo Alto Cortex XDR - description: Palo Alto Cortex XDR API + title: Palo Alto Cortex XDR Alerts + description: Palo Alto Cortex XDR Alerts API diff --git a/packages/panw_cortex_xdr/data_stream/alerts/sample_event.json b/packages/panw_cortex_xdr/data_stream/alerts/sample_event.json index 3f61bc29cad..32cf1442377 100644 --- a/packages/panw_cortex_xdr/data_stream/alerts/sample_event.json +++ b/packages/panw_cortex_xdr/data_stream/alerts/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-10-21T11:31:28.980Z", "agent": { - "ephemeral_id": "4fc5e240-77aa-4a6a-9616-b7ef082ceb68", - "id": "7ff883c1-54e3-408a-826c-eb98e0d94b6b", + "ephemeral_id": "d1f9377a-0b86-44ab-8ba3-2be0e35e75fc", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "panw_cortex_xdr.alerts", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "7ff883c1-54e3-408a-826c-eb98e0d94b6b", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "BLOCKED", @@ -29,7 +29,7 @@ "created": "2020-10-21T11:31:28.980Z", "dataset": "panw_cortex_xdr.alerts", "id": "800800", - "ingested": "2023-05-12T06:32:55Z", + "ingested": "2023-08-17T06:15:07Z", "kind": "alert", "original": "{\"action\":\"BLOCKED\",\"action_pretty\":\"Prevented (Blocked)\",\"agent_data_collection_status\":true,\"agent_device_domain\":null,\"agent_fqdn\":\"test\",\"agent_is_vdi\":null,\"agent_os_sub_type\":\"XP\",\"agent_os_type\":\"Windows\",\"agent_version\":\"1.2.3.4\",\"alert_id\":\"1001\",\"attempt_counter\":55,\"bioc_category_enum_key\":null,\"bioc_indicator\":null,\"category\":\"Exploit\",\"deduplicate_tokens\":null,\"description\":\"Local privilege escalation prevented\",\"detection_timestamp\":1603279888980,\"end_match_attempt_ts\":1603552062824,\"endpoint_id\":\"12345678\",\"events\":{\"action_country\":\"UNKNOWN\",\"action_external_hostname\":null,\"action_file_macro_sha256\":null,\"action_file_md5\":null,\"action_file_name\":null,\"action_file_path\":null,\"action_file_sha256\":null,\"action_local_ip\":null,\"action_local_port\":null,\"action_process_causality_id\":null,\"action_process_image_command_line\":null,\"action_process_image_name\":null,\"action_process_image_sha256\":null,\"action_process_instance_id\":null,\"action_process_signature_status\":\"N/A\",\"action_process_signature_vendor\":null,\"action_registry_data\":null,\"action_registry_full_key\":null,\"action_registry_key_name\":null,\"action_registry_value_name\":null,\"action_remote_ip\":null,\"action_remote_port\":null,\"actor_causality_id\":null,\"actor_process_causality_id\":null,\"actor_process_command_line\":\"c:\\\\tmp\\\\virus.exe\",\"actor_process_image_md5\":null,\"actor_process_image_name\":\"virus.exe\",\"actor_process_image_path\":\"c:\\\\tmp\\\\virus.exe\",\"actor_process_image_sha256\":\"133ee989293f92736301280c6f14c89d521200c17dcdcecca30cd20705332d44\",\"actor_process_instance_id\":\"1234\",\"actor_process_os_pid\":1234,\"actor_process_signature_status\":\"N/A\",\"actor_process_signature_vendor\":null,\"actor_thread_thread_id\":null,\"agent_host_boot_time\":null,\"agent_install_type\":\"NA\",\"association_strength\":null,\"causality_actor_causality_id\":null,\"causality_actor_process_command_line\":null,\"causality_actor_process_execution_time\":null,\"causality_actor_process_image_md5\":null,\"causality_actor_process_image_name\":null,\"causality_actor_process_image_path\":null,\"causality_actor_process_image_sha256\":null,\"causality_actor_process_signature_status\":\"N/A\",\"causality_actor_process_signature_vendor\":null,\"dns_query_name\":null,\"dst_action_country\":null,\"dst_action_external_hostname\":null,\"dst_action_external_port\":null,\"dst_agent_id\":null,\"dst_association_strength\":null,\"dst_causality_actor_process_execution_time\":null,\"event_id\":null,\"event_sub_type\":null,\"event_timestamp\":1603279888980,\"event_type\":\"Process Execution\",\"fw_app_category\":null,\"fw_app_id\":null,\"fw_app_subcategory\":null,\"fw_app_technology\":null,\"fw_device_name\":null,\"fw_email_recipient\":null,\"fw_email_sender\":null,\"fw_email_subject\":null,\"fw_interface_from\":null,\"fw_interface_to\":null,\"fw_is_phishing\":\"N/A\",\"fw_misc\":null,\"fw_rule\":null,\"fw_rule_id\":null,\"fw_serial_number\":null,\"fw_url_domain\":null,\"fw_vsys\":null,\"fw_xff\":null,\"module_id\":\"Privilege Escalation Protection\",\"os_actor_causality_id\":null,\"os_actor_effective_username\":null,\"os_actor_process_causality_id\":null,\"os_actor_process_command_line\":null,\"os_actor_process_image_name\":null,\"os_actor_process_image_path\":null,\"os_actor_process_image_sha256\":null,\"os_actor_process_instance_id\":null,\"os_actor_process_os_pid\":null,\"os_actor_process_signature_status\":\"N/A\",\"os_actor_process_signature_vendor\":null,\"os_actor_thread_thread_id\":null,\"story_id\":null,\"user_name\":null},\"external_id\":\"800800\",\"filter_rule_id\":null,\"host_ip\":[\"10.0.255.20\"],\"host_name\":\"Test\",\"is_whitelisted\":false,\"local_insert_ts\":1603279967500,\"mac\":null,\"mac_address\":[\"00:11:22:33:44:55\"],\"matching_service_rule_id\":null,\"matching_status\":\"FAILED\",\"mitre_tactic_id_and_name\":[\"\"],\"mitre_technique_id_and_name\":[\"\"],\"name\":\"Kernel Privilege Escalation\",\"severity\":\"high\",\"source\":\"XDR Agent\",\"starred\":false}", "reason": "Local privilege escalation prevented", diff --git a/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-common-config.yml b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log new file mode 100644 index 00000000000..36a30ac5d27 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log @@ -0,0 +1,6 @@ +{"reply":{"incidents":[],"result_count":0,"total_count":0}} +{"incident_id": "891", "incident_name": null, "creation_time": 1691884712575, "modification_time": 1691971288775, "detection_time": null, "status": "new", "severity": "low", "description": "2 'Large Upload (Generic)' alerts detected by XDR Analytics on host computer1 involving user nt authority\\system", "assigned_user_mail": null, "assigned_user_pretty_name": null, "alert_count": 2, "low_severity_alert_count": 2, "med_severity_alert_count": 0, "high_severity_alert_count": 0, "critical_severity_alert_count": 0, "user_count": 1, "host_count": 1, "notes": null, "resolve_comment": null, "resolved_timestamp": null, "manual_severity": null, "manual_description": null, "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=891", "starred": false, "hosts": ["computer1:7a7370f8934c4e60b1e7dc5d0c8b0477"], "users": ["nt authority\\system"], "incident_sources": ["XDR Analytics"], "rule_based_score": null, "predicted_score": 5, "manual_score": null, "aggregated_score": 5, "wildfire_hits": 0, "alerts_grouping_status": "Enabled", "mitre_tactics_ids_and_names": ["TA0010 - Exfiltration"], "mitre_techniques_ids_and_names": ["T1048 - Exfiltration Over Alternative Protocol"], "alert_categories": ["Exfiltration"], "original_tags": ["EG:win-server-ex-ransomeware_report", "DS:PANW/XDR Agent", "EG:win-server-default"], "tags": ["DS:PANW/XDR Agent", "EG:win-server-default", "EG:win-server-ex-ransomeware_report"]} +{"incident_id": "890", "incident_name": null, "creation_time": 1691881319461, "modification_time": 1691881319461, "detection_time": null, "status": "new", "severity": "medium", "description": "'Suspicious unsigned process loads a known PowerShell module' generated by XDR Analytics BIOC detected on host test4567 involving user test4567\\user1", "assigned_user_mail": null, "assigned_user_pretty_name": null, "alert_count": 1, "low_severity_alert_count": 0, "med_severity_alert_count": 1, "high_severity_alert_count": 0, "critical_severity_alert_count": 0, "user_count": 1, "host_count": 1, "notes": null, "resolve_comment": null, "resolved_timestamp": null, "manual_severity": null, "manual_description": null, "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=890", "starred": false, "hosts": ["test4567:855f982e857f2442c287904b90b46a67"], "users": ["test4567\\user1"], "incident_sources": ["XDR Analytics BIOC"], "rule_based_score": null, "predicted_score": 85, "manual_score": null, "aggregated_score": 85, "wildfire_hits": 0, "alerts_grouping_status": "Enabled", "mitre_tactics_ids_and_names": ["TA0002 - Execution"], "mitre_techniques_ids_and_names": ["T1059.001 - Command and Scripting Interpreter: PowerShell"], "alert_categories": ["Execution"], "original_tags": ["DS:PANW/XDR Agent", "EG:win-endpoint-default"], "tags": ["DS:PANW/XDR Agent", "EG:win-endpoint-default"]} +{"incident_id": "883", "incident_name": null, "creation_time": 1691514546533, "modification_time": 1691774368442, "detection_time": null, "status": "new", "severity": "medium", "description": "2 'WildFire Malware' alerts prevented by XDR Agent on 2 hosts involving 2 users", "assigned_user_mail": null, "assigned_user_pretty_name": null, "alert_count": 2, "low_severity_alert_count": 0, "med_severity_alert_count": 2, "high_severity_alert_count": 0, "critical_severity_alert_count": 0, "user_count": 2, "host_count": 2, "notes": null, "resolve_comment": null, "resolved_timestamp": null, "manual_severity": null, "manual_description": null, "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=883", "starred": false, "hosts": ["computer2:2ed89a3934e747a8b743cdf8e5f82d05", "computer3:2ed89a3934e747a8b743cdf8e5f82d05"], "users": ["domain1\\user2", "domain1\\user3"], "incident_sources": ["XDR Agent"], "rule_based_score": null, "predicted_score": 47, "manual_score": null, "aggregated_score": 47, "wildfire_hits": 1, "alerts_grouping_status": "Enabled", "mitre_tactics_ids_and_names": null, "mitre_techniques_ids_and_names": null, "alert_categories": ["Malware"], "original_tags": ["DS:PANW/XDR Agent", "EG:win-endpoint-default"], "tags": ["DS:PANW/XDR Agent", "EG:win-endpoint-default"]} +{"incident_id": "3", "incident_name": null, "creation_time": 1688386089591, "modification_time": 1688391281417, "detection_time": null, "status": "resolved_false_positive", "severity": "high", "description": "'Persistency - 134540067' generated by XDR Agent detected on host laptop-aaa involving user local\\aaa", "assigned_user_mail": "aaa@domain.com", "assigned_user_pretty_name": "Kim Jackson", "alert_count": 1, "low_severity_alert_count": 0, "med_severity_alert_count": 0, "high_severity_alert_count": 1, "critical_severity_alert_count": 0, "user_count": 1, "host_count": 1, "notes": null, "resolve_comment": "Cortex dislikes the TeamViewers persistency functionality, however all is benign.", "resolved_timestamp": 1688391281417, "manual_severity": null, "manual_description": null, "xdr_url": "https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=3", "starred": false, "hosts": ["laptop-aaa:08d160e65afe470c911b128042080bf1"], "users": ["local\\aaa"], "incident_sources": ["XDR Agent"], "rule_based_score": null, "predicted_score": 82, "manual_score": null, "aggregated_score": null, "wildfire_hits": 0, "alerts_grouping_status": "Disabled", "mitre_tactics_ids_and_names": ["TA0003 - Persistence"], "mitre_techniques_ids_and_names": ["T1547 - Boot or Logon Autostart Execution"], "alert_categories": ["Malware"], "original_tags": ["EG:WindowsEndpoint-StandardInstall", "DS:PANW/XDR Agent"], "tags": ["DS:PANW/XDR Agent", "EG:WindowsEndpoint-StandardInstall"]} +{"incident_id": "1", "incident_name": null, "creation_time": 1681742309396, "modification_time": 1683624792628, "detection_time": null, "status": "resolved_security_testing", "severity": "high", "description": "'SYNC - Remote Activity - 3456368549' along with 16 other alerts generated by XDR Agent detected on host pc-bbb", "assigned_user_mail": "bbb@domain2.com", "assigned_user_pretty_name": "Albert Einstein", "alert_count": 17, "low_severity_alert_count": 0, "med_severity_alert_count": 0, "high_severity_alert_count": 17, "critical_severity_alert_count": 0, "user_count": 0, "host_count": 1, "notes": null, "resolve_comment": "Pentesting", "resolved_timestamp": 1683624792628, "manual_severity": null, "manual_description": null, "xdr_url": "https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=1", "starred": false, "hosts": ["pc-bbb:9b0efa2354c14fdbb1f212ed0c8b99d9"], "users": [], "incident_sources": ["XDR Agent"], "rule_based_score": null, "predicted_score": null, "manual_score": null, "aggregated_score": null, "wildfire_hits": 0, "alerts_grouping_status": "Disabled", "mitre_tactics_ids_and_names": ["TA0002 - Execution", "TA0005 - Defense Evasion", "TA0006 - Credential Access", "TA0008 - Lateral Movement", "TA0042 - Resource Development"], "mitre_techniques_ids_and_names": ["T1003.002 - OS Credential Dumping: Security Account Manager", "T1021 - Remote Services", "T1040 - Network Sniffing", "T1047 - Windows Management Instrumentation", "T1059.001 - Command and Scripting Interpreter: PowerShell", "T1202 - Indirect Command Execution"], "alert_categories": ["Malware"], "original_tags": ["EG:WindowsEndpoint-StandardInstall", "DS:PANW/XDR Agent"], "tags": ["DS:PANW/XDR Agent", "EG:WindowsEndpoint-StandardInstall"]} diff --git a/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log-expected.json b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log-expected.json new file mode 100644 index 00000000000..0d074d8606f --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/pipeline/test-panw-xdr-incident.log-expected.json @@ -0,0 +1,477 @@ +{ + "expected": [ + null, + { + "@timestamp": "2023-08-12T23:58:32.575Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "malware" + ], + "id": "891", + "kind": "alert", + "original": "{\"incident_id\": \"891\", \"incident_name\": null, \"creation_time\": 1691884712575, \"modification_time\": 1691971288775, \"detection_time\": null, \"status\": \"new\", \"severity\": \"low\", \"description\": \"2 'Large Upload (Generic)' alerts detected by XDR Analytics on host computer1 involving user nt authority\\\\system\", \"assigned_user_mail\": null, \"assigned_user_pretty_name\": null, \"alert_count\": 2, \"low_severity_alert_count\": 2, \"med_severity_alert_count\": 0, \"high_severity_alert_count\": 0, \"critical_severity_alert_count\": 0, \"user_count\": 1, \"host_count\": 1, \"notes\": null, \"resolve_comment\": null, \"resolved_timestamp\": null, \"manual_severity\": null, \"manual_description\": null, \"xdr_url\": \"https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=891\", \"starred\": false, \"hosts\": [\"computer1:7a7370f8934c4e60b1e7dc5d0c8b0477\"], \"users\": [\"nt authority\\\\system\"], \"incident_sources\": [\"XDR Analytics\"], \"rule_based_score\": null, \"predicted_score\": 5, \"manual_score\": null, \"aggregated_score\": 5, \"wildfire_hits\": 0, \"alerts_grouping_status\": \"Enabled\", \"mitre_tactics_ids_and_names\": [\"TA0010 - Exfiltration\"], \"mitre_techniques_ids_and_names\": [\"T1048 - Exfiltration Over Alternative Protocol\"], \"alert_categories\": [\"Exfiltration\"], \"original_tags\": [\"EG:win-server-ex-ransomeware_report\", \"DS:PANW/XDR Agent\", \"EG:win-server-default\"], \"tags\": [\"DS:PANW/XDR Agent\", \"EG:win-server-default\", \"EG:win-server-ex-ransomeware_report\"]}", + "reason": "2 'Large Upload (Generic)' alerts detected by XDR Analytics on host computer1 involving user nt authority\\system", + "severity": 2, + "type": [ + "info" + ] + }, + "panw_cortex": { + "xdr": { + "aggregated_score": 5, + "alert_categories": [ + "Exfiltration" + ], + "alert_count": 2, + "alerts_grouping_status": "Enabled", + "creation_time": "2023-08-12T23:58:32.575Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 0, + "host_count": 1, + "hosts": [ + "computer1:7a7370f8934c4e60b1e7dc5d0c8b0477" + ], + "incident_sources": [ + "XDR Analytics" + ], + "low_severity_alert_count": 2, + "med_severity_alert_count": 0, + "mitre_tactics_ids_and_names": [ + "TA0010 - Exfiltration" + ], + "mitre_techniques_ids_and_names": [ + "T1048 - Exfiltration Over Alternative Protocol" + ], + "modification_time": "2023-08-14T00:01:28.775Z", + "original_tags": [ + "EG:win-server-ex-ransomeware_report", + "DS:PANW/XDR Agent", + "EG:win-server-default" + ], + "predicted_score": 5, + "starred": false, + "status": "new", + "user_count": 1, + "users": [ + "nt authority\\system" + ], + "wildfire_hits": 0, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=891" + } + }, + "related": { + "hosts": [ + "computer1" + ], + "user": [ + "system" + ] + }, + "tags": [ + "preserve_original_event", + "DS:PANW/XDR Agent", + "EG:win-server-default", + "EG:win-server-ex-ransomeware_report" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0010" + ], + "name": [ + "Exfiltration" + ] + }, + "technique": { + "id": [ + "T1048" + ], + "name": [ + "Exfiltration Over Alternative Protocol" + ] + } + } + }, + { + "@timestamp": "2023-08-12T23:01:59.461Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "malware" + ], + "id": "890", + "kind": "alert", + "original": "{\"incident_id\": \"890\", \"incident_name\": null, \"creation_time\": 1691881319461, \"modification_time\": 1691881319461, \"detection_time\": null, \"status\": \"new\", \"severity\": \"medium\", \"description\": \"'Suspicious unsigned process loads a known PowerShell module' generated by XDR Analytics BIOC detected on host test4567 involving user test4567\\\\user1\", \"assigned_user_mail\": null, \"assigned_user_pretty_name\": null, \"alert_count\": 1, \"low_severity_alert_count\": 0, \"med_severity_alert_count\": 1, \"high_severity_alert_count\": 0, \"critical_severity_alert_count\": 0, \"user_count\": 1, \"host_count\": 1, \"notes\": null, \"resolve_comment\": null, \"resolved_timestamp\": null, \"manual_severity\": null, \"manual_description\": null, \"xdr_url\": \"https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=890\", \"starred\": false, \"hosts\": [\"test4567:855f982e857f2442c287904b90b46a67\"], \"users\": [\"test4567\\\\user1\"], \"incident_sources\": [\"XDR Analytics BIOC\"], \"rule_based_score\": null, \"predicted_score\": 85, \"manual_score\": null, \"aggregated_score\": 85, \"wildfire_hits\": 0, \"alerts_grouping_status\": \"Enabled\", \"mitre_tactics_ids_and_names\": [\"TA0002 - Execution\"], \"mitre_techniques_ids_and_names\": [\"T1059.001 - Command and Scripting Interpreter: PowerShell\"], \"alert_categories\": [\"Execution\"], \"original_tags\": [\"DS:PANW/XDR Agent\", \"EG:win-endpoint-default\"], \"tags\": [\"DS:PANW/XDR Agent\", \"EG:win-endpoint-default\"]}", + "reason": "'Suspicious unsigned process loads a known PowerShell module' generated by XDR Analytics BIOC detected on host test4567 involving user test4567\\user1", + "severity": 3, + "type": [ + "info" + ] + }, + "panw_cortex": { + "xdr": { + "aggregated_score": 85, + "alert_categories": [ + "Execution" + ], + "alert_count": 1, + "alerts_grouping_status": "Enabled", + "creation_time": "2023-08-12T23:01:59.461Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 0, + "host_count": 1, + "hosts": [ + "test4567:855f982e857f2442c287904b90b46a67" + ], + "incident_sources": [ + "XDR Analytics BIOC" + ], + "low_severity_alert_count": 0, + "med_severity_alert_count": 1, + "mitre_tactics_ids_and_names": [ + "TA0002 - Execution" + ], + "mitre_techniques_ids_and_names": [ + "T1059.001 - Command and Scripting Interpreter: PowerShell" + ], + "modification_time": "2023-08-12T23:01:59.461Z", + "original_tags": [ + "DS:PANW/XDR Agent", + "EG:win-endpoint-default" + ], + "predicted_score": 85, + "starred": false, + "status": "new", + "user_count": 1, + "users": [ + "test4567\\user1" + ], + "wildfire_hits": 0, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=890" + } + }, + "related": { + "hosts": [ + "test4567" + ], + "user": [ + "user1" + ] + }, + "tags": [ + "preserve_original_event", + "DS:PANW/XDR Agent", + "EG:win-endpoint-default" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0002" + ], + "name": [ + "Execution" + ] + }, + "technique": { + "id": [ + "T1059.001" + ], + "name": [ + "Command and Scripting Interpreter: PowerShell" + ] + } + } + }, + { + "@timestamp": "2023-08-08T17:09:06.533Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "malware" + ], + "id": "883", + "kind": "alert", + "original": "{\"incident_id\": \"883\", \"incident_name\": null, \"creation_time\": 1691514546533, \"modification_time\": 1691774368442, \"detection_time\": null, \"status\": \"new\", \"severity\": \"medium\", \"description\": \"2 'WildFire Malware' alerts prevented by XDR Agent on 2 hosts involving 2 users\", \"assigned_user_mail\": null, \"assigned_user_pretty_name\": null, \"alert_count\": 2, \"low_severity_alert_count\": 0, \"med_severity_alert_count\": 2, \"high_severity_alert_count\": 0, \"critical_severity_alert_count\": 0, \"user_count\": 2, \"host_count\": 2, \"notes\": null, \"resolve_comment\": null, \"resolved_timestamp\": null, \"manual_severity\": null, \"manual_description\": null, \"xdr_url\": \"https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=883\", \"starred\": false, \"hosts\": [\"computer2:2ed89a3934e747a8b743cdf8e5f82d05\", \"computer3:2ed89a3934e747a8b743cdf8e5f82d05\"], \"users\": [\"domain1\\\\user2\", \"domain1\\\\user3\"], \"incident_sources\": [\"XDR Agent\"], \"rule_based_score\": null, \"predicted_score\": 47, \"manual_score\": null, \"aggregated_score\": 47, \"wildfire_hits\": 1, \"alerts_grouping_status\": \"Enabled\", \"mitre_tactics_ids_and_names\": null, \"mitre_techniques_ids_and_names\": null, \"alert_categories\": [\"Malware\"], \"original_tags\": [\"DS:PANW/XDR Agent\", \"EG:win-endpoint-default\"], \"tags\": [\"DS:PANW/XDR Agent\", \"EG:win-endpoint-default\"]}", + "reason": "2 'WildFire Malware' alerts prevented by XDR Agent on 2 hosts involving 2 users", + "severity": 3, + "type": [ + "info" + ] + }, + "panw_cortex": { + "xdr": { + "aggregated_score": 47, + "alert_categories": [ + "Malware" + ], + "alert_count": 2, + "alerts_grouping_status": "Enabled", + "creation_time": "2023-08-08T17:09:06.533Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 0, + "host_count": 2, + "hosts": [ + "computer2:2ed89a3934e747a8b743cdf8e5f82d05", + "computer3:2ed89a3934e747a8b743cdf8e5f82d05" + ], + "incident_sources": [ + "XDR Agent" + ], + "low_severity_alert_count": 0, + "med_severity_alert_count": 2, + "modification_time": "2023-08-11T17:19:28.442Z", + "original_tags": [ + "DS:PANW/XDR Agent", + "EG:win-endpoint-default" + ], + "predicted_score": 47, + "starred": false, + "status": "new", + "user_count": 2, + "users": [ + "domain1\\user2", + "domain1\\user3" + ], + "wildfire_hits": 1, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=883" + } + }, + "related": { + "hosts": [ + "computer2", + "computer3" + ], + "user": [ + "user2", + "user3" + ] + }, + "tags": [ + "preserve_original_event", + "DS:PANW/XDR Agent", + "EG:win-endpoint-default" + ] + }, + { + "@timestamp": "2023-07-03T12:08:09.591Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "malware" + ], + "id": "3", + "kind": "alert", + "original": "{\"incident_id\": \"3\", \"incident_name\": null, \"creation_time\": 1688386089591, \"modification_time\": 1688391281417, \"detection_time\": null, \"status\": \"resolved_false_positive\", \"severity\": \"high\", \"description\": \"'Persistency - 134540067' generated by XDR Agent detected on host laptop-aaa involving user local\\\\aaa\", \"assigned_user_mail\": \"aaa@domain.com\", \"assigned_user_pretty_name\": \"Kim Jackson\", \"alert_count\": 1, \"low_severity_alert_count\": 0, \"med_severity_alert_count\": 0, \"high_severity_alert_count\": 1, \"critical_severity_alert_count\": 0, \"user_count\": 1, \"host_count\": 1, \"notes\": null, \"resolve_comment\": \"Cortex dislikes the TeamViewers persistency functionality, however all is benign.\", \"resolved_timestamp\": 1688391281417, \"manual_severity\": null, \"manual_description\": null, \"xdr_url\": \"https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=3\", \"starred\": false, \"hosts\": [\"laptop-aaa:08d160e65afe470c911b128042080bf1\"], \"users\": [\"local\\\\aaa\"], \"incident_sources\": [\"XDR Agent\"], \"rule_based_score\": null, \"predicted_score\": 82, \"manual_score\": null, \"aggregated_score\": null, \"wildfire_hits\": 0, \"alerts_grouping_status\": \"Disabled\", \"mitre_tactics_ids_and_names\": [\"TA0003 - Persistence\"], \"mitre_techniques_ids_and_names\": [\"T1547 - Boot or Logon Autostart Execution\"], \"alert_categories\": [\"Malware\"], \"original_tags\": [\"EG:WindowsEndpoint-StandardInstall\", \"DS:PANW/XDR Agent\"], \"tags\": [\"DS:PANW/XDR Agent\", \"EG:WindowsEndpoint-StandardInstall\"]}", + "reason": "'Persistency - 134540067' generated by XDR Agent detected on host laptop-aaa involving user local\\aaa", + "severity": 4, + "type": [ + "info" + ] + }, + "panw_cortex": { + "xdr": { + "alert_categories": [ + "Malware" + ], + "alert_count": 1, + "alerts_grouping_status": "Disabled", + "assigned_user_mail": "aaa@domain.com", + "assigned_user_pretty_name": "Kim Jackson", + "creation_time": "2023-07-03T12:08:09.591Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 1, + "host_count": 1, + "hosts": [ + "laptop-aaa:08d160e65afe470c911b128042080bf1" + ], + "incident_sources": [ + "XDR Agent" + ], + "low_severity_alert_count": 0, + "med_severity_alert_count": 0, + "mitre_tactics_ids_and_names": [ + "TA0003 - Persistence" + ], + "mitre_techniques_ids_and_names": [ + "T1547 - Boot or Logon Autostart Execution" + ], + "modification_time": "2023-07-03T13:34:41.417Z", + "original_tags": [ + "EG:WindowsEndpoint-StandardInstall", + "DS:PANW/XDR Agent" + ], + "predicted_score": 82, + "resolve_comment": "Cortex dislikes the TeamViewers persistency functionality, however all is benign.", + "resolved_timestamp": "2023-07-03T13:34:41.417Z", + "starred": false, + "status": "resolved_false_positive", + "user_count": 1, + "users": [ + "local\\aaa" + ], + "wildfire_hits": 0, + "xdr_url": "https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=3" + } + }, + "related": { + "hosts": [ + "laptop-aaa" + ], + "user": [ + "aaa" + ] + }, + "tags": [ + "preserve_original_event", + "DS:PANW/XDR Agent", + "EG:WindowsEndpoint-StandardInstall" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0003" + ], + "name": [ + "Persistence" + ] + }, + "technique": { + "id": [ + "T1547" + ], + "name": [ + "Boot or Logon Autostart Execution" + ] + } + } + }, + { + "@timestamp": "2023-04-17T14:38:29.396Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "malware" + ], + "id": "1", + "kind": "alert", + "original": "{\"incident_id\": \"1\", \"incident_name\": null, \"creation_time\": 1681742309396, \"modification_time\": 1683624792628, \"detection_time\": null, \"status\": \"resolved_security_testing\", \"severity\": \"high\", \"description\": \"'SYNC - Remote Activity - 3456368549' along with 16 other alerts generated by XDR Agent detected on host pc-bbb\", \"assigned_user_mail\": \"bbb@domain2.com\", \"assigned_user_pretty_name\": \"Albert Einstein\", \"alert_count\": 17, \"low_severity_alert_count\": 0, \"med_severity_alert_count\": 0, \"high_severity_alert_count\": 17, \"critical_severity_alert_count\": 0, \"user_count\": 0, \"host_count\": 1, \"notes\": null, \"resolve_comment\": \"Pentesting\", \"resolved_timestamp\": 1683624792628, \"manual_severity\": null, \"manual_description\": null, \"xdr_url\": \"https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=1\", \"starred\": false, \"hosts\": [\"pc-bbb:9b0efa2354c14fdbb1f212ed0c8b99d9\"], \"users\": [], \"incident_sources\": [\"XDR Agent\"], \"rule_based_score\": null, \"predicted_score\": null, \"manual_score\": null, \"aggregated_score\": null, \"wildfire_hits\": 0, \"alerts_grouping_status\": \"Disabled\", \"mitre_tactics_ids_and_names\": [\"TA0002 - Execution\", \"TA0005 - Defense Evasion\", \"TA0006 - Credential Access\", \"TA0008 - Lateral Movement\", \"TA0042 - Resource Development\"], \"mitre_techniques_ids_and_names\": [\"T1003.002 - OS Credential Dumping: Security Account Manager\", \"T1021 - Remote Services\", \"T1040 - Network Sniffing\", \"T1047 - Windows Management Instrumentation\", \"T1059.001 - Command and Scripting Interpreter: PowerShell\", \"T1202 - Indirect Command Execution\"], \"alert_categories\": [\"Malware\"], \"original_tags\": [\"EG:WindowsEndpoint-StandardInstall\", \"DS:PANW/XDR Agent\"], \"tags\": [\"DS:PANW/XDR Agent\", \"EG:WindowsEndpoint-StandardInstall\"]}", + "reason": "'SYNC - Remote Activity - 3456368549' along with 16 other alerts generated by XDR Agent detected on host pc-bbb", + "severity": 4, + "type": [ + "info" + ] + }, + "panw_cortex": { + "xdr": { + "alert_categories": [ + "Malware" + ], + "alert_count": 17, + "alerts_grouping_status": "Disabled", + "assigned_user_mail": "bbb@domain2.com", + "assigned_user_pretty_name": "Albert Einstein", + "creation_time": "2023-04-17T14:38:29.396Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 17, + "host_count": 1, + "hosts": [ + "pc-bbb:9b0efa2354c14fdbb1f212ed0c8b99d9" + ], + "incident_sources": [ + "XDR Agent" + ], + "low_severity_alert_count": 0, + "med_severity_alert_count": 0, + "mitre_tactics_ids_and_names": [ + "TA0002 - Execution", + "TA0005 - Defense Evasion", + "TA0006 - Credential Access", + "TA0008 - Lateral Movement", + "TA0042 - Resource Development" + ], + "mitre_techniques_ids_and_names": [ + "T1003.002 - OS Credential Dumping: Security Account Manager", + "T1021 - Remote Services", + "T1040 - Network Sniffing", + "T1047 - Windows Management Instrumentation", + "T1059.001 - Command and Scripting Interpreter: PowerShell", + "T1202 - Indirect Command Execution" + ], + "modification_time": "2023-05-09T09:33:12.628Z", + "original_tags": [ + "EG:WindowsEndpoint-StandardInstall", + "DS:PANW/XDR Agent" + ], + "resolve_comment": "Pentesting", + "resolved_timestamp": "2023-05-09T09:33:12.628Z", + "starred": false, + "status": "resolved_security_testing", + "user_count": 0, + "wildfire_hits": 0, + "xdr_url": "https://test2.xdr.eu.paloaltonetworks.com/incident-view?caseId=1" + } + }, + "related": { + "hosts": [ + "pc-bbb" + ] + }, + "tags": [ + "preserve_original_event", + "DS:PANW/XDR Agent", + "EG:WindowsEndpoint-StandardInstall" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0002", + "TA0005", + "TA0006", + "TA0008", + "TA0042" + ], + "name": [ + "Execution", + "Defense Evasion", + "Credential Access", + "Lateral Movement", + "Resource Development" + ] + }, + "technique": { + "id": [ + "T1003.002", + "T1021", + "T1040", + "T1047", + "T1059.001", + "T1202" + ], + "name": [ + "OS Credential Dumping: Security Account Manager", + "Remote Services", + "Network Sniffing", + "Windows Management Instrumentation", + "Command and Scripting Interpreter: PowerShell", + "Indirect Command Execution" + ] + } + } + } + ] +} \ No newline at end of file diff --git a/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/system/test-http-config.yml b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/system/test-http-config.yml new file mode 100644 index 00000000000..4260eccf964 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/_dev/test/system/test-http-config.yml @@ -0,0 +1,9 @@ +service: panw-cortex-xdr-mock +input: httpjson +data_stream: + vars: + url: 'http://{{Hostname}}:{{Port}}' + api_token: testing-token + token_id: 1 + preserve_original_event: true + enable_request_tracer: true diff --git a/packages/panw_cortex_xdr/data_stream/incidents/agent/stream/httpjson.yml.hbs b/packages/panw_cortex_xdr/data_stream/incidents/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..925ed9383f2 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/agent/stream/httpjson.yml.hbs @@ -0,0 +1,97 @@ +config_version: "2" +interval: {{interval}} +request.method: POST +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} + +{{#if url}} +request.url: {{url}}/public_api/v1/incidents/get_incidents +{{/if}} +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +{{#if request_timeout}} +request.timeout: {{request_timeout}} +{{/if}} +{{#if proxy_url }} +request.proxy_url: {{proxy_url}} +{{/if}} +request.rate_limit: + limit: '[[.last_response.header.Get "X-Rate-Limit-Limit"]]' + remaining: '[[.last_response.header.Get "X-Rate-Limit-Remaining"]]' + reset: '[[(parseDate (.last_response.header.Get "X-Rate-Limit-Reset")).Unix]]' +request.transforms: +{{#if advanced_sec_level}} +- set: + target: header.x-xdr-timestamp + value: '[[ mul (add (now (parseDuration "-0s")).Unix) 1000 ]]' +- set: + target: header.x-xdr-nonce + value: '[[ hash "sha256" uuid ]]' +- set: + target: header.Authorization + value: '[[ hash "sha256" "{{api_token}}" (.header.Get "x-xdr-nonce") (.header.Get "x-xdr-timestamp") ]]' +{{else}} +- set: + target: header.Authorization + value: {{api_token}} +{{/if}} +- set: + target: header.x-xdr-auth-id + value: {{token_id}} +- set: + target: body.request_data.sort.field + value: creation_time +- set: + target: body.request_data.sort.keyword + value: asc +- append: + target: body.request_data.filters + value: |- + { + "field": "creation_time", + "operator": "gte", + "value": [[ .cursor.next_ts ]] + } + default: |- + { + "field": "creation_time", + "operator": "gte", + "value": [[ mul (add (now (parseDuration "-{{initial_interval}}")).Unix) 1000 ]] + } + value_type: json +response.split: + target: body.reply.incidents + split: + target: body.events + keep_parent: true +response.pagination: + - set: + target: body.request_data.search_from + value: '[[if (ne (len .last_response.body.reply.incidents) 0)]][[mul .last_response.page 100]][[end]]' + value_type: int + fail_on_template_error: true + - set: + target: body.request_data.search_to + value: '[[if (ne (len .last_response.body.reply.incidents) 0)]][[add (mul .last_response.page 100) 100]][[end]]' + value_type: int + fail_on_template_error: true +cursor: + next_ts: + value: "[[.last_event.creation_time]]" + +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/panw_cortex_xdr/data_stream/incidents/elasticsearch/ingest_pipeline/default.yml b/packages/panw_cortex_xdr/data_stream/incidents/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..05dfae461e1 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,212 @@ +--- +description: Pipeline for Palo Alto XDR Incident API. +processors: + - set: + field: ecs.version + value: '8.9.0' + - set: + field: event.kind + value: alert + - append: + field: event.category + value: malware + - append: + field: event.type + value: info + - rename: + field: message + target_field: event.original + - json: + field: event.original + target_field: panw_cortex.xdr + - drop: + if: ctx.panw_cortex?.xdr?.reply?.result_count == 0 + - fingerprint: + fields: + - panw_cortex.xdr.alert_count + - panw_cortex.xdr.incident_id + target_field: "_id" + ignore_missing: true + - date: + field: panw_cortex.xdr.creation_time + target_field: panw_cortex.xdr.creation_time + formats: + - UNIX_MS + if: ctx.panw_cortex?.xdr?.creation_time != null + - date: + field: panw_cortex.xdr.resolved_timestamp + target_field: panw_cortex.xdr.resolved_timestamp + formats: + - UNIX_MS + if: ctx.panw_cortex?.xdr?.resolved_timestamp != null + - date: + field: panw_cortex.xdr.modification_time + target_field: panw_cortex.xdr.modification_time + formats: + - UNIX_MS + if: ctx.panw_cortex?.xdr?.modification_time != null + - set: + field: "@timestamp" + copy_from: panw_cortex.xdr.creation_time + if: ctx.panw_cortex?.xdr?.creation_time != null + - set: + field: event.severity + value: 0 + if: ctx.panw_cortex?.xdr?.severity == "unknown" + - set: + field: event.severity + value: 1 + if: ctx.panw_cortex?.xdr?.severity == "informational" + - set: + field: event.severity + value: 2 + if: ctx.panw_cortex?.xdr?.severity == "low" + - set: + field: event.severity + value: 3 + if: ctx.panw_cortex?.xdr?.severity == "medium" + - set: + field: event.severity + value: 4 + if: ctx.panw_cortex?.xdr?.severity == "high" + - rename: + field: panw_cortex.xdr.incident_id + target_field: event.id + ignore_missing: true + - rename: + field: panw_cortex.xdr.description + target_field: event.reason + ignore_missing: true + if: ctx.panw_cortex?.xdr?.description instanceof String + - set: + field: related.hosts + copy_from: panw_cortex.xdr.hosts + if: ctx.panw_cortex?.xdr?.hosts != null + - set: + field: related.user + copy_from: panw_cortex.xdr.users + if: ctx.panw_cortex?.xdr?.users != null + - gsub: + field: related.hosts + pattern: ":.*" + replacement: "" + if: ctx.related?.hosts != null + - gsub: + field: related.user + pattern: '.*\\' + replacement: "" + if: ctx.related?.user != null + - script: + if: ctx.panw_cortex?.xdr?.mitre_techniques_ids_and_names != null + lang: painless + description: "Extract Mitre Techniques and append it to Threat ECS fields" + source: |- + void addTechnique(def ctx, def x, def y) { + if (ctx.threat == null) { + ctx.threat = new HashMap(); + } + if (ctx.threat.technique == null) { + ctx.threat.technique = new HashMap(); + } + if (ctx.threat.technique.id == null) { + ctx.threat.technique.id = new ArrayList(); + } + if (ctx.threat.technique.name == null) { + ctx.threat.technique.name = new ArrayList(); + } + if (!ctx.threat.technique.id.contains(x)) { + ctx.threat.technique.id.add(x); + } + if (!ctx.threat.technique.name.contains(y)) { + ctx.threat.technique.name.add(y); + } + } + for (mitre_technique in ctx.panw_cortex?.xdr?.mitre_techniques_ids_and_names) { + addTechnique(ctx, mitre_technique.splitOnToken(' - ')[0], mitre_technique.splitOnToken(' - ')[1]); + } + - script: + if: ctx.panw_cortex?.xdr?.mitre_tactics_ids_and_names != null + lang: painless + description: "Extract Mitre Tactics and append it to Threat ECS fields" + source: |- + void addTactic(def ctx, def x, def y) { + if (ctx.threat == null) { + ctx.threat = new HashMap(); + } + if (ctx.threat.tactic == null) { + ctx.threat.tactic = new HashMap(); + } + if (ctx.threat.tactic.id == null) { + ctx.threat.tactic.id = new ArrayList(); + } + if (ctx.threat.tactic.name == null) { + ctx.threat.tactic.name = new ArrayList(); + } + if (!ctx.threat.tactic.id.contains(x)) { + ctx.threat.tactic.id.add(x); + } + if (!ctx.threat.tactic.name.contains(y)) { + ctx.threat.tactic.name.add(y); + } + } + for (mitre_tactic in ctx.panw_cortex?.xdr?.mitre_tactics_ids_and_names) { + addTactic(ctx, mitre_tactic.splitOnToken(' - ')[0], mitre_tactic.splitOnToken(' - ')[1]); + } + - set: + field: threat.framework + value: "MITRE ATT&CK" + if: "ctx.threat?.technique != null || ctx.threat?.tactic != null" + - append: + field: related.user + value: "{{{user.name}}}" + allow_duplicates: false + if: ctx.user?.name != null + - append: + field: related.host + value: "{{{host.name}}}" + allow_duplicates: false + if: ctx.host?.name != null + - foreach: + field: panw_cortex.xdr.tags + if: ctx.panw_cortex?.xdr?.tags != null + processor: + append: + field: tags + value: '{{{_ingest._value}}}' + allow_duplicates: false + - script: + description: Drops null/empty values recursively + lang: painless + source: | + boolean drop(Object o) { + if (o == null || o == "") { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); + - remove: + field: + - panw_cortex.xdr.severity + - panw_cortex.xdr.tags + - panw_cortex.xdr.mitre_techniques_id_and_names + - panw_cortex.xdr.mitre_tactics_id_and_names + ignore_missing: true + - remove: + field: event.original + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/panw_cortex_xdr/data_stream/incidents/fields/agent.yml b/packages/panw_cortex_xdr/data_stream/incidents/fields/agent.yml new file mode 100644 index 00000000000..fed14316c18 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/fields/agent.yml @@ -0,0 +1,170 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + external: ecs + - name: hostname + external: ecs + - name: id + external: ecs + - name: ip + external: ecs + - name: mac + external: ecs + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + external: ecs + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/panw_cortex_xdr/data_stream/incidents/fields/base-fields.yml b/packages/panw_cortex_xdr/data_stream/incidents/fields/base-fields.yml new file mode 100644 index 00000000000..0bf1b815707 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: panw_cortex +- name: event.dataset + type: constant_keyword + description: Event dataset + value: panw_cortex_xdr.incidents +- name: "@timestamp" + type: date + description: Event timestamp. diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/beats.yml b/packages/panw_cortex_xdr/data_stream/incidents/fields/beats.yml similarity index 100% rename from packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/beats.yml rename to packages/panw_cortex_xdr/data_stream/incidents/fields/beats.yml diff --git a/packages/panw_cortex_xdr/data_stream/incidents/fields/ecs.yml b/packages/panw_cortex_xdr/data_stream/incidents/fields/ecs.yml new file mode 100644 index 00000000000..c629e96c1a3 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/fields/ecs.yml @@ -0,0 +1,32 @@ +- name: ecs.version + external: ecs +- name: message + external: ecs +- name: tags + external: ecs +- name: user.name + external: ecs +- name: user.domain + external: ecs +- name: user.id + external: ecs +- name: user.email + external: ecs +- name: rule.name + external: ecs +- name: rule.id + external: ecs +- name: related.hosts + external: ecs +- name: related.user + external: ecs +- name: threat.framework + external: ecs +- name: threat.technique.id + external: ecs +- name: threat.technique.name + external: ecs +- name: threat.tactic.id + external: ecs +- name: threat.tactic.name + external: ecs diff --git a/packages/panw_cortex_xdr/data_stream/incidents/fields/fields.yml b/packages/panw_cortex_xdr/data_stream/incidents/fields/fields.yml new file mode 100644 index 00000000000..487ed214745 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/fields/fields.yml @@ -0,0 +1,143 @@ +- name: panw_cortex.xdr + type: group + fields: + - name: aggregated_score + type: long + description: | + Aggregated incident score. + - name: alert_categories + type: keyword + description: | + Categories for alerts contained in the incident. + - name: alert_count + type: long + description: | + Count of alerts. + - name: alerts_grouping_status + type: keyword + description: | + Is alert grouping enabled for this incident. + - name: assigned_user_mail + type: keyword + description: | + Email for the assigned user. + - name: assigned_user_pretty_name + type: keyword + description: | + Pretty name for the assigned user. + - name: creation_time + type: date + description: | + Incident creation time. + - name: critical_severity_alert_count + type: long + description: | + Count of critical severity alerts for this incident. + - name: detection_time + type: object + description: | + Detection time. + - name: high_severity_alert_count + type: long + description: | + Count of high severity alerts for this incident. + - name: host_count + type: long + description: | + Count of hosts related to this incident. + - name: hosts + type: keyword + description: | + Host names and host ID's related to this incident. + - name: incident_id + type: keyword + description: | + Incident ID + - name: incident_name + type: keyword + description: | + Incident name + - name: incident_sources + type: keyword + description: | + Detection sources for this incident. + - name: low_severity_alert_count + type: long + description: | + Count of low severity alerts for this incident. + - name: manual_description + type: keyword + description: | + Manual incident description. + - name: manual_score + type: object + description: | + Manual incident score. + - name: manual_severity + type: keyword + description: | + Manual incident severity. + - name: med_severity_alert_count + type: long + description: | + Count of medium severity alerts for this incident. + - name: mitre_tactics_ids_and_names + type: keyword + description: | + MITRE tactic ID's and names + - name: mitre_techniques_ids_and_names + type: keyword + description: | + MITRE technique ID's and names + - name: modification_time + type: date + description: | + Incident modification time. + - name: notes + type: keyword + description: | + Incident notes. + - name: original_tags + type: keyword + description: | + Original tags for the asset. + - name: predicted_score + type: long + description: | + Predicted incident score. + - name: resolve_comment + type: keyword + description: | + Incident resolution comment. + - name: resolved_timestamp + type: date + description: | + Incident resolution timestamp. + - name: rule_based_score + type: long + description: | + Rule based incident score. + - name: starred + type: boolean + description: | + Starred incident. + - name: status + type: keyword + description: | + Incident status. + - name: user_count + type: long + description: | + Count of users related to the incident. + - name: users + type: keyword + description: | + Usernames related to the incident. + - name: wildfire_hits + type: long + description: | + Count of Wildfire hits. + - name: xdr_url + type: keyword + description: | + URL to Cortex XDR incident. diff --git a/packages/panw_cortex_xdr/data_stream/incidents/manifest.yml b/packages/panw_cortex_xdr/data_stream/incidents/manifest.yml new file mode 100644 index 00000000000..daa36819377 --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/manifest.yml @@ -0,0 +1,112 @@ +type: logs +title: Palo Alto Cortex XDR Incidents API +streams: + - input: httpjson + vars: + - name: url + type: text + title: Palo Alto Cortex XDR API Domain + multi: false + required: true + show_user: true + description: The URL hosting the API endpoint. + default: https://test.xdr.eu.paloaltonetworks.com + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. + - name: api_token + type: text + title: Palo Alto Cortex XDR API Token + multi: false + required: true + show_user: true + description: API token from the XDR UI. + - name: token_id + type: text + title: Palo Alto Cortex XDR API Token ID + multi: false + required: true + show_user: true + default: 1 + description: The token ID related to the above API token + - name: advanced_sec_level + type: bool + title: Advanced security level + multi: false + required: false + show_user: true + description: Whether the API tokeny was issued with an 'Advanced' security level. + default: false + - name: request_timeout + type: text + title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. + multi: false + required: false + show_user: true + default: 30s + - name: interval + type: text + title: Interval + multi: false + required: true + show_user: true + default: 5m + description: How often the API is polled for new incidents. Supported units for this parameter are h/m/s. + - name: initial_interval + type: text + title: Initial Interval + multi: false + required: true + show_user: true + default: 24h + description: How far back in time to look for incidents the first time running. Supported units for this parameter are h/m/s. + - name: ssl + type: yaml + title: SSL + multi: false + required: false + show_user: true + description: i.e. certificate, keys, supported_protocols, verification_mode etc. See [SSL](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-server-config) for details. + default: | + #certificate: "/etc/server/cert.pem" + #key: "/etc/server/key.pem" + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: true + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - panw_cortex_xdr + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + template_path: httpjson.yml.hbs + title: Palo Alto Cortex XDR Incidents + description: Palo Alto Cortex XDR Incidents API diff --git a/packages/panw_cortex_xdr/data_stream/incidents/sample_event.json b/packages/panw_cortex_xdr/data_stream/incidents/sample_event.json new file mode 100644 index 00000000000..2c8b618d45a --- /dev/null +++ b/packages/panw_cortex_xdr/data_stream/incidents/sample_event.json @@ -0,0 +1,121 @@ +{ + "@timestamp": "2023-08-14T01:20:00.230Z", + "agent": { + "ephemeral_id": "02205f80-afa5-4cf8-a320-018c29c153fe", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "panw_cortex_xdr.incidents", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6245802f-8bd9-4634-b1db-411601495ab1", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "malware" + ], + "created": "2023-08-17T06:15:40.867Z", + "dataset": "panw_cortex_xdr.incidents", + "id": "893", + "ingested": "2023-08-17T06:15:43Z", + "kind": "alert", + "original": "{\"aggregated_score\":5,\"alert_categories\":[\"Exfiltration\"],\"alert_count\":1,\"alerts_grouping_status\":\"Enabled\",\"assigned_user_mail\":null,\"assigned_user_pretty_name\":null,\"creation_time\":1691976000230,\"critical_severity_alert_count\":0,\"description\":\"'Large Upload (Generic)' generated by XDR Analytics detected on host test1234 involving user nt authority\\\\system\",\"detection_time\":null,\"high_severity_alert_count\":0,\"host_count\":1,\"hosts\":[\"test1234:b567c1a651e66999158aef5d864dad25\"],\"incident_id\":\"893\",\"incident_name\":null,\"incident_sources\":[\"XDR Analytics\"],\"low_severity_alert_count\":1,\"manual_description\":null,\"manual_score\":null,\"manual_severity\":null,\"med_severity_alert_count\":0,\"mitre_tactics_ids_and_names\":[\"TA0010 - Exfiltration\"],\"mitre_techniques_ids_and_names\":[\"T1048 - Exfiltration Over Alternative Protocol\"],\"modification_time\":1691976000230,\"notes\":null,\"original_tags\":[\"DS:PANW/XDR Agent\",\"EG:win-server-ex-ransomeware_report\",\"EG:win-server-default\"],\"predicted_score\":5,\"resolve_comment\":null,\"resolved_timestamp\":null,\"rule_based_score\":null,\"severity\":\"low\",\"starred\":false,\"status\":\"new\",\"tags\":[\"DS:PANW/XDR Agent\",\"EG:win-server-default\",\"EG:win-server-ex-ransomeware_report\"],\"user_count\":1,\"users\":[\"nt authority\\\\system\"],\"wildfire_hits\":0,\"xdr_url\":\"https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=893\"}", + "reason": "'Large Upload (Generic)' generated by XDR Analytics detected on host test1234 involving user nt authority\\system", + "severity": 2, + "type": [ + "info" + ] + }, + "input": { + "type": "httpjson" + }, + "panw_cortex": { + "xdr": { + "aggregated_score": 5, + "alert_categories": [ + "Exfiltration" + ], + "alert_count": 1, + "alerts_grouping_status": "Enabled", + "creation_time": "2023-08-14T01:20:00.230Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 0, + "host_count": 1, + "hosts": [ + "test1234:b567c1a651e66999158aef5d864dad25" + ], + "incident_sources": [ + "XDR Analytics" + ], + "low_severity_alert_count": 1, + "med_severity_alert_count": 0, + "mitre_tactics_ids_and_names": [ + "TA0010 - Exfiltration" + ], + "mitre_techniques_ids_and_names": [ + "T1048 - Exfiltration Over Alternative Protocol" + ], + "modification_time": "2023-08-14T01:20:00.230Z", + "original_tags": [ + "DS:PANW/XDR Agent", + "EG:win-server-ex-ransomeware_report", + "EG:win-server-default" + ], + "predicted_score": 5, + "starred": false, + "status": "new", + "user_count": 1, + "users": [ + "nt authority\\system" + ], + "wildfire_hits": 0, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=893" + } + }, + "related": { + "hosts": [ + "test1234" + ], + "user": [ + "system" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "panw_cortex_xdr", + "DS:PANW/XDR Agent", + "EG:win-server-default", + "EG:win-server-ex-ransomeware_report" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0010" + ], + "name": [ + "Exfiltration" + ] + }, + "technique": { + "id": [ + "T1048" + ], + "name": [ + "Exfiltration Over Alternative Protocol" + ] + } + } +} \ No newline at end of file diff --git a/packages/panw_cortex_xdr/docs/README.md b/packages/panw_cortex_xdr/docs/README.md index 02c9c25f9ec..0906ad571ff 100644 --- a/packages/panw_cortex_xdr/docs/README.md +++ b/packages/panw_cortex_xdr/docs/README.md @@ -1,6 +1,6 @@ # Palo Alto Cortex XDR Integration -The PANW XDR integration collects alerts with multiple events from the [Cortex XDR API,](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-alerts). +The PANW XDR integration collects alerts with multiple events from the [Cortex XDR Alerts API](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/Get-all-Alerts) and incidents from [Cortex XDR Incidents API](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-REST-API/IncidentManagement). ## Logs @@ -16,11 +16,11 @@ An example event for `alerts` looks as following: { "@timestamp": "2020-10-21T11:31:28.980Z", "agent": { - "ephemeral_id": "4fc5e240-77aa-4a6a-9616-b7ef082ceb68", - "id": "7ff883c1-54e3-408a-826c-eb98e0d94b6b", + "ephemeral_id": "d1f9377a-0b86-44ab-8ba3-2be0e35e75fc", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "panw_cortex_xdr.alerts", @@ -28,12 +28,12 @@ An example event for `alerts` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "7ff883c1-54e3-408a-826c-eb98e0d94b6b", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "BLOCKED", @@ -44,7 +44,7 @@ An example event for `alerts` looks as following: "created": "2020-10-21T11:31:28.980Z", "dataset": "panw_cortex_xdr.alerts", "id": "800800", - "ingested": "2023-05-12T06:32:55Z", + "ingested": "2023-08-17T06:15:07Z", "kind": "alert", "original": "{\"action\":\"BLOCKED\",\"action_pretty\":\"Prevented (Blocked)\",\"agent_data_collection_status\":true,\"agent_device_domain\":null,\"agent_fqdn\":\"test\",\"agent_is_vdi\":null,\"agent_os_sub_type\":\"XP\",\"agent_os_type\":\"Windows\",\"agent_version\":\"1.2.3.4\",\"alert_id\":\"1001\",\"attempt_counter\":55,\"bioc_category_enum_key\":null,\"bioc_indicator\":null,\"category\":\"Exploit\",\"deduplicate_tokens\":null,\"description\":\"Local privilege escalation prevented\",\"detection_timestamp\":1603279888980,\"end_match_attempt_ts\":1603552062824,\"endpoint_id\":\"12345678\",\"events\":{\"action_country\":\"UNKNOWN\",\"action_external_hostname\":null,\"action_file_macro_sha256\":null,\"action_file_md5\":null,\"action_file_name\":null,\"action_file_path\":null,\"action_file_sha256\":null,\"action_local_ip\":null,\"action_local_port\":null,\"action_process_causality_id\":null,\"action_process_image_command_line\":null,\"action_process_image_name\":null,\"action_process_image_sha256\":null,\"action_process_instance_id\":null,\"action_process_signature_status\":\"N/A\",\"action_process_signature_vendor\":null,\"action_registry_data\":null,\"action_registry_full_key\":null,\"action_registry_key_name\":null,\"action_registry_value_name\":null,\"action_remote_ip\":null,\"action_remote_port\":null,\"actor_causality_id\":null,\"actor_process_causality_id\":null,\"actor_process_command_line\":\"c:\\\\tmp\\\\virus.exe\",\"actor_process_image_md5\":null,\"actor_process_image_name\":\"virus.exe\",\"actor_process_image_path\":\"c:\\\\tmp\\\\virus.exe\",\"actor_process_image_sha256\":\"133ee989293f92736301280c6f14c89d521200c17dcdcecca30cd20705332d44\",\"actor_process_instance_id\":\"1234\",\"actor_process_os_pid\":1234,\"actor_process_signature_status\":\"N/A\",\"actor_process_signature_vendor\":null,\"actor_thread_thread_id\":null,\"agent_host_boot_time\":null,\"agent_install_type\":\"NA\",\"association_strength\":null,\"causality_actor_causality_id\":null,\"causality_actor_process_command_line\":null,\"causality_actor_process_execution_time\":null,\"causality_actor_process_image_md5\":null,\"causality_actor_process_image_name\":null,\"causality_actor_process_image_path\":null,\"causality_actor_process_image_sha256\":null,\"causality_actor_process_signature_status\":\"N/A\",\"causality_actor_process_signature_vendor\":null,\"dns_query_name\":null,\"dst_action_country\":null,\"dst_action_external_hostname\":null,\"dst_action_external_port\":null,\"dst_agent_id\":null,\"dst_association_strength\":null,\"dst_causality_actor_process_execution_time\":null,\"event_id\":null,\"event_sub_type\":null,\"event_timestamp\":1603279888980,\"event_type\":\"Process Execution\",\"fw_app_category\":null,\"fw_app_id\":null,\"fw_app_subcategory\":null,\"fw_app_technology\":null,\"fw_device_name\":null,\"fw_email_recipient\":null,\"fw_email_sender\":null,\"fw_email_subject\":null,\"fw_interface_from\":null,\"fw_interface_to\":null,\"fw_is_phishing\":\"N/A\",\"fw_misc\":null,\"fw_rule\":null,\"fw_rule_id\":null,\"fw_serial_number\":null,\"fw_url_domain\":null,\"fw_vsys\":null,\"fw_xff\":null,\"module_id\":\"Privilege Escalation Protection\",\"os_actor_causality_id\":null,\"os_actor_effective_username\":null,\"os_actor_process_causality_id\":null,\"os_actor_process_command_line\":null,\"os_actor_process_image_name\":null,\"os_actor_process_image_path\":null,\"os_actor_process_image_sha256\":null,\"os_actor_process_instance_id\":null,\"os_actor_process_os_pid\":null,\"os_actor_process_signature_status\":\"N/A\",\"os_actor_process_signature_vendor\":null,\"os_actor_thread_thread_id\":null,\"story_id\":null,\"user_name\":null},\"external_id\":\"800800\",\"filter_rule_id\":null,\"host_ip\":[\"10.0.255.20\"],\"host_name\":\"Test\",\"is_whitelisted\":false,\"local_insert_ts\":1603279967500,\"mac\":null,\"mac_address\":[\"00:11:22:33:44:55\"],\"matching_service_rule_id\":null,\"matching_status\":\"FAILED\",\"mitre_tactic_id_and_name\":[\"\"],\"mitre_technique_id_and_name\":[\"\"],\"name\":\"Kernel Privilege Escalation\",\"severity\":\"high\",\"source\":\"XDR Agent\",\"starred\":false}", "reason": "Local privilege escalation prevented", @@ -168,10 +168,10 @@ An example event for `alerts` looks as following: | email.to.address | The email address of recipient | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | @@ -348,3 +348,234 @@ An example event for `alerts` looks as following: | user.name.text | Multi-field of `user.name`. | match_only_text | +### Incidents + +The Cortex XDR Incidents API is used to retrieve incidents generated by Cortex XDR based on raw endpoint data. A single incident might include one or more local endpoint events, each event generating its own document on Elasticsearch. + +The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI. See: [Get Started with Cortex XDR API](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html) + +An example event for `incidents` looks as following: + +```json +{ + "@timestamp": "2023-08-14T01:20:00.230Z", + "agent": { + "ephemeral_id": "02205f80-afa5-4cf8-a320-018c29c153fe", + "id": "6245802f-8bd9-4634-b1db-411601495ab1", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "panw_cortex_xdr.incidents", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6245802f-8bd9-4634-b1db-411601495ab1", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "malware" + ], + "created": "2023-08-17T06:15:40.867Z", + "dataset": "panw_cortex_xdr.incidents", + "id": "893", + "ingested": "2023-08-17T06:15:43Z", + "kind": "alert", + "original": "{\"aggregated_score\":5,\"alert_categories\":[\"Exfiltration\"],\"alert_count\":1,\"alerts_grouping_status\":\"Enabled\",\"assigned_user_mail\":null,\"assigned_user_pretty_name\":null,\"creation_time\":1691976000230,\"critical_severity_alert_count\":0,\"description\":\"'Large Upload (Generic)' generated by XDR Analytics detected on host test1234 involving user nt authority\\\\system\",\"detection_time\":null,\"high_severity_alert_count\":0,\"host_count\":1,\"hosts\":[\"test1234:b567c1a651e66999158aef5d864dad25\"],\"incident_id\":\"893\",\"incident_name\":null,\"incident_sources\":[\"XDR Analytics\"],\"low_severity_alert_count\":1,\"manual_description\":null,\"manual_score\":null,\"manual_severity\":null,\"med_severity_alert_count\":0,\"mitre_tactics_ids_and_names\":[\"TA0010 - Exfiltration\"],\"mitre_techniques_ids_and_names\":[\"T1048 - Exfiltration Over Alternative Protocol\"],\"modification_time\":1691976000230,\"notes\":null,\"original_tags\":[\"DS:PANW/XDR Agent\",\"EG:win-server-ex-ransomeware_report\",\"EG:win-server-default\"],\"predicted_score\":5,\"resolve_comment\":null,\"resolved_timestamp\":null,\"rule_based_score\":null,\"severity\":\"low\",\"starred\":false,\"status\":\"new\",\"tags\":[\"DS:PANW/XDR Agent\",\"EG:win-server-default\",\"EG:win-server-ex-ransomeware_report\"],\"user_count\":1,\"users\":[\"nt authority\\\\system\"],\"wildfire_hits\":0,\"xdr_url\":\"https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=893\"}", + "reason": "'Large Upload (Generic)' generated by XDR Analytics detected on host test1234 involving user nt authority\\system", + "severity": 2, + "type": [ + "info" + ] + }, + "input": { + "type": "httpjson" + }, + "panw_cortex": { + "xdr": { + "aggregated_score": 5, + "alert_categories": [ + "Exfiltration" + ], + "alert_count": 1, + "alerts_grouping_status": "Enabled", + "creation_time": "2023-08-14T01:20:00.230Z", + "critical_severity_alert_count": 0, + "high_severity_alert_count": 0, + "host_count": 1, + "hosts": [ + "test1234:b567c1a651e66999158aef5d864dad25" + ], + "incident_sources": [ + "XDR Analytics" + ], + "low_severity_alert_count": 1, + "med_severity_alert_count": 0, + "mitre_tactics_ids_and_names": [ + "TA0010 - Exfiltration" + ], + "mitre_techniques_ids_and_names": [ + "T1048 - Exfiltration Over Alternative Protocol" + ], + "modification_time": "2023-08-14T01:20:00.230Z", + "original_tags": [ + "DS:PANW/XDR Agent", + "EG:win-server-ex-ransomeware_report", + "EG:win-server-default" + ], + "predicted_score": 5, + "starred": false, + "status": "new", + "user_count": 1, + "users": [ + "nt authority\\system" + ], + "wildfire_hits": 0, + "xdr_url": "https://test.xdr.eu.paloaltonetworks.com/incident-view?caseId=893" + } + }, + "related": { + "hosts": [ + "test1234" + ], + "user": [ + "system" + ] + }, + "tags": [ + "preserve_original_event", + "forwarded", + "panw_cortex_xdr", + "DS:PANW/XDR Agent", + "EG:win-server-default", + "EG:win-server-ex-ransomeware_report" + ], + "threat": { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": [ + "TA0010" + ], + "name": [ + "Exfiltration" + ] + }, + "technique": { + "id": [ + "T1048" + ], + "name": [ + "Exfiltration Over Alternative Protocol" + ] + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.dataset | Event dataset | constant_keyword | +| event.module | Event module | constant_keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.file.path | Path to the log file. | keyword | +| log.flags | Flags for the log file. | keyword | +| log.offset | Offset of the entry in the log file. | long | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| panw_cortex.xdr.aggregated_score | Aggregated incident score. | long | +| panw_cortex.xdr.alert_categories | Categories for alerts contained in the incident. | keyword | +| panw_cortex.xdr.alert_count | Count of alerts. | long | +| panw_cortex.xdr.alerts_grouping_status | Is alert grouping enabled for this incident. | keyword | +| panw_cortex.xdr.assigned_user_mail | Email for the assigned user. | keyword | +| panw_cortex.xdr.assigned_user_pretty_name | Pretty name for the assigned user. | keyword | +| panw_cortex.xdr.creation_time | Incident creation time. | date | +| panw_cortex.xdr.critical_severity_alert_count | Count of critical severity alerts for this incident. | long | +| panw_cortex.xdr.detection_time | Detection time. | object | +| panw_cortex.xdr.high_severity_alert_count | Count of high severity alerts for this incident. | long | +| panw_cortex.xdr.host_count | Count of hosts related to this incident. | long | +| panw_cortex.xdr.hosts | Host names and host ID's related to this incident. | keyword | +| panw_cortex.xdr.incident_id | Incident ID | keyword | +| panw_cortex.xdr.incident_name | Incident name | keyword | +| panw_cortex.xdr.incident_sources | Detection sources for this incident. | keyword | +| panw_cortex.xdr.low_severity_alert_count | Count of low severity alerts for this incident. | long | +| panw_cortex.xdr.manual_description | Manual incident description. | keyword | +| panw_cortex.xdr.manual_score | Manual incident score. | object | +| panw_cortex.xdr.manual_severity | Manual incident severity. | keyword | +| panw_cortex.xdr.med_severity_alert_count | Count of medium severity alerts for this incident. | long | +| panw_cortex.xdr.mitre_tactics_ids_and_names | MITRE tactic ID's and names | keyword | +| panw_cortex.xdr.mitre_techniques_ids_and_names | MITRE technique ID's and names | keyword | +| panw_cortex.xdr.modification_time | Incident modification time. | date | +| panw_cortex.xdr.notes | Incident notes. | keyword | +| panw_cortex.xdr.original_tags | Original tags for the asset. | keyword | +| panw_cortex.xdr.predicted_score | Predicted incident score. | long | +| panw_cortex.xdr.resolve_comment | Incident resolution comment. | keyword | +| panw_cortex.xdr.resolved_timestamp | Incident resolution timestamp. | date | +| panw_cortex.xdr.rule_based_score | Rule based incident score. | long | +| panw_cortex.xdr.starred | Starred incident. | boolean | +| panw_cortex.xdr.status | Incident status. | keyword | +| panw_cortex.xdr.user_count | Count of users related to the incident. | long | +| panw_cortex.xdr.users | Usernames related to the incident. | keyword | +| panw_cortex.xdr.wildfire_hits | Count of Wildfire hits. | long | +| panw_cortex.xdr.xdr_url | URL to Cortex XDR incident. | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | +| rule.name | The name of the rule or signature generating the event. | keyword | +| tags | List of keywords used to tag each event. | keyword | +| threat.framework | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | keyword | +| threat.tactic.id | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | keyword | +| threat.tactic.name | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | keyword | +| threat.technique.id | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | keyword | +| threat.technique.name.text | Multi-field of `threat.technique.name`. | match_only_text | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.email | User email address. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | + + diff --git a/packages/panw_cortex_xdr/kibana/tags.yml b/packages/panw_cortex_xdr/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/panw_cortex_xdr/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/panw_cortex_xdr/manifest.yml b/packages/panw_cortex_xdr/manifest.yml index e983f24f64e..72edd312814 100644 --- a/packages/panw_cortex_xdr/manifest.yml +++ b/packages/panw_cortex_xdr/manifest.yml @@ -1,26 +1,26 @@ name: panw_cortex_xdr title: Palo Alto Cortex XDR -version: "1.12.0" -release: ga +version: "1.20.0" description: Collect logs from Palo Alto Cortex XDR with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [security, edr_xdr] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/icon-cortex.svg title: Palo Alto size: 216x216 type: image/svg+xml policy_templates: - - name: alerts + - name: xdr title: Palo Alto Cortex XDR API description: Collect logs from Palo Alto Cortex XDR API inputs: - type: httpjson - title: "Collect data from Palo Alto Cortex XDR" - description: "Collect data from Palo Alto Cortex XDR (input: httpjson)" + title: "Collect logs from Palo Alto Cortex XDR" + description: "Collect logs from Palo Alto Cortex XDR (input: httpjson)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/pfsense/_dev/build/build.yml b/packages/pfsense/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/pfsense/_dev/build/build.yml +++ b/packages/pfsense/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/pfsense/changelog.yml b/packages/pfsense/changelog.yml index e788a3607ec..1b76c12f179 100644 --- a/packages/pfsense/changelog.yml +++ b/packages/pfsense/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7602 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.10.1" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6859 - version: "1.9.1" changes: - description: Fix Procotol ID field mapping. diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json index 87bac89d7e3..75307f53000 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json @@ -20,7 +20,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -118,7 +118,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -203,7 +203,7 @@ "mac": "4C-55-41-A0-FA-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DHCPDISCOVER", @@ -275,7 +275,7 @@ "type": "question" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -330,7 +330,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -422,7 +422,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-bsd.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-bsd.log-expected.json index 6c8330728aa..89d0c06a6df 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-bsd.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-bsd.log-expected.json @@ -20,7 +20,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -129,7 +129,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -238,7 +238,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -338,7 +338,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -447,7 +447,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -556,7 +556,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -653,7 +653,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -751,7 +751,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -860,7 +860,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -969,7 +969,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1078,7 +1078,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1187,7 +1187,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1296,7 +1296,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1405,7 +1405,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1502,7 +1502,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1602,7 +1602,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1710,7 +1710,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1806,7 +1806,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1894,7 +1894,7 @@ "ip": "10.100.15.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json index b25c9875520..92ae1aa22ee 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json @@ -6,7 +6,7 @@ "mac": "4C-55-41-A0-FA-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DHCPDISCOVER", @@ -67,7 +67,7 @@ "mac": "4C-55-41-A0-FA-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DHCPOFFER", @@ -145,7 +145,7 @@ "ip": "10.150.60.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DHCPREQUEST", @@ -224,7 +224,7 @@ "mac": "4C-55-41-A0-FA-99" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DHCPACK", @@ -293,7 +293,7 @@ { "@timestamp": "2023-07-04T09:40:40.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -334,7 +334,7 @@ { "@timestamp": "2023-07-04T09:40:40.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -378,7 +378,7 @@ "mac": "5F-A5-54-63-CC-1F" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "listening-on-bpf", @@ -442,7 +442,7 @@ "mac": "5F-A5-54-63-CC-1F" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sending-on-bpf", @@ -503,7 +503,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -544,7 +544,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -585,7 +585,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -630,7 +630,7 @@ "ip": "2a02:cf40:72dc:dd12:7378:913c:b42e:099c" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "remove-an-address", @@ -696,7 +696,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -737,7 +737,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -778,7 +778,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -819,7 +819,7 @@ { "@timestamp": "2023-07-23T18:07:11.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -864,7 +864,7 @@ "ip": "2a02:cf40:72dc:dd12:7378:913c:b42e:099c" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add-an-address", @@ -930,7 +930,7 @@ { "@timestamp": "2023-07-23T18:11:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -971,7 +971,7 @@ { "@timestamp": "2023-07-23T18:11:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1012,7 +1012,7 @@ { "@timestamp": "2023-07-23T18:11:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1058,7 +1058,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "solicit-message", @@ -1120,7 +1120,7 @@ "ip": "2a02:cf40:38d6:c4db:cafb:917b:44ec:c873" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "picking-pool-address", @@ -1185,7 +1185,7 @@ "ip": "2a02:cf40:38d6:c4db:cafb:917b:44ec:c873" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "advertise-na", @@ -1258,7 +1258,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sending-advertise", @@ -1316,7 +1316,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "request-message", @@ -1378,7 +1378,7 @@ "ip": "2a02:cf40:38d6:c4db:cafb:917b:44ec:c873" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reply-na", @@ -1451,7 +1451,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "sending-reply", @@ -1509,7 +1509,7 @@ "port": 546 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "information-request-message", @@ -1571,7 +1571,7 @@ "ip": "2a02:cf40:38d6:c4db:cafb:917b:44ec:c873" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "reusing-lease", diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-haproxy.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-haproxy.log-expected.json index 727be66c4a6..aeacb594331 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-haproxy.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-haproxy.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-08-15T16:15:18.502-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -91,7 +91,7 @@ { "@timestamp": "2021-08-15T16:15:18.407-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -178,7 +178,7 @@ { "@timestamp": "2021-08-15T16:15:10.549-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -257,7 +257,7 @@ { "@timestamp": "2022-06-13T20:53:10.208-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -346,7 +346,7 @@ { "@timestamp": "2022-06-13T20:56:55.187-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "duration": 204000000, @@ -413,7 +413,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -484,7 +484,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-ipsec.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-ipsec.log-expected.json index 9c955b78fbd..a2e0d68e78c 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-ipsec.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-ipsec.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -39,7 +39,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -75,7 +75,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -111,7 +111,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -147,7 +147,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -183,7 +183,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -219,7 +219,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -255,7 +255,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -291,7 +291,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -327,7 +327,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -363,7 +363,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -399,7 +399,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -435,7 +435,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -471,7 +471,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -507,7 +507,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -543,7 +543,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -579,7 +579,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -615,7 +615,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -651,7 +651,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -687,7 +687,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -723,7 +723,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -759,7 +759,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -795,7 +795,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -831,7 +831,7 @@ { "@timestamp": "2021-07-04T04:01:56.547Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -884,7 +884,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-openvpn.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-openvpn.log-expected.json index 8edeaf73e55..9a7d58261c9 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-openvpn.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-openvpn.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -57,7 +57,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -111,7 +111,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -165,7 +165,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -219,7 +219,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -273,7 +273,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -327,7 +327,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -381,7 +381,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -437,7 +437,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -481,7 +481,7 @@ { "@timestamp": "2023-07-03T21:42:57.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -540,7 +540,7 @@ { "@timestamp": "2021-07-04T03:17:01.074Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -603,7 +603,7 @@ { "@timestamp": "2021-07-04T03:40:38.477Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-phpfpm.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-phpfpm.log-expected.json index cf0312122f5..647654f73c3 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-phpfpm.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-phpfpm.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-07-03T19:10:30.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -54,7 +54,7 @@ { "@timestamp": "2023-07-03T19:10:30.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -105,7 +105,7 @@ { "@timestamp": "2023-07-03T19:10:30.000-04:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-squid.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-squid.log-expected.json index 3863ae2c4cd..7788809ceef 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-squid.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-squid.log-expected.json @@ -19,7 +19,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -113,7 +113,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-syslog.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-syslog.log-expected.json index 39db2a9f8df..2e7bf0b0152 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-syslog.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-syslog.log-expected.json @@ -20,7 +20,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -130,7 +130,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -228,7 +228,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -329,7 +329,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -439,7 +439,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -537,7 +537,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -651,7 +651,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -761,7 +761,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -859,7 +859,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -948,7 +948,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1049,7 +1049,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1159,7 +1159,7 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1269,7 +1269,7 @@ "port": 1900 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1357,7 +1357,7 @@ "ip": "224.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "pass", @@ -1442,7 +1442,7 @@ "ip": "224.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", @@ -1530,7 +1530,7 @@ "ip": "224.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "block", diff --git a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-unbound.log-expected.json b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-unbound.log-expected.json index b89f92960ac..657659b6762 100644 --- a/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-unbound.log-expected.json +++ b/packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-unbound.log-expected.json @@ -18,7 +18,7 @@ "type": "question" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -82,7 +82,7 @@ "type": "question" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 2f2f6fdb004..aeb284bd5a8 100644 --- a/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for PFsense processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: netgate diff --git a/packages/pfsense/data_stream/log/fields/fields.yml b/packages/pfsense/data_stream/log/fields/fields.yml index 2d1398ec5e9..10b0ecdc8c6 100644 --- a/packages/pfsense/data_stream/log/fields/fields.yml +++ b/packages/pfsense/data_stream/log/fields/fields.yml @@ -53,7 +53,7 @@ description: | Urgent pointer data. - name: options - type: array + type: keyword description: | TCP Options. - name: length diff --git a/packages/pfsense/data_stream/log/sample_event.json b/packages/pfsense/data_stream/log/sample_event.json index 18221f712ff..63e816e4619 100644 --- a/packages/pfsense/data_stream/log/sample_event.json +++ b/packages/pfsense/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-07-04T00:10:14.578Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "5594945b-ed0f-4496-aa7a-3a121ed00404", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "data_stream": { "dataset": "pfsense.log", @@ -30,12 +30,12 @@ "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "block", @@ -44,7 +44,7 @@ "network" ], "dataset": "pfsense.log", - "ingested": "2023-01-13T12:35:06Z", + "ingested": "2023-08-29T18:51:22Z", "kind": "event", "original": "\u003c134\u003e1 2021-07-03T19:10:14.578288-05:00 pfSense.example.com filterlog 72237 - - 146,,,1535324496,igb1.12,match,block,in,4,0x0,,63,32989,0,DF,6,tcp,60,10.170.12.50,175.16.199.1,49652,853,0,S,1818117648,,64240,,mss;sackOK;TS;nop;wscale", "provider": "filterlog", @@ -60,7 +60,7 @@ }, "log": { "source": { - "address": "172.27.0.4:60508" + "address": "172.21.0.4:35028" }, "syslog": { "priority": 134 diff --git a/packages/pfsense/docs/README.md b/packages/pfsense/docs/README.md index 3650f4efec2..75b88558aa7 100644 --- a/packages/pfsense/docs/README.md +++ b/packages/pfsense/docs/README.md @@ -48,11 +48,11 @@ An example event for `log` looks as following: { "@timestamp": "2021-07-04T00:10:14.578Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "5594945b-ed0f-4496-aa7a-3a121ed00404", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.1" }, "data_stream": { "dataset": "pfsense.log", @@ -77,12 +77,12 @@ An example event for `log` looks as following: "port": 853 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "action": "block", @@ -91,7 +91,7 @@ An example event for `log` looks as following: "network" ], "dataset": "pfsense.log", - "ingested": "2023-01-13T12:35:06Z", + "ingested": "2023-08-29T18:51:22Z", "kind": "event", "original": "\u003c134\u003e1 2021-07-03T19:10:14.578288-05:00 pfSense.example.com filterlog 72237 - - 146,,,1535324496,igb1.12,match,block,in,4,0x0,,63,32989,0,DF,6,tcp,60,10.170.12.50,175.16.199.1,49652,853,0,S,1818117648,,64240,,mss;sackOK;TS;nop;wscale", "provider": "filterlog", @@ -107,7 +107,7 @@ An example event for `log` looks as following: }, "log": { "source": { - "address": "172.27.0.4:60508" + "address": "172.21.0.4:35028" }, "syslog": { "priority": 134 @@ -250,10 +250,10 @@ An example event for `log` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -367,7 +367,7 @@ An example event for `log` looks as following: | pfsense.tcp.ack | TCP Acknowledgment number. | long | | pfsense.tcp.flags | TCP flags. | keyword | | pfsense.tcp.length | Length of the TCP header and payload. | long | -| pfsense.tcp.options | TCP Options. | array | +| pfsense.tcp.options | TCP Options. | keyword | | pfsense.tcp.seq | TCP sequence number. | long | | pfsense.tcp.urg | Urgent pointer data. | keyword | | pfsense.tcp.window | Advertised TCP window size. | long | diff --git a/packages/pfsense/img/dhcp.png b/packages/pfsense/img/dhcp.png index 3f73f8f3f4f..bb2345ec13b 100644 Binary files a/packages/pfsense/img/dhcp.png and b/packages/pfsense/img/dhcp.png differ diff --git a/packages/pfsense/img/firewall.png b/packages/pfsense/img/firewall.png index c98b30b09db..1324183f780 100644 Binary files a/packages/pfsense/img/firewall.png and b/packages/pfsense/img/firewall.png differ diff --git a/packages/pfsense/img/unbound-1.png b/packages/pfsense/img/unbound-1.png deleted file mode 100644 index cc53e8aa49b..00000000000 Binary files a/packages/pfsense/img/unbound-1.png and /dev/null differ diff --git a/packages/pfsense/img/unbound-2.png b/packages/pfsense/img/unbound-2.png deleted file mode 100644 index eaa51ee3df8..00000000000 Binary files a/packages/pfsense/img/unbound-2.png and /dev/null differ diff --git a/packages/pfsense/img/unbound-3.png b/packages/pfsense/img/unbound-3.png deleted file mode 100644 index 838bfdc6bf7..00000000000 Binary files a/packages/pfsense/img/unbound-3.png and /dev/null differ diff --git a/packages/pfsense/img/unbound.png b/packages/pfsense/img/unbound.png new file mode 100644 index 00000000000..8806b8f6e1f Binary files /dev/null and b/packages/pfsense/img/unbound.png differ diff --git a/packages/pfsense/kibana/dashboard/pfsense-986061c0-3a9a-11eb-96b2-e765737b7534.json b/packages/pfsense/kibana/dashboard/pfsense-986061c0-3a9a-11eb-96b2-e765737b7534.json index c863dde2e29..7b6a791ed89 100644 --- a/packages/pfsense/kibana/dashboard/pfsense-986061c0-3a9a-11eb-96b2-e765737b7534.json +++ b/packages/pfsense/kibana/dashboard/pfsense-986061c0-3a9a-11eb-96b2-e765737b7534.json @@ -1,687 +1,1387 @@ { - "id": "pfsense-986061c0-3a9a-11eb-96b2-e765737b7534", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T19:59:25.821Z", - "version": "WzY1NCwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unbound - DNS Flow [pfSense]", - "description": "Client IP <-flow-> dns question name", - "uiState": {}, - "params": { - "spec": "{\n $schema: https://vega.github.io/schema/vega/v3.0.json\n data: [\n {\n // query ES based on the currently selected time range and filter string\n name: rawData\n url: {\n %context%: true\n %timefield%: @timestamp\n index: logs-*\n body: {\n size: 0\n aggs: {\n table: {\n composite: {\n size: 10000\n sources: [\n {\n stk1: {\n terms: {field: \"client.ip\"}\n }\n }\n {\n stk2: {\n terms: {field: \"dns.question.name\"}\n }\n }\n ]\n }\n }\n }\n }\n }\n // From the result, take just the data we are interested in\n format: {property: \"aggregations.table.buckets\"}\n // Convert key.stk1 -> stk1 for simpler access below\n transform: [\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\n ]\n }\n {\n name: nodes\n source: rawData\n transform: [\n // when a country is selected, filter out unrelated data\n {\n type: filter\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\n }\n // Set new key for later lookups - identifies each node\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\n // instead of each table row, create two new rows,\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\n {\n type: fold\n fields: [\"stk1\", \"stk2\"]\n as: [\"stack\", \"grpId\"]\n }\n // Create a sortkey, different for stk1 and stk2 stacks.\n // Space separator ensures proper sort order in some corner cases.\n {\n type: formula\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\n as: sortField\n }\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\n // independently for each stack, and ensuring they are in the proper order,\n // alphabetical from the top (reversed on the y axis)\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"sortField\", order: \"descending\"}\n field: size\n }\n // calculate vertical center point for each node, used to draw edges\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\n ]\n }\n {\n name: groups\n source: nodes\n transform: [\n // combine all nodes into country groups, summing up the doc counts\n {\n type: aggregate\n groupby: [\"stack\", \"grpId\"]\n fields: [\"size\"]\n ops: [\"sum\"]\n as: [\"total\"]\n }\n // re-calculate the stacking y0,y1 values\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"grpId\", order: \"descending\"}\n field: total\n }\n // project y0 and y1 values to screen coordinates\n // doing it once here instead of doing it several times in marks\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\n // boolean flag if the label should be on the right of the stack\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\n // Calculate traffic percentage for this country using \"y\" scale\n // domain upper bound, which represents the total traffic\n {\n type: formula\n expr: datum.total/domain('y')[1]\n as: percentage\n }\n ]\n }\n {\n // This is a temp lookup table with all the 'stk2' stack nodes\n name: destinationNodes\n source: nodes\n transform: [\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\n ]\n }\n {\n name: edges\n source: nodes\n transform: [\n // we only want nodes from the left stack\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\n // find corresponding node from the right stack, keep it as \"target\"\n {\n type: lookup\n from: destinationNodes\n key: key\n fields: [\"key\"]\n as: [\"target\"]\n }\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\n {\n type: linkpath\n orient: horizontal\n shape: diagonal\n sourceY: {expr: \"scale('y', datum.yc)\"}\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\n targetY: {expr: \"scale('y', datum.target.yc)\"}\n targetX: {expr: \"scale('x', 'stk2')\"}\n }\n // A little trick to calculate the thickness of the line.\n // The value needs to be the same as the hight of the node, but scaling\n // size to screen's height gives inversed value because screen's Y\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\n // is at the bottom. So subtracting scaled doc count from screen height\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\n {\n type: formula\n expr: range('y')[0]-scale('y', datum.size)\n as: strokeWidth\n }\n // Tooltip needs individual link's percentage of all traffic\n {\n type: formula\n expr: datum.size/domain('y')[1]\n as: percentage\n }\n ]\n }\n ]\n scales: [\n {\n // calculates horizontal stack positioning\n name: x\n type: band\n range: width\n domain: [\"stk1\", \"stk2\"]\n paddingOuter: 0.05\n paddingInner: 0.95\n }\n {\n // this scale goes up as high as the highest y1 value of all nodes\n name: y\n type: linear\n range: height\n domain: {data: \"nodes\", field: \"y1\"}\n }\n {\n // use rawData to ensure the colors stay the same when clicking.\n name: color\n type: ordinal\n range: category\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\n }\n {\n // this scale is used to map internal ids (stk1, stk2) to stack names\n name: stackNames\n type: ordinal\n range: [\"Source\", \"Destination\"]\n domain: [\"stk1\", \"stk2\"]\n }\n ]\n axes: [\n {\n // x axis should use custom label formatting to print proper stack names\n orient: bottom\n scale: x\n encode: {\n labels: {\n update: {\n text: {scale: \"stackNames\", field: \"value\"}\n }\n }\n }\n }\n {orient: \"left\", scale: \"y\"}\n ]\n marks: [\n {\n // draw the connecting line between stacks\n type: path\n name: edgeMark\n from: {data: \"edges\"}\n // this prevents some autosizing issues with large strokeWidth for paths\n clip: true\n encode: {\n update: {\n // By default use color of the left node, except when showing traffic\n // from just one country, in which case use destination color.\n stroke: [\n {\n test: groupSelector && groupSelector.stack=='stk1'\n scale: color\n field: stk2\n }\n {scale: \"color\", field: \"stk1\"}\n ]\n strokeWidth: {field: \"strokeWidth\"}\n path: {field: \"path\"}\n // when showing all traffic, and hovering over a country,\n // highlight the traffic from that country.\n strokeOpacity: {\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\n }\n // Ensure that the hover-selected edges show on top\n zindex: {\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\n }\n // format tooltip string\n tooltip: {\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n // Simple mouseover highlighting of a single line\n hover: {\n strokeOpacity: {value: 1}\n }\n }\n }\n {\n // draw stack groups (countries)\n type: rect\n name: groupMark\n from: {data: \"groups\"}\n encode: {\n enter: {\n fill: {scale: \"color\", field: \"grpId\"}\n width: {scale: \"x\", band: 1}\n }\n update: {\n x: {scale: \"x\", field: \"stack\"}\n y: {field: \"scaledY0\"}\n y2: {field: \"scaledY1\"}\n fillOpacity: {value: 0.6}\n tooltip: {\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n hover: {\n fillOpacity: {value: 1}\n }\n }\n }\n {\n // draw country code labels on the inner side of the stack\n type: text\n from: {data: \"groups\"}\n // don't process events for the labels - otherwise line mouseover is unclean\n interactive: false\n encode: {\n update: {\n // depending on which stack it is, position x with some padding\n x: {\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\n }\n // middle of the group\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n // only show text label if the group's height is large enough\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\n }\n }\n }\n {\n // Create a \"show all\" button. Shown only when a country is selected.\n type: group\n data: [\n // We need to make the button show only when groupSelector signal is true.\n // Each mark is drawn as many times as there are elements in the backing data.\n // Which means that if values list is empty, it will not be drawn.\n // Here I create a data source with one empty object, and filter that list\n // based on the signal value. This can only be done in a group.\n {\n name: dataForShowAll\n values: [{}]\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\n }\n ]\n // Set button size and positioning\n encode: {\n enter: {\n xc: {signal: \"width/2\"}\n y: {value: 30}\n width: {value: 80}\n height: {value: 30}\n }\n }\n marks: [\n {\n // This group is shown as a button with rounded corners.\n type: group\n // mark name allows signal capturing\n name: groupReset\n // Only shows button if dataForShowAll has values.\n from: {data: \"dataForShowAll\"}\n encode: {\n enter: {\n cornerRadius: {value: 6}\n fill: {value: \"#f5f5f5\"}\n stroke: {value: \"#c1c1c1\"}\n strokeWidth: {value: 2}\n // use parent group's size\n height: {\n field: {group: \"height\"}\n }\n width: {\n field: {group: \"width\"}\n }\n }\n update: {\n // groups are transparent by default\n opacity: {value: 1}\n }\n hover: {\n opacity: {value: 0.7}\n }\n }\n marks: [\n {\n type: text\n // if true, it will prevent clicking on the button when over text.\n interactive: false\n encode: {\n enter: {\n // center text in the paren group\n xc: {\n field: {group: \"width\"}\n mult: 0.5\n }\n yc: {\n field: {group: \"height\"}\n mult: 0.5\n offset: 2\n }\n align: {value: \"center\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n text: {value: \"Show All\"}\n }\n }\n }\n ]\n }\n ]\n }\n ]\n signals: [\n {\n // used to highlight traffic to/from the same country\n name: groupHover\n value: {}\n on: [\n {\n events: @groupMark:mouseover\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\n }\n {events: \"mouseout\", update: \"{}\"}\n ]\n }\n // used to filter only the data related to the selected country\n {\n name: groupSelector\n value: false\n on: [\n {\n // Clicking groupMark sets this signal to the filter values\n events: @groupMark:click!\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\n }\n {\n // Clicking \"show all\" button, or double-clicking anywhere resets it\n events: [\n {type: \"click\", markname: \"groupReset\"}\n {type: \"dblclick\"}\n ]\n update: \"false\"\n }\n ]\n }\n ]\n}" - }, - "type": "vega", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"9ab12166-c3c1-47e8-9bbb-729eec776994\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"9ab12166-c3c1-47e8-9bbb-729eec776994\",\"fieldName\":\"observer.name\",\"title\":\"Firewall Selector\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 20, - "i": "73294aad-e475-4a63-97d1-fc214a83bb0a", - "w": 34, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "73294aad-e475-4a63-97d1-fc214a83bb0a", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall Selector [pfSense]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "observer.name", - "id": "1613404486264", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Firewall Selector", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d948f4b0-e67a-4f80-899e-d0404bc6e529", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c40b7671-2e8e-48a7-b226-0cd48c5df3da", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0ed14cf2-107e-437e-8ee5-860a5d6349b3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d948f4b0-e67a-4f80-899e-d0404bc6e529": { + "columnOrder": [ + "90b900b1-72dc-480e-b48e-5b0fb459f854", + "331fdcc9-95eb-46c4-b651-31212ec8431e", + "174eaf8d-d244-43f1-8875-675d33b73156" + ], + "columns": { + "174eaf8d-d244-43f1-8875-675d33b73156": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "331fdcc9-95eb-46c4-b651-31212ec8431e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DNS Requested Domains", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "174eaf8d-d244-43f1-8875-675d33b73156", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "dns.question.name" + }, + "90b900b1-72dc-480e-b48e-5b0fb459f854": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Client IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "174eaf8d-d244-43f1-8875-675d33b73156", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c40b7671-2e8e-48a7-b226-0cd48c5df3da", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.provider", + "index": "0ed14cf2-107e-437e-8ee5-860a5d6349b3", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d948f4b0-e67a-4f80-899e-d0404bc6e529", + "layerType": "data", + "legendDisplay": "hide", + "legendPosition": "right", + "metrics": [ + "174eaf8d-d244-43f1-8875-675d33b73156" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "90b900b1-72dc-480e-b48e-5b0fb459f854", + "331fdcc9-95eb-46c4-b651-31212ec8431e" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 6, - "i": "46725bb5-e239-4fa2-8dfd-4de947863354", - "w": 14, - "x": 34, - "y": 0 - }, - "panelIndex": "46725bb5-e239-4fa2-8dfd-4de947863354", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unbound - Question Types [pfSense]", - "description": "Unbound dns question types", - "uiState": { - "vis": { - "legendOpen": true - } + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "82648fb7-2511-4083-8693-e25b118b73c2", + "w": 34, + "x": 0, + "y": 0 + }, + "panelIndex": "82648fb7-2511-4083-8693-e25b118b73c2", + "title": "Unbound - DNS Requests per Client IP [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "top", - "nestedLegend": false, - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9117c6f5-4f56-4829-840f-076df3a95a72", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ebca49a1-f1bb-4faa-8874-f43301462059", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07dd459a-56c6-486b-8ac3-0cfbfd32aa95", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9117c6f5-4f56-4829-840f-076df3a95a72": { + "columnOrder": [ + "997168d3-5718-4701-b9ea-aca73cb961db", + "d1780e3c-793f-4b98-89ad-b4b14e1f6711" + ], + "columns": { + "997168d3-5718-4701-b9ea-aca73cb961db": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "dns.question.type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d1780e3c-793f-4b98-89ad-b4b14e1f6711", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "dns.question.type" + }, + "d1780e3c-793f-4b98-89ad-b4b14e1f6711": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ebca49a1-f1bb-4faa-8874-f43301462059", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "07dd459a-56c6-486b-8ac3-0cfbfd32aa95", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "9117c6f5-4f56-4829-840f-076df3a95a72", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "top", + "legendSize": "auto", + "metrics": [ + "d1780e3c-793f-4b98-89ad-b4b14e1f6711" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "997168d3-5718-4701-b9ea-aca73cb961db" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Unbound - Question Types [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f39b1b4c-b444-4d25-a8c5-a78b6285025f", + "w": 14, + "x": 34, + "y": 0 + }, + "panelIndex": "f39b1b4c-b444-4d25-a8c5-a78b6285025f", + "title": "Unbound - Question Types [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "484cdd30-47fd-490a-966b-ad6009bc9212", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0812570-064b-4573-80bf-0a91b4319603", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0c20878d-6e97-4e9a-9a7d-e7ccee31c296": { + "columnOrder": [ + "59656412-b998-4ae0-9bc6-d7c9e7855b1c", + "2c3f4549-07b1-4ed4-9308-c970456ccec6" + ], + "columns": { + "2c3f4549-07b1-4ed4-9308-c970456ccec6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "59656412-b998-4ae0-9bc6-d7c9e7855b1c": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c3f4549-07b1-4ed4-9308-c970456ccec6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "484cdd30-47fd-490a-966b-ad6009bc9212", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.provider", + "index": "b0812570-064b-4573-80bf-0a91b4319603", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2c3f4549-07b1-4ed4-9308-c970456ccec6", + "isTransposed": false + }, + { + "columnId": "59656412-b998-4ae0-9bc6-d7c9e7855b1c", + "isTransposed": false + } + ], + "layerId": "0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "dns.question.type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 14, - "i": "f39b1b4c-b444-4d25-a8c5-a78b6285025f", - "w": 14, - "x": 34, - "y": 6 - }, - "panelIndex": "f39b1b4c-b444-4d25-a8c5-a78b6285025f", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unbound - Top Client IPs [pfSense]", - "description": "Top 10 client IP unbound events", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": true + "gridData": { + "h": 12, + "i": "239c2d6b-3b6a-42fb-a9c7-0101ad132ab5", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "239c2d6b-3b6a-42fb-a9c7-0101ad132ab5", + "title": "Unbound - Top Client IPs [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "25f69046-eebe-4aa5-a805-43ed22311c8d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9994c2af-3fe2-40aa-a24c-47f5b63f6b82", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0c20878d-6e97-4e9a-9a7d-e7ccee31c296": { + "columnOrder": [ + "59656412-b998-4ae0-9bc6-d7c9e7855b1c", + "2c3f4549-07b1-4ed4-9308-c970456ccec6" + ], + "columns": { + "2c3f4549-07b1-4ed4-9308-c970456ccec6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "59656412-b998-4ae0-9bc6-d7c9e7855b1c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2c3f4549-07b1-4ed4-9308-c970456ccec6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "dns.question.registered_domain" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "25f69046-eebe-4aa5-a805-43ed22311c8d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.provider", + "index": "9994c2af-3fe2-40aa-a24c-47f5b63f6b82", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2c3f4549-07b1-4ed4-9308-c970456ccec6", + "isTransposed": false + }, + { + "columnId": "59656412-b998-4ae0-9bc6-d7c9e7855b1c", + "isTransposed": false + } + ], + "layerId": "0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 12, - "i": "a7662c6e-94d5-4062-85f4-0132897f3578", - "w": 24, - "x": 0, - "y": 20 - }, - "panelIndex": "a7662c6e-94d5-4062-85f4-0132897f3578", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unbound - Top Queries [pfSense]", - "description": "Top 10 domain name question/queries", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": true + "gridData": { + "h": 12, + "i": "88383583-1094-4c3a-86b9-f8ff95646b2a", + "w": 24, + "x": 24, + "y": 15 + }, + "panelIndex": "88383583-1094-4c3a-86b9-f8ff95646b2a", + "title": "Unbound - Top Queries [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f0138ad1-1844-4dc4-aad0-bac9f9e39d1d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a683e84-d3b7-432f-b345-5a6a144941bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d505d77-2cf7-4bd2-b2ed-40ae5244fe31", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "f0138ad1-1844-4dc4-aad0-bac9f9e39d1d": { + "columnOrder": [ + "00bc6ac5-344b-49ac-ae48-363483bcd914", + "e3e0a8ec-e64a-486f-af99-054f0e075563", + "bda60540-2a1e-4a5f-b05c-a92a8f9f78a0" + ], + "columns": { + "00bc6ac5-344b-49ac-ae48-363483bcd914": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "bda60540-2a1e-4a5f-b05c-a92a8f9f78a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e3e0a8ec-e64a-486f-af99-054f0e075563": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "client.ip: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bda60540-2a1e-4a5f-b05c-a92a8f9f78a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0a683e84-d3b7-432f-b345-5a6a144941bb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4d505d77-2cf7-4bd2-b2ed-40ae5244fe31", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "bda60540-2a1e-4a5f-b05c-a92a8f9f78a0" + ], + "isHistogram": true, + "layerId": "f0138ad1-1844-4dc4-aad0-bac9f9e39d1d", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "e3e0a8ec-e64a-486f-af99-054f0e075563", + "xAccessor": "00bc6ac5-344b-49ac-ae48-363483bcd914", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "bda60540-2a1e-4a5f-b05c-a92a8f9f78a0" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Unbound - Client IP/Time [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "dns.question.registered_domain", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 12, - "i": "763610d2-c8aa-4ab9-9a63-112e2471dcfc", - "w": 24, - "x": 24, - "y": 20 - }, - "panelIndex": "763610d2-c8aa-4ab9-9a63-112e2471dcfc", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Unbound - Client IP/Time [pfSense]", - "description": "Unbound client IP over time", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] + "gridData": { + "h": 14, + "i": "27569da9-7531-40cf-be93-8778738b68be", + "w": 48, + "x": 0, + "y": 27 + }, + "panelIndex": "27569da9-7531-40cf-be93-8778738b68be", + "title": "Unbound - Client IP/Time [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "columns": [ + "log.level", + "client.ip", + "dns.question.name", + "dns.question.type", + "dns.question.class" + ], + "enhancements": {} }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-7h", - "to": "now" + "gridData": { + "h": 21, + "i": "7ea4ebda-9d0c-4885-9c37-71cd0665497f", + "w": 30, + "x": 0, + "y": 41 + }, + "panelIndex": "7ea4ebda-9d0c-4885-9c37-71cd0665497f", + "panelRefName": "panel_7ea4ebda-9d0c-4885-9c37-71cd0665497f", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bae96055-1871-4797-8114-f0ecd007c73d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e5743279-d25c-4d73-8cf7-19f9c28dc317", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "78f3223d-fdf8-457a-b9b0-b5f4fc1b5691", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bae96055-1871-4797-8114-f0ecd007c73d": { + "columnOrder": [ + "8665ed03-163e-415b-b008-186d8741a5b3", + "c880132d-ec82-40d1-8aba-f1624e4b0444", + "37830514-935f-4ab6-8356-a2714529209e" + ], + "columns": { + "37830514-935f-4ab6-8356-a2714529209e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8665ed03-163e-415b-b008-186d8741a5b3": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "c880132d-ec82-40d1-8aba-f1624e4b0444": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Client IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "37830514-935f-4ab6-8356-a2714529209e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e5743279-d25c-4d73-8cf7-19f9c28dc317", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "78f3223d-fdf8-457a-b9b0-b5f4fc1b5691", + "key": "event.provider", + "negate": false, + "params": { + "query": "unbound" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "unbound" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "heatmap_grid" + }, + "layerId": "bae96055-1871-4797-8114-f0ecd007c73d", + "layerType": "data", + "legend": { + "isVisible": true, + "position": "top", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "37830514-935f-4ab6-8356-a2714529209e", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#006837", + "stop": 0 + }, + { + "color": "#1E974F", + "stop": 10 + }, + { + "color": "#65BC62", + "stop": 20 + }, + { + "color": "#A5D96B", + "stop": 30 + }, + { + "color": "#D8EF8C", + "stop": 40 + }, + { + "color": "#FEFEBD", + "stop": 50 + }, + { + "color": "#FEDF8B", + "stop": 60 + }, + { + "color": "#FDAD61", + "stop": 70 + }, + { + "color": "#F36D43", + "stop": 80 + }, + { + "color": "#D63129", + "stop": 90 + } + ], + "continuity": "none", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": 100, + "rangeMin": 0, + "rangeType": "percent", + "reverse": false, + "stops": [ + { + "color": "#006837", + "stop": 10 + }, + { + "color": "#1E974F", + "stop": 20 + }, + { + "color": "#65BC62", + "stop": 30 + }, + { + "color": "#A5D96B", + "stop": 40 + }, + { + "color": "#D8EF8C", + "stop": 50 + }, + { + "color": "#FEFEBD", + "stop": 60 + }, + { + "color": "#FEDF8B", + "stop": 70 + }, + { + "color": "#FDAD61", + "stop": 80 + }, + { + "color": "#F36D43", + "stop": 90 + }, + { + "color": "#D63129", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "37830514-935f-4ab6-8356-a2714529209e", + "xAccessor": "8665ed03-163e-415b-b008-186d8741a5b3", + "yAccessor": "c880132d-ec82-40d1-8aba-f1624e4b0444" + } + }, + "title": "Unbound - Request Rate [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsHeatmap" }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 21, + "i": "6a32114d-577c-488b-b1e9-b7b4fc8941ae", + "w": 18, + "x": 30, + "y": 41 + }, + "panelIndex": "6a32114d-577c-488b-b1e9-b7b4fc8941ae", + "title": "Unbound - Request Rate [pfSense]", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "Unbound - Dashboard [pfSense]", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-07T06:39:18.548Z", + "id": "pfsense-986061c0-3a9a-11eb-96b2-e765737b7534", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "82648fb7-2511-4083-8693-e25b118b73c2:indexpattern-datasource-layer-d948f4b0-e67a-4f80-899e-d0404bc6e529", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "27569da9-7531-40cf-be93-8778738b68be", - "w": 48, - "x": 0, - "y": 32 + { + "id": "logs-*", + "name": "82648fb7-2511-4083-8693-e25b118b73c2:c40b7671-2e8e-48a7-b226-0cd48c5df3da", + "type": "index-pattern" }, - "panelIndex": "27569da9-7531-40cf-be93-8778738b68be", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "columns": [ - "log.level", - "client.ip", - "dns.question.name", - "dns.question.type", - "dns.question.class" - ], - "enhancements": {} + { + "id": "logs-*", + "name": "82648fb7-2511-4083-8693-e25b118b73c2:0ed14cf2-107e-437e-8ee5-860a5d6349b3", + "type": "index-pattern" }, - "gridData": { - "h": 21, - "i": "7ea4ebda-9d0c-4885-9c37-71cd0665497f", - "w": 30, - "x": 0, - "y": 46 + { + "id": "logs-*", + "name": "f39b1b4c-b444-4d25-a8c5-a78b6285025f:indexpattern-datasource-layer-9117c6f5-4f56-4829-840f-076df3a95a72", + "type": "index-pattern" }, - "panelIndex": "7ea4ebda-9d0c-4885-9c37-71cd0665497f", - "panelRefName": "panel_7ea4ebda-9d0c-4885-9c37-71cd0665497f", - "type": "search", - "version": "7.15.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": null, - "savedVis": { - "title": "Unbound - Request Rate [pfSense]", - "description": "Unbound request heat map by IP address", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Green to Red", - "colorsNumber": 10, - "colorsRange": [], - "enableHover": false, - "invertColors": false, - "legendPosition": "top", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ] - }, - "type": "heatmap", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-7h", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "f39b1b4c-b444-4d25-a8c5-a78b6285025f:ebca49a1-f1bb-4faa-8874-f43301462059", + "type": "index-pattern" }, - "gridData": { - "h": 21, - "i": "6a32114d-577c-488b-b1e9-b7b4fc8941ae", - "w": 18, - "x": 30, - "y": 46 + { + "id": "logs-*", + "name": "f39b1b4c-b444-4d25-a8c5-a78b6285025f:07dd459a-56c6-486b-8ac3-0cfbfd32aa95", + "type": "index-pattern" }, - "panelIndex": "6a32114d-577c-488b-b1e9-b7b4fc8941ae", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "logs-*", + "name": "239c2d6b-3b6a-42fb-a9c7-0101ad132ab5:indexpattern-datasource-layer-0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "239c2d6b-3b6a-42fb-a9c7-0101ad132ab5:484cdd30-47fd-490a-966b-ad6009bc9212", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "239c2d6b-3b6a-42fb-a9c7-0101ad132ab5:b0812570-064b-4573-80bf-0a91b4319603", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88383583-1094-4c3a-86b9-f8ff95646b2a:indexpattern-datasource-layer-0c20878d-6e97-4e9a-9a7d-e7ccee31c296", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88383583-1094-4c3a-86b9-f8ff95646b2a:25f69046-eebe-4aa5-a805-43ed22311c8d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "88383583-1094-4c3a-86b9-f8ff95646b2a:9994c2af-3fe2-40aa-a24c-47f5b63f6b82", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27569da9-7531-40cf-be93-8778738b68be:indexpattern-datasource-layer-f0138ad1-1844-4dc4-aad0-bac9f9e39d1d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27569da9-7531-40cf-be93-8778738b68be:0a683e84-d3b7-432f-b345-5a6a144941bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "27569da9-7531-40cf-be93-8778738b68be:4d505d77-2cf7-4bd2-b2ed-40ae5244fe31", + "type": "index-pattern" + }, + { + "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4", + "name": "7ea4ebda-9d0c-4885-9c37-71cd0665497f:panel_7ea4ebda-9d0c-4885-9c37-71cd0665497f", + "type": "search" + }, + { + "id": "logs-*", + "name": "6a32114d-577c-488b-b1e9-b7b4fc8941ae:indexpattern-datasource-layer-bae96055-1871-4797-8114-f0ecd007c73d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a32114d-577c-488b-b1e9-b7b4fc8941ae:e5743279-d25c-4d73-8cf7-19f9c28dc317", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6a32114d-577c-488b-b1e9-b7b4fc8941ae:78f3223d-fdf8-457a-b9b0-b5f4fc1b5691", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_9ab12166-c3c1-47e8-9bbb-729eec776994:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "Unbound - Dashboard [pfSense]", - "version": 1 - }, - "references": [ - { - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4", - "name": "7ea4ebda-9d0c-4885-9c37-71cd0665497f:panel_7ea4ebda-9d0c-4885-9c37-71cd0665497f", - "type": "search" - }, - { - "type": "search", - "name": "73294aad-e475-4a63-97d1-fc214a83bb0a:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - }, - { - "type": "index-pattern", - "name": "46725bb5-e239-4fa2-8dfd-4de947863354:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "46725bb5-e239-4fa2-8dfd-4de947863354:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "search", - "name": "f39b1b4c-b444-4d25-a8c5-a78b6285025f:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - }, - { - "type": "search", - "name": "a7662c6e-94d5-4062-85f4-0132897f3578:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - }, - { - "type": "search", - "name": "763610d2-c8aa-4ab9-9a63-112e2471dcfc:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - }, - { - "type": "search", - "name": "27569da9-7531-40cf-be93-8778738b68be:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - }, - { - "type": "search", - "name": "6a32114d-577c-488b-b1e9-b7b4fc8941ae:search_0", - "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/pfsense/kibana/dashboard/pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534.json b/packages/pfsense/kibana/dashboard/pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534.json index cd4f30dfb54..2e2d0e8dfc4 100644 --- a/packages/pfsense/kibana/dashboard/pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534.json +++ b/packages/pfsense/kibana/dashboard/pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534.json @@ -1,1221 +1,1921 @@ { - "id": "pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T19:59:25.821Z", - "version": "WzY1NSwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall - Event Action [pfSense]", - "description": "Displays quantity of events based on action type", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Firewall - Event Action", - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"3845ebe2-e58d-4b6a-9432-dc94fa9c5c00\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"3845ebe2-e58d-4b6a-9432-dc94fa9c5c00\",\"fieldName\":\"observer.name\",\"title\":\"Firewall Selector\",\"enhancements\":{}}},\"1804d6fc-9923-4a67-8976-caeea656cb66\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"1804d6fc-9923-4a67-8976-caeea656cb66\",\"fieldName\":\"observer.ingress.interface.name\",\"title\":\"Interface Selector\",\"enhancements\":{}}},\"4b3a57df-9e9a-493c-b6f2-8f4d6626702e\":{\"type\":\"optionsListControl\",\"order\":2,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"4b3a57df-9e9a-493c-b6f2-8f4d6626702e\",\"fieldName\":\"network.transport\",\"title\":\"Network Transport\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 7, - "i": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b", - "w": 16, - "x": 0, - "y": 7 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "Treemap depicting the top 10 countries by destination ", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "d77ab0e4-c2c2-4fb4-bd98-63c13ade7778": { - "columnOrder": [ - "9d13ff42-0a6d-4cb4-bff4-bbd64836de35", - "57fc4315-85f4-4449-a8bd-308ec2e81e68" - ], - "columns": { - "57fc4315-85f4-4449-a8bd-308ec2e81e68": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" - }, - "9d13ff42-0a6d-4cb4-bff4-bbd64836de35": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of destination.geo.country_name", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "57fc4315-85f4-4449-a8bd-308ec2e81e68", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a03bd2de-e7a0-4b9e-948f-2e1d1bb589fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a39305d6-cd33-4ebe-8ead-3ebe203a8266", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 5, - "parentFormat": { - "id": "terms" + { + "id": "logs-*", + "name": "ed423989-3f2d-47c7-a5c9-61e7c0f9ae54", + "type": "index-pattern" } - }, - "scale": "ordinal", - "sourceField": "destination.geo.country_name" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "9d13ff42-0a6d-4cb4-bff4-bbd64836de35" - ], - "layerId": "d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", - "legendDisplay": "default", - "metric": "57fc4315-85f4-4449-a8bd-308ec2e81e68", - "nestedLegend": false, - "numberDisplay": "percent", - "percentDecimals": 0, - "layerType": "data" - } - ], - "shape": "treemap" - } - }, - "title": "Firewall - Top Destination Countries/Treemap (Lens) [pfSense]", - "visualizationType": "lnsPie", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 14, - "i": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc", - "w": 17, - "x": 16, - "y": 0 - }, - "panelIndex": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc", - "version": "8.1.0", - "type": "lens" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Interface Selector [pfSense]", - "description": "Select by interface alias", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "observer.ingress.interface.name", - "id": "1607565832669", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Interface Selector", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a03bd2de-e7a0-4b9e-948f-2e1d1bb589fa": { + "columnOrder": [ + "2459d995-b949-4dae-b1e3-9b3622e4e249", + "b5a04d69-3b8a-46b8-9c7a-2a5af561846f", + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX0", + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX1" + ], + "columns": { + "2459d995-b949-4dae-b1e3-9b3622e4e249": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Firewall - Event Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "b5a04d69-3b8a-46b8-9c7a-2a5af561846f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX1" + ], + "scale": "ratio" + }, + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Count", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "b5a04d69-3b8a-46b8-9c7a-2a5af561846fX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a39305d6-cd33-4ebe-8ead-3ebe203a8266", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ed423989-3f2d-47c7-a5c9-61e7c0f9ae54", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "breakdownByAccessor": "2459d995-b949-4dae-b1e3-9b3622e4e249", + "color": "#6092C0", + "layerId": "a03bd2de-e7a0-4b9e-948f-2e1d1bb589fa", + "layerType": "data", + "metricAccessor": "b5a04d69-3b8a-46b8-9c7a-2a5af561846f" + } + }, + "title": "Firewall - Event Action [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 7, - "i": "d2c26a96-ad50-4155-a67e-b6559246c302", - "w": 15, - "x": 33, - "y": 0 - }, - "panelIndex": "d2c26a96-ad50-4155-a67e-b6559246c302", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall Selector [pfSense]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "observer.name", - "id": "1613404486264", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Firewall Selector", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b", + "w": 16, + "x": 0, + "y": 0 + }, + "panelIndex": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b", + "title": "Firewall - Event Action [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + { + "embeddableConfig": { + "attributes": { + "description": "Treemap depicting the top 10 countries by destination ", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "219f9c72-072a-4b9d-bebf-f17292f1a4f5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ae8ac200-f288-4b65-8837-ad551dd8b596", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d77ab0e4-c2c2-4fb4-bd98-63c13ade7778": { + "columnOrder": [ + "9d13ff42-0a6d-4cb4-bff4-bbd64836de35", + "57fc4315-85f4-4449-a8bd-308ec2e81e68" + ], + "columns": { + "57fc4315-85f4-4449-a8bd-308ec2e81e68": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "9d13ff42-0a6d-4cb4-bff4-bbd64836de35": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of destination.geo.country_name", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "57fc4315-85f4-4449-a8bd-308ec2e81e68", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_name" + } + } + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "219f9c72-072a-4b9d-bebf-f17292f1a4f5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.provider", + "index": "ae8ac200-f288-4b65-8837-ad551dd8b596", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "57fc4315-85f4-4449-a8bd-308ec2e81e68" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 0, + "primaryGroups": [ + "9d13ff42-0a6d-4cb4-bff4-bbd64836de35" + ] + } + ], + "shape": "treemap" + } + }, + "title": "Firewall - Top Destination Countries/Treemap (Lens) [pfSense]", + "type": "lens", + "visualizationType": "lnsPie" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 7, - "i": "9db410fe-e1b3-46d1-9e9b-828f3cec05dd", - "w": 16, - "x": 0, - "y": 0 - }, - "panelIndex": "9db410fe-e1b3-46d1-9e9b-828f3cec05dd", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Network Transport Type [pfSense]", - "description": "Select by network transport type", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "network.transport", - "id": "1607565832669", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Network Transport Type", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc", + "w": 17, + "x": 16, + "y": 0 + }, + "panelIndex": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc", + "title": "Firewall - Top Destination Countries/Treemap [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7cf9efe7-b252-4ff0-a6b1-979dc50751d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fd0da016-ba0b-49e9-bd9d-8cdc278f21b2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3832ba27-ac50-4ae3-bcf8-6cfc756ee827", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7cf9efe7-b252-4ff0-a6b1-979dc50751d1": { + "columnOrder": [ + "ab13c54c-083d-4dc1-b547-c061104c7f9c", + "c0462817-9d4f-47ee-8aa9-614e4a295f50", + "022a38bc-5811-4775-9903-b22d0f1ff2c4" + ], + "columns": { + "022a38bc-5811-4775-9903-b22d0f1ff2c4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ab13c54c-083d-4dc1-b547-c061104c7f9c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "022a38bc-5811-4775-9903-b22d0f1ff2c4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "c0462817-9d4f-47ee-8aa9-614e4a295f50": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Firewall - Events by Interface", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "022a38bc-5811-4775-9903-b22d0f1ff2c4", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "observer.ingress.interface.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fd0da016-ba0b-49e9-bd9d-8cdc278f21b2", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3832ba27-ac50-4ae3-bcf8-6cfc756ee827", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "7cf9efe7-b252-4ff0-a6b1-979dc50751d1", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "022a38bc-5811-4775-9903-b22d0f1ff2c4" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ab13c54c-083d-4dc1-b547-c061104c7f9c", + "c0462817-9d4f-47ee-8aa9-614e4a295f50" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Firewall - Events by Interface [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 7, - "i": "20a6aca9-2a7c-4b4a-8bd4-f2e9ae5d6249", - "w": 15, - "x": 33, - "y": 7 - }, - "panelIndex": "20a6aca9-2a7c-4b4a-8bd4-f2e9ae5d6249", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "attributes": { - "description": "Events over time line chart utilizing the LENS virtualization", - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "25e5682a-0461-46dc-aa0a-7ad4cec0eade": { - "columnOrder": [ - "f718697e-acee-4bfd-99f4-3406e224ed7f", - "440112fe-405a-4b46-840e-2b9772961acc", - "31549313-ebc1-427a-9913-3f6f78594221" - ], - "columns": { - "31549313-ebc1-427a-9913-3f6f78594221": { - "dataType": "number", - "isBucketed": false, - "label": "Count of records", - "operationType": "count", - "scale": "ratio", - "sourceField": "___records___" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772", + "w": 15, + "x": 33, + "y": 0 + }, + "panelIndex": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772", + "title": "Firewall - Events by Interface [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "Events over time line chart utilizing the LENS virtualization", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-25e5682a-0461-46dc-aa0a-7ad4cec0eade", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c4a2f4c9-afff-4529-96d5-362305575839", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1291a28a-0b60-424d-a2aa-3669a1efdf1b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "25e5682a-0461-46dc-aa0a-7ad4cec0eade": { + "columnOrder": [ + "f718697e-acee-4bfd-99f4-3406e224ed7f", + "440112fe-405a-4b46-840e-2b9772961acc", + "31549313-ebc1-427a-9913-3f6f78594221" + ], + "columns": { + "31549313-ebc1-427a-9913-3f6f78594221": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "scale": "ratio", + "sourceField": "___records___" + }, + "440112fe-405a-4b46-840e-2b9772961acc": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f718697e-acee-4bfd-99f4-3406e224ed7f": { + "dataType": "string", + "isBucketed": true, + "label": "Top values of event.action", + "operationType": "terms", + "params": { + "orderBy": { + "columnId": "31549313-ebc1-427a-9913-3f6f78594221", + "type": "column" + }, + "orderDirection": "desc", + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + } + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c4a2f4c9-afff-4529-96d5-362305575839", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.provider", + "index": "1291a28a-0b60-424d-a2aa-3669a1efdf1b", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "layers": [ + { + "accessors": [ + "31549313-ebc1-427a-9913-3f6f78594221" + ], + "layerId": "25e5682a-0461-46dc-aa0a-7ad4cec0eade", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "f718697e-acee-4bfd-99f4-3406e224ed7f", + "xAccessor": "440112fe-405a-4b46-840e-2b9772961acc" + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + } + } }, - "440112fe-405a-4b46-840e-2b9772961acc": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" + "title": "Firewall - Events/Time (Lens) [pfSense]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "c2fbea99-8684-446a-a570-48bcbb9f1c39", + "w": 33, + "x": 0, + "y": 14 + }, + "panelIndex": "c2fbea99-8684-446a-a570-48bcbb9f1c39", + "title": "Firewall - Events/Time [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-05d878bc-ee96-495b-9be4-bef38684ca83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c7e1dbc1-e0e3-4bad-b627-9f22f1fe5515", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7538c1fb-cec8-4354-aa25-576fe2b9f328", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "05d878bc-ee96-495b-9be4-bef38684ca83": { + "columnOrder": [ + "1a250b1c-cc15-4703-9fbe-7cbcd801e299", + "f7708f51-6e72-4dda-8d26-2c2e62073e6a" + ], + "columns": { + "1a250b1c-cc15-4703-9fbe-7cbcd801e299": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Firewall - Network Transport", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f7708f51-6e72-4dda-8d26-2c2e62073e6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "f7708f51-6e72-4dda-8d26-2c2e62073e6a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c7e1dbc1-e0e3-4bad-b627-9f22f1fe5515", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7538c1fb-cec8-4354-aa25-576fe2b9f328", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "05d878bc-ee96-495b-9be4-bef38684ca83", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "f7708f51-6e72-4dda-8d26-2c2e62073e6a" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "1a250b1c-cc15-4703-9fbe-7cbcd801e299" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } }, - "f718697e-acee-4bfd-99f4-3406e224ed7f": { - "dataType": "string", - "isBucketed": true, - "label": "Top values of event.action", - "operationType": "terms", - "params": { - "orderBy": { - "columnId": "31549313-ebc1-427a-9913-3f6f78594221", - "type": "column" + "title": "Firewall - Network Transport [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "60b4467b-8227-41de-b5ec-00c860793819", + "w": 15, + "x": 33, + "y": 14 + }, + "panelIndex": "60b4467b-8227-41de-b5ec-00c860793819", + "title": "Firewall - Network Transport [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9faf4a53-ecf9-4327-9131-dac543552dda", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "11667108-805a-43e8-9c80-63ccca2cb485", + "type": "index-pattern" }, - "orderDirection": "desc", - "size": 5, - "parentFormat": { - "id": "terms" + { + "id": "logs-*", + "name": "5ddc2d89-5d83-42fe-baad-7ae83eb629b3", + "type": "index-pattern" } - }, - "scale": "ordinal", - "sourceField": "event.action" - } - } - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9faf4a53-ecf9-4327-9131-dac543552dda": { + "columnOrder": [ + "8abd4d17-b6ee-43a9-ac20-69e32038a0e9", + "08f20700-c14a-401b-8bc6-1eba1e6825fa", + "b4192a10-d167-4295-86f9-7287084c956a" + ], + "columns": { + "08f20700-c14a-401b-8bc6-1eba1e6825fa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.transport: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b4192a10-d167-4295-86f9-7287084c956a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "8abd4d17-b6ee-43a9-ac20-69e32038a0e9": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Firewall - Network Transport/Time", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b4192a10-d167-4295-86f9-7287084c956a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "11667108-805a-43e8-9c80-63ccca2cb485", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "5ddc2d89-5d83-42fe-baad-7ae83eb629b3", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "b4192a10-d167-4295-86f9-7287084c956a" + ], + "isHistogram": true, + "layerId": "9faf4a53-ecf9-4327-9131-dac543552dda", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "08f20700-c14a-401b-8bc6-1eba1e6825fa", + "xAccessor": "8abd4d17-b6ee-43a9-ac20-69e32038a0e9", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "b4192a10-d167-4295-86f9-7287084c956a" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Firewall - Network Transport/Time [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a", + "w": 48, + "x": 0, + "y": 28 }, - "layers": [ - { - "accessors": [ - "31549313-ebc1-427a-9913-3f6f78594221" + "panelIndex": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a", + "title": "Firewall - Network Transport/Time [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "columns": [ + "observer.name", + "observer.ingress.vlan.id", + "source.ip", + "source.port", + "destination.ip", + "destination.port", + "rule.id", + "event.action" ], - "layerId": "25e5682a-0461-46dc-aa0a-7ad4cec0eade", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "splitAccessor": "f718697e-acee-4bfd-99f4-3406e224ed7f", - "xAccessor": "440112fe-405a-4b46-840e-2b9772961acc", - "layerType": "data" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "enhancements": {} }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - } - } - }, - "title": "Firewall - Events/Time (Lens) [pfSense]", - "visualizationType": "lnsXY", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-25e5682a-0461-46dc-aa0a-7ad4cec0eade", - "type": "index-pattern" - } - ] - } - }, - "gridData": { - "h": 14, - "i": "c2fbea99-8684-446a-a570-48bcbb9f1c39", - "w": 33, - "x": 0, - "y": 14 - }, - "panelIndex": "c2fbea99-8684-446a-a570-48bcbb9f1c39", - "version": "8.1.0", - "type": "lens" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall - Events by Interface [pfSense]", - "description": "Pie chart depicting events by interface alias", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "gridData": { + "h": 17, + "i": "290350f0-e295-4441-8228-2f7c74fc8a0c", + "w": 48, + "x": 0, + "y": 43 + }, + "panelIndex": "290350f0-e295-4441-8228-2f7c74fc8a0c", + "panelRefName": "panel_290350f0-e295-4441-8228-2f7c74fc8a0c", + "type": "search", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-75195579-4159-4fd9-8e63-b21a012f35f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c0217b09-9d00-46ef-b96c-9126c4c45ad3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8de14527-eba8-4970-b3c0-afc2a07cf9f3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "75195579-4159-4fd9-8e63-b21a012f35f1": { + "columnOrder": [ + "4029833c-aa57-4be8-8f89-0edeca495820", + "384dee03-99e5-4071-a216-3b25baeb4bfb", + "65d465dc-9baf-4582-82f3-bff2c85868db" + ], + "columns": { + "384dee03-99e5-4071-a216-3b25baeb4bfb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "destination.geo.country_name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "65d465dc-9baf-4582-82f3-bff2c85868db", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_name" + }, + "4029833c-aa57-4be8-8f89-0edeca495820": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Firewall - Destination Heatmap", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "65d465dc-9baf-4582-82f3-bff2c85868db": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c0217b09-9d00-46ef-b96c-9126c4c45ad3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "8de14527-eba8-4970-b3c0-afc2a07cf9f3", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "heatmap_grid" + }, + "layerId": "75195579-4159-4fd9-8e63-b21a012f35f1", + "layerType": "data", + "legend": { + "position": "right", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "65d465dc-9baf-4582-82f3-bff2c85868db", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#006837", + "stop": 0 + }, + { + "color": "#1E974F", + "stop": 10 + }, + { + "color": "#65BC62", + "stop": 20 + }, + { + "color": "#A5D96B", + "stop": 30 + }, + { + "color": "#D8EF8C", + "stop": 40 + }, + { + "color": "#FEFEBD", + "stop": 50 + }, + { + "color": "#FEDF8B", + "stop": 60 + }, + { + "color": "#FDAD61", + "stop": 70 + }, + { + "color": "#F36D43", + "stop": 80 + }, + { + "color": "#D63129", + "stop": 90 + } + ], + "continuity": "none", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": 100, + "rangeMin": 0, + "rangeType": "percent", + "reverse": false, + "stops": [ + { + "color": "#006837", + "stop": 10 + }, + { + "color": "#1E974F", + "stop": 20 + }, + { + "color": "#65BC62", + "stop": 30 + }, + { + "color": "#A5D96B", + "stop": 40 + }, + { + "color": "#D8EF8C", + "stop": 50 + }, + { + "color": "#FEFEBD", + "stop": 60 + }, + { + "color": "#FEDF8B", + "stop": 70 + }, + { + "color": "#FDAD61", + "stop": 80 + }, + { + "color": "#F36D43", + "stop": 90 + }, + { + "color": "#D63129", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "65d465dc-9baf-4582-82f3-bff2c85868db", + "xAccessor": "4029833c-aa57-4be8-8f89-0edeca495820", + "yAccessor": "384dee03-99e5-4071-a216-3b25baeb4bfb" + } + }, + "title": "Firewall - Country Destination/Heatmap [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsHeatmap" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 21, + "i": "b5d79638-384f-411b-a5c9-0d5aea67c08f", + "w": 24, + "x": 0, + "y": 60 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Firewall - Events by Interface", - "field": "observer.ingress.interface.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 14, - "i": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772", - "w": 15, - "x": 33, - "y": 14 - }, - "panelIndex": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall - Network Transport/Time [pfSense]", - "description": "Events over type based on network transport type", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "row": true, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] + "panelIndex": "b5d79638-384f-411b-a5c9-0d5aea67c08f", + "title": "Firewall - Country Destination/Heatmap [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Firewall - Network Transport/Time", - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90m", - "to": "now" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3a2865b4-350d-49cf-847f-ece2fbf67b98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e8da623f-03a8-4adb-9321-76e8acb0e717", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e20a0b3-3901-443f-a591-53705496a914", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3a2865b4-350d-49cf-847f-ece2fbf67b98": { + "columnOrder": [ + "bac3f408-557b-4e99-9392-397da1432734", + "0c5589c0-308b-439f-8857-b627712e0d14", + "573fd5b5-b28d-4dd7-a643-2dfd47f0f72f" + ], + "columns": { + "0c5589c0-308b-439f-8857-b627712e0d14": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "source.geo.country_name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "573fd5b5-b28d-4dd7-a643-2dfd47f0f72f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + }, + "573fd5b5-b28d-4dd7-a643-2dfd47f0f72f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "bac3f408-557b-4e99-9392-397da1432734": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Firewall - Source Heatmap", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "e8da623f-03a8-4adb-9321-76e8acb0e717", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0e20a0b3-3901-443f-a591-53705496a914", + "key": "event.provider", + "negate": false, + "params": { + "query": "filterlog" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "filterlog" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "gridConfig": { + "isCellLabelVisible": false, + "isXAxisLabelVisible": true, + "isXAxisTitleVisible": true, + "isYAxisLabelVisible": true, + "isYAxisTitleVisible": true, + "type": "heatmap_grid" + }, + "layerId": "3a2865b4-350d-49cf-847f-ece2fbf67b98", + "layerType": "data", + "legend": { + "position": "right", + "type": "heatmap_legend" + }, + "palette": { + "accessor": "573fd5b5-b28d-4dd7-a643-2dfd47f0f72f", + "name": "custom", + "params": { + "colorStops": [ + { + "color": "#006837", + "stop": 0 + }, + { + "color": "#1E974F", + "stop": 10 + }, + { + "color": "#65BC62", + "stop": 20 + }, + { + "color": "#A5D96B", + "stop": 30 + }, + { + "color": "#D8EF8C", + "stop": 40 + }, + { + "color": "#FEFEBD", + "stop": 50 + }, + { + "color": "#FEDF8B", + "stop": 60 + }, + { + "color": "#FDAD61", + "stop": 70 + }, + { + "color": "#F36D43", + "stop": 80 + }, + { + "color": "#D63129", + "stop": 90 + } + ], + "continuity": "none", + "maxSteps": 5, + "name": "custom", + "progression": "fixed", + "rangeMax": 100, + "rangeMin": 0, + "rangeType": "percent", + "reverse": false, + "stops": [ + { + "color": "#006837", + "stop": 10 + }, + { + "color": "#1E974F", + "stop": 20 + }, + { + "color": "#65BC62", + "stop": 30 + }, + { + "color": "#A5D96B", + "stop": 40 + }, + { + "color": "#D8EF8C", + "stop": 50 + }, + { + "color": "#FEFEBD", + "stop": 60 + }, + { + "color": "#FEDF8B", + "stop": 70 + }, + { + "color": "#FDAD61", + "stop": 80 + }, + { + "color": "#F36D43", + "stop": 90 + }, + { + "color": "#D63129", + "stop": 100 + } + ] + }, + "type": "palette" + }, + "shape": "heatmap", + "valueAccessor": "573fd5b5-b28d-4dd7-a643-2dfd47f0f72f", + "xAccessor": "bac3f408-557b-4e99-9392-397da1432734", + "yAccessor": "0c5589c0-308b-439f-8857-b627712e0d14" + } + }, + "title": "Firewall - Country Source/Heatmap [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsHeatmap" }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 21, + "i": "20537b1f-8d42-4522-8f9e-8e6fbccca58a", + "w": 24, + "x": 24, + "y": 60 + }, + "panelIndex": "20537b1f-8d42-4522-8f9e-8e6fbccca58a", + "title": "Firewall - Country Source/Heatmap [pfSense]", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "Firewall - Dashboard [pfSense]", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T11:10:28.454Z", + "id": "pfsense-bdb33ee0-3a8e-11eb-96b2-e765737b7534", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b:indexpattern-datasource-layer-a03bd2de-e7a0-4b9e-948f-2e1d1bb589fa", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a", - "w": 33, - "x": 0, - "y": 28 + { + "id": "logs-*", + "name": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b:a39305d6-cd33-4ebe-8ead-3ebe203a8266", + "type": "index-pattern" }, - "panelIndex": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall - Network Transport [pfSense]", - "description": "Network transport pie chart", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "row": true, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Firewall - Network Transport", - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b:ed423989-3f2d-47c7-a5c9-61e7c0f9ae54", + "type": "index-pattern" }, - "gridData": { - "h": 15, - "i": "60b4467b-8227-41de-b5ec-00c860793819", - "w": 15, - "x": 33, - "y": 28 + { + "id": "logs-*", + "name": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc:indexpattern-datasource-layer-d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", + "type": "index-pattern" }, - "panelIndex": "60b4467b-8227-41de-b5ec-00c860793819", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "columns": [ - "observer.name", - "observer.ingress.vlan.id", - "source.ip", - "source.port", - "destination.ip", - "destination.port", - "rule.id", - "event.action" - ], - "enhancements": {} + { + "id": "logs-*", + "name": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc:219f9c72-072a-4b9d-bebf-f17292f1a4f5", + "type": "index-pattern" }, - "gridData": { - "h": 13, - "i": "290350f0-e295-4441-8228-2f7c74fc8a0c", - "w": 48, - "x": 0, - "y": 43 + { + "id": "logs-*", + "name": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc:ae8ac200-f288-4b65-8837-ad551dd8b596", + "type": "index-pattern" }, - "panelIndex": "290350f0-e295-4441-8228-2f7c74fc8a0c", - "panelRefName": "panel_9", - "version": "7.11.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": null, - "savedVis": { - "title": "Firewall - Country Destination/Heatmap [pfSense]", - "description": "Heatmap of destination countries", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Green to Red", - "colorsNumber": 10, - "colorsRange": [], - "enableHover": false, - "invertColors": false, - "legendPosition": "right", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ] - }, - "type": "heatmap", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Firewall - Destination Heatmap", - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90m", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "destination.geo.country_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772:indexpattern-datasource-layer-7cf9efe7-b252-4ff0-a6b1-979dc50751d1", + "type": "index-pattern" }, - "gridData": { - "h": 21, - "i": "b5d79638-384f-411b-a5c9-0d5aea67c08f", - "w": 24, - "x": 0, - "y": 56 + { + "id": "logs-*", + "name": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772:fd0da016-ba0b-49e9-bd9d-8cdc278f21b2", + "type": "index-pattern" }, - "panelIndex": "b5d79638-384f-411b-a5c9-0d5aea67c08f", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "vis": null, - "savedVis": { - "title": "Firewall - Country Source/Heatmap [pfSense]", - "description": "Heatmap of source countries", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "colorSchema": "Green to Red", - "colorsNumber": 10, - "colorsRange": [], - "enableHover": false, - "invertColors": false, - "legendPosition": "right", - "percentageMode": false, - "setColorRange": false, - "times": [], - "type": "heatmap", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "color": "black", - "overwriteColor": false, - "rotate": 0, - "show": false - }, - "scale": { - "defaultYExtents": false, - "type": "linear" - }, - "show": false, - "type": "value" - } - ] - }, - "type": "heatmap", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Firewall - Source Heatmap", - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-90m", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "source.geo.country_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772:3832ba27-ac50-4ae3-bcf8-6cfc756ee827", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c2fbea99-8684-446a-a570-48bcbb9f1c39:indexpattern-datasource-layer-25e5682a-0461-46dc-aa0a-7ad4cec0eade", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c2fbea99-8684-446a-a570-48bcbb9f1c39:c4a2f4c9-afff-4529-96d5-362305575839", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c2fbea99-8684-446a-a570-48bcbb9f1c39:1291a28a-0b60-424d-a2aa-3669a1efdf1b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60b4467b-8227-41de-b5ec-00c860793819:indexpattern-datasource-layer-05d878bc-ee96-495b-9be4-bef38684ca83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60b4467b-8227-41de-b5ec-00c860793819:c7e1dbc1-e0e3-4bad-b627-9f22f1fe5515", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60b4467b-8227-41de-b5ec-00c860793819:7538c1fb-cec8-4354-aa25-576fe2b9f328", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a:indexpattern-datasource-layer-9faf4a53-ecf9-4327-9131-dac543552dda", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a:11667108-805a-43e8-9c80-63ccca2cb485", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a:5ddc2d89-5d83-42fe-baad-7ae83eb629b3", + "type": "index-pattern" + }, + { + "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534", + "name": "290350f0-e295-4441-8228-2f7c74fc8a0c:panel_290350f0-e295-4441-8228-2f7c74fc8a0c", + "type": "search" + }, + { + "id": "logs-*", + "name": "b5d79638-384f-411b-a5c9-0d5aea67c08f:indexpattern-datasource-layer-75195579-4159-4fd9-8e63-b21a012f35f1", + "type": "index-pattern" }, - "gridData": { - "h": 21, - "i": "20537b1f-8d42-4522-8f9e-8e6fbccca58a", - "w": 24, - "x": 24, - "y": 56 + { + "id": "logs-*", + "name": "b5d79638-384f-411b-a5c9-0d5aea67c08f:c0217b09-9d00-46ef-b96c-9126c4c45ad3", + "type": "index-pattern" }, - "panelIndex": "20537b1f-8d42-4522-8f9e-8e6fbccca58a", - "version": "8.0.0", - "type": "visualization" - } + { + "id": "logs-*", + "name": "b5d79638-384f-411b-a5c9-0d5aea67c08f:8de14527-eba8-4970-b3c0-afc2a07cf9f3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20537b1f-8d42-4522-8f9e-8e6fbccca58a:indexpattern-datasource-layer-3a2865b4-350d-49cf-847f-ece2fbf67b98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20537b1f-8d42-4522-8f9e-8e6fbccca58a:e8da623f-03a8-4adb-9321-76e8acb0e717", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20537b1f-8d42-4522-8f9e-8e6fbccca58a:0e20a0b3-3901-443f-a591-53705496a914", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_3845ebe2-e58d-4b6a-9432-dc94fa9c5c00:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_1804d6fc-9923-4a67-8976-caeea656cb66:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_4b3a57df-9e9a-493c-b6f2-8f4d6626702e:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "Firewall - Dashboard [pfSense]", - "version": 1 - }, - "references": [ - { - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534", - "name": "panel_9", - "type": "search" - }, - { - "type": "search", - "name": "e0fb8e49-4af8-4958-9d55-8db1ed6cad2b:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - }, - { - "type": "index-pattern", - "name": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "82ed451e-8ee1-41a5-9aea-ffbd723c86cc:indexpattern-datasource-layer-d77ab0e4-c2c2-4fb4-bd98-63c13ade7778", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "d2c26a96-ad50-4155-a67e-b6559246c302:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "d2c26a96-ad50-4155-a67e-b6559246c302:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "9db410fe-e1b3-46d1-9e9b-828f3cec05dd:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "9db410fe-e1b3-46d1-9e9b-828f3cec05dd:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "20a6aca9-2a7c-4b4a-8bd4-f2e9ae5d6249:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "20a6aca9-2a7c-4b4a-8bd4-f2e9ae5d6249:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "c2fbea99-8684-446a-a570-48bcbb9f1c39:indexpattern-datasource-current-indexpattern", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "c2fbea99-8684-446a-a570-48bcbb9f1c39:indexpattern-datasource-layer-25e5682a-0461-46dc-aa0a-7ad4cec0eade", - "id": "logs-*" - }, - { - "type": "search", - "name": "f4ceeef3-255f-4a1d-85f3-0635aa6a0772:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "a49d8775-3fc1-4b7b-8e8b-26c9e8705b6a:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "60b4467b-8227-41de-b5ec-00c860793819:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "b5d79638-384f-411b-a5c9-0d5aea67c08f:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "20537b1f-8d42-4522-8f9e-8e6fbccca58a:search_0", - "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/pfsense/kibana/dashboard/pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534.json b/packages/pfsense/kibana/dashboard/pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534.json index 7021877e467..73b24a4ffad 100644 --- a/packages/pfsense/kibana/dashboard/pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534.json +++ b/packages/pfsense/kibana/dashboard/pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534.json @@ -1,833 +1,1147 @@ { - "id": "pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-22T19:59:25.821Z", - "version": "WzY1NiwxXQ==", - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - IP/MAC Flow [pfSense]", - "description": "", - "uiState": {}, - "params": { - "spec": "{\n $schema: https://vega.github.io/schema/vega/v3.0.json\n data: [\n {\n // query ES based on the currently selected time range and filter string\n name: rawData\n url: {\n %context%: true\n %timefield%: @timestamp\n index: logs-*\n body: {\n size: 0\n aggs: {\n table: {\n composite: {\n size: 10000\n sources: [\n {\n stk1: {\n terms: {field: \"client.ip\"}\n }\n }\n {\n stk2: {\n terms: {field: \"client.mac\"}\n }\n }\n ]\n }\n }\n }\n }\n }\n // From the result, take just the data we are interested in\n format: {property: \"aggregations.table.buckets\"}\n // Convert key.stk1 -> stk1 for simpler access below\n transform: [\n {type: \"formula\", expr: \"datum.key.stk1\", as: \"stk1\"}\n {type: \"formula\", expr: \"datum.key.stk2\", as: \"stk2\"}\n {type: \"formula\", expr: \"datum.doc_count\", as: \"size\"}\n ]\n }\n {\n name: nodes\n source: rawData\n transform: [\n // when a country is selected, filter out unrelated data\n {\n type: filter\n expr: !groupSelector || groupSelector.stk1 == datum.stk1 || groupSelector.stk2 == datum.stk2\n }\n // Set new key for later lookups - identifies each node\n {type: \"formula\", expr: \"datum.stk1+datum.stk2\", as: \"key\"}\n // instead of each table row, create two new rows,\n // one for the source (stack=stk1) and one for destination node (stack=stk2).\n // The country code stored in stk1 and stk2 fields is placed into grpId field.\n {\n type: fold\n fields: [\"stk1\", \"stk2\"]\n as: [\"stack\", \"grpId\"]\n }\n // Create a sortkey, different for stk1 and stk2 stacks.\n // Space separator ensures proper sort order in some corner cases.\n {\n type: formula\n expr: datum.stack == 'stk1' ? datum.stk1+' '+datum.stk2 : datum.stk2+' '+datum.stk1\n as: sortField\n }\n // Calculate y0 and y1 positions for stacking nodes one on top of the other,\n // independently for each stack, and ensuring they are in the proper order,\n // alphabetical from the top (reversed on the y axis)\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"sortField\", order: \"descending\"}\n field: size\n }\n // calculate vertical center point for each node, used to draw edges\n {type: \"formula\", expr: \"(datum.y0+datum.y1)/2\", as: \"yc\"}\n ]\n }\n {\n name: groups\n source: nodes\n transform: [\n // combine all nodes into country groups, summing up the doc counts\n {\n type: aggregate\n groupby: [\"stack\", \"grpId\"]\n fields: [\"size\"]\n ops: [\"sum\"]\n as: [\"total\"]\n }\n // re-calculate the stacking y0,y1 values\n {\n type: stack\n groupby: [\"stack\"]\n sort: {field: \"grpId\", order: \"descending\"}\n field: total\n }\n // project y0 and y1 values to screen coordinates\n // doing it once here instead of doing it several times in marks\n {type: \"formula\", expr: \"scale('y', datum.y0)\", as: \"scaledY0\"}\n {type: \"formula\", expr: \"scale('y', datum.y1)\", as: \"scaledY1\"}\n // boolean flag if the label should be on the right of the stack\n {type: \"formula\", expr: \"datum.stack == 'stk1'\", as: \"rightLabel\"}\n // Calculate traffic percentage for this country using \"y\" scale\n // domain upper bound, which represents the total traffic\n {\n type: formula\n expr: datum.total/domain('y')[1]\n as: percentage\n }\n ]\n }\n {\n // This is a temp lookup table with all the 'stk2' stack nodes\n name: destinationNodes\n source: nodes\n transform: [\n {type: \"filter\", expr: \"datum.stack == 'stk2'\"}\n ]\n }\n {\n name: edges\n source: nodes\n transform: [\n // we only want nodes from the left stack\n {type: \"filter\", expr: \"datum.stack == 'stk1'\"}\n // find corresponding node from the right stack, keep it as \"target\"\n {\n type: lookup\n from: destinationNodes\n key: key\n fields: [\"key\"]\n as: [\"target\"]\n }\n // calculate SVG link path between stk1 and stk2 stacks for the node pair\n {\n type: linkpath\n orient: horizontal\n shape: diagonal\n sourceY: {expr: \"scale('y', datum.yc)\"}\n sourceX: {expr: \"scale('x', 'stk1') + bandwidth('x')\"}\n targetY: {expr: \"scale('y', datum.target.yc)\"}\n targetX: {expr: \"scale('x', 'stk2')\"}\n }\n // A little trick to calculate the thickness of the line.\n // The value needs to be the same as the hight of the node, but scaling\n // size to screen's height gives inversed value because screen's Y\n // coordinate goes from the top to the bottom, whereas the graph's Y=0\n // is at the bottom. So subtracting scaled doc count from screen height\n // (which is the \"lower\" bound of the \"y\" scale) gives us the right value\n {\n type: formula\n expr: range('y')[0]-scale('y', datum.size)\n as: strokeWidth\n }\n // Tooltip needs individual link's percentage of all traffic\n {\n type: formula\n expr: datum.size/domain('y')[1]\n as: percentage\n }\n ]\n }\n ]\n scales: [\n {\n // calculates horizontal stack positioning\n name: x\n type: band\n range: width\n domain: [\"stk1\", \"stk2\"]\n paddingOuter: 0.05\n paddingInner: 0.95\n }\n {\n // this scale goes up as high as the highest y1 value of all nodes\n name: y\n type: linear\n range: height\n domain: {data: \"nodes\", field: \"y1\"}\n }\n {\n // use rawData to ensure the colors stay the same when clicking.\n name: color\n type: ordinal\n range: category\n domain: {data: \"rawData\", fields: [\"stk1\", \"stk2\"]}\n }\n {\n // this scale is used to map internal ids (stk1, stk2) to stack names\n name: stackNames\n type: ordinal\n range: [\"Source\", \"Destination\"]\n domain: [\"stk1\", \"stk2\"]\n }\n ]\n axes: [\n {\n // x axis should use custom label formatting to print proper stack names\n orient: bottom\n scale: x\n encode: {\n labels: {\n update: {\n text: {scale: \"stackNames\", field: \"value\"}\n }\n }\n }\n }\n {orient: \"left\", scale: \"y\"}\n ]\n marks: [\n {\n // draw the connecting line between stacks\n type: path\n name: edgeMark\n from: {data: \"edges\"}\n // this prevents some autosizing issues with large strokeWidth for paths\n clip: true\n encode: {\n update: {\n // By default use color of the left node, except when showing traffic\n // from just one country, in which case use destination color.\n stroke: [\n {\n test: groupSelector && groupSelector.stack=='stk1'\n scale: color\n field: stk2\n }\n {scale: \"color\", field: \"stk1\"}\n ]\n strokeWidth: {field: \"strokeWidth\"}\n path: {field: \"path\"}\n // when showing all traffic, and hovering over a country,\n // highlight the traffic from that country.\n strokeOpacity: {\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 0.9 : 0.3\n }\n // Ensure that the hover-selected edges show on top\n zindex: {\n signal: !groupSelector && (groupHover.stk1 == datum.stk1 || groupHover.stk2 == datum.stk2) ? 1 : 0\n }\n // format tooltip string\n tooltip: {\n signal: datum.stk1 + ' → ' + datum.stk2 + ' ' + format(datum.size, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n // Simple mouseover highlighting of a single line\n hover: {\n strokeOpacity: {value: 1}\n }\n }\n }\n {\n // draw stack groups (countries)\n type: rect\n name: groupMark\n from: {data: \"groups\"}\n encode: {\n enter: {\n fill: {scale: \"color\", field: \"grpId\"}\n width: {scale: \"x\", band: 1}\n }\n update: {\n x: {scale: \"x\", field: \"stack\"}\n y: {field: \"scaledY0\"}\n y2: {field: \"scaledY1\"}\n fillOpacity: {value: 0.6}\n tooltip: {\n signal: datum.grpId + ' ' + format(datum.total, ',.0f') + ' (' + format(datum.percentage, '.1%') + ')'\n }\n }\n hover: {\n fillOpacity: {value: 1}\n }\n }\n }\n {\n // draw country code labels on the inner side of the stack\n type: text\n from: {data: \"groups\"}\n // don't process events for the labels - otherwise line mouseover is unclean\n interactive: false\n encode: {\n update: {\n // depending on which stack it is, position x with some padding\n x: {\n signal: scale('x', datum.stack) + (datum.rightLabel ? bandwidth('x') + 8 : -8)\n }\n // middle of the group\n yc: {signal: \"(datum.scaledY0 + datum.scaledY1)/2\"}\n align: {signal: \"datum.rightLabel ? 'left' : 'right'\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n // only show text label if the group's height is large enough\n text: {signal: \"abs(datum.scaledY0-datum.scaledY1) > 13 ? datum.grpId : ''\"}\n }\n }\n }\n {\n // Create a \"show all\" button. Shown only when a country is selected.\n type: group\n data: [\n // We need to make the button show only when groupSelector signal is true.\n // Each mark is drawn as many times as there are elements in the backing data.\n // Which means that if values list is empty, it will not be drawn.\n // Here I create a data source with one empty object, and filter that list\n // based on the signal value. This can only be done in a group.\n {\n name: dataForShowAll\n values: [{}]\n transform: [{type: \"filter\", expr: \"groupSelector\"}]\n }\n ]\n // Set button size and positioning\n encode: {\n enter: {\n xc: {signal: \"width/2\"}\n y: {value: 30}\n width: {value: 80}\n height: {value: 30}\n }\n }\n marks: [\n {\n // This group is shown as a button with rounded corners.\n type: group\n // mark name allows signal capturing\n name: groupReset\n // Only shows button if dataForShowAll has values.\n from: {data: \"dataForShowAll\"}\n encode: {\n enter: {\n cornerRadius: {value: 6}\n fill: {value: \"#f5f5f5\"}\n stroke: {value: \"#c1c1c1\"}\n strokeWidth: {value: 2}\n // use parent group's size\n height: {\n field: {group: \"height\"}\n }\n width: {\n field: {group: \"width\"}\n }\n }\n update: {\n // groups are transparent by default\n opacity: {value: 1}\n }\n hover: {\n opacity: {value: 0.7}\n }\n }\n marks: [\n {\n type: text\n // if true, it will prevent clicking on the button when over text.\n interactive: false\n encode: {\n enter: {\n // center text in the paren group\n xc: {\n field: {group: \"width\"}\n mult: 0.5\n }\n yc: {\n field: {group: \"height\"}\n mult: 0.5\n offset: 2\n }\n align: {value: \"center\"}\n baseline: {value: \"middle\"}\n fontWeight: {value: \"bold\"}\n text: {value: \"Show All\"}\n }\n }\n }\n ]\n }\n ]\n }\n ]\n signals: [\n {\n // used to highlight traffic to/from the same country\n name: groupHover\n value: {}\n on: [\n {\n events: @groupMark:mouseover\n update: \"{stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\n }\n {events: \"mouseout\", update: \"{}\"}\n ]\n }\n // used to filter only the data related to the selected country\n {\n name: groupSelector\n value: false\n on: [\n {\n // Clicking groupMark sets this signal to the filter values\n events: @groupMark:click!\n update: \"{stack:datum.stack, stk1:datum.stack=='stk1' && datum.grpId, stk2:datum.stack=='stk2' && datum.grpId}\"\n }\n {\n // Clicking \"show all\" button, or double-clicking anywhere resets it\n events: [\n {type: \"click\", markname: \"groupReset\"}\n {type: \"dblclick\"}\n ]\n update: \"false\"\n }\n ]\n }\n ]\n}" - }, - "type": "vega", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"130bfb45-3861-4282-a781-382a13943729\":{\"type\":\"optionsListControl\",\"order\":1,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"130bfb45-3861-4282-a781-382a13943729\",\"fieldName\":\"observer.ingress.interface.name\",\"title\":\"Interface Selector\",\"enhancements\":{}}},\"38600bff-7815-42cc-b97c-2c5f17ac42f8\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":true,\"width\":\"medium\",\"explicitInput\":{\"id\":\"38600bff-7815-42cc-b97c-2c5f17ac42f8\",\"fieldName\":\"observer.name\",\"title\":\"Firewall Selector\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 22, - "i": "2b46d706-0288-4541-8880-ccb2efeeee92", - "w": 35, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "2b46d706-0288-4541-8880-ccb2efeeee92", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Interface Selector [pfSense]", - "description": "Select by interface alias", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "observer.ingress.interface.name", - "id": "1607565832669", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Interface Selector", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false - }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-45bdb0c0-2347-43fd-8af8-8709ebeb97e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f5b3f8c0-176b-47b1-bc50-6e7eaa19440c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9341e478-b986-4a1b-a248-4127dd01fe5e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "45bdb0c0-2347-43fd-8af8-8709ebeb97e3": { + "columnOrder": [ + "ad9a92b9-ebc6-4682-ab2b-7a5040ade065", + "5b347f11-7f56-465a-874a-753cbea4feeb" + ], + "columns": { + "5b347f11-7f56-465a-874a-753cbea4feeb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ad9a92b9-ebc6-4682-ab2b-7a5040ade065": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "observer.ingress.interface.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5b347f11-7f56-465a-874a-753cbea4feeb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "observer.ingress.interface.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "f5b3f8c0-176b-47b1-bc50-6e7eaa19440c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9341e478-b986-4a1b-a248-4127dd01fe5e", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcpd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcpd" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "45bdb0c0-2347-43fd-8af8-8709ebeb97e3", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "5b347f11-7f56-465a-874a-753cbea4feeb" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ad9a92b9-ebc6-4682-ab2b-7a5040ade065" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "DHCP - Interface [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8", + "w": 16, + "x": 0, + "y": 0 + }, + "panelIndex": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8", + "title": "DHCP - Interface [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d3848bc1-4b08-4ec5-8cb3-54a6516871f6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "afb6e6ee-2e1e-48f9-9805-b4020ce2ec94", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "38d66bc6-e47c-45db-9780-72caa2ce918c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d3848bc1-4b08-4ec5-8cb3-54a6516871f6": { + "columnOrder": [ + "450886f5-03c2-4887-be18-86c582997c6f", + "69d34bc0-1787-4e87-a1e2-b390b82af508" + ], + "columns": { + "450886f5-03c2-4887-be18-86c582997c6f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "69d34bc0-1787-4e87-a1e2-b390b82af508", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "69d34bc0-1787-4e87-a1e2-b390b82af508": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "afb6e6ee-2e1e-48f9-9805-b4020ce2ec94", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "38d66bc6-e47c-45db-9780-72caa2ce918c", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcpd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcpd" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "d3848bc1-4b08-4ec5-8cb3-54a6516871f6", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "69d34bc0-1787-4e87-a1e2-b390b82af508" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "450886f5-03c2-4887-be18-86c582997c6f" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "DHCP - Operation [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 7, - "i": "6018121a-9303-4c73-9c96-d23362cdc74d", - "w": 13, - "x": 35, - "y": 0 - }, - "panelIndex": "6018121a-9303-4c73-9c96-d23362cdc74d", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Firewall Selector [pfSense]", - "description": "", - "uiState": {}, - "params": { - "controls": [ - { - "fieldName": "observer.name", - "id": "1613404486264", - "indexPatternRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "label": "Firewall Selector", - "options": { - "dynamicOptions": true, - "multiselect": true, - "order": "desc", - "size": 5, - "type": "terms" - }, - "parent": "", - "type": "list" - } - ], - "pinFilters": false, - "updateFiltersOnChange": false, - "useTimeFilter": false + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "5b500115-4722-432b-8d67-38b1a948c1d5", + "w": 16, + "x": 16, + "y": 0 + }, + "panelIndex": "5b500115-4722-432b-8d67-38b1a948c1d5", + "title": "DHCP - Operation [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b700aa60-cd1b-4c58-ac7c-1b1b4b5c8ea4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1e4c56d0-991d-4b2d-ab1a-c86f089d8056", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8a0702a-9c31-4ac8-be39-0f752ff7317e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b700aa60-cd1b-4c58-ac7c-1b1b4b5c8ea4": { + "columnOrder": [ + "877083f9-84a9-4188-b44e-8ef47573571e", + "f359d4ca-fc2a-4b49-b3cd-8604a45b0d22" + ], + "columns": { + "877083f9-84a9-4188-b44e-8ef47573571e": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "client.ip: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f359d4ca-fc2a-4b49-b3cd-8604a45b0d22", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "f359d4ca-fc2a-4b49-b3cd-8604a45b0d22": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1e4c56d0-991d-4b2d-ab1a-c86f089d8056", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a8a0702a-9c31-4ac8-be39-0f752ff7317e", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcpd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcpd" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "b700aa60-cd1b-4c58-ac7c-1b1b4b5c8ea4", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "f359d4ca-fc2a-4b49-b3cd-8604a45b0d22" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "877083f9-84a9-4188-b44e-8ef47573571e" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "DHCP - Client IP [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "pfsense.log" - }, - "type": "phrase" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "aa85065f-1b07-468c-b264-1231b59be97b", + "w": 16, + "x": 32, + "y": 0 + }, + "panelIndex": "aa85065f-1b07-468c-b264-1231b59be97b", + "title": "DHCP - Client IP [pfSense]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e861b9dd-91d6-437a-87a2-4e441953300d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91406e0f-7b43-4abd-8df9-52dffd2647bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "818e3694-4664-463a-89f8-184833cd42e6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e861b9dd-91d6-437a-87a2-4e441953300d": { + "columnOrder": [ + "6d99dd38-1f00-42f9-9905-c86150041d45", + "d5e6b051-8e61-45e0-837a-34bd2beb0829", + "6b471f1b-d0f8-4cad-8757-d312730bdbb1" + ], + "columns": { + "6b471f1b-d0f8-4cad-8757-d312730bdbb1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "6d99dd38-1f00-42f9-9905-c86150041d45": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d5e6b051-8e61-45e0-837a-34bd2beb0829": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6b471f1b-d0f8-4cad-8757-d312730bdbb1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "91406e0f-7b43-4abd-8df9-52dffd2647bf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "818e3694-4664-463a-89f8-184833cd42e6", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcpd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcpd" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "6b471f1b-d0f8-4cad-8757-d312730bdbb1" + ], + "isHistogram": true, + "layerId": "e861b9dd-91d6-437a-87a2-4e441953300d", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "d5e6b051-8e61-45e0-837a-34bd2beb0829", + "xAccessor": "6d99dd38-1f00-42f9-9905-c86150041d45", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "6b471f1b-d0f8-4cad-8757-d312730bdbb1" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "DHCP - Operation/Time [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsXY" }, - "query": { - "match_phrase": { - "data_stream.dataset": "pfsense.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 7, - "i": "b7f79d47-95a2-4bfd-8f8f-4d6dc56ac082", - "w": 13, - "x": 35, - "y": 7 - }, - "panelIndex": "b7f79d47-95a2-4bfd-8f8f-4d6dc56ac082", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - Interface [pfSense]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "20e8c75c-3e93-42ab-b5c5-6ad814b64151", + "w": 48, + "x": 0, + "y": 14 + }, + "panelIndex": "20e8c75c-3e93-42ab-b5c5-6ad814b64151", + "title": "DHCP - Operation/Time [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-956b86d3-945b-479a-bc72-d526baaff6a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b1ca9da6-dd33-4bbb-9086-898ccddcf74b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fce8a5cd-947c-4bb1-bab7-6a768af9d7b6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "956b86d3-945b-479a-bc72-d526baaff6a6": { + "columnOrder": [ + "4ac0b2d2-c2bd-4ed1-9150-dc617a046d87", + "4870d658-8e91-426d-9283-399353ca7c31", + "9251c0d8-9c47-4d25-88dd-7a42ba1fc52d" + ], + "columns": { + "4870d658-8e91-426d-9283-399353ca7c31": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "client.ip: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9251c0d8-9c47-4d25-88dd-7a42ba1fc52d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "4ac0b2d2-c2bd-4ed1-9150-dc617a046d87": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9251c0d8-9c47-4d25-88dd-7a42ba1fc52d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b1ca9da6-dd33-4bbb-9086-898ccddcf74b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "pfsense.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "pfsense.log" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fce8a5cd-947c-4bb1-bab7-6a768af9d7b6", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcpd" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcpd" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "9251c0d8-9c47-4d25-88dd-7a42ba1fc52d" + ], + "isHistogram": true, + "layerId": "956b86d3-945b-479a-bc72-d526baaff6a6", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "4870d658-8e91-426d-9283-399353ca7c31", + "xAccessor": "4ac0b2d2-c2bd-4ed1-9150-dc617a046d87", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "9251c0d8-9c47-4d25-88dd-7a42ba1fc52d" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "DHCP - Client IP/Time [pfSense] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "observer.ingress.interface.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 8, - "i": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8", - "w": 13, - "x": 35, - "y": 14 - }, - "panelIndex": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - Operation/Time [pfSense]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] + "gridData": { + "h": 14, + "i": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5", + "w": 48, + "x": 0, + "y": 29 + }, + "panelIndex": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5", + "title": "DHCP - Client IP/Time [pfSense]", + "type": "lens", + "version": "8.7.1" }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "columns": [ + "observer.name", + "observer.ingress.interface.name", + "event.action", + "client.ip", + "client.mac", + "pfsense.dhcp.hostname" + ], + "enhancements": {} }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-12h", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "gridData": { + "h": 17, + "i": "73ea92c6-7373-4121-a255-1ed2e43010c1", + "w": 48, + "x": 0, + "y": 43 }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "panelIndex": "73ea92c6-7373-4121-a255-1ed2e43010c1", + "panelRefName": "panel_73ea92c6-7373-4121-a255-1ed2e43010c1", + "type": "search", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "DHCP - Dashboard [pfSense]", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T12:28:22.005Z", + "id": "pfsense-c8b42350-3a9c-11eb-96b2-e765737b7534", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8:indexpattern-datasource-layer-45bdb0c0-2347-43fd-8af8-8709ebeb97e3", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "20e8c75c-3e93-42ab-b5c5-6ad814b64151", - "w": 32, - "x": 0, - "y": 22 + { + "id": "logs-*", + "name": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8:f5b3f8c0-176b-47b1-bc50-6e7eaa19440c", + "type": "index-pattern" }, - "panelIndex": "20e8c75c-3e93-42ab-b5c5-6ad814b64151", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - Operation [pfSense]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8:9341e478-b986-4a1b-a248-4127dd01fe5e", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "5b500115-4722-432b-8d67-38b1a948c1d5", - "w": 16, - "x": 32, - "y": 22 + { + "id": "logs-*", + "name": "5b500115-4722-432b-8d67-38b1a948c1d5:indexpattern-datasource-layer-d3848bc1-4b08-4ec5-8cb3-54a6516871f6", + "type": "index-pattern" }, - "panelIndex": "5b500115-4722-432b-8d67-38b1a948c1d5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - Client IP [pfSense]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 15 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "5b500115-4722-432b-8d67-38b1a948c1d5:afb6e6ee-2e1e-48f9-9805-b4020ce2ec94", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "aa85065f-1b07-468c-b264-1231b59be97b", - "w": 16, - "x": 0, - "y": 36 + { + "id": "logs-*", + "name": "5b500115-4722-432b-8d67-38b1a948c1d5:38d66bc6-e47c-45db-9780-72caa2ce918c", + "type": "index-pattern" }, - "panelIndex": "aa85065f-1b07-468c-b264-1231b59be97b", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "DHCP - Client IP/Time [pfSense]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-7h", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "client.ip", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "aa85065f-1b07-468c-b264-1231b59be97b:indexpattern-datasource-layer-b700aa60-cd1b-4c58-ac7c-1b1b4b5c8ea4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa85065f-1b07-468c-b264-1231b59be97b:1e4c56d0-991d-4b2d-ab1a-c86f089d8056", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa85065f-1b07-468c-b264-1231b59be97b:a8a0702a-9c31-4ac8-be39-0f752ff7317e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20e8c75c-3e93-42ab-b5c5-6ad814b64151:indexpattern-datasource-layer-e861b9dd-91d6-437a-87a2-4e441953300d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20e8c75c-3e93-42ab-b5c5-6ad814b64151:91406e0f-7b43-4abd-8df9-52dffd2647bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "20e8c75c-3e93-42ab-b5c5-6ad814b64151:818e3694-4664-463a-89f8-184833cd42e6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5:indexpattern-datasource-layer-956b86d3-945b-479a-bc72-d526baaff6a6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5:b1ca9da6-dd33-4bbb-9086-898ccddcf74b", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5", - "w": 32, - "x": 16, - "y": 36 + { + "id": "logs-*", + "name": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5:fce8a5cd-947c-4bb1-bab7-6a768af9d7b6", + "type": "index-pattern" }, - "panelIndex": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "columns": [ - "observer.name", - "observer.ingress.interface.name", - "event.action", - "client.ip", - "client.mac", - "pfsense.dhcp.hostname" - ], - "enhancements": {} + { + "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534", + "name": "73ea92c6-7373-4121-a255-1ed2e43010c1:panel_73ea92c6-7373-4121-a255-1ed2e43010c1", + "type": "search" }, - "gridData": { - "h": 15, - "i": "73ea92c6-7373-4121-a255-1ed2e43010c1", - "w": 48, - "x": 0, - "y": 50 + { + "id": "logs-*", + "name": "controlGroup_130bfb45-3861-4282-a781-382a13943729:optionsListDataView", + "type": "index-pattern" }, - "panelIndex": "73ea92c6-7373-4121-a255-1ed2e43010c1", - "panelRefName": "panel_73ea92c6-7373-4121-a255-1ed2e43010c1", - "type": "search", - "version": "7.10.0" - } + { + "id": "logs-*", + "name": "controlGroup_38600bff-7815-42cc-b97c-2c5f17ac42f8:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "DHCP - Dashboard [pfSense]", - "version": 1 - }, - "references": [ - { - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534", - "name": "73ea92c6-7373-4121-a255-1ed2e43010c1:panel_73ea92c6-7373-4121-a255-1ed2e43010c1", - "type": "search" - }, - { - "type": "search", - "name": "2b46d706-0288-4541-8880-ccb2efeeee92:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - }, - { - "type": "index-pattern", - "name": "6018121a-9303-4c73-9c96-d23362cdc74d:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "6018121a-9303-4c73-9c96-d23362cdc74d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "b7f79d47-95a2-4bfd-8f8f-4d6dc56ac082:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" - }, - { - "type": "index-pattern", - "name": "b7f79d47-95a2-4bfd-8f8f-4d6dc56ac082:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" - }, - { - "type": "search", - "name": "d9f98967-4e91-4eef-9a43-9caaeeebe6f8:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "20e8c75c-3e93-42ab-b5c5-6ad814b64151:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "5b500115-4722-432b-8d67-38b1a948c1d5:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "aa85065f-1b07-468c-b264-1231b59be97b:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - }, - { - "type": "search", - "name": "22ea957e-7ba8-4ce0-b5d5-ccd92cb4deb5:search_0", - "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/pfsense/kibana/search/pfsense-22edf800-3a8e-11eb-96b2-e765737b7534.json b/packages/pfsense/kibana/search/pfsense-22edf800-3a8e-11eb-96b2-e765737b7534.json index 7c4b54d6612..d6b6ca45c04 100644 --- a/packages/pfsense/kibana/search/pfsense-22edf800-3a8e-11eb-96b2-e765737b7534.json +++ b/packages/pfsense/kibana/search/pfsense-22edf800-3a8e-11eb-96b2-e765737b7534.json @@ -62,10 +62,11 @@ "title": "Firewall - Discover [pfSense]", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T10:20:39.902Z", "id": "pfsense-22edf800-3a8e-11eb-96b2-e765737b7534", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/pfsense/kibana/search/pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534.json b/packages/pfsense/kibana/search/pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534.json index 85b01262cbf..5ab60213249 100644 --- a/packages/pfsense/kibana/search/pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534.json +++ b/packages/pfsense/kibana/search/pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534.json @@ -62,10 +62,11 @@ "title": "DHCP - Discover [pfSense]", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T10:20:39.902Z", "id": "pfsense-ec91cf20-3a9c-11eb-96b2-e765737b7534", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/pfsense/kibana/search/pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4.json b/packages/pfsense/kibana/search/pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4.json index e974670f1df..2eb4b5f19f4 100644 --- a/packages/pfsense/kibana/search/pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4.json +++ b/packages/pfsense/kibana/search/pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4.json @@ -62,10 +62,11 @@ "title": "Unbound - Discover [pfSense]", "version": 1 }, - "coreMigrationVersion": "7.15.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T12:48:53.751Z", "id": "pfsense-f9ed8947-6d26-4497-905f-57d08ee304f4", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/pfsense/kibana/tags.yml b/packages/pfsense/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/pfsense/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/pfsense/manifest.yml b/packages/pfsense/manifest.yml index b5eb1da48f7..5d96954508b 100644 --- a/packages/pfsense/manifest.yml +++ b/packages/pfsense/manifest.yml @@ -1,7 +1,6 @@ name: pfsense title: pfSense -version: "1.9.1" -release: ga +version: "1.13.0" description: Collect logs from pfSense and OPNsense with Elastic Agent. type: integration icons: @@ -9,14 +8,13 @@ icons: title: pfsense size: 512x143 type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: - network - security - firewall_security conditions: - kibana.version: ^8.1.0 + kibana.version: ^8.7.1 screenshots: - src: /img/firewall.png title: pfSense Firewall Dashboard @@ -26,18 +24,10 @@ screenshots: title: pfSense DHCP Dashboard size: 2999x1640 type: image/png - - src: /img/unbound-1.png + - src: /img/unbound.png title: pfSense Unbound Dashboard size: 1680x763 type: image/png - - src: /img/unbound-2.png - title: pfSense Unbound Dashboard - size: 1679x833 - type: image/png - - src: /img/unbound-3.png - title: pfSense Unbound Dashboard - size: 1679x904 - type: image/png policy_templates: - name: pfsense title: pfSense logs diff --git a/packages/php_fpm/_dev/build/docs/README.md b/packages/php_fpm/_dev/build/docs/README.md index 4fe913bded2..8596a592dac 100644 --- a/packages/php_fpm/_dev/build/docs/README.md +++ b/packages/php_fpm/_dev/build/docs/README.md @@ -31,6 +31,100 @@ Status path configuration format: `/path` Example Status path configuration: `/status` +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Pool`` and ``Process`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> PHP-FPM -> Integration policies` open the configuration of PHP-FPM and disable the `Collect PHP-FPM metrics` toggle to reindex metrics data stream and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-php_fpm.pool-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-php_fpm.pool-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-php_fpm.pool +``` +3. Go to `Integrations -> PHP-FPM -> Settings` and click on `Reinstall PHP-FPM`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-php_fpm.pool-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> PHP-FPM -> Integration policies` and open configuration of integration and enable the `Collect PHP-FPM metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Metrics reference ### Pool diff --git a/packages/php_fpm/changelog.yml b/packages/php_fpm/changelog.yml index a0119853313..b5bc9ca8605 100644 --- a/packages/php_fpm/changelog.yml +++ b/packages/php_fpm/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "0.6.2" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "0.6.1" + changes: + - description: Add metric_type for pool and process data streams. + type: enhancement + link: https://github.com/elastic/integrations/pull/7527 +- version: "0.6.0" + changes: + - description: Add service.address field and update dashboard. + type: enhancement + link: https://github.com/elastic/integrations/pull/7523 +- version: "0.5.1" + changes: + - description: Resolve the conflict in host.ip field + type: bugfix + link: https://github.com/elastic/integrations/pull/7444 - version: "0.5.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/php_fpm/data_stream/pool/agent/stream/httpjson.yml.hbs b/packages/php_fpm/data_stream/pool/agent/stream/httpjson.yml.hbs index 208e29bfb36..7bef04563e1 100644 --- a/packages/php_fpm/data_stream/pool/agent/stream/httpjson.yml.hbs +++ b/packages/php_fpm/data_stream/pool/agent/stream/httpjson.yml.hbs @@ -18,7 +18,11 @@ tags: {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} -{{#if processors}} processors: +- add_fields: + target: service + fields: + address: {{hostname}} +{{#if processors}} {{processors}} {{/if}} diff --git a/packages/php_fpm/data_stream/pool/elasticsearch/ingest_pipeline/default.yml b/packages/php_fpm/data_stream/pool/elasticsearch/ingest_pipeline/default.yml index 417c6ac9abc..ba1156cab62 100644 --- a/packages/php_fpm/data_stream/pool/elasticsearch/ingest_pipeline/default.yml +++ b/packages/php_fpm/data_stream/pool/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/php_fpm/data_stream/pool/fields/ecs.yml b/packages/php_fpm/data_stream/pool/fields/ecs.yml index cd6e234ba91..b77e5cec16d 100644 --- a/packages/php_fpm/data_stream/pool/fields/ecs.yml +++ b/packages/php_fpm/data_stream/pool/fields/ecs.yml @@ -14,5 +14,9 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip +- external: ecs + name: service.address - external: ecs name: tags diff --git a/packages/php_fpm/data_stream/pool/fields/fields.yml b/packages/php_fpm/data_stream/pool/fields/fields.yml index dd415d25df1..c0956a8ecfd 100644 --- a/packages/php_fpm/data_stream/pool/fields/fields.yml +++ b/packages/php_fpm/data_stream/pool/fields/fields.yml @@ -49,6 +49,7 @@ - name: children_reached.max type: long description: Has the maximum number of processes ever been reached? If so the displayed value is 1 otherwise the value is 0. + metric_type: gauge - name: count type: long description: The current total number of processes. @@ -69,4 +70,3 @@ - name: start_time type: long description: The date/time that the process pool was last started. - metric_type: counter diff --git a/packages/php_fpm/data_stream/pool/sample_event.json b/packages/php_fpm/data_stream/pool/sample_event.json index 914747000d6..b98bd7feeb7 100644 --- a/packages/php_fpm/data_stream/pool/sample_event.json +++ b/packages/php_fpm/data_stream/pool/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-11-08T12:28:32.010Z", + "@timestamp": "2023-07-28T10:10:15.918Z", "agent": { - "ephemeral_id": "bc8a33f5-b8f3-4c39-a808-c0145638ed96", - "id": "97c2a1e6-10a8-4398-a12b-d8c1a6a01750", + "ephemeral_id": "9581f949-002c-4a1f-8939-abae313a3e55", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.1" + "version": "8.7.1" }, "data_stream": { "dataset": "php_fpm.pool", @@ -16,9 +16,9 @@ "version": "8.4.0" }, "elastic_agent": { - "id": "97c2a1e6-10a8-4398-a12b-d8c1a6a01750", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "snapshot": false, - "version": "8.4.1" + "version": "8.7.1" }, "event": { "agent_id_status": "verified", @@ -27,9 +27,9 @@ "configuration", "process" ], - "created": "2022-11-08T12:28:32.010Z", + "created": "2023-07-28T10:10:15.918Z", "dataset": "php_fpm.pool", - "ingested": "2022-11-08T12:28:35Z", + "ingested": "2023-07-28T10:10:19Z", "kind": "event", "module": "php_fpm", "type": [ @@ -67,10 +67,13 @@ "idle": 0 }, "slow_requests": 0, - "start_since": 22, - "start_time": 1667910490 + "start_since": 17, + "start_time": 1690538998 } }, + "service": { + "address": "http://elastic-package-service_php_fpm_1" + }, "tags": [ "php_fpm-pool", "forwarded" diff --git a/packages/php_fpm/data_stream/process/agent/stream/httpjson.yml.hbs b/packages/php_fpm/data_stream/process/agent/stream/httpjson.yml.hbs index 68bd02fc971..3fb1acf75c9 100644 --- a/packages/php_fpm/data_stream/process/agent/stream/httpjson.yml.hbs +++ b/packages/php_fpm/data_stream/process/agent/stream/httpjson.yml.hbs @@ -21,7 +21,11 @@ tags: {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} -{{#if processors}} processors: +- add_fields: + target: service + fields: + address: {{hostname}} +{{#if processors}} {{processors}} {{/if}} diff --git a/packages/php_fpm/data_stream/process/elasticsearch/ingest_pipeline/default.yml b/packages/php_fpm/data_stream/process/elasticsearch/ingest_pipeline/default.yml index 12d8020c576..dd2cb9fa617 100644 --- a/packages/php_fpm/data_stream/process/elasticsearch/ingest_pipeline/default.yml +++ b/packages/php_fpm/data_stream/process/elasticsearch/ingest_pipeline/default.yml @@ -30,7 +30,7 @@ processors: field: message target_field: event.original ignore_missing: true - ignore_failure: true + if: 'ctx.event?.original == null' - json: field: event.original target_field: json diff --git a/packages/php_fpm/data_stream/process/fields/ecs.yml b/packages/php_fpm/data_stream/process/fields/ecs.yml index 6f895e400f5..5a15ed58edb 100644 --- a/packages/php_fpm/data_stream/process/fields/ecs.yml +++ b/packages/php_fpm/data_stream/process/fields/ecs.yml @@ -14,15 +14,19 @@ name: event.module - external: ecs name: event.type +- external: ecs + name: host.ip - external: ecs name: http.request.body.bytes - external: ecs name: http.request.method - external: ecs name: process.pid +- external: ecs + name: service.address +- external: ecs + name: tags - external: ecs name: url.original - external: ecs name: user.name -- external: ecs - name: tags diff --git a/packages/php_fpm/data_stream/process/fields/fields.yml b/packages/php_fpm/data_stream/process/fields/fields.yml index ec64f1ebbe3..2f4b4e981b2 100644 --- a/packages/php_fpm/data_stream/process/fields/fields.yml +++ b/packages/php_fpm/data_stream/process/fields/fields.yml @@ -31,6 +31,7 @@ type: long description: The maximum amount of memory consumed by the last request. This will be 0 if the process is not Idle because the calculation is done when the request processing is complete. metric_type: gauge + unit: byte - name: script type: keyword description: The full path of the script executed by the last request. This will be '-' if not applicable (eg. status page requests). diff --git a/packages/php_fpm/data_stream/process/sample_event.json b/packages/php_fpm/data_stream/process/sample_event.json index a40b294b1e7..691528b994e 100644 --- a/packages/php_fpm/data_stream/process/sample_event.json +++ b/packages/php_fpm/data_stream/process/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-11-15T14:01:31.755Z", + "@timestamp": "2023-07-28T10:11:12.080Z", "agent": { - "ephemeral_id": "c505ab2b-ef2e-45aa-8ee4-998433179139", - "id": "eb39489c-ee82-4bd4-b2d3-31f09610ca2e", + "ephemeral_id": "0f5589f7-327f-468e-b368-00ada3a96721", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.1" + "version": "8.7.1" }, "data_stream": { "dataset": "php_fpm.process", @@ -16,9 +16,9 @@ "version": "8.4.0" }, "elastic_agent": { - "id": "eb39489c-ee82-4bd4-b2d3-31f09610ca2e", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "snapshot": false, - "version": "8.4.1" + "version": "8.7.1" }, "event": { "agent_id_status": "verified", @@ -27,9 +27,9 @@ "configuration", "process" ], - "created": "2022-11-15T14:01:31.755Z", + "created": "2023-07-28T10:11:12.080Z", "dataset": "php_fpm.process", - "ingested": "2022-11-15T14:01:35Z", + "ingested": "2023-07-28T10:11:15Z", "kind": "event", "module": "php_fpm", "type": [ @@ -53,8 +53,8 @@ "name": "www" }, "request": { - "count": 2, - "duration": 186, + "count": 1, + "duration": 581, "last": { "cpu": { "pct": 0 @@ -63,14 +63,17 @@ } }, "script": "-", - "start_since": 6, - "start_time": 1668520885, + "start_since": 0, + "start_time": 1690539072, "state": "Running" } }, "process": { "pid": 33 }, + "service": { + "address": "http://elastic-package-service_php_fpm_1" + }, "tags": [ "php_fpm-process", "forwarded" diff --git a/packages/php_fpm/docs/README.md b/packages/php_fpm/docs/README.md index 98587aaadbc..9a891af8f14 100644 --- a/packages/php_fpm/docs/README.md +++ b/packages/php_fpm/docs/README.md @@ -31,6 +31,100 @@ Status path configuration format: `/path` Example Status path configuration: `/status` +### Troubleshooting + +If host.ip is shown conflicted under ``logs-*`` data view, then this issue can be solved by reindexing the ``Pool`` and ``Process`` data stream's indices. +To reindex the data, the following steps must be performed. + +1. Stop the data stream by going to `Integrations -> PHP-FPM -> Integration policies` open the configuration of PHP-FPM and disable the `Collect PHP-FPM metrics` toggle to reindex metrics data stream and save the integration. + +2. Copy data into the temporary index and delete the existing data stream and index template by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "source": { + "index": "" + }, + "dest": { + "index": "temp_index" + } +} +``` +Example: +``` +POST _reindex +{ + "source": { + "index": "logs-php_fpm.pool-default" + }, + "dest": { + "index": "temp_index" + } +} +``` + +``` +DELETE /_data_stream/ +``` +Example: +``` +DELETE /_data_stream/logs-php_fpm.pool-default +``` + +``` +DELETE _index_template/ +``` +Example: +``` +DELETE _index_template/logs-php_fpm.pool +``` +3. Go to `Integrations -> PHP-FPM -> Settings` and click on `Reinstall PHP-FPM`. + +4. Copy data from temporary index to new index by performing the following steps in the Dev tools. + +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "", + "op_type": "create" + + } +} +``` +Example: +``` +POST _reindex +{ + "conflicts": "proceed", + "source": { + "index": "temp_index" + }, + "dest": { + "index": "logs-php_fpm.pool-default", + "op_type": "create" + + } +} +``` + +5. Verify data is reindexed completely. + +6. Start the data stream by going to the `Integrations -> PHP-FPM -> Integration policies` and open configuration of integration and enable the `Collect PHP-FPM metrics` toggle and save the integration. + +7. Delete temporary index by performing the following step in the Dev tools. + +``` +DELETE temp_index +``` + +More details about reindexing can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html). + ## Metrics reference ### Pool @@ -41,13 +135,13 @@ An example event for `pool` looks as following: ```json { - "@timestamp": "2022-11-08T12:28:32.010Z", + "@timestamp": "2023-07-28T10:10:15.918Z", "agent": { - "ephemeral_id": "bc8a33f5-b8f3-4c39-a808-c0145638ed96", - "id": "97c2a1e6-10a8-4398-a12b-d8c1a6a01750", + "ephemeral_id": "9581f949-002c-4a1f-8939-abae313a3e55", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.1" + "version": "8.7.1" }, "data_stream": { "dataset": "php_fpm.pool", @@ -58,9 +152,9 @@ An example event for `pool` looks as following: "version": "8.4.0" }, "elastic_agent": { - "id": "97c2a1e6-10a8-4398-a12b-d8c1a6a01750", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "snapshot": false, - "version": "8.4.1" + "version": "8.7.1" }, "event": { "agent_id_status": "verified", @@ -69,9 +163,9 @@ An example event for `pool` looks as following: "configuration", "process" ], - "created": "2022-11-08T12:28:32.010Z", + "created": "2023-07-28T10:10:15.918Z", "dataset": "php_fpm.pool", - "ingested": "2022-11-08T12:28:35Z", + "ingested": "2023-07-28T10:10:19Z", "kind": "event", "module": "php_fpm", "type": [ @@ -109,10 +203,13 @@ An example event for `pool` looks as following: "idle": 0 }, "slow_requests": 0, - "start_since": 22, - "start_time": 1667910490 + "start_since": 17, + "start_time": 1690538998 } }, + "service": { + "address": "http://elastic-package-service_php_fpm_1" + }, "tags": [ "php_fpm-pool", "forwarded" @@ -136,6 +233,7 @@ An example event for `pool` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | input.type | Type of Filebeat input. | keyword | | | | php_fpm.pool.connections.accepted | The total number of accepted connections. | long | | counter | | php_fpm.pool.connections.listen_queue.max_size | The maximum allowed size of the listen queue. | long | | gauge | @@ -145,12 +243,13 @@ An example event for `pool` looks as following: | php_fpm.pool.process_manager.type | The process manager type - static, dynamic or ondemand. | keyword | | | | php_fpm.pool.processes.active.count | The number of processes that are currently processing requests. | long | | gauge | | php_fpm.pool.processes.active.max | The maximum number of concurrently active processes. | long | | gauge | -| php_fpm.pool.processes.children_reached.max | Has the maximum number of processes ever been reached? If so the displayed value is 1 otherwise the value is 0. | long | | | +| php_fpm.pool.processes.children_reached.max | Has the maximum number of processes ever been reached? If so the displayed value is 1 otherwise the value is 0. | long | | gauge | | php_fpm.pool.processes.count | The current total number of processes. | long | | gauge | | php_fpm.pool.processes.idle | The number of processes that are currently idle (waiting for requests). | long | | gauge | | php_fpm.pool.slow_requests | The total number of requests that have hit the configured request_slowlog_timeout. | long | | counter | | php_fpm.pool.start_since | The time in seconds since the process pool was last started. | long | s | counter | -| php_fpm.pool.start_time | The date/time that the process pool was last started. | long | | counter | +| php_fpm.pool.start_time | The date/time that the process pool was last started. | long | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | @@ -162,13 +261,13 @@ An example event for `process` looks as following: ```json { - "@timestamp": "2022-11-15T14:01:31.755Z", + "@timestamp": "2023-07-28T10:11:12.080Z", "agent": { - "ephemeral_id": "c505ab2b-ef2e-45aa-8ee4-998433179139", - "id": "eb39489c-ee82-4bd4-b2d3-31f09610ca2e", + "ephemeral_id": "0f5589f7-327f-468e-b368-00ada3a96721", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.1" + "version": "8.7.1" }, "data_stream": { "dataset": "php_fpm.process", @@ -179,9 +278,9 @@ An example event for `process` looks as following: "version": "8.4.0" }, "elastic_agent": { - "id": "eb39489c-ee82-4bd4-b2d3-31f09610ca2e", + "id": "79efec86-f67c-4ca6-8a2e-a8900f9ae3ac", "snapshot": false, - "version": "8.4.1" + "version": "8.7.1" }, "event": { "agent_id_status": "verified", @@ -190,9 +289,9 @@ An example event for `process` looks as following: "configuration", "process" ], - "created": "2022-11-15T14:01:31.755Z", + "created": "2023-07-28T10:11:12.080Z", "dataset": "php_fpm.process", - "ingested": "2022-11-15T14:01:35Z", + "ingested": "2023-07-28T10:11:15Z", "kind": "event", "module": "php_fpm", "type": [ @@ -216,8 +315,8 @@ An example event for `process` looks as following: "name": "www" }, "request": { - "count": 2, - "duration": 186, + "count": 1, + "duration": 581, "last": { "cpu": { "pct": 0 @@ -226,14 +325,17 @@ An example event for `process` looks as following: } }, "script": "-", - "start_since": 6, - "start_time": 1668520885, + "start_since": 0, + "start_time": 1690539072, "state": "Running" } }, "process": { "pid": 33 }, + "service": { + "address": "http://elastic-package-service_php_fpm_1" + }, "tags": [ "php_fpm-process", "forwarded" @@ -263,6 +365,7 @@ An example event for `process` looks as following: | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | | +| host.ip | Host ip addresses. | ip | | | | http.request.body.bytes | Size in bytes of the request body. | long | | | | http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | | | | input.type | Type of Filebeat input. | keyword | | | @@ -270,12 +373,13 @@ An example event for `process` looks as following: | php_fpm.process.request.count | The total number of requests served. | long | | counter | | php_fpm.process.request.duration | The duration in microseconds of the requests. | long | micros | gauge | | php_fpm.process.request.last.cpu.pct | The %cpu of the last request. This will be 0 if the process is not Idle because the calculation is done when the request processing is complete. | long | percent | gauge | -| php_fpm.process.request.last.memory | The maximum amount of memory consumed by the last request. This will be 0 if the process is not Idle because the calculation is done when the request processing is complete. | long | | gauge | +| php_fpm.process.request.last.memory | The maximum amount of memory consumed by the last request. This will be 0 if the process is not Idle because the calculation is done when the request processing is complete. | long | byte | gauge | | php_fpm.process.script | The full path of the script executed by the last request. This will be '-' if not applicable (eg. status page requests). | keyword | | | | php_fpm.process.start_since | The number of seconds since the process started. | long | s | counter | | php_fpm.process.start_time | The date/time at which the process started. | long | | | | php_fpm.process.state | The state of the process. | keyword | | | | process.pid | Process id. | long | | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | | | tags | List of keywords used to tag each event. | keyword | | | | url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | | | | url.original.text | Multi-field of `url.original`. | match_only_text | | | diff --git a/packages/php_fpm/img/php_fpm-pool-dashboard.png b/packages/php_fpm/img/php_fpm-pool-dashboard.png index 3d3f88caf5d..31ccb782d2c 100644 Binary files a/packages/php_fpm/img/php_fpm-pool-dashboard.png and b/packages/php_fpm/img/php_fpm-pool-dashboard.png differ diff --git a/packages/php_fpm/img/php_fpm-process-dashboard.png b/packages/php_fpm/img/php_fpm-process-dashboard.png index d8eda91b1da..7c8f85095c1 100644 Binary files a/packages/php_fpm/img/php_fpm-process-dashboard.png and b/packages/php_fpm/img/php_fpm-process-dashboard.png differ diff --git a/packages/php_fpm/kibana/dashboard/php_fpm-30d6d490-60c6-11ed-a227-676557292b43.json b/packages/php_fpm/kibana/dashboard/php_fpm-30d6d490-60c6-11ed-a227-676557292b43.json index 10e2d5acdbf..731a5d4a7f7 100644 --- a/packages/php_fpm/kibana/dashboard/php_fpm-30d6d490-60c6-11ed-a227-676557292b43.json +++ b/packages/php_fpm/kibana/dashboard/php_fpm-30d6d490-60c6-11ed-a227-676557292b43.json @@ -1,10 +1,38 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"bfd5cccd-6939-4445-8b50-c0773cf84b47\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"bfd5cccd-6939-4445-8b50-c0773cf84b47\",\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"singleSelect\":true,\"enhancements\":{}}}}" + }, "description": "This PHP-FPM dashboard visualizes Process metrics.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "php_fpm.process" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "php_fpm.process" + } + } + } + ], "query": { "language": "kuery", "query": "" @@ -14,6 +42,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -24,125 +53,49 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", + "name": "indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", "type": "index-pattern" }, { "id": "logs-*", - "name": "973b088d-1ba7-40f2-9e9d-c911dd80272f", + "name": "b661bcca-b850-4cf2-bb56-3696825b0a62", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b": { + "d9643729-e12e-4e3d-ba08-d48da266bbce": { "columnOrder": [ - "0cabd051-9070-4043-8c10-77b2d0d58304", - "453d6177-9684-47f9-adca-085092916add", - "2bba30b0-5402-41ba-891c-5f4761c42d42", - "576c7b06-a296-4e8c-b537-00cbfa6e010c", - "559cd91e-ea35-47a2-a470-96e2a63f119c", - "7a032388-c4bb-41fd-a435-ca80476b364d", - "8fde96f6-0666-4681-bb5f-ee062616676b" + "f5cbb076-1a0e-4ea3-8470-7238c004f0da", + "72832731-0703-4df0-9ab5-c452c13cd7d3", + "769422db-6636-4226-a5f6-bdf0308e0a9a" ], "columns": { - "0cabd051-9070-4043-8c10-77b2d0d58304": { - "customLabel": true, - "dataType": "number", + "72832731-0703-4df0-9ab5-c452c13cd7d3": { + "dataType": "date", "isBucketed": true, - "label": "PID", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "2bba30b0-5402-41ba-891c-5f4761c42d42", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10000 - }, - "scale": "ordinal", - "sourceField": "process.pid" - }, - "2bba30b0-5402-41ba-891c-5f4761c42d42": { - "customLabel": true, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.process.request.count: *" - }, - "isBucketed": false, - "label": "Request count", - "operationType": "last_value", - "params": { - "sortField": "@timestamp" - }, - "scale": "ratio", - "sourceField": "php_fpm.process.request.count" - }, - "453d6177-9684-47f9-adca-085092916add": { - "customLabel": true, - "dataType": "string", - "filter": { - "language": "kuery", - "query": "php_fpm.process.state: *" - }, - "isBucketed": false, - "label": "State", - "operationType": "last_value", - "params": { - "sortField": "@timestamp" - }, - "scale": "ordinal", - "sourceField": "php_fpm.process.state" - }, - "559cd91e-ea35-47a2-a470-96e2a63f119c": { - "customLabel": true, - "dataType": "string", - "filter": { - "language": "kuery", - "query": "user.name: *" - }, - "isBucketed": false, - "label": "User name", - "operationType": "last_value", - "params": { - "sortField": "@timestamp" - }, - "scale": "ordinal", - "sourceField": "user.name" - }, - "576c7b06-a296-4e8c-b537-00cbfa6e010c": { - "customLabel": true, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.process.request.duration: *" - }, - "isBucketed": false, - "label": "Request duration (μs)", - "operationType": "last_value", + "label": "@timestamp", + "operationType": "date_histogram", "params": { - "sortField": "@timestamp" + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ratio", - "sourceField": "php_fpm.process.request.duration" + "scale": "interval", + "sourceField": "@timestamp" }, - "7a032388-c4bb-41fd-a435-ca80476b364d": { + "769422db-6636-4226-a5f6-bdf0308e0a9a": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "http.request.body.bytes: *" + "query": "php_fpm.process.request.last.memory: *" }, "isBucketed": false, - "label": "Content length", + "label": "Request memory", "operationType": "last_value", "params": { "format": { @@ -154,23 +107,28 @@ "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "http.request.body.bytes" + "sourceField": "php_fpm.process.request.last.memory" }, - "8fde96f6-0666-4681-bb5f-ee062616676b": { - "customLabel": true, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.process.request.last.memory: *" - }, - "isBucketed": false, - "label": "Request memory", - "operationType": "last_value", + "f5cbb076-1a0e-4ea3-8470-7238c004f0da": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of process.pid", + "operationType": "terms", "params": { - "sortField": "@timestamp" + "missingBucket": false, + "orderBy": { + "columnId": "769422db-6636-4226-a5f6-bdf0308e0a9a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 }, - "scale": "ratio", - "sourceField": "php_fpm.process.request.last.memory" + "scale": "ordinal", + "sourceField": "process.pid" } }, "incompleteColumns": {} @@ -186,7 +144,7 @@ "meta": { "alias": null, "disabled": false, - "index": "973b088d-1ba7-40f2-9e9d-c911dd80272f", + "index": "b661bcca-b850-4cf2-bb56-3696825b0a62", "key": "event.dataset", "negate": false, "params": { @@ -201,73 +159,74 @@ } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "columns": [ - { - "alignment": "left", - "columnId": "0cabd051-9070-4043-8c10-77b2d0d58304" - }, - { - "columnId": "453d6177-9684-47f9-adca-085092916add", - "isTransposed": false - }, - { - "alignment": "left", - "columnId": "2bba30b0-5402-41ba-891c-5f4761c42d42", - "isTransposed": false - }, - { - "alignment": "left", - "columnId": "576c7b06-a296-4e8c-b537-00cbfa6e010c", - "isTransposed": false - }, - { - "columnId": "559cd91e-ea35-47a2-a470-96e2a63f119c", - "isTransposed": false - }, - { - "alignment": "left", - "columnId": "7a032388-c4bb-41fd-a435-ca80476b364d", - "isTransposed": false - }, + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ { - "alignment": "left", - "columnId": "8fde96f6-0666-4681-bb5f-ee062616676b", - "isTransposed": false + "accessors": [ + "769422db-6636-4226-a5f6-bdf0308e0a9a" + ], + "layerId": "d9643729-e12e-4e3d-ba08-d48da266bbce", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "f5cbb076-1a0e-4ea3-8470-7238c004f0da", + "xAccessor": "72832731-0703-4df0-9ab5-c452c13cd7d3" } ], - "headerRowHeight": "auto", - "layerId": "fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", - "layerType": "data", - "paging": { - "enabled": true, - "size": 10 + "legend": { + "isVisible": true, + "position": "right" }, - "rowHeight": "auto" + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true } }, "title": "", "type": "lens", - "visualizationType": "lnsDatatable" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 14, - "i": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d", + "h": 11, + "i": "1ed5459a-d03e-4a4b-872d-faff58d014de", "w": 48, "x": 0, "y": 0 }, - "panelIndex": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d", - "title": "Statistics of processes [Metrics PHP-FPM]", + "panelIndex": "1ed5459a-d03e-4a4b-872d-faff58d014de", + "title": "Memory consumed by last request over time [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -280,70 +239,58 @@ }, { "id": "logs-*", - "name": "9c4df760-98db-4493-865e-0eca0fbf159c", + "name": "a441ec79-5e7f-433b-89a0-6bcb9690488c", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d9643729-e12e-4e3d-ba08-d48da266bbce": { "columnOrder": [ - "f5cbb076-1a0e-4ea3-8470-7238c004f0da", "72832731-0703-4df0-9ab5-c452c13cd7d3", - "769422db-6636-4226-a5f6-bdf0308e0a9a" + "35717227-37dc-47aa-bf2d-2a5dd76069a0", + "2a9fa2e5-4f93-4b00-920e-adbbffcd7668" ], "columns": { - "72832731-0703-4df0-9ab5-c452c13cd7d3": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", + "2a9fa2e5-4f93-4b00-920e-adbbffcd7668": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Maximum", + "operationType": "max", "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" + "emptyAsNull": true }, - "scale": "interval", - "sourceField": "@timestamp" + "scale": "ratio", + "sourceField": "php_fpm.process.request.count" }, - "769422db-6636-4226-a5f6-bdf0308e0a9a": { + "35717227-37dc-47aa-bf2d-2a5dd76069a0": { "customLabel": true, "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.process.request.last.memory: *" - }, "isBucketed": false, - "label": "Request memory", - "operationType": "last_value", + "label": "Minimum", + "operationType": "min", "params": { - "sortField": "@timestamp" + "emptyAsNull": true }, "scale": "ratio", - "sourceField": "php_fpm.process.request.last.memory" + "sourceField": "php_fpm.process.request.count" }, - "f5cbb076-1a0e-4ea3-8470-7238c004f0da": { - "dataType": "string", + "72832731-0703-4df0-9ab5-c452c13cd7d3": { + "dataType": "date", "isBucketed": true, - "label": "Top 10 values of process.pid", - "operationType": "terms", + "label": "@timestamp", + "operationType": "date_histogram", "params": { - "missingBucket": false, - "orderBy": { - "columnId": "769422db-6636-4226-a5f6-bdf0308e0a9a", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" - }, - "size": 10 + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ordinal", - "sourceField": "process.pid" + "scale": "interval", + "sourceField": "@timestamp" } }, "incompleteColumns": {} @@ -359,7 +306,7 @@ "meta": { "alias": null, "disabled": false, - "index": "9c4df760-98db-4493-865e-0eca0fbf159c", + "index": "a441ec79-5e7f-433b-89a0-6bcb9690488c", "key": "event.dataset", "negate": false, "params": { @@ -374,6 +321,7 @@ } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" @@ -398,14 +346,14 @@ "layers": [ { "accessors": [ - "769422db-6636-4226-a5f6-bdf0308e0a9a" + "35717227-37dc-47aa-bf2d-2a5dd76069a0", + "2a9fa2e5-4f93-4b00-920e-adbbffcd7668" ], "layerId": "d9643729-e12e-4e3d-ba08-d48da266bbce", "layerType": "data", "position": "top", "seriesType": "line", "showGridlines": false, - "splitAccessor": "f5cbb076-1a0e-4ea3-8470-7238c004f0da", "xAccessor": "72832731-0703-4df0-9ab5-c452c13cd7d3" } ], @@ -419,7 +367,9 @@ "yLeft": true, "yRight": true }, - "valueLabels": "hide" + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Requests" } }, "title": "", @@ -430,16 +380,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "1ed5459a-d03e-4a4b-872d-faff58d014de", + "h": 11, + "i": "c733e783-e914-4a17-85a8-cda612ef83e6", "w": 48, "x": 0, - "y": 14 + "y": 11 }, - "panelIndex": "1ed5459a-d03e-4a4b-872d-faff58d014de", - "title": "Memory consumed by last request over time [Metrics PHP-FPM]", + "panelIndex": "c733e783-e914-4a17-85a8-cda612ef83e6", + "title": "Total requests over time [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -447,62 +397,160 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", + "name": "indexpattern-datasource-layer-fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", "type": "index-pattern" }, { "id": "logs-*", - "name": "1581d698-0c3b-4022-a763-eccbc407edf3", + "name": "f683a750-2ee2-4078-aedd-b5d741d26b53", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "d9643729-e12e-4e3d-ba08-d48da266bbce": { + "fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b": { "columnOrder": [ - "72832731-0703-4df0-9ab5-c452c13cd7d3", - "35717227-37dc-47aa-bf2d-2a5dd76069a0", - "2a9fa2e5-4f93-4b00-920e-adbbffcd7668" + "0cabd051-9070-4043-8c10-77b2d0d58304", + "453d6177-9684-47f9-adca-085092916add", + "2bba30b0-5402-41ba-891c-5f4761c42d42", + "576c7b06-a296-4e8c-b537-00cbfa6e010c", + "559cd91e-ea35-47a2-a470-96e2a63f119c", + "7a032388-c4bb-41fd-a435-ca80476b364d", + "8fde96f6-0666-4681-bb5f-ee062616676b" ], "columns": { - "2a9fa2e5-4f93-4b00-920e-adbbffcd7668": { + "0cabd051-9070-4043-8c10-77b2d0d58304": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "PID", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "2bba30b0-5402-41ba-891c-5f4761c42d42", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10000 + }, + "scale": "ordinal", + "sourceField": "process.pid" + }, + "2bba30b0-5402-41ba-891c-5f4761c42d42": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "php_fpm.process.request.count: *" + }, "isBucketed": false, - "label": "Maximum", - "operationType": "max", + "label": "Request count", + "operationType": "last_value", "params": { - "emptyAsNull": true + "sortField": "@timestamp" }, "scale": "ratio", "sourceField": "php_fpm.process.request.count" }, - "35717227-37dc-47aa-bf2d-2a5dd76069a0": { + "453d6177-9684-47f9-adca-085092916add": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "php_fpm.process.state: *" + }, + "isBucketed": false, + "label": "State", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "php_fpm.process.state" + }, + "559cd91e-ea35-47a2-a470-96e2a63f119c": { + "customLabel": true, + "dataType": "string", + "filter": { + "language": "kuery", + "query": "user.name: *" + }, + "isBucketed": false, + "label": "User name", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "576c7b06-a296-4e8c-b537-00cbfa6e010c": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "php_fpm.process.request.duration: *" + }, "isBucketed": false, - "label": "Minimum", - "operationType": "min", + "label": "Request duration (μs)", + "operationType": "last_value", "params": { - "emptyAsNull": true + "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.process.request.count" + "sourceField": "php_fpm.process.request.duration" }, - "72832731-0703-4df0-9ab5-c452c13cd7d3": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", + "7a032388-c4bb-41fd-a435-ca80476b364d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "http.request.body.bytes: *" + }, + "isBucketed": false, + "label": "Content length", + "operationType": "last_value", "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" }, - "scale": "interval", - "sourceField": "@timestamp" + "scale": "ratio", + "sourceField": "http.request.body.bytes" + }, + "8fde96f6-0666-4681-bb5f-ee062616676b": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "php_fpm.process.request.last.memory: *" + }, + "isBucketed": false, + "label": "Request memory", + "operationType": "last_value", + "params": { + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + }, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "php_fpm.process.request.last.memory" } }, "incompleteColumns": {} @@ -518,7 +566,7 @@ "meta": { "alias": null, "disabled": false, - "index": "1581d698-0c3b-4022-a763-eccbc407edf3", + "index": "f683a750-2ee2-4078-aedd-b5d741d26b53", "key": "event.dataset", "negate": false, "params": { @@ -533,73 +581,74 @@ } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ + "columns": [ { - "accessors": [ - "35717227-37dc-47aa-bf2d-2a5dd76069a0", - "2a9fa2e5-4f93-4b00-920e-adbbffcd7668" - ], - "layerId": "d9643729-e12e-4e3d-ba08-d48da266bbce", - "layerType": "data", - "position": "top", - "seriesType": "line", - "showGridlines": false, - "xAccessor": "72832731-0703-4df0-9ab5-c452c13cd7d3" + "alignment": "left", + "columnId": "0cabd051-9070-4043-8c10-77b2d0d58304" + }, + { + "columnId": "453d6177-9684-47f9-adca-085092916add", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "2bba30b0-5402-41ba-891c-5f4761c42d42", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "576c7b06-a296-4e8c-b537-00cbfa6e010c", + "isTransposed": false + }, + { + "columnId": "559cd91e-ea35-47a2-a470-96e2a63f119c", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "7a032388-c4bb-41fd-a435-ca80476b364d", + "isTransposed": false + }, + { + "alignment": "left", + "columnId": "8fde96f6-0666-4681-bb5f-ee062616676b", + "isTransposed": false } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "headerRowHeight": "auto", + "layerId": "fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 }, - "valueLabels": "hide", - "yTitle": "Requests" + "rowHeight": "auto" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsDatatable" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "c733e783-e914-4a17-85a8-cda612ef83e6", + "h": 11, + "i": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d", "w": 48, "x": 0, - "y": 29 + "y": 33 }, - "panelIndex": "c733e783-e914-4a17-85a8-cda612ef83e6", - "title": "Total requests over time [Metrics PHP-FPM]", + "panelIndex": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d", + "title": "Statistics of processes [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -623,7 +672,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1be79645-d0a1-479e-8374-cfe5f5957bcf": { "columnOrder": [ @@ -815,56 +864,62 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 11, "i": "b4772749-232c-49a2-b12e-d9b559e51b33", "w": 48, "x": 0, - "y": 44 + "y": 22 }, "panelIndex": "b4772749-232c-49a2-b12e-d9b559e51b33", "title": "Request duration over time [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Metrics PHP-FPM] Process", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-31T10:19:14.386Z", "id": "php_fpm-30d6d490-60c6-11ed-a227-676557292b43", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d:indexpattern-datasource-layer-fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d:973b088d-1ba7-40f2-9e9d-c911dd80272f", + "name": "1ed5459a-d03e-4a4b-872d-faff58d014de:indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", "type": "index-pattern" }, { "id": "logs-*", - "name": "1ed5459a-d03e-4a4b-872d-faff58d014de:indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", + "name": "1ed5459a-d03e-4a4b-872d-faff58d014de:b661bcca-b850-4cf2-bb56-3696825b0a62", "type": "index-pattern" }, { "id": "logs-*", - "name": "1ed5459a-d03e-4a4b-872d-faff58d014de:9c4df760-98db-4493-865e-0eca0fbf159c", + "name": "c733e783-e914-4a17-85a8-cda612ef83e6:indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", "type": "index-pattern" }, { "id": "logs-*", - "name": "c733e783-e914-4a17-85a8-cda612ef83e6:indexpattern-datasource-layer-d9643729-e12e-4e3d-ba08-d48da266bbce", + "name": "c733e783-e914-4a17-85a8-cda612ef83e6:a441ec79-5e7f-433b-89a0-6bcb9690488c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d:indexpattern-datasource-layer-fbe2058d-ab9e-4a5b-9e37-9ef507abbe6b", "type": "index-pattern" }, { "id": "logs-*", - "name": "c733e783-e914-4a17-85a8-cda612ef83e6:1581d698-0c3b-4022-a763-eccbc407edf3", + "name": "5c4d2a38-4913-43b6-a54a-a56cb1f9bb3d:f683a750-2ee2-4078-aedd-b5d741d26b53", "type": "index-pattern" }, { @@ -881,6 +936,11 @@ "id": "logs-*", "name": "b4772749-232c-49a2-b12e-d9b559e51b33:d17167fb-efef-400b-8cc3-a6975c370492", "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_bfd5cccd-6939-4445-8b50-c0773cf84b47:optionsListDataView", + "type": "index-pattern" } ], "type": "dashboard" diff --git a/packages/php_fpm/kibana/dashboard/php_fpm-6853a270-5a92-11ed-8d56-a14fd29a60cb.json b/packages/php_fpm/kibana/dashboard/php_fpm-6853a270-5a92-11ed-8d56-a14fd29a60cb.json index d6b04aff8ef..439b76ee7ae 100755 --- a/packages/php_fpm/kibana/dashboard/php_fpm-6853a270-5a92-11ed-8d56-a14fd29a60cb.json +++ b/packages/php_fpm/kibana/dashboard/php_fpm-6853a270-5a92-11ed-8d56-a14fd29a60cb.json @@ -1,10 +1,38 @@ { "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"79c32b59-977a-4270-8f9b-4238a9e8846c\":{\"type\":\"optionsListControl\",\"order\":0,\"grow\":false,\"width\":\"medium\",\"explicitInput\":{\"id\":\"79c32b59-977a-4270-8f9b-4238a9e8846c\",\"fieldName\":\"service.address\",\"title\":\"Host Name\",\"singleSelect\":true,\"enhancements\":{}}}}" + }, "description": "This PHP-FPM dashboard visualizes Pool metrics.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "php_fpm.pool" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "php_fpm.pool" + } + } + } + ], "query": { "language": "kuery", "query": "" @@ -14,6 +42,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -24,39 +53,39 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-d8f066c1-27ff-4f57-9b69-391adcf87dff", + "name": "indexpattern-datasource-layer-756303a8-9ea6-4075-b840-8c185f9f9591", "type": "index-pattern" }, { "id": "logs-*", - "name": "e6f08aa9-d38a-49f2-84a8-17a3ae909dab", + "name": "f6446d7d-d95d-45b4-b5d4-2bb3a808d295", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "d8f066c1-27ff-4f57-9b69-391adcf87dff": { + "756303a8-9ea6-4075-b840-8c185f9f9591": { "columnOrder": [ - "f47fdb37-121f-4bc5-94b2-e3a219a29cac" + "530787c0-6c85-444c-84d8-2c2373cc6aed" ], "columns": { - "f47fdb37-121f-4bc5-94b2-e3a219a29cac": { + "530787c0-6c85-444c-84d8-2c2373cc6aed": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "php_fpm.pool.connections.accepted: *" + "query": "php_fpm.pool.processes.count: *" }, "isBucketed": false, - "label": "Accepted connections", + "label": "Total processes", "operationType": "last_value", "params": { "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.pool.connections.accepted" + "sourceField": "php_fpm.pool.processes.count" } }, "incompleteColumns": {} @@ -72,7 +101,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e6f08aa9-d38a-49f2-84a8-17a3ae909dab", + "index": "f6446d7d-d95d-45b4-b5d4-2bb3a808d295", "key": "event.dataset", "negate": false, "params": { @@ -92,8 +121,8 @@ "query": "" }, "visualization": { - "accessor": "f47fdb37-121f-4bc5-94b2-e3a219a29cac", - "layerId": "d8f066c1-27ff-4f57-9b69-391adcf87dff", + "accessor": "530787c0-6c85-444c-84d8-2c2373cc6aed", + "layerId": "756303a8-9ea6-4075-b840-8c185f9f9591", "layerType": "data", "textAlign": "center", "titlePosition": "bottom" @@ -101,22 +130,22 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": true }, "gridData": { - "h": 5, - "i": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9", - "w": 16, + "h": 11, + "i": "75192bad-0b67-4e3f-91d9-dde39f1e03a0", + "w": 12, "x": 0, "y": 0 }, - "panelIndex": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9", - "title": "Accepted connections [Metrics PHP-FPM]", + "panelIndex": "75192bad-0b67-4e3f-91d9-dde39f1e03a0", + "title": "Total processes [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -124,39 +153,71 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-756303a8-9ea6-4075-b840-8c185f9f9591", + "name": "indexpattern-datasource-layer-e774e25a-81ea-4ac1-a8c6-599a04351bf6", "type": "index-pattern" }, { "id": "logs-*", - "name": "f6446d7d-d95d-45b4-b5d4-2bb3a808d295", + "name": "f3142243-0fca-4613-a39f-c4cfeb0aa545", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "756303a8-9ea6-4075-b840-8c185f9f9591": { + "e774e25a-81ea-4ac1-a8c6-599a04351bf6": { "columnOrder": [ - "530787c0-6c85-444c-84d8-2c2373cc6aed" + "fd28cbd3-090b-4068-99fb-503825881742", + "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80", + "ee26ef15-3df3-494e-88c5-91f160fa5e82" ], "columns": { - "530787c0-6c85-444c-84d8-2c2373cc6aed": { + "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "php_fpm.pool.processes.count: *" + "query": "php_fpm.pool.processes.active.count: *" }, "isBucketed": false, - "label": "Total processes", + "label": "Active", "operationType": "last_value", "params": { "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.pool.processes.count" + "sourceField": "php_fpm.pool.processes.active.count" + }, + "ee26ef15-3df3-494e-88c5-91f160fa5e82": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "php_fpm.pool.processes.idle: *" + }, + "isBucketed": false, + "label": "Idle", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "php_fpm.pool.processes.idle" + }, + "fd28cbd3-090b-4068-99fb-503825881742": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" } }, "incompleteColumns": {} @@ -172,7 +233,7 @@ "meta": { "alias": null, "disabled": false, - "index": "f6446d7d-d95d-45b4-b5d4-2bb3a808d295", + "index": "f3142243-0fca-4613-a39f-c4cfeb0aa545", "key": "event.dataset", "negate": false, "params": { @@ -187,36 +248,81 @@ } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "accessor": "530787c0-6c85-444c-84d8-2c2373cc6aed", - "layerId": "756303a8-9ea6-4075-b840-8c185f9f9591", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80", + "ee26ef15-3df3-494e-88c5-91f160fa5e82" + ], + "layerId": "e774e25a-81ea-4ac1-a8c6-599a04351bf6", + "layerType": "data", + "seriesType": "line", + "xAccessor": "fd28cbd3-090b-4068-99fb-503825881742", + "yConfig": [ + { + "color": "#55e81a", + "forAccessor": "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true, + "yTitle": "Processes" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": true + "hidePanelTitles": false }, "gridData": { - "h": 5, - "i": "75192bad-0b67-4e3f-91d9-dde39f1e03a0", - "w": 16, - "x": 16, + "h": 11, + "i": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1", + "w": 36, + "x": 12, "y": 0 }, - "panelIndex": "75192bad-0b67-4e3f-91d9-dde39f1e03a0", - "title": "Total processes [Metrics PHP-FPM]", + "panelIndex": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1", + "title": "Processes over time [Metrics PHP-FPM] ", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -235,7 +341,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "fe87988d-4f25-4383-9c4c-4c761c5deb59": { "columnOrder": [ @@ -301,22 +407,22 @@ }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": true }, "gridData": { - "h": 5, + "h": 11, "i": "68fff557-6358-4076-a81c-5468de202555", - "w": 16, - "x": 32, - "y": 0 + "w": 12, + "x": 0, + "y": 11 }, "panelIndex": "68fff557-6358-4076-a81c-5468de202555", "title": "Size of listen queue [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -335,7 +441,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0a69272c-85a3-4b5e-84fe-29dfadbe7c65": { "columnOrder": [ @@ -436,16 +542,16 @@ "hidePanelTitles": false }, "gridData": { - "h": 15, + "h": 11, "i": "eeabe160-e717-4614-8401-facdd31976cb", - "w": 24, - "x": 0, - "y": 5 + "w": 36, + "x": 12, + "y": 11 }, "panelIndex": "eeabe160-e717-4614-8401-facdd31976cb", "title": "Queued connections over time [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -453,53 +559,39 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-85579a79-a389-4c79-87cb-4eecc709a0b5", + "name": "indexpattern-datasource-layer-d8f066c1-27ff-4f57-9b69-391adcf87dff", "type": "index-pattern" }, { "id": "logs-*", - "name": "e7d729c7-52de-4891-8a7c-fef26d56f34e", + "name": "e6f08aa9-d38a-49f2-84a8-17a3ae909dab", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "85579a79-a389-4c79-87cb-4eecc709a0b5": { + "d8f066c1-27ff-4f57-9b69-391adcf87dff": { "columnOrder": [ - "94941b0d-8d7a-48a7-a252-b8deda228838", - "8e2ae67f-4fdc-4838-b31d-6f570368629e" + "f47fdb37-121f-4bc5-94b2-e3a219a29cac" ], "columns": { - "8e2ae67f-4fdc-4838-b31d-6f570368629e": { + "f47fdb37-121f-4bc5-94b2-e3a219a29cac": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "php_fpm.pool.slow_requests: *" + "query": "php_fpm.pool.connections.accepted: *" }, "isBucketed": false, - "label": "Slow requests", + "label": "Accepted connections", "operationType": "last_value", "params": { "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.pool.slow_requests" - }, - "94941b0d-8d7a-48a7-a252-b8deda228838": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" + "sourceField": "php_fpm.pool.connections.accepted" } }, "incompleteColumns": {} @@ -515,7 +607,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e7d729c7-52de-4891-8a7c-fef26d56f34e", + "index": "e6f08aa9-d38a-49f2-84a8-17a3ae909dab", "key": "event.dataset", "negate": false, "params": { @@ -535,64 +627,31 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "8e2ae67f-4fdc-4838-b31d-6f570368629e" - ], - "layerId": "85579a79-a389-4c79-87cb-4eecc709a0b5", - "layerType": "data", - "seriesType": "line", - "xAccessor": "94941b0d-8d7a-48a7-a252-b8deda228838" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" + "accessor": "f47fdb37-121f-4bc5-94b2-e3a219a29cac", + "layerId": "d8f066c1-27ff-4f57-9b69-391adcf87dff", + "layerType": "data", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": false + "hidePanelTitles": true }, "gridData": { - "h": 15, - "i": "75f8fe5c-c9ce-420e-a84d-6feb283addff", - "w": 24, - "x": 24, - "y": 5 + "h": 11, + "i": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9", + "w": 12, + "x": 0, + "y": 22 }, - "panelIndex": "75f8fe5c-c9ce-420e-a84d-6feb283addff", - "title": "Slow requests over time [Metrics PHP-FPM]", + "panelIndex": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9", + "title": "Accepted connections [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -600,70 +659,74 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-e774e25a-81ea-4ac1-a8c6-599a04351bf6", + "name": "indexpattern-datasource-layer-366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ce4eb805-3966-405b-a07a-a5e26b8907ad", "type": "index-pattern" }, { "id": "logs-*", - "name": "e255bed9-30b3-4b85-afaf-f77b732543a0", + "name": "b1f6fe7f-5725-4945-972a-edbb68eadcca", "type": "index-pattern" } ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "e774e25a-81ea-4ac1-a8c6-599a04351bf6": { + "366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568": { "columnOrder": [ - "fd28cbd3-090b-4068-99fb-503825881742", - "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80", - "ee26ef15-3df3-494e-88c5-91f160fa5e82" + "c1e82822-884d-473a-b98e-388694dee14c", + "8c186576-0e0f-424a-9966-8b3d5eaf6483", + "568b0991-05ec-4b44-a701-5cea15aa9004" ], "columns": { - "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80": { - "customLabel": true, + "568b0991-05ec-4b44-a701-5cea15aa9004": { "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.pool.processes.active.count: *" - }, "isBucketed": false, - "label": "Active", - "operationType": "last_value", + "isStaticValue": true, + "label": "Static value: 0", + "operationType": "static_value", "params": { - "sortField": "@timestamp" + "value": "0" }, - "scale": "ratio", - "sourceField": "php_fpm.pool.processes.active.count" + "references": [], + "scale": "ratio" }, - "ee26ef15-3df3-494e-88c5-91f160fa5e82": { + "8c186576-0e0f-424a-9966-8b3d5eaf6483": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "php_fpm.pool.processes.idle: *" + "query": "php_fpm.pool.connections.queued: *" }, "isBucketed": false, - "label": "Idle", + "label": "Queued connections", "operationType": "last_value", "params": { "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.pool.processes.idle" + "sourceField": "php_fpm.pool.connections.queued" }, - "fd28cbd3-090b-4068-99fb-503825881742": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", + "c1e82822-884d-473a-b98e-388694dee14c": { + "customLabel": false, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "php_fpm.pool.connections.listen_queue.max_size: *" + }, + "isBucketed": false, + "label": "Last value of php_fpm.pool.connections.listen_queue.max_size", + "operationType": "last_value", "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" + "sortField": "@timestamp" }, - "scale": "interval", - "sourceField": "@timestamp" + "scale": "ratio", + "sourceField": "php_fpm.pool.connections.listen_queue.max_size" } }, "incompleteColumns": {} @@ -679,7 +742,7 @@ "meta": { "alias": null, "disabled": false, - "index": "e255bed9-30b3-4b85-afaf-f77b732543a0", + "index": "ce4eb805-3966-405b-a07a-a5e26b8907ad", "key": "event.dataset", "negate": false, "params": { @@ -692,6 +755,27 @@ "event.dataset": "php_fpm.pool" } } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b1f6fe7f-5725-4945-972a-edbb68eadcca", + "key": "php_fpm.pool.connections.listen_queue.max_size", + "negate": true, + "params": { + "query": 0 + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "php_fpm.pool.connections.listen_queue.max_size": 0 + } + } } ], "query": { @@ -699,74 +783,34 @@ "query": "" }, "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "curveType": "LINEAR", - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80", - "ee26ef15-3df3-494e-88c5-91f160fa5e82" - ], - "layerId": "e774e25a-81ea-4ac1-a8c6-599a04351bf6", - "layerType": "data", - "seriesType": "line", - "xAccessor": "fd28cbd3-090b-4068-99fb-503825881742", - "yConfig": [ - { - "color": "#55e81a", - "forAccessor": "6b5b5e4c-fc30-4ab2-8ba9-ead0d5ec4d80" - } - ] - } - ], - "legend": { - "isInside": false, - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "line", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide", - "yTitle": "Processes" + "labelMajorMode": "auto", + "layerId": "366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", + "layerType": "data", + "maxAccessor": "c1e82822-884d-473a-b98e-388694dee14c", + "metricAccessor": "8c186576-0e0f-424a-9966-8b3d5eaf6483", + "minAccessor": "568b0991-05ec-4b44-a701-5cea15aa9004", + "shape": "horizontalBullet", + "ticksPosition": "auto" } }, "title": "", "type": "lens", - "visualizationType": "lnsXY" + "visualizationType": "lnsGauge" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 14, - "i": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1", - "w": 48, - "x": 0, - "y": 20 + "h": 11, + "i": "be4cc9f4-ba51-4e06-8be1-7493453de497", + "w": 36, + "x": 12, + "y": 22 }, - "panelIndex": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1", - "title": "Processes over time [Metrics PHP-FPM] ", + "panelIndex": "be4cc9f4-ba51-4e06-8be1-7493453de497", + "title": "Connections in listen queue [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" }, { "embeddableConfig": { @@ -774,74 +818,54 @@ "references": [ { "id": "logs-*", - "name": "indexpattern-datasource-layer-366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "ce4eb805-3966-405b-a07a-a5e26b8907ad", + "name": "indexpattern-datasource-layer-85579a79-a389-4c79-87cb-4eecc709a0b5", "type": "index-pattern" }, { "id": "logs-*", - "name": "b1f6fe7f-5725-4945-972a-edbb68eadcca", + "name": "db327be1-4db2-4ca8-b3e1-18af61987bb4", "type": "index-pattern" } ], "state": { + "adHocDataViews": {}, "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { - "366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568": { + "85579a79-a389-4c79-87cb-4eecc709a0b5": { "columnOrder": [ - "c1e82822-884d-473a-b98e-388694dee14c", - "8c186576-0e0f-424a-9966-8b3d5eaf6483", - "568b0991-05ec-4b44-a701-5cea15aa9004" + "94941b0d-8d7a-48a7-a252-b8deda228838", + "8e2ae67f-4fdc-4838-b31d-6f570368629e" ], "columns": { - "568b0991-05ec-4b44-a701-5cea15aa9004": { - "dataType": "number", - "isBucketed": false, - "isStaticValue": true, - "label": "Static value: 0", - "operationType": "static_value", - "params": { - "value": "0" - }, - "references": [], - "scale": "ratio" - }, - "8c186576-0e0f-424a-9966-8b3d5eaf6483": { + "8e2ae67f-4fdc-4838-b31d-6f570368629e": { "customLabel": true, "dataType": "number", "filter": { "language": "kuery", - "query": "php_fpm.pool.connections.queued: *" + "query": "php_fpm.pool.slow_requests: *" }, "isBucketed": false, - "label": "Queued connections", + "label": "Slow requests", "operationType": "last_value", "params": { "sortField": "@timestamp" }, "scale": "ratio", - "sourceField": "php_fpm.pool.connections.queued" + "sourceField": "php_fpm.pool.slow_requests" }, - "c1e82822-884d-473a-b98e-388694dee14c": { - "customLabel": false, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "php_fpm.pool.connections.listen_queue.max_size: *" - }, - "isBucketed": false, - "label": "Last value of php_fpm.pool.connections.listen_queue.max_size", - "operationType": "last_value", + "94941b0d-8d7a-48a7-a252-b8deda228838": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", "params": { - "sortField": "@timestamp" + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" }, - "scale": "ratio", - "sourceField": "php_fpm.pool.connections.listen_queue.max_size" + "scale": "interval", + "sourceField": "@timestamp" } }, "incompleteColumns": {} @@ -857,7 +881,7 @@ "meta": { "alias": null, "disabled": false, - "index": "ce4eb805-3966-405b-a07a-a5e26b8907ad", + "index": "db327be1-4db2-4ca8-b3e1-18af61987bb4", "key": "event.dataset", "negate": false, "params": { @@ -870,92 +894,109 @@ "event.dataset": "php_fpm.pool" } } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "b1f6fe7f-5725-4945-972a-edbb68eadcca", - "key": "php_fpm.pool.connections.listen_queue.max_size", - "negate": true, - "params": { - "query": 0 - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "php_fpm.pool.connections.listen_queue.max_size": 0 - } - } } ], + "internalReferences": [], "query": { "language": "kuery", "query": "" }, "visualization": { - "labelMajorMode": "auto", - "layerId": "366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", - "layerType": "data", - "maxAccessor": "c1e82822-884d-473a-b98e-388694dee14c", - "metricAccessor": "8c186576-0e0f-424a-9966-8b3d5eaf6483", - "minAccessor": "568b0991-05ec-4b44-a701-5cea15aa9004", - "shape": "horizontalBullet", - "ticksPosition": "auto" + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "8e2ae67f-4fdc-4838-b31d-6f570368629e" + ], + "layerId": "85579a79-a389-4c79-87cb-4eecc709a0b5", + "layerType": "data", + "seriesType": "line", + "xAccessor": "94941b0d-8d7a-48a7-a252-b8deda228838" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": true } }, "title": "", "type": "lens", - "visualizationType": "lnsGauge" + "visualizationType": "lnsXY" }, "enhancements": {}, "hidePanelTitles": false }, "gridData": { - "h": 15, - "i": "be4cc9f4-ba51-4e06-8be1-7493453de497", + "h": 11, + "i": "75f8fe5c-c9ce-420e-a84d-6feb283addff", "w": 48, "x": 0, - "y": 34 + "y": 33 }, - "panelIndex": "be4cc9f4-ba51-4e06-8be1-7493453de497", - "title": "Connections in listen queue [Metrics PHP-FPM]", + "panelIndex": "75f8fe5c-c9ce-420e-a84d-6feb283addff", + "title": "Slow requests over time [Metrics PHP-FPM]", "type": "lens", - "version": "8.4.1" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Metrics PHP-FPM] Pool", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-31T10:19:31.197Z", "id": "php_fpm-6853a270-5a92-11ed-8d56-a14fd29a60cb", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9:indexpattern-datasource-layer-d8f066c1-27ff-4f57-9b69-391adcf87dff", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" }, { "id": "logs-*", - "name": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9:e6f08aa9-d38a-49f2-84a8-17a3ae909dab", + "name": "75192bad-0b67-4e3f-91d9-dde39f1e03a0:indexpattern-datasource-layer-756303a8-9ea6-4075-b840-8c185f9f9591", "type": "index-pattern" }, { "id": "logs-*", - "name": "75192bad-0b67-4e3f-91d9-dde39f1e03a0:indexpattern-datasource-layer-756303a8-9ea6-4075-b840-8c185f9f9591", + "name": "75192bad-0b67-4e3f-91d9-dde39f1e03a0:f6446d7d-d95d-45b4-b5d4-2bb3a808d295", "type": "index-pattern" }, { "id": "logs-*", - "name": "75192bad-0b67-4e3f-91d9-dde39f1e03a0:f6446d7d-d95d-45b4-b5d4-2bb3a808d295", + "name": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1:indexpattern-datasource-layer-e774e25a-81ea-4ac1-a8c6-599a04351bf6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1:f3142243-0fca-4613-a39f-c4cfeb0aa545", "type": "index-pattern" }, { @@ -980,37 +1021,42 @@ }, { "id": "logs-*", - "name": "75f8fe5c-c9ce-420e-a84d-6feb283addff:indexpattern-datasource-layer-85579a79-a389-4c79-87cb-4eecc709a0b5", + "name": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9:indexpattern-datasource-layer-d8f066c1-27ff-4f57-9b69-391adcf87dff", "type": "index-pattern" }, { "id": "logs-*", - "name": "75f8fe5c-c9ce-420e-a84d-6feb283addff:e7d729c7-52de-4891-8a7c-fef26d56f34e", + "name": "e7a0d428-1f42-41ee-b0cc-2444ce257fa9:e6f08aa9-d38a-49f2-84a8-17a3ae909dab", "type": "index-pattern" }, { "id": "logs-*", - "name": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1:indexpattern-datasource-layer-e774e25a-81ea-4ac1-a8c6-599a04351bf6", + "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:indexpattern-datasource-layer-366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", "type": "index-pattern" }, { "id": "logs-*", - "name": "6ff5113c-e8b3-46e4-9934-84b83fb7d5b1:e255bed9-30b3-4b85-afaf-f77b732543a0", + "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:ce4eb805-3966-405b-a07a-a5e26b8907ad", "type": "index-pattern" }, { "id": "logs-*", - "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:indexpattern-datasource-layer-366cbf5b-aad5-4b9c-bf7c-8b74c8e7f568", + "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:b1f6fe7f-5725-4945-972a-edbb68eadcca", "type": "index-pattern" }, { "id": "logs-*", - "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:ce4eb805-3966-405b-a07a-a5e26b8907ad", + "name": "75f8fe5c-c9ce-420e-a84d-6feb283addff:indexpattern-datasource-layer-85579a79-a389-4c79-87cb-4eecc709a0b5", "type": "index-pattern" }, { "id": "logs-*", - "name": "be4cc9f4-ba51-4e06-8be1-7493453de497:b1f6fe7f-5725-4945-972a-edbb68eadcca", + "name": "75f8fe5c-c9ce-420e-a84d-6feb283addff:db327be1-4db2-4ca8-b3e1-18af61987bb4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_79c32b59-977a-4270-8f9b-4238a9e8846c:optionsListDataView", "type": "index-pattern" } ], diff --git a/packages/php_fpm/manifest.yml b/packages/php_fpm/manifest.yml index 936e8c06636..c1740a27e68 100644 --- a/packages/php_fpm/manifest.yml +++ b/packages/php_fpm/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: php_fpm title: PHP-FPM -version: "0.5.0" +version: "0.6.2" description: This Elastic integration collects metrics from PHP-FPM. type: integration categories: diff --git a/packages/ping_one/_dev/build/build.yml b/packages/ping_one/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ping_one/_dev/build/build.yml +++ b/packages/ping_one/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ping_one/changelog.yml b/packages/ping_one/changelog.yml index 4d601945638..4d896d89a84 100644 --- a/packages/ping_one/changelog.yml +++ b/packages/ping_one/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7296 +- version: "1.6.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.5.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ping_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json b/packages/ping_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json index 80c4b35f585..dcff8b883ef 100644 --- a/packages/ping_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json +++ b/packages/ping_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-07-06T06:12:00.400Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "action.created", @@ -62,7 +62,7 @@ { "@timestamp": "2022-07-18T13:25:08.750Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "action.updated", @@ -121,7 +121,7 @@ { "@timestamp": "2022-07-06T06:12:00.405Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application.created", @@ -186,7 +186,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application.updated", @@ -281,7 +281,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "application.deleted", @@ -376,7 +376,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_attribute.created", @@ -471,7 +471,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_attribute.deleted", @@ -566,7 +566,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_attribute.updated", @@ -661,7 +661,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_condition.created", @@ -756,7 +756,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_condition.deleted", @@ -851,7 +851,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_condition.updated", @@ -946,7 +946,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_policy.updated", @@ -1041,7 +1041,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_processor.created", @@ -1136,7 +1136,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_processor.deleted", @@ -1231,7 +1231,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_processor.updated", @@ -1326,7 +1326,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_service.created", @@ -1421,7 +1421,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_service.deleted", @@ -1516,7 +1516,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_service.updated", @@ -1611,7 +1611,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_advice.created", @@ -1706,7 +1706,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_advice.deleted", @@ -1801,7 +1801,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_advice.updated", @@ -1896,7 +1896,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_rule.created", @@ -1991,7 +1991,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_rule.deleted", @@ -2086,7 +2086,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "authorize_shared_rule.updated", @@ -2181,7 +2181,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "decision_endpoint.created", @@ -2276,7 +2276,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "decision_endpoint.deleted", @@ -2371,7 +2371,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "decision_endpoint.updated", @@ -2466,7 +2466,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "environment.created", @@ -2561,7 +2561,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "environment.updated", @@ -2656,7 +2656,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fido_policy.created", @@ -2751,7 +2751,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fido_policy.deleted", @@ -2846,7 +2846,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "fido_policy.updated", @@ -2941,7 +2941,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow.deleted", @@ -3040,7 +3040,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow.created", @@ -3139,7 +3139,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "flow.updated", @@ -3238,7 +3238,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "grant.created", @@ -3333,7 +3333,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "grant.deleted", @@ -3428,7 +3428,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "grant.updated", @@ -3523,7 +3523,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "group.created", @@ -3616,7 +3616,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "group.deleted", @@ -3709,7 +3709,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "group.updated", @@ -3802,7 +3802,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "identity_provider.created", @@ -3894,7 +3894,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "identity_provider.deleted", @@ -3986,7 +3986,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "identity_provider.updated", @@ -4078,7 +4078,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "idp_attribute.created", @@ -4170,7 +4170,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "idp_attribute.deleted", @@ -4262,7 +4262,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "idp_attribute.updated", @@ -4354,7 +4354,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "image.created", @@ -4446,7 +4446,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "key.created", @@ -4538,7 +4538,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "mfa_settings.updated", @@ -4633,7 +4633,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "notification_policy.created", @@ -4728,7 +4728,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "notification_policy.deleted", @@ -4823,7 +4823,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "notification_policy.updated", @@ -4912,7 +4912,7 @@ { "@timestamp": "2022-07-07T13:12:36.168Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password.check_failed", @@ -4973,7 +4973,7 @@ { "@timestamp": "2022-07-07T13:12:48.320Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password.check_succeeded", @@ -5041,7 +5041,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.created", @@ -5133,7 +5133,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "policy.deleted", @@ -5225,7 +5225,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password.reset", @@ -5313,7 +5313,7 @@ { "@timestamp": "2022-07-06T06:12:00.573Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "password.set", @@ -5380,7 +5380,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "population.created", @@ -5472,7 +5472,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "population.deleted", @@ -5564,7 +5564,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "population.updated", @@ -5656,7 +5656,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_connection.created", @@ -5748,7 +5748,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_rule.deleted", @@ -5840,7 +5840,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_rule.deleted", @@ -5932,7 +5932,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_connection.updated", @@ -6024,7 +6024,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_rule.created", @@ -6116,7 +6116,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "provisioning_rule.updated", @@ -6208,7 +6208,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "resource_attribute.created", @@ -6300,7 +6300,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "resource_attribute.deleted", @@ -6392,7 +6392,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "resource.created", @@ -6484,7 +6484,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "resource.deleted", @@ -6576,7 +6576,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "resource.updated", @@ -6668,7 +6668,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_policy_set.created", @@ -6760,7 +6760,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_policy_set.deleted", @@ -6852,7 +6852,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_policy_set.updated", @@ -6944,7 +6944,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_predictor.created", @@ -7036,7 +7036,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_predictor.deleted", @@ -7128,7 +7128,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "risk_predictor.updated", @@ -7214,7 +7214,7 @@ { "@timestamp": "2022-07-06T06:12:00.615Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "role_assignment.created", @@ -7286,7 +7286,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "role_assignment.deleted", @@ -7378,7 +7378,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "saml_attribute.created", @@ -7473,7 +7473,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "saml_attribute.deleted", @@ -7568,7 +7568,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "saml_attribute.updated", @@ -7663,7 +7663,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "schema_attribute.created", @@ -7755,7 +7755,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "schema_attribute.deleted", @@ -7847,7 +7847,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "schema_attribute.updated", @@ -7939,7 +7939,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "scope.created", @@ -8031,7 +8031,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "scope.deleted", @@ -8123,7 +8123,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "scope.updated", @@ -8215,7 +8215,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "secret.read", @@ -8309,7 +8309,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.access_allowed", @@ -8413,7 +8413,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.created", @@ -8509,7 +8509,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.deleted", @@ -8609,7 +8609,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.updated", @@ -8705,7 +8705,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "member_of_group.created", @@ -8798,7 +8798,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "member_of_group.deleted", @@ -8891,7 +8891,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.access_allowed", diff --git a/packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index abf6a1ff17d..4af0b2c8918 100644 --- a/packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ping_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/ping_one/data_stream/audit/manifest.yml b/packages/ping_one/data_stream/audit/manifest.yml index e4b2b21b0c5..3b69d0b6ac7 100644 --- a/packages/ping_one/data_stream/audit/manifest.yml +++ b/packages/ping_one/data_stream/audit/manifest.yml @@ -63,7 +63,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the activities from PingOne. NOTE:- Supported units for this parameter are h/m/s. (Maximum - 2 years) + description: How far back to pull the activities from PingOne. Supported units for this parameter are h/m/s. (Maximum - 2 years) multi: false required: true show_user: true @@ -78,7 +78,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the PingOne API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the PingOne API. Supported units for this parameter are h/m/s. default: 1m multi: false required: true @@ -86,7 +86,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/ping_one/data_stream/audit/sample_event.json b/packages/ping_one/data_stream/audit/sample_event.json index 1dc53c36777..1700932673d 100644 --- a/packages/ping_one/data_stream/audit/sample_event.json +++ b/packages/ping_one/data_stream/audit/sample_event.json @@ -1,17 +1,16 @@ { - "@timestamp": "2022-06-10T17:04:25.518Z", + "@timestamp": "2022-08-08T15:31:08.237Z", "agent": { - "ephemeral_id": "3ec0008f-3b03-448a-8617-f9798d15e68d", - "hostname": "docker-fleet-agent", - "id": "8e2910ec-3bb9-439a-90a1-acedb9847388", + "ephemeral_id": "458fbf41-2184-4f77-b412-2b72012ea4b9", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.9.0" }, "client": { "user": { - "id": "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "name": "RichardPatchetWorker" + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "PingOne Admin Console" } }, "data_stream": { @@ -20,79 +19,90 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "8e2910ec-3bb9-439a-90a1-acedb9847388", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "7.17.0" + "version": "8.9.0" }, "event": { - "action": "group.created", + "action": "user.access_allowed", "agent_id_status": "verified", "category": [ "iam", "configuration" ], - "created": "2022-10-03T07:21:04.317Z", "dataset": "ping_one.audit", - "id": "2076da4e-81ae-4cf4-803a-4ccc16419bc9", - "ingested": "2022-10-03T07:21:05Z", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "ingested": "2023-08-07T17:13:14Z", "kind": "event", - "original": "{\"_links\":{\"self\":{\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/activities/2076da4e-81ae-4cf4-803a-4ccc16419bc9\"}},\"action\":{\"description\":\"Group Created\",\"type\":\"GROUP.CREATED\"},\"actors\":{\"client\":{\"environment\":{\"id\":\"bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa\"},\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/applications/830109c7-f8aa-491e-b2f2-8f7532ae85e9\",\"id\":\"830109c7-f8aa-491e-b2f2-8f7532ae85e9\",\"name\":\"RichardPatchetWorker\",\"type\":\"CLIENT\"}},\"correlationId\":\"28b1f3ca-2ab6-4cc0-b33f-50153c7c9c14\",\"createdAt\":\"2022-06-10T17:04:25.534Z\",\"id\":\"2076da4e-81ae-4cf4-803a-4ccc16419bc9\",\"recordedAt\":\"2022-06-10T17:04:25.518Z\",\"resources\":[{\"environment\":{\"id\":\"bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa\"},\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51\",\"id\":\"ac05e3ff-60e2-4e03-bbac-f9455e6a6d51\",\"name\":\"Managers\",\"type\":\"GROUP\"}],\"result\":{\"description\":\"Created Group Managers\",\"status\":\"SUCCESS\"}}", + "original": "{\"_embedded\":{},\"action\":{\"type\":\"USER.ACCESS_ALLOWED\"},\"actors\":{\"client\":{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/applications/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"PingOne Admin Console\",\"type\":\"CLIENT\"},\"user\":{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"example@gmail.com\",\"population\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"type\":\"USER\"}},\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"recordedAt\":\"2022-08-08T15:31:08.237Z\",\"resources\":[{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"example@gmail.com\",\"population\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"type\":\"USER\"}],\"result\":{\"description\":\"Passed role access control\",\"status\":\"SUCCESS\"}}", "outcome": "success", "type": [ - "creation", - "group" + "user", + "allowed", + "access" ] }, "input": { - "type": "httpjson" + "type": "http_endpoint" }, "ping_one": { "audit": { "action": { - "description": "Group Created", - "type": "GROUP.CREATED" + "type": "USER.ACCESS_ALLOWED" }, "actors": { "client": { "environment": { - "id": "bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa" + "id": "123abc123-12ab-1234-1abc-abc123abc12" }, - "href": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/applications/830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "id": "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "name": "RichardPatchetWorker", + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/applications/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "PingOne Admin Console", "type": "CLIENT" + }, + "user": { + "environment": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com", + "population": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "type": "USER" } }, - "correlation": { - "id": "28b1f3ca-2ab6-4cc0-b33f-50153c7c9c14" - }, - "created_at": "2022-06-10T17:04:25.534Z", - "id": "2076da4e-81ae-4cf4-803a-4ccc16419bc9", - "recorded_at": "2022-06-10T17:04:25.518Z", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "recorded_at": "2022-08-08T15:31:08.237Z", "resources": [ { "environment": { - "id": "bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa" + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com", + "population": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" }, - "href": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "id": "ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "name": "Managers", - "type": "GROUP" + "type": "USER" } ], "result": { - "description": "Created Group Managers", + "description": "Passed role access control", "status": "SUCCESS" } } }, "related": { "user": [ - "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "RichardPatchetWorker" + "123abc123-12ab-1234-1abc-abc123abc12", + "PingOne Admin Console", + "example@gmail.com" ] }, "tags": [ @@ -102,9 +112,13 @@ "ping_one-audit" ], "url": { - "domain": "api.pingone.com", - "original": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "path": "/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", + "domain": "api.pingone.asia", + "original": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "path": "/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", "scheme": "https" + }, + "user": { + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com" } } \ No newline at end of file diff --git a/packages/ping_one/docs/README.md b/packages/ping_one/docs/README.md index 3ca417d20e0..670d0661bf1 100644 --- a/packages/ping_one/docs/README.md +++ b/packages/ping_one/docs/README.md @@ -60,19 +60,18 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2022-06-10T17:04:25.518Z", + "@timestamp": "2022-08-08T15:31:08.237Z", "agent": { - "ephemeral_id": "3ec0008f-3b03-448a-8617-f9798d15e68d", - "hostname": "docker-fleet-agent", - "id": "8e2910ec-3bb9-439a-90a1-acedb9847388", + "ephemeral_id": "458fbf41-2184-4f77-b412-2b72012ea4b9", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.9.0" }, "client": { "user": { - "id": "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "name": "RichardPatchetWorker" + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "PingOne Admin Console" } }, "data_stream": { @@ -81,79 +80,90 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "8e2910ec-3bb9-439a-90a1-acedb9847388", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "7.17.0" + "version": "8.9.0" }, "event": { - "action": "group.created", + "action": "user.access_allowed", "agent_id_status": "verified", "category": [ "iam", "configuration" ], - "created": "2022-10-03T07:21:04.317Z", "dataset": "ping_one.audit", - "id": "2076da4e-81ae-4cf4-803a-4ccc16419bc9", - "ingested": "2022-10-03T07:21:05Z", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "ingested": "2023-08-07T17:13:14Z", "kind": "event", - "original": "{\"_links\":{\"self\":{\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/activities/2076da4e-81ae-4cf4-803a-4ccc16419bc9\"}},\"action\":{\"description\":\"Group Created\",\"type\":\"GROUP.CREATED\"},\"actors\":{\"client\":{\"environment\":{\"id\":\"bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa\"},\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/applications/830109c7-f8aa-491e-b2f2-8f7532ae85e9\",\"id\":\"830109c7-f8aa-491e-b2f2-8f7532ae85e9\",\"name\":\"RichardPatchetWorker\",\"type\":\"CLIENT\"}},\"correlationId\":\"28b1f3ca-2ab6-4cc0-b33f-50153c7c9c14\",\"createdAt\":\"2022-06-10T17:04:25.534Z\",\"id\":\"2076da4e-81ae-4cf4-803a-4ccc16419bc9\",\"recordedAt\":\"2022-06-10T17:04:25.518Z\",\"resources\":[{\"environment\":{\"id\":\"bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa\"},\"href\":\"https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51\",\"id\":\"ac05e3ff-60e2-4e03-bbac-f9455e6a6d51\",\"name\":\"Managers\",\"type\":\"GROUP\"}],\"result\":{\"description\":\"Created Group Managers\",\"status\":\"SUCCESS\"}}", + "original": "{\"_embedded\":{},\"action\":{\"type\":\"USER.ACCESS_ALLOWED\"},\"actors\":{\"client\":{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/applications/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"PingOne Admin Console\",\"type\":\"CLIENT\"},\"user\":{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"example@gmail.com\",\"population\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"type\":\"USER\"}},\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"recordedAt\":\"2022-08-08T15:31:08.237Z\",\"resources\":[{\"environment\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"href\":\"https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12\",\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\",\"name\":\"example@gmail.com\",\"population\":{\"id\":\"123abc123-12ab-1234-1abc-abc123abc12\"},\"type\":\"USER\"}],\"result\":{\"description\":\"Passed role access control\",\"status\":\"SUCCESS\"}}", "outcome": "success", "type": [ - "creation", - "group" + "user", + "allowed", + "access" ] }, "input": { - "type": "httpjson" + "type": "http_endpoint" }, "ping_one": { "audit": { "action": { - "description": "Group Created", - "type": "GROUP.CREATED" + "type": "USER.ACCESS_ALLOWED" }, "actors": { "client": { "environment": { - "id": "bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa" + "id": "123abc123-12ab-1234-1abc-abc123abc12" }, - "href": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/applications/830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "id": "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "name": "RichardPatchetWorker", + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/applications/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "PingOne Admin Console", "type": "CLIENT" + }, + "user": { + "environment": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com", + "population": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "type": "USER" } }, - "correlation": { - "id": "28b1f3ca-2ab6-4cc0-b33f-50153c7c9c14" - }, - "created_at": "2022-06-10T17:04:25.534Z", - "id": "2076da4e-81ae-4cf4-803a-4ccc16419bc9", - "recorded_at": "2022-06-10T17:04:25.518Z", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "recorded_at": "2022-08-08T15:31:08.237Z", "resources": [ { "environment": { - "id": "bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa" + "id": "123abc123-12ab-1234-1abc-abc123abc12" + }, + "href": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com", + "population": { + "id": "123abc123-12ab-1234-1abc-abc123abc12" }, - "href": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "id": "ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "name": "Managers", - "type": "GROUP" + "type": "USER" } ], "result": { - "description": "Created Group Managers", + "description": "Passed role access control", "status": "SUCCESS" } } }, "related": { "user": [ - "830109c7-f8aa-491e-b2f2-8f7532ae85e9", - "RichardPatchetWorker" + "123abc123-12ab-1234-1abc-abc123abc12", + "PingOne Admin Console", + "example@gmail.com" ] }, "tags": [ @@ -163,10 +173,14 @@ An example event for `audit` looks as following: "ping_one-audit" ], "url": { - "domain": "api.pingone.com", - "original": "https://api.pingone.com/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", - "path": "/v1/environments/bf4cb8b8-33e9-4576-8d70-c0ab679fe0fa/groups/ac05e3ff-60e2-4e03-bbac-f9455e6a6d51", + "domain": "api.pingone.asia", + "original": "https://api.pingone.asia/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", + "path": "/v1/environments/123abc123-12ab-1234-1abc-abc123abc12/users/123abc123-12ab-1234-1abc-abc123abc12", "scheme": "https" + }, + "user": { + "id": "123abc123-12ab-1234-1abc-abc123abc12", + "name": "example@gmail.com" } } ``` @@ -198,10 +212,10 @@ An example event for `audit` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/ping_one/kibana/tags.yml b/packages/ping_one/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ping_one/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ping_one/manifest.yml b/packages/ping_one/manifest.yml index ba259a0dec9..b18fd65f2f5 100644 --- a/packages/ping_one/manifest.yml +++ b/packages/ping_one/manifest.yml @@ -1,9 +1,7 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: ping_one title: PingOne -version: "1.4.0" -release: ga -license: basic +version: "1.8.0" description: Collect logs from PingOne with Elastic-Agent. type: integration categories: diff --git a/packages/postgresql/changelog.yml b/packages/postgresql/changelog.yml index aeeda57be45..20afccb6ee9 100644 --- a/packages/postgresql/changelog.yml +++ b/packages/postgresql/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "1.16.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 +- version: "1.16.0" + changes: + - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/6973 - version: "1.15.2" changes: - description: Added changes to support TSDB Enablement for the activity datastream. diff --git a/packages/postgresql/data_stream/activity/manifest.yml b/packages/postgresql/data_stream/activity/manifest.yml index 69a773dee02..6cba80f4361 100644 --- a/packages/postgresql/data_stream/activity/manifest.yml +++ b/packages/postgresql/data_stream/activity/manifest.yml @@ -11,4 +11,6 @@ streams: multi: false required: true show_user: true - default: 10s \ No newline at end of file + default: 10s +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/postgresql/data_stream/bgwriter/manifest.yml b/packages/postgresql/data_stream/bgwriter/manifest.yml index 8df93185002..75a905c2ea5 100644 --- a/packages/postgresql/data_stream/bgwriter/manifest.yml +++ b/packages/postgresql/data_stream/bgwriter/manifest.yml @@ -12,3 +12,5 @@ streams: required: true show_user: true default: 10s +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/postgresql/data_stream/database/manifest.yml b/packages/postgresql/data_stream/database/manifest.yml index 098123f31f6..a6904fcf747 100644 --- a/packages/postgresql/data_stream/database/manifest.yml +++ b/packages/postgresql/data_stream/database/manifest.yml @@ -12,3 +12,5 @@ streams: required: true show_user: true default: 10s +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/postgresql/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/postgresql/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 3bc6a682b0f..0cadb7bef53 100644 --- a/packages/postgresql/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/postgresql/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -11,6 +11,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/postgresql/data_stream/statement/manifest.yml b/packages/postgresql/data_stream/statement/manifest.yml index d78cc3de9d7..589506dac16 100644 --- a/packages/postgresql/data_stream/statement/manifest.yml +++ b/packages/postgresql/data_stream/statement/manifest.yml @@ -12,3 +12,5 @@ streams: required: true show_user: true default: 10s +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/postgresql/manifest.yml b/packages/postgresql/manifest.yml index 91018da9df0..b4909b41354 100644 --- a/packages/postgresql/manifest.yml +++ b/packages/postgresql/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: postgresql title: PostgreSQL -version: "1.15.2" +version: "1.16.1" license: basic description: Collect logs and metrics from PostgreSQL servers with Elastic Agent. type: integration @@ -10,7 +10,7 @@ categories: - observability release: ga conditions: - kibana.version: "^8.4.0" + kibana.version: "^8.8.0" screenshots: - src: /img/logs-overview.png title: PostgreSQL logs overview diff --git a/packages/problemchild/_dev/build/docs/README.md b/packages/problemchild/_dev/build/docs/README.md index a7fdd0f48b8..732e9c84ef8 100644 --- a/packages/problemchild/_dev/build/docs/README.md +++ b/packages/problemchild/_dev/build/docs/README.md @@ -1,13 +1,13 @@ # Living off the Land Attack Detection -The Living off the Land Attack (LotL) Detection package contains a supervised machine learning model, called [ProblemChild and associated assets](https://www.elastic.co/blog/problemchild-generate-alerts-to-detect-living-off-the-land-attacks), which are used to detect living off the land (LotL) activity in your environment. +The Living off the Land Attack (LotL) Detection package contains a supervised machine learning model, called [ProblemChild and associated assets](https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration), which are used to detect living off the land (LotL) activity in your environment. This package requires a Platinum subscription. Please ensure that you have a Trial or Platinum level subscription installed on your cluster before proceeding. This package is licensed under Elastic License v 1.0. ## Configuration To download the assets, click **Settings** > **Install Living off the Land Attack Detection assets**. -Follow these instructions to ingest data with the ingest pipeline and enrich your indices with inference data. Then use these detection rules and anomaly detection jobs to detect LotL attacks. For more detailed information refer to [this](https://www.elastic.co/blog/problemchild-generate-alerts-to-detect-living-off-the-land-attacks) blog. +Follow these instructions to ingest data with the ingest pipeline and enrich your indices with inference data. Then use these detection rules and anomaly detection jobs to detect LotL attacks. For more detailed information refer to [this](https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration) blog. ### (Required) Set up the ingest pipeline @@ -54,4 +54,4 @@ Detects potential LotL activity by identifying malicious processes. | Suspicious Windows Process Cluster Spawned by a User | A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | ## Licensing -Usage in production requires that you have a license key that permits use of machine learning features. \ No newline at end of file +Usage in production requires that you have a license key that permits use of machine learning features. diff --git a/packages/problemchild/changelog.yml b/packages/problemchild/changelog.yml index 3b3ea53504f..dd79ec06e75 100644 --- a/packages/problemchild/changelog.yml +++ b/packages/problemchild/changelog.yml @@ -1,3 +1,19 @@ +# newer versions go on top +- version: "1.1.2" + changes: + - description: Convert detection rules to EQL + type: enhancement + link: https://github.com/elastic/integrations/pull/7579 +- version: "1.1.1" + changes: + - description: Update blog post link and minor bug fixes + type: bugfix + link: https://github.com/elastic/integrations/pull/7618 +- version: "1.1.0" + changes: + - description: Ensure event.kind is correctly set for pipeline errors. + type: enhancement + link: https://github.com/elastic/integrations/pull/7501 - version: "1.0.1" changes: - description: Add the Advanced Analytics (UEBA) subcategory diff --git a/packages/problemchild/docs/README.md b/packages/problemchild/docs/README.md index a7fdd0f48b8..732e9c84ef8 100644 --- a/packages/problemchild/docs/README.md +++ b/packages/problemchild/docs/README.md @@ -1,13 +1,13 @@ # Living off the Land Attack Detection -The Living off the Land Attack (LotL) Detection package contains a supervised machine learning model, called [ProblemChild and associated assets](https://www.elastic.co/blog/problemchild-generate-alerts-to-detect-living-off-the-land-attacks), which are used to detect living off the land (LotL) activity in your environment. +The Living off the Land Attack (LotL) Detection package contains a supervised machine learning model, called [ProblemChild and associated assets](https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration), which are used to detect living off the land (LotL) activity in your environment. This package requires a Platinum subscription. Please ensure that you have a Trial or Platinum level subscription installed on your cluster before proceeding. This package is licensed under Elastic License v 1.0. ## Configuration To download the assets, click **Settings** > **Install Living off the Land Attack Detection assets**. -Follow these instructions to ingest data with the ingest pipeline and enrich your indices with inference data. Then use these detection rules and anomaly detection jobs to detect LotL attacks. For more detailed information refer to [this](https://www.elastic.co/blog/problemchild-generate-alerts-to-detect-living-off-the-land-attacks) blog. +Follow these instructions to ingest data with the ingest pipeline and enrich your indices with inference data. Then use these detection rules and anomaly detection jobs to detect LotL attacks. For more detailed information refer to [this](https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration) blog. ### (Required) Set up the ingest pipeline @@ -54,4 +54,4 @@ Detects potential LotL activity by identifying malicious processes. | Suspicious Windows Process Cluster Spawned by a User | A machine learning job combination has detected a set of one or more suspicious Windows processes with unusually high scores for malicious probability. These process(es) have been classified as malicious in several ways. The process(es) were predicted to be malicious by the ProblemChild supervised ML model. If the anomaly contains a cluster of suspicious processes, each process has the same user name, and the aggregate score of the event cluster was calculated to be unusually high by an unsupervised ML model. Such a cluster often contains suspicious or malicious activity, possibly involving LOLbins, that may be resistant to detection using conventional search rules. | ## Licensing -Usage in production requires that you have a license key that permits use of machine learning features. \ No newline at end of file +Usage in production requires that you have a license key that permits use of machine learning features. diff --git a/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_inference_pipeline.yml b/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_inference_pipeline.yml index ddab7927241..857fab463b3 100644 --- a/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_inference_pipeline.yml +++ b/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_inference_pipeline.yml @@ -351,7 +351,7 @@ processors: } if: ctx.containsKey('problemchild') && ctx['problemchild'].containsKey('prediction') - && ctx['problemchild']['prediction'] == 0 + && ctx['problemchild']['prediction'] == '0' params: blocklist: - dump @@ -394,3 +394,10 @@ processors: - script: lang: painless source: ctx.entrySet().removeIf(field -> field.getKey() =~ /feature_.*/);ctx['problemchild'].remove('prediction_score');ctx['problemchild'].remove('model_id'); +on_failure: + - append: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_ingest_pipeline.yml b/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_ingest_pipeline.yml index f94e705f8a9..15191b62c36 100644 --- a/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_ingest_pipeline.yml +++ b/packages/problemchild/elasticsearch/ingest_pipeline/problem_child_ingest_pipeline.yml @@ -5,6 +5,9 @@ processors: if: ctx.containsKey('event') && ctx['event'].containsKey('kind') && ctx['event'].containsKey('category') && ctx['event']['kind'] == 'event' && ctx['event']['category'].contains('process') && ctx.containsKey('host') && ctx['host'].containsKey('os') && (ctx['host']['os'].containsKey('type') || ctx['host']['os'].containsKey('family') || ctx['host']['os'].containsKey('platform')) && (ctx['host']['os']['type'] == 'windows' || ctx['host']['os']['type'] == 'Windows' || ctx['host']['os']['family'] == 'windows' || ctx['host']['os']['family'] == 'Windows' || ctx['host']['os']['platform'] == 'windows' || ctx['host']['os']['platform'] == 'Windows') name: '{{ IngestPipeline "problem_child_inference_pipeline" }}' on_failure: - - set: + - append: + field: event.kind + value: pipeline_error + - append: field: error.message - value: '{{ _ingest.on_failure_message }}' + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/problemchild/kibana/security_rule/34184d4e-ef61-477b-8d76-5c93448c29bf.json b/packages/problemchild/kibana/security_rule/34184d4e-ef61-477b-8d76-5c93448c29bf.json index 6fe81535c0a..2d4046a1f46 100644 --- a/packages/problemchild/kibana/security_rule/34184d4e-ef61-477b-8d76-5c93448c29bf.json +++ b/packages/problemchild/kibana/security_rule/34184d4e-ef61-477b-8d76-5c93448c29bf.json @@ -7,14 +7,14 @@ "from": "now-9m", "index": [ "endgame-*", - "logs-endpoint.events.process.*", + "logs-endpoint.events.process-*", "winlogbeat-*" ], - "language": "kuery", + "language": "eql", "license": "Elastic License", "max_signals": 10000, "name": "Machine Learning Detected a Suspicious Windows Event Predicted to be Malicious Activity", - "query": "problemchild.prediction:1 or blocklist_label:1", + "query": "process where\n(problemchild.prediction == 1 or blocklist_label == 1) and\nnot process.args : (\n \"*C:\\\\WINDOWS\\\\temp\\\\nessus_*.txt*\",\n \"*C:\\\\WINDOWS\\\\temp\\\\nessus_*.tmp*\"\n)", "risk_score": 21, "rule_id": "34184d4e-ef61-477b-8d76-5c93448c29bf", "severity": "low", @@ -25,9 +25,12 @@ "ML" ], "timestamp_override": "event.ingested", - "type": "query", + "references": [ + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" + ], + "type": "eql", "version": 3 }, "id": "34184d4e-ef61-477b-8d76-5c93448c29bf", "type": "security-rule" -} \ No newline at end of file +} diff --git a/packages/problemchild/kibana/security_rule/9a2e372a-cbeb-4ad6-a288-017ef086324c.json b/packages/problemchild/kibana/security_rule/9a2e372a-cbeb-4ad6-a288-017ef086324c.json index 08ad0b04149..ea3cdc60ae7 100644 --- a/packages/problemchild/kibana/security_rule/9a2e372a-cbeb-4ad6-a288-017ef086324c.json +++ b/packages/problemchild/kibana/security_rule/9a2e372a-cbeb-4ad6-a288-017ef086324c.json @@ -7,14 +7,14 @@ "from": "now-9m", "index": [ "endgame-*", - "logs-endpoint.events.process.*", + "logs-endpoint.events.process-*", "winlogbeat-*" ], - "language": "kuery", + "language": "eql", "license": "Elastic License", "max_signals": 10000, "name": "Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score", - "query": "(problemchild.prediction:1 and problemchild.prediction_probability \u003e 0.98) or blocklist_label:1", + "query": "process where ((problemchild.prediction == 1 and problemchild.prediction_probability \u003e 0.98) or blocklist_label == 1) and \n not process.args : (\n \"*C:\\\\WINDOWS\\\\temp\\\\nessus_*.txt*\",\n \"*C:\\\\WINDOWS\\\\temp\\\\nessus_*.tmp*\"\n)", "risk_score": 21, "rule_id": "9a2e372a-cbeb-4ad6-a288-017ef086324c", "severity": "low", @@ -25,9 +25,12 @@ "ML" ], "timestamp_override": "event.ingested", - "type": "query", + "references": [ + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" + ], + "type": "eql", "version": 3 }, "id": "9a2e372a-cbeb-4ad6-a288-017ef086324c", "type": "security-rule" -} \ No newline at end of file +} diff --git a/packages/problemchild/manifest.yml b/packages/problemchild/manifest.yml index cc86640e347..12fdc770d23 100644 --- a/packages/problemchild/manifest.yml +++ b/packages/problemchild/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: problemchild title: "Living off the Land Attack Detection" -version: 1.0.1 +version: 1.1.2 license: basic description: "ML solution package to detect Living off the Land (LotL) attacks in your environment. Requires a Platinum subscription." type: integration diff --git a/packages/prometheus/changelog.yml b/packages/prometheus/changelog.yml index fecb238eb71..0a84003458f 100644 --- a/packages/prometheus/changelog.yml +++ b/packages/prometheus/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: "1.12.0" + changes: + - description: Use ecs definition of the 'event.dataset' field + type: enhancement + link: https://github.com/elastic/integrations/pull/7667 +- version: "1.11.0" + changes: + - description: Enable TSDB by default for remote_write datastreams. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html + type: enhancement + link: https://github.com/elastic/integrations/pull/7598 +- version: "1.10.0" + changes: + - description: Align fingerprint field name across all datastreams, add handling of pipeline failures to the collector and query datastreams + type: enhancement + link: https://github.com/elastic/integrations/pull/7594 +- version: "1.9.0" + changes: + - description: Add dimension and metric_type fields to remote_write datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7565 +- version: "1.8.0" + changes: + - description: Enable TSDB by default for collector and query metrics data streams. This improves storage usage and query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. Still TSDB is not supported for remote_write + type: enhancement + link: https://github.com/elastic/integrations/pull/7261 +- version: "1.7.0" + changes: + - description: Revert metrics field definition to the format used before introducing metric_type + type: enhancement + link: https://github.com/elastic/integrations/pull/7324 +- version: "1.6.0" + changes: + - description: Add metric_type fields to collector and query datastreams for TSDB support + type: enhancement + link: https://github.com/elastic/integrations/pull/6981 - version: "1.5.0" changes: - description: Add dimension fields to collector and query datastreams for TSDB support diff --git a/packages/prometheus/data_stream/collector/elasticsearch/ingest_pipeline/default.yml b/packages/prometheus/data_stream/collector/elasticsearch/ingest_pipeline/default.yml index 4c712885598..644e6425d60 100644 --- a/packages/prometheus/data_stream/collector/elasticsearch/ingest_pipeline/default.yml +++ b/packages/prometheus/data_stream/collector/elasticsearch/ingest_pipeline/default.yml @@ -1,8 +1,14 @@ --- -description: Pipeline for processing Prometheus metrics. +description: Pipeline for processing Prometheus collector metrics. processors: - fingerprint: fields: ["prometheus.labels"] - target_field: "prometheus.labels_id" - ignore_failure: true + target_field: "prometheus.labels_fingerprint" ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - set: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/prometheus/data_stream/collector/fields/base-fields.yml b/packages/prometheus/data_stream/collector/fields/base-fields.yml index d80b3f4fd9b..149aead8990 100644 --- a/packages/prometheus/data_stream/collector/fields/base-fields.yml +++ b/packages/prometheus/data_stream/collector/fields/base-fields.yml @@ -14,7 +14,3 @@ type: constant_keyword description: Event module. value: prometheus -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: prometheus.collector diff --git a/packages/prometheus/data_stream/collector/fields/ecs.yml b/packages/prometheus/data_stream/collector/fields/ecs.yml index 3da8d090560..00a5f46cd71 100644 --- a/packages/prometheus/data_stream/collector/fields/ecs.yml +++ b/packages/prometheus/data_stream/collector/fields/ecs.yml @@ -8,3 +8,5 @@ - external: ecs name: agent.id dimension: true +- external: ecs + name: event.dataset diff --git a/packages/prometheus/data_stream/collector/fields/fields.yml b/packages/prometheus/data_stream/collector/fields/fields.yml index 69a744aec55..ed592103e62 100644 --- a/packages/prometheus/data_stream/collector/fields/fields.yml +++ b/packages/prometheus/data_stream/collector/fields/fields.yml @@ -6,20 +6,22 @@ object_type: keyword description: | Prometheus metric labels - - name: labels_id + - name: labels_fingerprint type: keyword dimension: true description: Autogenerated ID representing the fingerprint of labels object - - name: metrics.* - type: object - object_type: double - object_type_mapping_type: "*" - description: | - Prometheus metric +- name: prometheus.metrics.* + type: object + object_type: double + object_type_mapping_type: "*" + metric_type: gauge + description: | + Prometheus metric - name: prometheus.*.value type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Prometheus gauge metric @@ -27,6 +29,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: counter description: > Prometheus counter metric @@ -34,6 +37,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Prometheus rated counter metric diff --git a/packages/prometheus/data_stream/collector/manifest.yml b/packages/prometheus/data_stream/collector/manifest.yml index f131cc47007..883ab0e2011 100644 --- a/packages/prometheus/data_stream/collector/manifest.yml +++ b/packages/prometheus/data_stream/collector/manifest.yml @@ -1,5 +1,7 @@ title: Prometheus collector metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: prometheus/metrics vars: diff --git a/packages/prometheus/data_stream/query/elasticsearch/ingest_pipeline/default.yml b/packages/prometheus/data_stream/query/elasticsearch/ingest_pipeline/default.yml index 525e32f0741..0f81c3b1a47 100644 --- a/packages/prometheus/data_stream/query/elasticsearch/ingest_pipeline/default.yml +++ b/packages/prometheus/data_stream/query/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,5 @@ --- -description: Pipeline for processing Prometheus metrics. +description: Pipeline for processing Prometheus query metrics. processors: - foreach: field: "prometheus.query" @@ -7,8 +7,15 @@ processors: set: field: "prometheus.labels.query_name" value: "{{_ingest._key}}" + description: Add query_name as a label to cover cases, when query returns a single value with no labels - fingerprint: fields: ["prometheus.labels"] - target_field: "prometheus.labels_id" - ignore_failure: true + target_field: "prometheus.labels_fingerprint" ignore_missing: true +on_failure: + - set: + field: event.kind + value: pipeline_error + - set: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/prometheus/data_stream/query/fields/base-fields.yml b/packages/prometheus/data_stream/query/fields/base-fields.yml index 713fd3fe02d..149aead8990 100644 --- a/packages/prometheus/data_stream/query/fields/base-fields.yml +++ b/packages/prometheus/data_stream/query/fields/base-fields.yml @@ -14,7 +14,3 @@ type: constant_keyword description: Event module. value: prometheus -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: prometheus.query diff --git a/packages/prometheus/data_stream/query/fields/ecs.yml b/packages/prometheus/data_stream/query/fields/ecs.yml index 3da8d090560..00a5f46cd71 100644 --- a/packages/prometheus/data_stream/query/fields/ecs.yml +++ b/packages/prometheus/data_stream/query/fields/ecs.yml @@ -8,3 +8,5 @@ - external: ecs name: agent.id dimension: true +- external: ecs + name: event.dataset diff --git a/packages/prometheus/data_stream/query/fields/fields.yml b/packages/prometheus/data_stream/query/fields/fields.yml index 22039426a36..cb385f2bcb1 100644 --- a/packages/prometheus/data_stream/query/fields/fields.yml +++ b/packages/prometheus/data_stream/query/fields/fields.yml @@ -6,13 +6,14 @@ object_type: keyword description: | Prometheus metric labels - - name: labels_id + - name: labels_fingerprint type: keyword dimension: true - description: Autogenerated ID representing the fingerprint of labels object - - name: query.* - type: object - object_type: double - object_type_mapping_type: "*" - description: | - Prometheus value resulted from PromQL + description: Autogenerated ID representing the fingerprint of labels object and includes query name +- name: prometheus.query.* + type: object + object_type: double + object_type_mapping_type: "*" + metric_type: gauge + description: | + Prometheus value resulted from PromQL diff --git a/packages/prometheus/data_stream/query/manifest.yml b/packages/prometheus/data_stream/query/manifest.yml index ceac0d6f769..5c8395b6d90 100644 --- a/packages/prometheus/data_stream/query/manifest.yml +++ b/packages/prometheus/data_stream/query/manifest.yml @@ -1,5 +1,7 @@ title: Prometheus query metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: prometheus/metrics vars: diff --git a/packages/prometheus/data_stream/remote_write/elasticsearch/ingest_pipeline/default.yml b/packages/prometheus/data_stream/remote_write/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..6e2d6a2e7b2 --- /dev/null +++ b/packages/prometheus/data_stream/remote_write/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,29 @@ +--- +description: Pipeline for processing Prometheus remote_write metrics. +processors: + - append: + field: "prometheus.labels.metrics_names" + value: [null] + allow_duplicates: false + description: Create an empty field of the object type to temporarily store list of all metrics names + - foreach: + field: "prometheus" + processor: + append: + field: "prometheus.labels.metrics_names" + value: ["{{_ingest._key}}"] + description: Add all keys of the 'prometheus' object to the earlier created field, it includes all metric names and key "labels" + - fingerprint: + fields: ["prometheus.labels"] + target_field: "prometheus.labels_fingerprint" + ignore_missing: true + - remove: + field: "prometheus.labels.metrics_names" + description: Remove field as it contains a redundant information and can impact the documents size +on_failure: + - set: + field: event.kind + value: pipeline_error + - set: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/prometheus/data_stream/remote_write/fields/agent.yml b/packages/prometheus/data_stream/remote_write/fields/agent.yml index da4e652c53b..48add32f2ae 100644 --- a/packages/prometheus/data_stream/remote_write/fields/agent.yml +++ b/packages/prometheus/data_stream/remote_write/fields/agent.yml @@ -8,6 +8,7 @@ - name: account.id level: extended type: keyword + dimension: true ignore_above: 1024 description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. @@ -16,12 +17,14 @@ - name: availability_zone level: extended type: keyword + dimension: true ignore_above: 1024 description: Availability zone in which this host is running. example: us-east-1c - name: instance.id level: extended type: keyword + dimension: true ignore_above: 1024 description: Instance ID of the host machine. example: i-1234567890abcdef0 @@ -39,12 +42,14 @@ - name: provider level: extended type: keyword + dimension: true ignore_above: 1024 description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. example: aws - name: region level: extended type: keyword + dimension: true ignore_above: 1024 description: Region in which this host is running. example: us-east-1 @@ -65,6 +70,7 @@ - name: id level: core type: keyword + dimension: true ignore_above: 1024 description: Unique container id. - name: image.name @@ -133,6 +139,7 @@ - name: name level: core type: keyword + dimension: true ignore_above: 1024 description: 'Name of the host. diff --git a/packages/prometheus/data_stream/remote_write/fields/base-fields.yml b/packages/prometheus/data_stream/remote_write/fields/base-fields.yml index 91357799423..149aead8990 100644 --- a/packages/prometheus/data_stream/remote_write/fields/base-fields.yml +++ b/packages/prometheus/data_stream/remote_write/fields/base-fields.yml @@ -14,7 +14,3 @@ type: constant_keyword description: Event module. value: prometheus -- name: event.dataset - type: constant_keyword - description: Event dataset. - value: prometheus.remote_write diff --git a/packages/prometheus/data_stream/remote_write/fields/ecs.yml b/packages/prometheus/data_stream/remote_write/fields/ecs.yml index 365d9a34e4d..869623a49da 100644 --- a/packages/prometheus/data_stream/remote_write/fields/ecs.yml +++ b/packages/prometheus/data_stream/remote_write/fields/ecs.yml @@ -6,3 +6,6 @@ name: service.type - external: ecs name: agent.id + dimension: true +- external: ecs + name: event.dataset diff --git a/packages/prometheus/data_stream/remote_write/fields/fields.yml b/packages/prometheus/data_stream/remote_write/fields/fields.yml index d616a14ef99..d86da85bbd5 100644 --- a/packages/prometheus/data_stream/remote_write/fields/fields.yml +++ b/packages/prometheus/data_stream/remote_write/fields/fields.yml @@ -6,16 +6,23 @@ object_type: keyword description: | Prometheus metric labels + - name: labels_fingerprint + type: keyword + dimension: true + description: Autogenerated ID representing the fingerprint of all labels and the list of metrics names - name: metrics.* type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: |- Prometheus metric + - name: prometheus.*.value type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Prometheus gauge metric @@ -23,6 +30,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: counter description: > Prometheus counter metric @@ -30,6 +38,7 @@ type: object object_type: double object_type_mapping_type: "*" + metric_type: gauge description: > Prometheus rated counter metric diff --git a/packages/prometheus/data_stream/remote_write/manifest.yml b/packages/prometheus/data_stream/remote_write/manifest.yml index 1a55b7f8f3a..a61cc76bf52 100644 --- a/packages/prometheus/data_stream/remote_write/manifest.yml +++ b/packages/prometheus/data_stream/remote_write/manifest.yml @@ -1,5 +1,7 @@ title: Prometheus remote_write metrics type: metrics +elasticsearch: + index_mode: "time_series" streams: - input: prometheus/metrics vars: diff --git a/packages/prometheus/docs/README.md b/packages/prometheus/docs/README.md index a10ebef7c61..a26b9bdffc4 100644 --- a/packages/prometheus/docs/README.md +++ b/packages/prometheus/docs/README.md @@ -179,55 +179,55 @@ The fields reported are: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| prometheus.\*.counter | Prometheus counter metric | object | -| prometheus.\*.histogram | Prometheus histogram metric | object | -| prometheus.\*.rate | Prometheus rated counter metric | object | -| prometheus.\*.value | Prometheus gauge metric | object | -| prometheus.labels.\* | Prometheus metric labels | object | -| prometheus.labels_id | Autogenerated ID representing the fingerprint of labels object | keyword | -| prometheus.metrics.\* | Prometheus metric | object | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.module | Event module. | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| prometheus.\*.counter | Prometheus counter metric | object | counter | +| prometheus.\*.histogram | Prometheus histogram metric | object | | +| prometheus.\*.rate | Prometheus rated counter metric | object | gauge | +| prometheus.\*.value | Prometheus gauge metric | object | gauge | +| prometheus.labels.\* | Prometheus metric labels | object | | +| prometheus.labels_fingerprint | Autogenerated ID representing the fingerprint of labels object | keyword | | +| prometheus.metrics.\* | Prometheus metric | object | gauge | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | @@ -393,54 +393,55 @@ The fields reported are: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| prometheus.\*.counter | Prometheus counter metric | object | -| prometheus.\*.histogram | Prometheus histogram metric | object | -| prometheus.\*.rate | Prometheus rated counter metric | object | -| prometheus.\*.value | Prometheus gauge metric | object | -| prometheus.labels.\* | Prometheus metric labels | object | -| prometheus.metrics.\* | Prometheus metric | object | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.module | Event module. | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| prometheus.\*.counter | Prometheus counter metric | object | counter | +| prometheus.\*.histogram | Prometheus histogram metric | object | | +| prometheus.\*.rate | Prometheus rated counter metric | object | gauge | +| prometheus.\*.value | Prometheus gauge metric | object | gauge | +| prometheus.labels.\* | Prometheus metric labels | object | | +| prometheus.labels_fingerprint | Autogenerated ID representing the fingerprint of all labels and the list of metrics names | keyword | | +| prometheus.metrics.\* | Prometheus metric | object | gauge | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | #### Histograms and types @@ -615,51 +616,51 @@ The fields reported are: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset. | constant_keyword | -| event.module | Event module. | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| prometheus.labels.\* | Prometheus metric labels | object | -| prometheus.labels_id | Autogenerated ID representing the fingerprint of labels object | keyword | -| prometheus.query.\* | Prometheus value resulted from PromQL | object | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | +| event.module | Event module. | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| prometheus.labels.\* | Prometheus metric labels | object | | +| prometheus.labels_fingerprint | Autogenerated ID representing the fingerprint of labels object and includes query name | keyword | | +| prometheus.query.\* | Prometheus value resulted from PromQL | object | gauge | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | ## Dashboard diff --git a/packages/prometheus/manifest.yml b/packages/prometheus/manifest.yml index e515585df59..5010a81f9fd 100644 --- a/packages/prometheus/manifest.yml +++ b/packages/prometheus/manifest.yml @@ -1,17 +1,15 @@ -format_version: 1.0.0 +format_version: 2.10.0 name: prometheus title: Prometheus -version: 1.5.0 -license: basic +version: 1.12.0 description: Collect metrics from Prometheus servers with Elastic Agent. type: integration categories: - observability - monitoring - containers -release: ga conditions: - kibana.version: "^8.4.0" + kibana.version: "^8.9.0" screenshots: - src: /img/prometheus-server-overview.png title: Metricbeat Prometheus Overview diff --git a/packages/proofpoint_tap/_dev/build/build.yml b/packages/proofpoint_tap/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/proofpoint_tap/_dev/build/build.yml +++ b/packages/proofpoint_tap/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/proofpoint_tap/changelog.yml b/packages/proofpoint_tap/changelog.yml index 7cebece55b1..45dbb6bd24a 100644 --- a/packages/proofpoint_tap/changelog.yml +++ b/packages/proofpoint_tap/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7297 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/proofpoint_tap/data_stream/clicks_blocked/_dev/test/pipeline/test-clicks-blocked.log-expected.json b/packages/proofpoint_tap/data_stream/clicks_blocked/_dev/test/pipeline/test-clicks-blocked.log-expected.json index 646454dd83a..026c0edda2e 100644 --- a/packages/proofpoint_tap/data_stream/clicks_blocked/_dev/test/pipeline/test-clicks-blocked.log-expected.json +++ b/packages/proofpoint_tap/data_stream/clicks_blocked/_dev/test/pipeline/test-clicks-blocked.log-expected.json @@ -24,15 +24,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "123abc@example.com" + "address": [ + "123abc@example.com" + ] } }, "event": { @@ -116,15 +120,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "bd5da771530b11830e6dfd25838b0240@example.com" + "address": [ + "bd5da771530b11830e6dfd25838b0240@example.com" + ] } }, "event": { @@ -207,15 +215,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "b81458bb9f757994e79a9287b8447622@example.com" + "address": [ + "b81458bb9f757994e79a9287b8447622@example.com" + ] } }, "event": { @@ -299,15 +311,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "9c52aa64228824247c48df69b066e5a7@example.com" + "address": [ + "9c52aa64228824247c48df69b066e5a7@example.com" + ] } }, "event": { @@ -391,15 +407,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "xyz@example.com" + "address": [ + "xyz@example.com" + ] } }, "event": { diff --git a/packages/proofpoint_tap/data_stream/clicks_blocked/elasticsearch/ingest_pipeline/default.yml b/packages/proofpoint_tap/data_stream/clicks_blocked/elasticsearch/ingest_pipeline/default.yml index 8bce9cccf31..ec9cc5354ee 100644 --- a/packages/proofpoint_tap/data_stream/clicks_blocked/elasticsearch/ingest_pipeline/default.yml +++ b/packages/proofpoint_tap/data_stream/clicks_blocked/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Proofpoint TAP blocked clicks logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -34,6 +34,10 @@ processors: field: json.sender target_field: email.from.address ignore_missing: true + - set: + field: email.from.address + value: ['{{{email.from.address}}}'] + if: ctx.email?.from?.address instanceof String - rename: field: json.messageID target_field: email.message_id @@ -42,6 +46,10 @@ processors: field: json.recipient target_field: email.to.address ignore_missing: true + - set: + field: email.to.address + value: ['{{{email.to.address}}}'] + if: ctx.email?.to?.address instanceof String - date: field: json.clickTime if: ctx.json?.clickTime != null && ctx.json.clickTime != '' diff --git a/packages/proofpoint_tap/data_stream/clicks_blocked/sample_event.json b/packages/proofpoint_tap/data_stream/clicks_blocked/sample_event.json index 5494c88e408..b033663eccf 100644 --- a/packages/proofpoint_tap/data_stream/clicks_blocked/sample_event.json +++ b/packages/proofpoint_tap/data_stream/clicks_blocked/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-03-30T10:11:12.000Z", "agent": { - "ephemeral_id": "e1f6ec70-06b8-4d4b-829f-03000950c530", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "78e894c5-08ce-4680-b2d1-db307a184b72", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.clicks_blocked", @@ -34,20 +34,24 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "9c52aa64228824247c48df69b066e5a7@example.com" + "address": [ + "9c52aa64228824247c48df69b066e5a7@example.com" + ] } }, "event": { @@ -55,10 +59,10 @@ "category": [ "email" ], - "created": "2022-11-04T13:46:30.114Z", + "created": "2023-08-07T18:31:11.689Z", "dataset": "proofpoint_tap.clicks_blocked", "id": "a5c9f8bb-1234-1234-1234-dx9xxx2xx9xxx", - "ingested": "2022-11-04T13:46:33Z", + "ingested": "2023-08-07T18:31:14Z", "kind": "event", "original": "{\"GUID\":\"ZcxxxxVxyxFxyxLxxxDxVxx4xxxxx\",\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"malware\",\"clickIP\":\"89.160.20.112\",\"clickTime\":\"2022-03-30T10:11:12.000Z\",\"id\":\"a5c9f8bb-1234-1234-1234-dx9xxx2xx9xxx\",\"messageID\":\"12345678912345.12345.mail@example.com\",\"recipient\":\"9c52aa64228824247c48df69b066e5a7@example.com\",\"sender\":\"abc123@example.com\",\"senderIP\":\"81.2.69.143\",\"threatID\":\"502b7xxxx0x5x1x3xb6xcxexbxxxxxxxcxxexc6xbxxxxxxdx7fxcx6x9xxxx9xdxxxxxxxx5f\",\"threatStatus\":\"active\",\"threatTime\":\"2022-03-21T14:40:31.000Z\",\"threatURL\":\"https://threatinsight.proofpoint.com/a2abc123-1234-1234-1234-babcded1234/threat/email/502xxxxxxxxxcebxxxxxxxxxxa04277xxxxx5dxc6xxxxxxxxx5f\",\"url\":\"https://www.example.com/abcdabcd123?query=0\",\"userAgent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/199.0.427504638 Mobile/15E148 Safari/604.1\"}", "type": [ diff --git a/packages/proofpoint_tap/data_stream/clicks_permitted/_dev/test/pipeline/test-clicks-permitted.log-expected.json b/packages/proofpoint_tap/data_stream/clicks_permitted/_dev/test/pipeline/test-clicks-permitted.log-expected.json index 5809fa63e0c..0143e9d2cbb 100644 --- a/packages/proofpoint_tap/data_stream/clicks_permitted/_dev/test/pipeline/test-clicks-permitted.log-expected.json +++ b/packages/proofpoint_tap/data_stream/clicks_permitted/_dev/test/pipeline/test-clicks-permitted.log-expected.json @@ -24,15 +24,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "example.abc@example.com" + "address": [ + "example.abc@example.com" + ] } }, "event": { @@ -115,15 +119,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] } }, "event": { @@ -207,15 +215,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "exxxxxxx8x2xxxx2x6x6xxxxx6xxxx5@example.com" + "address": [ + "exxxxxxx8x2xxxx2x6x6xxxxx6xxxx5@example.com" + ] } }, "event": { @@ -298,15 +310,19 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "f3xxxx0x2xcx3xaxbxcx2xaxxxcxxxx2@example.com" + "address": [ + "f3xxxx0x2xcx3xaxbxcx2xaxxxcxxxx2@example.com" + ] } }, "event": { diff --git a/packages/proofpoint_tap/data_stream/clicks_permitted/elasticsearch/ingest_pipeline/default.yml b/packages/proofpoint_tap/data_stream/clicks_permitted/elasticsearch/ingest_pipeline/default.yml index 14282258661..59b169331d9 100644 --- a/packages/proofpoint_tap/data_stream/clicks_permitted/elasticsearch/ingest_pipeline/default.yml +++ b/packages/proofpoint_tap/data_stream/clicks_permitted/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Proofpoint TAP permitted clicks logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -34,6 +34,10 @@ processors: field: json.sender target_field: email.from.address ignore_missing: true + - set: + field: email.from.address + value: ['{{{email.from.address}}}'] + if: ctx.email?.from?.address instanceof String - rename: field: json.messageID target_field: email.message_id @@ -42,6 +46,10 @@ processors: field: json.recipient target_field: email.to.address ignore_missing: true + - set: + field: email.to.address + value: ['{{{email.to.address}}}'] + if: ctx.email?.to?.address instanceof String - date: field: json.clickTime if: ctx.json?.clickTime != null && ctx.json.clickTime != '' diff --git a/packages/proofpoint_tap/data_stream/clicks_permitted/sample_event.json b/packages/proofpoint_tap/data_stream/clicks_permitted/sample_event.json index ad4e6e7157e..ab5563b522a 100644 --- a/packages/proofpoint_tap/data_stream/clicks_permitted/sample_event.json +++ b/packages/proofpoint_tap/data_stream/clicks_permitted/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-03-21T20:39:37.000Z", "agent": { - "ephemeral_id": "166b43f0-6109-4a08-b5e2-df035102378b", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "7d9f81b5-089b-48e9-8588-08a722332bf1", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.clicks_permitted", @@ -34,20 +34,24 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] } }, "event": { @@ -55,10 +59,10 @@ "category": [ "email" ], - "created": "2022-11-04T13:47:53.521Z", + "created": "2023-08-07T18:32:06.666Z", "dataset": "proofpoint_tap.clicks_permitted", "id": "de7eef56-1234-1234-1234-5xxfx7xxxdxxxx", - "ingested": "2022-11-04T13:47:57Z", + "ingested": "2023-08-07T18:32:09Z", "kind": "event", "original": "{\"GUID\":\"cTxxxxxxzx7xxxxxxxxxx8x4xwxx\",\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"phish\",\"clickIP\":\"89.160.20.112\",\"clickTime\":\"2022-03-21T20:39:37.000Z\",\"id\":\"de7eef56-1234-1234-1234-5xxfx7xxxdxxxx\",\"messageID\":\"12345678912345.12345.mail@example.com\",\"recipient\":\"abc@example.com\",\"sender\":\"abc123@example.com\",\"senderIP\":\"81.2.69.143\",\"threatID\":\"92c17aaxxxxxxxxxx07xx7xxxx9xexcx3x3xxxxxx8xx3xxxx\",\"threatStatus\":\"active\",\"threatTime\":\"2022-03-30T10:05:57.000Z\",\"threatURL\":\"https://threatinsight.proofpoint.com/a2abc123-1234-1234-1234-babcded1234/threat/email/92c17aaxxxxxxxxxx07xx7xxxx9xexcx3x3xxxxxx8xx3xxxx\",\"url\":\"https://example.com/collab/?id=x4x3x6xsx1xxxx8xEdxexnxxxaxX\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Edg/99.0.1150.46\"}", "type": [ diff --git a/packages/proofpoint_tap/data_stream/message_blocked/_dev/test/pipeline/test-message-blocked.log-expected.json b/packages/proofpoint_tap/data_stream/message_blocked/_dev/test/pipeline/test-message-blocked.log-expected.json index 1c700049a4b..5421485580d 100644 --- a/packages/proofpoint_tap/data_stream/message_blocked/_dev/test/pipeline/test-message-blocked.log-expected.json +++ b/packages/proofpoint_tap/data_stream/message_blocked/_dev/test/pipeline/test-message-blocked.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-01-01T00:45:55.050Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -125,7 +125,7 @@ { "@timestamp": "2022-01-01T01:25:59.059Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -246,7 +246,7 @@ { "@timestamp": "2022-01-01T04:51:56.269Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -374,7 +374,7 @@ { "@timestamp": "2022-01-01T00:25:20.010Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -571,7 +571,7 @@ { "@timestamp": "2022-01-01T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -698,7 +698,7 @@ { "@timestamp": "2022-01-01T05:00:02.010Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ diff --git a/packages/proofpoint_tap/data_stream/message_blocked/elasticsearch/ingest_pipeline/default.yml b/packages/proofpoint_tap/data_stream/message_blocked/elasticsearch/ingest_pipeline/default.yml index 27e246cf877..545db7fa9ea 100644 --- a/packages/proofpoint_tap/data_stream/message_blocked/elasticsearch/ingest_pipeline/default.yml +++ b/packages/proofpoint_tap/data_stream/message_blocked/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Proofpoint TAP blocked message logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -109,6 +109,10 @@ processors: field: json.ccAddresses target_field: email.cc.address ignore_missing: true + - set: + field: email.cc.address + value: ['{{{email.cc.address}}}'] + if: ctx.email?.cc?.address instanceof String - set: field: email.delivery_timestamp copy_from: '@timestamp' @@ -117,6 +121,10 @@ processors: field: json.fromAddress target_field: email.from.address ignore_missing: true + - set: + field: email.from.address + value: ['{{{email.from.address}}}'] + if: ctx.email?.from?.address instanceof String - rename: field: json.messageID target_field: email.message_id @@ -142,6 +150,10 @@ processors: field: email.to.address copy_from: json.toAddresses ignore_failure: true + - set: + field: email.to.address + value: ['{{{email.to.address}}}'] + if: ctx.email?.to?.address instanceof String - foreach: field: json.recipient processor: diff --git a/packages/proofpoint_tap/data_stream/message_blocked/sample_event.json b/packages/proofpoint_tap/data_stream/message_blocked/sample_event.json index 01804ae72c7..d6c856dae74 100644 --- a/packages/proofpoint_tap/data_stream/message_blocked/sample_event.json +++ b/packages/proofpoint_tap/data_stream/message_blocked/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-11-25T09:10:00.050Z", "agent": { - "ephemeral_id": "1579c7ca-be80-484e-b548-3980ec85934f", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "1ac91299-2df1-4476-ab43-293b76348bf8", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.message_blocked", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -50,7 +50,9 @@ }, "delivery_timestamp": "2021-11-25T09:10:00.050Z", "from": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "sender": { @@ -70,9 +72,9 @@ "category": [ "email" ], - "created": "2022-11-04T13:49:23.293Z", + "created": "2023-08-07T18:33:01.901Z", "dataset": "proofpoint_tap.message_blocked", - "ingested": "2022-11-04T13:49:26Z", + "ingested": "2023-08-07T18:33:04Z", "kind": "event", "original": "{\"GUID\":\"x11xxxx1-12f9-111x-x12x-1x1x123456xx\",\"QID\":\"x2XXxXXX111111\",\"ccAddresses\":[\"abc@example.com\"],\"clusterId\":\"pharmtech_hosted\",\"completelyRewritten\":\"true\",\"fromAddress\":\"abc@example.com\",\"headerCC\":\"\\\"Example Abc\\\" \\u003cabc@example.com\\u003e\",\"headerFrom\":\"\\\"A. Bc\\\" \\u003cabc@example.com\\u003e\",\"headerReplyTo\":null,\"headerTo\":\"\\\"Aa Bb\\\" \\u003caa.bb@example.com\\u003e; \\\"Hey Hello\\\" \\u003chey.hello@example.com\\u003e\",\"impostorScore\":0,\"malwareScore\":100,\"messageID\":\"12345678912345.12345.mail@example.com\",\"messageParts\":[{\"contentType\":\"text/plain\",\"disposition\":\"inline\",\"filename\":\"text.txt\",\"md5\":\"b10a8db164e0754105b7a99be72e3fe5\",\"oContentType\":\"text/plain\",\"sandboxStatus\":\"unsupported\",\"sha256\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\"},{\"contentType\":\"application/pdf\",\"disposition\":\"attached\",\"filename\":\"text.pdf\",\"md5\":\"b10a8db164e0754105b7a99be72e3fe5\",\"oContentType\":\"application/pdf\",\"sandboxStatus\":\"threat\",\"sha256\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\"}],\"messageTime\":\"2021-11-25T09:10:00.050Z\",\"modulesRun\":[\"pdr\",\"sandbox\",\"spam\",\"urldefense\"],\"phishScore\":46,\"policyRoutes\":[\"default_inbound\",\"executives\"],\"quarantineFolder\":\"Attachment Defense\",\"quarantineRule\":\"module.sandbox.threat\",\"recipient\":[\"example.abc@example.com\",\"hey.hello@example.com\"],\"replyToAddress\":null,\"sender\":\"x99x7x5580193x6x51x597xx2x0210@example.com\",\"senderIP\":\"175.16.199.1\",\"spamScore\":4,\"subject\":\"Please find a totally safe invoice attached.\",\"threatsInfoMap\":[{\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"MALWARE\",\"threat\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\",\"threatId\":\"2xxx740f143fc1aa4c1cd0146d334x5593b1428x6x062b2c406e5efe8xxx95xx\",\"threatStatus\":\"active\",\"threatTime\":\"2021-11-25T09:10:00.050Z\",\"threatType\":\"ATTACHMENT\",\"threatUrl\":\"https://www.example.com/?name=john\"},{\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"MALWARE\",\"threat\":\"example.com\",\"threatId\":\"3xx97xx852c66a7xx761450xxxxxx9f4ffab74715b591294f78b5e37a76481xx\",\"threatTime\":\"2021-07-20T05:00:00.050Z\",\"threatType\":\"URL\",\"threatUrl\":\"https://www.example.com/?name=john\"}],\"toAddresses\":[\"example.abc@example.com\",\"hey.hello@example.com\"],\"xmailer\":\"Spambot v2.5\"}", "type": [ diff --git a/packages/proofpoint_tap/data_stream/message_delivered/_dev/test/pipeline/test-message-delivered.log-expected.json b/packages/proofpoint_tap/data_stream/message_delivered/_dev/test/pipeline/test-message-delivered.log-expected.json index 6258f54459a..c23adee3c25 100644 --- a/packages/proofpoint_tap/data_stream/message_delivered/_dev/test/pipeline/test-message-delivered.log-expected.json +++ b/packages/proofpoint_tap/data_stream/message_delivered/_dev/test/pipeline/test-message-delivered.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-01-05T10:05:56.020Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-05T10:05:56.020Z", @@ -90,7 +90,7 @@ { "@timestamp": "2022-01-01T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-01T00:00:00.000Z", @@ -160,7 +160,7 @@ { "@timestamp": "2022-01-01T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-01T00:00:00.000Z", @@ -236,7 +236,7 @@ { "@timestamp": "2022-01-01T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-01T00:00:00.000Z", @@ -312,7 +312,7 @@ { "@timestamp": "2022-03-15T15:00:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -460,7 +460,7 @@ { "@timestamp": "2021-09-28T16:28:59.490Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -615,7 +615,7 @@ { "@timestamp": "2022-08-17T18:00:22.060Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -764,7 +764,7 @@ { "@timestamp": "2022-03-24T13:24:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "attachments": [ diff --git a/packages/proofpoint_tap/data_stream/message_delivered/elasticsearch/ingest_pipeline/default.yml b/packages/proofpoint_tap/data_stream/message_delivered/elasticsearch/ingest_pipeline/default.yml index f2949fba5c8..6a15288581d 100644 --- a/packages/proofpoint_tap/data_stream/message_delivered/elasticsearch/ingest_pipeline/default.yml +++ b/packages/proofpoint_tap/data_stream/message_delivered/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Proofpoint TAP delivered message logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -109,6 +109,10 @@ processors: field: json.ccAddresses target_field: email.cc.address ignore_missing: true + - set: + field: email.cc.address + value: ['{{{email.cc.address}}}'] + if: ctx.email?.cc?.address instanceof String - set: field: email.delivery_timestamp copy_from: '@timestamp' @@ -117,6 +121,10 @@ processors: field: json.fromAddress target_field: email.from.address ignore_missing: true + - set: + field: email.from.address + value: ['{{{email.from.address}}}'] + if: ctx.email?.from?.address instanceof String - rename: field: json.messageID target_field: email.message_id @@ -142,6 +150,10 @@ processors: field: email.to.address copy_from: json.toAddresses ignore_failure: true + - set: + field: email.to.address + value: ['{{{email.to.address}}}'] + if: ctx.email?.to?.address instanceof String - foreach: field: json.recipient processor: diff --git a/packages/proofpoint_tap/data_stream/message_delivered/sample_event.json b/packages/proofpoint_tap/data_stream/message_delivered/sample_event.json index b595a535eb8..94006279448 100644 --- a/packages/proofpoint_tap/data_stream/message_delivered/sample_event.json +++ b/packages/proofpoint_tap/data_stream/message_delivered/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-01-01T00:00:00.000Z", "agent": { - "ephemeral_id": "ebf5b065-0108-4db5-9431-ef67a62dcec4", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "5966500d-85d6-408f-91f5-1a2fabd4fd8e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.message_delivered", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-01T00:00:00.000Z", @@ -33,10 +33,10 @@ "category": [ "email" ], - "created": "2022-11-04T13:50:51.734Z", + "created": "2023-08-07T18:33:57.755Z", "dataset": "proofpoint_tap.message_delivered", "id": "2hsvbU-i8abc123-12345-xxxxx12", - "ingested": "2022-11-04T13:50:55Z", + "ingested": "2023-08-07T18:34:00Z", "kind": "event", "original": "{\"GUID\":\"NxxxsxvxbxUxixcx2xxxxx5x6xWxBxOxxxxxjxx\",\"QID\":null,\"ccAddresses\":null,\"cluster\":\"pharmtech_hosted\",\"completelyRewritten\":true,\"fromAddress\":null,\"headerFrom\":null,\"headerReplyTo\":null,\"id\":\"2hsvbU-i8abc123-12345-xxxxx12\",\"impostorScore\":0,\"malwareScore\":0,\"messageID\":\"\",\"messageParts\":null,\"messageSize\":0,\"messageTime\":\"2022-01-01T00:00:00.000Z\",\"modulesRun\":null,\"phishScore\":0,\"policyRoutes\":null,\"quarantineFolder\":null,\"quarantineRule\":null,\"recipient\":[\"fxxxxhxsxxvxbcx2xx5xxx6x3xx26@example.com\"],\"replyToAddress\":null,\"sender\":\"\",\"senderIP\":\"89.160.20.112\",\"spamScore\":0,\"subject\":null,\"threatsInfoMap\":[{\"campaignID\":null,\"classification\":\"spam\",\"threat\":\"http://zbcd123456x0.example.com\",\"threatID\":\"b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\",\"threatStatus\":\"active\",\"threatTime\":\"2021-11-25T13:02:58.640Z\",\"threatType\":\"url\",\"threatUrl\":\"https://threatinsight.proofpoint.com/aaabcdef-1234-b1abcdefghe/threat/email/b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\"},{\"campaignID\":null,\"classification\":\"phish\",\"threat\":\"http://zbcd123456x0.example.com\",\"threatID\":\"aaabcdefg123456f009971a9c193abcdefg123456bf5abcdefg1234566\",\"threatStatus\":\"active\",\"threatTime\":\"2021-07-19T10:28:15.100Z\",\"threatType\":\"url\",\"threatUrl\":\"https://threatinsight.proofpoint.com/aaabcdef-1234-b1abcdefghe/threat/email/b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\"}],\"toAddresses\":null,\"xmailer\":null}", "type": [ diff --git a/packages/proofpoint_tap/docs/README.md b/packages/proofpoint_tap/docs/README.md index 80079a4d805..8d3f048870a 100644 --- a/packages/proofpoint_tap/docs/README.md +++ b/packages/proofpoint_tap/docs/README.md @@ -31,11 +31,11 @@ An example event for `clicks_blocked` looks as following: { "@timestamp": "2022-03-30T10:11:12.000Z", "agent": { - "ephemeral_id": "e1f6ec70-06b8-4d4b-829f-03000950c530", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "78e894c5-08ce-4680-b2d1-db307a184b72", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.clicks_blocked", @@ -64,20 +64,24 @@ An example event for `clicks_blocked` looks as following: "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "9c52aa64228824247c48df69b066e5a7@example.com" + "address": [ + "9c52aa64228824247c48df69b066e5a7@example.com" + ] } }, "event": { @@ -85,10 +89,10 @@ An example event for `clicks_blocked` looks as following: "category": [ "email" ], - "created": "2022-11-04T13:46:30.114Z", + "created": "2023-08-07T18:31:11.689Z", "dataset": "proofpoint_tap.clicks_blocked", "id": "a5c9f8bb-1234-1234-1234-dx9xxx2xx9xxx", - "ingested": "2022-11-04T13:46:33Z", + "ingested": "2023-08-07T18:31:14Z", "kind": "event", "original": "{\"GUID\":\"ZcxxxxVxyxFxyxLxxxDxVxx4xxxxx\",\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"malware\",\"clickIP\":\"89.160.20.112\",\"clickTime\":\"2022-03-30T10:11:12.000Z\",\"id\":\"a5c9f8bb-1234-1234-1234-dx9xxx2xx9xxx\",\"messageID\":\"12345678912345.12345.mail@example.com\",\"recipient\":\"9c52aa64228824247c48df69b066e5a7@example.com\",\"sender\":\"abc123@example.com\",\"senderIP\":\"81.2.69.143\",\"threatID\":\"502b7xxxx0x5x1x3xb6xcxexbxxxxxxxcxxexc6xbxxxxxxdx7fxcx6x9xxxx9xdxxxxxxxx5f\",\"threatStatus\":\"active\",\"threatTime\":\"2022-03-21T14:40:31.000Z\",\"threatURL\":\"https://threatinsight.proofpoint.com/a2abc123-1234-1234-1234-babcded1234/threat/email/502xxxxxxxxxcebxxxxxxxxxxa04277xxxxx5dxc6xxxxxxxxx5f\",\"url\":\"https://www.example.com/abcdabcd123?query=0\",\"userAgent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/199.0.427504638 Mobile/15E148 Safari/604.1\"}", "type": [ @@ -185,10 +189,10 @@ An example event for `clicks_blocked` looks as following: | email.message_id | Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. | wildcard | | email.to.address | The email address of recipient | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -259,11 +263,11 @@ An example event for `clicks_permitted` looks as following: { "@timestamp": "2022-03-21T20:39:37.000Z", "agent": { - "ephemeral_id": "166b43f0-6109-4a08-b5e2-df035102378b", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "7d9f81b5-089b-48e9-8588-08a722332bf1", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.clicks_permitted", @@ -292,20 +296,24 @@ An example event for `clicks_permitted` looks as following: "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "from": { - "address": "abc123@example.com" + "address": [ + "abc123@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "to": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] } }, "event": { @@ -313,10 +321,10 @@ An example event for `clicks_permitted` looks as following: "category": [ "email" ], - "created": "2022-11-04T13:47:53.521Z", + "created": "2023-08-07T18:32:06.666Z", "dataset": "proofpoint_tap.clicks_permitted", "id": "de7eef56-1234-1234-1234-5xxfx7xxxdxxxx", - "ingested": "2022-11-04T13:47:57Z", + "ingested": "2023-08-07T18:32:09Z", "kind": "event", "original": "{\"GUID\":\"cTxxxxxxzx7xxxxxxxxxx8x4xwxx\",\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"phish\",\"clickIP\":\"89.160.20.112\",\"clickTime\":\"2022-03-21T20:39:37.000Z\",\"id\":\"de7eef56-1234-1234-1234-5xxfx7xxxdxxxx\",\"messageID\":\"12345678912345.12345.mail@example.com\",\"recipient\":\"abc@example.com\",\"sender\":\"abc123@example.com\",\"senderIP\":\"81.2.69.143\",\"threatID\":\"92c17aaxxxxxxxxxx07xx7xxxx9xexcx3x3xxxxxx8xx3xxxx\",\"threatStatus\":\"active\",\"threatTime\":\"2022-03-30T10:05:57.000Z\",\"threatURL\":\"https://threatinsight.proofpoint.com/a2abc123-1234-1234-1234-babcded1234/threat/email/92c17aaxxxxxxxxxx07xx7xxxx9xexcx3x3xxxxxx8xx3xxxx\",\"url\":\"https://example.com/collab/?id=x4x3x6xsx1xxxx8xEdxexnxxxaxX\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36 Edg/99.0.1150.46\"}", "type": [ @@ -413,10 +421,10 @@ An example event for `clicks_permitted` looks as following: | email.message_id | Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message. | wildcard | | email.to.address | The email address of recipient | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -485,11 +493,11 @@ An example event for `message_blocked` looks as following: { "@timestamp": "2021-11-25T09:10:00.050Z", "agent": { - "ephemeral_id": "1579c7ca-be80-484e-b548-3980ec85934f", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "1ac91299-2df1-4476-ab43-293b76348bf8", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.message_blocked", @@ -497,12 +505,12 @@ An example event for `message_blocked` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "attachments": [ @@ -534,7 +542,9 @@ An example event for `message_blocked` looks as following: }, "delivery_timestamp": "2021-11-25T09:10:00.050Z", "from": { - "address": "abc@example.com" + "address": [ + "abc@example.com" + ] }, "message_id": "12345678912345.12345.mail@example.com", "sender": { @@ -554,9 +564,9 @@ An example event for `message_blocked` looks as following: "category": [ "email" ], - "created": "2022-11-04T13:49:23.293Z", + "created": "2023-08-07T18:33:01.901Z", "dataset": "proofpoint_tap.message_blocked", - "ingested": "2022-11-04T13:49:26Z", + "ingested": "2023-08-07T18:33:04Z", "kind": "event", "original": "{\"GUID\":\"x11xxxx1-12f9-111x-x12x-1x1x123456xx\",\"QID\":\"x2XXxXXX111111\",\"ccAddresses\":[\"abc@example.com\"],\"clusterId\":\"pharmtech_hosted\",\"completelyRewritten\":\"true\",\"fromAddress\":\"abc@example.com\",\"headerCC\":\"\\\"Example Abc\\\" \\u003cabc@example.com\\u003e\",\"headerFrom\":\"\\\"A. Bc\\\" \\u003cabc@example.com\\u003e\",\"headerReplyTo\":null,\"headerTo\":\"\\\"Aa Bb\\\" \\u003caa.bb@example.com\\u003e; \\\"Hey Hello\\\" \\u003chey.hello@example.com\\u003e\",\"impostorScore\":0,\"malwareScore\":100,\"messageID\":\"12345678912345.12345.mail@example.com\",\"messageParts\":[{\"contentType\":\"text/plain\",\"disposition\":\"inline\",\"filename\":\"text.txt\",\"md5\":\"b10a8db164e0754105b7a99be72e3fe5\",\"oContentType\":\"text/plain\",\"sandboxStatus\":\"unsupported\",\"sha256\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\"},{\"contentType\":\"application/pdf\",\"disposition\":\"attached\",\"filename\":\"text.pdf\",\"md5\":\"b10a8db164e0754105b7a99be72e3fe5\",\"oContentType\":\"application/pdf\",\"sandboxStatus\":\"threat\",\"sha256\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\"}],\"messageTime\":\"2021-11-25T09:10:00.050Z\",\"modulesRun\":[\"pdr\",\"sandbox\",\"spam\",\"urldefense\"],\"phishScore\":46,\"policyRoutes\":[\"default_inbound\",\"executives\"],\"quarantineFolder\":\"Attachment Defense\",\"quarantineRule\":\"module.sandbox.threat\",\"recipient\":[\"example.abc@example.com\",\"hey.hello@example.com\"],\"replyToAddress\":null,\"sender\":\"x99x7x5580193x6x51x597xx2x0210@example.com\",\"senderIP\":\"175.16.199.1\",\"spamScore\":4,\"subject\":\"Please find a totally safe invoice attached.\",\"threatsInfoMap\":[{\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"MALWARE\",\"threat\":\"a591a6d40bf420404a011733cfb7b190d62c65bf0bcda32b57b277d9ad9f146e\",\"threatId\":\"2xxx740f143fc1aa4c1cd0146d334x5593b1428x6x062b2c406e5efe8xxx95xx\",\"threatStatus\":\"active\",\"threatTime\":\"2021-11-25T09:10:00.050Z\",\"threatType\":\"ATTACHMENT\",\"threatUrl\":\"https://www.example.com/?name=john\"},{\"campaignId\":\"46x01x8x-x899-404x-xxx9-111xx393d1x7\",\"classification\":\"MALWARE\",\"threat\":\"example.com\",\"threatId\":\"3xx97xx852c66a7xx761450xxxxxx9f4ffab74715b591294f78b5e37a76481xx\",\"threatTime\":\"2021-07-20T05:00:00.050Z\",\"threatType\":\"URL\",\"threatUrl\":\"https://www.example.com/?name=john\"}],\"toAddresses\":[\"example.abc@example.com\",\"hey.hello@example.com\"],\"xmailer\":\"Spambot v2.5\"}", "type": [ @@ -711,10 +721,10 @@ An example event for `message_blocked` looks as following: | email.to.address | The email address of recipient | keyword | | email.x_mailer | The name of the application that was used to draft and send the original email message. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -793,11 +803,11 @@ An example event for `message_delivered` looks as following: { "@timestamp": "2022-01-01T00:00:00.000Z", "agent": { - "ephemeral_id": "ebf5b065-0108-4db5-9431-ef67a62dcec4", - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "ephemeral_id": "5966500d-85d6-408f-91f5-1a2fabd4fd8e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.0" }, "data_stream": { "dataset": "proofpoint_tap.message_delivered", @@ -805,12 +815,12 @@ An example event for `message_delivered` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "19f05486-b68d-449a-9bdd-1493d2f3b55d", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.4.0" + "version": "8.9.0" }, "email": { "delivery_timestamp": "2022-01-01T00:00:00.000Z", @@ -825,10 +835,10 @@ An example event for `message_delivered` looks as following: "category": [ "email" ], - "created": "2022-11-04T13:50:51.734Z", + "created": "2023-08-07T18:33:57.755Z", "dataset": "proofpoint_tap.message_delivered", "id": "2hsvbU-i8abc123-12345-xxxxx12", - "ingested": "2022-11-04T13:50:55Z", + "ingested": "2023-08-07T18:34:00Z", "kind": "event", "original": "{\"GUID\":\"NxxxsxvxbxUxixcx2xxxxx5x6xWxBxOxxxxxjxx\",\"QID\":null,\"ccAddresses\":null,\"cluster\":\"pharmtech_hosted\",\"completelyRewritten\":true,\"fromAddress\":null,\"headerFrom\":null,\"headerReplyTo\":null,\"id\":\"2hsvbU-i8abc123-12345-xxxxx12\",\"impostorScore\":0,\"malwareScore\":0,\"messageID\":\"\",\"messageParts\":null,\"messageSize\":0,\"messageTime\":\"2022-01-01T00:00:00.000Z\",\"modulesRun\":null,\"phishScore\":0,\"policyRoutes\":null,\"quarantineFolder\":null,\"quarantineRule\":null,\"recipient\":[\"fxxxxhxsxxvxbcx2xx5xxx6x3xx26@example.com\"],\"replyToAddress\":null,\"sender\":\"\",\"senderIP\":\"89.160.20.112\",\"spamScore\":0,\"subject\":null,\"threatsInfoMap\":[{\"campaignID\":null,\"classification\":\"spam\",\"threat\":\"http://zbcd123456x0.example.com\",\"threatID\":\"b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\",\"threatStatus\":\"active\",\"threatTime\":\"2021-11-25T13:02:58.640Z\",\"threatType\":\"url\",\"threatUrl\":\"https://threatinsight.proofpoint.com/aaabcdef-1234-b1abcdefghe/threat/email/b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\"},{\"campaignID\":null,\"classification\":\"phish\",\"threat\":\"http://zbcd123456x0.example.com\",\"threatID\":\"aaabcdefg123456f009971a9c193abcdefg123456bf5abcdefg1234566\",\"threatStatus\":\"active\",\"threatTime\":\"2021-07-19T10:28:15.100Z\",\"threatType\":\"url\",\"threatUrl\":\"https://threatinsight.proofpoint.com/aaabcdef-1234-b1abcdefghe/threat/email/b7exxxxxxxx0d10xxxxxxe2xxxxxxxxxxxx81cxxxxxx034ac9cxxxxxxxxxxxxb\"}],\"toAddresses\":null,\"xmailer\":null}", "type": [ @@ -949,10 +959,10 @@ An example event for `message_delivered` looks as following: | email.to.address | The email address of recipient | keyword | | email.x_mailer | The name of the application that was used to draft and send the original email message. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/proofpoint_tap/kibana/tags.yml b/packages/proofpoint_tap/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/proofpoint_tap/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/proofpoint_tap/manifest.yml b/packages/proofpoint_tap/manifest.yml index 2ac6074a729..5fdf9532d20 100644 --- a/packages/proofpoint_tap/manifest.yml +++ b/packages/proofpoint_tap/manifest.yml @@ -1,14 +1,12 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: proofpoint_tap title: Proofpoint TAP -version: "1.8.0" -license: basic +version: "1.11.0" description: Collect logs from Proofpoint TAP with Elastic Agent. type: integration categories: - security - email_security -release: ga conditions: kibana.version: ^8.7.1 screenshots: diff --git a/packages/pulse_connect_secure/_dev/build/build.yml b/packages/pulse_connect_secure/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/pulse_connect_secure/_dev/build/build.yml +++ b/packages/pulse_connect_secure/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/pulse_connect_secure/changelog.yml b/packages/pulse_connect_secure/changelog.yml index b9ed8e321d6..02806389868 100644 --- a/packages/pulse_connect_secure/changelog.yml +++ b/packages/pulse_connect_secure/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7298 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-admin.log-expected.json b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-admin.log-expected.json index a4c6bd1b0d2..5f9fc9db9c9 100644 --- a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-admin.log-expected.json +++ b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-admin.log-expected.json @@ -25,7 +25,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -39,7 +39,9 @@ }, "message": "Connection from IP 89.160.20.156 not authenticated yet (URL=/dana-na/auth/welcome.cgi?p=forced-off)", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -85,7 +87,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -99,7 +101,9 @@ }, "message": "Connection from IP 89.160.20.156 not authenticated yet (URL=/dana-na/auth/url_o2d6zvh39ac6C92s/welcome.cgi?p=forced-off)", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -145,7 +149,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -159,7 +163,9 @@ }, "message": "Source IP realm restrictions successfully passed for admin/ADMIN_REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -223,7 +229,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -237,7 +243,9 @@ }, "message": "User Limit realm restrictions successfully passed for admin/ADMIN_REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -301,7 +309,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -317,7 +325,9 @@ }, "message": "Login failed. Reason: Wrong Password", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -381,7 +391,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -395,7 +405,9 @@ }, "message": "Primary authentication failed for admin/Administrators from 89.160.20.156", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -459,7 +471,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -475,7 +487,9 @@ }, "message": "Login failed using auth server Administrators (Local Authentication). Reason: Failed", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -539,7 +553,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -553,7 +567,9 @@ }, "message": "Source IP realm restrictions successfully passed for admin/ADMIN_REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -617,7 +633,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -631,7 +647,9 @@ }, "message": "User Limit realm restrictions successfully passed for admin/ADMIN_REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -695,7 +713,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -709,7 +727,9 @@ }, "message": "Primary authentication successful for admin/Administrators fr", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", diff --git a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json index aacb3c09a84..cffceeefa81 100644 --- a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json +++ b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json @@ -25,7 +25,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -41,7 +41,9 @@ }, "message": "Primary authentication successful for username/REALM from 89.160.20.156", "observer": { - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "pcs-name", "product": "Pulse Secure Connect", "type": "vpn", @@ -105,7 +107,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -121,7 +123,9 @@ }, "message": "Host Checker policy 'HC_POLICY' passed on host '89.160.20.156' address '2D-FF-88-AA-BB-DC' for user 'username'.", "observer": { - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "pcs-name", "product": "Pulse Secure Connect", "type": "vpn", @@ -185,7 +189,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -201,7 +205,9 @@ }, "message": "Syslog server 81.2.69.144 (facility LOCAL5, filter Standard, type UDP, interface Global) removed from Events logs", "observer": { - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "pcs-name", "product": "Pulse Secure Connect", "type": "vpn", @@ -247,7 +253,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -263,7 +269,9 @@ }, "message": "The current virus signature list imported successfully.", "observer": { - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "pcs-name", "product": "Pulse Secure Connect", "type": "vpn", @@ -291,7 +299,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -307,7 +315,9 @@ }, "message": "The current virus signature list downloaded successfully from 'https://download.pulsesecure.net/software/av/uac/epupdate_hist.xml'", "observer": { - "ip": "89.160.20.112", + "ip": [ + "89.160.20.112" + ], "name": "pcs-name", "product": "Pulse Secure Connect", "type": "vpn", diff --git a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-system.log-expected.json b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-system.log-expected.json index aea32ef013d..ea11dee4c48 100644 --- a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-system.log-expected.json +++ b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-system.log-expected.json @@ -7,7 +7,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -21,7 +21,9 @@ }, "message": "No new virus signature list available from 'https://download.pulsesecure.net/software/av/uac/epupdate_hist.xml'.", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node0", "product": "Pulse Secure Connect", "type": "vpn", @@ -67,7 +69,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -81,7 +83,9 @@ }, "message": "User Limit realm restrictions successfully passed for /REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -127,7 +131,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -141,7 +145,9 @@ }, "message": "Integrity Checker Tool: Periodic Scan Started!", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node0", "product": "Pulse Secure Connect", "type": "vpn", @@ -169,7 +175,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -183,7 +189,9 @@ }, "message": "Integrity Scan Completed: Integrity Scan Results : Matched Files 18773, Newly Detected Files 0, Mismatched Files 0", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node0", "product": "Pulse Secure Connect", "type": "vpn", @@ -211,7 +219,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -225,7 +233,9 @@ }, "message": "Integrity Checker Tool: Periodic Scan Finished!", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node0", "product": "Pulse Secure Connect", "type": "vpn", @@ -271,7 +281,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -285,7 +295,9 @@ }, "message": "User user.name denied access as the client version '9.1.11.6725' is lower than the minimum client version configured", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -349,7 +361,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -430,7 +442,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", diff --git a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-vpn.log-expected.json b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-vpn.log-expected.json index 32b538f3c99..e148d293f25 100644 --- a/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-vpn.log-expected.json +++ b/packages/pulse_connect_secure/data_stream/log/_dev/test/pipeline/test-log-vpn.log-expected.json @@ -25,7 +25,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -39,7 +39,9 @@ }, "message": "Primary authentication successful for user.name/REALM from 89.160.20.156", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -103,7 +105,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -118,7 +120,9 @@ }, "message": "Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -200,7 +204,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -223,7 +227,9 @@ "type": "ipv4" }, "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -293,7 +299,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -307,7 +313,9 @@ }, "message": "VPN Tunneling: User with IP 172.22.27.209 connected with SSL transport mode.", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -371,7 +379,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -385,7 +393,9 @@ }, "message": "User Limit realm restrictions successfully passed for user.name/REALM", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -449,7 +459,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -465,7 +475,9 @@ }, "message": "Login failed. Reason: Wrong Password", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -529,7 +541,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -543,7 +555,9 @@ }, "message": "Primary authentication failed for user.name/sign-in-page from 89.160.20.156", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -607,7 +621,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -623,7 +637,9 @@ }, "message": "Login failed using auth server AuthServer (Local Authentication). Reason: Failed", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -687,7 +703,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -701,7 +717,9 @@ }, "message": "Closed connection to TUN-VPN port 443 after 9 seconds, with 1308 bytes read (in 1 chunks) and 1131 bytes written (in 1 chunks) (session:sid085594569c49f5da11e483b49eaaabfc6fede5ce4a227da4)", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -771,7 +789,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -793,7 +811,9 @@ "type": "ipv4" }, "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -863,7 +883,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -877,7 +897,9 @@ }, "message": "Logout from 89.160.20.156 (session:sid085594569c49f5da11e483b49eaaabfc6fede5ce4a227da4)", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -944,7 +966,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -958,7 +980,9 @@ }, "message": "Session resumed from user agent 'Pulse-Secure/9.1.11.6725 (Windows 10) Pulse/9.1.11.6725' (session:sid9734dc3a195205ddb89cc05a9261a271201b4687ab468240).", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -1037,7 +1061,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": "network", @@ -1053,7 +1077,9 @@ }, "message": "WebRequest completed, GET to https://some.web.ch:443//sss/sessionPing?unique=0.10846163950738053 from 81.2.69.144 result=200 sent=60 received=4 in 1 seconds", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "sslvpn02", "product": "Pulse Secure Connect", "type": "vpn", diff --git a/packages/pulse_connect_secure/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/pulse_connect_secure/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 798e0b4883e..92d0dd15aae 100644 --- a/packages/pulse_connect_secure/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/pulse_connect_secure/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Pulse Connect Secure logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -116,9 +116,11 @@ processors: - set: field: source copy_from: client + - set: + field: observer.ip + value: ['{{{observer.ip}}}'] + if: ctx.observer?.ip instanceof String - - - remove: field: - _tmp diff --git a/packages/pulse_connect_secure/data_stream/log/sample_event.json b/packages/pulse_connect_secure/data_stream/log/sample_event.json index a9ad5f257fd..a700738e04c 100644 --- a/packages/pulse_connect_secure/data_stream/log/sample_event.json +++ b/packages/pulse_connect_secure/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-10-19T09:10:35.000+02:00", "agent": { - "ephemeral_id": "48b94170-8de9-42a4-8608-50484a347a6a", - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "ephemeral_id": "dbefdcf7-8da3-42ce-a1dd-919d2f3e0611", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.9.0" }, "client": { "address": "89.160.20.156", @@ -35,21 +35,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": "network", "created": "2021-10-19T09:10:35.000+02:00", "dataset": "pulse_connect_secure.log", - "ingested": "2022-02-03T09:39:02Z", + "ingested": "2023-08-07T18:48:45Z", "kind": "event", - "original": "Oct 19 09:10:35 pcs-node1 1 2021-10-19T09:10:35+02:00 10.5.2.3 PulseSecure: - - - 2021-10-19 09:10:35 - pcs-node1 - [89.160.20.156] user.name(REALM)[REALM_ROLES] - Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.\n", + "original": "Oct 19 09:10:35 pcs-node1 1 2021-10-19T09:10:35+02:00 10.5.2.3 PulseSecure: - - - 2021-10-19 09:10:35 - pcs-node1 - [89.160.20.156] user.name(REALM)[REALM_ROLES] - Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "outcome": "success", "timezone": "+02:00" }, @@ -57,16 +57,18 @@ "hostname": "pcs-node1" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "source": { - "address": "172.19.0.7:51695" + "address": "192.168.176.4:55846" } }, "message": "Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", diff --git a/packages/pulse_connect_secure/docs/README.md b/packages/pulse_connect_secure/docs/README.md index e4a79434311..9fecbe383ce 100644 --- a/packages/pulse_connect_secure/docs/README.md +++ b/packages/pulse_connect_secure/docs/README.md @@ -10,11 +10,11 @@ An example event for `log` looks as following: { "@timestamp": "2021-10-19T09:10:35.000+02:00", "agent": { - "ephemeral_id": "48b94170-8de9-42a4-8608-50484a347a6a", - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "ephemeral_id": "dbefdcf7-8da3-42ce-a1dd-919d2f3e0611", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.9.0" }, "client": { "address": "89.160.20.156", @@ -44,21 +44,21 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "584f3aea-648c-4e58-aba4-32b8f88d4396", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": "network", "created": "2021-10-19T09:10:35.000+02:00", "dataset": "pulse_connect_secure.log", - "ingested": "2022-02-03T09:39:02Z", + "ingested": "2023-08-07T18:48:45Z", "kind": "event", - "original": "Oct 19 09:10:35 pcs-node1 1 2021-10-19T09:10:35+02:00 10.5.2.3 PulseSecure: - - - 2021-10-19 09:10:35 - pcs-node1 - [89.160.20.156] user.name(REALM)[REALM_ROLES] - Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.\n", + "original": "Oct 19 09:10:35 pcs-node1 1 2021-10-19T09:10:35+02:00 10.5.2.3 PulseSecure: - - - 2021-10-19 09:10:35 - pcs-node1 - [89.160.20.156] user.name(REALM)[REALM_ROLES] - Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "outcome": "success", "timezone": "+02:00" }, @@ -66,16 +66,18 @@ An example event for `log` looks as following: "hostname": "pcs-node1" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "source": { - "address": "172.19.0.7:51695" + "address": "192.168.176.4:55846" } }, "message": "Agent login succeeded for user.name/REALM (session:sid74fa8e00ca601280318287f67dfaee7cc6da40db0be6ac75) from 89.160.20.156 with Pulse-Secure/9.1.13.11723 (Windows 10) Pulse/9.1.13.11723.", "observer": { - "ip": "10.5.2.3", + "ip": [ + "10.5.2.3" + ], "name": "pcs-node1", "product": "Pulse Secure Connect", "type": "vpn", @@ -168,7 +170,7 @@ An example event for `log` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/pulse_connect_secure/kibana/tags.yml b/packages/pulse_connect_secure/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/pulse_connect_secure/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/pulse_connect_secure/manifest.yml b/packages/pulse_connect_secure/manifest.yml index b450b22e693..523204de513 100644 --- a/packages/pulse_connect_secure/manifest.yml +++ b/packages/pulse_connect_secure/manifest.yml @@ -1,7 +1,6 @@ name: pulse_connect_secure title: Pulse Connect Secure -version: "1.10.0" -release: ga +version: "1.14.0" description: Collect logs from Pulse Connect Secure with Elastic Agent. type: integration icons: @@ -9,11 +8,11 @@ icons: title: pulse_connect_secure size: 300x70 type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [vpn_security, security] conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" policy_templates: - name: pulse_connect_secure title: Pulse Connect Secure logs @@ -27,3 +26,4 @@ policy_templates: description: "Collecting logs from Pulse Connect Secure instances (input: tcp)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/qnap_nas/_dev/build/build.yml b/packages/qnap_nas/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/qnap_nas/_dev/build/build.yml +++ b/packages/qnap_nas/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/qnap_nas/changelog.yml b/packages/qnap_nas/changelog.yml index 105c00df9f1..e6218568728 100644 --- a/packages/qnap_nas/changelog.yml +++ b/packages/qnap_nas/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.12.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6904 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json index 4d2c86f8956..132ee535a33 100644 --- a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json +++ b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-10-30T20:24:24.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create-directory", @@ -73,7 +73,7 @@ { "@timestamp": "2023-10-30T20:24:25.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-fail", @@ -138,7 +138,7 @@ { "@timestamp": "2023-10-30T20:35:25.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-success", @@ -203,7 +203,7 @@ { "@timestamp": "2023-11-21T14:42:18.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-success", @@ -265,7 +265,7 @@ { "@timestamp": "2023-10-30T20:35:25.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logout", @@ -329,7 +329,7 @@ { "@timestamp": "2023-10-30T20:24:30.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -396,7 +396,7 @@ { "@timestamp": "2023-10-30T20:24:30.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rename", @@ -461,7 +461,7 @@ { "@timestamp": "2023-10-30T20:24:33.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -531,7 +531,7 @@ { "@timestamp": "2023-10-30T20:43:19.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -602,7 +602,7 @@ { "@timestamp": "2023-10-30T20:43:19.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "add", diff --git a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log-expected.json b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log-expected.json index 5b82ccba974..293a7a49861 100644 --- a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log-expected.json +++ b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-10-30T20:28:41.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -55,7 +55,7 @@ { "@timestamp": "2023-10-30T20:29:32.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -107,7 +107,7 @@ { "@timestamp": "2023-10-30T20:29:32.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -159,7 +159,7 @@ { "@timestamp": "2023-10-30T20:32:25.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -218,7 +218,7 @@ { "@timestamp": "2023-10-30T20:34:22.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -277,7 +277,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created-shared-folder", @@ -345,7 +345,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted-shared-folder", @@ -413,7 +413,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted-user-group", @@ -479,7 +479,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created-user-group", @@ -545,7 +545,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "changed-password", @@ -612,7 +612,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "edited-account-profile", @@ -679,7 +679,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "created-user", @@ -745,7 +745,7 @@ { "@timestamp": "2023-11-21T15:23:42.000-05:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "deleted-user", diff --git a/packages/qnap_nas/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/qnap_nas/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 79fd84f4871..5a4d4bed4cb 100644 --- a/packages/qnap_nas/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/qnap_nas/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing QNAP NAS logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/qnap_nas/data_stream/log/sample_event.json b/packages/qnap_nas/data_stream/log/sample_event.json index 4b3ac75e25a..66bf8175690 100644 --- a/packages/qnap_nas/data_stream/log/sample_event.json +++ b/packages/qnap_nas/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8ad7c85d-9943-4b05-b50f-ccab228ad581", diff --git a/packages/qnap_nas/docs/README.md b/packages/qnap_nas/docs/README.md index 911c3b9e8e1..6c54c5ecb36 100644 --- a/packages/qnap_nas/docs/README.md +++ b/packages/qnap_nas/docs/README.md @@ -26,7 +26,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8ad7c85d-9943-4b05-b50f-ccab228ad581", diff --git a/packages/qnap_nas/kibana/dashboard/qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75.json b/packages/qnap_nas/kibana/dashboard/qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75.json index 350bbf92cf6..78a33dc510f 100644 --- a/packages/qnap_nas/kibana/dashboard/qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75.json +++ b/packages/qnap_nas/kibana/dashboard/qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75.json @@ -1,14 +1,6 @@ { - "id": "qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-24T08:38:18.380Z", - "version": "WzYxNiwxXQ==", "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -21,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -29,15 +23,45 @@ "enhancements": {}, "hidePanelTitles": true, "savedVis": { - "title": "Controls [QNAP NAS]", + "data": { + "aggs": [], + "searchSource": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qnap_nas.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qnap_nas.log" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, "description": "", - "uiState": {}, "params": { "controls": [ { "fieldName": "source.ip", "id": "1637528635830", - "indexPatternRefName": "control_0_index_pattern", + "indexPatternRefName": "control_08e193f5-7994-4a34-8572-62dd8fb527fd_0_index_pattern", "label": "Source IP", "options": { "dynamicOptions": true, @@ -52,7 +76,7 @@ { "fieldName": "host.name", "id": "1637528676545", - "indexPatternRefName": "control_1_index_pattern", + "indexPatternRefName": "control_08e193f5-7994-4a34-8572-62dd8fb527fd_1_index_pattern", "label": "NAS Hostname", "options": { "dynamicOptions": true, @@ -67,7 +91,7 @@ { "fieldName": "user.name", "id": "1637528892452", - "indexPatternRefName": "control_2_index_pattern", + "indexPatternRefName": "control_08e193f5-7994-4a34-8572-62dd8fb527fd_2_index_pattern", "label": "User", "options": { "dynamicOptions": true, @@ -82,7 +106,7 @@ { "fieldName": "qnap.nas.connection_type", "id": "1637530638172", - "indexPatternRefName": "control_3_index_pattern", + "indexPatternRefName": "control_08e193f5-7994-4a34-8572-62dd8fb527fd_3_index_pattern", "label": "Connection Type", "options": { "dynamicOptions": true, @@ -99,39 +123,9 @@ "updateFiltersOnChange": false, "useTimeFilter": false }, + "title": "Controls [QNAP NAS]", "type": "input_control_vis", - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "qnap_nas.log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "qnap_nas.log" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - } + "uiState": {} } }, "gridData": { @@ -143,100 +137,147 @@ }, "panelIndex": "08e193f5-7994-4a34-8572-62dd8fb527fd", "type": "visualization", - "version": "8.0.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "vis": { - "legendOpen": false - }, - "savedVis": { - "title": "File Actions [QNAP NAS]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "distinctColors": false, - "isDonut": false, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "percent" - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-155768ff-3d8d-4888-a974-d7a90447def1", + "type": "index-pattern" }, - "truncateLegend": true, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "376f8e14-3171-4e5d-8ced-e11c318f5fdf", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "155768ff-3d8d-4888-a974-d7a90447def1": { + "columnOrder": [ + "481ce6e1-baee-4b56-9eba-4df28b4f11d1", + "7c5d5ec3-6cc3-4604-aa38-042b776fd775" + ], + "columns": { + "481ce6e1-baee-4b56-9eba-4df28b4f11d1": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7c5d5ec3-6cc3-4604-aa38-042b776fd775", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "7c5d5ec3-6cc3-4604-aa38-042b776fd775": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" }, - "schema": "segment", - "type": "terms" + "meta": { + "alias": null, + "disabled": false, + "index": "376f8e14-3171-4e5d-8ced-e11c318f5fdf", + "key": "event.dataset", + "negate": false, + "params": { + "query": "qnap_nas.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "qnap_nas.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.category", - "negate": false, - "params": { - "query": "file" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "file" - } - } + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "155768ff-3d8d-4888-a974-d7a90447def1", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7c5d5ec3-6cc3-4604-aa38-042b776fd775" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "481ce6e1-baee-4b56-9eba-4df28b4f11d1" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true } ], - "query": { - "language": "kuery", - "query": "" - } + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" } - } - } + }, + "title": "File Actions [QNAP NAS]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -246,80 +287,149 @@ "y": 7 }, "panelIndex": "41e893ff-a7e2-4146-af96-35cd7fc9b5b9", - "type": "visualization", - "version": "8.0.0" + "title": "File Actions [QNAP NAS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Connection Types [QNAP NAS]", - "description": "", - "uiState": { - "vis": { - "legendOpen": false - } - }, - "params": { - "addLegend": false, - "addTooltip": true, - "distinctColors": false, - "isDonut": false, - "labels": { - "last_level": false, - "percentDecimals": 2, - "position": "default", - "show": true, - "truncate": 100, - "values": true, - "valuesFormat": "percent" - }, - "legendPosition": "right", - "maxLegendLines": 1, - "nestedLegend": false, - "palette": { - "name": "default", - "type": "palette" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d5e77c8e-2082-439e-bee4-4956316d623b", + "type": "index-pattern" }, - "truncateLegend": true, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "id": "logs-*", + "name": "fb055f07-1fbd-4d8c-9033-53cd24330c49", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d5e77c8e-2082-439e-bee4-4956316d623b": { + "columnOrder": [ + "56e12896-a34f-4f3c-a20c-c9f89ddb71e6", + "511082f2-e267-4f06-a6f4-b940695551e3" + ], + "columns": { + "511082f2-e267-4f06-a6f4-b940695551e3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "56e12896-a34f-4f3c-a20c-c9f89ddb71e6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "qnap.nas.connection_type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "511082f2-e267-4f06-a6f4-b940695551e3", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qnap.nas.connection_type" + } + }, + "incompleteColumns": {} + } + } }, + "textBased": { + "layers": {} + } + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "qnap.nas.connection_type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fb055f07-1fbd-4d8c-9033-53cd24330c49", + "key": "event.dataset", + "negate": false, + "params": { + "query": "qnap_nas.log" + }, + "type": "phrase" }, - "schema": "segment", - "type": "terms" + "query": { + "match_phrase": { + "event.dataset": "qnap_nas.log" + } + } } ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.3, + "layerId": "d5e77c8e-2082-439e-bee4-4956316d623b", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "511082f2-e267-4f06-a6f4-b940695551e3" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "56e12896-a34f-4f3c-a20c-c9f89ddb71e6" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" } - } - } + }, + "title": "Connection Types [QNAP NAS]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -329,99 +439,138 @@ "y": 7 }, "panelIndex": "3bef5ad2-ec7d-4cd0-b8af-255533d30f62", - "type": "visualization", - "version": "8.0.0" + "title": "Connection Types [QNAP NAS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "table": null, - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 1, - "width": 168.5 + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-27e2b1be-81b0-4f65-968c-4bba3e0f381e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3b64f003-ceae-4812-a048-f364f614650e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "27e2b1be-81b0-4f65-968c-4bba3e0f381e": { + "columnOrder": [ + "0a6ea82d-b6e1-4fde-98d4-ef174782919d", + "e232370b-b443-4d38-b535-a2e7da239e79" + ], + "columns": { + "0a6ea82d-b6e1-4fde-98d4-ef174782919d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "file.path: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e232370b-b443-4d38-b535-a2e7da239e79", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "file.path" + }, + "e232370b-b443-4d38-b535-a2e7da239e79": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } }, - { - "colIndex": 0, - "width": 464.5 + "textBased": { + "layers": {} } - ] - } - }, - "savedVis": { - "title": "Top Accessed Files [QNAP NAS]", - "description": "", - "uiState": {}, - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, + }, + "filters": [ { - "enabled": true, - "id": "2", - "params": { - "field": "file.path", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3b64f003-ceae-4812-a048-f364f614650e", + "key": "event.dataset", + "negate": false, + "params": { + "query": "qnap_nas.log" + }, + "type": "phrase" }, - "schema": "bucket", - "type": "terms" + "query": { + "match_phrase": { + "event.dataset": "qnap_nas.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.provider", - "negate": false, - "params": { - "query": "conn-log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.provider": "conn-log" - } - } + "alignment": "left", + "columnId": "e232370b-b443-4d38-b535-a2e7da239e79" + }, + { + "alignment": "left", + "columnId": "0a6ea82d-b6e1-4fde-98d4-ef174782919d" } ], - "query": { - "language": "kuery", - "query": "" - } + "headerRowHeight": "single", + "layerId": "27e2b1be-81b0-4f65-968c-4bba3e0f381e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } - } + }, + "title": "Top Accessed Files [QNAP NAS]", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 18, @@ -431,181 +580,200 @@ "y": 7 }, "panelIndex": "20d36c90-71af-4062-94da-0374c871667e", - "type": "visualization", - "version": "8.0.0" + "title": "Top Accessed Files [QNAP NAS]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event Actions over Time", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false - }, - "labels": { - "show": false + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7947008d-c3dc-4cf2-8ff6-71ceea81763b", + "type": "index-pattern" }, - "legendPosition": "right", - "maxLegendLines": 1, - "palette": { - "name": "default", - "type": "palette" - }, - "radiusRatio": 0, - "seriesParams": [ - { - "circlesRadius": 3, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "interpolate": "linear", - "lineWidth": 2, - "mode": "stacked", - "show": true, - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" + { + "id": "logs-*", + "name": "6c18307c-aecd-472c-b1de-9c7cc6b88ae9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7947008d-c3dc-4cf2-8ff6-71ceea81763b": { + "columnOrder": [ + "66f051f7-6d38-4fff-bd3a-bcb7332c0221", + "e25843c6-ea23-4f52-aadf-90db16209e3b", + "27ba08d7-a7b6-4b4e-9368-64b4244a9a2f" + ], + "columns": { + "27ba08d7-a7b6-4b4e-9368-64b4244a9a2f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "66f051f7-6d38-4fff-bd3a-bcb7332c0221": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "e25843c6-ea23-4f52-aadf-90db16209e3b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "27ba08d7-a7b6-4b4e-9368-64b4244a9a2f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 }, - "times": [], - "truncateLegend": true, - "type": "histogram", - "valueAxes": [ + "filters": [ { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "" + "$state": { + "store": "appState" }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-1y/d", - "to": "now" + "meta": { + "alias": null, + "disabled": false, + "index": "6c18307c-aecd-472c-b1de-9c7cc6b88ae9", + "key": "event.dataset", + "negate": false, + "params": { + "query": "qnap_nas.log" }, - "useNormalizedEsInterval": true, - "used_interval": "1w" - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 + "type": "phrase" }, - "schema": "group", - "type": "terms" + "query": { + "match_phrase": { + "event.dataset": "qnap_nas.log" + } + } } ], - "searchSource": { - "filter": [ + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ { - "$state": { - "store": "appState" + "accessors": [ + "27ba08d7-a7b6-4b4e-9368-64b4244a9a2f" + ], + "isHistogram": true, + "layerId": "7947008d-c3dc-4cf2-8ff6-71ceea81763b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.provider", - "negate": false, - "params": { - "query": "conn-log" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.provider": "conn-log" + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "e25843c6-ea23-4f52-aadf-90db16209e3b", + "xAccessor": "66f051f7-6d38-4fff-bd3a-bcb7332c0221", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "27ba08d7-a7b6-4b4e-9368-64b4244a9a2f" } - } + ] } ], - "query": { - "language": "kuery", - "query": "" - } + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "" } - } - } + }, + "title": "Event Actions over Time", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -615,78 +783,87 @@ "y": 25 }, "panelIndex": "e0abcb09-b900-4d29-9146-02ab3aca914e", - "type": "visualization", - "version": "8.0.0" + "title": "Event Actions over Time", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[QNAP NAS] Access Logs", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T04:53:25.210Z", + "id": "qnap_nas-32e28700-4b0c-11ec-b2cc-b9a3cc301b75", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { - "type": "index-pattern", + "id": "logs-*", "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_0_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_08e193f5-7994-4a34-8572-62dd8fb527fd_0_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_1_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_08e193f5-7994-4a34-8572-62dd8fb527fd_1_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_2_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_08e193f5-7994-4a34-8572-62dd8fb527fd_2_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_3_index_pattern", - "id": "logs-*" + "id": "logs-*", + "name": "08e193f5-7994-4a34-8572-62dd8fb527fd:control_08e193f5-7994-4a34-8572-62dd8fb527fd_3_index_pattern", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "41e893ff-a7e2-4146-af96-35cd7fc9b5b9:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "41e893ff-a7e2-4146-af96-35cd7fc9b5b9:indexpattern-datasource-layer-155768ff-3d8d-4888-a974-d7a90447def1", + "type": "index-pattern" }, { - "type": "search", - "name": "41e893ff-a7e2-4146-af96-35cd7fc9b5b9:search_0", - "id": "qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75" + "id": "logs-*", + "name": "41e893ff-a7e2-4146-af96-35cd7fc9b5b9:376f8e14-3171-4e5d-8ced-e11c318f5fdf", + "type": "index-pattern" }, { - "type": "search", - "name": "3bef5ad2-ec7d-4cd0-b8af-255533d30f62:search_0", - "id": "qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75" + "id": "logs-*", + "name": "3bef5ad2-ec7d-4cd0-b8af-255533d30f62:indexpattern-datasource-layer-d5e77c8e-2082-439e-bee4-4956316d623b", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "20d36c90-71af-4062-94da-0374c871667e:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "3bef5ad2-ec7d-4cd0-b8af-255533d30f62:fb055f07-1fbd-4d8c-9033-53cd24330c49", + "type": "index-pattern" }, { - "type": "search", - "name": "20d36c90-71af-4062-94da-0374c871667e:search_0", - "id": "qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75" + "id": "logs-*", + "name": "20d36c90-71af-4062-94da-0374c871667e:indexpattern-datasource-layer-27e2b1be-81b0-4f65-968c-4bba3e0f381e", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "e0abcb09-b900-4d29-9146-02ab3aca914e:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "id": "logs-*" + "id": "logs-*", + "name": "20d36c90-71af-4062-94da-0374c871667e:3b64f003-ceae-4812-a048-f364f614650e", + "type": "index-pattern" }, { - "type": "search", - "name": "e0abcb09-b900-4d29-9146-02ab3aca914e:search_0", - "id": "qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75" + "id": "logs-*", + "name": "e0abcb09-b900-4d29-9146-02ab3aca914e:indexpattern-datasource-layer-7947008d-c3dc-4cf2-8ff6-71ceea81763b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e0abcb09-b900-4d29-9146-02ab3aca914e:6c18307c-aecd-472c-b1de-9c7cc6b88ae9", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/qnap_nas/kibana/search/qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75.json b/packages/qnap_nas/kibana/search/qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75.json index a43331f5faf..0096f075f52 100644 --- a/packages/qnap_nas/kibana/search/qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75.json +++ b/packages/qnap_nas/kibana/search/qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75.json @@ -44,10 +44,11 @@ ], "title": "Discover [QNAP NAS]" }, - "coreMigrationVersion": "7.16.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T04:49:25.965Z", "id": "qnap_nas-50acdec0-4b0c-11ec-b2cc-b9a3cc301b75", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/qnap_nas/kibana/tags.yml b/packages/qnap_nas/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/qnap_nas/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/qnap_nas/manifest.yml b/packages/qnap_nas/manifest.yml index ed49e7497d0..65d9681ab18 100644 --- a/packages/qnap_nas/manifest.yml +++ b/packages/qnap_nas/manifest.yml @@ -1,12 +1,13 @@ name: qnap_nas title: QNAP NAS -version: "1.11.0" +version: "1.15.0" description: Collect logs from QNAP NAS devices with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security"] conditions: - kibana.version: "^8.1.0" + kibana: + version: "^8.7.1" icons: - src: /img/logo.svg title: QNAP logo @@ -25,3 +26,4 @@ policy_templates: description: 'Collecting logs from QNAP NAS via UDP' owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/qualys_vmdr/_dev/build/build.yml b/packages/qualys_vmdr/_dev/build/build.yml new file mode 100644 index 00000000000..c1af686e524 --- /dev/null +++ b/packages/qualys_vmdr/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/qualys_vmdr/_dev/build/docs/README.md b/packages/qualys_vmdr/_dev/build/docs/README.md new file mode 100644 index 00000000000..034f43f9243 --- /dev/null +++ b/packages/qualys_vmdr/_dev/build/docs/README.md @@ -0,0 +1,99 @@ +# Qualys Vulnerability Management, Detection and Response (VMDR) + +This [Qualys VMDR](https://www.qualys.com/apps/vulnerability-management-detection-response/) integration is a cloud-based service that gives you immediate, global visibility into where your IT systems might be vulnerable to the latest Internet threats and how to protect them. It helps you to continuously identify threats and monitor unexpected changes in your network before they turn into breaches. + +The Qualys VMDR integration uses REST API mode to collect data. Elastic Agent fetches data via API endpoints. + +## Compatibility + +This module has been tested against the latest Qualys VMDR version **v2**. + +## Data streams + +The Qualys VMDR integration collects data for the following two events: + +| Event Type | +|-------------------------------| +| Asset Host Detection | +| Knowledge Base | + +Reference for [Rest APIs](https://qualysguard.qg2.apps.qualys.com/qwebhelp/fo_portal/api_doc/index.htm) of Qualys VMDR. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data through the REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data through REST API, follow the below steps: + +- Considering you already have a Qualys user account, to identify your Qualys platform and get the API URL, refer this [link](https://www.qualys.com/platform-identification/). +- Alternative way to get the API URL is to log in to your Qualys account and go to Help > About. You’ll find your URL under Security Operations Center (SOC). + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations +2. In "Search for integrations" search bar, type Qualys VMDR +3. Click on the "Qualys VMDR" integration from the search results. +4. Click on the Add Qualys VMDR Integration button to add the integration. +5. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details: + - username + - password + - url + - interval + - input parameters + - batch size + + or if you want to collect Knowledge Base data via REST API, then you have to put the following details: + - username + - password + - url + - initial interval + - interval + - input parameters + +**NOTE**: By default, the input parameter is set to "action=list". + +## Data reference + +### Asset Host Detection + +This is the `Asset Host Detection` dataset. + +#### Example + +{{event "asset_host_detection"}} + +{{fields "asset_host_detection"}} + +### Knowledge Base + +This is the `Knowledge Base` dataset. + +#### Example + +{{event "knowledge_base"}} + +{{fields "knowledge_base"}} \ No newline at end of file diff --git a/packages/qualys_vmdr/_dev/deploy/docker/docker-compose.yml b/packages/qualys_vmdr/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..6841ee2274e --- /dev/null +++ b/packages/qualys_vmdr/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,15 @@ +version: '2.3' +services: + qualys_vmdr: + image: docker.elastic.co/observability/stream:v0.10.0 + hostname: qualys_vmdr + ports: + - 8090 + volumes: + - ./files:/files:ro + environment: + PORT: '8090' + command: + - http-server + - --addr=:8090 + - --config=/files/config.yml diff --git a/packages/qualys_vmdr/_dev/deploy/docker/files/config.yml b/packages/qualys_vmdr/_dev/deploy/docker/files/config.yml new file mode 100644 index 00000000000..c5d5270c1d3 --- /dev/null +++ b/packages/qualys_vmdr/_dev/deploy/docker/files/config.yml @@ -0,0 +1,118 @@ +rules: + - path: /api/2.0/fo/asset/host/vm/detection/ + methods: ['GET'] + responses: + - status_code: 200 + body: |- + + + + + 2023-07-03T06:51:41Z + + + 12048633 + 10.50.2.111 + IP + + + + + + + + + + + + + + + + + + + + + 2023-07-03T06:25:17Z + 2023-07-03T06:23:47Z + 1113 + 2023-06-28T09:58:12Z + + + 91681 + Confirmed + 5 + 0 + + + + Active + 2023-06-28T06:04:26Z + 2023-07-03T06:23:47Z + 11 + 2023-07-03T06:23:47Z + 2023-07-03T06:25:17Z + 0 + 0 + 2023-07-03T06:25:17Z + + + + + + + - path: /api/2.0/fo/knowledge_base/vuln/ + methods: ['GET'] + responses: + - status_code: 200 + body: |- + + + + + 2023-07-06T15:02:16Z + + + 11830 + Vulnerability + 2 + + <![CDATA[HTTP Security Header Not Detected]]> + + CGI + 2023-06-29T12:20:46Z + 2017-06-05T21:34:49Z + 0 + + + + + + + + + + + + + + + + + + Note: To better debug the results of this QID]]> + + 1 + + + + + + + 1 + + + + + diff --git a/packages/qualys_vmdr/changelog.yml b/packages/qualys_vmdr/changelog.yml new file mode 100644 index 00000000000..16f23ad876e --- /dev/null +++ b/packages/qualys_vmdr/changelog.yml @@ -0,0 +1,21 @@ +# newer versions go on top +- version: 0.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.2.0" + changes: + - description: Update data collection of knowledge base data stream to handle different log format. + type: bugfix + link: https://github.com/elastic/integrations/pull/7623 +- version: "0.1.0" + changes: + - description: Initial Release. + type: enhancement + link: https://github.com/elastic/integrations/pull/6872 diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log new file mode 100644 index 00000000000..4757ac73c4f --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log @@ -0,0 +1,7 @@ +{"NETBIOS": "EXCHB10","NETWORK_ID": 0,"IPV6":"0.0.0.0","OS_CPE":"xyz","EC2_INSTANCE_ID": "i-07f91cxxx3axxxb3f","CLOUD_RESOURCE_ID": "i-07f91cxxx3axxxb3f","CLOUD_SERVICE": "EC2","CLOUD_PROVIDER": "AWS","QG_HOSTID": "44e2cf13-xxxx-48b9-xxxx-de489547754d","METADATA": {"EC2": {"ATTRIBUTE": [{"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}]}, "GOOGLE": {"ATTRIBUTE": [{"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}]}, "AZURE": {"ATTRIBUTE": [{"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}]}},"CLOUD_PROVIDER_TAGS": {"CLOUD_TAG": [{"NAME": "Name","VALUE": "allocator-dnt-frozen-i3en-2xl-v1-a","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z"}]}, "IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031","TAGS": {"TAG": [{"NAME": "Sales","TAG_ID": "19427596","COLOR":"#FFFFF","BACKGROUND_COLOR":"#FFFFF"},{"TAG_ID": "19429855","NAME": "Linux"}]},"LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822","DETECTION_LIST": {"DETECTION": [{"LAST_UPDATE_DATETIME": "2023-05-30T07:48:14Z","LAST_FIXED_DATETIME":"2023-05-22T02:09:49Z","FIRST_REOPENED_DATETIME":"2023-05-22T02:09:49Z","LAST_REOPENED_DATETIME":"2023-05-22T02:09:49Z","TIMES_REOPENED":"2","SERVICE":"service1","AFFECT_RUNNING_KERNEL":"kernel1","AFFECT_RUNNING_SERVICE":"service1","AFFECT_EXPLOITABLE_CONFIG":"config1","ASSET_CVE":"cve3","STATUS": "New","FQDN":"exchb10.exchb10.local","INSTANCE":"instance1","FIRST_FOUND_DATETIME": "2023-05-30T07:46:15Z","QID": "11827","SSL": "0","IS_IGNORED": "0","PORT": "443","SEVERITY": "2","LAST_FOUND_DATETIME": "2023-05-30T07:46:15Z","TYPE": "Confirmed","QDS": {"#text": "50","severity": "MEDIUM"},"QDS_FACTORS": {"QDS_FACTOR": [{"#text": "Easy_Exploit,No_Patch","name": "RTI"},{"#text": "5.0","name": "CVSS"}]},"LAST_PROCESSED_DATETIME": "2023-05-30T07:48:14Z","PROTOCOL": "tcp","TIMES_FOUND": "1","IS_DISABLED": "1","RESULTS": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: "135e2b561de6d41:0"\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.","LAST_TEST_DATETIME": "2023-05-30T07:46:15Z"}]}, "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} +{"NETBIOS": "EXCHB10","IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031","TAGS": {"TAG": {"TAG_ID": "19429855","NAME": "Linux"}},"LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822","DETECTION_LIST": {"DETECTION": [{"LAST_UPDATE_DATETIME": "2023-05-30T07:48:14Z","STATUS": "New","FIRST_FOUND_DATETIME": "2023-05-30T07:46:15Z","QID": "11827","SSL": "0","IS_IGNORED": "0","PORT": "443","SEVERITY": "2","LAST_FOUND_DATETIME": "2023-05-30T07:46:15Z","TYPE": "Confirmed","QDS": {"#text": "50","severity": "MEDIUM"},"QDS_FACTORS": {"QDS_FACTOR": [{"#text": "Easy_Exploit,No_Patch","name": "RTI"},{"#text": "5.0","name": "CVSS"}]},"LAST_PROCESSED_DATETIME": "2023-05-30T07:48:14Z","PROTOCOL": "tcp","TIMES_FOUND": "1","RESULTS": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: "135e2b561de6d41:0"\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.","LAST_TEST_DATETIME": "2023-05-30T07:46:15Z"}]}, "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} +{"NETBIOS": "EXCHB10","IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031","TAGS": {"TAG": [{"NAME": "Sales","TAG_ID": "19427596"},{"TAG_ID": "19429855","NAME": "Linux"}]},"LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822","DETECTION_LIST": {"DETECTION": {"LAST_UPDATE_DATETIME": "2023-05-30T07:48:14Z","STATUS": "New","FIRST_FOUND_DATETIME": "2023-05-30T07:46:15Z","QID": "11827","SSL": "0","IS_IGNORED": "0","PORT": "443","SEVERITY": "2","LAST_FOUND_DATETIME": "2023-05-30T07:46:15Z","TYPE": "Confirmed","QDS": {"#text": "50","severity": "MEDIUM"},"QDS_FACTORS": {"QDS_FACTOR": [{"#text": "Easy_Exploit,No_Patch","name": "RTI"},{"#text": "5.0","name": "CVSS"}]},"LAST_PROCESSED_DATETIME": "2023-05-30T07:48:14Z","PROTOCOL": "tcp","TIMES_FOUND": "1","IS_DISABLED": "1","RESULTS": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: "135e2b561de6d41:0"\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.","LAST_TEST_DATETIME": "2023-05-30T07:46:15Z"}}, "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} +{"NETBIOS": "EXCHB10","IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031","TAGS": {"TAG": {"TAG_ID": "19429855","NAME": "Linux"}},"LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822","DETECTION_LIST": {"DETECTION": {"LAST_UPDATE_DATETIME": "2023-05-30T07:48:14Z","STATUS": "New","FIRST_FOUND_DATETIME": "2023-05-30T07:46:15Z","QID": "11827","SSL": "0","IS_IGNORED": "0","PORT": "443","SEVERITY": "2","LAST_FOUND_DATETIME": "2023-05-30T07:46:15Z","TYPE": "Confirmed","QDS": {"#text": "50","severity": "MEDIUM"},"QDS_FACTORS": {"QDS_FACTOR": [{"#text": "Easy_Exploit,No_Patch","name": "RTI"},{"#text": "5.0","name": "CVSS"}]},"LAST_PROCESSED_DATETIME": "2023-05-30T07:48:14Z","PROTOCOL": "tcp","TIMES_FOUND": "1","IS_DISABLED": "1","RESULTS": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: "135e2b561de6d41:0"\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.","LAST_TEST_DATETIME": "2023-05-30T07:46:15Z"}}, "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} +{"NETBIOS": "EXCHB10","IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031", "LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822", "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} +{"ASSET_ID":"27703780","DETECTION_LIST":{"DETECTION":{"FIRST_FOUND_DATETIME":"2023-05-30T11:49:24Z","IS_DISABLED":"0","LAST_FOUND_DATETIME":"2023-06-17T12:47:54Z","LAST_PROCESSED_DATETIME":"2023-06-17T13:20:12Z","QID":"70028","RESULTS":"User Name\t(none)\nDomain\t(none)\nAuthentication Scheme\tNULL session\nSecurity\tUser-based\nSMBv1 Signing\tDisabled\nDiscovery Method\tUnable to log in using credentials provided by user, fallback to NULL session\nCIFS Signing\tdefault","SEVERITY":"1","TIMES_FOUND":"38","TYPE":"Info"}},"DNS":"win-d24ck5nn676.ldap.local","DNS_DATA":{"DOMAIN":"ldap.local","FQDN":"win-d24ck5nn676.ldap.local","HOSTNAME":"win-d24ck5nn676"},"ID":"11701931","IP":"10.50.2.122","LAST_PC_SCANNED_DATE":"2023-06-18T04:00:17Z","LAST_SCAN_DATETIME":"2023-06-17T13:20:12Z","LAST_VM_SCANNED_DATE":"2023-06-17T12:47:54Z","LAST_VM_SCANNED_DURATION":"1806","NETBIOS":"WIN-D24CK5NN676","OS":"Windows 2016","TAGS":{"TAG":{"NAME":"Windows","TAG_ID":"19429857"}},"TRACKING_METHOD":"IP"} +{"NETBIOS": "EXCHB10","NETWORK_ID": 0,"EC2_INSTANCE_ID": "i-07f91cxxx3axxxb3f","CLOUD_RESOURCE_ID": "i-07f91cxxx3axxxb3f","CLOUD_SERVICE": "EC2","CLOUD_PROVIDER": "AWS","QG_HOSTID": "44e2cf13-xxxx-48b9-xxxx-de489547754d","METADATA": {"EC2": {"ATTRIBUTE": {"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}},"GOOGLE": {"ATTRIBUTE": {"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}},"AZURE": {"ATTRIBUTE": {"NAME": "firstDiscovered","LAST_STATUS": "Success","VALUE": "1683517315000","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z","LAST_ERROR_DATE": "2023-05-22T02:09:49Z","LAST_ERROR": "404 - Not Found"}}},"CLOUD_PROVIDER_TAGS": {"CLOUD_TAG": {"NAME": "Name","VALUE": "allocator-dnt-frozen-i3en-2xl-v1-a","LAST_SUCCESS_DATE": "2023-06-22T12:44:21Z"}}, "IP": "81.2.69.192","ID": "11700976","LAST_PC_SCANNED_DATE": "2023-05-31T11:30:20Z","ASSET_ID": "27858031","TAGS": {"TAG": [{"NAME": "Sales","TAG_ID": "19427596"},{"TAG_ID": "19429855","NAME": "Linux"}]},"LAST_VM_SCANNED_DATE": "2023-05-31T12:34:44Z","LAST_VM_SCANNED_DURATION": "1822","DNS": "abc10.fdgshb10.local","DNS_DATA": {"DOMAIN": "abc10.local","FQDN": "abc10.fdgshb10.local","HOSTNAME": "abc10"},"LAST_SCAN_DATETIME": "2023-05-31T12:55:28Z","LAST_VM_AUTH_SCANNED_DURATION": "1822","DETECTION_LIST": {"DETECTION": [{"LAST_UPDATE_DATETIME": "2023-05-30T07:48:14Z","STATUS": "New","FIRST_FOUND_DATETIME": "2023-05-30T07:46:15Z","QID": "11827","SSL": "0","IS_IGNORED": "0","PORT": "443","SEVERITY": "2","LAST_FOUND_DATETIME": "2023-05-30T07:46:15Z","TYPE": "Confirmed","QDS": {"#text": "50","severity": "MEDIUM"},"QDS_FACTORS": {"QDS_FACTOR": [{"#text": "Easy_Exploit,No_Patch","name": "RTI"},{"#text": "5.0","name": "CVSS"}]},"LAST_PROCESSED_DATETIME": "2023-05-30T07:48:14Z","PROTOCOL": "tcp","TIMES_FOUND": "1","IS_DISABLED": "1","RESULTS": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: "135e2b561de6d41:0"\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.","LAST_TEST_DATETIME": "2023-05-30T07:46:15Z"}]}, "OS": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607","TRACKING_METHOD": "IP","LAST_VM_AUTH_SCANNED_DATE": "2023-05-31T12:34:44Z"} \ No newline at end of file diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log-expected.json b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log-expected.json new file mode 100644 index 00000000000..9f0046e047c --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-asset-host-detection.log-expected.json @@ -0,0 +1,915 @@ +{ + "expected": [ + { + "cloud": { + "instance": { + "id": "i-07f91cxxx3axxxb3f" + }, + "provider": "AWS", + "service": { + "name": "EC2" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "cloud": { + "provider": { + "name": "AWS", + "tags": { + "cloud_tag": [ + { + "last_success_date": "2023-06-22T12:44:21.000Z", + "name": "Name", + "value": "allocator-dnt-frozen-i3en-2xl-v1-a" + } + ] + } + }, + "resource_id": "i-07f91cxxx3axxxb3f", + "service": "EC2" + }, + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "ec2_instance_id": "i-07f91cxxx3axxxb3f", + "id": "11700976", + "ip": "81.2.69.192", + "ipv6": "0.0.0.0", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "list": [ + { + "affect": { + "exploitable_config": "config1", + "running": { + "kernel": "kernel1", + "service": "service1" + } + }, + "asset_cve": "cve3", + "first": { + "found_datetime": "2023-05-30T07:46:15.000Z", + "reopened_datetime": "2023-05-22T02:09:49.000Z" + }, + "fqdn": "exchb10.exchb10.local", + "instance": "instance1", + "is_disabled": true, + "is_ignored": false, + "last": { + "fixed_datetime": "2023-05-22T02:09:49.000Z", + "found_datetime": "2023-05-30T07:46:15.000Z", + "processed_datetime": "2023-05-30T07:48:14.000Z", + "reopened_datetime": "2023-05-22T02:09:49.000Z", + "test_datetime": "2023-05-30T07:46:15.000Z", + "update_datetime": "2023-05-30T07:48:14.000Z" + }, + "port": 443, + "protocol": "tcp", + "qds": { + "severity": "MEDIUM", + "text": "50" + }, + "qds_factors": [ + { + "name": "RTI", + "text": "Easy_Exploit,No_Patch" + }, + { + "name": "CVSS", + "text": "5.0" + } + ], + "qid": "11827", + "results": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: \u0026quot;135e2b561de6d41:0\u0026quot;\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.", + "service": "service1", + "severity": 2, + "ssl": "0", + "status": "New", + "times": { + "found": 1, + "reopened": 2 + }, + "type": "Confirmed" + } + ], + "metadata": { + "azure": { + "attribute": [ + { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + ] + }, + "ec2": { + "attribute": [ + { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + ] + }, + "google": { + "attribute": [ + { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + ] + } + }, + "netbios": "EXCHB10", + "network_id": "0", + "os": { + "cpe": "xyz", + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "qg_host_id": "44e2cf13-xxxx-48b9-xxxx-de489547754d", + "tags": [ + { + "background_color": "#FFFFF", + "color": "#FFFFF", + "id": "19427596", + "name": "Sales" + }, + { + "id": "19429855", + "name": "Linux" + } + ], + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10", + "44e2cf13-xxxx-48b9-xxxx-de489547754d", + "exchb10.exchb10.local" + ], + "ip": [ + "81.2.69.192", + "0.0.0.0" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "id": "11700976", + "ip": "81.2.69.192", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "list": [ + { + "first": { + "found_datetime": "2023-05-30T07:46:15.000Z" + }, + "is_ignored": false, + "last": { + "found_datetime": "2023-05-30T07:46:15.000Z", + "processed_datetime": "2023-05-30T07:48:14.000Z", + "test_datetime": "2023-05-30T07:46:15.000Z", + "update_datetime": "2023-05-30T07:48:14.000Z" + }, + "port": 443, + "protocol": "tcp", + "qds": { + "severity": "MEDIUM", + "text": "50" + }, + "qds_factors": [ + { + "name": "RTI", + "text": "Easy_Exploit,No_Patch" + }, + { + "name": "CVSS", + "text": "5.0" + } + ], + "qid": "11827", + "results": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: \u0026quot;135e2b561de6d41:0\u0026quot;\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.", + "severity": 2, + "ssl": "0", + "status": "New", + "times": { + "found": 1 + }, + "type": "Confirmed" + } + ], + "netbios": "EXCHB10", + "os": { + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "tags": { + "id": "19429855", + "name": "Linux" + }, + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "id": "11700976", + "ip": "81.2.69.192", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "list": { + "first": { + "found_datetime": "2023-05-30T07:46:15.000Z" + }, + "is_disabled": true, + "is_ignored": false, + "last": { + "found_datetime": "2023-05-30T07:46:15.000Z", + "processed_datetime": "2023-05-30T07:48:14.000Z", + "test_datetime": "2023-05-30T07:46:15.000Z", + "update_datetime": "2023-05-30T07:48:14.000Z" + }, + "port": 443, + "protocol": "tcp", + "qds": { + "severity": "MEDIUM", + "text": "50" + }, + "qds_factors": [ + { + "name": "RTI", + "text": "Easy_Exploit,No_Patch" + }, + { + "name": "CVSS", + "text": "5.0" + } + ], + "qid": "11827", + "results": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: \u0026quot;135e2b561de6d41:0\u0026quot;\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.", + "severity": 2, + "ssl": "0", + "status": "New", + "times": { + "found": 1 + }, + "type": "Confirmed" + }, + "netbios": "EXCHB10", + "os": { + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "tags": [ + { + "id": "19427596", + "name": "Sales" + }, + { + "id": "19429855", + "name": "Linux" + } + ], + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "id": "11700976", + "ip": "81.2.69.192", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "list": { + "first": { + "found_datetime": "2023-05-30T07:46:15.000Z" + }, + "is_disabled": true, + "is_ignored": false, + "last": { + "found_datetime": "2023-05-30T07:46:15.000Z", + "processed_datetime": "2023-05-30T07:48:14.000Z", + "test_datetime": "2023-05-30T07:46:15.000Z", + "update_datetime": "2023-05-30T07:48:14.000Z" + }, + "port": 443, + "protocol": "tcp", + "qds": { + "severity": "MEDIUM", + "text": "50" + }, + "qds_factors": [ + { + "name": "RTI", + "text": "Easy_Exploit,No_Patch" + }, + { + "name": "CVSS", + "text": "5.0" + } + ], + "qid": "11827", + "results": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: \u0026quot;135e2b561de6d41:0\u0026quot;\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.", + "severity": 2, + "ssl": "0", + "status": "New", + "times": { + "found": 1 + }, + "type": "Confirmed" + }, + "netbios": "EXCHB10", + "os": { + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "tags": { + "id": "19429855", + "name": "Linux" + }, + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "id": "11700976", + "ip": "81.2.69.192", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "netbios": "EXCHB10", + "os": { + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "WIN-D24CK5NN676", + "id": "11701931", + "ip": [ + "10.50.2.122" + ], + "os": { + "full": "Windows 2016" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27703780", + "dns": { + "value": "win-d24ck5nn676.ldap.local" + }, + "dns_data": { + "domain": "ldap.local", + "fqdn": "win-d24ck5nn676.ldap.local", + "hostname": "win-d24ck5nn676" + }, + "id": "11701931", + "ip": "10.50.2.122", + "last": { + "pc_scanned_date": "2023-06-18T04:00:17.000Z", + "scan_datetime": "2023-06-17T13:20:12.000Z", + "vm": { + "scanned_date": "2023-06-17T12:47:54.000Z", + "scanned_duration": 1806 + } + }, + "list": { + "first": { + "found_datetime": "2023-05-30T11:49:24.000Z" + }, + "is_disabled": false, + "last": { + "found_datetime": "2023-06-17T12:47:54.000Z", + "processed_datetime": "2023-06-17T13:20:12.000Z" + }, + "qid": "70028", + "results": "User Name\t(none)\nDomain\t(none)\nAuthentication Scheme\tNULL session\nSecurity\tUser-based\nSMBv1 Signing\tDisabled\nDiscovery Method\tUnable to log in using credentials provided by user, fallback to NULL session\nCIFS Signing\tdefault", + "severity": 1, + "times": { + "found": 38 + }, + "type": "Info" + }, + "netbios": "WIN-D24CK5NN676", + "os": { + "value": "Windows 2016" + }, + "tags": { + "id": "19429857", + "name": "Windows" + }, + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "win-d24ck5nn676.ldap.local", + "win-d24ck5nn676", + "11701931", + "WIN-D24CK5NN676" + ], + "ip": [ + "10.50.2.122" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + }, + { + "cloud": { + "instance": { + "id": "i-07f91cxxx3axxxb3f" + }, + "provider": "AWS", + "service": { + "name": "EC2" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "domain": "EXCHB10", + "id": "11700976", + "ip": [ + "81.2.69.192" + ], + "os": { + "full": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + } + }, + "qualys_vmdr": { + "asset_host_detection": { + "asset_id": "27858031", + "cloud": { + "provider": { + "name": "AWS", + "tags": { + "cloud_tag": { + "last_success_date": "2023-06-22T12:44:21.000Z", + "name": "Name", + "value": "allocator-dnt-frozen-i3en-2xl-v1-a" + } + } + }, + "resource_id": "i-07f91cxxx3axxxb3f", + "service": "EC2" + }, + "dns": { + "value": "abc10.fdgshb10.local" + }, + "dns_data": { + "domain": "abc10.local", + "fqdn": "abc10.fdgshb10.local", + "hostname": "abc10" + }, + "ec2_instance_id": "i-07f91cxxx3axxxb3f", + "id": "11700976", + "ip": "81.2.69.192", + "last": { + "pc_scanned_date": "2023-05-31T11:30:20.000Z", + "scan_datetime": "2023-05-31T12:55:28.000Z", + "vm": { + "auth": { + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + }, + "scanned_date": "2023-05-31T12:34:44.000Z", + "scanned_duration": 1822 + } + }, + "list": [ + { + "first": { + "found_datetime": "2023-05-30T07:46:15.000Z" + }, + "is_disabled": true, + "is_ignored": false, + "last": { + "found_datetime": "2023-05-30T07:46:15.000Z", + "processed_datetime": "2023-05-30T07:48:14.000Z", + "test_datetime": "2023-05-30T07:46:15.000Z", + "update_datetime": "2023-05-30T07:48:14.000Z" + }, + "port": 443, + "protocol": "tcp", + "qds": { + "severity": "MEDIUM", + "text": "50" + }, + "qds_factors": [ + { + "name": "RTI", + "text": "Easy_Exploit,No_Patch" + }, + { + "name": "CVSS", + "text": "5.0" + } + ], + "qid": "11827", + "results": "X-Content-Type-Options HTTP Header missing on port 443.\n\nGET / HTTP/1.0\nHost: 81.2.69.192\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0\n\n\n\nHTTP/1.1 200 OK\nContent-Type: text/html\nLast-Modified: Fri, 29 Mar 2019 10:51:17 GMT\nAccept-Ranges: bytes\nETag: \u0026quot;135e2b561de6d41:0\u0026quot;\nServer: Microsoft-IIS/10.0\nX-Powered-By: ASP.NET\nDate: Tue, 30 May 2023 05:56:00 GMT\nConnection: keep-alive\nContent-Length: 703\n\nStrict-Transport-Security HTTP Header missing on port 443.", + "severity": 2, + "ssl": "0", + "status": "New", + "times": { + "found": 1 + }, + "type": "Confirmed" + } + ], + "metadata": { + "azure": { + "attribute": { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + }, + "ec2": { + "attribute": { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + }, + "google": { + "attribute": { + "last": { + "error": { + "date": "2023-05-22T02:09:49.000Z", + "value": "404 - Not Found" + }, + "status": "Success", + "success_date": "2023-06-22T12:44:21.000Z" + }, + "name": "firstDiscovered", + "value": "1683517315000" + } + } + }, + "netbios": "EXCHB10", + "network_id": "0", + "os": { + "value": "Windows Server 2016 Standard Evaluation 64 bit Edition AD Version 1607" + }, + "qg_host_id": "44e2cf13-xxxx-48b9-xxxx-de489547754d", + "tags": [ + { + "id": "19427596", + "name": "Sales" + }, + { + "id": "19429855", + "name": "Linux" + } + ], + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "abc10.fdgshb10.local", + "abc10", + "11700976", + "EXCHB10", + "44e2cf13-xxxx-48b9-xxxx-de489547754d" + ], + "ip": [ + "81.2.69.192" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields" + ] + } + ] +} \ No newline at end of file diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-common-config.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..37e8fa225fd --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_duplicate_custom_fields diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/system/test-default-config.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..2e80cc9d5a0 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/_dev/test/system/test-default-config.yml @@ -0,0 +1,11 @@ +input: cel +service: qualys_vmdr +vars: + username: xxxx + password: xxxx +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs b/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs new file mode 100644 index 00000000000..3a6e5bbc9cb --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/agent/stream/input.yml.hbs @@ -0,0 +1,533 @@ +config_version: 2 +interval: {{interval}} +{{#if proxy_url}} +resource.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +resource.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +resource.timeout: {{http_client_timeout}} +{{/if}} +resource.url: {{url}} +state: + user: {{username}} + password: {{password}} + batch_size: {{batch_size}} + params: {{input_parameters}} +redact: + fields: + - password +program: | + request("GET", ( + !has(state.want_more) || !state.want_more ? + (state.url + "/api/2.0/fo/asset/host/vm/detection/?action=list&truncation_limit=" + string(state.batch_size) + + (has(state.params) ? "&" + state.params : "")) + : + state.url + )).with({ + "Header":{ + "X-Requested-With": ["curl"], + "Authorization": ["Basic "+string(base64(state.user+":"+state.password))], + } + }).do_request().as(resp, bytes(resp.Body).decode_xml('qualys_api_2_0').as(body, { + "events": body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.HOST_LIST.HOST.map(e, { + "message": e.encode_json(), + }), + "url": ( + has(body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING) && has(body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL) + ? + body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL + : + state.url.parse_url().Scheme + "://" + state.url.parse_url().Host + ), + "want_more": has(body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING) && has(body.doc.HOST_LIST_VM_DETECTION_OUTPUT.RESPONSE.WARNING.URL), + "params": has(state.params) ? state.params : "", + "batch_size": state.batch_size, + "user": state.user, + "password": state.password, + })) +tags: +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} +xsd: + qualys_api_2_0: | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..fe218f9e2f2 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,1562 @@ +--- +description: Pipeline for processing Asset Host Detection data. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - set: + field: event.kind + tag: set_event_kind_1 + value: alert + - set: + field: event.category + tag: set_event_catgeory + value: [host] + - set: + field: event.type + tag: set_event_type + value: [info] + - json: + field: message + tag: json_message + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.ASSET_ID + tag: rename_ASSET_ID + target_field: qualys_vmdr.asset_host_detection.asset_id + ignore_missing: true + - rename: + field: json.DNS + tag: rename_DNS + target_field: qualys_vmdr.asset_host_detection.dns.value + ignore_missing: true + - rename: + field: json.DNS_DATA.DOMAIN + tag: rename_DNS_DATA.DOMAIN + target_field: qualys_vmdr.asset_host_detection.dns_data.domain + ignore_missing: true + - rename: + field: json.DNS_DATA.FQDN + tag: rename_DNS_DATA.FQDN + target_field: qualys_vmdr.asset_host_detection.dns_data.fqdn + ignore_missing: true + - append: + field: related.hosts + tag: append_fqdn_into_related_hosts + value: '{{{qualys_vmdr.asset_host_detection.dns_data.fqdn}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.dns_data?.fqdn != null + - rename: + field: json.DNS_DATA.HOSTNAME + tag: rename_DNS_DATA.HOSTNAME + target_field: qualys_vmdr.asset_host_detection.dns_data.hostname + ignore_missing: true + - append: + field: related.hosts + tag: append_hostname_into_related_hosts + value: '{{{qualys_vmdr.asset_host_detection.dns_data.hostname}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.dns_data?.hostname != null + - rename: + field: json.ID + tag: rename_ID + target_field: qualys_vmdr.asset_host_detection.id + ignore_missing: true + - set: + field: host.id + tag: set_host_id + copy_from: qualys_vmdr.asset_host_detection.id + ignore_empty_value: true + - append: + field: related.hosts + tag: append_host_id_into_related_hosts + value: '{{{host.id}}}' + allow_duplicates: false + if: ctx.host?.id != null + - rename: + field: json.NETBIOS + tag: rename_NETBIOS + target_field: qualys_vmdr.asset_host_detection.netbios + ignore_missing: true + - set: + field: host.domain + tag: set_host_domain + copy_from: qualys_vmdr.asset_host_detection.netbios + ignore_empty_value: true + - append: + field: related.hosts + tag: append_host_domain_into_related_hosts + value: '{{{host.domain}}}' + allow_duplicates: false + if: ctx.host?.domain != null + - convert: + field: json.NETWORK_ID + tag: convert_NETWORK_ID_to_string + target_field: qualys_vmdr.asset_host_detection.network_id + type: string + ignore_missing: true + if: ctx.json?.NETWORK_ID != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.EC2_INSTANCE_ID + tag: rename_EC2_INSTANCE_ID + target_field: qualys_vmdr.asset_host_detection.ec2_instance_id + ignore_missing: true + - rename: + field: json.CLOUD_RESOURCE_ID + tag: rename_CLOUD_RESOURCE_ID + target_field: qualys_vmdr.asset_host_detection.cloud.resource_id + ignore_missing: true + - set: + field: cloud.instance.id + tag: set_cloud_instance_id + copy_from: qualys_vmdr.asset_host_detection.cloud.resource_id + ignore_empty_value: true + - rename: + field: json.CLOUD_SERVICE + tag: rename_CLOUD_SERVICE + target_field: qualys_vmdr.asset_host_detection.cloud.service + ignore_missing: true + - set: + field: cloud.service.name + tag: set_cloud_service_name + copy_from: qualys_vmdr.asset_host_detection.cloud.service + ignore_empty_value: true + - rename: + field: json.CLOUD_PROVIDER + tag: rename_CLOUD_PROVIDER + target_field: qualys_vmdr.asset_host_detection.cloud.provider.name + ignore_missing: true + - set: + field: cloud.provider + tag: set_cloud_provider + copy_from: qualys_vmdr.asset_host_detection.cloud.provider.name + ignore_empty_value: true + - rename: + field: json.QG_HOSTID + tag: rename_QG_HOSTID + target_field: qualys_vmdr.asset_host_detection.qg_host_id + ignore_missing: true + - append: + field: related.hosts + tag: append_qg_host_id_into_related_hosts + value: '{{{qualys_vmdr.asset_host_detection.qg_host_id}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.qg_host_id != null + - rename: + field: json.OS_CPE + tag: rename_OS_CPE + target_field: qualys_vmdr.asset_host_detection.os.cpe + ignore_missing: true + - rename: + field: json.OS + tag: rename_OS + target_field: qualys_vmdr.asset_host_detection.os.value + ignore_missing: true + - set: + field: host.os.full + tag: set_host_os_full + copy_from: qualys_vmdr.asset_host_detection.os.value + ignore_empty_value: true + - rename: + field: json.TRACKING_METHOD + tag: rename_TRACKING_METHOD + target_field: qualys_vmdr.asset_host_detection.tracking_method + ignore_missing: true + - convert: + field: json.IP + tag: convert_IP_to_ip + target_field: qualys_vmdr.asset_host_detection.ip + type: ip + ignore_missing: true + if: ctx.json?.IP != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_ip_into_related_ip + value: '{{{qualys_vmdr.asset_host_detection.ip}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.ip != null + - convert: + field: json.IPV6 + tag: convert_IPV6_to_ip + target_field: qualys_vmdr.asset_host_detection.ipv6 + type: ip + ignore_missing: true + if: ctx.json?.IPV6 != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_ipv6_into_related_ip + value: '{{{qualys_vmdr.asset_host_detection.ipv6}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.ipv6 != null + - append: + field: host.ip + tag: append_host_ip + value: '{{{qualys_vmdr.asset_host_detection.ip}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.asset_host_detection?.ip != null + - date: + field: json.LAST_PC_SCANNED_DATE + tag: date_LAST_PC_SCANNED_DATE + target_field: qualys_vmdr.asset_host_detection.last.pc_scanned_date + formats: + - ISO8601 + if: ctx.json?.LAST_PC_SCANNED_DATE != null && ctx.json.LAST_PC_SCANNED_DATE != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.LAST_SCAN_DATETIME + tag: date_LAST_SCAN_DATETIME + target_field: qualys_vmdr.asset_host_detection.last.scan_datetime + formats: + - ISO8601 + if: ctx.json?.LAST_SCAN_DATETIME != null && ctx.json.LAST_SCAN_DATETIME != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.LAST_VM_AUTH_SCANNED_DATE + tag: date_LAST_VM_AUTH_SCANNED_DATE + target_field: qualys_vmdr.asset_host_detection.last.vm.auth.scanned_date + formats: + - ISO8601 + if: ctx.json?.LAST_VM_AUTH_SCANNED_DATE != null && ctx.json.LAST_VM_AUTH_SCANNED_DATE != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.LAST_VM_SCANNED_DATE + tag: date_LAST_VM_SCANNED_DATE + target_field: qualys_vmdr.asset_host_detection.last.vm.scanned_date + formats: + - ISO8601 + if: ctx.json?.LAST_VM_SCANNED_DATE != null && ctx.json.LAST_VM_SCANNED_DATE != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.LAST_VM_AUTH_SCANNED_DURATION + tag: convert_LAST_VM_AUTH_SCANNED_DURATION_to_long + target_field: qualys_vmdr.asset_host_detection.last.vm.auth.scanned_duration + type: long + ignore_missing: true + if: ctx.json?.LAST_VM_AUTH_SCANNED_DURATION != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.LAST_VM_SCANNED_DURATION + tag: convert_LAST_VM_SCANNED_DURATION_to_long + target_field: qualys_vmdr.asset_host_detection.last.vm.scanned_duration + type: long + ignore_missing: true + if: ctx.json?.LAST_VM_SCANNED_DURATION != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: json.TAGS.TAG + if: ctx.json?.TAGS?.TAG instanceof List + tag: foreach_rename_TAG_ID + processor: + rename: + field: _ingest._value.TAG_ID + tag: rename_qualys_vmdr_asset_host_detection_tags_TAG_ID_1 + target_field: _ingest._value.id + ignore_missing: true + - foreach: + field: json.TAGS.TAG + if: ctx.json?.TAGS?.TAG instanceof List + tag: foreach_rename_TAG_NAME + processor: + rename: + field: _ingest._value.NAME + tag: rename_qualys_vmdr_asset_host_detection_tags_NAME_1 + target_field: _ingest._value.name + ignore_missing: true + - foreach: + field: json.TAGS.TAG + if: ctx.json?.TAGS?.TAG instanceof List + tag: foreach_rename_COLOR + processor: + rename: + field: _ingest._value.COLOR + tag: rename_qualys_vmdr_asset_host_detection_tags_COLOR_1 + target_field: _ingest._value.color + ignore_missing: true + - foreach: + field: json.TAGS.TAG + if: ctx.json?.TAGS?.TAG instanceof List + tag: foreach_rename_TAG_BACKGROUND_COLOR + processor: + rename: + field: _ingest._value.BACKGROUND_COLOR + tag: rename_qualys_vmdr_asset_host_detection_BACKGROUND_COLOR_NAME_1 + target_field: _ingest._value.background_color + ignore_missing: true + - rename: + field: json.TAGS.TAG + tag: rename_TAGS_TAG + target_field: qualys_vmdr.asset_host_detection.tags + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.tags.NAME + tag: rename_qualys_vmdr_asset_host_detection_tags_NAME_2 + target_field: qualys_vmdr.asset_host_detection.tags.name + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.tags.TAG_ID + tag: rename_qualys_vmdr_asset_host_detection_tags_TAG_ID_2 + target_field: qualys_vmdr.asset_host_detection.tags.id + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.tags.COLOR + tag: rename_qualys_vmdr_asset_host_detection_tags_COLOR_2 + target_field: qualys_vmdr.asset_host_detection.tags.color + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.tags.BACKGROUND_COLOR + tag: rename_qualys_vmdr_asset_host_detection_tags_BACKGROUND_COLOR_2 + target_field: qualys_vmdr.asset_host_detection.tags.background_color + ignore_missing: true + - rename: + field: json.METADATA.EC2.ATTRIBUTE + tag: rename_METADATA_EC2_ATTRIBUTE + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_rename_metadata_ec2_attribute_NAME + processor: + rename: + field: _ingest._value.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_NAME_1 + target_field: _ingest._value.name + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_NAME_2 + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.name + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_rename_metadata_ec2_attribute_LAST_STATUS + processor: + rename: + field: _ingest._value.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_STATUS_1 + target_field: _ingest._value.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_rename_metadata_ec2_attribute_VALUE + processor: + rename: + field: _ingest._value.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_VALUE_1 + target_field: _ingest._value.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_VALUE_2 + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_STATUS_2 + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_rename_metadata_ec2_attribute_LAST_ERROR + processor: + rename: + field: _ingest._value.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_ERROR_1 + target_field: _ingest._value.last.error.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_ERROR_2 + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.error.value + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_date_metadata_ec2_attribute_LAST_SUCCESS_DATE + processor: + date: + field: _ingest._value.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_SUCCESS_DATE_1 + target_field: _ingest._value.last.success_date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_SUCCESS_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute?.LAST_SUCCESS_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_SUCCESS_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.success_date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_date_metadata_ec2_attribute_LAST_ERROR_DATE + processor: + date: + field: _ingest._value.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_ERROR_DATE_1 + target_field: _ingest._value.last.error.date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_LAST_ERROR_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute?.LAST_ERROR_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_ERROR_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.error.date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.ec2.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.ec2?.attribute instanceof List + tag: foreach_remove_metadata_ec2_attribute_fields + processor: + remove: + field: + - _ingest._value.LAST_SUCCESS_DATE + - _ingest._value.LAST_ERROR_DATE + tag: remove_qualys_vmdr_asset_host_detection_metadata_ec2_attribute_fields + ignore_missing: true + - rename: + field: json.METADATA.GOOGLE.ATTRIBUTE + tag: rename_METADATA_GOOGLE_ATTRIBUTE + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_rename_metadata_google_attribute_NAME + processor: + rename: + field: _ingest._value.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_NAME_1 + target_field: _ingest._value.name + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_NAME_2 + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.name + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_rename_metadata_google_attribute_LAST_STATUS + processor: + rename: + field: _ingest._value.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_STATUS_1 + target_field: _ingest._value.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_rename_metadata_google_attribute_VALUE + processor: + rename: + field: _ingest._value.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_VALUE_1 + target_field: _ingest._value.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_VALUE_2 + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_STATUS_2 + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_rename_metadata_google_attribute_LAST_ERROR + processor: + rename: + field: _ingest._value.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_ERROR_1 + target_field: _ingest._value.last.error.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_ERROR_2 + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.last.error.value + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_date_metadata_google_attribute_LAST_SUCCESS_DATE + processor: + date: + field: _ingest._value.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_SUCCESS_DATE_1 + target_field: _ingest._value.last.success_date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_SUCCESS_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute?.LAST_SUCCESS_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_SUCCESS_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.last.success_date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_date_metadata_google_attribute_LAST_ERROR_DATE + processor: + date: + field: _ingest._value.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_ERROR_DATE_1 + target_field: _ingest._value.last.error.date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_google_attribute_LAST_ERROR_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute?.LAST_ERROR_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_ERROR_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.google.attribute.last.error.date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.google.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.google?.attribute instanceof List + tag: foreach_remove_metadata_google_attribute_fields + processor: + remove: + field: + - _ingest._value.LAST_SUCCESS_DATE + - _ingest._value.LAST_ERROR_DATE + tag: remove_qualys_vmdr_asset_host_detection_metadata_google_attribute_fields + ignore_missing: true + - rename: + field: json.METADATA.AZURE.ATTRIBUTE + tag: rename_METADATA_AZURE_ATTRIBUTE + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_rename_metadata_azure_attribute_NAME + processor: + rename: + field: _ingest._value.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_NAME_1 + target_field: _ingest._value.name + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.NAME + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_NAME_2 + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.name + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_rename_metadata_azure_attribute_LAST_STATUS + processor: + rename: + field: _ingest._value.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_STATUS_1 + target_field: _ingest._value.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_rename_metadata_azure_attribute_VALUE + processor: + rename: + field: _ingest._value.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_VALUE_1 + target_field: _ingest._value.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.VALUE + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_VALUE_2 + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_STATUS + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_STATUS_2 + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_rename_metadata_azure_attribute_LAST_ERROR + processor: + rename: + field: _ingest._value.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_ERROR_1 + target_field: _ingest._value.last.error.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_ERROR + tag: rename_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_ERROR_2 + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.error.value + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_date_metadata_azure_attribute_LAST_SUCCESS_DATE + processor: + date: + field: _ingest._value.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_SUCCESS_DATE_1 + target_field: _ingest._value.last.success_date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_SUCCESS_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute?.LAST_SUCCESS_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_SUCCESS_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.success_date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_date_metadata_azure_attribute_LAST_ERROR_DATE + processor: + date: + field: _ingest._value.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_ERROR_DATE_1 + target_field: _ingest._value.last.error.date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_ERROR_DATE + tag: date_qualys_vmdr_asset_host_detection_metadata_azure_attribute_LAST_ERROR_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute?.LAST_ERROR_DATE != null && ctx.qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_ERROR_DATE != '' + target_field: qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.error.date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.metadata.azure.attribute + if: ctx.qualys_vmdr?.asset_host_detection?.metadata?.azure?.attribute instanceof List + tag: foreach_remove_metadata_azure_attribute_fields + processor: + remove: + field: + - _ingest._value.LAST_SUCCESS_DATE + - _ingest._value.LAST_ERROR_DATE + tag: remove_qualys_vmdr_asset_host_detection_metadata_azure_attribute_fields + ignore_missing: true + - rename: + field: json.CLOUD_PROVIDER_TAGS.CLOUD_TAG + tag: rename_CLOUD_PROVIDER_TAGS_CLOUD_TAG + target_field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag + if: ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag instanceof List + tag: foreach_rename_cloud_provider_tags_NAME + processor: + rename: + field: _ingest._value.NAME + tag: rename_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_NAME_1 + target_field: _ingest._value.name + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.NAME + tag: rename_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_NAME_2 + target_field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.name + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag + if: ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag instanceof List + tag: foreach_rename_cloud_provider_tags_VALUE + processor: + rename: + field: _ingest._value.VALUE + tag: rename_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_VALUE_1 + target_field: _ingest._value.value + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.VALUE + tag: rename_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_VALUE_2 + target_field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.value + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag + if: ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag instanceof List + tag: foreach_date_cloud_provider_tags_LAST_SUCCESS_DATE + processor: + date: + field: _ingest._value.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_LAST_SUCCESS_DATE_1 + target_field: _ingest._value.last_success_date + formats: + - ISO8601 + ignore_failure: true + - date: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.LAST_SUCCESS_DATE + tag: date_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_LAST_SUCCESS_DATE_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag?.LAST_SUCCESS_DATE != null && ctx.qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.LAST_SUCCESS_DATE != '' + target_field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.last_success_date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag + if: ctx.qualys_vmdr?.asset_host_detection?.cloud?.provider?.tags?.cloud_tag instanceof List + tag: foreach_remove_cloud_provider_tags_fields + processor: + remove: + field: + - _ingest._value.LAST_SUCCESS_DATE + tag: remove_qualys_vmdr_asset_host_detection_cloud_provider_tags_cloud_tag_fields + ignore_missing: true + - script: + lang: painless + tag: script_to_set_IS_DISABLED + description: Script to set IS_DISABLED for 0 and 1 values. + if: ctx.json?.DETECTION_LIST?.DETECTION instanceof List + source: >- + for (def obj : ctx.json.DETECTION_LIST.DETECTION) { + if (obj.containsKey("IS_DISABLED") && obj.get("IS_DISABLED").equals('0')) { + obj.remove("IS_DISABLED"); + obj.put("IS_DISABLED", false); + } else if (obj.containsKey("IS_DISABLED") && obj.get("IS_DISABLED").equals('1')) { + obj.remove("IS_DISABLED"); + obj.put("IS_DISABLED", true); + } + } + - script: + lang: painless + tag: script_to_set_IS_IGNORED + description: Script to set IS_IGNORED for 0 and 1 values. + if: ctx.json?.DETECTION_LIST?.DETECTION instanceof List + source: >- + for (def obj : ctx.json.DETECTION_LIST.DETECTION) { + if (obj.containsKey("IS_IGNORED") && obj.get("IS_IGNORED").equals('0')) { + obj.remove("IS_IGNORED"); + obj.put("IS_IGNORED", false); + } else if (obj.containsKey("IS_IGNORED") && obj.get("IS_IGNORED").equals('1')) { + obj.remove("IS_IGNORED"); + obj.put("IS_IGNORED", true); + } + } + - rename: + field: json.DETECTION_LIST.DETECTION + tag: rename_DETECTION_LIST_DETECTION + target_field: qualys_vmdr.asset_host_detection.list + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_PROTOCOL + processor: + rename: + field: _ingest._value.PROTOCOL + tag: rename_qualys_vmdr_asset_host_detection_list_PROTOCOL_1 + target_field: _ingest._value.protocol + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_FQDN + processor: + rename: + field: _ingest._value.FQDN + tag: rename_qualys_vmdr_asset_host_detection_list_FQDN_1 + target_field: _ingest._value.fqdn + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_FQDN + processor: + append: + field: related.hosts + tag: append_qualys_vmdr_asset_host_detection_list_fqdn_into_related_hosts_1 + value: '{{{_ingest._value.fqdn}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_INSTANCE + processor: + rename: + field: _ingest._value.INSTANCE + tag: rename_qualys_vmdr_asset_host_detection_list_INSTANCE_1 + target_field: _ingest._value.instance + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_SERVICE + processor: + rename: + field: _ingest._value.SERVICE + tag: rename_qualys_vmdr_asset_host_detection_list_SERVICE_1 + target_field: _ingest._value.service + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_AFFECT_RUNNING_KERNEL + processor: + rename: + field: _ingest._value.AFFECT_RUNNING_KERNEL + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_RUNNING_KERNEL_1 + target_field: _ingest._value.affect.running.kernel + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_AFFECT_RUNNING_SERVICE + processor: + rename: + field: _ingest._value.AFFECT_RUNNING_SERVICE + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_RUNNING_SERVICE_1 + target_field: _ingest._value.affect.running.service + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_AFFECT_EXPLOITABLE_CONFIG + processor: + rename: + field: _ingest._value.AFFECT_EXPLOITABLE_CONFIG + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_EXPLOITABLE_CONFIG_1 + target_field: _ingest._value.affect.exploitable_config + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_ASSET_CVE + processor: + rename: + field: _ingest._value.ASSET_CVE + tag: rename_qualys_vmdr_asset_host_detection_list_ASSET_CVE_1 + target_field: _ingest._value.asset_cve + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_QID + processor: + rename: + field: _ingest._value.QID + tag: rename_qualys_vmdr_asset_host_detection_list_QID_1 + target_field: _ingest._value.qid + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_RESULTS + processor: + rename: + field: _ingest._value.RESULTS + tag: rename_qualys_vmdr_asset_host_detection_list_RESULTS_1 + target_field: _ingest._value.results + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_STATUS + processor: + rename: + field: _ingest._value.STATUS + tag: rename_qualys_vmdr_asset_host_detection_list_STATUS_1 + target_field: _ingest._value.status + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_TYPE + processor: + rename: + field: _ingest._value.TYPE + tag: rename_qualys_vmdr_asset_host_detection_list_TYPE_1 + target_field: _ingest._value.type + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_QDS + processor: + rename: + field: _ingest._value.QDS + tag: rename_qualys_vmdr_asset_host_detection_list_QDS_1 + target_field: _ingest._value.qds + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_qds_#text + processor: + rename: + field: _ingest._value.qds.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_#text_1 + target_field: _ingest._value.qds.text + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_SSL + processor: + rename: + field: _ingest._value.SSL + tag: rename_qualys_vmdr_asset_host_detection_list_SSL_1 + target_field: _ingest._value.ssl + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_FIRST_FOUND_DATETIME + processor: + date: + field: _ingest._value.FIRST_FOUND_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_FIRST_FOUND_DATETIME_1 + target_field: _ingest._value.first.found_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_FIRST_REOPENED_DATETIME + processor: + date: + field: _ingest._value.FIRST_REOPENED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_FIRST_REOPENED_DATETIME_1 + target_field: _ingest._value.first.reopened_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_FOUND_DATETIME + processor: + date: + field: _ingest._value.LAST_FOUND_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_FOUND_DATETIME_1 + target_field: _ingest._value.last.found_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_REOPENED_DATETIME + processor: + date: + field: _ingest._value.LAST_REOPENED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_REOPENED_DATETIME_1 + target_field: _ingest._value.last.reopened_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_PROCESSED_DATETIME + processor: + date: + field: _ingest._value.LAST_PROCESSED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_PROCESSED_DATETIME_1 + target_field: _ingest._value.last.processed_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_TEST_DATETIME + processor: + date: + field: _ingest._value.LAST_TEST_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_TEST_DATETIME_1 + target_field: _ingest._value.last.test_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_UPDATE_DATETIME + processor: + date: + field: _ingest._value.LAST_UPDATE_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_UPDATE_DATETIME_1 + target_field: _ingest._value.last.update_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_date_LAST_FIXED_DATETIME + processor: + date: + field: _ingest._value.LAST_FIXED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_FIXED_DATETIME_1 + target_field: _ingest._value.last.fixed_datetime + formats: + - ISO8601 + ignore_failure: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_CONVERT_SEVERITY + processor: + convert: + field: _ingest._value.SEVERITY + target_field: _ingest._value.severity + tag: convert_qualys_vmdr_asset_host_detection_list_SEVERITY_to_long_1 + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_convert_IS_IGNORED + processor: + convert: + field: _ingest._value.IS_IGNORED + target_field: _ingest._value.is_ignored + tag: convert_qualys_vmdr_asset_host_detection_list_IS_IGNORED_to_boolean + type: boolean + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_convert_IS_DISABLED + processor: + convert: + field: _ingest._value.IS_DISABLED + target_field: _ingest._value.is_disabled + tag: convert_qualys_vmdr_asset_host_detection_list_IS_DISABLED_to_boolean + type: boolean + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_convert_TIMES_FOUND + processor: + convert: + field: _ingest._value.TIMES_FOUND + target_field: _ingest._value.times.found + tag: convert_qualys_vmdr_asset_host_detection_list_TIMES_FOUND_to_long_1 + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_convert_TIMES_REOPENED + processor: + convert: + field: _ingest._value.TIMES_REOPENED + target_field: _ingest._value.times.reopened + tag: convert_qualys_vmdr_asset_host_detection_list_TIMES_REOPENED_to_long_1 + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_convert_PORT + processor: + convert: + field: _ingest._value.PORT + target_field: _ingest._value.port + tag: convert_qualys_vmdr_asset_host_detection_list_PORT_to_long_1 + type: long + ignore_missing: true + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_QDS_FACTOR + processor: + rename: + field: _ingest._value.QDS_FACTORS.QDS_FACTOR + tag: rename_qualys_vmdr_asset_host_detection_list_QDS_FACTORS_QDS_FACTOR_1 + target_field: _ingest._value.qds_factors + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_inside_foreach + processor: + foreach: + field: _ingest._value.qds_factors + ignore_missing: true + tag: foreach_nested + processor: + rename: + field: _ingest._value.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_factors_#text_1 + target_field: _ingest._value.text + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_rename_qds_factors_#text + processor: + rename: + field: _ingest._value.qds_factors.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_factors_#text_2 + target_field: _ingest._value.qds_factors.text + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.QDS_FACTORS.QDS_FACTOR + tag: rename_qualys_vmdr_asset_host_detection_list_QDS_FACTORS_QDS_FACTOR_2 + target_field: qualys_vmdr.asset_host_detection.list.qds_factors + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.qds_factors.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_factors_#text_3 + target_field: qualys_vmdr.asset_host_detection.list.qds_factors.text + ignore_missing: true + - foreach: + field: qualys_vmdr.asset_host_detection.list.qds_factors + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.qds_factors instanceof List + tag: foreach_rename_#text + processor: + rename: + field: _ingest._value.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_factors_#text_4 + target_field: _ingest._value.text + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.QDS + tag: rename_qualys_vmdr_asset_host_detection_list_QDS_2 + target_field: qualys_vmdr.asset_host_detection.list.qds + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.qds.#text + tag: rename_qualys_vmdr_asset_host_detection_list_qds_#text_2 + target_field: qualys_vmdr.asset_host_detection.list.qds.text + ignore_missing: true + - convert: + field: qualys_vmdr.asset_host_detection.list.PORT + target_field: qualys_vmdr.asset_host_detection.list.port + tag: convert_qualys_vmdr_asset_host_detection_list_PORT_to_long_2 + type: long + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.PORT != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: qualys_vmdr.asset_host_detection.list.TIMES_FOUND + target_field: qualys_vmdr.asset_host_detection.list.times.found + tag: convert_qualys_vmdr_asset_host_detection_list_TIMES_FOUND_to_long_2 + type: long + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.TIMES_FOUND != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: qualys_vmdr.asset_host_detection.list.TIMES_REOPENED + target_field: qualys_vmdr.asset_host_detection.list.times.reopened + tag: convert_qualys_vmdr_asset_host_detection_list_TIMES_REOPENED_to_long_2 + type: long + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.TIMES_REOPENED != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: qualys_vmdr.asset_host_detection.list.SEVERITY + target_field: qualys_vmdr.asset_host_detection.list.severity + tag: convert_qualys_vmdr_asset_host_detection_list_SEVERITY_to_long_2 + type: long + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.SEVERITY != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_UPDATE_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_UPDATE_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_UPDATE_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_UPDATE_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.update_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_FIXED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_FIXED_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_FIXED_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_FIXED_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.fixed_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_TEST_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_TEST_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_TEST_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_TEST_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.test_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_PROCESSED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_PROCESSED_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_PROCESSED_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_PROCESSED_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.processed_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_FOUND_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_FOUND_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_FOUND_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_FOUND_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.found_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.LAST_REOPENED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_LAST_REOPENED_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.LAST_REOPENED_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.LAST_REOPENED_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.last.reopened_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.FIRST_FOUND_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_FIRST_FOUND_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.FIRST_FOUND_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.FIRST_FOUND_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.first.found_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: qualys_vmdr.asset_host_detection.list.FIRST_REOPENED_DATETIME + tag: date_qualys_vmdr_asset_host_detection_list_FIRST_REOPENED_DATETIME_2 + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.FIRST_REOPENED_DATETIME != null && ctx.qualys_vmdr.asset_host_detection.list.FIRST_REOPENED_DATETIME != '' + target_field: qualys_vmdr.asset_host_detection.list.first.reopened_datetime + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: qualys_vmdr.asset_host_detection.list.SSL + tag: rename_qualys_vmdr_asset_host_detection_list_SSL_2 + target_field: qualys_vmdr.asset_host_detection.list.ssl + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.TYPE + tag: rename_qualys_vmdr_asset_host_detection_list_TYPE_2 + target_field: qualys_vmdr.asset_host_detection.list.type + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.STATUS + tag: rename_qualys_vmdr_asset_host_detection_list_STATUS_2 + target_field: qualys_vmdr.asset_host_detection.list.status + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.RESULTS + tag: rename_qualys_vmdr_asset_host_detection_list_RESULTS_2 + target_field: qualys_vmdr.asset_host_detection.list.results + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.QID + tag: rename_qualys_vmdr_asset_host_detection_list_QID_2 + target_field: qualys_vmdr.asset_host_detection.list.qid + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.PROTOCOL + tag: rename_qualys_vmdr_asset_host_detection_list_PROTOCOL_2 + target_field: qualys_vmdr.asset_host_detection.list.protocol + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.FQDN + tag: rename_qualys_vmdr_asset_host_detection_list_FQDN_2 + target_field: qualys_vmdr.asset_host_detection.list.fqdn + ignore_missing: true + - append: + field: related.hosts + tag: append_qualys_vmdr_asset_host_detection_list_fqdn_into_related_hosts_2 + value: '{{{qualys_vmdr.asset_host_detection.list.fqdn}}}' + allow_duplicates: false + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.fqdn != null + - rename: + field: qualys_vmdr.asset_host_detection.list.INSTANCE + tag: rename_qualys_vmdr_asset_host_detection_list_INSTANCE_2 + target_field: qualys_vmdr.asset_host_detection.list.instance + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.SERVICE + tag: rename_qualys_vmdr_asset_host_detection_list_SERVICE_2 + target_field: qualys_vmdr.asset_host_detection.list.service + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.AFFECT_RUNNING_KERNEL + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_RUNNING_KERNEL_2 + target_field: qualys_vmdr.asset_host_detection.list.affect.running.kernel + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.AFFECT_RUNNING_SERVICE + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_RUNNING_SERVICE_2 + target_field: qualys_vmdr.asset_host_detection.list.affect.running.service + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.AFFECT_EXPLOITABLE_CONFIG + tag: rename_qualys_vmdr_asset_host_detection_list_AFFECT_EXPLOITABLE_CONFIG_2 + target_field: qualys_vmdr.asset_host_detection.list.affect.exploitable_config + ignore_missing: true + - rename: + field: qualys_vmdr.asset_host_detection.list.ASSET_CVE + tag: rename_qualys_vmdr_asset_host_detection_list_ASSET_CVE_2 + target_field: qualys_vmdr.asset_host_detection.list.asset_cve + ignore_missing: true + - set: + field: qualys_vmdr.asset_host_detection.list.IS_DISABLED + tag: set_qualys_vmdr_asset_host_detection_list_IS_DISABLED_true + value: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_DISABLED == '1' + - set: + field: qualys_vmdr.asset_host_detection.list.IS_DISABLED + tag: set_qualys_vmdr_asset_host_detection_list_IS_DISABLED_false + value: false + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_DISABLED == '0' + - convert: + field: qualys_vmdr.asset_host_detection.list.IS_DISABLED + tag: convert_IS_DISABLED_to_boolean + target_field: qualys_vmdr.asset_host_detection.list.is_disabled + type: boolean + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_DISABLED != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: qualys_vmdr.asset_host_detection.list.IS_IGNORED + tag: set_qualys_vmdr_asset_host_detection_list_IS_IGNORED_true + value: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_IGNORED == '1' + - set: + field: qualys_vmdr.asset_host_detection.list.IS_IGNORED + tag: set_qualys_vmdr_asset_host_detection_list_IS_IGNORED_false + value: false + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_IGNORED == '0' + - convert: + field: qualys_vmdr.asset_host_detection.list.IS_IGNORED + tag: convert_IS_IGNORED_to_boolean + target_field: qualys_vmdr.asset_host_detection.list.is_ignored + type: boolean + ignore_missing: true + if: (!(ctx.qualys_vmdr?.asset_host_detection?.list instanceof List)) && ctx.qualys_vmdr?.asset_host_detection?.list?.IS_IGNORED != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.asset_host_detection.list + if: ctx.qualys_vmdr?.asset_host_detection?.list instanceof List + tag: foreach_remove_ingest_value_fields + processor: + remove: + field: + - _ingest._value.LAST_UPDATE_DATETIME + - _ingest._value.LAST_FIXED_DATETIME + - _ingest._value.LAST_TEST_DATETIME + - _ingest._value.LAST_PROCESSED_DATETIME + - _ingest._value.FIRST_FOUND_DATETIME + - _ingest._value.FIRST_REOPENED_DATETIME + - _ingest._value.LAST_FOUND_DATETIME + - _ingest._value.LAST_REOPENED_DATETIME + - _ingest._value.SEVERITY + - _ingest._value.TIMES_FOUND + - _ingest._value.TIMES_REOPENED + - _ingest._value.PORT + - _ingest._value.QDS_FACTORS + - _ingest._value.IS_DISABLED + - _ingest._value.IS_IGNORED + tag: remove_qualys_vmdr_asset_host_detection_list_fields + ignore_missing: true + - remove: + tag: remove_json + field: + - json + - message + - qualys_vmdr.asset_host_detection.list.FIRST_FOUND_DATETIME + - qualys_vmdr.asset_host_detection.list.FIRST_REOPENED_DATETIME + - qualys_vmdr.asset_host_detection.list.IS_DISABLED + - qualys_vmdr.asset_host_detection.list.LAST_FOUND_DATETIME + - qualys_vmdr.asset_host_detection.list.LAST_REOPENED_DATETIME + - qualys_vmdr.asset_host_detection.list.LAST_PROCESSED_DATETIME + - qualys_vmdr.asset_host_detection.list.LAST_TEST_DATETIME + - qualys_vmdr.asset_host_detection.list.LAST_UPDATE_DATETIME + - qualys_vmdr.asset_host_detection.list.LAST_FIXED_DATETIME + - qualys_vmdr.asset_host_detection.list.PORT + - qualys_vmdr.asset_host_detection.list.SEVERITY + - qualys_vmdr.asset_host_detection.list.TIMES_FOUND + - qualys_vmdr.asset_host_detection.list.TIMES_REOPENED + - qualys_vmdr.asset_host_detection.list.IS_IGNORED + - qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.LAST_SUCCESS_DATE + - qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_ERROR_DATE + - qualys_vmdr.asset_host_detection.metadata.ec2.attribute.LAST_SUCCESS_DATE + - qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_ERROR_DATE + - qualys_vmdr.asset_host_detection.metadata.google.attribute.LAST_SUCCESS_DATE + - qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_ERROR_DATE + - qualys_vmdr.asset_host_detection.metadata.azure.attribute.LAST_SUCCESS_DATE + ignore_missing: true + - remove: + field: + - qualys_vmdr.asset_host_detection.netbios + - qualys_vmdr.asset_host_detection.ip + - qualys_vmdr.asset_host_detection.id + - qualys_vmdr.asset_host_detection.os.value + tag: remove_preserve_duplicate_custom_fields + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + ignore_missing: true + - script: + lang: painless + tag: script_to_remove_null_values + description: Drops null/empty values recursively. + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_event_kind_2 + value: pipeline_error + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/fields/base-fields.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/base-fields.yml new file mode 100644 index 00000000000..a7bb79dd9b9 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: qualys_vmdr +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: qualys_vmdr.asset_host_detection +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/fields/beats.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/beats.yml new file mode 100644 index 00000000000..b3701b581cf --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/fields/fields.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/fields.yml new file mode 100644 index 00000000000..cffc1054343 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/fields/fields.yml @@ -0,0 +1,259 @@ +- name: qualys_vmdr.asset_host_detection + type: group + fields: + - name: asset_id + type: keyword + - name: cloud + type: group + fields: + - name: provider + type: group + fields: + - name: name + type: keyword + - name: tags + type: group + fields: + - name: cloud_tag + type: group + fields: + - name: last_success_date + type: date + - name: name + type: keyword + - name: value + type: keyword + - name: resource_id + type: keyword + - name: service + type: keyword + - name: dns + type: group + fields: + - name: value + type: keyword + - name: dns_data + type: group + fields: + - name: domain + type: keyword + - name: fqdn + type: keyword + - name: hostname + type: keyword + - name: ec2_instance_id + type: keyword + - name: id + type: keyword + - name: ip + type: ip + - name: ipv6 + type: ip + - name: last + type: group + fields: + - name: pc_scanned_date + type: date + - name: scan_datetime + type: date + - name: vm + type: group + fields: + - name: auth + type: group + fields: + - name: scanned_date + type: date + - name: scanned_duration + type: long + - name: scanned_date + type: date + - name: scanned_duration + type: long + - name: list + type: group + fields: + - name: affect + type: group + fields: + - name: exploitable_config + type: keyword + - name: running + type: group + fields: + - name: kernel + type: keyword + - name: service + type: keyword + - name: asset_cve + type: keyword + - name: first + type: group + fields: + - name: found_datetime + type: date + - name: reopened_datetime + type: date + - name: fqdn + type: keyword + - name: instance + type: keyword + - name: is_disabled + type: boolean + - name: is_ignored + type: boolean + - name: last + type: group + fields: + - name: fixed_datetime + type: date + - name: found_datetime + type: date + - name: processed_datetime + type: date + - name: reopened_datetime + type: date + - name: test_datetime + type: date + - name: update_datetime + type: date + - name: port + type: long + - name: protocol + type: keyword + - name: qds + type: group + fields: + - name: severity + type: keyword + - name: text + type: keyword + - name: qds_factors + type: group + fields: + - name: name + type: keyword + - name: text + type: keyword + - name: qid + type: keyword + - name: results + type: keyword + - name: service + type: keyword + - name: severity + type: long + - name: ssl + type: keyword + - name: status + type: keyword + - name: times + type: group + fields: + - name: found + type: long + - name: reopened + type: long + - name: type + type: keyword + - name: metadata + type: group + fields: + - name: azure + type: group + fields: + - name: attribute + type: group + fields: + - name: last + type: group + fields: + - name: error + type: group + fields: + - name: value + type: keyword + - name: date + type: date + - name: status + type: keyword + - name: success_date + type: date + - name: name + type: keyword + - name: value + type: keyword + - name: ec2 + type: group + fields: + - name: attribute + type: group + fields: + - name: last + type: group + fields: + - name: error + type: group + fields: + - name: value + type: keyword + - name: date + type: date + - name: status + type: keyword + - name: success_date + type: date + - name: name + type: keyword + - name: value + type: keyword + - name: google + type: group + fields: + - name: attribute + type: group + fields: + - name: last + type: group + fields: + - name: error + type: group + fields: + - name: value + type: keyword + - name: date + type: date + - name: status + type: keyword + - name: success_date + type: date + - name: name + type: keyword + - name: value + type: keyword + - name: netbios + type: keyword + - name: network_id + type: keyword + - name: os + type: group + fields: + - name: value + type: keyword + - name: cpe + type: keyword + - name: qg_host_id + type: keyword + - name: tags + type: group + fields: + - name: background_color + type: keyword + - name: color + type: keyword + - name: id + type: keyword + - name: name + type: keyword + - name: tracking_method + type: keyword diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml b/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml new file mode 100644 index 00000000000..8f374e24a07 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/manifest.yml @@ -0,0 +1,71 @@ +title: Collect Asset Host Detection data from Qualys VMDR platform. +type: logs +streams: + - input: cel + title: Asset Host Detection data + description: Collect Asset Host Detection data from Qualys VMDR platform. + template_path: input.yml.hbs + vars: + - name: url + type: text + title: URL + description: Base URL of the Qualys Server API. + required: true + show_user: true + - name: interval + type: text + title: Interval + description: "Interval between two REST API calls. User can choose interval as per their plan mentioned in [Qualys API Limits](https://www.qualys.com/docs/qualys-api-limits.pdf). Supported units for this parameter are h/m/s." + default: 4h + multi: false + required: true + show_user: true + - name: batch_size + type: integer + title: Batch Size + description: "Batch size for the response of the Qualys Server API. This parameter specifies the truncation limit for the response. Specify 0 for no truncation limit." + default: 1000 + multi: false + required: true + show_user: false + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h." + multi: false + required: true + show_user: false + default: 30s + - name: input_parameters + type: text + title: Input Parameters + description: "Input Parameters for the URL. param1=value¶m2=value¶m3=....*" + multi: false + required: false + show_user: true + default: "" + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - qualys_vmdr-asset_host_detection + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve qualys_vmdr.asset_host_detection fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json b/packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json new file mode 100644 index 00000000000..3473bc9bf83 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/asset_host_detection/sample_event.json @@ -0,0 +1,95 @@ +{ + "@timestamp": "2023-08-28T09:53:52.909Z", + "agent": { + "ephemeral_id": "24c009cf-e26d-4f8a-b66f-7412425ed0fe", + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "qualys_vmdr.asset_host_detection", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "qualys_vmdr.asset_host_detection", + "ingested": "2023-08-28T09:53:53Z", + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "id": "12048633", + "ip": [ + "10.50.2.111" + ] + }, + "input": { + "type": "cel" + }, + "qualys_vmdr": { + "asset_host_detection": { + "id": "12048633", + "ip": "10.50.2.111", + "last": { + "pc_scanned_date": "2023-06-28T09:58:12.000Z", + "scan_datetime": "2023-07-03T06:25:17.000Z", + "vm": { + "scanned_date": "2023-07-03T06:23:47.000Z", + "scanned_duration": 1113 + } + }, + "list": [ + { + "first": { + "found_datetime": "2023-06-28T06:04:26.000Z" + }, + "is_disabled": false, + "is_ignored": false, + "last": { + "found_datetime": "2023-07-03T06:23:47.000Z", + "processed_datetime": "2023-07-03T06:25:17.000Z", + "test_datetime": "2023-07-03T06:23:47.000Z", + "update_datetime": "2023-07-03T06:25:17.000Z" + }, + "qid": "91681", + "severity": 5, + "ssl": "0", + "status": "Active", + "times": { + "found": 11 + }, + "type": "Confirmed" + } + ], + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "12048633" + ], + "ip": [ + "10.50.2.111" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "qualys_vmdr-asset_host_detection" + ] +} \ No newline at end of file diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-common-config.yml b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..37e8fa225fd --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_duplicate_custom_fields diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log new file mode 100644 index 00000000000..67c1ec8f6ab --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log @@ -0,0 +1,2 @@ +{"VENDOR_REFERENCE_LIST": {"VENDOR_REFERENCE": {"ID": "ABCDEFG-2023-6e5d4757df","URL": "https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df"}},"THREAT_INTELLIGENCE": {"THREAT_INTEL": [{"#text": "Exploit_Public","id": "2"},{"#text": "High_Lateral_Movement","id": "4"}]},"VULN_TYPE": "Vulnerability","CONSEQUENCE": "Malicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.","CONSEQUENCE_COMMENT":"comment2","CVE_LIST": {"CVE": {"ID": "CVE-2023-0341","URL": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341"}},"DETECTION_INFO":"info1","LAST_CUSTOMIZATION":{"DATETIME":"2023-06-06T06:02:48Z","USER_LOGIN":"user_login"},"BUGTRAQ_LIST":{"BUGTRAQ":{"ID":"123","URL":"https://www.bugtraq.com"}},"LAST_SERVICE_MODIFICATION_DATETIME": "2023-06-06T06:02:45Z","PCI_REASONS": {"PCI_REASON": "The QID adheres to the PCI requirements based on the CVSS basescore."},"DIAGNOSIS": "Fedora has released a security update for editorconfig to fix the vulnerabilities.

Affected OS:
Fedora 37


","DIAGNOSIS_COMMENT":"comment1","PUBLISHED_DATETIME": "2023-06-05T13:38:36Z","SEVERITY_LEVEL": "4","SUPPORTED_MODULES": "VM,CA-Linux Agent","PCI_FLAG": "0","SOFTWARE_LIST": {"SOFTWARE": {"PRODUCT": "editorconfig","VENDOR": "fedora"}},"CORRELATION": {"EXPLOITS": {"EXPLT_SRC": {"EXPLT_LIST": {"EXPLT": {"LINK": "https://litios.github.io/2023/01/14/CVE-2023-0341.html","REF": "CVE-2023-0341","DESC": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer."}},"SRC_NAME": "nvd"}}, "MALWARE":{"MW_SRC":{"SRC_NAME":"mw","MW_LIST":{"MW_INFO":{"MW_ID":"123","MW_TYPE":"ec_glob","MW_PLATFORM":"unknown","MW_ALIAS":"unknown","MW_RATING":"2","MW_LINK":"https://litios.github.io/2023/01/14/MW-2023-0341.html"}}}}},"CVSS":{"BASE":"base","TEMPORAL":"temporal","VECTOR_STRING":"vector1","ACCESS":{"VECTOR":"xy_1","COMPLEXITY":"medium"},"IMPACT":{"CONFIDENTIALITY":"high","INTEGRITY":"integrity","AVAILABILITY":"yes"},"AUTHENTICATION":"auth","EXPLOITABILITY":"exploit","REMEDIATION_LEVEL":"remedy","REPORT_CONFIDENCE":"level"},"CVSS_V3":{"BASE":"base","TEMPORAL":"temporal","VECTOR_STRING":"ax_vb","CVSS3_VERSION":"1.0.0","ATTACK":{"VECTOR":"ax_vb","COMPLEXITY":"hard"},"IMPACT":{"CONFIDENTIALITY":"confidential","INTEGRITY":"0","AVAILABILITY":"1"},"PRIVILEGES_REQUIRED":"userlevel","USER_INTERACTION":"interact","SCOPE":"4","EXPLOIT_CODE_MATURITY":"mature","REMEDIATION_LEVEL":"5","REPORT_CONFIDENCE":"confident"},"AUTOMATIC_PCI_FAIL":"fail","TITLE": "Fedora Security Update for editorconfig (ABCDEFG-2023-6e5d4757df)","PATCHABLE": "0","IS_DISABLED": "0","QID": "284008","CHANGE_LOG_LIST": {"CHANGE_LOG_INFO": [{"CHANGE_DATE": "2023-06-05T18:04:20Z","COMMENTS": "Real-time threat indicator \"High_Lateral_Movement\" added."},{"CHANGE_DATE": "2023-06-06T05:00:02Z","COMMENTS": "Exploit added."},{"CHANGE_DATE": "2023-06-06T05:00:02Z","COMMENTS": "CVSS V2 temporal score updated from \"4\" to \"4.3\"."},{"COMMENTS": "CVSS V3 temporal score updated from \"6.8\" to \"7\".","CHANGE_DATE": "2023-06-06T05:00:02Z"},{"CHANGE_DATE": "2023-06-06T06:02:45Z","COMMENTS": "Real-time threat indicator \"Exploit_Public\" added."}]},"CATEGORY": "Fedora","DISCOVERY": {"REMOTE": "0","ADDITIONAL_INFO": "Patch Available, Exploit Available","AUTH_TYPE_LIST": {"AUTH_TYPE": "Unix"}},"COMPLIANCE_LIST":{"COMPLIANCE":{"TYPE":"law","SECTION":"law_section","DESCRIPTION":"Not Provided"}},"SOLUTION_COMMENT":"comment3","SOLUTION": "Refer to Fedora security advisory Fedora 37 for updates and patch information.\n

Patch:
\nFollowing are links for downloading patches to fix the vulnerabilities:\n

ABCDEFG-2023-6e5d4757df:Fedora 37"} +{"VENDOR_REFERENCE_LIST": {"VENDOR_REFERENCE": {"ID": "ABCDEFG-2023-6e5d4757df","URL": "https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df"}},"THREAT_INTELLIGENCE": {"THREAT_INTEL": {"#text": "High_Lateral_Movement","id": "4"}},"VULN_TYPE": "Vulnerability","CONSEQUENCE": "Malicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability.","CVE_LIST": {"CVE": {"ID": "CVE-2023-0341","URL": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341"}},"LAST_SERVICE_MODIFICATION_DATETIME": "2023-06-06T06:02:45Z","PCI_REASONS": {"PCI_REASON": "The QID adheres to the PCI requirements based on the CVSS basescore."},"DIAGNOSIS": "Fedora has released a security update for editorconfig to fix the vulnerabilities.

Affected OS:
Fedora 37


","PUBLISHED_DATETIME": "2023-06-05T13:38:36Z","SEVERITY_LEVEL": "9","SUPPORTED_MODULES": "VM,CA-Linux Agent","PCI_FLAG": "0","SOFTWARE_LIST": {"SOFTWARE": {"PRODUCT": "editorconfig","VENDOR": "fedora"}},"CORRELATION": {"EXPLOITS": {"EXPLT_SRC": {"EXPLT_LIST": {"EXPLT": {"LINK": "https://litios.github.io/2023/01/14/CVE-2023-0341.html","REF": "CVE-2023-0341","DESC": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer."}},"SRC_NAME": "nvd"}}},"TITLE": "Fedora Security Update for editorconfig (ABCDEFG-2023-6e5d4757df)","PATCHABLE": "0","IS_DISABLED": "0","QID": "284008","CHANGE_LOG_LIST": {"CHANGE_LOG_INFO": {"CHANGE_DATE": "2023-06-05T18:04:20Z","COMMENTS": "Real-time threat indicator \"High_Lateral_Movement\" added."}},"CATEGORY": "Fedora","DISCOVERY": {"REMOTE": "0","ADDITIONAL_INFO": "Patch Available, Exploit Available","AUTH_TYPE_LIST": {"AUTH_TYPE": "Unix"}},"SOLUTION": "Refer to Fedora security advisory Fedora 37 for updates and patch information.\n

Patch:
\nFollowing are links for downloading patches to fix the vulnerabilities:\n

ABCDEFG-2023-6e5d4757df:Fedora 37"} \ No newline at end of file diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log-expected.json b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log-expected.json new file mode 100644 index 00000000000..f00c929af8f --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/pipeline/test-knowledge-base.log-expected.json @@ -0,0 +1,320 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-06T06:02:45.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "id": "284008", + "kind": "alert", + "type": [ + "info" + ] + }, + "qualys_vmdr": { + "knowledge_base": { + "automatic_pci_fail": "fail", + "bugtraq_list": { + "id": "123", + "url": "https://www.bugtraq.com" + }, + "category": "Fedora", + "changelog_list": { + "info": [ + { + "change_date": "2023-06-05T18:04:20.000Z", + "comments": "Real-time threat indicator \"High_Lateral_Movement\" added." + }, + { + "change_date": "2023-06-06T05:00:02.000Z", + "comments": "Exploit added." + }, + { + "change_date": "2023-06-06T05:00:02.000Z", + "comments": "CVSS V2 temporal score updated from \"4\" to \"4.3\"." + }, + { + "change_date": "2023-06-06T05:00:02.000Z", + "comments": "CVSS V3 temporal score updated from \"6.8\" to \"7\"." + }, + { + "change_date": "2023-06-06T06:02:45.000Z", + "comments": "Real-time threat indicator \"Exploit_Public\" added." + } + ] + }, + "compliance_list": { + "description": "Not Provided", + "section": "law_section", + "type": "law" + }, + "consequence": { + "comment": "comment2", + "value": "Malicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability." + }, + "correlation": { + "exploits": { + "explt_src": { + "list": { + "explt": { + "desc": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.", + "link": "https://litios.github.io/2023/01/14/CVE-2023-0341.html", + "ref": "CVE-2023-0341" + } + }, + "name": "nvd" + } + }, + "malware": { + "src": { + "list": { + "info": { + "alias": "unknown", + "id": "123", + "link": "https://litios.github.io/2023/01/14/MW-2023-0341.html", + "platform": "unknown", + "rating": "2", + "type": "ec_glob" + } + }, + "name": "mw" + } + } + }, + "cve_list": { + "id": "CVE-2023-0341", + "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341" + }, + "cvss": { + "access": { + "complexity": "medium", + "vector": "xy_1" + }, + "authentication": "auth", + "base": "base", + "exploitability": "exploit", + "impact": { + "availability": "yes", + "confidentiality": "high", + "integrity": "integrity" + }, + "remediation_level": "remedy", + "report_confidence": "level", + "temporal": "temporal", + "vector_string": "vector1" + }, + "cvss_v3": { + "attack": { + "complexity": "hard", + "vector": "ax_vb" + }, + "base": "base", + "exploit_code_maturity": "mature", + "impact": { + "availability": "1", + "confidentiality": "confidential", + "integrity": "0" + }, + "privileges_required": "userlevel", + "remediation_level": "5", + "report_confidence": "confident", + "scope": "4", + "temporal": "temporal", + "user_interaction": "interact", + "vector_string": "ax_vb", + "version": "1.0.0" + }, + "detection_info": "info1", + "diagnosis": { + "comment": "comment1", + "value": "Fedora has released a security update for editorconfig to fix the vulnerabilities.\u003cP\u003eAffected OS:\u003cBR\u003eFedora 37\u003cP\u003e\u003cBR\u003e" + }, + "discovery": { + "additional_info": "Patch Available, Exploit Available", + "auth_type_list": { + "value": "Unix" + }, + "remote": 0 + }, + "is_disabled": false, + "last": { + "customization": { + "datetime": "2023-06-06T06:02:48.000Z", + "user_login": "user_login" + }, + "service_modification_datetime": "2023-06-06T06:02:45.000Z" + }, + "patchable": false, + "pci_flag": false, + "pci_reasons": { + "value": "The QID adheres to the PCI requirements based on the CVSS basescore." + }, + "published_datetime": "2023-06-05T13:38:36.000Z", + "qid": "284008", + "severity_level": "4", + "software_list": { + "product": "editorconfig", + "vendor": "fedora" + }, + "solution": { + "comment": "comment3", + "value": "Refer to Fedora security advisory \u003cA HREF=\"https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df\" TARGET=\"_blank\"\u003eFedora 37\u003c/A\u003e for updates and patch information.\n\u003cP\u003ePatch:\u003cBR\u003e\nFollowing are links for downloading patches to fix the vulnerabilities:\n\u003cP\u003e \u003cA HREF=\"https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df\" TARGET=\"_blank\"\u003eABCDEFG-2023-6e5d4757df:Fedora 37\u003c/A\u003e" + }, + "supported_modules": "VM,CA-Linux Agent", + "threat_intelligence": { + "intel": [ + { + "id": "2", + "text": "Exploit_Public" + }, + { + "id": "4", + "text": "High_Lateral_Movement" + } + ] + }, + "title": "Fedora Security Update for editorconfig (ABCDEFG-2023-6e5d4757df)", + "vendor_reference_list": { + "id": "ABCDEFG-2023-6e5d4757df", + "url": "https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df" + }, + "vuln_type": "Vulnerability" + } + }, + "tags": [ + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "cve.mitre.org", + "extension": "cgi", + "original": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341", + "path": "/cgi-bin/cvename.cgi", + "query": "name=CVE-2023-0341", + "scheme": "http" + }, + "vulnerability": { + "category": [ + "Fedora" + ], + "description": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.", + "id": "CVE-2023-0341", + "reference": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341", + "severity": "Medium" + } + }, + { + "@timestamp": "2023-06-06T06:02:45.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "host" + ], + "id": "284008", + "kind": "alert", + "type": [ + "info" + ] + }, + "qualys_vmdr": { + "knowledge_base": { + "category": "Fedora", + "changelog_list": { + "info": { + "change_date": "2023-06-05T18:04:20.000Z", + "comments": "Real-time threat indicator \"High_Lateral_Movement\" added." + } + }, + "consequence": { + "value": "Malicious users could use this vulnerability to change partial contents or configuration on the system. Additionally this vulnerability can also be used to cause a limited denial of service in the form of interruptions in resource availability." + }, + "correlation": { + "exploits": { + "explt_src": { + "list": { + "explt": { + "desc": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.", + "link": "https://litios.github.io/2023/01/14/CVE-2023-0341.html", + "ref": "CVE-2023-0341" + } + }, + "name": "nvd" + } + } + }, + "cve_list": { + "id": "CVE-2023-0341", + "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341" + }, + "diagnosis": { + "value": "Fedora has released a security update for editorconfig to fix the vulnerabilities.\u003cP\u003eAffected OS:\u003cBR\u003eFedora 37\u003cP\u003e\u003cBR\u003e" + }, + "discovery": { + "additional_info": "Patch Available, Exploit Available", + "auth_type_list": { + "value": "Unix" + }, + "remote": 0 + }, + "is_disabled": false, + "last": { + "service_modification_datetime": "2023-06-06T06:02:45.000Z" + }, + "patchable": false, + "pci_flag": false, + "pci_reasons": { + "value": "The QID adheres to the PCI requirements based on the CVSS basescore." + }, + "published_datetime": "2023-06-05T13:38:36.000Z", + "qid": "284008", + "severity_level": "9", + "software_list": { + "product": "editorconfig", + "vendor": "fedora" + }, + "solution": { + "value": "Refer to Fedora security advisory \u003cA HREF=\"https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df\" TARGET=\"_blank\"\u003eFedora 37\u003c/A\u003e for updates and patch information.\n\u003cP\u003ePatch:\u003cBR\u003e\nFollowing are links for downloading patches to fix the vulnerabilities:\n\u003cP\u003e \u003cA HREF=\"https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df\" TARGET=\"_blank\"\u003eABCDEFG-2023-6e5d4757df:Fedora 37\u003c/A\u003e" + }, + "supported_modules": "VM,CA-Linux Agent", + "threat_intelligence": { + "intel": { + "id": "4", + "text": "High_Lateral_Movement" + } + }, + "title": "Fedora Security Update for editorconfig (ABCDEFG-2023-6e5d4757df)", + "vendor_reference_list": { + "id": "ABCDEFG-2023-6e5d4757df", + "url": "https://bodhi.fedoraproject.org/updates/ABCDEFG-2023-6e5d4757df" + }, + "vuln_type": "Vulnerability" + } + }, + "tags": [ + "preserve_duplicate_custom_fields" + ], + "url": { + "domain": "cve.mitre.org", + "extension": "cgi", + "original": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341", + "path": "/cgi-bin/cvename.cgi", + "query": "name=CVE-2023-0341", + "scheme": "http" + }, + "vulnerability": { + "category": [ + "Fedora" + ], + "description": "A stack buffer overflow exists in the ec_glob function of editorconfig-core-c before v0.12.6 which allowed an attacker to arbitrarily write to the stack and possibly allows remote code execution. editorconfig-core-c v0.12.6 resolved this vulnerability by bound checking all write operations over the p_pcre buffer.", + "id": "CVE-2023-0341", + "reference": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0341", + "severity": "Critical" + } + } + ] +} \ No newline at end of file diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/system/test-default-config.yml b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..2e80cc9d5a0 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/_dev/test/system/test-default-config.yml @@ -0,0 +1,11 @@ +input: cel +service: qualys_vmdr +vars: + username: xxxx + password: xxxx +data_stream: + vars: + url: http://{{Hostname}}:{{Port}} + preserve_duplicate_custom_fields: true +assert: + hit_count: 1 diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/agent/stream/input.yml.hbs b/packages/qualys_vmdr/data_stream/knowledge_base/agent/stream/input.yml.hbs new file mode 100644 index 00000000000..89f63c6e489 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/agent/stream/input.yml.hbs @@ -0,0 +1,708 @@ +config_version: 2 +interval: {{interval}} +{{#if proxy_url}} +resource.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +resource.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +resource.timeout: {{http_client_timeout}} +{{/if}} +resource.url: {{url}} +state: + user: {{username}} + password: {{password}} + params: {{input_parameters}} + initial_interval: {{initial_interval}} +redact: + fields: + - password +program: | + request("GET", state.url + "/api/2.0/fo/knowledge_base/vuln/?action=list&last_modified_after=" + + (has(state.cursor) && has(state.cursor.last_modified) && state.cursor.last_modified != null + ? + state.cursor.last_modified.parse_time(time_layout.RFC3339) + : + (now() - duration(state.initial_interval))).format(time_layout.RFC3339) + "&" + + (has(state.params) ? "&" + state.params : "") + ).with({ + "Header":{ + "X-Requested-With": ["curl"], + "Authorization": ["Basic "+string(base64(state.user+":"+state.password))], + } + }).do_request().as(resp, bytes(resp.Body).decode_xml('qualys_api_2_0').as(body, { + "events": (has(body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST) ? + body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.map(e,{ + "message": e.encode_json() + }) + : + body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.ID_SET + ), + "cursor": { + "last_modified": ( + has(body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST) && has(body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN) && body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.size() > 0 + ? + body.doc.KNOWLEDGE_BASE_VULN_LIST_OUTPUT.RESPONSE.VULN_LIST.VULN.map(e, e.LAST_SERVICE_MODIFICATION_DATETIME).max() + : + ( + has(state.cursor) && has(state.cursor.last_modified) + ? + state.cursor.last_modified + : + null + ) + ) + }, + "user": state.user, + "password": state.password, + "params": has(state.params) ? state.params : "", + "initial_interval": state.initial_interval + })) +tags: +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} +xsd: + qualys_api_2_0: | + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/elasticsearch/ingest_pipeline/default.yml b/packages/qualys_vmdr/data_stream/knowledge_base/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..c716e454227 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,684 @@ +--- +description: Pipeline for processing Knowledge Base data. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - set: + field: event.kind + tag: set_event_kind_1 + value: alert + - set: + field: event.category + tag: set_event_catgeory + value: [host] + - set: + field: event.type + tag: set_event_type + value: [info] + - json: + field: message + tag: json_message + target_field: json + if: ctx.message != null + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - fingerprint: + fields: + - json.QID + - json.LAST_SERVICE_MODIFICATION_DATETIME + target_field: _id + ignore_missing: true + - rename: + field: ID_RANGE + tag: rename_ID_RANGE + target_field: qualys_vmdr.knowledge_base.id_range + ignore_missing: true + - rename: + field: ID + tag: rename_ID + target_field: qualys_vmdr.knowledge_base.ids + ignore_missing: true + - rename: + field: json.CONSEQUENCE + tag: rename_CONSEQUENCE + target_field: qualys_vmdr.knowledge_base.consequence.value + ignore_missing: true + - rename: + field: json.CONSEQUENCE_COMMENT + tag: rename_CONSEQUENCE_COMMENT + target_field: qualys_vmdr.knowledge_base.consequence.comment + ignore_missing: true + - rename: + field: json.DETECTION_INFO + tag: rename_DETECTION_INFO + target_field: qualys_vmdr.knowledge_base.detection_info + ignore_missing: true + - rename: + field: json.COMPLIANCE_LIST.COMPLIANCE.TYPE + tag: rename_COMPLIANCE_LIST_COMPLIANCE_TYPE + target_field: qualys_vmdr.knowledge_base.compliance_list.type + ignore_missing: true + - rename: + field: json.COMPLIANCE_LIST.COMPLIANCE.SECTION + tag: rename_COMPLIANCE_LIST_COMPLIANCE_SECTION + target_field: qualys_vmdr.knowledge_base.compliance_list.section + ignore_missing: true + - rename: + field: json.COMPLIANCE_LIST.COMPLIANCE.DESCRIPTION + tag: rename_COMPLIANCE_LIST_COMPLIANCE_DESCRIPTION + target_field: qualys_vmdr.knowledge_base.compliance_list.description + ignore_missing: true + - rename: + field: json.CATEGORY + tag: rename_CATEGORY + target_field: qualys_vmdr.knowledge_base.category + ignore_missing: true + - append: + field: vulnerability.category + tag: append_vulnerability_category + value: '{{{qualys_vmdr.knowledge_base.category}}}' + allow_duplicates: false + if: ctx.qualys_vmdr?.knowledge_base?.category != null + - rename: + field: json.DIAGNOSIS + tag: rename_DIAGNOSIS + target_field: qualys_vmdr.knowledge_base.diagnosis.value + ignore_missing: true + - rename: + field: json.DIAGNOSIS_COMMENT + tag: rename_DIAGNOSIS_COMMENT + target_field: qualys_vmdr.knowledge_base.diagnosis.comment + ignore_missing: true + - rename: + field: json.PCI_REASONS.PCI_REASON + tag: rename_PCI_REASONS_PCI_REASON + target_field: qualys_vmdr.knowledge_base.pci_reasons.value + ignore_missing: true + - rename: + field: json.QID + tag: rename_QID + target_field: qualys_vmdr.knowledge_base.qid + ignore_missing: true + - set: + field: event.id + tag: set_event_id + copy_from: qualys_vmdr.knowledge_base.qid + ignore_empty_value: true + - rename: + field: json.SOLUTION + tag: rename_SOLUTION + target_field: qualys_vmdr.knowledge_base.solution.value + ignore_missing: true + - rename: + field: json.SOLUTION_COMMENT + tag: rename_SOLUTION_COMMENT + target_field: qualys_vmdr.knowledge_base.solution.comment + ignore_missing: true + - rename: + field: json.SUPPORTED_MODULES + tag: rename_SUPPORTED_MODULES + target_field: qualys_vmdr.knowledge_base.supported_modules + ignore_missing: true + - rename: + field: json.TITLE + tag: rename_TITLE + target_field: qualys_vmdr.knowledge_base.title + ignore_missing: true + - rename: + field: json.BUGTRAQ_LIST.BUGTRAQ.ID + tag: rename_BUGTRAQ_LIST_BUGTRAQ_ID + target_field: qualys_vmdr.knowledge_base.bugtraq_list.id + ignore_missing: true + - rename: + field: json.BUGTRAQ_LIST.BUGTRAQ.URL + tag: rename_BUGTRAQ_LIST_BUGTRAQ_URL + target_field: qualys_vmdr.knowledge_base.bugtraq_list.url + ignore_missing: true + - rename: + field: json.VULN_TYPE + tag: rename_VULN_TYPE + target_field: qualys_vmdr.knowledge_base.vuln_type + ignore_missing: true + - rename: + field: json.CVE_LIST.CVE.ID + tag: rename_CVE_LIST_CVE_ID + target_field: qualys_vmdr.knowledge_base.cve_list.id + ignore_missing: true + - rename: + field: json.CVSS.BASE + tag: rename_CVSS.BASE + target_field: qualys_vmdr.knowledge_base.cvss.base + ignore_missing: true + - rename: + field: json.CVSS.TEMPORAL + tag: rename_CVSS_TEMPORAL + target_field: qualys_vmdr.knowledge_base.cvss.temporal + ignore_missing: true + - rename: + field: json.CVSS.VECTOR_STRING + tag: rename_CVSS_VECTOR_STRING + target_field: qualys_vmdr.knowledge_base.cvss.vector_string + ignore_missing: true + - rename: + field: json.CVSS.ACCESS.VECTOR + tag: rename_CVSS_ACCESS_VECTOR + target_field: qualys_vmdr.knowledge_base.cvss.access.vector + ignore_missing: true + - rename: + field: json.CVSS.ACCESS.COMPLEXITY + tag: rename_CVSS_ACCESS_COMPLEXITY + target_field: qualys_vmdr.knowledge_base.cvss.access.complexity + ignore_missing: true + - rename: + field: json.CVSS.IMPACT.CONFIDENTIALITY + tag: rename_CVSS_IMPACT_CONFIDENTIALITY + target_field: qualys_vmdr.knowledge_base.cvss.impact.confidentiality + ignore_missing: true + - rename: + field: json.CVSS.IMPACT.INTEGRITY + tag: rename_CVSS_IMPACT_INTEGRITY + target_field: qualys_vmdr.knowledge_base.cvss.impact.integrity + ignore_missing: true + - rename: + field: json.CVSS.IMPACT.AVAILABILITY + tag: rename_CVSS_IMPACT_AVAILABILITY + target_field: qualys_vmdr.knowledge_base.cvss.impact.availability + ignore_missing: true + - rename: + field: json.CVSS.AUTHENTICATION + tag: rename_CVSS_AUTHENTICATION + target_field: qualys_vmdr.knowledge_base.cvss.authentication + ignore_missing: true + - rename: + field: json.CVSS.EXPLOITABILITY + tag: rename_CVSS_EXPLOITABILITY + target_field: qualys_vmdr.knowledge_base.cvss.exploitability + ignore_missing: true + - rename: + field: json.CVSS.REMEDIATION_LEVEL + tag: rename_CVSS_REMEDIATION_LEVEL + target_field: qualys_vmdr.knowledge_base.cvss.remediation_level + ignore_missing: true + - rename: + field: json.CVSS.REPORT_CONFIDENCE + tag: rename_CVSS_REPORT_CONFIDENCE + target_field: qualys_vmdr.knowledge_base.cvss.report_confidence + ignore_missing: true + - rename: + field: json.CVSS_V3.BASE + tag: rename_CVSS_V3.BASE + target_field: qualys_vmdr.knowledge_base.cvss_v3.base + ignore_missing: true + - rename: + field: json.CVSS_V3.TEMPORAL + tag: rename_CVSS_V3_TEMPORAL + target_field: qualys_vmdr.knowledge_base.cvss_v3.temporal + ignore_missing: true + - rename: + field: json.CVSS_V3.VECTOR_STRING + tag: rename_CVSS_V3_VECTOR_STRING + target_field: qualys_vmdr.knowledge_base.cvss_v3.vector_string + ignore_missing: true + - rename: + field: json.CVSS_V3.CVSS3_VERSION + tag: rename_CVSS_V3_CVSS3_VERSION + target_field: qualys_vmdr.knowledge_base.cvss_v3.version + ignore_missing: true + - rename: + field: json.CVSS_V3.ATTACK.VECTOR + tag: rename_CVSS_V3_ATTACK_VECTOR + target_field: qualys_vmdr.knowledge_base.cvss_v3.attack.vector + ignore_missing: true + - rename: + field: json.CVSS_V3.ATTACK.COMPLEXITY + tag: rename_CVSS_V3_ATTACK_COMPLEXITY + target_field: qualys_vmdr.knowledge_base.cvss_v3.attack.complexity + ignore_missing: true + - rename: + field: json.CVSS_V3.IMPACT.CONFIDENTIALITY + tag: rename_CVSS_V3_IMPACT_CONFIDENTIALITY + target_field: qualys_vmdr.knowledge_base.cvss_v3.impact.confidentiality + ignore_missing: true + - rename: + field: json.CVSS_V3.IMPACT.INTEGRITY + tag: rename_CVSS_V3_IMPACT_INTEGRITY + target_field: qualys_vmdr.knowledge_base.cvss_v3.impact.integrity + ignore_missing: true + - rename: + field: json.CVSS_V3.IMPACT.AVAILABILITY + tag: rename_CVSS_V3_IMPACT_AVAILABILITY + target_field: qualys_vmdr.knowledge_base.cvss_v3.impact.availability + ignore_missing: true + - rename: + field: json.CVSS_V3.PRIVILEGES_REQUIRED + tag: rename_CVSS_V3_PRIVILEGES_REQUIRED + target_field: qualys_vmdr.knowledge_base.cvss_v3.privileges_required + ignore_missing: true + - rename: + field: json.CVSS_V3.USER_INTERACTION + tag: rename_CVSS_V3_USER_INTERACTION + target_field: qualys_vmdr.knowledge_base.cvss_v3.user_interaction + ignore_missing: true + - rename: + field: json.CVSS_V3.SCOPE + tag: rename_CVSS_V3_SCOPE + target_field: qualys_vmdr.knowledge_base.cvss_v3.scope + ignore_missing: true + - rename: + field: json.CVSS_V3.EXPLOIT_CODE_MATURITY + tag: rename_CVSS_V3_EXPLOIT_CODE_MATURITY + target_field: qualys_vmdr.knowledge_base.cvss_v3.exploit_code_maturity + ignore_missing: true + - rename: + field: json.CVSS_V3.REMEDIATION_LEVEL + tag: rename_CVSS_V3_REMEDIATION_LEVEL + target_field: qualys_vmdr.knowledge_base.cvss_v3.remediation_level + ignore_missing: true + - rename: + field: json.CVSS_V3.REPORT_CONFIDENCE + tag: rename_CVSS_V3_REPORT_CONFIDENCE + target_field: qualys_vmdr.knowledge_base.cvss_v3.report_confidence + ignore_missing: true + - rename: + field: json.AUTOMATIC_PCI_FAIL + tag: rename_AUTOMATIC_PCI_FAIL + target_field: qualys_vmdr.knowledge_base.automatic_pci_fail + ignore_missing: true + - set: + field: vulnerability.id + tag: set_vulnerability_id + copy_from: qualys_vmdr.knowledge_base.cve_list.id + ignore_empty_value: true + - rename: + field: json.CVE_LIST.CVE.URL + tag: rename_CVE_LIST_CVE_URL + target_field: qualys_vmdr.knowledge_base.cve_list.url + ignore_missing: true + - set: + field: vulnerability.reference + tag: set_vulnerability_reference + copy_from: qualys_vmdr.knowledge_base.cve_list.url + ignore_empty_value: true + - uri_parts: + field: vulnerability.reference + tag: 'uri_parts_to_split_vulnerability_reference' + if: ctx.vulnerability?.reference != null + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.CORRELATION.EXPLOITS.EXPLT_SRC.EXPLT_LIST.EXPLT.DESC + tag: rename_CORRELATION_EXPLOITS_EXPLT_SRC_EXPLT_LIST_EXPLT_DESC + target_field: qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.desc + ignore_missing: true + - set: + field: vulnerability.description + tag: set_vulnerability_description + copy_from: qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.desc + ignore_empty_value: true + - rename: + field: json.CORRELATION.EXPLOITS.EXPLT_SRC.EXPLT_LIST.EXPLT.LINK + tag: rename_CORRELATION_EXPLOITS_EXPLT_SRC_EXPLT_LIST_EXPLT_LINK + target_field: qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.link + ignore_missing: true + - rename: + field: json.CORRELATION.EXPLOITS.EXPLT_SRC.EXPLT_LIST.EXPLT.REF + tag: rename_CORRELATION_EXPLOITS_EXPLT_SRC_EXPLT_LIST_EXPLT_REF + target_field: qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.ref + ignore_missing: true + - rename: + field: json.CORRELATION.EXPLOITS.EXPLT_SRC.SRC_NAME + tag: rename_CORRELATION_EXPLOITS_EXPLT_SRC_SRC_NAME + target_field: qualys_vmdr.knowledge_base.correlation.exploits.explt_src.name + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_ID + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_ID + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.id + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.SRC_NAME + tag: rename_CORRELATION_MALWARE_MW_SRC_SRC_NAME + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.name + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_TYPE + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_TYPE + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.type + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_PLATFORM + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_PLATFORM + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.platform + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_ALIAS + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_ALIAS + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.alias + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_RATING + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_RATING + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.rating + ignore_missing: true + - rename: + field: json.CORRELATION.MALWARE.MW_SRC.MW_LIST.MW_INFO.MW_LINK + tag: rename_CORRELATION_MALWARE_MW_SRC_MW_LIST_MW_INFO_MW_LINK + target_field: qualys_vmdr.knowledge_base.correlation.malware.src.list.info.link + ignore_missing: true + - rename: + field: json.DISCOVERY.ADDITIONAL_INFO + tag: rename_DISCOVERY_ADDITIONAL_INFO + target_field: qualys_vmdr.knowledge_base.discovery.additional_info + ignore_missing: true + - rename: + field: json.DISCOVERY.AUTH_TYPE_LIST.AUTH_TYPE + tag: rename_DISCOVERY_AUTH_TYPE_LIST_AUTH_TYPE + target_field: qualys_vmdr.knowledge_base.discovery.auth_type_list.value + ignore_missing: true + - convert: + field: json.DISCOVERY.REMOTE + tag: convert_DISCOVERY_REMOTE_to_long + target_field: qualys_vmdr.knowledge_base.discovery.remote + type: long + ignore_missing: true + if: ctx.json?.DISCOVERY?.REMOTE != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.SOFTWARE_LIST.SOFTWARE.PRODUCT + tag: rename_SOFTWARE_LIST_SOFTWARE_PRODUCT + target_field: qualys_vmdr.knowledge_base.software_list.product + ignore_missing: true + - rename: + field: json.SOFTWARE_LIST.SOFTWARE.VENDOR + tag: rename_SOFTWARE_LIST_SOFTWARE_VENDOR + target_field: qualys_vmdr.knowledge_base.software_list.vendor + ignore_missing: true + - rename: + field: json.VENDOR_REFERENCE_LIST.VENDOR_REFERENCE.ID + tag: rename_VENDOR_REFERENCE_LIST_VENDOR_REFERENCE_ID + target_field: qualys_vmdr.knowledge_base.vendor_reference_list.id + ignore_missing: true + - rename: + field: json.VENDOR_REFERENCE_LIST.VENDOR_REFERENCE.URL + tag: rename_VENDOR_REFERENCE_LIST_VENDOR_REFERENCE_URL + target_field: qualys_vmdr.knowledge_base.vendor_reference_list.url + ignore_missing: true + - date: + field: json.LAST_SERVICE_MODIFICATION_DATETIME + tag: date_LAST_SERVICE_MODIFICATION_DATETIME + target_field: qualys_vmdr.knowledge_base.last.service_modification_datetime + formats: + - ISO8601 + if: ctx.json?.LAST_SERVICE_MODIFICATION_DATETIME != null && ctx.json.LAST_SERVICE_MODIFICATION_DATETIME != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.LAST_SERVICE_MODIFICATION_DATETIME + tag: date_LAST_SERVICE_MODIFICATION_DATETIME_to_timestamp + formats: + - ISO8601 + if: ctx.json?.LAST_SERVICE_MODIFICATION_DATETIME != null && ctx.json.LAST_SERVICE_MODIFICATION_DATETIME != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json.LAST_CUSTOMIZATION.DATETIME + tag: date_LAST_CUSTOMIZATION_DATETIME + target_field: qualys_vmdr.knowledge_base.last.customization.datetime + formats: + - ISO8601 + if: ctx.json?.LAST_CUSTOMIZATION?.DATETIME != null && ctx.json.LAST_CUSTOMIZATION.DATETIME != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.LAST_CUSTOMIZATION.USER_LOGIN + tag: rename_LAST_CUSTOMIZATION_USER_LOGIN + target_field: qualys_vmdr.knowledge_base.last.customization.user_login + ignore_missing: true + - date: + field: json.PUBLISHED_DATETIME + tag: date_PUBLISHED_DATETIME + target_field: qualys_vmdr.knowledge_base.published_datetime + formats: + - ISO8601 + if: ctx.json?.PUBLISHED_DATETIME != null && ctx.json.PUBLISHED_DATETIME != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.CHANGE_LOG_LIST.CHANGE_LOG_INFO + tag: rename_CHANGE_LOG_LIST_CHANGE_LOG_INFO + target_field: qualys_vmdr.knowledge_base.changelog_list.info + ignore_missing: true + - rename: + field: qualys_vmdr.knowledge_base.changelog_list.info.COMMENTS + tag: rename_qualys_vmdr_knowledge_base_changelog_list_info_COMMENTS_1 + target_field: qualys_vmdr.knowledge_base.changelog_list.info.comments + ignore_missing: true + - date: + field: qualys_vmdr.knowledge_base.changelog_list.info.CHANGE_DATE + tag: date_qualys_vmdr_knowledge_base_changelog_list_info_CHANGE_DATE_1 + if: (!(ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info instanceof List)) && ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info?.CHANGE_DATE != null && ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info?.CHANGE_DATE != '' + target_field: qualys_vmdr.knowledge_base.changelog_list.info.change_date + formats: + - ISO8601 + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - foreach: + field: qualys_vmdr.knowledge_base.changelog_list.info + if: ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info instanceof List + tag: foreach_rename_COMMENTS + processor: + rename: + field: _ingest._value.COMMENTS + tag: rename_qualys_vmdr_knowledge_base_changelog_list_info_COMMENTS_2 + target_field: _ingest._value.comments + ignore_missing: true + - foreach: + field: qualys_vmdr.knowledge_base.changelog_list.info + if: ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info instanceof List + tag: foreach_date_CHANGE_DATE + processor: + date: + field: _ingest._value.CHANGE_DATE + tag: date_qualys_vmdr_knowledge_base_changelog_list_info_CHANGE_DATE_2 + target_field: _ingest._value.change_date + formats: + - ISO8601 + ignore_failure: true + - rename: + field: json.THREAT_INTELLIGENCE.THREAT_INTEL + tag: rename_THREAT_INTELLIGENCE_THREAT_INTEL + target_field: qualys_vmdr.knowledge_base.threat_intelligence.intel + ignore_missing: true + - foreach: + field: qualys_vmdr.knowledge_base.threat_intelligence.intel + if: ctx.qualys_vmdr?.knowledge_base?.threat_intelligence?.intel instanceof List + tag: foreach_rename_#text + processor: + rename: + field: _ingest._value.#text + tag: rename_qualys_vmdr_knowledge_base_threat_intelligence_intel_#text_1 + target_field: _ingest._value.text + ignore_missing: true + - rename: + field: qualys_vmdr.knowledge_base.threat_intelligence.intel.#text + tag: rename_qualys_vmdr_knowledge_base_threat_intelligence_intel_#text_2 + target_field: qualys_vmdr.knowledge_base.threat_intelligence.intel.text + ignore_missing: true + - foreach: + field: qualys_vmdr.knowledge_base.changelog_list.info + if: ctx.qualys_vmdr?.knowledge_base?.changelog_list?.info instanceof List + tag: foreach_remove_CHANGE_DATE + processor: + remove: + field: _ingest._value.CHANGE_DATE + tag: remove_qualys_vmdr_knowledge_base_changelog_list_info_CHANGE_DATE + ignore_missing: true + - set: + field: json.IS_DISABLED + tag: set_IS_DISABLED_true + value: true + if: ctx.json?.IS_DISABLED == '1' + - set: + field: json.IS_DISABLED + tag: set_IS_DISABLED_false + value: false + if: ctx.json?.IS_DISABLED == '0' + - convert: + field: json.IS_DISABLED + tag: convert_IS_DISABLED_to_boolean + target_field: qualys_vmdr.knowledge_base.is_disabled + type: boolean + ignore_missing: true + if: ctx.json?.IS_DISABLED != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: json.PATCHABLE + tag: set_PATCHABLE_true + value: true + if: ctx.json?.PATCHABLE == '1' + - set: + field: json.PATCHABLE + tag: set_PATCHABLE_false + value: false + if: ctx.json?.PATCHABLE == '0' + - convert: + field: json.PATCHABLE + tag: convert_PATCHABLE_to_boolean + target_field: qualys_vmdr.knowledge_base.patchable + type: boolean + ignore_missing: true + if: ctx.json?.PATCHABLE != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: json.PCI_FLAG + tag: set_PCI_FLAG_true + value: true + if: ctx.json?.PCI_FLAG == '1' + - set: + field: json.PCI_FLAG + tag: set_PCI_FLAG_false + value: false + if: ctx.json?.PCI_FLAG == '0' + - convert: + field: json.PCI_FLAG + tag: convert_PCI_FLAG_to_boolean + target_field: qualys_vmdr.knowledge_base.pci_flag + type: boolean + ignore_missing: true + if: ctx.json?.PCI_FLAG != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: qualys_vmdr.knowledge_base.severity_level + tag: set_qualys_vmdr_knowledge_base_severity_level + copy_from: json.SEVERITY_LEVEL + ignore_empty_value: true + - script: + lang: painless + tag: script_to_set_SEVERITY_LEVEL + description: Script to set SEVERITY_LEVEL for different ranges. + if: ctx.json?.SEVERITY_LEVEL != null + source: >- + def floatVal = Float.parseFloat(ctx.json.SEVERITY_LEVEL); + if (floatVal == 0.0){ + ctx.json.SEVERITY_LEVEL = "None"; + } else if (floatVal > 0.0 && floatVal <=3.9){ + ctx.json.SEVERITY_LEVEL = "Low"; + } else if (floatVal > 3.9 && floatVal <=6.9){ + ctx.json.SEVERITY_LEVEL = "Medium"; + } else if (floatVal > 6.9 && floatVal <=8.9){ + ctx.json.SEVERITY_LEVEL = "High"; + } else if (floatVal > 8.9 && floatVal <=10.0){ + ctx.json.SEVERITY_LEVEL = "Critical"; + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: vulnerability.severity + tag: set_vulnerability_severity + copy_from: json.SEVERITY_LEVEL + ignore_empty_value: true + - remove: + tag: remove_json + field: + - json + - message + - qualys_vmdr.knowledge_base.changelog_list.info.CHANGE_DATE + - ID_RANGE + - ID + ignore_missing: true + - remove: + field: + - qualys_vmdr.knowledge_base.last.service_modification_datetime + - qualys_vmdr.knowledge_base.qid + - qualys_vmdr.knowledge_base.category + - qualys_vmdr.knowledge_base.cve_list.id + - qualys_vmdr.knowledge_base.cve_list.url + - qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.desc + - qualys_vmdr.knowledge_base.severity_level + tag: remove_preserve_duplicate_custom_fields + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + ignore_missing: true + - script: + lang: painless + tag: script_to_remove_null_values + description: Drops null/empty values recursively. + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_event_kind_2 + value: pipeline_error + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/fields/base-fields.yml b/packages/qualys_vmdr/data_stream/knowledge_base/fields/base-fields.yml new file mode 100644 index 00000000000..ff69293c2c2 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: qualys_vmdr +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: qualys_vmdr.knowledge_base +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/fields/beats.yml b/packages/qualys_vmdr/data_stream/knowledge_base/fields/beats.yml new file mode 100644 index 00000000000..b3701b581cf --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/fields/fields.yml b/packages/qualys_vmdr/data_stream/knowledge_base/fields/fields.yml new file mode 100644 index 00000000000..9a2b641b4c5 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/fields/fields.yml @@ -0,0 +1,259 @@ +- name: qualys_vmdr.knowledge_base + type: group + fields: + - name: automatic_pci_fail + type: keyword + - name: bugtraq_list + type: group + fields: + - name: id + type: keyword + - name: url + type: keyword + - name: category + type: keyword + - name: changelog_list + type: group + fields: + - name: info + type: group + fields: + - name: change_date + type: date + - name: comments + type: keyword + - name: compliance_list + type: group + fields: + - name: description + type: keyword + - name: section + type: keyword + - name: type + type: keyword + - name: consequence + type: group + fields: + - name: comment + type: keyword + - name: value + type: keyword + - name: correlation + type: group + fields: + - name: exploits + type: group + fields: + - name: explt_src + type: group + fields: + - name: list + type: group + fields: + - name: explt + type: group + fields: + - name: desc + type: keyword + - name: link + type: keyword + - name: ref + type: keyword + - name: name + type: keyword + - name: malware + type: group + fields: + - name: src + type: group + fields: + - name: list + type: group + fields: + - name: info + type: group + fields: + - name: alias + type: keyword + - name: id + type: keyword + - name: link + type: keyword + - name: platform + type: keyword + - name: rating + type: keyword + - name: type + type: keyword + - name: name + type: keyword + - name: cve_list + type: group + fields: + - name: id + type: keyword + - name: url + type: keyword + - name: cvss + type: group + fields: + - name: access + type: group + fields: + - name: complexity + type: keyword + - name: vector + type: keyword + - name: authentication + type: keyword + - name: base + type: keyword + - name: exploitability + type: keyword + - name: impact + type: group + fields: + - name: availability + type: keyword + - name: confidentiality + type: keyword + - name: integrity + type: keyword + - name: remediation_level + type: keyword + - name: report_confidence + type: keyword + - name: temporal + type: keyword + - name: vector_string + type: keyword + - name: cvss_v3 + type: group + fields: + - name: attack + type: group + fields: + - name: complexity + type: keyword + - name: vector + type: keyword + - name: base + type: keyword + - name: exploit_code_maturity + type: keyword + - name: impact + type: group + fields: + - name: availability + type: keyword + - name: confidentiality + type: keyword + - name: integrity + type: keyword + - name: privileges_required + type: keyword + - name: remediation_level + type: keyword + - name: report_confidence + type: keyword + - name: scope + type: keyword + - name: temporal + type: keyword + - name: user_interaction + type: keyword + - name: vector_string + type: keyword + - name: version + type: keyword + - name: detection_info + type: keyword + - name: diagnosis + type: group + fields: + - name: comment + type: keyword + - name: value + type: keyword + - name: discovery + type: group + fields: + - name: auth_type_list + type: group + fields: + - name: value + type: keyword + - name: additional_info + type: keyword + - name: remote + type: long + - name: ids + type: keyword + - name: id_range + type: keyword + - name: is_disabled + type: boolean + - name: last + type: group + fields: + - name: customization + type: group + fields: + - name: datetime + type: date + - name: user_login + type: keyword + - name: service_modification_datetime + type: date + - name: patchable + type: boolean + - name: pci_flag + type: boolean + - name: pci_reasons + type: group + fields: + - name: value + type: keyword + - name: published_datetime + type: date + - name: qid + type: keyword + - name: severity_level + type: keyword + - name: software_list + type: group + fields: + - name: product + type: keyword + - name: vendor + type: keyword + - name: vendor_reference_list + type: group + fields: + - name: id + type: keyword + - name: url + type: keyword + - name: solution + type: group + fields: + - name: comment + type: keyword + - name: value + type: keyword + - name: supported_modules + type: keyword + - name: threat_intelligence + type: group + fields: + - name: intel + type: group + fields: + - name: id + type: keyword + - name: text + type: keyword + - name: title + type: keyword + - name: vuln_type + type: keyword diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/manifest.yml b/packages/qualys_vmdr/data_stream/knowledge_base/manifest.yml new file mode 100644 index 00000000000..fc69b10bad0 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/manifest.yml @@ -0,0 +1,71 @@ +title: Collect Knowledge Base data from Qualys VMDR platform. +type: logs +streams: + - input: cel + title: Knowledge Base data + description: Collect Knowledge Base data from Qualys VMDR platform. + template_path: input.yml.hbs + vars: + - name: url + type: text + title: URL + description: Base URL of the Qualys Server API. + required: true + show_user: true + - name: initial_interval + type: text + title: Initial Interval + description: "How far back to pull the Knowledge Base data from Qualys VMDR. Supported units for this parameter are s, m, h." + multi: false + required: true + show_user: true + default: 120h + - name: interval + type: text + title: Interval + description: "Interval between two REST API calls. User can choose interval as per their plan mentioned in [Qualys API Limits](https://www.qualys.com/docs/qualys-api-limits.pdf). Supported units for this parameter are h/m/s." + default: 6h + multi: false + required: true + show_user: true + - name: http_client_timeout + type: text + title: HTTP Client Timeout + description: "Duration before declaring that the HTTP client connection has timed out. Give a timeout of more than 1 minute when retrieving data which is more than 15 days old. Supported time units are ns, us, ms, s, m, h." + multi: false + required: true + show_user: false + default: 3m + - name: input_parameters + type: text + title: Input Parameters + description: "Input Parameters for the URL. param1=value¶m2=value¶m3=....*" + multi: false + required: false + show_user: true + default: "" + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - qualys_vmdr-knowledge_base + - name: preserve_duplicate_custom_fields + required: true + show_user: false + title: Preserve duplicate custom fields + description: Preserve qualys_vmdr.knowledge_base fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/qualys_vmdr/data_stream/knowledge_base/sample_event.json b/packages/qualys_vmdr/data_stream/knowledge_base/sample_event.json new file mode 100644 index 00000000000..272bd16b006 --- /dev/null +++ b/packages/qualys_vmdr/data_stream/knowledge_base/sample_event.json @@ -0,0 +1,74 @@ +{ + "@timestamp": "2023-06-29T12:20:46.000Z", + "agent": { + "ephemeral_id": "24c009cf-e26d-4f8a-b66f-7412425ed0fe", + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "qualys_vmdr.knowledge_base", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "qualys_vmdr.knowledge_base", + "id": "11830", + "ingested": "2023-08-28T09:54:51Z", + "kind": "alert", + "type": [ + "info" + ] + }, + "input": { + "type": "cel" + }, + "qualys_vmdr": { + "knowledge_base": { + "category": "CGI", + "discovery": { + "remote": 1 + }, + "last": { + "service_modification_datetime": "2023-06-29T12:20:46.000Z" + }, + "patchable": false, + "pci_flag": true, + "published_datetime": "2017-06-05T21:34:49.000Z", + "qid": "11830", + "severity_level": "2", + "threat_intelligence": { + "intel": [ + { + "id": "8" + } + ] + }, + "vuln_type": "Vulnerability" + } + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "qualys_vmdr-knowledge_base" + ], + "vulnerability": { + "category": [ + "CGI" + ], + "severity": "Low" + } +} \ No newline at end of file diff --git a/packages/qualys_vmdr/docs/README.md b/packages/qualys_vmdr/docs/README.md new file mode 100644 index 00000000000..42b527b4c3e --- /dev/null +++ b/packages/qualys_vmdr/docs/README.md @@ -0,0 +1,459 @@ +# Qualys Vulnerability Management, Detection and Response (VMDR) + +This [Qualys VMDR](https://www.qualys.com/apps/vulnerability-management-detection-response/) integration is a cloud-based service that gives you immediate, global visibility into where your IT systems might be vulnerable to the latest Internet threats and how to protect them. It helps you to continuously identify threats and monitor unexpected changes in your network before they turn into breaches. + +The Qualys VMDR integration uses REST API mode to collect data. Elastic Agent fetches data via API endpoints. + +## Compatibility + +This module has been tested against the latest Qualys VMDR version **v2**. + +## Data streams + +The Qualys VMDR integration collects data for the following two events: + +| Event Type | +|-------------------------------| +| Asset Host Detection | +| Knowledge Base | + +Reference for [Rest APIs](https://qualysguard.qg2.apps.qualys.com/qwebhelp/fo_portal/api_doc/index.htm) of Qualys VMDR. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data through the REST API and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data through REST API, follow the below steps: + +- Considering you already have a Qualys user account, to identify your Qualys platform and get the API URL, refer this [link](https://www.qualys.com/platform-identification/). +- Alternative way to get the API URL is to log in to your Qualys account and go to Help > About. You’ll find your URL under Security Operations Center (SOC). + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations +2. In "Search for integrations" search bar, type Qualys VMDR +3. Click on the "Qualys VMDR" integration from the search results. +4. Click on the Add Qualys VMDR Integration button to add the integration. +5. While adding the integration, if you want to collect Asset Host Detection data via REST API, then you have to put the following details: + - username + - password + - url + - interval + - input parameters + - batch size + + or if you want to collect Knowledge Base data via REST API, then you have to put the following details: + - username + - password + - url + - initial interval + - interval + - input parameters + +**NOTE**: By default, the input parameter is set to "action=list". + +## Data reference + +### Asset Host Detection + +This is the `Asset Host Detection` dataset. + +#### Example + +An example event for `asset_host_detection` looks as following: + +```json +{ + "@timestamp": "2023-08-28T09:53:52.909Z", + "agent": { + "ephemeral_id": "24c009cf-e26d-4f8a-b66f-7412425ed0fe", + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "qualys_vmdr.asset_host_detection", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "qualys_vmdr.asset_host_detection", + "ingested": "2023-08-28T09:53:53Z", + "kind": "alert", + "type": [ + "info" + ] + }, + "host": { + "id": "12048633", + "ip": [ + "10.50.2.111" + ] + }, + "input": { + "type": "cel" + }, + "qualys_vmdr": { + "asset_host_detection": { + "id": "12048633", + "ip": "10.50.2.111", + "last": { + "pc_scanned_date": "2023-06-28T09:58:12.000Z", + "scan_datetime": "2023-07-03T06:25:17.000Z", + "vm": { + "scanned_date": "2023-07-03T06:23:47.000Z", + "scanned_duration": 1113 + } + }, + "list": [ + { + "first": { + "found_datetime": "2023-06-28T06:04:26.000Z" + }, + "is_disabled": false, + "is_ignored": false, + "last": { + "found_datetime": "2023-07-03T06:23:47.000Z", + "processed_datetime": "2023-07-03T06:25:17.000Z", + "test_datetime": "2023-07-03T06:23:47.000Z", + "update_datetime": "2023-07-03T06:25:17.000Z" + }, + "qid": "91681", + "severity": 5, + "ssl": "0", + "status": "Active", + "times": { + "found": 11 + }, + "type": "Confirmed" + } + ], + "tracking_method": "IP" + } + }, + "related": { + "hosts": [ + "12048633" + ], + "ip": [ + "10.50.2.111" + ] + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "qualys_vmdr-asset_host_detection" + ] +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| qualys_vmdr.asset_host_detection.asset_id | | keyword | +| qualys_vmdr.asset_host_detection.cloud.provider.name | | keyword | +| qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.last_success_date | | date | +| qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.name | | keyword | +| qualys_vmdr.asset_host_detection.cloud.provider.tags.cloud_tag.value | | keyword | +| qualys_vmdr.asset_host_detection.cloud.resource_id | | keyword | +| qualys_vmdr.asset_host_detection.cloud.service | | keyword | +| qualys_vmdr.asset_host_detection.dns.value | | keyword | +| qualys_vmdr.asset_host_detection.dns_data.domain | | keyword | +| qualys_vmdr.asset_host_detection.dns_data.fqdn | | keyword | +| qualys_vmdr.asset_host_detection.dns_data.hostname | | keyword | +| qualys_vmdr.asset_host_detection.ec2_instance_id | | keyword | +| qualys_vmdr.asset_host_detection.id | | keyword | +| qualys_vmdr.asset_host_detection.ip | | ip | +| qualys_vmdr.asset_host_detection.ipv6 | | ip | +| qualys_vmdr.asset_host_detection.last.pc_scanned_date | | date | +| qualys_vmdr.asset_host_detection.last.scan_datetime | | date | +| qualys_vmdr.asset_host_detection.last.vm.auth.scanned_date | | date | +| qualys_vmdr.asset_host_detection.last.vm.auth.scanned_duration | | long | +| qualys_vmdr.asset_host_detection.last.vm.scanned_date | | date | +| qualys_vmdr.asset_host_detection.last.vm.scanned_duration | | long | +| qualys_vmdr.asset_host_detection.list.affect.exploitable_config | | keyword | +| qualys_vmdr.asset_host_detection.list.affect.running.kernel | | keyword | +| qualys_vmdr.asset_host_detection.list.affect.running.service | | keyword | +| qualys_vmdr.asset_host_detection.list.asset_cve | | keyword | +| qualys_vmdr.asset_host_detection.list.first.found_datetime | | date | +| qualys_vmdr.asset_host_detection.list.first.reopened_datetime | | date | +| qualys_vmdr.asset_host_detection.list.fqdn | | keyword | +| qualys_vmdr.asset_host_detection.list.instance | | keyword | +| qualys_vmdr.asset_host_detection.list.is_disabled | | boolean | +| qualys_vmdr.asset_host_detection.list.is_ignored | | boolean | +| qualys_vmdr.asset_host_detection.list.last.fixed_datetime | | date | +| qualys_vmdr.asset_host_detection.list.last.found_datetime | | date | +| qualys_vmdr.asset_host_detection.list.last.processed_datetime | | date | +| qualys_vmdr.asset_host_detection.list.last.reopened_datetime | | date | +| qualys_vmdr.asset_host_detection.list.last.test_datetime | | date | +| qualys_vmdr.asset_host_detection.list.last.update_datetime | | date | +| qualys_vmdr.asset_host_detection.list.port | | long | +| qualys_vmdr.asset_host_detection.list.protocol | | keyword | +| qualys_vmdr.asset_host_detection.list.qds.severity | | keyword | +| qualys_vmdr.asset_host_detection.list.qds.text | | keyword | +| qualys_vmdr.asset_host_detection.list.qds_factors.name | | keyword | +| qualys_vmdr.asset_host_detection.list.qds_factors.text | | keyword | +| qualys_vmdr.asset_host_detection.list.qid | | keyword | +| qualys_vmdr.asset_host_detection.list.results | | keyword | +| qualys_vmdr.asset_host_detection.list.service | | keyword | +| qualys_vmdr.asset_host_detection.list.severity | | long | +| qualys_vmdr.asset_host_detection.list.ssl | | keyword | +| qualys_vmdr.asset_host_detection.list.status | | keyword | +| qualys_vmdr.asset_host_detection.list.times.found | | long | +| qualys_vmdr.asset_host_detection.list.times.reopened | | long | +| qualys_vmdr.asset_host_detection.list.type | | keyword | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.error.date | | date | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.error.value | | keyword | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.status | | keyword | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.last.success_date | | date | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.name | | keyword | +| qualys_vmdr.asset_host_detection.metadata.azure.attribute.value | | keyword | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.error.date | | date | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.error.value | | keyword | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.status | | keyword | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.success_date | | date | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.name | | keyword | +| qualys_vmdr.asset_host_detection.metadata.ec2.attribute.value | | keyword | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.last.error.date | | date | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.last.error.value | | keyword | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.last.status | | keyword | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.last.success_date | | date | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.name | | keyword | +| qualys_vmdr.asset_host_detection.metadata.google.attribute.value | | keyword | +| qualys_vmdr.asset_host_detection.netbios | | keyword | +| qualys_vmdr.asset_host_detection.network_id | | keyword | +| qualys_vmdr.asset_host_detection.os.cpe | | keyword | +| qualys_vmdr.asset_host_detection.os.value | | keyword | +| qualys_vmdr.asset_host_detection.qg_host_id | | keyword | +| qualys_vmdr.asset_host_detection.tags.background_color | | keyword | +| qualys_vmdr.asset_host_detection.tags.color | | keyword | +| qualys_vmdr.asset_host_detection.tags.id | | keyword | +| qualys_vmdr.asset_host_detection.tags.name | | keyword | +| qualys_vmdr.asset_host_detection.tracking_method | | keyword | +| tags | User defined tags. | keyword | + + +### Knowledge Base + +This is the `Knowledge Base` dataset. + +#### Example + +An example event for `knowledge_base` looks as following: + +```json +{ + "@timestamp": "2023-06-29T12:20:46.000Z", + "agent": { + "ephemeral_id": "24c009cf-e26d-4f8a-b66f-7412425ed0fe", + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.9.0" + }, + "data_stream": { + "dataset": "qualys_vmdr.knowledge_base", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "6b293533-5b3c-4cb2-a00c-b2b25ba9edec", + "snapshot": false, + "version": "8.9.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "host" + ], + "dataset": "qualys_vmdr.knowledge_base", + "id": "11830", + "ingested": "2023-08-28T09:54:51Z", + "kind": "alert", + "type": [ + "info" + ] + }, + "input": { + "type": "cel" + }, + "qualys_vmdr": { + "knowledge_base": { + "category": "CGI", + "discovery": { + "remote": 1 + }, + "last": { + "service_modification_datetime": "2023-06-29T12:20:46.000Z" + }, + "patchable": false, + "pci_flag": true, + "published_datetime": "2017-06-05T21:34:49.000Z", + "qid": "11830", + "severity_level": "2", + "threat_intelligence": { + "intel": [ + { + "id": "8" + } + ] + }, + "vuln_type": "Vulnerability" + } + }, + "tags": [ + "preserve_duplicate_custom_fields", + "forwarded", + "qualys_vmdr-knowledge_base" + ], + "vulnerability": { + "category": [ + "CGI" + ], + "severity": "Low" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| qualys_vmdr.knowledge_base.automatic_pci_fail | | keyword | +| qualys_vmdr.knowledge_base.bugtraq_list.id | | keyword | +| qualys_vmdr.knowledge_base.bugtraq_list.url | | keyword | +| qualys_vmdr.knowledge_base.category | | keyword | +| qualys_vmdr.knowledge_base.changelog_list.info.change_date | | date | +| qualys_vmdr.knowledge_base.changelog_list.info.comments | | keyword | +| qualys_vmdr.knowledge_base.compliance_list.description | | keyword | +| qualys_vmdr.knowledge_base.compliance_list.section | | keyword | +| qualys_vmdr.knowledge_base.compliance_list.type | | keyword | +| qualys_vmdr.knowledge_base.consequence.comment | | keyword | +| qualys_vmdr.knowledge_base.consequence.value | | keyword | +| qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.desc | | keyword | +| qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.link | | keyword | +| qualys_vmdr.knowledge_base.correlation.exploits.explt_src.list.explt.ref | | keyword | +| qualys_vmdr.knowledge_base.correlation.exploits.explt_src.name | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.alias | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.id | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.link | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.platform | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.rating | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.list.info.type | | keyword | +| qualys_vmdr.knowledge_base.correlation.malware.src.name | | keyword | +| qualys_vmdr.knowledge_base.cve_list.id | | keyword | +| qualys_vmdr.knowledge_base.cve_list.url | | keyword | +| qualys_vmdr.knowledge_base.cvss.access.complexity | | keyword | +| qualys_vmdr.knowledge_base.cvss.access.vector | | keyword | +| qualys_vmdr.knowledge_base.cvss.authentication | | keyword | +| qualys_vmdr.knowledge_base.cvss.base | | keyword | +| qualys_vmdr.knowledge_base.cvss.exploitability | | keyword | +| qualys_vmdr.knowledge_base.cvss.impact.availability | | keyword | +| qualys_vmdr.knowledge_base.cvss.impact.confidentiality | | keyword | +| qualys_vmdr.knowledge_base.cvss.impact.integrity | | keyword | +| qualys_vmdr.knowledge_base.cvss.remediation_level | | keyword | +| qualys_vmdr.knowledge_base.cvss.report_confidence | | keyword | +| qualys_vmdr.knowledge_base.cvss.temporal | | keyword | +| qualys_vmdr.knowledge_base.cvss.vector_string | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.attack.complexity | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.attack.vector | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.base | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.exploit_code_maturity | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.impact.availability | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.impact.confidentiality | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.impact.integrity | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.privileges_required | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.remediation_level | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.report_confidence | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.scope | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.temporal | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.user_interaction | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.vector_string | | keyword | +| qualys_vmdr.knowledge_base.cvss_v3.version | | keyword | +| qualys_vmdr.knowledge_base.detection_info | | keyword | +| qualys_vmdr.knowledge_base.diagnosis.comment | | keyword | +| qualys_vmdr.knowledge_base.diagnosis.value | | keyword | +| qualys_vmdr.knowledge_base.discovery.additional_info | | keyword | +| qualys_vmdr.knowledge_base.discovery.auth_type_list.value | | keyword | +| qualys_vmdr.knowledge_base.discovery.remote | | long | +| qualys_vmdr.knowledge_base.id_range | | keyword | +| qualys_vmdr.knowledge_base.ids | | keyword | +| qualys_vmdr.knowledge_base.is_disabled | | boolean | +| qualys_vmdr.knowledge_base.last.customization.datetime | | date | +| qualys_vmdr.knowledge_base.last.customization.user_login | | keyword | +| qualys_vmdr.knowledge_base.last.service_modification_datetime | | date | +| qualys_vmdr.knowledge_base.patchable | | boolean | +| qualys_vmdr.knowledge_base.pci_flag | | boolean | +| qualys_vmdr.knowledge_base.pci_reasons.value | | keyword | +| qualys_vmdr.knowledge_base.published_datetime | | date | +| qualys_vmdr.knowledge_base.qid | | keyword | +| qualys_vmdr.knowledge_base.severity_level | | keyword | +| qualys_vmdr.knowledge_base.software_list.product | | keyword | +| qualys_vmdr.knowledge_base.software_list.vendor | | keyword | +| qualys_vmdr.knowledge_base.solution.comment | | keyword | +| qualys_vmdr.knowledge_base.solution.value | | keyword | +| qualys_vmdr.knowledge_base.supported_modules | | keyword | +| qualys_vmdr.knowledge_base.threat_intelligence.intel.id | | keyword | +| qualys_vmdr.knowledge_base.threat_intelligence.intel.text | | keyword | +| qualys_vmdr.knowledge_base.title | | keyword | +| qualys_vmdr.knowledge_base.vendor_reference_list.id | | keyword | +| qualys_vmdr.knowledge_base.vendor_reference_list.url | | keyword | +| qualys_vmdr.knowledge_base.vuln_type | | keyword | +| tags | User defined tags. | keyword | diff --git a/packages/qualys_vmdr/img/qualys-vmdr-asset-host-detection-dashboard.png b/packages/qualys_vmdr/img/qualys-vmdr-asset-host-detection-dashboard.png new file mode 100644 index 00000000000..0388af8457b Binary files /dev/null and b/packages/qualys_vmdr/img/qualys-vmdr-asset-host-detection-dashboard.png differ diff --git a/packages/qualys_vmdr/img/qualys-vmdr-knowledge-base-dashboard.png b/packages/qualys_vmdr/img/qualys-vmdr-knowledge-base-dashboard.png new file mode 100644 index 00000000000..7533a4fc061 Binary files /dev/null and b/packages/qualys_vmdr/img/qualys-vmdr-knowledge-base-dashboard.png differ diff --git a/packages/qualys_vmdr/img/qualys-vmdr-logo.svg b/packages/qualys_vmdr/img/qualys-vmdr-logo.svg new file mode 100644 index 00000000000..d0c6bbb7103 --- /dev/null +++ b/packages/qualys_vmdr/img/qualys-vmdr-logo.svg @@ -0,0 +1,37 @@ + +Created with Fabric.js 3.5.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd.json b/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd.json new file mode 100644 index 00000000000..886da0fce2d --- /dev/null +++ b/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd.json @@ -0,0 +1,2035 @@ +{ + "attributes": { + "description": "This dashboard shows Asset Host Detection data collected by the Qualys VMDR integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "Navigation\n\n[Qualys VMDR Asset Host Detection (This Page)](#/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd)\n\n[Qualys VMDR Knowledge Base](#/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892)\n\n[Integrations Page](/app/integrations/browse?q=qualys)\n\nOverview\n\nThis dashboard shows Asset Host Detection overview related to the Qualys VMDR Integration.\n\nThe dashboard is made to provide general statistics and show the detection of the ingested asset hosts from Qualys.\n\nIt provides information about how many hosts are active or disabled. It also displays the distribution of asset hosts according to type, severity, and status. Details regarding cloud provider, cloud service and metadata EC2 attributes are also shown.\nIt fetches new updates every four hours by default.\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "5276e363-c3e0-45dc-a02c-7bb2deab4c5c", + "w": 11, + "x": 0, + "y": 0 + }, + "panelIndex": "5276e363-c3e0-45dc-a02c-7bb2deab4c5c", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-736aade9-3fe7-4898-8b17-393b1883f0e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "126ba167-10db-4d56-b62d-86c9346af8d1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "736aade9-3fe7-4898-8b17-393b1883f0e7": { + "columnOrder": [ + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8fa", + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX0", + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX1" + ], + "columns": { + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Hosts", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(host.id), 0)", + "isFormulaBroken": false + }, + "references": [ + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX1" + ], + "scale": "ratio" + }, + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.id" + }, + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Hosts", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX0", + 0 + ], + "location": { + "max": 34, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(host.id), 0)", + "type": "function" + } + }, + "references": [ + "eacffb21-2e61-4158-a8d7-ffb0ed9ec8faX0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "126ba167-10db-4d56-b62d-86c9346af8d1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "736aade9-3fe7-4898-8b17-393b1883f0e7", + "layerType": "data", + "metricAccessor": "eacffb21-2e61-4158-a8d7-ffb0ed9ec8fa" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "deea88fb-bb05-4925-9fc2-6244ad262293", + "w": 12, + "x": 11, + "y": 0 + }, + "panelIndex": "deea88fb-bb05-4925-9fc2-6244ad262293", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-defc22a5-4f13-49ff-9c84-4db57102abac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c4f8790b-88d0-45bb-ad36-6f3e38f82474", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "defc22a5-4f13-49ff-9c84-4db57102abac": { + "columnOrder": [ + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5", + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X0", + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X1" + ], + "columns": { + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Hosts", + "operationType": "formula", + "params": { + "formula": "defaults(count(qualys_vmdr.asset_host_detection.list.is_disabled, kql='qualys_vmdr.asset_host_detection.list.is_disabled : false '), 0)", + "isFormulaBroken": false + }, + "references": [ + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X1" + ], + "scale": "ratio" + }, + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "qualys_vmdr.asset_host_detection.list.is_disabled : false " + }, + "isBucketed": false, + "label": "Active Hosts", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "qualys_vmdr.asset_host_detection.list.is_disabled" + }, + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Hosts", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X0", + 0 + ], + "location": { + "max": 135, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(qualys_vmdr.asset_host_detection.list.is_disabled, kql='qualys_vmdr.asset_host_detection.list.is_disabled : false '), 0)", + "type": "function" + } + }, + "references": [ + "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5X0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "c4f8790b-88d0-45bb-ad36-6f3e38f82474", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#54B399", + "layerId": "defc22a5-4f13-49ff-9c84-4db57102abac", + "layerType": "data", + "metricAccessor": "3768e0a9-5a3d-4c8a-8f1b-9e43e28db6f5" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "303a63da-f031-49c7-b120-7fa51b79b52f", + "w": 12, + "x": 23, + "y": 0 + }, + "panelIndex": "303a63da-f031-49c7-b120-7fa51b79b52f", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0e7009cd-e316-4bbe-8c45-6690620cdffd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aebaed35-bd71-41b2-a1c6-63356ccf6934", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0e7009cd-e316-4bbe-8c45-6690620cdffd": { + "columnOrder": [ + "6a8a89aa-4ac3-4bc9-a119-20c02202c532", + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X0", + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X1" + ], + "columns": { + "6a8a89aa-4ac3-4bc9-a119-20c02202c532": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Disabled Hosts", + "operationType": "formula", + "params": { + "formula": "defaults(count(qualys_vmdr.asset_host_detection.list.is_disabled, kql='qualys_vmdr.asset_host_detection.list.is_disabled : true '), 0)", + "isFormulaBroken": false + }, + "references": [ + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X1" + ], + "scale": "ratio" + }, + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "qualys_vmdr.asset_host_detection.list.is_disabled : true " + }, + "isBucketed": false, + "label": "Disabled Hosts", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "qualys_vmdr.asset_host_detection.list.is_disabled" + }, + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Disabled Hosts", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X0", + 0 + ], + "location": { + "max": 134, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(qualys_vmdr.asset_host_detection.list.is_disabled, kql='qualys_vmdr.asset_host_detection.list.is_disabled : true '), 0)", + "type": "function" + } + }, + "references": [ + "6a8a89aa-4ac3-4bc9-a119-20c02202c532X0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "aebaed35-bd71-41b2-a1c6-63356ccf6934", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#CC5642", + "layerId": "0e7009cd-e316-4bbe-8c45-6690620cdffd", + "layerType": "data", + "metricAccessor": "6a8a89aa-4ac3-4bc9-a119-20c02202c532" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "a46a2866-1969-4433-9fc1-1a387c1f463a", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "a46a2866-1969-4433-9fc1-1a387c1f463a", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e31c084b-0cac-4a93-bd9c-944cd4eb8064", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dcb2ccb1-6d24-41ca-927d-64582cd6fda0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e31c084b-0cac-4a93-bd9c-944cd4eb8064": { + "columnOrder": [ + "9d3e3e97-538d-4528-8bf9-bf91f4fcc2ac", + "6202905a-79e3-4b09-ade7-8297bae9c32f", + "c12a06da-e876-41a2-b2e6-c6867667ae18", + "9627e6f8-336b-43b1-bbb5-806713187296" + ], + "columns": { + "6202905a-79e3-4b09-ade7-8297bae9c32f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Tag ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9627e6f8-336b-43b1-bbb5-806713187296", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.tags.id" + }, + "9627e6f8-336b-43b1-bbb5-806713187296": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "9d3e3e97-538d-4528-8bf9-bf91f4fcc2ac": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Host ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9627e6f8-336b-43b1-bbb5-806713187296", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.id" + }, + "c12a06da-e876-41a2-b2e6-c6867667ae18": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Tag Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9627e6f8-336b-43b1-bbb5-806713187296", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.tags.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "dcb2ccb1-6d24-41ca-927d-64582cd6fda0", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9627e6f8-336b-43b1-bbb5-806713187296", + "isTransposed": false + }, + { + "columnId": "6202905a-79e3-4b09-ade7-8297bae9c32f", + "isTransposed": false + }, + { + "columnId": "c12a06da-e876-41a2-b2e6-c6867667ae18", + "isTransposed": false + }, + { + "columnId": "9d3e3e97-538d-4528-8bf9-bf91f4fcc2ac", + "isTransposed": false + } + ], + "layerId": "e31c084b-0cac-4a93-bd9c-944cd4eb8064", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "71cc5649-1d1e-46f3-8dbf-6fcef50d3e07", + "w": 19, + "x": 11, + "y": 7 + }, + "panelIndex": "71cc5649-1d1e-46f3-8dbf-6fcef50d3e07", + "title": "Asset Host List Detection Tag Details [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-613f9aaf-80b8-4737-ace5-c7423f402da2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "47bd9f10-64f6-4721-af73-0b481e9200f6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "613f9aaf-80b8-4737-ace5-c7423f402da2": { + "columnOrder": [ + "539084f1-12bf-4d87-96ee-59cd3a80d0c8", + "39fe45ad-44eb-41fd-9328-f7e08f076d1f", + "50bc67d9-1bee-47a9-9bf0-6360a9618f18", + "d145fa84-ca40-4f37-bed6-93684d3961ce", + "efdb0d5c-6cf3-4887-a1a5-a32334d7924f" + ], + "columns": { + "39fe45ad-44eb-41fd-9328-f7e08f076d1f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Attribute Value", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "efdb0d5c-6cf3-4887-a1a5-a32334d7924f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.metadata.ec2.attribute.value" + }, + "50bc67d9-1bee-47a9-9bf0-6360a9618f18": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Attribute Last Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "efdb0d5c-6cf3-4887-a1a5-a32334d7924f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.status" + }, + "539084f1-12bf-4d87-96ee-59cd3a80d0c8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Attribute Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "efdb0d5c-6cf3-4887-a1a5-a32334d7924f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.metadata.ec2.attribute.name" + }, + "d145fa84-ca40-4f37-bed6-93684d3961ce": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Last Error Value", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "efdb0d5c-6cf3-4887-a1a5-a32334d7924f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.metadata.ec2.attribute.last.error.value" + }, + "efdb0d5c-6cf3-4887-a1a5-a32334d7924f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "47bd9f10-64f6-4721-af73-0b481e9200f6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "efdb0d5c-6cf3-4887-a1a5-a32334d7924f", + "isTransposed": false + }, + { + "columnId": "539084f1-12bf-4d87-96ee-59cd3a80d0c8", + "isTransposed": false + }, + { + "columnId": "39fe45ad-44eb-41fd-9328-f7e08f076d1f", + "isTransposed": false + }, + { + "columnId": "50bc67d9-1bee-47a9-9bf0-6360a9618f18", + "isTransposed": false + }, + { + "columnId": "d145fa84-ca40-4f37-bed6-93684d3961ce", + "isTransposed": false + } + ], + "layerId": "613f9aaf-80b8-4737-ace5-c7423f402da2", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "03a7a927-2237-486c-962e-9812a147b143", + "w": 18, + "x": 30, + "y": 7 + }, + "panelIndex": "03a7a927-2237-486c-962e-9812a147b143", + "title": "Asset Host Metadata EC2 Details [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6b175f15-ccac-4228-b6be-9799c2a22f9b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "36ce9043-dec3-482b-98a4-5e3891df90d9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6b175f15-ccac-4228-b6be-9799c2a22f9b": { + "columnOrder": [ + "81b6797f-9bfe-4a42-9f1d-b8fdba983f52", + "c522a1b3-bfbf-45a2-9ad7-a6e2bf979f0f" + ], + "columns": { + "81b6797f-9bfe-4a42-9f1d-b8fdba983f52": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Detection Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c522a1b3-bfbf-45a2-9ad7-a6e2bf979f0f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.port" + }, + "c522a1b3-bfbf-45a2-9ad7-a6e2bf979f0f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of Detection Found", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "qualys_vmdr.asset_host_detection.list.times.found" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "36ce9043-dec3-482b-98a4-5e3891df90d9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "c522a1b3-bfbf-45a2-9ad7-a6e2bf979f0f" + ], + "layerId": "6b175f15-ccac-4228-b6be-9799c2a22f9b", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "xAccessor": "81b6797f-9bfe-4a42-9f1d-b8fdba983f52", + "yConfig": [ + { + "color": "#aa6556", + "forAccessor": "c522a1b3-bfbf-45a2-9ad7-a6e2bf979f0f" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "d05d9930-81af-428a-a8de-fa350b3f82a5", + "w": 24, + "x": 0, + "y": 22 + }, + "panelIndex": "d05d9930-81af-428a-a8de-fa350b3f82a5", + "title": "Count of Detection Found on Port [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-63ee9c94-98b1-44cc-80e9-9d32618dcc7d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8d8d9ad5-92ab-4db7-bd14-b9e85a9396c7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "63ee9c94-98b1-44cc-80e9-9d32618dcc7d": { + "columnOrder": [ + "0fd0b364-1fd5-445a-bc9d-4988b27525f9", + "9875a9ae-e68e-4e67-88be-736ce295bbf7" + ], + "columns": { + "0fd0b364-1fd5-445a-bc9d-4988b27525f9": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Detection Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9875a9ae-e68e-4e67-88be-736ce295bbf7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.severity" + }, + "9875a9ae-e68e-4e67-88be-736ce295bbf7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "8d8d9ad5-92ab-4db7-bd14-b9e85a9396c7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "9875a9ae-e68e-4e67-88be-736ce295bbf7" + ], + "layerId": "63ee9c94-98b1-44cc-80e9-9d32618dcc7d", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "xAccessor": "0fd0b364-1fd5-445a-bc9d-4988b27525f9", + "yConfig": [ + { + "color": "#d36086", + "forAccessor": "9875a9ae-e68e-4e67-88be-736ce295bbf7" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4af93ada-f0eb-4c2e-be3d-cdb4b09b1d8b", + "w": 24, + "x": 24, + "y": 22 + }, + "panelIndex": "4af93ada-f0eb-4c2e-be3d-cdb4b09b1d8b", + "title": "Distribution of Asset Host by Detection Severity [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-019e5587-b3f1-40df-aa39-6cf329384222", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d1ae3668-0999-4534-bf6e-22d7574c6140", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "019e5587-b3f1-40df-aa39-6cf329384222": { + "columnOrder": [ + "51ac912a-04f9-46c8-aa1e-4d005b499ef7", + "ce145df4-ee1d-4e54-8e10-816fc964bd74" + ], + "columns": { + "51ac912a-04f9-46c8-aa1e-4d005b499ef7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "QDS Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ce145df4-ee1d-4e54-8e10-816fc964bd74", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.qds.severity" + }, + "ce145df4-ee1d-4e54-8e10-816fc964bd74": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "d1ae3668-0999-4534-bf6e-22d7574c6140", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "019e5587-b3f1-40df-aa39-6cf329384222", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "ce145df4-ee1d-4e54-8e10-816fc964bd74" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "51ac912a-04f9-46c8-aa1e-4d005b499ef7" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cd7fd2bc-45d6-41e1-bcd5-11a55041ca72", + "w": 24, + "x": 0, + "y": 37 + }, + "panelIndex": "cd7fd2bc-45d6-41e1-bcd5-11a55041ca72", + "title": "Distribution of Host ID by QDS Severity [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-caeadf09-f0a8-40d1-8add-56d5fcda88f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e6d9f901-d36e-46d2-a97b-df8d5ddb788e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "caeadf09-f0a8-40d1-8add-56d5fcda88f1": { + "columnOrder": [ + "8e14697b-7a5e-4533-ab3b-c882f9115020", + "d324dfae-5dd7-40b1-93a9-ad6e48e6c531", + "6cd97d6e-169e-4544-8d8a-adafb1d31bbf" + ], + "columns": { + "6cd97d6e-169e-4544-8d8a-adafb1d31bbf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.id" + }, + "8e14697b-7a5e-4533-ab3b-c882f9115020": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Detection Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6cd97d6e-169e-4544-8d8a-adafb1d31bbf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.status" + }, + "d324dfae-5dd7-40b1-93a9-ad6e48e6c531": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Detection Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "6cd97d6e-169e-4544-8d8a-adafb1d31bbf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e6d9f901-d36e-46d2-a97b-df8d5ddb788e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "caeadf09-f0a8-40d1-8add-56d5fcda88f1", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "6cd97d6e-169e-4544-8d8a-adafb1d31bbf" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "primaryGroups": [ + "8e14697b-7a5e-4533-ab3b-c882f9115020", + "d324dfae-5dd7-40b1-93a9-ad6e48e6c531" + ], + "truncateLegend": false + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "193da6ca-ef10-4e49-93be-53ed8e14ce47", + "w": 24, + "x": 24, + "y": 37 + }, + "panelIndex": "193da6ca-ef10-4e49-93be-53ed8e14ce47", + "title": "Distribution of Asset Host by Detection Status and Type [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9f11ec1e-50c4-4d4d-bea2-d58ce81911fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e74c7b10-7f36-4c05-a8f4-d1b3b3110aad", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9f11ec1e-50c4-4d4d-bea2-d58ce81911fa": { + "columnOrder": [ + "2dd737fe-49f2-49a0-8fd3-fdbf7ee52ccf", + "9d01ad93-f476-4a8d-9163-494dc1a1b794", + "bf9ccb64-0ddd-4439-8606-9fca770201cf" + ], + "columns": { + "2dd737fe-49f2-49a0-8fd3-fdbf7ee52ccf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cloud Provider", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf9ccb64-0ddd-4439-8606-9fca770201cf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.provider" + }, + "9d01ad93-f476-4a8d-9163-494dc1a1b794": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cloud Service", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "bf9ccb64-0ddd-4439-8606-9fca770201cf", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "cloud.service.name" + }, + "bf9ccb64-0ddd-4439-8606-9fca770201cf": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e74c7b10-7f36-4c05-a8f4-d1b3b3110aad", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9f11ec1e-50c4-4d4d-bea2-d58ce81911fa", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "bf9ccb64-0ddd-4439-8606-9fca770201cf" + ], + "nestedLegend": true, + "numberDisplay": "percent", + "primaryGroups": [ + "2dd737fe-49f2-49a0-8fd3-fdbf7ee52ccf", + "9d01ad93-f476-4a8d-9163-494dc1a1b794" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f6761f74-9237-429f-b384-2259770d99c3", + "w": 24, + "x": 0, + "y": 52 + }, + "panelIndex": "f6761f74-9237-429f-b384-2259770d99c3", + "title": "Distribution of Asset Hosts by Cloud Provider and Cloud Service [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8b4bfe41-5793-4715-b5f4-d5208c639ba8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "99e287b3-fa77-4dde-9821-2b7dc9616d47", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8b4bfe41-5793-4715-b5f4-d5208c639ba8": { + "columnOrder": [ + "5ebee54a-b888-46ad-8044-4e6df7d39135", + "9ba8c11e-82d1-4f77-88dc-100a2a3949e8" + ], + "columns": { + "5ebee54a-b888-46ad-8044-4e6df7d39135": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "QDS Factor Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9ba8c11e-82d1-4f77-88dc-100a2a3949e8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.asset_host_detection.list.qds_factors.name" + }, + "9ba8c11e-82d1-4f77-88dc-100a2a3949e8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "99e287b3-fa77-4dde-9821-2b7dc9616d47", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "8b4bfe41-5793-4715-b5f4-d5208c639ba8", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "9ba8c11e-82d1-4f77-88dc-100a2a3949e8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "5ebee54a-b888-46ad-8044-4e6df7d39135" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "af7b8bea-693b-4dff-a6e5-16f7d748662b", + "w": 24, + "x": 24, + "y": 52 + }, + "panelIndex": "af7b8bea-693b-4dff-a6e5-16f7d748662b", + "title": "Distribution of Host ID by QDS Factor [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 13, + "i": "b9fb4232-265f-4604-8393-9c6e0fe3654f", + "w": 48, + "x": 0, + "y": 67 + }, + "panelIndex": "b9fb4232-265f-4604-8393-9c6e0fe3654f", + "panelRefName": "panel_b9fb4232-265f-4604-8393-9c6e0fe3654f", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Qualys VMDR] Asset Host Detection", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-08T19:11:34.675Z", + "id": "qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "deea88fb-bb05-4925-9fc2-6244ad262293:indexpattern-datasource-layer-736aade9-3fe7-4898-8b17-393b1883f0e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "deea88fb-bb05-4925-9fc2-6244ad262293:126ba167-10db-4d56-b62d-86c9346af8d1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "303a63da-f031-49c7-b120-7fa51b79b52f:indexpattern-datasource-layer-defc22a5-4f13-49ff-9c84-4db57102abac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "303a63da-f031-49c7-b120-7fa51b79b52f:c4f8790b-88d0-45bb-ad36-6f3e38f82474", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a46a2866-1969-4433-9fc1-1a387c1f463a:indexpattern-datasource-layer-0e7009cd-e316-4bbe-8c45-6690620cdffd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a46a2866-1969-4433-9fc1-1a387c1f463a:aebaed35-bd71-41b2-a1c6-63356ccf6934", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "71cc5649-1d1e-46f3-8dbf-6fcef50d3e07:indexpattern-datasource-layer-e31c084b-0cac-4a93-bd9c-944cd4eb8064", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "71cc5649-1d1e-46f3-8dbf-6fcef50d3e07:dcb2ccb1-6d24-41ca-927d-64582cd6fda0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "03a7a927-2237-486c-962e-9812a147b143:indexpattern-datasource-layer-613f9aaf-80b8-4737-ace5-c7423f402da2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "03a7a927-2237-486c-962e-9812a147b143:47bd9f10-64f6-4721-af73-0b481e9200f6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d05d9930-81af-428a-a8de-fa350b3f82a5:indexpattern-datasource-layer-6b175f15-ccac-4228-b6be-9799c2a22f9b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d05d9930-81af-428a-a8de-fa350b3f82a5:36ce9043-dec3-482b-98a4-5e3891df90d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4af93ada-f0eb-4c2e-be3d-cdb4b09b1d8b:indexpattern-datasource-layer-63ee9c94-98b1-44cc-80e9-9d32618dcc7d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4af93ada-f0eb-4c2e-be3d-cdb4b09b1d8b:8d8d9ad5-92ab-4db7-bd14-b9e85a9396c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd7fd2bc-45d6-41e1-bcd5-11a55041ca72:indexpattern-datasource-layer-019e5587-b3f1-40df-aa39-6cf329384222", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd7fd2bc-45d6-41e1-bcd5-11a55041ca72:d1ae3668-0999-4534-bf6e-22d7574c6140", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "193da6ca-ef10-4e49-93be-53ed8e14ce47:indexpattern-datasource-layer-caeadf09-f0a8-40d1-8add-56d5fcda88f1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "193da6ca-ef10-4e49-93be-53ed8e14ce47:e6d9f901-d36e-46d2-a97b-df8d5ddb788e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6761f74-9237-429f-b384-2259770d99c3:indexpattern-datasource-layer-9f11ec1e-50c4-4d4d-bea2-d58ce81911fa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f6761f74-9237-429f-b384-2259770d99c3:e74c7b10-7f36-4c05-a8f4-d1b3b3110aad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af7b8bea-693b-4dff-a6e5-16f7d748662b:indexpattern-datasource-layer-8b4bfe41-5793-4715-b5f4-d5208c639ba8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "af7b8bea-693b-4dff-a6e5-16f7d748662b:99e287b3-fa77-4dde-9821-2b7dc9616d47", + "type": "index-pattern" + }, + { + "id": "qualys_vmdr-4119cae0-100e-11ee-b28e-615808a979fd", + "name": "b9fb4232-265f-4604-8393-9c6e0fe3654f:panel_b9fb4232-265f-4604-8393-9c6e0fe3654f", + "type": "search" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892.json b/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892.json new file mode 100644 index 00000000000..758d3495e85 --- /dev/null +++ b/packages/qualys_vmdr/kibana/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892.json @@ -0,0 +1,1774 @@ +{ + "attributes": { + "description": "This dashboard shows Knowledge Base data collected by the Qualys VMDR integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "Navigation\n\n[Qualys VMDR Knowledge Base (This Page)](#/dashboard/qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892)\n\n[Qualys VMDR Asset Host Detection](#/dashboard/qualys_vmdr-017c0220-1001-11ee-b28e-615808a979fd)\n\n\n[Integrations Page](/app/integrations/browse?q=qualys)\n\nOverview\n\nThis dashboard shows Knowledge Base overview related to the Qualys VMDR Integration.\n\nThe dashboard is made to provide general statistics and show the information of the ingested vulnerabilities from Qualys.\n\nIt provides information about how many vulnerabilities are active or disabled. It also displays the distribution of vulnerabilities according to type, severity, and patchability. New or modified vulnerabilities over day is also shown.\nIt fetches new updates every six hours by default.\n", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "6714a04f-6db8-4c98-bdf4-a84400744766", + "w": 11, + "x": 0, + "y": 0 + }, + "panelIndex": "6714a04f-6db8-4c98-bdf4-a84400744766", + "title": "Table of Contents", + "type": "visualization", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc6d8315-bba7-4005-830e-c09ddd3feb2f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "30246ae5-d398-481a-bbef-cbdc5816d4a4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc6d8315-bba7-4005-830e-c09ddd3feb2f": { + "columnOrder": [ + "1ee0db7c-8791-42fa-9b8b-bf61197e79fe", + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX0", + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX1" + ], + "columns": { + "1ee0db7c-8791-42fa-9b8b-bf61197e79fe": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Vulnerabilities", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(event.id), 0)", + "isFormulaBroken": false + }, + "references": [ + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX1" + ], + "scale": "ratio" + }, + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Vulnerabilities", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Vulnerabilities", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX0", + 0 + ], + "location": { + "max": 35, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(event.id), 0)", + "type": "function" + } + }, + "references": [ + "1ee0db7c-8791-42fa-9b8b-bf61197e79feX0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "30246ae5-d398-481a-bbef-cbdc5816d4a4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "fc6d8315-bba7-4005-830e-c09ddd3feb2f", + "layerType": "data", + "metricAccessor": "1ee0db7c-8791-42fa-9b8b-bf61197e79fe" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "0313215b-27b8-48e5-b3d3-a5fec24fc03c", + "w": 12, + "x": 11, + "y": 0 + }, + "panelIndex": "0313215b-27b8-48e5-b3d3-a5fec24fc03c", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1c45f500-0cab-4d97-ae45-fb46a94b7708", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e70ad733-93ff-41e0-a6f6-e4cad3643932", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1c45f500-0cab-4d97-ae45-fb46a94b7708": { + "columnOrder": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4", + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0", + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1" + ], + "columns": { + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Vulnerabilities", + "operationType": "formula", + "params": { + "formula": "defaults(count(qualys_vmdr.knowledge_base.is_disabled, kql='qualys_vmdr.knowledge_base.is_disabled : false '), 0)", + "isFormulaBroken": false + }, + "references": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1" + ], + "scale": "ratio" + }, + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "qualys_vmdr.knowledge_base.is_disabled : false " + }, + "isBucketed": false, + "label": "Active Vulnerabilities", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "qualys_vmdr.knowledge_base.is_disabled" + }, + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Active Vulnerabilities", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0", + 0 + ], + "location": { + "max": 113, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(qualys_vmdr.knowledge_base.is_disabled, kql='qualys_vmdr.knowledge_base.is_disabled : false '), 0)", + "type": "function" + } + }, + "references": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "e70ad733-93ff-41e0-a6f6-e4cad3643932", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#54B399", + "layerId": "1c45f500-0cab-4d97-ae45-fb46a94b7708", + "layerType": "data", + "metricAccessor": "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "c8af9137-2e50-4f45-8214-9957c099933c", + "w": 12, + "x": 23, + "y": 0 + }, + "panelIndex": "c8af9137-2e50-4f45-8214-9957c099933c", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1c45f500-0cab-4d97-ae45-fb46a94b7708", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "91709e5e-fe38-4bb1-adc8-16b9925fbdb7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1c45f500-0cab-4d97-ae45-fb46a94b7708": { + "columnOrder": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4", + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0", + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1" + ], + "columns": { + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Disabled Vulnerabilities", + "operationType": "formula", + "params": { + "formula": "defaults(count(qualys_vmdr.knowledge_base.is_disabled, kql='qualys_vmdr.knowledge_base.is_disabled : true '), 0)", + "isFormulaBroken": false + }, + "references": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1" + ], + "scale": "ratio" + }, + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "qualys_vmdr.knowledge_base.is_disabled : true " + }, + "isBucketed": false, + "label": "Disabled Vulnerabilities", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "qualys_vmdr.knowledge_base.is_disabled" + }, + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Disabled Vulnerabilities", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0", + 0 + ], + "location": { + "max": 112, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(qualys_vmdr.knowledge_base.is_disabled, kql='qualys_vmdr.knowledge_base.is_disabled : true '), 0)", + "type": "function" + } + }, + "references": [ + "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4X0" + ], + "scale": "ratio" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "91709e5e-fe38-4bb1-adc8-16b9925fbdb7", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#CC5642", + "layerId": "1c45f500-0cab-4d97-ae45-fb46a94b7708", + "layerType": "data", + "metricAccessor": "bf9b9b47-9d37-4ebd-9c36-cdeeff1166c4" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "ea8ba0dd-5c49-4ec7-9a27-957fa70d35aa", + "w": 13, + "x": 35, + "y": 0 + }, + "panelIndex": "ea8ba0dd-5c49-4ec7-9a27-957fa70d35aa", + "title": "", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cdb710a8-9bd3-40ea-81e6-80ba7634f9c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "334cd028-2728-4de3-a1ba-77c1af124ab9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cdb710a8-9bd3-40ea-81e6-80ba7634f9c8": { + "columnOrder": [ + "0c10a23f-1a1b-4bff-8a0b-5587d1380d97", + "c5f4ce94-6edc-4999-8533-eeffc4865a94", + "8655b14d-a62f-4f98-8749-cdaee2ad54a7", + "84a7dbe5-ed6f-4239-89f1-1af2e5391132" + ], + "columns": { + "0c10a23f-1a1b-4bff-8a0b-5587d1380d97": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "84a7dbe5-ed6f-4239-89f1-1af2e5391132", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "vulnerability.category" + }, + "84a7dbe5-ed6f-4239-89f1-1af2e5391132": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8655b14d-a62f-4f98-8749-cdaee2ad54a7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "84a7dbe5-ed6f-4239-89f1-1af2e5391132", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.knowledge_base.vuln_type" + }, + "c5f4ce94-6edc-4999-8533-eeffc4865a94": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "84a7dbe5-ed6f-4239-89f1-1af2e5391132", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "vulnerability.severity" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "334cd028-2728-4de3-a1ba-77c1af124ab9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "84a7dbe5-ed6f-4239-89f1-1af2e5391132", + "isTransposed": false + }, + { + "columnId": "0c10a23f-1a1b-4bff-8a0b-5587d1380d97", + "isTransposed": false + }, + { + "columnId": "c5f4ce94-6edc-4999-8533-eeffc4865a94", + "isTransposed": false + }, + { + "columnId": "8655b14d-a62f-4f98-8749-cdaee2ad54a7", + "isTransposed": false + } + ], + "layerId": "cdb710a8-9bd3-40ea-81e6-80ba7634f9c8", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "32d00cd1-94d4-4c62-a02b-e447b57ed9e5", + "w": 19, + "x": 11, + "y": 7 + }, + "panelIndex": "32d00cd1-94d4-4c62-a02b-e447b57ed9e5", + "title": "Top 10 Categories by Highest Vulnerability [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9ff668db-ebd5-4d63-ad5a-059a12858425", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "942569ff-c235-4ba0-84ae-e8e690e001be", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9ff668db-ebd5-4d63-ad5a-059a12858425": { + "columnOrder": [ + "ca40c386-d0f7-462c-ab8c-394f47fb57f2", + "5a21218d-0bd5-44fb-bdfe-97d184efd59e" + ], + "columns": { + "5a21218d-0bd5-44fb-bdfe-97d184efd59e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "ca40c386-d0f7-462c-ab8c-394f47fb57f2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5a21218d-0bd5-44fb-bdfe-97d184efd59e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "vulnerability.severity" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "942569ff-c235-4ba0-84ae-e8e690e001be", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "9ff668db-ebd5-4d63-ad5a-059a12858425", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "5a21218d-0bd5-44fb-bdfe-97d184efd59e" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ca40c386-d0f7-462c-ab8c-394f47fb57f2" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "84a9af63-33d9-4aa9-8796-08f2c0e6ae8d", + "w": 18, + "x": 30, + "y": 7 + }, + "panelIndex": "84a9af63-33d9-4aa9-8796-08f2c0e6ae8d", + "title": "Distribution of Vulnerabilities by Severity [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d5d16f0c-4e1a-446b-909e-0c6c462045a1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "79c95a4a-9d90-4f2e-9316-80a68eaa755f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d5d16f0c-4e1a-446b-909e-0c6c462045a1": { + "columnOrder": [ + "86033fb4-f165-4f8b-9f2f-ad5b288dbfa7", + "8e2da2c5-2fd1-4579-ae20-ee6732338003" + ], + "columns": { + "86033fb4-f165-4f8b-9f2f-ad5b288dbfa7": { + "customLabel": true, + "dataType": "boolean", + "isBucketed": true, + "label": "Patchable", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8e2da2c5-2fd1-4579-ae20-ee6732338003", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.knowledge_base.patchable" + }, + "8e2da2c5-2fd1-4579-ae20-ee6732338003": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "79c95a4a-9d90-4f2e-9316-80a68eaa755f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "d5d16f0c-4e1a-446b-909e-0c6c462045a1", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "8e2da2c5-2fd1-4579-ae20-ee6732338003" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "86033fb4-f165-4f8b-9f2f-ad5b288dbfa7" + ], + "truncateLegend": false + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "39add182-fb70-40d9-8634-a38bc3f654e5", + "w": 24, + "x": 0, + "y": 22 + }, + "panelIndex": "39add182-fb70-40d9-8634-a38bc3f654e5", + "title": "Distribution of Vulnerabilities by Patchability [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-97c7489f-b3eb-4379-ae6d-09f07db7d5ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa4c3064-474b-4957-8eb5-8b8efe4eb487", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "97c7489f-b3eb-4379-ae6d-09f07db7d5ba": { + "columnOrder": [ + "404f0223-f424-47a6-8685-57fadb31feaa", + "08e5d34f-76d7-4526-b135-1dbf91341208" + ], + "columns": { + "08e5d34f-76d7-4526-b135-1dbf91341208": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "404f0223-f424-47a6-8685-57fadb31feaa": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Vulnerability Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "08e5d34f-76d7-4526-b135-1dbf91341208", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.knowledge_base.vuln_type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "fa4c3064-474b-4957-8eb5-8b8efe4eb487", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "97c7489f-b3eb-4379-ae6d-09f07db7d5ba", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "08e5d34f-76d7-4526-b135-1dbf91341208" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "404f0223-f424-47a6-8685-57fadb31feaa" + ], + "truncateLegend": false + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "5e8d452a-6ac1-49d2-8ca6-a8a96d2e3a16", + "w": 24, + "x": 24, + "y": 22 + }, + "panelIndex": "5e8d452a-6ac1-49d2-8ca6-a8a96d2e3a16", + "title": "Distribution of Vulnerabilities by Type [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-90d22ca7-1d9c-4bcd-8dfe-f3524990b16c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9034073-5816-4205-99a7-e64ccfb61f02", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "90d22ca7-1d9c-4bcd-8dfe-f3524990b16c": { + "columnOrder": [ + "dbdcda60-5ac1-46a7-ab2f-19c546fbd5a4", + "256882b2-ac19-4141-ba30-54db33af19ea" + ], + "columns": { + "256882b2-ac19-4141-ba30-54db33af19ea": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "dbdcda60-5ac1-46a7-ab2f-19c546fbd5a4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Software Vendor", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "256882b2-ac19-4141-ba30-54db33af19ea", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "qualys_vmdr.knowledge_base.software_list.vendor" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "b9034073-5816-4205-99a7-e64ccfb61f02", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "256882b2-ac19-4141-ba30-54db33af19ea" + ], + "layerId": "90d22ca7-1d9c-4bcd-8dfe-f3524990b16c", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "dbdcda60-5ac1-46a7-ab2f-19c546fbd5a4", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "256882b2-ac19-4141-ba30-54db33af19ea" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "34ce6929-6c25-47c2-9f12-e6ca5b732319", + "w": 48, + "x": 0, + "y": 37 + }, + "panelIndex": "34ce6929-6c25-47c2-9f12-e6ca5b732319", + "title": "Distribution of Vulnerabilities by Software Vendor [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-96ed356a-3613-4da1-a1e7-efee9d1a0ea6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "64b004c2-e6c1-411c-a336-d01ab0b2d5dc", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "96ed356a-3613-4da1-a1e7-efee9d1a0ea6": { + "columnOrder": [ + "feca14b8-559f-4fae-9d26-dd611b3cb054", + "1a84a85a-0bb7-4f91-b323-7aee8be3766d", + "1a84a85a-0bb7-4f91-b323-7aee8be3766dX0" + ], + "columns": { + "1a84a85a-0bb7-4f91-b323-7aee8be3766d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "formula", + "params": { + "formula": "unique_count(event.id)", + "isFormulaBroken": false + }, + "references": [ + "1a84a85a-0bb7-4f91-b323-7aee8be3766dX0" + ], + "scale": "ratio" + }, + "1a84a85a-0bb7-4f91-b323-7aee8be3766dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "unique_count(event.id)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "event.id" + }, + "feca14b8-559f-4fae-9d26-dd611b3cb054": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Published Date", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "d" + }, + "scale": "interval", + "sourceField": "qualys_vmdr.knowledge_base.published_datetime" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "64b004c2-e6c1-411c-a336-d01ab0b2d5dc", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "curveType": "LINEAR", + "layers": [ + { + "accessors": [ + "1a84a85a-0bb7-4f91-b323-7aee8be3766d" + ], + "layerId": "96ed356a-3613-4da1-a1e7-efee9d1a0ea6", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "feca14b8-559f-4fae-9d26-dd611b3cb054", + "yConfig": [ + { + "color": "#d36086", + "forAccessor": "1a84a85a-0bb7-4f91-b323-7aee8be3766d" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide", + "valuesInLegend": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a8c395dd-7ce3-4b8b-a0ae-3a05b9930402", + "w": 24, + "x": 0, + "y": 52 + }, + "panelIndex": "a8c395dd-7ce3-4b8b-a0ae-3a05b9930402", + "title": "New Vulnerabilities by Day [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c3c4df7e-483b-4471-93ab-3243c0661ba5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f59d47e-3612-40f9-9e58-04dd54d4c54d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c3c4df7e-483b-4471-93ab-3243c0661ba5": { + "columnOrder": [ + "0e23eea3-d6de-4958-8928-d24950612ec0", + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06", + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06X0" + ], + "columns": { + "0e23eea3-d6de-4958-8928-d24950612ec0": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "d" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "formula", + "params": { + "formula": "unique_count(event.id)", + "isFormulaBroken": false + }, + "references": [ + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06X0" + ], + "scale": "ratio" + }, + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Event ID", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "event.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "7f59d47e-3612-40f9-9e58-04dd54d4c54d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "2f28cc53-ddd0-4b17-8032-3e78d9aaea06" + ], + "layerId": "c3c4df7e-483b-4471-93ab-3243c0661ba5", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "0e23eea3-d6de-4958-8928-d24950612ec0", + "yConfig": [ + { + "color": "#9170b8", + "forAccessor": "2f28cc53-ddd0-4b17-8032-3e78d9aaea06" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right", + "shouldTruncate": false, + "showSingleSeries": true + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "60253842-958e-4a37-abc4-5b5e2dd97610", + "w": 24, + "x": 24, + "y": 52 + }, + "panelIndex": "60253842-958e-4a37-abc4-5b5e2dd97610", + "title": "Modified Vulnerabilities by Day [Logs Qualys VMDR]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 13, + "i": "c5d5dbe1-2194-4618-b719-0fa21d6bd4cf", + "w": 48, + "x": 0, + "y": 67 + }, + "panelIndex": "c5d5dbe1-2194-4618-b719-0fa21d6bd4cf", + "panelRefName": "panel_c5d5dbe1-2194-4618-b719-0fa21d6bd4cf", + "type": "search", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Qualys VMDR] Knowledge Base", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-08T19:19:37.847Z", + "id": "qualys_vmdr-686c4470-11b6-11ee-a722-91244a8ae892", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "0313215b-27b8-48e5-b3d3-a5fec24fc03c:indexpattern-datasource-layer-fc6d8315-bba7-4005-830e-c09ddd3feb2f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0313215b-27b8-48e5-b3d3-a5fec24fc03c:30246ae5-d398-481a-bbef-cbdc5816d4a4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c8af9137-2e50-4f45-8214-9957c099933c:indexpattern-datasource-layer-1c45f500-0cab-4d97-ae45-fb46a94b7708", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c8af9137-2e50-4f45-8214-9957c099933c:e70ad733-93ff-41e0-a6f6-e4cad3643932", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea8ba0dd-5c49-4ec7-9a27-957fa70d35aa:indexpattern-datasource-layer-1c45f500-0cab-4d97-ae45-fb46a94b7708", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea8ba0dd-5c49-4ec7-9a27-957fa70d35aa:91709e5e-fe38-4bb1-adc8-16b9925fbdb7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "32d00cd1-94d4-4c62-a02b-e447b57ed9e5:indexpattern-datasource-layer-cdb710a8-9bd3-40ea-81e6-80ba7634f9c8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "32d00cd1-94d4-4c62-a02b-e447b57ed9e5:334cd028-2728-4de3-a1ba-77c1af124ab9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84a9af63-33d9-4aa9-8796-08f2c0e6ae8d:indexpattern-datasource-layer-9ff668db-ebd5-4d63-ad5a-059a12858425", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "84a9af63-33d9-4aa9-8796-08f2c0e6ae8d:942569ff-c235-4ba0-84ae-e8e690e001be", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "39add182-fb70-40d9-8634-a38bc3f654e5:indexpattern-datasource-layer-d5d16f0c-4e1a-446b-909e-0c6c462045a1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "39add182-fb70-40d9-8634-a38bc3f654e5:79c95a4a-9d90-4f2e-9316-80a68eaa755f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e8d452a-6ac1-49d2-8ca6-a8a96d2e3a16:indexpattern-datasource-layer-97c7489f-b3eb-4379-ae6d-09f07db7d5ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5e8d452a-6ac1-49d2-8ca6-a8a96d2e3a16:fa4c3064-474b-4957-8eb5-8b8efe4eb487", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "34ce6929-6c25-47c2-9f12-e6ca5b732319:indexpattern-datasource-layer-90d22ca7-1d9c-4bcd-8dfe-f3524990b16c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "34ce6929-6c25-47c2-9f12-e6ca5b732319:b9034073-5816-4205-99a7-e64ccfb61f02", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8c395dd-7ce3-4b8b-a0ae-3a05b9930402:indexpattern-datasource-layer-96ed356a-3613-4da1-a1e7-efee9d1a0ea6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8c395dd-7ce3-4b8b-a0ae-3a05b9930402:64b004c2-e6c1-411c-a336-d01ab0b2d5dc", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60253842-958e-4a37-abc4-5b5e2dd97610:indexpattern-datasource-layer-c3c4df7e-483b-4471-93ab-3243c0661ba5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "60253842-958e-4a37-abc4-5b5e2dd97610:7f59d47e-3612-40f9-9e58-04dd54d4c54d", + "type": "index-pattern" + }, + { + "id": "qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892", + "name": "c5d5dbe1-2194-4618-b719-0fa21d6bd4cf:panel_c5d5dbe1-2194-4618-b719-0fa21d6bd4cf", + "type": "search" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/qualys_vmdr/kibana/search/qualys_vmdr-4119cae0-100e-11ee-b28e-615808a979fd.json b/packages/qualys_vmdr/kibana/search/qualys_vmdr-4119cae0-100e-11ee-b28e-615808a979fd.json new file mode 100644 index 00000000000..00131132e68 --- /dev/null +++ b/packages/qualys_vmdr/kibana/search/qualys_vmdr-4119cae0-100e-11ee-b28e-615808a979fd.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "columns": [ + "host.ip", + "host.id", + "host.domain", + "host.os.full", + "qualys_vmdr.asset_host_detection.last.vm.auth.scanned_date", + "qualys_vmdr.asset_host_detection.dns_data.domain", + "qualys_vmdr.asset_host_detection.dns_data.hostname" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.asset_host_detection" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.asset_host_detection" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Asset Host Detection Essential Details [Logs Qualys VMDR]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-08T18:52:00.843Z", + "id": "qualys_vmdr-4119cae0-100e-11ee-b28e-615808a979fd", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "dashboard": "7.9.3" + } +} \ No newline at end of file diff --git a/packages/qualys_vmdr/kibana/search/qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892.json b/packages/qualys_vmdr/kibana/search/qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892.json new file mode 100644 index 00000000000..d47c4106ee1 --- /dev/null +++ b/packages/qualys_vmdr/kibana/search/qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "columns": [ + "@timestamp", + "vulnerability.category", + "vulnerability.severity", + "vulnerability.id", + "vulnerability.description", + "qualys_vmdr.knowledge_base.vuln_type", + "qualys_vmdr.knowledge_base.pci_reasons.value", + "qualys_vmdr.knowledge_base.consequence" + ], + "description": "", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "qualys_vmdr.knowledge_base" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "qualys_vmdr.knowledge_base" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Knowledge Base Essential Details [Logs Qualys VMDR]", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-08T18:52:00.843Z", + "id": "qualys_vmdr-fc0b5150-125e-11ee-a722-91244a8ae892", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "migrationVersion": { + "dashboard": "7.9.3" + } +} \ No newline at end of file diff --git a/packages/qualys_vmdr/kibana/tags.yml b/packages/qualys_vmdr/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/qualys_vmdr/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/qualys_vmdr/manifest.yml b/packages/qualys_vmdr/manifest.yml new file mode 100644 index 00000000000..63629a8fabe --- /dev/null +++ b/packages/qualys_vmdr/manifest.yml @@ -0,0 +1,90 @@ +format_version: "3.0.0" +name: qualys_vmdr +title: Qualys VMDR +version: "0.4.0" +description: Collect data from Qualys VMDR platform with Elastic Agent. +type: integration +categories: + - security + - vulnerability_management +conditions: + kibana: + version: ^8.9.0 + elastic: + subscription: basic +screenshots: + - src: /img/qualys-vmdr-asset-host-detection-dashboard.png + title: Qualys VMDR Asset Host Detection Dashboard Screenshot + size: 600x600 + type: image/png + - src: /img/qualys-vmdr-knowledge-base-dashboard.png + title: Qualys VMDR Knowledge Base Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/qualys-vmdr-logo.svg + title: Qualys VMDR logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: qualys_vmdr + title: Qualys VMDR data + description: Collect Qualys VMDR data. + inputs: + - type: cel + title: Collect Qualys VMDR data via API + description: Collecting Qualys VMDR via API. + vars: + - name: username + type: text + title: Username + description: Username for the Qualys VMDR. + multi: false + required: true + show_user: true + - name: password + type: password + title: Password + description: Password for the Qualys VMDR. + multi: false + required: true + show_user: true + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/rabbitmq/changelog.yml b/packages/rabbitmq/changelog.yml index 6b9277869af..65830efbc0f 100644 --- a/packages/rabbitmq/changelog.yml +++ b/packages/rabbitmq/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.10.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 - version: "1.10.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/rabbitmq/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/rabbitmq/data_stream/log/elasticsearch/ingest_pipeline/default.yml index dccc59caef9..0921a542394 100644 --- a/packages/rabbitmq/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/rabbitmq/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -17,6 +17,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original pattern_definitions: diff --git a/packages/rabbitmq/manifest.yml b/packages/rabbitmq/manifest.yml index 5c827a4225c..4930b7363c0 100644 --- a/packages/rabbitmq/manifest.yml +++ b/packages/rabbitmq/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: rabbitmq title: RabbitMQ Logs and Metrics -version: "1.10.0" +version: "1.10.1" license: basic description: Collect and parse logs from RabbitMQ servers with Elastic Agent. type: integration diff --git a/packages/radware/_dev/build/build.yml b/packages/radware/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/radware/_dev/build/build.yml +++ b/packages/radware/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/radware/changelog.yml b/packages/radware/changelog.yml index ec9b216ea47..bada40c3045 100644 --- a/packages/radware/changelog.yml +++ b/packages/radware/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.16.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "0.15.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/radware/data_stream/defensepro/elasticsearch/ingest_pipeline/default.yml b/packages/radware/data_stream/defensepro/elasticsearch/ingest_pipeline/default.yml index 86434474fd7..bca3455ba93 100644 --- a/packages/radware/data_stream/defensepro/elasticsearch/ingest_pipeline/default.yml +++ b/packages/radware/data_stream/defensepro/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Radware DefensePro processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # User agent - user_agent: field: user_agent.original diff --git a/packages/radware/manifest.yml b/packages/radware/manifest.yml index 454a636b804..987b4a4bb06 100644 --- a/packages/radware/manifest.yml +++ b/packages/radware/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.7.0 name: radware title: Radware DefensePro Logs -version: "0.15.0" +version: "0.16.0" description: Collect defensePro logs from Radware devices with Elastic Agent. categories: ["security"] type: integration diff --git a/packages/rapid7_insightvm/_dev/build/build.yml b/packages/rapid7_insightvm/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/rapid7_insightvm/_dev/build/build.yml +++ b/packages/rapid7_insightvm/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/rapid7_insightvm/changelog.yml b/packages/rapid7_insightvm/changelog.yml index 3e580160381..a669984426b 100644 --- a/packages/rapid7_insightvm/changelog.yml +++ b/packages/rapid7_insightvm/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.1.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.0.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "1.0.0" changes: - description: Release Rapid7 InsightVM as GA. diff --git a/packages/rapid7_insightvm/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json b/packages/rapid7_insightvm/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json index 2d03caa5fc5..274e86902a3 100644 --- a/packages/rapid7_insightvm/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json +++ b/packages/rapid7_insightvm/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -78,7 +78,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/rapid7_insightvm/data_stream/asset/elasticsearch/ingest_pipeline/default.yml b/packages/rapid7_insightvm/data_stream/asset/elasticsearch/ingest_pipeline/default.yml index bd6fbb7b068..7e9282ad610 100644 --- a/packages/rapid7_insightvm/data_stream/asset/elasticsearch/ingest_pipeline/default.yml +++ b/packages/rapid7_insightvm/data_stream/asset/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Rapid7 InsightVM Asset logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: state @@ -24,7 +24,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - convert: @@ -37,7 +37,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.assessed_for_vulnerabilities tag: 'convert_assessed_for_vulnerabilities_to_boolean' @@ -48,7 +48,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.credential_assessments if: ctx.json?.credential_assessments instanceof List @@ -64,7 +64,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.credential_assessments target_field: rapid7.insightvm.asset.credential_assessments @@ -94,7 +94,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.exploits tag: 'convert_exploits_to_long' @@ -105,7 +105,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.host_name target_field: rapid7.insightvm.asset.host_name @@ -137,7 +137,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: host.ip value: '{{{rapid7.insightvm.asset.ip}}}' @@ -158,7 +158,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.last_scan_end tag: 'date_last_scan_end' @@ -169,7 +169,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.last_scan_start tag: 'date_last_scan_start' @@ -180,7 +180,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - gsub: field: json.mac pattern: '[:.]' @@ -204,7 +204,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.moderate_vulnerabilities tag: 'convert_moderate_vulnerabilities_to_long' @@ -215,7 +215,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.new if: ctx.json?.new instanceof List @@ -257,7 +257,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.new if: ctx.json?.new instanceof List @@ -415,7 +415,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.remediated if: ctx.json?.remediated instanceof List @@ -490,7 +490,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.risk.static_score copy_from: rapid7.insightvm.asset.risk_score @@ -536,7 +536,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.same if: ctx.json?.same instanceof List @@ -611,7 +611,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tags target_field: rapid7.insightvm.asset.tags @@ -626,7 +626,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.type target_field: rapid7.insightvm.asset.type diff --git a/packages/rapid7_insightvm/data_stream/asset/manifest.yml b/packages/rapid7_insightvm/data_stream/asset/manifest.yml index 984699ba576..1c2f1245029 100644 --- a/packages/rapid7_insightvm/data_stream/asset/manifest.yml +++ b/packages/rapid7_insightvm/data_stream/asset/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Rapid7 InsightVM API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Rapid7 InsightVM API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/rapid7_insightvm/data_stream/asset/sample_event.json b/packages/rapid7_insightvm/data_stream/asset/sample_event.json index bd28658fc2f..ab4b40270f9 100644 --- a/packages/rapid7_insightvm/data_stream/asset/sample_event.json +++ b/packages/rapid7_insightvm/data_stream/asset/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", diff --git a/packages/rapid7_insightvm/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json b/packages/rapid7_insightvm/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json index c2d33389e50..19cb3dd445a 100644 --- a/packages/rapid7_insightvm/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json +++ b/packages/rapid7_insightvm/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-06-08T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -172,7 +172,7 @@ { "@timestamp": "2018-06-08T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/rapid7_insightvm/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml b/packages/rapid7_insightvm/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml index 8e15a1a97ad..adc8af7933f 100644 --- a/packages/rapid7_insightvm/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml +++ b/packages/rapid7_insightvm/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Rapid7 InsightVM Vulnerability logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -24,7 +24,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - fingerprint: @@ -47,7 +47,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.categories target_field: rapid7.insightvm.vulnerability.categories @@ -107,7 +107,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.cvss_v2_impact_score tag: 'convert_cvss_v2_impact_score_to_double' @@ -118,7 +118,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.cvss_v2_integrity_impact target_field: rapid7.insightvm.vulnerability.cvss.v2.integrity_impact @@ -133,7 +133,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: vulnerability.score.base value: '{{{rapid7.insightvm.vulnerability.cvss.v2.score}}}' @@ -169,7 +169,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.cvss_v3_impact_score tag: 'convert_cvss_v3_impact_score_to_double' @@ -180,7 +180,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.cvss_v3_integrity_impact target_field: rapid7.insightvm.vulnerability.cvss.v3.integrity_impact @@ -203,7 +203,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: vulnerability.score.base value: '{{{rapid7.insightvm.vulnerability.cvss.v3.score}}}' @@ -224,7 +224,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.cvss_v3_user_interaction target_field: rapid7.insightvm.vulnerability.cvss.v3.user_interaction @@ -243,7 +243,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.description target_field: rapid7.insightvm.vulnerability.description @@ -282,7 +282,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: '@timestamp' copy_from: rapid7.insightvm.vulnerability.modified @@ -297,7 +297,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.pci_fail tag: 'convert_pci_fail_to_boolean' @@ -308,7 +308,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.pci_severity_score tag: 'convert_pci_severity_score_to_long' @@ -319,7 +319,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.pci_special_notes target_field: rapid7.insightvm.vulnerability.pci.special_notes @@ -338,7 +338,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.references target_field: rapid7.insightvm.vulnerability.references @@ -357,7 +357,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.risk_score copy_from: rapid7.insightvm.vulnerability.risk_score @@ -388,7 +388,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.severity copy_from: rapid7.insightvm.vulnerability.severity_score diff --git a/packages/rapid7_insightvm/data_stream/vulnerability/manifest.yml b/packages/rapid7_insightvm/data_stream/vulnerability/manifest.yml index 149cb59f5d0..a3557e92599 100644 --- a/packages/rapid7_insightvm/data_stream/vulnerability/manifest.yml +++ b/packages/rapid7_insightvm/data_stream/vulnerability/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the Vulnerability logs from Rapid7 InsightVM. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the Vulnerability logs from Rapid7 InsightVM. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Rapid7 InsightVM API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Rapid7 InsightVM API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -33,7 +33,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/rapid7_insightvm/data_stream/vulnerability/sample_event.json b/packages/rapid7_insightvm/data_stream/vulnerability/sample_event.json index 33b0c3ebe12..3b9306c6451 100644 --- a/packages/rapid7_insightvm/data_stream/vulnerability/sample_event.json +++ b/packages/rapid7_insightvm/data_stream/vulnerability/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", diff --git a/packages/rapid7_insightvm/docs/README.md b/packages/rapid7_insightvm/docs/README.md index 2e045e86356..7afca442aff 100644 --- a/packages/rapid7_insightvm/docs/README.md +++ b/packages/rapid7_insightvm/docs/README.md @@ -52,7 +52,7 @@ An example event for `asset` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", @@ -252,7 +252,7 @@ An example event for `vulnerability` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", diff --git a/packages/rapid7_insightvm/kibana/tags.yml b/packages/rapid7_insightvm/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/rapid7_insightvm/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/rapid7_insightvm/manifest.yml b/packages/rapid7_insightvm/manifest.yml index 8ef330a2caa..04335873a15 100644 --- a/packages/rapid7_insightvm/manifest.yml +++ b/packages/rapid7_insightvm/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: rapid7_insightvm title: Rapid7 InsightVM -version: "1.0.0" +version: "1.4.0" source: license: "Elastic-2.0" description: Collect logs from Rapid7 InsightVM with Elastic Agent. @@ -10,8 +10,10 @@ categories: - security - vulnerability_management conditions: - kibana.version: ^8.7.1 - elastic.subscription: "basic" + kibana: + version: ^8.7.1 + elastic: + subscription: "basic" screenshots: - src: /img/rapid7-insightvm-vulnerability-dashboard.png title: Rapid7 InsightVM Vulnerability Dashboard Screenshot @@ -94,3 +96,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/redis/changelog.yml b/packages/redis/changelog.yml index c7160d6f1a8..1a5b4afbe21 100644 --- a/packages/redis/changelog.yml +++ b/packages/redis/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.11.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 - version: "1.11.0" changes: - description: Enable time series data streams for the metrics datasets. This dramatically reduces storage for metrics and is expected to progressively improve query performance. For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. diff --git a/packages/redis/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/redis/data_stream/log/elasticsearch/ingest_pipeline/default.yml index ad7b402d95f..8d8b4c7c90f 100644 --- a/packages/redis/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/redis/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -11,6 +11,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/redis/manifest.yml b/packages/redis/manifest.yml index 7afbd75d9eb..428bfd2ef38 100644 --- a/packages/redis/manifest.yml +++ b/packages/redis/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: redis title: Redis -version: "1.11.0" +version: "1.11.1" license: basic description: Collect logs and metrics from Redis servers with Elastic Agent. type: integration diff --git a/packages/salesforce/_dev/build/docs/README.md b/packages/salesforce/_dev/build/docs/README.md index 64f9d1f99fa..4caa956ba46 100644 --- a/packages/salesforce/_dev/build/docs/README.md +++ b/packages/salesforce/_dev/build/docs/README.md @@ -151,6 +151,14 @@ After the integration is successfully configured, clicking on the Assets tab of ## Troubleshooting +### Request timeout + +In `Apex`, `Login Rest`, `Logout Rest`, or `SetupAuditTrail` datastreams, if the response is getting delayed from the Salesforce server side due to any reason then the following error might occur: +``` +Error while processing http request: failed to execute rf.collectResponse: failed to execute http client.Do: failed to execute http client.Do: failed to read http.response.body +``` +In this case, consider increasing `Request timeout` configuration from `Advanced options` section of that data stream. + ### Data ingestion error In case of data ingestion if the user finds the following type of error logs: diff --git a/packages/salesforce/changelog.yml b/packages/salesforce/changelog.yml index 0e1a4955ba7..eda10f3b5ed 100644 --- a/packages/salesforce/changelog.yml +++ b/packages/salesforce/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.10.1" + changes: + - description: Add 'Request timeout' configuration. + type: enhancement + link: https://github.com/elastic/integrations/pull/7891 - version: "0.10.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/salesforce/data_stream/apex/agent/stream/httpjson.yml.hbs b/packages/salesforce/data_stream/apex/agent/stream/httpjson.yml.hbs index 87b94b8a800..655d199cda7 100644 --- a/packages/salesforce/data_stream/apex/agent/stream/httpjson.yml.hbs +++ b/packages/salesforce/data_stream/apex/agent/stream/httpjson.yml.hbs @@ -11,6 +11,9 @@ auth.oauth2: token_url: {{token_url}} user: {{username}} password: {{password}} +{{#if request_timeout}} +request.timeout: {{request_timeout}} +{{/if}} request.url: {{instance_url}}/services/data/v54.0/query?q=apex request.transforms: - set: diff --git a/packages/salesforce/data_stream/apex/manifest.yml b/packages/salesforce/data_stream/apex/manifest.yml index d9ca8a8e379..499224e507c 100644 --- a/packages/salesforce/data_stream/apex/manifest.yml +++ b/packages/salesforce/data_stream/apex/manifest.yml @@ -28,6 +28,14 @@ streams: type: bool multi: false default: false + - name: request_timeout + type: text + title: Request timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are `s` (seconds) and `m` (minutes). Default is 30s if left empty. + show_user: false + multi: false + required: false + default: 5m - name: processors type: yaml title: Processors diff --git a/packages/salesforce/data_stream/login_rest/agent/stream/httpjson.yml.hbs b/packages/salesforce/data_stream/login_rest/agent/stream/httpjson.yml.hbs index d1d1a8547c5..1b5d7f215b5 100644 --- a/packages/salesforce/data_stream/login_rest/agent/stream/httpjson.yml.hbs +++ b/packages/salesforce/data_stream/login_rest/agent/stream/httpjson.yml.hbs @@ -11,6 +11,9 @@ auth.oauth2: token_url: {{token_url}} user: {{username}} password: {{password}} +{{#if request_timeout}} +request.timeout: {{request_timeout}} +{{/if}} request.url: {{instance_url}}/services/data/v54.0/query?q=login+rest request.transforms: - set: diff --git a/packages/salesforce/data_stream/login_rest/manifest.yml b/packages/salesforce/data_stream/login_rest/manifest.yml index d80a3b7c85f..f15fb899c00 100644 --- a/packages/salesforce/data_stream/login_rest/manifest.yml +++ b/packages/salesforce/data_stream/login_rest/manifest.yml @@ -28,6 +28,14 @@ streams: type: bool multi: false default: false + - name: request_timeout + type: text + title: Request timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are `s` (seconds) and `m` (minutes). Default is 30s if left empty. + show_user: false + multi: false + required: false + default: 5m - name: processors type: yaml title: Processors diff --git a/packages/salesforce/data_stream/logout_rest/agent/stream/httpjson.yml.hbs b/packages/salesforce/data_stream/logout_rest/agent/stream/httpjson.yml.hbs index 6b172fc59e8..281f068bdf1 100644 --- a/packages/salesforce/data_stream/logout_rest/agent/stream/httpjson.yml.hbs +++ b/packages/salesforce/data_stream/logout_rest/agent/stream/httpjson.yml.hbs @@ -11,6 +11,9 @@ auth.oauth2: token_url: {{token_url}} user: {{username}} password: {{password}} +{{#if request_timeout}} +request.timeout: {{request_timeout}} +{{/if}} request.url: {{instance_url}}/services/data/v54.0/query?q=logout+rest request.transforms: - set: diff --git a/packages/salesforce/data_stream/logout_rest/manifest.yml b/packages/salesforce/data_stream/logout_rest/manifest.yml index bbaa28038d8..00f27352802 100644 --- a/packages/salesforce/data_stream/logout_rest/manifest.yml +++ b/packages/salesforce/data_stream/logout_rest/manifest.yml @@ -28,6 +28,14 @@ streams: type: bool multi: false default: false + - name: request_timeout + type: text + title: Request timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are `s` (seconds) and `m` (minutes). Default is 30s if left empty. + show_user: false + multi: false + required: false + default: 5m - name: processors type: yaml title: Processors diff --git a/packages/salesforce/data_stream/setupaudittrail/agent/stream/httpjson.yml.hbs b/packages/salesforce/data_stream/setupaudittrail/agent/stream/httpjson.yml.hbs index 0b1c74333f4..cd53a5ae532 100644 --- a/packages/salesforce/data_stream/setupaudittrail/agent/stream/httpjson.yml.hbs +++ b/packages/salesforce/data_stream/setupaudittrail/agent/stream/httpjson.yml.hbs @@ -11,6 +11,9 @@ auth.oauth2: token_url: {{token_url}} user: {{username}} password: {{password}} +{{#if request_timeout}} +request.timeout: {{request_timeout}} +{{/if}} request.url: {{instance_url}}/services/data/v54.0/query?q=setupaudittrail+rest request.transforms: - set: diff --git a/packages/salesforce/data_stream/setupaudittrail/manifest.yml b/packages/salesforce/data_stream/setupaudittrail/manifest.yml index 949cc70ca7c..9ac116c79ad 100644 --- a/packages/salesforce/data_stream/setupaudittrail/manifest.yml +++ b/packages/salesforce/data_stream/setupaudittrail/manifest.yml @@ -28,6 +28,14 @@ streams: type: bool multi: false default: false + - name: request_timeout + type: text + title: Request timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are `s` (seconds) and `m` (minutes). Default is 30s if left empty. + show_user: false + multi: false + required: false + default: 5m - name: processors type: yaml title: Processors diff --git a/packages/salesforce/docs/README.md b/packages/salesforce/docs/README.md index e30ac2dffb1..e6180062042 100644 --- a/packages/salesforce/docs/README.md +++ b/packages/salesforce/docs/README.md @@ -151,6 +151,14 @@ After the integration is successfully configured, clicking on the Assets tab of ## Troubleshooting +### Request timeout + +In `Apex`, `Login Rest`, `Logout Rest`, or `SetupAuditTrail` datastreams, if the response is getting delayed from the Salesforce server side due to any reason then the following error might occur: +``` +Error while processing http request: failed to execute rf.collectResponse: failed to execute http client.Do: failed to execute http client.Do: failed to read http.response.body +``` +In this case, consider increasing `Request timeout` configuration from `Advanced options` section of that data stream. + ### Data ingestion error In case of data ingestion if the user finds the following type of error logs: diff --git a/packages/salesforce/manifest.yml b/packages/salesforce/manifest.yml index 9e37347ff8b..02e55c441e3 100644 --- a/packages/salesforce/manifest.yml +++ b/packages/salesforce/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: salesforce title: Salesforce -version: "0.10.0" +version: "0.10.1" license: basic description: Collect logs from Salesforce with Elastic Agent. type: integration diff --git a/packages/santa/_dev/build/build.yml b/packages/santa/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/santa/_dev/build/build.yml +++ b/packages/santa/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/santa/changelog.yml b/packages/santa/changelog.yml index c0c722611bd..70717dcea75 100644 --- a/packages/santa/changelog.yml +++ b/packages/santa/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 3.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "3.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "3.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "3.10.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6910 +- version: "3.9.0" + changes: + - description: Update to package-spec 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6855 - version: "3.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/santa/data_stream/log/_dev/test/pipeline/test-santa-raw.log-expected.json b/packages/santa/data_stream/log/_dev/test/pipeline/test-santa-raw.log-expected.json index 4a9a0455c73..2abd6da049d 100644 --- a/packages/santa/data_stream/log/_dev/test/pipeline/test-santa-raw.log-expected.json +++ b/packages/santa/data_stream/log/_dev/test/pipeline/test-santa-raw.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-05-12T11:38:03.923Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "exec", @@ -20,7 +20,9 @@ "file": { "x509": { "issuer": { - "common_name": "Software Signing" + "common_name": [ + "Software Signing" + ] } } }, @@ -80,7 +82,7 @@ { "@timestamp": "2022-05-12T11:38:42.781Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "exec", @@ -97,7 +99,9 @@ "file": { "x509": { "issuer": { - "common_name": "Software Signing" + "common_name": [ + "Software Signing" + ] } } }, @@ -155,7 +159,7 @@ { "@timestamp": "2022-05-12T11:33:56.696Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "delete", @@ -205,7 +209,7 @@ { "@timestamp": "2022-05-12T11:30:05.248Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "link", @@ -256,7 +260,7 @@ { "@timestamp": "2022-05-12T11:30:16.125Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "rename", @@ -307,7 +311,7 @@ { "@timestamp": "2022-05-12T11:38:05.278Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "write", @@ -357,7 +361,7 @@ { "@timestamp": "2022-05-12T11:32:33.718Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diskdisappear", @@ -382,7 +386,7 @@ { "@timestamp": "2022-05-12T11:32:44.184Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diskappear", @@ -409,7 +413,7 @@ { "@timestamp": "2022-05-12T11:33:57.166Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diskappear", @@ -437,7 +441,7 @@ { "@timestamp": "2022-05-12T11:33:57.235Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diskappear", @@ -466,7 +470,7 @@ { "@timestamp": "2022-05-12T11:35:31.436Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "diskdisappear", diff --git a/packages/santa/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/santa/data_stream/log/elasticsearch/ingest_pipeline/default.yml index f478ee47550..b6361c9b0e7 100644 --- a/packages/santa/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/santa/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Google Santa logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -100,10 +100,10 @@ processors: field: related.hash value: "{{process.hash.sha256}}" if: "ctx?.process?.hash != null" - - set: + - append: field: file.x509.issuer.common_name - value: "{{santa.certificate.common_name}}" - ignore_empty_value: true + value: "{{{santa.certificate.common_name}}}" + if: ctx.santa?.certificate?.common_name != null - remove: field: event.original if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" diff --git a/packages/santa/data_stream/log/sample_event.json b/packages/santa/data_stream/log/sample_event.json index 1d477fe144d..ac790dfc205 100644 --- a/packages/santa/data_stream/log/sample_event.json +++ b/packages/santa/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-12T11:30:05.248Z", "agent": { - "ephemeral_id": "ea9b3ab9-896a-456a-8e87-7a6452edad19", - "id": "2c596a05-d358-406e-924c-bf221088f43c", + "ephemeral_id": "55a748a5-5ecc-451d-859d-988ea77abde5", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.1" + "version": "8.8.1" }, "data_stream": { "dataset": "santa.log", @@ -13,18 +13,18 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "2c596a05-d358-406e-924c-bf221088f43c", - "snapshot": true, - "version": "8.2.1" + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", + "snapshot": false, + "version": "8.8.1" }, "event": { "action": "link", "agent_id_status": "verified", "dataset": "santa.log", - "ingested": "2022-05-18T03:34:40Z", + "ingested": "2023-07-06T20:01:12Z", "kind": "event" }, "file": { @@ -37,23 +37,24 @@ }, "host": { "architecture": "x86_64", - "containerized": false, + "containerized": true, "hostname": "docker-fleet-agent", + "id": "1de1e3b6561d4ccb9731539ce2f3baf3", "ip": [ - "192.168.160.7" + "192.168.16.7" ], "mac": [ - "02:42:c0:a8:a0:07" + "02-42-C0-A8-10-07" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", - "kernel": "5.10.104-linuxkit", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -70,7 +71,7 @@ "args": [ "/usr/sbin/newsyslog" ], - "entity_id": "2c596a05-d358-406e-924c-bf221088f43c-71559-1096716", + "entity_id": "bb043b0c-36d1-4054-81ed-2d3f4546a433-71559-1096716", "executable": "/usr/sbin/newsyslog", "name": "newsyslog", "parent": { diff --git a/packages/santa/docs/README.md b/packages/santa/docs/README.md index e3ba098cf5f..f7946dc61a2 100644 --- a/packages/santa/docs/README.md +++ b/packages/santa/docs/README.md @@ -23,11 +23,11 @@ An example event for `log` looks as following: { "@timestamp": "2022-05-12T11:30:05.248Z", "agent": { - "ephemeral_id": "ea9b3ab9-896a-456a-8e87-7a6452edad19", - "id": "2c596a05-d358-406e-924c-bf221088f43c", + "ephemeral_id": "55a748a5-5ecc-451d-859d-988ea77abde5", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.1" + "version": "8.8.1" }, "data_stream": { "dataset": "santa.log", @@ -35,18 +35,18 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "2c596a05-d358-406e-924c-bf221088f43c", - "snapshot": true, - "version": "8.2.1" + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", + "snapshot": false, + "version": "8.8.1" }, "event": { "action": "link", "agent_id_status": "verified", "dataset": "santa.log", - "ingested": "2022-05-18T03:34:40Z", + "ingested": "2023-07-06T20:01:12Z", "kind": "event" }, "file": { @@ -59,23 +59,24 @@ An example event for `log` looks as following: }, "host": { "architecture": "x86_64", - "containerized": false, + "containerized": true, "hostname": "docker-fleet-agent", + "id": "1de1e3b6561d4ccb9731539ce2f3baf3", "ip": [ - "192.168.160.7" + "192.168.16.7" ], "mac": [ - "02:42:c0:a8:a0:07" + "02-42-C0-A8-10-07" ], "name": "docker-fleet-agent", "os": { "codename": "focal", "family": "debian", - "kernel": "5.10.104-linuxkit", + "kernel": "5.10.47-linuxkit", "name": "Ubuntu", "platform": "ubuntu", "type": "linux", - "version": "20.04.4 LTS (Focal Fossa)" + "version": "20.04.6 LTS (Focal Fossa)" } }, "input": { @@ -92,7 +93,7 @@ An example event for `log` looks as following: "args": [ "/usr/sbin/newsyslog" ], - "entity_id": "2c596a05-d358-406e-924c-bf221088f43c-71559-1096716", + "entity_id": "bb043b0c-36d1-4054-81ed-2d3f4546a433-71559-1096716", "executable": "/usr/sbin/newsyslog", "name": "newsyslog", "parent": { diff --git a/packages/santa/img/kibana-santa-log-overview.png b/packages/santa/img/kibana-santa-log-overview.png index 31abdeb270a..bc427ec37a4 100644 Binary files a/packages/santa/img/kibana-santa-log-overview.png and b/packages/santa/img/kibana-santa-log-overview.png differ diff --git a/packages/santa/kibana/dashboard/santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307.json b/packages/santa/kibana/dashboard/santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307.json index d502b6edaea..c6a3b1da2b2 100644 --- a/packages/santa/kibana/dashboard/santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307.json +++ b/packages/santa/kibana/dashboard/santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307.json @@ -1,483 +1,957 @@ { - "id": "santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-23T06:23:56.756Z", - "version": "WzU3OSwxXQ==", - "attributes": { - "description": "Process executions on macOS monitored by Google Santa.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "data_stream.dataset:santa.log" - } - } - }, - "optionsJSON": { - "darkTheme": false, - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Description [Logs Santa]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 12, - "markdown": "![Santa Icon](https://raw.githubusercontent.com/google/santa/main/Source/santa/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png)\n\nGoogle Santa is a binary whitelisting/blacklisting system for macOS that monitors process executions.", - "openLinksInNewTab": false - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { + "attributes": { + "description": "Process executions on macOS monitored by Google Santa.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 12, - "i": "1", - "w": 10, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Decisions [Logs Santa]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "filter": { - "language": "kuery", - "query": "(data_stream.dataset:santa.log)" - }, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "auto", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "label": "Decision", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "![Santa Icon](https://raw.githubusercontent.com/google/santa/main/Source/gui/Resources/Images.xcassets/AppIcon.appiconset/santa-hat-icon-128.png) \nGoogle Santa is a binary whitelisting/blacklisting system for macOS that monitors process executions.", + "openLinksInNewTab": false + }, + "title": "Description [Logs Santa]", + "type": "markdown", + "uiState": {} } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "terms", - "stacked": "none", - "terms_field": "santa.decision" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false, - "drop_last_bucket": 1 + }, + "gridData": { + "h": 12, + "i": "1", + "w": 10, + "x": 0, + "y": 0 + }, + "panelIndex": "1", + "type": "visualization", + "version": "8.7.1" }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } - }, - "gridData": { - "h": 12, - "i": "2", - "w": 38, - "x": 10, - "y": 0 - }, - "panelIndex": "2", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Total Events [Logs Santa]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true + { + "embeddableConfig": { + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "1e5f57c7-cf23-462e-9058-3d079856a04f": { + "columnOrder": [ + "8c6419ed-2287-4619-a0e3-847ad5e61175", + "29ab69b4-68bb-47ba-99a6-67a74c0cdc95", + "95603840-cd5a-4c8b-8ff7-c690bd9518e9" + ], + "columns": { + "29ab69b4-68bb-47ba-99a6-67a74c0cdc95": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "8c6419ed-2287-4619-a0e3-847ad5e61175": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of santa.decision", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "santa.decision" + }, + "95603840-cd5a-4c8b-8ff7-c690bd9518e9": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Decision", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "tsvb_ad_hoc_logs-*/@timestamp", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-1e5f57c7-cf23-462e-9058-3d079856a04f", + "type": "index-pattern" + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "95603840-cd5a-4c8b-8ff7-c690bd9518e9" + ], + "layerId": "1e5f57c7-cf23-462e-9058-3d079856a04f", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "splitAccessor": "8c6419ed-2287-4619-a0e3-847ad5e61175", + "xAccessor": "29ab69b4-68bb-47ba-99a6-67a74c0cdc95", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "95603840-cd5a-4c8b-8ff7-c690bd9518e9" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } + }, + "title": "Decisions [Logs Santa] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" + "gridData": { + "h": 12, + "i": "2", + "w": 38, + "x": 10, + "y": 0 }, - "useRanges": false - }, - "type": "metric" + "panelIndex": "2", + "title": "Decisions [Logs Santa]", + "type": "lens", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Total Events" - }, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 10, - "i": "3", - "w": 10, - "x": 8, - "y": 12 - }, - "panelIndex": "3", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Decision and Reason [Logs Santa]", - "description": "", - "uiState": { - "vis": { - "colors": { - "ALLOW": "#7EB26D" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-23d3243e-20de-43c3-9eb0-ff92b0137cfb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "839e3cdf-81a6-4e53-bc36-54b1a00c2625", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "23d3243e-20de-43c3-9eb0-ff92b0137cfb": { + "columnOrder": [ + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8c", + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX0", + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX1" + ], + "columns": { + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Events", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX1" + ], + "scale": "ratio" + }, + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Total Events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Total Events", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8cX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "839e3cdf-81a6-4e53-bc36-54b1a00c2625", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "23d3243e-20de-43c3-9eb0-ff92b0137cfb", + "layerType": "data", + "metricAccessor": "0aebdc17-d2e4-4bd0-955e-6c1b0631cc8c" + } + }, + "title": "Total Events [Logs Santa] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "3", + "w": 10, + "x": 8, + "y": 12 + }, + "panelIndex": "3", + "title": "Total Events [Logs Santa]", + "type": "lens", + "version": "8.7.1" }, - "params": { - "addLegend": true, - "addTooltip": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "type": "pie", - "palette": { - "type": "palette", - "name": "kibana_palette" - }, - "distinctColors": true + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cbf341b6-8bf6-4938-b30a-5a44fd01c4ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45404203-e58f-484c-a7cb-c6172b5fa6ea", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cbf341b6-8bf6-4938-b30a-5a44fd01c4ad": { + "columnOrder": [ + "0dfca898-8d10-424c-9702-0e6e2c873f97", + "51668f34-ef8d-4dc5-ba81-fae7143f4be3", + "51719a84-e765-46a9-999e-a951fc0bf5ee" + ], + "columns": { + "0dfca898-8d10-424c-9702-0e6e2c873f97": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Decision", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "51719a84-e765-46a9-999e-a951fc0bf5ee", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "santa.decision" + }, + "51668f34-ef8d-4dc5-ba81-fae7143f4be3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Reason", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "51719a84-e765-46a9-999e-a951fc0bf5ee", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "santa.reason" + }, + "51719a84-e765-46a9-999e-a951fc0bf5ee": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "45404203-e58f-484c-a7cb-c6172b5fa6ea", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "cbf341b6-8bf6-4938-b30a-5a44fd01c4ad", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "51719a84-e765-46a9-999e-a951fc0bf5ee" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "0dfca898-8d10-424c-9702-0e6e2c873f97", + "51668f34-ef8d-4dc5-ba81-fae7143f4be3" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Decision and Reason [Logs Santa] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "4", + "w": 12, + "x": 36, + "y": 12 + }, + "panelIndex": "4", + "title": "Decision and Reason [Logs Santa]", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-729a2363-ab48-4f10-94dd-df1aebd6ef99", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5ac54720-1ca9-4c91-b838-c6b4bcfc10c4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "729a2363-ab48-4f10-94dd-df1aebd6ef99": { + "columnOrder": [ + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3", + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X0", + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X1" + ], + "columns": { + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts Reporting", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(agent.name), 0)", + "isFormulaBroken": false + }, + "references": [ + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X1" + ], + "scale": "ratio" + }, + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts Reporting", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "agent.name" + }, + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Hosts Reporting", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X0", + 0 + ], + "location": { + "max": 37, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(agent.name), 0)", + "type": "function" + } + }, + "references": [ + "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "5ac54720-1ca9-4c91-b838-c6b4bcfc10c4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "729a2363-ab48-4f10-94dd-df1aebd6ef99", + "layerType": "data", + "metricAccessor": "8a7d78dd-a341-4ca4-9223-a7ff9e66f0d3" + } + }, + "title": "Num of Hosts Reporting [Logs Santa] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Decision", - "field": "santa.decision", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 10, + "i": "5", + "w": 8, + "x": 0, + "y": 12 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Reason", - "field": "santa.reason", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 10, - "i": "4", - "w": 12, - "x": 36, - "y": 12 - }, - "panelIndex": "4", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Num of Hosts Reporting [Logs Santa]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true + "panelIndex": "5", + "title": "Num of Hosts Reporting [Logs Santa]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" + "gridData": { + "h": 21, + "i": "7", + "w": 48, + "x": 0, + "y": 22 }, - "useRanges": false - }, - "type": "metric" + "panelIndex": "7", + "panelRefName": "panel_7", + "type": "search", + "version": "8.7.1" }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Hosts Reporting", - "field": "agent.name" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-57f0950c-196e-4ef3-b26c-7b9ca8d0e45e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "56c82fca-000d-4812-892a-f9ccc7320545", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "57f0950c-196e-4ef3-b26c-7b9ca8d0e45e": { + "columnOrder": [ + "2b52401f-bae4-4a3a-a517-a0db54befed7", + "51a63333-b5de-4d4f-a63a-d2d15d79417f" + ], + "columns": { + "2b52401f-bae4-4a3a-a517-a0db54befed7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Certificate", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "51a63333-b5de-4d4f-a63a-d2d15d79417f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "santa.certificate.common_name" + }, + "51a63333-b5de-4d4f-a63a-d2d15d79417f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "index": "56c82fca-000d-4812-892a-f9ccc7320545", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "51a63333-b5de-4d4f-a63a-d2d15d79417f", + "isTransposed": false + }, + { + "columnId": "2b52401f-bae4-4a3a-a517-a0db54befed7", + "isTransposed": false + } + ], + "layerId": "57f0950c-196e-4ef3-b26c-7b9ca8d0e45e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "736aadf9-b3e2-4ae7-8df0-cb3e3f8060d9", + "w": 18, + "x": 18, + "y": 12 + }, + "panelIndex": "736aadf9-b3e2-4ae7-8df0-cb3e3f8060d9", + "title": "Code Signers [Logs Santa]", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Santa] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T07:38:56.297Z", + "id": "santa-161855f0-ff6a-11e8-93c5-d5ecd1b3e307", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-23d3243e-20de-43c3-9eb0-ff92b0137cfb", + "type": "index-pattern" }, - "gridData": { - "h": 10, - "i": "5", - "w": 8, - "x": 0, - "y": 12 + { + "id": "logs-*", + "name": "3:839e3cdf-81a6-4e53-bc36-54b1a00c2625", + "type": "index-pattern" }, - "panelIndex": "5", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Code Signers [Logs Santa]", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 39, - "minFontSize": 12, - "orientation": "single", - "scale": "linear", - "showLabel": true, - "palette": { - "type": "palette", - "name": "kibana_palette" - } - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "santa.certificate.common_name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-cbf341b6-8bf6-4938-b30a-5a44fd01c4ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4:45404203-e58f-484c-a7cb-c6172b5fa6ea", + "type": "index-pattern" }, - "gridData": { - "h": 10, - "i": "6", - "w": 18, - "x": 18, - "y": 12 + { + "id": "logs-*", + "name": "5:indexpattern-datasource-layer-729a2363-ab48-4f10-94dd-df1aebd6ef99", + "type": "index-pattern" }, - "panelIndex": "6", - "version": "8.0.0", - "type": "visualization" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "5:5ac54720-1ca9-4c91-b838-c6b4bcfc10c4", + "type": "index-pattern" }, - "gridData": { - "h": 10, - "i": "7", - "w": 48, - "x": 0, - "y": 22 + { + "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307", + "name": "7:panel_7", + "type": "search" }, - "panelIndex": "7", - "panelRefName": "panel_6", - "version": "7.0.0-alpha1-SNAPSHOT" - } + { + "id": "logs-*", + "name": "736aadf9-b3e2-4ae7-8df0-cb3e3f8060d9:indexpattern-datasource-layer-57f0950c-196e-4ef3-b26c-7b9ca8d0e45e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "736aadf9-b3e2-4ae7-8df0-cb3e3f8060d9:56c82fca-000d-4812-892a-f9ccc7320545", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Santa] Overview", - "version": 1 - }, - "references": [ - { - "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307", - "name": "panel_6", - "type": "search" - }, - { - "type": "search", - "name": "3:search_0", - "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307" - }, - { - "type": "search", - "name": "4:search_0", - "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307" - }, - { - "type": "search", - "name": "5:search_0", - "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307" - }, - { - "type": "search", - "name": "6:search_0", - "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/santa/kibana/search/santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307.json b/packages/santa/kibana/search/santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307.json index a99704119e9..221c7eec75f 100644 --- a/packages/santa/kibana/search/santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307.json +++ b/packages/santa/kibana/search/santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307.json @@ -7,10 +7,36 @@ "santa.certificate.common_name" ], "description": "", + "grid": {}, + "hideChart": false, "hits": 0, + "isTextBasedQuery": false, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [], + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "santa.log" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "santa.log" + } + } + } + ], "highlightAll": true, "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", "query": { @@ -26,16 +52,17 @@ "desc" ] ], + "timeRestore": false, "title": "Santa Logs Search [Logs Santa]", + "usesAdHocDataView": false, "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T07:26:05.541Z", "id": "santa-6d56a010-ff6a-11e8-93c5-d5ecd1b3e307", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, - "namespaces": [ - "default" - ], "references": [ { "id": "logs-*", @@ -46,11 +73,6 @@ "id": "logs-*", "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" } ], "type": "search" diff --git a/packages/santa/kibana/tags.yml b/packages/santa/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/santa/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/santa/manifest.yml b/packages/santa/manifest.yml index 8476dd7e6ae..5cc70329410 100644 --- a/packages/santa/manifest.yml +++ b/packages/santa/manifest.yml @@ -1,19 +1,18 @@ name: santa title: Google Santa -version: "3.8.0" -release: ga +version: "3.13.0" description: Collect logs from Google Santa with Elastic Agent. type: integration icons: - src: /img/icon.svg title: Google Santa type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: - security conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - src: /img/kibana-santa-log-overview.png title: kibana santa log overview @@ -29,3 +28,4 @@ policy_templates: description: "Collecting application logs from Google Santa instances (input: logfile)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/security_detection_engine/changelog.yml b/packages/security_detection_engine/changelog.yml index 93d07787f5f..78fe3349bdb 100644 --- a/packages/security_detection_engine/changelog.yml +++ b/packages/security_detection_engine/changelog.yml @@ -1,5 +1,80 @@ # newer versions go on top # NOTE: please use pre-release versions (e.g. -beta.0) until a package is ready for production +- version: 8.10.3 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7869 +- version: 8.10.3-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7857 +- version: 8.10.2 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7700 +- version: 8.10.2-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7686 +- version: 8.10.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7457 +- version: 8.10.1-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7450 +- version: 8.9.3 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7227 +- version: 8.9.3-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/7223 +- version: 8.9.2 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6957 +- version: 8.9.2-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6956 +- version: 8.8.7 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6955 +- version: 8.8.7-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6953 +- version: 8.7.9 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6951 +- version: 8.7.9-beta.1 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6940 +- version: 8.6.9 + changes: + - description: Release security rules update + type: enhancement + link: https://github.com/elastic/integrations/pull/6937 - version: 8.9.1 changes: - description: Release security rules update diff --git a/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_104.json b/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_104.json new file mode 100644 index 00000000000..f78e4205b3b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Modify an Okta Policy Rule", + "note": "## Triage and analysis\n\n### Investigating Attempt to Modify an Okta Policy Rule\n\nThe modification of an Okta policy rule can be an indication of malicious activity as it may aim to weaken an organization's security controls.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the modification attempt.\n- Check the `okta.outcome.result` field to confirm the rule modification attempt.\n- Check if there are multiple rule modification attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the modification attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized modification is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.rule.update\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_105.json b/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_105.json new file mode 100644 index 00000000000..e269ccf5f95 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/000047bb-b27a-47ec-8b62-ef1a5d2c9e19_105.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to modify a rule within an Okta policy. An adversary may attempt to modify an Okta policy rule in order to weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Modify an Okta Policy Rule", + "note": "## Triage and analysis\n\n### Investigating Attempt to Modify an Okta Policy Rule\n\nThe modification of an Okta policy rule can be an indication of malicious activity as it may aim to weaken an organization's security controls.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the modification attempt.\n- Check the `okta.outcome.result` field to confirm the rule modification attempt.\n- Check if there are multiple rule modification attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the modification attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized modification is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.rule.update\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "000047bb-b27a-47ec-8b62-ef1a5d2c9e19_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/00140285-b827-4aee-aa09-8113f58a08f3_108.json b/packages/security_detection_engine/kibana/security_rule/00140285-b827-4aee-aa09-8113f58a08f3_108.json new file mode 100644 index 00000000000..7e461f17a35 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/00140285-b827-4aee-aa09-8113f58a08f3_108.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of known Windows utilities often abused to dump LSASS memory or the Active Directory database (NTDS.dit) in preparation for credential access.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*", + "logs-system.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via Windows Utilities", + "note": "## Triage and analysis\n\n### Investigating Potential Credential Access via Windows Utilities\n\nLocal Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.\n\nThe `Ntds.dit` file is a database that stores Active Directory data, including information about user objects, groups, and group membership.\n\nThis rule looks for the execution of utilities that can extract credential data from the LSASS memory and Active Directory `Ntds.dit` file.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to identify what information was targeted.\n- Identify the target computer and its role in the IT environment.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If the host is a domain controller (DC):\n - Activate your incident response plan for total Active Directory compromise.\n - Review the privileges assigned to users that can access the DCs, to ensure that the least privilege principle is being followed and to reduce the attack surface.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n (process.pe.original_file_name : \"procdump\" or process.name : \"procdump.exe\") and process.args : \"-ma\"\n ) or\n (\n process.name : \"ProcessDump.exe\" and not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Cisco Systems\\\\.*\"\"\"\n ) or\n (\n (process.pe.original_file_name : \"WriteMiniDump.exe\" or process.name : \"WriteMiniDump.exe\") and\n not process.parent.executable regex~ \"\"\"C:\\\\Program Files( \\(x86\\))?\\\\Steam\\\\.*\"\"\"\n ) or\n (\n (process.pe.original_file_name : \"RUNDLL32.EXE\" or process.name : \"RUNDLL32.exe\") and\n (process.args : \"MiniDump*\" or process.command_line : \"*comsvcs.dll*#24*\")\n ) or\n (\n (process.pe.original_file_name : \"RdrLeakDiag.exe\" or process.name : \"RdrLeakDiag.exe\") and\n process.args : \"/fullmemdmp\"\n ) or\n (\n (process.pe.original_file_name : \"SqlDumper.exe\" or process.name : \"SqlDumper.exe\") and\n process.args : \"0x01100*\") or\n (\n (process.pe.original_file_name : \"TTTracer.exe\" or process.name : \"TTTracer.exe\") and\n process.args : \"-dumpFull\" and process.args : \"-attach\") or\n (\n (process.pe.original_file_name : \"ntdsutil.exe\" or process.name : \"ntdsutil.exe\") and\n process.args : \"create*full*\") or\n (\n (process.pe.original_file_name : \"diskshadow.exe\" or process.name : \"diskshadow.exe\") and process.args : \"/s\")\n)\n", + "references": [ + "https://lolbas-project.github.io/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "00140285-b827-4aee-aa09-8113f58a08f3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + }, + { + "id": "T1003.003", + "name": "NTDS", + "reference": "https://attack.mitre.org/techniques/T1003/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "00140285-b827-4aee-aa09-8113f58a08f3_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0022d47d-39c7-4f69-a232-4fe9dc7a3acd_107.json b/packages/security_detection_engine/kibana/security_rule/0022d47d-39c7-4f69-a232-4fe9dc7a3acd_107.json new file mode 100644 index 00000000000..06b98274fa9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0022d47d-39c7-4f69-a232-4fe9dc7a3acd_107.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Windows services typically run as SYSTEM and can be used as a privilege escalation opportunity. Malware or penetration testers may run a shell as a service to gain SYSTEM permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Shells via Services", + "note": "## Triage and analysis\n\n### Investigating System Shells via Services\n\nAttackers may configure existing services or create new ones to execute system shells to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these shells with persistence payloads.\n\nThis rule looks for system shells being spawned by `services.exe`, which is compatible with the above behavior.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).\n - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Check for commands executed under the spawned shell.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service or restore it to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"services.exe\" and\n process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n\n /* Third party FP's */\n not process.args : \"NVDisplay.ContainerLocalSystem\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "0022d47d-39c7-4f69-a232-4fe9dc7a3acd_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_1.json b/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_1.json new file mode 100644 index 00000000000..3133587aaf4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_1.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Network Scan Detected", + "query": "destination.port :* and event.action: (\"network_flow\" or \"connection_accepted\" or \"connection_attempted\" )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0171f283-ade7-4f87-9521-ac346c68cc9b", + "severity": "medium", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.port", + "value": 20 + } + ], + "field": [ + "destination.ip", + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 1 + }, + "id": "0171f283-ade7-4f87-9521-ac346c68cc9b_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_2.json b/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_2.json new file mode 100644 index 00000000000..9ab37a0e545 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0171f283-ade7-4f87-9521-ac346c68cc9b_2.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential port scan. A port scan is a method utilized by attackers to systematically scan a target system or network for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system or network. This rule proposes threshold logic to check for connection attempts from one source host to 20 or more destination ports.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Network Scan Detected", + "query": "destination.port : * and event.action : \"network_flow\" and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 21, + "rule_id": "0171f283-ade7-4f87-9521-ac346c68cc9b", + "severity": "low", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.port", + "value": 250 + } + ], + "field": [ + "destination.ip", + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 2 + }, + "id": "0171f283-ade7-4f87-9521-ac346c68cc9b_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/027ff9ea-85e7-42e3-99d2-bbb7069e02eb_103.json b/packages/security_detection_engine/kibana/security_rule/027ff9ea-85e7-42e3-99d2-bbb7069e02eb_103.json new file mode 100644 index 00000000000..777d6f46a6f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/027ff9ea-85e7-42e3-99d2-bbb7069e02eb_103.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a Chromium based browser with the debugging process argument, which may indicate an attempt to steal authentication cookies. An adversary may steal web application or service session cookies and use them to gain access web applications or Internet services as an authenticated user without needing credentials.", + "false_positives": [ + "Developers performing browsers plugin or extension debugging." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Potential Cookies Theft via Browser Debugging", + "note": "", + "query": "process where event.type in (\"start\", \"process_started\", \"info\") and\n process.name in (\n \"Microsoft Edge\",\n \"chrome.exe\",\n \"Google Chrome\",\n \"google-chrome-stable\",\n \"google-chrome-beta\",\n \"google-chrome\",\n \"msedge.exe\") and\n process.args : (\"--remote-debugging-port=*\",\n \"--remote-debugging-targets=*\",\n \"--remote-debugging-pipe=*\") and\n process.args : \"--user-data-dir=*\" and not process.args:\"--remote-debugging-port=0\"\n", + "references": [ + "https://github.com/defaultnamehere/cookie_crimes", + "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/", + "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/post/multi/gather/chrome_cookies.md", + "https://posts.specterops.io/hands-in-the-cookie-jar-dumping-cookies-with-chromiums-remote-debugger-port-34c4f468844e" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "027ff9ea-85e7-42e3-99d2-bbb7069e02eb", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: Windows", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1539", + "name": "Steal Web Session Cookie", + "reference": "https://attack.mitre.org/techniques/T1539/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "027ff9ea-85e7-42e3-99d2-bbb7069e02eb_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/02a23ee7-c8f8-4701-b99d-e9038ce313cb_5.json b/packages/security_detection_engine/kibana/security_rule/02a23ee7-c8f8-4701-b99d-e9038ce313cb_5.json new file mode 100644 index 00000000000..397301722f1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/02a23ee7-c8f8-4701-b99d-e9038ce313cb_5.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a process running as SYSTEM and impersonating a Windows core binary privileges. Adversaries may create a new process with a different token to escalate privileges and bypass access controls.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Created with an Elevated Token", + "query": "/* This rule is only compatible with Elastic Endpoint 8.4+ */\n\nprocess where host.os.type == \"windows\" and event.action == \"start\" and\n\n /* CreateProcessWithToken and effective parent is a privileged MS native binary used as a target for token theft */\n user.id : \"S-1-5-18\" and\n\n /* Token Theft target process usually running as service are located in one of the following paths */\n process.Ext.effective_parent.executable :\n (\"?:\\\\Windows\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\ProgramData\\\\*\") and\n\n/* Ignores Utility Manager in Windows running in debug mode */\n not (process.Ext.effective_parent.executable : \"?:\\\\Windows\\\\System32\\\\Utilman.exe\" and\n process.parent.executable : \"?:\\\\Windows\\\\System32\\\\Utilman.exe\" and process.parent.args : \"/debug\") and\n\n/* Ignores Windows print spooler service with correlation to Access Intelligent Form */\nnot (process.parent.executable : \"?\\\\Windows\\\\System32\\\\spoolsv.exe\" and\n process.executable: \"?:\\\\Program Files*\\\\Access\\\\Intelligent Form\\\\*\\\\LaunchCreate.exe\") and \n\n/* Ignores Windows error reporting executables */\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFaultSecure.exe\",\n \"?:\\\\windows\\\\system32\\\\WerMgr.exe\",\n \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\Install\\\\securityhealthsetup.exe\") and\n\n /* Ignores Windows updates from TiWorker.exe that runs with elevated privileges */\n not (process.parent.executable : \"?:\\\\Windows\\\\WinSxS\\\\*\\\\TiWorker.exe\" and\n process.executable : (\"?:\\\\Windows\\\\Microsoft.NET\\\\Framework*.exe\",\n \"?:\\\\Windows\\\\WinSxS\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\iissetup.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\inetsrv\\\\iissetup.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\aspnetca.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\inetsrv\\\\aspnetca.exe\",\n \"?:\\\\Windows\\\\System32\\\\lodctr.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\lodctr.exe\",\n \"?:\\\\Windows\\\\System32\\\\netcfg.exe\",\n \"?:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\*\\\\ngen.exe\",\n \"?:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\*\\\\aspnet_regiis.exe\")) and\n\n\n/* Ignores additional parent executables that run with elevated privileges */\n not process.parent.executable : \n (\"?:\\\\Windows\\\\System32\\\\AtBroker.exe\", \n \"?:\\\\Windows\\\\system32\\\\svchost.exe\", \n \"?:\\\\Program Files (x86)\\\\*.exe\", \n \"?:\\\\Program Files\\\\*.exe\", \n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\System32\\\\DriverStore\\\\*\") and\n\n/* Ignores Windows binaries with a trusted signature and specific signature name */\n not (process.code_signature.trusted == true and\n process.code_signature.subject_name : \n (\"philandro Software GmbH\", \n \"Freedom Scientific Inc.\", \n \"TeamViewer Germany GmbH\", \n \"Projector.is, Inc.\", \n \"TeamViewer GmbH\", \n \"Cisco WebEx LLC\", \n \"Dell Inc\"))\n", + "references": [ + "https://lengjibo.github.io/token/", + "https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithtokenw" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.effective_parent.executable", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "02a23ee7-c8f8-4701-b99d-e9038ce313cb", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1134", + "name": "Access Token Manipulation", + "reference": "https://attack.mitre.org/techniques/T1134/", + "subtechnique": [ + { + "id": "T1134.002", + "name": "Create Process with Token", + "reference": "https://attack.mitre.org/techniques/T1134/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "02a23ee7-c8f8-4701-b99d-e9038ce313cb_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/02a4576a-7480-4284-9327-548a806b5e48_206.json b/packages/security_detection_engine/kibana/security_rule/02a4576a-7480-4284-9327-548a806b5e48_206.json new file mode 100644 index 00000000000..500c9612ba8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/02a4576a-7480-4284-9327-548a806b5e48_206.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious access to an LSASS handle via DuplicateHandle from an unknown call trace module. This may indicate an attempt to bypass the NtOpenProcess API to evade detection and dump LSASS memory for credential access.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via DuplicateHandle in LSASS", + "note": "", + "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n\n /* LSASS requesting DuplicateHandle access right to another process */\n process.name : \"lsass.exe\" and winlog.event_data.GrantedAccess == \"0x40\" and\n\n /* call is coming from an unknown executable region */\n winlog.event_data.CallTrace : \"*UNKNOWN*\"\n", + "references": [ + "https://github.com/CCob/MirrorDump" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.GrantedAccess", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "02a4576a-7480-4284-9327-548a806b5e48", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 206 + }, + "id": "02a4576a-7480-4284-9327-548a806b5e48_206", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/02ea4563-ec10-4974-b7de-12e65aa4f9b3_104.json b/packages/security_detection_engine/kibana/security_rule/02ea4563-ec10-4974-b7de-12e65aa4f9b3_104.json new file mode 100644 index 00000000000..e9fa702f66e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/02ea4563-ec10-4974-b7de-12e65aa4f9b3_104.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of macOS built-in commands used to dump user account hashes. Adversaries may attempt to dump credentials to obtain account login information in the form of a hash. These hashes can be cracked or leveraged for lateral movement.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Dumping Account Hashes via Built-In Commands", + "query": "event.category:process and host.os.type:macos and event.type:start and\n process.name:(defaults or mkpassdb) and process.args:(ShadowHashData or \"-dump\")\n", + "references": [ + "https://apple.stackexchange.com/questions/186893/os-x-10-9-where-are-password-hashes-stored", + "https://www.unix.com/man-page/osx/8/mkpassdb/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "02ea4563-ec10-4974-b7de-12e65aa4f9b3", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "02ea4563-ec10-4974-b7de-12e65aa4f9b3_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/035889c4-2686-4583-a7df-67f89c292f2c_106.json b/packages/security_detection_engine/kibana/security_rule/035889c4-2686-4583-a7df-67f89c292f2c_106.json new file mode 100644 index 00000000000..854eecf6da1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/035889c4-2686-4583-a7df-67f89c292f2c_106.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a high number (10) of process terminations (stop, delete, or suspend) from the same host within a short time period.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "High Number of Process and/or Service Terminations", + "note": "## Triage and analysis\n\n### Investigating High Number of Process and/or Service Terminations\n\nAttackers can stop services and kill processes for a variety of purposes. For example, they can stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted, or stop security and backup solutions, etc.\n\nThis rule identifies a high number (10) of service and/or process terminations (stop, delete, or suspend) from the same host within a short time period.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check if any files on the host machine have been encrypted.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system or restore it to the operational state.\n- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:windows and event.type:start and process.name:(net.exe or sc.exe or taskkill.exe) and\n process.args:(stop or pause or delete or \"/PID\" or \"/IM\" or \"/T\" or \"/F\" or \"/t\" or \"/f\" or \"/im\" or \"/pid\") and\n not process.parent.name:osquerybeat.exe\n", + "references": [ + "https://www.elastic.co/security-labs/luna-ransomware-attack-pattern" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "035889c4-2686-4583-a7df-67f89c292f2c", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "threshold": { + "field": [ + "host.id" + ], + "value": 10 + }, + "type": "threshold", + "version": 106 + }, + "id": "035889c4-2686-4583-a7df-67f89c292f2c_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0415f22a-2336-45fa-ba07-618a5942e22c_105.json b/packages/security_detection_engine/kibana/security_rule/0415f22a-2336-45fa-ba07-618a5942e22c_105.json new file mode 100644 index 00000000000..fae3430f477 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0415f22a-2336-45fa-ba07-618a5942e22c_105.json @@ -0,0 +1,146 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may modify SSH related binaries for persistence or credential access by patching sensitive functions to enable unauthorized access or by logging SSH credentials for exfiltration.", + "false_positives": [ + "Trusted OpenSSH executable updates. It's recommended to verify the integrity of OpenSSH binary changes." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of OpenSSH Binaries", + "query": "event.category:file and host.os.type:linux and event.type:change and \n process.name:(* and not (dnf or dnf-automatic or dpkg or yum or rpm or yum-cron or anacron)) and \n (file.path:(/usr/bin/scp or \n /usr/bin/sftp or \n /usr/bin/ssh or \n /usr/sbin/sshd) or \n file.name:libkeyutils.so)\n", + "references": [ + "https://blog.angelalonso.es/2016/09/anatomy-of-real-linux-intrusion-part-ii.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0415f22a-2336-45fa-ba07-618a5942e22c", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Persistence", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1556", + "name": "Modify Authentication Process", + "reference": "https://attack.mitre.org/techniques/T1556/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.004", + "name": "SSH", + "reference": "https://attack.mitre.org/techniques/T1021/004/" + } + ] + }, + { + "id": "T1563", + "name": "Remote Service Session Hijacking", + "reference": "https://attack.mitre.org/techniques/T1563/", + "subtechnique": [ + { + "id": "T1563.001", + "name": "SSH Hijacking", + "reference": "https://attack.mitre.org/techniques/T1563/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "0415f22a-2336-45fa-ba07-618a5942e22c_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/041d4d41-9589-43e2-ba13-5680af75ebc2_105.json b/packages/security_detection_engine/kibana/security_rule/041d4d41-9589-43e2-ba13-5680af75ebc2_105.json new file mode 100644 index 00000000000..f110195e925 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/041d4d41-9589-43e2-ba13-5680af75ebc2_105.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Iodine is a tool for tunneling Internet protocol version 4 (IPV4) traffic over the DNS protocol to circumvent firewalls, network security groups, and network access lists while evading detection.", + "false_positives": [ + "Normal use of Iodine is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Deprecated - Potential DNS Tunneling via Iodine", + "note": "This rule was deprecated due to its addition to the umbrella `Potential Linux Tunneling and/or Port Forwarding` (6ee947e9-de7e-4281-a55d-09289bdf947e) rule.", + "query": "event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:(iodine or iodined)\n", + "references": [ + "https://code.kryo.se/iodine/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "041d4d41-9589-43e2-ba13-5680af75ebc2", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "041d4d41-9589-43e2-ba13-5680af75ebc2_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/053a0387-f3b5-4ba5-8245-8002cca2bd08_106.json b/packages/security_detection_engine/kibana/security_rule/053a0387-f3b5-4ba5-8245-8002cca2bd08_106.json new file mode 100644 index 00000000000..c1d1f89418f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/053a0387-f3b5-4ba5-8245-8002cca2bd08_106.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Dennis Perto" + ], + "description": "Identifies a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of one of those processes.", + "false_positives": [ + "Microsoft Antimalware Service Executable installed on non default installation path." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential DLL Side-Loading via Microsoft Antimalware Service Executable", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (process.pe.original_file_name == \"MsMpEng.exe\" and not process.name : \"MsMpEng.exe\") or\n (process.name : \"MsMpEng.exe\" and not\n process.executable : (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Windows Defender\\\\*.exe\",\n \"?:\\\\Program Files\\\\Microsoft Security Client\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Security Client\\\\*.exe\"))\n)\n", + "references": [ + "https://news.sophos.com/en-us/2021/07/04/independence-day-revil-uses-supply-chain-exploit-to-attack-hundreds-of-businesses/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "053a0387-f3b5-4ba5-8245-8002cca2bd08", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.002", + "name": "DLL Side-Loading", + "reference": "https://attack.mitre.org/techniques/T1574/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "053a0387-f3b5-4ba5-8245-8002cca2bd08_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0564fb9d-90b9-4234-a411-82a546dc1343_106.json b/packages/security_detection_engine/kibana/security_rule/0564fb9d-90b9-4234-a411-82a546dc1343_106.json new file mode 100644 index 00000000000..6385c5dd257 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0564fb9d-90b9-4234-a411-82a546dc1343_106.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. An attacker with IIS web server access via a web shell can decrypt and dump the IIS AppPool service account password using AppCmd.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Microsoft IIS Service Account Password Dumped", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"appcmd.exe\" or process.pe.original_file_name == \"appcmd.exe\") and\n process.args : \"/list\" and process.args : \"/text*password\"\n", + "references": [ + "https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "0564fb9d-90b9-4234-a411-82a546dc1343", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "0564fb9d-90b9-4234-a411-82a546dc1343_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/05b358de-aa6d-4f6c-89e6-78f74018b43b_106.json b/packages/security_detection_engine/kibana/security_rule/05b358de-aa6d-4f6c-89e6-78f74018b43b_106.json new file mode 100644 index 00000000000..f7b53febe61 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/05b358de-aa6d-4f6c-89e6-78f74018b43b_106.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects when the Console Window Host (conhost.exe) process is spawned by a suspicious parent process, which could be indicative of code injection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Conhost Spawned By Suspicious Parent Process", + "note": "## Triage and analysis\n\n### Investigating Conhost Spawned By Suspicious Parent Process\n\nThe Windows Console Host, or `conhost.exe`, is both the server application for all of the Windows Console APIs as well as the classic Windows user interface for working with command-line applications.\n\nAttackers often rely on custom shell implementations to avoid using built-in command interpreters like `cmd.exe` and `PowerShell.exe` and bypass application allowlisting and security features. Attackers commonly inject these implementations into legitimate system processes.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Retrieve the parent process executable and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- Suspicious Process from Conhost - 28896382-7d4f-4d50-9b72-67091901fd26\n- Suspicious PowerShell Engine ImageLoad - 852c1f19-68e8-43a6-9dce-340771fe1be3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"conhost.exe\" and\n process.parent.name : (\"lsass.exe\", \"services.exe\", \"smss.exe\", \"winlogon.exe\", \"explorer.exe\", \"dllhost.exe\", \"rundll32.exe\",\n \"regsvr32.exe\", \"userinit.exe\", \"wininit.exe\", \"spoolsv.exe\", \"ctfmon.exe\") and\n not (process.parent.name : \"rundll32.exe\" and\n process.parent.args : (\"?:\\\\Windows\\\\Installer\\\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc\",\n \"?:\\\\WINDOWS\\\\system32\\\\PcaSvc.dll,PcaPatchSdbTask\",\n \"?:\\\\WINDOWS\\\\system32\\\\davclnt.dll,DavSetCookie\"))\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-one.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "05b358de-aa6d-4f6c-89e6-78f74018b43b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "05b358de-aa6d-4f6c-89e6-78f74018b43b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/05e5a668-7b51-4a67-93ab-e9af405c9ef3_105.json b/packages/security_detection_engine/kibana/security_rule/05e5a668-7b51-4a67-93ab-e9af405c9ef3_105.json new file mode 100644 index 00000000000..b3e8ebd73da --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/05e5a668-7b51-4a67-93ab-e9af405c9ef3_105.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a terminal (tty) is spawned via Perl. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Interactive Terminal Spawned via Perl", + "query": "event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:perl and\n process.args:(\"exec \\\"/bin/sh\\\";\" or \"exec \\\"/bin/dash\\\";\" or \"exec \\\"/bin/bash\\\";\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "05e5a668-7b51-4a67-93ab-e9af405c9ef3", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "05e5a668-7b51-4a67-93ab-e9af405c9ef3_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0635c542-1b96-4335-9b47-126582d2c19a_108.json b/packages/security_detection_engine/kibana/security_rule/0635c542-1b96-4335-9b47-126582d2c19a_108.json new file mode 100644 index 00000000000..0716a3da5f4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0635c542-1b96-4335-9b47-126582d2c19a_108.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Discovery of remote system information using built-in commands, which may be used to move laterally.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote System Discovery Commands", + "note": "## Triage and analysis\n\n### Investigating Remote System Discovery Commands\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `arp` or `nbstat` utilities to enumerate remote systems in the environment, which is useful for attackers to identify lateral movement targets.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n ((process.name : \"nbtstat.exe\" and process.args : (\"-n\", \"-s\")) or\n (process.name : \"arp.exe\" and process.args : \"-a\") or\n (process.name : \"nltest.exe\" and process.args : (\"/dclist\", \"/dsgetdc\")) or\n (process.name : \"nslookup.exe\" and process.args : \"*_ldap._tcp.dc.*\") or\n (process.name: (\"dsquery.exe\", \"dsget.exe\") and process.args: \"subnet\") or\n ((((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and not \n process.parent.name : \"net.exe\")) and \n process.args : \"group\" and process.args : \"/domain\" and not process.args : \"/add\")))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "0635c542-1b96-4335-9b47-126582d2c19a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1016", + "name": "System Network Configuration Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/" + }, + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "0635c542-1b96-4335-9b47-126582d2c19a_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/06568a02-af29-4f20-929c-f3af281e41aa_4.json b/packages/security_detection_engine/kibana/security_rule/06568a02-af29-4f20-929c-f3af281e41aa_4.json new file mode 100644 index 00000000000..d07984573d2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/06568a02-af29-4f20-929c-f3af281e41aa_4.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the usage of commonly used system time discovery techniques, which attackers may use during the reconnaissance phase after compromising a system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Time Discovery", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n ((process.name: \"net.exe\" or (process.name : \"net1.exe\" and not process.parent.name : \"net.exe\")) and process.args : \"time\") or \n (process.name: \"w32tm.exe\" and process.args: \"/tz\") or \n (process.name: \"tzutil.exe\" and process.args: \"/g\")\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "06568a02-af29-4f20-929c-f3af281e41aa", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1124", + "name": "System Time Discovery", + "reference": "https://attack.mitre.org/techniques/T1124/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "06568a02-af29-4f20-929c-f3af281e41aa_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_4.json b/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_4.json new file mode 100644 index 00000000000..83d602c92fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_4.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments.", + "false_positives": [ + "Domain administrators may use this command-line utility for legitimate information gathering purposes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumerating Domain Trusts via DSQUERY.EXE", + "note": "## Triage and analysis\n\n### Investigating Enumerating Domain Trusts via DSQUERY.EXE\n\nActive Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a \"trusting\" domain permits users from a \"trusted\" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.\n\nThis rule identifies the usage of the `dsquery.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- Enumerating Domain Trusts via NLTEST.EXE - 84da2554-e12a-11ec-b896-f661ea17fbcd\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"dsquery.exe\" or process.pe.original_file_name: \"dsquery.exe\") and \n process.args : \"*objectClass=trustedDomain*\"\n", + "references": [ + "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)", + "https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "06a7a03c-c735-47a6-a313-51c354aef6c3", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "06a7a03c-c735-47a6-a313-51c354aef6c3_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_5.json b/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_5.json new file mode 100644 index 00000000000..1e155615374 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/06a7a03c-c735-47a6-a313-51c354aef6c3_5.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of dsquery.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate trust relationships that may be used for Lateral Movement opportunities in Windows multi-domain forest environments.", + "false_positives": [ + "Domain administrators may use this command-line utility for legitimate information gathering purposes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumerating Domain Trusts via DSQUERY.EXE", + "note": "## Triage and analysis\n\n### Investigating Enumerating Domain Trusts via DSQUERY.EXE\n\nActive Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a \"trusting\" domain permits users from a \"trusted\" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.\n\nThis rule identifies the usage of the `dsquery.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- Enumerating Domain Trusts via NLTEST.EXE - 84da2554-e12a-11ec-b896-f661ea17fbcd\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"dsquery.exe\" or process.pe.original_file_name: \"dsquery.exe\") and \n process.args : \"*objectClass=trustedDomain*\"\n", + "references": [ + "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)", + "https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "06a7a03c-c735-47a6-a313-51c354aef6c3", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "06a7a03c-c735-47a6-a313-51c354aef6c3_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/06dceabf-adca-48af-ac79-ffdf4c3b1e9a_107.json b/packages/security_detection_engine/kibana/security_rule/06dceabf-adca-48af-ac79-ffdf4c3b1e9a_107.json new file mode 100644 index 00000000000..bd6632229d4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/06dceabf-adca-48af-ac79-ffdf4c3b1e9a_107.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The Filter Manager Control Program (fltMC.exe) binary may be abused by adversaries to unload a filter driver and evade defenses.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Evasion via Filter Manager", + "note": "## Triage and analysis\n\n### Investigating Potential Evasion via Filter Manager\n\nA file system filter driver, or minifilter, is a specialized type of filter driver designed to intercept and modify I/O requests sent to a file system or another filter driver. Minifilters are used by a wide range of security software, including EDR, antivirus, backup agents, encryption products, etc.\n\nAttackers may try to unload minifilters to avoid protections such as malware detection, file system monitoring, and behavior-based detections.\n\nThis rule identifies the attempt to unload a minifilter using the `fltmc.exe` command-line utility, a tool used to manage and query the filter drivers loaded on Windows systems.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Examine the command line event to identify the target driver.\n - Identify the minifilter's role in the environment and if it is security-related. Microsoft provides a [list](https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/allocated-altitudes) of allocated altitudes that may provide more context, such as the manufacturer.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for the action.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"fltMC.exe\" and process.args : \"unload\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "06dceabf-adca-48af-ac79-ffdf4c3b1e9a_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/074464f9-f30d-4029-8c03-0ed237fffec7_106.json b/packages/security_detection_engine/kibana/security_rule/074464f9-f30d-4029-8c03-0ed237fffec7_106.json new file mode 100644 index 00000000000..2a737a5cc02 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/074464f9-f30d-4029-8c03-0ed237fffec7_106.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the network shell utility (netsh.exe) to enable inbound Remote Desktop Protocol (RDP) connections in the Windows Firewall.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote Desktop Enabled in Windows Firewall by Netsh", + "note": "## Triage and analysis\n\n### Investigating Remote Desktop Enabled in Windows Firewall by Netsh\n\nMicrosoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.\n\nAttackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.\n\nThis rule detects the creation of a Windows Firewall inbound rule that would allow inbound RDP traffic using the `netsh.exe` utility.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the user to check if they are aware of the operation.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check whether it makes sense to enable RDP to this host, given its role in the environment.\n- Check if the host is directly exposed to the internet.\n- Check whether privileged accounts accessed the host shortly after the modification.\n- Review network events within a short timespan of this alert for incoming RDP connection attempts.\n\n### False positive analysis\n\n- The `netsh.exe` utility can be used legitimately. Check whether the user should be performing this kind of activity, whether the user is aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If RDP is needed, make sure to secure it:\n - Allowlist RDP traffic to specific trusted hosts.\n - Restrict RDP logins to authorized non-administrator accounts, where possible.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"netsh.exe\" or process.pe.original_file_name == \"netsh.exe\") and\n process.args : (\"localport=3389\", \"RemoteDesktop\", \"group=\\\"remote desktop\\\"\") and\n process.args : (\"action=allow\", \"enable=Yes\", \"enable\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "074464f9-f30d-4029-8c03-0ed237fffec7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.004", + "name": "Disable or Modify System Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "074464f9-f30d-4029-8c03-0ed237fffec7_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/07639887-da3a-4fbf-9532-8ce748ff8c50_1.json b/packages/security_detection_engine/kibana/security_rule/07639887-da3a-4fbf-9532-8ce748ff8c50_1.json new file mode 100644 index 00000000000..5d7c796a45f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/07639887-da3a-4fbf-9532-8ce748ff8c50_1.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects setting modifications for protected branches of a GitHub repository. Branch protection rules can be used to enforce certain workflows or requirements before a contributor can push changes to a branch in your repository. Changes to these protected branch settings should be investigated and verified as legitimate activity. Unauthorized changes could be used to lower your organization's security posture and leave you exposed for future attacks.", + "from": "now-9m", + "index": [ + "logs-github.audit-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "GitHub Protected Branch Settings Changed", + "query": "configuration where event.dataset == \"github.audit\" \n and github.category == \"protected_branch\" and event.type == \"change\" \n", + "related_integrations": [ + { + "package": "github", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "github.category", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "07639887-da3a-4fbf-9532-8ce748ff8c50", + "severity": "medium", + "tags": [ + "Domain: Cloud", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Github" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "07639887-da3a-4fbf-9532-8ce748ff8c50_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_1.json b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_1.json new file mode 100644 index 00000000000..615f3d6625e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_1.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Proc Pseudo File System Enumeration", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "host.os.type : \"linux\" and event.category : \"file\" and event.action : \"opened-file\" and \nfile.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.parent.pid : 1\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "medium", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "file.path", + "value": 25 + } + ], + "field": [ + "host.id", + "process.pid", + "process.name" + ], + "value": 1 + }, + "timestamp_override": "event.ingested", + "type": "threshold", + "version": 1 + }, + "id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_2.json b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_2.json new file mode 100644 index 00000000000..ab42f6d31b3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_2.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Proc Pseudo File System Enumeration", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "host.os.type : \"linux\" and event.category : \"file\" and event.action : \"opened-file\" and \nfile.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : \"pidof\" and \nnot process.parent.pid : 1\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + } + ], + "risk_score": 21, + "rule_id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "file.path", + "value": 100 + } + ], + "field": [ + "host.id", + "process.pid", + "process.name" + ], + "value": 1 + }, + "timestamp_override": "event.ingested", + "type": "threshold", + "version": 2 + }, + "id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_3.json b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_3.json new file mode 100644 index 00000000000..20384b20898 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0787daa6-f8c5-453b-a4ec-048037f6c1cd_3.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for a rapid enumeration of 25 different proc cmd, stat, and exe files, which suggests an abnormal activity pattern. Such behavior could be an indicator of a malicious process scanning or gathering information about running processes, potentially for reconnaissance, privilege escalation, or identifying vulnerable targets.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Proc Pseudo File System Enumeration", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "host.os.type : \"linux\" and event.category : \"file\" and event.action : \"opened-file\" and \nfile.path : (/proc/*/cmdline or /proc/*/stat or /proc/*/exe) and not process.name : \"pidof\" and \nnot process.parent.pid : 1\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + } + ], + "risk_score": 21, + "rule_id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "file.path", + "value": 100 + } + ], + "field": [ + "host.id", + "process.pid", + "process.name" + ], + "value": 1 + }, + "timestamp_override": "event.ingested", + "type": "threshold", + "version": 3 + }, + "id": "0787daa6-f8c5-453b-a4ec-048037f6c1cd_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/07b1ef73-1fde-4a49-a34a-5dd40011b076_5.json b/packages/security_detection_engine/kibana/security_rule/07b1ef73-1fde-4a49-a34a-5dd40011b076_5.json new file mode 100644 index 00000000000..13d709b977f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/07b1ef73-1fde-4a49-a34a-5dd40011b076_5.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies registry modification to the LocalAccountTokenFilterPolicy policy. If this value exists (which doesn't by default) and is set to 1, then remote connections from all local members of Administrators are granted full high-integrity tokens during negotiation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Local Account TokenFilter Policy Disabled", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\*\\\\LocalAccountTokenFilterPolicy\",\n \"\\\\REGISTRY\\\\MACHINE\\\\*\\\\LocalAccountTokenFilterPolicy\") and\n registry.data.strings : (\"1\", \"0x00000001\")\n", + "references": [ + "https://www.stigviewer.com/stig/windows_server_2008_r2_member_server/2014-04-02/finding/V-36439", + "https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167", + "https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "07b1ef73-1fde-4a49-a34a-5dd40011b076", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "07b1ef73-1fde-4a49-a34a-5dd40011b076_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/080bc66a-5d56-4d1f-8071-817671716db9_104.json b/packages/security_detection_engine/kibana/security_rule/080bc66a-5d56-4d1f-8071-817671716db9_104.json new file mode 100644 index 00000000000..7b438d8272a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/080bc66a-5d56-4d1f-8071-817671716db9_104.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a suspicious browser child process. Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Browser Child Process", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.parent.name : (\"Google Chrome\", \"Google Chrome Helper*\", \"firefox\", \"Opera\", \"Safari\", \"com.apple.WebKit.WebContent\", \"Microsoft Edge\") and\n process.name : (\"sh\", \"bash\", \"dash\", \"ksh\", \"tcsh\", \"zsh\", \"curl\", \"wget\", \"python*\", \"perl*\", \"php*\", \"osascript\", \"pwsh\") and\n process.command_line != null and\n not process.command_line : \"*/Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate*\" and\n not process.args :\n (\n \"hw.model\",\n \"IOPlatformExpertDevice\",\n \"/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh\",\n \"--defaults-torrc\",\n \"*Chrome.app\",\n \"Framework.framework/Versions/*/Resources/keystone_promote_preflight.sh\",\n \"/Users/*/Library/Application Support/Google/Chrome/recovery/*/ChromeRecovery\",\n \"$DISPLAY\",\n \"*GIO_LAUNCHED_DESKTOP_FILE_PID=$$*\",\n \"/opt/homebrew/*\",\n \"/usr/local/*brew*\"\n )\n", + "references": [ + "https://objective-see.com/blog/blog_0x43.html", + "https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "080bc66a-5d56-4d1f-8071-817671716db9", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1203", + "name": "Exploitation for Client Execution", + "reference": "https://attack.mitre.org/techniques/T1203/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1189", + "name": "Drive-by Compromise", + "reference": "https://attack.mitre.org/techniques/T1189/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "080bc66a-5d56-4d1f-8071-817671716db9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/082e3f8c-6f80-485c-91eb-5b112cb79b28_104.json b/packages/security_detection_engine/kibana/security_rule/082e3f8c-6f80-485c-91eb-5b112cb79b28_104.json new file mode 100644 index 00000000000..af5a303753f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/082e3f8c-6f80-485c-91eb-5b112cb79b28_104.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary can establish persistence by installing a new launch agent that executes at login by using launchd or launchctl to load a plist into the appropriate directories.", + "false_positives": [ + "Trusted applications persisting via LaunchAgent" + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Launch Agent Creation or Modification and Immediate Loading", + "query": "sequence by host.id with maxspan=1m\n [file where host.os.type == \"macos\" and event.type != \"deletion\" and\n file.path : (\"/System/Library/LaunchAgents/*\", \"/Library/LaunchAgents/*\", \"/Users/*/Library/LaunchAgents/*\")\n ]\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name == \"launchctl\" and process.args == \"load\"]\n", + "references": [ + "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "082e3f8c-6f80-485c-91eb-5b112cb79b28", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.001", + "name": "Launch Agent", + "reference": "https://attack.mitre.org/techniques/T1543/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "082e3f8c-6f80-485c-91eb-5b112cb79b28_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/083fa162-e790-4d85-9aeb-4fea04188adb_104.json b/packages/security_detection_engine/kibana/security_rule/083fa162-e790-4d85-9aeb-4fea04188adb_104.json new file mode 100644 index 00000000000..ddba9849d6b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/083fa162-e790-4d85-9aeb-4fea04188adb_104.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a launchd child process with a hidden file. An adversary can establish persistence by installing a new logon item, launch agent, or daemon that executes upon login.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Hidden Child Process of Launchd", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:.* and process.parent.executable:/sbin/launchd\n", + "references": [ + "https://objective-see.com/blog/blog_0x61.html", + "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/", + "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "083fa162-e790-4d85-9aeb-4fea04188adb", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.001", + "name": "Launch Agent", + "reference": "https://attack.mitre.org/techniques/T1543/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "083fa162-e790-4d85-9aeb-4fea04188adb_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_1.json b/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_1.json new file mode 100644 index 00000000000..c18bc65ad84 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_1.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "First Time Seen Removable Device", + "new_terms_fields": [ + "registry.path" + ], + "query": "event.category:\"registry\" and host.os.type:\"windows\" and registry.value:\"FriendlyName\" and registry.path:*USBSTOR*\n", + "references": [ + "https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html", + "https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.value", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "0859355c-0f08-4b43-8ff5-7d2a4789fc08", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Exfiltration", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1091", + "name": "Replication Through Removable Media", + "reference": "https://attack.mitre.org/techniques/T1091/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1052", + "name": "Exfiltration Over Physical Medium", + "reference": "https://attack.mitre.org/techniques/T1052/", + "subtechnique": [ + { + "id": "T1052.001", + "name": "Exfiltration over USB", + "reference": "https://attack.mitre.org/techniques/T1052/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 1 + }, + "id": "0859355c-0f08-4b43-8ff5-7d2a4789fc08_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_2.json b/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_2.json new file mode 100644 index 00000000000..bb2188037ff --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0859355c-0f08-4b43-8ff5-7d2a4789fc08_2.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies newly seen removable devices by device friendly name using registry modification events. While this activity is not inherently malicious, analysts can use those events to aid monitoring for data exfiltration over those devices.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "First Time Seen Removable Device", + "new_terms_fields": [ + "registry.path" + ], + "query": "event.category:\"registry\" and host.os.type:\"windows\" and registry.value:\"FriendlyName\" and registry.path:*USBSTOR*\n", + "references": [ + "https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/USB-storage.html", + "https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.value", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "0859355c-0f08-4b43-8ff5-7d2a4789fc08", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Exfiltration", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1091", + "name": "Replication Through Removable Media", + "reference": "https://attack.mitre.org/techniques/T1091/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1052", + "name": "Exfiltration Over Physical Medium", + "reference": "https://attack.mitre.org/techniques/T1052/", + "subtechnique": [ + { + "id": "T1052.001", + "name": "Exfiltration over USB", + "reference": "https://attack.mitre.org/techniques/T1052/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 2 + }, + "id": "0859355c-0f08-4b43-8ff5-7d2a4789fc08_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_1.json b/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_1.json new file mode 100644 index 00000000000..185d8f3e8fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_1.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Account or Group Discovery", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n (\n (process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n (\n (process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\"\n )\n ) and process.args : (\"group\", \"user\", \"localgroup\") and not process.args : \"/add\"\n ) or\n (process.name:(\"dsquery.exe\", \"dsget.exe\") and process.args:(\"*members*\", \"user\")) or\n (process.name:\"dsquery.exe\" and process.args:\"*filter*\") or\n process.name:(\"quser.exe\", \"qwinsta.exe\", \"PsGetSID.exe\", \"PsLoggedOn.exe\", \"LogonSessions.exe\", \"whoami.exe\") or\n (\n process.name: \"cmd.exe\" and\n (\n process.args : \"echo\" and process.args : (\n \"%username%\", \"%userdomain%\", \"%userdnsdomain%\",\n \"%userdomain_roamingprofile%\", \"%userprofile%\",\n \"%homepath%\", \"%localappdata%\", \"%appdata%\"\n ) or\n process.args : \"set\"\n )\n )\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "089db1af-740d-4d84-9a5b-babd6de143b0", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + }, + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "089db1af-740d-4d84-9a5b-babd6de143b0_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_2.json b/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_2.json new file mode 100644 index 00000000000..e9286828e7b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/089db1af-740d-4d84-9a5b-babd6de143b0_2.json @@ -0,0 +1,128 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that enumerates account or group information. Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Account or Group Discovery", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n (\n (process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n (\n (process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\"\n )\n ) and process.args : (\"accounts\", \"group\", \"user\", \"localgroup\") and not process.args : \"/add\"\n ) or\n (process.name:(\"dsquery.exe\", \"dsget.exe\") and process.args:(\"*members*\", \"user\")) or\n (process.name:\"dsquery.exe\" and process.args:\"*filter*\") or\n process.name:(\"quser.exe\", \"qwinsta.exe\", \"PsGetSID.exe\", \"PsLoggedOn.exe\", \"LogonSessions.exe\", \"whoami.exe\") or\n (\n process.name: \"cmd.exe\" and\n (\n process.args : \"echo\" and process.args : (\n \"%username%\", \"%userdomain%\", \"%userdnsdomain%\",\n \"%userdomain_roamingprofile%\", \"%userprofile%\",\n \"%homepath%\", \"%localappdata%\", \"%appdata%\"\n ) or\n process.args : \"set\"\n )\n )\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "089db1af-740d-4d84-9a5b-babd6de143b0", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + }, + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1201", + "name": "Password Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1201/" + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "089db1af-740d-4d84-9a5b-babd6de143b0_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/092b068f-84ac-485d-8a55-7dd9e006715f_104.json b/packages/security_detection_engine/kibana/security_rule/092b068f-84ac-485d-8a55-7dd9e006715f_104.json new file mode 100644 index 00000000000..24b15b9a911 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/092b068f-84ac-485d-8a55-7dd9e006715f_104.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a hidden launch agent or daemon. An adversary may establish persistence by installing a new launch agent or daemon which executes at login.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation of Hidden Launch Agent or Daemon", + "note": "", + "query": "file where host.os.type == \"macos\" and event.type != \"deletion\" and\n file.path :\n (\n \"/System/Library/LaunchAgents/.*.plist\",\n \"/Library/LaunchAgents/.*.plist\",\n \"/Users/*/Library/LaunchAgents/.*.plist\",\n \"/System/Library/LaunchDaemons/.*.plist\",\n \"/Library/LaunchDaemons/.*.plist\"\n )\n", + "references": [ + "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "092b068f-84ac-485d-8a55-7dd9e006715f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.001", + "name": "Launch Agent", + "reference": "https://attack.mitre.org/techniques/T1543/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "092b068f-84ac-485d-8a55-7dd9e006715f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_105.json b/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_105.json new file mode 100644 index 00000000000..03437346d50 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_105.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Termination followed by Deletion", + "note": "## Triage and analysis\n\n### Investigating Process Termination followed by Deletion\n\nThis rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately, as programs that exhibit this behavior, such as installers and similar utilities, should be signed. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id with maxspan=5s\n [process where host.os.type == \"windows\" and event.type == \"end\" and\n process.code_signature.trusted != true and\n not process.executable : (\"C:\\\\Windows\\\\SoftwareDistribution\\\\*.exe\", \"C:\\\\Windows\\\\WinSxS\\\\*.exe\")\n ] by process.executable\n [file where host.os.type == \"windows\" and event.type == \"deletion\" and file.extension : (\"exe\", \"scr\", \"com\") and\n not process.executable :\n (\"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\drvinst.exe\") and\n not file.path : (\"?:\\\\Program Files\\\\*.exe\", \"?:\\\\Program Files (x86)\\\\*.exe\")\n ] by file.path\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "09443c92-46b3-45a4-8f25-383b028b258d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "09443c92-46b3-45a4-8f25-383b028b258d_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_106.json b/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_106.json new file mode 100644 index 00000000000..bb5c07f11be --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/09443c92-46b3-45a4-8f25-383b028b258d_106.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a process termination event quickly followed by the deletion of its executable file. Malware tools and other non-native files dropped or created on a system by an adversary may leave traces to indicate to what occurred. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Termination followed by Deletion", + "note": "## Triage and analysis\n\n### Investigating Process Termination followed by Deletion\n\nThis rule identifies an unsigned process termination event quickly followed by the deletion of its executable file. Attackers can delete programs after their execution in an attempt to cover their tracks in a host.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately, as programs that exhibit this behavior, such as installers and similar utilities, should be signed. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id with maxspan=5s\n [process where host.os.type == \"windows\" and event.type == \"end\" and\n process.code_signature.trusted != true and\n not process.executable : (\"C:\\\\Windows\\\\SoftwareDistribution\\\\*.exe\", \"C:\\\\Windows\\\\WinSxS\\\\*.exe\")\n ] by process.executable\n [file where host.os.type == \"windows\" and event.type == \"deletion\" and file.extension : (\"exe\", \"scr\", \"com\") and\n not process.executable :\n (\"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\drvinst.exe\") and\n not file.path : (\"?:\\\\Program Files\\\\*.exe\", \"?:\\\\Program Files (x86)\\\\*.exe\")\n ] by file.path\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "09443c92-46b3-45a4-8f25-383b028b258d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "09443c92-46b3-45a4-8f25-383b028b258d_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/09bc6c90-7501-494d-b015-5d988dc3f233_1.json b/packages/security_detection_engine/kibana/security_rule/09bc6c90-7501-494d-b015-5d988dc3f233_1.json new file mode 100644 index 00000000000..d1e694a6394 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/09bc6c90-7501-494d-b015-5d988dc3f233_1.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the creation of a file, followed by its execution and self-deletion in a short timespan within a directory often used for malicious purposes by threat actors. This behavior is often used by malware to execute malicious code and delete itself to hide its tracks.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "File Creation, Execution and Self-Deletion in Suspicious Directory", + "query": "sequence by host.id, user.id with maxspan=1m\n [file where host.os.type == \"linux\" and event.action == \"creation\" and \n process.name in (\"curl\", \"wget\", \"fetch\", \"ftp\", \"sftp\", \"scp\", \"rsync\", \"ld\") and \n file.path : (\"/dev/shm/*\", \"/run/shm/*\", \"/tmp/*\", \"/var/tmp/*\",\n \"/run/*\", \"/var/run/*\", \"/var/www/*\", \"/proc/*/fd/*\")] by file.name\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")] by process.name\n [file where host.os.type == \"linux\" and event.action == \"deletion\" and not process.name in (\"rm\", \"ld\") and \n file.path : (\"/dev/shm/*\", \"/run/shm/*\", \"/tmp/*\", \"/var/tmp/*\",\n \"/run/*\", \"/var/run/*\", \"/var/www/*\", \"/proc/*/fd/*\")] by file.name\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "09bc6c90-7501-494d-b015-5d988dc3f233", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "09bc6c90-7501-494d-b015-5d988dc3f233_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83_1.json b/packages/security_detection_engine/kibana/security_rule/0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83_1.json new file mode 100644 index 00000000000..c3063466d68 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83_1.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Remote Execution Capabilities via WinRM", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n (\"Invoke-WmiMethod\" or \"Invoke-Command\" or \"Enter-PSSession\") and \"ComputerName\"\n )\n", + "references": [ + "https://attack.mitre.org/techniques/T1021/006/", + "https://github.com/cobbr/SharpSploit/blob/master/SharpSploit/LateralMovement/PowerShellRemoting.cs", + "https://github.com/BC-SECURITY/Empire/blob/main/empire/server/modules/powershell/lateral_movement/invoke_psremoting.py" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.006", + "name": "Windows Remote Management", + "reference": "https://attack.mitre.org/techniques/T1021/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "0abf0c5b-62dd-48d2-ac4e-6b43fe3a6e83_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5_105.json b/packages/security_detection_engine/kibana/security_rule/0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5_105.json new file mode 100644 index 00000000000..10199a27456 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5_105.json @@ -0,0 +1,66 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies unusual parent-child process relationships that can indicate malware execution or persistence mechanisms. Malicious scripts often call on other applications and processes as part of their exploit payload. For example, when a malicious Office document runs scripts as part of an exploit payload, Excel or Word may start a script interpreter process, which, in turn, runs a script that downloads and executes malware. Another common scenario is Outlook running an unusual process when malware is downloaded in an email. Monitoring and identifying anomalous process relationships is a method of detecting new and emerging malware that is not yet recognized by anti-virus scanners.", + "false_positives": [ + "Users running scripts in the course of technical support operations of software upgrades could trigger this alert. A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_process_creation" + ], + "name": "Anomalous Windows Process Creation", + "note": "## Triage and analysis\n\n### Investigating Anomalous Windows Process Creation\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.\n\nThis rule uses a machine learning job to detect an anomalous Windows process with an unusual parent-child relationship, which could indicate malware execution or persistence activities on the host machine.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n - Investigate the process metadata \u2014 such as the digital signature, directory, etc. \u2014 to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.\n- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Retrieve Service Unisgned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76\n- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5\n- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "type": "machine_learning", + "version": 105 + }, + "id": "0b29cab4-dbbd-4a3f-9e8e-1287c7c11ae5_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_1.json b/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_1.json new file mode 100644 index 00000000000..a3be391be02 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_1.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of a set of linux binaries, that are potentially vulnerable to wildcard injection, with suspicious command line flags followed by a shell spawn event. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Shell via Wildcard Injection Detected", + "query": "sequence by host.id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and (\n (process.name == \"tar\" and process.args : \"--checkpoint=*\" and process.args : \"--checkpoint-action=*\") or\n (process.name == \"rsync\" and process.args : \"-e*\") or\n (process.name == \"zip\" and process.args == \"--unzip-command\") )] by process.entity_id\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.parent.name : (\"tar\", \"rsync\", \"zip\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")] by process.parent.entity_id\n", + "references": [ + "https://www.exploit-db.com/papers/33930" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0b803267-74c5-444d-ae29-32b5db2d562a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "0b803267-74c5-444d-ae29-32b5db2d562a_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_2.json b/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_2.json new file mode 100644 index 00000000000..17aa96ab23a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0b803267-74c5-444d-ae29-32b5db2d562a_2.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of a set of linux binaries, that are potentially vulnerable to wildcard injection, with suspicious command line flags followed by a shell spawn event. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Shell via Wildcard Injection Detected", + "query": "sequence by host.id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and (\n (process.name == \"tar\" and process.args : \"--checkpoint=*\" and process.args : \"--checkpoint-action=*\") or\n (process.name == \"rsync\" and process.args : \"-e*\") or\n (process.name == \"zip\" and process.args == \"--unzip-command\") )] by process.entity_id\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.parent.name : (\"tar\", \"rsync\", \"zip\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")] by process.parent.entity_id\n", + "references": [ + "https://www.exploit-db.com/papers/33930" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0b803267-74c5-444d-ae29-32b5db2d562a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "0b803267-74c5-444d-ae29-32b5db2d562a_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c093569-dff9-42b6-87b1-0242d9f7d9b4_1.json b/packages/security_detection_engine/kibana/security_rule/0c093569-dff9-42b6-87b1-0242d9f7d9b4_1.json new file mode 100644 index 00000000000..243cb99c9ba --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0c093569-dff9-42b6-87b1-0242d9f7d9b4_1.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identify instances where adversaries include trailing space characters to mimic regular files, disguising their activity to evade default file handling mechanisms.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Processes with Trailing Spaces", + "query": "process where event.type in (\"start\", \"process_started\") and process.name : \"* \"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "0c093569-dff9-42b6-87b1-0242d9f7d9b4", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.006", + "name": "Space after Filename", + "reference": "https://attack.mitre.org/techniques/T1036/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "0c093569-dff9-42b6-87b1-0242d9f7d9b4_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_2.json b/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_2.json new file mode 100644 index 00000000000..48c9b22601f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_2.json @@ -0,0 +1,141 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "packetbeat-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel IP Address Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel IP Address Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:\n - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. \n - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - $osquery_0\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - $osquery_1\n - $osquery_2\n - $osquery_3\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.\n- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "source.ip:* or destination.ip:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 99, + "rule_id": "0c41e478-5263-4c69-8f9e-7dfd2c22da64", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "source.ip", + "type": "mapping", + "value": "threat.indicator.ip" + } + ] + }, + { + "entries": [ + { + "field": "destination.ip", + "type": "mapping", + "value": "threat.indicator.ip" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 2 + }, + "id": "0c41e478-5263-4c69-8f9e-7dfd2c22da64_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_3.json b/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_3.json new file mode 100644 index 00000000000..bb90304d7d1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0c41e478-5263-4c69-8f9e-7dfd2c22da64_3.json @@ -0,0 +1,141 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "packetbeat-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel IP Address Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel IP Address Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when an IP address indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against a network event.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation so you can understand the nature of the connection. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the IP address, which can be found in the `threat.indicator.matched.atomic` field:\n - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. \n - Execute a reverse DNS lookup to retrieve hostnames associated with the given IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- When a match is found, it's important to consider the indicator's initial release date. Threat intelligence is useful for augmenting existing security processes but can quickly become outdated. In other words, some threat intelligence only represents a specific set of activity observed at a specific time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.\n- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "source.ip:* or destination.ip:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 99, + "rule_id": "0c41e478-5263-4c69-8f9e-7dfd2c22da64", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "source.ip", + "type": "mapping", + "value": "threat.indicator.ip" + } + ] + }, + { + "entries": [ + { + "field": "destination.ip", + "type": "mapping", + "value": "threat.indicator.ip" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 3 + }, + "id": "0c41e478-5263-4c69-8f9e-7dfd2c22da64_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4_106.json b/packages/security_detection_engine/kibana/security_rule/0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4_106.json new file mode 100644 index 00000000000..4bc62bbe290 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the Windows file system utility (fsutil.exe) to gather information about attached peripheral devices and components connected to a computer system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Peripheral Device Discovery", + "note": "## Triage and analysis\n\n### Investigating Peripheral Device Discovery\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `fsutil` utility with the `fsinfo` subcommand to enumerate drives attached to the computer, which can be used to identify secondary drives used for backups, mapped network drives, and removable media. These devices can contain valuable information for attackers.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Determine whether this activity was followed by suspicious file access/copy operations or uploads to file storage services.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"fsutil.exe\" or process.pe.original_file_name == \"fsutil.exe\") and\n process.args : \"fsinfo\" and process.args : \"drives\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1120", + "name": "Peripheral Device Discovery", + "reference": "https://attack.mitre.org/techniques/T1120/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "0c7ca5c2-728d-4ad9-b1c5-bbba83ecb1f4_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_103.json b/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_103.json deleted file mode 100644 index d565b7ea4a5..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_103.json +++ /dev/null @@ -1,235 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel integrations have a match against local file or network observations.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Threat Intel Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps:\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0", - "severity": "critical", - "tags": [ - "Elastic", - "Windows", - "Elastic Endgame", - "Network", - "Continuous Monitoring", - "SecOps", - "Monitoring", - "Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.dataset", - "negate": false, - "params": { - "query": "ti_*" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "ti_*" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "logs-ti_*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.dataset:ti_* and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 103 - }, - "id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_103", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_104.json b/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_104.json deleted file mode 100644 index 1718730b81d..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_104.json +++ /dev/null @@ -1,230 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel integrations have a match against local file or network observations.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Threat Intel Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps:\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0", - "severity": "critical", - "tags": [ - "OS: Windows", - "Data Source: Elastic Endgame", - "Resources: Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.dataset", - "negate": false, - "params": { - "query": "ti_*" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "ti_*" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "logs-ti_*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.dataset:ti_* and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 104 - }, - "id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_104", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_204.json b/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_204.json deleted file mode 100644 index 383a3750c11..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_204.json +++ /dev/null @@ -1,231 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel integrations have a match against local file or network observations. This rule was deprecated. See the Setup section for more information and alternative rules.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Deprecated - Threat Intel Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps\n\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n\nThis rule was deprecated in the 8.8 version of the Elastic Stack for performance reasons and to avoid alert duplication due to the indicators expiration new feature. Users using 8.8+ versions should disable this rule and enable indicator-based rules instead:\n\n* Threat Intel IP Address Indicator Match - 0c41e478-5263-4c69-8f9e-7dfd2c22da64\n* Threat Intel Hash Indicator Match - aab184d3-72b3-4639-b242-6597c99d8bca\n* Threat Intel Windows Registry Indicator Match - a61809f3-fb5b-465c-8bff-23a8a068ac60\n* Threat Intel URL Indicator Match - f3e22c8b-ea47-45d1-b502-b57b6de950b3", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0", - "setup": "This rule was deprecated in the 8.8 version of the Elastic Stack for performance reasons and to avoid alert duplication due to the indicators expiration new feature. Users using 8.8+ versions should disable this rule and enable indicator-based rules instead:\n\nThreat Intel IP Address Indicator Match - 0c41e478-5263-4c69-8f9e-7dfd2c22da64Threat Intel Hash Indicator Match - aab184d3-72b3-4639-b242-6597c99d8bcaThreat Intel Windows Registry Indicator Match - a61809f3-fb5b-465c-8bff-23a8a068ac60Threat Intel URL Indicator Match - f3e22c8b-ea47-45d1-b502-b57b6de950b3", - "severity": "critical", - "tags": [ - "OS: Windows", - "Data Source: Elastic Endgame", - "Resources: Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.dataset", - "negate": false, - "params": { - "query": "ti_*" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.dataset": "ti_*" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "logs-ti_*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.dataset:ti_* and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 204 - }, - "id": "0c9a14d9-d65d-486f-9b5b-91e4e6b22bd0_204", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0d69150b-96f8-467c-a86d-a67a3378ce77_105.json b/packages/security_detection_engine/kibana/security_rule/0d69150b-96f8-467c-a86d-a67a3378ce77_105.json new file mode 100644 index 00000000000..8b1d385daff --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0d69150b-96f8-467c-a86d-a67a3378ce77_105.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Nping ran on a Linux host. Nping is part of the Nmap tool suite and has the ability to construct raw packets for a wide variety of security testing applications, including denial of service testing.", + "false_positives": [ + "Some normal use of this command may originate from security engineers and network or server administrators, but this is usually not routine or unannounced. Use of `Nping` by non-engineers or ordinary users is uncommon." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Nping Process Activity", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and process.name == \"nping\"\n", + "references": [ + "https://en.wikipedia.org/wiki/Nmap" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0d69150b-96f8-467c-a86d-a67a3378ce77", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "0d69150b-96f8-467c-a86d-a67a3378ce77_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5_106.json b/packages/security_detection_engine/kibana/security_rule/0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5_106.json new file mode 100644 index 00000000000..a0daf781a17 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5_106.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an executable created by a Microsoft Office application and subsequently executed. These processes are often launched via scripts inside documents or during exploitation of Microsoft Office applications.", + "from": "now-120m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of File Written or Modified by Microsoft Office", + "note": "## Triage and analysis\n\n### Investigating Execution of File Written or Modified by Microsoft Office\n\nMicrosoft Office is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.\n\nThis rule searches for executable files written by MS Office applications executed in sequence. This is most likely the result of the execution of malicious documents or exploitation for initial access or privilege escalation. This rule can also detect suspicious processes masquerading as the MS Office applications.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence with maxspan=2h\n [file where host.os.type == \"windows\" and event.type != \"deletion\" and file.extension : \"exe\" and\n (process.name : \"WINWORD.EXE\" or\n process.name : \"EXCEL.EXE\" or\n process.name : \"OUTLOOK.EXE\" or\n process.name : \"POWERPNT.EXE\" or\n process.name : \"eqnedt32.exe\" or\n process.name : \"fltldr.exe\" or\n process.name : \"MSPUB.EXE\" or\n process.name : \"MSACCESS.EXE\")\n ] by host.id, file.path\n [process where host.os.type == \"windows\" and event.type == \"start\"] by host.id, process.executable\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "0d8ad79f-9025-45d8-80c1-4f0cd3c5e8e5_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0e79980b-4250-4a50-a509-69294c14e84b_105.json b/packages/security_detection_engine/kibana/security_rule/0e79980b-4250-4a50-a509-69294c14e84b_105.json new file mode 100644 index 00000000000..08983ffede1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0e79980b-4250-4a50-a509-69294c14e84b_105.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies MsBuild.exe making outbound network connections. This may indicate adversarial activity as MsBuild is often leveraged by adversaries to execute code and evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "MsBuild Making Network Connections", + "note": "## Triage and analysis\n\n### Investigating MsBuild Making Network Connections\n\nBy examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.\n\nThe Microsoft Build Engine, also known as MSBuild, is a platform for building applications. This engine provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy code execution.\n\nThis rule looks for the `Msbuild.exe` utility execution, followed by a network connection to an external address. Attackers can abuse MsBuild to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.\n- Investigate the target host that the signed binary is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of destination IP address and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"MSBuild.exe\" and event.type == \"start\"]\n [network where host.os.type == \"windows\" and process.name : \"MSBuild.exe\" and\n not cidrmatch(destination.ip, \"127.0.0.1\", \"::1\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0e79980b-4250-4a50-a509-69294c14e84b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/", + "subtechnique": [ + { + "id": "T1127.001", + "name": "MSBuild", + "reference": "https://attack.mitre.org/techniques/T1127/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "0e79980b-4250-4a50-a509-69294c14e84b_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_104.json b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_104.json new file mode 100644 index 00000000000..109fe689b13 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_104.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors the creation/alteration of the rc.local file by a previously unknown process executable through the use of the new terms rule type. The /etc/rc.local file is used to start custom applications, services, scripts or commands during start-up. The rc.local file has mostly been replaced by Systemd. However, through the \"systemd-rc-local-generator\", rc.local files can be converted to services that run at boot. Adversaries may alter rc.local to execute malicious code at start-up, and gain persistence onto the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through Run Control Detected", + "new_terms_fields": [ + "host.id", + "process.executable" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through Run Control Detected\n\nThe `rc.local` file executes custom commands or scripts during system startup on Linux systems. `rc.local` has been deprecated in favor of the use of `systemd services`, and more recent Unix distributions no longer leverage this method of on-boot script execution. \n\nThere might still be users that use `rc.local` in a benign matter, so investigation to see whether the file is malicious is vital. \n\nDetection alerts from this rule indicate the creation of a new `/etc/rc.local` file. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate whether the `/lib/systemd/system/rc-local.service` and `/run/systemd/generator/multi-user.target.wants/rc-local.service` files were created through the `systemd-rc-local-generator` located at `/usr/lib/systemd/system-generators/systemd-rc-local-generator`.\n - !{osquery{\"label\":\"Osquery - Retrieve rc-local.service File Information\",\"query\":\"SELECT * FROM file WHERE (path = '/run/systemd/generator/multi-user.target.wants/rc-local.service' OR path = '/run/systemd/generator/multi-user.target.wants/rc-local.service')\"}}\n - In case the file is not present here, `sudo systemctl status rc-local` can be executed to find the location of the rc-local unit file.\n - If `rc-local.service` is found, manual investigation is required to check for the rc script execution. Systemd will generate syslogs in case of the execution of the rc-local service. `sudo cat /var/log/syslog | grep \"rc-local.service|/etc/rc.local Compatibility\"` can be executed to check for the execution of the service.\n - If logs are found, it's likely that the contents of the `rc.local` file have been executed. Analyze the logs. In case several syslog log files are available, use a wildcard to search through all of the available logs.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses `rc.local` for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the `service/rc.local` files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.category : \"file\" and \nevent.type : (\"change\" or \"file_modify_event\" or \"creation\" or \"file_create_event\") and\nfile.path : \"/etc/rc.local\" and not file.extension : \"swp\"\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0f4d35e4-925e-4959-ab24-911be207ee6f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + } + ] + } + ], + "type": "new_terms", + "version": 104 + }, + "id": "0f4d35e4-925e-4959-ab24-911be207ee6f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_105.json b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_105.json new file mode 100644 index 00000000000..5b4460f8cb3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_105.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors the creation/alteration of the rc.local file by a previously unknown process executable through the use of the new terms rule type. The /etc/rc.local file is used to start custom applications, services, scripts or commands during start-up. The rc.local file has mostly been replaced by Systemd. However, through the \"systemd-rc-local-generator\", rc.local files can be converted to services that run at boot. Adversaries may alter rc.local to execute malicious code at start-up, and gain persistence onto the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through Run Control Detected", + "new_terms_fields": [ + "host.id", + "process.executable" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through Run Control Detected\n\nThe `rc.local` file executes custom commands or scripts during system startup on Linux systems. `rc.local` has been deprecated in favor of the use of `systemd services`, and more recent Unix distributions no longer leverage this method of on-boot script execution. \n\nThere might still be users that use `rc.local` in a benign matter, so investigation to see whether the file is malicious is vital. \n\nDetection alerts from this rule indicate the creation of a new `/etc/rc.local` file. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate whether the `/lib/systemd/system/rc-local.service` and `/run/systemd/generator/multi-user.target.wants/rc-local.service` files were created through the `systemd-rc-local-generator` located at `/usr/lib/systemd/system-generators/systemd-rc-local-generator`.\n - !{osquery{\"label\":\"Osquery - Retrieve rc-local.service File Information\",\"query\":\"SELECT * FROM file WHERE (path = '/run/systemd/generator/multi-user.target.wants/rc-local.service' OR path = '/run/systemd/generator/multi-user.target.wants/rc-local.service')\"}}\n - In case the file is not present here, `sudo systemctl status rc-local` can be executed to find the location of the rc-local unit file.\n - If `rc-local.service` is found, manual investigation is required to check for the rc script execution. Systemd will generate syslogs in case of the execution of the rc-local service. `sudo cat /var/log/syslog | grep \"rc-local.service|/etc/rc.local Compatibility\"` can be executed to check for the execution of the service.\n - If logs are found, it's likely that the contents of the `rc.local` file have been executed. Analyze the logs. In case several syslog log files are available, use a wildcard to search through all of the available logs.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses `rc.local` for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the `service/rc.local` files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.category : \"file\" and \nevent.type : (\"change\" or \"file_modify_event\" or \"creation\" or \"file_create_event\") and\nfile.path : \"/etc/rc.local\" and not process.name : (\"dockerd\" or \"yum\" or \"rpm\" or \"dpkg\") and not file.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0f4d35e4-925e-4959-ab24-911be207ee6f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + } + ] + } + ], + "type": "new_terms", + "version": 105 + }, + "id": "0f4d35e4-925e-4959-ab24-911be207ee6f_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_106.json b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_106.json new file mode 100644 index 00000000000..5702a63834d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0f4d35e4-925e-4959-ab24-911be207ee6f_106.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors the creation/alteration of the rc.local file by a previously unknown process executable through the use of the new terms rule type. The /etc/rc.local file is used to start custom applications, services, scripts or commands during start-up. The rc.local file has mostly been replaced by Systemd. However, through the \"systemd-rc-local-generator\", rc.local files can be converted to services that run at boot. Adversaries may alter rc.local to execute malicious code at start-up, and gain persistence onto the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through Run Control Detected", + "new_terms_fields": [ + "host.id", + "process.executable" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through Run Control Detected\n\nThe `rc.local` file executes custom commands or scripts during system startup on Linux systems. `rc.local` has been deprecated in favor of the use of `systemd services`, and more recent Unix distributions no longer leverage this method of on-boot script execution. \n\nThere might still be users that use `rc.local` in a benign matter, so investigation to see whether the file is malicious is vital. \n\nDetection alerts from this rule indicate the creation of a new `/etc/rc.local` file. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate whether the `/lib/systemd/system/rc-local.service` and `/run/systemd/generator/multi-user.target.wants/rc-local.service` files were created through the `systemd-rc-local-generator` located at `/usr/lib/systemd/system-generators/systemd-rc-local-generator`.\n - !{osquery{\"label\":\"Osquery - Retrieve rc-local.service File Information\",\"query\":\"SELECT * FROM file WHERE (path = '/run/systemd/generator/multi-user.target.wants/rc-local.service' OR path = '/run/systemd/generator/multi-user.target.wants/rc-local.service')\"}}\n - In case the file is not present here, `sudo systemctl status rc-local` can be executed to find the location of the rc-local unit file.\n - If `rc-local.service` is found, manual investigation is required to check for the rc script execution. Systemd will generate syslogs in case of the execution of the rc-local service. `sudo cat /var/log/syslog | grep \"rc-local.service|/etc/rc.local Compatibility\"` can be executed to check for the execution of the service.\n - If logs are found, it's likely that the contents of the `rc.local` file have been executed. Analyze the logs. In case several syslog log files are available, use a wildcard to search through all of the available logs.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses `rc.local` for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the `service/rc.local` files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.category : \"file\" and \nevent.type : (\"change\" or \"file_modify_event\" or \"creation\" or \"file_create_event\") and\nfile.path : \"/etc/rc.local\" and not process.name : (\"dockerd\" or \"docker\" or \"dnf\" or \"yum\" or \"rpm\" or \"dpkg\") and not file.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "0f4d35e4-925e-4959-ab24-911be207ee6f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + } + ] + } + ], + "type": "new_terms", + "version": 106 + }, + "id": "0f4d35e4-925e-4959-ab24-911be207ee6f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0f93cb9a-1931-48c2-8cd0-f173fd3e5283_206.json b/packages/security_detection_engine/kibana/security_rule/0f93cb9a-1931-48c2-8cd0-f173fd3e5283_206.json new file mode 100644 index 00000000000..c5c987e610a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0f93cb9a-1931-48c2-8cd0-f173fd3e5283_206.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious access to an LSASS handle via PssCaptureSnapShot where two successive process accesses are performed by the same process and target two different instances of LSASS. This may indicate an attempt to evade detection and dump LSASS memory for credential access.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential LSASS Memory Dump via PssCaptureSnapShot", + "note": "", + "query": "event.category:process and host.os.type:windows and event.code:10 and\n winlog.event_data.TargetImage:(\"C:\\\\Windows\\\\system32\\\\lsass.exe\" or\n \"c:\\\\Windows\\\\system32\\\\lsass.exe\" or\n \"c:\\\\Windows\\\\System32\\\\lsass.exe\")\n", + "references": [ + "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", + "https://twitter.com/sbousseaden/status/1280619931516747777?lang=en" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetImage", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "0f93cb9a-1931-48c2-8cd0-f173fd3e5283", + "setup": "This is meant to run only on datasources using Elastic Agent 7.14+ since versions prior to that will be missing the threshold\nrule cardinality feature.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "winlog.event_data.TargetProcessId", + "value": 2 + } + ], + "field": [ + "process.entity_id" + ], + "value": 2 + }, + "timestamp_override": "event.ingested", + "type": "threshold", + "version": 206 + }, + "id": "0f93cb9a-1931-48c2-8cd0-f173fd3e5283_206", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/0ff84c42-873d-41a2-a4ed-08d74d352d01_104.json b/packages/security_detection_engine/kibana/security_rule/0ff84c42-873d-41a2-a4ed-08d74d352d01_104.json new file mode 100644 index 00000000000..022d74ade22 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/0ff84c42-873d-41a2-a4ed-08d74d352d01_104.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to the root crontab file. Adversaries may overwrite this file to gain code execution with root privileges by exploiting privileged file write or move related vulnerabilities.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Privilege Escalation via Root Crontab File Modification", + "query": "event.category:file and host.os.type:macos and not event.type:deletion and\n file.path:/private/var/at/tabs/root and not process.executable:/usr/bin/crontab\n", + "references": [ + "https://phoenhex.re/2017-06-09/pwn2own-diskarbitrationd-privesc", + "https://www.exploit-db.com/exploits/42146" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "0ff84c42-873d-41a2-a4ed-08d74d352d01", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "0ff84c42-873d-41a2-a4ed-08d74d352d01_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/10a500bb-a28f-418e-ba29-ca4c8d1a9f2f_104.json b/packages/security_detection_engine/kibana/security_rule/10a500bb-a28f-418e-ba29-ca4c8d1a9f2f_104.json new file mode 100644 index 00000000000..e4cb94733f8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/10a500bb-a28f-418e-ba29-ca4c8d1a9f2f_104.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the built-in networksetup command to configure webproxy settings. This may indicate an attempt to hijack web browser traffic for credential access via traffic sniffing or redirection.", + "false_positives": [ + "Legitimate WebProxy Settings Modification" + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "WebProxy Settings Modification", + "query": "event.category:process and host.os.type:macos and event.type:start and\n process.name : networksetup and process.args : ((\"-setwebproxy\" or \"-setsecurewebproxy\" or \"-setautoproxyurl\") and not (Bluetooth or off)) and\n not process.parent.executable : (\"/Library/PrivilegedHelperTools/com.80pct.FreedomHelper\" or\n \"/Applications/Fiddler Everywhere.app/Contents/Resources/app/out/WebServer/Fiddler.WebUi\" or\n \"/usr/libexec/xpcproxy\")\n", + "references": [ + "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/", + "https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "10a500bb-a28f-418e-ba29-ca4c8d1a9f2f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1539", + "name": "Steal Web Session Cookie", + "reference": "https://attack.mitre.org/techniques/T1539/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "10a500bb-a28f-418e-ba29-ca4c8d1a9f2f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1160dcdb-0a0a-4a79-91d8-9b84616edebd_105.json b/packages/security_detection_engine/kibana/security_rule/1160dcdb-0a0a-4a79-91d8-9b84616edebd_105.json new file mode 100644 index 00000000000..8bb417b3d20 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1160dcdb-0a0a-4a79-91d8-9b84616edebd_105.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an instance of a Windows trusted program that is known to be vulnerable to DLL Search Order Hijacking starting after being renamed or from a non-standard path. This is uncommon behavior and may indicate an attempt to evade defenses via side loading a malicious DLL within the memory space of one of those processes.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential DLL SideLoading via Trusted Microsoft Programs", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name in (\"WinWord.exe\", \"EXPLORER.EXE\", \"w3wp.exe\", \"DISM.EXE\") and\n not (process.name : (\"winword.exe\", \"explorer.exe\", \"w3wp.exe\", \"Dism.exe\") or\n process.executable : (\"?:\\\\Windows\\\\explorer.exe\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office*\\\\WINWORD.EXE\",\n \"?:\\\\Program Files?(x86)\\\\Microsoft Office\\\\root\\\\Office*\\\\WINWORD.EXE\",\n \"?:\\\\Windows\\\\System32\\\\Dism.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\Dism.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "1160dcdb-0a0a-4a79-91d8-9b84616edebd", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "1160dcdb-0a0a-4a79-91d8-9b84616edebd_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1178ae09-5aff-460a-9f2f-455cd0ac4d8e_107.json b/packages/security_detection_engine/kibana/security_rule/1178ae09-5aff-460a-9f2f-455cd0ac4d8e_107.json new file mode 100644 index 00000000000..9296bbdd4ce --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1178ae09-5aff-460a-9f2f-455cd0ac4d8e_107.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass via Windows Firewall Snap-In Hijack", + "note": "## Triage and analysis\n\n### Investigating UAC Bypass via Windows Firewall Snap-In Hijack\n\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.\n\nFor more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).\n\nThis rule identifies attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in. Attackers bypass UAC to stealthily execute code with elevated permissions.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze any suspicious spawned processes using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name == \"mmc.exe\" and\n /* process.Ext.token.integrity_level_name == \"high\" can be added in future for tuning */\n /* args of the Windows Firewall SnapIn */\n process.parent.args == \"WF.msc\" and process.name != \"WerFault.exe\"\n", + "references": [ + "https://github.com/AzAgarampur/byeintegrity-uac" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1178ae09-5aff-460a-9f2f-455cd0ac4d8e", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "1178ae09-5aff-460a-9f2f-455cd0ac4d8e_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/11dd9713-0ec6-4110-9707-32daae1ee68c_7.json b/packages/security_detection_engine/kibana/security_rule/11dd9713-0ec6-4110-9707-32daae1ee68c_7.json new file mode 100644 index 00000000000..f16193a875b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/11dd9713-0ec6-4110-9707-32daae1ee68c_7.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Token Impersonation Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text:(\n \"Invoke-TokenManipulation\" or\n \"ImpersonateNamedPipeClient\" or\n \"NtImpersonateThread\" or\n (\n \"STARTUPINFOEX\" and\n \"UpdateProcThreadAttribute\"\n ) or\n (\n \"AdjustTokenPrivileges\" and\n \"SeDebugPrivilege\"\n ) or\n (\n (\"DuplicateToken\" or\n \"DuplicateTokenEx\") and\n (\"SetThreadToken\" or\n \"ImpersonateLoggedOnUser\" or\n \"CreateProcessWithTokenW\" or\n \"CreatePRocessAsUserW\" or\n \"CreateProcessAsUserA\")\n ) \n ) and not \n (user.id:(\"S-1-5-18\" or \"S-1-5-19\") and\n file.directory: \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\Downloads\")\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n", + "references": [ + "https://github.com/decoder-it/psgetsystem", + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Privesc/Get-System.ps1", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.directory", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "11dd9713-0ec6-4110-9707-32daae1ee68c", + "setup": "The 'PowerShell Script Block Logging' logging policy must be configured (Enable).\n\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1134", + "name": "Access Token Manipulation", + "reference": "https://attack.mitre.org/techniques/T1134/", + "subtechnique": [ + { + "id": "T1134.001", + "name": "Token Impersonation/Theft", + "reference": "https://attack.mitre.org/techniques/T1134/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + }, + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 7 + }, + "id": "11dd9713-0ec6-4110-9707-32daae1ee68c_7", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/11ea6bec-ebde-4d71-a8e9-784948f8e3e9_107.json b/packages/security_detection_engine/kibana/security_rule/11ea6bec-ebde-4d71-a8e9-784948f8e3e9_107.json new file mode 100644 index 00000000000..68e7fd3e07c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/11ea6bec-ebde-4d71-a8e9-784948f8e3e9_107.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the deletion of backup files, saved using third-party software, by a process outside of the backup suite. Adversaries may delete Backup files to ensure that recovery from a ransomware attack is less likely.", + "false_positives": [ + "Certain utilities that delete files for disk cleanup or Administrators manually removing backup files." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Third-party Backup Files Deleted via Unexpected Process", + "note": "## Triage and analysis\n\n### Investigating Third-party Backup Files Deleted via Unexpected Process\n\nBackups are a significant obstacle for any ransomware operation. They allow the victim to resume business by performing data recovery, making them a valuable target.\n\nAttackers can delete backups from the host and gain access to backup servers to remove centralized backups for the environment, ensuring that victims have no alternatives to paying the ransom.\n\nThis rule identifies file deletions performed by a process that does not belong to the backup suite and aims to delete Veritas or Veeam backups.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check if any files on the host machine have been encrypted.\n\n### False positive analysis\n\n- This rule can be triggered by the manual removal of backup files and by removal using other third-party tools that are not from the backup suite. Exceptions can be added for specific accounts and executables, preferably tied together.\n\n### Related rules\n\n- Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- Perform data recovery locally or restore the backups from replicated copies (Cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"deletion\" and\n (\n /* Veeam Related Backup Files */\n (file.extension : (\"VBK\", \"VIB\", \"VBM\") and\n not (\n process.executable : (\"?:\\\\Windows\\\\*\", \"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\") and\n (process.code_signature.trusted == true and process.code_signature.subject_name : \"Veeam Software Group GmbH\")\n )) or\n\n /* Veritas Backup Exec Related Backup File */\n (file.extension : \"BKF\" and\n not process.executable : (\"?:\\\\Program Files\\\\Veritas\\\\Backup Exec\\\\*\",\n \"?:\\\\Program Files (x86)\\\\Veritas\\\\Backup Exec\\\\*\") and\n not file.path : (\"?:\\\\ProgramData\\\\Trend Micro\\\\*\",\n \"?:\\\\Program Files (x86)\\\\Trend Micro\\\\*\",\n \"?:\\\\$RECYCLE.BIN\\\\*\"))\n )\n", + "references": [ + "https://www.advintel.io/post/backup-removal-solutions-from-conti-ransomware-with-love" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "11ea6bec-ebde-4d71-a8e9-784948f8e3e9", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "11ea6bec-ebde-4d71-a8e9-784948f8e3e9_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/128468bf-cab1-4637-99ea-fdf3780a4609_105.json b/packages/security_detection_engine/kibana/security_rule/128468bf-cab1-4637-99ea-fdf3780a4609_105.json new file mode 100644 index 00000000000..40190b54615 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/128468bf-cab1-4637-99ea-fdf3780a4609_105.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies access attempts to LSASS handle, this may indicate an attempt to dump credentials from Lsass memory.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Lsass Process Access", + "note": "## Setup", + "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\" and\n not winlog.event_data.GrantedAccess :\n (\"0x1000\", \"0x1400\", \"0x101400\", \"0x101000\", \"0x101001\", \"0x100000\", \"0x100040\", \"0x3200\", \"0x40\", \"0x3200\") and\n not process.name : (\"procexp64.exe\", \"procmon.exe\", \"procexp.exe\", \"Microsoft.Identity.AadConnect.Health.AadSync.Host.ex\") and\n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\lsm.exe\",\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\CCM\\\\CcmExec.exe\",\n \"?:\\\\Windows\\\\system32\\\\csrss.exe\",\n \"?:\\\\Windows\\\\system32\\\\wininit.exe\",\n \"?:\\\\Windows\\\\system32\\\\wbem\\\\wmiprvse.exe\",\n \"?:\\\\Windows\\\\system32\\\\MRT.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\platform\\\\*\",\n \"?:\\\\ProgramData\\\\WebEx\\\\webex\\\\*\",\n \"?:\\\\Windows\\\\LTSvc\\\\LTSVC.exe\") and\n not winlog.event_data.CallTrace : (\"*mpengine.dll*\", \"*appresolver.dll*\", \"*sysmain.dll*\")\n", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.GrantedAccess", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetImage", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "128468bf-cab1-4637-99ea-fdf3780a4609", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "128468bf-cab1-4637-99ea-fdf3780a4609_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_1.json b/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_1.json new file mode 100644 index 00000000000..a06193adf6d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_1.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may leverage unquoted service path vulnerabilities to escalate privileges. By placing an executable in a higher-level directory within the path of an unquoted service executable, Windows will natively launch this executable from its defined path variable instead of the benign one in a deeper directory, thus leading to code execution.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Exploitation of an Unquoted Service Path Vulnerability", + "query": "process where event.type == \"start\" and \n (\n process.executable : \"?:\\\\Program.exe\" or \n process.executable regex \"\"\"(C:\\\\Program Files \\(x86\\)\\\\|C:\\\\Program Files\\\\)\\w+.exe\"\"\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "12de29d4-bbb0-4eef-b687-857e8a163870", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.009", + "name": "Path Interception by Unquoted Path", + "reference": "https://attack.mitre.org/techniques/T1574/009/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "12de29d4-bbb0-4eef-b687-857e8a163870_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_2.json b/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_2.json new file mode 100644 index 00000000000..43f6f643097 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/12de29d4-bbb0-4eef-b687-857e8a163870_2.json @@ -0,0 +1,76 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may leverage unquoted service path vulnerabilities to escalate privileges. By placing an executable in a higher-level directory within the path of an unquoted service executable, Windows will natively launch this executable from its defined path variable instead of the benign one in a deeper directory, thus leading to code execution.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Exploitation of an Unquoted Service Path Vulnerability", + "query": "process where event.type == \"start\" and \n (\n process.executable : \"?:\\\\Program.exe\" or \n process.executable regex \"\"\"(C:\\\\Program Files \\(x86\\)\\\\|C:\\\\Program Files\\\\)\\w+.exe\"\"\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "12de29d4-bbb0-4eef-b687-857e8a163870", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.009", + "name": "Path Interception by Unquoted Path", + "reference": "https://attack.mitre.org/techniques/T1574/009/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "12de29d4-bbb0-4eef-b687-857e8a163870_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/12f07955-1674-44f7-86b5-c35da0a6f41a_106.json b/packages/security_detection_engine/kibana/security_rule/12f07955-1674-44f7-86b5-c35da0a6f41a_106.json new file mode 100644 index 00000000000..ff46204db71 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/12f07955-1674-44f7-86b5-c35da0a6f41a_106.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Cmd Execution via WMI", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"WmiPrvSE.exe\" and process.name : \"cmd.exe\" and\n process.args : \"\\\\\\\\127.0.0.1\\\\*\" and process.args : (\"2\u003e\u00261\", \"1\u003e\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "12f07955-1674-44f7-86b5-c35da0a6f41a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "12f07955-1674-44f7-86b5-c35da0a6f41a_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1327384f-00f3-44d5-9a8c-2373ba071e92_104.json b/packages/security_detection_engine/kibana/security_rule/1327384f-00f3-44d5-9a8c-2373ba071e92_104.json new file mode 100644 index 00000000000..7667030e524 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1327384f-00f3-44d5-9a8c-2373ba071e92_104.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A job can be used to schedule programs or scripts to be executed at a specified date and time. Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.", + "false_positives": [ + "Legitimate scheduled jobs may be created during installation of new software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Scheduled Job Creation", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.path : \"?:\\\\Windows\\\\Tasks\\\\*\" and file.extension : \"job\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1327384f-00f3-44d5-9a8c-2373ba071e92", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "1327384f-00f3-44d5-9a8c-2373ba071e92_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/138c5dd5-838b-446e-b1ac-c995c7f8108a_104.json b/packages/security_detection_engine/kibana/security_rule/138c5dd5-838b-446e-b1ac-c995c7f8108a_104.json new file mode 100644 index 00000000000..940d6c25ba6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/138c5dd5-838b-446e-b1ac-c995c7f8108a_104.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job found an unusual user name in the authentication logs. An unusual user name is one way of detecting credentialed access by means of a new or dormant user account. An inactive user account (because the user has left the organization) that becomes active may be due to credentialed access using a compromised account password. Threat actors will sometimes also create new users as a means of persisting in a compromised web application.", + "false_positives": [ + "User accounts that are rarely active, such as a site reliability engineer (SRE) or developer logging into a production server for troubleshooting, may trigger this alert. Under some conditions, a newly created user account may briefly trigger this alert while the model is learning." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_rare_user", + "name": "Rare User Logon", + "note": "## Triage and analysis\n\n### Investigating Rare User Logon\n\nThis rule uses a machine learning job to detect an unusual user name in authentication logs, which could detect new accounts created for persistence.\n\n#### Possible investigation steps\n\n- Check if the user was newly created and if the company policies were followed.\n - Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the involved users during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Accounts that are used for specific purposes \u2014 and therefore not normally active \u2014 may trigger the alert.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "138c5dd5-838b-446e-b1ac-c995c7f8108a", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.002", + "name": "Domain Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/002/" + }, + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "138c5dd5-838b-446e-b1ac-c995c7f8108a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/143cb236-0956-4f42-a706-814bcaa0cf5a_102.json b/packages/security_detection_engine/kibana/security_rule/143cb236-0956-4f42-a706-814bcaa0cf5a_102.json new file mode 100644 index 00000000000..33c3cacb585 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/143cb236-0956-4f42-a706-814bcaa0cf5a_102.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.", + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "RPC (Remote Procedure Call) from the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and\n not source.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n destination.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 73, + "rule_id": "143cb236-0956-4f42-a706-814bcaa0cf5a", + "severity": "high", + "tags": [ + "Tactic: Initial Access", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 102 + }, + "id": "143cb236-0956-4f42-a706-814bcaa0cf5a_102", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/14dab405-5dd9-450c-8106-72951af2391f_1.json b/packages/security_detection_engine/kibana/security_rule/14dab405-5dd9-450c-8106-72951af2391f_1.json new file mode 100644 index 00000000000..f11774d3b4a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/14dab405-5dd9-450c-8106-72951af2391f_1.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the modification of the Microsoft Office \"Office Test\" Registry key, a registry location that can be used to specify a DLL which will be executed every time an MS Office application is started. Attackers can abuse this to gain persistence on a compromised host.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Office Test Registry Persistence", + "query": "registry where host.os.type == \"windows\" and event.action != \"deletion\" and\n registry.path : \"*\\\\Software\\\\Microsoft\\\\Office Test\\\\Special\\\\Perf\\\\*\"\n", + "references": [ + "https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "14dab405-5dd9-450c-8106-72951af2391f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1137", + "name": "Office Application Startup", + "reference": "https://attack.mitre.org/techniques/T1137/", + "subtechnique": [ + { + "id": "T1137.002", + "name": "Office Test", + "reference": "https://attack.mitre.org/techniques/T1137/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "14dab405-5dd9-450c-8106-72951af2391f_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/14ed1aa9-ebfd-4cf9-a463-0ac59ec55204_104.json b/packages/security_detection_engine/kibana/security_rule/14ed1aa9-ebfd-4cf9-a463-0ac59ec55204_104.json new file mode 100644 index 00000000000..df451e7d6cb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/14ed1aa9-ebfd-4cf9-a463-0ac59ec55204_104.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modification of the Time Provider. Adversaries may establish persistence by registering and enabling a malicious DLL as a time provider. Windows uses the time provider architecture to obtain accurate time stamps from other network devices or clients in the network. Time providers are implemented in the form of a DLL file which resides in the System32 folder. The service W32Time initiates during the startup of Windows and loads w32time.dll.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Persistence via Time Provider Modification", + "query": "registry where host.os.type == \"windows\" and event.type:\"change\" and\n registry.path: (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\W32Time\\\\TimeProviders\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\W32Time\\\\TimeProviders\\\\*\"\n ) and\n registry.data.strings:\"*.dll\"\n", + "references": [ + "https://pentestlab.blog/2019/10/22/persistence-time-providers/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "14ed1aa9-ebfd-4cf9-a463-0ac59ec55204", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.003", + "name": "Time Providers", + "reference": "https://attack.mitre.org/techniques/T1547/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "14ed1aa9-ebfd-4cf9-a463-0ac59ec55204_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/15c0b7a7-9c34-4869-b25b-fa6518414899_107.json b/packages/security_detection_engine/kibana/security_rule/15c0b7a7-9c34-4869-b25b-fa6518414899_107.json new file mode 100644 index 00000000000..365d63d5c70 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/15c0b7a7-9c34-4869-b25b-fa6518414899_107.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Download via Desktopimgdownldr Utility", + "note": "## Triage and analysis\n\n### Investigating Remote File Download via Desktopimgdownldr Utility\n\nAttackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.\n\nThe `Desktopimgdownldr.exe` utility is used to to configure lockscreen/desktop image, and can be abused with the `lockscreenurl` argument to download remote files and tools, this rule looks for this behavior.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Check the reputation of the domain or IP address used to host the downloaded file or if the user downloaded the file from an internal system.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unusual but can be done by administrators. Benign true positives (B-TPs) can be added as exceptions if necessary.\n- Analysts can dismiss the alert if the downloaded file is a legitimate image.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"desktopimgdownldr.exe\" or process.pe.original_file_name == \"desktopimgdownldr.exe\") and\n process.args : \"/lockscreenurl:http*\"\n", + "references": [ + "https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "15c0b7a7-9c34-4869-b25b-fa6518414899", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "15c0b7a7-9c34-4869-b25b-fa6518414899_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/15dacaa0-5b90-466b-acab-63435a59701a_104.json b/packages/security_detection_engine/kibana/security_rule/15dacaa0-5b90-466b-acab-63435a59701a_104.json new file mode 100644 index 00000000000..e174afabef2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/15dacaa0-5b90-466b-acab-63435a59701a_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of macOS built-in commands to connect to an existing Virtual Private Network (VPN). Adversaries may use VPN connections to laterally move and control remote systems on a network.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Virtual Private Network Connection Attempt", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n (\n (process.name : \"networksetup\" and process.args : \"-connectpppoeservice\") or\n (process.name : \"scutil\" and process.args : \"--nc\" and process.args : \"start\") or\n (process.name : \"osascript\" and process.command_line : \"osascript*set VPN to service*\")\n )\n", + "references": [ + "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/osx/manage/vpn.rb", + "https://www.unix.com/man-page/osx/8/networksetup/", + "https://superuser.com/questions/358513/start-configured-vpn-from-command-line-osx" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "15dacaa0-5b90-466b-acab-63435a59701a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "15dacaa0-5b90-466b-acab-63435a59701a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/16904215-2c95-4ac8-bf5c-12354e047192_104.json b/packages/security_detection_engine/kibana/security_rule/16904215-2c95-4ac8-bf5c-12354e047192_104.json new file mode 100644 index 00000000000..e0f2fac7b95 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/16904215-2c95-4ac8-bf5c-12354e047192_104.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of Bifrost, a known macOS Kerberos pentesting tool, which can be used to dump cached Kerberos tickets or attempt unauthorized authentication techniques such as pass-the-ticket/hash and kerberoasting.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Kerberos Attack via Bifrost", + "query": "event.category:process and host.os.type:macos and event.type:start and\n process.args:(\"-action\" and (\"-kerberoast\" or askhash or asktgs or asktgt or s4u or (\"-ticket\" and ptt) or (dump and (tickets or keytab))))\n", + "references": [ + "https://github.com/its-a-feature/bifrost" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "16904215-2c95-4ac8-bf5c-12354e047192", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1550", + "name": "Use Alternate Authentication Material", + "reference": "https://attack.mitre.org/techniques/T1550/", + "subtechnique": [ + { + "id": "T1550.003", + "name": "Pass the Ticket", + "reference": "https://attack.mitre.org/techniques/T1550/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/", + "subtechnique": [ + { + "id": "T1558.003", + "name": "Kerberoasting", + "reference": "https://attack.mitre.org/techniques/T1558/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "16904215-2c95-4ac8-bf5c-12354e047192_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/16a52c14-7883-47af-8745-9357803f0d4c_107.json b/packages/security_detection_engine/kibana/security_rule/16a52c14-7883-47af-8745-9357803f0d4c_107.json new file mode 100644 index 00000000000..7e837426e18 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/16a52c14-7883-47af-8745-9357803f0d4c_107.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies Component Object Model (COM) hijacking via registry modification. Adversaries may establish persistence by executing malicious content triggered by hijacked references to COM objects.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Component Object Model Hijacking", + "note": "## Triage and analysis\n\n### Investigating Component Object Model Hijacking\n\nAdversaries can insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means of persistence.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Retrieve the file referenced in the registry and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- Some Microsoft executables will reference the LocalServer32 registry key value for the location of external COM objects.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and\n /* not necessary but good for filtering privileged installations */\n user.domain != \"NT AUTHORITY\" and\n (\n (\n registry.path : (\"HK*\\\\InprocServer32\\\\\", \"\\\\REGISTRY\\\\*\\\\InprocServer32\\\\\") and\n registry.data.strings: (\"scrobj.dll\", \"C:\\\\*\\\\scrobj.dll\") and\n not registry.path : \"*\\\\{06290BD*-48AA-11D2-8432-006008C3FBFC}\\\\*\"\n ) or\n\n /* in general COM Registry changes on Users Hive is less noisy and worth alerting */\n (registry.path : (\n \"HKEY_USERS\\\\*\\\\InprocServer32\\\\\",\n \"HKEY_USERS\\\\*\\\\LocalServer32\\\\\",\n \"HKEY_USERS\\\\*\\\\DelegateExecute*\",\n \"HKEY_USERS\\\\*\\\\TreatAs*\",\n \"HKEY_USERS\\\\*\\\\ScriptletURL*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\InprocServer32\\\\\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\LocalServer32\\\\\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\DelegateExecute*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\TreatAs*\", \n \"\\\\REGISTRY\\\\USER\\\\*\\\\ScriptletURL*\"\n ) and not \n (\n process.executable : \"?:\\\\Program Files*\\\\Veeam\\\\Backup and Replication\\\\Console\\\\veeam.backup.shell.exe\" and\n registry.path : (\n \"HKEY_USERS\\\\S-1-*_Classes\\\\CLSID\\\\*\\\\LocalServer32\\\\\",\n \"\\\\REGISTRY\\\\USER\\\\S-1-*_Classes\\\\CLSID\\\\*\\\\LocalServer32\\\\\"))\n ) or\n\n (\n registry.path : (\"HKLM\\\\*\\\\InProcServer32\\\\*\", \"\\\\REGISTRY\\\\MACHINE\\\\*\\\\InProcServer32\\\\*\") and\n registry.data.strings : (\"*\\\\Users\\\\*\", \"*\\\\ProgramData\\\\*\")\n )\n ) and\n\n /* removes false-positives generated by OneDrive and Teams */\n not process.name: (\"OneDrive.exe\", \"OneDriveSetup.exe\", \"FileSyncConfig.exe\", \"Teams.exe\") and\n\n /* Teams DLL loaded by regsvr */\n not (process.name: \"regsvr32.exe\" and registry.data.strings : \"*Microsoft.Teams.*.dll\")\n", + "references": [ + "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "16a52c14-7883-47af-8745-9357803f0d4c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.015", + "name": "Component Object Model Hijacking", + "reference": "https://attack.mitre.org/techniques/T1546/015/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "16a52c14-7883-47af-8745-9357803f0d4c_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c59-fc0fa58336a5_104.json b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c59-fc0fa58336a5_104.json new file mode 100644 index 00000000000..c4850e6f74d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c59-fc0fa58336a5_104.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an administrator or help desk technician logging onto a workstation or server in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_user_name" + ], + "name": "Unusual Windows Username", + "note": "## Triage and analysis\n\n### Investigating an Unusual Windows User\nDetection alerts from this rule indicate activity for a Windows user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to occasional troubleshooting or support activity?\n- Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c59-fc0fa58336a5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.002", + "name": "Domain Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/002/" + }, + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "1781d055-5c66-4adf-9c59-fc0fa58336a5_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c71-fc0fa58338c7_103.json b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c71-fc0fa58338c7_103.json new file mode 100644 index 00000000000..d710d21e3ad --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9c71-fc0fa58338c7_103.json @@ -0,0 +1,71 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusual Windows service, This can indicate execution of unauthorized services, malware, or persistence mechanisms. In corporate Windows environments, hosts do not generally run many rare or unique services. This job helps detect malware and persistence mechanisms that have been installed and run as a service.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_service" + ], + "name": "Unusual Windows Service", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9c71-fc0fa58338c7", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "1781d055-5c66-4adf-9c71-fc0fa58338c7_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d60-fc0fa58337b6_104.json b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d60-fc0fa58337b6_104.json new file mode 100644 index 00000000000..317d1b76ee9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d60-fc0fa58337b6_104.json @@ -0,0 +1,72 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a PowerShell script with unusual data characteristics, such as obfuscation, that may be a characteristic of malicious PowerShell script text blocks.", + "false_positives": [ + "Certain kinds of security testing may trigger this alert. PowerShell scripts that use high levels of obfuscation or have unusual script block payloads may trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_script" + ], + "name": "Suspicious Powershell Script", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html", + "https://www.elastic.co/security-labs/detecting-living-off-the-land-attacks-with-new-elastic-integration" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d60-fc0fa58337b6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "1781d055-5c66-4adf-9d60-fc0fa58337b6_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d82-fc0fa58449c8_103.json b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d82-fc0fa58449c8_103.json new file mode 100644 index 00000000000..4f7c6724a4e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9d82-fc0fa58449c8_103.json @@ -0,0 +1,58 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusual user context switch, using the runas command or similar techniques, which can indicate account takeover or privilege escalation using compromised accounts. Privilege elevation using tools like runas are more commonly used by domain and network administrators than by regular Windows users.", + "false_positives": [ + "Uncommon user privilege elevation activity can be due to an administrator, help desk technician, or a user performing manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_rare_user_runas_event" + ], + "name": "Unusual Windows User Privilege Elevation Activity", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9d82-fc0fa58449c8", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "1781d055-5c66-4adf-9d82-fc0fa58449c8_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9e93-fc0fa69550c9_103.json b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9e93-fc0fa69550c9_103.json new file mode 100644 index 00000000000..ec8e549ac57 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1781d055-5c66-4adf-9e93-fc0fa69550c9_103.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusual remote desktop protocol (RDP) username, which can indicate account takeover or credentialed persistence using compromised accounts. RDP attacks, such as BlueKeep, also tend to use unusual usernames.", + "false_positives": [ + "Uncommon username activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_rare_user_type10_remote_login" + ], + "name": "Unusual Windows Remote User", + "note": "## Triage and analysis\n\n### Investigating an Unusual Windows User\nDetection alerts from this rule indicate activity for a rare and unusual Windows RDP (remote desktop) user. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is the user part of a group who normally logs into Windows hosts using RDP (remote desktop protocol)? Is this logon activity part of an expected workflow for the user?\n- Consider the source of the login. If the source is remote, could this be related to occasional troubleshooting or support activity by a vendor or an employee working remotely?", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "1781d055-5c66-4adf-9e93-fc0fa69550c9", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "1781d055-5c66-4adf-9e93-fc0fa69550c9_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_3.json b/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_3.json new file mode 100644 index 00000000000..dd78380b639 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_3.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Systemd service files are configuration files in Linux systems used to define and manage system services. Malicious actors can leverage systemd service files to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "New Systemd Service Created by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type : \"linux\" and event.action : (\"creation\" or \"file_create_event\") and\nfile.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or \n/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not \n(process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"snapd\" or \"yum\" or \"exe\" or \"dnf\" or \"dnf-automatic\" or python* or \n \"elastic-agent\" or \"cinc-client\") or file.extension : (\"swp\" or \"swx\"))\n", + "references": [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "17b0a495-4d9f-414c-8ad0-92f018b8e001", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "17b0a495-4d9f-414c-8ad0-92f018b8e001_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_4.json b/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_4.json new file mode 100644 index 00000000000..8d477d4b6f1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/17b0a495-4d9f-414c-8ad0-92f018b8e001_4.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Systemd service files are configuration files in Linux systems used to define and manage system services. Malicious actors can leverage systemd service files to achieve persistence by creating or modifying service files to execute malicious commands or payloads during system startup. This allows them to maintain unauthorized access, execute additional malicious activities, or evade detection.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "New Systemd Service Created by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type : \"linux\" and event.action : (\"creation\" or \"file_create_event\") and\nfile.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or \n/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not \n(process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"snapd\" or \"yum\" or \"exe\" or \"dnf\" or \"dnf-automatic\" or python* or \n \"elastic-agent\" or \"cinc-client\") or file.extension : (\"swp\" or \"swx\"))\n", + "references": [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "17b0a495-4d9f-414c-8ad0-92f018b8e001", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 4 + }, + "id": "17b0a495-4d9f-414c-8ad0-92f018b8e001_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_106.json b/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_106.json new file mode 100644 index 00000000000..6f420254849 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Renamed Utility Executed with Short Program Name", + "note": "## Triage and analysis\n\n### Investigating Renamed Utility Executed with Short Program Name\n\nIdentifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and length(process.name) \u003e 0 and\n length(process.name) == 5 and length(process.pe.original_file_name) \u003e 5\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "17c7f6a5-5bc9-4e1f-92bf-13632d24384d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "17c7f6a5-5bc9-4e1f-92bf-13632d24384d_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_107.json b/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_107.json new file mode 100644 index 00000000000..128b7f103b8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/17c7f6a5-5bc9-4e1f-92bf-13632d24384d_107.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Renamed Utility Executed with Short Program Name", + "note": "## Triage and analysis\n\n### Investigating Renamed Utility Executed with Short Program Name\n\nIdentifies the execution of a process with a single character process name, differing from the original file name. This is often done by adversaries while staging, executing temporary utilities, or trying to bypass security detections based on the process name.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, command line and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and length(process.name) \u003e 0 and\n length(process.name) == 5 and length(process.pe.original_file_name) \u003e 5\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "17c7f6a5-5bc9-4e1f-92bf-13632d24384d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "17c7f6a5-5bc9-4e1f-92bf-13632d24384d_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/17e68559-b274-4948-ad0b-f8415bb31126_103.json b/packages/security_detection_engine/kibana/security_rule/17e68559-b274-4948-ad0b-f8415bb31126_103.json new file mode 100644 index 00000000000..f66ee49368e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/17e68559-b274-4948-ad0b-f8415bb31126_103.json @@ -0,0 +1,42 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusual network destination domain name. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon web server name. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "packetbeat_rare_server_domain", + "name": "Unusual Network Destination Domain Name", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "17e68559-b274-4948-ad0b-f8415bb31126", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "17e68559-b274-4948-ad0b-f8415bb31126_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/193549e8-bb9e-466a-a7f9-7e783f5cb5a6_1.json b/packages/security_detection_engine/kibana/security_rule/193549e8-bb9e-466a-a7f9-7e783f5cb5a6_1.json new file mode 100644 index 00000000000..f7c39723bae --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/193549e8-bb9e-466a-a7f9-7e783f5cb5a6_1.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors a sequence involving a program compilation event followed by its execution and a subsequent alteration of UID permissions to root privileges. This behavior can potentially indicate the execution of a kernel or software privilege escalation exploit.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via Recently Compiled Executable", + "query": "sequence by host.id with maxspan=1m\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name in (\"gcc\", \"g++\", \"cc\") and user.id != \"0\"] by process.args\n [file where host.os.type == \"linux\" and event.action == \"creation\" and event.type == \"creation\" and \n process.name == \"ld\" and user.id != \"0\"] by file.name\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n user.id != \"0\"] by process.name\n [process where host.os.type == \"linux\" and event.action in (\"uid_change\", \"guid_change\") and event.type == \"change\" and \n user.id == \"0\"] by process.name\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "193549e8-bb9e-466a-a7f9-7e783f5cb5a6", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "193549e8-bb9e-466a-a7f9-7e783f5cb5a6_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/19de8096-e2b0-4bd8-80c9-34a820813fff_106.json b/packages/security_detection_engine/kibana/security_rule/19de8096-e2b0-4bd8-80c9-34a820813fff_106.json new file mode 100644 index 00000000000..39267d97601 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/19de8096-e2b0-4bd8-80c9-34a820813fff_106.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusual error in a CloudTrail message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.", + "false_positives": [ + "Rare and unusual errors may indicate an impending service failure state. Rare and unusual user error activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to IAM privileges." + ], + "from": "now-2h", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "rare_error_code", + "name": "Rare AWS Error Code", + "note": "## Triage and analysis\n\n### Investigating Rare AWS Error Code\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.\n\nThis rule uses a machine learning job to detect an unusual error in a CloudTrail message. This can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.\n\nDetection alerts from this rule indicate a rare and unusual error code that was associated with the response to an AWS API command or method call.\n\n#### Possible investigation steps\n\n- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.\n- Investigate other alerts associated with the user account during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, or network administrator activity.\n- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed when the error occurred.\n - Check whether the error is related to unsuccessful attempts to enumerate or access objects, data, or secrets.\n- Considering the source IP address and geolocation of the user who issued the command:\n - Do they look normal for the calling user?\n - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?\n - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?\n- Contact the account owner and confirm whether they are aware of this activity if suspicious.\n- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.\n\n### False positive analysis\n\n- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.\n- The adoption of new services or the addition of new functionality to scripts may generate false positives.\n\n### Related Rules\n\n- Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276\n- Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1\n- Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1\n- Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Disable or limit the account during the investigation and response.\n- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:\n - Identify the account role in the cloud environment.\n - Assess the criticality of affected services and servers.\n - Work with your IT team to identify and minimize the impact on users.\n - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.\n - Identify any regulatory or legal ramifications related to this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.\n- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.\n- Consider enabling multi-factor authentication for users.\n- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.\n- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n- Take the actions needed to return affected systems, data, or services to their normal operational levels.\n- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "aws", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "19de8096-e2b0-4bd8-80c9-34a820813fff", + "setup": "The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Domain: Cloud", + "Data Source: AWS", + "Data Source: Amazon Web Services", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Resources: Investigation Guide" + ], + "type": "machine_learning", + "version": 106 + }, + "id": "19de8096-e2b0-4bd8-80c9-34a820813fff_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1a6075b0-7479-450e-8fe7-b8b8438ac570_106.json b/packages/security_detection_engine/kibana/security_rule/1a6075b0-7479-450e-8fe7-b8b8438ac570_106.json new file mode 100644 index 00000000000..57dfe485f5b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1a6075b0-7479-450e-8fe7-b8b8438ac570_106.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Windows Component Object Model (COM) is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects or executable code. Xwizard can be used to run a COM object created in registry to evade defensive counter measures.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of COM object via Xwizard", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name : \"xwizard.exe\" and\n (\n (process.args : \"RunWizard\" and process.args : \"{*}\") or\n (process.executable != null and\n not process.executable : (\"C:\\\\Windows\\\\SysWOW64\\\\xwizard.exe\", \"C:\\\\Windows\\\\System32\\\\xwizard.exe\")\n )\n )\n", + "references": [ + "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/", + "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1a6075b0-7479-450e-8fe7-b8b8438ac570", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1559", + "name": "Inter-Process Communication", + "reference": "https://attack.mitre.org/techniques/T1559/", + "subtechnique": [ + { + "id": "T1559.001", + "name": "Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1559/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "1a6075b0-7479-450e-8fe7-b8b8438ac570_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1aa9181a-492b-4c01-8b16-fa0735786b2b_106.json b/packages/security_detection_engine/kibana/security_rule/1aa9181a-492b-4c01-8b16-fa0735786b2b_106.json new file mode 100644 index 00000000000..fafefa1a848 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1aa9181a-492b-4c01-8b16-fa0735786b2b_106.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to create new users. This is sometimes done by attackers to increase access or establish persistence on a system or domain.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "User Account Creation", + "note": "## Triage and analysis\n\n### Investigating User Account Creation\n\nAttackers may create new accounts (both local and domain) to maintain access to victim systems.\n\nThis rule identifies the usage of `net.exe` to create new accounts.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Identify if the account was added to privileged groups or assigned special privileges after creation.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.\n\n### Related rules\n\n- Creation of a Hidden Local User Account - 2edc8076-291e-41e9-81e4-e3fcbc97ae5e\n- Windows User Account Creation - 38e17753-f581-4644-84da-0d60a8318694\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Delete the created account.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"net.exe\", \"net1.exe\") and\n not process.parent.name : \"net.exe\" and\n (process.args : \"user\" and process.args : (\"/ad\", \"/add\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1aa9181a-492b-4c01-8b16-fa0735786b2b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "1aa9181a-492b-4c01-8b16-fa0735786b2b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1b21abcc-4d9f-4b08-a7f5-316f5f94b973_104.json b/packages/security_detection_engine/kibana/security_rule/1b21abcc-4d9f-4b08-a7f5-316f5f94b973_104.json new file mode 100644 index 00000000000..713a8c06bb5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1b21abcc-4d9f-4b08-a7f5-316f5f94b973_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to non-publicly routable IP addresses.", + "false_positives": [ + "Telnet can be used for both benign or malicious purposes. Telnet is included by default in some Linux distributions, so its presence is not inherently suspicious. The use of Telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as SSH. Telnet usage by non-automated tools or frameworks may be suspicious." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Connection to Internal Network via Telnet", + "query": "sequence by process.entity_id\n [process where host.os.type == \"linux\" and process.name == \"telnet\" and event.type == \"start\"]\n [network where host.os.type == \"linux\" and process.name == \"telnet\" and\n cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1b21abcc-4d9f-4b08-a7f5-316f5f94b973", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "1b21abcc-4d9f-4b08-a7f5-316f5f94b973_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1c27fa22-7727-4dd3-81c0-de6da5555feb_7.json b/packages/security_detection_engine/kibana/security_rule/1c27fa22-7727-4dd3-81c0-de6da5555feb_7.json new file mode 100644 index 00000000000..54de15f5bbd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1c27fa22-7727-4dd3-81c0-de6da5555feb_7.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple internal consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts.", + "from": "now-9m", + "index": [ + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Internal Linux SSH Brute Force Detected", + "note": "## Triage and analysis\n\n### Investigating Potential Internal Linux SSH Brute Force Detected\n\nThe rule identifies consecutive internal SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.\n\n#### Possible investigation steps\n\n- Investigate the login failure user name(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Related Rules\n\n- Potential External Linux SSH Brute Force Detected - fa210b61-b627-4e5e-86f4-17e8270656ab\n- Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", + "query": "sequence by host.id, source.ip, user.name with maxspan=5s\n [ authentication where host.os.type == \"linux\" and \n event.action in (\"ssh_login\", \"user_login\") and event.outcome == \"failure\" and\n cidrmatch(source.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \n \"::1\", \"FE80::/10\", \"FF00::/8\") ] with runs = 10\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1c27fa22-7727-4dd3-81c0-de6da5555feb", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 7 + }, + "id": "1c27fa22-7727-4dd3-81c0-de6da5555feb_7", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_107.json b/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_107.json new file mode 100644 index 00000000000..bbb734dd39d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_107.json @@ -0,0 +1,168 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence mechanisms for long term access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious File Creation in /etc for Persistence", + "query": "file where host.os.type == \"linux\" and event.type in (\"creation\", \"file_create_event\") and user.name == \"root\" and\nfile.path : (\"/etc/ld.so.conf.d/*\", \"/etc/cron.d/*\", \"/etc/sudoers.d/*\", \"/etc/rc.d/init.d/*\", \"/etc/systemd/system/*\",\n\"/usr//lib/systemd/system/*\") and not process.executable : (\"*/dpkg\", \"*/yum\", \"*/apt\", \"*/dnf\", \"*/rpm\", \"*/systemd\",\n\"*/snapd\", \"*/dnf-automatic\",\"*/yum-cron\", \"*/elastic-agent\", \"*/dnfdaemon-system\", \"*/bin/dockerd\", \"*/sbin/dockerd\",\n\"/kaniko/executor\", \"/usr/sbin/rhn_check\") and not file.extension == \"swp\"\n", + "references": [ + "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1c84dd64-7e6c-4bad-ac73-a5014ee37042", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Orbit", + "Threat: Lightning Framework", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + }, + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "1c84dd64-7e6c-4bad-ac73-a5014ee37042_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_108.json b/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_108.json new file mode 100644 index 00000000000..977d9c55870 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1c84dd64-7e6c-4bad-ac73-a5014ee37042_108.json @@ -0,0 +1,169 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the manual creation of files in specific etc directories, via user root, used by Linux malware to persist and elevate privileges on compromised systems. File creation in these directories should not be entirely common and could indicate a malicious binary or script installing persistence mechanisms for long term access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious File Creation in /etc for Persistence", + "query": "file where host.os.type == \"linux\" and event.type in (\"creation\", \"file_create_event\") and user.name == \"root\" and\nfile.path : (\"/etc/ld.so.conf.d/*\", \"/etc/cron.d/*\", \"/etc/sudoers.d/*\", \"/etc/rc.d/init.d/*\", \"/etc/systemd/system/*\",\n\"/usr/lib/systemd/system/*\") and not process.executable : (\"*/dpkg\", \"*/yum\", \"*/apt\", \"*/dnf\", \"*/rpm\", \"*/systemd\",\n\"*/snapd\", \"*/dnf-automatic\",\"*/yum-cron\", \"*/elastic-agent\", \"*/dnfdaemon-system\", \"*/bin/dockerd\", \"*/sbin/dockerd\",\n\"/kaniko/executor\", \"/usr/sbin/rhn_check\") and not file.extension in (\"swp\", \"swpx\", \"tmp\")\n", + "references": [ + "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/", + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1c84dd64-7e6c-4bad-ac73-a5014ee37042", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Orbit", + "Threat: Lightning Framework", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + }, + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "1c84dd64-7e6c-4bad-ac73-a5014ee37042_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_105.json b/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_105.json new file mode 100644 index 00000000000..46fe5fc49d0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_105.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an indication of lateral movement.", + "false_positives": [ + "WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming Execution via WinRM Remote Shell", + "query": "sequence by host.id with maxspan=30s\n [network where host.os.type == \"windows\" and process.pid == 4 and network.direction : (\"incoming\", \"ingress\") and\n destination.port in (5985, 5986) and network.protocol == \"http\" and source.ip != \"127.0.0.1\" and source.ip != \"::1\"]\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"winrshost.exe\" and not process.executable : \"?:\\\\Windows\\\\System32\\\\conhost.exe\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "1cd01db9-be24-4bef-8e7c-e923f0ff78ab", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.006", + "name": "Windows Remote Management", + "reference": "https://attack.mitre.org/techniques/T1021/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "1cd01db9-be24-4bef-8e7c-e923f0ff78ab_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_106.json b/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_106.json new file mode 100644 index 00000000000..acfc0071bbf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1cd01db9-be24-4bef-8e7c-e923f0ff78ab_106.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an indication of lateral movement.", + "false_positives": [ + "WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming Execution via WinRM Remote Shell", + "query": "sequence by host.id with maxspan=30s\n [network where host.os.type == \"windows\" and process.pid == 4 and network.direction : (\"incoming\", \"ingress\") and\n destination.port in (5985, 5986) and network.protocol == \"http\" and source.ip != \"127.0.0.1\" and source.ip != \"::1\"]\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"winrshost.exe\" and not process.executable : \"?:\\\\Windows\\\\System32\\\\conhost.exe\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "1cd01db9-be24-4bef-8e7c-e923f0ff78ab", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.006", + "name": "Windows Remote Management", + "reference": "https://attack.mitre.org/techniques/T1021/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "1cd01db9-be24-4bef-8e7c-e923f0ff78ab_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1d276579-3380-4095-ad38-e596a01bc64f_107.json b/packages/security_detection_engine/kibana/security_rule/1d276579-3380-4095-ad38-e596a01bc64f_107.json new file mode 100644 index 00000000000..409e4ebc9c3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1d276579-3380-4095-ad38-e596a01bc64f_107.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies built-in Windows script interpreters (cscript.exe or wscript.exe) being used to download an executable file from a remote destination.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Download via Script Interpreter", + "note": "## Triage and analysis\n\n### Investigating Remote File Download via Script Interpreter\n\nThe Windows Script Host (WSH) is a Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.\n\nAttackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but can also use them to download tools and utilities needed to accomplish their goals.\n\nThis rule looks for DLLs and executables downloaded using `cscript.exe` or `wscript.exe`.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze both the script and the executable involved using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id, process.entity_id\n [network where host.os.type == \"windows\" and process.name : (\"wscript.exe\", \"cscript.exe\") and network.protocol != \"dns\" and\n network.direction : (\"outgoing\", \"egress\") and network.type == \"ipv4\" and destination.ip != \"127.0.0.1\"\n ]\n [file where host.os.type == \"windows\" and event.type == \"creation\" and file.extension : (\"exe\", \"dll\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1d276579-3380-4095-ad38-e596a01bc64f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "1d276579-3380-4095-ad38-e596a01bc64f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1d72d014-e2ab-4707-b056-9b96abe7b511_106.json b/packages/security_detection_engine/kibana/security_rule/1d72d014-e2ab-4707-b056-9b96abe7b511_106.json new file mode 100644 index 00000000000..b46b1f655eb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1d72d014-e2ab-4707-b056-9b96abe7b511_106.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies domains commonly used by adversaries for post-exploitation IP lookups. It is common for adversaries to test for Internet access and acquire their external IP address after they have gained access to a system. Among others, this has been observed in campaigns leveraging the information stealer, Trickbot.", + "false_positives": [ + "If the domains listed in this rule are used as part of an authorized workflow, this rule will be triggered by those events. Validate that this is expected activity and tune the rule to fit your environment variables." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "External IP Lookup from Non-Browser Process", + "note": "## Triage and analysis\n\n### Investigating External IP Lookup from Non-Browser Process\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for connections to known IP lookup services through non-browser processes or non-installed programs. Using only the IP address of the compromised system, attackers can obtain valuable information such as the system's geographic location, the company that owns the IP, whether the system is cloud-hosted, and more.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Use the data collected through the analysis to investigate other machines affected in the environment.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "network where host.os.type == \"windows\" and network.protocol == \"dns\" and\n process.name != null and user.id not in (\"S-1-5-19\", \"S-1-5-20\") and\n event.action == \"lookup_requested\" and\n /* Add new external IP lookup services here */\n dns.question.name :\n (\n \"*api.ipify.org\",\n \"*freegeoip.app\",\n \"*checkip.amazonaws.com\",\n \"*checkip.dyndns.org\",\n \"*freegeoip.app\",\n \"*icanhazip.com\",\n \"*ifconfig.*\",\n \"*ipecho.net\",\n \"*ipgeoapi.com\",\n \"*ipinfo.io\",\n \"*ip.anysrc.net\",\n \"*myexternalip.com\",\n \"*myipaddress.com\",\n \"*showipaddress.com\",\n \"*whatismyipaddress.com\",\n \"*wtfismyip.com\",\n \"*ipapi.co\",\n \"*ip-lookup.net\",\n \"*ipstack.com\"\n ) and\n /* Insert noisy false positives here */\n not process.executable :\n (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\WWAHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\smartscreen.exe\",\n \"?:\\\\Windows\\\\System32\\\\MicrosoftEdgeCP.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Fiddler\\\\Fiddler.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft VS Code\\\\Code.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe\"\n )\n", + "references": [ + "https://community.jisc.ac.uk/blogs/csirt/article/trickbot-analysis-and-mitigation", + "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1d72d014-e2ab-4707-b056-9b96abe7b511", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1016", + "name": "System Network Configuration Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/", + "subtechnique": [ + { + "id": "T1016.001", + "name": "Internet Connection Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/001/" + } + ] + }, + { + "id": "T1614", + "name": "System Location Discovery", + "reference": "https://attack.mitre.org/techniques/T1614/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "1d72d014-e2ab-4707-b056-9b96abe7b511_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1d9aeb0b-9549-46f6-a32d-05e2a001b7fd_5.json b/packages/security_detection_engine/kibana/security_rule/1d9aeb0b-9549-46f6-a32d-05e2a001b7fd_5.json new file mode 100644 index 00000000000..9472f1cd213 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1d9aeb0b-9549-46f6-a32d-05e2a001b7fd_5.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions.", + "false_positives": [ + "Legitimate PowerShell Scripts which makes use of encryption." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Encryption/Decryption Capabilities", + "note": "## Triage and analysis\n\n### Investigating PowerShell Script with Encryption/Decryption Capabilities\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.\n\nPowerShell offers encryption and decryption functionalities that attackers can abuse for various purposes, such as concealing payloads, C2 communications, and encrypting data as part of ransomware operations.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n\n### False positive analysis\n\n- This is a dual-use mechanism, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the script doesn't contain malicious functions or potential for abuse, no other suspicious activity was identified, and there are justifications for the execution.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n (\n \"Cryptography.AESManaged\" or\n \"Cryptography.RijndaelManaged\" or\n \"Cryptography.SHA1Managed\" or\n \"Cryptography.SHA256Managed\" or\n \"Cryptography.SHA384Managed\" or\n \"Cryptography.SHA512Managed\" or\n \"Cryptography.SymmetricAlgorithm\" or\n \"PasswordDeriveBytes\" or\n \"Rfc2898DeriveBytes\"\n ) and\n (\n CipherMode and PaddingMode\n ) and\n (\n \".CreateEncryptor\" or\n \".CreateDecryptor\"\n )\n ) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1d9aeb0b-9549-46f6-a32d-05e2a001b7fd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: PowerShell Logs", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 5 + }, + "id": "1d9aeb0b-9549-46f6-a32d-05e2a001b7fd_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1dcc51f6-ba26-49e7-9ef4-2655abb2361e_104.json b/packages/security_detection_engine/kibana/security_rule/1dcc51f6-ba26-49e7-9ef4-2655abb2361e_104.json new file mode 100644 index 00000000000..29f4dd29a2f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1dcc51f6-ba26-49e7-9ef4-2655abb2361e_104.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies User Account Control (UAC) bypass via hijacking DiskCleanup Scheduled Task. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass via DiskCleanup Scheduled Task Hijack", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.args : \"/autoclean\" and process.args : \"/d\" and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\cleanmgr.exe\",\n \"C:\\\\Windows\\\\SysWOW64\\\\cleanmgr.exe\",\n \"C:\\\\Windows\\\\System32\\\\taskhostw.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1dcc51f6-ba26-49e7-9ef4-2655abb2361e", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "1dcc51f6-ba26-49e7-9ef4-2655abb2361e_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1dee0500-4aeb-44ca-b24b-4a285d7b6ba1_4.json b/packages/security_detection_engine/kibana/security_rule/1dee0500-4aeb-44ca-b24b-4a285d7b6ba1_4.json new file mode 100644 index 00000000000..543bec020ae --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1dee0500-4aeb-44ca-b24b-4a285d7b6ba1_4.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects Inter-Process Communication with Outlook via Component Object Model from an unusual process. Adversaries may target user email to collect sensitive information or send email on their behalf via API.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Inter-Process Communication via Outlook", + "query": "process where host.os.type == \"windows\" and event.action == \"start\" and process.name : \"OUTLOOK.EXE\" and\n process.Ext.effective_parent.name != null and\n not process.Ext.effective_parent.executable : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\")\n", + "references": [ + "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/apt29/Archive/CALDERA_DIY/evals/payloads/stepSeventeen_email.ps1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.effective_parent.executable", + "type": "unknown" + }, + { + "ecs": false, + "name": "process.Ext.effective_parent.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1114", + "name": "Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/", + "subtechnique": [ + { + "id": "T1114.001", + "name": "Local Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1559", + "name": "Inter-Process Communication", + "reference": "https://attack.mitre.org/techniques/T1559/", + "subtechnique": [ + { + "id": "T1559.001", + "name": "Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1559/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "1dee0500-4aeb-44ca-b24b-4a285d7b6ba1_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1defdd62-cd8d-426e-a246-81a37751bb2b_106.json b/packages/security_detection_engine/kibana/security_rule/1defdd62-cd8d-426e-a246-81a37751bb2b_106.json new file mode 100644 index 00000000000..2af42a556a2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1defdd62-cd8d-426e-a246-81a37751bb2b_106.json @@ -0,0 +1,127 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious file that was written by a PDF reader application and subsequently executed. These processes are often launched via exploitation of PDF applications.", + "from": "now-120m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of File Written or Modified by PDF Reader", + "note": "## Triage and analysis\n\n### Investigating Execution of File Written or Modified by PDF Reader\n\nPDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.\n\nThis rule searches for executable files written by PDF reader software and executed in sequence. This is most likely the result of exploitation for privilege escalation or initial access. This rule can also detect suspicious processes masquerading as PDF readers.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve the PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence with maxspan=2h\n [file where host.os.type == \"windows\" and event.type != \"deletion\" and file.extension : \"exe\" and\n (process.name : \"AcroRd32.exe\" or\n process.name : \"rdrcef.exe\" or\n process.name : \"FoxitPhantomPDF.exe\" or\n process.name : \"FoxitReader.exe\") and\n not (file.name : \"FoxitPhantomPDF.exe\" or\n file.name : \"FoxitPhantomPDFUpdater.exe\" or\n file.name : \"FoxitReader.exe\" or\n file.name : \"FoxitReaderUpdater.exe\" or\n file.name : \"AcroRd32.exe\" or\n file.name : \"rdrcef.exe\")\n ] by host.id, file.path\n [process where host.os.type == \"windows\" and event.type == \"start\"] by host.id, process.executable\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "1defdd62-cd8d-426e-a246-81a37751bb2b", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "1defdd62-cd8d-426e-a246-81a37751bb2b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_1.json b/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_1.json new file mode 100644 index 00000000000..185818db86a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_1.json @@ -0,0 +1,189 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Discovery Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n (\n (\"Get-ItemProperty\" or \"Get-Item\") and \"-Path\"\n ) or\n (\n \"Get-ADDefaultDomainPasswordPolicy\" or\n \"Get-ADDomain\" or \"Get-ComputerInfo\" or\n \"Get-Disk\" or \"Get-DnsClientCache\" or\n \"Get-GPOReport\" or \"Get-HotFix\" or\n \"Get-LocalUser\" or \"Get-NetFirewallProfile\" or\n \"get-nettcpconnection\" or \"Get-NetAdapter\" or\n \"Get-PhysicalDisk\" or \"Get-Process\" or\n \"Get-PSDrive\" or \"Get-Service\" or\n \"Get-SmbShare\" or \"Get-WinEvent\"\n ) or\n (\n (\"Get-WmiObject\" or \"gwmi\" or \"Get-CimInstance\" or\n \"gcim\" or \"Management.ManagementObjectSearcher\" or\n \"System.Management.ManagementClass\" or\n \"[WmiClass]\" or \"[WMI]\") and\n (\n \"AntiVirusProduct\" or \"CIM_BIOSElement\" or \"CIM_ComputerSystem\" or \"CIM_Product\" or \"CIM_DiskDrive\" or\n \"CIM_LogicalDisk\" or \"CIM_NetworkAdapter\" or \"CIM_StorageVolume\" or \"CIM_OperatingSystem\" or\n \"CIM_Process\" or \"CIM_Service\" or \"MSFT_DNSClientCache\" or \"Win32_BIOS\" or \"Win32_ComputerSystem\" or\n \"Win32_ComputerSystemProduct\" or \"Win32_DiskDrive\" or \"win32_environment\" or \"Win32_Group\" or\n \"Win32_groupuser\" or \"Win32_IP4RouteTable\" or \"Win32_logicaldisk\" or \"Win32_MappedLogicalDisk\" or\n \"Win32_NetworkAdapterConfiguration\" or \"win32_ntdomain\" or \"Win32_OperatingSystem\" or\n \"Win32_PnPEntity\" or \"Win32_Process\" or \"Win32_Product\" or \"Win32_quickfixengineering\" or\n \"win32_service\" or \"Win32_Share\" or \"Win32_UserAccount\"\n )\n ) or\n (\n (\"ADSI\" and \"WinNT\") or\n (\"Get-ChildItem\" and \"sysmondrv.sys\") or\n (\"::GetIPGlobalProperties()\" and \"GetActiveTcpConnections()\") or\n (\"ServiceProcess.ServiceController\" and \"::GetServices\") or\n (\"Diagnostics.Process\" and \"::GetProcesses\") or\n (\"DirectoryServices.Protocols.GroupPolicy\" and \".GetGPOReport()\") or\n (\"DirectoryServices.AccountManagement\" and \"PrincipalSearcher\") or\n (\"NetFwTypeLib.NetFwMgr\" and \"CurrentProfile\") or\n (\"NetworkInformation.NetworkInterface\" and \"GetAllNetworkInterfaces\") or\n (\"Automation.PSDriveInfo\") or\n (\"Microsoft.Win32.RegistryHive\")\n ) or\n (\n \"Get-ItemProperty\" and\n (\n \"\\Control\\SecurityProviders\\WDigest\" or\n \"\\microsoft\\windows\\currentversion\\explorer\\runmru\" or\n \"\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\" or\n \"\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" or\n \"\\Microsoft\\Windows\\WindowsUpdate\" or\n \"Policies\\Microsoft\\Windows\\Installer\" or\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" or\n (\"\\Services\\SharedAccess\\Parameters\\FirewallPolicy\" and \"EnableFirewall\") or\n (\"Microsoft\\Windows\\CurrentVersion\\Internet Settings\" and \"proxyEnable\")\n )\n ) or\n (\n (\"Directoryservices.Activedirectory\" or\n \"DirectoryServices.AccountManagement\") and \n (\n \"Domain Admins\" or \"DomainControllers\" or\n \"FindAllGlobalCatalogs\" or \"GetAllTrustRelationships\" or\n \"GetCurrentDomain\" or \"GetCurrentForest\"\n ) or\n \"DirectoryServices.DirectorySearcher\" and\n (\n \"samAccountType=805306368\" or\n \"samAccountType=805306369\" or\n \"objectCategory=group\" or\n \"objectCategory=groupPolicyContainer\" or\n \"objectCategory=site\" or\n \"objectCategory=subnet\" or\n \"objectClass=trustedDomain\"\n )\n ) or\n (\n \"Get-Process\" and\n (\n \"mcshield\" or \"windefend\" or \"savservice\" or\n \"TMCCSF\" or \"symantec antivirus\" or\n \"CSFalcon\" or \"TmPfw\" or \"kvoop\"\n )\n )\n ) and not user.id : (\"S-1-5-18\" or \"S-1-5-19\" or \"S-1-5-20\")\n and not file.path : (*WindowsPowerShell*Modules*.psd1 or *WindowsPowerShell*Modules*.psm1)\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Tactic: Discovery", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + }, + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + }, + { + "id": "T1083", + "name": "File and Directory Discovery", + "reference": "https://attack.mitre.org/techniques/T1083/" + }, + { + "id": "T1615", + "name": "Group Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1615/" + }, + { + "id": "T1135", + "name": "Network Share Discovery", + "reference": "https://attack.mitre.org/techniques/T1135/" + }, + { + "id": "T1201", + "name": "Password Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1201/" + }, + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + }, + { + "id": "T1012", + "name": "Query Registry", + "reference": "https://attack.mitre.org/techniques/T1012/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + }, + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + }, + { + "id": "T1007", + "name": "System Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1007/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_2.json b/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_2.json new file mode 100644 index 00000000000..b54e7a89b57 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_2.json @@ -0,0 +1,194 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to discovery activities. Attackers can use these to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Discovery Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n (\n (\"Get-ItemProperty\" or \"Get-Item\") and \"-Path\"\n ) or\n (\n \"Get-ADDefaultDomainPasswordPolicy\" or\n \"Get-ADDomain\" or \"Get-ComputerInfo\" or\n \"Get-Disk\" or \"Get-DnsClientCache\" or\n \"Get-GPOReport\" or \"Get-HotFix\" or\n \"Get-LocalUser\" or \"Get-NetFirewallProfile\" or\n \"get-nettcpconnection\" or \"Get-NetAdapter\" or\n \"Get-PhysicalDisk\" or \"Get-Process\" or\n \"Get-PSDrive\" or \"Get-Service\" or\n \"Get-SmbShare\" or \"Get-WinEvent\"\n ) or\n (\n (\"Get-WmiObject\" or \"gwmi\" or \"Get-CimInstance\" or\n \"gcim\" or \"Management.ManagementObjectSearcher\" or\n \"System.Management.ManagementClass\" or\n \"[WmiClass]\" or \"[WMI]\") and\n (\n \"AntiVirusProduct\" or \"CIM_BIOSElement\" or \"CIM_ComputerSystem\" or \"CIM_Product\" or \"CIM_DiskDrive\" or\n \"CIM_LogicalDisk\" or \"CIM_NetworkAdapter\" or \"CIM_StorageVolume\" or \"CIM_OperatingSystem\" or\n \"CIM_Process\" or \"CIM_Service\" or \"MSFT_DNSClientCache\" or \"Win32_BIOS\" or \"Win32_ComputerSystem\" or\n \"Win32_ComputerSystemProduct\" or \"Win32_DiskDrive\" or \"win32_environment\" or \"Win32_Group\" or\n \"Win32_groupuser\" or \"Win32_IP4RouteTable\" or \"Win32_logicaldisk\" or \"Win32_MappedLogicalDisk\" or\n \"Win32_NetworkAdapterConfiguration\" or \"win32_ntdomain\" or \"Win32_OperatingSystem\" or\n \"Win32_PnPEntity\" or \"Win32_Process\" or \"Win32_Product\" or \"Win32_quickfixengineering\" or\n \"win32_service\" or \"Win32_Share\" or \"Win32_UserAccount\"\n )\n ) or\n (\n (\"ADSI\" and \"WinNT\") or\n (\"Get-ChildItem\" and \"sysmondrv.sys\") or\n (\"::GetIPGlobalProperties()\" and \"GetActiveTcpConnections()\") or\n (\"ServiceProcess.ServiceController\" and \"::GetServices\") or\n (\"Diagnostics.Process\" and \"::GetProcesses\") or\n (\"DirectoryServices.Protocols.GroupPolicy\" and \".GetGPOReport()\") or\n (\"DirectoryServices.AccountManagement\" and \"PrincipalSearcher\") or\n (\"NetFwTypeLib.NetFwMgr\" and \"CurrentProfile\") or\n (\"NetworkInformation.NetworkInterface\" and \"GetAllNetworkInterfaces\") or\n (\"Automation.PSDriveInfo\") or\n (\"Microsoft.Win32.RegistryHive\")\n ) or\n (\n \"Get-ItemProperty\" and\n (\n \"\\Control\\SecurityProviders\\WDigest\" or\n \"\\microsoft\\windows\\currentversion\\explorer\\runmru\" or\n \"\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\Parameters\" or\n \"\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" or\n \"\\Microsoft\\Windows\\WindowsUpdate\" or\n \"Policies\\Microsoft\\Windows\\Installer\" or\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\" or\n (\"\\Services\\SharedAccess\\Parameters\\FirewallPolicy\" and \"EnableFirewall\") or\n (\"Microsoft\\Windows\\CurrentVersion\\Internet Settings\" and \"proxyEnable\")\n )\n ) or\n (\n (\"Directoryservices.Activedirectory\" or\n \"DirectoryServices.AccountManagement\") and \n (\n \"Domain Admins\" or \"DomainControllers\" or\n \"FindAllGlobalCatalogs\" or \"GetAllTrustRelationships\" or\n \"GetCurrentDomain\" or \"GetCurrentForest\"\n ) or\n \"DirectoryServices.DirectorySearcher\" and\n (\n \"samAccountType=805306368\" or\n \"samAccountType=805306369\" or\n \"objectCategory=group\" or\n \"objectCategory=groupPolicyContainer\" or\n \"objectCategory=site\" or\n \"objectCategory=subnet\" or\n \"objectClass=trustedDomain\"\n )\n ) or\n (\n \"Get-Process\" and\n (\n \"mcshield\" or \"windefend\" or \"savservice\" or\n \"TMCCSF\" or \"symantec antivirus\" or\n \"CSFalcon\" or \"TmPfw\" or \"kvoop\"\n )\n )\n ) and not user.id : (\"S-1-5-18\" or \"S-1-5-19\" or \"S-1-5-20\")\n and not file.path : (\n *WindowsPowerShell*Modules*.psd1 or\n *WindowsPowerShell*Modules*.psm1 or \n \"C:\\\\Program Files\\\\Microsoft Azure AD Sync\\\\Extensions\\\\AADConnector.psm1\"\n )\n and not (file.path : (\n *Windows*TEMP*SDIAG* or\n *WINDOWS*TEMP*SDIAG* or\n *windows*TEMP*SDIAG*) and file.name : \"CL_Utility.ps1\")\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Tactic: Discovery", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + }, + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + }, + { + "id": "T1083", + "name": "File and Directory Discovery", + "reference": "https://attack.mitre.org/techniques/T1083/" + }, + { + "id": "T1615", + "name": "Group Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1615/" + }, + { + "id": "T1135", + "name": "Network Share Discovery", + "reference": "https://attack.mitre.org/techniques/T1135/" + }, + { + "id": "T1201", + "name": "Password Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1201/" + }, + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + }, + { + "id": "T1012", + "name": "Query Registry", + "reference": "https://attack.mitre.org/techniques/T1012/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + }, + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + }, + { + "id": "T1007", + "name": "System Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1007/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 2 + }, + "id": "1e0a3f7c-21e7-4bb1-98c7-2036612fb1be_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1e6363a6-3af5-41d4-b7ea-d475389c0ceb_1.json b/packages/security_detection_engine/kibana/security_rule/1e6363a6-3af5-41d4-b7ea-d475389c0ceb_1.json new file mode 100644 index 00000000000..e8e4fd57ebd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1e6363a6-3af5-41d4-b7ea-d475389c0ceb_1.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the suspicious creation of SettingContents-ms files, which have been used in attacks to achieve code execution while evading defenses.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Creation of SettingContent-ms Files", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n file.extension : \"settingcontent-ms\"\n", + "references": [ + "https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1e6363a6-3af5-41d4-b7ea-d475389c0ceb", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "1e6363a6-3af5-41d4-b7ea-d475389c0ceb_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1e9fc667-9ff1-4b33-9f40-fefca8537eb0_103.json b/packages/security_detection_engine/kibana/security_rule/1e9fc667-9ff1-4b33-9f40-fefca8537eb0_103.json new file mode 100644 index 00000000000..6faa41aa8c5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1e9fc667-9ff1-4b33-9f40-fefca8537eb0_103.json @@ -0,0 +1,76 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "Looks for sudo activity from an unusual user context. An unusual sudo user could be due to troubleshooting activity or it could be a sign of credentialed access via compromised accounts.", + "false_positives": [ + "Uncommon sudo activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_rare_sudo_user" + ], + "name": "Unusual Sudo Activity", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "1e9fc667-9ff1-4b33-9f40-fefca8537eb0", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "1e9fc667-9ff1-4b33-9f40-fefca8537eb0_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1f0a69c0-3392-4adf-b7d5-6012fd292da8_6.json b/packages/security_detection_engine/kibana/security_rule/1f0a69c0-3392-4adf-b7d5-6012fd292da8_6.json new file mode 100644 index 00000000000..4698a6b530b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1f0a69c0-3392-4adf-b7d5-6012fd292da8_6.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Antimalware Scan Interface Bypass via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Potential Antimalware Scan Interface Bypass via PowerShell\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nThe Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.\n\nThis rule identifies scripts that contain methods and classes that can be abused to bypass AMSI.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Determine whether the script was executed and capture relevant information, such as arguments that reveal intent or are indicators of compromise (IoCs).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate commands and scripts executed after this activity was observed.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:\"process\" and host.os.type:windows and\n (powershell.file.script_block_text :\n (\"System.Management.Automation.AmsiUtils\" or\n\t\t\t\t amsiInitFailed or \n\t\t\t\t \"Invoke-AmsiBypass\" or \n\t\t\t\t \"Bypass.AMSI\" or \n\t\t\t\t \"amsi.dll\" or \n\t\t\t\t AntimalwareProvider or \n\t\t\t\t amsiSession or \n\t\t\t\t amsiContext or\n\t\t\t\t AmsiInitialize or \n\t\t\t\t unloadobfuscated or \n\t\t\t\t unloadsilent or \n\t\t\t\t AmsiX64 or \n\t\t\t\t AmsiX32 or \n\t\t\t\t FindAmsiFun) or\n powershell.file.script_block_text:(\"[System.Runtime.InteropServices.Marshal]::Copy\" and \"VirtualProtect\") or\n powershell.file.script_block_text:(\"[Ref].Assembly.GetType(('System.Management.Automation\" and \".SetValue(\")\n )\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n", + "references": [ + "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 73, + "rule_id": "1f0a69c0-3392-4adf-b7d5-6012fd292da8", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: PowerShell Logs", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 6 + }, + "id": "1f0a69c0-3392-4adf-b7d5-6012fd292da8_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1f460f12-a3cf-4105-9ebb-f788cc63f365_1.json b/packages/security_detection_engine/kibana/security_rule/1f460f12-a3cf-4105-9ebb-f788cc63f365_1.json new file mode 100644 index 00000000000..e7314aca9fe --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1f460f12-a3cf-4105-9ebb-f788cc63f365_1.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies unusual processes running from the WBEM path, uncommon outside WMI-related Windows processes.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Process Execution on WBEM Path", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.executable : (\"?:\\\\Windows\\\\System32\\\\wbem\\\\*\", \"?:\\\\Windows\\\\SysWow64\\\\wbem\\\\*\") and\n not process.name : (\n \"mofcomp.exe\",\n \"scrcons.exe\",\n \"unsecapp.exe\",\n \"wbemtest.exe\",\n \"winmgmt.exe\",\n \"wmiadap.exe\",\n \"wmiapsrv.exe\",\n \"wmic.exe\",\n \"wmiprvse.exe\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "1f460f12-a3cf-4105-9ebb-f788cc63f365", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "1f460f12-a3cf-4105-9ebb-f788cc63f365_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1faec04b-d902-4f89-8aff-92cd9043c16f_103.json b/packages/security_detection_engine/kibana/security_rule/1faec04b-d902-4f89-8aff-92cd9043c16f_103.json new file mode 100644 index 00000000000..c873a1733c1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1faec04b-d902-4f89-8aff-92cd9043c16f_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.", + "false_positives": [ + "A newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. Manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_rare_metadata_user" + ], + "name": "Unusual Linux User Calling the Metadata Service", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "1faec04b-d902-4f89-8aff-92cd9043c16f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.005", + "name": "Cloud Instance Metadata API", + "reference": "https://attack.mitre.org/techniques/T1552/005/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "1faec04b-d902-4f89-8aff-92cd9043c16f_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/1fe3b299-fbb5-4657-a937-1d746f2c711a_107.json b/packages/security_detection_engine/kibana/security_rule/1fe3b299-fbb5-4657-a937-1d746f2c711a_107.json new file mode 100644 index 00000000000..6cafd711b3e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/1fe3b299-fbb5-4657-a937-1d746f2c711a_107.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Network Activity from a Windows System Binary", + "note": "## Triage and analysis\n\n### Investigating Unusual Network Activity from a Windows System Binary\n\nAttackers can abuse certain trusted developer utilities to proxy the execution of malicious payloads. Since these utilities are usually signed, they can bypass the security controls that were put in place to prevent or detect direct execution.\n\nThis rule identifies network connections established by trusted developer utilities, which can indicate abuse to execute payloads or process masquerading.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- As trusted developer utilities have dual-use purposes, alerts derived from this rule are not essentially malicious. If these utilities are contacting internal or known trusted domains, review their security and consider creating exceptions if the domain is safe.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id with maxspan=5m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n\n /* known applocker bypasses */\n (process.name : \"bginfo.exe\" or\n process.name : \"cdb.exe\" or\n process.name : \"control.exe\" or\n process.name : \"cmstp.exe\" or\n process.name : \"csi.exe\" or\n process.name : \"dnx.exe\" or\n process.name : \"fsi.exe\" or\n process.name : \"ieexec.exe\" or\n process.name : \"iexpress.exe\" or\n process.name : \"installutil.exe\" or\n process.name : \"Microsoft.Workflow.Compiler.exe\" or\n process.name : \"MSBuild.exe\" or\n process.name : \"msdt.exe\" or\n process.name : \"mshta.exe\" or\n process.name : \"msiexec.exe\" or\n process.name : \"msxsl.exe\" or\n process.name : \"odbcconf.exe\" or\n process.name : \"rcsi.exe\" or\n process.name : \"regsvr32.exe\" or\n process.name : \"xwizard.exe\")]\n [network where\n (process.name : \"bginfo.exe\" or\n process.name : \"cdb.exe\" or\n process.name : \"control.exe\" or\n process.name : \"cmstp.exe\" or\n process.name : \"csi.exe\" or\n process.name : \"dnx.exe\" or\n process.name : \"fsi.exe\" or\n process.name : \"ieexec.exe\" or\n process.name : \"iexpress.exe\" or\n process.name : \"installutil.exe\" or\n process.name : \"Microsoft.Workflow.Compiler.exe\" or\n process.name : \"MSBuild.exe\" or\n process.name : \"msdt.exe\" or\n process.name : \"mshta.exe\" or\n (\n process.name : \"msiexec.exe\" and not\n dns.question.name : (\n \"ocsp.digicert.com\", \"ocsp.verisign.com\", \"ocsp.comodoca.com\", \"ocsp.entrust.net\", \"ocsp.usertrust.com\",\n \"ocsp.godaddy.com\", \"ocsp.camerfirma.com\", \"ocsp.globalsign.com\", \"ocsp.sectigo.com\", \"*.local\"\n )\n ) or\n process.name : \"msxsl.exe\" or\n process.name : \"odbcconf.exe\" or\n process.name : \"rcsi.exe\" or\n process.name : \"regsvr32.exe\" or\n process.name : \"xwizard.exe\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "1fe3b299-fbb5-4657-a937-1d746f2c711a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "1fe3b299-fbb5-4657-a937-1d746f2c711a_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/201200f1-a99b-43fb-88ed-f65a45c4972c_106.json b/packages/security_detection_engine/kibana/security_rule/201200f1-a99b-43fb-88ed-f65a45c4972c_106.json new file mode 100644 index 00000000000..5fd84a5bdd9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/201200f1-a99b-43fb-88ed-f65a45c4972c_106.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious .NET code execution. connections.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious .NET Code Compilation", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"csc.exe\", \"vbc.exe\") and\n process.parent.name : (\"wscript.exe\", \"mshta.exe\", \"cscript.exe\", \"wmic.exe\", \"svchost.exe\", \"rundll32.exe\", \"cmstp.exe\", \"regsvr32.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "201200f1-a99b-43fb-88ed-f65a45c4972c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/", + "subtechnique": [ + { + "id": "T1027.004", + "name": "Compile After Delivery", + "reference": "https://attack.mitre.org/techniques/T1027/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "201200f1-a99b-43fb-88ed-f65a45c4972c_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/203ab79b-239b-4aa5-8e54-fc50623ee8e4_106.json b/packages/security_detection_engine/kibana/security_rule/203ab79b-239b-4aa5-8e54-fc50623ee8e4_106.json new file mode 100644 index 00000000000..10fb878d464 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/203ab79b-239b-4aa5-8e54-fc50623ee8e4_106.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a local trusted root certificate in Windows. The install of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.", + "false_positives": [ + "Certain applications may install root certificates for the purpose of inspecting SSL traffic." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation or Modification of Root Certificate", + "note": "## Triage and analysis\n\n### Investigating Creation or Modification of Root Certificate\n\nRoot certificates are the primary level of certifications that tell a browser that the communication is trusted and legitimate. This verification is based upon the identification of a certification authority. Windows adds several trusted root certificates so browsers can use them to communicate with websites.\n\n[Check out this post](https://www.thewindowsclub.com/what-are-root-certificates-windows) for more details on root certificates and the involved cryptography.\n\nThis rule identifies the creation or modification of a root certificate by monitoring registry modifications. The installation of a malicious root certificate would allow an attacker the ability to masquerade malicious files as valid signed components from any entity (for example, Microsoft). It could also allow an attacker to decrypt SSL traffic.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate abnormal behaviors observed by the subject process such as network connections, other registry or file modifications, and any spawned child processes.\n- If one of the processes is suspicious, retrieve it and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove the malicious certificate from the root certificate store.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n registry.path :\n (\n \"HKLM\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\Root\\\\Certificates\\\\*\\\\Blob\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\SystemCertificates\\\\AuthRoot\\\\Certificates\\\\*\\\\Blob\"\n ) and\n not process.executable :\n (\"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\*.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\*.exe\",\n \"?:\\\\Windows\\\\Sysmon64.exe\",\n \"?:\\\\Windows\\\\Sysmon.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"?:\\\\Windows\\\\WinSxS\\\\*.exe\",\n \"?:\\\\Windows\\\\UUS\\\\amd64\\\\MoUsoCoreWorker.exe\")\n", + "references": [ + "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", + "https://www.ired.team/offensive-security/persistence/t1130-install-root-certificate" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "203ab79b-239b-4aa5-8e54-fc50623ee8e4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.004", + "name": "Install Root Certificate", + "reference": "https://attack.mitre.org/techniques/T1553/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "203ab79b-239b-4aa5-8e54-fc50623ee8e4_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/20457e4f-d1de-4b92-ae69-142e27a4342a_104.json b/packages/security_detection_engine/kibana/security_rule/20457e4f-d1de-4b92-ae69-142e27a4342a_104.json new file mode 100644 index 00000000000..4b0e094e795 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/20457e4f-d1de-4b92-ae69-142e27a4342a_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a process with arguments pointing to known browser files that store passwords and cookies. Adversaries may acquire credentials from web browsers by reading files specific to the target browser.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Access of Stored Browser Credentials", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.args :\n (\n \"/Users/*/Library/Application Support/Google/Chrome/Default/Login Data\",\n \"/Users/*/Library/Application Support/Google/Chrome/Default/Cookies\",\n \"/Users/*/Library/Application Support/Google/Chrome/Profile*/Cookies\",\n \"/Users/*/Library/Cookies*\",\n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/cookies.sqlite\",\n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/key*.db\",\n \"/Users/*/Library/Application Support/Firefox/Profiles/*.default/logins.json\",\n \"Login Data\",\n \"Cookies.binarycookies\",\n \"key4.db\",\n \"key3.db\",\n \"logins.json\",\n \"cookies.sqlite\"\n )\n", + "references": [ + "https://securelist.com/calisto-trojan-for-macos/86543/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "20457e4f-d1de-4b92-ae69-142e27a4342a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1539", + "name": "Steal Web Session Cookie", + "reference": "https://attack.mitre.org/techniques/T1539/" + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.003", + "name": "Credentials from Web Browsers", + "reference": "https://attack.mitre.org/techniques/T1555/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "20457e4f-d1de-4b92-ae69-142e27a4342a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/205b52c4-9c28-4af4-8979-935f3278d61a_1.json b/packages/security_detection_engine/kibana/security_rule/205b52c4-9c28-4af4-8979-935f3278d61a_1.json new file mode 100644 index 00000000000..e94201e5053 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/205b52c4-9c28-4af4-8979-935f3278d61a_1.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the registration of a Werfault Debugger. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed with the \"-pr\" parameter.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Werfault ReflectDebugger Persistence", + "query": "registry where event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\Windows Error Reporting\\\\Hangs\\\\ReflectDebugger\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\Windows Error Reporting\\\\Hangs\\\\ReflectDebugger\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "205b52c4-9c28-4af4-8979-935f3278d61a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "205b52c4-9c28-4af4-8979-935f3278d61a_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/210d4430-b371-470e-b879-80b7182aa75e_1.json b/packages/security_detection_engine/kibana/security_rule/210d4430-b371-470e-b879-80b7182aa75e_1.json new file mode 100644 index 00000000000..a3903c7e7a1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/210d4430-b371-470e-b879-80b7182aa75e_1.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Managed Object Format (MOF) files can be compiled locally or remotely through mofcomp.exe. Attackers may leverage MOF files to build their own namespaces and classes into the Windows Management Instrumentation (WMI) repository, or establish persistence using WMI Event Subscription.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Mofcomp Activity", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"mofcomp.exe\" and process.args : \"*.mof\" and\n not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "210d4430-b371-470e-b879-80b7182aa75e", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.003", + "name": "Windows Management Instrumentation Event Subscription", + "reference": "https://attack.mitre.org/techniques/T1546/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "210d4430-b371-470e-b879-80b7182aa75e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/220be143-5c67-4fdb-b6ce-dd6826d024fd_5.json b/packages/security_detection_engine/kibana/security_rule/220be143-5c67-4fdb-b6ce-dd6826d024fd_5.json new file mode 100644 index 00000000000..9e9f5228dd3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/220be143-5c67-4fdb-b6ce-dd6826d024fd_5.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the enable of the full user-mode dumps feature system-wide. This feature allows Windows Error Reporting (WER) to collect data after an application crashes. This setting is a requirement for the LSASS Shtinkering attack, which fakes the communication of a crash on LSASS, generating a dump of the process memory, which gives the attacker access to the credentials present on the system without having to bring malware to the system. This setting is not enabled by default, and applications must create their registry subkeys to hold settings that enable them to collect dumps.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Full User-Mode Dumps Enabled System-Wide", + "query": "registry where host.os.type == \"windows\" and registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\Windows Error Reporting\\\\LocalDumps\\\\DumpType\" and\n registry.data.strings : (\"2\", \"0x00000002\") and\n not (process.executable : \"?:\\\\Windows\\\\system32\\\\svchost.exe\" and user.id : (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\"))\n", + "references": [ + "https://docs.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps", + "https://github.com/deepinstinct/Lsass-Shtinkering", + "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "220be143-5c67-4fdb-b6ce-dd6826d024fd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "220be143-5c67-4fdb-b6ce-dd6826d024fd_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f_104.json b/packages/security_detection_engine/kibana/security_rule/2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f_104.json new file mode 100644 index 00000000000..9ae13941163 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f_104.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The Secure Shell (SSH) authorized_keys file specifies which users are allowed to log into a server using public key authentication. Adversaries may modify it to maintain persistence on a victim host by adding their own public key(s).", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "SSH Authorized Keys File Modification", + "query": "event.category:file and event.type:(change or creation) and\n file.name:(\"authorized_keys\" or \"authorized_keys2\" or \"/etc/ssh/sshd_config\" or \"/root/.ssh\") and\n not process.executable:\n (/Library/Developer/CommandLineTools/usr/bin/git or\n /usr/local/Cellar/maven/*/libexec/bin/mvn or\n /Library/Java/JavaVirtualMachines/jdk*.jdk/Contents/Home/bin/java or\n /usr/bin/vim or\n /usr/local/Cellar/coreutils/*/bin/gcat or\n /usr/bin/bsdtar or\n /usr/bin/nautilus or\n /usr/bin/scp or\n /usr/bin/touch or\n /var/lib/docker/* or\n /usr/bin/google_guest_agent or \n /opt/jc/bin/jumpcloud-agent)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1098", + "name": "Account Manipulation", + "reference": "https://attack.mitre.org/techniques/T1098/", + "subtechnique": [ + { + "id": "T1098.004", + "name": "SSH Authorized Keys", + "reference": "https://attack.mitre.org/techniques/T1098/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1563", + "name": "Remote Service Session Hijacking", + "reference": "https://attack.mitre.org/techniques/T1563/", + "subtechnique": [ + { + "id": "T1563.001", + "name": "SSH Hijacking", + "reference": "https://attack.mitre.org/techniques/T1563/001/" + } + ] + }, + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.004", + "name": "SSH", + "reference": "https://attack.mitre.org/techniques/T1021/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "2215b8bd-1759-4ffa-8ab8-55c8e6b32e7f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/22599847-5d13-48cb-8872-5796fee8692b_107.json b/packages/security_detection_engine/kibana/security_rule/22599847-5d13-48cb-8872-5796fee8692b_107.json new file mode 100644 index 00000000000..b91974195d4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/22599847-5d13-48cb-8872-5796fee8692b_107.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The malware known as SUNBURST targets the SolarWind's Orion business software for command and control. This rule detects post-exploitation command and control activity of the SUNBURST backdoor.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "SUNBURST Command and Control Activity", + "note": "## Triage and analysis\n\n### Investigating SUNBURST Command and Control Activity\n\nSUNBURST is a trojanized version of a digitally signed SolarWinds Orion plugin called SolarWinds.Orion.Core.BusinessLayer.dll. The plugin contains a backdoor that communicates via HTTP to third-party servers. After an initial dormant period of up to two weeks, SUNBURST may retrieve and execute commands that instruct the backdoor to transfer files, execute files, profile the system, reboot the system, and disable system services. The malware's network traffic attempts to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol, and the malware stores persistent state data within legitimate plugin configuration files. The backdoor uses multiple obfuscated blocklists to identify processes, services, and drivers associated with forensic and anti-virus tools.\n\nMore details on SUNBURST can be found on the [Mandiant Report](https://www.mandiant.com/resources/sunburst-additional-technical-details).\n\nThis rule identifies suspicious network connections that attempt to blend in with legitimate SolarWinds activity by imitating the Orion Improvement Program (OIP) protocol behavior.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the executable involved using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the environment at risk.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Reimage the host operating system and restore compromised files to clean versions.\n- Upgrade SolarWinds systems to the latest version to eradicate the chance of reinfection by abusing the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "network where host.os.type == \"windows\" and event.type == \"protocol\" and network.protocol == \"http\" and\n process.name : (\"ConfigurationWizard.exe\",\n \"NetFlowService.exe\",\n \"NetflowDatabaseMaintenance.exe\",\n \"SolarWinds.Administration.exe\",\n \"SolarWinds.BusinessLayerHost.exe\",\n \"SolarWinds.BusinessLayerHostx64.exe\",\n \"SolarWinds.Collector.Service.exe\",\n \"SolarwindsDiagnostics.exe\") and\n (\n (\n (http.request.body.content : \"*/swip/Upload.ashx*\" and http.request.body.content : (\"POST*\", \"PUT*\")) or\n (http.request.body.content : (\"*/swip/SystemDescription*\", \"*/swip/Events*\") and http.request.body.content : (\"GET*\", \"HEAD*\"))\n ) and\n not http.request.body.content : \"*solarwinds.com*\"\n )\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "http.request.body.content", + "type": "wildcard" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "22599847-5d13-48cb-8872-5796fee8692b", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1195", + "name": "Supply Chain Compromise", + "reference": "https://attack.mitre.org/techniques/T1195/", + "subtechnique": [ + { + "id": "T1195.002", + "name": "Compromise Software Supply Chain", + "reference": "https://attack.mitre.org/techniques/T1195/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "22599847-5d13-48cb-8872-5796fee8692b_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2339f03c-f53f-40fa-834b-40c5983fc41f_105.json b/packages/security_detection_engine/kibana/security_rule/2339f03c-f53f-40fa-834b-40c5983fc41f_105.json new file mode 100644 index 00000000000..286fd8eaa39 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2339f03c-f53f-40fa-834b-40c5983fc41f_105.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of the insmod binary to load a Linux kernel object file. Threat actors can use this binary, given they have root privileges, to load a rootkit on a system providing them with complete control and the ability to hide from security products. Manually loading a kernel module in this manner should not be at all common and can indicate suspcious or malicious behavior.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kernel module load via insmod", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and process.name == \"insmod\" and process.args : \"*.ko\"\n", + "references": [ + "https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2339f03c-f53f-40fa-834b-40c5983fc41f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Rootkit", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "2339f03c-f53f-40fa-834b-40c5983fc41f_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/25224a80-5a4a-4b8a-991e-6ab390465c4f_104.json b/packages/security_detection_engine/kibana/security_rule/25224a80-5a4a-4b8a-991e-6ab390465c4f_104.json new file mode 100644 index 00000000000..5ab79a57a5b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/25224a80-5a4a-4b8a-991e-6ab390465c4f_104.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Lateral Movement via Startup Folder", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n\n /* via RDP TSClient mounted share or SMB */\n (process.name : \"mstsc.exe\" or process.pid == 4) and\n\n file.path : (\"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\")\n", + "references": [ + "https://www.mdsec.co.uk/2017/06/rdpinception/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "25224a80-5a4a-4b8a-991e-6ab390465c4f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "25224a80-5a4a-4b8a-991e-6ab390465c4f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_1.json b/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_1.json new file mode 100644 index 00000000000..d7f49958db0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_1.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the built-in Linux DebugFS utility to access a disk device without root permissions. Linux users that are part of the \"disk\" group have sufficient privileges to access all data inside of the machine through DebugFS. Attackers may leverage DebugFS in conjunction with \"disk\" permissions to read sensitive files owned by root, such as the shadow file, root ssh private keys or other sensitive files that may allow them to further escalate privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Suspicious DebugFS Root Device Access", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and event.type == \"start\" and \nprocess.name == \"debugfs\" and process.args : \"/dev/sd*\" and not user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#disk-group" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "2605aa59-29ac-4662-afad-8d86257c7c91", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "2605aa59-29ac-4662-afad-8d86257c7c91_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_2.json b/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_2.json new file mode 100644 index 00000000000..5034ebe8d7d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2605aa59-29ac-4662-afad-8d86257c7c91_2.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the built-in Linux DebugFS utility to access a disk device without root permissions. Linux users that are part of the \"disk\" group have sufficient privileges to access all data inside of the machine through DebugFS. Attackers may leverage DebugFS in conjunction with \"disk\" permissions to read sensitive files owned by root, such as the shadow file, root ssh private keys or other sensitive files that may allow them to further escalate privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Suspicious DebugFS Root Device Access", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and event.type == \"start\" and \nprocess.name == \"debugfs\" and process.args : \"/dev/sd*\" and not process.args == \"-R\" and \nnot user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#disk-group" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "2605aa59-29ac-4662-afad-8d86257c7c91", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "2605aa59-29ac-4662-afad-8d86257c7c91_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/265db8f5-fc73-4d0d-b434-6483b56372e2_107.json b/packages/security_detection_engine/kibana/security_rule/265db8f5-fc73-4d0d-b434-6483b56372e2_107.json new file mode 100644 index 00000000000..59b70f4c062 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/265db8f5-fc73-4d0d-b434-6483b56372e2_107.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potential hijacking of the Microsoft Update Orchestrator Service to establish persistence with an integrity level of SYSTEM.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Update Orchestrator Service Hijack", + "note": "## Triage and analysis\n\n### Investigating Persistence via Update Orchestrator Service Hijack\n\nWindows Update Orchestrator Service is a DCOM service used by other components to install Windows updates that are already downloaded. Windows Update Orchestrator Service was vulnerable to elevation of privileges (any user to local system) due to an improper authorization of the callers. The vulnerability affected the Windows 10 and Windows Server Core products. Fixed by Microsoft on Patch Tuesday June 2020.\n\nThis rule will detect uncommon processes spawned by `svchost.exe` with `UsoSvc` as the command line parameters. Attackers can leverage this technique to elevate privileges or maintain persistence.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.executable : \"C:\\\\Windows\\\\System32\\\\svchost.exe\" and\n process.parent.args : \"UsoSvc\" and\n not process.executable :\n (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\UUS\\\\Packages\\\\*\\\\amd64\\\\MoUsoCoreWorker.exe\",\n \"?:\\\\Windows\\\\System32\\\\UsoClient.exe\",\n \"?:\\\\Windows\\\\System32\\\\MusNotification.exe\",\n \"?:\\\\Windows\\\\System32\\\\MusNotificationUx.exe\",\n \"?:\\\\Windows\\\\System32\\\\MusNotifyIcon.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerMgr.exe\",\n \"?:\\\\Windows\\\\UUS\\\\amd64\\\\MoUsoCoreWorker.exe\",\n \"?:\\\\Windows\\\\System32\\\\MoUsoCoreWorker.exe\",\n \"?:\\\\Windows\\\\UUS\\\\amd64\\\\UsoCoreWorker.exe\",\n \"?:\\\\Windows\\\\System32\\\\UsoCoreWorker.exe\",\n \"?:\\\\Program Files\\\\Common Files\\\\microsoft shared\\\\ClickToRun\\\\OfficeC2RClient.exe\") and\n not process.name : (\"MoUsoCoreWorker.exe\", \"OfficeC2RClient.exe\")\n", + "references": [ + "https://github.com/irsl/CVE-2020-1313" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "265db8f5-fc73-4d0d-b434-6483b56372e2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Use Case: Vulnerability", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "265db8f5-fc73-4d0d-b434-6483b56372e2_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/26b01043-4f04-4d2f-882a-5a1d2e95751b_5.json b/packages/security_detection_engine/kibana/security_rule/26b01043-4f04-4d2f-882a-5a1d2e95751b_5.json new file mode 100644 index 00000000000..85bf15e76fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/26b01043-4f04-4d2f-882a-5a1d2e95751b_5.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies parent process spoofing used to create an elevated child process. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Privileges Elevation via Parent Process PID Spoofing", + "query": "/* This rule is compatible with Elastic Endpoint only */\n\nprocess where host.os.type == \"windows\" and event.action == \"start\" and\n\n /* process creation via seclogon */\n process.parent.Ext.real.pid \u003e 0 and\n\n /* PrivEsc to SYSTEM */\n user.id : \"S-1-5-18\" and\n\n /* Common FPs - evasion via hollowing is possible, should be covered by code injection */\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\System32\\\\Wermgr.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\Wermgr.exe\",\n \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\Install\\\\securityhealthsetup.exe\") and\n /* Logon Utilities */\n not (process.parent.executable : \"?:\\\\Windows\\\\System32\\\\Utilman.exe\" and\n process.executable : (\"?:\\\\Windows\\\\System32\\\\osk.exe\",\n \"?:\\\\Windows\\\\System32\\\\Narrator.exe\",\n \"?:\\\\Windows\\\\System32\\\\Magnify.exe\")) and\n\n not process.parent.executable : \"?:\\\\Windows\\\\System32\\\\AtBroker.exe\" and\n\n not (process.code_signature.subject_name in\n (\"philandro Software GmbH\", \"Freedom Scientific Inc.\", \"TeamViewer Germany GmbH\", \"Projector.is, Inc.\",\n \"TeamViewer GmbH\", \"Cisco WebEx LLC\", \"Dell Inc\") and process.code_signature.trusted == true) and \n\n /* AM_Delta_Patch Windows Update */\n not (process.executable : (\"?:\\\\Windows\\\\System32\\\\MpSigStub.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\MpSigStub.exe\") and\n process.parent.executable : (\"?:\\\\Windows\\\\System32\\\\wuauclt.exe\", \n \"?:\\\\Windows\\\\SysWOW64\\\\wuauclt.exe\", \n \"?:\\\\Windows\\\\UUS\\\\Packages\\\\Preview\\\\*\\\\wuaucltcore.exe\", \n \"?:\\\\Windows\\\\UUS\\\\amd64\\\\wuauclt.exe\", \n \"?:\\\\Windows\\\\UUS\\\\amd64\\\\wuaucltcore.exe\", \n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\UUS\\\\*\\\\wuaucltcore.exe\")) and\n not (process.executable : (\"?:\\\\Windows\\\\System32\\\\MpSigStub.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\MpSigStub.exe\") and process.parent.executable == null) and\n\n /* Other third party SW */\n not process.parent.executable :\n (\"?:\\\\Program Files (x86)\\\\HEAT Software\\\\HEAT Remote\\\\HEATRemoteServer.exe\",\n \"?:\\\\Program Files (x86)\\\\VisualCron\\\\VisualCronService.exe\",\n \"?:\\\\Program Files\\\\BinaryDefense\\\\Vision\\\\Agent\\\\bds-vision-agent-app.exe\",\n \"?:\\\\Program Files\\\\Tablet\\\\Wacom\\\\WacomHost.exe\",\n \"?:\\\\Program Files (x86)\\\\LogMeIn\\\\x64\\\\LogMeIn.exe\",\n \"?:\\\\Program Files (x86)\\\\EMC Captiva\\\\Captiva Cloud Runtime\\\\Emc.Captiva.WebCaptureRunner.exe\",\n \"?:\\\\Program Files\\\\Freedom Scientific\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Google\\\\Chrome Remote Desktop\\\\*\\\\remoting_host.exe\",\n \"?:\\\\Program Files (x86)\\\\GoToAssist Remote Support Customer\\\\*\\\\g2ax_comm_customer.exe\")\n", + "references": [ + "https://gist.github.com/xpn/a057a26ec81e736518ee50848b9c2cd6", + "https://blog.didierstevens.com/2017/03/20/", + "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-updateprocthreadattribute", + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1134.002/T1134.002.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.parent.Ext.real.pid", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "26b01043-4f04-4d2f-882a-5a1d2e95751b", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1134", + "name": "Access Token Manipulation", + "reference": "https://attack.mitre.org/techniques/T1134/", + "subtechnique": [ + { + "id": "T1134.002", + "name": "Create Process with Token", + "reference": "https://attack.mitre.org/techniques/T1134/002/" + }, + { + "id": "T1134.004", + "name": "Parent PID Spoofing", + "reference": "https://attack.mitre.org/techniques/T1134/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "26b01043-4f04-4d2f-882a-5a1d2e95751b_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_1.json b/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_1.json new file mode 100644 index 00000000000..74d2c65527d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_1.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Archive Compression Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n(\n powershell.file.script_block_text : (\n \"IO.Compression.ZipFile\" or\n \"IO.Compression.ZipArchive\" or\n \"ZipFile.CreateFromDirectory\" or\n \"IO.Compression.BrotliStream\" or\n \"IO.Compression.DeflateStream\" or\n \"IO.Compression.GZipStream\" or\n \"IO.Compression.ZLibStream\"\n ) and \n powershell.file.script_block_text : (\n \"CompressionLevel\" or\n \"CompressionMode\" or\n \"ZipArchiveMode\"\n ) or\n powershell.file.script_block_text : \"Compress-Archive\"\n)\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "27071ea3-e806-4697-8abc-e22c92aa4293", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "27071ea3-e806-4697-8abc-e22c92aa4293_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_2.json b/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_2.json new file mode 100644 index 00000000000..81db9eb890f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/27071ea3-e806-4697-8abc-e22c92aa4293_2.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to archive compression activities. Adversaries will often compress and encrypt data in preparation for exfiltration.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Archive Compression Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n(\n powershell.file.script_block_text : (\n \"IO.Compression.ZipFile\" or\n \"IO.Compression.ZipArchive\" or\n \"ZipFile.CreateFromDirectory\" or\n \"IO.Compression.BrotliStream\" or\n \"IO.Compression.DeflateStream\" or\n \"IO.Compression.GZipStream\" or\n \"IO.Compression.ZLibStream\"\n ) and \n powershell.file.script_block_text : (\n \"CompressionLevel\" or\n \"CompressionMode\" or\n \"ZipArchiveMode\"\n ) or\n powershell.file.script_block_text : \"Compress-Archive\"\n) and not file.path : *ProgramData*Microsoft*Windows*Defender*Advanced*Threat*Protection*DataCollection*\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "27071ea3-e806-4697-8abc-e22c92aa4293", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 2 + }, + "id": "27071ea3-e806-4697-8abc-e22c92aa4293_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_105.json b/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_105.json new file mode 100644 index 00000000000..1b8ca3ba8c8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_105.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.", + "false_positives": [ + "PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming Execution via PowerShell Remoting", + "query": "sequence by host.id with maxspan = 30s\n [network where host.os.type == \"windows\" and network.direction : (\"incoming\", \"ingress\") and destination.port in (5985, 5986) and\n network.protocol == \"http\" and source.ip != \"127.0.0.1\" and source.ip != \"::1\"]\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"wsmprovhost.exe\" and not process.executable : \"?:\\\\Windows\\\\System32\\\\conhost.exe\"]\n", + "references": [ + "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "2772264c-6fb9-4d9d-9014-b416eed21254", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.006", + "name": "Windows Remote Management", + "reference": "https://attack.mitre.org/techniques/T1021/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "2772264c-6fb9-4d9d-9014-b416eed21254_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_106.json b/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_106.json new file mode 100644 index 00000000000..983c55ab034 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2772264c-6fb9-4d9d-9014-b416eed21254_106.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.", + "false_positives": [ + "PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming Execution via PowerShell Remoting", + "query": "sequence by host.id with maxspan = 30s\n [network where host.os.type == \"windows\" and network.direction : (\"incoming\", \"ingress\") and destination.port in (5985, 5986) and\n network.protocol == \"http\" and source.ip != \"127.0.0.1\" and source.ip != \"::1\"]\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"wsmprovhost.exe\" and not process.executable : \"?:\\\\Windows\\\\System32\\\\conhost.exe\"]\n", + "references": [ + "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "2772264c-6fb9-4d9d-9014-b416eed21254", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.006", + "name": "Windows Remote Management", + "reference": "https://attack.mitre.org/techniques/T1021/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "2772264c-6fb9-4d9d-9014-b416eed21254_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2856446a-34e6-435b-9fb5-f8f040bfa7ed_106.json b/packages/security_detection_engine/kibana/security_rule/2856446a-34e6-435b-9fb5-f8f040bfa7ed_106.json new file mode 100644 index 00000000000..528f358a0d5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2856446a-34e6-435b-9fb5-f8f040bfa7ed_106.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when the SYSTEM account uses an account discovery utility. This could be a sign of discovery activity after an adversary has achieved privilege escalation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Account Discovery Command via SYSTEM Account", + "note": "## Triage and analysis\n\n### Investigating Account Discovery Command via SYSTEM Account\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of account discovery utilities using the SYSTEM account, which is commonly observed after attackers successfully perform privilege escalation or exploit web applications.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - If the process tree includes a web-application server process such as w3wp, httpd.exe, nginx.exe and alike, investigate any suspicious file creation or modification in the last 48 hours to assess the presence of any potential webshell backdoor.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Determine how the SYSTEM account is being used. For example, users with administrator privileges can spawn a system shell using Windows services, scheduled tasks or other third party utilities.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n- Use the data collected through the analysis to investigate other machines affected in the environment.", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n (process.name : \"whoami.exe\" or\n (process.name : \"net1.exe\" and not process.parent.name : \"net.exe\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.IntegrityLevel", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2856446a-34e6-435b-9fb5-f8f040bfa7ed_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_3.json b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_3.json new file mode 100644 index 00000000000..f680ccf825b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_3.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious File Changes Activity Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s \n [ file where host.os.type == \"linux\" and event.type == \"change\" and\n event.action == \"rename\" and file.extension != \"\" and \n file.path : (\n \"/home/*\", \"/etc/*\", \"/root/*\", \"/opt/*\", \"/var/backups/*\", \"/var/lib/log/*\"\n ) and not \n file.extension : (\n \"xml\", \"json\", \"conf\", \"dat\", \"gz\", \"info\", \"mod\", \"final\",\n \"php\", \"pyc\", \"log\", \"bak\", \"bin\", \"csv\", \"pdf\", \"cfg\", \"*old\"\n ) and not \n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\"\n ) ] with runs=100 | tail 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "28738f9f-7427-4d23-bc69-756708b5f624", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "28738f9f-7427-4d23-bc69-756708b5f624_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_4.json b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_4.json new file mode 100644 index 00000000000..cc0d29c5690 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_4.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious File Changes Activity Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s \n [ file where host.os.type == \"linux\" and event.type == \"change\" and\n event.action == \"rename\" and file.extension != \"\" and \n file.path : (\n \"/home/*\", \"/etc/*\", \"/root/*\", \"/opt/*\", \"/var/backups/*\", \"/var/lib/log/*\"\n ) and not \n file.extension : (\n \"xml\", \"json\", \"conf\", \"dat\", \"gz\", \"info\", \"mod\", \"final\",\n \"php\", \"pyc\", \"log\", \"bak\", \"bin\", \"csv\", \"pdf\", \"cfg\", \"*old\"\n ) and not \n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\", \"go\", \"java\", \"pip*\", \"python*\", \"node\", \"containerd\", \"php\", \"p4d\", \n \"conda\", \"chrome\", \"imap\", \"cmake\", \"firefox\", \"semanage\", \"semodule\", \"ansible-galaxy\"\n ) ] with runs=100 | tail 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "28738f9f-7427-4d23-bc69-756708b5f624", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "28738f9f-7427-4d23-bc69-756708b5f624_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_5.json b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_5.json new file mode 100644 index 00000000000..3c838455041 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/28738f9f-7427-4d23-bc69-756708b5f624_5.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of 100 file extension rename events within a set of common file paths by the same process in a timespan of 1 second. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious File Changes Activity Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n [file where host.os.type == \"linux\" and event.type == \"change\" and event.action == \"rename\" and file.extension : \"?*\" \n and ((process.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"ash\", \"openssl\")) or\n (process.executable : (\"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/dev/shm/*\", \"/var/run/*\", \"/boot/*\", \"/srv/*\", \"/run/*\"))) and\n file.path : (\n \"/home/*/Downloads/*\", \"/home/*/Documents/*\", \"/root/*\", \"/bin/*\", \"/usr/bin/*\",\n \"/opt/*\", \"/etc/*\", \"/var/log/*\", \"/var/lib/log/*\", \"/var/backup/*\", \"/var/www/*\") and not ((\n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\", \"go\", \"java\", \"pip*\", \"python*\", \"node\", \"containerd\", \"php\", \"p4d\",\n \"conda\", \"chrome\", \"imap\", \"cmake\", \"firefox\", \"semanage\", \"semodule\", \"ansible-galaxy\", \"fc-cache\", \"jammy\", \"git\",\n \"systemsettings\", \"vmis-launcher\")) or file.path : \"/etc/selinux/*\" or (file.extension in (\"qmlc\", \"txt\")\n ))] with runs=25\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "28738f9f-7427-4d23-bc69-756708b5f624", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 5 + }, + "id": "28738f9f-7427-4d23-bc69-756708b5f624_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_1.json b/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_1.json new file mode 100644 index 00000000000..9eaa36bbda6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_1.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the sudo -l command, which is used to list the allowed and forbidden commands for the invoking user. Attackers may execute this command to enumerate commands allowed to be executed with sudo permissions, potentially allowing to escalate privileges to root.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Sudo Command Enumeration Detected", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \nprocess.name == \"sudo\" and process.args == \"-l\" and \nprocess.parent.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \nnot group.Ext.real.id : \"0\" and not user.Ext.real.id : \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "28d39238-0c01-420a-b77a-24e5a7378663", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "28d39238-0c01-420a-b77a-24e5a7378663_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_2.json b/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_2.json new file mode 100644 index 00000000000..babb9933123 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/28d39238-0c01-420a-b77a-24e5a7378663_2.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the sudo -l command, which is used to list the allowed and forbidden commands for the invoking user. Attackers may execute this command to enumerate commands allowed to be executed with sudo permissions, potentially allowing to escalate privileges to root.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Sudo Command Enumeration Detected", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \nprocess.name == \"sudo\" and process.args == \"-l\" and process.args_count == 2 and\nprocess.parent.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \nnot group.Ext.real.id : \"0\" and not user.Ext.real.id : \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "28d39238-0c01-420a-b77a-24e5a7378663", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "28d39238-0c01-420a-b77a-24e5a7378663_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/290aca65-e94d-403b-ba0f-62f320e63f51_107.json b/packages/security_detection_engine/kibana/security_rule/290aca65-e94d-403b-ba0f-62f320e63f51_107.json new file mode 100644 index 00000000000..dfa95e1462d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/290aca65-e94d-403b-ba0f-62f320e63f51_107.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass Attempt via Windows Directory Masquerading", + "note": "## Triage and analysis\n\n### Investigating UAC Bypass Attempt via Windows Directory Masquerading\n\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.\n\nFor more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).\n\nThis rule identifies an attempt to bypass User Account Control (UAC) by masquerading as a Microsoft trusted Windows directory. Attackers may bypass UAC to stealthily execute code with elevated permissions.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze any suspicious spawned processes using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.args : (\"C:\\\\Windows \\\\system32\\\\*.exe\", \"C:\\\\Windows \\\\SysWOW64\\\\*.exe\")\n", + "references": [ + "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "290aca65-e94d-403b-ba0f-62f320e63f51", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "290aca65-e94d-403b-ba0f-62f320e63f51_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2917d495-59bd-4250-b395-c29409b76086_106.json b/packages/security_detection_engine/kibana/security_rule/2917d495-59bd-4250-b395-c29409b76086_106.json new file mode 100644 index 00000000000..6e5a5d646aa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2917d495-59bd-4250-b395-c29409b76086_106.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access.", + "false_positives": [ + "Security audits, maintenance, and network administrative scripts may trigger this alert when run under web processes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Web Shell Detection: Script Process Child of Common Web Processes", + "note": "## Triage and analysis\n\n### Investigating Web Shell Detection: Script Process Child of Common Web Processes\n\nAdversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a web script that is placed on an openly accessible web server to allow an adversary to use the web server as a gateway into a network. A web shell may provide a set of functions to execute or a command-line interface on the system that hosts the web server.\n\nThis rule detects a web server process spawning script and command-line interface programs, potentially indicating attackers executing commands using the web shell.\n\n#### Possible investigation steps\n\n- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any other spawned child processes.\n- Examine the command line to determine which commands or scripts were executed.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"w3wp.exe\", \"httpd.exe\", \"nginx.exe\", \"php.exe\", \"php-cgi.exe\", \"tomcat.exe\") and\n process.name : (\"cmd.exe\", \"cscript.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"wmic.exe\", \"wscript.exe\")\n", + "references": [ + "https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/", + "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965", + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2917d495-59bd-4250-b395-c29409b76086", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/", + "subtechnique": [ + { + "id": "T1505.003", + "name": "Web Shell", + "reference": "https://attack.mitre.org/techniques/T1505/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2917d495-59bd-4250-b395-c29409b76086_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/29f0cf93-d17c-4b12-b4f3-a433800539fa_1.json b/packages/security_detection_engine/kibana/security_rule/29f0cf93-d17c-4b12-b4f3-a433800539fa_1.json new file mode 100644 index 00000000000..f24dc5d0cc9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/29f0cf93-d17c-4b12-b4f3-a433800539fa_1.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for X11 forwarding via SSH. X11 forwarding is a feature that allows users to run graphical applications on a remote server and display the application's graphical user interface on their local machine. Attackers can abuse X11 forwarding for tunneling their GUI-based tools, pivot through compromised systems, and create covert communication channels, enabling lateral movement and facilitating remote control of systems within a network.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux SSH X11 Forwarding", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and\nprocess.name in (\"ssh\", \"sshd\") and process.args in (\"-X\", \"-Y\") and process.args_count \u003e= 3 and \nprocess.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")\n", + "references": [ + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "29f0cf93-d17c-4b12-b4f3-a433800539fa", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "29f0cf93-d17c-4b12-b4f3-a433800539fa_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_1.json b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_1.json new file mode 100644 index 00000000000..6d06f5e95cd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_1.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Code Execution via Postgresql", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\", \"fork\", \"fork_event\") and \nevent.type == \"start\" and user.name == \"postgres\" and (process.parent.args : \"*sh\" or process.args : \"*sh\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2a692072-d78d-42f3-a48a-775677d79c4e", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "2a692072-d78d-42f3-a48a-775677d79c4e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_2.json b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_2.json new file mode 100644 index 00000000000..4c0943fc4a1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_2.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Code Execution via Postgresql", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\", \"fork\", \"fork_event\") and \nevent.type == \"start\" and user.name == \"postgres\" and (\n (process.parent.args : \"*sh\" and process.parent.args : \"echo*\") or \n (process.args : \"*sh\" and process.args : \"echo*\")\n) and not process.parent.name : \"puppet\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2a692072-d78d-42f3-a48a-775677d79c4e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "2a692072-d78d-42f3-a48a-775677d79c4e_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_3.json b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_3.json new file mode 100644 index 00000000000..3d74796b567 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2a692072-d78d-42f3-a48a-775677d79c4e_3.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for suspicious activities that may indicate an attacker attempting to execute arbitrary code within a PostgreSQL environment. Attackers can execute code via PostgreSQL as a result of gaining unauthorized access to a public facing PostgreSQL database or exploiting vulnerabilities, such as remote command execution and SQL injection attacks, which can result in unauthorized access and malicious actions, and facilitate post-exploitation activities for unauthorized access and malicious actions.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Code Execution via Postgresql", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\", \"fork\", \"fork_event\") and \nevent.type == \"start\" and user.name == \"postgres\" and (\n (process.parent.args : \"*sh\" and process.parent.args : \"echo*\") or \n (process.args : \"*sh\" and process.args : \"echo*\")\n) and not process.parent.name : \"puppet\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2a692072-d78d-42f3-a48a-775677d79c4e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "2a692072-d78d-42f3-a48a-775677d79c4e_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2b662e21-dc6e-461e-b5cf-a6eb9b235ec4_3.json b/packages/security_detection_engine/kibana/security_rule/2b662e21-dc6e-461e-b5cf-a6eb9b235ec4_3.json new file mode 100644 index 00000000000..9da8b521395 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2b662e21-dc6e-461e-b5cf-a6eb9b235ec4_3.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where a process named 'grep', 'egrep', or 'pgrep' is started on a Linux system with arguments related to virtual machine (VM) files, such as \"vmdk\", \"vmx\", \"vmxf\", \"vmsd\", \"vmsn\", \"vswp\", \"vmss\", \"nvram\", or \"vmem\". These file extensions are associated with VM-related file formats, and their presence in grep command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM files on the system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "ESXI Discovery via Grep", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\nprocess.name in (\"grep\", \"egrep\", \"pgrep\") and\nprocess.args in (\"vmdk\", \"vmx\", \"vmxf\", \"vmsd\", \"vmsn\", \"vswp\", \"vmss\", \"nvram\", \"vmem\")\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "2b662e21-dc6e-461e-b5cf-a6eb9b235ec4_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2bf78aa2-9c56-48de-b139-f169bf99cf86_107.json b/packages/security_detection_engine/kibana/security_rule/2bf78aa2-9c56-48de-b139-f169bf99cf86_107.json new file mode 100644 index 00000000000..8052cfcecf6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2bf78aa2-9c56-48de-b139-f169bf99cf86_107.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects writing executable files that will be automatically launched by Adobe on launch.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Adobe Hijack Persistence", + "note": "## Triage and analysis\n\n### Investigating Adobe Hijack Persistence\n\nAttackers can replace the `RdrCEF.exe` executable with their own to maintain their access, which will be launched whenever Adobe Acrobat Reader is executed.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n file.path : (\"?:\\\\Program Files (x86)\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\AcroCEF\\\\RdrCEF.exe\",\n \"?:\\\\Program Files\\\\Adobe\\\\Acrobat Reader DC\\\\Reader\\\\AcroCEF\\\\RdrCEF.exe\") and\n not process.name : \"msiexec.exe\"\n", + "references": [ + "https://twitter.com/pabraeken/status/997997818362155008" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "2bf78aa2-9c56-48de-b139-f169bf99cf86", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.010", + "name": "Services File Permissions Weakness", + "reference": "https://attack.mitre.org/techniques/T1574/010/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "2bf78aa2-9c56-48de-b139-f169bf99cf86_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2c17e5d7-08b9-43b2-b58a-0270d65ac85b_106.json b/packages/security_detection_engine/kibana/security_rule/2c17e5d7-08b9-43b2-b58a-0270d65ac85b_106.json new file mode 100644 index 00000000000..c4a62e22aa3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2c17e5d7-08b9-43b2-b58a-0270d65ac85b_106.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to the Windows Defender configuration settings using PowerShell to add exclusions at the folder directory or process level.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Defender Exclusions Added via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Windows Defender Exclusions Added via PowerShell\n\nMicrosoft Windows Defender is an antivirus product built into Microsoft Windows. Since this software product is used to prevent and stop malware, it's important to monitor what specific exclusions are made to the product's configuration settings. These can often be signs of an adversary or malware trying to bypass Windows Defender's capabilities. One of the more notable [examples](https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/) was observed in 2018 where Trickbot incorporated mechanisms to disable Windows Defender to avoid detection.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Examine the exclusion in order to determine the intent behind it.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- If the exclusion specifies a suspicious file or path, retrieve the file(s) and determine if malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This rule has a high chance to produce false positives due to how often network administrators legitimately configure exclusions. In order to validate the activity further, review the specific exclusion and its intent. There are many legitimate reasons for exclusions, so it's important to gain context.\n\n### Related rules\n\n- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb\n- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Exclusion lists for antimalware capabilities should always be routinely monitored for review.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in (\"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\")) and\n process.args : (\"*Add-MpPreference*\", \"*Set-MpPreference*\") and\n process.args : (\"*-Exclusion*\")\n", + "references": [ + "https://www.bitdefender.com/files/News/CaseStudies/study/400/Bitdefender-PR-Whitepaper-MosaicLoader-creat5540-en-EN.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2c17e5d7-08b9-43b2-b58a-0270d65ac85b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + }, + { + "id": "T1562.006", + "name": "Indicator Blocking", + "reference": "https://attack.mitre.org/techniques/T1562/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2c17e5d7-08b9-43b2-b58a-0270d65ac85b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a_106.json b/packages/security_detection_engine/kibana/security_rule/2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a_106.json new file mode 100644 index 00000000000..a6db69d80c1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a_106.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potential abuse of the Microsoft Diagnostics Troubleshooting Wizard (MSDT) to proxy malicious command or binary execution via malicious process arguments.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Microsoft Diagnostics Wizard Execution", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.pe.original_file_name == \"msdt.exe\" or process.name : \"msdt.exe\") and\n (\n process.args : (\"IT_RebrowseForFile=*\", \"ms-msdt:/id\", \"ms-msdt:-id\", \"*FromBase64*\") or\n\n (process.args : \"-af\" and process.args : \"/skip\" and\n process.parent.name : (\"explorer.exe\", \"cmd.exe\", \"powershell.exe\", \"cscript.exe\", \"wscript.exe\", \"mshta.exe\", \"rundll32.exe\", \"regsvr32.exe\") and\n process.args : (\"?:\\\\WINDOWS\\\\diagnostics\\\\index\\\\PCWDiagnostic.xml\", \"PCWDiagnostic.xml\", \"?:\\\\Users\\\\Public\\\\*\", \"?:\\\\Windows\\\\Temp\\\\*\")) or\n\n (process.pe.original_file_name == \"msdt.exe\" and not process.name : \"msdt.exe\" and process.name != null) or\n\n (process.pe.original_file_name == \"msdt.exe\" and not process.executable : (\"?:\\\\Windows\\\\system32\\\\msdt.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\msdt.exe\"))\n )\n", + "references": [ + "https://twitter.com/nao_sec/status/1530196847679401984", + "https://lolbas-project.github.io/lolbas/Binaries/Msdt/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2c3c29a4-f170-42f8-a3d8-2ceebc18eb6a_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_204.json b/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_204.json new file mode 100644 index 00000000000..b8a1e84ff77 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_204.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to enumerate kernel modules. Use of these programs by ordinary users is uncommon. These can be exempted by process name or username." + ], + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Enumeration of Kernel Modules", + "new_terms_fields": [ + "process.parent.name", + "host.id" + ], + "query": "event.category:process and host.os.type:linux and event.type:start and (\n (process.name:(lsmod or modinfo)) or \n (process.name:kmod and process.args:list) or \n (process.name:depmod and process.args:(--all or -a))\n) and not process.parent.user.id:0\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2d8043ed-5bda-4caf-801c-c1feb7410504", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 204 + }, + "id": "2d8043ed-5bda-4caf-801c-c1feb7410504_204", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_205.json b/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_205.json new file mode 100644 index 00000000000..d48589dfb5b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2d8043ed-5bda-4caf-801c-c1feb7410504_205.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to enumerate kernel modules. Use of these programs by ordinary users is uncommon. These can be exempted by process name or username." + ], + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Enumeration of Kernel Modules", + "new_terms_fields": [ + "process.parent.name", + "host.id" + ], + "query": "event.category:process and host.os.type:linux and event.type:start and (\n (process.name:(lsmod or modinfo)) or \n (process.name:kmod and process.args:list) or \n (process.name:depmod and process.args:(--all or -a))\n) and process.parent.name:(sudo or bash or dash or ash or sh or tcsh or csh or zsh or ksh or fish) and \nnot process.parent.user.id:0\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2d8043ed-5bda-4caf-801c-c1feb7410504", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 205 + }, + "id": "2d8043ed-5bda-4caf-801c-c1feb7410504_205", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2dd480be-1263-4d9c-8672-172928f6789a_208.json b/packages/security_detection_engine/kibana/security_rule/2dd480be-1263-4d9c-8672-172928f6789a_208.json new file mode 100644 index 00000000000..80272cc3264 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2dd480be-1263-4d9c-8672-172928f6789a_208.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious process access events from an unknown memory region. Endpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Access via Direct System Call", + "note": "## Triage and analysis\n\n### Investigating Suspicious Process Access via Direct System Call\n\nEndpoint security solutions usually hook userland Windows APIs in order to decide if the code that is being executed is malicious or not. It's possible to bypass hooked functions by writing malicious functions that call syscalls directly.\n\nMore context and technical details can be found in this [research blog](https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/).\n\nThis rule identifies suspicious process access events from an unknown memory region. Attackers can use direct system calls to bypass security solutions that rely on hooks.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This detection may be triggered by certain applications that install root certificates for the purpose of inspecting SSL traffic. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove the malicious certificate from the root certificate store.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n length(winlog.event_data.CallTrace) \u003e 0 and\n\n /* Sysmon CallTrace starting with unknown memory module instead of ntdll which host Windows NT Syscalls */\n not winlog.event_data.CallTrace :\n (\"?:\\\\WINDOWS\\\\SYSTEM32\\\\ntdll.dll*\",\n \"?:\\\\WINDOWS\\\\SysWOW64\\\\ntdll.dll*\",\n \"?:\\\\Windows\\\\System32\\\\wow64cpu.dll*\",\n \"?:\\\\WINDOWS\\\\System32\\\\wow64win.dll*\",\n \"?:\\\\Windows\\\\System32\\\\win32u.dll*\") and\n\n not winlog.event_data.TargetImage :\n (\"?:\\\\Program Files (x86)\\\\Malwarebytes Anti-Exploit\\\\mbae-svc.exe\",\n \"?:\\\\Program Files\\\\Cisco\\\\AMP\\\\*\\\\sfc.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\*\\\\msedgewebview2.exe\",\n \"?:\\\\Program Files\\\\Adobe\\\\Acrobat DC\\\\Acrobat\\\\*\\\\AcroCEF.exe\") and\n\n not (process.executable : (\"?:\\\\Program Files\\\\Adobe\\\\Acrobat DC\\\\Acrobat\\\\Acrobat.exe\",\n \"?:\\\\Program Files (x86)\\\\World of Warcraft\\\\_classic_\\\\WowClassic.exe\") and\n not winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\")\n", + "references": [ + "https://twitter.com/SBousseaden/status/1278013896440324096", + "https://www.ired.team/offensive-security/defense-evasion/using-syscalls-directly-from-visual-studio-to-bypass-avs-edrs" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetImage", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2dd480be-1263-4d9c-8672-172928f6789a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 208 + }, + "id": "2dd480be-1263-4d9c-8672-172928f6789a_208", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2de87d72-ee0c-43e2-b975-5f0b029ac600_6.json b/packages/security_detection_engine/kibana/security_rule/2de87d72-ee0c-43e2-b975-5f0b029ac600_6.json new file mode 100644 index 00000000000..85919573dad --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2de87d72-ee0c-43e2-b975-5f0b029ac600_6.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to dump Wireless saved access keys in clear text using the Windows built-in utility Netsh.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Wireless Credential Dumping using Netsh Command", + "note": "## Triage and analysis\n\n### Investigating Wireless Credential Dumping using Netsh Command\n\nNetsh is a Windows command line tool used for network configuration and troubleshooting. It enables the management of network settings and adapters, wireless network profiles, and other network-related tasks.\n\nThis rule looks for patterns used to dump credentials from wireless network profiles using Netsh, which can enable attackers to bring their own devices to the network.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"netsh.exe\" or process.pe.original_file_name == \"netsh.exe\") and\n process.args : \"wlan\" and process.args : \"key*clear\"\n", + "references": [ + "https://learn.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts", + "https://www.geeksforgeeks.org/how-to-find-the-wi-fi-password-using-cmd-in-windows/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2de87d72-ee0c-43e2-b975-5f0b029ac600", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 6 + }, + "id": "2de87d72-ee0c-43e2-b975-5f0b029ac600_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2e1e835d-01e5-48ca-b9fc-7a61f7f11902_107.json b/packages/security_detection_engine/kibana/security_rule/2e1e835d-01e5-48ca-b9fc-7a61f7f11902_107.json new file mode 100644 index 00000000000..d7b592a80aa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2e1e835d-01e5-48ca-b9fc-7a61f7f11902_107.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious AutoIt process execution. Malware written as an AutoIt script tends to rename the AutoIt executable to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Renamed AutoIt Scripts Interpreter", + "note": "## Triage and analysis\n\n### Investigating Renamed AutoIt Scripts Interpreter\n\nThe OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.\n\nAutoIt is a scripting language and tool for automating tasks on Microsoft Windows operating systems. Due to its capabilities, malicious threat actors can abuse it to create malicious scripts and distribute malware.\n\nThis rule checks for renamed instances of AutoIt, which can indicate an attempt of evading detections, application allowlists, and other security protections.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name : \"AutoIt*.exe\" and not process.name : \"AutoIt*.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2e1e835d-01e5-48ca-b9fc-7a61f7f11902", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "2e1e835d-01e5-48ca-b9fc-7a61f7f11902_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2e311539-cd88-4a85-a301-04f38795007c_1.json b/packages/security_detection_engine/kibana/security_rule/2e311539-cd88-4a85-a301-04f38795007c_1.json new file mode 100644 index 00000000000..6003d37fed7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2e311539-cd88-4a85-a301-04f38795007c_1.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies commands containing references to Outlook data files extensions, which can potentially indicate the search, access, or modification of these files.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Accessing Outlook Data Files", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.args : (\"*.ost\", \"*.pst\") and\n not process.name : \"outlook.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "2e311539-cd88-4a85-a301-04f38795007c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1114", + "name": "Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/", + "subtechnique": [ + { + "id": "T1114.001", + "name": "Local Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "2e311539-cd88-4a85-a301-04f38795007c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2edc8076-291e-41e9-81e4-e3fcbc97ae5e_106.json b/packages/security_detection_engine/kibana/security_rule/2edc8076-291e-41e9-81e4-e3fcbc97ae5e_106.json new file mode 100644 index 00000000000..864f748a6fd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2edc8076-291e-41e9-81e4-e3fcbc97ae5e_106.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a hidden local user account by appending the dollar sign to the account name. This is sometimes done by attackers to increase access to a system and avoid appearing in the results of accounts listing using the net users command.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation of a Hidden Local User Account", + "note": "## Triage and analysis\n\n### Investigating Creation of a Hidden Local User Account\n\nAttackers can create accounts ending with a `$` symbol to make the account hidden to user enumeration utilities and bypass detections that identify computer accounts by this pattern to apply filters.\n\nThis rule uses registry events to identify the creation of local hidden accounts.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positive (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Delete the hidden account.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\*$\\\\\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SAM\\\\SAM\\\\Domains\\\\Account\\\\Users\\\\Names\\\\*$\\\\\"\n)\n", + "references": [ + "https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html", + "https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "2edc8076-291e-41e9-81e4-e3fcbc97ae5e", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2edc8076-291e-41e9-81e4-e3fcbc97ae5e_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2f2f4939-0b34-40c2-a0a3-844eb7889f43_107.json b/packages/security_detection_engine/kibana/security_rule/2f2f4939-0b34-40c2-a0a3-844eb7889f43_107.json new file mode 100644 index 00000000000..7378d083e5a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2f2f4939-0b34-40c2-a0a3-844eb7889f43_107.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Suspicious Script with Audio Capture Capabilities", + "note": "## Triage and analysis\n\n### Investigating PowerShell Suspicious Script with Audio Capture Capabilities\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell to interact with the Windows API with the intent of capturing audio from input devices connected to the victim's computer.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Investigate if the script stores the recorded data locally and determine if anything was recorded.\n- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.\n- Assess network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users should not need scripts to capture audio, which makes false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"Get-MicrophoneAudio\" or\n \"WindowsAudioDevice-Powershell-Cmdlet\" or\n (waveInGetNumDevs and mciSendStringA)\n )\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n and not user.id : \"S-1-5-18\"\n", + "references": [ + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-MicrophoneAudio.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2f2f4939-0b34-40c2-a0a3-844eb7889f43", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1123", + "name": "Audio Capture", + "reference": "https://attack.mitre.org/techniques/T1123/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 107 + }, + "id": "2f2f4939-0b34-40c2-a0a3-844eb7889f43_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_105.json b/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_105.json new file mode 100644 index 00000000000..1f12374c343 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_105.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Disable Syslog Service", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n ( (process.name == \"service\" and process.args == \"stop\") or\n (process.name == \"chkconfig\" and process.args == \"off\") or\n (process.name == \"systemctl\" and process.args in (\"disable\", \"stop\", \"kill\"))\n ) and process.args in (\"syslog\", \"rsyslog\", \"syslog-ng\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2f8a1226-5720-437d-9c20-e0029deb6194", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "2f8a1226-5720-437d-9c20-e0029deb6194_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_106.json b/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_106.json new file mode 100644 index 00000000000..296a8266fd5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2f8a1226-5720-437d-9c20-e0029deb6194_106.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may attempt to disable the syslog service in an attempt to an attempt to disrupt event logging and evade detection by security controls.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Disable Syslog Service", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n ( (process.name == \"service\" and process.args == \"stop\") or\n (process.name == \"chkconfig\" and process.args == \"off\") or\n (process.name == \"systemctl\" and process.args in (\"disable\", \"stop\", \"kill\"))\n ) and process.args in (\"syslog\", \"rsyslog\", \"syslog-ng\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2f8a1226-5720-437d-9c20-e0029deb6194", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2f8a1226-5720-437d-9c20-e0029deb6194_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2fba96c0-ade5-4bce-b92f-a5df2509da3f_107.json b/packages/security_detection_engine/kibana/security_rule/2fba96c0-ade5-4bce-b92f-a5df2509da3f_107.json new file mode 100644 index 00000000000..261708878cb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2fba96c0-ade5-4bce-b92f-a5df2509da3f_107.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies files written or modified in the startup folder by unsigned processes. Adversaries may abuse this technique to maintain persistence in an environment.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Startup Folder Persistence via Unsigned Process", + "note": "## Triage and analysis\n\n### Investigating Startup Folder Persistence via Unsigned Process\n\nThe Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.\n\nThis rule looks for unsigned processes writing to the Startup folder locations.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- There is a high possibility of benign legitimate programs being added to Startup folders. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id, process.entity_id with maxspan=5s\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.code_signature.trusted == false and\n /* suspicious paths can be added here */\n process.executable : (\"C:\\\\Users\\\\*.exe\",\n \"C:\\\\ProgramData\\\\*.exe\",\n \"C:\\\\Windows\\\\Temp\\\\*.exe\",\n \"C:\\\\Windows\\\\Tasks\\\\*.exe\",\n \"C:\\\\Intel\\\\*.exe\",\n \"C:\\\\PerfLogs\\\\*.exe\")\n ]\n [file where host.os.type == \"windows\" and event.type != \"deletion\" and user.domain != \"NT AUTHORITY\" and\n file.path : (\"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\",\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\*\")\n ]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "2fba96c0-ade5-4bce-b92f-a5df2509da3f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "2fba96c0-ade5-4bce-b92f-a5df2509da3f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/2ffa1f1e-b6db-47fa-994b-1512743847eb_106.json b/packages/security_detection_engine/kibana/security_rule/2ffa1f1e-b6db-47fa-994b-1512743847eb_106.json new file mode 100644 index 00000000000..29eb21459af --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/2ffa1f1e-b6db-47fa-994b-1512743847eb_106.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to the Windows Defender registry settings to disable the service or set the service to be started manually.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Defender Disabled via Registry Modification", + "note": "## Triage and analysis\n\n### Investigating Windows Defender Disabled via Registry Modification\n\nMicrosoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.\n\nThis rule monitors the registry for configurations that disable Windows Defender or the start of its service.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check if this operation was approved and performed according to the organization's change management policy.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.\n\n### Related rules\n\n- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87\n- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Re-enable Windows Defender and restore the service configurations to automatic start.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n (\n (\n registry.path: (\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\"\n ) and\n registry.data.strings: (\"1\", \"0x00000001\")\n ) or\n (\n registry.path: (\n \"HKLM\\\\System\\\\*ControlSet*\\\\Services\\\\WinDefend\\\\Start\",\n \"\\\\REGISTRY\\\\MACHINE\\\\System\\\\*ControlSet*\\\\Services\\\\WinDefend\\\\Start\"\n ) and\n registry.data.strings in (\"3\", \"4\", \"0x00000003\", \"0x00000004\")\n )\n ) and\n\n not process.executable :\n (\"?:\\\\WINDOWS\\\\system32\\\\services.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Program Files (x86)\\\\Trend Micro\\\\Security Agent\\\\NTRmv.exe\")\n", + "references": [ + "https://thedfirreport.com/2020/12/13/defender-control/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "2ffa1f1e-b6db-47fa-994b-1512743847eb", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + }, + { + "id": "T1562.006", + "name": "Indicator Blocking", + "reference": "https://attack.mitre.org/techniques/T1562/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "2ffa1f1e-b6db-47fa-994b-1512743847eb_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/30bfddd7-2954-4c9d-bbc6-19a99ca47e23_3.json b/packages/security_detection_engine/kibana/security_rule/30bfddd7-2954-4c9d-bbc6-19a99ca47e23_3.json new file mode 100644 index 00000000000..63c00776ecb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/30bfddd7-2954-4c9d-bbc6-19a99ca47e23_3.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where the 'touch' command is executed on a Linux system with the \"-r\" flag, which is used to modify the timestamp of a file based on another file's timestamp. The rule targets specific VM-related paths, such as \"/etc/vmware/\", \"/usr/lib/vmware/\", or \"/vmfs/*\". These paths are associated with VMware virtualization software, and their presence in the touch command arguments may indicate that a threat actor is attempting to tamper with timestamps of VM-related files and configurations on the system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "ESXI Timestomping using Touch Command", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\nprocess.name : \"touch\" and process.args : \"-r\" and process.args : (\"/etc/vmware/*\", \"/usr/lib/vmware/*\", \"/vmfs/*\")\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "30bfddd7-2954-4c9d-bbc6-19a99ca47e23", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.006", + "name": "Timestomp", + "reference": "https://attack.mitre.org/techniques/T1070/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "30bfddd7-2954-4c9d-bbc6-19a99ca47e23_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/31b4c719-f2b4-41f6-a9bd-fce93c2eaf62_107.json b/packages/security_detection_engine/kibana/security_rule/31b4c719-f2b4-41f6-a9bd-fce93c2eaf62_107.json new file mode 100644 index 00000000000..1e7f0ce6a01 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/31b4c719-f2b4-41f6-a9bd-fce93c2eaf62_107.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies User Account Control (UAC) bypass via eventvwr.exe. Attackers bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Bypass UAC via Event Viewer", + "note": "## Triage and analysis\n\n### Investigating Bypass UAC via Event Viewer\n\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.\n\nFor more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).\n\nDuring startup, `eventvwr.exe` checks the registry value of the `HKCU\\Software\\Classes\\mscfile\\shell\\open\\command` registry key for the location of `mmc.exe`, which is used to open the `eventvwr.msc` saved console file. If the location of another binary or script is added to this registry value, it will be executed as a high-integrity process without a UAC prompt being displayed to the user. This rule detects this UAC bypass by monitoring processes spawned by `eventvwr.exe` other than `mmc.exe` and `werfault.exe`.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"eventvwr.exe\" and\n not process.executable :\n (\"?:\\\\Windows\\\\SysWOW64\\\\mmc.exe\",\n \"?:\\\\Windows\\\\System32\\\\mmc.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "31b4c719-f2b4-41f6-a9bd-fce93c2eaf62_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/32923416-763a-4531-bb35-f33b9232ecdb_102.json b/packages/security_detection_engine/kibana/security_rule/32923416-763a-4531-bb35-f33b9232ecdb_102.json new file mode 100644 index 00000000000..37e360b35c0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/32923416-763a-4531-bb35-f33b9232ecdb_102.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.", + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "RPC (Remote Procedure Call) to the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:135 or event.dataset:zeek.dce_rpc) and\n source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n ) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 73, + "rule_id": "32923416-763a-4531-bb35-f33b9232ecdb", + "severity": "high", + "tags": [ + "Tactic: Initial Access", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 102 + }, + "id": "32923416-763a-4531-bb35-f33b9232ecdb_102", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14_105.json b/packages/security_detection_engine/kibana/security_rule/32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14_105.json new file mode 100644 index 00000000000..d3059ad2650 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14_105.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution from a directory masquerading as the Windows Program Files directories. These paths are trusted and usually host trusted third party programs. An adversary may leverage masquerading, along with low privileges to bypass detections allowlisting those folders.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Program Files Directory Masquerading", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.executable : \"C:\\\\*Program*Files*\\\\*.exe\" and\n not process.executable : (\"C:\\\\Program Files\\\\*.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\", \"C:\\\\Users\\\\*.exe\", \"C:\\\\ProgramData\\\\*.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.005", + "name": "Match Legitimate Name or Location", + "reference": "https://attack.mitre.org/techniques/T1036/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "32c5cf9c-2ef8-4e87-819e-5ccb7cd18b14_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/32f4675e-6c49-4ace-80f9-97c9259dca2e_106.json b/packages/security_detection_engine/kibana/security_rule/32f4675e-6c49-4ace-80f9-97c9259dca2e_106.json new file mode 100644 index 00000000000..4414abf452c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/32f4675e-6c49-4ace-80f9-97c9259dca2e_106.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious child processes of Microsoft Outlook. These child processes are often associated with spear phishing activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious MS Outlook Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious MS Outlook Child Process\n\nMicrosoft Outlook is an email client that provides contact, email calendar, and task management features. Outlook is widely used, either standalone or as part of the Office suite.\n\nThis rule looks for suspicious processes spawned by MS Outlook, which can be the result of the execution of malicious documents and/or exploitation for initial access.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve recently opened files received via email and opened by the user that could cause this behavior. Common locations include but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"outlook.exe\" and\n process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\",\n \"cdb.exe\", \"certutil.exe\", \"cmd.exe\", \"cmstp.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\",\n \"dsquery.exe\", \"forfiles.exe\", \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\",\n \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\", \"mshta.exe\", \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\",\n \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\", \"ping.exe\", \"powershell.exe\",\n \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\",\n \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\",\n \"tracert.exe\", \"whoami.exe\", \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "32f4675e-6c49-4ace-80f9-97c9259dca2e", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "32f4675e-6c49-4ace-80f9-97c9259dca2e_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/33a6752b-da5e-45f8-b13a-5f094c09522f_3.json b/packages/security_detection_engine/kibana/security_rule/33a6752b-da5e-45f8-b13a-5f094c09522f_3.json new file mode 100644 index 00000000000..e5e2de4d5dd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/33a6752b-da5e-45f8-b13a-5f094c09522f_3.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where the 'find' command is started on a Linux system with arguments targeting specific VM-related paths, such as \"/etc/vmware/\", \"/usr/lib/vmware/\", or \"/vmfs/*\". These paths are associated with VMware virtualization software, and their presence in the find command arguments may indicate that a threat actor is attempting to search for, analyze, or manipulate VM-related files and configurations on the system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "ESXI Discovery via Find", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and process.name : \"find\" and\nprocess.args : (\"/etc/vmware/*\", \"/usr/lib/vmware/*\", \"/vmfs/*\")\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "33a6752b-da5e-45f8-b13a-5f094c09522f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "33a6752b-da5e-45f8-b13a-5f094c09522f_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/33f306e8-417c-411b-965c-c2812d6d3f4d_107.json b/packages/security_detection_engine/kibana/security_rule/33f306e8-417c-411b-965c-c2812d6d3f4d_107.json new file mode 100644 index 00000000000..9a5f86c1d21 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/33f306e8-417c-411b-965c-c2812d6d3f4d_107.json @@ -0,0 +1,135 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies powershell.exe being used to download an executable file from an untrusted remote destination.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Download via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Remote File Download via PowerShell\n\nAttackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.\n\nPowerShell is one of system administrators' main tools for automation, report routines, and other tasks. This makes it available for use in various environments and creates an attractive way for attackers to execute code and perform actions. This rule correlates network and file events to detect downloads of executable and script files performed using PowerShell.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check the reputation of the domain or IP address used to host the downloaded file.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- Administrators can use PowerShell legitimately to download executable and script files. Analysts can dismiss the alert if the Administrator is aware of the activity and the triage has not identified suspicious or malicious files.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id, process.entity_id with maxspan=30s\n [network where host.os.type == \"windows\" and process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and network.protocol == \"dns\" and\n not dns.question.name : (\"localhost\", \"*.microsoft.com\", \"*.azureedge.net\", \"*.powershellgallery.com\", \"*.windowsupdate.com\", \"metadata.google.internal\") and\n not user.domain : \"NT AUTHORITY\"]\n [file where host.os.type == \"windows\" and process.name : \"powershell.exe\" and event.type == \"creation\" and file.extension : (\"exe\", \"dll\", \"ps1\", \"bat\") and\n not file.name : \"__PSScriptPolicy*.ps1\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "33f306e8-417c-411b-965c-c2812d6d3f4d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "33f306e8-417c-411b-965c-c2812d6d3f4d_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/342f834b-21a6-41bf-878c-87d116eba3ee_1.json b/packages/security_detection_engine/kibana/security_rule/342f834b-21a6-41bf-878c-87d116eba3ee_1.json new file mode 100644 index 00000000000..21e374fdcf8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/342f834b-21a6-41bf-878c-87d116eba3ee_1.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the creation or modification of the dynamic linker preload shared object (ld.so.preload) inside a container. The Linux dynamic linker is used to load libraries needed by a program at runtime. Adversaries may hijack the dynamic linker by modifying the /etc/ld.so.preload file to point to malicious libraries. This behavior can be used to grant unauthorized access to system resources and has been used to evade detection of malicious processes in container environments.", + "from": "now-6m", + "index": [ + "logs-cloud_defend*" + ], + "interval": "5m", + "language": "eql", + "license": "Elastic License v2", + "name": "Modification of Dynamic Linker Preload Shared Object Inside A Container", + "query": "file where event.module== \"cloud_defend\" and event.type != \"deletion\" and file.path== \"/etc/ld.so.preload\"\n", + "references": [ + "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/", + "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang/", + "https://sysdig.com/blog/threat-detection-aws-cloud-containers/" + ], + "related_integrations": [ + { + "package": "cloud_defend", + "version": "^1.0.5" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.module", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "342f834b-21a6-41bf-878c-87d116eba3ee", + "severity": "high", + "tags": [ + "Data Source: Elastic Defend for Containers", + "Domain: Container", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "342f834b-21a6-41bf-878c-87d116eba3ee_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/345889c4-23a8-4bc0-b7ca-756bd17ce83b_1.json b/packages/security_detection_engine/kibana/security_rule/345889c4-23a8-4bc0-b7ca-756bd17ce83b_1.json new file mode 100644 index 00000000000..6d4556db5da --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/345889c4-23a8-4bc0-b7ca-756bd17ce83b_1.json @@ -0,0 +1,59 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects when a GitHub repository is deleted within your organization. Repositories are a critical component used within an organization to manage work, collaborate with others and release products to the public. Any delete action against a repository should be investigated to determine it's validity. Unauthorized deletion of organization repositories could cause irreversible loss of intellectual property and indicate compromise within your organization.", + "from": "now-9m", + "index": [ + "logs-github.audit-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "GitHub Repository Deleted", + "query": "configuration where event.module == \"github\" and event.action == \"repo.destroy\"\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.module", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "345889c4-23a8-4bc0-b7ca-756bd17ce83b", + "severity": "medium", + "tags": [ + "Domain: Cloud", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Github" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1485", + "name": "Data Destruction", + "reference": "https://attack.mitre.org/techniques/T1485/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "345889c4-23a8-4bc0-b7ca-756bd17ce83b_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/35330ba2-c859-4c98-8b7f-c19159ea0e58_104.json b/packages/security_detection_engine/kibana/security_rule/35330ba2-c859-4c98-8b7f-c19159ea0e58_104.json new file mode 100644 index 00000000000..3e86fec8f83 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/35330ba2-c859-4c98-8b7f-c19159ea0e58_104.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to execute a child process from within the context of an Electron application using the child_process Node.js module. Adversaries may abuse this technique to inherit permissions from parent processes.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Execution via Electron Child Process Node.js Module", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and process.args:(\"-e\" and const*require*child_process*)\n", + "references": [ + "https://www.matthewslipper.com/2019/09/22/everything-you-wanted-electron-child-process.html", + "https://www.trustedsec.com/blog/macos-injection-via-third-party-frameworks/", + "https://nodejs.org/api/child_process.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "35330ba2-c859-4c98-8b7f-c19159ea0e58", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "35330ba2-c859-4c98-8b7f-c19159ea0e58_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3535c8bb-3bd5-40f4-ae32-b7cd589d5372_106.json b/packages/security_detection_engine/kibana/security_rule/3535c8bb-3bd5-40f4-ae32-b7cd589d5372_106.json new file mode 100644 index 00000000000..57b1f4f0a6b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3535c8bb-3bd5-40f4-ae32-b7cd589d5372_106.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Port Forwarding Rule Addition", + "note": "## Triage and analysis\n\n### Investigating Port Forwarding Rule Addition\n\nNetwork port forwarding is a mechanism to redirect incoming TCP connections (IPv4 or IPv6) from the local TCP port to any other port number, or even to a port on a remote computer.\n\nAttackers may configure port forwarding rules to bypass network segmentation restrictions, using the host as a jump box to access previously unreachable systems.\n\nThis rule monitors the modifications to the `HKLM\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\` subkeys.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Identify the target host IP address, check the connections originating from the host where the modification occurred, and inspect the credentials used.\n - Investigate suspicious login activity, such as unauthorized access and logins from outside working hours and unusual locations.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Delete the port forwarding rule.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\PortProxy\\\\v4tov4\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\PortProxy\\\\v4tov4\\\\*\"\n)\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3535c8bb-3bd5-40f4-ae32-b7cd589d5372", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3535c8bb-3bd5-40f4-ae32-b7cd589d5372_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/35df0dd8-092d-4a83-88c1-5151a804f31b_107.json b/packages/security_detection_engine/kibana/security_rule/35df0dd8-092d-4a83-88c1-5151a804f31b_107.json new file mode 100644 index 00000000000..b334ed14fce --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/35df0dd8-092d-4a83-88c1-5151a804f31b_107.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies Windows programs run from unexpected parent processes. This could indicate masquerading or other strange activity on a system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Parent-Child Relationship", + "note": "## Triage and analysis\n\n### Investigating Unusual Parent-Child Relationship\n\nWindows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is parent-child relationships. These relationships can be used to baseline the typical behavior of the system and then alert on occurrences that don't comply with the baseline.\n\nThis rule uses this information to spot suspicious parent and child processes.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\nprocess.parent.name != null and\n (\n /* suspicious parent processes */\n (process.name:\"autochk.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"fontdrvhost.exe\", \"dwm.exe\") and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:(\"consent.exe\", \"RuntimeBroker.exe\", \"TiWorker.exe\") and not process.parent.name:\"svchost.exe\") or\n (process.name:\"SearchIndexer.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"SearchProtocolHost.exe\" and not process.parent.name:(\"SearchIndexer.exe\", \"dllhost.exe\")) or\n (process.name:\"dllhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"smss.exe\" and not process.parent.name:(\"System\", \"smss.exe\")) or\n (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\", \"svchost.exe\")) or\n (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"lsass.exe\", \"LsaIso.exe\") and not process.parent.name:\"wininit.exe\") or\n (process.name:\"LogonUI.exe\" and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or\n (process.name:\"svchost.exe\" and not process.parent.name:(\"MsMpEng.exe\", \"services.exe\")) or\n (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\", \"winlogon.exe\")) or\n (process.name:(\"wmiprvse.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") and not process.parent.name:\"svchost.exe\") or\n /* suspicious child processes */\n (process.parent.name:(\"SearchProtocolHost.exe\", \"taskhost.exe\", \"csrss.exe\") and not process.name:(\"werfault.exe\", \"wermgr.exe\", \"WerFaultSecure.exe\")) or\n (process.parent.name:\"autochk.exe\" and not process.name:(\"chkdsk.exe\", \"doskey.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"smss.exe\" and not process.name:(\"autochk.exe\", \"smss.exe\", \"csrss.exe\", \"wininit.exe\", \"winlogon.exe\", \"setupcl.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"wermgr.exe\" and not process.name:(\"WerFaultSecure.exe\", \"wermgr.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"conhost.exe\" and not process.name:(\"mscorsvw.exe\", \"wermgr.exe\", \"WerFault.exe\", \"WerFaultSecure.exe\"))\n )\n", + "references": [ + "https://github.com/sbousseaden/Slides/blob/master/Hunting%20MindMaps/PNG/Windows%20Processes%20TH.map.png", + "https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "35df0dd8-092d-4a83-88c1-5151a804f31b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/", + "subtechnique": [ + { + "id": "T1055.012", + "name": "Process Hollowing", + "reference": "https://attack.mitre.org/techniques/T1055/012/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "35df0dd8-092d-4a83-88c1-5151a804f31b_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/35f86980-1fb1-4dff-b311-3be941549c8d_103.json b/packages/security_detection_engine/kibana/security_rule/35f86980-1fb1-4dff-b311-3be941549c8d_103.json new file mode 100644 index 00000000000..3f1bb49feff --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/35f86980-1fb1-4dff-b311-3be941549c8d_103.json @@ -0,0 +1,42 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a rare destination country name in the network logs. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from a server in a country which does not normally appear in network traffic or business work-flows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.", + "false_positives": [ + "Business workflows that occur very occasionally, and involve a business relationship with an organization in a country that does not routinely appear in network events, can trigger this alert. A new business workflow with an organization in a country with which no workflows previously existed may trigger this alert - although the model will learn that the new destination country is no longer anomalous as the activity becomes ongoing. Business travelers who roam to many countries for brief periods may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "rare_destination_country", + "name": "Network Traffic to Rare Destination Country", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "35f86980-1fb1-4dff-b311-3be941549c8d", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "35f86980-1fb1-4dff-b311-3be941549c8d_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3688577a-d196-11ec-90b0-f661ea17fbce_106.json b/packages/security_detection_engine/kibana/security_rule/3688577a-d196-11ec-90b0-f661ea17fbce_106.json new file mode 100644 index 00000000000..a46302b0033 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3688577a-d196-11ec-90b0-f661ea17fbce_106.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a new process starting from a process ID (PID), lock or reboot file within the temporary file storage paradigm (tmpfs) directory /var/run directory. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.", + "false_positives": [ + "False-Positives (FP) should be at a minimum with this detection as PID files are meant to hold process IDs, not inherently be executables that spawn processes." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Started from Process ID (PID) File", + "note": "## Triage and analysis\n\n### Investigating Process Started from Process ID (PID) File\nDetection alerts from this rule indicate a process spawned from an executable masqueraded as a legitimate PID file which is very unusual and should not occur. Here are some possible avenues of investigation:\n- Examine parent and child process relationships of the new process to determine if other processes are running.\n- Examine the /var/run directory using Osquery to determine other potential PID files with unsually large file sizes, indicative of it being an executable: \"SELECT f.size, f.uid, f.type, f.path from file f WHERE path like '/var/run/%%';\"\n- Examine the reputation of the SHA256 hash from the PID file in a database like VirusTotal to identify additional pivots and artifacts for investigation.", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and user.id == \"0\" and\n process.executable regex~ \"\"\"/var/run/\\w+\\.(pid|lock|reboot)\"\"\"\n", + "references": [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3688577a-d196-11ec-90b0-f661ea17fbce", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3688577a-d196-11ec-90b0-f661ea17fbce_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/36a8e048-d888-4f61-a8b9-0f9e2e40f317_104.json b/packages/security_detection_engine/kibana/security_rule/36a8e048-d888-4f61-a8b9-0f9e2e40f317_104.json new file mode 100644 index 00000000000..b33be5a1579 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/36a8e048-d888-4f61-a8b9-0f9e2e40f317_104.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a suspicious ImagePath value. This could be an indication of an adversary attempting to stealthily persist or escalate privileges through abnormal service creation.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious ImagePath Service Creation", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ImagePath\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ImagePath\"\n ) and\n /* add suspicious registry ImagePath values here */\n registry.data.strings : (\"%COMSPEC%*\", \"*\\\\.\\\\pipe\\\\*\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "36a8e048-d888-4f61-a8b9-0f9e2e40f317", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "36a8e048-d888-4f61-a8b9-0f9e2e40f317_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_1.json b/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_1.json new file mode 100644 index 00000000000..4b1b4fe0a2c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_1.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Suspicious File Edit", + "query": "file where event.action in (\"creation\", \"file_create_event\") and file.extension == \"swp\" and \nfile.path : (\n /* common interesting files and locations */\n \"/etc/.shadow.swp\", \"/etc/.shadow-.swp\", \"/etc/.shadow~.swp\", \"/etc/.gshadow.swp\", \"/etc/.gshadow-.swp\",\n \"/etc/.passwd.swp\", \"/etc/.pwd.db.swp\", \"/etc/.master.passwd.swp\", \"/etc/.spwd.db.swp\", \"/etc/security/.opasswd.swp\",\n \"/etc/.hosts.swp\", \"/etc/.environment.swp\", \"/etc/.profile.swp\", \"/etc/sudoers.d/.*.swp\",\n \"/etc/ld.so.conf.d/.*.swp\", \"/etc/init.d/.*.swp\", \"/etc/.rc.local.swp\", \"/etc/rc*.d/.*.swp\",\n \"/dev/shm/.*.swp\", \"/etc/update-motd.d/.*.swp\", \"/usr/lib/update-notifier/.*.swp\",\n\n /* service, timer, want, socket and lock files */\n \"/etc/systemd/system/.*.swp\", \"/usr/local/lib/systemd/system/.*.swp\", \"/lib/systemd/system/.*.swp\",\n \"/usr/lib/systemd/system/.*.swp\",\"/home/*/.config/systemd/user/.*.swp\", \"/run/.*.swp\", \"/var/run/.*.swp/\",\n\n /* profile and shell configuration files */ \n \"/home/*.profile.swp\", \"/home/*.bash_profile.swp\", \"/home/*.bash_login.swp\", \"/home/*.bashrc.swp\", \"/home/*.bash_logout.swp\",\n \"/home/*.zshrc.swp\", \"/home/*.zlogin.swp\", \"/home/*.tcshrc.swp\", \"/home/*.kshrc.swp\", \"/home/*.config.fish.swp\",\n \"/root/*.profile.swp\", \"/root/*.bash_profile.swp\", \"/root/*.bash_login.swp\", \"/root/*.bashrc.swp\", \"/root/*.bash_logout.swp\",\n \"/root/*.zshrc.swp\", \"/root/*.zlogin.swp\", \"/root/*.tcshrc.swp\", \"/root/*.kshrc.swp\", \"/root/*.config.fish.swp\"\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "3728c08d-9b70-456b-b6b8-007c7d246128", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + }, + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "3728c08d-9b70-456b-b6b8-007c7d246128_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_2.json b/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_2.json new file mode 100644 index 00000000000..5d930e26be8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3728c08d-9b70-456b-b6b8-007c7d246128_2.json @@ -0,0 +1,130 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the potential edit of a suspicious file. In Linux, when editing a file through an editor, a temporary .swp file is created. By monitoring for the creation of this .swp file, we can detect potential file edits of suspicious files. The execution of this rule is not a clear sign of the file being edited, as just opening the file through an editor will trigger this event. Attackers may alter any of the files added in this rule to establish persistence, escalate privileges or perform reconnaisance on the system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Suspicious File Edit", + "query": "file where event.action in (\"creation\", \"file_create_event\") and file.extension == \"swp\" and \nfile.path : (\n /* common interesting files and locations */\n \"/etc/.shadow.swp\", \"/etc/.shadow-.swp\", \"/etc/.shadow~.swp\", \"/etc/.gshadow.swp\", \"/etc/.gshadow-.swp\",\n \"/etc/.passwd.swp\", \"/etc/.pwd.db.swp\", \"/etc/.master.passwd.swp\", \"/etc/.spwd.db.swp\", \"/etc/security/.opasswd.swp\",\n \"/etc/.hosts.swp\", \"/etc/.environment.swp\", \"/etc/.profile.swp\", \"/etc/sudoers.d/.*.swp\",\n \"/etc/ld.so.conf.d/.*.swp\", \"/etc/init.d/.*.swp\", \"/etc/.rc.local.swp\", \"/etc/rc*.d/.*.swp\",\n \"/dev/shm/.*.swp\", \"/etc/update-motd.d/.*.swp\", \"/usr/lib/update-notifier/.*.swp\",\n\n /* service, timer, want, socket and lock files */\n \"/etc/systemd/system/.*.swp\", \"/usr/local/lib/systemd/system/.*.swp\", \"/lib/systemd/system/.*.swp\",\n \"/usr/lib/systemd/system/.*.swp\",\"/home/*/.config/systemd/user/.*.swp\", \"/run/.*.swp\", \"/var/run/.*.swp/\",\n\n /* profile and shell configuration files */ \n \"/home/*.profile.swp\", \"/home/*.bash_profile.swp\", \"/home/*.bash_login.swp\", \"/home/*.bashrc.swp\", \"/home/*.bash_logout.swp\",\n \"/home/*.zshrc.swp\", \"/home/*.zlogin.swp\", \"/home/*.tcshrc.swp\", \"/home/*.kshrc.swp\", \"/home/*.config.fish.swp\",\n \"/root/*.profile.swp\", \"/root/*.bash_profile.swp\", \"/root/*.bash_login.swp\", \"/root/*.bashrc.swp\", \"/root/*.bash_logout.swp\",\n \"/root/*.zshrc.swp\", \"/root/*.zlogin.swp\", \"/root/*.tcshrc.swp\", \"/root/*.kshrc.swp\", \"/root/*.config.fish.swp\"\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "3728c08d-9b70-456b-b6b8-007c7d246128", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + }, + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "3728c08d-9b70-456b-b6b8-007c7d246128_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/37f638ea-909d-4f94-9248-edd21e4a9906_104.json b/packages/security_detection_engine/kibana/security_rule/37f638ea-909d-4f94-9248-edd21e4a9906_104.json new file mode 100644 index 00000000000..03f38c43348 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/37f638ea-909d-4f94-9248-edd21e4a9906_104.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Finder Sync plugins enable users to extend Finder\u2019s functionality by modifying the user interface. Adversaries may abuse this feature by adding a rogue Finder Plugin to repeatedly execute malicious payloads for persistence.", + "false_positives": [ + "Trusted Finder Sync Plugins" + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Finder Sync Plugin Registered and Enabled", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name : \"pluginkit\" and\n process.args : \"-e\" and process.args : \"use\" and process.args : \"-i\" and\n not process.args :\n (\n \"com.google.GoogleDrive.FinderSyncAPIExtension\",\n \"com.google.drivefs.findersync\",\n \"com.boxcryptor.osx.Rednif\",\n \"com.adobe.accmac.ACCFinderSync\",\n \"com.microsoft.OneDrive.FinderSync\",\n \"com.insynchq.Insync.Insync-Finder-Integration\",\n \"com.box.desktop.findersyncext\"\n ) and\n not process.parent.executable : (\n \"/Library/Application Support/IDriveforMac/IDriveHelperTools/FinderPluginApp.app/Contents/MacOS/FinderPluginApp\"\n )\n", + "references": [ + "https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "37f638ea-909d-4f94-9248-edd21e4a9906", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "37f638ea-909d-4f94-9248-edd21e4a9906_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_104.json b/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_104.json new file mode 100644 index 00000000000..8b2d5f3a68b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_104.json @@ -0,0 +1,72 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempted Bypass of Okta MFA", + "note": "## Triage and analysis\n\n### Investigating Attempted Bypass of Okta MFA\n\nMulti-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.\n\nThis rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.\n\n#### Possible investigation steps\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the bypass attempt.\n- Check the `okta.outcome.result` field to confirm the MFA bypass attempt.\n- Check if there are multiple unsuccessful MFA attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the MFA bypass attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.\n\n### False positive analysis\n\n- Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's MFA settings to ensure they are correctly configured.\n\n### Response and remediation\n\n- If unauthorized access is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific MFA bypass technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:user.mfa.attempt_bypass\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3805c3dc-f82c-4f8d-891e-63c24d3102b0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1111", + "name": "Multi-Factor Authentication Interception", + "reference": "https://attack.mitre.org/techniques/T1111/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "3805c3dc-f82c-4f8d-891e-63c24d3102b0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_105.json b/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_105.json new file mode 100644 index 00000000000..a548528bd42 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3805c3dc-f82c-4f8d-891e-63c24d3102b0_105.json @@ -0,0 +1,71 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to bypass Okta multi-factor authentication (MFA). An adversary may attempt to bypass the Okta MFA policies configured for an organization in order to obtain unauthorized access to an application.", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempted Bypass of Okta MFA", + "note": "## Triage and analysis\n\n### Investigating Attempted Bypass of Okta MFA\n\nMulti-factor authentication (MFA) is a crucial security measure in preventing unauthorized access. Okta MFA, like other MFA solutions, requires the user to provide multiple means of identification at login. An adversary might attempt to bypass Okta MFA to gain unauthorized access to an application.\n\nThis rule detects attempts to bypass Okta MFA. It might indicate a serious attempt to compromise a user account within the organization's network.\n\n#### Possible investigation steps\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the bypass attempt.\n- Check the `okta.outcome.result` field to confirm the MFA bypass attempt.\n- Check if there are multiple unsuccessful MFA attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the MFA bypass attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the bypass attempt.\n\n### False positive analysis\n\n- Check if there were issues with the MFA system at the time of the bypass attempt. This could indicate a system error rather than a genuine bypass attempt.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the login attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's MFA settings to ensure they are correctly configured.\n\n### Response and remediation\n\n- If unauthorized access is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific MFA bypass technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:user.mfa.attempt_bypass\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3805c3dc-f82c-4f8d-891e-63c24d3102b0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1111", + "name": "Multi-Factor Authentication Interception", + "reference": "https://attack.mitre.org/techniques/T1111/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "3805c3dc-f82c-4f8d-891e-63c24d3102b0_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3838e0e3-1850-4850-a411-2e8c5ba40ba8_107.json b/packages/security_detection_engine/kibana/security_rule/3838e0e3-1850-4850-a411-2e8c5ba40ba8_107.json new file mode 100644 index 00000000000..5ec8c32fceb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3838e0e3-1850-4850-a411-2e8c5ba40ba8_107.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies certutil.exe making a network connection. Adversaries could abuse certutil.exe to download a certificate, or malware, from a remote URL.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via Certutil", + "note": "## Triage and analysis\n\n### Investigating Network Connection via Certutil\n\nAttackers can abuse `certutil.exe` to download malware, offensive security tools, and certificates from external sources in order to take the next steps in a compromised environment.\n\nThis rule looks for network events where `certutil.exe` contacts IP ranges other than the ones specified in [IANA IPv4 Special-Purpose Address Registry](https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml)\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate if the downloaded file was executed.\n- Determine the context in which `certutil.exe` and the file were run.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the downloaded file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. If trusted software uses this command and the triage has not identified anything suspicious, this alert can be closed as a false positive.\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"certutil.exe\" and event.type == \"start\"]\n [network where host.os.type == \"windows\" and process.name : \"certutil.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml", + "https://frsecure.com/malware-incident-response-playbook/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "3838e0e3-1850-4850-a411-2e8c5ba40ba8_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/38948d29-3d5d-42e3-8aec-be832aaaf8eb_104.json b/packages/security_detection_engine/kibana/security_rule/38948d29-3d5d-42e3-8aec-be832aaaf8eb_104.json new file mode 100644 index 00000000000..106f69a33ed --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/38948d29-3d5d-42e3-8aec-be832aaaf8eb_104.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of osascript to execute scripts via standard input that may prompt a user with a rogue dialog for credentials.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Prompt for Credentials with OSASCRIPT", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*display dialog*password*\"\n", + "references": [ + "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/prompt.py", + "https://ss64.com/osx/osascript.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "38948d29-3d5d-42e3-8aec-be832aaaf8eb", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1056", + "name": "Input Capture", + "reference": "https://attack.mitre.org/techniques/T1056/", + "subtechnique": [ + { + "id": "T1056.002", + "name": "GUI Input Capture", + "reference": "https://attack.mitre.org/techniques/T1056/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "38948d29-3d5d-42e3-8aec-be832aaaf8eb_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/39157d52-4035-44a8-9d1a-6f8c5f580a07_1.json b/packages/security_detection_engine/kibana/security_rule/39157d52-4035-44a8-9d1a-6f8c5f580a07_1.json new file mode 100644 index 00000000000..d19aa5de544 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/39157d52-4035-44a8-9d1a-6f8c5f580a07_1.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies .lnk shortcut file downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Downloaded Shortcut Files", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and file.extension == \"lnk\" and file.Ext.windows.zone_identifier \u003e 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.windows.zone_identifier", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "39157d52-4035-44a8-9d1a-6f8c5f580a07", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "39157d52-4035-44a8-9d1a-6f8c5f580a07_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/397945f3-d39a-4e6f-8bcb-9656c2031438_104.json b/packages/security_detection_engine/kibana/security_rule/397945f3-d39a-4e6f-8bcb-9656c2031438_104.json new file mode 100644 index 00000000000..fec9a057074 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/397945f3-d39a-4e6f-8bcb-9656c2031438_104.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to establish persistence on an endpoint by installing a rogue Microsoft Outlook VBA Template.", + "false_positives": [ + "A legitimate VBA for Outlook is usually configured interactively via OUTLOOK.EXE." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Microsoft Outlook VBA", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.path : \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Outlook\\\\VbaProject.OTM\"\n", + "references": [ + "https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/", + "https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "397945f3-d39a-4e6f-8bcb-9656c2031438", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1137", + "name": "Office Application Startup", + "reference": "https://attack.mitre.org/techniques/T1137/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "397945f3-d39a-4e6f-8bcb-9656c2031438_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3a59fc81-99d3-47ea-8cd6-d48d561fca20_106.json b/packages/security_detection_engine/kibana/security_rule/3a59fc81-99d3-47ea-8cd6-d48d561fca20_106.json new file mode 100644 index 00000000000..80e1f232ade --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3a59fc81-99d3-47ea-8cd6-d48d561fca20_106.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a large number (15) of nslookup.exe executions with an explicit query type from the same host. This may indicate command and control activity utilizing the DNS protocol.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential DNS Tunneling via NsLookup", + "note": "## Triage and analysis\n\n### Investigating Potential DNS Tunneling via NsLookup\n\nAttackers can abuse existing network rules that allow DNS communication with external resources to use the protocol as their command and control and/or exfiltration channel.\n\nDNS queries can be used to infiltrate data such as commands to be run, malicious files, etc., and also for exfiltration, since queries can be used to send data to the attacker-controlled DNS server. This process is commonly known as DNS tunneling.\n\nMore information on how tunneling works and how it can be abused can be found on [Palo Alto Unit42 Research](https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors).\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the DNS query and identify the information sent.\n- Extract this communication's indicators of compromise (IoCs) and use traffic logs to search for other potentially compromised hosts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. If the parent process is trusted and the data sent is not sensitive nor command and control related, this alert can be closed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Immediately block the identified indicators of compromise (IoCs).\n- Implement any temporary network rules, procedures, and segmentation required to contain the attack.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Update firewall rules to be more restrictive.\n- Reimage the host operating system or restore the compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:windows and event.type:start and process.name:nslookup.exe and process.args:(-querytype=* or -qt=* or -q=* or -type=*)\n", + "references": [ + "https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3a59fc81-99d3-47ea-8cd6-d48d561fca20", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.004", + "name": "DNS", + "reference": "https://attack.mitre.org/techniques/T1071/004/" + } + ] + } + ] + } + ], + "threshold": { + "field": [ + "host.id" + ], + "value": 15 + }, + "type": "threshold", + "version": 106 + }, + "id": "3a59fc81-99d3-47ea-8cd6-d48d561fca20_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3a6001a0-0939-4bbe-86f4-47d8faeb7b97_4.json b/packages/security_detection_engine/kibana/security_rule/3a6001a0-0939-4bbe-86f4-47d8faeb7b97_4.json new file mode 100644 index 00000000000..9b1ee729e69 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3a6001a0-0939-4bbe-86f4-47d8faeb7b97_4.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies LSASS loading an unsigned or untrusted DLL. Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Module Loaded by LSASS", + "note": "", + "query": "library where host.os.type == \"windows\" and process.executable : \"?:\\\\Windows\\\\System32\\\\lsass.exe\" and\n not (dll.code_signature.subject_name :\n (\"Microsoft Windows\",\n \"Microsoft Corporation\",\n \"Microsoft Windows Publisher\",\n \"Microsoft Windows Software Compatibility Publisher\",\n \"Microsoft Windows Hardware Compatibility Publisher\",\n \"McAfee, Inc.\",\n \"SecMaker AB\",\n \"HID Global Corporation\",\n \"HID Global\",\n \"Apple Inc.\",\n \"Citrix Systems, Inc.\",\n \"Dell Inc\",\n \"Hewlett-Packard Company\",\n \"Symantec Corporation\",\n \"National Instruments Corporation\",\n \"DigitalPersona, Inc.\",\n \"Novell, Inc.\",\n \"gemalto\",\n \"EasyAntiCheat Oy\",\n \"Entrust Datacard Corporation\",\n \"AuriStor, Inc.\",\n \"LogMeIn, Inc.\",\n \"VMware, Inc.\",\n \"Istituto Poligrafico e Zecca dello Stato S.p.A.\",\n \"Nubeva Technologies Ltd\",\n \"Micro Focus (US), Inc.\",\n \"Yubico AB\",\n \"GEMALTO SA\",\n \"Secure Endpoints, Inc.\",\n \"Sophos Ltd\",\n \"Morphisec Information Security 2014 Ltd\",\n \"Entrust, Inc.\",\n \"Nubeva Technologies Ltd\",\n \"Micro Focus (US), Inc.\",\n \"F5 Networks Inc\",\n \"Bit4id\",\n \"Thales DIS CPL USA, Inc.\",\n \"Micro Focus International plc\",\n \"HYPR Corp\",\n \"Intel(R) Software Development Products\",\n \"PGP Corporation\",\n \"Parallels International GmbH\",\n \"FrontRange Solutions Deutschland GmbH\",\n \"SecureLink, Inc.\",\n \"Tidexa OU\",\n \"Amazon Web Services, Inc.\",\n \"SentryBay Limited\",\n \"Audinate Pty Ltd\",\n \"CyberArk Software Ltd.\",\n \"McAfeeSysPrep\",\n \"NVIDIA Corporation PE Sign v2016\") and\n dll.code_signature.status : (\"trusted\", \"errorExpired\", \"errorCode_endpoint*\", \"errorChaining\")) and\n\n not dll.hash.sha256 :\n (\"811a03a5d7c03802676d2613d741be690b3461022ea925eb6b2651a5be740a4c\",\n \"1181542d9cfd63fb00c76242567446513e6773ea37db6211545629ba2ecf26a1\",\n \"ed6e735aa6233ed262f50f67585949712f1622751035db256811b4088c214ce3\",\n \"26be2e4383728eebe191c0ab19706188f0e9592add2e0bf86b37442083ae5e12\",\n \"9367e78b84ef30cf38ab27776605f2645e52e3f6e93369c674972b668a444faa\",\n \"d46cc934765c5ecd53867070f540e8d6f7701e834831c51c2b0552aba871921b\",\n \"0f77a3826d7a5cd0533990be0269d951a88a5c277bc47cff94553330b715ec61\",\n \"4aca034d3d85a9e9127b5d7a10882c2ef4c3e0daa3329ae2ac1d0797398695fb\",\n \"86031e69914d9d33c34c2f4ac4ae523cef855254d411f88ac26684265c981d95\")\n", + "references": [ + "https://blog.xpnsec.com/exploring-mimikatz-part-2/", + "https://github.com/jas502n/mimikat_ssp" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3a6001a0-0939-4bbe-86f4-47d8faeb7b97", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "3a6001a0-0939-4bbe-86f4-47d8faeb7b97_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3ad49c61-7adc-42c1-b788-732eda2f5abf_103.json b/packages/security_detection_engine/kibana/security_rule/3ad49c61-7adc-42c1-b788-732eda2f5abf_103.json new file mode 100644 index 00000000000..44f54602b9d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3ad49c61-7adc-42c1-b788-732eda2f5abf_103.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.", + "false_positives": [ + "VNC connections may be made directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "VNC (Virtual Network Computing) to the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and destination.port \u003e= 5800 and destination.port \u003c= 5810 and\n source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n ) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "3ad49c61-7adc-42c1-b788-732eda2f5abf", + "severity": "medium", + "tags": [ + "Tactic: Command and Control", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Software", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "3ad49c61-7adc-42c1-b788-732eda2f5abf_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_106.json b/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_106.json new file mode 100644 index 00000000000..4674c2c2335 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_106.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Parent Process for cmd.exe", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"cmd.exe\" and\n process.parent.name : (\"lsass.exe\",\n \"csrss.exe\",\n \"epad.exe\",\n \"regsvr32.exe\",\n \"dllhost.exe\",\n \"LogonUI.exe\",\n \"wermgr.exe\",\n \"spoolsv.exe\",\n \"jucheck.exe\",\n \"jusched.exe\",\n \"ctfmon.exe\",\n \"taskhostw.exe\",\n \"GoogleUpdate.exe\",\n \"sppsvc.exe\",\n \"sihost.exe\",\n \"slui.exe\",\n \"SIHClient.exe\",\n \"SearchIndexer.exe\",\n \"SearchProtocolHost.exe\",\n \"FlashPlayerUpdateService.exe\",\n \"WerFault.exe\",\n \"WUDFHost.exe\",\n \"unsecapp.exe\",\n \"wlanext.exe\" )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3b47900d-e793-49e8-968f-c90dc3526aa1", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3b47900d-e793-49e8-968f-c90dc3526aa1_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_107.json b/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_107.json new file mode 100644 index 00000000000..b5e03d91822 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3b47900d-e793-49e8-968f-c90dc3526aa1_107.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from an unusual process.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Parent Process for cmd.exe", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"cmd.exe\" and\n process.parent.name : (\"lsass.exe\",\n \"csrss.exe\",\n \"epad.exe\",\n \"regsvr32.exe\",\n \"dllhost.exe\",\n \"LogonUI.exe\",\n \"wermgr.exe\",\n \"spoolsv.exe\",\n \"jucheck.exe\",\n \"jusched.exe\",\n \"ctfmon.exe\",\n \"taskhostw.exe\",\n \"GoogleUpdate.exe\",\n \"sppsvc.exe\",\n \"sihost.exe\",\n \"slui.exe\",\n \"SIHClient.exe\",\n \"SearchIndexer.exe\",\n \"SearchProtocolHost.exe\",\n \"FlashPlayerUpdateService.exe\",\n \"WerFault.exe\",\n \"WUDFHost.exe\",\n \"unsecapp.exe\",\n \"wlanext.exe\" ) and\n not (process.parent.name : \"dllhost.exe\" and process.parent.args : \"/Processid:{CA8C87C1-929D-45BA-94DB-EF8E6CB346AD}\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3b47900d-e793-49e8-968f-c90dc3526aa1", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "3b47900d-e793-49e8-968f-c90dc3526aa1_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3bc6deaa-fbd4-433a-ae21-3e892f95624f_106.json b/packages/security_detection_engine/kibana/security_rule/3bc6deaa-fbd4-433a-ae21-3e892f95624f_106.json new file mode 100644 index 00000000000..bd01dce091d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3bc6deaa-fbd4-433a-ae21-3e892f95624f_106.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies a copy operation of the Active Directory Domain Database (ntds.dit) or Security Account Manager (SAM) files. Those files contain sensitive information including hashed domain and/or local credentials.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "NTDS or SAM Database File Copied", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n (process.pe.original_file_name in (\"Cmd.Exe\", \"PowerShell.EXE\", \"XCOPY.EXE\") and\n process.args : (\"copy\", \"xcopy\", \"Copy-Item\", \"move\", \"cp\", \"mv\")\n ) or\n (process.pe.original_file_name : \"esentutl.exe\" and process.args : (\"*/y*\", \"*/vss*\", \"*/d*\"))\n ) and\n process.args : (\"*\\\\ntds.dit\", \"*\\\\config\\\\SAM\", \"\\\\*\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy*\\\\*\", \"*/system32/config/SAM*\")\n", + "references": [ + "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/", + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3bc6deaa-fbd4-433a-ae21-3e892f95624f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3bc6deaa-fbd4-433a-ae21-3e892f95624f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3c7e32e6-6104-46d9-a06e-da0f8b5795a0_103.json b/packages/security_detection_engine/kibana/security_rule/3c7e32e6-6104-46d9-a06e-da0f8b5795a0_103.json new file mode 100644 index 00000000000..5e9d2bd5796 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3c7e32e6-6104-46d9-a06e-da0f8b5795a0_103.json @@ -0,0 +1,46 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies unusual destination port activity that can indicate command-and-control, persistence mechanism, or data exfiltration activity. Rarely used destination port activity is generally unusual in Linux fleets, and can indicate unauthorized access or threat actor activity.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_anomalous_network_port_activity" + ], + "name": "Unusual Linux Network Port Activity", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "3c7e32e6-6104-46d9-a06e-da0f8b5795a0_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3d3aa8f9-12af-441f-9344-9f31053e316d_1.json b/packages/security_detection_engine/kibana/security_rule/3d3aa8f9-12af-441f-9344-9f31053e316d_1.json new file mode 100644 index 00000000000..5caca57d936 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3d3aa8f9-12af-441f-9344-9f31053e316d_1.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to Windows event log deletion activities. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Log Clear Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"Clear-EventLog\" or\n \"Remove-EventLog\" or\n (\"Eventing.Reader.EventLogSession\" and \".ClearLog\") or\n (\"Diagnostics.EventLog\" and \".Clear\")\n )\n", + "references": [ + "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear", + "https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "3d3aa8f9-12af-441f-9344-9f31053e316d", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.001", + "name": "Clear Windows Event Logs", + "reference": "https://attack.mitre.org/techniques/T1070/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "3d3aa8f9-12af-441f-9344-9f31053e316d_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3e0eeb75-16e8-4f2f-9826-62461ca128b7_4.json b/packages/security_detection_engine/kibana/security_rule/3e0eeb75-16e8-4f2f-9826-62461ca128b7_4.json new file mode 100644 index 00000000000..e64290bf866 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3e0eeb75-16e8-4f2f-9826-62461ca128b7_4.json @@ -0,0 +1,142 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects Linux Bash commands from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Execution via Windows Subsystem for Linux", + "query": "process where host.os.type == \"windows\" and event.type : \"start\" and\n (\n ((process.executable : \"?:\\\\Windows\\\\System32\\\\bash.exe\" or process.pe.original_file_name == \"Bash.exe\") and \n not process.command_line : (\"bash\", \"bash.exe\")) or \n process.executable : \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Packages\\\\*\\\\rootfs\\\\usr\\\\bin\\\\bash\" or \n (process.parent.name : \"wsl.exe\" and process.parent.command_line : \"bash*\" and not process.name : \"wslhost.exe\") or \n (process.name : \"wsl.exe\" and process.args : (\"curl\", \"/etc/shadow\", \"/etc/passwd\", \"cat\",\"--system\", \"root\", \"-e\", \"--exec\", \"bash\", \"/mnt/c/*\"))\n ) and \n not process.parent.executable : (\"?:\\\\Program Files\\\\Docker\\\\*.exe\", \"?:\\\\Program Files (x86)\\\\Docker\\\\*.exe\")\n", + "references": [ + "https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/", + "https://blog.qualys.com/vulnerabilities-threat-research/2022/03/22/implications-of-windows-subsystem-for-linux-for-adversaries-defenders-part-1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3e0eeb75-16e8-4f2f-9826-62461ca128b7", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "3e0eeb75-16e8-4f2f-9826-62461ca128b7_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3e3d15c6-1509-479a-b125-21718372157e_104.json b/packages/security_detection_engine/kibana/security_rule/3e3d15c6-1509-479a-b125-21718372157e_104.json new file mode 100644 index 00000000000..0538c336e17 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3e3d15c6-1509-479a-b125-21718372157e_104.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a suspicious child process of the Event Monitor Daemon (emond). Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Emond Child Process", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.parent.name : \"emond\" and\n process.name : (\n \"bash\",\n \"dash\",\n \"sh\",\n \"tcsh\",\n \"csh\",\n \"zsh\",\n \"ksh\",\n \"fish\",\n \"Python\",\n \"python*\",\n \"perl*\",\n \"php*\",\n \"osascript\",\n \"pwsh\",\n \"curl\",\n \"wget\",\n \"cp\",\n \"mv\",\n \"touch\",\n \"echo\",\n \"base64\",\n \"launchctl\")\n", + "references": [ + "https://www.xorrior.com/emond-persistence/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3e3d15c6-1509-479a-b125-21718372157e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.014", + "name": "Emond", + "reference": "https://attack.mitre.org/techniques/T1546/014/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "3e3d15c6-1509-479a-b125-21718372157e_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3ecbdc9e-e4f2-43fa-8cca-63802125e582_106.json b/packages/security_detection_engine/kibana/security_rule/3ecbdc9e-e4f2-43fa-8cca-63802125e582_106.json new file mode 100644 index 00000000000..7a5e3349186 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3ecbdc9e-e4f2-43fa-8cca-63802125e582_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a privilege escalation attempt via named pipe impersonation. An adversary may abuse this technique by utilizing a framework such Metasploit's meterpreter getsystem command.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Privilege Escalation via Named Pipe Impersonation", + "note": "## Triage and analysis\n\n### Investigating Privilege Escalation via Named Pipe Impersonation\n\nA named pipe is a type of inter-process communication (IPC) mechanism used in operating systems like Windows, which allows two or more processes to communicate with each other by sending and receiving data through a well-known point.\n\nAttackers can abuse named pipes to elevate their privileges by impersonating the security context in which they execute code. Metasploit, for example, creates a service and a random pipe, and then uses the service to connect to the pipe and impersonate the service security context, which is SYSTEM.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - If any suspicious processes were found, examine the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name in (\"Cmd.Exe\", \"PowerShell.EXE\") and\n process.args : \"echo\" and process.args : \"\u003e\" and process.args : \"\\\\\\\\.\\\\pipe\\\\*\"\n", + "references": [ + "https://www.ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation", + "https://www.cobaltstrike.com/blog/what-happens-when-i-type-getsystem/", + "https://redcanary.com/blog/getsystem-offsec/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3ecbdc9e-e4f2-43fa-8cca-63802125e582", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1134", + "name": "Access Token Manipulation", + "reference": "https://attack.mitre.org/techniques/T1134/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3ecbdc9e-e4f2-43fa-8cca-63802125e582_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3ed032b2-45d8-4406-bc79-7ad1eabb2c72_207.json b/packages/security_detection_engine/kibana/security_rule/3ed032b2-45d8-4406-bc79-7ad1eabb2c72_207.json new file mode 100644 index 00000000000..d258d3815a6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3ed032b2-45d8-4406-bc79-7ad1eabb2c72_207.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a process is created and immediately accessed from an unknown memory code region and by the same parent process. This may indicate a code injection attempt.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Creation CallTrace", + "note": "## Triage and analysis\n\n### Investigating Suspicious Process Creation CallTrace\n\nAttackers may inject code into child processes' memory to hide their actual activity, evade detection mechanisms, and decrease discoverability during forensics. This rule looks for a spawned process by Microsoft Office, scripting, and command line applications, followed by a process access event for an unknown memory region by the parent process, which can indicate a code injection attempt.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Create a memory dump of the child process for analysis.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id with maxspan=1m\n [process where host.os.type == \"windows\" and event.code == \"1\" and\n /* sysmon process creation */\n process.parent.name : (\"winword.exe\", \"excel.exe\", \"outlook.exe\", \"powerpnt.exe\", \"eqnedt32.exe\", \"fltldr.exe\",\n \"mspub.exe\", \"msaccess.exe\",\"cscript.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n \"mshta.exe\", \"wmic.exe\", \"cmstp.exe\", \"msxsl.exe\") and\n\n /* noisy FP patterns */\n not (process.parent.name : \"EXCEL.EXE\" and process.executable : \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\Office*\\\\ADDINS\\\\*.exe\") and\n not (process.executable : \"?:\\\\Windows\\\\splwow64.exe\" and process.args in (\"8192\", \"12288\") and process.parent.name : (\"winword.exe\", \"excel.exe\", \"outlook.exe\", \"powerpnt.exe\")) and\n not (process.parent.name : \"rundll32.exe\" and process.parent.args : (\"?:\\\\WINDOWS\\\\Installer\\\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc\", \"--no-sandbox\")) and\n not (process.executable :\n (\"?:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeWebView\\\\Application\\\\*\\\\msedgewebview2.exe\",\n \"?:\\\\Program Files\\\\Adobe\\\\Acrobat DC\\\\Acrobat\\\\Acrobat.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\DWWIN.EXE\") and\n process.parent.name : (\"winword.exe\", \"excel.exe\", \"outlook.exe\", \"powerpnt.exe\")) and\n not (process.parent.name : \"regsvr32.exe\" and process.parent.args : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\"))\n ] by process.parent.entity_id, process.entity_id\n [process where host.os.type == \"windows\" and event.code == \"10\" and\n /* Sysmon process access event from unknown module */\n winlog.event_data.CallTrace : \"*UNKNOWN*\"] by process.entity_id, winlog.event_data.TargetProcessGUID\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetProcessGUID", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3ed032b2-45d8-4406-bc79-7ad1eabb2c72", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "type": "eql", + "version": 207 + }, + "id": "3ed032b2-45d8-4406-bc79-7ad1eabb2c72_207", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3f12325a-4cc6-410b-8d4c-9fbbeb744cfd_1.json b/packages/security_detection_engine/kibana/security_rule/3f12325a-4cc6-410b-8d4c-9fbbeb744cfd_1.json new file mode 100644 index 00000000000..08a6e3b94af --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3f12325a-4cc6-410b-8d4c-9fbbeb744cfd_1.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for common command line flags leveraged by the Chisel client utility followed by a connection attempt. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Protocol Tunneling via Chisel Client", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.args == \"client\" and process.args : (\"R*\", \"*:*\", \"*socks*\", \"*.*\") and process.args_count \u003e= 4 and \n process.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")]\n [network where host.os.type == \"linux\" and event.action == \"connection_attempted\" and event.type == \"start\" and \n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" and \n not process.name : (\n \"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\", \"java\", \"telnet\",\n \"ftp\", \"socat\", \"curl\", \"wget\", \"dpkg\", \"docker\", \"dockerd\", \"yum\", \"apt\", \"rpm\", \"dnf\", \"ssh\", \"sshd\")]\n", + "references": [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "3f12325a-4cc6-410b-8d4c-9fbbeb744cfd_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3f3f9fe2-d095-11ec-95dc-f661ea17fbce_106.json b/packages/security_detection_engine/kibana/security_rule/3f3f9fe2-d095-11ec-95dc-f661ea17fbce_106.json new file mode 100644 index 00000000000..2506531314a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3f3f9fe2-d095-11ec-95dc-f661ea17fbce_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a binary by root in Linux shared memory directories: (/dev/shm/, /run/shm/, /var/run/, /var/lock/). This activity is to be considered highly abnormal and should be investigated. Threat actors have placed executables used for persistence on high-uptime servers in these directories as system backdoors.", + "false_positives": [ + "Directories /dev/shm and /run/shm are temporary file storage directories in Linux. They are intended to appear as a mounted file system, but uses virtual memory instead of a persistent storage device and thus are used for mounting file systems in legitimate purposes." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Binary Executed from Shared Memory Directory", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"exec\", \"exec_event\") and\nprocess.executable : (\"/dev/shm/*\", \"/run/shm/*\", \"/var/run/*\", \"/var/lock/*\") and\nnot process.executable : (\"/var/run/docker/*\", \"/var/run/utsns/*\", \"/var/run/s6/*\", \"/var/run/cloudera-scm-agent/*\") and\nuser.id == \"0\"\n", + "references": [ + "https://linuxsecurity.com/features/fileless-malware-on-linux", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "3f3f9fe2-d095-11ec-95dc-f661ea17fbce", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "3f3f9fe2-d095-11ec-95dc-f661ea17fbce_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_1.json b/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_1.json new file mode 100644 index 00000000000..66cd2b18969 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_1.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools attackers can use to discover running processes on an endpoint.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Process Discovery via Built-In Applications", + "query": "process where event.type == \"start\" and event.action == \"exec\" and\n process.name :(\"ps\", \"pstree\", \"htop\", \"pgrep\") and\n not (event.action == \"exec\" and process.parent.name in (\"amazon-ssm-agent\", \"snap\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "3f4d7734-2151-4481-b394-09d7c6c91f75", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "3f4d7734-2151-4481-b394-09d7c6c91f75_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_2.json b/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_2.json new file mode 100644 index 00000000000..66e33e75630 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/3f4d7734-2151-4481-b394-09d7c6c91f75_2.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools attackers can use to discover running processes on an endpoint.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Process Discovery via Built-In Applications", + "query": "process where event.type == \"start\" and event.action == \"exec\" and\n process.name :(\"ps\", \"pstree\", \"htop\", \"pgrep\") and\n not (event.action == \"exec\" and process.parent.name in (\"amazon-ssm-agent\", \"snap\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "3f4d7734-2151-4481-b394-09d7c6c91f75", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "3f4d7734-2151-4481-b394-09d7c6c91f75_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/403ef0d3-8259-40c9-a5b6-d48354712e49_104.json b/packages/security_detection_engine/kibana/security_rule/403ef0d3-8259-40c9-a5b6-d48354712e49_104.json new file mode 100644 index 00000000000..37c6b3db835 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/403ef0d3-8259-40c9-a5b6-d48354712e49_104.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies processes modifying the services registry key directly, instead of through the expected Windows APIs. This could be an indication of an adversary attempting to stealthily persist through abnormal service creation or modification of an existing service.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Persistence via Services Registry", + "query": "registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ServiceDLL\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ImagePath\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ServiceDLL\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\ControlSet*\\\\Services\\\\*\\\\ImagePath\"\n ) and not registry.data.strings : (\n \"?:\\\\windows\\\\system32\\\\Drivers\\\\*.sys\",\n \"\\\\SystemRoot\\\\System32\\\\drivers\\\\*.sys\",\n \"\\\\??\\\\?:\\\\Windows\\\\system32\\\\Drivers\\\\*.SYS\",\n \"system32\\\\DRIVERS\\\\USBSTOR\") and\n not (process.name : \"procexp??.exe\" and registry.data.strings : \"?:\\\\*\\\\procexp*.sys\") and\n not process.executable : (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\winsxs\\\\*\\\\TiWorker.exe\",\n \"?:\\\\Windows\\\\System32\\\\drvinst.exe\",\n \"?:\\\\Windows\\\\System32\\\\services.exe\",\n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\System32\\\\regsvr32.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "403ef0d3-8259-40c9-a5b6-d48354712e49", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "403ef0d3-8259-40c9-a5b6-d48354712e49_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_1.json b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_1.json new file mode 100644 index 00000000000..3f1890c9552 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_1.json @@ -0,0 +1,81 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Modprobe File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action in (\"opened-file\", \"read-file\", \"wrote-to-file\") and\nfile.path : (\"/etc/modprobe.conf\", \"/etc/modprobe.d\", \"/etc/modprobe.d/*\") and not \n(process.name in (\"auditbeat\", \"kmod\", \"modprobe\", \"lsmod\", \"insmod\", \"modinfo\", \"rmmod\") or process.title : (\"*grep*\") or process.parent.pid == 1)\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.title", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_2.json b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_2.json new file mode 100644 index 00000000000..551c51843b9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_2.json @@ -0,0 +1,81 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Modprobe File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action == \"opened-file\" and\nfile.path : (\"/etc/modprobe.conf\", \"/etc/modprobe.d\", \"/etc/modprobe.d/*\") and not \n(\n process.name in (\"auditbeat\", \"kmod\", \"modprobe\", \"lsmod\", \"insmod\", \"modinfo\", \"rmmod\", \"dpkg\", \"cp\") or \n process.title : \"*grep*\" or process.parent.pid == 1\n)\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.title", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_3.json b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_3.json new file mode 100644 index 00000000000..92effad61ed --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_3.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Detects file events involving kernel modules in modprobe configuration files, which may indicate unauthorized access or manipulation of critical kernel modules. Attackers may tamper with the modprobe files to load malicious or unauthorized kernel modules, potentially bypassing security measures, escalating privileges, or hiding their activities within the system.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Modprobe File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action == \"opened-file\" and\nfile.path : (\"/etc/modprobe.conf\", \"/etc/modprobe.d\", \"/etc/modprobe.d/*\") and not \n(\n process.name in (\"auditbeat\", \"kmod\", \"modprobe\", \"lsmod\", \"insmod\", \"modinfo\", \"rmmod\", \"dpkg\", \"cp\", \"mkinitramfs\",\n \"readlink\") or process.title : \"*grep*\" or process.parent.pid == 1\n)\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.title", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /etc/modprobe.conf -p wa -k modprobe\n-w /etc/modprobe.d -p wa -k modprobe\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "40ddbcc8-6561-44d9-afc8-eefdbfe0cccd_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/416697ae-e468-4093-a93d-59661fa619ec_106.json b/packages/security_detection_engine/kibana/security_rule/416697ae-e468-4093-a93d-59661fa619ec_106.json new file mode 100644 index 00000000000..c06608ffc19 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/416697ae-e468-4093-a93d-59661fa619ec_106.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unusual instances of Control Panel with suspicious keywords or paths in the process command line value. Adversaries may abuse control.exe to proxy execution of malicious code.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Control Panel Process with Unusual Arguments", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.executable : (\"?:\\\\Windows\\\\SysWOW64\\\\control.exe\", \"?:\\\\Windows\\\\System32\\\\control.exe\") and\n process.command_line :\n (\"*.jpg*\",\n \"*.png*\",\n \"*.gif*\",\n \"*.bmp*\",\n \"*.jpeg*\",\n \"*.TIFF*\",\n \"*.inf*\",\n \"*.cpl:*/*\",\n \"*../../..*\",\n \"*/AppData/Local/*\",\n \"*:\\\\Users\\\\Public\\\\*\",\n \"*\\\\AppData\\\\Local\\\\*\")\n", + "references": [ + "https://www.joesandbox.com/analysis/476188/1/html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "416697ae-e468-4093-a93d-59661fa619ec", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.002", + "name": "Control Panel", + "reference": "https://attack.mitre.org/techniques/T1218/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "416697ae-e468-4093-a93d-59661fa619ec_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/41824afb-d68c-4d0e-bfee-474dac1fa56e_103.json b/packages/security_detection_engine/kibana/security_rule/41824afb-d68c-4d0e-bfee-474dac1fa56e_103.json new file mode 100644 index 00000000000..1dae7f4a998 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/41824afb-d68c-4d0e-bfee-474dac1fa56e_103.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of and EggShell Backdoor. EggShell is a known post exploitation tool for macOS and Linux.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "EggShell Backdoor Execution", + "query": "event.category:process and event.type:(process_started or start) and process.name:espl and process.args:eyJkZWJ1ZyI6*\n", + "references": [ + "https://github.com/neoneggplant/EggShell" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "41824afb-d68c-4d0e-bfee-474dac1fa56e", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.006", + "name": "Python", + "reference": "https://attack.mitre.org/techniques/T1059/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "41824afb-d68c-4d0e-bfee-474dac1fa56e_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/41b638a1-8ab6-4f8e-86d9-466317ef2db5_104.json b/packages/security_detection_engine/kibana/security_rule/41b638a1-8ab6-4f8e-86d9-466317ef2db5_104.json new file mode 100644 index 00000000000..10fe830243e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/41b638a1-8ab6-4f8e-86d9-466317ef2db5_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Hidden Local User Account Creation", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:dscl and process.args:(IsHidden and create and (true or 1 or yes))\n", + "references": [ + "https://support.apple.com/en-us/HT203998" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "41b638a1-8ab6-4f8e-86d9-466317ef2db5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "41b638a1-8ab6-4f8e-86d9-466317ef2db5_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_104.json b/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_104.json new file mode 100644 index 00000000000..227badd06e4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_104.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts.", + "false_positives": [ + "Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Okta Brute Force or Password Spraying Attack", + "note": "## Triage and analysis\n\n### Investigating Okta Brute Force or Password Spraying Attack\n\nThis rule alerts when a high number of failed Okta user authentication attempts occur from a single IP address. This could be indicative of a brute force or password spraying attack, where an adversary may attempt to gain unauthorized access to user accounts by guessing the passwords.\n\n#### Possible investigation steps:\n\n- Review the `source.ip` field to identify the IP address from which the high volume of failed login attempts originated.\n- Look into the `event.outcome` field to verify that these are indeed failed authentication attempts.\n- Determine the `user.name` or `user.email` related to these failed login attempts. If the attempts are spread across multiple accounts, it might indicate a password spraying attack.\n- Check the timeline of the events. Are the failed attempts spread out evenly, or are there burst periods, which might indicate an automated tool?\n- Determine the geographical location of the source IP. Is this location consistent with the user's typical login location?\n- Analyze any previous successful logins from this IP. Was this IP previously associated with successful logins?\n\n### False positive analysis:\n\n- A single user or automated process that attempts to authenticate using expired or wrong credentials multiple times may trigger a false positive.\n- Analyze the behavior of the source IP. If the IP is associated with legitimate users or services, it may be a false positive.\n\n### Response and remediation:\n\n- If you identify unauthorized access attempts, consider blocking the source IP at the firewall level.\n- Notify the users who are targeted by the attack. Ask them to change their passwords and ensure they use unique, complex passwords.\n- Enhance monitoring on the affected user accounts for any suspicious activity.\n- If the attack is persistent, consider implementing CAPTCHA or account lockouts after a certain number of failed login attempts.\n- If the attack is persistent, consider implementing multi-factor authentication (MFA) for the affected user accounts.\n- Review and update your security policies based on the findings from the incident.", + "query": "event.dataset:okta.system and event.category:authentication and event.outcome:failure\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "42bf698b-4738-445b-8231-c834ddefd8a0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "threshold": { + "field": [ + "source.ip" + ], + "value": 25 + }, + "type": "threshold", + "version": 104 + }, + "id": "42bf698b-4738-445b-8231-c834ddefd8a0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_105.json b/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_105.json new file mode 100644 index 00000000000..c0b9da25347 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/42bf698b-4738-445b-8231-c834ddefd8a0_105.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a high number of failed Okta user authentication attempts from a single IP address, which could be indicative of a brute force or password spraying attack. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts.", + "false_positives": [ + "Automated processes that attempt to authenticate using expired credentials and unbounded retries may lead to false positives." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Okta Brute Force or Password Spraying Attack", + "note": "## Triage and analysis\n\n### Investigating Okta Brute Force or Password Spraying Attack\n\nThis rule alerts when a high number of failed Okta user authentication attempts occur from a single IP address. This could be indicative of a brute force or password spraying attack, where an adversary may attempt to gain unauthorized access to user accounts by guessing the passwords.\n\n#### Possible investigation steps:\n\n- Review the `source.ip` field to identify the IP address from which the high volume of failed login attempts originated.\n- Look into the `event.outcome` field to verify that these are indeed failed authentication attempts.\n- Determine the `user.name` or `user.email` related to these failed login attempts. If the attempts are spread across multiple accounts, it might indicate a password spraying attack.\n- Check the timeline of the events. Are the failed attempts spread out evenly, or are there burst periods, which might indicate an automated tool?\n- Determine the geographical location of the source IP. Is this location consistent with the user's typical login location?\n- Analyze any previous successful logins from this IP. Was this IP previously associated with successful logins?\n\n### False positive analysis:\n\n- A single user or automated process that attempts to authenticate using expired or wrong credentials multiple times may trigger a false positive.\n- Analyze the behavior of the source IP. If the IP is associated with legitimate users or services, it may be a false positive.\n\n### Response and remediation:\n\n- If you identify unauthorized access attempts, consider blocking the source IP at the firewall level.\n- Notify the users who are targeted by the attack. Ask them to change their passwords and ensure they use unique, complex passwords.\n- Enhance monitoring on the affected user accounts for any suspicious activity.\n- If the attack is persistent, consider implementing CAPTCHA or account lockouts after a certain number of failed login attempts.\n- If the attack is persistent, consider implementing multi-factor authentication (MFA) for the affected user accounts.\n- Review and update your security policies based on the findings from the incident.", + "query": "event.dataset:okta.system and event.category:authentication and event.outcome:failure\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "42bf698b-4738-445b-8231-c834ddefd8a0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Credential Access", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "threshold": { + "field": [ + "source.ip" + ], + "value": 25 + }, + "type": "threshold", + "version": 105 + }, + "id": "42bf698b-4738-445b-8231-c834ddefd8a0_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4330272b-9724-4bc6-a3ca-f1532b81e5c2_103.json b/packages/security_detection_engine/kibana/security_rule/4330272b-9724-4bc6-a3ca-f1532b81e5c2_103.json new file mode 100644 index 00000000000..56eef466878 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4330272b-9724-4bc6-a3ca-f1532b81e5c2_103.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies an unusually high number of authentication attempts.", + "false_positives": [ + "Security audits may trigger this alert. Conditions that generate bursts of failed logins, such as misconfigured applications or account lockouts could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "suspicious_login_activity", + "name": "Unusual Login Activity", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "4330272b-9724-4bc6-a3ca-f1532b81e5c2_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_2.json b/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_2.json new file mode 100644 index 00000000000..c1e28e7aadd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_2.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux User Added to Privileged Group", + "note": "## Triage and analysis\n\n### Investigating Linux User User Added to Privileged Group\n\nThe `usermod`, `adduser`, and `gpasswd` commands can be used to assign user accounts to new groups in Linux-based operating systems.\n\nAttackers may add users to a privileged group in order to escalate privileges or establish persistence on a system or domain.\n\nThis rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate whether the user was succesfully added to the privileged group.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Retrieve information about the privileged group to which the user was added.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Adding accounts to a group is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the account that seems to be involved in malicious activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nprocess.parent.name == \"sudo\" and\nprocess.args in (\"root\", \"admin\", \"wheel\", \"staff\", \"sudo\",\n \"disk\", \"video\", \"shadow\", \"lxc\", \"lxd\") and\n(\n process.name in (\"usermod\", \"adduser\") or\n process.name == \"gpasswd\" and \n process.args in (\"-a\", \"--add\", \"-M\", \"--members\") \n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "43d6ec12-2b1c-47b5-8f35-e9de65551d3b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "43d6ec12-2b1c-47b5-8f35-e9de65551d3b_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_3.json b/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_3.json new file mode 100644 index 00000000000..2cddba9db6d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/43d6ec12-2b1c-47b5-8f35-e9de65551d3b_3.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to add a user to a privileged group. Attackers may add users to a privileged group in order to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux User Added to Privileged Group", + "note": "## Triage and analysis\n\n### Investigating Linux User User Added to Privileged Group\n\nThe `usermod`, `adduser`, and `gpasswd` commands can be used to assign user accounts to new groups in Linux-based operating systems.\n\nAttackers may add users to a privileged group in order to escalate privileges or establish persistence on a system or domain.\n\nThis rule identifies the usages of `usermod`, `adduser` and `gpasswd` to assign user accounts to a privileged group.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate whether the user was succesfully added to the privileged group.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Retrieve information about the privileged group to which the user was added.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Adding accounts to a group is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the account that seems to be involved in malicious activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nprocess.parent.name == \"sudo\" and\nprocess.args in (\"root\", \"admin\", \"wheel\", \"staff\", \"sudo\",\n \"disk\", \"video\", \"shadow\", \"lxc\", \"lxd\") and\n(\n process.name in (\"usermod\", \"adduser\") or\n process.name == \"gpasswd\" and \n process.args in (\"-a\", \"--add\", \"-M\", \"--members\") \n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "43d6ec12-2b1c-47b5-8f35-e9de65551d3b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "43d6ec12-2b1c-47b5-8f35-e9de65551d3b_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/440e2db4-bc7f-4c96-a068-65b78da59bde_107.json b/packages/security_detection_engine/kibana/security_rule/440e2db4-bc7f-4c96-a068-65b78da59bde_107.json new file mode 100644 index 00000000000..820bc3f03cb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/440e2db4-bc7f-4c96-a068-65b78da59bde_107.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies files written to or modified in the startup folder by commonly abused processes. Adversaries may use this technique to maintain persistence.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Startup Persistence by a Suspicious Process", + "note": "## Triage and analysis\n\n### Investigating Startup Persistence by a Suspicious Process\n\nThe Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.\n\nThis rule monitors for commonly abused processes writing to the Startup folder locations.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- Administrators may add programs to this mechanism via command-line shells. Before the further investigation, verify that this activity is not benign.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n user.domain != \"NT AUTHORITY\" and\n file.path : (\"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\",\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\*\") and\n process.name : (\"cmd.exe\",\n \"powershell.exe\",\n \"wmic.exe\",\n \"mshta.exe\",\n \"pwsh.exe\",\n \"cscript.exe\",\n \"wscript.exe\",\n \"regsvr32.exe\",\n \"RegAsm.exe\",\n \"rundll32.exe\",\n \"EQNEDT32.EXE\",\n \"WINWORD.EXE\",\n \"EXCEL.EXE\",\n \"POWERPNT.EXE\",\n \"MSPUB.EXE\",\n \"MSACCESS.EXE\",\n \"iexplore.exe\",\n \"InstallUtil.exe\")\n", + "references": [ + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "440e2db4-bc7f-4c96-a068-65b78da59bde", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "440e2db4-bc7f-4c96-a068-65b78da59bde_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/445a342e-03fb-42d0-8656-0367eb2dead5_104.json b/packages/security_detection_engine/kibana/security_rule/445a342e-03fb-42d0-8656-0367eb2dead5_104.json new file mode 100644 index 00000000000..41a4c7e25aa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/445a342e-03fb-42d0-8656-0367eb2dead5_104.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies processes started from atypical folders in the file system, which might indicate malware execution or persistence mechanisms. In corporate Windows environments, software installation is centrally managed and it is unusual for programs to be executed from user or temporary directories. Processes executed from these locations can denote that a user downloaded software directly from the Internet or a malicious script or macro executed malware.", + "false_positives": [ + "A new and unusual program or artifact download in the course of software upgrades, debugging, or troubleshooting could trigger this alert. Users downloading and running programs from unusual locations, such as temporary directories, browser caches, or profile paths could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_path_activity" + ], + "name": "Unusual Windows Path Activity", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "445a342e-03fb-42d0-8656-0367eb2dead5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "445a342e-03fb-42d0-8656-0367eb2dead5_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4494c14f-5ff8-4ed2-8e99-bf816a1642fc_1.json b/packages/security_detection_engine/kibana/security_rule/4494c14f-5ff8-4ed2-8e99-bf816a1642fc_1.json new file mode 100644 index 00000000000..6bde717c195 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4494c14f-5ff8-4ed2-8e99-bf816a1642fc_1.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies instances of VLC-related DLLs which are not signed by the original developer. Attackers may name their payload as legitimate applications to blend into the environment, or embedding its malicious code within legitimate applications to deceive machine learning algorithms by incorporating authentic and benign code.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as VLC DLL", + "query": "library where host.os.type == \"windows\" and event.action == \"load\" and\n dll.name : (\"libvlc.dll\", \"libvlccore.dll\", \"axvlc.dll\") and\n not (\n dll.code_signature.subject_name : (\"VideoLAN\", \"716F2E5E-A03A-486B-BC67-9B18474B9D51\")\n and dll.code_signature.trusted == true\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4494c14f-5ff8-4ed2-8e99-bf816a1642fc", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "Data Source: Elastic Defend", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4494c14f-5ff8-4ed2-8e99-bf816a1642fc_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/44fc462c-1159-4fa8-b1b7-9b6296ab4f96_8.json b/packages/security_detection_engine/kibana/security_rule/44fc462c-1159-4fa8-b1b7-9b6296ab4f96_8.json new file mode 100644 index 00000000000..05b3b70d02c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/44fc462c-1159-4fa8-b1b7-9b6296ab4f96_8.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Multiple Vault Web Credentials Read", + "note": "", + "query": "sequence by winlog.computer_name, winlog.process.pid with maxspan=1s\n\n /* 2 consecutive vault reads from same pid for web creds */\n\n [any where event.code : \"5382\" and\n (winlog.event_data.SchemaFriendlyName : \"Windows Web Password Credential\" and winlog.event_data.Resource : \"http*\") and\n not winlog.event_data.SubjectLogonId : \"0x3e7\" and \n not winlog.event_data.Resource : \"http://localhost/\"]\n\n [any where event.code : \"5382\" and\n (winlog.event_data.SchemaFriendlyName : \"Windows Web Password Credential\" and winlog.event_data.Resource : \"http*\") and\n not winlog.event_data.SubjectLogonId : \"0x3e7\" and \n not winlog.event_data.Resource : \"http://localhost/\"]\n", + "references": [ + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5382", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.computer_name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.Resource", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SchemaFriendlyName", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectLogonId", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "44fc462c-1159-4fa8-b1b7-9b6296ab4f96", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.004", + "name": "Windows Credential Manager", + "reference": "https://attack.mitre.org/techniques/T1555/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 8 + }, + "id": "44fc462c-1159-4fa8-b1b7-9b6296ab4f96_8", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/45d273fb-1dca-457d-9855-bcb302180c21_107.json b/packages/security_detection_engine/kibana/security_rule/45d273fb-1dca-457d-9855-bcb302180c21_107.json new file mode 100644 index 00000000000..74ffd1ce116 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/45d273fb-1dca-457d-9855-bcb302180c21_107.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of WinRar or 7z to create an encrypted files. Adversaries will often compress and encrypt data in preparation for exfiltration.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Encrypting Files with WinRar or 7z", + "note": "## Triage and analysis\n\n### Investigating Encrypting Files with WinRar or 7z\n\nAttackers may compress and/or encrypt data collected before exfiltration. Compressing the data can help obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less apparent upon inspection by a defender.\n\nThese steps are usually done in preparation for exfiltration, meaning the attack may be in its final stages.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the encrypted file.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check if the password used in the encryption was included in the command line.\n- Decrypt the `.rar`/`.zip` and check if the information is sensitive.\n- If the password is not available, and the format is `.zip` or the option used in WinRAR is not the `-hp`, list the file names included in the encrypted file.\n- Investigate if the file was transferred to an attacker-controlled server.\n\n### False positive analysis\n\n- Backup software can use these utilities. Check the `process.parent.executable` and `process.parent.command_line` fields to determine what triggered the encryption.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Prioritize cases that involve personally identifiable information (PII) or other classified data.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n ((process.name:\"rar.exe\" or process.code_signature.subject_name == \"win.rar GmbH\" or\n process.pe.original_file_name == \"Command line RAR\") and\n process.args == \"a\" and process.args : (\"-hp*\", \"-p*\", \"-dw\", \"-tb\", \"-ta\", \"/hp*\", \"/p*\", \"/dw\", \"/tb\", \"/ta\"))\n\n or\n (process.pe.original_file_name in (\"7z.exe\", \"7za.exe\") and\n process.args == \"a\" and process.args : (\"-p*\", \"-sdel\"))\n\n /* uncomment if noisy for backup software related FPs */\n /* not process.parent.executable : (\"C:\\\\Program Files\\\\*.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\") */\n)\n", + "references": [ + "https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "45d273fb-1dca-457d-9855-bcb302180c21", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/", + "subtechnique": [ + { + "id": "T1560.001", + "name": "Archive via Utility", + "reference": "https://attack.mitre.org/techniques/T1560/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "45d273fb-1dca-457d-9855-bcb302180c21_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4630d948-40d4-4cef-ac69-4002e29bc3db_108.json b/packages/security_detection_engine/kibana/security_rule/4630d948-40d4-4cef-ac69-4002e29bc3db_108.json new file mode 100644 index 00000000000..0d6a4b32ef8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4630d948-40d4-4cef-ac69-4002e29bc3db_108.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries can add the 'hidden' attribute to files to hide them from the user in an attempt to evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Adding Hidden File Attribute via Attrib", + "note": "## Triage and analysis\n\n### Investigating Adding Hidden File Attribute via Attrib\n\nThe `Hidden` attribute is a file or folder attribute that makes the file or folder invisible to regular directory listings when the attribute is set. \n\nAttackers can use this attribute to conceal tooling and malware to prevent administrators and users from finding it, even if they are looking specifically for it.\n\nThis rule looks for the execution of the `attrib.exe` utility with a command line that indicates the modification of the `Hidden` attribute.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to identify the target file or folder.\n - Examine the file, which process created it, header, etc.\n - If suspicious, retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"attrib.exe\" or process.pe.original_file_name == \"ATTRIB.EXE\") and process.args : \"+h\" and\n not\n (process.parent.name: \"cmd.exe\" and\n process.command_line: \"attrib +R +H +S +A *.cui\" and\n process.parent.command_line: \"?:\\\\WINDOWS\\\\system32\\\\cmd.exe /c \\\"?:\\\\WINDOWS\\\\system32\\\\*.bat\\\"\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4630d948-40d4-4cef-ac69-4002e29bc3db", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "4630d948-40d4-4cef-ac69-4002e29bc3db_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4682fd2c-cfae-47ed-a543-9bed37657aa6_106.json b/packages/security_detection_engine/kibana/security_rule/4682fd2c-cfae-47ed-a543-9bed37657aa6_106.json new file mode 100644 index 00000000000..ffb0e954ed3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4682fd2c-cfae-47ed-a543-9bed37657aa6_106.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempt to coerce a local NTLM authentication via HTTP using the Windows Printer Spooler service as a target. An adversary may use this primitive in combination with other techniques to elevate privileges on a compromised system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Local NTLM Relay via HTTP", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"rundll32.exe\" and\n\n /* Rundll32 WbeDav Client */\n process.args : (\"?:\\\\Windows\\\\System32\\\\davclnt.dll,DavSetCookie\", \"?:\\\\Windows\\\\SysWOW64\\\\davclnt.dll,DavSetCookie\") and\n\n /* Access to named pipe via http */\n process.args : (\"http*/print/pipe/*\", \"http*/pipe/spoolss\", \"http*/pipe/srvsvc\")\n", + "references": [ + "https://github.com/med0x2e/NTLMRelay2Self", + "https://github.com/topotam/PetitPotam", + "https://github.com/dirkjanm/krbrelayx/blob/master/printerbug.py" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4682fd2c-cfae-47ed-a543-9bed37657aa6", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1212", + "name": "Exploitation for Credential Access", + "reference": "https://attack.mitre.org/techniques/T1212/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "4682fd2c-cfae-47ed-a543-9bed37657aa6_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/46f804f5-b289-43d6-a881-9387cf594f75_104.json b/packages/security_detection_engine/kibana/security_rule/46f804f5-b289-43d6-a881-9387cf594f75_104.json new file mode 100644 index 00000000000..2c811c9c172 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/46f804f5-b289-43d6-a881-9387cf594f75_104.json @@ -0,0 +1,72 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_rare_process_by_host_linux" + ], + "name": "Unusual Process For a Linux Host", + "note": "## Triage and analysis\n\n### Investigating Unusual Process For a Linux Host\n\nSearching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.\n\nThis rule uses a machine learning job to detect a Linux process that is rare and unusual for an individual Linux host in your environment.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.\n- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "46f804f5-b289-43d6-a881-9387cf594f75", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.002", + "name": "Systemd Service", + "reference": "https://attack.mitre.org/techniques/T1543/002/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "46f804f5-b289-43d6-a881-9387cf594f75_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_3.json b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_3.json new file mode 100644 index 00000000000..a2390d43227 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_3.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the \"systemd-sysv-generator\" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through init.d Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through init.d Detected\n\nThe `/etc/init.d` directory is used in Linux systems to store the initialization scripts for various services and daemons that are executed during system startup and shutdown.\n\nAttackers can abuse files within the `/etc/init.d/` directory to run scripts, commands or malicious software every time a system is rebooted by converting an executable file into a service file through the `systemd-sysv-generator`. After conversion, a unit file is created within the `/run/systemd/generator.late/` directory.\n\nThis rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/init.d/` or `/run/systemd/generator.late/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate syslog through the `sudo cat /var/log/syslog | grep 'LSB'` command to find traces of the LSB header of the script (if present). If syslog is being ingested into Elasticsearch, the same can be accomplished through Kibana.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses init.d for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the maliciously created service/init.d files or restore it to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : /etc/init.d/* and not process.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\") and not \nfile.extension : \"swp\"\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_4.json b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_4.json new file mode 100644 index 00000000000..8298a525e1e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_4.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the \"systemd-sysv-generator\" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through init.d Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through init.d Detected\n\nThe `/etc/init.d` directory is used in Linux systems to store the initialization scripts for various services and daemons that are executed during system startup and shutdown.\n\nAttackers can abuse files within the `/etc/init.d/` directory to run scripts, commands or malicious software every time a system is rebooted by converting an executable file into a service file through the `systemd-sysv-generator`. After conversion, a unit file is created within the `/run/systemd/generator.late/` directory.\n\nThis rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/init.d/` or `/run/systemd/generator.late/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate syslog through the `sudo cat /var/log/syslog | grep 'LSB'` command to find traces of the LSB header of the script (if present). If syslog is being ingested into Elasticsearch, the same can be accomplished through Kibana.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses init.d for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the maliciously created service/init.d files or restore it to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : /etc/init.d/* and not process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"chef-client\" or \"apk\" or \"yum\" or \n\"rpm\" or \"vmis-launcher\" or \"exe\") and not file.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 4 + }, + "id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_5.json b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_5.json new file mode 100644 index 00000000000..e6d25fa8647 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/474fd20e-14cc-49c5-8160-d9ab4ba16c8b_5.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Files that are placed in the /etc/init.d/ directory in Unix can be used to start custom applications, services, scripts or commands during start-up. Init.d has been mostly replaced in favor of Systemd. However, the \"systemd-sysv-generator\" can convert init.d files to service unit files that run at boot. Adversaries may add or alter files located in the /etc/init.d/ directory to execute malicious code upon boot in order to gain persistence on the system.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through init.d Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through init.d Detected\n\nThe `/etc/init.d` directory is used in Linux systems to store the initialization scripts for various services and daemons that are executed during system startup and shutdown.\n\nAttackers can abuse files within the `/etc/init.d/` directory to run scripts, commands or malicious software every time a system is rebooted by converting an executable file into a service file through the `systemd-sysv-generator`. After conversion, a unit file is created within the `/run/systemd/generator.late/` directory.\n\nThis rule looks for the creation of new files within the `/etc/init.d/` directory. Executable files in these directories will automatically run at boot with root privileges.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/init.d/` or `/run/systemd/generator.late/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/init.d/%' OR path LIKE '/run/systemd/generator.late/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate syslog through the `sudo cat /var/log/syslog | grep 'LSB'` command to find traces of the LSB header of the script (if present). If syslog is being ingested into Elasticsearch, the same can be accomplished through Kibana.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate whether this activity is related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses init.d for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Suspicious File Creation in /etc for Persistence - 1c84dd64-7e6c-4bad-ac73-a5014ee37042\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the maliciously created service/init.d files or restore it to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : /etc/init.d/* and not process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"dnf\" or \"chef-client\" or \"apk\" or \"yum\" or \n\"rpm\" or \"vmis-launcher\" or \"exe\") and not file.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://www.intezer.com/blog/malware-analysis/hiddenwasp-malware-targeting-linux-systems/", + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#8-boot-or-logon-initialization-scripts-rc-scripts", + "https://www.cyberciti.biz/faq/how-to-enable-rc-local-shell-script-on-systemd-while-booting-linux-system/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 5 + }, + "id": "474fd20e-14cc-49c5-8160-d9ab4ba16c8b_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/47f76567-d58a-4fed-b32b-21f571e28910_104.json b/packages/security_detection_engine/kibana/security_rule/47f76567-d58a-4fed-b32b-21f571e28910_104.json new file mode 100644 index 00000000000..a091deb60a3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/47f76567-d58a-4fed-b32b-21f571e28910_104.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects execution via the Apple script interpreter (osascript) followed by a network connection from the same process within a short time period. Adversaries may use malicious scripts for execution and command and control.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Apple Script Execution followed by Network Connection", + "query": "sequence by host.id, process.entity_id with maxspan=30s\n [process where host.os.type == \"macos\" and event.type == \"start\" and process.name == \"osascript\"]\n [network where host.os.type == \"macos\" and event.type != \"end\" and process.name == \"osascript\" and destination.ip != \"::1\" and\n not cidrmatch(destination.ip,\n \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.0.0/29\", \"192.0.0.8/32\",\n \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\",\n \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://developer.apple.com/library/archive/documentation/LanguagesUtilities/Conceptual/MacAutomationScriptingGuide/index.html", + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "47f76567-d58a-4fed-b32b-21f571e28910", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.002", + "name": "AppleScript", + "reference": "https://attack.mitre.org/techniques/T1059/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "47f76567-d58a-4fed-b32b-21f571e28910_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/483c4daf-b0c6-49e0-adf3-0bfa93231d6b_104.json b/packages/security_detection_engine/kibana/security_rule/483c4daf-b0c6-49e0-adf3-0bfa93231d6b_104.json new file mode 100644 index 00000000000..505be2b9dac --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/483c4daf-b0c6-49e0-adf3-0bfa93231d6b_104.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies suspicious processes being spawned by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26857.", + "false_positives": [ + "Legitimate processes may be spawned from the Microsoft Exchange Server Unified Messaging (UM) service. If known processes are causing false positives, they can be exempted from the rule." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Exchange Server UM Spawning Suspicious Processes", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"UMService.exe\", \"UMWorkerProcess.exe\") and\n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\werfault.exe\",\n \"?:\\\\Windows\\\\System32\\\\wermgr.exe\",\n \"?:\\\\Program Files\\\\Microsoft\\\\Exchange Server\\\\V??\\\\Bin\\\\UMWorkerProcess.exe\",\n \"D:\\\\Exchange 2016\\\\Bin\\\\UMWorkerProcess.exe\",\n \"E:\\\\ExchangeServer\\\\Bin\\\\UMWorkerProcess.exe\")\n", + "references": [ + "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", + "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "483c4daf-b0c6-49e0-adf3-0bfa93231d6b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "483c4daf-b0c6-49e0-adf3-0bfa93231d6b_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48819484-9826-4083-9eba-1da74cd0eaf2_1.json b/packages/security_detection_engine/kibana/security_rule/48819484-9826-4083-9eba-1da74cd0eaf2_1.json new file mode 100644 index 00000000000..2b2caa06150 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48819484-9826-4083-9eba-1da74cd0eaf2_1.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a Microsoft 365 Mailbox is accessed by a ClientAppId that was observed for the fist time during the last 10 days.", + "false_positives": [ + "User using a new mail client." + ], + "from": "now-30m", + "history_window_start": "now-10d", + "index": [ + "filebeat-*", + "logs-o365*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Microsoft 365 Mail Access by ClientAppId", + "new_terms_fields": [ + "o365.audit.ClientAppId", + "user.id" + ], + "note": "", + "query": "event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:MailItemsAccessed and event.outcome:success\n", + "references": [ + "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a" + ], + "related_integrations": [ + { + "package": "o365", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.provider", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48819484-9826-4083-9eba-1da74cd0eaf2", + "setup": "The Office 365 Logs Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Domain: Cloud", + "Data Source: Microsoft 365", + "Use Case: Configuration Audit", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 1 + }, + "id": "48819484-9826-4083-9eba-1da74cd0eaf2_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_1.json b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_1.json new file mode 100644 index 00000000000..d85e9048382 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_1.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell", + "query": "sequence by host.id with maxspan=1s\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action : (\"exec\", \"fork\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_2.json b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_2.json new file mode 100644 index 00000000000..ca65fe8c297 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_2.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell", + "query": "sequence by host.id with maxspan=1s\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") and \n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action : (\"exec\", \"fork\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_3.json b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_3.json new file mode 100644 index 00000000000..54381134e61 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_3.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell", + "query": "sequence by host.id with maxspan=1s\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") and \n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action : (\"exec\", \"fork\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_4.json b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_4.json new file mode 100644 index 00000000000..ecad6edac17 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48b3d2e3-f4e8-41e6-95e6-9b2091228db3_4.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies suspicious network traffic patterns associated with TCP reverse shell activity. This activity consists of a parent-child relationship where a network event is followed by the creation of a shell process. An attacker may establish a Linux TCP reverse shell to gain remote access to a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell", + "query": "sequence by host.id with maxspan=1s\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") and \n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action : (\"exec\", \"fork\") and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"socat\") ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "48b3d2e3-f4e8-41e6-95e6-9b2091228db3_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48d7f54d-c29e-4430-93a9-9db6b5892270_104.json b/packages/security_detection_engine/kibana/security_rule/48d7f54d-c29e-4430-93a9-9db6b5892270_104.json new file mode 100644 index 00000000000..867f27fb846 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48d7f54d-c29e-4430-93a9-9db6b5892270_104.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a child process is spawned by the screensaver engine process, which is consistent with an attacker's malicious payload being executed after the screensaver activated on the endpoint. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unexpected Child Process of macOS Screensaver Engine", + "note": "## Triage and analysis\n\n- Analyze the descendant processes of the ScreenSaverEngine process for malicious code and suspicious behavior such\nas a download of a payload from a server.\n- Review the installed and activated screensaver on the host. Triage the screensaver (.saver) file that was triggered to\nidentify whether the file is malicious or not.", + "query": "process where host.os.type == \"macos\" and event.type == \"start\" and process.parent.name == \"ScreenSaverEngine\"\n", + "references": [ + "https://posts.specterops.io/saving-your-access-d562bf5bf90b", + "https://github.com/D00MFist/PersistentJXA" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "48d7f54d-c29e-4430-93a9-9db6b5892270", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.002", + "name": "Screensaver", + "reference": "https://attack.mitre.org/techniques/T1546/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "48d7f54d-c29e-4430-93a9-9db6b5892270_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/48ec9452-e1fd-4513-a376-10a1a26d2c83_104.json b/packages/security_detection_engine/kibana/security_rule/48ec9452-e1fd-4513-a376-10a1a26d2c83_104.json new file mode 100644 index 00000000000..3ef3fec469e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/48ec9452-e1fd-4513-a376-10a1a26d2c83_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of the default configuration for periodic tasks. Adversaries may abuse periodic tasks to execute malicious code or maintain persistence.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence via Periodic Tasks", + "query": "event.category:file and host.os.type:macos and not event.type:\"deletion\" and\n file.path:(/private/etc/periodic/* or /private/etc/defaults/periodic.conf or /private/etc/periodic.conf)\n", + "references": [ + "https://opensource.apple.com/source/crontabs/crontabs-13/private/etc/defaults/periodic.conf.auto.html", + "https://www.oreilly.com/library/view/mac-os-x/0596003706/re328.html", + "https://github.com/D00MFist/PersistentJXA/blob/master/PeriodicPersist.js" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "48ec9452-e1fd-4513-a376-10a1a26d2c83", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "48ec9452-e1fd-4513-a376-10a1a26d2c83_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_2.json b/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_2.json new file mode 100644 index 00000000000..13e6840da4d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_2.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Backdoor User Account Creation", + "note": "## Triage and analysis\n\n### Investigating Potential Linux Backdoor User Account Creation\n\nThe `usermod` command is used to modify user account attributes and settings in Linux-based operating systems.\n\nAttackers may create new accounts with a UID of 0 to maintain root access to target systems without leveraging the root user account.\n\nThis rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n- Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.\n - !{osquery{\"label\":\"Osquery - Retrieve User Accounts with a UID of 0\",\"query\":\"SELECT description, gid, gid_signed, shell, uid, uid_signed, username FROM users WHERE username != 'root' AND uid LIKE '0'\"}}\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Identify if the account was added to privileged groups or assigned special privileges after creation.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the created account.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\") and process.name == \"usermod\" and\nprocess.args : \"-u\" and process.args : \"0\" and process.args : \"-o\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "494ebba4-ecb7-4be4-8c6f-654c686549ad", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "494ebba4-ecb7-4be4-8c6f-654c686549ad_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_3.json b/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_3.json new file mode 100644 index 00000000000..30667287c1f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/494ebba4-ecb7-4be4-8c6f-654c686549ad_3.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the attempt to create a new backdoor user by setting the user's UID to 0. Attackers may alter a user's UID to 0 to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Backdoor User Account Creation", + "note": "## Triage and analysis\n\n### Investigating Potential Linux Backdoor User Account Creation\n\nThe `usermod` command is used to modify user account attributes and settings in Linux-based operating systems.\n\nAttackers may create new accounts with a UID of 0 to maintain root access to target systems without leveraging the root user account.\n\nThis rule identifies the usage of the `usermod` command to set a user's UID to 0, indicating that the user becomes a root account. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n- Investigate the user account that got assigned a uid of 0, and analyze its corresponding attributes.\n - !{osquery{\"label\":\"Osquery - Retrieve User Accounts with a UID of 0\",\"query\":\"SELECT description, gid, gid_signed, shell, uid, uid_signed, username FROM users WHERE username != 'root' AND uid LIKE '0'\"}}\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Identify the user account that performed the action, analyze it, and check whether it should perform this kind of action.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Identify if the account was added to privileged groups or assigned special privileges after creation.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the created account.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\") and process.name == \"usermod\" and\nprocess.args : \"-u\" and process.args : \"0\" and process.args : \"-o\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "494ebba4-ecb7-4be4-8c6f-654c686549ad", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "494ebba4-ecb7-4be4-8c6f-654c686549ad_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_1.json b/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_1.json new file mode 100644 index 00000000000..a1780d25cbb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_1.json @@ -0,0 +1,128 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Process Injection via LD_PRELOAD Environment Variable", + "note": "## Setup\nBy default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration. \n```\nKibana --\u003e\nFleet --\u003e\nAgent policies --\u003e\nAgent policy for which the option should be enabled --\u003e\nName of the Elastic Defend integration --\u003e \nShow advanced settings --\u003e\nlinux.advanced.capture_env_vars\n```\n`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`. \nAfter saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.", + "query": "process where host.os.type == \"linux\" and \n event.action == \"exec\" and \n process.env_vars : (\"LD_PRELOAD=?*\", \"LD_LIBRARY_PATH=?*\") \n", + "references": [ + "https://www.getambassador.io/resources/code-injection-on-linux-and-macos" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.env_vars", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4973e46b-a663-41b8-a875-ced16dda2bb0", + "setup": "By default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration.\n```\nKibana --\u003e\nFleet --\u003e\nAgent policies --\u003e\nAgent policy for which the option should be enabled --\u003e\nName of the Elastic Defend integration --\u003e \nShow advanced settings --\u003e\nlinux.advanced.capture_env_vars\n```\n`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`.\nAfter saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Persistence", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4973e46b-a663-41b8-a875-ced16dda2bb0_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_2.json b/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_2.json new file mode 100644 index 00000000000..4a0b70fb0c9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4973e46b-a663-41b8-a875-ced16dda2bb0_2.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the execution of a process where the LD_PRELOAD environment variable is set. LD_PRELOAD can be used to inject a shared library into a binary at or prior to execution. A threat actor may do this in order to load a malicious shared library for the purposes of persistence, privilege escalation, and defense evasion. This activity is not common and will potentially indicate malicious or suspicious behavior.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Deprecated - Potential Process Injection via LD_PRELOAD Environment Variable", + "note": "This rule was deprecated due to the large amount of false positives and the lack of true positives generated by the rule.\n## Setup\nBy default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration. \n```\nKibana --\u003e\nFleet --\u003e\nAgent policies --\u003e\nAgent policy for which the option should be enabled --\u003e\nName of the Elastic Defend integration --\u003e \nShow advanced settings --\u003e\nlinux.advanced.capture_env_vars\n```\n`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`. \nAfter saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and process.env_vars : (\"LD_PRELOAD=?*\", \"LD_LIBRARY_PATH=?*\")\n", + "references": [ + "https://www.getambassador.io/resources/code-injection-on-linux-and-macos" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.env_vars", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4973e46b-a663-41b8-a875-ced16dda2bb0", + "setup": "By default, the `Elastic Defend` integration does not collect environment variable logging. In order to capture this behavior, this rule requires a specific configuration option set within the advanced settings of the `Elastic Defend` integration.\n```\nKibana --\u003e\nFleet --\u003e\nAgent policies --\u003e\nAgent policy for which the option should be enabled --\u003e\nName of the Elastic Defend integration --\u003e \nShow advanced settings --\u003e\nlinux.advanced.capture_env_vars\n```\n`linux.advanced.capture_env_vars` should be set to `LD_PRELOAD,LD_LIBRARY_PATH`.\nAfter saving the integration change, the Elastic Agents running this policy will be updated and the rule will function properly.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "4973e46b-a663-41b8-a875-ced16dda2bb0_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_1.json b/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_1.json new file mode 100644 index 00000000000..7ddec505f54 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_1.json @@ -0,0 +1,78 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to enumerate running processes. Adversaries may enumerate processes to identify installed applications and security solutions.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Process Discovery Using Built-in Tools", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n process.name == \"reg.exe\" and process.args : \"query\" or\n (process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n (process.args: (\"*Get-ChildItem*\", \"*Get-Item*\", \"*Get-ItemProperty*\") and\n process.args : (\n \"*HKLM*\", \"*HKCU*\", \"*HKEY_LOCAL_MACHINE*\", \"*HKEY_CURRENT_USER*\", \"Registry::\"\n )))\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4982ac3e-d0ee-4818-b95d-d9522d689259", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4982ac3e-d0ee-4818-b95d-d9522d689259_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_2.json b/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_2.json new file mode 100644 index 00000000000..9c4c864e4ec --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4982ac3e-d0ee-4818-b95d-d9522d689259_2.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to enumerate running processes. Adversaries may enumerate processes to identify installed applications and security solutions.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Process Discovery Using Built-in Tools", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n process.name :(\"PsList.exe\", \"qprocess.exe\") or \n (process.name : \"powershell.exe\" and process.args : (\"*get-process*\", \"*Win32_Process*\")) or \n (process.name : \"wmic.exe\" and process.args : (\"process\", \"*Win32_Process*\")) or\n (process.name : \"tasklist.exe\" and not process.args : (\"pid eq*\")) or\n (process.name : \"query.exe\" and process.args : \"process\")\n ) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4982ac3e-d0ee-4818-b95d-d9522d689259", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "4982ac3e-d0ee-4818-b95d-d9522d689259_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_1.json b/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_1.json new file mode 100644 index 00000000000..4f4ed2a6f20 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_1.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of the \"chown\" and \"chmod\" commands with command line flags that could indicate a wildcard injection attack. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Unauthorized Access via Wildcard Injection Detected", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and event.type == \"start\" and \nprocess.name in (\"chown\", \"chmod\") and process.args == \"-R\" and process.args : \"--reference=*\"\n", + "references": [ + "https://www.exploit-db.com/papers/33930" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4a99ac6f-9a54-4ba5-a64f-6eb65695841b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4a99ac6f-9a54-4ba5-a64f-6eb65695841b_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_2.json b/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_2.json new file mode 100644 index 00000000000..b9356ced2e4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4a99ac6f-9a54-4ba5-a64f-6eb65695841b_2.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of the \"chown\" and \"chmod\" commands with command line flags that could indicate a wildcard injection attack. Linux wildcard injection is a type of security vulnerability where attackers manipulate commands or input containing wildcards (e.g., *, ?, []) to execute unintended operations or access sensitive data by tricking the system into interpreting the wildcard characters in unexpected ways.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Unauthorized Access via Wildcard Injection Detected", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and event.type == \"start\" and \nprocess.name in (\"chown\", \"chmod\") and process.args == \"-R\" and process.args : \"--reference=*\"\n", + "references": [ + "https://www.exploit-db.com/papers/33930" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4a99ac6f-9a54-4ba5-a64f-6eb65695841b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "4a99ac6f-9a54-4ba5-a64f-6eb65695841b_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4aa58ac6-4dc0-4d18-b713-f58bf8bd015c_1.json b/packages/security_detection_engine/kibana/security_rule/4aa58ac6-4dc0-4d18-b713-f58bf8bd015c_1.json new file mode 100644 index 00000000000..2366d025af7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4aa58ac6-4dc0-4d18-b713-f58bf8bd015c_1.json @@ -0,0 +1,70 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Cross-Site Scripting (XSS) is a type of attack in which malicious scripts are injected into trusted websites. In XSS attacks, an attacker uses a benign web application to send malicious code, generally in the form of a browser-side script. This detection rule identifies the potential malicious executions of such browser-side scripts.", + "from": "now-119m", + "index": [ + "apm-*-transaction*", + "traces-apm*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Cross Site Scripting (XSS)", + "query": "any where processor.name == \"transaction\" and\nurl.fragment : (\"\u003ciframe*\", \"*prompt(*)*\", \"\u003cscript*\u003e\", \"\u003csvg*\u003e\", \"*onerror=*\", \"*javascript*alert*\", \"*eval*(*)*\", \"*onclick=*\",\n\"*alert(document.cookie)*\", \"*alert(document.domain)*\",\"*onresize=*\",\"*onload=*\",\"*onmouseover=*\")\n", + "references": [ + "https://github.com/payloadbox/xss-payload-list" + ], + "related_integrations": [ + { + "package": "apm", + "version": "^8.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "processor.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "url.fragment", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4aa58ac6-4dc0-4d18-b713-f58bf8bd015c", + "severity": "low", + "tags": [ + "Data Source: APM", + "Use Case: Threat Detection", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1189", + "name": "Drive-by Compromise", + "reference": "https://attack.mitre.org/techniques/T1189/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4aa58ac6-4dc0-4d18-b713-f58bf8bd015c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_1.json b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_1.json new file mode 100644 index 00000000000..9b687688335 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_1.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Parent Process", + "query": "sequence by host.id, process.parent.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"fork\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_2.json b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_2.json new file mode 100644 index 00000000000..4c99744975e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_2.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Parent Process", + "query": "sequence by host.id, process.parent.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"fork\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_3.json b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_3.json new file mode 100644 index 00000000000..d4ed703a72c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_3.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Parent Process", + "query": "sequence by host.id, process.parent.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"fork\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_4.json b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_4.json new file mode 100644 index 00000000000..874dff9bca5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b1a807a-4e7b-414e-8cea-24bf580f6fc5_4.json @@ -0,0 +1,130 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious parent child relationship. Any reverse shells spawned by the specified utilities that use a forked process to initialize the connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Parent Process", + "query": "sequence by host.id, process.parent.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"fork\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "4b1a807a-4e7b-414e-8cea-24bf580f6fc5_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b438734-3793-4fda-bd42-ceeada0be8f9_106.json b/packages/security_detection_engine/kibana/security_rule/4b438734-3793-4fda-bd42-ceeada0be8f9_106.json new file mode 100644 index 00000000000..730cf4168ff --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b438734-3793-4fda-bd42-ceeada0be8f9_106.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the netsh.exe to disable or weaken the local firewall. Attackers will use this command line tool to disable the firewall during troubleshooting or to enable network mobility.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Disable Windows Firewall Rules via Netsh", + "note": "## Triage and analysis\n\n### Investigating Disable Windows Firewall Rules via Netsh\n\nThe Windows Defender Firewall is a native component which provides host-based, two-way network traffic filtering for a device, and blocks unauthorized network traffic flowing into or out of the local device.\n\nAttackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.\n\nThis rule identifies patterns related to disabling the Windows firewall or its rules using the `netsh.exe` utility.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the user to check if they are aware of the operation.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.\n- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"netsh.exe\" and\n (\n (process.args : \"disable\" and process.args : \"firewall\" and process.args : \"set\") or\n (process.args : \"advfirewall\" and process.args : \"off\" and process.args : \"state\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4b438734-3793-4fda-bd42-ceeada0be8f9", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.004", + "name": "Disable or Modify System Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "4b438734-3793-4fda-bd42-ceeada0be8f9_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4b868f1f-15ff-4ba3-8c11-d5a7a6356d37_1.json b/packages/security_detection_engine/kibana/security_rule/4b868f1f-15ff-4ba3-8c11-d5a7a6356d37_1.json new file mode 100644 index 00000000000..8bcbcfc1917 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4b868f1f-15ff-4ba3-8c11-d5a7a6356d37_1.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the execution of the ProxyChains utility. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "ProxyChains Activity", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and process.name == \"proxychains\"\n", + "references": [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4b868f1f-15ff-4ba3-8c11-d5a7a6356d37", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4b868f1f-15ff-4ba3-8c11-d5a7a6356d37_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4bd1c1af-79d4-4d37-9efa-6e0240640242_105.json b/packages/security_detection_engine/kibana/security_rule/4bd1c1af-79d4-4d37-9efa-6e0240640242_105.json new file mode 100644 index 00000000000..8afc7fabfa5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4bd1c1af-79d4-4d37-9efa-6e0240640242_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies processes running from an Alternate Data Stream. This is uncommon for legitimate processes and sometimes done by adversaries to hide malware.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Process Execution Path - Alternate Data Stream", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.args : \"?:\\\\*:*\" and process.args_count == 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "4bd1c1af-79d4-4d37-9efa-6e0240640242", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.004", + "name": "NTFS File Attributes", + "reference": "https://attack.mitre.org/techniques/T1564/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "4bd1c1af-79d4-4d37-9efa-6e0240640242_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_1.json b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_1.json new file mode 100644 index 00000000000..daff70b29e2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_1.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kernel Load or Unload via Kexec Detected", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and process.name == \"kexec\" and \nprocess.args in (\"--exec\", \"-e\", \"--load\", \"-l\", \"--unload\", \"-u\")\n", + "references": [ + "https://www.crowdstrike.com/blog/venom-vulnerability-details/", + "https://www.makeuseof.com/what-is-venom-vulnerability/", + "https://madaidans-insecurities.github.io/guides/linux-hardening.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1601", + "name": "Modify System Image", + "reference": "https://attack.mitre.org/techniques/T1601/", + "subtechnique": [ + { + "id": "T1601.001", + "name": "Patch System Image", + "reference": "https://attack.mitre.org/techniques/T1601/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_2.json b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_2.json new file mode 100644 index 00000000000..9bd2c78bcd7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_2.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kernel Load or Unload via Kexec Detected", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and process.name == \"kexec\" and \nprocess.args in (\"--exec\", \"-e\", \"--load\", \"-l\", \"--unload\", \"-u\")\n", + "references": [ + "https://www.crowdstrike.com/blog/venom-vulnerability-details/", + "https://www.makeuseof.com/what-is-venom-vulnerability/", + "https://madaidans-insecurities.github.io/guides/linux-hardening.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1601", + "name": "Modify System Image", + "reference": "https://attack.mitre.org/techniques/T1601/", + "subtechnique": [ + { + "id": "T1601.001", + "name": "Patch System Image", + "reference": "https://attack.mitre.org/techniques/T1601/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_3.json b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_3.json new file mode 100644 index 00000000000..7ee53fc6c8a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_3.json @@ -0,0 +1,127 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the usage of kexec, helping to uncover unauthorized kernel replacements and potential compromise of the system's integrity. Kexec is a Linux feature that enables the loading and execution of a different kernel without going through the typical boot process. Malicious actors can abuse kexec to bypass security measures, escalate privileges, establish persistence or hide their activities by loading a malicious kernel, enabling them to tamper with the system's trusted state, allowing e.g. a VM Escape.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kernel Load or Unload via Kexec Detected", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and process.name == \"kexec\" and \nprocess.args in (\"--exec\", \"-e\", \"--load\", \"-l\", \"--unload\", \"-u\")\n", + "references": [ + "https://www.crowdstrike.com/blog/venom-vulnerability-details/", + "https://www.makeuseof.com/what-is-venom-vulnerability/", + "https://madaidans-insecurities.github.io/guides/linux-hardening.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1601", + "name": "Modify System Image", + "reference": "https://attack.mitre.org/techniques/T1601/", + "subtechnique": [ + { + "id": "T1601.001", + "name": "Patch System Image", + "reference": "https://attack.mitre.org/techniques/T1601/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "4d4c35f4-414e-4d0c-bb7e-6db7c80a6957_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4da13d6e-904f-4636-81d8-6ab14b4e6ae9_104.json b/packages/security_detection_engine/kibana/security_rule/4da13d6e-904f-4636-81d8-6ab14b4e6ae9_104.json new file mode 100644 index 00000000000..76730407b94 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4da13d6e-904f-4636-81d8-6ab14b4e6ae9_104.json @@ -0,0 +1,81 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to disable Gatekeeper on macOS. Gatekeeper is a security feature that's designed to ensure that only trusted software is run. Adversaries may attempt to disable Gatekeeper before executing malicious code.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Disable Gatekeeper", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.args:(spctl and \"--master-disable\")\n", + "references": [ + "https://support.apple.com/en-us/HT202491", + "https://community.carbonblack.com/t5/Threat-Advisories-Documents/TAU-TIN-Shlayer-OSX/ta-p/68397" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4da13d6e-904f-4636-81d8-6ab14b4e6ae9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "4da13d6e-904f-4636-81d8-6ab14b4e6ae9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4de76544-f0e5-486a-8f84-eae0b6063cdc_107.json b/packages/security_detection_engine/kibana/security_rule/4de76544-f0e5-486a-8f84-eae0b6063cdc_107.json new file mode 100644 index 00000000000..9dc25d318f4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4de76544-f0e5-486a-8f84-eae0b6063cdc_107.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Ivan Ninichuck", + "Austin Songer" + ], + "description": "Identifies attempts to disable EventLog via the logman Windows utility, PowerShell, or auditpol. This is often done by attackers in an attempt to evade detection on a system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Disable Windows Event and Security Logs Using Built-in Tools", + "note": "## Triage and analysis\n\n### Investigating Disable Windows Event and Security Logs Using Built-in Tools\n\nWindows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.\n\nThis rule looks for the usage of different utilities to disable the EventLog service or specific event logs.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n - Verify if any other anti-forensics behaviors were observed.\n- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Re-enable affected logging components, services, and security monitoring.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n ((process.name:\"logman.exe\" or process.pe.original_file_name == \"Logman.exe\") and\n process.args : \"EventLog-*\" and process.args : (\"stop\", \"delete\")) or\n\n ((process.name : (\"pwsh.exe\", \"powershell.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in\n (\"pwsh.exe\", \"powershell.exe\", \"powershell_ise.exe\")) and\n\tprocess.args : \"Set-Service\" and process.args: \"EventLog\" and process.args : \"Disabled\") or\n\n ((process.name:\"auditpol.exe\" or process.pe.original_file_name == \"AUDITPOL.EXE\") and process.args : \"/success:disable\")\n)\n", + "references": [ + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/logman", + "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4de76544-f0e5-486a-8f84-eae0b6063cdc", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.001", + "name": "Clear Windows Event Logs", + "reference": "https://attack.mitre.org/techniques/T1070/001/" + } + ] + }, + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.006", + "name": "Indicator Blocking", + "reference": "https://attack.mitre.org/techniques/T1562/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "4de76544-f0e5-486a-8f84-eae0b6063cdc_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_3.json b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_3.json new file mode 100644 index 00000000000..babde9b7245 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_3.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Spawned from MOTD Detected", + "note": "## Triage and analysis\n\n### Investigating Suspicious Process Spawned from MOTD Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Files in these directories will automatically run with root privileges when they are made executable.\n\nThis rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified from which the suspicious process was executed.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services, and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Potential Persistence Through MOTD File Creation Detected - 96d11d31-9a79-480f-8401-da28b194608f\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore them to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and \nevent.type == \"start\" and event.action : (\"exec\", \"exec_event\") and\nprocess.parent.executable : (\"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\") and\nprocess.executable : (\"*sh\", \"python*\", \"perl\", \"php*\")\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4ec47004-b34a-42e6-8003-376a123ea447", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "4ec47004-b34a-42e6-8003-376a123ea447_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_4.json b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_4.json new file mode 100644 index 00000000000..8f94c47ab1d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_4.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Spawned from MOTD Detected", + "note": "## Triage and analysis\n\n### Investigating Suspicious Process Spawned from MOTD Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Files in these directories will automatically run with root privileges when they are made executable.\n\nThis rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified from which the suspicious process was executed.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services, and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Potential Persistence Through MOTD File Creation Detected - 96d11d31-9a79-480f-8401-da28b194608f\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore them to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and \nevent.type == \"start\" and event.action : (\"exec\", \"exec_event\") and\nprocess.parent.executable : (\"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\") and\nprocess.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"python*\", \"perl\", \"php*\", \"nc\", \"ncat\", \n\"netcat\", \"socat\", \"lua\", \"java\", \"openssl\", \"ruby\", \"telnet\", \"awk\")\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4ec47004-b34a-42e6-8003-376a123ea447", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "4ec47004-b34a-42e6-8003-376a123ea447_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_5.json b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_5.json new file mode 100644 index 00000000000..0030c90a2c1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4ec47004-b34a-42e6-8003-376a123ea447_5.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the execution of potentially malicious processes through the MOTD utility.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Spawned from MOTD Detected", + "note": "## Triage and analysis\n\n### Investigating Suspicious Process Spawned from MOTD Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Files in these directories will automatically run with root privileges when they are made executable.\n\nThis rule identifies the execution of potentially malicious processes from a MOTD script, which is not likely to occur as default benign behavior. \n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified from which the suspicious process was executed.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services, and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Potential Persistence Through MOTD File Creation Detected - 96d11d31-9a79-480f-8401-da28b194608f\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore them to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and \nevent.type == \"start\" and event.action : (\"exec\", \"exec_event\") and\nprocess.parent.executable : (\"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\") and\nprocess.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"python*\", \"perl\", \"php*\", \"nc\", \"ncat\", \n\"netcat\", \"socat\", \"lua\", \"java\", \"openssl\", \"ruby\", \"telnet\")\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4ec47004-b34a-42e6-8003-376a123ea447", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "4ec47004-b34a-42e6-8003-376a123ea447_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4ed493fc-d637-4a36-80ff-ac84937e5461_106.json b/packages/security_detection_engine/kibana/security_rule/4ed493fc-d637-4a36-80ff-ac84937e5461_106.json new file mode 100644 index 00000000000..8391c921d69 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4ed493fc-d637-4a36-80ff-ac84937e5461_106.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution via MSSQL xp_cmdshell stored procedure. Malicious users may attempt to elevate their privileges by using xp_cmdshell, which is disabled by default, thus, it's important to review the context of it's use.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution via MSSQL xp_cmdshell Stored Procedure", + "note": "## Triage and analysis\n\n### Investigating Execution via MSSQL xp_cmdshell Stored Procedure\n\nMicrosoft SQL Server (MSSQL) has procedures meant to extend its functionality, the Extended Stored Procedures. These procedures are external functions written in C/C++; some provide interfaces for external programs. This is the case for xp_cmdshell, which spawns a Windows command shell and passes in a string for execution. Attackers can use this to execute commands on the system running the SQL server, commonly to escalate their privileges and establish persistence.\n\nThe xp_cmdshell procedure is disabled by default, but when used, it has the same security context as the MSSQL Server service account, which is often privileged.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the command line to determine if the command executed is potentially harmful or malicious.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n\n### False positive analysis\n\n- This mechanism can be used legitimately, but it brings inherent risk. The security team must monitor any activity of it. If recurrent tasks are being executed using this mechanism, consider adding exceptions \u2014 preferably with a full command line.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Ensure that SQL servers are not directly exposed to the internet. If there is a business justification for such, use an allowlist to allow only connections from known legitimate sources.\n- Disable the xp_cmdshell stored procedure.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"sqlservr.exe\" and \n (\n (process.name : \"cmd.exe\" and \n not process.args : (\"\\\\\\\\*\", \"diskfree\", \"rmdir\", \"mkdir\", \"dir\", \"del\", \"rename\", \"bcp\", \"*XMLNAMESPACES*\", \n \"?:\\\\MSSQL\\\\Backup\\\\Jobs\\\\sql_agent_backup_job.ps1\", \"K:\\\\MSSQL\\\\Backup\\\\msdb\", \"K:\\\\MSSQL\\\\Backup\\\\Logins\")) or \n \n (process.name : \"vpnbridge.exe\" or process.pe.original_file_name : \"vpnbridge.exe\") or \n\n (process.name : \"certutil.exe\" or process.pe.original_file_name == \"CertUtil.exe\") or \n\n (process.name : \"bitsadmin.exe\" or process.pe.original_file_name == \"bitsadmin.exe\")\n )\n", + "references": [ + "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4ed493fc-d637-4a36-80ff-ac84937e5461", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/", + "subtechnique": [ + { + "id": "T1505.001", + "name": "SQL Stored Procedures", + "reference": "https://attack.mitre.org/techniques/T1505/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "4ed493fc-d637-4a36-80ff-ac84937e5461_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff_104.json b/packages/security_detection_engine/kibana/security_rule/4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff_104.json new file mode 100644 index 00000000000..7fac70a8e52 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff_104.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies scrobj.dll loaded into unusual Microsoft processes. This usually means a malicious scriptlet is being executed in the target process.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Script Object Execution", + "query": "sequence by process.entity_id with maxspan=2m\n [process where host.os.type == \"windows\" and event.type == \"start\"\n and (process.code_signature.subject_name in (\"Microsoft Corporation\", \"Microsoft Windows\") and\n process.code_signature.trusted == true) and\n not process.executable : (\n \"?:\\\\Windows\\\\System32\\\\cscript.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\cscript.exe\",\n \"?:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe\",\n \"?:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe\",\n \"?:\\\\Windows\\\\SystemApps\\\\Microsoft.MicrosoftEdge_*\\\\MicrosoftEdge.exe\",\n \"?:\\\\Windows\\\\system32\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\",\n \"?:\\\\Windows\\\\System32\\\\smartscreen.exe\",\n \"?:\\\\Windows\\\\system32\\\\taskhostw.exe\",\n \"?:\\\\windows\\\\system32\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\windows\\\\SysWOW64\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\Windows\\\\system32\\\\wscript.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\wscript.exe\",\n \"?:\\\\Windows\\\\system32\\\\mobsync.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\mobsync.exe\",\n \"?:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\cmd.exe\")]\n [library where host.os.type == \"windows\" and event.type == \"start\" and dll.name : \"scrobj.dll\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "4ed678a9-3a4f-41fb-9fea-f85a6e0a0dff_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4edd3e1a-3aa0-499b-8147-4d2ea43b1613_104.json b/packages/security_detection_engine/kibana/security_rule/4edd3e1a-3aa0-499b-8147-4d2ea43b1613_104.json new file mode 100644 index 00000000000..63d9ba9afb5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4edd3e1a-3aa0-499b-8147-4d2ea43b1613_104.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies unauthorized access attempts to Okta applications.", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Unauthorized Access to an Okta Application", + "note": "", + "query": "event.dataset:okta.system and event.action:app.generic.unauth_app_access_attempt\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "4edd3e1a-3aa0-499b-8147-4d2ea43b1613", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Tactic: Initial Access", + "Use Case: Identity and Access Audit", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "4edd3e1a-3aa0-499b-8147-4d2ea43b1613_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/4fe9d835-40e1-452d-8230-17c147cafad8_105.json b/packages/security_detection_engine/kibana/security_rule/4fe9d835-40e1-452d-8230-17c147cafad8_105.json new file mode 100644 index 00000000000..9a7026e4370 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/4fe9d835-40e1-452d-8230-17c147cafad8_105.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution from the Remote Desktop Protocol (RDP) shared mountpoint tsclient on the target host. This may indicate a lateral movement attempt.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution via TSClient Mountpoint", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.executable : \"\\\\Device\\\\Mup\\\\tsclient\\\\*.exe\"\n", + "references": [ + "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "4fe9d835-40e1-452d-8230-17c147cafad8", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "4fe9d835-40e1-452d-8230-17c147cafad8_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_1.json b/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_1.json new file mode 100644 index 00000000000..193ed153651 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_1.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows System Information Discovery", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n process.name : \"cmd.exe\" and process.args : \"ver*\" and not\n process.parent.executable : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Keybase\\\\upd.exe\",\n \"?:\\\\Users\\\\*\\\\python*.exe\"\n )\n ) or \n process.name : (\"systeminfo.exe\", \"hostname.exe\") or \n (process.name : \"wmic.exe\" and process.args : \"os\" and process.args : \"get\")\n) and not\nprocess.parent.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\ProgramData\\\\*\"\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "51176ed2-2d90-49f2-9f3d-17196428b169", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "51176ed2-2d90-49f2-9f3d-17196428b169_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_2.json b/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_2.json new file mode 100644 index 00000000000..8984238a4cc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/51176ed2-2d90-49f2-9f3d-17196428b169_2.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Detects the execution of commands used to discover information about the system, which attackers may use after compromising a system to gain situational awareness.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows System Information Discovery", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n process.name : \"cmd.exe\" and process.args : \"ver*\" and not\n process.parent.executable : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Keybase\\\\upd.exe\",\n \"?:\\\\Users\\\\*\\\\python*.exe\"\n )\n ) or \n process.name : (\"systeminfo.exe\", \"hostname.exe\") or \n (process.name : \"wmic.exe\" and process.args : \"os\" and process.args : \"get\")\n) and not\nprocess.parent.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\ProgramData\\\\*\"\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "51176ed2-2d90-49f2-9f3d-17196428b169", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "51176ed2-2d90-49f2-9f3d-17196428b169_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5124e65f-df97-4471-8dcb-8e3953b3ea97_1.json b/packages/security_detection_engine/kibana/security_rule/5124e65f-df97-4471-8dcb-8e3953b3ea97_1.json new file mode 100644 index 00000000000..f67694e7d78 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5124e65f-df97-4471-8dcb-8e3953b3ea97_1.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identify activity related where adversaries can add the 'hidden' flag to files to hide them from the user in an attempt to evade detection.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Hidden Files and Directories via Hidden Flag", + "query": "file where event.type : \"creation\" and process.name : \"chflags\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5124e65f-df97-4471-8dcb-8e3953b3ea97", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5124e65f-df97-4471-8dcb-8e3953b3ea97_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/513f0ffd-b317-4b9c-9494-92ce861f22c7_104.json b/packages/security_detection_engine/kibana/security_rule/513f0ffd-b317-4b9c-9494-92ce861f22c7_104.json new file mode 100644 index 00000000000..fa6f85b9f6e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/513f0ffd-b317-4b9c-9494-92ce861f22c7_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to maintain persistence by creating registry keys using AppCert DLLs. AppCert DLLs are loaded by every process using the common API functions to create processes.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Registry Persistence via AppCert DLL", + "note": "", + "query": "registry where host.os.type == \"windows\" and\n/* uncomment once stable length(bytes_written_string) \u003e 0 and */\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Session Manager\\\\AppCertDLLs\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Session Manager\\\\AppCertDLLs\\\\*\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "513f0ffd-b317-4b9c-9494-92ce861f22c7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.009", + "name": "AppCert DLLs", + "reference": "https://attack.mitre.org/techniques/T1546/009/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "513f0ffd-b317-4b9c-9494-92ce861f22c7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/51ce96fb-9e52-4dad-b0ba-99b54440fc9a_105.json b/packages/security_detection_engine/kibana/security_rule/51ce96fb-9e52-4dad-b0ba-99b54440fc9a_105.json new file mode 100644 index 00000000000..5837c649a59 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/51ce96fb-9e52-4dad-b0ba-99b54440fc9a_105.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the MMC20 Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming DCOM Lateral Movement with MMC", + "query": "sequence by host.id with maxspan=1m\n [network where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"mmc.exe\" and source.port \u003e= 49152 and\n destination.port \u003e= 49152 and source.ip != \"127.0.0.1\" and source.ip != \"::1\" and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\"\n ] by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"mmc.exe\"\n ] by process.parent.entity_id\n", + "references": [ + "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "51ce96fb-9e52-4dad-b0ba-99b54440fc9a", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.003", + "name": "Distributed Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1021/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "51ce96fb-9e52-4dad-b0ba-99b54440fc9a_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/521fbe5c-a78d-4b6b-a323-f978b0e4c4c0_1.json b/packages/security_detection_engine/kibana/security_rule/521fbe5c-a78d-4b6b-a323-f978b0e4c4c0_1.json new file mode 100644 index 00000000000..e0fcbb34d32 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/521fbe5c-a78d-4b6b-a323-f978b0e4c4c0_1.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An RDP (Remote Desktop Protocol) brute force attack involves an attacker repeatedly attempting various username and password combinations to gain unauthorized access to a remote computer via RDP, and if successful, the potential impact can include unauthorized control over the compromised system, data theft, or the ability to launch further attacks within the network, jeopardizing the security and confidentiality of the targeted system and potentially compromising the entire network infrastructure. This rule identifies multiple consecutive authentication failures targeting a specific user account within a short time interval, followed by a successful authentication.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Successful Linux RDP Brute Force Attack Detected", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n```\nFor this detection rule no additional audit rules are required to be added to the integration. \n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "sequence by host.id, related.user with maxspan=5s\n [authentication where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n event.action == \"authenticated\" and auditd.data.terminal : \"*rdp*\" and event.outcome == \"failure\"] with runs=10\n [authentication where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n event.action == \"authenticated\" and auditd.data.terminal : \"*rdp*\" and event.outcome == \"success\"] | tail 1\n", + "related_integrations": [ + { + "integration": "auditd", + "package": "auditd_manager", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "auditd.data.terminal", + "type": "unknown" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "related.user", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n```\nFor this detection rule no additional audit rules are required to be added to the integration.\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "521fbe5c-a78d-4b6b-a323-f978b0e4c4c0_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_106.json b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_106.json new file mode 100644 index 00000000000..6f36a8350c1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_106.json @@ -0,0 +1,137 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via Linux Binary(s)", + "note": "## Triage and analysis\n\n### Investigating Shell Evasion via Linux Utilities\nDetection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or\nenvironments by spawning an interactive system shell.\nHere are some possible avenues of investigation:\n- Examine the entry point to the host and user in action via the Analyse View.\n - Identify the session entry leader and session user\n- Examine the contents of session leading to the abuse via the Session View.\n - Examine the command execution pattern in the session, which may lead to suspricous activities\n- Examine the execution of commands in the spawned shell.\n - Identify imment threat to the system from the executed commands\n - Take necessary incident response actions to contain any malicious behviour caused via this execution.\n\n### Related rules\n\n- A malicious spawned shell can execute any of the possible MITTRE ATT\u0026CK vectors mainly to impair defences.\n- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment\n\n### Response and remediation\n\nInitiate the incident response process based on the outcome of the triage.\n\n- If the triage releaved suspicious netwrok activity from the malicious spawned shell,\n - Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware execution via the maliciously spawned shell,\n - Search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- If the triage revelaed defence evasion for imparing defenses\n - Isolate the involved host to prevent further post-compromise behavior.\n - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.\n - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.\n- If the triage revelaed addition of persistence mechanism exploit like auto start scripts\n - Isolate further login to the systems that can initae auto start scripts.\n - Identify the auto start scripts and disable and remove the same from the systems\n- If the triage revealed data crawling or data export via remote copy\n - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling\n - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.\n - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\n(\n /* launching shell from capsh */\n (process.name == \"capsh\" and process.args == \"--\") or\n \n /* launching shells from unusual parents or parent+arg combos */\n (process.name : \"*sh\" and (\n (process.parent.name : (\"byebug\", \"ftp\", \"strace\", \"zip\", \"*awk\", \"git\", \"tar\") and \n (\n process.parent.args : \"BEGIN {system(*)}\" or\n (process.parent.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\") or process.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\")) or\n (\n (process.parent.args : \"exec=*sh\" or (process.parent.args : \"-I\" and process.parent.args : \"*sh\")) or\n (process.args : \"exec=*sh\" or (process.args : \"-I\" and process.args : \"*sh\"))\n )\n )\n ) or\n \n /* shells specified in parent args */\n /* nice rule is broken in 8.2 */\n (process.parent.args : \"*sh\" and\n (\n (process.parent.name == \"nice\") or\n (process.parent.name == \"cpulimit\" and process.parent.args == \"-f\") or\n (process.parent.name == \"find\" and process.parent.args == \"-exec\" and process.parent.args == \";\" and process.parent.args == \"-p\") or\n (process.parent.name == \"flock\" and process.parent.args == \"-u\" and process.parent.args == \"/\")\n )\n )\n )) or\n\n /* shells specified in args */\n (process.args : \"*sh\" and (\n (process.parent.name == \"crash\" and process.parent.args == \"-h\") or\n (process.name == \"sensible-pager\" and process.parent.name in (\"apt\", \"apt-get\") and process.parent.args == \"changelog\")\n /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */\n \n )) or\n (process.name == \"busybox\" and event.action == \"exec\" and process.args_count == 2 and process.args : \"*sh\" and not process.executable : \"/var/lib/docker/overlay2/*/merged/bin/busybox\") or\n (process.name == \"env\" and process.args_count == 2 and process.args : \"*sh\") or\n (process.parent.name in (\"vi\", \"vim\") and process.parent.args == \"-c\" and process.parent.args : \":!*sh\") or\n (process.parent.name in (\"c89\", \"c99\", \"gcc\") and process.parent.args : \"*sh,-s\" and process.parent.args == \"-wrapper\") or\n (process.parent.name == \"expect\" and process.parent.args == \"-c\" and process.parent.args : \"spawn *sh;interact\") or\n (process.parent.name == \"mysql\" and process.parent.args == \"-e\" and process.parent.args : \"\\\\!*sh\") or\n (process.parent.name == \"ssh\" and process.parent.args == \"-o\" and process.parent.args : \"ProxyCommand=;*sh 0\u003c\u00262 1\u003e\u00262\")\n)\n", + "references": [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/", + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/", + "https://gtfobins.github.io/gtfobins/awk/", + "https://gtfobins.github.io/gtfobins/gawk/", + "https://gtfobins.github.io/gtfobins/busybox/", + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/", + "https://gtfobins.github.io/gtfobins/cpulimit/", + "https://gtfobins.github.io/gtfobins/crash/", + "https://gtfobins.github.io/gtfobins/env/", + "https://gtfobins.github.io/gtfobins/expect/", + "https://gtfobins.github.io/gtfobins/find/", + "https://gtfobins.github.io/gtfobins/flock/", + "https://gtfobins.github.io/gtfobins/gcc/", + "https://gtfobins.github.io/gtfobins/mysql/", + "https://gtfobins.github.io/gtfobins/nice/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://gtfobins.github.io/gtfobins/vi/", + "https://gtfobins.github.io/gtfobins/vim/", + "https://gtfobins.github.io/gtfobins/capsh/", + "https://gtfobins.github.io/gtfobins/byebug/", + "https://gtfobins.github.io/gtfobins/git/", + "https://gtfobins.github.io/gtfobins/ftp/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "52376a86-ee86-4967-97ae-1a05f55816f0", + "setup": "The session view analysis for the command alerted is avalible in versions 8.2 and above.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "52376a86-ee86-4967-97ae-1a05f55816f0_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_107.json b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_107.json new file mode 100644 index 00000000000..a7b8fcf8b10 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_107.json @@ -0,0 +1,137 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via Linux Binary(s)", + "note": "## Triage and analysis\n\n### Investigating Shell Evasion via Linux Utilities\nDetection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or\nenvironments by spawning an interactive system shell.\nHere are some possible avenues of investigation:\n- Examine the entry point to the host and user in action via the Analyse View.\n - Identify the session entry leader and session user\n- Examine the contents of session leading to the abuse via the Session View.\n - Examine the command execution pattern in the session, which may lead to suspricous activities\n- Examine the execution of commands in the spawned shell.\n - Identify imment threat to the system from the executed commands\n - Take necessary incident response actions to contain any malicious behviour caused via this execution.\n\n### Related rules\n\n- A malicious spawned shell can execute any of the possible MITTRE ATT\u0026CK vectors mainly to impair defences.\n- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment\n\n### Response and remediation\n\nInitiate the incident response process based on the outcome of the triage.\n\n- If the triage releaved suspicious netwrok activity from the malicious spawned shell,\n - Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware execution via the maliciously spawned shell,\n - Search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- If the triage revelaed defence evasion for imparing defenses\n - Isolate the involved host to prevent further post-compromise behavior.\n - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.\n - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.\n- If the triage revelaed addition of persistence mechanism exploit like auto start scripts\n - Isolate further login to the systems that can initae auto start scripts.\n - Identify the auto start scripts and disable and remove the same from the systems\n- If the triage revealed data crawling or data export via remote copy\n - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling\n - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.\n - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\n(\n /* launching shell from capsh */\n (process.name == \"capsh\" and process.args == \"--\") or\n \n /* launching shells from unusual parents or parent+arg combos */\n (process.name : \"*sh\" and (\n (process.parent.name : (\"byebug\", \"ftp\", \"strace\", \"zip\", \"*awk\", \"git\", \"tar\") and \n (\n process.parent.args : \"BEGIN {system(*)}\" or\n (process.parent.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\") or process.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\")) or\n (\n (process.parent.args : \"exec=*sh\" or (process.parent.args : \"-I\" and process.parent.args : \"*sh\")) or\n (process.args : \"exec=*sh\" or (process.args : \"-I\" and process.args : \"*sh\"))\n )\n )\n ) or\n \n /* shells specified in parent args */\n /* nice rule is broken in 8.2 */\n (process.parent.args : \"*sh\" and\n (\n (process.parent.name == \"nice\") or\n (process.parent.name == \"cpulimit\" and process.parent.args == \"-f\") or\n (process.parent.name == \"find\" and process.parent.args == \"-exec\" and process.parent.args == \";\" and process.parent.args == \"-p\") or\n (process.parent.name == \"flock\" and process.parent.args == \"-u\" and process.parent.args == \"/\")\n )\n )\n )) or\n\n /* shells specified in args */\n (process.args : \"*sh\" and (\n (process.parent.name == \"crash\" and process.parent.args == \"-h\") or\n (process.name == \"sensible-pager\" and process.parent.name in (\"apt\", \"apt-get\") and process.parent.args == \"changelog\")\n /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */\n \n )) or\n (process.name == \"busybox\" and event.action == \"exec\" and process.args_count == 2 and process.args : \"*sh\" and not \n process.executable : \"/var/lib/docker/overlay2/*/merged/bin/busybox\" and not (process.parent.args == \"init\" and\n process.parent.args == \"runc\") and not process.parent.args in (\"ls-remote\", \"push\", \"fetch\")) or\n (process.name == \"env\" and process.args_count == 2 and process.args : \"*sh\") or\n (process.parent.name in (\"vi\", \"vim\") and process.parent.args == \"-c\" and process.parent.args : \":!*sh\") or\n (process.parent.name in (\"c89\", \"c99\", \"gcc\") and process.parent.args : \"*sh,-s\" and process.parent.args == \"-wrapper\") or\n (process.parent.name == \"expect\" and process.parent.args == \"-c\" and process.parent.args : \"spawn *sh;interact\") or\n (process.parent.name == \"mysql\" and process.parent.args == \"-e\" and process.parent.args : \"\\\\!*sh\") or\n (process.parent.name == \"ssh\" and process.parent.args == \"-o\" and process.parent.args : \"ProxyCommand=;*sh 0\u003c\u00262 1\u003e\u00262\")\n)\n", + "references": [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/", + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/", + "https://gtfobins.github.io/gtfobins/awk/", + "https://gtfobins.github.io/gtfobins/gawk/", + "https://gtfobins.github.io/gtfobins/busybox/", + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/", + "https://gtfobins.github.io/gtfobins/cpulimit/", + "https://gtfobins.github.io/gtfobins/crash/", + "https://gtfobins.github.io/gtfobins/env/", + "https://gtfobins.github.io/gtfobins/expect/", + "https://gtfobins.github.io/gtfobins/find/", + "https://gtfobins.github.io/gtfobins/flock/", + "https://gtfobins.github.io/gtfobins/gcc/", + "https://gtfobins.github.io/gtfobins/mysql/", + "https://gtfobins.github.io/gtfobins/nice/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://gtfobins.github.io/gtfobins/vi/", + "https://gtfobins.github.io/gtfobins/vim/", + "https://gtfobins.github.io/gtfobins/capsh/", + "https://gtfobins.github.io/gtfobins/byebug/", + "https://gtfobins.github.io/gtfobins/git/", + "https://gtfobins.github.io/gtfobins/ftp/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "52376a86-ee86-4967-97ae-1a05f55816f0", + "setup": "The session view analysis for the command alerted is avalible in versions 8.2 and above.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "52376a86-ee86-4967-97ae-1a05f55816f0_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_108.json b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_108.json new file mode 100644 index 00000000000..b8dc303ab9e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/52376a86-ee86-4967-97ae-1a05f55816f0_108.json @@ -0,0 +1,138 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the abuse of a Linux binary to break out of a restricted shell or environment by spawning an interactive system shell. The activity of spawning a shell from a binary is not common behavior for a user or system administrator, and may indicate an attempt to evade detection, increase capabilities or enhance the stability of an adversary.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Restricted Shell Breakout via Linux Binary(s)", + "note": "## Triage and analysis\n\n### Investigating Shell Evasion via Linux Utilities\nDetection alerts from this rule indicate that a Linux utility has been abused to breakout of restricted shells or\nenvironments by spawning an interactive system shell.\nHere are some possible avenues of investigation:\n- Examine the entry point to the host and user in action via the Analyse View.\n - Identify the session entry leader and session user\n- Examine the contents of session leading to the abuse via the Session View.\n - Examine the command execution pattern in the session, which may lead to suspricous activities\n- Examine the execution of commands in the spawned shell.\n - Identify imment threat to the system from the executed commands\n - Take necessary incident response actions to contain any malicious behviour caused via this execution.\n\n### Related rules\n\n- A malicious spawned shell can execute any of the possible MITTRE ATT\u0026CK vectors mainly to impair defences.\n- Hence its adviced to enable defence evasion and privilige escalation rules accordingly in your environment\n\n### Response and remediation\n\nInitiate the incident response process based on the outcome of the triage.\n\n- If the triage releaved suspicious netwrok activity from the malicious spawned shell,\n - Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware execution via the maliciously spawned shell,\n - Search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- If the triage revelaed defence evasion for imparing defenses\n - Isolate the involved host to prevent further post-compromise behavior.\n - Identified the disabled security guard components on the host and take necessary steps in renebaling the same.\n - If any tools have been disbaled / uninstalled or config tampered work towards reenabling the same.\n- If the triage revelaed addition of persistence mechanism exploit like auto start scripts\n - Isolate further login to the systems that can initae auto start scripts.\n - Identify the auto start scripts and disable and remove the same from the systems\n- If the triage revealed data crawling or data export via remote copy\n - Investigate credential exposure on systems compromised / used / decoded by the attacker during the data crawling\n - Intiate compromised credential deactivation and credential rotation process for all exposed crednetials.\n - Investiagte if any IPR data was accessed during the data crawling and take appropriate actions.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\n(\n /* launching shell from capsh */\n (process.name == \"capsh\" and process.args == \"--\") or\n \n /* launching shells from unusual parents or parent+arg combos */\n (process.name : \"*sh\" and (\n (process.parent.name : \"*awk\" and process.parent.args : \"BEGIN {system(*)}\") or\n (process.parent.name == \"git\" and process.parent.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\") or \n process.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\") and not process.name == \"ssh\" ) or\n (process.parent.name : (\"byebug\", \"ftp\", \"strace\", \"zip\", \"tar\") and \n (\n process.parent.args : \"BEGIN {system(*)}\" or\n (process.parent.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\") or process.args : (\"*PAGER*\", \"!*sh\", \"exec *sh\")) or\n (\n (process.parent.args : \"exec=*sh\" or (process.parent.args : \"-I\" and process.parent.args : \"*sh\")) or\n (process.args : \"exec=*sh\" or (process.args : \"-I\" and process.args : \"*sh\"))\n )\n )\n ) or\n \n /* shells specified in parent args */\n /* nice rule is broken in 8.2 */\n (process.parent.args : \"*sh\" and\n (\n (process.parent.name == \"nice\") or\n (process.parent.name == \"cpulimit\" and process.parent.args == \"-f\") or\n (process.parent.name == \"find\" and process.parent.args == \".\" and process.parent.args == \"-exec\" and \n process.parent.args == \";\" and process.parent.args : \"/bin/*sh\") or\n (process.parent.name == \"flock\" and process.parent.args == \"-u\" and process.parent.args == \"/\")\n )\n )\n )) or\n\n /* shells specified in args */\n (process.args : \"*sh\" and (\n (process.parent.name == \"crash\" and process.parent.args == \"-h\") or\n (process.name == \"sensible-pager\" and process.parent.name in (\"apt\", \"apt-get\") and process.parent.args == \"changelog\")\n /* scope to include more sensible-pager invoked shells with different parent process to reduce noise and remove false positives */\n \n )) or\n (process.name == \"busybox\" and event.action == \"exec\" and process.args_count == 2 and process.args : \"*sh\" and not \n process.executable : \"/var/lib/docker/overlay2/*/merged/bin/busybox\" and not (process.parent.args == \"init\" and\n process.parent.args == \"runc\") and not process.parent.args in (\"ls-remote\", \"push\", \"fetch\") and not process.parent.name == \"mkinitramfs\") or\n (process.name == \"env\" and process.args_count == 2 and process.args : \"*sh\") or\n (process.parent.name in (\"vi\", \"vim\") and process.parent.args == \"-c\" and process.parent.args : \":!*sh\") or\n (process.parent.name in (\"c89\", \"c99\", \"gcc\") and process.parent.args : \"*sh,-s\" and process.parent.args == \"-wrapper\") or\n (process.parent.name == \"expect\" and process.parent.args == \"-c\" and process.parent.args : \"spawn *sh;interact\") or\n (process.parent.name == \"mysql\" and process.parent.args == \"-e\" and process.parent.args : \"\\\\!*sh\") or\n (process.parent.name == \"ssh\" and process.parent.args == \"-o\" and process.parent.args : \"ProxyCommand=;*sh 0\u003c\u00262 1\u003e\u00262\")\n)\n", + "references": [ + "https://gtfobins.github.io/gtfobins/apt/", + "https://gtfobins.github.io/gtfobins/apt-get/", + "https://gtfobins.github.io/gtfobins/nawk/", + "https://gtfobins.github.io/gtfobins/mawk/", + "https://gtfobins.github.io/gtfobins/awk/", + "https://gtfobins.github.io/gtfobins/gawk/", + "https://gtfobins.github.io/gtfobins/busybox/", + "https://gtfobins.github.io/gtfobins/c89/", + "https://gtfobins.github.io/gtfobins/c99/", + "https://gtfobins.github.io/gtfobins/cpulimit/", + "https://gtfobins.github.io/gtfobins/crash/", + "https://gtfobins.github.io/gtfobins/env/", + "https://gtfobins.github.io/gtfobins/expect/", + "https://gtfobins.github.io/gtfobins/find/", + "https://gtfobins.github.io/gtfobins/flock/", + "https://gtfobins.github.io/gtfobins/gcc/", + "https://gtfobins.github.io/gtfobins/mysql/", + "https://gtfobins.github.io/gtfobins/nice/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://gtfobins.github.io/gtfobins/vi/", + "https://gtfobins.github.io/gtfobins/vim/", + "https://gtfobins.github.io/gtfobins/capsh/", + "https://gtfobins.github.io/gtfobins/byebug/", + "https://gtfobins.github.io/gtfobins/git/", + "https://gtfobins.github.io/gtfobins/ftp/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "52376a86-ee86-4967-97ae-1a05f55816f0", + "setup": "The session view analysis for the command alerted is avalible in versions 8.2 and above.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "52376a86-ee86-4967-97ae-1a05f55816f0_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/52aaab7b-b51c-441a-89ce-4387b3aea886_107.json b/packages/security_detection_engine/kibana/security_rule/52aaab7b-b51c-441a-89ce-4387b3aea886_107.json new file mode 100644 index 00000000000..842844f726d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/52aaab7b-b51c-441a-89ce-4387b3aea886_107.json @@ -0,0 +1,132 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unusual instances of rundll32.exe making outbound network connections. This may indicate adversarial Command and Control activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Network Connection via RunDLL32", + "note": "## Triage and analysis\n\n### Investigating Unusual Network Connection via RunDLL32\n\nRunDLL32 is a built-in Windows utility and also a vital component used by the operating system itself. The functionality provided by RunDLL32 to execute Dynamic Link Libraries (DLLs) is widely abused by attackers, because it makes it hard to differentiate malicious activity from normal operations.\n\nThis rule looks for external network connections established using RunDLL32 when the utility is being executed with no arguments, which can potentially indicate command and control activity.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the target host that RunDLL32 is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Identify the target computer and its role in the IT environment.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id, process.entity_id with maxspan=1m\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"rundll32.exe\" and process.args_count == 1]\n [network where host.os.type == \"windows\" and process.name : \"rundll32.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml", + "https://redcanary.com/threat-detection-report/techniques/rundll32/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "52aaab7b-b51c-441a-89ce-4387b3aea886", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.011", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1218/011/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "52aaab7b-b51c-441a-89ce-4387b3aea886_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/52afbdc5-db15-485e-bc24-f5707f820c4b_103.json b/packages/security_detection_engine/kibana/security_rule/52afbdc5-db15-485e-bc24-f5707f820c4b_103.json new file mode 100644 index 00000000000..cd469a170a6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/52afbdc5-db15-485e-bc24-f5707f820c4b_103.json @@ -0,0 +1,44 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies Linux processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_anomalous_network_activity" + ], + "name": "Unusual Linux Network Activity", + "note": "## Triage and analysis\n\n### Investigating Unusual Network Activity\nDetection alerts from this rule indicate the presence of network activity from a Linux process for which network activity is rare and unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected?\n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business or maintenance process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "52afbdc5-db15-485e-bc24-f5707f820c4b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "52afbdc5-db15-485e-bc24-f5707f820c4b_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/530178da-92ea-43ce-94c2-8877a826783d_104.json b/packages/security_detection_engine/kibana/security_rule/530178da-92ea-43ce-94c2-8877a826783d_104.json new file mode 100644 index 00000000000..81849bc1271 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/530178da-92ea-43ce-94c2-8877a826783d_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to create or modify a crontab via a process that is not crontab (i.e python, osascript, etc.). This activity should not be highly prevalent and could indicate the use of cron as a persistence mechanism by a threat actor.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious CronTab Creation or Modification", + "query": "file where host.os.type == \"macos\" and event.type != \"deletion\" and process.name != null and\n file.path : \"/private/var/at/tabs/*\" and not process.executable == \"/usr/bin/crontab\"\n", + "references": [ + "https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf", + "https://theevilbit.github.io/beyond/beyond_0004/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "530178da-92ea-43ce-94c2-8877a826783d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "530178da-92ea-43ce-94c2-8877a826783d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_2.json b/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_2.json new file mode 100644 index 00000000000..2aeb3b8e5d3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_2.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory to a previously unknown destination ip. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.", + "from": "now-59m", + "history_window_start": "now-7d", + "index": [ + "auditbeat-*", + "filebeat-*", + "packetbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Network Activity to the Internet by Previously Unknown Executable", + "new_terms_fields": [ + "destination.ip", + "process.executable" + ], + "query": "host.os.type:linux and event.category:network and \nevent.action:(connection_attempted or ipv4_connection_attempt_event) and \nprocess.executable : ( \n (/etc/crontab or \n /etc/rc.local or \n /boot/* or \n /dev/shm/* or \n /etc/cron.*/* or \n /etc/init.d/* or \n /etc/rc*.d/* or \n /etc/update-motd.d/* or \n /home/*/.* or \n /run/* or \n /srv/* or \n /tmp/* or \n /usr/lib/update-notifier/* or \n /var/tmp/*) and \n not (/usr/bin/apt or \n /usr/bin/curl or \n /usr/bin/dnf or \n /usr/bin/dockerd or \n /usr/bin/dpkg or \n /usr/bin/rpm or \n /usr/bin/wget or \n /usr/bin/yum) \n ) \nand source.ip : ( \n 10.0.0.0/8 or \n 127.0.0.0/8 or \n 172.16.0.0/12 or \n 192.168.0.0/16) and \n not destination.ip : ( \n 10.0.0.0/8 or \n 100.64.0.0/10 or \n 127.0.0.0/8 or \n 169.254.0.0/16 or \n 172.16.0.0/12 or \n 192.0.0.0/24 or \n 192.0.0.0/29 or \n 192.0.0.10/32 or \n 192.0.0.170/32 or \n 192.0.0.171/32 or \n 192.0.0.8/32 or \n 192.0.0.9/32 or \n 192.0.2.0/24 or \n 192.168.0.0/16 or \n 192.175.48.0/24 or \n 192.31.196.0/24 or \n 192.52.193.0/24 or \n 192.88.99.0/24 or \n 198.18.0.0/15 or \n 198.51.100.0/24 or \n 203.0.113.0/24 or \n 224.0.0.0/4 or \n 240.0.0.0/4 or \n \"::1\" or \n \"FE80::/10\" or \n \"FF00::/8\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 21, + "rule_id": "53617418-17b4-4e9c-8a2c-8deb8086ca4b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 2 + }, + "id": "53617418-17b4-4e9c-8a2c-8deb8086ca4b_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_3.json b/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_3.json new file mode 100644 index 00000000000..a28a4046862 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/53617418-17b4-4e9c-8a2c-8deb8086ca4b_3.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for network connectivity to the internet from a previously unknown executable located in a suspicious directory to a previously unknown destination ip. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to establish connections to unknown or suspicious destinations such as a command and control server. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.", + "from": "now-59m", + "history_window_start": "now-7d", + "index": [ + "auditbeat-*", + "filebeat-*", + "packetbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Network Activity to the Internet by Previously Unknown Executable", + "new_terms_fields": [ + "destination.ip", + "process.executable" + ], + "query": "host.os.type:linux and event.category:network and \nevent.action:(connection_attempted or ipv4_connection_attempt_event) and \nprocess.executable : ( \n (/etc/crontab or \n /etc/rc.local or \n /boot/* or \n /dev/shm/* or \n /etc/cron.*/* or \n /etc/init.d/* or \n /etc/rc*.d/* or \n /etc/update-motd.d/* or \n /home/*/.* or \n /run/* or \n /srv/* or \n /tmp/* or \n /usr/lib/update-notifier/* or \n /var/tmp/*) and \n not (/usr/bin/apt or \n /usr/bin/curl or \n /usr/bin/dnf or \n /usr/bin/dockerd or \n /usr/bin/dpkg or \n /usr/bin/rpm or \n /usr/bin/wget or \n /usr/bin/yum) \n ) \nand source.ip : ( \n 10.0.0.0/8 or \n 127.0.0.0/8 or \n 172.16.0.0/12 or \n 192.168.0.0/16) and \n not destination.ip : ( \n 10.0.0.0/8 or \n 100.64.0.0/10 or \n 127.0.0.0/8 or \n 169.254.0.0/16 or \n 172.16.0.0/12 or \n 192.0.0.0/24 or \n 192.0.0.0/29 or \n 192.0.0.10/32 or \n 192.0.0.170/32 or \n 192.0.0.171/32 or \n 192.0.0.8/32 or \n 192.0.0.9/32 or \n 192.0.2.0/24 or \n 192.168.0.0/16 or \n 192.175.48.0/24 or \n 192.31.196.0/24 or \n 192.52.193.0/24 or \n 192.88.99.0/24 or \n 198.18.0.0/15 or \n 198.51.100.0/24 or \n 203.0.113.0/24 or \n 224.0.0.0/4 or \n 240.0.0.0/4 or \n \"::1\" or \n \"FE80::/10\" or \n \"FF00::/8\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 21, + "rule_id": "53617418-17b4-4e9c-8a2c-8deb8086ca4b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "53617418-17b4-4e9c-8a2c-8deb8086ca4b_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/53a26770-9cbd-40c5-8b57-61d01a325e14_106.json b/packages/security_detection_engine/kibana/security_rule/53a26770-9cbd-40c5-8b57-61d01a325e14_106.json new file mode 100644 index 00000000000..22fbff78c67 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/53a26770-9cbd-40c5-8b57-61d01a325e14_106.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious child processes of PDF reader applications. These child processes are often launched via exploitation of PDF applications or social engineering.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious PDF Reader Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious PDF Reader Child Process\n\nPDF is a common file type used in corporate environments and most machines have software to handle these files. This creates a vector where attackers can exploit the engines and technology behind this class of software for initial access or privilege escalation.\n\nThis rule looks for commonly abused built-in utilities spawned by a PDF reader process, which is likely a malicious behavior.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve PDF documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"AcroRd32.exe\",\n \"Acrobat.exe\",\n \"FoxitPhantomPDF.exe\",\n \"FoxitReader.exe\") and\n process.name : (\"arp.exe\", \"dsquery.exe\", \"dsget.exe\", \"gpresult.exe\", \"hostname.exe\", \"ipconfig.exe\", \"nbtstat.exe\",\n \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"ping.exe\", \"qprocess.exe\",\n \"quser.exe\", \"qwinsta.exe\", \"reg.exe\", \"sc.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\",\n \"whoami.exe\", \"bginfo.exe\", \"cdb.exe\", \"cmstp.exe\", \"csi.exe\", \"dnx.exe\", \"fsi.exe\", \"ieexec.exe\",\n \"iexpress.exe\", \"installutil.exe\", \"Microsoft.Workflow.Compiler.exe\", \"msbuild.exe\", \"mshta.exe\",\n \"msxsl.exe\", \"odbcconf.exe\", \"rcsi.exe\", \"regsvr32.exe\", \"xwizard.exe\", \"atbroker.exe\",\n \"forfiles.exe\", \"schtasks.exe\", \"regasm.exe\", \"regsvcs.exe\", \"cmd.exe\", \"cscript.exe\",\n \"powershell.exe\", \"pwsh.exe\", \"wmic.exe\", \"wscript.exe\", \"bitsadmin.exe\", \"certutil.exe\", \"ftp.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "53a26770-9cbd-40c5-8b57-61d01a325e14", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "53a26770-9cbd-40c5-8b57-61d01a325e14_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/53dedd83-1be7-430f-8026-363256395c8b_1.json b/packages/security_detection_engine/kibana/security_rule/53dedd83-1be7-430f-8026-363256395c8b_1.json new file mode 100644 index 00000000000..103c27836d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/53dedd83-1be7-430f-8026-363256395c8b_1.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Attackers may abuse cmd.exe commands to reassemble binary fragments into a malicious payload.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Binary Content Copy via Cmd.exe", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"cmd.exe\" and (\n (process.args : \"type\" and process.args : (\"\u003e\", \"\u003e\u003e\")) or\n (process.args : \"copy\" and process.args : \"/b\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "53dedd83-1be7-430f-8026-363256395c8b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "53dedd83-1be7-430f-8026-363256395c8b_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_104.json b/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_104.json new file mode 100644 index 00000000000..2bf81df259b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_104.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Uncommon Registry Persistence Change", + "query": "registry where host.os.type == \"windows\" and\n /* uncomment once stable length(registry.data.strings) \u003e 0 and */\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Runonce\\\\*\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Load\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Run\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\IconServiceLib\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\AppSetup\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Taskman\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\VmApplet\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active Setup\\\\Installed Components\\\\*\\\\ShellComponent\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnConnect\\\\MicrosoftActiveSync\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnDisconnect\\\\MicrosoftActiveSync\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n \"HKEY_USERS\\\\*\\\\Control Panel\\\\Desktop\\\\scrnsave.exe\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*\\\\VerifierDlls\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\GpExtensions\\\\*\\\\DllName\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\SafeBoot\\\\AlternateShell\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\Wds\\\\rdpwd\\\\StartupPrograms\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\InitialProgram\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\BootExecute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\SetupExecute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\Execute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\S0InitialCommand\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\ServiceControlManagerExtension\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\BootVerificationProgram\\\\ImagePath\",\n \"HKLM\\\\SYSTEM\\\\Setup\\\\CmdLine\",\n \"HKEY_USERS\\\\*\\\\Environment\\\\UserInitMprLogonScript\") and\n\n not registry.data.strings : (\"C:\\\\Windows\\\\system32\\\\userinit.exe\", \"cmd.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\",\n \"C:\\\\Program Files\\\\*.exe\") and\n not (process.name : \"rundll32.exe\" and registry.path : \"*\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\") and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\",\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"C:\\\\Program Files\\\\*.exe\",\n \"C:\\\\Program Files (x86)\\\\*.exe\")\n", + "references": [ + "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\u0026seqNum=2" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "54902e45-3467-49a4-8abc-529f2c8cfb80", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "54902e45-3467-49a4-8abc-529f2c8cfb80_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_105.json b/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_105.json new file mode 100644 index 00000000000..8e17f606dd3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/54902e45-3467-49a4-8abc-529f2c8cfb80_105.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects changes to registry persistence keys that are not commonly used or modified by legitimate programs. This could be an indication of an adversary's attempt to persist in a stealthy manner.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Uncommon Registry Persistence Change", + "query": "registry where host.os.type == \"windows\" and\n /* uncomment once stable length(registry.data.strings) \u003e 0 and */\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Terminal Server\\\\Install\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Runonce\\\\*\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Load\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Run\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\IconServiceLib\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\AppSetup\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Taskman\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Userinit\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\VmApplet\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active Setup\\\\Installed Components\\\\*\\\\ShellComponent\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnConnect\\\\MicrosoftActiveSync\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows CE Services\\\\AutoStartOnDisconnect\\\\MicrosoftActiveSync\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n \"HKEY_USERS\\\\*\\\\Control Panel\\\\Desktop\\\\scrnsave.exe\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*\\\\VerifierDlls\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\GpExtensions\\\\*\\\\DllName\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\SafeBoot\\\\AlternateShell\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\Wds\\\\rdpwd\\\\StartupPrograms\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\InitialProgram\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\BootExecute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\SetupExecute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\Execute\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Session Manager\\\\S0InitialCommand\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\ServiceControlManagerExtension\",\n \"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\BootVerificationProgram\\\\ImagePath\",\n \"HKLM\\\\SYSTEM\\\\Setup\\\\CmdLine\",\n \"HKEY_USERS\\\\*\\\\Environment\\\\UserInitMprLogonScript\") and\n\n not registry.data.strings : (\"C:\\\\Windows\\\\system32\\\\userinit.exe\", \"cmd.exe\", \"C:\\\\Program Files (x86)\\\\*.exe\",\n \"C:\\\\Program Files\\\\*.exe\") and\n not (process.name : \"rundll32.exe\" and registry.path : \"*\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\") and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\",\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"C:\\\\Program Files\\\\*.exe\",\n \"C:\\\\Program Files (x86)\\\\*.exe\")\n", + "references": [ + "https://www.microsoftpressstore.com/articles/article.aspx?p=2762082\u0026seqNum=2" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "54902e45-3467-49a4-8abc-529f2c8cfb80", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + }, + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.002", + "name": "Screensaver", + "reference": "https://attack.mitre.org/techniques/T1546/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "54902e45-3467-49a4-8abc-529f2c8cfb80_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/54a81f68-5f2a-421e-8eed-f888278bb712_4.json b/packages/security_detection_engine/kibana/security_rule/54a81f68-5f2a-421e-8eed-f888278bb712_4.json new file mode 100644 index 00000000000..043c4241e56 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/54a81f68-5f2a-421e-8eed-f888278bb712_4.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.", + "false_positives": [ + "Legitimate exchange system administration activity." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Exchange Mailbox Export via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Exchange Mailbox Export via PowerShell\n\nThe `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.\nAttackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the export operation:\n - Identify the user account that performed the action and whether it should perform this kind of action.\n - Contact the account owner and confirm whether they are aware of this activity.\n - Check if this operation was approved and performed according to the organization's change management policy.\n - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.\n - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the \"Mailbox Import Export\" privilege for abnormal activity.\n- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.\n- If the operation was completed successfully:\n - Check if the file is on the path specified in the command.\n - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.\n- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.\n- Prioritize cases that involve personally identifiable information (PII) or other classified data.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges of users with the \"Mailbox Import Export\" privilege to ensure that the least privilege principle is being followed.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : \"New-MailboxExportRequest\" and\n not (file.path : (*Microsoft* and *Exchange* and *RemotePowerShell* or *AppData* and *Local*) and\n file.name:(*.psd1 or *.psm1))\n", + "references": [ + "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", + "https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps", + "https://www.elastic.co/security-labs/siestagraph-new-implant-uncovered-in-asean-member-foreign-ministry" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "54a81f68-5f2a-421e-8eed-f888278bb712", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1114", + "name": "Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/", + "subtechnique": [ + { + "id": "T1114.001", + "name": "Local Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/001/" + }, + { + "id": "T1114.002", + "name": "Remote Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 4 + }, + "id": "54a81f68-5f2a-421e-8eed-f888278bb712_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/54c3d186-0461-4dc3-9b33-2dc5c7473936_105.json b/packages/security_detection_engine/kibana/security_rule/54c3d186-0461-4dc3-9b33-2dc5c7473936_105.json new file mode 100644 index 00000000000..2487ff310c0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/54c3d186-0461-4dc3-9b33-2dc5c7473936_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.", + "false_positives": [ + "Authorized third party network logon providers." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Logon Provider Registry Modification", + "query": "registry where host.os.type == \"windows\" and registry.data.strings != null and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\NetworkProvider\\\\ProviderPath\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\NetworkProvider\\\\ProviderPath\"\n ) and\n /* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */\n not ( user.id : \"S-1-5-18\" and\n registry.data.strings in\n (\"%SystemRoot%\\\\System32\\\\ntlanman.dll\",\n \"%SystemRoot%\\\\System32\\\\drprov.dll\",\n \"%SystemRoot%\\\\System32\\\\davclnt.dll\")\n )\n", + "references": [ + "https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy", + "https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "54c3d186-0461-4dc3-9b33-2dc5c7473936", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1556", + "name": "Modify Authentication Process", + "reference": "https://attack.mitre.org/techniques/T1556/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "54c3d186-0461-4dc3-9b33-2dc5c7473936_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/55d551c6-333b-4665-ab7e-5d14a59715ce_106.json b/packages/security_detection_engine/kibana/security_rule/55d551c6-333b-4665-ab7e-5d14a59715ce_106.json new file mode 100644 index 00000000000..8b1125fe504 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/55d551c6-333b-4665-ab7e-5d14a59715ce_106.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the SysInternals tool PsExec.exe making a network connection. This could be an indication of lateral movement.", + "false_positives": [ + "PsExec is a dual-use tool that can be used for benign or malicious activity. It's important to baseline your environment to determine the amount of noise to expect from this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "PsExec Network Connection", + "note": "## Triage and analysis\n\n### Investigating PsExec Network Connection\n\nPsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. Microsoft develops it as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.\n\nThis rule identifies PsExec execution by looking for the creation of `PsExec.exe`, the default name for the utility, followed by a network connection done by the process.\n\n#### Possible investigation steps\n\n- Check if the usage of this tool complies with the organization's administration policy.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Identify the target computer and its role in the IT environment.\n- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n - Prioritize cases involving critical servers and users.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"PsExec.exe\" and event.type == \"start\" and\n\n /* This flag suppresses the display of the license dialog and may\n indicate that psexec executed for the first time in the machine */\n process.args : \"-accepteula\" and\n\n not process.executable : (\"?:\\\\ProgramData\\\\Docusnap\\\\Discovery\\\\discovery\\\\plugins\\\\17\\\\Bin\\\\psexec.exe\",\n \"?:\\\\Docusnap 11\\\\Bin\\\\psexec.exe\",\n \"?:\\\\Program Files\\\\Docusnap X\\\\Bin\\\\psexec.exe\",\n \"?:\\\\Program Files\\\\Docusnap X\\\\Tools\\\\dsDNS.exe\") and\n not process.parent.executable : \"?:\\\\Program Files (x86)\\\\Cynet\\\\Cynet Scanner\\\\CynetScanner.exe\"]\n [network where host.os.type == \"windows\" and process.name : \"PsExec.exe\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "55d551c6-333b-4665-ab7e-5d14a59715ce", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1569", + "name": "System Services", + "reference": "https://attack.mitre.org/techniques/T1569/", + "subtechnique": [ + { + "id": "T1569.002", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1569/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [] + } + ], + "type": "eql", + "version": 106 + }, + "id": "55d551c6-333b-4665-ab7e-5d14a59715ce_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/565c2b44-7a21-4818-955f-8d4737967d2e_104.json b/packages/security_detection_engine/kibana/security_rule/565c2b44-7a21-4818-955f-8d4737967d2e_104.json new file mode 100644 index 00000000000..1558b141dd7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/565c2b44-7a21-4818-955f-8d4737967d2e_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to add an account to the admin group via the command line. This could be an indication of privilege escalation activity.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Admin Group Account Addition", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:(dscl or dseditgroup) and process.args:((\"/Groups/admin\" or admin) and (\"-a\" or \"-append\"))\n", + "references": [ + "https://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "565c2b44-7a21-4818-955f-8d4737967d2e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "565c2b44-7a21-4818-955f-8d4737967d2e_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/565d6ca5-75ba-4c82-9b13-add25353471c_104.json b/packages/security_detection_engine/kibana/security_rule/565d6ca5-75ba-4c82-9b13-add25353471c_104.json new file mode 100644 index 00000000000..652dd047e91 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/565d6ca5-75ba-4c82-9b13-add25353471c_104.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may dump the content of the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Dumping of Keychain Content via Security Command", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.args : \"dump-keychain\" and process.args : \"-d\"\n", + "references": [ + "https://ss64.com/osx/security.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "565d6ca5-75ba-4c82-9b13-add25353471c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.001", + "name": "Keychain", + "reference": "https://attack.mitre.org/techniques/T1555/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "565d6ca5-75ba-4c82-9b13-add25353471c_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_1.json b/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_1.json new file mode 100644 index 00000000000..48b9f4f2db4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_1.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of an Unsigned Service", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n( \n (\n process.parent.executable : \"C:\\\\Windows\\\\System32\\\\services.exe\" and\n (process.code_signature.exists == false or process.code_signature.trusted == false)\n )\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "56fdfcf1-ca7c-4fd9-951d-e215ee26e404", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1569", + "name": "System Services", + "reference": "https://attack.mitre.org/techniques/T1569/", + "subtechnique": [ + { + "id": "T1569.002", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1569/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "56fdfcf1-ca7c-4fd9-951d-e215ee26e404_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_2.json b/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_2.json new file mode 100644 index 00000000000..a75fc1f2d4c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/56fdfcf1-ca7c-4fd9-951d-e215ee26e404_2.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of unsigned executables via service control manager (SCM). Adversaries may abuse SCM to execute malware or escalate privileges.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of an Unsigned Service", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n( \n (\n process.parent.executable : \"C:\\\\Windows\\\\System32\\\\services.exe\" and\n (process.code_signature.exists == false or process.code_signature.trusted == false)\n )\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "56fdfcf1-ca7c-4fd9-951d-e215ee26e404", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1569", + "name": "System Services", + "reference": "https://attack.mitre.org/techniques/T1569/", + "subtechnique": [ + { + "id": "T1569.002", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1569/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "56fdfcf1-ca7c-4fd9-951d-e215ee26e404_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5700cb81-df44-46aa-a5d7-337798f53eb8_103.json b/packages/security_detection_engine/kibana/security_rule/5700cb81-df44-46aa-a5d7-337798f53eb8_103.json new file mode 100644 index 00000000000..f1b2c0062fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5700cb81-df44-46aa-a5d7-337798f53eb8_103.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.", + "false_positives": [ + "VNC connections may be received directly to Linux cloud server instances but such connections are usually made only by engineers. VNC is less common than SSH or RDP but may be required by some work-flows such as remote access and support for specialized software products or servers. Such work-flows are usually known and not unexpected. Usage that is unfamiliar to server or network owners can be unexpected and suspicious." + ], + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "VNC (Virtual Network Computing) from the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and destination.port \u003e= 5800 and destination.port \u003c= 5810 and\n not source.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n destination.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 73, + "rule_id": "5700cb81-df44-46aa-a5d7-337798f53eb8", + "severity": "high", + "tags": [ + "Tactic: Command and Control", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Software", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "5700cb81-df44-46aa-a5d7-337798f53eb8_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/57bccf1d-daf5-4e1a-9049-ff79b5254704_1.json b/packages/security_detection_engine/kibana/security_rule/57bccf1d-daf5-4e1a-9049-ff79b5254704_1.json new file mode 100644 index 00000000000..15131f5299c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/57bccf1d-daf5-4e1a-9049-ff79b5254704_1.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies files written to the root of the Recycle Bin folder instead of subdirectories. Adversaries may place files in the root of the Recycle Bin in preparation for exfiltration or to evade defenses.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "File Staged in Root Folder of Recycle Bin", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n file.path : \"?:\\\\$RECYCLE.BIN\\\\*\" and\n not file.path : \"?:\\\\$RECYCLE.BIN\\\\*\\\\*\" and\n not file.name : \"desktop.ini\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "57bccf1d-daf5-4e1a-9049-ff79b5254704", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1074", + "name": "Data Staged", + "reference": "https://attack.mitre.org/techniques/T1074/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "57bccf1d-daf5-4e1a-9049-ff79b5254704_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/581add16-df76-42bb-af8e-c979bfb39a59_106.json b/packages/security_detection_engine/kibana/security_rule/581add16-df76-42bb-af8e-c979bfb39a59_106.json new file mode 100644 index 00000000000..72ab99aad09 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/581add16-df76-42bb-af8e-c979bfb39a59_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the wbadmin.exe to delete the backup catalog. Ransomware and other malware may do this to prevent system recovery.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Deleting Backup Catalogs with Wbadmin", + "note": "## Triage and analysis\n\n### Investigating Deleting Backup Catalogs with Wbadmin\n\nWindows Server Backup stores the details about your backups (what volumes are backed up and where the backups are located) in a file called a backup catalog, which ransomware victims can use to recover corrupted backup files. Deleting these files is a common step in threat actor playbooks.\n\nThis rule identifies the deletion of the backup catalog using the `wbadmin.exe` utility.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Check if any files on the host machine have been encrypted.\n\n### False positive analysis\n\n- Administrators can use this command to delete corrupted catalogs, but overall the activity is unlikely to be legitimate.\n\n### Related rules\n\n- Third-party Backup Files Deleted via Unexpected Process - 11ea6bec-ebde-4d71-a8e9-784948f8e3e9\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n- Volume Shadow Copy Deletion via WMIC - dc9c1f74-dac3-48e3-b47f-eb79db358f57\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.\n- If any backups were affected:\n - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"wbadmin.exe\" or process.pe.original_file_name == \"WBADMIN.EXE\") and\n process.args : \"catalog\" and process.args : \"delete\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "581add16-df76-42bb-af8e-c979bfb39a59", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "581add16-df76-42bb-af8e-c979bfb39a59_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_106.json b/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_106.json new file mode 100644 index 00000000000..3d49bb7930d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_106.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "RDP Enabled via Registry", + "note": "## Triage and analysis\n\n### Investigating RDP Enabled via Registry\n\nMicrosoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.\n\nAttackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.\n\nThis rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the user to check if they are aware of the operation.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check whether it makes sense to enable RDP to this host, given its role in the environment.\n- Check if the host is directly exposed to the internet.\n- Check whether privileged accounts accessed the host shortly after the modification.\n- Review network events within a short timespan of this alert for incoming RDP connection attempts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If RDP is needed, make sure to secure it using firewall rules:\n - Allowlist RDP traffic to specific trusted hosts.\n - Restrict RDP logins to authorized non-administrator accounts, where possible.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and \n event.type in (\"creation\", \"change\") and\n registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Terminal Server\\\\fDenyTSConnections\" and\n registry.data.strings : (\"0\", \"0x00000000\") and\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\SystemPropertiesRemote.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemPropertiesComputerName.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemPropertiesAdvanced.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemSettingsAdminFlows.exe\", \n \"?:\\\\Windows\\\\WinSxS\\\\*\\\\TiWorker.exe\", \n \"?:\\\\Windows\\\\system32\\\\svchost.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "58aa72ca-d968-4f34-b9f7-bea51d75eb50", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.001", + "name": "Remote Desktop Protocol", + "reference": "https://attack.mitre.org/techniques/T1021/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "58aa72ca-d968-4f34-b9f7-bea51d75eb50_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_107.json b/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_107.json new file mode 100644 index 00000000000..88df15e71c3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/58aa72ca-d968-4f34-b9f7-bea51d75eb50_107.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies registry write modifications to enable Remote Desktop Protocol (RDP) access. This could be indicative of adversary lateral movement preparation.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "RDP Enabled via Registry", + "note": "## Triage and analysis\n\n### Investigating RDP Enabled via Registry\n\nMicrosoft Remote Desktop Protocol (RDP) is a proprietary Microsoft protocol that enables remote connections to other computers, typically over TCP port 3389.\n\nAttackers can use RDP to conduct their actions interactively. Ransomware operators frequently use RDP to access victim servers, often using privileged accounts.\n\nThis rule detects modification of the fDenyTSConnections registry key to the value `0`, which specifies that remote desktop connections are enabled. Attackers can abuse remote registry, use psexec, etc., to enable RDP and move laterally.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the user to check if they are aware of the operation.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check whether it makes sense to enable RDP to this host, given its role in the environment.\n- Check if the host is directly exposed to the internet.\n- Check whether privileged accounts accessed the host shortly after the modification.\n- Review network events within a short timespan of this alert for incoming RDP connection attempts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Check whether the user should be performing this kind of activity, whether they are aware of it, whether RDP should be open, and whether the action exposes the environment to unnecessary risks.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If RDP is needed, make sure to secure it using firewall rules:\n - Allowlist RDP traffic to specific trusted hosts.\n - Restrict RDP logins to authorized non-administrator accounts, where possible.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and \n event.type in (\"creation\", \"change\") and\n registry.path : \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Terminal Server\\\\fDenyTSConnections\" and\n registry.data.strings : (\"0\", \"0x00000000\") and\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\SystemPropertiesRemote.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemPropertiesComputerName.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemPropertiesAdvanced.exe\", \n \"?:\\\\Windows\\\\System32\\\\SystemSettingsAdminFlows.exe\", \n \"?:\\\\Windows\\\\WinSxS\\\\*\\\\TiWorker.exe\", \n \"?:\\\\Windows\\\\system32\\\\svchost.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "58aa72ca-d968-4f34-b9f7-bea51d75eb50", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.001", + "name": "Remote Desktop Protocol", + "reference": "https://attack.mitre.org/techniques/T1021/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "58aa72ca-d968-4f34-b9f7-bea51d75eb50_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/58bc134c-e8d2-4291-a552-b4b3e537c60b_106.json b/packages/security_detection_engine/kibana/security_rule/58bc134c-e8d2-4291-a552-b4b3e537c60b_106.json new file mode 100644 index 00000000000..062ceaffb44 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/58bc134c-e8d2-4291-a552-b4b3e537c60b_106.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or change of a Windows executable file over network shares. Adversaries may transfer tools or other files between systems in a compromised environment.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Lateral Tool Transfer via SMB Share", + "note": "## Triage and analysis\n\n### Investigating Potential Lateral Tool Transfer via SMB Share\n\nAdversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc. Attackers can also leverage file shares that employees frequently access to host malicious files to gain a foothold in other machines.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve the created file and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Review the privileges needed to write to the network share and restrict write access as needed.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id with maxspan=30s\n [network where host.os.type == \"windows\" and event.type == \"start\" and process.pid == 4 and destination.port == 445 and\n network.direction : (\"incoming\", \"ingress\") and\n network.transport == \"tcp\" and source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ] by process.entity_id\n /* add more executable extensions here if they are not noisy in your environment */\n [file where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and process.pid == 4 and file.extension : (\"exe\", \"dll\", \"bat\", \"cmd\")] by process.entity_id\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "58bc134c-e8d2-4291-a552-b4b3e537c60b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + }, + { + "id": "T1570", + "name": "Lateral Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1570/" + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "58bc134c-e8d2-4291-a552-b4b3e537c60b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/58c6d58b-a0d3-412d-b3b8-0981a9400607_107.json b/packages/security_detection_engine/kibana/security_rule/58c6d58b-a0d3-412d-b3b8-0981a9400607_107.json new file mode 100644 index 00000000000..8dd9e458420 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/58c6d58b-a0d3-412d-b3b8-0981a9400607_107.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a potential exploitation of InstallerTakeOver (CVE-2021-41379) default PoC execution. Successful exploitation allows an unprivileged user to escalate privileges to SYSTEM.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via InstallerFileTakeOver", + "note": "## Triage and analysis\n\n### Investigating Potential Privilege Escalation via InstallerFileTakeOver\n\nInstallerFileTakeOver is a weaponized escalation of privilege proof of concept (EoP PoC) to the CVE-2021-41379 vulnerability. Upon successful exploitation, an unprivileged user will escalate privileges to SYSTEM/NT AUTHORITY.\n\nThis rule detects the default execution of the PoC, which overwrites the `elevation_service.exe` DACL and copies itself to the location to escalate privileges. An attacker is able to still take over any file that is not in use (locked), which is outside the scope of this rule.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Look for additional processes spawned by the process, command lines, and network communications.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- Verify whether a digital signature exists in the executable, and if it is valid.\n\n### Related rules\n\n- Suspicious DLL Loaded for Persistence or Privilege Escalation - bfeaf89b-a2a7-48a3-817f-e41829dc61ee\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "/* This rule is compatible with both Sysmon and Elastic Endpoint */\n\nprocess where host.os.type == \"windows\" and event.type == \"start\" and\n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n (\n (process.name : \"elevation_service.exe\" and\n not process.pe.original_file_name == \"elevation_service.exe\") or\n\n (process.parent.name : \"elevation_service.exe\" and\n process.name : (\"rundll32.exe\", \"cmd.exe\", \"powershell.exe\"))\n )\n", + "references": [ + "https://github.com/klinix5/InstallerFileTakeOver" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.IntegrityLevel", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "58c6d58b-a0d3-412d-b3b8-0981a9400607", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "58c6d58b-a0d3-412d-b3b8-0981a9400607_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_1.json b/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_1.json new file mode 100644 index 00000000000..29d9e21bf74 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_1.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to delete files and directories. Adversaries may delete files and directories on a host system, such as logs, browser history, or malware.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "File or Directory Deletion Command", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and \n(\n (process.name: \"rundll32.exe\" and process.args: \"*InetCpl.cpl,Clear*\") or \n (process.name: \"reg.exe\" and process.args:\"delete\") or \n (\n process.name: \"cmd.exe\" and process.args: (\"*rmdir*\", \"*rm *\", \"rm\") and\n not process.args : (\"*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\", \"*\\\\AppData\\\\Local\\\\Temp\\\\DockerDesktop\\\\*\")\n ) or\n (process.name: \"powershell.exe\" and process.args: (\"*rmdir\", \"rm\", \"rd\", \"*Remove-Item*\", \"del\", \"*]::Delete(*\"))\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5919988c-29e1-4908-83aa-1f087a838f63", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5919988c-29e1-4908-83aa-1f087a838f63_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_2.json b/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_2.json new file mode 100644 index 00000000000..301c6e85a5c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5919988c-29e1-4908-83aa-1f087a838f63_2.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to delete files and directories. Adversaries may delete files and directories on a host system, such as logs, browser history, or malware.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "File or Directory Deletion Command", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and \n(\n (process.name: \"rundll32.exe\" and process.args: \"*InetCpl.cpl,Clear*\") or \n (process.name: \"reg.exe\" and process.args:\"delete\") or \n (\n process.name: \"cmd.exe\" and process.args: (\"*rmdir*\", \"*rm *\", \"rm\") and\n not process.args : (\n \"*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\",\n \"*\\\\AppData\\\\Local\\\\Temp\\\\DockerDesktop\\\\*\",\n \"*\\\\AppData\\\\Local\\\\Temp\\\\Report.*\",\n \"*\\\\AppData\\\\Local\\\\Temp\\\\*.PackageExtraction\"\n )\n ) or\n (process.name: \"powershell.exe\" and process.args: (\"*rmdir\", \"rm\", \"rd\", \"*Remove-Item*\", \"del\", \"*]::Delete(*\"))\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5919988c-29e1-4908-83aa-1f087a838f63", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "5919988c-29e1-4908-83aa-1f087a838f63_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/59756272-1998-4b8c-be14-e287035c4d10_104.json b/packages/security_detection_engine/kibana/security_rule/59756272-1998-4b8c-be14-e287035c4d10_104.json new file mode 100644 index 00000000000..21a7ba64e07 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/59756272-1998-4b8c-be14-e287035c4d10_104.json @@ -0,0 +1,61 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "Looks for commands related to system user or owner discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system owner or user discovery in order to identify currently active or primary users of a system. This may be a precursor to additional discovery, credential dumping or privilege elevation activity.", + "false_positives": [ + "Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_system_user_discovery" + ], + "name": "Unusual Linux User Discovery Activity", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "59756272-1998-4b8c-be14-e287035c4d10", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "59756272-1998-4b8c-be14-e287035c4d10_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5a14d01d-7ac8-4545-914c-b687c2cf66b3_105.json b/packages/security_detection_engine/kibana/security_rule/5a14d01d-7ac8-4545-914c-b687c2cf66b3_105.json new file mode 100644 index 00000000000..67e2353494f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5a14d01d-7ac8-4545-914c-b687c2cf66b3_105.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to bypass User Account Control (UAC) via DLL side-loading. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass Attempt via Privileged IFileOperation COM Interface", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type : \"change\" and process.name : \"dllhost.exe\" and\n /* Known modules names side loaded into process running with high or system integrity level for UAC Bypass, update here for new modules */\n file.name : (\"wow64log.dll\", \"comctl32.dll\", \"DismCore.dll\", \"OskSupport.dll\", \"duser.dll\", \"Accessibility.ni.dll\") and\n /* has no impact on rule logic just to avoid OS install related FPs */\n not file.path : (\"C:\\\\Windows\\\\SoftwareDistribution\\\\*\", \"C:\\\\Windows\\\\WinSxS\\\\*\")\n", + "references": [ + "https://github.com/hfiref0x/UACME", + "https://www.elastic.co/security-labs/exploring-windows-uac-bypasses-techniques-and-detection-strategies" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "5a14d01d-7ac8-4545-914c-b687c2cf66b3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "5a14d01d-7ac8-4545-914c-b687c2cf66b3_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_1.json b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_1.json new file mode 100644 index 00000000000..39a35e87d2e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_1.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Java", + "query": "sequence by host.id with maxspan=5s\n[ network where host.os.type == \"linux\" and event.action in (\"connection_accepted\", \"connection_attempted\") and \n process.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and \n process.parent.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") and\n process.parent.args : \"-jar\" and process.executable : \"*sh\" ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5a3d5447-31c9-409a-aed1-72f9921594fd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "5a3d5447-31c9-409a-aed1-72f9921594fd_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_2.json b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_2.json new file mode 100644 index 00000000000..39ba4e90335 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_2.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Java", + "query": "sequence by host.id with maxspan=5s\n[ network where host.os.type == \"linux\" and event.action in (\"connection_accepted\", \"connection_attempted\") and \n process.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and \n process.parent.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") and\n process.parent.args : \"-jar\" and process.executable : \"*sh\" ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5a3d5447-31c9-409a-aed1-72f9921594fd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "5a3d5447-31c9-409a-aed1-72f9921594fd_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_3.json b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_3.json new file mode 100644 index 00000000000..a46d0bb7b03 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5a3d5447-31c9-409a-aed1-72f9921594fd_3.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies the execution of a Linux shell process from a Java JAR application post an incoming network connection. This behavior may indicate reverse shell activity via a Java application.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Java", + "query": "sequence by host.id with maxspan=5s\n[ network where host.os.type == \"linux\" and event.action in (\"connection_accepted\", \"connection_attempted\") and \n process.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ] by process.entity_id\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and \n process.parent.executable : (\"/usr/bin/java\", \"/bin/java\", \"/usr/lib/jvm/*\", \"/usr/java/*\") and\n process.parent.args : \"-jar\" and process.executable : \"*sh\" ] by process.parent.entity_id\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5a3d5447-31c9-409a-aed1-72f9921594fd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "5a3d5447-31c9-409a-aed1-72f9921594fd_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc_104.json b/packages/security_detection_engine/kibana/security_rule/5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc_104.json new file mode 100644 index 00000000000..91498043907 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc_104.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects use of the systemsetup command to enable remote SSH Login.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Remote SSH Login Enabled via systemsetup Command", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:systemsetup and\n process.args:(\"-setremotelogin\" and on) and\n not process.parent.executable : /usr/local/jamf/bin/jamf\n", + "references": [ + "https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf", + "https://ss64.com/osx/systemsetup.html", + "https://support.apple.com/guide/remote-desktop/about-systemsetup-apd95406b8d/mac" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.004", + "name": "SSH", + "reference": "https://attack.mitre.org/techniques/T1021/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "5ae4e6f8-d1bf-40fa-96ba-e29645e1e4dc_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_105.json b/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_105.json new file mode 100644 index 00000000000..39bb1b8278b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_105.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Secure File Deletion via SDelete Utility", + "note": "## Triage and analysis\n\n### Investigating Potential Secure File Deletion via SDelete Utility\n\nSDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.\n\nThis rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.\n\n### False positive analysis\n\n- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n - Prioritize cases involving critical servers and users.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If important data was encrypted, deleted, or modified, activate your data recovery plan.\n - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "file where host.os.type == \"windows\" and event.type == \"change\" and file.name : \"*AAA.AAA\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5aee924b-6ceb-4633-980e-1bde8cdb40c5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "5aee924b-6ceb-4633-980e-1bde8cdb40c5_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_106.json b/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_106.json new file mode 100644 index 00000000000..90d027e9790 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5aee924b-6ceb-4633-980e-1bde8cdb40c5_106.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects file name patterns generated by the use of Sysinternals SDelete utility to securely delete a file via multiple file overwrite and rename operations.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Secure File Deletion via SDelete Utility", + "note": "## Triage and analysis\n\n### Investigating Potential Secure File Deletion via SDelete Utility\n\nSDelete is a tool primarily used for securely deleting data from storage devices, making it unrecoverable. Microsoft develops it as part of the Sysinternals Suite. Although commonly used to delete data securely, attackers can abuse it to delete forensic indicators and remove files as a post-action to a destructive action such as ransomware or data theft to hinder recovery efforts.\n\nThis rule identifies file name patterns generated by the use of SDelete utility to securely delete a file via multiple file overwrite and rename operations.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Examine the command line and identify the files deleted, their importance and whether they could be the target of antiforensics activity.\n\n### False positive analysis\n\n- This is a dual-use tool, meaning its usage is not inherently malicious. Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n - Prioritize cases involving critical servers and users.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If important data was encrypted, deleted, or modified, activate your data recovery plan.\n - Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "file where host.os.type == \"windows\" and event.type == \"change\" and file.name : \"*AAA.AAA\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5aee924b-6ceb-4633-980e-1bde8cdb40c5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "5aee924b-6ceb-4633-980e-1bde8cdb40c5_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5b03c9fb-9945-4d2f-9568-fd690fee3fba_105.json b/packages/security_detection_engine/kibana/security_rule/5b03c9fb-9945-4d2f-9568-fd690fee3fba_105.json new file mode 100644 index 00000000000..8a162ef9404 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5b03c9fb-9945-4d2f-9568-fd690fee3fba_105.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware.", + "false_positives": [ + "Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or process arguments to eliminate potential noise." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Virtual Machine Fingerprinting", + "query": "event.category:process and host.os.type:linux and event.type:(start or process_started) and\n process.args:(\"/sys/class/dmi/id/bios_version\" or\n \"/sys/class/dmi/id/product_name\" or\n \"/sys/class/dmi/id/chassis_vendor\" or\n \"/proc/scsi/scsi\" or\n \"/proc/ide/hd0/model\") and\n not user.name:root\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "5b03c9fb-9945-4d2f-9568-fd690fee3fba", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "5b03c9fb-9945-4d2f-9568-fd690fee3fba_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_1.json b/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_1.json new file mode 100644 index 00000000000..5e3be062e3a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_1.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the \"find\" command in conjunction with SUID and SGUID permission arguments. SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow a program to execute with the privileges of the file owner or group, respectively, rather than the privileges of the user running the program. In case an attacker is able to enumerate and find a binary that is misconfigured, they might be able to leverage this misconfiguration to escalate privileges by exploiting vulnerabilities or built-in features in the privileged program.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "SUID/SGUID Enumeration Detected", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \nprocess.name == \"find\" and process.args : \"-perm\" and process.args : (\n \"/6000\", \"-6000\", \"/4000\", \"-4000\", \"/2000\", \"-2000\", \"/u=s\", \"-u=s\", \"/g=s\", \"-g=s\", \"/u=s,g=s\", \"/g=s,u=s\"\n) and \nnot user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "5b06a27f-ad72-4499-91db-0c69667bffa5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1083", + "name": "File and Directory Discovery", + "reference": "https://attack.mitre.org/techniques/T1083/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.001", + "name": "Setuid and Setgid", + "reference": "https://attack.mitre.org/techniques/T1548/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5b06a27f-ad72-4499-91db-0c69667bffa5_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_2.json b/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_2.json new file mode 100644 index 00000000000..2d426c769db --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5b06a27f-ad72-4499-91db-0c69667bffa5_2.json @@ -0,0 +1,123 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of the \"find\" command in conjunction with SUID and SGUID permission arguments. SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow a program to execute with the privileges of the file owner or group, respectively, rather than the privileges of the user running the program. In case an attacker is able to enumerate and find a binary that is misconfigured, they might be able to leverage this misconfiguration to escalate privileges by exploiting vulnerabilities or built-in features in the privileged program.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "SUID/SGUID Enumeration Detected", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \nprocess.name == \"find\" and process.args : \"-perm\" and process.args : (\n \"/6000\", \"-6000\", \"/4000\", \"-4000\", \"/2000\", \"-2000\", \"/u=s\", \"-u=s\", \"/g=s\", \"-g=s\", \"/u=s,g=s\", \"/g=s,u=s\"\n) and \nnot user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "5b06a27f-ad72-4499-91db-0c69667bffa5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1083", + "name": "File and Directory Discovery", + "reference": "https://attack.mitre.org/techniques/T1083/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.001", + "name": "Setuid and Setgid", + "reference": "https://attack.mitre.org/techniques/T1548/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "5b06a27f-ad72-4499-91db-0c69667bffa5_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5b18eef4-842c-4b47-970f-f08d24004bde_1.json b/packages/security_detection_engine/kibana/security_rule/5b18eef4-842c-4b47-970f-f08d24004bde_1.json new file mode 100644 index 00000000000..39418412b3a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5b18eef4-842c-4b47-970f-f08d24004bde_1.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the usage of the which command with an unusual amount of process arguments. Attackers may leverage the which command to enumerate the system for useful installed utilities that may be used after compromising a system to escalate privileges or move latteraly across the network.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious which Enumeration", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"which\" and process.args_count \u003e= 10\n\n/* potential tuning if rule would turn out to be noisy\nand process.args in (\"nmap\", \"nc\", \"ncat\", \"netcat\", nc.traditional\", \"gcc\", \"g++\", \"socat\") and \nprocess.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")\n*/ \n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5b18eef4-842c-4b47-970f-f08d24004bde", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5b18eef4-842c-4b47-970f-f08d24004bde_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5b9eb30f-87d6-45f4-9289-2bf2024f0376_1.json b/packages/security_detection_engine/kibana/security_rule/5b9eb30f-87d6-45f4-9289-2bf2024f0376_1.json new file mode 100644 index 00000000000..a5e1dd5e661 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5b9eb30f-87d6-45f4-9289-2bf2024f0376_1.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of browser processes, such as unsigned or signed with unusual certificates, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as Browser Process", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n /* Chrome Related Processes */\n (process.name : (\n \"chrome.exe\", \"GoogleUpdate.exe\", \"GoogleCrashHandler64.exe\", \"GoogleCrashHandler.exe\",\n \"GoogleUpdateComRegisterShell64.exe\", \"GoogleUpdateSetup.exe\", \"GoogleUpdateOnDemand.exe\",\n \"chrome_proxy.exe\", \"remote_assistance_host.exe\", \"remoting_native_messaging_host.exe\",\n \"GoogleUpdateBroker.exe\"\n ) and not\n (process.code_signature.subject_name : (\"Google LLC\", \"Google Inc\") and process.code_signature.trusted == true)\n and not\n (\n process.executable : \"?:\\\\Program Files\\\\HP\\\\Sure Click\\\\servers\\\\chrome.exe\" and\n process.code_signature.subject_name : (\"Bromium, Inc.\") and process.code_signature.trusted == true\n )\n and not process.hash.sha256 : \"6538d54a236349f880d6793d219f558764629efc85d4d08b56b94717c01fb25a\"\n ) or\n\n /* MS Edge Related Processes */\n (process.name : (\n \"msedge.exe\", \"MicrosoftEdgeUpdate.exe\", \"identity_helper.exe\", \"msedgewebview2.exe\",\n \"MicrosoftEdgeWebview2Setup.exe\", \"MicrosoftEdge_X*.exe\", \"msedge_proxy.exe\",\n \"MicrosoftEdgeUpdateCore.exe\", \"MicrosoftEdgeUpdateBroker.exe\", \"MicrosoftEdgeUpdateSetup_X*.exe\",\n \"MicrosoftEdgeUpdateComRegisterShell64.exe\", \"msedgerecovery.exe\", \"MicrosoftEdgeUpdateSetup.exe\"\n ) and not\n (process.code_signature.subject_name : \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Brave Related Processes */\n (process.name : (\n \"brave.exe\", \"BraveUpdate.exe\", \"BraveCrashHandler64.exe\", \"BraveCrashHandler.exe\",\n \"BraveUpdateOnDemand.exe\", \"brave_vpn_helper.exe\", \"BraveUpdateSetup*.exe\",\n \"BraveUpdateComRegisterShell64.exe\"\n ) and not\n (process.code_signature.subject_name : \"Brave Software, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Firefox Related Processes */\n (process.name : (\n \"firefox.exe\", \"pingsender.exe\", \"default-browser-agent.exe\", \"maintenanceservice.exe\",\n \"plugin-container.exe\", \"maintenanceservice_tmp.exe\", \"maintenanceservice_installer.exe\",\n \"minidump-analyzer.exe\", \"crashreporter.exe\"\n ) and not\n (process.code_signature.subject_name : \"Mozilla Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Island Related Processes */\n (process.name : (\n \"Island.exe\", \"IslandUpdate.exe\", \"IslandCrashHandler.exe\", \"IslandCrashHandler64.exe\",\n \"IslandUpdateBroker.exe\", \"IslandUpdateOnDemand.exe\", \"IslandUpdateComRegisterShell64.exe\",\n \"IslandUpdateSetup.exe\"\n ) and not\n (process.code_signature.subject_name : \"Island Technology Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Opera Related Processes */\n (process.name : (\n \"opera.exe\", \"opera_*.exe\", \"browser_assistant.exe\"\n ) and not\n (process.code_signature.subject_name : \"Opera Norway AS\" and process.code_signature.trusted == true)\n ) or\n\n /* Whale Related Processes */\n (process.name : (\n \"whale.exe\", \"whale_update.exe\", \"wusvc.exe\"\n ) and not\n (process.code_signature.subject_name : \"NAVER Corp.\" and process.code_signature.trusted == true)\n ) or\n\n /* Chromium-based Browsers processes */\n (process.name : (\n \"chrmstp.exe\", \"notification_helper.exe\", \"elevation_service.exe\"\n ) and not\n (process.code_signature.subject_name : (\n \"Island Technology Inc.\",\n \"Citrix Systems, Inc.\",\n \"Brave Software, Inc.\",\n \"Google LLC\",\n \"Google Inc\",\n \"Microsoft Corporation\",\n \"NAVER Corp.\"\n ) and process.code_signature.trusted == true\n )\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "5b9eb30f-87d6-45f4-9289-2bf2024f0376", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5b9eb30f-87d6-45f4-9289-2bf2024f0376_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5bb4a95d-5a08-48eb-80db-4c3a63ec78a8_104.json b/packages/security_detection_engine/kibana/security_rule/5bb4a95d-5a08-48eb-80db-4c3a63ec78a8_104.json new file mode 100644 index 00000000000..f16c70f32d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5bb4a95d-5a08-48eb-80db-4c3a63ec78a8_104.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted system is patched.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious PrintSpooler Service Executable File Creation", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n process.name : \"spoolsv.exe\" and file.extension : \"dll\" and\n file.path : (\"?:\\\\Windows\\\\System32\\\\*\", \"?:\\\\Windows\\\\SysWOW64\\\\*\") and\n not file.path :\n (\"?:\\\\WINDOWS\\\\SysWOW64\\\\PrintConfig.dll\",\n \"?:\\\\WINDOWS\\\\system32\\\\x5lrs.dll\",\n \"?:\\\\WINDOWS\\\\sysWOW64\\\\x5lrs.dll\",\n \"?:\\\\WINDOWS\\\\system32\\\\PrintConfig.dll\")\n", + "references": [ + "https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/", + "https://www.thezdi.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "5bb4a95d-5a08-48eb-80db-4c3a63ec78a8", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "5bb4a95d-5a08-48eb-80db-4c3a63ec78a8_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_5.json b/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_5.json new file mode 100644 index 00000000000..6df80c141c9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_5.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.", + "from": "now-9m", + "history_window_start": "now-15d", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "FirstTime Seen Account Performing DCSync", + "new_terms_fields": [ + "winlog.event_data.SubjectUserName" + ], + "note": "## Triage and analysis\n\n### Investigating FirstTime Seen Account Performing DCSync\n\nActive Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.\n\nActive Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys that are used legitimately for creating tickets, but also for forging tickets by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).\n\nThis rule monitors for when a Windows Event ID 4662 (Operation was performed on an Active Directory object) with the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) is seen in the environment for the first time in the last 15 days.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).\n\n### False positive analysis\n\n- Administrators may use custom accounts on Azure AD Connect; investigate if this is part of a new Azure AD account setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.\n- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. Investigate if this is part of a new product setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the entire domain or the `krbtgt` user was compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.\n- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.action:\"Directory Service Access\" and event.code:\"4662\" and\n winlog.event_data.Properties:(*DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or\n *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or\n *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*) and\n not winlog.event_data.SubjectUserName:(*$ or MSOL_*)\n", + "references": [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.Properties", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserName", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "5c6f4c58-b381-452a-8976-f1b1c6aa0def", + "setup": "The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nAudit Policies \u003e\nDS Access \u003e\nAudit Directory Service Changes (Success,Failure)\n```", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Use Case: Active Directory Monitoring", + "Data Source: Active Directory", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.006", + "name": "DCSync", + "reference": "https://attack.mitre.org/techniques/T1003/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 5 + }, + "id": "5c6f4c58-b381-452a-8976-f1b1c6aa0def_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_6.json b/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_6.json new file mode 100644 index 00000000000..bf422e750ca --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5c6f4c58-b381-452a-8976-f1b1c6aa0def_6.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies when a User Account starts the Active Directory Replication Process for the first time. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.", + "from": "now-9m", + "history_window_start": "now-15d", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "FirstTime Seen Account Performing DCSync", + "new_terms_fields": [ + "winlog.event_data.SubjectUserName" + ], + "note": "## Triage and analysis\n\n### Investigating FirstTime Seen Account Performing DCSync\n\nActive Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.\n\nActive Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys that are used legitimately for creating tickets, but also for forging tickets by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).\n\nThis rule monitors for when a Windows Event ID 4662 (Operation was performed on an Active Directory object) with the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) is seen in the environment for the first time in the last 15 days.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).\n\n### False positive analysis\n\n- Administrators may use custom accounts on Azure AD Connect; investigate if this is part of a new Azure AD account setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.\n- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. Investigate if this is part of a new product setup, and ensure it is properly secured. If the activity was expected and there is no other suspicious activity involving the host or user, the analyst can dismiss the alert.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the entire domain or the `krbtgt` user was compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.\n- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.action:\"Directory Service Access\" and event.code:\"4662\" and\n winlog.event_data.Properties:(*DS-Replication-Get-Changes* or *DS-Replication-Get-Changes-All* or\n *DS-Replication-Get-Changes-In-Filtered-Set* or *1131f6ad-9c07-11d1-f79f-00c04fc2dcd2* or\n *1131f6aa-9c07-11d1-f79f-00c04fc2dcd2* or *89e95b76-444d-4c62-991a-0facbeda640c*) and\n not winlog.event_data.SubjectUserName:(*$ or MSOL_*)\n", + "references": [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.Properties", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserName", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "5c6f4c58-b381-452a-8976-f1b1c6aa0def", + "setup": "The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nAudit Policies \u003e\nDS Access \u003e\nAudit Directory Service Access (Success,Failure)\n```", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Use Case: Active Directory Monitoring", + "Data Source: Active Directory", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.006", + "name": "DCSync", + "reference": "https://attack.mitre.org/techniques/T1003/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 6 + }, + "id": "5c6f4c58-b381-452a-8976-f1b1c6aa0def_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5c895b4f-9133-4e68-9e23-59902175355c_1.json b/packages/security_detection_engine/kibana/security_rule/5c895b4f-9133-4e68-9e23-59902175355c_1.json new file mode 100644 index 00000000000..fab4516a05e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5c895b4f-9133-4e68-9e23-59902175355c_1.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies a sample of suspicious Linux system file reads used for system fingerprinting, leveraged by the Metasploit Meterpreter shell to gather information about the target that it is executing its shell on. Detecting this pattern is indicative of a successful meterpreter shell connection.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Meterpreter Reverse Shell", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /proc/net/ -p r -k audit_proc\n-w /etc/machine-id -p wa -k machineid\n-w /etc/passwd -p wa -k passwd\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "sample by host.id, process.pid, user.id\n[file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and auditd.data.syscall == \"open\" and \n auditd.data.a2 == \"1b6\" and file.path == \"/etc/machine-id\"]\n[file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and auditd.data.syscall == \"open\" and\n auditd.data.a2 == \"1b6\" and file.path == \"/etc/passwd\"]\n[file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and auditd.data.syscall == \"open\" and \n auditd.data.a2 == \"1b6\" and file.path == \"/proc/net/route\"]\n[file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and auditd.data.syscall == \"open\" and\n auditd.data.a2 == \"1b6\" and file.path == \"/proc/net/ipv6_route\"]\n[file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and auditd.data.syscall == \"open\" and\n auditd.data.a2 == \"1b6\" and file.path == \"/proc/net/if_inet6\"]\n", + "related_integrations": [ + { + "integration": "auditd", + "package": "auditd_manager", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "auditd.data.a2", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.syscall", + "type": "unknown" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5c895b4f-9133-4e68-9e23-59902175355c", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /proc/net/ -p r -k audit_proc\n-w /etc/machine-id -p wa -k machineid\n-w /etc/passwd -p wa -k passwd\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "5c895b4f-9133-4e68-9e23-59902175355c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5c983105-4681-46c3-9890-0c66d05e776b_103.json b/packages/security_detection_engine/kibana/security_rule/5c983105-4681-46c3-9890-0c66d05e776b_103.json new file mode 100644 index 00000000000..84d3d02614f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5c983105-4681-46c3-9890-0c66d05e776b_103.json @@ -0,0 +1,61 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Looks for commands related to system process discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system process discovery in order to increase their understanding of software applications running on a target host or network. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation.", + "false_positives": [ + "Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_system_process_discovery" + ], + "name": "Unusual Linux Process Discovery Activity", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "5c983105-4681-46c3-9890-0c66d05e776b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "5c983105-4681-46c3-9890-0c66d05e776b_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5c9ec990-37fa-4d5c-abfc-8d432f3dedd0_3.json b/packages/security_detection_engine/kibana/security_rule/5c9ec990-37fa-4d5c-abfc-8d432f3dedd0_3.json new file mode 100644 index 00000000000..54ffdf38382 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5c9ec990-37fa-4d5c-abfc-8d432f3dedd0_3.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the PRoot utility, an open-source tool for user-space implementation of chroot, mount --bind, and binfmt_misc. Adversaries can leverage an open-source tool PRoot to expand the scope of their operations to multiple Linux distributions and simplify their necessary efforts. In a normal threat scenario, the scope of an attack is limited by the varying configurations of each Linux distribution. With PRoot, it provides an attacker with a consistent operational environment across different Linux distributions, such as Ubuntu, Fedora, and Alpine. PRoot also provides emulation capabilities that allow for malware built on other architectures, such as ARM, to be run.The post-exploitation technique called bring your own filesystem (BYOF), can be used by the threat actors to execute malicious payload or elevate privileges or perform network scans or orchestrate another attack on the environment. Although PRoot was originally not developed with malicious intent it can be easily tuned to work for one.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Defense Evasion via PRoot", + "query": "process where event.action == \"exec\" and process.parent.name ==\"proot\" and host.os.type == \"linux\"\n", + "references": [ + "https://proot-me.github.io/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1211", + "name": "Exploitation for Defense Evasion", + "reference": "https://attack.mitre.org/techniques/T1211/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "5c9ec990-37fa-4d5c-abfc-8d432f3dedd0_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5cd55388-a19c-47c7-8ec4-f41656c2fded_104.json b/packages/security_detection_engine/kibana/security_rule/5cd55388-a19c-47c7-8ec4-f41656c2fded_104.json new file mode 100644 index 00000000000..d5ecc9ca498 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5cd55388-a19c-47c7-8ec4-f41656c2fded_104.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the PowerShell process loading the Task Scheduler COM DLL followed by an outbound RPC network connection within a short time period. This may indicate lateral movement or remote discovery via scheduled tasks.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Outbound Scheduled Task Activity via PowerShell", + "query": "sequence by host.id, process.entity_id with maxspan = 5s\n [any where host.os.type == \"windows\" and (event.category == \"library\" or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : \"taskschd.dll\" or file.name : \"taskschd.dll\") and process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\")]\n [network where host.os.type == \"windows\" and process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and destination.port == 135 and not destination.address in (\"127.0.0.1\", \"::1\")]\n", + "references": [ + "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.address", + "type": "keyword" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5cd55388-a19c-47c7-8ec4-f41656c2fded", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "5cd55388-a19c-47c7-8ec4-f41656c2fded_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5cf6397e-eb91-4f31-8951-9f0eaa755a31_5.json b/packages/security_detection_engine/kibana/security_rule/5cf6397e-eb91-4f31-8951-9f0eaa755a31_5.json new file mode 100644 index 00000000000..048b2aae931 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5cf6397e-eb91-4f31-8951-9f0eaa755a31_5.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a PowerShell profile. PowerShell profile is a script that is executed when PowerShell starts to customize the user environment, which can be abused by attackers to persist in a environment where PowerShell is common.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via PowerShell profile", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.path : (\"?:\\\\Users\\\\*\\\\Documents\\\\WindowsPowerShell\\\\*\",\n \"?:\\\\Users\\\\*\\\\Documents\\\\PowerShell\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\*\") and\n file.name : (\"profile.ps1\", \"Microsoft.Powershell_profile.ps1\")\n", + "references": [ + "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles", + "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5cf6397e-eb91-4f31-8951-9f0eaa755a31", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.013", + "name": "PowerShell Profile", + "reference": "https://attack.mitre.org/techniques/T1546/013/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "5cf6397e-eb91-4f31-8951-9f0eaa755a31_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5d0265bf-dea9-41a9-92ad-48a8dcd05080_104.json b/packages/security_detection_engine/kibana/security_rule/5d0265bf-dea9-41a9-92ad-48a8dcd05080_104.json new file mode 100644 index 00000000000..ae329371dc2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5d0265bf-dea9-41a9-92ad-48a8dcd05080_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the Defaults command to install a login or logoff hook in MacOS. An adversary may abuse this capability to establish persistence in an environment by inserting code to be executed at login or logout.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Login or Logout Hook", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type == \"start\" and\n process.name == \"defaults\" and process.args == \"write\" and process.args : (\"LoginHook\", \"LogoutHook\") and\n not process.args :\n (\n \"Support/JAMF/ManagementFrameworkScripts/logouthook.sh\",\n \"Support/JAMF/ManagementFrameworkScripts/loginhook.sh\",\n \"/Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh\",\n \"/Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh\"\n )\n", + "references": [ + "https://www.virusbulletin.com/uploads/pdf/conference_slides/2014/Wardle-VB2014.pdf", + "https://www.manpagez.com/man/1/defaults/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5d0265bf-dea9-41a9-92ad-48a8dcd05080", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "5d0265bf-dea9-41a9-92ad-48a8dcd05080_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5d1d6907-0747-4d5d-9b24-e4a18853dc0a_104.json b/packages/security_detection_engine/kibana/security_rule/5d1d6907-0747-4d5d-9b24-e4a18853dc0a_104.json new file mode 100644 index 00000000000..554419804e5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5d1d6907-0747-4d5d-9b24-e4a18853dc0a_104.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution of a suspicious program via scheduled tasks by looking at process lineage and command line usage.", + "false_positives": [ + "Legitimate scheduled tasks running third party software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Execution via Scheduled Task", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n /* Schedule service cmdline on Win10+ */\n process.parent.name : \"svchost.exe\" and process.parent.args : \"Schedule\" and\n /* add suspicious programs here */\n process.pe.original_file_name in\n (\n \"cscript.exe\",\n \"wscript.exe\",\n \"PowerShell.EXE\",\n \"Cmd.Exe\",\n \"MSHTA.EXE\",\n \"RUNDLL32.EXE\",\n \"REGSVR32.EXE\",\n \"MSBuild.exe\",\n \"InstallUtil.exe\",\n \"RegAsm.exe\",\n \"RegSvcs.exe\",\n \"msxsl.exe\",\n \"CONTROL.EXE\",\n \"EXPLORER.EXE\",\n \"Microsoft.Workflow.Compiler.exe\",\n \"msiexec.exe\"\n ) and\n /* add suspicious paths here */\n process.args : (\n \"C:\\\\Users\\\\*\",\n \"C:\\\\ProgramData\\\\*\",\n \"C:\\\\Windows\\\\Temp\\\\*\",\n \"C:\\\\Windows\\\\Tasks\\\\*\",\n \"C:\\\\PerfLogs\\\\*\",\n \"C:\\\\Intel\\\\*\",\n \"C:\\\\Windows\\\\Debug\\\\*\",\n \"C:\\\\HP\\\\*\") and\n\n not (process.name : \"cmd.exe\" and process.args : \"?:\\\\*.bat\" and process.working_directory : \"?:\\\\Windows\\\\System32\\\\\") and\n not (process.name : \"cscript.exe\" and process.args : \"?:\\\\Windows\\\\system32\\\\calluxxprovider.vbs\") and\n not (process.name : \"powershell.exe\" and process.args : (\"-File\", \"-PSConsoleFile\") and user.id : \"S-1-5-18\") and\n not (process.name : \"msiexec.exe\" and user.id : \"S-1-5-18\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5d1d6907-0747-4d5d-9b24-e4a18853dc0a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "5d1d6907-0747-4d5d-9b24-e4a18853dc0a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/5d9f8cfc-0d03-443e-a167-2b0597ce0965_104.json b/packages/security_detection_engine/kibana/security_rule/5d9f8cfc-0d03-443e-a167-2b0597ce0965_104.json new file mode 100644 index 00000000000..315f367141f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/5d9f8cfc-0d03-443e-a167-2b0597ce0965_104.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the Automator Workflows process followed by a network connection from it's XPC service. Adversaries may drop a custom workflow template that hosts malicious JavaScript for Automation (JXA) code as an alternative to using osascript.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Automator Workflows Execution", + "query": "sequence by host.id with maxspan=30s\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name == \"automator\"]\n [network where host.os.type == \"macos\" and process.name:\"com.apple.automator.runner\"]\n", + "references": [ + "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "5d9f8cfc-0d03-443e-a167-2b0597ce0965", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "5d9f8cfc-0d03-443e-a167-2b0597ce0965_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/610949a1-312f-4e04-bb55-3a79b8c95267_106.json b/packages/security_detection_engine/kibana/security_rule/610949a1-312f-4e04-bb55-3a79b8c95267_106.json new file mode 100644 index 00000000000..a888b528d2a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/610949a1-312f-4e04-bb55-3a79b8c95267_106.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies network activity from unexpected system applications. This may indicate adversarial activity as these applications are often leveraged by adversaries to execute code and evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Process Network Connection", + "note": "## Triage and analysis\n\n### Investigating Unusual Process Network Connection\n\nThis rule identifies network activity from unexpected system utilities and applications. These applications are commonly abused by attackers to execute code, evade detections, and bypass security protections.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the target host that the process is communicating with.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and (process.name : \"Microsoft.Workflow.Compiler.exe\" or\n process.name : \"bginfo.exe\" or\n process.name : \"cdb.exe\" or\n process.name : \"cmstp.exe\" or\n process.name : \"csi.exe\" or\n process.name : \"dnx.exe\" or\n process.name : \"fsi.exe\" or\n process.name : \"ieexec.exe\" or\n process.name : \"iexpress.exe\" or\n process.name : \"odbcconf.exe\" or\n process.name : \"rcsi.exe\" or\n process.name : \"xwizard.exe\") and\n event.type == \"start\"]\n [network where host.os.type == \"windows\" and (process.name : \"Microsoft.Workflow.Compiler.exe\" or\n process.name : \"bginfo.exe\" or\n process.name : \"cdb.exe\" or\n process.name : \"cmstp.exe\" or\n process.name : \"csi.exe\" or\n process.name : \"dnx.exe\" or\n process.name : \"fsi.exe\" or\n process.name : \"ieexec.exe\" or\n process.name : \"iexpress.exe\" or\n process.name : \"odbcconf.exe\" or\n process.name : \"rcsi.exe\" or\n process.name : \"xwizard.exe\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "610949a1-312f-4e04-bb55-3a79b8c95267", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/" + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "610949a1-312f-4e04-bb55-3a79b8c95267_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/61ac3638-40a3-44b2-855a-985636ca985e_109.json b/packages/security_detection_engine/kibana/security_rule/61ac3638-40a3-44b2-855a-985636ca985e_109.json new file mode 100644 index 00000000000..2e94f0ae923 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/61ac3638-40a3-44b2-855a-985636ca985e_109.json @@ -0,0 +1,143 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.", + "false_positives": [ + "Legitimate PowerShell scripts that make use of these functions." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Suspicious Discovery Related Windows API Functions", + "note": "## Triage and analysis\n\n### Investigating PowerShell Suspicious Discovery Related Windows API Functions\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell to interact with the Win32 API to bypass command line based detections, using libraries like PSReflect or Get-ProcAddress Cmdlet.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Check for additional PowerShell and command-line logs that indicate that imported functions were run.\n\n### False positive analysis\n\n- Discovery activities themselves are not inherently malicious if occurring in isolation, as long as the script does not contain other capabilities, and there are no other alerts related to the user or host; such alerts can be dismissed. However, analysts should keep in mind that this is not a common way of getting information, making it suspicious.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n NetShareEnum or\n NetWkstaUserEnum or\n NetSessionEnum or\n NetLocalGroupEnum or\n NetLocalGroupGetMembers or\n DsGetSiteName or\n DsEnumerateDomainTrusts or\n WTSEnumerateSessionsEx or\n WTSQuerySessionInformation or\n LsaGetLogonSessionData or\n QueryServiceObjectSecurity or\n GetComputerNameEx or\n NetWkstaGetInfo or\n GetUserNameEx or\n NetUserEnum or\n NetUserGetInfo or\n NetGroupEnum or\n NetGroupGetInfo or\n NetGroupGetUsers or\n NetWkstaTransportEnum or\n NetServerGetInfo or\n LsaEnumerateTrustedDomains or\n NetScheduleJobEnum or\n NetUserModalsGet\n )\n and not user.id : (\"S-1-5-18\" or \"S-1-5-19\")\n", + "references": [ + "https://github.com/BC-SECURITY/Empire/blob/9259e5106986847d2bb770c4289c0c0f1adf2344/data/module_source/situational_awareness/network/powerview.ps1#L21413", + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "61ac3638-40a3-44b2-855a-985636ca985e", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + } + ] + }, + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1135", + "name": "Network Share Discovery", + "reference": "https://attack.mitre.org/techniques/T1135/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + }, + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 109 + }, + "id": "61ac3638-40a3-44b2-855a-985636ca985e_109", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/622ecb68-fa81-4601-90b5-f8cd661e4520_105.json b/packages/security_detection_engine/kibana/security_rule/622ecb68-fa81-4601-90b5-f8cd661e4520_105.json new file mode 100644 index 00000000000..1149139a72e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/622ecb68-fa81-4601-90b5-f8cd661e4520_105.json @@ -0,0 +1,148 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of Distributed Component Object Model (DCOM) to execute commands from a remote host, which are launched via the HTA Application COM Object. This behavior may indicate an attacker abusing a DCOM application to move laterally while attempting to evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming DCOM Lateral Movement via MSHTA", + "query": "sequence with maxspan=1m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"mshta.exe\" and process.args : \"-Embedding\"\n ] by host.id, process.entity_id\n [network where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"mshta.exe\" and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n source.port \u003e 49151 and destination.port \u003e 49151 and source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ] by host.id, process.entity_id\n", + "references": [ + "https://codewhitesec.blogspot.com/2018/07/lethalhta.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "622ecb68-fa81-4601-90b5-f8cd661e4520", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.003", + "name": "Distributed Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1021/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.005", + "name": "Mshta", + "reference": "https://attack.mitre.org/techniques/T1218/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "622ecb68-fa81-4601-90b5-f8cd661e4520_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_1.json b/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_1.json new file mode 100644 index 00000000000..de263665bf4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_1.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies potentially malicious processes communicating via a port paring typically not associated with HTTP/HTTPS. For example, HTTP over port 8443 or port 440 as opposed to the traditional port 80 , 443. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Non-Standard Port HTTP/HTTPS connection", + "query": "network where process.name : (\"http\", \"https\")\n and destination.port not in (80, 443)\n and event.action in (\"connection_attempted\", \"connection_accepted\")\n and destination.ip != \"127.0.0.1\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "62b68eb2-1e47-4da7-85b6-8f478db5b272", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1571", + "name": "Non-Standard Port", + "reference": "https://attack.mitre.org/techniques/T1571/" + }, + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + }, + { + "id": "T1573", + "name": "Encrypted Channel", + "reference": "https://attack.mitre.org/techniques/T1573/", + "subtechnique": [ + { + "id": "T1573.001", + "name": "Symmetric Cryptography", + "reference": "https://attack.mitre.org/techniques/T1573/001/" + }, + { + "id": "T1573.002", + "name": "Asymmetric Cryptography", + "reference": "https://attack.mitre.org/techniques/T1573/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "62b68eb2-1e47-4da7-85b6-8f478db5b272_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_2.json b/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_2.json new file mode 100644 index 00000000000..ae4a4308f00 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/62b68eb2-1e47-4da7-85b6-8f478db5b272_2.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies potentially malicious processes communicating via a port paring typically not associated with HTTP/HTTPS. For example, HTTP over port 8443 or port 440 as opposed to the traditional port 80 , 443. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Non-Standard Port HTTP/HTTPS connection", + "query": "network where process.name : (\"http\", \"https\")\n and destination.port not in (80, 443)\n and event.action in (\"connection_attempted\", \"connection_accepted\")\n and destination.ip != \"127.0.0.1\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "62b68eb2-1e47-4da7-85b6-8f478db5b272", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1571", + "name": "Non-Standard Port", + "reference": "https://attack.mitre.org/techniques/T1571/" + }, + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + }, + { + "id": "T1573", + "name": "Encrypted Channel", + "reference": "https://attack.mitre.org/techniques/T1573/", + "subtechnique": [ + { + "id": "T1573.001", + "name": "Symmetric Cryptography", + "reference": "https://attack.mitre.org/techniques/T1573/001/" + }, + { + "id": "T1573.002", + "name": "Asymmetric Cryptography", + "reference": "https://attack.mitre.org/techniques/T1573/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "62b68eb2-1e47-4da7-85b6-8f478db5b272_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/63c057cc-339a-11ed-a261-0242ac120002_5.json b/packages/security_detection_engine/kibana/security_rule/63c057cc-339a-11ed-a261-0242ac120002_5.json new file mode 100644 index 00000000000..a1bc7e025f2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/63c057cc-339a-11ed-a261-0242ac120002_5.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects when an unauthenticated user request is authorized within the cluster. Attackers may attempt to use anonymous accounts to gain initial access to the cluster or to avoid attribution of their activities within the cluster. This rule excludes the /healthz, /livez and /readyz endpoints which are commonly accessed anonymously.", + "false_positives": [ + "Anonymous access to the API server is a dangerous setting enabled by default. Common anonymous connections (e.g., health checks) have been excluded from this rule. All other instances of authorized anonymous requests should be investigated." + ], + "index": [ + "logs-kubernetes.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Kubernetes Anonymous Request Authorized", + "note": "", + "query": "event.dataset:kubernetes.audit_logs\n and kubernetes.audit.annotations.authorization_k8s_io/decision:allow\n and kubernetes.audit.user.username:(\"system:anonymous\" or \"system:unauthenticated\" or not *)\n and not kubernetes.audit.requestURI:(/healthz* or /livez* or /readyz*)\n", + "references": [ + "https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF" + ], + "related_integrations": [ + { + "package": "kubernetes", + "version": "^1.4.1" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": false, + "name": "kubernetes.audit.annotations.authorization_k8s_io/decision", + "type": "unknown" + }, + { + "ecs": false, + "name": "kubernetes.audit.requestURI", + "type": "unknown" + }, + { + "ecs": false, + "name": "kubernetes.audit.user.username", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "63c057cc-339a-11ed-a261-0242ac120002", + "setup": "The Kubernetes Fleet integration with Audit Logs enabled or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Data Source: Kubernetes", + "Tactic: Execution", + "Tactic: Initial Access", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.001", + "name": "Default Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 5 + }, + "id": "63c057cc-339a-11ed-a261-0242ac120002_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/63e65ec3-43b1-45b0-8f2d-45b34291dc44_105.json b/packages/security_detection_engine/kibana/security_rule/63e65ec3-43b1-45b0-8f2d-45b34291dc44_105.json new file mode 100644 index 00000000000..1c50f64b5bf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/63e65ec3-43b1-45b0-8f2d-45b34291dc44_105.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Binaries signed with trusted digital certificates can execute on Windows systems protected by digital signature validation. Adversaries may use these binaries to 'live off the land' and execute malicious files that could bypass application allowlists and signature validation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via Signed Binary", + "note": "## Triage and analysis\n\n### Investigating Network Connection via Signed Binary\n\nBy examining the specific traits of Windows binaries (such as process trees, command lines, network connections, registry modifications, and so on) it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.\n\nThis rule looks for the execution of `expand.exe`, `extrac32.exe`, `ieexec.exe`, or `makecab.exe` utilities, followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities to bypass detections and evade defenses.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.\n- Investigate the target host that the signed binary is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of destination IP address and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and (process.name : \"expand.exe\" or process.name : \"extrac32.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n event.type == \"start\"]\n [network where host.os.type == \"windows\" and (process.name : \"expand.exe\" or process.name : \"extrac32.exe\" or\n process.name : \"ieexec.exe\" or process.name : \"makecab.exe\") and\n not cidrmatch(destination.ip,\n \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.0.0/29\", \"192.0.0.8/32\",\n \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\",\n \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + } + ], + "type": "eql", + "version": 105 + }, + "id": "63e65ec3-43b1-45b0-8f2d-45b34291dc44_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/647fc812-7996-4795-8869-9c4ea595fe88_104.json b/packages/security_detection_engine/kibana/security_rule/647fc812-7996-4795-8869-9c4ea595fe88_104.json new file mode 100644 index 00000000000..3ace9d34522 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/647fc812-7996-4795-8869-9c4ea595fe88_104.json @@ -0,0 +1,73 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Searches for rare processes running on multiple Linux hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_anomalous_process_all_hosts" + ], + "name": "Anomalous Process For a Linux Population", + "note": "## Triage and analysis\n\n### Investigating Anomalous Process For a Linux Population\n\nSearching for abnormal Linux processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.\n\nThis rule uses a machine learning job to detect a Linux process that is rare and unusual for all of the monitored Linux hosts in your fleet.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, and whether they are located in expected locations.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.\n- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "647fc812-7996-4795-8869-9c4ea595fe88", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "647fc812-7996-4795-8869-9c4ea595fe88_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6482255d-f468-45ea-a5b3-d3a7de1331ae_104.json b/packages/security_detection_engine/kibana/security_rule/6482255d-f468-45ea-a5b3-d3a7de1331ae_104.json new file mode 100644 index 00000000000..bd69ba7789a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6482255d-f468-45ea-a5b3-d3a7de1331ae_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies changes to the Safari configuration using the built-in defaults command. Adversaries may attempt to enable or disable certain Safari settings, such as enabling JavaScript from Apple Events to ease in the hijacking of the users browser.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of Safari Settings via Defaults Command", + "query": "event.category:process and host.os.type:macos and event.type:start and\n process.name:defaults and process.args:\n (com.apple.Safari and write and not\n (\n UniversalSearchEnabled or\n SuppressSearchSuggestions or\n WebKitTabToLinksPreferenceKey or\n ShowFullURLInSmartSearchField or\n com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks\n )\n )\n", + "references": [ + "https://objectivebythesea.com/v2/talks/OBTS_v2_Zohar.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6482255d-f468-45ea-a5b3-d3a7de1331ae", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "6482255d-f468-45ea-a5b3-d3a7de1331ae_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/64cfca9e-0f6f-4048-8251-9ec56a055e9e_1.json b/packages/security_detection_engine/kibana/security_rule/64cfca9e-0f6f-4048-8251-9ec56a055e9e_1.json new file mode 100644 index 00000000000..32dd2ce0cb2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/64cfca9e-0f6f-4048-8251-9ec56a055e9e_1.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors a sequence involving a program compilation event followed by its execution and a subsequent network connection event. This behavior can indicate the set up of a reverse tcp connection to a command-and-control server. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via Recently Compiled Executable", + "query": "sequence by host.id with maxspan=1m\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name in (\"gcc\", \"g++\", \"cc\")] by process.args\n [file where host.os.type == \"linux\" and event.action == \"creation\" and process.name == \"ld\"] by file.name\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\"] by process.name\n [network where host.os.type == \"linux\" and event.action == \"connection_attempted\"] by process.name\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "64cfca9e-0f6f-4048-8251-9ec56a055e9e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "64cfca9e-0f6f-4048-8251-9ec56a055e9e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/661545b4-1a90-4f45-85ce-2ebd7c6a15d0_104.json b/packages/security_detection_engine/kibana/security_rule/661545b4-1a90-4f45-85ce-2ebd7c6a15d0_104.json new file mode 100644 index 00000000000..1bd98a1487f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/661545b4-1a90-4f45-85ce-2ebd7c6a15d0_104.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of macOS built-in commands to mount a Server Message Block (SMB) network share. Adversaries may use valid accounts to interact with a remote network share using SMB.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Mount SMB Share via Command Line", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n (\n process.name : \"mount_smbfs\" or\n (process.name : \"open\" and process.args : \"smb://*\") or\n (process.name : \"mount\" and process.args : \"smbfs\") or\n (process.name : \"osascript\" and process.command_line : \"osascript*mount volume*smb://*\")\n ) and\n not process.parent.executable : \"/Applications/Google Drive.app/Contents/MacOS/Google Drive\"\n", + "references": [ + "https://www.freebsd.org/cgi/man.cgi?mount_smbfs", + "https://ss64.com/osx/mount.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "661545b4-1a90-4f45-85ce-2ebd7c6a15d0", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "661545b4-1a90-4f45-85ce-2ebd7c6a15d0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6641a5af-fb7e-487a-adc4-9e6503365318_3.json b/packages/security_detection_engine/kibana/security_rule/6641a5af-fb7e-487a-adc4-9e6503365318_3.json new file mode 100644 index 00000000000..580cf8b5350 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6641a5af-fb7e-487a-adc4-9e6503365318_3.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where VMware processes, such as \"vmware-vmx\" or \"vmx,\" are terminated on a Linux system by a \"kill\" command. The rule monitors for the \"end\" event type, which signifies the termination of a process. The presence of a \"kill\" command as the parent process for terminating VMware processes may indicate that a threat actor is attempting to interfere with the virtualized environment on the targeted system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Termination of ESXI Process", + "query": "process where host.os.type == \"linux\" and event.type == \"end\" and process.name : (\"vmware-vmx\", \"vmx\")\nand process.parent.name : \"kill\"\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6641a5af-fb7e-487a-adc4-9e6503365318", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "6641a5af-fb7e-487a-adc4-9e6503365318_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/665e7a4f-c58e-4fc6-bc83-87a7572670ac_103.json b/packages/security_detection_engine/kibana/security_rule/665e7a4f-c58e-4fc6-bc83-87a7572670ac_103.json new file mode 100644 index 00000000000..007d8c9f5fb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/665e7a4f-c58e-4fc6-bc83-87a7572670ac_103.json @@ -0,0 +1,77 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the deletion of WebServer access logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "WebServer Access Logs Deleted", + "note": "", + "query": "file where event.type == \"deletion\" and\n file.path : (\"C:\\\\inetpub\\\\logs\\\\LogFiles\\\\*.log\",\n \"/var/log/apache*/access.log\",\n \"/etc/httpd/logs/access_log\",\n \"/var/log/httpd/access_log\",\n \"/var/www/*/logs/access.log\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "665e7a4f-c58e-4fc6-bc83-87a7572670ac", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: Windows", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "665e7a4f-c58e-4fc6-bc83-87a7572670ac_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/66712812-e7f2-4a1d-bbda-dd0b5cf20c5d_1.json b/packages/security_detection_engine/kibana/security_rule/66712812-e7f2-4a1d-bbda-dd0b5cf20c5d_1.json new file mode 100644 index 00000000000..6cda25778c1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/66712812-e7f2-4a1d-bbda-dd0b5cf20c5d_1.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Successful Linux FTP Brute Force Attack Detected", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n```\nFor this detection rule no additional audit rules are required to be added to the integration. \n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "sequence by host.id, auditd.data.addr, related.user with maxspan=5s\n [authentication where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n event.action == \"authenticated\" and auditd.data.terminal == \"ftp\" and event.outcome == \"failure\" and \n auditd.data.addr != null and auditd.data.addr != \"0.0.0.0\" and auditd.data.addr != \"::\"] with runs=10\n [authentication where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n event.action == \"authenticated\" and auditd.data.terminal == \"ftp\" and event.outcome == \"success\" and \n auditd.data.addr != null and auditd.data.addr != \"0.0.0.0\" and auditd.data.addr != \"::\"] | tail 1\n", + "related_integrations": [ + { + "integration": "auditd", + "package": "auditd_manager", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "auditd.data.addr", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.terminal", + "type": "unknown" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "related.user", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n```\nFor this detection rule no additional audit rules are required to be added to the integration.\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "66712812-e7f2-4a1d-bbda-dd0b5cf20c5d_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/66883649-f908-4a5b-a1e0-54090a1d3a32_107.json b/packages/security_detection_engine/kibana/security_rule/66883649-f908-4a5b-a1e0-54090a1d3a32_107.json new file mode 100644 index 00000000000..966c1e487e1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/66883649-f908-4a5b-a1e0-54090a1d3a32_107.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may implement command and control (C2) communications that use common web services to hide their activity. This attack technique is typically targeted at an organization and uses web services common to the victim network, which allows the adversary to blend into legitimate traffic activity. These popular services are typically targeted since they have most likely been used before compromise, which helps malicious traffic blend in.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Connection to Commonly Abused Web Services", + "note": "## Triage and analysis\n\n### Investigating Connection to Commonly Abused Web Services\n\nAdversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.\n\nThis rule looks for processes outside known legitimate program locations communicating with a list of services that can be abused for exfiltration or command and control.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Verify whether the digital signature exists in the executable.\n- Identify the operation type (upload, download, tunneling, etc.).\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This rule has a high chance to produce false positives because it detects communication with legitimate services. Noisy false positives can be added as exceptions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "network where host.os.type == \"windows\" and network.protocol == \"dns\" and\n process.name != null and user.id not in (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\") and\n /* Add new WebSvc domains here */\n dns.question.name :\n (\n \"raw.githubusercontent.*\",\n \"*.pastebin.*\",\n \"*drive.google.*\",\n \"*docs.live.*\",\n \"*api.dropboxapi.*\",\n \"*dropboxusercontent.*\",\n \"*onedrive.*\",\n \"*4shared.*\",\n \"*.file.io\",\n \"*filebin.net\",\n \"*slack-files.com\",\n \"*ghostbin.*\",\n \"*ngrok.*\",\n \"*portmap.*\",\n \"*serveo.net\",\n \"*localtunnel.me\",\n \"*pagekite.me\",\n \"*localxpose.io\",\n \"*notabug.org\",\n \"rawcdn.githack.*\",\n \"paste.nrecom.net\",\n \"zerobin.net\",\n \"controlc.com\",\n \"requestbin.net\",\n \"cdn.discordapp.com\",\n \"discordapp.com\",\n \"discord.com\",\n \"script.google.com\",\n \"script.googleusercontent.com\"\n ) and\n /* Insert noisy false positives here */\n not (\n process.executable : (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\WWAHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\smartscreen.exe\",\n \"?:\\\\Windows\\\\System32\\\\MicrosoftEdgeCP.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Fiddler\\\\Fiddler.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Programs\\\\Microsoft VS Code\\\\Code.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\OneDrive.exe\",\n \"?:\\\\Windows\\\\system32\\\\mobsync.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\mobsync.exe\"\n ) or\n \n /* Discord App */\n (process.name : \"Discord.exe\" and (process.code_signature.subject_name : \"Discord Inc.\" and\n process.code_signature.trusted == true) and dns.question.name : (\"discord.com\", \"cdn.discordapp.com\", \"discordapp.com\")\n ) or \n\n /* MS Sharepoint */\n (process.name : \"Microsoft.SharePoint.exe\" and (process.code_signature.subject_name : \"Microsoft Corporation\" and\n process.code_signature.trusted == true) and dns.question.name : \"onedrive.live.com\"\n ) or \n\n /* Firefox */\n (process.name : \"firefox.exe\" and (process.code_signature.subject_name : \"Mozilla Corporation\" and\n process.code_signature.trusted == true)\n )\n ) \n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "66883649-f908-4a5b-a1e0-54090a1d3a32", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1102", + "name": "Web Service", + "reference": "https://attack.mitre.org/techniques/T1102/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1567", + "name": "Exfiltration Over Web Service", + "reference": "https://attack.mitre.org/techniques/T1567/", + "subtechnique": [ + { + "id": "T1567.001", + "name": "Exfiltration to Code Repository", + "reference": "https://attack.mitre.org/techniques/T1567/001/" + }, + { + "id": "T1567.002", + "name": "Exfiltration to Cloud Storage", + "reference": "https://attack.mitre.org/techniques/T1567/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "66883649-f908-4a5b-a1e0-54090a1d3a32_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/66c058f3-99f4-4d18-952b-43348f2577a0_1.json b/packages/security_detection_engine/kibana/security_rule/66c058f3-99f4-4d18-952b-43348f2577a0_1.json new file mode 100644 index 00000000000..74306e7527d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/66c058f3-99f4-4d18-952b-43348f2577a0_1.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for potential memory dumping through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include \"truffleproc\" and \"bash-memory-dump\". This behavior should not happen by default, and should be investigated thoroughly.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Secret Dumping via GDB", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"gdb\" and process.args in (\"--pid\", \"-p\") and \n/* Covered by d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f */\nprocess.args != \"1\"\n", + "references": [ + "https://github.com/controlplaneio/truffleproc", + "https://github.com/hajzer/bash-memory-dump" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "66c058f3-99f4-4d18-952b-43348f2577a0", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.007", + "name": "Proc Filesystem", + "reference": "https://attack.mitre.org/techniques/T1003/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "66c058f3-99f4-4d18-952b-43348f2577a0_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/66da12b1-ac83-40eb-814c-07ed1d82b7b9_104.json b/packages/security_detection_engine/kibana/security_rule/66da12b1-ac83-40eb-814c-07ed1d82b7b9_104.json new file mode 100644 index 00000000000..f2f94ac164d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/66da12b1-ac83-40eb-814c-07ed1d82b7b9_104.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, and Excel). These child processes are often launched during exploitation of Office applications or by documents with malicious macros.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious macOS MS Office Child Process", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.parent.name:(\"Microsoft Word\", \"Microsoft PowerPoint\", \"Microsoft Excel\") and\n process.name:\n (\n \"bash\",\n \"dash\",\n \"sh\",\n \"tcsh\",\n \"csh\",\n \"zsh\",\n \"ksh\",\n \"fish\",\n \"python*\",\n \"perl*\",\n \"php*\",\n \"osascript\",\n \"pwsh\",\n \"curl\",\n \"wget\",\n \"cp\",\n \"mv\",\n \"base64\",\n \"launchctl\"\n ) and\n /* noisy false positives related to product version discovery and office errors reporting */\n not process.args:\n (\n \"ProductVersion\",\n \"hw.model\",\n \"ioreg\",\n \"ProductName\",\n \"ProductUserVisibleVersion\",\n \"ProductBuildVersion\",\n \"/Library/Application Support/Microsoft/MERP*/Microsoft Error Reporting.app/Contents/MacOS/Microsoft Error Reporting\"\n )\n", + "references": [ + "https://blog.malwarebytes.com/cybercrime/2017/02/microsoft-office-macro-malware-targets-macs/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "66da12b1-ac83-40eb-814c-07ed1d82b7b9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "66da12b1-ac83-40eb-814c-07ed1d82b7b9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6731fbf2-8f28-49ed-9ab9-9a918ceb5a45_104.json b/packages/security_detection_engine/kibana/security_rule/6731fbf2-8f28-49ed-9ab9-9a918ceb5a45_104.json new file mode 100644 index 00000000000..ca058f9edca --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6731fbf2-8f28-49ed-9ab9-9a918ceb5a45_104.json @@ -0,0 +1,81 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to modify an Okta policy. An adversary may attempt to modify an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to modify an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta policies are regularly modified in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Modify an Okta Policy", + "note": "## Triage and analysis\n\n### Investigating Attempt to Modify an Okta Policy\n\nModifications to Okta policies may indicate attempts to weaken an organization's security controls. If such an attempt is detected, consider the following steps for investigation.\n\n#### Possible investigation steps:\n- Identify the actor associated with the event. Check the fields `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name`.\n- Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.\n- Check the nature of the policy modification. You can review the `okta.target` field, especially `okta.target.display_name` and `okta.target.id`.\n- Examine the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the modification attempt.\n- Check if there have been other similar modification attempts in a short time span from the same actor or IP address.\n\n### False positive analysis:\n- This alert might be a false positive if Okta policies are regularly updated in your organization as a part of normal operations.\n- Check if the actor associated with the event has legitimate rights to modify the Okta policies.\n- Verify the actor's geographical location and the time of the modification attempt. If these align with the actor's regular behavior, it could be a false positive.\n\n### Response and remediation:\n- If unauthorized modification is confirmed, initiate the incident response process.\n- Lock the actor's account and enforce password change as an immediate response.\n- Reset MFA tokens for the actor and enforce re-enrollment, if applicable.\n- Review any other actions taken by the actor to assess the overall impact.\n- If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.\n- Consider a security review of your Okta policies and rules to ensure they follow security best practices.", + "query": "event.dataset:okta.system and event.action:policy.lifecycle.update\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "6731fbf2-8f28-49ed-9ab9-9a918ceb5a45", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "6731fbf2-8f28-49ed-9ab9-9a918ceb5a45_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7_104.json b/packages/security_detection_engine/kibana/security_rule/676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7_104.json new file mode 100644 index 00000000000..2133244fe54 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7_104.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to revoke an Okta API token. An adversary may attempt to revoke or delete an Okta API token to disrupt an organization's business operations.", + "false_positives": [ + "If the behavior of revoking Okta API tokens is expected, consider adding exceptions to this rule to filter false positives." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Revoke Okta API Token", + "note": "## Triage and analysis\n\n### Investigating Attempt to Revoke Okta API Token\n\nThe rule alerts when attempts are made to revoke an Okta API token. The API tokens are critical for integration services, and revoking them may lead to disruption in services. Therefore, it's important to validate these activities.\n\n#### Possible investigation steps:\n- Identify the actor associated with the API token revocation attempt. You can use the `okta.actor.alternate_id` field for this purpose.\n- Determine the client used by the actor. Review the `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context` fields.\n- Verify if the API token revocation was authorized or part of some planned activity.\n- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.\n- Analyze the past activities of the actor involved in this action. An actor who usually performs such activities may indicate a legitimate reason.\n- Evaluate the actions that happened just before and after this event. It can help understand the full context of the activity.\n\n### False positive analysis:\n- It might be a false positive if the action was part of a planned activity or was performed by an authorized person.\n\n### Response and remediation:\n- If unauthorized revocation attempts are confirmed, initiate the incident response process.\n- Block the IP address or device used in the attempts, if they appear suspicious.\n- Reset the user's password and enforce MFA re-enrollment, if applicable.\n- Conduct a review of Okta policies and ensure they are in accordance with security best practices.\n- If the revoked token was used for critical integrations, coordinate with the relevant team to minimize the impact.", + "query": "event.dataset:okta.system and event.action:system.api_token.revoke\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1531", + "name": "Account Access Removal", + "reference": "https://attack.mitre.org/techniques/T1531/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "676cff2b-450b-4cf1-8ed2-c0c58a4a2dd7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_107.json b/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_107.json new file mode 100644 index 00000000000..9cb07332436 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_107.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "High Number of Process Terminations", + "note": "## Triage and analysis\n\n### Investigating High Number of Process Terminations\n\nAttackers can kill processes for a variety of purposes. For example, they can kill process associated with business applications and databases to release the lock on files used by these applications so they may be encrypted,or stop security and backup solutions, etc.\n\nThis rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.\n\n#### Possible investigation steps\n\n- Examine the entry point to the host and user in action via the Analyse View.\n - Identify the session entry leader and session user.\n- Examine the contents of session leading to the process termination(s) via the Session View.\n - Examine the command execution pattern in the session, which may lead to suspricous activities.\n- Examine the process killed during the malicious execution\n - Identify imment threat to the system from the process killed.\n - Take necessary incident response actions to respawn necessary process.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system or restore it to the operational state.\n- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:linux and event.type:start and process.name:\"pkill\" and process.args:\"-f\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "threshold": { + "field": [ + "host.id", + "process.executable", + "user.name" + ], + "value": 10 + }, + "type": "threshold", + "version": 107 + }, + "id": "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_108.json b/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_108.json new file mode 100644 index 00000000000..420dedd6311 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_108.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "High Number of Process Terminations", + "note": "## Triage and analysis\n\n### Investigating High Number of Process Terminations\n\nAttackers can kill processes for a variety of purposes. For example, they can kill process associated with business applications and databases to release the lock on files used by these applications so they may be encrypted,or stop security and backup solutions, etc.\n\nThis rule identifies a high number (10) of process terminations via pkill from the same host within a short time period.\n\n#### Possible investigation steps\n\n- Examine the entry point to the host and user in action via the Analyse View.\n - Identify the session entry leader and session user.\n- Examine the contents of session leading to the process termination(s) via the Session View.\n - Examine the command execution pattern in the session, which may lead to suspricous activities.\n- Examine the process killed during the malicious execution\n - Identify imment threat to the system from the process killed.\n - Take necessary incident response actions to respawn necessary process.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further destructive behavior, which is commonly associated with this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system or restore it to the operational state.\n- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:linux and event.type:start and process.name:\"pkill\" and process.args:\"-f\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "threshold": { + "field": [ + "host.id", + "process.executable", + "user.name" + ], + "value": 10 + }, + "type": "threshold", + "version": 108 + }, + "id": "67f8443a-4ff3-4a70-916d-3cfa3ae9f02b_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6839c821-011d-43bd-bd5b-acff00257226_104.json b/packages/security_detection_engine/kibana/security_rule/6839c821-011d-43bd-bd5b-acff00257226_104.json new file mode 100644 index 00000000000..89d606c98ac --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6839c821-011d-43bd-bd5b-acff00257226_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The Debugger and SilentProcessExit registry keys can allow an adversary to intercept the execution of files, causing a different process to be executed. This functionality can be abused by an adversary to establish persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Image File Execution Options Injection", + "query": "registry where host.os.type == \"windows\" and length(registry.data.strings) \u003e 0 and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*.exe\\\\Debugger\",\n \"HKLM\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*\\\\Debugger\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\*\\\\MonitorProcess\",\n \"HKLM\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\*\\\\MonitorProcess\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*.exe\\\\Debugger\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\*\\\\Debugger\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\*\\\\MonitorProcess\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\SilentProcessExit\\\\*\\\\MonitorProcess\"\n ) and\n /* add FPs here */\n not registry.data.strings regex~ (\"\"\"C:\\\\Program Files( \\(x86\\))?\\\\ThinKiosk\\\\thinkiosk\\.exe\"\"\", \"\"\".*\\\\PSAppDeployToolkit\\\\.*\"\"\")\n", + "references": [ + "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6839c821-011d-43bd-bd5b-acff00257226", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.012", + "name": "Image File Execution Options Injection", + "reference": "https://attack.mitre.org/techniques/T1546/012/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "6839c821-011d-43bd-bd5b-acff00257226_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/68921d85-d0dc-48b3-865f-43291ca2c4f2_105.json b/packages/security_detection_engine/kibana/security_rule/68921d85-d0dc-48b3-865f-43291ca2c4f2_105.json new file mode 100644 index 00000000000..8b488a2c309 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/68921d85-d0dc-48b3-865f-43291ca2c4f2_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the successful hijack of Microsoft Compatibility Appraiser scheduled task to establish persistence with an integrity level of system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via TelemetryController Scheduled Task Hijack", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"CompatTelRunner.exe\" and process.args : \"-cv*\" and\n not process.name : (\"conhost.exe\",\n \"DeviceCensus.exe\",\n \"CompatTelRunner.exe\",\n \"DismHost.exe\",\n \"rundll32.exe\",\n \"powershell.exe\")\n", + "references": [ + "https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "68921d85-d0dc-48b3-865f-43291ca2c4f2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "68921d85-d0dc-48b3-865f-43291ca2c4f2_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/689b9d57-e4d5-4357-ad17-9c334609d79a_104.json b/packages/security_detection_engine/kibana/security_rule/689b9d57-e4d5-4357-ad17-9c334609d79a_104.json new file mode 100644 index 00000000000..cbfac92027d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/689b9d57-e4d5-4357-ad17-9c334609d79a_104.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A scheduled task was created by a Windows script via cscript.exe, wscript.exe or powershell.exe. This can be abused by an adversary to establish persistence.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Scheduled Task Created by a Windows Script", + "note": "## Triage and analysis\n\nDecode the base64 encoded Tasks Actions registry value to investigate the task's configured action.", + "query": "sequence by host.id with maxspan = 30s\n [any where host.os.type == \"windows\" and \n (event.category : (\"library\", \"driver\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : \"taskschd.dll\" or file.name : \"taskschd.dll\") and\n process.name : (\"cscript.exe\", \"wscript.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\")]\n [registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\*\\\\Actions\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\*\\\\Actions\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "689b9d57-e4d5-4357-ad17-9c334609d79a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "689b9d57-e4d5-4357-ad17-9c334609d79a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/68d56fdc-7ffa-4419-8e95-81641bd6f845_105.json b/packages/security_detection_engine/kibana/security_rule/68d56fdc-7ffa-4419-8e95-81641bd6f845_105.json new file mode 100644 index 00000000000..0e96e994059 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/68d56fdc-7ffa-4419-8e95-81641bd6f845_105.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies User Account Control (UAC) bypass attempts via the ICMLuaUtil Elevated COM interface. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass via ICMLuaUtil Elevated COM Interface", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name == \"dllhost.exe\" and\n process.parent.args in (\"/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}\", \"/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}\") and\n process.pe.original_file_name != \"WerFault.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "68d56fdc-7ffa-4419-8e95-81641bd6f845", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "68d56fdc-7ffa-4419-8e95-81641bd6f845_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_103.json b/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_103.json deleted file mode 100644 index 7cba50f6049..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_103.json +++ /dev/null @@ -1,235 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Threat Intel Filebeat Module (v8.x) Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps:\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "699e9fdb-b77c-4c01-995c-1c15019b9c43", - "severity": "critical", - "tags": [ - "Elastic", - "Windows", - "Elastic Endgame", - "Network", - "Continuous Monitoring", - "SecOps", - "Monitoring", - "Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.module", - "negate": false, - "params": { - "query": "threatintel" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.module": "threatintel" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "filebeat-8*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:threatintel and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 103 - }, - "id": "699e9fdb-b77c-4c01-995c-1c15019b9c43_103", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_104.json b/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_104.json deleted file mode 100644 index f7ae768ca7c..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_104.json +++ /dev/null @@ -1,230 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Threat Intel Filebeat Module (v8.x) Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps:\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "699e9fdb-b77c-4c01-995c-1c15019b9c43", - "severity": "critical", - "tags": [ - "OS: Windows", - "Data Source: Elastic Endgame", - "Resources: Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.module", - "negate": false, - "params": { - "query": "threatintel" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.module": "threatintel" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "filebeat-8*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:threatintel and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 104 - }, - "id": "699e9fdb-b77c-4c01-995c-1c15019b9c43_104", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_204.json b/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_204.json deleted file mode 100644 index 14c7cf51302..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/699e9fdb-b77c-4c01-995c-1c15019b9c43_204.json +++ /dev/null @@ -1,231 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "This rule is triggered when indicators from the Threat Intel Filebeat module (v8.x) has a match against local file or network observations. This rule was deprecated. See the Setup section for more information and alternative rules.", - "from": "now-65m", - "index": [ - "auditbeat-*", - "endgame-*", - "filebeat-*", - "logs-*", - "packetbeat-*", - "winlogbeat-*" - ], - "interval": "1h", - "language": "kuery", - "license": "Elastic License v2", - "name": "Deprecated - Threat Intel Filebeat Module (v8.x) Indicator Match", - "note": "## Triage and Analysis\n\n### Investigating Threat Intel Indicator Matches\n\nThreat Intel indicator match rules allow matching from a local observation such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations. Matches can also occur on an IP address, registry path, URL, or imphash.\n\nThe matches will be based on the incoming last 30 days feed data so it's important to validate the data and review the results by investigating the associated activity to determine if it requires further investigation.\n\nIf an indicator matches a local observation, the following enriched fields will be generated to identify the indicator, field, and type matched.\n\n- `threat.indicator.matched.atomic` - this identifies the atomic indicator that matched the local observation\n- `threat.indicator.matched.field` - this identifies the indicator field that matched the local observation\n- `threat.indicator.matched.type` - this identifies the indicator type that matched the local observation\n\n#### Possible investigation steps\n\n- Investigation should be validated and reviewed based on the data (file hash, registry path, URL, imphash) that was matched and by viewing the source of that activity.\n- Consider the history of the indicator that was matched. Has it happened before? Is it happening on multiple machines? These kinds of questions can help understand if the activity is related to legitimate behavior.\n- Consider the user and their role within the company: is this something related to their job or work function?\n\n### False Positive Analysis\n\n- For any matches found, it's important to consider the initial release date of that indicator. Threat intelligence can be a great tool for augmenting existing security processes, while at the same time it should be understood that threat intelligence can represent a specific set of activity observed at a point in time. For example, an IP address may have hosted malware observed in a Dridex campaign months ago, but it's possible that IP has been remediated and no longer represents any threat.\n- Adversaries often use legitimate tools as network administrators such as `PsExec` or `AdFind`; these tools often find their way into indicator lists creating the potential for false positives.\n- It's possible after large and publicly written campaigns, curious employees might end up going directly to attacker infrastructure and triggering these rules.\n\n### Response and Remediation\n\n- If suspicious or malicious behavior is observed, take immediate action to isolate activity to prevent further post-compromise behavior.\n- One example of a response if a machine matched a command and control IP address would be to add an entry to a network device such as a firewall or proxy appliance to prevent any outbound activity from leaving that machine.\n- Another example of a response with a malicious file hash match would involve validating if the file was properly quarantined, reviewing current running processes for any abnormal activity, and investigating for any other follow-up actions such as persistence or lateral movement.\n\nThis rule was deprecated in the 8.8 version of the Elastic Stack for performance reasons. Users using 8.8+ versions should disable this rule and enable indicator-based rules instead:\n\n* Threat Intel IP Address Indicator Match - 0c41e478-5263-4c69-8f9e-7dfd2c22da64\n* Threat Intel Hash Indicator Match - aab184d3-72b3-4639-b242-6597c99d8bca\n* Threat Intel Windows Registry Indicator Match - a61809f3-fb5b-465c-8bff-23a8a068ac60\n* Threat Intel URL Indicator Match - f3e22c8b-ea47-45d1-b502-b57b6de950b3", - "query": "file.hash.*:* or file.pe.imphash:* or source.ip:* or destination.ip:* or url.full:* or registry.path:*\n", - "references": [ - "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html" - ], - "required_fields": [ - { - "ecs": true, - "name": "destination.ip", - "type": "ip" - }, - { - "ecs": false, - "name": "file.hash.*", - "type": "unknown" - }, - { - "ecs": true, - "name": "file.pe.imphash", - "type": "keyword" - }, - { - "ecs": true, - "name": "registry.path", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "url.full", - "type": "wildcard" - } - ], - "risk_score": 99, - "rule_id": "699e9fdb-b77c-4c01-995c-1c15019b9c43", - "setup": "This rule was deprecated in the 8.8 version of the Elastic Stack for performance reasons. Users using 8.8+ versions should disable this rule and enable indicator-based rules instead:\n\nThreat Intel IP Address Indicator Match - 0c41e478-5263-4c69-8f9e-7dfd2c22da64Threat Intel Hash Indicator Match - aab184d3-72b3-4639-b242-6597c99d8bcaThreat Intel Windows Registry Indicator Match - a61809f3-fb5b-465c-8bff-23a8a068ac60Threat Intel URL Indicator Match - f3e22c8b-ea47-45d1-b502-b57b6de950b3", - "severity": "critical", - "tags": [ - "OS: Windows", - "Data Source: Elastic Endgame", - "Resources: Investigation Guide" - ], - "threat_filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.module", - "negate": false, - "params": { - "query": "threatintel" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.module": "threatintel" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.category", - "negate": false, - "params": { - "query": "threat" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.category": "threat" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.kind", - "negate": false, - "params": { - "query": "enrichment" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.kind": "enrichment" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "disabled": false, - "key": "event.type", - "negate": false, - "params": { - "query": "indicator" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "event.type": "indicator" - } - } - } - ], - "threat_index": [ - "filebeat-8*" - ], - "threat_indicator_path": "threat.indicator", - "threat_language": "kuery", - "threat_mapping": [ - { - "entries": [ - { - "field": "file.hash.md5", - "type": "mapping", - "value": "threat.indicator.file.hash.md5" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha1", - "type": "mapping", - "value": "threat.indicator.file.hash.sha1" - } - ] - }, - { - "entries": [ - { - "field": "file.hash.sha256", - "type": "mapping", - "value": "threat.indicator.file.hash.sha256" - } - ] - }, - { - "entries": [ - { - "field": "file.pe.imphash", - "type": "mapping", - "value": "threat.indicator.file.pe.imphash" - } - ] - }, - { - "entries": [ - { - "field": "source.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "destination.ip", - "type": "mapping", - "value": "threat.indicator.ip" - } - ] - }, - { - "entries": [ - { - "field": "url.full", - "type": "mapping", - "value": "threat.indicator.url.full" - } - ] - }, - { - "entries": [ - { - "field": "registry.path", - "type": "mapping", - "value": "threat.indicator.registry.path" - } - ] - } - ], - "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:threatintel and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:* or threat.indicator.ip:* or threat.indicator.registry.path:* or threat.indicator.url.full:*)", - "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", - "timeline_title": "Generic Threat Match Timeline", - "type": "threat_match", - "version": 204 - }, - "id": "699e9fdb-b77c-4c01-995c-1c15019b9c43_204", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/69c251fb-a5d6-4035-b5ec-40438bd829ff_106.json b/packages/security_detection_engine/kibana/security_rule/69c251fb-a5d6-4035-b5ec-40438bd829ff_106.json new file mode 100644 index 00000000000..1d4985c60cd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/69c251fb-a5d6-4035-b5ec-40438bd829ff_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of bcdedit.exe to delete boot configuration data. This tactic is sometimes used as by malware or an attacker as a destructive technique.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Modification of Boot Configuration", + "note": "## Triage and analysis\n\n### Investigating Modification of Boot Configuration\n\nBoot entry parameters, or boot parameters, are optional, system-specific settings that represent configuration options. These are stored in a boot configuration data (BCD) store, and administrators can use utilities like `bcdedit.exe` to configure these.\n\nThis rule identifies the usage of `bcdedit.exe` to:\n\n- Disable Windows Error Recovery (recoveryenabled).\n- Ignore errors if there is a failed boot, failed shutdown, or failed checkpoint (bootstatuspolicy ignoreallfailures).\n\nThese are common steps in destructive attacks by adversaries leveraging ransomware.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Check if any files on the host machine have been encrypted.\n\n### False positive analysis\n\n- The usage of these options is not inherently malicious. Administrators can modify these configurations to force a machine to boot for troubleshooting or data recovery purposes.\n\n### Related rules\n\n- Deleting Backup Catalogs with Wbadmin - 581add16-df76-42bb-af8e-c979bfb39a59\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If any other destructive action was identified on the host, it is recommended to prioritize the investigation and look for ransomware preparation and execution activities.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"bcdedit.exe\" or process.pe.original_file_name == \"bcdedit.exe\") and\n (\n (process.args : \"/set\" and process.args : \"bootstatuspolicy\" and process.args : \"ignoreallfailures\") or\n (process.args : \"no\" and process.args : \"recoveryenabled\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "69c251fb-a5d6-4035-b5ec-40438bd829ff", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "69c251fb-a5d6-4035-b5ec-40438bd829ff_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6a8ab9cc-4023-4d17-b5df-1a3e16882ce7_105.json b/packages/security_detection_engine/kibana/security_rule/6a8ab9cc-4023-4d17-b5df-1a3e16882ce7_105.json new file mode 100644 index 00000000000..ca17f0e7c32 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6a8ab9cc-4023-4d17-b5df-1a3e16882ce7_105.json @@ -0,0 +1,127 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn any child processes. This may indicate a code injection or an equivalent form of exploitation.", + "false_positives": [ + "Changes to Windows services or a rarely executed child process." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Service Host Child Process - Childless Service", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"svchost.exe\" and\n\n /* based on svchost service arguments -s svcname where the service is known to be childless */\n\n process.parent.args : (\"WdiSystemHost\",\"LicenseManager\",\n \"StorSvc\",\"CDPSvc\",\"cdbhsvc\",\"BthAvctpSvc\",\"SstpSvc\",\"WdiServiceHost\",\n \"imgsvc\",\"TrkWks\",\"WpnService\",\"IKEEXT\",\"PolicyAgent\",\"CryptSvc\",\n \"netprofm\",\"ProfSvc\",\"StateRepository\",\"camsvc\",\"LanmanWorkstation\",\n \"NlaSvc\",\"EventLog\",\"hidserv\",\"DisplayEnhancementService\",\"ShellHWDetection\",\n \"AppHostSvc\",\"fhsvc\",\"CscService\",\"PushToInstall\") and\n\n /* unknown FPs can be added here */\n\n not process.name : (\"WerFault.exe\",\"WerFaultSecure.exe\",\"wermgr.exe\") and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\RelPost.exe\" and process.parent.args : \"WdiSystemHost\") and\n not (process.name : \"rundll32.exe\" and\n process.args : \"?:\\\\WINDOWS\\\\System32\\\\winethc.dll,ForceProxyDetectionOnNextRun\" and process.parent.args : \"WdiServiceHost\") and\n not (process.executable : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\", \"?:\\\\Windows\\\\System32\\\\Kodak\\\\kds_i4x50\\\\lib\\\\lexexe.exe\") and\n process.parent.args : \"imgsvc\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/", + "subtechnique": [ + { + "id": "T1055.012", + "name": "Process Hollowing", + "reference": "https://attack.mitre.org/techniques/T1055/012/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "6a8ab9cc-4023-4d17-b5df-1a3e16882ce7_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6aace640-e631-4870-ba8e-5fdda09325db_107.json b/packages/security_detection_engine/kibana/security_rule/6aace640-e631-4870-ba8e-5fdda09325db_107.json new file mode 100644 index 00000000000..3e518b61030 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6aace640-e631-4870-ba8e-5fdda09325db_107.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.", + "false_positives": [ + "Legitimate exchange system administration activity." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Exporting Exchange Mailbox via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Exporting Exchange Mailbox via PowerShell\n\nEmail mailboxes and their information can be valuable assets for attackers. Company mailboxes often contain sensitive information such as login credentials, intellectual property, financial data, and personal information, making them high-value targets for malicious actors.\n\nThe `New-MailBoxExportRequest` cmdlet is used to begin the process of exporting contents of a primary mailbox or archive to a .pst file. Note that this is done on a per-mailbox basis and this cmdlet is available only in on-premises Exchange.\n\nAttackers can abuse this functionality in preparation for exfiltrating contents, which is likely to contain sensitive and strategic data.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the export operation:\n - Identify the user account that performed the action and whether it should perform this kind of action.\n - Contact the account owner and confirm whether they are aware of this activity.\n - Check if this operation was approved and performed according to the organization's change management policy.\n - Retrieve the operation status and use the `Get-MailboxExportRequest` cmdlet to review previous requests.\n - By default, no group in Exchange has the privilege to import or export mailboxes. Investigate administrators that assigned the \"Mailbox Import Export\" privilege for abnormal activity.\n- Investigate if there is a significant quantity of export requests in the alert timeframe. This operation is done on a per-mailbox basis and can be part of a mass export.\n- If the operation was completed successfully:\n - Check if the file is on the path specified in the command.\n - Investigate if the file was compressed, archived, or retrieved by the attacker for exfiltration.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and it is done with proper approval.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- If the involved host is not the Exchange server, isolate the host to prevent further post-compromise behavior.\n- Use the `Remove-MailboxExportRequest` cmdlet to remove fully or partially completed export requests.\n- Prioritize cases that involve personally identifiable information (PII) or other classified data.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges of users with the \"Mailbox Import Export\" privilege to ensure that the least privilege principle is being followed.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and \n process.command_line : (\"*MailboxExportRequest*\", \"*-Mailbox*-ContentFilter*\")\n", + "references": [ + "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", + "https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6aace640-e631-4870-ba8e-5fdda09325db", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1005", + "name": "Data from Local System", + "reference": "https://attack.mitre.org/techniques/T1005/" + }, + { + "id": "T1114", + "name": "Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/", + "subtechnique": [ + { + "id": "T1114.002", + "name": "Remote Email Collection", + "reference": "https://attack.mitre.org/techniques/T1114/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "6aace640-e631-4870-ba8e-5fdda09325db_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6ace94ba-f02c-4d55-9f53-87d99b6f9af4_1.json b/packages/security_detection_engine/kibana/security_rule/6ace94ba-f02c-4d55-9f53-87d99b6f9af4_1.json new file mode 100644 index 00000000000..776fda96b0d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6ace94ba-f02c-4d55-9f53-87d99b6f9af4_1.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of suspicious linux tools through ProxyChains. ProxyChains is a command-line tool that enables the routing of network connections through intermediary proxies, enhancing anonymity and enabling access to restricted resources. Attackers can exploit the ProxyChains utility to hide their true source IP address, evade detection, and perform malicious activities through a chain of proxy servers, potentially masking their identity and intentions.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Utility Launched via ProxyChains", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"proxychains\" and process.args : (\n \"ssh\", \"sshd\", \"sshuttle\", \"socat\", \"iodine\", \"iodined\", \"dnscat\", \"hans\", \"hans-ubuntu\", \"ptunnel-ng\",\n \"ssf\", \"3proxy\", \"ngrok\", \"gost\", \"pivotnacci\", \"chisel*\", \"nmap\", \"ping\", \"python*\", \"php*\", \"perl\", \"ruby\",\n \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\", \"java\", \"telnet\", \"ftp\", \"curl\", \"wget\")\n", + "references": [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "6ace94ba-f02c-4d55-9f53-87d99b6f9af4", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "6ace94ba-f02c-4d55-9f53-87d99b6f9af4_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6b84d470-9036-4cc0-a27c-6d90bbfe81ab_105.json b/packages/security_detection_engine/kibana/security_rule/6b84d470-9036-4cc0-a27c-6d90bbfe81ab_105.json new file mode 100644 index 00000000000..3707f4750c0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6b84d470-9036-4cc0-a27c-6d90bbfe81ab_105.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of a compression utility to collect known files containing sensitive information, such as credentials and system configurations.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Sensitive Files Compression", + "query": "event.category:process and host.os.type:linux and event.type:start and\n process.name:(zip or tar or gzip or hdiutil or 7z) and\n process.args:\n (\n /root/.ssh/id_rsa or\n /root/.ssh/id_rsa.pub or\n /root/.ssh/id_ed25519 or\n /root/.ssh/id_ed25519.pub or\n /root/.ssh/authorized_keys or\n /root/.ssh/authorized_keys2 or\n /root/.ssh/known_hosts or\n /root/.bash_history or\n /etc/hosts or\n /home/*/.ssh/id_rsa or\n /home/*/.ssh/id_rsa.pub or\n /home/*/.ssh/id_ed25519 or\n /home/*/.ssh/id_ed25519.pub or\n /home/*/.ssh/authorized_keys or\n /home/*/.ssh/authorized_keys2 or\n /home/*/.ssh/known_hosts or\n /home/*/.bash_history or\n /root/.aws/credentials or\n /root/.aws/config or\n /home/*/.aws/credentials or\n /home/*/.aws/config or\n /root/.docker/config.json or\n /home/*/.docker/config.json or\n /etc/group or\n /etc/passwd or\n /etc/shadow or\n /etc/gshadow\n )\n", + "references": [ + "https://www.trendmicro.com/en_ca/research/20/l/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6b84d470-9036-4cc0-a27c-6d90bbfe81ab", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Collection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.001", + "name": "Credentials In Files", + "reference": "https://attack.mitre.org/techniques/T1552/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/", + "subtechnique": [ + { + "id": "T1560.001", + "name": "Archive via Utility", + "reference": "https://attack.mitre.org/techniques/T1560/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "6b84d470-9036-4cc0-a27c-6d90bbfe81ab_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6bed021a-0afb-461c-acbe-ffdb9574d3f3_107.json b/packages/security_detection_engine/kibana/security_rule/6bed021a-0afb-461c-acbe-ffdb9574d3f3_107.json new file mode 100644 index 00000000000..de39103c3af --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6bed021a-0afb-461c-acbe-ffdb9574d3f3_107.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the remote update to a computer account's DnsHostName attribute. If the new value set is a valid domain controller DNS hostname and the subject computer name is not a domain controller, then it's highly likely a preparation step to exploit CVE-2022-26923 in an attempt to elevate privileges from a standard domain user to domain admin privileges.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote Computer Account DnsHostName Update", + "query": "iam where event.action == \"changed-computer-account\" and user.id : (\"S-1-5-21-*\", \"S-1-12-1-*\") and\n\n /* if DnsHostName value equal a DC DNS hostname then it's highly suspicious */\n winlog.event_data.DnsHostName : \"??*\" and\n\n /* exclude FPs where DnsHostName starts with the ComputerName that was changed */\n not startswith~(winlog.event_data.DnsHostName, substring(winlog.event_data.TargetUserName, 0, length(winlog.event_data.TargetUserName) - 1))\n", + "references": [ + "https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4", + "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26923" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.DnsHostName", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetUserName", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "6bed021a-0afb-461c-acbe-ffdb9574d3f3", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Active Directory Monitoring", + "Data Source: Active Directory", + "Use Case: Vulnerability" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + }, + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.002", + "name": "Domain Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "6bed021a-0afb-461c-acbe-ffdb9574d3f3_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6cd1779c-560f-4b68-a8f1-11009b27fe63_104.json b/packages/security_detection_engine/kibana/security_rule/6cd1779c-560f-4b68-a8f1-11009b27fe63_104.json new file mode 100644 index 00000000000..933c9e915db --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6cd1779c-560f-4b68-a8f1-11009b27fe63_104.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies suspicious files being written by the Microsoft Exchange Server Unified Messaging (UM) service. This activity has been observed exploiting CVE-2021-26858.", + "false_positives": [ + "Files generated during installation will generate a lot of noise, so the rule should only be enabled after the fact.", + "This rule was tuned using the following baseline: https://raw.githubusercontent.com/microsoft/CSS-Exchange/main/Security/Baselines/baseline_15.2.792.5.csv from Microsoft. Depending on version, consult https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines to help determine normalcy." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Exchange Server UM Writing Suspicious Files", + "note": "## Triage and analysis\n\nPositive hits can be checked against the established Microsoft [baselines](https://github.com/microsoft/CSS-Exchange/tree/main/Security/Baselines).\n\nMicrosoft highly recommends that the best course of action is patching, but this may not protect already compromised systems\nfrom existing intrusions. Other tools for detecting and mitigating can be found within their Exchange support\n[repository](https://github.com/microsoft/CSS-Exchange/tree/main/Security)", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n process.name : (\"UMWorkerProcess.exe\", \"umservice.exe\") and\n file.extension : (\"php\", \"jsp\", \"js\", \"aspx\", \"asmx\", \"asax\", \"cfm\", \"shtml\") and\n (\n file.path : \"?:\\\\inetpub\\\\wwwroot\\\\aspnet_client\\\\*\" or\n\n (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\*\" and\n not (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\owa\\\\auth\\\\version\\\\*\" or\n file.name : (\"errorFE.aspx\", \"expiredpassword.aspx\", \"frowny.aspx\", \"GetIdToken.htm\", \"logoff.aspx\",\n \"logon.aspx\", \"OutlookCN.aspx\", \"RedirSuiteServiceProxy.aspx\", \"signout.aspx\"))) or\n\n (file.path : \"?:\\\\*\\\\Microsoft\\\\Exchange Server*\\\\FrontEnd\\\\HttpProxy\\\\ecp\\\\auth\\\\*\" and\n not file.name : \"TimeoutLogoff.aspx\")\n )\n", + "references": [ + "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", + "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6cd1779c-560f-4b68-a8f1-11009b27fe63", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "6cd1779c-560f-4b68-a8f1-11009b27fe63_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6d448b96-c922-4adb-b51c-b767f1ea5b76_107.json b/packages/security_detection_engine/kibana/security_rule/6d448b96-c922-4adb-b51c-b767f1ea5b76_107.json new file mode 100644 index 00000000000..d9442d13117 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6d448b96-c922-4adb-b51c-b767f1ea5b76_107.json @@ -0,0 +1,73 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies rare processes that do not usually run on individual hosts, which can indicate execution of unauthorized services, malware, or persistence mechanisms. Processes are considered rare when they only run occasionally as compared with other processes running on the host.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_rare_process_by_host_windows" + ], + "name": "Unusual Process For a Windows Host", + "note": "## Triage and analysis\n\n### Investigating Unusual Process For a Windows Host\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.\n\nThis rule uses a machine learning job to detect a Windows process that is rare and unusual for an individual Windows host in your environment.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n - Investigate the process metadata \u2014 such as the digital signature, directory, etc. \u2014 to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.\n- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE NOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR user_account == null)\"}}\n - !{osquery{\"label\":\"Retrieve Service Unisgned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid, services.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path = authenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76\n- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5\n- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "6d448b96-c922-4adb-b51c-b767f1ea5b76", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 107 + }, + "id": "6d448b96-c922-4adb-b51c-b767f1ea5b76_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_3.json b/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_3.json new file mode 100644 index 00000000000..228a5f898e0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_3.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days.", + "from": "now-9m", + "history_window_start": "now-15d", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "First Time Seen Commonly Abused Remote Access Tool Execution", + "new_terms_fields": [ + "host.id" + ], + "note": "## Triage and analysis\n\n### Investigating First Time Seen Commonly Abused Remote Access Tool Execution\n\nRemote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.\n\nAt the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.\n\nThis rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Check if the execution of the remote access tool is approved by the organization's IT department.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Contact the account owner and confirm whether they are aware of this activity.\n - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.\n- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.\n- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type: \"windows\" and\n\n event.category: \"process\" and event.type : \"start\" and\n\n (\n process.code_signature.subject_name : (\n TeamViewer* or \"NetSupport Ltd\" or \"GlavSoft\" or \"LogMeIn, Inc.\" or \"Ammyy LLC\" or\n \"Nanosystems S.r.l.\" or \"Remote Utilities LLC\" or \"ShowMyPC\" or \"Splashtop Inc.\" or\n \"Yakhnovets Denis Aleksandrovich IP\" or \"Pro Softnet Corporation\" or \"BeamYourScreen GmbH\" or\n \"RealVNC\" or \"uvnc\" or \"SAFIB\") or\n\n process.name.caseless : (\n \"teamviewer.exe\" or \"apc_Admin.exe\" or \"apc_host.exe\" or \"SupremoHelper.exe\" or \"rfusclient.exe\" or\n \"spclink.exe\" or \"smpcview.exe\" or \"ROMServer.exe\" or \"strwinclt.exe\" or \"RPCSuite.exe\" or \"RemotePCDesktop.exe\" or\n \"RemotePCService.exe\" or \"tvn.exe\" or \"LMIIgnition.exe\" or \"B4-Service.exe\" or \"Mikogo-Service.exe\" or \"AnyDesk.exe\" or\n \"Splashtop-streamer.exe\" or AA_v*.exe, or \"rutserv.exe\" or \"rutview.exe\" or \"vncserver.exe\" or \"vncviewer.exe\" or\n \"tvnserver.exe\" or \"tvnviewer.exe\" or \"winvnc.exe\" or \"RemoteDesktopManager.exe\" or \"LogMeIn.exe\" or ScreenConnect*.exe or\n \"RemotePC.exe\" or \"r_server.exe\" or \"radmin.exe\" or \"ROMServer.exe\" or \"ROMViewer.exe\" or \"DWRCC.exe\" or \"AeroAdmin.exe\" or\n \"ISLLightClient.exe\" or \"ISLLight.exe\" or \"AteraAgent.exe\" or \"SRService.exe\")\n\t) and\n\n\tnot (process.pe.original_file_name : (\"G2M.exe\" or \"Updater.exe\" or \"powershell.exe\") and process.code_signature.subject_name : \"LogMeIn, Inc.\")\n", + "references": [ + "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/", + "https://attack.mitre.org/techniques/T1219/" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.name.caseless", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6e1a2cc4-d260-11ed-8829-f661ea17fbcc", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Software", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "6e1a2cc4-d260-11ed-8829-f661ea17fbcc_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_4.json b/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_4.json new file mode 100644 index 00000000000..94ee40380d1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6e1a2cc4-d260-11ed-8829-f661ea17fbcc_4.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may install legitimate remote access tools (RAT) to compromised endpoints for further command-and-control (C2). Adversaries can rely on installed RATs for persistence, execution of native commands and more. This rule detects when a process is started whose name or code signature resembles commonly abused RATs. This is a New Terms rule type indicating the host has not seen this RAT process started before within the last 30 days.", + "from": "now-9m", + "history_window_start": "now-15d", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "First Time Seen Commonly Abused Remote Access Tool Execution", + "new_terms_fields": [ + "host.id" + ], + "note": "## Triage and analysis\n\n### Investigating First Time Seen Commonly Abused Remote Access Tool Execution\n\nRemote access software is a class of tools commonly used by IT departments to provide support by connecting securely to users' computers. Remote access is an ever-growing market where new companies constantly offer new ways of quickly accessing remote systems.\n\nAt the same pace as IT departments adopt these tools, the attackers also adopt them as part of their workflow to connect into an interactive session, maintain access with legitimate software as a persistence mechanism, drop malicious software, etc.\n\nThis rule detects when a remote access tool is seen in the environment for the first time in the last 15 days, enabling analysts to investigate and enforce the correct usage of such tools.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Check if the execution of the remote access tool is approved by the organization's IT department.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Contact the account owner and confirm whether they are aware of this activity.\n - If the tool is not approved for use in the organization, the employee could have been tricked into installing it and providing access to a malicious third party. Investigate whether this third party could be attempting to scam the end-user or gain access to the environment through social engineering.\n- Investigate any abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- If an authorized support person or administrator used the tool to conduct legitimate support or remote access, consider reinforcing that only tooling approved by the IT policy should be used. The analyst can dismiss the alert if no other suspicious behavior is observed involving the host or users.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Run a full scan using the antimalware tool in place. This scan can reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If an unauthorized third party did the access via social engineering, consider improvements to the security awareness program.\n- Enforce that only tooling approved by the IT policy should be used for remote access purposes and only by authorized staff.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type: \"windows\" and\n\n event.category: \"process\" and event.type : \"start\" and\n\n (\n process.code_signature.subject_name : (\n TeamViewer* or \"NetSupport Ltd\" or \"GlavSoft\" or \"LogMeIn, Inc.\" or \"Ammyy LLC\" or\n \"Nanosystems S.r.l.\" or \"Remote Utilities LLC\" or \"ShowMyPC\" or \"Splashtop Inc.\" or\n \"Yakhnovets Denis Aleksandrovich IP\" or \"Pro Softnet Corporation\" or \"BeamYourScreen GmbH\" or\n \"RealVNC\" or \"uvnc\" or \"SAFIB\") or\n\n process.name.caseless : (\n \"teamviewer.exe\" or \"apc_Admin.exe\" or \"apc_host.exe\" or \"SupremoHelper.exe\" or \"rfusclient.exe\" or\n \"spclink.exe\" or \"smpcview.exe\" or \"ROMServer.exe\" or \"strwinclt.exe\" or \"RPCSuite.exe\" or \"RemotePCDesktop.exe\" or\n \"RemotePCService.exe\" or \"tvn.exe\" or \"LMIIgnition.exe\" or \"B4-Service.exe\" or \"Mikogo-Service.exe\" or \"AnyDesk.exe\" or\n \"Splashtop-streamer.exe\" or AA_v*.exe, or \"rutserv.exe\" or \"rutview.exe\" or \"vncserver.exe\" or \"vncviewer.exe\" or\n \"tvnserver.exe\" or \"tvnviewer.exe\" or \"winvnc.exe\" or \"RemoteDesktopManager.exe\" or \"LogMeIn.exe\" or ScreenConnect*.exe or\n \"RemotePC.exe\" or \"r_server.exe\" or \"radmin.exe\" or \"ROMServer.exe\" or \"ROMViewer.exe\" or \"DWRCC.exe\" or \"AeroAdmin.exe\" or\n \"ISLLightClient.exe\" or \"ISLLight.exe\" or \"AteraAgent.exe\" or \"SRService.exe\")\n\t) and\n\n\tnot (process.pe.original_file_name : (\"G2M.exe\" or \"Updater.exe\" or \"powershell.exe\") and process.code_signature.subject_name : \"LogMeIn, Inc.\")\n", + "references": [ + "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/", + "https://attack.mitre.org/techniques/T1219/" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.name.caseless", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6e1a2cc4-d260-11ed-8829-f661ea17fbcc", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1219", + "name": "Remote Access Software", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 4 + }, + "id": "6e1a2cc4-d260-11ed-8829-f661ea17fbcc_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6e40d56f-5c0e-4ac6-aece-bee96645b172_105.json b/packages/security_detection_engine/kibana/security_rule/6e40d56f-5c0e-4ac6-aece-bee96645b172_105.json new file mode 100644 index 00000000000..52b49a273ad --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6e40d56f-5c0e-4ac6-aece-bee96645b172_105.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Searches for rare processes running on multiple hosts in an entire fleet or network. This reduces the detection of false positives since automated maintenance processes usually only run occasionally on a single machine but are common to all or many hosts in a fleet.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_process_all_hosts" + ], + "name": "Anomalous Process For a Windows Population", + "note": "## Triage and analysis\n\n### Investigating Anomalous Process For a Windows Population\n\nSearching for abnormal Windows processes is a good methodology to find potentially malicious activity within a network. Understanding what is commonly run within an environment and developing baselines for legitimate activity can help uncover potential malware and suspicious behaviors.\n\nThis rule uses a machine learning job to detect a Windows process that is rare and unusual for all of the monitored Windows hosts in your environment.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n - Investigate the process metadata \u2014 such as the digital signature, directory, etc. \u2014 to obtain more context that can indicate whether the executable is associated with an expected software vendor or package.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Consider the user as identified by the `user.name` field. Is this program part of an expected workflow for the user who ran this program on this host?\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Validate if the activity has a consistent cadence (for example, if it runs monthly or quarterly), as it could be part of a monthly or quarterly business process.\n- Examine the arguments and working directory of the process. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSyste' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Retrieve Service Unisgned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Related Rules\n\n- Unusual Process For a Windows Host - 6d448b96-c922-4adb-b51c-b767f1ea5b76\n- Unusual Windows Path Activity - 445a342e-03fb-42d0-8656-0367eb2dead5\n- Unusual Windows Process Calling the Metadata Service - abae61a8-c560-4dbd-acca-1e1438bff36b\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "6e40d56f-5c0e-4ac6-aece-bee96645b172", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Persistence", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 105 + }, + "id": "6e40d56f-5c0e-4ac6-aece-bee96645b172_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6e9b351e-a531-4bdc-b73e-7034d6eed7ff_104.json b/packages/security_detection_engine/kibana/security_rule/6e9b351e-a531-4bdc-b73e-7034d6eed7ff_104.json new file mode 100644 index 00000000000..f281b0fb275 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6e9b351e-a531-4bdc-b73e-7034d6eed7ff_104.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of macOS built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumeration of Users or Groups via Built-in Commands", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n (\n process.name : (\"ldapsearch\", \"dsmemberutil\") or\n (process.name : \"dscl\" and\n process.args : (\"read\", \"-read\", \"list\", \"-list\", \"ls\", \"search\", \"-search\") and\n process.args : (\"/Active Directory/*\", \"/Users*\", \"/Groups*\"))\n\t) and\n not process.parent.executable : (\"/Applications/NoMAD.app/Contents/MacOS/NoMAD\",\n \"/Applications/ZoomPresence.app/Contents/MacOS/ZoomPresence\",\n \"/Applications/Sourcetree.app/Contents/MacOS/Sourcetree\",\n \"/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon\",\n \"/Applications/Jamf Connect.app/Contents/MacOS/Jamf Connect\",\n \"/usr/local/jamf/bin/jamf\",\n \"/Library/Application Support/AirWatch/hubd\",\n \"/opt/jc/bin/jumpcloud-agent\",\n \"/Applications/ESET Endpoint Antivirus.app/Contents/MacOS/esets_daemon\",\n \"/Applications/ESET Endpoint Security.app/Contents/MacOS/esets_daemon\",\n \"/Library/PrivilegedHelperTools/com.fortinet.forticlient.uninstall_helper\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "6e9b351e-a531-4bdc-b73e-7034d6eed7ff", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "6e9b351e-a531-4bdc-b73e-7034d6eed7ff_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6ea41894-66c3-4df7-ad6b-2c5074eb3df8_105.json b/packages/security_detection_engine/kibana/security_rule/6ea41894-66c3-4df7-ad6b-2c5074eb3df8_105.json new file mode 100644 index 00000000000..d5255db7ab4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6ea41894-66c3-4df7-ad6b-2c5074eb3df8_105.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.", + "false_positives": [ + "Legit Application Crash with rare Werfault commandline value" + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Windows Error Manager Masquerading", + "note": "## Triage and analysis\n\n### Investigating Potential Windows Error Manager Masquerading\n\nBy examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading and deserve further investigation.\n\nThis rule identifies a potential malicious process masquerading as `wermgr.exe` or `WerFault.exe`, by looking for a process creation with no arguments followed by a network connection.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by host.id, process.entity_id with maxspan = 5s\n [process where host.os.type == \"windows\" and event.type:\"start\" and process.name : (\"wermgr.exe\", \"WerFault.exe\") and process.args_count == 1]\n [network where host.os.type == \"windows\" and process.name : (\"wermgr.exe\", \"WerFault.exe\") and network.protocol != \"dns\" and\n network.direction : (\"outgoing\", \"egress\") and destination.ip !=\"::1\" and destination.ip !=\"127.0.0.1\"\n ]\n", + "references": [ + "https://twitter.com/SBousseaden/status/1235533224337641473", + "https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/", + "https://app.any.run/tasks/26051d84-b68e-4afb-8a9a-76921a271b81/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6ea41894-66c3-4df7-ad6b-2c5074eb3df8", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "6ea41894-66c3-4df7-ad6b-2c5074eb3df8_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6ea55c81-e2ba-42f2-a134-bccf857ba922_106.json b/packages/security_detection_engine/kibana/security_rule/6ea55c81-e2ba-42f2-a134-bccf857ba922_106.json new file mode 100644 index 00000000000..fcf242aa12f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6ea55c81-e2ba-42f2-a134-bccf857ba922_106.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of Windows Management Instrumentation Command (WMIC) to discover certain System Security Settings such as AntiVirus or Host Firewall details.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Security Software Discovery using WMIC", + "note": "## Triage and analysis\n\n### Investigating Security Software Discovery using WMIC\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `wmic` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name:\"wmic.exe\" or process.pe.original_file_name:\"wmic.exe\") and\n process.args:\"/namespace:\\\\\\\\root\\\\SecurityCenter2\" and process.args:\"Get\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6ea55c81-e2ba-42f2-a134-bccf857ba922", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "6ea55c81-e2ba-42f2-a134-bccf857ba922_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/6ee947e9-de7e-4281-a55d-09289bdf947e_1.json b/packages/security_detection_engine/kibana/security_rule/6ee947e9-de7e-4281-a55d-09289bdf947e_1.json new file mode 100644 index 00000000000..f24c3e2e60f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/6ee947e9-de7e-4281-a55d-09289bdf947e_1.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for a set of Linux utilities that can be used for tunneling and port forwarding. Attackers can leverage tunneling and port forwarding techniques to bypass network defenses, establish hidden communication channels, and gain unauthorized access to internal resources, facilitating data exfiltration, lateral movement, and remote control.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Tunneling and/or Port Forwarding", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and ((\n// gost \u0026 pivotnacci - spawned without process.parent.name\n(process.name == \"gost\" and process.args : (\"-L*\", \"-C*\", \"-R*\")) or (process.name == \"pivotnacci\")) or (\n// ssh\n(process.name in (\"ssh\", \"sshd\") and (process.args in (\"-R\", \"-L\", \"D\", \"-w\") and process.args_count \u003e= 4)) or\n// sshuttle\n(process.name == \"sshuttle\" and process.args in (\"-r\", \"--remote\", \"-l\", \"--listen\") and process.args_count \u003e= 4) or\n// socat\n(process.name == \"socat\" and process.args : (\"TCP4-LISTEN:*\", \"SOCKS*\") and process.args_count \u003e= 3) or\n// chisel\n(process.name : \"chisel*\" and process.args in (\"client\", \"server\")) or\n// iodine(d), dnscat, hans, ptunnel-ng, ssf, 3proxy \u0026 ngrok \n(process.name in (\"iodine\", \"iodined\", \"dnscat\", \"hans\", \"hans-ubuntu\", \"ptunnel-ng\", \"ssf\", \"3proxy\", \"ngrok\"))\n) and process.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\"))\n", + "references": [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "6ee947e9-de7e-4281-a55d-09289bdf947e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "6ee947e9-de7e-4281-a55d-09289bdf947e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/70d12c9c-0dbd-4a1a-bc44-1467502c9cf6_105.json b/packages/security_detection_engine/kibana/security_rule/70d12c9c-0dbd-4a1a-bc44-1467502c9cf6_105.json new file mode 100644 index 00000000000..ba2a53a2dbd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/70d12c9c-0dbd-4a1a-bc44-1467502c9cf6_105.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via WMI Standard Registry Provider", + "query": "registry where host.os.type == \"windows\" and\n registry.data.strings != null and process.name : \"WmiPrvSe.exe\" and\n registry.path : (\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ServiceDLL\",\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ImagePath\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\",\n \"HKEY_USERS\\\\*\\\\Environment\\\\UserInitMprLogonScript\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Load\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"HKEY_USERS\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ServiceDLL\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ImagePath\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Environment\\\\UserInitMprLogonScript\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\Load\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\Shell\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logoff\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Logon\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Shutdown\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\System\\\\Scripts\\\\Startup\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Ctf\\\\LangBarAddin\\\\*\\\\FilePath\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Exec\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Internet Explorer\\\\Extensions\\\\*\\\\Script\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Command Processor\\\\Autorun\"\n )\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov", + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + }, + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "70d12c9c-0dbd-4a1a-bc44-1467502c9cf6_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/70fa1af4-27fd-4f26-bd03-50b6af6b9e24_104.json b/packages/security_detection_engine/kibana/security_rule/70fa1af4-27fd-4f26-bd03-50b6af6b9e24_104.json new file mode 100644 index 00000000000..3e626ddb3c0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/70fa1af4-27fd-4f26-bd03-50b6af6b9e24_104.json @@ -0,0 +1,111 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to unload the Elastic Endpoint Security kernel extension via the kextunload command.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Unload Elastic Endpoint Security Kernel Extension", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:kextunload and process.args:(\"/System/Library/Extensions/EndpointSecurity.kext\" or \"EndpointSecurity.kext\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "70fa1af4-27fd-4f26-bd03-50b6af6b9e24", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "70fa1af4-27fd-4f26-bd03-50b6af6b9e24_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_105.json b/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_105.json new file mode 100644 index 00000000000..e5712619a5c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of Dynamic Linker Preload Shared Object", + "query": "event.category:file and host.os.type:linux and not event.type:deletion and file.path:/etc/ld.so.preload and\nevent.action:(updated or renamed or rename)\n", + "references": [ + "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "717f82c2-7741-4f9b-85b8-d06aeb853f4f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "717f82c2-7741-4f9b-85b8-d06aeb853f4f_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_106.json b/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_106.json new file mode 100644 index 00000000000..90cfc1cf60a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/717f82c2-7741-4f9b-85b8-d06aeb853f4f_106.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modification of the dynamic linker preload shared object (ld.so.preload). Adversaries may execute malicious payloads by hijacking the dynamic linker used to load libraries.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of Dynamic Linker Preload Shared Object", + "query": "event.category:file and host.os.type:linux and not event.type:deletion and file.path:/etc/ld.so.preload and\nevent.action:(updated or renamed or rename)\n", + "references": [ + "https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "717f82c2-7741-4f9b-85b8-d06aeb853f4f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 106 + }, + "id": "717f82c2-7741-4f9b-85b8-d06aeb853f4f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_109.json b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_109.json new file mode 100644 index 00000000000..31710a22168 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_109.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual File Creation - Alternate Data Stream", + "note": "## Triage and analysis\n\n### Investigating Unusual File Creation - Alternate Data Stream\n\nAlternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.\n\nThe regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty, contains the data inside the file. So any data stream that has a name is considered an alternate data stream.\n\nAttackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:\n - `Get-Content C:\\Path\\To\\file.exe -stream SampleAlternateDataStreamName`\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of process executable and file conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n\n file.path : \"C:\\\\*:*\" and\n not file.path : \"C:\\\\*:zone.identifier*\" and\n\n not process.executable :\n (\"?:\\\\windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\Windows\\\\explorer.exe\",\n \"?:\\\\Windows\\\\System32\\\\sihost.exe\",\n \"?:\\\\Windows\\\\System32\\\\PickerHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\SearchProtocolHost.exe\",\n \"?:\\\\Program Files (x86)\\\\Dropbox\\\\Client\\\\Dropbox.exe\",\n \"?:\\\\Program Files\\\\Rivet Networks\\\\SmartByte\\\\SmartByteNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\n \"?:\\\\Program Files\\\\ExpressConnect\\\\ExpressConnectNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe\",\n \"?:\\\\Program Files(x86)\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\") and\n\n file.extension :\n (\n \"pdf\",\n \"dll\",\n \"png\",\n \"exe\",\n \"dat\",\n \"com\",\n \"bat\",\n \"cmd\",\n \"sys\",\n \"vbs\",\n \"ps1\",\n \"hta\",\n \"txt\",\n \"vbe\",\n \"js\",\n \"wsh\",\n \"docx\",\n \"doc\",\n \"xlsx\",\n \"xls\",\n \"pptx\",\n \"ppt\",\n \"rtf\",\n \"gif\",\n \"jpg\",\n \"png\",\n \"bmp\",\n \"img\",\n \"iso\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "71bccb61-e19b-452f-b104-79a60e546a95", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.004", + "name": "NTFS File Attributes", + "reference": "https://attack.mitre.org/techniques/T1564/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 109 + }, + "id": "71bccb61-e19b-452f-b104-79a60e546a95_109", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_110.json b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_110.json new file mode 100644 index 00000000000..c5451ba3b7b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_110.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual File Creation - Alternate Data Stream", + "note": "## Triage and analysis\n\n### Investigating Unusual File Creation - Alternate Data Stream\n\nAlternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.\n\nThe regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty, contains the data inside the file. So any data stream that has a name is considered an alternate data stream.\n\nAttackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:\n - `Get-Content C:\\Path\\To\\file.exe -stream SampleAlternateDataStreamName`\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of process executable and file conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n\n file.path : \"C:\\\\*:*\" and\n not file.path : \n (\"C:\\\\*:zone.identifier*\",\n \"C:\\\\users\\\\*\\\\appdata\\\\roaming\\\\microsoft\\\\teams\\\\old_weblogs_*:$DATA\") and\n\n not process.executable :\n (\"?:\\\\windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\Windows\\\\explorer.exe\",\n \"?:\\\\Windows\\\\System32\\\\sihost.exe\",\n \"?:\\\\Windows\\\\System32\\\\PickerHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\SearchProtocolHost.exe\",\n \"?:\\\\Program Files (x86)\\\\Dropbox\\\\Client\\\\Dropbox.exe\",\n \"?:\\\\Program Files\\\\Rivet Networks\\\\SmartByte\\\\SmartByteNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\n \"?:\\\\Program Files\\\\ExpressConnect\\\\ExpressConnectNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe\",\n \"?:\\\\Program Files(x86)\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\") and\n\n file.extension :\n (\n \"pdf\",\n \"dll\",\n \"png\",\n \"exe\",\n \"dat\",\n \"com\",\n \"bat\",\n \"cmd\",\n \"sys\",\n \"vbs\",\n \"ps1\",\n \"hta\",\n \"txt\",\n \"vbe\",\n \"js\",\n \"wsh\",\n \"docx\",\n \"doc\",\n \"xlsx\",\n \"xls\",\n \"pptx\",\n \"ppt\",\n \"rtf\",\n \"gif\",\n \"jpg\",\n \"png\",\n \"bmp\",\n \"img\",\n \"iso\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "71bccb61-e19b-452f-b104-79a60e546a95", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.004", + "name": "NTFS File Attributes", + "reference": "https://attack.mitre.org/techniques/T1564/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 110 + }, + "id": "71bccb61-e19b-452f-b104-79a60e546a95_110", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_111.json b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_111.json new file mode 100644 index 00000000000..ccd0208fe5f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/71bccb61-e19b-452f-b104-79a60e546a95_111.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious creation of Alternate Data Streams on highly targeted files. This is uncommon for legitimate files and sometimes done by adversaries to hide malware.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual File Creation - Alternate Data Stream", + "note": "## Triage and analysis\n\n### Investigating Unusual File Creation - Alternate Data Stream\n\nAlternate Data Streams (ADS) are file attributes only found on the NTFS file system. In this file system, files are built up from a couple of attributes; one of them is $Data, also known as the data attribute.\n\nThe regular data stream, also referred to as the unnamed data stream since the name string of this attribute is empty, contains the data inside the file. So any data stream that has a name is considered an alternate data stream.\n\nAttackers can abuse these alternate data streams to hide malicious files, string payloads, etc. This rule detects the creation of alternate data streams on highly targeted file types.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Retrieve the contents of the alternate data stream, and analyze it for potential maliciousness. Analysts can use the following PowerShell cmdlet to accomplish this:\n - `Get-Content C:\\Path\\To\\file.exe -stream SampleAlternateDataStreamName`\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of process executable and file conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n\n file.path : \"C:\\\\*:*\" and\n not file.path : \n (\"C:\\\\*:zone.identifier*\",\n \"C:\\\\users\\\\*\\\\appdata\\\\roaming\\\\microsoft\\\\teams\\\\old_weblogs_*:$DATA\") and\n\n not process.executable :\n (\"?:\\\\windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\Windows\\\\explorer.exe\",\n \"?:\\\\Windows\\\\System32\\\\sihost.exe\",\n \"?:\\\\Windows\\\\System32\\\\PickerHost.exe\",\n \"?:\\\\Windows\\\\System32\\\\SearchProtocolHost.exe\",\n \"?:\\\\Program Files (x86)\\\\Dropbox\\\\Client\\\\Dropbox.exe\",\n \"?:\\\\Program Files\\\\Rivet Networks\\\\SmartByte\\\\SmartByteNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\",\n \"?:\\\\Program Files\\\\ExpressConnect\\\\ExpressConnectNetworkService.exe\",\n \"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe\",\n \"?:\\\\Program Files(x86)\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\EXCEL.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\OUTLOOK.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\POWERPNT.EXE\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\",\n \"?:\\\\Program Files\\\\Microsoft Office\\\\root\\\\*\\\\WINWORD.EXE\") and\n\n file.extension :\n (\n \"pdf\",\n \"dll\",\n \"png\",\n \"exe\",\n \"dat\",\n \"com\",\n \"bat\",\n \"cmd\",\n \"sys\",\n \"vbs\",\n \"ps1\",\n \"hta\",\n \"txt\",\n \"vbe\",\n \"js\",\n \"wsh\",\n \"docx\",\n \"doc\",\n \"xlsx\",\n \"xls\",\n \"pptx\",\n \"ppt\",\n \"rtf\",\n \"gif\",\n \"jpg\",\n \"png\",\n \"bmp\",\n \"img\",\n \"iso\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "71bccb61-e19b-452f-b104-79a60e546a95", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.004", + "name": "NTFS File Attributes", + "reference": "https://attack.mitre.org/techniques/T1564/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 111 + }, + "id": "71bccb61-e19b-452f-b104-79a60e546a95_111", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/71c5cb27-eca5-4151-bb47-64bc3f883270_104.json b/packages/security_detection_engine/kibana/security_rule/71c5cb27-eca5-4151-bb47-64bc3f883270_104.json new file mode 100644 index 00000000000..b8d7413e4be --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/71c5cb27-eca5-4151-bb47-64bc3f883270_104.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious Image Loading of the Remote Desktop Services ActiveX Client (mstscax), this may indicate the presence of RDP lateral movement capability.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious RDP ActiveX Client Loaded", + "note": "", + "query": "any where host.os.type == \"windows\" and\n (event.category : (\"library\", \"driver\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : \"mstscax.dll\" or file.name : \"mstscax.dll\") and\n /* depending on noise in your env add here extra paths */\n process.executable :\n (\n \"C:\\\\Windows\\\\*\",\n \"C:\\\\Users\\\\Public\\\\*\",\n \"C:\\\\Users\\\\Default\\\\*\",\n \"C:\\\\Intel\\\\*\",\n \"C:\\\\PerfLogs\\\\*\",\n \"C:\\\\ProgramData\\\\*\",\n \"\\\\Device\\\\Mup\\\\*\",\n \"\\\\\\\\*\"\n ) and\n /* add here FPs */\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\mstsc.exe\", \"C:\\\\Windows\\\\SysWOW64\\\\mstsc.exe\")\n", + "references": [ + "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "71c5cb27-eca5-4151-bb47-64bc3f883270", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "71c5cb27-eca5-4151-bb47-64bc3f883270_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/729aa18d-06a6-41c7-b175-b65b739b1181_104.json b/packages/security_detection_engine/kibana/security_rule/729aa18d-06a6-41c7-b175-b65b739b1181_104.json new file mode 100644 index 00000000000..5e90aa5b253 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/729aa18d-06a6-41c7-b175-b65b739b1181_104.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to reset an Okta user's enrolled multi-factor authentication (MFA) factors. An adversary may attempt to reset the MFA factors for an Okta user's account in order to register new MFA factors and abuse the account to blend in with normal activity in the victim's environment.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if the MFA factors for Okta user accounts are regularly reset in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Reset MFA Factors for an Okta User Account", + "note": "", + "query": "event.dataset:okta.system and event.action:user.mfa.factor.reset_all\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "729aa18d-06a6-41c7-b175-b65b739b1181", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Tactic: Persistence", + "Use Case: Identity and Access Audit", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1098", + "name": "Account Manipulation", + "reference": "https://attack.mitre.org/techniques/T1098/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "729aa18d-06a6-41c7-b175-b65b739b1181_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7405ddf1-6c8e-41ce-818f-48bea6bcaed8_107.json b/packages/security_detection_engine/kibana/security_rule/7405ddf1-6c8e-41ce-818f-48bea6bcaed8_107.json new file mode 100644 index 00000000000..1c7a7e5fe71 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7405ddf1-6c8e-41ce-818f-48bea6bcaed8_107.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Windows contains accessibility features that may be launched with a key combination before a user has logged in. An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Modification of Accessibility Binaries", + "note": "## Triage and analysis\n\n### Investigating Potential Modification of Accessibility Binaries\n\nAdversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features. Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen). An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.\n\nMore details can be found [here](https://attack.mitre.org/techniques/T1546/008/).\n\nThis rule looks for the execution of supposed accessibility binaries that don't match any of the accessibility features binaries' original file names, which is likely a custom binary deployed by the attacker.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"Utilman.exe\", \"winlogon.exe\") and user.name == \"SYSTEM\" and\n process.args :\n (\n \"C:\\\\Windows\\\\System32\\\\osk.exe\",\n \"C:\\\\Windows\\\\System32\\\\Magnify.exe\",\n \"C:\\\\Windows\\\\System32\\\\Narrator.exe\",\n \"C:\\\\Windows\\\\System32\\\\Sethc.exe\",\n \"utilman.exe\",\n \"ATBroker.exe\",\n \"DisplaySwitch.exe\",\n \"sethc.exe\"\n )\n and not process.pe.original_file_name in\n (\n \"osk.exe\",\n \"sethc.exe\",\n \"utilman2.exe\",\n \"DisplaySwitch.exe\",\n \"ATBroker.exe\",\n \"ScreenMagnifier.exe\",\n \"SR.exe\",\n \"Narrator.exe\",\n \"magnify.exe\",\n \"MAGNIFY.EXE\"\n )\n\n/* uncomment once in winlogbeat to avoid bypass with rogue process with matching pe original file name */\n/* and process.code_signature.subject_name == \"Microsoft Windows\" and process.code_signature.status == \"trusted\" */\n", + "references": [ + "https://www.elastic.co/blog/practical-security-engineering-stateful-detection" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.008", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1546/008/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.008", + "name": "Accessibility Features", + "reference": "https://attack.mitre.org/techniques/T1546/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "7405ddf1-6c8e-41ce-818f-48bea6bcaed8_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1_104.json b/packages/security_detection_engine/kibana/security_rule/7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1_104.json new file mode 100644 index 00000000000..a741e20f5b8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1_104.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to an environment variable using the built-in launchctl command. Adversaries may execute their own malicious payloads by hijacking certain environment variables to load arbitrary libraries or bypass certain restrictions.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of Environment Variable via Launchctl", + "query": "event.category:process and host.os.type:macos and event.type:start and \n process.name:launchctl and \n process.args:(setenv and not (ANT_HOME or \n DBUS_LAUNCHD_SESSION_BUS_SOCKET or \n EDEN_ENV or \n LG_WEBOS_TV_SDK_HOME or \n RUNTIME_JAVA_HOME or \n WEBOS_CLI_TV or \n JAVA*_HOME) and \n not *.vmoptions) and \n not process.parent.executable:(\"/Applications/IntelliJ IDEA CE.app/Contents/jbr/Contents/Home/lib/jspawnhelper\" or \n /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or \n /Applications/NoMachine.app/Contents/Frameworks/bin/nxserver.bin or \n /usr/local/bin/kr)\n", + "references": [ + "https://github.com/rapid7/metasploit-framework/blob/master//modules/post/osx/escalate/tccbypass.rb" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.007", + "name": "Path Interception by PATH Environment Variable", + "reference": "https://attack.mitre.org/techniques/T1574/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "7453e19e-3dbf-4e4e-9ae0-33d6c6ed15e1_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/745b0119-0560-43ba-860a-7235dd8cee8d_104.json b/packages/security_detection_engine/kibana/security_rule/745b0119-0560-43ba-860a-7235dd8cee8d_104.json new file mode 100644 index 00000000000..c722b231110 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/745b0119-0560-43ba-860a-7235dd8cee8d_104.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. In addition, unauthorized user activity often takes place during non-business hours.", + "false_positives": [ + "Users working late, or logging in from unusual time zones while traveling, may trigger this rule." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_rare_hour_for_a_user", + "name": "Unusual Hour for a User to Logon", + "note": "## Triage and analysis\n\n### Investigating Unusual Hour for a User to Logon\n\nThis rule uses a machine learning job to detect a user logging in at a time of day that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different time zones. It can also indicate unauthorized user activity, as it often occurs during non-business hours.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, network connections, data access, and logon events.\n- Investigate other alerts associated with the involved users during the past 48 hours.\n\n### False positive analysis\n\n- Users may need to log in during non-business hours to perform work-related tasks. Examine whether the company policies authorize this or if the activity is done under change management.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "745b0119-0560-43ba-860a-7235dd8cee8d", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "745b0119-0560-43ba-860a-7235dd8cee8d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/746edc4c-c54c-49c6-97a1-651223819448_103.json b/packages/security_detection_engine/kibana/security_rule/746edc4c-c54c-49c6-97a1-651223819448_103.json new file mode 100644 index 00000000000..9bf3fa5f1f0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/746edc4c-c54c-49c6-97a1-651223819448_103.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a rare and unusual DNS query that indicate network activity with unusual DNS domains. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, when a user clicks on a link in a phishing email or opens a malicious document, a request may be sent to download and run a payload from an uncommon domain. When malware is already running, it may send requests to an uncommon DNS domain the malware uses for command-and-control communication.", + "false_positives": [ + "A newly installed program or one that runs rarely as part of a monthly or quarterly workflow could trigger this alert. Network activity that occurs rarely, in small quantities, can trigger this alert. Possible examples are browsing technical support or vendor networks sparsely. A user who visits a new or unique web destination may trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "packetbeat_rare_dns_question", + "name": "Unusual DNS Activity", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "746edc4c-c54c-49c6-97a1-651223819448", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.004", + "name": "DNS", + "reference": "https://attack.mitre.org/techniques/T1071/004/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "746edc4c-c54c-49c6-97a1-651223819448_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_1.json b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_1.json new file mode 100644 index 00000000000..73db05ab465 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_1.json @@ -0,0 +1,71 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Sysctl File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action in (\"opened-file\", \"read-file\", \"wrote-to-file\") and\nfile.path : (\"/etc/sysctl.conf\", \"/etc/sysctl.d\", \"/etc/sysctl.d/*\") and not process.name == \"auditbeat\"\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7592c127-89fb-4209-a8f6-f9944dfd7e02", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "7592c127-89fb-4209-a8f6-f9944dfd7e02_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_2.json b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_2.json new file mode 100644 index 00000000000..5150d488cfe --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_2.json @@ -0,0 +1,71 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Sysctl File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action in (\"opened-file\", \"read-file\", \"wrote-to-file\") and\nfile.path : (\"/etc/sysctl.conf\", \"/etc/sysctl.d\", \"/etc/sysctl.d/*\") and \nnot process.name in (\"auditbeat\", \"systemd-sysctl\")\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7592c127-89fb-4209-a8f6-f9944dfd7e02", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "7592c127-89fb-4209-a8f6-f9944dfd7e02_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_3.json b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_3.json new file mode 100644 index 00000000000..f142ab7d198 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7592c127-89fb-4209-a8f6-f9944dfd7e02_3.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Monitors file events on sysctl configuration files (e.g., /etc/sysctl.conf, /etc/sysctl.d/*.conf) to identify potential unauthorized access or manipulation of system-level configuration settings. Attackers may tamper with the sysctl configuration files to modify kernel parameters, potentially compromising system stability, performance, or security.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Sysctl File Event", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action in (\"opened-file\", \"read-file\", \"wrote-to-file\") and\nfile.path : (\"/etc/sysctl.conf\", \"/etc/sysctl.d\", \"/etc/sysctl.d/*\") and \nnot process.name in (\"auditbeat\", \"systemd-sysctl\", \"dpkg\", \"dnf\", \"yum\", \"rpm\", \"apt\")\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7592c127-89fb-4209-a8f6-f9944dfd7e02", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n\n```\n-w /etc/sysctl.conf -p wa -k sysctl\n-w /etc/sysctl.d -p wa -k sysctl\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "7592c127-89fb-4209-a8f6-f9944dfd7e02_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/75dcb176-a575-4e33-a020-4a52aaa1b593_1.json b/packages/security_detection_engine/kibana/security_rule/75dcb176-a575-4e33-a020-4a52aaa1b593_1.json new file mode 100644 index 00000000000..1597dea37bd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/75dcb176-a575-4e33-a020-4a52aaa1b593_1.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies attempts to modify services start settings using processes other than services.exe. Attackers may attempt to modify security and monitoring services to avoid detection or delay response.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Service Disabled via Registry Modification", + "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start\"\n ) and registry.data.strings : (\"3\", \"4\") and\n not \n (\n process.name : \"services.exe\" and user.id : \"S-1-5-18\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "75dcb176-a575-4e33-a020-4a52aaa1b593", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "75dcb176-a575-4e33-a020-4a52aaa1b593_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76152ca1-71d0-4003-9e37-0983e12832da_103.json b/packages/security_detection_engine/kibana/security_rule/76152ca1-71d0-4003-9e37-0983e12832da_103.json new file mode 100644 index 00000000000..f28cc668a29 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76152ca1-71d0-4003-9e37-0983e12832da_103.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A sudoers file specifies the commands users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via Sudoers File Modification", + "query": "event.category:process and event.type:start and process.args:(echo and *NOPASSWD*ALL*)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "76152ca1-71d0-4003-9e37-0983e12832da", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "76152ca1-71d0-4003-9e37-0983e12832da_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66_7.json b/packages/security_detection_engine/kibana/security_rule/764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66_7.json new file mode 100644 index 00000000000..bb949352bd9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66_7.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identify access to sensitive Active Directory object attributes that contains credentials and decryption keys such as unixUserPassword, ms-PKI-AccountCredentials and msPKI-CredentialRoamingTokens.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Access to a Sensitive LDAP Attribute", + "note": "The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nAudit Policies \u003e\nDS Access \u003e\nAudit Directory Service Access (Success,Failure)\n```", + "query": "any where event.action == \"Directory Service Access\" and event.code == \"4662\" and\n\n not winlog.event_data.SubjectUserSid : \"S-1-5-18\" and\n\n winlog.event_data.Properties : (\n /* unixUserPassword */\n \"*612cb747-c0e8-4f92-9221-fdd5f15b550d*\",\n\n /* ms-PKI-AccountCredentials */\n \"*b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7*\",\n\n /* ms-PKI-DPAPIMasterKeys */\n \"*b3f93023-9239-4f7c-b99c-6745d87adbc2*\",\n\n /* msPKI-CredentialRoamingTokens */\n \"*b7ff5a38-0818-42b0-8110-d3d154c97f24*\"\n ) and\n\n /*\n Excluding noisy AccessMasks\n 0x0 undefined and 0x100 Control Access\n https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662\n */\n not winlog.event_data.AccessMask in (\"0x0\", \"0x100\")\n", + "references": [ + "https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming", + "https://social.technet.microsoft.com/wiki/contents/articles/11483.windows-credential-roaming.aspx", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.AccessMask", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.Properties", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserSid", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66", + "setup": "", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Use Case: Active Directory Monitoring", + "Data Source: Active Directory" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 7 + }, + "id": "764c9fcd-4c4c-41e6-a0c7-d6c46c2eff66_7", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/766d3f91-3f12-448c-b65f-20123e9e9e8c_105.json b/packages/security_detection_engine/kibana/security_rule/766d3f91-3f12-448c-b65f-20123e9e9e8c_105.json new file mode 100644 index 00000000000..227fc6878d4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/766d3f91-3f12-448c-b65f-20123e9e9e8c_105.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a hidden shared object (.so) file. Users can mark specific files as hidden simply by putting a \".\" as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Creation of Hidden Shared Object File", + "note": "", + "query": "file where host.os.type == \"linux\" and event.type == \"creation\" and file.extension == \"so\" and file.name : \".*.so\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "766d3f91-3f12-448c-b65f-20123e9e9e8c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "766d3f91-3f12-448c-b65f-20123e9e9e8c_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_1.json b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_1.json new file mode 100644 index 00000000000..386d2c47244 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_1.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Child Process", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_2.json b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_2.json new file mode 100644 index 00000000000..7b777d7fc15 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_2.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Child Process", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_3.json b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_3.json new file mode 100644 index 00000000000..8757d31d36a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_3.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Child Process", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_4.json b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_4.json new file mode 100644 index 00000000000..e02f4ce40f9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76e4d92b-61c1-4a95-ab61-5fd94179a1ee_4.json @@ -0,0 +1,130 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a suspicious process chain. Any reverse shells spawned by the specified utilities that are initialized from a single process followed by a network connection attempt will be captured through this rule. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Child Process", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and (\n (process.name : \"python*\" and process.args : \"-c\") or\n (process.name : \"php*\" and process.args : \"-r\") or\n (process.name : \"perl\" and process.args : \"-e\") or\n (process.name : \"ruby\" and process.args : (\"-e\", \"-rsocket\")) or\n (process.name : \"lua*\" and process.args : \"-e\") or\n (process.name : \"openssl\" and process.args : \"-connect\") or\n (process.name : (\"nc\", \"ncat\", \"netcat\") and process.args_count \u003e= 3) or\n (process.name : \"telnet\" and process.args_count \u003e= 3) or\n (process.name : \"awk\")) and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and \n process.name : (\"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\") and\n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "76e4d92b-61c1-4a95-ab61-5fd94179a1ee_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/76fd43b7-3480-4dd9-8ad7-8bd36bfad92f_106.json b/packages/security_detection_engine/kibana/security_rule/76fd43b7-3480-4dd9-8ad7-8bd36bfad92f_106.json new file mode 100644 index 00000000000..50a083f0341 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/76fd43b7-3480-4dd9-8ad7-8bd36bfad92f_106.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Desktop Tunneling Detected", + "note": "## Triage and analysis\n\n### Investigating Potential Remote Desktop Tunneling Detected\n\nProtocol Tunneling is a mechanism that involves explicitly encapsulating a protocol within another for various use cases, ranging from providing an outer layer of encryption (similar to a VPN) to enabling traffic that network appliances would filter to reach their destination.\n\nAttackers may tunnel Remote Desktop Protocol (RDP) traffic through other protocols like Secure Shell (SSH) to bypass network restrictions that block incoming RDP connections but may be more permissive to other protocols.\n\nThis rule looks for command lines involving the `3389` port, which RDP uses by default and options commonly associated with tools that perform tunneling.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine network data to determine if the host communicated with external servers using the tunnel.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n- Investigate the command line for the execution of programs that are unrelated to tunneling, like Remote Desktop clients.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Take the necessary actions to disable the tunneling, which can be a process kill, service deletion, registry key modification, etc. Inspect the host to learn which method was used and to determine a response for the case.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n /* RDP port and usual SSH tunneling related switches in command line */\n process.args : \"*:3389\" and\n process.args : (\"-L\", \"-P\", \"-R\", \"-pw\", \"-ssh\")\n", + "references": [ + "https://blog.netspi.com/how-to-access-rdp-over-a-reverse-ssh-tunnel/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "76fd43b7-3480-4dd9-8ad7-8bd36bfad92f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "76fd43b7-3480-4dd9-8ad7-8bd36bfad92f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/770e0c4d-b998-41e5-a62e-c7901fd7f470_106.json b/packages/security_detection_engine/kibana/security_rule/770e0c4d-b998-41e5-a62e-c7901fd7f470_106.json new file mode 100644 index 00000000000..82cab8caab7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/770e0c4d-b998-41e5-a62e-c7901fd7f470_106.json @@ -0,0 +1,128 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation Provider Service (WMIPrvSE).", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumeration Command Spawned via WMIPrvSE", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name:\n (\n \"arp.exe\",\n \"dsquery.exe\",\n \"dsget.exe\",\n \"gpresult.exe\",\n \"hostname.exe\",\n \"ipconfig.exe\",\n \"nbtstat.exe\",\n \"net.exe\",\n \"net1.exe\",\n \"netsh.exe\",\n \"netstat.exe\",\n \"nltest.exe\",\n \"ping.exe\",\n \"qprocess.exe\",\n \"quser.exe\",\n \"qwinsta.exe\",\n \"reg.exe\",\n \"sc.exe\",\n \"systeminfo.exe\",\n \"tasklist.exe\",\n \"tracert.exe\",\n \"whoami.exe\"\n ) and\n process.parent.name:\"wmiprvse.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "770e0c4d-b998-41e5-a62e-c7901fd7f470", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/" + }, + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/" + }, + { + "id": "T1016", + "name": "System Network Configuration Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/", + "subtechnique": [ + { + "id": "T1016.001", + "name": "Internet Connection Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/001/" + } + ] + }, + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "770e0c4d-b998-41e5-a62e-c7901fd7f470_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_1.json b/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_1.json new file mode 100644 index 00000000000..c689e96b1e5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_1.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Network Sweep Detected", + "query": "destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "781f8746-2180-4691-890c-4c96d11ca91d", + "severity": "medium", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.ip", + "value": 10 + } + ], + "field": [ + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 1 + }, + "id": "781f8746-2180-4691-890c-4c96d11ca91d_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_2.json b/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_2.json new file mode 100644 index 00000000000..1607a40ae2a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/781f8746-2180-4691-890c-4c96d11ca91d_2.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination hosts on commonly used network services.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Network Sweep Detected", + "query": "destination.port : (21 or 22 or 23 or 25 or 139 or 445 or 3389 or 5985 or 5986) and \nsource.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 21, + "rule_id": "781f8746-2180-4691-890c-4c96d11ca91d", + "severity": "low", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.ip", + "value": 100 + } + ], + "field": [ + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 2 + }, + "id": "781f8746-2180-4691-890c-4c96d11ca91d_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/78d3d8d9-b476-451d-a9e0-7a5addd70670_106.json b/packages/security_detection_engine/kibana/security_rule/78d3d8d9-b476-451d-a9e0-7a5addd70670_106.json new file mode 100644 index 00000000000..c4b29a31791 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/78d3d8d9-b476-451d-a9e0-7a5addd70670_106.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.", + "false_positives": [ + "Spikes in error message activity can also be due to bugs in cloud automation scripts or workflows; changes to cloud automation scripts or workflows; adoption of new services; changes in the way services are used; or changes to IAM privileges." + ], + "from": "now-60m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "high_distinct_count_error_message", + "name": "Spike in AWS Error Messages", + "note": "## Triage and analysis\n\n### Investigating Spike in AWS Error Messages\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.\n\nThis rule uses a machine learning job to detect a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.\n\n#### Possible investigation steps\n\n- Examine the history of the error. If the error only manifested recently, it might be related to recent changes in an automation module or script. You can find the error in the `aws.cloudtrail.error_code field` field.\n- Investigate other alerts associated with the user account during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, or network administrator activity.\n- Examine the request parameters. These may indicate the source of the program or the nature of the task being performed when the error occurred.\n - Check whether the error is related to unsuccessful attempts to enumerate or access objects, data, or secrets.\n- Considering the source IP address and geolocation of the user who issued the command:\n - Do they look normal for the calling user?\n - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?\n - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?\n- Contact the account owner and confirm whether they are aware of this activity if suspicious.\n- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.\n\n### False positive analysis\n\n- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.\n- The adoption of new services or the addition of new functionality to scripts may generate false positives.\n\n### Related Rules\n\n- Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276\n- Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1\n- Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1\n- Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Disable or limit the account during the investigation and response.\n- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:\n - Identify the account role in the cloud environment.\n - Assess the criticality of affected services and servers.\n - Work with your IT team to identify and minimize the impact on users.\n - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.\n - Identify any regulatory or legal ramifications related to this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.\n- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.\n- Consider enabling multi-factor authentication for users.\n- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.\n- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n- Take the actions needed to return affected systems, data, or services to their normal operational levels.\n- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "aws", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "78d3d8d9-b476-451d-a9e0-7a5addd70670", + "setup": "The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Domain: Cloud", + "Data Source: AWS", + "Data Source: Amazon Web Services", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Resources: Investigation Guide" + ], + "type": "machine_learning", + "version": 106 + }, + "id": "78d3d8d9-b476-451d-a9e0-7a5addd70670_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/78ef0c95-9dc2-40ac-a8da-5deb6293a14e_4.json b/packages/security_detection_engine/kibana/security_rule/78ef0c95-9dc2-40ac-a8da-5deb6293a14e_4.json new file mode 100644 index 00000000000..7088ba51e71 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/78ef0c95-9dc2-40ac-a8da-5deb6293a14e_4.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an unsigned library created in the last 5 minutes and subsequently loaded by a shared windows service (svchost). Adversaries may use this technique to maintain persistence or run with System privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unsigned DLL Loaded by Svchost", + "query": "library where host.os.type == \"windows\" and\n\n process.executable : \n (\"?:\\\\Windows\\\\System32\\\\svchost.exe\", \"?:\\\\Windows\\\\Syswow64\\\\svchost.exe\") and \n \n dll.code_signature.trusted != true and \n \n not dll.code_signature.status : (\"trusted\", \"errorExpired\", \"errorCode_endpoint*\") and \n \n dll.hash.sha256 != null and \n \n (\n /* DLL created within 5 minutes of the library load event - compatible with Elastic Endpoint 8.4+ */\n dll.Ext.relative_file_creation_time \u003c= 300 or \n \n /* unusual paths */\n dll.path :(\"?:\\\\ProgramData\\\\*\",\n \"?:\\\\Users\\\\*\",\n \"?:\\\\PerfLogs\\\\*\",\n \"?:\\\\Windows\\\\Tasks\\\\*\",\n \"?:\\\\Intel\\\\*\",\n \"?:\\\\AMD\\\\Temp\\\\*\",\n \"?:\\\\Windows\\\\AppReadiness\\\\*\",\n \"?:\\\\Windows\\\\ServiceState\\\\*\",\n \"?:\\\\Windows\\\\security\\\\*\",\n \"?:\\\\Windows\\\\IdentityCRL\\\\*\",\n \"?:\\\\Windows\\\\Branding\\\\*\",\n \"?:\\\\Windows\\\\csc\\\\*\",\n \"?:\\\\Windows\\\\DigitalLocker\\\\*\",\n \"?:\\\\Windows\\\\en-US\\\\*\",\n \"?:\\\\Windows\\\\wlansvc\\\\*\",\n \"?:\\\\Windows\\\\Prefetch\\\\*\",\n \"?:\\\\Windows\\\\Fonts\\\\*\",\n \"?:\\\\Windows\\\\diagnostics\\\\*\",\n \"?:\\\\Windows\\\\TAPI\\\\*\",\n \"?:\\\\Windows\\\\INF\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\Speech\\\\*\",\n \"?:\\\\windows\\\\tracing\\\\*\",\n \"?:\\\\windows\\\\IME\\\\*\",\n \"?:\\\\Windows\\\\Performance\\\\*\",\n \"?:\\\\windows\\\\intel\\\\*\",\n \"?:\\\\windows\\\\ms\\\\*\",\n \"?:\\\\Windows\\\\dot3svc\\\\*\",\n \"?:\\\\Windows\\\\panther\\\\*\",\n \"?:\\\\Windows\\\\RemotePackages\\\\*\",\n \"?:\\\\Windows\\\\OCR\\\\*\",\n \"?:\\\\Windows\\\\appcompat\\\\*\",\n \"?:\\\\Windows\\\\apppatch\\\\*\",\n \"?:\\\\Windows\\\\addins\\\\*\",\n \"?:\\\\Windows\\\\Setup\\\\*\",\n \"?:\\\\Windows\\\\Help\\\\*\",\n \"?:\\\\Windows\\\\SKB\\\\*\",\n \"?:\\\\Windows\\\\Vss\\\\*\",\n \"?:\\\\Windows\\\\servicing\\\\*\",\n \"?:\\\\Windows\\\\CbsTemp\\\\*\",\n \"?:\\\\Windows\\\\Logs\\\\*\",\n \"?:\\\\Windows\\\\WaaS\\\\*\",\n \"?:\\\\Windows\\\\twain_32\\\\*\",\n \"?:\\\\Windows\\\\ShellExperiences\\\\*\",\n \"?:\\\\Windows\\\\ShellComponents\\\\*\",\n \"?:\\\\Windows\\\\PLA\\\\*\",\n \"?:\\\\Windows\\\\Migration\\\\*\",\n \"?:\\\\Windows\\\\debug\\\\*\",\n \"?:\\\\Windows\\\\Cursors\\\\*\",\n \"?:\\\\Windows\\\\Containers\\\\*\",\n \"?:\\\\Windows\\\\Boot\\\\*\",\n \"?:\\\\Windows\\\\bcastdvr\\\\*\",\n \"?:\\\\Windows\\\\TextInput\\\\*\",\n \"?:\\\\Windows\\\\security\\\\*\",\n \"?:\\\\Windows\\\\schemas\\\\*\",\n \"?:\\\\Windows\\\\SchCache\\\\*\",\n \"?:\\\\Windows\\\\Resources\\\\*\",\n \"?:\\\\Windows\\\\rescache\\\\*\",\n \"?:\\\\Windows\\\\Provisioning\\\\*\",\n \"?:\\\\Windows\\\\PrintDialog\\\\*\",\n \"?:\\\\Windows\\\\PolicyDefinitions\\\\*\",\n \"?:\\\\Windows\\\\media\\\\*\",\n \"?:\\\\Windows\\\\Globalization\\\\*\",\n \"?:\\\\Windows\\\\L2Schemas\\\\*\",\n \"?:\\\\Windows\\\\LiveKernelReports\\\\*\",\n \"?:\\\\Windows\\\\ModemLogs\\\\*\",\n \"?:\\\\Windows\\\\ImmersiveControlPanel\\\\*\",\n \"?:\\\\$Recycle.Bin\\\\*\")\n ) and \n \n not dll.hash.sha256 : \n (\"3ed33e71641645367442e65dca6dab0d326b22b48ef9a4c2a2488e67383aa9a6\", \n \"b4db053f6032964df1b254ac44cb995ffaeb4f3ade09597670aba4f172cf65e4\", \n \"214c75f678bc596bbe667a3b520aaaf09a0e50c364a28ac738a02f867a085eba\", \n \"23aa95b637a1bf6188b386c21c4e87967ede80242327c55447a5bb70d9439244\", \n \"5050b025909e81ae5481db37beb807a80c52fc6dd30c8aa47c9f7841e2a31be7\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.Ext.relative_file_creation_time", + "type": "unknown" + }, + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "78ef0c95-9dc2-40ac-a8da-5deb6293a14e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "78ef0c95-9dc2-40ac-a8da-5deb6293a14e_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/79ce2c96-72f7-44f9-88ef-60fa1ac2ce47_1.json b/packages/security_detection_engine/kibana/security_rule/79ce2c96-72f7-44f9-88ef-60fa1ac2ce47_1.json new file mode 100644 index 00000000000..50dfd734c03 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/79ce2c96-72f7-44f9-88ef-60fa1ac2ce47_1.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of default system32 executables, either unsigned or signed with non-MS certificates. This could indicate the attempt to masquerade as system executables or backdoored and resigned legitimate executables.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as System32 Executable", + "query": "process where event.type == \"start\" and process.code_signature.status : \"*\" and\n process.name: (\n \"agentactivationruntimestarter.exe\", \"agentservice.exe\", \"aitstatic.exe\", \"alg.exe\", \"apphostregistrationverifier.exe\", \"appidcertstorecheck.exe\", \"appidpolicyconverter.exe\", \"appidtel.exe\", \"applicationframehost.exe\", \"applysettingstemplatecatalog.exe\", \"applytrustoffline.exe\", \"approvechildrequest.exe\", \"appvclient.exe\", \"appvdllsurrogate.exe\", \"appvnice.exe\", \"appvshnotify.exe\", \"arp.exe\", \"assignedaccessguard.exe\", \"at.exe\", \"atbroker.exe\", \"attrib.exe\", \"audiodg.exe\", \"auditpol.exe\", \"authhost.exe\", \"autochk.exe\", \"autoconv.exe\", \"autofmt.exe\", \"axinstui.exe\", \"baaupdate.exe\", \"backgroundtaskhost.exe\", \"backgroundtransferhost.exe\", \"bcdboot.exe\", \"bcdedit.exe\", \"bdechangepin.exe\", \"bdehdcfg.exe\", \"bdeuisrv.exe\", \"bdeunlock.exe\", \"bioiso.exe\", \"bitlockerdeviceencryption.exe\", \"bitlockerwizard.exe\", \"bitlockerwizardelev.exe\", \"bitsadmin.exe\", \"bootcfg.exe\", \"bootim.exe\", \"bootsect.exe\", \"bridgeunattend.exe\", \"browserexport.exe\", \"browser_broker.exe\", \"bthudtask.exe\", \"bytecodegenerator.exe\", \"cacls.exe\", \"calc.exe\", \"camerasettingsuihost.exe\", \"castsrv.exe\", \"certenrollctrl.exe\", \"certreq.exe\", \"certutil.exe\", \"change.exe\", \"changepk.exe\", \"charmap.exe\", \"checknetisolation.exe\", \"chglogon.exe\", \"chgport.exe\", \"chgusr.exe\", \"chkdsk.exe\", \"chkntfs.exe\", \"choice.exe\", \"cidiag.exe\", \"cipher.exe\", \"cleanmgr.exe\", \"cliconfg.exe\", \"clip.exe\", \"clipup.exe\", \"cloudexperiencehostbroker.exe\", \"cloudnotifications.exe\", \"cmd.exe\", \"cmdkey.exe\", \"cmdl32.exe\", \"cmmon32.exe\", \"cmstp.exe\", \"cofire.exe\", \"colorcpl.exe\", \"comp.exe\", \"compact.exe\", \"compattelrunner.exe\", \"compmgmtlauncher.exe\", \"comppkgsrv.exe\", \"computerdefaults.exe\", \"conhost.exe\", \"consent.exe\", \"control.exe\", \"convert.exe\", \"convertvhd.exe\", \"coredpussvr.exe\", \"credentialenrollmentmanager.exe\", \"credentialuibroker.exe\", \"credwiz.exe\", \"cscript.exe\", \"csrss.exe\", \"ctfmon.exe\", \"cttune.exe\", \"cttunesvr.exe\", \"custominstallexec.exe\", \"customshellhost.exe\", \"dashost.exe\", \"dataexchangehost.exe\", \"datastorecachedumptool.exe\", \"dccw.exe\", \"dcomcnfg.exe\", \"ddodiag.exe\", \"defrag.exe\", \"deploymentcsphelper.exe\", \"desktopimgdownldr.exe\", \"devicecensus.exe\", \"devicecredentialdeployment.exe\", \"deviceeject.exe\", \"deviceenroller.exe\", \"devicepairingwizard.exe\", \"deviceproperties.exe\", \"dfdwiz.exe\", \"dfrgui.exe\", \"dialer.exe\", \"directxdatabaseupdater.exe\", \"diskpart.exe\", \"diskperf.exe\", \"diskraid.exe\", \"disksnapshot.exe\", \"dism.exe\", \"dispdiag.exe\", \"displayswitch.exe\", \"djoin.exe\", \"dllhost.exe\", \"dllhst3g.exe\", \"dmcertinst.exe\", \"dmcfghost.exe\", \"dmclient.exe\", \"dmnotificationbroker.exe\", \"dmomacpmo.exe\", \"dnscacheugc.exe\", \"doskey.exe\", \"dpapimig.exe\", \"dpiscaling.exe\", \"dpnsvr.exe\", \"driverquery.exe\", \"drvinst.exe\", \"dsmusertask.exe\", \"dsregcmd.exe\", \"dstokenclean.exe\", \"dusmtask.exe\", \"dvdplay.exe\", \"dwm.exe\", \"dwwin.exe\", \"dxdiag.exe\", \"dxgiadaptercache.exe\", \"dxpserver.exe\", \"eap3host.exe\", \"easeofaccessdialog.exe\", \"easinvoker.exe\", \"easpolicymanagerbrokerhost.exe\", \"edpcleanup.exe\", \"edpnotify.exe\", \"eduprintprov.exe\", \"efsui.exe\", \"ehstorauthn.exe\", \"eoaexperiences.exe\", \"esentutl.exe\", \"eudcedit.exe\", \"eventcreate.exe\", \"eventvwr.exe\", \"expand.exe\", \"extrac32.exe\", \"fc.exe\", \"fclip.exe\", \"fhmanagew.exe\", \"filehistory.exe\", \"find.exe\", \"findstr.exe\", \"finger.exe\", \"fixmapi.exe\", \"fltmc.exe\", \"fodhelper.exe\", \"fondue.exe\", \"fontdrvhost.exe\", \"fontview.exe\", \"forfiles.exe\", \"fsavailux.exe\", \"fsiso.exe\", \"fsquirt.exe\", \"fsutil.exe\", \"ftp.exe\", \"fvenotify.exe\", \"fveprompt.exe\", \"gamebarpresencewriter.exe\", \"gamepanel.exe\", \"genvalobj.exe\", \"getmac.exe\", \"gpresult.exe\", \"gpscript.exe\", \"gpupdate.exe\", \"grpconv.exe\", \"hdwwiz.exe\", \"help.exe\", \"hostname.exe\", \"hvax64.exe\", \"hvix64.exe\", \"hvsievaluator.exe\", \"icacls.exe\", \"icsentitlementhost.exe\", \"icsunattend.exe\", \"ie4uinit.exe\", \"ie4ushowie.exe\", \"iesettingsync.exe\", \"ieunatt.exe\", \"iexpress.exe\", \"immersivetpmvscmgrsvr.exe\", \"infdefaultinstall.exe\", \"inputswitchtoasthandler.exe\", \"iotstartup.exe\", \"ipconfig.exe\", \"iscsicli.exe\", \"iscsicpl.exe\", \"isoburn.exe\", \"klist.exe\", \"ksetup.exe\", \"ktmutil.exe\", \"label.exe\", \"languagecomponentsinstallercomhandler.exe\", \"launchtm.exe\", \"launchwinapp.exe\", \"legacynetuxhost.exe\", \"licensemanagershellext.exe\", \"licensingdiag.exe\", \"licensingui.exe\", \"locationnotificationwindows.exe\", \"locator.exe\", \"lockapphost.exe\", \"lockscreencontentserver.exe\", \"lodctr.exe\", \"logagent.exe\", \"logman.exe\", \"logoff.exe\", \"logonui.exe\", \"lpkinstall.exe\", \"lpksetup.exe\", \"lpremove.exe\", \"lsaiso.exe\", \"lsass.exe\", \"magnify.exe\", \"makecab.exe\", \"manage-bde.exe\", \"mavinject.exe\", \"mbaeparsertask.exe\", \"mblctr.exe\", \"mbr2gpt.exe\", \"mcbuilder.exe\", \"mdeserver.exe\", \"mdmagent.exe\", \"mdmappinstaller.exe\", \"mdmdiagnosticstool.exe\", \"mdres.exe\", \"mdsched.exe\", \"mfpmp.exe\", \"microsoft.uev.cscunpintool.exe\", \"microsoft.uev.synccontroller.exe\", \"microsoftedgebchost.exe\", \"microsoftedgecp.exe\", \"microsoftedgedevtools.exe\", \"microsoftedgesh.exe\", \"mmc.exe\", \"mmgaserver.exe\", \"mobsync.exe\", \"mountvol.exe\", \"mousocoreworker.exe\", \"mpnotify.exe\", \"mpsigstub.exe\", \"mrinfo.exe\", \"mschedexe.exe\", \"msconfig.exe\", \"msdt.exe\", \"msdtc.exe\", \"msfeedssync.exe\", \"msg.exe\", \"mshta.exe\", \"msiexec.exe\", \"msinfo32.exe\", \"mspaint.exe\", \"msra.exe\", \"msspellcheckinghost.exe\", \"mstsc.exe\", \"mtstocom.exe\", \"muiunattend.exe\", \"multidigimon.exe\", \"musnotification.exe\", \"musnotificationux.exe\", \"musnotifyicon.exe\", \"narrator.exe\", \"nbtstat.exe\", \"ndadmin.exe\", \"ndkping.exe\", \"net.exe\", \"net1.exe\", \"netbtugc.exe\", \"netcfg.exe\", \"netcfgnotifyobjecthost.exe\", \"netevtfwdr.exe\", \"nethost.exe\", \"netiougc.exe\", \"netplwiz.exe\", \"netsh.exe\", \"netstat.exe\", \"newdev.exe\", \"ngciso.exe\", \"nltest.exe\", \"notepad.exe\", \"nslookup.exe\", \"ntoskrnl.exe\", \"ntprint.exe\", \"odbcad32.exe\", \"odbcconf.exe\", \"ofdeploy.exe\", \"omadmclient.exe\", \"omadmprc.exe\", \"openfiles.exe\", \"openwith.exe\", \"optionalfeatures.exe\", \"osk.exe\", \"pacjsworker.exe\", \"packagedcwalauncher.exe\", \"packageinspector.exe\", \"passwordonwakesettingflyout.exe\", \"pathping.exe\", \"pcalua.exe\", \"pcaui.exe\", \"pcwrun.exe\", \"perfmon.exe\", \"phoneactivate.exe\", \"pickerhost.exe\", \"pinenrollmentbroker.exe\", \"ping.exe\", \"pkgmgr.exe\", \"pktmon.exe\", \"plasrv.exe\", \"pnpunattend.exe\", \"pnputil.exe\", \"poqexec.exe\", \"pospaymentsworker.exe\", \"powercfg.exe\", \"presentationhost.exe\", \"presentationsettings.exe\", \"prevhost.exe\", \"printbrmui.exe\", \"printfilterpipelinesvc.exe\", \"printisolationhost.exe\", \"printui.exe\", \"proquota.exe\", \"provlaunch.exe\", \"provtool.exe\", \"proximityuxhost.exe\", \"prproc.exe\", \"psr.exe\", \"pwlauncher.exe\", \"qappsrv.exe\", \"qprocess.exe\", \"query.exe\", \"quser.exe\", \"qwinsta.exe\", \"rasautou.exe\", \"rasdial.exe\", \"raserver.exe\", \"rasphone.exe\", \"rdpclip.exe\", \"rdpinit.exe\", \"rdpinput.exe\", \"rdpsa.exe\", \"rdpsaproxy.exe\", \"rdpsauachelper.exe\", \"rdpshell.exe\", \"rdpsign.exe\", \"rdrleakdiag.exe\", \"reagentc.exe\", \"recdisc.exe\", \"recover.exe\", \"recoverydrive.exe\", \"refsutil.exe\", \"reg.exe\", \"regedt32.exe\", \"regini.exe\", \"register-cimprovider.exe\", \"regsvr32.exe\", \"rekeywiz.exe\", \"relog.exe\", \"relpost.exe\", \"remoteapplifetimemanager.exe\", \"remoteposworker.exe\", \"repair-bde.exe\", \"replace.exe\", \"reset.exe\", \"resetengine.exe\", \"resmon.exe\", \"rmactivate.exe\", \"rmactivate_isv.exe\", \"rmactivate_ssp.exe\", \"rmactivate_ssp_isv.exe\", \"rmclient.exe\", \"rmttpmvscmgrsvr.exe\", \"robocopy.exe\", \"route.exe\", \"rpcping.exe\", \"rrinstaller.exe\", \"rstrui.exe\", \"runas.exe\", \"rundll32.exe\", \"runexehelper.exe\", \"runlegacycplelevated.exe\", \"runonce.exe\", \"runtimebroker.exe\", \"rwinsta.exe\", \"sc.exe\", \"schtasks.exe\", \"scriptrunner.exe\", \"sdbinst.exe\", \"sdchange.exe\", \"sdclt.exe\", \"sdiagnhost.exe\", \"searchfilterhost.exe\", \"searchindexer.exe\", \"searchprotocolhost.exe\", \"secedit.exe\", \"secinit.exe\", \"securekernel.exe\", \"securityhealthhost.exe\", \"securityhealthservice.exe\", \"securityhealthsystray.exe\", \"sensordataservice.exe\", \"services.exe\", \"sessionmsg.exe\", \"sethc.exe\", \"setspn.exe\", \"settingsynchost.exe\", \"setupcl.exe\", \"setupugc.exe\", \"setx.exe\", \"sfc.exe\", \"sgrmbroker.exe\", \"sgrmlpac.exe\", \"shellappruntime.exe\", \"shrpubw.exe\", \"shutdown.exe\", \"sigverif.exe\", \"sihclient.exe\", \"sihost.exe\", \"slidetoshutdown.exe\", \"slui.exe\", \"smartscreen.exe\", \"smss.exe\", \"sndvol.exe\", \"snippingtool.exe\", \"snmptrap.exe\", \"sort.exe\", \"spaceagent.exe\", \"spaceman.exe\", \"spatialaudiolicensesrv.exe\", \"spectrum.exe\", \"spoolsv.exe\", \"sppextcomobj.exe\", \"sppsvc.exe\", \"srdelayed.exe\", \"srtasks.exe\", \"stordiag.exe\", \"subst.exe\", \"svchost.exe\", \"sxstrace.exe\", \"syncappvpublishingserver.exe\", \"synchost.exe\", \"sysreseterr.exe\", \"systeminfo.exe\", \"systempropertiesadvanced.exe\", \"systempropertiescomputername.exe\", \"systempropertiesdataexecutionprevention.exe\", \"systempropertieshardware.exe\", \"systempropertiesperformance.exe\", \"systempropertiesprotection.exe\", \"systempropertiesremote.exe\", \"systemreset.exe\", \"systemsettingsadminflows.exe\", \"systemsettingsbroker.exe\", \"systemsettingsremovedevice.exe\", \"systemuwplauncher.exe\", \"systray.exe\", \"tabcal.exe\", \"takeown.exe\", \"tapiunattend.exe\", \"tar.exe\", \"taskhostw.exe\", \"taskkill.exe\", \"tasklist.exe\", \"taskmgr.exe\", \"tcblaunch.exe\", \"tcmsetup.exe\", \"tcpsvcs.exe\", \"thumbnailextractionhost.exe\", \"tieringengineservice.exe\", \"timeout.exe\", \"tokenbrokercookies.exe\", \"tpminit.exe\", \"tpmtool.exe\", \"tpmvscmgr.exe\", \"tpmvscmgrsvr.exe\", \"tracerpt.exe\", \"tracert.exe\", \"tscon.exe\", \"tsdiscon.exe\", \"tskill.exe\", \"tstheme.exe\", \"tswbprxy.exe\", \"ttdinject.exe\", \"tttracer.exe\", \"typeperf.exe\", \"tzsync.exe\", \"tzutil.exe\", \"ucsvc.exe\", \"uevagentpolicygenerator.exe\", \"uevappmonitor.exe\", \"uevtemplatebaselinegenerator.exe\", \"uevtemplateconfigitemgenerator.exe\", \"uimgrbroker.exe\", \"unlodctr.exe\", \"unregmp2.exe\", \"upfc.exe\", \"upgraderesultsui.exe\", \"upnpcont.exe\", \"upprinterinstaller.exe\", \"useraccountbroker.exe\", \"useraccountcontrolsettings.exe\", \"userinit.exe\", \"usoclient.exe\", \"utcdecoderhost.exe\", \"utilman.exe\", \"vaultcmd.exe\", \"vds.exe\", \"vdsldr.exe\", \"verclsid.exe\", \"verifier.exe\", \"verifiergui.exe\", \"vssadmin.exe\", \"vssvc.exe\", \"w32tm.exe\", \"waasmedicagent.exe\", \"waitfor.exe\", \"wallpaperhost.exe\", \"wbadmin.exe\", \"wbengine.exe\", \"wecutil.exe\", \"werfault.exe\", \"werfaultsecure.exe\", \"wermgr.exe\", \"wevtutil.exe\", \"wextract.exe\", \"where.exe\", \"whoami.exe\", \"wiaacmgr.exe\", \"wiawow64.exe\", \"wifitask.exe\", \"wimserv.exe\", \"winbiodatamodeloobe.exe\", \"windows.media.backgroundplayback.exe\", \"windows.warp.jitservice.exe\", \"windowsactiondialog.exe\", \"windowsupdateelevatedinstaller.exe\", \"wininit.exe\", \"winload.exe\", \"winlogon.exe\", \"winresume.exe\", \"winrs.exe\", \"winrshost.exe\", \"winrtnetmuahostserver.exe\", \"winsat.exe\", \"winver.exe\", \"wkspbroker.exe\", \"wksprt.exe\", \"wlanext.exe\", \"wlrmdr.exe\", \"wmpdmc.exe\", \"workfolders.exe\", \"wowreg32.exe\", \"wpcmon.exe\", \"wpctok.exe\", \"wpdshextautoplay.exe\", \"wpnpinst.exe\", \"wpr.exe\", \"write.exe\", \"wscadminui.exe\", \"wscollect.exe\", \"wscript.exe\", \"wsl.exe\", \"wsmanhttpconfig.exe\", \"wsmprovhost.exe\", \"wsqmcons.exe\", \"wsreset.exe\", \"wuapihost.exe\", \"wuauclt.exe\", \"wudfcompanionhost.exe\", \"wudfhost.exe\", \"wusa.exe\", \"wwahost.exe\", \"xblgamesavetask.exe\", \"xcopy.exe\", \"xwizard.exe\", \"aggregatorhost.exe\", \"diskusage.exe\", \"dtdump.exe\", \"ism.exe\", \"ndkperfcmd.exe\", \"ntkrla57.exe\", \"securekernella57.exe\", \"spaceutil.exe\", \"configure-smremoting.exe\", \"dcgpofix.exe\", \"dcpromo.exe\", \"dimc.exe\", \"diskshadow.exe\", \"drvcfg.exe\", \"escunattend.exe\", \"iashost.exe\", \"ktpass.exe\", \"lbfoadmin.exe\", \"netdom.exe\", \"rdspnf.exe\", \"rsopprov.exe\", \"sacsess.exe\", \"servermanager.exe\", \"servermanagerlauncher.exe\", \"setres.exe\", \"tsecimp.exe\", \"vssuirun.exe\", \"webcache.exe\", \"win32calc.exe\", \"certoc.exe\", \"sdndiagnosticstask.exe\", \"xpsrchvw.exe\"\n ) and\n not (\n process.code_signature.subject_name in (\n \"Microsoft Windows\",\n \"Microsoft Corporation\",\n \"Microsoft Windows Publisher\"\n ) and process.code_signature.trusted == true\n ) and not process.code_signature.status: (\"errorCode_endpoint*\", \"errorUntrustedRoot\", \"errorChaining\") and\n not\n (\n process.executable: (\n \"?:\\\\Program Files\\\\Git\\\\usr\\\\bin\\\\hostname.exe\",\n \"?:\\\\Windows\\\\Temp\\\\{*}\\\\taskkill.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\{*}\\\\taskkill.exe\",\n \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\System32\\\\ie4ushowIE.exe\",\n \"?:\\\\Program Files\\\\Git\\\\usr\\\\bin\\\\find.exe\"\n )\n ) and\n not\n (\n (process.name: \"ucsvc.exe\" and process.code_signature.subject_name == \"Wellbia.com Co., Ltd.\" and process.code_signature.status: \"trusted\") or\n (process.name: \"pnputil.exe\" and process.code_signature.subject_name: \"Lenovo\" and process.code_signature.status: \"trusted\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "79ce2c96-72f7-44f9-88ef-60fa1ac2ce47", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "Data Source: Elastic Defend", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "79ce2c96-72f7-44f9-88ef-60fa1ac2ce47_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/79f0a1f7-ed6b-471c-8eb1-23abd6470b1c_4.json b/packages/security_detection_engine/kibana/security_rule/79f0a1f7-ed6b-471c-8eb1-23abd6470b1c_4.json new file mode 100644 index 00000000000..c7f36e5756e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/79f0a1f7-ed6b-471c-8eb1-23abd6470b1c_4.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies Certreq making an HTTP Post request. Adversaries could abuse Certreq to exfiltrate data to a remote URL.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Exfiltration via Certreq", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"CertReq.exe\" or process.pe.original_file_name == \"CertReq.exe\") and process.args : \"-Post\"\n", + "references": [ + "https://lolbas-project.github.io/lolbas/Binaries/Certreq/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "79f0a1f7-ed6b-471c-8eb1-23abd6470b1c", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "79f0a1f7-ed6b-471c-8eb1-23abd6470b1c_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_1.json b/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_1.json new file mode 100644 index 00000000000..7b38836f346 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_1.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation through Writable Docker Socket", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \n(\n (process.name == \"docker\" and process.args : \"run\" and process.args : \"-it\" and \n process.args : (\"unix://*/docker.sock\", \"unix://*/dockershim.sock\")) or \n (process.name == \"socat\" and process.args : (\"UNIX-CONNECT:*/docker.sock\", \"UNIX-CONNECT:*/dockershim.sock\"))\n) and not user.Ext.real.id : \"0\" and not group.Ext.real.id : \"0\"\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Domain: Container" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_2.json b/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_2.json new file mode 100644 index 00000000000..44f7d47b574 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_2.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the usage of Docker runtime sockets to escalate privileges on Linux systems. Docker sockets by default are only be writable by the root user and docker group. Attackers that have permissions to write to these sockets may be able to create and run a container that allows them to escalate privileges and gain further access onto the host file system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation through Writable Docker Socket", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and \n(\n (process.name == \"docker\" and process.args : \"run\" and process.args : \"-it\" and \n process.args : (\"unix://*/docker.sock\", \"unix://*/dockershim.sock\")) or \n (process.name == \"socat\" and process.args : (\"UNIX-CONNECT:*/docker.sock\", \"UNIX-CONNECT:*/dockershim.sock\"))\n) and not user.Ext.real.id : \"0\" and not group.Ext.real.id : \"0\"\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation#automatic-enumeration-and-escape" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Domain: Container", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "7acb2de3-8465-472a-8d9c-ccd7b73d0ed8_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7b8bfc26-81d2-435e-965c-d722ee397ef1_106.json b/packages/security_detection_engine/kibana/security_rule/7b8bfc26-81d2-435e-965c-d722ee397ef1_106.json new file mode 100644 index 00000000000..c85fe29baea --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7b8bfc26-81d2-435e-965c-d722ee397ef1_106.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to enumerate hosts in a network using the built-in Windows net.exe tool.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Network Enumeration", + "note": "## Triage and analysis\n\n### Investigating Windows Network Enumeration\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `net` utility to enumerate servers in the environment that hosts shared drives or printers. This information is useful to attackers as they can identify targets for lateral movements and search for valuable shared data.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n ((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n (process.args : \"view\" or (process.args : \"time\" and process.args : \"\\\\\\\\*\"))\n\n\n /* expand when ancestry is available\n and not descendant of [process where event.type == \"start\" and process.name : \"cmd.exe\" and\n ((process.parent.name : \"userinit.exe\") or\n (process.parent.name : \"gpscript.exe\") or\n (process.parent.name : \"explorer.exe\" and\n process.args : \"C:\\\\*\\\\Start Menu\\\\Programs\\\\Startup\\\\*.bat*\"))]\n */\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "7b8bfc26-81d2-435e-965c-d722ee397ef1", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + }, + { + "id": "T1135", + "name": "Network Share Discovery", + "reference": "https://attack.mitre.org/techniques/T1135/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "7b8bfc26-81d2-435e-965c-d722ee397ef1_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7ba58110-ae13-439b-8192-357b0fcfa9d7_206.json b/packages/security_detection_engine/kibana/security_rule/7ba58110-ae13-439b-8192-357b0fcfa9d7_206.json new file mode 100644 index 00000000000..bd2597511d5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7ba58110-ae13-439b-8192-357b0fcfa9d7_206.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious access to LSASS handle from a call trace pointing to seclogon.dll and with a suspicious access rights value. This may indicate an attempt to leak an LSASS handle via abusing the Secondary Logon service in preparation for credential access.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious LSASS Access via MalSecLogon", + "note": "", + "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\" and\n\n /* seclogon service accessing lsass */\n winlog.event_data.CallTrace : \"*seclogon.dll*\" and process.name : \"svchost.exe\" and\n\n /* PROCESS_CREATE_PROCESS \u0026 PROCESS_DUP_HANDLE \u0026 PROCESS_QUERY_INFORMATION */\n winlog.event_data.GrantedAccess == \"0x14c0\"\n", + "references": [ + "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.GrantedAccess", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetImage", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "7ba58110-ae13-439b-8192-357b0fcfa9d7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 206 + }, + "id": "7ba58110-ae13-439b-8192-357b0fcfa9d7_206", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7bcbb3ac-e533-41ad-a612-d6c3bf666aba_103.json b/packages/security_detection_engine/kibana/security_rule/7bcbb3ac-e533-41ad-a612-d6c3bf666aba_103.json new file mode 100644 index 00000000000..4ec417a1ead --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7bcbb3ac-e533-41ad-a612-d6c3bf666aba_103.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may attempt to clear or disable the Bash command-line history in an attempt to evade detection or forensic investigations.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Tampering of Bash Command-Line History", + "note": "", + "query": "process where event.type in (\"start\", \"process_started\") and\n (\n ((process.args : (\"rm\", \"echo\") or\n (process.args : \"ln\" and process.args : \"-sf\" and process.args : \"/dev/null\") or\n (process.args : \"truncate\" and process.args : \"-s0\"))\n and process.args : (\".bash_history\", \"/root/.bash_history\", \"/home/*/.bash_history\",\"/Users/.bash_history\", \"/Users/*/.bash_history\",\n \".zsh_history\", \"/root/.zsh_history\", \"/home/*/.zsh_history\", \"/Users/.zsh_history\", \"/Users/*/.zsh_history\")) or\n (process.name : \"history\" and process.args : \"-c\") or\n (process.args : \"export\" and process.args : (\"HISTFILE=/dev/null\", \"HISTFILESIZE=0\")) or\n (process.args : \"unset\" and process.args : \"HISTFILE\") or\n (process.args : \"set\" and process.args : \"history\" and process.args : \"+o\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "7bcbb3ac-e533-41ad-a612-d6c3bf666aba", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.003", + "name": "Clear Command History", + "reference": "https://attack.mitre.org/techniques/T1070/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "7bcbb3ac-e533-41ad-a612-d6c3bf666aba_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7f370d54-c0eb-4270-ac5a-9a6020585dc6_105.json b/packages/security_detection_engine/kibana/security_rule/7f370d54-c0eb-4270-ac5a-9a6020585dc6_105.json new file mode 100644 index 00000000000..e1e02dcf169 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7f370d54-c0eb-4270-ac5a-9a6020585dc6_105.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious WMIC XSL Script Execution", + "query": "sequence by process.entity_id with maxspan = 2m\n[process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"WMIC.exe\" or process.pe.original_file_name : \"wmic.exe\") and\n process.args : (\"format*:*\", \"/format*:*\", \"*-format*:*\") and\n not process.command_line : \"* /format:table *\"]\n[any where host.os.type == \"windows\" and (event.category == \"library\" or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : (\"jscript.dll\", \"vbscript.dll\") or file.name : (\"jscript.dll\", \"vbscript.dll\"))]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "7f370d54-c0eb-4270-ac5a-9a6020585dc6", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1220", + "name": "XSL Script Processing", + "reference": "https://attack.mitre.org/techniques/T1220/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "7f370d54-c0eb-4270-ac5a-9a6020585dc6_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7f89afef-9fc5-4e7b-bf16-75ffdf27f8db_1.json b/packages/security_detection_engine/kibana/security_rule/7f89afef-9fc5-4e7b-bf16-75ffdf27f8db_1.json new file mode 100644 index 00000000000..c2a392f0727 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7f89afef-9fc5-4e7b-bf16-75ffdf27f8db_1.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools attackers can use to check for Internet connectivity on compromised systems. These results may be used to determine communication capabilities with C2 servers, or to identify routes, redirectors, and proxy servers.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Discovery of Internet Capabilities via Built-in Tools", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"ping.exe\", \"tracert.exe\", \"pathping.exe\") and\n not process.args : (\"127.0.0.1\", \"::1\", \"0.0.0.0\", \"192.168.*\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1016", + "name": "System Network Configuration Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/", + "subtechnique": [ + { + "id": "T1016.001", + "name": "Internet Connection Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "7f89afef-9fc5-4e7b-bf16-75ffdf27f8db_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_3.json b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_3.json new file mode 100644 index 00000000000..47675834282 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_3.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "New Systemd Timer Created", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating New Systemd Timer Created\n\nSystemd timers are used for scheduling and automating recurring tasks or services on Linux systems. \n\nAttackers can leverage systemd timers to run scripts, commands, or malicious software at system boot or on a set time interval by creating a systemd timer and a corresponding systemd service file. \n\nThis rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the timer file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the currently enabled systemd timers through the following command `sudo systemctl list-timers`.\n- Search for the systemd service file named similarly to the timer that was created.\n- Investigate whether any other files in any of the available systemd directories have been altered through OSQuery.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/user/.config/systemd/user/%'\\n)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/{{user.name}}/.config/systemd/user/%'\\n)\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses systemd timers for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service/timer or restore its original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.action : (\"creation\" or \"file_create_event\") and file.extension : \"timer\" and\nfile.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or \n/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not \nprocess.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\")\n", + "references": [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7fb500fa-8e24-4bd1-9480-2a819352602c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.006", + "name": "Systemd Timers", + "reference": "https://attack.mitre.org/techniques/T1053/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "7fb500fa-8e24-4bd1-9480-2a819352602c_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_4.json b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_4.json new file mode 100644 index 00000000000..fae519b49f7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_4.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "New Systemd Timer Created", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating New Systemd Timer Created\n\nSystemd timers are used for scheduling and automating recurring tasks or services on Linux systems. \n\nAttackers can leverage systemd timers to run scripts, commands, or malicious software at system boot or on a set time interval by creating a systemd timer and a corresponding systemd service file. \n\nThis rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the timer file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the currently enabled systemd timers through the following command `sudo systemctl list-timers`.\n- Search for the systemd service file named similarly to the timer that was created.\n- Investigate whether any other files in any of the available systemd directories have been altered through OSQuery.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/user/.config/systemd/user/%'\\n)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/{{user.name}}/.config/systemd/user/%'\\n)\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses systemd timers for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service/timer or restore its original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.action : (\"creation\" or \"file_create_event\") and file.extension : \"timer\" and\nfile.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or \n/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not \nprocess.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\" or \"/proc/self/exe\" or \"/usr/sbin/dockerd\")\n", + "references": [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7fb500fa-8e24-4bd1-9480-2a819352602c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.006", + "name": "Systemd Timers", + "reference": "https://attack.mitre.org/techniques/T1053/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 4 + }, + "id": "7fb500fa-8e24-4bd1-9480-2a819352602c_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_5.json b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_5.json new file mode 100644 index 00000000000..2bd1b734cc0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/7fb500fa-8e24-4bd1-9480-2a819352602c_5.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation of a systemd timer within any of the default systemd timer directories. Systemd timers can be used by an attacker to gain persistence, by scheduling the execution of a command or script. Similarly to cron/at, systemd timers can be set up to execute on boot time, or on a specific point in time, which allows attackers to regain access in case the connection to the infected asset was lost.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "New Systemd Timer Created", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating New Systemd Timer Created\n\nSystemd timers are used for scheduling and automating recurring tasks or services on Linux systems. \n\nAttackers can leverage systemd timers to run scripts, commands, or malicious software at system boot or on a set time interval by creating a systemd timer and a corresponding systemd service file. \n\nThis rule monitors the creation of new systemd timer files, potentially indicating the creation of a persistence mechanism.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the timer file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate the currently enabled systemd timers through the following command `sudo systemctl list-timers`.\n- Search for the systemd service file named similarly to the timer that was created.\n- Investigate whether any other files in any of the available systemd directories have been altered through OSQuery.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/user/.config/systemd/user/%'\\n)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (\\npath LIKE '/etc/systemd/system/%' OR \\npath LIKE '/usr/local/lib/systemd/system/%' OR \\npath LIKE '/lib/systemd/system/%' OR\\npath LIKE '/usr/lib/systemd/system/%' OR\\npath LIKE '/home/{{user.name}}/.config/systemd/user/%'\\n)\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Investigate whether the altered scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False Positive Analysis\n\n- If this activity is related to new benign software installation activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- If this activity is related to a system administrator who uses systemd timers for administrative purposes, consider adding exceptions for this specific administrator user account. \n- Try to understand the context of the execution by thinking about the user, machine, or business purpose. A small number of endpoints, such as servers with unique software, might appear unusual but satisfy a specific business need.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service/timer or restore its original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.action : (\"creation\" or \"file_create_event\") and file.extension : \"timer\" and\nfile.path : (/etc/systemd/system/* or /usr/local/lib/systemd/system/* or /lib/systemd/system/* or \n/usr/lib/systemd/system/* or /home/*/.config/systemd/user/*) and not process.name : (\"docker\" or \"dockerd\" or \"dnf\" or \"yum\" or \"rpm\" or \"dpkg\" or \"executor\")\n", + "references": [ + "https://opensource.com/article/20/7/systemd-timers", + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "7fb500fa-8e24-4bd1-9480-2a819352602c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.006", + "name": "Systemd Timers", + "reference": "https://attack.mitre.org/techniques/T1053/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 5 + }, + "id": "7fb500fa-8e24-4bd1-9480-2a819352602c_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_2.json b/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_2.json new file mode 100644 index 00000000000..b3db371b9ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_2.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to enumerate kernel modules. Use of these programs by ordinary users is uncommon. These can be exempted by process name or username." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumeration of Kernel Modules via Proc", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action == \"opened-file\" and file.path == \"/proc/modules\" and not \n(\n process.name in (\"auditbeat\", \"kmod\", \"modprobe\", \"lsmod\", \"insmod\", \"modinfo\", \"rmmod\", \"SchedulerRunner\", \"grep\") or \n process.parent.pid == 1 or process.title : \"*grep*\"\n)\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.title", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "80084fa9-8677-4453-8680-b891d3c0c778", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "80084fa9-8677-4453-8680-b891d3c0c778_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_3.json b/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_3.json new file mode 100644 index 00000000000..cf3d898f80a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/80084fa9-8677-4453-8680-b891d3c0c778_3.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules.", + "false_positives": [ + "Security tools and device drivers may run these programs in order to enumerate kernel modules. Use of these programs by ordinary users is uncommon. These can be exempted by process name or username." + ], + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Enumeration of Kernel Modules via Proc", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "file where host.os.type == \"linux\" and event.action == \"opened-file\" and file.path == \"/proc/modules\" and not \n(\n process.name in (\"auditbeat\", \"kmod\", \"modprobe\", \"lsmod\", \"insmod\", \"modinfo\", \"rmmod\", \"SchedulerRunner\", \"grep\") or \n process.parent.pid == 1 or process.title : \"*grep*\"\n)\n", + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.title", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "80084fa9-8677-4453-8680-b891d3c0c778", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "80084fa9-8677-4453-8680-b891d3c0c778_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/800e01be-a7a4-46d0-8de9-69f3c9582b44_1.json b/packages/security_detection_engine/kibana/security_rule/800e01be-a7a4-46d0-8de9-69f3c9582b44_1.json new file mode 100644 index 00000000000..dfa2fb4bb65 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/800e01be-a7a4-46d0-8de9-69f3c9582b44_1.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies processes running with unusual extensions that are not typically valid for Windows executables.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Process Extension", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.executable : \"?*\" and \n not process.name : (\"*.exe\", \"*.com\", \"*.scr\", \"*.tmp\", \"*.dat\") and\n not process.executable : \n (\n \"MemCompression\",\n \"Registry\",\n \"vmmem\",\n \"vmmemWSL\",\n \"?:\\\\Program Files\\\\Dell\\\\SupportAssistAgent\\\\*.p5x\",\n \"?:\\\\Program Files\\\\Docker\\\\Docker\\\\com.docker.service\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Intel\\\\AGS\\\\Libs\\\\AGSRunner.bin\"\n ) and\n not (\n (process.name : \"C9632CF058AE4321B6B0B5EA39B710FE\" and process.code_signature.subject_name == \"Dell Inc\") or\n (process.name : \"*.upd\" and process.code_signature.subject_name == \"Bloomberg LP\") or\n (process.name: \"FD552E21-686E-413C-931D-3B82A9D29F3B\" and process.code_signature.subject_name: \"Adobe Inc.\") or\n (process.name: \"3B91051C-AE82-43C9-BCEF-0309CD2DD9EB\" and process.code_signature.subject_name: \"McAfee, LLC\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "800e01be-a7a4-46d0-8de9-69f3c9582b44", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "800e01be-a7a4-46d0-8de9-69f3c9582b44_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/809b70d3-e2c3-455e-af1b-2626a5a1a276_106.json b/packages/security_detection_engine/kibana/security_rule/809b70d3-e2c3-455e-af1b-2626a5a1a276_106.json new file mode 100644 index 00000000000..04a5c107313 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/809b70d3-e2c3-455e-af1b-2626a5a1a276_106.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s).", + "false_positives": [ + "New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently." + ], + "from": "now-2h", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "rare_method_for_a_city", + "name": "Unusual City For an AWS Command", + "note": "## Triage and analysis\n\n### Investigating Unusual City For an AWS Command\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.\n\nThis rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is sourcing from a geolocation (city) that is unusual for the command. This can be the result of compromised credentials or keys used by a threat actor in a different geography than the authorized user(s).\n\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.\n\n#### Possible investigation steps\n\n- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.\n - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.\n - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Investigate other alerts associated with the user account during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, or network administrator activity.\n- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.\n- Considering the source IP address and geolocation of the user who issued the command:\n - Do they look normal for the calling user?\n - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?\n - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?\n- Contact the account owner and confirm whether they are aware of this activity if suspicious.\n- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.\n\n### False positive analysis\n\n- False positives can occur if activity is coming from new employees based in a city with no previous history in AWS.\n- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.\n\n### Related Rules\n\n- Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1\n- Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1\n- Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff\n- Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Disable or limit the account during the investigation and response.\n- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:\n - Identify the account role in the cloud environment.\n - Assess the criticality of affected services and servers.\n - Work with your IT team to identify and minimize the impact on users.\n - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.\n - Identify any regulatory or legal ramifications related to this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.\n- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.\n- Consider enabling multi-factor authentication for users.\n- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.\n- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n- Take the actions needed to return affected systems, data, or services to their normal operational levels.\n- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "aws", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "809b70d3-e2c3-455e-af1b-2626a5a1a276", + "setup": "The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Domain: Cloud", + "Data Source: AWS", + "Data Source: Amazon Web Services", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Resources: Investigation Guide" + ], + "type": "machine_learning", + "version": 106 + }, + "id": "809b70d3-e2c3-455e-af1b-2626a5a1a276_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/818e23e6-2094-4f0e-8c01-22d30f3506c6_106.json b/packages/security_detection_engine/kibana/security_rule/818e23e6-2094-4f0e-8c01-22d30f3506c6_106.json new file mode 100644 index 00000000000..bcf65adfa5e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/818e23e6-2094-4f0e-8c01-22d30f3506c6_106.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to disable PowerShell Script Block Logging via registry modification. Attackers may disable this logging to conceal their activities in the host and evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "PowerShell Script Block Logging Disabled", + "note": "## Triage and analysis\n\n### Investigating PowerShell Script Block Logging Disabled\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available in various environments and creating an attractive way for attackers to execute code.\n\nPowerShell Script Block Logging is a feature of PowerShell that records the content of all script blocks that it processes, giving defenders visibility of PowerShell scripts and sequences of executed commands.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check whether it makes sense for the user to use PowerShell to complete tasks.\n- Investigate if PowerShell scripts were run after logging was disabled.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- PowerShell Suspicious Discovery Related Windows API Functions - 61ac3638-40a3-44b2-855a-985636ca985e\n- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889\n- PowerShell Suspicious Script with Audio Capture Capabilities - 2f2f4939-0b34-40c2-a0a3-844eb7889f43\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n- PowerShell Suspicious Script with Screenshot Capabilities - 959a7353-1129-4aa7-9084-30746b256a70\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\PowerShell\\\\ScriptBlockLogging\\\\EnableScriptBlockLogging\"\n ) and registry.data.strings : (\"0\", \"0x00000000\")\n", + "references": [ + "https://admx.help/?Category=Windows_10_2016\u0026Policy=Microsoft.Policies.PowerShell::EnableScriptBlockLogging" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "818e23e6-2094-4f0e-8c01-22d30f3506c6", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.002", + "name": "Disable Windows Event Logging", + "reference": "https://attack.mitre.org/techniques/T1562/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "818e23e6-2094-4f0e-8c01-22d30f3506c6_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/81fe9dc6-a2d7-4192-a2d8-eed98afc766a_108.json b/packages/security_detection_engine/kibana/security_rule/81fe9dc6-a2d7-4192-a2d8-eed98afc766a_108.json new file mode 100644 index 00000000000..1fab5a63621 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/81fe9dc6-a2d7-4192-a2d8-eed98afc766a_108.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses.", + "false_positives": [ + "Legitimate PowerShell Scripts which makes use of compression and encoding." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Suspicious Payload Encoded and Compressed", + "note": "## Triage and analysis\n\n### Investigating PowerShell Suspicious Payload Encoded and Compressed\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can embed compressed and encoded payloads in scripts to load directly into the memory without touching the disk. This strategy can circumvent string and file-based security protections.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the script using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n- Suspicious .NET Reflection via PowerShell - e26f042e-c590-4e82-8e05-41e81bd822ad\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n (\n \"System.IO.Compression.DeflateStream\" or\n \"System.IO.Compression.GzipStream\" or\n \"IO.Compression.DeflateStream\" or\n \"IO.Compression.GzipStream\"\n ) and\n FromBase64String\n ) and not \n (user.id:(\"S-1-5-18\" or \"S-1-5-19\") and\n file.directory: \"C:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\Downloads\")\n and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.directory", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "81fe9dc6-a2d7-4192-a2d8-eed98afc766a", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 108 + }, + "id": "81fe9dc6-a2d7-4192-a2d8-eed98afc766a_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/827f8d8f-4117-4ae4-b551-f56d54b9da6b_104.json b/packages/security_detection_engine/kibana/security_rule/827f8d8f-4117-4ae4-b551-f56d54b9da6b_104.json new file mode 100644 index 00000000000..8a329b643fb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/827f8d8f-4117-4ae4-b551-f56d54b9da6b_104.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution of the Apple script interpreter (osascript) without a password prompt and with administrator privileges.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Apple Scripting Execution with Administrator Privileges", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*with administrator privileges\"\n", + "references": [ + "https://discussions.apple.com/thread/2266150" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "827f8d8f-4117-4ae4-b551-f56d54b9da6b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "827f8d8f-4117-4ae4-b551-f56d54b9da6b_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_1.json b/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_1.json new file mode 100644 index 00000000000..e4182ce1e41 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_1.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Local Account Brute Force Detected", + "query": "sequence by host.id, process.parent.executable, user.name with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and \n event.action == \"exec\" and process.name == \"su\" ] with runs=10\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "835c0622-114e-40b5-a346-f843ea5d01f1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "835c0622-114e-40b5-a346-f843ea5d01f1_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_2.json b/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_2.json new file mode 100644 index 00000000000..4ea48532f50 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/835c0622-114e-40b5-a346-f843ea5d01f1_2.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Local Account Brute Force Detected", + "query": "sequence by host.id, process.parent.executable, user.id with maxspan=1s\n [process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and process.name == \"su\" and \n not process.parent.name in (\n \"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"clickhouse-server\"\n )] with runs=10\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "835c0622-114e-40b5-a346-f843ea5d01f1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "835c0622-114e-40b5-a346-f843ea5d01f1_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f_3.json b/packages/security_detection_engine/kibana/security_rule/83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f_3.json new file mode 100644 index 00000000000..5614cef983f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f_3.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may attempt to disable the iptables or firewall service in an attempt to affect how a host is allowed to receive or send network traffic.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Disable IPTables or Firewall", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\n (\n /* disable FW */\n (\n (process.name == \"ufw\" and process.args == \"disable\") or\n (process.name == \"iptables\" and process.args == \"-F\" and process.args_count == 2)\n ) or\n\n /* stop FW service */\n (\n ((process.name == \"service\" and process.args == \"stop\") or\n (process.name == \"chkconfig\" and process.args == \"off\") or\n (process.name == \"systemctl\" and process.args in (\"disable\", \"stop\", \"kill\"))) and\n process.args in (\"firewalld\", \"ip6tables\", \"iptables\")\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "83e9c2b3-24ef-4c1d-a8cd-5ebafb5dfa2f_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/846fe13f-6772-4c83-bd39-9d16d4ad1a81_1.json b/packages/security_detection_engine/kibana/security_rule/846fe13f-6772-4c83-bd39-9d16d4ad1a81_1.json new file mode 100644 index 00000000000..6fbaab7dd1f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/846fe13f-6772-4c83-bd39-9d16d4ad1a81_1.json @@ -0,0 +1,111 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to Microsoft Exchange Transport Agents install. Adversaries may leverage malicious Microsoft Exchange Transport Agents to execute tasks in response to adversary-defined criteria, establishing persistence.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Microsoft Exchange Transport Agent Install Script", + "note": "## Setup", + "query": "event.category: \"process\" and host.os.type:windows and\n powershell.file.script_block_text : (\n (\n \"Install-TransportAgent\" or\n \"Enable-TransportAgent\"\n )\n ) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "846fe13f-6772-4c83-bd39-9d16d4ad1a81", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\nSteps to implement the logging policy via registry:\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/", + "subtechnique": [ + { + "id": "T1505.002", + "name": "Transport Agent", + "reference": "https://attack.mitre.org/techniques/T1505/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "846fe13f-6772-4c83-bd39-9d16d4ad1a81_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_106.json b/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_106.json new file mode 100644 index 00000000000..3368291f6d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_106.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.", + "false_positives": [ + "Domain administrators may use this command-line utility for legitimate information gathering purposes, but it is not common for environments with Windows Server 2012 and newer." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumerating Domain Trusts via NLTEST.EXE", + "note": "## Triage and analysis\n\n### Investigating Enumerating Domain Trusts via NLTEST.EXE\n\nActive Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a \"trusting\" domain permits users from a \"trusted\" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.\n\nThis rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"nltest.exe\" and process.args : (\n \"/DCLIST:*\", \"/DCNAME:*\", \"/DSGET*\",\n \"/LSAQUERYFTI:*\", \"/PARENTDOMAIN\",\n \"/DOMAIN_TRUSTS\", \"/BDC_QUERY:*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)", + "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "84da2554-e12a-11ec-b896-f661ea17fbcd", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "84da2554-e12a-11ec-b896-f661ea17fbcd_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_107.json b/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_107.json new file mode 100644 index 00000000000..6b1f9261df6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/84da2554-e12a-11ec-b896-f661ea17fbcd_107.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of nltest.exe for domain trust discovery purposes. Adversaries may use this command-line utility to enumerate domain trusts and gain insight into trust relationships, as well as the state of Domain Controller (DC) replication in a Microsoft Windows NT Domain.", + "false_positives": [ + "Domain administrators may use this command-line utility for legitimate information gathering purposes, but it is not common for environments with Windows Server 2012 and newer." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumerating Domain Trusts via NLTEST.EXE", + "note": "## Triage and analysis\n\n### Investigating Enumerating Domain Trusts via NLTEST.EXE\n\nActive Directory (AD) domain trusts define relationships between domains within a Windows AD environment. In this setup, a \"trusting\" domain permits users from a \"trusted\" domain to access resources. These trust relationships can be configurable as one-way, two-way, transitive, or non-transitive, enabling controlled access and resource sharing across domains.\n\nThis rule identifies the usage of the `nltest.exe` utility to enumerate domain trusts. Attackers can use this information to enable the next actions in a target environment, such as lateral movement.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation and are done within the user business context (e.g., an administrator in this context). As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- Enumerating Domain Trusts via DSQUERY.EXE - 06a7a03c-c735-47a6-a313-51c354aef6c3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"nltest.exe\" and process.args : (\n \"/DCLIST:*\", \"/DCNAME:*\", \"/DSGET*\",\n \"/LSAQUERYFTI:*\", \"/PARENTDOMAIN\",\n \"/DOMAIN_TRUSTS\", \"/BDC_QUERY:*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)", + "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "84da2554-e12a-11ec-b896-f661ea17fbcd", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + }, + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "84da2554-e12a-11ec-b896-f661ea17fbcd_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/850d901a-2a3c-46c6-8b22-55398a01aad8_108.json b/packages/security_detection_engine/kibana/security_rule/850d901a-2a3c-46c6-8b22-55398a01aad8_108.json new file mode 100644 index 00000000000..28dd2684e98 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/850d901a-2a3c-46c6-8b22-55398a01aad8_108.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote access to the registry to potentially dump credential data from the Security Account Manager (SAM) registry hive in preparation for credential access and privileges elevation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Credential Access via Registry", + "note": "## Triage and analysis\n\n### Investigating Potential Remote Credential Access via Registry\n\nDumping registry hives is a common way to access credential information. Some hives store credential material, such as the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.\n\nAttackers can use tools like secretsdump.py or CrackMapExec to dump the registry hives remotely, and use dumped credentials to access other systems in the domain.\n\n#### Possible investigation steps\n\n- Identify the specifics of the involved assets, such as their role, criticality, and associated users.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Determine the privileges of the compromised accounts.\n- Investigate other alerts associated with the user/source host during the past 48 hours.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Related rules\n\n- Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine if other hosts were compromised.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Reimage the host operating system or restore the compromised files to clean versions.\n- Ensure that the machine has the latest security updates and is not running unsupported Windows versions.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and\n event.action == \"creation\" and process.name : \"svchost.exe\" and\n file.Ext.header_bytes : \"72656766*\" and user.id : (\"S-1-5-21-*\", \"S-1-12-1-*\") and file.size \u003e= 30000 and\n file.path : (\"?:\\\\Windows\\\\system32\\\\*.tmp\", \"?:\\\\WINDOWS\\\\Temp\\\\*.tmp\")\n", + "references": [ + "https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.header_bytes", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.size", + "type": "long" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "850d901a-2a3c-46c6-8b22-55398a01aad8", + "setup": "This rule uses Elastic Endpoint file creation and system integration events for correlation. Both data should be collected from the host for this detection to work.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "850d901a-2a3c-46c6-8b22-55398a01aad8_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_107.json b/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_107.json new file mode 100644 index 00000000000..8fa670e6553 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_107.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious PowerShell Engine ImageLoad", + "note": "## Triage and analysis\n\n### Investigating Suspicious PowerShell Engine ImageLoad\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called \"PowerShell without PowerShell,\" works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Retrieve the implementation (DLL, executable, etc.) and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "library where host.os.type == \"windows\" and\n dll.name : (\"System.Management.Automation.ni.dll\", \"System.Management.Automation.dll\") and\n not \n (\n /* MS Signed Binaries */\n (\n process.code_signature.subject_name : (\n \"Microsoft Windows\",\n \"Microsoft Dynamic Code Publisher\",\n \"Microsoft Corporation\"\n ) and process.code_signature.trusted == true and not process.name : (\"rundll32.exe\", \"regsvr32.exe\")\n ) or\n\n /* Signed Executables from the Program Files folder */\n (\n process.executable : (\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\"\n ) and process.code_signature.trusted == true\n ) or\n\n /* Lenovo */\n (\n process.executable : (\n \"?:\\\\Windows\\\\Lenovo\\\\*.exe\"\n ) and (process.code_signature.subject_name : \"Lenovo\" and process.code_signature.trusted == true) \n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "852c1f19-68e8-43a6-9dce-340771fe1be3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "852c1f19-68e8-43a6-9dce-340771fe1be3_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_108.json b/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_108.json new file mode 100644 index 00000000000..da5543dd908 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/852c1f19-68e8-43a6-9dce-340771fe1be3_108.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the PowerShell engine being invoked by unexpected processes. Rather than executing PowerShell functionality with powershell.exe, some attackers do this to operate more stealthily.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious PowerShell Engine ImageLoad", + "note": "## Triage and analysis\n\n### Investigating Suspicious PowerShell Engine ImageLoad\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use PowerShell without having to execute `PowerShell.exe` directly. This technique, often called \"PowerShell without PowerShell,\" works by using the underlying System.Management.Automation namespace and can bypass application allowlisting and PowerShell security features.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Retrieve the implementation (DLL, executable, etc.) and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity can happen legitimately. Some vendors have their own PowerShell implementations that are shipped with some products. These benign true positives (B-TPs) can be added as exceptions if necessary after analysis.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "library where host.os.type == \"windows\" and\n dll.name : (\"System.Management.Automation.ni.dll\", \"System.Management.Automation.dll\") and\n not \n (\n /* MS Signed Binaries */\n (\n process.code_signature.subject_name : (\n \"Microsoft Windows\",\n \"Microsoft Dynamic Code Publisher\",\n \"Microsoft Corporation\"\n ) and process.code_signature.trusted == true and not process.name : (\"rundll32.exe\", \"regsvr32.exe\")\n ) or\n\n /* Signed Executables from the Program Files folder */\n (\n process.executable : (\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\"\n ) and process.code_signature.trusted == true\n ) or\n\n /* Lenovo */\n (\n process.executable : (\n \"?:\\\\Windows\\\\Lenovo\\\\*.exe\"\n ) and (process.code_signature.subject_name : \"Lenovo\" and process.code_signature.trusted == true) \n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "852c1f19-68e8-43a6-9dce-340771fe1be3", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "852c1f19-68e8-43a6-9dce-340771fe1be3_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/870aecc0-cea4-4110-af3f-e02e9b373655_105.json b/packages/security_detection_engine/kibana/security_rule/870aecc0-cea4-4110-af3f-e02e9b373655_105.json new file mode 100644 index 00000000000..b4cbb27e3fe --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/870aecc0-cea4-4110-af3f-e02e9b373655_105.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the grep command to discover known third-party macOS and Linux security tools, such as Antivirus or Host Firewall details.", + "false_positives": [ + "Endpoint Security installers, updaters and post installation verification scripts." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "auditbeat-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Security Software Discovery via Grep", + "note": "## Triage and analysis\n\n### Investigating Security Software Discovery via Grep\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `grep` utility with arguments compatible to the enumeration of the security software installed on the host. Attackers can use this information to decide whether or not to infect a system, disable protections, use bypasses, etc.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where event.type == \"start\" and\nprocess.name : \"grep\" and user.id != \"0\" and\n not process.parent.executable : \"/Library/Application Support/*\" and\n process.args :\n (\"Little Snitch*\",\n \"Avast*\",\n \"Avira*\",\n \"ESET*\",\n \"BlockBlock*\",\n \"360Sec*\",\n \"LuLu*\",\n \"KnockKnock*\",\n \"kav\",\n \"KIS\",\n \"RTProtectionDaemon*\",\n \"Malware*\",\n \"VShieldScanner*\",\n \"WebProtection*\",\n \"webinspectord*\",\n \"McAfee*\",\n \"isecespd*\",\n \"macmnsvc*\",\n \"masvc*\",\n \"kesl*\",\n \"avscan*\",\n \"guard*\",\n \"rtvscand*\",\n \"symcfgd*\",\n \"scmdaemon*\",\n \"symantec*\",\n \"sophos*\",\n \"osquery*\",\n \"elastic-endpoint*\"\n ) and\n not (process.args : \"Avast\" and process.args : \"Passwords\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "870aecc0-cea4-4110-af3f-e02e9b373655", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1518", + "name": "Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/", + "subtechnique": [ + { + "id": "T1518.001", + "name": "Security Software Discovery", + "reference": "https://attack.mitre.org/techniques/T1518/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "870aecc0-cea4-4110-af3f-e02e9b373655_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/871ea072-1b71-4def-b016-6278b505138d_107.json b/packages/security_detection_engine/kibana/security_rule/871ea072-1b71-4def-b016-6278b505138d_107.json new file mode 100644 index 00000000000..2bca9ba45d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/871ea072-1b71-4def-b016-6278b505138d_107.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances of lower privilege accounts enumerating Administrator accounts or groups using built-in Windows tools.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enumeration of Administrator Accounts", + "note": "## Triage and analysis\n\n### Investigating Enumeration of Administrator Accounts\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `net` and `wmic` utilities to enumerate administrator-related users or groups in the domain and local machine scope. Attackers can use this information to plan their next steps of the attack, such as mapping targets for credential compromise and other post-exploitation activities.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- AdFind Command Activity - eda499b8-a073-4e35-9733-22ec71f57f3a\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n process.args : (\"group\", \"user\", \"localgroup\") and\n process.args : (\"*admin*\", \"Domain Admins\", \"Remote Desktop Users\", \"Enterprise Admins\", \"Organization Management\") and\n not process.args : \"/add\")\n\n or\n\n ((process.name : \"wmic.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : (\"group\", \"useraccount\"))\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "871ea072-1b71-4def-b016-6278b505138d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + }, + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "871ea072-1b71-4def-b016-6278b505138d_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_1.json b/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_1.json new file mode 100644 index 00000000000..05e18214922 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_1.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process group leader. Adversaries may collect data stored in the clipboard from users copying information within or between applications.", + "from": "now-119m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Suspicious Clipboard Activity Detected", + "new_terms_fields": [ + "host.id", + "process.group_leader.executable" + ], + "query": "event.category:process and host.os.type:\"linux\" and event.action:\"exec\" and event.type:\"start\" and \nprocess.name:(\"xclip\" or \"xsel\" or \"wl-clipboard\" or \"clipman\" or \"copyq\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "884e87cc-c67b-4c90-a4ed-e1e24a940c82", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Collection", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1115", + "name": "Clipboard Data", + "reference": "https://attack.mitre.org/techniques/T1115/" + } + ] + } + ], + "type": "new_terms", + "version": 1 + }, + "id": "884e87cc-c67b-4c90-a4ed-e1e24a940c82_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_2.json b/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_2.json new file mode 100644 index 00000000000..c807dc31751 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/884e87cc-c67b-4c90-a4ed-e1e24a940c82_2.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process group leader. Adversaries may collect data stored in the clipboard from users copying information within or between applications.", + "from": "now-119m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Suspicious Clipboard Activity Detected", + "new_terms_fields": [ + "host.id", + "process.group_leader.executable" + ], + "query": "event.category:process and host.os.type:\"linux\" and event.action:\"exec\" and event.type:\"start\" and \nprocess.name:(\"xclip\" or \"xsel\" or \"wl-clipboard\" or \"clipman\" or \"copyq\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "884e87cc-c67b-4c90-a4ed-e1e24a940c82", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Collection", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1115", + "name": "Clipboard Data", + "reference": "https://attack.mitre.org/techniques/T1115/" + } + ] + } + ], + "type": "new_terms", + "version": 2 + }, + "id": "884e87cc-c67b-4c90-a4ed-e1e24a940c82_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/88817a33-60d3-411f-ba79-7c905d865b2a_104.json b/packages/security_detection_engine/kibana/security_rule/88817a33-60d3-411f-ba79-7c905d865b2a_104.json new file mode 100644 index 00000000000..308da8dbfc6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/88817a33-60d3-411f-ba79-7c905d865b2a_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may create or modify the Sublime application plugins or scripts to execute a malicious payload each time the Sublime application is started.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Sublime Plugin or Application Script Modification", + "note": "", + "query": "file where host.os.type == \"macos\" and event.type in (\"change\", \"creation\") and file.extension : \"py\" and\n file.path :\n (\n \"/Users/*/Library/Application Support/Sublime Text*/Packages/*.py\",\n \"/Applications/Sublime Text.app/Contents/MacOS/sublime.py\"\n ) and\n not process.executable :\n (\n \"/Applications/Sublime Text*.app/Contents/*\",\n \"/usr/local/Cellar/git/*/bin/git\",\n \"/Library/Developer/CommandLineTools/usr/bin/git\",\n \"/usr/libexec/xpcproxy\",\n \"/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/Resources/DesktopServicesHelper\"\n )\n", + "references": [ + "https://posts.specterops.io/persistent-jxa-66e1c3cd1cf5" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "88817a33-60d3-411f-ba79-7c905d865b2a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1554", + "name": "Compromise Client Software Binary", + "reference": "https://attack.mitre.org/techniques/T1554/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "88817a33-60d3-411f-ba79-7c905d865b2a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_1.json b/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_1.json new file mode 100644 index 00000000000..f2aa683a515 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_1.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a sudo binary located at /usr/bin/sudo. Attackers may hijack the default sudo binary and replace it with a custom binary or script that can read the user's password in clear text to escalate privileges or enable persistence onto the system every time the sudo binary is executed.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Sudo Hijacking Detected", + "query": "file where event.type in (\"creation\", \"file_create_event\") and file.path == \"/usr/bin/sudo\"\n", + "references": [ + "https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "88fdcb8c-60e5-46ee-9206-2663adf1b1ce", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Persistence", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "88fdcb8c-60e5-46ee-9206-2663adf1b1ce_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_2.json b/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_2.json new file mode 100644 index 00000000000..5cd89480024 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/88fdcb8c-60e5-46ee-9206-2663adf1b1ce_2.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a sudo binary located at /usr/bin/sudo. Attackers may hijack the default sudo binary and replace it with a custom binary or script that can read the user's password in clear text to escalate privileges or enable persistence onto the system every time the sudo binary is executed.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Sudo Hijacking Detected", + "query": "file where event.type in (\"creation\", \"file_create_event\") and file.path == \"/usr/bin/sudo\"\n", + "references": [ + "https://eapolsniper.github.io/2020/08/17/Sudo-Hijacking/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "88fdcb8c-60e5-46ee-9206-2663adf1b1ce", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "88fdcb8c-60e5-46ee-9206-2663adf1b1ce_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/891cb88e-441a-4c3e-be2d-120d99fe7b0d_105.json b/packages/security_detection_engine/kibana/security_rule/891cb88e-441a-4c3e-be2d-120d99fe7b0d_105.json new file mode 100644 index 00000000000..bf3e9727472 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/891cb88e-441a-4c3e-be2d-120d99fe7b0d_105.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious image load (wmiutils.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where child processes are spawned via Windows Management Instrumentation (WMI). This technique can be used to execute code and evade traditional parent/child processes spawned from Microsoft Office products.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious WMI Image Load from MS Office", + "note": "", + "query": "any where host.os.type == \"windows\" and\n (event.category : (\"library\", \"driver\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n process.name : (\"WINWORD.EXE\", \"EXCEL.EXE\", \"POWERPNT.EXE\", \"MSPUB.EXE\", \"MSACCESS.EXE\") and\n (dll.name : \"wmiutils.dll\" or file.name : \"wmiutils.dll\")\n", + "references": [ + "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "891cb88e-441a-4c3e-be2d-120d99fe7b0d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "891cb88e-441a-4c3e-be2d-120d99fe7b0d_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/897dc6b5-b39f-432a-8d75-d3730d50c782_107.json b/packages/security_detection_engine/kibana/security_rule/897dc6b5-b39f-432a-8d75-d3730d50c782_107.json new file mode 100644 index 00000000000..6bd3408824d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/897dc6b5-b39f-432a-8d75-d3730d50c782_107.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies network connections to the standard Kerberos port from an unusual process. On Windows, the only process that normally performs Kerberos traffic from a domain joined host is lsass.exe.", + "false_positives": [ + "HTTP traffic on a non standard port. Verify that the destination IP address is not related to a Domain Controller." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kerberos Traffic from Unusual Process", + "note": "## Triage and analysis\n\n### Investigating Kerberos Traffic from Unusual Process\n\nKerberos is the default authentication protocol in Active Directory, designed to provide strong authentication for client/server applications by using secret-key cryptography.\n\nDomain-joined hosts usually perform Kerberos traffic using the `lsass.exe` process. This rule detects the occurrence of traffic on the Kerberos port (88) by processes other than `lsass.exe` to detect the unusual request and usage of Kerberos tickets.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check if the Destination IP is related to a Domain Controller.\n- Review event ID 4769 for suspicious ticket requests.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This rule uses a Kerberos-related port but does not identify the protocol used on that port. HTTP traffic on a non-standard port or destination IP address unrelated to Domain controllers can create false positives.\n- Exceptions can be added for noisy/frequent connections.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n - Ticket requests can be used to investigate potentially compromised accounts.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "network where host.os.type == \"windows\" and event.type == \"start\" and network.direction : (\"outgoing\", \"egress\") and\n destination.port == 88 and source.port \u003e= 49152 and process.pid != 4 and \n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\lsass.exe\",\n \"System\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Program Files\\\\Puppet Labs\\\\Puppet\\\\puppet\\\\bin\\\\ruby.exe\",\n \"\\\\device\\\\harddiskvolume?\\\\windows\\\\system32\\\\lsass.exe\",\n \"?:\\\\Program Files\\\\rapid7\\\\nexpose\\\\nse\\\\.DLLCACHE\\\\nseserv.exe\",\n \"?:\\\\Program Files (x86)\\\\GFI\\\\LanGuard 12 Agent\\\\lnsscomm.exe\",\n \"?:\\\\Program Files (x86)\\\\SuperScan\\\\scanner.exe\",\n \"?:\\\\Program Files (x86)\\\\Nmap\\\\nmap.exe\",\n \"?:\\\\Program Files\\\\Tenable\\\\Nessus\\\\nessusd.exe\",\n \"\\\\device\\\\harddiskvolume?\\\\program files (x86)\\\\nmap\\\\nmap.exe\",\n \"?:\\\\Program Files\\\\Docker\\\\Docker\\\\resources\\\\vpnkit.exe\",\n \"?:\\\\Program Files\\\\Docker\\\\Docker\\\\resources\\\\com.docker.vpnkit.exe\",\n \"?:\\\\Program Files\\\\VMware\\\\VMware View\\\\Server\\\\bin\\\\ws_TomcatService.exe\",\n \"?:\\\\Program Files (x86)\\\\DesktopCentral_Agent\\\\bin\\\\dcpatchscan.exe\",\n \"\\\\device\\\\harddiskvolume?\\\\program files (x86)\\\\nmap oem\\\\nmap.exe\",\n \"?:\\\\Program Files (x86)\\\\Nmap OEM\\\\nmap.exe\",\n \"?:\\\\Program Files (x86)\\\\Zscaler\\\\ZSATunnel\\\\ZSATunnel.exe\",\n \"?:\\\\Program Files\\\\JetBrains\\\\PyCharm Community Edition*\\\\bin\\\\pycharm64.exe\",\n \"?:\\\\Program Files (x86)\\\\Advanced Port Scanner\\\\advanced_port_scanner.exe\",\n \"?:\\\\Program Files (x86)\\\\nwps\\\\NetScanTools Pro\\\\NSTPRO.exe\",\n \"?:\\\\Program Files\\\\BlackBerry\\\\UEM\\\\Proxy Server\\\\bin\\\\prunsrv.exe\",\n \"?:\\\\Program Files (x86)\\\\Microsoft Silverlight\\\\sllauncher.exe\",\n \"?:\\\\Windows\\\\System32\\\\MicrosoftEdgeCP.exe\",\n \"?:\\\\Windows\\\\SystemApps\\\\Microsoft.MicrosoftEdge_*\\\\MicrosoftEdge.exe\", \n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\EdgeUpdate\\\\MicrosoftEdgeUpdate.exe\",\n \"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\", \n \"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\", \n \"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\", \n \"?:\\\\Program Files\\\\Mozilla Firefox\\\\firefox.exe\", \n \"?:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe\",\n \"?:\\\\Program Files (x86)\\\\Internet Explorer\\\\iexplore.exe\"\n ) and\n destination.address != \"127.0.0.1\" and destination.address != \"::1\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.address", + "type": "keyword" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "897dc6b5-b39f-432a-8d75-d3730d50c782", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "897dc6b5-b39f-432a-8d75-d3730d50c782_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/89f9a4b0-9f8f-4ee0-8823-c4751a6d6696_105.json b/packages/security_detection_engine/kibana/security_rule/89f9a4b0-9f8f-4ee0-8823-c4751a6d6696_105.json new file mode 100644 index 00000000000..6411a79686e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/89f9a4b0-9f8f-4ee0-8823-c4751a6d6696_105.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies cmd.exe making a network connection. Adversaries could abuse cmd.exe to download or execute malware from a remote URL.", + "false_positives": [ + "Administrators may use the command prompt for regular administrative tasks. It's important to baseline your environment for network connections being made from the command prompt to determine any abnormal use of this tool." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Command Prompt Network Connection", + "note": "## Triage and analysis\n\n### Investigating Command Prompt Network Connection\n\nAttackers commonly transfer tooling or malware from external systems into a compromised environment using a command and control channel. However, they can also abuse signed utilities to drop these files.\n\nThis rule looks for a network connection to an external address from the `cmd.exe` utility, which can indicate the abuse of the utility to download malicious files and tools.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.\n- Investigate the target host that the signed binary is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Examine if any file was downloaded and check if it is an executable or script.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the downloaded file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of destination IP address and file name conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"cmd.exe\" and event.type == \"start\"]\n [network where host.os.type == \"windows\" and process.name : \"cmd.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "89f9a4b0-9f8f-4ee0-8823-c4751a6d6696_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/89fa6cb7-6b53-4de2-b604-648488841ab8_104.json b/packages/security_detection_engine/kibana/security_rule/89fa6cb7-6b53-4de2-b604-648488841ab8_104.json new file mode 100644 index 00000000000..21425394e18 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/89fa6cb7-6b53-4de2-b604-648488841ab8_104.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a DirectoryService PlugIns (dsplug) file. The DirectoryService daemon launches on each system boot and automatically reloads after crash. It scans and executes bundles that are located in the DirectoryServices PlugIns folder and can be abused by adversaries to maintain persistence.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Persistence via DirectoryService Plugin Modification", + "query": "event.category:file and host.os.type:macos and not event.type:deletion and\n file.path:/Library/DirectoryServices/PlugIns/*.dsplug\n", + "references": [ + "https://blog.chichou.me/2019/11/21/two-macos-persistence-tricks-abusing-plugins/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "89fa6cb7-6b53-4de2-b604-648488841ab8", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "89fa6cb7-6b53-4de2-b604-648488841ab8_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_1.json b/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_1.json new file mode 100644 index 00000000000..799c8b149f3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_1.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a symbolic link to a suspicious file or location. A symbolic link is a reference to a file or directory that acts as a pointer or shortcut, allowing users to access the target file or directory from a different location in the file system. An attacker can potentially leverage symbolic links for privilege escalation by tricking a privileged process into following the symbolic link to a sensitive file, giving the attacker access to data or capabilities they would not normally have.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Symbolic Link Created", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and \nevent.type == \"start\" and process.name == \"ln\" and \n (\n /* suspicious files */\n (process.args in (\"/etc/shadow\", \"/etc/shadow-\", \"/etc/shadow~\", \"/etc/gshadow\", \"/etc/gshadow-\") or \n (process.working_directory == \"/etc\" and process.args in (\"shadow\", \"shadow-\", \"shadow~\", \"gshadow\", \"gshadow-\"))) or \n \n /* suspicious bins */\n (process.args in (\"/bin/bash\", \"/bin/dash\", \"/bin/sh\", \"/bin/tcsh\", \"/bin/csh\", \"/bin/zsh\", \"/bin/ksh\", \"/bin/fish\") or \n (process.working_directory == \"/bin\" and process.args : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\"))) or \n (process.args in (\"/usr/bin/bash\", \"/usr/bin/dash\", \"/usr/bin/sh\", \"/usr/bin/tcsh\", \"/usr/bin/csh\", \"/usr/bin/zsh\", \"/usr/bin/ksh\", \"/usr/bin/fish\") or \n (process.working_directory == \"/usr/bin\" and process.args in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\"))) or\n \n /* suspicious locations */\n (process.args : (\"/etc/cron.d/*\", \"/etc/cron.daily/*\", \"/etc/cron.hourly/*\", \"/etc/cron.weekly/*\", \"/etc/cron.monthly/*\")) or\n (process.args : (\"/home/*/.ssh/*\", \"/root/.ssh/*\",\"/etc/sudoers.d/*\", \"/dev/shm/*\"))\n ) and \nnot user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "8a024633-c444-45c0-a4fe-78128d8c1ab6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "8a024633-c444-45c0-a4fe-78128d8c1ab6_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_2.json b/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_2.json new file mode 100644 index 00000000000..fe1d887f7c8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8a024633-c444-45c0-a4fe-78128d8c1ab6_2.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a symbolic link to a suspicious file or location. A symbolic link is a reference to a file or directory that acts as a pointer or shortcut, allowing users to access the target file or directory from a different location in the file system. An attacker can potentially leverage symbolic links for privilege escalation by tricking a privileged process into following the symbolic link to a sensitive file, giving the attacker access to data or capabilities they would not normally have.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Symbolic Link Created", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and \nevent.type == \"start\" and process.name == \"ln\" and \n (\n /* suspicious files */\n (process.args in (\"/etc/shadow\", \"/etc/shadow-\", \"/etc/shadow~\", \"/etc/gshadow\", \"/etc/gshadow-\") or \n (process.working_directory == \"/etc\" and process.args in (\"shadow\", \"shadow-\", \"shadow~\", \"gshadow\", \"gshadow-\"))) or \n \n /* suspicious bins */\n (process.args in (\"/bin/bash\", \"/bin/dash\", \"/bin/sh\", \"/bin/tcsh\", \"/bin/csh\", \"/bin/zsh\", \"/bin/ksh\", \"/bin/fish\") or \n (process.working_directory == \"/bin\" and process.args : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\"))) or \n (process.args in (\"/usr/bin/bash\", \"/usr/bin/dash\", \"/usr/bin/sh\", \"/usr/bin/tcsh\", \"/usr/bin/csh\", \"/usr/bin/zsh\", \"/usr/bin/ksh\", \"/usr/bin/fish\") or \n (process.working_directory == \"/usr/bin\" and process.args in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\"))) or\n \n /* suspicious locations */\n (process.args : (\"/etc/cron.d/*\", \"/etc/cron.daily/*\", \"/etc/cron.hourly/*\", \"/etc/cron.weekly/*\", \"/etc/cron.monthly/*\")) or\n (process.args : (\"/home/*/.ssh/*\", \"/root/.ssh/*\",\"/etc/sudoers.d/*\", \"/dev/shm/*\"))\n ) and \n process.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n not user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "8a024633-c444-45c0-a4fe-78128d8c1ab6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "8a024633-c444-45c0-a4fe-78128d8c1ab6_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8a1b0278-0f9a-487d-96bd-d4833298e87a_103.json b/packages/security_detection_engine/kibana/security_rule/8a1b0278-0f9a-487d-96bd-d4833298e87a_103.json new file mode 100644 index 00000000000..d4cd8b02e1c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8a1b0278-0f9a-487d-96bd-d4833298e87a_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary may add the setuid or setgid bit to a file or directory in order to run a file with the privileges of the owning user or group. An adversary can take advantage of this to either do a shell escape or exploit a vulnerability in an application with the setuid or setgid bit to get code running in a different user\u2019s context. Additionally, adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "lucene", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Setuid / Setgid Bit Set via chmod", + "query": "event.category:process AND event.type:(start OR process_started) AND\n process.name:chmod AND process.args:(\"+s\" OR \"u+s\" OR /4[0-9]{3}/ OR g+s OR /2[0-9]{3}/) AND\n NOT process.args:\n (\n /.*\\/Applications\\/VirtualBox.app\\/.+/ OR\n /\\/usr\\/local\\/lib\\/python.+/ OR\n /\\/var\\/folders\\/.+\\/FP.*nstallHelper/ OR\n /\\/Library\\/Filesystems\\/.+/ OR\n /\\/usr\\/lib\\/virtualbox\\/.+/ OR\n /\\/Library\\/Application.*/ OR\n \"/run/postgresql\" OR\n \"/var/crash\" OR\n \"/var/run/postgresql\" OR\n /\\/usr\\/bin\\/.+/ OR /\\/usr\\/local\\/share\\/.+/ OR\n /\\/Applications\\/.+/ OR /\\/usr\\/libexec\\/.+/ OR\n \"/var/metrics\" OR /\\/var\\/lib\\/dpkg\\/.+/ OR\n /\\/run\\/log\\/journal\\/.*/ OR\n \\/Users\\/*\\/.minikube\\/bin\\/docker-machine-driver-hyperkit\n ) AND\n NOT process.parent.executable:\n (\n /\\/var\\/lib\\/docker\\/.+/ OR\n \"/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service\" OR\n \"/var/lib/dpkg/info/whoopsie.postinst\"\n )\n", + "related_integrations": [], + "risk_score": 21, + "rule_id": "8a1b0278-0f9a-487d-96bd-d4833298e87a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.001", + "name": "Setuid and Setgid", + "reference": "https://attack.mitre.org/techniques/T1548/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "8a1b0278-0f9a-487d-96bd-d4833298e87a_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8a1d4831-3ce6-4859-9891-28931fa6101d_104.json b/packages/security_detection_engine/kibana/security_rule/8a1d4831-3ce6-4859-9891-28931fa6101d_104.json new file mode 100644 index 00000000000..c0c4222900e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8a1d4831-3ce6-4859-9891-28931fa6101d_104.json @@ -0,0 +1,137 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a script interpreter or signed binary is launched via a non-standard working directory. An attacker may use this technique to evade defenses.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Execution from a Mounted Device", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.executable : \"C:\\\\*\" and\n (process.working_directory : \"?:\\\\\" and not process.working_directory: \"C:\\\\\") and\n process.parent.name : \"explorer.exe\" and\n process.name : (\"rundll32.exe\", \"mshta.exe\", \"powershell.exe\", \"pwsh.exe\", \"cmd.exe\", \"regsvr32.exe\",\n \"cscript.exe\", \"wscript.exe\")\n", + "references": [ + "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", + "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8a1d4831-3ce6-4859-9891-28931fa6101d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.005", + "name": "Mshta", + "reference": "https://attack.mitre.org/techniques/T1218/005/" + }, + { + "id": "T1218.010", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1218/010/" + }, + { + "id": "T1218.011", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1218/011/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "8a1d4831-3ce6-4859-9891-28931fa6101d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8a5c1e5f-ad63-481e-b53a-ef959230f7f1_104.json b/packages/security_detection_engine/kibana/security_rule/8a5c1e5f-ad63-481e-b53a-ef959230f7f1_104.json new file mode 100644 index 00000000000..c8f51afcf83 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8a5c1e5f-ad63-481e-b53a-ef959230f7f1_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if your organization's Okta network zones are regularly modified." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate an Okta Network Zone", + "note": "## Triage and analysis\n\n### Investigating Attempt to Deactivate an Okta Network Zone\n\nThe Okta network zones can be configured to restrict or limit access to a network based on IP addresses or geolocations. Deactivating a network zone in Okta may remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.\n\n#### Possible investigation steps\n\n- Identify the actor related to the alert by reviewing the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.\n- Examine the `event.action` field to confirm the deactivation of a network zone.\n- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the network zone that was deactivated.\n- Investigate the `event.time` field to understand when the event happened.\n- Review the actor's activities before and after the event to understand the context of this event.\n\n### False positive analysis\n\n- Check the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's normal behavior, it might be a false positive.\n- Check if the actor is a known administrator or part of the IT team who might have a legitimate reason to deactivate a network zone.\n- Verify the actor's actions with any known planned changes or maintenance activities.\n\n### Response and remediation\n\n- If unauthorized access or actions are confirmed, immediately lock the affected actor account and require a password change.\n- Re-enable the deactivated network zone if it was deactivated without authorization.\n- Review and update the privileges of the actor who initiated the deactivation.\n- Check the security policies and procedures to identify any gaps and update them as necessary.\n- Implement additional monitoring and logging of Okta events to improve visibility of user actions.\n- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.", + "query": "event.dataset:okta.system and event.action:zone.deactivate\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8a5c1e5f-ad63-481e-b53a-ef959230f7f1", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Network Security Monitoring", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "8a5c1e5f-ad63-481e-b53a-ef959230f7f1_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8acb7614-1d92-4359-bfcf-478b6d9de150_105.json b/packages/security_detection_engine/kibana/security_rule/8acb7614-1d92-4359-bfcf-478b6d9de150_105.json new file mode 100644 index 00000000000..0f93db731d1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8acb7614-1d92-4359-bfcf-478b6d9de150_105.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious child processes of the Java interpreter process. This may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a JAVA specific vulnerability.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious JAVA Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious Java Child Process\n\nThis rule identifies a suspicious child process of the Java interpreter process. It may indicate an attempt to execute a malicious JAR file or an exploitation attempt via a Java specific vulnerability.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n- Examine the command line to determine if the command executed is potentially harmful or malicious.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of process and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where event.type in (\"start\", \"process_started\") and\n process.parent.name : \"java\" and\n process.name : (\"sh\", \"bash\", \"dash\", \"ksh\", \"tcsh\", \"zsh\", \"curl\", \"wget\")\n", + "references": [ + "https://www.lunasec.io/docs/blog/log4j-zero-day/", + "https://github.com/christophetd/log4shell-vulnerable-app", + "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf", + "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security", + "https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8acb7614-1d92-4359-bfcf-478b6d9de150", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.007", + "name": "JavaScript", + "reference": "https://attack.mitre.org/techniques/T1059/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "8acb7614-1d92-4359-bfcf-478b6d9de150_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8af5b42f-8d74-48c8-a8d0-6d14b4197288_1.json b/packages/security_detection_engine/kibana/security_rule/8af5b42f-8d74-48c8-a8d0-6d14b4197288_1.json new file mode 100644 index 00000000000..e35a51e28dd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8af5b42f-8d74-48c8-a8d0-6d14b4197288_1.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of a suspicious sudo command that is leveraged in CVE-2019-14287 to escalate privileges to root. Sudo does not verify the presence of the designated user ID and proceeds to execute using a user ID that can be chosen arbitrarily. By using the sudo privileges, the command \"sudo -u#-1\" translates to an ID of 0, representing the root user. This exploit may work for sudo versions prior to v1.28.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Sudo Privilege Escalation via CVE-2019-14287", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"sudo\" and process.args == \"-u#-1\"\n", + "references": [ + "https://www.exploit-db.com/exploits/47502" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8af5b42f-8d74-48c8-a8d0-6d14b4197288", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend", + "Use Case: Vulnerability" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "8af5b42f-8d74-48c8-a8d0-6d14b4197288_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8b2b3a62-a598-4293-bc14-3d5fa22bb98f_105.json b/packages/security_detection_engine/kibana/security_rule/8b2b3a62-a598-4293-bc14-3d5fa22bb98f_105.json new file mode 100644 index 00000000000..a484bc3e831 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8b2b3a62-a598-4293-bc14-3d5fa22bb98f_105.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Masquerading can allow an adversary to evade defenses and better blend in with the environment. One way it occurs is when the name or location of a file is manipulated as a means of tricking a user into executing what they think is a benign file type but is actually executable code.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Executable File Creation with Multiple Extensions", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and file.extension : \"exe\" and\n file.name regex~ \"\"\".*\\.(vbs|vbe|bat|js|cmd|wsh|ps1|pdf|docx?|xlsx?|pptx?|txt|rtf|gif|jpg|png|bmp|hta|txt|img|iso)\\.exe\"\"\" and\n not (process.executable : (\"?:\\\\Windows\\\\System32\\\\msiexec.exe\", \"C:\\\\Users\\\\*\\\\QGIS_SCCM\\\\Files\\\\QGIS-OSGeo4W-*-Setup-x86_64.exe\") and\n file.path : \"?:\\\\Program Files\\\\QGIS *\\\\apps\\\\grass\\\\*.exe\") and\n not process.executable : (\"/bin/sh\", \"/usr/sbin/MailScanner\", \"/usr/bin/perl\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8b2b3a62-a598-4293-bc14-3d5fa22bb98f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.007", + "name": "Double File Extension", + "reference": "https://attack.mitre.org/techniques/T1036/007/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "8b2b3a62-a598-4293-bc14-3d5fa22bb98f_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8b4f0816-6a65-4630-86a6-c21c179c0d09_106.json b/packages/security_detection_engine/kibana/security_rule/8b4f0816-6a65-4630-86a6-c21c179c0d09_106.json new file mode 100644 index 00000000000..7f00d16b41c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8b4f0816-6a65-4630-86a6-c21c179c0d09_106.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the netsh.exe program to enable host discovery via the network. Attackers can use this command-line tool to weaken the host firewall settings.", + "false_positives": [ + "Host Windows Firewall planned system administration changes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Enable Host Network Discovery via Netsh", + "note": "## Triage and analysis\n\n### Investigating Enable Host Network Discovery via Netsh\n\nThe Windows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.\n\nAttackers can enable Network Discovery on the Windows firewall to find other systems present in the same network. Systems with this setting enabled will communicate with other systems using broadcast messages, which can be used to identify targets for lateral movement. This rule looks for the setup of this setting using the netsh utility.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the Administrator is aware of the activity and there are justifications for this configuration.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Disable Network Discovery:\n - Using netsh: `netsh advfirewall firewall set rule group=\"Network Discovery\" new enable=No`\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\nprocess.name : \"netsh.exe\" and\nprocess.args : (\"firewall\", \"advfirewall\") and process.args : \"group=Network Discovery\" and process.args : \"enable=Yes\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8b4f0816-6a65-4630-86a6-c21c179c0d09", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.004", + "name": "Disable or Modify System Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "8b4f0816-6a65-4630-86a6-c21c179c0d09_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8c1bdde8-4204-45c0-9e0c-c85ca3902488_102.json b/packages/security_detection_engine/kibana/security_rule/8c1bdde8-4204-45c0-9e0c-c85ca3902488_102.json new file mode 100644 index 00000000000..70a7ca9e8b1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8c1bdde8-4204-45c0-9e0c-c85ca3902488_102.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.", + "false_positives": [ + "Some network security policies allow RDP directly from the Internet but usage that is unfamiliar to server or network owners can be unexpected and suspicious. RDP services may be exposed directly to the Internet in some networks such as cloud environments. In such cases, only RDP gateways, bastions or jump servers may be expected expose RDP directly to the Internet and can be exempted from this rule. RDP may be required by some work-flows such as remote access and support for specialized software products and servers. Such work-flows are usually known and not unexpected." + ], + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "RDP (Remote Desktop Protocol) from the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:3389 or event.dataset:zeek.rdp) and\n not source.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n ) and\n destination.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 47, + "rule_id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488", + "severity": "medium", + "tags": [ + "Tactic: Command and Control", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timeline_id": "300afc76-072d-4261-864d-4149714bf3f1", + "timeline_title": "Comprehensive Network Timeline", + "timestamp_override": "event.ingested", + "type": "query", + "version": 102 + }, + "id": "8c1bdde8-4204-45c0-9e0c-c85ca3902488_102", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45_106.json b/packages/security_detection_engine/kibana/security_rule/8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45_106.json new file mode 100644 index 00000000000..846d839b07a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45_106.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an unexpected process spawning from dns.exe, the process responsible for Windows DNS server services, which may indicate activity related to remote code execution or other forms of exploitation.", + "false_positives": [ + "Werfault.exe will legitimately spawn when dns.exe crashes, but the DNS service is very stable and so this is a low occurring event. Denial of Service (DoS) attempts by intentionally crashing the service will also cause werfault.exe to spawn." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Child Process of dns.exe", + "note": "## Triage and analysis\n\n### Investigating Unusual Child Process of dns.exe\n\nSIGRed (CVE-2020-1350) is a wormable, critical vulnerability in the Windows DNS server that affects Windows Server versions 2003 to 2019 and can be triggered by a malicious DNS response. Because the service is running in elevated privileges (SYSTEM), an attacker that successfully exploits it is granted Domain Administrator rights. This can effectively compromise the entire corporate infrastructure.\n\nThis rule looks for unusual children of the `dns.exe` process, which can indicate the exploitation of the SIGRed or a similar remote code execution vulnerability in the DNS server.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes.\n - Any suspicious or abnormal child process spawned from dns.exe should be carefully reviewed and investigated. It's impossible to predict what an adversary may deploy as the follow-on process after the exploit, but built-in discovery/enumeration utilities should be top of mind (`whoami.exe`, `netstat.exe`, `systeminfo.exe`, `tasklist.exe`).\n - Built-in Windows programs that contain capabilities used to download and execute additional payloads should also be considered. This is not an exhaustive list, but ideal candidates to start out would be: `mshta.exe`, `powershell.exe`, `regsvr32.exe`, `rundll32.exe`, `wscript.exe`, `wmic.exe`.\n - If a denial-of-service (DoS) exploit is successful and DNS Server service crashes, be mindful of potential child processes related to `werfault.exe` occurring.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the host during the past 48 hours.\n- Check whether the server is vulnerable to CVE-2020-1350.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system or restore the compromised server to a clean state.\n- Install the latest patches on systems that run Microsoft DNS Server.\n- Consider the implementation of a patch management system, such as the Windows Server Update Services (WSUS).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"dns.exe\" and\n not process.name : \"conhost.exe\"\n", + "references": [ + "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", + "https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/", + "https://github.com/maxpl0it/CVE-2020-1350-DoS", + "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1133", + "name": "External Remote Services", + "reference": "https://attack.mitre.org/techniques/T1133/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "8c37dc0e-e3ac-4c97-8aa0-cf6a9122de45_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8c81e506-6e82-4884-9b9a-75d3d252f967_105.json b/packages/security_detection_engine/kibana/security_rule/8c81e506-6e82-4884-9b9a-75d3d252f967_105.json new file mode 100644 index 00000000000..bb08b878b52 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8c81e506-6e82-4884-9b9a-75d3d252f967_105.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potential behavior of SharpRDP, which is a tool that can be used to perform authenticated command execution against a remote target via Remote Desktop Protocol (RDP) for the purposes of lateral movement.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential SharpRDP Behavior", + "query": "/* Incoming RDP followed by a new RunMRU string value set to cmd, powershell, taskmgr or tsclient, followed by process execution within 1m */\n\nsequence by host.id with maxspan=1m\n [network where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"svchost.exe\" and destination.port == 3389 and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ]\n\n [registry where host.os.type == \"windows\" and process.name : \"explorer.exe\" and\n registry.path : (\"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\RunMRU\\\\*\") and\n registry.data.strings : (\"cmd.exe*\", \"powershell.exe*\", \"taskmgr*\", \"\\\\\\\\tsclient\\\\*.exe\\\\*\")\n ]\n\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.parent.name : (\"cmd.exe\", \"powershell.exe\", \"taskmgr.exe\") or process.args : (\"\\\\\\\\tsclient\\\\*.exe\")) and\n not process.name : \"conhost.exe\"\n ]\n", + "references": [ + "https://posts.specterops.io/revisiting-remote-desktop-lateral-movement-8fb905cb46c3", + "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Lateral%20Movement/LM_sysmon_3_12_13_1_SharpRDP.evtx" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 73, + "rule_id": "8c81e506-6e82-4884-9b9a-75d3d252f967", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.001", + "name": "Remote Desktop Protocol", + "reference": "https://attack.mitre.org/techniques/T1021/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "8c81e506-6e82-4884-9b9a-75d3d252f967_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_6.json b/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_6.json new file mode 100644 index 00000000000..1976c7eefc4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_6.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential SSH Password Guessing", + "note": "## Triage and analysis\n\n### Investigating Potential SSH Password Guessing Attack\n\nThe rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the same target host indicating a successful attempt of brute force password guessing.\n\n#### Possible investigation steps\n\n- Investigate the login failure user name(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Ensure active session(s) on the host(s) are terminated as the attacker could have gained initial access to the system(s).\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", + "query": "sequence by host.id, source.ip, user.name with maxspan=3s\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"failure\" and source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::\" ] with runs=10\n\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"success\" and source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::\" ]\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8cb84371-d053-4f4f-bce0-c74990e28f28", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 6 + }, + "id": "8cb84371-d053-4f4f-bce0-c74990e28f28_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_7.json b/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_7.json new file mode 100644 index 00000000000..bac5d22abb2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8cb84371-d053-4f4f-bce0-c74990e28f28_7.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple SSH login failures followed by a successful one from the same source address. Adversaries can attempt to login into multiple users with a common or known password to gain access to accounts.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Successful SSH Brute Force Attack", + "note": "## Triage and analysis\n\n### Investigating Potential Successful SSH Brute Force Attack\n\nThe rule identifies consecutive SSH login failures followed by a successful login from the same source IP address to the same target host indicating a successful attempt of brute force password guessing.\n\n#### Possible investigation steps\n\n- Investigate the login failure user name(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Ensure active session(s) on the host(s) are terminated as the attacker could have gained initial access to the system(s).\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", + "query": "sequence by host.id, source.ip, user.name with maxspan=3s\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"failure\" and source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::\" ] with runs=10\n\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"success\" and source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::\" ]\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "8cb84371-d053-4f4f-bce0-c74990e28f28", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 7 + }, + "id": "8cb84371-d053-4f4f-bce0-c74990e28f28_7", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9_105.json b/packages/security_detection_engine/kibana/security_rule/8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9_105.json new file mode 100644 index 00000000000..72dad2b7f9c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9_105.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an attempt to exploit a local privilege escalation in polkit pkexec (CVE-2021-4034) via unsecure environment variable injection. Successful exploitation allows an unprivileged user to escalate to the root user.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via PKEXEC", + "query": "file where host.os.type == \"linux\" and file.path : \"/*GCONV_PATH*\"\n", + "references": [ + "https://seclists.org/oss-sec/2022/q1/80", + "https://haxx.in/files/blasty-vs-pkexec.c" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.007", + "name": "Path Interception by PATH Environment Variable", + "reference": "https://attack.mitre.org/techniques/T1574/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "8da41fc9-7735-4b24-9cc6-c78dfc9fc9c9_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8e39f54e-910b-4adb-a87e-494fbba5fb65_1.json b/packages/security_detection_engine/kibana/security_rule/8e39f54e-910b-4adb-a87e-494fbba5fb65_1.json new file mode 100644 index 00000000000..f41bcb7d209 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8e39f54e-910b-4adb-a87e-494fbba5fb65_1.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may attempt to connect to a remote system over Windows Remote Desktop Protocol (RDP) to achieve lateral movement. Adversaries may avoid using the Microsoft Terminal Services Client (mstsc.exe) binary to establish an RDP connection to evade detection.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Outgoing RDP Connection by Unusual Process", + "query": "network where host.os.type == \"windows\" and\n event.action == \"connection_attempted\" and destination.port == 3389 and\n not process.executable : \"?:\\\\Windows\\\\System32\\\\mstsc.exe\" and\n destination.ip != \"::1\" and destination.ip != \"127.0.0.1\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "8e39f54e-910b-4adb-a87e-494fbba5fb65", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.001", + "name": "Remote Desktop Protocol", + "reference": "https://attack.mitre.org/techniques/T1021/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "8e39f54e-910b-4adb-a87e-494fbba5fb65_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8eec4df1-4b4b-4502-b6c3-c788714604c9_1.json b/packages/security_detection_engine/kibana/security_rule/8eec4df1-4b4b-4502-b6c3-c788714604c9_1.json new file mode 100644 index 00000000000..d3555eb3a48 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8eec4df1-4b4b-4502-b6c3-c788714604c9_1.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism. Adversaries may abuse BITS to persist, download, execute, and even clean up after running malicious code.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Bitsadmin Activity", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n (process.name : \"bitsadmin.exe\" and process.args : (\n \"*Transfer*\", \"*Create*\", \"AddFile\", \"*SetNotifyFlags*\", \"*SetNotifyCmdLine*\",\n \"*SetMinRetryDelay*\", \"*SetCustomHeaders*\", \"*Resume*\")\n ) or\n (process.name : \"powershell.exe\" and process.args : (\n \"*Start-BitsTransfer*\", \"*Add-BitsFile*\",\n \"*Resume-BitsTransfer*\", \"*Set-BitsTransfer*\", \"*BITS.Manager*\")\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "8eec4df1-4b4b-4502-b6c3-c788714604c9", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "8eec4df1-4b4b-4502-b6c3-c788714604c9_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8f3e91c7-d791-4704-80a1-42c160d7aa27_104.json b/packages/security_detection_engine/kibana/security_rule/8f3e91c7-d791-4704-80a1-42c160d7aa27_104.json new file mode 100644 index 00000000000..305f3007a82 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8f3e91c7-d791-4704-80a1-42c160d7aa27_104.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies port monitor and print processor registry modifications. Adversaries may abuse port monitor and print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence, if permissions allow writing a fully-qualified pathname for that DLL.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Port Monitor or Print Processor Registration Abuse", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Print\\\\Monitors\\\\*\",\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Print Processors\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Print\\\\Monitors\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Print\\\\Environments\\\\Windows*\\\\Print Processors\\\\*\"\n ) and registry.data.strings : \"*.dll\" and\n /* exclude SYSTEM SID - look for changes by non-SYSTEM user */\n not user.id : \"S-1-5-18\"\n", + "references": [ + "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "8f3e91c7-d791-4704-80a1-42c160d7aa27", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.010", + "name": "Port Monitors", + "reference": "https://attack.mitre.org/techniques/T1547/010/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.010", + "name": "Port Monitors", + "reference": "https://attack.mitre.org/techniques/T1547/010/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "8f3e91c7-d791-4704-80a1-42c160d7aa27_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/8f919d4b-a5af-47ca-a594-6be59cd924a4_105.json b/packages/security_detection_engine/kibana/security_rule/8f919d4b-a5af-47ca-a594-6be59cd924a4_105.json new file mode 100644 index 00000000000..64600f338bd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/8f919d4b-a5af-47ca-a594-6be59cd924a4_105.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of Distributed Component Object Model (DCOM) to run commands from a remote host, which are launched via the ShellBrowserWindow or ShellWindows Application COM Object. This behavior may indicate an attacker abusing a DCOM application to stealthily move laterally.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows", + "query": "sequence by host.id with maxspan=5s\n [network where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"explorer.exe\" and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n source.port \u003e 49151 and destination.port \u003e 49151 and source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ] by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"explorer.exe\"\n ] by process.parent.entity_id\n", + "references": [ + "https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "8f919d4b-a5af-47ca-a594-6be59cd924a4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.003", + "name": "Distributed Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1021/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "8f919d4b-a5af-47ca-a594-6be59cd924a4_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/90169566-2260-4824-b8e4-8615c3b4ed52_105.json b/packages/security_detection_engine/kibana/security_rule/90169566-2260-4824-b8e4-8615c3b4ed52_105.json new file mode 100644 index 00000000000..5196562b968 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/90169566-2260-4824-b8e4-8615c3b4ed52_105.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Hping ran on a Linux host. Hping is a FOSS command-line packet analyzer and has the ability to construct network packets for a wide variety of network security testing applications, including scanning and firewall auditing.", + "false_positives": [ + "Normal use of hping is uncommon apart from security testing and research. Use by non-security engineers is very uncommon." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Hping Process Activity", + "query": "process where host.os.type == \"linux\" and event.type == \"start\"\nand process.name in (\"hping\", \"hping2\", \"hping3\")\n", + "references": [ + "https://en.wikipedia.org/wiki/Hping" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "90169566-2260-4824-b8e4-8615c3b4ed52", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "90169566-2260-4824-b8e4-8615c3b4ed52_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9092cd6c-650f-4fa3-8a8a-28256c7489c9_104.json b/packages/security_detection_engine/kibana/security_rule/9092cd6c-650f-4fa3-8a8a-28256c7489c9_104.json new file mode 100644 index 00000000000..1dceb80438f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9092cd6c-650f-4fa3-8a8a-28256c7489c9_104.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may collect keychain storage data from a system to in order to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos.", + "false_positives": [ + "Applications for password management." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Keychain Password Retrieval via Command Line", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type == \"start\" and\n process.name : \"security\" and process.args : \"-wa\" and process.args : (\"find-generic-password\", \"find-internet-password\") and\n process.args : (\"Chrome*\", \"Chromium\", \"Opera\", \"Safari*\", \"Brave\", \"Microsoft Edge\", \"Edge\", \"Firefox*\") and\n not process.parent.executable : \"/Applications/Keeper Password Manager.app/Contents/Frameworks/Keeper Password Manager Helper*/Contents/MacOS/Keeper Password Manager Helper*\"\n", + "references": [ + "https://www.netmeister.org/blog/keychain-passwords.html", + "https://github.com/priyankchheda/chrome_password_grabber/blob/master/chrome.py", + "https://ss64.com/osx/security.html", + "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "9092cd6c-650f-4fa3-8a8a-28256c7489c9", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.001", + "name": "Keychain", + "reference": "https://attack.mitre.org/techniques/T1555/001/" + } + ] + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.003", + "name": "Credentials from Web Browsers", + "reference": "https://attack.mitre.org/techniques/T1555/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "9092cd6c-650f-4fa3-8a8a-28256c7489c9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/90babaa8-5216-4568-992d-d4a01a105d98_1.json b/packages/security_detection_engine/kibana/security_rule/90babaa8-5216-4568-992d-d4a01a105d98_1.json new file mode 100644 index 00000000000..4896ccdaa92 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/90babaa8-5216-4568-992d-d4a01a105d98_1.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. Adversaries may use InstallUtil to proxy the execution of code through a trusted Windows utility.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "InstallUtil Activity", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"installutil.exe\" and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "90babaa8-5216-4568-992d-d4a01a105d98", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.004", + "name": "InstallUtil", + "reference": "https://attack.mitre.org/techniques/T1218/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "90babaa8-5216-4568-992d-d4a01a105d98_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8d77-07827ac4cee0_103.json b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8d77-07827ac4cee0_103.json new file mode 100644 index 00000000000..5a58a9ae4c8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8d77-07827ac4cee0_103.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a rare and unusual user agent indicating web browsing activity by an unusual process other than a web browser. This can be due to persistence, command-and-control, or exfiltration activity. Uncommon user agents coming from remote sources to local destinations are often the result of scanners, bots, and web scrapers, which are part of common Internet background traffic. Much of this is noise, but more targeted attacks on websites using tools like Burp or SQLmap can sometimes be discovered by spotting uncommon user agents. Uncommon user agents in traffic from local sources to remote destinations can be any number of things, including harmless programs like weather monitoring or stock-trading programs. However, uncommon user agents from local sources can also be due to malware or scanning activity.", + "false_positives": [ + "Web activity that is uncommon, like security scans, may trigger this alert and may need to be excluded. A new or rarely used program that calls web services may trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "packetbeat_rare_user_agent", + "name": "Unusual Web User Agent", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8d77-07827ac4cee0", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "91f02f01-969f-4167-8d77-07827ac4cee0_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f55-07827ac3acc9_103.json b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f55-07827ac3acc9_103.json new file mode 100644 index 00000000000..f755f38176f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f55-07827ac3acc9_103.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a rare and unusual URL that indicates unusual web browsing activity. This can be due to initial access, persistence, command-and-control, or exfiltration activity. For example, in a strategic web compromise or watering hole attack, when a trusted website is compromised to target a particular sector or organization, targeted users may receive emails with uncommon URLs for trusted websites. These URLs can be used to download and run a payload. When malware is already running, it may send requests to uncommon URLs on trusted websites the malware uses for command-and-control communication. When rare URLs are observed being requested for a local web server by a remote source, these can be due to web scanning, enumeration or attack traffic, or they can be due to bots and web scrapers which are part of common Internet background traffic.", + "false_positives": [ + "Web activity that occurs rarely in small quantities can trigger this alert. Possible examples are browsing technical support or vendor URLs that are used very sparsely. A user who visits a new and unique web destination may trigger this alert when the activity is sparse. Web applications that generate URLs unique to a transaction may trigger this when they are used sparsely. Web domains can be excluded in cases such as these." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "packetbeat_rare_urls", + "name": "Unusual Web Request", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f55-07827ac3acc9", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "91f02f01-969f-4167-8f55-07827ac3acc9_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f66-07827ac3bdd9_103.json b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f66-07827ac3bdd9_103.json new file mode 100644 index 00000000000..2636ad1a3ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/91f02f01-969f-4167-8f66-07827ac3bdd9_103.json @@ -0,0 +1,60 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.", + "false_positives": [ + "DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "packetbeat_dns_tunneling", + "name": "DNS Tunneling", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "91f02f01-969f-4167-8f66-07827ac3bdd9", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Command and Control" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "91f02f01-969f-4167-8f66-07827ac3bdd9_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/92984446-aefb-4d5e-ad12-598042ca80ba_5.json b/packages/security_detection_engine/kibana/security_rule/92984446-aefb-4d5e-ad12-598042ca80ba_5.json new file mode 100644 index 00000000000..293bbab9c4a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/92984446-aefb-4d5e-ad12-598042ca80ba_5.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Suspicious Script with Clipboard Retrieval Capabilities", + "note": "## Triage and analysis\n\n### Investigating PowerShell Suspicious Script with Clipboard Retrieval Capabilities\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell capabilities to get the contents of the clipboard with the goal of stealing credentials and other valuable information, such as credit card data and confidential conversations.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Determine whether the script stores the captured data locally.\n- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.\n- Assess network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users are unlikely to use scripting utilities to capture contents of the clipboard, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell Keylogging Script - bd2c86a0-8b61-4457-ab38-96943984e889\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n (powershell.file.script_block_text : (\n \"Windows.Clipboard\" or\n \"Windows.Forms.Clipboard\" or\n \"Windows.Forms.TextBox\"\n ) and\n powershell.file.script_block_text : (\n \"]::GetText\" or\n \".Paste()\"\n )) or powershell.file.script_block_text : \"Get-Clipboard\"\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n and not user.id : \"S-1-5-18\"\n and not file.path : (*WindowsPowerShell*Modules*.psd1 or *WindowsPowerShell*Modules*.psm1)\n and not (\n file.path : *WindowsPowerShell*Modules*.ps1 and\n file.name : (\"Convert-ExcelRangeToImage.ps1\" or \"Read-Clipboard.ps1\")\n )\n", + "references": [ + "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-clipboard", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-ClipboardContents.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "92984446-aefb-4d5e-ad12-598042ca80ba", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: PowerShell Logs", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1115", + "name": "Clipboard Data", + "reference": "https://attack.mitre.org/techniques/T1115/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 5 + }, + "id": "92984446-aefb-4d5e-ad12-598042ca80ba_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4_103.json b/packages/security_detection_engine/kibana/security_rule/931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4_103.json new file mode 100644 index 00000000000..392f702c517 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4_103.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A sudoers file specifies the commands that users or groups can run and from which terminals. Adversaries can take advantage of these configurations to execute commands as other users or spawn processes with higher privileges.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Sudoers File Modification", + "query": "event.category:file and event.type:change and file.path:(/etc/sudoers* or /private/etc/sudoers*)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "931e25a5-0f5e-4ae0-ba0d-9e94eff7e3a4_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/93b22c0a-06a0-4131-b830-b10d5e166ff4_106.json b/packages/security_detection_engine/kibana/security_rule/93b22c0a-06a0-4131-b830-b10d5e166ff4_106.json new file mode 100644 index 00000000000..3d325d8e508 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/93b22c0a-06a0-4131-b830-b10d5e166ff4_106.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious SolarWinds child process was detected, which may indicate an attempt to execute malicious programs.", + "false_positives": [ + "Trusted SolarWinds child processes, verify process details such as network connections and file writes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious SolarWinds Child Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name: (\"SolarWinds.BusinessLayerHost.exe\", \"SolarWinds.BusinessLayerHostx64.exe\") and\n not process.name : (\n \"APMServiceControl*.exe\",\n \"ExportToPDFCmd*.Exe\",\n \"SolarWinds.Credentials.Orion.WebApi*.exe\",\n \"SolarWinds.Orion.Topology.Calculator*.exe\",\n \"Database-Maint.exe\",\n \"SolarWinds.Orion.ApiPoller.Service.exe\",\n \"WerFault.exe\",\n \"WerMgr.exe\",\n \"SolarWinds.BusinessLayerHost.exe\",\n \"SolarWinds.BusinessLayerHostx64.exe\") and\n not process.executable : (\"?:\\\\Windows\\\\SysWOW64\\\\ARP.EXE\", \"?:\\\\Windows\\\\SysWOW64\\\\lodctr.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\unlodctr.exe\")\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", + "https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20CHILD%20PROCESSES%20(METHODOLOGY).ioc" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "93b22c0a-06a0-4131-b830-b10d5e166ff4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1195", + "name": "Supply Chain Compromise", + "reference": "https://attack.mitre.org/techniques/T1195/", + "subtechnique": [ + { + "id": "T1195.002", + "name": "Compromise Software Supply Chain", + "reference": "https://attack.mitre.org/techniques/T1195/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "93b22c0a-06a0-4131-b830-b10d5e166ff4_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/93c1ce76-494c-4f01-8167-35edfb52f7b1_105.json b/packages/security_detection_engine/kibana/security_rule/93c1ce76-494c-4f01-8167-35edfb52f7b1_105.json new file mode 100644 index 00000000000..1e17368d21f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/93c1ce76-494c-4f01-8167-35edfb52f7b1_105.json @@ -0,0 +1,73 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies registry write modifications to hide an encoded portable executable. This could be indicative of adversary defense evasion by avoiding the storing of malicious content directly on disk.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Encoded Executable Stored in the Registry", + "query": "registry where host.os.type == \"windows\" and\n/* update here with encoding combinations */\n registry.data.strings : \"TVqQAAMAAAAEAAAA*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + } + ], + "risk_score": 47, + "rule_id": "93c1ce76-494c-4f01-8167-35edfb52f7b1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "93c1ce76-494c-4f01-8167-35edfb52f7b1_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/93f47b6f-5728-4004-ba00-625083b3dcb0_104.json b/packages/security_detection_engine/kibana/security_rule/93f47b6f-5728-4004-ba00-625083b3dcb0_104.json new file mode 100644 index 00000000000..48f67187bdb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/93f47b6f-5728-4004-ba00-625083b3dcb0_104.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may modify the standard authentication module for persistence via patching the normal authorization process or modifying the login configuration to allow unauthorized access or elevate privileges.", + "false_positives": [ + "Trusted system module updates or allowed Pluggable Authentication Module (PAM) daemon configuration changes." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification of Standard Authentication Module or Configuration", + "query": "event.category:file and event.type:change and\n (file.name:pam_*.so or file.path:(/etc/pam.d/* or /private/etc/pam.d/* or /usr/lib64/security/*)) and\n process.executable:\n (* and\n not\n (\n /bin/yum or\n \"/usr/sbin/pam-auth-update\" or\n /usr/libexec/packagekitd or\n /usr/bin/dpkg or\n /usr/bin/vim or\n /usr/libexec/xpcproxy or\n /usr/bin/bsdtar or\n /usr/local/bin/brew or\n /usr/bin/rsync or\n /usr/bin/yum or\n /var/lib/docker/*/bin/yum or\n /var/lib/docker/*/bin/dpkg or\n ./merged/var/lib/docker/*/bin/dpkg or\n \"/System/Library/PrivateFrameworks/PackageKit.framework/Versions/A/XPCServices/package_script_service.xpc/Contents/MacOS/package_script_service\"\n )\n ) and\n not file.path:\n (\n /tmp/snap.rootfs_*/pam_*.so or\n /tmp/newroot/lib/*/pam_*.so or\n /private/var/folders/*/T/com.apple.fileprovider.ArchiveService/TemporaryItems/*/lib/security/pam_*.so or\n /tmp/newroot/usr/lib64/security/pam_*.so\n )\n", + "references": [ + "https://github.com/zephrax/linux-pam-backdoor", + "https://github.com/eurialo/pambd", + "http://0x90909090.blogspot.com/2016/06/creating-backdoor-in-pam-in-5-line-of.html", + "https://www.trendmicro.com/en_us/research/19/i/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "93f47b6f-5728-4004-ba00-625083b3dcb0", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1556", + "name": "Modify Authentication Process", + "reference": "https://attack.mitre.org/techniques/T1556/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "93f47b6f-5728-4004-ba00-625083b3dcb0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/947827c6-9ed6-4dec-903e-c856c86e72f3_1.json b/packages/security_detection_engine/kibana/security_rule/947827c6-9ed6-4dec-903e-c856c86e72f3_1.json new file mode 100644 index 00000000000..d9b38e98315 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/947827c6-9ed6-4dec-903e-c856c86e72f3_1.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Creation of Kernel Module", + "query": "file where event.type in (\"change\", \"creation\") and host.os.type == \"linux\" and\nfile.path : \"/lib/modules/*\" and file.name : \"*.ko\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "947827c6-9ed6-4dec-903e-c856c86e72f3", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "947827c6-9ed6-4dec-903e-c856c86e72f3_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/94a401ba-4fa2-455c-b7ae-b6e037afc0b7_4.json b/packages/security_detection_engine/kibana/security_rule/94a401ba-4fa2-455c-b7ae-b6e037afc0b7_4.json new file mode 100644 index 00000000000..6f3c65080a8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/94a401ba-4fa2-455c-b7ae-b6e037afc0b7_4.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the usage of gpresult.exe to query group policy objects. Attackers may query group policy objects during the reconnaissance phase after compromising a system to gain a better understanding of the active directory environment and possible methods to escalate privileges or move laterally.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Group Policy Discovery via Microsoft GPResult Utility", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(process.name: \"gpresult.exe\" or process.pe.original_file_name == \"gprslt.exe\") and process.args: (\"/z\", \"/v\", \"/r\", \"/x\")\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "94a401ba-4fa2-455c-b7ae-b6e037afc0b7", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1615", + "name": "Group Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1615/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "94a401ba-4fa2-455c-b7ae-b6e037afc0b7_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/954ee7c8-5437-49ae-b2d6-2960883898e9_106.json b/packages/security_detection_engine/kibana/security_rule/954ee7c8-5437-49ae-b2d6-2960883898e9_106.json new file mode 100644 index 00000000000..9dd4247b1f2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/954ee7c8-5437-49ae-b2d6-2960883898e9_106.json @@ -0,0 +1,130 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote scheduled task creations on a target host. This could be indicative of adversary lateral movement.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote Scheduled Task Creation", + "note": "## Triage and analysis\n\n### Investigating Remote Scheduled Task Creation\n\n[Scheduled tasks](https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler) are a great mechanism for persistence and program execution. These features can be used remotely for a variety of legitimate reasons, but at the same time used by malware and adversaries. When investigating scheduled tasks that were set up remotely, one of the first steps should be to determine the original intent behind the configuration and to verify if the activity is tied to benign behavior such as software installation or any kind of network administrator work. One objective for these alerts is to understand the configured action within the scheduled task. This is captured within the registry event data for this rule and can be base64 decoded to view the value.\n\n#### Possible investigation steps\n\n- Review the base64 encoded tasks actions registry value to investigate the task configured action.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Further examination should include review of host-based artifacts and network logs from around when the scheduled task was created, on both the source and target machines.\n\n### False positive analysis\n\n- There is a high possibility of benign activity tied to the creation of remote scheduled tasks as it is a general feature within Windows and used for legitimate purposes for a wide range of activity. Any kind of context should be found to further understand the source of the activity and determine the intent based on the scheduled task's contents.\n\n### Related rules\n\n- Service Command Lateral Movement - d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc\n- Remotely Started Services via RPC - aa9a274d-6b53-424d-ac5e-cb8ca4251650\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Remove scheduled task and any other related artifacts.\n- Review privileged account management and user account management settings. Consider implementing group policy object (GPO) policies to further restrict activity, or configuring settings that only allow administrators to create remote scheduled tasks.\n", + "query": "/* Task Scheduler service incoming connection followed by TaskCache registry modification */\n\nsequence by host.id, process.entity_id with maxspan = 1m\n [network where host.os.type == \"windows\" and process.name : \"svchost.exe\" and\n network.direction : (\"incoming\", \"ingress\") and source.port \u003e= 49152 and destination.port \u003e= 49152 and\n source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ]\n [registry where host.os.type == \"windows\" and registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks\\\\*\\\\Actions\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "954ee7c8-5437-49ae-b2d6-2960883898e9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "954ee7c8-5437-49ae-b2d6-2960883898e9_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/968ccab9-da51-4a87-9ce2-d3c9782fd759_106.json b/packages/security_detection_engine/kibana/security_rule/968ccab9-da51-4a87-9ce2-d3c9782fd759_106.json new file mode 100644 index 00000000000..b283cc15d9e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/968ccab9-da51-4a87-9ce2-d3c9782fd759_106.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects a file being made immutable using the chattr binary. Making a file immutable means it cannot be deleted or renamed, no link can be created to this file, most of the file's metadata can not be modified, and the file can not be opened in write mode. Threat actors will commonly utilize this to prevent tampering or modification of their malicious files or any system files they have modified for purposes of persistence (e.g .ssh, /etc/passwd, etc.).", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "File made Immutable by Chattr", + "note": "", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and user.name == \"root\" and\n process.executable : \"/usr/bin/chattr\" and process.args : (\"-*i*\", \"+*i*\") and\n not process.parent.executable: (\"/lib/systemd/systemd\", \"/usr/local/uems_agent/bin/*\", \"/usr/lib/systemd/systemd\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "968ccab9-da51-4a87-9ce2-d3c9782fd759", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/", + "subtechnique": [ + { + "id": "T1222.002", + "name": "Linux and Mac File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "968ccab9-da51-4a87-9ce2-d3c9782fd759_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_3.json b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_3.json new file mode 100644 index 00000000000..fdaebd62c92 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_3.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through MOTD File Creation Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through MOTD File Creation Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Executable files in these directories automatically run with root privileges.\n\nThis rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the modified scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Suspicious Process Spawned from MOTD Detected - 4ec47004-b34a-42e6-8003-376a123ea447\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not \nprocess.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\") and not file.extension : \"swp\"\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "96d11d31-9a79-480f-8401-da28b194608f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "type": "new_terms", + "version": 3 + }, + "id": "96d11d31-9a79-480f-8401-da28b194608f_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_4.json b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_4.json new file mode 100644 index 00000000000..29db3d7b517 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_4.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through MOTD File Creation Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through MOTD File Creation Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Executable files in these directories automatically run with root privileges.\n\nThis rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the modified scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Suspicious Process Spawned from MOTD Detected - 4ec47004-b34a-42e6-8003-376a123ea447\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not \nprocess.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\" or \"/kaniko/executor\") and not \nfile.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "96d11d31-9a79-480f-8401-da28b194608f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "type": "new_terms", + "version": 4 + }, + "id": "96d11d31-9a79-480f-8401-da28b194608f_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_5.json b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_5.json new file mode 100644 index 00000000000..ef6e5ab68e2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/96d11d31-9a79-480f-8401-da28b194608f_5.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Message of the day (MOTD) is the message that is presented to the user when a user connects to a Linux server via SSH or a serial connection. Linux systems contain several default MOTD files located in the \"/etc/update-motd.d/\" and \"/usr/lib/update-notifier/\" directories. These scripts run as the root user every time a user connects over SSH or a serial connection. Adversaries may create malicious MOTD files that grant them persistence onto the target every time a user connects to the system by executing a backdoor script or command. This rule detects the creation of potentially malicious files within the default MOTD file directories.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence Through MOTD File Creation Detected", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "note": "## Triage and analysis\n\n### Investigating Potential Persistence Through MOTD File Creation Detected\n\nThe message-of-the-day (MOTD) is used to display a customizable system-wide message or information to users upon login in Linux.\n\nAttackers can abuse message-of-the-day (motd) files to run scripts, commands or malicious software every time a user connects to a system over SSH or a serial connection, by creating a new file within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directory. Executable files in these directories automatically run with root privileges.\n\nThis rule identifies the creation of new files within the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible Investigation Steps\n\n- Investigate the file that was created or modified.\n - !{osquery{\"label\":\"Osquery - Retrieve File Information\",\"query\":\"SELECT * FROM file WHERE path = {{file.path}}\"}}\n- Investigate whether any other files in the `/etc/update-motd.d/` or `/usr/lib/update-notifier/` directories have been altered.\n - !{osquery{\"label\":\"Osquery - Retrieve File Listing Information\",\"query\":\"SELECT * FROM file WHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Additional File Listing Information\",\"query\":\"SELECT\\n f.path,\\n u.username AS file_owner,\\n g.groupname AS group_owner,\\n datetime(f.atime, 'unixepoch') AS file_last_access_time,\\n datetime(f.mtime, 'unixepoch') AS file_last_modified_time,\\n datetime(f.ctime, 'unixepoch') AS file_last_status_change_time,\\n datetime(f.btime, 'unixepoch') AS file_created_time,\\n f.size AS size_bytes\\nFROM\\n file f\\n LEFT JOIN users u ON f.uid = u.uid\\n LEFT JOIN groups g ON f.gid = g.gid\\nWHERE (path LIKE '/etc/update-motd.d/%' OR path LIKE '/usr/lib/update-notifier/%')\\n\"}}\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate whether the modified scripts call other malicious scripts elsewhere on the file system. \n - If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### Related Rules\n\n- Suspicious Process Spawned from MOTD Detected - 4ec47004-b34a-42e6-8003-376a123ea447\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the MOTD files or restore their original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type :\"linux\" and event.action:(\"creation\" or \"file_create_event\" or \"rename\" or \"file_rename_event\") and \nfile.path : (/etc/update-motd.d/* or /usr/lib/update-notifier/*) and not \nprocess.executable : (\"/usr/bin/dpkg\" or \"/usr/bin/dockerd\" or \"/bin/rpm\" or \"/kaniko/executor\") and not \nfile.extension : (\"swp\" or \"swx\")\n", + "references": [ + "https://pberba.github.io/security/2022/02/06/linux-threat-hunting-for-persistence-initialization-scripts-and-shell-configuration/#10-boot-or-logon-initialization-scripts-motd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "96d11d31-9a79-480f-8401-da28b194608f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "type": "new_terms", + "version": 5 + }, + "id": "96d11d31-9a79-480f-8401-da28b194608f_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/96e90768-c3b7-4df6-b5d9-6237f8bc36a8_104.json b/packages/security_detection_engine/kibana/security_rule/96e90768-c3b7-4df6-b5d9-6237f8bc36a8_104.json new file mode 100644 index 00000000000..26235897b50 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/96e90768-c3b7-4df6-b5d9-6237f8bc36a8_104.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may collect the keychain storage data from a system to acquire credentials. Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features such as WiFi passwords, websites, secure notes and certificates.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Access to Keychain Credentials Directories", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.args :\n (\n \"/Users/*/Library/Keychains/*\",\n \"/Library/Keychains/*\",\n \"/Network/Library/Keychains/*\",\n \"System.keychain\",\n \"login.keychain-db\",\n \"login.keychain\"\n ) and\n not process.args : (\"find-certificate\",\n \"add-trusted-cert\",\n \"set-keychain-settings\",\n \"delete-certificate\",\n \"/Users/*/Library/Keychains/openvpn.keychain-db\",\n \"show-keychain-info\",\n \"lock-keychain\",\n \"set-key-partition-list\",\n \"import\",\n \"find-identity\") and\n not process.parent.executable :\n (\n \"/Applications/OpenVPN Connect/OpenVPN Connect.app/Contents/MacOS/OpenVPN Connect\",\n \"/Applications/Microsoft Defender.app/Contents/MacOS/wdavdaemon_enterprise.app/Contents/MacOS/wdavdaemon_enterprise\",\n \"/opt/jc/bin/jumpcloud-agent\"\n ) and\n not process.executable : \"/opt/jc/bin/jumpcloud-agent\"\n", + "references": [ + "https://objective-see.com/blog/blog_0x25.html", + "https://securelist.com/calisto-trojan-for-macos/86543/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "96e90768-c3b7-4df6-b5d9-6237f8bc36a8", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.001", + "name": "Keychain", + "reference": "https://attack.mitre.org/techniques/T1555/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "96e90768-c3b7-4df6-b5d9-6237f8bc36a8_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_104.json b/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_104.json new file mode 100644 index 00000000000..8a731088fc8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_104.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Abuse of Repeated MFA Push Notifications", + "note": "## Triage and analysis\n\n### Investigating Potential Abuse of Repeated MFA Push Notifications\n\nMulti-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.\n\nThis rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.\n\n#### Possible investigation steps:\n\n- Identify the user who received the MFA notifications by reviewing the `user.email` field.\n- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.\n- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.\n- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.\n- Check if the MFA requests and the successful login occurred during the user's regular activity hours.\n- Look for any other suspicious activity on the account around the same time.\n- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.\n\n### False positive analysis:\n\n- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.\n- Check if there are known issues with the MFA system causing false denials.\n\n### Response and remediation:\n\n- If unauthorized access is confirmed, initiate your incident response process.\n- Alert the user and your IT department immediately.\n- If possible, isolate the user's account until the issue is resolved.\n- Investigate the source of the unauthorized access.\n- If the account was accessed by an unauthorized party, determine the actions they took after logging in.\n- Consider enhancing your MFA policy to prevent such incidents in the future.\n- Encourage users to report any unexpected MFA notifications immediately.\n- Review and update your incident response plans and security policies based on the findings from the incident.", + "query": "sequence by user.email with maxspan=10m\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.mfa.okta_verify.deny_push\"]\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.mfa.okta_verify.deny_push\"]\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.authentication.sso\"]\n", + "references": [ + "https://www.mandiant.com/resources/russian-targeting-gov-business", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.module", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.email", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_105.json b/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_105.json new file mode 100644 index 00000000000..d72d87fc121 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_105.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects when an attacker abuses the Multi-Factor authentication mechanism by repeatedly issuing login requests until the user eventually accepts the Okta push notification. An adversary may attempt to bypass the Okta MFA policies configured for an organization to obtain unauthorized access.", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Abuse of Repeated MFA Push Notifications", + "note": "## Triage and analysis\n\n### Investigating Potential Abuse of Repeated MFA Push Notifications\n\nMulti-Factor Authentication (MFA) is an effective method to prevent unauthorized access. However, some adversaries may abuse the system by repeatedly sending MFA push notifications until the user unwittingly approves the access.\n\nThis rule detects when a user denies MFA Okta Verify push notifications twice, followed by a successful authentication event within a 10-minute window. This sequence could indicate an adversary's attempt to bypass the Okta MFA policy.\n\n#### Possible investigation steps:\n\n- Identify the user who received the MFA notifications by reviewing the `user.email` field.\n- Identify the time, source IP, and geographical location of the MFA requests and the subsequent successful login.\n- Review the `event.action` field to understand the nature of the events. It should include two `user.mfa.okta_verify.deny_push` actions and one `user.authentication.sso` action.\n- Ask the user if they remember receiving the MFA notifications and subsequently logging into their account.\n- Check if the MFA requests and the successful login occurred during the user's regular activity hours.\n- Look for any other suspicious activity on the account around the same time.\n- Identify whether the same pattern is repeated for other users in your organization. Multiple users receiving push notifications simultaneously might indicate a larger attack.\n\n### False positive analysis:\n\n- Determine if the MFA push notifications were legitimate. Sometimes, users accidentally trigger MFA requests or deny them unintentionally and later approve them.\n- Check if there are known issues with the MFA system causing false denials.\n\n### Response and remediation:\n\n- If unauthorized access is confirmed, initiate your incident response process.\n- Alert the user and your IT department immediately.\n- If possible, isolate the user's account until the issue is resolved.\n- Investigate the source of the unauthorized access.\n- If the account was accessed by an unauthorized party, determine the actions they took after logging in.\n- Consider enhancing your MFA policy to prevent such incidents in the future.\n- Encourage users to report any unexpected MFA notifications immediately.\n- Review and update your incident response plans and security policies based on the findings from the incident.", + "query": "sequence by user.email with maxspan=10m\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.mfa.okta_verify.deny_push\"]\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.mfa.okta_verify.deny_push\"]\n [any where event.dataset == \"okta.system\" and event.module == \"okta\" and event.action == \"user.authentication.sso\"]\n", + "references": [ + "https://www.mandiant.com/resources/russian-targeting-gov-business", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.module", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.email", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Credential Access", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "97a8e584-fd3b-421f-9b9d-9c9d9e57e9d7_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_106.json b/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_106.json new file mode 100644 index 00000000000..33b015b8597 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_106.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Zoom Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious Zoom Child Process\n\nBy examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading, and deserve further investigation.\n\nThis rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the command line of the child process to determine which commands or scripts were executed.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"Zoom.exe\" and process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "97aba1ef-6034-4bd3-8c1a-1e0996b27afa", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + }, + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "97aba1ef-6034-4bd3-8c1a-1e0996b27afa_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_107.json b/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_107.json new file mode 100644 index 00000000000..ed17482a0c8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97aba1ef-6034-4bd3-8c1a-1e0996b27afa_107.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious Zoom child process was detected, which may indicate an attempt to run unnoticed. Verify process details such as command line, network connections, file writes and associated file signature details as well.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Zoom Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious Zoom Child Process\n\nBy examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity, such as masquerading, and deserve further investigation.\n\nThis rule identifies a potential malicious process masquerading as `Zoom.exe` or exploiting a vulnerability in the application causing it to execute code.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the command line of the child process to determine which commands or scripts were executed.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"Zoom.exe\" and process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "97aba1ef-6034-4bd3-8c1a-1e0996b27afa", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + }, + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "97aba1ef-6034-4bd3-8c1a-1e0996b27afa_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97db8b42-69d8-4bf3-9fd4-c69a1d895d68_3.json b/packages/security_detection_engine/kibana/security_rule/97db8b42-69d8-4bf3-9fd4-c69a1d895d68_3.json new file mode 100644 index 00000000000..eddda14d46b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97db8b42-69d8-4bf3-9fd4-c69a1d895d68_3.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where VMware-related files, such as those with extensions like \".vmdk\", \".vmx\", \".vmxf\", \".vmsd\", \".vmsn\", \".vswp\", \".vmss\", \".nvram\", and \".vmem\", are renamed on a Linux system. The rule monitors for the \"rename\" event action associated with these file types, which could indicate malicious activity.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Renaming of ESXI Files", + "query": "file where host.os.type == \"linux\" and event.action == \"rename\" and\nfile.Ext.original.name : (\"*.vmdk\", \"*.vmx\", \"*.vmxf\", \"*.vmsd\", \"*.vmsn\", \"*.vswp\", \"*.vmss\", \"*.nvram\", \"*.vmem\")\nand not file.name : (\"*.vmdk\", \"*.vmx\", \"*.vmxf\", \"*.vmsd\", \"*.vmsn\", \"*.vswp\", \"*.vmss\", \"*.nvram\", \"*.vmem\")\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.original.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "97db8b42-69d8-4bf3-9fd4-c69a1d895d68", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "97db8b42-69d8-4bf3-9fd4-c69a1d895d68_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_108.json b/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_108.json new file mode 100644 index 00000000000..6aa2441dc00 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_108.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Startup or Run Key Registry Modification", + "note": "## Triage and analysis\n\n### Investigating Startup or Run Key Registry Modification\n\nAdversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0\n- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f\n- Startup Persistence by a Suspicious Process - 440e2db4-bc7f-4c96-a068-65b78da59bde\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "registry where host.os.type == \"windows\" and registry.data.strings != null and\n registry.path : (\n /* Machine Hive */\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\",\n /* Users Hive */\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\"\n ) and\n /* add common legitimate changes without being too restrictive as this is one of the most abused AESPs */\n not registry.data.strings : \"ctfmon.exe /n\" and\n not (registry.value : \"Application Restart #*\" and process.name : \"csrss.exe\") and\n not user.id : (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\") and\n not registry.data.strings : (\"?:\\\\Program Files\\\\*.exe\", \"?:\\\\Program Files (x86)\\\\*.exe\") and\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\msiexec.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\") and\n not (\n /* Logitech G Hub */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name == \"Logitech Inc\" and\n process.name : \"lghub_agent.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\LGHUB\\\\lghub.exe\\\" --background\"\n )\n ) or\n\n /* Google Drive File Stream, Chrome, and Google Update */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name == \"Google LLC\" and\n (\n process.name : \"GoogleDriveFS.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\Google\\\\Drive File Stream\\\\*\\\\GoogleDriveFS.exe\\\" --startup_mode\"\n ) or\n\n process.name : \"chrome.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --no-startup-window /prefetch:5\",\n \"\\\"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --no-startup-window /prefetch:5\"\n ) or\n\n process.name : \"GoogleUpdate.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Update\\\\*\\\\GoogleUpdateCore.exe\\\"\"\n )\n )\n ) or\n\n /* MS Programs */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\"Microsoft Windows\", \"Microsoft Corporation\") and\n (\n process.name : \"msedge.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" --no-startup-window --win-session-start /prefetch:5\"\n ) or\n\n process.name : (\"Update.exe\", \"Teams.exe\") and registry.data.strings : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\Update.exe --processStart \\\"Teams.exe\\\" --process-start-args \\\"--system-initiated\\\"\"\n ) or\n\n process.name : \"OneDriveStandaloneUpdater.exe\" and registry.data.strings : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\\\\Microsoft.SharePoint.exe\"\n ) or\n\n process.name : \"OneDriveSetup.exe\" and\n registry.value : (\n \"Delete Cached Standalone Update Binary\", \"Delete Cached Update Binary\", \"amd64\", \"Uninstall *\", \"i386\", \"OneDrive\"\n ) and\n registry.data.strings : (\n \"?:\\\\Windows\\\\system32\\\\cmd.exe /q /c * \\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\\\"\",\n \"?:\\\\Program Files (x86)\\\\Microsoft OneDrive\\\\OneDrive.exe /background *\",\n \"\\\"?:\\\\Program Files (x86)\\\\Microsoft OneDrive\\\\OneDrive.exe\\\" /background *\",\n \"?:\\\\Program Files\\\\Microsoft OneDrive\\\\OneDrive.exe /background *\"\n )\n )\n ) or\n\n /* Slack */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\n \"Slack Technologies, Inc.\", \"Slack Technologies, LLC\"\n ) and process.name : \"slack.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\slack\\\\slack.exe\\\" --process-start-args --startup\"\n )\n ) or\n\n /* WebEx */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and\n process.name : \"WebexHost.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\WebEx\\\\WebexHost.exe\\\" /daemon /runFrom=autorun\"\n )\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.value", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "97fc44d3-8dae-4019-ae83-298c3015600f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "97fc44d3-8dae-4019-ae83-298c3015600f_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_109.json b/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_109.json new file mode 100644 index 00000000000..7804efd5bc4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/97fc44d3-8dae-4019-ae83-298c3015600f_109.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies run key or startup key registry modifications. In order to survive reboots and other system interrupts, attackers will modify run keys within the registry or leverage startup folder items as a form of persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Startup or Run Key Registry Modification", + "note": "## Triage and analysis\n\n### Investigating Startup or Run Key Registry Modification\n\nAdversaries may achieve persistence by referencing a program with a registry run key. Adding an entry to the run keys in the registry will cause the program referenced to be executed when a user logs in. These programs will executed under the context of the user and will have the account's permissions. This rule looks for this behavior by monitoring a range of registry run keys.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- There is a high possibility of benign legitimate programs being added to registry run keys. This activity could be based on new software installations, patches, or any kind of network administrator related activity. Before undertaking further investigation, verify that this activity is not benign.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0\n- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f\n- Startup Persistence by a Suspicious Process - 440e2db4-bc7f-4c96-a068-65b78da59bde\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "registry where host.os.type == \"windows\" and registry.data.strings != null and\n registry.path : (\n /* Machine Hive */\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\",\n /* Users Hive */\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnceEx\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\*\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\\\\Shell\\\\*\"\n ) and\n /* add common legitimate changes without being too restrictive as this is one of the most abused AESPs */\n not registry.data.strings : \"ctfmon.exe /n\" and\n not (registry.value : \"Application Restart #*\" and process.name : \"csrss.exe\") and\n not user.id : (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\") and\n not registry.data.strings : (\"?:\\\\Program Files\\\\*.exe\", \"?:\\\\Program Files (x86)\\\\*.exe\") and\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\msiexec.exe\", \"?:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\") and\n not (\n /* Logitech G Hub */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name == \"Logitech Inc\" and\n process.name : \"lghub_agent.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\LGHUB\\\\lghub.exe\\\" --background\"\n )\n ) or\n\n /* Google Drive File Stream, Chrome, and Google Update */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name == \"Google LLC\" and\n (\n process.name : \"GoogleDriveFS.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\Google\\\\Drive File Stream\\\\*\\\\GoogleDriveFS.exe\\\" --startup_mode\"\n ) or\n\n process.name : \"chrome.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --no-startup-window /prefetch:5\",\n \"\\\"?:\\\\Program Files (x86)\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\\\" --no-startup-window /prefetch:5\"\n ) or\n\n process.name : \"GoogleUpdate.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Update\\\\*\\\\GoogleUpdateCore.exe\\\"\"\n )\n )\n ) or\n\n /* MS Programs */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\"Microsoft Windows\", \"Microsoft Corporation\") and\n (\n process.name : \"msedge.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe\\\" --no-startup-window --win-session-start /prefetch:5\"\n ) or\n\n process.name : (\"Update.exe\", \"Teams.exe\") and registry.data.strings : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\Update.exe --processStart \\\"Teams.exe\\\" --process-start-args \\\"--system-initiated\\\"\"\n ) or\n\n process.name : \"OneDriveStandaloneUpdater.exe\" and registry.data.strings : (\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\\\\Microsoft.SharePoint.exe\"\n ) or\n\n process.name : \"OneDriveSetup.exe\" and\n registry.value : (\n \"Delete Cached Standalone Update Binary\", \"Delete Cached Update Binary\", \"amd64\", \"Uninstall *\", \"i386\", \"OneDrive\"\n ) and\n registry.data.strings : (\n \"?:\\\\Windows\\\\system32\\\\cmd.exe /q /c * \\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\*\\\"\",\n \"?:\\\\Program Files (x86)\\\\Microsoft OneDrive\\\\OneDrive.exe /background *\",\n \"\\\"?:\\\\Program Files (x86)\\\\Microsoft OneDrive\\\\OneDrive.exe\\\" /background *\",\n \"?:\\\\Program Files\\\\Microsoft OneDrive\\\\OneDrive.exe /background *\"\n )\n )\n ) or\n\n /* Slack */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\n \"Slack Technologies, Inc.\", \"Slack Technologies, LLC\"\n ) and process.name : \"slack.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\slack\\\\slack.exe\\\" --process-start-args --startup\"\n )\n ) or\n\n /* WebEx */\n (\n process.code_signature.trusted == true and process.code_signature.subject_name in (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and\n process.name : \"WebexHost.exe\" and registry.data.strings : (\n \"\\\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\WebEx\\\\WebexHost.exe\\\" /daemon /runFrom=autorun\"\n )\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.value", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "97fc44d3-8dae-4019-ae83-298c3015600f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 109 + }, + "id": "97fc44d3-8dae-4019-ae83-298c3015600f_109", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/98843d35-645e-4e66-9d6a-5049acd96ce1_1.json b/packages/security_detection_engine/kibana/security_rule/98843d35-645e-4e66-9d6a-5049acd96ce1_1.json new file mode 100644 index 00000000000..3999875fd7f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/98843d35-645e-4e66-9d6a-5049acd96ce1_1.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies indirect command execution via Program Compatibility Assistant (pcalua.exe) or forfiles.exe.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Indirect Command Execution via Forfiles/Pcalua", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"pcalua.exe\", \"forfiles.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "98843d35-645e-4e66-9d6a-5049acd96ce1", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "98843d35-645e-4e66-9d6a-5049acd96ce1_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/99239e7d-b0d4-46e3-8609-acafcf99f68c_104.json b/packages/security_detection_engine/kibana/security_rule/99239e7d-b0d4-46e3-8609-acafcf99f68c_104.json new file mode 100644 index 00000000000..2d04209a553 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/99239e7d-b0d4-46e3-8609-acafcf99f68c_104.json @@ -0,0 +1,128 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the execution of a MacOS installer package with an abnormal child process (e.g bash) followed immediately by a network connection via a suspicious process (e.g curl). Threat actors will build and distribute malicious MacOS installer packages, which have a .pkg extension, many times imitating valid software in order to persuade and infect their victims often using the package files (e.g pre/post install scripts etc.) to download additional tools or malicious software. If this rule fires it should indicate the installation of a malicious or suspicious package.", + "false_positives": [ + "Custom organization-specific macOS packages that use .pkg files to run cURL could trigger this rule. If known behavior is causing false positives, it can be excluded from the rule." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "MacOS Installer Package Spawns Network Event", + "query": "sequence by host.id, user.id with maxspan=30s\n[process where host.os.type == \"macos\" and event.type == \"start\" and event.action == \"exec\" and process.parent.name : (\"installer\", \"package_script_service\") and process.name : (\"bash\", \"sh\", \"zsh\", \"python\", \"osascript\", \"tclsh*\")]\n[network where host.os.type == \"macos\" and event.type == \"start\" and process.name : (\"curl\", \"osascript\", \"wget\", \"python\")]\n", + "references": [ + "https://redcanary.com/blog/clipping-silver-sparrows-wings", + "https://posts.specterops.io/introducing-mystikal-4fbd2f7ae520", + "https://github.com/D00MFist/Mystikal" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "99239e7d-b0d4-46e3-8609-acafcf99f68c", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.007", + "name": "JavaScript", + "reference": "https://attack.mitre.org/techniques/T1059/007/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/", + "subtechnique": [ + { + "id": "T1071.001", + "name": "Web Protocols", + "reference": "https://attack.mitre.org/techniques/T1071/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "99239e7d-b0d4-46e3-8609-acafcf99f68c_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9960432d-9b26-409f-972b-839a959e79e2_206.json b/packages/security_detection_engine/kibana/security_rule/9960432d-9b26-409f-972b-839a959e79e2_206.json new file mode 100644 index 00000000000..717b7fabcb3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9960432d-9b26-409f-972b-839a959e79e2_206.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious access to LSASS handle from a call trace pointing to DBGHelp.dll or DBGCore.dll, which both export the MiniDumpWriteDump method that can be used to dump LSASS memory content in preparation for credential access.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via LSASS Memory Dump", + "note": "", + "query": "process where host.os.type == \"windows\" and event.code == \"10\" and\n winlog.event_data.TargetImage : \"?:\\\\WINDOWS\\\\system32\\\\lsass.exe\" and\n\n /* DLLs exporting MiniDumpWriteDump API to create an lsass mdmp*/\n winlog.event_data.CallTrace : (\"*dbghelp*\", \"*dbgcore*\") and\n\n /* case of lsass crashing */\n not process.executable : (\"?:\\\\Windows\\\\System32\\\\WerFault.exe\", \"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\")\n", + "references": [ + "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.CallTrace", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TargetImage", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "9960432d-9b26-409f-972b-839a959e79e2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 206 + }, + "id": "9960432d-9b26-409f-972b-839a959e79e2_206", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/99dcf974-6587-4f65-9252-d866a3fdfd9c_104.json b/packages/security_detection_engine/kibana/security_rule/99dcf974-6587-4f65-9252-d866a3fdfd9c_104.json new file mode 100644 index 00000000000..fd6b24b1c0a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/99dcf974-6587-4f65-9252-d866a3fdfd9c_104.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job found an unusually large spike in authentication failure events. This can be due to password spraying, user enumeration or brute force activity and may be a precursor to account takeover or credentialed access.", + "false_positives": [ + "A misconfigured service account can trigger this alert. A password change on an account used by an email client can trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_high_count_logon_fails", + "name": "Spike in Failed Logon Events", + "note": "## Triage and analysis\n\n### Investigating Spike in Failed Logon Events\n\nThis rule uses a machine learning job to detect a substantial spike in failed authentication events. This could indicate attempts to enumerate users, password spraying, brute force, etc.\n\n#### Possible investigation steps\n\n- Identify the users involved and if the activity targets a specific user or a set of users.\n- Check if the authentication comes from different sources.\n- Investigate if the host where the failed authentication events occur is exposed to the internet.\n - If the host is exposed to the internet, and the source of these attempts is external, the activity can be related to bot activity and possibly not directed at your organization.\n - If the host is not exposed to the internet, investigate the hosts where the authentication attempts are coming from, as this can indicate that they are compromised and the attacker is trying to move laterally.\n- Investigate other alerts associated with the involved users and hosts during the past 48 hours.\n- Check whether the involved credentials are used in automation or scheduled tasks.\n- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.\n- Investigate whether there are successful authentication events from the involved sources. This could indicate a successful brute force or password spraying attack.\n\n### False positive analysis\n\n- If the account is used in automation tasks, it is possible that they are using expired credentials, causing a spike in authentication failures.\n- Authentication failures can be related to permission issues.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Assess whether the asset should be exposed to the internet, and take action to reduce your attack surface.\n - If the asset needs to be exposed to the internet, restrict access to remote login services to specific IPs.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "99dcf974-6587-4f65-9252-d866a3fdfd9c", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "99dcf974-6587-4f65-9252-d866a3fdfd9c_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_105.json b/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_105.json new file mode 100644 index 00000000000..6b697d8613b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_105.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies access to the /etc/shadow file via the commandline using standard system utilities. After elevating privileges to root, threat actors may attempt to read or dump this file in order to gain valid credentials. They may utilize these to move laterally undetected and access additional resources.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Shadow File Read via Command Line Utilities", + "new_terms_fields": [ + "process.command_line" + ], + "query": "host.os.type : \"linux\" and event.category : \"process\" and event.action : (\"exec\" or \"exec_event\") and\n(process.args : \"/etc/shadow\" or (process.working_directory: \"/etc\" and process.args: \"shadow\")) and not \n(process.executable : (\"/bin/chown\" or \"/usr/bin/chown\") and process.args : \"root:shadow\") and not \n(process.executable : (\"/bin/chmod\" or \"/usr/bin/chmod\") and process.args : \"640\")\n", + "references": [ + "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9a3a3689-8ed1-4cdb-83fb-9506db54c61f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 105 + }, + "id": "9a3a3689-8ed1-4cdb-83fb-9506db54c61f_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_106.json b/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_106.json new file mode 100644 index 00000000000..35fa8b39ba4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9a3a3689-8ed1-4cdb-83fb-9506db54c61f_106.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies access to the /etc/shadow file via the commandline using standard system utilities. After elevating privileges to root, threat actors may attempt to read or dump this file in order to gain valid credentials. They may utilize these to move laterally undetected and access additional resources.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Shadow File Read via Command Line Utilities", + "new_terms_fields": [ + "process.command_line" + ], + "query": "host.os.type : \"linux\" and event.category : \"process\" and event.action : (\"exec\" or \"exec_event\") and\n(process.args : \"/etc/shadow\" or (process.working_directory: \"/etc\" and process.args: \"shadow\")) and not \n(process.executable : (\"/bin/chown\" or \"/usr/bin/chown\") and process.args : \"root:shadow\") and not \n(process.executable : (\"/bin/chmod\" or \"/usr/bin/chmod\") and process.args : \"640\")\n", + "references": [ + "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9a3a3689-8ed1-4cdb-83fb-9506db54c61f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 106 + }, + "id": "9a3a3689-8ed1-4cdb-83fb-9506db54c61f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9a5b4e31-6cde-4295-9ff7-6be1b8567e1b_105.json b/packages/security_detection_engine/kibana/security_rule/9a5b4e31-6cde-4295-9ff7-6be1b8567e1b_105.json new file mode 100644 index 00000000000..763df516a98 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9a5b4e31-6cde-4295-9ff7-6be1b8567e1b_105.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious Windows explorer child process. Explorer.exe can be abused to launch malicious scripts or executables from a trusted parent process.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Explorer Child Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n process.name : (\"cscript.exe\", \"wscript.exe\", \"powershell.exe\", \"rundll32.exe\", \"cmd.exe\", \"mshta.exe\", \"regsvr32.exe\") or\n process.pe.original_file_name in (\"cscript.exe\", \"wscript.exe\", \"PowerShell.EXE\", \"RUNDLL32.EXE\", \"Cmd.Exe\", \"MSHTA.EXE\", \"REGSVR32.EXE\")\n ) and\n /* Explorer started via DCOM */\n process.parent.name : \"explorer.exe\" and process.parent.args : \"-Embedding\" and\n not process.parent.args:\n (\n /* Noisy CLSID_SeparateSingleProcessExplorerHost Explorer COM Class IDs */\n \"/factory,{5BD95610-9434-43C2-886C-57852CC8A120}\",\n \"/factory,{ceff45ee-c862-41de-aee2-a022c81eda92}\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9a5b4e31-6cde-4295-9ff7-6be1b8567e1b_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9aa0e1f6-52ce-42e1-abb3-09657cee2698_105.json b/packages/security_detection_engine/kibana/security_rule/9aa0e1f6-52ce-42e1-abb3-09657cee2698_105.json new file mode 100644 index 00000000000..1943de6d60c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9aa0e1f6-52ce-42e1-abb3-09657cee2698_105.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to enable the Windows scheduled tasks AT command via the registry. Attackers may use this method to move laterally or persist locally. The AT command has been deprecated since Windows 8 and Windows Server 2012, but still exists for backwards compatibility.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Scheduled Tasks AT Command Enabled", + "note": "", + "query": "registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\Configuration\\\\EnableAt\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Schedule\\\\Configuration\\\\EnableAt\"\n ) and registry.data.strings : (\"1\", \"0x00000001\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9aa0e1f6-52ce-42e1-abb3-09657cee2698", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9aa0e1f6-52ce-42e1-abb3-09657cee2698_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c_106.json b/packages/security_detection_engine/kibana/security_rule/9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c_106.json new file mode 100644 index 00000000000..d3b59b5fedf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c_106.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via WMI Event Subscription", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"wmic.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : \"create\" and\n process.args : (\"ActiveScriptEventConsumer\", \"CommandLineEventConsumer\")\n", + "references": [ + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.003", + "name": "Windows Management Instrumentation Event Subscription", + "reference": "https://attack.mitre.org/techniques/T1546/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "9b6813a1-daf1-457e-b0e6-0bb4e55b8a4c_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9c260313-c811-4ec8-ab89-8f6530e0246c_105.json b/packages/security_detection_engine/kibana/security_rule/9c260313-c811-4ec8-ab89-8f6530e0246c_105.json new file mode 100644 index 00000000000..ef692fa2030 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9c260313-c811-4ec8-ab89-8f6530e0246c_105.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The hosts file on endpoints is used to control manual IP address to hostname resolutions. The hosts file is the first point of lookup for DNS hostname resolution so if adversaries can modify the endpoint hosts file, they can route traffic to malicious infrastructure. This rule detects modifications to the hosts file on Microsoft Windows, Linux (Ubuntu or RHEL) and macOS systems.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Hosts File Modified", + "note": "## Triage and analysis\n\n### Investigating Hosts File Modified\n\nOperating systems use the hosts file to map a connection between an IP address and domain names before going to domain name servers. Attackers can abuse this mechanism to route traffic to malicious infrastructure or disrupt security that depends on server communications. For example, Russian threat actors modified this file on a domain controller to redirect Duo MFA calls to localhost instead of the Duo server, which prevented the MFA service from contacting its server to validate MFA login. This effectively disabled MFA for active domain accounts because the default policy of Duo for Windows is to \"Fail open\" if the MFA server is unreachable. This can happen in any MFA implementation and is not exclusive to Duo. Find more details in this [CISA Alert](https://www.cisa.gov/uscert/ncas/alerts/aa22-074a).\n\nThis rule identifies modifications in the hosts file across multiple operating systems using process creation events for Linux and file events in Windows and macOS.\n\n#### Possible investigation steps\n\n- Identify the specifics of the involved assets, such as role, criticality, and associated users.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the changes to the hosts file by comparing it against file backups, volume shadow copies, and other restoration mechanisms.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and the configuration was justified.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Consider isolating the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges of the administrator account that performed the action.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "any where\n\n /* file events for creation; file change events are not captured by some of the included sources for linux and so may\n miss this, which is the purpose of the process + command line args logic below */\n (\n event.category == \"file\" and event.type in (\"change\", \"creation\") and\n file.path : (\"/private/etc/hosts\", \"/etc/hosts\", \"?:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\hosts\")\n )\n or\n\n /* process events for change targeting linux only */\n (\n event.category == \"process\" and event.type in (\"start\") and\n process.name in (\"nano\", \"vim\", \"vi\", \"emacs\", \"echo\", \"sed\") and\n process.args : (\"/etc/hosts\")\n )\n", + "references": [ + "https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-reference-yml.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9c260313-c811-4ec8-ab89-8f6530e0246c", + "setup": "For Windows systems using Auditbeat, this rule requires adding `C:/Windows/System32/drivers/etc` as an additional path in the 'file_integrity' module of auditbeat.yml.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: Windows", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1565", + "name": "Data Manipulation", + "reference": "https://attack.mitre.org/techniques/T1565/", + "subtechnique": [ + { + "id": "T1565.001", + "name": "Stored Data Manipulation", + "reference": "https://attack.mitre.org/techniques/T1565/001/" + } + ] + } + ] + } + ], + "timeline_id": "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "timeline_title": "Comprehensive File Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9c260313-c811-4ec8-ab89-8f6530e0246c_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9ccf3ce0-0057-440a-91f5-870c6ad39093_106.json b/packages/security_detection_engine/kibana/security_rule/9ccf3ce0-0057-440a-91f5-870c6ad39093_106.json new file mode 100644 index 00000000000..b3ac178f45a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9ccf3ce0-0057-440a-91f5-870c6ad39093_106.json @@ -0,0 +1,127 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies command shell activity started via RunDLL32, which is commonly abused by attackers to host malicious code.", + "false_positives": [ + "Microsoft Windows installers leveraging RunDLL32 for installation." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Command Shell Activity Started via RunDLL32", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"cmd.exe\", \"powershell.exe\") and\n process.parent.name : \"rundll32.exe\" and process.parent.command_line != null and\n /* common FPs can be added here */\n not process.parent.args : (\"C:\\\\Windows\\\\System32\\\\SHELL32.dll,RunAsNewUser_RunDLL\",\n \"C:\\\\WINDOWS\\\\*.tmp,zzzzInvokeManagedCustomActionOutOfProc\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9ccf3ce0-0057-440a-91f5-870c6ad39093", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + }, + { + "id": "T1059.003", + "name": "Windows Command Shell", + "reference": "https://attack.mitre.org/techniques/T1059/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "9ccf3ce0-0057-440a-91f5-870c6ad39093_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2_105.json b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2_105.json new file mode 100644 index 00000000000..eb4f7c06082 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2_105.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by a script or the Windows command interpreter. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Build Engine Started by a Script Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"MSBuild.exe\" or process.pe.original_file_name == \"MSBuild.exe\") and\n process.parent.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"cscript.exe\", \"wscript.exe\", \"mshta.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/", + "subtechnique": [ + { + "id": "T1127.001", + "name": "MSBuild", + "reference": "https://attack.mitre.org/techniques/T1127/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae2_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3_106.json b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3_106.json new file mode 100644 index 00000000000..857d9af3e2a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3_106.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Explorer or the WMI (Windows Management Instrumentation) subsystem. This behavior is unusual and is sometimes used by malicious payloads.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Build Engine Started by a System Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"MSBuild.exe\" and\n process.parent.name : (\"explorer.exe\", \"wmiprvse.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/", + "subtechnique": [ + { + "id": "T1127.001", + "name": "MSBuild", + "reference": "https://attack.mitre.org/techniques/T1127/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae3_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4_107.json b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4_107.json new file mode 100644 index 00000000000..471b0c82083 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4_107.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, was started after being renamed. This is uncommon behavior and may indicate an attempt to run unnoticed or undetected.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Build Engine Using an Alternate Name", + "note": "## Triage and analysis\n\n### Investigating Microsoft Build Engine Using an Alternate Name\n\nThe OriginalFileName attribute of a PE (Portable Executable) file is a metadata field that contains the original name of the executable file when compiled or linked. By using this attribute, analysts can identify renamed instances that attackers can use with the intent of evading detections, application allowlists, and other security protections.\n\nThe Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.\n\nThis rule checks for renamed instances of MSBuild, which can indicate an attempt of evading detections, application allowlists, and other security protections.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name == \"MSBuild.exe\" and\n not process.name : \"MSBuild.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae4_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5_107.json b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5_107.json new file mode 100644 index 00000000000..4788db1768b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5_107.json @@ -0,0 +1,111 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, loaded DLLs (dynamically linked libraries) responsible for Windows credential management. This technique is sometimes used for credential dumping.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via Trusted Developer Utility", + "note": "## Triage and analysis\n\n### Investigating Potential Credential Access via Trusted Developer Utility\n\nThe Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software.\n\nAdversaries can abuse MSBuild to proxy the execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file. MSBuild will compile and execute the inline task. `MSBuild.exe` is a signed Microsoft binary, and the execution of code using it can bypass application control defenses that are configured to allow `MSBuild.exe` execution.\n\nThis rule looks for the MSBuild process loading `vaultcli.dll` or `SAMLib.DLL`, which indicates the execution of credential access activities.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to identify the `.csproj` file location.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and (process.name : \"MSBuild.exe\" or process.pe.original_file_name == \"MSBuild.exe\")]\n [any where host.os.type == \"windows\" and (event.category == \"library\" or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : (\"vaultcli.dll\", \"SAMLib.DLL\") or file.name : (\"vaultcli.dll\", \"SAMLib.DLL\"))]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae5_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6_106.json b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6_106.json new file mode 100644 index 00000000000..3b69bb99de0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6_106.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, started a PowerShell script or the Visual C# Command Line Compiler. This technique is sometimes used to deploy a malicious payload using the Build Engine.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. If a build system triggers this rule it can be exempted by process, user or host name." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Build Engine Started an Unusual Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"MSBuild.exe\" and\n process.name : (\"csc.exe\", \"iexplore.exe\", \"powershell.exe\")\n", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/", + "subtechnique": [ + { + "id": "T1027.004", + "name": "Compile After Delivery", + "reference": "https://attack.mitre.org/techniques/T1027/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "9d110cb3-5f4b-4c9a-b9f5-53f0a1707ae6_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d19ece6-c20e-481a-90c5-ccca596537de_104.json b/packages/security_detection_engine/kibana/security_rule/9d19ece6-c20e-481a-90c5-ccca596537de_104.json new file mode 100644 index 00000000000..6d151e7c137 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d19ece6-c20e-481a-90c5-ccca596537de_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Indicates the creation or modification of a launch daemon, which adversaries may use to repeatedly execute malicious payloads as part of persistence.", + "false_positives": [ + "Trusted applications persisting via LaunchDaemons" + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "LaunchDaemon Creation or Modification and Immediate Loading", + "query": "sequence by host.id with maxspan=1m\n [file where host.os.type == \"macos\" and event.type != \"deletion\" and file.path : (\"/System/Library/LaunchDaemons/*\", \"/Library/LaunchDaemons/*\")]\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name == \"launchctl\" and process.args == \"load\"]\n", + "references": [ + "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9d19ece6-c20e-481a-90c5-ccca596537de", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "9d19ece6-c20e-481a-90c5-ccca596537de_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9d302377-d226-4e12-b54c-1906b5aec4f6_103.json b/packages/security_detection_engine/kibana/security_rule/9d302377-d226-4e12-b54c-1906b5aec4f6_103.json new file mode 100644 index 00000000000..1dc5ce8eac0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9d302377-d226-4e12-b54c-1906b5aec4f6_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.", + "false_positives": [ + "A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_rare_metadata_process" + ], + "name": "Unusual Linux Process Calling the Metadata Service", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "9d302377-d226-4e12-b54c-1906b5aec4f6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.005", + "name": "Cloud Instance Metadata API", + "reference": "https://attack.mitre.org/techniques/T1552/005/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "9d302377-d226-4e12-b54c-1906b5aec4f6_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9f1c4ca3-44b5-481d-ba42-32dc215a2769_105.json b/packages/security_detection_engine/kibana/security_rule/9f1c4ca3-44b5-481d-ba42-32dc215a2769_105.json new file mode 100644 index 00000000000..01aa15c6848 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9f1c4ca3-44b5-481d-ba42-32dc215a2769_105.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the EarthWorm tunneler. Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection and network filtering, or to enable access to otherwise unreachable systems.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Protocol Tunneling via EarthWorm", + "note": "", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\n process.args : \"-s\" and process.args : \"-d\" and process.args : \"rssocks\"\n", + "references": [ + "http://rootkiter.com/EarthWorm/", + "https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "9f1c4ca3-44b5-481d-ba42-32dc215a2769", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9f1c4ca3-44b5-481d-ba42-32dc215a2769_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_108.json b/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_108.json new file mode 100644 index 00000000000..b92c8d40eaa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_108.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via DCSync", + "note": "## Triage and analysis\n\n### Investigating Potential Credential Access via DCSync\n\nActive Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.\n\nActive Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).\n\nThis rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).\n\n### False positive analysis\n\n- Administrators may use custom accounts on Azure AD Connect, investigate if it is the case, and if it is properly secured. If noisy in your environment due to expected activity, consider adding the corresponding account as a exception.\n- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. If this rule is noisy in your environment due to expected activity, consider adding the corresponding account as a exception.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the entire domain or the `krbtgt` user was compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.\n- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "any where event.action == \"Directory Service Access\" and\n event.code == \"4662\" and winlog.event_data.Properties : (\n\n /* Control Access Rights/Permissions Symbol */\n\n \"*DS-Replication-Get-Changes*\",\n \"*DS-Replication-Get-Changes-All*\",\n \"*DS-Replication-Get-Changes-In-Filtered-Set*\",\n\n /* Identifying GUID used in ACE */\n\n \"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*89e95b76-444d-4c62-991a-0facbeda640c*\")\n\n /* The right to perform an operation controlled by an extended access right. */\n\n and winlog.event_data.AccessMask : \"0x100\" and\n not winlog.event_data.SubjectUserName : (\"*$\", \"MSOL_*\", \"OpenDNS_Connector\")\n\n /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */\n", + "references": [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.AccessMask", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.Properties", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserName", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "9f962927-1a4f-45f3-a57b-287f2c7029c1", + "setup": "The 'Audit Directory Service Changes' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nAudit Policies \u003e\nDS Access \u003e\nAudit Directory Service Changes (Success,Failure)\n```", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Active Directory", + "Resources: Investigation Guide", + "Use Case: Active Directory Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.006", + "name": "DCSync", + "reference": "https://attack.mitre.org/techniques/T1003/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "9f962927-1a4f-45f3-a57b-287f2c7029c1_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_109.json b/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_109.json new file mode 100644 index 00000000000..5739ce39eb9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9f962927-1a4f-45f3-a57b-287f2c7029c1_109.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies when a User Account starts the Active Directory Replication Process. Attackers can use the DCSync technique to get credential information of individual accounts or the entire domain, thus compromising the entire domain.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Credential Access via DCSync", + "note": "## Triage and analysis\n\n### Investigating Potential Credential Access via DCSync\n\nActive Directory replication is the process by which the changes that originate on one domain controller are automatically transferred to other domain controllers that store the same data.\n\nActive Directory data consists of objects that have properties, or attributes. Each object is an instance of an object class, and object classes and their respective attributes are defined in the Active Directory schema. Objects are defined by the values of their attributes, and changes to attribute values must be transferred from the domain controller on which they occur to every other domain controller that stores a replica of an affected object.\n\nAdversaries can use the DCSync technique that uses Windows Domain Controller's API to simulate the replication process from a remote domain controller, compromising major credential material such as the Kerberos krbtgt keys used legitimately for tickets creation, but also tickets forging by attackers. This attack requires some extended privileges to succeed (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All), which are granted by default to members of the Administrators, Domain Admins, Enterprise Admins, and Domain Controllers groups. Privileged accounts can be abused to grant controlled objects the right to DCsync/Replicate.\n\nMore details can be found on [Threat Hunter Playbook](https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing) and [The Hacker Recipes](https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync).\n\nThis rule monitors for Event ID 4662 (Operation was performed on an Active Directory object) and identifies events that use the access mask 0x100 (Control Access) and properties that contain at least one of the following or their equivalent Schema-Id-GUID (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set). It also filters out events that use computer accounts and also Azure AD Connect MSOL accounts (more details [here](https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/ad-connect-msol-user-suspected-dcsync-attack/m-p/788028)).\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account and system owners and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Correlate security events 4662 and 4624 (Logon Type 3) by their Logon ID (`winlog.logon.id`) on the Domain Controller (DC) that received the replication request. This will tell you where the AD replication request came from, and if it came from another DC or not.\n- Scope which credentials were compromised (for example, whether all accounts were replicated or specific ones).\n\n### False positive analysis\n\n- Administrators may use custom accounts on Azure AD Connect, investigate if it is the case, and if it is properly secured. If noisy in your environment due to expected activity, consider adding the corresponding account as a exception.\n- Although replicating Active Directory (AD) data to non-Domain Controllers is not a common practice and is generally not recommended from a security perspective, some software vendors may require it for their products to function correctly. If this rule is noisy in your environment due to expected activity, consider adding the corresponding account as a exception.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the entire domain or the `krbtgt` user was compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.\n- Investigate how the attacker escalated privileges and identify systems they used to conduct lateral movement. Use this information to determine ways the attacker could regain access to the environment.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "any where event.action == \"Directory Service Access\" and\n event.code == \"4662\" and winlog.event_data.Properties : (\n\n /* Control Access Rights/Permissions Symbol */\n\n \"*DS-Replication-Get-Changes*\",\n \"*DS-Replication-Get-Changes-All*\",\n \"*DS-Replication-Get-Changes-In-Filtered-Set*\",\n\n /* Identifying GUID used in ACE */\n\n \"*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*\",\n \"*89e95b76-444d-4c62-991a-0facbeda640c*\")\n\n /* The right to perform an operation controlled by an extended access right. */\n\n and winlog.event_data.AccessMask : \"0x100\" and\n not winlog.event_data.SubjectUserName : (\"*$\", \"MSOL_*\", \"OpenDNS_Connector\")\n\n /* The Umbrella AD Connector uses the OpenDNS_Connector account to perform replication */\n", + "references": [ + "https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-180815210510.html", + "https://threathunterplaybook.com/library/windows/active_directory_replication.html?highlight=dcsync#directory-replication-services-auditing", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_ad_replication_non_machine_account.yml", + "https://github.com/atc-project/atomic-threat-coverage/blob/master/Atomic_Threat_Coverage/Logging_Policies/LP_0027_windows_audit_directory_service_access.md", + "https://attack.stealthbits.com/privilege-escalation-using-mimikatz-dcsync", + "https://www.thehacker.recipes/ad/movement/credentials/dumping/dcsync" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.AccessMask", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.Properties", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserName", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "9f962927-1a4f-45f3-a57b-287f2c7029c1", + "setup": "The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure).\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nAudit Policies \u003e\nDS Access \u003e\nAudit Directory Service Access (Success,Failure)\n```", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Active Directory", + "Resources: Investigation Guide", + "Use Case: Active Directory Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.006", + "name": "DCSync", + "reference": "https://attack.mitre.org/techniques/T1003/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 109 + }, + "id": "9f962927-1a4f-45f3-a57b-287f2c7029c1_109", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_104.json b/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_104.json new file mode 100644 index 00000000000..b37cb9539b9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.", + "false_positives": [ + "Certain programs or applications may modify files or change ownership in writable directories. These can be exempted by username." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "File Permission Modification in Writable Directory", + "query": "process where host.os.type == \"linux\" and event.type == \"start\"and\n process.name in (\"chmod\", \"chown\", \"chattr\", \"chgrp\") and\n process.working_directory in (\"/tmp\", \"/var/tmp\", \"/dev/shm\") and\n not process.parent.name in (\"update-motd-updates-available\") and\n not user.name == \"root\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9f9a2a82-93a8-4b1a-8778-1780895626d4", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "9f9a2a82-93a8-4b1a-8778-1780895626d4_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_105.json b/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_105.json new file mode 100644 index 00000000000..ccb4175ae32 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/9f9a2a82-93a8-4b1a-8778-1780895626d4_105.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies file permission modifications in common writable directories by a non-root user. Adversaries often drop files or payloads into a writable directory and change permissions prior to execution.", + "false_positives": [ + "Certain programs or applications may modify files or change ownership in writable directories. These can be exempted by username." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "File Permission Modification in Writable Directory", + "query": "process where host.os.type == \"linux\" and event.type == \"start\"and\n process.name in (\"chmod\", \"chown\", \"chattr\", \"chgrp\") and\n process.working_directory in (\"/tmp\", \"/var/tmp\", \"/dev/shm\") and\n not process.parent.name in (\"update-motd-updates-available\") and\n not user.name == \"root\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "9f9a2a82-93a8-4b1a-8778-1780895626d4", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "9f9a2a82-93a8-4b1a-8778-1780895626d4_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a02cb68e-7c93-48d1-93b2-2c39023308eb_8.json b/packages/security_detection_engine/kibana/security_rule/a02cb68e-7c93-48d1-93b2-2c39023308eb_8.json new file mode 100644 index 00000000000..135b69c4c48 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a02cb68e-7c93-48d1-93b2-2c39023308eb_8.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Indicates the update of a scheduled task using Windows event logs. Adversaries can use these to establish persistence, by changing the configuration of a legit scheduled task. Some changes such as disabling or enabling a scheduled task are common and may may generate noise.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "A scheduled task was updated", + "query": "iam where event.action == \"scheduled-task-updated\" and\n\n /* excluding tasks created by the computer account */\n not user.name : \"*$\" and \n not winlog.event_data.TaskName : \"*Microsoft*\" and \n not winlog.event_data.TaskName :\n (\"\\\\User_Feed_Synchronization-*\",\n \"\\\\OneDrive Reporting Task-S-1-5-21*\",\n \"\\\\OneDrive Reporting Task-S-1-12-1-*\",\n \"\\\\Hewlett-Packard\\\\HP Web Products Detection\",\n \"\\\\Hewlett-Packard\\\\HPDeviceCheck\", \n \"\\\\Microsoft\\\\Windows\\\\UpdateOrchestrator\\\\UpdateAssistant\", \n \"\\\\IpamDnsProvisioning\", \n \"\\\\Microsoft\\\\Windows\\\\UpdateOrchestrator\\\\UpdateAssistantAllUsersRun\", \n \"\\\\Microsoft\\\\Windows\\\\UpdateOrchestrator\\\\UpdateAssistantCalendarRun\", \n \"\\\\Microsoft\\\\Windows\\\\UpdateOrchestrator\\\\UpdateAssistantWakeupRun\", \n \"\\\\Microsoft\\\\Windows\\\\.NET Framework\\\\.NET Framework NGEN v*\", \n \"\\\\Microsoft\\\\VisualStudio\\\\Updates\\\\BackgroundDownload\") and \n not winlog.event_data.SubjectUserSid : (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.SubjectUserSid", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.TaskName", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "a02cb68e-7c93-48d1-93b2-2c39023308eb", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 8 + }, + "id": "a02cb68e-7c93-48d1-93b2-2c39023308eb_8", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a13167f1-eec2-4015-9631-1fee60406dcf_105.json b/packages/security_detection_engine/kibana/security_rule/a13167f1-eec2-4015-9631-1fee60406dcf_105.json new file mode 100644 index 00000000000..1ac7925ba44 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a13167f1-eec2-4015-9631-1fee60406dcf_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies InstallUtil.exe making outbound network connections. This may indicate adversarial activity as InstallUtil is often leveraged by adversaries to execute code and evade detection.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "InstallUtil Process Making Network Connections", + "query": "/* the benefit of doing this as an eql sequence vs kql is this will limit to alerting only on the first network connection */\n\nsequence by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"installutil.exe\"]\n [network where host.os.type == \"windows\" and process.name : \"installutil.exe\" and network.direction : (\"outgoing\", \"egress\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a13167f1-eec2-4015-9631-1fee60406dcf", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.004", + "name": "InstallUtil", + "reference": "https://attack.mitre.org/techniques/T1218/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "a13167f1-eec2-4015-9631-1fee60406dcf_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a1329140-8de3-4445-9f87-908fb6d824f4_105.json b/packages/security_detection_engine/kibana/security_rule/a1329140-8de3-4445-9f87-908fb6d824f4_105.json new file mode 100644 index 00000000000..15ac4fd063e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a1329140-8de3-4445-9f87-908fb6d824f4_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Malware or other files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as part of the post-intrusion cleanup process.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "File Deletion via Shred", + "query": "event.category:process and host.os.type:linux and event.type:start and process.name:shred and\nprocess.args:(\"-u\" or \"--remove\" or \"-z\" or \"--zero\") and not process.parent.name:logrotate\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "a1329140-8de3-4445-9f87-908fb6d824f4", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "a1329140-8de3-4445-9f87-908fb6d824f4_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a1699af0-8e1e-4ed0-8ec1-89783538a061_4.json b/packages/security_detection_engine/kibana/security_rule/a1699af0-8e1e-4ed0-8ec1-89783538a061_4.json new file mode 100644 index 00000000000..2d032823306 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a1699af0-8e1e-4ed0-8ec1-89783538a061_4.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects changes to the registry that indicates the install of a new Windows Subsystem for Linux distribution by name. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Subsystem for Linux Distribution Installed", + "query": "registry where host.os.type == \"windows\" and\n registry.path : \n (\"HK*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Lxss\\\\*\\\\PackageFamilyName\",\n \"\\\\REGISTRY\\\\*\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Lxss\\\\*\\\\PackageFamilyName\")\n", + "references": [ + "https://learn.microsoft.com/en-us/windows/wsl/wsl-config" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a1699af0-8e1e-4ed0-8ec1-89783538a061", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + }, + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timeline_id": "3e47ef71-ebfc-4520-975c-cb27fc090799", + "timeline_title": "Comprehensive Registry Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "a1699af0-8e1e-4ed0-8ec1-89783538a061_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a1a0375f-22c2-48c0-81a4-7c2d11cc6856_105.json b/packages/security_detection_engine/kibana/security_rule/a1a0375f-22c2-48c0-81a4-7c2d11cc6856_105.json new file mode 100644 index 00000000000..2600b6d98a5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a1a0375f-22c2-48c0-81a4-7c2d11cc6856_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a shell process with suspicious arguments which may be indicative of reverse shell activity.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell Activity via Terminal", + "note": "## Triage and analysis\n\n### Investigating Potential Reverse Shell Activity via Terminal\n\nA reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing. This activity is typically the result of vulnerability exploitation, malware infection, or penetration testing.\n\nThis rule identifies commands that are potentially related to reverse shell activities using shell applications.\n\n#### Possible investigation steps\n\n- Examine the command line and extract the target domain or IP address information.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Take actions to terminate processes and connections used by the attacker.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where event.type in (\"start\", \"process_started\") and\n process.name in (\"sh\", \"bash\", \"zsh\", \"dash\", \"zmodload\") and\n process.args : (\"*/dev/tcp/*\", \"*/dev/udp/*\", \"*zsh/net/tcp*\", \"*zsh/net/udp*\") and\n\n /* noisy FPs */\n not (process.parent.name : \"timeout\" and process.executable : \"/var/lib/docker/overlay*\") and\n not process.command_line : (\"*/dev/tcp/sirh_db/*\", \"*/dev/tcp/remoteiot.com/*\", \"*dev/tcp/elk.stag.one/*\", \"*dev/tcp/kafka/*\", \"*/dev/tcp/$0/$1*\", \"*/dev/tcp/127.*\", \"*/dev/udp/127.*\", \"*/dev/tcp/localhost/*\") and\n not process.parent.command_line : \"runc init\"\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md", + "https://github.com/WangYihang/Reverse-Shell-Manager", + "https://www.netsparker.com/blog/web-security/understanding-reverse-shells/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "a1a0375f-22c2-48c0-81a4-7c2d11cc6856", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "a1a0375f-22c2-48c0-81a4-7c2d11cc6856_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f_2.json b/packages/security_detection_engine/kibana/security_rule/a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f_2.json new file mode 100644 index 00000000000..5a520ec0273 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f_2.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux Group Creation", + "note": "## Triage and analysis\n\n### Investigating Linux Group Creation\n\nThe `groupadd` and `addgroup` commands are used to create new user groups in Linux-based operating systems.\n\nAttackers may create new groups to maintain access to victim systems or escalate privileges by assigning a compromised account to a privileged group.\n\nThis rule identifies the usages of `groupadd` and `addgroup` to create new groups.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate whether the group was created succesfully.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Identify if a user account was added to this group after creation.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Group creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the created group and, in case an account was added to this group, delete the account.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "iam where host.os.type == \"linux\" and (event.type == \"group\" and event.type == \"creation\") and\nprocess.name in (\"groupadd\", \"addgroup\") and group.name != null\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "group.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "a1c2589e-0c8c-4ca8-9eb6-f83c4bbdbe8f_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a22a09c2-2162-4df0-a356-9aacbeb56a04_105.json b/packages/security_detection_engine/kibana/security_rule/a22a09c2-2162-4df0-a356-9aacbeb56a04_105.json new file mode 100644 index 00000000000..ce176504e58 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a22a09c2-2162-4df0-a356-9aacbeb56a04_105.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Austin Songer" + ], + "description": "Identifies when a user enables DNS-over-HTTPS. This can be used to hide internet activity or the process of exfiltrating data. With this enabled, an organization will lose visibility into data such as query type, response, and originating IP, which are used to determine bad actors.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "DNS-over-HTTPS Enabled via Registry", + "note": "", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Edge\\\\BuiltInDnsClientEnabled\" and\n registry.data.strings : \"1\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Google\\\\Chrome\\\\DnsOverHttpsMode\" and\n registry.data.strings : \"secure\") or\n (registry.path : \"*\\\\SOFTWARE\\\\Policies\\\\Mozilla\\\\Firefox\\\\DNSOverHTTPS\" and\n registry.data.strings : \"1\")\n", + "references": [ + "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", + "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "a22a09c2-2162-4df0-a356-9aacbeb56a04", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "a22a09c2-2162-4df0-a356-9aacbeb56a04_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a3ea12f3-0d4e-4667-8b44-4230c63f3c75_105.json b/packages/security_detection_engine/kibana/security_rule/a3ea12f3-0d4e-4667-8b44-4230c63f3c75_105.json new file mode 100644 index 00000000000..a78185e581a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a3ea12f3-0d4e-4667-8b44-4230c63f3c75_105.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation, change, or deletion of a DLL module within a Windows SxS local folder. Adversaries may abuse shared modules to execute malicious payloads by instructing the Windows module loader to load DLLs from arbitrary local paths.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution via local SxS Shared Module", + "note": "## Triage and analysis\n\nThe SxS DotLocal folder is a legitimate feature that can be abused to hijack standard modules loading order by forcing an executable on the same application.exe.local folder to load a malicious DLL module from the same directory.", + "query": "file where host.os.type == \"windows\" and file.extension : \"dll\" and file.path : \"C:\\\\*\\\\*.exe.local\\\\*.dll\"\n", + "references": [ + "https://docs.microsoft.com/en-us/windows/win32/dlls/dynamic-link-library-redirection" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a3ea12f3-0d4e-4667-8b44-4230c63f3c75", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1129", + "name": "Shared Modules", + "reference": "https://attack.mitre.org/techniques/T1129/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "a3ea12f3-0d4e-4667-8b44-4230c63f3c75_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a4c7473a-5cb4-4bc1-9d06-e4a75adbc494_106.json b/packages/security_detection_engine/kibana/security_rule/a4c7473a-5cb4-4bc1-9d06-e4a75adbc494_106.json new file mode 100644 index 00000000000..ea68cc2ae50 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a4c7473a-5cb4-4bc1-9d06-e4a75adbc494_106.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a medium-size registry hive file on a Server Message Block (SMB) share, which may indicate an exfiltration attempt of a previously dumped Security Account Manager (SAM) registry hive for credential extraction on an attacker-controlled system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Registry File Creation in SMB Share", + "note": "## Triage and analysis\n\n### Investigating Windows Registry File Creation in SMB Share\n\nDumping registry hives is a common way to access credential information. Some hives store credential material, as is the case for the SAM hive, which stores locally cached credentials (SAM secrets), and the SECURITY hive, which stores domain cached credentials (LSA secrets). Dumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.\n\nAttackers can try to evade detection on the host by transferring this data to a system that is not monitored to be parsed and decrypted. This rule identifies the creation or modification of a medium-size registry hive file on an SMB share, which may indicate this kind of exfiltration attempt.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/source host during the past 48 hours.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Inspect the source host for suspicious or abnormal behaviors in the alert timeframe.\n- Capture the registry file(s) to determine the extent of the credential compromise in an eventual incident response.\n\n### False positive analysis\n\n- Administrators can export registry hives for backup purposes. Check whether the user should be performing this kind of activity and is aware of it.\n\n### Related rules\n\n- Credential Acquisition via Registry Hive Dumping - a7e7bfa3-088e-4f13-b29e-3986e0e756b8\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system and restore compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and\n /* regf file header */\n file.Ext.header_bytes : \"72656766*\" and file.size \u003e= 30000 and\n process.pid == 4 and user.id : (\"S-1-5-21*\", \"S-1-12-1-*\")\n", + "references": [ + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.header_bytes", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.size", + "type": "long" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a4c7473a-5cb4-4bc1-9d06-e4a75adbc494", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "a4c7473a-5cb4-4bc1-9d06-e4a75adbc494_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a5eb21b7-13cc-4b94-9fe2-29bb2914e037_1.json b/packages/security_detection_engine/kibana/security_rule/a5eb21b7-13cc-4b94-9fe2-29bb2914e037_1.json new file mode 100644 index 00000000000..1ecc06d2fb4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a5eb21b7-13cc-4b94-9fe2-29bb2914e037_1.json @@ -0,0 +1,138 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule identifies suspicious network traffic patterns associated with UDP reverse shell activity. This activity consists of a sample of an execve, socket and connect syscall executed by the same process, where the auditd.data.a0-1 indicate a UDP connection, ending with an egress connection event. An attacker may establish a Linux UDP reverse shell to bypass traditional firewall restrictions and gain remote access to a target system covertly.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via UDP", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n```\nFor this detection rule no additional audit rules are required to be added to the integration. \n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "sample by host.id, process.pid, process.parent.pid\n[process where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n auditd.data.syscall == \"execve\" and process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\",\n \"csh\", \"zsh\", \"ksh\", \"fish\", \"perl\", \"python*\", \"nc\", \"ncat\", \"netcat\", \"php*\", \"ruby\",\n \"openssl\", \"awk\", \"telnet\", \"lua*\", \"socat\")]\n[process where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n auditd.data.syscall == \"socket\" and process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\",\n \"zsh\", \"ksh\", \"fish\", \"perl\", \"python*\", \"nc\", \"ncat\", \"netcat\", \"php*\", \"ruby\", \"openssl\",\n \"awk\", \"telnet\", \"lua*\", \"socat\") and auditd.data.a0 == \"2\" and auditd.data.a1 : (\"2\", \"802\")]\n[network where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n auditd.data.syscall == \"connect\" and process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\",\n \"zsh\", \"ksh\", \"fish\", \"perl\", \"python*\", \"nc\", \"ncat\", \"netcat\", \"php*\", \"ruby\", \"openssl\",\n \"awk\", \"telnet\", \"lua*\", \"socat\") and network.direction == \"egress\" and destination.ip != null and \n destination.ip != \"127.0.0.1\" and destination.ip != \"127.0.0.53\" and destination.ip != \"::1\"]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "integration": "auditd", + "package": "auditd_manager", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "auditd.data.a0", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.a1", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.syscall", + "type": "unknown" + }, + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "a5eb21b7-13cc-4b94-9fe2-29bb2914e037", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n```\nFor this detection rule no additional audit rules are required to be added to the integration.\n```\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "medium", + "tags": [ + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "a5eb21b7-13cc-4b94-9fe2-29bb2914e037_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_4.json b/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_4.json deleted file mode 100644 index a5b9897bc64..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_4.json +++ /dev/null @@ -1,122 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies multiple consecutive login failures targeting a root user account from the same source address and within a short time interval. Adversaries will often brute force login attempts on privileged accounts with a common or known password, in an attempt to gain privileged access to systems.", - "from": "now-9m", - "index": [ - "auditbeat-*", - "logs-system.auth-*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Potential SSH Brute Force Detected on Privileged Account", - "note": "## Triage and analysis\n\n### Investigating Potential SSH Brute Force Attack on Privileged Account\n\nThe rule identifies consecutive SSH login failures targeting a privileged (root) account from the same source IP address to the same target host indicating brute force login attempts.\n\n#### Possible investigation steps\n\n- Investigate the login failure on privileged account(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", - "query": "sequence by host.id, source.ip with maxspan=10s\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"failure\" and source.ip != null and source.ip != \"0.0.0.0\" and\n source.ip != \"::\" and user.name : (\"*root*\" , \"*admin*\")] with runs=3\n", - "related_integrations": [ - { - "package": "system", - "version": "^1.6.4" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.action", - "type": "keyword" - }, - { - "ecs": true, - "name": "event.outcome", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.id", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "user.name", - "type": "keyword" - } - ], - "risk_score": 73, - "rule_id": "a5f0d057-d540-44f5-924d-c6a2ae92f045", - "severity": "high", - "tags": [ - "Elastic", - "Host", - "Linux", - "Threat Detection", - "Lateral Movement", - "Credential Access" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1110", - "name": "Brute Force", - "reference": "https://attack.mitre.org/techniques/T1110/", - "subtechnique": [ - { - "id": "T1110.001", - "name": "Password Guessing", - "reference": "https://attack.mitre.org/techniques/T1110/001/" - }, - { - "id": "T1110.003", - "name": "Password Spraying", - "reference": "https://attack.mitre.org/techniques/T1110/003/" - } - ] - } - ] - }, - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/", - "subtechnique": [ - { - "id": "T1021.004", - "name": "SSH", - "reference": "https://attack.mitre.org/techniques/T1021/004/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 4 - }, - "id": "a5f0d057-d540-44f5-924d-c6a2ae92f045_4", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_5.json b/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_5.json deleted file mode 100644 index ec94702789a..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/a5f0d057-d540-44f5-924d-c6a2ae92f045_5.json +++ /dev/null @@ -1,121 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies multiple consecutive login failures targeting a root user account from the same source address and within a short time interval. Adversaries will often brute force login attempts on privileged accounts with a common or known password, in an attempt to gain privileged access to systems.", - "from": "now-9m", - "index": [ - "auditbeat-*", - "logs-system.auth-*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Potential SSH Brute Force Detected on Privileged Account", - "note": "## Triage and analysis\n\n### Investigating Potential SSH Brute Force Attack on Privileged Account\n\nThe rule identifies consecutive SSH login failures targeting a privileged (root) account from the same source IP address to the same target host indicating brute force login attempts.\n\n#### Possible investigation steps\n\n- Investigate the login failure on privileged account(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", - "query": "sequence by host.id, source.ip with maxspan=10s\n [authentication where host.os.type == \"linux\" and event.action in (\"ssh_login\", \"user_login\") and\n event.outcome == \"failure\" and source.ip != null and source.ip != \"0.0.0.0\" and\n source.ip != \"::\" and user.name : (\"*root*\" , \"*admin*\")] with runs=3\n", - "related_integrations": [ - { - "package": "system", - "version": "^1.6.4" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.action", - "type": "keyword" - }, - { - "ecs": true, - "name": "event.outcome", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.id", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "source.ip", - "type": "ip" - }, - { - "ecs": true, - "name": "user.name", - "type": "keyword" - } - ], - "risk_score": 73, - "rule_id": "a5f0d057-d540-44f5-924d-c6a2ae92f045", - "severity": "high", - "tags": [ - "Domain: Endpoint", - "OS: Linux", - "Use Case: Threat Detection", - "Tactic: Lateral Movement", - "Tactic: Credential Access" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0006", - "name": "Credential Access", - "reference": "https://attack.mitre.org/tactics/TA0006/" - }, - "technique": [ - { - "id": "T1110", - "name": "Brute Force", - "reference": "https://attack.mitre.org/techniques/T1110/", - "subtechnique": [ - { - "id": "T1110.001", - "name": "Password Guessing", - "reference": "https://attack.mitre.org/techniques/T1110/001/" - }, - { - "id": "T1110.003", - "name": "Password Spraying", - "reference": "https://attack.mitre.org/techniques/T1110/003/" - } - ] - } - ] - }, - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0008", - "name": "Lateral Movement", - "reference": "https://attack.mitre.org/tactics/TA0008/" - }, - "technique": [ - { - "id": "T1021", - "name": "Remote Services", - "reference": "https://attack.mitre.org/techniques/T1021/", - "subtechnique": [ - { - "id": "T1021.004", - "name": "SSH", - "reference": "https://attack.mitre.org/techniques/T1021/004/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 5 - }, - "id": "a5f0d057-d540-44f5-924d-c6a2ae92f045_5", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_2.json b/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_2.json new file mode 100644 index 00000000000..59ee1b0755f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_2.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel Windows Registry Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel Windows Registry Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Check related threat reports to gain context about the registry indicator of compromise (IoC) and to understand if it's a system-native mechanism abused for persistence, to store data, to disable security mechanisms, etc. Use this information to define the appropriate triage and respond steps.\n- Identify the process responsible for the registry operation and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - $osquery_0\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - $osquery_1\n - $osquery_2\n - $osquery_3\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- Adversaries can leverage dual-use registry mechanisms that are commonly used by normal applications. These registry keys can be added into indicator lists creating the potential for false positives.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "registry.path:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 99, + "rule_id": "a61809f3-fb5b-465c-8bff-23a8a068ac60", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "registry.path", + "type": "mapping", + "value": "threat.indicator.registry.path" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.registry.path:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 2 + }, + "id": "a61809f3-fb5b-465c-8bff-23a8a068ac60_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_3.json b/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_3.json new file mode 100644 index 00000000000..434d88ff4cb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a61809f3-fb5b-465c-8bff-23a8a068ac60_3.json @@ -0,0 +1,126 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains registry data.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel Windows Registry Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel Windows Registry Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a Windows registry indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains registry data.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Check related threat reports to gain context about the registry indicator of compromise (IoC) and to understand if it's a system-native mechanism abused for persistence, to store data, to disable security mechanisms, etc. Use this information to define the appropriate triage and respond steps.\n- Identify the process responsible for the registry operation and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- Adversaries can leverage dual-use registry mechanisms that are commonly used by normal applications. These registry keys can be added into indicator lists creating the potential for false positives.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "registry.path:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 99, + "rule_id": "a61809f3-fb5b-465c-8bff-23a8a068ac60", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "registry.path", + "type": "mapping", + "value": "threat.indicator.registry.path" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.registry.path:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 3 + }, + "id": "a61809f3-fb5b-465c-8bff-23a8a068ac60_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a624863f-a70d-417f-a7d2-7a404638d47f_107.json b/packages/security_detection_engine/kibana/security_rule/a624863f-a70d-417f-a7d2-7a404638d47f_107.json new file mode 100644 index 00000000000..47b753d20d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a624863f-a70d-417f-a7d2-7a404638d47f_107.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious child processes of frequently targeted Microsoft Office applications (Word, PowerPoint, Excel). These child processes are often launched during exploitation of Office applications or from documents with malicious macros.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious MS Office Child Process", + "note": "## Triage and analysis\n\n### Investigating Suspicious MS Office Child Process\n\nMicrosoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.\n\nThis rule looks for suspicious processes spawned by MS Office programs. This is generally the result of the execution of malicious documents.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"eqnedt32.exe\", \"excel.exe\", \"fltldr.exe\", \"msaccess.exe\", \"mspub.exe\", \"powerpnt.exe\", \"winword.exe\", \"outlook.exe\") and\n process.name : (\"Microsoft.Workflow.Compiler.exe\", \"arp.exe\", \"atbroker.exe\", \"bginfo.exe\", \"bitsadmin.exe\", \"cdb.exe\", \"certutil.exe\",\n \"cmd.exe\", \"cmstp.exe\", \"control.exe\", \"cscript.exe\", \"csi.exe\", \"dnx.exe\", \"dsget.exe\", \"dsquery.exe\", \"forfiles.exe\",\n \"fsi.exe\", \"ftp.exe\", \"gpresult.exe\", \"hostname.exe\", \"ieexec.exe\", \"iexpress.exe\", \"installutil.exe\", \"ipconfig.exe\",\n \"mshta.exe\", \"msxsl.exe\", \"nbtstat.exe\", \"net.exe\", \"net1.exe\", \"netsh.exe\", \"netstat.exe\", \"nltest.exe\", \"odbcconf.exe\",\n \"ping.exe\", \"powershell.exe\", \"pwsh.exe\", \"qprocess.exe\", \"quser.exe\", \"qwinsta.exe\", \"rcsi.exe\", \"reg.exe\", \"regasm.exe\",\n \"regsvcs.exe\", \"regsvr32.exe\", \"sc.exe\", \"schtasks.exe\", \"systeminfo.exe\", \"tasklist.exe\", \"tracert.exe\", \"whoami.exe\",\n \"wmic.exe\", \"wscript.exe\", \"xwizard.exe\", \"explorer.exe\", \"rundll32.exe\", \"hh.exe\", \"msdt.exe\")\n", + "references": [ + "https://www.elastic.co/blog/vulnerability-summary-follina" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a624863f-a70d-417f-a7d2-7a404638d47f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Resources: Investigation Guide", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.003", + "name": "Windows Command Shell", + "reference": "https://attack.mitre.org/techniques/T1059/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "a624863f-a70d-417f-a7d2-7a404638d47f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a6bf4dd4-743e-4da8-8c03-3ebd753a6c90_104.json b/packages/security_detection_engine/kibana/security_rule/a6bf4dd4-743e-4da8-8c03-3ebd753a6c90_104.json new file mode 100644 index 00000000000..0e8b172f570 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a6bf4dd4-743e-4da8-8c03-3ebd753a6c90_104.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of the Event Monitor Daemon (emond) rules. Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Emond Rules Creation or Modification", + "note": "", + "query": "file where host.os.type == \"macos\" and event.type != \"deletion\" and\n file.path : (\"/private/etc/emond.d/rules/*.plist\", \"/etc/emon.d/rules/*.plist\", \"/private/var/db/emondClients/*\")\n", + "references": [ + "https://www.xorrior.com/emond-persistence/", + "https://www.sentinelone.com/blog/how-malware-persists-on-macos/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.014", + "name": "Emond", + "reference": "https://attack.mitre.org/techniques/T1546/014/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "a6bf4dd4-743e-4da8-8c03-3ebd753a6c90_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a7ccae7b-9d2c-44b2-a061-98e5946971fa_107.json b/packages/security_detection_engine/kibana/security_rule/a7ccae7b-9d2c-44b2-a061-98e5946971fa_107.json new file mode 100644 index 00000000000..237004b1e6d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a7ccae7b-9d2c-44b2-a061-98e5946971fa_107.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Print Spooler SPL File Created", + "note": "## Triage and analysis\n\n### Investigating Suspicious Print Spooler SPL File Created\n\nPrint Spooler is a Windows service enabled by default in all Windows clients and servers. The service manages print jobs by loading printer drivers, receiving files to be printed, queuing them, scheduling, etc.\n\nThe Print Spooler service has some known vulnerabilities that attackers can abuse to escalate privileges to SYSTEM, like CVE-2020-1048 and CVE-2020-1337. This rule looks for unusual processes writing SPL files to the location `?:\\Windows\\System32\\spool\\PRINTERS\\`, which is an essential step in exploiting these vulnerabilities.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of process executable and file conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Ensure that the machine has the latest security updates and is not running legacy Windows versions.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.extension : \"spl\" and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\PRINTERS\\\\*\" and\n not process.name : (\"spoolsv.exe\",\n \"printfilterpipelinesvc.exe\",\n \"PrintIsolationHost.exe\",\n \"splwow64.exe\",\n \"msiexec.exe\",\n \"poqexec.exe\") and\n not user.id : \"S-1-5-18\" and\n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\mmc.exe\",\n \"\\\\Device\\\\Mup\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Windows\\\\System32\\\\mmc.exe\",\n \"?:\\\\Windows\\\\System32\\\\printui.exe\",\n \"?:\\\\Windows\\\\System32\\\\mstsc.exe\",\n \"?:\\\\Windows\\\\System32\\\\spool\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\PROGRA~1\\\\*.exe\",\n \"?:\\\\PROGRA~2\\\\*.exe\")\n", + "references": [ + "https://safebreach.com/Post/How-we-bypassed-CVE-2020-1048-Patch-and-got-CVE-2020-1337" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "a7ccae7b-9d2c-44b2-a061-98e5946971fa", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "a7ccae7b-9d2c-44b2-a061-98e5946971fa_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a7e7bfa3-088e-4f13-b29e-3986e0e756b8_106.json b/packages/security_detection_engine/kibana/security_rule/a7e7bfa3-088e-4f13-b29e-3986e0e756b8_106.json new file mode 100644 index 00000000000..2b02f7714b7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a7e7bfa3-088e-4f13-b29e-3986e0e756b8_106.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to export a registry hive which may contain credentials using the Windows reg.exe tool.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Credential Acquisition via Registry Hive Dumping", + "note": "## Triage and analysis\n\n### Investigating Credential Acquisition via Registry Hive Dumping\n\nDumping registry hives is a common way to access credential information as some hives store credential material.\n\nFor example, the SAM hive stores locally cached credentials (SAM Secrets), and the SECURITY hive stores domain cached credentials (LSA secrets).\n\nDumping these hives in combination with the SYSTEM hive enables the attacker to decrypt these secrets.\n\nThis rule identifies the usage of `reg.exe` to dump SECURITY and/or SAM hives, which potentially indicates the compromise of the credentials stored in the host.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate if the credential material was exfiltrated or processed locally by other tools.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.\n\n### False positive analysis\n\n- Administrators can export registry hives for backup purposes using command line tools like `reg.exe`. Check whether the user is legitamitely performing this kind of activity.\n\n### Related rules\n\n- Registry Hive File Creation via SMB - a4c7473a-5cb4-4bc1-9d06-e4a75adbc494\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system and restore compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name == \"reg.exe\" and\n process.args : (\"save\", \"export\") and\n process.args : (\"hklm\\\\sam\", \"hklm\\\\security\")\n", + "references": [ + "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-the-registry-7512674487f8", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "a7e7bfa3-088e-4f13-b29e-3986e0e756b8", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + }, + { + "id": "T1003.004", + "name": "LSA Secrets", + "reference": "https://attack.mitre.org/techniques/T1003/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "a7e7bfa3-088e-4f13-b29e-3986e0e756b8_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a9b05c3b-b304-4bf9-970d-acdfaef2944c_104.json b/packages/security_detection_engine/kibana/security_rule/a9b05c3b-b304-4bf9-970d-acdfaef2944c_104.json new file mode 100644 index 00000000000..ceebff52074 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a9b05c3b-b304-4bf9-970d-acdfaef2944c_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a persistence mechanism that utilizes the NtSetValueKey native API to create a hidden (null terminated) registry key. An adversary may use this method to hide from system utilities such as the Registry Editor (regedit).", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Hidden Run Key Detected", + "note": "", + "query": "/* Registry Path ends with backslash */\nregistry where host.os.type == \"windows\" and /* length(registry.data.strings) \u003e 0 and */\n registry.path : (\"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKLM\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\WOW6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\Explorer\\\\Run\\\\\")\n", + "references": [ + "https://github.com/outflanknl/SharpHide", + "https://github.com/ewhitehats/InvisiblePersistence/blob/master/InvisibleRegValues_Whitepaper.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "a9b05c3b-b304-4bf9-970d-acdfaef2944c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "a9b05c3b-b304-4bf9-970d-acdfaef2944c_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7_103.json b/packages/security_detection_engine/kibana/security_rule/a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7_103.json new file mode 100644 index 00000000000..b593acc4cad --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7_103.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects events that could be describing IPSEC NAT Traversal traffic. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal enables these tunnels to communicate over the Internet where one of the sides is behind a NAT router gateway. This may be common on your network, but this technique is also used by threat actors to avoid detection.", + "false_positives": [ + "Some networks may utilize these protocols but usage that is unfamiliar to local network administrators can be unexpected and suspicious. Because this port is in the ephemeral range, this rule may false under certain conditions, such as when an application server with a public IP address replies to a client which has used a UDP port in the range by coincidence. This is uncommon but such servers can be excluded." + ], + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "IPSEC NAT Traversal Port Activity", + "query": "event.dataset: network_traffic.flow and network.transport:udp and destination.port:4500\n", + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7", + "severity": "low", + "tags": [ + "Tactic: Command and Control", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "a9cb3641-ff4b-4cdc-a063-b4b8d02a67c7_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aa895aea-b69c-4411-b110-8d7599634b30_106.json b/packages/security_detection_engine/kibana/security_rule/aa895aea-b69c-4411-b110-8d7599634b30_106.json new file mode 100644 index 00000000000..63e189d3b7b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aa895aea-b69c-4411-b110-8d7599634b30_106.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the deletion of sensitive Linux system logs. This may indicate an attempt to evade detection or destroy forensic evidence on a system.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Log File Deletion", + "note": "", + "query": "file where host.os.type == \"linux\" and event.type == \"deletion\" and\n file.path :\n (\n \"/var/run/utmp\",\n \"/var/log/wtmp\",\n \"/var/log/btmp\",\n \"/var/log/lastlog\",\n \"/var/log/faillog\",\n \"/var/log/syslog\",\n \"/var/log/messages\",\n \"/var/log/secure\",\n \"/var/log/auth.log\",\n \"/var/log/boot.log\",\n \"/var/log/kern.log\"\n ) and\n not process.name : (\"gzip\")\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2020/11/live-off-the-land-an-overview-of-unc1945.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "aa895aea-b69c-4411-b110-8d7599634b30", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.002", + "name": "Clear Linux or Mac System Logs", + "reference": "https://attack.mitre.org/techniques/T1070/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "aa895aea-b69c-4411-b110-8d7599634b30_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_107.json b/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_107.json new file mode 100644 index 00000000000..dce684546e9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_107.json @@ -0,0 +1,135 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators.\"", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remotely Started Services via RPC", + "note": "## Triage and analysis\n\n### Investigating Remotely Started Services via RPC\n\nThe Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service programs running on a remote computer. A remote service management session begins with the client initiating the connection request to the server. If the server grants the request, the connection is established. The client can then make multiple requests to modify, query the configuration, or start and stop services on the server by using the same session until the session is terminated.\n\nThis rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the `source.address` field to help identify the source system.\n- Review network events from the source system using the source port identified on the alert and try to identify the program used to initiate the action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- Remote management software like SCCM may trigger this rule. If noisy on your environment, consider adding exceptions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence with maxspan=1s\n [network where host.os.type == \"windows\" and process.name : \"services.exe\" and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n source.port \u003e= 49152 and destination.port \u003e= 49152 and source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ] by host.id, process.entity_id\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"services.exe\" and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\svchost.exe\" and process.args : \"tiledatamodelsvc\") and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\msiexec.exe\" and process.args : \"/V\") and\n not process.executable :\n (\"?:\\\\Windows\\\\ADCR_Agent\\\\adcrsvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\VSSVC.exe\",\n \"?:\\\\Windows\\\\servicing\\\\TrustedInstaller.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Windows\\\\PSEXESVC.EXE\",\n \"?:\\\\Windows\\\\System32\\\\sppsvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\wbem\\\\WmiApSrv.exe\",\n \"?:\\\\WINDOWS\\\\RemoteAuditService.exe\",\n \"?:\\\\Windows\\\\VeeamVssSupport\\\\VeeamGuestHelper.exe\",\n \"?:\\\\Windows\\\\VeeamLogShipper\\\\VeeamLogShipper.exe\",\n \"?:\\\\Windows\\\\CAInvokerService.exe\",\n \"?:\\\\Windows\\\\System32\\\\upfc.exe\",\n \"?:\\\\Windows\\\\AdminArsenal\\\\PDQ*.exe\",\n \"?:\\\\Windows\\\\System32\\\\vds.exe\",\n \"?:\\\\Windows\\\\Veeam\\\\Backup\\\\VeeamDeploymentSvc.exe\",\n \"?:\\\\Windows\\\\ProPatches\\\\Scheduler\\\\STSchedEx.exe\",\n \"?:\\\\Windows\\\\System32\\\\certsrv.exe\",\n \"?:\\\\Windows\\\\eset-remote-install-service.exe\",\n \"?:\\\\Pella Corporation\\\\Pella Order Management\\\\GPAutoSvc.exe\",\n \"?:\\\\Pella Corporation\\\\OSCToGPAutoService\\\\OSCToGPAutoSvc.exe\",\n \"?:\\\\Pella Corporation\\\\Pella Order Management\\\\GPAutoSvc.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\NwxExeSvc\\\\NwxExeSvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\taskhostex.exe\")\n ] by host.id, process.parent.entity_id\n", + "references": [ + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/705b624a-13de-43cc-b8a2-99573da3635f" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "aa9a274d-6b53-424d-ac5e-cb8ca4251650", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "aa9a274d-6b53-424d-ac5e-cb8ca4251650_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_108.json b/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_108.json new file mode 100644 index 00000000000..6160a615af0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aa9a274d-6b53-424d-ac5e-cb8ca4251650_108.json @@ -0,0 +1,136 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies remote execution of Windows services over remote procedure call (RPC). This could be indicative of lateral movement, but will be noisy if commonly done by administrators.\"", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remotely Started Services via RPC", + "note": "## Triage and analysis\n\n### Investigating Remotely Started Services via RPC\n\nThe Service Control Manager Remote Protocol is a client/server protocol used for configuring and controlling service programs running on a remote computer. A remote service management session begins with the client initiating the connection request to the server. If the server grants the request, the connection is established. The client can then make multiple requests to modify, query the configuration, or start and stop services on the server by using the same session until the session is terminated.\n\nThis rule detects the remote creation or start of a service by correlating a `services.exe` network connection and the spawn of a child process.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Review login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action. Use the `source.address` field to help identify the source system.\n- Review network events from the source system using the source port identified on the alert and try to identify the program used to initiate the action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- Remote management software like SCCM may trigger this rule. If noisy on your environment, consider adding exceptions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence with maxspan=1s\n [network where host.os.type == \"windows\" and process.name : \"services.exe\" and\n network.direction : (\"incoming\", \"ingress\") and network.transport == \"tcp\" and\n source.port \u003e= 49152 and destination.port \u003e= 49152 and source.ip != \"127.0.0.1\" and source.ip != \"::1\"\n ] by host.id, process.entity_id\n [process where host.os.type == \"windows\" and \n event.type == \"start\" and process.parent.name : \"services.exe\" and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\svchost.exe\" and process.args : \"tiledatamodelsvc\") and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\msiexec.exe\" and process.args : \"/V\") and\n not process.executable :\n (\"?:\\\\Windows\\\\ADCR_Agent\\\\adcrsvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\VSSVC.exe\",\n \"?:\\\\Windows\\\\servicing\\\\TrustedInstaller.exe\",\n \"?:\\\\Windows\\\\System32\\\\svchost.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Windows\\\\PSEXESVC.EXE\",\n \"?:\\\\Windows\\\\System32\\\\sppsvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\wbem\\\\WmiApSrv.exe\",\n \"?:\\\\WINDOWS\\\\RemoteAuditService.exe\",\n \"?:\\\\Windows\\\\VeeamVssSupport\\\\VeeamGuestHelper.exe\",\n \"?:\\\\Windows\\\\VeeamLogShipper\\\\VeeamLogShipper.exe\",\n \"?:\\\\Windows\\\\CAInvokerService.exe\",\n \"?:\\\\Windows\\\\System32\\\\upfc.exe\",\n \"?:\\\\Windows\\\\AdminArsenal\\\\PDQ*.exe\",\n \"?:\\\\Windows\\\\System32\\\\vds.exe\",\n \"?:\\\\Windows\\\\Veeam\\\\Backup\\\\VeeamDeploymentSvc.exe\",\n \"?:\\\\Windows\\\\ProPatches\\\\Scheduler\\\\STSchedEx.exe\",\n \"?:\\\\Windows\\\\System32\\\\certsrv.exe\",\n \"?:\\\\Windows\\\\eset-remote-install-service.exe\",\n \"?:\\\\Pella Corporation\\\\Pella Order Management\\\\GPAutoSvc.exe\",\n \"?:\\\\Pella Corporation\\\\OSCToGPAutoService\\\\OSCToGPAutoSvc.exe\",\n \"?:\\\\Pella Corporation\\\\Pella Order Management\\\\GPAutoSvc.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\NwxExeSvc\\\\NwxExeSvc.exe\",\n \"?:\\\\Windows\\\\System32\\\\taskhostex.exe\")\n ] by host.id, process.parent.entity_id\n", + "references": [ + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-scmr/705b624a-13de-43cc-b8a2-99573da3635f" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "aa9a274d-6b53-424d-ac5e-cb8ca4251650", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 108 + }, + "id": "aa9a274d-6b53-424d-ac5e-cb8ca4251650_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_2.json b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_2.json new file mode 100644 index 00000000000..ec09bb6ccb3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_2.json @@ -0,0 +1,236 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel Hash Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel Hash Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:\n - Search for the existence and reputation of the hash in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n - Scope other potentially compromised hosts in your environment by mapping hosts with file operations involving the same hash.\n- Identify the process that created the file.\n - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Enrich the information that you have right now by determining how the file was dropped, where it was downloaded from, etc. This can help you determine if the event is part of an ongoing campaign against the organization.\n- Retrieve the involved file and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - $osquery_0\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - $osquery_1\n - $osquery_2\n - $osquery_3\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "file.hash.*:* or file.pe.imphash:* or process.hash.*:* or process.pe.imphash:* or dll.hash.*:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.hash.*", + "type": "unknown" + }, + { + "ecs": false, + "name": "file.hash.*", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.pe.imphash", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.hash.*", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.pe.imphash", + "type": "keyword" + } + ], + "risk_score": 99, + "rule_id": "aab184d3-72b3-4639-b242-6597c99d8bca", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "file.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "file.pe.imphash", + "type": "mapping", + "value": "threat.indicator.file.pe.imphash" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "process.pe.imphash", + "type": "mapping", + "value": "threat.indicator.file.pe.imphash" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:*) and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 2 + }, + "id": "aab184d3-72b3-4639-b242-6597c99d8bca_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_3.json b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_3.json new file mode 100644 index 00000000000..77a31adec3f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_3.json @@ -0,0 +1,208 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel Hash Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel Hash Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:\n - Search for the existence and reputation of the hash in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n - Scope other potentially compromised hosts in your environment by mapping hosts with file operations involving the same hash.\n- Identify the process that created the file.\n - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Enrich the information that you have right now by determining how the file was dropped, where it was downloaded from, etc. This can help you determine if the event is part of an ongoing campaign against the organization.\n- Retrieve the involved file and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - $osquery_0\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - $osquery_1\n - $osquery_2\n - $osquery_3\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "file.hash.*:* or process.hash.*:* or dll.hash.*:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.hash.*", + "type": "unknown" + }, + { + "ecs": false, + "name": "file.hash.*", + "type": "unknown" + }, + { + "ecs": false, + "name": "process.hash.*", + "type": "unknown" + } + ], + "risk_score": 99, + "rule_id": "aab184d3-72b3-4639-b242-6597c99d8bca", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "file.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:*) and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 3 + }, + "id": "aab184d3-72b3-4639-b242-6597c99d8bca_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_4.json b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_4.json new file mode 100644 index 00000000000..20b9a7062bc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aab184d3-72b3-4639-b242-6597c99d8bca_4.json @@ -0,0 +1,208 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a hash indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains file hashes, such as antivirus alerts, process creation, library load, and file operation events.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel Hash Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel Hash Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a hash indicator from the Threat Intel Filebeat module or an indicator ingested from a threat intelligence integration matches against an event that contains file hashes, such as antivirus alerts, file operation events, etc.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Gain context about the field that matched the local observation. This information can be found in the `threat.indicator.matched.field` field.\n- Investigate the hash , which can be found in the `threat.indicator.matched.atomic` field:\n - Search for the existence and reputation of the hash in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n - Scope other potentially compromised hosts in your environment by mapping hosts with file operations involving the same hash.\n- Identify the process that created the file.\n - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Enrich the information that you have right now by determining how the file was dropped, where it was downloaded from, etc. This can help you determine if the event is part of an ongoing campaign against the organization.\n- Retrieve the involved file and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- Adversaries often use legitimate tools as network administrators, such as `PsExec` or `AdFind`. These tools are often included in indicator lists, which creates the potential for false positives.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "file.hash.*:* or process.hash.*:* or dll.hash.*:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.hash.*", + "type": "unknown" + }, + { + "ecs": false, + "name": "file.hash.*", + "type": "unknown" + }, + { + "ecs": false, + "name": "process.hash.*", + "type": "unknown" + } + ], + "risk_score": 99, + "rule_id": "aab184d3-72b3-4639-b242-6597c99d8bca", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "file.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "file.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "dll.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.md5", + "type": "mapping", + "value": "threat.indicator.file.hash.md5" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha1", + "type": "mapping", + "value": "threat.indicator.file.hash.sha1" + } + ] + }, + { + "entries": [ + { + "field": "process.hash.sha256", + "type": "mapping", + "value": "threat.indicator.file.hash.sha256" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and (threat.indicator.file.hash.*:* or threat.indicator.file.pe.imphash:*) and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 4 + }, + "id": "aab184d3-72b3-4639-b242-6597c99d8bca_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ab75c24b-2502-43a0-bf7c-e60e662c811e_107.json b/packages/security_detection_engine/kibana/security_rule/ab75c24b-2502-43a0-bf7c-e60e662c811e_107.json new file mode 100644 index 00000000000..6cf3b02eb30 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ab75c24b-2502-43a0-bf7c-e60e662c811e_107.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a file that was created by the virtual system process. This may indicate lateral movement via network file shares.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote Execution via File Shares", + "note": "## Triage and analysis\n\n### Investigating Remote Execution via File Shares\n\nAdversaries can use network shares to host tooling to support the compromise of other hosts in the environment. These tools can include discovery utilities, credential dumpers, malware, etc.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Review adjacent login events (e.g., 4624) in the alert timeframe to identify the account used to perform this action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity can happen legitimately. Consider adding exceptions if it is expected and noisy in your environment.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Review the privileges needed to write to the network share and restrict write access as needed.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence with maxspan=1m\n [file where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and process.pid == 4 and file.extension : \"exe\"] by host.id, file.path\n [process where host.os.type == \"windows\" and event.type == \"start\"] by host.id, process.executable\n", + "references": [ + "https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "ab75c24b-2502-43a0-bf7c-e60e662c811e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "ab75c24b-2502-43a0-bf7c-e60e662c811e_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/abae61a8-c560-4dbd-acca-1e1438bff36b_103.json b/packages/security_detection_engine/kibana/security_rule/abae61a8-c560-4dbd-acca-1e1438bff36b_103.json new file mode 100644 index 00000000000..8d6c465c812 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/abae61a8-c560-4dbd-acca-1e1438bff36b_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Looks for anomalous access to the metadata service by an unusual process. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.", + "false_positives": [ + "A newly installed program or one that runs very rarely as part of a monthly or quarterly workflow could trigger this detection rule." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_rare_metadata_process" + ], + "name": "Unusual Windows Process Calling the Metadata Service", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "abae61a8-c560-4dbd-acca-1e1438bff36b", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.005", + "name": "Cloud Instance Metadata API", + "reference": "https://attack.mitre.org/techniques/T1552/005/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "abae61a8-c560-4dbd-acca-1e1438bff36b_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ac412404-57a5-476f-858f-4e8fbb4f48d8_105.json b/packages/security_detection_engine/kibana/security_rule/ac412404-57a5-476f-858f-4e8fbb4f48d8_105.json new file mode 100644 index 00000000000..32168a90e56 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ac412404-57a5-476f-858f-4e8fbb4f48d8_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of the login window property list (plist). Adversaries may modify plist files to run a program during system boot or user login for persistence.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence via Login Hook", + "note": "## Triage and analysis\n\nStarting in Mac OS X 10.7 (Lion), users can specify certain applications to be re-opened when a user reboots their machine. This can be abused to establish or maintain persistence on a compromised system.", + "query": "event.category:file and host.os.type:macos and not event.type:\"deletion\" and\n file.name:\"com.apple.loginwindow.plist\" and\n process.name:(* and not (systemmigrationd or DesktopServicesHelper or diskmanagementd or rsync or launchd or cfprefsd or xpcproxy or ManagedClient or MCXCompositor or backupd or \"iMazing Profile Editor\"\n))\n", + "references": [ + "https://github.com/D00MFist/PersistentJXA/blob/master/LoginScript.js" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ac412404-57a5-476f-858f-4e8fbb4f48d8", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1647", + "name": "Plist File Modification", + "reference": "https://attack.mitre.org/techniques/T1647/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "ac412404-57a5-476f-858f-4e8fbb4f48d8_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ac5012b8-8da8-440b-aaaf-aedafdea2dff_107.json b/packages/security_detection_engine/kibana/security_rule/ac5012b8-8da8-440b-aaaf-aedafdea2dff_107.json new file mode 100644 index 00000000000..52864e0e1f3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ac5012b8-8da8-440b-aaaf-aedafdea2dff_107.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious WerFault child process was detected, which may indicate an attempt to run via the SilentProcessExit registry key manipulation. Verify process details such as command line, network connections and file writes.", + "false_positives": [ + "Custom Windows error reporting debugger or applications restarted by WerFault after a crash." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious WerFault Child Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n\n process.parent.name : \"WerFault.exe\" and \n \n /* args -s and -t used to execute a process via SilentProcessExit mechanism */\n (process.parent.args : \"-s\" and process.parent.args : \"-t\" and process.parent.args : \"-c\") and \n \n not process.executable : (\"?:\\\\Windows\\\\SysWOW64\\\\Initcrypt.exe\", \"?:\\\\Program Files (x86)\\\\Heimdal\\\\Heimdal.Guard.exe\")\n", + "references": [ + "https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/", + "https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/", + "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx", + "https://blog.menasec.net/2021/01/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ac5012b8-8da8-440b-aaaf-aedafdea2dff", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "ac5012b8-8da8-440b-aaaf-aedafdea2dff_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1_106.json b/packages/security_detection_engine/kibana/security_rule/ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1_106.json new file mode 100644 index 00000000000..4c4612e9721 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1_106.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an AWS API command that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.", + "false_positives": [ + "New or unusual user command activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; or changes in the way services are used." + ], + "from": "now-2h", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "rare_method_for_a_username", + "name": "Unusual AWS Command for a User", + "note": "## Triage and analysis\n\n### Investigating Unusual AWS Command for a User\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.\n\nThis rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is being made by a user context that does not normally use the command. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.\n\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the calling IAM user.\n\n#### Possible investigation steps\n\n- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.\n - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.\n - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Investigate other alerts associated with the user account during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, or network administrator activity.\n- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.\n- Considering the source IP address and geolocation of the user who issued the command:\n - Do they look normal for the calling user?\n - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?\n - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?\n- Contact the account owner and confirm whether they are aware of this activity if suspicious.\n- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.\n\n### False positive analysis\n\n- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.\n\n### Related Rules\n\n- Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276\n- Unusual Country For an AWS Command - dca28dee-c999-400f-b640-50a081cc0fd1\n- Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff\n- Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Disable or limit the account during the investigation and response.\n- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:\n - Identify the account role in the cloud environment.\n - Assess the criticality of affected services and servers.\n - Work with your IT team to identify and minimize the impact on users.\n - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.\n - Identify any regulatory or legal ramifications related to this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.\n- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.\n- Consider enabling multi-factor authentication for users.\n- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.\n- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n- Take the actions needed to return affected systems, data, or services to their normal operational levels.\n- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "aws", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1", + "setup": "The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Domain: Cloud", + "Data Source: AWS", + "Data Source: Amazon Web Services", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Resources: Investigation Guide" + ], + "type": "machine_learning", + "version": 106 + }, + "id": "ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ac8805f6-1e08-406c-962e-3937057fa86f_1.json b/packages/security_detection_engine/kibana/security_rule/ac8805f6-1e08-406c-962e-3937057fa86f_1.json new file mode 100644 index 00000000000..8e2181a9cb0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ac8805f6-1e08-406c-962e-3937057fa86f_1.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for common command line flags leveraged by the Chisel server utility followed by a received connection within a timespan of 1 minute. Chisel is a command-line utility used for creating and managing TCP and UDP tunnels, enabling port forwarding and secure communication between machines. Attackers can abuse the Chisel utility to establish covert communication channels, bypass network restrictions, and carry out malicious activities by creating tunnels that allow unauthorized access to internal systems.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Protocol Tunneling via Chisel Server", + "query": "sequence by host.id, process.entity_id with maxspan=1m\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.args == \"server\" and process.args in (\"--port\", \"-p\", \"--reverse\", \"--backend\", \"--socks5\") and \n process.args_count \u003e= 3 and process.parent.name in (\"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")]\n [network where host.os.type == \"linux\" and event.action == \"connection_accepted\" and event.type == \"start\" and \n destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" and \n not process.name : (\n \"python*\", \"php*\", \"perl\", \"ruby\", \"lua*\", \"openssl\", \"nc\", \"netcat\", \"ncat\", \"telnet\", \"awk\", \"java\", \"telnet\",\n \"ftp\", \"socat\", \"curl\", \"wget\", \"dpkg\", \"docker\", \"dockerd\", \"yum\", \"apt\", \"rpm\", \"dnf\", \"ssh\", \"sshd\", \"hugo\")]\n", + "references": [ + "https://blog.bitsadmin.com/living-off-the-foreign-land-windows-as-offensive-platform", + "https://book.hacktricks.xyz/generic-methodologies-and-resources/tunneling-and-port-forwarding" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ac8805f6-1e08-406c-962e-3937057fa86f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1572", + "name": "Protocol Tunneling", + "reference": "https://attack.mitre.org/techniques/T1572/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "ac8805f6-1e08-406c-962e-3937057fa86f_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/acd611f3-2b93-47b3-a0a3-7723bcc46f6d_104.json b/packages/security_detection_engine/kibana/security_rule/acd611f3-2b93-47b3-a0a3-7723bcc46f6d_104.json new file mode 100644 index 00000000000..e0474ca70e8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/acd611f3-2b93-47b3-a0a3-7723bcc46f6d_104.json @@ -0,0 +1,136 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances of Internet Explorer (iexplore.exe) being started via the Component Object Model (COM) making unusual network connections. Adversaries could abuse Internet Explorer via COM to avoid suspicious processes making network connections and bypass host-based firewall restrictions.", + "false_positives": [ + "Processes such as MS Office using IEproxy to render HTML content." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Command and Control via Internet Explorer", + "query": "sequence by host.id, user.name with maxspan = 5s\n [library where host.os.type == \"windows\" and dll.name : \"IEProxy.dll\" and process.name : (\"rundll32.exe\", \"regsvr32.exe\")]\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"iexplore.exe\" and process.parent.args : \"-Embedding\"]\n /* IE started via COM in normal conditions makes few connections, mainly to Microsoft and OCSP related domains, add FPs here */\n [network where host.os.type == \"windows\" and network.protocol == \"dns\" and process.name : \"iexplore.exe\" and\n not dns.question.name :\n (\n \"*.microsoft.com\",\n \"*.digicert.com\",\n \"*.msocsp.com\",\n \"*.windowsupdate.com\",\n \"*.bing.com\",\n \"*.identrust.com\",\n \"*.sharepoint.com\",\n \"*.office365.com\",\n \"*.office.com\"\n )\n ] /* with runs=5 */\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "acd611f3-2b93-47b3-a0a3-7723bcc46f6d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1559", + "name": "Inter-Process Communication", + "reference": "https://attack.mitre.org/techniques/T1559/", + "subtechnique": [ + { + "id": "T1559.001", + "name": "Component Object Model", + "reference": "https://attack.mitre.org/techniques/T1559/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "acd611f3-2b93-47b3-a0a3-7723bcc46f6d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ace1e989-a541-44df-93a8-a8b0591b63c0_105.json b/packages/security_detection_engine/kibana/security_rule/ace1e989-a541-44df-93a8-a8b0591b63c0_105.json new file mode 100644 index 00000000000..0650e445853 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ace1e989-a541-44df-93a8-a8b0591b63c0_105.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a high number (20) of macOS SSH KeyGen process executions from the same host. An adversary may attempt a brute force attack to obtain unauthorized access to user accounts.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential macOS SSH Brute Force Detected", + "query": "event.category:process and host.os.type:macos and event.type:start and process.name:\"sshd-keygen-wrapper\" and process.parent.name:launchd\n", + "references": [ + "https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ace1e989-a541-44df-93a8-a8b0591b63c0", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "threshold": { + "field": [ + "host.id" + ], + "value": 20 + }, + "type": "threshold", + "version": 105 + }, + "id": "ace1e989-a541-44df-93a8-a8b0591b63c0_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/acf738b5-b5b2-4acc-bad9-1e18ee234f40_104.json b/packages/security_detection_engine/kibana/security_rule/acf738b5-b5b2-4acc-bad9-1e18ee234f40_104.json new file mode 100644 index 00000000000..bb5fa9da0e7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/acf738b5-b5b2-4acc-bad9-1e18ee234f40_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious managed code hosting process which could indicate code injection or other form of suspicious code execution.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Managed Code Hosting Process", + "query": "sequence by process.entity_id with maxspan=5m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"wscript.exe\", \"cscript.exe\", \"mshta.exe\", \"wmic.exe\", \"regsvr32.exe\", \"svchost.exe\", \"dllhost.exe\", \"cmstp.exe\")]\n [file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.name : (\"wscript.exe.log\",\n \"cscript.exe\",\n \"mshta.exe.log\",\n \"wmic.exe.log\",\n \"svchost.exe.log\",\n \"dllhost.exe.log\",\n \"cmstp.exe.log\",\n \"regsvr32.exe.log\")]\n", + "references": [ + "https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "acf738b5-b5b2-4acc-bad9-1e18ee234f40", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "acf738b5-b5b2-4acc-bad9-1e18ee234f40_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ad88231f-e2ab-491c-8fc6-64746da26cfe_104.json b/packages/security_detection_engine/kibana/security_rule/ad88231f-e2ab-491c-8fc6-64746da26cfe_104.json new file mode 100644 index 00000000000..400154ffb78 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ad88231f-e2ab-491c-8fc6-64746da26cfe_104.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the Kerberos credential cache (kcc) utility to dump locally cached Kerberos tickets. Adversaries may attempt to dump credential material in the form of tickets that can be leveraged for lateral movement.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Kerberos Cached Credentials Dumping", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:kcc and\n process.args:copy_cred_cache\n", + "references": [ + "https://github.com/EmpireProject/EmPyre/blob/master/lib/modules/collection/osx/kerberosdump.py", + "https://opensource.apple.com/source/Heimdal/Heimdal-323.12/kuser/kcc-commands.in.auto.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "ad88231f-e2ab-491c-8fc6-64746da26cfe", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/", + "subtechnique": [ + { + "id": "T1558.003", + "name": "Kerberoasting", + "reference": "https://attack.mitre.org/techniques/T1558/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "ad88231f-e2ab-491c-8fc6-64746da26cfe_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/adb961e0-cb74-42a0-af9e-29fc41f88f5f_107.json b/packages/security_detection_engine/kibana/security_rule/adb961e0-cb74-42a0-af9e-29fc41f88f5f_107.json new file mode 100644 index 00000000000..9cbe3f6425c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/adb961e0-cb74-42a0-af9e-29fc41f88f5f_107.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A netcat process is engaging in network activity on a Linux host. Netcat is often used as a persistence mechanism by exporting a reverse shell or by serving a shell on a listening port. Netcat is also sometimes used for data exfiltration.", + "false_positives": [ + "Netcat is a dual-use tool that can be used for benign or malicious activity. Netcat is included in some Linux distributions so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "File Transfer or Listener Established via Netcat", + "note": "## Triage and analysis\n\n### Investigating Netcat Network Activity\n\nNetcat is a dual-use command line tool that can be used for various purposes, such as port scanning, file transfers, and connection tests. Attackers can abuse its functionality for malicious purposes such creating bind shells or reverse shells to gain access to the target system.\n\nA reverse shell is a mechanism that's abused to connect back to an attacker-controlled system. It effectively redirects the system's input and output and delivers a fully functional remote shell to the attacker. Even private systems are vulnerable since the connection is outgoing.\n\nA bind shell is a type of backdoor that attackers set up on the target host and binds to a specific port to listen for an incoming connection from the attacker.\n\nThis rule identifies potential reverse shell or bind shell activity using Netcat by checking for the execution of Netcat followed by a network connection.\n\n#### Possible investigation steps\n\n- Examine the command line to identify if the command is suspicious.\n- Extract and examine the target domain or IP address.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - Scope other potentially compromised hosts in your environment by mapping hosts that also communicated with the domain or IP address.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- Netcat is a dual-use tool that can be used for benign or malicious activity. It is included in some Linux distributions, so its presence is not necessarily suspicious. Some normal use of this program, while uncommon, may originate from scripts, automation tools, and frameworks.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Block the identified indicators of compromise (IoCs).\n- Take actions to terminate processes and connections used by the attacker.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"linux\" and event.type == \"start\" and\n process.name:(\"nc\",\"ncat\",\"netcat\",\"netcat.openbsd\",\"netcat.traditional\") and (\n /* bind shell to echo for command execution */\n (process.args:(\"-l\",\"-p\") and process.args:(\"-c\",\"echo\",\"$*\"))\n /* bind shell to specific port */\n or process.args:(\"-l\",\"-p\",\"-lp\")\n /* reverse shell to command-line interpreter used for command execution */\n or (process.args:(\"-e\") and process.args:(\"/bin/bash\",\"/bin/sh\"))\n /* file transfer via stdout */\n or process.args:(\"\u003e\",\"\u003c\")\n /* file transfer via pipe */\n or (process.args:(\"|\") and process.args:(\"nc\",\"ncat\"))\n )]\n [network where host.os.type == \"linux\" and (process.name == \"nc\" or process.name == \"ncat\" or process.name == \"netcat\" or\n process.name == \"netcat.openbsd\" or process.name == \"netcat.traditional\")]\n", + "references": [ + "http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", + "https://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf", + "https://en.wikipedia.org/wiki/Netcat", + "https://www.hackers-arise.com/hacking-fundamentals", + "https://null-byte.wonderhowto.com/how-to/hack-like-pro-use-netcat-swiss-army-knife-hacking-tools-0148657/", + "https://levelup.gitconnected.com/ethical-hacking-part-15-netcat-nc-and-netcat-f6a8f7df43fd" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "adb961e0-cb74-42a0-af9e-29fc41f88f5f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/adbfa3ee-777e-4747-b6b0-7bd645f30880_1.json b/packages/security_detection_engine/kibana/security_rule/adbfa3ee-777e-4747-b6b0-7bd645f30880_1.json new file mode 100644 index 00000000000..0042b5e9675 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/adbfa3ee-777e-4747-b6b0-7bd645f30880_1.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious child processes of communications apps, which can indicate a potential masquerading as the communication app or the exploitation of a vulnerability on the application causing it to execute code.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Communication App Child Process", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n /* Slack */\n (process.parent.name : \"slack.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Zoom\\\\bin\\\\Zoom.exe\",\n \"?:\\\\Windows\\\\System32\\\\rundll32.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Mozilla Firefox\\\\firefox.exe\",\n \"?:\\\\Windows\\\\System32\\\\notepad.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Slack Technologies, Inc.\",\n \"Slack Technologies, LLC\"\n ) and process.code_signature.trusted == true\n ) or\n (\n (process.name : \"powershell.exe\" and process.command_line : \"powershell.exe -c Invoke-WebRequest -Uri https://slackb.com/*\") or\n (process.name : \"cmd.exe\" and process.command_line : \"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /d /s /c \\\"%windir%\\\\System32\\\\rundll32.exe User32.dll,SetFocus 0\\\"\")\n )\n )\n ) or\n\n /* WebEx */\n (process.parent.name : (\"CiscoCollabHost.exe\", \"WebexHost.exe\") and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Cisco Systems, Inc.\",\n \"Cisco WebEx LLC\",\n \"Cisco Systems Inc.\"\n ) and process.code_signature.trusted == true\n )\n )\n ) or\n\n /* Teams */\n (process.parent.name : \"Teams.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Microsoft Corporation\",\n \"Microsoft 3rd Party Application Component\"\n ) and process.code_signature.trusted == true\n ) or\n (\n (process.name : \"taskkill.exe\" and process.args : \"Teams.exe\")\n )\n )\n ) or\n\n /* Discord */\n (process.parent.name : \"Discord.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\reg.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\reg.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Discord Inc.\"\n ) and process.code_signature.trusted == true\n ) or\n (\n process.name : \"cmd.exe\" and process.command_line : (\n \"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /d /s /c \\\"chcp\\\"\",\n \"C:\\\\WINDOWS\\\\system32\\\\cmd.exe /q /d /s /c \\\"C:\\\\Program^ Files\\\\NVIDIA^ Corporation\\\\NVSMI\\\\nvidia-smi.exe\\\"\"\n )\n )\n )\n ) or\n\n /* WhatsApp */\n (process.parent.name : \"Whatsapp.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\reg.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\reg.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"WhatsApp LLC\",\n \"WhatsApp, Inc\",\n \"24803D75-212C-471A-BC57-9EF86AB91435\"\n ) and process.code_signature.trusted == true\n ) or\n (\n (process.name : \"cmd.exe\" and process.command_line : \"C:\\\\Windows\\\\system32\\\\cmd.exe /d /s /c \\\"C:\\\\Windows\\\\system32\\\\wbem\\\\wmic.exe*\")\n )\n )\n ) or\n\n /* Zoom */\n (process.parent.name : \"Zoom.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Zoom Video Communications, Inc.\"\n ) and process.code_signature.trusted == true\n )\n )\n ) or\n\n /* Outlook */\n (process.parent.name : \"outlook.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\Teams\\\\current\\\\Teams.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\NewOutlookInstall\\\\NewOutlookInstaller.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Google\\\\Chrome\\\\Application\\\\chrome.exe\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Zoom\\\\bin\\\\Zoom.exe\",\n \"?:\\\\Windows\\\\System32\\\\IME\\\\SHARED\\\\IMEWDBLD.EXE\",\n \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\prevhost.exe\",\n \"?:\\\\Windows\\\\System32\\\\dwwin.exe\",\n \"?:\\\\Windows\\\\System32\\\\notepad.exe\",\n \"?:\\\\Windows\\\\explorer.exe\"\n ) and process.code_signature.trusted == true \n )\n )\n ) or\n\n /* Thunderbird */\n (process.parent.name : \"thunderbird.exe\" and not\n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\"\n ) and process.code_signature.trusted == true \n ) or\n (\n process.code_signature.subject_name : (\n \"Mozilla Corporation\"\n ) and process.code_signature.trusted == true\n )\n )\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "adbfa3ee-777e-4747-b6b0-7bd645f30880", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + }, + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "adbfa3ee-777e-4747-b6b0-7bd645f30880_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ae8a142c-6a1d-4918-bea7-0b617e99ecfa_3.json b/packages/security_detection_engine/kibana/security_rule/ae8a142c-6a1d-4918-bea7-0b617e99ecfa_3.json new file mode 100644 index 00000000000..653607c8482 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ae8a142c-6a1d-4918-bea7-0b617e99ecfa_3.json @@ -0,0 +1,133 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution of common Microsoft Office applications to launch an Office Add-In from a suspicious path or with an unusual parent process. This may indicate an attempt to get initial access via a malicious phishing MS Office Add-In.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Execution via Microsoft Office Add-Ins", + "query": "process where \n \n host.os.type == \"windows\" and event.type == \"start\" and \n \n process.name : (\"WINWORD.EXE\", \"EXCEL.EXE\", \"POWERPNT.EXE\", \"MSACCESS.EXE\", \"VSTOInstaller.exe\") and \n \n process.args regex~ \"\"\".+\\.(wll|xll|ppa|ppam|xla|xlam|vsto)\"\"\" and \n \n /* Office Add-In from suspicious paths */\n (process.args :\n (\"?:\\\\Users\\\\*\\\\Temp\\\\7z*\",\n \"?:\\\\Users\\\\*\\\\Temp\\\\Rar$*\",\n \"?:\\\\Users\\\\*\\\\Temp\\\\Temp?_*\",\n \"?:\\\\Users\\\\*\\\\Temp\\\\BNZ.*\",\n \"?:\\\\Users\\\\*\\\\Downloads\\\\*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\*\",\n \"?:\\\\Users\\\\Public\\\\*\",\n \"?:\\\\ProgramData\\\\*\",\n \"?:\\\\Windows\\\\Temp\\\\*\",\n \"\\\\Device\\\\*\",\n \"http*\") or\n\t \n process.parent.name : (\"explorer.exe\", \"OpenWith.exe\") or \n \n /* Office Add-In from suspicious parent */\n process.parent.name : (\"cmd.exe\", \"powershell.exe\")) and\n\t \n /* False Positives */\n not (process.args : \"*.vsto\" and\n process.parent.executable :\n (\"?:\\\\Program Files\\\\Logitech\\\\LogiOptions\\\\PlugInInstallerUtility*.exe\",\n \"?:\\\\ProgramData\\\\Logishrd\\\\LogiOptions\\\\Plugins\\\\VSTO\\\\*\\\\VSTOInstaller.exe\",\n \"?:\\\\Program Files\\\\Logitech\\\\LogiOptions\\\\PlugInInstallerUtility.exe\",\n \"?:\\\\Program Files\\\\LogiOptionsPlus\\\\PlugInInstallerUtility*.exe\",\n \"?:\\\\ProgramData\\\\Logishrd\\\\LogiOptionsPlus\\\\Plugins\\\\VSTO\\\\*\\\\VSTOInstaller.exe\",\n \"?:\\\\Program Files\\\\Common Files\\\\microsoft shared\\\\VSTO\\\\*\\\\VSTOInstaller.exe\")) and\n not (process.args : \"/Uninstall\" and process.name : \"VSTOInstaller.exe\") and\n not (process.parent.name : \"rundll32.exe\" and\n process.parent.args : \"?:\\\\WINDOWS\\\\Installer\\\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc\") and\n not (process.name : \"VSTOInstaller.exe\" and process.args : \"https://dl.getsidekick.com/outlook/vsto/Sidekick.vsto\")\n", + "references": [ + "https://github.com/Octoberfest7/XLL_Phishing", + "https://labs.f-secure.com/archive/add-in-opportunities-for-office-persistence/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ae8a142c-6a1d-4918-bea7-0b617e99ecfa", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1137", + "name": "Office Application Startup", + "reference": "https://attack.mitre.org/techniques/T1137/", + "subtechnique": [ + { + "id": "T1137.006", + "name": "Add-ins", + "reference": "https://attack.mitre.org/techniques/T1137/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "ae8a142c-6a1d-4918-bea7-0b617e99ecfa_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_2.json b/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_2.json new file mode 100644 index 00000000000..3ecbb788d44 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_2.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Shared Object Created or Changed by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type:linux and event.action:(creation or file_create_event or file_rename_event or rename) and \nfile.path:(/dev/shm/* or /usr/lib/*) and file.extension:so and \nprocess.name: ( * and not (\"5\" or \"dockerd\" or \"dpkg\" or \"rpm\" or \"snapd\" or \"exe\" or \"yum\" or \"vmis-launcher\"))\n", + "references": [ + "https://threatpost.com/sneaky-malware-backdoors-linux/180158/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "aebaa51f-2a91-4f6a-850b-b601db2293f4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 2 + }, + "id": "aebaa51f-2a91-4f6a-850b-b601db2293f4_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_3.json b/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_3.json new file mode 100644 index 00000000000..d2825a7722f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/aebaa51f-2a91-4f6a-850b-b601db2293f4_3.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors the creation of shared object files by previously unknown processes. The creation of a shared object file involves compiling code into a dynamically linked library that can be loaded by other programs at runtime. While this process is typically used for legitimate purposes, malicious actors can leverage shared object files to execute unauthorized code, inject malicious functionality into legitimate processes, or bypass security controls. This allows malware to persist on the system, evade detection, and potentially compromise the integrity and confidentiality of the affected system and its data.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Shared Object Created or Changed by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type:linux and event.action:(creation or file_create_event or file_rename_event or rename) and \nfile.path:(/dev/shm/* or /usr/lib/*) and file.extension:so and \nprocess.name: ( * and not (\"5\" or \"dockerd\" or \"dpkg\" or \"rpm\" or \"snapd\" or \"exe\" or \"yum\" or \"vmis-launcher\"))\n", + "references": [ + "https://threatpost.com/sneaky-malware-backdoors-linux/180158/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "aebaa51f-2a91-4f6a-850b-b601db2293f4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "aebaa51f-2a91-4f6a-850b-b601db2293f4_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/afa135c0-a365-43ab-aa35-fd86df314a47_1.json b/packages/security_detection_engine/kibana/security_rule/afa135c0-a365-43ab-aa35-fd86df314a47_1.json new file mode 100644 index 00000000000..852204bfe43 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/afa135c0-a365-43ab-aa35-fd86df314a47_1.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for a sequence of 20 \"id\" command executions within 1 second by the same parent process. This behavior is unusual, and may be indicative of the execution of an enumeration script such as LinPEAS or LinEnum. These scripts leverage the \"id\" command to enumerate the privileges of all users present on the system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual User Privilege Enumeration via id", + "query": "sequence by host.id, process.parent.entity_id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"id\" and process.args_count == 2] with runs=20\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "afa135c0-a365-43ab-aa35-fd86df314a47", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "afa135c0-a365-43ab-aa35-fd86df314a47_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/afcce5ad-65de-4ed2-8516-5e093d3ac99a_105.json b/packages/security_detection_engine/kibana/security_rule/afcce5ad-65de-4ed2-8516-5e093d3ac99a_105.json new file mode 100644 index 00000000000..7a8824d653d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/afcce5ad-65de-4ed2-8516-5e093d3ac99a_105.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Indicates the creation of a scheduled task. Adversaries can use these to establish persistence, move laterally, and/or escalate privileges.", + "false_positives": [ + "Legitimate scheduled tasks may be created during installation of new software." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Local Scheduled Task Creation", + "query": "sequence with maxspan=1m\n [process where host.os.type == \"windows\" and event.type != \"end\" and\n ((process.name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") or\n process.pe.original_file_name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"wmic.exe\", \"mshta.exe\",\n \"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\", \"WmiPrvSe.exe\", \"wsmprovhost.exe\",\n \"winrshost.exe\")) or\n process.code_signature.trusted == false)] by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"schtasks.exe\" or process.pe.original_file_name == \"schtasks.exe\") and\n process.args : (\"/create\", \"-create\") and process.args : (\"/RU\", \"/SC\", \"/TN\", \"/TR\", \"/F\", \"/XML\") and\n /* exclude SYSTEM Integrity Level - look for task creations by non-SYSTEM user */\n not (?process.Ext.token.integrity_level_name : \"System\" or ?winlog.event_data.IntegrityLevel : \"System\")\n ] by process.parent.entity_id\n", + "references": [ + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-1", + "https://www.elastic.co/security-labs/hunting-for-persistence-using-elastic-security-part-2" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.IntegrityLevel", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "afcce5ad-65de-4ed2-8516-5e093d3ac99a_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/afd04601-12fc-4149-9b78-9c3f8fe45d39_1.json b/packages/security_detection_engine/kibana/security_rule/afd04601-12fc-4149-9b78-9c3f8fe45d39_1.json new file mode 100644 index 00000000000..fb401f42d77 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/afd04601-12fc-4149-9b78-9c3f8fe45d39_1.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of the cat command, followed by a connection attempt by the same process. Cat is capable of transfering data via tcp/udp channels by redirecting its read output to a /dev/tcp or /dev/udp channel. This activity is highly suspicious, and should be investigated. Attackers may leverage this capability to transfer tools or files to another host in the network or exfiltrate data while attempting to evade detection in the process.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Activity Detected via cat", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"cat\"]\n [network where host.os.type == \"linux\" and event.action in (\"connection_attempted\", \"disconnect_received\") and \n process.name == \"cat\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "afd04601-12fc-4149-9b78-9c3f8fe45d39", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [] + } + ], + "type": "eql", + "version": 1 + }, + "id": "afd04601-12fc-4149-9b78-9c3f8fe45d39_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_1.json b/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_1.json new file mode 100644 index 00000000000..1f983a5d9ae --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_1.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of processes that interact with Linux containers through an interactive shell without root permissions. Utilities such as runc and ctr are universal command-line utilities leveraged to interact with containers via root permissions. On systems where the access to these utilities are misconfigured, attackers might be able to create and run a container that mounts the root folder or spawn a privileged container vulnerable to a container escape attack, which might allow them to escalate privileges and gain further access onto the host file system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via Container Misconfiguration", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and (\n (process.name == \"runc\" and process.args == \"run\") or\n (process.name == \"ctr\" and process.args == \"run\" and process.args in (\"--privileged\", \"--mount\"))\n) and not user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\" and \nprocess.interactive == true and process.parent.interactive == true\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation", + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.interactive", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.interactive", + "type": "boolean" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "afe6b0eb-dd9d-4922-b08a-1910124d524d", + "setup": "This rule leverages `session` fields, which requires that the collection of session data is enabled for Linux operating systems. The following steps should be performed in order to enable session data event collection on a Linux system. ``` Kibana --\u003e Management --\u003e Fleet --\u003e Agent Policies --\u003e Agent Policy with Elastic Defend installed --\u003e Elastic Defend integration --\u003e Enable the \"Collect session data\" box under \"Event Collection\" for \"Linux\" ``` More information on this topic and how to enable session data collection can be found at https://www.elastic.co/blog/secure-your-cloud-with-cloud-workload-protection-in-elastic-security.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Domain: Container" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "afe6b0eb-dd9d-4922-b08a-1910124d524d_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_2.json b/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_2.json new file mode 100644 index 00000000000..48ac1c97698 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/afe6b0eb-dd9d-4922-b08a-1910124d524d_2.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of processes that interact with Linux containers through an interactive shell without root permissions. Utilities such as runc and ctr are universal command-line utilities leveraged to interact with containers via root permissions. On systems where the access to these utilities are misconfigured, attackers might be able to create and run a container that mounts the root folder or spawn a privileged container vulnerable to a container escape attack, which might allow them to escalate privileges and gain further access onto the host file system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via Container Misconfiguration", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and (\n (process.name == \"runc\" and process.args == \"run\") or\n (process.name == \"ctr\" and process.args == \"run\" and process.args in (\"--privileged\", \"--mount\"))\n) and not user.Ext.real.id == \"0\" and not group.Ext.real.id == \"0\" and \nprocess.interactive == true and process.parent.interactive == true\n", + "references": [ + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/runc-privilege-escalation", + "https://book.hacktricks.xyz/linux-hardening/privilege-escalation/containerd-ctr-privilege-escalation" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "group.Ext.real.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.interactive", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.interactive", + "type": "boolean" + }, + { + "ecs": false, + "name": "user.Ext.real.id", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "afe6b0eb-dd9d-4922-b08a-1910124d524d", + "setup": "This rule leverages `session` fields, which requires that the collection of session data is enabled for Linux operating systems. The following steps should be performed in order to enable session data event collection on a Linux system. ``` Kibana --\u003e Management --\u003e Fleet --\u003e Agent Policies --\u003e Agent Policy with Elastic Defend installed --\u003e Elastic Defend integration --\u003e Enable the \"Collect session data\" box under \"Event Collection\" for \"Linux\" ``` More information on this topic and how to enable session data collection can be found at https://www.elastic.co/blog/secure-your-cloud-with-cloud-workload-protection-in-elastic-security.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Domain: Container", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1611", + "name": "Escape to Host", + "reference": "https://attack.mitre.org/techniques/T1611/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "afe6b0eb-dd9d-4922-b08a-1910124d524d_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b0046934-486e-462f-9487-0d4cf9e429c6_103.json b/packages/security_detection_engine/kibana/security_rule/b0046934-486e-462f-9487-0d4cf9e429c6_103.json new file mode 100644 index 00000000000..5744fc36791 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b0046934-486e-462f-9487-0d4cf9e429c6_103.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Timestomping is an anti-forensics technique which is used to modify the timestamps of a file, often to mimic files that are in the same folder.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Timestomping using Touch Command", + "note": "", + "query": "process where event.type == \"start\" and\n process.name : \"touch\" and user.id != \"0\" and\n process.args : (\"-r\", \"-t\", \"-a*\",\"-m*\") and\n not process.args : (\"/usr/lib/go-*/bin/go\", \"/usr/lib/dracut/dracut-functions.sh\", \"/tmp/KSInstallAction.*/m/.patch/*\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b0046934-486e-462f-9487-0d4cf9e429c6", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.006", + "name": "Timestomp", + "reference": "https://attack.mitre.org/techniques/T1070/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "b0046934-486e-462f-9487-0d4cf9e429c6_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b00bcd89-000c-4425-b94c-716ef67762f6_104.json b/packages/security_detection_engine/kibana/security_rule/b00bcd89-000c-4425-b94c-716ef67762f6_104.json new file mode 100644 index 00000000000..f5c78b3662e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b00bcd89-000c-4425-b94c-716ef67762f6_104.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the mount_apfs command to mount the entire file system through Apple File System (APFS) snapshots as read-only and with the noowners flag set. This action enables the adversary to access almost any file in the file system, including all user data and files protected by Apple\u2019s privacy framework (TCC).", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "TCC Bypass via Mounted APFS Snapshot Access", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and process.name:mount_apfs and\n process.args:(/System/Volumes/Data and noowners)\n", + "references": [ + "https://theevilbit.github.io/posts/cve_2020_9771/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b00bcd89-000c-4425-b94c-716ef67762f6", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1006", + "name": "Direct Volume Access", + "reference": "https://attack.mitre.org/techniques/T1006/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "b00bcd89-000c-4425-b94c-716ef67762f6_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b0638186-4f12-48ac-83d2-47e686d08e82_1.json b/packages/security_detection_engine/kibana/security_rule/b0638186-4f12-48ac-83d2-47e686d08e82_1.json new file mode 100644 index 00000000000..1fb22352971 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b0638186-4f12-48ac-83d2-47e686d08e82_1.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the addition of a Netsh Helper DLL, netsh.exe supports the addition of these DLLs to extend its functionality. Attackers may abuse this mechanism to execute malicious payloads every time the utility is executed, which can be done by administrators or a scheduled task.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Netsh Helper DLL", + "query": "registry where event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\Software\\\\Microsoft\\\\netsh\\\\*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\netsh\\\\*\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b0638186-4f12-48ac-83d2-47e686d08e82", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.007", + "name": "Netsh Helper DLL", + "reference": "https://attack.mitre.org/techniques/T1546/007/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "b0638186-4f12-48ac-83d2-47e686d08e82_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b2318c71-5959-469a-a3ce-3a0768e63b9c_1.json b/packages/security_detection_engine/kibana/security_rule/b2318c71-5959-469a-a3ce-3a0768e63b9c_1.json new file mode 100644 index 00000000000..0bb7ce92c6c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b2318c71-5959-469a-a3ce-3a0768e63b9c_1.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may look for folders and drives shared on remote systems to identify sources of information to gather as a precursor for collection and identify potential systems of interest for Lateral Movement.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*", + "logs-system.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Network Share Discovery", + "query": "sequence by user.name, source.port, source.ip with maxspan=15s \n [file where event.action == \"network-share-object-access-checked\" and \n winlog.event_data.ShareName : (\"\\\\*ADMIN$\", \"\\\\*C$\") and \n source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::1\" and source.ip != \"::\" and source.ip != \"127.0.0.1\"]\n [file where event.action == \"network-share-object-access-checked\" and \n winlog.event_data.ShareName : (\"\\\\*ADMIN$\", \"\\\\*C$\") and \n source.ip != null and source.ip != \"0.0.0.0\" and source.ip != \"::1\" and source.ip != \"::\" and source.ip != \"127.0.0.1\"]\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.ShareName", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "b2318c71-5959-469a-a3ce-3a0768e63b9c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1135", + "name": "Network Share Discovery", + "reference": "https://attack.mitre.org/techniques/T1135/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "b2318c71-5959-469a-a3ce-3a0768e63b9c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b240bfb8-26b7-4e5e-924e-218144a3fa71_103.json b/packages/security_detection_engine/kibana/security_rule/b240bfb8-26b7-4e5e-924e-218144a3fa71_103.json new file mode 100644 index 00000000000..f204fd8a039 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b240bfb8-26b7-4e5e-924e-218144a3fa71_103.json @@ -0,0 +1,42 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusually large spike in network traffic. Such a burst of traffic, if not caused by a surge in business activity, can be due to suspicious or malicious activity. Large-scale data exfiltration may produce a burst of network traffic; this could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic.", + "false_positives": [ + "Business workflows that occur very occasionally, and involve an unusual surge in network traffic, can trigger this alert. A new business workflow or a surge in business activity may trigger this alert. A misconfigured network application or firewall may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "high_count_network_events", + "name": "Spike in Network Traffic", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "b240bfb8-26b7-4e5e-924e-218144a3fa71", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "b240bfb8-26b7-4e5e-924e-218144a3fa71_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b25a7df2-120a-4db2-bd3f-3e4b86b24bee_107.json b/packages/security_detection_engine/kibana/security_rule/b25a7df2-120a-4db2-bd3f-3e4b86b24bee_107.json new file mode 100644 index 00000000000..f0d484fabeb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b25a7df2-120a-4db2-bd3f-3e4b86b24bee_107.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an executable or script file remotely downloaded via a TeamViewer transfer session.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Copy via TeamViewer", + "note": "## Triage and analysis\n\n### Investigating Remote File Copy via TeamViewer\n\nAttackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse legitimate utilities to drop these files.\n\nTeamViewer is a remote access and remote control tool used by helpdesks and system administrators to perform various support activities. It is also frequently used by attackers and scammers to deploy malware interactively and other malicious activities. This rule looks for the TeamViewer process creating files with suspicious extensions.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Contact the user to gather information about who and why was conducting the remote access.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check whether the company uses TeamViewer for the support activities and if there is a support ticket related to this access.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the company relies on TeamViewer to conduct remote access and the triage has not identified suspicious or malicious files.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and process.name : \"TeamViewer.exe\" and\n file.extension : (\"exe\", \"dll\", \"scr\", \"com\", \"bat\", \"ps1\", \"vbs\", \"vbe\", \"js\", \"wsh\", \"hta\")\n", + "references": [ + "https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b25a7df2-120a-4db2-bd3f-3e4b86b24bee", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + }, + { + "id": "T1219", + "name": "Remote Access Software", + "reference": "https://attack.mitre.org/techniques/T1219/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "b25a7df2-120a-4db2-bd3f-3e4b86b24bee_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b29ee2be-bf99-446c-ab1a-2dc0183394b8_105.json b/packages/security_detection_engine/kibana/security_rule/b29ee2be-bf99-446c-ab1a-2dc0183394b8_105.json new file mode 100644 index 00000000000..c0c7de418d6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b29ee2be-bf99-446c-ab1a-2dc0183394b8_105.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via Compiled HTML File", + "note": "## Triage and analysis\n\n### Investigating Network Connection via Compiled HTML File\n\nCHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.\n\nWhen users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.\n\nThis rule identifies network connections done by `hh.exe`, which can potentially indicate abuse to download malicious files or tooling, or masquerading.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Examine the command lines for suspicious activities.\n - Retrieve `.chm`, `.ps1`, and other files that were involved for further examination.\n - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.\n- Investigate the target host that the signed binary is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executables, scripts and help files retrieved from the system using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"hh.exe\" and event.type == \"start\"]\n [network where host.os.type == \"windows\" and process.name : \"hh.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.001", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1218/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "b29ee2be-bf99-446c-ab1a-2dc0183394b8_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b347b919-665f-4aac-b9e8-68369bf2340c_103.json b/packages/security_detection_engine/kibana/security_rule/b347b919-665f-4aac-b9e8-68369bf2340c_103.json new file mode 100644 index 00000000000..7e360daecb6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b347b919-665f-4aac-b9e8-68369bf2340c_103.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected activity for a username that is not normally active, which can indicate unauthorized changes, activity by unauthorized users, lateral movement, or compromised credentials. In many organizations, new usernames are not often created apart from specific types of system activities, such as creating new accounts for new employees. These user accounts quickly become active and routine. Events from rarely used usernames can point to suspicious activity. Additionally, automated Linux fleets tend to see activity from rarely used usernames only when personnel log in to make authorized or unauthorized changes, or threat actors have acquired credentials and log in for malicious purposes. Unusual usernames can also indicate pivoting, where compromised credentials are used to try and move laterally from one host to another.", + "false_positives": [ + "Uncommon user activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_anomalous_user_name" + ], + "name": "Unusual Linux Username", + "note": "## Triage and analysis\n\n### Investigating an Unusual Linux User\nDetection alerts from this rule indicate activity for a Linux user name that is rare and unusual. Here are some possible avenues of investigation:\n- Consider the user as identified by the username field. Is this program part of an expected workflow for the user who ran this program on this host? Could this be related to troubleshooting or debugging activity by a developer or site reliability engineer?\n- Examine the history of user activity. If this user only manifested recently, it might be a service account for a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks that the user is performing.", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "b347b919-665f-4aac-b9e8-68369bf2340c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "b347b919-665f-4aac-b9e8-68369bf2340c_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b41a13c6-ba45-4bab-a534-df53d0cfed6a_106.json b/packages/security_detection_engine/kibana/security_rule/b41a13c6-ba45-4bab-a534-df53d0cfed6a_106.json new file mode 100644 index 00000000000..006be6a6576 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b41a13c6-ba45-4bab-a534-df53d0cfed6a_106.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious Endpoint Security parent process was detected. This may indicate a process hollowing or other form of code injection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Endpoint Security Parent Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"esensor.exe\", \"elastic-endpoint.exe\") and\n process.parent.executable != null and\n /* add FPs here */\n not process.parent.executable : (\"C:\\\\Program Files\\\\Elastic\\\\*\",\n \"C:\\\\Windows\\\\System32\\\\services.exe\",\n \"C:\\\\Windows\\\\System32\\\\WerFault*.exe\",\n \"C:\\\\Windows\\\\System32\\\\wermgr.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b41a13c6-ba45-4bab-a534-df53d0cfed6a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "b41a13c6-ba45-4bab-a534-df53d0cfed6a_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b43570de-a908-4f7f-8bdb-b2df6ffd8c80_5.json b/packages/security_detection_engine/kibana/security_rule/b43570de-a908-4f7f-8bdb-b2df6ffd8c80_5.json new file mode 100644 index 00000000000..dd1dd2fdea3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b43570de-a908-4f7f-8bdb-b2df6ffd8c80_5.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to disable/modify the code signing policy through system native utilities. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Code Signing Policy Modification Through Built-in tools", + "note": "## Triage and analysis\n\n### Investigating Code Signing Policy Modification Through Built-in tools\n\nWindows Driver Signature Enforcement (DSE) is a security feature introduced by Microsoft to enforce that only signed drivers can be loaded and executed into the kernel (ring 0). This feature was introduced to prevent attackers from loading their malicious drivers on targets. If the driver has an invalid signature, the system will not allow it to be loaded.\n\nThis protection is essential for maintaining the security of the system. However, attackers or even administrators can disable this feature and load untrusted drivers, as this can put the system at risk. Therefore, it is important to keep this feature enabled and only load drivers from trusted sources to ensure the integrity and security of the system.\n\nThis rule identifies commands that can disable the Driver Signature Enforcement feature.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Use Osquery and endpoint driver events (`event.category = \"driver\"`) to investigate if suspicious drivers were loaded into the system after the command was executed.\n - !{osquery{\"label\":\"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \\\"Microsoft\\\" AND signed == \\\"1\\\")\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Unsigned Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \\\"0\\\"\\n\"}}\n- Identify the driver's `Device Name` and `Service Name`.\n- Check for alerts from the rules specified in the `Related Rules` section.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.\n\n### Related Rules\n\n- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9\n- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa\n- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)\n- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.\n - This can be done via PowerShell `Remove-Service` cmdlet.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Remove and block malicious artifacts identified during triage.\n- Ensure that the Driver Signature Enforcement is enabled on the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name: \"bcdedit.exe\" or process.pe.original_file_name == \"bcdedit.exe\") and process.args: (\"-set\", \"/set\") and \n process.args: (\"TESTSIGNING\", \"nointegritychecks\", \"loadoptions\", \"DISABLE_INTEGRITY_CHECKS\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b43570de-a908-4f7f-8bdb-b2df6ffd8c80", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.006", + "name": "Code Signing Policy Modification", + "reference": "https://attack.mitre.org/techniques/T1553/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "b43570de-a908-4f7f-8bdb-b2df6ffd8c80_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b4449455-f986-4b5a-82ed-e36b129331f7_104.json b/packages/security_detection_engine/kibana/security_rule/b4449455-f986-4b5a-82ed-e36b129331f7_104.json new file mode 100644 index 00000000000..78b251693df --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b4449455-f986-4b5a-82ed-e36b129331f7_104.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to the Atom desktop text editor Init File. Adversaries may add malicious JavaScript code to the init.coffee file that will be executed upon the Atom application opening.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Persistence via Atom Init Script Modification", + "query": "event.category:file and host.os.type:macos and not event.type:\"deletion\" and\n file.path:/Users/*/.atom/init.coffee and not process.name:(Atom or xpcproxy) and not user.name:root\n", + "references": [ + "https://github.com/D00MFist/PersistentJXA/blob/master/AtomPersist.js", + "https://flight-manual.atom.io/hacking-atom/sections/the-init-file/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b4449455-f986-4b5a-82ed-e36b129331f7", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "b4449455-f986-4b5a-82ed-e36b129331f7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b483365c-98a8-40c0-92d8-0458ca25058a_1.json b/packages/security_detection_engine/kibana/security_rule/b483365c-98a8-40c0-92d8-0458ca25058a_1.json new file mode 100644 index 00000000000..a7aedc3c3ff --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b483365c-98a8-40c0-92d8-0458ca25058a_1.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "At.exe Command Lateral Movement", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"at.exe\" and process.args : \"\\\\\\\\*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b483365c-98a8-40c0-92d8-0458ca25058a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "b483365c-98a8-40c0-92d8-0458ca25058a_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9_104.json b/packages/security_detection_engine/kibana/security_rule/b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9_104.json new file mode 100644 index 00000000000..858f057e94a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9_104.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to delete an Okta policy. An adversary may attempt to delete an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to delete an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta policies are regularly deleted in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Delete an Okta Policy", + "note": "## Triage and analysis\n\n### Investigating Attempt to Delete an Okta Policy\n\nOkta policies are critical to managing user access and enforcing security controls within an organization. The deletion of an Okta policy could drastically weaken an organization's security posture by allowing unrestricted access or facilitating other malicious activities.\n\nThis rule detects attempts to delete an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. Adversaries may do this to bypass security barriers and enable further malicious activities.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the deletion attempt.\n- Check the `okta.outcome.result` field to confirm the policy deletion attempt.\n- Check if there are multiple policy deletion attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the policy deletion attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized policy deletion is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific deletion technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.lifecycle.delete\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "b4bb1440-0fcb-4ed1-87e5-b06d58efc5e9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_1.json b/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_1.json new file mode 100644 index 00000000000..165bf688637 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_1.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and CVE-2023-32629) via a flaw in Ubuntu's modifications to OverlayFS. These flaws allow the creation of specialized executables, which, upon execution, grant the ability to escalate privileges to root on the affected machine.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via OverlayFS", + "query": "sequence by process.parent.entity_id, host.id with maxspan=5s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"unshare\" and process.args : (\"-r\", \"-rm\", \"m\") and process.args : \"*cap_setuid*\" and user.id != \"0\"]\n [process where host.os.type == \"linux\" and event.action == \"uid_change\" and event.type == \"change\" and \n user.id == \"0\"]\n", + "references": [ + "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", + "https://twitter.com/liadeliyahu/status/1684841527959273472" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b51dbc92-84e2-4af1-ba47-65183fcd0c57", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "b51dbc92-84e2-4af1-ba47-65183fcd0c57_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_2.json b/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_2.json new file mode 100644 index 00000000000..a772db305f0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b51dbc92-84e2-4af1-ba47-65183fcd0c57_2.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an attempt to exploit a local privilege escalation (CVE-2023-2640 and CVE-2023-32629) via a flaw in Ubuntu's modifications to OverlayFS. These flaws allow the creation of specialized executables, which, upon execution, grant the ability to escalate privileges to root on the affected machine.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via OverlayFS", + "query": "sequence by process.parent.entity_id, host.id with maxspan=5s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"unshare\" and process.args : (\"-r\", \"-rm\", \"m\") and process.args : \"*cap_setuid*\" and user.id != \"0\"]\n [process where host.os.type == \"linux\" and event.action == \"uid_change\" and event.type == \"change\" and \n user.id == \"0\"]\n", + "references": [ + "https://www.wiz.io/blog/ubuntu-overlayfs-vulnerability", + "https://twitter.com/liadeliyahu/status/1684841527959273472" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b51dbc92-84e2-4af1-ba47-65183fcd0c57", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "b51dbc92-84e2-4af1-ba47-65183fcd0c57_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b5877334-677f-4fb9-86d5-a9721274223b_106.json b/packages/security_detection_engine/kibana/security_rule/b5877334-677f-4fb9-86d5-a9721274223b_106.json new file mode 100644 index 00000000000..2762a309d24 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b5877334-677f-4fb9-86d5-a9721274223b_106.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Austin Songer" + ], + "description": "Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Clearing Windows Console History", + "note": "## Triage and analysis\n\n### Investigating Clearing Windows Console History\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can try to cover their tracks by clearing PowerShell console history. PowerShell has two different ways of logging commands: the built-in history and the command history managed by the PSReadLine module. This rule looks for the execution of commands that can clear the built-in PowerShell logs or delete the `ConsoleHost_history.txt` file.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n - Verify if any other anti-forensics behaviors were observed.\n- Investigate the PowerShell logs on the SIEM to determine if there was suspicious behavior that an attacker may be trying to cover up.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n - Ensure that PowerShell auditing policies and log collection are in place to grant future visibility.", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name == \"PowerShell.EXE\") and\n (process.args : \"*Clear-History*\" or\n (process.args : (\"*Remove-Item*\", \"rm\") and process.args : (\"*ConsoleHost_history.txt*\", \"*(Get-PSReadlineOption).HistorySavePath*\")) or\n (process.args : \"*Set-PSReadlineOption*\" and process.args : \"*SaveNothing*\"))\n", + "references": [ + "https://stefanos.cloud/kb/how-to-clear-the-powershell-command-history/", + "https://www.shellhacks.com/clear-history-powershell/", + "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b5877334-677f-4fb9-86d5-a9721274223b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.003", + "name": "Clear Command History", + "reference": "https://attack.mitre.org/techniques/T1070/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "b5877334-677f-4fb9-86d5-a9721274223b_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b5ea4bfe-a1b2-421f-9d47-22a75a6f2921_107.json b/packages/security_detection_engine/kibana/security_rule/b5ea4bfe-a1b2-421f-9d47-22a75a6f2921_107.json new file mode 100644 index 00000000000..e349886f20a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b5ea4bfe-a1b2-421f-9d47-22a75a6f2921_107.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of vssadmin.exe for shadow copy deletion or resizing on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Volume Shadow Copy Deleted or Resized via VssAdmin", + "note": "## Triage and analysis\n\n### Investigating Volume Shadow Copy Deleted or Resized via VssAdmin\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.\n\nThis rule monitors the execution of Vssadmin.exe to either delete or resize shadow copies.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule may produce benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\"\n and (process.name : \"vssadmin.exe\" or process.pe.original_file_name == \"VSSADMIN.EXE\") and\n process.args in (\"delete\", \"resize\") and process.args : \"shadows*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "b5ea4bfe-a1b2-421f-9d47-22a75a6f2921_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_103.json b/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_103.json new file mode 100644 index 00000000000..d9579f35117 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_103.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Elastic Agent Service Terminated", + "note": "", + "query": "process where\n/* net, sc or wmic stopping or deleting Elastic Agent on Windows */\n(event.type == \"start\" and\n process.name : (\"net.exe\", \"sc.exe\", \"wmic.exe\",\"powershell.exe\",\"taskkill.exe\",\"PsKill.exe\",\"ProcessHacker.exe\") and\n process.args : (\"stopservice\",\"uninstall\", \"stop\", \"disabled\",\"Stop-Process\",\"terminate\",\"suspend\") and\n process.args : (\"elasticendpoint\", \"Elastic Agent\",\"elastic-agent\",\"elastic-endpoint\"))\nor\n/* service or systemctl used to stop Elastic Agent on Linux */\n(event.type == \"end\" and\n (process.name : (\"systemctl\", \"service\") and\n process.args : \"elastic-agent\" and\n process.args : \"stop\")\n or\n /* pkill , killall used to stop Elastic Agent on Linux */\n ( event.type == \"end\" and process.name : (\"pkill\", \"killall\") and process.args: \"elastic-agent\")\n or\n /* Unload Elastic Agent extension on MacOS */\n (process.name : \"kextunload\" and\n process.args : \"com.apple.iokit.EndpointSecurity\" and\n event.action : \"end\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b627cd12-dac4-11ec-9582-f661ea17fbcd", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: Windows", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "b627cd12-dac4-11ec-9582-f661ea17fbcd_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_104.json b/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_104.json new file mode 100644 index 00000000000..82fd0707809 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b627cd12-dac4-11ec-9582-f661ea17fbcd_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the Elastic endpoint agent has stopped and is no longer running on the host. Adversaries may attempt to disable security monitoring tools in an attempt to evade detection or prevention capabilities during an intrusion. This may also indicate an issue with the agent itself and should be addressed to ensure defensive measures are back in a stable state.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Elastic Agent Service Terminated", + "note": "", + "query": "process where\n/* net, sc or wmic stopping or deleting Elastic Agent on Windows */\n(event.type == \"start\" and\n process.name : (\"net.exe\", \"sc.exe\", \"wmic.exe\",\"powershell.exe\",\"taskkill.exe\",\"PsKill.exe\",\"ProcessHacker.exe\") and\n process.args : (\"stopservice\",\"uninstall\", \"stop\", \"disabled\",\"Stop-Process\",\"terminate\",\"suspend\") and\n process.args : (\"elasticendpoint\", \"Elastic Agent\",\"elastic-agent\",\"elastic-endpoint\"))\nor\n/* service or systemctl used to stop Elastic Agent on Linux */\n(event.type == \"end\" and\n (process.name : (\"systemctl\", \"service\") and\n process.args : \"elastic-agent\" and\n process.args : \"stop\")\n or\n /* pkill , killall used to stop Elastic Agent on Linux */\n ( event.type == \"end\" and process.name : (\"pkill\", \"killall\") and process.args: \"elastic-agent\")\n or\n /* Unload Elastic Agent extension on MacOS */\n (process.name : \"kextunload\" and\n process.args : \"com.apple.iokit.EndpointSecurity\" and\n event.action : \"end\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b627cd12-dac4-11ec-9582-f661ea17fbcd", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: Windows", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "b627cd12-dac4-11ec-9582-f661ea17fbcd_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b64b183e-1a76-422d-9179-7b389513e74d_106.json b/packages/security_detection_engine/kibana/security_rule/b64b183e-1a76-422d-9179-7b389513e74d_106.json new file mode 100644 index 00000000000..821bccaad1e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b64b183e-1a76-422d-9179-7b389513e74d_106.json @@ -0,0 +1,146 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process via Windows Management Instrumentation (WMI). This may be indicative of malicious activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Script Interpreter Executing Process via WMI", + "query": "sequence by host.id with maxspan = 5s\n [any where host.os.type == \"windows\" and \n (event.category : (\"library\", \"driver\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (dll.name : \"wmiutils.dll\" or file.name : \"wmiutils.dll\") and process.name : (\"wscript.exe\", \"cscript.exe\")]\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"wmiprvse.exe\" and\n user.domain != \"NT AUTHORITY\" and\n (process.pe.original_file_name :\n (\n \"cscript.exe\",\n \"wscript.exe\",\n \"PowerShell.EXE\",\n \"Cmd.Exe\",\n \"MSHTA.EXE\",\n \"RUNDLL32.EXE\",\n \"REGSVR32.EXE\",\n \"MSBuild.exe\",\n \"InstallUtil.exe\",\n \"RegAsm.exe\",\n \"RegSvcs.exe\",\n \"msxsl.exe\",\n \"CONTROL.EXE\",\n \"EXPLORER.EXE\",\n \"Microsoft.Workflow.Compiler.exe\",\n \"msiexec.exe\"\n ) or\n process.executable : (\"C:\\\\Users\\\\*.exe\", \"C:\\\\ProgramData\\\\*.exe\")\n )\n ]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b64b183e-1a76-422d-9179-7b389513e74d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "b64b183e-1a76-422d-9179-7b389513e74d_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b719a170-3bdb-4141-b0e3-13e3cf627bfe_104.json b/packages/security_detection_engine/kibana/security_rule/b719a170-3bdb-4141-b0e3-13e3cf627bfe_104.json new file mode 100644 index 00000000000..35e6abf1a94 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b719a170-3bdb-4141-b0e3-13e3cf627bfe_104.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate an Okta policy. An adversary may attempt to deactivate an Okta policy in order to weaken an organization's security controls. For example, an adversary may attempt to deactivate an Okta multi-factor authentication (MFA) policy in order to weaken the authentication requirements for user accounts.", + "false_positives": [ + "If the behavior of deactivating Okta policies is expected, consider adding exceptions to this rule to filter false positives." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate an Okta Policy", + "note": "## Triage and analysis\n\n### Investigating Attempt to Deactivate an Okta Policy\n\nOkta policies define rules to manage user access to resources. Policies such as multi-factor authentication (MFA) are critical for enforcing strong security measures. Deactivation of an Okta policy could potentially weaken the security posture, allowing for unauthorized access or facilitating other malicious activities.\n\nThis rule is designed to detect attempts to deactivate an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. For example, disabling an MFA policy could lower the security of user authentication processes.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.\n- Check the `okta.outcome.result` field to confirm the policy deactivation attempt.\n- Check if there are multiple policy deactivation attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the policy deactivation attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized policy deactivation is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.lifecycle.deactivate\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b719a170-3bdb-4141-b0e3-13e3cf627bfe", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "b719a170-3bdb-4141-b0e3-13e3cf627bfe_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_1.json b/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_1.json new file mode 100644 index 00000000000..8074936b3f7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_1.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Enrich process events with uname and other command lines that imply Linux system information discovery.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Linux System Information Discovery", + "query": "process where event.type == \"start\" and\n(\n process.name: \"uname\" or\n (process.name: (\"cat\", \"more\", \"less\") and\n process.args: (\"*issue*\", \"*version*\", \"*profile*\", \"*services*\", \"*cpuinfo*\"))\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b81bd314-db5b-4d97-82e8-88e3e5fc9de5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "b81bd314-db5b-4d97-82e8-88e3e5fc9de5_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_2.json b/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_2.json new file mode 100644 index 00000000000..1dcf2d2702e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b81bd314-db5b-4d97-82e8-88e3e5fc9de5_2.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Enrich process events with uname and other command lines that imply Linux system information discovery.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Linux System Information Discovery", + "query": "process where event.type == \"start\" and\n(\n process.name: \"uname\" or\n (process.name: (\"cat\", \"more\", \"less\") and\n process.args: (\"*issue*\", \"*version*\", \"*profile*\", \"*services*\", \"*cpuinfo*\"))\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b81bd314-db5b-4d97-82e8-88e3e5fc9de5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "b81bd314-db5b-4d97-82e8-88e3e5fc9de5_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b8386923-b02c-4b94-986a-d223d9b01f88_4.json b/packages/security_detection_engine/kibana/security_rule/b8386923-b02c-4b94-986a-d223d9b01f88_4.json new file mode 100644 index 00000000000..d5f03e41ce2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b8386923-b02c-4b94-986a-d223d9b01f88_4.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects PowerShell scripts that contain the default exported functions used on Invoke-NinjaCopy. Attackers can use Invoke-NinjaCopy to read SYSTEM files that are normally locked, such as the NTDS.dit file or registry hives.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Invoke-NinjaCopy script", + "note": "## Triage and analysis\n\n### Investigating PowerShell Invoke-NinjaCopy script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.\n\nInvoke-NinjaCopy is a PowerShell script capable of reading SYSTEM files that were normally locked, such as `NTDS.dit` or sensitive registry locations. It does so by using the direct volume access technique, which enables attackers to bypass access control mechanisms and file system monitoring by reading the raw data directly from the disk and extracting the file by parsing the file system structures.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Determine whether the script stores the captured data locally.\n- Check if the imported function was executed and which file it targeted.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"StealthReadFile\" or\n \"StealthReadFileAddr\" or\n \"StealthCloseFileDelegate\" or\n \"StealthOpenFile\" or\n \"StealthCloseFile\" or\n \"StealthReadFile\" or\n \"Invoke-NinjaCopy\"\n )\n and not user.id : \"S-1-5-18\"\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n", + "references": [ + "https://github.com/BC-SECURITY/Empire/blob/main/empire/server/data/module_source/collection/Invoke-NinjaCopy.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b8386923-b02c-4b94-986a-d223d9b01f88", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: PowerShell Logs", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.002", + "name": "Security Account Manager", + "reference": "https://attack.mitre.org/techniques/T1003/002/" + }, + { + "id": "T1003.003", + "name": "NTDS", + "reference": "https://attack.mitre.org/techniques/T1003/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1006", + "name": "Direct Volume Access", + "reference": "https://attack.mitre.org/techniques/T1006/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 4 + }, + "id": "b8386923-b02c-4b94-986a-d223d9b01f88_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b83a7e96-2eb3-4edf-8346-427b6858d3bd_105.json b/packages/security_detection_engine/kibana/security_rule/b83a7e96-2eb3-4edf-8346-427b6858d3bd_105.json new file mode 100644 index 00000000000..04d692d29d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b83a7e96-2eb3-4edf-8346-427b6858d3bd_105.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of Domain Backup private keys. Adversaries may extract the Data Protection API (DPAPI) domain backup key from a Domain Controller (DC) to be able to decrypt any domain user master key file.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation or Modification of Domain Backup DPAPI private key", + "note": "## Triage and analysis\n\nDomain DPAPI Backup keys are stored on domain controllers and can be dumped remotely with tools such as Mimikatz. The resulting .pvk private key can be used to decrypt ANY domain user masterkeys, which then can be used to decrypt any secrets protected by those keys.", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and file.name : (\"ntds_capi_*.pfx\", \"ntds_capi_*.pvk\")\n", + "references": [ + "https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/", + "https://posts.specterops.io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b83a7e96-2eb3-4edf-8346-427b6858d3bd", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.004", + "name": "Private Keys", + "reference": "https://attack.mitre.org/techniques/T1552/004/" + } + ] + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "b83a7e96-2eb3-4edf-8346-427b6858d3bd_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b86afe07-0d98-4738-b15d-8d7465f95ff5_104.json b/packages/security_detection_engine/kibana/security_rule/b86afe07-0d98-4738-b15d-8d7465f95ff5_104.json new file mode 100644 index 00000000000..594e1d21d13 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b86afe07-0d98-4738-b15d-8d7465f95ff5_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies msxsl.exe making a network connection. This may indicate adversarial activity as msxsl.exe is often leveraged by adversaries to execute malicious scripts and evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via MsXsl", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and process.name : \"msxsl.exe\" and event.type == \"start\"]\n [network where host.os.type == \"windows\" and process.name : \"msxsl.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b86afe07-0d98-4738-b15d-8d7465f95ff5", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1220", + "name": "XSL Script Processing", + "reference": "https://attack.mitre.org/techniques/T1220/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "b86afe07-0d98-4738-b15d-8d7465f95ff5_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b8f8da2d-a9dc-48c0-90e4-955c0aa1259a_1.json b/packages/security_detection_engine/kibana/security_rule/b8f8da2d-a9dc-48c0-90e4-955c0aa1259a_1.json new file mode 100644 index 00000000000..24c553a5d41 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b8f8da2d-a9dc-48c0-90e4-955c0aa1259a_1.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the creation of .kirbi files. The creation of this kind of file is an indicator of an attacker running Kerberos ticket dump utilities, such as Mimikatz, and precedes attacks such as Pass-The-Ticket (PTT), which allows the attacker to impersonate users using Kerberos tickets.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Kirbi File Creation", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and file.extension : \"kirbi\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b8f8da2d-a9dc-48c0-90e4-955c0aa1259a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "b8f8da2d-a9dc-48c0-90e4-955c0aa1259a_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b90cdde7-7e0d-4359-8bf0-2c112ce2008a_105.json b/packages/security_detection_engine/kibana/security_rule/b90cdde7-7e0d-4359-8bf0-2c112ce2008a_105.json new file mode 100644 index 00000000000..176f2e719dd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b90cdde7-7e0d-4359-8bf0-2c112ce2008a_105.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to bypass User Account Control (UAC) by abusing an elevated COM Interface to launch a rogue Windows ClipUp program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"Clipup.exe\" and\n not process.executable : \"C:\\\\Windows\\\\System32\\\\ClipUp.exe\" and process.parent.name : \"dllhost.exe\" and\n /* CLSID of the Elevated COM Interface IEditionUpgradeManager */\n process.parent.args : \"/Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}\"\n", + "references": [ + "https://github.com/hfiref0x/UACME" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "b90cdde7-7e0d-4359-8bf0-2c112ce2008a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "b90cdde7-7e0d-4359-8bf0-2c112ce2008a_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_105.json b/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_105.json new file mode 100644 index 00000000000..770d9985167 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_105.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Chkconfig Service Add", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n( \n (process.executable : \"/usr/sbin/chkconfig\" and process.args : \"--add\") or\n (process.args : \"*chkconfig\" and process.args : \"--add\")\n)\n", + "references": [ + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b910f25a-2d44-47f2-a873-aabdc0d355e6", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Lightning Framework", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "b910f25a-2d44-47f2-a873-aabdc0d355e6_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_106.json b/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_106.json new file mode 100644 index 00000000000..aa070217ad7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b910f25a-2d44-47f2-a873-aabdc0d355e6_106.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of the chkconfig binary to manually add a service for management by chkconfig. Threat actors may utilize this technique to maintain persistence on a system. When a new service is added, chkconfig ensures that the service has either a start or a kill entry in every runlevel and when the system is rebooted the service file added will run providing long-term persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Chkconfig Service Add", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n( \n (process.executable : \"/usr/sbin/chkconfig\" and process.args : \"--add\") or\n (process.args : \"*chkconfig\" and process.args : \"--add\")\n)\n", + "references": [ + "https://www.intezer.com/blog/research/lightning-framework-new-linux-threat/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b910f25a-2d44-47f2-a873-aabdc0d355e6", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Lightning Framework", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/", + "subtechnique": [ + { + "id": "T1037.004", + "name": "RC Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "b910f25a-2d44-47f2-a873-aabdc0d355e6_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b92d5eae-70bb-4b66-be27-f98ba9d0ccdc_1.json b/packages/security_detection_engine/kibana/security_rule/b92d5eae-70bb-4b66-be27-f98ba9d0ccdc_1.json new file mode 100644 index 00000000000..71e40cf41d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b92d5eae-70bb-4b66-be27-f98ba9d0ccdc_1.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the execution of Linux built-in commands related to account or group enumeration. Adversaries may use account and group information to orient themselves before deciding how to act.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Discovery of Domain Groups", + "query": "process where event.type : (\"start\", \"process_started\") and host.os.type == \"linux\" and\n ( process.name : (\"ldapsearch\", \"dscacheutil\") or\n (process.name : \"dscl\" and process.args : \"*-list*\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "b92d5eae-70bb-4b66-be27-f98ba9d0ccdc", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "b92d5eae-70bb-4b66-be27-f98ba9d0ccdc_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b9666521-4742-49ce-9ddc-b8e84c35acae_104.json b/packages/security_detection_engine/kibana/security_rule/b9666521-4742-49ce-9ddc-b8e84c35acae_104.json new file mode 100644 index 00000000000..59d1f69d514 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b9666521-4742-49ce-9ddc-b8e84c35acae_104.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Users can mark specific files as hidden simply by putting a \".\" as the first character in the file or folder name. Adversaries can use this to their advantage to hide files and folders on the system for persistence and defense evasion. This rule looks for hidden files or folders in common writable directories.", + "false_positives": [ + "Certain tools may create hidden temporary files or directories upon installation or as part of their normal behavior. These events can be filtered by the process arguments, username, or process name values." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Creation of Hidden Files and Directories via CommandLine", + "note": "", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nprocess.working_directory in (\"/tmp\", \"/var/tmp\", \"/dev/shm\") and\nprocess.args regex~ \"\"\"\\.[a-z0-9_\\-][a-z0-9_\\-\\.]{1,254}\"\"\" and\nnot process.name in (\"ls\", \"find\", \"grep\", \"git\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.working_directory", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b9666521-4742-49ce-9ddc-b8e84c35acae", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/", + "subtechnique": [ + { + "id": "T1564.001", + "name": "Hidden Files and Directories", + "reference": "https://attack.mitre.org/techniques/T1564/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "b9666521-4742-49ce-9ddc-b8e84c35acae_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/b9960fef-82c6-4816-befa-44745030e917_105.json b/packages/security_detection_engine/kibana/security_rule/b9960fef-82c6-4816-befa-44745030e917_105.json new file mode 100644 index 00000000000..2c396bde06b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/b9960fef-82c6-4816-befa-44745030e917_105.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a SolarWinds binary modifying the start type of a service to be disabled. An adversary may abuse this technique to manipulate relevant security services.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "SolarWinds Process Disabling Services via Registry", + "note": "", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\Start\"\n ) and\n registry.data.strings : (\"4\", \"0x00000004\") and\n process.name : (\n \"SolarWinds.BusinessLayerHost*.exe\",\n \"ConfigurationWizard*.exe\",\n \"NetflowDatabaseMaintenance*.exe\",\n \"NetFlowService*.exe\",\n \"SolarWinds.Administration*.exe\",\n \"SolarWinds.Collector.Service*.exe\",\n \"SolarwindsDiagnostics*.exe\")\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "b9960fef-82c6-4816-befa-44745030e917", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1195", + "name": "Supply Chain Compromise", + "reference": "https://attack.mitre.org/techniques/T1195/", + "subtechnique": [ + { + "id": "T1195.002", + "name": "Compromise Software Supply Chain", + "reference": "https://attack.mitre.org/techniques/T1195/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "b9960fef-82c6-4816-befa-44745030e917_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ba342eb2-583c-439f-b04d-1fdd7c1417cc_103.json b/packages/security_detection_engine/kibana/security_rule/ba342eb2-583c-439f-b04d-1fdd7c1417cc_103.json new file mode 100644 index 00000000000..299b26c02b5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ba342eb2-583c-439f-b04d-1fdd7c1417cc_103.json @@ -0,0 +1,47 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Identifies Windows processes that do not usually use the network but have unexpected network activity, which can indicate command-and-control, lateral movement, persistence, or data exfiltration activity. A process with unusual network activity can denote process exploitation or injection, where the process is used to run persistence mechanisms that allow a malicious actor remote access or control of the host, data exfiltration, and execution of unauthorized network applications.", + "false_positives": [ + "A newly installed program or one that rarely uses the network could trigger this alert." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_anomalous_network_activity" + ], + "name": "Unusual Windows Network Activity", + "note": "## Triage and analysis\n\n### Investigating Unusual Network Activity\nDetection alerts from this rule indicate the presence of network activity from a Windows process for which network activity is very unusual. Here are some possible avenues of investigation:\n- Consider the IP addresses, protocol and ports. Are these used by normal but infrequent network workflows? Are they expected or unexpected?\n- If the destination IP address is remote or external, does it associate with an expected domain, organization or geography? Note: avoid interacting directly with suspected malicious IP addresses.\n- Consider the user as identified by the username field. Is this network activity part of an expected workflow for the user who ran the program?\n- Examine the history of execution. If this process only manifested recently, it might be part of a new software package. If it has a consistent cadence (for example if it runs monthly or quarterly), it might be part of a monthly or quarterly business process.\n- Examine the process arguments, title and working directory. These may provide indications as to the source of the program or the nature of the tasks it is performing.\n- Consider the same for the parent process. If the parent process is a legitimate system utility or service, this could be related to software updates or system management. If the parent process is something user-facing like an Office application, this process could be more suspicious.\n- If you have file hash values in the event data, and you suspect malware, you can optionally run a search for the file hash to see if the file is identified as malware by anti-malware tools.", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "ba342eb2-583c-439f-b04d-1fdd7c1417cc_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/baa5d22c-5e1c-4f33-bfc9-efa73bb53022_104.json b/packages/security_detection_engine/kibana/security_rule/baa5d22c-5e1c-4f33-bfc9-efa73bb53022_104.json new file mode 100644 index 00000000000..460ae4744f3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/baa5d22c-5e1c-4f33-bfc9-efa73bb53022_104.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious image load (taskschd.dll) from Microsoft Office processes. This behavior may indicate adversarial activity where a scheduled task is configured via Windows Component Object Model (COM). This technique can be used to configure persistence and evade monitoring by avoiding the usage of the traditional Windows binary (schtasks.exe) used to manage scheduled tasks.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Image Load (taskschd.dll) from MS Office", + "note": "", + "query": "any where host.os.type == \"windows\" and\n (event.category : (\"library\", \"driver\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n process.name : (\"WINWORD.EXE\", \"EXCEL.EXE\", \"POWERPNT.EXE\", \"MSPUB.EXE\", \"MSACCESS.EXE\") and\n (dll.name : \"taskschd.dll\" or file.name : \"taskschd.dll\")\n", + "references": [ + "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", + "https://www.clearskysec.com/wp-content/uploads/2020/10/Operation-Quicksand.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "baa5d22c-5e1c-4f33-bfc9-efa73bb53022", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "baa5d22c-5e1c-4f33-bfc9-efa73bb53022_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_1.json b/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_1.json new file mode 100644 index 00000000000..6e03868fbb4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_1.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential SYN-Based Network Scan Detected", + "query": "destination.port :* and network.packets \u003c= 2\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "network.packets", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "bbaa96b9-f36c-4898-ace2-581acb00a409", + "severity": "medium", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.port", + "value": 10 + } + ], + "field": [ + "destination.ip", + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 1 + }, + "id": "bbaa96b9-f36c-4898-ace2-581acb00a409_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_2.json b/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_2.json new file mode 100644 index 00000000000..2b9f7ca64c6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bbaa96b9-f36c-4898-ace2-581acb00a409_2.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule proposes threshold logic to check for connection attempts from one source host to 10 or more destination ports using 2 or less packets per port.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.network-*", + "logs-network_traffic.*", + "packetbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential SYN-Based Network Scan Detected", + "query": "destination.port : * and network.packets \u003c= 2 and source.ip : (10.0.0.0/8 or 172.16.0.0/12 or 192.168.0.0/16)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "network.packets", + "type": "long" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 21, + "rule_id": "bbaa96b9-f36c-4898-ace2-581acb00a409", + "severity": "low", + "tags": [ + "Domain: Network", + "Tactic: Discovery", + "Tactic: Reconnaissance", + "Use Case: Network Security Monitoring" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1046", + "name": "Network Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1046/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0043", + "name": "Reconnaissance", + "reference": "https://attack.mitre.org/tactics/TA0043/" + }, + "technique": [ + { + "id": "T1595", + "name": "Active Scanning", + "reference": "https://attack.mitre.org/techniques/T1595/", + "subtechnique": [ + { + "id": "T1595.001", + "name": "Scanning IP Blocks", + "reference": "https://attack.mitre.org/techniques/T1595/001/" + } + ] + } + ] + } + ], + "threshold": { + "cardinality": [ + { + "field": "destination.port", + "value": 250 + } + ], + "field": [ + "destination.ip", + "source.ip" + ], + "value": 1 + }, + "type": "threshold", + "version": 2 + }, + "id": "bbaa96b9-f36c-4898-ace2-581acb00a409_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bc1eeacf-2972-434f-b782-3a532b100d67_104.json b/packages/security_detection_engine/kibana/security_rule/bc1eeacf-2972-434f-b782-3a532b100d67_104.json new file mode 100644 index 00000000000..d3d50cef82f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bc1eeacf-2972-434f-b782-3a532b100d67_104.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to their command and control servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.", + "false_positives": [ + "Certain applications may install root certificates for the purpose of inspecting SSL traffic." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Install Root Certificate", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:security and process.args:\"add-trusted-cert\" and\n not process.parent.executable:(\"/Library/Bitdefender/AVP/product/bin/BDCoreIssues\" or \"/Applications/Bitdefender/SecurityNetworkInstallerApp.app/Contents/MacOS/SecurityNetworkInstallerApp\"\n)\n", + "references": [ + "https://ss64.com/osx/security-cert.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "bc1eeacf-2972-434f-b782-3a532b100d67", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.004", + "name": "Install Root Certificate", + "reference": "https://attack.mitre.org/techniques/T1553/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "bc1eeacf-2972-434f-b782-3a532b100d67_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9_4.json b/packages/security_detection_engine/kibana/security_rule/bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9_4.json new file mode 100644 index 00000000000..3fc5be541c6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9_4.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data.", + "false_positives": [ + "SSH over ports apart from the traditional port 22 is highly uncommon. This rule alerts the usage of the such uncommon ports by the ssh service. Tuning is needed to have higher confidence. If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination whitelisted ports for such legitimate ssh activities." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Non-Standard Port SSH connection", + "query": "sequence by process.entity_id with maxspan=1m\n[process where event.action == \"exec\" and process.name:\"ssh\"]\n[network where process.name:\"ssh\"\n and event.action in (\"connection_attempted\", \"connection_accepted\")\n and destination.port != 22\n and destination.ip != \"127.0.0.1\"\n and network.transport: \"tcp\"\n]\n", + "references": [ + "https://attack.mitre.org/techniques/T1571/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "OS: macOS", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1571", + "name": "Non-Standard Port", + "reference": "https://attack.mitre.org/techniques/T1571/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "bc8ca7e0-92fd-4b7c-b11e-ee0266b8d9c9_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bc9e4f5a-e263-4213-a2ac-1edf9b417ada_1.json b/packages/security_detection_engine/kibana/security_rule/bc9e4f5a-e263-4213-a2ac-1edf9b417ada_1.json new file mode 100644 index 00000000000..e68cccf05f3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bc9e4f5a-e263-4213-a2ac-1edf9b417ada_1.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the change of permissions/ownership of files/folders through built-in Windows utilities. Threat actors may require permission modification of files/folders to change, modify or delete them.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "File and Directory Permissions Modification", + "query": "process where event.type == \"start\" and host.os.type == \"windows\" and\n(\n ((process.name: \"icacls.exe\" or process.pe.original_file_name == \"iCACLS.EXE\") and process.args: (\"*:F\", \"/reset\", \"/setowner\", \"*grant*\")) or\n ((process.name: \"cacls.exe\" or process.pe.original_file_name == \"CACLS.EXE\") and process.args: (\"/g\", \"*:f\")) or\n ((process.name: \"takeown.exe\" or process.pe.original_file_name == \"takeown.exe\") and process.args: (\"/F\")) or\n ((process.name: \"attrib.exe\" or process.pe.original_file_name== \"ATTRIB.EXE\") and process.args: \"-r\")\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "bc9e4f5a-e263-4213-a2ac-1edf9b417ada", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/", + "subtechnique": [ + { + "id": "T1222.001", + "name": "Windows File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "bc9e4f5a-e263-4213-a2ac-1edf9b417ada_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_108.json b/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_108.json new file mode 100644 index 00000000000..a2892450571 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_108.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Keylogging Script", + "note": "## Triage and analysis\n\n### Investigating PowerShell Keylogging Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other valuable information as credit card data and confidential conversations.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Determine whether the script stores the captured data locally.\n- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.\n- Assess network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users do not have a business justification for using scripting utilities to capture keystrokes, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n (\n powershell.file.script_block_text : (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or \"Get-Keystrokes\") or\n powershell.file.script_block_text : (\n (SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or SetWindowsHookExA or NtUserSetWindowsHookEx) and\n (GetForegroundWindow or GetWindowTextA or GetWindowTextW or \"WM_KEYBOARD_LL\")\n )\n ) and not user.id : \"S-1-5-18\"\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n", + "references": [ + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1", + "https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "bd2c86a0-8b61-4457-ab38-96943984e889", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1056", + "name": "Input Capture", + "reference": "https://attack.mitre.org/techniques/T1056/", + "subtechnique": [ + { + "id": "T1056.001", + "name": "Keylogging", + "reference": "https://attack.mitre.org/techniques/T1056/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 108 + }, + "id": "bd2c86a0-8b61-4457-ab38-96943984e889_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_109.json b/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_109.json new file mode 100644 index 00000000000..c1ace3d8913 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bd2c86a0-8b61-4457-ab38-96943984e889_109.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Keylogging Script", + "note": "## Triage and analysis\n\n### Investigating PowerShell Keylogging Script\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can abuse PowerShell capabilities to capture user keystrokes with the goal of stealing credentials and other valuable information as credit card data and confidential conversations.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Determine whether the script stores the captured data locally.\n- Investigate whether the script contains exfiltration capabilities and identify the exfiltration server.\n- Assess network data to determine if the host communicated with the exfiltration server.\n\n### False positive analysis\n\n- Regular users do not have a business justification for using scripting utilities to capture keystrokes, making false positives unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Prioritize the response if this alert involves key executives or potentially valuable targets for espionage.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n (\n powershell.file.script_block_text : (GetAsyncKeyState or NtUserGetAsyncKeyState or GetKeyboardState or \"Get-Keystrokes\") or\n powershell.file.script_block_text : (\n (SetWindowsHookA or SetWindowsHookW or SetWindowsHookEx or SetWindowsHookExA or NtUserSetWindowsHookEx) and\n (GetForegroundWindow or GetWindowTextA or GetWindowTextW or \"WM_KEYBOARD_LL\" or \"WH_MOUSE_LL\")\n )\n ) and not user.id : \"S-1-5-18\"\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\"\n )\n", + "references": [ + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/collection/Get-Keystrokes.ps1", + "https://github.com/MojtabaTajik/FunnyKeylogger/blob/master/FunnyLogger.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "bd2c86a0-8b61-4457-ab38-96943984e889", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1056", + "name": "Input Capture", + "reference": "https://attack.mitre.org/techniques/T1056/", + "subtechnique": [ + { + "id": "T1056.001", + "name": "Keylogging", + "reference": "https://attack.mitre.org/techniques/T1056/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 109 + }, + "id": "bd2c86a0-8b61-4457-ab38-96943984e889_109", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bd3d058d-5405-4cee-b890-337f09366ba2_1.json b/packages/security_detection_engine/kibana/security_rule/bd3d058d-5405-4cee-b890-337f09366ba2_1.json new file mode 100644 index 00000000000..00f2a8766aa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bd3d058d-5405-4cee-b890-337f09366ba2_1.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program to install Connection Manager service profiles, which accept installation information file (INF) files. Adversaries may abuse CMSTP to proxy the execution of malicious code by supplying INF files that contain malicious commands.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Defense Evasion via CMSTP.exe", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"cmstp.exe\" and process.args == \"/s\"\n", + "references": [ + "https://attack.mitre.org/techniques/T1218/003/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "bd3d058d-5405-4cee-b890-337f09366ba2", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.003", + "name": "CMSTP", + "reference": "https://attack.mitre.org/techniques/T1218/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "bd3d058d-5405-4cee-b890-337f09366ba2_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bd7eefee-f671-494e-98df-f01daf9e5f17_104.json b/packages/security_detection_engine/kibana/security_rule/bd7eefee-f671-494e-98df-f01daf9e5f17_104.json new file mode 100644 index 00000000000..a47577c715d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bd7eefee-f671-494e-98df-f01daf9e5f17_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to exploit a privilege escalation vulnerability (CVE-2020-1030) related to the print spooler service. Exploitation involves chaining multiple primitives to load an arbitrary DLL into the print spooler process running as SYSTEM.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Print Spooler Point and Print DLL", + "query": "sequence by host.id with maxspan=30s\n[registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers\\\\*\\\\SpoolDirectory\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers\\\\*\\\\SpoolDirectory\"\n ) and\n registry.data.strings : \"C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\4\"]\n[registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers\\\\*\\\\CopyFiles\\\\Payload\\\\Module\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Print\\\\Printers\\\\*\\\\CopyFiles\\\\Payload\\\\Module\"\n ) and\n registry.data.strings : \"C:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\4\\\\*\"]\n", + "references": [ + "https://www.accenture.com/us-en/blogs/cyber-defense/discovering-exploiting-shutting-down-dangerous-windows-print-spooler-vulnerability", + "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Privilege%20Escalation/privesc_sysmon_cve_20201030_spooler.evtx", + "https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1030" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "bd7eefee-f671-494e-98df-f01daf9e5f17", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "bd7eefee-f671-494e-98df-f01daf9e5f17_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bdb04043-f0e3-4efa-bdee-7d9d13fa9edc_1.json b/packages/security_detection_engine/kibana/security_rule/bdb04043-f0e3-4efa-bdee-7d9d13fa9edc_1.json new file mode 100644 index 00000000000..75649fadb98 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bdb04043-f0e3-4efa-bdee-7d9d13fa9edc_1.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule leverages auditd to monitor for processes scanning different processes within the /proc directory using the openat syscall. This is a strong indication for the usage of the pspy utility. Attackers may leverage the pspy process monitoring utility to monitor system processes without requiring root permissions, in order to find potential privilege escalation vectors.", + "from": "now-9m", + "index": [ + "logs-auditd_manager.auditd-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Pspy Process Monitoring Detected", + "note": "## Setup\nThis rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system. \n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from. \n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "query": "sequence by process.pid, host.id with maxspan=5s\n[ file where host.os.type == \"linux\" and event.dataset == \"auditd_manager.auditd\" and \n auditd.data.syscall == \"openat\" and file.path == \"/proc\" and auditd.data.a0 : (\"ffffffffffffff9c\", \"ffffff9c\") and \n auditd.data.a2 : (\"80000\", \"88000\") ] with runs=10\n", + "references": [ + "https://github.com/DominicBreuker/pspy" + ], + "related_integrations": [ + { + "integration": "auditd", + "package": "auditd_manager", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "auditd.data.a0", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.a2", + "type": "unknown" + }, + { + "ecs": false, + "name": "auditd.data.syscall", + "type": "unknown" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 21, + "rule_id": "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc", + "setup": "This rule requires the use of the `auditd_manager` integration. `Auditd_manager` is a tool designed to simplify and enhance the management of the audit subsystem in Linux systems. It provides a user-friendly interface and automation capabilities for configuring and monitoring system auditing through the auditd daemon. With `auditd_manager`, administrators can easily define audit rules, track system events, and generate comprehensive audit reports, improving overall security and compliance in the system. The following steps should be executed in order to install and deploy `auditd_manager` on a Linux system.\n\n```\nKibana --\u003e\nManagement --\u003e\nIntegrations --\u003e\nAuditd Manager --\u003e\nAdd Auditd Manager\n```\n\n`Auditd_manager` subscribes to the kernel and receives events as they occur without any additional configuration. However, if more advanced configuration is required to detect specific behavior, audit rules can be added to the integration in either the \"audit rules\" configuration box or the \"auditd rule files\" box by specifying a file to read the audit rules from.\n\nFor this detection rule to trigger, the following additional audit rules are required to be added to the integration:\n```\n-w /proc/ -p r -k audit_proc\n```\n\nAdd the newly installed `auditd manager` to an agent policy, and deploy the agent on a Linux system from which auditd log files are desirable.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1057", + "name": "Process Discovery", + "reference": "https://attack.mitre.org/techniques/T1057/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "bdb04043-f0e3-4efa-bdee-7d9d13fa9edc_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/be8afaed-4bcd-4e0a-b5f9-5562003dde81_106.json b/packages/security_detection_engine/kibana/security_rule/be8afaed-4bcd-4e0a-b5f9-5562003dde81_106.json new file mode 100644 index 00000000000..e3c7635e8ba --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/be8afaed-4bcd-4e0a-b5f9-5562003dde81_106.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Windows Credential Manager allows you to create, view, or delete saved credentials for signing into websites, connected applications, and networks. An adversary may abuse this to list or dump credentials stored in the Credential Manager for saved usernames and passwords. This may also be performed in preparation of lateral movement.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Searching for Saved Credentials via VaultCmd", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.pe.original_file_name:\"vaultcmd.exe\" or process.name:\"vaultcmd.exe\") and\n process.args:\"/list*\"\n", + "references": [ + "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", + "https://web.archive.org/web/20201004080456/https://rastamouse.me/blog/rdp-jump-boxes/", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "be8afaed-4bcd-4e0a-b5f9-5562003dde81", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.004", + "name": "Windows Credential Manager", + "reference": "https://attack.mitre.org/techniques/T1555/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "be8afaed-4bcd-4e0a-b5f9-5562003dde81_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_1.json b/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_1.json new file mode 100644 index 00000000000..629a43a1c7b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_1.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Owner/User Discovery Linux", + "query": "process where event.type == \"start\" and\n process.name : (\"whoami\", \"w\", \"who\", \"users\", \"id\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "bf8c007c-7dee-4842-8e9a-ee534c09d205", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + }, + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "bf8c007c-7dee-4842-8e9a-ee534c09d205_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_2.json b/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_2.json new file mode 100644 index 00000000000..2fe95b34800 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bf8c007c-7dee-4842-8e9a-ee534c09d205_2.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools which adversaries may use to enumerate the system owner/user of a compromised system.", + "from": "now-119m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Owner/User Discovery Linux", + "query": "process where event.type == \"start\" and\n process.name : (\"whoami\", \"w\", \"who\", \"users\", \"id\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "bf8c007c-7dee-4842-8e9a-ee534c09d205", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + }, + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "bf8c007c-7dee-4842-8e9a-ee534c09d205_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_106.json b/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_106.json new file mode 100644 index 00000000000..ecc2a890b2e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_106.json @@ -0,0 +1,154 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious DLL Loaded for Persistence or Privilege Escalation", + "note": "## Triage and analysis\n\n### Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation\n\nAttackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.\n\n#### Possible investigation steps\n\n- Examine the DLL signature and identify the process that created it.\n - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve the DLL and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "any where host.os.type == \"windows\" and\n (event.category : (\"driver\", \"library\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (\n /* compatible with Elastic Endpoint Library Events */\n (dll.name : (\"wlbsctrl.dll\", \"wbemcomn.dll\", \"WptsExtensions.dll\", \"Tsmsisrv.dll\", \"TSVIPSrv.dll\", \"Msfte.dll\",\n \"wow64log.dll\", \"WindowsCoreDeviceInfo.dll\", \"Ualapi.dll\", \"wlanhlp.dll\", \"phoneinfo.dll\", \"EdgeGdi.dll\",\n \"cdpsgshims.dll\", \"windowsperformancerecordercontrol.dll\", \"diagtrack_win.dll\", \"oci.dll\", \"TPPCOIPW32.dll\", \n \"tpgenlic.dll\", \"thinmon.dll\", \"fxsst.dll\", \"msTracer.dll\")\n and (dll.code_signature.trusted != true or dll.code_signature.exists != true)) or\n\n /* compatible with Sysmon EventID 7 - Image Load */\n (file.name : (\"wlbsctrl.dll\", \"wbemcomn.dll\", \"WptsExtensions.dll\", \"Tsmsisrv.dll\", \"TSVIPSrv.dll\", \"Msfte.dll\",\n \"wow64log.dll\", \"WindowsCoreDeviceInfo.dll\", \"Ualapi.dll\", \"wlanhlp.dll\", \"phoneinfo.dll\", \"EdgeGdi.dll\",\n \"cdpsgshims.dll\", \"windowsperformancerecordercontrol.dll\", \"diagtrack_win.dll\", \"oci.dll\", \"TPPCOIPW32.dll\", \n \"tpgenlic.dll\", \"thinmon.dll\", \"fxsst.dll\", \"msTracer.dll\") and \n not file.path : (\"?:\\\\Windows\\\\System32\\\\wbemcomn.dll\", \"?:\\\\Windows\\\\SysWOW64\\\\wbemcomn.dll\") and \n not file.hash.sha256 : \n (\"6e837794fc282446906c36d681958f2f6212043fc117c716936920be166a700f\", \n \"b14e4954e8cca060ffeb57f2458b6a3a39c7d2f27e94391cbcea5387652f21a4\", \n \"c258d90acd006fa109dc6b748008edbb196d6168bc75ace0de0de54a4db46662\") and \n not file.code_signature.status == \"Valid\")\n )\n", + "references": [ + "https://itm4n.github.io/windows-dll-hijacking-clarified/", + "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html", + "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", + "https://shellz.club/2020/10/16/edgegdi-dll-for-persistence-and-lateral-movement.html", + "https://windows-internals.com/faxing-your-way-to-system/", + "http://waleedassar.blogspot.com/2013/01/wow64logdll.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "bfeaf89b-a2a7-48a3-817f-e41829dc61ee", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.002", + "name": "DLL Side-Loading", + "reference": "https://attack.mitre.org/techniques/T1574/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.001", + "name": "DLL Search Order Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "bfeaf89b-a2a7-48a3-817f-e41829dc61ee_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_107.json b/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_107.json new file mode 100644 index 00000000000..0e7229093b1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/bfeaf89b-a2a7-48a3-817f-e41829dc61ee_107.json @@ -0,0 +1,155 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the loading of a non Microsoft signed DLL that is missing on a default Windows install (phantom DLL) or one that can be loaded from a different location by a native Windows process. This may be abused to persist or elevate privileges via privileged file write vulnerabilities.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious DLL Loaded for Persistence or Privilege Escalation", + "note": "## Triage and analysis\n\n### Investigating Suspicious DLL Loaded for Persistence or Privilege Escalation\n\nAttackers can execute malicious code by abusing missing modules that processes try to load, enabling them to escalate privileges or gain persistence. This rule identifies the loading of a non-Microsoft-signed DLL that is missing on a default Windows installation or one that can be loaded from a different location by a native Windows process.\n\n#### Possible investigation steps\n\n- Examine the DLL signature and identify the process that created it.\n - Investigate any abnormal behaviors by the process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve the DLL and determine if it is malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "any where host.os.type == \"windows\" and\n (event.category : (\"driver\", \"library\") or (event.category == \"process\" and event.action : \"Image loaded*\")) and\n (\n /* compatible with Elastic Endpoint Library Events */\n (dll.name : (\"wlbsctrl.dll\", \"wbemcomn.dll\", \"WptsExtensions.dll\", \"Tsmsisrv.dll\", \"TSVIPSrv.dll\", \"Msfte.dll\",\n \"wow64log.dll\", \"WindowsCoreDeviceInfo.dll\", \"Ualapi.dll\", \"wlanhlp.dll\", \"phoneinfo.dll\", \"EdgeGdi.dll\",\n \"cdpsgshims.dll\", \"windowsperformancerecordercontrol.dll\", \"diagtrack_win.dll\", \"oci.dll\", \"TPPCOIPW32.dll\", \n \"tpgenlic.dll\", \"thinmon.dll\", \"fxsst.dll\", \"msTracer.dll\")\n and (dll.code_signature.trusted != true or dll.code_signature.exists != true)) or\n\n /* compatible with Sysmon EventID 7 - Image Load */\n (file.name : (\"wlbsctrl.dll\", \"wbemcomn.dll\", \"WptsExtensions.dll\", \"Tsmsisrv.dll\", \"TSVIPSrv.dll\", \"Msfte.dll\",\n \"wow64log.dll\", \"WindowsCoreDeviceInfo.dll\", \"Ualapi.dll\", \"wlanhlp.dll\", \"phoneinfo.dll\", \"EdgeGdi.dll\",\n \"cdpsgshims.dll\", \"windowsperformancerecordercontrol.dll\", \"diagtrack_win.dll\", \"oci.dll\", \"TPPCOIPW32.dll\", \n \"tpgenlic.dll\", \"thinmon.dll\", \"fxsst.dll\", \"msTracer.dll\") and \n not file.path : (\"?:\\\\Windows\\\\System32\\\\wbemcomn.dll\", \"?:\\\\Windows\\\\SysWOW64\\\\wbemcomn.dll\") and \n not file.hash.sha256 : \n (\"6e837794fc282446906c36d681958f2f6212043fc117c716936920be166a700f\", \n \"b14e4954e8cca060ffeb57f2458b6a3a39c7d2f27e94391cbcea5387652f21a4\", \n \"c258d90acd006fa109dc6b748008edbb196d6168bc75ace0de0de54a4db46662\") and \n not file.code_signature.status == \"Valid\")\n )\n", + "references": [ + "https://itm4n.github.io/windows-dll-hijacking-clarified/", + "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html", + "https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html", + "https://shellz.club/2020/10/16/edgegdi-dll-for-persistence-and-lateral-movement.html", + "https://windows-internals.com/faxing-your-way-to-system/", + "http://waleedassar.blogspot.com/2013/01/wow64logdll.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "bfeaf89b-a2a7-48a3-817f-e41829dc61ee", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.002", + "name": "DLL Side-Loading", + "reference": "https://attack.mitre.org/techniques/T1574/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.001", + "name": "DLL Search Order Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "bfeaf89b-a2a7-48a3-817f-e41829dc61ee_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d_104.json b/packages/security_detection_engine/kibana/security_rule/c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d_104.json new file mode 100644 index 00000000000..97829ad4cc6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d_104.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the Secure Copy Protocol (SCP) to copy files locally by abusing the auto addition of the Secure Shell Daemon (sshd) to the authorized application list for Full Disk Access. This may indicate attempts to bypass macOS privacy controls to access sensitive files.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privacy Control Bypass via Localhost Secure Copy", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.name:\"scp\" and\n process.args:\"StrictHostKeyChecking=no\" and\n process.command_line:(\"scp *localhost:/*\", \"scp *127.0.0.1:/*\") and\n not process.args:\"vagrant@*127.0.0.1*\"\n", + "references": [ + "https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "c02c8b9f-5e1d-463c-a1b0-04edcdfe1a3d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c0429aa8-9974-42da-bfb6-53a0a515a145_105.json b/packages/security_detection_engine/kibana/security_rule/c0429aa8-9974-42da-bfb6-53a0a515a145_105.json new file mode 100644 index 00000000000..2b2ac14813a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c0429aa8-9974-42da-bfb6-53a0a515a145_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation or modification of a new Group Policy based scheduled task or service. These methods are used for legitimate system administration, but can also be abused by an attacker with domain admin permissions to execute a malicious payload remotely on all or a subset of the domain joined machines.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation or Modification of a new GPO Scheduled Task or Service", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.path : (\"?:\\\\Windows\\\\SYSVOL\\\\domain\\\\Policies\\\\*\\\\MACHINE\\\\Preferences\\\\ScheduledTasks\\\\ScheduledTasks.xml\",\n \"?:\\\\Windows\\\\SYSVOL\\\\domain\\\\Policies\\\\*\\\\MACHINE\\\\Preferences\\\\Services\\\\Services.xml\") and\n not process.name : \"dfsrs.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c0429aa8-9974-42da-bfb6-53a0a515a145", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.005", + "name": "Scheduled Task", + "reference": "https://attack.mitre.org/techniques/T1053/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "c0429aa8-9974-42da-bfb6-53a0a515a145_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c125e48f-6783-41f0-b100-c3bf1b114d16_3.json b/packages/security_detection_engine/kibana/security_rule/c125e48f-6783-41f0-b100-c3bf1b114d16_3.json new file mode 100644 index 00000000000..cebd5ce63ea --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c125e48f-6783-41f0-b100-c3bf1b114d16_3.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies instances where the \"index.html\" file within the \"/usr/lib/vmware/*\" directory is renamed on a Linux system. The rule monitors for the \"rename\" event action associated with this specific file and path, which could indicate malicious activity.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Renaming of ESXI index.html File", + "query": "file where host.os.type == \"linux\" and event.action == \"rename\" and file.name : \"index.html\" and\nfile.Ext.original.path : \"/usr/lib/vmware/*\"\n", + "references": [ + "https://www.bleepingcomputer.com/news/security/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.original.path", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c125e48f-6783-41f0-b100-c3bf1b114d16", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.003", + "name": "Rename System Utilities", + "reference": "https://attack.mitre.org/techniques/T1036/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "c125e48f-6783-41f0-b100-c3bf1b114d16_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c20cd758-07b1-46a1-b03f-fa66158258b8_1.json b/packages/security_detection_engine/kibana/security_rule/c20cd758-07b1-46a1-b03f-fa66158258b8_1.json new file mode 100644 index 00000000000..b85c97ab7bf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c20cd758-07b1-46a1-b03f-fa66158258b8_1.json @@ -0,0 +1,131 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies digitally signed (trusted) processes loading unsigned DLLs. Attackers may plant their payloads into the application folder and invoke the legitimate application to execute the payload, masking actions they perform under a legitimate, trusted, and potentially elevated system or software process.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Unsigned DLL Loaded by a Trusted Process", + "query": "library where host.os.type == \"windows\" and\n (dll.Ext.relative_file_creation_time \u003c= 500 or\n dll.Ext.relative_file_name_modify_time \u003c= 500 or\n dll.Ext.device.product_id : (\"Virtual DVD-ROM\", \"Virtual Disk\")) and dll.hash.sha256 != null and\n process.code_signature.status :\"trusted\" and not dll.code_signature.status : (\"trusted\", \"errorExpired\", \"errorCode_endpoint*\") and\n /* DLL loaded from the process.executable current directory */\n endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))\n and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.Ext.device.product_id", + "type": "unknown" + }, + { + "ecs": false, + "name": "dll.Ext.relative_file_creation_time", + "type": "unknown" + }, + { + "ecs": false, + "name": "dll.Ext.relative_file_name_modify_time", + "type": "unknown" + }, + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.hash.sha256", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c20cd758-07b1-46a1-b03f-fa66158258b8", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.001", + "name": "DLL Search Order Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/001/" + }, + { + "id": "T1574.002", + "name": "DLL Side-Loading", + "reference": "https://attack.mitre.org/techniques/T1574/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "c20cd758-07b1-46a1-b03f-fa66158258b8_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c25e9c87-95e1-4368-bfab-9fd34cf867ec_106.json b/packages/security_detection_engine/kibana/security_rule/c25e9c87-95e1-4368-bfab-9fd34cf867ec_106.json new file mode 100644 index 00000000000..24219b89902 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c25e9c87-95e1-4368-bfab-9fd34cf867ec_106.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "Microsoft IIS Connection Strings Decryption", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"aspnet_regiis.exe\" or process.pe.original_file_name == \"aspnet_regiis.exe\") and\n process.args : \"connectionStrings\" and process.args : \"-pdf\"\n", + "references": [ + "https://blog.netspi.com/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c25e9c87-95e1-4368-bfab-9fd34cf867ec", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "c25e9c87-95e1-4368-bfab-9fd34cf867ec_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c28c4d8c-f014-40ef-88b6-79a1d67cd499_103.json b/packages/security_detection_engine/kibana/security_rule/c28c4d8c-f014-40ef-88b6-79a1d67cd499_103.json new file mode 100644 index 00000000000..b1772abcc21 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c28c4d8c-f014-40ef-88b6-79a1d67cd499_103.json @@ -0,0 +1,61 @@ +{ + "attributes": { + "anomaly_threshold": 25, + "author": [ + "Elastic" + ], + "description": "Looks for commands related to system network connection discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network connection discovery in order to increase their understanding of connected services and systems. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.", + "false_positives": [ + "Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_network_connection_discovery" + ], + "name": "Unusual Linux Network Connection Discovery", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "c28c4d8c-f014-40ef-88b6-79a1d67cd499", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "c28c4d8c-f014-40ef-88b6-79a1d67cd499_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c292fa52-4115-408a-b897-e14f684b3cb7_104.json b/packages/security_detection_engine/kibana/security_rule/c292fa52-4115-408a-b897-e14f684b3cb7_104.json new file mode 100644 index 00000000000..9720a19d461 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c292fa52-4115-408a-b897-e14f684b3cb7_104.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects modification of a Folder Action script. A Folder Action script is executed when the folder to which it is attached has items added or removed, or when its window is opened, closed, moved, or resized. Adversaries may abuse this feature to establish persistence by utilizing a malicious script.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Folder Action Script", + "query": "sequence by host.id with maxspan=5s\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\", \"info\") and process.name == \"com.apple.foundation.UserScriptService\"] by process.pid\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name in (\"osascript\", \"python\", \"tcl\", \"node\", \"perl\", \"ruby\", \"php\", \"bash\", \"csh\", \"zsh\", \"sh\") and\n not process.args : \"/Users/*/Library/Application Support/iTerm2/Scripts/AutoLaunch/*.scpt\"\n ] by process.parent.pid\n", + "references": [ + "https://posts.specterops.io/folder-actions-for-persistence-on-macos-8923f222343d" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "c292fa52-4115-408a-b897-e14f684b3cb7", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1037", + "name": "Boot or Logon Initialization Scripts", + "reference": "https://attack.mitre.org/techniques/T1037/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "c292fa52-4115-408a-b897-e14f684b3cb7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c2d90150-0133-451c-a783-533e736c12d7_105.json b/packages/security_detection_engine/kibana/security_rule/c2d90150-0133-451c-a783-533e736c12d7_105.json new file mode 100644 index 00000000000..7db3e60f0bc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c2d90150-0133-451c-a783-533e736c12d7_105.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies Mshta.exe making outbound network connections. This may indicate adversarial activity, as Mshta is often leveraged by adversaries to execute malicious scripts and evade detection.", + "from": "now-20m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Mshta Making Network Connections", + "query": "sequence by process.entity_id with maxspan=10m\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"mshta.exe\" and\n not process.parent.name : \"Microsoft.ConfigurationManagement.exe\" and\n not (process.parent.executable : \"C:\\\\Amazon\\\\Amazon Assistant\\\\amazonAssistantService.exe\" or\n process.parent.executable : \"C:\\\\TeamViewer\\\\TeamViewer.exe\") and\n not process.args : \"ADSelfService_Enroll.hta\"]\n [network where host.os.type == \"windows\" and process.name : \"mshta.exe\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c2d90150-0133-451c-a783-533e736c12d7", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.005", + "name": "Mshta", + "reference": "https://attack.mitre.org/techniques/T1218/005/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "c2d90150-0133-451c-a783-533e736c12d7_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c3b915e0-22f3-4bf7-991d-b643513c722f_104.json b/packages/security_detection_engine/kibana/security_rule/c3b915e0-22f3-4bf7-991d-b643513c722f_104.json new file mode 100644 index 00000000000..d6e7d0405fa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c3b915e0-22f3-4bf7-991d-b643513c722f_104.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary can use the Background Intelligent Transfer Service (BITS) SetNotifyCmdLine method to execute a program that runs after a job finishes transferring data or after a job enters a specified state in order to persist on a system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via BITS Job Notify Cmdline", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"svchost.exe\" and process.parent.args : \"BITS\" and\n not process.executable :\n (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\System32\\\\wermgr.exe\",\n \"?:\\\\WINDOWS\\\\system32\\\\directxdatabaseupdater.exe\")\n", + "references": [ + "https://pentestlab.blog/2019/10/30/persistence-bits-jobs/", + "https://docs.microsoft.com/en-us/windows/win32/api/bits1_5/nf-bits1_5-ibackgroundcopyjob2-setnotifycmdline", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin-setnotifycmdline", + "https://www.elastic.co/blog/hunting-for-persistence-using-elastic-security-part-2" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c3b915e0-22f3-4bf7-991d-b643513c722f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "c3b915e0-22f3-4bf7-991d-b643513c722f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c3f5e1d8-910e-43b4-8d44-d748e498ca86_104.json b/packages/security_detection_engine/kibana/security_rule/c3f5e1d8-910e-43b4-8d44-d748e498ca86_104.json new file mode 100644 index 00000000000..e88f4786662 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c3f5e1d8-910e-43b4-8d44-d748e498ca86_104.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an outbound network connection by JAVA to LDAP, RMI or DNS standard ports followed by a suspicious JAVA child processes. This may indicate an attempt to exploit a JAVA/NDI (Java Naming and Directory Interface) injection vulnerability.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential JAVA/JNDI Exploitation Attempt", + "query": "sequence by host.id with maxspan=1m\n [network where event.action == \"connection_attempted\" and\n process.name : \"java\" and\n /*\n outbound connection attempt to\n LDAP, RMI or DNS standard ports\n by JAVA process\n */\n destination.port in (1389, 389, 1099, 53, 5353)] by process.pid\n [process where event.type == \"start\" and\n\n /* Suspicious JAVA child process */\n process.parent.name : \"java\" and\n process.name : (\"sh\",\n \"bash\",\n \"dash\",\n \"ksh\",\n \"tcsh\",\n \"zsh\",\n \"curl\",\n \"perl*\",\n \"python*\",\n \"ruby*\",\n \"php*\",\n \"wget\")] by process.parent.pid\n", + "references": [ + "https://www.lunasec.io/docs/blog/log4j-zero-day/", + "https://github.com/christophetd/log4shell-vulnerable-app", + "https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf", + "https://www.elastic.co/security-labs/detecting-log4j2-with-elastic-security", + "https://www.elastic.co/security-labs/analysis-of-log4shell-cve-2021-45046" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "c3f5e1d8-910e-43b4-8d44-d748e498ca86", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.007", + "name": "JavaScript", + "reference": "https://attack.mitre.org/techniques/T1059/007/" + } + ] + }, + { + "id": "T1203", + "name": "Exploitation for Client Execution", + "reference": "https://attack.mitre.org/techniques/T1203/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "c3f5e1d8-910e-43b4-8d44-d748e498ca86_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14_106.json b/packages/security_detection_engine/kibana/security_rule/c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14_106.json new file mode 100644 index 00000000000..fa9eb57e27b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14_106.json @@ -0,0 +1,153 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or preparation for data exfiltration.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Mounting Hidden or WebDav Remote Shares", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n ((process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or ((process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\")) and\n process.args : \"use\" and\n /* including hidden and webdav based online shares such as onedrive */\n process.args : (\"\\\\\\\\*\\\\*$*\", \"\\\\\\\\*@SSL\\\\*\", \"http*\") and\n /* excluding shares deletion operation */\n not process.args : \"/d*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c4818812-d44f-47be-aaef-4cfb2f9cc799_104.json b/packages/security_detection_engine/kibana/security_rule/c4818812-d44f-47be-aaef-4cfb2f9cc799_104.json new file mode 100644 index 00000000000..30e5021bcb9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c4818812-d44f-47be-aaef-4cfb2f9cc799_104.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects deletion of print driver files by an unusual process. This may indicate a clean up attempt post successful privilege escalation via Print Spooler service related vulnerabilities.", + "false_positives": [ + "Uninstall or manual deletion of a legitimate printing driver files. Verify the printer file metadata such as manufacturer and signature information." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Print Spooler File Deletion", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type : \"deletion\" and\n not process.name : (\"spoolsv.exe\", \"dllhost.exe\", \"explorer.exe\") and\n file.path : \"?:\\\\Windows\\\\System32\\\\spool\\\\drivers\\\\x64\\\\3\\\\*.dll\"\n", + "references": [ + "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c4818812-d44f-47be-aaef-4cfb2f9cc799", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "c4818812-d44f-47be-aaef-4cfb2f9cc799_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_1.json b/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_1.json new file mode 100644 index 00000000000..b53f23c2f45 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_1.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to enumerate network connections. Adversaries may attempt to get a listing of network connections to or from a compromised system to identify targets within an environment.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows System Network Connections Discovery", + "query": "process where event.type == \"start\" and\n(\n process.name : \"netstat.exe\" or\n (\n (\n (process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n (\n (process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\"\n )\n ) and process.args : (\"use\", \"user\", \"session\", \"config\") and not process.args: (\"/persistent:*\", \"/delete\", \"\\\\\\\\*\")\n ) or\n (process.name : \"nbtstat.exe\" and process.args : \"-s*\")\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c4e9ed3e-55a2-4309-a012-bc3c78dad10a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "c4e9ed3e-55a2-4309-a012-bc3c78dad10a_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_2.json b/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_2.json new file mode 100644 index 00000000000..ad8d87c85fa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c4e9ed3e-55a2-4309-a012-bc3c78dad10a_2.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to enumerate network connections. Adversaries may attempt to get a listing of network connections to or from a compromised system to identify targets within an environment.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Windows System Network Connections Discovery", + "query": "process where event.type == \"start\" and\n(\n process.name : \"netstat.exe\" or\n (\n (\n (process.name : \"net.exe\" or process.pe.original_file_name == \"net.exe\") or\n (\n (process.name : \"net1.exe\" or process.pe.original_file_name == \"net1.exe\") and\n not process.parent.name : \"net.exe\"\n )\n ) and process.args : (\"use\", \"user\", \"session\", \"config\") and not process.args: (\"/persistent:*\", \"/delete\", \"\\\\\\\\*\")\n ) or\n (process.name : \"nbtstat.exe\" and process.args : \"-s*\")\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c4e9ed3e-55a2-4309-a012-bc3c78dad10a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + }, + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "c4e9ed3e-55a2-4309-a012-bc3c78dad10a_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c55badd3-3e61-4292-836f-56209dc8a601_1.json b/packages/security_detection_engine/kibana/security_rule/c55badd3-3e61-4292-836f-56209dc8a601_1.json new file mode 100644 index 00000000000..8e808a717f1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c55badd3-3e61-4292-836f-56209dc8a601_1.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Attackers may try to access private keys, e.g. ssh, in order to gain further authenticated access to the environment.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Attempted Private Key Access", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.args : (\"*.pem*\", \"*.id_rsa*\") and\n not process.executable : (\n \"?:\\\\ProgramData\\\\Logishrd\\\\LogiOptions\\\\Software\\\\*\\\\LogiLuUpdater.exe\",\n \"?:\\\\Program Files\\\\Logi\\\\LogiBolt\\\\LogiBoltUpdater.exe\",\n \"?:\\\\Windows\\\\system32\\\\icacls.exe\",\n \"?:\\\\Program Files\\\\Splunk\\\\bin\\\\openssl.exe\",\n \"?:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\*\\\\components\\\\osqueryd.exe\",\n \"?:\\\\Windows\\\\System32\\\\OpenSSH\\\\*\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c55badd3-3e61-4292-836f-56209dc8a601", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.004", + "name": "Private Keys", + "reference": "https://attack.mitre.org/techniques/T1552/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "c55badd3-3e61-4292-836f-56209dc8a601_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c5677997-f75b-4cda-b830-a75920514096_1.json b/packages/security_detection_engine/kibana/security_rule/c5677997-f75b-4cda-b830-a75920514096_1.json new file mode 100644 index 00000000000..c9156346927 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c5677997-f75b-4cda-b830-a75920514096_1.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies attempts to modify a service path setting using sc.exe. Attackers may attempt to modify existing services for persistence or privilege escalation.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Service Path Modification via sc.exe", + "query": "process where event.type == \"start\" and\n process.name : \"sc.exe\" and process.args : \"*binPath*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c5677997-f75b-4cda-b830-a75920514096", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "c5677997-f75b-4cda-b830-a75920514096_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c57f8579-e2a5-4804-847f-f2732edc5156_105.json b/packages/security_detection_engine/kibana/security_rule/c57f8579-e2a5-4804-847f-f2732edc5156_105.json new file mode 100644 index 00000000000..12da98219f7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c57f8579-e2a5-4804-847f-f2732edc5156_105.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the modification of the Remote Desktop Protocol (RDP) Shadow registry or the execution of processes indicative of an active RDP shadowing session. An adversary may abuse the RDP Shadowing feature to spy on or control other users active RDP sessions.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Desktop Shadowing Activity", + "note": "", + "query": "/* Identifies the modification of RDP Shadow registry or\n the execution of processes indicative of active shadow RDP session */\n\nany where host.os.type == \"windows\" and\n(\n (event.category == \"registry\" and\n registry.path : (\n \"HKLM\\\\Software\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\Shadow\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Terminal Services\\\\Shadow\"\n )\n ) or\n (event.category == \"process\" and event.type == \"start\" and\n (process.name : (\"RdpSaUacHelper.exe\", \"RdpSaProxy.exe\") and process.parent.name : \"svchost.exe\") or\n (process.pe.original_file_name : \"mstsc.exe\" and process.args : \"/shadow:*\")\n )\n)\n", + "references": [ + "https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing", + "https://swarm.ptsecurity.com/remote-desktop-services-shadowing/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c57f8579-e2a5-4804-847f-f2732edc5156", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "c57f8579-e2a5-4804-847f-f2732edc5156_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c5ce48a6-7f57-4ee8-9313-3d0024caee10_105.json b/packages/security_detection_engine/kibana/security_rule/c5ce48a6-7f57-4ee8-9313-3d0024caee10_105.json new file mode 100644 index 00000000000..76b9f8a4e42 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c5ce48a6-7f57-4ee8-9313-3d0024caee10_105.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the installation of custom Application Compatibility Shim databases. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Installation of Custom Shim Databases", + "query": "sequence by process.entity_id with maxspan = 5m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n not (process.name : \"sdbinst.exe\" and process.parent.name : \"msiexec.exe\")]\n [registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n registry.path : \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Custom\\\\*.sdb\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c5ce48a6-7f57-4ee8-9313-3d0024caee10", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.011", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1546/011/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "c5ce48a6-7f57-4ee8-9313-3d0024caee10_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c5dc3223-13a2-44a2-946c-e9dc0aa0449c_106.json b/packages/security_detection_engine/kibana/security_rule/c5dc3223-13a2-44a2-946c-e9dc0aa0449c_106.json new file mode 100644 index 00000000000..5260477a845 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c5dc3223-13a2-44a2-946c-e9dc0aa0449c_106.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An instance of MSBuild, the Microsoft Build Engine, was started by Excel or Word. This is unusual behavior for the Build Engine and could have been caused by an Excel or Word document executing a malicious script payload.", + "false_positives": [ + "The Build Engine is commonly used by Windows developers but use by non-engineers is unusual. It is quite unusual for this program to be started by an Office application like Word or Excel." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Build Engine Started by an Office Application", + "note": "## Triage and analysis\n\n### Investigating Microsoft Build Engine Started by an Office Application\n\nMicrosoft Office (MS Office) is a suite of applications designed to help with productivity and completing common tasks on a computer. You can create and edit documents containing text and images, work with data in spreadsheets and databases, and create presentations and posters. As it is some of the most-used software across companies, MS Office is frequently targeted for initial access. It also has a wide variety of capabilities that attackers can take advantage of.\n\nThe Microsoft Build Engine is a platform for building applications. This engine, also known as MSBuild, provides an XML schema for a project file that controls how the build platform processes and builds software, and can be abused to proxy execution of code.\n\nThis rule looks for the `Msbuild.exe` utility spawned by MS Office programs. This is generally the result of the execution of malicious documents.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate abnormal behaviors observed by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Retrieve MS Office documents received and opened by the user that could cause this behavior. Common locations include, but are not limited to, the Downloads and Document folders and the folder configured at the email client.\n- Determine if the collected files are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n - If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"MSBuild.exe\" and\n process.parent.name : (\"eqnedt32.exe\",\n \"excel.exe\",\n \"fltldr.exe\",\n \"msaccess.exe\",\n \"mspub.exe\",\n \"outlook.exe\",\n \"powerpnt.exe\",\n \"winword.exe\" )\n", + "references": [ + "https://blog.talosintelligence.com/2020/02/building-bypass-with-msbuild.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1127", + "name": "Trusted Developer Utilities Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1127/", + "subtechnique": [ + { + "id": "T1127.001", + "name": "MSBuild", + "reference": "https://attack.mitre.org/techniques/T1127/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "c5dc3223-13a2-44a2-946c-e9dc0aa0449c_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c6453e73-90eb-4fe7-a98c-cde7bbfc504a_107.json b/packages/security_detection_engine/kibana/security_rule/c6453e73-90eb-4fe7-a98c-cde7bbfc504a_107.json new file mode 100644 index 00000000000..bbccab88cb0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c6453e73-90eb-4fe7-a98c-cde7bbfc504a_107.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the Windows Defender configuration utility (MpCmdRun.exe) being used to download a remote file.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Download via MpCmdRun", + "note": "## Triage and analysis\n\n### Investigating Remote File Download via MpCmdRun\n\nAttackers commonly transfer tooling or malware from external systems into a compromised environment using the command and control channel. However, they can also abuse signed utilities to drop these files.\n\nThe `MpCmdRun.exe` is a command-line tool part of Windows Defender and is used to manage various Microsoft Windows Defender Antivirus settings and perform certain tasks. It can also be abused by attackers to download remote files, including malware and offensive tooling. This rule looks for the patterns used to perform downloads using the utility.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Check the reputation of the domain or IP address used to host the downloaded file.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"MpCmdRun.exe\" or process.pe.original_file_name == \"MpCmdRun.exe\") and\n process.args : \"-DownloadFile\" and process.args : \"-url\" and process.args : \"-path\"\n", + "references": [ + "https://twitter.com/mohammadaskar2/status/1301263551638761477", + "https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-can-ironically-be-used-to-download-malware/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c6453e73-90eb-4fe7-a98c-cde7bbfc504a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "c6453e73-90eb-4fe7-a98c-cde7bbfc504a_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c749e367-a069-4a73-b1f2-43a3798153ad_104.json b/packages/security_detection_engine/kibana/security_rule/c749e367-a069-4a73-b1f2-43a3798153ad_104.json new file mode 100644 index 00000000000..196631f2c1c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c749e367-a069-4a73-b1f2-43a3798153ad_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are regularly deleted." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Delete an Okta Network Zone", + "note": "## Triage and analysis\n\n### Investigating Attempt to Delete an Okta Network Zone\n\nOkta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. Deleting a network zone in Okta might remove or weaken the security controls of an organization, which might be an indicator of an adversary's attempt to evade defenses.\n\n#### Possible investigation steps:\n\n- Identify the actor associated with the alert by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.\n- Examine the `event.action` field to confirm the deletion of a network zone.\n- Investigate the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` fields to identify the network zone that was deleted.\n- Review the `event.time` field to understand when the event happened.\n- Check the actor's activities before and after the event to understand the context of this event.\n\n### False positive analysis:\n\n- Verify the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor. If these match the actor's typical behavior, it might be a false positive.\n- Check if the actor is a known administrator or a member of the IT team who might have a legitimate reason to delete a network zone.\n- Cross-verify the actor's actions with any known planned changes or maintenance activities.\n\n### Response and remediation:\n\n- If unauthorized access or actions are confirmed, immediately lock the affected actor's account and require a password change.\n- If a network zone was deleted without authorization, create a new network zone with similar settings as the deleted one.\n- Review and update the privileges of the actor who initiated the deletion.\n- Identify any gaps in the security policies and procedures and update them as necessary.\n- Implement additional monitoring and logging of Okta events to improve visibility of user actions.\n- Communicate and train the employees about the importance of following proper procedures for modifying network zone settings.", + "query": "event.dataset:okta.system and event.action:zone.delete\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c749e367-a069-4a73-b1f2-43a3798153ad", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Network Security Monitoring", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "c749e367-a069-4a73-b1f2-43a3798153ad_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c7894234-7814-44c2-92a9-f7d851ea246a_105.json b/packages/security_detection_engine/kibana/security_rule/c7894234-7814-44c2-92a9-f7d851ea246a_105.json new file mode 100644 index 00000000000..d876105778e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c7894234-7814-44c2-92a9-f7d851ea246a_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unusual instances of dllhost.exe making outbound network connections. This may indicate adversarial Command and Control activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Network Connection via DllHost", + "query": "sequence by host.id, process.entity_id with maxspan=1m\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"dllhost.exe\" and process.args_count == 1]\n [network where host.os.type == \"windows\" and process.name : \"dllhost.exe\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\", \"192.0.2.0/24\",\n \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\",\n \"192.175.48.0/24\", \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\", \"FE80::/10\",\n \"FF00::/8\")]\n", + "references": [ + "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", + "https://www.volexity.com/blog/2021/05/27/suspected-apt29-operation-launches-election-fraud-themed-phishing-campaigns/", + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c7894234-7814-44c2-92a9-f7d851ea246a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "c7894234-7814-44c2-92a9-f7d851ea246a_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9_106.json b/packages/security_detection_engine/kibana/security_rule/c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9_106.json new file mode 100644 index 00000000000..4adc2ed99a7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9_106.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an unexpected file being modified by dns.exe, the process responsible for Windows DNS Server services, which may indicate activity related to remote code execution or other forms of exploitation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual File Modification by dns.exe", + "note": "## Triage and analysis\n\n### Investigating Unusual File Write\nDetection alerts from this rule indicate potential unusual/abnormal file writes from the DNS Server service process (`dns.exe`) after exploitation from CVE-2020-1350 (SigRed) has occurred. Here are some possible avenues of investigation:\n- Post-exploitation, adversaries may write additional files or payloads to the system as additional discovery/exploitation/persistence mechanisms.\n- Any suspicious or abnormal files written from `dns.exe` should be reviewed and investigated with care.", + "query": "file where host.os.type == \"windows\" and process.name : \"dns.exe\" and event.type in (\"creation\", \"deletion\", \"change\") and\n not file.name : \"dns.log\" and not\n (file.extension : (\"old\", \"temp\", \"bak\", \"dns\", \"arpa\") and file.path : \"C:\\\\Windows\\\\System32\\\\dns\\\\*\")\n", + "references": [ + "https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", + "https://msrc-blog.microsoft.com/2020/07/14/july-2020-security-update-cve-2020-1350-vulnerability-in-windows-domain-name-system-dns-server/", + "https://www.elastic.co/security-labs/detection-rules-for-sigred-vulnerability" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1133", + "name": "External Remote Services", + "reference": "https://attack.mitre.org/techniques/T1133/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "c7ce36c0-32ff-4f9a-bfc2-dcb242bf99f9_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c7db5533-ca2a-41f6-a8b0-ee98abe0f573_104.json b/packages/security_detection_engine/kibana/security_rule/c7db5533-ca2a-41f6-a8b0-ee98abe0f573_104.json new file mode 100644 index 00000000000..ba9ceca01c2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c7db5533-ca2a-41f6-a8b0-ee98abe0f573_104.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusually large spike in network activity to one destination country in the network logs. This could be due to unusually large amounts of reconnaissance or enumeration traffic. Data exfiltration activity may also produce such a surge in traffic to a destination country that does not normally appear in network traffic or business workflows. Malware instances and persistence mechanisms may communicate with command-and-control (C2) infrastructure in their country of origin, which may be an unusual destination country for the source network.", + "false_positives": [ + "Business workflows that occur very occasionally, and involve an unusual surge in network traffic to one destination country, can trigger this alert. A new business workflow or a surge in business activity in a particular country may trigger this alert. Business travelers who roam to many countries for brief periods may trigger this alert if they engage in volumetric network activity." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "high_count_by_destination_country", + "name": "Spike in Network Traffic To a Country", + "note": "## Triage and analysis\n\n### Investigating Spike in Network Traffic To a Country\n\nMonitoring network traffic for anomalies is a good methodology for uncovering various potentially suspicious activities. For example, data exfiltration or infected machines may communicate with a command-and-control (C2) server in another country your company doesn't have business with.\n\nThis rule uses a machine learning job to detect a significant spike in the network traffic to a country, which can indicate reconnaissance or enumeration activities, an infected machine being used as a bot in a DDoS attack, or potentially data exfiltration.\n\n#### Possible investigation steps\n\n- Identify the specifics of the involved assets, such as role, criticality, and associated users.\n- Investigate other alerts associated with the involved assets during the past 48 hours.\n- Examine the data available and determine the exact users and processes involved in those connections.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Consider the time of day. If the user is a human (not a program or script), did the activity occurs during working hours?\n- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.\n\n### False positive analysis\n\n- Understand the context of the connections by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions \u2014 preferably with a combination of user and source conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n - Remove and block malicious artifacts identified during triage.\n- Consider implementing temporary network border rules to block or alert connections to the target country, if relevant.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "c7db5533-ca2a-41f6-a8b0-ee98abe0f573", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 104 + }, + "id": "c7db5533-ca2a-41f6-a8b0-ee98abe0f573_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c81cefcb-82b9-4408-a533-3c3df549e62d_104.json b/packages/security_detection_engine/kibana/security_rule/c81cefcb-82b9-4408-a533-3c3df549e62d_104.json new file mode 100644 index 00000000000..9eac17dd853 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c81cefcb-82b9-4408-a533-3c3df549e62d_104.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary can establish persistence by modifying an existing macOS dock property list in order to execute a malicious application instead of the intended one when invoked.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Persistence via Docker Shortcut Modification", + "query": "event.category:file and host.os.type:macos and event.action:modification and\n file.path:/Users/*/Library/Preferences/com.apple.dock.plist and\n not process.name:(xpcproxy or cfprefsd or plutil or jamf or PlistBuddy or InstallerRemotePluginService)\n", + "references": [ + "https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c81cefcb-82b9-4408-a533-3c3df549e62d", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "c81cefcb-82b9-4408-a533-3c3df549e62d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c82b2bd8-d701-420c-ba43-f11a155b681a_102.json b/packages/security_detection_engine/kibana/security_rule/c82b2bd8-d701-420c-ba43-f11a155b681a_102.json new file mode 100644 index 00000000000..e924a05efb7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c82b2bd8-d701-420c-ba43-f11a155b681a_102.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.", + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "SMB (Windows File Sharing) Activity to the Internet", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:(139 or 445) or event.dataset:zeek.smb) and\n source.ip:(\n 10.0.0.0/8 or\n 172.16.0.0/12 or\n 192.168.0.0/16\n ) and\n not destination.ip:(\n 10.0.0.0/8 or\n 127.0.0.0/8 or\n 169.254.0.0/16 or\n 172.16.0.0/12 or\n 192.0.0.0/24 or\n 192.0.0.0/29 or\n 192.0.0.8/32 or\n 192.0.0.9/32 or\n 192.0.0.10/32 or\n 192.0.0.170/32 or\n 192.0.0.171/32 or\n 192.0.2.0/24 or\n 192.31.196.0/24 or\n 192.52.193.0/24 or\n 192.168.0.0/16 or\n 192.88.99.0/24 or\n 224.0.0.0/4 or\n 100.64.0.0/10 or\n 192.175.48.0/24 or\n 198.18.0.0/15 or\n 198.51.100.0/24 or\n 203.0.113.0/24 or\n 240.0.0.0/4 or\n \"::1\" or\n \"FE80::/10\" or\n \"FF00::/8\"\n )\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + } + ], + "risk_score": 73, + "rule_id": "c82b2bd8-d701-420c-ba43-f11a155b681a", + "severity": "high", + "tags": [ + "Tactic: Initial Access", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 102 + }, + "id": "c82b2bd8-d701-420c-ba43-f11a155b681a_102", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1_107.json b/packages/security_detection_engine/kibana/security_rule/c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1_107.json new file mode 100644 index 00000000000..d6830d8f57c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1_107.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unexpected processes making network connections over port 445. Windows File Sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel. Processes making 445/tcp connections may be port scanners, exploits, or suspicious user-level processes moving laterally.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Direct Outbound SMB Connection", + "note": "## Triage and analysis\n\n### Investigating Direct Outbound SMB Connection\n\nThis rule looks for unexpected processes making network connections over port 445. Windows file sharing is typically implemented over Server Message Block (SMB), which communicates between hosts using port 445. When legitimate, these network connections are established by the kernel (PID 4). Occurrences of non-system processes using this port can indicate port scanners, exploits, and tools used to move laterally on the environment.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.pid != 4 and\n not (process.executable : \"D:\\\\EnterpriseCare\\\\tools\\\\jre.1\\\\bin\\\\java.exe\" and process.args : \"com.emeraldcube.prism.launcher.Invoker\") and\n not (process.executable : \"C:\\\\Docusnap 11\\\\Tools\\\\nmap\\\\nmap.exe\" and process.args : \"smb-os-discovery.nse\") and\n not process.executable :\n (\"?:\\\\Program Files\\\\SentinelOne\\\\Sentinel Agent *\\\\Ranger\\\\SentinelRanger.exe\",\n \"?:\\\\Program Files\\\\Ivanti\\\\Security Controls\\\\ST.EngineHost.exe\",\n \"?:\\\\Program Files (x86)\\\\Fortinet\\\\FSAE\\\\collectoragent.exe\",\n \"?:\\\\Program Files (x86)\\\\Nmap\\\\nmap.exe\",\n \"?:\\\\Program Files\\\\Azure Advanced Threat Protection Sensor\\\\*\\\\Microsoft.Tri.Sensor.exe\",\n \"?:\\\\Program Files\\\\CloudMatters\\\\auvik\\\\AuvikService-release-*\\\\AuvikService.exe\",\n \"?:\\\\Program Files\\\\uptime software\\\\uptime\\\\UptimeDataCollector.exe\",\n \"?:\\\\Program Files\\\\CloudMatters\\\\auvik\\\\AuvikAgentService.exe\",\n \"?:\\\\Program Files\\\\Rumble\\\\rumble-agent-*.exe\")]\n [network where host.os.type == \"windows\" and destination.port == 445 and process.pid != 4 and\n not cidrmatch(destination.ip, \"127.0.0.1\", \"::1\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "c82c7d8f-fb9e-4874-a4bd-fd9e3f9becf1_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c85eb82c-d2c8-485c-a36f-534f914b7663_103.json b/packages/security_detection_engine/kibana/security_rule/c85eb82c-d2c8-485c-a36f-534f914b7663_103.json new file mode 100644 index 00000000000..37c2cea003f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c85eb82c-d2c8-485c-a36f-534f914b7663_103.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "An adversary may attempt to get detailed information about the operating system and hardware. This rule identifies common locations used to discover virtual machine hardware by a non-root user. This technique has been used by the Pupy RAT and other malware.", + "false_positives": [ + "Certain tools or automated software may enumerate hardware information. These tools can be exempted via user name or process arguments to eliminate potential noise." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Virtual Machine Fingerprinting via Grep", + "note": "", + "query": "process where event.type == \"start\" and\n process.name in (\"grep\", \"egrep\") and user.id != \"0\" and\n process.args : (\"parallels*\", \"vmware*\", \"virtualbox*\") and process.args : \"Manufacturer*\" and\n not process.parent.executable in (\"/Applications/Docker.app/Contents/MacOS/Docker\", \"/usr/libexec/kcare/virt-what\")\n", + "references": [ + "https://objective-see.com/blog/blog_0x4F.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c85eb82c-d2c8-485c-a36f-534f914b7663", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 103 + }, + "id": "c85eb82c-d2c8-485c-a36f-534f914b7663_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c88d4bd0-5649-4c52-87ea-9be59dbfbcf2_104.json b/packages/security_detection_engine/kibana/security_rule/c88d4bd0-5649-4c52-87ea-9be59dbfbcf2_104.json new file mode 100644 index 00000000000..8886fa18aaf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c88d4bd0-5649-4c52-87ea-9be59dbfbcf2_104.json @@ -0,0 +1,130 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies parent process spoofing used to thwart detection. Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Parent Process PID Spoofing", + "query": "/* This rule is compatible with Elastic Endpoint only */\n\nsequence by host.id, user.id with maxspan=3m \n\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.Ext.token.integrity_level_name != \"system\" and \n (\n process.pe.original_file_name : (\"winword.exe\", \"excel.exe\", \"outlook.exe\", \"powerpnt.exe\", \"eqnedt32.exe\",\n \"fltldr.exe\", \"mspub.exe\", \"msaccess.exe\", \"powershell.exe\", \"pwsh.exe\",\n \"cscript.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\", \"msbuild.exe\",\n \"mshta.exe\", \"wmic.exe\", \"cmstp.exe\", \"msxsl.exe\") or \n \n (process.executable : (\"?:\\\\Users\\\\*.exe\",\n \"?:\\\\ProgramData\\\\*.exe\",\n \"?:\\\\Windows\\\\Temp\\\\*.exe\",\n \"?:\\\\Windows\\\\Tasks\\\\*\") and \n (process.code_signature.exists == false or process.code_signature.status : \"errorBadDigest\")) or \n \n process.executable : \"?:\\\\Windows\\\\Microsoft.NET\\\\*.exe\" \n ) and \n \n not process.executable : \n (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\", \n \"?:\\\\WINDOWS\\\\SysWOW64\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\")\n ] by process.pid\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.Ext.real.pid \u003e 0 and \n \n /* process.parent.Ext.real.pid is only populated if the parent process pid doesn't match */\n not (process.name : \"msedge.exe\" and process.parent.name : \"sihost.exe\") and \n \n not process.executable : \n (\"?:\\\\Windows\\\\System32\\\\WerFaultSecure.exe\", \n \"?:\\\\WINDOWS\\\\SysWOW64\\\\WerFaultSecure.exe\",\n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\",\n \"?:\\\\Windows\\\\SysWOW64\\\\WerFault.exe\")\n ] by process.parent.Ext.real.pid\n", + "references": [ + "https://blog.didierstevens.com/2017/03/20/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.parent.Ext.real.pid", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1134", + "name": "Access Token Manipulation", + "reference": "https://attack.mitre.org/techniques/T1134/", + "subtechnique": [ + { + "id": "T1134.004", + "name": "Parent PID Spoofing", + "reference": "https://attack.mitre.org/techniques/T1134/004/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "c88d4bd0-5649-4c52-87ea-9be59dbfbcf2_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_3.json b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_3.json new file mode 100644 index 00000000000..da77435ed9c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_3.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Ransomware Note Creation Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s \n [ file where host.os.type == \"linux\" and event.type == \"change\" and\n event.action == \"rename\" and file.extension != \"\" and \n file.path : (\n \"/home/*\", \"/etc/*\", \"/root/*\", \"/opt/*\", \"/var/backups/*\", \"/var/lib/log/*\"\n ) and not \n file.extension : (\n \"xml\", \"json\", \"conf\", \"dat\", \"gz\", \"info\", \"mod\", \"final\",\n \"php\", \"pyc\", \"log\", \"bak\", \"bin\", \"csv\", \"pdf\", \"cfg\", \"*old\"\n ) and not \n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\"\n ) ] with runs=100\n [ file where host.os.type == \"linux\" and event.action == \"creation\" and file.extension == \"txt\" and \n file.name : (\n \"*crypt*\", \"*restore*\", \"*lock*\", \"*recovery*\", \"*data*\", \n \"*read*\", \"*instruction*\", \"*how_to*\", \"*ransom*\"\n ) ] | tail 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_4.json b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_4.json new file mode 100644 index 00000000000..02735569429 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_4.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Ransomware Note Creation Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s \n [ file where host.os.type == \"linux\" and event.type == \"change\" and\n event.action == \"rename\" and file.extension != \"\" and \n file.path : (\n \"/home/*\", \"/etc/*\", \"/root/*\", \"/opt/*\", \"/var/backups/*\", \"/var/lib/log/*\"\n ) and not \n file.extension : (\n \"xml\", \"json\", \"conf\", \"dat\", \"gz\", \"info\", \"mod\", \"final\",\n \"php\", \"pyc\", \"log\", \"bak\", \"bin\", \"csv\", \"pdf\", \"cfg\", \"*old\"\n ) and not \n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\"\n ) ] with runs=100\n [ file where host.os.type == \"linux\" and event.action == \"creation\" and file.extension == \"txt\" and \n file.name : (\n \"*crypt*\", \"*restore*\", \"*lock*\", \"*recovery*\", \"*data*\", \n \"*read*\", \"*instruction*\", \"*how_to*\", \"*ransom*\"\n ) and not process.name : (\"go\", \"java\", \"pip*\", \"python*\", \"node\", \"containerd\") ] | tail 1\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_5.json b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_5.json new file mode 100644 index 00000000000..e0f0a60d734 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c8935a8b-634a-4449-98f7-bb24d3b2c0af_5.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule identifies a sequence of a mass file encryption event in conjunction with the creation of a .txt file with a file name containing ransomware keywords executed by the same process in a 1 second timespan. Ransomware is a type of malware that encrypts a victim's files or systems and demands payment (usually in cryptocurrency) in exchange for the decryption key. One important indicator of a ransomware attack is the mass encryption of the file system, after which a new file extension is added to the file.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Ransomware Note Creation Detected", + "query": "sequence by host.id, process.entity_id with maxspan=1s \n [file where host.os.type == \"linux\" and event.type == \"change\" and event.action == \"rename\" and file.extension : \"?*\" \n and ((process.name in (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"ash\", \"openssl\")) or\n (process.executable : (\"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/dev/shm/*\", \"/var/run/*\", \"/boot/*\", \"/srv/*\", \"/run/*\"))) and\n file.path : (\n \"/home/*/Downloads/*\", \"/home/*/Documents/*\", \"/root/*\", \"/bin/*\", \"/usr/bin/*\",\n \"/opt/*\", \"/etc/*\", \"/var/log/*\", \"/var/lib/log/*\", \"/var/backup/*\", \"/var/www/*\") and not ((\n process.name : (\n \"dpkg\", \"yum\", \"dnf\", \"rpm\", \"dockerd\", \"go\", \"java\", \"pip*\", \"python*\", \"node\", \"containerd\", \"php\", \"p4d\",\n \"conda\", \"chrome\", \"imap\", \"cmake\", \"firefox\", \"semanage\", \"semodule\", \"ansible-galaxy\", \"fc-cache\", \"jammy\", \"git\",\n \"systemsettings\", \"vmis-launcher\")) or (file.path : \"/etc/selinux/*\") or (file.extension in (\"qmlc\", \"txt\")\n ))] with runs=25\n [file where host.os.type == \"linux\" and event.action == \"creation\" and file.name : (\n \"*crypt*\", \"*restore*\", \"*lock*\", \"*recovery*\", \"*data*\", \"*read*\", \"*instruction*\", \"*how_to*\", \"*ransom*\"\n )]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 5 + }, + "id": "c8935a8b-634a-4449-98f7-bb24d3b2c0af_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c8b150f0-0164-475b-a75e-74b47800a9ff_107.json b/packages/security_detection_engine/kibana/security_rule/c8b150f0-0164-475b-a75e-74b47800a9ff_107.json new file mode 100644 index 00000000000..e90cf674060 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c8b150f0-0164-475b-a75e-74b47800a9ff_107.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious startup shell folder modifications to change the default Startup directory in order to bypass detections monitoring file creation in the Windows Startup folder.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Startup Shell Folder Modification", + "note": "## Triage and analysis\n\n### Investigating Suspicious Startup Shell Folder Modification\n\nTechniques used within malware and by adversaries often leverage the Windows registry to store malicious programs for persistence. Startup shell folders are often targeted as they are not as prevalent as normal Startup folder paths so this behavior may evade existing AV/EDR solutions. These programs may also run with higher privileges which can be ideal for an attacker.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Review the source process and related file tied to the Windows Registry entry.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- There is a high possibility of benign legitimate programs being added to shell folders. This activity could be based on new software installations, patches, or other network administrator activity. Before undertaking further investigation, it should be verified that this activity is not benign.\n\n### Related rules\n\n- Startup or Run Key Registry Modification - 97fc44d3-8dae-4019-ae83-298c3015600f\n- Persistent Scripts in the Startup Directory - f7c4dc5a-a58d-491d-9f14-9b66507121c0\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Common Startup\",\n \"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Common Startup\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Startup\",\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Common Startup\",\n \"\\\\REGISTRY\\\\MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Common Startup\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\User Shell Folders\\\\Startup\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\Shell Folders\\\\Startup\"\n ) and\n registry.data.strings != null and\n /* Normal Startup Folder Paths */\n not registry.data.strings : (\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"%ProgramData%\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"%USERPROFILE%\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "c8b150f0-0164-475b-a75e-74b47800a9ff", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "c8b150f0-0164-475b-a75e-74b47800a9ff_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c8cccb06-faf2-4cd5-886e-2c9636cfcb87_106.json b/packages/security_detection_engine/kibana/security_rule/c8cccb06-faf2-4cd5-886e-2c9636cfcb87_106.json new file mode 100644 index 00000000000..89841230f60 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c8cccb06-faf2-4cd5-886e-2c9636cfcb87_106.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the Set-MpPreference PowerShell command to disable or weaken certain Windows Defender settings.", + "false_positives": [ + "Planned Windows Defender configuration changes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Disabling Windows Defender Security Settings via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Disabling Windows Defender Security Settings via PowerShell\n\nMicrosoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.\n\nThis rule monitors the execution of commands that can tamper the Windows Defender antivirus features.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to determine which action was executed. Based on that, examine exceptions, antivirus state, sample submission, etc.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.\n\n### Related rules\n\n- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb\n- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Based on the command line, take actions to restore the appropriate Windows Defender antivirus configurations.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name in (\"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\")) and\n process.args : \"Set-MpPreference\" and process.args : (\"-Disable*\", \"Disabled\", \"NeverSend\", \"-Exclusion*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "c8cccb06-faf2-4cd5-886e-2c9636cfcb87", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "c8cccb06-faf2-4cd5-886e-2c9636cfcb87_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_1.json b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_1.json new file mode 100644 index 00000000000..edc281842a3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_1.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as Communication Apps", + "query": "process where host.os.type == \"windows\" and\n event.type == \"start\" and\n (\n /* Slack */\n (process.name : \"slack.exe\" and not\n (process.code_signature.subject_name : \"Slack Technologies, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* WebEx */\n (process.name : \"WebexHost.exe\" and not\n (process.code_signature.subject_name : (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and process.code_signature.trusted == true)\n ) or\n\n /* Teams */\n (process.name : \"Teams.exe\" and not\n (process.code_signature.subject_name : \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Discord */\n (process.name : \"Discord.exe\" and not\n (process.code_signature.subject_name : \"Discord Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* RocketChat */\n (process.name : \"Rocket.Chat.exe\" and not\n (process.code_signature.subject_name : \"Rocket.Chat Technologies Corp.\" and process.code_signature.trusted == true)\n ) or\n\n /* Mattermost */\n (process.name : \"Mattermost.exe\" and not\n (process.code_signature.subject_name : \"Mattermost, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* WhatsApp */\n (process.name : \"WhatsApp.exe\" and not\n (process.code_signature.subject_name : \"WhatsApp LLC\" and process.code_signature.trusted == true)\n ) or\n\n /* Zoom */\n (process.name : \"Zoom.exe\" and not\n (process.code_signature.subject_name : \"Zoom Video Communications, Inc.\" and process.code_signature.trusted == true)\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c9482bfa-a553-4226-8ea2-4959bd4f7923", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "c9482bfa-a553-4226-8ea2-4959bd4f7923_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_2.json b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_2.json new file mode 100644 index 00000000000..9a2a8e533ec --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_2.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as Communication Apps", + "query": "process where host.os.type == \"windows\" and\n event.type == \"start\" and\n (\n /* Slack */\n (process.name : \"slack.exe\" and not\n (process.code_signature.subject_name in (\n \"Slack Technologies, Inc.\",\n \"Slack Technologies, LLC\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* WebEx */\n (process.name : \"WebexHost.exe\" and not\n (process.code_signature.subject_name in (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and process.code_signature.trusted == true)\n ) or\n\n /* Teams */\n (process.name : \"Teams.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Discord */\n (process.name : \"Discord.exe\" and not\n (process.code_signature.subject_name == \"Discord Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* RocketChat */\n (process.name : \"Rocket.Chat.exe\" and not\n (process.code_signature.subject_name == \"Rocket.Chat Technologies Corp.\" and process.code_signature.trusted == true)\n ) or\n\n /* Mattermost */\n (process.name : \"Mattermost.exe\" and not\n (process.code_signature.subject_name == \"Mattermost, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* WhatsApp */\n (process.name : \"WhatsApp.exe\" and not\n (process.code_signature.subject_name in (\n \"WhatsApp LLC\",\n \"WhatsApp, Inc\",\n \"24803D75-212C-471A-BC57-9EF86AB91435\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* Zoom */\n (process.name : \"Zoom.exe\" and not\n (process.code_signature.subject_name == \"Zoom Video Communications, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Outlook */\n (process.name : \"outlook.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Thunderbird */\n (process.name : \"thunderbird.exe\" and not\n (process.code_signature.subject_name == \"Mozilla Corporation\" and process.code_signature.trusted == true)\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c9482bfa-a553-4226-8ea2-4959bd4f7923", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "c9482bfa-a553-4226-8ea2-4959bd4f7923_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_3.json b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_3.json new file mode 100644 index 00000000000..e5288b4f8f8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/c9482bfa-a553-4226-8ea2-4959bd4f7923_3.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of communications apps, both unsigned and renamed ones, that can indicate an attempt to conceal malicious activity, bypass security features such as allowlists, or trick users into executing malware.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as Communication Apps", + "query": "process where host.os.type == \"windows\" and\n event.type == \"start\" and\n (\n /* Slack */\n (process.name : \"slack.exe\" and not\n (process.code_signature.subject_name in (\n \"Slack Technologies, Inc.\",\n \"Slack Technologies, LLC\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* WebEx */\n (process.name : \"WebexHost.exe\" and not\n (process.code_signature.subject_name in (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and process.code_signature.trusted == true)\n ) or\n\n /* Teams */\n (process.name : \"Teams.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Discord */\n (process.name : \"Discord.exe\" and not\n (process.code_signature.subject_name == \"Discord Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* RocketChat */\n (process.name : \"Rocket.Chat.exe\" and not\n (process.code_signature.subject_name == \"Rocket.Chat Technologies Corp.\" and process.code_signature.trusted == true)\n ) or\n\n /* Mattermost */\n (process.name : \"Mattermost.exe\" and not\n (process.code_signature.subject_name == \"Mattermost, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* WhatsApp */\n (process.name : \"WhatsApp.exe\" and not\n (process.code_signature.subject_name in (\n \"WhatsApp LLC\",\n \"WhatsApp, Inc\",\n \"24803D75-212C-471A-BC57-9EF86AB91435\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* Zoom */\n (process.name : \"Zoom.exe\" and not\n (process.code_signature.subject_name == \"Zoom Video Communications, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Outlook */\n (process.name : \"outlook.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Thunderbird */\n (process.name : \"thunderbird.exe\" and not\n (process.code_signature.subject_name == \"Mozilla Corporation\" and process.code_signature.trusted == true)\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "c9482bfa-a553-4226-8ea2-4959bd4f7923", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "c9482bfa-a553-4226-8ea2-4959bd4f7923_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ca98c7cf-a56e-4057-a4e8-39603f7f0389_4.json b/packages/security_detection_engine/kibana/security_rule/ca98c7cf-a56e-4057-a4e8-39603f7f0389_4.json new file mode 100644 index 00000000000..59509cfb2d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ca98c7cf-a56e-4057-a4e8-39603f7f0389_4.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a Windows trusted program running from locations often abused by adversaries to masquerade as a trusted program and loading a recently dropped DLL. This behavior may indicate an attempt to evade defenses via side-loading a malicious DLL within the memory space of a signed processes.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unsigned DLL Side-Loading from a Suspicious Folder", + "note": "", + "query": "library where host.os.type == \"windows\" and\n\n process.code_signature.trusted == true and \n \n (dll.Ext.relative_file_creation_time \u003c= 500 or dll.Ext.relative_file_name_modify_time \u003c= 500) and \n \n not dll.code_signature.status : (\"trusted\", \"errorExpired\", \"errorCode_endpoint*\", \"errorChaining\") and \n \n /* Suspicious Paths */\n dll.path : (\"?:\\\\PerfLogs\\\\*.dll\",\n \"?:\\\\Users\\\\*\\\\Pictures\\\\*.dll\",\n \"?:\\\\Users\\\\*\\\\Music\\\\*.dll\",\n \"?:\\\\Users\\\\Public\\\\*.dll\",\n \"?:\\\\Users\\\\*\\\\Documents\\\\*.dll\",\n \"?:\\\\Windows\\\\Tasks\\\\*.dll\",\n \"?:\\\\Windows\\\\System32\\\\Tasks\\\\*.dll\",\n \"?:\\\\Intel\\\\*.dll\",\n \"?:\\\\AMD\\\\Temp\\\\*.dll\",\n \"?:\\\\Windows\\\\AppReadiness\\\\*.dll\",\n \"?:\\\\Windows\\\\ServiceState\\\\*.dll\",\n \"?:\\\\Windows\\\\security\\\\*.dll\",\n\t\t \"?:\\\\Windows\\\\System\\\\*.dll\",\n \"?:\\\\Windows\\\\IdentityCRL\\\\*.dll\",\n \"?:\\\\Windows\\\\Branding\\\\*.dll\",\n \"?:\\\\Windows\\\\csc\\\\*.dll\",\n \"?:\\\\Windows\\\\DigitalLocker\\\\*.dll\",\n \"?:\\\\Windows\\\\en-US\\\\*.dll\",\n \"?:\\\\Windows\\\\wlansvc\\\\*.dll\",\n \"?:\\\\Windows\\\\Prefetch\\\\*.dll\",\n \"?:\\\\Windows\\\\Fonts\\\\*.dll\",\n \"?:\\\\Windows\\\\diagnostics\\\\*.dll\",\n \"?:\\\\Windows\\\\TAPI\\\\*.dll\",\n \"?:\\\\Windows\\\\INF\\\\*.dll\",\n \"?:\\\\windows\\\\tracing\\\\*.dll\",\n \"?:\\\\windows\\\\IME\\\\*.dll\",\n \"?:\\\\Windows\\\\Performance\\\\*.dll\",\n \"?:\\\\windows\\\\intel\\\\*.dll\",\n \"?:\\\\windows\\\\ms\\\\*.dll\",\n \"?:\\\\Windows\\\\dot3svc\\\\*.dll\",\n \"?:\\\\Windows\\\\ServiceProfiles\\\\*.dll\",\n \"?:\\\\Windows\\\\panther\\\\*.dll\",\n \"?:\\\\Windows\\\\RemotePackages\\\\*.dll\",\n \"?:\\\\Windows\\\\OCR\\\\*.dll\",\n \"?:\\\\Windows\\\\appcompat\\\\*.dll\",\n \"?:\\\\Windows\\\\apppatch\\\\*.dll\",\n \"?:\\\\Windows\\\\addins\\\\*.dll\",\n \"?:\\\\Windows\\\\Setup\\\\*.dll\",\n \"?:\\\\Windows\\\\Help\\\\*.dll\",\n \"?:\\\\Windows\\\\SKB\\\\*.dll\",\n \"?:\\\\Windows\\\\Vss\\\\*.dll\",\n \"?:\\\\Windows\\\\Web\\\\*.dll\",\n \"?:\\\\Windows\\\\servicing\\\\*.dll\",\n \"?:\\\\Windows\\\\CbsTemp\\\\*.dll\",\n \"?:\\\\Windows\\\\Logs\\\\*.dll\",\n \"?:\\\\Windows\\\\WaaS\\\\*.dll\",\n \"?:\\\\Windows\\\\twain_32\\\\*.dll\",\n \"?:\\\\Windows\\\\ShellExperiences\\\\*.dll\",\n \"?:\\\\Windows\\\\ShellComponents\\\\*.dll\",\n \"?:\\\\Windows\\\\PLA\\\\*.dll\",\n \"?:\\\\Windows\\\\Migration\\\\*.dll\",\n \"?:\\\\Windows\\\\debug\\\\*.dll\",\n \"?:\\\\Windows\\\\Cursors\\\\*.dll\",\n \"?:\\\\Windows\\\\Containers\\\\*.dll\",\n \"?:\\\\Windows\\\\Boot\\\\*.dll\",\n \"?:\\\\Windows\\\\bcastdvr\\\\*.dll\",\n \"?:\\\\Windows\\\\TextInput\\\\*.dll\",\n \"?:\\\\Windows\\\\schemas\\\\*.dll\",\n \"?:\\\\Windows\\\\SchCache\\\\*.dll\",\n \"?:\\\\Windows\\\\Resources\\\\*.dll\",\n \"?:\\\\Windows\\\\rescache\\\\*.dll\",\n \"?:\\\\Windows\\\\Provisioning\\\\*.dll\",\n \"?:\\\\Windows\\\\PrintDialog\\\\*.dll\",\n \"?:\\\\Windows\\\\PolicyDefinitions\\\\*.dll\",\n \"?:\\\\Windows\\\\media\\\\*.dll\",\n \"?:\\\\Windows\\\\Globalization\\\\*.dll\",\n \"?:\\\\Windows\\\\L2Schemas\\\\*.dll\",\n \"?:\\\\Windows\\\\LiveKernelReports\\\\*.dll\",\n \"?:\\\\Windows\\\\ModemLogs\\\\*.dll\",\n \"?:\\\\Windows\\\\ImmersiveControlPanel\\\\*.dll\",\n \"?:\\\\$Recycle.Bin\\\\*.dll\") and \n\t \n\t /* DLL loaded from the process.executable current directory */\n\t endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)), substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "dll.Ext.relative_file_creation_time", + "type": "unknown" + }, + { + "ecs": false, + "name": "dll.Ext.relative_file_name_modify_time", + "type": "unknown" + }, + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ca98c7cf-a56e-4057-a4e8-39603f7f0389", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.002", + "name": "DLL Side-Loading", + "reference": "https://attack.mitre.org/techniques/T1574/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "ca98c7cf-a56e-4057-a4e8-39603f7f0389_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_207.json b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_207.json new file mode 100644 index 00000000000..039e5d7fbb4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_207.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.", + "false_positives": [ + "False-Positives (FP) can appear if the PID file is legitimate and holding a process ID as intended. To differentiate, if the PID file is an executable or larger than 10 bytes, it should be ruled suspicious." + ], + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Abnormal Process ID or Lock File Created", + "new_terms_fields": [ + "process.executable", + "file.path" + ], + "note": "## Triage and analysis\n\n### Investigating Abnormal Process ID or Lock File Created\n\nLinux applications may need to save their process identification number (PID) for various purposes: from signaling that a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID files contain its creator process PID in an integer value.\n\nLinux lock files are used to coordinate operations in files so that conflicts and race conditions are prevented.\n\nThis rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade malware, payloads, staged data for exfiltration, and more as legitimate PID files.\n\n#### Possible investigation steps\n\n- Retrieve the file and determine if it is malicious:\n - Check the contents of the PID files. They should only contain integer strings.\n - Check the file type of the lock and PID files to determine if they are executables. This is only observed in malicious files.\n - Check the size of the subject file. Legitimate PID files should be under 10 bytes.\n - Check if the lock or PID file has high entropy. This typically indicates an encrypted payload.\n - Analysts can use tools like `ent` to measure entropy.\n - Examine the reputation of the SHA-256 hash in the PID file. Use a database like VirusTotal to identify additional pivots and artifacts for investigation.\n- Trace the file's creation to ensure it came from a legitimate or authorized process.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of file name and process executable conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Block the identified indicators of compromise (IoCs).\n- Take actions to terminate processes and connections used by the attacker.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.category : \"file\" and event.action : (\"creation\" or \"file_create_event\") and\nuser.id : \"0\" and file.path : (/var/run/* or /run/*) and file.extension : (\"pid\" or \"lock\" or \"reboot\") and not \nfile.name : (\"auditd.pid\" or \"python*\" or \"apport.pid\" or \"apport.lock\" or \"kworker*\" or \"gdm3.pid\" or \"sshd.pid\" or \n\"acpid.pid\" or \"unattended-upgrades.lock\" or \"unattended-upgrades.pid\" or \"cmd.pid\" or \"yum.pid\" or \"netconfig.pid\" or \n\"docker.pid\" or \"atd.pid\" or \"lfd.pid\" or \"atop.pid\" or \"nginx.pid\" or \"dhclient.pid\" or \"smtpd.pid\" or \"stunnel.pid\" or \n\"1_waagent.pid\" or \"crond.pid\" or \"cron.reboot\" or \"sssd.pid\" or \"tomcat8.pid\")\n", + "references": [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cac91072-d165-11ec-a764-f661ea17fbce", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 207 + }, + "id": "cac91072-d165-11ec-a764-f661ea17fbce_207", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_208.json b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_208.json new file mode 100644 index 00000000000..d6142151597 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_208.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.", + "false_positives": [ + "False-Positives (FP) can appear if the PID file is legitimate and holding a process ID as intended. To differentiate, if the PID file is an executable or larger than 10 bytes, it should be ruled suspicious." + ], + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Abnormal Process ID or Lock File Created", + "new_terms_fields": [ + "process.executable", + "file.path" + ], + "note": "## Triage and analysis\n\n### Investigating Abnormal Process ID or Lock File Created\n\nLinux applications may need to save their process identification number (PID) for various purposes: from signaling that a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID files contain its creator process PID in an integer value.\n\nLinux lock files are used to coordinate operations in files so that conflicts and race conditions are prevented.\n\nThis rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade malware, payloads, staged data for exfiltration, and more as legitimate PID files.\n\n#### Possible investigation steps\n\n- Retrieve the file and determine if it is malicious:\n - Check the contents of the PID files. They should only contain integer strings.\n - Check the file type of the lock and PID files to determine if they are executables. This is only observed in malicious files.\n - Check the size of the subject file. Legitimate PID files should be under 10 bytes.\n - Check if the lock or PID file has high entropy. This typically indicates an encrypted payload.\n - Analysts can use tools like `ent` to measure entropy.\n - Examine the reputation of the SHA-256 hash in the PID file. Use a database like VirusTotal to identify additional pivots and artifacts for investigation.\n- Trace the file's creation to ensure it came from a legitimate or authorized process.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of file name and process executable conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Block the identified indicators of compromise (IoCs).\n- Take actions to terminate processes and connections used by the attacker.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type : \"linux\" and event.category : \"file\" and event.action : (\"creation\" or \"file_create_event\") and\nuser.id : \"0\" and file.extension : (\"pid\" or \"lock\" or \"reboot\") and file.path : (/var/run/* or /run/*) and not \nfile.name : (\"auditd.pid\" or python* or \"apport.pid\" or \"apport.lock\" or kworker* or \"gdm3.pid\" or \"sshd.pid\" or \n\"acpid.pid\" or \"unattended-upgrades.lock\" or \"unattended-upgrades.pid\" or \"cmd.pid\" or \"yum.pid\" or \"netconfig.pid\" or \n\"docker.pid\" or \"atd.pid\" or \"lfd.pid\" or \"atop.pid\" or \"nginx.pid\" or \"dhclient.pid\" or \"smtpd.pid\" or \"stunnel.pid\" or \n\"1_waagent.pid\" or \"crond.pid\" or \"cron.reboot\" or \"sssd.pid\" or \"tomcat8.pid\" or \"winbindd.pid\" or \"chronyd.pid\") and\nnot process.name : (\"runc\" or \"ufw\" or \"snapd\" or \"snap\" or \"iptables\")\n", + "references": [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cac91072-d165-11ec-a764-f661ea17fbce", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 208 + }, + "id": "cac91072-d165-11ec-a764-f661ea17fbce_208", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_209.json b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_209.json new file mode 100644 index 00000000000..9f66ede666d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cac91072-d165-11ec-a764-f661ea17fbce_209.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a Process ID (PID), lock or reboot file created in temporary file storage paradigm (tmpfs) directory /var/run. On Linux, the PID files typically hold the process ID to track previous copies running and manage other tasks. Certain Linux malware use the /var/run directory for holding data, executables and other tasks, disguising itself or these files as legitimate PID files.", + "false_positives": [ + "False-Positives (FP) can appear if the PID file is legitimate and holding a process ID as intended. To differentiate, if the PID file is an executable or larger than 10 bytes, it should be ruled suspicious." + ], + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Abnormal Process ID or Lock File Created", + "new_terms_fields": [ + "process.executable", + "file.path" + ], + "note": "## Triage and analysis\n\n### Investigating Abnormal Process ID or Lock File Created\n\nLinux applications may need to save their process identification number (PID) for various purposes: from signaling that a program is running to serving as a signal that a previous instance of an application didn't exit successfully. PID files contain its creator process PID in an integer value.\n\nLinux lock files are used to coordinate operations in files so that conflicts and race conditions are prevented.\n\nThis rule identifies the creation of PID, lock, or reboot files in the /var/run/ directory. Attackers can masquerade malware, payloads, staged data for exfiltration, and more as legitimate PID files.\n\n#### Possible investigation steps\n\n- Retrieve the file and determine if it is malicious:\n - Check the contents of the PID files. They should only contain integer strings.\n - Check the file type of the lock and PID files to determine if they are executables. This is only observed in malicious files.\n - Check the size of the subject file. Legitimate PID files should be under 10 bytes.\n - Check if the lock or PID file has high entropy. This typically indicates an encrypted payload.\n - Analysts can use tools like `ent` to measure entropy.\n - Examine the reputation of the SHA-256 hash in the PID file. Use a database like VirusTotal to identify additional pivots and artifacts for investigation.\n- Trace the file's creation to ensure it came from a legitimate or authorized process.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n- Investigate any abnormal behavior by the subject process such as network connections, file modifications, and any spawned child processes.\n\n### False positive analysis\n\n- False positives can appear if the PID file is legitimate and holding a process ID as intended. If the PID file is an executable or has a file size that's larger than 10 bytes, it should be ruled suspicious.\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of file name and process executable conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Block the identified indicators of compromise (IoCs).\n- Take actions to terminate processes and connections used by the attacker.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "host.os.type:linux and event.category:file and event.action:creation and\nuser.id:0 and file.extension:(pid or lock or reboot) and file.path:(/var/run/* or /run/*) and (\n (process.name : (\n bash or dash or sh or tcsh or csh or zsh or ksh or fish or ash or touch or nano or vim or vi or editor or mv or cp)\n ) or (\n process.executable : (\n ./* or /tmp/* or /var/tmp/* or /dev/shm/* or /var/run/* or /boot/* or /srv/* or /run/*\n ))\n) and not process.name : (go or git)\n", + "references": [ + "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", + "https://twitter.com/GossiTheDog/status/1522964028284411907", + "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf", + "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cac91072-d165-11ec-a764-f661ea17fbce", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: BPFDoor", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1106", + "name": "Native API", + "reference": "https://attack.mitre.org/techniques/T1106/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 209 + }, + "id": "cac91072-d165-11ec-a764-f661ea17fbce_209", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51_104.json b/packages/security_detection_engine/kibana/security_rule/cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51_104.json new file mode 100644 index 00000000000..b89ad384bfa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51_104.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious modifications of the calendar file by an unusual process. Adversaries may create a custom calendar notification procedure to execute a malicious program at a recurring interval to establish persistence.", + "false_positives": [ + "Trusted applications for managing calendars and reminders." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "auditbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Calendar File Modification", + "query": "event.category:file and host.os.type:macos and event.action:modification and\n file.path:/Users/*/Library/Calendars/*.calendar/Events/*.ics and\n process.executable:\n (* and not\n (\n /System/Library/* or\n /System/Applications/Calendar.app/Contents/MacOS/* or\n /System/Applications/Mail.app/Contents/MacOS/Mail or\n /usr/libexec/xpcproxy or\n /sbin/launchd or\n /Applications/*\n )\n )\n", + "references": [ + "https://labs.f-secure.com/blog/operationalising-calendar-alerts-persistence-on-macos", + "https://github.com/FSecureLABS/CalendarPersist", + "https://github.com/D00MFist/PersistentJXA/blob/master/CalendarPersist.js" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cb71aa62-55c8-42f0-b0dd-afb0bb0b1f51_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cc2fd2d0-ba3a-4939-b87f-2901764ed036_104.json b/packages/security_detection_engine/kibana/security_rule/cc2fd2d0-ba3a-4939-b87f-2901764ed036_104.json new file mode 100644 index 00000000000..356ddaee183 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cc2fd2d0-ba3a-4939-b87f-2901764ed036_104.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to enable the root account using the dsenableroot command. This command may be abused by adversaries for persistence, as the root account is disabled by default.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Enable the Root Account", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:dsenableroot and not process.args:\"-d\"\n", + "references": [ + "https://ss64.com/osx/dsenableroot.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cc2fd2d0-ba3a-4939-b87f-2901764ed036", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cc2fd2d0-ba3a-4939-b87f-2901764ed036_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_104.json b/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_104.json new file mode 100644 index 00000000000..02338a784c5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly deactivated in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate an Okta Policy Rule", + "note": "## Triage and analysis\n\n### Investigating Attempt to Deactivate an Okta Policy Rule\n\nIdentity and Access Management (IAM) systems like Okta serve as the first line of defense for an organization's network, and are often targeted by adversaries. By disabling security rules, adversaries can circumvent multi-factor authentication, access controls, or other protective measures enforced by these policies, enabling unauthorized access, privilege escalation, or other malicious activities.\n\nThis rule detects attempts to deactivate a rule within an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. A threat actor may do this to remove barriers to their activities or enable future attacks.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.\n- Check the `okta.outcome.result` field to confirm the policy rule deactivation attempt.\n- Check if there are multiple policy rule deactivation attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the policy rule deactivation attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized policy rule deactivation is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.rule.deactivate\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cc92c835-da92-45c9-9f29-b4992ad621a0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cc92c835-da92-45c9-9f29-b4992ad621a0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_105.json b/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_105.json new file mode 100644 index 00000000000..c34562f0c1b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cc92c835-da92-45c9-9f29-b4992ad621a0_105.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate a rule within an Okta policy. An adversary may attempt to deactivate a rule within an Okta policy in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly deactivated in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate an Okta Policy Rule", + "note": "## Triage and analysis\n\n### Investigating Attempt to Deactivate an Okta Policy Rule\n\nIdentity and Access Management (IAM) systems like Okta serve as the first line of defense for an organization's network, and are often targeted by adversaries. By disabling security rules, adversaries can circumvent multi-factor authentication, access controls, or other protective measures enforced by these policies, enabling unauthorized access, privilege escalation, or other malicious activities.\n\nThis rule detects attempts to deactivate a rule within an Okta policy, which could be indicative of an adversary's attempt to weaken an organization's security controls. A threat actor may do this to remove barriers to their activities or enable future attacks.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the deactivation attempt.\n- Check the `okta.outcome.result` field to confirm the policy rule deactivation attempt.\n- Check if there are multiple policy rule deactivation attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the policy rule deactivation attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deactivation attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the deactivation attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deactivation attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized policy rule deactivation is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific deactivation technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.rule.deactivate\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cc92c835-da92-45c9-9f29-b4992ad621a0", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "cc92c835-da92-45c9-9f29-b4992ad621a0_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ccc55af4-9882-4c67-87b4-449a7ae8079c_105.json b/packages/security_detection_engine/kibana/security_rule/ccc55af4-9882-4c67-87b4-449a7ae8079c_105.json new file mode 100644 index 00000000000..ae6b2797b99 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ccc55af4-9882-4c67-87b4-449a7ae8079c_105.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies process execution followed by a file overwrite of an executable by the same parent process. This may indicate an evasion attempt to execute malicious code in a stealthy way.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Process Herpaderping Attempt", + "query": "sequence with maxspan=5s\n [process where host.os.type == \"windows\" and event.type == \"start\" and not process.parent.executable :\n (\n \"?:\\\\Windows\\\\SoftwareDistribution\\\\*.exe\",\n \"?:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\Trend Micro\\\\*.exe\"\n )\n ] by host.id, process.executable, process.parent.entity_id\n [file where host.os.type == \"windows\" and event.type == \"change\" and event.action == \"overwrite\" and file.extension == \"exe\"] by host.id, file.path, process.entity_id\n", + "references": [ + "https://github.com/jxy-s/herpaderping" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "ccc55af4-9882-4c67-87b4-449a7ae8079c", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "ccc55af4-9882-4c67-87b4-449a7ae8079c_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cd16fb10-0261-46e8-9932-a0336278cdbe_104.json b/packages/security_detection_engine/kibana/security_rule/cd16fb10-0261-46e8-9932-a0336278cdbe_104.json new file mode 100644 index 00000000000..f3583726b64 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cd16fb10-0261-46e8-9932-a0336278cdbe_104.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to modify or delete a sign on policy for an Okta application. An adversary may attempt to modify or delete the sign on policy for an Okta application in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if sign on policies for Okta applications are regularly modified or deleted in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Modification or Removal of an Okta Application Sign-On Policy", + "note": "", + "query": "event.dataset:okta.system and event.action:(application.policy.sign_on.update or application.policy.sign_on.rule.delete)\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/App_Based_Signon.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cd16fb10-0261-46e8-9932-a0336278cdbe", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Tactic: Persistence", + "Use Case: Identity and Access Audit", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1556", + "name": "Modify Authentication Process", + "reference": "https://attack.mitre.org/techniques/T1556/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cd16fb10-0261-46e8-9932-a0336278cdbe_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530_103.json b/packages/security_detection_engine/kibana/security_rule/cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530_103.json new file mode 100644 index 00000000000..31a8ed11e8a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "Looks for compiler activity by a user context which does not normally run compilers. This can be the result of ad-hoc software changes or unauthorized software deployment. This can also be due to local privilege elevation via locally run exploits or malware activity.", + "false_positives": [ + "Uncommon compiler activity can be due to an engineer running a local build on a production or staging instance in the course of troubleshooting or fixing a software issue." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_rare_user_compiler" + ], + "name": "Anomalous Linux Compiler Activity", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Resource Development" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0042", + "name": "Resource Development", + "reference": "https://attack.mitre.org/tactics/TA0042/" + }, + "technique": [ + { + "id": "T1588", + "name": "Obtain Capabilities", + "reference": "https://attack.mitre.org/techniques/T1588/", + "subtechnique": [ + { + "id": "T1588.001", + "name": "Malware", + "reference": "https://attack.mitre.org/techniques/T1588/001/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "cd66a419-9b3f-4f57-8ff8-ac4cd2d5f530_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cd66a5af-e34b-4bb0-8931-57d0a043f2ef_105.json b/packages/security_detection_engine/kibana/security_rule/cd66a5af-e34b-4bb0-8931-57d0a043f2ef_105.json new file mode 100644 index 00000000000..c546cd3e0f3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cd66a5af-e34b-4bb0-8931-57d0a043f2ef_105.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This rule identifies attempts to remove a kernel module.", + "false_positives": [ + "There is usually no reason to remove modules, but some buggy modules require it. These can be exempted by username. Note that some Linux distributions are not built to support the removal of modules at all." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Kernel Module Removal", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and process.name == \"rmmod\" or\n(process.name == \"modprobe\" and process.args in (\"--remove\", \"-r\")) and \nprocess.parent.name in (\"sudo\", \"bash\", \"dash\", \"ash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\")\n", + "references": [ + "http://man7.org/linux/man-pages/man8/modprobe.8.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cd66a5af-e34b-4bb0-8931-57d0a043f2ef", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.006", + "name": "Kernel Modules and Extensions", + "reference": "https://attack.mitre.org/techniques/T1547/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "cd66a5af-e34b-4bb0-8931-57d0a043f2ef_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cd82e3d6-1346-4afd-8f22-38388bbf34cb_1.json b/packages/security_detection_engine/kibana/security_rule/cd82e3d6-1346-4afd-8f22-38388bbf34cb_1.json new file mode 100644 index 00000000000..c27f428ef54 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cd82e3d6-1346-4afd-8f22-38388bbf34cb_1.json @@ -0,0 +1,111 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies .url shortcut files downloaded from outside the local network. These shortcut files are commonly used in phishing campaigns.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Downloaded URL Files", + "query": "file where host.os.type == \"windows\" and event.type == \"creation\" and file.extension == \"url\"\n and file.Ext.windows.zone_identifier \u003e 1 and not process.name : \"explorer.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.windows.zone_identifier", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "cd82e3d6-1346-4afd-8f22-38388bbf34cb", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "cd82e3d6-1346-4afd-8f22-38388bbf34cb_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cd89602e-9db0-48e3-9391-ae3bf241acd8_104.json b/packages/security_detection_engine/kibana/security_rule/cd89602e-9db0-48e3-9391-ae3bf241acd8_104.json new file mode 100644 index 00000000000..ffff8c305a2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cd89602e-9db0-48e3-9391-ae3bf241acd8_104.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate multi-factor authentication (MFA) for an Okta user. An adversary may deactivate MFA for an Okta user account in order to weaken the authentication requirements for the account.", + "false_positives": [ + "If the behavior of deactivating MFA for Okta user accounts is expected, consider adding exceptions to this rule to filter false positives." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate MFA for an Okta User Account", + "note": "", + "query": "event.dataset:okta.system and event.action:user.mfa.factor.deactivate\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "cd89602e-9db0-48e3-9391-ae3bf241acd8", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Tactic: Persistence", + "Use Case: Identity and Access Audit", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1098", + "name": "Account Manipulation", + "reference": "https://attack.mitre.org/techniques/T1098/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cd89602e-9db0-48e3-9391-ae3bf241acd8_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_104.json b/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_104.json new file mode 100644 index 00000000000..8fcb10162c2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_104.json @@ -0,0 +1,67 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.", + "from": "now-30m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "interval": "15m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Okta User Session Impersonation", + "note": "## Triage and analysis\n\n### Investigating Okta User Session Impersonation\n\nThe detection of an Okta User Session Impersonation indicates that a user has initiated a session impersonation which grants them access with the permissions of the user they are impersonating. This type of activity typically indicates Okta administrative access and should only ever occur if requested and expected.\n\n#### Possible investigation steps\n\n- Identify the actor associated with the impersonation event by checking the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.\n- Review the `event.action` field to confirm the initiation of the impersonation event.\n- Check the `event.time` field to understand the timing of the event.\n- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the user who was impersonated.\n- Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.\n\n### False positive analysis\n\n- Verify if the session impersonation was part of an approved activity. Check if it was associated with any documented administrative tasks or troubleshooting efforts.\n- Ensure that the impersonation session was initiated by an authorized individual. You can check this by verifying the `okta.actor.id` or `okta.actor.display_name` against the list of approved administrators.\n\n### Response and remediation\n\n- If the impersonation was not authorized, consider it as a breach. Suspend the user account of the impersonator immediately.\n- Reset the user session and invalidate any active sessions related to the impersonated user.\n- If a specific impersonation technique was used, ensure that systems are patched or configured to prevent such techniques.\n- Conduct a thorough investigation to understand the extent of the breach and the potential impact on the systems and data.\n- Review and update your security policies to prevent such incidents in the future.\n- Implement additional monitoring and logging of Okta events to improve visibility of user actions.", + "query": "event.dataset:okta.system and event.action:user.session.impersonation.initiate\n", + "references": [ + "https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "cdbebdc1-dc97-43c6-a538-f26a20c0a911", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "cdbebdc1-dc97-43c6-a538-f26a20c0a911_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_105.json b/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_105.json new file mode 100644 index 00000000000..1072201f250 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cdbebdc1-dc97-43c6-a538-f26a20c0a911_105.json @@ -0,0 +1,66 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A user has initiated a session impersonation granting them access to the environment with the permissions of the user they are impersonating. This would likely indicate Okta administrative access and should only ever occur if requested and expected.", + "from": "now-30m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "interval": "15m", + "language": "kuery", + "license": "Elastic License v2", + "name": "Okta User Session Impersonation", + "note": "## Triage and analysis\n\n### Investigating Okta User Session Impersonation\n\nThe detection of an Okta User Session Impersonation indicates that a user has initiated a session impersonation which grants them access with the permissions of the user they are impersonating. This type of activity typically indicates Okta administrative access and should only ever occur if requested and expected.\n\n#### Possible investigation steps\n\n- Identify the actor associated with the impersonation event by checking the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields.\n- Review the `event.action` field to confirm the initiation of the impersonation event.\n- Check the `event.time` field to understand the timing of the event.\n- Check the `okta.target.id`, `okta.target.type`, `okta.target.alternate_id`, or `okta.target.display_name` to identify the user who was impersonated.\n- Review any activities that occurred during the impersonation session. Look for any activities related to the impersonated user's account during and after the impersonation event.\n\n### False positive analysis\n\n- Verify if the session impersonation was part of an approved activity. Check if it was associated with any documented administrative tasks or troubleshooting efforts.\n- Ensure that the impersonation session was initiated by an authorized individual. You can check this by verifying the `okta.actor.id` or `okta.actor.display_name` against the list of approved administrators.\n\n### Response and remediation\n\n- If the impersonation was not authorized, consider it as a breach. Suspend the user account of the impersonator immediately.\n- Reset the user session and invalidate any active sessions related to the impersonated user.\n- If a specific impersonation technique was used, ensure that systems are patched or configured to prevent such techniques.\n- Conduct a thorough investigation to understand the extent of the breach and the potential impact on the systems and data.\n- Review and update your security policies to prevent such incidents in the future.\n- Implement additional monitoring and logging of Okta events to improve visibility of user actions.", + "query": "event.dataset:okta.system and event.action:user.session.impersonation.initiate\n", + "references": [ + "https://blog.cloudflare.com/cloudflare-investigation-of-the-january-2022-okta-compromise/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "cdbebdc1-dc97-43c6-a538-f26a20c0a911", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "high", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Credential Access", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "cdbebdc1-dc97-43c6-a538-f26a20c0a911_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cde1bafa-9f01-4f43-a872-605b678968b0_5.json b/packages/security_detection_engine/kibana/security_rule/cde1bafa-9f01-4f43-a872-605b678968b0_5.json new file mode 100644 index 00000000000..fbe15ab1784 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cde1bafa-9f01-4f43-a872-605b678968b0_5.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential PowerShell HackTool Script by Function Names", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"Add-DomainGroupMember\" or \"Add-DomainObjectAcl\" or\n \"Add-RemoteConnection\" or \"Add-ServiceDacl\" or\n \"Add-Win32Type\" or \"Convert-ADName\" or\n \"Convert-LDAPProperty\" or \"ConvertFrom-LDAPLogonHours\" or\n \"ConvertFrom-UACValue\" or \"Copy-ArrayOfMemAddresses\" or\n \"Create-NamedPipe\" or \"Create-ProcessWithToken\" or\n \"Create-RemoteThread\" or \"Create-SuspendedWinLogon\" or\n \"Create-WinLogonProcess\" or \"Emit-CallThreadStub\" or\n \"Enable-SeAssignPrimaryTokenPrivilege\" or \"Enable-SeDebugPrivilege\" or\n \"Enum-AllTokens\" or \"Export-PowerViewCSV\" or\n \"Find-AVSignature\" or \"Find-AppLockerLog\" or\n \"Find-DomainLocalGroupMember\" or \"Find-DomainObjectPropertyOutlier\" or\n \"Find-DomainProcess\" or \"Find-DomainShare\" or\n \"Find-DomainUserEvent\" or \"Find-DomainUserLocation\" or\n \"Find-InterestingDomainAcl\" or \"Find-InterestingDomainShareFile\" or\n \"Find-InterestingFile\" or \"Find-LocalAdminAccess\" or\n \"Find-PSScriptsInPSAppLog\" or \"Find-PathDLLHijack\" or\n \"Find-ProcessDLLHijack\" or \"Find-RDPClientConnection\" or\n \"Get-AllAttributesForClass\" or \"Get-CachedGPPPassword\" or\n \"Get-DecryptedCpassword\" or \"Get-DecryptedSitelistPassword\" or\n \"Get-DelegateType\" or\n \"Get-DomainDFSShare\" or \"Get-DomainDFSShareV1\" or\n \"Get-DomainDFSShareV2\" or \"Get-DomainDNSRecord\" or\n \"Get-DomainDNSZone\" or \"Get-DomainFileServer\" or\n \"Get-DomainForeignGroupMember\" or \"Get-DomainForeignUser\" or\n \"Get-DomainGPO\" or \"Get-DomainGPOComputerLocalGroupMapping\" or\n \"Get-DomainGPOLocalGroup\" or \"Get-DomainGPOUserLocalGroupMapping\" or\n \"Get-DomainGUIDMap\" or \"Get-DomainGroup\" or\n \"Get-DomainGroupMember\" or \"Get-DomainGroupMemberDeleted\" or\n \"Get-DomainManagedSecurityGroup\" or \"Get-DomainOU\" or\n \"Get-DomainObject\" or \"Get-DomainObjectAcl\" or\n \"Get-DomainObjectAttributeHistory\" or \"Get-DomainObjectLinkedAttributeHistory\" or\n \"Get-DomainPolicyData\" or \"Get-DomainSID\" or\n \"Get-DomainSPNTicket\" or \"Get-DomainSearcher\" or\n \"Get-DomainSite\" or \"Get-DomainSubnet\" or\n \"Get-DomainTrust\" or \"Get-DomainTrustMapping\" or\n \"Get-DomainUser\" or \"Get-DomainUserEvent\" or\n \"Get-Forest\" or \"Get-ForestDomain\" or\n \"Get-ForestGlobalCatalog\" or \"Get-ForestSchemaClass\" or\n \"Get-ForestTrust\" or \"Get-GPODelegation\" or\n \"Get-GPPAutologon\" or \"Get-GPPInnerField\" or\n \"Get-GPPInnerFields\" or \"Get-GPPPassword\" or\n \"Get-GptTmpl\" or \"Get-GroupsXML\" or\n \"Get-HttpStatus\" or \"Get-ImageNtHeaders\" or\n \"Get-Keystrokes\" or\n \"Get-MemoryProcAddress\" or \"Get-MicrophoneAudio\" or\n \"Get-ModifiablePath\" or \"Get-ModifiableRegistryAutoRun\" or\n \"Get-ModifiableScheduledTaskFile\" or \"Get-ModifiableService\" or\n \"Get-ModifiableServiceFile\" or \"Get-Name\" or\n \"Get-NetComputerSiteName\" or \"Get-NetLocalGroup\" or\n \"Get-NetLocalGroupMember\" or \"Get-NetLoggedon\" or\n \"Get-NetRDPSession\" or \"Get-NetSession\" or\n \"Get-NetShare\" or \"Get-PEArchitecture\" or\n \"Get-PEBasicInfo\" or \"Get-PEDetailedInfo\" or\n \"Get-PathAcl\" or \"Get-PrimaryToken\" or\n \"Get-ProcAddress\" or \"Get-ProcessTokenGroup\" or\n \"Get-ProcessTokenPrivilege\" or \"Get-ProcessTokenType\" or\n \"Get-RegLoggedOn\" or \"Get-RegistryAlwaysInstallElevated\" or\n \"Get-RegistryAutoLogon\" or \"Get-RemoteProcAddress\" or\n \"Get-Screenshot\" or \"Get-ServiceDetail\" or\n \"Get-SiteListPassword\" or \"Get-SitelistField\" or\n \"Get-System\" or \"Get-SystemNamedPipe\" or\n \"Get-SystemToken\" or \"Get-ThreadToken\" or\n \"Get-TimedScreenshot\" or \"Get-TokenInformation\" or\n \"Get-TopPort\" or \"Get-UnattendedInstallFile\" or\n \"Get-UniqueTokens\" or \"Get-UnquotedService\" or\n \"Get-VaultCredential\" or \"Get-VaultElementValue\" or\n \"Get-VirtualProtectValue\" or \"Get-VolumeShadowCopy\" or\n \"Get-WMIProcess\" or \"Get-WMIRegCachedRDPConnection\" or\n \"Get-WMIRegLastLoggedOn\" or \"Get-WMIRegMountedDrive\" or\n \"Get-WMIRegProxy\" or \"Get-WebConfig\" or\n \"Get-Win32Constants\" or \"Get-Win32Functions\" or\n \"Get-Win32Types\" or \"Import-DllImports\" or\n \"Import-DllInRemoteProcess\" or \"Inject-LocalShellcode\" or\n \"Inject-RemoteShellcode\" or \"Install-ServiceBinary\" or\n \"Invoke-CompareAttributesForClass\" or \"Invoke-CreateRemoteThread\" or\n \"Invoke-CredentialInjection\" or \"Invoke-DllInjection\" or\n \"Invoke-EventVwrBypass\" or \"Invoke-ImpersonateUser\" or\n \"Invoke-Kerberoast\" or \"Invoke-MemoryFreeLibrary\" or\n \"Invoke-MemoryLoadLibrary\" or \"Invoke-Method\" or\n \"Invoke-Mimikatz\" or \"Invoke-NinjaCopy\" or\n \"Invoke-PatchDll\" or \"Invoke-Portscan\" or\n \"Invoke-PrivescAudit\" or \"Invoke-ReflectivePEInjection\" or\n \"Invoke-ReverseDnsLookup\" or \"Invoke-RevertToSelf\" or\n \"Invoke-ServiceAbuse\" or \"Invoke-Shellcode\" or\n \"Invoke-TokenManipulation\" or \"Invoke-UserImpersonation\" or\n \"Invoke-WmiCommand\" or \"Mount-VolumeShadowCopy\" or\n \"New-ADObjectAccessControlEntry\" or \"New-DomainGroup\" or\n \"New-DomainUser\" or \"New-DynamicParameter\" or\n \"New-InMemoryModule\" or\n \"New-ThreadedFunction\" or \"New-VolumeShadowCopy\" or\n \"Out-CompressedDll\" or \"Out-EncodedCommand\" or\n \"Out-EncryptedScript\" or \"Out-Minidump\" or\n \"PortScan-Alive\" or \"Portscan-Port\" or\n \"Remove-DomainGroupMember\" or \"Remove-DomainObjectAcl\" or\n \"Remove-RemoteConnection\" or \"Remove-VolumeShadowCopy\" or\n \"Restore-ServiceBinary\" or \"Set-DesktopACLToAllowEveryone\" or\n \"Set-DesktopACLs\" or \"Set-DomainObject\" or\n \"Set-DomainObjectOwner\" or \"Set-DomainUserPassword\" or\n \"Set-ServiceBinaryPath\" or \"Sub-SignedIntAsUnsigned\" or\n \"Test-AdminAccess\" or \"Test-MemoryRangeValid\" or\n \"Test-ServiceDaclPermission\" or \"Update-ExeFunctions\" or\n \"Update-MemoryAddresses\" or \"Update-MemoryProtectionFlags\" or\n \"Write-BytesToMemory\" or \"Write-HijackDll\" or\n \"Write-PortscanOut\" or \"Write-ServiceBinary\" or\n \"Write-UserAddMSI\" or \"Invoke-Privesc\" or\n \"func_get_proc_address\" or \"Invoke-BloodHound\" or\n \"Invoke-HostEnum\" or \"Get-BrowserInformation\" or\n \"Get-DomainAccountPolicy\" or \"Get-DomainAdmins\" or\n \"Get-AVProcesses\" or \"Get-AVInfo\" or\n \"Get-RecycleBin\" or \"Invoke-BruteForce\" or\n \"Get-PassHints\" or \"Invoke-SessionGopher\" or\n \"Get-LSASecret\" or \"Get-PassHashes\" or\n \"Invoke-WdigestDowngrade\" or \"Get-ChromeDump\" or\n \"Invoke-DomainPasswordSpray\" or \"Get-FoxDump\" or\n \"New-HoneyHash\" or \"Invoke-DCSync\" or\n \"Invoke-PowerDump\" or \"Invoke-SSIDExfil\" or\n \"Invoke-PowerShellTCP\" or \"Add-Exfiltration\" or\n \"Do-Exfiltration\" or \"Invoke-DropboxUpload\" or\n \"Invoke-ExfilDataToGitHub\" or \"Invoke-EgressCheck\" or\n \"Invoke-PostExfil\" or \"Create-MultipleSessions\" or\n \"Invoke-NetworkRelay\" or \"New-GPOImmediateTask\" or\n \"Invoke-WMIDebugger\" or \"Invoke-SQLOSCMD\" or\n \"Invoke-SMBExec\" or \"Invoke-PSRemoting\" or\n \"Invoke-ExecuteMSBuild\" or \"Invoke-DCOM\" or\n \"Invoke-InveighRelay\" or \"Invoke-PsExec\" or\n \"Invoke-SSHCommand\" or \"Find-ActiveUsersWMI\" or\n \"Get-SystemDrivesWMI\" or \"Get-ActiveNICSWMI\" or\n \"Remove-Persistence\" or \"DNS_TXT_Pwnage\" or\n \"Execute-OnTime\" or \"HTTP-Backdoor\" or\n \"Add-ConstrainedDelegationBackdoor\" or \"Add-RegBackdoor\" or\n \"Add-ScrnSaveBackdoor\" or \"Gupt-Backdoor\" or\n \"Invoke-ADSBackdoor\" or \"Add-Persistence\" or\n \"Invoke-ResolverBackdoor\" or \"Invoke-EventLogBackdoor\" or\n \"Invoke-DeadUserBackdoor\" or \"Invoke-DisableMachineAcctChange\" or\n \"Invoke-AccessBinary\" or \"Add-NetUser\" or\n \"Invoke-Schtasks\" or \"Invoke-JSRatRegsvr\" or\n \"Invoke-JSRatRundll\" or \"Invoke-PoshRatHttps\" or\n \"Invoke-PsGcatAgent\" or \"Remove-PoshRat\" or\n \"Install-SSP\" or \"Invoke-BackdoorLNK\" or\n \"PowerBreach\" or \"InstallEXE-Persistence\" or\n \"RemoveEXE-Persistence\" or \"Install-ServiceLevel-Persistence\" or\n \"Remove-ServiceLevel-Persistence\" or \"Invoke-Prompt\" or\n \"Invoke-PacketCapture\" or \"Start-WebcamRecorder\" or\n \"Get-USBKeyStrokes\" or \"Invoke-KeeThief\" or\n \"Get-Keystrokes\" or \"Invoke-NetRipper\" or\n \"Get-EmailItems\" or \"Invoke-MailSearch\" or\n \"Invoke-SearchGAL\" or \"Get-WebCredentials\" or\n \"Start-CaptureServer\" or \"Invoke-PowerShellIcmp\" or\n \"Invoke-PowerShellTcpOneLine\" or \"Invoke-PowerShellTcpOneLineBind\" or\n \"Invoke-PowerShellUdp\" or \"Invoke-PowerShellUdpOneLine\" or\n \"Run-EXEonRemote\" or \"Download-Execute-PS\" or\n \"Out-RundllCommand\" or \"Set-RemoteWMI\" or\n \"Set-DCShadowPermissions\" or \"Invoke-PowerShellWMI\" or\n \"Invoke-Vnc\" or \"Invoke-LockWorkStation\" or\n \"Invoke-EternalBlue\" or \"Invoke-ShellcodeMSIL\" or\n \"Invoke-MetasploitPayload\" or \"Invoke-DowngradeAccount\" or\n \"Invoke-RunAs\" or \"ExetoText\" or\n \"Disable-SecuritySettings\" or \"Set-MacAttribute\" or\n \"Invoke-MS16032\" or \"Invoke-BypassUACTokenManipulation\" or\n \"Invoke-SDCLTBypass\" or \"Invoke-FodHelperBypass\" or\n \"Invoke-EventVwrBypass\" or \"Invoke-EnvBypass\" or\n \"Get-ServiceUnquoted\" or \"Get-ServiceFilePermission\" or\n \"Get-ServicePermission\" or \"Get-ServicePermission\" or\n \"Enable-DuplicateToken\" or \"Invoke-PsUaCme\" or\n \"Invoke-Tater\" or \"Invoke-WScriptBypassUAC\" or\n \"Invoke-AllChecks\" or \"Find-TrustedDocuments\" or\n \"Invoke-Interceptor\" or \"Invoke-PoshRatHttp\" or\n \"Invoke-ExecCommandWMI\" or \"Invoke-KillProcessWMI\" or\n \"Invoke-CreateShareandExecute\" or \"Invoke-RemoteScriptWithOutput\" or\n \"Invoke-SchedJobManipulation\" or \"Invoke-ServiceManipulation\" or\n \"Invoke-PowerOptionsWMI\" or \"Invoke-DirectoryListing\" or\n \"Invoke-FileTransferOverWMI\" or \"Invoke-WMImplant\" or\n \"Invoke-WMIObfuscatedPSCommand\" or \"Invoke-WMIDuplicateClass\" or\n \"Invoke-WMIUpload\" or \"Invoke-WMIRemoteExtract\" or \"Invoke-winPEAS\"\n )\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\"\n )\n", + "references": [ + "https://github.com/atc-project/atc-data/blob/master/docs/Logging_Policies/LP_0109_windows_powershell_script_block_log.md", + "https://github.com/BC-SECURITY/Empire" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "cde1bafa-9f01-4f43-a872-605b678968b0", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 5 + }, + "id": "cde1bafa-9f01-4f43-a872-605b678968b0_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ce64d965-6cb0-466d-b74f-8d2c76f47f05_105.json b/packages/security_detection_engine/kibana/security_rule/ce64d965-6cb0-466d-b74f-8d2c76f47f05_105.json new file mode 100644 index 00000000000..c41554597ba --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ce64d965-6cb0-466d-b74f-8d2c76f47f05_105.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device. Adversaries may target user email to collect sensitive information.", + "false_positives": [ + "Legitimate exchange system administration activity." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "New ActiveSyncAllowedDeviceID Added via PowerShell", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and process.args : \"Set-CASMailbox*ActiveSyncAllowedDeviceIDs*\"\n", + "references": [ + "https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/", + "https://docs.microsoft.com/en-us/powershell/module/exchange/set-casmailbox?view=exchange-ps" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ce64d965-6cb0-466d-b74f-8d2c76f47f05", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1098", + "name": "Account Manipulation", + "reference": "https://attack.mitre.org/techniques/T1098/", + "subtechnique": [ + { + "id": "T1098.002", + "name": "Additional Email Delegate Permissions", + "reference": "https://attack.mitre.org/techniques/T1098/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "ce64d965-6cb0-466d-b74f-8d2c76f47f05_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cf6995ec-32a9-4b2d-9340-f8e61acf3f4e_1.json b/packages/security_detection_engine/kibana/security_rule/cf6995ec-32a9-4b2d-9340-f8e61acf3f4e_1.json new file mode 100644 index 00000000000..abf26e97a70 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cf6995ec-32a9-4b2d-9340-f8e61acf3f4e_1.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identify activity related where adversaries can include a trap command which then allows programs and shells to specify commands that will be executed upon receiving interrupt signals.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Trap Signals Execution", + "query": "process where event.type : (\"start\", \"process_started\") and process.name : \"trap\" and process.args : \"SIG*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "cf6995ec-32a9-4b2d-9340-f8e61acf3f4e", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.005", + "name": "Trap", + "reference": "https://attack.mitre.org/techniques/T1546/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "cf6995ec-32a9-4b2d-9340-f8e61acf3f4e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/cff92c41-2225-4763-b4ce-6f71e5bda5e6_108.json b/packages/security_detection_engine/kibana/security_rule/cff92c41-2225-4763-b4ce-6f71e5bda5e6_108.json new file mode 100644 index 00000000000..bfa05b10999 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/cff92c41-2225-4763-b4ce-6f71e5bda5e6_108.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies process execution from suspicious default Windows directories. This may be abused by adversaries to hide malware in trusted paths.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution from Unusual Directory - Command Line", + "note": "## Triage and analysis\n\n### Investigating Execution from Unusual Directory - Command Line\n\nThis rule looks for the execution of scripts from unusual directories. Attackers can use system or application paths to hide malware and make the execution less suspicious.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to determine which commands or scripts were executed.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the script using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of parent process executable and command line conditions.\n\n### Related rules\n\n- Process Execution from an Unusual Directory - ebfe1448-7fac-4d59-acea-181bd89b1f7f\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"wscript.exe\",\n \"cscript.exe\",\n \"rundll32.exe\",\n \"regsvr32.exe\",\n \"cmstp.exe\",\n \"RegAsm.exe\",\n \"installutil.exe\",\n \"mshta.exe\",\n \"RegSvcs.exe\",\n \"powershell.exe\",\n \"pwsh.exe\",\n \"cmd.exe\") and\n\n /* add suspicious execution paths here */\n process.args : (\"C:\\\\PerfLogs\\\\*\",\n \"C:\\\\Users\\\\Public\\\\*\",\n \"C:\\\\Windows\\\\Tasks\\\\*\",\n \"C:\\\\Intel\\\\*\",\n \"C:\\\\AMD\\\\Temp\\\\*\",\n \"C:\\\\Windows\\\\AppReadiness\\\\*\",\n \"C:\\\\Windows\\\\ServiceState\\\\*\",\n \"C:\\\\Windows\\\\security\\\\*\",\n \"C:\\\\Windows\\\\IdentityCRL\\\\*\",\n \"C:\\\\Windows\\\\Branding\\\\*\",\n \"C:\\\\Windows\\\\csc\\\\*\",\n \"C:\\\\Windows\\\\DigitalLocker\\\\*\",\n \"C:\\\\Windows\\\\en-US\\\\*\",\n \"C:\\\\Windows\\\\wlansvc\\\\*\",\n \"C:\\\\Windows\\\\Prefetch\\\\*\",\n \"C:\\\\Windows\\\\Fonts\\\\*\",\n \"C:\\\\Windows\\\\diagnostics\\\\*\",\n \"C:\\\\Windows\\\\TAPI\\\\*\",\n \"C:\\\\Windows\\\\INF\\\\*\",\n \"C:\\\\Windows\\\\System32\\\\Speech\\\\*\",\n \"C:\\\\windows\\\\tracing\\\\*\",\n \"c:\\\\windows\\\\IME\\\\*\",\n \"c:\\\\Windows\\\\Performance\\\\*\",\n \"c:\\\\windows\\\\intel\\\\*\",\n \"c:\\\\windows\\\\ms\\\\*\",\n \"C:\\\\Windows\\\\dot3svc\\\\*\",\n \"C:\\\\Windows\\\\panther\\\\*\",\n \"C:\\\\Windows\\\\RemotePackages\\\\*\",\n \"C:\\\\Windows\\\\OCR\\\\*\",\n \"C:\\\\Windows\\\\appcompat\\\\*\",\n \"C:\\\\Windows\\\\apppatch\\\\*\",\n \"C:\\\\Windows\\\\addins\\\\*\",\n \"C:\\\\Windows\\\\Setup\\\\*\",\n \"C:\\\\Windows\\\\Help\\\\*\",\n \"C:\\\\Windows\\\\SKB\\\\*\",\n \"C:\\\\Windows\\\\Vss\\\\*\",\n \"C:\\\\Windows\\\\servicing\\\\*\",\n \"C:\\\\Windows\\\\CbsTemp\\\\*\",\n \"C:\\\\Windows\\\\Logs\\\\*\",\n \"C:\\\\Windows\\\\WaaS\\\\*\",\n \"C:\\\\Windows\\\\twain_32\\\\*\",\n \"C:\\\\Windows\\\\ShellExperiences\\\\*\",\n \"C:\\\\Windows\\\\ShellComponents\\\\*\",\n \"C:\\\\Windows\\\\PLA\\\\*\",\n \"C:\\\\Windows\\\\Migration\\\\*\",\n \"C:\\\\Windows\\\\debug\\\\*\",\n \"C:\\\\Windows\\\\Cursors\\\\*\",\n \"C:\\\\Windows\\\\Containers\\\\*\",\n \"C:\\\\Windows\\\\Boot\\\\*\",\n \"C:\\\\Windows\\\\bcastdvr\\\\*\",\n \"C:\\\\Windows\\\\TextInput\\\\*\",\n \"C:\\\\Windows\\\\security\\\\*\",\n \"C:\\\\Windows\\\\schemas\\\\*\",\n \"C:\\\\Windows\\\\SchCache\\\\*\",\n \"C:\\\\Windows\\\\Resources\\\\*\",\n \"C:\\\\Windows\\\\rescache\\\\*\",\n \"C:\\\\Windows\\\\Provisioning\\\\*\",\n \"C:\\\\Windows\\\\PrintDialog\\\\*\",\n \"C:\\\\Windows\\\\PolicyDefinitions\\\\*\",\n \"C:\\\\Windows\\\\media\\\\*\",\n \"C:\\\\Windows\\\\Globalization\\\\*\",\n \"C:\\\\Windows\\\\L2Schemas\\\\*\",\n \"C:\\\\Windows\\\\LiveKernelReports\\\\*\",\n \"C:\\\\Windows\\\\ModemLogs\\\\*\",\n \"C:\\\\Windows\\\\ImmersiveControlPanel\\\\*\",\n \"C:\\\\$Recycle.Bin\\\\*\") and\n\n /* noisy FP patterns */\n\n not process.parent.executable : (\"C:\\\\WINDOWS\\\\System32\\\\DriverStore\\\\FileRepository\\\\*\\\\igfxCUIService*.exe\",\n \"C:\\\\Windows\\\\System32\\\\spacedeskService.exe\",\n \"C:\\\\Program Files\\\\Dell\\\\SupportAssistAgent\\\\SRE\\\\SRE.exe\") and\n not (process.name : \"rundll32.exe\" and\n process.args : (\"uxtheme.dll,#64\",\n \"PRINTUI.DLL,PrintUIEntry\",\n \"?:\\\\Windows\\\\System32\\\\FirewallControlPanel.dll,ShowNotificationDialog\",\n \"?:\\\\WINDOWS\\\\system32\\\\Speech\\\\SpeechUX\\\\sapi.cpl\",\n \"?:\\\\Windows\\\\system32\\\\shell32.dll,OpenAs_RunDLL\")) and\n\n not (process.name : \"cscript.exe\" and process.args : \"?:\\\\WINDOWS\\\\system32\\\\calluxxprovider.vbs\") and\n\n not (process.name : \"cmd.exe\" and process.args : \"?:\\\\WINDOWS\\\\system32\\\\powercfg.exe\" and process.args : \"?:\\\\WINDOWS\\\\inf\\\\PowerPlan.log\") and\n\n not (process.name : \"regsvr32.exe\" and process.args : \"?:\\\\Windows\\\\Help\\\\OEM\\\\scripts\\\\checkmui.dll\") and\n\n not (process.name : \"cmd.exe\" and\n process.parent.executable : (\"?:\\\\Windows\\\\System32\\\\oobe\\\\windeploy.exe\",\n \"?:\\\\Program Files (x86)\\\\ossec-agent\\\\wazuh-agent.exe\",\n \"?:\\\\Windows\\\\System32\\\\igfxCUIService.exe\",\n \"?:\\\\Windows\\\\Temp\\\\IE*.tmp\\\\IE*-support\\\\ienrcore.exe\"))\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "cff92c41-2225-4763-b4ce-6f71e5bda5e6", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.003", + "name": "Windows Command Shell", + "reference": "https://attack.mitre.org/techniques/T1059/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.005", + "name": "Match Legitimate Name or Location", + "reference": "https://attack.mitre.org/techniques/T1036/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "cff92c41-2225-4763-b4ce-6f71e5bda5e6_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d00f33e7-b57d-4023-9952-2db91b1767c4_6.json b/packages/security_detection_engine/kibana/security_rule/d00f33e7-b57d-4023-9952-2db91b1767c4_6.json new file mode 100644 index 00000000000..cfea06b87fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d00f33e7-b57d-4023-9952-2db91b1767c4_6.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious usage of unshare to manipulate system namespaces. Unshare can be utilized to escalate privileges or escape container security boundaries. Threat actors have utilized this binary to allow themselves to escape to the host and access other resources or escalate privileges.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Namespace Manipulation Using Unshare", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and event.action : (\"exec\", \"exec_event\") and\nprocess.executable: \"/usr/bin/unshare\" and\nnot process.parent.executable: (\"/usr/bin/udevadm\", \"*/lib/systemd/systemd-udevd\", \"/usr/bin/unshare\") and\nnot process.args : \"/usr/bin/snap\"\n", + "references": [ + "https://man7.org/linux/man-pages/man1/unshare.1.html", + "https://www.crowdstrike.com/blog/cve-2022-0185-kubernetes-container-escape-using-linux-kernel-exploit/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d00f33e7-b57d-4023-9952-2db91b1767c4", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 6 + }, + "id": "d00f33e7-b57d-4023-9952-2db91b1767c4_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d0b0f3ed-0b37-44bf-adee-e8cb7de92767_1.json b/packages/security_detection_engine/kibana/security_rule/d0b0f3ed-0b37-44bf-adee-e8cb7de92767_1.json new file mode 100644 index 00000000000..58d9466e20f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d0b0f3ed-0b37-44bf-adee-e8cb7de92767_1.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the use of system search utilities like grep and find to search for AWS credentials inside a container. Unauthorized access to these sensitive files could lead to further compromise of the container environment or facilitate a container breakout to the underlying cloud environment.", + "from": "now-6m", + "index": [ + "logs-cloud_defend*" + ], + "interval": "5m", + "language": "eql", + "license": "Elastic License v2", + "name": "AWS Credentials Searched For Inside A Container", + "query": "process where event.module == \"cloud_defend\" and \n event.type == \"start\" and\n \n/*account for tools that execute utilities as a subprocess, in this case the target utility name will appear as a process arg*/\n(process.name : (\"grep\", \"egrep\", \"fgrep\", \"find\", \"locate\", \"mlocate\") or process.args : (\"grep\", \"egrep\", \"fgrep\", \"find\", \"locate\", \"mlocate\")) and \nprocess.args : (\"*aws_access_key_id*\", \"*aws_secret_access_key*\", \"*aws_session_token*\", \"*accesskeyid*\", \"*secretaccesskey*\", \"*access_key*\", \"*.aws/credentials*\")\n", + "references": [ + "https://sysdig.com/blog/threat-detection-aws-cloud-containers/" + ], + "related_integrations": [ + { + "package": "cloud_defend", + "version": "^1.0.5" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.module", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d0b0f3ed-0b37-44bf-adee-e8cb7de92767", + "severity": "medium", + "tags": [ + "Data Source: Elastic Defend for Containers", + "Domain: Container", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.001", + "name": "Credentials In Files", + "reference": "https://attack.mitre.org/techniques/T1552/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d0b0f3ed-0b37-44bf-adee-e8cb7de92767_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d0e159cf-73e9-40d1-a9ed-077e3158a855_105.json b/packages/security_detection_engine/kibana/security_rule/d0e159cf-73e9-40d1-a9ed-077e3158a855_105.json new file mode 100644 index 00000000000..15f5213367a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d0e159cf-73e9-40d1-a9ed-077e3158a855_105.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "AppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads user32.dll) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications. Attackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Registry Persistence via AppInit DLL", + "note": "## Triage and analysis\n\n### Investigating Registry Persistence via AppInit DLL\n\nAppInit DLLs are dynamic-link libraries (DLLs) that are loaded into every process that creates a user interface (loads `user32.dll`) on Microsoft Windows operating systems. The AppInit DLL mechanism is used to load custom code into user-mode processes, allowing for the customization of the user interface and the behavior of Windows-based applications.\n\nAttackers who add those DLLs to the registry locations can execute code with elevated privileges, similar to process injection, and provide a solid and constant persistence on the machine.\n\nThis rule identifies modifications on the AppInit registry keys.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Review the source process and related DLL file tied to the Windows Registry entry.\n - Check whether the DLL is signed, and tied to a authorized program used on your environment.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Retrieve all DLLs under the AppInit registry keys:\n - !{osquery{\"label\":\"Osquery - Retrieve AppInit Registry Value\",\"query\":\"SELECT * FROM registry r where (r.key == 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows' or\\nr.key == 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows') and r.name ==\\n'AppInit_DLLs'\\n\"}}\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable and the DLLs using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\",\n \"HKLM\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\AppInit_Dlls\"\n ) and not process.executable : (\n \"C:\\\\Windows\\\\System32\\\\msiexec.exe\",\n \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\",\n \"C:\\\\Program Files\\\\Commvault\\\\ContentStore*\\\\Base\\\\cvd.exe\",\n \"C:\\\\Program Files (x86)\\\\Commvault\\\\ContentStore*\\\\Base\\\\cvd.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d0e159cf-73e9-40d1-a9ed-077e3158a855", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.010", + "name": "AppInit DLLs", + "reference": "https://attack.mitre.org/techniques/T1546/010/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "d0e159cf-73e9-40d1-a9ed-077e3158a855_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d117cbb4-7d56-41b4-b999-bdf8c25648a0_106.json b/packages/security_detection_engine/kibana/security_rule/d117cbb4-7d56-41b4-b999-bdf8c25648a0_106.json new file mode 100644 index 00000000000..213eda500b0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d117cbb4-7d56-41b4-b999-bdf8c25648a0_106.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies the creation of symbolic links to a shadow copy. Symbolic links can be used to access files in the shadow copy, including sensitive files such as ntds.dit, System Boot Key and browser offline credentials.", + "false_positives": [ + "Legitimate administrative activity related to shadow copies." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Symbolic Link to Shadow Copy Created", + "note": "## Triage and analysis\n\n### Investigating Symbolic Link to Shadow Copy Created\n\nShadow copies are backups or snapshots of an endpoint's files or volumes while they are in use. Adversaries may attempt to discover and create symbolic links to these shadow copies in order to copy sensitive information offline. If Active Directory (AD) is in use, often the ntds.dit file is a target as it contains password hashes, but an offline copy is needed to extract these hashes and potentially conduct lateral movement.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Determine if a volume shadow copy was recently created on this endpoint.\n- Review privileges of the end user as this requires administrative access.\n- Verify if the ntds.dit file was successfully copied and determine its copy destination.\n- Investigate for registry SYSTEM file copies made recently or saved via Reg.exe.\n- Investigate recent deletions of volume shadow copies.\n- Identify other files potentially copied from volume shadow copy paths directly.\n\n### False positive analysis\n\n- This rule should cause very few false positives. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- NTDS or SAM Database File Copied - 3bc6deaa-fbd4-433a-ae21-3e892f95624f\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- If the entire domain or the `krbtgt` user was compromised:\n - Activate your incident response plan for total Active Directory compromise which should include, but not be limited to, a password reset (twice) of the `krbtgt` user.\n- Locate and remove static files copied from volume shadow copies.\n- Command-Line tool mklink should require administrative access by default unless in developer mode.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nEnsure advanced audit policies for Windows are enabled, specifically:\nObject Access policies [Event ID 4656](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4656) (Handle to an Object was Requested)\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nSystem Audit Policies \u003e\nObject Access \u003e\nAudit File System (Success,Failure)\nAudit Handle Manipulation (Success,Failure)\n```\n\nThis event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments.\nDirect access to a shell and calling symbolic link creation tools will not generate an event matching this rule.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name in (\"Cmd.Exe\",\"PowerShell.EXE\") and\n\n /* Create Symbolic Link to Shadow Copies */\n process.args : (\"*mklink*\", \"*SymbolicLink*\") and process.command_line : (\"*HarddiskVolumeShadowCopy*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/mklink", + "https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf", + "https://blog.netwrix.com/2021/11/30/extracting-password-hashes-from-the-ntds-dit-file/", + "https://www.hackingarticles.in/credential-dumping-ntds-dit/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d117cbb4-7d56-41b4-b999-bdf8c25648a0", + "setup": "Ensure advanced audit policies for Windows are enabled, specifically:\nObject Access policies Event ID 4656 (Handle to an Object was Requested)\n\n```\nComputer Configuration \u003e\nPolicies \u003e\nWindows Settings \u003e\nSecurity Settings \u003e\nAdvanced Audit Policies Configuration \u003e\nSystem Audit Policies \u003e\nObject Access \u003e\nAudit File System (Success,Failure)\nAudit Handle Manipulation (Success,Failure)\n```\n\nThis event will only trigger if symbolic links are created from a new process spawning cmd.exe or powershell.exe with the correct arguments.\nDirect access to a shell and calling symbolic link creation tools will not generate an event matching this rule.\n\nIf enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d117cbb4-7d56-41b4-b999-bdf8c25648a0_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_1.json b/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_1.json new file mode 100644 index 00000000000..e56508caf27 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_1.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Expired or Revoked Driver Loaded", + "query": "driver where host.os.type == \"windows\" and process.pid == 4 and\n dll.code_signature.status : (\"errorExpired\", \"errorRevoked\")\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 21, + "rule_id": "d12bac54-ab2a-4159-933f-d7bcefa7b61d", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d12bac54-ab2a-4159-933f-d7bcefa7b61d_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_2.json b/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_2.json new file mode 100644 index 00000000000..61e92211a74 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d12bac54-ab2a-4159-933f-d7bcefa7b61d_2.json @@ -0,0 +1,76 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies an attempt to load a revoked or expired driver. Adversaries may bring outdated drivers with vulnerabilities to gain code execution in kernel mode or abuse revoked certificates to sign their drivers.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Expired or Revoked Driver Loaded", + "query": "driver where host.os.type == \"windows\" and process.pid == 4 and\n dll.code_signature.status : (\"errorExpired\", \"errorRevoked\")\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 21, + "rule_id": "d12bac54-ab2a-4159-933f-d7bcefa7b61d", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "d12bac54-ab2a-4159-933f-d7bcefa7b61d_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_1.json b/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_1.json new file mode 100644 index 00000000000..35f61f34e84 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_1.json @@ -0,0 +1,69 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Compression DLL Loaded by Unusual Process", + "query": "library where \n dll.name : (\"System.IO.Compression.FileSystem.ni.dll\", \"System.IO.Compression.ni.dll\") and\n \n /* FP Patterns */\n not process.executable :\n (\"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\mscorsvw.exe\",\n \"?:\\\\Windows\\\\System32\\\\sdiagnhost.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d197478e-39f0-4347-a22f-ba654718b148", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d197478e-39f0-4347-a22f-ba654718b148_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_2.json b/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_2.json new file mode 100644 index 00000000000..014eeebe9c4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d197478e-39f0-4347-a22f-ba654718b148_2.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the image load of a compression DLL. Adversaries will often compress and encrypt data in preparation for exfiltration.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Compression DLL Loaded by Unusual Process", + "query": "library where \n dll.name : (\"System.IO.Compression.FileSystem.ni.dll\", \"System.IO.Compression.ni.dll\") and\n not \n (\n (\n process.executable : (\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\mscorsvw.exe\",\n \"?:\\\\Windows\\\\System32\\\\sdiagnhost.exe\",\n \"?:\\\\Windows\\\\System32\\\\inetsrv\\\\w3wp.exe\",\n \"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender Advanced Threat Protection\\\\DataCollection\\\\*\\\\OpenHandleCollector.exe\"\n ) and process.code_signature.trusted == true\n ) or\n (\n process.name : \"NuGet.exe\" and process.code_signature.trusted == true and user.id : (\"S-1-5-18\", \"S-1-5-20\")\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d197478e-39f0-4347-a22f-ba654718b148", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1560", + "name": "Archive Collected Data", + "reference": "https://attack.mitre.org/techniques/T1560/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "d197478e-39f0-4347-a22f-ba654718b148_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d22a85c6-d2ad-4cc4-bf7b-54787473669a_104.json b/packages/security_detection_engine/kibana/security_rule/d22a85c6-d2ad-4cc4-bf7b-54787473669a_104.json new file mode 100644 index 00000000000..e0da874d19d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d22a85c6-d2ad-4cc4-bf7b-54787473669a_104.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a suspicious zip file prepended with special characters. Sandboxed Microsoft Office applications on macOS are allowed to write files that start with special characters, which can be combined with an AutoStart location to achieve sandbox evasion.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Microsoft Office Sandbox Evasion", + "query": "event.category:file and host.os.type:(macos and macos) and not event.type:deletion and file.name:~$*.zip\n", + "references": [ + "https://i.blackhat.com/USA-20/Wednesday/us-20-Wardle-Office-Drama-On-macOS.pdf", + "https://www.mdsec.co.uk/2018/08/escaping-the-sandbox-microsoft-office-on-macos/", + "https://desi-jarvis.medium.com/office365-macos-sandbox-escape-fcce4fa4123c" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d22a85c6-d2ad-4cc4-bf7b-54787473669a", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1497", + "name": "Virtualization/Sandbox Evasion", + "reference": "https://attack.mitre.org/techniques/T1497/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "d22a85c6-d2ad-4cc4-bf7b-54787473669a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d31f183a-e5b1-451b-8534-ba62bca0b404_106.json b/packages/security_detection_engine/kibana/security_rule/d31f183a-e5b1-451b-8534-ba62bca0b404_106.json new file mode 100644 index 00000000000..b12a8b5eb64 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d31f183a-e5b1-451b-8534-ba62bca0b404_106.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "User Account Control (UAC) can help mitigate the impact of malware on Windows hosts. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. This rule identifies registry value changes to bypass User Access Control (UAC) protection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Disabling User Account Control via Registry Modification", + "note": "## Triage and analysis\n\n### Investigating Disabling User Account Control via Registry Modification\n\nWindows User Account Control (UAC) allows a program to elevate its privileges (tracked as low to high integrity levels) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. UAC can deny an operation under high-integrity enforcement, or allow the user to perform the action if they are in the local administrators group and enter an administrator password when prompted.\n\nFor more information about the UAC and how it works, check the [official Microsoft docs page](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works).\n\nAttackers may disable UAC to execute code directly in high integrity. This rule identifies registry value changes to bypass the UAC protection.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behaviors in the alert timeframe.\n- Investigate abnormal behaviors observed by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Analyze non-system processes executed with high integrity after UAC was disabled for unknown or suspicious processes.\n- Retrieve the suspicious processes' executables and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled tasks creation.\n - Use the PowerShell `Get-FileHash` cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Restore UAC settings to the desired state.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n registry.path :\n (\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\ConsentPromptBehaviorAdmin\",\n \"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\PromptOnSecureDesktop\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\ConsentPromptBehaviorAdmin\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\PromptOnSecureDesktop\"\n ) and\n registry.data.strings : (\"0\", \"0x00000000\")\n", + "references": [ + "https://www.greyhathacker.net/?p=796", + "https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", + "https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/user-account-control-overview" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d31f183a-e5b1-451b-8534-ba62bca0b404", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d31f183a-e5b1-451b-8534-ba62bca0b404_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d331bbe2-6db4-4941-80a5-8270db72eb61_107.json b/packages/security_detection_engine/kibana/security_rule/d331bbe2-6db4-4941-80a5-8270db72eb61_107.json new file mode 100644 index 00000000000..48b5ed18f08 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d331bbe2-6db4-4941-80a5-8270db72eb61_107.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to clear or disable Windows event log stores using Windows wevetutil command. This is often done by attackers in an attempt to evade detection or destroy forensic evidence on a system.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Clearing Windows Event Logs", + "note": "## Triage and analysis\n\n### Investigating Clearing Windows Event Logs\n\nWindows event logs are a fundamental data source for security monitoring, forensics, and incident response. Adversaries can tamper, clear, and delete this data to break SIEM detections, cover their tracks, and slow down incident response.\n\nThis rule looks for the execution of the `wevtutil.exe` utility or the `Clear-EventLog` cmdlet to clear event logs.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n - Verify if any other anti-forensics behaviors were observed.\n- Investigate the event logs prior to the action for suspicious behaviors that an attacker may be trying to cover up.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity and there are justifications for this action.\n- Analyze whether the cleared event log is pertinent to security and general monitoring. Administrators can clear non-relevant event logs using this mechanism. If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n - This activity is potentially done after the adversary achieves its objectives on the host. Ensure that previous actions, if any, are investigated accordingly with their response playbooks.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n (process.name : \"wevtutil.exe\" or process.pe.original_file_name == \"wevtutil.exe\") and\n process.args : (\"/e:false\", \"cl\", \"clear-log\")\n ) or\n (\n process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n process.args : \"Clear-EventLog\"\n )\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d331bbe2-6db4-4941-80a5-8270db72eb61", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.001", + "name": "Clear Windows Event Logs", + "reference": "https://attack.mitre.org/techniques/T1070/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "d331bbe2-6db4-4941-80a5-8270db72eb61_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d3551433-782f-4e22-bbea-c816af2d41c6_1.json b/packages/security_detection_engine/kibana/security_rule/d3551433-782f-4e22-bbea-c816af2d41c6_1.json new file mode 100644 index 00000000000..5244cc63ac1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d3551433-782f-4e22-bbea-c816af2d41c6_1.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may abuse the WMI diagnostic tool, wbemtest.exe, to enumerate WMI object instances or invoke methods against local or remote endpoints.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "WMI WBEMTEST Utility Execution", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"wbemtest.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d3551433-782f-4e22-bbea-c816af2d41c6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d3551433-782f-4e22-bbea-c816af2d41c6_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d461fac0-43e8-49e2-85ea-3a58fe120b4f_104.json b/packages/security_detection_engine/kibana/security_rule/d461fac0-43e8-49e2-85ea-3a58fe120b4f_104.json new file mode 100644 index 00000000000..594389ab939 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d461fac0-43e8-49e2-85ea-3a58fe120b4f_104.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the shell process (sh) via scripting (JXA or AppleScript). Adversaries may use the doShellScript functionality in JXA or do shell script in AppleScript to execute system commands.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Shell Execution via Apple Scripting", + "query": "sequence by host.id with maxspan=5s\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\", \"info\") and process.name == \"osascript\"] by process.pid\n [process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name == \"sh\" and process.args == \"-c\"] by process.parent.pid\n", + "references": [ + "https://developer.apple.com/library/archive/technotes/tn2065/_index.html", + "https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "d461fac0-43e8-49e2-85ea-3a58fe120b4f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "d461fac0-43e8-49e2-85ea-3a58fe120b4f_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d4af3a06-1e0a-48ec-b96a-faf2309fae46_103.json b/packages/security_detection_engine/kibana/security_rule/d4af3a06-1e0a-48ec-b96a-faf2309fae46_103.json new file mode 100644 index 00000000000..7a270b6ea6a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d4af3a06-1e0a-48ec-b96a-faf2309fae46_103.json @@ -0,0 +1,61 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "Looks for commands related to system information discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used to engage in system information discovery in order to gather detailed information about system configuration and software versions. This may be a precursor to selection of a persistence mechanism or a method of privilege elevation.", + "false_positives": [ + "Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_system_information_discovery" + ], + "name": "Unusual Linux System Information Discovery Activity", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "d4af3a06-1e0a-48ec-b96a-faf2309fae46", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "d4af3a06-1e0a-48ec-b96a-faf2309fae46_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d4b73fa0-9d43-465e-b8bf-50230da6718b_103.json b/packages/security_detection_engine/kibana/security_rule/d4b73fa0-9d43-465e-b8bf-50230da6718b_103.json new file mode 100644 index 00000000000..c4c7c20f556 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d4b73fa0-9d43-465e-b8bf-50230da6718b_103.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected a user logging in from an IP address that is unusual for the user. This can be due to credentialed access via a compromised account when the user and the threat actor are in different locations. An unusual source IP address for a username could also be due to lateral movement when a compromised account is used to pivot between hosts.", + "false_positives": [ + "Business travelers who roam to new locations may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_rare_source_ip_for_a_user", + "name": "Unusual Source IP for a User to Logon from", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "d4b73fa0-9d43-465e-b8bf-50230da6718b", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Initial Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "d4b73fa0-9d43-465e-b8bf-50230da6718b_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f_1.json b/packages/security_detection_engine/kibana/security_rule/d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f_1.json new file mode 100644 index 00000000000..d1fff9b12b5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f_1.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the potential memory dump of the init process (PID 1) through gdb. Attackers may leverage memory dumping techniques to attempt secret extraction from privileged processes. Tools that display this behavior include \"truffleproc\" and \"bash-memory-dump\". This behavior should not happen by default, and should be investigated thoroughly.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux init (PID 1) Secret Dump via GDB", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"gdb\" and process.args in (\"--pid\", \"-p\") and process.args == \"1\"\n", + "references": [ + "https://github.com/controlplaneio/truffleproc", + "https://github.com/hajzer/bash-memory-dump" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 47, + "rule_id": "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.007", + "name": "Proc Filesystem", + "reference": "https://attack.mitre.org/techniques/T1003/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d4ff2f53-c802-4d2e-9fb9-9ecc08356c3f_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_1.json b/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_1.json new file mode 100644 index 00000000000..dd356a5a15a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_1.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of the systemd-run command by a user with a UID that is larger than the maximum allowed UID size (INT_MAX). Some older Linux versions were affected by a bug which allows user accounts with a UID greater than INT_MAX to escalate privileges by spawning a shell through systemd-run.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via UID INT_MAX Bug Detected", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"systemd-run\" and process.args == \"-t\" and process.args_count \u003e= 3 and user.id \u003e= \"1000000000\"\n", + "references": [ + "https://twitter.com/paragonsec/status/1071152249529884674", + "https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh", + "https://gitlab.freedesktop.org/polkit/polkit/-/issues/74" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d55436a8-719c-445f-92c4-c113ff2f9ba5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "d55436a8-719c-445f-92c4-c113ff2f9ba5_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_2.json b/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_2.json new file mode 100644 index 00000000000..7f5fae08cae --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d55436a8-719c-445f-92c4-c113ff2f9ba5_2.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of the systemd-run command by a user with a UID that is larger than the maximum allowed UID size (INT_MAX). Some older Linux versions were affected by a bug which allows user accounts with a UID greater than INT_MAX to escalate privileges by spawning a shell through systemd-run.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privilege Escalation via UID INT_MAX Bug Detected", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \nprocess.name == \"systemd-run\" and process.args == \"-t\" and process.args_count \u003e= 3 and user.id \u003e= \"1000000000\"\n", + "references": [ + "https://twitter.com/paragonsec/status/1071152249529884674", + "https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh", + "https://gitlab.freedesktop.org/polkit/polkit/-/issues/74" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d55436a8-719c-445f-92c4-c113ff2f9ba5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "d55436a8-719c-445f-92c4-c113ff2f9ba5_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d563aaba-2e72-462b-8658-3e5ea22db3a6_104.json b/packages/security_detection_engine/kibana/security_rule/d563aaba-2e72-462b-8658-3e5ea22db3a6_104.json new file mode 100644 index 00000000000..921a158712c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d563aaba-2e72-462b-8658-3e5ea22db3a6_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a privilege escalation attempt via a rogue Windows directory (Windir) environment variable. This is a known primitive that is often combined with other vulnerabilities to elevate privileges.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Privilege Escalation via Windir Environment Variable", + "query": "registry where host.os.type == \"windows\" and registry.path : (\n \"HKEY_USERS\\\\*\\\\Environment\\\\windir\",\n \"HKEY_USERS\\\\*\\\\Environment\\\\systemroot\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Environment\\\\windir\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Environment\\\\systemroot\"\n ) and\n not registry.data.strings : (\"C:\\\\windows\", \"%SystemRoot%\")\n", + "references": [ + "https://www.tiraniddo.dev/2017/05/exploiting-environment-variables-in.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d563aaba-2e72-462b-8658-3e5ea22db3a6", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.007", + "name": "Path Interception by PATH Environment Variable", + "reference": "https://attack.mitre.org/techniques/T1574/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "d563aaba-2e72-462b-8658-3e5ea22db3a6_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d5d86bf5-cf0c-4c06-b688-53fdc072fdfd_104.json b/packages/security_detection_engine/kibana/security_rule/d5d86bf5-cf0c-4c06-b688-53fdc072fdfd_104.json new file mode 100644 index 00000000000..b40470a9dea --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d5d86bf5-cf0c-4c06-b688-53fdc072fdfd_104.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to delete a rule within an Okta policy. An adversary may attempt to delete an Okta policy rule in order to weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Okta MFA rules are regularly modified in your organization." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Delete an Okta Policy Rule", + "note": "## Triage and analysis\n\n### Investigating Attempt to Delete an Okta Policy Rule\n\nOkta policy rules are integral components of an organization's security controls, as they define how user access to resources is managed. Deletion of a rule within an Okta policy could potentially weaken the organization's security posture, allowing for unauthorized access or facilitating other malicious activities.\n\nThis rule detects attempts to delete an Okta policy rule, which could indicate an adversary's attempt to weaken an organization's security controls. Adversaries may do this to circumvent security measures and enable further malicious activities.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the deletion attempt.\n- Check the `okta.outcome.result` field to confirm the policy rule deletion attempt.\n- Check if there are multiple policy rule deletion attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the policy rule deletion attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the deletion attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the deletion attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the deletion attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized policy rule deletion is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific deletion technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:policy.rule.delete\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/Security_Policies.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d5d86bf5-cf0c-4c06-b688-53fdc072fdfd", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "d5d86bf5-cf0c-4c06-b688-53fdc072fdfd_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc_105.json b/packages/security_detection_engine/kibana/security_rule/d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc_105.json new file mode 100644 index 00000000000..8c767012043 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc_105.json @@ -0,0 +1,140 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of sc.exe to create, modify, or start services on remote hosts. This could be indicative of adversary lateral movement but will be noisy if commonly done by admins.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Service Command Lateral Movement", + "query": "sequence by process.entity_id with maxspan = 1m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"sc.exe\" or process.pe.original_file_name : \"sc.exe\") and\n process.args : \"\\\\\\\\*\" and process.args : (\"binPath=*\", \"binpath=*\") and\n process.args : (\"create\", \"config\", \"failure\", \"start\")]\n [network where host.os.type == \"windows\" and process.name : \"sc.exe\" and destination.ip != \"127.0.0.1\"]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1569", + "name": "System Services", + "reference": "https://attack.mitre.org/techniques/T1569/", + "subtechnique": [ + { + "id": "T1569.002", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1569/002/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "d61cbcf8-1bc1-4cff-85ba-e7b21c5beedc_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d68e95ad-1c82-4074-a12a-125fe10ac8ba_6.json b/packages/security_detection_engine/kibana/security_rule/d68e95ad-1c82-4074-a12a-125fe10ac8ba_6.json new file mode 100644 index 00000000000..c78f0dccd52 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d68e95ad-1c82-4074-a12a-125fe10ac8ba_6.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of discovery commands to enumerate system information, files, and folders using the Windows Command Shell.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Information Discovery via Windows Command Shell", + "note": "## Triage and analysis\n\n### Investigating System Information Discovery via Windows Command Shell\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule identifies commands to enumerate system information, files, and folders using the Windows Command Shell.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"cmd.exe\" and process.args : \"/c\" and process.args : (\"set\", \"dir\") and\n not process.parent.executable : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\", \"?:\\\\PROGRA~1\\\\*\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d68e95ad-1c82-4074-a12a-125fe10ac8ba", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1082", + "name": "System Information Discovery", + "reference": "https://attack.mitre.org/techniques/T1082/" + }, + { + "id": "T1083", + "name": "File and Directory Discovery", + "reference": "https://attack.mitre.org/techniques/T1083/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.003", + "name": "Windows Command Shell", + "reference": "https://attack.mitre.org/techniques/T1059/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 6 + }, + "id": "d68e95ad-1c82-4074-a12a-125fe10ac8ba_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d703a5af-d5b0-43bd-8ddb-7a5d500b7da5_106.json b/packages/security_detection_engine/kibana/security_rule/d703a5af-d5b0-43bd-8ddb-7a5d500b7da5_106.json new file mode 100644 index 00000000000..637c62b91ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d703a5af-d5b0-43bd-8ddb-7a5d500b7da5_106.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to modify the WDigest security provider in the registry to force the user's password to be stored in clear text in memory. This behavior can be indicative of an adversary attempting to weaken the security configuration of an endpoint. Once the UseLogonCredential value is modified, the adversary may attempt to dump clear text passwords from memory.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Modification of WDigest Security Provider", + "note": "## Triage and analysis\n\n### Investigating Modification of WDigest Security Provider\n\nIn Windows XP, Microsoft added support for a protocol known as WDigest. The WDigest protocol allows clients to send cleartext credentials to Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) applications based on RFC 2617 and 2831. Windows versions up to 8 and 2012 store logon credentials in memory in plaintext by default, which is no longer the case with newer Windows versions.\n\nStill, attackers can force WDigest to store the passwords insecurely on the memory by modifying the `HKLM\\SYSTEM\\*ControlSet*\\Control\\SecurityProviders\\WDigest\\UseLogonCredential` registry key. This activity is commonly related to the execution of credential dumping tools.\n\n#### Possible investigation steps\n\n- It is unlikely that the monitored registry key was modified legitimately in newer versions of Windows. Analysts should treat any activity triggered from this rule with high priority as it typically represents an active adversary.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Determine if credential dumping tools were run on the host, and retrieve and analyze suspicious executables:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences on other hosts.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team, as these modifications expose the entire domain to credential compromises and consequently unauthorized access.\n\n### Related rules\n\n- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reimage the host operating system and restore compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type : (\"creation\", \"change\") and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\SecurityProviders\\\\WDigest\\\\UseLogonCredential\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\SecurityProviders\\\\WDigest\\\\UseLogonCredential\"\n ) and registry.data.strings : (\"1\", \"0x00000001\") and\n not (process.executable : \"?:\\\\Windows\\\\System32\\\\svchost.exe\" and user.id : \"S-1-5-18\")\n", + "references": [ + "https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html", + "https://www.praetorian.com/blog/mitigating-mimikatz-wdigest-cleartext-credential-theft?edition=2019", + "https://frsecure.com/compromised-credentials-response-playbook", + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d703a5af-d5b0-43bd-8ddb-7a5d500b7da5", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d703a5af-d5b0-43bd-8ddb-7a5d500b7da5_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d72e33fc-6e91-42ff-ac8b-e573268c5a87_106.json b/packages/security_detection_engine/kibana/security_rule/d72e33fc-6e91-42ff-ac8b-e573268c5a87_106.json new file mode 100644 index 00000000000..215a4b8794a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d72e33fc-6e91-42ff-ac8b-e573268c5a87_106.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "A suspicious SolarWinds child process (Cmd.exe or Powershell.exe) was detected.", + "false_positives": [ + "Trusted SolarWinds child processes. Verify process details such as network connections and file writes." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Command Execution via SolarWinds Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name: (\"cmd.exe\", \"powershell.exe\") and\nprocess.parent.name: (\n \"ConfigurationWizard*.exe\",\n \"NetflowDatabaseMaintenance*.exe\",\n \"NetFlowService*.exe\",\n \"SolarWinds.Administration*.exe\",\n \"SolarWinds.Collector.Service*.exe\",\n \"SolarwindsDiagnostics*.exe\"\n )\n", + "references": [ + "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", + "https://github.com/mandiant/sunburst_countermeasures/blob/main/rules/SUNBURST/hxioc/SUNBURST%20SUSPICIOUS%20FILEWRITES%20(METHODOLOGY).ioc" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d72e33fc-6e91-42ff-ac8b-e573268c5a87", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1195", + "name": "Supply Chain Compromise", + "reference": "https://attack.mitre.org/techniques/T1195/", + "subtechnique": [ + { + "id": "T1195.002", + "name": "Compromise Software Supply Chain", + "reference": "https://attack.mitre.org/techniques/T1195/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d72e33fc-6e91-42ff-ac8b-e573268c5a87_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d75991f2-b989-419d-b797-ac1e54ec2d61_104.json b/packages/security_detection_engine/kibana/security_rule/d75991f2-b989-419d-b797-ac1e54ec2d61_104.json new file mode 100644 index 00000000000..94811c3038a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d75991f2-b989-419d-b797-ac1e54ec2d61_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Keychains are the built-in way for macOS to keep track of users' passwords and credentials for many services and features, including Wi-Fi and website passwords, secure notes, certificates, and Kerberos. Adversaries may collect the keychain storage data from a system to acquire credentials.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "SystemKey Access via Command Line", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.args:(\"/private/var/db/SystemKey\" or \"/var/db/SystemKey\")\n", + "references": [ + "https://github.com/AlessandroZ/LaZagne/blob/master/Mac/lazagne/softwares/system/chainbreaker.py" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d75991f2-b989-419d-b797-ac1e54ec2d61", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1555", + "name": "Credentials from Password Stores", + "reference": "https://attack.mitre.org/techniques/T1555/", + "subtechnique": [ + { + "id": "T1555.001", + "name": "Keychain", + "reference": "https://attack.mitre.org/techniques/T1555/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "d75991f2-b989-419d-b797-ac1e54ec2d61_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_106.json b/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_106.json new file mode 100644 index 00000000000..357c2c3220e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_106.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Interactive Terminal Spawned via Python", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n(\n (process.parent.name : \"python*\" and process.name : \"*sh\" and process.parent.args_count \u003e= 3 and\n process.parent.args : \"*pty.spawn*\" and process.parent.args : \"-c\") or\n (process.parent.name : \"python*\" and process.name : \"*sh\" and process.args : \"*sh\" and process.args_count == 1\n and process.parent.args_count == 1)\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d76b02ef-fc95-4001-9297-01cb7412232f", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.006", + "name": "Python", + "reference": "https://attack.mitre.org/techniques/T1059/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d76b02ef-fc95-4001-9297-01cb7412232f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_107.json b/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_107.json new file mode 100644 index 00000000000..dc0d6ee01e0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d76b02ef-fc95-4001-9297-01cb7412232f_107.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a terminal (tty) is spawned via Python. Attackers may upgrade a simple reverse shell to a fully interactive tty after obtaining initial access to a host.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Interactive Terminal Spawned via Python", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n(\n (process.parent.name : \"python*\" and process.name : \"*sh\" and process.parent.args_count \u003e= 3 and\n process.parent.args : \"*pty.spawn*\" and process.parent.args : \"-c\") or\n (process.parent.name : \"python*\" and process.name : \"*sh\" and process.args : \"*sh\" and process.args_count == 1\n and process.parent.args_count == 1)\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d76b02ef-fc95-4001-9297-01cb7412232f", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.006", + "name": "Python", + "reference": "https://attack.mitre.org/techniques/T1059/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "d76b02ef-fc95-4001-9297-01cb7412232f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d79c4b2a-6134-4edd-86e6-564a92a933f9_103.json b/packages/security_detection_engine/kibana/security_rule/d79c4b2a-6134-4edd-86e6-564a92a933f9_103.json new file mode 100644 index 00000000000..b34c3ed18a3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d79c4b2a-6134-4edd-86e6-564a92a933f9_103.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Austin Songer" + ], + "description": "Identifies when the Azure role-based access control (Azure RBAC) permissions are modified for an Azure Blob. An adversary may modify the permissions on a blob to weaken their target's security controls or an administrator may inadvertently modify the permissions, which could lead to data exposure or loss.", + "false_positives": [ + "Blob permissions may be modified by system administrators. Verify that the configuration change was expected. Exceptions can be added to this rule to filter expected behavior." + ], + "index": [ + "filebeat-*", + "logs-azure*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Azure Blob Permissions Modification", + "note": "", + "query": "event.dataset:azure.activitylogs and azure.activitylogs.operation_name:(\n \"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MANAGEOWNERSHIP/ACTION\" or\n \"MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/BLOBS/MODIFYPERMISSIONS/ACTION\") and\n event.outcome:(Success or success)\n", + "references": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles" + ], + "related_integrations": [ + { + "integration": "activitylogs", + "package": "azure", + "version": "^1.0.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "azure.activitylogs.operation_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "d79c4b2a-6134-4edd-86e6-564a92a933f9", + "setup": "The Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Domain: Cloud", + "Data Source: Azure", + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "d79c4b2a-6134-4edd-86e6-564a92a933f9_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d7d5c059-c19a-4a96-8ae3-41496ef3bcf9_103.json b/packages/security_detection_engine/kibana/security_rule/d7d5c059-c19a-4a96-8ae3-41496ef3bcf9_103.json new file mode 100644 index 00000000000..1588199870f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d7d5c059-c19a-4a96-8ae3-41496ef3bcf9_103.json @@ -0,0 +1,65 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job found an unusually large spike in successful authentication events. This can be due to password spraying, user enumeration or brute force activity.", + "false_positives": [ + "Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_high_count_logon_events", + "name": "Spike in Logon Events", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "d7d5c059-c19a-4a96-8ae3-41496ef3bcf9", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "d7d5c059-c19a-4a96-8ae3-41496ef3bcf9_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d7e62693-aab9-4f66-a21a-3d79ecdd603d_102.json b/packages/security_detection_engine/kibana/security_rule/d7e62693-aab9-4f66-a21a-3d79ecdd603d_102.json new file mode 100644 index 00000000000..a92342d9898 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d7e62693-aab9-4f66-a21a-3d79ecdd603d_102.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects events that may indicate use of SMTP on TCP port 26. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems.", + "false_positives": [ + "Servers that process email traffic may cause false positives and should be excluded from this rule as this is expected behavior." + ], + "from": "now-9m", + "index": [ + "packetbeat-*", + "logs-network_traffic.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "SMTP on Port 26/TCP", + "query": "event.dataset: network_traffic.flow and network.transport:tcp and (destination.port:26 or (event.dataset:zeek.smtp and destination.port:26))\n", + "references": [ + "https://unit42.paloaltonetworks.com/unit42-badpatch/", + "https://isc.sans.edu/forums/diary/Next+up+whats+up+with+TCP+port+26/25564/" + ], + "related_integrations": [ + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.transport", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d", + "severity": "low", + "tags": [ + "Tactic: Command and Control", + "Domain: Endpoint", + "Use Case: Threat Detection" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0010", + "name": "Exfiltration", + "reference": "https://attack.mitre.org/tactics/TA0010/" + }, + "technique": [ + { + "id": "T1048", + "name": "Exfiltration Over Alternative Protocol", + "reference": "https://attack.mitre.org/techniques/T1048/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 102 + }, + "id": "d7e62693-aab9-4f66-a21a-3d79ecdd603d_102", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d8ab1ec1-feeb-48b9-89e7-c12e189448aa_5.json b/packages/security_detection_engine/kibana/security_rule/d8ab1ec1-feeb-48b9-89e7-c12e189448aa_5.json new file mode 100644 index 00000000000..470326da766 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d8ab1ec1-feeb-48b9-89e7-c12e189448aa_5.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempt to load an untrusted driver. Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Untrusted Driver Loaded", + "note": "## Triage and analysis\n\n### Investigating Untrusted Driver Loaded\n\nMicrosoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. \n\nThis protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.\n\nThis rule identifies an attempt to load an untrusted driver, which effectively means that DSE was disabled or bypassed. This can indicate that the system was compromised.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:\n - Identify the path that the driver was loaded from. If you're using Elastic Defend, path information can be found in the `dll.path` field.\n - Examine the file creation and modification timestamps:\n - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `dll.Ext.relative_file_name_modify_time` fields. The values are in seconds.\n - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.\n - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Use Osquery to investigate the drivers loaded into the system.\n - !{osquery{\"label\":\"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \\\"Microsoft\\\" AND signed == \\\"1\\\")\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Unsigned Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \\\"0\\\"\\n\"}}\n- Identify the driver's `Device Name` and `Service Name`.\n- Check for alerts from the rules specified in the `Related Rules` section.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.\n\n### Related Rules\n\n- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9\n- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd\n- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)\n- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.\n - This can be done via PowerShell `Remove-Service` cmdlet.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Ensure that the Driver Signature Enforcement is enabled on the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "driver where host.os.type == \"windows\" and process.pid == 4 and\n dll.code_signature.trusted != true and \n not dll.code_signature.status : (\"errorExpired\", \"errorRevoked\")\n", + "references": [ + "https://github.com/hfiref0x/TDL", + "https://docs.microsoft.com/en-us/previous-versions/windows/hardware/design/dn653559(v=vs.85)?redirectedfrom=MSDN" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pid", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "d8ab1ec1-feeb-48b9-89e7-c12e189448aa", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.006", + "name": "Code Signing Policy Modification", + "reference": "https://attack.mitre.org/techniques/T1553/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "d8ab1ec1-feeb-48b9-89e7-c12e189448aa_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/d99a037b-c8e2-47a5-97b9-170d076827c4_106.json b/packages/security_detection_engine/kibana/security_rule/d99a037b-c8e2-47a5-97b9-170d076827c4_106.json new file mode 100644 index 00000000000..79bf1144174 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/d99a037b-c8e2-47a5-97b9-170d076827c4_106.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies the use of the Win32_ShadowCopy class and related cmdlets to achieve shadow copy deletion. This commonly occurs in tandem with ransomware or other destructive attacks.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Volume Shadow Copy Deletion via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Volume Shadow Copy Deletion via PowerShell\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.\n\nThis rule monitors the execution of PowerShell cmdlets to interact with the Win32_ShadowCopy WMI class, retrieve shadow copy objects, and delete them.\n\n#### Possible investigation steps\n\n- Investigate the program execution chain (parent process tree).\n- Check whether the account is authorized to perform this operation.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n process.args : (\"*Get-WmiObject*\", \"*gwmi*\", \"*Get-CimInstance*\", \"*gcim*\") and\n process.args : (\"*Win32_ShadowCopy*\") and\n process.args : (\"*.Delete()*\", \"*Remove-WmiObject*\", \"*rwmi*\", \"*Remove-CimInstance*\", \"*rcim*\")\n", + "references": [ + "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/vsswmi/win32-shadowcopy", + "https://powershell.one/wmi/root/cimv2/win32_shadowcopy", + "https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "d99a037b-c8e2-47a5-97b9-170d076827c4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "d99a037b-c8e2-47a5-97b9-170d076827c4_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/da7733b1-fe08-487e-b536-0a04c6d8b0cd_5.json b/packages/security_detection_engine/kibana/security_rule/da7733b1-fe08-487e-b536-0a04c6d8b0cd_5.json new file mode 100644 index 00000000000..51d05d2fee9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/da7733b1-fe08-487e-b536-0a04c6d8b0cd_5.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to disable/modify the code signing policy through the registry. Code signing provides authenticity on a program, and grants the user with the ability to check whether the program has been tampered with. By allowing the execution of unsigned or self-signed code, threat actors can craft and execute malicious code.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Code Signing Policy Modification Through Registry", + "note": "## Triage and analysis\n\n### Investigating Code Signing Policy Modification Through Registry\n\nMicrosoft created the Windows Driver Signature Enforcement (DSE) security feature to prevent drivers with invalid signatures from loading and executing into the kernel (ring 0). DSE aims to protect systems by blocking attackers from loading malicious drivers on targets. \n\nThis protection is essential for maintaining system security. However, attackers or administrators can disable DSE and load untrusted drivers, which can put the system at risk. Therefore, it's important to keep this feature enabled and only load drivers from trusted sources to ensure system integrity and security.\n\nThis rule identifies registry modifications that can disable DSE.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Use Osquery and endpoint driver events (`event.category = \"driver\"`) to investigate if suspicious drivers were loaded into the system after the registry was modified.\n - !{osquery{\"label\":\"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \\\"Microsoft\\\" AND signed == \\\"1\\\")\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Unsigned Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \\\"0\\\"\\n\"}}\n- Identify the driver's `Device Name` and `Service Name`.\n- Check for alerts from the rules specified in the `Related Rules` section.\n\n### False positive analysis\n\n- This activity should not happen legitimately. The security team should address any potential benign true positive (B-TP), as this configuration can put the user and the domain at risk.\n\n### Related Rules\n\n- First Time Seen Driver Loaded - df0fd41e-5590-4965-ad5e-cd079ec22fa9\n- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa\n- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode.)\n- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.\n - This can be done via PowerShell `Remove-Service` cmdlet.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Remove and block malicious artifacts identified during triage.\n- Ensure that the Driver Signature Enforcement is enabled on the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "registry where host.os.type == \"windows\" and event.type : (\"creation\", \"change\") and\n(\n registry.path : \"HKEY_USERS\\\\*\\\\Software\\\\Policies\\\\Microsoft\\\\Windows NT\\\\Driver Signing\\\\BehaviorOnFailedVerify\" and\n registry.value: \"BehaviorOnFailedVerify\" and\n registry.data.strings : (\"0\", \"0x00000000\", \"1\", \"0x00000001\")\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.value", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "da7733b1-fe08-487e-b536-0a04c6d8b0cd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.006", + "name": "Code Signing Policy Modification", + "reference": "https://attack.mitre.org/techniques/T1553/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "da7733b1-fe08-487e-b536-0a04c6d8b0cd_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/da87eee1-129c-4661-a7aa-57d0b9645fad_8.json b/packages/security_detection_engine/kibana/security_rule/da87eee1-129c-4661-a7aa-57d0b9645fad_8.json new file mode 100644 index 00000000000..f7be99016ba --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/da87eee1-129c-4661-a7aa-57d0b9645fad_8.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a new Windows service with suspicious Service command values. Windows services typically run as SYSTEM and can be used for privilege escalation and persistence.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Service was Installed in the System", + "note": "## Triage and analysis\n\n### Investigating Suspicious Service was Installed in the System\n\nAttackers may create new services to execute system shells and other command execution utilities to elevate their privileges from administrator to SYSTEM. They can also configure services to execute these utilities with persistence payloads.\n\nThis rule looks for suspicious services being created with suspicious traits compatible with the above behavior.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify how the service was created or modified. Look for registry changes events or Windows events related to service activities (for example, 4697 and/or 7045).\n - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \\\"Microsoft\\\" AND signed == \\\"1\\\")\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Unsigned Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \\\"0\\\"\\n\"}}\n - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n\n### False positive analysis\n\n- Certain services such as PSEXECSVC may happen legitimately. The security team should address any potential benign true positive (B-TP) by excluding the relevant FP by pattern.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "any where\n (event.code : \"4697\" and\n (winlog.event_data.ServiceFileName : \n (\"*COMSPEC*\", \"*\\\\127.0.0.1*\", \"*Admin$*\", \"*powershell*\", \"*rundll32*\", \"*cmd.exe*\", \"*PSEXESVC*\", \n \"*echo*\", \"*RemComSvc*\", \"*.bat*\", \"*.cmd*\", \"*certutil*\", \"*vssadmin*\", \"*certmgr*\", \"*bitsadmin*\", \n \"*\\\\Users\\\\*\", \"*\\\\Windows\\\\Temp\\\\*\", \"*\\\\Windows\\\\Tasks\\\\*\", \"*\\\\PerfLogs\\\\*\", \"*\\\\Windows\\\\Debug\\\\*\",\n \"*regsvr32*\", \"*msbuild*\") or\n winlog.event_data.ServiceFileName regex~ \"\"\"%systemroot%\\\\[a-z0-9]+\\.exe\"\"\")) or\n\n (event.code : \"7045\" and\n winlog.event_data.ImagePath : (\n \"*COMSPEC*\", \"*\\\\127.0.0.1*\", \"*Admin$*\", \"*powershell*\", \"*rundll32*\", \"*cmd.exe*\", \"*PSEXESVC*\",\n \"*echo*\", \"*RemComSvc*\", \"*.bat*\", \"*.cmd*\", \"*certutil*\", \"*vssadmin*\", \"*certmgr*\", \"*bitsadmin*\",\n \"*\\\\Users\\\\*\", \"*\\\\Windows\\\\Temp\\\\*\", \"*\\\\Windows\\\\Tasks\\\\*\", \"*\\\\PerfLogs\\\\*\", \"*\\\\Windows\\\\Debug\\\\*\",\n \"*regsvr32*\", \"*msbuild*\"))\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.ImagePath", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.ServiceFileName", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "da87eee1-129c-4661-a7aa-57d0b9645fad", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 8 + }, + "id": "da87eee1-129c-4661-a7aa-57d0b9645fad_8", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/db65f5ba-d1ef-4944-b9e8-7e51060c2b42_1.json b/packages/security_detection_engine/kibana/security_rule/db65f5ba-d1ef-4944-b9e8-7e51060c2b42_1.json new file mode 100644 index 00000000000..0150a937dc6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/db65f5ba-d1ef-4944-b9e8-7e51060c2b42_1.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the attempt to disable Network-Level Authentication (NLA) via registry modification. Network Level Authentication (NLA) is a feature on Windows that provides an extra layer of security for Remote Desktop (RDP) connections, as it requires users to authenticate before allowing a full RDP session. Attackers can disable NLA to enable persistence methods that require access to the Windows sign-in screen without authenticating, such as Accessibility Features persistence methods, like Sticky Keys.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network-Level Authentication (NLA) Disabled", + "query": "registry where host.os.type == \"windows\" and event.action != \"deletion\" and\n registry.path :\n (\"HKLM\\\\SYSTEM\\\\ControlSet*\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\UserAuthentication\", \n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Terminal Server\\\\WinStations\\\\RDP-Tcp\\\\UserAuthentication\" ) and\n registry.data.strings : \"0\"\n", + "references": [ + "https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "db65f5ba-d1ef-4944-b9e8-7e51060c2b42", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend", + "Data Source: Elastic Endgame", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "db65f5ba-d1ef-4944-b9e8-7e51060c2b42_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd_4.json b/packages/security_detection_engine/kibana/security_rule/db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd_4.json new file mode 100644 index 00000000000..4dc461744ab --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd_4.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to execute a program on the host from the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution via Windows Subsystem for Linux", + "query": "process where host.os.type == \"windows\" and event.type : \"start\" and\n process.parent.executable : \n (\"?:\\\\Windows\\\\System32\\\\wsl.exe\", \n \"?:\\\\Program Files*\\\\WindowsApps\\\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\\\wsl.exe\", \n \"?:\\\\Windows\\\\System32\\\\wslhost.exe\", \n \"?:\\\\Program Files*\\\\WindowsApps\\\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\\\wslhost.exe\") and \n not process.executable : \n (\"?:\\\\Windows\\\\System32\\\\conhost.exe\", \n \"?:\\\\Windows\\\\System32\\\\lxss\\\\wslhost.exe\", \n \"?:\\\\Windows\\\\Sys*\\\\wslconfig.exe\", \n \"?:\\\\Program Files*\\\\WindowsApps\\\\MicrosoftCorporationII.WindowsSubsystemForLinux_*\\\\wsl*.exe\", \n \"?:\\\\Windows\\\\System32\\\\WerFault.exe\", \n \"?:\\\\Program Files\\\\*\", \n \"?:\\\\Program Files (x86)\\\\*\")\n", + "references": [ + "https://learn.microsoft.com/en-us/windows/wsl/wsl-config" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "db7dbad5-08d2-4d25-b9b1-d3a1e4a15efd_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_1.json b/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_1.json new file mode 100644 index 00000000000..6eb408e8e66 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_1.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the \"-c\" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Content Extracted or Decompressed via Funzip", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n((process.args == \"tail\" and process.args == \"-c\" and process.args == \"funzip\")) and\nnot process.args : \"/var/log/messages\" and \nnot process.parent.executable : (\"/usr/bin/dracut\", \"/sbin/dracut\", \"/usr/bin/xargs\") and\nnot (process.parent.name in (\"sh\", \"sudo\") and process.parent.command_line : \"*nessus_su*\")\n", + "references": [ + "https://attack.mitre.org/software/S0482/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "dc0b7782-0df0-47ff-8337-db0d678bdb66", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "dc0b7782-0df0-47ff-8337-db0d678bdb66_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_2.json b/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_2.json new file mode 100644 index 00000000000..ab40fe592ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dc0b7782-0df0-47ff-8337-db0d678bdb66_2.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when suspicious content is extracted from a file and subsequently decompressed using the funzip utility. Malware may execute the tail utility using the \"-c\" option to read a sequence of bytes from the end of a file. The output from tail can be piped to funzip in order to decompress malicious code before it is executed. This behavior is consistent with malware families such as Bundlore.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Content Extracted or Decompressed via Funzip", + "query": "process where host.os.type == \"linux\" and event.action in (\"exec\", \"exec_event\") and\n((process.args == \"tail\" and process.args == \"-c\" and process.args == \"funzip\")) and\nnot process.args : \"/var/log/messages\" and \nnot process.parent.executable : (\"/usr/bin/dracut\", \"/sbin/dracut\", \"/usr/bin/xargs\") and\nnot (process.parent.name in (\"sh\", \"sudo\") and process.parent.command_line : \"*nessus_su*\")\n", + "references": [ + "https://attack.mitre.org/software/S0482/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "dc0b7782-0df0-47ff-8337-db0d678bdb66", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "dc0b7782-0df0-47ff-8337-db0d678bdb66_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dc71c186-9fe4-4437-a4d0-85ebb32b8204_3.json b/packages/security_detection_engine/kibana/security_rule/dc71c186-9fe4-4437-a4d0-85ebb32b8204_3.json new file mode 100644 index 00000000000..854658c2935 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dc71c186-9fe4-4437-a4d0-85ebb32b8204_3.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of mount process with hidepid parameter, which can make processes invisible to other users from the system. Adversaries using Linux kernel version 3.2+ (or RHEL/CentOS v6.5+ above) can hide the process from other users. When hidepid=2 option is executed to mount the /proc filesystem, only the root user can see all processes and the logged-in user can only see their own process. This provides a defense evasion mechanism for the adversaries to hide their process executions from all other commands such as ps, top, pgrep and more. With the Linux kernel hardening hidepid option all the user has to do is remount the /proc filesystem with the option, which can now be monitored and detected.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Hidden Process via Mount Hidepid", + "query": "process where host.os.type == \"linux\" and process.name == \"mount\" and event.action == \"exec\" and\nprocess.args == \"/proc\" and process.args == \"-o\" and process.args : \"*hidepid=2*\"\n", + "references": [ + "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "dc71c186-9fe4-4437-a4d0-85ebb32b8204", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "dc71c186-9fe4-4437-a4d0-85ebb32b8204_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dc9c1f74-dac3-48e3-b47f-eb79db358f57_106.json b/packages/security_detection_engine/kibana/security_rule/dc9c1f74-dac3-48e3-b47f-eb79db358f57_106.json new file mode 100644 index 00000000000..c22d53c8f76 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dc9c1f74-dac3-48e3-b47f-eb79db358f57_106.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of wmic.exe for shadow copy deletion on endpoints. This commonly occurs in tandem with ransomware or other destructive attacks.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Volume Shadow Copy Deletion via WMIC", + "note": "## Triage and analysis\n\n### Investigating Volume Shadow Copy Deletion via WMIC\n\nThe Volume Shadow Copy Service (VSS) is a Windows feature that enables system administrators to take snapshots of volumes that can later be restored or mounted to recover specific files or folders.\n\nA typical step in the playbook of an attacker attempting to deploy ransomware is to delete Volume Shadow Copies to ensure that victims have no alternative to paying the ransom, making any action that deletes shadow copies worth monitoring.\n\nThis rule monitors the execution of `wmic.exe` to interact with VSS via the `shadowcopy` alias and delete parameter.\n\n#### Possible investigation steps\n\n- Investigate the program execution chain (parent process tree).\n- Check whether the account is authorized to perform this operation.\n- Contact the account owner and confirm whether they are aware of this activity.\n- In the case of a resize operation, check if the resize value is equal to suspicious values, like 401MB.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences in other hosts.\n- Check if any files on the host machine have been encrypted.\n\n\n### False positive analysis\n\n- This rule has chances of producing benign true positives (B-TPs). If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Related rules\n\n- Volume Shadow Copy Deleted or Resized via VssAdmin - b5ea4bfe-a1b2-421f-9d47-22a75a6f2921\n- Volume Shadow Copy Deletion via PowerShell - d99a037b-c8e2-47a5-97b9-170d076827c4\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Priority should be given due to the advanced stage of this activity on the attack.\n- Consider isolating the involved host to prevent destructive behavior, which is commonly associated with this activity.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- If data was encrypted, deleted, or modified, activate your data recovery plan.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"WMIC.exe\" or process.pe.original_file_name == \"wmic.exe\") and\n process.args : \"delete\" and process.args : \"shadowcopy\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Impact", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1490", + "name": "Inhibit System Recovery", + "reference": "https://attack.mitre.org/techniques/T1490/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "dc9c1f74-dac3-48e3-b47f-eb79db358f57_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dca28dee-c999-400f-b640-50a081cc0fd1_106.json b/packages/security_detection_engine/kibana/security_rule/dca28dee-c999-400f-b640-50a081cc0fd1_106.json new file mode 100644 index 00000000000..5cb902a9825 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dca28dee-c999-400f-b640-50a081cc0fd1_106.json @@ -0,0 +1,43 @@ +{ + "attributes": { + "anomaly_threshold": 50, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected AWS command activity that, while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys being used by a threat actor in a different geography than the authorized user(s).", + "false_positives": [ + "New or unusual command and user geolocation activity can be due to manual troubleshooting or reconfiguration; changes in cloud automation scripts or workflows; adoption of new services; expansion into new regions; increased adoption of work from home policies; or users who travel frequently." + ], + "from": "now-2h", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "rare_method_for_a_country", + "name": "Unusual Country For an AWS Command", + "note": "## Triage and analysis\n\n### Investigating Unusual Country For an AWS Command\n\nCloudTrail logging provides visibility on actions taken within an AWS environment. By monitoring these events and understanding what is considered normal behavior within an organization, you can spot suspicious or malicious activity when deviations occur.\n\nThis rule uses a machine learning job to detect an AWS API command that while not inherently suspicious or abnormal, is sourcing from a geolocation (country) that is unusual for the command. This can be the result of compromised credentials or keys used by a threat actor in a different geography than the authorized user(s).\n\nDetection alerts from this rule indicate an AWS API command or method call that is rare and unusual for the geolocation of the source IP address.\n\n#### Possible investigation steps\n\n- Identify the user account involved and the action performed. Verify whether it should perform this kind of action.\n - Examine the user identity in the `aws.cloudtrail.user_identity.arn` field and the access key ID in the `aws.cloudtrail.user_identity.access_key_id` field, which can help identify the precise user context.\n - The user agent details in the `user_agent.original` field may also indicate what kind of a client made the request.\n- Investigate other alerts associated with the user account during the past 48 hours.\n- Validate the activity is not related to planned patches, updates, or network administrator activity.\n- Examine the request parameters. These might indicate the source of the program or the nature of its tasks.\n- Considering the source IP address and geolocation of the user who issued the command:\n - Do they look normal for the calling user?\n - If the source is an EC2 IP address, is it associated with an EC2 instance in one of your accounts or is the source IP from an EC2 instance that's not under your control?\n - If it is an authorized EC2 instance, is the activity associated with normal behavior for the instance role or roles? Are there any other alerts or signs of suspicious activity involving this instance?\n- Consider the time of day. If the user is a human (not a program or script), did the activity take place during a normal time of day?\n- Contact the account owner and confirm whether they are aware of this activity if suspicious.\n- If you suspect the account has been compromised, scope potentially compromised assets by tracking servers, services, and data accessed by the account in the last 24 hours.\n\n### False Positive Analysis\n\n- False positives can occur if activity is coming from new employees based in a country with no previous history in AWS.\n- Examine the history of the command. If the command only manifested recently, it might be part of a new automation module or script. If it has a consistent cadence (for example, it appears in small numbers on a weekly or monthly cadence), it might be part of a housekeeping or maintenance process. You can find the command in the `event.action field` field.\n\n### Related Rules\n\n- Unusual City For an AWS Command - 809b70d3-e2c3-455e-af1b-2626a5a1a276\n- Unusual AWS Command for a User - ac706eae-d5ec-4b14-b4fd-e8ba8086f0e1\n- Rare AWS Error Code - 19de8096-e2b0-4bd8-80c9-34a820813fff\n- Spike in AWS Error Messages - 78d3d8d9-b476-451d-a9e0-7a5addd70670\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Disable or limit the account during the investigation and response.\n- Identify the possible impact of the incident and prioritize accordingly; the following actions can help you gain context:\n - Identify the account role in the cloud environment.\n - Assess the criticality of affected services and servers.\n - Work with your IT team to identify and minimize the impact on users.\n - Identify if the attacker is moving laterally and compromising other accounts, servers, or services.\n - Identify any regulatory or legal ramifications related to this activity.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords or delete API keys as needed to revoke the attacker's access to the environment. Work with your IT teams to minimize the impact on business operations during these actions.\n- Check if unauthorized new users were created, remove unauthorized new accounts, and request password resets for other IAM users.\n- Consider enabling multi-factor authentication for users.\n- Review the permissions assigned to the implicated user to ensure that the least privilege principle is being followed.\n- Implement security best practices [outlined](https://aws.amazon.com/premiumsupport/knowledge-center/security-best-practices/) by AWS.\n- Take the actions needed to return affected systems, data, or services to their normal operational levels.\n- Identify the initial vector abused by the attacker and take action to prevent reinfection via the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "aws", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "dca28dee-c999-400f-b640-50a081cc0fd1", + "setup": "The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Domain: Cloud", + "Data Source: AWS", + "Data Source: Amazon Web Services", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Resources: Investigation Guide" + ], + "type": "machine_learning", + "version": 106 + }, + "id": "dca28dee-c999-400f-b640-50a081cc0fd1_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_4.json b/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_4.json new file mode 100644 index 00000000000..fae05faedf3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_4.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Install Kali Linux via WSL", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (process.name : \"wsl.exe\" and process.args : (\"-d\", \"--distribution\", \"-i\", \"--install\") and process.args : \"kali*\") or \n process.executable : \n (\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\packages\\\\kalilinux*\", \n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\WindowsApps\\\\kali.exe\",\n \"?:\\\\Program Files*\\\\WindowsApps\\\\KaliLinux.*\\\\kali.exe\")\n )\n", + "references": [ + "https://learn.microsoft.com/en-us/windows/wsl/wsl-config" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_5.json b/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_5.json new file mode 100644 index 00000000000..07ba3f79d42 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_5.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to install or use Kali Linux via Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Install Kali Linux via WSL", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (process.name : \"wsl.exe\" and process.args : (\"-d\", \"--distribution\", \"-i\", \"--install\") and process.args : \"kali*\") or \n process.executable : \n (\"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\packages\\\\kalilinux*\", \n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Microsoft\\\\WindowsApps\\\\kali.exe\",\n \"?:\\\\Program Files*\\\\WindowsApps\\\\KaliLinux.*\\\\kali.exe\")\n )\n", + "references": [ + "https://learn.microsoft.com/en-us/windows/wsl/wsl-config" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "dd34b062-b9e3-4a6b-8c0c-6c8ca6dd450e_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_4.json b/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_4.json deleted file mode 100644 index 0ad9c5be712..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_4.json +++ /dev/null @@ -1,104 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies a reverse shell via the abuse of named pipes on Linux with the help of OpenSSL or Netcat. First in, first out (FIFO) files are special files for reading and writing to by Linux processes. For this to work, a named pipe is created and passed to a Linux shell where the use of a network connection tool such as Netcat or OpenSSL has been established. The stdout and stderr are captured in the named pipe from the network connection and passed back to the shell for execution.", - "false_positives": [ - "Netcat and OpenSSL are common tools used for establishing network connections and creating encryption keys. While they are popular, capturing the stdout and stderr in a named pipe pointed to a shell is anomalous." - ], - "from": "now-9m", - "index": [ - "auditbeat-*", - "logs-endpoint.events.*", - "endgame-*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Reverse Shell Created via Named Pipe", - "query": "sequence by host.id with maxspan = 5s\n [process where host.os.type == \"linux\" and event.type == \"start\" and process.executable : (\"/usr/bin/mkfifo\",\"/usr/bin/mknod\") and process.args:(\"/tmp/*\",\"$*\")]\n [process where host.os.type == \"linux\" and process.executable : (\"/bin/sh\",\"/bin/bash\") and process.args:(\"-i\") or\n (process.executable: (\"/usr/bin/openssl\") and process.args: (\"-connect\"))]\n [process where host.os.type == \"linux\" and (process.name:(\"nc\",\"ncat\",\"netcat\",\"netcat.openbsd\",\"netcat.traditional\") or\n (process.name: \"openssl\" and process.executable: \"/usr/bin/openssl\"))]\n", - "references": [ - "https://int0x33.medium.com/day-43-reverse-shell-with-openssl-1ee2574aa998", - "https://blog.gregscharf.com/2021/03/22/tar-in-cronjob-to-privilege-escalation/", - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#openssl" - ], - "related_integrations": [ - { - "package": "endpoint", - "version": "^8.2.0" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.id", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.args", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.executable", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.name", - "type": "keyword" - } - ], - "risk_score": 47, - "rule_id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd", - "severity": "medium", - "tags": [ - "Elastic", - "Host", - "Linux", - "Threat Detection", - "Execution", - "Investigation Guide", - "Elastic Endgame" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command and Scripting Interpreter", - "reference": "https://attack.mitre.org/techniques/T1059/", - "subtechnique": [ - { - "id": "T1059.004", - "name": "Unix Shell", - "reference": "https://attack.mitre.org/techniques/T1059/004/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 4 - }, - "id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd_4", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_5.json b/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_5.json deleted file mode 100644 index b49ae56114f..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_5.json +++ /dev/null @@ -1,103 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies a reverse shell via the abuse of named pipes on Linux with the help of OpenSSL or Netcat. First in, first out (FIFO) files are special files for reading and writing to by Linux processes. For this to work, a named pipe is created and passed to a Linux shell where the use of a network connection tool such as Netcat or OpenSSL has been established. The stdout and stderr are captured in the named pipe from the network connection and passed back to the shell for execution.", - "false_positives": [ - "Netcat and OpenSSL are common tools used for establishing network connections and creating encryption keys. While they are popular, capturing the stdout and stderr in a named pipe pointed to a shell is anomalous." - ], - "from": "now-9m", - "index": [ - "auditbeat-*", - "logs-endpoint.events.*", - "endgame-*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Reverse Shell Created via Named Pipe", - "query": "sequence by host.id with maxspan = 5s\n [process where host.os.type == \"linux\" and event.type == \"start\" and process.executable : (\"/usr/bin/mkfifo\",\"/usr/bin/mknod\") and process.args:(\"/tmp/*\",\"$*\")]\n [process where host.os.type == \"linux\" and process.executable : (\"/bin/sh\",\"/bin/bash\") and process.args:(\"-i\") or\n (process.executable: (\"/usr/bin/openssl\") and process.args: (\"-connect\"))]\n [process where host.os.type == \"linux\" and (process.name:(\"nc\",\"ncat\",\"netcat\",\"netcat.openbsd\",\"netcat.traditional\") or\n (process.name: \"openssl\" and process.executable: \"/usr/bin/openssl\"))]\n", - "references": [ - "https://int0x33.medium.com/day-43-reverse-shell-with-openssl-1ee2574aa998", - "https://blog.gregscharf.com/2021/03/22/tar-in-cronjob-to-privilege-escalation/", - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#openssl" - ], - "related_integrations": [ - { - "package": "endpoint", - "version": "^8.2.0" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.id", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.args", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.executable", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.name", - "type": "keyword" - } - ], - "risk_score": 47, - "rule_id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd", - "severity": "medium", - "tags": [ - "Elastic", - "Host", - "Linux", - "Threat Detection", - "Execution", - "Elastic Endgame" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command and Scripting Interpreter", - "reference": "https://attack.mitre.org/techniques/T1059/", - "subtechnique": [ - { - "id": "T1059.004", - "name": "Unix Shell", - "reference": "https://attack.mitre.org/techniques/T1059/004/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 5 - }, - "id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd_5", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_6.json b/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_6.json deleted file mode 100644 index a085c6db76c..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/dd7f1524-643e-11ed-9e35-f661ea17fbcd_6.json +++ /dev/null @@ -1,102 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies a reverse shell via the abuse of named pipes on Linux with the help of OpenSSL or Netcat. First in, first out (FIFO) files are special files for reading and writing to by Linux processes. For this to work, a named pipe is created and passed to a Linux shell where the use of a network connection tool such as Netcat or OpenSSL has been established. The stdout and stderr are captured in the named pipe from the network connection and passed back to the shell for execution.", - "false_positives": [ - "Netcat and OpenSSL are common tools used for establishing network connections and creating encryption keys. While they are popular, capturing the stdout and stderr in a named pipe pointed to a shell is anomalous." - ], - "from": "now-9m", - "index": [ - "auditbeat-*", - "logs-endpoint.events.*", - "endgame-*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Reverse Shell Created via Named Pipe", - "query": "sequence by host.id with maxspan = 5s\n [process where host.os.type == \"linux\" and event.type == \"start\" and process.executable : (\"/usr/bin/mkfifo\",\"/usr/bin/mknod\") and process.args:(\"/tmp/*\",\"$*\")]\n [process where host.os.type == \"linux\" and process.executable : (\"/bin/sh\",\"/bin/bash\") and process.args:(\"-i\") or\n (process.executable: (\"/usr/bin/openssl\") and process.args: (\"-connect\"))]\n [process where host.os.type == \"linux\" and (process.name:(\"nc\",\"ncat\",\"netcat\",\"netcat.openbsd\",\"netcat.traditional\") or\n (process.name: \"openssl\" and process.executable: \"/usr/bin/openssl\"))]\n", - "references": [ - "https://int0x33.medium.com/day-43-reverse-shell-with-openssl-1ee2574aa998", - "https://blog.gregscharf.com/2021/03/22/tar-in-cronjob-to-privilege-escalation/", - "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md#openssl" - ], - "related_integrations": [ - { - "package": "endpoint", - "version": "^8.2.0" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.id", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.args", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.executable", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.name", - "type": "keyword" - } - ], - "risk_score": 47, - "rule_id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd", - "severity": "medium", - "tags": [ - "Domain: Endpoint", - "OS: Linux", - "Use Case: Threat Detection", - "Tactic: Execution", - "Data Source: Elastic Endgame" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0002", - "name": "Execution", - "reference": "https://attack.mitre.org/tactics/TA0002/" - }, - "technique": [ - { - "id": "T1059", - "name": "Command and Scripting Interpreter", - "reference": "https://attack.mitre.org/techniques/T1059/", - "subtechnique": [ - { - "id": "T1059.004", - "name": "Unix Shell", - "reference": "https://attack.mitre.org/techniques/T1059/004/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 6 - }, - "id": "dd7f1524-643e-11ed-9e35-f661ea17fbcd_6", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ddab1f5f-7089-44f5-9fda-de5b11322e77_105.json b/packages/security_detection_engine/kibana/security_rule/ddab1f5f-7089-44f5-9fda-de5b11322e77_105.json new file mode 100644 index 00000000000..1e89de8c677 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ddab1f5f-7089-44f5-9fda-de5b11322e77_105.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies NullSessionPipe registry modifications that specify which pipes can be accessed anonymously. This could be indicative of adversary lateral movement preparation by making the added pipe available to everyone.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "NullSessionPipe Registry Modification", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\nregistry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\services\\\\LanmanServer\\\\Parameters\\\\NullSessionPipes\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\services\\\\LanmanServer\\\\Parameters\\\\NullSessionPipes\"\n) and length(registry.data.strings) \u003e 0\n", + "references": [ + "https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ddab1f5f-7089-44f5-9fda-de5b11322e77", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "ddab1f5f-7089-44f5-9fda-de5b11322e77_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/de9bd7e0-49e9-4e92-a64d-53ade2e66af1_106.json b/packages/security_detection_engine/kibana/security_rule/de9bd7e0-49e9-4e92-a64d-53ade2e66af1_106.json new file mode 100644 index 00000000000..a1a6405542a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/de9bd7e0-49e9-4e92-a64d-53ade2e66af1_106.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious child process of the Windows virtual system process, which could indicate code injection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Child Process from a System Virtual Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.pid == 4 and\n not process.executable : (\"Registry\", \"MemCompression\", \"?:\\\\Windows\\\\System32\\\\smss.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.pid", + "type": "long" + } + ], + "risk_score": 73, + "rule_id": "de9bd7e0-49e9-4e92-a64d-53ade2e66af1", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "de9bd7e0-49e9-4e92-a64d-53ade2e66af1_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/debff20a-46bc-4a4d-bae5-5cdd14222795_105.json b/packages/security_detection_engine/kibana/security_rule/debff20a-46bc-4a4d-bae5-5cdd14222795_105.json new file mode 100644 index 00000000000..76f5a401eb3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/debff20a-46bc-4a4d-bae5-5cdd14222795_105.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries may encode/decode data in an attempt to evade detection by host- or network-based security controls.", + "false_positives": [ + "Automated tools such as Jenkins may encode or decode files as part of their normal behavior. These events can be filtered by the process executable or username values." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Base16 or Base32 Encoding/Decoding Activity", + "query": "event.category:process and host.os.type:linux and event.type:(start or process_started) and\n process.name:(base16 or base32 or base32plain or base32hex)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "debff20a-46bc-4a4d-bae5-5cdd14222795", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/" + }, + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "debff20a-46bc-4a4d-bae5-5cdd14222795_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_1.json b/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_1.json new file mode 100644 index 00000000000..5bfb83cd23f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_1.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Query Registry using Built-in Tools", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n process.name == \"reg.exe\" and process.args : \"query\" and\n not process.parent.executable : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\")\n ) or\n (\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n (process.args: (\"*Get-ChildItem*\", \"*Get-Item*\", \"*Get-ItemProperty*\") and\n process.args : (\"*HKLM*\", \"*HKCU*\", \"*HKEY_LOCAL_MACHINE*\", \"*HKEY_CURRENT_USER*\", \"*Registry::*\"))\n )\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "ded09d02-0137-4ccc-8005-c45e617e8d4c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1012", + "name": "Query Registry", + "reference": "https://attack.mitre.org/techniques/T1012/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "ded09d02-0137-4ccc-8005-c45e617e8d4c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_2.json b/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_2.json new file mode 100644 index 00000000000..e7b70dfc2f8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ded09d02-0137-4ccc-8005-c45e617e8d4c_2.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "This rule identifies the execution of commands that can be used to query the Windows Registry. Adversaries may query the registry to gain situational awareness about the host, like installed security software, programs and settings.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Query Registry using Built-in Tools", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n(\n (\n process.name == \"reg.exe\" and process.args : \"query\" and\n not process.parent.executable : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\")\n ) or\n (\n process.name: (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") and\n (process.args: (\"*Get-ChildItem*\", \"*Get-Item*\", \"*Get-ItemProperty*\") and\n process.args : (\"*HKLM*\", \"*HKCU*\", \"*HKEY_LOCAL_MACHINE*\", \"*HKEY_CURRENT_USER*\", \"*Registry::*\"))\n )\n) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "ded09d02-0137-4ccc-8005-c45e617e8d4c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1012", + "name": "Query Registry", + "reference": "https://attack.mitre.org/techniques/T1012/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "ded09d02-0137-4ccc-8005-c45e617e8d4c_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/df0fd41e-5590-4965-ad5e-cd079ec22fa9_5.json b/packages/security_detection_engine/kibana/security_rule/df0fd41e-5590-4965-ad5e-cd079ec22fa9_5.json new file mode 100644 index 00000000000..15252562ec1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/df0fd41e-5590-4965-ad5e-cd079ec22fa9_5.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the load of a driver with an original file name and signature values that were observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.", + "from": "now-9m", + "history_window_start": "now-30d", + "index": [ + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "First Time Seen Driver Loaded", + "new_terms_fields": [ + "dll.pe.original_file_name", + "dll.code_signature.subject_name" + ], + "note": "## Triage and analysis\n\n### Investigating First Time Seen Driver Loaded\n\nA driver is a software component that allows the operating system to communicate with hardware devices. It works at a high privilege level, the kernel level, having high control over the system's security and stability.\n\nAttackers may exploit known good but vulnerable drivers to execute code in their context because once an attacker can execute code in the kernel, security tools can no longer effectively protect the host. They can leverage these drivers to tamper, bypass and terminate security software, elevate privileges, create persistence mechanisms, and disable operating system protections and monitoring features. Attackers were seen in the wild conducting these actions before acting on their objectives, such as ransomware.\n\nRead the complete research on \"Stopping Vulnerable Driver Attacks\" done by Elastic Security Labs [here](https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks).\n\nThis rule identifies the load of a driver with an original file name and signature values observed for the first time during the last 30 days. This rule type can help baseline drivers installation within your environment.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Examine the driver loaded to identify potentially suspicious characteristics. The following actions can help you gain context:\n - Identify the path that the driver was loaded from. If using Elastic Defend, this information can be found in the `dll.path` field.\n - Examine the digital signature of the driver, and check if it's valid.\n - Examine the creation and modification timestamps of the file:\n - On Elastic Defend, those can be found in the `dll.Ext.relative_file_creation_time` and `\"dll.Ext.relative_file_name_modify_time\"` fields, with the values being seconds.\n - Search for file creation events sharing the same file name as the `dll.name` field and identify the process responsible for the operation.\n - Investigate any other abnormal behavior by the subject process, such as network connections, registry or file modifications, and any spawned child processes.\n - Use the driver SHA-256 (`dll.hash.sha256` field) hash value to search for the existence and reputation in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Use Osquery to investigate the drivers loaded into the system.\n - !{osquery{\"label\":\"Osquery - Retrieve All Non-Microsoft Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE NOT (provider == \\\"Microsoft\\\" AND signed == \\\"1\\\")\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve All Unsigned Drivers with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, class, description, directory, image, issuer_name, manufacturer, service, signed, subject_name FROM drivers JOIN authenticode ON drivers.image = authenticode.path JOIN hash ON drivers.image = hash.path WHERE signed == \\\"0\\\"\\n\"}}\n- Identify the driver's `Device Name` and `Service Name`.\n- Check for alerts from the rules specified in the `Related Rules` section.\n\n### False positive analysis\n\n- Matches derived from these rules are not inherently malicious. The security team should investigate them to ensure they are legitimate and needed, then include them in an allowlist only if required. The security team should address any vulnerable driver installation as it can put the user and the domain at risk.\n\n### Related Rules\n\n- Untrusted Driver Loaded - d8ab1ec1-feeb-48b9-89e7-c12e189448aa\n- Code Signing Policy Modification Through Registry - da7733b1-fe08-487e-b536-0a04c6d8b0cd\n- Code Signing Policy Modification Through Built-in tools - b43570de-a908-4f7f-8bdb-b2df6ffd8c80\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Disable and uninstall all suspicious drivers found in the system. This can be done via Device Manager. (Note that this step may require you to boot the system into Safe Mode)\n- Remove the related services and registry keys found in the system. Note that the service will probably not stop if the driver is still installed.\n - This can be done via PowerShell `Remove-Service` cmdlet.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Ensure that the Driver Signature Enforcement is enabled on the system.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "event.category:\"driver\" and host.os.type:windows and event.action:\"load\"\n", + "references": [ + "https://www.elastic.co/kr/security-labs/stopping-vulnerable-driver-attacks" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "df0fd41e-5590-4965-ad5e-cd079ec22fa9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 5 + }, + "id": "df0fd41e-5590-4965-ad5e-cd079ec22fa9_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/df197323-72a8-46a9-a08e-3f5b04a4a97a_103.json b/packages/security_detection_engine/kibana/security_rule/df197323-72a8-46a9-a08e-3f5b04a4a97a_103.json new file mode 100644 index 00000000000..4f562cf5f0b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/df197323-72a8-46a9-a08e-3f5b04a4a97a_103.json @@ -0,0 +1,68 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.", + "false_positives": [ + "A newly installed program, or one that runs under a new or rarely used user context, could trigger this detection rule. Manual interrogation of the metadata service during debugging or troubleshooting could trigger this rule." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_windows_rare_metadata_user" + ], + "name": "Unusual Windows User Calling the Metadata Service", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "risk_score": 21, + "rule_id": "df197323-72a8-46a9-a08e-3f5b04a4a97a", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1552", + "name": "Unsecured Credentials", + "reference": "https://attack.mitre.org/techniques/T1552/", + "subtechnique": [ + { + "id": "T1552.005", + "name": "Cloud Instance Metadata API", + "reference": "https://attack.mitre.org/techniques/T1552/005/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 103 + }, + "id": "df197323-72a8-46a9-a08e-3f5b04a4a97a_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/df6f62d9-caab-4b88-affa-044f4395a1e0_104.json b/packages/security_detection_engine/kibana/security_rule/df6f62d9-caab-4b88-affa-044f4395a1e0_104.json new file mode 100644 index 00000000000..53cb42da4c8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/df6f62d9-caab-4b88-affa-044f4395a1e0_104.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the copying of the Linux dynamic loader binary and subsequent file creation for the purpose of creating a backup copy. This technique was seen recently being utilized by Linux malware prior to patching the dynamic loader in order to inject and preload a malicious shared object file. This activity should never occur and if it does then it should be considered highly suspicious or malicious.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Dynamic Linker Copy", + "query": "sequence by process.entity_id with maxspan=1m\n[process where host.os.type == \"linux\" and event.type == \"start\" and process.name : (\"cp\", \"rsync\") and\n process.args : (\"/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2\", \"/etc/ld.so.preload\")]\n[file where host.os.type == \"linux\" and event.action == \"creation\" and file.extension == \"so\"]\n", + "references": [ + "https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "df6f62d9-caab-4b88-affa-044f4395a1e0", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Threat: Orbit", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.006", + "name": "Dynamic Linker Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "df6f62d9-caab-4b88-affa-044f4395a1e0_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e0881d20-54ac-457f-8733-fe0bc5d44c55_4.json b/packages/security_detection_engine/kibana/security_rule/e0881d20-54ac-457f-8733-fe0bc5d44c55_4.json new file mode 100644 index 00000000000..703632bfc8f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e0881d20-54ac-457f-8733-fe0bc5d44c55_4.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the usage of commonly used system service discovery techniques, which attackers may use during the reconnaissance phase after compromising a system in order to gain a better understanding of the environment and/or escalate privileges.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Service Discovery through built-in Windows Utilities", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (\n ((process.name: \"net.exe\" or process.pe.original_file_name == \"net.exe\" or (process.name : \"net1.exe\" and not process.parent.name : \"net.exe\")) and process.args : (\"start\", \"use\") and process.args_count == 2) or\n ((process.name: \"sc.exe\" or process.pe.original_file_name == \"sc.exe\") and process.args: (\"query\", \"q*\")) or\n ((process.name: \"tasklist.exe\" or process.pe.original_file_name == \"tasklist.exe\") and process.args: \"/svc\") or\n (process.name : \"psservice.exe\" or process.pe.original_file_name == \"psservice.exe\")\n ) and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e0881d20-54ac-457f-8733-fe0bc5d44c55", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1007", + "name": "System Service Discovery", + "reference": "https://attack.mitre.org/techniques/T1007/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "e0881d20-54ac-457f-8733-fe0bc5d44c55_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_104.json b/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_104.json new file mode 100644 index 00000000000..74aa6595001 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_104.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic", + "@BenB196", + "Austin Songer" + ], + "description": "Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts.", + "from": "now-180m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempts to Brute Force an Okta User Account", + "note": "## Triage and analysis\n\n### Investigating Attempts to Brute Force an Okta User Account\n\nBrute force attacks aim to guess user credentials through exhaustive trial-and-error attempts. In this context, Okta accounts are targeted.\n\nThis rule fires when an Okta user account has been locked out 3 times within a 3-hour window. This could indicate an attempted brute force or password spraying attack to gain unauthorized access to the user account. Okta's default authentication policy locks a user account after 10 failed authentication attempts.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.\n- Review the `okta.event_type` field to understand the nature of the events that led to the account lockout.\n- Check the `okta.severity` and `okta.display_message` fields for more context around the lockout events.\n- Look for correlation of events from the same IP address. Multiple lockouts from the same IP address might indicate a single source for the attack.\n- If the IP is not familiar, investigate it. The IP could be a proxy, VPN, Tor node, cloud datacenter, or a legitimate IP turned malicious.\n- Determine if the lockout events occurred during the user's regular activity hours. Unusual timing may indicate malicious activity.\n- Examine the authentication methods used during the lockout events by checking the `okta.authentication_context.credential_type` field.\n\n### False positive analysis:\n\n- Determine whether the account owner or an internal user made repeated mistakes in entering their credentials, leading to the account lockout.\n- Ensure there are no known network or application issues that might cause these events.\n\n### Response and remediation:\n\n- Alert the user and your IT department immediately.\n- If unauthorized access is confirmed, initiate your incident response process.\n- Investigate the source of the attack. If a specific machine or network is compromised, additional steps may need to be taken to address the issue.\n- Require the affected user to change their password.\n- If the attack is ongoing, consider blocking the IP address initiating the brute force attack.\n- Implement account lockout policies to limit the impact of brute force attacks.\n- Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.\n- Check if the compromised account was used to access or alter any sensitive data or systems.", + "query": "event.dataset:okta.system and event.action:user.account.lock\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e08ccd49-0380-4b2b-8d71-8000377d6e49", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "threshold": { + "field": [ + "okta.actor.alternate_id" + ], + "value": 3 + }, + "type": "threshold", + "version": 104 + }, + "id": "e08ccd49-0380-4b2b-8d71-8000377d6e49_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_105.json b/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_105.json new file mode 100644 index 00000000000..b371fd3fde8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e08ccd49-0380-4b2b-8d71-8000377d6e49_105.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic", + "@BenB196", + "Austin Songer" + ], + "description": "Identifies when an Okta user account is locked out 3 times within a 3 hour window. An adversary may attempt a brute force or password spraying attack to obtain unauthorized access to user accounts. The default Okta authentication policy ensures that a user account is locked out after 10 failed authentication attempts.", + "from": "now-180m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempts to Brute Force an Okta User Account", + "note": "## Triage and analysis\n\n### Investigating Attempts to Brute Force an Okta User Account\n\nBrute force attacks aim to guess user credentials through exhaustive trial-and-error attempts. In this context, Okta accounts are targeted.\n\nThis rule fires when an Okta user account has been locked out 3 times within a 3-hour window. This could indicate an attempted brute force or password spraying attack to gain unauthorized access to the user account. Okta's default authentication policy locks a user account after 10 failed authentication attempts.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.alternate_id` field in the alert. This should give the username of the account being targeted.\n- Review the `okta.event_type` field to understand the nature of the events that led to the account lockout.\n- Check the `okta.severity` and `okta.display_message` fields for more context around the lockout events.\n- Look for correlation of events from the same IP address. Multiple lockouts from the same IP address might indicate a single source for the attack.\n- If the IP is not familiar, investigate it. The IP could be a proxy, VPN, Tor node, cloud datacenter, or a legitimate IP turned malicious.\n- Determine if the lockout events occurred during the user's regular activity hours. Unusual timing may indicate malicious activity.\n- Examine the authentication methods used during the lockout events by checking the `okta.authentication_context.credential_type` field.\n\n### False positive analysis:\n\n- Determine whether the account owner or an internal user made repeated mistakes in entering their credentials, leading to the account lockout.\n- Ensure there are no known network or application issues that might cause these events.\n\n### Response and remediation:\n\n- Alert the user and your IT department immediately.\n- If unauthorized access is confirmed, initiate your incident response process.\n- Investigate the source of the attack. If a specific machine or network is compromised, additional steps may need to be taken to address the issue.\n- Require the affected user to change their password.\n- If the attack is ongoing, consider blocking the IP address initiating the brute force attack.\n- Implement account lockout policies to limit the impact of brute force attacks.\n- Encourage users to use complex, unique passwords and consider implementing multi-factor authentication.\n- Check if the compromised account was used to access or alter any sensitive data or systems.", + "query": "event.dataset:okta.system and event.action:user.account.lock\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e08ccd49-0380-4b2b-8d71-8000377d6e49", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Tactic: Credential Access", + "Data Source: Okta" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + } + ], + "threshold": { + "field": [ + "okta.actor.alternate_id" + ], + "value": 3 + }, + "type": "threshold", + "version": 105 + }, + "id": "e08ccd49-0380-4b2b-8d71-8000377d6e49_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e19e64ee-130e-4c07-961f-8a339f0b8362_104.json b/packages/security_detection_engine/kibana/security_rule/e19e64ee-130e-4c07-961f-8a339f0b8362_104.json new file mode 100644 index 00000000000..36d983d93af --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e19e64ee-130e-4c07-961f-8a339f0b8362_104.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Telnet provides a command line interface for communication with a remote device or server. This rule identifies Telnet network connections to publicly routable IP addresses.", + "false_positives": [ + "Telnet can be used for both benign or malicious purposes. Telnet is included by default in some Linux distributions, so its presence is not inherently suspicious. The use of Telnet to manage devices remotely has declined in recent years in favor of more secure protocols such as SSH. Telnet usage by non-automated tools or frameworks may be suspicious." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Connection to External Network via Telnet", + "query": "sequence by process.entity_id\n [process where host.os.type == \"linux\" and process.name == \"telnet\" and event.type == \"start\"]\n [network where host.os.type == \"linux\" and process.name == \"telnet\" and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\",\n \"192.0.0.171/32\", \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\",\n \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\", \"100.64.0.0/10\", \"192.175.48.0/24\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\")]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e19e64ee-130e-4c07-961f-8a339f0b8362", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "e19e64ee-130e-4c07-961f-8a339f0b8362_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e2258f48-ba75-4248-951b-7c885edf18c2_3.json b/packages/security_detection_engine/kibana/security_rule/e2258f48-ba75-4248-951b-7c885edf18c2_3.json new file mode 100644 index 00000000000..7e0f1f4760e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e2258f48-ba75-4248-951b-7c885edf18c2_3.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies service creation events of common mining services, possibly indicating the infection of a system with a cryptominer.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Mining Process Creation Event", + "query": "file where host.os.type == \"linux\" and event.type == \"creation\" and\nevent.action : (\"creation\", \"file_create_event\") and \nfile.name : (\"aliyun.service\", \"moneroocean_miner.service\", \"c3pool_miner.service\", \"pnsd.service\", \"apache4.service\", \"pastebin.service\", \"xvf.service\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e2258f48-ba75-4248-951b-7c885edf18c2", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "e2258f48-ba75-4248-951b-7c885edf18c2_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e26aed74-c816-40d3-a810-48d6fbd8b2fd_104.json b/packages/security_detection_engine/kibana/security_rule/e26aed74-c816-40d3-a810-48d6fbd8b2fd_104.json new file mode 100644 index 00000000000..ebc6d76a032 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e26aed74-c816-40d3-a810-48d6fbd8b2fd_104.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job found an unusually large spike in successful authentication events from a particular source IP address. This can be due to password spraying, user enumeration or brute force activity.", + "false_positives": [ + "Build servers and CI systems can sometimes trigger this alert. Security test cycles that include brute force or password spraying activities may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "auth_high_count_logon_events_for_a_source_ip", + "name": "Spike in Successful Logon Events from a Source IP", + "note": "## Triage and analysis\n\n### Investigating Spike in Successful Logon Events from a Source IP\n\nThis rule uses a machine learning job to detect a substantial spike in successful authentication events. This could indicate post-exploitation activities that aim to test which hosts, services, and other resources the attacker can access with the compromised credentials.\n\n#### Possible investigation steps\n\n- Identify the specifics of the involved assets, such as role, criticality, and associated users.\n- Check if the authentication comes from different sources.\n- Use the historical data available to determine if the same behavior happened in the past.\n- Investigate other alerts associated with the involved users during the past 48 hours.\n- Check whether the involved credentials are used in automation or scheduled tasks.\n- If this activity is suspicious, contact the account owner and confirm whether they are aware of it.\n\n### False positive analysis\n\n- Understand the context of the authentications by contacting the asset owners. If this activity is related to a new business process or newly implemented (approved) technology, consider adding exceptions \u2014 preferably with a combination of user and source conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + } + ], + "risk_score": 21, + "rule_id": "e26aed74-c816-40d3-a810-48d6fbd8b2fd", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Credential Access", + "Tactic: Defense Evasion", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/", + "subtechnique": [ + { + "id": "T1078.002", + "name": "Domain Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/002/" + }, + { + "id": "T1078.003", + "name": "Local Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/003/" + } + ] + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "e26aed74-c816-40d3-a810-48d6fbd8b2fd_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e26f042e-c590-4e82-8e05-41e81bd822ad_108.json b/packages/security_detection_engine/kibana/security_rule/e26f042e-c590-4e82-8e05-41e81bd822ad_108.json new file mode 100644 index 00000000000..fa0f5006fe0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e26f042e-c590-4e82-8e05-41e81bd822ad_108.json @@ -0,0 +1,122 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious .NET Reflection via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Suspicious .NET Reflection via PowerShell\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks. This makes it available for use in various environments, and creates an attractive way for attackers to execute code.\n\nAttackers can use .NET reflection to load PEs and DLLs in memory. These payloads are commonly embedded in the script, which can circumvent file-based security protections.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine file or network events from the involved PowerShell process for suspicious behavior.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Evaluate whether the user needs to use PowerShell to complete tasks.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the script using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately outside engineering or IT business units. As long as the analyst did not identify malware or suspicious activity related to the user or host, this alert can be dismissed.\n\n### Related rules\n\n- PowerShell PSReflect Script - 56f2e9b5-4803-4e44-a0a4-a52dc79d57fe\n- Potential Process Injection via PowerShell - 2e29e96a-b67c-455a-afe4-de6183431d0d\n- PowerShell Suspicious Payload Encoded and Compressed - 81fe9dc6-a2d7-4192-a2d8-eed98afc766a\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Restrict PowerShell usage outside of IT and engineering business units using GPOs, AppLocker, Intune, or similar software.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"[System.Reflection.Assembly]::Load\" or\n \"[Reflection.Assembly]::Load\"\n ) and not \n powershell.file.script_block_text : (\n (\"CommonWorkflowParameters\" or \"RelatedLinksHelpInfo\") and\n \"HelpDisplayStrings\"\n ) and not \n (powershell.file.script_block_text :\n (\"Get-SolutionFiles\" or \"Get-VisualStudio\" or \"Select-MSBuildPath\") and\n not file.name : \"PathFunctions.ps1\"\n )\n and not user.id : \"S-1-5-18\"\n", + "references": [ + "https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e26f042e-c590-4e82-8e05-41e81bd822ad", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/", + "subtechnique": [ + { + "id": "T1055.001", + "name": "Dynamic-link Library Injection", + "reference": "https://attack.mitre.org/techniques/T1055/001/" + }, + { + "id": "T1055.002", + "name": "Portable Executable Injection", + "reference": "https://attack.mitre.org/techniques/T1055/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 108 + }, + "id": "e26f042e-c590-4e82-8e05-41e81bd822ad_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_1.json b/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_1.json new file mode 100644 index 00000000000..6280f3b737b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_1.json @@ -0,0 +1,69 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may attempt to get a listing of network connections to or from a compromised system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Network Connections Discovery", + "query": "process where event.type == \"start\" and\n process.name : (\"netstat\", \"lsof\", \"who\", \"w\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_2.json b/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_2.json new file mode 100644 index 00000000000..c0ad74f9373 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_2.json @@ -0,0 +1,70 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may attempt to get a listing of network connections to or from a compromised system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Network Connections Discovery", + "query": "process where event.type == \"start\" and\n process.name : (\"netstat\", \"lsof\", \"who\", \"w\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1049", + "name": "System Network Connections Discovery", + "reference": "https://attack.mitre.org/techniques/T1049/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "e2dc8f8c-5f16-42fa-b49e-0eb8057f7444_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e2e0537d-7d8f-4910-a11d-559bcf61295a_4.json b/packages/security_detection_engine/kibana/security_rule/e2e0537d-7d8f-4910-a11d-559bcf61295a_4.json new file mode 100644 index 00000000000..456b2e40940 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e2e0537d-7d8f-4910-a11d-559bcf61295a_4.json @@ -0,0 +1,92 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to enable the Windows Subsystem for Linux using Microsoft Dism utility. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Subsystem for Linux Enabled via Dism Utility", + "query": "process where host.os.type == \"windows\" and event.type : \"start\" and\n (process.name : \"Dism.exe\" or process.pe.original_file_name == \"DISM.EXE\") and \n process.command_line : \"*Microsoft-Windows-Subsystem-Linux*\"\n", + "references": [ + "https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e2e0537d-7d8f-4910-a11d-559bcf61295a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "e2e0537d-7d8f-4910-a11d-559bcf61295a_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e2f9fdf5-8076-45ad-9427-41e0e03dc9c2_106.json b/packages/security_detection_engine/kibana/security_rule/e2f9fdf5-8076-45ad-9427-41e0e03dc9c2_106.json new file mode 100644 index 00000000000..b9e3e1c338f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e2f9fdf5-8076-45ad-9427-41e0e03dc9c2_106.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious psexec activity which is executing from the psexec service that has been renamed, possibly to evade detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Process Execution via Renamed PsExec Executable", + "note": "## Triage and analysis\n\n### Investigating PsExec Network Connection\n\nPsExec is a remote administration tool that enables the execution of commands with both regular and SYSTEM privileges on Windows systems. It operates by executing a service component `Psexecsvc` on a remote system, which then runs a specified process and returns the results to the local system. Microsoft develops PsExec as part of the Sysinternals Suite. Although commonly used by administrators, PsExec is frequently used by attackers to enable lateral movement and execute commands as SYSTEM to disable defenses and bypass security protections.\n\nThis rule identifies instances where the PsExec service component is executed using a custom name. This behavior can indicate an attempt to bypass security controls or detections that look for the default PsExec service component name.\n\n#### Possible investigation steps\n\n- Check if the usage of this tool complies with the organization's administration policy.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Identify the target computer and its role in the IT environment.\n- Investigate what commands were run, and assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. As long as the analyst did not identify suspicious activity related to the user or involved hosts, and the tool is allowed by the organization's policy, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n - Prioritize cases involving critical servers and users.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.pe.original_file_name : \"psexesvc.exe\" and not process.name : \"PSEXESVC.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1569", + "name": "System Services", + "reference": "https://attack.mitre.org/techniques/T1569/", + "subtechnique": [ + { + "id": "T1569.002", + "name": "Service Execution", + "reference": "https://attack.mitre.org/techniques/T1569/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "e2f9fdf5-8076-45ad-9427-41e0e03dc9c2_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e3343ab9-4245-4715-b344-e11c56b0a47f_107.json b/packages/security_detection_engine/kibana/security_rule/e3343ab9-4245-4715-b344-e11c56b0a47f_107.json new file mode 100644 index 00000000000..b4dd9fc6bed --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e3343ab9-4245-4715-b344-e11c56b0a47f_107.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Compiled HTML files (.chm) are commonly distributed as part of the Microsoft HTML Help system. Adversaries may conceal malicious code in a CHM file and deliver it to a victim for execution. CHM content is loaded by the HTML Help executable program (hh.exe).", + "false_positives": [ + "The HTML Help executable program (hh.exe) runs whenever a user clicks a compiled help (.chm) file or menu item that opens the help file inside the Help Viewer. This is not always malicious, but adversaries may abuse this technology to conceal malicious code." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Activity via Compiled HTML File", + "note": "## Triage and analysis\n\n### Investigating Process Activity via Compiled HTML File\n\nCHM (Compiled HTML) files are a format for delivering online help files on Windows. CHM files are compressed compilations of various content, such as HTML documents, images, and scripting/web-related programming languages such as VBA, JScript, Java, and ActiveX.\n\nWhen users double-click CHM files, the HTML Help executable program (`hh.exe`) will execute them. `hh.exe` also can be used to execute code embedded in those files, PowerShell scripts, and executables. This makes it useful for attackers not only to proxy the execution of malicious payloads via a signed binary that could bypass security controls, but also to gain initial access to environments via social engineering methods.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Investigate the parent process to gain understanding of what triggered this behavior.\n - Retrieve `.chm`, `.ps1`, and other files that were involved to further examination.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executables, scripts and help files retrieved from the system using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"hh.exe\" and\n process.name : (\"mshta.exe\", \"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\", \"cscript.exe\", \"wscript.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e3343ab9-4245-4715-b344-e11c56b0a47f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1204", + "name": "User Execution", + "reference": "https://attack.mitre.org/techniques/T1204/", + "subtechnique": [ + { + "id": "T1204.002", + "name": "Malicious File", + "reference": "https://attack.mitre.org/techniques/T1204/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.001", + "name": "Compiled HTML File", + "reference": "https://attack.mitre.org/techniques/T1218/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "e3343ab9-4245-4715-b344-e11c56b0a47f_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e3cf38fa-d5b8-46cc-87f9-4a7513e4281d_104.json b/packages/security_detection_engine/kibana/security_rule/e3cf38fa-d5b8-46cc-87f9-4a7513e4281d_104.json new file mode 100644 index 00000000000..4d86fca3bd8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e3cf38fa-d5b8-46cc-87f9-4a7513e4281d_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies unusual processes connecting to domains using known free SSL certificates. Adversaries may employ a known encryption algorithm to conceal command and control traffic.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Connection to Commonly Abused Free SSL Certificate Providers", + "note": "", + "query": "network where host.os.type == \"windows\" and network.protocol == \"dns\" and\n /* Add new free SSL certificate provider domains here */\n dns.question.name : (\"*letsencrypt.org\", \"*.sslforfree.com\", \"*.zerossl.com\", \"*.freessl.org\") and\n\n /* Native Windows process paths that are unlikely to have network connections to domains secured using free SSL certificates */\n process.executable : (\"C:\\\\Windows\\\\System32\\\\*.exe\",\n \"C:\\\\Windows\\\\System\\\\*.exe\",\n\t \"C:\\\\Windows\\\\SysWOW64\\\\*.exe\",\n\t\t \"C:\\\\Windows\\\\Microsoft.NET\\\\Framework*\\\\*.exe\",\n\t\t \"C:\\\\Windows\\\\explorer.exe\",\n\t\t \"C:\\\\Windows\\\\notepad.exe\") and\n\n /* Insert noisy false positives here */\n not process.name : (\"svchost.exe\", \"MicrosoftEdge*.exe\", \"msedge.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dns.question.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e3cf38fa-d5b8-46cc-87f9-4a7513e4281d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1573", + "name": "Encrypted Channel", + "reference": "https://attack.mitre.org/techniques/T1573/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "e3cf38fa-d5b8-46cc-87f9-4a7513e4281d_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e3e904b3-0a8e-4e68-86a8-977a163e21d3_105.json b/packages/security_detection_engine/kibana/security_rule/e3e904b3-0a8e-4e68-86a8-977a163e21d3_105.json new file mode 100644 index 00000000000..38c207f4fcd --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e3e904b3-0a8e-4e68-86a8-977a163e21d3_105.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation or modification of a K Desktop Environment (KDE) AutoStart script or desktop file that will execute upon each user logon. Adversaries may abuse this method for persistence.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via KDE AutoStart Script or Desktop File Modification", + "note": "", + "query": "file where host.os.type == \"linux\" and event.type != \"deletion\" and\n file.extension in (\"sh\", \"desktop\") and\n file.path :\n (\n \"/home/*/.config/autostart/*\", \"/root/.config/autostart/*\",\n \"/home/*/.kde/Autostart/*\", \"/root/.kde/Autostart/*\",\n \"/home/*/.kde4/Autostart/*\", \"/root/.kde4/Autostart/*\",\n \"/home/*/.kde/share/autostart/*\", \"/root/.kde/share/autostart/*\",\n \"/home/*/.kde4/share/autostart/*\", \"/root/.kde4/share/autostart/*\",\n \"/home/*/.local/share/autostart/*\", \"/root/.local/share/autostart/*\",\n \"/home/*/.config/autostart-scripts/*\", \"/root/.config/autostart-scripts/*\",\n \"/etc/xdg/autostart/*\", \"/usr/share/autostart/*\"\n ) and\n not process.name in (\"yum\", \"dpkg\", \"install\", \"dnf\", \"teams\", \"yum-cron\", \"dnf-automatic\", \"docker\", \"dockerd\", \n \"rpm\")\n", + "references": [ + "https://userbase.kde.org/System_Settings/Autostart", + "https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/", + "https://www.intezer.com/blog/research/operation-electrorat-attacker-creates-fake-companies-to-drain-your-crypto-wallets/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e3e904b3-0a8e-4e68-86a8-977a163e21d3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "e3e904b3-0a8e-4e68-86a8-977a163e21d3_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e48236ca-b67a-4b4e-840c-fdc7782bc0c3_104.json b/packages/security_detection_engine/kibana/security_rule/e48236ca-b67a-4b4e-840c-fdc7782bc0c3_104.json new file mode 100644 index 00000000000..fdca0c22de8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e48236ca-b67a-4b4e-840c-fdc7782bc0c3_104.json @@ -0,0 +1,83 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if Oyour organization's Okta network zones are regularly modified." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Modify an Okta Network Zone", + "note": "## Triage and analysis\n\n### Investigating Attempt to Modify an Okta Network Zone\n\nThe modification of an Okta network zone is a critical event as it could potentially allow an adversary to gain unrestricted access to your network. This rule detects attempts to modify, delete, or deactivate an Okta network zone, which may suggest an attempt to remove or weaken an organization's security controls.\n\n#### Possible investigation steps:\n\n- Identify the actor related to the alert by reviewing `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, or `okta.actor.display_name` fields in the alert.\n- Review the `okta.client.user_agent.raw_user_agent` field to understand the device and software used by the actor.\n- Examine the `okta.outcome.reason` field for additional context around the modification attempt.\n- Check the `okta.outcome.result` field to confirm the network zone modification attempt.\n- Check if there are multiple network zone modification attempts from the same actor or IP address (`okta.client.ip`).\n- Check for successful logins immediately following the modification attempt.\n- Verify whether the actor's activity aligns with typical behavior or if any unusual activity took place around the time of the modification attempt.\n\n### False positive analysis:\n\n- Check if there were issues with the Okta system at the time of the modification attempt. This could indicate a system error rather than a genuine threat activity.\n- Check the geographical location (`okta.request.ip_chain.geographical_context`) and time of the modification attempt. If these match the actor's normal behavior, it might be a false positive.\n- Verify the actor's administrative rights to ensure they are correctly configured.\n\n### Response and remediation:\n\n- If unauthorized modification is confirmed, initiate the incident response process.\n- Immediately lock the affected actor account and require a password change.\n- Consider resetting MFA tokens for the actor and require re-enrollment.\n- Check if the compromised account was used to access or alter any sensitive data or systems.\n- If a specific modification technique was used, ensure your systems are patched or configured to prevent such techniques.\n- Assess the criticality of affected services and servers.\n- Work with your IT team to minimize the impact on users and maintain business continuity.\n- If multiple accounts are affected, consider a broader reset or audit of MFA tokens.\n- Implement security best practices [outlined](https://www.okta.com/blog/2019/10/9-admin-best-practices-to-keep-your-org-secure/) by Okta.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.dataset:okta.system and event.action:(zone.update or network_zone.rule.disabled or zone.remove_blacklist)\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Security/network/network-zones.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e48236ca-b67a-4b4e-840c-fdc7782bc0c3", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Network Security Monitoring", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.007", + "name": "Disable or Modify Cloud Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/007/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "e48236ca-b67a-4b4e-840c-fdc7782bc0c3_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e6c1a552-7776-44ad-ae0f-8746cc07773c_103.json b/packages/security_detection_engine/kibana/security_rule/e6c1a552-7776-44ad-ae0f-8746cc07773c_103.json new file mode 100644 index 00000000000..d41a7104fdb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e6c1a552-7776-44ad-ae0f-8746cc07773c_103.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Both ~/.bash_profile and ~/.bashrc are files containing shell commands that are run when Bash is invoked. These files are executed in a user's context, either interactively or non-interactively, when a user logs in so that their environment is set correctly. Adversaries may abuse this to establish persistence by executing malicious content triggered by a user\u2019s shell.", + "false_positives": [ + "Changes to the Shell Profile tend to be noisy, a tuning per your environment will be required." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "auditbeat-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Bash Shell Profile Modification", + "query": "event.category:file and event.type:change and\n process.name:(* and not (sudo or\n vim or\n zsh or\n env or\n nano or\n bash or\n Terminal or\n xpcproxy or\n login or\n cat or\n cp or\n launchctl or\n java)) and\n not process.executable:(/Applications/* or /private/var/folders/* or /usr/local/*) and\n file.path:(/private/etc/rc.local or\n /etc/rc.local or\n /home/*/.profile or\n /home/*/.profile1 or\n /home/*/.bash_profile or\n /home/*/.bash_profile1 or\n /home/*/.bashrc or\n /Users/*/.bash_profile or\n /Users/*/.zshenv)\n", + "references": [ + "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e6c1a552-7776-44ad-ae0f-8746cc07773c", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.004", + "name": "Unix Shell Configuration Modification", + "reference": "https://attack.mitre.org/techniques/T1546/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 103 + }, + "id": "e6c1a552-7776-44ad-ae0f-8746cc07773c_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e6c98d38-633d-4b3e-9387-42112cd5ac10_104.json b/packages/security_detection_engine/kibana/security_rule/e6c98d38-633d-4b3e-9387-42112cd5ac10_104.json new file mode 100644 index 00000000000..d3e0ef1f2fa --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e6c98d38-633d-4b3e-9387-42112cd5ac10_104.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Authorization plugins are used to extend the authorization services API and implement mechanisms that are not natively supported by the OS, such as multi-factor authentication with third party software. Adversaries may abuse this feature to persist and/or collect clear text credentials as they traverse the registered plugins during user logon.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Authorization Plugin Modification", + "query": "event.category:file and host.os.type:macos and not event.type:deletion and\n file.path:(/Library/Security/SecurityAgentPlugins/* and\n not /Library/Security/SecurityAgentPlugins/TeamViewerAuthPlugin.bundle/*) and\n not process.name:shove and process.code_signature.trusted:true\n", + "references": [ + "https://developer.apple.com/documentation/security/authorization_plug-ins", + "https://www.xorrior.com/persistent-credential-theft/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e6c98d38-633d-4b3e-9387-42112cd5ac10", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.002", + "name": "Authentication Package", + "reference": "https://attack.mitre.org/techniques/T1547/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "e6c98d38-633d-4b3e-9387-42112cd5ac10_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e6e8912f-283f-4d0d-8442-e0dcaf49944b_104.json b/packages/security_detection_engine/kibana/security_rule/e6e8912f-283f-4d0d-8442-e0dcaf49944b_104.json new file mode 100644 index 00000000000..41b6b465366 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e6e8912f-283f-4d0d-8442-e0dcaf49944b_104.json @@ -0,0 +1,103 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when a screensaver plist file is modified by an unexpected process. An adversary can maintain persistence on a macOS endpoint by creating a malicious screensaver (.saver) file and configuring the screensaver plist file to execute code each time the screensaver is activated.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Screensaver Plist File Modified by Unexpected Process", + "note": "## Triage and analysis\n\n- Analyze the plist file modification event to identify whether the change was expected or not\n- Investigate the process that modified the plist file for malicious code or other suspicious behavior\n- Identify if any suspicious or known malicious screensaver (.saver) files were recently written to or modified on the host", + "query": "file where host.os.type == \"macos\" and event.type != \"deletion\" and\n file.name: \"com.apple.screensaver.*.plist\" and\n file.path : (\n \"/Users/*/Library/Preferences/ByHost/*\",\n \"/Library/Managed Preferences/*\",\n \"/System/Library/Preferences/*\"\n ) and\n (\n process.code_signature.trusted == false or\n process.code_signature.exists == false or\n\n /* common script interpreters and abused native macOS bins */\n process.name : (\n \"curl\",\n \"mktemp\",\n \"tail\",\n \"funzip\",\n \"python*\",\n \"osascript\",\n \"perl\"\n )\n ) and\n\n /* Filter OS processes modifying screensaver plist files */\n not process.executable : (\n \"/usr/sbin/cfprefsd\",\n \"/usr/libexec/xpcproxy\",\n \"/System/Library/CoreServices/ManagedClient.app/Contents/Resources/MCXCompositor\",\n \"/System/Library/CoreServices/ManagedClient.app/Contents/MacOS/ManagedClient\"\n )\n", + "references": [ + "https://posts.specterops.io/saving-your-access-d562bf5bf90b", + "https://github.com/D00MFist/PersistentJXA" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.exists", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e6e8912f-283f-4d0d-8442-e0dcaf49944b", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "e6e8912f-283f-4d0d-8442-e0dcaf49944b_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e7125cea-9fe1-42a5-9a05-b0792cf86f5a_105.json b/packages/security_detection_engine/kibana/security_rule/e7125cea-9fe1-42a5-9a05-b0792cf86f5a_105.json new file mode 100644 index 00000000000..91d84336144 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e7125cea-9fe1-42a5-9a05-b0792cf86f5a_105.json @@ -0,0 +1,110 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution of suspicious persistent programs (scripts, rundll32, etc.) by looking at process lineage and command line usage.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Execution of Persistent Suspicious Program", + "query": "/* userinit followed by explorer followed by early child process of explorer (unlikely to be launched interactively) within 1m */\nsequence by host.id, user.name with maxspan=1m\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"userinit.exe\" and process.parent.name : \"winlogon.exe\"]\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"explorer.exe\"]\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"explorer.exe\" and\n /* add suspicious programs here */\n process.pe.original_file_name in (\"cscript.exe\",\n \"wscript.exe\",\n \"PowerShell.EXE\",\n \"MSHTA.EXE\",\n \"RUNDLL32.EXE\",\n \"REGSVR32.EXE\",\n \"RegAsm.exe\",\n \"MSBuild.exe\",\n \"InstallUtil.exe\") and\n /* add potential suspicious paths here */\n process.args : (\"C:\\\\Users\\\\*\", \"C:\\\\ProgramData\\\\*\", \"C:\\\\Windows\\\\Temp\\\\*\", \"C:\\\\Windows\\\\Tasks\\\\*\", \"C:\\\\PerfLogs\\\\*\", \"C:\\\\Intel\\\\*\")\n ]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e7125cea-9fe1-42a5-9a05-b0792cf86f5a", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "e7125cea-9fe1-42a5-9a05-b0792cf86f5a_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_2.json b/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_2.json new file mode 100644 index 00000000000..12a04ff6933 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_2.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious WMI Event Subscription Created", + "query": "any where event.dataset == \"windows.sysmon_operational\" and event.code == \"21\" and\n winlog.event_data.Operation : \"Created\" and winlog.event_data.Consumer : (\"*subscription:CommandLineEventConsumer*\", \"*subscription:ActiveScriptEventConsumer*\")\n", + "references": [ + "https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", + "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.Consumer", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.Operation", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e72f87d0-a70e-4f8d-8443-a6407bc34643", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.003", + "name": "Windows Management Instrumentation Event Subscription", + "reference": "https://attack.mitre.org/techniques/T1546/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "e72f87d0-a70e-4f8d-8443-a6407bc34643_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_4.json b/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_4.json new file mode 100644 index 00000000000..14208605bcf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e72f87d0-a70e-4f8d-8443-a6407bc34643_4.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects the creation of a WMI Event Subscription. Attackers can abuse this mechanism for persistence or to elevate to SYSTEM privileges.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious WMI Event Subscription Created", + "query": "any where event.dataset == \"windows.sysmon_operational\" and event.code == \"21\" and\n winlog.event_data.Operation : \"Created\" and winlog.event_data.Consumer : (\"*subscription:CommandLineEventConsumer*\", \"*subscription:ActiveScriptEventConsumer*\")\n", + "references": [ + "https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", + "https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.Consumer", + "type": "unknown" + }, + { + "ecs": false, + "name": "winlog.event_data.Operation", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e72f87d0-a70e-4f8d-8443-a6407bc34643", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Sysmon Only" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.003", + "name": "Windows Management Instrumentation Event Subscription", + "reference": "https://attack.mitre.org/techniques/T1546/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "e72f87d0-a70e-4f8d-8443-a6407bc34643_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e74d645b-fec6-431e-bf93-ca64a538e0de_1.json b/packages/security_detection_engine/kibana/security_rule/e74d645b-fec6-431e-bf93-ca64a538e0de_1.json new file mode 100644 index 00000000000..7ca39de3fc9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e74d645b-fec6-431e-bf93-ca64a538e0de_1.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies unusual process executions using MSSQL Service accounts, which can indicate the exploitation/compromise of SQL instances. Attackers may exploit exposed MSSQL instances for initial access or lateral movement.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Process For MSSQL Service Accounts", + "query": "process where event.type == \"start\" and host.os.type == \"windows\" and\n user.name : (\n \"SQLSERVERAGENT\", \"SQLAGENT$*\",\n \"MSSQLSERVER\", \"MSSQL$*\",\n \"MSSQLServerOLAPService\",\n \"ReportServer*\", \"MsDtsServer150\",\n \"MSSQLFDLauncher*\",\n \"SQLServer2005SQLBrowserUser$*\",\n \"SQLWriter\", \"winmgmt\"\n ) and user.domain : \"NT SERVICE\" and\n not (\n process.name : (\n \"sqlceip.exe\", \"sqlservr.exe\", \"sqlagent.exe\",\n \"msmdsrv.exe\", \"ReportingServicesService.exe\",\n \"MsDtsSrvr.exe\", \"sqlbrowser.exe\"\n ) and (process.code_signature.subject_name : \"Microsoft Corporation\" and process.code_signature.trusted == true)\n )\n", + "references": [ + "https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/", + "https://learn.microsoft.com/en-us/sql/database-engine/configure-windows/configure-windows-service-accounts-and-permissions?view=sql-server-ver16" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e74d645b-fec6-431e-bf93-ca64a538e0de", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "e74d645b-fec6-431e-bf93-ca64a538e0de_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e7cb3cfd-aaa3-4d7b-af18-23b89955062c_4.json b/packages/security_detection_engine/kibana/security_rule/e7cb3cfd-aaa3-4d7b-af18-23b89955062c_4.json new file mode 100644 index 00000000000..6bc62a59ebf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e7cb3cfd-aaa3-4d7b-af18-23b89955062c_4.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password' files. Using the combined file generated from the utility, the malicious threat actors can use them as input for password-cracking utilities or prepare themselves for future operations by gathering credential information of the victim.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Credential Dumping via Unshadow", + "query": "process where host.os.type == \"linux\" and process.name == \"unshadow\" and\n event.type == \"start\" and event.action in (\"exec\", \"exec_event\") and process.args_count \u003e= 2\n", + "references": [ + "https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e7cb3cfd-aaa3-4d7b-af18-23b89955062c", + "severity": "medium", + "tags": [ + "Data Source: Elastic Endgame", + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.008", + "name": "/etc/passwd and /etc/shadow", + "reference": "https://attack.mitre.org/techniques/T1003/008/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "e7cb3cfd-aaa3-4d7b-af18-23b89955062c_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e8571d5f-bea1-46c2-9f56-998de2d3ed95_106.json b/packages/security_detection_engine/kibana/security_rule/e8571d5f-bea1-46c2-9f56-998de2d3ed95_106.json new file mode 100644 index 00000000000..51d0812dec8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e8571d5f-bea1-46c2-9f56-998de2d3ed95_106.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies Service Control (sc.exe) spawning from script interpreter processes to create, modify, or start services. This can potentially indicate an attempt to elevate privileges or maintain persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "logs-system.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Service Control Spawned via Script Interpreter", + "note": "## Triage and analysis\n\n### Investigating Service Control Spawned via Script Interpreter\n\nWindows services are background processes that run with SYSTEM privileges and provide specific functionality or support to other applications and system components.\n\nThe `sc.exe` command line utility is used to manage and control Windows services on a local or remote computer. Attackers may use `sc.exe` to create, modify, and start services to elevate their privileges from administrator to SYSTEM.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Examine the command line, registry changes events, and Windows events related to service activities (for example, 4697 and/or 7045) for suspicious characteristics.\n - Examine the created and existent services, the executables or drivers referenced, and command line arguments for suspicious entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the referenced files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n\n### False positive analysis\n\n- This activity is not inherently malicious if it occurs in isolation. As long as the analyst did not identify suspicious activity related to the user, host, and service, such alerts can be dismissed.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Delete the service or restore it to the original configuration.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "/* This rule is not compatible with Sysmon due to user.id issues */\n\nprocess where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"sc.exe\" or process.pe.original_file_name == \"sc.exe\") and\n process.parent.name : (\"cmd.exe\", \"wscript.exe\", \"rundll32.exe\", \"regsvr32.exe\",\n \"wmic.exe\", \"mshta.exe\",\"powershell.exe\", \"pwsh.exe\") and\n process.args:(\"config\", \"create\", \"start\", \"delete\", \"stop\", \"pause\") and\n /* exclude SYSTEM SID - look for service creations by non-SYSTEM user */\n not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "e8571d5f-bea1-46c2-9f56-998de2d3ed95_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e86da94d-e54b-4fb5-b96c-cecff87e8787_104.json b/packages/security_detection_engine/kibana/security_rule/e86da94d-e54b-4fb5-b96c-cecff87e8787_104.json new file mode 100644 index 00000000000..2c47c0a4ce3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e86da94d-e54b-4fb5-b96c-cecff87e8787_104.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Installation of Security Support Provider", + "note": "", + "query": "registry where host.os.type == \"windows\" and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\Security Packages*\",\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\Security Packages*\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\OSConfig\\\\Security Packages*\"\n ) and\n not process.executable : (\"C:\\\\Windows\\\\System32\\\\msiexec.exe\", \"C:\\\\Windows\\\\SysWOW64\\\\msiexec.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e86da94d-e54b-4fb5-b96c-cecff87e8787", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.005", + "name": "Security Support Provider", + "reference": "https://attack.mitre.org/techniques/T1547/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "e86da94d-e54b-4fb5-b96c-cecff87e8787_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e88d1fe9-b2f4-48d4-bace-a026dc745d4b_4.json b/packages/security_detection_engine/kibana/security_rule/e88d1fe9-b2f4-48d4-bace-a026dc745d4b_4.json new file mode 100644 index 00000000000..427de916f4d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e88d1fe9-b2f4-48d4-bace-a026dc745d4b_4.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects files creation and modification on the host system from the the Windows Subsystem for Linux. Adversaries may enable and use WSL for Linux to avoid detection.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Host Files System Changes via Windows Subsystem for Linux", + "query": "sequence by process.entity_id with maxspan=5m\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"dllhost.exe\" and \n /* Plan9FileSystem CLSID - WSL Host File System Worker */\n process.command_line : \"*{DFB65C4C-B34F-435D-AFE9-A86218684AA8}*\"]\n [file where host.os.type == \"windows\" and process.name : \"dllhost.exe\" and not file.path : \"?:\\\\Users\\\\*\\\\Downloads\\\\*\"]\n", + "references": [ + "https://github.com/microsoft/WSL" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e88d1fe9-b2f4-48d4-bace-a026dc745d4b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1202", + "name": "Indirect Command Execution", + "reference": "https://attack.mitre.org/techniques/T1202/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "e88d1fe9-b2f4-48d4-bace-a026dc745d4b_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_1.json b/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_1.json new file mode 100644 index 00000000000..772be774c50 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_1.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.", + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious System Commands Executed by Previously Unknown Executable", + "new_terms_fields": [ + "process.executable" + ], + "query": "host.os.type : \"linux\" and event.category : \"process\" and \nevent.action : (\"exec\" or \"exec_event\" or \"fork\" or \"fork_event\") and \nprocess.executable : (\n /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or\n /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or \n /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*\n ) and process.args : (\n \"whoami\" or \"id\" or \"hostname\" or \"uptime\" or \"top\" or \"ifconfig\" or \"netstat\" or \"route\" or \n \"ps\" or \"pwd\" or \"ls\"\n ) and not process.name : (\n \"sudo\" or \"which\" or \"whoami\" or \"id\" or \"hostname\" or \"uptime\" or \"top\" or \"netstat\" or \"ps\" or \n \"pwd\" or \"ls\" or \"apt\" or \"dpkg\" or \"yum\" or \"rpm\" or \"dnf\" or \"dockerd\" or \"snapd\" or \"snap\"\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e9001ee6-2d00-4d2f-849e-b8b1fb05234c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 1 + }, + "id": "e9001ee6-2d00-4d2f-849e-b8b1fb05234c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_2.json b/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_2.json new file mode 100644 index 00000000000..0385dc992ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e9001ee6-2d00-4d2f-849e-b8b1fb05234c_2.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the execution of several commonly used system commands executed by a previously unknown executable located in commonly abused directories. An alert from this rule can indicate the presence of potentially malicious activity, such as the execution of unauthorized or suspicious processes attempting to run malicious code. Detecting and investigating such behavior can help identify and mitigate potential security threats, protecting the system and its data from potential compromise.", + "from": "now-9m", + "history_window_start": "now-14d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious System Commands Executed by Previously Unknown Executable", + "new_terms_fields": [ + "process.executable" + ], + "query": "host.os.type:linux and event.category:process and event.action:(exec or exec_event or fork or fork_event) and \nprocess.executable:(\n /bin/* or /usr/bin/* or /usr/share/* or /tmp/* or /var/tmp/* or /dev/shm/* or\n /etc/init.d/* or /etc/rc*.d/* or /etc/crontab or /etc/cron.*/* or /etc/update-motd.d/* or \n /usr/lib/update-notifier/* or /home/*/.* or /boot/* or /srv/* or /run/*) \n and process.args:(whoami or id or hostname or uptime or top or ifconfig or netstat or route or ps or pwd or ls) and \n not process.name:(sudo or which or whoami or id or hostname or uptime or top or netstat or ps or pwd or ls or apt or \n dpkg or yum or rpm or dnf or dockerd or docker or snapd or snap) and\n not process.parent.executable:(/bin/* or /usr/bin/* or /run/k3s/* or /etc/network/* or /opt/Elastic/*)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "e9001ee6-2d00-4d2f-849e-b8b1fb05234c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 2 + }, + "id": "e9001ee6-2d00-4d2f-849e-b8b1fb05234c_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_104.json b/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_104.json new file mode 100644 index 00000000000..f1addcea68f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_104.json @@ -0,0 +1,113 @@ +{ + "attributes": { + "author": [ + "Elastic", + "@BenB196", + "Austin Songer" + ], + "description": "Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection.", + "false_positives": [ + "The number of Okta user password reset or account unlock attempts will likely vary between organizations. To fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule." + ], + "from": "now-60m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "High Number of Okta User Password Reset or Unlock Attempts", + "note": "## Triage and analysis\n\n### Investigating High Number of Okta User Password Reset or Unlock Attempts\n\nThis rule is designed to detect a suspiciously high number of password reset or account unlock attempts in Okta. Excessive password resets or account unlocks can be indicative of an attacker's attempt to gain unauthorized access to an account.\n\n#### Possible investigation steps:\n- Identify the actor associated with the excessive attempts. The `okta.actor.alternate_id` field can be used for this purpose.\n- Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.\n- Review the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the password reset or unlock attempts.\n- Review the event actions associated with these attempts. Look at the `event.action` field and filter for actions related to password reset and account unlock attempts.\n- Check for other similar patterns of behavior from the same actor or IP address. If there is a high number of failed login attempts before the password reset or unlock attempts, this may suggest a brute force attack.\n- Also, look at the times when these attempts were made. If these were made during off-hours, it could further suggest an adversary's activity.\n\n### False positive analysis:\n- This alert might be a false positive if there are legitimate reasons for a high number of password reset or unlock attempts. This could be due to the user forgetting their password or account lockouts due to too many incorrect attempts.\n- Check the actor's past behavior. If this is their usual behavior and they have a valid reason for it, then it might be a false positive.\n\n### Response and remediation:\n- If unauthorized attempts are confirmed, initiate the incident response process.\n- Reset the user's password and enforce MFA re-enrollment, if applicable.\n- Block the IP address or device used in the attempts, if they appear suspicious.\n- If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.\n- Consider a security review of your Okta policies and rules to ensure they follow security best practices.", + "query": "event.dataset:okta.system and\n event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or\n system.sms.send_account_unlock_message or system.sms.send_password_reset_message or\n system.voice.send_account_unlock_call or system.voice.send_password_reset_call or\n user.account.unlock_token)\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e90ee3af-45fc-432e-a850-4a58cf14a457", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Use Case: Identity and Access Audit", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "threshold": { + "field": [ + "okta.actor.alternate_id" + ], + "value": 5 + }, + "type": "threshold", + "version": 104 + }, + "id": "e90ee3af-45fc-432e-a850-4a58cf14a457_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_105.json b/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_105.json new file mode 100644 index 00000000000..1c453f01dd9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e90ee3af-45fc-432e-a850-4a58cf14a457_105.json @@ -0,0 +1,112 @@ +{ + "attributes": { + "author": [ + "Elastic", + "@BenB196", + "Austin Songer" + ], + "description": "Identifies a high number of Okta user password reset or account unlock attempts. An adversary may attempt to obtain unauthorized access to Okta user accounts using these methods and attempt to blend in with normal activity in their target's environment and evade detection.", + "false_positives": [ + "The number of Okta user password reset or account unlock attempts will likely vary between organizations. To fit this rule to their organization, users can duplicate this rule and edit the schedule and threshold values in the new rule." + ], + "from": "now-60m", + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "High Number of Okta User Password Reset or Unlock Attempts", + "note": "## Triage and analysis\n\n### Investigating High Number of Okta User Password Reset or Unlock Attempts\n\nThis rule is designed to detect a suspiciously high number of password reset or account unlock attempts in Okta. Excessive password resets or account unlocks can be indicative of an attacker's attempt to gain unauthorized access to an account.\n\n#### Possible investigation steps:\n- Identify the actor associated with the excessive attempts. The `okta.actor.alternate_id` field can be used for this purpose.\n- Determine the client used by the actor. You can look at `okta.client.device`, `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.ip_chain.ip`, and `okta.client.geographical_context`.\n- Review the `okta.outcome.result` and `okta.outcome.reason` fields to understand the outcome of the password reset or unlock attempts.\n- Review the event actions associated with these attempts. Look at the `event.action` field and filter for actions related to password reset and account unlock attempts.\n- Check for other similar patterns of behavior from the same actor or IP address. If there is a high number of failed login attempts before the password reset or unlock attempts, this may suggest a brute force attack.\n- Also, look at the times when these attempts were made. If these were made during off-hours, it could further suggest an adversary's activity.\n\n### False positive analysis:\n- This alert might be a false positive if there are legitimate reasons for a high number of password reset or unlock attempts. This could be due to the user forgetting their password or account lockouts due to too many incorrect attempts.\n- Check the actor's past behavior. If this is their usual behavior and they have a valid reason for it, then it might be a false positive.\n\n### Response and remediation:\n- If unauthorized attempts are confirmed, initiate the incident response process.\n- Reset the user's password and enforce MFA re-enrollment, if applicable.\n- Block the IP address or device used in the attempts, if they appear suspicious.\n- If the attack was facilitated by a particular technique, ensure your systems are patched or configured to prevent such techniques.\n- Consider a security review of your Okta policies and rules to ensure they follow security best practices.", + "query": "event.dataset:okta.system and\n event.action:(system.email.account_unlock.sent_message or system.email.password_reset.sent_message or\n system.sms.send_account_unlock_message or system.sms.send_password_reset_message or\n system.voice.send_account_unlock_call or system.voice.send_password_reset_call or\n user.account.unlock_token)\n", + "references": [ + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e90ee3af-45fc-432e-a850-4a58cf14a457", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "medium", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Defense Evasion" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + } + ] + } + ], + "threshold": { + "field": [ + "okta.actor.alternate_id" + ], + "value": 5 + }, + "type": "threshold", + "version": 105 + }, + "id": "e90ee3af-45fc-432e-a850-4a58cf14a457_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e94262f2-c1e9-4d3f-a907-aeab16712e1a_107.json b/packages/security_detection_engine/kibana/security_rule/e94262f2-c1e9-4d3f-a907-aeab16712e1a_107.json new file mode 100644 index 00000000000..e3694e14c84 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e94262f2-c1e9-4d3f-a907-aeab16712e1a_107.json @@ -0,0 +1,87 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies an unexpected executable file being created or modified by a Windows system critical process, which may indicate activity related to remote code execution or other forms of exploitation.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Executable File Creation by a System Critical Process", + "note": "## Triage and analysis\n\n### Investigating Unusual Executable File Creation by a System Critical Process\n\nWindows internal/system processes have some characteristics that can be used to spot suspicious activities. One of these characteristics is file operations.\n\nThis rule looks for the creation of executable files done by system-critical processes. This can indicate the exploitation of a vulnerability or a malicious process masquerading as a system-critical process.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.extension : (\"exe\", \"dll\") and\n process.name : (\"smss.exe\",\n \"autochk.exe\",\n \"csrss.exe\",\n \"wininit.exe\",\n \"services.exe\",\n \"lsass.exe\",\n \"winlogon.exe\",\n \"userinit.exe\",\n \"LogonUI.exe\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "e94262f2-c1e9-4d3f-a907-aeab16712e1a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1211", + "name": "Exploitation for Defense Evasion", + "reference": "https://attack.mitre.org/techniques/T1211/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "e94262f2-c1e9-4d3f-a907-aeab16712e1a_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb_104.json b/packages/security_detection_engine/kibana/security_rule/e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb_104.json new file mode 100644 index 00000000000..62ee5bd1093 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb_104.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Adversaries can use the autostart mechanism provided by the Local Security Authority (LSA) authentication packages for privilege escalation or persistence by placing a reference to a binary in the Windows registry. The binary will then be executed by SYSTEM when the authentication packages are loaded.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential LSA Authentication Package Abuse", + "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\Authentication Packages\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Control\\\\Lsa\\\\Authentication Packages\"\n ) and\n /* exclude SYSTEM SID - look for changes by non-SYSTEM user */\n not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.002", + "name": "Authentication Package", + "reference": "https://attack.mitre.org/techniques/T1547/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.002", + "name": "Authentication Package", + "reference": "https://attack.mitre.org/techniques/T1547/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "e9abe69b-1deb-4e19-ac4a-5d5ac00f72eb_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eaa77d63-9679-4ce3-be25-3ba8b795e5fa_103.json b/packages/security_detection_engine/kibana/security_rule/eaa77d63-9679-4ce3-be25-3ba8b795e5fa_103.json new file mode 100644 index 00000000000..27312767bd7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eaa77d63-9679-4ce3-be25-3ba8b795e5fa_103.json @@ -0,0 +1,42 @@ +{ + "attributes": { + "anomaly_threshold": 75, + "author": [ + "Elastic" + ], + "description": "A machine learning job detected an unusually large spike in network traffic that was denied by network access control lists (ACLs) or firewall rules. Such a burst of denied traffic is usually caused by either 1) a mis-configured application or firewall or 2) suspicious or malicious activity. Unsuccessful attempts at network transit, in order to connect to command-and-control (C2), or engage in data exfiltration, may produce a burst of failed connections. This could also be due to unusually large amounts of reconnaissance or enumeration traffic. Denial-of-service attacks or traffic floods may also produce such a surge in traffic.", + "false_positives": [ + "A misconfgured network application or firewall may trigger this alert. Security scans or test cycles may trigger this alert." + ], + "from": "now-30m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": "high_count_network_denies", + "name": "Spike in Firewall Denies", + "references": [ + "https://www.elastic.co/guide/en/security/current/prebuilt-ml-jobs.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "network_traffic", + "version": "^1.1.0" + } + ], + "risk_score": 21, + "rule_id": "eaa77d63-9679-4ce3-be25-3ba8b795e5fa", + "severity": "low", + "tags": [ + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning" + ], + "type": "machine_learning", + "version": 103 + }, + "id": "eaa77d63-9679-4ce3-be25-3ba8b795e5fa_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eb44611f-62a8-4036-a5ef-587098be6c43_1.json b/packages/security_detection_engine/kibana/security_rule/eb44611f-62a8-4036-a5ef-587098be6c43_1.json new file mode 100644 index 00000000000..40419103095 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eb44611f-62a8-4036-a5ef-587098be6c43_1.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Detects PowerShell scripts that can be used to record webcam video. Attackers can capture this information to extort or spy on victims.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Webcam Video Capture Capabilities", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"NewFrameEventHandler\" or\n \"VideoCaptureDevice\" or\n \"DirectX.Capture.Filters\" or\n \"VideoCompressors\" or\n \"Start-WebcamRecorder\" or\n (\n (\"capCreateCaptureWindowA\" or\n \"capCreateCaptureWindow\" or\n \"capGetDriverDescription\") and\n (\"avicap32.dll\" or \"avicap32\")\n )\n )\n", + "references": [ + "https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/collection/WebcamRecorder.py" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "eb44611f-62a8-4036-a5ef-587098be6c43", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Collection", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0009", + "name": "Collection", + "reference": "https://attack.mitre.org/tactics/TA0009/" + }, + "technique": [ + { + "id": "T1125", + "name": "Video Capture", + "reference": "https://attack.mitre.org/techniques/T1125/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "eb44611f-62a8-4036-a5ef-587098be6c43_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eb610e70-f9e6-4949-82b9-f1c5bcd37c39_107.json b/packages/security_detection_engine/kibana/security_rule/eb610e70-f9e6-4949-82b9-f1c5bcd37c39_107.json new file mode 100644 index 00000000000..c8b6a501442 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eb610e70-f9e6-4949-82b9-f1c5bcd37c39_107.json @@ -0,0 +1,118 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Kerberos Ticket Request", + "note": "## Triage and analysis\n\n### Investigating PowerShell Kerberos Ticket Request\n\nPowerShell is one of the main tools system administrators use for automation, report routines, and other tasks, making it available for use in various environments, creating an attractive way for attackers to execute code.\n\nAccounts associated with a service principal name (SPN) are viable targets for Kerberoasting attacks, which use brute force to crack the user password, which is used to encrypt a Kerberos TGS ticket.\n\nAttackers can use PowerShell to request these Kerberos tickets, with the intent of extracting them from memory to perform Kerberoasting.\n\n#### Possible investigation steps\n\n- Examine the script content that triggered the detection; look for suspicious DLL imports, collection or exfiltration capabilities, suspicious functions, encoded or compressed data, and other potentially malicious characteristics.\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate if the script was executed, and if so, which account was targeted.\n- Validate if the account has an SPN associated with it.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Check if the script has any other functionality that can be potentially malicious.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Review event ID [4769](https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4769) related to this account and service name for additional information.\n\n### False positive analysis\n\n- A possible false positive can be identified if the script content is not malicious/harmful or does not request Kerberos tickets for user accounts, as computer accounts are not vulnerable to Kerberoasting due to complex password requirements and policy.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services. Prioritize privileged accounts.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n KerberosRequestorSecurityToken\n ) and not user.id : \"S-1-5-18\"\n and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n", + "references": [ + "https://cobalt.io/blog/kerberoast-attack-techniques", + "https://github.com/EmpireProject/Empire/blob/master/data/module_source/credentials/Invoke-Kerberoast.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "eb610e70-f9e6-4949-82b9-f1c5bcd37c39", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/", + "subtechnique": [ + { + "id": "T1558.003", + "name": "Kerberoasting", + "reference": "https://attack.mitre.org/techniques/T1558/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 107 + }, + "id": "eb610e70-f9e6-4949-82b9-f1c5bcd37c39_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_102.json b/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_102.json deleted file mode 100644 index 4ed6b45f1ef..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_102.json +++ /dev/null @@ -1,116 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.", - "false_positives": [ - "False-Positives (FP) can appear if another remote terminal service is being used to connect to it's listener but typically SSH is used in these scenarios." - ], - "from": "now-9m", - "index": [ - "logs-endpoint.events.*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Suspicious Network Connection Attempt by Root", - "note": "## Triage and analysis\n### Investigating Connection Attempt by Non-SSH Root Session\nDetection alerts from this rule indicate a strange or abnormal outbound connection attempt by a privileged process. Here are some possible avenues of investigation:\n- Examine unusual and active sessions using commands such as 'last -a', 'netstat -a', and 'w -a'.\n- Analyze processes and command line arguments to detect anomalous process execution that may be acting as a listener.\n- Analyze anomalies in the use of files that do not normally initiate connections.\n- Examine processes utilizing the network that do not normally have network communication.\n", - "query": "sequence by process.entity_id with maxspan=1m\n[network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and user.id == \"0\" and\n not process.executable : (\"/bin/ssh\", \"/sbin/ssh\", \"/usr/lib/systemd/systemd\", \"/usr/sbin/sshd\")]\n[process where host.os.type == \"linux\" and event.action == \"session_id_change\" and user.id == \"0\" and\n not process.executable : (\"/bin/ssh\", \"/sbin/ssh\", \"/usr/lib/systemd/systemd\", \"/usr/sbin/sshd\")]\n", - "references": [ - "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", - "https://twitter.com/GossiTheDog/status/1522964028284411907", - "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf" - ], - "related_integrations": [ - { - "package": "endpoint", - "version": "^8.2.0" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.action", - "type": "keyword" - }, - { - "ecs": true, - "name": "event.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.entity_id", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.executable", - "type": "keyword" - }, - { - "ecs": true, - "name": "user.id", - "type": "keyword" - } - ], - "risk_score": 47, - "rule_id": "eb6a3790-d52d-11ec-8ce9-f661ea17fbce", - "severity": "medium", - "tags": [ - "Elastic", - "Host", - "Linux", - "Threat Detection", - "Command and Control" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1095", - "name": "Non-Application Layer Protocol", - "reference": "https://attack.mitre.org/techniques/T1095/" - } - ] - }, - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1548", - "name": "Abuse Elevation Control Mechanism", - "reference": "https://attack.mitre.org/techniques/T1548/", - "subtechnique": [ - { - "id": "T1548.003", - "name": "Sudo and Sudo Caching", - "reference": "https://attack.mitre.org/techniques/T1548/003/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 102 - }, - "id": "eb6a3790-d52d-11ec-8ce9-f661ea17fbce_102", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_103.json b/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_103.json deleted file mode 100644 index 262181d1fee..00000000000 --- a/packages/security_detection_engine/kibana/security_rule/eb6a3790-d52d-11ec-8ce9-f661ea17fbce_103.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "attributes": { - "author": [ - "Elastic" - ], - "description": "Identifies an outbound network connection attempt followed by a session id change as the root user by the same process entity. This particular instantiation of a network connection is abnormal and should be investigated as it may indicate a potential reverse shell activity via a privileged process.", - "false_positives": [ - "False-Positives (FP) can appear if another remote terminal service is being used to connect to it's listener but typically SSH is used in these scenarios." - ], - "from": "now-9m", - "index": [ - "logs-endpoint.events.*" - ], - "language": "eql", - "license": "Elastic License v2", - "name": "Suspicious Network Connection Attempt by Root", - "note": "## Triage and analysis\n### Investigating Connection Attempt by Non-SSH Root Session\nDetection alerts from this rule indicate a strange or abnormal outbound connection attempt by a privileged process. Here are some possible avenues of investigation:\n- Examine unusual and active sessions using commands such as 'last -a', 'netstat -a', and 'w -a'.\n- Analyze processes and command line arguments to detect anomalous process execution that may be acting as a listener.\n- Analyze anomalies in the use of files that do not normally initiate connections.\n- Examine processes utilizing the network that do not normally have network communication.\n", - "query": "sequence by process.entity_id with maxspan=1m\n[network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and user.id == \"0\" and\n not process.executable : (\"/bin/ssh\", \"/sbin/ssh\", \"/usr/lib/systemd/systemd\", \"/usr/sbin/sshd\")]\n[process where host.os.type == \"linux\" and event.action == \"session_id_change\" and user.id == \"0\" and\n not process.executable : (\"/bin/ssh\", \"/sbin/ssh\", \"/usr/lib/systemd/systemd\", \"/usr/sbin/sshd\")]\n", - "references": [ - "https://www.sandflysecurity.com/blog/linux-file-masquerading-and-malicious-pids-sandfly-1-2-6-update/", - "https://twitter.com/GossiTheDog/status/1522964028284411907", - "https://exatrack.com/public/Tricephalic_Hellkeeper.pdf" - ], - "related_integrations": [ - { - "package": "endpoint", - "version": "^8.2.0" - } - ], - "required_fields": [ - { - "ecs": true, - "name": "event.action", - "type": "keyword" - }, - { - "ecs": true, - "name": "event.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "host.os.type", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.entity_id", - "type": "keyword" - }, - { - "ecs": true, - "name": "process.executable", - "type": "keyword" - }, - { - "ecs": true, - "name": "user.id", - "type": "keyword" - } - ], - "risk_score": 47, - "rule_id": "eb6a3790-d52d-11ec-8ce9-f661ea17fbce", - "severity": "medium", - "tags": [ - "Domain: Endpoint", - "OS: Linux", - "Use Case: Threat Detection", - "Tactic: Command and Control" - ], - "threat": [ - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0011", - "name": "Command and Control", - "reference": "https://attack.mitre.org/tactics/TA0011/" - }, - "technique": [ - { - "id": "T1095", - "name": "Non-Application Layer Protocol", - "reference": "https://attack.mitre.org/techniques/T1095/" - } - ] - }, - { - "framework": "MITRE ATT\u0026CK", - "tactic": { - "id": "TA0004", - "name": "Privilege Escalation", - "reference": "https://attack.mitre.org/tactics/TA0004/" - }, - "technique": [ - { - "id": "T1548", - "name": "Abuse Elevation Control Mechanism", - "reference": "https://attack.mitre.org/techniques/T1548/", - "subtechnique": [ - { - "id": "T1548.003", - "name": "Sudo and Sudo Caching", - "reference": "https://attack.mitre.org/techniques/T1548/003/" - } - ] - } - ] - } - ], - "type": "eql", - "version": 103 - }, - "id": "eb6a3790-d52d-11ec-8ce9-f661ea17fbce_103", - "type": "security-rule" -} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eb9eb8ba-a983-41d9-9c93-a1c05112ca5e_105.json b/packages/security_detection_engine/kibana/security_rule/eb9eb8ba-a983-41d9-9c93-a1c05112ca5e_105.json new file mode 100644 index 00000000000..d660d2fc75c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eb9eb8ba-a983-41d9-9c93-a1c05112ca5e_105.json @@ -0,0 +1,91 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies potential attempts to disable Security-Enhanced Linux (SELinux), which is a Linux kernel security feature to support access control policies. Adversaries may disable security tools to avoid possible detection of their tools and activities.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Potential Disabling of SELinux", + "query": "event.category:process and host.os.type:linux and event.type:(start or process_started) and process.name:setenforce and process.args:0\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 105 + }, + "id": "eb9eb8ba-a983-41d9-9c93-a1c05112ca5e_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6_106.json b/packages/security_detection_engine/kibana/security_rule/ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6_106.json new file mode 100644 index 00000000000..268782456a7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6_106.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the password log file from the default Mimikatz memssp module.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Mimikatz Memssp Log File Detected", + "note": "## Triage and analysis\n\n### Investigating Mimikatz Memssp Log File Detected\n\n[Mimikatz](https://github.com/gentilkiwi/mimikatz) is an open-source tool used to collect, decrypt, and/or use cached credentials. This tool is commonly abused by adversaries during the post-compromise stage where adversaries have gained an initial foothold on an endpoint and are looking to elevate privileges and seek out additional authentication objects such as tokens/hashes/credentials that can then be used to laterally move and pivot across a network.\n\nThis rule looks for the creation of a file named `mimilsa.log`, which is generated when using the Mimikatz misc::memssp module, which injects a malicious Windows SSP to collect locally authenticated credentials, which includes the computer account password, running service credentials, and any accounts that logon.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (e.g., 4624) to the target host.\n- Retrieve and inspect the log file contents.\n- Search for DLL files created in the same location as the log file, and retrieve unsigned DLLs.\n - Use the PowerShell Get-FileHash cmdlet to get the SHA-256 hash value of these files.\n - Search for the existence of these files in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n - Identify the process that created the DLL using file creation events.\n\n### False positive analysis\n\n- This file name `mimilsa.log` should not legitimately be created.\n\n### Related rules\n\n- Mimikatz Powershell Module Activity - ac96ceb8-4399-4191-af1d-4feeac1f1f46\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the host is a Domain Controller (DC):\n - Activate your incident response plan for total Active Directory compromise.\n - Review the privileges assigned to users that can access the DCs to ensure that the least privilege principle is being followed and reduce the attack surface.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Reboot the host to remove the injected SSP from memory.\n- Reimage the host operating system or restore compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and file.name : \"mimilsa.log\" and process.name : \"lsass.exe\"\n", + "references": [ + "https://www.elastic.co/security-labs/detect-credential-access" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "ebb200e8-adf0-43f8-a0bb-4ee5b5d852c6_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ebf1adea-ccf2-4943-8b96-7ab11ca173a5_106.json b/packages/security_detection_engine/kibana/security_rule/ebf1adea-ccf2-4943-8b96-7ab11ca173a5_106.json new file mode 100644 index 00000000000..d14e8fa86a7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ebf1adea-ccf2-4943-8b96-7ab11ca173a5_106.json @@ -0,0 +1,105 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when Internet Information Services (IIS) HTTP Logging is disabled on a server. An attacker with IIS server access via a webshell or other mechanism can disable HTTP Logging as an effective anti-forensics measure.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "max_signals": 33, + "name": "IIS HTTP Logging Disabled", + "note": "## Triage and analysis\n\n### Investigating IIS HTTP Logging Disabled\n\nIIS (Internet Information Services) is a Microsoft web server software used to host websites and web applications on Windows. It provides features for serving dynamic and static content, and can be managed through a graphical interface or command-line tools.\n\nIIS logging is a data source that can be used for security monitoring, forensics, and incident response. It contains mainly information related to requests done to the web server, and can be used to spot malicious activities like webshells. Adversaries can tamper, clear, and delete this data to evade detection, cover their tracks, and slow down incident response.\n\nThis rule monitors commands that disable IIS logging.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n - Verify if any other anti-forensics behaviors were observed.\n- Verify whether the logs stored in the `C:\\inetpub\\logs\\logfiles\\w3svc1` directory were deleted after this action.\n- Check if this operation is done under change management and approved according to the organization's policy.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Re-enable affected logging components, services, and security monitoring.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"appcmd.exe\" or process.pe.original_file_name == \"appcmd.exe\") and\n process.args : \"/dontLog*:*True\" and\n not process.parent.name : \"iissetup.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "ebf1adea-ccf2-4943-8b96-7ab11ca173a5", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.002", + "name": "Disable Windows Event Logging", + "reference": "https://attack.mitre.org/techniques/T1562/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "ebf1adea-ccf2-4943-8b96-7ab11ca173a5_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ebfe1448-7fac-4d59-acea-181bd89b1f7f_106.json b/packages/security_detection_engine/kibana/security_rule/ebfe1448-7fac-4d59-acea-181bd89b1f7f_106.json new file mode 100644 index 00000000000..f02dbc92bc0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ebfe1448-7fac-4d59-acea-181bd89b1f7f_106.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies process execution from suspicious default Windows directories. This is sometimes done by adversaries to hide malware in trusted paths.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Process Execution from an Unusual Directory", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n /* add suspicious execution paths here */\nprocess.executable : (\"C:\\\\PerfLogs\\\\*.exe\",\"C:\\\\Users\\\\Public\\\\*.exe\",\"C:\\\\Windows\\\\Tasks\\\\*.exe\",\"C:\\\\Intel\\\\*.exe\",\"C:\\\\AMD\\\\Temp\\\\*.exe\",\"C:\\\\Windows\\\\AppReadiness\\\\*.exe\",\n\"C:\\\\Windows\\\\ServiceState\\\\*.exe\",\"C:\\\\Windows\\\\security\\\\*.exe\",\"C:\\\\Windows\\\\IdentityCRL\\\\*.exe\",\"C:\\\\Windows\\\\Branding\\\\*.exe\",\"C:\\\\Windows\\\\csc\\\\*.exe\",\n \"C:\\\\Windows\\\\DigitalLocker\\\\*.exe\",\"C:\\\\Windows\\\\en-US\\\\*.exe\",\"C:\\\\Windows\\\\wlansvc\\\\*.exe\",\"C:\\\\Windows\\\\Prefetch\\\\*.exe\",\"C:\\\\Windows\\\\Fonts\\\\*.exe\",\n \"C:\\\\Windows\\\\diagnostics\\\\*.exe\",\"C:\\\\Windows\\\\TAPI\\\\*.exe\",\"C:\\\\Windows\\\\INF\\\\*.exe\",\"C:\\\\Windows\\\\System32\\\\Speech\\\\*.exe\",\"C:\\\\windows\\\\tracing\\\\*.exe\",\n \"c:\\\\windows\\\\IME\\\\*.exe\",\"c:\\\\Windows\\\\Performance\\\\*.exe\",\"c:\\\\windows\\\\intel\\\\*.exe\",\"c:\\\\windows\\\\ms\\\\*.exe\",\"C:\\\\Windows\\\\dot3svc\\\\*.exe\",\n \"C:\\\\Windows\\\\panther\\\\*.exe\",\"C:\\\\Windows\\\\RemotePackages\\\\*.exe\",\"C:\\\\Windows\\\\OCR\\\\*.exe\",\"C:\\\\Windows\\\\appcompat\\\\*.exe\",\"C:\\\\Windows\\\\apppatch\\\\*.exe\",\"C:\\\\Windows\\\\addins\\\\*.exe\",\n \"C:\\\\Windows\\\\Setup\\\\*.exe\",\"C:\\\\Windows\\\\Help\\\\*.exe\",\"C:\\\\Windows\\\\SKB\\\\*.exe\",\"C:\\\\Windows\\\\Vss\\\\*.exe\",\"C:\\\\Windows\\\\Web\\\\*.exe\",\"C:\\\\Windows\\\\servicing\\\\*.exe\",\"C:\\\\Windows\\\\CbsTemp\\\\*.exe\",\n \"C:\\\\Windows\\\\Logs\\\\*.exe\",\"C:\\\\Windows\\\\WaaS\\\\*.exe\",\"C:\\\\Windows\\\\ShellExperiences\\\\*.exe\",\"C:\\\\Windows\\\\ShellComponents\\\\*.exe\",\"C:\\\\Windows\\\\PLA\\\\*.exe\",\n \"C:\\\\Windows\\\\Migration\\\\*.exe\",\"C:\\\\Windows\\\\debug\\\\*.exe\",\"C:\\\\Windows\\\\Cursors\\\\*.exe\",\"C:\\\\Windows\\\\Containers\\\\*.exe\",\"C:\\\\Windows\\\\Boot\\\\*.exe\",\"C:\\\\Windows\\\\bcastdvr\\\\*.exe\",\n \"C:\\\\Windows\\\\assembly\\\\*.exe\",\"C:\\\\Windows\\\\TextInput\\\\*.exe\",\"C:\\\\Windows\\\\security\\\\*.exe\",\"C:\\\\Windows\\\\schemas\\\\*.exe\",\"C:\\\\Windows\\\\SchCache\\\\*.exe\",\"C:\\\\Windows\\\\Resources\\\\*.exe\",\n \"C:\\\\Windows\\\\rescache\\\\*.exe\",\"C:\\\\Windows\\\\Provisioning\\\\*.exe\",\"C:\\\\Windows\\\\PrintDialog\\\\*.exe\",\"C:\\\\Windows\\\\PolicyDefinitions\\\\*.exe\",\"C:\\\\Windows\\\\media\\\\*.exe\",\n \"C:\\\\Windows\\\\Globalization\\\\*.exe\",\"C:\\\\Windows\\\\L2Schemas\\\\*.exe\",\"C:\\\\Windows\\\\LiveKernelReports\\\\*.exe\",\"C:\\\\Windows\\\\ModemLogs\\\\*.exe\",\"C:\\\\Windows\\\\ImmersiveControlPanel\\\\*.exe\") and\n not process.name : (\"SpeechUXWiz.exe\",\"SystemSettings.exe\",\"TrustedInstaller.exe\",\"PrintDialog.exe\",\"MpSigStub.exe\",\"LMS.exe\",\"mpam-*.exe\") and\n not process.executable :\n (\"?:\\\\Intel\\\\Wireless\\\\WUSetupLauncher.exe\",\n \"?:\\\\Intel\\\\Wireless\\\\Setup.exe\",\n \"?:\\\\Intel\\\\Move Mouse.exe\",\n \"?:\\\\windows\\\\Panther\\\\DiagTrackRunner.exe\",\n \"?:\\\\Windows\\\\servicing\\\\GC64\\\\tzupd.exe\",\n \"?:\\\\Users\\\\Public\\\\res\\\\RemoteLite.exe\",\n \"?:\\\\Users\\\\Public\\\\IBM\\\\ClientSolutions\\\\*.exe\",\n \"?:\\\\Users\\\\Public\\\\Documents\\\\syspin.exe\",\n \"?:\\\\Users\\\\Public\\\\res\\\\FileWatcher.exe\")\n /* uncomment once in winlogbeat */\n /* and not (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true) */\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ebfe1448-7fac-4d59-acea-181bd89b1f7f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.005", + "name": "Match Legitimate Name or Location", + "reference": "https://attack.mitre.org/techniques/T1036/005/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "ebfe1448-7fac-4d59-acea-181bd89b1f7f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eda499b8-a073-4e35-9733-22ec71f57f3a_106.json b/packages/security_detection_engine/kibana/security_rule/eda499b8-a073-4e35-9733-22ec71f57f3a_106.json new file mode 100644 index 00000000000..f94459397fc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eda499b8-a073-4e35-9733-22ec71f57f3a_106.json @@ -0,0 +1,129 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects the Active Directory query tool, AdFind.exe. AdFind has legitimate purposes, but it is frequently leveraged by threat actors to perform post-exploitation Active Directory reconnaissance. The AdFind tool has been observed in Trickbot, Ryuk, Maze, and FIN6 campaigns. For Winlogbeat, this rule requires Sysmon.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "AdFind Command Activity", + "note": "## Triage and analysis\n\n### Investigating AdFind Command Activity\n\n[AdFind](http://www.joeware.net/freetools/tools/adfind/) is a freely available command-line tool used to retrieve information from Active Directory (AD). Network discovery and enumeration tools like `AdFind` are useful to adversaries in the same ways they are effective for network administrators. This tool provides quick ability to scope AD person/computer objects and understand subnets and domain information. There are many [examples](https://thedfirreport.com/category/adfind/) of this tool being adopted by ransomware and criminal groups and used in compromises.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Examine the command line to determine what information was retrieved by the tool.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- This rule has a high chance to produce false positives as it is a legitimate tool used by network administrators.\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n- Malicious behavior with `AdFind` should be investigated as part of a step within an attack chain. It doesn't happen in isolation, so reviewing previous logs/activity from impacted machines can be very telling.\n\n### Related rules\n\n- Windows Network Enumeration - 7b8bfc26-81d2-435e-965c-d722ee397ef1\n- Enumeration of Administrator Accounts - 871ea072-1b71-4def-b016-6278b505138d\n- Enumeration Command Spawned via WMIPrvSE - 770e0c4d-b998-41e5-a62e-c7901fd7f470\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"AdFind.exe\" or process.pe.original_file_name == \"AdFind.exe\") and\n process.args : (\"objectcategory=computer\", \"(objectcategory=computer)\",\n \"objectcategory=person\", \"(objectcategory=person)\",\n \"objectcategory=subnet\", \"(objectcategory=subnet)\",\n \"objectcategory=group\", \"(objectcategory=group)\",\n \"objectcategory=organizationalunit\", \"(objectcategory=organizationalunit)\",\n \"objectcategory=attributeschema\", \"(objectcategory=attributeschema)\",\n \"domainlist\", \"dcmodes\", \"adinfo\", \"dclist\", \"computers_pwnotreqd\", \"trustdmp\")\n", + "references": [ + "http://www.joeware.net/freetools/tools/adfind/", + "https://thedfirreport.com/2020/05/08/adfind-recon/", + "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", + "https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware", + "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html", + "https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "eda499b8-a073-4e35-9733-22ec71f57f3a", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + }, + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + }, + { + "id": "T1482", + "name": "Domain Trust Discovery", + "reference": "https://attack.mitre.org/techniques/T1482/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "eda499b8-a073-4e35-9733-22ec71f57f3a_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/edb91186-1c7e-4db8-b53e-bfa33a1a0a8a_104.json b/packages/security_detection_engine/kibana/security_rule/edb91186-1c7e-4db8-b53e-bfa33a1a0a8a_104.json new file mode 100644 index 00000000000..9d8a33048dc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/edb91186-1c7e-4db8-b53e-bfa33a1a0a8a_104.json @@ -0,0 +1,75 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to deactivate an Okta application. An adversary may attempt to modify, deactivate, or delete an Okta application in order to weaken an organization's security controls or disrupt their business operations.", + "false_positives": [ + "Consider adding exceptions to this rule to filter false positives if your organization's Okta applications are regularly deactivated and the behavior is expected." + ], + "index": [ + "filebeat-*", + "logs-okta*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Attempt to Deactivate an Okta Application", + "note": "## Triage and analysis\n\n### Investigating Attempt to Deactivate an Okta Application\n\nThis rule detects attempts to deactivate an Okta application. Unauthorized deactivation could lead to disruption of services and pose a significant risk to the organization.\n\n#### Possible investigation steps:\n- Identify the actor associated with the deactivation attempt by examining the `okta.actor.id`, `okta.actor.type`, `okta.actor.alternate_id`, and `okta.actor.display_name` fields.\n- Determine the client used by the actor. Review the `okta.client.ip`, `okta.client.user_agent.raw_user_agent`, `okta.client.zone`, `okta.client.device`, and `okta.client.id` fields.\n- If the client is a device, check the `okta.device.id`, `okta.device.name`, `okta.device.os_platform`, `okta.device.os_version`, and `okta.device.managed` fields.\n- Understand the context of the event from the `okta.debug_context.debug_data` and `okta.authentication_context` fields.\n- Check the `okta.outcome.result` and `okta.outcome.reason` fields to see if the attempt was successful or failed.\n- Review the past activities of the actor involved in this action by checking their previous actions logged in the `okta.target` field.\n- Analyze the `okta.transaction.id` and `okta.transaction.type` fields to understand the context of the transaction.\n- Evaluate the actions that happened just before and after this event in the `okta.event_type` field to help understand the full context of the activity.\n\n### False positive analysis:\n- It might be a false positive if the action was part of a planned activity, performed by an authorized person, or if the `okta.outcome.result` field shows a failure.\n- An unsuccessful attempt might also indicate an authorized user having trouble rather than a malicious activity.\n\n### Response and remediation:\n- If unauthorized deactivation attempts are confirmed, initiate the incident response process.\n- Block the IP address or device used in the attempts if they appear suspicious, using the data from the `okta.client.ip` and `okta.device.id` fields.\n- Reset the user's password and enforce MFA re-enrollment, if applicable.\n- Conduct a review of Okta policies and ensure they are in accordance with security best practices.\n- If the deactivated application was crucial for business operations, coordinate with the relevant team to reactivate it and minimize the impact.", + "query": "event.dataset:okta.system and event.action:application.lifecycle.deactivate\n", + "references": [ + "https://help.okta.com/en/prod/Content/Topics/Apps/Apps_Apps.htm", + "https://developer.okta.com/docs/reference/api/system-log/", + "https://developer.okta.com/docs/reference/api/event-types/", + "https://www.elastic.co/security-labs/testing-okta-visibility-and-detection-dorothy" + ], + "related_integrations": [ + { + "package": "okta", + "version": "^1.3.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.dataset", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "edb91186-1c7e-4db8-b53e-bfa33a1a0a8a", + "setup": "The Okta Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.", + "severity": "low", + "tags": [ + "Use Case: Identity and Access Audit", + "Data Source: Okta", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1489", + "name": "Service Stop", + "reference": "https://attack.mitre.org/techniques/T1489/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "edb91186-1c7e-4db8-b53e-bfa33a1a0a8a_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/edf8ee23-5ea7-4123-ba19-56b41e424ae3_106.json b/packages/security_detection_engine/kibana/security_rule/edf8ee23-5ea7-4123-ba19-56b41e424ae3_106.json new file mode 100644 index 00000000000..3c3158ffe31 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/edf8ee23-5ea7-4123-ba19-56b41e424ae3_106.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies abuse of the Windows Update Auto Update Client (wuauclt.exe) to load an arbitrary DLL. This behavior is used as a defense evasion technique to blend-in malicious activity with legitimate Windows software.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "ImageLoad via Windows Update Auto Update Client", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.pe.original_file_name == \"wuauclt.exe\" or process.name : \"wuauclt.exe\") and\n /* necessary windows update client args to load a dll */\n process.args : \"/RunHandlerComServer\" and process.args : \"/UpdateDeploymentProvider\" and\n /* common paths writeable by a standard user where the target DLL can be placed */\n process.args : (\"C:\\\\Users\\\\*.dll\", \"C:\\\\ProgramData\\\\*.dll\", \"C:\\\\Windows\\\\Temp\\\\*.dll\", \"C:\\\\Windows\\\\Tasks\\\\*.dll\")\n", + "references": [ + "https://dtm.uk/wuauclt/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "edf8ee23-5ea7-4123-ba19-56b41e424ae3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/" + } + ] + } + ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "edf8ee23-5ea7-4123-ba19-56b41e424ae3_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/edfd5ca9-9d6c-44d9-b615-1e56b920219c_2.json b/packages/security_detection_engine/kibana/security_rule/edfd5ca9-9d6c-44d9-b615-1e56b920219c_2.json new file mode 100644 index 00000000000..68102128c6f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/edfd5ca9-9d6c-44d9-b615-1e56b920219c_2.json @@ -0,0 +1,84 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.", + "from": "now-9m", + "index": [ + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Linux User Account Creation", + "note": "## Triage and analysis\n\n### Investigating Linux User Account Creation\n\nThe `useradd` and `adduser` commands are used to create new user accounts in Linux-based operating systems.\n\nAttackers may create new accounts (both local and domain) to maintain access to victim systems.\n\nThis rule identifies the usage of `useradd` and `adduser` to create new accounts.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate whether the user was created succesfully.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific User\",\"query\":\"SELECT * FROM users WHERE username = {{user.name}}\"}}\n- Investigate whether the user is currently logged in and active.\n - !{osquery{\"label\":\"Osquery - Investigate the Account Authentication Status\",\"query\":\"SELECT * FROM logged_in_users WHERE user = {{user.name}}\"}}\n- Identify if the account was added to privileged groups or assigned special privileges after creation.\n - !{osquery{\"label\":\"Osquery - Retrieve Information for a Specific Group\",\"query\":\"SELECT * FROM groups WHERE groupname = {{group.name}}\"}}\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence and whether they are located in expected locations.\n - !{osquery{\"label\":\"Osquery - Retrieve Running Processes by User\",\"query\":\"SELECT pid, username, name FROM processes p JOIN users u ON u.uid = p.uid ORDER BY username\"}}\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- Account creation is a common administrative task, so there is a high chance of the activity being legitimate. Before investigating further, verify that this activity is not benign.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Delete the created account.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "iam where host.os.type == \"linux\" and (event.type == \"user\" and event.type == \"creation\") and\nprocess.name in (\"useradd\", \"adduser\") and user.name != null\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "edfd5ca9-9d6c-44d9-b615-1e56b920219c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1136", + "name": "Create Account", + "reference": "https://attack.mitre.org/techniques/T1136/", + "subtechnique": [ + { + "id": "T1136.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1136/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "edfd5ca9-9d6c-44d9-b615-1e56b920219c_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ee5300a7-7e31-4a72-a258-250abb8b3aa1_104.json b/packages/security_detection_engine/kibana/security_rule/ee5300a7-7e31-4a72-a258-250abb8b3aa1_104.json new file mode 100644 index 00000000000..2b5848161f8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ee5300a7-7e31-4a72-a258-250abb8b3aa1_104.json @@ -0,0 +1,106 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects unusual Print Spooler service (spoolsv.exe) child processes. This may indicate an attempt to exploit privilege escalation vulnerabilities related to the Printing Service on Windows.", + "false_positives": [ + "Install or update of a legitimate printing driver. Verify the printer driver file metadata such as manufacturer and signature information." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Print Spooler Child Process", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"spoolsv.exe\" and\n (?process.Ext.token.integrity_level_name : \"System\" or\n ?winlog.event_data.IntegrityLevel : \"System\") and\n\n /* exclusions for FP control below */\n not process.name : (\"splwow64.exe\", \"PDFCreator.exe\", \"acrodist.exe\", \"spoolsv.exe\", \"msiexec.exe\", \"route.exe\", \"WerFault.exe\") and\n not process.command_line : \"*\\\\WINDOWS\\\\system32\\\\spool\\\\DRIVERS*\" and\n not (process.name : \"net.exe\" and process.command_line : (\"*stop*\", \"*start*\")) and\n not (process.name : (\"cmd.exe\", \"powershell.exe\") and process.command_line : (\"*.spl*\", \"*\\\\program files*\", \"*route add*\")) and\n not (process.name : \"netsh.exe\" and process.command_line : (\"*add portopening*\", \"*rule name*\")) and\n not (process.name : \"regsvr32.exe\" and process.command_line : \"*PrintConfig.dll*\")\n", + "references": [ + "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.IntegrityLevel", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ee5300a7-7e31-4a72-a258-250abb8b3aa1", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "ee5300a7-7e31-4a72-a258-250abb8b3aa1_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ee53d67a-5f0c-423c-a53c-8084ae562b5c_1.json b/packages/security_detection_engine/kibana/security_rule/ee53d67a-5f0c-423c-a53c-8084ae562b5c_1.json new file mode 100644 index 00000000000..9091806674b --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ee53d67a-5f0c-423c-a53c-8084ae562b5c_1.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies shortcut files written to or modified in the startup folder. Adversaries may use this technique to maintain persistence.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Shortcut File Written or Modified on Startup Folder", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and file.extension == \"lnk\" and\n file.path : (\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\Startup\\\\*\",\n \"C:\\\\ProgramData\\\\Microsoft\\\\Windows\\\\Start Menu\\\\Programs\\\\StartUp\\\\*\"\n ) and\n not (\n (process.name : \"ONENOTE.EXE\" and process.code_signature.status: \"trusted\" and file.name : \"Send to OneNote.lnk\") or\n (process.name: \"OktaVerifySetup.exe\" and process.code_signature.status: \"trusted\" and file.name : \"Okta Verify.lnk\")\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "ee53d67a-5f0c-423c-a53c-8084ae562b5c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + }, + { + "id": "T1547.009", + "name": "Shortcut Modification", + "reference": "https://attack.mitre.org/techniques/T1547/009/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "ee53d67a-5f0c-423c-a53c-8084ae562b5c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/eea82229-b002-470e-a9e1-00be38b14d32_104.json b/packages/security_detection_engine/kibana/security_rule/eea82229-b002-470e-a9e1-00be38b14d32_104.json new file mode 100644 index 00000000000..00fe4b417b0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/eea82229-b002-470e-a9e1-00be38b14d32_104.json @@ -0,0 +1,96 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the use of sqlite3 to directly modify the Transparency, Consent, and Control (TCC) SQLite database. This may indicate an attempt to bypass macOS privacy controls, including access to sensitive resources like the system camera, microphone, address book, and calendar.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Privacy Control Bypass via TCCDB Modification", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name : \"sqlite*\" and\n process.args : \"/*/Application Support/com.apple.TCC/TCC.db\" and\n not process.parent.executable : \"/Library/Bitdefender/AVP/product/bin/*\"\n", + "references": [ + "https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/", + "https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh", + "https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "eea82229-b002-470e-a9e1-00be38b14d32", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "eea82229-b002-470e-a9e1-00be38b14d32_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ef04a476-07ec-48fc-8f3d-5e1742de76d3_105.json b/packages/security_detection_engine/kibana/security_rule/ef04a476-07ec-48fc-8f3d-5e1742de76d3_105.json new file mode 100644 index 00000000000..ecb6d1764f5 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ef04a476-07ec-48fc-8f3d-5e1742de76d3_105.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects when the tc (transmission control) binary is utilized to set a BPF (Berkeley Packet Filter) on a network interface. Tc is used to configure Traffic Control in the Linux kernel. It can shape, schedule, police and drop traffic. A threat actor can utilize tc to set a bpf filter on an interface for the purpose of manipulating the incoming traffic. This technique is not at all common and should indicate abnormal, suspicious or malicious activity.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "BPF filter applied using TC", + "query": "process where host.os.type == \"linux\" and event.type != \"end\" and process.executable : \"/usr/sbin/tc\" and process.args : \"filter\" and process.args : \"add\" and process.args : \"bpf\" and not process.parent.executable: \"/usr/sbin/libvirtd\"\n", + "references": [ + "https://github.com/h3xduck/TripleCross/blob/master/src/helpers/deployer.sh", + "https://man7.org/linux/man-pages/man8/tc.8.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "ef04a476-07ec-48fc-8f3d-5e1742de76d3", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Threat: TripleCross", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "ef04a476-07ec-48fc-8f3d-5e1742de76d3_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ef100a2e-ecd4-4f72-9d1e-2f779ff3c311_3.json b/packages/security_detection_engine/kibana/security_rule/ef100a2e-ecd4-4f72-9d1e-2f779ff3c311_3.json new file mode 100644 index 00000000000..e8174210ff8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ef100a2e-ecd4-4f72-9d1e-2f779ff3c311_3.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of the mimipenguin exploit script which is linux adaptation of Windows tool mimikatz. Mimipenguin exploit script is used to dump clear text passwords from a currently logged-in user. The tool exploits a known vulnerability CVE-2018-20781. Malicious actors can exploit the cleartext credentials in memory by dumping the process and extracting lines that have a high probability of containing cleartext passwords.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Linux Credential Dumping via Proc Filesystem", + "query": "sequence by process.parent.name,host.name with maxspan=1m\n[process where host.os.type == \"linux\" and process.name == \"ps\" and event.action == \"exec\"\n and process.args in (\"-eo\", \"pid\", \"command\") ]\n\n[process where host.os.type == \"linux\" and process.name == \"strings\" and event.action == \"exec\"\n and process.args : \"/tmp/*\" ]\n", + "references": [ + "https://github.com/huntergregal/mimipenguin", + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.007", + "name": "Proc Filesystem", + "reference": "https://attack.mitre.org/techniques/T1003/007/" + } + ] + }, + { + "id": "T1212", + "name": "Exploitation for Credential Access", + "reference": "https://attack.mitre.org/techniques/T1212/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "ef100a2e-ecd4-4f72-9d1e-2f779ff3c311_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ef862985-3f13-4262-a686-5f357bbb9bc2_107.json b/packages/security_detection_engine/kibana/security_rule/ef862985-3f13-4262-a686-5f357bbb9bc2_107.json new file mode 100644 index 00000000000..6e5b78e3c6c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ef862985-3f13-4262-a686-5f357bbb9bc2_107.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious use of whoami.exe which displays user, group, and privileges information for the user who is currently logged on to the local system.", + "false_positives": [ + "Some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools and frameworks. Usage by non-engineers and ordinary users is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "logs-system.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Whoami Process Activity", + "note": "## Triage and analysis\n\n### Investigating Whoami Process Activity\n\nAfter successfully compromising an environment, attackers may try to gain situational awareness to plan their next steps. This can happen by running commands to enumerate network resources, users, connections, files, and installed security software.\n\nThis rule looks for the execution of the `whoami` utility. Attackers commonly use this utility to measure their current privileges, discover the current user, determine if a privilege escalation was successful, etc.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal account behavior, such as command executions, file creations or modifications, and network connections.\n\n### False positive analysis\n\n- Discovery activities are not inherently malicious if they occur in isolation. As long as the analyst did not identify suspicious activity related to the user or host, such alerts can be dismissed.\n\n### Related rules\n\n- Account Discovery Command via SYSTEM Account - 2856446a-34e6-435b-9fb5-f8f040bfa7ed\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"whoami.exe\" and\n(\n\n (/* scoped for whoami execution under system privileges */\n (user.domain : (\"NT AUTHORITY\", \"NT-AUTORIT\u00c4T\", \"AUTORITE NT\", \"IIS APPPOOL\") or user.id : (\"S-1-5-18\", \"S-1-5-19\", \"S-1-5-20\")) and\n\n not (process.parent.name : \"cmd.exe\" and\n process.parent.args : (\"chcp 437\u003enul 2\u003e\u00261 \u0026 C:\\\\WINDOWS\\\\System32\\\\whoami.exe /groups\",\n \"chcp 437\u003enul 2\u003e\u00261 \u0026 %systemroot%\\\\system32\\\\whoami /user\",\n \"C:\\\\WINDOWS\\\\System32\\\\whoami.exe /groups\",\n \"*WINDOWS\\\\system32\\\\config\\\\systemprofile*\")) and\n not (process.parent.executable : \"C:\\\\Windows\\\\system32\\\\inetsrv\\\\appcmd.exe\" and process.parent.args : \"LIST\") and\n not process.parent.executable : (\"C:\\\\Program Files\\\\Microsoft Monitoring Agent\\\\Agent\\\\MonitoringHost.exe\",\n \"C:\\\\Program Files\\\\Cohesity\\\\cohesity_windows_agent_service.exe\")) or\n\n process.parent.name : (\"wsmprovhost.exe\", \"w3wp.exe\", \"wmiprvse.exe\", \"rundll32.exe\", \"regsvr32.exe\")\n\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "ef862985-3f13-4262-a686-5f357bbb9bc2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1033", + "name": "System Owner/User Discovery", + "reference": "https://attack.mitre.org/techniques/T1033/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "ef862985-3f13-4262-a686-5f357bbb9bc2_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f036953a-4615-4707-a1ca-dc53bf69dcd5_105.json b/packages/security_detection_engine/kibana/security_rule/f036953a-4615-4707-a1ca-dc53bf69dcd5_105.json new file mode 100644 index 00000000000..ac4aa35fca0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f036953a-4615-4707-a1ca-dc53bf69dcd5_105.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies child processes of unusual instances of RunDLL32 where the command line parameters were suspicious. Misuse of RunDLL32 could indicate malicious activity.", + "from": "now-60m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "30m", + "language": "eql", + "license": "Elastic License v2", + "name": "Unusual Child Processes of RunDLL32", + "query": "sequence with maxspan=1h\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"rundll32.exe\" or process.pe.original_file_name == \"RUNDLL32.EXE\") and\n process.args_count == 1\n ] by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"rundll32.exe\"\n ] by process.parent.entity_id\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f036953a-4615-4707-a1ca-dc53bf69dcd5", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.011", + "name": "Rundll32", + "reference": "https://attack.mitre.org/techniques/T1218/011/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "f036953a-4615-4707-a1ca-dc53bf69dcd5_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f0493cb4-9b15-43a9-9359-68c23a7f2cf3_104.json b/packages/security_detection_engine/kibana/security_rule/f0493cb4-9b15-43a9-9359-68c23a7f2cf3_104.json new file mode 100644 index 00000000000..3e8ace04db7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f0493cb4-9b15-43a9-9359-68c23a7f2cf3_104.json @@ -0,0 +1,141 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of a browser process to open an HTML file with high entropy and size. Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious HTML File Creation", + "note": "", + "query": "sequence by user.id with maxspan=5m\n [file where host.os.type == \"windows\" and event.action in (\"creation\", \"rename\") and\n file.extension : (\"htm\", \"html\") and\n file.path : (\"?:\\\\Users\\\\*\\\\Downloads\\\\*\",\n \"?:\\\\Users\\\\*\\\\Content.Outlook\\\\*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\Temp?_*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\7z*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\Rar$*\") and\n ((file.Ext.entropy \u003e= 5 and file.size \u003e= 150000) or file.size \u003e= 1000000)]\n [process where host.os.type == \"windows\" and event.action == \"start\" and\n (\n (process.name in (\"chrome.exe\", \"msedge.exe\", \"brave.exe\", \"whale.exe\", \"browser.exe\", \"dragon.exe\", \"vivaldi.exe\", \"opera.exe\")\n and process.args == \"--single-argument\") or\n (process.name == \"iexplore.exe\" and process.args_count == 2) or\n (process.name in (\"firefox.exe\", \"waterfox.exe\") and process.args == \"-url\")\n )\n and process.args : (\"?:\\\\Users\\\\*\\\\Downloads\\\\*.htm*\",\n \"?:\\\\Users\\\\*\\\\Content.Outlook\\\\*.htm*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\Temp?_*.htm*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\7z*.htm*\",\n \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\Temp\\\\Rar$*.htm*\")]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.entropy", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.size", + "type": "long" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f0493cb4-9b15-43a9-9359-68c23a7f2cf3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + }, + { + "id": "T1566.002", + "name": "Spearphishing Link", + "reference": "https://attack.mitre.org/techniques/T1566/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1027", + "name": "Obfuscated Files or Information", + "reference": "https://attack.mitre.org/techniques/T1027/", + "subtechnique": [ + { + "id": "T1027.006", + "name": "HTML Smuggling", + "reference": "https://attack.mitre.org/techniques/T1027/006/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 104 + }, + "id": "f0493cb4-9b15-43a9-9359-68c23a7f2cf3_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7_104.json b/packages/security_detection_engine/kibana/security_rule/f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7_104.json new file mode 100644 index 00000000000..faf434998b1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7_104.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a potential Gatekeeper bypass. In macOS, when applications or programs are downloaded from the internet, there is a quarantine flag set on the file. This attribute is read by Apple's Gatekeeper defense program at execution time. An adversary may disable this attribute to evade defenses.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Attempt to Remove File Quarantine Attribute", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and\n process.name : \"xattr\" and\n (\n (process.args : \"com.apple.quarantine\" and process.args : (\"-d\", \"-w\")) or\n (process.args : \"-c\") or\n (process.command_line : (\"/bin/bash -c xattr -c *\", \"/bin/zsh -c xattr -c *\", \"/bin/sh -c xattr -c *\"))\n ) and not process.args_count \u003e 12\n", + "references": [ + "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html", + "https://ss64.com/osx/xattr.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args_count", + "type": "long" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "f0b48bbc-549e-4bcf-8ee0-a7a72586c6a7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f0eb70e9-71e9-40cd-813f-bf8e8c812cb1_104.json b/packages/security_detection_engine/kibana/security_rule/f0eb70e9-71e9-40cd-813f-bf8e8c812cb1_104.json new file mode 100644 index 00000000000..e5c3011c744 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f0eb70e9-71e9-40cd-813f-bf8e8c812cb1_104.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies execution of the security_authtrampoline process via a scripting interpreter. This occurs when programs use AuthorizationExecute-WithPrivileges from the Security.framework to run another program with root privileges. It should not be run by itself, as this is a sign of execution with explicit logon credentials.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Execution with Explicit Credentials via Scripting", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:\"security_authtrampoline\" and\n process.parent.name:(osascript or com.apple.automator.runner or sh or bash or dash or zsh or python* or Python or perl* or php* or ruby or pwsh)\n", + "references": [ + "https://objectivebythesea.com/v2/talks/OBTS_v2_Thomas.pdf", + "https://www.manpagez.com/man/8/security_authtrampoline/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f0eb70e9-71e9-40cd-813f-bf8e8c812cb1", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Execution", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1078", + "name": "Valid Accounts", + "reference": "https://attack.mitre.org/techniques/T1078/" + }, + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.004", + "name": "Elevated Execution with Prompt", + "reference": "https://attack.mitre.org/techniques/T1548/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "f0eb70e9-71e9-40cd-813f-bf8e8c812cb1_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_3.json b/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_3.json new file mode 100644 index 00000000000..4ce741c0292 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_3.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.", + "false_positives": [ + "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Code Execution via Web Server", + "note": "## Triage and analysis\n\n### Investigating Potential Remote Code Execution via Web Server\n\nAdversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a malicious script, often embedded into a compromised web server, that grants an attacker remote access and control over the server. This enables the execution of arbitrary commands, data exfiltration, and further exploitation of the target network.\n\nThis rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate abnormal behaviors by the subject process such as network connections, file modifications, and any other spawned child processes.\n - Investigate listening ports and open sockets to look for potential reverse shells or data exfiltration.\n - !{osquery{\"label\":\"Osquery - Retrieve Listening Ports\",\"query\":\"SELECT pid, address, port, socket, protocol, path FROM listening_ports\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Open Sockets\",\"query\":\"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets\"}}\n - Investigate the process information for malicious or uncommon processes/process trees.\n - !{osquery{\"label\":\"Osquery - Retrieve Process Info\",\"query\":\"SELECT name, cmdline, parent, path, uid FROM processes\"}}\n - Investigate the process tree spawned from the user that is used to run the web application service. A user that is running a web application should not spawn other child processes.\n - !{osquery{\"label\":\"Osquery - Retrieve Process Info for Webapp User\",\"query\":\"SELECT name, cmdline, parent, path, uid FROM processes WHERE uid = {{process.user.id}}\"}}\n- Examine the command line to determine which commands or scripts were executed.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\") and process.parent.executable : (\n \"/usr/sbin/nginx\", \"/usr/local/sbin/nginx\",\n \"/usr/sbin/apache\", \"/usr/local/sbin/apache\",\n \"/usr/sbin/apache2\", \"/usr/local/sbin/apache2\",\n \"/usr/sbin/php*\", \"/usr/local/sbin/php*\",\n \"/usr/sbin/lighttpd\", \"/usr/local/sbin/lighttpd\",\n \"/usr/sbin/hiawatha\", \"/usr/local/sbin/hiawatha\",\n \"/usr/local/bin/caddy\", \n \"/usr/local/lsws/bin/lswsctrl\",\n \"*/bin/catalina.sh\"\n) and\nprocess.name : (\"*sh\", \"python*\", \"perl\", \"php*\", \"tmux\") and\nprocess.args : (\"whoami\", \"id\", \"uname\", \"cat\", \"hostname\", \"ip\", \"curl\", \"wget\", \"pwd\")\n", + "references": [ + "https://pentestlab.blog/tag/web-shell/", + "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/", + "subtechnique": [ + { + "id": "T1505.003", + "name": "Web Shell", + "reference": "https://attack.mitre.org/techniques/T1505/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_4.json b/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_4.json new file mode 100644 index 00000000000..3b0fc8c70d9 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_4.json @@ -0,0 +1,121 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious commands executed via a web server, which may suggest a vulnerability and remote shell access. Attackers may exploit a vulnerability in a web application to execute commands via a web server, or place a backdoor file that can be abused to gain code execution as a mechanism for persistence.", + "false_positives": [ + "Network monitoring or management products may have a web server component that runs shell commands as part of normal behavior." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Remote Code Execution via Web Server", + "note": "## Triage and analysis\n\n### Investigating Potential Remote Code Execution via Web Server\n\nAdversaries may backdoor web servers with web shells to establish persistent access to systems. A web shell is a malicious script, often embedded into a compromised web server, that grants an attacker remote access and control over the server. This enables the execution of arbitrary commands, data exfiltration, and further exploitation of the target network.\n\nThis rule detects a web server process spawning script and command line interface programs, potentially indicating attackers executing commands using the web shell.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\u003e This investigation guide uses [placeholder fields](https://www.elastic.co/guide/en/security/current/osquery-placeholder-fields.html) to dynamically pass alert data into Osquery queries. Placeholder fields were introduced in Elastic Stack version 8.7.0. If you're using Elastic Stack version 8.6.0 or earlier, you'll need to manually adjust this investigation guide's queries to ensure they properly run.\n\n#### Possible investigation steps\n\n- Investigate abnormal behaviors by the subject process such as network connections, file modifications, and any other spawned child processes.\n - Investigate listening ports and open sockets to look for potential reverse shells or data exfiltration.\n - !{osquery{\"label\":\"Osquery - Retrieve Listening Ports\",\"query\":\"SELECT pid, address, port, socket, protocol, path FROM listening_ports\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Open Sockets\",\"query\":\"SELECT pid, family, remote_address, remote_port, socket, state FROM process_open_sockets\"}}\n - Investigate the process information for malicious or uncommon processes/process trees.\n - !{osquery{\"label\":\"Osquery - Retrieve Process Info\",\"query\":\"SELECT name, cmdline, parent, path, uid FROM processes\"}}\n - Investigate the process tree spawned from the user that is used to run the web application service. A user that is running a web application should not spawn other child processes.\n - !{osquery{\"label\":\"Osquery - Retrieve Process Info for Webapp User\",\"query\":\"SELECT name, cmdline, parent, path, uid FROM processes WHERE uid = {{process.user.id}}\"}}\n- Examine the command line to determine which commands or scripts were executed.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- If scripts or executables were dropped, retrieve the files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n - File access, modification, and creation activities.\n - Cron jobs, services and other persistence mechanisms.\n - !{osquery{\"label\":\"Osquery - Retrieve Crontab Information\",\"query\":\"SELECT * FROM crontab\"}}\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Leverage the incident response data and logging to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"linux\" and event.type == \"start\" and\nevent.action in (\"exec\", \"exec_event\") and process.parent.executable : (\n \"/usr/sbin/nginx\", \"/usr/local/sbin/nginx\",\n \"/usr/sbin/apache\", \"/usr/local/sbin/apache\",\n \"/usr/sbin/apache2\", \"/usr/local/sbin/apache2\",\n \"/usr/sbin/php*\", \"/usr/local/sbin/php*\",\n \"/usr/sbin/lighttpd\", \"/usr/local/sbin/lighttpd\",\n \"/usr/sbin/hiawatha\", \"/usr/local/sbin/hiawatha\",\n \"/usr/local/bin/caddy\", \n \"/usr/local/lsws/bin/lswsctrl\",\n \"*/bin/catalina.sh\"\n) and\nprocess.name : (\"*sh\", \"python*\", \"perl\", \"php*\", \"tmux\") and\nprocess.args : (\"whoami\", \"id\", \"uname\", \"cat\", \"hostname\", \"ip\", \"curl\", \"wget\", \"pwd\") and\nnot process.name == \"phpquery\"\n", + "references": [ + "https://pentestlab.blog/tag/web-shell/", + "https://www.elastic.co/security-labs/elastic-response-to-the-the-spring4shell-vulnerability-cve-2022-22965" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Use Case: Vulnerability", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1505", + "name": "Server Software Component", + "reference": "https://attack.mitre.org/techniques/T1505/", + "subtechnique": [ + { + "id": "T1505.003", + "name": "Web Shell", + "reference": "https://attack.mitre.org/techniques/T1505/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "f16fca20-4d6c-43f9-aec1-20b6de3b0aeb_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f243fe39-83a4-46f3-a3b6-707557a102df_1.json b/packages/security_detection_engine/kibana/security_rule/f243fe39-83a4-46f3-a3b6-707557a102df_1.json new file mode 100644 index 00000000000..6eebfd887d8 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f243fe39-83a4-46f3-a3b6-707557a102df_1.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies attempts to modify a service path by an unusual process. Attackers may attempt to modify existing services for persistence or privilege escalation.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Service Path Modification", + "query": "registry where host.os.type == \"windows\" and event.type == \"change\" and\n registry.path : (\n \"HKLM\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ImagePath\",\n \"\\\\REGISTRY\\\\MACHINE\\\\SYSTEM\\\\*ControlSet*\\\\Services\\\\*\\\\ImagePath\"\n ) and not (\n process.executable : (\n \"?:\\\\Program Files\\\\*.exe\",\n \"?:\\\\Program Files (x86)\\\\*.exe\",\n \"?:\\\\Windows\\\\System32\\\\services.exe\",\n \"?:\\\\Windows\\\\WinSxS\\\\*\"\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f243fe39-83a4-46f3-a3b6-707557a102df", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1112", + "name": "Modify Registry", + "reference": "https://attack.mitre.org/techniques/T1112/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1543", + "name": "Create or Modify System Process", + "reference": "https://attack.mitre.org/techniques/T1543/", + "subtechnique": [ + { + "id": "T1543.003", + "name": "Windows Service", + "reference": "https://attack.mitre.org/techniques/T1543/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "f243fe39-83a4-46f3-a3b6-707557a102df_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f24bcae1-8980-4b30-b5dd-f851b055c9e7_105.json b/packages/security_detection_engine/kibana/security_rule/f24bcae1-8980-4b30-b5dd-f851b055c9e7_105.json new file mode 100644 index 00000000000..6be47f2351a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f24bcae1-8980-4b30-b5dd-f851b055c9e7_105.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the execution of osascript to create a hidden login item. This may indicate an attempt to persist a malicious program while concealing its presence.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Creation of Hidden Login Item via Apple Script", + "note": "", + "query": "process where host.os.type == \"macos\" and event.type in (\"start\", \"process_started\") and process.name : \"osascript\" and\n process.command_line : \"osascript*login item*hidden:true*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.command_line", + "type": "wildcard" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f24bcae1-8980-4b30-b5dd-f851b055c9e7", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.002", + "name": "AppleScript", + "reference": "https://attack.mitre.org/techniques/T1059/002/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1647", + "name": "Plist File Modification", + "reference": "https://attack.mitre.org/techniques/T1647/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "f24bcae1-8980-4b30-b5dd-f851b055c9e7_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f28e2be4-6eca-4349-bdd9-381573730c22_105.json b/packages/security_detection_engine/kibana/security_rule/f28e2be4-6eca-4349-bdd9-381573730c22_105.json new file mode 100644 index 00000000000..97a874b5616 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f28e2be4-6eca-4349-bdd9-381573730c22_105.json @@ -0,0 +1,114 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a Secure Shell (SSH) client or server process creating or writing to a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration.", + "false_positives": [ + "Updates to approved and trusted SSH executables can trigger this rule." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential OpenSSH Backdoor Logging Activity", + "note": "", + "query": "file where host.os.type == \"linux\" and event.type == \"change\" and process.executable : (\"/usr/sbin/sshd\", \"/usr/bin/ssh\") and\n (\n (file.name : (\".*\", \"~*\", \"*~\") and not file.name : (\".cache\", \".viminfo\", \".bash_history\")) or\n file.extension : (\"in\", \"out\", \"ini\", \"h\", \"gz\", \"so\", \"sock\", \"sync\", \"0\", \"1\", \"2\", \"3\", \"4\", \"5\", \"6\", \"7\", \"8\", \"9\") or\n file.path :\n (\n \"/private/etc/*--\",\n \"/usr/share/*\",\n \"/usr/include/*\",\n \"/usr/local/include/*\",\n \"/private/tmp/*\",\n \"/private/var/tmp/*\",\n \"/usr/tmp/*\",\n \"/usr/share/man/*\",\n \"/usr/local/share/*\",\n \"/usr/lib/*.so.*\",\n \"/private/etc/ssh/.sshd_auth\",\n \"/usr/bin/ssd\",\n \"/private/var/opt/power\",\n \"/private/etc/ssh/ssh_known_hosts\",\n \"/private/var/html/lol\",\n \"/private/var/log/utmp\",\n \"/private/var/lib\",\n \"/var/run/sshd/sshd.pid\",\n \"/var/run/nscd/ns.pid\",\n \"/var/run/udev/ud.pid\",\n \"/var/run/udevd.pid\"\n )\n )\n", + "references": [ + "https://github.com/eset/malware-ioc/tree/master/sshdoor", + "https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f28e2be4-6eca-4349-bdd9-381573730c22", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1556", + "name": "Modify Authentication Process", + "reference": "https://attack.mitre.org/techniques/T1556/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1554", + "name": "Compromise Client Software Binary", + "reference": "https://attack.mitre.org/techniques/T1554/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "f28e2be4-6eca-4349-bdd9-381573730c22_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f2c7b914-eda3-40c2-96ac-d23ef91776ca_105.json b/packages/security_detection_engine/kibana/security_rule/f2c7b914-eda3-40c2-96ac-d23ef91776ca_105.json new file mode 100644 index 00000000000..613e5ee7dea --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f2c7b914-eda3-40c2-96ac-d23ef91776ca_105.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications to the registered Subject Interface Package (SIP) providers. SIP providers are used by the Windows cryptographic system to validate file signatures on the system. This may be an attempt to bypass signature validation checks or inject code into critical processes.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "SIP Provider Modification", + "query": "registry where host.os.type == \"windows\" and event.type:\"change\" and\n registry.path: (\n \"*\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllPutSignedDataMsg\\\\{*}\\\\Dll\",\n \"*\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CryptSIPDllPutSignedDataMsg\\\\{*}\\\\Dll\",\n \"*\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\{*}\\\\$Dll\",\n \"*\\\\SOFTWARE\\\\WOW6432Node\\\\Microsoft\\\\Cryptography\\\\Providers\\\\Trust\\\\FinalPolicy\\\\{*}\\\\$Dll\"\n ) and\n registry.data.strings:\"*.dll\"\n", + "references": [ + "https://github.com/mattifestation/PoCSubjectInterfacePackage" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f2c7b914-eda3-40c2-96ac-d23ef91776ca", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1553", + "name": "Subvert Trust Controls", + "reference": "https://attack.mitre.org/techniques/T1553/", + "subtechnique": [ + { + "id": "T1553.003", + "name": "SIP and Trust Provider Hijacking", + "reference": "https://attack.mitre.org/techniques/T1553/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "f2c7b914-eda3-40c2-96ac-d23ef91776ca_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f2f46686-6f3c-4724-bd7d-24e31c70f98f_106.json b/packages/security_detection_engine/kibana/security_rule/f2f46686-6f3c-4724-bd7d-24e31c70f98f_106.json new file mode 100644 index 00000000000..13198bac173 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f2f46686-6f3c-4724-bd7d-24e31c70f98f_106.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of a Local Security Authority Subsystem Service (lsass.exe) default memory dump. This may indicate a credential access attempt via trusted system utilities such as Task Manager (taskmgr.exe) and SQL Dumper (sqldumper.exe) or known pentesting tools such as Dumpert and AndrewSpecial.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "LSASS Memory Dump Creation", + "note": "## Triage and analysis\n\n### Investigating LSASS Memory Dump Creation\n\nLocal Security Authority Server Service (LSASS) is a process in Microsoft Windows operating systems that is responsible for enforcing security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.\n\nThis rule looks for the creation of memory dump files with file names compatible with credential dumping tools or that start with `lsass`.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the process responsible for creating the dump file.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Any activity that triggered the alert and is not inherently malicious must be monitored by the security team.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and file.name : (\"lsass*.dmp\", \"dumpert.dmp\", \"Andrew.dmp\", \"SQLDmpr*.mdmp\", \"Coredump.dmp\") and\n\n not (process.executable : (\"?:\\\\Program Files\\\\Microsoft SQL Server\\\\*\\\\Shared\\\\SqlDumper.exe\", \"?:\\\\Windows\\\\System32\\\\dllhost.exe\") and\n file.path : (\"?:\\\\Program Files\\\\Microsoft SQL Server\\\\*\\\\Shared\\\\ErrorDumps\\\\SQLDmpr*.mdmp\",\n \"?:\\\\*\\\\Reporting Services\\\\Logfiles\\\\SQLDmpr*.mdmp\")) and\n\n not (process.executable : \"?:\\\\WINDOWS\\\\system32\\\\WerFault.exe\" and\n file.path : \"?:\\\\Windows\\\\System32\\\\config\\\\systemprofile\\\\AppData\\\\Local\\\\CrashDumps\\\\lsass.exe.*.dmp\")\n", + "references": [ + "https://github.com/outflanknl/Dumpert", + "https://github.com/hoangprod/AndrewSpecial" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f2f46686-6f3c-4724-bd7d-24e31c70f98f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timeline_id": "4d4c0b59-ea83-483f-b8c1-8c360ee53c5c", + "timeline_title": "Comprehensive File Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "f2f46686-6f3c-4724-bd7d-24e31c70f98f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_106.json b/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_106.json new file mode 100644 index 00000000000..6833f7b3fdb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_106.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "WMI Incoming Lateral Movement", + "query": "sequence by host.id with maxspan = 2s\n\n /* Accepted Incoming RPC connection by Winmgmt service */\n\n [network where host.os.type == \"windows\" and process.name : \"svchost.exe\" and network.direction : (\"incoming\", \"ingress\") and\n source.ip != \"127.0.0.1\" and source.ip != \"::1\" and source.port \u003e= 49152 and destination.port \u003e= 49152\n ]\n\n /* Excluding Common FPs Nessus and SCCM */\n\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"WmiPrvSE.exe\" and\n not process.args : (\"C:\\\\windows\\\\temp\\\\nessus_*.txt\",\n \"*C:\\\\windows\\\\TEMP\\\\nessus_*.TMP*\",\n \"*C:\\\\Windows\\\\CCM\\\\SystemTemp\\\\*\",\n \"C:\\\\Windows\\\\CCM\\\\ccmrepair.exe\",\n \"C:\\\\Windows\\\\CCMCache\\\\*\",\n \"C:\\\\CCM\\\\Cache\\\\*\")\n ]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "f3475224-b179-4f78-8877-c2bd64c26b88", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "type": "eql", + "version": 106 + }, + "id": "f3475224-b179-4f78-8877-c2bd64c26b88_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_107.json b/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_107.json new file mode 100644 index 00000000000..9fbfd05d159 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f3475224-b179-4f78-8877-c2bd64c26b88_107.json @@ -0,0 +1,120 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies processes executed via Windows Management Instrumentation (WMI) on a remote host. This could be indicative of adversary lateral movement, but could be noisy if administrators use WMI to remotely manage hosts.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "WMI Incoming Lateral Movement", + "query": "sequence by host.id with maxspan = 2s\n\n /* Accepted Incoming RPC connection by Winmgmt service */\n\n [network where host.os.type == \"windows\" and process.name : \"svchost.exe\" and network.direction : (\"incoming\", \"ingress\") and\n source.ip != \"127.0.0.1\" and source.ip != \"::1\" and source.port \u003e= 49152 and destination.port \u003e= 49152\n ]\n\n /* Excluding Common FPs Nessus and SCCM */\n\n [process where host.os.type == \"windows\" and event.type == \"start\" and process.parent.name : \"WmiPrvSE.exe\" and\n not process.args : (\"C:\\\\windows\\\\temp\\\\nessus_*.txt\",\n \"*C:\\\\windows\\\\TEMP\\\\nessus_*.TMP*\",\n \"*C:\\\\Windows\\\\CCM\\\\SystemTemp\\\\*\",\n \"C:\\\\Windows\\\\CCM\\\\ccmrepair.exe\",\n \"C:\\\\Windows\\\\CCMCache\\\\*\",\n \"C:\\\\CCM\\\\Cache\\\\*\")\n ]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.port", + "type": "long" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.direction", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "source.port", + "type": "long" + } + ], + "risk_score": 47, + "rule_id": "f3475224-b179-4f78-8877-c2bd64c26b88", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "type": "eql", + "version": 107 + }, + "id": "f3475224-b179-4f78-8877-c2bd64c26b88_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f37f3054-d40b-49ac-aa9b-a786c74c58b8_103.json b/packages/security_detection_engine/kibana/security_rule/f37f3054-d40b-49ac-aa9b-a786c74c58b8_103.json new file mode 100644 index 00000000000..f55bc658043 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f37f3054-d40b-49ac-aa9b-a786c74c58b8_103.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the attempted use of a heap-based buffer overflow vulnerability for the Sudo binary in Unix-like systems (CVE-2021-3156). Successful exploitation allows an unprivileged user to escalate to the root user.", + "false_positives": [ + "This rule could generate false positives if the process arguments leveraged by the exploit are shared by custom scripts using the Sudo or Sudoedit binaries. Only Sudo versions 1.8.2 through 1.8.31p2 and 1.9.0 through 1.9.5p1 are affected; if those versions are not present on the endpoint, this could be a false positive." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Sudo Heap-Based Buffer Overflow Attempt", + "query": "event.category:process and event.type:start and\n process.name:(sudo or sudoedit) and\n process.args:(*\\\\ and (\"-i\" or \"-s\"))\n", + "references": [ + "https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-3156", + "https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit", + "https://www.bleepingcomputer.com/news/security/latest-macos-big-sur-also-has-sudo-root-privilege-escalation-flaw", + "https://www.sudo.ws/alerts/unescape_overflow.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f37f3054-d40b-49ac-aa9b-a786c74c58b8", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "threshold": { + "field": [ + "host.hostname" + ], + "value": 100 + }, + "type": "threshold", + "version": 103 + }, + "id": "f37f3054-d40b-49ac-aa9b-a786c74c58b8_103", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_2.json b/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_2.json new file mode 100644 index 00000000000..c9cf6290623 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_2.json @@ -0,0 +1,136 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "packetbeat-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel URL Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel URL Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.\n\n#### Possible investigation steps\n\n- Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:\n - Identify the type of malicious activity related to the URL (phishing, malware, etc.).\n - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. \n - Execute a WHOIS lookup to retrieve information about the domain registration and contacts to report abuse.\n - If dealing with a phishing incident:\n - Contact the user to gain more information around the delivery method, information sent, etc.\n - Analyze whether the URL is trying to impersonate a legitimate address. Look for typosquatting, extra or unusual subdomains, or other anomalies that could lure the user.\n - Investigate the phishing page to identify which information may have been sent to the attacker by the user.\n- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - $osquery_0\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - $osquery_1\n - $osquery_2\n - $osquery_3\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.\n- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Consider reporting the address for abuse using the provided contact information.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "url.full:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "url.full", + "type": "wildcard" + } + ], + "risk_score": 99, + "rule_id": "f3e22c8b-ea47-45d1-b502-b57b6de950b3", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "url.full", + "type": "mapping", + "value": "threat.indicator.url.full" + } + ] + }, + { + "entries": [ + { + "field": "url.original", + "type": "mapping", + "value": "threat.indicator.url.original" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.url.full:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 2 + }, + "id": "f3e22c8b-ea47-45d1-b502-b57b6de950b3_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_3.json b/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_3.json new file mode 100644 index 00000000000..1fafb7fb47f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f3e22c8b-ea47-45d1-b502-b57b6de950b3_3.json @@ -0,0 +1,136 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule is triggered when a URL indicator from the Threat Intel Filebeat module or integrations has a match against an event that contains URL data, like DNS events, network logs, etc.", + "from": "now-65m", + "index": [ + "auditbeat-*", + "endgame-*", + "filebeat-*", + "logs-*", + "packetbeat-*", + "winlogbeat-*" + ], + "interval": "1h", + "language": "kuery", + "license": "Elastic License v2", + "name": "Threat Intel URL Indicator Match", + "note": "## Triage and Analysis\n\n### Investigating Threat Intel URL Indicator Match\n\nThreat Intel indicator match rules allow matching from a local observation, such as an endpoint event that records a file hash with an entry of a file hash stored within the Threat Intel integrations index. \n\nMatches are based on threat intelligence data that's been ingested during the last 30 days. Some integrations don't place expiration dates on their threat indicators, so we strongly recommend validating ingested threat indicators and reviewing match results. When reviewing match results, check associated activity to determine whether the event requires additional investigation.\n\nThis rule is triggered when a URL indicator from the Threat Intel Filebeat module or a threat intelligence integration matches against an event that contains URL data, like DNS events, network logs, etc.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the URL, which can be found in the `threat.indicator.matched.atomic` field:\n - Identify the type of malicious activity related to the URL (phishing, malware, etc.).\n - Check the reputation of the IP address in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc. \n - Execute a WHOIS lookup to retrieve information about the domain registration and contacts to report abuse.\n - If dealing with a phishing incident:\n - Contact the user to gain more information around the delivery method, information sent, etc.\n - Analyze whether the URL is trying to impersonate a legitimate address. Look for typosquatting, extra or unusual subdomains, or other anomalies that could lure the user.\n - Investigate the phishing page to identify which information may have been sent to the attacker by the user.\n- Identify the process responsible for the connection, and investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Retrieve the involved process executable and examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n- Using the data collected through the analysis, scope users targeted and other machines infected in the environment.\n\n### False Positive Analysis\n\n- False positives might occur after large and publicly written campaigns if curious employees interact with attacker infrastructure.\n- Some feeds may include internal or known benign addresses by mistake (e.g., 8.8.8.8, google.com, 127.0.0.1, etc.). Make sure you understand how blocking a specific domain or address might impact the organization or normal system functioning.\n\n### Response and Remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Consider reporting the address for abuse using the provided contact information.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\nThis rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an [Elastic Agent integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#agent-ti-integration), the [Threat Intel module](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#ti-mod-integration), or a [custom integration](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html#custom-ti-integration).\n\nMore information can be found [here](https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html).", + "query": "url.full:*\n", + "references": [ + "https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-threatintel.html", + "https://www.elastic.co/guide/en/security/master/es-threat-intel-integrations.html", + "https://www.elastic.co/security/tip" + ], + "required_fields": [ + { + "ecs": true, + "name": "url.full", + "type": "wildcard" + } + ], + "risk_score": 99, + "rule_id": "f3e22c8b-ea47-45d1-b502-b57b6de950b3", + "setup": "This rule needs threat intelligence indicators to work. Threat intelligence indicators can be collected using an Elastic Agent integration, the Threat Intel module, or a custom integration.\n\nMore information can be found here.", + "severity": "critical", + "tags": [ + "OS: Windows", + "Data Source: Elastic Endgame", + "Rule Type: Indicator Match" + ], + "threat_filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.category", + "negate": false, + "params": { + "query": "threat" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.category": "threat" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.kind", + "negate": false, + "params": { + "query": "enrichment" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "enrichment" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "disabled": false, + "key": "event.type", + "negate": false, + "params": { + "query": "indicator" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.type": "indicator" + } + } + } + ], + "threat_index": [ + "filebeat-*", + "logs-ti_*" + ], + "threat_indicator_path": "threat.indicator", + "threat_language": "kuery", + "threat_mapping": [ + { + "entries": [ + { + "field": "url.full", + "type": "mapping", + "value": "threat.indicator.url.full" + } + ] + }, + { + "entries": [ + { + "field": "url.original", + "type": "mapping", + "value": "threat.indicator.url.original" + } + ] + } + ], + "threat_query": "@timestamp \u003e= \"now-30d/d\" and event.module:(threatintel or ti_*) and threat.indicator.url.full:* and not labels.is_ioc_transform_source:\"true\"", + "timeline_id": "495ad7a7-316e-4544-8a0f-9c098daee76e", + "timeline_title": "Generic Threat Match Timeline", + "type": "threat_match", + "version": 3 + }, + "id": "f3e22c8b-ea47-45d1-b502-b57b6de950b3_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f44fa4b6-524c-4e87-8d9e-a32599e4fb7c_104.json b/packages/security_detection_engine/kibana/security_rule/f44fa4b6-524c-4e87-8d9e-a32599e4fb7c_104.json new file mode 100644 index 00000000000..e3c5fdb6673 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f44fa4b6-524c-4e87-8d9e-a32599e4fb7c_104.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to establish persistence on an endpoint by abusing Microsoft Office add-ins.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistence via Microsoft Office AddIns", + "note": "", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and\n file.extension : (\"wll\",\"xll\",\"ppa\",\"ppam\",\"xla\",\"xlam\") and\n file.path :\n (\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Word\\\\Startup\\\\*\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\AddIns\\\\*\",\n \"C:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\Microsoft\\\\Excel\\\\XLSTART\\\\*\"\n )\n", + "references": [ + "https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1137", + "name": "Office Application Startup", + "reference": "https://attack.mitre.org/techniques/T1137/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "f44fa4b6-524c-4e87-8d9e-a32599e4fb7c_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_1.json b/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_1.json new file mode 100644 index 00000000000..211011aa49c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_1.json @@ -0,0 +1,73 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Data Encryption via OpenSSL Utility", + "query": "sequence by host.id, user.name, process.parent.entity_id with maxspan=5s\n [ process where host.os.type == \"linux\" and event.action == \"exec\" and \n process.name == \"openssl\" and process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"perl*\", \"php*\", \"python*\", \"xargs\") and\n process.args == \"-in\" and process.args == \"-out\" and\n process.args in (\"-k\", \"-K\", \"-kfile\", \"-pass\", \"-iv\", \"-md\") and\n /* excluding base64 encoding options and including encryption password or key params */\n not process.args in (\"-d\", \"-a\", \"-A\", \"-base64\", \"-none\", \"-nosalt\") ] with runs=10\n", + "references": [ + "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/", + "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_2.json b/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_2.json new file mode 100644 index 00000000000..a5c3044a27a --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_2.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies when the openssl command-line utility is used to encrypt multiple files on a host within a short time window. Adversaries may encrypt data on a single or multiple systems in order to disrupt the availability of their target's data and may attempt to hold the organization's data to ransom for the purposes of extortion.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Data Encryption via OpenSSL Utility", + "query": "sequence by host.id, user.name, process.parent.entity_id with maxspan=5s\n [ process where host.os.type == \"linux\" and event.action == \"exec\" and \n process.name == \"openssl\" and process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\", \"perl*\", \"php*\", \"python*\", \"xargs\") and\n process.args == \"-in\" and process.args == \"-out\" and\n process.args in (\"-k\", \"-K\", \"-kfile\", \"-pass\", \"-iv\", \"-md\") and\n /* excluding base64 encoding options and including encryption password or key params */\n not process.args in (\"-d\", \"-a\", \"-A\", \"-base64\", \"-none\", \"-nosalt\") ] with runs=10\n", + "references": [ + "https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/", + "https://www.trendmicro.com/en_us/research/21/f/bash-ransomware-darkradiation-targets-red-hat--and-debian-based-linux-distributions.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Impact", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0040", + "name": "Impact", + "reference": "https://attack.mitre.org/tactics/TA0040/" + }, + "technique": [ + { + "id": "T1486", + "name": "Data Encrypted for Impact", + "reference": "https://attack.mitre.org/techniques/T1486/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "f530ca17-153b-4a7a-8cd3-98dd4b4ddf73_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc_106.json b/packages/security_detection_engine/kibana/security_rule/f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc_106.json new file mode 100644 index 00000000000..9423fc1bf8c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc_106.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Script Executing PowerShell", + "note": "## Triage and analysis\n\n### Investigating Windows Script Executing PowerShell\n\nThe Windows Script Host (WSH) is an Windows automation technology, which is ideal for non-interactive scripting needs, such as logon scripting, administrative scripting, and machine automation.\n\nAttackers commonly use WSH scripts as their initial access method, acting like droppers for second stage payloads, but can also use them to download tools and utilities needed to accomplish their goals.\n\nThis rule looks for the spawn of the `powershell.exe` process with `cscript.exe` or `wscript.exe` as its parent process.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate commands executed by the spawned PowerShell process.\n- If unsigned files are found on the process tree, retrieve them and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Determine how the script file was delivered (email attachment, dropped by other processes, etc.).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n\n### False positive analysis\n\n- The usage of these script engines by regular users is unlikely. In the case of authorized benign true positives (B-TPs), exceptions can be added.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- If the malicious file was delivered via phishing:\n - Block the email sender from sending future emails.\n - Block the malicious web pages.\n - Remove emails from the sender from mailboxes.\n - Consider improvements to the security awareness program.\n- Reimage the host operating system and restore compromised files to clean versions.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : (\"cscript.exe\", \"wscript.exe\") and process.name : \"powershell.exe\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1566", + "name": "Phishing", + "reference": "https://attack.mitre.org/techniques/T1566/", + "subtechnique": [ + { + "id": "T1566.001", + "name": "Spearphishing Attachment", + "reference": "https://attack.mitre.org/techniques/T1566/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f5861570-e39a-4b8a-9259-abd39f84cb97_1.json b/packages/security_detection_engine/kibana/security_rule/f5861570-e39a-4b8a-9259-abd39f84cb97_1.json new file mode 100644 index 00000000000..51f3bda2fd2 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f5861570-e39a-4b8a-9259-abd39f84cb97_1.json @@ -0,0 +1,85 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the access on an object with WRITEDAC permissions. With the WRITEDAC permission, the user can perform a Write Discretionary Access Control List (WriteDACL) operation, which is used to modify the access control rules associated with a specific object within Active Directory. Attackers may abuse this privilege to grant themselves or other compromised accounts additional rights, ultimately compromising the target object, resulting in privilege escalation, lateral movement, and persistence.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-system.*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "WRITEDAC Access on Active Directory Object", + "query": "event.action:\"Directory Service Access\" and event.code:\"5136\" and\n winlog.event_data.AccessMask:\"0x40000\"\n", + "references": [ + "https://www.blackhat.com/docs/us-17/wednesday/us-17-Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors.pdf" + ], + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.code", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.AccessMask", + "type": "unknown" + } + ], + "risk_score": 21, + "rule_id": "f5861570-e39a-4b8a-9259-abd39f84cb97", + "setup": "The 'Audit Directory Service Access' logging policy must be configured for (Success, Failure). Steps to implement the logging policy with Advanced Audit Configuration: ``` Computer Configuration \u003e Policies \u003e Windows Settings \u003e Security Settings \u003e Advanced Audit Policies Configuration \u003e Audit Policies \u003e DS Access \u003e Audit Directory Service Access (Success,Failure) ```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Active Directory", + "Use Case: Active Directory Monitoring", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1222", + "name": "File and Directory Permissions Modification", + "reference": "https://attack.mitre.org/techniques/T1222/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "f5861570-e39a-4b8a-9259-abd39f84cb97_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f59668de-caa0-4b84-94c1-3a1549e1e798_1.json b/packages/security_detection_engine/kibana/security_rule/f59668de-caa0-4b84-94c1-3a1549e1e798_1.json new file mode 100644 index 00000000000..3a2d33a32b3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f59668de-caa0-4b84-94c1-3a1549e1e798_1.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of wmic.exe to run commands on remote hosts. While this can be used by administrators legitimately, attackers can abuse this built-in utility to achieve lateral movement.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "WMIC Remote Command", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : \"WMIC.exe\" and\n process.args : \"*node:*\" and\n process.args : (\"call\", \"set\", \"get\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f59668de-caa0-4b84-94c1-3a1549e1e798", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1047", + "name": "Windows Management Instrumentation", + "reference": "https://attack.mitre.org/techniques/T1047/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "f59668de-caa0-4b84-94c1-3a1549e1e798_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f5fb4598-4f10-11ed-bdc3-0242ac120002_4.json b/packages/security_detection_engine/kibana/security_rule/f5fb4598-4f10-11ed-bdc3-0242ac120002_4.json new file mode 100644 index 00000000000..fcc455b50cc --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f5fb4598-4f10-11ed-bdc3-0242ac120002_4.json @@ -0,0 +1,90 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rules identifies a process created from an executable with a space appended to the end of the filename. This may indicate an attempt to masquerade a malicious file as benign to gain user execution. When a space is added to the end of certain files, the OS will execute the file according to it's true filetype instead of it's extension. Adversaries can hide a program's true filetype by changing the extension of the file. They can then add a space to the end of the name so that the OS automatically executes the file when it's double-clicked.", + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Masquerading Space After Filename", + "note": "", + "query": "process where host.os.type:(\"linux\",\"macos\") and\n event.type == \"start\" and\n (process.executable regex~ \"\"\"/[a-z0-9\\s_\\-\\\\./]+\\s\"\"\") and not\n process.name in (\"ls\", \"find\", \"grep\", \"xkbcomp\")\n", + "references": [ + "https://www.picussecurity.com/resource/blog/picus-10-critical-mitre-attck-techniques-t1036-masquerading" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f5fb4598-4f10-11ed-bdc3-0242ac120002", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/", + "subtechnique": [ + { + "id": "T1036.006", + "name": "Space after Filename", + "reference": "https://attack.mitre.org/techniques/T1036/006/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "f5fb4598-4f10-11ed-bdc3-0242ac120002_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_1.json b/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_1.json new file mode 100644 index 00000000000..17381a95105 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_1.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Account or Group Discovery via Built-In Tools", + "query": "process where event.type== \"start\" and event.action == \"exec\" and\n ( (process.name: (\"groups\",\"id\"))\n or (process.name : \"dscl\" and process.args : (\"/Active Directory/*\", \"/Users*\", \"/Groups*\"))\n or (process.name: \"dscacheutil\" and process.args:(\"user\", \"group\"))\n or process.args:(\"/etc/passwd\", \"/etc/master.passwd\", \"/etc/sudoers\")\n or (process.name: \"getent\" and process.args:(\"passwd\", \"group\"))\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + }, + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_2.json b/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_2.json new file mode 100644 index 00000000000..a9d7aa719a4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_2.json @@ -0,0 +1,109 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Adversaries may use built-in applications to get a listing of local system or domain accounts and groups.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Account or Group Discovery via Built-In Tools", + "query": "process where event.type== \"start\" and event.action == \"exec\" and\n ( (process.name: (\"groups\",\"id\"))\n or (process.name : \"dscl\" and process.args : (\"/Active Directory/*\", \"/Users*\", \"/Groups*\"))\n or (process.name: \"dscacheutil\" and process.args:(\"user\", \"group\"))\n or process.args:(\"/etc/passwd\", \"/etc/master.passwd\", \"/etc/sudoers\")\n or (process.name: \"getent\" and process.args:(\"passwd\", \"group\"))\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1069", + "name": "Permission Groups Discovery", + "reference": "https://attack.mitre.org/techniques/T1069/", + "subtechnique": [ + { + "id": "T1069.001", + "name": "Local Groups", + "reference": "https://attack.mitre.org/techniques/T1069/001/" + }, + { + "id": "T1069.002", + "name": "Domain Groups", + "reference": "https://attack.mitre.org/techniques/T1069/002/" + } + ] + }, + { + "id": "T1087", + "name": "Account Discovery", + "reference": "https://attack.mitre.org/techniques/T1087/", + "subtechnique": [ + { + "id": "T1087.001", + "name": "Local Account", + "reference": "https://attack.mitre.org/techniques/T1087/001/" + }, + { + "id": "T1087.002", + "name": "Domain Account", + "reference": "https://attack.mitre.org/techniques/T1087/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "f638a66d-3bbf-46b1-a52c-ef6f39fb6caf_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f63c8e3c-d396-404f-b2ea-0379d3942d73_106.json b/packages/security_detection_engine/kibana/security_rule/f63c8e3c-d396-404f-b2ea-0379d3942d73_106.json new file mode 100644 index 00000000000..4e22a461952 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f63c8e3c-d396-404f-b2ea-0379d3942d73_106.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Austin Songer" + ], + "description": "Identifies when the Windows Firewall is disabled using PowerShell cmdlets, which can help attackers evade network constraints, like internet and network lateral communication restrictions.", + "false_positives": [ + "Windows Firewall can be disabled by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Windows Profile being disabled by unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Windows Firewall Disabled via PowerShell", + "note": "## Triage and analysis\n\n### Investigating Windows Firewall Disabled via PowerShell\n\nWindows Defender Firewall is a native component that provides host-based, two-way network traffic filtering for a device and blocks unauthorized network traffic flowing into or out of the local device.\n\nAttackers can disable the Windows firewall or its rules to enable lateral movement and command and control activity.\n\nThis rule identifies patterns related to disabling the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Check whether the user is an administrator and is legitimately performing troubleshooting.\n- In case of an allowed benign true positive (B-TP), assess adding rules to allow needed traffic and re-enable the firewall.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Re-enable the firewall with its desired configurations.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Review the privileges assigned to the involved users to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.action == \"start\" and\n (process.name : (\"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or process.pe.original_file_name == \"PowerShell.EXE\") and\n process.args : \"*Set-NetFirewallProfile*\" and\n (process.args : \"*-Enabled*\" and process.args : \"*False*\") and\n (process.args : \"*-All*\" or process.args : (\"*Public*\", \"*Domain*\", \"*Private*\"))\n", + "references": [ + "https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps", + "https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell", + "http://powershellhelp.space/commands/set-netfirewallrule-psv5.php", + "http://woshub.com/manage-windows-firewall-powershell/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f63c8e3c-d396-404f-b2ea-0379d3942d73", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.004", + "name": "Disable or Modify System Firewall", + "reference": "https://attack.mitre.org/techniques/T1562/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "f63c8e3c-d396-404f-b2ea-0379d3942d73_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f675872f-6d85-40a3-b502-c0d2ef101e92_107.json b/packages/security_detection_engine/kibana/security_rule/f675872f-6d85-40a3-b502-c0d2ef101e92_107.json new file mode 100644 index 00000000000..768e27520e1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f675872f-6d85-40a3-b502-c0d2ef101e92_107.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies use of the fsutil.exe to delete the volume USNJRNL. This technique is used by attackers to eliminate evidence of files created during post-exploitation activities.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Delete Volume USN Journal with Fsutil", + "note": "## Triage and analysis\n\n### Investigating Delete Volume USN Journal with Fsutil\n\nThe Update Sequence Number (USN) Journal is a feature in the NTFS file system used by Microsoft Windows operating systems to keep track of changes made to files and directories on a disk volume. The journal records metadata for changes such as file creation, deletion, modification, and permission changes. It is used by the operating system for various purposes, including backup and recovery, file indexing, and file replication.\n\nThis artifact can provide valuable information in forensic analysis, such as programs executed (prefetch file operations), file modification events in suspicious directories, deleted files, etc. Attackers may delete this artifact in an attempt to cover their tracks, and this rule identifies the usage of the `fsutil.exe` utility to accomplish it.\n\nConsider using the Elastic Defend integration instead of USN Journal, as the Elastic Defend integration provides more visibility and context in the file operations it records.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n - Verify if any other anti-forensics behaviors were observed.\n- Review file operation logs from Elastic Defend for suspicious activity the attacker tried to hide.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"fsutil.exe\" or process.pe.original_file_name == \"fsutil.exe\") and\n process.args : \"deletejournal\" and process.args : \"usn\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f675872f-6d85-40a3-b502-c0d2ef101e92", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1070", + "name": "Indicator Removal", + "reference": "https://attack.mitre.org/techniques/T1070/", + "subtechnique": [ + { + "id": "T1070.004", + "name": "File Deletion", + "reference": "https://attack.mitre.org/techniques/T1070/004/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "f675872f-6d85-40a3-b502-c0d2ef101e92_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f683dcdf-a018-4801-b066-193d4ae6c8e5_104.json b/packages/security_detection_engine/kibana/security_rule/f683dcdf-a018-4801-b066-193d4ae6c8e5_104.json new file mode 100644 index 00000000000..43cf455fe8e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f683dcdf-a018-4801-b066-193d4ae6c8e5_104.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies changes to the SoftwareUpdate preferences using the built-in defaults command. Adversaries may abuse this in an attempt to disable security updates.", + "false_positives": [ + "Authorized SoftwareUpdate Settings Changes" + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "SoftwareUpdate Preferences Modification", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.name:defaults and\n process.args:(write and \"-bool\" and (com.apple.SoftwareUpdate or /Library/Preferences/com.apple.SoftwareUpdate.plist) and not (TRUE or true))\n", + "references": [ + "https://blog.checkpoint.com/2017/07/13/osxdok-refuses-go-away-money/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f683dcdf-a018-4801-b066-193d4ae6c8e5", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "f683dcdf-a018-4801-b066-193d4ae6c8e5_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_1.json b/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_1.json new file mode 100644 index 00000000000..1c769a5aa56 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_1.json @@ -0,0 +1,79 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools to read the contents of \\etc\\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Hosts File Access", + "query": "process where event.type == \"start\" and event.action == \"exec\" and\n (process.name:(\"vi\", \"nano\", \"cat\", \"more\", \"less\") and process.args : \"/etc/hosts\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f75f65cf-ed04-48df-a7ff-b02a8bfe636e", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "f75f65cf-ed04-48df-a7ff-b02a8bfe636e_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_2.json b/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_2.json new file mode 100644 index 00000000000..c2bfee2da44 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f75f65cf-ed04-48df-a7ff-b02a8bfe636e_2.json @@ -0,0 +1,80 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of built-in tools to read the contents of \\etc\\hosts on a local machine. Attackers may use this data to discover remote machines in an environment that may be used for Lateral Movement from the current system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "System Hosts File Access", + "query": "process where event.type == \"start\" and event.action == \"exec\" and\n (process.name:(\"vi\", \"nano\", \"cat\", \"more\", \"less\") and process.args : \"/etc/hosts\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f75f65cf-ed04-48df-a7ff-b02a8bfe636e", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Rule Type: BBR", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1018", + "name": "Remote System Discovery", + "reference": "https://attack.mitre.org/techniques/T1018/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 2 + }, + "id": "f75f65cf-ed04-48df-a7ff-b02a8bfe636e_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_107.json b/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_107.json new file mode 100644 index 00000000000..56402e10641 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_107.json @@ -0,0 +1,99 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistent Scripts in the Startup Directory", + "note": "## Triage and analysis\n\n### Investigating Persistent Scripts in the Startup Directory\n\nThe Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.\n\nThis rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and user.domain != \"NT AUTHORITY\" and\n\n /* detect shortcuts created by wscript.exe or cscript.exe */\n (file.path : \"C:\\\\*\\\\Programs\\\\Startup\\\\*.lnk\" and\n process.name : (\"wscript.exe\", \"cscript.exe\")) or\n\n /* detect vbs or js files created by any process */\n file.path : (\"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbs\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbe\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsh\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsf\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.js\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f7c4dc5a-a58d-491d-9f14-9b66507121c0", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "f7c4dc5a-a58d-491d-9f14-9b66507121c0_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_108.json b/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_108.json new file mode 100644 index 00000000000..886aa61c1fb --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f7c4dc5a-a58d-491d-9f14-9b66507121c0_108.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies script engines creating files in the Startup folder, or the creation of script files in the Startup folder. Adversaries may abuse this technique to maintain persistence in an environment.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Persistent Scripts in the Startup Directory", + "note": "## Triage and analysis\n\n### Investigating Persistent Scripts in the Startup Directory\n\nThe Windows Startup folder is a special folder in Windows. Programs added to this folder are executed during account logon, without user interaction, providing an excellent way for attackers to maintain persistence.\n\nThis rule looks for shortcuts created by wscript.exe or cscript.exe, or js/vbs scripts created by any process.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Validate if the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the file using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Related rules\n\n- Suspicious Startup Shell Folder Modification - c8b150f0-0164-475b-a75e-74b47800a9ff\n- Startup Folder Persistence via Unsigned Process - 2fba96c0-ade5-4bce-b92f-a5df2509da3f\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "file where host.os.type == \"windows\" and event.type != \"deletion\" and user.domain != \"NT AUTHORITY\" and\n\n /* detect shortcuts created by wscript.exe or cscript.exe */\n (file.path : \"C:\\\\*\\\\Programs\\\\Startup\\\\*.lnk\" and\n process.name : (\"wscript.exe\", \"cscript.exe\")) or\n\n /* detect vbs or js files created by any process */\n file.path : (\"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbs\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.vbe\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsh\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.wsf\",\n \"C:\\\\*\\\\Programs\\\\Startup\\\\*.js\")\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.domain", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "f7c4dc5a-a58d-491d-9f14-9b66507121c0", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1547", + "name": "Boot or Logon Autostart Execution", + "reference": "https://attack.mitre.org/techniques/T1547/", + "subtechnique": [ + { + "id": "T1547.001", + "name": "Registry Run Keys / Startup Folder", + "reference": "https://attack.mitre.org/techniques/T1547/001/" + }, + { + "id": "T1547.009", + "name": "Shortcut Modification", + "reference": "https://attack.mitre.org/techniques/T1547/009/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 108 + }, + "id": "f7c4dc5a-a58d-491d-9f14-9b66507121c0_108", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f81ee52c-297e-46d9-9205-07e66931df26_104.json b/packages/security_detection_engine/kibana/security_rule/f81ee52c-297e-46d9-9205-07e66931df26_104.json new file mode 100644 index 00000000000..c1c90bbeae0 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f81ee52c-297e-46d9-9205-07e66931df26_104.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies suspicious processes being spawned by the Microsoft Exchange Server worker process (w3wp). This activity may indicate exploitation activity or access to an existing web shell backdoor.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Exchange Worker Spawning Suspicious Processes", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.parent.name : \"w3wp.exe\" and process.parent.args : \"MSExchange*AppPool\" and\n (process.name : (\"cmd.exe\", \"powershell.exe\", \"pwsh.exe\", \"powershell_ise.exe\") or\n process.pe.original_file_name in (\"cmd.exe\", \"powershell.exe\", \"pwsh.dll\", \"powershell_ise.exe\"))\n", + "references": [ + "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers", + "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities", + "https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f81ee52c-297e-46d9-9205-07e66931df26", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Initial Access", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1190", + "name": "Exploit Public-Facing Application", + "reference": "https://attack.mitre.org/techniques/T1190/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 104 + }, + "id": "f81ee52c-297e-46d9-9205-07e66931df26_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f85ce03f-d8a8-4c83-acdc-5c8cd0592be7_104.json b/packages/security_detection_engine/kibana/security_rule/f85ce03f-d8a8-4c83-acdc-5c8cd0592be7_104.json new file mode 100644 index 00000000000..37258546dd4 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f85ce03f-d8a8-4c83-acdc-5c8cd0592be7_104.json @@ -0,0 +1,94 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects attempts to exploit privilege escalation vulnerabilities related to the Adobe Acrobat Reader PrivilegedHelperTool responsible for installing updates. For more information, refer to CVE-2020-9615, CVE-2020-9614 and CVE-2020-9613 and verify that the impacted system is patched.", + "false_positives": [ + "Trusted system or Adobe Acrobat Related processes." + ], + "from": "now-9m", + "index": [ + "auditbeat-*", + "logs-endpoint.events.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Suspicious Child Process of Adobe Acrobat Reader Update Service", + "query": "event.category:process and host.os.type:macos and event.type:(start or process_started) and\n process.parent.name:com.adobe.ARMDC.SMJobBlessHelper and\n user.name:root and\n not process.executable: (/Library/PrivilegedHelperTools/com.adobe.ARMDC.SMJobBlessHelper or\n /usr/bin/codesign or\n /private/var/folders/zz/*/T/download/ARMDCHammer or\n /usr/sbin/pkgutil or\n /usr/bin/shasum or\n /usr/bin/perl* or\n /usr/sbin/spctl or\n /usr/sbin/installer or\n /usr/bin/csrutil)\n", + "references": [ + "https://rekken.github.io/2020/05/14/Security-Flaws-in-Adobe-Acrobat-Reader-Allow-Malicious-Program-to-Gain-Root-on-macOS-Silently/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: macOS", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Use Case: Vulnerability", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1068", + "name": "Exploitation for Privilege Escalation", + "reference": "https://attack.mitre.org/techniques/T1068/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 104 + }, + "id": "f85ce03f-d8a8-4c83-acdc-5c8cd0592be7_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f874315d-5188-4b4a-8521-d1c73093a7e4_106.json b/packages/security_detection_engine/kibana/security_rule/f874315d-5188-4b4a-8521-d1c73093a7e4_106.json new file mode 100644 index 00000000000..7598e264e74 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f874315d-5188-4b4a-8521-d1c73093a7e4_106.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies modifications of the AmsiEnable registry key to 0, which disables the Antimalware Scan Interface (AMSI). An adversary can modify this key to disable AMSI protections.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Modification of AmsiEnable Registry Key", + "note": "## Triage and analysis\n\n### Investigating Modification of AmsiEnable Registry Key\n\nThe Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.\n\nSince AMSI is widely used across security products for increased visibility, attackers can disable it to evade detections that rely on it.\n\nThis rule monitors the modifications to the Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable registry key.\n\n#### Possible investigation steps\n\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the execution of scripts and macros after the registry modification.\n- Retrieve scripts or Microsoft Office files and determine if they are malicious:\n - Use a private sandboxed malware analysis system to perform analysis.\n - Observe and collect information about the following activities:\n - Attempts to contact external domains and addresses.\n - File and registry access, modification, and creation activities.\n - Service creation and launch activities.\n - Scheduled task creation.\n - Use the PowerShell Get-FileHash cmdlet to get the files' SHA-256 hash values.\n - Search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Use process name, command line, and file hash to search for occurrences on other hosts.\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.\n\n### Related rules\n\n- Microsoft Windows Defender Tampering - fe794edd-487f-4a90-b285-3ee54f2af2d3\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Delete or set the key to its default value.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n registry.path : (\n \"HKEY_USERS\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\",\n \"HKU\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\",\n \"\\\\REGISTRY\\\\USER\\\\*\\\\Software\\\\Microsoft\\\\Windows Script\\\\Settings\\\\AmsiEnable\"\n ) and\n registry.data.strings: (\"0\", \"0x00000000\")\n", + "references": [ + "https://hackinparis.com/data/slides/2019/talks/HIP2019-Dominic_Chell-Cracking_The_Perimeter_With_Sharpshooter.pdf", + "https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "f874315d-5188-4b4a-8521-d1c73093a7e4", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "f874315d-5188-4b4a-8521-d1c73093a7e4_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f9590f47-6bd5-4a49-bd49-a2f886476fb9_104.json b/packages/security_detection_engine/kibana/security_rule/f9590f47-6bd5-4a49-bd49-a2f886476fb9_104.json new file mode 100644 index 00000000000..e8165f8cfb7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f9590f47-6bd5-4a49-bd49-a2f886476fb9_104.json @@ -0,0 +1,61 @@ +{ + "attributes": { + "anomaly_threshold": 25, + "author": [ + "Elastic" + ], + "description": "Looks for commands related to system network configuration discovery from an unusual user context. This can be due to uncommon troubleshooting activity or due to a compromised account. A compromised account may be used by a threat actor to engage in system network configuration discovery in order to increase their understanding of connected networks and hosts. This information may be used to shape follow-up behaviors such as lateral movement or additional discovery.", + "false_positives": [ + "Uncommon user command activity can be due to an engineer logging onto a server instance in order to perform manual troubleshooting or reconfiguration." + ], + "from": "now-45m", + "interval": "15m", + "license": "Elastic License v2", + "machine_learning_job_id": [ + "v3_linux_network_configuration_discovery" + ], + "name": "Unusual Linux Network Configuration Discovery", + "related_integrations": [ + { + "package": "auditd_manager", + "version": "^1.0.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "risk_score": 21, + "rule_id": "f9590f47-6bd5-4a49-bd49-a2f886476fb9", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Rule Type: ML", + "Rule Type: Machine Learning", + "Tactic: Discovery" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1016", + "name": "System Network Configuration Discovery", + "reference": "https://attack.mitre.org/techniques/T1016/" + } + ] + } + ], + "type": "machine_learning", + "version": 104 + }, + "id": "f9590f47-6bd5-4a49-bd49-a2f886476fb9_104", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f95972d3-c23b-463b-89a8-796b3f369b49_4.json b/packages/security_detection_engine/kibana/security_rule/f95972d3-c23b-463b-89a8-796b3f369b49_4.json new file mode 100644 index 00000000000..0b9a799d54d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f95972d3-c23b-463b-89a8-796b3f369b49_4.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies downloads of executable and archive files via the Windows Background Intelligent Transfer Service (BITS). Adversaries could leverage Windows BITS transfer jobs to download remote payloads.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Ingress Transfer via Windows BITS", + "query": "file where host.os.type == \"windows\" and event.action == \"rename\" and\n\nprocess.name : \"svchost.exe\" and file.Ext.original.name : \"BIT*.tmp\" and \n (file.extension :(\"exe\", \"zip\", \"rar\", \"bat\", \"dll\", \"ps1\", \"vbs\", \"wsh\", \"js\", \"vbe\", \"pif\", \"scr\", \"cmd\", \"cpl\") or file.Ext.header_bytes : \"4d5a*\") and \n \n /* noisy paths, for hunting purposes you can use the same query without the following exclusions */\n not file.path : (\"?:\\\\Program Files\\\\*\", \"?:\\\\Program Files (x86)\\\\*\", \"?:\\\\Windows\\\\*\", \"?:\\\\ProgramData\\\\*\\\\*\") and \n \n /* lot of third party SW use BITS to download executables with a long file name */\n not length(file.name) \u003e 30\n", + "references": [ + "https://attack.mitre.org/techniques/T1197/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": false, + "name": "file.Ext.header_bytes", + "type": "unknown" + }, + { + "ecs": false, + "name": "file.Ext.original.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f95972d3-c23b-463b-89a8-796b3f369b49", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Tactic: Command and Control", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1105", + "name": "Ingress Tool Transfer", + "reference": "https://attack.mitre.org/techniques/T1105/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1197", + "name": "BITS Jobs", + "reference": "https://attack.mitre.org/techniques/T1197/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 4 + }, + "id": "f95972d3-c23b-463b-89a8-796b3f369b49_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/f97504ac-1053-498f-aeaa-c6d01e76b379_1.json b/packages/security_detection_engine/kibana/security_rule/f97504ac-1053-498f-aeaa-c6d01e76b379_1.json new file mode 100644 index 00000000000..b3531efc5e7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/f97504ac-1053-498f-aeaa-c6d01e76b379_1.json @@ -0,0 +1,74 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the install of browser extensions. Malicious browser extensions can be installed via app store downloads masquerading as legitimate extensions, social engineering, or by an adversary that has already compromised a system.", + "from": "now-119m", + "index": [ + "logs-endpoint.events.*" + ], + "interval": "60m", + "language": "eql", + "license": "Elastic License v2", + "name": "Browser Extension Install", + "query": "file where event.action : \"creation\" and \n(\n /* Firefox-Based Browsers */\n (\n file.name : \"*.xpi\" and\n file.path : \"?:\\\\Users\\\\*\\\\AppData\\\\Roaming\\\\*\\\\Profiles\\\\*\\\\Extensions\\\\*.xpi\"\n ) or\n /* Chromium-Based Browsers */\n (\n file.name : \"*.crx\" and\n file.path : \"?:\\\\Users\\\\*\\\\AppData\\\\Local\\\\*\\\\*\\\\User Data\\\\Webstore Downloads\\\\*\"\n )\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "f97504ac-1053-498f-aeaa-c6d01e76b379", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Defend", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1176", + "name": "Browser Extensions", + "reference": "https://attack.mitre.org/techniques/T1176/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "f97504ac-1053-498f-aeaa-c6d01e76b379_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa01341d-6662-426b-9d0c-6d81e33c8a9d_105.json b/packages/security_detection_engine/kibana/security_rule/fa01341d-6662-426b-9d0c-6d81e33c8a9d_105.json new file mode 100644 index 00000000000..bdde3b1d174 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa01341d-6662-426b-9d0c-6d81e33c8a9d_105.json @@ -0,0 +1,93 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*", + "winlogbeat-*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Remote File Copy to a Hidden Share", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"cmd.exe\", \"powershell.exe\", \"robocopy.exe\", \"xcopy.exe\") and\n process.args : (\"copy*\", \"move*\", \"cp\", \"mv\") and process.args : \"*$*\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fa01341d-6662-426b-9d0c-6d81e33c8a9d", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Lateral Movement", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0008", + "name": "Lateral Movement", + "reference": "https://attack.mitre.org/tactics/TA0008/" + }, + "technique": [ + { + "id": "T1021", + "name": "Remote Services", + "reference": "https://attack.mitre.org/techniques/T1021/", + "subtechnique": [ + { + "id": "T1021.002", + "name": "SMB/Windows Admin Shares", + "reference": "https://attack.mitre.org/techniques/T1021/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "fa01341d-6662-426b-9d0c-6d81e33c8a9d_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa210b61-b627-4e5e-86f4-17e8270656ab_3.json b/packages/security_detection_engine/kibana/security_rule/fa210b61-b627-4e5e-86f4-17e8270656ab_3.json new file mode 100644 index 00000000000..996bca81c4c --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa210b61-b627-4e5e-86f4-17e8270656ab_3.json @@ -0,0 +1,97 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies multiple external consecutive login failures targeting a user account from the same source address within a short time interval. Adversaries will often brute force login attempts across multiple users with a common or known password, in an attempt to gain access to these accounts.", + "from": "now-9m", + "index": [ + "logs-system.auth-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential External Linux SSH Brute Force Detected", + "note": "## Triage and analysis\n\n### Investigating Potential External Linux SSH Brute Force Detected\n\nThe rule identifies consecutive SSH login failures targeting a user account from the same source IP address to the same target host indicating brute force login attempts.\n\nThis rule will generate a lot of noise for systems with a front-facing SSH service, as adversaries scan the internet for remotely accessible SSH services and try to brute force them to gain unauthorized access. \n\nIn case this rule generates too much noise and external brute forcing is of not much interest, consider turning this rule off and enabling \"Potential Internal Linux SSH Brute Force Detected\" to detect internal brute force attempts.\n\n#### Possible investigation steps\n\n- Investigate the login failure user name(s).\n- Investigate the source IP address of the failed ssh login attempt(s).\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Identify the source and the target computer and their roles in the IT environment.\n\n### False positive analysis\n\n- Authentication misconfiguration or obsolete credentials.\n- Service account password expired.\n- Infrastructure or availability issue.\n\n### Related Rules\n\n- Potential Internal Linux SSH Brute Force Detected - 1c27fa22-7727-4dd3-81c0-de6da5555feb\n- Potential SSH Password Guessing - 8cb84371-d053-4f4f-bce0-c74990e28f28\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n\n", + "query": "sequence by host.id, source.ip, user.name with maxspan=5s\n [ authentication where host.os.type == \"linux\" and \n event.action in (\"ssh_login\", \"user_login\") and event.outcome == \"failure\" and\n not cidrmatch(source.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \n \"::1\", \"FE80::/10\", \"FF00::/8\") ] with runs = 10\n", + "related_integrations": [ + { + "package": "system", + "version": "^1.6.4" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.outcome", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "source.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "user.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fa210b61-b627-4e5e-86f4-17e8270656ab", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Credential Access" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1110", + "name": "Brute Force", + "reference": "https://attack.mitre.org/techniques/T1110/", + "subtechnique": [ + { + "id": "T1110.001", + "name": "Password Guessing", + "reference": "https://attack.mitre.org/techniques/T1110/001/" + }, + { + "id": "T1110.003", + "name": "Password Spraying", + "reference": "https://attack.mitre.org/techniques/T1110/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "fa210b61-b627-4e5e-86f4-17e8270656ab_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_1.json b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_1.json new file mode 100644 index 00000000000..958158adb82 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_1.json @@ -0,0 +1,119 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Binary", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and\n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and not\n process.name : (\"curl\", \"wget\", \"ping\", \"apt\", \"dpkg\", \"yum\", \"rpm\", \"dnf\", \"dockerd\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) ]\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_2.json b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_2.json new file mode 100644 index 00000000000..c4e153706c7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_2.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Binary", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and\n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and not\n process.name : (\"curl\", \"wget\", \"ping\", \"apt\", \"dpkg\", \"yum\", \"rpm\", \"dnf\", \"dockerd\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"connection_attempted\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_3.json b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_3.json new file mode 100644 index 00000000000..1e7458022b1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_3.json @@ -0,0 +1,124 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Binary", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and\n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and not\n process.name : (\"curl\", \"wget\", \"ping\", \"apt\", \"dpkg\", \"yum\", \"rpm\", \"dnf\", \"dockerd\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 3 + }, + "id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_4.json b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_4.json new file mode 100644 index 00000000000..cc6399b4216 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa3a59dc-33c3-43bf-80a9-e8437a922c7f_4.json @@ -0,0 +1,125 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This detection rule detects the creation of a shell through a chain consisting of the execution of a suspicious binary (located in a commonly abused location or executed manually) followed by a network event and ending with a shell being spawned. Stageless reverse tcp shells display this behaviour. Attackers may spawn reverse shells to establish persistence onto a target system.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Reverse Shell via Suspicious Binary", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n[ process where host.os.type == \"linux\" and event.type == \"start\" and event.action == \"exec\" and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and\n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and not\n process.name : (\"curl\", \"wget\", \"ping\", \"apt\", \"dpkg\", \"yum\", \"rpm\", \"dnf\", \"dockerd\") ]\n[ network where host.os.type == \"linux\" and event.type == \"start\" and event.action in (\"connection_attempted\", \"connection_accepted\") and\n process.executable : (\n \"./*\", \"/tmp/*\", \"/var/tmp/*\", \"/var/www/*\", \"/dev/shm/*\", \"/etc/init.d/*\", \"/etc/rc*.d/*\",\n \"/etc/crontab\", \"/etc/cron.*\", \"/etc/update-motd.d/*\", \"/usr/lib/update-notifier/*\",\n \"/boot/*\", \"/srv/*\", \"/run/*\", \"/root/*\", \"/etc/rc.local\"\n ) and destination.ip != null and destination.ip != \"127.0.0.1\" and destination.ip != \"::1\" ]\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") and \n process.parent.name : (\"bash\", \"dash\", \"sh\", \"tcsh\", \"csh\", \"zsh\", \"ksh\", \"fish\") ]\n", + "references": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Execution", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.004", + "name": "Unix Shell", + "reference": "https://attack.mitre.org/techniques/T1059/004/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0011", + "name": "Command and Control", + "reference": "https://attack.mitre.org/tactics/TA0011/" + }, + "technique": [ + { + "id": "T1071", + "name": "Application Layer Protocol", + "reference": "https://attack.mitre.org/techniques/T1071/" + } + ] + } + ], + "type": "eql", + "version": 4 + }, + "id": "fa3a59dc-33c3-43bf-80a9-e8437a922c7f_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_5.json b/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_5.json new file mode 100644 index 00000000000..3b0ee407295 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_5.json @@ -0,0 +1,107 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Antimalware Scan Interface DLL", + "note": "## Triage and analysis\n\n### Investigating Suspicious Antimalware Scan Interface DLL\n\nThe Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.\n\nAttackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the process that created the DLL and which account was used.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the execution of scripts and macros after the registry modification.\n- Investigate other processes launched from the directory that the DLL was created.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "file where host.os.type == \"windows\" and event.action != \"deletion\" and file.path != null and\n file.name : (\"amsi.dll\", \"amsi\") and not file.path : (\"?:\\\\Windows\\\\system32\\\\amsi.dll\", \"?:\\\\Windows\\\\Syswow64\\\\amsi.dll\", \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\WinSXS\\\\*\", \"?:\\\\$WINDOWS.~BT\\\\Work\\\\*\\\\*\", \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\*\")\n", + "references": [ + "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "fa488440-04cc-41d7-9279-539387bf2a17", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.001", + "name": "DLL Search Order Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 5 + }, + "id": "fa488440-04cc-41d7-9279-539387bf2a17_5", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_6.json b/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_6.json new file mode 100644 index 00000000000..e52dfb82791 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fa488440-04cc-41d7-9279-539387bf2a17_6.json @@ -0,0 +1,108 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the creation of the Antimalware Scan Interface (AMSI) DLL in an unusual location. This may indicate an attempt to bypass AMSI by loading a rogue AMSI module instead of the legit one.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious Antimalware Scan Interface DLL", + "note": "## Triage and analysis\n\n### Investigating Suspicious Antimalware Scan Interface DLL\n\nThe Windows Antimalware Scan Interface (AMSI) is a versatile interface standard that allows your applications and services to integrate with any antimalware product on a machine. AMSI integrates with multiple Windows components, ranging from User Account Control (UAC) to VBA macros and PowerShell.\n\nAttackers might copy a rogue AMSI DLL to an unusual location to prevent the process from loading the legitimate module, achieving a bypass to execute malicious code.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Identify the process that created the DLL and which account was used.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the execution of scripts and macros after the registry modification.\n- Investigate other processes launched from the directory that the DLL was created.\n- Inspect the host for suspicious or abnormal behavior in the alert timeframe:\n - Observe and collect information about the following activities in the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n\n### False positive analysis\n\n- This modification should not happen legitimately. Any potential benign true positive (B-TP) should be mapped and monitored by the security team as these modifications expose the host to malware infections.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "file where host.os.type == \"windows\" and event.action != \"deletion\" and file.path != null and\n file.name : (\"amsi.dll\", \"amsi\") and not file.path : (\"?:\\\\Windows\\\\system32\\\\amsi.dll\", \"?:\\\\Windows\\\\Syswow64\\\\amsi.dll\", \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\WinSXS\\\\*\", \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\servicing\\\\LCU\\\\*\", \"?:\\\\$WINDOWS.~BT\\\\Work\\\\*\\\\*\", \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\*\")\n", + "references": [ + "https://github.com/S3cur3Th1sSh1t/Amsi-Bypass-Powershell" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + }, + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + } + ], + "risk_score": 73, + "rule_id": "fa488440-04cc-41d7-9279-539387bf2a17", + "severity": "high", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + }, + { + "id": "T1574", + "name": "Hijack Execution Flow", + "reference": "https://attack.mitre.org/techniques/T1574/", + "subtechnique": [ + { + "id": "T1574.001", + "name": "DLL Search Order Hijacking", + "reference": "https://attack.mitre.org/techniques/T1574/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 6 + }, + "id": "fa488440-04cc-41d7-9279-539387bf2a17_6", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fac52c69-2646-4e79-89c0-fd7653461010_1.json b/packages/security_detection_engine/kibana/security_rule/fac52c69-2646-4e79-89c0-fd7653461010_1.json new file mode 100644 index 00000000000..b4318937871 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fac52c69-2646-4e79-89c0-fd7653461010_1.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for potential attempts to disable AppArmor. AppArmor is a Linux security module that enforces fine-grained access control policies to restrict the actions and resources that specific applications and processes can access. Adversaries may disable security tools to avoid possible detection of their tools and activities.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Disabling of AppArmor", + "query": "process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and (\n (process.name == \"systemctl\" and process.args == \"disable\" and process.args == \"apparmor\") or\n (process.name == \"ln\" and process.args : \"/etc/apparmor.d/*\" and process.args : \"/etc/apparmor.d/disable/\")\n)\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fac52c69-2646-4e79-89c0-fd7653461010", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/", + "subtechnique": [ + { + "id": "T1562.001", + "name": "Disable or Modify Tools", + "reference": "https://attack.mitre.org/techniques/T1562/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "fac52c69-2646-4e79-89c0-fd7653461010_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fb01d790-9f74-4e76-97dd-b4b0f7bf6435_1.json b/packages/security_detection_engine/kibana/security_rule/fb01d790-9f74-4e76-97dd-b4b0f7bf6435_1.json new file mode 100644 index 00000000000..af7d8b2dd85 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fb01d790-9f74-4e76-97dd-b4b0f7bf6435_1.json @@ -0,0 +1,88 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies suspicious instances of default system32 DLLs either unsigned or signed with non-MS certificates. This can potentially indicate the attempt to masquerade as system DLLs, perform DLL Search Order Hijacking or backdoor and resign legitimate DLLs.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as System32 DLL", + "query": "library where event.action == \"load\" and\n not (\n dll.path : (\n \"?:\\\\Windows\\\\System32\\\\*\",\n \"?:\\\\Windows\\\\SysWOW64\\\\*\",\n \"?:\\\\Windows\\\\SystemTemp\\\\*\",\n \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\WinSxS\\\\*\",\n \"?:\\\\$WINDOWS.~BT\\\\NewOS\\\\Windows\\\\System32\\\\*\",\n \"?:\\\\Windows\\\\WinSxS\\\\*\",\n \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download\\\\*\",\n \"?:\\\\Windows\\\\assembly\\\\NativeImages_v*\"\n )\n ) and\n not (\n dll.code_signature.subject_name in (\n \"Microsoft Windows\",\n \"Microsoft Corporation\",\n \"Microsoft Windows Hardware Abstraction Layer Publisher\",\n \"Microsoft Windows Publisher\",\n \"Microsoft Windows 3rd party Component\",\n \"Microsoft 3rd Party Application Component\"\n ) and dll.code_signature.trusted == true\n ) and not dll.code_signature.status : (\"errorCode_endpoint*\", \"errorUntrustedRoot\", \"errorChaining\") and\n dll.name : (\n \"aadauthhelper.dll\", \"aadcloudap.dll\", \"aadjcsp.dll\", \"aadtb.dll\", \"aadwamextension.dll\", \"aarsvc.dll\", \"abovelockapphost.dll\", \"accessibilitycpl.dll\", \"accountaccessor.dll\", \"accountsrt.dll\", \"acgenral.dll\", \"aclayers.dll\", \"acledit.dll\", \"aclui.dll\", \"acmigration.dll\", \"acppage.dll\", \"acproxy.dll\", \"acspecfc.dll\", \"actioncenter.dll\", \"actioncentercpl.dll\", \"actionqueue.dll\", \"activationclient.dll\", \"activeds.dll\", \"activesynccsp.dll\", \"actxprxy.dll\", \"acwinrt.dll\", \"acxtrnal.dll\", \"adaptivecards.dll\", \"addressparser.dll\", \"adhapi.dll\", \"adhsvc.dll\", \"admtmpl.dll\", \"adprovider.dll\", \"adrclient.dll\", \"adsldp.dll\", \"adsldpc.dll\", \"adsmsext.dll\", \"adsnt.dll\", \"adtschema.dll\", \"advancedemojids.dll\", \"advapi32.dll\", \"advapi32res.dll\", \"advpack.dll\", \"aeevts.dll\", \"aeinv.dll\", \"aepic.dll\", \"ajrouter.dll\", \"altspace.dll\", \"amsi.dll\", \"amsiproxy.dll\", \"amstream.dll\", \"apds.dll\", \"aphostclient.dll\", \"aphostres.dll\", \"aphostservice.dll\", \"apisampling.dll\", \"apisetschema.dll\", \"apmon.dll\", \"apmonui.dll\", \"appcontracts.dll\", \"appextension.dll\", \"apphelp.dll\", \"apphlpdm.dll\", \"appidapi.dll\", \"appidsvc.dll\", \"appinfo.dll\", \"appinfoext.dll\", \"applicationframe.dll\", \"applockercsp.dll\", \"appmgmts.dll\", \"appmgr.dll\", \"appmon.dll\", \"appointmentapis.dll\", \"appraiser.dll\", \"appreadiness.dll\", \"apprepapi.dll\", \"appresolver.dll\", \"appsruprov.dll\", \"appvcatalog.dll\", \"appvclientps.dll\", \"appvetwclientres.dll\", \"appvintegration.dll\", \"appvmanifest.dll\", \"appvpolicy.dll\", \"appvpublishing.dll\", \"appvreporting.dll\", \"appvscripting.dll\", \"appvsentinel.dll\", \"appvstreamingux.dll\", \"appvstreammap.dll\", \"appvterminator.dll\", \"appxalluserstore.dll\", \"appxpackaging.dll\", \"appxsip.dll\", \"appxsysprep.dll\", \"archiveint.dll\", \"asferror.dll\", \"aspnet_counters.dll\", \"asycfilt.dll\", \"atl.dll\", \"atlthunk.dll\", \"atmlib.dll\", \"audioeng.dll\", \"audiohandlers.dll\", \"audiokse.dll\", \"audioses.dll\", \"audiosrv.dll\", \"auditcse.dll\", \"auditpolcore.dll\", \"auditpolmsg.dll\", \"authbroker.dll\", \"authbrokerui.dll\", \"authentication.dll\", \"authext.dll\", \"authfwcfg.dll\", \"authfwgp.dll\", \"authfwsnapin.dll\", \"authfwwizfwk.dll\", \"authhostproxy.dll\", \"authui.dll\", \"authz.dll\", \"autopilot.dll\", \"autopilotdiag.dll\", \"autoplay.dll\", \"autotimesvc.dll\", \"avicap32.dll\", \"avifil32.dll\", \"avrt.dll\", \"axinstsv.dll\", \"azroles.dll\", \"azroleui.dll\", \"azsqlext.dll\", \"basecsp.dll\", \"basesrv.dll\", \"batmeter.dll\", \"bcastdvrbroker.dll\", \"bcastdvrclient.dll\", \"bcastdvrcommon.dll\", \"bcd.dll\", \"bcdprov.dll\", \"bcdsrv.dll\", \"bcp47langs.dll\", \"bcp47mrm.dll\", \"bcrypt.dll\", \"bcryptprimitives.dll\", \"bdehdcfglib.dll\", \"bderepair.dll\", \"bdesvc.dll\", \"bdesysprep.dll\", \"bdeui.dll\", \"bfe.dll\", \"bi.dll\", \"bidispl.dll\", \"bindfltapi.dll\", \"bingasds.dll\", \"bingfilterds.dll\", \"bingmaps.dll\", \"biocredprov.dll\", \"bisrv.dll\", \"bitlockercsp.dll\", \"bitsigd.dll\", \"bitsperf.dll\", \"bitsproxy.dll\", \"biwinrt.dll\", \"blbevents.dll\", \"blbres.dll\", \"blb_ps.dll\", \"bluetoothapis.dll\", \"bnmanager.dll\", \"bootmenuux.dll\", \"bootstr.dll\", \"bootux.dll\", \"bootvid.dll\", \"bridgeres.dll\", \"brokerlib.dll\", \"browcli.dll\", \"browserbroker.dll\", \"browseui.dll\", \"btagservice.dll\", \"bthavctpsvc.dll\", \"bthavrcp.dll\", \"bthavrcpappsvc.dll\", \"bthci.dll\", \"bthpanapi.dll\", \"bthradiomedia.dll\", \"bthserv.dll\", \"bthtelemetry.dll\", \"btpanui.dll\", \"bwcontexthandler.dll\", \"cabapi.dll\", \"cabinet.dll\", \"cabview.dll\", \"callbuttons.dll\", \"cameracaptureui.dll\", \"capauthz.dll\", \"capiprovider.dll\", \"capisp.dll\", \"captureservice.dll\", \"castingshellext.dll\", \"castlaunch.dll\", \"catsrv.dll\", \"catsrvps.dll\", \"catsrvut.dll\", \"cbdhsvc.dll\", \"cca.dll\", \"cdd.dll\", \"cdosys.dll\", \"cdp.dll\", \"cdprt.dll\", \"cdpsvc.dll\", \"cdpusersvc.dll\", \"cemapi.dll\", \"certca.dll\", \"certcli.dll\", \"certcredprovider.dll\", \"certenc.dll\", \"certenroll.dll\", \"certenrollui.dll\", \"certmgr.dll\", \"certpkicmdlet.dll\", \"certpoleng.dll\", \"certprop.dll\", \"cewmdm.dll\", \"cfgbkend.dll\", \"cfgmgr32.dll\", \"cfgspcellular.dll\", \"cfgsppolicy.dll\", \"cflapi.dll\", \"cfmifs.dll\", \"cfmifsproxy.dll\", \"chakra.dll\", \"chakradiag.dll\", \"chakrathunk.dll\", \"chartv.dll\", \"chatapis.dll\", \"chkwudrv.dll\", \"chsstrokeds.dll\", \"chtbopomofods.dll\", \"chtcangjieds.dll\", \"chthkstrokeds.dll\", \"chtquickds.dll\", \"chxapds.dll\", \"chxdecoder.dll\", \"chxhapds.dll\", \"chxinputrouter.dll\", \"chxranker.dll\", \"ci.dll\", \"cic.dll\", \"cimfs.dll\", \"circoinst.dll\", \"ciwmi.dll\", \"clb.dll\", \"clbcatq.dll\", \"cldapi.dll\", \"cleanpccsp.dll\", \"clfsw32.dll\", \"cliconfg.dll\", \"clipboardserver.dll\", \"clipc.dll\", \"clipsvc.dll\", \"clipwinrt.dll\", \"cloudap.dll\", \"cloudidsvc.dll\", \"clrhost.dll\", \"clusapi.dll\", \"cmcfg32.dll\", \"cmdext.dll\", \"cmdial32.dll\", \"cmgrcspps.dll\", \"cmifw.dll\", \"cmintegrator.dll\", \"cmlua.dll\", \"cmpbk32.dll\", \"cmstplua.dll\", \"cmutil.dll\", \"cngcredui.dll\", \"cngprovider.dll\", \"cnvfat.dll\", \"cofiredm.dll\", \"colbact.dll\", \"colorcnv.dll\", \"colorui.dll\", \"combase.dll\", \"comcat.dll\", \"comctl32.dll\", \"comdlg32.dll\", \"coml2.dll\", \"comppkgsup.dll\", \"compstui.dll\", \"computecore.dll\", \"computenetwork.dll\", \"computestorage.dll\", \"comrepl.dll\", \"comres.dll\", \"comsnap.dll\", \"comsvcs.dll\", \"comuid.dll\", \"configmanager2.dll\", \"conhostv1.dll\", \"connect.dll\", \"consentux.dll\", \"consentuxclient.dll\", \"console.dll\", \"consolelogon.dll\", \"contactapis.dll\", \"container.dll\", \"coredpus.dll\", \"coreglobconfig.dll\", \"coremas.dll\", \"coremessaging.dll\", \"coremmres.dll\", \"coreshell.dll\", \"coreshellapi.dll\", \"coreuicomponents.dll\", \"correngine.dll\", \"courtesyengine.dll\", \"cpfilters.dll\", \"creddialogbroker.dll\", \"credprovhelper.dll\", \"credprovhost.dll\", \"credprovs.dll\", \"credprovslegacy.dll\", \"credssp.dll\", \"credui.dll\", \"crypt32.dll\", \"cryptbase.dll\", \"cryptcatsvc.dll\", \"cryptdlg.dll\", \"cryptdll.dll\", \"cryptext.dll\", \"cryptnet.dll\", \"cryptngc.dll\", \"cryptowinrt.dll\", \"cryptsp.dll\", \"cryptsvc.dll\", \"crypttpmeksvc.dll\", \"cryptui.dll\", \"cryptuiwizard.dll\", \"cryptxml.dll\", \"cscapi.dll\", \"cscdll.dll\", \"cscmig.dll\", \"cscobj.dll\", \"cscsvc.dll\", \"cscui.dll\", \"csplte.dll\", \"cspproxy.dll\", \"csrsrv.dll\", \"cxcredprov.dll\", \"c_g18030.dll\", \"c_gsm7.dll\", \"c_is2022.dll\", \"c_iscii.dll\", \"d2d1.dll\", \"d3d10.dll\", \"d3d10core.dll\", \"d3d10level9.dll\", \"d3d10warp.dll\", \"d3d10_1.dll\", \"d3d10_1core.dll\", \"d3d11.dll\", \"d3d11on12.dll\", \"d3d12.dll\", \"d3d12core.dll\", \"d3d8thk.dll\", \"d3d9.dll\", \"d3d9on12.dll\", \"d3dscache.dll\", \"dab.dll\", \"dabapi.dll\", \"daconn.dll\", \"dafbth.dll\", \"dafdnssd.dll\", \"dafescl.dll\", \"dafgip.dll\", \"dafiot.dll\", \"dafipp.dll\", \"dafmcp.dll\", \"dafpos.dll\", \"dafprintprovider.dll\", \"dafupnp.dll\", \"dafwcn.dll\", \"dafwfdprovider.dll\", \"dafwiprov.dll\", \"dafwsd.dll\", \"damediamanager.dll\", \"damm.dll\", \"das.dll\", \"dataclen.dll\", \"datusage.dll\", \"davclnt.dll\", \"davhlpr.dll\", \"davsyncprovider.dll\", \"daxexec.dll\", \"dbgcore.dll\", \"dbgeng.dll\", \"dbghelp.dll\", \"dbgmodel.dll\", \"dbnetlib.dll\", \"dbnmpntw.dll\", \"dciman32.dll\", \"dcntel.dll\", \"dcomp.dll\", \"ddaclsys.dll\", \"ddcclaimsapi.dll\", \"ddds.dll\", \"ddisplay.dll\", \"ddoiproxy.dll\", \"ddores.dll\", \"ddpchunk.dll\", \"ddptrace.dll\", \"ddputils.dll\", \"ddp_ps.dll\", \"ddraw.dll\", \"ddrawex.dll\", \"defragproxy.dll\", \"defragres.dll\", \"defragsvc.dll\", \"deploymentcsps.dll\", \"deskadp.dll\", \"deskmon.dll\", \"desktopshellext.dll\", \"devenum.dll\", \"deviceaccess.dll\", \"devicecenter.dll\", \"devicecredential.dll\", \"devicepairing.dll\", \"deviceuxres.dll\", \"devinv.dll\", \"devmgr.dll\", \"devobj.dll\", \"devpropmgr.dll\", \"devquerybroker.dll\", \"devrtl.dll\", \"dfdts.dll\", \"dfscli.dll\", \"dfshim.dll\", \"dfsshlex.dll\", \"dggpext.dll\", \"dhcpcmonitor.dll\", \"dhcpcore.dll\", \"dhcpcore6.dll\", \"dhcpcsvc.dll\", \"dhcpcsvc6.dll\", \"dhcpsapi.dll\", \"diagcpl.dll\", \"diagnosticlogcsp.dll\", \"diagperf.dll\", \"diagsvc.dll\", \"diagtrack.dll\", \"dialclient.dll\", \"dialserver.dll\", \"dictationmanager.dll\", \"difxapi.dll\", \"dimsjob.dll\", \"dimsroam.dll\", \"dinput.dll\", \"dinput8.dll\", \"direct2ddesktop.dll\", \"directml.dll\", \"discan.dll\", \"dismapi.dll\", \"dispbroker.dll\", \"dispex.dll\", \"display.dll\", \"displaymanager.dll\", \"dlnashext.dll\", \"dmappsres.dll\", \"dmcfgutils.dll\", \"dmcmnutils.dll\", \"dmcsps.dll\", \"dmdlgs.dll\", \"dmdskmgr.dll\", \"dmdskres.dll\", \"dmdskres2.dll\", \"dmenrollengine.dll\", \"dmintf.dll\", \"dmiso8601utils.dll\", \"dmloader.dll\", \"dmocx.dll\", \"dmoleaututils.dll\", \"dmpushproxy.dll\", \"dmpushroutercore.dll\", \"dmrcdecoder.dll\", \"dmrserver.dll\", \"dmsynth.dll\", \"dmusic.dll\", \"dmutil.dll\", \"dmvdsitf.dll\", \"dmwappushsvc.dll\", \"dmwmicsp.dll\", \"dmxmlhelputils.dll\", \"dnsapi.dll\", \"dnscmmc.dll\", \"dnsext.dll\", \"dnshc.dll\", \"dnsrslvr.dll\", \"docprop.dll\", \"dolbydecmft.dll\", \"domgmt.dll\", \"dosettings.dll\", \"dosvc.dll\", \"dot3api.dll\", \"dot3cfg.dll\", \"dot3conn.dll\", \"dot3dlg.dll\", \"dot3gpclnt.dll\", \"dot3gpui.dll\", \"dot3hc.dll\", \"dot3mm.dll\", \"dot3msm.dll\", \"dot3svc.dll\", \"dot3ui.dll\", \"dpapi.dll\", \"dpapiprovider.dll\", \"dpapisrv.dll\", \"dpnaddr.dll\", \"dpnathlp.dll\", \"dpnet.dll\", \"dpnhpast.dll\", \"dpnhupnp.dll\", \"dpnlobby.dll\", \"dps.dll\", \"dpx.dll\", \"drprov.dll\", \"drt.dll\", \"drtprov.dll\", \"drttransport.dll\", \"drvsetup.dll\", \"drvstore.dll\", \"dsauth.dll\", \"dsccore.dll\", \"dsccoreconfprov.dll\", \"dsclient.dll\", \"dscproxy.dll\", \"dsctimer.dll\", \"dsdmo.dll\", \"dskquota.dll\", \"dskquoui.dll\", \"dsound.dll\", \"dsparse.dll\", \"dsprop.dll\", \"dsquery.dll\", \"dsreg.dll\", \"dsregtask.dll\", \"dsrole.dll\", \"dssec.dll\", \"dssenh.dll\", \"dssvc.dll\", \"dsui.dll\", \"dsuiext.dll\", \"dswave.dll\", \"dtsh.dll\", \"ducsps.dll\", \"dui70.dll\", \"duser.dll\", \"dusmapi.dll\", \"dusmsvc.dll\", \"dwmapi.dll\", \"dwmcore.dll\", \"dwmghost.dll\", \"dwminit.dll\", \"dwmredir.dll\", \"dwmscene.dll\", \"dwrite.dll\", \"dxcore.dll\", \"dxdiagn.dll\", \"dxgi.dll\", \"dxgwdi.dll\", \"dxilconv.dll\", \"dxmasf.dll\", \"dxp.dll\", \"dxpps.dll\", \"dxptasksync.dll\", \"dxtmsft.dll\", \"dxtrans.dll\", \"dxva2.dll\", \"dynamoapi.dll\", \"eapp3hst.dll\", \"eappcfg.dll\", \"eappcfgui.dll\", \"eappgnui.dll\", \"eapphost.dll\", \"eappprxy.dll\", \"eapprovp.dll\", \"eapputil.dll\", \"eapsimextdesktop.dll\", \"eapsvc.dll\", \"eapteapauth.dll\", \"eapteapconfig.dll\", \"eapteapext.dll\", \"easconsent.dll\", \"easwrt.dll\", \"edgeangle.dll\", \"edgecontent.dll\", \"edgehtml.dll\", \"edgeiso.dll\", \"edgemanager.dll\", \"edpauditapi.dll\", \"edpcsp.dll\", \"edptask.dll\", \"edputil.dll\", \"eeprov.dll\", \"eeutil.dll\", \"efsadu.dll\", \"efscore.dll\", \"efsext.dll\", \"efslsaext.dll\", \"efssvc.dll\", \"efsutil.dll\", \"efswrt.dll\", \"ehstorapi.dll\", \"ehstorpwdmgr.dll\", \"ehstorshell.dll\", \"els.dll\", \"elscore.dll\", \"elshyph.dll\", \"elslad.dll\", \"elstrans.dll\", \"emailapis.dll\", \"embeddedmodesvc.dll\", \"emojids.dll\", \"encapi.dll\", \"energy.dll\", \"energyprov.dll\", \"energytask.dll\", \"enrollmentapi.dll\", \"enterpriseapncsp.dll\", \"enterprisecsps.dll\", \"enterpriseetw.dll\", \"eqossnap.dll\", \"errordetails.dll\", \"errordetailscore.dll\", \"es.dll\", \"esclprotocol.dll\", \"esclscan.dll\", \"esclwiadriver.dll\", \"esdsip.dll\", \"esent.dll\", \"esentprf.dll\", \"esevss.dll\", \"eshims.dll\", \"etwrundown.dll\", \"euiccscsp.dll\", \"eventaggregation.dll\", \"eventcls.dll\", \"evr.dll\", \"execmodelclient.dll\", \"execmodelproxy.dll\", \"explorerframe.dll\", \"exsmime.dll\", \"extrasxmlparser.dll\", \"f3ahvoas.dll\", \"facilitator.dll\", \"familysafetyext.dll\", \"faultrep.dll\", \"fcon.dll\", \"fdbth.dll\", \"fdbthproxy.dll\", \"fddevquery.dll\", \"fde.dll\", \"fdeploy.dll\", \"fdphost.dll\", \"fdpnp.dll\", \"fdprint.dll\", \"fdproxy.dll\", \"fdrespub.dll\", \"fdssdp.dll\", \"fdwcn.dll\", \"fdwnet.dll\", \"fdwsd.dll\", \"feclient.dll\", \"ffbroker.dll\", \"fhcat.dll\", \"fhcfg.dll\", \"fhcleanup.dll\", \"fhcpl.dll\", \"fhengine.dll\", \"fhevents.dll\", \"fhshl.dll\", \"fhsrchapi.dll\", \"fhsrchph.dll\", \"fhsvc.dll\", \"fhsvcctl.dll\", \"fhtask.dll\", \"fhuxadapter.dll\", \"fhuxapi.dll\", \"fhuxcommon.dll\", \"fhuxgraphics.dll\", \"fhuxpresentation.dll\", \"fidocredprov.dll\", \"filemgmt.dll\", \"filterds.dll\", \"findnetprinters.dll\", \"firewallapi.dll\", \"flightsettings.dll\", \"fltlib.dll\", \"fluencyds.dll\", \"fmapi.dll\", \"fmifs.dll\", \"fms.dll\", \"fntcache.dll\", \"fontext.dll\", \"fontprovider.dll\", \"fontsub.dll\", \"fphc.dll\", \"framedyn.dll\", \"framedynos.dll\", \"frameserver.dll\", \"frprov.dll\", \"fsutilext.dll\", \"fthsvc.dll\", \"fundisc.dll\", \"fveapi.dll\", \"fveapibase.dll\", \"fvecerts.dll\", \"fvecpl.dll\", \"fveskybackup.dll\", \"fveui.dll\", \"fvewiz.dll\", \"fwbase.dll\", \"fwcfg.dll\", \"fwmdmcsp.dll\", \"fwpolicyiomgr.dll\", \"fwpuclnt.dll\", \"fwremotesvr.dll\", \"gameinput.dll\", \"gamemode.dll\", \"gamestreamingext.dll\", \"gameux.dll\", \"gamingtcui.dll\", \"gcdef.dll\", \"gdi32.dll\", \"gdi32full.dll\", \"gdiplus.dll\", \"generaltel.dll\", \"geocommon.dll\", \"geolocation.dll\", \"getuname.dll\", \"glmf32.dll\", \"globinputhost.dll\", \"glu32.dll\", \"gmsaclient.dll\", \"gpapi.dll\", \"gpcsewrappercsp.dll\", \"gpedit.dll\", \"gpprefcl.dll\", \"gpprnext.dll\", \"gpscript.dll\", \"gpsvc.dll\", \"gptext.dll\", \"graphicscapture.dll\", \"graphicsperfsvc.dll\", \"groupinghc.dll\", \"hal.dll\", \"halextpl080.dll\", \"hascsp.dll\", \"hashtagds.dll\", \"hbaapi.dll\", \"hcproviders.dll\", \"hdcphandler.dll\", \"heatcore.dll\", \"helppaneproxy.dll\", \"hgcpl.dll\", \"hhsetup.dll\", \"hid.dll\", \"hidcfu.dll\", \"hidserv.dll\", \"hlink.dll\", \"hmkd.dll\", \"hnetcfg.dll\", \"hnetcfgclient.dll\", \"hnetmon.dll\", \"hologramworld.dll\", \"holoshellruntime.dll\", \"holoshextensions.dll\", \"hotplug.dll\", \"hrtfapo.dll\", \"httpapi.dll\", \"httpprxc.dll\", \"httpprxm.dll\", \"httpprxp.dll\", \"httpsdatasource.dll\", \"htui.dll\", \"hvhostsvc.dll\", \"hvloader.dll\", \"hvsigpext.dll\", \"hvsocket.dll\", \"hydrogen.dll\", \"ia2comproxy.dll\", \"ias.dll\", \"iasacct.dll\", \"iasads.dll\", \"iasdatastore.dll\", \"iashlpr.dll\", \"iasmigplugin.dll\", \"iasnap.dll\", \"iaspolcy.dll\", \"iasrad.dll\", \"iasrecst.dll\", \"iassam.dll\", \"iassdo.dll\", \"iassvcs.dll\", \"icfupgd.dll\", \"icm32.dll\", \"icmp.dll\", \"icmui.dll\", \"iconcodecservice.dll\", \"icsigd.dll\", \"icsvc.dll\", \"icsvcext.dll\", \"icu.dll\", \"icuin.dll\", \"icuuc.dll\", \"idctrls.dll\", \"idlisten.dll\", \"idndl.dll\", \"idstore.dll\", \"ieadvpack.dll\", \"ieapfltr.dll\", \"iedkcs32.dll\", \"ieframe.dll\", \"iemigplugin.dll\", \"iepeers.dll\", \"ieproxy.dll\", \"iernonce.dll\", \"iertutil.dll\", \"iesetup.dll\", \"iesysprep.dll\", \"ieui.dll\", \"ifmon.dll\", \"ifsutil.dll\", \"ifsutilx.dll\", \"igddiag.dll\", \"ihds.dll\", \"ikeext.dll\", \"imagehlp.dll\", \"imageres.dll\", \"imagesp1.dll\", \"imapi.dll\", \"imapi2.dll\", \"imapi2fs.dll\", \"imgutil.dll\", \"imm32.dll\", \"implatsetup.dll\", \"indexeddblegacy.dll\", \"inetcomm.dll\", \"inetmib1.dll\", \"inetpp.dll\", \"inetppui.dll\", \"inetres.dll\", \"inked.dll\", \"inkobjcore.dll\", \"inproclogger.dll\", \"input.dll\", \"inputcloudstore.dll\", \"inputcontroller.dll\", \"inputhost.dll\", \"inputservice.dll\", \"inputswitch.dll\", \"inseng.dll\", \"installservice.dll\", \"internetmail.dll\", \"internetmailcsp.dll\", \"invagent.dll\", \"iologmsg.dll\", \"iphlpapi.dll\", \"iphlpsvc.dll\", \"ipnathlp.dll\", \"ipnathlpclient.dll\", \"ippcommon.dll\", \"ippcommonproxy.dll\", \"iprtprio.dll\", \"iprtrmgr.dll\", \"ipsecsnp.dll\", \"ipsecsvc.dll\", \"ipsmsnap.dll\", \"ipxlatcfg.dll\", \"iri.dll\", \"iscsicpl.dll\", \"iscsidsc.dll\", \"iscsied.dll\", \"iscsiexe.dll\", \"iscsilog.dll\", \"iscsium.dll\", \"iscsiwmi.dll\", \"iscsiwmiv2.dll\", \"ism.dll\", \"itircl.dll\", \"itss.dll\", \"iuilp.dll\", \"iumbase.dll\", \"iumcrypt.dll\", \"iumdll.dll\", \"iumsdk.dll\", \"iyuv_32.dll\", \"joinproviderol.dll\", \"joinutil.dll\", \"jpmapcontrol.dll\", \"jpndecoder.dll\", \"jpninputrouter.dll\", \"jpnranker.dll\", \"jpnserviceds.dll\", \"jscript.dll\", \"jscript9.dll\", \"jscript9diag.dll\", \"jsproxy.dll\", \"kbd101.dll\", \"kbd101a.dll\", \"kbd101b.dll\", \"kbd101c.dll\", \"kbd103.dll\", \"kbd106.dll\", \"kbd106n.dll\", \"kbda1.dll\", \"kbda2.dll\", \"kbda3.dll\", \"kbdadlm.dll\", \"kbdal.dll\", \"kbdarme.dll\", \"kbdarmph.dll\", \"kbdarmty.dll\", \"kbdarmw.dll\", \"kbdax2.dll\", \"kbdaze.dll\", \"kbdazel.dll\", \"kbdazst.dll\", \"kbdbash.dll\", \"kbdbe.dll\", \"kbdbene.dll\", \"kbdbgph.dll\", \"kbdbgph1.dll\", \"kbdbhc.dll\", \"kbdblr.dll\", \"kbdbr.dll\", \"kbdbu.dll\", \"kbdbug.dll\", \"kbdbulg.dll\", \"kbdca.dll\", \"kbdcan.dll\", \"kbdcher.dll\", \"kbdcherp.dll\", \"kbdcr.dll\", \"kbdcz.dll\", \"kbdcz1.dll\", \"kbdcz2.dll\", \"kbdda.dll\", \"kbddiv1.dll\", \"kbddiv2.dll\", \"kbddv.dll\", \"kbddzo.dll\", \"kbdes.dll\", \"kbdest.dll\", \"kbdfa.dll\", \"kbdfar.dll\", \"kbdfc.dll\", \"kbdfi.dll\", \"kbdfi1.dll\", \"kbdfo.dll\", \"kbdfr.dll\", \"kbdfthrk.dll\", \"kbdgae.dll\", \"kbdgeo.dll\", \"kbdgeoer.dll\", \"kbdgeome.dll\", \"kbdgeooa.dll\", \"kbdgeoqw.dll\", \"kbdgkl.dll\", \"kbdgn.dll\", \"kbdgr.dll\", \"kbdgr1.dll\", \"kbdgrlnd.dll\", \"kbdgthc.dll\", \"kbdhau.dll\", \"kbdhaw.dll\", \"kbdhe.dll\", \"kbdhe220.dll\", \"kbdhe319.dll\", \"kbdheb.dll\", \"kbdhebl3.dll\", \"kbdhela2.dll\", \"kbdhela3.dll\", \"kbdhept.dll\", \"kbdhu.dll\", \"kbdhu1.dll\", \"kbdibm02.dll\", \"kbdibo.dll\", \"kbdic.dll\", \"kbdinasa.dll\", \"kbdinbe1.dll\", \"kbdinbe2.dll\", \"kbdinben.dll\", \"kbdindev.dll\", \"kbdinen.dll\", \"kbdinguj.dll\", \"kbdinhin.dll\", \"kbdinkan.dll\", \"kbdinmal.dll\", \"kbdinmar.dll\", \"kbdinori.dll\", \"kbdinpun.dll\", \"kbdintam.dll\", \"kbdintel.dll\", \"kbdinuk2.dll\", \"kbdir.dll\", \"kbdit.dll\", \"kbdit142.dll\", \"kbdiulat.dll\", \"kbdjav.dll\", \"kbdjpn.dll\", \"kbdkaz.dll\", \"kbdkhmr.dll\", \"kbdkni.dll\", \"kbdkor.dll\", \"kbdkurd.dll\", \"kbdkyr.dll\", \"kbdla.dll\", \"kbdlao.dll\", \"kbdlisub.dll\", \"kbdlisus.dll\", \"kbdlk41a.dll\", \"kbdlt.dll\", \"kbdlt1.dll\", \"kbdlt2.dll\", \"kbdlv.dll\", \"kbdlv1.dll\", \"kbdlvst.dll\", \"kbdmac.dll\", \"kbdmacst.dll\", \"kbdmaori.dll\", \"kbdmlt47.dll\", \"kbdmlt48.dll\", \"kbdmon.dll\", \"kbdmonmo.dll\", \"kbdmonst.dll\", \"kbdmyan.dll\", \"kbdne.dll\", \"kbdnec.dll\", \"kbdnec95.dll\", \"kbdnecat.dll\", \"kbdnecnt.dll\", \"kbdnepr.dll\", \"kbdnko.dll\", \"kbdno.dll\", \"kbdno1.dll\", \"kbdnso.dll\", \"kbdntl.dll\", \"kbdogham.dll\", \"kbdolch.dll\", \"kbdoldit.dll\", \"kbdosa.dll\", \"kbdosm.dll\", \"kbdpash.dll\", \"kbdphags.dll\", \"kbdpl.dll\", \"kbdpl1.dll\", \"kbdpo.dll\", \"kbdro.dll\", \"kbdropr.dll\", \"kbdrost.dll\", \"kbdru.dll\", \"kbdru1.dll\", \"kbdrum.dll\", \"kbdsf.dll\", \"kbdsg.dll\", \"kbdsl.dll\", \"kbdsl1.dll\", \"kbdsmsfi.dll\", \"kbdsmsno.dll\", \"kbdsn1.dll\", \"kbdsora.dll\", \"kbdsorex.dll\", \"kbdsors1.dll\", \"kbdsorst.dll\", \"kbdsp.dll\", \"kbdsw.dll\", \"kbdsw09.dll\", \"kbdsyr1.dll\", \"kbdsyr2.dll\", \"kbdtaile.dll\", \"kbdtajik.dll\", \"kbdtam99.dll\", \"kbdtat.dll\", \"kbdth0.dll\", \"kbdth1.dll\", \"kbdth2.dll\", \"kbdth3.dll\", \"kbdtifi.dll\", \"kbdtifi2.dll\", \"kbdtiprc.dll\", \"kbdtiprd.dll\", \"kbdtt102.dll\", \"kbdtuf.dll\", \"kbdtuq.dll\", \"kbdturme.dll\", \"kbdtzm.dll\", \"kbdughr.dll\", \"kbdughr1.dll\", \"kbduk.dll\", \"kbdukx.dll\", \"kbdur.dll\", \"kbdur1.dll\", \"kbdurdu.dll\", \"kbdus.dll\", \"kbdusa.dll\", \"kbdusl.dll\", \"kbdusr.dll\", \"kbdusx.dll\", \"kbduzb.dll\", \"kbdvntc.dll\", \"kbdwol.dll\", \"kbdyak.dll\", \"kbdyba.dll\", \"kbdycc.dll\", \"kbdycl.dll\", \"kd.dll\", \"kdcom.dll\", \"kdcpw.dll\", \"kdhvcom.dll\", \"kdnet.dll\", \"kdnet_uart16550.dll\", \"kdscli.dll\", \"kdstub.dll\", \"kdusb.dll\", \"kd_02_10df.dll\", \"kd_02_10ec.dll\", \"kd_02_1137.dll\", \"kd_02_14e4.dll\", \"kd_02_15b3.dll\", \"kd_02_1969.dll\", \"kd_02_19a2.dll\", \"kd_02_1af4.dll\", \"kd_02_8086.dll\", \"kd_07_1415.dll\", \"kd_0c_8086.dll\", \"kerbclientshared.dll\", \"kerberos.dll\", \"kernel32.dll\", \"kernelbase.dll\", \"keycredmgr.dll\", \"keyiso.dll\", \"keymgr.dll\", \"knobscore.dll\", \"knobscsp.dll\", \"ksuser.dll\", \"ktmw32.dll\", \"l2gpstore.dll\", \"l2nacp.dll\", \"l2sechc.dll\", \"laprxy.dll\", \"legacynetux.dll\", \"lfsvc.dll\", \"libcrypto.dll\", \"licensemanager.dll\", \"licensingcsp.dll\", \"licensingdiagspp.dll\", \"licensingwinrt.dll\", \"licmgr10.dll\", \"linkinfo.dll\", \"lltdapi.dll\", \"lltdres.dll\", \"lltdsvc.dll\", \"lmhsvc.dll\", \"loadperf.dll\", \"localsec.dll\", \"localspl.dll\", \"localui.dll\", \"locationapi.dll\", \"lockappbroker.dll\", \"lockcontroller.dll\", \"lockscreendata.dll\", \"loghours.dll\", \"logoncli.dll\", \"logoncontroller.dll\", \"lpasvc.dll\", \"lpk.dll\", \"lsasrv.dll\", \"lscshostpolicy.dll\", \"lsm.dll\", \"lsmproxy.dll\", \"lstelemetry.dll\", \"luainstall.dll\", \"luiapi.dll\", \"lz32.dll\", \"magnification.dll\", \"maintenanceui.dll\", \"manageci.dll\", \"mapconfiguration.dll\", \"mapcontrolcore.dll\", \"mapgeocoder.dll\", \"mapi32.dll\", \"mapistub.dll\", \"maprouter.dll\", \"mapsbtsvc.dll\", \"mapsbtsvcproxy.dll\", \"mapscsp.dll\", \"mapsstore.dll\", \"mapstoasttask.dll\", \"mapsupdatetask.dll\", \"mbaeapi.dll\", \"mbaeapipublic.dll\", \"mbaexmlparser.dll\", \"mbmediamanager.dll\", \"mbsmsapi.dll\", \"mbussdapi.dll\", \"mccsengineshared.dll\", \"mccspal.dll\", \"mciavi32.dll\", \"mcicda.dll\", \"mciqtz32.dll\", \"mciseq.dll\", \"mciwave.dll\", \"mcrecvsrc.dll\", \"mdmcommon.dll\", \"mdmdiagnostics.dll\", \"mdminst.dll\", \"mdmmigrator.dll\", \"mdmregistration.dll\", \"memorydiagnostic.dll\", \"messagingservice.dll\", \"mf.dll\", \"mf3216.dll\", \"mfaacenc.dll\", \"mfasfsrcsnk.dll\", \"mfaudiocnv.dll\", \"mfc42.dll\", \"mfc42u.dll\", \"mfcaptureengine.dll\", \"mfcore.dll\", \"mfcsubs.dll\", \"mfds.dll\", \"mfdvdec.dll\", \"mferror.dll\", \"mfh263enc.dll\", \"mfh264enc.dll\", \"mfksproxy.dll\", \"mfmediaengine.dll\", \"mfmjpegdec.dll\", \"mfmkvsrcsnk.dll\", \"mfmp4srcsnk.dll\", \"mfmpeg2srcsnk.dll\", \"mfnetcore.dll\", \"mfnetsrc.dll\", \"mfperfhelper.dll\", \"mfplat.dll\", \"mfplay.dll\", \"mfps.dll\", \"mfreadwrite.dll\", \"mfsensorgroup.dll\", \"mfsrcsnk.dll\", \"mfsvr.dll\", \"mftranscode.dll\", \"mfvdsp.dll\", \"mfvfw.dll\", \"mfwmaaec.dll\", \"mgmtapi.dll\", \"mi.dll\", \"mibincodec.dll\", \"midimap.dll\", \"migisol.dll\", \"miguiresource.dll\", \"mimefilt.dll\", \"mimofcodec.dll\", \"minstoreevents.dll\", \"miracastinputmgr.dll\", \"miracastreceiver.dll\", \"mirrordrvcompat.dll\", \"mispace.dll\", \"mitigationclient.dll\", \"miutils.dll\", \"mlang.dll\", \"mmcbase.dll\", \"mmcndmgr.dll\", \"mmcshext.dll\", \"mmdevapi.dll\", \"mmgaclient.dll\", \"mmgaproxystub.dll\", \"mmres.dll\", \"mobilenetworking.dll\", \"modemui.dll\", \"modernexecserver.dll\", \"moricons.dll\", \"moshost.dll\", \"moshostclient.dll\", \"moshostcore.dll\", \"mosstorage.dll\", \"mp3dmod.dll\", \"mp43decd.dll\", \"mp4sdecd.dll\", \"mpeval.dll\", \"mpg4decd.dll\", \"mpr.dll\", \"mprapi.dll\", \"mprddm.dll\", \"mprdim.dll\", \"mprext.dll\", \"mprmsg.dll\", \"mpssvc.dll\", \"mpunits.dll\", \"mrmcorer.dll\", \"mrmdeploy.dll\", \"mrmindexer.dll\", \"mrt100.dll\", \"mrt_map.dll\", \"msaatext.dll\", \"msac3enc.dll\", \"msacm32.dll\", \"msafd.dll\", \"msajapi.dll\", \"msalacdecoder.dll\", \"msalacencoder.dll\", \"msamrnbdecoder.dll\", \"msamrnbencoder.dll\", \"msamrnbsink.dll\", \"msamrnbsource.dll\", \"msasn1.dll\", \"msauddecmft.dll\", \"msaudite.dll\", \"msauserext.dll\", \"mscandui.dll\", \"mscat32.dll\", \"msclmd.dll\", \"mscms.dll\", \"mscoree.dll\", \"mscorier.dll\", \"mscories.dll\", \"msctf.dll\", \"msctfmonitor.dll\", \"msctfp.dll\", \"msctfui.dll\", \"msctfuimanager.dll\", \"msdadiag.dll\", \"msdart.dll\", \"msdelta.dll\", \"msdmo.dll\", \"msdrm.dll\", \"msdtckrm.dll\", \"msdtclog.dll\", \"msdtcprx.dll\", \"msdtcspoffln.dll\", \"msdtctm.dll\", \"msdtcuiu.dll\", \"msdtcvsp1res.dll\", \"msfeeds.dll\", \"msfeedsbs.dll\", \"msflacdecoder.dll\", \"msflacencoder.dll\", \"msftedit.dll\", \"msheif.dll\", \"mshtml.dll\", \"mshtmldac.dll\", \"mshtmled.dll\", \"mshtmler.dll\", \"msi.dll\", \"msicofire.dll\", \"msidcrl40.dll\", \"msident.dll\", \"msidle.dll\", \"msidntld.dll\", \"msieftp.dll\", \"msihnd.dll\", \"msiltcfg.dll\", \"msimg32.dll\", \"msimsg.dll\", \"msimtf.dll\", \"msisip.dll\", \"msiso.dll\", \"msiwer.dll\", \"mskeyprotcli.dll\", \"mskeyprotect.dll\", \"msls31.dll\", \"msmpeg2adec.dll\", \"msmpeg2enc.dll\", \"msmpeg2vdec.dll\", \"msobjs.dll\", \"msoert2.dll\", \"msopusdecoder.dll\", \"mspatcha.dll\", \"mspatchc.dll\", \"msphotography.dll\", \"msports.dll\", \"msprivs.dll\", \"msrahc.dll\", \"msrating.dll\", \"msrawimage.dll\", \"msrdc.dll\", \"msrdpwebaccess.dll\", \"msrle32.dll\", \"msscntrs.dll\", \"mssecuser.dll\", \"mssign32.dll\", \"mssip32.dll\", \"mssitlb.dll\", \"mssph.dll\", \"mssprxy.dll\", \"mssrch.dll\", \"mssvp.dll\", \"mstask.dll\", \"mstextprediction.dll\", \"mstscax.dll\", \"msutb.dll\", \"msv1_0.dll\", \"msvcirt.dll\", \"msvcp110_win.dll\", \"msvcp120_clr0400.dll\", \"msvcp140_clr0400.dll\", \"msvcp60.dll\", \"msvcp_win.dll\", \"msvcr100_clr0400.dll\", \"msvcr120_clr0400.dll\", \"msvcrt.dll\", \"msvfw32.dll\", \"msvidc32.dll\", \"msvidctl.dll\", \"msvideodsp.dll\", \"msvp9dec.dll\", \"msvproc.dll\", \"msvpxenc.dll\", \"mswb7.dll\", \"mswebp.dll\", \"mswmdm.dll\", \"mswsock.dll\", \"msxml3.dll\", \"msxml3r.dll\", \"msxml6.dll\", \"msxml6r.dll\", \"msyuv.dll\", \"mtcmodel.dll\", \"mtf.dll\", \"mtfappserviceds.dll\", \"mtfdecoder.dll\", \"mtffuzzyds.dll\", \"mtfserver.dll\", \"mtfspellcheckds.dll\", \"mtxclu.dll\", \"mtxdm.dll\", \"mtxex.dll\", \"mtxoci.dll\", \"muifontsetup.dll\", \"mycomput.dll\", \"mydocs.dll\", \"napcrypt.dll\", \"napinsp.dll\", \"naturalauth.dll\", \"naturallanguage6.dll\", \"navshutdown.dll\", \"ncaapi.dll\", \"ncasvc.dll\", \"ncbservice.dll\", \"ncdautosetup.dll\", \"ncdprop.dll\", \"nci.dll\", \"ncobjapi.dll\", \"ncrypt.dll\", \"ncryptprov.dll\", \"ncryptsslp.dll\", \"ncsi.dll\", \"ncuprov.dll\", \"nddeapi.dll\", \"ndfapi.dll\", \"ndfetw.dll\", \"ndfhcdiscovery.dll\", \"ndishc.dll\", \"ndproxystub.dll\", \"nduprov.dll\", \"negoexts.dll\", \"netapi32.dll\", \"netbios.dll\", \"netcenter.dll\", \"netcfgx.dll\", \"netcorehc.dll\", \"netdiagfx.dll\", \"netdriverinstall.dll\", \"netevent.dll\", \"netfxperf.dll\", \"neth.dll\", \"netid.dll\", \"netiohlp.dll\", \"netjoin.dll\", \"netlogon.dll\", \"netman.dll\", \"netmsg.dll\", \"netplwiz.dll\", \"netprofm.dll\", \"netprofmsvc.dll\", \"netprovfw.dll\", \"netprovisionsp.dll\", \"netsetupapi.dll\", \"netsetupengine.dll\", \"netsetupshim.dll\", \"netsetupsvc.dll\", \"netshell.dll\", \"nettrace.dll\", \"netutils.dll\", \"networkexplorer.dll\", \"networkhelper.dll\", \"networkicon.dll\", \"networkproxycsp.dll\", \"networkstatus.dll\", \"networkuxbroker.dll\", \"newdev.dll\", \"nfcradiomedia.dll\", \"ngccredprov.dll\", \"ngcctnr.dll\", \"ngcctnrsvc.dll\", \"ngcisoctnr.dll\", \"ngckeyenum.dll\", \"ngcksp.dll\", \"ngclocal.dll\", \"ngcpopkeysrv.dll\", \"ngcprocsp.dll\", \"ngcrecovery.dll\", \"ngcsvc.dll\", \"ngctasks.dll\", \"ninput.dll\", \"nlaapi.dll\", \"nlahc.dll\", \"nlasvc.dll\", \"nlhtml.dll\", \"nlmgp.dll\", \"nlmproxy.dll\", \"nlmsprep.dll\", \"nlsbres.dll\", \"nlsdata0000.dll\", \"nlsdata0009.dll\", \"nlsdl.dll\", \"nlslexicons0009.dll\", \"nmadirect.dll\", \"normaliz.dll\", \"npmproxy.dll\", \"npsm.dll\", \"nrpsrv.dll\", \"nshhttp.dll\", \"nshipsec.dll\", \"nshwfp.dll\", \"nsi.dll\", \"nsisvc.dll\", \"ntasn1.dll\", \"ntdll.dll\", \"ntdsapi.dll\", \"ntlanman.dll\", \"ntlanui2.dll\", \"ntlmshared.dll\", \"ntmarta.dll\", \"ntprint.dll\", \"ntshrui.dll\", \"ntvdm64.dll\", \"objsel.dll\", \"occache.dll\", \"ocsetapi.dll\", \"odbc32.dll\", \"odbcbcp.dll\", \"odbcconf.dll\", \"odbccp32.dll\", \"odbccr32.dll\", \"odbccu32.dll\", \"odbcint.dll\", \"odbctrac.dll\", \"oemlicense.dll\", \"offfilt.dll\", \"officecsp.dll\", \"offlinelsa.dll\", \"offlinesam.dll\", \"offreg.dll\", \"ole32.dll\", \"oleacc.dll\", \"oleacchooks.dll\", \"oleaccrc.dll\", \"oleaut32.dll\", \"oledlg.dll\", \"oleprn.dll\", \"omadmagent.dll\", \"omadmapi.dll\", \"onebackuphandler.dll\", \"onex.dll\", \"onexui.dll\", \"opcservices.dll\", \"opengl32.dll\", \"ortcengine.dll\", \"osbaseln.dll\", \"osksupport.dll\", \"osuninst.dll\", \"p2p.dll\", \"p2pgraph.dll\", \"p2pnetsh.dll\", \"p2psvc.dll\", \"packager.dll\", \"panmap.dll\", \"pautoenr.dll\", \"pcacli.dll\", \"pcadm.dll\", \"pcaevts.dll\", \"pcasvc.dll\", \"pcaui.dll\", \"pcpksp.dll\", \"pcsvdevice.dll\", \"pcwum.dll\", \"pcwutl.dll\", \"pdh.dll\", \"pdhui.dll\", \"peerdist.dll\", \"peerdistad.dll\", \"peerdistcleaner.dll\", \"peerdistsh.dll\", \"peerdistsvc.dll\", \"peopleapis.dll\", \"peopleband.dll\", \"perceptiondevice.dll\", \"perfctrs.dll\", \"perfdisk.dll\", \"perfnet.dll\", \"perfos.dll\", \"perfproc.dll\", \"perfts.dll\", \"phoneom.dll\", \"phoneproviders.dll\", \"phoneservice.dll\", \"phoneserviceres.dll\", \"phoneutil.dll\", \"phoneutilres.dll\", \"photowiz.dll\", \"pickerplatform.dll\", \"pid.dll\", \"pidgenx.dll\", \"pifmgr.dll\", \"pimstore.dll\", \"pkeyhelper.dll\", \"pktmonapi.dll\", \"pku2u.dll\", \"pla.dll\", \"playlistfolder.dll\", \"playsndsrv.dll\", \"playtodevice.dll\", \"playtomanager.dll\", \"playtomenu.dll\", \"playtoreceiver.dll\", \"ploptin.dll\", \"pmcsnap.dll\", \"pngfilt.dll\", \"pnidui.dll\", \"pnpclean.dll\", \"pnppolicy.dll\", \"pnpts.dll\", \"pnpui.dll\", \"pnpxassoc.dll\", \"pnpxassocprx.dll\", \"pnrpauto.dll\", \"pnrphc.dll\", \"pnrpnsp.dll\", \"pnrpsvc.dll\", \"policymanager.dll\", \"polstore.dll\", \"posetup.dll\", \"posyncservices.dll\", \"pots.dll\", \"powercpl.dll\", \"powrprof.dll\", \"ppcsnap.dll\", \"prauthproviders.dll\", \"prflbmsg.dll\", \"printui.dll\", \"printwsdahost.dll\", \"prm0009.dll\", \"prncache.dll\", \"prnfldr.dll\", \"prnntfy.dll\", \"prntvpt.dll\", \"profapi.dll\", \"profext.dll\", \"profprov.dll\", \"profsvc.dll\", \"profsvcext.dll\", \"propsys.dll\", \"provcore.dll\", \"provdatastore.dll\", \"provdiagnostics.dll\", \"provengine.dll\", \"provhandlers.dll\", \"provisioningcsp.dll\", \"provmigrate.dll\", \"provops.dll\", \"provplugineng.dll\", \"provsysprep.dll\", \"provthrd.dll\", \"proximitycommon.dll\", \"proximityservice.dll\", \"prvdmofcomp.dll\", \"psapi.dll\", \"pshed.dll\", \"psisdecd.dll\", \"psmsrv.dll\", \"pstask.dll\", \"pstorec.dll\", \"ptpprov.dll\", \"puiapi.dll\", \"puiobj.dll\", \"pushtoinstall.dll\", \"pwlauncher.dll\", \"pwrshplugin.dll\", \"pwsso.dll\", \"qasf.dll\", \"qcap.dll\", \"qdv.dll\", \"qdvd.dll\", \"qedit.dll\", \"qedwipes.dll\", \"qmgr.dll\", \"query.dll\", \"quiethours.dll\", \"qwave.dll\", \"racengn.dll\", \"racpldlg.dll\", \"radardt.dll\", \"radarrs.dll\", \"radcui.dll\", \"rasadhlp.dll\", \"rasapi32.dll\", \"rasauto.dll\", \"raschap.dll\", \"raschapext.dll\", \"rasctrs.dll\", \"rascustom.dll\", \"rasdiag.dll\", \"rasdlg.dll\", \"rasgcw.dll\", \"rasman.dll\", \"rasmans.dll\", \"rasmbmgr.dll\", \"rasmediamanager.dll\", \"rasmm.dll\", \"rasmontr.dll\", \"rasplap.dll\", \"rasppp.dll\", \"rastapi.dll\", \"rastls.dll\", \"rastlsext.dll\", \"rdbui.dll\", \"rdpbase.dll\", \"rdpcfgex.dll\", \"rdpcore.dll\", \"rdpcorets.dll\", \"rdpencom.dll\", \"rdpendp.dll\", \"rdpnano.dll\", \"rdpsaps.dll\", \"rdpserverbase.dll\", \"rdpsharercom.dll\", \"rdpudd.dll\", \"rdpviewerax.dll\", \"rdsappxhelper.dll\", \"rdsdwmdr.dll\", \"rdvvmtransport.dll\", \"rdxservice.dll\", \"rdxtaskfactory.dll\", \"reagent.dll\", \"reagenttask.dll\", \"recovery.dll\", \"regapi.dll\", \"regctrl.dll\", \"regidle.dll\", \"regsvc.dll\", \"reguwpapi.dll\", \"reinfo.dll\", \"remotepg.dll\", \"remotewipecsp.dll\", \"reportingcsp.dll\", \"resampledmo.dll\", \"resbparser.dll\", \"reseteng.dll\", \"resetengine.dll\", \"resetengonline.dll\", \"resourcemapper.dll\", \"resutils.dll\", \"rgb9rast.dll\", \"riched20.dll\", \"riched32.dll\", \"rjvmdmconfig.dll\", \"rmapi.dll\", \"rmclient.dll\", \"rnr20.dll\", \"roamingsecurity.dll\", \"rometadata.dll\", \"rotmgr.dll\", \"rpcepmap.dll\", \"rpchttp.dll\", \"rpcns4.dll\", \"rpcnsh.dll\", \"rpcrt4.dll\", \"rpcrtremote.dll\", \"rpcss.dll\", \"rsaenh.dll\", \"rshx32.dll\", \"rstrtmgr.dll\", \"rtffilt.dll\", \"rtm.dll\", \"rtmediaframe.dll\", \"rtmmvrortc.dll\", \"rtutils.dll\", \"rtworkq.dll\", \"rulebasedds.dll\", \"samcli.dll\", \"samlib.dll\", \"samsrv.dll\", \"sas.dll\", \"sbe.dll\", \"sbeio.dll\", \"sberes.dll\", \"sbservicetrigger.dll\", \"scansetting.dll\", \"scardbi.dll\", \"scarddlg.dll\", \"scardsvr.dll\", \"scavengeui.dll\", \"scdeviceenum.dll\", \"scecli.dll\", \"scesrv.dll\", \"schannel.dll\", \"schedcli.dll\", \"schedsvc.dll\", \"scksp.dll\", \"scripto.dll\", \"scrobj.dll\", \"scrptadm.dll\", \"scrrun.dll\", \"sdcpl.dll\", \"sdds.dll\", \"sdengin2.dll\", \"sdfhost.dll\", \"sdhcinst.dll\", \"sdiageng.dll\", \"sdiagprv.dll\", \"sdiagschd.dll\", \"sdohlp.dll\", \"sdrsvc.dll\", \"sdshext.dll\", \"searchfolder.dll\", \"sechost.dll\", \"seclogon.dll\", \"secproc.dll\", \"secproc_isv.dll\", \"secproc_ssp.dll\", \"secproc_ssp_isv.dll\", \"secur32.dll\", \"security.dll\", \"semgrps.dll\", \"semgrsvc.dll\", \"sendmail.dll\", \"sens.dll\", \"sensapi.dll\", \"sensorsapi.dll\", \"sensorscpl.dll\", \"sensorservice.dll\", \"sensorsnativeapi.dll\", \"sensorsutilsv2.dll\", \"sensrsvc.dll\", \"serialui.dll\", \"servicinguapi.dll\", \"serwvdrv.dll\", \"sessenv.dll\", \"setbcdlocale.dll\", \"settingmonitor.dll\", \"settingsync.dll\", \"settingsynccore.dll\", \"setupapi.dll\", \"setupcl.dll\", \"setupcln.dll\", \"setupetw.dll\", \"sfc.dll\", \"sfc_os.dll\", \"sgrmenclave.dll\", \"shacct.dll\", \"shacctprofile.dll\", \"sharedpccsp.dll\", \"sharedrealitysvc.dll\", \"sharehost.dll\", \"sharemediacpl.dll\", \"shcore.dll\", \"shdocvw.dll\", \"shell32.dll\", \"shellstyle.dll\", \"shfolder.dll\", \"shgina.dll\", \"shimeng.dll\", \"shimgvw.dll\", \"shlwapi.dll\", \"shpafact.dll\", \"shsetup.dll\", \"shsvcs.dll\", \"shunimpl.dll\", \"shutdownext.dll\", \"shutdownux.dll\", \"shwebsvc.dll\", \"signdrv.dll\", \"simauth.dll\", \"simcfg.dll\", \"skci.dll\", \"slc.dll\", \"slcext.dll\", \"slwga.dll\", \"smartscreenps.dll\", \"smbhelperclass.dll\", \"smbwmiv2.dll\", \"smiengine.dll\", \"smphost.dll\", \"smsroutersvc.dll\", \"sndvolsso.dll\", \"snmpapi.dll\", \"socialapis.dll\", \"softkbd.dll\", \"softpub.dll\", \"sortwindows61.dll\", \"sortwindows62.dll\", \"spacebridge.dll\", \"spacecontrol.dll\", \"spatializerapo.dll\", \"spatialstore.dll\", \"spbcd.dll\", \"speechpal.dll\", \"spfileq.dll\", \"spinf.dll\", \"spmpm.dll\", \"spnet.dll\", \"spoolss.dll\", \"spopk.dll\", \"spp.dll\", \"sppc.dll\", \"sppcext.dll\", \"sppcomapi.dll\", \"sppcommdlg.dll\", \"sppinst.dll\", \"sppnp.dll\", \"sppobjs.dll\", \"sppwinob.dll\", \"sppwmi.dll\", \"spwinsat.dll\", \"spwizeng.dll\", \"spwizimg.dll\", \"spwizres.dll\", \"spwmp.dll\", \"sqlsrv32.dll\", \"sqmapi.dll\", \"srchadmin.dll\", \"srclient.dll\", \"srcore.dll\", \"srevents.dll\", \"srh.dll\", \"srhelper.dll\", \"srm.dll\", \"srmclient.dll\", \"srmlib.dll\", \"srmscan.dll\", \"srmshell.dll\", \"srmstormod.dll\", \"srmtrace.dll\", \"srm_ps.dll\", \"srpapi.dll\", \"srrstr.dll\", \"srumapi.dll\", \"srumsvc.dll\", \"srvcli.dll\", \"srvsvc.dll\", \"srwmi.dll\", \"sscore.dll\", \"sscoreext.dll\", \"ssdm.dll\", \"ssdpapi.dll\", \"ssdpsrv.dll\", \"sspicli.dll\", \"sspisrv.dll\", \"ssshim.dll\", \"sstpsvc.dll\", \"starttiledata.dll\", \"startupscan.dll\", \"stclient.dll\", \"sti.dll\", \"sti_ci.dll\", \"stobject.dll\", \"storageusage.dll\", \"storagewmi.dll\", \"storewuauth.dll\", \"storprop.dll\", \"storsvc.dll\", \"streamci.dll\", \"structuredquery.dll\", \"sud.dll\", \"svf.dll\", \"svsvc.dll\", \"swprv.dll\", \"sxproxy.dll\", \"sxs.dll\", \"sxshared.dll\", \"sxssrv.dll\", \"sxsstore.dll\", \"synccenter.dll\", \"synccontroller.dll\", \"synchostps.dll\", \"syncproxy.dll\", \"syncreg.dll\", \"syncres.dll\", \"syncsettings.dll\", \"syncutil.dll\", \"sysclass.dll\", \"sysfxui.dll\", \"sysmain.dll\", \"sysntfy.dll\", \"syssetup.dll\", \"systemcpl.dll\", \"t2embed.dll\", \"tabbtn.dll\", \"tabbtnex.dll\", \"tabsvc.dll\", \"tapi3.dll\", \"tapi32.dll\", \"tapilua.dll\", \"tapimigplugin.dll\", \"tapiperf.dll\", \"tapisrv.dll\", \"tapisysprep.dll\", \"tapiui.dll\", \"taskapis.dll\", \"taskbarcpl.dll\", \"taskcomp.dll\", \"taskschd.dll\", \"taskschdps.dll\", \"tbauth.dll\", \"tbs.dll\", \"tcbloader.dll\", \"tcpipcfg.dll\", \"tcpmib.dll\", \"tcpmon.dll\", \"tcpmonui.dll\", \"tdh.dll\", \"tdlmigration.dll\", \"tellib.dll\", \"termmgr.dll\", \"termsrv.dll\", \"tetheringclient.dll\", \"tetheringmgr.dll\", \"tetheringservice.dll\", \"tetheringstation.dll\", \"textshaping.dll\", \"themecpl.dll\", \"themeservice.dll\", \"themeui.dll\", \"threadpoolwinrt.dll\", \"thumbcache.dll\", \"timebrokerclient.dll\", \"timebrokerserver.dll\", \"timesync.dll\", \"timesynctask.dll\", \"tlscsp.dll\", \"tokenbinding.dll\", \"tokenbroker.dll\", \"tokenbrokerui.dll\", \"tpmcertresources.dll\", \"tpmcompc.dll\", \"tpmtasks.dll\", \"tpmvsc.dll\", \"tquery.dll\", \"traffic.dll\", \"transportdsa.dll\", \"trie.dll\", \"trkwks.dll\", \"tsbyuv.dll\", \"tscfgwmi.dll\", \"tserrredir.dll\", \"tsf3gip.dll\", \"tsgqec.dll\", \"tsmf.dll\", \"tspkg.dll\", \"tspubwmi.dll\", \"tssessionux.dll\", \"tssrvlic.dll\", \"tsworkspace.dll\", \"ttdloader.dll\", \"ttdplm.dll\", \"ttdrecord.dll\", \"ttdrecordcpu.dll\", \"ttlsauth.dll\", \"ttlscfg.dll\", \"ttlsext.dll\", \"tvratings.dll\", \"twext.dll\", \"twinapi.dll\", \"twinui.dll\", \"txflog.dll\", \"txfw32.dll\", \"tzautoupdate.dll\", \"tzres.dll\", \"tzsyncres.dll\", \"ubpm.dll\", \"ucmhc.dll\", \"ucrtbase.dll\", \"ucrtbase_clr0400.dll\", \"ucrtbase_enclave.dll\", \"udhisapi.dll\", \"udwm.dll\", \"ueficsp.dll\", \"uexfat.dll\", \"ufat.dll\", \"uiamanager.dll\", \"uianimation.dll\", \"uiautomationcore.dll\", \"uicom.dll\", \"uireng.dll\", \"uiribbon.dll\", \"uiribbonres.dll\", \"ulib.dll\", \"umb.dll\", \"umdmxfrm.dll\", \"umpdc.dll\", \"umpnpmgr.dll\", \"umpo-overrides.dll\", \"umpo.dll\", \"umpoext.dll\", \"umpowmi.dll\", \"umrdp.dll\", \"unattend.dll\", \"unenrollhook.dll\", \"unimdmat.dll\", \"uniplat.dll\", \"unistore.dll\", \"untfs.dll\", \"updateagent.dll\", \"updatecsp.dll\", \"updatepolicy.dll\", \"upnp.dll\", \"upnphost.dll\", \"upshared.dll\", \"urefs.dll\", \"urefsv1.dll\", \"ureg.dll\", \"url.dll\", \"urlmon.dll\", \"usbcapi.dll\", \"usbceip.dll\", \"usbmon.dll\", \"usbperf.dll\", \"usbpmapi.dll\", \"usbtask.dll\", \"usbui.dll\", \"user32.dll\", \"usercpl.dll\", \"userdataservice.dll\", \"userdatatimeutil.dll\", \"userenv.dll\", \"userinitext.dll\", \"usermgr.dll\", \"usermgrcli.dll\", \"usermgrproxy.dll\", \"usoapi.dll\", \"usocoreps.dll\", \"usosvc.dll\", \"usp10.dll\", \"ustprov.dll\", \"utcutil.dll\", \"utildll.dll\", \"uudf.dll\", \"uvcmodel.dll\", \"uwfcfgmgmt.dll\", \"uwfcsp.dll\", \"uwfservicingapi.dll\", \"uxinit.dll\", \"uxlib.dll\", \"uxlibres.dll\", \"uxtheme.dll\", \"vac.dll\", \"van.dll\", \"vault.dll\", \"vaultcds.dll\", \"vaultcli.dll\", \"vaultroaming.dll\", \"vaultsvc.dll\", \"vbsapi.dll\", \"vbscript.dll\", \"vbssysprep.dll\", \"vcardparser.dll\", \"vdsbas.dll\", \"vdsdyn.dll\", \"vdsutil.dll\", \"vdsvd.dll\", \"vds_ps.dll\", \"verifier.dll\", \"version.dll\", \"vertdll.dll\", \"vfuprov.dll\", \"vfwwdm32.dll\", \"vhfum.dll\", \"vid.dll\", \"videohandlers.dll\", \"vidreszr.dll\", \"virtdisk.dll\", \"vmbuspipe.dll\", \"vmdevicehost.dll\", \"vmictimeprovider.dll\", \"vmrdvcore.dll\", \"voiprt.dll\", \"vpnike.dll\", \"vpnikeapi.dll\", \"vpnsohdesktop.dll\", \"vpnv2csp.dll\", \"vscmgrps.dll\", \"vssapi.dll\", \"vsstrace.dll\", \"vss_ps.dll\", \"w32time.dll\", \"w32topl.dll\", \"waasassessment.dll\", \"waasmediccapsule.dll\", \"waasmedicps.dll\", \"waasmedicsvc.dll\", \"wabsyncprovider.dll\", \"walletproxy.dll\", \"walletservice.dll\", \"wavemsp.dll\", \"wbemcomn.dll\", \"wbiosrvc.dll\", \"wci.dll\", \"wcimage.dll\", \"wcmapi.dll\", \"wcmcsp.dll\", \"wcmsvc.dll\", \"wcnapi.dll\", \"wcncsvc.dll\", \"wcneapauthproxy.dll\", \"wcneappeerproxy.dll\", \"wcnnetsh.dll\", \"wcnwiz.dll\", \"wc_storage.dll\", \"wdc.dll\", \"wdi.dll\", \"wdigest.dll\", \"wdscore.dll\", \"webauthn.dll\", \"webcamui.dll\", \"webcheck.dll\", \"webclnt.dll\", \"webio.dll\", \"webservices.dll\", \"websocket.dll\", \"wecapi.dll\", \"wecsvc.dll\", \"wephostsvc.dll\", \"wer.dll\", \"werconcpl.dll\", \"wercplsupport.dll\", \"werenc.dll\", \"weretw.dll\", \"wersvc.dll\", \"werui.dll\", \"wevtapi.dll\", \"wevtfwd.dll\", \"wevtsvc.dll\", \"wfapigp.dll\", \"wfdprov.dll\", \"wfdsconmgr.dll\", \"wfdsconmgrsvc.dll\", \"wfhc.dll\", \"whealogr.dll\", \"whhelper.dll\", \"wiaaut.dll\", \"wiadefui.dll\", \"wiadss.dll\", \"wiarpc.dll\", \"wiascanprofiles.dll\", \"wiaservc.dll\", \"wiashext.dll\", \"wiatrace.dll\", \"wificloudstore.dll\", \"wificonfigsp.dll\", \"wifidisplay.dll\", \"wimgapi.dll\", \"win32spl.dll\", \"win32u.dll\", \"winbio.dll\", \"winbiodatamodel.dll\", \"winbioext.dll\", \"winbrand.dll\", \"wincorlib.dll\", \"wincredprovider.dll\", \"wincredui.dll\", \"windowmanagement.dll\", \"windowscodecs.dll\", \"windowscodecsext.dll\", \"windowscodecsraw.dll\", \"windowsiotcsp.dll\", \"windowslivelogin.dll\", \"winethc.dll\", \"winhttp.dll\", \"winhttpcom.dll\", \"winhvemulation.dll\", \"winhvplatform.dll\", \"wininet.dll\", \"wininetlui.dll\", \"wininitext.dll\", \"winipcfile.dll\", \"winipcsecproc.dll\", \"winipsec.dll\", \"winlangdb.dll\", \"winlogonext.dll\", \"winmde.dll\", \"winml.dll\", \"winmm.dll\", \"winmmbase.dll\", \"winmsipc.dll\", \"winnlsres.dll\", \"winnsi.dll\", \"winreagent.dll\", \"winrnr.dll\", \"winrscmd.dll\", \"winrsmgr.dll\", \"winrssrv.dll\", \"winrttracing.dll\", \"winsatapi.dll\", \"winscard.dll\", \"winsetupui.dll\", \"winshfhc.dll\", \"winsku.dll\", \"winsockhc.dll\", \"winsqlite3.dll\", \"winsrpc.dll\", \"winsrv.dll\", \"winsrvext.dll\", \"winsta.dll\", \"winsync.dll\", \"winsyncmetastore.dll\", \"winsyncproviders.dll\", \"wintrust.dll\", \"wintypes.dll\", \"winusb.dll\", \"wirednetworkcsp.dll\", \"wisp.dll\", \"wkscli.dll\", \"wkspbrokerax.dll\", \"wksprtps.dll\", \"wkssvc.dll\", \"wlanapi.dll\", \"wlancfg.dll\", \"wlanconn.dll\", \"wlandlg.dll\", \"wlangpui.dll\", \"wlanhc.dll\", \"wlanhlp.dll\", \"wlanmediamanager.dll\", \"wlanmm.dll\", \"wlanmsm.dll\", \"wlanpref.dll\", \"wlanradiomanager.dll\", \"wlansec.dll\", \"wlansvc.dll\", \"wlansvcpal.dll\", \"wlanui.dll\", \"wlanutil.dll\", \"wldap32.dll\", \"wldp.dll\", \"wlgpclnt.dll\", \"wlidcli.dll\", \"wlidcredprov.dll\", \"wlidfdp.dll\", \"wlidnsp.dll\", \"wlidprov.dll\", \"wlidres.dll\", \"wlidsvc.dll\", \"wmadmod.dll\", \"wmadmoe.dll\", \"wmalfxgfxdsp.dll\", \"wmasf.dll\", \"wmcodecdspps.dll\", \"wmdmlog.dll\", \"wmdmps.dll\", \"wmdrmsdk.dll\", \"wmerror.dll\", \"wmi.dll\", \"wmiclnt.dll\", \"wmicmiplugin.dll\", \"wmidcom.dll\", \"wmidx.dll\", \"wmiprop.dll\", \"wmitomi.dll\", \"wmnetmgr.dll\", \"wmp.dll\", \"wmpdui.dll\", \"wmpdxm.dll\", \"wmpeffects.dll\", \"wmphoto.dll\", \"wmploc.dll\", \"wmpps.dll\", \"wmpshell.dll\", \"wmsgapi.dll\", \"wmspdmod.dll\", \"wmspdmoe.dll\", \"wmvcore.dll\", \"wmvdecod.dll\", \"wmvdspa.dll\", \"wmvencod.dll\", \"wmvsdecd.dll\", \"wmvsencd.dll\", \"wmvxencd.dll\", \"woftasks.dll\", \"wofutil.dll\", \"wordbreakers.dll\", \"workfoldersgpext.dll\", \"workfoldersres.dll\", \"workfoldersshell.dll\", \"workfolderssvc.dll\", \"wosc.dll\", \"wow64.dll\", \"wow64cpu.dll\", \"wow64win.dll\", \"wpbcreds.dll\", \"wpc.dll\", \"wpcapi.dll\", \"wpcdesktopmonsvc.dll\", \"wpcproxystubs.dll\", \"wpcrefreshtask.dll\", \"wpcwebfilter.dll\", \"wpdbusenum.dll\", \"wpdshext.dll\", \"wpdshserviceobj.dll\", \"wpdsp.dll\", \"wpd_ci.dll\", \"wpnapps.dll\", \"wpnclient.dll\", \"wpncore.dll\", \"wpninprc.dll\", \"wpnprv.dll\", \"wpnservice.dll\", \"wpnsruprov.dll\", \"wpnuserservice.dll\", \"wpportinglibrary.dll\", \"wpprecorderum.dll\", \"wptaskscheduler.dll\", \"wpx.dll\", \"ws2help.dll\", \"ws2_32.dll\", \"wscapi.dll\", \"wscinterop.dll\", \"wscisvif.dll\", \"wsclient.dll\", \"wscproxystub.dll\", \"wscsvc.dll\", \"wsdapi.dll\", \"wsdchngr.dll\", \"wsdprintproxy.dll\", \"wsdproviderutil.dll\", \"wsdscanproxy.dll\", \"wsecedit.dll\", \"wsepno.dll\", \"wshbth.dll\", \"wshcon.dll\", \"wshelper.dll\", \"wshext.dll\", \"wshhyperv.dll\", \"wship6.dll\", \"wshqos.dll\", \"wshrm.dll\", \"wshtcpip.dll\", \"wshunix.dll\", \"wslapi.dll\", \"wsmagent.dll\", \"wsmauto.dll\", \"wsmplpxy.dll\", \"wsmres.dll\", \"wsmsvc.dll\", \"wsmwmipl.dll\", \"wsnmp32.dll\", \"wsock32.dll\", \"wsplib.dll\", \"wsp_fs.dll\", \"wsp_health.dll\", \"wsp_sr.dll\", \"wtsapi32.dll\", \"wuapi.dll\", \"wuaueng.dll\", \"wuceffects.dll\", \"wudfcoinstaller.dll\", \"wudfplatform.dll\", \"wudfsmcclassext.dll\", \"wudfx.dll\", \"wudfx02000.dll\", \"wudriver.dll\", \"wups.dll\", \"wups2.dll\", \"wuuhext.dll\", \"wuuhosdeployment.dll\", \"wvc.dll\", \"wwaapi.dll\", \"wwaext.dll\", \"wwanapi.dll\", \"wwancfg.dll\", \"wwanhc.dll\", \"wwanprotdim.dll\", \"wwanradiomanager.dll\", \"wwansvc.dll\", \"wwapi.dll\", \"xamltilerender.dll\", \"xaudio2_8.dll\", \"xaudio2_9.dll\", \"xblauthmanager.dll\", \"xblgamesave.dll\", \"xblgamesaveext.dll\", \"xblgamesaveproxy.dll\", \"xboxgipsvc.dll\", \"xboxgipsynthetic.dll\", \"xboxnetapisvc.dll\", \"xinput1_4.dll\", \"xinput9_1_0.dll\", \"xinputuap.dll\", \"xmlfilter.dll\", \"xmllite.dll\", \"xmlprovi.dll\", \"xolehlp.dll\", \"xpsgdiconverter.dll\", \"xpsprint.dll\", \"xpspushlayer.dll\", \"xpsrasterservice.dll\", \"xpsservices.dll\", \"xwizards.dll\", \"xwreg.dll\", \"xwtpdui.dll\", \"xwtpw32.dll\", \"zipcontainer.dll\", \"zipfldr.dll\", \"bootsvc.dll\", \"halextintcpsedma.dll\", \"icsvcvss.dll\", \"ieproxydesktop.dll\", \"lsaadt.dll\", \"nlansp_c.dll\", \"nrtapi.dll\", \"opencl.dll\", \"pfclient.dll\", \"pnpdiag.dll\", \"prxyqry.dll\", \"rdpnanotransport.dll\", \"servicingcommon.dll\", \"sortwindows63.dll\", \"sstpcfg.dll\", \"tdhres.dll\", \"umpodev.dll\", \"utcapi.dll\", \"windlp.dll\", \"wow64base.dll\", \"wow64con.dll\", \"blbuires.dll\", \"bpainst.dll\", \"cbclient.dll\", \"certadm.dll\", \"certocm.dll\", \"certpick.dll\", \"csdeployres.dll\", \"dsdeployres.dll\", \"eapa3hst.dll\", \"eapacfg.dll\", \"eapahost.dll\", \"elsext.dll\", \"encdump.dll\", \"escmigplugin.dll\", \"fsclient.dll\", \"fsdeployres.dll\", \"fssminst.dll\", \"fssmres.dll\", \"fssprov.dll\", \"ipamapi.dll\", \"kpssvc.dll\", \"lbfoadminlib.dll\", \"mintdh.dll\", \"mmci.dll\", \"mmcico.dll\", \"mprsnap.dll\", \"mstsmhst.dll\", \"mstsmmc.dll\", \"muxinst.dll\", \"personax.dll\", \"rassfm.dll\", \"rasuser.dll\", \"rdmsinst.dll\", \"rdmsres.dll\", \"rtrfiltr.dll\", \"sacsvr.dll\", \"scrdenrl.dll\", \"sdclient.dll\", \"sharedstartmodel.dll\", \"smsrouter.dll\", \"spwizimg_svr.dll\", \"sqlcecompact40.dll\", \"sqlceoledb40.dll\", \"sqlceqp40.dll\", \"sqlcese40.dll\", \"srvmgrinst.dll\", \"svrmgrnc.dll\", \"tapisnap.dll\", \"tlsbrand.dll\", \"tsec.dll\", \"tsprop.dll\", \"tspubiconhelper.dll\", \"tssdjet.dll\", \"tsuserex.dll\", \"ualapi.dll\", \"ualsvc.dll\", \"umcres.dll\", \"updatehandlers.dll\", \"usocore.dll\", \"vssui.dll\", \"wsbappres.dll\", \"wsbonline.dll\", \"wsmselpl.dll\", \"wsmselrr.dll\", \"xpsfilt.dll\", \"xpsshhdr.dll\"\n ) and\n not (\n (dll.name : \"icuuc.dll\" and dll.code_signature.subject_name == \"Valve\" and dll.code_signature.trusted == true) or \n (dll.name : \"dbghelp.dll\" and dll.code_signature.trusted == true) or \n (dll.name : \"DirectML.dll\" and dll.code_signature.subject_name == \"Adobe Inc.\" and dll.code_signature.trusted == true) or\n (\n dll.path : (\n \"?:\\\\Windows\\\\SystemApps\\\\*\\\\dxgi.dll\",\n \"?:\\\\Windows\\\\SystemApps\\\\*\\\\wincorlib.dll\",\n \"?:\\\\Windows\\\\dxgi.dll\"\n )\n )\n )\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "dll.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "dll.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "dll.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.action", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fb01d790-9f74-4e76-97dd-b4b0f7bf6435", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "Data Source: Elastic Defend", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "fb01d790-9f74-4e76-97dd-b4b0f7bf6435_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fb02b8d3-71ee-4af1-bacd-215d23f17efa_105.json b/packages/security_detection_engine/kibana/security_rule/fb02b8d3-71ee-4af1-bacd-215d23f17efa_105.json new file mode 100644 index 00000000000..3b697c33c7f --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fb02b8d3-71ee-4af1-bacd-215d23f17efa_105.json @@ -0,0 +1,135 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies the native Windows tools regsvr32.exe, regsvr64.exe, RegSvcs.exe, or RegAsm.exe making a network connection. This may be indicative of an attacker bypassing allowlists or running arbitrary scripts via a signed Microsoft binary.", + "false_positives": [ + "Security testing may produce events like this. Activity of this kind performed by non-engineers and ordinary users is unusual." + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Network Connection via Registration Utility", + "note": "## Triage and analysis\n\n### Investigating Network Connection via Registration Utility\n\nBy examining the specific traits of Windows binaries -- such as process trees, command lines, network connections, registry modifications, and so on -- it's possible to establish a baseline of normal activity. Deviations from this baseline can indicate malicious activity such as masquerading, and deserve further investigation.\n\nThis rule looks for the execution of `regsvr32.exe`, `RegAsm.exe`, or `RegSvcs.exe` utilities followed by a network connection to an external address. Attackers can abuse utilities to execute malicious files or masquerade as those utilities in order to bypass detections and evade defenses.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n - Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n - Investigate the file digital signature and process original filename, if suspicious, treat it as potential malware.\n- Investigate the target host that the signed binary is communicating with.\n - Check if the domain is newly registered or unexpected.\n - Check the reputation of the domain or IP address.\n- Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this activity is expected and noisy in your environment, consider adding exceptions \u2014 preferably with a combination of destination IP address and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "sequence by process.entity_id\n [process where host.os.type == \"windows\" and event.type == \"start\" and\n process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not (\n (?process.Ext.token.integrity_level_name : \"System\" or ?winlog.event_data.IntegrityLevel : \"System\") and\n (process.parent.name : \"msiexec.exe\" or process.parent.executable : (\"C:\\\\Program Files (x86)\\\\*.exe\", \"C:\\\\Program Files\\\\*.exe\"))\n )\n ]\n [network where host.os.type == \"windows\" and process.name : (\"regsvr32.exe\", \"RegAsm.exe\", \"RegSvcs.exe\") and\n not cidrmatch(destination.ip, \"10.0.0.0/8\", \"127.0.0.0/8\", \"169.254.0.0/16\", \"172.16.0.0/12\", \"192.0.0.0/24\",\n \"192.0.0.0/29\", \"192.0.0.8/32\", \"192.0.0.9/32\", \"192.0.0.10/32\", \"192.0.0.170/32\", \"192.0.0.171/32\",\n \"192.0.2.0/24\", \"192.31.196.0/24\", \"192.52.193.0/24\", \"192.168.0.0/16\", \"192.88.99.0/24\", \"224.0.0.0/4\",\n \"100.64.0.0/10\", \"192.175.48.0/24\",\"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"240.0.0.0/4\", \"::1\",\n \"FE80::/10\", \"FF00::/8\") and network.protocol != \"dns\"]\n", + "references": [ + "https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "destination.ip", + "type": "ip" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "network.protocol", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.token.integrity_level_name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + }, + { + "ecs": false, + "name": "winlog.event_data.IntegrityLevel", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1218", + "name": "System Binary Proxy Execution", + "reference": "https://attack.mitre.org/techniques/T1218/", + "subtechnique": [ + { + "id": "T1218.010", + "name": "Regsvr32", + "reference": "https://attack.mitre.org/techniques/T1218/010/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 105 + }, + "id": "fb02b8d3-71ee-4af1-bacd-215d23f17efa_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fc7c0fa4-8f03-4b3e-8336-c5feab0be022_105.json b/packages/security_detection_engine/kibana/security_rule/fc7c0fa4-8f03-4b3e-8336-c5feab0be022_105.json new file mode 100644 index 00000000000..2afbcad5b97 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fc7c0fa4-8f03-4b3e-8336-c5feab0be022_105.json @@ -0,0 +1,101 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies User Account Control (UAC) bypass attempts by abusing an elevated COM Interface to launch a malicious program. Attackers may attempt to bypass UAC to stealthily execute code with elevated permissions.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n process.executable : \"C:\\\\*\\\\AppData\\\\*\\\\Temp\\\\IDC*.tmp\\\\*.exe\" and\n process.parent.name : \"ieinstal.exe\" and process.parent.args : \"-Embedding\"\n\n /* uncomment once in winlogbeat */\n /* and not (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true) */\n", + "references": [ + "https://swapcontext.blogspot.com/2020/11/uac-bypasses-from-comautoapprovallist.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fc7c0fa4-8f03-4b3e-8336-c5feab0be022", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.002", + "name": "Bypass User Account Control", + "reference": "https://attack.mitre.org/techniques/T1548/002/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 105 + }, + "id": "fc7c0fa4-8f03-4b3e-8336-c5feab0be022_105", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fd4a992d-6130-4802-9ff8-829b89ae801f_106.json b/packages/security_detection_engine/kibana/security_rule/fd4a992d-6130-4802-9ff8-829b89ae801f_106.json new file mode 100644 index 00000000000..c7687fb2a5e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fd4a992d-6130-4802-9ff8-829b89ae801f_106.json @@ -0,0 +1,115 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "The Application Shim was created to allow for backward compatibility of software as the operating system codebase changes over time. This Windows functionality has been abused by attackers to stealthily gain persistence and arbitrary code execution in legitimate Windows processes.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Application Shimming via Sdbinst", + "note": "", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and process.name : \"sdbinst.exe\" and\n not (process.args : \"-m\" and process.args : \"-bg\") and\n not process.args : \"-mm\"\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fd4a992d-6130-4802-9ff8-829b89ae801f", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.011", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1546/011/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1546", + "name": "Event Triggered Execution", + "reference": "https://attack.mitre.org/techniques/T1546/", + "subtechnique": [ + { + "id": "T1546.011", + "name": "Application Shimming", + "reference": "https://attack.mitre.org/techniques/T1546/011/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "fd4a992d-6130-4802-9ff8-829b89ae801f_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fd70c98a-c410-42dc-a2e3-761c71848acf_106.json b/packages/security_detection_engine/kibana/security_rule/fd70c98a-c410-42dc-a2e3-761c71848acf_106.json new file mode 100644 index 00000000000..4d56cb36851 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fd70c98a-c410-42dc-a2e3-761c71848acf_106.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "author": [ + "Elastic", + "Austin Songer" + ], + "description": "Identifies suspicious commands being used with certutil.exe. CertUtil is a native Windows component which is part of Certificate Services. CertUtil is often abused by attackers to live off the land for stealthier command and control or data exfiltration.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Suspicious CertUtil Commands", + "note": "## Triage and analysis\n\n### Investigating Suspicious CertUtil Commands\n\n`certutil.exe` is a command line utility program that is included with Microsoft Windows operating systems. It is used to manage and manipulate digital certificates and certificate services on computers running Windows.\n\nAttackers can abuse `certutil.exe` utility to download and/or deobfuscate malware, offensive security tools, and certificates from external sources to take the next steps in a compromised environment. This rule identifies command line arguments used to accomplish these behaviors.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the script execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine the command line to determine the nature of the execution.\n - If files were downloaded, retrieve them and check whether they were run, and under which security context.\n - If files were obfuscated or deobfuscated, retrieve them.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the involved files using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n\n### False positive analysis\n\n- If this rule is noisy in your environment due to expected activity, consider adding exceptions \u2014 preferably with a combination of user and command line conditions.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).\n", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n (process.name : \"certutil.exe\" or process.pe.original_file_name == \"CertUtil.exe\") and\n process.args : (\"?decode\", \"?encode\", \"?urlcache\", \"?verifyctl\", \"?encodehex\", \"?decodehex\", \"?exportPFX\")\n", + "references": [ + "https://twitter.com/Moriarty_Meng/status/984380793383370752", + "https://twitter.com/egre55/status/1087685529016193025", + "https://www.sysadmins.lv/blog-en/certutil-tips-and-tricks-working-with-x509-file-format.aspx", + "https://docs.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.pe.original_file_name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fd70c98a-c410-42dc-a2e3-761c71848acf", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Endgame", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1140", + "name": "Deobfuscate/Decode Files or Information", + "reference": "https://attack.mitre.org/techniques/T1140/" + } + ] + } + ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "fd70c98a-c410-42dc-a2e3-761c71848acf_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fd7a6052-58fa-4397-93c3-4795249ccfa2_107.json b/packages/security_detection_engine/kibana/security_rule/fd7a6052-58fa-4397-93c3-4795249ccfa2_107.json new file mode 100644 index 00000000000..412192abec6 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fd7a6052-58fa-4397-93c3-4795249ccfa2_107.json @@ -0,0 +1,102 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies a suspicious parent child process relationship with cmd.exe descending from svchost.exe", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*", + "endgame-*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Svchost spawning Cmd", + "note": "## Triage and analysis\n\n### Investigating Svchost spawning Cmd\n\nThe Service Host process (SvcHost) is a system process that can host one, or multiple, Windows services in the Windows NT family of operating systems. Note that `Svchost.exe` is reserved for use by the operating system and should not be used by non-Windows services.\n\nThis rule looks for the creation of the `cmd.exe` process with `svchost.exe` as its parent process. This is an unusual behavior that can indicate the masquerading of a malicious process as `svchost.exe` or exploitation for privilege escalation.\n\n\u003e **Note**:\n\u003e This investigation guide uses the [Osquery Markdown Plugin](https://www.elastic.co/guide/en/security/master/invest-guide-run-osquery.html) introduced in Elastic Stack version 8.5.0. Older Elastic Stack versions will display unrendered Markdown in this guide.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Investigate any abnormal behavior by the subject process such as network connections, registry or file modifications, and any spawned child processes.\n- Examine the host for derived artifacts that indicate suspicious activities:\n - Analyze the process executable using a private sandboxed analysis system.\n - Observe and collect information about the following activities in both the sandbox and the alert subject host:\n - Attempts to contact external domains and addresses.\n - Use the Elastic Defend network events to determine domains and addresses contacted by the subject process by filtering by the process' `process.entity_id`.\n - Examine the DNS cache for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve DNS Cache\",\"query\":\"SELECT * FROM dns_cache\"}}\n - Use the Elastic Defend registry events to examine registry keys accessed, modified, or created by the related processes in the process tree.\n - Examine the host services for suspicious or anomalous entries.\n - !{osquery{\"label\":\"Osquery - Retrieve All Services\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Services Running on User Accounts\",\"query\":\"SELECT description, display_name, name, path, pid, service_type, start_type, status, user_account FROM services WHERE\\nNOT (user_account LIKE '%LocalSystem' OR user_account LIKE '%LocalService' OR user_account LIKE '%NetworkService' OR\\nuser_account == null)\\n\"}}\n - !{osquery{\"label\":\"Osquery - Retrieve Service Unsigned Executables with Virustotal Link\",\"query\":\"SELECT concat('https://www.virustotal.com/gui/file/', sha1) AS VtLink, name, description, start_type, status, pid,\\nservices.path FROM services JOIN authenticode ON services.path = authenticode.path OR services.module_path =\\nauthenticode.path JOIN hash ON services.path = hash.path WHERE authenticode.result != 'trusted'\\n\"}}\n - Retrieve the files' SHA-256 hash values using the PowerShell `Get-FileHash` cmdlet and search for the existence and reputation of the hashes in resources like VirusTotal, Hybrid-Analysis, CISCO Talos, Any.run, etc.\n- Investigate potentially compromised accounts. Analysts can do this by searching for login events (for example, 4624) to the target host after the registry modification.\n\n\n### False positive analysis\n\n- This activity is unlikely to happen legitimately. Benign true positives (B-TPs) can be added as exceptions if necessary.\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved host to prevent further post-compromise behavior.\n- If the triage identified malware, search the environment for additional compromised hosts.\n - Implement temporary network rules, procedures, and segmentation to contain the malware.\n - Stop suspicious processes.\n - Immediately block the identified indicators of compromise (IoCs).\n - Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.\n- Remove and block malicious artifacts identified during triage.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "process where host.os.type == \"windows\" and event.type == \"start\" and\n\n process.parent.name : \"svchost.exe\" and process.name : \"cmd.exe\" and\n\n not process.args :\n (\"??:\\\\Program Files\\\\Npcap\\\\CheckStatus.bat?\",\n \"?:\\\\Program Files\\\\Npcap\\\\CheckStatus.bat\",\n \"\\\\system32\\\\cleanmgr.exe\",\n \"?:\\\\Windows\\\\system32\\\\silcollector.cmd\",\n \"\\\\system32\\\\AppHostRegistrationVerifier.exe\",\n \"\\\\system32\\\\ServerManagerLauncher.exe\",\n \"dir\",\n \"?:\\\\Program Files\\\\*\",\n \"?:\\\\Program Files (x86)\\\\*\",\n \"?:\\\\Windows\\\\LSDeployment\\\\Lspush.exe\",\n \"(x86)\\\\FMAuditOnsite\\\\watchdog.bat\",\n \"?:\\\\ProgramData\\\\chocolatey\\\\bin\\\\choco-upgrade-all.bat\",\n \"Files\\\\Npcap\\\\CheckStatus.bat\") and\n\n /* very noisy pattern - bat or cmd script executed via scheduled tasks */\n not (process.parent.args : \"netsvcs\" and process.args : (\"?:\\\\*.bat\", \"?:\\\\*.cmd\"))\n", + "references": [ + "https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.parent.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fd7a6052-58fa-4397-93c3-4795249ccfa2", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Execution", + "Resources: Investigation Guide", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/" + } + ] + } + ], + "timeline_id": "e70679c2-6cde-4510-9764-4823df18f7db", + "timeline_title": "Comprehensive Process Timeline", + "timestamp_override": "event.ingested", + "type": "eql", + "version": 107 + }, + "id": "fd7a6052-58fa-4397-93c3-4795249ccfa2_107", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fda1d332-5e08-4f27-8a9b-8c802e3292a6_1.json b/packages/security_detection_engine/kibana/security_rule/fda1d332-5e08-4f27-8a9b-8c802e3292a6_1.json new file mode 100644 index 00000000000..e620d53f3bf --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fda1d332-5e08-4f27-8a9b-8c802e3292a6_1.json @@ -0,0 +1,95 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule monitors for the copying or moving of a system binary to a suspicious directory. Adversaries may copy/move and rename system binaries to evade detection. Copying a system binary to a different location should not occur often, so if it does, the activity should be investigated.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "System Binary Copied and/or Moved to Suspicious Directory", + "query": "sequence by host.id, process.entity_id with maxspan=1s\n [process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name in (\"cp\", \"mv\", \"cat\") and process.args : (\n // Shells\n \"/bin/*sh\", \"/usr/bin/*sh\", \n\n // Interpreters\n \"/bin/python*\", \"/usr/bin/python*\", \"/bin/php*\", \"/usr/bin/php*\", \"/bin/ruby*\", \"/usr/bin/ruby*\", \"/bin/perl*\",\n \"/usr/bin/perl*\", \"/bin/lua*\", \"/usr/bin/lua*\", \"/bin/java*\", \"/usr/bin/java*\", \n\n // Compilers\n \"/bin/gcc*\", \"/usr/bin/gcc*\", \"/bin/g++*\", \"/usr/bin/g++*\", \"/bin/cc\", \"/usr/bin/cc\",\n\n // Suspicious utilities\n \"/bin/nc\", \"/usr/bin/nc\", \"/bin/ncat\", \"/usr/bin/ncat\", \"/bin/netcat\", \"/usr/bin/netcat\", \"/bin/nc.openbsd\",\n \"/usr/bin/nc.openbsd\", \"/bin/*awk\", \"/usr/bin/*awk\", \"/bin/socat\", \"/usr/bin/socat\", \"/bin/openssl\",\n \"/usr/bin/openssl\", \"/bin/telnet\", \"/usr/bin/telnet\", \"/bin/mkfifo\", \"/usr/bin/mkfifo\", \"/bin/mknod\",\n \"/usr/bin/mknod\", \"/bin/ping*\", \"/usr/bin/ping*\", \"/bin/nmap\", \"/usr/bin/nmap\",\n\n // System utilities\n \"/bin/ls\", \"/usr/bin/ls\", \"/bin/cat\", \"/usr/bin/cat\", \"/bin/mv\", \"/usr/bin/mv\", \"/bin/cp\", \"/usr/bin/cp\",\n \"/bin/sudo\", \"/usr/bin/sudo\", \"/bin/curl\", \"/usr/bin/curl\", \"/bin/wget\", \"/usr/bin/wget\", \"/bin/tmux\",\n \"/usr/bin/tmux\", \"/bin/screen\", \"/usr/bin/screen\", \"/bin/ssh\", \"/usr/bin/ssh\", \"/bin/ftp\", \"/usr/bin/ftp\"\n )]\n [file where host.os.type == \"linux\" and event.action == \"creation\" and file.path : (\n \"/dev/shm/*\", \"/run/shm/*\", \"/tmp/*\", \"/var/tmp/*\", \"/run/*\", \"/var/run/*\", \"/var/www/*\", \"/proc/*/fd/*\"\n )]\n", + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.args", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fda1d332-5e08-4f27-8a9b-8c802e3292a6", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1564", + "name": "Hide Artifacts", + "reference": "https://attack.mitre.org/techniques/T1564/" + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "fda1d332-5e08-4f27-8a9b-8c802e3292a6_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fddff193-48a3-484d-8d35-90bb3d323a56_1.json b/packages/security_detection_engine/kibana/security_rule/fddff193-48a3-484d-8d35-90bb3d323a56_1.json new file mode 100644 index 00000000000..342d79a420d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fddff193-48a3-484d-8d35-90bb3d323a56_1.json @@ -0,0 +1,104 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Detects PowerShell scripts that have the capability of dumping Kerberos tickets from LSA, which potentially indicates an attacker's attempt to acquire credentials for lateral movement.", + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Kerberos Ticket Dump", + "note": "", + "query": "event.category:process and host.os.type:windows and\n powershell.file.script_block_text : (\n \"LsaCallAuthenticationPackage\" and\n (\n \"KerbRetrieveEncodedTicketMessage\" or\n \"KerbQueryTicketCacheMessage\" or\n \"KerbQueryTicketCacheExMessage\" or\n \"KerbQueryTicketCacheEx2Message\" or\n \"KerbRetrieveTicketMessage\" or\n \"KerbDecryptDataMessage\"\n )\n )\n", + "references": [ + "https://github.com/MzHmO/PowershellKerberos/blob/main/dumper.ps1" + ], + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + } + ], + "risk_score": 47, + "rule_id": "fddff193-48a3-484d-8d35-90bb3d323a56", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: PowerShell Logs" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/" + }, + { + "id": "T1558", + "name": "Steal or Forge Kerberos Tickets", + "reference": "https://attack.mitre.org/techniques/T1558/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1059", + "name": "Command and Scripting Interpreter", + "reference": "https://attack.mitre.org/techniques/T1059/", + "subtechnique": [ + { + "id": "T1059.001", + "name": "PowerShell", + "reference": "https://attack.mitre.org/techniques/T1059/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "fddff193-48a3-484d-8d35-90bb3d323a56_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fe25d5bc-01fa-494a-95ff-535c29cc4c96_1.json b/packages/security_detection_engine/kibana/security_rule/fe25d5bc-01fa-494a-95ff-535c29cc4c96_1.json new file mode 100644 index 00000000000..3beb295c861 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fe25d5bc-01fa-494a-95ff-535c29cc4c96_1.json @@ -0,0 +1,82 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies the use of Cmdlets and methods related to remote execution activities using WinRM. Attackers can abuse WinRM to perform lateral movement using built-in tools.", + "from": "now-119m", + "index": [ + "winlogbeat-*", + "logs-windows.*" + ], + "interval": "60m", + "language": "kuery", + "license": "Elastic License v2", + "name": "PowerShell Script with Password Policy Discovery Capabilities", + "note": "", + "query": "event.category: \"process\" and host.os.type:windows and\n(\n powershell.file.script_block_text: (\n \"Get-ADDefaultDomainPasswordPolicy\" or\n \"Get-ADFineGrainedPasswordPolicy\" or\n \"Get-ADUserResultantPasswordPolicy\" or\n \"Get-DomainPolicy\" or\n \"Get-GPPPassword\" or\n \"Get-PassPol\"\n )\n or\n powershell.file.script_block_text: (\n (\"defaultNamingContext\" or \"ActiveDirectory.DirectoryContext\" or \"ActiveDirectory.DirectorySearcher\") and\n (\n (\n \".MinLengthPassword\" or\n \".MinPasswordAge\" or\n \".MaxPasswordAge\"\n ) or\n (\n \"minPwdAge\" or\n \"maxPwdAge\" or\n \"minPwdLength\"\n ) or\n (\n \"msDS-PasswordSettings\"\n )\n )\n )\n) and not powershell.file.script_block_text : (\n \"sentinelbreakpoints\" and \"Set-PSBreakpoint\" and \"PowerSploitIndicators\"\n )\n and not user.id : \"S-1-5-18\"\n", + "related_integrations": [ + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.category", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "powershell.file.script_block_text", + "type": "unknown" + }, + { + "ecs": true, + "name": "user.id", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "fe25d5bc-01fa-494a-95ff-535c29cc4c96", + "setup": "The 'PowerShell Script Block Logging' logging policy must be enabled.\nSteps to implement the logging policy with Advanced Audit Configuration:\n\n```\nComputer Configuration \u003e\nAdministrative Templates \u003e\nWindows PowerShell \u003e\nTurn on PowerShell Script Block Logging (Enable)\n```\n\nSteps to implement the logging policy via registry:\n\n```\nreg add \"hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging\" /v EnableScriptBlockLogging /t REG_DWORD /d 1\n```", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Discovery", + "Data Source: PowerShell Logs", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0007", + "name": "Discovery", + "reference": "https://attack.mitre.org/tactics/TA0007/" + }, + "technique": [ + { + "id": "T1201", + "name": "Password Policy Discovery", + "reference": "https://attack.mitre.org/techniques/T1201/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "query", + "version": 1 + }, + "id": "fe25d5bc-01fa-494a-95ff-535c29cc4c96_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/fe794edd-487f-4a90-b285-3ee54f2af2d3_106.json b/packages/security_detection_engine/kibana/security_rule/fe794edd-487f-4a90-b285-3ee54f2af2d3_106.json new file mode 100644 index 00000000000..c7efacaa31e --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/fe794edd-487f-4a90-b285-3ee54f2af2d3_106.json @@ -0,0 +1,98 @@ +{ + "attributes": { + "author": [ + "Austin Songer" + ], + "description": "Identifies when one or more features on Microsoft Defender are disabled. Adversaries may disable or tamper with Microsoft Defender features to evade detection and conceal malicious behavior.", + "false_positives": [ + "Legitimate Windows Defender configuration changes" + ], + "from": "now-9m", + "index": [ + "winlogbeat-*", + "logs-endpoint.events.*", + "logs-windows.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Microsoft Windows Defender Tampering", + "note": "## Triage and analysis\n\n### Investigating Microsoft Windows Defender Tampering\n\nMicrosoft Windows Defender is an antivirus product built into Microsoft Windows, which makes it popular across multiple environments. Disabling it is a common step in threat actor playbooks.\n\nThis rule monitors the registry for modifications that disable Windows Defender features.\n\n#### Possible investigation steps\n\n- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.\n- Validate the activity is not related to planned patches, updates, network administrator activity, or legitimate software installations.\n- Identify the user account that performed the action and whether it should perform this kind of action.\n- Contact the account owner and confirm whether they are aware of this activity.\n- Investigate other alerts associated with the user/host during the past 48 hours.\n- Examine which features have been disabled, and check if this operation is done under change management and approved according to the organization's policy.\n\n### False positive analysis\n\n- This mechanism can be used legitimately. Analysts can dismiss the alert if the administrator is aware of the activity, the configuration is justified (for example, it is being used to deploy other security solutions or troubleshooting), and no other suspicious activity has been observed.\n\n### Related rules\n\n- Windows Defender Disabled via Registry Modification - 2ffa1f1e-b6db-47fa-994b-1512743847eb\n- Disabling Windows Defender Security Settings via PowerShell - c8cccb06-faf2-4cd5-886e-2c9636cfcb87\n\n### Response and remediation\n\n- Initiate the incident response process based on the outcome of the triage.\n- Isolate the involved hosts to prevent further post-compromise behavior.\n- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.\n- Take actions to restore the appropriate Windows Defender antivirus configurations.\n- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.\n- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.\n- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.\n- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).", + "query": "registry where host.os.type == \"windows\" and event.type in (\"creation\", \"change\") and\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\PUAProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender Security Center\\\\App and Browser protection\\\\DisallowExploitProtectionOverride\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\DisableAntiSpyware\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Features\\\\TamperProtection\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableRealtimeMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIntrusionPreventionSystem\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableScriptScanning\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Windows Defender Exploit Guard\\\\Controlled Folder Access\\\\EnableControlledFolderAccess\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableIOAVProtection\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Reporting\\\\DisableEnhancedNotifications\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\DisableBlockAtFirstSeen\" and\n registry.data.strings : (\"1\", \"0x00000001\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SpynetReporting\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\SpyNet\\\\SubmitSamplesConsent\" and\n registry.data.strings : (\"0\", \"0x00000000\")) or\n (registry.path : \"HKLM\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows Defender\\\\Real-Time Protection\\\\DisableBehaviorMonitoring\" and\n registry.data.strings : (\"1\", \"0x00000001\"))\n", + "references": [ + "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", + "https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html", + "https://www.tenforums.com/tutorials/104025-turn-off-core-isolation-memory-integrity-windows-10-a.html", + "https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html", + "https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html", + "https://www.tenforums.com/tutorials/51514-turn-off-microsoft-defender-periodic-scanning-windows-10-a.html", + "https://www.tenforums.com/tutorials/3569-turn-off-real-time-protection-microsoft-defender-antivirus.html", + "https://www.tenforums.com/tutorials/99576-how-schedule-scan-microsoft-defender-antivirus-windows-10-a.html" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + }, + { + "package": "windows", + "version": "^1.5.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "registry.data.strings", + "type": "wildcard" + }, + { + "ecs": true, + "name": "registry.path", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "fe794edd-487f-4a90-b285-3ee54f2af2d3", + "setup": "If enabling an EQL rule on a non-elastic-agent index (such as beats) for versions \u003c8.2, events will not define `event.ingested` and default fallback for EQL rules was not added until 8.2, so you will need to add a custom pipeline to populate `event.ingested` to @timestamp for this rule to work.", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Resources: Investigation Guide", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1562", + "name": "Impair Defenses", + "reference": "https://attack.mitre.org/techniques/T1562/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 106 + }, + "id": "fe794edd-487f-4a90-b285-3ee54f2af2d3_106", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/feafdc51-c575-4ed2-89dd-8e20badc2d6c_1.json b/packages/security_detection_engine/kibana/security_rule/feafdc51-c575-4ed2-89dd-8e20badc2d6c_1.json new file mode 100644 index 00000000000..d719b2a55f7 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/feafdc51-c575-4ed2-89dd-8e20badc2d6c_1.json @@ -0,0 +1,111 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "building_block_type": "default", + "description": "Identifies executables with names resembling legitimate business applications but lacking signatures from the original developer. Attackers may trick users into downloading malicious executables that masquerade as legitimate applications via malicious ads, forum posts, and tutorials, effectively gaining initial access.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Masquerading as Business App Installer", + "query": "process where host.os.type == \"windows\" and\n event.type == \"start\" and process.executable : \"?:\\\\Users\\\\*\\\\Downloads\\\\*\" and\n not process.code_signature.status : (\"errorCode_endpoint*\", \"errorUntrustedRoot\", \"errorChaining\") and\n (\n /* Slack */\n (process.name : \"*slack*.exe\" and not\n (process.code_signature.subject_name in (\n \"Slack Technologies, Inc.\",\n \"Slack Technologies, LLC\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* WebEx */\n (process.name : \"*webex*.exe\" and not\n (process.code_signature.subject_name in (\"Cisco WebEx LLC\", \"Cisco Systems, Inc.\") and process.code_signature.trusted == true)\n ) or\n\n /* Teams */\n (process.name : \"teams*.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Discord */\n (process.name : \"*discord*.exe\" and not\n (process.code_signature.subject_name == \"Discord Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* WhatsApp */\n (process.name : \"*whatsapp*.exe\" and not\n (process.code_signature.subject_name in (\n \"WhatsApp LLC\",\n \"WhatsApp, Inc\",\n \"24803D75-212C-471A-BC57-9EF86AB91435\"\n ) and process.code_signature.trusted == true)\n ) or\n\n /* Zoom */\n (process.name : (\"*zoom*installer*.exe\", \"*zoom*setup*.exe\", \"zoom.exe\") and not\n (process.code_signature.subject_name == \"Zoom Video Communications, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Outlook */\n (process.name : \"*outlook*.exe\" and not\n (\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true) or\n (\n process.name: \"MSOutlookHelp-PST-Viewer.exe\" and process.code_signature.subject_name == \"Aryson Technologies Pvt. Ltd\" and\n process.code_signature.trusted == true\n )\n )\n ) or\n\n /* Thunderbird */\n (process.name : \"*thunderbird*.exe\" and not\n (process.code_signature.subject_name == \"Mozilla Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Grammarly */\n (process.name : \"*grammarly*.exe\" and not\n (process.code_signature.subject_name == \"Grammarly, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Dropbox */\n (process.name : \"*dropbox*.exe\" and not\n (process.code_signature.subject_name == \"Dropbox, Inc\" and process.code_signature.trusted == true)\n ) or\n\n /* Tableau */\n (process.name : \"*tableau*.exe\" and not\n (process.code_signature.subject_name == \"Tableau Software LLC\" and process.code_signature.trusted == true)\n ) or\n\n /* Google Drive */\n (process.name : \"*googledrive*.exe\" and not\n (process.code_signature.subject_name == \"Google LLC\" and process.code_signature.trusted == true)\n ) or\n\n /* MSOffice */\n (process.name : \"*office*setup*.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Okta */\n (process.name : \"*okta*.exe\" and not\n (process.code_signature.subject_name == \"Okta, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* OneDrive */\n (process.name : \"*onedrive*.exe\" and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Chrome */\n (process.name : \"*chrome*.exe\" and not\n (process.code_signature.subject_name in (\"Google LLC\", \"Google Inc\") and process.code_signature.trusted == true)\n ) or\n\n /* Firefox */\n (process.name : \"*firefox*.exe\" and not\n (process.code_signature.subject_name == \"Mozilla Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Edge */\n (process.name : (\"*microsoftedge*.exe\", \"*msedge*.exe\") and not\n (process.code_signature.subject_name == \"Microsoft Corporation\" and process.code_signature.trusted == true)\n ) or\n\n /* Brave */\n (process.name : \"*brave*.exe\" and not\n (process.code_signature.subject_name == \"Brave Software, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* GoogleCloud Related Tools */\n (process.name : \"*GoogleCloud*.exe\" and not\n (process.code_signature.subject_name == \"Google LLC\" and process.code_signature.trusted == true)\n ) or\n\n /* Github Related Tools */\n (process.name : \"*github*.exe\" and not\n (process.code_signature.subject_name == \"GitHub, Inc.\" and process.code_signature.trusted == true)\n ) or\n\n /* Notion */\n (process.name : \"*notion*.exe\" and not\n (process.code_signature.subject_name == \"Notion Labs, Inc.\" and process.code_signature.trusted == true)\n )\n )\n", + "references": [ + "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.status", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.subject_name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.code_signature.trusted", + "type": "boolean" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 21, + "rule_id": "feafdc51-c575-4ed2-89dd-8e20badc2d6c", + "severity": "low", + "tags": [ + "Domain: Endpoint", + "Data Source: Elastic Defend", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", + "Rule Type: BBR" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0005", + "name": "Defense Evasion", + "reference": "https://attack.mitre.org/tactics/TA0005/" + }, + "technique": [ + { + "id": "T1036", + "name": "Masquerading", + "reference": "https://attack.mitre.org/techniques/T1036/" + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0001", + "name": "Initial Access", + "reference": "https://attack.mitre.org/tactics/TA0001/" + }, + "technique": [ + { + "id": "T1189", + "name": "Drive-by Compromise", + "reference": "https://attack.mitre.org/techniques/T1189/" + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 1 + }, + "id": "feafdc51-c575-4ed2-89dd-8e20badc2d6c_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_3.json b/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_3.json new file mode 100644 index 00000000000..aec110bc0c3 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_3.json @@ -0,0 +1,143 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Linux cron jobs are scheduled tasks that can be leveraged by malicious actors for persistence, privilege escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Cron Job Created or Changed by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type : \"linux\" and event.action : (\"change\" or \"file_modify_event\" or \"creation\" or \"file_create_event\") and \nfile.path : (/etc/cron.allow or /etc/cron.deny or /etc/cron.d/* or /etc/cron.hourly/* or /etc/cron.daily/* or \n/etc/cron.weekly/* or /etc/cron.monthly/* or /etc/crontab or /usr/sbin/cron or /usr/sbin/anacron) \nand not (process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"snapd\" or \"yum\" or \"exe\" or \"dnf\" or \"5\") or \nfile.extension : (\"swp\" or \"swx\"))\n", + "references": [ + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ff10d4d8-fea7-422d-afb1-e5a2702369a9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Execution", + "Data Source: Elastic Endgame" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 3 + }, + "id": "ff10d4d8-fea7-422d-afb1-e5a2702369a9_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_4.json b/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_4.json new file mode 100644 index 00000000000..6f3dcaf5d2d --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ff10d4d8-fea7-422d-afb1-e5a2702369a9_4.json @@ -0,0 +1,144 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Linux cron jobs are scheduled tasks that can be leveraged by malicious actors for persistence, privilege escalation and command execution. By creating or modifying cron job configurations, attackers can execute malicious commands or scripts at predefined intervals, ensuring their continued presence and enabling unauthorized activities.", + "from": "now-9m", + "history_window_start": "now-7d", + "index": [ + "logs-endpoint.events.*", + "endgame-*" + ], + "language": "kuery", + "license": "Elastic License v2", + "name": "Cron Job Created or Changed by Previously Unknown Process", + "new_terms_fields": [ + "file.path", + "process.name" + ], + "query": "host.os.type : \"linux\" and event.action : (\"change\" or \"file_modify_event\" or \"creation\" or \"file_create_event\") and \nfile.path : (/etc/cron.allow or /etc/cron.deny or /etc/cron.d/* or /etc/cron.hourly/* or /etc/cron.daily/* or \n/etc/cron.weekly/* or /etc/cron.monthly/* or /etc/crontab or /usr/sbin/cron or /usr/sbin/anacron) \nand not (process.name : (\"dpkg\" or \"dockerd\" or \"rpm\" or \"snapd\" or \"yum\" or \"exe\" or \"dnf\" or \"5\") or \nfile.extension : (\"swp\" or \"swx\"))\n", + "references": [ + "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.extension", + "type": "keyword" + }, + { + "ecs": true, + "name": "file.path", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ff10d4d8-fea7-422d-afb1-e5a2702369a9", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Tactic: Privilege Escalation", + "Tactic: Execution", + "Data Source: Elastic Endgame", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0003", + "name": "Persistence", + "reference": "https://attack.mitre.org/tactics/TA0003/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + }, + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0002", + "name": "Execution", + "reference": "https://attack.mitre.org/tactics/TA0002/" + }, + "technique": [ + { + "id": "T1053", + "name": "Scheduled Task/Job", + "reference": "https://attack.mitre.org/techniques/T1053/", + "subtechnique": [ + { + "id": "T1053.003", + "name": "Cron", + "reference": "https://attack.mitre.org/techniques/T1053/003/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "new_terms", + "version": 4 + }, + "id": "ff10d4d8-fea7-422d-afb1-e5a2702369a9_4", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ff4599cb-409f-4910-a239-52e4e6f532ff_3.json b/packages/security_detection_engine/kibana/security_rule/ff4599cb-409f-4910-a239-52e4e6f532ff_3.json new file mode 100644 index 00000000000..56b2e2705ef --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ff4599cb-409f-4910-a239-52e4e6f532ff_3.json @@ -0,0 +1,86 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "Identifies access attempts to the LSASS handle, which may indicate an attempt to dump credentials from LSASS memory.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "LSASS Process Access via Windows API", + "query": "api where host.os.type == \"windows\" and \n process.Ext.api.name in (\"OpenProcess\", \"OpenThread\") and Target.process.name : \"lsass.exe\" and \n not process.executable : \n (\"?:\\\\ProgramData\\\\Microsoft\\\\Windows Defender\\\\Platform\\\\*\\\\MsMpEng.exe\", \n \"?:\\\\Program Files\\\\Microsoft Security Client\\\\MsMpEng.exe\", \n \"?:\\\\Program Files*\\\\Windows Defender\\\\MsMpEng.exe\", \n \"?:\\\\Program Files (x86)\\\\N-able Technologies\\\\Windows Agent\\\\bin\\\\agent.exe\", \n \"?:\\\\Windows\\\\System32\\\\wbem\\\\WmiPrvSE.exe\", \n \"?:\\\\Windows\\\\SysWOW64\\\\wbem\\\\WmiPrvSE.exe\",\n \"?:\\\\Program Files\\\\VMware\\\\VMware Tools\\\\vmtoolsd.exe\", \n \"?:\\\\Program Files (x86)\\\\N-able Technologies\\\\Reactive\\\\bin\\\\NableReactiveManagement.exe\", \n \"?:\\\\Program Files\\\\EA\\\\AC\\\\EAAntiCheat.GameService.exe\", \n \"?:\\\\Program Files\\\\Cisco\\\\AMP\\\\*\\\\sfc.exe\", \n \"?:\\\\Program Files\\\\TDAgent\\\\ossec-agent\\\\ossec-agent.exe\", \n \"?:\\\\Windows\\\\System32\\\\MRT.exe\", \n \"?:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\elastic-agent-*\\\\components\\\\metricbeat.exe\", \n \"?:\\\\Program Files\\\\Elastic\\\\Agent\\\\data\\\\elastic-agent-*\\\\components\\\\osqueryd.exe\", \n \"?:\\\\Windows\\\\System32\\\\msiexec.exe\", \n \"?:\\\\Program Files\\\\Common Files\\\\McAfee\\\\AVSolution\\\\mcshield.exe\", \n \"?:\\\\Program Files\\\\Fortinet\\\\FortiClient\\\\FortiProxy.exe\", \n \"?:\\\\Program Files\\\\LogicMonitor\\\\Agent\\\\bin\\\\sbshutdown.exe\", \n \"?:\\\\Program Files (x86)\\\\Google\\\\Update\\\\GoogleUpdate.exe\", \n \"?:\\\\Program Files (x86)\\\\Blackpoint\\\\SnapAgent\\\\SnapAgent.exe\", \n \"?:\\\\Program Files\\\\ESET\\\\ESET Security\\\\ekrn.exe\", \n \"?:\\\\Program Files\\\\Huntress\\\\HuntressAgent.exe\", \n \"?:\\\\Program Files (x86)\\\\eScan\\\\reload.exe\", \n \"?:\\\\Program Files\\\\Topaz OFD\\\\Warsaw\\\\core.exe\")\n", + "references": [ + "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": false, + "name": "Target.process.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.Ext.api.name", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.executable", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ff4599cb-409f-4910-a239-52e4e6f532ff", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Windows", + "Use Case: Threat Detection", + "Tactic: Credential Access", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0006", + "name": "Credential Access", + "reference": "https://attack.mitre.org/tactics/TA0006/" + }, + "technique": [ + { + "id": "T1003", + "name": "OS Credential Dumping", + "reference": "https://attack.mitre.org/techniques/T1003/", + "subtechnique": [ + { + "id": "T1003.001", + "name": "LSASS Memory", + "reference": "https://attack.mitre.org/techniques/T1003/001/" + } + ] + } + ] + } + ], + "timestamp_override": "event.ingested", + "type": "eql", + "version": 3 + }, + "id": "ff4599cb-409f-4910-a239-52e4e6f532ff_3", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_1.json b/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_1.json new file mode 100644 index 00000000000..b5c920b87b1 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_1.json @@ -0,0 +1,116 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects potential sudo token manipulation attacks through process injection by monitoring the use of a debugger (gdb) process followed by a successful uid change event during the execution of the sudo process. A sudo token manipulation attack is performed by injecting into a process that has a valid sudo token, which can then be used by attackers to activate their own sudo token. This attack requires ptrace to be enabled in conjunction with the existence of a living process that has a valid sudo token with the same uid as the current user.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Sudo Token Manipulation via Process Injection", + "query": "sequence by host.id, process.session_leader.entity_id with maxspan=15s\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"gdb\" and process.user.id != \"0\" and process.group.id != \"0\" ]\n[ process where host.os.type == \"linux\" and event.action == \"uid_change\" and event.type == \"change\" and \n process.name == \"sudo\" and process.user.id == \"0\" and process.group.id == \"0\" ]\n", + "references": [ + "https://github.com/nongiach/sudo_inject" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.group.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.session_leader.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/", + "subtechnique": [ + { + "id": "T1055.008", + "name": "Ptrace System Calls", + "reference": "https://attack.mitre.org/techniques/T1055/008/" + } + ] + }, + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 1 + }, + "id": "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_1", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_2.json b/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_2.json new file mode 100644 index 00000000000..a476b434b75 --- /dev/null +++ b/packages/security_detection_engine/kibana/security_rule/ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_2.json @@ -0,0 +1,117 @@ +{ + "attributes": { + "author": [ + "Elastic" + ], + "description": "This rule detects potential sudo token manipulation attacks through process injection by monitoring the use of a debugger (gdb) process followed by a successful uid change event during the execution of the sudo process. A sudo token manipulation attack is performed by injecting into a process that has a valid sudo token, which can then be used by attackers to activate their own sudo token. This attack requires ptrace to be enabled in conjunction with the existence of a living process that has a valid sudo token with the same uid as the current user.", + "from": "now-9m", + "index": [ + "logs-endpoint.events.*" + ], + "language": "eql", + "license": "Elastic License v2", + "name": "Potential Sudo Token Manipulation via Process Injection", + "query": "sequence by host.id, process.session_leader.entity_id with maxspan=15s\n[ process where host.os.type == \"linux\" and event.action == \"exec\" and event.type == \"start\" and \n process.name == \"gdb\" and process.user.id != \"0\" and process.group.id != \"0\" ]\n[ process where host.os.type == \"linux\" and event.action == \"uid_change\" and event.type == \"change\" and \n process.name == \"sudo\" and process.user.id == \"0\" and process.group.id == \"0\" ]\n", + "references": [ + "https://github.com/nongiach/sudo_inject" + ], + "related_integrations": [ + { + "package": "endpoint", + "version": "^8.2.0" + } + ], + "required_fields": [ + { + "ecs": true, + "name": "event.action", + "type": "keyword" + }, + { + "ecs": true, + "name": "event.type", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.id", + "type": "keyword" + }, + { + "ecs": true, + "name": "host.os.type", + "type": "keyword" + }, + { + "ecs": false, + "name": "process.group.id", + "type": "unknown" + }, + { + "ecs": true, + "name": "process.name", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.session_leader.entity_id", + "type": "keyword" + }, + { + "ecs": true, + "name": "process.user.id", + "type": "keyword" + } + ], + "risk_score": 47, + "rule_id": "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b", + "severity": "medium", + "tags": [ + "Domain: Endpoint", + "OS: Linux", + "Use Case: Threat Detection", + "Tactic: Privilege Escalation", + "Data Source: Elastic Defend" + ], + "threat": [ + { + "framework": "MITRE ATT\u0026CK", + "tactic": { + "id": "TA0004", + "name": "Privilege Escalation", + "reference": "https://attack.mitre.org/tactics/TA0004/" + }, + "technique": [ + { + "id": "T1055", + "name": "Process Injection", + "reference": "https://attack.mitre.org/techniques/T1055/", + "subtechnique": [ + { + "id": "T1055.008", + "name": "Ptrace System Calls", + "reference": "https://attack.mitre.org/techniques/T1055/008/" + } + ] + }, + { + "id": "T1548", + "name": "Abuse Elevation Control Mechanism", + "reference": "https://attack.mitre.org/techniques/T1548/", + "subtechnique": [ + { + "id": "T1548.003", + "name": "Sudo and Sudo Caching", + "reference": "https://attack.mitre.org/techniques/T1548/003/" + } + ] + } + ] + } + ], + "type": "eql", + "version": 2 + }, + "id": "ff9bc8b9-f03b-4283-be58-ee0a16f5a11b_2", + "type": "security-rule" +} \ No newline at end of file diff --git a/packages/security_detection_engine/manifest.yml b/packages/security_detection_engine/manifest.yml index 0c0a949e087..dc268f982ec 100644 --- a/packages/security_detection_engine/manifest.yml +++ b/packages/security_detection_engine/manifest.yml @@ -1,7 +1,7 @@ categories: - security conditions: - kibana.version: ^8.9.0 + kibana.version: ^8.10.1 description: Prebuilt detection rules for Elastic Security format_version: 1.0.0 icons: @@ -15,4 +15,4 @@ owner: release: ga title: Prebuilt Security Detection Rules type: integration -version: 8.9.1 +version: 8.10.3 diff --git a/packages/sentinel_one/_dev/build/build.yml b/packages/sentinel_one/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/sentinel_one/_dev/build/build.yml +++ b/packages/sentinel_one/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/sentinel_one/changelog.yml b/packages/sentinel_one/changelog.yml index 4aa1446b35d..3eaec7d6f46 100644 --- a/packages/sentinel_one/changelog.yml +++ b/packages/sentinel_one/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.11.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6932 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/sentinel_one/data_stream/activity/_dev/test/pipeline/test-pipeline-activity.log-expected.json b/packages/sentinel_one/data_stream/activity/_dev/test/pipeline/test-pipeline-activity.log-expected.json index f6d9cb023f7..a7a225eed03 100644 --- a/packages/sentinel_one/data_stream/activity/_dev/test/pipeline/test-pipeline-activity.log-expected.json +++ b/packages/sentinel_one/data_stream/activity/_dev/test/pipeline/test-pipeline-activity.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-04-18T05:14:08.925Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ { "@timestamp": "2022-04-18T05:14:09.240Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -149,7 +149,7 @@ { "@timestamp": "2022-04-05T16:11:05.469Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -209,7 +209,7 @@ { "@timestamp": "2022-04-06T08:26:45.579Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -297,7 +297,7 @@ { "@timestamp": "2022-04-06T08:26:45.582Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -362,7 +362,7 @@ { "@timestamp": "2022-04-06T08:26:52.843Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -435,7 +435,7 @@ { "@timestamp": "2022-04-06T08:45:43.122Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -519,7 +519,7 @@ { "@timestamp": "2022-04-06T08:45:54.532Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -609,7 +609,7 @@ { "@timestamp": "2022-04-06T08:45:55.309Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -703,7 +703,7 @@ { "@timestamp": "2022-04-06T08:45:56.634Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -796,7 +796,7 @@ { "@timestamp": "2022-04-06T08:45:56.641Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -890,7 +890,7 @@ { "@timestamp": "2022-04-06T08:46:08.135Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -974,7 +974,7 @@ { "@timestamp": "2022-04-06T08:51:09.416Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1033,7 +1033,7 @@ { "@timestamp": "2022-04-06T08:51:09.416Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1101,7 +1101,7 @@ { "@timestamp": "2022-04-06T08:57:37.680Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1202,7 +1202,7 @@ { "@timestamp": "2022-04-06T08:59:41.758Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1262,7 +1262,7 @@ { "@timestamp": "2022-04-06T08:26:45.579Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1350,7 +1350,7 @@ { "@timestamp": "2022-04-05T16:01:56.995Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1406,7 +1406,7 @@ { "@timestamp": "2022-04-06T09:00:33.115Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1490,7 +1490,7 @@ { "@timestamp": "2022-04-13T03:34:10.933Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1571,7 +1571,7 @@ { "@timestamp": "2022-04-18T05:09:27.532Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1632,7 +1632,7 @@ { "@timestamp": "2022-04-18T05:09:27.534Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1696,7 +1696,7 @@ { "@timestamp": "2022-04-05T16:11:05.469Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1756,7 +1756,7 @@ { "@timestamp": "2022-04-05T16:11:05.469Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1817,7 +1817,7 @@ { "@timestamp": "2022-04-05T16:11:05.469Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1868,7 +1868,7 @@ { "@timestamp": "2022-04-05T16:11:05.469Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -1919,7 +1919,7 @@ { "@timestamp": "2022-04-06T08:45:54.532Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one/data_stream/activity/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one/data_stream/activity/elasticsearch/ingest_pipeline/default.yml index e5a70d559fa..f2f0a489282 100644 --- a/packages/sentinel_one/data_stream/activity/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one/data_stream/activity/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing activity logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/sentinel_one/data_stream/activity/sample_event.json b/packages/sentinel_one/data_stream/activity/sample_event.json index ebddf52e1bf..8fa0983c2b5 100644 --- a/packages/sentinel_one/data_stream/activity/sample_event.json +++ b/packages/sentinel_one/data_stream/activity/sample_event.json @@ -14,7 +14,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", diff --git a/packages/sentinel_one/data_stream/agent/_dev/test/pipeline/test-pipeline-agent.log-expected.json b/packages/sentinel_one/data_stream/agent/_dev/test/pipeline/test-pipeline-agent.log-expected.json index c3583a5fbd6..7c7d730dd64 100644 --- a/packages/sentinel_one/data_stream/agent/_dev/test/pipeline/test-pipeline-agent.log-expected.json +++ b/packages/sentinel_one/data_stream/agent/_dev/test/pipeline/test-pipeline-agent.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-04-07T08:31:47.481Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml index 1b02bfb85c3..e7ca0e0d9b8 100644 --- a/packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one/data_stream/agent/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing agent logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/sentinel_one/data_stream/agent/sample_event.json b/packages/sentinel_one/data_stream/agent/sample_event.json index c5a3a4d9f9a..34dd4886de7 100644 --- a/packages/sentinel_one/data_stream/agent/sample_event.json +++ b/packages/sentinel_one/data_stream/agent/sample_event.json @@ -14,7 +14,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", diff --git a/packages/sentinel_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json b/packages/sentinel_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json index a66ecea6e29..5601361a65a 100644 --- a/packages/sentinel_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json +++ b/packages/sentinel_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json @@ -25,7 +25,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index c4ad31fa4ce..8c09b45ee99 100644 --- a/packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/sentinel_one/data_stream/alert/sample_event.json b/packages/sentinel_one/data_stream/alert/sample_event.json index 9e25753757b..ffec3400785 100644 --- a/packages/sentinel_one/data_stream/alert/sample_event.json +++ b/packages/sentinel_one/data_stream/alert/sample_event.json @@ -36,7 +36,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", diff --git a/packages/sentinel_one/data_stream/group/_dev/test/pipeline/test-pipeline-group.log-expected.json b/packages/sentinel_one/data_stream/group/_dev/test/pipeline/test-pipeline-group.log-expected.json index 1bfdcc35cd2..cd926596ef0 100644 --- a/packages/sentinel_one/data_stream/group/_dev/test/pipeline/test-pipeline-group.log-expected.json +++ b/packages/sentinel_one/data_stream/group/_dev/test/pipeline/test-pipeline-group.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-04-05T16:01:57.564Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one/data_stream/group/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one/data_stream/group/elasticsearch/ingest_pipeline/default.yml index 5b6f32d4663..3745f2315c0 100644 --- a/packages/sentinel_one/data_stream/group/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one/data_stream/group/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing group logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event diff --git a/packages/sentinel_one/data_stream/group/sample_event.json b/packages/sentinel_one/data_stream/group/sample_event.json index bf3563aeaf5..19bb152087e 100644 --- a/packages/sentinel_one/data_stream/group/sample_event.json +++ b/packages/sentinel_one/data_stream/group/sample_event.json @@ -14,7 +14,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", diff --git a/packages/sentinel_one/data_stream/threat/_dev/test/pipeline/test-pipeline-threat.log-expected.json b/packages/sentinel_one/data_stream/threat/_dev/test/pipeline/test-pipeline-threat.log-expected.json index 55c874f6a3a..b4c6aaa0192 100644 --- a/packages/sentinel_one/data_stream/threat/_dev/test/pipeline/test-pipeline-threat.log-expected.json +++ b/packages/sentinel_one/data_stream/threat/_dev/test/pipeline/test-pipeline-threat.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-04-06T08:54:17.194Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SentinelOne Cloud", @@ -247,7 +247,7 @@ { "@timestamp": "2022-04-06T08:57:37.672Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Documents, Scripts,On-Write ABC", @@ -536,7 +536,7 @@ { "@timestamp": "2022-04-06T08:57:37.672Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Documents, Scripts,On-Write ABC", @@ -825,7 +825,7 @@ { "@timestamp": "2022-04-06T08:57:37.672Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Documents, Scripts,On-Write ABC", @@ -1114,7 +1114,7 @@ { "@timestamp": "2022-04-06T08:57:37.672Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Documents, Scripts,On-Write ABC", diff --git a/packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index 84d55f8ce9b..a38b59922ca 100644 --- a/packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing threat logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: alert diff --git a/packages/sentinel_one/data_stream/threat/sample_event.json b/packages/sentinel_one/data_stream/threat/sample_event.json index 6f1c9081bc3..dd97a841a61 100644 --- a/packages/sentinel_one/data_stream/threat/sample_event.json +++ b/packages/sentinel_one/data_stream/threat/sample_event.json @@ -14,7 +14,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", diff --git a/packages/sentinel_one/docs/README.md b/packages/sentinel_one/docs/README.md index 879377d8315..4718e5186b2 100644 --- a/packages/sentinel_one/docs/README.md +++ b/packages/sentinel_one/docs/README.md @@ -44,7 +44,7 @@ An example event for `activity` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", @@ -136,9 +136,9 @@ An example event for `activity` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -263,7 +263,7 @@ An example event for `agent` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", @@ -462,9 +462,9 @@ An example event for `agent` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -632,7 +632,7 @@ An example event for `alert` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", @@ -897,10 +897,10 @@ An example event for `alert` looks as following: | dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1060,7 +1060,7 @@ An example event for `group` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", @@ -1145,9 +1145,9 @@ An example event for `group` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1214,7 +1214,7 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b87eb683-6c5a-4db7-86d4-96694d38752b", @@ -1494,10 +1494,10 @@ An example event for `threat` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/sentinel_one/kibana/dashboard/sentinel_one-0dd17490-bbb8-11ec-82b7-8fcb232e9538.json b/packages/sentinel_one/kibana/dashboard/sentinel_one-0dd17490-bbb8-11ec-82b7-8fcb232e9538.json index f08c3cea9fe..99e8ccffd8a 100644 --- a/packages/sentinel_one/kibana/dashboard/sentinel_one-0dd17490-bbb8-11ec-82b7-8fcb232e9538.json +++ b/packages/sentinel_one/kibana/dashboard/sentinel_one-0dd17490-bbb8-11ec-82b7-8fcb232e9538.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -57,7 +58,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "58329672-9ca4-4454-9d78-c619ef956a6a": { "columnOrder": [ @@ -87,12 +88,15 @@ "visualization": { "accessor": "d8990d07-439a-4335-9646-8fbcab6e268d", "layerId": "58329672-9ca4-4454-9d78-c619ef956a6a", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Number of Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -105,7 +109,7 @@ }, "panelIndex": "ac59079e-c791-449b-aeeb-d47504921dff", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -130,7 +134,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "01d7bdc3-638b-4d23-9ae6-d24678743470": { "columnOrder": [ @@ -160,7 +164,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": false, "params": { @@ -182,12 +186,15 @@ "visualization": { "accessor": "831e34ee-b0d6-44b1-81b7-2bfee2a628ab", "layerId": "01d7bdc3-638b-4d23-9ae6-d24678743470", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Resolved Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -200,7 +207,7 @@ }, "panelIndex": "1684da14-7484-42a6-91d6-b9659883e20d", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -225,7 +232,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8a4ab761-ffa9-4e3d-bd66-9cf0b7ee9849": { "columnOrder": [ @@ -255,7 +262,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": false, "params": { @@ -277,12 +284,15 @@ "visualization": { "accessor": "f3d83b7a-fc35-4c85-83f8-b41e12baddf6", "layerId": "8a4ab761-ffa9-4e3d-bd66-9cf0b7ee9849", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unresolved Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -297,7 +307,7 @@ "panelIndex": "030f8164-5e7d-4fb6-a779-d0537748a819", "title": "Total Unresolved Threats [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -327,7 +337,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6f8f021f-aef7-458f-a0bb-445bd78741db": { "columnOrder": [ @@ -357,7 +367,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": false, "params": { @@ -378,7 +388,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "sentinel_one.threat.mitigation.status", "negate": false, "params": { @@ -400,12 +410,15 @@ "visualization": { "accessor": "1ede434b-a316-4e79-85b6-ffbfc41f379a", "layerId": "6f8f021f-aef7-458f-a0bb-445bd78741db", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Active Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -420,7 +433,7 @@ "panelIndex": "075409b1-9d74-4399-8348-3101a2d22392", "title": "Active Threats [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -450,7 +463,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "31be526e-c389-4f6d-93e8-27f1b7dcd0d0": { "columnOrder": [ @@ -480,7 +493,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": true, "params": { @@ -501,7 +514,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "sentinel_one.threat.mitigation.status", "negate": false, "params": { @@ -523,12 +536,15 @@ "visualization": { "accessor": "8ae53844-358d-4472-9d64-d7c2708fc29c", "layerId": "31be526e-c389-4f6d-93e8-27f1b7dcd0d0", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Blocked Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -543,7 +559,7 @@ "panelIndex": "3ff8c08e-3a29-488c-b481-9b51accaae95", "title": "Total Blocked Threats [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -573,7 +589,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1c27890e-f153-4984-8c2f-6004a3779f71": { "columnOrder": [ @@ -603,7 +619,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.mitigation.status", "negate": false, "params": { @@ -624,7 +640,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "sentinel_one.threat.incident.status", "negate": true, "params": { @@ -646,12 +662,15 @@ "visualization": { "accessor": "eb8375d7-8836-43bb-840a-88c8c2f11b43", "layerId": "1c27890e-f153-4984-8c2f-6004a3779f71", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Mitigated Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -666,7 +685,7 @@ "panelIndex": "d2411b38-52ad-47c2-b364-f1f42b7cd26a", "title": "Total Mitigated Threats [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -696,7 +715,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "98a05273-ef46-4b59-8caa-86b7de9c9724": { "columnOrder": [ @@ -726,7 +745,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": true, "params": { @@ -747,7 +766,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "sentinel_one.agent.console_migration_status", "negate": false, "params": { @@ -769,12 +788,15 @@ "visualization": { "accessor": "9295a43b-ccd0-4d23-abf8-73586af8dac7", "layerId": "98a05273-ef46-4b59-8caa-86b7de9c9724", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Detected - Suspicious Threats [Logs SentinelOne]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -789,7 +811,110 @@ "panelIndex": "14069c35-b940-4540-82f8-1ef2bb73dfe1", "title": "Total Detected - Suspicious Threats [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-current-indexpattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ec6bf891-aedf-4b92-af42-54c04e749174", + "type": "index-pattern" + } + ], + "state": { + "datasourceStates": { + "formBased": { + "layers": { + "ec6bf891-aedf-4b92-af42-54c04e749174": { + "columnOrder": [ + "7dc311c6-df3f-40ca-88e5-3925010191be", + "9934d429-8319-435c-8c72-57a56541dfcb" + ], + "columns": { + "7dc311c6-df3f-40ca-88e5-3925010191be": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Engine Detections", + "operationType": "terms", + "params": { + "missingBucket": false, + "orderBy": { + "columnId": "9934d429-8319-435c-8c72-57a56541dfcb", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "sentinel_one.threat.detection.engines.title" + }, + "9934d429-8319-435c-8c72-57a56541dfcb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "unique_count", + "scale": "ratio", + "sourceField": "sentinel_one.threat.id" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "ec6bf891-aedf-4b92-af42-54c04e749174", + "layerType": "data", + "legendDisplay": "default", + "legendSize": "auto", + "metrics": [ + "9934d429-8319-435c-8c72-57a56541dfcb" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7dc311c6-df3f-40ca-88e5-3925010191be" + ] + } + ], + "shape": "pie" + } + }, + "title": "Distribution of Detections by Engine [Logs SentinelOne]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 15, + "i": "14523f88-ccbb-45bc-9758-7263315630cb", + "w": 24, + "x": 0, + "y": 14 + }, + "panelIndex": "14523f88-ccbb-45bc-9758-7263315630cb", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -814,7 +939,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9d8d04b8-42e9-488a-9c18-39f38153e46a": { "columnOrder": [ @@ -864,7 +989,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.incident.status", "negate": true, "params": { @@ -899,6 +1024,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -927,107 +1053,7 @@ }, "panelIndex": "213a2279-8bb5-491b-b0f0-d5a7a2473670", "type": "lens", - "version": "7.17.0" - }, - { - "embeddableConfig": { - "attributes": { - "description": "", - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-ec6bf891-aedf-4b92-af42-54c04e749174", - "type": "index-pattern" - } - ], - "state": { - "datasourceStates": { - "indexpattern": { - "layers": { - "ec6bf891-aedf-4b92-af42-54c04e749174": { - "columnOrder": [ - "7dc311c6-df3f-40ca-88e5-3925010191be", - "9934d429-8319-435c-8c72-57a56541dfcb" - ], - "columns": { - "7dc311c6-df3f-40ca-88e5-3925010191be": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Engine Detections", - "operationType": "terms", - "params": { - "missingBucket": false, - "orderBy": { - "columnId": "9934d429-8319-435c-8c72-57a56541dfcb", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "size": 5 - }, - "scale": "ordinal", - "sourceField": "sentinel_one.threat.detection.engines.title" - }, - "9934d429-8319-435c-8c72-57a56541dfcb": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count", - "operationType": "unique_count", - "scale": "ratio", - "sourceField": "sentinel_one.threat.id" - } - }, - "incompleteColumns": {} - } - } - } - }, - "filters": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "groups": [ - "7dc311c6-df3f-40ca-88e5-3925010191be" - ], - "layerId": "ec6bf891-aedf-4b92-af42-54c04e749174", - "layerType": "data", - "legendDisplay": "default", - "metric": "9934d429-8319-435c-8c72-57a56541dfcb", - "nestedLegend": false, - "numberDisplay": "percent" - } - ], - "shape": "pie" - } - }, - "title": "Distribution of Detections by Engine [Logs SentinelOne]", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {} - }, - "gridData": { - "h": 15, - "i": "14523f88-ccbb-45bc-9758-7263315630cb", - "w": 24, - "x": 0, - "y": 14 - }, - "panelIndex": "14523f88-ccbb-45bc-9758-7263315630cb", - "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1052,7 +1078,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f83c655e-003c-4cc5-a2e3-789acb23b691": { "columnOrder": [ @@ -1108,7 +1134,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.agent.is_active", "negate": false, "type": "exists" @@ -1128,15 +1154,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d427f2bd-912c-476e-85a7-3110216b3b8d" - ], "layerId": "f83c655e-003c-4cc5-a2e3-789acb23b691", "layerType": "data", "legendDisplay": "default", - "metric": "7fead18f-d40b-4539-ace7-5328e84140d2", + "legendSize": "auto", + "metrics": [ + "7fead18f-d40b-4539-ace7-5328e84140d2" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d427f2bd-912c-476e-85a7-3110216b3b8d" + ] } ], "shape": "pie" @@ -1158,7 +1187,7 @@ }, "panelIndex": "dc9ba6b7-0c35-4333-99ad-653d57c20fd7", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1178,7 +1207,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6f4336e8-7451-476e-89a5-fe65d93be571": { "columnOrder": [ @@ -1229,15 +1258,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "59424e47-b686-440e-b754-51a079ad1417" - ], "layerId": "6f4336e8-7451-476e-89a5-fe65d93be571", "layerType": "data", "legendDisplay": "default", - "metric": "7c71fee2-7e8b-48d2-8344-767b3e76f207", + "legendSize": "auto", + "metrics": [ + "7c71fee2-7e8b-48d2-8344-767b3e76f207" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "59424e47-b686-440e-b754-51a079ad1417" + ] } ], "shape": "pie" @@ -1258,7 +1290,7 @@ }, "panelIndex": "0ae44b6f-3e90-4fce-96a0-a0bdf069ab0e", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1278,7 +1310,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c5e5c6f0-5d4d-48f4-9ad4-727d5f1c0ebd": { "columnOrder": [ @@ -1329,15 +1361,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "039a2941-5111-4bf1-a02a-af4a8fe09609" - ], "layerId": "c5e5c6f0-5d4d-48f4-9ad4-727d5f1c0ebd", "layerType": "data", "legendDisplay": "default", - "metric": "86f6d3c9-4b8b-4d98-afae-df8ba9fd0e43", + "legendSize": "auto", + "metrics": [ + "86f6d3c9-4b8b-4d98-afae-df8ba9fd0e43" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "039a2941-5111-4bf1-a02a-af4a8fe09609" + ] } ], "shape": "pie" @@ -1358,7 +1393,7 @@ }, "panelIndex": "accf3797-c215-44a4-829d-c9ff30758f7b", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1378,7 +1413,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a64559b1-90c9-4859-9d5f-2585172bcda4": { "columnOrder": [ @@ -1441,6 +1476,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1469,7 +1505,7 @@ }, "panelIndex": "301b13f1-59c8-40e0-80f8-ecc1892b938d", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1489,7 +1525,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "da28cab9-5d08-4b0b-bbd6-2cf9952051b2": { "columnOrder": [ @@ -1552,6 +1588,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1580,7 +1617,7 @@ }, "panelIndex": "b8f90700-ca73-40c7-9257-8612aa86cc9f", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1600,7 +1637,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "87c51fc8-6c57-4d1c-a3f5-8b420f1d392c": { "columnOrder": [ @@ -1663,6 +1700,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1691,7 +1729,7 @@ }, "panelIndex": "9bdf752f-f767-44a4-bf05-51e0a27b7bbf", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1711,7 +1749,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "3f121a5b-0179-4329-a945-a3d23d83172f": { "columnOrder": [ @@ -1770,7 +1808,9 @@ } ], "layerId": "3f121a5b-0179-4329-a945-a3d23d83172f", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Top 10 File Extension [Logs SentinelOne]", @@ -1788,7 +1828,7 @@ }, "panelIndex": "ed9a7061-e640-41f3-a838-3772f86e4be4", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1808,7 +1848,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8662c82e-ca55-4ddc-81b6-2c4f9a3afbf8": { "columnOrder": [ @@ -1871,6 +1911,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_stacked", @@ -1901,78 +1942,120 @@ "panelIndex": "e17f8b5f-d5de-4921-bb3a-9d3e7ef58ae4", "title": "Distribution of Threats by Incident Status [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "field": "sentinel_one.threat.id" - }, - "schema": "metric", - "type": "cardinality" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-72498694-dd0d-4f76-9d38-d0e7a211b6a9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "72498694-dd0d-4f76-9d38-d0e7a211b6a9": { + "columnOrder": [ + "872c0c1b-aedd-4cf0-a98a-60443e689fc5", + "7d83b2e8-f6df-4b3e-868c-9452cf579fb0" + ], + "columns": { + "7d83b2e8-f6df-4b3e-868c-9452cf579fb0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "872c0c1b-aedd-4cf0-a98a-60443e689fc5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Technique ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7d83b2e8-f6df-4b3e-868c-9452cf579fb0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "threat.technique.id" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Technique Name", - "field": "threat.technique.id", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "textBased": { + "layers": {} } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7d83b2e8-f6df-4b3e-868c-9452cf579fb0", + "isTransposed": false + }, + { + "columnId": "872c0c1b-aedd-4cf0-a98a-60443e689fc5", + "isTransposed": false + } + ], + "layerId": "72498694-dd0d-4f76-9d38-d0e7a211b6a9", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 } } }, - "description": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "title": "Top 10 Threat Techniques [Logs SentinelOne]", - "type": "tagcloud", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "6d788430-6b2b-4e7c-9468-36b0aebf8468", + "i": "3e6f6367-85e2-45ee-a9c2-a14d5739f952", "w": 24, "x": 0, "y": 89 }, - "panelIndex": "6d788430-6b2b-4e7c-9468-36b0aebf8468", - "type": "visualization", - "version": "7.17.0" + "panelIndex": "3e6f6367-85e2-45ee-a9c2-a14d5739f952", + "title": "Top 10 Threat Techniques [Logs SentinelOne]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -1997,7 +2080,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "71ff1569-960a-408c-8e00-df6b68186912": { "columnOrder": [ @@ -2053,7 +2136,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "sentinel_one.threat.agent.infected", "negate": false, "type": "exists" @@ -2073,15 +2156,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "9a221d90-b37c-4947-899a-a8806d7d25f1" - ], "layerId": "71ff1569-960a-408c-8e00-df6b68186912", "layerType": "data", "legendDisplay": "default", - "metric": "d24c6b72-358d-4f01-ade3-cf9c228946e0", + "legendSize": "auto", + "metrics": [ + "d24c6b72-358d-4f01-ade3-cf9c228946e0" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "9a221d90-b37c-4947-899a-a8806d7d25f1" + ] } ], "shape": "pie" @@ -2104,7 +2190,7 @@ "panelIndex": "1888de07-0e2f-4fc4-80e9-f3102e8b97b3", "title": "Distribution of Threats by Infected Agents [Logs SentinelOne]", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2124,7 +2210,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9fe7a9cc-3417-4166-bdfc-5cdb85599981": { "columnOrder": [ @@ -2183,7 +2269,9 @@ } ], "layerId": "9fe7a9cc-3417-4166-bdfc-5cdb85599981", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Distribution of Threats by Detection Engine [Logs SentinelOne] ", @@ -2201,88 +2289,130 @@ }, "panelIndex": "6080a8f0-54d7-4fae-884f-f34dbed69ea8", "type": "lens", - "version": "7.17.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Count", - "field": "sentinel_one.threat.id" - }, - "schema": "metric", - "type": "cardinality" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7cff55a3-869c-4529-a8bf-39b8d5ad3fa1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7cff55a3-869c-4529-a8bf-39b8d5ad3fa1": { + "columnOrder": [ + "32957c07-beb9-4cc6-99a8-f6e1c686c105", + "92c9fb3d-991c-4c5e-b5e4-f73d60aed93f" + ], + "columns": { + "32957c07-beb9-4cc6-99a8-f6e1c686c105": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Threat Classification", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "92c9fb3d-991c-4c5e-b5e4-f73d60aed93f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sentinel_one.threat.classification" + }, + "92c9fb3d-991c-4c5e-b5e4-f73d60aed93f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Threat Classification", - "field": "sentinel_one.threat.classification", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" + "textBased": { + "layers": {} } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "32957c07-beb9-4cc6-99a8-f6e1c686c105" + }, + { + "columnId": "92c9fb3d-991c-4c5e-b5e4-f73d60aed93f" + } + ], + "layerId": "7cff55a3-869c-4529-a8bf-39b8d5ad3fa1", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 } } }, - "description": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" - }, - "scale": "linear", - "showLabel": true - }, - "title": "Top Threats by Classification [Logs SentinelOne]", - "type": "tagcloud", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, - "i": "55d0b7da-986b-4e98-b476-f3768233dc8f", + "i": "f7c0e875-f75f-4d06-b4dd-a8e50965eabe", "w": 24, "x": 24, "y": 104 }, - "panelIndex": "55d0b7da-986b-4e98-b476-f3768233dc8f", - "type": "visualization", - "version": "7.17.0" + "panelIndex": "f7c0e875-f75f-4d06-b4dd-a8e50965eabe", + "title": "Top 10 Threats by Classification [Logs SentinelOne]", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs SentinelOne] Threats", "version": 1 }, - "coreMigrationVersion": "7.17.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T11:18:11.726Z", "id": "sentinel_one-0dd17490-bbb8-11ec-82b7-8fcb232e9538", "migrationVersion": { - "dashboard": "7.17.0" + "dashboard": "8.7.0" }, "references": [ { @@ -2412,27 +2542,27 @@ }, { "id": "logs-*", - "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:indexpattern-datasource-current-indexpattern", + "name": "14523f88-ccbb-45bc-9758-7263315630cb:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:indexpattern-datasource-layer-9d8d04b8-42e9-488a-9c18-39f38153e46a", + "name": "14523f88-ccbb-45bc-9758-7263315630cb:indexpattern-datasource-layer-ec6bf891-aedf-4b92-af42-54c04e749174", "type": "index-pattern" }, { "id": "logs-*", - "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:filter-index-pattern-0", + "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:indexpattern-datasource-current-indexpattern", "type": "index-pattern" }, { "id": "logs-*", - "name": "14523f88-ccbb-45bc-9758-7263315630cb:indexpattern-datasource-current-indexpattern", + "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:indexpattern-datasource-layer-9d8d04b8-42e9-488a-9c18-39f38153e46a", "type": "index-pattern" }, { "id": "logs-*", - "name": "14523f88-ccbb-45bc-9758-7263315630cb:indexpattern-datasource-layer-ec6bf891-aedf-4b92-af42-54c04e749174", + "name": "213a2279-8bb5-491b-b0f0-d5a7a2473670:filter-index-pattern-0", "type": "index-pattern" }, { @@ -2522,7 +2652,7 @@ }, { "id": "logs-*", - "name": "6d788430-6b2b-4e7c-9468-36b0aebf8468:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "3e6f6367-85e2-45ee-a9c2-a14d5739f952:indexpattern-datasource-layer-72498694-dd0d-4f76-9d38-d0e7a211b6a9", "type": "index-pattern" }, { @@ -2552,7 +2682,7 @@ }, { "id": "logs-*", - "name": "55d0b7da-986b-4e98-b476-f3768233dc8f:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "f7c0e875-f75f-4d06-b4dd-a8e50965eabe:indexpattern-datasource-layer-7cff55a3-869c-4529-a8bf-39b8d5ad3fa1", "type": "index-pattern" } ], diff --git a/packages/sentinel_one/kibana/tags.yml b/packages/sentinel_one/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sentinel_one/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sentinel_one/manifest.yml b/packages/sentinel_one/manifest.yml index 1c545eb742d..b42b28b47b7 100644 --- a/packages/sentinel_one/manifest.yml +++ b/packages/sentinel_one/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: 2.11.0 name: sentinel_one title: SentinelOne -version: "1.10.0" +version: "1.13.0" description: Collect logs from SentinelOne with Elastic Agent. type: integration categories: diff --git a/packages/sentinel_one_cloud_funnel/_dev/build/build.yml b/packages/sentinel_one_cloud_funnel/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/sentinel_one_cloud_funnel/_dev/build/build.yml +++ b/packages/sentinel_one_cloud_funnel/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/sentinel_one_cloud_funnel/changelog.yml b/packages/sentinel_one_cloud_funnel/changelog.yml index e61c7225813..36a2cea21eb 100644 --- a/packages/sentinel_one_cloud_funnel/changelog.yml +++ b/packages/sentinel_one_cloud_funnel/changelog.yml @@ -1,4 +1,32 @@ # newer versions go on top +- version: 0.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.3.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "0.2.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "0.1.1-next" + changes: + - description: Relax constraints on date values for testing. + type: bugfix + link: https://github.com/elastic/integrations/pull/6857 + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "0.1.0" changes: - description: Initial release. diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-command-script.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-command-script.log-expected.json index 8747cfdbf5b..43fb69f0a50 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-command-script.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-command-script.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.180Z", + "@timestamp": "2022-10-25T07:47:24.180Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -43,14 +43,14 @@ }, "name": "CompatTelRunner.exe", "pid": 6008, - "start": "2023-01-01T00:00:00.590Z", + "start": "2022-10-25T07:46:11.590Z", "title": "MicrosoftCompatibilityTelemetry", "user": { "name": "NTAUTHORITY\\SYSTEM" } }, "pid": 5912, - "start": "2023-01-01T00:00:00.917Z", + "start": "2022-10-25T07:47:21.917Z", "title": "WindowsPowerShell", "user": { "name": "NTAUTHORITY\\SYSTEM" @@ -117,8 +117,8 @@ "packet_id": "9CB6AC4F10C34F5BB0A2788760E870F5", "process_unique_key": "230B188E26085676", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.507Z", - "ingest_time": "2023-01-01T00:00:00.063Z" + "atlantis_ingest_time": "2022-10-25T07:47:37.507Z", + "ingest_time": "1970-01-20T06:58:04.063Z" }, "site": { "id": "123456789123456789", @@ -195,7 +195,7 @@ "publisher": "MICROSOFTWINDOWS", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.590Z", + "start_time": "2022-10-25T07:46:11.590Z", "storyline_tm_id": "87EE3C19E0250305", "subsystem": "SYS_WIN32", "uid": "8608188E26085676", @@ -208,7 +208,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.917Z", + "start_time": "2022-10-25T07:47:21.917Z", "storyline_tm_id": "87EE3C19E0250305", "subsystem": "SYS_WIN32", "tgt_file": { @@ -228,7 +228,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.180Z", + "time": "2022-10-25T07:47:24.180Z", "timestamp": "2023-01-01T10:47:24.180Z", "trace_id": "01GG71RXEEHZQFY6XZ1WGS2BAE", "type": "CommandScript" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-common-config.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-common-config.yml index be41bb0d476..8a049cff95a 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-common-config.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-common-config.yml @@ -2,3 +2,24 @@ fields: tags: - preserve_original_event - preserve_duplicate_custom_fields +# Temporarily relax constraints on data fields. Remove after 8.9 is lowest kibana.version. +dynamic_fields: + "@timestamp": "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + file.created: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + file.mtime: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + process.parent.start: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + process.start: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.os_src_process.start_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.sca.atlantis_ingest_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.sca.ingest_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.src.process.parent.start_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.src.process.start_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.tgt.file.creation_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.tgt.file.modification_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.tgt.process.parent.start_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.tgt.process.start_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.ti_indicator.modification_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.ti_indicator.original_event.time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.ti_indicator.upload_time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.ti_indicator.valid_until: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" + sentinel_one_cloud_funnel.event.time: "[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}Z" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-cross-process.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-cross-process.log-expected.json index 6c04d0f9670..0bd18b3e9f6 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-cross-process.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-cross-process.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.474Z", + "@timestamp": "2022-10-03T15:32:29.474Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -43,14 +43,14 @@ }, "name": "chrome.exe", "pid": 17948, - "start": "2023-01-01T00:00:00.406Z", + "start": "2022-10-03T15:32:29.406Z", "title": "GoogleChrome", "user": { "name": "asdf\\SYSTEM" } }, "pid": 3088, - "start": "2023-01-01T00:00:00.441Z", + "start": "2022-10-03T15:32:29.441Z", "title": "GoogleChrome", "user": { "name": [ @@ -110,8 +110,8 @@ "packet_id": "5731239730C44FAEB2AA24236C5146EF", "process_unique_key": "F27AB6F105F6C47A", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.116Z", - "ingest_time": "2023-01-01T00:00:00.166Z" + "atlantis_ingest_time": "2022-10-03T15:32:46.116Z", + "ingest_time": "1970-01-20T06:26:51.166Z" }, "site": { "id": "123456789123456789", @@ -189,7 +189,7 @@ "publisher": "GOOGLELLC", "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.406Z", + "start_time": "2022-10-03T15:32:29.406Z", "storyline_id": "A5FDB5F105F6C47A", "subsystem": "SYS_WIN32", "uid": "F17AB6F105F6C47A", @@ -202,7 +202,7 @@ "registry_change_count": 1, "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.441Z", + "start_time": "2022-10-03T15:32:29.441Z", "storyline_id": "A5FDB5F105F6C47A", "subsystem": "SYS_WIN32", "tgt_file": { @@ -246,7 +246,7 @@ "relation": "parent", "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.406Z", + "start_time": "2022-10-03T15:32:29.406Z", "storyline_id": "A5FDB5F105F6C47A", "subsystem": "SYS_WIN32", "uid": "F17AB6F105F6C47A", @@ -256,7 +256,7 @@ "verified_status": "verified" } }, - "time": "2023-01-01T00:00:00.474Z", + "time": "2022-10-03T15:32:29.474Z", "timestamp": "2023-01-01T18:32:29.474Z", "trace_id": "01GEF7MSR2YS7Q4NR76C0TXT2C", "type": "DuplicateProcessHandle" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-dns.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-dns.log-expected.json index 4c232a0702b..f0e41647b9f 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-dns.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.495Z", + "@timestamp": "2022-10-03T15:32:29.495Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -43,14 +43,14 @@ }, "name": "VIERO.exe", "pid": 2728, - "start": "2023-01-01T00:00:00.680Z", + "start": "2022-10-03T13:16:06.680Z", "title": "VIERO-RMSLaunchBar", "user": { "name": "asdf\\SYSTEM" } }, "pid": 3924, - "start": "2023-01-01T00:00:00.244Z", + "start": "2022-10-03T13:22:38.244Z", "title": "OrderEntryApplication(Client)", "user": { "name": "asdf\\SYSTEM" @@ -163,7 +163,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.863Z", + "start_time": "2022-10-03T12:35:06.863Z", "storyline_id": "74833004051AA366", "subsystem": "SYS_WIN32", "tgt_file": { @@ -180,8 +180,8 @@ "packet_id": "1A1DF4D521014F9C90F4CF31E5446B91", "process_unique_key": "AFD43004051AA366", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.298Z", - "ingest_time": "2023-01-01T00:00:00.166Z" + "atlantis_ingest_time": "2022-10-03T15:32:46.298Z", + "ingest_time": "1970-01-20T06:26:51.166Z" }, "site": { "id": "123456789123456789", @@ -250,7 +250,7 @@ "pid": 2728, "session_id": "1", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.680Z", + "start_time": "2022-10-03T13:16:06.680Z", "storyline_id": "8DD23004051AA366", "subsystem": "SYS_WIN32", "uid": "8CD23004051AA366", @@ -262,7 +262,7 @@ "registry_change_count": 0, "session_id": "1", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.244Z", + "start_time": "2022-10-03T13:22:38.244Z", "storyline_id": "8DD23004051AA366", "subsystem": "SYS_WIN32", "tgt_file": { @@ -281,7 +281,7 @@ "is_signed": "unsigned" } }, - "time": "2023-01-01T00:00:00.495Z", + "time": "2022-10-03T15:32:29.495Z", "timestamp": "2023-01-01T18:32:29.495Z", "trace_id": "01GEF7MT4CB2DBKG1NGZ8XA7E0", "type": "DNSUnresolved" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-file.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-file.log-expected.json index 0a33862dc97..7904bb0cff8 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-file.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-file.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.488Z", + "@timestamp": "2022-10-03T15:32:29.488Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -17,8 +17,8 @@ ] }, "file": { - "created": "2023-01-01T00:00:00.488Z", - "mtime": "2023-01-01T00:00:00.488Z", + "created": "2022-10-03T15:32:29.488Z", + "mtime": "2022-10-03T15:32:29.488Z", "path": "C:\\PROGRAMFILES\\MediaMonitors\\ChromeProfiles\\profile-1234\\userdata\\Default\\Favicons", "size": 0, "type": "UNKNOWN" @@ -50,14 +50,14 @@ }, "name": "MediaMonitors.WebCrawler.Desktop.exe", "pid": 2340, - "start": "2023-01-01T00:00:00.907Z", + "start": "2022-10-03T06:12:57.907Z", "title": "WebCrawler", "user": { "name": "asdf\\SYSTEM" } }, "pid": 7660, - "start": "2023-01-01T00:00:00.756Z", + "start": "2022-10-03T15:32:16.756Z", "title": "GoogleChrome", "user": { "name": "asdf\\SYSTEM" @@ -116,8 +116,8 @@ "packet_id": "EBCEB9D2B6B349F0AD43B097C7A619EB", "process_unique_key": "BA34D0202623D4E6", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.502Z", - "ingest_time": "2023-01-01T00:00:00.158Z" + "atlantis_ingest_time": "2022-10-03T15:32:38.502Z", + "ingest_time": "1970-01-20T06:26:51.158Z" }, "site": { "id": "123456789123456789", @@ -190,7 +190,7 @@ "pid": 2340, "session_id": "1", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.907Z", + "start_time": "2022-10-03T06:12:57.907Z", "storyline_id": "4041C4202623D4E6", "subsystem": "SYS_WIN32", "uid": "3F41C4202623D4E6", @@ -203,7 +203,7 @@ "registry_change_count": 11, "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.756Z", + "start_time": "2022-10-03T15:32:16.756Z", "storyline_id": "4041C4202623D4E6", "subsystem": "SYS_WIN32", "tgt_file": { @@ -223,17 +223,17 @@ }, "tgt": { "file": { - "creation_time": "2023-01-01T00:00:00.488Z", + "creation_time": "2022-10-03T15:32:29.488Z", "id": "999BF0ASDF0999F23NC", "is_executable": false, "location": "Local", - "modification_time": "2023-01-01T00:00:00.488Z", + "modification_time": "2022-10-03T15:32:29.488Z", "path": "C:\\PROGRAMFILES\\MediaMonitors\\ChromeProfiles\\profile-1234\\userdata\\Default\\Favicons", "size": 0, "type": "UNKNOWN" } }, - "time": "2023-01-01T00:00:00.488Z", + "time": "2022-10-03T15:32:29.488Z", "timestamp": "2023-01-01T18:32:29.488Z", "trace_id": "01GEF7MJGBPX67Q8KNKKDCT872", "type": "FileCreation" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-indicator.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-indicator.log-expected.json index 03064084311..ae8a5516f74 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-indicator.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-indicator.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.466Z", + "@timestamp": "2022-10-03T15:32:29.466Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "01GEF7MQGWG17J10TNZ7GGY2PN_689", @@ -37,14 +37,14 @@ }, "name": "services.exe", "pid": 892, - "start": "2023-01-01T00:00:00.657Z", + "start": "2022-05-05T17:32:06.657Z", "title": "ServicesandControllerapp", "user": { "name": "NTAUTHORITY\\SYSTEM" } }, "pid": 54812, - "start": "2023-01-01T00:00:00.464Z", + "start": "2022-10-03T15:32:29.464Z", "thread": { "id": 0 }, @@ -112,8 +112,8 @@ "packet_id": "CCC100CEC10D485082761D8E9FBEAC4F", "process_unique_key": "9544B91D29223D1A", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.078Z", - "ingest_time": "2023-01-01T00:00:00.165Z" + "atlantis_ingest_time": "2022-10-03T15:32:44.078Z", + "ingest_time": "1970-01-20T06:26:51.165Z" }, "site": { "id": "123456789123456789", @@ -182,7 +182,7 @@ "publisher": "MICROSOFTWINDOWSPUBLISHER", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.657Z", + "start_time": "2022-05-05T17:32:06.657Z", "storyline_tm_id": "7961D6FD2944B344", "subsystem": "SYS_WIN32", "uid": "B4C1F07EC98B907A", @@ -195,7 +195,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.464Z", + "start_time": "2022-10-03T15:32:29.464Z", "storyline_tm_id": "9644B91D29223D1A", "subsystem": "SYS_WIN32", "tgt_file": { @@ -216,7 +216,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.466Z", + "time": "2022-10-03T15:32:29.466Z", "timestamp": "2023-01-01T18:32:29.466Z", "trace_id": "01GEF7MQGWG17J10TNZ7GGY2PN", "type": "BehavioralIndicators" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-login.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-login.log-expected.json index fb47aae01aa..138f51e61d5 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-login.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-login.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.467Z", + "@timestamp": "2022-10-03T15:32:29.467Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -26,7 +26,7 @@ }, "process": { "pid": 776, - "start": "2023-01-01T00:00:00.297Z", + "start": "2022-09-25T05:39:44.297Z", "user": { "name": "NTAUTHORITY\\SYSTEM" } @@ -85,8 +85,8 @@ "packet_id": "62A299E57FC84504A7CB0A3EB733C82A", "process_unique_key": "61D19661DB864A92", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.561Z", - "ingest_time": "2023-01-01T00:00:00.157Z" + "atlantis_ingest_time": "2022-10-03T15:32:37.561Z", + "ingest_time": "1970-01-20T06:26:51.157Z" }, "site": { "id": "123456789123456789", @@ -131,7 +131,7 @@ "pid": 776, "registry_change_count": 7137, "session_id": "-1", - "start_time": "2023-01-01T00:00:00.297Z", + "start_time": "2022-09-25T05:39:44.297Z", "subsystem": "SYS_WIN32", "tgt_file": { "creation_count": 23, @@ -144,7 +144,7 @@ } } }, - "time": "2023-01-01T00:00:00.467Z", + "time": "2022-10-03T15:32:29.467Z", "timestamp": "2023-01-01T18:32:29.467Z", "trace_id": "01GEF7MHHR6BB9SJNBMVFMQP5X", "type": "Login" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-module.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-module.log-expected.json index 1230921ce3a..f2494577777 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-module.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-module.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.290Z", + "@timestamp": "2022-10-25T12:17:47.290Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "01GG7H7P5GNC0537Q6XM2W1ATB_29", @@ -37,14 +37,14 @@ }, "name": "SentinelRanger.exe", "pid": 2220, - "start": "2023-01-01T00:00:00.216Z", + "start": "2022-10-25T12:17:47.216Z", "title": "SentinelRanger", "user": { "name": "NTAUTHORITY\\SYSTEM" } }, "pid": 6520, - "start": "2023-01-01T00:00:00.224Z", + "start": "2022-10-25T12:17:47.224Z", "title": "ConsoleWindowHost", "user": { "name": "NTAUTHORITY\\SYSTEM" @@ -108,8 +108,8 @@ "packet_id": "F7BDE5DCE83249A8A2FC8E7906A9FEB9", "process_unique_key": "08693A26E6783D52", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.197Z", - "ingest_time": "2023-01-01T00:00:00.278Z" + "atlantis_ingest_time": "2022-10-25T12:17:56.197Z", + "ingest_time": "1970-01-20T06:58:20.278Z" }, "site": { "id": "123456789123456789", @@ -179,7 +179,7 @@ "publisher": "SENTINELLABS,INC.", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.216Z", + "start_time": "2022-10-25T12:17:47.216Z", "storyline_id": "FB7CE73C89DB2642", "subsystem": "SYS_WIN32", "uid": "07693A26E6783D52", @@ -192,7 +192,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.224Z", + "start_time": "2022-10-25T12:17:47.224Z", "storyline_id": "FB7CE73C89DB2642", "subsystem": "SYS_WIN32", "tgt_file": { @@ -212,7 +212,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.290Z", + "time": "2022-10-25T12:17:47.290Z", "timestamp": "2023-01-01T15:17:47.290Z", "trace_id": "01GG7H7P5GNC0537Q6XM2W1ATB", "type": "ModuleLoad" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json index 377a7aaf851..74d6ae5dedb 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-network-action.log-expected.json @@ -1,13 +1,13 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.466Z", + "@timestamp": "2022-10-03T15:32:29.466Z", "destination": { "ip": "81.2.69.192", "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -52,14 +52,14 @@ }, "name": "chrome.exe", "pid": 11892, - "start": "2023-01-01T00:00:00.640Z", + "start": "2022-10-03T15:32:14.640Z", "title": "GoogleChrome", "user": { "name": "asdf\\SYSTEM" } }, "pid": 12952, - "start": "2023-01-01T00:00:00.954Z", + "start": "2022-10-03T15:32:14.954Z", "title": "GoogleChrome", "user": { "name": "asdf\\SYSTEM" @@ -128,8 +128,8 @@ "process_unique_key": "778A830FDFF04CF5", "repetition_count": 2, "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.704Z", - "ingest_time": "2023-01-01T00:00:00.152Z" + "atlantis_ingest_time": "2022-10-03T15:32:31.704Z", + "ingest_time": "1970-01-20T06:26:51.152Z" }, "site": { "id": "123456789123456789", @@ -209,7 +209,7 @@ "publisher": "GOOGLELLC", "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.640Z", + "start_time": "2022-10-03T15:32:14.640Z", "storyline_id": "738A830FDFF04CF5", "subsystem": "SYS_WIN32", "uid": "728A830FDFF04CF5", @@ -222,7 +222,7 @@ "registry_change_count": 0, "session_id": "1", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.954Z", + "start_time": "2022-10-03T15:32:14.954Z", "storyline_id": "738A830FDFF04CF5", "subsystem": "SYS_WIN32", "tgt_file": { @@ -242,7 +242,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.466Z", + "time": "2022-10-03T15:32:29.466Z", "timestamp": "2023-01-01T18:32:29.466Z", "trace_id": "01GEF7MB0DMJQHCWR3DZWQY4CF", "type": "IPConnect" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-process.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-process.log-expected.json index 0626fb2872a..b840c0a11de 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-process.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-process.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.470Z", + "@timestamp": "2022-10-03T15:32:29.470Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -43,14 +43,14 @@ }, "name": "newrelic-infra-service.exe", "pid": 3132, - "start": "2023-01-01T00:00:00.701Z", + "start": "2022-09-10T04:36:45.701Z", "title": "Test123", "user": { "name": "asdf\\SYSTEM" } }, "pid": 3596, - "start": "2023-01-01T00:00:00.181Z", + "start": "2022-09-10T04:36:46.181Z", "title": "newrelic-infra.exe", "user": { "name": "NTAUTHORITY\\SYSTEM" @@ -113,8 +113,8 @@ "packet_id": "62D7376456284C24A2067FE50BA5B7D7", "process_unique_key": "D0046CBAF5BC03DA", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.133Z", - "ingest_time": "2023-01-01T00:00:00.195Z" + "atlantis_ingest_time": "2022-10-03T15:33:15.133Z", + "ingest_time": "1970-01-20T06:26:51.195Z" }, "site": { "id": "123456789123456789", @@ -184,7 +184,7 @@ "publisher": "NEWRELIC,INC.", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.701Z", + "start_time": "2022-09-10T04:36:45.701Z", "storyline_id": "F8C44B7A0C80D2E7", "subsystem": "SYS_WIN32", "uid": "C19445BAF5BC03DA", @@ -197,7 +197,7 @@ "registry_change_count": 146, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.181Z", + "start_time": "2022-09-10T04:36:46.181Z", "storyline_id": "F8C44B7A0C80D2E7", "subsystem": "SYS_WIN32", "tgt_file": { @@ -235,7 +235,7 @@ "publisher": "NEWRELIC,INC.", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.464Z", + "start_time": "2022-10-03T15:32:29.464Z", "storyline_id": "F8C44B7A0C80D2E7", "subsystem": "SYS_WIN32", "uid": "D0046CBAF5BC03DA", @@ -245,7 +245,7 @@ "verified_status": "verified" } }, - "time": "2023-01-01T00:00:00.470Z", + "time": "2022-10-03T15:32:29.470Z", "timestamp": "2023-01-01T18:32:29.470Z", "trace_id": "01GEF7NPDYKJDP1X0XSQ9K7J2N", "type": "ProcessCreation" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-registry.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-registry.log-expected.json index 4e6755b203b..e2b18ad8226 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-registry.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-registry.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.466Z", + "@timestamp": "2022-10-03T15:32:29.466Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -43,14 +43,14 @@ }, "name": "services.exe", "pid": 492, - "start": "2023-01-01T00:00:00.352Z", + "start": "2021-03-04T16:30:53.352Z", "title": "ServicesandControllerapp", "user": { "name": "asdf\\SYSTEM" } }, "pid": 672, - "start": "2023-01-01T00:00:00.054Z", + "start": "2021-03-04T16:30:54.054Z", "title": "HostProcessforWindowsServices", "user": { "name": "NTAUTHORITY\\SYSTEM" @@ -120,8 +120,8 @@ } }, "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.083Z", - "ingest_time": "2023-01-01T00:00:00.154Z" + "atlantis_ingest_time": "2022-10-03T15:32:34.083Z", + "ingest_time": "1970-01-20T06:26:51.154Z" }, "site": { "id": "123456789123456789", @@ -191,7 +191,7 @@ "publisher": "MICROSOFTWINDOWS", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.352Z", + "start_time": "2021-03-04T16:30:53.352Z", "storyline_id": "0A900769B6B731C4", "subsystem": "SYS_WIN32", "uid": "55A75E7FE942CE7D", @@ -204,7 +204,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.054Z", + "start_time": "2021-03-04T16:30:54.054Z", "storyline_id": "EB1E4D7D014631E5", "subsystem": "SYS_WIN32", "tgt_file": { @@ -224,7 +224,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.466Z", + "time": "2022-10-03T15:32:29.466Z", "timestamp": "2023-01-01T18:32:29.466Z", "trace_id": "01GEF7ME4WFRMD8MNECTVJCX07", "type": "RegistryValueCreate" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-scheduled-task.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-scheduled-task.log-expected.json index a7951851ae2..e62bbe68f2d 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-scheduled-task.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-scheduled-task.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.490Z", + "@timestamp": "2022-10-03T15:32:29.490Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "01GEF7MTMQ9Z9WPEWSCZM8918M_580", @@ -37,7 +37,7 @@ }, "name": "services.exe", "pid": 924, - "start": "2023-01-01T00:00:00.483Z", + "start": "2022-09-25T22:21:18.483Z", "title": "ServicesandControllerapp", "user": { "name": "asdf\\SYSTEM" @@ -153,7 +153,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.093Z", + "start_time": "2022-09-25T22:21:19.093Z", "storyline_id": "68F2AD1313577E13", "subsystem": "SYS_WIN32", "tgt_file": { @@ -170,8 +170,8 @@ "packet_id": "CFFCA917DA234AD39A7A3BF42B31ECC9", "process_unique_key": "0AF3AD1313577E13", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.614Z", - "ingest_time": "2023-01-01T00:00:00.167Z" + "atlantis_ingest_time": "2022-10-03T15:32:46.614Z", + "ingest_time": "1970-01-20T06:26:51.167Z" }, "site": { "id": "123456789123456789", @@ -241,7 +241,7 @@ "publisher": "MICROSOFTWINDOWSPUBLISHER", "session_id": "0", "signed_status": "signed", - "start_time": "2023-01-01T00:00:00.483Z", + "start_time": "2022-09-25T22:21:18.483Z", "storyline_id": "2BF2AD1313577E13", "subsystem": "SYS_WIN32", "uid": "2AF2AD1313577E13", @@ -276,7 +276,7 @@ "is_signed": "signed" } }, - "time": "2023-01-01T00:00:00.490Z", + "time": "2022-10-03T15:32:29.490Z", "timestamp": "2023-01-01T18:32:29.490Z", "trace_id": "01GEF7MTMQ9Z9WPEWSCZM8918M", "type": "TaskDelete" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-threat-intelligence-indicator.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-threat-intelligence-indicator.log-expected.json index f2260edb18d..b61a8444d73 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-threat-intelligence-indicator.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-threat-intelligence-indicator.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.433Z", + "@timestamp": "2022-10-25T12:53:27.433Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -33,7 +33,7 @@ "sha1": "4fe13081b31b55176af7dee8354ea18ad3ca4c59" }, "pid": 1901, - "start": "2023-01-01T00:00:00.160Z", + "start": "2022-01-18T16:26:33.160Z", "title": "sshd", "user": { "name": "root" @@ -83,8 +83,8 @@ "os_name": "Linux", "process_unique_key": "09edcd06-faa9-1575-1f8b-46a5ad0ac0fe", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.563Z", - "ingest_time": "2023-01-01T00:00:00.413Z" + "atlantis_ingest_time": "2022-10-25T12:53:27.563Z", + "ingest_time": "1970-01-20T06:58:22.413Z" }, "site": { "id": "123456789123456789", @@ -136,7 +136,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.160Z", + "start_time": "2022-01-18T16:26:33.160Z", "storyline_id": "09edcd07-2638-0131-52a9-9a36732f727f", "subsystem": "SUBSYSTEM_UNKNOWN", "tgt_file": { @@ -158,22 +158,22 @@ "ti_indicator": { "added_by": "admin@usea1-purple.sentinelone.net", "comparison_method": "EQUALS", - "modification_time": "2023-01-01T00:00:00.007Z", + "modification_time": "2022-10-11T14:59:53.007Z", "name": "mandiant_ipv4_41.66.217.101", "original_event": { "id": "01GG7HHG0PAKQDFE9XZY7WDT4V_1", "index": 1, - "time": "2023-01-01T00:00:00.275Z", + "time": "2022-10-25T12:22:29.275Z", "trace_id": "01GG7HHG0PAKQDFE9XZY7WDT4V" }, "source": "mandiant", "type": "IPv4", "uid": "7d56201c92ba03d33008b0044bf941d9", - "upload_time": "2023-01-01T00:00:00.103Z", - "valid_until": "2023-01-01T00:00:00.007Z", + "upload_time": "2022-09-17T02:59:52.103Z", + "valid_until": "2022-10-25T14:59:53.007Z", "value": "41.66.217.101" }, - "time": "2023-01-01T00:00:00.433Z", + "time": "2022-10-25T12:53:27.433Z", "timestamp": "2023-01-01T15:53:27.433Z", "trace_id": "f2636c08-9f6b-44b6-b19b-21f2335d80a7", "type": "ThreatIntelligenceIndicators" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-url.log-expected.json b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-url.log-expected.json index 522907946c9..e13305067d4 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-url.log-expected.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/_dev/test/pipeline/test-url.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2023-01-01T00:00:00.475Z", + "@timestamp": "2022-10-03T15:32:29.475Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "01GEF7MS3ZP37XN57XJH2CG4P4_21", @@ -37,14 +37,14 @@ }, "name": "nssm.exe", "pid": 3540, - "start": "2023-01-01T00:00:00.924Z", + "start": "2022-10-02T13:31:04.924Z", "title": "Test1", "user": { "name": "NTAUTHORITY\\SYSTEM" } }, "pid": 10332, - "start": "2023-01-01T00:00:00.052Z", + "start": "2022-10-03T15:31:19.052Z", "title": "sourcelink5.exe", "user": { "name": "NTAUTHORITY\\SYSTEM" @@ -103,8 +103,8 @@ "packet_id": "4F43E43733A94560B13FB0E441252B21", "process_unique_key": "E1471D24880BECFA", "sca": { - "atlantis_ingest_time": "2023-01-01T00:00:00.273Z", - "ingest_time": "2023-01-01T00:00:00.165Z" + "atlantis_ingest_time": "2022-10-03T15:32:45.273Z", + "ingest_time": "1970-01-20T06:26:51.165Z" }, "site": { "id": "123456789123456789", @@ -173,7 +173,7 @@ "pid": 3540, "session_id": "0", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.924Z", + "start_time": "2022-10-02T13:31:04.924Z", "storyline_id": "C6EAC68B8E502782", "subsystem": "SYS_WIN32", "uid": "632D1A24880BECFA", @@ -185,7 +185,7 @@ "registry_change_count": 0, "session_id": "0", "signed_status": "unsigned", - "start_time": "2023-01-01T00:00:00.052Z", + "start_time": "2022-10-03T15:31:19.052Z", "storyline_id": "C6EAC68B8E502782", "subsystem": "SYS_WIN32", "tgt_file": { @@ -204,7 +204,7 @@ "is_signed": "unsigned" } }, - "time": "2023-01-01T00:00:00.475Z", + "time": "2022-10-03T15:32:29.475Z", "timestamp": "2023-01-01T18:32:29.475Z", "trace_id": "01GEF7MS3ZP37XN57XJH2CG4P4", "type": "GET", diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml index cdb62354127..cccee5b9b84 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Event logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: event @@ -15,7 +15,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: message target_field: event.original @@ -27,7 +27,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless if: ctx.json != null @@ -39,7 +39,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - dot_expander: field: '*' tag: 'dot_expander' @@ -47,7 +47,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: lang: painless tag: 'script_to_remove_quotes_from_begining_and_end' @@ -74,7 +74,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.event.time tag: 'date_json_event_time' @@ -86,7 +86,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.event.time tag: 'date_timestamp' @@ -97,7 +97,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.event.logout.tgt.user.name target_field: sentinel_one_cloud_funnel.event.logout.tgt.user.name @@ -344,7 +344,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.parent.pid copy_from: sentinel_one_cloud_funnel.event.src.process.parent.pid @@ -359,7 +359,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.parent.real_user.id copy_from: sentinel_one_cloud_funnel.event.src.process.parent.r_user.uid @@ -393,7 +393,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.parent.start copy_from: sentinel_one_cloud_funnel.event.src.process.parent.start_time @@ -416,7 +416,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.parent.user.id copy_from: sentinel_one_cloud_funnel.event.src.process.parent.e_user.uid @@ -457,7 +457,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.pid copy_from: sentinel_one_cloud_funnel.event.src.process.pid @@ -472,7 +472,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.real_user.id copy_from: sentinel_one_cloud_funnel.event.src.process.r_user.uid @@ -506,7 +506,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.start copy_from: sentinel_one_cloud_funnel.event.src.process.start_time @@ -529,7 +529,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.user.id copy_from: sentinel_one_cloud_funnel.event.src.process.e_user.uid @@ -605,7 +605,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.event.type target_field: sentinel_one_cloud_funnel.event.type @@ -656,7 +656,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.cmdline target_field: sentinel_one_cloud_funnel.event.os_src_process.cmd_line @@ -671,7 +671,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.crossProcessDupRemoteProcessHandleCount tag: 'convert_json_osSrc_process_crossProcessDupRemoteProcessHandleCount' @@ -682,7 +682,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.crossProcessDupThreadHandleCount tag: 'convert_json_osSrc_process_crossProcessDupThreadHandleCount' @@ -693,7 +693,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.crossProcessOpenProcessCount tag: 'json_osSrc_process_crossProcessOpenProcessCount' @@ -704,7 +704,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.crossProcessOutOfStorylineCount tag: 'convert_json_osSrc_process_crossProcessOutOfStorylineCount' @@ -715,7 +715,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.crossProcessThreadCreateCount tag: 'convert_json_osSrc_process_crossProcessThreadCreateCount' @@ -726,7 +726,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.displayName target_field: sentinel_one_cloud_funnel.event.os_src_process.display_name @@ -741,7 +741,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.image.binaryIsExecutable tag: 'convert_json_osSrc_process_image_binaryIsExecutable' @@ -752,7 +752,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.image.md5 target_field: sentinel_one_cloud_funnel.event.os_src_process.image.md5 @@ -794,7 +794,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorEvasionCount tag: 'convert_json_osSrc_process_indicatorEvasionCount' @@ -805,7 +805,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorExploitationCount tag: 'convert_json_osSrc_process_indicatorExploitationCount' @@ -816,7 +816,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorGeneral.count tag: 'convert_json_osSrc_process_indicatorGeneral_count' @@ -827,7 +827,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorInfostealerCount tag: 'convert_json_osSrc_process_indicatorInfostealerCount' @@ -838,7 +838,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorInjectionCount tag: 'convert_json_osSrc_process_indicatorInjectionCount' @@ -849,7 +849,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorPersistenceCount tag: 'convert_json_osSrc_process_indicatorPersistenceCount' @@ -860,7 +860,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorPostExploitationCount tag: 'convert_json_osSrc_process_indicatorPostExploitationCount' @@ -871,7 +871,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorRansomwareCount tag: 'convert_json_osSrc_process_indicatorRansomwareCount' @@ -882,7 +882,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.indicatorReconnaissanceCount tag: 'json_osSrc_process_indicatorReconnaissanceCount' @@ -893,7 +893,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.integrityLevel target_field: sentinel_one_cloud_funnel.event.os_src_process.integrity_level @@ -908,7 +908,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.isRedirectCmdProcessor tag: 'convert_json_osSrc_process_isRedirectCmdProcessor' @@ -919,7 +919,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.isStorylineRoot tag: 'convert_json_osSrc_process_isStorylineRoot' @@ -930,7 +930,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.moduleCount tag: 'convert_json_osSrc_process_moduleCount' @@ -941,7 +941,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.name target_field: sentinel_one_cloud_funnel.event.os_src_process.name @@ -956,7 +956,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.netConnInCount tag: 'convert_json_osSrc_process_netConnInCount' @@ -967,7 +967,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.netConnOutCount tag: 'convert_json_osSrc_process_netConnOutCount' @@ -978,7 +978,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.activeContent.hash target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.active_content.hash @@ -1039,7 +1039,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.parent.isRedirectCmdProcessor tag: 'convert_json_osSrc_process_parent_isRedirectCmdProcessor' @@ -1050,7 +1050,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.parent.isStorylineRoot tag: 'convert_json_osSrc_process_parent_isStorylineRoot' @@ -1061,7 +1061,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.name target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.name @@ -1076,7 +1076,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.publisher target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.publisher @@ -1095,7 +1095,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.signedStatus target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.signed_status @@ -1111,7 +1111,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.storyline.id target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.storyline_id @@ -1139,7 +1139,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.publisher target_field: sentinel_one_cloud_funnel.event.os_src_process.publisher @@ -1158,7 +1158,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.sessionId tag: 'convert_json_osSrc_process_sessionId' @@ -1169,7 +1169,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.signedStatus target_field: sentinel_one_cloud_funnel.event.os_src_process.signed_status @@ -1185,7 +1185,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.storyline.id target_field: sentinel_one_cloud_funnel.event.os_src_process.storyline_id @@ -1204,7 +1204,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.tgtFileDeletionCount tag: 'convert_json_osSrc_process_tgtFileDeletionCount' @@ -1215,7 +1215,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.tgtFileModificationCount tag: 'convert_json_osSrc_process_tgtFileModificationCount' @@ -1226,7 +1226,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.uid target_field: sentinel_one_cloud_funnel.event.os_src_process.uid @@ -1255,7 +1255,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.site.id target_field: sentinel_one_cloud_funnel.event.site.id @@ -1294,7 +1294,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.crossProcessDupRemoteProcessHandleCount tag: 'convert_json_src_process_crossProcessDupRemoteProcessHandleCount' @@ -1305,7 +1305,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.crossProcessOpenProcessCount tag: 'convert_json_src_process_crossProcessOpenProcessCount' @@ -1316,7 +1316,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorExploitationCount tag: 'convert_json_src_process_indicatorExploitationCount' @@ -1327,7 +1327,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorInjectionCount tag: 'convert_json_src_process_indicatorInjectionCount' @@ -1338,7 +1338,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorRansomwareCount tag: 'convert_json_src_process_indicatorRansomwareCount' @@ -1349,7 +1349,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorReconnaissanceCount tag: 'convert_json_src_process_indicatorReconnaissanceCount' @@ -1360,7 +1360,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.integrityLevel target_field: sentinel_one_cloud_funnel.event.src.process.integrity_level @@ -1384,7 +1384,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{sentinel_one_cloud_funnel.event.src.process.l_user.uid}}}' @@ -1400,7 +1400,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.netConnInCount tag: 'convert_json_src_process_netConnInCount' @@ -1411,7 +1411,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.activeContent.hash target_field: sentinel_one_cloud_funnel.event.src.process.parent.active_content.hash @@ -1459,7 +1459,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.parent.isRedirectCmdProcessor tag: 'convert_json_src_process_parent_isRedirectCmdProcessor' @@ -1470,7 +1470,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.parent.isStorylineRoot tag: 'convert_json_src_process_parent_isStorylineRoot' @@ -1481,7 +1481,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.lUserName target_field: sentinel_one_cloud_funnel.event.src.process.parent.l_user.name @@ -1501,7 +1501,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{sentinel_one_cloud_funnel.event.src.process.parent.l_user.uid}}}' @@ -1525,7 +1525,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.signedStatus target_field: sentinel_one_cloud_funnel.event.src.process.parent.signed_status @@ -1565,7 +1565,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.isSigned target_field: sentinel_one_cloud_funnel.event.tgt.file.is_signed @@ -1589,7 +1589,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{sentinel_one_cloud_funnel.event.tgt.process.e_user.uid}}}' @@ -1614,7 +1614,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{sentinel_one_cloud_funnel.event.tgt.process.l_user.uid}}}' @@ -1639,7 +1639,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{sentinel_one_cloud_funnel.event.tgt.process.r_user.uid}}}' @@ -1657,7 +1657,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.dataSource.category target_field: sentinel_one_cloud_funnel.event.data_source.category @@ -1685,7 +1685,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.crossProcessDupThreadHandleCount tag: 'convert_json_src_process_crossProcessDupThreadHandleCount' @@ -1696,7 +1696,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.dnsCount tag: 'convert_json_src_process_dnsCount' @@ -1707,7 +1707,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorBootConfigurationUpdateCount tag: 'convert_json_src_process_indicatorBootConfigurationUpdateCount' @@ -1718,7 +1718,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorEvasionCount tag: 'convert_json_src_process_indicatorEvasionCount' @@ -1729,7 +1729,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorGeneralCount tag: 'convert_json_src_process_indicatorGeneralCount' @@ -1740,7 +1740,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorInfostealerCount tag: 'convert_json_src_process_indicatorInfostealerCount' @@ -1751,7 +1751,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorPersistenceCount tag: 'convert_json_src_process_indicatorPersistenceCount' @@ -1762,7 +1762,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.isNative64Bit tag: 'convert_json_src_process_isNative64Bit' @@ -1773,7 +1773,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.isRedirectCmdProcessor tag: 'convert_json_src_process_isRedirectCmdProcessor' @@ -1784,7 +1784,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.netConnCount tag: 'convert_json_src_process_netConnCount' @@ -1795,7 +1795,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.netConnOutCount tag: 'convert_json_src_process_netConnOutCount' @@ -1806,7 +1806,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.subsystem target_field: sentinel_one_cloud_funnel.event.src.process.parent.subsystem @@ -1821,7 +1821,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.sessionId tag: 'convert_json_src_process_sessionId' @@ -1832,7 +1832,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.signedStatus target_field: sentinel_one_cloud_funnel.event.src.process.signed_status @@ -1847,7 +1847,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.tgtFileModificationCount tag: 'convert_json_src_process_tgtFileModificationCount' @@ -1858,7 +1858,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.uid target_field: sentinel_one_cloud_funnel.event.src.process.uid @@ -1881,7 +1881,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.crossProcessOutOfStorylineCount tag: 'convert_json_src_process_crossProcessOutOfStorylineCount' @@ -1892,7 +1892,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.crossProcessThreadCreateCount tag: 'convert_json_src_process_crossProcessThreadCreateCount' @@ -1903,7 +1903,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.image.binaryIsExecutable tag: 'convert_json_src_process_image_binaryIsExecutable' @@ -1914,7 +1914,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.indicatorPostExploitationCount tag: 'convert_json_src_process_indicatorPostExploitationCount' @@ -1925,7 +1925,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.isStorylineRoot tag: 'convert_json_src_process_isStorylineRoot' @@ -1936,7 +1936,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.publisher target_field: sentinel_one_cloud_funnel.event.src.process.publisher @@ -1959,7 +1959,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.driver.isLoadedBeforeMonitor tag: 'convert_json_driver_isLoadedBeforeMonitor' @@ -1970,7 +1970,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.driver.loadVerdict target_field: sentinel_one_cloud_funnel.event.driver.load_verdict @@ -2033,7 +2033,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.event.processtermination.signal target_field: sentinel_one_cloud_funnel.event.process_termination.signal @@ -2068,7 +2068,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.namedPipe.isOverlapped tag: 'convert_json_namedPipe_isOverlapped' @@ -2079,7 +2079,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.namedPipe.isWriteThrough tag: 'convert_json_namedPipe_isWriteThrough' @@ -2090,7 +2090,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.namedPipe.maxInstances tag: 'convert_json_namedPipe_maxInstances' @@ -2101,7 +2101,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.namedPipe.name target_field: sentinel_one_cloud_funnel.event.named_pipe.name @@ -2148,7 +2148,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.image.size tag: 'convert_json_osSrc_process_image_size' @@ -2159,7 +2159,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.image.type target_field: sentinel_one_cloud_funnel.event.os_src_process.image.type @@ -2178,7 +2178,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.image.extension target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.image.extension @@ -2197,7 +2197,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.osSrc.process.parent.image.size tag: 'convert_json_osSrc_process_parent_image_size' @@ -2208,7 +2208,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.osSrc.process.parent.image.type target_field: sentinel_one_cloud_funnel.event.os_src_process.parent.image.type @@ -2275,7 +2275,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.exeModificationCount tag: 'convert_json_src_process_exeModificationCount' @@ -2286,7 +2286,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.image.description target_field: sentinel_one_cloud_funnel.event.src.process.image.description @@ -2325,7 +2325,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.image.type target_field: sentinel_one_cloud_funnel.event.src.process.image.type @@ -2344,7 +2344,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.parent.image.binaryIsExecutable tag: 'convert_json_src_process_parent_image_binaryIsExecutable' @@ -2355,7 +2355,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.image.extension target_field: sentinel_one_cloud_funnel.event.src.process.parent.image.extension @@ -2374,7 +2374,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.parent.image.size tag: 'convert_json_src_process_parent_image_size' @@ -2385,7 +2385,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.image.type target_field: sentinel_one_cloud_funnel.event.src.process.parent.image.type @@ -2413,7 +2413,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.file.isDirectory tag: 'convert_json_tgt_file_isDirectory' @@ -2424,7 +2424,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.file.isKernelModule tag: 'convert_json_tgt_file_isKernelModule' @@ -2435,7 +2435,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.originalFileName target_field: sentinel_one_cloud_funnel.event.tgt.file.original_file_name @@ -2475,7 +2475,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.signatureInvalidReason target_field: sentinel_one_cloud_funnel.event.tgt.file.signature.invalid_reason @@ -2490,7 +2490,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.image.extension target_field: sentinel_one_cloud_funnel.event.tgt.process.image.extension @@ -2505,7 +2505,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.image.uid target_field: sentinel_one_cloud_funnel.event.tgt.process.image.uid @@ -2542,7 +2542,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tiIndicator.externalId target_field: sentinel_one_cloud_funnel.event.ti_indicator.external_id @@ -2566,7 +2566,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-cross-process" }}' tag: 'pipeline-cross-process' @@ -2574,7 +2574,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-dns" }}' tag: 'pipeline-dns' @@ -2582,7 +2582,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-file" }}' tag: 'pipeline-file' @@ -2590,7 +2590,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-indicator" }}' tag: 'pipeline-indicator' @@ -2598,7 +2598,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-login" }}' tag: 'pipeline-login' @@ -2606,7 +2606,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-module" }}' tag: 'pipeline-module' @@ -2614,7 +2614,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-network-action" }}' tag: 'pipeline-network-action' @@ -2622,7 +2622,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-process" }}' tag: 'pipeline_process' @@ -2630,7 +2630,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-registry" }}' tag: 'pipeline-registry' @@ -2638,7 +2638,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-scheduled-task" }}' tag: 'pipeline-scheduled-task' @@ -2646,7 +2646,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-threat-intelligence-indicator" }}' tag: 'pipeline-threat-intelligence-indicator' @@ -2654,7 +2654,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - pipeline: name: '{{ IngestPipeline "pipeline-url" }}' tag: 'pipeline-url' @@ -2662,7 +2662,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - remove: field: json ignore_missing: true diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-command-script.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-command-script.yml index 8a07d99ed34..d05e538b431 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-command-script.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-command-script.yml @@ -38,7 +38,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.cmdScript.originalSize tag: 'convert_json_cmdScript_originalSize' @@ -49,7 +49,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.cmdScript.sha256 target_field: sentinel_one_cloud_funnel.event.cmd_script.sha256 @@ -69,7 +69,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.isStoryline™Root target_field: sentinel_one_cloud_funnel.event.src.process.is_storyline_tm_root @@ -84,7 +84,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.Storyline™.id target_field: sentinel_one_cloud_funnel.event.src.process.parent.storyline_tm_id diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-cross-process.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-cross-process.yml index 542e911d12f..5f15ee8b304 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-cross-process.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-cross-process.yml @@ -35,7 +35,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.activeContent.hash target_field: sentinel_one_cloud_funnel.event.tgt.process.active_content.hash @@ -74,7 +74,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.image.md5 target_field: sentinel_one_cloud_funnel.event.tgt.process.image.md5 @@ -120,7 +120,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.process.isRedirectCmdProcessor tag: 'convert_json_tgt_process_isRedirectCmdProcessor' @@ -131,7 +131,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.process.isStorylineRoot tag: 'convert_json_tgt_process_isStorylineRoot' @@ -142,7 +142,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.name target_field: sentinel_one_cloud_funnel.event.tgt.process.name @@ -157,7 +157,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.publisher target_field: sentinel_one_cloud_funnel.event.tgt.process.publisher @@ -176,7 +176,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.signedStatus target_field: sentinel_one_cloud_funnel.event.tgt.process.signed_status @@ -192,7 +192,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.storyline.id target_field: sentinel_one_cloud_funnel.event.tgt.process.storyline_id diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file.yml index b8bb883e4ec..64f192d6196 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-file.yml @@ -76,7 +76,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.created copy_from: sentinel_one_cloud_funnel.event.tgt.file.creation_time @@ -139,7 +139,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.mtime copy_from: sentinel_one_cloud_funnel.event.tgt.file.modification_time @@ -162,7 +162,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.size copy_from: sentinel_one_cloud_funnel.event.tgt.file.size @@ -185,7 +185,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.thread.id copy_from: sentinel_one_cloud_funnel.event.src.process.tid @@ -270,7 +270,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.task.path target_field: sentinel_one_cloud_funnel.event.task.path @@ -301,7 +301,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.location target_field: sentinel_one_cloud_funnel.event.tgt.file.location diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-indicator.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-indicator.yml index bc716dde2c2..74f28227399 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-indicator.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-indicator.yml @@ -11,7 +11,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.thread.id copy_from: sentinel_one_cloud_funnel.event.src.process.tid @@ -42,7 +42,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.process.parent.isStoryline™Root tag: 'json_src_process_parent_isStoryline™Root' @@ -53,7 +53,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src.process.parent.Storyline™.id target_field: sentinel_one_cloud_funnel.event.src.process.parent.storyline_tm_id diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-login.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-login.yml index db77129c36d..e1820501b2d 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-login.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-login.yml @@ -30,7 +30,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{sentinel_one_cloud_funnel.event.src.endpoint_ip_address}}}' @@ -76,7 +76,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.event.login.loginIsSuccessful tag: 'convert_json_event_login_loginIsSuccessful' @@ -87,7 +87,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.event.login.sessionId tag: 'convert_json_event_login_sessionId' @@ -98,7 +98,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.event.login.type target_field: sentinel_one_cloud_funnel.event.login.type diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml index 4616a7af21e..623d2b7dc16 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-network-action.yml @@ -63,7 +63,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{sentinel_one_cloud_funnel.event.dst.ip_address}}}' @@ -83,7 +83,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.port copy_from: sentinel_one_cloud_funnel.event.dst.port_number @@ -105,7 +105,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.event.network.direction target_field: sentinel_one_cloud_funnel.event.network.direction @@ -131,7 +131,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src.ip.address tag: 'convert_json_src_ip_address' @@ -142,7 +142,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{sentinel_one_cloud_funnel.event.src.ip_address}}}' @@ -162,7 +162,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.port copy_from: sentinel_one_cloud_funnel.event.src.port_number diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml index 875ebc40ace..57b59237600 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-process.yml @@ -76,7 +76,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: process.thread.id copy_from: sentinel_one_cloud_funnel.event.src.process.tid @@ -145,7 +145,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.convictedBy target_field: sentinel_one_cloud_funnel.event.tgt.file.convicted_by @@ -160,7 +160,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.activeContent.hash target_field: sentinel_one_cloud_funnel.event.tgt.process.active_content.hash @@ -199,7 +199,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.image.md5 target_field: sentinel_one_cloud_funnel.event.tgt.process.image.md5 @@ -245,7 +245,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.process.isRedirectCmdProcessor tag: 'convert_json_tgt_process_isRedirectCmdProcessor' @@ -256,7 +256,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.tgt.process.isStorylineRoot tag: 'convert_json_tgt_process_isStorylineRoot' @@ -267,7 +267,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.lUserName target_field: sentinel_one_cloud_funnel.event.tgt.process.l_user.name @@ -291,7 +291,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.publisher target_field: sentinel_one_cloud_funnel.event.tgt.process.publisher @@ -310,7 +310,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.signedStatus target_field: sentinel_one_cloud_funnel.event.tgt.process.signed_status @@ -326,7 +326,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.process.storyline.id target_field: sentinel_one_cloud_funnel.event.tgt.process.storyline_id diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-registry.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-registry.yml index 9bd99aa38c5..096a22b276f 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-registry.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-registry.yml @@ -50,7 +50,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.registry.oldValueIsComplete tag: 'convert_json_registry_oldValueIsComplete' @@ -61,7 +61,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.registry.oldValueType target_field: sentinel_one_cloud_funnel.event.registry.old_value.type @@ -76,7 +76,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.registry.valueIsComplete tag: 'convert_json_registry_valueIsComplete' @@ -87,7 +87,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.registry.valueType target_field: sentinel_one_cloud_funnel.event.registry.value.type diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-scheduled-task.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-scheduled-task.yml index e2ec4bca5a9..b6e80938328 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-scheduled-task.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-scheduled-task.yml @@ -12,7 +12,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.created copy_from: sentinel_one_cloud_funnel.event.tgt.file.creation_time @@ -75,7 +75,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.mtime copy_from: sentinel_one_cloud_funnel.event.tgt.file.modification_time @@ -98,7 +98,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: file.size copy_from: sentinel_one_cloud_funnel.event.tgt.file.size @@ -141,7 +141,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tgt.file.location target_field: sentinel_one_cloud_funnel.event.tgt.file.location diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-intelligence-indicator.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-intelligence-indicator.yml index 172c4d098c2..8c5192e0c5a 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-intelligence-indicator.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/elasticsearch/ingest_pipeline/pipeline-threat-intelligence-indicator.yml @@ -26,7 +26,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tiIndicator.name target_field: sentinel_one_cloud_funnel.event.ti_indicator.name @@ -45,7 +45,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.tiindicator.originalEvent.time tag: 'date_json_tiindicator_originalEvent_time' @@ -57,7 +57,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tiindicator.originalEvent.traceId target_field: sentinel_one_cloud_funnel.event.ti_indicator.original_event.trace_id @@ -85,7 +85,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.tiIndicator.validUntil tag: 'date_json_tiIndicator_validUntil' @@ -97,7 +97,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.tiIndicator.value target_field: sentinel_one_cloud_funnel.event.ti_indicator.value diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml b/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml index c61026dbe60..74daceca760 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 6m - description: "Time interval for polling listing of the S3 bucket. It should be greater than 5m. NOTE: Supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. It should be greater than 5m. Supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/sentinel_one_cloud_funnel/data_stream/event/sample_event.json b/packages/sentinel_one_cloud_funnel/data_stream/event/sample_event.json index 62d62683775..b379b0bf7f4 100644 --- a/packages/sentinel_one_cloud_funnel/data_stream/event/sample_event.json +++ b/packages/sentinel_one_cloud_funnel/data_stream/event/sample_event.json @@ -1,7 +1,7 @@ { "@timestamp": "2023-01-01T00:00:00.180Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one_cloud_funnel/docs/README.md b/packages/sentinel_one_cloud_funnel/docs/README.md index 1d9c7a7d2b2..a8891a9afde 100644 --- a/packages/sentinel_one_cloud_funnel/docs/README.md +++ b/packages/sentinel_one_cloud_funnel/docs/README.md @@ -114,7 +114,7 @@ An example event for `event` looks as following: { "@timestamp": "2023-01-01T00:00:00.180Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sentinel_one_cloud_funnel/kibana/tags.yml b/packages/sentinel_one_cloud_funnel/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sentinel_one_cloud_funnel/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sentinel_one_cloud_funnel/manifest.yml b/packages/sentinel_one_cloud_funnel/manifest.yml index a2172d5b997..b930c582007 100644 --- a/packages/sentinel_one_cloud_funnel/manifest.yml +++ b/packages/sentinel_one_cloud_funnel/manifest.yml @@ -1,13 +1,15 @@ -format_version: 2.8.0 +format_version: "3.0.0" name: sentinel_one_cloud_funnel title: SentinelOne Cloud Funnel -version: 0.1.0 +version: "0.5.0" description: Collect logs from SentinelOne Cloud Funnel with Elastic Agent. type: integration categories: ["security", "edr_xdr"] conditions: - kibana.version: ^8.7.1 - elastic.subscription: basic + kibana: + version: ^8.7.1 + elastic: + subscription: basic screenshots: - src: /img/sentinel-one-cloud-funnel-overview-dashboard.png title: SentinelOne Cloud Funnel Overview Dashboard Screenshot @@ -157,3 +159,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/slack/_dev/build/build.yml b/packages/slack/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/slack/_dev/build/build.yml +++ b/packages/slack/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/slack/_dev/deploy/docker/files/config.yml b/packages/slack/_dev/deploy/docker/files/config.yml index 99868d5f55e..7a7f8ab0416 100644 --- a/packages/slack/_dev/deploy/docker/files/config.yml +++ b/packages/slack/_dev/deploy/docker/files/config.yml @@ -5,8 +5,63 @@ rules: authorization: Bearer xoxp-1234567890 accept: application/json query_params: - oldest: "{oldest:\\d+}" - latest: "{latest:\\d+}" + oldest: "1683836285" + limit: "2" + responses: + - status_code: 200 + body: |- + { + "entries":[ + {"action":"file_downloaded","actor":{"type":"user","user":{"email":"user.mcuser@abcd.co","id":"2f53269c-4f38-4f58-b56d-c2b968681dbd","name":"User McUser","team":"user-team"}},"context":{"ip_address":"81.2.69.144","location":{"domain":"domain.tld","id":"eedd1a7d-1a92-418d-8b01-51a4c809d0fb","name":"The Place","type":"workspace"},"session_id":913888259765,"ua":"com.tinyspeck.chatlyio/23.04.40 (iPhone; iOS 1.4.1; Scale/3.00)"},"date_create":1683836290,"details":{"url_private":"https://example.com/"},"entity":{"file":{"filetype":"image/png","id":"7edc4c42-f925-47af-979a-22c10e1fefed","name":"image.png","title":"image.png"},"type":"file"},"id":"2db28080-1659-4b27-ad55-fdba12e3a7b1"}, + {"id":"1665fc41-c67c-4cf5-a5c4-d90cb58dd5f9","date_create":1683836291,"action":"anomaly","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"},"details":{"action_timestamp":1673631621862,"location":"England, GB","previous_ip_address":"175.16.199.64","previous_ua":"","reason":["asn","ip_address"]}} + ] + } + - path: /audit/v1/logs + methods: ["GET"] + request_headers: + authorization: Bearer xoxp-1234567890 + accept: application/json + query_params: + limit: "2" + cursor: GytjmKHF5hFmty + responses: + - status_code: 200 + body: |- + { + "entries":[ + {"action":"file_downloaded","actor":{"type":"user","user":{"email":"user.mcuser@abcd.co","id":"2f53269c-4f38-4f08-b56d-c2b968681dbd","name":"User McUser","team":"user-team"}},"context":{"ip_address":"81.2.69.144","location":{"domain":"domain.tld","id":"eedd1a7d-1a92-418d-8b01-51a4c809d0fb","name":"The Place","type":"workspace"},"session_id":913888259765,"ua":"com.tinyspeck.chatlyio/23.04.40 (iPhone; iOS 1.4.1; Scale/3.00)"},"date_create":1683836285,"details":{"url_private":"https://example.com/"},"entity":{"file":{"filetype":"image/png","id":"7edc4c42-f925-47af-979a-22c10e1fefed","name":"image.png","title":"image.png"},"type":"file"},"id":"2db28070-1659-4b27-ad55-fdba12e3a7b1"}, + {"id":"1665fb41-c67c-4cf5-a5c4-d90cb58dd5f9","date_create":1683836281,"action":"anomaly","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"},"details":{"action_timestamp":1673631621862,"location":"England, GB","previous_ip_address":"175.16.199.64","previous_ua":"","reason":["asn","ip_address"]}} + ], + "response_metadata": { + "next_cursor": "" + } + } + - path: /audit/v1/logs + methods: ["GET"] + request_headers: + authorization: Bearer xoxp-1234567890 + accept: application/json + query_params: + oldest: "1683836277" + limit: "2" + responses: + - status_code: 200 + body: |- + { + "entries":[ + {"id":"bdcd13e3-28a3-41f0-9ace-a20952def3a0","date_create":1683836285,"action":"user_created","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"181.2.69.143"}}, + {"id":"0126a45b-6c7d-8900-e12f-3456789gh0i1","date_create":1683836287,"action":"user_login","actor":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"entity":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"context":{"location":{"type":"enterprise","id":"E1701NCCA","name":"Birdland","domain":"birdland"},"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","ip_address":"81.2.69.143"}} + ], + "response_metadata": { + "next_cursor": "GytjmKHF5hFmty" + } + } + - path: /audit/v1/logs + methods: ["GET"] + request_headers: + authorization: Bearer xoxp-1234567890 + accept: application/json + query_params: limit: "2" cursor: YXNkZmFzZGZhc2Rm responses: @@ -15,8 +70,11 @@ rules: { "entries":[ {"action":"file_downloaded","actor":{"type":"user","user":{"email":"user.mcuser@abcd.co","id":"2f52269c-4f38-4f08-b56d-c2b968681dbd","name":"User McUser","team":"user-team"}},"context":{"ip_address":"81.2.69.144","location":{"domain":"domain.tld","id":"eedd1a7d-1a92-418d-8b01-51a4c809d0fb","name":"The Place","type":"workspace"},"session_id":913888259765,"ua":"com.tinyspeck.chatlyio/23.04.40 (iPhone; iOS 1.4.1; Scale/3.00)"},"date_create":1683836275,"details":{"url_private":"https://example.com/"},"entity":{"file":{"filetype":"image/png","id":"7edc4c42-f925-47af-979a-22c10e1fefed","name":"image.png","title":"image.png"},"type":"file"},"id":"2db28060-1659-4b27-ad55-fdba12e3a7b1"}, - {"id":"16f5fb41-c67c-4cf5-a5c4-d90cb58dd5f9","date_create":1673631531,"action":"anomaly","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"},"details":{"action_timestamp":1673631621862,"location":"England, GB","previous_ip_address":"175.16.199.64","previous_ua":"","reason":["asn","ip_address"]}} - ] + {"id":"16f5fb41-c67c-4cf5-a5c4-d90cb58dd5f9","date_create":1683836271,"action":"anomaly","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"},"details":{"action_timestamp":1673631621862,"location":"England, GB","previous_ip_address":"175.16.199.64","previous_ua":"","reason":["asn","ip_address"]}} + ], + "response_metadata": { + "next_cursor": "" + } } - path: /audit/v1/logs methods: ["GET"] @@ -25,15 +83,14 @@ rules: accept: application/json query_params: oldest: "{oldest:\\d+}" - latest: "{latest:\\d+}" limit: "2" responses: - status_code: 200 body: |- { "entries":[ - {"id":"bdcb13e3-28a3-41f0-9ace-a20952def3a0","date_create":1566215192,"action":"user_created","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"181.2.69.143"}}, - {"id":"0123a45b-6c7d-8900-e12f-3456789gh0i1","date_create":1521214343,"action":"user_login","actor":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"entity":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"context":{"location":{"type":"enterprise","id":"E1701NCCA","name":"Birdland","domain":"birdland"},"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","ip_address":"81.2.69.143"}} + {"id":"bdcb13e3-28a3-41f0-9ace-a20952def3a0","date_create":1683836277,"action":"user_created","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"181.2.69.143"}}, + {"id":"0123a45b-6c7d-8900-e12f-3456789gh0i1","date_create":1683836279,"action":"user_login","actor":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"entity":{"type":"user","user":{"id":"W123AB456","name":"Charlie Parker","email":"bird@slack.com"}},"context":{"location":{"type":"enterprise","id":"E1701NCCA","name":"Birdland","domain":"birdland"},"ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36","ip_address":"81.2.69.143"}} ], "response_metadata": { "next_cursor": "YXNkZmFzZGZhc2Rm" diff --git a/packages/slack/changelog.yml b/packages/slack/changelog.yml index fb0a5d0d18b..80ae91a7db5 100644 --- a/packages/slack/changelog.yml +++ b/packages/slack/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: "1.11.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.10.1" + changes: + - description: Fix handling of API query param 'oldest' + type: bugfix + link: https://github.com/elastic/integrations/pull/6958 +- version: "1.10.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7299 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.8.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.7.1" + changes: + - description: Parse action_timestamp values as microseconds since unix epoch. + type: bugfix + link: https://github.com/elastic/integrations/pull/6965 +- version: "1.7.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.6.0" changes: - description: Ensure error.message is correctly set for pipeline errors. diff --git a/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log b/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log index 7316bf4113a..194b56eda8f 100644 --- a/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log +++ b/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log @@ -2,3 +2,4 @@ {"id":"bdcb13e3-28a3-41f0-9ace-a20952def3a0","date_create":1566215192,"action":"user_created","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"}} {"action":"file_downloaded","actor":{"type":"user","user":{"email":"user.mcuser@abcd.co","id":"2f52269c-4f38-4f08-b56d-c2b968681dbd","name":"User McUser","team":"user-team"}},"context":{"ip_address":"81.2.69.144","location":{"domain":"domain.tld","id":"eedd1a7d-1a92-418d-8b01-51a4c809d0fb","name":"The Place","type":"workspace"},"session_id":913888259765,"ua":"com.tinyspeck.chatlyio/23.04.40 (iPhone; iOS 1.4.1; Scale/3.00)"},"date_create":1683836275,"details":{"url_private":"https://example.com/"},"entity":{"file":{"filetype":"image/png","id":"7edc4c42-f925-47af-979a-22c10e1fefed","name":"image.png","title":"image.png"},"type":"file"},"id":"2db28060-1659-4b27-ad55-fdba12e3a7b1"} {"id":"16f5fb41-c67c-4cf5-a5c4-d90cb58dd5f9","date_create":1673631531,"action":"anomaly","actor":{"type":"user","user":{"id":"e65b0f5c","name":"roy","email":"aaron@demo.com"}},"entity":{"type":"user","user":{"id":"asdfasdf","name":"Joe Bob","email":"jbob@example.com","team":"T234SAH2"}},"context":{"location":{"type":"workspace","id":"e65b11aa","name":"Docker","domain":"Docker"},"ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0","ip_address":"81.2.69.143"},"details":{"action_timestamp":1673631621862,"location":"England, GB","previous_ip_address":"175.16.199.64","previous_ua":"","reason":["asn","ip_address"]}} +{"action":"anomaly","actor":{"type":"user","user":{"email":"john@example.com","id":"U04V6RBUPAK","name":"John Doe","team":"Z0937DXQX"}},"context":{"ip_address":"192.168.220.224","location":{"domain":"example","id":"Z0937DXQX","name":"Acme","type":"workspace"},"session_id":9982493323637,"ua":"com.tinyspeck.chatlyio/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)"},"date_create":1689249764,"details":{"action_timestamp":1689249716345113,"location":"Tokyo, JP","previous_ip_address":"192.168.79.87","previous_ua":"com.tinyspeck.chatlyio.NotificationService/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)","reason":["asn","ip_address"]},"entity":{"type":"user","user":{"email":"john@example.com","id":"U04V6RBUPAK","name":"John Doe","team":"Z0937DXQX"}},"id":"abc8e17e-c081-4b82-a515-4c54674e3de4"} \ No newline at end of file diff --git a/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index 9902f0b65ad..c6f9a6af4ad 100644 --- a/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/slack/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-03-16T15:32:23.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_login", @@ -86,7 +86,7 @@ { "@timestamp": "2019-08-19T11:46:32.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user_created", @@ -168,7 +168,7 @@ { "@timestamp": "2023-05-11T20:17:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "file_downloaded", @@ -249,14 +249,16 @@ { "@timestamp": "2023-01-13T17:40:21.862Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "anomaly", "id": "16f5fb41-c67c-4cf5-a5c4-d90cb58dd5f9", "kind": "event", "original": "{\"id\":\"16f5fb41-c67c-4cf5-a5c4-d90cb58dd5f9\",\"date_create\":1673631531,\"action\":\"anomaly\",\"actor\":{\"type\":\"user\",\"user\":{\"id\":\"e65b0f5c\",\"name\":\"roy\",\"email\":\"aaron@demo.com\"}},\"entity\":{\"type\":\"user\",\"user\":{\"id\":\"asdfasdf\",\"name\":\"Joe Bob\",\"email\":\"jbob@example.com\",\"team\":\"T234SAH2\"}},\"context\":{\"location\":{\"type\":\"workspace\",\"id\":\"e65b11aa\",\"name\":\"Docker\",\"domain\":\"Docker\"},\"ua\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:23.0) Gecko/20131011 Firefox/23.0\",\"ip_address\":\"81.2.69.143\"},\"details\":{\"action_timestamp\":1673631621862,\"location\":\"England, GB\",\"previous_ip_address\":\"175.16.199.64\",\"previous_ua\":\"\",\"reason\":[\"asn\",\"ip_address\"]}}", - "type": "info" + "type": [ + "info" + ] }, "related": { "ip": [ @@ -329,6 +331,81 @@ }, "version": "23.0." } + }, + { + "@timestamp": "2023-07-13T12:01:56.345113Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "anomaly", + "id": "abc8e17e-c081-4b82-a515-4c54674e3de4", + "kind": "event", + "original": "{\"action\":\"anomaly\",\"actor\":{\"type\":\"user\",\"user\":{\"email\":\"john@example.com\",\"id\":\"U04V6RBUPAK\",\"name\":\"John Doe\",\"team\":\"Z0937DXQX\"}},\"context\":{\"ip_address\":\"192.168.220.224\",\"location\":{\"domain\":\"example\",\"id\":\"Z0937DXQX\",\"name\":\"Acme\",\"type\":\"workspace\"},\"session_id\":9982493323637,\"ua\":\"com.tinyspeck.chatlyio/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)\"},\"date_create\":1689249764,\"details\":{\"action_timestamp\":1689249716345113,\"location\":\"Tokyo, JP\",\"previous_ip_address\":\"192.168.79.87\",\"previous_ua\":\"com.tinyspeck.chatlyio.NotificationService/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)\",\"reason\":[\"asn\",\"ip_address\"]},\"entity\":{\"type\":\"user\",\"user\":{\"email\":\"john@example.com\",\"id\":\"U04V6RBUPAK\",\"name\":\"John Doe\",\"team\":\"Z0937DXQX\"}},\"id\":\"abc8e17e-c081-4b82-a515-4c54674e3de4\"}", + "type": [ + "info" + ] + }, + "related": { + "ip": [ + "192.168.220.224" + ], + "user": [ + "U04V6RBUPAK", + "john@example.com" + ] + }, + "slack": { + "audit": { + "context": { + "domain": "example", + "id": "Z0937DXQX", + "name": "Acme", + "session_id": "9982493323637", + "type": "workspace" + }, + "details": { + "location": "Tokyo, JP", + "previous_ip_address": "192.168.79.87", + "previous_user_agent": "com.tinyspeck.chatlyio.NotificationService/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)", + "reason": [ + "asn", + "ip_address" + ] + }, + "entity": { + "email": "john@example.com", + "entity_type": "user", + "id": "U04V6RBUPAK", + "name": "John Doe", + "team": "Z0937DXQX" + } + } + }, + "source": { + "address": "192.168.220.224", + "ip": "192.168.220.224" + }, + "tags": [ + "preserve_original_event" + ], + "user": { + "email": "john@example.com", + "full_name": "John Doe", + "id": "U04V6RBUPAK" + }, + "user_agent": { + "device": { + "name": "iPhone" + }, + "name": "Mobile Safari UI/WKWebView", + "original": "com.tinyspeck.chatlyio/23.07.10 (iPhone; iOS 16.5.1; Scale/3.00)", + "os": { + "full": "iOS 16.5.1", + "name": "iOS", + "version": "16.5.1" + } + } } ] } \ No newline at end of file diff --git a/packages/slack/data_stream/audit/_dev/test/system/test-default-config.yml b/packages/slack/data_stream/audit/_dev/test/system/test-default-config.yml index 1b2a2193af6..47a38decac1 100644 --- a/packages/slack/data_stream/audit/_dev/test/system/test-default-config.yml +++ b/packages/slack/data_stream/audit/_dev/test/system/test-default-config.yml @@ -9,5 +9,7 @@ data_stream: preserve_original_event: true oauth_token: xoxp-1234567890 limit: 2 + initial_interval: 4800h + interval: 10s assert: - hit_count: 4 + hit_count: 10 diff --git a/packages/slack/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/slack/data_stream/audit/agent/stream/httpjson.yml.hbs index 8be41fc3067..c6217f36373 100644 --- a/packages/slack/data_stream/audit/agent/stream/httpjson.yml.hbs +++ b/packages/slack/data_stream/audit/agent/stream/httpjson.yml.hbs @@ -19,13 +19,27 @@ request.transforms: - set: target: header.Authorization value: "Bearer {{oauth_token}}" + + - set: + target: url.params.cursor + value: '[[.cursor.next_cursor]]' + # An empty value omits this param from being set on the request. + # This should be omitted if it is a new request or a request after pagination is complete. + default: '' + - set: target: url.params.oldest - value: "[[.cursor.last_timestamp]]" + # If last pagination cycle was finished successully + # we move the oldest pointer forward + # else we continue processing using cursor + # If none of the values are in the cursor it means is a fresh start + # and we pick the default value. + value: |- + [[- if .cursor.pagination_finished -]] + [[- .cursor.next_oldest_date -]] + [[- end -]] default: '[[(now (parseDuration "-{{initial_interval}}")).Unix]]' - - set: - target: url.params.latest - value: '[[(now).Unix]]' + - set: target: url.params.limit value: '[[{{limit}}]]' @@ -36,15 +50,26 @@ request.rate_limit.remaining: '0' # hardcoded to 0 since slack doesn't return re response.split: target: body.entries response.pagination: -- set: - target: url.params.cursor - value: '[[.last_response.body.response_metadata.next_cursor]]' - fail_on_template_error: true + - set: + target: url.params.cursor + value: '[[.last_response.body.response_metadata.next_cursor]]' + fail_on_template_error: true + - delete: + target: url.params.oldest cursor: - last_timestamp: - value: "[[toInt .first_event.date_create]]" - fail_on_template_error: true + pagination_finished: + # Use this flag to identify if an execution was interrupted in the middle + # of a pagination cycle. + # For completed pagination next_cursor is "" and if the response is not paginated + # then the blob response_metadata does not exist + value: '[[and (not (index .last_response.body "response_metadata")) (eq (.last_response.body.response_metadata.Get "next_cursor") "")]]' + next_cursor: + # Use this value to be able to resume from an interrupted pagination cycle. + value: '[[.last_response.body.response_metadata.Get "next_cursor"]]' + next_oldest_date: + # In order to pick the next startDate we keep the first event (newest) date. + value: '[[toInt .first_event.date_create]]' {{#if tags.length}} tags: diff --git a/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index 34d9aa3edda..082edb62e31 100644 --- a/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Slack Audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -138,6 +138,15 @@ processors: field: json.details.reason target_field: slack.audit.details.reason ignore_missing: true +- script: + if: ctx.json?.details?.action_timestamp != null && ctx.json.details.action_timestamp > 1e13 + description: Parse action_timestamp as microseconds since unix epoch. + tag: action-timestamp-microseconds + source: | + def secs = (long)(ctx.json.details.action_timestamp/1e6); + def nanos = (long)(ctx.json.details.action_timestamp % 1e6) * 1000; + ctx["@timestamp"] = Instant.ofEpochSecond(secs, nanos).atZone(ZoneId.of("UTC")); + ctx.json.details.remove("action_timestamp"); - date: if: ctx.json?.details?.action_timestamp != null field: json.details.action_timestamp @@ -373,7 +382,7 @@ processors: - info source: | ctx.event.kind = 'event'; - ctx.event.type = 'info'; + ctx.event.type = ['info']; if (ctx.event?.action == null) { return; } diff --git a/packages/slack/data_stream/audit/manifest.yml b/packages/slack/data_stream/audit/manifest.yml index bb36a3b04fb..a4e8fbed144 100644 --- a/packages/slack/data_stream/audit/manifest.yml +++ b/packages/slack/data_stream/audit/manifest.yml @@ -16,7 +16,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 2m and 1h. + description: Interval at which the logs will be pulled. The value must be between 2m and 1h. Supported units for this parameter are h/m/s. default: 1h - name: initial_interval type: text @@ -24,7 +24,7 @@ streams: multi: false required: true show_user: false - description: Initial interval at which the logs will be pulled. Defaults to 30 days (720 hours). + description: Initial interval at which the logs will be pulled. Defaults to 30 days (720 hours). Supported units for this parameter are h/m/s. default: 720h - name: limit type: integer diff --git a/packages/slack/data_stream/audit/sample_event.json b/packages/slack/data_stream/audit/sample_event.json index 050bdfb171b..f81728e15bc 100644 --- a/packages/slack/data_stream/audit/sample_event.json +++ b/packages/slack/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-03-16T15:32:23.000Z", "agent": { - "ephemeral_id": "940a985c-ceec-4a32-9a49-0dd2beb2d7d1", - "id": "3b4885c5-66eb-4b06-a771-04c7f3b9ed82", + "ephemeral_id": "09ed6137-cc14-44bf-ae25-3bfb4867008e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "slack.audit", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3b4885c5-66eb-4b06-a771-04c7f3b9ed82", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "user_login", @@ -27,10 +27,10 @@ "authentication", "session" ], - "created": "2023-05-31T13:25:05.411Z", + "created": "2023-08-07T18:55:53.319Z", "dataset": "slack.audit", "id": "0123a45b-6c7d-8900-e12f-3456789gh0i1", - "ingested": "2023-05-31T13:25:06Z", + "ingested": "2023-08-07T18:55:54Z", "kind": "event", "original": "{\"action\":\"user_login\",\"actor\":{\"type\":\"user\",\"user\":{\"email\":\"bird@slack.com\",\"id\":\"W123AB456\",\"name\":\"Charlie Parker\"}},\"context\":{\"ip_address\":\"81.2.69.143\",\"location\":{\"domain\":\"birdland\",\"id\":\"E1701NCCA\",\"name\":\"Birdland\",\"type\":\"enterprise\"},\"ua\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36\"},\"date_create\":1521214343,\"entity\":{\"type\":\"user\",\"user\":{\"email\":\"bird@slack.com\",\"id\":\"W123AB456\",\"name\":\"Charlie Parker\"}},\"id\":\"0123a45b-6c7d-8900-e12f-3456789gh0i1\"}", "outcome": "success", diff --git a/packages/slack/docs/README.md b/packages/slack/docs/README.md index a9aa50d1a99..93558b71883 100644 --- a/packages/slack/docs/README.md +++ b/packages/slack/docs/README.md @@ -63,7 +63,7 @@ Audit logs summarize the history of changes made within the Slack Enterprise. | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -156,11 +156,11 @@ An example event for `audit` looks as following: { "@timestamp": "2018-03-16T15:32:23.000Z", "agent": { - "ephemeral_id": "940a985c-ceec-4a32-9a49-0dd2beb2d7d1", - "id": "3b4885c5-66eb-4b06-a771-04c7f3b9ed82", + "ephemeral_id": "09ed6137-cc14-44bf-ae25-3bfb4867008e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.9.0" }, "data_stream": { "dataset": "slack.audit", @@ -168,12 +168,12 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3b4885c5-66eb-4b06-a771-04c7f3b9ed82", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.7.1" + "version": "8.9.0" }, "event": { "action": "user_login", @@ -182,10 +182,10 @@ An example event for `audit` looks as following: "authentication", "session" ], - "created": "2023-05-31T13:25:05.411Z", + "created": "2023-08-07T18:55:53.319Z", "dataset": "slack.audit", "id": "0123a45b-6c7d-8900-e12f-3456789gh0i1", - "ingested": "2023-05-31T13:25:06Z", + "ingested": "2023-08-07T18:55:54Z", "kind": "event", "original": "{\"action\":\"user_login\",\"actor\":{\"type\":\"user\",\"user\":{\"email\":\"bird@slack.com\",\"id\":\"W123AB456\",\"name\":\"Charlie Parker\"}},\"context\":{\"ip_address\":\"81.2.69.143\",\"location\":{\"domain\":\"birdland\",\"id\":\"E1701NCCA\",\"name\":\"Birdland\",\"type\":\"enterprise\"},\"ua\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36\"},\"date_create\":1521214343,\"entity\":{\"type\":\"user\",\"user\":{\"email\":\"bird@slack.com\",\"id\":\"W123AB456\",\"name\":\"Charlie Parker\"}},\"id\":\"0123a45b-6c7d-8900-e12f-3456789gh0i1\"}", "outcome": "success", diff --git a/packages/slack/kibana/tags.yml b/packages/slack/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/slack/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/slack/manifest.yml b/packages/slack/manifest.yml index cb10193ebd5..2624c44be31 100644 --- a/packages/slack/manifest.yml +++ b/packages/slack/manifest.yml @@ -1,9 +1,7 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: slack title: "Slack Logs" -version: "1.6.0" -license: basic -release: ga +version: "1.11.0" description: "Slack Logs Integration" type: integration categories: @@ -56,6 +54,7 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true diff --git a/packages/snort/_dev/build/build.yml b/packages/snort/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/snort/_dev/build/build.yml +++ b/packages/snort/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/snort/changelog.yml b/packages/snort/changelog.yml index 06290323d0d..45c9ae6ce06 100644 --- a/packages/snort/changelog.yml +++ b/packages/snort/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.11.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.10.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 - version: "1.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-csv.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-csv.log-expected.json index edc4ead6e1b..5e38f6a3c00 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-csv.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-csv.log-expected.json @@ -9,7 +9,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -83,7 +83,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -157,7 +157,7 @@ "port": 55475 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -228,7 +228,7 @@ "port": 55333 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -299,7 +299,7 @@ "port": 32414 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -381,7 +381,7 @@ "mac": "00-25-90-3A-05-13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -456,7 +456,7 @@ "mac": "00-50-56-9D-A5-BE" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -555,7 +555,7 @@ "mac": "00-25-90-3A-05-13" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-fast.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-fast.log-expected.json index c57cd77a1c2..e2eff72502e 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-fast.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-fast.log-expected.json @@ -8,7 +8,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -76,7 +76,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -143,7 +143,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -220,7 +220,7 @@ "port": 1900 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -276,7 +276,7 @@ "port": 1051 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -343,7 +343,7 @@ "ip": "192.168.115.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -410,7 +410,7 @@ "port": 54757 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -478,7 +478,7 @@ "port": 36312 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -557,7 +557,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -611,7 +611,7 @@ "ip": "10.100.10.190" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-full.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-full.log-expected.json index 80187a6492f..22ab784275e 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-full.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-full.log-expected.json @@ -8,7 +8,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -80,7 +80,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -152,7 +152,7 @@ "port": 36635 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -231,7 +231,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -302,7 +302,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -374,7 +374,7 @@ "ip": "10.100.10.190" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -456,7 +456,7 @@ "port": 56012 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-json.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-json.log-expected.json index f34c2db0cb8..296dbd07d0f 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-json.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-json.log-expected.json @@ -8,7 +8,7 @@ "mac": "52-54-00-1F-8A-1C" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -88,7 +88,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -156,7 +156,7 @@ "port": 1047 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -258,7 +258,7 @@ "port": 68 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -336,7 +336,7 @@ "mac": "00-16-47-9D-F2-C2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-pfsense.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-pfsense.log-expected.json index 36c1792f0b1..2e0b4bf5cd4 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-pfsense.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-pfsense.log-expected.json @@ -20,7 +20,7 @@ "port": 91 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -105,7 +105,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -189,7 +189,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json index 469d357a1df..7f7e6f4aa37 100644 --- a/packages/snort/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json +++ b/packages/snort/data_stream/log/_dev/test/pipeline/test-log-syslog.log-expected.json @@ -8,7 +8,7 @@ "port": 32414 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -138,7 +138,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/snort/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/snort/data_stream/log/elasticsearch/ingest_pipeline/default.yml index ebcfb811796..9a6c76e31e3 100644 --- a/packages/snort/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/snort/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Snort logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/snort/data_stream/log/sample_event.json b/packages/snort/data_stream/log/sample_event.json index 596899004f4..9fa416e3894 100644 --- a/packages/snort/data_stream/log/sample_event.json +++ b/packages/snort/data_stream/log/sample_event.json @@ -29,7 +29,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ca0beb8d-9522-4450-8af7-3cb7f3d8c478", diff --git a/packages/snort/docs/README.md b/packages/snort/docs/README.md index 0d42073e527..54a8d7b26c8 100644 --- a/packages/snort/docs/README.md +++ b/packages/snort/docs/README.md @@ -44,7 +44,7 @@ An example event for `log` looks as following: "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "ca0beb8d-9522-4450-8af7-3cb7f3d8c478", @@ -154,9 +154,9 @@ An example event for `log` looks as following: | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/snort/kibana/tags.yml b/packages/snort/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/snort/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/snort/manifest.yml b/packages/snort/manifest.yml index f4ca5fa3f21..2a0724c7b05 100644 --- a/packages/snort/manifest.yml +++ b/packages/snort/manifest.yml @@ -1,6 +1,6 @@ name: snort title: Snort -version: "1.8.0" +version: "1.11.0" description: Collect logs from Snort with Elastic Agent. type: integration icons: @@ -8,10 +8,11 @@ icons: title: snort size: 120x60 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" categories: [ids_ips, security] conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" policy_templates: - name: snort title: Snort logs @@ -25,3 +26,4 @@ policy_templates: description: "Collecting logs from Snort instances (input: udp)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/snyk/_dev/build/build.yml b/packages/snyk/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/snyk/_dev/build/build.yml +++ b/packages/snyk/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/snyk/changelog.yml b/packages/snyk/changelog.yml index 8f353422ecb..3adce2bec8c 100644 --- a/packages/snyk/changelog.yml +++ b/packages/snyk/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.15.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.14.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.13.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.12.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.11.0" + changes: + - description: Update package-spec 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6852 - version: "1.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/snyk/data_stream/audit/_dev/test/pipeline/test-snyk-audit.log-expected.json b/packages/snyk/data_stream/audit/_dev/test/pipeline/test-snyk-audit.log-expected.json index 13bca746c23..7a6269fdb67 100644 --- a/packages/snyk/data_stream/audit/_dev/test/pipeline/test-snyk-audit.log-expected.json +++ b/packages/snyk/data_stream/audit/_dev/test/pipeline/test-snyk-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-11-17T14:30:13.800Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.logged_in", @@ -30,7 +30,7 @@ { "@timestamp": "2020-11-12T13:24:40.317Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "api.access", @@ -57,7 +57,7 @@ { "@timestamp": "2020-11-11T21:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.user.invite", @@ -85,7 +85,7 @@ { "@timestamp": "2020-11-15T06:02:45.497Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "org.user.role.edit", diff --git a/packages/snyk/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/snyk/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index ceb4c132f2c..00b643832d3 100644 --- a/packages/snyk/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/snyk/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Snyk Audit logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/snyk/data_stream/audit/fields/package-fields.yml b/packages/snyk/data_stream/audit/fields/package-fields.yml index a6f1fda959b..d145f7df11f 100644 --- a/packages/snyk/data_stream/audit/fields/package-fields.yml +++ b/packages/snyk/data_stream/audit/fields/package-fields.yml @@ -1,6 +1,5 @@ - name: snyk type: group - release: beta description: > Module for parsing Snyk project vulnerabilities. diff --git a/packages/snyk/data_stream/audit/sample_event.json b/packages/snyk/data_stream/audit/sample_event.json index 622549c5ccd..87e604df178 100644 --- a/packages/snyk/data_stream/audit/sample_event.json +++ b/packages/snyk/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2020-11-11T21:00:00.000Z", + "@timestamp": "2020-11-12T13:24:40.317Z", "agent": { - "ephemeral_id": "d625d71f-f6c0-4b21-a59c-8e6c6ca1cfa1", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "8dd58507-15bf-413b-bbbe-f278ce3905c3", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.1" }, "data_stream": { "dataset": "snyk.audit", @@ -13,23 +13,20 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.1" }, "event": { - "action": "org.user.invite", + "action": "api.access", "agent_id_status": "verified", - "created": "2022-01-02T10:21:09.808Z", + "created": "2023-07-06T18:45:03.747Z", "dataset": "snyk.audit", - "ingested": "2022-01-02T10:21:10Z", - "original": "{\"content\":{\"email\":\"someone@snyk.io\",\"isAdmin\":false},\"created\":\"2020-11-11T21:00:00.000Z\",\"event\":\"org.user.invite\",\"groupId\":\"groupid123test-543123-54312sadf-123ad\",\"orgId\":\"orgid123test-5643asd234-asdfasdf\",\"projectId\":null,\"userId\":\"userid123test-234sdfa2-423sdfa-2134\"}" - }, - "host": { - "name": "docker-fleet-agent" + "ingested": "2023-07-06T18:45:04Z", + "original": "{\"content\":{\"url\":\"/api/v1/org/orgid123test-5643asd234-asdfasdf/projects\"},\"created\":\"2020-11-12T13:24:40.317Z\",\"event\":\"api.access\",\"groupId\":\"groupid123test-543123-54312sadf-123ad\",\"orgId\":\"orgid123test-5643asd234-asdfasdf\",\"projectId\":null,\"userId\":\"userid123test-234sdfa2-423sdfa-2134\"}" }, "input": { "type": "httpjson" @@ -37,8 +34,7 @@ "snyk": { "audit": { "content": { - "email": "someone@snyk.io", - "isAdmin": false + "url": "/api/v1/org/orgid123test-5643asd234-asdfasdf/projects" }, "org_id": "orgid123test-5643asd234-asdfasdf" } diff --git a/packages/snyk/data_stream/vulnerabilities/_dev/test/pipeline/test-snyk-vulnerabilities.log-expected.json b/packages/snyk/data_stream/vulnerabilities/_dev/test/pipeline/test-snyk-vulnerabilities.log-expected.json index 1af3352f299..73644871061 100644 --- a/packages/snyk/data_stream/vulnerabilities/_dev/test/pipeline/test-snyk-vulnerabilities.log-expected.json +++ b/packages/snyk/data_stream/vulnerabilities/_dev/test/pipeline/test-snyk-vulnerabilities.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"issue\":{\"url\":\"https://snyk.io/vuln/npm:ejs:20161128\",\"id\":\"npm:ejs:20161128\",\"title\":\"Arbitrary Code Execution\",\"type\":\"vuln\",\"package\":\"ejs\",\"version\":\"0.8.8\",\"severity\":\"high\",\"originalSeverity\":null,\"uniqueSeveritiesList\":[\"high\"],\"language\":\"js\",\"packageManager\":\"npm\",\"semver\":{\"vulnerable\":[\"\u003c2.5.3\"]},\"isIgnored\":false,\"publicationTime\":\"2016-11-28T18:44:12.000Z\",\"disclosureTime\":\"2016-11-27T22:00:00.000Z\",\"isUpgradable\":false,\"isPatchable\":false,\"isPinnable\":false,\"identifiers\":{\"CVE\":[],\"CWE\":[\"CWE-94\"],\"ALTERNATIVE\":[\"SNYK-JS-EJS-10218\"]},\"credit\":[\"Snyk Security Research Team\"],\"CVSSv3\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"cvssScore\":\"8.1\",\"patches\":[{\"id\":\"patch:npm:ejs:20161128:0\",\"urls\":[\"https://snyk-patches.s3.amazonaws.com/npm/ejs/20161128/ejs_20161128_0_0_3d447c5a335844b25faec04b1132dbc721f9c8f6.patch\"],\"version\":\"\u003c2.5.3 \u003e=2.2.4\",\"comments\":[],\"modificationTime\":\"2019-12-03T11:40:45.851976Z\"}],\"isPatched\":false,\"exploitMaturity\":\"no-known-exploit\",\"reachability\":\"No Info\",\"priorityScore\":4.05,\"jiraIssueUrl\":null},\"isFixed\":false,\"introducedDate\":\"2020-04-07\",\"projects\":[{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"username/reponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"folder1/package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"projectname\",\"source\":\"cli\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"}]}" @@ -97,7 +97,9 @@ "preserve_original_event" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "reference": "https://snyk.io/vuln/npm:ejs:20161128", @@ -113,7 +115,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"issue\":{\"url\":\"https://snyk.io/vuln/npm:ejs:20161128\",\"id\":\"npm:ejs:20161121\",\"title\":\"Arbitrary Code Execution\",\"type\":\"vuln\",\"package\":\"ejs\",\"version\":\"0.8.8\",\"severity\":\"high\",\"originalSeverity\":null,\"uniqueSeveritiesList\":[\"high\"],\"language\":\"js\",\"packageManager\":\"npm\",\"semver\":{\"vulnerable\":[\"\u003c2.5.3\"]},\"isIgnored\":false,\"publicationTime\":\"2016-11-28T18:44:12.000Z\",\"disclosureTime\":\"2016-11-27T22:00:00.000Z\",\"isUpgradable\":false,\"isPatchable\":false,\"isPinnable\":false,\"identifiers\":{\"CVE\":[\"CVE-2017-1000228\"],\"CWE\":[\"CWE-94\"],\"ALTERNATIVE\":[\"SNYK-JS-EJS-10218\"]},\"credit\":[\"Snyk Security Research Team\"],\"CVSSv3\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"cvssScore\":\"8.1\",\"patches\":[{\"id\":\"patch:npm:ejs:20161128:0\",\"urls\":[\"https://snyk-patches.s3.amazonaws.com/npm/ejs/20161128/ejs_20161128_0_0_3d447c5a335844b25faec04b1132dbc721f9c8f6.patch\"],\"version\":\"\u003c2.5.3 \u003e=2.2.4\",\"comments\":[],\"modificationTime\":\"2019-12-03T11:40:45.851976Z\"}],\"isPatched\":false,\"exploitMaturity\":\"no-known-exploit\",\"reachability\":\"No Info\",\"priorityScore\":619,\"jiraIssueUrl\":null},\"isFixed\":false,\"introducedDate\":\"2020-11-13\",\"projects\":[{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"username/reponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"folder1/package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"projectname\",\"source\":\"cli\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"}]}" @@ -208,7 +210,9 @@ "preserve_original_event" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "id": [ @@ -227,7 +231,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"issue\":{\"url\":\"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488\",\"id\":\"SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488\",\"title\":\"Insecure Randomness\",\"type\":\"vuln\",\"package\":\"github.com/satori/go.uuid\",\"version\":\"#000000000000\",\"severity\":\"high\",\"originalSeverity\":null,\"uniqueSeveritiesList\":[\"high\"],\"language\":\"golang\",\"packageManager\":\"golang\",\"semver\":{\"vulnerable\":[\"=1.2.0\"],\"hashesRange\":[\"\u003e=0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c \u003cd91630c8510268e75203009fe7daf2b8e1d60c45\"],\"vulnerableHashes\":[\"c596ec57260fd2ad47b2ae6809d6890a2f99c3b2\",\"36e9d2ebbde5e3f13ab2e25625fd453271d6522e\",\"f6920249aa08fc2a2c2e8274ea9648d0bb1e9364\",\"0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c\"]},\"isIgnored\":false,\"publicationTime\":\"2018-10-24T08:56:41.000Z\",\"disclosureTime\":\"2018-03-23T08:57:24.000Z\",\"isUpgradable\":false,\"isPatchable\":false,\"isPinnable\":false,\"identifiers\":{\"CVE\":[],\"CWE\":[\"CWE-338\"]},\"credit\":[\"josselin-c\"],\"CVSSv3\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"cvssScore\":\"8.1\",\"patches\":[],\"isPatched\":false,\"exploitMaturity\":\"no-known-exploit\",\"reachability\":\"No Info\",\"priorityScore\":405,\"jiraIssueUrl\":null},\"isFixed\":false,\"introducedDate\":\"2020-11-17\",\"projects\":[{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"username/reponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"folder1/package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"projectname\",\"source\":\"cli\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"}]}" @@ -318,7 +322,9 @@ "preserve_original_event" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "reference": "https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488", @@ -334,7 +340,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "{\"issue\":{\"url\":\"https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGOYAMLYAML-564236\",\"id\":\"SNYK-GOLANG-GITHUBCOMGOYAMLYAML-564236\",\"title\":\"Denial of Service (DoS)\",\"type\":\"vuln\",\"package\":\"github.com/go-yaml/yaml\",\"version\":\"2.1.0\",\"severity\":\"medium\",\"originalSeverity\":null,\"uniqueSeveritiesList\":[\"medium\"],\"language\":\"golang\",\"packageManager\":\"golang\",\"semver\":{\"vulnerable\":[\"\u003c2.2.8\"],\"hashesRange\":[\"53403b58ad1b561927d19068c655246f2db79d48\"],\"vulnerableHashes\":[\"dd8f49ae7840d1fc6810d53ee7b05356da92f81f\",\"d4766d1dff71f8a135a57e1fcff946c8c1a140ab\",\"2aba0a492be00f1eb4d95483b08930ebe4968b64\",\"3b0eedc5a476efc2b2e025eff55b2fd08fa32abd\",\"2f2fd02e5a54a7d4f5e5d3494b170b0cb9275c92\",\"7ad95dd0798a40da1ccdff6dff35fd177b5edf40\",\"f7716cbe52baa25d2e9b0d0da546fcf909fc16b4\",\"1ff37a7d30b085dc643dee7adb18759e3511661a\",\"eca94c41d994ae2215d455ce578ae6e2dc6ee516\",\"b0c168ac0cf9493da1f9bb76c34b26ffef940b4a\",\"77373ee937410eceadc4dc64b1100d897ed593d0\",\"025607cd2e381e6e08a56ffec46ac79e23ca2d88\",\"7d17c9173a3d25ebba15cedb25b5205bdfb1eac8\",\"ca3d523f32f3b33fb3265bfeb8e11003a8670e3d\",\"85db785e81ed62ffae7a145404fc0f022335378c\",\"a72a87d92dad7563e31c2c007e8d67f93d67f221\",\"1be3d31502d6eabc0dd7ce5b0daab022e14a5538\",\"90376f16b6d74c4e2fff21dd24397bec3dc62dd5\",\"bb263360b83253468e534d974aabeddd6c22f887\",\"d466437aa4adc35830964cffc5b5f262c63ddcb4\",\"d6c23fbaf16f72995b58492627e65801cfb9a8dd\",\"e4d366fc3c7938e2958e662b4258c7a89e1f0e3e\",\"60a2abf4e00318875a661c29b36df7a68e484bf4\",\"f4d271a8a289b41fa88b802c430fefde4e018bba\",\"10c59a7d91867c206737dcd482fe68906a1484ca\",\"d0b6f3facf302fb1bf969a12bad68ce720b3c025\",\"4d6bb54d8acc91e147763cea066cff0b89437e90\",\"1244d3ce02e3e1c16820ada0bae506b6c479f106\",\"49fdd64ad429d146bacf7106dd73078e889be2e8\",\"8e626dec39b5836cef636d885e33479debcf0cb1\",\"4914593b9558e85597f08346c798aea8f6fb899f\",\"031c922227a592b2b562a1833438308381f9a8bf\",\"b51f82a2e3cbedab685908bd64d61d0a1b781754\",\"c75e52ecee48db6de9aa73d00a360d43abf3e7ac\",\"857a0b2759f87f47aaebad6dd319cf4f887eb6dc\",\"5887bc194be84805c8283e9d9a66102bf9571fca\",\"a528d0ef484d32e416d7b9c4a249d1fa7111be6e\",\"5b18502a28c65dfd209ea5aebb405fb6fc07f7e1\",\"5d6f7e02b7cdad63b06ab3877915532cd30073b4\",\"9c272e25743608d6d3287141522eb4506b2dac45\",\"125a562d7bf105e062ed2adfb2d37e6f11c209bd\",\"87e4a22b684220ccca96de3f2e651b2380a55f9e\",\"d56ec34a3ded0bb58c82198664664ccb81eec91b\",\"b754a4fe6ad8db932e083a2d85ae2199b3516bef\",\"04092268b2c5e87e6373229049c827b833af4edb\",\"f59f5e67022f3c186e20af01b1993b86ac74f0dc\",\"52d5976e4791cf8c96a9de7569098e3752677412\",\"770b8dae4cf00919e5eafffbd8d58186294b61b5\",\"71e7ede9d48a2e096f6d5d0516c763513a471bd1\",\"b01920c75e30179201b01633db246038b0226ce9\",\"ef0aede23c8c624e127a9a59183ee8915e48a3c9\",\"1632dd8118ce1efece66b7f53bb167956d5d8b4e\",\"05299e459464264cd87a230b62d1aca93725c51b\",\"d00346f943c9d2c43424c8a3840f5ca58817750d\",\"49c95bdc21843256fb6c4e0d370a05f24a0bf213\",\"088598405c86d37e951287d094d691e221654a00\",\"c11897f0ba79d8a35d8a124ff0d76e13d9dccb9b\",\"711419034010345c604724ef87ec3db91ffe0936\",\"3e6d767784b037b90a14701b6c9f0643f05db963\",\"a83829b6f1293c91addabc89d0571c246397bbf4\",\"ee2f4956ea46791a74a31142105f03c0d5f9492b\",\"7b079234548be56f14c6e342d4660aa8d54865b7\",\"b7fbda9990042cd5456fdf187480c25fdd776f92\",\"a6dc653f939ab0e6a554873806c41add1140d90c\",\"687eda924018599a7c4518013c369f0bfb7eb0e1\",\"fa9662d290d59b79f2ef7e1f72c885560efe512d\",\"e47eca576e8f3a433de0ba77f1923e7c7f959667\",\"e90bcf783f7abddaa0ee0994a09e536498744e49\",\"fdc1ab46101a842d9e914408bd481f6647d5f9c1\",\"f0766b44ca7999dc9af38a050ddf6db79d05bf3b\",\"cdd36ee8d333aa740c1c0bceae0da74969b2c60b\",\"7701d177ce02b7bd38c4ebd2ba4a7783080505ae\",\"2c1be0d7f7ff8305cf666e89152e9753c8b39004\",\"97203c6e4fc7347bfef3bd6d4913e90bd46c7ecb\",\"7c97801ccf41d5273de9e22c8b2af6860c7703a2\",\"7002636de42c9ef59a2921bb4f78744cabe8bfe3\",\"0725b7707fdeeb6894c403d0f5a2a20e1dc7454d\",\"1dd72ac3928693b9db2533639dfc2a5f831697eb\",\"73a1567027eea2fab2b057a193036f844736f7da\",\"7539b1dee2c790ab2d1aa5e254ef877f5552ff97\",\"920b7d819b42f26f4796e4a43f518090a7a6331f\",\"1f64d6156d11335c3f22d9330b0ad14fc1e789ce\",\"1b9791953ba4027efaeb728c7355e542a203be5e\",\"1ed59511881fdb008c1e618e9f219ce0704e658e\",\"c325d146e464fb9567e780ddfa2dad3a99323075\",\"0ee36981cbf495d5eb6aeb540a3afc25c61d1a96\",\"c4a9fb418357aceb801272d73efd518f183700fa\",\"a347d2466e459933f4fb25f8026d995977436ccf\",\"f221b8435cfb71e54062f6c6e99e9ade30b124d5\",\"5206f6dd03423b3a5462a2a4286a4efae8abe347\",\"a1c4bcb6c278a41992e2f4f0f29a44b4146daa5c\",\"4ca689e686c2caf4dda3a62936c097d6dfb56877\",\"119a11e4378a0410c69c42d82f51331a6da7a97c\",\"c7da9dcff86f24fcfdc15e1f9fa39dfc19784616\",\"f29dde21846f6357ee4421013b59eefd65c069b0\",\"5515099aacaeb9ff3ab7492f0803327bb19fc512\",\"1c9241b56a03383c77e1c33d86ea6ca4a927153e\",\"86f5ed62f8a0ee96bd888d2efdfd6d4fb100a4eb\",\"1f2a25ba9402c70a7806e84531ef763943739072\",\"1418a9bc452f9cf4efa70307cafcb10743e64a56\",\"65b1927d8262617ca3d25f296fdde1e8c48f813d\",\"2bf60357b89cbc6044dde700cf63bab94a615bf7\",\"c6314f5b627e2a1c1846d89cd775de6b2808d37e\",\"50e1b1b1332ea40fff2a9b13bfbccbbecd526f00\",\"50f7813e6b19e58334360ab011dfbaece5b1501f\",\"a311394a2a9276454d3f92d26838c3ae3d99cdf3\",\"79f5ef7c40ae7a4ee6bcd26d324bf50491b431e5\",\"731788bc8b082f8c81c63ca0abd5950c7a68a2f1\",\"6491ec31f7b0d27492e3046c86de94838dcb523c\",\"41168bb7ed2fc849bc36727a2b902bd8f447bfc2\",\"bc27649cd5454055cf20fdb9ef556c214d3f9aa0\",\"d6b53382672776035ad8ef0404681f8a4a16bb95\",\"8eba062837dc10754db7cbafcbedbfbc985ca172\",\"837b0877fcd6b2c8ba83d126917267695ff16ad8\",\"72c33f6840f49f9ed7d1faef7562b3266640fdf4\",\"26b882523374125854702734c30b0ce6a1a18d7b\",\"e90048704a8adb0b81b2e15ebafd1a35fa110903\",\"4fc5987536ef307a24ca299aee7ae301cde3d221\",\"4341420a144323d3f148ece677a20da6e077cfd2\",\"5c8bfe59213b6e9a5eb50debebc396e99a9fa174\",\"200c098a06472243b50aeda4510220a90c4e7dbe\",\"de3643d77b438c6f0f69f350c437639a300b5e73\",\"9a4310b1caff4cca3780580195a916ca060d08f7\",\"91eb945ac02153399ac9f69e34751f1a176254c3\",\"4cdd993908b57c3b87bef0695e5ca989151ad55f\",\"7ddc4634ce2d8ca5c03846918ae1df6aa40ee464\",\"ec232d2920a84930b077414b60b5985e076ae228\",\"2c8612dfee1362e7e482c66c5feb892a94d53255\",\"d670f9405373e636a5a2765eea47fac0c9bc91a4\",\"e9bfed595636e952566e5cb857c22b918f2530a2\",\"c1cd2254a6dd314c9d73c338c12688c9325d85c6\",\"df747160af0ebfcc572951e4168d4b1bc91a47f5\",\"a65e08b08285cef29253c50ffd92469bf6e26a29\",\"e6da37e746419537560c1e95e429f42b33f6d0e3\",\"eea198a9c5cc6e02bfcd130a932051088a9f0950\",\"6675ed2a9028caf87bb5915503c08a595e57b77d\",\"562080bfe963d41a6870a4c500918f6361a0b61f\",\"8171f560dedcb162dd3d2c925015679e84bac269\",\"c78cd3ebd83777ac093137fbb55c33a9d3f65819\",\"e4ac4c457c23b390e7fd75ddf746c5a69aa8cfd5\",\"93d787c44dc828e1c67fa275cb66eb86bb2929f8\",\"7cdd87a79f79db641dae55776224443026d28928\",\"406cad6bb47dd7d9a123d005fb8ff766f6463051\",\"523c7d9470684b02d902e8d986cd9eea66884755\",\"9ca8abd6882a6e741166e6ec946a73f3a64df65a\",\"885e19c0dda1f4e4e22837474879f8f3d36fb449\",\"e8976af76e3d35c48f8b2c9540cca3e92995fbc6\",\"addb3a024ff5763c8facbe4767fe530d602cfedc\",\"c7f6f9c6e6c14027a46eb91241427dba67604f39\",\"0a6d1b02c16e372ceea8f17f3b1833b918954bf1\",\"835086a6b6aa65939515e30b5d6c2eba43d7c075\",\"7b8fd2dbef04521fdd8d670ef4c77be691845aa2\",\"3eb2270747cdd89e3f095cb24e8dd4ccf2a098f6\",\"1d653a737648051ca638423377052c2f5c10c050\",\"14d1c4659ec7b9ee26f5d705f3c2bb56cb6cbee4\",\"c544d0342172409bd9c8f7c45d9fb21971c8aee9\",\"6941443daa441371720e9ef8f3554c3958cfb071\",\"f8db564a0a4a5f6d04f66522493597f18e5ab4ae\",\"7c634f6a68c1076d3cfdc56930db26e86f7876d7\",\"f7e23311052d3dda728ce15788fb3727898afa17\",\"8691640bc70f3d96128a809341d850b550a3abb9\",\"b9b22c434500d7639936fbed673fc0ef23ce88f6\",\"d6385b38675d8d03521c9290f4f3d7bff08664c0\",\"4c78c975fe7c825c6d1466c42be594d1d6f3aba6\",\"54c736c86c9bcc793fb4bd6f203604cd738dc0e9\",\"722ff6b958a31d4ca3405db35a72648a6077a6bb\",\"2afc2e57e051513a3f5f67e74857696a8558d67b\",\"283fbcdd1e64975730a38609f8802ef983a43cb9\",\"ab5d55c35f3919fe06e9daedce5a32f4aab23777\",\"e2fbf5b72a6a12abd15be9b37656a0a136fc32f8\",\"399c3345e0f76f583d830cd7da27518bbb00c91a\",\"b6679148d27038e59d7818facc4d100e677a64ae\",\"43a0256bb22b0c2e1803ac6e28f55e5989a60523\",\"f5f5cc19d1f681884684426c96adadef47a3b55c\",\"787afde64d7b36591050440c4a14c2288b373de6\",\"7b8349ac747c6a24702b762d2c4fd9266cf4f1d6\",\"0e4404da71227dcc02fb1deee803d93e86d08f72\",\"a95acef3719e5e9f7614cc90a119dee4699291eb\",\"3ba0e99ffa727bd7eb782b7a5d1aafcb989b0899\",\"5edc3ded41385ca1b9a80339d2a070e4d0a17cb6\",\"2c9db3558be789ef3896b03ed3f354b822c304b9\",\"a833012353d046b1f12c82db87d01c86570b24d7\",\"77b516425597da3c093a666c11608112e91604de\",\"1ade51a028efa6990b524e0b01237dbd9123957d\",\"9e27074feeaed4b0ae4e5e71187eff80c0f0bf35\",\"cd515839285fe1a31b92193360172d59f818c9b8\",\"9f33a69b86c3c76c52e41d12d83e233065bfcca9\",\"36babc3691687601732d9e2571b698be4116469a\",\"51d6538a90f86fe93ac480b35f37b2be17fef232\",\"31c299268d302dd0aa9a0dcf765a3d58971ac83f\",\"3e92d6a11b92fa4612d66712704844bdc0c48aed\",\"9211cbc02789a32acf5e90c23a42f040ac3ec3f8\",\"0cb32393ebcfc65467398e5daadfb63b2184caea\",\"0f9a5c380d77a8b2888a78c3d3a14db15949b1fa\",\"82377a97b299347cd15cc1be13e1c8d04e33efbb\",\"fe9486c37432968838e1798b2317dc1aa10b586b\",\"77b384eced7745af978888311ea3c67e57c7ed96\",\"fc7f19eff1782a0beae3065097c776183e7d01d0\",\"dbd6d0229d1f1e1c3055cd82efb81f60a27d1103\",\"25c4ec802a7d637f88d584ab26798e94ad14c13b\",\"5e76f7cf8cb1fc353b84b96c72a36c4984cbd005\",\"a5844a8f8f489bad96ab6da62cfa21ee1f5d9e6b\",\"41c132e8ac051886e4eb06e7c3d58ced63d58057\",\"4f03e946c120a8f146f43bee6f392f9bb5d0a677\",\"287cf08546ab5e7e37d55a84f7ed3fd1db036de5\",\"1092c5d94f266e0f94e485a24f7010da877eeba0\",\"910de082618d0d8ccac6443a6e7a72cc8bcd5227\",\"feb4ca79644e8e7e39c06095246ee54b1282c118\",\"3c68098bffba683534584be69216dac3a2b2305a\",\"3323b7713e656f16fbd0eec27c60370b6237f4e3\",\"f3293401ceedf2a32a1c22cb062b274dba6be798\",\"43607cc2a1772b23faf366c24b8e33541187b64d\",\"add015b1c64e144664b73d5eacfeb6aeace2e45c\",\"3e69410288aeb97d31353af8e063b798d40feb3f\",\"39e59aa7e15898a87148f0f4891a085c83b9b0fc\",\"a3f3340b5840cee44f372bddb5880fcbc419b46a\",\"05d405925260878bd750ea7d96c746c2d726b349\",\"65622dcbf4c25328cd440d1b322c6530abe83337\",\"8ca81d591dc2242f9c4b7a907533f0b7f93802b5\",\"3d8cfc3754fba03b8f1a0d44ea4e6e870cf86c57\",\"eb3733d160e74a9c7e442f435eb3bea458e1d19f\",\"d0fefed9b627fbe0c1597ac29ed5f48ff2eb9064\",\"dcd83b31fd165d8cc8677fce58f889dca3e06f35\",\"7f97868eec74b32b0982dd158a51a446d1da7eb5\",\"925f818e2c358746b3a14bf3e5614db14208037f\",\"c95af922eae69f190717a0b7148960af8c55a072\",\"0516c53462e633a479f3826e1d3557033413eeb8\",\"53087c11c10b453af4f2eb47471434eae75526f9\",\"5420a8b6744d3b0345ab293f6fcba19c978f1183\",\"fb03f24d58ac0c7a3d85edc1b91dfcfea4329883\",\"08434a82b8376f585898a97654ce18065d14cb97\",\"a5b47d31c556af34a302ce5d659e6fea44d90de0\",\"838f4ea96166350b9185bf3d2cbf786d34127ca2\",\"f2d2788ce5b1741745c0d1a853e856b5b77376b2\",\"284796d39ddb313ec0ae04898de280d41fe32479\",\"970885f01c8bc1fecb7ab1c8ce8e7609bda45530\",\"4f3d34e492b8930c50204a216d960e7da0dc5f63\",\"9f389a1f0b1d442eba00213e7aa09ccd878d18b0\",\"1b2e8c1531abbfe7dcd3de8ff4483326af275bc8\",\"14227de293ca979cf205cd88769fe71ed96a97e2\",\"e72f93569ef83aca933836c2fb9185faeeced236\",\"3b4ad1db5b2a649883ff3782f5f9f6fb52be71af\",\"a0ae8d516398f3724bb3db614ab47f0e4f643f2e\",\"f7a330473f18ddc052fce1f71a2b2d1231860f71\",\"81205292aba40f8868069e2f18d90043d3e724a6\",\"059398de19c863a04c55315526d6c226de540aa1\",\"e6ec13e5a80029d7ebcbc2c90d16ce5ff1fa6c84\",\"8173ecbc8953a159ae0fa2fad94adf3553b0bf8e\",\"b7dfe2d918fda477aa5b42519294b5ada3c991fa\",\"b6b591a3c0ec0452719f4d4555a3e084fd9f12fb\",\"ba29208cca8f239f2cea685183f79df8e4defc29\",\"422f540d2e1f1b41b6184903cd1eb69c777df1bb\",\"914e67f109a574665d15c0d179cdc796abefb176\",\"1bf6a7ce154075e61134f8a68dd50902c3027a10\",\"2628b30e544c309ac3d0c8cd7e78a785400cd41f\",\"0846a25da24891a7b3c725bc190493b5f7525db8\",\"4cadac2bc790baeffa0a7fa19689223966a64c24\",\"b3031338ac8e006cbd668f67c36c24d2c5e64b6d\",\"cd8b52f8269e0feb286dfeef29f8fe4d5b397e0b\",\"205b70273c7999d96b32db43ab54337690817184\",\"62e345dcf33dd13810ceba10407c30a7db6a0958\",\"53feefa2559fb8dfa8d81baad31be332c97d6c77\",\"e720624475f3807e3dc6477e7af6feb09da0b848\",\"bd61a856f807e525beaee41959452c88c83d46cf\",\"f90ceb4f409096b60e2e9076b38b304b8246e5fa\",\"3c0d4d4f56c36fcfd2da00ff26c40046512b4208\",\"1f1f61830e4c9f1eff03047c9d1d11e576853bc4\",\"f96735bc0fa70a12e9f41277b2d909e0c477ee30\",\"e334f8522ac9fe2b381c329b3159a328eeb14f76\",\"18e5f12b39cb93b31a249fb7115b9bbf6162aeeb\",\"b3472531944cd769419f297322dc285a0fc0d6cc\",\"3e542fbf7c84c0bf22f51ad07899cf80f8658caa\",\"00efe9c47819ca58089c4bd5d1d8463248e23228\",\"670d4cfef0544295bc27a114dbac37980d83185a\",\"8ed39f36d6f36299d2ce5f9b35a05d048500f777\",\"bb4e33bf68bf89cad44d386192cbed201f35b241\",\"bef53efd0c76e49e6de55ead051f886bea7e9420\",\"9eade332f0ceebc6b7c9e24893574cad4c51722b\"]},\"isIgnored\":false,\"publicationTime\":\"2020-04-02T11:29:49.000Z\",\"disclosureTime\":\"2020-03-26T11:30:05.000Z\",\"isUpgradable\":false,\"isPatchable\":false,\"isPinnable\":false,\"identifiers\":{\"CVE\":[\"CVE-2019-11254\"],\"CWE\":[\"CWE-1050\"]},\"credit\":[\"Unknown\"],\"CVSSv3\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"cvssScore\":\"6.5\",\"patches\":[],\"isPatched\":false,\"exploitMaturity\":\"no-known-exploit\",\"reachability\":\"No Info\",\"priorityScore\":325,\"jiraIssueUrl\":null},\"isFixed\":false,\"introducedDate\":\"2020-04-29\",\"projects\":[{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"username/reponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"source\":\"github\",\"packageManager\":\"npm\",\"targetFile\":\"folder1/package.json\"},{\"url\":\"https://snyk.io/org/orgname/project/projectid\",\"id\":\"projectid\",\"name\":\"projectname\",\"source\":\"cli\",\"packageManager\":\"npm\",\"targetFile\":\"package.json\"}]}" @@ -699,7 +705,9 @@ "preserve_original_event" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "id": [ diff --git a/packages/snyk/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml b/packages/snyk/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml index b71e38e0b84..863723ac8d3 100644 --- a/packages/snyk/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml +++ b/packages/snyk/data_stream/vulnerabilities/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Snyk vulnerability logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -19,7 +19,7 @@ processors: value: CVSS - set: field: vulnerability.category - value: Github + value: ["Github"] - set: field: vulnerability.scanner.vendor value: Snyk diff --git a/packages/snyk/data_stream/vulnerabilities/fields/package-fields.yml b/packages/snyk/data_stream/vulnerabilities/fields/package-fields.yml index a6f1fda959b..d145f7df11f 100644 --- a/packages/snyk/data_stream/vulnerabilities/fields/package-fields.yml +++ b/packages/snyk/data_stream/vulnerabilities/fields/package-fields.yml @@ -1,6 +1,5 @@ - name: snyk type: group - release: beta description: > Module for parsing Snyk project vulnerabilities. diff --git a/packages/snyk/data_stream/vulnerabilities/sample_event.json b/packages/snyk/data_stream/vulnerabilities/sample_event.json index 568e2d3cf3a..f59c7a13e66 100644 --- a/packages/snyk/data_stream/vulnerabilities/sample_event.json +++ b/packages/snyk/data_stream/vulnerabilities/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-01-02T10:21:46.407Z", + "@timestamp": "2023-07-06T18:46:12.851Z", "agent": { - "ephemeral_id": "b6ade099-0307-4079-b700-1b29dfb838ff", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "eadbc5df-eed9-4729-9f23-a701b539bf47", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.1" }, "data_stream": { "dataset": "snyk.vulnerabilities", @@ -13,23 +13,20 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", - "created": "2022-01-02T10:21:46.407Z", + "created": "2023-07-06T18:46:12.851Z", "dataset": "snyk.vulnerabilities", - "ingested": "2022-01-02T10:21:47Z", + "ingested": "2023-07-06T18:46:13Z", "original": "{\"introducedDate\":\"2020-04-07\",\"isFixed\":false,\"issue\":{\"CVSSv3\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"credit\":[\"Snyk Security Research Team\"],\"cvssScore\":\"8.1\",\"disclosureTime\":\"2016-11-27T22:00:00.000Z\",\"exploitMaturity\":\"no-known-exploit\",\"id\":\"npm:ejs:20161128\",\"identifiers\":{\"ALTERNATIVE\":[\"SNYK-JS-EJS-10218\"],\"CVE\":[],\"CWE\":[\"CWE-94\"]},\"isIgnored\":false,\"isPatchable\":false,\"isPatched\":false,\"isPinnable\":false,\"isUpgradable\":false,\"jiraIssueUrl\":null,\"language\":\"js\",\"originalSeverity\":null,\"package\":\"ejs\",\"packageManager\":\"npm\",\"patches\":[{\"comments\":[],\"id\":\"patch:npm:ejs:20161128:0\",\"modificationTime\":\"2019-12-03T11:40:45.851976Z\",\"urls\":[\"https://snyk-patches.s3.amazonaws.com/npm/ejs/20161128/ejs_20161128_0_0_3d447c5a335844b25faec04b1132dbc721f9c8f6.patch\"],\"version\":\"\\u003c2.5.3 \\u003e=2.2.4\"}],\"priorityScore\":4.05,\"publicationTime\":\"2016-11-28T18:44:12.000Z\",\"reachability\":\"No Info\",\"semver\":{\"vulnerable\":[\"\\u003c2.5.3\"]},\"severity\":\"high\",\"title\":\"Arbitrary Code Execution\",\"type\":\"vuln\",\"uniqueSeveritiesList\":[\"high\"],\"url\":\"https://snyk.io/vuln/npm:ejs:20161128\",\"version\":\"0.8.8\"},\"projects\":[{\"id\":\"projectid\",\"name\":\"username/reponame\",\"packageManager\":\"npm\",\"source\":\"github\",\"targetFile\":\"package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"},{\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"packageManager\":\"npm\",\"source\":\"github\",\"targetFile\":\"folder1/package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"},{\"id\":\"projectid\",\"name\":\"projectname\",\"packageManager\":\"npm\",\"source\":\"cli\",\"targetFile\":\"package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"}]}" }, - "host": { - "name": "docker-fleet-agent" - }, "input": { "type": "httpjson" }, @@ -125,7 +122,9 @@ "snyk-vulnerabilities" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "reference": "https://snyk.io/vuln/npm:ejs:20161128", diff --git a/packages/snyk/docs/README.md b/packages/snyk/docs/README.md index 537c0b950d3..17aa278a6c1 100644 --- a/packages/snyk/docs/README.md +++ b/packages/snyk/docs/README.md @@ -14,13 +14,13 @@ An example event for `audit` looks as following: ```json { - "@timestamp": "2020-11-11T21:00:00.000Z", + "@timestamp": "2020-11-12T13:24:40.317Z", "agent": { - "ephemeral_id": "d625d71f-f6c0-4b21-a59c-8e6c6ca1cfa1", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "8dd58507-15bf-413b-bbbe-f278ce3905c3", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.1" }, "data_stream": { "dataset": "snyk.audit", @@ -28,23 +28,20 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.1" }, "event": { - "action": "org.user.invite", + "action": "api.access", "agent_id_status": "verified", - "created": "2022-01-02T10:21:09.808Z", + "created": "2023-07-06T18:45:03.747Z", "dataset": "snyk.audit", - "ingested": "2022-01-02T10:21:10Z", - "original": "{\"content\":{\"email\":\"someone@snyk.io\",\"isAdmin\":false},\"created\":\"2020-11-11T21:00:00.000Z\",\"event\":\"org.user.invite\",\"groupId\":\"groupid123test-543123-54312sadf-123ad\",\"orgId\":\"orgid123test-5643asd234-asdfasdf\",\"projectId\":null,\"userId\":\"userid123test-234sdfa2-423sdfa-2134\"}" - }, - "host": { - "name": "docker-fleet-agent" + "ingested": "2023-07-06T18:45:04Z", + "original": "{\"content\":{\"url\":\"/api/v1/org/orgid123test-5643asd234-asdfasdf/projects\"},\"created\":\"2020-11-12T13:24:40.317Z\",\"event\":\"api.access\",\"groupId\":\"groupid123test-543123-54312sadf-123ad\",\"orgId\":\"orgid123test-5643asd234-asdfasdf\",\"projectId\":null,\"userId\":\"userid123test-234sdfa2-423sdfa-2134\"}" }, "input": { "type": "httpjson" @@ -52,8 +49,7 @@ An example event for `audit` looks as following: "snyk": { "audit": { "content": { - "email": "someone@snyk.io", - "isAdmin": false + "url": "/api/v1/org/orgid123test-5643asd234-asdfasdf/projects" }, "org_id": "orgid123test-5643asd234-asdfasdf" } @@ -81,7 +77,7 @@ An example event for `audit` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | @@ -123,13 +119,13 @@ An example event for `vulnerabilities` looks as following: ```json { - "@timestamp": "2022-01-02T10:21:46.407Z", + "@timestamp": "2023-07-06T18:46:12.851Z", "agent": { - "ephemeral_id": "b6ade099-0307-4079-b700-1b29dfb838ff", - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "ephemeral_id": "eadbc5df-eed9-4729-9f23-a701b539bf47", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0-beta1" + "version": "8.8.1" }, "data_stream": { "dataset": "snyk.vulnerabilities", @@ -137,23 +133,20 @@ An example event for `vulnerabilities` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "b1d83907-ff3e-464a-b79a-cf843f6f0bba", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.0.0-beta1" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", - "created": "2022-01-02T10:21:46.407Z", + "created": "2023-07-06T18:46:12.851Z", "dataset": "snyk.vulnerabilities", - "ingested": "2022-01-02T10:21:47Z", + "ingested": "2023-07-06T18:46:13Z", "original": "{\"introducedDate\":\"2020-04-07\",\"isFixed\":false,\"issue\":{\"CVSSv3\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"credit\":[\"Snyk Security Research Team\"],\"cvssScore\":\"8.1\",\"disclosureTime\":\"2016-11-27T22:00:00.000Z\",\"exploitMaturity\":\"no-known-exploit\",\"id\":\"npm:ejs:20161128\",\"identifiers\":{\"ALTERNATIVE\":[\"SNYK-JS-EJS-10218\"],\"CVE\":[],\"CWE\":[\"CWE-94\"]},\"isIgnored\":false,\"isPatchable\":false,\"isPatched\":false,\"isPinnable\":false,\"isUpgradable\":false,\"jiraIssueUrl\":null,\"language\":\"js\",\"originalSeverity\":null,\"package\":\"ejs\",\"packageManager\":\"npm\",\"patches\":[{\"comments\":[],\"id\":\"patch:npm:ejs:20161128:0\",\"modificationTime\":\"2019-12-03T11:40:45.851976Z\",\"urls\":[\"https://snyk-patches.s3.amazonaws.com/npm/ejs/20161128/ejs_20161128_0_0_3d447c5a335844b25faec04b1132dbc721f9c8f6.patch\"],\"version\":\"\\u003c2.5.3 \\u003e=2.2.4\"}],\"priorityScore\":4.05,\"publicationTime\":\"2016-11-28T18:44:12.000Z\",\"reachability\":\"No Info\",\"semver\":{\"vulnerable\":[\"\\u003c2.5.3\"]},\"severity\":\"high\",\"title\":\"Arbitrary Code Execution\",\"type\":\"vuln\",\"uniqueSeveritiesList\":[\"high\"],\"url\":\"https://snyk.io/vuln/npm:ejs:20161128\",\"version\":\"0.8.8\"},\"projects\":[{\"id\":\"projectid\",\"name\":\"username/reponame\",\"packageManager\":\"npm\",\"source\":\"github\",\"targetFile\":\"package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"},{\"id\":\"projectid\",\"name\":\"someotheruser/someotherreponame\",\"packageManager\":\"npm\",\"source\":\"github\",\"targetFile\":\"folder1/package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"},{\"id\":\"projectid\",\"name\":\"projectname\",\"packageManager\":\"npm\",\"source\":\"cli\",\"targetFile\":\"package.json\",\"url\":\"https://snyk.io/org/orgname/project/projectid\"}]}" }, - "host": { - "name": "docker-fleet-agent" - }, "input": { "type": "httpjson" }, @@ -249,7 +242,9 @@ An example event for `vulnerabilities` looks as following: "snyk-vulnerabilities" ], "vulnerability": { - "category": "Github", + "category": [ + "Github" + ], "classification": "CVSS", "enumeration": "CVE", "reference": "https://snyk.io/vuln/npm:ejs:20161128", @@ -274,7 +269,7 @@ An example event for `vulnerabilities` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | diff --git a/packages/snyk/kibana/tags.yml b/packages/snyk/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/snyk/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/snyk/manifest.yml b/packages/snyk/manifest.yml index 876de67cbfc..9dbcf2614e3 100644 --- a/packages/snyk/manifest.yml +++ b/packages/snyk/manifest.yml @@ -1,15 +1,14 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: snyk title: "Snyk" -version: "1.10.0" -license: basic +version: "1.15.0" description: Collect logs from Snyk with Elastic Agent. type: integration categories: - security -release: ga conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/snyk-logo.svg title: Snyk logo @@ -48,6 +47,7 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true @@ -67,3 +67,4 @@ policy_templates: show_user: false owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/sonicwall_firewall/_dev/build/build.yml b/packages/sonicwall_firewall/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/sonicwall_firewall/_dev/build/build.yml +++ b/packages/sonicwall_firewall/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/sonicwall_firewall/changelog.yml b/packages/sonicwall_firewall/changelog.yml index 720aca2caa0..8946896b076 100644 --- a/packages/sonicwall_firewall/changelog.yml +++ b/packages/sonicwall_firewall/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.10.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.9.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.8.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.7.0" + changes: + - description: Update to package-spec 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6849 - version: "1.6.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-drizzthacker.log-expected.json b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-drizzthacker.log-expected.json index a5e4e9ac20e..723b701ca55 100644 --- a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-drizzthacker.log-expected.json +++ b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-drizzthacker.log-expected.json @@ -19,7 +19,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -58,7 +58,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -91,7 +93,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -132,7 +134,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -183,7 +187,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -216,7 +220,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -260,7 +266,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1220", @@ -274,7 +280,9 @@ }, "message": "Invalid SNMP packet (Invalid engineID: 0)", "observer": { - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -303,7 +311,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "session-start", @@ -339,7 +347,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -379,7 +389,7 @@ "port": 45071 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -415,7 +425,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -457,7 +469,7 @@ "port": 35878 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -493,7 +505,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -544,7 +558,7 @@ "port": 10617 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "866", @@ -566,7 +580,9 @@ "name": "X0" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -620,7 +636,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "867", @@ -643,7 +659,9 @@ "name": "X0" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -694,7 +712,7 @@ "port": 56432 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "internal-log-failure", @@ -730,7 +748,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -770,7 +790,7 @@ "port": 22402 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -801,7 +821,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -840,7 +862,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1231", @@ -864,7 +886,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -904,7 +928,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "326", @@ -928,7 +952,9 @@ "name": "X1" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -965,7 +991,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1232", @@ -989,7 +1015,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1013,7 +1041,7 @@ { "@timestamp": "2022-04-27T10:24:35.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "586", @@ -1032,7 +1060,9 @@ "name": "X1" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1055,7 +1085,7 @@ { "@timestamp": "2022-04-27T10:24:35.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "307", @@ -1074,7 +1104,9 @@ "name": "X5" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1099,7 +1131,7 @@ "ip": "172.16.1.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "584", @@ -1123,7 +1155,9 @@ "name": "X1" } }, - "ip": "172.16.1.1", + "ip": [ + "172.16.1.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1146,7 +1180,7 @@ { "@timestamp": "2022-04-28T06:38:51.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1371", @@ -1160,7 +1194,9 @@ }, "message": "Possible TCP Flood on IF X1 - src: 82.98.136.100:80 dst: 172.16.0.2:15912 - rate: 1869/sec continues", "observer": { - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1184,7 +1220,7 @@ "port": 37462 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1370", @@ -1211,7 +1247,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1253,7 +1291,7 @@ "port": 12137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -1289,7 +1327,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1331,7 +1371,7 @@ "port": 61017 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -1367,7 +1407,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1420,7 +1462,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "436", @@ -1444,7 +1486,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1467,7 +1511,7 @@ { "@timestamp": "2022-04-27T23:04:26.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "585", @@ -1486,7 +1530,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1513,7 +1559,7 @@ "port": 81 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-blocked", @@ -1544,7 +1590,9 @@ "name": "X1" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1585,7 +1633,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "session-end", @@ -1622,7 +1670,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1661,7 +1711,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "session-end", @@ -1697,7 +1747,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1725,7 +1777,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-success", @@ -1762,7 +1814,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1801,7 +1855,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "logout", @@ -1836,7 +1890,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1874,7 +1930,7 @@ "ip": "172.16.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "435", @@ -1898,7 +1954,9 @@ "name": "X5" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1921,7 +1979,7 @@ { "@timestamp": "2022-04-29T03:46:56.000+02:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "internal-log-failure", @@ -1944,7 +2002,9 @@ }, "message": "Response from NTP Server is either incomplete or invalid", "observer": { - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -1976,7 +2036,7 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1230", @@ -2000,7 +2060,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", @@ -2028,7 +2090,7 @@ "port": 4444 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-failure", @@ -2065,7 +2127,9 @@ "name": "X0" } }, - "ip": "172.16.0.2", + "ip": [ + "172.16.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0000A0AAAA00", diff --git a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-general.log-expected.json b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-general.log-expected.json index b3c23aa4a27..7064efbf9b2 100644 --- a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-general.log-expected.json +++ b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-general.log-expected.json @@ -7,7 +7,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -44,7 +44,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -84,7 +86,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-failure", @@ -118,7 +120,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -158,7 +162,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -195,7 +199,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -236,7 +242,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -275,7 +281,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -306,7 +314,7 @@ "port": 1026 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -344,7 +352,9 @@ "name": "LAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -380,7 +390,7 @@ "port": 41850 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -418,7 +428,9 @@ "name": "LAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -466,7 +478,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -504,7 +516,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -533,7 +547,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -570,7 +584,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -610,7 +626,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "login-failure", @@ -644,7 +660,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -684,7 +702,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -721,7 +739,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -761,7 +781,7 @@ "port": 6822 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-dropped", @@ -794,7 +814,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -840,7 +862,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -877,7 +899,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -917,7 +941,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "346", @@ -931,7 +955,9 @@ }, "message": "IKE Initiator: Start Quick Mode (Phase 2).", "observer": { - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -983,7 +1009,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1020,7 +1046,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1048,7 +1076,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "483", @@ -1062,7 +1090,9 @@ }, "message": "Received notify: INVALID_ID_INFO", "observer": { - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1102,7 +1132,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1140,7 +1170,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1169,7 +1201,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1206,7 +1238,9 @@ "name": "LAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1236,7 +1270,7 @@ "port": 50000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -1274,7 +1308,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1317,7 +1353,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -1357,7 +1393,9 @@ "name": "LAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1393,7 +1431,7 @@ "port": 3582 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1430,7 +1468,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1458,7 +1498,7 @@ "ip": "192.168.5.10" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1486,7 +1526,9 @@ "transport": "tcp" }, "observer": { - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1515,7 +1557,7 @@ "ip": "::1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1553,7 +1595,9 @@ "name": "WAN" } }, - "ip": "1.128.3.4", + "ip": [ + "1.128.3.4" + ], "name": "firewall", "product": "SonicOS", "serial_number": "000SERIAL", @@ -1592,7 +1636,7 @@ "mac": "00-53-00-00-00-0C" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "id=firewall sn=XXXXXXX time=\"2015-11-21 14:30:38\" fw=10.0.0.1 pri=5 msg=\"Unhandled link-local or multicast IPv6 packet dropped\" srcV6=fe80::d4db:99b9:6f20:f6bd dstV6=ff02::c srcMac=00:53:ff:ff:55:55 dstMac=00:53:00:00:00:0c proto=udp/65535", @@ -1607,7 +1651,9 @@ "transport": "udp" }, "observer": { - "ip": "10.0.0.1", + "ip": [ + "10.0.0.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "XXXXXXX", @@ -1647,7 +1693,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "1388", @@ -1661,7 +1707,9 @@ }, "message": "IPSec VPN Decryption Failed (Replay check failure.)", "observer": { - "ip": "172.29.1.2", + "ip": [ + "172.29.1.2" + ], "name": "YYYYYY", "product": "SonicOS", "serial_number": "XXXX", @@ -1709,7 +1757,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-info", @@ -1746,7 +1794,9 @@ "name": "X500" } }, - "ip": "10.1.1.1", + "ip": [ + "10.1.1.1" + ], "name": "YYYYYY", "product": "SonicOS", "serial_number": "XXXX", @@ -1791,7 +1841,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -1829,7 +1879,9 @@ "name": "X0" } }, - "ip": "10.1.1.1", + "ip": [ + "10.1.1.1" + ], "name": "YYYYYY", "product": "SonicOS", "serial_number": "XXXX", @@ -1890,7 +1942,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1929,7 +1981,9 @@ "name": "X0" } }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "123456789", @@ -1996,7 +2050,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -2027,7 +2081,9 @@ }, "zone": "Trusted" }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "123456789", @@ -2102,7 +2158,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -2138,7 +2194,9 @@ }, "zone": "Trusted" }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2210,7 +2268,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -2241,7 +2299,9 @@ }, "zone": "Trusted" }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2313,7 +2373,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -2349,7 +2409,9 @@ }, "zone": "Trusted" }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2422,7 +2484,7 @@ "port": 8800 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -2461,7 +2523,9 @@ "name": "X0" } }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2505,7 +2569,7 @@ "port": 1850 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-detected", @@ -2538,7 +2602,9 @@ "name": "X1" } }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2603,7 +2669,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "97", @@ -2634,7 +2700,9 @@ }, "zone": "Trusted" }, - "ip": "10.0.0.2", + "ip": [ + "10.0.0.2" + ], "name": "firewall", "product": "SonicOS", "serial_number": "12345678", @@ -2707,7 +2775,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "attack-blocked", @@ -2740,7 +2808,9 @@ "name": "X20-V60" } }, - "ip": "192.168.33.1", + "ip": [ + "192.168.33.1" + ], "name": "firewall", "product": "SonicOS", "serial_number": "ZZZZZZZZZ", @@ -2797,7 +2867,7 @@ "port": 4433 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -2835,7 +2905,9 @@ "name": "X4-V1032" } }, - "ip": "192.168.255.6", + "ip": [ + "192.168.255.6" + ], "name": "firewall", "product": "SonicOS", "serial_number": "xxxxxxxxxxxxxxx", @@ -2895,7 +2967,7 @@ "port": 4433 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -2933,7 +3005,9 @@ "name": "X4-V1032" } }, - "ip": "192.168.255.6", + "ip": [ + "192.168.255.6" + ], "name": "firewall", "product": "SonicOS", "serial_number": "xxxxxxxxxxxxxxx", @@ -2984,7 +3058,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -3027,7 +3101,9 @@ }, "zone": "TEST" }, - "ip": "192.168.255.6", + "ip": [ + "192.168.255.6" + ], "name": "firewall", "product": "SonicOS", "serial_number": "xxxxxxxxxxxxxxx", diff --git a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-nat.log-expected.json b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-nat.log-expected.json index 86fbfbbabc1..637acc4b6bd 100644 --- a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-nat.log-expected.json +++ b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-nat.log-expected.json @@ -11,7 +11,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -43,7 +43,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -87,7 +89,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -119,7 +121,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -166,7 +170,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -198,7 +202,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -242,7 +248,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -274,7 +280,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", diff --git a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-sonicos70-aws.log-expected.json b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-sonicos70-aws.log-expected.json index 5920ef33215..40d518caf72 100644 --- a/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-sonicos70-aws.log-expected.json +++ b/packages/sonicwall_firewall/data_stream/log/_dev/test/pipeline/test-sonicos70-aws.log-expected.json @@ -9,7 +9,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -50,7 +50,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -111,7 +113,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -152,7 +154,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -213,7 +217,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -254,7 +258,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -313,7 +319,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -352,7 +358,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -407,7 +415,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -436,7 +444,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -506,7 +516,7 @@ "port": 64889 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -547,7 +557,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -607,7 +619,7 @@ "port": 64889 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -648,7 +660,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -695,7 +709,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "config-change", @@ -723,7 +737,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -780,7 +796,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "config-change", @@ -808,7 +824,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -867,7 +885,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -910,7 +928,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -973,7 +993,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -1016,7 +1036,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1079,7 +1101,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -1121,7 +1143,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1175,7 +1199,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1214,7 +1238,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1272,7 +1298,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -1304,7 +1330,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1363,7 +1391,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1402,7 +1430,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1460,7 +1490,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -1492,7 +1522,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1551,7 +1583,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -1590,7 +1622,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1648,7 +1682,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -1680,7 +1714,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1752,7 +1788,7 @@ "port": 64891 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -1793,7 +1829,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1853,7 +1891,7 @@ "port": 64891 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -1894,7 +1932,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -1954,7 +1994,7 @@ "port": 64890 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -1995,7 +2035,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2055,7 +2097,7 @@ "port": 64890 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -2096,7 +2138,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2156,7 +2200,7 @@ "port": 64892 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -2197,7 +2241,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2257,7 +2303,7 @@ "port": 64892 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -2298,7 +2344,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2345,7 +2393,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -2384,7 +2432,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2442,7 +2492,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -2474,7 +2524,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2535,7 +2587,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -2578,7 +2630,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2641,7 +2695,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -2684,7 +2738,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2758,7 +2814,7 @@ "port": 64893 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -2799,7 +2855,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2859,7 +2917,7 @@ "port": 64893 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -2900,7 +2958,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -2949,7 +3009,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -2992,7 +3052,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3055,7 +3117,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -3098,7 +3160,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3159,7 +3223,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -3198,7 +3262,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3256,7 +3322,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -3288,7 +3354,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3360,7 +3428,7 @@ "port": 64894 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -3401,7 +3469,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3461,7 +3531,7 @@ "port": 64894 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -3502,7 +3572,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3549,7 +3621,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -3588,7 +3660,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3646,7 +3720,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -3678,7 +3752,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3750,7 +3826,7 @@ "port": 64895 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -3791,7 +3867,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3851,7 +3929,7 @@ "port": 64895 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -3892,7 +3970,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -3941,7 +4021,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -3984,7 +4064,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4047,7 +4129,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -4090,7 +4172,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4153,7 +4237,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -4195,7 +4279,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4249,7 +4335,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -4288,7 +4374,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4346,7 +4434,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -4378,7 +4466,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4437,7 +4527,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -4476,7 +4566,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4534,7 +4626,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -4566,7 +4658,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4638,7 +4732,7 @@ "port": 64896 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -4679,7 +4773,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4739,7 +4835,7 @@ "port": 64896 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -4780,7 +4876,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4840,7 +4938,7 @@ "port": 64897 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -4881,7 +4979,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -4941,7 +5041,7 @@ "port": 64897 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -4982,7 +5082,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5029,7 +5131,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -5068,7 +5170,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5126,7 +5230,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -5158,7 +5262,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5230,7 +5336,7 @@ "port": 64898 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -5271,7 +5377,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5331,7 +5439,7 @@ "port": 64898 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -5372,7 +5480,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5419,7 +5529,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -5458,7 +5568,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5516,7 +5628,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -5548,7 +5660,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5609,7 +5723,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -5652,7 +5766,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5715,7 +5831,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -5758,7 +5874,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5832,7 +5950,7 @@ "port": 64899 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -5873,7 +5991,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -5933,7 +6053,7 @@ "port": 64899 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -5974,7 +6094,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6023,7 +6145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -6066,7 +6188,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6129,7 +6253,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -6172,7 +6296,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6233,7 +6359,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -6272,7 +6398,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6330,7 +6458,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -6362,7 +6490,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6434,7 +6564,7 @@ "port": 64901 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -6475,7 +6605,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6535,7 +6667,7 @@ "port": 64901 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -6576,7 +6708,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6623,7 +6757,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -6662,7 +6796,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6720,7 +6856,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -6752,7 +6888,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6811,7 +6949,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -6850,7 +6988,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -6908,7 +7048,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -6940,7 +7080,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7012,7 +7154,7 @@ "port": 64903 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7053,7 +7195,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7113,7 +7257,7 @@ "port": 64903 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7154,7 +7298,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7214,7 +7360,7 @@ "port": 64902 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7255,7 +7401,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7315,7 +7463,7 @@ "port": 64902 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7356,7 +7504,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7403,7 +7553,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -7442,7 +7592,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7500,7 +7652,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -7532,7 +7684,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7604,7 +7758,7 @@ "port": 64904 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7645,7 +7799,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7705,7 +7861,7 @@ "port": 64904 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -7746,7 +7902,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7793,7 +7951,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -7832,7 +7990,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7890,7 +8050,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -7922,7 +8082,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -7983,7 +8145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -8026,7 +8188,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8089,7 +8253,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -8132,7 +8296,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8195,7 +8361,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -8238,7 +8404,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8312,7 +8480,7 @@ "port": 64905 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -8353,7 +8521,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8413,7 +8583,7 @@ "port": 64905 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -8454,7 +8624,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8503,7 +8675,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -8546,7 +8718,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8607,7 +8781,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -8646,7 +8820,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8697,7 +8873,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -8729,7 +8905,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8783,7 +8961,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -8826,7 +9004,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8889,7 +9069,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -8930,7 +9110,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -8983,7 +9165,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -9024,7 +9206,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9077,7 +9261,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -9118,7 +9302,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9171,7 +9357,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -9214,7 +9400,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9268,7 +9456,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -9307,7 +9495,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9365,7 +9555,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -9397,7 +9587,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9456,7 +9648,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -9495,7 +9687,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9553,7 +9747,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -9585,7 +9779,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9657,7 +9853,7 @@ "port": 64906 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -9698,7 +9894,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9758,7 +9956,7 @@ "port": 64906 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -9799,7 +9997,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9859,7 +10059,7 @@ "port": 64907 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -9900,7 +10100,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -9960,7 +10162,7 @@ "port": 64907 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -10001,7 +10203,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10048,7 +10252,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -10087,7 +10291,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10145,7 +10351,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -10177,7 +10383,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10249,7 +10457,7 @@ "port": 64908 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -10290,7 +10498,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10350,7 +10560,7 @@ "port": 64908 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -10391,7 +10601,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10438,7 +10650,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -10477,7 +10689,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10535,7 +10749,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -10567,7 +10781,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10628,7 +10844,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -10671,7 +10887,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10734,7 +10952,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -10777,7 +10995,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10851,7 +11071,7 @@ "port": 64909 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -10892,7 +11112,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -10952,7 +11174,7 @@ "port": 64909 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -10993,7 +11215,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11042,7 +11266,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -11085,7 +11309,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11148,7 +11374,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -11190,7 +11416,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11246,7 +11474,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -11289,7 +11517,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11350,7 +11580,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -11389,7 +11619,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11447,7 +11679,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -11479,7 +11711,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11551,7 +11785,7 @@ "port": 64910 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -11592,7 +11826,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11652,7 +11888,7 @@ "port": 64910 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -11693,7 +11929,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11742,7 +11980,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -11785,7 +12023,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11850,7 +12090,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -11889,7 +12129,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -11935,7 +12177,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -11967,7 +12209,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12012,7 +12256,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -12051,7 +12295,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12097,7 +12343,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-forwarded", @@ -12129,7 +12375,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12172,7 +12420,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -12214,7 +12462,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12268,7 +12518,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -12307,7 +12557,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12365,7 +12617,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -12397,7 +12649,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12456,7 +12710,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -12495,7 +12749,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12553,7 +12809,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -12585,7 +12841,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12657,7 +12915,7 @@ "port": 64913 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -12698,7 +12956,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12758,7 +13018,7 @@ "port": 64913 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -12799,7 +13059,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12859,7 +13121,7 @@ "port": 64912 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -12900,7 +13162,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -12960,7 +13224,7 @@ "port": 64912 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -13001,7 +13265,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13055,7 +13321,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -13096,7 +13362,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13145,7 +13413,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -13186,7 +13454,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13228,7 +13498,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -13267,7 +13537,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13325,7 +13597,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -13357,7 +13629,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13416,7 +13690,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-start", @@ -13455,7 +13729,9 @@ "name": "X1" } }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13513,7 +13789,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "packet-management", @@ -13545,7 +13821,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13617,7 +13895,7 @@ "port": 64914 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -13658,7 +13936,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13718,7 +13998,7 @@ "port": 64914 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -13759,7 +14039,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13808,7 +14090,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -13851,7 +14133,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -13914,7 +14198,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -13957,7 +14241,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -14031,7 +14317,7 @@ "port": 64915 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -14072,7 +14358,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -14132,7 +14420,7 @@ "port": 64915 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-denied", @@ -14173,7 +14461,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", @@ -14222,7 +14512,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "connection-end", @@ -14265,7 +14555,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", diff --git a/packages/sonicwall_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/sonicwall_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml index cec8424e09f..48985a5ead6 100644 --- a/packages/sonicwall_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sonicwall_firewall/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing SonicWall firewall logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor @@ -301,10 +301,15 @@ processors: # - convert: field: observer.hostname - target_field: observer.ip + target_field: _temp_.observer.ip type: ip ignore_missing: true ignore_failure: true + - append: + field: observer.ip + value: "{{{ _temp_.observer.ip }}}" + allow_duplicates: false + if: 'ctx._temp_?.observer?.ip != null' - remove: field: observer.hostname @@ -1265,9 +1270,9 @@ processors: if: 'ctx.destination?.nat?.ip != null' - append: field: related.ip - value: "{{{ observer.ip }}}" + value: "{{{ _temp_.observer.ip }}}" allow_duplicates: false - if: 'ctx.observer?.ip != null' + if: 'ctx._temp_?.observer?.ip != null' - append: field: related.user value: "{{{ user.name }}}" diff --git a/packages/sonicwall_firewall/data_stream/log/sample_event.json b/packages/sonicwall_firewall/data_stream/log/sample_event.json index c45615be912..f0afe9767a8 100644 --- a/packages/sonicwall_firewall/data_stream/log/sample_event.json +++ b/packages/sonicwall_firewall/data_stream/log/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-16T08:18:39.000+02:00", "agent": { - "ephemeral_id": "6cc3228b-d89c-4104-b750-d9cb44ed5513", - "id": "08a5caf6-a717-4f5f-90e2-0f4eb7c59b00", + "ephemeral_id": "9c635b3a-cb8b-4d1a-891b-3f37008b59bb", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.0" + "version": "8.8.1" }, "data_stream": { "dataset": "sonicwall_firewall.log", @@ -30,12 +30,12 @@ "port": 64889 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "08a5caf6-a717-4f5f-90e2-0f4eb7c59b00", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.2.0" + "version": "8.8.1" }, "event": { "action": "connection-denied", @@ -45,7 +45,7 @@ ], "code": "713", "dataset": "sonicwall_firewall.log", - "ingested": "2022-05-23T13:47:58Z", + "ingested": "2023-07-06T18:14:01Z", "kind": "event", "outcome": "success", "sequence": "692", @@ -62,7 +62,7 @@ "log": { "level": "debug", "source": { - "address": "172.24.0.4:47831" + "address": "192.168.16.4:58483" } }, "message": "� (TCP Flag(s): RST)", @@ -84,7 +84,9 @@ }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", diff --git a/packages/sonicwall_firewall/docs/README.md b/packages/sonicwall_firewall/docs/README.md index 9c77461b6e8..677db9b31ad 100644 --- a/packages/sonicwall_firewall/docs/README.md +++ b/packages/sonicwall_firewall/docs/README.md @@ -80,11 +80,11 @@ An example event for `log` looks as following: { "@timestamp": "2022-05-16T08:18:39.000+02:00", "agent": { - "ephemeral_id": "6cc3228b-d89c-4104-b750-d9cb44ed5513", - "id": "08a5caf6-a717-4f5f-90e2-0f4eb7c59b00", + "ephemeral_id": "9c635b3a-cb8b-4d1a-891b-3f37008b59bb", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.0" + "version": "8.8.1" }, "data_stream": { "dataset": "sonicwall_firewall.log", @@ -109,12 +109,12 @@ An example event for `log` looks as following: "port": 64889 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "08a5caf6-a717-4f5f-90e2-0f4eb7c59b00", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.2.0" + "version": "8.8.1" }, "event": { "action": "connection-denied", @@ -124,7 +124,7 @@ An example event for `log` looks as following: ], "code": "713", "dataset": "sonicwall_firewall.log", - "ingested": "2022-05-23T13:47:58Z", + "ingested": "2023-07-06T18:14:01Z", "kind": "event", "outcome": "success", "sequence": "692", @@ -141,7 +141,7 @@ An example event for `log` looks as following: "log": { "level": "debug", "source": { - "address": "172.24.0.4:47831" + "address": "192.168.16.4:58483" } }, "message": "� (TCP Flag(s): RST)", @@ -163,7 +163,9 @@ An example event for `log` looks as following: }, "zone": "Untrusted" }, - "ip": "10.0.0.96", + "ip": [ + "10.0.0.96" + ], "name": "firewall", "product": "SonicOS", "serial_number": "0040103CE114", diff --git a/packages/sonicwall_firewall/kibana/tags.yml b/packages/sonicwall_firewall/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sonicwall_firewall/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sonicwall_firewall/manifest.yml b/packages/sonicwall_firewall/manifest.yml index f3f3e53afc5..1109678f23d 100644 --- a/packages/sonicwall_firewall/manifest.yml +++ b/packages/sonicwall_firewall/manifest.yml @@ -1,9 +1,7 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: sonicwall_firewall title: "SonicWall Firewall" -version: "1.6.0" -license: basic -release: ga +version: "1.10.0" description: "Integration for SonicWall firewall logs" type: integration categories: @@ -11,7 +9,8 @@ categories: - security - firewall_security conditions: - kibana.version: "^8.2.0" + kibana: + version: "^8.2.0" screenshots: - src: /img/dashboard.png title: Sample dashboard @@ -68,6 +67,6 @@ vars: show_user: false description: > Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/sophos/_dev/build/build.yml b/packages/sophos/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/sophos/_dev/build/build.yml +++ b/packages/sophos/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/sophos/_dev/build/docs/README.md b/packages/sophos/_dev/build/docs/README.md index e7ef23223bf..d3e18cda747 100644 --- a/packages/sophos/_dev/build/docs/README.md +++ b/packages/sophos/_dev/build/docs/README.md @@ -2,7 +2,7 @@ The Sophos integration collects and parses logs from Sophos Products. -Currently it accepts logs in syslog format or from a file for the following devices: +Currently, it accepts logs in syslog format or from a file for the following devices: - `utm` dataset: supports [Unified Threat Management](https://www.sophos.com/en-us/support/documentation/sophos-utm) (formerly known as Astaro Security Gateway) logs. - `xg` dataset: supports [Sophos XG SFOS logs](https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/Logs.html). @@ -18,9 +18,11 @@ Versions above this are expected to work but have not been tested. ## Logs -### Utm log +### UTM log -The `utm` dataset collects Unified Threat Management logs. +The `utm` dataset collects Unified Threat Management logs. Currently, it collects the following log categories: DNS, DHCP, HTTP and Packet Filter. + +{{event "utm"}} {{fields "utm"}} diff --git a/packages/sophos/_dev/deploy/docker/docker-compose.yml b/packages/sophos/_dev/deploy/docker/docker-compose.yml index 53c8924a8ac..ca49071f72c 100644 --- a/packages/sophos/_dev/deploy/docker/docker-compose.yml +++ b/packages/sophos/_dev/deploy/docker/docker-compose.yml @@ -11,13 +11,13 @@ services: volumes: - ./sample_logs:/sample_logs:ro entrypoint: /bin/bash - command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9549 -p=udp /sample_logs/sophos-utm-*.log" + command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9549 -p=udp /sample_logs/sophos-utm*.log" sophos-utm-tcp: image: docker.elastic.co/observability/stream:v0.7.0 volumes: - ./sample_logs:/sample_logs:ro entrypoint: /bin/bash - command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9549 -p=tcp /sample_logs/sophos-utm-*.log" + command: -c "/stream log --start-signal=SIGHUP --delay=5s --addr elastic-agent:9549 -p=tcp /sample_logs/sophos-utm*.log" sophos-xg-udp: image: docker.elastic.co/observability/stream:v0.7.0 volumes: diff --git a/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm-generated.log b/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm-generated.log deleted file mode 100644 index 070d8c61636..00000000000 --- a/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm-generated.log +++ /dev/null @@ -1,102 +0,0 @@ -2016:1:29-06:09:59 localhost.localdomain smtpd[905]: MASTER[nnumqua]: QR globally disabled, status one set to 'disabled' -2016:2:12-13:12:33 astarosg_TVM[5716]: id=ommod severity=medium sys=inima sub=tlabo name=web request blocked, forbidden application detectedaction=accept method=ugiatnu client=stiae facility=nofdeF user=sunt srcip=10.57.170.140 dstip=10.213.231.72 version=1.5102 storage=emips ad_domain=imadmi object=ostrume class=molest type=upt attributes=uiineavocount=tisetq node=irati account=icistatuscode=giatquov cached=eritquii profile=dexeac filteraction=iscinge size=6992 request=oreseos url=https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu referer=https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac error=nidolo authtime=tatn dnstime=eli cattime=nnu avscantime=dolo fullreqtime=Loremip device=idolor auth=emeumfu ua=CSed exceptions=lupt group=psaquae category=oinBCSe categoryname=mnisist content-type=sedd reputation=uatD application=iunt app-id=temveleu reason=colabo filename=eme file=numqu extension=qui time=civeli function=block line=agnaali message=gnam fwrule=tat seq=ipitla initf=enp0s7281 outitf=enp0s7084 dstmac=01:00:5e:de:94:f6 srcmac=01:00:5e:1d:c1:c0 proto=den length=tutla tos=olorema prec=;iades ttl=siarchi srcport=2289 dstport=3920 tcpflags=mqu info=apariat prec=tlabore caller=untmolli engine=remi localip=saute host=ercit2385.internal.home extra=run server=10.47.202.102 cookie=quirat set-cookie=llu -2016:2:26-20:15:08 eirure7587.internal.localhost reverseproxy: [mpori] [aaliquaU:medium] [pid 3905:lpaqui] (22)No form context found: [client sitame] No form context found when parsing iadese tag, referer: https://api.example.com/utla/utei.htm?oei=tlabori#oin -2016:3:12-03:17:42 data4478.api.lan confd: id=iquipex severity=very-high sys=uradip sub=wri name=bor client=occa facility=stquidol user=itquiin srcip=10.106.239.55 version=1.3129 storage=atevel object=nsecte class=itame type=eumfug attributes=litcount=asun node=estia account=eaq -2016:3:26-10:20:16 ctetura3009.www5.corp reverseproxy: [lita] [adeseru:medium] [pid 7692:eaq] amest configured -- corp normal operations -2016:4:9-17:22:51 localhost smtpd[1411]: MASTER[inculpa]: QR globally disabled, status one set to 'disabled' -2016:4:24-00:25:25 httpproxy[176]: [nse] disk_cache_zap (non) paquioff -2016:5:8-07:27:59 ptasnu6684.mail.lan reverseproxy: [orumSe] [boree:low] [pid 945:rQuisau] AH01915: Init: (10.18.13.211:205) You configured ofdeFini(irat) on the onev(aturauto) port! -2016:5:22-14:30:33 ssecillu7166.internal.lan barnyard: Initializing daemon mode -2016:6:5-21:33:08 ore5643.api.lan reverseproxy: [metco] [acom:high] [pid 2164:nim] ModSecurity: utaliqu compiled version="rsi"; loaded version="taliqui" -2016:6:20-04:35:42 ciun39.localdomain reverseproxy: [iatqu] [inBCSedu:high] [pid 4006:rorsit] AH00098: pid file tionemu overwritten -- Unclean shutdown of previous Apache run? -2016:7:4-11:38:16 atatnon6064.www.invalid reverseproxy: [magnid] [adol:low] [pid 1263:roide] AH00291: long lost child came home! (pid tem) -2016:7:18-18:40:50 gitse2463.www5.invalid aua: id=tvolup severity=low sys=sci sub=col name=web request blocked srcip=10.42.252.243 user=agnaaliq caller=est engine=mquisno -2016:8:2-01:43:25 httpproxy[2078]: [mol] sc_server_cmd (umdolors) decrypt failed -2016:8:16-08:45:59 oriosam6277.mail.localdomain frox: Listening on 10.169.5.162:6676 -2016:8:30-15:48:33 ptate3830.internal.localhost reverseproxy: [quamqua] [ntut:high] [pid 5996:meum] AH02572: Failed to configure at least one certificate and key for mini:Loremip -2016:9:13-22:51:07 nvo6105.invalid reverseproxy: [amquaer] [aqui:medium] [pid 3340:lpa] AH00020: Configuration Failed, isn -2016:9:28-05:53:42 afcd[2492]: Classifier configuration reloaded successfully -2016:10:12-12:56:16 edic2758.api.domain confd: id=olabori severity=medium sys=atatnon sub=lica name=secil client=uisnos facility=olores user=scipit srcip=10.54.169.175 version=1.5889 storage=onorumet object=ptatema class=eavolup type=ipsumq attributes=evitcount=tno node=iss account=taspe -2016:10:26-19:58:50 aua[32]: id=mmo severity=high sys=tlaboru sub=aeabillo name=checking if admin is enabled srcip=10.26.228.145 user=eruntmo caller=nimve engine=usanti -2016:11:10-03:01:24 sshd[2051]: Server listening on 10.59.215.207 port 6195. -2016:11:24-10:03:59 ectobeat3157.mail.local reverseproxy: [uasiarch] [Malor:low] [pid 170:cillumdo] AH02312: Fatal error initialising mod_ssl, ditau. -2016:12:8-17:06:33 ident2323.internal.corp reverseproxy: [hend] [remagna:high] [pid 873:aparia] AH01909: 10.144.21.112:90:epteurs server certificate does NOT include an ID which matches the server name -2016:12:23-00:09:07 ttenb4581.www.host httpproxy: [rem] main (exer) shutdown finished, exiting -2017:1:6-07:11:41 lapari5763.api.invalid frox: Listening on 10.103.2.48:4713 -2017:1:20-14:14:16 elites4713.www.localhost ulogd: id=serr severity=very-high sys=olore sub=onemul name=portscan detected action=deny fwrule=remeum seq=etur initf=lo6086 outitf=lo272 dstmac=01:00:5e:51:b9:4d srcmac=01:00:5e:15:3a:74 srcip=10.161.51.135 dstip=10.52.190.18 proto=isni length=quid tos=aUten prec=Duis ttl=uisq srcport=7807 dstport=165 tcpflags=accus info=CSed code=tiu type=wri -2017:2:3-21:16:50 sam1795.invalid reverseproxy: [lorese] [olupta:low] [pid 3338:iqui] AH02312: Fatal error initialising mod_ssl, animide. -2017:2:18-04:19:24 confd[10]: id=arch severity=high sys=data sub=ugits name=ittenb client=tobeatae facility=ntut user=llum srcip=10.232.108.32 version=1.5240 storage=idolo object=mqu class=mquido type=ende attributes=ntmollitcount=tisu node=ionofdeF account=rsp -2017:3:4-11:21:59 nostrum6305.internal.localhost astarosg_TVM: id=llitani severity=high sys=itametco sub=etcons name=web request blocked, forbidden url detectedaction=allow method=iuntN client=utfugi facility=ursintoc user=tio srcip=10.89.41.97 dstip=10.231.116.175 version=1.5146 storage=lup ad_domain=mipsamv object=exeacomm class=sequines type=cto attributes=cusacount=nderi node=tem account=tcustatuscode=eumiu cached=nim profile=pteurs filteraction=ercitati size=835 request=ptat url=https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn referer=https://example.com/taliqui/idi.txt?undeomn=ape#itaspe error=ari authtime=umtot dnstime=onemulla cattime=atquo avscantime=borio fullreqtime=equatD device=uidol auth=inculpa ua=ruredol exceptions=iadeseru group=loremagn category=acons categoryname=nimadmi content-type=lapa reputation=emoenimi application=iquipex app-id=mqu reason=onorume filename=abill file=ametcon extension=ofdeFini time=tasnu function=deny line=tionev message=uasiarch fwrule=velites seq=uredolor initf=lo1543 outitf=lo6683 dstmac=01:00:5e:8c:f2:06 srcmac=01:00:5e:6f:71:02 proto=plica length=asiarc tos=lor prec=;nvolupt ttl=dquia srcport=5334 dstport=1525 tcpflags=umfugiat info=quisnos prec=utf caller=dolor engine=dexe localip=nemul host=Duis583.api.local extra=eavolupt server=10.17.51.153 cookie=aperiame set-cookie=stenat -2017:3:18-18:24:33 xeaco7887.www.localdomain aua: id=hite severity=very-high sys=ugitsed sub=dminimve name=Packet accepted srcip=10.137.165.144 user=uptate caller=tot engine=reme -2017:4:2-01:27:07 reverseproxy[5430]: ARGS:userPermissions: [\\x22dashletAccessAlertingRecentAlertsPanel\\x22,\\x22dashletAccessAlerterTopAlertsDashlet\\x22,\\x22accessViewRules\\x22,\\x22deployLiveResources\\x22,\\x22vi..."] [severity [hostname "iscivel3512.invalid"] [uri "atcupi"] [unique_id "eriti"] -2017:4:16-08:29:41 sockd[6181]: dante/server 1.202 running -2017:4:30-15:32:16 dolor5799.home afcd: Classifier configuration reloaded successfully -2017:5:14-22:34:50 oreseosq1859.api.lan reverseproxy: [mmodic] [essequam:low] [pid 6691:ficiade] [client uiinea] [uianonn] virus daemon connection problem found in request https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure, referer: https://example.com/adeser/mSe.gif?aute=rchite#rcit -2017:5:29-05:37:24 confd-sync[6908]: id=smoditem severity=very-high sys=tev sub=oNemoeni name=luptatem -2017:6:12-12:39:58 autodit272.www.localhost reverseproxy: [oriss] [imadmin:very-high] [pid 1121:urve] ModSecurity: sBonoru compiled version="everi"; loaded version="squ" -2017:6:26-19:42:33 rporis6787.www5.localdomain reverseproxy: [quasiarc] [pta:low] [pid 3705:liqu] [client ipsu] AH01114: siarch: failed to make connection to backend: 10.148.21.7 -2017:7:11-02:45:07 reprehe5661.www.lan reverseproxy: rManage\\x22,\\x22manageLiveSystemSettings\\x22,\\x22accessViewJobs\\x22,\\x22exportList\\..."] [ver "olor"] [maturity "corpo"] [accuracy "commod"] iumd [hostname "ntore4333.api.invalid"] [uri "sitv"] [unique_id "equam"] -2017:7:25-09:47:41 exim[2384]: aeca-ugitse-ameiu utei:caecat:lumquid oluptat sequatD163.internal.example [10.151.206.38]:5794 lits -2017:8:8-16:50:15 elillu5777.www5.lan pluto: "elaudant"[olup] 10.230.4.70 #ncu: starting keying attempt quaturve of an unlimited number -2017:8:22-23:52:50 ecatcup3022.mail.invalid xl2tpd: Inherited by nproide -2017:9:6-06:55:24 qui7797.www.host ipsec_starter: Starting strongSwan umet IPsec [starter]... -2017:9:20-13:57:58 nofdeFin2037.mail.example reverseproxy: [quatD] [nevol:high] [pid 3994:Sectio] [client tiumdol] [laud] cannot read reply: Operation now in progress (115), referer: https://example.org/tquov/natu.jpg?uianonnu=por#nve -2017:10:4-21:00:32 sockd[7264]: dante/server 1.3714 running -2017:10:19-04:03:07 eFinib2403.api.example reverseproxy: [utaliq] [sun:high] [pid 4074:uredol] [client quatD] [enimad] ecatcu while reading reply from cssd, referer: https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse -2017:11:2-11:05:41 confd[4939]: id=acons severity=high sys=adipisc sub=omnisist name=orroqui client=sci facility=psamvolu user=itsedqui srcip=10.244.96.61 version=1.2707 storage=onevol object=ese class=reprehen type=Exce attributes=toccacount=tinvolu node=ecatc account=iumt -2017:11:16-18:08:15 named[1900]: reloading eddoei iono -2017:12:1-01:10:49 obeatae2042.www.domain reverseproxy: [dquian] [isaute:low] [pid 1853:utfugit] (70007)The ula specified has expired: [client quaUteni] AH01110: error reading response -2017:12:15-08:13:24 aerat1267.www5.example pop3proxy: Master started -2017:12:29-15:15:58 writt2238.internal.localdomain reverseproxy: [uaer] [aed:low] [pid 478:ain] [client scingeli] [uatDuis] mod_avscan_check_file_single_part() called with parameter filename=imip -2018:1:12-22:18:32 siutaliq4937.api.lan reverseproxy: [siutaliq] [urvel:very-high] [pid 7721:ntium] [imadmi] Hostname in dquiac request (liquide) does not match the server name (uatD) -2018:1:27-05:21:06 URID[7596]: T=BCSedut ------ 1 - [exit] accept: ametco -2018:2:10-12:23:41 astarosg_TVM[1090]: id=udex severity=low sys=iam sub=animi name=UDP flood detectedaction=allow method=nsectetu client=spici facility=untutl user=hen srcip=10.214.167.164 dstip=10.76.98.53 version=1.3726 storage=uovolup ad_domain=expl object=animi class=mdoloree type=mullamco attributes=tnulcount=ons node=radip account=amremapstatuscode=dolorsit cached=atisund profile=isnostru filteraction=quepo size=5693 request=nisi url=https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi referer=https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi error=nculp authtime=quamnihi dnstime=nimadmi cattime=mquiado avscantime=agn fullreqtime=dip device=urmag auth=nim ua=laboreet exceptions=tutlabo group=incid category=der categoryname=totamrem content-type=eaqu reputation=itani application=mni app-id=runtmol reason=uaer filename=nor file=saut extension=olest time=volu function=block line=osam message=ncid fwrule=loremagn seq=uisau initf=lo1255 outitf=eth965 dstmac=01:00:5e:2f:c3:3e srcmac=01:00:5e:65:2d:fe proto=ictasun length=iumto tos=ciun prec=;prehe ttl=essec srcport=4562 dstport=2390 tcpflags=uaera info=nsequa prec=yCicero caller=orporis engine=oluptate localip=tesseq host=tenbyCi4371.www5.localdomain extra=spernatu server=10.98.126.206 cookie=tion set-cookie=tNeque -2018:2:24-19:26:15 ulogd[6722]: id=persp severity=medium sys=orev sub=lapa name=Packet logged action=allow fwrule=adminim seq=isiutali initf=lo7088 outitf=eth6357 dstmac=01:00:5e:9a:fe:91 srcmac=01:00:5e:78:1a:5a srcip=10.203.157.250 dstip=10.32.236.117 proto=turm length=quamei tos=nvento prec=nama ttl=ema srcport=6585 dstport=5550 tcpflags=xeacomm info=oriosa code=erspici type=oreeu -2018:3:11-02:28:49 ectob5542.www5.corp reverseproxy: [agni] [ivelit:high] [pid 7755:uovol] AH00959: ap_proxy_connect_backend disabling worker for (10.231.77.26) for volups -2018:3:25-09:31:24 iusmo901.www.home httpd: id=scivelit severity=high sys=untut sub=siu name=Authentication successfulaction=allow method=icons client=hende facility=umdol user=Sedutper srcip=10.2.24.156 dstip=10.113.78.101 version=1.2707 storage=amqua ad_domain=nsequatu object=aboNemoe class=mqu type=tse attributes=ntiumdcount=ueip node=amvo account=dolorsistatuscode=acc cached=quinesc profile=ulpaq filteraction=usa size=5474 request=tob url=https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru referer=https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo error=avolup authtime=litse dnstime=archit cattime=nde avscantime=tNequepo fullreqtime=byCicer device=imvenia auth=ipit ua=tdolorem exceptions=nderitin group=mquiado category=ssequa categoryname=nisist content-type=temvele reputation=ofd application=quam app-id=umdol reason=porincid filename=tisetqu file=pici extension=erit time=ehenderi function=block line=fugiatqu message=Duisaute fwrule=uptat seq=hende initf=lo3680 outitf=lo4358 dstmac=01:00:5e:0a:8f:6c srcmac=01:00:5e:34:8c:d2 proto=mnis length=ainci tos=aturve prec=;tiumdol ttl=mporain srcport=6938 dstport=6939 tcpflags=dut info=aecons prec=tionemu caller=edictasu engine=quipexea localip=orsit host=tenima5715.api.example extra=snisiut server=10.92.93.236 cookie=amr set-cookie=mfug port=7174 query=exerc uid=ntoccae -2018:4:8-16:33:58 astarosg_TVM[6463]: id=user severity=low sys=sequamn sub=adeseru name=File extension warned and proceededaction=accept method=mquisn client=ulamcol facility=nulamcol user=atatno srcip=10.180.169.49 dstip=10.206.69.71 version=1.3155 storage=risni ad_domain=ccaecat object=dtemp class=onproid type=ica attributes=mnisiscount=edolor node=nonnumqu account=iscivelistatuscode=urve cached=sundeomn profile=tasu filteraction=equunt size=3144 request=ilmo url=https://mail.example.net/isqua/deF.html?iameaq=orainci#adm referer=https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria error=tessec authtime=cupida dnstime=ciade cattime=busBonor avscantime=enima fullreqtime=emseq device=osamni auth=umetMa ua=equatDui exceptions=its group=setquas category=nti categoryname=osamnis content-type=atisetqu reputation=ciduntut application=atisu app-id=edutpe reason=architec filename=incul file=tevelit extension=emse time=eipsaqua function=cancel line=suntincu message=lore fwrule=equatu seq=enbyCi initf=enp0s566 outitf=lo2179 dstmac=01:00:5e:2c:9d:65 srcmac=01:00:5e:1a:03:f5 proto=orema length=iusmo tos=uunturm prec=;mSect ttl=avolupta srcport=3308 dstport=1402 tcpflags=dolo info=tsed prec=corpori caller=cillumd engine=umdol localip=turmagn host=mni4032.lan extra=amrem server=10.202.65.2 cookie=queporr set-cookie=oide -2018:4:22-23:36:32 iscing6960.api.invalid reverseproxy: [emipsu] [incidu:very-high] [pid 5350:itation] SSL Library Error: error:itasper:failure -2018:5:7-06:39:06 httpd[793]: [ruredo:success] [pid nculpaq:mides] [client iconseq] ModSecurity: Warning. nidolo [file "runtmoll"] [line "tuserror"] [id "utlabo"] [rev "scip"] [msg "imvenia"] [severity "low"] [ver "1.6420"] [maturity "nisi"] [accuracy "seq"] [tag "ors"] [hostname "olupta3647.host"] [uri "uaUteni"] [unique_id "gitsedqu"]amqu -2018:5:21-13:41:41 named[6633]: FORMERR resolving 'iavolu7814.www5.localhost': 10.194.12.83#elit -2018:6:4-20:44:15 astarosg_TVM[5792]: id=elitess severity=low sys=amqua sub=mavenia name=checking if admin is enabledaction=cancel method=doc client=teurs facility=eturadi user=eturadip srcip=10.33.138.154 dstip=10.254.28.41 version=1.4256 storage=volupta ad_domain=dolor object=dolorsit class=tfugits type=lor attributes=oremcount=utper node=ueips account=umqustatuscode=ntexpli cached=siuta profile=porincid filteraction=itame size=1026 request=fugiat url=https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf referer=https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol error=emul authtime=ariatu dnstime=luptate cattime=umdolore avscantime=iutaliq fullreqtime=oriosamn device=oluptate auth=tcu ua=mmodo exceptions=rauto group=lup category=orem categoryname=tutl content-type=iusmo reputation=uiavolu application=eri app-id=pis reason=riosam filename=isa file=nonnum extension=Nemoenim time=itati function=cancel line=nes message=atvolupt fwrule=umwritt seq=uae initf=enp0s3792 outitf=lo2114 dstmac=01:00:5e:24:b8:9f srcmac=01:00:5e:a1:a3:9f proto=bil length=itten tos=icer prec=;dolo ttl=siutaliq srcport=1455 dstport=6937 tcpflags=pexeaco info=ercitati prec=dexea caller=tasnul engine=onu localip=orisnisi host=obea2960.mail.corp extra=dolor server=10.45.12.53 cookie=etdo set-cookie=edictas -2018:6:19-03:46:49 frox[7744]: Listening on 10.99.134.49:2274 -2018:7:3-10:49:23 olli5982.www.test reverseproxy: [asp] [uatDui:medium] [pid 212:unde] [client raut] [suscip] virus daemon error found in request ectetu, referer: https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid -2018:7:17-17:51:58 nsecte3644.internal.test reverseproxy: [tutla] [isund:high] [pid 3136:uidex] [client uptate] Invalid signature, cookie: JSESSIONID -2018:8:1-00:54:32 confd[4157]: id=onseq severity=very-high sys=siutaliq sub=aliqu name=serro client=ctet facility=umiurere user=antium srcip=10.32.85.21 version=1.7852 storage=eaco object=onp class=ectetur type=ione attributes=utlaborecount=nci node=acommodi account=etconsec -2018:8:15-07:57:06 econseq7119.www.home sshd: error: Could not get shadow information for NOUSER -2018:8:29-14:59:40 ant2543.www5.lan reverseproxy: [uaturve] [lapa:high] [pid 3669:idu] [client sed] [utem] cannot read reply: Operation now in progress (115), referer: https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo -2018:9:12-22:02:15 pluto[7138]: | sent accept notification olore with seqno = urEx -2018:9:27-05:04:49 httpd[6562]: id=iurere severity=medium sys=erc sub=atu name=http accessaction=accept method=odte client=uis facility=sedquia user=reetd srcip=10.210.175.52 dstip=10.87.14.186 version=1.7641 storage=tasu ad_domain=mquae object=CSedu class=atae type=aeconseq attributes=boNemocount=duntutla node=mqu account=inimastatuscode=emipsum cached=venia profile=Loremi filteraction=uisnostr size=849 request=vol url=https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq referer=https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid error=mipsa authtime=teturad dnstime=nimide cattime=spernat avscantime=nevolu fullreqtime=itectobe device=rroq auth=itessequ ua=uunt exceptions=pic group=unt category=emUt categoryname=eiru content-type=sauteir reputation=pic application=caecatc app-id=iarc reason=emquia filename=duntutl file=idi extension=reetdo time=pidatatn function=cancel line=ncul message=mcorpor fwrule=ofd seq=lapariat initf=eth65 outitf=lo3615 dstmac=01:00:5e:b3:e3:90 srcmac=01:00:5e:0e:b3:8e proto=consequ length=min tos=riame prec=;gnaal ttl=nti srcport=1125 dstport=605 tcpflags=utlab info=colabo prec=ditem caller=did engine=BCS localip=idex host=nisiuta4810.api.test extra=apa server=10.85.200.58 cookie=esse set-cookie=idexeac port=2294 query=iatquovo uid=rExce -2018:10:11-12:07:23 itametc1599.api.test ulogd: id=itaedi severity=low sys=ore sub=ips name=Authentication successful action=block fwrule=iamqu seq=aboN initf=eth2679 outitf=enp0s1164 dstmac=01:00:5e:c3:8a:24 srcmac=01:00:5e:5a:9d:a9 srcip=10.133.45.45 dstip=10.115.166.48 proto=utaliq length=icer tos=essequ prec=oeiu ttl=nsequa srcport=4180 dstport=4884 tcpflags=squa info=etM code=eve type=iru -2018:10:25-19:09:57 tiumt5462.mail.localhost sshd: Invalid user admin from runt -2018:11:9-02:12:32 vol1450.internal.host sshd: Server listening on 10.71.184.162 port 3506. -2018:11:23-09:15:06 ipsec_starter[178]: IP address or index of physical interface changed -> reinit of ipsec interface -2018:12:7-16:17:40 rporissu573.api.test reverseproxy: [exercita] [emaperi:very-high] [pid 5943:ddoei] AH02312: Fatal error initialising mod_ssl, nihi. -2018:12:21-23:20:14 nostru774.corp URID: T=tatnonp ------ 1 - [exit] allow: natuserr -2019:1:5-06:22:49 ipsec_starter[6226]: IP address or index of physical interface changed -> reinit of ipsec interface -2019:1:19-13:25:23 httpd[5037]: [iadese:unknown] [pid isundeo:emq] [client rehender] ModSecurity: Warning. uat [file "apa"] [line "tani"] [id "per"] [rev "ngelitse"] [msg "olorsita"] [severity "medium"] [ver "1.7102"] [maturity "apariat"] [accuracy "iuntNequ"] [tag "rExc"] [hostname "lorsita2216.www5.example"] [uri "turvelil"] [unique_id "velitsed"]rau -2019:2:2-20:27:57 sum2208.host reverseproxy: [eir] [nia:medium] [pid 4346:mco] [client ritinvol] [quioffi] mod_avscan_check_file_single_part() called with parameter filename=quamquae -2019:2:17-03:30:32 ore6843.local reverseproxy: [usmodite] [aveniam:medium] [pid 5126:xplicab] [client taev] No signature found, cookie: dictasu -2019:3:3-10:33:06 Sedu1610.mail.corp reverseproxy: [audant] [porr:medium] [pid 7442:tation] [client uunturma] AH01114: cons: failed to make connection to backend: 10.177.35.133 -2019:3:17-17:35:40 corpo6737.example reverseproxy: [officiad] [aliquide:very-high] [pid 6600:errorsi] [client raincidu] [orincidi] cannot connect: failure (111) -2019:4:1-00:38:14 pop3proxy[6854]: Master started -2019:4:15-07:40:49 eratvol314.www.home pop3proxy: Master started -2019:4:29-14:43:23 utemvele1838.mail.test reverseproxy: [xplicabo] [aco:high] [pid 2389:ratione] [client nrepr] ModSecurity: Warning. uipex [file "alorumw"] [line "nibus"] [id "eiusmo"] [msg "rci"] [hostname "seosquir715.local"] [uri "ercitati"] [unique_id "uiration"] -2019:5:13-21:45:57 ulapari2656.local reverseproxy: [itessec] [non:very-high] [pid 2237:licaboN] [client nvol] [moenimip] cannot connect: failure (111) -2019:5:28-04:48:31 reverseproxy[4278]: [ritat] [iscinge:very-high] [pid 4264:rroquisq] [client tnonpro] [nimv] erunt while reading reply from cssd, referer: https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor -2019:6:11-11:51:06 URID[7418]: T=xer ------ 1 - [exit] cancel: onemul -2019:6:25-18:53:40 pluto[7201]: | handling event ips for 10.165.217.56 "econse" #otamr -2019:7:10-01:56:14 stla2856.host reverseproxy: [onpro] [adolo:very-high] [pid 7766:siste] ModSecurity for Apache/nisiut (ostr) configured. -2019:7:24-08:58:48 peri6748.www5.domain reverseproxy: [cingeli] [esseq:high] [pid 2404:aquae] AH00098: pid file otamrema overwritten -- Unclean shutdown of previous Apache run? -2019:8:7-16:01:23 tnon5442.internal.test reverseproxy: [ive] [tquido:very-high] [pid 6108:taliquip] AH00295: caught accept, ectetu -2019:8:21-23:03:57 ariatu2606.www.host reverseproxy: [quamestq] [umquid:very-high] [pid 7690:rem] [client its] [inv] not all the file sent to the client: rin, referer: https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati -2019:9:5-06:06:31 imv1805.api.host ulogd: id=oenim severity=very-high sys=iaturExc sub=orsit name=ICMP flood detected action=cancel fwrule=eos seq=quameius initf=lo4665 outitf=lo3422 dstmac=01:00:5e:d6:f3:bc srcmac=01:00:5e:87:02:08 srcip=10.96.243.231 dstip=10.248.62.55 proto=ugiat length=quiin tos=apar prec=eleumiur ttl=chite srcport=5632 dstport=4206 tcpflags=tevelit info=etc code=lorem type=temvele -2019:9:19-13:09:05 rita600.www5.localdomain reverseproxy: [ini] [elite:high] [pid 7650:mnisiut] AH00959: ap_proxy_connect_backend disabling worker for (10.132.101.158) for cipitlabs -2019:10:3-20:11:40 sshd[2014]: Did not receive identification string from rroq -2019:10:18-03:14:14 admini1122.www.local reverseproxy: [ritte] [umwritte:very-high] [pid 1817:atu] (13)failure: [client vol] AH01095: prefetch request body failed to 10.96.193.132:5342 (orumwr) from bori () -2019:11:1-10:16:48 confd[2475]: id=utaliqu severity=low sys=xplicabo sub=quamni name=dol client=sisten facility=remeumf user=acommod srcip=10.96.200.83 version=1.7416 storage=sper object=asia class=roident type=olorem attributes=teursintcount=evelites node=nostr account=lapariat -2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud -2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico -2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER -2019:04:08-11:21:55 galaxy ulogd[5009]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="3000000014" initf="eth0" outitf="eth3" srcmac="00:50:56:c0:00:01" dstmac="00:0c:29:93:cc:85" srcip="192.168.168.1" dstip="172.30.30.1" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="57051" dstport="51130" tcpflags="SYN" -2019:04:08-11:22:05 gemini ulogd[8882]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62003" initf="eth0" srcmac="00:0c:29:93:cc:a3" dstmac="00:0c:29:69:57:8b" srcip="192.168.168.1" dstip="172.30.30.1" proto="6" length="52" tos="0x00" prec="0x00" ttl="127" srcport="57096" dstport="51130" tcpflags="SYN" \ No newline at end of file diff --git a/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm.log b/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm.log new file mode 100644 index 00000000000..b2b2594ee89 --- /dev/null +++ b/packages/sophos/_dev/deploy/docker/sample_logs/sophos-utm.log @@ -0,0 +1,40 @@ +2023:04:28-00:00:04 sophos-test-vm1 dhcpd: DHCPDISCOVER from 04:7b:cb:a1:d2:93 via eth7: unknown client +2023:04:28-00:00:10 sophos-test-vm1 dhcpd: DHCPINFORM from 89.160.20.129 via eth7 +2023:04:28-00:00:10 sophos-test-vm1 dhcpd: DHCPACK to 89.160.20.129 (04:7b:cb:a1:d2:93) via eth7 +2023:04:28-06:50:45 sophos-test-vm1 dhcpd: DHCPACK on 89.160.20.129 to 04:7b:cb:a1:d2:93 (CLIENTHOST) via eth1 +2023:04:28-09:21:39 sophos-test-vm1 dhcpd: DHCPREQUEST for 192.168.72.129 from 04:7b:cb:a1:d2:93 via eth7: wrong network. +2023:04:28-09:21:39 sophos-test-vm1 dhcpd: DHCPNAK on 192.168.72.129 to 04:7b:cb:a1:d2:93 via eth7 +2023:04:28-09:22:03 sophos-test-vm1 dhcpd: DHCPOFFER on 10.50.148.12 to 04:7b:cb:a1:d2:93 via eth7 +2023:04:28-00:04:36 sophos-test-vm1 dhcpd: Dynamic and static leases present for 89.160.20.129. +2023:04:28-08:15:27 sophos-test-vm2 dhcpd: Received DHCPv4 packet without client-id option and empty hlen field. +2023:04:28-08:15:27 sophos-test-vm2 dhcpd: WARNING: Host declarations are global. They are not limited to the scope you declared them in. +2023:04:28-03:26:51 sophos-test-vm1 dhcpd: Wrote 0 deleted host decls to leases file. +2023:04:28-03:26:51 sophos-test-vm1 dhcpd: Wrote 0 new dynamic host decls to leases file. +2023:04:28-03:26:51 sophos-test-vm1 dhcpd: Wrote 13 leases to leases file. +2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Listening on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24 +2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Sending on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24 +2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Sending on Socket/fallback/fallback-net +2023:04:28-07:43:18 sophos-test-vm1 dhcpd: receive_packet failed on wlan1: Network is down +2023:04:28-08:11:33 sophos-test-vm1 dhcpd: 3 bad udp checksums in 5 packets +2023:04:28-09:22:03 sophos-test-vm1 dhcpd: 5 udp packets in 5 too long - dropped +2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="311" request="0x7fad9e44ac00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="5" aptptime="0" cattime="200" avscantime="0" fullreqtime="32181" device="0" auth="0" ua="Microsoft BITS/7.8" exceptions="" category="178" reputation="trusted" categoryname="Internet Services" application="googplay" app-id="816" country="United States" content-type="application/octet-stream" +2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="416" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="311" request="0x7fad9e44ac00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="191" avscantime="0" fullreqtime="50667" device="0" auth="0" ua="Microsoft BITS/7.8" exceptions="" category="178" reputation="trusted" categoryname="Internet Services" application="googplay" app-id="816" content-type="application/octet-stream" reason="range" +2023:03:08-15:00:06 sophos-test-vm1 httpproxy[6267]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x7fad90f7ed00" function="fileextension_scan" file="fileextensionscanner.c" line="154" message="error converting file name to utf-8 from x-user-defined: Conversion from character set 'x-user-defined' to 'UTF8' is not supported" +2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x7fadb4088d00" function="ssl_raw_read" file="ssl.c" line="1012" message="SSL_ERROR_SYSCALL: ret=-1 error=Broken pipe" +2023:03:08-15:00:39 sophos-test-vm1 httpproxy[6267]: id="0060" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="4764" request="0x7fad933c8b00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="249" aptptime="0" cattime="206" avscantime="0" fullreqtime="1499" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" country="Germany" category="141" reputation="trusted" categoryname="Portal Sites" application="yahoo" app-id="553" reason="category" +2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="92" request="0x7fad8b180000" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="137" avscantime="3221" fullreqtime="407968" device="0" auth="0" ua="CloudKitWin/57.0.0.0 (Windows/10.0.0.0)" exceptions="" category="170" reputation="trusted" categoryname="Personal Network Storage" application="icloud" app-id="666" content-type="application/x-protobuf" sandbox="-" +2023:03:08-15:05:47 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="23229" request="0x7fad93120200" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="257" aptptime="0" cattime="170" avscantime="0" fullreqtime="8408149" device="0" auth="0" ua="" exceptions="ssl,certcheck,certdate" category="105" reputation="trusted" categoryname="Business" country="Germany" +2023:03:08-15:08:20 sophos-test-vm1 httpproxy[6267]: id="0071" severity="info" sys="SecureWeb" sub="http" name="web request warned, forbidden category detected" action="warn" method="OPTIONS" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="3783" request="0x7fad9be42000" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="211" aptptime="0" cattime="149" avscantime="0" fullreqtime="1265" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" country="Germany" reason="category" category="9998" reputation="unverified" categoryname="Uncategorized" +2023:03:08-15:19:36 sophos-test-vm1 httpproxy[6267]: id="0072" severity="info" sys="SecureWeb" sub="http" name="Contentfilter warned and proceeded" url="https://myurl.test.com/extension" srcip="67.43.156.2" category="9998" categoryname="Uncategorized" +2023:03:08-15:20:40 sophos-test-vm1 httpproxy[6267]: id="0064" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden file extension detected" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="2814" request="0x7fad92a81700" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="0" avscantime="0" fullreqtime="638695" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" overridecategory="1" overridereputation="1" category="105,105,105,105,105" reputation="neutral" categoryname="Business,Business,Business,Business,Business" application="google" app-id="182" reason="extension" extension="com" filename="file1.zw-net.com" +2023:04:28-00:00:01 sophos-test-vm1 named[7442]: trust-anchor-telemetry '_test-1/IN' from 89.160.20.129 +2023:04:28-02:03:58 sophos-test-vm1 named[7442]: clients-per-query increased to 15 +2023:04:28-07:43:18 sophos-test-vm1 named[7442]: no longer listening on 192.168.1.123#53 +2023:04:28-07:43:18 sophos-test-vm1 named[7442]: listening on IPv4 interface wlan1, 192.168.1.123#53 +2023:04:28-09:12:31 sophos-test-vm1 named[7442]: clients-per-query decreased to 14 +2023:04:28-00:00:01 sophos-test-vm1 ulogd[12511]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth6" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="6" length="44" tos="0x00" prec="0x00" ttl="238" srcport="36584" dstport="8888" tcpflags="SYN" +2023:04:28-00:18:05 sophos-test-vm1 ulogd[12511]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="150" initf="eth7" outitf="eth6" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="1" length="30" tos="0x00" prec="0x00" ttl="5" type="8" code="0" +2023:04:28-00:18:06 sophos-test-vm1 ulogd[12511]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth6" mark="0x207c" app="124" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="17" length="87" tos="0x00" prec="0x00" ttl="59" srcport="53" dstport="30799" +2023:04:28-00:00:01 sophos-test-vm1 ulogd[12511]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="174" initf="eth6" outitf="eth7" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="6" length="52" tos="0x02" prec="0x00" ttl="126" srcport="55267" dstport="445" tcpflags="SYN" +2023:04:28-00:50:54 sophos-test-vm1 ulogd[12511]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth6" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="6" length="88" tos="0x00" prec="0x00" ttl="227" srcport="443" dstport="42181" tcpflags="ACK PSH" +2023:04:28-11:28:41 sophos-test-vm1 ulogd[12511]: id="2014" severity="info" sys="SecureNet" sub="packetfilter" name="DNS request" action="DNS request" fwrule="60011" initf="eth7" srcmac="00:50:56:b6:27:aa" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="17" length="75" tos="0x00" prec="0x00" ttl="64" srcport="34200" dstport="53" \ No newline at end of file diff --git a/packages/sophos/changelog.yml b/packages/sophos/changelog.yml index 91bb6d7a34f..d449b13b584 100644 --- a/packages/sophos/changelog.yml +++ b/packages/sophos/changelog.yml @@ -1,4 +1,36 @@ # newer versions go on top +- version: 3.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "3.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "3.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "3.0.0" + changes: + - description: Add support to UTM Packetfilter logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/6816 + - description: Add support to UTM HTTP logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/6816 + - description: Add support to UTM DHCP logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/6816 + - description: Add support to UTM DNS logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/6816 + - description: Deprecate JavaScript processing in favor of ingest pipelines for UTM logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/6816 - version: "2.11.1" changes: - description: Fix indentation in log agent config. diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log deleted file mode 100644 index cb9fa97790b..00000000000 --- a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log +++ /dev/null @@ -1,100 +0,0 @@ -2016:1:29-06:09:59 localhost.localdomain smtpd[905]: MASTER[nnumqua]: QR globally disabled, status one set to 'disabled' -2016:2:12-13:12:33 astarosg_TVM[5716]: id=ommod severity=medium sys=inima sub=tlabo name=web request blocked, forbidden application detectedaction=accept method=ugiatnu client=stiae facility=nofdeF user=sunt srcip=10.57.170.140 dstip=10.213.231.72 version=1.5102 storage=emips ad_domain=imadmi object=ostrume class=molest type=upt attributes=uiineavocount=tisetq node=irati account=icistatuscode=giatquov cached=eritquii profile=dexeac filteraction=iscinge size=6992 request=oreseos url=https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu referer=https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac error=nidolo authtime=tatn dnstime=eli cattime=nnu avscantime=dolo fullreqtime=Loremip device=idolor auth=emeumfu ua=CSed exceptions=lupt group=psaquae category=oinBCSe categoryname=mnisist content-type=sedd reputation=uatD application=iunt app-id=temveleu reason=colabo filename=eme file=numqu extension=qui time=civeli function=block line=agnaali message=gnam fwrule=tat seq=ipitla initf=enp0s7281 outitf=enp0s7084 dstmac=01:00:5e:de:94:f6 srcmac=01:00:5e:1d:c1:c0 proto=den length=tutla tos=olorema prec=;iades ttl=siarchi srcport=2289 dstport=3920 tcpflags=mqu info=apariat prec=tlabore caller=untmolli engine=remi localip=saute host=ercit2385.internal.home extra=run server=10.47.202.102 cookie=quirat set-cookie=llu -2016:2:26-20:15:08 eirure7587.internal.localhost reverseproxy: [mpori] [aaliquaU:medium] [pid 3905:lpaqui] (22)No form context found: [client sitame] No form context found when parsing iadese tag, referer: https://api.example.com/utla/utei.htm?oei=tlabori#oin -2016:3:12-03:17:42 data4478.api.lan confd: id=iquipex severity=very-high sys=uradip sub=wri name=bor client=occa facility=stquidol user=itquiin srcip=10.106.239.55 version=1.3129 storage=atevel object=nsecte class=itame type=eumfug attributes=litcount=asun node=estia account=eaq -2016:3:26-10:20:16 ctetura3009.www5.corp reverseproxy: [lita] [adeseru:medium] [pid 7692:eaq] amest configured -- corp normal operations -2016:4:9-17:22:51 localhost smtpd[1411]: MASTER[inculpa]: QR globally disabled, status one set to 'disabled' -2016:4:24-00:25:25 httpproxy[176]: [nse] disk_cache_zap (non) paquioff -2016:5:8-07:27:59 ptasnu6684.mail.lan reverseproxy: [orumSe] [boree:low] [pid 945:rQuisau] AH01915: Init: (10.18.13.211:205) You configured ofdeFini(irat) on the onev(aturauto) port! -2016:5:22-14:30:33 ssecillu7166.internal.lan barnyard: Initializing daemon mode -2016:6:5-21:33:08 ore5643.api.lan reverseproxy: [metco] [acom:high] [pid 2164:nim] ModSecurity: utaliqu compiled version="rsi"; loaded version="taliqui" -2016:6:20-04:35:42 ciun39.localdomain reverseproxy: [iatqu] [inBCSedu:high] [pid 4006:rorsit] AH00098: pid file tionemu overwritten -- Unclean shutdown of previous Apache run? -2016:7:4-11:38:16 atatnon6064.www.invalid reverseproxy: [magnid] [adol:low] [pid 1263:roide] AH00291: long lost child came home! (pid tem) -2016:7:18-18:40:50 gitse2463.www5.invalid aua: id=tvolup severity=low sys=sci sub=col name=web request blocked srcip=10.42.252.243 user=agnaaliq caller=est engine=mquisno -2016:8:2-01:43:25 httpproxy[2078]: [mol] sc_server_cmd (umdolors) decrypt failed -2016:8:16-08:45:59 oriosam6277.mail.localdomain frox: Listening on 10.169.5.162:6676 -2016:8:30-15:48:33 ptate3830.internal.localhost reverseproxy: [quamqua] [ntut:high] [pid 5996:meum] AH02572: Failed to configure at least one certificate and key for mini:Loremip -2016:9:13-22:51:07 nvo6105.invalid reverseproxy: [amquaer] [aqui:medium] [pid 3340:lpa] AH00020: Configuration Failed, isn -2016:9:28-05:53:42 afcd[2492]: Classifier configuration reloaded successfully -2016:10:12-12:56:16 edic2758.api.domain confd: id=olabori severity=medium sys=atatnon sub=lica name=secil client=uisnos facility=olores user=scipit srcip=10.54.169.175 version=1.5889 storage=onorumet object=ptatema class=eavolup type=ipsumq attributes=evitcount=tno node=iss account=taspe -2016:10:26-19:58:50 aua[32]: id=mmo severity=high sys=tlaboru sub=aeabillo name=checking if admin is enabled srcip=10.26.228.145 user=eruntmo caller=nimve engine=usanti -2016:11:10-03:01:24 sshd[2051]: Server listening on 10.59.215.207 port 6195. -2016:11:24-10:03:59 ectobeat3157.mail.local reverseproxy: [uasiarch] [Malor:low] [pid 170:cillumdo] AH02312: Fatal error initialising mod_ssl, ditau. -2016:12:8-17:06:33 ident2323.internal.corp reverseproxy: [hend] [remagna:high] [pid 873:aparia] AH01909: 10.144.21.112:90:epteurs server certificate does NOT include an ID which matches the server name -2016:12:23-00:09:07 ttenb4581.www.host httpproxy: [rem] main (exer) shutdown finished, exiting -2017:1:6-07:11:41 lapari5763.api.invalid frox: Listening on 10.103.2.48:4713 -2017:1:20-14:14:16 elites4713.www.localhost ulogd: id=serr severity=very-high sys=olore sub=onemul name=portscan detected action=deny fwrule=remeum seq=etur initf=lo6086 outitf=lo272 dstmac=01:00:5e:51:b9:4d srcmac=01:00:5e:15:3a:74 srcip=10.161.51.135 dstip=10.52.190.18 proto=isni length=quid tos=aUten prec=Duis ttl=uisq srcport=7807 dstport=165 tcpflags=accus info=CSed code=tiu type=wri -2017:2:3-21:16:50 sam1795.invalid reverseproxy: [lorese] [olupta:low] [pid 3338:iqui] AH02312: Fatal error initialising mod_ssl, animide. -2017:2:18-04:19:24 confd[10]: id=arch severity=high sys=data sub=ugits name=ittenb client=tobeatae facility=ntut user=llum srcip=10.232.108.32 version=1.5240 storage=idolo object=mqu class=mquido type=ende attributes=ntmollitcount=tisu node=ionofdeF account=rsp -2017:3:4-11:21:59 nostrum6305.internal.localhost astarosg_TVM: id=llitani severity=high sys=itametco sub=etcons name=web request blocked, forbidden url detectedaction=allow method=iuntN client=utfugi facility=ursintoc user=tio srcip=10.89.41.97 dstip=10.231.116.175 version=1.5146 storage=lup ad_domain=mipsamv object=exeacomm class=sequines type=cto attributes=cusacount=nderi node=tem account=tcustatuscode=eumiu cached=nim profile=pteurs filteraction=ercitati size=835 request=ptat url=https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn referer=https://example.com/taliqui/idi.txt?undeomn=ape#itaspe error=ari authtime=umtot dnstime=onemulla cattime=atquo avscantime=borio fullreqtime=equatD device=uidol auth=inculpa ua=ruredol exceptions=iadeseru group=loremagn category=acons categoryname=nimadmi content-type=lapa reputation=emoenimi application=iquipex app-id=mqu reason=onorume filename=abill file=ametcon extension=ofdeFini time=tasnu function=deny line=tionev message=uasiarch fwrule=velites seq=uredolor initf=lo1543 outitf=lo6683 dstmac=01:00:5e:8c:f2:06 srcmac=01:00:5e:6f:71:02 proto=plica length=asiarc tos=lor prec=;nvolupt ttl=dquia srcport=5334 dstport=1525 tcpflags=umfugiat info=quisnos prec=utf caller=dolor engine=dexe localip=nemul host=Duis583.api.local extra=eavolupt server=10.17.51.153 cookie=aperiame set-cookie=stenat -2017:3:18-18:24:33 xeaco7887.www.localdomain aua: id=hite severity=very-high sys=ugitsed sub=dminimve name=Packet accepted srcip=10.137.165.144 user=uptate caller=tot engine=reme -2017:4:2-01:27:07 reverseproxy[5430]: ARGS:userPermissions: [\\x22dashletAccessAlertingRecentAlertsPanel\\x22,\\x22dashletAccessAlerterTopAlertsDashlet\\x22,\\x22accessViewRules\\x22,\\x22deployLiveResources\\x22,\\x22vi..."] [severity [hostname "iscivel3512.invalid"] [uri "atcupi"] [unique_id "eriti"] -2017:4:16-08:29:41 sockd[6181]: dante/server 1.202 running -2017:4:30-15:32:16 dolor5799.home afcd: Classifier configuration reloaded successfully -2017:5:14-22:34:50 oreseosq1859.api.lan reverseproxy: [mmodic] [essequam:low] [pid 6691:ficiade] [client uiinea] [uianonn] virus daemon connection problem found in request https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure, referer: https://example.com/adeser/mSe.gif?aute=rchite#rcit -2017:5:29-05:37:24 confd-sync[6908]: id=smoditem severity=very-high sys=tev sub=oNemoeni name=luptatem -2017:6:12-12:39:58 autodit272.www.localhost reverseproxy: [oriss] [imadmin:very-high] [pid 1121:urve] ModSecurity: sBonoru compiled version="everi"; loaded version="squ" -2017:6:26-19:42:33 rporis6787.www5.localdomain reverseproxy: [quasiarc] [pta:low] [pid 3705:liqu] [client ipsu] AH01114: siarch: failed to make connection to backend: 10.148.21.7 -2017:7:11-02:45:07 reprehe5661.www.lan reverseproxy: rManage\\x22,\\x22manageLiveSystemSettings\\x22,\\x22accessViewJobs\\x22,\\x22exportList\\..."] [ver "olor"] [maturity "corpo"] [accuracy "commod"] iumd [hostname "ntore4333.api.invalid"] [uri "sitv"] [unique_id "equam"] -2017:7:25-09:47:41 exim[2384]: aeca-ugitse-ameiu utei:caecat:lumquid oluptat sequatD163.internal.example [10.151.206.38]:5794 lits -2017:8:8-16:50:15 elillu5777.www5.lan pluto: "elaudant"[olup] 10.230.4.70 #ncu: starting keying attempt quaturve of an unlimited number -2017:8:22-23:52:50 ecatcup3022.mail.invalid xl2tpd: Inherited by nproide -2017:9:6-06:55:24 qui7797.www.host ipsec_starter: Starting strongSwan umet IPsec [starter]... -2017:9:20-13:57:58 nofdeFin2037.mail.example reverseproxy: [quatD] [nevol:high] [pid 3994:Sectio] [client tiumdol] [laud] cannot read reply: Operation now in progress (115), referer: https://example.org/tquov/natu.jpg?uianonnu=por#nve -2017:10:4-21:00:32 sockd[7264]: dante/server 1.3714 running -2017:10:19-04:03:07 eFinib2403.api.example reverseproxy: [utaliq] [sun:high] [pid 4074:uredol] [client quatD] [enimad] ecatcu while reading reply from cssd, referer: https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse -2017:11:2-11:05:41 confd[4939]: id=acons severity=high sys=adipisc sub=omnisist name=orroqui client=sci facility=psamvolu user=itsedqui srcip=10.244.96.61 version=1.2707 storage=onevol object=ese class=reprehen type=Exce attributes=toccacount=tinvolu node=ecatc account=iumt -2017:11:16-18:08:15 named[1900]: reloading eddoei iono -2017:12:1-01:10:49 obeatae2042.www.domain reverseproxy: [dquian] [isaute:low] [pid 1853:utfugit] (70007)The ula specified has expired: [client quaUteni] AH01110: error reading response -2017:12:15-08:13:24 aerat1267.www5.example pop3proxy: Master started -2017:12:29-15:15:58 writt2238.internal.localdomain reverseproxy: [uaer] [aed:low] [pid 478:ain] [client scingeli] [uatDuis] mod_avscan_check_file_single_part() called with parameter filename=imip -2018:1:12-22:18:32 siutaliq4937.api.lan reverseproxy: [siutaliq] [urvel:very-high] [pid 7721:ntium] [imadmi] Hostname in dquiac request (liquide) does not match the server name (uatD) -2018:1:27-05:21:06 URID[7596]: T=BCSedut ------ 1 - [exit] accept: ametco -2018:2:10-12:23:41 astarosg_TVM[1090]: id=udex severity=low sys=iam sub=animi name=UDP flood detectedaction=allow method=nsectetu client=spici facility=untutl user=hen srcip=10.214.167.164 dstip=10.76.98.53 version=1.3726 storage=uovolup ad_domain=expl object=animi class=mdoloree type=mullamco attributes=tnulcount=ons node=radip account=amremapstatuscode=dolorsit cached=atisund profile=isnostru filteraction=quepo size=5693 request=nisi url=https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi referer=https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi error=nculp authtime=quamnihi dnstime=nimadmi cattime=mquiado avscantime=agn fullreqtime=dip device=urmag auth=nim ua=laboreet exceptions=tutlabo group=incid category=der categoryname=totamrem content-type=eaqu reputation=itani application=mni app-id=runtmol reason=uaer filename=nor file=saut extension=olest time=volu function=block line=osam message=ncid fwrule=loremagn seq=uisau initf=lo1255 outitf=eth965 dstmac=01:00:5e:2f:c3:3e srcmac=01:00:5e:65:2d:fe proto=ictasun length=iumto tos=ciun prec=;prehe ttl=essec srcport=4562 dstport=2390 tcpflags=uaera info=nsequa prec=yCicero caller=orporis engine=oluptate localip=tesseq host=tenbyCi4371.www5.localdomain extra=spernatu server=10.98.126.206 cookie=tion set-cookie=tNeque -2018:2:24-19:26:15 ulogd[6722]: id=persp severity=medium sys=orev sub=lapa name=Packet logged action=allow fwrule=adminim seq=isiutali initf=lo7088 outitf=eth6357 dstmac=01:00:5e:9a:fe:91 srcmac=01:00:5e:78:1a:5a srcip=10.203.157.250 dstip=10.32.236.117 proto=turm length=quamei tos=nvento prec=nama ttl=ema srcport=6585 dstport=5550 tcpflags=xeacomm info=oriosa code=erspici type=oreeu -2018:3:11-02:28:49 ectob5542.www5.corp reverseproxy: [agni] [ivelit:high] [pid 7755:uovol] AH00959: ap_proxy_connect_backend disabling worker for (10.231.77.26) for volups -2018:3:25-09:31:24 iusmo901.www.home httpd: id=scivelit severity=high sys=untut sub=siu name=Authentication successfulaction=allow method=icons client=hende facility=umdol user=Sedutper srcip=10.2.24.156 dstip=10.113.78.101 version=1.2707 storage=amqua ad_domain=nsequatu object=aboNemoe class=mqu type=tse attributes=ntiumdcount=ueip node=amvo account=dolorsistatuscode=acc cached=quinesc profile=ulpaq filteraction=usa size=5474 request=tob url=https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru referer=https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo error=avolup authtime=litse dnstime=archit cattime=nde avscantime=tNequepo fullreqtime=byCicer device=imvenia auth=ipit ua=tdolorem exceptions=nderitin group=mquiado category=ssequa categoryname=nisist content-type=temvele reputation=ofd application=quam app-id=umdol reason=porincid filename=tisetqu file=pici extension=erit time=ehenderi function=block line=fugiatqu message=Duisaute fwrule=uptat seq=hende initf=lo3680 outitf=lo4358 dstmac=01:00:5e:0a:8f:6c srcmac=01:00:5e:34:8c:d2 proto=mnis length=ainci tos=aturve prec=;tiumdol ttl=mporain srcport=6938 dstport=6939 tcpflags=dut info=aecons prec=tionemu caller=edictasu engine=quipexea localip=orsit host=tenima5715.api.example extra=snisiut server=10.92.93.236 cookie=amr set-cookie=mfug port=7174 query=exerc uid=ntoccae -2018:4:8-16:33:58 astarosg_TVM[6463]: id=user severity=low sys=sequamn sub=adeseru name=File extension warned and proceededaction=accept method=mquisn client=ulamcol facility=nulamcol user=atatno srcip=10.180.169.49 dstip=10.206.69.71 version=1.3155 storage=risni ad_domain=ccaecat object=dtemp class=onproid type=ica attributes=mnisiscount=edolor node=nonnumqu account=iscivelistatuscode=urve cached=sundeomn profile=tasu filteraction=equunt size=3144 request=ilmo url=https://mail.example.net/isqua/deF.html?iameaq=orainci#adm referer=https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria error=tessec authtime=cupida dnstime=ciade cattime=busBonor avscantime=enima fullreqtime=emseq device=osamni auth=umetMa ua=equatDui exceptions=its group=setquas category=nti categoryname=osamnis content-type=atisetqu reputation=ciduntut application=atisu app-id=edutpe reason=architec filename=incul file=tevelit extension=emse time=eipsaqua function=cancel line=suntincu message=lore fwrule=equatu seq=enbyCi initf=enp0s566 outitf=lo2179 dstmac=01:00:5e:2c:9d:65 srcmac=01:00:5e:1a:03:f5 proto=orema length=iusmo tos=uunturm prec=;mSect ttl=avolupta srcport=3308 dstport=1402 tcpflags=dolo info=tsed prec=corpori caller=cillumd engine=umdol localip=turmagn host=mni4032.lan extra=amrem server=10.202.65.2 cookie=queporr set-cookie=oide -2018:4:22-23:36:32 iscing6960.api.invalid reverseproxy: [emipsu] [incidu:very-high] [pid 5350:itation] SSL Library Error: error:itasper:failure -2018:5:7-06:39:06 httpd[793]: [ruredo:success] [pid nculpaq:mides] [client iconseq] ModSecurity: Warning. nidolo [file "runtmoll"] [line "tuserror"] [id "utlabo"] [rev "scip"] [msg "imvenia"] [severity "low"] [ver "1.6420"] [maturity "nisi"] [accuracy "seq"] [tag "ors"] [hostname "olupta3647.host"] [uri "uaUteni"] [unique_id "gitsedqu"]amqu -2018:5:21-13:41:41 named[6633]: FORMERR resolving 'iavolu7814.www5.localhost': 10.194.12.83#elit -2018:6:4-20:44:15 astarosg_TVM[5792]: id=elitess severity=low sys=amqua sub=mavenia name=checking if admin is enabledaction=cancel method=doc client=teurs facility=eturadi user=eturadip srcip=10.33.138.154 dstip=10.254.28.41 version=1.4256 storage=volupta ad_domain=dolor object=dolorsit class=tfugits type=lor attributes=oremcount=utper node=ueips account=umqustatuscode=ntexpli cached=siuta profile=porincid filteraction=itame size=1026 request=fugiat url=https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf referer=https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol error=emul authtime=ariatu dnstime=luptate cattime=umdolore avscantime=iutaliq fullreqtime=oriosamn device=oluptate auth=tcu ua=mmodo exceptions=rauto group=lup category=orem categoryname=tutl content-type=iusmo reputation=uiavolu application=eri app-id=pis reason=riosam filename=isa file=nonnum extension=Nemoenim time=itati function=cancel line=nes message=atvolupt fwrule=umwritt seq=uae initf=enp0s3792 outitf=lo2114 dstmac=01:00:5e:24:b8:9f srcmac=01:00:5e:a1:a3:9f proto=bil length=itten tos=icer prec=;dolo ttl=siutaliq srcport=1455 dstport=6937 tcpflags=pexeaco info=ercitati prec=dexea caller=tasnul engine=onu localip=orisnisi host=obea2960.mail.corp extra=dolor server=10.45.12.53 cookie=etdo set-cookie=edictas -2018:6:19-03:46:49 frox[7744]: Listening on 10.99.134.49:2274 -2018:7:3-10:49:23 olli5982.www.test reverseproxy: [asp] [uatDui:medium] [pid 212:unde] [client raut] [suscip] virus daemon error found in request ectetu, referer: https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid -2018:7:17-17:51:58 nsecte3644.internal.test reverseproxy: [tutla] [isund:high] [pid 3136:uidex] [client uptate] Invalid signature, cookie: JSESSIONID -2018:8:1-00:54:32 confd[4157]: id=onseq severity=very-high sys=siutaliq sub=aliqu name=serro client=ctet facility=umiurere user=antium srcip=10.32.85.21 version=1.7852 storage=eaco object=onp class=ectetur type=ione attributes=utlaborecount=nci node=acommodi account=etconsec -2018:8:15-07:57:06 econseq7119.www.home sshd: error: Could not get shadow information for NOUSER -2018:8:29-14:59:40 ant2543.www5.lan reverseproxy: [uaturve] [lapa:high] [pid 3669:idu] [client sed] [utem] cannot read reply: Operation now in progress (115), referer: https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo -2018:9:12-22:02:15 pluto[7138]: | sent accept notification olore with seqno = urEx -2018:9:27-05:04:49 httpd[6562]: id=iurere severity=medium sys=erc sub=atu name=http accessaction=accept method=odte client=uis facility=sedquia user=reetd srcip=10.210.175.52 dstip=10.87.14.186 version=1.7641 storage=tasu ad_domain=mquae object=CSedu class=atae type=aeconseq attributes=boNemocount=duntutla node=mqu account=inimastatuscode=emipsum cached=venia profile=Loremi filteraction=uisnostr size=849 request=vol url=https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq referer=https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid error=mipsa authtime=teturad dnstime=nimide cattime=spernat avscantime=nevolu fullreqtime=itectobe device=rroq auth=itessequ ua=uunt exceptions=pic group=unt category=emUt categoryname=eiru content-type=sauteir reputation=pic application=caecatc app-id=iarc reason=emquia filename=duntutl file=idi extension=reetdo time=pidatatn function=cancel line=ncul message=mcorpor fwrule=ofd seq=lapariat initf=eth65 outitf=lo3615 dstmac=01:00:5e:b3:e3:90 srcmac=01:00:5e:0e:b3:8e proto=consequ length=min tos=riame prec=;gnaal ttl=nti srcport=1125 dstport=605 tcpflags=utlab info=colabo prec=ditem caller=did engine=BCS localip=idex host=nisiuta4810.api.test extra=apa server=10.85.200.58 cookie=esse set-cookie=idexeac port=2294 query=iatquovo uid=rExce -2018:10:11-12:07:23 itametc1599.api.test ulogd: id=itaedi severity=low sys=ore sub=ips name=Authentication successful action=block fwrule=iamqu seq=aboN initf=eth2679 outitf=enp0s1164 dstmac=01:00:5e:c3:8a:24 srcmac=01:00:5e:5a:9d:a9 srcip=10.133.45.45 dstip=10.115.166.48 proto=utaliq length=icer tos=essequ prec=oeiu ttl=nsequa srcport=4180 dstport=4884 tcpflags=squa info=etM code=eve type=iru -2018:10:25-19:09:57 tiumt5462.mail.localhost sshd: Invalid user admin from runt -2018:11:9-02:12:32 vol1450.internal.host sshd: Server listening on 10.71.184.162 port 3506. -2018:11:23-09:15:06 ipsec_starter[178]: IP address or index of physical interface changed -> reinit of ipsec interface -2018:12:7-16:17:40 rporissu573.api.test reverseproxy: [exercita] [emaperi:very-high] [pid 5943:ddoei] AH02312: Fatal error initialising mod_ssl, nihi. -2018:12:21-23:20:14 nostru774.corp URID: T=tatnonp ------ 1 - [exit] allow: natuserr -2019:1:5-06:22:49 ipsec_starter[6226]: IP address or index of physical interface changed -> reinit of ipsec interface -2019:1:19-13:25:23 httpd[5037]: [iadese:unknown] [pid isundeo:emq] [client rehender] ModSecurity: Warning. uat [file "apa"] [line "tani"] [id "per"] [rev "ngelitse"] [msg "olorsita"] [severity "medium"] [ver "1.7102"] [maturity "apariat"] [accuracy "iuntNequ"] [tag "rExc"] [hostname "lorsita2216.www5.example"] [uri "turvelil"] [unique_id "velitsed"]rau -2019:2:2-20:27:57 sum2208.host reverseproxy: [eir] [nia:medium] [pid 4346:mco] [client ritinvol] [quioffi] mod_avscan_check_file_single_part() called with parameter filename=quamquae -2019:2:17-03:30:32 ore6843.local reverseproxy: [usmodite] [aveniam:medium] [pid 5126:xplicab] [client taev] No signature found, cookie: dictasu -2019:3:3-10:33:06 Sedu1610.mail.corp reverseproxy: [audant] [porr:medium] [pid 7442:tation] [client uunturma] AH01114: cons: failed to make connection to backend: 10.177.35.133 -2019:3:17-17:35:40 corpo6737.example reverseproxy: [officiad] [aliquide:very-high] [pid 6600:errorsi] [client raincidu] [orincidi] cannot connect: failure (111) -2019:4:1-00:38:14 pop3proxy[6854]: Master started -2019:4:15-07:40:49 eratvol314.www.home pop3proxy: Master started -2019:4:29-14:43:23 utemvele1838.mail.test reverseproxy: [xplicabo] [aco:high] [pid 2389:ratione] [client nrepr] ModSecurity: Warning. uipex [file "alorumw"] [line "nibus"] [id "eiusmo"] [msg "rci"] [hostname "seosquir715.local"] [uri "ercitati"] [unique_id "uiration"] -2019:5:13-21:45:57 ulapari2656.local reverseproxy: [itessec] [non:very-high] [pid 2237:licaboN] [client nvol] [moenimip] cannot connect: failure (111) -2019:5:28-04:48:31 reverseproxy[4278]: [ritat] [iscinge:very-high] [pid 4264:rroquisq] [client tnonpro] [nimv] erunt while reading reply from cssd, referer: https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor -2019:6:11-11:51:06 URID[7418]: T=xer ------ 1 - [exit] cancel: onemul -2019:6:25-18:53:40 pluto[7201]: | handling event ips for 10.165.217.56 "econse" #otamr -2019:7:10-01:56:14 stla2856.host reverseproxy: [onpro] [adolo:very-high] [pid 7766:siste] ModSecurity for Apache/nisiut (ostr) configured. -2019:7:24-08:58:48 peri6748.www5.domain reverseproxy: [cingeli] [esseq:high] [pid 2404:aquae] AH00098: pid file otamrema overwritten -- Unclean shutdown of previous Apache run? -2019:8:7-16:01:23 tnon5442.internal.test reverseproxy: [ive] [tquido:very-high] [pid 6108:taliquip] AH00295: caught accept, ectetu -2019:8:21-23:03:57 ariatu2606.www.host reverseproxy: [quamestq] [umquid:very-high] [pid 7690:rem] [client its] [inv] not all the file sent to the client: rin, referer: https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati -2019:9:5-06:06:31 imv1805.api.host ulogd: id=oenim severity=very-high sys=iaturExc sub=orsit name=ICMP flood detected action=cancel fwrule=eos seq=quameius initf=lo4665 outitf=lo3422 dstmac=01:00:5e:d6:f3:bc srcmac=01:00:5e:87:02:08 srcip=10.96.243.231 dstip=10.248.62.55 proto=ugiat length=quiin tos=apar prec=eleumiur ttl=chite srcport=5632 dstport=4206 tcpflags=tevelit info=etc code=lorem type=temvele -2019:9:19-13:09:05 rita600.www5.localdomain reverseproxy: [ini] [elite:high] [pid 7650:mnisiut] AH00959: ap_proxy_connect_backend disabling worker for (10.132.101.158) for cipitlabs -2019:10:3-20:11:40 sshd[2014]: Did not receive identification string from rroq -2019:10:18-03:14:14 admini1122.www.local reverseproxy: [ritte] [umwritte:very-high] [pid 1817:atu] (13)failure: [client vol] AH01095: prefetch request body failed to 10.96.193.132:5342 (orumwr) from bori () -2019:11:1-10:16:48 confd[2475]: id=utaliqu severity=low sys=xplicabo sub=quamni name=dol client=sisten facility=remeumf user=acommod srcip=10.96.200.83 version=1.7416 storage=sper object=asia class=roident type=olorem attributes=teursintcount=evelites node=nostr account=lapariat -2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud -2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico -2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log-expected.json deleted file mode 100644 index 46d8764eeff..00000000000 --- a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-generated.log-expected.json +++ /dev/null @@ -1,904 +0,0 @@ -{ - "expected": [ - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:1:29-06:09:59 localhost.localdomain smtpd[905]: MASTER[nnumqua]: QR globally disabled, status one set to 'disabled'", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:2:12-13:12:33 astarosg_TVM[5716]: id=ommod severity=medium sys=inima sub=tlabo name=web request blocked, forbidden application detectedaction=accept method=ugiatnu client=stiae facility=nofdeF user=sunt srcip=10.57.170.140 dstip=10.213.231.72 version=1.5102 storage=emips ad_domain=imadmi object=ostrume class=molest type=upt attributes=uiineavocount=tisetq node=irati account=icistatuscode=giatquov cached=eritquii profile=dexeac filteraction=iscinge size=6992 request=oreseos url=https://mail.example.net/tati/utaliqu.html?iquaUten=santium#iciatisu referer=https://www5.example.org/eporroqu/uat.txt?atquovo=suntinc#xeac error=nidolo authtime=tatn dnstime=eli cattime=nnu avscantime=dolo fullreqtime=Loremip device=idolor auth=emeumfu ua=CSed exceptions=lupt group=psaquae category=oinBCSe categoryname=mnisist content-type=sedd reputation=uatD application=iunt app-id=temveleu reason=colabo filename=eme file=numqu extension=qui time=civeli function=block line=agnaali message=gnam fwrule=tat seq=ipitla initf=enp0s7281 outitf=enp0s7084 dstmac=01:00:5e:de:94:f6 srcmac=01:00:5e:1d:c1:c0 proto=den length=tutla tos=olorema prec=;iades ttl=siarchi srcport=2289 dstport=3920 tcpflags=mqu info=apariat prec=tlabore caller=untmolli engine=remi localip=saute host=ercit2385.internal.home extra=run server=10.47.202.102 cookie=quirat set-cookie=llu", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:2:26-20:15:08 eirure7587.internal.localhost reverseproxy: [mpori] [aaliquaU:medium] [pid 3905:lpaqui] (22)No form context found: [client sitame] No form context found when parsing iadese tag, referer: https://api.example.com/utla/utei.htm?oei=tlabori#oin", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:3:12-03:17:42 data4478.api.lan confd: id=iquipex severity=very-high sys=uradip sub=wri name=bor client=occa facility=stquidol user=itquiin srcip=10.106.239.55 version=1.3129 storage=atevel object=nsecte class=itame type=eumfug attributes=litcount=asun node=estia account=eaq", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:3:26-10:20:16 ctetura3009.www5.corp reverseproxy: [lita] [adeseru:medium] [pid 7692:eaq] amest configured -- corp normal operations", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:4:9-17:22:51 localhost smtpd[1411]: MASTER[inculpa]: QR globally disabled, status one set to 'disabled'", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:4:24-00:25:25 httpproxy[176]: [nse] disk_cache_zap (non) paquioff", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:5:8-07:27:59 ptasnu6684.mail.lan reverseproxy: [orumSe] [boree:low] [pid 945:rQuisau] AH01915: Init: (10.18.13.211:205) You configured ofdeFini(irat) on the onev(aturauto) port!", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:5:22-14:30:33 ssecillu7166.internal.lan barnyard: Initializing daemon mode", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:6:5-21:33:08 ore5643.api.lan reverseproxy: [metco] [acom:high] [pid 2164:nim] ModSecurity: utaliqu compiled version=\"rsi\"; loaded version=\"taliqui\"", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:6:20-04:35:42 ciun39.localdomain reverseproxy: [iatqu] [inBCSedu:high] [pid 4006:rorsit] AH00098: pid file tionemu overwritten -- Unclean shutdown of previous Apache run?", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:7:4-11:38:16 atatnon6064.www.invalid reverseproxy: [magnid] [adol:low] [pid 1263:roide] AH00291: long lost child came home! (pid tem)", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:7:18-18:40:50 gitse2463.www5.invalid aua: id=tvolup severity=low sys=sci sub=col name=web request blocked srcip=10.42.252.243 user=agnaaliq caller=est engine=mquisno", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:8:2-01:43:25 httpproxy[2078]: [mol] sc_server_cmd (umdolors) decrypt failed", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:8:16-08:45:59 oriosam6277.mail.localdomain frox: Listening on 10.169.5.162:6676", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:8:30-15:48:33 ptate3830.internal.localhost reverseproxy: [quamqua] [ntut:high] [pid 5996:meum] AH02572: Failed to configure at least one certificate and key for mini:Loremip", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:9:13-22:51:07 nvo6105.invalid reverseproxy: [amquaer] [aqui:medium] [pid 3340:lpa] AH00020: Configuration Failed, isn", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:9:28-05:53:42 afcd[2492]: Classifier configuration reloaded successfully", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:10:12-12:56:16 edic2758.api.domain confd: id=olabori severity=medium sys=atatnon sub=lica name=secil client=uisnos facility=olores user=scipit srcip=10.54.169.175 version=1.5889 storage=onorumet object=ptatema class=eavolup type=ipsumq attributes=evitcount=tno node=iss account=taspe", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:10:26-19:58:50 aua[32]: id=mmo severity=high sys=tlaboru sub=aeabillo name=checking if admin is enabled srcip=10.26.228.145 user=eruntmo caller=nimve engine=usanti", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:11:10-03:01:24 sshd[2051]: Server listening on 10.59.215.207 port 6195.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:11:24-10:03:59 ectobeat3157.mail.local reverseproxy: [uasiarch] [Malor:low] [pid 170:cillumdo] AH02312: Fatal error initialising mod_ssl, ditau.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:12:8-17:06:33 ident2323.internal.corp reverseproxy: [hend] [remagna:high] [pid 873:aparia] AH01909: 10.144.21.112:90:epteurs server certificate does NOT include an ID which matches the server name", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2016:12:23-00:09:07 ttenb4581.www.host httpproxy: [rem] main (exer) shutdown finished, exiting", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:1:6-07:11:41 lapari5763.api.invalid frox: Listening on 10.103.2.48:4713", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:1:20-14:14:16 elites4713.www.localhost ulogd: id=serr severity=very-high sys=olore sub=onemul name=portscan detected action=deny fwrule=remeum seq=etur initf=lo6086 outitf=lo272 dstmac=01:00:5e:51:b9:4d srcmac=01:00:5e:15:3a:74 srcip=10.161.51.135 dstip=10.52.190.18 proto=isni length=quid tos=aUten prec=Duis ttl=uisq srcport=7807 dstport=165 tcpflags=accus info=CSed code=tiu type=wri", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:2:3-21:16:50 sam1795.invalid reverseproxy: [lorese] [olupta:low] [pid 3338:iqui] AH02312: Fatal error initialising mod_ssl, animide.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:2:18-04:19:24 confd[10]: id=arch severity=high sys=data sub=ugits name=ittenb client=tobeatae facility=ntut user=llum srcip=10.232.108.32 version=1.5240 storage=idolo object=mqu class=mquido type=ende attributes=ntmollitcount=tisu node=ionofdeF account=rsp", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:3:4-11:21:59 nostrum6305.internal.localhost astarosg_TVM: id=llitani severity=high sys=itametco sub=etcons name=web request blocked, forbidden url detectedaction=allow method=iuntN client=utfugi facility=ursintoc user=tio srcip=10.89.41.97 dstip=10.231.116.175 version=1.5146 storage=lup ad_domain=mipsamv object=exeacomm class=sequines type=cto attributes=cusacount=nderi node=tem account=tcustatuscode=eumiu cached=nim profile=pteurs filteraction=ercitati size=835 request=ptat url=https://mail.example.net/velillu/ecatcupi.txt?rsitamet=leumiur#ssequamn referer=https://example.com/taliqui/idi.txt?undeomn=ape#itaspe error=ari authtime=umtot dnstime=onemulla cattime=atquo avscantime=borio fullreqtime=equatD device=uidol auth=inculpa ua=ruredol exceptions=iadeseru group=loremagn category=acons categoryname=nimadmi content-type=lapa reputation=emoenimi application=iquipex app-id=mqu reason=onorume filename=abill file=ametcon extension=ofdeFini time=tasnu function=deny line=tionev message=uasiarch fwrule=velites seq=uredolor initf=lo1543 outitf=lo6683 dstmac=01:00:5e:8c:f2:06 srcmac=01:00:5e:6f:71:02 proto=plica length=asiarc tos=lor prec=;nvolupt ttl=dquia srcport=5334 dstport=1525 tcpflags=umfugiat info=quisnos prec=utf caller=dolor engine=dexe localip=nemul host=Duis583.api.local extra=eavolupt server=10.17.51.153 cookie=aperiame set-cookie=stenat", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:3:18-18:24:33 xeaco7887.www.localdomain aua: id=hite severity=very-high sys=ugitsed sub=dminimve name=Packet accepted srcip=10.137.165.144 user=uptate caller=tot engine=reme", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:4:2-01:27:07 reverseproxy[5430]: ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"iscivel3512.invalid\"] [uri \"atcupi\"] [unique_id \"eriti\"]", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:4:16-08:29:41 sockd[6181]: dante/server 1.202 running", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:4:30-15:32:16 dolor5799.home afcd: Classifier configuration reloaded successfully", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:5:14-22:34:50 oreseosq1859.api.lan reverseproxy: [mmodic] [essequam:low] [pid 6691:ficiade] [client uiinea] [uianonn] virus daemon connection problem found in request https://www5.example.com/dantium/ors.htm?sinto=edi#eumiure, referer: https://example.com/adeser/mSe.gif?aute=rchite#rcit", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:5:29-05:37:24 confd-sync[6908]: id=smoditem severity=very-high sys=tev sub=oNemoeni name=luptatem", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:6:12-12:39:58 autodit272.www.localhost reverseproxy: [oriss] [imadmin:very-high] [pid 1121:urve] ModSecurity: sBonoru compiled version=\"everi\"; loaded version=\"squ\"", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:6:26-19:42:33 rporis6787.www5.localdomain reverseproxy: [quasiarc] [pta:low] [pid 3705:liqu] [client ipsu] AH01114: siarch: failed to make connection to backend: 10.148.21.7", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:7:11-02:45:07 reprehe5661.www.lan reverseproxy: rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"olor\"] [maturity \"corpo\"] [accuracy \"commod\"] iumd [hostname \"ntore4333.api.invalid\"] [uri \"sitv\"] [unique_id \"equam\"]", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:7:25-09:47:41 exim[2384]: aeca-ugitse-ameiu utei:caecat:lumquid oluptat sequatD163.internal.example [10.151.206.38]:5794 lits", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:8:8-16:50:15 elillu5777.www5.lan pluto: \"elaudant\"[olup] 10.230.4.70 #ncu: starting keying attempt quaturve of an unlimited number", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:8:22-23:52:50 ecatcup3022.mail.invalid xl2tpd: Inherited by nproide", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:9:6-06:55:24 qui7797.www.host ipsec_starter: Starting strongSwan umet IPsec [starter]...", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:9:20-13:57:58 nofdeFin2037.mail.example reverseproxy: [quatD] [nevol:high] [pid 3994:Sectio] [client tiumdol] [laud] cannot read reply: Operation now in progress (115), referer: https://example.org/tquov/natu.jpg?uianonnu=por#nve", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:10:4-21:00:32 sockd[7264]: dante/server 1.3714 running", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:10:19-04:03:07 eFinib2403.api.example reverseproxy: [utaliq] [sun:high] [pid 4074:uredol] [client quatD] [enimad] ecatcu while reading reply from cssd, referer: https://mail.example.org/urautod/eveli.html?rese=nonproi#doconse", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:11:2-11:05:41 confd[4939]: id=acons severity=high sys=adipisc sub=omnisist name=orroqui client=sci facility=psamvolu user=itsedqui srcip=10.244.96.61 version=1.2707 storage=onevol object=ese class=reprehen type=Exce attributes=toccacount=tinvolu node=ecatc account=iumt", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:11:16-18:08:15 named[1900]: reloading eddoei iono", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:12:1-01:10:49 obeatae2042.www.domain reverseproxy: [dquian] [isaute:low] [pid 1853:utfugit] (70007)The ula specified has expired: [client quaUteni] AH01110: error reading response", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:12:15-08:13:24 aerat1267.www5.example pop3proxy: Master started", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2017:12:29-15:15:58 writt2238.internal.localdomain reverseproxy: [uaer] [aed:low] [pid 478:ain] [client scingeli] [uatDuis] mod_avscan_check_file_single_part() called with parameter filename=imip", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:1:12-22:18:32 siutaliq4937.api.lan reverseproxy: [siutaliq] [urvel:very-high] [pid 7721:ntium] [imadmi] Hostname in dquiac request (liquide) does not match the server name (uatD)", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:1:27-05:21:06 URID[7596]: T=BCSedut ------ 1 - [exit] accept: ametco", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:2:10-12:23:41 astarosg_TVM[1090]: id=udex severity=low sys=iam sub=animi name=UDP flood detectedaction=allow method=nsectetu client=spici facility=untutl user=hen srcip=10.214.167.164 dstip=10.76.98.53 version=1.3726 storage=uovolup ad_domain=expl object=animi class=mdoloree type=mullamco attributes=tnulcount=ons node=radip account=amremapstatuscode=dolorsit cached=atisund profile=isnostru filteraction=quepo size=5693 request=nisi url=https://api.example.org/iono/secillum.txt?apariat=tse#enbyCi referer=https://example.com/eetdol/aut.jpg?pitlab=tutlabor#imadmi error=nculp authtime=quamnihi dnstime=nimadmi cattime=mquiado avscantime=agn fullreqtime=dip device=urmag auth=nim ua=laboreet exceptions=tutlabo group=incid category=der categoryname=totamrem content-type=eaqu reputation=itani application=mni app-id=runtmol reason=uaer filename=nor file=saut extension=olest time=volu function=block line=osam message=ncid fwrule=loremagn seq=uisau initf=lo1255 outitf=eth965 dstmac=01:00:5e:2f:c3:3e srcmac=01:00:5e:65:2d:fe proto=ictasun length=iumto tos=ciun prec=;prehe ttl=essec srcport=4562 dstport=2390 tcpflags=uaera info=nsequa prec=yCicero caller=orporis engine=oluptate localip=tesseq host=tenbyCi4371.www5.localdomain extra=spernatu server=10.98.126.206 cookie=tion set-cookie=tNeque", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:2:24-19:26:15 ulogd[6722]: id=persp severity=medium sys=orev sub=lapa name=Packet logged action=allow fwrule=adminim seq=isiutali initf=lo7088 outitf=eth6357 dstmac=01:00:5e:9a:fe:91 srcmac=01:00:5e:78:1a:5a srcip=10.203.157.250 dstip=10.32.236.117 proto=turm length=quamei tos=nvento prec=nama ttl=ema srcport=6585 dstport=5550 tcpflags=xeacomm info=oriosa code=erspici type=oreeu", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:3:11-02:28:49 ectob5542.www5.corp reverseproxy: [agni] [ivelit:high] [pid 7755:uovol] AH00959: ap_proxy_connect_backend disabling worker for (10.231.77.26) for volups", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:3:25-09:31:24 iusmo901.www.home httpd: id=scivelit severity=high sys=untut sub=siu name=Authentication successfulaction=allow method=icons client=hende facility=umdol user=Sedutper srcip=10.2.24.156 dstip=10.113.78.101 version=1.2707 storage=amqua ad_domain=nsequatu object=aboNemoe class=mqu type=tse attributes=ntiumdcount=ueip node=amvo account=dolorsistatuscode=acc cached=quinesc profile=ulpaq filteraction=usa size=5474 request=tob url=https://www.example.org/imipsamv/doeiu.jpg?nderit=ficia#tru referer=https://mail.example.org/natuser/olupt.txt?ipsumqu=nsec#smo error=avolup authtime=litse dnstime=archit cattime=nde avscantime=tNequepo fullreqtime=byCicer device=imvenia auth=ipit ua=tdolorem exceptions=nderitin group=mquiado category=ssequa categoryname=nisist content-type=temvele reputation=ofd application=quam app-id=umdol reason=porincid filename=tisetqu file=pici extension=erit time=ehenderi function=block line=fugiatqu message=Duisaute fwrule=uptat seq=hende initf=lo3680 outitf=lo4358 dstmac=01:00:5e:0a:8f:6c srcmac=01:00:5e:34:8c:d2 proto=mnis length=ainci tos=aturve prec=;tiumdol ttl=mporain srcport=6938 dstport=6939 tcpflags=dut info=aecons prec=tionemu caller=edictasu engine=quipexea localip=orsit host=tenima5715.api.example extra=snisiut server=10.92.93.236 cookie=amr set-cookie=mfug port=7174 query=exerc uid=ntoccae", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:4:8-16:33:58 astarosg_TVM[6463]: id=user severity=low sys=sequamn sub=adeseru name=File extension warned and proceededaction=accept method=mquisn client=ulamcol facility=nulamcol user=atatno srcip=10.180.169.49 dstip=10.206.69.71 version=1.3155 storage=risni ad_domain=ccaecat object=dtemp class=onproid type=ica attributes=mnisiscount=edolor node=nonnumqu account=iscivelistatuscode=urve cached=sundeomn profile=tasu filteraction=equunt size=3144 request=ilmo url=https://mail.example.net/isqua/deF.html?iameaq=orainci#adm referer=https://api.example.org/mremap/ate.htm?tlabor=cidunt#ria error=tessec authtime=cupida dnstime=ciade cattime=busBonor avscantime=enima fullreqtime=emseq device=osamni auth=umetMa ua=equatDui exceptions=its group=setquas category=nti categoryname=osamnis content-type=atisetqu reputation=ciduntut application=atisu app-id=edutpe reason=architec filename=incul file=tevelit extension=emse time=eipsaqua function=cancel line=suntincu message=lore fwrule=equatu seq=enbyCi initf=enp0s566 outitf=lo2179 dstmac=01:00:5e:2c:9d:65 srcmac=01:00:5e:1a:03:f5 proto=orema length=iusmo tos=uunturm prec=;mSect ttl=avolupta srcport=3308 dstport=1402 tcpflags=dolo info=tsed prec=corpori caller=cillumd engine=umdol localip=turmagn host=mni4032.lan extra=amrem server=10.202.65.2 cookie=queporr set-cookie=oide", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:4:22-23:36:32 iscing6960.api.invalid reverseproxy: [emipsu] [incidu:very-high] [pid 5350:itation] SSL Library Error: error:itasper:failure", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:5:7-06:39:06 httpd[793]: [ruredo:success] [pid nculpaq:mides] [client iconseq] ModSecurity: Warning. nidolo [file \"runtmoll\"] [line \"tuserror\"] [id \"utlabo\"] [rev \"scip\"] [msg \"imvenia\"] [severity \"low\"] [ver \"1.6420\"] [maturity \"nisi\"] [accuracy \"seq\"] [tag \"ors\"] [hostname \"olupta3647.host\"] [uri \"uaUteni\"] [unique_id \"gitsedqu\"]amqu", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:5:21-13:41:41 named[6633]: FORMERR resolving 'iavolu7814.www5.localhost': 10.194.12.83#elit", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:6:4-20:44:15 astarosg_TVM[5792]: id=elitess severity=low sys=amqua sub=mavenia name=checking if admin is enabledaction=cancel method=doc client=teurs facility=eturadi user=eturadip srcip=10.33.138.154 dstip=10.254.28.41 version=1.4256 storage=volupta ad_domain=dolor object=dolorsit class=tfugits type=lor attributes=oremcount=utper node=ueips account=umqustatuscode=ntexpli cached=siuta profile=porincid filteraction=itame size=1026 request=fugiat url=https://www5.example.org/etcons/aecatc.jpg?ditem=tut#oditautf referer=https://internal.example.org/eddoei/iatqu.htm?itessec=dat#tdol error=emul authtime=ariatu dnstime=luptate cattime=umdolore avscantime=iutaliq fullreqtime=oriosamn device=oluptate auth=tcu ua=mmodo exceptions=rauto group=lup category=orem categoryname=tutl content-type=iusmo reputation=uiavolu application=eri app-id=pis reason=riosam filename=isa file=nonnum extension=Nemoenim time=itati function=cancel line=nes message=atvolupt fwrule=umwritt seq=uae initf=enp0s3792 outitf=lo2114 dstmac=01:00:5e:24:b8:9f srcmac=01:00:5e:a1:a3:9f proto=bil length=itten tos=icer prec=;dolo ttl=siutaliq srcport=1455 dstport=6937 tcpflags=pexeaco info=ercitati prec=dexea caller=tasnul engine=onu localip=orisnisi host=obea2960.mail.corp extra=dolor server=10.45.12.53 cookie=etdo set-cookie=edictas", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:6:19-03:46:49 frox[7744]: Listening on 10.99.134.49:2274", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:7:3-10:49:23 olli5982.www.test reverseproxy: [asp] [uatDui:medium] [pid 212:unde] [client raut] [suscip] virus daemon error found in request ectetu, referer: https://example.com/ariat/ptatemU.txt?cusan=ueipsaq#upid", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:7:17-17:51:58 nsecte3644.internal.test reverseproxy: [tutla] [isund:high] [pid 3136:uidex] [client uptate] Invalid signature, cookie: JSESSIONID", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:8:1-00:54:32 confd[4157]: id=onseq severity=very-high sys=siutaliq sub=aliqu name=serro client=ctet facility=umiurere user=antium srcip=10.32.85.21 version=1.7852 storage=eaco object=onp class=ectetur type=ione attributes=utlaborecount=nci node=acommodi account=etconsec", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:8:15-07:57:06 econseq7119.www.home sshd: error: Could not get shadow information for NOUSER", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:8:29-14:59:40 ant2543.www5.lan reverseproxy: [uaturve] [lapa:high] [pid 3669:idu] [client sed] [utem] cannot read reply: Operation now in progress (115), referer: https://example.com/oremagn/ehenderi.htm?mdolo=ionul#oeiusmo", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:9:12-22:02:15 pluto[7138]: | sent accept notification olore with seqno = urEx", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:9:27-05:04:49 httpd[6562]: id=iurere severity=medium sys=erc sub=atu name=http accessaction=accept method=odte client=uis facility=sedquia user=reetd srcip=10.210.175.52 dstip=10.87.14.186 version=1.7641 storage=tasu ad_domain=mquae object=CSedu class=atae type=aeconseq attributes=boNemocount=duntutla node=mqu account=inimastatuscode=emipsum cached=venia profile=Loremi filteraction=uisnostr size=849 request=vol url=https://internal.example.com/ritat/dipi.jpg?aliquide=aliqui#agnaaliq referer=https://api.example.org/Bonorume/emeumfu.txt?iuntNequ=ender#quid error=mipsa authtime=teturad dnstime=nimide cattime=spernat avscantime=nevolu fullreqtime=itectobe device=rroq auth=itessequ ua=uunt exceptions=pic group=unt category=emUt categoryname=eiru content-type=sauteir reputation=pic application=caecatc app-id=iarc reason=emquia filename=duntutl file=idi extension=reetdo time=pidatatn function=cancel line=ncul message=mcorpor fwrule=ofd seq=lapariat initf=eth65 outitf=lo3615 dstmac=01:00:5e:b3:e3:90 srcmac=01:00:5e:0e:b3:8e proto=consequ length=min tos=riame prec=;gnaal ttl=nti srcport=1125 dstport=605 tcpflags=utlab info=colabo prec=ditem caller=did engine=BCS localip=idex host=nisiuta4810.api.test extra=apa server=10.85.200.58 cookie=esse set-cookie=idexeac port=2294 query=iatquovo uid=rExce", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:10:11-12:07:23 itametc1599.api.test ulogd: id=itaedi severity=low sys=ore sub=ips name=Authentication successful action=block fwrule=iamqu seq=aboN initf=eth2679 outitf=enp0s1164 dstmac=01:00:5e:c3:8a:24 srcmac=01:00:5e:5a:9d:a9 srcip=10.133.45.45 dstip=10.115.166.48 proto=utaliq length=icer tos=essequ prec=oeiu ttl=nsequa srcport=4180 dstport=4884 tcpflags=squa info=etM code=eve type=iru", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:10:25-19:09:57 tiumt5462.mail.localhost sshd: Invalid user admin from runt", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:11:9-02:12:32 vol1450.internal.host sshd: Server listening on 10.71.184.162 port 3506.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:11:23-09:15:06 ipsec_starter[178]: IP address or index of physical interface changed -\u003e reinit of ipsec interface", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:12:7-16:17:40 rporissu573.api.test reverseproxy: [exercita] [emaperi:very-high] [pid 5943:ddoei] AH02312: Fatal error initialising mod_ssl, nihi.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2018:12:21-23:20:14 nostru774.corp URID: T=tatnonp ------ 1 - [exit] allow: natuserr", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:1:5-06:22:49 ipsec_starter[6226]: IP address or index of physical interface changed -\u003e reinit of ipsec interface", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:1:19-13:25:23 httpd[5037]: [iadese:unknown] [pid isundeo:emq] [client rehender] ModSecurity: Warning. uat [file \"apa\"] [line \"tani\"] [id \"per\"] [rev \"ngelitse\"] [msg \"olorsita\"] [severity \"medium\"] [ver \"1.7102\"] [maturity \"apariat\"] [accuracy \"iuntNequ\"] [tag \"rExc\"] [hostname \"lorsita2216.www5.example\"] [uri \"turvelil\"] [unique_id \"velitsed\"]rau", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:2:2-20:27:57 sum2208.host reverseproxy: [eir] [nia:medium] [pid 4346:mco] [client ritinvol] [quioffi] mod_avscan_check_file_single_part() called with parameter filename=quamquae", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:2:17-03:30:32 ore6843.local reverseproxy: [usmodite] [aveniam:medium] [pid 5126:xplicab] [client taev] No signature found, cookie: dictasu", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:3:3-10:33:06 Sedu1610.mail.corp reverseproxy: [audant] [porr:medium] [pid 7442:tation] [client uunturma] AH01114: cons: failed to make connection to backend: 10.177.35.133", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:3:17-17:35:40 corpo6737.example reverseproxy: [officiad] [aliquide:very-high] [pid 6600:errorsi] [client raincidu] [orincidi] cannot connect: failure (111)", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:4:1-00:38:14 pop3proxy[6854]: Master started", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:4:15-07:40:49 eratvol314.www.home pop3proxy: Master started", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:4:29-14:43:23 utemvele1838.mail.test reverseproxy: [xplicabo] [aco:high] [pid 2389:ratione] [client nrepr] ModSecurity: Warning. uipex [file \"alorumw\"] [line \"nibus\"] [id \"eiusmo\"] [msg \"rci\"] [hostname \"seosquir715.local\"] [uri \"ercitati\"] [unique_id \"uiration\"]", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:5:13-21:45:57 ulapari2656.local reverseproxy: [itessec] [non:very-high] [pid 2237:licaboN] [client nvol] [moenimip] cannot connect: failure (111)", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:5:28-04:48:31 reverseproxy[4278]: [ritat] [iscinge:very-high] [pid 4264:rroquisq] [client tnonpro] [nimv] erunt while reading reply from cssd, referer: https://example.org/etcon/ipitlab.gif?utlabore=suscipi#tlabor", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:6:11-11:51:06 URID[7418]: T=xer ------ 1 - [exit] cancel: onemul", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:6:25-18:53:40 pluto[7201]: | handling event ips for 10.165.217.56 \"econse\" #otamr", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:7:10-01:56:14 stla2856.host reverseproxy: [onpro] [adolo:very-high] [pid 7766:siste] ModSecurity for Apache/nisiut (ostr) configured.", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:7:24-08:58:48 peri6748.www5.domain reverseproxy: [cingeli] [esseq:high] [pid 2404:aquae] AH00098: pid file otamrema overwritten -- Unclean shutdown of previous Apache run?", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:8:7-16:01:23 tnon5442.internal.test reverseproxy: [ive] [tquido:very-high] [pid 6108:taliquip] AH00295: caught accept, ectetu", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:8:21-23:03:57 ariatu2606.www.host reverseproxy: [quamestq] [umquid:very-high] [pid 7690:rem] [client its] [inv] not all the file sent to the client: rin, referer: https://example.org/tation/tutlabo.jpg?amvo=ullamco#tati", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:9:5-06:06:31 imv1805.api.host ulogd: id=oenim severity=very-high sys=iaturExc sub=orsit name=ICMP flood detected action=cancel fwrule=eos seq=quameius initf=lo4665 outitf=lo3422 dstmac=01:00:5e:d6:f3:bc srcmac=01:00:5e:87:02:08 srcip=10.96.243.231 dstip=10.248.62.55 proto=ugiat length=quiin tos=apar prec=eleumiur ttl=chite srcport=5632 dstport=4206 tcpflags=tevelit info=etc code=lorem type=temvele", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:9:19-13:09:05 rita600.www5.localdomain reverseproxy: [ini] [elite:high] [pid 7650:mnisiut] AH00959: ap_proxy_connect_backend disabling worker for (10.132.101.158) for cipitlabs", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:10:3-20:11:40 sshd[2014]: Did not receive identification string from rroq", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:10:18-03:14:14 admini1122.www.local reverseproxy: [ritte] [umwritte:very-high] [pid 1817:atu] (13)failure: [client vol] AH01095: prefetch request body failed to 10.96.193.132:5342 (orumwr) from bori ()", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:11:1-10:16:48 confd[2475]: id=utaliqu severity=low sys=xplicabo sub=quamni name=dol client=sisten facility=remeumf user=acommod srcip=10.96.200.83 version=1.7416 storage=sper object=asia class=roident type=olorem attributes=teursintcount=evelites node=nostr account=lapariat", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:11:15-17:19:22 emvel4391.localhost sshd: Did not receive identification string from quelaud", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:11:30-00:21:57 confd-sync[5454]: id=smodite severity=high sys=utpersp sub=rnatu name=ico", - "tags": [ - "preserve_original_event" - ] - }, - { - "ecs": { - "version": "8.8.0" - }, - "message": "2019:12:14-07:24:31 untinc5531.www5.test sshd: error: Could not get shadow information for NOUSER", - "tags": [ - "preserve_original_event" - ] - } - ] -} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json deleted file mode 100644 index 52741a0f490..00000000000 --- a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "events": [ - { - "@timestamp": "2019-04-08T11:21:55.000Z", - "agent": { - "ephemeral_id": "e311f248-bcfe-40fa-a92c-75047bac1b66", - "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.1.3" - }, - "data_stream": { - "dataset": "sophos.utm", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "172.30.30.1", - "mac": "00:0c:29:93:cc:85", - "port": 51130 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", - "snapshot": false, - "version": "8.1.3" - }, - "event": { - "code": "ulogd", - "dataset": "sophos.utm", - "original": "2019:04:08-11:21:55 galaxy ulogd[5009]: id=\"2002\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet accepted\" action=\"accept\" fwrule=\"3000000014\" initf=\"eth0\" outitf=\"eth3\" srcmac=\"00:50:56:c0:00:01\" dstmac=\"00:0c:29:93:cc:85\" srcip=\"192.168.168.1\" dstip=\"172.30.30.1\" proto=\"6\" length=\"52\" tos=\"0x00\" prec=\"0x00\" ttl=\"127\" srcport=\"57051\" dstport=\"51130\" tcpflags=\"SYN\"", - "timezone": "+00:00" - }, - "host": { - "name": "galaxy" - }, - "input": { - "type": "log" - }, - "log": { - "file": { - "path": "/tmp/service_logs/sophos-utm-generated.log" - }, - "level": "info", - "offset": 24605 - }, - "message": "\"Packet", - "observer": { - "egress": { - "interface": { - "name": "eth3" - } - }, - "ingress": { - "interface": { - "name": "eth0" - } - }, - "product": "UTM", - "type": "Firewall", - "vendor": "Sophos" - }, - "process": { - "pid": 5009 - }, - "related": { - "ip": [ - "172.30.30.1", - "192.168.168.1" - ] - }, - "rsa": { - "internal": { - "event_desc": "\"Packet", - "messageid": "ulogd" - }, - "investigations": { - "ec_activity": "Scan", - "ec_subject": "NetworkComm", - "ec_theme": "TEV", - "event_cat": 1901000000, - "event_cat_name": "Other.Default" - }, - "misc": { - "policy_id": "3000000014", - "rule": "2002", - "severity": "info", - "vsys": "SecureNet" - }, - "network": { - "alias_host": [ - "galaxy" - ], - "dinterface": "eth3", - "network_service": "packetfilter", - "sinterface": "eth0" - }, - "time": { - "event_time": "2019-04-08T11:21:55.000Z" - } - }, - "source": { - "ip": "192.168.168.1", - "mac": "00:50:56:c0:00:01", - "port": 57051 - }, - "tags": [ - "sophos-utm", - "forwarded" - ] - } - ] -} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json-expected.json deleted file mode 100644 index 4d367c710c2..00000000000 --- a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-packet-filter.json-expected.json +++ /dev/null @@ -1,117 +0,0 @@ -{ - "expected": [ - { - "@timestamp": "2019-04-08T11:21:55.000Z", - "agent": { - "ephemeral_id": "e311f248-bcfe-40fa-a92c-75047bac1b66", - "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.1.3" - }, - "data_stream": { - "dataset": "sophos.utm", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "172.30.30.1", - "mac": "00-0C-29-93-CC-85", - "port": 51130 - }, - "ecs": { - "version": "8.8.0" - }, - "elastic_agent": { - "id": "de9c1b8e-5967-4715-bc22-6f9dd52f6cc2", - "snapshot": false, - "version": "8.1.3" - }, - "event": { - "code": "ulogd", - "dataset": "sophos.utm", - "original": "2019:04:08-11:21:55 galaxy ulogd[5009]: id=\"2002\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet accepted\" action=\"accept\" fwrule=\"3000000014\" initf=\"eth0\" outitf=\"eth3\" srcmac=\"00:50:56:c0:00:01\" dstmac=\"00:0c:29:93:cc:85\" srcip=\"192.168.168.1\" dstip=\"172.30.30.1\" proto=\"6\" length=\"52\" tos=\"0x00\" prec=\"0x00\" ttl=\"127\" srcport=\"57051\" dstport=\"51130\" tcpflags=\"SYN\"", - "timezone": "+00:00" - }, - "host": { - "name": "galaxy" - }, - "input": { - "type": "log" - }, - "log": { - "file": { - "path": "/tmp/service_logs/sophos-utm-generated.log" - }, - "level": "info", - "offset": 24605 - }, - "message": "\"Packet", - "observer": { - "egress": { - "interface": { - "name": "eth3" - } - }, - "ingress": { - "interface": { - "name": "eth0" - } - }, - "product": "UTM", - "type": "Firewall", - "vendor": "Sophos" - }, - "process": { - "pid": 5009 - }, - "related": { - "hosts": [ - "galaxy" - ], - "ip": [ - "172.30.30.1", - "192.168.168.1" - ] - }, - "rsa": { - "internal": { - "event_desc": "\"Packet", - "messageid": "ulogd" - }, - "investigations": { - "ec_activity": "Scan", - "ec_subject": "NetworkComm", - "ec_theme": "TEV", - "event_cat": 1901000000, - "event_cat_name": "Other.Default" - }, - "misc": { - "policy_id": "3000000014", - "rule": "2002", - "severity": "info", - "vsys": "SecureNet" - }, - "network": { - "alias_host": [ - "galaxy" - ], - "dinterface": "eth3", - "network_service": "packetfilter", - "sinterface": "eth0" - }, - "time": { - "event_time": "2019-04-08T11:21:55.000Z" - } - }, - "source": { - "ip": "192.168.168.1", - "mac": "00-50-56-C0-00-01", - "port": 57051 - }, - "tags": [ - "preserve_original_event" - ] - } - ] -} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log new file mode 100644 index 00000000000..3717143cc54 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log @@ -0,0 +1,4 @@ +2023:04:28-00:00:04 sophos-test-vm1 dhcpd: DHCPDISCOVER from 04:7b:cb:a1:d2:93 via eth7: unknown client +2023:04:28-06:50:45 sophos-test-vm1 dhcpd: DHCPACK on 89.160.20.129 to 04:7b:cb:a1:d2:93 (CLIENTHOST) via eth1 +2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Listening on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24 +2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Sending on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24 \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log-expected.json new file mode 100644 index 00000000000..58b29373da9 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dhcp.log-expected.json @@ -0,0 +1,255 @@ +{ + "expected": [ + { + "@timestamp": "2023-04-28T00:00:04.000Z", + "client": { + "mac": "04-7B-CB-A1-D2-93" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "dhcpdiscover", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-00:00:04 sophos-test-vm1 dhcpd: DHCPDISCOVER from 04:7b:cb:a1:d2:93 via eth7: unknown client", + "provider": "dhcp", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "message": "unknown client", + "network": { + "protocol": "dhcp", + "transport": "udp" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth7" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "dhcpd" + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T06:50:45.000Z", + "client": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "mac": "04-7B-CB-A1-D2-93" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "dhcpack", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-06:50:45 sophos-test-vm1 dhcpd: DHCPACK on 89.160.20.129 to 04:7b:cb:a1:d2:93 (CLIENTHOST) via eth1", + "provider": "dhcp", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "protocol": "dhcp", + "transport": "udp" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth1" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "dhcpd" + }, + "related": { + "hosts": [ + "CLIENTHOST", + "sophos-test-vm1" + ], + "ip": [ + "89.160.20.129" + ] + }, + "sophos": { + "utm": { + "client": { + "hostname": "CLIENTHOST" + } + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T03:30:27.000Z", + "client": { + "mac": "04-7B-CB-A1-D2-93" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "dhcpd-listening", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Listening on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24", + "provider": "dhcp", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm2" + }, + "network": { + "protocol": "dhcp", + "transport": "udp" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth0" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "dhcpd" + }, + "related": { + "hosts": [ + "sophos-test-vm2" + ] + }, + "sophos": { + "utm": { + "socket": "LPF", + "subnet": "89.160.20.0/24" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T03:30:27.000Z", + "client": { + "mac": "04-7B-CB-A1-D2-93" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "dhcpd-sending", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-03:30:27 sophos-test-vm2 dhcpd: Sending on LPF/eth0/04:7b:cb:a1:d2:93/89.160.20.0/24", + "provider": "dhcp", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm2" + }, + "network": { + "protocol": "dhcp", + "transport": "udp" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth0" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "dhcpd" + }, + "related": { + "hosts": [ + "sophos-test-vm2" + ] + }, + "sophos": { + "utm": { + "socket": "LPF", + "subnet": "89.160.20.0/24" + } + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log new file mode 100644 index 00000000000..6064c906332 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log @@ -0,0 +1,5 @@ +2023:04:28-00:00:01 sophos-test-vm1 named[7442]: trust-anchor-telemetry '_test-1/IN' from 89.160.20.129 +2023:04:28-02:03:58 sophos-test-vm1 named[7442]: clients-per-query increased to 15 +2023:04:28-07:43:18 sophos-test-vm1 named[7442]: no longer listening on 89.160.20.129#53 +2023:04:28-07:43:18 sophos-test-vm1 named[7442]: listening on IPv4 interface wlan1, 89.160.20.129#53 +2023:04:28-09:12:31 sophos-test-vm1 named[7442]: clients-per-query decreased to 14 \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log-expected.json new file mode 100644 index 00000000000..c51aed79eee --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-dns.log-expected.json @@ -0,0 +1,285 @@ +{ + "expected": [ + { + "@timestamp": "2023-04-28T00:00:01.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-00:00:01 sophos-test-vm1 named[7442]: trust-anchor-telemetry '_test-1/IN' from 89.160.20.129", + "provider": "dns", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "message": "trust-anchor-telemetry '_test-1/IN' from 89.160.20.129", + "network": { + "protocol": "dns", + "transport": "udp" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "named", + "pid": 7442 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T02:03:58.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-02:03:58 sophos-test-vm1 named[7442]: clients-per-query increased to 15", + "provider": "dns", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "message": "clients-per-query increased to 15", + "network": { + "protocol": "dns", + "transport": "udp" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "named", + "pid": 7442 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T07:43:18.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "named-listening", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-07:43:18 sophos-test-vm1 named[7442]: no longer listening on 89.160.20.129#53", + "provider": "dns", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "protocol": "dns", + "transport": "udp" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "named", + "pid": 7442 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "89.160.20.129" + ] + }, + "server": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 53 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T07:43:18.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "named-listening", + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-07:43:18 sophos-test-vm1 named[7442]: listening on IPv4 interface wlan1, 89.160.20.129#53", + "provider": "dns", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "protocol": "dns", + "transport": "udp", + "type": "ipv4" + }, + "observer": { + "ingress": { + "interface": { + "name": "wlan1" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "named", + "pid": 7442 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "89.160.20.129" + ] + }, + "server": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "port": 53 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T09:12:31.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "network" + ], + "kind": "event", + "original": "2023:04:28-09:12:31 sophos-test-vm1 named[7442]: clients-per-query decreased to 14", + "provider": "dns", + "timezone": "UTC", + "type": [ + "info", + "connection", + "protocol" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "message": "clients-per-query decreased to 14", + "network": { + "protocol": "dns", + "transport": "udp" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "named", + "pid": 7442 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log new file mode 100644 index 00000000000..c13fc19e9e1 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log @@ -0,0 +1,10 @@ +2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="HEAD" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="311" request="0x7fad9e44ac00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="5" aptptime="0" cattime="200" avscantime="0" fullreqtime="32181" device="0" auth="0" ua="Microsoft BITS/7.8" exceptions="" category="178" reputation="trusted" categoryname="Internet Services" application="googplay" app-id="816" country="United States" content-type="application/octet-stream" +2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="416" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="311" request="0x7fad9e44ac00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="191" avscantime="0" fullreqtime="50667" device="0" auth="0" ua="Microsoft BITS/7.8" exceptions="" category="178" reputation="trusted" categoryname="Internet Services" application="googplay" app-id="816" content-type="application/octet-stream" reason="range" +2023:03:08-15:00:06 sophos-test-vm1 httpproxy[6267]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x7fad90f7ed00" function="fileextension_scan" file="fileextensionscanner.c" line="154" message="error converting file name to utf-8 from x-user-defined: Conversion from character set 'x-user-defined' to 'UTF8' is not supported" +2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id="0003" severity="info" sys="SecureWeb" sub="http" request="0x7fadb4088d00" function="ssl_raw_read" file="ssl.c" line="1012" message="SSL_ERROR_SYSCALL: ret=-1 error=Broken pipe" +2023:03:08-15:00:39 sophos-test-vm1 httpproxy[6267]: id="0060" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden category detected" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="4764" request="0x7fad933c8b00" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="249" aptptime="0" cattime="206" avscantime="0" fullreqtime="1499" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" country="Germany" category="141" reputation="trusted" categoryname="Portal Sites" application="yahoo" app-id="553" reason="category" +2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="POST" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="92" request="0x7fad8b180000" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="137" avscantime="3221" fullreqtime="407968" device="0" auth="0" ua="CloudKitWin/57.0.0.0 (Windows/10.0.0.0)" exceptions="" category="170" reputation="trusted" categoryname="Personal Network Storage" application="icloud" app-id="666" content-type="application/x-protobuf" sandbox="-" +2023:03:08-15:05:47 sophos-test-vm1 httpproxy[6267]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="200" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="23229" request="0x7fad93120200" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="257" aptptime="0" cattime="170" avscantime="0" fullreqtime="8408149" device="0" auth="0" ua="" exceptions="ssl,certcheck,certdate" category="105" reputation="trusted" categoryname="Business" country="Germany" +2023:03:08-15:08:20 sophos-test-vm1 httpproxy[6267]: id="0071" severity="info" sys="SecureWeb" sub="http" name="web request warned, forbidden category detected" action="warn" method="OPTIONS" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="3783" request="0x7fad9be42000" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="211" aptptime="0" cattime="149" avscantime="0" fullreqtime="1265" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" country="Germany" reason="category" category="9998" reputation="unverified" categoryname="Uncategorized" +2023:03:08-15:19:36 sophos-test-vm1 httpproxy[6267]: id="0072" severity="info" sys="SecureWeb" sub="http" name="Contentfilter warned and proceeded" url="https://myurl.test.com/extension" srcip="67.43.156.2" category="9998" categoryname="Uncategorized" +2023:03:08-15:20:40 sophos-test-vm1 httpproxy[6267]: id="0064" severity="info" sys="SecureWeb" sub="http" name="web request blocked, forbidden file extension detected" action="block" method="GET" srcip="67.43.156.2" dstip="89.160.20.129" user="testuser" group="testgroup" ad_domain="example.com" statuscode="403" cached="0" profile="HTTP_Sophos_Profile_1" filteraction="REF_HTTP_ACTION" size="2814" request="0x7fad92a81700" url="https://myurl.test.com/extension" referer="https://referer.test.com/" error="" authtime="0" dnstime="0" aptptime="0" cattime="0" avscantime="0" fullreqtime="638695" device="0" auth="0" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" exceptions="" overridecategory="1" overridereputation="1" category="105,105,105,105,105" reputation="neutral" categoryname="Business,Business,Business,Business,Business" application="google" app-id="182" reason="extension" extension="com" filename="file1.zw-net.com" \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log-expected.json new file mode 100644 index 00000000000..a8142b48ea2 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-http.log-expected.json @@ -0,0 +1,1294 @@ +{ + "expected": [ + { + "@timestamp": "2023-03-08T15:00:00.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "pass", + "category": [ + "web" + ], + "id": "0001", + "kind": "event", + "original": "2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id=\"0001\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"http access\" action=\"pass\" method=\"HEAD\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"200\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"311\" request=\"0x7fad9e44ac00\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"5\" aptptime=\"0\" cattime=\"200\" avscantime=\"0\" fullreqtime=\"32181\" device=\"0\" auth=\"0\" ua=\"Microsoft BITS/7.8\" exceptions=\"\" category=\"178\" reputation=\"trusted\" categoryname=\"Internet Services\" application=\"googplay\" app-id=\"816\" country=\"United States\" content-type=\"application/octet-stream\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 311, + "id": "0x7fad9e44ac00", + "method": "HEAD", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 200 + } + }, + "network": { + "application": "googplay", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "ad_domain": "example.com", + "app_id": "816", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "178" + ], + "categoryname": [ + "Internet Services" + ], + "cattime": 200, + "content_type": "application/octet-stream", + "country": "United States", + "dnstime": 5, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 32181, + "name": "http access", + "profile": "HTTP_Sophos_Profile_1", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Microsoft BITS/7.8" + } + }, + { + "@timestamp": "2023-03-08T15:00:00.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block-range", + "category": [ + "web" + ], + "id": "0002", + "kind": "event", + "original": "2023:03:08-15:00:00 sophos-test-vm1 httpproxy[6267]: id=\"0002\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"web request blocked\" action=\"block\" method=\"GET\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"416\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"311\" request=\"0x7fad9e44ac00\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"0\" aptptime=\"0\" cattime=\"191\" avscantime=\"0\" fullreqtime=\"50667\" device=\"0\" auth=\"0\" ua=\"Microsoft BITS/7.8\" exceptions=\"\" category=\"178\" reputation=\"trusted\" categoryname=\"Internet Services\" application=\"googplay\" app-id=\"816\" content-type=\"application/octet-stream\" reason=\"range\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 311, + "id": "0x7fad9e44ac00", + "method": "GET", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 416 + } + }, + "network": { + "application": "googplay", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "action": "block", + "ad_domain": "example.com", + "app_id": "816", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "178" + ], + "categoryname": [ + "Internet Services" + ], + "cattime": 191, + "content_type": "application/octet-stream", + "dnstime": 0, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 50667, + "name": "web request blocked", + "profile": "HTTP_Sophos_Profile_1", + "reason": "range", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Microsoft BITS/7.8" + } + }, + { + "@timestamp": "2023-03-08T15:00:06.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "web" + ], + "id": "0003", + "kind": "event", + "original": "2023:03:08-15:00:06 sophos-test-vm1 httpproxy[6267]: id=\"0003\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" request=\"0x7fad90f7ed00\" function=\"fileextension_scan\" file=\"fileextensionscanner.c\" line=\"154\" message=\"error converting file name to utf-8 from x-user-defined: Conversion from character set 'x-user-defined' to 'UTF8' is not supported\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "file": { + "name": "fileextensionscanner.c" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "id": "0x7fad90f7ed00" + } + }, + "message": "error converting file name to utf-8 from x-user-defined: Conversion from character set 'x-user-defined' to 'UTF8' is not supported", + "network": { + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "sophos": { + "utm": { + "function": "fileextension_scan", + "line": "154", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-03-08T15:00:50.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "web" + ], + "id": "0003", + "kind": "event", + "original": "2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id=\"0003\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" request=\"0x7fadb4088d00\" function=\"ssl_raw_read\" file=\"ssl.c\" line=\"1012\" message=\"SSL_ERROR_SYSCALL: ret=-1 error=Broken pipe\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "file": { + "name": "ssl.c" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "id": "0x7fadb4088d00" + } + }, + "message": "SSL_ERROR_SYSCALL: ret=-1 error=Broken pipe", + "network": { + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ] + }, + "sophos": { + "utm": { + "function": "ssl_raw_read", + "line": "1012", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-03-08T15:00:39.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block-category", + "category": [ + "web" + ], + "id": "0060", + "kind": "event", + "original": "2023:03:08-15:00:39 sophos-test-vm1 httpproxy[6267]: id=\"0060\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"web request blocked, forbidden category detected\" action=\"block\" method=\"GET\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"403\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"4764\" request=\"0x7fad933c8b00\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"249\" aptptime=\"0\" cattime=\"206\" avscantime=\"0\" fullreqtime=\"1499\" device=\"0\" auth=\"0\" ua=\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" exceptions=\"\" country=\"Germany\" category=\"141\" reputation=\"trusted\" categoryname=\"Portal Sites\" application=\"yahoo\" app-id=\"553\" reason=\"category\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 4764, + "id": "0x7fad933c8b00", + "method": "GET", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 403 + } + }, + "network": { + "application": "yahoo", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "action": "block", + "ad_domain": "example.com", + "app_id": "553", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "141" + ], + "categoryname": [ + "Portal Sites" + ], + "cattime": 206, + "country": "Germany", + "dnstime": 249, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 1499, + "name": "web request blocked, forbidden category detected", + "profile": "HTTP_Sophos_Profile_1", + "reason": "category", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "os": { + "full": "Windows 10", + "name": "Windows", + "version": "10" + }, + "version": "110.0.0.0" + } + }, + { + "@timestamp": "2023-03-08T15:00:50.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "pass", + "category": [ + "web" + ], + "id": "0001", + "kind": "event", + "original": "2023:03:08-15:00:50 sophos-test-vm1 httpproxy[6267]: id=\"0001\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"http access\" action=\"pass\" method=\"POST\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"200\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"92\" request=\"0x7fad8b180000\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"0\" aptptime=\"0\" cattime=\"137\" avscantime=\"3221\" fullreqtime=\"407968\" device=\"0\" auth=\"0\" ua=\"CloudKitWin/57.0.0.0 (Windows/10.0.0.0)\" exceptions=\"\" category=\"170\" reputation=\"trusted\" categoryname=\"Personal Network Storage\" application=\"icloud\" app-id=\"666\" content-type=\"application/x-protobuf\" sandbox=\"-\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 92, + "id": "0x7fad8b180000", + "method": "POST", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 200 + } + }, + "network": { + "application": "icloud", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "ad_domain": "example.com", + "app_id": "666", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 3221, + "cached": "0", + "category": [ + "170" + ], + "categoryname": [ + "Personal Network Storage" + ], + "cattime": 137, + "content_type": "application/x-protobuf", + "dnstime": 0, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 407968, + "name": "http access", + "profile": "HTTP_Sophos_Profile_1", + "reputation": "trusted", + "sandbox": "-", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "CloudKitWin/57.0.0.0 (Windows/10.0.0.0)", + "os": { + "name": "Windows" + } + } + }, + { + "@timestamp": "2023-03-08T15:05:47.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "pass", + "category": [ + "web" + ], + "id": "0001", + "kind": "event", + "original": "2023:03:08-15:05:47 sophos-test-vm1 httpproxy[6267]: id=\"0001\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"http access\" action=\"pass\" method=\"CONNECT\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"200\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"23229\" request=\"0x7fad93120200\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"257\" aptptime=\"0\" cattime=\"170\" avscantime=\"0\" fullreqtime=\"8408149\" device=\"0\" auth=\"0\" ua=\"\" exceptions=\"ssl,certcheck,certdate\" category=\"105\" reputation=\"trusted\" categoryname=\"Business\" country=\"Germany\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 23229, + "id": "0x7fad93120200", + "method": "CONNECT", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 200 + } + }, + "network": { + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "ad_domain": "example.com", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "105" + ], + "categoryname": [ + "Business" + ], + "cattime": 170, + "country": "Germany", + "dnstime": 257, + "exceptions": [ + "ssl", + "certcheck", + "certdate" + ], + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 8408149, + "name": "http access", + "profile": "HTTP_Sophos_Profile_1", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other" + } + }, + { + "@timestamp": "2023-03-08T15:08:20.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "warn-category", + "category": [ + "web" + ], + "id": "0071", + "kind": "event", + "original": "2023:03:08-15:08:20 sophos-test-vm1 httpproxy[6267]: id=\"0071\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"web request warned, forbidden category detected\" action=\"warn\" method=\"OPTIONS\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"403\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"3783\" request=\"0x7fad9be42000\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"211\" aptptime=\"0\" cattime=\"149\" avscantime=\"0\" fullreqtime=\"1265\" device=\"0\" auth=\"0\" ua=\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" exceptions=\"\" country=\"Germany\" reason=\"category\" category=\"9998\" reputation=\"unverified\" categoryname=\"Uncategorized\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 3783, + "id": "0x7fad9be42000", + "method": "OPTIONS", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 403 + } + }, + "network": { + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "action": "warn", + "ad_domain": "example.com", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "9998" + ], + "categoryname": [ + "Uncategorized" + ], + "cattime": 149, + "country": "Germany", + "dnstime": 211, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 1265, + "name": "web request warned, forbidden category detected", + "profile": "HTTP_Sophos_Profile_1", + "reason": "category", + "reputation": "unverified", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "os": { + "full": "Windows 10", + "name": "Windows", + "version": "10" + }, + "version": "110.0.0.0" + } + }, + { + "@timestamp": "2023-03-08T15:19:36.000Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "web" + ], + "id": "0072", + "kind": "event", + "original": "2023:03:08-15:19:36 sophos-test-vm1 httpproxy[6267]: id=\"0072\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"Contentfilter warned and proceeded\" url=\"https://myurl.test.com/extension\" srcip=\"67.43.156.2\" category=\"9998\" categoryname=\"Uncategorized\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2" + ] + }, + "sophos": { + "utm": { + "category": [ + "9998" + ], + "categoryname": [ + "Uncategorized" + ], + "name": "Contentfilter warned and proceeded", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + } + }, + { + "@timestamp": "2023-03-08T15:20:40.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "block-extension", + "category": [ + "web" + ], + "id": "0064", + "kind": "event", + "original": "2023:03:08-15:20:40 sophos-test-vm1 httpproxy[6267]: id=\"0064\" severity=\"info\" sys=\"SecureWeb\" sub=\"http\" name=\"web request blocked, forbidden file extension detected\" action=\"block\" method=\"GET\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" user=\"testuser\" group=\"testgroup\" ad_domain=\"example.com\" statuscode=\"403\" cached=\"0\" profile=\"HTTP_Sophos_Profile_1\" filteraction=\"REF_HTTP_ACTION\" size=\"2814\" request=\"0x7fad92a81700\" url=\"https://myurl.test.com/extension\" referer=\"https://referer.test.com/\" error=\"\" authtime=\"0\" dnstime=\"0\" aptptime=\"0\" cattime=\"0\" avscantime=\"0\" fullreqtime=\"638695\" device=\"0\" auth=\"0\" ua=\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" exceptions=\"\" overridecategory=\"1\" overridereputation=\"1\" category=\"105,105,105,105,105\" reputation=\"neutral\" categoryname=\"Business,Business,Business,Business,Business\" application=\"google\" app-id=\"182\" reason=\"extension\" extension=\"com\" filename=\"file1.zw-net.com\"", + "provider": "http", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "file": { + "name": "file1.zw-net.com" + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 2814, + "id": "0x7fad92a81700", + "method": "GET", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 403 + } + }, + "network": { + "application": "google", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "action": "block", + "ad_domain": "example.com", + "app_id": "182", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "105", + "105", + "105", + "105", + "105" + ], + "categoryname": [ + "Business", + "Business", + "Business", + "Business", + "Business" + ], + "cattime": 0, + "dnstime": 0, + "extension": "com", + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 638695, + "name": "web request blocked, forbidden file extension detected", + "overridecategory": "1", + "overridereputation": "1", + "profile": "HTTP_Sophos_Profile_1", + "reason": "extension", + "reputation": "neutral", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Chrome", + "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "os": { + "full": "Windows 10", + "name": "Windows", + "version": "10" + }, + "version": "110.0.0.0" + } + } + ] +} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log new file mode 100644 index 00000000000..b3573b4317e --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log @@ -0,0 +1,3 @@ +2023:04:28-00:50:54 sophos-test-vm1 ulogd[12511]: id="2021" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped (GEOIP)" action="drop" fwrule="60019" initf="eth6" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="6" length="88" tos="0x00" prec="0x00" ttl="227" srcport="443" dstport="42181" tcpflags="ACK PSH" +2023:04:28-11:08:04 sophos-test-vm1 ulogd[12511]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="eth6" mark="0x21bd" app="445" srcmac="1a:fc:2b:33:4d:5f" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="17" length="438" tos="0x00" prec="0x00" ttl="56" srcport="5319" dstport="5060" +2023:04:28-11:28:41 sophos-test-vm1 ulogd[12511]: id="2014" severity="info" sys="SecureNet" sub="packetfilter" name="DNS request" action="DNS request" fwrule="60011" initf="eth7" srcmac="00:50:56:b6:27:aa" dstmac="00:11:22:33:44:55" srcip="67.43.156.2" dstip="89.160.20.129" proto="17" length="75" tos="0x00" prec="0x00" ttl="64" srcport="34200" dstport="53" \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log-expected.json b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log-expected.json new file mode 100644 index 00000000000..58138244e43 --- /dev/null +++ b/packages/sophos/data_stream/utm/_dev/test/pipeline/test-sophos-utm-packetfilter.log-expected.json @@ -0,0 +1,336 @@ +{ + "expected": [ + { + "@timestamp": "2023-04-28T00:50:54.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "mac": "00-11-22-33-44-55", + "port": 42181 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "drop", + "category": [ + "network" + ], + "id": "2021", + "kind": "event", + "original": "2023:04:28-00:50:54 sophos-test-vm1 ulogd[12511]: id=\"2021\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet dropped (GEOIP)\" action=\"drop\" fwrule=\"60019\" initf=\"eth6\" srcmac=\"1a:fc:2b:33:4d:5f\" dstmac=\"00:11:22:33:44:55\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" proto=\"6\" length=\"88\" tos=\"0x00\" prec=\"0x00\" ttl=\"227\" srcport=\"443\" dstport=\"42181\" tcpflags=\"ACK PSH\"", + "provider": "packetfilter", + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "denied" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "iana_number": "6" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth6" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "ulogd", + "pid": 12511 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ] + }, + "rule": { + "id": "60019" + }, + "sophos": { + "utm": { + "length": 88, + "name": "Packet dropped (GEOIP)", + "prec": "0x00", + "severity": "info", + "sub": "packetfilter", + "sys": "SecureNet", + "tcpflags": [ + "ack", + "psh" + ], + "tos": "0x00", + "ttl": 227 + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "mac": "1A-FC-2B-33-4D-5F", + "port": 443 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T11:08:04.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "mac": "00-11-22-33-44-55", + "port": 5060 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "drop", + "category": [ + "network" + ], + "id": "2001", + "kind": "event", + "original": "2023:04:28-11:08:04 sophos-test-vm1 ulogd[12511]: id=\"2001\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"Packet dropped\" action=\"drop\" fwrule=\"60001\" initf=\"eth6\" mark=\"0x21bd\" app=\"445\" srcmac=\"1a:fc:2b:33:4d:5f\" dstmac=\"00:11:22:33:44:55\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" proto=\"17\" length=\"438\" tos=\"0x00\" prec=\"0x00\" ttl=\"56\" srcport=\"5319\" dstport=\"5060\"", + "provider": "packetfilter", + "severity": 6, + "timezone": "UTC", + "type": [ + "info", + "denied" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "iana_number": "17" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth6" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "ulogd", + "pid": 12511 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ] + }, + "rule": { + "id": "60001" + }, + "sophos": { + "utm": { + "app_id": "445", + "length": 438, + "mark": "0x21bd", + "name": "Packet dropped", + "prec": "0x00", + "severity": "info", + "sub": "packetfilter", + "sys": "SecureNet", + "tos": "0x00", + "ttl": 56 + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "mac": "1A-FC-2B-33-4D-5F", + "port": 5319 + }, + "tags": [ + "preserve_original_event" + ] + }, + { + "@timestamp": "2023-04-28T11:28:41.000Z", + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129", + "mac": "00-11-22-33-44-55", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "DNS request", + "category": [ + "network" + ], + "id": "2014", + "kind": "event", + "original": "2023:04:28-11:28:41 sophos-test-vm1 ulogd[12511]: id=\"2014\" severity=\"info\" sys=\"SecureNet\" sub=\"packetfilter\" name=\"DNS request\" action=\"DNS request\" fwrule=\"60011\" initf=\"eth7\" srcmac=\"00:50:56:b6:27:aa\" dstmac=\"00:11:22:33:44:55\" srcip=\"67.43.156.2\" dstip=\"89.160.20.129\" proto=\"17\" length=\"75\" tos=\"0x00\" prec=\"0x00\" ttl=\"64\" srcport=\"34200\" dstport=\"53\" ", + "provider": "packetfilter", + "severity": 6, + "timezone": "UTC", + "type": [ + "info" + ] + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "network": { + "iana_number": "17" + }, + "observer": { + "ingress": { + "interface": { + "name": "eth7" + } + }, + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "ulogd", + "pid": 12511 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ] + }, + "rule": { + "id": "60011" + }, + "sophos": { + "utm": { + "length": 75, + "name": "DNS request", + "prec": "0x00", + "severity": "info", + "sub": "packetfilter", + "sys": "SecureNet", + "tos": "0x00", + "ttl": 64 + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2", + "mac": "00-50-56-B6-27-AA", + "port": 34200 + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/_dev/test/system/test-logfile-config.yml b/packages/sophos/data_stream/utm/_dev/test/system/test-logfile-config.yml index 6613cd02589..54f5091b56c 100644 --- a/packages/sophos/data_stream/utm/_dev/test/system/test-logfile-config.yml +++ b/packages/sophos/data_stream/utm/_dev/test/system/test-logfile-config.yml @@ -3,4 +3,4 @@ input: logfile data_stream: vars: paths: - - "{{SERVICE_LOGS_DIR}}/sophos-utm-*.log" + - "{{SERVICE_LOGS_DIR}}/sophos-utm*.log" diff --git a/packages/sophos/data_stream/utm/agent/stream/stream.yml.hbs b/packages/sophos/data_stream/utm/agent/stream/stream.yml.hbs index 8cce59a86fd..efbf06b1e6e 100644 --- a/packages/sophos/data_stream/utm/agent/stream/stream.yml.hbs +++ b/packages/sophos/data_stream/utm/agent/stream/stream.yml.hbs @@ -1,5072 +1,24 @@ paths: {{#each paths as |path i|}} - - {{path}} +- {{path}} {{/each}} exclude_files: [".gz$"] tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#each tags as |tag i|}} - - {{tag}} +- {{tag}} {{/each}} fields_under_root: true fields: - observer: - vendor: "Sophos" - product: "UTM" - type: "Firewall" +_conf: +tz_offset: '{{tz_offset}}' {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} processors: +- add_locale: ~ {{#if processors}} {{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{hfld1->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0002"), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ - setc("header_id","0003"), - setc("messageid","reverseproxy"), - ])); - - var hdr4 = match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","0005"), - ])); - - var hdr5 = match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0004"), - setc("messageid","astarosg_TVM"), - ])); - - var hdr6 = match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ - setc("header_id","0006"), - setc("messageid","Sophos_Firewall"), - ])); - - var select1 = linear_select([ - hdr1, - hdr2, - hdr3, - hdr4, - hdr5, - hdr6, - ]); - - var part1 = match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg1 = msg("named:01", part1); - - var part2 = match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg2 = msg("named:02", part2); - - var part3 = match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ - dup4, - dup2, - dup3, - ])); - - var msg3 = msg("named:03", part3); - - var part4 = match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ - dup5, - dup2, - dup3, - ])); - - var msg4 = msg("named:04", part4); - - var part5 = match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ - dup6, - dup2, - dup3, - ])); - - var msg5 = msg("named:05", part5); - - var part6 = match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ - setc("eventcategory","1804000000"), - dup2, - dup3, - ])); - - var msg6 = msg("named:06", part6); - - var part7 = match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ - dup7, - dup2, - dup3, - ])); - - var msg7 = msg("named:07", part7); - - var part8 = match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg8 = msg("named:08", part8); - - var part9 = match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ - dup7, - dup2, - dup3, - setc("action","reloading"), - ])); - - var msg9 = msg("named:09", part9); - - var part10 = match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - ])); - - var msg10 = msg("named:10", part10); - - var part11 = match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - setc("action","all zones loaded"), - ])); - - var msg11 = msg("named:11", part11); - - var part12 = match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ - dup7, - setc("disposition","running"), - dup2, - dup3, - setc("action","running"), - ])); - - var msg12 = msg("named:12", part12); - - var part13 = match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ - dup7, - setc("context","built-in root key"), - dup2, - dup3, - ])); - - var msg13 = msg("named:13", part13); - - var part14 = match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg14 = msg("named:14", part14); - - var part15 = match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ - dup10, - setc("event_description","named:too many timeouts resolving DNS."), - dup11, - dup2, - ])); - - var msg15 = msg("named:15", part15); - - var part16 = match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:FORMERR resolving DNS."), - dup11, - dup2, - ])); - - var msg16 = msg("named:16", part16); - - var part17 = match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:unexpected RCODE (SERVFAIL) resolving DNS."), - dup11, - dup2, - ])); - - var msg17 = msg("named:17", part17); - - var select2 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - ]); - - var part18 = match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ - dup12, - setc("event_description","httpproxy:Integrated HTTP-Proxy."), - dup11, - dup2, - ])); - - var msg18 = msg("httpproxy:09", part18); - - var part19 = match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ - dup10, - setc("event_description","httpproxy:Name or service not known."), - dup11, - dup2, - ])); - - var msg19 = msg("httpproxy:10", part19); - - var part20 = match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ - dup10, - setc("event_description","httpproxy:failed to resolve passthrough."), - dup11, - dup2, - ])); - - var msg20 = msg("httpproxy:11", part20); - - var part21 = match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ - dup10, - setc("event_description","httpproxy:ssl handshake failure."), - dup11, - dup2, - ])); - - var msg21 = msg("httpproxy:12", part21); - - var part22 = match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ - dup10, - setc("event_description","httpproxy:EVP_DecryptFinal failed."), - dup11, - dup2, - ])); - - var msg22 = msg("httpproxy:13", part22); - - var part23 = match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ - dup10, - setc("event_description","httpproxy:decrypt failed."), - dup11, - dup2, - ])); - - var msg23 = msg("httpproxy:14", part23); - - var part24 = match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:reloading av pattern"), - dup11, - dup2, - ])); - - var msg24 = msg("httpproxy:15", part24); - - var part25 = match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ - dup12, - setc("event_description","httpproxy:sc_check_servers.Server checked."), - dup11, - dup2, - ])); - - var msg25 = msg("httpproxy:16", part25); - - var part26 = match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ - dup12, - setc("event_description","httpproxy:shutdown finished, exiting."), - dup11, - dup2, - ])); - - var msg26 = msg("httpproxy:17", part26); - - var part27 = match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ - dup12, - setc("event_description","httpproxy:"), - dup11, - dup2, - ])); - - var msg27 = msg("httpproxy:18", part27); - - var part28 = match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ - dup12, - setc("event_description","httpproxy:reading profiles"), - dup11, - dup2, - ])); - - var msg28 = msg("httpproxy:19", part28); - - var part29 = match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ - dup12, - setc("event_description","httpproxy:finished startup"), - dup11, - dup2, - ])); - - var msg29 = msg("httpproxy:20", part29); - - var part30 = match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:read_request_headers related message."), - dup11, - dup2, - ])); - - var msg30 = msg("httpproxy:21", part30); - - var part31 = match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_loop related message."), - dup11, - dup2, - ])); - - var msg31 = msg("httpproxy:22", part31); - - var part32 = match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scan_exit related message."), - dup11, - dup2, - ])); - - var msg32 = msg("httpproxy:23", part32); - - var part33 = match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_exit related message."), - dup11, - dup2, - ])); - - var msg33 = msg("httpproxy:24", part33); - - var part34 = match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_exit related message."), - dup11, - dup2, - ])); - - var msg34 = msg("httpproxy:25", part34); - - var part35 = match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_zap related message."), - dup11, - dup2, - ])); - - var msg35 = msg("httpproxy:26", part35); - - var part36 = match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scanner_init related message."), - dup11, - dup2, - ])); - - var msg36 = msg("httpproxy:27", part36); - - var part37 = tagval("MESSAGE#36:httpproxy:01", "nwparser.payload", tvm, { - "action": "action", - "ad_domain": "fld1", - "app-id": "fld18", - "application": "fld17", - "auth": "fld10", - "authtime": "fld4", - "avscantime": "fld7", - "cached": "fld2", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld6", - "content-type": "content_type", - "device": "fld9", - "dnstime": "fld5", - "dstip": "daddr", - "error": "result", - "exceptions": "fld12", - "extension": "fld13", - "file": "filename", - "filename": "filename", - "filteraction": "fld3", - "fullreqtime": "fld8", - "function": "action", - "group": "group", - "id": "rule", - "line": "fld14", - "message": "context", - "method": "web_method", - "name": "event_description", - "profile": "policyname", - "reason": "rule_group", - "referer": "web_referer", - "reputation": "fld16", - "request": "connectionid", - "severity": "severity", - "size": "rbytes", - "srcip": "saddr", - "statuscode": "resultcode", - "sub": "network_service", - "sys": "vsys", - "time": "fld15", - "ua": "fld11", - "url": "url", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg37 = msg("httpproxy:01", part37); - - var select3 = linear_select([ - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - ]); - - var part38 = match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ - dup16, - dup2, - dup3, - ])); - - var msg38 = msg("URID:01", part38); - - var part39 = tagval("MESSAGE#38:ulogd:01", "nwparser.payload", tvm, { - "action": "action", - "code": "fld30", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "fwrule": "policy_id", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "name": "event_description", - "outitf": "dinterface", - "prec": "fld27", - "proto": "fld24", - "seq": "fld23", - "severity": "severity", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "sub": "network_service", - "sys": "vsys", - "tcpflags": "fld29", - "tos": "fld26", - "ttl": "fld28", - "type": "fld31", - }, processor_chain([ - dup13, - setc("ec_subject","NetworkComm"), - setc("ec_activity","Scan"), - setc("ec_theme","TEV"), - dup11, - dup2, - dup45, - dup46, - ])); - - var msg39 = msg("ulogd:01", part39); - - var part40 = match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ - dup6, - setc("disposition","configured"), - dup2, - dup3, - ])); - - var msg40 = msg("reverseproxy:01", part40); - - var part41 = match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg41 = msg("reverseproxy:02", part41); - - var part42 = match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg42 = msg("reverseproxy:03", part42); - - var part43 = match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ - dup17, - setc("event_id","AH00292"), - dup2, - dup3, - ])); - - var msg43 = msg("reverseproxy:04", part43); - - var part44 = match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ - setc("eventcategory","1805010000"), - dup18, - dup2, - dup3, - ])); - - var msg44 = msg("reverseproxy:06", part44); - - var part45 = match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); - - var select4 = linear_select([ - dup19, - ]); - - var part46 = match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); - - var all1 = all_match({ - processors: [ - part45, - select4, - part46, - ], - on_success: processor_chain([ - dup5, - setc("event_id","AH00297"), - dup2, - dup3, - ]), - }); - - var msg45 = msg("reverseproxy:07", all1); - - var part47 = match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ - dup4, - setc("event_id","AH00112"), - dup2, - dup3, - ])); - - var msg46 = msg("reverseproxy:08", part47); - - var part48 = match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ - setc("eventcategory","1605010000"), - setc("event_id","AH00094"), - dup2, - dup3, - ])); - - var msg47 = msg("reverseproxy:09", part48); - - var part49 = match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ - dup12, - setc("event_id","AH00291"), - dup2, - dup3, - ])); - - var msg48 = msg("reverseproxy:10", part49); - - var part50 = match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ - dup20, - setc("event_id","AH02572"), - dup2, - dup3, - ])); - - var msg49 = msg("reverseproxy:11", part50); - - var part51 = match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ - dup20, - setc("context","SSL Library Error"), - dup2, - dup3, - ])); - - var msg50 = msg("reverseproxy:12", part51); - - var part52 = match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ - dup20, - setc("result","Fatal error"), - setc("event_id","AH02312"), - dup2, - dup3, - ])); - - var msg51 = msg("reverseproxy:13", part52); - - var part53 = match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ - dup20, - setc("result","Configuration Failed"), - setc("event_id","AH00020"), - dup2, - dup3, - ])); - - var msg52 = msg("reverseproxy:14", part53); - - var part54 = match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ - setc("eventcategory","1609000000"), - setc("context","Unclean shutdown"), - setc("event_id","AH00098"), - dup2, - dup3, - ])); - - var msg53 = msg("reverseproxy:15", part54); - - var part55 = match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ - dup16, - setc("event_id","AH00295"), - dup2, - dup3, - ])); - - var msg54 = msg("reverseproxy:16", part55); - - var part56 = match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); - - var part57 = match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); - - var select5 = linear_select([ - part57, - dup19, - ]); - - var part58 = match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all2 = all_match({ - processors: [ - part56, - select5, - part58, - ], - on_success: processor_chain([ - dup21, - dup2, - dup3, - ]), - }); - - var msg55 = msg("reverseproxy:17", all2); - - var part59 = match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ - dup4, - dup22, - dup2, - dup3, - ])); - - var msg56 = msg("reverseproxy:18", part59); - - var part60 = match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ - dup23, - dup22, - dup2, - dup3, - ])); - - var msg57 = msg("reverseproxy:19", part60); - - var part61 = match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg58 = msg("reverseproxy:20", part61); - - var part62 = match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ - dup20, - dup18, - setc("event_id","AH01909"), - dup2, - dup3, - ])); - - var msg59 = msg("reverseproxy:21", part62); - - var part63 = match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ - dup20, - setc("comments","Invalid port configuration"), - dup2, - dup3, - ])); - - var msg60 = msg("reverseproxy:22", part63); - - var part64 = match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg61 = msg("reverseproxy:23", part64); - - var part65 = match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg62 = msg("reverseproxy:24", part65); - - var part66 = match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg63 = msg("reverseproxy:25", part66); - - var part67 = match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); - - var part68 = match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); - - var select6 = linear_select([ - part68, - dup19, - ]); - - var part69 = match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); - - var part70 = match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); - - var part71 = match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); - - var select7 = linear_select([ - part70, - part71, - ]); - - var part72 = match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all3 = all_match({ - processors: [ - part67, - select6, - part69, - select7, - part72, - ], - on_success: processor_chain([ - dup24, - dup2, - dup3, - ]), - }); - - var msg64 = msg("reverseproxy:26", all3); - - var part73 = match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg65 = msg("reverseproxy:27", part73); - - var part74 = match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ - dup26, - setc("result","virus daemon error"), - dup2, - dup3, - ])); - - var msg66 = msg("reverseproxy:28", part74); - - var part75 = match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ - dup27, - setc("result","virus found"), - dup2, - dup3, - ])); - - var msg67 = msg("reverseproxy:29", part75); - - var part76 = match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg68 = msg("reverseproxy:30", part76); - - var part77 = match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ - dup25, - setc("result","Cannot read reply"), - dup2, - dup3, - ])); - - var msg69 = msg("reverseproxy:31", part77); - - var part78 = match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg70 = msg("reverseproxy:32", part78); - - var part79 = match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg71 = msg("reverseproxy:33", part79); - - var part80 = match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg72 = msg("reverseproxy:34", part80); - - var part81 = match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg73 = msg("reverseproxy:35", part81); - - var part82 = match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ - dup27, - setc("result","Virus found"), - dup2, - dup3, - ])); - - var msg74 = msg("reverseproxy:36", part82); - - var part83 = match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg75 = msg("reverseproxy:37", part83); - - var part84 = match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg76 = msg("reverseproxy:38", part84); - - var part85 = match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ - dup23, - setc("result","Form validation failed"), - dup2, - dup3, - ])); - - var msg77 = msg("reverseproxy:39", part85); - - var part86 = match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ - dup25, - setc("result","Sending trickle failed"), - dup2, - dup3, - ])); - - var msg78 = msg("reverseproxy:40", part86); - - var part87 = match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ - dup30, - dup2, - dup3, - ])); - - var msg79 = msg("reverseproxy:41", part87); - - var part88 = match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ - setc("eventcategory","1603050000"), - dup2, - dup3, - ])); - - var msg80 = msg("reverseproxy:42", part88); - - var part89 = match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ - dup30, - setc("event_id","AH01110"), - setc("result","Error reading response"), - dup2, - dup3, - ])); - - var msg81 = msg("reverseproxy:43", part89); - - var part90 = match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1601020000"), - setc("result","No form context found"), - dup2, - dup3, - ])); - - var msg82 = msg("reverseproxy:44", part90); - - var part91 = match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ - dup25, - setc("event_id","AH00957"), - dup2, - dup3, - ])); - - var msg83 = msg("reverseproxy:45", part91); - - var part92 = match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ - dup16, - setc("event_id","AH00959"), - setc("result","disabling worker"), - dup2, - dup3, - ])); - - var msg84 = msg("reverseproxy:46", part92); - - var part93 = match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1801000000"), - setc("context","Not all file sent to client"), - dup2, - dup3, - ])); - - var msg85 = msg("reverseproxy:47", part93); - - var part94 = match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg86 = msg("reverseproxy:48", part94); - - var part95 = match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg87 = msg("reverseproxy:49", part95); - - var part96 = tagval("MESSAGE#87:reverseproxy:05", "nwparser.payload", tvm, { - "cookie": "web_cookie", - "exceptions": "policy_waiver", - "extra": "info", - "host": "dhost", - "id": "policy_id", - "localip": "fld3", - "method": "web_method", - "reason": "comments", - "referer": "web_referer", - "server": "daddr", - "set-cookie": "fld5", - "size": "fld4", - "srcip": "saddr", - "statuscode": "resultcode", - "time": "processing_time", - "url": "web_root", - "user": "username", - }, processor_chain([ - setc("eventcategory","1802000000"), - dup2, - dup3, - ])); - - var msg88 = msg("reverseproxy:05", part96); - - var select8 = linear_select([ - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - msg59, - msg60, - msg61, - msg62, - msg63, - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - ]); - - var part97 = tagval("MESSAGE#88:confd-sync", "nwparser.payload", tvm, { - "id": "fld5", - "name": "event_description", - "severity": "severity", - "sub": "service", - "sys": "fld2", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg89 = msg("confd-sync", part97); - - var part98 = tagval("MESSAGE#89:confd:01", "nwparser.payload", tvm, { - "account": "logon_id", - "attributes": "obj_name", - "class": "group_object", - "client": "fld3", - "count": "fld4", - "facility": "logon_type", - "id": "fld1", - "name": "event_description", - "node": "node", - "object": "fld6", - "severity": "severity", - "srcip": "saddr", - "storage": "directory", - "sub": "service", - "sys": "fld2", - "type": "obj_type", - "user": "username", - "version": "version", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg90 = msg("confd:01", part98); - - var part99 = match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy Frox started."), - dup11, - dup2, - ])); - - var msg91 = msg("frox", part99); - - var part100 = match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy listening on port."), - dup11, - dup2, - ])); - - var msg92 = msg("frox:01", part100); - - var part101 = match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy dropped priveleges."), - dup11, - dup2, - ])); - - var msg93 = msg("frox:02", part101); - - var select9 = linear_select([ - msg91, - msg92, - msg93, - ]); - - var part102 = match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ - dup12, - setc("event_description","afcd: IM/P2P Classifier configuration reloaded successfully."), - dup11, - dup2, - ])); - - var msg94 = msg("afcd", part102); - - var part103 = match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ - dup12, - setc("event_description","ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]..."), - dup11, - dup2, - ])); - - var msg95 = msg("ipsec_starter", part103); - - var part104 = match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ - dup12, - setc("event_description","ipsec_starter: IP address or index of physical interface changed."), - dup11, - dup2, - ])); - - var msg96 = msg("ipsec_starter:01", part104); - - var select10 = linear_select([ - msg95, - msg96, - ]); - - var part105 = match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: Starting Pluto."), - dup11, - dup2, - ])); - - var msg97 = msg("pluto", part105); - - var part106 = match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: including NAT-Traversal patch."), - dup11, - dup2, - ])); - - var msg98 = msg("pluto:01", part106); - - var part107 = match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating encryption algorithm."), - dup11, - dup2, - ])); - - var msg99 = msg("pluto:02", part107); - - var part108 = match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating hash algorithm."), - dup11, - dup2, - ])); - - var msg100 = msg("pluto:03", part108); - - var part109 = match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ - dup12, - setc("event_description","pluto: Testing registered IKE encryption algorithms"), - dup11, - dup2, - ])); - - var msg101 = msg("pluto:04", part109); - - var part110 = match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test not available."), - dup11, - dup2, - ])); - - var msg102 = msg("pluto:05", part110); - - var part111 = match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test passed."), - dup11, - dup2, - ])); - - var msg103 = msg("pluto:06", part111); - - var part112 = match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ - dup12, - setc("event_description","pluto: Using KLIPS IPsec interface code"), - dup11, - dup2, - ])); - - var msg104 = msg("pluto:07", part112); - - var part113 = match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","pluto: adding interface"), - dup11, - dup2, - ])); - - var msg105 = msg("pluto:08", part113); - - var part114 = match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ - dup34, - setc("event_description","pluto: loading secrets"), - dup11, - dup2, - ])); - - var msg106 = msg("pluto:09", part114); - - var part115 = match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ - dup34, - setc("event_description","pluto: loaded private key file"), - dup11, - dup2, - ])); - - var msg107 = msg("pluto:10", part115); - - var part116 = match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ - dup12, - setc("event_description","pluto: added connection description"), - dup11, - dup2, - ])); - - var msg108 = msg("pluto:11", part116); - - var part117 = match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg109 = msg("pluto:12", part117); - - var part118 = match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup10, - dup36, - dup11, - dup2, - ])); - - var msg110 = msg("pluto:13", part118); - - var part119 = match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg111 = msg("pluto:14", part119); - - var part120 = match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ - dup12, - setc("event_description","pluto:forgetting secrets"), - dup11, - dup2, - ])); - - var msg112 = msg("pluto:15", part120); - - var part121 = match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ - dup12, - setc("event_description","pluto:Changing to directory"), - dup11, - dup2, - ])); - - var msg113 = msg("pluto:17", part121); - - var part122 = match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ - dup12, - setc("event_description","pluto:*time to handle event"), - dup11, - dup2, - ])); - - var msg114 = msg("pluto:18", part122); - - var part123 = match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ - dup12, - setc("event_description","pluto:*received kernel message"), - dup11, - dup2, - ])); - - var msg115 = msg("pluto:19", part123); - - var part124 = match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ - dup25, - setc("event_description","pluto:rejected packet"), - dup11, - dup2, - ])); - - var msg116 = msg("pluto:20", part124); - - var part125 = match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg117 = msg("pluto:21", part125); - - var part126 = match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg118 = msg("pluto:22", part126); - - var part127 = match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg119 = msg("pluto:23", part127); - - var part128 = match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg120 = msg("pluto:24", part128); - - var part129 = match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg121 = msg("pluto:25", part129); - - var part130 = match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg122 = msg("pluto:26", part130); - - var part131 = match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg123 = msg("pluto:27", part131); - - var part132 = match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg124 = msg("pluto:28", part132); - - var part133 = match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg125 = msg("pluto:29", part133); - - var part134 = match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg126 = msg("pluto:30", part134); - - var part135 = match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg127 = msg("pluto:31", part135); - - var part136 = match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ - dup12, - setc("event_description","not authenticated"), - dup11, - dup2, - ])); - - var msg128 = msg("pluto:32", part136); - - var part137 = match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg129 = msg("pluto:33", part137); - - var part138 = match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup12, - dup36, - dup11, - dup2, - ])); - - var msg130 = msg("pluto:34", part138); - - var part139 = match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg131 = msg("pluto:35", part139); - - var select11 = linear_select([ - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - ]); - - var part140 = match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ - setc("eventcategory","1607000000"), - setc("event_description","xl2tpd:This binary does not support kernel L2TP."), - dup11, - dup2, - ])); - - var msg132 = msg("xl2tpd", part140); - - var part141 = match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ - dup12, - setc("event_description","xl2tpd:xl2tpd started."), - dup11, - dup2, - ])); - - var msg133 = msg("xl2tpd:01", part141); - - var part142 = match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg134 = msg("xl2tpd:02", part142); - - var part143 = match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg135 = msg("xl2tpd:03", part143); - - var part144 = match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg136 = msg("xl2tpd:04", part144); - - var part145 = match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg137 = msg("xl2tpd:05", part145); - - var select12 = linear_select([ - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - ]); - - var part146 = match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ - dup12, - setc("event_description","barnyard: Exiting"), - dup11, - dup2, - ])); - - var msg138 = msg("barnyard:01", part146); - - var part147 = match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Initializing daemon mode"), - dup11, - dup2, - ])); - - var msg139 = msg("barnyard:02", part147); - - var part148 = match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ - dup12, - setc("event_description","barnyard:Opened spool file."), - dup11, - dup2, - ])); - - var msg140 = msg("barnyard:03", part148); - - var part149 = match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Waiting for new data"), - dup11, - dup2, - ])); - - var msg141 = msg("barnyard:04", part149); - - var select13 = linear_select([ - msg138, - msg139, - msg140, - msg141, - ]); - - var part150 = match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ - dup12, - setc("event_description","exim:SMTP connection from localhost closed by QUIT"), - dup11, - dup2, - ])); - - var msg142 = msg("exim:01", part150); - - var part151 = match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ - setc("eventcategory","1207010000"), - setc("event_description","exim:e-mail accepted from relay."), - dup11, - dup2, - ])); - - var msg143 = msg("exim:02", part151); - - var part152 = match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ - setc("eventcategory","1207000000"), - setc("event_description","exim: e-mail sent."), - dup11, - dup2, - ])); - - var msg144 = msg("exim:03", part152); - - var part153 = match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ - dup39, - setc("event_description","exim: e-mail host lookup did not complete in DNS."), - dup11, - dup2, - ])); - - var msg145 = msg("exim:04", part153); - - var part154 = match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ - dup39, - setc("event_description","exim: e-mail routing defer:retry time not reached."), - dup11, - dup2, - ])); - - var msg146 = msg("exim:05", part154); - - var part155 = match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ - dup12, - setc("event_description","exim: exim daemon started."), - dup11, - dup2, - ])); - - var msg147 = msg("exim:06", part155); - - var part156 = match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ - dup12, - setc("event_description","exim: Start queue run."), - dup11, - dup2, - ])); - - var msg148 = msg("exim:07", part156); - - var part157 = match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ - dup12, - setc("event_description","exim: SIGHUP received: re-exec daemon."), - dup11, - dup2, - ])); - - var msg149 = msg("exim:08", part157); - - var part158 = match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim: SMTP connection from host."), - dup11, - dup2, - ])); - - var msg150 = msg("exim:09", part158); - - var part159 = match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:rejected EHLO from host."), - dup11, - dup2, - ])); - - var msg151 = msg("exim:10", part159); - - var part160 = match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:SMTP protocol synchronization error rejected connection from host."), - dup11, - dup2, - ])); - - var msg152 = msg("exim:11", part160); - - var part161 = match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:TLS error on connection from host."), - dup11, - dup2, - ])); - - var msg153 = msg("exim:12", part161); - - var part162 = match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg154 = msg("exim:13", part162); - - var part163 = match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg155 = msg("exim:14", part163); - - var part164 = match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg156 = msg("exim:15", part164); - - var part165 = match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg157 = msg("exim:16", part165); - - var select14 = linear_select([ - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - ]); - - var part166 = match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ - dup12, - setc("event_description","smtpd: Process moved to work queue."), - dup11, - dup2, - ])); - - var msg158 = msg("smtpd:01", part166); - - var part167 = match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ - setc("eventcategory","1207010100"), - dup11, - dup2, - ])); - - var msg159 = msg("smtpd:02", part167); - - var part168 = match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ - dup12, - setc("event_description","smtpd: SCANNER: Nothing to do,exiting."), - dup11, - dup2, - ])); - - var msg160 = msg("smtpd:03", part168); - - var part169 = match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status two set to disabled."), - dup11, - dup2, - ])); - - var msg161 = msg("smtpd:04", part169); - - var part170 = match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status one set to disabled."), - dup11, - dup2, - ])); - - var msg162 = msg("smtpd:07", part170); - - var part171 = match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:(Re-)loading configuration from Confd."), - dup11, - dup2, - ])); - - var msg163 = msg("smtpd:05", part171); - - var part172 = match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:Sending QR one."), - dup11, - dup2, - ])); - - var msg164 = msg("smtpd:06", part172); - - var select15 = linear_select([ - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - ]); - - var part173 = match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ - dup10, - setc("event_description","sshd: Did not receive identification string."), - dup11, - dup2, - ])); - - var msg165 = msg("sshd:01", part173); - - var part174 = match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ - dup12, - setc("event_description","sshd:Received SIGHUP restarting."), - dup11, - dup2, - ])); - - var msg166 = msg("sshd:02", part174); - - var part175 = match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ - dup12, - setc("event_description","sshd:Server listening; restarting."), - dup11, - dup2, - ])); - - var msg167 = msg("sshd:03", part175); - - var part176 = match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ - dup41, - setc("event_description","sshd:Invalid user admin."), - dup11, - dup2, - ])); - - var msg168 = msg("sshd:04", part176); - - var part177 = match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed none for invalid user admin."), - dup11, - dup2, - ])); - - var msg169 = msg("sshd:05", part177); - - var part178 = match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ - dup10, - setc("event_description","sshd:error:Could not get shadow information for NOUSER"), - dup11, - dup2, - ])); - - var msg170 = msg("sshd:06", part178); - - var part179 = match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed password for root."), - dup11, - dup2, - ])); - - var msg171 = msg("sshd:07", part179); - - var part180 = match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - setc("eventcategory","1302000000"), - setc("event_description","sshd:Accepted password for loginuser."), - dup11, - dup2, - ])); - - var msg172 = msg("sshd:08", part180); - - var part181 = match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ - dup10, - setc("event_description","sshd:subsystem request for sftp failed,subsystem not found."), - dup11, - dup2, - ])); - - var msg173 = msg("sshd:09", part181); - - var select16 = linear_select([ - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - ]); - - var part182 = tagval("MESSAGE#173:aua:01", "nwparser.payload", tvm, { - "caller": "fld4", - "engine": "fld5", - "id": "fld1", - "name": "event_description", - "severity": "severity", - "srcip": "saddr", - "sub": "service", - "sys": "fld2", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg174 = msg("aua:01", part182); - - var part183 = match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ - dup12, - setc("event_description","sockd: created new negotiatorchild."), - dup11, - dup2, - ])); - - var msg175 = msg("sockd:01", part183); - - var part184 = match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ - dup12, - setc("event_description","sockd:dante/server running."), - dup11, - dup2, - ])); - - var msg176 = msg("sockd:02", part184); - - var part185 = match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ - dup12, - setc("event_description","sockd:sockdexit():terminating on signal."), - dup11, - dup2, - ])); - - var msg177 = msg("sockd:03", part185); - - var select17 = linear_select([ - msg175, - msg176, - msg177, - ]); - - var part186 = match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ - dup12, - setc("event_description","pop3proxy:Master started."), - dup11, - dup2, - ])); - - var msg178 = msg("pop3proxy", part186); - - var part187 = tagval("MESSAGE#178:astarosg_TVM", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg179 = msg("astarosg_TVM", part187); - - var part188 = tagval("MESSAGE#179:httpd", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "port": "network_port", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "query": "web_query", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "uid": "uid", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg180 = msg("httpd", part188); - - var part189 = match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ - setc("eventcategory","1502000000"), - dup2, - dup3, - ])); - - var msg181 = msg("httpd:01", part189); - - var select18 = linear_select([ - msg180, - msg181, - ]); - - var part190 = tagval("MESSAGE#181:Sophos_Firewall", "nwparser.payload", tvm, { - "activityname": "fld9", - "appfilter_policy_id": "fld10", - "application": "application", - "application_category": "fld23", - "application_risk": "risk_num", - "application_technology": "fld11", - "appresolvedby": "fld22", - "category": "fld4", - "category_type": "fld5", - "connevent": "fld19", - "connid": "connectionid", - "contenttype": "content_type", - "dir_disp": "fld18", - "domain": "fqdn", - "dst_country_code": "location_dst", - "dst_ip": "daddr", - "dst_port": "dport", - "dstzone": "dst_zone", - "dstzonetype": "fld17", - "duration": "duration", - "exceptions": "fld8", - "fw_rule_id": "rule_uid", - "hb_health": "fld21", - "httpresponsecode": "fld7", - "iap": "id1", - "in_interface": "sinterface", - "ips_policy_id": "policy_id", - "log_component": "event_source", - "log_subtype": "category", - "log_type": "event_type", - "message": "info", - "out_interface": "dinterface", - "override_token": "fld6", - "policy_type": "fld23", - "priority": "severity", - "protocol": "protocol", - "reason": "result", - "recv_bytes": "rbytes", - "recv_pkts": "fld15", - "referer": "web_referer", - "sent_bytes": "sbytes", - "sent_pkts": "fld14", - "src_country_code": "location_src", - "src_ip": "saddr", - "src_mac": "smacaddr", - "src_port": "sport", - "srczone": "src_zone", - "srczonetype": "fld16", - "status": "event_state", - "status_code": "resultcode", - "tran_dst_ip": "dtransaddr", - "tran_dst_port": "dtransport", - "tran_src_ip": "stransaddr", - "tran_src_port": "stransport", - "transactionid": "id2", - "url": "url", - "user_agent": "user_agent", - "user_gp": "group", - "user_name": "username", - "vconnid": "fld20", - }, processor_chain([ - setc("eventcategory","1204000000"), - dup2, - date_time({ - dest: "event_time", - args: ["hdate","htime"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dS], - ], - }), - ])); - - var msg182 = msg("Sophos_Firewall", part190); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "Sophos_Firewall": msg182, - "URID": msg38, - "afcd": msg94, - "astarosg_TVM": msg179, - "aua": msg174, - "barnyard": select13, - "confd": msg90, - "confd-sync": msg89, - "exim": select14, - "frox": select9, - "httpd": select18, - "httpproxy": select3, - "ipsec_starter": select10, - "named": select2, - "pluto": select11, - "pop3proxy": msg178, - "reverseproxy": select8, - "smtpd": select15, - "sockd": select17, - "sshd": select16, - "ulogd": msg39, - "xl2tpd": select12, - }), - ]); - - var part191 = match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ +{{/if}} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/agent/stream/tcp.yml.hbs b/packages/sophos/data_stream/utm/agent/stream/tcp.yml.hbs index 1de04c8c77c..04764ecf30f 100644 --- a/packages/sophos/data_stream/utm/agent/stream/tcp.yml.hbs +++ b/packages/sophos/data_stream/utm/agent/stream/tcp.yml.hbs @@ -2,5068 +2,20 @@ tcp: host: "{{tcp_host}}:{{tcp_port}}" tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#each tags as |tag i|}} - - {{tag}} +- {{tag}} {{/each}} fields_under_root: true fields: - observer: - vendor: "Sophos" - product: "UTM" - type: "Firewall" +_conf: +tz_offset: '{{tz_offset}}' {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} processors: +- add_locale: ~ {{#if processors}} {{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{hfld1->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0002"), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ - setc("header_id","0003"), - setc("messageid","reverseproxy"), - ])); - - var hdr4 = match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","0005"), - ])); - - var hdr5 = match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0004"), - setc("messageid","astarosg_TVM"), - ])); - - var hdr6 = match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ - setc("header_id","0006"), - setc("messageid","Sophos_Firewall"), - ])); - - var select1 = linear_select([ - hdr1, - hdr2, - hdr3, - hdr4, - hdr5, - hdr6, - ]); - - var part1 = match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg1 = msg("named:01", part1); - - var part2 = match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg2 = msg("named:02", part2); - - var part3 = match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ - dup4, - dup2, - dup3, - ])); - - var msg3 = msg("named:03", part3); - - var part4 = match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ - dup5, - dup2, - dup3, - ])); - - var msg4 = msg("named:04", part4); - - var part5 = match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ - dup6, - dup2, - dup3, - ])); - - var msg5 = msg("named:05", part5); - - var part6 = match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ - setc("eventcategory","1804000000"), - dup2, - dup3, - ])); - - var msg6 = msg("named:06", part6); - - var part7 = match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ - dup7, - dup2, - dup3, - ])); - - var msg7 = msg("named:07", part7); - - var part8 = match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg8 = msg("named:08", part8); - - var part9 = match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ - dup7, - dup2, - dup3, - setc("action","reloading"), - ])); - - var msg9 = msg("named:09", part9); - - var part10 = match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - ])); - - var msg10 = msg("named:10", part10); - - var part11 = match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - setc("action","all zones loaded"), - ])); - - var msg11 = msg("named:11", part11); - - var part12 = match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ - dup7, - setc("disposition","running"), - dup2, - dup3, - setc("action","running"), - ])); - - var msg12 = msg("named:12", part12); - - var part13 = match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ - dup7, - setc("context","built-in root key"), - dup2, - dup3, - ])); - - var msg13 = msg("named:13", part13); - - var part14 = match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg14 = msg("named:14", part14); - - var part15 = match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ - dup10, - setc("event_description","named:too many timeouts resolving DNS."), - dup11, - dup2, - ])); - - var msg15 = msg("named:15", part15); - - var part16 = match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:FORMERR resolving DNS."), - dup11, - dup2, - ])); - - var msg16 = msg("named:16", part16); - - var part17 = match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:unexpected RCODE (SERVFAIL) resolving DNS."), - dup11, - dup2, - ])); - - var msg17 = msg("named:17", part17); - - var select2 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - ]); - - var part18 = match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ - dup12, - setc("event_description","httpproxy:Integrated HTTP-Proxy."), - dup11, - dup2, - ])); - - var msg18 = msg("httpproxy:09", part18); - - var part19 = match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ - dup10, - setc("event_description","httpproxy:Name or service not known."), - dup11, - dup2, - ])); - - var msg19 = msg("httpproxy:10", part19); - - var part20 = match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ - dup10, - setc("event_description","httpproxy:failed to resolve passthrough."), - dup11, - dup2, - ])); - - var msg20 = msg("httpproxy:11", part20); - - var part21 = match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ - dup10, - setc("event_description","httpproxy:ssl handshake failure."), - dup11, - dup2, - ])); - - var msg21 = msg("httpproxy:12", part21); - - var part22 = match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ - dup10, - setc("event_description","httpproxy:EVP_DecryptFinal failed."), - dup11, - dup2, - ])); - - var msg22 = msg("httpproxy:13", part22); - - var part23 = match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ - dup10, - setc("event_description","httpproxy:decrypt failed."), - dup11, - dup2, - ])); - - var msg23 = msg("httpproxy:14", part23); - - var part24 = match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:reloading av pattern"), - dup11, - dup2, - ])); - - var msg24 = msg("httpproxy:15", part24); - - var part25 = match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ - dup12, - setc("event_description","httpproxy:sc_check_servers.Server checked."), - dup11, - dup2, - ])); - - var msg25 = msg("httpproxy:16", part25); - - var part26 = match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ - dup12, - setc("event_description","httpproxy:shutdown finished, exiting."), - dup11, - dup2, - ])); - - var msg26 = msg("httpproxy:17", part26); - - var part27 = match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ - dup12, - setc("event_description","httpproxy:"), - dup11, - dup2, - ])); - - var msg27 = msg("httpproxy:18", part27); - - var part28 = match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ - dup12, - setc("event_description","httpproxy:reading profiles"), - dup11, - dup2, - ])); - - var msg28 = msg("httpproxy:19", part28); - - var part29 = match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ - dup12, - setc("event_description","httpproxy:finished startup"), - dup11, - dup2, - ])); - - var msg29 = msg("httpproxy:20", part29); - - var part30 = match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:read_request_headers related message."), - dup11, - dup2, - ])); - - var msg30 = msg("httpproxy:21", part30); - - var part31 = match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_loop related message."), - dup11, - dup2, - ])); - - var msg31 = msg("httpproxy:22", part31); - - var part32 = match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scan_exit related message."), - dup11, - dup2, - ])); - - var msg32 = msg("httpproxy:23", part32); - - var part33 = match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_exit related message."), - dup11, - dup2, - ])); - - var msg33 = msg("httpproxy:24", part33); - - var part34 = match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_exit related message."), - dup11, - dup2, - ])); - - var msg34 = msg("httpproxy:25", part34); - - var part35 = match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_zap related message."), - dup11, - dup2, - ])); - - var msg35 = msg("httpproxy:26", part35); - - var part36 = match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scanner_init related message."), - dup11, - dup2, - ])); - - var msg36 = msg("httpproxy:27", part36); - - var part37 = tagval("MESSAGE#36:httpproxy:01", "nwparser.payload", tvm, { - "action": "action", - "ad_domain": "fld1", - "app-id": "fld18", - "application": "fld17", - "auth": "fld10", - "authtime": "fld4", - "avscantime": "fld7", - "cached": "fld2", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld6", - "content-type": "content_type", - "device": "fld9", - "dnstime": "fld5", - "dstip": "daddr", - "error": "result", - "exceptions": "fld12", - "extension": "fld13", - "file": "filename", - "filename": "filename", - "filteraction": "fld3", - "fullreqtime": "fld8", - "function": "action", - "group": "group", - "id": "rule", - "line": "fld14", - "message": "context", - "method": "web_method", - "name": "event_description", - "profile": "policyname", - "reason": "rule_group", - "referer": "web_referer", - "reputation": "fld16", - "request": "connectionid", - "severity": "severity", - "size": "rbytes", - "srcip": "saddr", - "statuscode": "resultcode", - "sub": "network_service", - "sys": "vsys", - "time": "fld15", - "ua": "fld11", - "url": "url", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg37 = msg("httpproxy:01", part37); - - var select3 = linear_select([ - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - ]); - - var part38 = match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ - dup16, - dup2, - dup3, - ])); - - var msg38 = msg("URID:01", part38); - - var part39 = tagval("MESSAGE#38:ulogd:01", "nwparser.payload", tvm, { - "action": "action", - "code": "fld30", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "fwrule": "policy_id", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "name": "event_description", - "outitf": "dinterface", - "prec": "fld27", - "proto": "fld24", - "seq": "fld23", - "severity": "severity", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "sub": "network_service", - "sys": "vsys", - "tcpflags": "fld29", - "tos": "fld26", - "ttl": "fld28", - "type": "fld31", - }, processor_chain([ - dup13, - setc("ec_subject","NetworkComm"), - setc("ec_activity","Scan"), - setc("ec_theme","TEV"), - dup11, - dup2, - dup45, - dup46, - ])); - - var msg39 = msg("ulogd:01", part39); - - var part40 = match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ - dup6, - setc("disposition","configured"), - dup2, - dup3, - ])); - - var msg40 = msg("reverseproxy:01", part40); - - var part41 = match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg41 = msg("reverseproxy:02", part41); - - var part42 = match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg42 = msg("reverseproxy:03", part42); - - var part43 = match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ - dup17, - setc("event_id","AH00292"), - dup2, - dup3, - ])); - - var msg43 = msg("reverseproxy:04", part43); - - var part44 = match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ - setc("eventcategory","1805010000"), - dup18, - dup2, - dup3, - ])); - - var msg44 = msg("reverseproxy:06", part44); - - var part45 = match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); - - var select4 = linear_select([ - dup19, - ]); - - var part46 = match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); - - var all1 = all_match({ - processors: [ - part45, - select4, - part46, - ], - on_success: processor_chain([ - dup5, - setc("event_id","AH00297"), - dup2, - dup3, - ]), - }); - - var msg45 = msg("reverseproxy:07", all1); - - var part47 = match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ - dup4, - setc("event_id","AH00112"), - dup2, - dup3, - ])); - - var msg46 = msg("reverseproxy:08", part47); - - var part48 = match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ - setc("eventcategory","1605010000"), - setc("event_id","AH00094"), - dup2, - dup3, - ])); - - var msg47 = msg("reverseproxy:09", part48); - - var part49 = match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ - dup12, - setc("event_id","AH00291"), - dup2, - dup3, - ])); - - var msg48 = msg("reverseproxy:10", part49); - - var part50 = match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ - dup20, - setc("event_id","AH02572"), - dup2, - dup3, - ])); - - var msg49 = msg("reverseproxy:11", part50); - - var part51 = match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ - dup20, - setc("context","SSL Library Error"), - dup2, - dup3, - ])); - - var msg50 = msg("reverseproxy:12", part51); - - var part52 = match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ - dup20, - setc("result","Fatal error"), - setc("event_id","AH02312"), - dup2, - dup3, - ])); - - var msg51 = msg("reverseproxy:13", part52); - - var part53 = match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ - dup20, - setc("result","Configuration Failed"), - setc("event_id","AH00020"), - dup2, - dup3, - ])); - - var msg52 = msg("reverseproxy:14", part53); - - var part54 = match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ - setc("eventcategory","1609000000"), - setc("context","Unclean shutdown"), - setc("event_id","AH00098"), - dup2, - dup3, - ])); - - var msg53 = msg("reverseproxy:15", part54); - - var part55 = match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ - dup16, - setc("event_id","AH00295"), - dup2, - dup3, - ])); - - var msg54 = msg("reverseproxy:16", part55); - - var part56 = match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); - - var part57 = match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); - - var select5 = linear_select([ - part57, - dup19, - ]); - - var part58 = match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all2 = all_match({ - processors: [ - part56, - select5, - part58, - ], - on_success: processor_chain([ - dup21, - dup2, - dup3, - ]), - }); - - var msg55 = msg("reverseproxy:17", all2); - - var part59 = match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ - dup4, - dup22, - dup2, - dup3, - ])); - - var msg56 = msg("reverseproxy:18", part59); - - var part60 = match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ - dup23, - dup22, - dup2, - dup3, - ])); - - var msg57 = msg("reverseproxy:19", part60); - - var part61 = match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg58 = msg("reverseproxy:20", part61); - - var part62 = match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ - dup20, - dup18, - setc("event_id","AH01909"), - dup2, - dup3, - ])); - - var msg59 = msg("reverseproxy:21", part62); - - var part63 = match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ - dup20, - setc("comments","Invalid port configuration"), - dup2, - dup3, - ])); - - var msg60 = msg("reverseproxy:22", part63); - - var part64 = match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg61 = msg("reverseproxy:23", part64); - - var part65 = match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg62 = msg("reverseproxy:24", part65); - - var part66 = match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg63 = msg("reverseproxy:25", part66); - - var part67 = match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); - - var part68 = match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); - - var select6 = linear_select([ - part68, - dup19, - ]); - - var part69 = match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); - - var part70 = match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); - - var part71 = match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); - - var select7 = linear_select([ - part70, - part71, - ]); - - var part72 = match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all3 = all_match({ - processors: [ - part67, - select6, - part69, - select7, - part72, - ], - on_success: processor_chain([ - dup24, - dup2, - dup3, - ]), - }); - - var msg64 = msg("reverseproxy:26", all3); - - var part73 = match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg65 = msg("reverseproxy:27", part73); - - var part74 = match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ - dup26, - setc("result","virus daemon error"), - dup2, - dup3, - ])); - - var msg66 = msg("reverseproxy:28", part74); - - var part75 = match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ - dup27, - setc("result","virus found"), - dup2, - dup3, - ])); - - var msg67 = msg("reverseproxy:29", part75); - - var part76 = match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg68 = msg("reverseproxy:30", part76); - - var part77 = match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ - dup25, - setc("result","Cannot read reply"), - dup2, - dup3, - ])); - - var msg69 = msg("reverseproxy:31", part77); - - var part78 = match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg70 = msg("reverseproxy:32", part78); - - var part79 = match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg71 = msg("reverseproxy:33", part79); - - var part80 = match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg72 = msg("reverseproxy:34", part80); - - var part81 = match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg73 = msg("reverseproxy:35", part81); - - var part82 = match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ - dup27, - setc("result","Virus found"), - dup2, - dup3, - ])); - - var msg74 = msg("reverseproxy:36", part82); - - var part83 = match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg75 = msg("reverseproxy:37", part83); - - var part84 = match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg76 = msg("reverseproxy:38", part84); - - var part85 = match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ - dup23, - setc("result","Form validation failed"), - dup2, - dup3, - ])); - - var msg77 = msg("reverseproxy:39", part85); - - var part86 = match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ - dup25, - setc("result","Sending trickle failed"), - dup2, - dup3, - ])); - - var msg78 = msg("reverseproxy:40", part86); - - var part87 = match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ - dup30, - dup2, - dup3, - ])); - - var msg79 = msg("reverseproxy:41", part87); - - var part88 = match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ - setc("eventcategory","1603050000"), - dup2, - dup3, - ])); - - var msg80 = msg("reverseproxy:42", part88); - - var part89 = match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ - dup30, - setc("event_id","AH01110"), - setc("result","Error reading response"), - dup2, - dup3, - ])); - - var msg81 = msg("reverseproxy:43", part89); - - var part90 = match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1601020000"), - setc("result","No form context found"), - dup2, - dup3, - ])); - - var msg82 = msg("reverseproxy:44", part90); - - var part91 = match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ - dup25, - setc("event_id","AH00957"), - dup2, - dup3, - ])); - - var msg83 = msg("reverseproxy:45", part91); - - var part92 = match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ - dup16, - setc("event_id","AH00959"), - setc("result","disabling worker"), - dup2, - dup3, - ])); - - var msg84 = msg("reverseproxy:46", part92); - - var part93 = match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1801000000"), - setc("context","Not all file sent to client"), - dup2, - dup3, - ])); - - var msg85 = msg("reverseproxy:47", part93); - - var part94 = match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg86 = msg("reverseproxy:48", part94); - - var part95 = match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg87 = msg("reverseproxy:49", part95); - - var part96 = tagval("MESSAGE#87:reverseproxy:05", "nwparser.payload", tvm, { - "cookie": "web_cookie", - "exceptions": "policy_waiver", - "extra": "info", - "host": "dhost", - "id": "policy_id", - "localip": "fld3", - "method": "web_method", - "reason": "comments", - "referer": "web_referer", - "server": "daddr", - "set-cookie": "fld5", - "size": "fld4", - "srcip": "saddr", - "statuscode": "resultcode", - "time": "processing_time", - "url": "web_root", - "user": "username", - }, processor_chain([ - setc("eventcategory","1802000000"), - dup2, - dup3, - ])); - - var msg88 = msg("reverseproxy:05", part96); - - var select8 = linear_select([ - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - msg59, - msg60, - msg61, - msg62, - msg63, - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - ]); - - var part97 = tagval("MESSAGE#88:confd-sync", "nwparser.payload", tvm, { - "id": "fld5", - "name": "event_description", - "severity": "severity", - "sub": "service", - "sys": "fld2", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg89 = msg("confd-sync", part97); - - var part98 = tagval("MESSAGE#89:confd:01", "nwparser.payload", tvm, { - "account": "logon_id", - "attributes": "obj_name", - "class": "group_object", - "client": "fld3", - "count": "fld4", - "facility": "logon_type", - "id": "fld1", - "name": "event_description", - "node": "node", - "object": "fld6", - "severity": "severity", - "srcip": "saddr", - "storage": "directory", - "sub": "service", - "sys": "fld2", - "type": "obj_type", - "user": "username", - "version": "version", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg90 = msg("confd:01", part98); - - var part99 = match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy Frox started."), - dup11, - dup2, - ])); - - var msg91 = msg("frox", part99); - - var part100 = match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy listening on port."), - dup11, - dup2, - ])); - - var msg92 = msg("frox:01", part100); - - var part101 = match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy dropped priveleges."), - dup11, - dup2, - ])); - - var msg93 = msg("frox:02", part101); - - var select9 = linear_select([ - msg91, - msg92, - msg93, - ]); - - var part102 = match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ - dup12, - setc("event_description","afcd: IM/P2P Classifier configuration reloaded successfully."), - dup11, - dup2, - ])); - - var msg94 = msg("afcd", part102); - - var part103 = match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ - dup12, - setc("event_description","ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]..."), - dup11, - dup2, - ])); - - var msg95 = msg("ipsec_starter", part103); - - var part104 = match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ - dup12, - setc("event_description","ipsec_starter: IP address or index of physical interface changed."), - dup11, - dup2, - ])); - - var msg96 = msg("ipsec_starter:01", part104); - - var select10 = linear_select([ - msg95, - msg96, - ]); - - var part105 = match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: Starting Pluto."), - dup11, - dup2, - ])); - - var msg97 = msg("pluto", part105); - - var part106 = match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: including NAT-Traversal patch."), - dup11, - dup2, - ])); - - var msg98 = msg("pluto:01", part106); - - var part107 = match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating encryption algorithm."), - dup11, - dup2, - ])); - - var msg99 = msg("pluto:02", part107); - - var part108 = match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating hash algorithm."), - dup11, - dup2, - ])); - - var msg100 = msg("pluto:03", part108); - - var part109 = match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ - dup12, - setc("event_description","pluto: Testing registered IKE encryption algorithms"), - dup11, - dup2, - ])); - - var msg101 = msg("pluto:04", part109); - - var part110 = match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test not available."), - dup11, - dup2, - ])); - - var msg102 = msg("pluto:05", part110); - - var part111 = match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test passed."), - dup11, - dup2, - ])); - - var msg103 = msg("pluto:06", part111); - - var part112 = match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ - dup12, - setc("event_description","pluto: Using KLIPS IPsec interface code"), - dup11, - dup2, - ])); - - var msg104 = msg("pluto:07", part112); - - var part113 = match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","pluto: adding interface"), - dup11, - dup2, - ])); - - var msg105 = msg("pluto:08", part113); - - var part114 = match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ - dup34, - setc("event_description","pluto: loading secrets"), - dup11, - dup2, - ])); - - var msg106 = msg("pluto:09", part114); - - var part115 = match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ - dup34, - setc("event_description","pluto: loaded private key file"), - dup11, - dup2, - ])); - - var msg107 = msg("pluto:10", part115); - - var part116 = match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ - dup12, - setc("event_description","pluto: added connection description"), - dup11, - dup2, - ])); - - var msg108 = msg("pluto:11", part116); - - var part117 = match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg109 = msg("pluto:12", part117); - - var part118 = match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup10, - dup36, - dup11, - dup2, - ])); - - var msg110 = msg("pluto:13", part118); - - var part119 = match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg111 = msg("pluto:14", part119); - - var part120 = match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ - dup12, - setc("event_description","pluto:forgetting secrets"), - dup11, - dup2, - ])); - - var msg112 = msg("pluto:15", part120); - - var part121 = match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ - dup12, - setc("event_description","pluto:Changing to directory"), - dup11, - dup2, - ])); - - var msg113 = msg("pluto:17", part121); - - var part122 = match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ - dup12, - setc("event_description","pluto:*time to handle event"), - dup11, - dup2, - ])); - - var msg114 = msg("pluto:18", part122); - - var part123 = match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ - dup12, - setc("event_description","pluto:*received kernel message"), - dup11, - dup2, - ])); - - var msg115 = msg("pluto:19", part123); - - var part124 = match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ - dup25, - setc("event_description","pluto:rejected packet"), - dup11, - dup2, - ])); - - var msg116 = msg("pluto:20", part124); - - var part125 = match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg117 = msg("pluto:21", part125); - - var part126 = match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg118 = msg("pluto:22", part126); - - var part127 = match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg119 = msg("pluto:23", part127); - - var part128 = match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg120 = msg("pluto:24", part128); - - var part129 = match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg121 = msg("pluto:25", part129); - - var part130 = match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg122 = msg("pluto:26", part130); - - var part131 = match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg123 = msg("pluto:27", part131); - - var part132 = match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg124 = msg("pluto:28", part132); - - var part133 = match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg125 = msg("pluto:29", part133); - - var part134 = match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg126 = msg("pluto:30", part134); - - var part135 = match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg127 = msg("pluto:31", part135); - - var part136 = match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ - dup12, - setc("event_description","not authenticated"), - dup11, - dup2, - ])); - - var msg128 = msg("pluto:32", part136); - - var part137 = match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg129 = msg("pluto:33", part137); - - var part138 = match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup12, - dup36, - dup11, - dup2, - ])); - - var msg130 = msg("pluto:34", part138); - - var part139 = match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg131 = msg("pluto:35", part139); - - var select11 = linear_select([ - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - ]); - - var part140 = match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ - setc("eventcategory","1607000000"), - setc("event_description","xl2tpd:This binary does not support kernel L2TP."), - dup11, - dup2, - ])); - - var msg132 = msg("xl2tpd", part140); - - var part141 = match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ - dup12, - setc("event_description","xl2tpd:xl2tpd started."), - dup11, - dup2, - ])); - - var msg133 = msg("xl2tpd:01", part141); - - var part142 = match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg134 = msg("xl2tpd:02", part142); - - var part143 = match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg135 = msg("xl2tpd:03", part143); - - var part144 = match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg136 = msg("xl2tpd:04", part144); - - var part145 = match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg137 = msg("xl2tpd:05", part145); - - var select12 = linear_select([ - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - ]); - - var part146 = match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ - dup12, - setc("event_description","barnyard: Exiting"), - dup11, - dup2, - ])); - - var msg138 = msg("barnyard:01", part146); - - var part147 = match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Initializing daemon mode"), - dup11, - dup2, - ])); - - var msg139 = msg("barnyard:02", part147); - - var part148 = match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ - dup12, - setc("event_description","barnyard:Opened spool file."), - dup11, - dup2, - ])); - - var msg140 = msg("barnyard:03", part148); - - var part149 = match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Waiting for new data"), - dup11, - dup2, - ])); - - var msg141 = msg("barnyard:04", part149); - - var select13 = linear_select([ - msg138, - msg139, - msg140, - msg141, - ]); - - var part150 = match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ - dup12, - setc("event_description","exim:SMTP connection from localhost closed by QUIT"), - dup11, - dup2, - ])); - - var msg142 = msg("exim:01", part150); - - var part151 = match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ - setc("eventcategory","1207010000"), - setc("event_description","exim:e-mail accepted from relay."), - dup11, - dup2, - ])); - - var msg143 = msg("exim:02", part151); - - var part152 = match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ - setc("eventcategory","1207000000"), - setc("event_description","exim: e-mail sent."), - dup11, - dup2, - ])); - - var msg144 = msg("exim:03", part152); - - var part153 = match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ - dup39, - setc("event_description","exim: e-mail host lookup did not complete in DNS."), - dup11, - dup2, - ])); - - var msg145 = msg("exim:04", part153); - - var part154 = match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ - dup39, - setc("event_description","exim: e-mail routing defer:retry time not reached."), - dup11, - dup2, - ])); - - var msg146 = msg("exim:05", part154); - - var part155 = match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ - dup12, - setc("event_description","exim: exim daemon started."), - dup11, - dup2, - ])); - - var msg147 = msg("exim:06", part155); - - var part156 = match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ - dup12, - setc("event_description","exim: Start queue run."), - dup11, - dup2, - ])); - - var msg148 = msg("exim:07", part156); - - var part157 = match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ - dup12, - setc("event_description","exim: SIGHUP received: re-exec daemon."), - dup11, - dup2, - ])); - - var msg149 = msg("exim:08", part157); - - var part158 = match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim: SMTP connection from host."), - dup11, - dup2, - ])); - - var msg150 = msg("exim:09", part158); - - var part159 = match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:rejected EHLO from host."), - dup11, - dup2, - ])); - - var msg151 = msg("exim:10", part159); - - var part160 = match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:SMTP protocol synchronization error rejected connection from host."), - dup11, - dup2, - ])); - - var msg152 = msg("exim:11", part160); - - var part161 = match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:TLS error on connection from host."), - dup11, - dup2, - ])); - - var msg153 = msg("exim:12", part161); - - var part162 = match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg154 = msg("exim:13", part162); - - var part163 = match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg155 = msg("exim:14", part163); - - var part164 = match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg156 = msg("exim:15", part164); - - var part165 = match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg157 = msg("exim:16", part165); - - var select14 = linear_select([ - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - ]); - - var part166 = match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ - dup12, - setc("event_description","smtpd: Process moved to work queue."), - dup11, - dup2, - ])); - - var msg158 = msg("smtpd:01", part166); - - var part167 = match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ - setc("eventcategory","1207010100"), - dup11, - dup2, - ])); - - var msg159 = msg("smtpd:02", part167); - - var part168 = match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ - dup12, - setc("event_description","smtpd: SCANNER: Nothing to do,exiting."), - dup11, - dup2, - ])); - - var msg160 = msg("smtpd:03", part168); - - var part169 = match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status two set to disabled."), - dup11, - dup2, - ])); - - var msg161 = msg("smtpd:04", part169); - - var part170 = match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status one set to disabled."), - dup11, - dup2, - ])); - - var msg162 = msg("smtpd:07", part170); - - var part171 = match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:(Re-)loading configuration from Confd."), - dup11, - dup2, - ])); - - var msg163 = msg("smtpd:05", part171); - - var part172 = match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:Sending QR one."), - dup11, - dup2, - ])); - - var msg164 = msg("smtpd:06", part172); - - var select15 = linear_select([ - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - ]); - - var part173 = match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ - dup10, - setc("event_description","sshd: Did not receive identification string."), - dup11, - dup2, - ])); - - var msg165 = msg("sshd:01", part173); - - var part174 = match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ - dup12, - setc("event_description","sshd:Received SIGHUP restarting."), - dup11, - dup2, - ])); - - var msg166 = msg("sshd:02", part174); - - var part175 = match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ - dup12, - setc("event_description","sshd:Server listening; restarting."), - dup11, - dup2, - ])); - - var msg167 = msg("sshd:03", part175); - - var part176 = match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ - dup41, - setc("event_description","sshd:Invalid user admin."), - dup11, - dup2, - ])); - - var msg168 = msg("sshd:04", part176); - - var part177 = match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed none for invalid user admin."), - dup11, - dup2, - ])); - - var msg169 = msg("sshd:05", part177); - - var part178 = match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ - dup10, - setc("event_description","sshd:error:Could not get shadow information for NOUSER"), - dup11, - dup2, - ])); - - var msg170 = msg("sshd:06", part178); - - var part179 = match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed password for root."), - dup11, - dup2, - ])); - - var msg171 = msg("sshd:07", part179); - - var part180 = match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - setc("eventcategory","1302000000"), - setc("event_description","sshd:Accepted password for loginuser."), - dup11, - dup2, - ])); - - var msg172 = msg("sshd:08", part180); - - var part181 = match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ - dup10, - setc("event_description","sshd:subsystem request for sftp failed,subsystem not found."), - dup11, - dup2, - ])); - - var msg173 = msg("sshd:09", part181); - - var select16 = linear_select([ - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - ]); - - var part182 = tagval("MESSAGE#173:aua:01", "nwparser.payload", tvm, { - "caller": "fld4", - "engine": "fld5", - "id": "fld1", - "name": "event_description", - "severity": "severity", - "srcip": "saddr", - "sub": "service", - "sys": "fld2", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg174 = msg("aua:01", part182); - - var part183 = match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ - dup12, - setc("event_description","sockd: created new negotiatorchild."), - dup11, - dup2, - ])); - - var msg175 = msg("sockd:01", part183); - - var part184 = match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ - dup12, - setc("event_description","sockd:dante/server running."), - dup11, - dup2, - ])); - - var msg176 = msg("sockd:02", part184); - - var part185 = match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ - dup12, - setc("event_description","sockd:sockdexit():terminating on signal."), - dup11, - dup2, - ])); - - var msg177 = msg("sockd:03", part185); - - var select17 = linear_select([ - msg175, - msg176, - msg177, - ]); - - var part186 = match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ - dup12, - setc("event_description","pop3proxy:Master started."), - dup11, - dup2, - ])); - - var msg178 = msg("pop3proxy", part186); - - var part187 = tagval("MESSAGE#178:astarosg_TVM", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg179 = msg("astarosg_TVM", part187); - - var part188 = tagval("MESSAGE#179:httpd", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "port": "network_port", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "query": "web_query", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "uid": "uid", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg180 = msg("httpd", part188); - - var part189 = match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ - setc("eventcategory","1502000000"), - dup2, - dup3, - ])); - - var msg181 = msg("httpd:01", part189); - - var select18 = linear_select([ - msg180, - msg181, - ]); - - var part190 = tagval("MESSAGE#181:Sophos_Firewall", "nwparser.payload", tvm, { - "activityname": "fld9", - "appfilter_policy_id": "fld10", - "application": "application", - "application_category": "fld23", - "application_risk": "risk_num", - "application_technology": "fld11", - "appresolvedby": "fld22", - "category": "fld4", - "category_type": "fld5", - "connevent": "fld19", - "connid": "connectionid", - "contenttype": "content_type", - "dir_disp": "fld18", - "domain": "fqdn", - "dst_country_code": "location_dst", - "dst_ip": "daddr", - "dst_port": "dport", - "dstzone": "dst_zone", - "dstzonetype": "fld17", - "duration": "duration", - "exceptions": "fld8", - "fw_rule_id": "rule_uid", - "hb_health": "fld21", - "httpresponsecode": "fld7", - "iap": "id1", - "in_interface": "sinterface", - "ips_policy_id": "policy_id", - "log_component": "event_source", - "log_subtype": "category", - "log_type": "event_type", - "message": "info", - "out_interface": "dinterface", - "override_token": "fld6", - "policy_type": "fld23", - "priority": "severity", - "protocol": "protocol", - "reason": "result", - "recv_bytes": "rbytes", - "recv_pkts": "fld15", - "referer": "web_referer", - "sent_bytes": "sbytes", - "sent_pkts": "fld14", - "src_country_code": "location_src", - "src_ip": "saddr", - "src_mac": "smacaddr", - "src_port": "sport", - "srczone": "src_zone", - "srczonetype": "fld16", - "status": "event_state", - "status_code": "resultcode", - "tran_dst_ip": "dtransaddr", - "tran_dst_port": "dtransport", - "tran_src_ip": "stransaddr", - "tran_src_port": "stransport", - "transactionid": "id2", - "url": "url", - "user_agent": "user_agent", - "user_gp": "group", - "user_name": "username", - "vconnid": "fld20", - }, processor_chain([ - setc("eventcategory","1204000000"), - dup2, - date_time({ - dest: "event_time", - args: ["hdate","htime"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dS], - ], - }), - ])); - - var msg182 = msg("Sophos_Firewall", part190); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "Sophos_Firewall": msg182, - "URID": msg38, - "afcd": msg94, - "astarosg_TVM": msg179, - "aua": msg174, - "barnyard": select13, - "confd": msg90, - "confd-sync": msg89, - "exim": select14, - "frox": select9, - "httpd": select18, - "httpproxy": select3, - "ipsec_starter": select10, - "named": select2, - "pluto": select11, - "pop3proxy": msg178, - "reverseproxy": select8, - "smtpd": select15, - "sockd": select17, - "sshd": select16, - "ulogd": msg39, - "xl2tpd": select12, - }), - ]); - - var part191 = match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ +{{/if}} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/agent/stream/udp.yml.hbs b/packages/sophos/data_stream/utm/agent/stream/udp.yml.hbs index cef2ed2295e..444e10172f0 100644 --- a/packages/sophos/data_stream/utm/agent/stream/udp.yml.hbs +++ b/packages/sophos/data_stream/utm/agent/stream/udp.yml.hbs @@ -2,5068 +2,20 @@ udp: host: "{{udp_host}}:{{udp_port}}" tags: {{#if preserve_original_event}} - - preserve_original_event +- preserve_original_event {{/if}} {{#each tags as |tag i|}} - - {{tag}} +- {{tag}} {{/each}} fields_under_root: true fields: - observer: - vendor: "Sophos" - product: "UTM" - type: "Firewall" +_conf: +tz_offset: '{{tz_offset}}' {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} processors: +- add_locale: ~ {{#if processors}} {{processors}} -{{/if}} -- script: - lang: javascript - params: - ecs: true - rsa: {{rsa_fields}} - tz_offset: {{tz_offset}} - keep_raw: {{keep_raw_fields}} - debug: {{debug}} - source: | - // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one - // or more contributor license agreements. Licensed under the Elastic License; - // you may not use this file except in compliance with the Elastic License. - - /* jshint -W014,-W016,-W097,-W116 */ - - var processor = require("processor"); - var console = require("console"); - - var FLAG_FIELD = "log.flags"; - var FIELDS_OBJECT = "nwparser"; - var FIELDS_PREFIX = FIELDS_OBJECT + "."; - - var defaults = { - debug: false, - ecs: true, - rsa: false, - keep_raw: false, - tz_offset: "local", - strip_priority: true - }; - - var saved_flags = null; - var debug; - var map_ecs; - var map_rsa; - var keep_raw; - var device; - var tz_offset; - var strip_priority; - - // Register params from configuration. - function register(params) { - debug = params.debug !== undefined ? params.debug : defaults.debug; - map_ecs = params.ecs !== undefined ? params.ecs : defaults.ecs; - map_rsa = params.rsa !== undefined ? params.rsa : defaults.rsa; - keep_raw = params.keep_raw !== undefined ? params.keep_raw : defaults.keep_raw; - tz_offset = parse_tz_offset(params.tz_offset !== undefined? params.tz_offset : defaults.tz_offset); - strip_priority = params.strip_priority !== undefined? params.strip_priority : defaults.strip_priority; - device = new DeviceProcessor(); - } - - function parse_tz_offset(offset) { - var date; - var m; - switch(offset) { - // local uses the tz offset from the JS VM. - case "local": - date = new Date(); - // Reversing the sign as we the offset from UTC, not to UTC. - return parse_local_tz_offset(-date.getTimezoneOffset()); - // event uses the tz offset from event.timezone (add_locale processor). - case "event": - return offset; - // Otherwise a tz offset in the form "[+-][0-9]{4}" is required. - default: - m = offset.match(/^([+\-])([0-9]{2}):?([0-9]{2})?$/); - if (m === null || m.length !== 4) { - throw("bad timezone offset: '" + offset + "'. Must have the form +HH:MM"); - } - return m[1] + m[2] + ":" + (m[3]!==undefined? m[3] : "00"); - } - } - - function parse_local_tz_offset(minutes) { - var neg = minutes < 0; - minutes = Math.abs(minutes); - var min = minutes % 60; - var hours = Math.floor(minutes / 60); - var pad2digit = function(n) { - if (n < 10) { return "0" + n;} - return "" + n; - }; - return (neg? "-" : "+") + pad2digit(hours) + ":" + pad2digit(min); - } - - function process(evt) { - // Function register is only called by the processor when `params` are set - // in the processor config. - if (device === undefined) { - register(defaults); - } - return device.process(evt); - } - - function processor_chain(subprocessors) { - var builder = new processor.Chain(); - subprocessors.forEach(builder.Add); - return builder.Build().Run; - } - - function linear_select(subprocessors) { - return function (evt) { - var flags = evt.Get(FLAG_FIELD); - var i; - for (i = 0; i < subprocessors.length; i++) { - evt.Delete(FLAG_FIELD); - if (debug) console.warn("linear_select trying entry " + i); - subprocessors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) == null) break; - if (debug) console.warn("linear_select failed entry " + i); - } - if (flags !== null) { - evt.Put(FLAG_FIELD, flags); - } - if (debug) { - if (i < subprocessors.length) { - console.warn("linear_select matched entry " + i); - } else { - console.warn("linear_select didn't match"); - } - } - }; - } - - function conditional(opt) { - return function(evt) { - if (opt.if(evt)) { - opt.then(evt); - } else if (opt.else) { - opt.else(evt); - } - }; - } - - var strip_syslog_priority = (function() { - var isEnabled = function() { return strip_priority === true; }; - var fetchPRI = field("_pri"); - var fetchPayload = field("payload"); - var removePayload = remove(["payload"]); - var cleanup = remove(["_pri", "payload"]); - var onMatch = function(evt) { - var pri, priStr = fetchPRI(evt); - if (priStr != null - && 0 < priStr.length && priStr.length < 4 - && !isNaN((pri = Number(priStr))) - && 0 <= pri && pri < 192) { - var severity = pri & 7, - facility = pri >> 3; - setc("_severity", "" + severity)(evt); - setc("_facility", "" + facility)(evt); - // Replace message with priority stripped. - evt.Put("message", fetchPayload(evt)); - removePayload(evt); - } else { - // not a valid syslog PRI, cleanup. - cleanup(evt); - } - }; - return conditional({ - if: isEnabled, - then: cleanup_flags(match( - "STRIP_PRI", - "message", - "<%{_pri}>%{payload}", - onMatch - )) - }); - })(); - - function match(id, src, pattern, on_success) { - var dissect = new processor.Dissect({ - field: src, - tokenizer: pattern, - target_prefix: FIELDS_OBJECT, - ignore_failure: true, - overwrite_keys: true, - trim_values: "right" - }); - return function (evt) { - var msg = evt.Get(src); - dissect.Run(evt); - var failed = evt.Get(FLAG_FIELD) != null; - if (debug) { - if (failed) { - console.debug("dissect fail: " + id + " field:" + src); - } else { - console.debug("dissect OK: " + id + " field:" + src); - } - console.debug(" expr: <<" + pattern + ">>"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null && !failed) { - on_success(evt); - } - }; - } - - function match_copy(id, src, dst, on_success) { - dst = FIELDS_PREFIX + dst; - if (dst === FIELDS_PREFIX || dst === src) { - return function (evt) { - if (debug) { - console.debug("noop OK: " + id + " field:" + src); - console.debug(" input: <<" + evt.Get(src) + ">>"); - } - if (on_success != null) on_success(evt); - } - } - return function (evt) { - var msg = evt.Get(src); - evt.Put(dst, msg); - if (debug) { - console.debug("copy OK: " + id + " field:" + src); - console.debug(" target: '" + dst + "'"); - console.debug(" input: <<" + msg + ">>"); - } - if (on_success != null) on_success(evt); - } - } - - function cleanup_flags(processor) { - return function(evt) { - processor(evt); - evt.Delete(FLAG_FIELD); - }; - } - - function all_match(opts) { - return function (evt) { - var i; - for (i = 0; i < opts.processors.length; i++) { - evt.Delete(FLAG_FIELD); - opts.processors[i](evt); - // Dissect processor succeeded? - if (evt.Get(FLAG_FIELD) != null) { - if (debug) console.warn("all_match failure at " + i); - if (opts.on_failure != null) opts.on_failure(evt); - return; - } - if (debug) console.warn("all_match success at " + i); - } - if (opts.on_success != null) opts.on_success(evt); - }; - } - - function msgid_select(mapping) { - return function (evt) { - var msgid = evt.Get(FIELDS_PREFIX + "messageid"); - if (msgid == null) { - if (debug) console.warn("msgid_select: no messageid captured!"); - return; - } - var next = mapping[msgid]; - if (next === undefined) { - if (debug) console.warn("msgid_select: no mapping for messageid:" + msgid); - return; - } - if (debug) console.info("msgid_select: matched key=" + msgid); - return next(evt); - }; - } - - function msg(msg_id, match) { - return function (evt) { - match(evt); - if (evt.Get(FLAG_FIELD) == null) { - evt.Put(FIELDS_PREFIX + "msg_id1", msg_id); - } - }; - } - - var start; - - function save_flags(evt) { - saved_flags = evt.Get(FLAG_FIELD); - evt.Put("event.original", evt.Get("message")); - } - - function restore_flags(evt) { - if (saved_flags !== null) { - evt.Put(FLAG_FIELD, saved_flags); - } - evt.Delete("message"); - } - - function constant(value) { - return function (evt) { - return value; - }; - } - - function field(name) { - var fullname = FIELDS_PREFIX + name; - return function (evt) { - return evt.Get(fullname); - }; - } - - function STRCAT(args) { - var s = ""; - var i; - for (i = 0; i < args.length; i++) { - s += args[i]; - } - return s; - } - - // TODO: Implement - function DIRCHK(args) { - unimplemented("DIRCHK"); - } - - function strictToInt(str) { - return str * 1; - } - - function CALC(args) { - if (args.length !== 3) { - console.warn("skipped call to CALC with " + args.length + " arguments."); - return; - } - var a = strictToInt(args[0]); - var b = strictToInt(args[2]); - if (isNaN(a) || isNaN(b)) { - console.warn("failed evaluating CALC arguments a='" + args[0] + "' b='" + args[2] + "'."); - return; - } - var result; - switch (args[1]) { - case "+": - result = a + b; - break; - case "-": - result = a - b; - break; - case "*": - result = a * b; - break; - default: - // Only * and + seen in the parsers. - console.warn("unknown CALC operation '" + args[1] + "'."); - return; - } - // Always return a string - return result !== undefined ? "" + result : result; - } - - var quoteChars = "\"'`"; - function RMQ(args) { - if(args.length !== 1) { - console.warn("RMQ: only one argument expected"); - return; - } - var value = args[0].trim(); - var n = value.length; - var char; - return n > 1 - && (char=value.charAt(0)) === value.charAt(n-1) - && quoteChars.indexOf(char) !== -1? - value.substr(1, n-2) - : value; - } - - function call(opts) { - var args = new Array(opts.args.length); - return function (evt) { - for (var i = 0; i < opts.args.length; i++) - if ((args[i] = opts.args[i](evt)) == null) return; - var result = opts.fn(args); - if (result != null) { - evt.Put(opts.dest, result); - } - }; - } - - function nop(evt) { - } - - function appendErrorMsg(evt, msg) { - var value = evt.Get("error.message"); - if (value == null) { - value = [msg]; - } else if (msg instanceof Array) { - value.push(msg); - } else { - value = [value, msg]; - } - evt.Put("error.message", value); - } - - function unimplemented(name) { - appendErrorMsg("unimplemented feature: " + name); - } - - function lookup(opts) { - return function (evt) { - var key = opts.key(evt); - if (key == null) return; - var value = opts.map.keyvaluepairs[key]; - if (value === undefined) { - value = opts.map.default; - } - if (value !== undefined) { - evt.Put(opts.dest, value(evt)); - } - }; - } - - function set(fields) { - return new processor.AddFields({ - target: FIELDS_OBJECT, - fields: fields, - }); - } - - function setf(dst, src) { - return function (evt) { - var val = evt.Get(FIELDS_PREFIX + src); - if (val != null) evt.Put(FIELDS_PREFIX + dst, val); - }; - } - - function setc(dst, value) { - return function (evt) { - evt.Put(FIELDS_PREFIX + dst, value); - }; - } - - function set_field(opts) { - return function (evt) { - var val = opts.value(evt); - if (val != null) evt.Put(opts.dest, val); - }; - } - - function dump(label) { - return function (evt) { - console.log("Dump of event at " + label + ": " + JSON.stringify(evt, null, "\t")); - }; - } - - function date_time_join_args(evt, arglist) { - var str = ""; - for (var i = 0; i < arglist.length; i++) { - var fname = FIELDS_PREFIX + arglist[i]; - var val = evt.Get(fname); - if (val != null) { - if (str !== "") str += " "; - str += val; - } else { - if (debug) console.warn("in date_time: input arg " + fname + " is not set"); - } - } - return str; - } - - function to2Digit(num) { - return num? (num < 10? "0" + num : num) : "00"; - } - - // Make two-digit dates 00-69 interpreted as 2000-2069 - // and dates 70-99 translated to 1970-1999. - var twoDigitYearEpoch = 70; - var twoDigitYearCentury = 2000; - - // This is to accept dates up to 2 days in the future, only used when - // no year is specified in a date. 2 days should be enough to account for - // time differences between systems and different tz offsets. - var maxFutureDelta = 2*24*60*60*1000; - - // DateContainer stores date fields and then converts those fields into - // a Date. Necessary because building a Date using its set() methods gives - // different results depending on the order of components. - function DateContainer(tzOffset) { - this.offset = tzOffset === undefined? "Z" : tzOffset; - } - - DateContainer.prototype = { - setYear: function(v) {this.year = v;}, - setMonth: function(v) {this.month = v;}, - setDay: function(v) {this.day = v;}, - setHours: function(v) {this.hours = v;}, - setMinutes: function(v) {this.minutes = v;}, - setSeconds: function(v) {this.seconds = v;}, - - setUNIX: function(v) {this.unix = v;}, - - set2DigitYear: function(v) { - this.year = v < twoDigitYearEpoch? twoDigitYearCentury + v : twoDigitYearCentury + v - 100; - }, - - toDate: function() { - if (this.unix !== undefined) { - return new Date(this.unix * 1000); - } - if (this.day === undefined || this.month === undefined) { - // Can't make a date from this. - return undefined; - } - if (this.year === undefined) { - // A date without a year. Set current year, or previous year - // if date would be in the future. - var now = new Date(); - this.year = now.getFullYear(); - var date = this.toDate(); - if (date.getTime() - now.getTime() > maxFutureDelta) { - date.setFullYear(now.getFullYear() - 1); - } - return date; - } - var MM = to2Digit(this.month); - var DD = to2Digit(this.day); - var hh = to2Digit(this.hours); - var mm = to2Digit(this.minutes); - var ss = to2Digit(this.seconds); - return new Date(this.year + "-" + MM + "-" + DD + "T" + hh + ":" + mm + ":" + ss + this.offset); - } - } - - function date_time_try_pattern(fmt, str, tzOffset) { - var date = new DateContainer(tzOffset); - var pos = date_time_try_pattern_at_pos(fmt, str, 0, date); - return pos !== undefined? date.toDate() : undefined; - } - - function date_time_try_pattern_at_pos(fmt, str, pos, date) { - var len = str.length; - for (var proc = 0; pos !== undefined && pos < len && proc < fmt.length; proc++) { - pos = fmt[proc](str, pos, date); - } - return pos; - } - - function date_time(opts) { - return function (evt) { - var tzOffset = opts.tz || tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var date = date_time_try_pattern(opts.fmts[i], str, tzOffset); - if (date !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, date); - return; - } - } - if (debug) console.warn("in date_time: id=" + opts.id + " FAILED: " + str); - }; - } - - var uA = 60 * 60 * 24; - var uD = 60 * 60 * 24; - var uF = 60 * 60; - var uG = 60 * 60 * 24 * 30; - var uH = 60 * 60; - var uI = 60 * 60; - var uJ = 60 * 60 * 24; - var uM = 60 * 60 * 24 * 30; - var uN = 60 * 60; - var uO = 1; - var uS = 1; - var uT = 60; - var uU = 60; - var uc = dc; - - function duration(opts) { - return function(evt) { - var str = date_time_join_args(evt, opts.args); - for (var i = 0; i < opts.fmts.length; i++) { - var seconds = duration_try_pattern(opts.fmts[i], str); - if (seconds !== undefined) { - evt.Put(FIELDS_PREFIX + opts.dest, seconds); - return; - } - } - if (debug) console.warn("in duration: id=" + opts.id + " (s) FAILED: " + str); - }; - } - - function duration_try_pattern(fmt, str) { - var secs = 0; - var pos = 0; - for (var i=0; i [ month_id , how many chars to skip if month in long form ] - "Jan": [0, 4], - "Feb": [1, 5], - "Mar": [2, 2], - "Apr": [3, 2], - "May": [4, 0], - "Jun": [5, 1], - "Jul": [6, 1], - "Aug": [7, 3], - "Sep": [8, 6], - "Oct": [9, 4], - "Nov": [10, 5], - "Dec": [11, 4], - "jan": [0, 4], - "feb": [1, 5], - "mar": [2, 2], - "apr": [3, 2], - "may": [4, 0], - "jun": [5, 1], - "jul": [6, 1], - "aug": [7, 3], - "sep": [8, 6], - "oct": [9, 4], - "nov": [10, 5], - "dec": [11, 4], - }; - - // var dC = undefined; - var dR = dateMonthName(true); - var dB = dateMonthName(false); - var dM = dateFixedWidthNumber("M", 2, 1, 12, DateContainer.prototype.setMonth); - var dG = dateVariableWidthNumber("G", 1, 12, DateContainer.prototype.setMonth); - var dD = dateFixedWidthNumber("D", 2, 1, 31, DateContainer.prototype.setDay); - var dF = dateVariableWidthNumber("F", 1, 31, DateContainer.prototype.setDay); - var dH = dateFixedWidthNumber("H", 2, 0, 24, DateContainer.prototype.setHours); - var dI = dateVariableWidthNumber("I", 0, 24, DateContainer.prototype.setHours); // Accept hours >12 - var dN = dateVariableWidthNumber("N", 0, 24, DateContainer.prototype.setHours); - var dT = dateFixedWidthNumber("T", 2, 0, 59, DateContainer.prototype.setMinutes); - var dU = dateVariableWidthNumber("U", 0, 59, DateContainer.prototype.setMinutes); - var dP = parseAMPM; // AM|PM - var dQ = parseAMPM; // A.M.|P.M - var dS = dateFixedWidthNumber("S", 2, 0, 60, DateContainer.prototype.setSeconds); - var dO = dateVariableWidthNumber("O", 0, 60, DateContainer.prototype.setSeconds); - var dY = dateFixedWidthNumber("Y", 2, 0, 99, DateContainer.prototype.set2DigitYear); - var dW = dateFixedWidthNumber("W", 4, 1000, 9999, DateContainer.prototype.setYear); - var dZ = parseHMS; - var dX = dateVariableWidthNumber("X", 0, 0x10000000000, DateContainer.prototype.setUNIX); - - // parseAMPM parses "A.M", "AM", "P.M", "PM" from logs. - // Only works if this modifier appears after the hour has been read from logs - // which is always the case in the 300 devices. - function parseAMPM(str, pos, date) { - var n = str.length; - var start = skipws(str, pos); - if (start + 2 > n) return; - var head = str.substr(start, 2).toUpperCase(); - var isPM = false; - var skip = false; - switch (head) { - case "A.": - skip = true; - /* falls through */ - case "AM": - break; - case "P.": - skip = true; - /* falls through */ - case "PM": - isPM = true; - break; - default: - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(head:" + head + ")"); - return; - } - pos = start + 2; - if (skip) { - if (pos+2 > n || str.substr(pos, 2).toUpperCase() !== "M.") { - if (debug) console.warn("can't parse pos " + start + " as AM/PM: " + str + "(tail)"); - return; - } - pos += 2; - } - var hh = date.hours; - if (isPM) { - // Accept existing hour in 24h format. - if (hh < 12) hh += 12; - } else { - if (hh === 12) hh = 0; - } - date.setHours(hh); - return pos; - } - - function parseHMS(str, pos, date) { - return date_time_try_pattern_at_pos([dN, dc(":"), dU, dc(":"), dO], str, pos, date); - } - - function skipws(str, pos) { - for ( var n = str.length; - pos < n && str.charAt(pos) === " "; - pos++) - ; - return pos; - } - - function skipdigits(str, pos) { - var c; - for (var n = str.length; - pos < n && (c = str.charAt(pos)) >= "0" && c <= "9"; - pos++) - ; - return pos; - } - - function dSkip(str, pos, date) { - var chr; - for (;pos < str.length && (chr=str[pos])<'0' || chr>'9'; pos++) {} - return pos < str.length? pos : undefined; - } - - function dateVariableWidthNumber(fmtChar, min, max, setter) { - return function (str, pos, date) { - var start = skipws(str, pos); - pos = skipdigits(str, start); - var s = str.substr(start, pos - start); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos; - } - return; - }; - } - - function dateFixedWidthNumber(fmtChar, width, min, max, setter) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + width > n) return; - var s = str.substr(pos, width); - var value = parseInt(s, 10); - if (value >= min && value <= max) { - setter.call(date, value); - return pos + width; - } - return; - }; - } - - // Short month name (Jan..Dec). - function dateMonthName(long) { - return function (str, pos, date) { - pos = skipws(str, pos); - var n = str.length; - if (pos + 3 > n) return; - var mon = str.substr(pos, 3); - var idx = shortMonths[mon]; - if (idx === undefined) { - idx = shortMonths[mon.toLowerCase()]; - } - if (idx === undefined) { - //console.warn("parsing date_time: '" + mon + "' is not a valid short month (%B)"); - return; - } - date.setMonth(idx[0]+1); - return pos + 3 + (long ? idx[1] : 0); - }; - } - - function url_wrapper(dst, src, fn) { - return function(evt) { - var value = evt.Get(FIELDS_PREFIX + src), result; - if (value != null && (result = fn(value))!== undefined) { - evt.Put(FIELDS_PREFIX + dst, result); - } else { - console.debug(fn.name + " failed for '" + value + "'"); - } - }; - } - - // The following regular expression for parsing URLs from: - // https://github.com/wizard04wsu/URI_Parsing - // - // The MIT License (MIT) - // - // Copyright (c) 2014 Andrew Harrison - // - // Permission is hereby granted, free of charge, to any person obtaining a copy of - // this software and associated documentation files (the "Software"), to deal in - // the Software without restriction, including without limitation the rights to - // use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of - // the Software, and to permit persons to whom the Software is furnished to do so, - // subject to the following conditions: - // - // The above copyright notice and this permission notice shall be included in all - // copies or substantial portions of the Software. - // - // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - // IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS - // FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR - // COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER - // IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN - // CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - var uriRegExp = /^([a-z][a-z0-9+.\-]*):(?:\/\/((?:(?=((?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9A-F]{2})*))(\3)@)?(?=(\[[0-9A-F:.]{2,}\]|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9A-F]{2})*))\5(?::(?=(\d*))\6)?)(\/(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\8)?|(\/?(?!\/)(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/]|%[0-9A-F]{2})*))\10)?)(?:\?(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\11)?(?:#(?=((?:[a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9A-F]{2})*))\12)?$/i; - - var uriScheme = 1; - var uriDomain = 5; - var uriPort = 6; - var uriPath = 7; - var uriPathAlt = 9; - var uriQuery = 11; - - function domain(dst, src) { - return url_wrapper(dst, src, extract_domain); - } - - function split_url(value) { - var m = value.match(uriRegExp); - if (m && m[uriDomain]) return m; - // Support input in the form "www.example.net/path", but not "/path". - m = ("null://" + value).match(uriRegExp); - if (m) return m; - } - - function extract_domain(value) { - var m = split_url(value); - if (m && m[uriDomain]) return m[uriDomain]; - } - - var extFromPage = /\.[^.]+$/; - function extract_ext(value) { - var page = extract_page(value); - if (page) { - var m = page.match(extFromPage); - if (m) return m[0]; - } - } - - function ext(dst, src) { - return url_wrapper(dst, src, extract_ext); - } - - function fqdn(dst, src) { - // TODO: fqdn and domain(eTLD+1) are currently the same. - return domain(dst, src); - } - - var pageFromPathRegExp = /\/([^\/]+)$/; - var pageName = 1; - - function extract_page(value) { - value = extract_path(value); - if (!value) return undefined; - var m = value.match(pageFromPathRegExp); - if (m) return m[pageName]; - } - - function page(dst, src) { - return url_wrapper(dst, src, extract_page); - } - - function extract_path(value) { - var m = split_url(value); - return m? m[uriPath] || m[uriPathAlt] : undefined; - } - - function path(dst, src) { - return url_wrapper(dst, src, extract_path); - } - - // Map common schemes to their default port. - // port has to be a string (will be converted at a later stage). - var schemePort = { - "ftp": "21", - "ssh": "22", - "http": "80", - "https": "443", - }; - - function extract_port(value) { - var m = split_url(value); - if (!m) return undefined; - if (m[uriPort]) return m[uriPort]; - if (m[uriScheme]) { - return schemePort[m[uriScheme]]; - } - } - - function port(dst, src) { - return url_wrapper(dst, src, extract_port); - } - - function extract_query(value) { - var m = split_url(value); - if (m && m[uriQuery]) return m[uriQuery]; - } - - function query(dst, src) { - return url_wrapper(dst, src, extract_query); - } - - function extract_root(value) { - var m = split_url(value); - if (m && m[uriDomain] && m[uriDomain]) { - var scheme = m[uriScheme] && m[uriScheme] !== "null"? - m[uriScheme] + "://" : ""; - var port = m[uriPort]? ":" + m[uriPort] : ""; - return scheme + m[uriDomain] + port; - } - } - - function root(dst, src) { - return url_wrapper(dst, src, extract_root); - } - - function tagval(id, src, cfg, keys, on_success) { - var fail = function(evt) { - evt.Put(FLAG_FIELD, "tagval_parsing_error"); - } - if (cfg.kv_separator.length !== 1) { - throw("Invalid TAGVALMAP ValueDelimiter (must have 1 character)"); - } - var quotes_len = cfg.open_quote.length > 0 && cfg.close_quote.length > 0? - cfg.open_quote.length + cfg.close_quote.length : 0; - var kv_regex = new RegExp('^([^' + cfg.kv_separator + ']*)*' + cfg.kv_separator + ' *(.*)*$'); - return function(evt) { - var msg = evt.Get(src); - if (msg === undefined) { - console.warn("tagval: input field is missing"); - return fail(evt); - } - var pairs = msg.split(cfg.pair_separator); - var i; - var success = false; - var prev = ""; - for (i=0; i 0 && - value.length >= cfg.open_quote.length + cfg.close_quote.length && - value.substr(0, cfg.open_quote.length) === cfg.open_quote && - value.substr(value.length - cfg.close_quote.length) === cfg.close_quote) { - value = value.substr(cfg.open_quote.length, value.length - quotes_len); - } - evt.Put(FIELDS_PREFIX + field, value); - success = true; - } - if (!success) { - return fail(evt); - } - if (on_success != null) { - on_success(evt); - } - } - } - - var ecs_mappings = { - "_facility": {convert: to_long, to:[{field: "log.syslog.facility.code", setter: fld_set}]}, - "_pri": {convert: to_long, to:[{field: "log.syslog.priority", setter: fld_set}]}, - "_severity": {convert: to_long, to:[{field: "log.syslog.severity.code", setter: fld_set}]}, - "action": {to:[{field: "event.action", setter: fld_prio, prio: 0}]}, - "administrator": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 4}]}, - "alias.ip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 3},{field: "related.ip", setter: fld_append}]}, - "alias.ipv6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 4},{field: "related.ip", setter: fld_append}]}, - "alias.mac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 1}]}, - "application": {to:[{field: "network.application", setter: fld_set}]}, - "bytes": {convert: to_long, to:[{field: "network.bytes", setter: fld_set}]}, - "c_domain": {to:[{field: "source.domain", setter: fld_prio, prio: 1}]}, - "c_logon_id": {to:[{field: "user.id", setter: fld_prio, prio: 2}]}, - "c_user_name": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 8}]}, - "c_username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 2}]}, - "cctld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 1}]}, - "child_pid": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 1}]}, - "child_pid_val": {to:[{field: "process.title", setter: fld_set}]}, - "child_process": {to:[{field: "process.name", setter: fld_prio, prio: 1}]}, - "city.dst": {to:[{field: "destination.geo.city_name", setter: fld_set}]}, - "city.src": {to:[{field: "source.geo.city_name", setter: fld_set}]}, - "daddr": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "daddr_v6": {convert: to_ip, to:[{field: "destination.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "ddomain": {to:[{field: "destination.domain", setter: fld_prio, prio: 0}]}, - "devicehostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "devicehostmac": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 0}]}, - "dhost": {to:[{field: "destination.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "dinterface": {to:[{field: "observer.egress.interface.name", setter: fld_set}]}, - "direction": {to:[{field: "network.direction", setter: fld_set}]}, - "directory": {to:[{field: "file.directory", setter: fld_set}]}, - "dmacaddr": {convert: to_mac, to:[{field: "destination.mac", setter: fld_set}]}, - "dns.responsetype": {to:[{field: "dns.answers.type", setter: fld_set}]}, - "dns.resptext": {to:[{field: "dns.answers.name", setter: fld_set}]}, - "dns_querytype": {to:[{field: "dns.question.type", setter: fld_set}]}, - "domain": {to:[{field: "server.domain", setter: fld_prio, prio: 0},{field: "related.hosts", setter: fld_append}]}, - "domain.dst": {to:[{field: "destination.domain", setter: fld_prio, prio: 1}]}, - "domain.src": {to:[{field: "source.domain", setter: fld_prio, prio: 2}]}, - "domain_id": {to:[{field: "user.domain", setter: fld_set}]}, - "domainname": {to:[{field: "server.domain", setter: fld_prio, prio: 1}]}, - "dport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 0}]}, - "dtransaddr": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "dtransport": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 0}]}, - "ec_outcome": {to:[{field: "event.outcome", setter: fld_ecs_outcome}]}, - "event_description": {to:[{field: "message", setter: fld_prio, prio: 0}]}, - "event_source": {to:[{field: "related.hosts", setter: fld_append}]}, - "event_time": {convert: to_date, to:[{field: "@timestamp", setter: fld_set}]}, - "event_type": {to:[{field: "event.action", setter: fld_prio, prio: 1}]}, - "extension": {to:[{field: "file.extension", setter: fld_prio, prio: 1}]}, - "file.attributes": {to:[{field: "file.attributes", setter: fld_set}]}, - "filename": {to:[{field: "file.name", setter: fld_prio, prio: 0}]}, - "filename_size": {convert: to_long, to:[{field: "file.size", setter: fld_set}]}, - "filepath": {to:[{field: "file.path", setter: fld_set}]}, - "filetype": {to:[{field: "file.type", setter: fld_set}]}, - "fqdn": {to:[{field: "related.hosts", setter: fld_append}]}, - "group": {to:[{field: "group.name", setter: fld_set}]}, - "groupid": {to:[{field: "group.id", setter: fld_set}]}, - "host": {to:[{field: "host.name", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "hostip": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "hostip_v6": {convert: to_ip, to:[{field: "host.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "hostname": {to:[{field: "host.name", setter: fld_prio, prio: 0}]}, - "id": {to:[{field: "event.code", setter: fld_prio, prio: 0}]}, - "interface": {to:[{field: "network.interface.name", setter: fld_set}]}, - "ip.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "ip.trans.dst": {convert: to_ip, to:[{field: "destination.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ip.trans.src": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "ipv6.orig": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 2},{field: "related.ip", setter: fld_append}]}, - "latdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lat", setter: fld_set}]}, - "latdec_src": {convert: to_double, to:[{field: "source.geo.location.lat", setter: fld_set}]}, - "location_city": {to:[{field: "geo.city_name", setter: fld_set}]}, - "location_country": {to:[{field: "geo.country_name", setter: fld_set}]}, - "location_desc": {to:[{field: "geo.name", setter: fld_set}]}, - "location_dst": {to:[{field: "destination.geo.country_name", setter: fld_set}]}, - "location_src": {to:[{field: "source.geo.country_name", setter: fld_set}]}, - "location_state": {to:[{field: "geo.region_name", setter: fld_set}]}, - "logon_id": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 5}]}, - "longdec_dst": {convert: to_double, to:[{field: "destination.geo.location.lon", setter: fld_set}]}, - "longdec_src": {convert: to_double, to:[{field: "source.geo.location.lon", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "host.mac", setter: fld_prio, prio: 2}]}, - "messageid": {to:[{field: "event.code", setter: fld_prio, prio: 1}]}, - "method": {to:[{field: "http.request.method", setter: fld_set}]}, - "msg": {to:[{field: "message", setter: fld_set}]}, - "orig_ip": {convert: to_ip, to:[{field: "network.forwarded_ip", setter: fld_prio, prio: 1},{field: "related.ip", setter: fld_append}]}, - "owner": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 6}]}, - "packets": {convert: to_long, to:[{field: "network.packets", setter: fld_set}]}, - "parent_pid": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 0}]}, - "parent_pid_val": {to:[{field: "process.parent.title", setter: fld_set}]}, - "parent_process": {to:[{field: "process.parent.name", setter: fld_prio, prio: 0}]}, - "patient_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 1}]}, - "port.dst": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 1}]}, - "port.src": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 1}]}, - "port.trans.dst": {convert: to_long, to:[{field: "destination.nat.port", setter: fld_prio, prio: 1}]}, - "port.trans.src": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 1}]}, - "process": {to:[{field: "process.name", setter: fld_prio, prio: 0}]}, - "process_id": {convert: to_long, to:[{field: "process.pid", setter: fld_prio, prio: 0}]}, - "process_id_src": {convert: to_long, to:[{field: "process.parent.pid", setter: fld_prio, prio: 1}]}, - "process_src": {to:[{field: "process.parent.name", setter: fld_prio, prio: 1}]}, - "product": {to:[{field: "observer.product", setter: fld_set}]}, - "protocol": {to:[{field: "network.protocol", setter: fld_set}]}, - "query": {to:[{field: "url.query", setter: fld_prio, prio: 2}]}, - "rbytes": {convert: to_long, to:[{field: "destination.bytes", setter: fld_set}]}, - "referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 1}]}, - "rulename": {to:[{field: "rule.name", setter: fld_set}]}, - "saddr": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "saddr_v6": {convert: to_ip, to:[{field: "source.ip", setter: fld_set},{field: "related.ip", setter: fld_append}]}, - "sbytes": {convert: to_long, to:[{field: "source.bytes", setter: fld_set}]}, - "sdomain": {to:[{field: "source.domain", setter: fld_prio, prio: 0}]}, - "service": {to:[{field: "service.name", setter: fld_prio, prio: 1}]}, - "service.name": {to:[{field: "service.name", setter: fld_prio, prio: 0}]}, - "service_account": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 7}]}, - "severity": {to:[{field: "log.level", setter: fld_set}]}, - "shost": {to:[{field: "host.hostname", setter: fld_set},{field: "source.address", setter: fld_set},{field: "related.hosts", setter: fld_append}]}, - "sinterface": {to:[{field: "observer.ingress.interface.name", setter: fld_set}]}, - "sld": {to:[{field: "url.registered_domain", setter: fld_set}]}, - "smacaddr": {convert: to_mac, to:[{field: "source.mac", setter: fld_set}]}, - "sport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 0}]}, - "stransaddr": {convert: to_ip, to:[{field: "source.nat.ip", setter: fld_prio, prio: 0},{field: "related.ip", setter: fld_append}]}, - "stransport": {convert: to_long, to:[{field: "source.nat.port", setter: fld_prio, prio: 0}]}, - "tcp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 2}]}, - "tcp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 2}]}, - "timezone": {to:[{field: "event.timezone", setter: fld_set}]}, - "tld": {to:[{field: "url.top_level_domain", setter: fld_prio, prio: 0}]}, - "udp.dstport": {convert: to_long, to:[{field: "destination.port", setter: fld_prio, prio: 3}]}, - "udp.srcport": {convert: to_long, to:[{field: "source.port", setter: fld_prio, prio: 3}]}, - "uid": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 3}]}, - "url": {to:[{field: "url.original", setter: fld_prio, prio: 1}]}, - "url_raw": {to:[{field: "url.original", setter: fld_prio, prio: 0}]}, - "urldomain": {to:[{field: "url.domain", setter: fld_prio, prio: 0}]}, - "urlquery": {to:[{field: "url.query", setter: fld_prio, prio: 0}]}, - "user": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 0}]}, - "user.id": {to:[{field: "user.id", setter: fld_prio, prio: 1}]}, - "user_agent": {to:[{field: "user_agent.original", setter: fld_set}]}, - "user_fullname": {to:[{field: "user.full_name", setter: fld_prio, prio: 0}]}, - "user_id": {to:[{field: "user.id", setter: fld_prio, prio: 0}]}, - "username": {to:[{field: "related.user", setter: fld_append},{field: "user.name", setter: fld_prio, prio: 1}]}, - "version": {to:[{field: "observer.version", setter: fld_set}]}, - "web_domain": {to:[{field: "url.domain", setter: fld_prio, prio: 1},{field: "related.hosts", setter: fld_append}]}, - "web_extension": {to:[{field: "file.extension", setter: fld_prio, prio: 0}]}, - "web_query": {to:[{field: "url.query", setter: fld_prio, prio: 1}]}, - "web_ref_domain": {to:[{field: "related.hosts", setter: fld_append}]}, - "web_referer": {to:[{field: "http.request.referrer", setter: fld_prio, prio: 0}]}, - "web_root": {to:[{field: "url.path", setter: fld_set}]}, - "webpage": {to:[{field: "file.name", setter: fld_prio, prio: 1}]}, - }; - - var rsa_mappings = { - "access_point": {to:[{field: "rsa.wireless.access_point", setter: fld_set}]}, - "accesses": {to:[{field: "rsa.identity.accesses", setter: fld_set}]}, - "acl_id": {to:[{field: "rsa.misc.acl_id", setter: fld_set}]}, - "acl_op": {to:[{field: "rsa.misc.acl_op", setter: fld_set}]}, - "acl_pos": {to:[{field: "rsa.misc.acl_pos", setter: fld_set}]}, - "acl_table": {to:[{field: "rsa.misc.acl_table", setter: fld_set}]}, - "action": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "ad_computer_dst": {to:[{field: "rsa.network.ad_computer_dst", setter: fld_set}]}, - "addr": {to:[{field: "rsa.network.addr", setter: fld_set}]}, - "admin": {to:[{field: "rsa.misc.admin", setter: fld_set}]}, - "agent": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 0}]}, - "agent.id": {to:[{field: "rsa.misc.agent_id", setter: fld_set}]}, - "alarm_id": {to:[{field: "rsa.misc.alarm_id", setter: fld_set}]}, - "alarmname": {to:[{field: "rsa.misc.alarmname", setter: fld_set}]}, - "alert": {to:[{field: "rsa.threat.alert", setter: fld_set}]}, - "alert_id": {to:[{field: "rsa.misc.alert_id", setter: fld_set}]}, - "alias.host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "analysis.file": {to:[{field: "rsa.investigations.analysis_file", setter: fld_set}]}, - "analysis.service": {to:[{field: "rsa.investigations.analysis_service", setter: fld_set}]}, - "analysis.session": {to:[{field: "rsa.investigations.analysis_session", setter: fld_set}]}, - "app_id": {to:[{field: "rsa.misc.app_id", setter: fld_set}]}, - "attachment": {to:[{field: "rsa.file.attachment", setter: fld_set}]}, - "audit": {to:[{field: "rsa.misc.audit", setter: fld_set}]}, - "audit_class": {to:[{field: "rsa.internal.audit_class", setter: fld_set}]}, - "audit_object": {to:[{field: "rsa.misc.audit_object", setter: fld_set}]}, - "auditdata": {to:[{field: "rsa.misc.auditdata", setter: fld_set}]}, - "authmethod": {to:[{field: "rsa.identity.auth_method", setter: fld_set}]}, - "autorun_type": {to:[{field: "rsa.misc.autorun_type", setter: fld_set}]}, - "bcc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "benchmark": {to:[{field: "rsa.misc.benchmark", setter: fld_set}]}, - "binary": {to:[{field: "rsa.file.binary", setter: fld_set}]}, - "boc": {to:[{field: "rsa.investigations.boc", setter: fld_set}]}, - "bssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 1}]}, - "bypass": {to:[{field: "rsa.misc.bypass", setter: fld_set}]}, - "c_sid": {to:[{field: "rsa.identity.user_sid_src", setter: fld_set}]}, - "cache": {to:[{field: "rsa.misc.cache", setter: fld_set}]}, - "cache_hit": {to:[{field: "rsa.misc.cache_hit", setter: fld_set}]}, - "calling_from": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 1}]}, - "calling_to": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 0}]}, - "category": {to:[{field: "rsa.misc.category", setter: fld_set}]}, - "cc": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "cc.number": {convert: to_long, to:[{field: "rsa.misc.cc_number", setter: fld_set}]}, - "cefversion": {to:[{field: "rsa.misc.cefversion", setter: fld_set}]}, - "cert.serial": {to:[{field: "rsa.crypto.cert_serial", setter: fld_set}]}, - "cert_ca": {to:[{field: "rsa.crypto.cert_ca", setter: fld_set}]}, - "cert_checksum": {to:[{field: "rsa.crypto.cert_checksum", setter: fld_set}]}, - "cert_common": {to:[{field: "rsa.crypto.cert_common", setter: fld_set}]}, - "cert_error": {to:[{field: "rsa.crypto.cert_error", setter: fld_set}]}, - "cert_hostname": {to:[{field: "rsa.crypto.cert_host_name", setter: fld_set}]}, - "cert_hostname_cat": {to:[{field: "rsa.crypto.cert_host_cat", setter: fld_set}]}, - "cert_issuer": {to:[{field: "rsa.crypto.cert_issuer", setter: fld_set}]}, - "cert_keysize": {to:[{field: "rsa.crypto.cert_keysize", setter: fld_set}]}, - "cert_status": {to:[{field: "rsa.crypto.cert_status", setter: fld_set}]}, - "cert_subject": {to:[{field: "rsa.crypto.cert_subject", setter: fld_set}]}, - "cert_username": {to:[{field: "rsa.crypto.cert_username", setter: fld_set}]}, - "cfg.attr": {to:[{field: "rsa.misc.cfg_attr", setter: fld_set}]}, - "cfg.obj": {to:[{field: "rsa.misc.cfg_obj", setter: fld_set}]}, - "cfg.path": {to:[{field: "rsa.misc.cfg_path", setter: fld_set}]}, - "change_attribute": {to:[{field: "rsa.misc.change_attrib", setter: fld_set}]}, - "change_new": {to:[{field: "rsa.misc.change_new", setter: fld_set}]}, - "change_old": {to:[{field: "rsa.misc.change_old", setter: fld_set}]}, - "changes": {to:[{field: "rsa.misc.changes", setter: fld_set}]}, - "checksum": {to:[{field: "rsa.misc.checksum", setter: fld_set}]}, - "checksum.dst": {to:[{field: "rsa.misc.checksum_dst", setter: fld_set}]}, - "checksum.src": {to:[{field: "rsa.misc.checksum_src", setter: fld_set}]}, - "cid": {to:[{field: "rsa.internal.cid", setter: fld_set}]}, - "client": {to:[{field: "rsa.misc.client", setter: fld_prio, prio: 1}]}, - "client_ip": {to:[{field: "rsa.misc.client_ip", setter: fld_set}]}, - "clustermembers": {to:[{field: "rsa.misc.clustermembers", setter: fld_set}]}, - "cmd": {to:[{field: "rsa.misc.cmd", setter: fld_set}]}, - "cn_acttimeout": {to:[{field: "rsa.misc.cn_acttimeout", setter: fld_set}]}, - "cn_asn_dst": {to:[{field: "rsa.web.cn_asn_dst", setter: fld_set}]}, - "cn_asn_src": {to:[{field: "rsa.misc.cn_asn_src", setter: fld_set}]}, - "cn_bgpv4nxthop": {to:[{field: "rsa.misc.cn_bgpv4nxthop", setter: fld_set}]}, - "cn_ctr_dst_code": {to:[{field: "rsa.misc.cn_ctr_dst_code", setter: fld_set}]}, - "cn_dst_tos": {to:[{field: "rsa.misc.cn_dst_tos", setter: fld_set}]}, - "cn_dst_vlan": {to:[{field: "rsa.misc.cn_dst_vlan", setter: fld_set}]}, - "cn_engine_id": {to:[{field: "rsa.misc.cn_engine_id", setter: fld_set}]}, - "cn_engine_type": {to:[{field: "rsa.misc.cn_engine_type", setter: fld_set}]}, - "cn_f_switch": {to:[{field: "rsa.misc.cn_f_switch", setter: fld_set}]}, - "cn_flowsampid": {to:[{field: "rsa.misc.cn_flowsampid", setter: fld_set}]}, - "cn_flowsampintv": {to:[{field: "rsa.misc.cn_flowsampintv", setter: fld_set}]}, - "cn_flowsampmode": {to:[{field: "rsa.misc.cn_flowsampmode", setter: fld_set}]}, - "cn_inacttimeout": {to:[{field: "rsa.misc.cn_inacttimeout", setter: fld_set}]}, - "cn_inpermbyts": {to:[{field: "rsa.misc.cn_inpermbyts", setter: fld_set}]}, - "cn_inpermpckts": {to:[{field: "rsa.misc.cn_inpermpckts", setter: fld_set}]}, - "cn_invalid": {to:[{field: "rsa.misc.cn_invalid", setter: fld_set}]}, - "cn_ip_proto_ver": {to:[{field: "rsa.misc.cn_ip_proto_ver", setter: fld_set}]}, - "cn_ipv4_ident": {to:[{field: "rsa.misc.cn_ipv4_ident", setter: fld_set}]}, - "cn_l_switch": {to:[{field: "rsa.misc.cn_l_switch", setter: fld_set}]}, - "cn_log_did": {to:[{field: "rsa.misc.cn_log_did", setter: fld_set}]}, - "cn_log_rid": {to:[{field: "rsa.misc.cn_log_rid", setter: fld_set}]}, - "cn_max_ttl": {to:[{field: "rsa.misc.cn_max_ttl", setter: fld_set}]}, - "cn_maxpcktlen": {to:[{field: "rsa.misc.cn_maxpcktlen", setter: fld_set}]}, - "cn_min_ttl": {to:[{field: "rsa.misc.cn_min_ttl", setter: fld_set}]}, - "cn_minpcktlen": {to:[{field: "rsa.misc.cn_minpcktlen", setter: fld_set}]}, - "cn_mpls_lbl_1": {to:[{field: "rsa.misc.cn_mpls_lbl_1", setter: fld_set}]}, - "cn_mpls_lbl_10": {to:[{field: "rsa.misc.cn_mpls_lbl_10", setter: fld_set}]}, - "cn_mpls_lbl_2": {to:[{field: "rsa.misc.cn_mpls_lbl_2", setter: fld_set}]}, - "cn_mpls_lbl_3": {to:[{field: "rsa.misc.cn_mpls_lbl_3", setter: fld_set}]}, - "cn_mpls_lbl_4": {to:[{field: "rsa.misc.cn_mpls_lbl_4", setter: fld_set}]}, - "cn_mpls_lbl_5": {to:[{field: "rsa.misc.cn_mpls_lbl_5", setter: fld_set}]}, - "cn_mpls_lbl_6": {to:[{field: "rsa.misc.cn_mpls_lbl_6", setter: fld_set}]}, - "cn_mpls_lbl_7": {to:[{field: "rsa.misc.cn_mpls_lbl_7", setter: fld_set}]}, - "cn_mpls_lbl_8": {to:[{field: "rsa.misc.cn_mpls_lbl_8", setter: fld_set}]}, - "cn_mpls_lbl_9": {to:[{field: "rsa.misc.cn_mpls_lbl_9", setter: fld_set}]}, - "cn_mplstoplabel": {to:[{field: "rsa.misc.cn_mplstoplabel", setter: fld_set}]}, - "cn_mplstoplabip": {to:[{field: "rsa.misc.cn_mplstoplabip", setter: fld_set}]}, - "cn_mul_dst_byt": {to:[{field: "rsa.misc.cn_mul_dst_byt", setter: fld_set}]}, - "cn_mul_dst_pks": {to:[{field: "rsa.misc.cn_mul_dst_pks", setter: fld_set}]}, - "cn_muligmptype": {to:[{field: "rsa.misc.cn_muligmptype", setter: fld_set}]}, - "cn_rpackets": {to:[{field: "rsa.web.cn_rpackets", setter: fld_set}]}, - "cn_sampalgo": {to:[{field: "rsa.misc.cn_sampalgo", setter: fld_set}]}, - "cn_sampint": {to:[{field: "rsa.misc.cn_sampint", setter: fld_set}]}, - "cn_seqctr": {to:[{field: "rsa.misc.cn_seqctr", setter: fld_set}]}, - "cn_spackets": {to:[{field: "rsa.misc.cn_spackets", setter: fld_set}]}, - "cn_src_tos": {to:[{field: "rsa.misc.cn_src_tos", setter: fld_set}]}, - "cn_src_vlan": {to:[{field: "rsa.misc.cn_src_vlan", setter: fld_set}]}, - "cn_sysuptime": {to:[{field: "rsa.misc.cn_sysuptime", setter: fld_set}]}, - "cn_template_id": {to:[{field: "rsa.misc.cn_template_id", setter: fld_set}]}, - "cn_totbytsexp": {to:[{field: "rsa.misc.cn_totbytsexp", setter: fld_set}]}, - "cn_totflowexp": {to:[{field: "rsa.misc.cn_totflowexp", setter: fld_set}]}, - "cn_totpcktsexp": {to:[{field: "rsa.misc.cn_totpcktsexp", setter: fld_set}]}, - "cn_unixnanosecs": {to:[{field: "rsa.misc.cn_unixnanosecs", setter: fld_set}]}, - "cn_v6flowlabel": {to:[{field: "rsa.misc.cn_v6flowlabel", setter: fld_set}]}, - "cn_v6optheaders": {to:[{field: "rsa.misc.cn_v6optheaders", setter: fld_set}]}, - "code": {to:[{field: "rsa.misc.code", setter: fld_set}]}, - "command": {to:[{field: "rsa.misc.command", setter: fld_set}]}, - "comments": {to:[{field: "rsa.misc.comments", setter: fld_set}]}, - "comp_class": {to:[{field: "rsa.misc.comp_class", setter: fld_set}]}, - "comp_name": {to:[{field: "rsa.misc.comp_name", setter: fld_set}]}, - "comp_rbytes": {to:[{field: "rsa.misc.comp_rbytes", setter: fld_set}]}, - "comp_sbytes": {to:[{field: "rsa.misc.comp_sbytes", setter: fld_set}]}, - "component_version": {to:[{field: "rsa.misc.comp_version", setter: fld_set}]}, - "connection_id": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 1}]}, - "connectionid": {to:[{field: "rsa.misc.connection_id", setter: fld_prio, prio: 0}]}, - "content": {to:[{field: "rsa.misc.content", setter: fld_set}]}, - "content_type": {to:[{field: "rsa.misc.content_type", setter: fld_set}]}, - "content_version": {to:[{field: "rsa.misc.content_version", setter: fld_set}]}, - "context": {to:[{field: "rsa.misc.context", setter: fld_set}]}, - "count": {to:[{field: "rsa.misc.count", setter: fld_set}]}, - "cpu": {convert: to_long, to:[{field: "rsa.misc.cpu", setter: fld_set}]}, - "cpu_data": {to:[{field: "rsa.misc.cpu_data", setter: fld_set}]}, - "criticality": {to:[{field: "rsa.misc.criticality", setter: fld_set}]}, - "cs_agency_dst": {to:[{field: "rsa.misc.cs_agency_dst", setter: fld_set}]}, - "cs_analyzedby": {to:[{field: "rsa.misc.cs_analyzedby", setter: fld_set}]}, - "cs_av_other": {to:[{field: "rsa.misc.cs_av_other", setter: fld_set}]}, - "cs_av_primary": {to:[{field: "rsa.misc.cs_av_primary", setter: fld_set}]}, - "cs_av_secondary": {to:[{field: "rsa.misc.cs_av_secondary", setter: fld_set}]}, - "cs_bgpv6nxthop": {to:[{field: "rsa.misc.cs_bgpv6nxthop", setter: fld_set}]}, - "cs_bit9status": {to:[{field: "rsa.misc.cs_bit9status", setter: fld_set}]}, - "cs_context": {to:[{field: "rsa.misc.cs_context", setter: fld_set}]}, - "cs_control": {to:[{field: "rsa.misc.cs_control", setter: fld_set}]}, - "cs_data": {to:[{field: "rsa.misc.cs_data", setter: fld_set}]}, - "cs_datecret": {to:[{field: "rsa.misc.cs_datecret", setter: fld_set}]}, - "cs_dst_tld": {to:[{field: "rsa.misc.cs_dst_tld", setter: fld_set}]}, - "cs_eth_dst_ven": {to:[{field: "rsa.misc.cs_eth_dst_ven", setter: fld_set}]}, - "cs_eth_src_ven": {to:[{field: "rsa.misc.cs_eth_src_ven", setter: fld_set}]}, - "cs_event_uuid": {to:[{field: "rsa.misc.cs_event_uuid", setter: fld_set}]}, - "cs_filetype": {to:[{field: "rsa.misc.cs_filetype", setter: fld_set}]}, - "cs_fld": {to:[{field: "rsa.misc.cs_fld", setter: fld_set}]}, - "cs_if_desc": {to:[{field: "rsa.misc.cs_if_desc", setter: fld_set}]}, - "cs_if_name": {to:[{field: "rsa.misc.cs_if_name", setter: fld_set}]}, - "cs_ip_next_hop": {to:[{field: "rsa.misc.cs_ip_next_hop", setter: fld_set}]}, - "cs_ipv4dstpre": {to:[{field: "rsa.misc.cs_ipv4dstpre", setter: fld_set}]}, - "cs_ipv4srcpre": {to:[{field: "rsa.misc.cs_ipv4srcpre", setter: fld_set}]}, - "cs_lifetime": {to:[{field: "rsa.misc.cs_lifetime", setter: fld_set}]}, - "cs_log_medium": {to:[{field: "rsa.misc.cs_log_medium", setter: fld_set}]}, - "cs_loginname": {to:[{field: "rsa.misc.cs_loginname", setter: fld_set}]}, - "cs_modulescore": {to:[{field: "rsa.misc.cs_modulescore", setter: fld_set}]}, - "cs_modulesign": {to:[{field: "rsa.misc.cs_modulesign", setter: fld_set}]}, - "cs_opswatresult": {to:[{field: "rsa.misc.cs_opswatresult", setter: fld_set}]}, - "cs_payload": {to:[{field: "rsa.misc.cs_payload", setter: fld_set}]}, - "cs_registrant": {to:[{field: "rsa.misc.cs_registrant", setter: fld_set}]}, - "cs_registrar": {to:[{field: "rsa.misc.cs_registrar", setter: fld_set}]}, - "cs_represult": {to:[{field: "rsa.misc.cs_represult", setter: fld_set}]}, - "cs_rpayload": {to:[{field: "rsa.misc.cs_rpayload", setter: fld_set}]}, - "cs_sampler_name": {to:[{field: "rsa.misc.cs_sampler_name", setter: fld_set}]}, - "cs_sourcemodule": {to:[{field: "rsa.misc.cs_sourcemodule", setter: fld_set}]}, - "cs_streams": {to:[{field: "rsa.misc.cs_streams", setter: fld_set}]}, - "cs_targetmodule": {to:[{field: "rsa.misc.cs_targetmodule", setter: fld_set}]}, - "cs_v6nxthop": {to:[{field: "rsa.misc.cs_v6nxthop", setter: fld_set}]}, - "cs_whois_server": {to:[{field: "rsa.misc.cs_whois_server", setter: fld_set}]}, - "cs_yararesult": {to:[{field: "rsa.misc.cs_yararesult", setter: fld_set}]}, - "cve": {to:[{field: "rsa.misc.cve", setter: fld_set}]}, - "d_certauth": {to:[{field: "rsa.crypto.d_certauth", setter: fld_set}]}, - "d_cipher": {to:[{field: "rsa.crypto.cipher_dst", setter: fld_set}]}, - "d_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_dst", setter: fld_set}]}, - "d_sslver": {to:[{field: "rsa.crypto.ssl_ver_dst", setter: fld_set}]}, - "data": {to:[{field: "rsa.internal.data", setter: fld_set}]}, - "data_type": {to:[{field: "rsa.misc.data_type", setter: fld_set}]}, - "date": {to:[{field: "rsa.time.date", setter: fld_set}]}, - "datetime": {to:[{field: "rsa.time.datetime", setter: fld_set}]}, - "day": {to:[{field: "rsa.time.day", setter: fld_set}]}, - "db_id": {to:[{field: "rsa.db.db_id", setter: fld_set}]}, - "db_name": {to:[{field: "rsa.db.database", setter: fld_set}]}, - "db_pid": {convert: to_long, to:[{field: "rsa.db.db_pid", setter: fld_set}]}, - "dclass_counter1": {convert: to_long, to:[{field: "rsa.counters.dclass_c1", setter: fld_set}]}, - "dclass_counter1_string": {to:[{field: "rsa.counters.dclass_c1_str", setter: fld_set}]}, - "dclass_counter2": {convert: to_long, to:[{field: "rsa.counters.dclass_c2", setter: fld_set}]}, - "dclass_counter2_string": {to:[{field: "rsa.counters.dclass_c2_str", setter: fld_set}]}, - "dclass_counter3": {convert: to_long, to:[{field: "rsa.counters.dclass_c3", setter: fld_set}]}, - "dclass_counter3_string": {to:[{field: "rsa.counters.dclass_c3_str", setter: fld_set}]}, - "dclass_ratio1": {to:[{field: "rsa.counters.dclass_r1", setter: fld_set}]}, - "dclass_ratio1_string": {to:[{field: "rsa.counters.dclass_r1_str", setter: fld_set}]}, - "dclass_ratio2": {to:[{field: "rsa.counters.dclass_r2", setter: fld_set}]}, - "dclass_ratio2_string": {to:[{field: "rsa.counters.dclass_r2_str", setter: fld_set}]}, - "dclass_ratio3": {to:[{field: "rsa.counters.dclass_r3", setter: fld_set}]}, - "dclass_ratio3_string": {to:[{field: "rsa.counters.dclass_r3_str", setter: fld_set}]}, - "dead": {convert: to_long, to:[{field: "rsa.internal.dead", setter: fld_set}]}, - "description": {to:[{field: "rsa.misc.description", setter: fld_set}]}, - "detail": {to:[{field: "rsa.misc.event_desc", setter: fld_set}]}, - "device": {to:[{field: "rsa.misc.device_name", setter: fld_set}]}, - "device.class": {to:[{field: "rsa.internal.device_class", setter: fld_set}]}, - "device.group": {to:[{field: "rsa.internal.device_group", setter: fld_set}]}, - "device.host": {to:[{field: "rsa.internal.device_host", setter: fld_set}]}, - "device.ip": {convert: to_ip, to:[{field: "rsa.internal.device_ip", setter: fld_set}]}, - "device.ipv6": {convert: to_ip, to:[{field: "rsa.internal.device_ipv6", setter: fld_set}]}, - "device.type": {to:[{field: "rsa.internal.device_type", setter: fld_set}]}, - "device.type.id": {convert: to_long, to:[{field: "rsa.internal.device_type_id", setter: fld_set}]}, - "devicehostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "devvendor": {to:[{field: "rsa.misc.devvendor", setter: fld_set}]}, - "dhost": {to:[{field: "rsa.network.host_dst", setter: fld_set}]}, - "did": {to:[{field: "rsa.internal.did", setter: fld_set}]}, - "dinterface": {to:[{field: "rsa.network.dinterface", setter: fld_set}]}, - "directory.dst": {to:[{field: "rsa.file.directory_dst", setter: fld_set}]}, - "directory.src": {to:[{field: "rsa.file.directory_src", setter: fld_set}]}, - "disk_volume": {to:[{field: "rsa.storage.disk_volume", setter: fld_set}]}, - "disposition": {to:[{field: "rsa.misc.disposition", setter: fld_set}]}, - "distance": {to:[{field: "rsa.misc.distance", setter: fld_set}]}, - "dmask": {to:[{field: "rsa.network.dmask", setter: fld_set}]}, - "dn": {to:[{field: "rsa.identity.dn", setter: fld_set}]}, - "dns_a_record": {to:[{field: "rsa.network.dns_a_record", setter: fld_set}]}, - "dns_cname_record": {to:[{field: "rsa.network.dns_cname_record", setter: fld_set}]}, - "dns_id": {to:[{field: "rsa.network.dns_id", setter: fld_set}]}, - "dns_opcode": {to:[{field: "rsa.network.dns_opcode", setter: fld_set}]}, - "dns_ptr_record": {to:[{field: "rsa.network.dns_ptr_record", setter: fld_set}]}, - "dns_resp": {to:[{field: "rsa.network.dns_resp", setter: fld_set}]}, - "dns_type": {to:[{field: "rsa.network.dns_type", setter: fld_set}]}, - "doc_number": {convert: to_long, to:[{field: "rsa.misc.doc_number", setter: fld_set}]}, - "domain": {to:[{field: "rsa.network.domain", setter: fld_set}]}, - "domain1": {to:[{field: "rsa.network.domain1", setter: fld_set}]}, - "dst_dn": {to:[{field: "rsa.identity.dn_dst", setter: fld_set}]}, - "dst_payload": {to:[{field: "rsa.misc.payload_dst", setter: fld_set}]}, - "dst_spi": {to:[{field: "rsa.misc.spi_dst", setter: fld_set}]}, - "dst_zone": {to:[{field: "rsa.network.zone_dst", setter: fld_set}]}, - "dstburb": {to:[{field: "rsa.misc.dstburb", setter: fld_set}]}, - "duration": {convert: to_double, to:[{field: "rsa.time.duration_time", setter: fld_set}]}, - "duration_string": {to:[{field: "rsa.time.duration_str", setter: fld_set}]}, - "ec_activity": {to:[{field: "rsa.investigations.ec_activity", setter: fld_set}]}, - "ec_outcome": {to:[{field: "rsa.investigations.ec_outcome", setter: fld_set}]}, - "ec_subject": {to:[{field: "rsa.investigations.ec_subject", setter: fld_set}]}, - "ec_theme": {to:[{field: "rsa.investigations.ec_theme", setter: fld_set}]}, - "edomain": {to:[{field: "rsa.misc.edomain", setter: fld_set}]}, - "edomaub": {to:[{field: "rsa.misc.edomaub", setter: fld_set}]}, - "effective_time": {convert: to_date, to:[{field: "rsa.time.effective_time", setter: fld_set}]}, - "ein.number": {convert: to_long, to:[{field: "rsa.misc.ein_number", setter: fld_set}]}, - "email": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "encryption_type": {to:[{field: "rsa.crypto.crypto", setter: fld_set}]}, - "endtime": {convert: to_date, to:[{field: "rsa.time.endtime", setter: fld_set}]}, - "entropy.req": {convert: to_long, to:[{field: "rsa.internal.entropy_req", setter: fld_set}]}, - "entropy.res": {convert: to_long, to:[{field: "rsa.internal.entropy_res", setter: fld_set}]}, - "entry": {to:[{field: "rsa.internal.entry", setter: fld_set}]}, - "eoc": {to:[{field: "rsa.investigations.eoc", setter: fld_set}]}, - "error": {to:[{field: "rsa.misc.error", setter: fld_set}]}, - "eth_type": {convert: to_long, to:[{field: "rsa.network.eth_type", setter: fld_set}]}, - "euid": {to:[{field: "rsa.misc.euid", setter: fld_set}]}, - "event.cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 1}]}, - "event.cat.name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 1}]}, - "event_cat": {convert: to_long, to:[{field: "rsa.investigations.event_cat", setter: fld_prio, prio: 0}]}, - "event_cat_name": {to:[{field: "rsa.investigations.event_cat_name", setter: fld_prio, prio: 0}]}, - "event_category": {to:[{field: "rsa.misc.event_category", setter: fld_set}]}, - "event_computer": {to:[{field: "rsa.misc.event_computer", setter: fld_set}]}, - "event_counter": {convert: to_long, to:[{field: "rsa.counters.event_counter", setter: fld_set}]}, - "event_description": {to:[{field: "rsa.internal.event_desc", setter: fld_set}]}, - "event_id": {to:[{field: "rsa.misc.event_id", setter: fld_set}]}, - "event_log": {to:[{field: "rsa.misc.event_log", setter: fld_set}]}, - "event_name": {to:[{field: "rsa.internal.event_name", setter: fld_set}]}, - "event_queue_time": {convert: to_date, to:[{field: "rsa.time.event_queue_time", setter: fld_set}]}, - "event_source": {to:[{field: "rsa.misc.event_source", setter: fld_set}]}, - "event_state": {to:[{field: "rsa.misc.event_state", setter: fld_set}]}, - "event_time": {convert: to_date, to:[{field: "rsa.time.event_time", setter: fld_set}]}, - "event_time_str": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 1}]}, - "event_time_string": {to:[{field: "rsa.time.event_time_str", setter: fld_prio, prio: 0}]}, - "event_type": {to:[{field: "rsa.misc.event_type", setter: fld_set}]}, - "event_user": {to:[{field: "rsa.misc.event_user", setter: fld_set}]}, - "eventtime": {to:[{field: "rsa.time.eventtime", setter: fld_set}]}, - "expected_val": {to:[{field: "rsa.misc.expected_val", setter: fld_set}]}, - "expiration_time": {convert: to_date, to:[{field: "rsa.time.expire_time", setter: fld_set}]}, - "expiration_time_string": {to:[{field: "rsa.time.expire_time_str", setter: fld_set}]}, - "facility": {to:[{field: "rsa.misc.facility", setter: fld_set}]}, - "facilityname": {to:[{field: "rsa.misc.facilityname", setter: fld_set}]}, - "faddr": {to:[{field: "rsa.network.faddr", setter: fld_set}]}, - "fcatnum": {to:[{field: "rsa.misc.fcatnum", setter: fld_set}]}, - "federated_idp": {to:[{field: "rsa.identity.federated_idp", setter: fld_set}]}, - "federated_sp": {to:[{field: "rsa.identity.federated_sp", setter: fld_set}]}, - "feed.category": {to:[{field: "rsa.internal.feed_category", setter: fld_set}]}, - "feed_desc": {to:[{field: "rsa.internal.feed_desc", setter: fld_set}]}, - "feed_name": {to:[{field: "rsa.internal.feed_name", setter: fld_set}]}, - "fhost": {to:[{field: "rsa.network.fhost", setter: fld_set}]}, - "file_entropy": {convert: to_double, to:[{field: "rsa.file.file_entropy", setter: fld_set}]}, - "file_vendor": {to:[{field: "rsa.file.file_vendor", setter: fld_set}]}, - "filename_dst": {to:[{field: "rsa.file.filename_dst", setter: fld_set}]}, - "filename_src": {to:[{field: "rsa.file.filename_src", setter: fld_set}]}, - "filename_tmp": {to:[{field: "rsa.file.filename_tmp", setter: fld_set}]}, - "filesystem": {to:[{field: "rsa.file.filesystem", setter: fld_set}]}, - "filter": {to:[{field: "rsa.misc.filter", setter: fld_set}]}, - "finterface": {to:[{field: "rsa.misc.finterface", setter: fld_set}]}, - "flags": {to:[{field: "rsa.misc.flags", setter: fld_set}]}, - "forensic_info": {to:[{field: "rsa.misc.forensic_info", setter: fld_set}]}, - "forward.ip": {convert: to_ip, to:[{field: "rsa.internal.forward_ip", setter: fld_set}]}, - "forward.ipv6": {convert: to_ip, to:[{field: "rsa.internal.forward_ipv6", setter: fld_set}]}, - "found": {to:[{field: "rsa.misc.found", setter: fld_set}]}, - "fport": {to:[{field: "rsa.network.fport", setter: fld_set}]}, - "fqdn": {to:[{field: "rsa.web.fqdn", setter: fld_set}]}, - "fresult": {convert: to_long, to:[{field: "rsa.misc.fresult", setter: fld_set}]}, - "from": {to:[{field: "rsa.email.email_src", setter: fld_set}]}, - "gaddr": {to:[{field: "rsa.misc.gaddr", setter: fld_set}]}, - "gateway": {to:[{field: "rsa.network.gateway", setter: fld_set}]}, - "gmtdate": {to:[{field: "rsa.time.gmtdate", setter: fld_set}]}, - "gmttime": {to:[{field: "rsa.time.gmttime", setter: fld_set}]}, - "group": {to:[{field: "rsa.misc.group", setter: fld_set}]}, - "group_object": {to:[{field: "rsa.misc.group_object", setter: fld_set}]}, - "groupid": {to:[{field: "rsa.misc.group_id", setter: fld_set}]}, - "h_code": {to:[{field: "rsa.internal.hcode", setter: fld_set}]}, - "hardware_id": {to:[{field: "rsa.misc.hardware_id", setter: fld_set}]}, - "header.id": {to:[{field: "rsa.internal.header_id", setter: fld_set}]}, - "host.orig": {to:[{field: "rsa.network.host_orig", setter: fld_set}]}, - "host.state": {to:[{field: "rsa.endpoint.host_state", setter: fld_set}]}, - "host.type": {to:[{field: "rsa.network.host_type", setter: fld_set}]}, - "host_role": {to:[{field: "rsa.identity.host_role", setter: fld_set}]}, - "hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hostname": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "hour": {to:[{field: "rsa.time.hour", setter: fld_set}]}, - "https.insact": {to:[{field: "rsa.crypto.https_insact", setter: fld_set}]}, - "https.valid": {to:[{field: "rsa.crypto.https_valid", setter: fld_set}]}, - "icmpcode": {convert: to_long, to:[{field: "rsa.network.icmp_code", setter: fld_set}]}, - "icmptype": {convert: to_long, to:[{field: "rsa.network.icmp_type", setter: fld_set}]}, - "id": {to:[{field: "rsa.misc.reference_id", setter: fld_set}]}, - "id1": {to:[{field: "rsa.misc.reference_id1", setter: fld_set}]}, - "id2": {to:[{field: "rsa.misc.reference_id2", setter: fld_set}]}, - "id3": {to:[{field: "rsa.misc.id3", setter: fld_set}]}, - "ike": {to:[{field: "rsa.crypto.ike", setter: fld_set}]}, - "ike_cookie1": {to:[{field: "rsa.crypto.ike_cookie1", setter: fld_set}]}, - "ike_cookie2": {to:[{field: "rsa.crypto.ike_cookie2", setter: fld_set}]}, - "im_buddyid": {to:[{field: "rsa.misc.im_buddyid", setter: fld_set}]}, - "im_buddyname": {to:[{field: "rsa.misc.im_buddyname", setter: fld_set}]}, - "im_client": {to:[{field: "rsa.misc.im_client", setter: fld_set}]}, - "im_croomid": {to:[{field: "rsa.misc.im_croomid", setter: fld_set}]}, - "im_croomtype": {to:[{field: "rsa.misc.im_croomtype", setter: fld_set}]}, - "im_members": {to:[{field: "rsa.misc.im_members", setter: fld_set}]}, - "im_userid": {to:[{field: "rsa.misc.im_userid", setter: fld_set}]}, - "im_username": {to:[{field: "rsa.misc.im_username", setter: fld_set}]}, - "index": {to:[{field: "rsa.misc.index", setter: fld_set}]}, - "info": {to:[{field: "rsa.db.index", setter: fld_set}]}, - "inode": {convert: to_long, to:[{field: "rsa.internal.inode", setter: fld_set}]}, - "inout": {to:[{field: "rsa.misc.inout", setter: fld_set}]}, - "instance": {to:[{field: "rsa.db.instance", setter: fld_set}]}, - "interface": {to:[{field: "rsa.network.interface", setter: fld_set}]}, - "inv.category": {to:[{field: "rsa.investigations.inv_category", setter: fld_set}]}, - "inv.context": {to:[{field: "rsa.investigations.inv_context", setter: fld_set}]}, - "ioc": {to:[{field: "rsa.investigations.ioc", setter: fld_set}]}, - "ip_proto": {convert: to_long, to:[{field: "rsa.network.ip_proto", setter: fld_set}]}, - "ipkt": {to:[{field: "rsa.misc.ipkt", setter: fld_set}]}, - "ipscat": {to:[{field: "rsa.misc.ipscat", setter: fld_set}]}, - "ipspri": {to:[{field: "rsa.misc.ipspri", setter: fld_set}]}, - "jobname": {to:[{field: "rsa.misc.jobname", setter: fld_set}]}, - "jobnum": {to:[{field: "rsa.misc.job_num", setter: fld_set}]}, - "laddr": {to:[{field: "rsa.network.laddr", setter: fld_set}]}, - "language": {to:[{field: "rsa.misc.language", setter: fld_set}]}, - "latitude": {to:[{field: "rsa.misc.latitude", setter: fld_set}]}, - "lc.cid": {to:[{field: "rsa.internal.lc_cid", setter: fld_set}]}, - "lc.ctime": {convert: to_date, to:[{field: "rsa.internal.lc_ctime", setter: fld_set}]}, - "ldap": {to:[{field: "rsa.identity.ldap", setter: fld_set}]}, - "ldap.query": {to:[{field: "rsa.identity.ldap_query", setter: fld_set}]}, - "ldap.response": {to:[{field: "rsa.identity.ldap_response", setter: fld_set}]}, - "level": {convert: to_long, to:[{field: "rsa.internal.level", setter: fld_set}]}, - "lhost": {to:[{field: "rsa.network.lhost", setter: fld_set}]}, - "library": {to:[{field: "rsa.misc.library", setter: fld_set}]}, - "lifetime": {convert: to_long, to:[{field: "rsa.misc.lifetime", setter: fld_set}]}, - "linenum": {to:[{field: "rsa.misc.linenum", setter: fld_set}]}, - "link": {to:[{field: "rsa.misc.link", setter: fld_set}]}, - "linterface": {to:[{field: "rsa.network.linterface", setter: fld_set}]}, - "list_name": {to:[{field: "rsa.misc.list_name", setter: fld_set}]}, - "listnum": {to:[{field: "rsa.misc.listnum", setter: fld_set}]}, - "load_data": {to:[{field: "rsa.misc.load_data", setter: fld_set}]}, - "location_floor": {to:[{field: "rsa.misc.location_floor", setter: fld_set}]}, - "location_mark": {to:[{field: "rsa.misc.location_mark", setter: fld_set}]}, - "log_id": {to:[{field: "rsa.misc.log_id", setter: fld_set}]}, - "log_type": {to:[{field: "rsa.misc.log_type", setter: fld_set}]}, - "logid": {to:[{field: "rsa.misc.logid", setter: fld_set}]}, - "logip": {to:[{field: "rsa.misc.logip", setter: fld_set}]}, - "logname": {to:[{field: "rsa.misc.logname", setter: fld_set}]}, - "logon_type": {to:[{field: "rsa.identity.logon_type", setter: fld_set}]}, - "logon_type_desc": {to:[{field: "rsa.identity.logon_type_desc", setter: fld_set}]}, - "longitude": {to:[{field: "rsa.misc.longitude", setter: fld_set}]}, - "lport": {to:[{field: "rsa.misc.lport", setter: fld_set}]}, - "lread": {convert: to_long, to:[{field: "rsa.db.lread", setter: fld_set}]}, - "lun": {to:[{field: "rsa.storage.lun", setter: fld_set}]}, - "lwrite": {convert: to_long, to:[{field: "rsa.db.lwrite", setter: fld_set}]}, - "macaddr": {convert: to_mac, to:[{field: "rsa.network.eth_host", setter: fld_set}]}, - "mail_id": {to:[{field: "rsa.misc.mail_id", setter: fld_set}]}, - "mask": {to:[{field: "rsa.network.mask", setter: fld_set}]}, - "match": {to:[{field: "rsa.misc.match", setter: fld_set}]}, - "mbug_data": {to:[{field: "rsa.misc.mbug_data", setter: fld_set}]}, - "mcb.req": {convert: to_long, to:[{field: "rsa.internal.mcb_req", setter: fld_set}]}, - "mcb.res": {convert: to_long, to:[{field: "rsa.internal.mcb_res", setter: fld_set}]}, - "mcbc.req": {convert: to_long, to:[{field: "rsa.internal.mcbc_req", setter: fld_set}]}, - "mcbc.res": {convert: to_long, to:[{field: "rsa.internal.mcbc_res", setter: fld_set}]}, - "medium": {convert: to_long, to:[{field: "rsa.internal.medium", setter: fld_set}]}, - "message": {to:[{field: "rsa.internal.message", setter: fld_set}]}, - "message_body": {to:[{field: "rsa.misc.message_body", setter: fld_set}]}, - "messageid": {to:[{field: "rsa.internal.messageid", setter: fld_set}]}, - "min": {to:[{field: "rsa.time.min", setter: fld_set}]}, - "misc": {to:[{field: "rsa.misc.misc", setter: fld_set}]}, - "misc_name": {to:[{field: "rsa.misc.misc_name", setter: fld_set}]}, - "mode": {to:[{field: "rsa.misc.mode", setter: fld_set}]}, - "month": {to:[{field: "rsa.time.month", setter: fld_set}]}, - "msg": {to:[{field: "rsa.internal.msg", setter: fld_set}]}, - "msgIdPart1": {to:[{field: "rsa.misc.msgIdPart1", setter: fld_set}]}, - "msgIdPart2": {to:[{field: "rsa.misc.msgIdPart2", setter: fld_set}]}, - "msgIdPart3": {to:[{field: "rsa.misc.msgIdPart3", setter: fld_set}]}, - "msgIdPart4": {to:[{field: "rsa.misc.msgIdPart4", setter: fld_set}]}, - "msg_id": {to:[{field: "rsa.internal.msg_id", setter: fld_set}]}, - "msg_type": {to:[{field: "rsa.misc.msg_type", setter: fld_set}]}, - "msgid": {to:[{field: "rsa.misc.msgid", setter: fld_set}]}, - "name": {to:[{field: "rsa.misc.name", setter: fld_set}]}, - "netname": {to:[{field: "rsa.network.netname", setter: fld_set}]}, - "netsessid": {to:[{field: "rsa.misc.netsessid", setter: fld_set}]}, - "network_port": {convert: to_long, to:[{field: "rsa.network.network_port", setter: fld_set}]}, - "network_service": {to:[{field: "rsa.network.network_service", setter: fld_set}]}, - "node": {to:[{field: "rsa.misc.node", setter: fld_set}]}, - "nodename": {to:[{field: "rsa.internal.node_name", setter: fld_set}]}, - "ntype": {to:[{field: "rsa.misc.ntype", setter: fld_set}]}, - "num": {to:[{field: "rsa.misc.num", setter: fld_set}]}, - "number": {to:[{field: "rsa.misc.number", setter: fld_set}]}, - "number1": {to:[{field: "rsa.misc.number1", setter: fld_set}]}, - "number2": {to:[{field: "rsa.misc.number2", setter: fld_set}]}, - "nwe.callback_id": {to:[{field: "rsa.internal.nwe_callback_id", setter: fld_set}]}, - "nwwn": {to:[{field: "rsa.misc.nwwn", setter: fld_set}]}, - "obj_id": {to:[{field: "rsa.internal.obj_id", setter: fld_set}]}, - "obj_name": {to:[{field: "rsa.misc.obj_name", setter: fld_set}]}, - "obj_server": {to:[{field: "rsa.internal.obj_server", setter: fld_set}]}, - "obj_type": {to:[{field: "rsa.misc.obj_type", setter: fld_set}]}, - "obj_value": {to:[{field: "rsa.internal.obj_val", setter: fld_set}]}, - "object": {to:[{field: "rsa.misc.object", setter: fld_set}]}, - "observed_val": {to:[{field: "rsa.misc.observed_val", setter: fld_set}]}, - "operation": {to:[{field: "rsa.misc.operation", setter: fld_set}]}, - "operation_id": {to:[{field: "rsa.misc.operation_id", setter: fld_set}]}, - "opkt": {to:[{field: "rsa.misc.opkt", setter: fld_set}]}, - "org.dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 1}]}, - "org.src": {to:[{field: "rsa.physical.org_src", setter: fld_set}]}, - "org_dst": {to:[{field: "rsa.physical.org_dst", setter: fld_prio, prio: 0}]}, - "orig_from": {to:[{field: "rsa.misc.orig_from", setter: fld_set}]}, - "origin": {to:[{field: "rsa.network.origin", setter: fld_set}]}, - "original_owner": {to:[{field: "rsa.identity.owner", setter: fld_set}]}, - "os": {to:[{field: "rsa.misc.OS", setter: fld_set}]}, - "owner_id": {to:[{field: "rsa.misc.owner_id", setter: fld_set}]}, - "p_action": {to:[{field: "rsa.misc.p_action", setter: fld_set}]}, - "p_date": {to:[{field: "rsa.time.p_date", setter: fld_set}]}, - "p_filter": {to:[{field: "rsa.misc.p_filter", setter: fld_set}]}, - "p_group_object": {to:[{field: "rsa.misc.p_group_object", setter: fld_set}]}, - "p_id": {to:[{field: "rsa.misc.p_id", setter: fld_set}]}, - "p_month": {to:[{field: "rsa.time.p_month", setter: fld_set}]}, - "p_msgid": {to:[{field: "rsa.misc.p_msgid", setter: fld_set}]}, - "p_msgid1": {to:[{field: "rsa.misc.p_msgid1", setter: fld_set}]}, - "p_msgid2": {to:[{field: "rsa.misc.p_msgid2", setter: fld_set}]}, - "p_result1": {to:[{field: "rsa.misc.p_result1", setter: fld_set}]}, - "p_time": {to:[{field: "rsa.time.p_time", setter: fld_set}]}, - "p_time1": {to:[{field: "rsa.time.p_time1", setter: fld_set}]}, - "p_time2": {to:[{field: "rsa.time.p_time2", setter: fld_set}]}, - "p_url": {to:[{field: "rsa.web.p_url", setter: fld_set}]}, - "p_user_agent": {to:[{field: "rsa.web.p_user_agent", setter: fld_set}]}, - "p_web_cookie": {to:[{field: "rsa.web.p_web_cookie", setter: fld_set}]}, - "p_web_method": {to:[{field: "rsa.web.p_web_method", setter: fld_set}]}, - "p_web_referer": {to:[{field: "rsa.web.p_web_referer", setter: fld_set}]}, - "p_year": {to:[{field: "rsa.time.p_year", setter: fld_set}]}, - "packet_length": {to:[{field: "rsa.network.packet_length", setter: fld_set}]}, - "paddr": {convert: to_ip, to:[{field: "rsa.network.paddr", setter: fld_set}]}, - "param": {to:[{field: "rsa.misc.param", setter: fld_set}]}, - "param.dst": {to:[{field: "rsa.misc.param_dst", setter: fld_set}]}, - "param.src": {to:[{field: "rsa.misc.param_src", setter: fld_set}]}, - "parent_node": {to:[{field: "rsa.misc.parent_node", setter: fld_set}]}, - "parse.error": {to:[{field: "rsa.internal.parse_error", setter: fld_set}]}, - "password": {to:[{field: "rsa.identity.password", setter: fld_set}]}, - "password_chg": {to:[{field: "rsa.misc.password_chg", setter: fld_set}]}, - "password_expire": {to:[{field: "rsa.misc.password_expire", setter: fld_set}]}, - "patient_fname": {to:[{field: "rsa.healthcare.patient_fname", setter: fld_set}]}, - "patient_id": {to:[{field: "rsa.healthcare.patient_id", setter: fld_set}]}, - "patient_lname": {to:[{field: "rsa.healthcare.patient_lname", setter: fld_set}]}, - "patient_mname": {to:[{field: "rsa.healthcare.patient_mname", setter: fld_set}]}, - "payload.req": {convert: to_long, to:[{field: "rsa.internal.payload_req", setter: fld_set}]}, - "payload.res": {convert: to_long, to:[{field: "rsa.internal.payload_res", setter: fld_set}]}, - "peer": {to:[{field: "rsa.crypto.peer", setter: fld_set}]}, - "peer_id": {to:[{field: "rsa.crypto.peer_id", setter: fld_set}]}, - "permgranted": {to:[{field: "rsa.misc.permgranted", setter: fld_set}]}, - "permissions": {to:[{field: "rsa.db.permissions", setter: fld_set}]}, - "permwanted": {to:[{field: "rsa.misc.permwanted", setter: fld_set}]}, - "pgid": {to:[{field: "rsa.misc.pgid", setter: fld_set}]}, - "phone_number": {to:[{field: "rsa.misc.phone", setter: fld_prio, prio: 2}]}, - "phost": {to:[{field: "rsa.network.phost", setter: fld_set}]}, - "pid": {to:[{field: "rsa.misc.pid", setter: fld_set}]}, - "policy": {to:[{field: "rsa.misc.policy", setter: fld_set}]}, - "policyUUID": {to:[{field: "rsa.misc.policyUUID", setter: fld_set}]}, - "policy_id": {to:[{field: "rsa.misc.policy_id", setter: fld_set}]}, - "policy_value": {to:[{field: "rsa.misc.policy_value", setter: fld_set}]}, - "policy_waiver": {to:[{field: "rsa.misc.policy_waiver", setter: fld_set}]}, - "policyname": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 0}]}, - "pool_id": {to:[{field: "rsa.misc.pool_id", setter: fld_set}]}, - "pool_name": {to:[{field: "rsa.misc.pool_name", setter: fld_set}]}, - "port": {convert: to_long, to:[{field: "rsa.network.port", setter: fld_set}]}, - "portname": {to:[{field: "rsa.misc.port_name", setter: fld_set}]}, - "pread": {convert: to_long, to:[{field: "rsa.db.pread", setter: fld_set}]}, - "priority": {to:[{field: "rsa.misc.priority", setter: fld_set}]}, - "privilege": {to:[{field: "rsa.file.privilege", setter: fld_set}]}, - "process.vid.dst": {to:[{field: "rsa.internal.process_vid_dst", setter: fld_set}]}, - "process.vid.src": {to:[{field: "rsa.internal.process_vid_src", setter: fld_set}]}, - "process_id_val": {to:[{field: "rsa.misc.process_id_val", setter: fld_set}]}, - "processing_time": {to:[{field: "rsa.time.process_time", setter: fld_set}]}, - "profile": {to:[{field: "rsa.identity.profile", setter: fld_set}]}, - "prog_asp_num": {to:[{field: "rsa.misc.prog_asp_num", setter: fld_set}]}, - "program": {to:[{field: "rsa.misc.program", setter: fld_set}]}, - "protocol_detail": {to:[{field: "rsa.network.protocol_detail", setter: fld_set}]}, - "pwwn": {to:[{field: "rsa.storage.pwwn", setter: fld_set}]}, - "r_hostid": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "real_data": {to:[{field: "rsa.misc.real_data", setter: fld_set}]}, - "realm": {to:[{field: "rsa.identity.realm", setter: fld_set}]}, - "reason": {to:[{field: "rsa.misc.reason", setter: fld_set}]}, - "rec_asp_device": {to:[{field: "rsa.misc.rec_asp_device", setter: fld_set}]}, - "rec_asp_num": {to:[{field: "rsa.misc.rec_asp_num", setter: fld_set}]}, - "rec_library": {to:[{field: "rsa.misc.rec_library", setter: fld_set}]}, - "recorded_time": {convert: to_date, to:[{field: "rsa.time.recorded_time", setter: fld_set}]}, - "recordnum": {to:[{field: "rsa.misc.recordnum", setter: fld_set}]}, - "registry.key": {to:[{field: "rsa.endpoint.registry_key", setter: fld_set}]}, - "registry.value": {to:[{field: "rsa.endpoint.registry_value", setter: fld_set}]}, - "remote_domain": {to:[{field: "rsa.web.remote_domain", setter: fld_set}]}, - "remote_domain_id": {to:[{field: "rsa.network.remote_domain_id", setter: fld_set}]}, - "reputation_num": {convert: to_double, to:[{field: "rsa.web.reputation_num", setter: fld_set}]}, - "resource": {to:[{field: "rsa.internal.resource", setter: fld_set}]}, - "resource_class": {to:[{field: "rsa.internal.resource_class", setter: fld_set}]}, - "result": {to:[{field: "rsa.misc.result", setter: fld_set}]}, - "result_code": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 1}]}, - "resultcode": {to:[{field: "rsa.misc.result_code", setter: fld_prio, prio: 0}]}, - "rid": {convert: to_long, to:[{field: "rsa.internal.rid", setter: fld_set}]}, - "risk": {to:[{field: "rsa.misc.risk", setter: fld_set}]}, - "risk_info": {to:[{field: "rsa.misc.risk_info", setter: fld_set}]}, - "risk_num": {convert: to_double, to:[{field: "rsa.misc.risk_num", setter: fld_set}]}, - "risk_num_comm": {convert: to_double, to:[{field: "rsa.misc.risk_num_comm", setter: fld_set}]}, - "risk_num_next": {convert: to_double, to:[{field: "rsa.misc.risk_num_next", setter: fld_set}]}, - "risk_num_sand": {convert: to_double, to:[{field: "rsa.misc.risk_num_sand", setter: fld_set}]}, - "risk_num_static": {convert: to_double, to:[{field: "rsa.misc.risk_num_static", setter: fld_set}]}, - "risk_suspicious": {to:[{field: "rsa.misc.risk_suspicious", setter: fld_set}]}, - "risk_warning": {to:[{field: "rsa.misc.risk_warning", setter: fld_set}]}, - "rpayload": {to:[{field: "rsa.network.rpayload", setter: fld_set}]}, - "ruid": {to:[{field: "rsa.misc.ruid", setter: fld_set}]}, - "rule": {to:[{field: "rsa.misc.rule", setter: fld_set}]}, - "rule_group": {to:[{field: "rsa.misc.rule_group", setter: fld_set}]}, - "rule_template": {to:[{field: "rsa.misc.rule_template", setter: fld_set}]}, - "rule_uid": {to:[{field: "rsa.misc.rule_uid", setter: fld_set}]}, - "rulename": {to:[{field: "rsa.misc.rule_name", setter: fld_set}]}, - "s_certauth": {to:[{field: "rsa.crypto.s_certauth", setter: fld_set}]}, - "s_cipher": {to:[{field: "rsa.crypto.cipher_src", setter: fld_set}]}, - "s_ciphersize": {convert: to_long, to:[{field: "rsa.crypto.cipher_size_src", setter: fld_set}]}, - "s_context": {to:[{field: "rsa.misc.context_subject", setter: fld_set}]}, - "s_sslver": {to:[{field: "rsa.crypto.ssl_ver_src", setter: fld_set}]}, - "sburb": {to:[{field: "rsa.misc.sburb", setter: fld_set}]}, - "scheme": {to:[{field: "rsa.crypto.scheme", setter: fld_set}]}, - "sdomain_fld": {to:[{field: "rsa.misc.sdomain_fld", setter: fld_set}]}, - "search.text": {to:[{field: "rsa.misc.search_text", setter: fld_set}]}, - "sec": {to:[{field: "rsa.misc.sec", setter: fld_set}]}, - "second": {to:[{field: "rsa.misc.second", setter: fld_set}]}, - "sensor": {to:[{field: "rsa.misc.sensor", setter: fld_set}]}, - "sensorname": {to:[{field: "rsa.misc.sensorname", setter: fld_set}]}, - "seqnum": {to:[{field: "rsa.misc.seqnum", setter: fld_set}]}, - "serial_number": {to:[{field: "rsa.misc.serial_number", setter: fld_set}]}, - "service.account": {to:[{field: "rsa.identity.service_account", setter: fld_set}]}, - "session": {to:[{field: "rsa.misc.session", setter: fld_set}]}, - "session.split": {to:[{field: "rsa.internal.session_split", setter: fld_set}]}, - "sessionid": {to:[{field: "rsa.misc.log_session_id", setter: fld_set}]}, - "sessionid1": {to:[{field: "rsa.misc.log_session_id1", setter: fld_set}]}, - "sessiontype": {to:[{field: "rsa.misc.sessiontype", setter: fld_set}]}, - "severity": {to:[{field: "rsa.misc.severity", setter: fld_set}]}, - "sid": {to:[{field: "rsa.identity.user_sid_dst", setter: fld_set}]}, - "sig.name": {to:[{field: "rsa.misc.sig_name", setter: fld_set}]}, - "sigUUID": {to:[{field: "rsa.misc.sigUUID", setter: fld_set}]}, - "sigcat": {to:[{field: "rsa.misc.sigcat", setter: fld_set}]}, - "sigid": {convert: to_long, to:[{field: "rsa.misc.sig_id", setter: fld_set}]}, - "sigid1": {convert: to_long, to:[{field: "rsa.misc.sig_id1", setter: fld_set}]}, - "sigid_string": {to:[{field: "rsa.misc.sig_id_str", setter: fld_set}]}, - "signame": {to:[{field: "rsa.misc.policy_name", setter: fld_prio, prio: 1}]}, - "sigtype": {to:[{field: "rsa.crypto.sig_type", setter: fld_set}]}, - "sinterface": {to:[{field: "rsa.network.sinterface", setter: fld_set}]}, - "site": {to:[{field: "rsa.internal.site", setter: fld_set}]}, - "size": {convert: to_long, to:[{field: "rsa.internal.size", setter: fld_set}]}, - "smask": {to:[{field: "rsa.network.smask", setter: fld_set}]}, - "snmp.oid": {to:[{field: "rsa.misc.snmp_oid", setter: fld_set}]}, - "snmp.value": {to:[{field: "rsa.misc.snmp_value", setter: fld_set}]}, - "sourcefile": {to:[{field: "rsa.internal.sourcefile", setter: fld_set}]}, - "space": {to:[{field: "rsa.misc.space", setter: fld_set}]}, - "space1": {to:[{field: "rsa.misc.space1", setter: fld_set}]}, - "spi": {to:[{field: "rsa.misc.spi", setter: fld_set}]}, - "sql": {to:[{field: "rsa.misc.sql", setter: fld_set}]}, - "src_dn": {to:[{field: "rsa.identity.dn_src", setter: fld_set}]}, - "src_payload": {to:[{field: "rsa.misc.payload_src", setter: fld_set}]}, - "src_spi": {to:[{field: "rsa.misc.spi_src", setter: fld_set}]}, - "src_zone": {to:[{field: "rsa.network.zone_src", setter: fld_set}]}, - "srcburb": {to:[{field: "rsa.misc.srcburb", setter: fld_set}]}, - "srcdom": {to:[{field: "rsa.misc.srcdom", setter: fld_set}]}, - "srcservice": {to:[{field: "rsa.misc.srcservice", setter: fld_set}]}, - "ssid": {to:[{field: "rsa.wireless.wlan_ssid", setter: fld_prio, prio: 0}]}, - "stamp": {convert: to_date, to:[{field: "rsa.time.stamp", setter: fld_set}]}, - "starttime": {convert: to_date, to:[{field: "rsa.time.starttime", setter: fld_set}]}, - "state": {to:[{field: "rsa.misc.state", setter: fld_set}]}, - "statement": {to:[{field: "rsa.internal.statement", setter: fld_set}]}, - "status": {to:[{field: "rsa.misc.status", setter: fld_set}]}, - "status1": {to:[{field: "rsa.misc.status1", setter: fld_set}]}, - "streams": {convert: to_long, to:[{field: "rsa.misc.streams", setter: fld_set}]}, - "subcategory": {to:[{field: "rsa.misc.subcategory", setter: fld_set}]}, - "subject": {to:[{field: "rsa.email.subject", setter: fld_set}]}, - "svcno": {to:[{field: "rsa.misc.svcno", setter: fld_set}]}, - "system": {to:[{field: "rsa.misc.system", setter: fld_set}]}, - "t_context": {to:[{field: "rsa.misc.context_target", setter: fld_set}]}, - "task_name": {to:[{field: "rsa.file.task_name", setter: fld_set}]}, - "tbdstr1": {to:[{field: "rsa.misc.tbdstr1", setter: fld_set}]}, - "tbdstr2": {to:[{field: "rsa.misc.tbdstr2", setter: fld_set}]}, - "tbl_name": {to:[{field: "rsa.db.table_name", setter: fld_set}]}, - "tcp_flags": {convert: to_long, to:[{field: "rsa.misc.tcp_flags", setter: fld_set}]}, - "terminal": {to:[{field: "rsa.misc.terminal", setter: fld_set}]}, - "tgtdom": {to:[{field: "rsa.misc.tgtdom", setter: fld_set}]}, - "tgtdomain": {to:[{field: "rsa.misc.tgtdomain", setter: fld_set}]}, - "threat_name": {to:[{field: "rsa.threat.threat_category", setter: fld_set}]}, - "threat_source": {to:[{field: "rsa.threat.threat_source", setter: fld_set}]}, - "threat_val": {to:[{field: "rsa.threat.threat_desc", setter: fld_set}]}, - "threshold": {to:[{field: "rsa.misc.threshold", setter: fld_set}]}, - "time": {convert: to_date, to:[{field: "rsa.internal.time", setter: fld_set}]}, - "timestamp": {to:[{field: "rsa.time.timestamp", setter: fld_set}]}, - "timezone": {to:[{field: "rsa.time.timezone", setter: fld_set}]}, - "to": {to:[{field: "rsa.email.email_dst", setter: fld_set}]}, - "tos": {convert: to_long, to:[{field: "rsa.misc.tos", setter: fld_set}]}, - "trans_from": {to:[{field: "rsa.email.trans_from", setter: fld_set}]}, - "trans_id": {to:[{field: "rsa.db.transact_id", setter: fld_set}]}, - "trans_to": {to:[{field: "rsa.email.trans_to", setter: fld_set}]}, - "trigger_desc": {to:[{field: "rsa.misc.trigger_desc", setter: fld_set}]}, - "trigger_val": {to:[{field: "rsa.misc.trigger_val", setter: fld_set}]}, - "type": {to:[{field: "rsa.misc.type", setter: fld_set}]}, - "type1": {to:[{field: "rsa.misc.type1", setter: fld_set}]}, - "tzone": {to:[{field: "rsa.time.tzone", setter: fld_set}]}, - "ubc.req": {convert: to_long, to:[{field: "rsa.internal.ubc_req", setter: fld_set}]}, - "ubc.res": {convert: to_long, to:[{field: "rsa.internal.ubc_res", setter: fld_set}]}, - "udb_class": {to:[{field: "rsa.misc.udb_class", setter: fld_set}]}, - "url_fld": {to:[{field: "rsa.misc.url_fld", setter: fld_set}]}, - "urlpage": {to:[{field: "rsa.web.urlpage", setter: fld_set}]}, - "urlroot": {to:[{field: "rsa.web.urlroot", setter: fld_set}]}, - "user_address": {to:[{field: "rsa.email.email", setter: fld_append}]}, - "user_dept": {to:[{field: "rsa.identity.user_dept", setter: fld_set}]}, - "user_div": {to:[{field: "rsa.misc.user_div", setter: fld_set}]}, - "user_fname": {to:[{field: "rsa.identity.firstname", setter: fld_set}]}, - "user_lname": {to:[{field: "rsa.identity.lastname", setter: fld_set}]}, - "user_mname": {to:[{field: "rsa.identity.middlename", setter: fld_set}]}, - "user_org": {to:[{field: "rsa.identity.org", setter: fld_set}]}, - "user_role": {to:[{field: "rsa.identity.user_role", setter: fld_set}]}, - "userid": {to:[{field: "rsa.misc.userid", setter: fld_set}]}, - "username_fld": {to:[{field: "rsa.misc.username_fld", setter: fld_set}]}, - "utcstamp": {to:[{field: "rsa.misc.utcstamp", setter: fld_set}]}, - "v_instafname": {to:[{field: "rsa.misc.v_instafname", setter: fld_set}]}, - "vendor_event_cat": {to:[{field: "rsa.investigations.event_vcat", setter: fld_set}]}, - "version": {to:[{field: "rsa.misc.version", setter: fld_set}]}, - "vid": {to:[{field: "rsa.internal.msg_vid", setter: fld_set}]}, - "virt_data": {to:[{field: "rsa.misc.virt_data", setter: fld_set}]}, - "virusname": {to:[{field: "rsa.misc.virusname", setter: fld_set}]}, - "vlan": {convert: to_long, to:[{field: "rsa.network.vlan", setter: fld_set}]}, - "vlan.name": {to:[{field: "rsa.network.vlan_name", setter: fld_set}]}, - "vm_target": {to:[{field: "rsa.misc.vm_target", setter: fld_set}]}, - "vpnid": {to:[{field: "rsa.misc.vpnid", setter: fld_set}]}, - "vsys": {to:[{field: "rsa.misc.vsys", setter: fld_set}]}, - "vuln_ref": {to:[{field: "rsa.misc.vuln_ref", setter: fld_set}]}, - "web_cookie": {to:[{field: "rsa.web.web_cookie", setter: fld_set}]}, - "web_extension_tmp": {to:[{field: "rsa.web.web_extension_tmp", setter: fld_set}]}, - "web_host": {to:[{field: "rsa.web.alias_host", setter: fld_set}]}, - "web_method": {to:[{field: "rsa.misc.action", setter: fld_append}]}, - "web_page": {to:[{field: "rsa.web.web_page", setter: fld_set}]}, - "web_ref_domain": {to:[{field: "rsa.web.web_ref_domain", setter: fld_set}]}, - "web_ref_host": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "web_ref_page": {to:[{field: "rsa.web.web_ref_page", setter: fld_set}]}, - "web_ref_query": {to:[{field: "rsa.web.web_ref_query", setter: fld_set}]}, - "web_ref_root": {to:[{field: "rsa.web.web_ref_root", setter: fld_set}]}, - "wifi_channel": {convert: to_long, to:[{field: "rsa.wireless.wlan_channel", setter: fld_set}]}, - "wlan": {to:[{field: "rsa.wireless.wlan_name", setter: fld_set}]}, - "word": {to:[{field: "rsa.internal.word", setter: fld_set}]}, - "workspace_desc": {to:[{field: "rsa.misc.workspace", setter: fld_set}]}, - "workstation": {to:[{field: "rsa.network.alias_host", setter: fld_append}]}, - "year": {to:[{field: "rsa.time.year", setter: fld_set}]}, - "zone": {to:[{field: "rsa.network.zone", setter: fld_set}]}, - }; - - function to_date(value) { - switch (typeof (value)) { - case "object": - // This is a Date. But as it was obtained from evt.Get(), the VM - // doesn't see it as a JS Date anymore, thus value instanceof Date === false. - // Have to trust that any object here is a valid Date for Go. - return value; - case "string": - var asDate = new Date(value); - if (!isNaN(asDate)) return asDate; - } - } - - // ECMAScript 5.1 doesn't have Object.MAX_SAFE_INTEGER / Object.MIN_SAFE_INTEGER. - var maxSafeInt = Math.pow(2, 53) - 1; - var minSafeInt = -maxSafeInt; - - function to_long(value) { - var num = parseInt(value); - // Better not to index a number if it's not safe (above 53 bits). - return !isNaN(num) && minSafeInt <= num && num <= maxSafeInt ? num : undefined; - } - - function to_ip(value) { - if (value.indexOf(":") === -1) - return to_ipv4(value); - return to_ipv6(value); - } - - var ipv4_regex = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/; - var ipv6_hex_regex = /^[0-9A-Fa-f]{1,4}$/; - - function to_ipv4(value) { - var result = ipv4_regex.exec(value); - if (result == null || result.length !== 5) return; - for (var i = 1; i < 5; i++) { - var num = strictToInt(result[i]); - if (isNaN(num) || num < 0 || num > 255) return; - } - return value; - } - - function to_ipv6(value) { - var sqEnd = value.indexOf("]"); - if (sqEnd > -1) { - if (value.charAt(0) !== "[") return; - value = value.substr(1, sqEnd - 1); - } - var zoneOffset = value.indexOf("%"); - if (zoneOffset > -1) { - value = value.substr(0, zoneOffset); - } - var parts = value.split(":"); - if (parts == null || parts.length < 3 || parts.length > 8) return; - var numEmpty = 0; - var innerEmpty = 0; - for (var i = 0; i < parts.length; i++) { - if (parts[i].length === 0) { - numEmpty++; - if (i > 0 && i + 1 < parts.length) innerEmpty++; - } else if (!parts[i].match(ipv6_hex_regex) && - // Accept an IPv6 with a valid IPv4 at the end. - ((i + 1 < parts.length) || !to_ipv4(parts[i]))) { - return; - } - } - return innerEmpty === 0 && parts.length === 8 || innerEmpty === 1 ? value : undefined; - } - - function to_double(value) { - return parseFloat(value); - } - - function to_mac(value) { - // ES doesn't have a mac datatype so it's safe to ingest whatever was captured. - return value; - } - - function to_lowercase(value) { - // to_lowercase is used against keyword fields, which can accept - // any other type (numbers, dates). - return typeof(value) === "string"? value.toLowerCase() : value; - } - - function fld_set(dst, value) { - dst[this.field] = { v: value }; - } - - function fld_append(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: [value] }; - } else { - var base = dst[this.field]; - if (base.v.indexOf(value)===-1) base.v.push(value); - } - } - - function fld_prio(dst, value) { - if (dst[this.field] === undefined) { - dst[this.field] = { v: value, prio: this.prio}; - } else if(this.prio < dst[this.field].prio) { - dst[this.field].v = value; - dst[this.field].prio = this.prio; - } - } - - var valid_ecs_outcome = { - 'failure': true, - 'success': true, - 'unknown': true - }; - - function fld_ecs_outcome(dst, value) { - value = value.toLowerCase(); - if (valid_ecs_outcome[value] === undefined) { - value = 'unknown'; - } - if (dst[this.field] === undefined) { - dst[this.field] = { v: value }; - } else if (dst[this.field].v === 'unknown') { - dst[this.field] = { v: value }; - } - } - - function map_all(evt, targets, value) { - for (var i = 0; i < targets.length; i++) { - evt.Put(targets[i], value); - } - } - - function populate_fields(evt) { - var base = evt.Get(FIELDS_OBJECT); - if (base === null) return; - alternate_datetime(evt); - if (map_ecs) { - do_populate(evt, base, ecs_mappings); - } - if (map_rsa) { - do_populate(evt, base, rsa_mappings); - } - if (keep_raw) { - evt.Put("rsa.raw", base); - } - evt.Delete(FIELDS_OBJECT); - } - - var datetime_alt_components = [ - {field: "day", fmts: [[dF]]}, - {field: "year", fmts: [[dW]]}, - {field: "month", fmts: [[dB],[dG]]}, - {field: "date", fmts: [[dW,dSkip,dG,dSkip,dF],[dW,dSkip,dB,dSkip,dF],[dW,dSkip,dR,dSkip,dF]]}, - {field: "hour", fmts: [[dN]]}, - {field: "min", fmts: [[dU]]}, - {field: "secs", fmts: [[dO]]}, - {field: "time", fmts: [[dN, dSkip, dU, dSkip, dO]]}, - ]; - - function alternate_datetime(evt) { - if (evt.Get(FIELDS_PREFIX + "event_time") != null) { - return; - } - var tzOffset = tz_offset; - if (tzOffset === "event") { - tzOffset = evt.Get("event.timezone"); - } - var container = new DateContainer(tzOffset); - for (var i=0; i} %{hostname->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0001"), - ])); - - var hdr2 = match("HEADER#1:0002", "message", "%{hfld1->} %{messageid}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0002"), - ])); - - var hdr3 = match("HEADER#2:0003", "message", "%{hfld1->} %{hostname->} reverseproxy: %{payload}", processor_chain([ - setc("header_id","0003"), - setc("messageid","reverseproxy"), - ])); - - var hdr4 = match("HEADER#3:0005", "message", "%{hfld1->} %{hostname->} %{messageid}: %{payload}", processor_chain([ - setc("header_id","0005"), - ])); - - var hdr5 = match("HEADER#4:0004", "message", "%{hfld1->} %{id}[%{process_id}]: %{payload}", processor_chain([ - setc("header_id","0004"), - setc("messageid","astarosg_TVM"), - ])); - - var hdr6 = match("HEADER#5:0006", "message", "device=\"%{product}\" date=%{hdate->} time=%{htime->} timezone=\"%{timezone}\" device_name=\"%{device}\" device_id=%{hardware_id->} log_id=%{id->} %{payload}", processor_chain([ - setc("header_id","0006"), - setc("messageid","Sophos_Firewall"), - ])); - - var select1 = linear_select([ - hdr1, - hdr2, - hdr3, - hdr4, - hdr5, - hdr6, - ]); - - var part1 = match("MESSAGE#0:named:01", "nwparser.payload", "received control channel command '%{action}'", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg1 = msg("named:01", part1); - - var part2 = match("MESSAGE#1:named:02", "nwparser.payload", "flushing caches in all views %{disposition}", processor_chain([ - dup1, - dup2, - dup3, - ])); - - var msg2 = msg("named:02", part2); - - var part3 = match("MESSAGE#2:named:03", "nwparser.payload", "error (%{result}) resolving '%{dhost}': %{daddr}#%{dport}", processor_chain([ - dup4, - dup2, - dup3, - ])); - - var msg3 = msg("named:03", part3); - - var part4 = match("MESSAGE#3:named:04", "nwparser.payload", "received %{action->} signal to %{fld3}", processor_chain([ - dup5, - dup2, - dup3, - ])); - - var msg4 = msg("named:04", part4); - - var part5 = match("MESSAGE#4:named:05", "nwparser.payload", "loading configuration from '%{filename}'", processor_chain([ - dup6, - dup2, - dup3, - ])); - - var msg5 = msg("named:05", part5); - - var part6 = match("MESSAGE#5:named:06", "nwparser.payload", "no %{protocol->} interfaces found", processor_chain([ - setc("eventcategory","1804000000"), - dup2, - dup3, - ])); - - var msg6 = msg("named:06", part6); - - var part7 = match("MESSAGE#6:named:07", "nwparser.payload", "sizing zone task pool based on %{fld3->} zones", processor_chain([ - dup7, - dup2, - dup3, - ])); - - var msg7 = msg("named:07", part7); - - var part8 = match("MESSAGE#7:named:08", "nwparser.payload", "automatic empty zone: view %{fld3}: %{dns_ptr_record}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg8 = msg("named:08", part8); - - var part9 = match("MESSAGE#8:named:09", "nwparser.payload", "reloading %{obj_type->} %{disposition}", processor_chain([ - dup7, - dup2, - dup3, - setc("action","reloading"), - ])); - - var msg9 = msg("named:09", part9); - - var part10 = match("MESSAGE#9:named:10", "nwparser.payload", "zone %{dhost}/%{fld3}: loaded serial %{operation_id}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - ])); - - var msg10 = msg("named:10", part10); - - var part11 = match("MESSAGE#10:named:11", "nwparser.payload", "all zones loaded%{}", processor_chain([ - dup7, - dup9, - dup2, - dup3, - setc("action","all zones loaded"), - ])); - - var msg11 = msg("named:11", part11); - - var part12 = match("MESSAGE#11:named:12", "nwparser.payload", "running%{}", processor_chain([ - dup7, - setc("disposition","running"), - dup2, - dup3, - setc("action","running"), - ])); - - var msg12 = msg("named:12", part12); - - var part13 = match("MESSAGE#12:named:13", "nwparser.payload", "using built-in root key for view %{fld3}", processor_chain([ - dup7, - setc("context","built-in root key"), - dup2, - dup3, - ])); - - var msg13 = msg("named:13", part13); - - var part14 = match("MESSAGE#13:named:14", "nwparser.payload", "zone %{dns_ptr_record}/%{fld3}: (%{username}) %{action}", processor_chain([ - dup8, - dup2, - dup3, - ])); - - var msg14 = msg("named:14", part14); - - var part15 = match("MESSAGE#14:named:15", "nwparser.payload", "too many timeouts resolving '%{fld3}' (%{fld4}): disabling EDNS", processor_chain([ - dup10, - setc("event_description","named:too many timeouts resolving DNS."), - dup11, - dup2, - ])); - - var msg15 = msg("named:15", part15); - - var part16 = match("MESSAGE#15:named:16", "nwparser.payload", "FORMERR resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:FORMERR resolving DNS."), - dup11, - dup2, - ])); - - var msg16 = msg("named:16", part16); - - var part17 = match("MESSAGE#16:named:17", "nwparser.payload", "unexpected RCODE (SERVFAIL) resolving '%{hostname}': %{saddr}#%{fld3}", processor_chain([ - dup10, - setc("event_description","named:unexpected RCODE (SERVFAIL) resolving DNS."), - dup11, - dup2, - ])); - - var msg17 = msg("named:17", part17); - - var select2 = linear_select([ - msg1, - msg2, - msg3, - msg4, - msg5, - msg6, - msg7, - msg8, - msg9, - msg10, - msg11, - msg12, - msg13, - msg14, - msg15, - msg16, - msg17, - ]); - - var part18 = match("MESSAGE#17:httpproxy:09", "nwparser.payload", "Integrated HTTP-Proxy %{version}", processor_chain([ - dup12, - setc("event_description","httpproxy:Integrated HTTP-Proxy."), - dup11, - dup2, - ])); - - var msg18 = msg("httpproxy:09", part18); - - var part19 = match("MESSAGE#18:httpproxy:10", "nwparser.payload", "[%{fld2}] parse_address (%{fld3}) getaddrinfo: passthrough.fw-notify.net: Name or service not known", processor_chain([ - dup10, - setc("event_description","httpproxy:Name or service not known."), - dup11, - dup2, - ])); - - var msg19 = msg("httpproxy:10", part19); - - var part20 = match("MESSAGE#19:httpproxy:11", "nwparser.payload", "[%{fld2}] confd_config_filter (%{fld3}) failed to resolve passthrough.fw-notify.net, using %{saddr}", processor_chain([ - dup10, - setc("event_description","httpproxy:failed to resolve passthrough."), - dup11, - dup2, - ])); - - var msg20 = msg("httpproxy:11", part20); - - var part21 = match("MESSAGE#20:httpproxy:12", "nwparser.payload", "[%{fld2}] ssl_log_errors (%{fld3}) %{fld4}ssl handshake failure%{fld5}", processor_chain([ - dup10, - setc("event_description","httpproxy:ssl handshake failure."), - dup11, - dup2, - ])); - - var msg21 = msg("httpproxy:12", part21); - - var part22 = match("MESSAGE#21:httpproxy:13", "nwparser.payload", "[%{fld2}] sc_decrypt (%{fld3}) EVP_DecryptFinal failed", processor_chain([ - dup10, - setc("event_description","httpproxy:EVP_DecryptFinal failed."), - dup11, - dup2, - ])); - - var msg22 = msg("httpproxy:13", part22); - - var part23 = match("MESSAGE#22:httpproxy:14", "nwparser.payload", "[%{fld2}] sc_server_cmd (%{fld3}) decrypt failed", processor_chain([ - dup10, - setc("event_description","httpproxy:decrypt failed."), - dup11, - dup2, - ])); - - var msg23 = msg("httpproxy:14", part23); - - var part24 = match("MESSAGE#23:httpproxy:15", "nwparser.payload", "[%{fld2}] clamav_reload (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:reloading av pattern"), - dup11, - dup2, - ])); - - var msg24 = msg("httpproxy:15", part24); - - var part25 = match("MESSAGE#24:httpproxy:16", "nwparser.payload", "[%{fld2}] sc_check_servers (%{fld3}) server '%{hostname}' access time: %{fld4}", processor_chain([ - dup12, - setc("event_description","httpproxy:sc_check_servers.Server checked."), - dup11, - dup2, - ])); - - var msg25 = msg("httpproxy:16", part25); - - var part26 = match("MESSAGE#25:httpproxy:17", "nwparser.payload", "[%{fld2}] main (%{fld3}) shutdown finished, exiting", processor_chain([ - dup12, - setc("event_description","httpproxy:shutdown finished, exiting."), - dup11, - dup2, - ])); - - var msg26 = msg("httpproxy:17", part26); - - var part27 = match("MESSAGE#26:httpproxy:18", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading configuration", processor_chain([ - dup12, - setc("event_description","httpproxy:"), - dup11, - dup2, - ])); - - var msg27 = msg("httpproxy:18", part27); - - var part28 = match("MESSAGE#27:httpproxy:19", "nwparser.payload", "[%{fld2}] main (%{fld3}) reading profiles", processor_chain([ - dup12, - setc("event_description","httpproxy:reading profiles"), - dup11, - dup2, - ])); - - var msg28 = msg("httpproxy:19", part28); - - var part29 = match("MESSAGE#28:httpproxy:20", "nwparser.payload", "[%{fld2}] main (%{fld3}) finished startup", processor_chain([ - dup12, - setc("event_description","httpproxy:finished startup"), - dup11, - dup2, - ])); - - var msg29 = msg("httpproxy:20", part29); - - var part30 = match("MESSAGE#29:httpproxy:21", "nwparser.payload", "[%{fld2}] read_request_headers (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:read_request_headers related message."), - dup11, - dup2, - ])); - - var msg30 = msg("httpproxy:21", part30); - - var part31 = match("MESSAGE#30:httpproxy:22", "nwparser.payload", "[%{fld2}] epoll_loop (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_loop related message."), - dup11, - dup2, - ])); - - var msg31 = msg("httpproxy:22", part31); - - var part32 = match("MESSAGE#31:httpproxy:23", "nwparser.payload", "[%{fld2}] scan_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scan_exit related message."), - dup11, - dup2, - ])); - - var msg32 = msg("httpproxy:23", part32); - - var part33 = match("MESSAGE#32:httpproxy:24", "nwparser.payload", "[%{fld2}] epoll_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:epoll_exit related message."), - dup11, - dup2, - ])); - - var msg33 = msg("httpproxy:24", part33); - - var part34 = match("MESSAGE#33:httpproxy:25", "nwparser.payload", "[%{fld2}] disk_cache_exit (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_exit related message."), - dup11, - dup2, - ])); - - var msg34 = msg("httpproxy:25", part34); - - var part35 = match("MESSAGE#34:httpproxy:26", "nwparser.payload", "[%{fld2}] disk_cache_zap (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:disk_cache_zap related message."), - dup11, - dup2, - ])); - - var msg35 = msg("httpproxy:26", part35); - - var part36 = match("MESSAGE#35:httpproxy:27", "nwparser.payload", "[%{fld2}] scanner_init (%{fld3}) %{info}", processor_chain([ - dup12, - setc("event_description","httpproxy:scanner_init related message."), - dup11, - dup2, - ])); - - var msg36 = msg("httpproxy:27", part36); - - var part37 = tagval("MESSAGE#36:httpproxy:01", "nwparser.payload", tvm, { - "action": "action", - "ad_domain": "fld1", - "app-id": "fld18", - "application": "fld17", - "auth": "fld10", - "authtime": "fld4", - "avscantime": "fld7", - "cached": "fld2", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld6", - "content-type": "content_type", - "device": "fld9", - "dnstime": "fld5", - "dstip": "daddr", - "error": "result", - "exceptions": "fld12", - "extension": "fld13", - "file": "filename", - "filename": "filename", - "filteraction": "fld3", - "fullreqtime": "fld8", - "function": "action", - "group": "group", - "id": "rule", - "line": "fld14", - "message": "context", - "method": "web_method", - "name": "event_description", - "profile": "policyname", - "reason": "rule_group", - "referer": "web_referer", - "reputation": "fld16", - "request": "connectionid", - "severity": "severity", - "size": "rbytes", - "srcip": "saddr", - "statuscode": "resultcode", - "sub": "network_service", - "sys": "vsys", - "time": "fld15", - "ua": "fld11", - "url": "url", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg37 = msg("httpproxy:01", part37); - - var select3 = linear_select([ - msg18, - msg19, - msg20, - msg21, - msg22, - msg23, - msg24, - msg25, - msg26, - msg27, - msg28, - msg29, - msg30, - msg31, - msg32, - msg33, - msg34, - msg35, - msg36, - msg37, - ]); - - var part38 = match("MESSAGE#37:URID:01", "nwparser.payload", "T=%{fld3->} ------ 1 - [exit] %{action}: %{disposition}", processor_chain([ - dup16, - dup2, - dup3, - ])); - - var msg38 = msg("URID:01", part38); - - var part39 = tagval("MESSAGE#38:ulogd:01", "nwparser.payload", tvm, { - "action": "action", - "code": "fld30", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "fwrule": "policy_id", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "name": "event_description", - "outitf": "dinterface", - "prec": "fld27", - "proto": "fld24", - "seq": "fld23", - "severity": "severity", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "sub": "network_service", - "sys": "vsys", - "tcpflags": "fld29", - "tos": "fld26", - "ttl": "fld28", - "type": "fld31", - }, processor_chain([ - dup13, - setc("ec_subject","NetworkComm"), - setc("ec_activity","Scan"), - setc("ec_theme","TEV"), - dup11, - dup2, - dup45, - dup46, - ])); - - var msg39 = msg("ulogd:01", part39); - - var part40 = match("MESSAGE#39:reverseproxy:01", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity for Apache/%{fld5->} (%{fld6}) configured.", processor_chain([ - dup6, - setc("disposition","configured"), - dup2, - dup3, - ])); - - var msg40 = msg("reverseproxy:01", part40); - - var part41 = match("MESSAGE#40:reverseproxy:02", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"; loaded version=\"%{fld7}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg41 = msg("reverseproxy:02", part41); - - var part42 = match("MESSAGE#41:reverseproxy:03", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] ModSecurity: %{fld5->} compiled version=\"%{fld6}\"", processor_chain([ - dup17, - dup2, - dup3, - ])); - - var msg42 = msg("reverseproxy:03", part42); - - var part43 = match("MESSAGE#42:reverseproxy:04", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] %{fld5->} configured -- %{disposition->} normal operations", processor_chain([ - dup17, - setc("event_id","AH00292"), - dup2, - dup3, - ])); - - var msg43 = msg("reverseproxy:04", part43); - - var part44 = match("MESSAGE#43:reverseproxy:06", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [%{fld5}] Hostname in %{network_service->} request (%{fld6}) does not match the server name (%{ddomain})", processor_chain([ - setc("eventcategory","1805010000"), - dup18, - dup2, - dup3, - ])); - - var msg44 = msg("reverseproxy:06", part44); - - var part45 = match("MESSAGE#44:reverseproxy:07/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00297: %{action->} received. Doing%{p0}"); - - var select4 = linear_select([ - dup19, - ]); - - var part46 = match("MESSAGE#44:reverseproxy:07/2", "nwparser.p0", "%{}graceful %{disposition}"); - - var all1 = all_match({ - processors: [ - part45, - select4, - part46, - ], - on_success: processor_chain([ - dup5, - setc("event_id","AH00297"), - dup2, - dup3, - ]), - }); - - var msg45 = msg("reverseproxy:07", all1); - - var part47 = match("MESSAGE#45:reverseproxy:08", "nwparser.payload", "AH00112: Warning: DocumentRoot [%{web_root}] does not exist", processor_chain([ - dup4, - setc("event_id","AH00112"), - dup2, - dup3, - ])); - - var msg46 = msg("reverseproxy:08", part47); - - var part48 = match("MESSAGE#46:reverseproxy:09", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00094: Command line: '%{web_root}'", processor_chain([ - setc("eventcategory","1605010000"), - setc("event_id","AH00094"), - dup2, - dup3, - ])); - - var msg47 = msg("reverseproxy:09", part48); - - var part49 = match("MESSAGE#47:reverseproxy:10", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00291: long lost child came home! (pid %{fld5})", processor_chain([ - dup12, - setc("event_id","AH00291"), - dup2, - dup3, - ])); - - var msg48 = msg("reverseproxy:10", part49); - - var part50 = match("MESSAGE#48:reverseproxy:11", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02572: Failed to configure at least one certificate and key for %{fld5}:%{fld6}", processor_chain([ - dup20, - setc("event_id","AH02572"), - dup2, - dup3, - ])); - - var msg49 = msg("reverseproxy:11", part50); - - var part51 = match("MESSAGE#49:reverseproxy:12", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] SSL Library Error: error:%{resultcode}:%{result}", processor_chain([ - dup20, - setc("context","SSL Library Error"), - dup2, - dup3, - ])); - - var msg50 = msg("reverseproxy:12", part51); - - var part52 = match("MESSAGE#50:reverseproxy:13", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH02312: Fatal error initialising mod_ssl, %{disposition}.", processor_chain([ - dup20, - setc("result","Fatal error"), - setc("event_id","AH02312"), - dup2, - dup3, - ])); - - var msg51 = msg("reverseproxy:13", part52); - - var part53 = match("MESSAGE#51:reverseproxy:14", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00020: Configuration Failed, %{disposition}", processor_chain([ - dup20, - setc("result","Configuration Failed"), - setc("event_id","AH00020"), - dup2, - dup3, - ])); - - var msg52 = msg("reverseproxy:14", part53); - - var part54 = match("MESSAGE#52:reverseproxy:15", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00098: pid file %{filename->} overwritten -- Unclean shutdown of previous Apache run?", processor_chain([ - setc("eventcategory","1609000000"), - setc("context","Unclean shutdown"), - setc("event_id","AH00098"), - dup2, - dup3, - ])); - - var msg53 = msg("reverseproxy:15", part54); - - var part55 = match("MESSAGE#53:reverseproxy:16", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00295: caught %{action}, %{disposition}", processor_chain([ - dup16, - setc("event_id","AH00295"), - dup2, - dup3, - ])); - - var msg54 = msg("reverseproxy:16", part55); - - var part56 = match("MESSAGE#54:reverseproxy:17/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{result}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"]%{p0}"); - - var part57 = match("MESSAGE#54:reverseproxy:17/1_0", "nwparser.p0", " [rev \"%{fld6}\"]%{p0}"); - - var select5 = linear_select([ - part57, - dup19, - ]); - - var part58 = match("MESSAGE#54:reverseproxy:17/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"%{daddr}\"] [severity \"%{severity}\"] [ver \"%{policyname}\"] [maturity \"%{fld7}\"] [accuracy \"%{fld8}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all2 = all_match({ - processors: [ - part56, - select5, - part58, - ], - on_success: processor_chain([ - dup21, - dup2, - dup3, - ]), - }); - - var msg55 = msg("reverseproxy:17", all2); - - var part59 = match("MESSAGE#55:reverseproxy:18", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] No signature found, cookie: %{fld5}", processor_chain([ - dup4, - dup22, - dup2, - dup3, - ])); - - var msg56 = msg("reverseproxy:18", part59); - - var part60 = match("MESSAGE#56:reverseproxy:19", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] %{disposition->} '%{fld5}' from request due to missing/invalid signature", processor_chain([ - dup23, - dup22, - dup2, - dup3, - ])); - - var msg57 = msg("reverseproxy:19", part60); - - var part61 = match("MESSAGE#57:reverseproxy:20", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [msg \"%{comments}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg58 = msg("reverseproxy:20", part61); - - var part62 = match("MESSAGE#58:reverseproxy:21", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01909: %{daddr}:%{dport}:%{fld5->} server certificate does NOT include an ID which matches the server name", processor_chain([ - dup20, - dup18, - setc("event_id","AH01909"), - dup2, - dup3, - ])); - - var msg59 = msg("reverseproxy:21", part62); - - var part63 = match("MESSAGE#59:reverseproxy:22", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH01915: Init: (%{daddr}:%{dport}) You configured %{network_service}(%{fld5}) on the %{fld6}(%{fld7}) port!", processor_chain([ - dup20, - setc("comments","Invalid port configuration"), - dup2, - dup3, - ])); - - var msg60 = msg("reverseproxy:22", part63); - - var part64 = match("MESSAGE#60:reverseproxy:23", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: Rule %{rulename->} [id \"%{rule}\"][file \"%{filename}\"][line \"%{fld5}\"] - Execution error - PCRE limits exceeded (%{fld6}): (%{fld7}). [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg61 = msg("reverseproxy:23", part64); - - var part65 = match("MESSAGE#61:reverseproxy:24", "nwparser.payload", "rManage\\\\x22,\\\\x22manageLiveSystemSettings\\\\x22,\\\\x22accessViewJobs\\\\x22,\\\\x22exportList\\\\...\"] [ver \"%{policyname}\"] [maturity \"%{fld3}\"] [accuracy \"%{fld4}\"] %{context->} [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg62 = msg("reverseproxy:24", part65); - - var part66 = match("MESSAGE#62:reverseproxy:25", "nwparser.payload", "ARGS:userPermissions: [\\\\x22dashletAccessAlertingRecentAlertsPanel\\\\x22,\\\\x22dashletAccessAlerterTopAlertsDashlet\\\\x22,\\\\x22accessViewRules\\\\x22,\\\\x22deployLiveResources\\\\x22,\\\\x22vi...\"] [severity [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]", processor_chain([ - dup21, - dup2, - dup3, - ])); - - var msg63 = msg("reverseproxy:25", part66); - - var part67 = match("MESSAGE#63:reverseproxy:26/0", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] ModSecurity: %{disposition->} with code %{resultcode->} (%{fld5}). %{rulename->} [file \"%{filename}\"] [line \"%{fld6}\"] [id \"%{rule}\"]%{p0}"); - - var part68 = match("MESSAGE#63:reverseproxy:26/1_0", "nwparser.p0", " [rev \"%{fld7}\"]%{p0}"); - - var select6 = linear_select([ - part68, - dup19, - ]); - - var part69 = match("MESSAGE#63:reverseproxy:26/2", "nwparser.p0", "%{}[msg \"%{comments}\"] [data \"Last Matched Data: %{p0}"); - - var part70 = match("MESSAGE#63:reverseproxy:26/3_0", "nwparser.p0", "%{daddr}:%{dport}\"] [hostname \"%{p0}"); - - var part71 = match("MESSAGE#63:reverseproxy:26/3_1", "nwparser.p0", "%{daddr}\"] [hostname \"%{p0}"); - - var select7 = linear_select([ - part70, - part71, - ]); - - var part72 = match("MESSAGE#63:reverseproxy:26/4", "nwparser.p0", "%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]"); - - var all3 = all_match({ - processors: [ - part67, - select6, - part69, - select7, - part72, - ], - on_success: processor_chain([ - dup24, - dup2, - dup3, - ]), - }); - - var msg64 = msg("reverseproxy:26", all3); - - var part73 = match("MESSAGE#64:reverseproxy:27", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] %{disposition->} while reading reply from cssd, referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg65 = msg("reverseproxy:27", part73); - - var part74 = match("MESSAGE#65:reverseproxy:28", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon error found in request %{web_root}, referer: %{web_referer}", processor_chain([ - dup26, - setc("result","virus daemon error"), - dup2, - dup3, - ])); - - var msg66 = msg("reverseproxy:28", part74); - - var part75 = match("MESSAGE#66:reverseproxy:29", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found, referer: %{web_referer}", processor_chain([ - dup27, - setc("result","virus found"), - dup2, - dup3, - ])); - - var msg67 = msg("reverseproxy:29", part75); - - var part76 = match("MESSAGE#67:reverseproxy:30", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} (), referer: %{web_referer}", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg68 = msg("reverseproxy:30", part76); - - var part77 = match("MESSAGE#68:reverseproxy:31", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot read reply: Operation now in progress (115), referer: %{web_referer}", processor_chain([ - dup25, - setc("result","Cannot read reply"), - dup2, - dup3, - ])); - - var msg69 = msg("reverseproxy:31", part77); - - var part78 = match("MESSAGE#69:reverseproxy:32", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111), referer: %{web_referer}", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg70 = msg("reverseproxy:32", part78); - - var part79 = match("MESSAGE#70:reverseproxy:33", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] cannot connect: %{result->} (111)", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg71 = msg("reverseproxy:33", part79); - - var part80 = match("MESSAGE#71:reverseproxy:34", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}, referer: %{web_referer}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg72 = msg("reverseproxy:34", part80); - - var part81 = match("MESSAGE#72:reverseproxy:35", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] virus daemon connection problem found in request %{url}", processor_chain([ - dup26, - dup29, - dup2, - dup3, - ])); - - var msg73 = msg("reverseproxy:35", part81); - - var part82 = match("MESSAGE#73:reverseproxy:36", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] mod_avscan_input_filter: virus found", processor_chain([ - dup27, - setc("result","Virus found"), - dup2, - dup3, - ])); - - var msg74 = msg("reverseproxy:36", part82); - - var part83 = match("MESSAGE#74:reverseproxy:37", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (13)%{result}: [client %{gateway}] AH01095: prefetch request body failed to %{saddr}:%{sport->} (%{fld5}) from %{fld6->} ()", processor_chain([ - dup24, - dup28, - dup2, - dup3, - ])); - - var msg75 = msg("reverseproxy:37", part83); - - var part84 = match("MESSAGE#75:reverseproxy:38", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Invalid signature, cookie: JSESSIONID", processor_chain([ - dup25, - dup2, - dup3, - ])); - - var msg76 = msg("reverseproxy:38", part84); - - var part85 = match("MESSAGE#76:reverseproxy:39", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] Form validation failed: Received unhardened form data, referer: %{web_referer}", processor_chain([ - dup23, - setc("result","Form validation failed"), - dup2, - dup3, - ])); - - var msg77 = msg("reverseproxy:39", part85); - - var part86 = match("MESSAGE#77:reverseproxy:40", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] sending trickle failed: 103", processor_chain([ - dup25, - setc("result","Sending trickle failed"), - dup2, - dup3, - ])); - - var msg78 = msg("reverseproxy:40", part86); - - var part87 = match("MESSAGE#78:reverseproxy:41", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] client requesting %{web_root->} has %{disposition}", processor_chain([ - dup30, - dup2, - dup3, - ])); - - var msg79 = msg("reverseproxy:41", part87); - - var part88 = match("MESSAGE#79:reverseproxy:42", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] mod_avscan_check_file_single_part() called with parameter filename=%{filename}", processor_chain([ - setc("eventcategory","1603050000"), - dup2, - dup3, - ])); - - var msg80 = msg("reverseproxy:42", part88); - - var part89 = match("MESSAGE#80:reverseproxy:43", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (70007)The %{disposition->} specified has expired: [client %{gateway}] AH01110: error reading response", processor_chain([ - dup30, - setc("event_id","AH01110"), - setc("result","Error reading response"), - dup2, - dup3, - ])); - - var msg81 = msg("reverseproxy:43", part89); - - var part90 = match("MESSAGE#81:reverseproxy:44", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (22)%{result}: [client %{gateway}] No form context found when parsing %{fld5->} tag, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1601020000"), - setc("result","No form context found"), - dup2, - dup3, - ])); - - var msg82 = msg("reverseproxy:44", part90); - - var part91 = match("MESSAGE#82:reverseproxy:45", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] (111)%{result}: AH00957: %{network_service}: attempt to connect to %{daddr}:%{dport->} (%{fld5}) failed", processor_chain([ - dup25, - setc("event_id","AH00957"), - dup2, - dup3, - ])); - - var msg83 = msg("reverseproxy:45", part91); - - var part92 = match("MESSAGE#83:reverseproxy:46", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] AH00959: ap_proxy_connect_backend disabling worker for (%{daddr}) for %{processing_time}s", processor_chain([ - dup16, - setc("event_id","AH00959"), - setc("result","disabling worker"), - dup2, - dup3, - ])); - - var msg84 = msg("reverseproxy:46", part92); - - var part93 = match("MESSAGE#84:reverseproxy:47", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] [%{fld5}] not all the file sent to the client: %{fld6}, referer: %{web_referer}", processor_chain([ - setc("eventcategory","1801000000"), - setc("context","Not all file sent to client"), - dup2, - dup3, - ])); - - var msg85 = msg("reverseproxy:47", part93); - - var part94 = match("MESSAGE#85:reverseproxy:48", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}, referer: %{web_referer}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg86 = msg("reverseproxy:48", part94); - - var part95 = match("MESSAGE#86:reverseproxy:49", "nwparser.payload", "[%{fld3}] [%{event_log}:%{severity}] [pid %{process_id}:%{fld4}] [client %{gateway}] AH01114: %{network_service}: failed to make connection to backend: %{daddr}", processor_chain([ - dup25, - dup31, - dup32, - dup2, - dup3, - ])); - - var msg87 = msg("reverseproxy:49", part95); - - var part96 = tagval("MESSAGE#87:reverseproxy:05", "nwparser.payload", tvm, { - "cookie": "web_cookie", - "exceptions": "policy_waiver", - "extra": "info", - "host": "dhost", - "id": "policy_id", - "localip": "fld3", - "method": "web_method", - "reason": "comments", - "referer": "web_referer", - "server": "daddr", - "set-cookie": "fld5", - "size": "fld4", - "srcip": "saddr", - "statuscode": "resultcode", - "time": "processing_time", - "url": "web_root", - "user": "username", - }, processor_chain([ - setc("eventcategory","1802000000"), - dup2, - dup3, - ])); - - var msg88 = msg("reverseproxy:05", part96); - - var select8 = linear_select([ - msg40, - msg41, - msg42, - msg43, - msg44, - msg45, - msg46, - msg47, - msg48, - msg49, - msg50, - msg51, - msg52, - msg53, - msg54, - msg55, - msg56, - msg57, - msg58, - msg59, - msg60, - msg61, - msg62, - msg63, - msg64, - msg65, - msg66, - msg67, - msg68, - msg69, - msg70, - msg71, - msg72, - msg73, - msg74, - msg75, - msg76, - msg77, - msg78, - msg79, - msg80, - msg81, - msg82, - msg83, - msg84, - msg85, - msg86, - msg87, - msg88, - ]); - - var part97 = tagval("MESSAGE#88:confd-sync", "nwparser.payload", tvm, { - "id": "fld5", - "name": "event_description", - "severity": "severity", - "sub": "service", - "sys": "fld2", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg89 = msg("confd-sync", part97); - - var part98 = tagval("MESSAGE#89:confd:01", "nwparser.payload", tvm, { - "account": "logon_id", - "attributes": "obj_name", - "class": "group_object", - "client": "fld3", - "count": "fld4", - "facility": "logon_type", - "id": "fld1", - "name": "event_description", - "node": "node", - "object": "fld6", - "severity": "severity", - "srcip": "saddr", - "storage": "directory", - "sub": "service", - "sys": "fld2", - "type": "obj_type", - "user": "username", - "version": "version", - }, processor_chain([ - dup1, - dup11, - dup2, - ])); - - var msg90 = msg("confd:01", part98); - - var part99 = match("MESSAGE#90:frox", "nwparser.payload", "Frox started%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy Frox started."), - dup11, - dup2, - ])); - - var msg91 = msg("frox", part99); - - var part100 = match("MESSAGE#91:frox:01", "nwparser.payload", "Listening on %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy listening on port."), - dup11, - dup2, - ])); - - var msg92 = msg("frox:01", part100); - - var part101 = match("MESSAGE#92:frox:02", "nwparser.payload", "Dropped privileges%{}", processor_chain([ - dup12, - setc("event_description","frox:FTP Proxy dropped priveleges."), - dup11, - dup2, - ])); - - var msg93 = msg("frox:02", part101); - - var select9 = linear_select([ - msg91, - msg92, - msg93, - ]); - - var part102 = match("MESSAGE#93:afcd", "nwparser.payload", "Classifier configuration reloaded successfully%{}", processor_chain([ - dup12, - setc("event_description","afcd: IM/P2P Classifier configuration reloaded successfully."), - dup11, - dup2, - ])); - - var msg94 = msg("afcd", part102); - - var part103 = match("MESSAGE#94:ipsec_starter", "nwparser.payload", "Starting strongSwan %{fld2->} IPsec [starter]...", processor_chain([ - dup12, - setc("event_description","ipsec_starter: Starting strongSwan 4.2.3 IPsec [starter]..."), - dup11, - dup2, - ])); - - var msg95 = msg("ipsec_starter", part103); - - var part104 = match("MESSAGE#95:ipsec_starter:01", "nwparser.payload", "IP address or index of physical interface changed -> reinit of ipsec interface%{}", processor_chain([ - dup12, - setc("event_description","ipsec_starter: IP address or index of physical interface changed."), - dup11, - dup2, - ])); - - var msg96 = msg("ipsec_starter:01", part104); - - var select10 = linear_select([ - msg95, - msg96, - ]); - - var part105 = match("MESSAGE#96:pluto", "nwparser.payload", "Starting Pluto (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: Starting Pluto."), - dup11, - dup2, - ])); - - var msg97 = msg("pluto", part105); - - var part106 = match("MESSAGE#97:pluto:01", "nwparser.payload", "including NAT-Traversal patch (%{info})", processor_chain([ - dup12, - setc("event_description","pluto: including NAT-Traversal patch."), - dup11, - dup2, - ])); - - var msg98 = msg("pluto:01", part106); - - var part107 = match("MESSAGE#98:pluto:02", "nwparser.payload", "ike_alg: Activating %{info->} encryption: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating encryption algorithm."), - dup11, - dup2, - ])); - - var msg99 = msg("pluto:02", part107); - - var part108 = match("MESSAGE#99:pluto:03", "nwparser.payload", "ike_alg: Activating %{info->} hash: Ok", processor_chain([ - dup33, - setc("event_description","pluto: Activating hash algorithm."), - dup11, - dup2, - ])); - - var msg100 = msg("pluto:03", part108); - - var part109 = match("MESSAGE#100:pluto:04", "nwparser.payload", "Testing registered IKE encryption algorithms:%{}", processor_chain([ - dup12, - setc("event_description","pluto: Testing registered IKE encryption algorithms"), - dup11, - dup2, - ])); - - var msg101 = msg("pluto:04", part109); - - var part110 = match("MESSAGE#101:pluto:05", "nwparser.payload", "%{info->} self-test not available", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test not available."), - dup11, - dup2, - ])); - - var msg102 = msg("pluto:05", part110); - - var part111 = match("MESSAGE#102:pluto:06", "nwparser.payload", "%{info->} self-test passed", processor_chain([ - dup12, - setc("event_description","pluto: Algorithm self-test passed."), - dup11, - dup2, - ])); - - var msg103 = msg("pluto:06", part111); - - var part112 = match("MESSAGE#103:pluto:07", "nwparser.payload", "Using KLIPS IPsec interface code%{}", processor_chain([ - dup12, - setc("event_description","pluto: Using KLIPS IPsec interface code"), - dup11, - dup2, - ])); - - var msg104 = msg("pluto:07", part112); - - var part113 = match("MESSAGE#104:pluto:08", "nwparser.payload", "adding interface %{interface->} %{saddr}:%{sport}", processor_chain([ - dup12, - setc("event_description","pluto: adding interface"), - dup11, - dup2, - ])); - - var msg105 = msg("pluto:08", part113); - - var part114 = match("MESSAGE#105:pluto:09", "nwparser.payload", "loading secrets from \"%{filename}\"", processor_chain([ - dup34, - setc("event_description","pluto: loading secrets"), - dup11, - dup2, - ])); - - var msg106 = msg("pluto:09", part114); - - var part115 = match("MESSAGE#106:pluto:10", "nwparser.payload", "loaded private key file '%{filename}' (%{filename_size->} bytes)", processor_chain([ - dup34, - setc("event_description","pluto: loaded private key file"), - dup11, - dup2, - ])); - - var msg107 = msg("pluto:10", part115); - - var part116 = match("MESSAGE#107:pluto:11", "nwparser.payload", "added connection description \"%{fld2}\"", processor_chain([ - dup12, - setc("event_description","pluto: added connection description"), - dup11, - dup2, - ])); - - var msg108 = msg("pluto:11", part116); - - var part117 = match("MESSAGE#108:pluto:12", "nwparser.payload", "\"%{fld2}\" #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg109 = msg("pluto:12", part117); - - var part118 = match("MESSAGE#109:pluto:13", "nwparser.payload", "\"%{fld2}\" #%{fld3}: max number of retransmissions (%{fld4}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup10, - dup36, - dup11, - dup2, - ])); - - var msg110 = msg("pluto:13", part118); - - var part119 = match("MESSAGE#110:pluto:14", "nwparser.payload", "\"%{fld2}\" #%{fld3}: starting keying attempt %{fld4->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg111 = msg("pluto:14", part119); - - var part120 = match("MESSAGE#111:pluto:15", "nwparser.payload", "forgetting secrets%{}", processor_chain([ - dup12, - setc("event_description","pluto:forgetting secrets"), - dup11, - dup2, - ])); - - var msg112 = msg("pluto:15", part120); - - var part121 = match("MESSAGE#112:pluto:17", "nwparser.payload", "Changing to directory '%{directory}'", processor_chain([ - dup12, - setc("event_description","pluto:Changing to directory"), - dup11, - dup2, - ])); - - var msg113 = msg("pluto:17", part121); - - var part122 = match("MESSAGE#113:pluto:18", "nwparser.payload", "| *time to handle event%{}", processor_chain([ - dup12, - setc("event_description","pluto:*time to handle event"), - dup11, - dup2, - ])); - - var msg114 = msg("pluto:18", part122); - - var part123 = match("MESSAGE#114:pluto:19", "nwparser.payload", "| *received kernel message%{}", processor_chain([ - dup12, - setc("event_description","pluto:*received kernel message"), - dup11, - dup2, - ])); - - var msg115 = msg("pluto:19", part123); - - var part124 = match("MESSAGE#115:pluto:20", "nwparser.payload", "| rejected packet:%{}", processor_chain([ - dup25, - setc("event_description","pluto:rejected packet"), - dup11, - dup2, - ])); - - var msg116 = msg("pluto:20", part124); - - var part125 = match("MESSAGE#116:pluto:21", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg117 = msg("pluto:21", part125); - - var part126 = match("MESSAGE#117:pluto:22", "nwparser.payload", "| next event %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg118 = msg("pluto:22", part126); - - var part127 = match("MESSAGE#118:pluto:23", "nwparser.payload", "| inserting event %{event_type->} in %{fld2->} seconds for #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg119 = msg("pluto:23", part127); - - var part128 = match("MESSAGE#119:pluto:24", "nwparser.payload", "| event after this is %{event_type->} in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg120 = msg("pluto:24", part128); - - var part129 = match("MESSAGE#120:pluto:25", "nwparser.payload", "| recent %{action->} activity %{fld2->} seconds ago, %{info}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg121 = msg("pluto:25", part129); - - var part130 = match("MESSAGE#121:pluto:26", "nwparser.payload", "| *received %{rbytes->} bytes from %{saddr}:%{sport->} on %{dinterface}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg122 = msg("pluto:26", part130); - - var part131 = match("MESSAGE#122:pluto:27", "nwparser.payload", "| received %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg123 = msg("pluto:27", part131); - - var part132 = match("MESSAGE#123:pluto:28", "nwparser.payload", "| sent %{action->} notification %{msg->} with seqno = %{fld2}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg124 = msg("pluto:28", part132); - - var part133 = match("MESSAGE#124:pluto:29", "nwparser.payload", "| inserting event %{event_type}, timeout in %{fld2->} seconds", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg125 = msg("pluto:29", part133); - - var part134 = match("MESSAGE#125:pluto:30", "nwparser.payload", "| handling event %{event_type->} for %{saddr->} \"%{fld2}\" #%{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg126 = msg("pluto:30", part134); - - var part135 = match("MESSAGE#126:pluto:31", "nwparser.payload", "| %{event_description}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg127 = msg("pluto:31", part135); - - var part136 = match("MESSAGE#127:pluto:32", "nwparser.payload", "%{fld2}: asynchronous network error report on %{interface->} for message to %{daddr->} port %{dport}, complainant %{saddr}: Connection refused [errno %{fld4}, origin ICMP type %{icmptype->} code %{icmpcode->} (not authenticated)]", processor_chain([ - dup12, - setc("event_description","not authenticated"), - dup11, - dup2, - ])); - - var msg128 = msg("pluto:32", part136); - - var part137 = match("MESSAGE#128:pluto:33", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: initiating Main Mode", processor_chain([ - dup12, - dup35, - dup11, - dup2, - ])); - - var msg129 = msg("pluto:33", part137); - - var part138 = match("MESSAGE#129:pluto:34", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: max number of retransmissions (%{fld5}) reached STATE_MAIN_I1. No response (or no acceptable response) to our first IKE message", processor_chain([ - dup12, - dup36, - dup11, - dup2, - ])); - - var msg130 = msg("pluto:34", part138); - - var part139 = match("MESSAGE#130:pluto:35", "nwparser.payload", "\"%{fld2}\"[%{fld4}] %{saddr->} #%{fld3}: starting keying attempt %{fld5->} of an unlimited number", processor_chain([ - dup12, - dup37, - dup11, - dup2, - ])); - - var msg131 = msg("pluto:35", part139); - - var select11 = linear_select([ - msg97, - msg98, - msg99, - msg100, - msg101, - msg102, - msg103, - msg104, - msg105, - msg106, - msg107, - msg108, - msg109, - msg110, - msg111, - msg112, - msg113, - msg114, - msg115, - msg116, - msg117, - msg118, - msg119, - msg120, - msg121, - msg122, - msg123, - msg124, - msg125, - msg126, - msg127, - msg128, - msg129, - msg130, - msg131, - ]); - - var part140 = match("MESSAGE#131:xl2tpd", "nwparser.payload", "This binary does not support kernel L2TP.%{}", processor_chain([ - setc("eventcategory","1607000000"), - setc("event_description","xl2tpd:This binary does not support kernel L2TP."), - dup11, - dup2, - ])); - - var msg132 = msg("xl2tpd", part140); - - var part141 = match("MESSAGE#132:xl2tpd:01", "nwparser.payload", "xl2tpd version %{version->} started on PID:%{fld2}", processor_chain([ - dup12, - setc("event_description","xl2tpd:xl2tpd started."), - dup11, - dup2, - ])); - - var msg133 = msg("xl2tpd:01", part141); - - var part142 = match("MESSAGE#133:xl2tpd:02", "nwparser.payload", "Written by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg134 = msg("xl2tpd:02", part142); - - var part143 = match("MESSAGE#134:xl2tpd:03", "nwparser.payload", "Forked by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg135 = msg("xl2tpd:03", part143); - - var part144 = match("MESSAGE#135:xl2tpd:04", "nwparser.payload", "Inherited by %{info}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg136 = msg("xl2tpd:04", part144); - - var part145 = match("MESSAGE#136:xl2tpd:05", "nwparser.payload", "Listening on IP address %{saddr}, port %{sport}", processor_chain([ - dup12, - dup38, - dup11, - dup2, - ])); - - var msg137 = msg("xl2tpd:05", part145); - - var select12 = linear_select([ - msg132, - msg133, - msg134, - msg135, - msg136, - msg137, - ]); - - var part146 = match("MESSAGE#137:barnyard:01", "nwparser.payload", "Exiting%{}", processor_chain([ - dup12, - setc("event_description","barnyard: Exiting"), - dup11, - dup2, - ])); - - var msg138 = msg("barnyard:01", part146); - - var part147 = match("MESSAGE#138:barnyard:02", "nwparser.payload", "Initializing daemon mode%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Initializing daemon mode"), - dup11, - dup2, - ])); - - var msg139 = msg("barnyard:02", part147); - - var part148 = match("MESSAGE#139:barnyard:03", "nwparser.payload", "Opened spool file '%{filename}'", processor_chain([ - dup12, - setc("event_description","barnyard:Opened spool file."), - dup11, - dup2, - ])); - - var msg140 = msg("barnyard:03", part148); - - var part149 = match("MESSAGE#140:barnyard:04", "nwparser.payload", "Waiting for new data%{}", processor_chain([ - dup12, - setc("event_description","barnyard:Waiting for new data"), - dup11, - dup2, - ])); - - var msg141 = msg("barnyard:04", part149); - - var select13 = linear_select([ - msg138, - msg139, - msg140, - msg141, - ]); - - var part150 = match("MESSAGE#141:exim:01", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from localhost (%{hostname}) [%{saddr}]:%{sport->} closed by QUIT", processor_chain([ - dup12, - setc("event_description","exim:SMTP connection from localhost closed by QUIT"), - dup11, - dup2, - ])); - - var msg142 = msg("exim:01", part150); - - var part151 = match("MESSAGE#142:exim:02", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} [%{saddr}] F=\u003c\u003c%{from}> R=\u003c\u003c%{to}> Accepted: %{info}", processor_chain([ - setc("eventcategory","1207010000"), - setc("event_description","exim:e-mail accepted from relay."), - dup11, - dup2, - ])); - - var msg143 = msg("exim:02", part151); - - var part152 = match("MESSAGE#143:exim:03", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} \u003c\u003c= %{from->} H=localhost (%{hostname}) [%{saddr}]:%{sport->} P=%{protocol->} S=%{fld9->} id=%{info}", processor_chain([ - setc("eventcategory","1207000000"), - setc("event_description","exim: e-mail sent."), - dup11, - dup2, - ])); - - var msg144 = msg("exim:03", part152); - - var part153 = match("MESSAGE#144:exim:04", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} R=dnslookup defer (%{fld9}): host lookup did not complete", processor_chain([ - dup39, - setc("event_description","exim: e-mail host lookup did not complete in DNS."), - dup11, - dup2, - ])); - - var msg145 = msg("exim:04", part153); - - var part154 = match("MESSAGE#145:exim:05", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld8->} == %{from->} routing defer (%{fld9}): retry time not reached", processor_chain([ - dup39, - setc("event_description","exim: e-mail routing defer:retry time not reached."), - dup11, - dup2, - ])); - - var msg146 = msg("exim:05", part154); - - var part155 = match("MESSAGE#146:exim:06", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} exim %{version->} daemon started: pid=%{fld8}, no queue runs, listening for SMTP on port %{sport->} (%{info}) port %{fld9->} (%{fld10}) and for SMTPS on port %{fld11->} (%{fld12})", processor_chain([ - dup12, - setc("event_description","exim: exim daemon started."), - dup11, - dup2, - ])); - - var msg147 = msg("exim:06", part155); - - var part156 = match("MESSAGE#147:exim:07", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} Start queue run: pid=%{fld8}", processor_chain([ - dup12, - setc("event_description","exim: Start queue run."), - dup11, - dup2, - ])); - - var msg148 = msg("exim:07", part156); - - var part157 = match("MESSAGE#148:exim:08", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} pid %{fld8}: SIGHUP received: re-exec daemon", processor_chain([ - dup12, - setc("event_description","exim: SIGHUP received: re-exec daemon."), - dup11, - dup2, - ])); - - var msg149 = msg("exim:08", part157); - - var part158 = match("MESSAGE#149:exim:09", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim: SMTP connection from host."), - dup11, - dup2, - ])); - - var msg150 = msg("exim:09", part158); - - var part159 = match("MESSAGE#150:exim:10", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} rejected EHLO from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:rejected EHLO from host."), - dup11, - dup2, - ])); - - var msg151 = msg("exim:10", part159); - - var part160 = match("MESSAGE#151:exim:11", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} SMTP protocol synchronization error (%{result}): %{fld8->} H=[%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:SMTP protocol synchronization error rejected connection from host."), - dup11, - dup2, - ])); - - var msg152 = msg("exim:11", part160); - - var part161 = match("MESSAGE#152:exim:12", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} TLS error on connection from [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - setc("event_description","exim:TLS error on connection from host."), - dup11, - dup2, - ])); - - var msg153 = msg("exim:12", part161); - - var part162 = match("MESSAGE#153:exim:13", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} == %{hostname->} R=%{fld8->} T=%{fld9}: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg154 = msg("exim:13", part162); - - var part163 = match("MESSAGE#154:exim:14", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} %{fld10->} %{hostname->} [%{saddr}]:%{sport->} %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg155 = msg("exim:14", part163); - - var part164 = match("MESSAGE#155:exim:15", "nwparser.payload", "%{fld2}-%{fld3}-%{fld4->} %{fld5}:%{fld6}:%{fld7->} End queue run: %{info}", processor_chain([ - dup12, - dup40, - dup11, - dup2, - ])); - - var msg156 = msg("exim:15", part164); - - var part165 = match("MESSAGE#156:exim:16", "nwparser.payload", "%{fld2->} %{fld3}", processor_chain([ - dup12, - dup11, - dup2, - ])); - - var msg157 = msg("exim:16", part165); - - var select14 = linear_select([ - msg142, - msg143, - msg144, - msg145, - msg146, - msg147, - msg148, - msg149, - msg150, - msg151, - msg152, - msg153, - msg154, - msg155, - msg156, - msg157, - ]); - - var part166 = match("MESSAGE#157:smtpd:01", "nwparser.payload", "QMGR[%{fld2}]: %{fld3->} moved to work queue", processor_chain([ - dup12, - setc("event_description","smtpd: Process moved to work queue."), - dup11, - dup2, - ])); - - var msg158 = msg("smtpd:01", part166); - - var part167 = match("MESSAGE#158:smtpd:02", "nwparser.payload", "SCANNER[%{fld3}]: id=\"1000\" severity=\"%{severity}\" sys=\"%{fld4}\" sub=\"%{service}\" name=\"%{event_description}\" srcip=\"%{saddr}\" from=\"%{from}\" to=\"%{to}\" subject=\"%{subject}\" queueid=\"%{fld5}\" size=\"%{rbytes}\"", processor_chain([ - setc("eventcategory","1207010100"), - dup11, - dup2, - ])); - - var msg159 = msg("smtpd:02", part167); - - var part168 = match("MESSAGE#159:smtpd:03", "nwparser.payload", "SCANNER[%{fld3}]: Nothing to do, exiting.", processor_chain([ - dup12, - setc("event_description","smtpd: SCANNER: Nothing to do,exiting."), - dup11, - dup2, - ])); - - var msg160 = msg("smtpd:03", part168); - - var part169 = match("MESSAGE#160:smtpd:04", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status two set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status two set to disabled."), - dup11, - dup2, - ])); - - var msg161 = msg("smtpd:04", part169); - - var part170 = match("MESSAGE#161:smtpd:07", "nwparser.payload", "MASTER[%{fld3}]: QR globally disabled, status one set to 'disabled'", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:QR globally disabled, status one set to disabled."), - dup11, - dup2, - ])); - - var msg162 = msg("smtpd:07", part170); - - var part171 = match("MESSAGE#162:smtpd:05", "nwparser.payload", "MASTER[%{fld3}]: (Re-)loading configuration from Confd", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:(Re-)loading configuration from Confd."), - dup11, - dup2, - ])); - - var msg163 = msg("smtpd:05", part171); - - var part172 = match("MESSAGE#163:smtpd:06", "nwparser.payload", "MASTER[%{fld3}]: Sending QR one", processor_chain([ - dup12, - setc("event_description","smtpd: MASTER:Sending QR one."), - dup11, - dup2, - ])); - - var msg164 = msg("smtpd:06", part172); - - var select15 = linear_select([ - msg158, - msg159, - msg160, - msg161, - msg162, - msg163, - msg164, - ]); - - var part173 = match("MESSAGE#164:sshd:01", "nwparser.payload", "Did not receive identification string from %{fld18}", processor_chain([ - dup10, - setc("event_description","sshd: Did not receive identification string."), - dup11, - dup2, - ])); - - var msg165 = msg("sshd:01", part173); - - var part174 = match("MESSAGE#165:sshd:02", "nwparser.payload", "Received SIGHUP; restarting.%{}", processor_chain([ - dup12, - setc("event_description","sshd:Received SIGHUP restarting."), - dup11, - dup2, - ])); - - var msg166 = msg("sshd:02", part174); - - var part175 = match("MESSAGE#166:sshd:03", "nwparser.payload", "Server listening on %{saddr->} port %{sport}.", processor_chain([ - dup12, - setc("event_description","sshd:Server listening; restarting."), - dup11, - dup2, - ])); - - var msg167 = msg("sshd:03", part175); - - var part176 = match("MESSAGE#167:sshd:04", "nwparser.payload", "Invalid user admin from %{fld18}", processor_chain([ - dup41, - setc("event_description","sshd:Invalid user admin."), - dup11, - dup2, - ])); - - var msg168 = msg("sshd:04", part176); - - var part177 = match("MESSAGE#168:sshd:05", "nwparser.payload", "Failed none for invalid user admin from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed none for invalid user admin."), - dup11, - dup2, - ])); - - var msg169 = msg("sshd:05", part177); - - var part178 = match("MESSAGE#169:sshd:06", "nwparser.payload", "error: Could not get shadow information for NOUSER%{}", processor_chain([ - dup10, - setc("event_description","sshd:error:Could not get shadow information for NOUSER"), - dup11, - dup2, - ])); - - var msg170 = msg("sshd:06", part178); - - var part179 = match("MESSAGE#170:sshd:07", "nwparser.payload", "Failed password for root from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - dup41, - setc("event_description","sshd:Failed password for root."), - dup11, - dup2, - ])); - - var msg171 = msg("sshd:07", part179); - - var part180 = match("MESSAGE#171:sshd:08", "nwparser.payload", "Accepted password for loginuser from %{saddr->} port %{sport->} %{fld3}", processor_chain([ - setc("eventcategory","1302000000"), - setc("event_description","sshd:Accepted password for loginuser."), - dup11, - dup2, - ])); - - var msg172 = msg("sshd:08", part180); - - var part181 = match("MESSAGE#172:sshd:09", "nwparser.payload", "subsystem request for sftp failed, subsystem not found%{}", processor_chain([ - dup10, - setc("event_description","sshd:subsystem request for sftp failed,subsystem not found."), - dup11, - dup2, - ])); - - var msg173 = msg("sshd:09", part181); - - var select16 = linear_select([ - msg165, - msg166, - msg167, - msg168, - msg169, - msg170, - msg171, - msg172, - msg173, - ]); - - var part182 = tagval("MESSAGE#173:aua:01", "nwparser.payload", tvm, { - "caller": "fld4", - "engine": "fld5", - "id": "fld1", - "name": "event_description", - "severity": "severity", - "srcip": "saddr", - "sub": "service", - "sys": "fld2", - "user": "username", - }, processor_chain([ - dup13, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg174 = msg("aua:01", part182); - - var part183 = match("MESSAGE#174:sockd:01", "nwparser.payload", "created new negotiatorchild%{}", processor_chain([ - dup12, - setc("event_description","sockd: created new negotiatorchild."), - dup11, - dup2, - ])); - - var msg175 = msg("sockd:01", part183); - - var part184 = match("MESSAGE#175:sockd:02", "nwparser.payload", "dante/server %{version->} running", processor_chain([ - dup12, - setc("event_description","sockd:dante/server running."), - dup11, - dup2, - ])); - - var msg176 = msg("sockd:02", part184); - - var part185 = match("MESSAGE#176:sockd:03", "nwparser.payload", "sockdexit(): terminating on signal %{fld2}", processor_chain([ - dup12, - setc("event_description","sockd:sockdexit():terminating on signal."), - dup11, - dup2, - ])); - - var msg177 = msg("sockd:03", part185); - - var select17 = linear_select([ - msg175, - msg176, - msg177, - ]); - - var part186 = match("MESSAGE#177:pop3proxy", "nwparser.payload", "Master started%{}", processor_chain([ - dup12, - setc("event_description","pop3proxy:Master started."), - dup11, - dup2, - ])); - - var msg178 = msg("pop3proxy", part186); - - var part187 = tagval("MESSAGE#178:astarosg_TVM", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg179 = msg("astarosg_TVM", part187); - - var part188 = tagval("MESSAGE#179:httpd", "nwparser.payload", tvm, { - "account": "logon_id", - "action": "action", - "ad_domain": "fld5", - "app-id": "fld20", - "application": "fld19", - "attributes": "obj_name", - "auth": "fld15", - "authtime": "fld9", - "avscantime": "fld12", - "cached": "fld7", - "caller": "fld30", - "category": "policy_id", - "categoryname": "info", - "cattime": "fld11", - "class": "group_object", - "client": "fld3", - "content-type": "content_type", - "cookie": "web_cookie", - "count": "fld4", - "device": "fld14", - "dnstime": "fld10", - "dstip": "daddr", - "dstmac": "dmacaddr", - "dstport": "dport", - "engine": "fld31", - "error": "comments", - "exceptions": "fld17", - "extension": "web_extension", - "extra": "info", - "facility": "logon_type", - "file": "filename", - "filename": "filename", - "filteraction": "policyname", - "fullreqtime": "fld13", - "function": "action", - "fwrule": "policy_id", - "group": "group", - "host": "dhost", - "id": "rule", - "info": "context", - "initf": "sinterface", - "length": "fld25", - "line": "fld22", - "localip": "fld31", - "message": "context", - "method": "web_method", - "name": "event_description", - "node": "node", - "object": "fld6", - "outitf": "dinterface", - "port": "network_port", - "prec": "fld30", - "profile": "owner", - "proto": "fld24", - "query": "web_query", - "reason": "comments", - "referer": "web_referer", - "reputation": "fld18", - "request": "fld8", - "seq": "fld23", - "server": "daddr", - "set-cookie": "fld32", - "severity": "severity", - "size": "filename_size", - "srcip": "saddr", - "srcmac": "smacaddr", - "srcport": "sport", - "statuscode": "resultcode", - "storage": "directory", - "sub": "service", - "sys": "vsys", - "tcpflags": "fld29", - "time": "fld21", - "tos": "fld26", - "ttl": "fld28", - "type": "obj_type", - "ua": "fld16", - "uid": "uid", - "url": "url", - "user": "username", - "version": "version", - }, processor_chain([ - dup12, - dup11, - dup2, - dup45, - dup46, - ])); - - var msg180 = msg("httpd", part188); - - var part189 = match("MESSAGE#180:httpd:01", "nwparser.payload", "[%{event_log}:%{result}] [pid %{fld3}:%{fld4}] [client %{gateway}] ModSecurity: Warning. %{rulename->} [file \"%{filename}\"] [line \"%{fld5}\"] [id \"%{rule}\"] [rev \"%{fld2}\"] [msg \"%{event_description}\"] [severity \"%{severity}\"] [ver \"%{version}\"] [maturity \"%{fld22}\"] [accuracy \"%{fld23}\"] [tag \"%{fld24}\"] [hostname \"%{dhost}\"] [uri \"%{web_root}\"] [unique_id \"%{operation_id}\"]%{fld25}", processor_chain([ - setc("eventcategory","1502000000"), - dup2, - dup3, - ])); - - var msg181 = msg("httpd:01", part189); - - var select18 = linear_select([ - msg180, - msg181, - ]); - - var part190 = tagval("MESSAGE#181:Sophos_Firewall", "nwparser.payload", tvm, { - "activityname": "fld9", - "appfilter_policy_id": "fld10", - "application": "application", - "application_category": "fld23", - "application_risk": "risk_num", - "application_technology": "fld11", - "appresolvedby": "fld22", - "category": "fld4", - "category_type": "fld5", - "connevent": "fld19", - "connid": "connectionid", - "contenttype": "content_type", - "dir_disp": "fld18", - "domain": "fqdn", - "dst_country_code": "location_dst", - "dst_ip": "daddr", - "dst_port": "dport", - "dstzone": "dst_zone", - "dstzonetype": "fld17", - "duration": "duration", - "exceptions": "fld8", - "fw_rule_id": "rule_uid", - "hb_health": "fld21", - "httpresponsecode": "fld7", - "iap": "id1", - "in_interface": "sinterface", - "ips_policy_id": "policy_id", - "log_component": "event_source", - "log_subtype": "category", - "log_type": "event_type", - "message": "info", - "out_interface": "dinterface", - "override_token": "fld6", - "policy_type": "fld23", - "priority": "severity", - "protocol": "protocol", - "reason": "result", - "recv_bytes": "rbytes", - "recv_pkts": "fld15", - "referer": "web_referer", - "sent_bytes": "sbytes", - "sent_pkts": "fld14", - "src_country_code": "location_src", - "src_ip": "saddr", - "src_mac": "smacaddr", - "src_port": "sport", - "srczone": "src_zone", - "srczonetype": "fld16", - "status": "event_state", - "status_code": "resultcode", - "tran_dst_ip": "dtransaddr", - "tran_dst_port": "dtransport", - "tran_src_ip": "stransaddr", - "tran_src_port": "stransport", - "transactionid": "id2", - "url": "url", - "user_agent": "user_agent", - "user_gp": "group", - "user_name": "username", - "vconnid": "fld20", - }, processor_chain([ - setc("eventcategory","1204000000"), - dup2, - date_time({ - dest: "event_time", - args: ["hdate","htime"], - fmts: [ - [dW,dc("-"),dG,dc("-"),dF,dH,dc(":"),dU,dc(":"),dS], - ], - }), - ])); - - var msg182 = msg("Sophos_Firewall", part190); - - var chain1 = processor_chain([ - select1, - msgid_select({ - "Sophos_Firewall": msg182, - "URID": msg38, - "afcd": msg94, - "astarosg_TVM": msg179, - "aua": msg174, - "barnyard": select13, - "confd": msg90, - "confd-sync": msg89, - "exim": select14, - "frox": select9, - "httpd": select18, - "httpproxy": select3, - "ipsec_starter": select10, - "named": select2, - "pluto": select11, - "pop3proxy": msg178, - "reverseproxy": select8, - "smtpd": select15, - "sockd": select17, - "sshd": select16, - "ulogd": msg39, - "xl2tpd": select12, - }), - ]); - - var part191 = match_copy("MESSAGE#44:reverseproxy:07/1_0", "nwparser.p0", "p0"); - -- community_id: -- registered_domain: - ignore_missing: true - ignore_failure: true - field: dns.question.name - target_field: dns.question.registered_domain - target_subdomain_field: dns.question.subdomain - target_etld_field: dns.question.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: client.domain - target_field: client.registered_domain - target_subdomain_field: client.subdomain - target_etld_field: client.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: server.domain - target_field: server.registered_domain - target_subdomain_field: server.subdomain - target_etld_field: server.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: destination.domain - target_field: destination.registered_domain - target_subdomain_field: destination.subdomain - target_etld_field: destination.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: source.domain - target_field: source.registered_domain - target_subdomain_field: source.subdomain - target_etld_field: source.top_level_domain -- registered_domain: - ignore_missing: true - ignore_failure: true - field: url.domain - target_field: url.registered_domain - target_subdomain_field: url.subdomain - target_etld_field: url.top_level_domain -- add_locale: ~ +{{/if}} \ No newline at end of file diff --git a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/default.yml b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/default.yml index 664ea6a9b04..8f8c8a6bc1d 100644 --- a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/default.yml @@ -1,87 +1,169 @@ --- -description: Pipeline for Sophos UTM (formerly Astaro Security Gateway). - +description: Pipeline for Sophos UTM (formerly Astaro Security Gateway) processors: - set: field: ecs.version - value: '8.8.0' - - gsub: - field: destination.mac - ignore_missing: true - pattern: '[:]' - replacement: '-' - - gsub: - field: source.mac - ignore_missing: true - pattern: '[:]' - replacement: '-' - - uppercase: - field: destination.mac - ignore_missing: true - - uppercase: - field: source.mac - ignore_missing: true - # User agent - - user_agent: - field: user_agent.original - ignore_missing: true - # IP Geolocation Lookup - - geoip: - field: source.ip - target_field: source.geo - ignore_missing: true - - geoip: - field: destination.ip - target_field: destination.geo - ignore_missing: true - - # IP Autonomous System (AS) Lookup - - geoip: - database_file: GeoLite2-ASN.mmdb - field: source.ip - target_field: source.as - properties: - - asn - - organization_name - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: destination.ip - target_field: destination.as - properties: - - asn - - organization_name - ignore_missing: true - - rename: - field: source.as.asn - target_field: source.as.number - ignore_missing: true - - rename: - field: source.as.organization_name - target_field: source.as.organization.name - ignore_missing: true + value: '8.9.0' + tag: set_ecs_version - rename: - field: destination.as.asn - target_field: destination.as.number + field: message + target_field: event.original ignore_missing: true + tag: rename_event_original + - set: + field: event.category + value: [network] + tag: set_event_category + - set: + field: event.type + value: [info] + tag: set_event_type + - set: + field: event.kind + value: event + tag: set_event_kind + + # Parse the event header: populates the timestamp, hostname, and process info + # from the header and stores the message in _tmp.raw_data + - grok: + field: event.original + if: ctx.event?.original != null + pattern_definitions: + SOPHOS_TIMESTAMP: (?:%{YEAR}:%{MONTHNUM}:%{MONTHDAY}-%{HOUR}:%{MINUTE}:%{SECOND}) + patterns: + - '^%{SOPHOS_TIMESTAMP:_tmp.timestamp} (?:%{HOSTNAME:host.hostname}) %{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?: %{GREEDYDATA:_tmp.raw_data}' + tag: grok_syslog_header + on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error + # Process timestamp and timezone if configured (default UTC) - rename: - field: destination.as.organization_name - target_field: destination.as.organization.name + if: ctx._conf?.tz_offset != null + field: _conf.tz_offset + target_field: event.timezone ignore_missing: true + tag: rename_conf_timezone + - set: + field: event.timezone + value: UTC + override: false + tag: set_default_timezone + - date: + if: ctx._tmp?.timestamp != null + timezone: "{{{ event.timezone }}}" + field: _tmp.timestamp + formats: + - yyyy:MM:dd-HH:mm:ss + tag: date_set_timestamp + on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error + + # Choose the pipeline based on the log source + - set: + field: event.provider + value: dns + if: ctx.process?.name == 'named' + tag: set_provider_dns + - set: + field: event.provider + value: dhcp + if: ctx.process?.name == 'dhcpd' + tag: set_provider_dhcp + - set: + field: event.provider + value: http + if: ctx.process?.name == 'httpproxy' + tag: set_provider_http + - set: + field: event.provider + value: packetfilter + if: ctx.process?.name == 'ulogd' + tag: set_provider_packetfilter + - pipeline: + name: '{{ IngestPipeline "dns" }}' + if: ctx.event?.provider == 'dns' + tag: pipeline_dns + - pipeline: + name: '{{ IngestPipeline "dhcp" }}' + if: ctx.event?.provider == 'dhcp' + tag: pipeline_dhcp + - pipeline: + name: '{{ IngestPipeline "http" }}' + if: ctx.event?.provider == 'http' + tag: pipeline_http + - pipeline: + name: '{{ IngestPipeline "packetfilter" }}' + if: ctx.event?.provider == 'packetfilter' + tag: pipeline_packetfilter + + # Set observer fields + - set: + field: observer.vendor + value: Sophos + tag: set_observer_vendor + - set: + field: observer.product + value: UTM + tag: set_observer_product + - set: + field: observer.type + value: firewall + tag: set_observer_type + + # Fill related fields - append: field: related.hosts - value: '{{host.name}}' + value: '{{{host.hostname}}}' allow_duplicates: false - if: ctx.host?.name != null && ctx.host?.name != '' + if: ctx.host?.hostname != null && ctx.host.hostname != '' + tag: append_related_hosts + + # Clean event + - remove: + field: _tmp + ignore_failure: true + ignore_missing: true + tag: remove_tmp - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) ignore_failure: true ignore_missing: true + tag: remove_event_original + - script: + description: Drops null/empty values recursively. + tag: script_drop_empty_fields + lang: painless + source: + boolean dropEmptyFields(Object object) { + if (object == null || object == "") { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(value -> dropEmptyFields(value)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(value -> dropEmptyFields(value)); + return (((List) object).length == 0); + } + return false; + } + dropEmptyFields(ctx); on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" - set: field: event.kind value: pipeline_error - - append: - field: error.message - value: '{{{ _ingest.on_failure_message }}}' diff --git a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dhcp.yml b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dhcp.yml new file mode 100644 index 00000000000..3eebc9467f6 --- /dev/null +++ b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dhcp.yml @@ -0,0 +1,166 @@ +--- +description: Pipeline for Sophos UTM DHCP logs +processors: + - append: + field: event.type + value: + - connection + - protocol + allow_duplicates: false + tag: append_type_network + - set: + field: network.protocol + value: dhcp + tag: set_network_protocol + - set: + field: network.transport + value: udp + tag: set_network_transport + + # Process DHCP events in separate grok processors + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPDISCOVER') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} from %{MAC:client.mac} via %{WORD:observer.ingress.interface.name}: %{GREEDYDATA:message}$' + - '^%{WORD:event.action} from %{MAC:client.mac} via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_discover + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPOFFER') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} on %{IP:client.ip} to %{MAC:client.mac} via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_offer + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPREQUEST') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} for %{IP:client.ip}( \(%{IP:sophos.utm.router.ip}\))? from %{MAC:client.mac}( \(%{DATA:sophos.utm.client.hostname}\))? via %{WORD:observer.ingress.interface.name}(: %{GREEDYDATA:message})?$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_request + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPACK') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} on %{IP:client.ip} to %{MAC:client.mac}( \(%{DATA:sophos.utm.client.hostname}\))? via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} to %{IP:client.ip} \(%{MAC:client.mac}\) via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_ack + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPNACK') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} on %{IP:client.ip} to %{MAC:client.mac}( \(%{DATA:sophos.utm.client.hostname}\))? via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} to %{IP:client.ip} \(%{MAC:client.mac}\) via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_nak + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('DHCPINFORM') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} from %{IP:client.ip} via %{WORD:observer.ingress.interface.name}: %{GREEDYDATA:message}$' + - '^%{WORD:event.action} from %{IP:client.ip} via %{WORD:observer.ingress.interface.name}$' + - '^%{WORD:event.action} %{GREEDYDATA:message}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_inform + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('Listening') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action}[ ]+on[ ]+%{WORD:sophos.utm.socket}/%{WORD:observer.ingress.interface.name}/%{MAC:client.mac}/%{DATA:sophos.utm.subnet}$' + - '^%{WORD:event.action}[ ]+on[ ]+%{WORD:sophos.utm.socket}/%{WORD:observer.ingress.interface.name}/%{DATA:sophos.utm.subnet}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_listening + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.startsWith('Sending') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action}[ ]+on[ ]+%{WORD:sophos.utm.socket}/%{WORD:observer.ingress.interface.name}/%{MAC:client.mac}/%{DATA:sophos.utm.subnet}$' + - '^%{WORD:event.action}[ ]+on[ ]+%{WORD:sophos.utm.socket}/%{WORD:observer.ingress.interface.name}/%{DATA:sophos.utm.subnet}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_sending + - grok: + if: ctx.event?.action == null + field: _tmp.raw_data + patterns: + - '^%{GREEDYDATA:message}$' + tag: grok_dhcp_default + - lowercase: + field: event.action + ignore_failure: true + ignore_missing: true + tag: lowercase_event_action + - set: + field: event.action + value: '{{{process.name}}}-{{{event.action}}}' + if: ctx.event?.action != null && (ctx.event.action == 'sending' || ctx.event.action == 'listening') + tag: set_event_action_dhcpd + + # Transform MAC address + - gsub: + field: client.mac + ignore_missing: true + pattern: '[:]' + replacement: '-' + tag: gsub_client_mac + - uppercase: + field: client.mac + ignore_missing: true + tag: uppercase_client_mac + + # IP Geolocation Lookup + - geoip: + field: client.ip + target_field: client.geo + ignore_missing: true + tag: geo_client_ip + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: client.ip + target_field: client.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_client_as + - rename: + field: client.as.asn + target_field: client.as.number + ignore_missing: true + tag: rename_client_as_number + - rename: + field: client.as.organization_name + target_field: client.as.organization.name + ignore_missing: true + tag: rename_client_as_org + + # Fill related fields + - append: + field: related.hosts + value: '{{{sophos.utm.client.hostname}}}' + allow_duplicates: false + if: ctx.sophos?.utm?.client?.hostname != null && ctx.sophos.utm.client.hostname != '' + tag: append_related_client_host + - append: + field: related.ip + value: '{{{client.ip}}}' + allow_duplicates: false + if: ctx.client?.ip != null && ctx.client.ip != '' + tag: append_related_client_ip +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dns.yml b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dns.yml new file mode 100644 index 00000000000..bd286a6d7d0 --- /dev/null +++ b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/dns.yml @@ -0,0 +1,94 @@ +--- +description: Pipeline for Sophos UTM DNS logs +processors: + - append: + field: event.type + value: + - connection + - protocol + allow_duplicates: false + tag: append_type_network + - set: + field: network.protocol + value: dns + tag: set_network_protocol + - set: + field: network.transport + value: udp + tag: set_network_transport + - grok: + if: ctx._tmp?.raw_data != null && ctx._tmp.raw_data.contains('listening') + field: _tmp.raw_data + patterns: + - '^%{WORD:event.action} on %{WORD:network.type} interface %{WORD:observer.ingress.interface.name}, %{IP:server.ip}#%{NUMBER:server.port:long}$' + - '^no longer %{WORD:event.action} on %{IP:server.ip}#%{NUMBER:server.port:long}$' + - '^%{GREEDYDATA:message}$' + tag: grok_dns + - grok: + if: ctx.event?.action == null + field: _tmp.raw_data + patterns: + - '^%{GREEDYDATA:message}$' + tag: grok_dns_default + + # Lowercase fields + - lowercase: + field: event.action + ignore_failure: true + ignore_missing: true + tag: lowercase_event_action + - lowercase: + field: network.type + ignore_failure: true + ignore_missing: true + tag: lowercase_network_type + + - set: + field: event.action + value: '{{{process.name}}}-{{{event.action}}}' + if: ctx.event?.action != null + tag: set_event_action_dns + + # IP Geolocation Lookup + - geoip: + field: server.ip + target_field: server.geo + ignore_missing: true + tag: geo_server_ip + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: server.ip + target_field: server.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_server_as + - rename: + field: server.as.asn + target_field: server.as.number + ignore_missing: true + tag: rename_server_as_number + - rename: + field: server.as.organization_name + target_field: server.as.organization.name + ignore_missing: true + tag: rename_server_as_org + + # Fill related fields + - append: + field: related.ip + value: '{{{server.ip}}}' + allow_duplicates: false + if: ctx.server?.ip != null && ctx.server.ip != '' + tag: append_related_server_ip +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/http.yml b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/http.yml new file mode 100644 index 00000000000..32ce078b468 --- /dev/null +++ b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/http.yml @@ -0,0 +1,316 @@ +--- +description: Pipeline for Sophos UTM HTTP logs +processors: + - set: + field: network.protocol + value: http + tag: set_network_protocol + - set: + field: event.category + value: [web] + tag: overwrite_event_category + - kv: + if: ctx._tmp?.raw_data != null + field: _tmp.raw_data + field_split: ' (?=[a-z0-9\_\-]+=")' + value_split: '=' + prefix: 'sophos.utm.' + trim_value: '" ' + ignore_missing: true + tag: kv_parse_fields + + # Map ECS fields + - rename: + field: sophos.utm.action + target_field: event.action + if: ctx.sophos?.utm?.action != null && ctx.sophos?.utm?.reason == null + tag: rename_event_action + - set: + field: event.action + value: '{{{sophos.utm.action}}}-{{{sophos.utm.reason}}}' + if: ctx.sophos?.utm?.action != null && ctx.sophos?.utm?.reason != null + tag: set_event_action_reason + - rename: + field: sophos.utm.application + target_field: network.application + ignore_missing: true + tag: rename_network_application + - rename: + field: sophos.utm.dstip + target_field: destination.ip + ignore_missing: true + tag: rename_destination_ip + - rename: + field: sophos.utm.device + target_field: device.id + ignore_missing: true + tag: rename_device_id + - rename: + field: sophos.utm.error + target_field: error.message + if: ctx.sophos?.utm?.error != null && ctx.sophos.utm.error != '' + tag: rename_error_message + - rename: + field: sophos.utm.file + target_field: file.name + if: ctx.sophos?.utm?.file != null && ctx.sophos.utm.file != '' + tag: rename_file + - rename: + field: sophos.utm.filename + target_field: file.name + if: ctx.sophos?.utm?.filename != null && ctx.sophos.utm.filename != '' + tag: rename_filename + - rename: + field: sophos.utm.group + target_field: group.name + ignore_missing: true + tag: rename_group_name + - rename: + field: sophos.utm.id + target_field: event.id + ignore_missing: true + tag: rename_event_id + - rename: + field: sophos.utm.message + target_field: message + ignore_missing: true + tag: rename_message + - rename: + field: sophos.utm.method + target_field: http.request.method + ignore_missing: true + tag: rename_http_method + - rename: + field: sophos.utm.referer + target_field: http.request.referrer + ignore_missing: true + tag: rename_http_referrer + - rename: + field: sophos.utm.request + target_field: http.request.id + ignore_missing: true + tag: rename_http_request_id + - convert: + field: sophos.utm.size + type: long + ignore_missing: true + tag: convert_http_size + - rename: + field: sophos.utm.size + target_field: http.request.bytes + ignore_missing: true + tag: rename_http_request_size + - rename: + field: sophos.utm.srcip + target_field: source.ip + ignore_missing: true + tag: rename_source_ip + - convert: + field: sophos.utm.statuscode + type: long + ignore_missing: true + tag: convert_status_code + - rename: + field: sophos.utm.statuscode + target_field: http.response.status_code + ignore_missing: true + tag: rename_status_code + - rename: + field: sophos.utm.ua + target_field: user_agent.original + ignore_missing: true + tag: rename_user_agent + - user_agent: + field: user_agent.original + ignore_missing: true + - uri_parts: + field: sophos.utm.url + target_field: url + remove_if_successful: true + if: ctx.sophos?.utm?.url != null + - rename: + field: sophos.utm.user + target_field: user.name + ignore_missing: true + tag: rename_user + + # Convert severity + - set: + field: event.severity + value: 0 + if: ctx.sophos?.utm?.severity == 'emergency' + tag: set_severity_0 + - set: + field: event.severity + value: 1 + if: ctx.sophos?.utm?.severity == 'alert' + tag: set_severity_1 + - set: + field: event.severity + value: 2 + if: ctx.sophos?.utm?.severity == 'critical' + tag: set_severity_2 + - set: + field: event.severity + value: 3 + if: ctx.sophos?.utm?.severity == 'error' + tag: set_severity_3 + - set: + field: event.severity + value: 4 + if: ctx.sophos?.utm?.severity == 'warning' + tag: set_severity_4 + - set: + field: event.severity + value: 5 + if: ctx.sophos?.utm?.severity == 'notice' + tag: set_severity_5 + - set: + field: event.severity + value: 6 + if: ctx.sophos?.utm?.severity == 'info' + tag: set_severity_6 + - set: + field: event.severity + value: 7 + if: ctx.sophos?.utm?.severity == 'debug' + tag: set_severity_7 + + # Split fields that contains several values + - split: + field: sophos.utm.category + separator: ',' + ignore_missing: true + tag: split_category + - split: + field: sophos.utm.categoryname + separator: ',' + ignore_missing: true + tag: split_category_name + - split: + field: sophos.utm.exceptions + separator: ',' + ignore_missing: true + tag: split_exceptions + + # Converts all kebab-case key names to snake_case + - foreach: + field: sophos.utm + processor: + gsub: + field: _ingest._key + pattern: '-' + replacement: '_' + tag: gsub_convert_snake_case + + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + tag: geo_source_ip + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + tag: geo_destination_ip + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_source_as + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_destination_as + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + tag: rename_source_as_number + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + tag: rename_source_as_org + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + tag: rename_destination_as_number + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + tag: rename_destination_as_org + + # Convert time fields to long + - convert: + field: sophos.utm.aptptime + type: long + ignore_missing: true + tag: convert_aptptime_long + - convert: + field: sophos.utm.authtime + type: long + ignore_missing: true + tag: convert_authtime_long + - convert: + field: sophos.utm.avscantime + type: long + ignore_missing: true + tag: convert_avscantime_long + - convert: + field: sophos.utm.cattime + type: long + ignore_missing: true + tag: convert_cattime_long + - convert: + field: sophos.utm.dnstime + type: long + ignore_missing: true + tag: convert_dnstime_long + - convert: + field: sophos.utm.fullreqtime + type: long + ignore_missing: true + tag: convert_fullreqtime_long + + # Fill related fields + - append: + field: related.ip + value: '{{{source.ip}}}' + allow_duplicates: false + if: ctx.source?.ip != null && ctx.source.ip != '' + tag: append_related_source_ip + - append: + field: related.ip + value: '{{{destination.ip}}}' + allow_duplicates: false + if: ctx.destination?.ip != null && ctx.destination.ip != '' + tag: append_related_destination_ip + - append: + field: related.user + value: '{{{user.name}}}' + allow_duplicates: false + if: ctx.user?.name != null && ctx.user.name != '' + tag: append_related_user +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/packetfilter.yml b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/packetfilter.yml new file mode 100644 index 00000000000..df95ecdc894 --- /dev/null +++ b/packages/sophos/data_stream/utm/elasticsearch/ingest_pipeline/packetfilter.yml @@ -0,0 +1,271 @@ +--- +description: Pipeline for Sophos UTM Packet Filter logs +processors: + - kv: + if: ctx._tmp?.raw_data != null + field: _tmp.raw_data + field_split: ' (?=[a-z0-9\_\-]+=)' + value_split: '=' + prefix: 'sophos.utm.' + trim_value: '" ' + ignore_missing: true + tag: kv_parse_fields + + # Map ECS fields + - rename: + field: sophos.utm.action + target_field: event.action + ignore_missing: true + tag: rename_event_action + - append: + if: ctx.event?.action == 'accept' + field: event.type + value: + - allowed + allow_duplicates: false + tag: append_type_allowed + - append: + if: ctx.event?.action == 'drop' + field: event.type + value: + - denied + allow_duplicates: false + tag: append_type_denied + - rename: + field: sophos.utm.dstip + target_field: destination.ip + ignore_missing: true + tag: rename_destination_ip + - rename: + field: sophos.utm.dstmac + target_field: destination.mac + ignore_missing: true + tag: rename_destination_mac + - convert: + field: sophos.utm.dstport + type: long + ignore_missing: true + tag: convert_destination_port + - rename: + field: sophos.utm.dstport + target_field: destination.port + ignore_missing: true + tag: rename_destination_port + - rename: + field: sophos.utm.id + target_field: event.id + ignore_missing: true + tag: rename_event_id + - rename: + field: sophos.utm.srcip + target_field: source.ip + ignore_missing: true + tag: rename_source_ip + - rename: + field: sophos.utm.srcmac + target_field: source.mac + ignore_missing: true + tag: rename_source_mac + - convert: + field: sophos.utm.srcport + type: long + ignore_missing: true + tag: convert_source_port + - rename: + field: sophos.utm.srcport + target_field: source.port + ignore_missing: true + tag: rename_source_port + - rename: + field: sophos.utm.fwrule + target_field: rule.id + ignore_missing: true + tag: rename_rule_id + - rename: + field: sophos.utm.initf + target_field: observer.ingress.interface.name + ignore_missing: true + tag: rename_ingress_interface + - rename: + field: sophos.utm.outitf + target_field: observer.egress.interface.name + ignore_missing: true + tag: rename_egress_interface + - rename: + field: sophos.utm.proto + target_field: network.iana_number + ignore_missing: true + tag: rename_protocol_iana_number + - rename: + field: sophos.utm.message + target_field: message + ignore_missing: true + tag: rename_message + + # Rename App ID field to match with the HTTP field + - rename: + field: sophos.utm.app + target_field: sophos.utm.app_id + ignore_missing: true + tag: rename_app_id + + # Convert severity + - set: + field: event.severity + value: 0 + if: ctx.sophos?.utm?.severity == 'emergency' + tag: set_severity_0 + - set: + field: event.severity + value: 1 + if: ctx.sophos?.utm?.severity == 'alert' + tag: set_severity_1 + - set: + field: event.severity + value: 2 + if: ctx.sophos?.utm?.severity == 'critical' + tag: set_severity_2 + - set: + field: event.severity + value: 3 + if: ctx.sophos?.utm?.severity == 'error' + tag: set_severity_3 + - set: + field: event.severity + value: 4 + if: ctx.sophos?.utm?.severity == 'warning' + tag: set_severity_4 + - set: + field: event.severity + value: 5 + if: ctx.sophos?.utm?.severity == 'notice' + tag: set_severity_5 + - set: + field: event.severity + value: 6 + if: ctx.sophos?.utm?.severity == 'info' + tag: set_severity_6 + - set: + field: event.severity + value: 7 + if: ctx.sophos?.utm?.severity == 'debug' + tag: set_severity_7 + + # Process TCP Flags + - split: + field: sophos.utm.tcpflags + separator: '\s+' + ignore_missing: true + tag: split_tcp_flags + - lowercase: + field: sophos.utm.tcpflags + ignore_missing: true + tag: lowercase_tcp_flags + + # Transform MAC address + - gsub: + field: source.mac + ignore_missing: true + pattern: '[:]' + replacement: '-' + tag: gsub_source_mac + - uppercase: + field: source.mac + ignore_missing: true + tag: uppercase_source_mac + - gsub: + field: destination.mac + ignore_missing: true + pattern: '[:]' + replacement: '-' + tag: gsub_destination_mac + - uppercase: + field: destination.mac + ignore_missing: true + tag: uppercase_destination_mac + + # IP Geolocation Lookup + - geoip: + field: source.ip + target_field: source.geo + ignore_missing: true + tag: geo_source_ip + - geoip: + field: destination.ip + target_field: destination.geo + ignore_missing: true + tag: geo_destination_ip + + # IP Autonomous System (AS) Lookup + - geoip: + database_file: GeoLite2-ASN.mmdb + field: source.ip + target_field: source.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_source_as + - geoip: + database_file: GeoLite2-ASN.mmdb + field: destination.ip + target_field: destination.as + properties: + - asn + - organization_name + ignore_missing: true + tag: geo_destination_as + - rename: + field: source.as.asn + target_field: source.as.number + ignore_missing: true + tag: rename_source_as_number + - rename: + field: source.as.organization_name + target_field: source.as.organization.name + ignore_missing: true + tag: rename_source_as_org + - rename: + field: destination.as.asn + target_field: destination.as.number + ignore_missing: true + tag: rename_destination_as_number + - rename: + field: destination.as.organization_name + target_field: destination.as.organization.name + ignore_missing: true + tag: rename_destination_as_org + + # Convert time fields to long type + - convert: + field: sophos.utm.length + type: long + ignore_missing: true + tag: convert_length_long + - convert: + field: sophos.utm.ttl + type: long + ignore_missing: true + tag: convert_ttl_long + + # Fill related fields + - append: + field: related.ip + value: '{{{source.ip}}}' + allow_duplicates: false + if: ctx.source?.ip != null && ctx.source.ip != '' + tag: append_related_source_ip + - append: + field: related.ip + value: '{{{destination.ip}}}' + allow_duplicates: false + if: ctx.destination?.ip != null && ctx.destination.ip != '' + tag: append_related_destination_ip +on_failure: + - append: + field: error.message + value: |- + Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/sophos/data_stream/utm/fields/agent.yml b/packages/sophos/data_stream/utm/fields/agent.yml new file mode 100644 index 00000000000..cabc6d0fc99 --- /dev/null +++ b/packages/sophos/data_stream/utm/fields/agent.yml @@ -0,0 +1,215 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + +- name: input.type + type: keyword + description: Input type. +- name: log.offset + type: long + description: Log offset +- name: log.file.path + description: Full path to the log file this event came from. + example: /var/log/fun-times.log + ignore_above: 1024 + type: keyword +- name: log.source.address + description: Source address from which the log event was read / sent from. + type: keyword +- name: log.flags + description: Flags for the log file. + type: keyword diff --git a/packages/sophos/data_stream/utm/fields/base-fields.yml b/packages/sophos/data_stream/utm/fields/base-fields.yml index 15da1486fe7..f7a2fc592bc 100644 --- a/packages/sophos/data_stream/utm/fields/base-fields.yml +++ b/packages/sophos/data_stream/utm/fields/base-fields.yml @@ -15,24 +15,3 @@ type: constant_keyword description: Event dataset value: sophos.utm -- name: container.id - description: Unique container id. - ignore_above: 1024 - type: keyword -- name: input.type - description: Type of Filebeat input. - type: keyword -- name: log.file.path - description: Full path to the log file this event came from. - example: /var/log/fun-times.log - ignore_above: 1024 - type: keyword -- name: log.source.address - description: Source address from which the log event was read / sent from. - type: keyword -- name: log.flags - description: Flags for the log file. - type: keyword -- name: log.offset - description: Offset of the entry in the log file. - type: long diff --git a/packages/sophos/data_stream/utm/fields/ecs.yml b/packages/sophos/data_stream/utm/fields/ecs.yml index fd1b4594e68..ac7ac0261c6 100644 --- a/packages/sophos/data_stream/utm/fields/ecs.yml +++ b/packages/sophos/data_stream/utm/fields/ecs.yml @@ -1,133 +1,115 @@ - external: ecs name: '@timestamp' - external: ecs - name: client.domain + name: client.as.number - external: ecs - name: client.registered_domain + name: client.as.organization.name - external: ecs - name: client.subdomain + name: client.geo.city_name - external: ecs - name: client.top_level_domain + name: client.geo.continent_name - external: ecs - name: destination.address + name: client.geo.country_iso_code - external: ecs - name: destination.as.number -- external: ecs - name: destination.as.organization.name + name: client.geo.country_name - external: ecs - name: destination.bytes + name: client.geo.location - external: ecs - name: destination.domain -- external: ecs - name: destination.geo.city_name + name: client.geo.name - external: ecs - name: destination.geo.country_name + name: client.geo.postal_code - external: ecs - name: destination.geo.location + name: client.geo.region_iso_code - external: ecs - name: destination.ip + name: client.geo.region_name - external: ecs - name: destination.mac + name: client.geo.timezone - external: ecs - name: destination.nat.ip + name: client.ip - external: ecs - name: destination.nat.port + name: client.mac - external: ecs - name: destination.port + name: client.port - external: ecs - name: destination.registered_domain -- external: ecs - name: destination.subdomain + name: destination.as.number - external: ecs - name: destination.top_level_domain + name: destination.as.organization.name - external: ecs - name: dns.answers.name + name: destination.geo.city_name - external: ecs - name: dns.answers.type + name: destination.geo.continent_name - external: ecs - name: dns.question.registered_domain + name: destination.geo.country_iso_code - external: ecs - name: dns.question.subdomain + name: destination.geo.country_name - external: ecs - name: dns.question.top_level_domain + name: destination.geo.location - external: ecs - name: dns.question.type + name: destination.geo.name - external: ecs - name: ecs.version + name: destination.geo.postal_code - external: ecs - name: error.message + name: destination.geo.region_iso_code - external: ecs - name: event.action + name: destination.geo.region_name - external: ecs - name: event.code + name: destination.geo.timezone - external: ecs - name: event.ingested + name: destination.ip - external: ecs - name: event.original + name: destination.mac - external: ecs - name: event.outcome + name: destination.port - external: ecs - name: event.timezone + name: device.id - external: ecs - name: file.attributes + name: error.message - external: ecs - name: file.directory + name: ecs.version - external: ecs - name: file.extension + name: event.action - external: ecs - name: file.name + name: event.category - external: ecs - name: file.path + name: event.id - external: ecs - name: file.size + name: event.kind - external: ecs - name: file.type + name: event.original - external: ecs - name: geo.city_name + name: event.provider - external: ecs - name: geo.country_name + name: event.severity - external: ecs - name: geo.name + name: event.timezone - external: ecs - name: geo.region_name + name: event.type - external: ecs - name: group.id + name: file.name - external: ecs name: group.name - external: ecs - name: host.hostname -- external: ecs - name: host.ip -- external: ecs - name: host.mac + name: http.request.bytes - external: ecs - name: host.name + name: http.request.id - external: ecs name: http.request.method - external: ecs name: http.request.referrer - external: ecs - name: log.level -- external: ecs - name: log.syslog.facility.code -- external: ecs - name: log.syslog.priority -- external: ecs - name: log.syslog.severity.code + name: http.response.status_code - external: ecs name: message - external: ecs name: network.application - external: ecs - name: network.bytes -- external: ecs - name: network.direction + name: network.iana_number - external: ecs - name: network.forwarded_ip + name: network.protocol - external: ecs - name: network.packets + name: network.transport - external: ecs - name: network.protocol + name: network.type - external: ecs name: observer.egress.interface.name - external: ecs @@ -138,20 +120,10 @@ name: observer.type - external: ecs name: observer.vendor -- external: ecs - name: observer.version - external: ecs name: process.name -- external: ecs - name: process.parent.name -- external: ecs - name: process.parent.title - external: ecs name: process.pid -- external: ecs - name: process.parent.pid -- external: ecs - name: process.title - external: ecs name: related.hosts - external: ecs @@ -159,70 +131,108 @@ - external: ecs name: related.user - external: ecs - name: rule.name + name: rule.id +- external: ecs + name: server.as.number +- external: ecs + name: server.as.organization.name - external: ecs - name: server.domain + name: server.geo.city_name - external: ecs - name: server.registered_domain + name: server.geo.continent_name - external: ecs - name: server.subdomain + name: server.geo.country_iso_code - external: ecs - name: server.top_level_domain + name: server.geo.country_name - external: ecs - name: service.name + name: server.geo.location - external: ecs - name: source.address + name: server.geo.name +- external: ecs + name: server.geo.postal_code +- external: ecs + name: server.geo.region_iso_code +- external: ecs + name: server.geo.region_name +- external: ecs + name: server.geo.timezone +- external: ecs + name: server.ip +- external: ecs + name: server.port - external: ecs name: source.as.number - external: ecs name: source.as.organization.name - external: ecs - name: source.bytes + name: source.geo.city_name - external: ecs - name: source.domain + name: source.geo.continent_name - external: ecs - name: source.geo.city_name + name: source.geo.country_iso_code - external: ecs name: source.geo.country_name - external: ecs name: source.geo.location - external: ecs - name: source.ip + name: source.geo.name - external: ecs - name: source.mac + name: source.geo.postal_code - external: ecs - name: source.nat.ip + name: source.geo.region_iso_code - external: ecs - name: source.nat.port + name: source.geo.region_name - external: ecs - name: source.port + name: source.geo.timezone - external: ecs - name: source.registered_domain + name: source.ip - external: ecs - name: source.subdomain + name: source.mac - external: ecs - name: source.top_level_domain + name: source.port - external: ecs name: tags - external: ecs name: url.domain +- external: ecs + name: url.extension +- external: ecs + name: url.fragment +- external: ecs + name: url.full - external: ecs name: url.original +- external: ecs + name: url.password - external: ecs name: url.path +- external: ecs + name: url.port - external: ecs name: url.query - external: ecs name: url.registered_domain - external: ecs - name: url.top_level_domain + name: url.scheme - external: ecs - name: user.domain + name: url.subdomain - external: ecs - name: user.full_name + name: url.top_level_domain - external: ecs - name: user.id + name: url.username - external: ecs name: user.name +- external: ecs + name: user_agent.device.name +- external: ecs + name: user_agent.name - external: ecs name: user_agent.original +- external: ecs + name: user_agent.os.full +- external: ecs + name: user_agent.os.name +- external: ecs + name: user_agent.os.version +- external: ecs + name: user_agent.version diff --git a/packages/sophos/data_stream/utm/fields/fields.yml b/packages/sophos/data_stream/utm/fields/fields.yml index ea69cd79e3c..6f967f9bcbc 100644 --- a/packages/sophos/data_stream/utm/fields/fields.yml +++ b/packages/sophos/data_stream/utm/fields/fields.yml @@ -1,1754 +1,131 @@ -- name: rsa +- name: sophos.utm type: group + description: Integration for parsing Sophos UTM logs. fields: - - name: internal - type: group - fields: - - name: msg - type: keyword - description: This key is used to capture the raw message that comes into the Log Decoder - - name: messageid - type: keyword - - name: event_desc - type: keyword - - name: message - type: keyword - description: This key captures the contents of instant messages - - name: time - type: date - description: This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. - - name: level - type: long - description: Deprecated key defined only in table map. - - name: msg_id - type: keyword - description: This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: msg_vid - type: keyword - description: This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: data - type: keyword - description: Deprecated key defined only in table map. - - name: obj_server - type: keyword - description: Deprecated key defined only in table map. - - name: obj_val - type: keyword - description: Deprecated key defined only in table map. - - name: resource - type: keyword - description: Deprecated key defined only in table map. - - name: obj_id - type: keyword - description: Deprecated key defined only in table map. - - name: statement - type: keyword - description: Deprecated key defined only in table map. - - name: audit_class - type: keyword - description: Deprecated key defined only in table map. - - name: entry - type: keyword - description: Deprecated key defined only in table map. - - name: hcode - type: keyword - description: Deprecated key defined only in table map. - - name: inode - type: long - description: Deprecated key defined only in table map. - - name: resource_class - type: keyword - description: Deprecated key defined only in table map. - - name: dead - type: long - description: Deprecated key defined only in table map. - - name: feed_desc - type: keyword - description: This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: feed_name - type: keyword - description: This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: cid - type: keyword - description: This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_class - type: keyword - description: This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_group - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_host - type: keyword - description: This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ip - type: ip - description: This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_ipv6 - type: ip - description: This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type - type: keyword - description: This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: device_type_id - type: long - description: Deprecated key defined only in table map. - - name: did - type: keyword - description: This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: entropy_req - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: entropy_res - type: long - description: This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration - - name: event_name - type: keyword - description: Deprecated key defined only in table map. - - name: feed_category - type: keyword - description: This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: forward_ip - type: ip - description: This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. - - name: forward_ipv6 - type: ip - description: This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: header_id - type: keyword - description: This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_cid - type: keyword - description: This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: lc_ctime - type: date - description: This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: mcb_req - type: long - description: This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most - - name: mcb_res - type: long - description: This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most - - name: mcbc_req - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: mcbc_res - type: long - description: This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams - - name: medium - type: long - description: "This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session" - - name: node_name - type: keyword - description: Deprecated key defined only in table map. - - name: nwe_callback_id - type: keyword - description: This key denotes that event is endpoint related - - name: parse_error - type: keyword - description: This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: payload_req - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: payload_res - type: long - description: This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep - - name: process_vid_dst - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. - - name: process_vid_src - type: keyword - description: Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. - - name: rid - type: long - description: This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: session_split - type: keyword - description: This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: site - type: keyword - description: Deprecated key defined only in table map. - - name: size - type: long - description: This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: sourcefile - type: keyword - description: This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: ubc_req - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: ubc_res - type: long - description: This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once - - name: word - type: keyword - description: This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log - - name: time - type: group - fields: - - name: event_time - type: date - description: This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form - - name: duration_time - type: double - description: This key is used to capture the normalized duration/lifetime in seconds. - - name: event_time_str - type: keyword - description: This key is used to capture the incomplete time mentioned in a session as a string - - name: starttime - type: date - description: This key is used to capture the Start time mentioned in a session in a standard form - - name: month - type: keyword - - name: day - type: keyword - - name: endtime - type: date - description: This key is used to capture the End time mentioned in a session in a standard form - - name: timezone - type: keyword - description: This key is used to capture the timezone of the Event Time - - name: duration_str - type: keyword - description: A text string version of the duration - - name: date - type: keyword - - name: year - type: keyword - - name: recorded_time - type: date - description: The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. - - name: datetime - type: keyword - - name: effective_time - type: date - description: This key is the effective time referenced by an individual event in a Standard Timestamp format - - name: expire_time - type: date - description: This key is the timestamp that explicitly refers to an expiration. - - name: process_time - type: keyword - description: Deprecated, use duration.time - - name: hour - type: keyword - - name: min - type: keyword - - name: timestamp - type: keyword - - name: event_queue_time - type: date - description: This key is the Time that the event was queued. - - name: p_time1 - type: keyword - - name: tzone - type: keyword - - name: eventtime - type: keyword - - name: gmtdate - type: keyword - - name: gmttime - type: keyword - - name: p_date - type: keyword - - name: p_month - type: keyword - - name: p_time - type: keyword - - name: p_time2 - type: keyword - - name: p_year - type: keyword - - name: expire_time_str - type: keyword - description: This key is used to capture incomplete timestamp that explicitly refers to an expiration. - - name: stamp - type: date - description: Deprecated key defined only in table map. - - name: misc - type: group - fields: - - name: action - type: keyword - - name: result - type: keyword - description: This key is used to capture the outcome/result string value of an action in a session. - - name: severity - type: keyword - description: This key is used to capture the severity given the session - - name: event_type - type: keyword - description: This key captures the event category type as specified by the event source. - - name: reference_id - type: keyword - description: This key is used to capture an event id from the session directly - - name: version - type: keyword - description: This key captures Version of the application or OS which is generating the event. - - name: disposition - type: keyword - description: This key captures the The end state of an action. - - name: result_code - type: keyword - description: This key is used to capture the outcome/result numeric value of an action in a session - - name: category - type: keyword - description: This key is used to capture the category of an event given by the vendor in the session - - name: obj_name - type: keyword - description: This is used to capture name of object - - name: obj_type - type: keyword - description: This is used to capture type of object - - name: event_source - type: keyword - description: "This key captures Source of the event that’s not a hostname" - - name: log_session_id - type: keyword - description: This key is used to capture a sessionid from the session directly - - name: group - type: keyword - description: This key captures the Group Name value - - name: policy_name - type: keyword - description: This key is used to capture the Policy Name only. - - name: rule_name - type: keyword - description: This key captures the Rule Name - - name: context - type: keyword - description: This key captures Information which adds additional context to the event. - - name: change_new - type: keyword - description: "This key is used to capture the new values of the attribute that’s changing in a session" - - name: space - type: keyword - - name: client - type: keyword - description: This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. - - name: msgIdPart1 - type: keyword - - name: msgIdPart2 - type: keyword - - name: change_old - type: keyword - description: "This key is used to capture the old value of the attribute that’s changing in a session" - - name: operation_id - type: keyword - description: An alert number or operation number. The values should be unique and non-repeating. - - name: event_state - type: keyword - description: This key captures the current state of the object/item referenced within the event. Describing an on-going event. - - name: group_object - type: keyword - description: This key captures a collection/grouping of entities. Specific usage - - name: node - type: keyword - description: Common use case is the node name within a cluster. The cluster name is reflected by the host name. - - name: rule - type: keyword - description: This key captures the Rule number - - name: device_name - type: keyword - description: 'This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc' - - name: param - type: keyword - description: This key is the parameters passed as part of a command or application, etc. - - name: change_attrib - type: keyword - description: "This key is used to capture the name of the attribute that’s changing in a session" - - name: event_computer - type: keyword - description: This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. - - name: reference_id1 - type: keyword - description: This key is for Linked ID to be used as an addition to "reference.id" - - name: event_log - type: keyword - description: This key captures the Name of the event log - - name: OS - type: keyword - description: This key captures the Name of the Operating System - - name: terminal - type: keyword - description: This key captures the Terminal Names only - - name: msgIdPart3 - type: keyword - - name: filter - type: keyword - description: This key captures Filter used to reduce result set - - name: serial_number - type: keyword - description: This key is the Serial number associated with a physical asset. - - name: checksum - type: keyword - description: This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. - - name: event_user - type: keyword - description: This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. - - name: virusname - type: keyword - description: This key captures the name of the virus - - name: content_type - type: keyword - description: This key is used to capture Content Type only. - - name: group_id - type: keyword - description: This key captures Group ID Number (related to the group name) - - name: policy_id - type: keyword - description: This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise - - name: vsys - type: keyword - description: This key captures Virtual System Name - - name: connection_id - type: keyword - description: This key captures the Connection ID - - name: reference_id2 - type: keyword - description: This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. - - name: sensor - type: keyword - description: This key captures Name of the sensor. Typically used in IDS/IPS based devices - - name: sig_id - type: long - description: This key captures IDS/IPS Int Signature ID - - name: port_name - type: keyword - description: 'This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name).' - - name: rule_group - type: keyword - description: This key captures the Rule group name - - name: risk_num - type: double - description: This key captures a Numeric Risk value - - name: trigger_val - type: keyword - description: This key captures the Value of the trigger or threshold condition. - - name: log_session_id1 - type: keyword - description: This key is used to capture a Linked (Related) Session ID from the session directly - - name: comp_version - type: keyword - description: This key captures the Version level of a sub-component of a product. - - name: content_version - type: keyword - description: This key captures Version level of a signature or database content. - - name: hardware_id - type: keyword - description: This key is used to capture unique identifier for a device or system (NOT a Mac address) - - name: risk - type: keyword - description: This key captures the non-numeric risk value - - name: event_id - type: keyword - - name: reason - type: keyword - - name: status - type: keyword - - name: mail_id - type: keyword - description: This key is used to capture the mailbox id/name - - name: rule_uid - type: keyword - description: This key is the Unique Identifier for a rule. - - name: trigger_desc - type: keyword - description: This key captures the Description of the trigger or threshold condition. - - name: inout - type: keyword - - name: p_msgid - type: keyword - - name: data_type - type: keyword - - name: msgIdPart4 - type: keyword - - name: error - type: keyword - description: This key captures All non successful Error codes or responses - - name: index - type: keyword - - name: listnum - type: keyword - description: This key is used to capture listname or listnumber, primarily for collecting access-list - - name: ntype - type: keyword - - name: observed_val - type: keyword - description: This key captures the Value observed (from the perspective of the device generating the log). - - name: policy_value - type: keyword - description: This key captures the contents of the policy. This contains details about the policy - - name: pool_name - type: keyword - description: This key captures the name of a resource pool - - name: rule_template - type: keyword - description: A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template - - name: count - type: keyword - - name: number - type: keyword - - name: sigcat - type: keyword - - name: type - type: keyword - - name: comments - type: keyword - description: Comment information provided in the log message - - name: doc_number - type: long - description: This key captures File Identification number - - name: expected_val - type: keyword - description: This key captures the Value expected (from the perspective of the device generating the log). - - name: job_num - type: keyword - description: This key captures the Job Number - - name: spi_dst - type: keyword - description: Destination SPI Index - - name: spi_src - type: keyword - description: Source SPI Index - - name: code - type: keyword - - name: agent_id - type: keyword - description: This key is used to capture agent id - - name: message_body - type: keyword - description: This key captures the The contents of the message body. - - name: phone - type: keyword - - name: sig_id_str - type: keyword - description: This key captures a string object of the sigid variable. - - name: cmd - type: keyword - - name: misc - type: keyword - - name: name - type: keyword - - name: cpu - type: long - description: This key is the CPU time used in the execution of the event being recorded. - - name: event_desc - type: keyword - description: This key is used to capture a description of an event available directly or inferred - - name: sig_id1 - type: long - description: This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id - - name: im_buddyid - type: keyword - - name: im_client - type: keyword - - name: im_userid - type: keyword - - name: pid - type: keyword - - name: priority - type: keyword - - name: context_subject - type: keyword - description: This key is to be used in an audit context where the subject is the object being identified - - name: context_target - type: keyword - - name: cve - type: keyword - description: This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. - - name: fcatnum - type: keyword - description: This key captures Filter Category Number. Legacy Usage - - name: library - type: keyword - description: This key is used to capture library information in mainframe devices - - name: parent_node - type: keyword - description: This key captures the Parent Node Name. Must be related to node variable. - - name: risk_info - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: tcp_flags - type: long - description: This key is captures the TCP flags set in any packet of session - - name: tos - type: long - description: This key describes the type of service - - name: vm_target - type: keyword - description: VMWare Target **VMWARE** only varaible. - - name: workspace - type: keyword - description: This key captures Workspace Description - - name: command - type: keyword - - name: event_category - type: keyword - - name: facilityname - type: keyword - - name: forensic_info - type: keyword - - name: jobname - type: keyword - - name: mode - type: keyword - - name: policy - type: keyword - - name: policy_waiver - type: keyword - - name: second - type: keyword - - name: space1 - type: keyword - - name: subcategory - type: keyword - - name: tbdstr2 - type: keyword - - name: alert_id - type: keyword - description: Deprecated, New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: checksum_dst - type: keyword - description: This key is used to capture the checksum or hash of the the target entity such as a process or file. - - name: checksum_src - type: keyword - description: This key is used to capture the checksum or hash of the source entity such as a file or process. - - name: fresult - type: long - description: This key captures the Filter Result - - name: payload_dst - type: keyword - description: This key is used to capture destination payload - - name: payload_src - type: keyword - description: This key is used to capture source payload - - name: pool_id - type: keyword - description: This key captures the identifier (typically numeric field) of a resource pool - - name: process_id_val - type: keyword - description: This key is a failure key for Process ID when it is not an integer value - - name: risk_num_comm - type: double - description: This key captures Risk Number Community - - name: risk_num_next - type: double - description: This key captures Risk Number NextGen - - name: risk_num_sand - type: double - description: This key captures Risk Number SandBox - - name: risk_num_static - type: double - description: This key captures Risk Number Static - - name: risk_suspicious - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: risk_warning - type: keyword - description: Deprecated, use New Hunting Model (inv.*, ioc, boc, eoc, analysis.*) - - name: snmp_oid - type: keyword - description: SNMP Object Identifier - - name: sql - type: keyword - description: This key captures the SQL query - - name: vuln_ref - type: keyword - description: This key captures the Vulnerability Reference details - - name: acl_id - type: keyword - - name: acl_op - type: keyword - - name: acl_pos - type: keyword - - name: acl_table - type: keyword - - name: admin - type: keyword - - name: alarm_id - type: keyword - - name: alarmname - type: keyword - - name: app_id - type: keyword - - name: audit - type: keyword - - name: audit_object - type: keyword - - name: auditdata - type: keyword - - name: benchmark - type: keyword - - name: bypass - type: keyword - - name: cache - type: keyword - - name: cache_hit - type: keyword - - name: cefversion - type: keyword - - name: cfg_attr - type: keyword - - name: cfg_obj - type: keyword - - name: cfg_path - type: keyword - - name: changes - type: keyword - - name: client_ip - type: keyword - - name: clustermembers - type: keyword - - name: cn_acttimeout - type: keyword - - name: cn_asn_src - type: keyword - - name: cn_bgpv4nxthop - type: keyword - - name: cn_ctr_dst_code - type: keyword - - name: cn_dst_tos - type: keyword - - name: cn_dst_vlan - type: keyword - - name: cn_engine_id - type: keyword - - name: cn_engine_type - type: keyword - - name: cn_f_switch - type: keyword - - name: cn_flowsampid - type: keyword - - name: cn_flowsampintv - type: keyword - - name: cn_flowsampmode - type: keyword - - name: cn_inacttimeout - type: keyword - - name: cn_inpermbyts - type: keyword - - name: cn_inpermpckts - type: keyword - - name: cn_invalid - type: keyword - - name: cn_ip_proto_ver - type: keyword - - name: cn_ipv4_ident - type: keyword - - name: cn_l_switch - type: keyword - - name: cn_log_did - type: keyword - - name: cn_log_rid - type: keyword - - name: cn_max_ttl - type: keyword - - name: cn_maxpcktlen - type: keyword - - name: cn_min_ttl - type: keyword - - name: cn_minpcktlen - type: keyword - - name: cn_mpls_lbl_1 - type: keyword - - name: cn_mpls_lbl_10 - type: keyword - - name: cn_mpls_lbl_2 - type: keyword - - name: cn_mpls_lbl_3 - type: keyword - - name: cn_mpls_lbl_4 - type: keyword - - name: cn_mpls_lbl_5 - type: keyword - - name: cn_mpls_lbl_6 - type: keyword - - name: cn_mpls_lbl_7 - type: keyword - - name: cn_mpls_lbl_8 - type: keyword - - name: cn_mpls_lbl_9 - type: keyword - - name: cn_mplstoplabel - type: keyword - - name: cn_mplstoplabip - type: keyword - - name: cn_mul_dst_byt - type: keyword - - name: cn_mul_dst_pks - type: keyword - - name: cn_muligmptype - type: keyword - - name: cn_sampalgo - type: keyword - - name: cn_sampint - type: keyword - - name: cn_seqctr - type: keyword - - name: cn_spackets - type: keyword - - name: cn_src_tos - type: keyword - - name: cn_src_vlan - type: keyword - - name: cn_sysuptime - type: keyword - - name: cn_template_id - type: keyword - - name: cn_totbytsexp - type: keyword - - name: cn_totflowexp - type: keyword - - name: cn_totpcktsexp - type: keyword - - name: cn_unixnanosecs - type: keyword - - name: cn_v6flowlabel - type: keyword - - name: cn_v6optheaders - type: keyword - - name: comp_class - type: keyword - - name: comp_name - type: keyword - - name: comp_rbytes - type: keyword - - name: comp_sbytes - type: keyword - - name: cpu_data - type: keyword - - name: criticality - type: keyword - - name: cs_agency_dst - type: keyword - - name: cs_analyzedby - type: keyword - - name: cs_av_other - type: keyword - - name: cs_av_primary - type: keyword - - name: cs_av_secondary - type: keyword - - name: cs_bgpv6nxthop - type: keyword - - name: cs_bit9status - type: keyword - - name: cs_context - type: keyword - - name: cs_control - type: keyword - - name: cs_data - type: keyword - - name: cs_datecret - type: keyword - - name: cs_dst_tld - type: keyword - - name: cs_eth_dst_ven - type: keyword - - name: cs_eth_src_ven - type: keyword - - name: cs_event_uuid - type: keyword - - name: cs_filetype - type: keyword - - name: cs_fld - type: keyword - - name: cs_if_desc - type: keyword - - name: cs_if_name - type: keyword - - name: cs_ip_next_hop - type: keyword - - name: cs_ipv4dstpre - type: keyword - - name: cs_ipv4srcpre - type: keyword - - name: cs_lifetime - type: keyword - - name: cs_log_medium - type: keyword - - name: cs_loginname - type: keyword - - name: cs_modulescore - type: keyword - - name: cs_modulesign - type: keyword - - name: cs_opswatresult - type: keyword - - name: cs_payload - type: keyword - - name: cs_registrant - type: keyword - - name: cs_registrar - type: keyword - - name: cs_represult - type: keyword - - name: cs_rpayload - type: keyword - - name: cs_sampler_name - type: keyword - - name: cs_sourcemodule - type: keyword - - name: cs_streams - type: keyword - - name: cs_targetmodule - type: keyword - - name: cs_v6nxthop - type: keyword - - name: cs_whois_server - type: keyword - - name: cs_yararesult - type: keyword - - name: description - type: keyword - - name: devvendor - type: keyword - - name: distance - type: keyword - - name: dstburb - type: keyword - - name: edomain - type: keyword - - name: edomaub - type: keyword - - name: euid - type: keyword - - name: facility - type: keyword - - name: finterface - type: keyword - - name: flags - type: keyword - - name: gaddr - type: keyword - - name: id3 - type: keyword - - name: im_buddyname - type: keyword - - name: im_croomid - type: keyword - - name: im_croomtype - type: keyword - - name: im_members - type: keyword - - name: im_username - type: keyword - - name: ipkt - type: keyword - - name: ipscat - type: keyword - - name: ipspri - type: keyword - - name: latitude - type: keyword - - name: linenum - type: keyword - - name: list_name - type: keyword - - name: load_data - type: keyword - - name: location_floor - type: keyword - - name: location_mark - type: keyword - - name: log_id - type: keyword - - name: log_type - type: keyword - - name: logid - type: keyword - - name: logip - type: keyword - - name: logname - type: keyword - - name: longitude - type: keyword - - name: lport - type: keyword - - name: mbug_data - type: keyword - - name: misc_name - type: keyword - - name: msg_type - type: keyword - - name: msgid - type: keyword - - name: netsessid - type: keyword - - name: num - type: keyword - - name: number1 - type: keyword - - name: number2 - type: keyword - - name: nwwn - type: keyword - - name: object - type: keyword - - name: operation - type: keyword - - name: opkt - type: keyword - - name: orig_from - type: keyword - - name: owner_id - type: keyword - - name: p_action - type: keyword - - name: p_filter - type: keyword - - name: p_group_object - type: keyword - - name: p_id - type: keyword - - name: p_msgid1 - type: keyword - - name: p_msgid2 - type: keyword - - name: p_result1 - type: keyword - - name: password_chg - type: keyword - - name: password_expire - type: keyword - - name: permgranted - type: keyword - - name: permwanted - type: keyword - - name: pgid - type: keyword - - name: policyUUID - type: keyword - - name: prog_asp_num - type: keyword - - name: program - type: keyword - - name: real_data - type: keyword - - name: rec_asp_device - type: keyword - - name: rec_asp_num - type: keyword - - name: rec_library - type: keyword - - name: recordnum - type: keyword - - name: ruid - type: keyword - - name: sburb - type: keyword - - name: sdomain_fld - type: keyword - - name: sec - type: keyword - - name: sensorname - type: keyword - - name: seqnum - type: keyword - - name: session - type: keyword - - name: sessiontype - type: keyword - - name: sigUUID - type: keyword - - name: spi - type: keyword - - name: srcburb - type: keyword - - name: srcdom - type: keyword - - name: srcservice - type: keyword - - name: state - type: keyword - - name: status1 - type: keyword - - name: svcno - type: keyword - - name: system - type: keyword - - name: tbdstr1 - type: keyword - - name: tgtdom - type: keyword - - name: tgtdomain - type: keyword - - name: threshold - type: keyword - - name: type1 - type: keyword - - name: udb_class - type: keyword - - name: url_fld - type: keyword - - name: user_div - type: keyword - - name: userid - type: keyword - - name: username_fld - type: keyword - - name: utcstamp - type: keyword - - name: v_instafname - type: keyword - - name: virt_data - type: keyword - - name: vpnid - type: keyword - - name: autorun_type - type: keyword - description: This is used to capture Auto Run type - - name: cc_number - type: long - description: Valid Credit Card Numbers only - - name: content - type: keyword - description: This key captures the content type from protocol headers - - name: ein_number - type: long - description: Employee Identification Numbers only - - name: found - type: keyword - description: This is used to capture the results of regex match - - name: language - type: keyword - description: This is used to capture list of languages the client support and what it prefers - - name: lifetime - type: long - description: This key is used to capture the session lifetime in seconds. - - name: link - type: keyword - description: This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness - - name: match - type: keyword - description: This key is for regex match name from search.ini - - name: param_dst - type: keyword - description: This key captures the command line/launch argument of the target process or file - - name: param_src - type: keyword - description: This key captures source parameter - - name: search_text - type: keyword - description: This key captures the Search Text used - - name: sig_name - type: keyword - description: This key is used to capture the Signature Name only. - - name: snmp_value - type: keyword - description: SNMP set request value - - name: streams - type: long - description: This key captures number of streams in session - - name: db - type: group - fields: - - name: index - type: keyword - description: This key captures IndexID of the index. - - name: instance - type: keyword - description: This key is used to capture the database server instance name - - name: database - type: keyword - description: This key is used to capture the name of a database or an instance as seen in a session - - name: transact_id - type: keyword - description: This key captures the SQL transantion ID of the current session - - name: permissions - type: keyword - description: This key captures permission or privilege level assigned to a resource. - - name: table_name - type: keyword - description: This key is used to capture the table name - - name: db_id - type: keyword - description: This key is used to capture the unique identifier for a database - - name: db_pid - type: long - description: This key captures the process id of a connection with database server - - name: lread - type: long - description: This key is used for the number of logical reads - - name: lwrite - type: long - description: This key is used for the number of logical writes - - name: pread - type: long - description: This key is used for the number of physical writes - - name: network - type: group - fields: - - name: alias_host - type: keyword - description: This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. - - name: domain - type: keyword - - name: host_dst - type: keyword - description: "This key should only be used when it’s a Destination Hostname" - - name: network_service - type: keyword - description: This is used to capture layer 7 protocols/service names - - name: interface - type: keyword - description: This key should be used when the source or destination context of an interface is not clear - - name: network_port - type: long - description: 'Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!)' - - name: eth_host - type: keyword - description: Deprecated, use alias.mac - - name: sinterface - type: keyword - description: "This key should only be used when it’s a Source Interface" - - name: dinterface - type: keyword - description: "This key should only be used when it’s a Destination Interface" - - name: vlan - type: long - description: This key should only be used to capture the ID of the Virtual LAN - - name: zone_src - type: keyword - description: "This key should only be used when it’s a Source Zone." - - name: zone - type: keyword - description: This key should be used when the source or destination context of a Zone is not clear - - name: zone_dst - type: keyword - description: "This key should only be used when it’s a Destination Zone." - - name: gateway - type: keyword - description: This key is used to capture the IP Address of the gateway - - name: icmp_type - type: long - description: This key is used to capture the ICMP type only - - name: mask - type: keyword - description: This key is used to capture the device network IPmask. - - name: icmp_code - type: long - description: This key is used to capture the ICMP code only - - name: protocol_detail - type: keyword - description: This key should be used to capture additional protocol information - - name: dmask - type: keyword - description: This key is used for Destionation Device network mask - - name: port - type: long - description: This key should only be used to capture a Network Port when the directionality is not clear - - name: smask - type: keyword - description: This key is used for capturing source Network Mask - - name: netname - type: keyword - description: This key is used to capture the network name associated with an IP range. This is configured by the end user. - - name: paddr + - name: action + type: keyword + description: Event action. + - name: ad_domain + type: keyword + - name: app_id + type: keyword + description: Application ID. + - name: aptptime + type: long + - name: auth + type: keyword + description: Auth ID. + - name: authtime + type: long + description: Authorization time. + - name: avscantime + type: long + description: AntiVirus scan time. + - name: cached + type: keyword + description: Cached bytes. + - name: category + type: keyword + description: Array of category IDs. + - name: categoryname + type: keyword + description: Array of category names. + - name: cattime + type: long + - name: client + type: group + fields: + - name: hostname + type: keyword + description: Client hostname in DHCP events. + - name: code + type: keyword + description: Code ID. + - name: content_type + type: keyword + description: HTTP header content-type. + - name: country + type: keyword + description: HTTP request country source. + - name: dnstime + type: long + description: DNS time. + - name: exceptions + type: keyword + - name: extension + type: keyword + description: URL extension. + - name: filteraction + type: keyword + description: Filter action. + - name: fullreqtime + type: long + description: Full HTTP request time. + - name: function + type: keyword + description: The failed function in case of error. + - name: id + type: keyword + description: Packet Filter rule ID. + - name: length + type: long + description: Packet length in bytes. + - name: line + type: keyword + description: The failed line in case of error. + - name: mark + type: keyword + description: The Netfilter conntrack mark. + - name: name + type: keyword + description: Event description. + - name: overridecategory + type: keyword + - name: overridereputation + type: keyword + - name: prec + type: keyword + - name: profile + type: keyword + description: HTTP profile. + - name: reason + type: keyword + - name: reputation + type: keyword + - name: router + type: group + fields: + - name: ip type: ip - description: Deprecated - - name: faddr - type: keyword - - name: lhost - type: keyword - - name: origin - type: keyword - - name: remote_domain_id - type: keyword - - name: addr - type: keyword - - name: dns_a_record - type: keyword - - name: dns_ptr_record - type: keyword - - name: fhost - type: keyword - - name: fport - type: keyword - - name: laddr - type: keyword - - name: linterface - type: keyword - - name: phost - type: keyword - - name: ad_computer_dst - type: keyword - description: Deprecated, use host.dst - - name: eth_type - type: long - description: This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only - - name: ip_proto - type: long - description: This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI - - name: dns_cname_record - type: keyword - - name: dns_id - type: keyword - - name: dns_opcode - type: keyword - - name: dns_resp - type: keyword - - name: dns_type - type: keyword - - name: domain1 - type: keyword - - name: host_type - type: keyword - - name: packet_length - type: keyword - - name: host_orig - type: keyword - description: This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. - - name: rpayload - type: keyword - description: This key is used to capture the total number of payload bytes seen in the retransmitted packets. - - name: vlan_name - type: keyword - description: This key should only be used to capture the name of the Virtual LAN - - name: investigations - type: group - fields: - - name: ec_activity - type: keyword - description: This key captures the particular event activity(Ex:Logoff) - - name: ec_theme - type: keyword - description: This key captures the Theme of a particular Event(Ex:Authentication) - - name: ec_subject - type: keyword - description: This key captures the Subject of a particular Event(Ex:User) - - name: ec_outcome - type: keyword - description: This key captures the outcome of a particular Event(Ex:Success) - - name: event_cat - type: long - description: This key captures the Event category number - - name: event_cat_name - type: keyword - description: This key captures the event category name corresponding to the event cat code - - name: event_vcat - type: keyword - description: This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. - - name: analysis_file - type: keyword - description: This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file - - name: analysis_service - type: keyword - description: This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service - - name: analysis_session - type: keyword - description: This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session - - name: boc - type: keyword - description: This is used to capture behaviour of compromise - - name: eoc - type: keyword - description: This is used to capture Enablers of Compromise - - name: inv_category - type: keyword - description: This used to capture investigation category - - name: inv_context - type: keyword - description: This used to capture investigation context - - name: ioc - type: keyword - description: This is key capture indicator of compromise - - name: counters - type: group - fields: - - name: dclass_c1 - type: long - description: This is a generic counter key that should be used with the label dclass.c1.str only - - name: dclass_c2 - type: long - description: This is a generic counter key that should be used with the label dclass.c2.str only - - name: event_counter - type: long - description: This is used to capture the number of times an event repeated - - name: dclass_r1 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r1.str only - - name: dclass_c3 - type: long - description: This is a generic counter key that should be used with the label dclass.c3.str only - - name: dclass_c1_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c1 only - - name: dclass_c2_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c2 only - - name: dclass_r1_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r1 only - - name: dclass_r2 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r2.str only - - name: dclass_c3_str - type: keyword - description: This is a generic counter string key that should be used with the label dclass.c3 only - - name: dclass_r3 - type: keyword - description: This is a generic ratio key that should be used with the label dclass.r3.str only - - name: dclass_r2_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r2 only - - name: dclass_r3_str - type: keyword - description: This is a generic ratio string key that should be used with the label dclass.r3 only - - name: identity - type: group - fields: - - name: auth_method - type: keyword - description: This key is used to capture authentication methods used only - - name: user_role - type: keyword - description: This key is used to capture the Role of a user only - - name: dn - type: keyword - description: X.500 (LDAP) Distinguished Name - - name: logon_type - type: keyword - description: This key is used to capture the type of logon method used. - - name: profile - type: keyword - description: This key is used to capture the user profile - - name: accesses - type: keyword - description: This key is used to capture actual privileges used in accessing an object - - name: realm - type: keyword - description: Radius realm or similar grouping of accounts - - name: user_sid_dst - type: keyword - description: This key captures Destination User Session ID - - name: dn_src - type: keyword - description: An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn - - name: org - type: keyword - description: This key captures the User organization - - name: dn_dst - type: keyword - description: An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn - - name: firstname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: lastname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: user_dept - type: keyword - description: User's Department Names only - - name: user_sid_src - type: keyword - description: This key captures Source User Session ID - - name: federated_sp - type: keyword - description: This key is the Federated Service Provider. This is the application requesting authentication. - - name: federated_idp - type: keyword - description: This key is the federated Identity Provider. This is the server providing the authentication. - - name: logon_type_desc - type: keyword - description: This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. - - name: middlename - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: password - type: keyword - description: This key is for Passwords seen in any session, plain text or encrypted - - name: host_role - type: keyword - description: This key should only be used to capture the role of a Host Machine - - name: ldap - type: keyword - description: "This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context" - - name: ldap_query - type: keyword - description: This key is the Search criteria from an LDAP search - - name: ldap_response - type: keyword - description: This key is to capture Results from an LDAP search - - name: owner - type: keyword - description: This is used to capture username the process or service is running as, the author of the task - - name: service_account - type: keyword - description: This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage - - name: email - type: group - fields: - - name: email_dst - type: keyword - description: This key is used to capture the Destination email address only, when the destination context is not clear use email - - name: email_src - type: keyword - description: This key is used to capture the source email address only, when the source context is not clear use email - - name: subject - type: keyword - description: This key is used to capture the subject string from an Email only. - - name: email - type: keyword - description: This key is used to capture a generic email address where the source or destination context is not clear - - name: trans_from - type: keyword - description: Deprecated key defined only in table map. - - name: trans_to - type: keyword - description: Deprecated key defined only in table map. - - name: file - type: group - fields: - - name: privilege - type: keyword - description: Deprecated, use permissions - - name: attachment - type: keyword - description: This key captures the attachment file name - - name: filesystem - type: keyword - - name: binary - type: keyword - description: Deprecated key defined only in table map. - - name: filename_dst - type: keyword - description: This is used to capture name of the file targeted by the action - - name: filename_src - type: keyword - description: This is used to capture name of the parent filename, the file which performed the action - - name: filename_tmp - type: keyword - - name: directory_dst - type: keyword - description: This key is used to capture the directory of the target process or file - - name: directory_src - type: keyword - description: This key is used to capture the directory of the source process or file - - name: file_entropy - type: double - description: This is used to capture entropy vale of a file - - name: file_vendor - type: keyword - description: This is used to capture Company name of file located in version_info - - name: task_name - type: keyword - description: This is used to capture name of the task - - name: web - type: group - fields: - - name: fqdn - type: keyword - description: Fully Qualified Domain Names - - name: web_cookie - type: keyword - description: This key is used to capture the Web cookies specifically. - - name: alias_host - type: keyword - - name: reputation_num - type: double - description: Reputation Number of an entity. Typically used for Web Domains - - name: web_ref_domain - type: keyword - description: Web referer's domain - - name: web_ref_query - type: keyword - description: This key captures Web referer's query portion of the URL - - name: remote_domain - type: keyword - - name: web_ref_page - type: keyword - description: This key captures Web referer's page information - - name: web_ref_root - type: keyword - description: Web referer's root URL path - - name: cn_asn_dst - type: keyword - - name: cn_rpackets - type: keyword - - name: urlpage - type: keyword - - name: urlroot - type: keyword - - name: p_url - type: keyword - - name: p_user_agent - type: keyword - - name: p_web_cookie - type: keyword - - name: p_web_method - type: keyword - - name: p_web_referer - type: keyword - - name: web_extension_tmp - type: keyword - - name: web_page - type: keyword - - name: threat - type: group - fields: - - name: threat_category - type: keyword - description: This key captures Threat Name/Threat Category/Categorization of alert - - name: threat_desc - type: keyword - description: This key is used to capture the threat description from the session directly or inferred - - name: alert - type: keyword - description: This key is used to capture name of the alert - - name: threat_source - type: keyword - description: This key is used to capture source of the threat - - name: crypto - type: group - fields: - - name: crypto - type: keyword - description: This key is used to capture the Encryption Type or Encryption Key only - - name: cipher_src - type: keyword - description: This key is for Source (Client) Cipher - - name: cert_subject - type: keyword - description: This key is used to capture the Certificate organization only - - name: peer - type: keyword - description: This key is for Encryption peer's IP Address - - name: cipher_size_src - type: long - description: This key captures Source (Client) Cipher Size - - name: ike - type: keyword - description: IKE negotiation phase. - - name: scheme - type: keyword - description: This key captures the Encryption scheme used - - name: peer_id - type: keyword - description: "This key is for Encryption peer’s identity" - - name: sig_type - type: keyword - description: This key captures the Signature Type - - name: cert_issuer - type: keyword - - name: cert_host_name - type: keyword - description: Deprecated key defined only in table map. - - name: cert_error - type: keyword - description: This key captures the Certificate Error String - - name: cipher_dst - type: keyword - description: This key is for Destination (Server) Cipher - - name: cipher_size_dst - type: long - description: This key captures Destination (Server) Cipher Size - - name: ssl_ver_src - type: keyword - description: Deprecated, use version - - name: d_certauth - type: keyword - - name: s_certauth - type: keyword - - name: ike_cookie1 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase One" - - name: ike_cookie2 - type: keyword - description: "ID of the negotiation — sent for ISAKMP Phase Two" - - name: cert_checksum - type: keyword - - name: cert_host_cat - type: keyword - description: This key is used for the hostname category value of a certificate - - name: cert_serial - type: keyword - description: This key is used to capture the Certificate serial number only - - name: cert_status - type: keyword - description: This key captures Certificate validation status - - name: ssl_ver_dst - type: keyword - description: Deprecated, use version - - name: cert_keysize - type: keyword - - name: cert_username - type: keyword - - name: https_insact - type: keyword - - name: https_valid - type: keyword - - name: cert_ca - type: keyword - description: This key is used to capture the Certificate signing authority only - - name: cert_common - type: keyword - description: This key is used to capture the Certificate common name only - - name: wireless - type: group - fields: - - name: wlan_ssid - type: keyword - description: This key is used to capture the ssid of a Wireless Session - - name: access_point - type: keyword - description: This key is used to capture the access point name. - - name: wlan_channel - type: long - description: This is used to capture the channel names - - name: wlan_name - type: keyword - description: This key captures either WLAN number/name - - name: storage - type: group - fields: - - name: disk_volume - type: keyword - description: A unique name assigned to logical units (volumes) within a physical disk - - name: lun - type: keyword - description: Logical Unit Number.This key is a very useful concept in Storage. - - name: pwwn - type: keyword - description: This uniquely identifies a port on a HBA. - - name: physical - type: group - fields: - - name: org_dst - type: keyword - description: This is used to capture the destination organization based on the GEOPIP Maxmind database. - - name: org_src - type: keyword - description: This is used to capture the source organization based on the GEOPIP Maxmind database. - - name: healthcare - type: group - fields: - - name: patient_fname - type: keyword - description: This key is for First Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_id - type: keyword - description: This key captures the unique ID for a patient - - name: patient_lname - type: keyword - description: This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information - - name: patient_mname - type: keyword - description: This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information - - name: endpoint - type: group - fields: - - name: host_state - type: keyword - description: This key is used to capture the current state of the machine, such as blacklisted, infected, firewall disabled and so on - - name: registry_key - type: keyword - description: This key captures the path to the registry key - - name: registry_value - type: keyword - description: This key captures values or decorators used within a registry entry -- name: dns.question.domain - type: keyword - ignore_above: 1024 - description: Server domain. -- name: network.interface.name - type: keyword + description: DHCP router IP. + - name: sandbox + type: keyword + - name: severity + type: keyword + description: Event severity. + - name: socket + type: keyword + description: Socket where DHCP server is listening. + - name: sub + type: keyword + - name: subnet + type: keyword + description: Subnet where DHCP server is listening. + - name: sys + type: keyword + description: System name. + - name: tcpflags + type: keyword + description: TCP flags set in any packet of session. + - name: tos + type: keyword + description: Type of Service. + - name: ttl + type: long + description: Time to Live. + - name: type + type: keyword + description: Type ID. + - name: url + type: keyword + description: HTTP request URL. diff --git a/packages/sophos/data_stream/utm/manifest.yml b/packages/sophos/data_stream/utm/manifest.yml index 807bd92dda8..1e711b8eabf 100644 --- a/packages/sophos/data_stream/utm/manifest.yml +++ b/packages/sophos/data_stream/utm/manifest.yml @@ -1,5 +1,4 @@ title: Sophos UTM logs -release: experimental type: logs streams: - input: udp @@ -32,28 +31,13 @@ streams: default: 9549 - name: tz_offset type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields + title: Timezone offset + multi: false required: false show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false + default: UTC + description: >- + By default, date times in the logs will be interpreted as UTC timezone. If the timezone of logs is different, use this field to set the timezone offset so that date times are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam") or an HH:mm differential (e.g. "-05:00"). - name: preserve_original_event required: true show_user: true @@ -101,28 +85,13 @@ streams: default: 9549 - name: tz_offset type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields + title: Timezone offset + multi: false required: false show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false + default: UTC + description: >- + By default, date times in the logs will be interpreted as UTC timezone. If the timezone of logs is different, use this field to set the timezone offset so that date times are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam") or an HH:mm differential (e.g. "-05:00"). - name: preserve_original_event required: true show_user: true @@ -141,7 +110,6 @@ streams: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. - input: logfile - enabled: false title: Sophos UTM logs description: Collect Sophos UTM logs from file vars: @@ -164,28 +132,13 @@ streams: - forwarded - name: tz_offset type: text - title: Timezone offset (+HH:mm format) - required: false - show_user: true - default: "local" - - name: rsa_fields - type: bool - title: Add non-ECS fields + title: Timezone offset + multi: false required: false show_user: true - default: true - - name: keep_raw_fields - type: bool - title: Keep raw parser fields - required: false - show_user: false - default: false - - name: debug - type: bool - title: Enable debug logging - required: false - show_user: false - default: false + default: UTC + description: >- + By default, date times in the logs will be interpreted as UTC timezone. If the timezone of logs is different, use this field to set the timezone offset so that date times are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam") or an HH:mm differential (e.g. "-05:00"). - name: preserve_original_event required: true show_user: true diff --git a/packages/sophos/data_stream/utm/sample_event.json b/packages/sophos/data_stream/utm/sample_event.json index ce7c56f013d..29de011369e 100644 --- a/packages/sophos/data_stream/utm/sample_event.json +++ b/packages/sophos/data_stream/utm/sample_event.json @@ -1,73 +1,178 @@ { - "@timestamp": "2016-01-29T06:09:59.000Z", + "@timestamp": "2023-03-08T15:00:00.000Z", "agent": { - "ephemeral_id": "4a4dd5d5-8f82-4911-b531-99290943b6c6", - "id": "9a015053-a5c0-4959-99ab-2b6556a2a396", + "ephemeral_id": "cc0463c4-c141-46e2-81a4-c9ffe70bf450", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.8.1" }, "data_stream": { "dataset": "sophos.utm", "namespace": "ep", "type": "logs" }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "9a015053-a5c0-4959-99ab-2b6556a2a396", - "snapshot": true, - "version": "8.0.0" + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", + "snapshot": false, + "version": "8.8.1" }, "event": { + "action": "pass", "agent_id_status": "verified", - "code": "smtpd", + "category": [ + "web" + ], "dataset": "sophos.utm", - "ingested": "2022-01-25T18:04:29Z", - "timezone": "+00:00" + "id": "0001", + "ingested": "2023-07-20T08:37:19Z", + "kind": "event", + "provider": "http", + "severity": 6, + "timezone": "+00:00", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" }, "host": { - "name": "localhost.localdomain" + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 311, + "id": "0x7fad9e44ac00", + "method": "HEAD", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 200 + } }, "input": { "type": "udp" }, "log": { "source": { - "address": "172.25.0.7:39467" + "address": "172.31.0.4:45730" } }, - "message": "smtpd: MASTER:QR globally disabled, status one set to disabled.", + "network": { + "application": "googplay", + "protocol": "http" + }, "observer": { "product": "UTM", - "type": "Firewall", + "type": "firewall", "vendor": "Sophos" }, "process": { - "pid": 905 + "name": "httpproxy", + "pid": 6267 }, "related": { "hosts": [ - "localhost.localdomain" + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" ] }, - "rsa": { - "internal": { - "event_desc": "smtpd: MASTER:QR globally disabled, status one set to disabled.", - "messageid": "smtpd" + "sophos": { + "utm": { + "ad_domain": "example.com", + "app_id": "816", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "178" + ], + "categoryname": [ + "Internet Services" + ], + "cattime": 200, + "content_type": "application/octet-stream", + "country": "United States", + "dnstime": 5, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 32181, + "name": "http access", + "profile": "HTTP_Sophos_Profile_1", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 }, - "network": { - "alias_host": [ - "localhost.localdomain" - ] + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } }, - "time": { - "event_time": "2016-01-29T06:09:59.000Z" - } + "ip": "67.43.156.2" }, "tags": [ "sophos-utm", "forwarded" - ] + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Microsoft BITS/7.8" + } } \ No newline at end of file diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-spam.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-spam.log-expected.json index ae8df4a87f3..ad03744b0ca 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-spam.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-spam.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -117,7 +117,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -223,7 +223,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -327,7 +327,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -433,7 +433,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -539,7 +539,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -645,7 +645,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -751,7 +751,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -855,7 +855,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -952,7 +952,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Dos", @@ -1038,7 +1038,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1143,7 +1143,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1248,7 +1248,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1355,7 +1355,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1459,7 +1459,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1561,7 +1561,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1665,7 +1665,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1769,7 +1769,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1871,7 +1871,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-ftp.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-ftp.log-expected.json index 235a3543d86..65de23c20d2 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-ftp.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-ftp.log-expected.json @@ -8,7 +8,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", @@ -98,7 +98,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-smtp.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-smtp.log-expected.json index c76776f154d..8ef24d83507 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-smtp.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-smtp.log-expected.json @@ -11,7 +11,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -118,7 +118,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -225,7 +225,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-web.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-web.log-expected.json index 1440f824bd5..d6271441784 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-web.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-anti-virus-web.log-expected.json @@ -23,7 +23,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", @@ -121,7 +121,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-atp-firewall.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-atp-firewall.log-expected.json index 918653e711a..29b45979b33 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-atp-firewall.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-atp-firewall.log-expected.json @@ -19,7 +19,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -106,7 +106,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-authentication.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-authentication.log-expected.json index 8bba545a815..5cedd801927 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-authentication.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-authentication.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2017-01-31T18:13:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -15,7 +15,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, @@ -77,7 +76,7 @@ { "@timestamp": "2017-03-15T14:33:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -89,7 +88,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, @@ -147,7 +145,7 @@ { "@timestamp": "2017-03-15T17:23:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -159,7 +157,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-http.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-http.log-expected.json index be8f6e925b6..217ae036c43 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-http.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-http.log-expected.json @@ -20,7 +20,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -117,7 +117,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -222,7 +222,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -332,7 +332,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -442,7 +442,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -553,7 +553,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -663,7 +663,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "warned", @@ -771,7 +771,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-web-content-policy.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-web-content-policy.log-expected.json index 10e81d36ccc..88999fbcd56 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-web-content-policy.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-content-filtering-web-content-policy.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-firewall.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-firewall.log-expected.json index b42a29e3458..d5263816afc 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-firewall.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-firewall.log-expected.json @@ -24,7 +24,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -170,7 +170,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -288,7 +288,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -391,7 +391,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -509,7 +509,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -613,7 +613,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -722,7 +722,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -817,7 +817,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -910,7 +910,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1011,7 +1011,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1112,7 +1112,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1214,7 +1214,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1310,7 +1310,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1425,7 +1425,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1521,7 +1521,7 @@ "ip": "127.0.0.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1610,7 +1610,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-idp.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-idp.log-expected.json index 6c478ec57a0..d4db62ccfe9 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-idp.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-idp.log-expected.json @@ -7,7 +7,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "detect", @@ -90,7 +90,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -173,7 +173,7 @@ "port": 111 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "detect", @@ -256,7 +256,7 @@ "port": 40575 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-sandstorm.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-sandstorm.log-expected.json index ea2b9f99838..97d9cd16bad 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-sandstorm.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-sandstorm.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2016-12-02T18:27:55.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", @@ -65,7 +65,7 @@ "domain": "floater.baldrys.ca" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", @@ -149,7 +149,7 @@ "domain": "ta-web-static.qa.astaro.de" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Denied", @@ -234,7 +234,7 @@ "domain": "floater.baldrys.ca" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Pending", @@ -319,7 +319,7 @@ "domain": "floater.baldrys.ca" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Pending", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-systemhealth.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-systemhealth.log-expected.json index b7baf9401a1..6c19e0e21a2 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-systemhealth.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-systemhealth.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-06-05T15:10:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18031", @@ -50,7 +50,7 @@ { "@timestamp": "2018-06-05T15:10:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18031", @@ -98,7 +98,7 @@ { "@timestamp": "2018-06-05T15:10:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18031", @@ -150,7 +150,7 @@ { "@timestamp": "2018-06-05T15:10:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18031", @@ -198,7 +198,7 @@ { "@timestamp": "2018-06-05T15:10:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18031", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-wireless.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-wireless.log-expected.json index f976b69946c..cce7a70e2ef 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-wireless.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-18-5-wireless.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2017-02-01T14:17:35.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18011", @@ -51,7 +51,7 @@ { "@timestamp": "2017-02-01T14:19:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18011", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json index 97f05472586..22acb0a775e 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json @@ -10,7 +10,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -118,7 +118,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -245,7 +245,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -374,7 +374,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -491,7 +491,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -597,7 +597,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -703,7 +703,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -809,7 +809,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -910,7 +910,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Dos", @@ -996,7 +996,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1101,7 +1101,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1217,7 +1217,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", @@ -1339,7 +1339,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", @@ -1464,7 +1464,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1594,7 +1594,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1712,7 +1712,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1819,7 +1819,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "email": { "from": { @@ -1923,7 +1923,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Virus", @@ -2012,7 +2012,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", @@ -2107,7 +2107,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -2201,7 +2201,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -2306,7 +2306,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -2411,7 +2411,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -2500,7 +2500,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2606,7 +2606,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -2716,7 +2716,7 @@ "port": 5228 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -2823,7 +2823,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2939,7 +2939,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -3057,7 +3057,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3168,7 +3168,7 @@ { "@timestamp": "2016-12-02T18:50:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "alert", @@ -3251,7 +3251,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "warned", @@ -3359,7 +3359,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3453,7 +3453,7 @@ { "@timestamp": "2020-05-18T14:38:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3465,7 +3465,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, @@ -3554,7 +3553,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18055", @@ -3628,7 +3627,7 @@ { "@timestamp": "2020-05-18T14:38:59.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18057", @@ -3675,7 +3674,7 @@ { "@timestamp": "2020-05-18T14:39:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3687,7 +3686,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, @@ -3757,7 +3755,7 @@ { "@timestamp": "2020-05-18T14:39:01.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3812,7 +3810,7 @@ { "@timestamp": "2020-05-18T14:39:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "60022", @@ -3860,7 +3858,7 @@ { "@timestamp": "2020-05-18T14:39:03.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3872,7 +3870,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "start" ] }, @@ -3945,7 +3942,7 @@ "bytes": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17824", @@ -4004,7 +4001,7 @@ { "@timestamp": "2020-05-18T14:39:05.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4083,7 +4080,7 @@ { "@timestamp": "2020-05-18T14:39:06.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18017", @@ -4131,7 +4128,7 @@ { "@timestamp": "2020-05-18T14:39:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17502", @@ -4190,7 +4187,7 @@ { "@timestamp": "2020-05-18T14:39:08.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17507", @@ -4261,7 +4258,7 @@ { "@timestamp": "2020-05-18T14:39:09.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17818", @@ -4309,7 +4306,7 @@ { "@timestamp": "2020-05-18T14:39:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17923", @@ -4358,7 +4355,7 @@ "bytes": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4371,7 +4368,6 @@ "outcome": "success", "severity": 6, "type": [ - "user", "end", "connection" ] @@ -4438,7 +4434,7 @@ "bytes": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18014", @@ -4496,7 +4492,7 @@ "bytes": 31488 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18015", @@ -4554,7 +4550,7 @@ "bytes": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18016", @@ -4609,7 +4605,7 @@ { "@timestamp": "2018-06-06T11:12:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "17815", @@ -4678,7 +4674,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4822,7 +4818,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4966,7 +4962,7 @@ "port": 4980 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5084,7 +5080,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5211,7 +5207,7 @@ "port": 18 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5324,7 +5320,7 @@ "port": 1109 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5452,7 +5448,7 @@ "port": 64465 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5567,7 +5563,7 @@ "port": 56267 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -5680,7 +5676,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5817,7 +5813,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5932,7 +5928,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -6071,7 +6067,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6166,7 +6162,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6259,7 +6255,7 @@ "port": 137 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6360,7 +6356,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6461,7 +6457,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6569,7 +6565,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6665,7 +6661,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6765,7 +6761,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6879,7 +6875,7 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -6990,7 +6986,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -7096,7 +7092,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -7202,7 +7198,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -7296,7 +7292,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "detect", @@ -7379,7 +7375,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -7458,7 +7454,7 @@ { "@timestamp": "2017-01-31T14:52:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", @@ -7516,7 +7512,7 @@ { "@timestamp": "2017-01-31T14:52:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Denied", @@ -7595,7 +7591,7 @@ { "@timestamp": "2017-01-31T15:28:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Allowed", @@ -7656,7 +7652,7 @@ "ip": "10.198.241.50" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Pending", @@ -7741,7 +7737,7 @@ "ip": "10.198.241.50" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Denied", @@ -7827,7 +7823,7 @@ "domain": "sophostest.com" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Denied", @@ -7931,7 +7927,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -8036,7 +8032,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -8130,7 +8126,7 @@ "ip": "10.198.233.48" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -8220,7 +8216,7 @@ "ip": "10.198.233.48" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -8325,7 +8321,7 @@ "ip": "175.16.199.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -8414,7 +8410,7 @@ { "@timestamp": "2017-02-01T14:17:35.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18011", @@ -8462,7 +8458,7 @@ { "@timestamp": "2017-02-01T14:19:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "18011", @@ -8536,7 +8532,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -8676,7 +8672,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-cfilter-new.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-cfilter-new.log-expected.json index f6295d1d50d..1d859cdb51a 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-cfilter-new.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-cfilter-new.log-expected.json @@ -7,7 +7,7 @@ "port": 22083 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -107,7 +107,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -222,7 +222,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -337,7 +337,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -452,7 +452,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -573,7 +573,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -689,7 +689,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -804,7 +804,7 @@ "port": 8089 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -927,7 +927,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1042,7 +1042,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1164,7 +1164,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1287,7 +1287,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1402,7 +1402,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1502,7 +1502,7 @@ "port": 8089 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1617,7 +1617,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1732,7 +1732,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1847,7 +1847,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1961,7 +1961,7 @@ "port": 4000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -2061,7 +2061,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2182,7 +2182,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2297,7 +2297,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2417,7 +2417,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2537,7 +2537,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2652,7 +2652,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2773,7 +2773,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2888,7 +2888,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3006,7 +3006,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3122,7 +3122,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3219,7 +3219,7 @@ "port": 8089 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3334,7 +3334,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3449,7 +3449,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3564,7 +3564,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3679,7 +3679,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3795,7 +3795,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3910,7 +3910,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4026,7 +4026,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4147,7 +4147,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4262,7 +4262,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4377,7 +4377,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4492,7 +4492,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4607,7 +4607,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4722,7 +4722,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4837,7 +4837,7 @@ "port": 8089 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4960,7 +4960,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5075,7 +5075,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5190,7 +5190,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5305,7 +5305,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5421,7 +5421,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5542,7 +5542,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5657,7 +5657,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-event-new.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-event-new.log-expected.json index 168cdb659ad..146d07a6e55 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-event-new.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-event-new.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-15T20:52:23.000-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "60020", @@ -56,7 +56,7 @@ { "@timestamp": "2021-11-15T20:57:56.000-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "60020", @@ -109,7 +109,7 @@ { "@timestamp": "2021-11-15T21:04:08.000-06:00", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "code": "60020", diff --git a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-firewall-new.log-expected.json b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-firewall-new.log-expected.json index 53f9d1f820b..9b6355fb373 100644 --- a/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-firewall-new.log-expected.json +++ b/packages/sophos/data_stream/xg/_dev/test/pipeline/test-xg-firewall-new.log-expected.json @@ -26,7 +26,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -145,7 +145,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -264,7 +264,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -384,7 +384,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -509,7 +509,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -611,7 +611,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -713,7 +713,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -833,7 +833,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -958,7 +958,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1060,7 +1060,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1161,7 +1161,7 @@ "port": 22083 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1262,7 +1262,7 @@ "port": 22083 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1380,7 +1380,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -1484,7 +1484,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1609,7 +1609,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1729,7 +1729,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1854,7 +1854,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -1975,7 +1975,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2100,7 +2100,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "denied", @@ -2204,7 +2204,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2312,7 +2312,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2435,7 +2435,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2553,7 +2553,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2674,7 +2674,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2782,7 +2782,7 @@ "port": 9988 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -2896,7 +2896,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3014,7 +3014,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3134,7 +3134,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3262,7 +3262,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3393,7 +3393,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3518,7 +3518,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3638,7 +3638,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3746,7 +3746,7 @@ "port": 8089 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3867,7 +3867,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -3996,7 +3996,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4116,7 +4116,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4243,7 +4243,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4368,7 +4368,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4488,7 +4488,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4614,7 +4614,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4734,7 +4734,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4859,7 +4859,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -4977,7 +4977,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5096,7 +5096,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5217,7 +5217,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5347,7 +5347,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5465,7 +5465,7 @@ "mac": "00-50-56-9F-39-33" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5585,7 +5585,7 @@ "packets": 2 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5711,7 +5711,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -5834,7 +5834,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", diff --git a/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/default.yml b/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/default.yml index b2d22d0ec21..811f2a99678 100644 --- a/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing Sophos XG firewall logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.original diff --git a/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/event.yml b/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/event.yml index 855e94ec7ad..62083620122 100644 --- a/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/event.yml +++ b/packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/event.yml @@ -25,15 +25,11 @@ processors: if: 'ctx.sophos?.xg?.log_subtype == "Admin" && ctx.sophos?.xg?.status == "Failed" && ctx.event?.code == "17507"' - append: field: event.type - value: - - user - - start + value: start if: "['17701', '17704', '17707', '17710', '17713'].contains(ctx.event?.code)" - append: field: event.type - value: - - user - - end + value: end if: "['17703', '17706', '17709', '17712', '17715'].contains(ctx.event?.code)" - append: field: event.type diff --git a/packages/sophos/data_stream/xg/sample_event.json b/packages/sophos/data_stream/xg/sample_event.json index a2f29c627c3..3522d4364c8 100644 --- a/packages/sophos/data_stream/xg/sample_event.json +++ b/packages/sophos/data_stream/xg/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2016-12-02T18:50:20.000Z", "agent": { - "ephemeral_id": "b1eb8b45-bca7-40b1-b2f4-9d5c87e449bc", - "id": "dee3c982-4bd2-4c06-b207-fe0ce9ef19c5", + "ephemeral_id": "12701a32-24a5-401a-a7f4-b8202e00f440", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.1.2" + "version": "8.8.1" }, "data_stream": { "dataset": "sophos.xg", @@ -13,12 +13,12 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "dee3c982-4bd2-4c06-b207-fe0ce9ef19c5", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", "snapshot": false, - "version": "8.1.2" + "version": "8.8.1" }, "event": { "action": "alert", @@ -28,22 +28,22 @@ ], "code": "16010", "dataset": "sophos.xg", - "ingested": "2022-04-20T20:13:02Z", + "ingested": "2023-07-20T08:39:24Z", "kind": "event", "outcome": "success", "severity": 1, - "timezone": "+00:00" + "timezone": "GMT" }, "host": { "name": "XG230" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "level": "alert", "source": { - "address": "172.31.0.8:48162" + "address": "172.31.0.4:59318" } }, "observer": { @@ -76,6 +76,7 @@ "log_subtype": "Alert", "log_type": "Content Filtering", "site_category": "Information Technology", + "timezone": "GMT", "transaction_id": "e4a127f7-a850-477c-920e-a471b38727c1", "user": "gi123456", "website": "ta-web-static-testing.qa. astaro.de" diff --git a/packages/sophos/docs/README.md b/packages/sophos/docs/README.md index 63bec6b2d0a..2ac3acb2058 100644 --- a/packages/sophos/docs/README.md +++ b/packages/sophos/docs/README.md @@ -2,7 +2,7 @@ The Sophos integration collects and parses logs from Sophos Products. -Currently it accepts logs in syslog format or from a file for the following devices: +Currently, it accepts logs in syslog format or from a file for the following devices: - `utm` dataset: supports [Unified Threat Management](https://www.sophos.com/en-us/support/documentation/sophos-utm) (formerly known as Astaro Security Gateway) logs. - `xg` dataset: supports [Sophos XG SFOS logs](https://docs.sophos.com/nsg/sophos-firewall/17.5/Help/en-us/webhelp/onlinehelp/nsg/sfos/concepts/Logs.html). @@ -18,824 +18,411 @@ Versions above this are expected to work but have not been tested. ## Logs -### Utm log +### UTM log -The `utm` dataset collects Unified Threat Management logs. +The `utm` dataset collects Unified Threat Management logs. Currently, it collects the following log categories: DNS, DHCP, HTTP and Packet Filter. + +An example event for `utm` looks as following: + +```json +{ + "@timestamp": "2023-03-08T15:00:00.000Z", + "agent": { + "ephemeral_id": "cc0463c4-c141-46e2-81a4-c9ffe70bf450", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.1" + }, + "data_stream": { + "dataset": "sophos.utm", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.129" + }, + "device": { + "id": "0" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", + "snapshot": false, + "version": "8.8.1" + }, + "event": { + "action": "pass", + "agent_id_status": "verified", + "category": [ + "web" + ], + "dataset": "sophos.utm", + "id": "0001", + "ingested": "2023-07-20T08:37:19Z", + "kind": "event", + "provider": "http", + "severity": 6, + "timezone": "+00:00", + "type": [ + "info" + ] + }, + "group": { + "name": "testgroup" + }, + "host": { + "hostname": "sophos-test-vm1" + }, + "http": { + "request": { + "bytes": 311, + "id": "0x7fad9e44ac00", + "method": "HEAD", + "referrer": "https://referer.test.com/" + }, + "response": { + "status_code": 200 + } + }, + "input": { + "type": "udp" + }, + "log": { + "source": { + "address": "172.31.0.4:45730" + } + }, + "network": { + "application": "googplay", + "protocol": "http" + }, + "observer": { + "product": "UTM", + "type": "firewall", + "vendor": "Sophos" + }, + "process": { + "name": "httpproxy", + "pid": 6267 + }, + "related": { + "hosts": [ + "sophos-test-vm1" + ], + "ip": [ + "67.43.156.2", + "89.160.20.129" + ], + "user": [ + "testuser" + ] + }, + "sophos": { + "utm": { + "ad_domain": "example.com", + "app_id": "816", + "aptptime": 0, + "auth": "0", + "authtime": 0, + "avscantime": 0, + "cached": "0", + "category": [ + "178" + ], + "categoryname": [ + "Internet Services" + ], + "cattime": 200, + "content_type": "application/octet-stream", + "country": "United States", + "dnstime": 5, + "filteraction": "REF_HTTP_ACTION", + "fullreqtime": 32181, + "name": "http access", + "profile": "HTTP_Sophos_Profile_1", + "reputation": "trusted", + "severity": "info", + "sub": "http", + "sys": "SecureWeb" + } + }, + "source": { + "as": { + "number": 35908 + }, + "geo": { + "continent_name": "Asia", + "country_iso_code": "BT", + "country_name": "Bhutan", + "location": { + "lat": 27.5, + "lon": 90.5 + } + }, + "ip": "67.43.156.2" + }, + "tags": [ + "sophos-utm", + "forwarded" + ], + "url": { + "domain": "myurl.test.com", + "original": "https://myurl.test.com/extension", + "path": "/extension", + "scheme": "https" + }, + "user": { + "name": "testuser" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "Microsoft BITS/7.8" + } +} +``` **Exported fields** | Field | Description | Type | |---|---|---| | @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | -| client.domain | The domain name of the client system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| client.registered_domain | The highest registered client domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| client.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| client.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| client.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| client.as.organization.name | Organization name. | keyword | +| client.as.organization.name.text | Multi-field of `client.as.organization.name`. | match_only_text | +| client.geo.city_name | City name. | keyword | +| client.geo.continent_name | Name of the continent. | keyword | +| client.geo.country_iso_code | Country ISO code. | keyword | +| client.geo.country_name | Country name. | keyword | +| client.geo.location | Longitude and latitude. | geo_point | +| client.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| client.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| client.geo.region_iso_code | Region ISO code. | keyword | +| client.geo.region_name | Region name. | keyword | +| client.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | +| client.mac | MAC address of the client. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | +| client.port | Port of the client. | long | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | | container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | | data_stream.dataset | Data stream dataset. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | destination.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | destination.as.organization.name | Organization name. | keyword | | destination.as.organization.name.text | Multi-field of `destination.as.organization.name`. | match_only_text | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.domain | The domain name of the destination system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | destination.geo.city_name | City name. | keyword | +| destination.geo.continent_name | Name of the continent. | keyword | +| destination.geo.country_iso_code | Country ISO code. | keyword | | destination.geo.country_name | Country name. | keyword | | destination.geo.location | Longitude and latitude. | geo_point | +| destination.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| destination.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| destination.geo.region_iso_code | Region ISO code. | keyword | +| destination.geo.region_name | Region name. | keyword | +| destination.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| destination.nat.ip | Translated ip of destination based NAT sessions (e.g. internet to private DMZ) Typically used with load balancers, firewalls, or routers. | ip | -| destination.nat.port | Port the source session is translated to by NAT Device. Typically used with load balancers, firewalls, or routers. | long | | destination.port | Port of the destination. | long | -| destination.registered_domain | The highest registered destination domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| destination.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| destination.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.question.domain | Server domain. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| dns.question.type | The type of record being queried. | keyword | +| device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Event dataset | constant_keyword | -| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.id | Unique ID to describe the event. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | -| file.attributes | Array of file attributes. Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | keyword | -| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | -| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.name | Name of the file including the extension, without the directory. | keyword | -| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | -| file.path.text | Multi-field of `file.path`. | match_only_text | -| file.size | File size in bytes. Only relevant when `file.type` is "file". | long | -| file.type | File type (file, dir, or symlink). | keyword | -| geo.city_name | City name. | keyword | -| geo.country_name | Country name. | keyword | -| geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | -| geo.region_name | Region name. | keyword | -| group.id | Unique identifier for the group on the system/platform. | keyword | | group.name | Name of the group. | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | host.ip | Host ip addresses. | ip | -| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| http.request.bytes | Total size in bytes of the request (body and headers). | long | +| http.request.id | A unique identifier for each HTTP request to correlate logs between clients and servers in transactions. The id may be contained in a non-standard HTTP header, such as `X-Request-ID` or `X-Correlation-ID`. | keyword | | http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | | http.request.referrer | Referrer for this HTTP request. | keyword | -| input.type | Type of Filebeat input. | keyword | +| http.response.status_code | HTTP response status code. | long | +| input.type | Input type. | keyword | | log.file.path | Full path to the log file this event came from. | keyword | | log.flags | Flags for the log file. | keyword | -| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | -| log.offset | Offset of the entry in the log file. | long | +| log.offset | Log offset | long | | log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.facility.code | The Syslog numeric facility of the log event, if available. According to RFCs 5424 and 3164, this value should be an integer between 0 and 23. | long | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| log.syslog.severity.code | The Syslog numeric severity of the log event, if available. If the event source publishing via Syslog provides a different numeric severity value (e.g. firewall, IDS), your source's numeric severity should go to `event.severity`. If the event source does not specify a distinct severity, you can optionally copy the Syslog severity to `event.severity`. | long | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | -| network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.forwarded_ip | Host IP address when the source IP address is the proxy. | ip | -| network.interface.name | | keyword | -| network.packets | Total packets transferred in both directions. If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | long | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | | network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | +| network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | | observer.egress.interface.name | Interface name as reported by the system. | keyword | | observer.ingress.interface.name | Interface name as reported by the system. | keyword | | observer.product | The product name of the observer. | keyword | | observer.type | The type of the observer the data is coming from. There is no predefined list of observer types. Some examples are `forwarder`, `firewall`, `ids`, `ips`, `proxy`, `poller`, `sensor`, `APM server`. | keyword | | observer.vendor | Vendor name of the observer. | keyword | -| observer.version | Observer version. | keyword | | process.name | Process name. Sometimes called program name or similar. | keyword | | process.name.text | Multi-field of `process.name`. | match_only_text | -| process.parent.name | Process name. Sometimes called program name or similar. | keyword | -| process.parent.name.text | Multi-field of `process.parent.name`. | match_only_text | -| process.parent.pid | Process id. | long | -| process.parent.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.parent.title.text | Multi-field of `process.parent.title`. | match_only_text | | process.pid | Process id. | long | -| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | -| process.title.text | Multi-field of `process.title`. | match_only_text | | related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | | related.ip | All of the IPs seen on your event. | ip | | related.user | All the user names or other user identifiers seen on the event. | keyword | -| rsa.counters.dclass_c1 | This is a generic counter key that should be used with the label dclass.c1.str only | long | -| rsa.counters.dclass_c1_str | This is a generic counter string key that should be used with the label dclass.c1 only | keyword | -| rsa.counters.dclass_c2 | This is a generic counter key that should be used with the label dclass.c2.str only | long | -| rsa.counters.dclass_c2_str | This is a generic counter string key that should be used with the label dclass.c2 only | keyword | -| rsa.counters.dclass_c3 | This is a generic counter key that should be used with the label dclass.c3.str only | long | -| rsa.counters.dclass_c3_str | This is a generic counter string key that should be used with the label dclass.c3 only | keyword | -| rsa.counters.dclass_r1 | This is a generic ratio key that should be used with the label dclass.r1.str only | keyword | -| rsa.counters.dclass_r1_str | This is a generic ratio string key that should be used with the label dclass.r1 only | keyword | -| rsa.counters.dclass_r2 | This is a generic ratio key that should be used with the label dclass.r2.str only | keyword | -| rsa.counters.dclass_r2_str | This is a generic ratio string key that should be used with the label dclass.r2 only | keyword | -| rsa.counters.dclass_r3 | This is a generic ratio key that should be used with the label dclass.r3.str only | keyword | -| rsa.counters.dclass_r3_str | This is a generic ratio string key that should be used with the label dclass.r3 only | keyword | -| rsa.counters.event_counter | This is used to capture the number of times an event repeated | long | -| rsa.crypto.cert_ca | This key is used to capture the Certificate signing authority only | keyword | -| rsa.crypto.cert_checksum | | keyword | -| rsa.crypto.cert_common | This key is used to capture the Certificate common name only | keyword | -| rsa.crypto.cert_error | This key captures the Certificate Error String | keyword | -| rsa.crypto.cert_host_cat | This key is used for the hostname category value of a certificate | keyword | -| rsa.crypto.cert_host_name | Deprecated key defined only in table map. | keyword | -| rsa.crypto.cert_issuer | | keyword | -| rsa.crypto.cert_keysize | | keyword | -| rsa.crypto.cert_serial | This key is used to capture the Certificate serial number only | keyword | -| rsa.crypto.cert_status | This key captures Certificate validation status | keyword | -| rsa.crypto.cert_subject | This key is used to capture the Certificate organization only | keyword | -| rsa.crypto.cert_username | | keyword | -| rsa.crypto.cipher_dst | This key is for Destination (Server) Cipher | keyword | -| rsa.crypto.cipher_size_dst | This key captures Destination (Server) Cipher Size | long | -| rsa.crypto.cipher_size_src | This key captures Source (Client) Cipher Size | long | -| rsa.crypto.cipher_src | This key is for Source (Client) Cipher | keyword | -| rsa.crypto.crypto | This key is used to capture the Encryption Type or Encryption Key only | keyword | -| rsa.crypto.d_certauth | | keyword | -| rsa.crypto.https_insact | | keyword | -| rsa.crypto.https_valid | | keyword | -| rsa.crypto.ike | IKE negotiation phase. | keyword | -| rsa.crypto.ike_cookie1 | ID of the negotiation — sent for ISAKMP Phase One | keyword | -| rsa.crypto.ike_cookie2 | ID of the negotiation — sent for ISAKMP Phase Two | keyword | -| rsa.crypto.peer | This key is for Encryption peer's IP Address | keyword | -| rsa.crypto.peer_id | This key is for Encryption peer’s identity | keyword | -| rsa.crypto.s_certauth | | keyword | -| rsa.crypto.scheme | This key captures the Encryption scheme used | keyword | -| rsa.crypto.sig_type | This key captures the Signature Type | keyword | -| rsa.crypto.ssl_ver_dst | Deprecated, use version | keyword | -| rsa.crypto.ssl_ver_src | Deprecated, use version | keyword | -| rsa.db.database | This key is used to capture the name of a database or an instance as seen in a session | keyword | -| rsa.db.db_id | This key is used to capture the unique identifier for a database | keyword | -| rsa.db.db_pid | This key captures the process id of a connection with database server | long | -| rsa.db.index | This key captures IndexID of the index. | keyword | -| rsa.db.instance | This key is used to capture the database server instance name | keyword | -| rsa.db.lread | This key is used for the number of logical reads | long | -| rsa.db.lwrite | This key is used for the number of logical writes | long | -| rsa.db.permissions | This key captures permission or privilege level assigned to a resource. | keyword | -| rsa.db.pread | This key is used for the number of physical writes | long | -| rsa.db.table_name | This key is used to capture the table name | keyword | -| rsa.db.transact_id | This key captures the SQL transantion ID of the current session | keyword | -| rsa.email.email | This key is used to capture a generic email address where the source or destination context is not clear | keyword | -| rsa.email.email_dst | This key is used to capture the Destination email address only, when the destination context is not clear use email | keyword | -| rsa.email.email_src | This key is used to capture the source email address only, when the source context is not clear use email | keyword | -| rsa.email.subject | This key is used to capture the subject string from an Email only. | keyword | -| rsa.email.trans_from | Deprecated key defined only in table map. | keyword | -| rsa.email.trans_to | Deprecated key defined only in table map. | keyword | -| rsa.endpoint.host_state | This key is used to capture the current state of the machine, such as \blacklisted\, \infected\, \firewall disabled\ and so on | keyword | -| rsa.endpoint.registry_key | This key captures the path to the registry key | keyword | -| rsa.endpoint.registry_value | This key captures values or decorators used within a registry entry | keyword | -| rsa.file.attachment | This key captures the attachment file name | keyword | -| rsa.file.binary | Deprecated key defined only in table map. | keyword | -| rsa.file.directory_dst | \This key is used to capture the directory of the target process or file\ | keyword | -| rsa.file.directory_src | This key is used to capture the directory of the source process or file | keyword | -| rsa.file.file_entropy | This is used to capture entropy vale of a file | double | -| rsa.file.file_vendor | This is used to capture Company name of file located in version_info | keyword | -| rsa.file.filename_dst | This is used to capture name of the file targeted by the action | keyword | -| rsa.file.filename_src | This is used to capture name of the parent filename, the file which performed the action | keyword | -| rsa.file.filename_tmp | | keyword | -| rsa.file.filesystem | | keyword | -| rsa.file.privilege | Deprecated, use permissions | keyword | -| rsa.file.task_name | This is used to capture name of the task | keyword | -| rsa.healthcare.patient_fname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_id | This key captures the unique ID for a patient | keyword | -| rsa.healthcare.patient_lname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.healthcare.patient_mname | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.accesses | This key is used to capture actual privileges used in accessing an object | keyword | -| rsa.identity.auth_method | This key is used to capture authentication methods used only | keyword | -| rsa.identity.dn | X.500 (LDAP) Distinguished Name | keyword | -| rsa.identity.dn_dst | An X.500 (LDAP) Distinguished name that used in a context that indicates a Destination dn | keyword | -| rsa.identity.dn_src | An X.500 (LDAP) Distinguished name that is used in a context that indicates a Source dn | keyword | -| rsa.identity.federated_idp | This key is the federated Identity Provider. This is the server providing the authentication. | keyword | -| rsa.identity.federated_sp | This key is the Federated Service Provider. This is the application requesting authentication. | keyword | -| rsa.identity.firstname | This key is for First Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.host_role | This key should only be used to capture the role of a Host Machine | keyword | -| rsa.identity.lastname | This key is for Last Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.ldap | This key is for Uninterpreted LDAP values. Ldap Values that don’t have a clear query or response context | keyword | -| rsa.identity.ldap_query | This key is the Search criteria from an LDAP search | keyword | -| rsa.identity.ldap_response | This key is to capture Results from an LDAP search | keyword | -| rsa.identity.logon_type | This key is used to capture the type of logon method used. | keyword | -| rsa.identity.logon_type_desc | This key is used to capture the textual description of an integer logon type as stored in the meta key 'logon.type'. | keyword | -| rsa.identity.middlename | This key is for Middle Names only, this is used for Healthcare predominantly to capture Patients information | keyword | -| rsa.identity.org | This key captures the User organization | keyword | -| rsa.identity.owner | This is used to capture username the process or service is running as, the author of the task | keyword | -| rsa.identity.password | This key is for Passwords seen in any session, plain text or encrypted | keyword | -| rsa.identity.profile | This key is used to capture the user profile | keyword | -| rsa.identity.realm | Radius realm or similar grouping of accounts | keyword | -| rsa.identity.service_account | This key is a windows specific key, used for capturing name of the account a service (referenced in the event) is running under. Legacy Usage | keyword | -| rsa.identity.user_dept | User's Department Names only | keyword | -| rsa.identity.user_role | This key is used to capture the Role of a user only | keyword | -| rsa.identity.user_sid_dst | This key captures Destination User Session ID | keyword | -| rsa.identity.user_sid_src | This key captures Source User Session ID | keyword | -| rsa.internal.audit_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.cid | This is the unique identifier used to identify a NetWitness Concentrator. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.data | Deprecated key defined only in table map. | keyword | -| rsa.internal.dead | Deprecated key defined only in table map. | long | -| rsa.internal.device_class | This is the Classification of the Log Event Source under a predefined fixed set of Event Source Classifications. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_group | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_host | This is the Hostname of the log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_ip | This is the IPv4 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_ipv6 | This is the IPv6 address of the Log Event Source sending the logs to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.device_type | This is the name of the log parser which parsed a given session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.device_type_id | Deprecated key defined only in table map. | long | -| rsa.internal.did | This is the unique identifier used to identify a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.entropy_req | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entropy_res | This key is only used by the Entropy Parser, the Meta Type can be either UInt16 or Float32 based on the configuration | long | -| rsa.internal.entry | Deprecated key defined only in table map. | keyword | -| rsa.internal.event_desc | | keyword | -| rsa.internal.event_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.feed_category | This is used to capture the category of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_desc | This is used to capture the description of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.feed_name | This is used to capture the name of the feed. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.forward_ip | This key should be used to capture the IPV4 address of a relay system which forwarded the events from the original system to NetWitness. | ip | -| rsa.internal.forward_ipv6 | This key is used to capture the IPV6 address of a relay system which forwarded the events from the original system to NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | ip | -| rsa.internal.hcode | Deprecated key defined only in table map. | keyword | -| rsa.internal.header_id | This is the Header ID value that identifies the exact log parser header definition that parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.inode | Deprecated key defined only in table map. | long | -| rsa.internal.lc_cid | This is a unique Identifier of a Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.lc_ctime | This is the time at which a log is collected in a NetWitness Log Collector. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | date | -| rsa.internal.level | Deprecated key defined only in table map. | long | -| rsa.internal.mcb_req | This key is only used by the Entropy Parser, the most common byte request is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcb_res | This key is only used by the Entropy Parser, the most common byte response is simply which byte for each side (0 thru 255) was seen the most | long | -| rsa.internal.mcbc_req | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.mcbc_res | This key is only used by the Entropy Parser, the most common byte count is the number of times the most common byte (above) was seen in the session streams | long | -| rsa.internal.medium | This key is used to identify if it’s a log/packet session or Layer 2 Encapsulation Type. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. 32 = log, 33 = correlation session, < 32 is packet session | long | -| rsa.internal.message | This key captures the contents of instant messages | keyword | -| rsa.internal.messageid | | keyword | -| rsa.internal.msg | This key is used to capture the raw message that comes into the Log Decoder | keyword | -| rsa.internal.msg_id | This is the Message ID1 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.msg_vid | This is the Message ID2 value that identifies the exact log parser definition which parses a particular log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.node_name | Deprecated key defined only in table map. | keyword | -| rsa.internal.nwe_callback_id | This key denotes that event is endpoint related | keyword | -| rsa.internal.obj_id | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_server | Deprecated key defined only in table map. | keyword | -| rsa.internal.obj_val | Deprecated key defined only in table map. | keyword | -| rsa.internal.parse_error | This is a special key that stores any Meta key validation error found while parsing a log session. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.payload_req | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.payload_res | This key is only used by the Entropy Parser, the payload size metrics are the payload sizes of each session side at the time of parsing. However, in order to keep | long | -| rsa.internal.process_vid_dst | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the target process. | keyword | -| rsa.internal.process_vid_src | Endpoint generates and uses a unique virtual ID to identify any similar group of process. This ID represents the source process. | keyword | -| rsa.internal.resource | Deprecated key defined only in table map. | keyword | -| rsa.internal.resource_class | Deprecated key defined only in table map. | keyword | -| rsa.internal.rid | This is a special ID of the Remote Session created by NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.session_split | This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.site | Deprecated key defined only in table map. | keyword | -| rsa.internal.size | This is the size of the session as seen by the NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | long | -| rsa.internal.sourcefile | This is the name of the log file or PCAPs that can be imported into NetWitness. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.internal.statement | Deprecated key defined only in table map. | keyword | -| rsa.internal.time | This is the time at which a session hits a NetWitness Decoder. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness. | date | -| rsa.internal.ubc_req | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.ubc_res | This key is only used by the Entropy Parser, Unique byte count is the number of unique bytes seen in each stream. 256 would mean all byte values of 0 thru 255 were seen at least once | long | -| rsa.internal.word | This is used by the Word Parsing technology to capture the first 5 character of every word in an unparsed log | keyword | -| rsa.investigations.analysis_file | This is used to capture all indicators used in a File Analysis. This key should be used to capture an analysis of a file | keyword | -| rsa.investigations.analysis_service | This is used to capture all indicators used in a Service Analysis. This key should be used to capture an analysis of a service | keyword | -| rsa.investigations.analysis_session | This is used to capture all indicators used for a Session Analysis. This key should be used to capture an analysis of a session | keyword | -| rsa.investigations.boc | This is used to capture behaviour of compromise | keyword | -| rsa.investigations.ec_activity | This key captures the particular event activity(Ex:Logoff) | keyword | -| rsa.investigations.ec_outcome | This key captures the outcome of a particular Event(Ex:Success) | keyword | -| rsa.investigations.ec_subject | This key captures the Subject of a particular Event(Ex:User) | keyword | -| rsa.investigations.ec_theme | This key captures the Theme of a particular Event(Ex:Authentication) | keyword | -| rsa.investigations.eoc | This is used to capture Enablers of Compromise | keyword | -| rsa.investigations.event_cat | This key captures the Event category number | long | -| rsa.investigations.event_cat_name | This key captures the event category name corresponding to the event cat code | keyword | -| rsa.investigations.event_vcat | This is a vendor supplied category. This should be used in situations where the vendor has adopted their own event_category taxonomy. | keyword | -| rsa.investigations.inv_category | This used to capture investigation category | keyword | -| rsa.investigations.inv_context | This used to capture investigation context | keyword | -| rsa.investigations.ioc | This is key capture indicator of compromise | keyword | -| rsa.misc.OS | This key captures the Name of the Operating System | keyword | -| rsa.misc.acl_id | | keyword | -| rsa.misc.acl_op | | keyword | -| rsa.misc.acl_pos | | keyword | -| rsa.misc.acl_table | | keyword | -| rsa.misc.action | | keyword | -| rsa.misc.admin | | keyword | -| rsa.misc.agent_id | This key is used to capture agent id | keyword | -| rsa.misc.alarm_id | | keyword | -| rsa.misc.alarmname | | keyword | -| rsa.misc.alert_id | Deprecated, New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.app_id | | keyword | -| rsa.misc.audit | | keyword | -| rsa.misc.audit_object | | keyword | -| rsa.misc.auditdata | | keyword | -| rsa.misc.autorun_type | This is used to capture Auto Run type | keyword | -| rsa.misc.benchmark | | keyword | -| rsa.misc.bypass | | keyword | -| rsa.misc.cache | | keyword | -| rsa.misc.cache_hit | | keyword | -| rsa.misc.category | This key is used to capture the category of an event given by the vendor in the session | keyword | -| rsa.misc.cc_number | Valid Credit Card Numbers only | long | -| rsa.misc.cefversion | | keyword | -| rsa.misc.cfg_attr | | keyword | -| rsa.misc.cfg_obj | | keyword | -| rsa.misc.cfg_path | | keyword | -| rsa.misc.change_attrib | This key is used to capture the name of the attribute that’s changing in a session | keyword | -| rsa.misc.change_new | This key is used to capture the new values of the attribute that’s changing in a session | keyword | -| rsa.misc.change_old | This key is used to capture the old value of the attribute that’s changing in a session | keyword | -| rsa.misc.changes | | keyword | -| rsa.misc.checksum | This key is used to capture the checksum or hash of the entity such as a file or process. Checksum should be used over checksum.src or checksum.dst when it is unclear whether the entity is a source or target of an action. | keyword | -| rsa.misc.checksum_dst | This key is used to capture the checksum or hash of the the target entity such as a process or file. | keyword | -| rsa.misc.checksum_src | This key is used to capture the checksum or hash of the source entity such as a file or process. | keyword | -| rsa.misc.client | This key is used to capture only the name of the client application requesting resources of the server. See the user.agent meta key for capture of the specific user agent identifier or browser identification string. | keyword | -| rsa.misc.client_ip | | keyword | -| rsa.misc.clustermembers | | keyword | -| rsa.misc.cmd | | keyword | -| rsa.misc.cn_acttimeout | | keyword | -| rsa.misc.cn_asn_src | | keyword | -| rsa.misc.cn_bgpv4nxthop | | keyword | -| rsa.misc.cn_ctr_dst_code | | keyword | -| rsa.misc.cn_dst_tos | | keyword | -| rsa.misc.cn_dst_vlan | | keyword | -| rsa.misc.cn_engine_id | | keyword | -| rsa.misc.cn_engine_type | | keyword | -| rsa.misc.cn_f_switch | | keyword | -| rsa.misc.cn_flowsampid | | keyword | -| rsa.misc.cn_flowsampintv | | keyword | -| rsa.misc.cn_flowsampmode | | keyword | -| rsa.misc.cn_inacttimeout | | keyword | -| rsa.misc.cn_inpermbyts | | keyword | -| rsa.misc.cn_inpermpckts | | keyword | -| rsa.misc.cn_invalid | | keyword | -| rsa.misc.cn_ip_proto_ver | | keyword | -| rsa.misc.cn_ipv4_ident | | keyword | -| rsa.misc.cn_l_switch | | keyword | -| rsa.misc.cn_log_did | | keyword | -| rsa.misc.cn_log_rid | | keyword | -| rsa.misc.cn_max_ttl | | keyword | -| rsa.misc.cn_maxpcktlen | | keyword | -| rsa.misc.cn_min_ttl | | keyword | -| rsa.misc.cn_minpcktlen | | keyword | -| rsa.misc.cn_mpls_lbl_1 | | keyword | -| rsa.misc.cn_mpls_lbl_10 | | keyword | -| rsa.misc.cn_mpls_lbl_2 | | keyword | -| rsa.misc.cn_mpls_lbl_3 | | keyword | -| rsa.misc.cn_mpls_lbl_4 | | keyword | -| rsa.misc.cn_mpls_lbl_5 | | keyword | -| rsa.misc.cn_mpls_lbl_6 | | keyword | -| rsa.misc.cn_mpls_lbl_7 | | keyword | -| rsa.misc.cn_mpls_lbl_8 | | keyword | -| rsa.misc.cn_mpls_lbl_9 | | keyword | -| rsa.misc.cn_mplstoplabel | | keyword | -| rsa.misc.cn_mplstoplabip | | keyword | -| rsa.misc.cn_mul_dst_byt | | keyword | -| rsa.misc.cn_mul_dst_pks | | keyword | -| rsa.misc.cn_muligmptype | | keyword | -| rsa.misc.cn_sampalgo | | keyword | -| rsa.misc.cn_sampint | | keyword | -| rsa.misc.cn_seqctr | | keyword | -| rsa.misc.cn_spackets | | keyword | -| rsa.misc.cn_src_tos | | keyword | -| rsa.misc.cn_src_vlan | | keyword | -| rsa.misc.cn_sysuptime | | keyword | -| rsa.misc.cn_template_id | | keyword | -| rsa.misc.cn_totbytsexp | | keyword | -| rsa.misc.cn_totflowexp | | keyword | -| rsa.misc.cn_totpcktsexp | | keyword | -| rsa.misc.cn_unixnanosecs | | keyword | -| rsa.misc.cn_v6flowlabel | | keyword | -| rsa.misc.cn_v6optheaders | | keyword | -| rsa.misc.code | | keyword | -| rsa.misc.command | | keyword | -| rsa.misc.comments | Comment information provided in the log message | keyword | -| rsa.misc.comp_class | | keyword | -| rsa.misc.comp_name | | keyword | -| rsa.misc.comp_rbytes | | keyword | -| rsa.misc.comp_sbytes | | keyword | -| rsa.misc.comp_version | This key captures the Version level of a sub-component of a product. | keyword | -| rsa.misc.connection_id | This key captures the Connection ID | keyword | -| rsa.misc.content | This key captures the content type from protocol headers | keyword | -| rsa.misc.content_type | This key is used to capture Content Type only. | keyword | -| rsa.misc.content_version | This key captures Version level of a signature or database content. | keyword | -| rsa.misc.context | This key captures Information which adds additional context to the event. | keyword | -| rsa.misc.context_subject | This key is to be used in an audit context where the subject is the object being identified | keyword | -| rsa.misc.context_target | | keyword | -| rsa.misc.count | | keyword | -| rsa.misc.cpu | This key is the CPU time used in the execution of the event being recorded. | long | -| rsa.misc.cpu_data | | keyword | -| rsa.misc.criticality | | keyword | -| rsa.misc.cs_agency_dst | | keyword | -| rsa.misc.cs_analyzedby | | keyword | -| rsa.misc.cs_av_other | | keyword | -| rsa.misc.cs_av_primary | | keyword | -| rsa.misc.cs_av_secondary | | keyword | -| rsa.misc.cs_bgpv6nxthop | | keyword | -| rsa.misc.cs_bit9status | | keyword | -| rsa.misc.cs_context | | keyword | -| rsa.misc.cs_control | | keyword | -| rsa.misc.cs_data | | keyword | -| rsa.misc.cs_datecret | | keyword | -| rsa.misc.cs_dst_tld | | keyword | -| rsa.misc.cs_eth_dst_ven | | keyword | -| rsa.misc.cs_eth_src_ven | | keyword | -| rsa.misc.cs_event_uuid | | keyword | -| rsa.misc.cs_filetype | | keyword | -| rsa.misc.cs_fld | | keyword | -| rsa.misc.cs_if_desc | | keyword | -| rsa.misc.cs_if_name | | keyword | -| rsa.misc.cs_ip_next_hop | | keyword | -| rsa.misc.cs_ipv4dstpre | | keyword | -| rsa.misc.cs_ipv4srcpre | | keyword | -| rsa.misc.cs_lifetime | | keyword | -| rsa.misc.cs_log_medium | | keyword | -| rsa.misc.cs_loginname | | keyword | -| rsa.misc.cs_modulescore | | keyword | -| rsa.misc.cs_modulesign | | keyword | -| rsa.misc.cs_opswatresult | | keyword | -| rsa.misc.cs_payload | | keyword | -| rsa.misc.cs_registrant | | keyword | -| rsa.misc.cs_registrar | | keyword | -| rsa.misc.cs_represult | | keyword | -| rsa.misc.cs_rpayload | | keyword | -| rsa.misc.cs_sampler_name | | keyword | -| rsa.misc.cs_sourcemodule | | keyword | -| rsa.misc.cs_streams | | keyword | -| rsa.misc.cs_targetmodule | | keyword | -| rsa.misc.cs_v6nxthop | | keyword | -| rsa.misc.cs_whois_server | | keyword | -| rsa.misc.cs_yararesult | | keyword | -| rsa.misc.cve | This key captures CVE (Common Vulnerabilities and Exposures) - an identifier for known information security vulnerabilities. | keyword | -| rsa.misc.data_type | | keyword | -| rsa.misc.description | | keyword | -| rsa.misc.device_name | This is used to capture name of the Device associated with the node Like: a physical disk, printer, etc | keyword | -| rsa.misc.devvendor | | keyword | -| rsa.misc.disposition | This key captures the The end state of an action. | keyword | -| rsa.misc.distance | | keyword | -| rsa.misc.doc_number | This key captures File Identification number | long | -| rsa.misc.dstburb | | keyword | -| rsa.misc.edomain | | keyword | -| rsa.misc.edomaub | | keyword | -| rsa.misc.ein_number | Employee Identification Numbers only | long | -| rsa.misc.error | This key captures All non successful Error codes or responses | keyword | -| rsa.misc.euid | | keyword | -| rsa.misc.event_category | | keyword | -| rsa.misc.event_computer | This key is a windows only concept, where this key is used to capture fully qualified domain name in a windows log. | keyword | -| rsa.misc.event_desc | This key is used to capture a description of an event available directly or inferred | keyword | -| rsa.misc.event_id | | keyword | -| rsa.misc.event_log | This key captures the Name of the event log | keyword | -| rsa.misc.event_source | This key captures Source of the event that’s not a hostname | keyword | -| rsa.misc.event_state | This key captures the current state of the object/item referenced within the event. Describing an on-going event. | keyword | -| rsa.misc.event_type | This key captures the event category type as specified by the event source. | keyword | -| rsa.misc.event_user | This key is a windows only concept, where this key is used to capture combination of domain name and username in a windows log. | keyword | -| rsa.misc.expected_val | This key captures the Value expected (from the perspective of the device generating the log). | keyword | -| rsa.misc.facility | | keyword | -| rsa.misc.facilityname | | keyword | -| rsa.misc.fcatnum | This key captures Filter Category Number. Legacy Usage | keyword | -| rsa.misc.filter | This key captures Filter used to reduce result set | keyword | -| rsa.misc.finterface | | keyword | -| rsa.misc.flags | | keyword | -| rsa.misc.forensic_info | | keyword | -| rsa.misc.found | This is used to capture the results of regex match | keyword | -| rsa.misc.fresult | This key captures the Filter Result | long | -| rsa.misc.gaddr | | keyword | -| rsa.misc.group | This key captures the Group Name value | keyword | -| rsa.misc.group_id | This key captures Group ID Number (related to the group name) | keyword | -| rsa.misc.group_object | This key captures a collection/grouping of entities. Specific usage | keyword | -| rsa.misc.hardware_id | This key is used to capture unique identifier for a device or system (NOT a Mac address) | keyword | -| rsa.misc.id3 | | keyword | -| rsa.misc.im_buddyid | | keyword | -| rsa.misc.im_buddyname | | keyword | -| rsa.misc.im_client | | keyword | -| rsa.misc.im_croomid | | keyword | -| rsa.misc.im_croomtype | | keyword | -| rsa.misc.im_members | | keyword | -| rsa.misc.im_userid | | keyword | -| rsa.misc.im_username | | keyword | -| rsa.misc.index | | keyword | -| rsa.misc.inout | | keyword | -| rsa.misc.ipkt | | keyword | -| rsa.misc.ipscat | | keyword | -| rsa.misc.ipspri | | keyword | -| rsa.misc.job_num | This key captures the Job Number | keyword | -| rsa.misc.jobname | | keyword | -| rsa.misc.language | This is used to capture list of languages the client support and what it prefers | keyword | -| rsa.misc.latitude | | keyword | -| rsa.misc.library | This key is used to capture library information in mainframe devices | keyword | -| rsa.misc.lifetime | This key is used to capture the session lifetime in seconds. | long | -| rsa.misc.linenum | | keyword | -| rsa.misc.link | This key is used to link the sessions together. This key should never be used to parse Meta data from a session (Logs/Packets) Directly, this is a Reserved key in NetWitness | keyword | -| rsa.misc.list_name | | keyword | -| rsa.misc.listnum | This key is used to capture listname or listnumber, primarily for collecting access-list | keyword | -| rsa.misc.load_data | | keyword | -| rsa.misc.location_floor | | keyword | -| rsa.misc.location_mark | | keyword | -| rsa.misc.log_id | | keyword | -| rsa.misc.log_session_id | This key is used to capture a sessionid from the session directly | keyword | -| rsa.misc.log_session_id1 | This key is used to capture a Linked (Related) Session ID from the session directly | keyword | -| rsa.misc.log_type | | keyword | -| rsa.misc.logid | | keyword | -| rsa.misc.logip | | keyword | -| rsa.misc.logname | | keyword | -| rsa.misc.longitude | | keyword | -| rsa.misc.lport | | keyword | -| rsa.misc.mail_id | This key is used to capture the mailbox id/name | keyword | -| rsa.misc.match | This key is for regex match name from search.ini | keyword | -| rsa.misc.mbug_data | | keyword | -| rsa.misc.message_body | This key captures the The contents of the message body. | keyword | -| rsa.misc.misc | | keyword | -| rsa.misc.misc_name | | keyword | -| rsa.misc.mode | | keyword | -| rsa.misc.msgIdPart1 | | keyword | -| rsa.misc.msgIdPart2 | | keyword | -| rsa.misc.msgIdPart3 | | keyword | -| rsa.misc.msgIdPart4 | | keyword | -| rsa.misc.msg_type | | keyword | -| rsa.misc.msgid | | keyword | -| rsa.misc.name | | keyword | -| rsa.misc.netsessid | | keyword | -| rsa.misc.node | Common use case is the node name within a cluster. The cluster name is reflected by the host name. | keyword | -| rsa.misc.ntype | | keyword | -| rsa.misc.num | | keyword | -| rsa.misc.number | | keyword | -| rsa.misc.number1 | | keyword | -| rsa.misc.number2 | | keyword | -| rsa.misc.nwwn | | keyword | -| rsa.misc.obj_name | This is used to capture name of object | keyword | -| rsa.misc.obj_type | This is used to capture type of object | keyword | -| rsa.misc.object | | keyword | -| rsa.misc.observed_val | This key captures the Value observed (from the perspective of the device generating the log). | keyword | -| rsa.misc.operation | | keyword | -| rsa.misc.operation_id | An alert number or operation number. The values should be unique and non-repeating. | keyword | -| rsa.misc.opkt | | keyword | -| rsa.misc.orig_from | | keyword | -| rsa.misc.owner_id | | keyword | -| rsa.misc.p_action | | keyword | -| rsa.misc.p_filter | | keyword | -| rsa.misc.p_group_object | | keyword | -| rsa.misc.p_id | | keyword | -| rsa.misc.p_msgid | | keyword | -| rsa.misc.p_msgid1 | | keyword | -| rsa.misc.p_msgid2 | | keyword | -| rsa.misc.p_result1 | | keyword | -| rsa.misc.param | This key is the parameters passed as part of a command or application, etc. | keyword | -| rsa.misc.param_dst | This key captures the command line/launch argument of the target process or file | keyword | -| rsa.misc.param_src | This key captures source parameter | keyword | -| rsa.misc.parent_node | This key captures the Parent Node Name. Must be related to node variable. | keyword | -| rsa.misc.password_chg | | keyword | -| rsa.misc.password_expire | | keyword | -| rsa.misc.payload_dst | This key is used to capture destination payload | keyword | -| rsa.misc.payload_src | This key is used to capture source payload | keyword | -| rsa.misc.permgranted | | keyword | -| rsa.misc.permwanted | | keyword | -| rsa.misc.pgid | | keyword | -| rsa.misc.phone | | keyword | -| rsa.misc.pid | | keyword | -| rsa.misc.policy | | keyword | -| rsa.misc.policyUUID | | keyword | -| rsa.misc.policy_id | This key is used to capture the Policy ID only, this should be a numeric value, use policy.name otherwise | keyword | -| rsa.misc.policy_name | This key is used to capture the Policy Name only. | keyword | -| rsa.misc.policy_value | This key captures the contents of the policy. This contains details about the policy | keyword | -| rsa.misc.policy_waiver | | keyword | -| rsa.misc.pool_id | This key captures the identifier (typically numeric field) of a resource pool | keyword | -| rsa.misc.pool_name | This key captures the name of a resource pool | keyword | -| rsa.misc.port_name | This key is used for Physical or logical port connection but does NOT include a network port. (Example: Printer port name). | keyword | -| rsa.misc.priority | | keyword | -| rsa.misc.process_id_val | This key is a failure key for Process ID when it is not an integer value | keyword | -| rsa.misc.prog_asp_num | | keyword | -| rsa.misc.program | | keyword | -| rsa.misc.real_data | | keyword | -| rsa.misc.reason | | keyword | -| rsa.misc.rec_asp_device | | keyword | -| rsa.misc.rec_asp_num | | keyword | -| rsa.misc.rec_library | | keyword | -| rsa.misc.recordnum | | keyword | -| rsa.misc.reference_id | This key is used to capture an event id from the session directly | keyword | -| rsa.misc.reference_id1 | This key is for Linked ID to be used as an addition to "reference.id" | keyword | -| rsa.misc.reference_id2 | This key is for the 2nd Linked ID. Can be either linked to "reference.id" or "reference.id1" value but should not be used unless the other two variables are in play. | keyword | -| rsa.misc.result | This key is used to capture the outcome/result string value of an action in a session. | keyword | -| rsa.misc.result_code | This key is used to capture the outcome/result numeric value of an action in a session | keyword | -| rsa.misc.risk | This key captures the non-numeric risk value | keyword | -| rsa.misc.risk_info | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_num | This key captures a Numeric Risk value | double | -| rsa.misc.risk_num_comm | This key captures Risk Number Community | double | -| rsa.misc.risk_num_next | This key captures Risk Number NextGen | double | -| rsa.misc.risk_num_sand | This key captures Risk Number SandBox | double | -| rsa.misc.risk_num_static | This key captures Risk Number Static | double | -| rsa.misc.risk_suspicious | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.risk_warning | Deprecated, use New Hunting Model (inv.\*, ioc, boc, eoc, analysis.\*) | keyword | -| rsa.misc.ruid | | keyword | -| rsa.misc.rule | This key captures the Rule number | keyword | -| rsa.misc.rule_group | This key captures the Rule group name | keyword | -| rsa.misc.rule_name | This key captures the Rule Name | keyword | -| rsa.misc.rule_template | A default set of parameters which are overlayed onto a rule (or rulename) which efffectively constitutes a template | keyword | -| rsa.misc.rule_uid | This key is the Unique Identifier for a rule. | keyword | -| rsa.misc.sburb | | keyword | -| rsa.misc.sdomain_fld | | keyword | -| rsa.misc.search_text | This key captures the Search Text used | keyword | -| rsa.misc.sec | | keyword | -| rsa.misc.second | | keyword | -| rsa.misc.sensor | This key captures Name of the sensor. Typically used in IDS/IPS based devices | keyword | -| rsa.misc.sensorname | | keyword | -| rsa.misc.seqnum | | keyword | -| rsa.misc.serial_number | This key is the Serial number associated with a physical asset. | keyword | -| rsa.misc.session | | keyword | -| rsa.misc.sessiontype | | keyword | -| rsa.misc.severity | This key is used to capture the severity given the session | keyword | -| rsa.misc.sigUUID | | keyword | -| rsa.misc.sig_id | This key captures IDS/IPS Int Signature ID | long | -| rsa.misc.sig_id1 | This key captures IDS/IPS Int Signature ID. This must be linked to the sig.id | long | -| rsa.misc.sig_id_str | This key captures a string object of the sigid variable. | keyword | -| rsa.misc.sig_name | This key is used to capture the Signature Name only. | keyword | -| rsa.misc.sigcat | | keyword | -| rsa.misc.snmp_oid | SNMP Object Identifier | keyword | -| rsa.misc.snmp_value | SNMP set request value | keyword | -| rsa.misc.space | | keyword | -| rsa.misc.space1 | | keyword | -| rsa.misc.spi | | keyword | -| rsa.misc.spi_dst | Destination SPI Index | keyword | -| rsa.misc.spi_src | Source SPI Index | keyword | -| rsa.misc.sql | This key captures the SQL query | keyword | -| rsa.misc.srcburb | | keyword | -| rsa.misc.srcdom | | keyword | -| rsa.misc.srcservice | | keyword | -| rsa.misc.state | | keyword | -| rsa.misc.status | | keyword | -| rsa.misc.status1 | | keyword | -| rsa.misc.streams | This key captures number of streams in session | long | -| rsa.misc.subcategory | | keyword | -| rsa.misc.svcno | | keyword | -| rsa.misc.system | | keyword | -| rsa.misc.tbdstr1 | | keyword | -| rsa.misc.tbdstr2 | | keyword | -| rsa.misc.tcp_flags | This key is captures the TCP flags set in any packet of session | long | -| rsa.misc.terminal | This key captures the Terminal Names only | keyword | -| rsa.misc.tgtdom | | keyword | -| rsa.misc.tgtdomain | | keyword | -| rsa.misc.threshold | | keyword | -| rsa.misc.tos | This key describes the type of service | long | -| rsa.misc.trigger_desc | This key captures the Description of the trigger or threshold condition. | keyword | -| rsa.misc.trigger_val | This key captures the Value of the trigger or threshold condition. | keyword | -| rsa.misc.type | | keyword | -| rsa.misc.type1 | | keyword | -| rsa.misc.udb_class | | keyword | -| rsa.misc.url_fld | | keyword | -| rsa.misc.user_div | | keyword | -| rsa.misc.userid | | keyword | -| rsa.misc.username_fld | | keyword | -| rsa.misc.utcstamp | | keyword | -| rsa.misc.v_instafname | | keyword | -| rsa.misc.version | This key captures Version of the application or OS which is generating the event. | keyword | -| rsa.misc.virt_data | | keyword | -| rsa.misc.virusname | This key captures the name of the virus | keyword | -| rsa.misc.vm_target | VMWare Target \*\*VMWARE\*\* only varaible. | keyword | -| rsa.misc.vpnid | | keyword | -| rsa.misc.vsys | This key captures Virtual System Name | keyword | -| rsa.misc.vuln_ref | This key captures the Vulnerability Reference details | keyword | -| rsa.misc.workspace | This key captures Workspace Description | keyword | -| rsa.network.ad_computer_dst | Deprecated, use host.dst | keyword | -| rsa.network.addr | | keyword | -| rsa.network.alias_host | This key should be used when the source or destination context of a hostname is not clear.Also it captures the Device Hostname. Any Hostname that isnt ad.computer. | keyword | -| rsa.network.dinterface | This key should only be used when it’s a Destination Interface | keyword | -| rsa.network.dmask | This key is used for Destionation Device network mask | keyword | -| rsa.network.dns_a_record | | keyword | -| rsa.network.dns_cname_record | | keyword | -| rsa.network.dns_id | | keyword | -| rsa.network.dns_opcode | | keyword | -| rsa.network.dns_ptr_record | | keyword | -| rsa.network.dns_resp | | keyword | -| rsa.network.dns_type | | keyword | -| rsa.network.domain | | keyword | -| rsa.network.domain1 | | keyword | -| rsa.network.eth_host | Deprecated, use alias.mac | keyword | -| rsa.network.eth_type | This key is used to capture Ethernet Type, Used for Layer 3 Protocols Only | long | -| rsa.network.faddr | | keyword | -| rsa.network.fhost | | keyword | -| rsa.network.fport | | keyword | -| rsa.network.gateway | This key is used to capture the IP Address of the gateway | keyword | -| rsa.network.host_dst | This key should only be used when it’s a Destination Hostname | keyword | -| rsa.network.host_orig | This is used to capture the original hostname in case of a Forwarding Agent or a Proxy in between. | keyword | -| rsa.network.host_type | | keyword | -| rsa.network.icmp_code | This key is used to capture the ICMP code only | long | -| rsa.network.icmp_type | This key is used to capture the ICMP type only | long | -| rsa.network.interface | This key should be used when the source or destination context of an interface is not clear | keyword | -| rsa.network.ip_proto | This key should be used to capture the Protocol number, all the protocol nubers are converted into string in UI | long | -| rsa.network.laddr | | keyword | -| rsa.network.lhost | | keyword | -| rsa.network.linterface | | keyword | -| rsa.network.mask | This key is used to capture the device network IPmask. | keyword | -| rsa.network.netname | This key is used to capture the network name associated with an IP range. This is configured by the end user. | keyword | -| rsa.network.network_port | Deprecated, use port. NOTE: There is a type discrepancy as currently used, TM: Int32, INDEX: UInt64 (why neither chose the correct UInt16?!) | long | -| rsa.network.network_service | This is used to capture layer 7 protocols/service names | keyword | -| rsa.network.origin | | keyword | -| rsa.network.packet_length | | keyword | -| rsa.network.paddr | Deprecated | ip | -| rsa.network.phost | | keyword | -| rsa.network.port | This key should only be used to capture a Network Port when the directionality is not clear | long | -| rsa.network.protocol_detail | This key should be used to capture additional protocol information | keyword | -| rsa.network.remote_domain_id | | keyword | -| rsa.network.rpayload | This key is used to capture the total number of payload bytes seen in the retransmitted packets. | keyword | -| rsa.network.sinterface | This key should only be used when it’s a Source Interface | keyword | -| rsa.network.smask | This key is used for capturing source Network Mask | keyword | -| rsa.network.vlan | This key should only be used to capture the ID of the Virtual LAN | long | -| rsa.network.vlan_name | This key should only be used to capture the name of the Virtual LAN | keyword | -| rsa.network.zone | This key should be used when the source or destination context of a Zone is not clear | keyword | -| rsa.network.zone_dst | This key should only be used when it’s a Destination Zone. | keyword | -| rsa.network.zone_src | This key should only be used when it’s a Source Zone. | keyword | -| rsa.physical.org_dst | This is used to capture the destination organization based on the GEOPIP Maxmind database. | keyword | -| rsa.physical.org_src | This is used to capture the source organization based on the GEOPIP Maxmind database. | keyword | -| rsa.storage.disk_volume | A unique name assigned to logical units (volumes) within a physical disk | keyword | -| rsa.storage.lun | Logical Unit Number.This key is a very useful concept in Storage. | keyword | -| rsa.storage.pwwn | This uniquely identifies a port on a HBA. | keyword | -| rsa.threat.alert | This key is used to capture name of the alert | keyword | -| rsa.threat.threat_category | This key captures Threat Name/Threat Category/Categorization of alert | keyword | -| rsa.threat.threat_desc | This key is used to capture the threat description from the session directly or inferred | keyword | -| rsa.threat.threat_source | This key is used to capture source of the threat | keyword | -| rsa.time.date | | keyword | -| rsa.time.datetime | | keyword | -| rsa.time.day | | keyword | -| rsa.time.duration_str | A text string version of the duration | keyword | -| rsa.time.duration_time | This key is used to capture the normalized duration/lifetime in seconds. | double | -| rsa.time.effective_time | This key is the effective time referenced by an individual event in a Standard Timestamp format | date | -| rsa.time.endtime | This key is used to capture the End time mentioned in a session in a standard form | date | -| rsa.time.event_queue_time | This key is the Time that the event was queued. | date | -| rsa.time.event_time | This key is used to capture the time mentioned in a raw session that represents the actual time an event occured in a standard normalized form | date | -| rsa.time.event_time_str | This key is used to capture the incomplete time mentioned in a session as a string | keyword | -| rsa.time.eventtime | | keyword | -| rsa.time.expire_time | This key is the timestamp that explicitly refers to an expiration. | date | -| rsa.time.expire_time_str | This key is used to capture incomplete timestamp that explicitly refers to an expiration. | keyword | -| rsa.time.gmtdate | | keyword | -| rsa.time.gmttime | | keyword | -| rsa.time.hour | | keyword | -| rsa.time.min | | keyword | -| rsa.time.month | | keyword | -| rsa.time.p_date | | keyword | -| rsa.time.p_month | | keyword | -| rsa.time.p_time | | keyword | -| rsa.time.p_time1 | | keyword | -| rsa.time.p_time2 | | keyword | -| rsa.time.p_year | | keyword | -| rsa.time.process_time | Deprecated, use duration.time | keyword | -| rsa.time.recorded_time | The event time as recorded by the system the event is collected from. The usage scenario is a multi-tier application where the management layer of the system records it's own timestamp at the time of collection from its child nodes. Must be in timestamp format. | date | -| rsa.time.stamp | Deprecated key defined only in table map. | date | -| rsa.time.starttime | This key is used to capture the Start time mentioned in a session in a standard form | date | -| rsa.time.timestamp | | keyword | -| rsa.time.timezone | This key is used to capture the timezone of the Event Time | keyword | -| rsa.time.tzone | | keyword | -| rsa.time.year | | keyword | -| rsa.web.alias_host | | keyword | -| rsa.web.cn_asn_dst | | keyword | -| rsa.web.cn_rpackets | | keyword | -| rsa.web.fqdn | Fully Qualified Domain Names | keyword | -| rsa.web.p_url | | keyword | -| rsa.web.p_user_agent | | keyword | -| rsa.web.p_web_cookie | | keyword | -| rsa.web.p_web_method | | keyword | -| rsa.web.p_web_referer | | keyword | -| rsa.web.remote_domain | | keyword | -| rsa.web.reputation_num | Reputation Number of an entity. Typically used for Web Domains | double | -| rsa.web.urlpage | | keyword | -| rsa.web.urlroot | | keyword | -| rsa.web.web_cookie | This key is used to capture the Web cookies specifically. | keyword | -| rsa.web.web_extension_tmp | | keyword | -| rsa.web.web_page | | keyword | -| rsa.web.web_ref_domain | Web referer's domain | keyword | -| rsa.web.web_ref_page | This key captures Web referer's page information | keyword | -| rsa.web.web_ref_query | This key captures Web referer's query portion of the URL | keyword | -| rsa.web.web_ref_root | Web referer's root URL path | keyword | -| rsa.wireless.access_point | This key is used to capture the access point name. | keyword | -| rsa.wireless.wlan_channel | This is used to capture the channel names | long | -| rsa.wireless.wlan_name | This key captures either WLAN number/name | keyword | -| rsa.wireless.wlan_ssid | This key is used to capture the ssid of a Wireless Session | keyword | -| rule.name | The name of the rule or signature generating the event. | keyword | -| server.domain | The domain name of the server system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | -| server.registered_domain | The highest registered server domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| server.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| server.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | -| source.address | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | +| server.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | +| server.as.organization.name | Organization name. | keyword | +| server.as.organization.name.text | Multi-field of `server.as.organization.name`. | match_only_text | +| server.geo.city_name | City name. | keyword | +| server.geo.continent_name | Name of the continent. | keyword | +| server.geo.country_iso_code | Country ISO code. | keyword | +| server.geo.country_name | Country name. | keyword | +| server.geo.location | Longitude and latitude. | geo_point | +| server.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| server.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| server.geo.region_iso_code | Region ISO code. | keyword | +| server.geo.region_name | Region name. | keyword | +| server.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | +| server.ip | IP address of the server (IPv4 or IPv6). | ip | +| server.port | Port of the server. | long | +| sophos.utm.action | Event action. | keyword | +| sophos.utm.ad_domain | | keyword | +| sophos.utm.app_id | Application ID. | keyword | +| sophos.utm.aptptime | | long | +| sophos.utm.auth | Auth ID. | keyword | +| sophos.utm.authtime | Authorization time. | long | +| sophos.utm.avscantime | AntiVirus scan time. | long | +| sophos.utm.cached | Cached bytes. | keyword | +| sophos.utm.category | Array of category IDs. | keyword | +| sophos.utm.categoryname | Array of category names. | keyword | +| sophos.utm.cattime | | long | +| sophos.utm.client.hostname | Client hostname in DHCP events. | keyword | +| sophos.utm.code | Code ID. | keyword | +| sophos.utm.content_type | HTTP header content-type. | keyword | +| sophos.utm.country | HTTP request country source. | keyword | +| sophos.utm.dnstime | DNS time. | long | +| sophos.utm.exceptions | | keyword | +| sophos.utm.extension | URL extension. | keyword | +| sophos.utm.filteraction | Filter action. | keyword | +| sophos.utm.fullreqtime | Full HTTP request time. | long | +| sophos.utm.function | The failed function in case of error. | keyword | +| sophos.utm.id | Packet Filter rule ID. | keyword | +| sophos.utm.length | Packet length in bytes. | long | +| sophos.utm.line | The failed line in case of error. | keyword | +| sophos.utm.mark | The Netfilter conntrack mark. | keyword | +| sophos.utm.name | Event description. | keyword | +| sophos.utm.overridecategory | | keyword | +| sophos.utm.overridereputation | | keyword | +| sophos.utm.prec | | keyword | +| sophos.utm.profile | HTTP profile. | keyword | +| sophos.utm.reason | | keyword | +| sophos.utm.reputation | | keyword | +| sophos.utm.router.ip | DHCP router IP. | ip | +| sophos.utm.sandbox | | keyword | +| sophos.utm.severity | Event severity. | keyword | +| sophos.utm.socket | Socket where DHCP server is listening. | keyword | +| sophos.utm.sub | | keyword | +| sophos.utm.subnet | Subnet where DHCP server is listening. | keyword | +| sophos.utm.sys | System name. | keyword | +| sophos.utm.tcpflags | TCP flags set in any packet of session. | keyword | +| sophos.utm.tos | Type of Service. | keyword | +| sophos.utm.ttl | Time to Live. | long | +| sophos.utm.type | Type ID. | keyword | +| sophos.utm.url | HTTP request URL. | keyword | | source.as.number | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | long | | source.as.organization.name | Organization name. | keyword | | source.as.organization.name.text | Multi-field of `source.as.organization.name`. | match_only_text | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.domain | The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | keyword | | source.geo.city_name | City name. | keyword | +| source.geo.continent_name | Name of the continent. | keyword | +| source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.name | User-defined description of a location, at the level of granularity they care about. Could be the name of their data centers, the floor number, if this describes a local physical entity, city names. Not typically used in automated geolocation. | keyword | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | +| source.geo.region_iso_code | Region ISO code. | keyword | +| source.geo.region_name | Region name. | keyword | +| source.geo.timezone | The time zone of the location, such as IANA time zone name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | | source.mac | MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| source.nat.ip | Translated ip of source based NAT sessions (e.g. internal client to internet) Typically connections traversing load balancers, firewalls, or routers. | ip | -| source.nat.port | Translated port of source based NAT sessions. (e.g. internal client to internet) Typically used with load balancers, firewalls, or routers. | long | | source.port | Port of the source. | long | -| source.registered_domain | The highest registered source domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | -| source.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| source.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | | tags | List of keywords used to tag each event. | keyword | | url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | +| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | +| url.full | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | wildcard | +| url.full.text | Multi-field of `url.full`. | match_only_text | | url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | | url.original.text | Multi-field of `url.original`. | match_only_text | +| url.password | Password of the request. | keyword | | url.path | Path of the request, such as "/search". | wildcard | +| url.port | Port of the request, such as 443. | long | | url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | | url.registered_domain | The highest registered url domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | +| url.subdomain | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain. In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain. For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | | url.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | -| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | -| user.full_name | User's full name, if available. | keyword | -| user.full_name.text | Multi-field of `user.full_name`. | match_only_text | -| user.id | Unique identifier of the user. | keyword | +| url.username | Username of the request. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | +| user_agent.device.name | Name of the device. | keyword | +| user_agent.name | Name of the user agent. | keyword | | user_agent.original | Unparsed user_agent string. | keyword | | user_agent.original.text | Multi-field of `user_agent.original`. | match_only_text | +| user_agent.os.full | Operating system name, including the version or code name. | keyword | +| user_agent.os.full.text | Multi-field of `user_agent.os.full`. | match_only_text | +| user_agent.os.name | Operating system name, without the version. | keyword | +| user_agent.os.name.text | Multi-field of `user_agent.os.name`. | match_only_text | +| user_agent.os.version | Operating system version as a raw string. | keyword | +| user_agent.version | Version of the user agent. | keyword | ### XG log @@ -850,11 +437,11 @@ An example event for `xg` looks as following: { "@timestamp": "2016-12-02T18:50:20.000Z", "agent": { - "ephemeral_id": "b1eb8b45-bca7-40b1-b2f4-9d5c87e449bc", - "id": "dee3c982-4bd2-4c06-b207-fe0ce9ef19c5", + "ephemeral_id": "12701a32-24a5-401a-a7f4-b8202e00f440", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.1.2" + "version": "8.8.1" }, "data_stream": { "dataset": "sophos.xg", @@ -862,12 +449,12 @@ An example event for `xg` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "dee3c982-4bd2-4c06-b207-fe0ce9ef19c5", + "id": "533bdb32-d7d6-482e-a4ee-22a7c8ba474c", "snapshot": false, - "version": "8.1.2" + "version": "8.8.1" }, "event": { "action": "alert", @@ -877,22 +464,22 @@ An example event for `xg` looks as following: ], "code": "16010", "dataset": "sophos.xg", - "ingested": "2022-04-20T20:13:02Z", + "ingested": "2023-07-20T08:39:24Z", "kind": "event", "outcome": "success", "severity": 1, - "timezone": "+00:00" + "timezone": "GMT" }, "host": { "name": "XG230" }, "input": { - "type": "udp" + "type": "tcp" }, "log": { "level": "alert", "source": { - "address": "172.31.0.8:48162" + "address": "172.31.0.4:59318" } }, "observer": { @@ -925,6 +512,7 @@ An example event for `xg` looks as following: "log_subtype": "Alert", "log_type": "Content Filtering", "site_category": "Information Technology", + "timezone": "GMT", "transaction_id": "e4a127f7-a850-477c-920e-a471b38727c1", "user": "gi123456", "website": "ta-web-static-testing.qa. astaro.de" @@ -989,14 +577,14 @@ An example event for `xg` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.hash | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -1004,7 +592,7 @@ An example event for `xg` looks as following: | event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | | event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | diff --git a/packages/sophos/img/sophos-utm-dhcp.png b/packages/sophos/img/sophos-utm-dhcp.png new file mode 100644 index 00000000000..c36ba29d8f0 Binary files /dev/null and b/packages/sophos/img/sophos-utm-dhcp.png differ diff --git a/packages/sophos/img/sophos-utm-http.png b/packages/sophos/img/sophos-utm-http.png new file mode 100644 index 00000000000..1fc9141eae9 Binary files /dev/null and b/packages/sophos/img/sophos-utm-http.png differ diff --git a/packages/sophos/img/sophos-utm-overview.png b/packages/sophos/img/sophos-utm-overview.png new file mode 100644 index 00000000000..586dbe2e20b Binary files /dev/null and b/packages/sophos/img/sophos-utm-overview.png differ diff --git a/packages/sophos/img/sophos-utm-packetfilter.png b/packages/sophos/img/sophos-utm-packetfilter.png new file mode 100644 index 00000000000..ca92f0db397 Binary files /dev/null and b/packages/sophos/img/sophos-utm-packetfilter.png differ diff --git a/packages/sophos/kibana/dashboard/sophos-13d06620-19af-11ee-982d-b1686976653f.json b/packages/sophos/kibana/dashboard/sophos-13d06620-19af-11ee-982d-b1686976653f.json new file mode 100644 index 00000000000..196b29e3004 --- /dev/null +++ b/packages/sophos/kibana/dashboard/sophos-13d06620-19af-11ee-982d-b1686976653f.json @@ -0,0 +1,2546 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"fb9844d7-1fad-410b-ba00-2bf51c05d963\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"id\":\"fb9844d7-1fad-410b-ba00-2bf51c05d963\",\"enhancements\":{}}},\"55a4f937-e18a-4443-8f2d-46a6f945d1b9\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"source.ip\",\"title\":\"Source IP\",\"id\":\"55a4f937-e18a-4443-8f2d-46a6f945d1b9\",\"enhancements\":{}}},\"8a262122-bceb-4a38-af74-f2a895b14e23\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"destination.ip\",\"title\":\"Destination IP\",\"id\":\"8a262122-bceb-4a38-af74-f2a895b14e23\",\"enhancements\":{}}},\"fbacbf87-2340-4beb-b9c8-11691cb4b5d8\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"source.geo.country_name\",\"title\":\"Source Country\",\"id\":\"fbacbf87-2340-4beb-b9c8-11691cb4b5d8\",\"enhancements\":{}}},\"f9c8855d-b44b-435c-8c85-86d872f4827d\":{\"order\":7,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"user.name\",\"childFieldName\":\"user.name.text\",\"title\":\"User Name\",\"id\":\"f9c8855d-b44b-435c-8c85-86d872f4827d\",\"enhancements\":{}}},\"66d145fc-cfcc-46cf-9bc7-8638e4931123\":{\"order\":6,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"event.action\",\"title\":\"Action\",\"id\":\"66d145fc-cfcc-46cf-9bc7-8638e4931123\",\"enhancements\":{}}},\"dcd330ae-eb98-44f6-922f-0c4bef4cef2d\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"destination.geo.country_name\",\"title\":\"Destination Country\",\"id\":\"dcd330ae-eb98-44f6-922f-0c4bef4cef2d\",\"enhancements\":{}}},\"ce38e885-2232-4fa4-b9f6-3925c3dceb66\":{\"order\":8,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"group.name\",\"title\":\"Group Name\",\"id\":\"ce38e885-2232-4fa4-b9f6-3925c3dceb66\",\"enhancements\":{}}},\"230fb68b-b0c9-42e9-af51-cd3196e79b04\":{\"order\":5,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.severity\",\"title\":\"Severity\",\"id\":\"230fb68b-b0c9-42e9-af51-cd3196e79b04\",\"enhancements\":{}}}}" + }, + "description": "HTTP events collected by Sophos UTM.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Sophos UTM**\n \n[Overview](/app/dashboards#/view/sophos-60a2c260-19ad-11ee-982d-b1686976653f) \n[DHCP](/app/dashboards#/view/sophos-55522ef0-19ad-11ee-982d-b1686976653f) \n**[HTTP](/app/dashboards#/view/sophos-13d06620-19af-11ee-982d-b1686976653f)** \n[Packet Filter](/app/dashboards#/view/sophos-14b92300-19b0-11ee-982d-b1686976653f)\n\n**Overview**\n\nThis dashboard provides information about the HTTP events collected by Sophos UTM.\n\n[**Integration Page**](/app/integrations/detail/sophos/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 23, + "i": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "title": "Table of contents", + "type": "visualization", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"985e7399-20df-464b-b6d5-880922106ffe\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"sourceDescriptor\":{\"geoField\":\"destination.geo.location\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"id\":\"9824e6a2-d62e-4ced-af30-d01211168ed2\",\"type\":\"ES_GEO_GRID\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}],\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":8,\"maxSize\":24,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"invert\":false}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelZoomRange\":{\"options\":{\"useLayerZoomRange\":true,\"minZoom\":0,\"maxZoom\":24}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"b808fd21-6e02-4fd2-aeee-29e99c36f03a\",\"label\":\"Destination\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[],\"disableTooltips\":false},{\"sourceDescriptor\":{\"geoField\":\"source.geo.location\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"id\":\"cb3a0a63-72cc-44f3-85ac-43b8ab67f15a\",\"type\":\"ES_GEO_GRID\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}],\"indexPatternRefName\":\"layer_2_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Blues\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":8,\"maxSize\":24,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelZoomRange\":{\"options\":{\"useLayerZoomRange\":true,\"minZoom\":0,\"maxZoom\":24}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"6f4f0d48-f93a-4ea5-ab91-e45617e7a5b2\",\"label\":\"Source\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[],\"disableTooltips\":false}]", + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1.58,\"center\":{\"lon\":24.69417,\"lat\":8.33423},\"timeFilters\":{\"from\":\"now-4y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"logs-*\",\"alias\":\"Sophos UTM dataset\",\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"data_stream.dataset\",\"params\":{\"query\":\"sophos.utm\"}},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"sophos.utm\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"index\":\"logs-*\",\"alias\":\"HTTP\",\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"http\"}},\"query\":{\"match_phrase\":{\"event.provider\":\"http\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "SSH failed login attempts source locations [Logs System]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": true, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 270, + "minLat": -66.51326, + "minLon": -270 + }, + "mapCenter": { + "lat": 8.33423, + "lon": 24.69417, + "zoom": 1.58 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 23, + "i": "99f81f9a-565f-4d20-a199-48604427bc1e", + "w": 41, + "x": 7, + "y": 0 + }, + "panelIndex": "99f81f9a-565f-4d20-a199-48604427bc1e", + "title": "[Sophos UTM] HTTP Top Traffic Countries", + "type": "map", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4446192c-81d2-401d-869c-7b2d63f71885", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "dfb71094-6485-4622-9f31-753f1c9e63ae", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "8df0ca0c-4cd6-490d-a829-3f553e8fc62f", + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d", + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + ], + "columns": { + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "sophos.utm.action : \"block\" " + }, + "isBucketed": false, + "label": "Denied Requests", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action : \"pass\" " + }, + "isBucketed": false, + "label": "Allowed Requests", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8df0ca0c-4cd6-490d-a829-3f553e8fc62f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "HTTP Requests", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "4446192c-81d2-401d-869c-7b2d63f71885", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "dfb71094-6485-4622-9f31-753f1c9e63ae", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d", + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "seriesType": "area", + "xAccessor": "8df0ca0c-4cd6-490d-a829-3f553e8fc62f", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "81650e11-a5cf-4575-9a32-b5c4c5a60d5d" + }, + { + "color": "#d36086", + "forAccessor": "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "09dc4444-5fc3-498b-b5e6-3dd668d872b9", + "w": 24, + "x": 0, + "y": 23 + }, + "panelIndex": "09dc4444-5fc3-498b-b5e6-3dd668d872b9", + "title": "[Sophos UTM] HTTP Requests over Time", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e08cdb88-c6bc-4647-ada5-04af882b5e82", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b8bfb6d3-f85a-4fca-9270-c65103bdefcb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": false, + "dataType": "number", + "isBucketed": true, + "label": "Top 10 values of http.response.status_code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "http.response.status_code" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "e08cdb88-c6bc-4647-ada5-04af882b5e82", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "b8bfb6d3-f85a-4fca-9270-c65103bdefcb", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "allowMultipleMetrics": false, + "categoryDisplay": "default", + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + ], + "secondaryGroups": [] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7317fde8-83e9-4331-a269-fd8b0d660190", + "w": 24, + "x": 24, + "y": 23 + }, + "panelIndex": "7317fde8-83e9-4331-a269-fd8b0d660190", + "title": "[Sophos UTM] Response Code of HTTP Requests", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "418301cd-033f-44dd-8f23-031c9ec470d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "331a7ad9-8776-4627-a378-c73bf3ed656d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": false, + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of event.action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "418301cd-033f-44dd-8f23-031c9ec470d9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "331a7ad9-8776-4627-a378-c73bf3ed656d", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "33dfb3fe-02cb-488b-98d0-955bf152a0e0", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "33dfb3fe-02cb-488b-98d0-955bf152a0e0", + "title": "[Sophos UTM] Action Over HTTP Requests", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f16a5b29-ec32-40be-b154-2b349e1c74ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "23ac7f06-04a2-4b7e-99fa-9fcead446452", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.severity" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "f16a5b29-ec32-40be-b154-2b349e1c74ba", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "23ac7f06-04a2-4b7e-99fa-9fcead446452", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4f397d41-83a2-4a3f-81d8-4283f4c8b6ef", + "w": 24, + "x": 24, + "y": 38 + }, + "panelIndex": "4f397d41-83a2-4a3f-81d8-4283f4c8b6ef", + "title": "[Sophos UTM] HTTP Events Severity", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e18d5842-d2c2-4514-870f-cb4fcf264873", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "346fe975-75f1-4280-a70b-e73e9d416113", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "HTTP Request Method", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 8 + }, + "scale": "ordinal", + "sourceField": "http.request.method" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "e18d5842-d2c2-4514-870f-cb4fcf264873", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "346fe975-75f1-4280-a70b-e73e9d416113", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": false, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "position": "top", + "seriesType": "bar", + "showGridlines": false, + "xAccessor": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + } + ], + "legend": { + "isVisible": false, + "position": "right", + "showSingleSeries": false + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "show", + "yTitle": "" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "052c962a-5a1a-4004-9aad-5abb40188c43", + "w": 24, + "x": 0, + "y": 53 + }, + "panelIndex": "052c962a-5a1a-4004-9aad-5abb40188c43", + "title": "[Sophos UTM] Top HTTP Request Methods", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00fb0610-8147-406f-957a-bfe89311dc31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50c8844b-ff85-4506-8a9d-5bf3ca8b716e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "00fb0610-8147-406f-957a-bfe89311dc31", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "50c8844b-ff85-4506-8a9d-5bf3ca8b716e", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "13bd07fb-b572-41bd-ae23-0d83f37849f9", + "w": 24, + "x": 0, + "y": 68 + }, + "panelIndex": "13bd07fb-b572-41bd-ae23-0d83f37849f9", + "title": "[Sophos UTM] Top Source IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "39747d27-fe78-4a24-9522-885746873d9e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fcb1b50a-128d-43d6-9237-46e5f38aefc1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "HTTP Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.name" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "39747d27-fe78-4a24-9522-885746873d9e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "fcb1b50a-128d-43d6-9237-46e5f38aefc1", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "45da4679-8b8a-4943-bd67-52a7a2b404c3", + "w": 24, + "x": 24, + "y": 53 + }, + "panelIndex": "45da4679-8b8a-4943-bd67-52a7a2b404c3", + "title": "[Sophos UTM] Top Action Name", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d498b36-1b89-4cdf-9759-9a52b83f462e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "02ca67ec-184d-4949-a6b9-df2c9fed6630", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "URL", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.original" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "4d498b36-1b89-4cdf-9759-9a52b83f462e", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "02ca67ec-184d-4949-a6b9-df2c9fed6630", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "700b9675-cfa6-48ae-9416-c48a717ad5a2", + "w": 24, + "x": 0, + "y": 83 + }, + "panelIndex": "700b9675-cfa6-48ae-9416-c48a717ad5a2", + "title": "[Sophos UTM] Top URLs", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33b7abc8-e5a3-4dfc-9518-f22625437661", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e7eed46-f4a2-473f-9073-63c6259410ad", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "33b7abc8-e5a3-4dfc-9518-f22625437661", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "0e7eed46-f4a2-473f-9073-63c6259410ad", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "2befc96b-282f-4d9f-96a8-db7bf1ae5b2b", + "w": 24, + "x": 24, + "y": 68 + }, + "panelIndex": "2befc96b-282f-4d9f-96a8-db7bf1ae5b2b", + "title": "[Sophos UTM] Top Destination IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d55e0936-8f15-47c2-9408-8b97c51c902b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "741a8abb-3e9c-4a10-92e2-ef3b3c0271c7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "b0ba4967-5504-4da8-9af9-169a8e9655b7X0", + "a5ba1941-bc66-4860-8436-0b7678d326e2", + "a5ba1941-bc66-4860-8436-0b7678d326e2X0", + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4", + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4X0" + ], + "columns": { + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "99th Percentile", + "operationType": "formula", + "params": { + "formula": "percentile(sophos.utm.fullreqtime, percentile=99)", + "isFormulaBroken": false + }, + "references": [ + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4X0" + ], + "scale": "ratio" + }, + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of 99th Percentile", + "operationType": "percentile", + "params": { + "percentile": 99 + }, + "scale": "ratio", + "sourceField": "sophos.utm.fullreqtime" + }, + "a5ba1941-bc66-4860-8436-0b7678d326e2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "95th Percentile", + "operationType": "formula", + "params": { + "formula": "percentile(sophos.utm.fullreqtime, percentile=95)", + "isFormulaBroken": false + }, + "references": [ + "a5ba1941-bc66-4860-8436-0b7678d326e2X0" + ], + "scale": "ratio" + }, + "a5ba1941-bc66-4860-8436-0b7678d326e2X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of 95th Percentile", + "operationType": "percentile", + "params": { + "percentile": 95 + }, + "scale": "ratio", + "sourceField": "sophos.utm.fullreqtime" + }, + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "75th Percentile", + "operationType": "formula", + "params": { + "formula": "percentile(sophos.utm.fullreqtime, percentile=75)", + "isFormulaBroken": false + }, + "references": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7X0" + ], + "scale": "ratio" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of 75th Percentile", + "operationType": "percentile", + "params": { + "percentile": 75 + }, + "scale": "ratio", + "sourceField": "sophos.utm.fullreqtime" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "d55e0936-8f15-47c2-9408-8b97c51c902b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "741a8abb-3e9c-4a10-92e2-ef3b3c0271c7", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "a5ba1941-bc66-4860-8436-0b7678d326e2", + "4d2c55d3-2069-41e9-a7cf-756d518b0dd4" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "seriesType": "line", + "xAccessor": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "yConfig": [ + { + "axisMode": "left", + "color": "#00a69b", + "forAccessor": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + }, + { + "axisMode": "left", + "color": "#57c17b", + "forAccessor": "a5ba1941-bc66-4860-8436-0b7678d326e2" + }, + { + "axisMode": "left", + "color": "#6f87d8", + "forAccessor": "4d2c55d3-2069-41e9-a7cf-756d518b0dd4" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yTitle": "HTTP Full Request Time" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "eebe0b50-51a7-4af2-91b7-98cff7c33f9c", + "w": 24, + "x": 0, + "y": 98 + }, + "panelIndex": "eebe0b50-51a7-4af2-91b7-98cff7c33f9c", + "title": "[Sophos UTM] Full Request Time", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9459490a-a507-4e9e-876d-f03e0f97c820", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9edfae7-ce87-4a9f-a564-41d989963532", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Agent", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user_agent.original" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "9459490a-a507-4e9e-876d-f03e0f97c820", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "b9edfae7-ce87-4a9f-a564-41d989963532", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "00efa07a-2aa0-43bd-aa7c-aa2289b65f5a", + "w": 24, + "x": 24, + "y": 83 + }, + "panelIndex": "00efa07a-2aa0-43bd-aa7c-aa2289b65f5a", + "title": "[Sophos UTM] Top User Agents", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1a6b1929-1c6d-4848-9152-edaccbeb1dbf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4be93c6f-4101-46bb-aa01-566042a25c75", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "HTTP Request Body Average (bytes)", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "bytes", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "http.request.bytes" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "1a6b1929-1c6d-4848-9152-edaccbeb1dbf", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "HTTP", + "disabled": false, + "index": "4be93c6f-4101-46bb-aa01-566042a25c75", + "key": "event.provider", + "negate": false, + "params": { + "query": "http" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "http" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "seriesType": "bar", + "xAccessor": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "849d33c6-ebde-46a3-8ff0-a1527dd8424f", + "w": 24, + "x": 24, + "y": 98 + }, + "panelIndex": "849d33c6-ebde-46a3-8ff0-a1527dd8424f", + "title": "[Sophos UTM] HTTP Requests Size Average over Time (Bytes)", + "type": "lens", + "version": "8.6.1" + } + ], + "timeRestore": false, + "title": "[Sophos UTM] HTTP events", + "version": 1 + }, + "coreMigrationVersion": "8.6.1", + "created_at": "2023-07-14T16:16:22.846Z", + "id": "sophos-13d06620-19af-11ee-982d-b1686976653f", + "migrationVersion": { + "dashboard": "8.6.0" + }, + "references": [ + { + "id": "logs-*", + "name": "99f81f9a-565f-4d20-a199-48604427bc1e:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "99f81f9a-565f-4d20-a199-48604427bc1e:layer_2_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "09dc4444-5fc3-498b-b5e6-3dd668d872b9:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "09dc4444-5fc3-498b-b5e6-3dd668d872b9:4446192c-81d2-401d-869c-7b2d63f71885", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "09dc4444-5fc3-498b-b5e6-3dd668d872b9:dfb71094-6485-4622-9f31-753f1c9e63ae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7317fde8-83e9-4331-a269-fd8b0d660190:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7317fde8-83e9-4331-a269-fd8b0d660190:e08cdb88-c6bc-4647-ada5-04af882b5e82", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7317fde8-83e9-4331-a269-fd8b0d660190:b8bfb6d3-f85a-4fca-9270-c65103bdefcb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33dfb3fe-02cb-488b-98d0-955bf152a0e0:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33dfb3fe-02cb-488b-98d0-955bf152a0e0:418301cd-033f-44dd-8f23-031c9ec470d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "33dfb3fe-02cb-488b-98d0-955bf152a0e0:331a7ad9-8776-4627-a378-c73bf3ed656d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f397d41-83a2-4a3f-81d8-4283f4c8b6ef:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f397d41-83a2-4a3f-81d8-4283f4c8b6ef:f16a5b29-ec32-40be-b154-2b349e1c74ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4f397d41-83a2-4a3f-81d8-4283f4c8b6ef:23ac7f06-04a2-4b7e-99fa-9fcead446452", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "052c962a-5a1a-4004-9aad-5abb40188c43:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "052c962a-5a1a-4004-9aad-5abb40188c43:e18d5842-d2c2-4514-870f-cb4fcf264873", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "052c962a-5a1a-4004-9aad-5abb40188c43:346fe975-75f1-4280-a70b-e73e9d416113", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13bd07fb-b572-41bd-ae23-0d83f37849f9:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13bd07fb-b572-41bd-ae23-0d83f37849f9:00fb0610-8147-406f-957a-bfe89311dc31", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "13bd07fb-b572-41bd-ae23-0d83f37849f9:50c8844b-ff85-4506-8a9d-5bf3ca8b716e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45da4679-8b8a-4943-bd67-52a7a2b404c3:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45da4679-8b8a-4943-bd67-52a7a2b404c3:39747d27-fe78-4a24-9522-885746873d9e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "45da4679-8b8a-4943-bd67-52a7a2b404c3:fcb1b50a-128d-43d6-9237-46e5f38aefc1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "700b9675-cfa6-48ae-9416-c48a717ad5a2:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "700b9675-cfa6-48ae-9416-c48a717ad5a2:4d498b36-1b89-4cdf-9759-9a52b83f462e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "700b9675-cfa6-48ae-9416-c48a717ad5a2:02ca67ec-184d-4949-a6b9-df2c9fed6630", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2befc96b-282f-4d9f-96a8-db7bf1ae5b2b:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2befc96b-282f-4d9f-96a8-db7bf1ae5b2b:33b7abc8-e5a3-4dfc-9518-f22625437661", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2befc96b-282f-4d9f-96a8-db7bf1ae5b2b:0e7eed46-f4a2-473f-9073-63c6259410ad", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eebe0b50-51a7-4af2-91b7-98cff7c33f9c:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eebe0b50-51a7-4af2-91b7-98cff7c33f9c:d55e0936-8f15-47c2-9408-8b97c51c902b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "eebe0b50-51a7-4af2-91b7-98cff7c33f9c:741a8abb-3e9c-4a10-92e2-ef3b3c0271c7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00efa07a-2aa0-43bd-aa7c-aa2289b65f5a:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00efa07a-2aa0-43bd-aa7c-aa2289b65f5a:9459490a-a507-4e9e-876d-f03e0f97c820", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "00efa07a-2aa0-43bd-aa7c-aa2289b65f5a:b9edfae7-ce87-4a9f-a564-41d989963532", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "849d33c6-ebde-46a3-8ff0-a1527dd8424f:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "849d33c6-ebde-46a3-8ff0-a1527dd8424f:1a6b1929-1c6d-4848-9152-edaccbeb1dbf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "849d33c6-ebde-46a3-8ff0-a1527dd8424f:4be93c6f-4101-46bb-aa01-566042a25c75", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fb9844d7-1fad-410b-ba00-2bf51c05d963:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_55a4f937-e18a-4443-8f2d-46a6f945d1b9:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_8a262122-bceb-4a38-af74-f2a895b14e23:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fbacbf87-2340-4beb-b9c8-11691cb4b5d8:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f9c8855d-b44b-435c-8c85-86d872f4827d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_66d145fc-cfcc-46cf-9bc7-8638e4931123:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_dcd330ae-eb98-44f6-922f-0c4bef4cef2d:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ce38e885-2232-4fa4-b9f6-3925c3dceb66:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_230fb68b-b0c9-42e9-af51-cd3196e79b04:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/sophos/kibana/dashboard/sophos-14b92300-19b0-11ee-982d-b1686976653f.json b/packages/sophos/kibana/dashboard/sophos-14b92300-19b0-11ee-982d-b1686976653f.json new file mode 100644 index 00000000000..c6ad0401a1a --- /dev/null +++ b/packages/sophos/kibana/dashboard/sophos-14b92300-19b0-11ee-982d-b1686976653f.json @@ -0,0 +1,1864 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ec57f15e-764f-471e-8375-237fb4433630\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"id\":\"ec57f15e-764f-471e-8375-237fb4433630\",\"enhancements\":{}}},\"e8b103fc-956c-4bc6-841d-6708478a279a\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"source.ip\",\"title\":\"Source IP\",\"id\":\"e8b103fc-956c-4bc6-841d-6708478a279a\",\"enhancements\":{}}},\"5005e90e-b685-4496-b152-530fd1babf60\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"destination.ip\",\"title\":\"Destination IP\",\"id\":\"5005e90e-b685-4496-b152-530fd1babf60\",\"enhancements\":{}}},\"7851d8c2-4d82-414f-acc0-f4692752e8e5\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"source.geo.country_name\",\"title\":\"Source Country\",\"id\":\"7851d8c2-4d82-414f-acc0-f4692752e8e5\",\"enhancements\":{}}},\"71863581-cdd9-4afd-b709-b8ba9b728911\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"destination.geo.country_name\",\"title\":\"Destination Country\",\"id\":\"71863581-cdd9-4afd-b709-b8ba9b728911\",\"enhancements\":{}}},\"6dc67de2-a196-444a-8684-141f823ff2c6\":{\"order\":7,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rule.id\",\"title\":\"Rule ID\",\"id\":\"6dc67de2-a196-444a-8684-141f823ff2c6\",\"enhancements\":{}}},\"510b15b7-c29a-40e1-ba8e-9579c131cf6f\":{\"order\":5,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.severity\",\"title\":\"Severity\",\"id\":\"510b15b7-c29a-40e1-ba8e-9579c131cf6f\",\"enhancements\":{}}},\"fafb4971-3385-490b-98f4-78465e38949a\":{\"order\":6,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.name\",\"title\":\"Action name\",\"id\":\"fafb4971-3385-490b-98f4-78465e38949a\",\"enhancements\":{}}}}" + }, + "description": "Packet Filter events collected by Sophos UTM.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Sophos UTM**\n \n[Overview](/app/dashboards#/view/sophos-60a2c260-19ad-11ee-982d-b1686976653f) \n[DHCP](/app/dashboards#/view/sophos-55522ef0-19ad-11ee-982d-b1686976653f) \n[HTTP](/app/dashboards#/view/sophos-13d06620-19af-11ee-982d-b1686976653f) \n**[Packet Filter](/app/dashboards#/view/sophos-14b92300-19b0-11ee-982d-b1686976653f)**\n\n**Overview**\n\nThis dashboard provides information about the Packet Filter events collected by Sophos UTM.\n\n[**Integration Page**](/app/integrations/detail/sophos/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 23, + "i": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "w": 7, + "x": 0, + "y": 0 + }, + "panelIndex": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "title": "Table of contents", + "type": "visualization", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"985e7399-20df-464b-b6d5-880922106ffe\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"sourceDescriptor\":{\"geoField\":\"destination.geo.location\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"id\":\"9824e6a2-d62e-4ced-af30-d01211168ed2\",\"type\":\"ES_GEO_GRID\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}],\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\",\"useCustomColorRamp\":false}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":8,\"maxSize\":24,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"invert\":false}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelZoomRange\":{\"options\":{\"useLayerZoomRange\":true,\"minZoom\":0,\"maxZoom\":24}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"b808fd21-6e02-4fd2-aeee-29e99c36f03a\",\"label\":\"Destination\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[],\"disableTooltips\":false},{\"sourceDescriptor\":{\"geoField\":\"source.geo.location\",\"requestType\":\"point\",\"resolution\":\"FINE\",\"id\":\"cb3a0a63-72cc-44f3-85ac-43b8ab67f15a\",\"type\":\"ES_GEO_GRID\",\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"applyForceRefresh\":true,\"metrics\":[{\"type\":\"count\"}],\"indexPatternRefName\":\"layer_2_source_index_pattern\"},\"style\":{\"type\":\"VECTOR\",\"properties\":{\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}},\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"color\":\"Blues\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3},\"type\":\"ORDINAL\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":0}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"minSize\":8,\"maxSize\":24,\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":true,\"sigma\":3}}},\"iconOrientation\":{\"type\":\"STATIC\",\"options\":{\"orientation\":0}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"}}},\"labelColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#000000\"}},\"labelSize\":{\"type\":\"STATIC\",\"options\":{\"size\":14}},\"labelZoomRange\":{\"options\":{\"useLayerZoomRange\":true,\"minZoom\":0,\"maxZoom\":24}},\"labelBorderColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}}},\"isTimeAware\":true},\"id\":\"6f4f0d48-f93a-4ea5-ab91-e45617e7a5b2\",\"label\":\"Source\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.75,\"visible\":true,\"includeInFitToBounds\":true,\"type\":\"GEOJSON_VECTOR\",\"joins\":[],\"disableTooltips\":false}]", + "mapStateJSON": "{\"adHocDataViews\":[],\"zoom\":1.58,\"center\":{\"lon\":24.69417,\"lat\":8.33423},\"timeFilters\":{\"from\":\"now-4y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"logs-*\",\"alias\":\"Sophos UTM dataset\",\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"data_stream.dataset\",\"params\":{\"query\":\"sophos.utm\"}},\"query\":{\"match_phrase\":{\"data_stream.dataset\":\"sophos.utm\"}},\"$state\":{\"store\":\"appState\"}},{\"meta\":{\"index\":\"logs-*\",\"alias\":\"Packet Filter\",\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"event.provider\",\"params\":{\"query\":\"packetfilter\"}},\"query\":{\"match_phrase\":{\"event.provider\":\"packetfilter\"}},\"$state\":{\"store\":\"appState\"}}],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"customIcons\":[],\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"keydownScrollZoom\":false,\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "title": "SSH failed login attempts source locations [Logs System]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "hidePanelTitles": false, + "isLayerTOCOpen": true, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 270, + "minLat": -66.51326, + "minLon": -270 + }, + "mapCenter": { + "lat": 8.33423, + "lon": 24.69417, + "zoom": 1.58 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 23, + "i": "99f81f9a-565f-4d20-a199-48604427bc1e", + "w": 41, + "x": 7, + "y": 0 + }, + "panelIndex": "99f81f9a-565f-4d20-a199-48604427bc1e", + "title": "[Sophos UTM] Packet Filter Top Traffic Countries", + "type": "map", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7c95f6ba-769f-4c8a-a904-bdc6051622a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6770449b-9e66-4572-b203-cf528b0a3143", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "8df0ca0c-4cd6-490d-a829-3f553e8fc62f", + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d", + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + ], + "columns": { + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action : \"drop\" " + }, + "isBucketed": false, + "label": "Dropped Packets", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action : \"accept\" " + }, + "isBucketed": false, + "label": "Accepted Packets", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8df0ca0c-4cd6-490d-a829-3f553e8fc62f": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Packets", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "7c95f6ba-769f-4c8a-a904-bdc6051622a3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "6770449b-9e66-4572-b203-cf528b0a3143", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "81650e11-a5cf-4575-9a32-b5c4c5a60d5d", + "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "seriesType": "area", + "xAccessor": "8df0ca0c-4cd6-490d-a829-3f553e8fc62f", + "yConfig": [ + { + "color": "#6092c0", + "forAccessor": "81650e11-a5cf-4575-9a32-b5c4c5a60d5d" + }, + { + "color": "#d36086", + "forAccessor": "5097e0dd-06f8-4a5d-87f5-ca7971d6324a" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a60d5e8e-36c6-453d-aef9-c5a95f30c672", + "w": 24, + "x": 0, + "y": 23 + }, + "panelIndex": "a60d5e8e-36c6-453d-aef9-c5a95f30c672", + "title": "[Sophos UTM] Packet Filter Events over Time", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b3939934-aa2f-4834-9f89-c149865570a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "bc76f8d3-3441-4c19-8ee8-d4c0322006c6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.severity" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "b3939934-aa2f-4834-9f89-c149865570a3", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "bc76f8d3-3441-4c19-8ee8-d4c0322006c6", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "cd778397-453c-40b7-a3fe-88ec10a3551d", + "w": 12, + "x": 24, + "y": 23 + }, + "panelIndex": "cd778397-453c-40b7-a3fe-88ec10a3551d", + "title": "[Sophos UTM] Packet Filter Events Severity", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "db3682ff-2991-4f97-a4bb-ac28f9c0e21d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0b96c5c8-b83c-4187-a208-3145eba2187e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Packet Filter Action Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.name" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": false, + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "db3682ff-2991-4f97-a4bb-ac28f9c0e21d", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "0b96c5c8-b83c-4187-a208-3145eba2187e", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "4d3afb0a-e1ac-4a44-81e6-87a3486bca86", + "w": 12, + "x": 36, + "y": 23 + }, + "panelIndex": "4d3afb0a-e1ac-4a44-81e6-87a3486bca86", + "title": "[Sophos UTM] Packet Filter Actions", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7eeb3d1e-dd96-487a-9869-946c26d21bbe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f88a01e3-0f61-4429-9999-c7b07bafbac3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packet Length Average", + "operationType": "average", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 2 + } + } + }, + "scale": "ratio", + "sourceField": "sophos.utm.length" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "7eeb3d1e-dd96-487a-9869-946c26d21bbe", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "f88a01e3-0f61-4429-9999-c7b07bafbac3", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "seriesType": "bar", + "xAccessor": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a7a48acf-5f4d-410d-b99e-b56ece742e41", + "w": 24, + "x": 0, + "y": 38 + }, + "panelIndex": "a7a48acf-5f4d-410d-b99e-b56ece742e41", + "title": "[Sophos UTM] Packet Length Over Time", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "04ab66b2-2f8a-4b4a-af09-d572b2e50a78", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49ae2b73-3889-422a-8893-9ed529e9f037", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_name" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "04ab66b2-2f8a-4b4a-af09-d572b2e50a78", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "49ae2b73-3889-422a-8893-9ed529e9f037", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "53f1584c-65ea-45e1-9148-f5f030bc33a9", + "w": 24, + "x": 24, + "y": 38 + }, + "panelIndex": "53f1584c-65ea-45e1-9148-f5f030bc33a9", + "title": "[Sophos UTM] Top Source Countries", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "65b39c90-a177-4eae-9e37-3e7de4c56f93", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e2e0de34-2f65-4321-9194-f1453f38d384", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Source IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.ip" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "65b39c90-a177-4eae-9e37-3e7de4c56f93", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "e2e0de34-2f65-4321-9194-f1453f38d384", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "6775d0fd-ae68-4e8f-bf8b-b54c4fae6074", + "w": 24, + "x": 0, + "y": 53 + }, + "panelIndex": "6775d0fd-ae68-4e8f-bf8b-b54c4fae6074", + "title": "[Sophos UTM] Top Source IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8b36c89d-f03d-4f38-a63a-334dd597bef1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5ff14c11-6f57-4f24-99c5-be6368f1da81", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Source Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.port" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "8b36c89d-f03d-4f38-a63a-334dd597bef1", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "5ff14c11-6f57-4f24-99c5-be6368f1da81", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "07a63809-b2fb-4a2a-9613-143d80a33f76", + "w": 24, + "x": 0, + "y": 68 + }, + "panelIndex": "07a63809-b2fb-4a2a-9613-143d80a33f76", + "title": "[Sophos UTM] Top Source Port", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9eb61622-d56b-4e51-bd38-a5800ea97ca5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4807d2c-2b6e-4fd7-91d5-0b259d20436d", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Destination IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.ip" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "9eb61622-d56b-4e51-bd38-a5800ea97ca5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "a4807d2c-2b6e-4fd7-91d5-0b259d20436d", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "c43f003b-fbaf-4612-80a5-6237647f8bd6", + "w": 24, + "x": 24, + "y": 53 + }, + "panelIndex": "c43f003b-fbaf-4612-80a5-6237647f8bd6", + "title": "[Sophos UTM] Top Destination IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8477f859-7bfd-4d56-b33d-b6b945587319", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "19956553-a395-474c-be0f-2d3c8fe082b3", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d": { + "columnOrder": [ + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b", + "b0ba4967-5504-4da8-9af9-169a8e9655b7" + ], + "columns": { + "ac508a1c-6c5a-4d43-aa49-aa0ca897105b": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Destination Port", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.port" + }, + "b0ba4967-5504-4da8-9af9-169a8e9655b7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "8477f859-7bfd-4d56-b33d-b6b945587319", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Packet Filter", + "disabled": false, + "index": "19956553-a395-474c-be0f-2d3c8fe082b3", + "key": "event.provider", + "negate": false, + "params": { + "query": "packetfilter" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "packetfilter" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "ac508a1c-6c5a-4d43-aa49-aa0ca897105b" + }, + { + "columnId": "b0ba4967-5504-4da8-9af9-169a8e9655b7" + } + ], + "layerId": "0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "aed1195c-a76f-4328-8f3b-4a73a8e0b268", + "w": 24, + "x": 24, + "y": 68 + }, + "panelIndex": "aed1195c-a76f-4328-8f3b-4a73a8e0b268", + "title": "[Sophos UTM] Top Destination Port", + "type": "lens", + "version": "8.6.1" + } + ], + "timeRestore": false, + "title": "[Sophos UTM] Packet Filter events", + "version": 1 + }, + "coreMigrationVersion": "8.6.1", + "created_at": "2023-07-14T16:22:44.819Z", + "id": "sophos-14b92300-19b0-11ee-982d-b1686976653f", + "migrationVersion": { + "dashboard": "8.6.0" + }, + "references": [ + { + "id": "logs-*", + "name": "99f81f9a-565f-4d20-a199-48604427bc1e:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "99f81f9a-565f-4d20-a199-48604427bc1e:layer_2_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a60d5e8e-36c6-453d-aef9-c5a95f30c672:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a60d5e8e-36c6-453d-aef9-c5a95f30c672:7c95f6ba-769f-4c8a-a904-bdc6051622a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a60d5e8e-36c6-453d-aef9-c5a95f30c672:6770449b-9e66-4572-b203-cf528b0a3143", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd778397-453c-40b7-a3fe-88ec10a3551d:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd778397-453c-40b7-a3fe-88ec10a3551d:b3939934-aa2f-4834-9f89-c149865570a3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd778397-453c-40b7-a3fe-88ec10a3551d:bc76f8d3-3441-4c19-8ee8-d4c0322006c6", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d3afb0a-e1ac-4a44-81e6-87a3486bca86:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d3afb0a-e1ac-4a44-81e6-87a3486bca86:db3682ff-2991-4f97-a4bb-ac28f9c0e21d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d3afb0a-e1ac-4a44-81e6-87a3486bca86:0b96c5c8-b83c-4187-a208-3145eba2187e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7a48acf-5f4d-410d-b99e-b56ece742e41:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7a48acf-5f4d-410d-b99e-b56ece742e41:7eeb3d1e-dd96-487a-9869-946c26d21bbe", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a7a48acf-5f4d-410d-b99e-b56ece742e41:f88a01e3-0f61-4429-9999-c7b07bafbac3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53f1584c-65ea-45e1-9148-f5f030bc33a9:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53f1584c-65ea-45e1-9148-f5f030bc33a9:04ab66b2-2f8a-4b4a-af09-d572b2e50a78", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "53f1584c-65ea-45e1-9148-f5f030bc33a9:49ae2b73-3889-422a-8893-9ed529e9f037", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6775d0fd-ae68-4e8f-bf8b-b54c4fae6074:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6775d0fd-ae68-4e8f-bf8b-b54c4fae6074:65b39c90-a177-4eae-9e37-3e7de4c56f93", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6775d0fd-ae68-4e8f-bf8b-b54c4fae6074:e2e0de34-2f65-4321-9194-f1453f38d384", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07a63809-b2fb-4a2a-9613-143d80a33f76:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07a63809-b2fb-4a2a-9613-143d80a33f76:8b36c89d-f03d-4f38-a63a-334dd597bef1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "07a63809-b2fb-4a2a-9613-143d80a33f76:5ff14c11-6f57-4f24-99c5-be6368f1da81", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c43f003b-fbaf-4612-80a5-6237647f8bd6:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c43f003b-fbaf-4612-80a5-6237647f8bd6:9eb61622-d56b-4e51-bd38-a5800ea97ca5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c43f003b-fbaf-4612-80a5-6237647f8bd6:a4807d2c-2b6e-4fd7-91d5-0b259d20436d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed1195c-a76f-4328-8f3b-4a73a8e0b268:indexpattern-datasource-layer-0d5b6fd3-5264-4b3b-8579-63b1e1ff2e2d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed1195c-a76f-4328-8f3b-4a73a8e0b268:8477f859-7bfd-4d56-b33d-b6b945587319", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aed1195c-a76f-4328-8f3b-4a73a8e0b268:19956553-a395-474c-be0f-2d3c8fe082b3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_ec57f15e-764f-471e-8375-237fb4433630:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_e8b103fc-956c-4bc6-841d-6708478a279a:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5005e90e-b685-4496-b152-530fd1babf60:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_7851d8c2-4d82-414f-acc0-f4692752e8e5:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_71863581-cdd9-4afd-b709-b8ba9b728911:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_6dc67de2-a196-444a-8684-141f823ff2c6:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_510b15b7-c29a-40e1-ba8e-9579c131cf6f:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_fafb4971-3385-490b-98f4-78465e38949a:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/sophos/kibana/dashboard/sophos-55522ef0-19ad-11ee-982d-b1686976653f.json b/packages/sophos/kibana/dashboard/sophos-55522ef0-19ad-11ee-982d-b1686976653f.json new file mode 100644 index 00000000000..293effcb14e --- /dev/null +++ b/packages/sophos/kibana/dashboard/sophos-55522ef0-19ad-11ee-982d-b1686976653f.json @@ -0,0 +1,1212 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"ec5673b6-70a2-432b-baba-3142362dd025\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"id\":\"ec5673b6-70a2-432b-baba-3142362dd025\",\"enhancements\":{}}},\"37aeeb18-da4f-4958-8f4c-df30a2707e39\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"client.ip\",\"title\":\"Client IP\",\"id\":\"37aeeb18-da4f-4958-8f4c-df30a2707e39\",\"enhancements\":{}}},\"cd8a87e5-2989-449a-a545-7236a3f7a2d2\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"server.ip\",\"title\":\"Server IP\",\"id\":\"cd8a87e5-2989-449a-a545-7236a3f7a2d2\",\"enhancements\":{}}},\"81ba0ae1-2d8b-4131-b7f5-c4e5b5112469\":{\"order\":7,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"client.mac\",\"title\":\"Client MAC\",\"id\":\"81ba0ae1-2d8b-4131-b7f5-c4e5b5112469\",\"enhancements\":{}}},\"34fd44e0-1110-4ea4-9a11-56f4c5895204\":{\"order\":5,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"observer.ingress.interface.name\",\"title\":\"Server Interface\",\"id\":\"34fd44e0-1110-4ea4-9a11-56f4c5895204\",\"enhancements\":{}}},\"a5a48546-814c-4bf6-9b00-dd56383bb6c2\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"event.action\",\"title\":\"Action\",\"id\":\"a5a48546-814c-4bf6-9b00-dd56383bb6c2\",\"enhancements\":{}}},\"f1fcf810-6958-4b14-b172-cfcc5d135d71\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.router.ip\",\"title\":\"Router IP\",\"id\":\"f1fcf810-6958-4b14-b172-cfcc5d135d71\",\"enhancements\":{}}},\"b2449ff7-4d39-4244-b3ba-5c494d604c96\":{\"order\":6,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.client.hostname\",\"title\":\"Client Hostname\",\"id\":\"b2449ff7-4d39-4244-b3ba-5c494d604c96\",\"enhancements\":{}}}}" + }, + "description": "DHCP events collected by Sophos UTM.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Sophos UTM**\n \n[Overview](/app/dashboards#/view/sophos-60a2c260-19ad-11ee-982d-b1686976653f) \n**[DHCP](/app/dashboards#/view/sophos-55522ef0-19ad-11ee-982d-b1686976653f)** \n[HTTP](/app/dashboards#/view/sophos-13d06620-19af-11ee-982d-b1686976653f) \n[Packet Filter](/app/dashboards#/view/sophos-14b92300-19b0-11ee-982d-b1686976653f)\n\n**Overview**\n\nThis dashboard provides information about the DHCP events collected by Sophos UTM.\n\n[**Integration Page**](/app/integrations/detail/sophos/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 45, + "i": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "121c98b6-8aec-4ab3-b389-3a24e4395396", + "title": "Table of contents", + "type": "visualization", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8b1cdccc-044d-45d7-8e8b-73a5c6d930bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5c320bac-fbbf-4bec-8fbd-5cbbfe557fac", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "89f08cf9-e626-4e88-980a-e3579134b04b", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "89f08cf9-e626-4e88-980a-e3579134b04b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DHCP Events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "8b1cdccc-044d-45d7-8e8b-73a5c6d930bb", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "5c320bac-fbbf-4bec-8fbd-5cbbfe557fac", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "xAccessor": "89f08cf9-e626-4e88-980a-e3579134b04b" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a8521c3c-0b7d-4b73-ad4b-e7e2cdf0c7a7", + "w": 20, + "x": 8, + "y": 0 + }, + "panelIndex": "a8521c3c-0b7d-4b73-ad4b-e7e2cdf0c7a7", + "title": "[Sophos UTM] DHCP Events over Time", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b2af9e2a-cfbf-461a-ae9b-7cd44bb28bac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "397d1057-f247-4a08-94e4-cadad52fe5ab", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "3a1b163a-916d-4a46-9c9e-c117edcaf16a", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "3a1b163a-916d-4a46-9c9e-c117edcaf16a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "DHCP Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 8 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "DHCP Events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "b2af9e2a-cfbf-461a-ae9b-7cd44bb28bac", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "397d1057-f247-4a08-94e4-cadad52fe5ab", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "3a1b163a-916d-4a46-9c9e-c117edcaf16a" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "5dbd2789-ff2d-4481-9516-c19551786ddb", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "5dbd2789-ff2d-4481-9516-c19551786ddb", + "title": "[Sophos UTM] DHCP Event Action", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4830dd79-17c4-4501-b4bb-7d3917a44256", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c99b18bc-0898-40b2-9b6a-22f3cc056bba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "89f08cf9-e626-4e88-980a-e3579134b04b", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "89f08cf9-e626-4e88-980a-e3579134b04b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Client IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "4830dd79-17c4-4501-b4bb-7d3917a44256", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "c99b18bc-0898-40b2-9b6a-22f3cc056bba", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "89f08cf9-e626-4e88-980a-e3579134b04b" + }, + { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33" + } + ], + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "f9c43d23-7950-40b7-b085-a18103ac6076", + "w": 20, + "x": 8, + "y": 15 + }, + "panelIndex": "f9c43d23-7950-40b7-b085-a18103ac6076", + "title": "[Sophos UTM] Top Client IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "51fd2a0e-ec57-4c55-9838-965e6475c88f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b5f9b444-17f8-43bb-a68f-1ffaa6d8f9dd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "89f08cf9-e626-4e88-980a-e3579134b04b", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "89f08cf9-e626-4e88-980a-e3579134b04b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Client MAC Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.mac" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "51fd2a0e-ec57-4c55-9838-965e6475c88f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "b5f9b444-17f8-43bb-a68f-1ffaa6d8f9dd", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "89f08cf9-e626-4e88-980a-e3579134b04b" + }, + { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33" + } + ], + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7f7a292e-1bf4-4cb1-9bc8-009d68b04dfd", + "w": 20, + "x": 28, + "y": 15 + }, + "panelIndex": "7f7a292e-1bf4-4cb1-9bc8-009d68b04dfd", + "title": "[Sophos UTM] Top Client MAC Address", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c4355091-5b2e-4a4b-9895-b2efa930ac83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7c8efb44-b6c5-44d5-91f3-ece5112291eb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "89f08cf9-e626-4e88-980a-e3579134b04b", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "89f08cf9-e626-4e88-980a-e3579134b04b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Client Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.client.hostname" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "c4355091-5b2e-4a4b-9895-b2efa930ac83", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "7c8efb44-b6c5-44d5-91f3-ece5112291eb", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "89f08cf9-e626-4e88-980a-e3579134b04b" + }, + { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33" + } + ], + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "a5702f04-b8b9-4efe-a819-3fc2fb0aa827", + "w": 20, + "x": 8, + "y": 30 + }, + "panelIndex": "a5702f04-b8b9-4efe-a819-3fc2fb0aa827", + "title": "[Sophos UTM] Top Client Hostname", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "92ae9fbd-251f-4e29-82de-95d12db78d98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2ec6757b-6fa8-455f-ba3b-7f51c87d001e", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c": { + "columnOrder": [ + "89f08cf9-e626-4e88-980a-e3579134b04b", + "9c505e8d-6eee-474a-926d-9f3c0d664c33" + ], + "columns": { + "89f08cf9-e626-4e88-980a-e3579134b04b": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Router IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sophos.utm.router.ip" + }, + "9c505e8d-6eee-474a-926d-9f3c0d664c33": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "92ae9fbd-251f-4e29-82de-95d12db78d98", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "DHCP", + "disabled": false, + "index": "2ec6757b-6fa8-455f-ba3b-7f51c87d001e", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "89f08cf9-e626-4e88-980a-e3579134b04b" + }, + { + "columnId": "9c505e8d-6eee-474a-926d-9f3c0d664c33" + } + ], + "layerId": "3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "b7ddb0d3-657f-4017-b63d-2e598801b956", + "w": 20, + "x": 28, + "y": 30 + }, + "panelIndex": "b7ddb0d3-657f-4017-b63d-2e598801b956", + "title": "[Sophos UTM] Top Router IP", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 25, + "i": "0389a8d4-4abf-46bc-94da-e8598b73f043", + "w": 48, + "x": 0, + "y": 45 + }, + "panelIndex": "0389a8d4-4abf-46bc-94da-e8598b73f043", + "panelRefName": "panel_0389a8d4-4abf-46bc-94da-e8598b73f043", + "type": "search", + "version": "8.6.1" + } + ], + "timeRestore": false, + "title": "[Sophos UTM] DHCP events", + "version": 1 + }, + "coreMigrationVersion": "8.6.1", + "created_at": "2023-07-14T16:26:40.526Z", + "id": "sophos-55522ef0-19ad-11ee-982d-b1686976653f", + "migrationVersion": { + "dashboard": "8.6.0" + }, + "references": [ + { + "id": "logs-*", + "name": "a8521c3c-0b7d-4b73-ad4b-e7e2cdf0c7a7:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8521c3c-0b7d-4b73-ad4b-e7e2cdf0c7a7:8b1cdccc-044d-45d7-8e8b-73a5c6d930bb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a8521c3c-0b7d-4b73-ad4b-e7e2cdf0c7a7:5c320bac-fbbf-4bec-8fbd-5cbbfe557fac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5dbd2789-ff2d-4481-9516-c19551786ddb:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5dbd2789-ff2d-4481-9516-c19551786ddb:b2af9e2a-cfbf-461a-ae9b-7cd44bb28bac", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5dbd2789-ff2d-4481-9516-c19551786ddb:397d1057-f247-4a08-94e4-cadad52fe5ab", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9c43d23-7950-40b7-b085-a18103ac6076:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9c43d23-7950-40b7-b085-a18103ac6076:4830dd79-17c4-4501-b4bb-7d3917a44256", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f9c43d23-7950-40b7-b085-a18103ac6076:c99b18bc-0898-40b2-9b6a-22f3cc056bba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f7a292e-1bf4-4cb1-9bc8-009d68b04dfd:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f7a292e-1bf4-4cb1-9bc8-009d68b04dfd:51fd2a0e-ec57-4c55-9838-965e6475c88f", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f7a292e-1bf4-4cb1-9bc8-009d68b04dfd:b5f9b444-17f8-43bb-a68f-1ffaa6d8f9dd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5702f04-b8b9-4efe-a819-3fc2fb0aa827:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5702f04-b8b9-4efe-a819-3fc2fb0aa827:c4355091-5b2e-4a4b-9895-b2efa930ac83", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a5702f04-b8b9-4efe-a819-3fc2fb0aa827:7c8efb44-b6c5-44d5-91f3-ece5112291eb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7ddb0d3-657f-4017-b63d-2e598801b956:indexpattern-datasource-layer-3523a4b8-e38a-48e7-b87f-ea3598f8cd9c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7ddb0d3-657f-4017-b63d-2e598801b956:92ae9fbd-251f-4e29-82de-95d12db78d98", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b7ddb0d3-657f-4017-b63d-2e598801b956:2ec6757b-6fa8-455f-ba3b-7f51c87d001e", + "type": "index-pattern" + }, + { + "id": "sophos-fc02bd30-1a5e-11ee-86cf-13f340792f77", + "name": "0389a8d4-4abf-46bc-94da-e8598b73f043:panel_0389a8d4-4abf-46bc-94da-e8598b73f043", + "type": "search" + }, + { + "id": "logs-*", + "name": "controlGroup_ec5673b6-70a2-432b-baba-3142362dd025:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_37aeeb18-da4f-4958-8f4c-df30a2707e39:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_cd8a87e5-2989-449a-a545-7236a3f7a2d2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_81ba0ae1-2d8b-4131-b7f5-c4e5b5112469:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_34fd44e0-1110-4ea4-9a11-56f4c5895204:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_a5a48546-814c-4bf6-9b00-dd56383bb6c2:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_f1fcf810-6958-4b14-b172-cfcc5d135d71:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_b2449ff7-4d39-4244-b3ba-5c494d604c96:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/sophos/kibana/dashboard/sophos-60a2c260-19ad-11ee-982d-b1686976653f.json b/packages/sophos/kibana/dashboard/sophos-60a2c260-19ad-11ee-982d-b1686976653f.json new file mode 100644 index 00000000000..a2236372548 --- /dev/null +++ b/packages/sophos/kibana/dashboard/sophos-60a2c260-19ad-11ee-982d-b1686976653f.json @@ -0,0 +1,1103 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"2d704e3f-4207-436b-bea8-32236b0b75f4\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"agent.name\",\"title\":\"Agent Name\",\"id\":\"2d704e3f-4207-436b-bea8-32236b0b75f4\",\"enhancements\":{}}},\"85c2021c-6266-46cb-839e-eea1381dc2c8\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"host.hostname\",\"title\":\"Hostname\",\"id\":\"85c2021c-6266-46cb-839e-eea1381dc2c8\",\"enhancements\":{}}},\"2bd66687-92fd-402c-a100-66fb45caf649\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"related.ip\",\"title\":\"IP Address\",\"id\":\"2bd66687-92fd-402c-a100-66fb45caf649\",\"enhancements\":{}}},\"218cc93a-31a6-4e3b-962d-00187d053589\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"sophos.utm.severity\",\"title\":\"Severity\",\"id\":\"218cc93a-31a6-4e3b-962d-00187d053589\",\"enhancements\":{}}}}" + }, + "description": "Overview of events from UTM collected by the Sophos integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "**Navigation**\n\n**Sophos UTM**\n \n**[Overview](/app/dashboards#/view/sophos-60a2c260-19ad-11ee-982d-b1686976653f)** \n[DHCP](/app/dashboards#/view/sophos-55522ef0-19ad-11ee-982d-b1686976653f) \n[HTTP](/app/dashboards#/view/sophos-13d06620-19af-11ee-982d-b1686976653f) \n[Packet Filter](/app/dashboards#/view/sophos-14b92300-19b0-11ee-982d-b1686976653f)\n\n**Overview**\n\nThis dashboard provides an overall summary of logs collected by Sophos UTM (Unified Threat Management) for the time frame selected.\n\nPivot to other dashboards by pinning your filters and using the dashboard links navigation above.\n\n[**Integration Page**](/app/integrations/detail/sophos/overview)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 24, + "i": "d0f9c873-0b69-4418-b68c-45682e02c96a", + "w": 8, + "x": 0, + "y": 0 + }, + "panelIndex": "d0f9c873-0b69-4418-b68c-45682e02c96a", + "title": "Table of contents", + "type": "visualization", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "87247ed6-08de-4ebd-8a96-e94b604cf8aa", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "23bd05fb-0707-48f8-b318-5603cbe468fb", + "d03e1e98-f8f0-4ac8-87db-571ab420533d" + ], + "columns": { + "23bd05fb-0707-48f8-b318-5603cbe468fb": { + "dataType": "string", + "isBucketed": true, + "label": "Filters", + "operationType": "filters", + "params": { + "filters": [ + { + "input": { + "language": "kuery", + "query": "event.provider: \"dhcp\" " + }, + "label": "DHCP" + }, + { + "input": { + "language": "kuery", + "query": "event.provider : \"http\" " + }, + "label": "HTTP" + }, + { + "input": { + "language": "kuery", + "query": "event.provider : \"packetfilter\" " + }, + "label": "Packet Filter" + }, + { + "input": { + "language": "kuery", + "query": "event.provider : \"dns\" " + }, + "label": "DNS" + } + ] + }, + "scale": "ordinal" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sophos UTM events", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "87247ed6-08de-4ebd-8a96-e94b604cf8aa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533d" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "23bd05fb-0707-48f8-b318-5603cbe468fb" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "e73c5d79-8153-4190-9185-19efe938bd5f", + "w": 20, + "x": 8, + "y": 0 + }, + "panelIndex": "e73c5d79-8153-4190-9185-19efe938bd5f", + "title": "[Sophos UTM] Source of events", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "435c1609-b3f0-4160-b2da-4a6fedc104bd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "23bd05fb-0707-48f8-b318-5603cbe468fb", + "d03e1e98-f8f0-4ac8-87db-571ab420533d" + ], + "columns": { + "23bd05fb-0707-48f8-b318-5603cbe468fb": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "IP Address", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d03e1e98-f8f0-4ac8-87db-571ab420533d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "related.ip" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "435c1609-b3f0-4160-b2da-4a6fedc104bd", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "23bd05fb-0707-48f8-b318-5603cbe468fb" + }, + { + "columnId": "d03e1e98-f8f0-4ac8-87db-571ab420533d" + } + ], + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "7b5c0e09-c1a8-4e18-b7df-748431074633", + "w": 20, + "x": 28, + "y": 16 + }, + "panelIndex": "7b5c0e09-c1a8-4e18-b7df-748431074633", + "title": "[Sophos UTM] Top IP Address", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8e43e703-a20a-4fc2-bb71-b3c50e06e046", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "23bd05fb-0707-48f8-b318-5603cbe468fb", + "d03e1e98-f8f0-4ac8-87db-571ab420533d" + ], + "columns": { + "23bd05fb-0707-48f8-b318-5603cbe468fb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d03e1e98-f8f0-4ac8-87db-571ab420533d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "8e43e703-a20a-4fc2-bb71-b3c50e06e046", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "23bd05fb-0707-48f8-b318-5603cbe468fb" + }, + { + "columnId": "d03e1e98-f8f0-4ac8-87db-571ab420533d" + } + ], + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "cd1bd2f0-1743-4136-bc6a-08b80d18fe6e", + "w": 20, + "x": 8, + "y": 16 + }, + "panelIndex": "cd1bd2f0-1743-4136-bc6a-08b80d18fe6e", + "title": "[Sophos UTM] Top Hostname", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5ffe3cf7-e3c5-423d-a22a-1c47de47d176", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "7f2bc5bb-81d4-4961-911c-ab24a0f26214", + "147f7b55-77aa-45cc-b66d-bb1499f705d5" + ], + "columns": { + "147f7b55-77aa-45cc-b66d-bb1499f705d5": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7f2bc5bb-81d4-4961-911c-ab24a0f26214": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Severity", + "operationType": "range", + "params": { + "maxBars": 499.5, + "parentFormat": { + "id": "range", + "params": { + "replaceInfinity": true, + "template": "arrow_right" + } + }, + "ranges": [ + { + "from": 0, + "label": "Emergency", + "to": 1 + }, + { + "from": 1, + "label": "Alert", + "to": 2 + }, + { + "from": 2, + "label": "Critical", + "to": 3 + }, + { + "from": 3, + "label": "Error", + "to": 4 + }, + { + "from": 4, + "label": "Warning", + "to": 5 + }, + { + "from": 5, + "label": "Notice", + "to": 6 + }, + { + "from": 6, + "label": "Info", + "to": 7 + }, + { + "from": 7, + "label": "Debug", + "to": null + } + ], + "type": "range" + }, + "scale": "ordinal", + "sourceField": "event.severity" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "5ffe3cf7-e3c5-423d-a22a-1c47de47d176", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "collapseFns": { + "7f2bc5bb-81d4-4961-911c-ab24a0f26214": "" + }, + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "147f7b55-77aa-45cc-b66d-bb1499f705d5" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7f2bc5bb-81d4-4961-911c-ab24a0f26214" + ] + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "7f34e96b-6f50-4576-a2c2-867515aa2363", + "w": 20, + "x": 28, + "y": 0 + }, + "panelIndex": "7f34e96b-6f50-4576-a2c2-867515aa2363", + "title": "[Sophos UTM] Severity of events", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa072a23-a7b2-4924-b424-23c35be5e6e9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533d", + "d03e1e98-f8f0-4ac8-87db-571ab420533dX0", + "d03e1e98-f8f0-4ac8-87db-571ab420533dX1" + ], + "columns": { + "d03e1e98-f8f0-4ac8-87db-571ab420533d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Sophos UTM events", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533dX1" + ], + "scale": "ratio" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sophos UTM events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Sophos UTM events", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533dX0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533dX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "fa072a23-a7b2-4924-b424-23c35be5e6e9", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "metricAccessor": "d03e1e98-f8f0-4ac8-87db-571ab420533d" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "c42f1bf5-b9c8-4fb8-8689-21220219fcf1", + "w": 8, + "x": 0, + "y": 24 + }, + "panelIndex": "c42f1bf5-b9c8-4fb8-8689-21220219fcf1", + "title": "[Sophos UTM] Total UTM events", + "type": "lens", + "version": "8.6.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0b1160fb-8850-4f33-986b-50335c648f80", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "69f9b932-cf52-4a5d-abe6-152200d031e3": { + "columnOrder": [ + "ec3ffa09-d8ce-4b38-b8e5-c0a34202e95d", + "d03e1e98-f8f0-4ac8-87db-571ab420533d", + "b9cddc76-1b95-4440-b58d-d98cc496f02e", + "29edb7c6-4712-4212-b26f-bd3369c4f266" + ], + "columns": { + "29edb7c6-4712-4212-b26f-bd3369c4f266": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "sophos.utm.action : \"block\" or event.action : \"drop\"" + }, + "isBucketed": false, + "label": "Denied", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b9cddc76-1b95-4440-b58d-d98cc496f02e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "event.action: \"accept\" or event.action : \"pass\"" + }, + "isBucketed": false, + "label": "Allowed", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d03e1e98-f8f0-4ac8-87db-571ab420533d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ec3ffa09-d8ce-4b38-b8e5-c0a34202e95d": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Sophos UTM dataset", + "disabled": false, + "index": "0b1160fb-8850-4f33-986b-50335c648f80", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d03e1e98-f8f0-4ac8-87db-571ab420533d", + "b9cddc76-1b95-4440-b58d-d98cc496f02e", + "29edb7c6-4712-4212-b26f-bd3369c4f266" + ], + "layerId": "69f9b932-cf52-4a5d-abe6-152200d031e3", + "layerType": "data", + "seriesType": "area", + "xAccessor": "ec3ffa09-d8ce-4b38-b8e5-c0a34202e95d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "area", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 18, + "i": "97c79872-3a11-4ae1-823c-326a7c21d13b", + "w": 48, + "x": 0, + "y": 32 + }, + "panelIndex": "97c79872-3a11-4ae1-823c-326a7c21d13b", + "title": "[Sophos UTM] Total events vs Allowed vs Denied over Time", + "type": "lens", + "version": "8.6.1" + } + ], + "timeRestore": false, + "title": "[Sophos UTM] Overview", + "version": 1 + }, + "coreMigrationVersion": "8.6.1", + "created_at": "2023-07-14T16:18:16.801Z", + "id": "sophos-60a2c260-19ad-11ee-982d-b1686976653f", + "migrationVersion": { + "dashboard": "8.6.0" + }, + "references": [ + { + "id": "logs-*", + "name": "e73c5d79-8153-4190-9185-19efe938bd5f:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e73c5d79-8153-4190-9185-19efe938bd5f:87247ed6-08de-4ebd-8a96-e94b604cf8aa", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b5c0e09-c1a8-4e18-b7df-748431074633:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7b5c0e09-c1a8-4e18-b7df-748431074633:435c1609-b3f0-4160-b2da-4a6fedc104bd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd1bd2f0-1743-4136-bc6a-08b80d18fe6e:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cd1bd2f0-1743-4136-bc6a-08b80d18fe6e:8e43e703-a20a-4fc2-bb71-b3c50e06e046", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f34e96b-6f50-4576-a2c2-867515aa2363:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7f34e96b-6f50-4576-a2c2-867515aa2363:5ffe3cf7-e3c5-423d-a22a-1c47de47d176", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c42f1bf5-b9c8-4fb8-8689-21220219fcf1:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c42f1bf5-b9c8-4fb8-8689-21220219fcf1:fa072a23-a7b2-4924-b424-23c35be5e6e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "97c79872-3a11-4ae1-823c-326a7c21d13b:indexpattern-datasource-layer-69f9b932-cf52-4a5d-abe6-152200d031e3", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "97c79872-3a11-4ae1-823c-326a7c21d13b:0b1160fb-8850-4f33-986b-50335c648f80", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2d704e3f-4207-436b-bea8-32236b0b75f4:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_85c2021c-6266-46cb-839e-eea1381dc2c8:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2bd66687-92fd-402c-a100-66fb45caf649:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_218cc93a-31a6-4e3b-962d-00187d053589:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/sophos/kibana/search/sophos-fc02bd30-1a5e-11ee-86cf-13f340792f77.json b/packages/sophos/kibana/search/sophos-fc02bd30-1a5e-11ee-86cf-13f340792f77.json new file mode 100644 index 00000000000..9d01edce141 --- /dev/null +++ b/packages/sophos/kibana/search/sophos-fc02bd30-1a5e-11ee-86cf-13f340792f77.json @@ -0,0 +1,100 @@ +{ + "attributes": { + "columns": [ + "event.action", + "client.ip", + "client.mac", + "event.original" + ], + "description": "Search for the latest DHCP events collected by the Sophos UTM integration", + "grid": {}, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "sophos.utm" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "sophos.utm" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "event.provider", + "negate": false, + "params": { + "query": "dhcp" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.provider": "dhcp" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRestore": false, + "title": "Sophos UTM DHCP Search", + "usesAdHocDataView": false + }, + "coreMigrationVersion": "8.6.1", + "created_at": "2023-07-14T15:58:02.823Z", + "id": "sophos-fc02bd30-1a5e-11ee-86cf-13f340792f77", + "migrationVersion": { + "search": "8.0.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + } + ], + "type": "search" +} \ No newline at end of file diff --git a/packages/sophos/kibana/tags.yml b/packages/sophos/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sophos/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sophos/manifest.yml b/packages/sophos/manifest.yml index 5981a6cf188..a108c4cb1e2 100644 --- a/packages/sophos/manifest.yml +++ b/packages/sophos/manifest.yml @@ -1,14 +1,16 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: sophos title: Sophos -version: "2.11.1" +version: "3.3.0" description: Collect logs from Sophos with Elastic Agent. -categories: ["security", "network", "firewall_security"] -release: ga -license: basic +categories: + - "security" + - "network" + - "firewall_security" type: integration conditions: - kibana.version: "^7.17.0 || ^8.0.0" + kibana: + version: ^8.6.1 policy_templates: - name: sophos title: Sophos logs @@ -23,6 +25,23 @@ policy_templates: - type: logfile title: Collect logs from Sophos via file description: Collecting syslog from Sophos via file. +screenshots: + - src: /img/sophos-utm-overview.png + title: Sophos UTM - Overview + size: 1847x950 + type: image/png + - src: /img/sophos-utm-dhcp.png + title: Sophos UTM - DHCP + size: 1850x948 + type: image/png + - src: /img/sophos-utm-http.png + title: Sophos UTM - HTTP + size: 1850x948 + type: image/png + - src: /img/sophos-utm-packetfilter.png + title: Sophos UTM - Packet Filter + size: 1850x948 + type: image/png icons: - src: /img/logo.svg title: Sophos logo @@ -30,3 +49,4 @@ icons: type: image/svg+xml owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/sophos_central/_dev/build/build.yml b/packages/sophos_central/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/sophos_central/_dev/build/build.yml +++ b/packages/sophos_central/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/sophos_central/changelog.yml b/packages/sophos_central/changelog.yml index ad35ffe8064..fc310a328ba 100644 --- a/packages/sophos_central/changelog.yml +++ b/packages/sophos_central/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.9.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7110 +- version: "1.6.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.5.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-pipeline-activity.log-expected.json b/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-pipeline-activity.log-expected.json index 4830e456833..4c7b16bf44a 100644 --- a/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-pipeline-activity.log-expected.json +++ b/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-pipeline-activity.log-expected.json @@ -7,7 +7,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-user-formats.log-expected.json b/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-user-formats.log-expected.json index c08444abdd0..8c72c619607 100644 --- a/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-user-formats.log-expected.json +++ b/packages/sophos_central/data_stream/alert/_dev/test/pipeline/test-user-formats.log-expected.json @@ -7,7 +7,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -187,7 +187,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -363,7 +363,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/sophos_central/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/sophos_central/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index cb2df5f1d27..06230eafcda 100644 --- a/packages/sophos_central/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sophos_central/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: alert diff --git a/packages/sophos_central/data_stream/alert/manifest.yml b/packages/sophos_central/data_stream/alert/manifest.yml index 11aa5e721bc..41c676ff2b2 100644 --- a/packages/sophos_central/data_stream/alert/manifest.yml +++ b/packages/sophos_central/data_stream/alert/manifest.yml @@ -9,7 +9,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are s, m, h." + description: "Duration before declaring that the HTTP client connection has timed out. Valid time units are s, m, h." multi: false required: true show_user: false @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: "Interval between two REST API calls. NOTE: Valid time units are s, m, h." + description: "Interval between two REST API calls. Valid time units are s, m, h." default: 5m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: "The starting date from which alerts will be retrieved is defined as a Unix timestamp in UTC. Must be within the last 24 hours. NOTE: Valid time units are s, m, h." + description: "The starting date from which alerts will be retrieved is defined as a Unix timestamp in UTC. Must be within the last 24 hours. Valid time units are s, m, h." multi: false required: true show_user: true diff --git a/packages/sophos_central/data_stream/alert/sample_event.json b/packages/sophos_central/data_stream/alert/sample_event.json index b19a45d8eb5..c2f1679b943 100644 --- a/packages/sophos_central/data_stream/alert/sample_event.json +++ b/packages/sophos_central/data_stream/alert/sample_event.json @@ -17,7 +17,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862", diff --git a/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-pipeline-activity.log-expected.json b/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-pipeline-activity.log-expected.json index 9eb82b128e2..264430f4218 100644 --- a/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-pipeline-activity.log-expected.json +++ b/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-pipeline-activity.log-expected.json @@ -7,7 +7,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "New user added automatically: Lightning-wmknq52avx\\Lightning", diff --git a/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-user-formats.log-expected.json b/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-user-formats.log-expected.json index 101517f75d6..2e94eed6980 100644 --- a/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-user-formats.log-expected.json +++ b/packages/sophos_central/data_stream/event/_dev/test/pipeline/test-user-formats.log-expected.json @@ -7,7 +7,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "New user added automatically: Lightning-wmknq52avx\\Lightning", @@ -165,7 +165,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "New user added automatically: \\Lightning", @@ -319,7 +319,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "New user added automatically: Lightning Somename", diff --git a/packages/sophos_central/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/sophos_central/data_stream/event/elasticsearch/ingest_pipeline/default.yml index 1d75e245359..b8eeb230296 100644 --- a/packages/sophos_central/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sophos_central/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Events logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: event diff --git a/packages/sophos_central/data_stream/event/manifest.yml b/packages/sophos_central/data_stream/event/manifest.yml index d3254d4d67a..73b9b09ddb6 100644 --- a/packages/sophos_central/data_stream/event/manifest.yml +++ b/packages/sophos_central/data_stream/event/manifest.yml @@ -9,7 +9,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are s, m, h." + description: "Duration before declaring that the HTTP client connection has timed out. Valid time units are s, m, h." multi: false required: true show_user: false @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: "Interval between two REST API calls. NOTE: Valid time units are s, m, h." + description: "Interval between two REST API calls. Valid time units are s, m, h." default: 5m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: "The starting date from which alerts will be retrieved is defined as a Unix timestamp in UTC. Must be within the last 24 hours. NOTE: Valid time units are s, m, h." + description: "The starting date from which alerts will be retrieved is defined as a Unix timestamp in UTC. Must be within the last 24 hours. Valid time units are s, m, h." multi: false required: true show_user: true diff --git a/packages/sophos_central/data_stream/event/sample_event.json b/packages/sophos_central/data_stream/event/sample_event.json index f647d96da1f..585b8d15a71 100644 --- a/packages/sophos_central/data_stream/event/sample_event.json +++ b/packages/sophos_central/data_stream/event/sample_event.json @@ -17,7 +17,7 @@ "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862", diff --git a/packages/sophos_central/docs/README.md b/packages/sophos_central/docs/README.md index 3b5a2cd8099..6f26ad20b46 100644 --- a/packages/sophos_central/docs/README.md +++ b/packages/sophos_central/docs/README.md @@ -67,7 +67,7 @@ An example event for `alert` looks as following: "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862", @@ -383,7 +383,7 @@ An example event for `event` looks as following: "port": 789 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "cf659b85-d5b7-4b0d-8b9a-4ea2e187d862", diff --git a/packages/sophos_central/kibana/tags.yml b/packages/sophos_central/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sophos_central/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sophos_central/manifest.yml b/packages/sophos_central/manifest.yml index 04356dab0a0..3db1515cc64 100644 --- a/packages/sophos_central/manifest.yml +++ b/packages/sophos_central/manifest.yml @@ -1,14 +1,16 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: sophos_central title: Sophos Central -version: "1.5.0" +version: "1.9.0" description: This Elastic integration collects logs from Sophos Central with Elastic Agent. type: integration categories: - security conditions: - kibana.version: ^8.7.1 - elastic.subscription: "basic" + kibana: + version: ^8.7.1 + elastic: + subscription: "basic" screenshots: - src: /img/sophos-central-alerts.png title: Sample screenshot @@ -113,3 +115,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/spring_boot/changelog.yml b/packages/spring_boot/changelog.yml index 2753ac44baf..3c7f99f21e7 100644 --- a/packages/spring_boot/changelog.yml +++ b/packages/spring_boot/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.11.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7341 - version: "0.10.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/spring_boot/data_stream/audit_events/agent/stream/stream.yml.hbs b/packages/spring_boot/data_stream/audit_events/agent/stream/stream.yml.hbs index 8aed58625e5..bb519915129 100644 --- a/packages/spring_boot/data_stream/audit_events/agent/stream/stream.yml.hbs +++ b/packages/spring_boot/data_stream/audit_events/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{period}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: GET request.url: {{hostname}}/actuator/auditevents {{#if proxy_url }} diff --git a/packages/spring_boot/data_stream/http_trace/agent/stream/stream.yml.hbs b/packages/spring_boot/data_stream/http_trace/agent/stream/stream.yml.hbs index 39d4f18a0b4..a14cd08d934 100644 --- a/packages/spring_boot/data_stream/http_trace/agent/stream/stream.yml.hbs +++ b/packages/spring_boot/data_stream/http_trace/agent/stream/stream.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{period}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#if ssl}} request.ssl: {{ssl}} {{/if}} diff --git a/packages/spring_boot/manifest.yml b/packages/spring_boot/manifest.yml index 608681932b2..7b27d80b823 100644 --- a/packages/spring_boot/manifest.yml +++ b/packages/spring_boot/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: spring_boot title: Spring Boot -version: "0.10.0" +version: "0.11.0" license: basic description: This Elastic integration collects logs and metrics from Spring Boot integration. type: integration @@ -58,6 +58,13 @@ policy_templates: required: false show_user: false default: "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE----- \n" + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. - type: jolokia/metrics title: Collect Spring Boot metrics using Jolokia. description: Collecting metrics from Spring Boot of Memory, Threading and Garbage Collector (GC) using Jolokia. diff --git a/packages/sql_input/agent/input/input.yml.hbs b/packages/sql_input/agent/input/input.yml.hbs index 85ac2a9e400..2bf19a8f78a 100644 --- a/packages/sql_input/agent/input/input.yml.hbs +++ b/packages/sql_input/agent/input/input.yml.hbs @@ -3,9 +3,17 @@ hosts: {{#each hosts}} - {{this}} {{/each}} +{{#if condition}} +condition: {{ condition }} +{{/if}} driver: {{driver}} sql_queries: {{sql_queries}} raw_data.enabled: true period: {{period}} +merge_results: {{merge_results}} data_stream: dataset: {{data_stream.dataset}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/sql_input/changelog.yml b/packages/sql_input/changelog.yml index e43ababf552..9658baa9530 100644 --- a/packages/sql_input/changelog.yml +++ b/packages/sql_input/changelog.yml @@ -1,4 +1,14 @@ # newer versions go on top +- version: "0.4.0" + changes: + - description: Add `condition` and `processors` settings. + type: enhancement + link: https://github.com/elastic/integrations/pull/6358 +- version: "0.3.0" + changes: + - description: Add merge_results feature + type: enhancement + link: https://github.com/elastic/integrations/pull/6922 - version: "0.2.1" changes: - description: Add system test cases. diff --git a/packages/sql_input/docs/README.md b/packages/sql_input/docs/README.md index 7982387d196..07be686c844 100644 --- a/packages/sql_input/docs/README.md +++ b/packages/sql_input/docs/README.md @@ -81,3 +81,25 @@ Expects any number of columns. This mode generates a single event for each row. For more examples of response format pelase refer [here](https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-sql.html) + +### Merge Results +Merge multiple queries into a single event. + +Multiple queries will create multiple events, one for each query. It may be preferable to create a single event by combining the metrics together in a single event. + +This feature can be enabled using the `merge_results` config. + +`merge_results` can merge queries having response format as "variable". +However, for queries with a response format as "table", a merge is possible only if each table query produces a single row. + +For example, if we have 2 queries as below for PostgreSQL: + +sql_queries: + - query: "SELECT blks_hit,blks_read FROM pg_stat_database LIMIT 1;" + response_format: table + + - query: "SELECT checkpoints_timed,checkpoints_req FROM pg_stat_bgwriter;" + response_format: table + +The `merge_results` feature will create a combined event, where `blks_hit`, `blks_read`, `checkpoints_timed` and `checkpoints_req` are part of the same event. + diff --git a/packages/sql_input/manifest.yml b/packages/sql_input/manifest.yml index ab3fbc743a5..77ab8e3dd10 100644 --- a/packages/sql_input/manifest.yml +++ b/packages/sql_input/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: sql title: "SQL Input" -version: "0.2.1" +version: "0.4.0" description: "Collects Metrics by Quering on SQL Databases" type: input categories: @@ -48,5 +48,28 @@ policy_templates: required: true show_user: true default: "- query: SHOW GLOBAL STATUS LIKE 'Innodb_system%'\n response_format: variables\n \n" + - name: merge_results + type: bool + title: Merge Results + multi: false + required: false + show_user: false + default: false + description: Merge results from multiple queries to a single event (restrictions apply) + - name: condition + title: Condition + description: Condition to filter when to apply this datastream. Refer to [Conditions](https://www.elastic.co/guide/en/fleet/current/dynamic-input-configuration.html#conditions) on how to use the available keys in conditions. + type: text + multi: false + required: false + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the events are shipped. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. owner: github: elastic/obs-infraobs-integrations diff --git a/packages/squid/_dev/build/build.yml b/packages/squid/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/squid/_dev/build/build.yml +++ b/packages/squid/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/squid/changelog.yml b/packages/squid/changelog.yml index a5049f44287..ac5861f4d05 100644 --- a/packages/squid/changelog.yml +++ b/packages/squid/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "0.16.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/squid/data_stream/log/_dev/test/pipeline/test-access1.log-expected.json b/packages/squid/data_stream/log/_dev/test/pipeline/test-access1.log-expected.json index 9392ec2a10f..00379d73e1a 100644 --- a/packages/squid/data_stream/log/_dev/test/pipeline/test-access1.log-expected.json +++ b/packages/squid/data_stream/log/_dev/test/pipeline/test-access1.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689312.049 5006 10.105.21.199 TCP_MISS/200 19763 CONNECT login.yahoo.com:443 badeyek DIRECT/209.73.177.115 -", "tags": [ @@ -11,7 +11,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689320.327 2864 10.105.21.199 TCP_MISS/200 10182 GET http://www.goonernews.com/ badeyek DIRECT/207.58.145.61 text/html", "tags": [ @@ -20,7 +20,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689320.343 1357 10.105.21.199 TCP_REFRESH_HIT/304 214 GET http://www.goonernews.com/styles.css badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -29,7 +29,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689321.315 1 10.105.21.199 TCP_HIT/200 1464 GET http://www.goonernews.com/styles.css badeyek NONE/- text/css", "tags": [ @@ -38,7 +38,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689322.780 1464 10.105.21.199 TCP_HIT/200 5626 GET http://www.google-analytics.com/urchin.js badeyek NONE/- text/javascript", "tags": [ @@ -47,7 +47,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689323.718 3856 10.105.21.199 TCP_MISS/200 30169 GET http://www.goonernews.com/ badeyek DIRECT/207.58.145.61 text/html", "tags": [ @@ -56,7 +56,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689324.156 1372 10.105.21.199 TCP_MISS/200 399 GET http://www.google-analytics.com/__utm.gif? badeyek DIRECT/66.102.9.147 image/gif", "tags": [ @@ -65,7 +65,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689324.266 1457 10.105.21.199 TCP_REFRESH_HIT/304 215 GET http://www.goonernews.com/graphics/newslogo.gif badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -74,7 +74,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689324.281 1465 10.105.21.199 TCP_REFRESH_HIT/304 215 GET http://www.goonernews.com/shop/arsenal_shop_ad.jpg badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -83,7 +83,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689325.734 1452 10.105.21.199 TCP_REFRESH_HIT/304 214 GET http://www.goonernews.com/flags/FUS.gif badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -92,7 +92,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689325.736 2 10.105.21.199 TCP_HIT/200 1353 GET http://www.goonernews.com/flags/FGB.gif badeyek NONE/- image/gif", "tags": [ @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689325.953 2603 10.105.21.199 TCP_MISS/200 1013 GET http://as.casalemedia.com/s? badeyek DIRECT/209.85.16.38 text/html", "tags": [ @@ -110,7 +110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689326.703 4459 10.105.21.199 TCP_MISS/200 1845 CONNECT us.bc.yahoo.com:443 badeyek DIRECT/68.142.213.132 -", "tags": [ @@ -119,7 +119,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689327.312 1356 10.105.21.199 TCP_MISS/302 729 GET http://impgb.tradedoubler.com/imp/img/16349696/992098 badeyek DIRECT/217.212.240.172 text/html", "tags": [ @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689327.751 3484 10.105.21.199 TCP_MISS/200 1577 GET http://4.adbrite.com/mb/text_group.php? badeyek DIRECT/206.169.136.22 text/html", "tags": [ @@ -137,7 +137,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689327.803 9 10.105.21.199 TCP_HIT/200 1353 GET http://www.goonernews.com/flags/FFR.gif badeyek NONE/- image/gif", "tags": [ @@ -146,7 +146,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689329.234 1431 10.105.21.199 TCP_REFRESH_HIT/304 214 GET http://www.goonernews.com/flags/FAU.gif badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689329.280 1414 10.105.21.199 TCP_REFRESH_HIT/304 213 GET http://www.goonernews.com/graphics/spacer.gif badeyek DIRECT/207.58.145.61 -", "tags": [ @@ -164,7 +164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689330.920 1686 10.105.21.199 TCP_MISS/200 1784 GET http://4.adbrite.com/mb/text_group.php? badeyek DIRECT/64.127.126.178 text/html", "tags": [ @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689331.313 3997 10.105.21.199 TCP_MISS/302 851 GET http://ff.connextra.com/Ladbrokes/selector/image? badeyek DIRECT/213.160.98.161 -", "tags": [ @@ -182,7 +182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689335.275 3962 10.105.21.199 TCP_MISS/200 30904 GET http://dd.connextra.com/servlet/controller? badeyek DIRECT/213.160.98.160 image/gif", "tags": [ @@ -191,7 +191,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689337.481 4 10.105.47.218 TCP_DENIED/407 1661 GET http://hi5.com/ - NONE/- text/html", "tags": [ @@ -200,7 +200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689342.757 3657 10.105.21.199 TCP_MISS/200 12569 CONNECT login.yahoo.com:443 badeyek DIRECT/209.73.177.115 -", "tags": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689343.106 1 10.105.33.214 TCP_DENIED/407 1752 GET http://update.messenger.yahoo.com/msgrcli7.html - NONE/- text/html", "tags": [ @@ -218,7 +218,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689343.782 1371 10.105.33.214 TCP_MISS/200 484 POST http://shttp.msg.yahoo.com/notify/ adeolaegbedokun DIRECT/216.155.194.239 text/plain", "tags": [ @@ -227,7 +227,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689344.736 4969 10.105.47.218 TCP_MISS/200 29359 GET http://hi5.com/ nazsoau DIRECT/204.13.51.238 text/html", "tags": [ @@ -236,7 +236,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689344.798 1631 10.105.47.218 TCP_MISS/200 5930 GET http://hi5.com/friend/styles/homepage.css nazsoau DIRECT/204.13.51.238 text/css", "tags": [ @@ -245,7 +245,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689345.641 1810 10.105.33.214 TCP_MISS/200 1645 POST http://shttp.msg.yahoo.com/notify/ adeolaegbedokun DIRECT/216.155.194.239 text/plain", "tags": [ @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689346.267 880 10.105.37.58 TCP_DENIED/407 1812 GET http://rms.adobe.com/read/0600/win_/ENU/read0600win_ENUadbe0000.xml - NONE/- text/html", "tags": [ @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689347.190 10 10.105.47.218 TCP_IMS_HIT/304 217 GET http://images.hi5.com/styles/style.css nazsoau NONE/- text/css", "tags": [ @@ -272,7 +272,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689347.307 116 10.105.47.218 TCP_IMS_HIT/304 217 GET http://images.hi5.com/friend/styles/buttons_en_us.css nazsoau NONE/- text/css", "tags": [ @@ -281,7 +281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689347.751 6160 10.105.47.218 TCP_MISS/200 27799 GET http://hi5.com/ nazsoau DIRECT/204.13.51.238 text/html", "tags": [ @@ -290,7 +290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689349.064 1758 10.105.47.218 TCP_MISS/200 4470 GET http://hi5.com/friend/styles/headernav.css nazsoau DIRECT/204.13.51.238 text/css", "tags": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689350.829 1393 10.105.33.214 TCP_MISS/200 382 POST http://shttp.msg.yahoo.com/notify/ adeolaegbedokun DIRECT/216.155.194.239 text/plain", "tags": [ @@ -308,7 +308,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689353.439 3667 10.105.33.214 TCP_MISS/200 24095 GET http://insider.msg.yahoo.com/? adeolaegbedokun DIRECT/68.142.194.14 text/html", "tags": [ @@ -317,7 +317,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689353.939 4899 10.105.33.214 TCP_MISS/200 22964 GET http://radio.launch.yahoo.com/radio/play/playmessenger.asp adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -326,7 +326,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689354.877 1349 10.105.33.214 TCP_MISS/200 646 POST http://shttp.msg.yahoo.com/notify/ adeolaegbedokun DIRECT/216.155.194.239 text/plain", "tags": [ @@ -335,7 +335,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689355.517 1578 10.105.33.214 TCP_MISS/200 699 GET http://address.yahoo.com/yab/us? adeolaegbedokun DIRECT/209.191.93.51 text/xml", "tags": [ @@ -344,7 +344,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689356.907 6741 10.105.21.199 TCP_MISS/302 734 GET http://fxfeeds.mozilla.org/rss20.xml badeyek DIRECT/63.245.209.21 text/html", "tags": [ @@ -353,7 +353,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689357.267 6424 10.105.33.214 TCP_MISS/200 31400 GET http://insider.msg.yahoo.com/ycontent/? adeolaegbedokun DIRECT/68.142.231.252 text/xml", "tags": [ @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689357.720 2831 10.105.33.214 TCP_MISS/200 21152 GET http://insider.msg.yahoo.com/ycontent/? adeolaegbedokun DIRECT/68.142.194.14 text/xml", "tags": [ @@ -371,7 +371,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.173 1 10.105.37.17 TCP_DENIED/407 1667 CONNECT us.mcafee.com:443 - NONE/- text/html", "tags": [ @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.174 0 10.105.37.17 TCP_DENIED/407 1767 POST http://us.mcafee.com/apps/agent/submgr/appinstru.asp - NONE/- text/html", "tags": [ @@ -389,7 +389,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.174 0 10.105.37.17 TCP_DENIED/407 1761 POST http://us.mcafee.com/apps/agent/submgr/appsync.asp - NONE/- text/html", "tags": [ @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.226 0 10.105.37.17 TCP_DENIED/407 1667 CONNECT us.mcafee.com:443 - NONE/- text/html", "tags": [ @@ -407,7 +407,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.486 711 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/images/btn_stations.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689358.683 0 10.105.37.17 TCP_DENIED/407 1667 CONNECT us.mcafee.com:443 - NONE/- text/html", "tags": [ @@ -425,7 +425,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689359.199 713 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/images/btn_stations_over.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -434,7 +434,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689359.269 1982 10.105.33.214 TCP_MISS/200 362 POST http://shttp.msg.yahoo.com/notify/ adeolaegbedokun DIRECT/216.155.194.239 text/plain", "tags": [ @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689359.924 725 10.105.33.214 TCP_REFRESH_HIT/304 511 GET http://radio.launch.yahoo.com/radio/clientdata/538/skins/1/images/bg_left.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -452,7 +452,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689360.611 687 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/images/launchcast_radio.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689360.980 1 10.105.47.191 TCP_DENIED/407 1767 POST http://us.mcafee.com/apps/agent/submgr/appinstru.asp - NONE/- text/html", "tags": [ @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689361.188 1 10.105.47.191 TCP_DENIED/407 1761 POST http://us.mcafee.com/apps/agent/submgr/appsync.asp - NONE/- text/html", "tags": [ @@ -479,7 +479,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689361.393 783 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/skins/1/images/bg_right.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -488,7 +488,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689361.564 2242 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/skins/1/images/bg_center.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -497,7 +497,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689362.220 827 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/clientdata/538/skins/1/images/bg_controls_off.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689362.315 751 10.105.33.214 TCP_REFRESH_HIT/304 512 GET http://radio.launch.yahoo.com/radio/common_radio/resources/images/t.gif adeolaegbedokun DIRECT/68.142.219.132 -", "tags": [ @@ -515,7 +515,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689362.318 3 10.105.33.214 TCP_IMS_HIT/304 218 GET http://radio.launch.yahoo.com/radio/clientdata/538/images/btn_off_state_station.gif adeolaegbedokun NONE/- image/gif", "tags": [ @@ -524,7 +524,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689362.332 13 10.105.33.214 TCP_IMS_HIT/304 218 GET http://radio.launch.yahoo.com/radio/clientdata/538/skins/1/images/bg_controls_fill.gif adeolaegbedokun NONE/- image/gif", "tags": [ @@ -533,7 +533,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689362.341 8 10.105.33.214 TCP_HIT/200 2263 GET http://us.i1.yimg.com/us.yimg.com/i/us/toolbar50x50.gif adeolaegbedokun NONE/- image/gif", "tags": [ @@ -542,7 +542,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689363.423 6517 10.105.21.199 TCP_REFRESH_MISS/200 17396 GET http://newsrss.bbc.co.uk/rss/newsonline_world_edition/front_page/rss.xml badeyek DIRECT/212.58.226.33 application/xml", "tags": [ @@ -551,7 +551,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689364.361 2140 10.105.33.214 TCP_MISS/200 407 GET http://insider.msg.yahoo.com/ycontent/beacon.php adeolaegbedokun DIRECT/68.142.231.252 image/gif", "tags": [ @@ -560,7 +560,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689364.402 7 10.105.33.214 TCP_IMS_HIT/304 219 GET http://us.ent1.yimg.com/images.launch.yahoo.com/000/032/457/32457654.jpg adeolaegbedokun NONE/- image/jpeg", "tags": [ @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689364.411 8 10.105.33.214 TCP_HIT/200 10593 GET http://us.news1.yimg.com/us.yimg.com/p/ap/20060906/thumb.71d29ded334347c48ac88433d033c9a9.pakistan_bin_laden_nyol440.jpg adeolaegbedokun NONE/- image/jpeg", "tags": [ @@ -578,7 +578,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689365.312 2420 10.105.33.214 TCP_MISS/302 1270 POST http://radio.launch.yahoo.com/radio/play/authplay.asp adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -587,7 +587,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689366.377 1966 10.105.33.214 TCP_MISS/200 10519 GET http://us.news1.yimg.com/us.yimg.com/p/ap/20060908/thumb.443f57762d7349669f609fbf0c97a5f1.academy_awards_host_cacp101.jpg adeolaegbedokun DIRECT/213.160.98.159 image/jpeg", "tags": [ @@ -596,7 +596,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689368.080 1703 10.105.33.214 TCP_MISS/200 515 GET http://radio.music.yahoo.com/radio/player/ymsgr/initstationfeed.asp? adeolaegbedokun DIRECT/68.142.219.132 text/xml", "tags": [ @@ -605,7 +605,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689368.370 3057 10.105.33.214 TCP_MISS/200 14411 GET http://radio.music.yahoo.com/radio/player/ymsgr/initstationfeed.asp? adeolaegbedokun DIRECT/68.142.219.132 text/xml", "tags": [ @@ -614,7 +614,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689368.889 808 10.105.33.214 TCP_MISS/200 1627 GET http://radio.launch.yahoo.com/radio/play/authplay.asp? adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -623,7 +623,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689369.097 1226 10.105.37.65 TCP_DENIED/407 1728 GET http://natrocket.kmip.net:5288/iesocks? - NONE/- text/html", "tags": [ @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689369.702 0 10.105.37.65 TCP_DENIED/407 1725 GET http://natrocket.kmip.net:5288/return? - NONE/- text/html", "tags": [ @@ -641,7 +641,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689370.125 1202 10.105.33.214 TCP_MISS/200 13124 GET http://us.news1.yimg.com/us.yimg.com/p/ap/20060907/thumb.1caf18e56db54eafb16da58356eb3382.amazon_com_online_video_watw101.jpg adeolaegbedokun DIRECT/213.160.98.159 image/jpeg", "tags": [ @@ -650,7 +650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689370.862 736 10.105.33.214 TCP_MISS/302 912 GET http://radio.launch.yahoo.com/radio/clientdata/515/starter.asp? adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -659,7 +659,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689371.690 828 10.105.33.214 TCP_MISS/200 1450 GET http://radio.launch.yahoo.com/radio/player/default.asp? adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -668,7 +668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689371.987 3617 10.105.33.214 TCP_MISS/200 30432 GET http://us.a2.yimg.com/us.yimg.com/a/ya/yahoo_messenger/081106_lrec_msgr_interophitchhiker.swf? adeolaegbedokun DIRECT/213.160.98.152 application/x-shockwave-flash", "tags": [ @@ -677,7 +677,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689373.315 1626 10.105.33.214 TCP_MISS/200 14643 GET http://radio.launch.yahoo.com/radio/player/stickwall.asp? adeolaegbedokun DIRECT/68.142.219.132 text/html", "tags": [ @@ -686,7 +686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689374.065 2078 10.105.33.214 TCP_MISS/200 425 GET http://us.bc.yahoo.com/b? adeolaegbedokun DIRECT/68.142.213.132 image/gif", "tags": [ @@ -695,7 +695,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689376.221 2130 10.105.33.214 TCP_MISS/200 407 GET http://insider.msg.yahoo.com/ycontent/beacon.php;_ylc=X1MDNTcwMzAyODMEX3IDMgRldnQDdDAEaW50bAN1cwR2ZXIDNywwLDIsMTIw? adeolaegbedokun DIRECT/68.142.194.14 image/gif", "tags": [ @@ -704,7 +704,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689377.171 3412 10.105.33.214 TCP_MISS/200 1476 CONNECT pclick.internal.yahoo.com:443 adeolaegbedokun DIRECT/216.109.124.55 -", "tags": [ @@ -713,7 +713,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689377.191 11 10.105.33.214 TCP_IMS_HIT/304 233 GET http://a1568.g.akamai.net/7/1568/1600/20051025184124/radio.launch.yahoo.com/radioapi/includes/js/compVersionedJS/rapiBridge_1_4.js adeolaegbedokun NONE/- application/x-javascript", "tags": [ @@ -722,7 +722,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689377.424 1159 10.105.33.214 TCP_MISS/304 236 GET http://a1568.g.akamai.net/7/1568/1600/20040405222754/radio.launch.yahoo.com/radio/clientdata/515/other.css adeolaegbedokun DIRECT/213.160.98.159 text/css", "tags": [ @@ -731,7 +731,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689378.221 797 10.105.33.214 TCP_MISS/304 238 GET http://a1568.g.akamai.net/7/1568/1600/20040405222757/radio.launch.yahoo.com/radio/clientdata/515/skins/1/images/bg_left.gif adeolaegbedokun DIRECT/213.160.98.159 image/gif", "tags": [ @@ -740,7 +740,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689378.473 3288 10.105.21.199 TCP_MISS/200 2681 CONNECT login.yahoo.com:443 badeyek DIRECT/209.73.177.115 -", "tags": [ @@ -749,7 +749,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689378.909 1405 10.105.33.214 TCP_MISS/304 136 GET http://a1568.g.akamai.net/7/1568/1600/20050829181418/radio.launch.yahoo.com/radio/common_radio/resources/images/noaccess_msgr_uk.gif adeolaegbedokun DIRECT/213.160.98.167 -", "tags": [ @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689378.924 702 10.105.33.214 TCP_MISS/304 237 GET http://a1568.g.akamai.net/7/1568/1600/20040405222757/radio.launch.yahoo.com/radio/clientdata/515/skins/1/images/bg_right.gif adeolaegbedokun DIRECT/213.160.98.159 image/gif", "tags": [ @@ -767,7 +767,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689378.929 4 10.105.33.214 TCP_IMS_HIT/304 218 GET http://a1568.g.akamai.net/7/1568/1600/20040405222807/radio.launch.yahoo.com/radio/common_radio/resources/images/t.gif adeolaegbedokun NONE/- image/gif", "tags": [ @@ -776,7 +776,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689379.472 563 10.105.33.214 TCP_MISS/304 238 GET http://a1568.g.akamai.net/7/1568/1600/20040405222757/radio.launch.yahoo.com/radio/clientdata/515/skins/1/images/bg_controls_off.gif adeolaegbedokun DIRECT/213.160.98.167 image/gif", "tags": [ @@ -785,7 +785,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689379.488 560 10.105.33.214 TCP_MISS/304 238 GET http://a1568.g.akamai.net/7/1568/1600/20040405222756/radio.launch.yahoo.com/radio/clientdata/515/skins/1/images/bg_center.gif adeolaegbedokun DIRECT/213.160.98.159 image/gif", "tags": [ @@ -794,7 +794,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689380.159 685 10.105.33.214 TCP_MISS/304 238 GET http://a1568.g.akamai.net/7/1568/1600/20040405222757/radio.launch.yahoo.com/radio/clientdata/515/skins/1/images/bg_controls_fill.gif adeolaegbedokun DIRECT/213.160.98.167 image/gif", "tags": [ @@ -803,7 +803,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689381.267 1 10.105.37.180 TCP_DENIED/407 1728 GET http://www.google.com/supported_domains - NONE/- text/html", "tags": [ @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689381.659 0 10.105.47.191 TCP_DENIED/407 1782 GET http://us.mcafee.com/apps/agent/en-us/agent5/chknews.asp? - NONE/- text/html", "tags": [ @@ -821,7 +821,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689381.660 2171 10.105.33.214 TCP_MISS/200 449 GET http://launch.adserver.yahoo.com/l? adeolaegbedokun DIRECT/216.109.125.112 image/gif", "tags": [ @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689382.173 3700 10.105.21.199 TCP_MISS/200 11746 GET http://uk.f250.mail.yahoo.com/dc/launch? badeyek DIRECT/217.12.10.96 text/html", "tags": [ @@ -839,7 +839,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689382.622 1 10.105.37.180 TCP_DENIED/407 1670 CONNECT login.live.com:443 - NONE/- text/html", "tags": [ @@ -848,7 +848,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689384.316 2828 10.105.21.199 TCP_SWAPFAIL_MISS/200 633 GET http://us.js2.yimg.com/us.js.yimg.com/lib/pim/r/dclient/d/js/uk/77cf3e56414f974dfd8616f56f0f632c_1.js badeyek DIRECT/213.160.98.169 application/x-javascript", "tags": [ @@ -857,7 +857,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689385.714 1397 10.105.21.199 TCP_HIT/200 1742 GET http://us.js1.yimg.com/us.yimg.com/lib/hdr/ygma5.css badeyek NONE/- text/css", "tags": [ @@ -866,7 +866,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689387.690 1977 10.105.21.199 TCP_MISS/200 14561 GET http://us.js2.yimg.com/us.js.yimg.com/lib/pim/r/dclient/d/js/uk/f7fc76100697c9c2d25dd0ec35e563b0_1.js badeyek DIRECT/213.160.98.169 application/x-javascript", "tags": [ @@ -875,7 +875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689387.771 80 10.105.21.199 TCP_HIT/200 68733 GET http://us.js1.yimg.com/us.yimg.com/lib/pim/r/medici/13_15/mail/ac.js badeyek NONE/- application/x-javascript", "tags": [ @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689387.830 1 10.105.21.199 TCP_HIT/200 898 GET http://us.js2.yimg.com/us.js.yimg.com/lib/common/utils/2/yahoo_2.0.0-b4.js badeyek NONE/- application/x-javascript", "tags": [ @@ -893,7 +893,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "1157689387.832 60 10.105.21.199 TCP_HIT/200 26803 GET http://us.i1.yimg.com/us.yimg.com/i/us/pim/dclient/d/img/liam_ball_1.gif badeyek NONE/- image/gif", "tags": [ diff --git a/packages/squid/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json b/packages/squid/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json index 1400faa01e8..2f114547fa8 100644 --- a/packages/squid/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json +++ b/packages/squid/data_stream/log/_dev/test/pipeline/test-generated.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.251.224.219 7337 [29/Jan/2016:6:09:59 nto] \"PROPFIND https://example.org/exercita/der.htm?odoco=ria#min ite\" 10.234.224.44 etdo tation \"quasiarc\" liqua ciade 5699 \"https://example.net/umq/ntium.gif?nes=eab#aliqu\" \"Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;]\" deny", "tags": [ @@ -11,7 +11,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.102.123.34 7178 [12/Feb/2016:1:12:33 nostrud] \"PURGE https://www.example.org/enderitq/sperna.txt?billoi=oreetdol#nidolor tatemU\" 10.70.36.222 estlabo doeiu \"nia\" olupt volup 208 \"https://example.com/eosquir/orsi.txt?itessequ=vol#luptat\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" deny", "tags": [ @@ -20,7 +20,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.15.135.248 7269 [26/Feb/2016:8:15:08 mquia] \"OPTIONS https://internal.example.com/aqu/utper.jpg?eFinib=omm#iin proident\" 10.142.172.64 lupt tia \"oloremqu\" temvel iatu 5493 \"https://example.net/dolo/meumfug.gif?roinBCS=ufugiatn#tionulam\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" accept", "tags": [ @@ -29,7 +29,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.44.134.153 5162 [12/Mar/2016:3:17:42 nci] \"GET https://api.example.org/ceroinBC/ratvolup.gif?iatu=ionofde#con uia\" quiavo 1156 \"https://mail.example.com/consec/taliquip.html?radip=tNequ#gelit\" \"Mozilla/5.0 (Linux; Android 9; 5024D_RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36 YaApp_Android/10.61 YaSearchBrowser/10.61\" allow 10.81.122.126 taev 160.145000", "tags": [ @@ -38,7 +38,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.160.95.56 1980 [26/Mar/2016:10:20:16 aqui] \"PUT https://api.example.org/isetq/estqui.gif?magn=equuntu#eos enimad\" 10.171.175.51 boreet onev \"tenima\" laboreet aquaeabi 5738 \"https://api.example.net/veleumi/tia.gif?ude=maveniam#uian\" \"Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" cancel", "tags": [ @@ -47,7 +47,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.175.107.139 4243 [09/Apr/2016:5:22:51 antium] \"HEAD https://www.example.org/inesci/rsitvolu.txt?pori=occ#ect reetdolo\" 10.12.195.60 uiano mrema \"autfu\" natura aboris 2946 \"https://api.example.com/ssitaspe/gitsedqu.jpg?iutal=dexe#urerep\" \"Mozilla/5.0 (Linux; Android 9; ZTE Blade V1000RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" accept", "tags": [ @@ -56,7 +56,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.198.136.50 6875 [24/Apr/2016:12:25:25 llam] \"DELETE https://www5.example.com/ari/eataevit.txt?iam=mqua#atat quunt\" 10.207.249.121 iciade tsed \"orai\" mUt usmodte 1296 \"https://www.example.org/ametcons/porainc.jpg?temsequ=emquiavo#nonnu\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" allow", "tags": [ @@ -65,7 +65,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.34.9.93 124 [08/May/2016:7:27:59 onse] \"PROPFIND https://example.org/tatno/imav.htm?ofdeF=tion#orsitame quiratio\" 10.116.120.216 qua umdo \"sed\" apariat mol 1510 \"https://internal.example.net/turveli/toccae.htm?erc=taliqu#temUten\" \"Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36\" accept", "tags": [ @@ -74,7 +74,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.90.131.186 6343 [22/May/2016:2:30:33 nimadmin] \"HEAD https://example.org/uaera/sitas.txt?aedic=atquovo#iumto aboreetd\" 10.30.216.41 enim saute \"vel\" quu undeo 5794 \"https://mail.example.net/atuse/ddoeiu.gif?idolore=onse#liq\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" accept", "tags": [ @@ -83,7 +83,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.8.88.110 7618 [05/Jun/2016:9:33:08 ionul] \"CONNECT https://mail.example.org/edquiano/loru.htm?end=enia#nsequu cup\" 10.203.172.203 idestla Nemoeni \"uradi\" aborumSe luptat 6884 \"https://www5.example.org/strude/ctetura.htm?ittenbyC=aperi#lor\" \"Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -92,7 +92,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.71.34.9 267 [20/Jun/2016:4:35:42 dolore] \"UNLOCK https://www.example.org/iqui/etc.txt?tatiset=eprehen#xercitat lpa\" 10.158.185.163 rudexerc aliq \"rsitam\" quam adm 987 \"https://www.example.org/ritatis/oloremi.txt?icab=mwr#fugi\" \"Mozilla/5.0 (Linux; U; Android 7.1.2; uz-uz; Redmi 4X Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/71.0.3578.141 Mobile Safari/537.36 XiaoMi/MiuiBrowser/12.2.3-g\" allow", "tags": [ @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.210.74.24 6423 [04/Jul/2016:11:38:16 untut] \"OPTIONS https://internal.example.net/ommod/sequatur.txt?tlabo=suntexp#ugiatnu stiae\" 10.201.76.240 amqu uines \"nsec\" onse emips 2655 \"https://example.net/tion/eataev.htm?uiineavo=tisetq#irati\" \"Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10\" accept", "tags": [ @@ -110,7 +110,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.114.138.121 1939 [18/Jul/2016:6:40:50 tati] \"COPY https://api.example.org/oriosamn/deFinibu.gif?iciatisu=rehender#eporroqu uat\" 10.206.136.206 suntinc xeac \"nidolo\" tatn eli 6462 \"https://www.example.net/pida/nse.html?emeumfu=CSed#lupt\" \"Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" deny", "tags": [ @@ -119,7 +119,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.200.199.166 3727 [02/Aug/2016:1:43:25 amvolup] \"COPY https://mail.example.org/rehend/tio.html?numqu=qui#civeli lum\" 10.134.161.118 tat ipitla \"quae\" maccusa uptat 3458 \"https://www.example.com/xerci/aqu.htm?olorema=iades#siarchi\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36\" block", "tags": [ @@ -128,7 +128,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.122.46.71 2807 [16/Aug/2016:8:45:59 ihilm] \"NONE https://www.example.org/eav/ionevo.txt?siar=orev#iamquis quirat\" 10.76.3.41 isc aturve \"emulla\" mpori aaliquaU 2989 \"https://www5.example.com/ern/psaquae.html?nsectet=utla#utei\" \"Mozilla/5.0 (Linux; Android 8.0.0; VS996) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" allow", "tags": [ @@ -137,7 +137,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.164.250.63 2530 [30/Aug/2016:3:48:33 eritqu] \"PROPFIND https://internal.example.net/wri/bor.jpg?hitect=dol#leumiu namali\" 10.249.213.83 nsecte itame \"eumfug\" lit asun 1250 \"https://api.example.com/oluptate/onseq.html?labore=texp#tMalor\" \"Mozilla/5.0 (Linux; Android 6.0; Lenovo A2016a40 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.106 Mobile Safari/537.36 YaApp_Android/10.30 YaSearchBrowser/10.30\" accept", "tags": [ @@ -146,7 +146,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.61.242.75 2591 [13/Sep/2016:10:51:07 dantiumt] \"HEAD https://api.example.net/equat/doloreme.htm?ione=ihilmole#eriamea amre\" 10.236.248.65 pisciv iquidex \"radipisc\" tmo fficiade 3280 \"https://www5.example.net/uioffi/oru.jpg?one=etMalor#ipi\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" cancel", "tags": [ @@ -155,7 +155,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.13.59.31 5685 [28/Sep/2016:5:53:42 sperna] \"PUT https://www5.example.com/estia/tper.gif?volupt=osqui#xerc iutali\" 10.214.7.83 liquide etdol \"uela\" boN eprehend 2462 \"https://internal.example.net/lamcolab/ati.jpg?gel=lorsitam#mpo\" \"Mozilla/5.0 (Linux; Android 9; LG-US998) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" block", "tags": [ @@ -164,7 +164,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.89.201.140 2447 [12/Oct/2016:12:56:16 uamei] \"GET https://internal.example.net/sin/rvel.htm?nimid=itatione#isnis uptasn\" 10.49.92.179 osamn isnisiu \"bore\" tsu tcons 3128 \"https://api.example.org/lorinre/olorsita.gif?idata=rumwritt#magnid\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" accept", "tags": [ @@ -173,7 +173,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.235.7.92 5787 [26/Oct/2016:7:58:50 nsecte] \"PURGE https://api.example.org/abo/veniamqu.gif?aliquide=ofde#equat derit\" 10.90.86.89 piscin lapar \"laboree\" tfu udan 5516 \"https://mail.example.net/xeacomm/mveleu.htm?utlabor=rau#idex\" \"Mozilla/5.0 (Linux; Android 6.0; QMobile X700 PRO II) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36\" deny", "tags": [ @@ -182,7 +182,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.14.211.43 4762 [10/Nov/2016:3:01:24 eiu] \"PROPFIND https://api.example.org/autfu/gnaaliq.jpg?olupta=litse#icabo itatio\" 10.14.48.16 sintoc volupt \"siste\" uiinea Utenima 1612 \"https://www5.example.net/ptatem/Nequepor.html?ugiatnu=ciati#nto\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" cancel", "tags": [ @@ -191,7 +191,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.47.25.230 5491 [24/Nov/2016:10:03:59 ese] \"CONNECT https://internal.example.net/ptatemq/luptatev.html?Nequepo=ipsumd#ntocc uteirure\" 10.93.123.174 evelit reetdolo \"smo\" etcons iusmodi 1563 \"https://example.com/uiac/epte.gif?itam=aper#santiumd\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" block", "tags": [ @@ -200,7 +200,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.7.46.36 837 [08/Dec/2016:5:06:33 nonn] \"MKOL https://www5.example.net/quiavol/rrorsi.gif?iatisu=sec#cons sBon\" 10.233.48.103 leumiur tlab \"aperiame\" isc ullamcor 584 \"https://www5.example.com/tateve/itinvol.txt?tenatus=cipitlab#ipsumd\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" cancel", "tags": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.93.220.10 2805 [23/Dec/2016:12:09:07 com] \"PROPATCH https://api.example.net/orain/tiumt.jpg?litessec=itas#edquia sequatu\" 10.27.58.92 amvo qui \"tasn\" Nemoenim squirati 63 \"https://mail.example.com/nbyCic/utlabor.html?iciade=ntiumt#iquipe\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" accept", "tags": [ @@ -218,7 +218,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.213.144.249 4427 [06/Jan/2017:7:11:41 taedicta] \"PURGE https://www.example.net/str/idolore.txt?eetdolo=cteturad#untut uamni\" 10.135.217.12 metMalo ntexplic \"archite\" loreme untu 5676 \"https://example.net/con/nisist.gif?ium=esciuntN#idunt\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" block", "tags": [ @@ -227,7 +227,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.13.226.57 3275 [20/Jan/2017:2:14:16 runtm] \"PURGE https://mail.example.net/velitse/oditem.html?torever=oremi#mestq temUt\" 10.233.239.112 npr mquelau \"iadolor\" amcol adeser 3780 \"https://internal.example.com/tqu/reprehen.gif?quam=quid#fugiat\" \"Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36\" cancel", "tags": [ @@ -236,7 +236,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.161.203.252 301 [03/Feb/2017:9:16:50 emquia] \"CONNECT https://internal.example.org/isnisi/ritatise.gif?tamet=quatur#uisa eFi\" 10.21.169.127 rpori ice \"oles\" edic seq 2835 \"https://example.com/tatn/dolorsit.jpg?billo=labo#oNemoeni\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -245,7 +245,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.17.215.111 148 [18/Feb/2017:4:19:24 ratv] \"LOCK https://www.example.net/ianon/tsed.htm?ameiusm=proide#ano piscinge\" 10.69.139.26 ditemp edqui \"nre\" veli volupta 7124 \"https://api.example.com/ersp/enderi.jpg?adi=umwrit#uptate\" \"Mozilla/5.0 (Linux; Android 6.0; Lenovo A2016a40 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.106 Mobile Safari/537.36 YaApp_Android/10.30 YaSearchBrowser/10.30\" block", "tags": [ @@ -254,7 +254,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.10.213.83 7206 [04/Mar/2017:11:21:59 nisi] \"COPY https://www5.example.org/ncididun/umSe.jpg?ise=itau#apariat vitaedi\" 10.104.80.189 dolore onsecte \"nBCSedut\" ugiat onulam 1542 \"https://mail.example.org/oditautf/quatu.jpg?lumdolor=nonp#labo\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.125.131.91 3480 [18/Mar/2017:6:24:33 urv] \"UNLOCK https://example.org/uatur/adminimv.gif?exeacom=roidents#tem dol\" 10.116.230.217 mvele isis \"uasiar\" utlab emUteni 7122 \"https://api.example.org/lor/velillu.html?dolorem=tvolu#nreprehe\" \"Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16\" block", "tags": [ @@ -272,7 +272,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.26.96.202 2751 [02/Apr/2017:1:27:07 rautodi] \"ICP_QUERY https://api.example.com/ven/rQu.html?doloreme=dun#reprehe tincu\" 10.119.90.128 lor oraincid \"intocc\" amcorp ntsunt 4826 \"https://mail.example.com/olo/psumqu.txt?fdeF=iquidexe#diconse\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" cancel", "tags": [ @@ -281,7 +281,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.0.98.205 126 [16/Apr/2017:8:29:41 edquiac] \"HEAD https://api.example.net/eseru/quamest.html?qua=rsita#ate ipsamvo\" 10.76.110.144 tdol upt \"mex\" tatem untutlab 3386 \"https://mail.example.com/plicab/oremq.html?uisaute=imide#poriss\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36\" deny", "tags": [ @@ -290,7 +290,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.224.11.165 1646 [30/Apr/2017:3:32:16 nof] \"MOVE https://internal.example.org/mvolu/conse.txt?aincidu=nimadmin#isiu licabo\" 10.135.46.242 lupta xeaco \"nvolupt\" oremi elites 1940 \"https://www.example.org/boNemoe/onsequ.html?amvolupt=onevolu#mnis\" \"Mozilla/5.0 (Linux; Android 6.0; QMobile X700 PRO II) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36\" deny", "tags": [ @@ -299,7 +299,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.27.44.4 4686 [14/May/2017:10:34:50 sequatD] \"TRACE https://internal.example.org/isciv/rroqu.html?uisa=tametco#ilmol eri\" 10.154.53.249 tae autodit \"elit\" cidunt plica 7398 \"https://internal.example.org/emqu/nderi.html?accusant=onse#admin\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" accept", "tags": [ @@ -308,7 +308,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.93.39.140 4275 [29/May/2017:5:37:24 ute] \"COPY https://www5.example.net/uaeratv/isa.txt?periam=dqu#pid rExc\" 10.150.245.88 orisn reetd \"prehen\" ntutlabo iusmodte 1738 \"https://example.org/isc/Nequepor.txt?rem=idid#tesse\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36\" cancel", "tags": [ @@ -317,7 +317,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.61.92.2 6595 [12/Jun/2017:12:39:58 maliquam] \"UNLOCK https://www5.example.com/orroq/vitaedic.txt?orisni=ons#remagn ecillu\" 10.73.207.70 llamco atu \"untincul\" ssecil commodi 3023 \"https://mail.example.net/tate/onevo.htm?emvele=isnost#olorem\" \"Mozilla/5.0 (Linux; Android 6.0; Lenovo A2016a40 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.106 Mobile Safari/537.36 YaApp_Android/10.30 YaSearchBrowser/10.30\" block", "tags": [ @@ -326,7 +326,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.84.32.178 5271 [26/Jun/2017:7:42:33 aliq] \"GET https://example.net/mven/olorsit.gif?oremag=illu#ruredo mac\" temUt 2741 \"https://internal.example.com/uamnihi/risnis.html?scingeli=isn#sBono\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" allow 10.50.124.116 numquam 104.719000", "tags": [ @@ -335,7 +335,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.173.222.131 918 [11/Jul/2017:2:45:07 ori] \"TRACE https://www5.example.net/rum/eataevi.html?ulla=iqu#oin hil\" 10.211.234.224 uiadol Duisa \"lupta\" aUt boNem 5564 \"https://api.example.org/maveni/onevo.htm?liquaUte=alorum#obeataev\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -344,7 +344,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.11.83.126 6581 [25/Jul/2017:9:47:41 naaliq] \"PROPFIND https://mail.example.net/osquir/mod.txt?fugitse=imad#tinvolup tsed\" 10.0.157.225 itam atu \"lloin\" remipsum tempor 1282 \"https://www5.example.net/incidid/rure.htm?edquian=loremeu#aturve\" \"Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" deny", "tags": [ @@ -353,7 +353,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.228.77.21 6889 [08/Aug/2017:4:50:15 lamc] \"PUT https://api.example.com/asper/umq.txt?itasper=uae#mve uia\" 10.92.237.93 mad onse \"redol\" gnaa mod 5107 \"https://www5.example.com/toditaut/voluptat.htm?strumex=eprehend#asnu\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" cancel", "tags": [ @@ -362,7 +362,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.102.215.23 3665 [22/Aug/2017:11:52:50 esseq] \"POST https://www5.example.net/quatD/isqua.jpg?oloreseo=iruredol#veniamqu licaboN\" 10.20.28.92 econs ntexpl \"dunt\" litsedq nderiti 409 \"https://api.example.com/Cic/olorema.txt?iscive=quasiar#aeab\" \"Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16\" allow", "tags": [ @@ -371,7 +371,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.45.28.159 5627 [06/Sep/2017:6:55:24 ree] \"NONE https://api.example.net/ation/luptas.html?iatqu=lorsi#repreh plic\" 10.17.87.79 tetur tionula \"ritqu\" ecatcupi uamei 4595 \"https://www5.example.com/onse/olorem.gif?duntutla=ntium#iration\" \"Mozilla/5.0 (Linux; Android 7.0; SM-S337TL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" block", "tags": [ @@ -380,7 +380,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.177.238.45 5137 [20/Sep/2017:1:57:58 ssusci] \"DELETE https://internal.example.com/mpo/unte.jpg?ueipsa=scipitl#eumi quasiarc\" 10.189.94.51 tetura rsp \"oluptat\" metco acom 5704 \"https://api.example.com/tem/exeacomm.txt?taliqui=mides#ciun\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36\" allow", "tags": [ @@ -389,7 +389,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.46.77.76 5169 [04/Oct/2017:9:00:32 anim] \"GET https://www.example.org/uov/quaeab.jpg?moles=dipiscin#olup aco\" 10.101.85.169 natu liquid \"enim\" Finibus radi 5697 \"https://example.com/taed/umdolo.html?rroqu=dquiaco#nibus\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.122 YaBrowser/20.3.0.2221 Yowser/2.5 Safari/537.36\" accept", "tags": [ @@ -398,7 +398,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.24.54.129 77 [19/Oct/2017:4:03:07 eprehend] \"HEAD https://example.net/edolo/ugiatquo.jpg?eosquira=pta#snos orsi\" 10.231.7.209 lorsita eavol \"osamnis\" temaccu scipitl 1247 \"https://www5.example.org/caboNem/urExcept.txt?litesseq=atcupida#tessequa\" \"Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36\" block", "tags": [ @@ -407,7 +407,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.121.163.5 7803 [02/Nov/2017:11:05:41 redol] \"CONNECT https://api.example.org/isci/dolor.htm?orinrep=quiavol#nrepreh ratv\" 10.77.129.175 tali BCS \"qui\" ugiatquo incidid 2617 \"https://www.example.com/sBonor/fugits.jpg?amc=vol#admi\" \"Mozilla/5.0 (Linux; Android 9; LG-US998) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" allow", "tags": [ @@ -416,7 +416,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.51.236.148 329 [16/Nov/2017:6:08:15 adol] \"PROPFIND https://mail.example.com/roide/tem.gif?rerepre=nculpaq#culpaqui tvolup\" 10.116.146.114 col obea \"emp\" agnaaliq est 1444 \"https://www.example.com/inculp/onofd.gif?umdolors=dolori#asperna\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" deny", "tags": [ @@ -425,7 +425,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.244.108.135 6997 [01/Dec/2017:1:10:49 ume] \"NONE https://internal.example.net/rautod/olest.jpg?lapar=ritati#edquia itesse\" 10.217.222.99 ame amvolu \"mip\" tion tobeatae 2512 \"https://api.example.com/iqua/luptat.txt?oremqu=uradi#velitsed\" \"Mozilla/5.0 (Linux; Android 6.0; U20 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.147 Mobile Safari/537.36 YaApp_Android/10.90 YaSearchBrowser/10.90\" block", "tags": [ @@ -434,7 +434,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.4.69.152 3833 [15/Dec/2017:8:13:24 scivel] \"PUT https://api.example.org/iusmodt/enim.txt?aquio=ersp#iame orroquis\" 10.150.198.112 ntmoll mexer \"estla\" uipexe abor 1370 \"https://www.example.net/remips/illoi.jpg?abori=uisnostr#reetdol\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" block", "tags": [ @@ -443,7 +443,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.45.114.111 357 [29/Dec/2017:3:15:58 olup] \"POST https://example.org/abillo/undeom.html?oraincid=quaer#eetdo tlab\" 10.45.54.107 seddoeiu nse \"aali\" edictasu mdolors 7490 \"https://www5.example.org/atis/atDuis.txt?nisiut=rumwri#velill\" \"Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;]\" accept", "tags": [ @@ -452,7 +452,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.49.242.174 4078 [12/Jan/2018:10:18:32 tat] \"TRACE https://mail.example.net/uam/orumSec.jpg?isnisiu=suntincu#sse venia\" 10.205.28.24 oeni untutlab \"tvolup\" consecte pteurs 742 \"https://www5.example.net/ons/tiaecon.html?unt=tass#tiumdol\" \"Mozilla/5.0 (Linux; Android 6.0; U20 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.147 Mobile Safari/537.36 YaApp_Android/10.90 YaSearchBrowser/10.90\" allow", "tags": [ @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.17.202.219 487 [27/Jan/2018:5:21:06 iame] \"HEAD https://www5.example.org/umiurer/rere.txt?mnisi=usmo#iamea imaveni\" 10.183.223.149 cor odoco \"oin\" itseddoe elites 6366 \"https://mail.example.com/eursinto/litesse.html?licaboNe=tautfug#giatquov\" \"Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10\" deny", "tags": [ @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.81.140.173 7623 [10/Feb/2018:12:23:41 itae] \"MOVE https://internal.example.net/atnula/ditautf.jpg?iquidex=olup#remipsu tan\" 10.88.172.222 doconse etdol \"dolorsi\" nturmag tura 6695 \"https://internal.example.org/totam/ntoccae.htm?idunt=atqu#naturau\" \"mobmail android 2.1.3.3150\" cancel", "tags": [ @@ -479,7 +479,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.162.129.196 4247 [24/Feb/2018:7:26:15 snisi] \"OPTIONS https://api.example.net/uscip/umS.txt?quiacons=uisa#xeacommo Cicero\" 10.247.53.179 issu identsu \"piscivel\" hend eacommo 6835 \"https://example.com/osquira/umd.gif?scipi=tur#acon\" \"mobmail android 2.1.3.3150\" accept", "tags": [ @@ -488,7 +488,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.110.86.230 536 [11/Mar/2018:2:28:49 eFini] \"UNLOCK https://mail.example.com/mrema/ullamc.txt?eufug=roquisq#temporai uido\" 10.172.148.223 snulap enimadm \"stenatu\" upta atc 3066 \"https://www5.example.net/asnulap/ipi.htm?orissu=fic#sBon\" \"Mozilla/5.0 (Linux; Android 5.1.1; Android Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36 YaApp_Android/9.80 YaSearchBrowser/9.80\" accept", "tags": [ @@ -497,7 +497,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.93.159.170 3481 [25/Mar/2018:9:31:24 emullam] \"GET https://www5.example.com/isau/itinvol.txt?saquaea=ons#orsitam modico\" 10.232.19.43 porinc riame \"riat\" sseq eriam 729 \"https://internal.example.net/imve/essequam.gif?urQuis=etcon#onsequu\" \"Mozilla/5.0 (Linux; Android 6.0; QMobile X700 PRO II) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36\" deny", "tags": [ @@ -506,7 +506,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.207.97.192 973 [08/Apr/2018:4:33:58 emp] \"ICP_QUERY https://api.example.net/veli/venia.htm?etdolor=uat#onemulla riaturEx\" 10.55.55.72 nculp asp \"eacom\" mag gelitse 2007 \"https://example.net/lab/llumq.htm?tetura=rumet#uptasnul\" \"Mozilla/5.0 (Linux; Android 7.0; SM-S337TL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" cancel", "tags": [ @@ -515,7 +515,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.41.156.88 203 [22/Apr/2018:11:36:32 oco] \"MOVE https://internal.example.net/ainci/osqu.jpg?sus=imavenia#expli ugiat\" 10.89.73.240 orem ntorever \"pisciv\" fugiatqu seos 5561 \"https://www5.example.net/elillum/veleumi.gif?tvol=oluptate#lit\" \"Mozilla/5.0 (Linux; Android 9; 5024D_RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36 YaApp_Android/10.61 YaSearchBrowser/10.61\" deny", "tags": [ @@ -524,7 +524,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.54.44.231 5292 [07/May/2018:6:39:06 aco] \"CONNECT https://www.example.org/runtm/eturadip.htm?psumd=oloree#seos rios\" 10.101.183.86 mvenia mcorpo \"ntexpl\" abor oreverit 6451 \"https://internal.example.net/tat/eufugia.htm?tau=fficia#est\" \"Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10\" allow", "tags": [ @@ -533,7 +533,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.181.177.74 3378 [21/May/2018:1:41:41 itsedd] \"LOCK https://internal.example.org/liquipex/uisnos.html?ventor=lupt#umwri odoc\" 10.130.150.189 oreeu nvo \"iamqui\" tassita colabori 1223 \"https://www.example.net/lpa/isn.htm?iat=ffic#siuta\" \"Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -542,7 +542,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.76.220.3 2492 [04/Jun/2018:8:44:15 serrorsi] \"GET https://api.example.org/mquisnos/lore.txt?siar=isn#veniamq lup\" 10.83.130.95 ipitlabo userror \"eacommo\" nderi liqua 7030 \"https://api.example.net/henderit/remq.jpg?voluptas=velill#rspic\" \"Mozilla/5.0 (Linux; Android 4.1.2; Micromax P410i Build/JZO54K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36\" deny", "tags": [ @@ -551,7 +551,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.219.245.58 7073 [19/Jun/2018:3:46:49 snisiut] \"COPY https://www.example.com/quas/occaeca.htm?ender=dico#uptatem upt\" 10.166.160.217 olor radip \"rchitect\" Dui iameaqu 2429 \"https://api.example.com/asnulap/yCiceroi.jpg?ender=inc#tect\" \"Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16\" deny", "tags": [ @@ -560,7 +560,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.121.121.153 723 [03/Jul/2018:10:49:23 smoditem] \"UNLOCK https://www5.example.org/uidolo/umdolore.jpg?oquisq=abori#sit catcu\" 10.183.243.246 amni tatio \"amquisno\" modoc magnam 3267 \"https://example.com/idatat/onev.html?lesti=oreseo#reprehen\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" cancel", "tags": [ @@ -569,7 +569,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.54.5.47 1585 [17/Jul/2018:5:51:58 mmodi] \"OPTIONS https://internal.example.net/eniamqu/inimav.htm?imadm=uta#tisu remagnam\" 10.202.224.209 iusmodit aturv \"ectetura\" obeataev umf 3141 \"https://www.example.com/quaeabil/emip.htm?urExc=tDuis#iqu\" \"Mozilla/5.0 (Linux; Android 4.1.2; Micromax P410i Build/JZO54K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.111 Mobile Safari/537.36\" cancel", "tags": [ @@ -578,7 +578,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.72.99.69 3172 [01/Aug/2018:12:54:32 oremeumf] \"PROPFIND https://mail.example.net/sintocca/mipsumqu.htm?tnulapar=ico#giatquo lors\" 10.170.234.233 accus uatu \"mquis\" lab uido 2046 \"https://mail.example.com/tena/aal.jpg?CSedu=mcol#lup\" \"Mozilla/5.0 (Linux; Android 9; POCOPHONE F1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" allow", "tags": [ @@ -587,7 +587,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.245.240.47 4017 [15/Aug/2018:7:57:06 itaedict] \"DELETE https://api.example.org/rep/remap.html?siarc=fdeFin#eleumi edic\" 10.142.130.227 olabori odic \"iuta\" liquaUte scivelit 7795 \"https://internal.example.net/scipit/lloinve.htm?evolup=rvelil#isiutali\" \"Mozilla/5.0 (Linux; Android 9; ZTE Blade V1000RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" allow", "tags": [ @@ -596,7 +596,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.62.188.193 4104 [29/Aug/2018:2:59:40 atu] \"DELETE https://api.example.net/eturad/tDuis.htm?enimadmi=tateveli#osa mini\" 10.61.110.7 oremque quaU \"ufugi\" cin tmo 508 \"https://example.com/oremip/its.jpg?iavol=natuserr#ostrudex\" \"Mozilla/5.0 (compatible; Yahoo Ad monitoring; https://help.yahoo.com/kb/yahoo-ad-monitoring-SLN24857.html) yahoo.adquality.lwd.desktop/1591143192-10\" deny", "tags": [ @@ -605,7 +605,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.172.139.78 6533 [12/Sep/2018:10:02:15 lamco] \"COPY https://www.example.net/hender/ptatemU.htm?mquisnos=tnulapa#madmi tlabore\" 10.68.198.188 doeiu onsectet \"dentsunt\" inea animid 2119 \"https://mail.example.net/onnumqua/quioff.html?upt=atatnonp#nvol\" \"Mozilla/5.0 (Linux; Android 9; 5024D_RU Build/PPR1.180610.011) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36 YaApp_Android/10.61 YaSearchBrowser/10.61\" block", "tags": [ @@ -614,7 +614,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.172.47.7 2805 [27/Sep/2018:5:04:49 midest] \"CONNECT https://www.example.org/iduntutl/rsitam.htm?ntor=oinBCSed#oid rchit\" 10.169.63.169 ariat midestl \"quatu\" avolu teturad 3465 \"https://api.example.net/iquaUten/prehende.gif?rpo=velites#nonpro\" \"Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16\" block", "tags": [ @@ -623,7 +623,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.32.98.109 5012 [11/Oct/2018:12:07:23 dexercit] \"PURGE https://example.org/itessequ/porissu.html?uip=ectobea#dat aUtenima\" 10.62.10.137 eeufugi deomnisi \"olupta\" oll laboree 3880 \"https://api.example.org/cupidata/stiaecon.htm?rsint=itl#ttenb\" \"Mozilla/5.0 (Linux; Android 9; LG-US998) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" cancel", "tags": [ @@ -632,7 +632,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.176.62.146 5945 [25/Oct/2018:7:09:57 lors] \"COPY https://api.example.net/enimad/tis.txt?mipsumq=ident#nimide quelaud\" 10.255.40.12 rro oeiusmo \"nimv\" emeu tatemac 5192 \"https://www5.example.com/teursint/etMa.gif?lamcolab=ceroinB#umqui\" \"Mozilla/5.0 (Linux; Android 6.0; U20 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.147 Mobile Safari/537.36 YaApp_Android/10.90 YaSearchBrowser/10.90\" deny", "tags": [ @@ -641,7 +641,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.194.198.46 3387 [09/Nov/2018:2:12:32 cta] \"GET https://api.example.org/taspe/yCiceroi.htm?cti=ommodoc#nse mveniam\" tuser 2694 \"https://internal.example.com/tlaboru/aeabillo.txt?equuntu=quamni#turveli\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0]\" deny 10.88.98.31 rured 105.243000", "tags": [ @@ -650,7 +650,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.5.49.20 7503 [23/Nov/2018:9:15:06 macc] \"OPTIONS https://example.com/beat/rro.jpg?uisau=qua#iarchite emsequi\" 10.1.27.133 edqu tationu \"gnaaliq\" olore ntutlab 6881 \"https://www5.example.com/gnama/esciun.html?ratvo=ntutl#volupt\" \"Mozilla/5.0 (Linux; Android 6.0; Lenovo A2016a40 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.106 Mobile Safari/537.36 YaApp_Android/10.30 YaSearchBrowser/10.30\" block", "tags": [ @@ -659,7 +659,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.11.73.145 6972 [07/Dec/2018:4:17:40 uisautem] \"POST https://www5.example.org/loremq/turmagni.txt?emUtenim=ende#dexea aco\" 10.70.244.155 olorsi caboNemo \"uptas\" temaccus ons 2160 \"https://internal.example.com/ctetur/mvolupta.html?oreeu=mea#ssec\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0]\" accept", "tags": [ @@ -668,7 +668,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.204.214.98 985 [21/Dec/2018:11:20:14 equ] \"PURGE https://www5.example.net/deomnisi/ddoe.txt?oremi=ectobeat#ecte abo\" 10.121.80.158 boriosa cillumdo \"ditau\" moenimip uames 7663 \"https://internal.example.com/lor/oreeu.html?eturadip=nost#atus\" \"Mozilla/5.0 (Linux; Android 7.0; SM-S337TL) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" accept", "tags": [ @@ -677,7 +677,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.74.115.33 4006 [05/Jan/2019:6:22:49 nsequat] \"PURGE https://api.example.net/tiset/sci.jpg?rauto=doloreeu#lors eumfu\" 10.139.151.19 eumf roquisq \"uasi\" maveniam uis 5533 \"https://www.example.com/imi/animi.htm?ama=tatnonp#ntiumt\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" block", "tags": [ @@ -686,7 +686,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.191.220.1 6454 [19/Jan/2019:1:25:23 ctetura] \"DELETE https://api.example.net/tDuisau/aturve.htm?tper=pisciv#tconsect pariat\" 10.242.48.203 ctobeat isi \"idexeac\" ntu tdolo 3872 \"https://mail.example.com/olupt/ola.jpg?etquasia=qua#adm\" \"Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36\" deny", "tags": [ @@ -695,7 +695,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.109.88.27 5568 [02/Feb/2019:8:27:57 cidu] \"PROPATCH https://internal.example.com/oluptate/todi.jpg?tdolo=ident#scip eacommod\" 10.254.10.98 adipisc aparia \"maliq\" ccusant epteurs 6661 \"https://www5.example.org/oditau/onsec.gif?temqui=lup#aeca\" \"Mozilla/5.0 (Linux; Android 9; Pixel 3 Build/PD1A.180720.030) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Mobile Safari/537.36\" accept", "tags": [ @@ -704,7 +704,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.5.148.114 4749 [17/Feb/2019:3:30:32 ntin] \"LOCK https://mail.example.com/radipis/lore.html?civeli=eufugia#utlabore tamr\" 10.175.138.42 olore onemul \"trudexe\" remeum etur 890 \"https://mail.example.org/quiav/ctionofd.gif?Finibus=uisautei#nevolu\" \"Mozilla/5.0 (Linux; Android 6.0; ZTE BLADE V7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" deny", "tags": [ @@ -713,7 +713,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.0.0.240 1795 [03/Mar/2019:10:33:06 psa] \"PROPFIND https://internal.example.org/olupta/tio.jpg?idestl=litani#emp arch\" 10.18.199.203 ugits ittenb \"tobeatae\" ntut llum 366 \"https://example.com/equat/estiaec.htm?mquido=ende#ntmollit\" \"Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" allow", "tags": [ @@ -722,7 +722,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.1.220.47 6685 [17/Mar/2019:5:35:40 mipsamv] \"NONE https://www5.example.com/sequines/cto.gif?temaccu=uamqua#Neq runt\" 10.73.80.251 pteurs ercitati \"atem\" serro lumquid 5939 \"https://www5.example.org/imaveni/equ.htm?ssequamn=ave#taliqui\" \"Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;]\" allow", "tags": [ @@ -731,7 +731,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.153.109.61 7499 [01/Apr/2019:12:38:14 numq] \"PURGE https://www.example.net/periam/ain.gif?iquipex=mqu#onorume abill\" 10.22.34.206 mini mve \"tionev\" uasiarch velites 1745 \"https://api.example.org/equa/edquiaco.gif?olorsit=naaliq#plica\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" block", "tags": [ @@ -740,7 +740,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.62.168.226 5334 [15/Apr/2019:7:40:49 bori] \"CONNECT https://www.example.net/ecatc/quovolu.jpg?dexe=nemul#Duis lupt\" 10.199.103.185 uipe ipsa \"con\" eirured sequamn 5243 \"https://mail.example.com/ciatisun/duntutl.htm?didun=riaturEx#nde\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0]\" allow", "tags": [ @@ -749,7 +749,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.97.33.56 3541 [29/Apr/2019:2:43:23 rad] \"COPY https://example.com/tqui/ssequ.gif?emse=emqui#cipitla tlab\" 10.128.84.27 nula ptate \"volupta\" umfu utla 2478 \"https://www5.example.com/dolo/velites.gif?equa=apari#tsunt\" \"Mozilla/5.0 (Linux; Android 10; ASUS_X01BDA) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36\" block", "tags": [ @@ -758,7 +758,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.49.169.175 2103 [13/May/2019:9:45:57 sistena] \"HEAD https://example.com/caboN/imipsam.jpg?catcupid=ritquiin#quisnost sequines\" 10.115.154.104 illum ore \"spici\" Sedut tatis 7767 \"https://www5.example.com/sequines/minimve.gif?toditau=uiad#nvolupta\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" allow", "tags": [ @@ -767,7 +767,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.213.100.153 2571 [28/May/2019:4:48:31 iatquo] \"PROPFIND https://www.example.org/oinvento/ali.htm?utaliqui=isciv#osqu ptatemse\" 10.33.112.100 catcup enimad \"magnaali\" velillum ionev 1594 \"https://internal.example.com/ameaq/Quis.html?lestiae=iav#umiure\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" block", "tags": [ @@ -776,7 +776,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.216.143.226 2632 [11/Jun/2019:11:51:06 deomn] \"CONNECT https://api.example.net/quido/llo.htm?tpersp=assi#rch psa\" 10.25.53.93 tvolup oremeu \"lab\" lla urau 6127 \"https://example.net/equamni/atcupi.htm?onemull=mdo#labore\" \"Mozilla/5.0 (Linux; U; Android 4.0.3; es-us; GT-P3100 Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30\" cancel", "tags": [ @@ -785,7 +785,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.139.195.188 893 [25/Jun/2019:6:53:40 aliquaU] \"HEAD https://www.example.net/tvolu/imve.txt?gnaaliq=quam#deriti edictasu\" 10.246.115.57 edquiano mSecti \"henderi\" taevitae tevel 5926 \"https://example.com/ita/iquipexe.jpg?quamqua=quuntur#nihi\" \"Mozilla/5.0 (Linux; Android 9; G8142) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" allow", "tags": [ @@ -794,7 +794,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.60.56.205 4345 [10/Jul/2019:1:56:14 writtenb] \"NONE https://www5.example.com/ugitsed/dminimve.htm?onse=uiac#tquii tesse\" 10.82.148.126 inBCSedu ita \"ade\" nihilmol nder 2214 \"https://api.example.net/uunturm/iatn.gif?tseddo=diduntut#rroq\" \"Mozilla/5.0 (iPhone; CPU iPhone OS 13_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 LightSpeed [FBAN/MessengerLiteForiOS;FBAV/266.0.0.32.114;FBBV/216059178;FBDV/iPhone10,6;FBMD/iPhone;FBSN/iOS;FBSV/13.4.1;FBSS/3;FBCR/;FBID/phone;FBLC/en_US;FBOP/0]\" block", "tags": [ @@ -803,7 +803,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.245.251.98 261 [24/Jul/2019:8:58:48 mremaper] \"DELETE https://api.example.com/ntium/ide.htm?tamrema=isautem#usan gnamali\" 10.6.11.124 edqui tvolu \"psu\" strud onsequ 5930 \"https://www5.example.net/iumto/sequatu.jpg?runtm=mdoloree#que\" \"Mozilla/5.0 (Linux; Android 6.0; QMobile X700 PRO II) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36\" accept", "tags": [ @@ -812,7 +812,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.99.55.115 1537 [07/Aug/2019:4:01:23 exerci] \"CONNECT https://www5.example.org/iad/ngelits.jpg?mporin=orissusc#utaliqui uov\" 10.145.25.55 litsed lumd \"tiaec\" lorem iamquisn 2079 \"https://mail.example.org/aper/entor.txt?lumdol=edutper#utemve\" \"Mozilla/5.0 (Linux; Android 6.0; ZTE BLADE V7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" block", "tags": [ @@ -821,7 +821,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.187.86.64 3325 [21/Aug/2019:11:03:57 atatn] \"TRACE https://mail.example.com/iatnulap/roi.htm?uine=loreeu#eprehe ddoeiusm\" 10.6.88.105 uptatemU rem \"onorumet\" iscivel rinci 249 \"https://internal.example.com/eriti/uptateve.htm?rema=mcol#tion\" \"Mozilla/5.0 (Linux; Android 9; Notepad_K10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Safari/537.36\" allow", "tags": [ @@ -830,7 +830,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.252.146.132 503 [05/Sep/2019:6:06:31 tat] \"CONNECT https://mail.example.org/turv/use.jpg?mtot=macc#illoin eursi\" 10.163.9.35 uatDu umq \"ipsu\" oremip ota 4562 \"https://example.com/epteurs/itse.jpg?modi=cip#tla\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" accept", "tags": [ @@ -839,7 +839,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.249.101.177 4465 [19/Sep/2019:1:09:05 quam] \"DELETE https://mail.example.com/umdol/rerepr.txt?emipsumq=orinr#ineavol umdo\" 10.235.160.245 squamest upta \"umquiad\" porinc uameiu 4857 \"https://api.example.org/mipsa/uas.gif?reeufu=umexe#xce\" \"Mozilla/5.0 (Linux; Android 8.1.0; SM-A260G Build/OPR6; rv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Rocket/2.1.17(19420) Chrome/81.0.4044.138 Mobile Safari/537.36\" deny", "tags": [ @@ -848,7 +848,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.140.170.171 773 [03/Oct/2019:8:11:40 deom] \"TRACE https://internal.example.com/rautod/onorumet.htm?mvo=agnidol#nevolup erspici\" 10.73.218.58 quidol tinv \"Utenima\" nse umq 1831 \"https://mail.example.org/meaquei/snisiu.htm?atev=vento#litsed\" \"Mozilla/5.0 (Linux; Android 9; U307AS) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36\" block", "tags": [ @@ -857,7 +857,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.248.156.138 2125 [18/Oct/2019:3:14:14 smodit] \"OPTIONS https://example.net/dun/xce.jpg?nsequat=mvol#asiar eiu\" 10.67.148.40 tcons squamest \"ction\" emveleum siuta 2155 \"https://example.com/epteur/onproi.txt?imveniam=sunte#exerc\" \"Opera/9.80 (Series 60; Opera Mini/7.1.32444/174.101; U; ru) Presto/2.12.423 Version/12.16\" deny", "tags": [ @@ -866,7 +866,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.83.154.75 4260 [01/Nov/2019:10:16:48 explicab] \"UNLOCK https://api.example.com/teiru/mquamei.jpg?pta=uradi#sequu orumetMa\" 10.37.33.179 taed eatae \"siutali\" oloremq sum 6106 \"https://www.example.org/ulamc/doe.txt?remquela=toreve#squirat\" \"Mozilla/5.0 (Linux; Android 7.0; MEIZU M6 Build/NRD90M) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Mobile Safari/537.36 YaApp_Android/10.30 YaSearchBrowser/10.30\" accept", "tags": [ @@ -875,7 +875,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.14.29.202 7842 [15/Nov/2019:5:19:22 modoco] \"MKOL https://www5.example.net/dtempor/rroquisq.gif?liquid=uidex#umdolo nimv\" 10.84.107.38 tutla usmod \"ine\" qui itse 2097 \"https://www5.example.org/tasn/exeaco.html?metc=aincidu#reprehe\" \"Mozilla/5.0 (Linux; Android 10; SM-A305FN Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/78.0.3904.96 Mobile Safari/537.36 YandexSearch/8.10 YandexSearchBrowser/8.10\" deny", "tags": [ @@ -884,7 +884,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.221.86.133 6682 [30/Nov/2019:12:21:57 edi] \"POST https://api.example.com/ore/adeser.htm?pre=aute#rchite rcit\" 10.204.223.184 oinve ptasnul \"utaliqui\" mcorpor rerepr 6861 \"https://example.com/tuserror/agnama.jpg?deritq=boreetdo#teni\" \"Mozilla/5.0 (Linux; Android 10; SM-A715F Build/QP1A.190711.020; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/83.0.4103.83 Mobile Safari/537.36 [FB_IAB/Orca-Android;FBAV/266.0.0.16.117;]\" deny", "tags": [ @@ -893,7 +893,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "message": "10.195.4.70 3844 [14/Dec/2019:7:24:31 mfugiat] \"PUT https://api.example.com/liqu/dolor.htm?ess=umdo#aer quela\" 10.229.39.190 Nequepo edictas \"emac\" rmagnido exeaco 2574 \"https://api.example.org/loremi/nven.htm?usan=ugiatn#squa\" \"Mozilla/5.0 (Linux; Android 10; STK-L21 Build/HUAWEISTK-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.83 Mobile Safari/537.36 YaApp_Android/10.91 YaSearchBrowser/10.91\" deny", "tags": [ diff --git a/packages/squid/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/squid/data_stream/log/elasticsearch/ingest_pipeline/default.yml index af7abd85030..2d252006e1c 100644 --- a/packages/squid/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/squid/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for Squid processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' # User agent - user_agent: field: user_agent.original diff --git a/packages/squid/data_stream/log/sample_event.json b/packages/squid/data_stream/log/sample_event.json index c4d5bee0649..58cb44391a3 100644 --- a/packages/squid/data_stream/log/sample_event.json +++ b/packages/squid/data_stream/log/sample_event.json @@ -18,7 +18,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "4e3f135a-d5f9-40b6-ae01-2c834ecbead0", diff --git a/packages/squid/manifest.yml b/packages/squid/manifest.yml index c63559061ee..52ceebd099f 100644 --- a/packages/squid/manifest.yml +++ b/packages/squid/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.7.0 name: squid title: Squid Logs -version: "0.16.0" +version: "0.17.0" description: Collect and parse logs from Squid devices with Elastic Agent. categories: ["security", "network", "proxy_security"] type: integration diff --git a/packages/statsd_input/changelog.yml b/packages/statsd_input/changelog.yml index 4912dc2e304..554f94c71b6 100644 --- a/packages/statsd_input/changelog.yml +++ b/packages/statsd_input/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.2.3" + changes: + - description: Improve documentation for the package. + type: enhancement + link: https://github.com/elastic/integrations/pull/6580 - version: "0.2.2" changes: - description: Add system tests for the package. diff --git a/packages/statsd_input/docs/README.md b/packages/statsd_input/docs/README.md index 59f329d8580..1a1b42cf01d 100644 --- a/packages/statsd_input/docs/README.md +++ b/packages/statsd_input/docs/README.md @@ -1,21 +1,21 @@ -# Statsd input +# StatsD input The `statsd input package` spawns a UDP server and listens for metrics in StatsD compatible format. -The user can use this input for any service that collects metrics through Statsd endpoint. User has the flexibility to provide custom mappings and custom ingets pipelines through the Kibana UI to get the tailored data. +This input can be used to collect metrics from services that send data over the StatsD protocol. To tailor the data you can provide custom mappings and ingest pipelines through Kibana. ## Metric types The input supports the following types of metrics: -*Counter (c)*:: Measurement which accumulates over period of time until flushed (value set to 0). +**Counter (c)**:: Measurement which accumulates over a period of time until flushed (value set to 0). -*Gauge (g)*:: Measurement which can increase, decrease or be set to a value. +**Gauge (g)**:: Measurement which can increase, decrease or be set to a value. -*Timer (ms)*:: Time measurement (in milliseconds) of an event. +**Timer (ms)**:: Time measurement (in milliseconds) of an event. -*Histogram (h)*:: Time measurement, alias for timer. +**Histogram (h)**:: Time measurement, an alias for the *Timer*. -*Set (s)*:: Measurement which counts unique occurrences until flushed (value set to 0). +**Set (s)**:: Measurement which counts unique occurrences until flushed (value set to 0). ## Compatibility diff --git a/packages/statsd_input/manifest.yml b/packages/statsd_input/manifest.yml index a2fac9be727..62e2f12ec9a 100644 --- a/packages/statsd_input/manifest.yml +++ b/packages/statsd_input/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.0.0 name: statsd_input title: StatsD Input -version: "0.2.2" +version: "0.2.3" description: StatsD Input Package type: input categories: diff --git a/packages/suricata/_dev/build/build.yml b/packages/suricata/_dev/build/build.yml index 074278e5b1f..c1af686e524 100644 --- a/packages/suricata/_dev/build/build.yml +++ b/packages/suricata/_dev/build/build.yml @@ -1,3 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/suricata/changelog.yml b/packages/suricata/changelog.yml index e316b64cde2..50ccef01aac 100644 --- a/packages/suricata/changelog.yml +++ b/packages/suricata/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 2.16.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.14.0" + changes: + - description: Use ECS imported rather than local definitions. + type: enhancement + link: https://github.com/elastic/integrations/pull/7715 +- version: "2.13.0" + changes: + - description: Use dynamic field definitions. + type: enhancement + link: https://github.com/elastic/integrations/pull/7657 +- version: "2.12.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7309 +- version: "2.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "2.10.0" + changes: + - description: Convert dashboards to Lens + type: enhancement + link: https://github.com/elastic/integrations/pull/6839 - version: "2.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-6-0.log-expected.json b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-6-0.log-expected.json index 32707ac6e14..d41357aa322 100644 --- a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-6-0.log-expected.json +++ b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-6-0.log-expected.json @@ -12,7 +12,7 @@ "port": 47592 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-alerts.log-expected.json b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-alerts.log-expected.json index 7ce2596d79b..f9d67aeaf4e 100644 --- a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-alerts.log-expected.json +++ b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-alerts.log-expected.json @@ -29,7 +29,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -151,7 +151,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -273,7 +273,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -395,7 +395,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -517,7 +517,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -639,7 +639,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -761,7 +761,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -885,7 +885,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1009,7 +1009,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1133,7 +1133,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1257,7 +1257,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1381,7 +1381,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1505,7 +1505,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1629,7 +1629,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1753,7 +1753,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1877,7 +1877,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2001,7 +2001,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2125,7 +2125,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2249,7 +2249,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2372,7 +2372,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2475,7 +2475,7 @@ "port": 9080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2556,19 +2556,35 @@ "subject": "C=US, ST=California, L=Mountain View, O=Google Inc, CN=*.google.com", "x509": { "issuer": { - "common_name": "Google Internet Authority G2", - "country": "US", - "organization": "Google Inc" + "common_name": [ + "Google Internet Authority G2" + ], + "country": [ + "US" + ], + "organization": [ + "Google Inc" + ] }, "not_after": "2024-07-16T14:52:35.000Z", "not_before": "2019-07-17T14:52:35.000Z", "serial_number": "001122334455667788", "subject": { - "common_name": "*.google.com", - "country": "US,", - "locality": "Mountain View,", - "organization": "Google Inc,", - "state_or_province": "California," + "common_name": [ + "*.google.com" + ], + "country": [ + "US," + ], + "locality": [ + "Mountain View," + ], + "organization": [ + "Google Inc," + ], + "state_or_province": [ + "California," + ] } } }, @@ -2587,7 +2603,7 @@ "port": 8443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2688,23 +2704,47 @@ "subject": "C=Unknown, ST=Unknown, L=Unknown, O=Unknown, OU=Unknown, CN=Unknown", "x509": { "issuer": { - "common_name": "Unknown", - "country": "Unknown", - "locality": "Unknown", - "organization": "Unknown", - "organizational_unit": "Unknown", - "state_or_province": "Unknown" + "common_name": [ + "Unknown" + ], + "country": [ + "Unknown" + ], + "locality": [ + "Unknown" + ], + "organization": [ + "Unknown" + ], + "organizational_unit": [ + "Unknown" + ], + "state_or_province": [ + "Unknown" + ] }, "not_after": "2026-06-25T17:36:29.000Z", "not_before": "2016-06-27T17:36:29.000Z", "serial_number": "72A92C51", "subject": { - "common_name": "Unknown", - "country": "Unknown,", - "locality": "Unknown,", - "organization": "Unknown,", - "organizational_unit": "Unknown,", - "state_or_province": "Unknown," + "common_name": [ + "Unknown" + ], + "country": [ + "Unknown," + ], + "locality": [ + "Unknown," + ], + "organization": [ + "Unknown," + ], + "organizational_unit": [ + "Unknown," + ], + "state_or_province": [ + "Unknown," + ] } } }, diff --git a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-dns-4-1-4.log-expected.json b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-dns-4-1-4.log-expected.json index e22854e5d76..8d77dbd9ab9 100644 --- a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-dns-4-1-4.log-expected.json +++ b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-dns-4-1-4.log-expected.json @@ -18,7 +18,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -83,7 +83,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -164,7 +164,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -246,7 +246,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -313,7 +313,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -379,7 +379,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -488,7 +488,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -598,7 +598,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -667,7 +667,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -733,7 +733,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -810,7 +810,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -892,7 +892,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -975,7 +975,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1058,7 +1058,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1141,7 +1141,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1221,7 +1221,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1303,7 +1303,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1386,7 +1386,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1469,7 +1469,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1552,7 +1552,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1621,7 +1621,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1687,7 +1687,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1796,7 +1796,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1906,7 +1906,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-metadata.log-expected.json b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-metadata.log-expected.json index 554a1393108..8fbdf088a26 100644 --- a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-metadata.log-expected.json +++ b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-metadata.log-expected.json @@ -12,7 +12,7 @@ "port": 47592 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-small.log-expected.json b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-small.log-expected.json index 97297ed0d0f..6274b78bc4f 100644 --- a/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-small.log-expected.json +++ b/packages/suricata/data_stream/eve/_dev/test/pipeline/test-eve-small.log-expected.json @@ -8,7 +8,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -69,7 +69,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -156,7 +156,7 @@ "port": 63963 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -245,7 +245,7 @@ "port": 56118 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -360,7 +360,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -413,7 +413,7 @@ { "@timestamp": "2018-07-05T19:51:23.009Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -613,7 +613,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -682,20 +682,38 @@ "subject": "CN=*.icloud.com, OU=management:idms.group.506364, O=Apple Inc., ST=California, C=US", "x509": { "issuer": { - "common_name": "Apple IST CA 2 - G1", - "country": "US", - "organization": "Apple Inc.", - "organizational_unit": "Certification Authority" + "common_name": [ + "Apple IST CA 2 - G1" + ], + "country": [ + "US" + ], + "organization": [ + "Apple Inc." + ], + "organizational_unit": [ + "Certification Authority" + ] }, "not_after": "2019-03-29T17:54:31.000Z", "not_before": "2017-02-27T17:54:31.000Z", "serial_number": "5C9CE1097887F807", "subject": { - "common_name": "*.icloud.com,", - "country": "US", - "organization": "Apple Inc.,", - "organizational_unit": "management:idms.group.506364,", - "state_or_province": "California," + "common_name": [ + "*.icloud.com," + ], + "country": [ + "US" + ], + "organization": [ + "Apple Inc.," + ], + "organizational_unit": [ + "management:idms.group.506364," + ], + "state_or_province": [ + "California," + ] } } }, @@ -713,7 +731,7 @@ "port": 547 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -774,7 +792,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -854,7 +872,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -922,20 +940,38 @@ "subject": "C=US, ST=New York, L=New York City, O=Acme U.S.A., INC., CN=update.acme.com", "x509": { "issuer": { - "common_name": "GeoTrust RSA CA 2018", - "country": "US", - "organization": "DigiCert Inc", - "organizational_unit": "www.digicert.com" + "common_name": [ + "GeoTrust RSA CA 2018" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ], + "organizational_unit": [ + "www.digicert.com" + ] }, "not_after": "2021-12-25T23:59:59.000Z", "not_before": "2020-11-24T00:00:00.000Z", "serial_number": "0DCEDCBCAF9256B4C5414071265B1D53", "subject": { - "common_name": "update.acme.com", - "country": "US,", - "locality": "New York City,", - "organization": "Acme U.S.A., INC.,", - "state_or_province": "New York," + "common_name": [ + "update.acme.com" + ], + "country": [ + "US," + ], + "locality": [ + "New York City," + ], + "organization": [ + "Acme U.S.A., INC.," + ], + "state_or_province": [ + "New York," + ] } } }, @@ -952,7 +988,7 @@ "port": 8081 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1038,7 +1074,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml index 96bf982b023..32294014607 100644 --- a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml +++ b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for parsing Suricata EVE logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.original copy_from: message diff --git a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml index b7a98ed9aed..dcf3f11b18d 100644 --- a/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml +++ b/packages/suricata/data_stream/eve/elasticsearch/ingest_pipeline/tls.yml @@ -35,26 +35,50 @@ processors: field: suricata.eve.tls.kv_subject.C target_field: tls.server.x509.subject.country ignore_missing: true + - set: + field: tls.server.x509.subject.country + value: ['{{{tls.server.x509.subject.country}}}'] + if: ctx.tls?.server?.x509?.subject?.country instanceof String - rename: field: suricata.eve.tls.kv_subject.CN target_field: tls.server.x509.subject.common_name ignore_missing: true + - set: + field: tls.server.x509.subject.common_name + value: ['{{{tls.server.x509.subject.common_name}}}'] + if: ctx.tls?.server?.x509?.subject?.common_name instanceof String - rename: field: suricata.eve.tls.kv_subject.L target_field: tls.server.x509.subject.locality ignore_missing: true + - set: + field: tls.server.x509.subject.locality + value: ['{{{tls.server.x509.subject.locality}}}'] + if: ctx.tls?.server?.x509?.subject?.locality instanceof String - rename: field: suricata.eve.tls.kv_subject.O target_field: tls.server.x509.subject.organization ignore_missing: true + - set: + field: tls.server.x509.subject.organization + value: ['{{{tls.server.x509.subject.organization}}}'] + if: ctx.tls?.server?.x509?.subject?.organization instanceof String - rename: field: suricata.eve.tls.kv_subject.OU target_field: tls.server.x509.subject.organizational_unit ignore_missing: true + - set: + field: tls.server.x509.subject.organizational_unit + value: ['{{{tls.server.x509.subject.organizational_unit}}}'] + if: ctx.tls?.server?.x509?.subject?.organizational_unit instanceof String - rename: field: suricata.eve.tls.kv_subject.ST target_field: tls.server.x509.subject.state_or_province ignore_missing: true + - set: + field: tls.server.x509.subject.state_or_province + value: ['{{{tls.server.x509.subject.state_or_province}}}'] + if: ctx.tls?.server?.x509?.subject?.state_or_province instanceof String # Issuer - set: field: tls.server.issuer @@ -75,26 +99,50 @@ processors: field: suricata.eve.tls.kv_issuerdn.C target_field: tls.server.x509.issuer.country ignore_missing: true + - set: + field: tls.server.x509.issuer.country + value: ['{{{tls.server.x509.issuer.country}}}'] + if: ctx.tls?.server?.x509?.issuer?.country instanceof String - rename: field: suricata.eve.tls.kv_issuerdn.CN target_field: tls.server.x509.issuer.common_name ignore_missing: true + - set: + field: tls.server.x509.issuer.common_name + value: ['{{{tls.server.x509.issuer.common_name}}}'] + if: ctx.tls?.server?.x509?.issuer?.common_name instanceof String - rename: field: suricata.eve.tls.kv_issuerdn.L target_field: tls.server.x509.issuer.locality ignore_missing: true + - set: + field: tls.server.x509.issuer.locality + value: ['{{{tls.server.x509.issuer.locality}}}'] + if: ctx.tls?.server?.x509?.issuer?.locality instanceof String - rename: field: suricata.eve.tls.kv_issuerdn.O target_field: tls.server.x509.issuer.organization ignore_missing: true + - set: + field: tls.server.x509.issuer.organization + value: ['{{{tls.server.x509.issuer.organization}}}'] + if: ctx.tls?.server?.x509?.issuer?.organization instanceof String - rename: field: suricata.eve.tls.kv_issuerdn.OU target_field: tls.server.x509.issuer.organizational_unit ignore_missing: true + - set: + field: tls.server.x509.issuer.organizational_unit + value: ['{{{tls.server.x509.issuer.organizational_unit}}}'] + if: ctx.tls?.server?.x509?.issuer?.organizational_unit instanceof String - rename: field: suricata.eve.tls.kv_issuerdn.ST target_field: tls.server.x509.issuer.state_or_province ignore_missing: true + - set: + field: tls.server.x509.issuer.state_or_province + value: ['{{{tls.server.x509.issuer.state_or_province}}}'] + if: ctx.tls?.server?.x509?.issuer?.state_or_province instanceof String - convert: field: suricata.eve.tls.session_resumed diff --git a/packages/suricata/data_stream/eve/fields/ecs.yml b/packages/suricata/data_stream/eve/fields/ecs.yml index fc4952f07b1..cc03cf2e71a 100644 --- a/packages/suricata/data_stream/eve/fields/ecs.yml +++ b/packages/suricata/data_stream/eve/fields/ecs.yml @@ -32,12 +32,54 @@ name: destination.packets - external: ecs name: destination.port +- external: ecs + name: dns.answers +- external: ecs + name: dns.answers.class +- external: ecs + name: dns.answers.data +- external: ecs + name: dns.answers.name +- external: ecs + name: dns.answers.ttl +- external: ecs + name: dns.answers.type +- external: ecs + name: dns.header_flags +- external: ecs + name: dns.id +- external: ecs + name: dns.op_code +- external: ecs + name: dns.question.class +- external: ecs + name: dns.question.name +- external: ecs + name: dns.question.registered_domain +- external: ecs + name: dns.question.subdomain +- external: ecs + name: dns.question.top_level_domain +- external: ecs + name: dns.question.type +- external: ecs + name: dns.resolved_ip +- external: ecs + name: dns.response_code +- external: ecs + name: dns.type - external: ecs name: ecs.version +- external: ecs + name: event.created - external: ecs name: event.duration - external: ecs name: event.end +- external: ecs + name: event.ingested +- external: ecs + name: event.original - external: ecs name: event.outcome - external: ecs @@ -58,6 +100,8 @@ name: http.response.body.bytes - external: ecs name: http.response.status_code +- external: ecs + name: log.file.path - external: ecs name: message - external: ecs @@ -74,6 +118,8 @@ name: related.hash - external: ecs name: related.hosts +- external: ecs + name: related.ip - external: ecs name: rule.category - external: ecs diff --git a/packages/suricata/data_stream/eve/fields/fields-epr.yml b/packages/suricata/data_stream/eve/fields/fields-epr.yml index b8a01e0fdce..fcd109b245b 100644 --- a/packages/suricata/data_stream/eve/fields/fields-epr.yml +++ b/packages/suricata/data_stream/eve/fields/fields-epr.yml @@ -1,168 +1,6 @@ -- name: event - title: Event - group: 2 - description: "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events." - type: group - fields: - - name: created - level: core - type: date - description: "event.created contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, @timestamp should be used." - example: "2016-05-23T08:05:34.857Z" - - name: ingested - level: core - type: date - description: "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`." - example: "2016-05-23T08:05:35.101Z" - - name: original - level: core - type: keyword - ignore_above: 1024 - description: "Raw text message of entire event. Used to demonstrate log integrity.\nThis field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`." - example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232 -- name: dns - title: DNS - group: 2 - description: "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`)." - type: group - fields: - - name: answers - level: extended - type: object - object_type: keyword - description: "An array containing an object for each answer section returned by the server.\nThe main keys that should be present in these objects are defined by ECS. Records that have more information may contain more keys than what ECS defines.\nNot all DNS data sources give all details about DNS answers. At minimum, answer objects must contain the `data` key. If more information is available, map as much of it to ECS as possible, and add any additional fields to the answer objects as custom fields." - - name: answers.class - level: extended - type: keyword - ignore_above: 1024 - description: The class of DNS data contained in this resource record. - example: IN - - name: answers.data - level: extended - type: keyword - ignore_above: 1024 - description: "The data describing the resource.\nThe meaning of this data depends on the type and class of the resource record." - example: 10.10.10.10 - - name: answers.name - level: extended - type: keyword - ignore_above: 1024 - description: "The domain name to which this resource record pertains.\nIf a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated." - example: www.google.com - - name: answers.ttl - level: extended - type: long - description: The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. - example: 180 - - name: answers.type - level: extended - type: keyword - ignore_above: 1024 - description: The type of data contained in this resource record. - example: CNAME - - name: header_flags - level: extended - type: keyword - ignore_above: 1024 - description: "Array of 2 letter DNS header flags.\nExpected values are: AA, TC, RD, RA, AD, CD, DO." - example: - - RD - - RA - - name: id - level: extended - type: keyword - ignore_above: 1024 - description: The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. - example: 62111 - - name: op_code - level: extended - type: keyword - ignore_above: 1024 - description: The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. - example: QUERY - - name: question.class - level: extended - type: keyword - ignore_above: 1024 - description: The class of records being queried. - example: IN - - name: question.name - level: extended - type: keyword - ignore_above: 1024 - description: 'The name being queried. - - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.' - example: www.google.com - - name: question.registered_domain - level: extended - type: keyword - ignore_above: 1024 - description: 'The highest registered domain, stripped of the subdomain. - - For example, the registered domain for "foo.google.com" is "google.com". - - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk".' - example: google.com - - name: question.subdomain - level: extended - type: keyword - ignore_above: 1024 - description: 'The subdomain is all of the labels under the registered_domain. - - If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period.' - example: www - - name: question.top_level_domain - level: extended - type: keyword - ignore_above: 1024 - description: 'The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for google.com is "com". - - This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk".' - example: co.uk - - name: question.type - level: extended - type: keyword - ignore_above: 1024 - description: The type of record being queried. - example: AAAA - - name: resolved_ip - level: extended - type: ip - description: "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for." - example: - - 10.10.10.10 - - 10.10.10.11 - - name: response_code - level: extended - type: keyword - ignore_above: 1024 - description: The DNS response code. - example: NOERROR - - name: type - level: extended - type: keyword - ignore_above: 1024 - description: "The type of DNS event captured, query or answer.\nIf your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`.\nIf your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers." - example: answer -- name: related - title: Related - group: 2 - description: "This field set is meant to facilitate pivoting around a piece of data.\nSome pieces of information can be seen in many places in an ECS event. To facilitate searching for them, store an array of all seen values to their corresponding field in `related.`.\nA concrete example is IP addresses, which can be under host, observer, source, destination, client, server, and network.forwarded_ip. If you append all IPs to `related.ip`, you can then search for a given IP trivially, no matter where it appeared, by querying `related.ip:192.0.2.15`." - type: group - fields: - - name: ip - level: extended - type: ip - description: All of the IPs seen on your event. - name: input.type # Filebeat Fields type: keyword description: Filebeat input type used to collect the log. -- name: log.file.path - type: keyword - description: > - The file from which the line was read. This field contains the absolute path to the file. For example: `/var/log/system.log`. - - name: log.offset type: long description: >- diff --git a/packages/suricata/data_stream/eve/sample_event.json b/packages/suricata/data_stream/eve/sample_event.json index 6213881473c..c6d869024c2 100644 --- a/packages/suricata/data_stream/eve/sample_event.json +++ b/packages/suricata/data_stream/eve/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-07-05T19:01:09.820Z", "agent": { - "ephemeral_id": "1766b03e-b9fd-4e5b-9c37-bb972c55d7c5", - "id": "543eeec2-6585-484f-9f7b-34db47abcd9c", + "ephemeral_id": "58adcb6e-5d0e-4822-98a4-8d93557f8f2e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.3" + "version": "8.9.0" }, "data_stream": { "dataset": "suricata.eve", @@ -18,21 +18,21 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "543eeec2-6585-484f-9f7b-34db47abcd9c", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.2.3" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "network" ], - "created": "2022-07-08T01:02:15.499Z", + "created": "2023-08-08T15:09:13.171Z", "dataset": "suricata.eve", - "ingested": "2022-07-08T01:02:16Z", + "ingested": "2023-08-08T15:09:14Z", "kind": "event", "type": [ "protocol" diff --git a/packages/suricata/docs/README.md b/packages/suricata/docs/README.md index 490ac84bd60..a74417339a1 100644 --- a/packages/suricata/docs/README.md +++ b/packages/suricata/docs/README.md @@ -17,11 +17,11 @@ An example event for `eve` looks as following: { "@timestamp": "2018-07-05T19:01:09.820Z", "agent": { - "ephemeral_id": "1766b03e-b9fd-4e5b-9c37-bb972c55d7c5", - "id": "543eeec2-6585-484f-9f7b-34db47abcd9c", + "ephemeral_id": "58adcb6e-5d0e-4822-98a4-8d93557f8f2e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.2.3" + "version": "8.9.0" }, "data_stream": { "dataset": "suricata.eve", @@ -34,21 +34,21 @@ An example event for `eve` looks as following: "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "543eeec2-6585-484f-9f7b-34db47abcd9c", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.2.3" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "network" ], - "created": "2022-07-08T01:02:15.499Z", + "created": "2023-08-08T15:09:13.171Z", "dataset": "suricata.eve", - "ingested": "2022-07-08T01:02:16Z", + "ingested": "2023-08-08T15:09:14Z", "kind": "event", "type": [ "protocol" @@ -147,29 +147,29 @@ An example event for `eve` looks as following: | dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | | dns.answers.ttl | The time interval in seconds that this resource record may be cached before it should be discarded. Zero values mean that the data should not be cached. | long | | dns.answers.type | The type of data contained in this resource record. | keyword | -| dns.header_flags | Array of 2 letter DNS header flags. Expected values are: AA, TC, RD, RA, AD, CD, DO. | keyword | +| dns.header_flags | Array of 2 letter DNS header flags. | keyword | | dns.id | The DNS packet identifier assigned by the program that generated the query. The identifier is copied to the response. | keyword | | dns.op_code | The DNS operation code that specifies the kind of query in the message. This value is set by the originator of a query and copied into the response. | keyword | | dns.question.class | The class of records being queried. | keyword | | dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.google.com" is "google.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | +| dns.question.registered_domain | The highest registered domain, stripped of the subdomain. For example, the registered domain for "foo.example.com" is "example.com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | keyword | | dns.question.subdomain | The subdomain is all of the labels under the registered_domain. If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | keyword | -| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for google.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | +| dns.question.top_level_domain | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | keyword | | dns.question.type | The type of record being queried. | keyword | | dns.resolved_ip | Array containing all IPs seen in `answers.data`. The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ip | | dns.response_code | The DNS response code. | keyword | | dns.type | The type of DNS event captured, query or answer. If your source of DNS events only gives you DNS queries, you should only create dns events of type `dns.type:query`. If your source of DNS events gives you answers as well, you should create one event per query (optionally as soon as the query is seen). And a second event containing all query details as well as an array of answers. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | -| event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | +| event.end | `event.end` contains the date when the event ended or when the activity was last observed. | date | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. | keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | file.name | Name of the file including the extension, without the directory. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | | file.path.text | Multi-field of `file.path`. | match_only_text | @@ -196,7 +196,7 @@ An example event for `eve` looks as following: | http.response.body.bytes | Size in bytes of the response body. | long | | http.response.status_code | HTTP response status code. | long | | input.type | Filebeat input type used to collect the log. | keyword | -| log.file.path | The file from which the line was read. This field contains the absolute path to the file. For example: `/var/log/system.log`. | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.offset | The file offset the reported line starts at. | long | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | network.bytes | Total bytes transferred in both directions. If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | long | diff --git a/packages/suricata/img/filebeat-suricata-alerts.png b/packages/suricata/img/filebeat-suricata-alerts.png deleted file mode 100644 index bd45777eef8..00000000000 Binary files a/packages/suricata/img/filebeat-suricata-alerts.png and /dev/null differ diff --git a/packages/suricata/img/filebeat-suricata-events.png b/packages/suricata/img/filebeat-suricata-events.png deleted file mode 100644 index b9501304ca6..00000000000 Binary files a/packages/suricata/img/filebeat-suricata-events.png and /dev/null differ diff --git a/packages/suricata/img/suricata-alerts.png b/packages/suricata/img/suricata-alerts.png new file mode 100644 index 00000000000..5108b6bc535 Binary files /dev/null and b/packages/suricata/img/suricata-alerts.png differ diff --git a/packages/suricata/img/suricata-events.png b/packages/suricata/img/suricata-events.png new file mode 100644 index 00000000000..e22fae8f91e Binary files /dev/null and b/packages/suricata/img/suricata-events.png differ diff --git a/packages/suricata/kibana/dashboard/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c.json b/packages/suricata/kibana/dashboard/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c.json index e9e60eba7b9..9b98b7a3630 100644 --- a/packages/suricata/kibana/dashboard/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c.json +++ b/packages/suricata/kibana/dashboard/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c.json @@ -1,614 +1,991 @@ { - "id": "suricata-05268ee0-86d1-11e8-b59d-21efb914e65c", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-23T06:37:42.472Z", - "version": "WzU4OSwxXQ==", - "attributes": { - "description": "Overview of the Suricata Alerts dashboard.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false, - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Alerting Hosts [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-6y", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { + "attributes": { + "description": "Overview of the Suricata Alerts dashboard.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 10, - "i": "1", - "w": 23, - "x": 0, - "y": 4 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Alert Signatures [Logs Suricata]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7a1d93ca-33eb-4439-ab54-ec4cd6c5b8ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e3fce70-e9e8-40b0-a37d-18432058063b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d0d32c37-123c-47a7-ad69-2b4d16faa8d1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7a1d93ca-33eb-4439-ab54-ec4cd6c5b8ba": { + "columnOrder": [ + "11a0694d-1a5f-4bfa-ad68-894c970b7111", + "6fd39053-8106-4a86-8c43-5eccfd09cb71", + "9ac8a01d-755c-4efa-8ca1-e852290adde8" + ], + "columns": { + "11a0694d-1a5f-4bfa-ad68-894c970b7111": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "6fd39053-8106-4a86-8c43-5eccfd09cb71": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9ac8a01d-755c-4efa-8ca1-e852290adde8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "9ac8a01d-755c-4efa-8ca1-e852290adde8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0e3fce70-e9e8-40b0-a37d-18432058063b", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d0d32c37-123c-47a7-ad69-2b4d16faa8d1", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "9ac8a01d-755c-4efa-8ca1-e852290adde8" + ], + "isHistogram": true, + "layerId": "7a1d93ca-33eb-4439-ab54-ec4cd6c5b8ba", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "6fd39053-8106-4a86-8c43-5eccfd09cb71", + "xAccessor": "11a0694d-1a5f-4bfa-ad68-894c970b7111", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "9ac8a01d-755c-4efa-8ca1-e852290adde8" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Top Alerting Hosts [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "1", + "w": 23, + "x": 0, + "y": 4 + }, + "panelIndex": "1", + "title": "Top Alerting Hosts [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "params": { - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-29186944-4fe9-4b6d-a86b-1f215554bd5b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "67c69229-07c2-4215-b5d3-f9ceae074512", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1f9d9e87-9deb-4f53-a2d6-ebf558cd6ee7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "29186944-4fe9-4b6d-a86b-1f215554bd5b": { + "columnOrder": [ + "fc0ad336-46a2-40b6-8716-5e87820eeef5", + "d9614d50-5e94-447b-a448-725b2157ed52", + "18ebd13e-9dc1-4de8-bba4-09351750d2fd" + ], + "columns": { + "18ebd13e-9dc1-4de8-bba4-09351750d2fd": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d9614d50-5e94-447b-a448-725b2157ed52": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Alert Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "18ebd13e-9dc1-4de8-bba4-09351750d2fd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "rule.category" + }, + "fc0ad336-46a2-40b6-8716-5e87820eeef5": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Alert Signature", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "18ebd13e-9dc1-4de8-bba4-09351750d2fd", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "rule.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "67c69229-07c2-4215-b5d3-f9ceae074512", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1f9d9e87-9deb-4f53-a2d6-ebf558cd6ee7", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "18ebd13e-9dc1-4de8-bba4-09351750d2fd" + }, + { + "alignment": "left", + "columnId": "fc0ad336-46a2-40b6-8716-5e87820eeef5", + "width": 403.66666666666674 + }, + { + "alignment": "left", + "columnId": "d9614d50-5e94-447b-a448-725b2157ed52", + "width": 300.16666666666663 + } + ], + "headerRowHeight": "single", + "layerId": "29186944-4fe9-4b6d-a86b-1f215554bd5b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" + } + }, + "title": "Top Alert Signatures [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 26, + "i": "2", + "w": 25, + "x": 23, + "y": 0 + }, + "panelIndex": "2", + "title": "Top Alert Signatures [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "enhancements": {} }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Alert Signature", - "field": "rule.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 15 - }, - "schema": "bucket", - "type": "terms" + "gridData": { + "h": 16, + "i": "3", + "w": 48, + "x": 0, + "y": 41 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Alert Category", - "field": "rule.category", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 26, - "i": "2", - "w": 25, - "x": 23, - "y": 0 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 16, - "i": "3", - "w": 48, - "x": 0, - "y": 41 - }, - "panelIndex": "3", - "panelRefName": "panel_3", - "type": "search", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Alerts - Top Destination Countries [Logs Suricata]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "panelIndex": "3", + "panelRefName": "panel_3", + "type": "search", + "version": "8.7.1" }, - "params": { - "perPage": 5, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c036e878-b4dc-4a98-abc5-1bc666dd109b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9f4bd7fa-7c45-4936-b646-ef8abe445ef0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2acb37a2-60fb-454d-953a-f10855ca1650", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c036e878-b4dc-4a98-abc5-1bc666dd109b": { + "columnOrder": [ + "1fbbc84c-2c2c-429c-b935-c32e0fde0a78", + "94e0c6ed-9540-4463-984d-c77f65cbcc1f" + ], + "columns": { + "1fbbc84c-2c2c-429c-b935-c32e0fde0a78": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "94e0c6ed-9540-4463-984d-c77f65cbcc1f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_iso_code" + }, + "94e0c6ed-9540-4463-984d-c77f65cbcc1f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9f4bd7fa-7c45-4936-b646-ef8abe445ef0", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "2acb37a2-60fb-454d-953a-f10855ca1650", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "94e0c6ed-9540-4463-984d-c77f65cbcc1f" + }, + { + "alignment": "left", + "columnId": "1fbbc84c-2c2c-429c-b935-c32e0fde0a78" + } + ], + "headerRowHeight": "single", + "layerId": "c036e878-b4dc-4a98-abc5-1bc666dd109b", + "layerType": "data", + "paging": { + "enabled": true, + "size": 5 + }, + "rowHeight": "single" + } + }, + "title": "Alerts - Top Destination Countries [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 12, + "i": "7", + "w": 12, + "x": 11, + "y": 14 + }, + "panelIndex": "7", + "title": "Alerts - Top Destination Countries [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cef42db7-be35-446f-8b05-4df026f4693e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "da534929-50b7-4725-9932-b3f20668e892", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a4fb3d30-c30a-4b37-afca-49170e3f5b68", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cef42db7-be35-446f-8b05-4df026f4693e": { + "columnOrder": [ + "1100c960-81bb-4663-afb1-0a9772697b7d", + "85065dc4-3a21-44dc-a587-7cc99ccfe0f6" + ], + "columns": { + "1100c960-81bb-4663-afb1-0a9772697b7d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source Country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "85065dc4-3a21-44dc-a587-7cc99ccfe0f6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_iso_code" + }, + "85065dc4-3a21-44dc-a587-7cc99ccfe0f6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "da534929-50b7-4725-9932-b3f20668e892", + "key": "event.kind", + "negate": false, + "params": { + "query": "alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "alert" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a4fb3d30-c30a-4b37-afca-49170e3f5b68", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "85065dc4-3a21-44dc-a587-7cc99ccfe0f6" + }, + { + "alignment": "left", + "columnId": "1100c960-81bb-4663-afb1-0a9772697b7d" + } + ], + "headerRowHeight": "single", + "layerId": "cef42db7-be35-446f-8b05-4df026f4693e", + "layerType": "data", + "paging": { + "enabled": true, + "size": 5 + }, + "rowHeight": "single" + } + }, + "title": "Alerts - Top Source Countries [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Source Country", - "field": "destination.geo.country_iso_code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 12, - "i": "7", - "w": 12, - "x": 11, - "y": 14 - }, - "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Alerts - Top Source Countries [Logs Suricata]", - "description": "", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } + "gridData": { + "h": 12, + "i": "8", + "w": 11, + "x": 0, + "y": 14 + }, + "panelIndex": "8", + "title": "Alerts - Top Source Countries [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "params": { - "perPage": 5, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 18, + "markdown": "![Hello World](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAAyCAYAAAAA9rgCAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAJ17AACdewE8n3fEAAABWWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpMwidZAAAN5UlEQVRoBe1ZeXCU5Rn/7b25s9nEHJAQAhggCIKCThFpFRXFa+yhTtVSndaZUvWPVjqt1bGHY6cdrVNq66C21UpbT7wwxqMjAh4oBCGQC8KRY7Ob3WQ3e9/9Pe/uh2ukrePM7h/oM2S/73ve87l+z/O+6NIkfIFI/wWSVYn6pcAnu8W/tPCXFj7JNPClS59kBv2UOF84Cxs/pYJ8M1jYHS/udIBOV1idF1ZgqWJ1Ov6jpFlKp1PqrVCCF07grLDJeBT+oX5Ex52wVk9DxYy5muwFeRbGn7LCphIx9G26A933noZ0KoFEyAvHe1uUAgoiLRcpiMCMWiVPYGQAvg/vg7lhFpLRIGL+cQxsuBTO95/PyCuKyTMVxqVFDoZtPBSAjivqjJUY/OfXYWlciXl370bVnMUZMXNiO19yF0bg7O6jXicgGJWKw1y3CG3rNsNcZlOonQtk+RJW5i2MwFnLBYcOQGeSZVNIx4eRSiblo6CU/xhmXIr1ktEwQke2Qm+lfPoixMcnEHQMZIQtQOxqWs27wBoMxYKTFHILLdwMmhdSb4RdR7V9FOyZd4G1EsNosUJfvATppI+opVe4HXFnBS4AWGkazbvAUlkJGYvLYKlZhnR0AqnIXpS2fgeRsV5Ibs4AluYL2tby88y/wLJvFcd6GIpsMNpWwFx9BUzl05Dw9SPgOCI9WIicRAJrohiLK5COuVA0/UyEht7m8xwMvvIA3TxBLxfdaz2VDvLyUxALazk2HvAQuHqRDPtgrVvKdBxFMngMrn3blXCFsHLeBdaOglGfB6HDj9Gl52Dyo9+w2rLSsnEYy5sI2uG8WPNEk+ZdYIlfId+RLlrXRUHLVS6OjOyEscSORGBUAdeJNpcPXt4F1tzZ270NejNFSEUodDOSoR7+uVExbw0q5yxVsun0WhLLh6iZOfNbWop1mZbiLDqCBzczD5cTjUMEqDLEJ/ahePpizLhwbVY68YT8C/yxhbk5FW/KBXPQUr4VL7sveUzlad/aM4u2WvwGRg4h5tpNC7dwbIzDo6qmrllykZo0LTW1WiZnXW05bU55apTLy33PRflP8LWB2cODXLPIFcsn9SsLkHOiKmgqb+o3R2pXN7KUt/f9zMlbXecYlFvrLWQZ+E7SaU/1NeXnBHOfcE9Thv23PkaxlgibjEV4IJ+guxlgKa/iJtjE/Jhg0S+KM1gs0BvNPOEk1EEgw2O5aDQhEQnRVeXkIwqiFq3Fak55jwUmMLFnIwxl4s5+SmmhkfthqroUxqJStU0ZG/W61VhzuZ2K+DjSZLzK0+SZSyvVGmo98YocZYiCDSYzDGY5nfDsHfRlqjjKY+I47c7MKIPGmAeH23/BnPgRuxphbbgM827agAg30f3HFUiFBzDz+u2oXrAcQecg+jZeSOw5iJa178M+dxkOv/QgvJ3rmWJWUVEmVlGNsC26HA1nr4G3fw9io50w10odPcn5TUhFAWv9UqWYycE+HHvpXsTcO5Dw96P+4ifQeN63Zc9UZBDdD11LdO+AseIctN3yCkwsUQeevx/+nk1E+wbOGYLeVMGqrQN1qzdj+ooraZQ4+p74McJHH2Ho6NB2mwPWqlraNg3jeH8nDm5YAWM1PU2MGaN2PBtZFNxHA+mQCg2wUCBfWZC74KBU6KDicWa1sVQ8osamjHsRG3MhVsw09MFGRFx/gKmsCpVn3QH/gXuoDHpK0VJ6ElC14DzlUT33t2bPyPSGY0B0YkjNKT/RSQ9jvwP60oWcdzuiPrcSOObpReRgDywto9yhAQkWMuEuKmjFuBobD/gQGWmHztKGhGc/wuOjSmDZu9657XEY6CmG4jPQdM0WzPkhrbbilxxIPxYPpXfJX677yLVBLk/cX7qbbOdg5k2voXjO92CZ1gxn+62I+VwoaVyI6CCFXPoAXXkB21pR3XY2jr3+VxlGS1Wj9sLHMfv2DpQ2LVKblp+IxyFZjBasQoqGCHtGVFv9+bei5dZ2mCrPZbsHRTO+jzl3vQ7b/OWqXYqcpH+YIFmlvsNj1GSWjOGRfyurVi66EfVnXaLY9nnL1DPq92a6qatj2VqW5FX701hxbsxcjrozL0B583wc+P3DKu+aK+pQVNOE4tb5mH7+Dej7++1ovbkDcl3r2/eg0mPF6T9F06rrtdmVNwmWhJxHxCikpOgeYX6DYWWfm8nbnt3PMgwYHjWzUHfGKumoSBTDWyTukR5Irwo5+hVfagK9zlCiXCrqOaKY6RSvX/iX+eBqstJnIfaTvaUScRTZ6mCpv0G5vfq216Fs/ncJfPR1HhJKamcg5B5h3A1AlrK1natWkL5CGsCEHb1KaWkpVli0hB09ql1iMckwkpCSMElnxwmgCoVGD8mRW5HcsEQcexXwiXb1pXOuUA3+fb/D0LZnM6eWjFozIz7LL/vLEJV3Oam6lqUPEtRpnBjMFXakQ2N0MzeqWldi4MUN8O7fCpHfWsI/IrOQCg1RG+eQg0XEsRu6IqC0hZ7Hu7Dw6B6VNcRSmlKUlvktpNdL7KU5rluFXMms1cSM0xB1PosYUVv1qT/namqK2GxbhqGnvgF31ztcmGr7H5QRLmNRNQlLQhPXMhv1KqUEHUcQHP4Xgoy7dHE1TEVl0M2+EFtumw437Kg5cw2cww70HAQOyUWmiVJlSdO1hFPE+QIsZSsYmyupnFlITbyMOO+yFYmC+SJ/x4lyy1VwxLlTeURl6woYSlpY1QWY9sZUN31pXTMar25HzLGTqeMsDPxtOfzDh1RjbvFwfFK+GKkPMzWulb7BaApDo0D3oXG8tflpPPbzW9D+KvDiw0DJnAweHOjqw9NPAE/+6GKUNbQg0bwczz8J7PigHrHkx3GjVWeOESee+y2wzzUNxpoWDPtnQK7Agh5qSBFTDDeg7SHLVMge92wnCC9ESf1MClyrMkh4bEh14eVSGvXLVqPuskeYjt4nYhpw+On1qlFHF5HMIx6T9RqlUV+AwjGcvJGMfrtGUtjyFLCt413846pv4dieHaD3Yu32t1FT36DmMpkMqOBb1YIraRa6VCwMG79LSnj4133CTqr/6NAgBGpitlNha5iB/lgrHtsE9PQdUe1yQTIeSCPGsFd3B4orSO5AglhrqlqisMJinymYRwA8rHrotaWaV9+EiiU/Y3AnEex7Dp7eXZCLNzOtGScWRDN4ggDd9KVngI4tnCTLE2WIU1a3tGLWNZfAoPOjYv4CnHr64uw2KCMVy3WRYEUn2rOWlCjlxdxjiEdZiQixj3a6Gh3oRzlZRVYTxp0jKCu1giGP4f4+6cmxOuw8mMLmjQwLlyYFFeQ6DBO9z2gtZ/5lGuNaggPh0W41Si8LaOjWdPE6ImkdzKxzIyO9iCWS2NcLvPAg4A5lJqVtYCDyMXUf/48puZ6h0VF/+nKsXrcekT2A640uHOraS26GpIgRUk9OVV5lFxxCiGYM+DKAkqSyZT/JRAJDXZ2wzwC6Nj+MXzdMw+G3noN9NgXu2qXaDQY9TPoUaEx4gh8L/FHnfjhCnHfoTfTePw2B/RtgtFcRyHYwvv3QS5xqtWtxdT30lSvRd4BaGw0hntLhg210HU6qXb9I6kgMkEEyWTN1q7xLFoiFgphJy1ZfuVJZ78C726XpOMm2JL+mGCf22jqUssYQBR7a26n6GMU0pMCkF67OdmJKDWLOYzA20gBDR2GqaYTrvWeoIK86eIiCZIQhGxLRcAi7dnyIN7cCr7yyH4QNTHqHacAapCd3IsKCRD/42qMY+7ADvtFB7Hj5eXS078BLr1GAyjrYaIVTzlgCKfG7dmxFJBhAV1YIK0OjsvoU2R+tolf/ZxPx+5Tl5p5/ubJnz6tPwj+RQVVRrNhYHTbicY6twcyLboGFgb3tT3eic9tbGDjQhd49uzHpGYfvPaIqq4obn9qJOzvduH7TVsRdgwjQMydYvoqvyJyiRA3oJicmEOp9DUbixyW/fRNr/uxGw9pd2NWdwAR5MQ+rr/Ej+/Didatx36omPHnZVXBsH0IjXantjKUqPS3+5s3KbXpefBS/+moN3nnobgS5yPwb1qOGriakeYiG6nPP+ooSzt2xG0f7iG6kFFFGvEBnJBBmC5vzrrsJXnqznNQ2XfM1/KTtNHS9s42bc4FeifJZ52LmvDaU2eyY2bYQRU3zIKXF2MgwfzOKljm1VDbucsK/n3m9zYbZCxbCZrejed4CONKL8PRfBPCOQj9WvgQ7Gac+7otpFPVrVuEHHd2wnVKrJr3g2htw/j13wfvuILwfRjDx7hAWrluLq25dr9rlJ84jJCs8SNEuq89onYcK4pXwOt9oly6q0pFIjU44lUcIb/Zpi7DurTeQjmRypHhSma0KQ33d8PC9vKEJJgEUkrWoCOWNpyrlD3bzpECSI6Ccv+S4KDR8sA9i+7KmxbAWC8Qx7Jg/G2Y1q3773mGNQXdIe6lRn9tNdzOirpGLEJ01N9FQc+hQP/xeL4qIro2zT4WBfaWPtIuLRUMhVlZm2OvqFc8z6kA8FmM/Az1hOibHPQj6/URQE6rYR0+g08b7vRNwO0a4OTNOmd6I4OQkIsQDa3EJbDWZsJHNjztHEY1EYCmykl8LWSPBNSwUTvp5ifhhhp2Z2GKvrZchioQv8xl4yFECaw3aU2rpzMV4Jj40obV2eWqbzeV9nvfctT7PeG3MZ92PElg6U4LMWMlb/JtK6lBBpmqZ0uf4+Bz+VN7U79z5j7cJU1tb9pMznzQd75fl/79vGSOU2+8/QDU5FFmyNvEAAAAASUVORK5CYII=) [Events](/app/dashboards#/view/suricata-78289c40-86da-11e8-b59d-21efb914e65c) | **[Alerts](/app/dashboards#/view/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c)**", + "openLinksInNewTab": false + }, + "title": "Navigation [Logs Suricata]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "e86b7f30-96da-4f52-9ff0-cefcaadcc914", + "w": 23, + "x": 0, + "y": 0 + }, + "panelIndex": "e86b7f30-96da-4f52-9ff0-cefcaadcc914", + "type": "visualization", + "version": "8.7.1" }, - "type": "table", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"967e2051-c2f4-49ef-bc72-d94947e45883\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"cdbf364a-7d6f-499e-9819-0ef05d687969\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Alert - Source Location [Logs Suricata]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"source.geo.location\",\"id\":\"345ad34d-95d3-4e10-9850-cfd6b366fd7e\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "references": [], + "title": "Alert - Source Location [Logs Suricata]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "isLayerTOCOpen": false, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 360, + "minLat": -85.05113, + "minLon": -360 + }, + "mapCenter": { + "lat": 35.92756, + "lon": 4.09477, + "zoom": 0.78 + }, + "openTOCDetails": [] }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Source Country", - "field": "source.geo.country_iso_code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 15, + "i": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b", + "w": 23, + "x": 0, + "y": 26 + }, + "panelIndex": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b", + "type": "map", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"20edc2ac-aae0-4f6b-8eae-405d2423b580\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"9df30dd6-f660-4daf-a2b6-3691e4bd6e81\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Alert - Destination Location [Logs Suricata]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"destination.geo.location\",\"id\":\"09c636cb-a239-4636-aaba-abbab2ec3b02\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", + "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", + "references": [], + "title": "Alert - Destination Location [Logs Suricata]", + "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" + }, + "enhancements": {}, + "hiddenLayers": [], + "isLayerTOCOpen": false, + "mapBuffer": { + "maxLat": 85.05113, + "maxLon": 360, + "minLat": -85.05113, + "minLon": -360 + }, + "mapCenter": { + "lat": 35.92756, + "lon": 4.09477, + "zoom": 0.78 + }, + "openTOCDetails": [] + }, + "gridData": { + "h": 15, + "i": "df498f0d-f08c-48e0-9b9f-1e579824a327", + "w": 25, + "x": 23, + "y": 26 + }, + "panelIndex": "df498f0d-f08c-48e0-9b9f-1e579824a327", + "type": "map", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Suricata] Alert Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T09:26:50.029Z", + "id": "suricata-05268ee0-86d1-11e8-b59d-21efb914e65c", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-7a1d93ca-33eb-4439-ab54-ec4cd6c5b8ba", + "type": "index-pattern" }, - "gridData": { - "h": 12, - "i": "8", - "w": 11, - "x": 0, - "y": 14 + { + "id": "logs-*", + "name": "1:0e3fce70-e9e8-40b0-a37d-18432058063b", + "type": "index-pattern" }, - "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Navigation [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 18, - "markdown": "![Hello World](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAAyCAYAAAAA9rgCAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAJ17AACdewE8n3fEAAABWWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpMwidZAAAN5UlEQVRoBe1ZeXCU5Rn/7b25s9nEHJAQAhggCIKCThFpFRXFa+yhTtVSndaZUvWPVjqt1bGHY6cdrVNq66C21UpbT7wwxqMjAh4oBCGQC8KRY7Ob3WQ3e9/9Pe/uh2ukrePM7h/oM2S/73ve87l+z/O+6NIkfIFI/wWSVYn6pcAnu8W/tPCXFj7JNPClS59kBv2UOF84Cxs/pYJ8M1jYHS/udIBOV1idF1ZgqWJ1Ov6jpFlKp1PqrVCCF07grLDJeBT+oX5Ex52wVk9DxYy5muwFeRbGn7LCphIx9G26A933noZ0KoFEyAvHe1uUAgoiLRcpiMCMWiVPYGQAvg/vg7lhFpLRIGL+cQxsuBTO95/PyCuKyTMVxqVFDoZtPBSAjivqjJUY/OfXYWlciXl370bVnMUZMXNiO19yF0bg7O6jXicgGJWKw1y3CG3rNsNcZlOonQtk+RJW5i2MwFnLBYcOQGeSZVNIx4eRSiblo6CU/xhmXIr1ktEwQke2Qm+lfPoixMcnEHQMZIQtQOxqWs27wBoMxYKTFHILLdwMmhdSb4RdR7V9FOyZd4G1EsNosUJfvATppI+opVe4HXFnBS4AWGkazbvAUlkJGYvLYKlZhnR0AqnIXpS2fgeRsV5Ibs4AluYL2tby88y/wLJvFcd6GIpsMNpWwFx9BUzl05Dw9SPgOCI9WIicRAJrohiLK5COuVA0/UyEht7m8xwMvvIA3TxBLxfdaz2VDvLyUxALazk2HvAQuHqRDPtgrVvKdBxFMngMrn3blXCFsHLeBdaOglGfB6HDj9Gl52Dyo9+w2rLSsnEYy5sI2uG8WPNEk+ZdYIlfId+RLlrXRUHLVS6OjOyEscSORGBUAdeJNpcPXt4F1tzZ270NejNFSEUodDOSoR7+uVExbw0q5yxVsun0WhLLh6iZOfNbWop1mZbiLDqCBzczD5cTjUMEqDLEJ/ahePpizLhwbVY68YT8C/yxhbk5FW/KBXPQUr4VL7sveUzlad/aM4u2WvwGRg4h5tpNC7dwbIzDo6qmrllykZo0LTW1WiZnXW05bU55apTLy33PRflP8LWB2cODXLPIFcsn9SsLkHOiKmgqb+o3R2pXN7KUt/f9zMlbXecYlFvrLWQZ+E7SaU/1NeXnBHOfcE9Thv23PkaxlgibjEV4IJ+guxlgKa/iJtjE/Jhg0S+KM1gs0BvNPOEk1EEgw2O5aDQhEQnRVeXkIwqiFq3Fak55jwUmMLFnIwxl4s5+SmmhkfthqroUxqJStU0ZG/W61VhzuZ2K+DjSZLzK0+SZSyvVGmo98YocZYiCDSYzDGY5nfDsHfRlqjjKY+I47c7MKIPGmAeH23/BnPgRuxphbbgM827agAg30f3HFUiFBzDz+u2oXrAcQecg+jZeSOw5iJa178M+dxkOv/QgvJ3rmWJWUVEmVlGNsC26HA1nr4G3fw9io50w10odPcn5TUhFAWv9UqWYycE+HHvpXsTcO5Dw96P+4ifQeN63Zc9UZBDdD11LdO+AseIctN3yCkwsUQeevx/+nk1E+wbOGYLeVMGqrQN1qzdj+ooraZQ4+p74McJHH2Ho6NB2mwPWqlraNg3jeH8nDm5YAWM1PU2MGaN2PBtZFNxHA+mQCg2wUCBfWZC74KBU6KDicWa1sVQ8osamjHsRG3MhVsw09MFGRFx/gKmsCpVn3QH/gXuoDHpK0VJ6ElC14DzlUT33t2bPyPSGY0B0YkjNKT/RSQ9jvwP60oWcdzuiPrcSOObpReRgDywto9yhAQkWMuEuKmjFuBobD/gQGWmHztKGhGc/wuOjSmDZu9657XEY6CmG4jPQdM0WzPkhrbbilxxIPxYPpXfJX677yLVBLk/cX7qbbOdg5k2voXjO92CZ1gxn+62I+VwoaVyI6CCFXPoAXXkB21pR3XY2jr3+VxlGS1Wj9sLHMfv2DpQ2LVKblp+IxyFZjBasQoqGCHtGVFv9+bei5dZ2mCrPZbsHRTO+jzl3vQ7b/OWqXYqcpH+YIFmlvsNj1GSWjOGRfyurVi66EfVnXaLY9nnL1DPq92a6qatj2VqW5FX701hxbsxcjrozL0B583wc+P3DKu+aK+pQVNOE4tb5mH7+Dej7++1ovbkDcl3r2/eg0mPF6T9F06rrtdmVNwmWhJxHxCikpOgeYX6DYWWfm8nbnt3PMgwYHjWzUHfGKumoSBTDWyTukR5Irwo5+hVfagK9zlCiXCrqOaKY6RSvX/iX+eBqstJnIfaTvaUScRTZ6mCpv0G5vfq216Fs/ncJfPR1HhJKamcg5B5h3A1AlrK1natWkL5CGsCEHb1KaWkpVli0hB09ql1iMckwkpCSMElnxwmgCoVGD8mRW5HcsEQcexXwiXb1pXOuUA3+fb/D0LZnM6eWjFozIz7LL/vLEJV3Oam6lqUPEtRpnBjMFXakQ2N0MzeqWldi4MUN8O7fCpHfWsI/IrOQCg1RG+eQg0XEsRu6IqC0hZ7Hu7Dw6B6VNcRSmlKUlvktpNdL7KU5rluFXMms1cSM0xB1PosYUVv1qT/namqK2GxbhqGnvgF31ztcmGr7H5QRLmNRNQlLQhPXMhv1KqUEHUcQHP4Xgoy7dHE1TEVl0M2+EFtumw437Kg5cw2cww70HAQOyUWmiVJlSdO1hFPE+QIsZSsYmyupnFlITbyMOO+yFYmC+SJ/x4lyy1VwxLlTeURl6woYSlpY1QWY9sZUN31pXTMar25HzLGTqeMsDPxtOfzDh1RjbvFwfFK+GKkPMzWulb7BaApDo0D3oXG8tflpPPbzW9D+KvDiw0DJnAweHOjqw9NPAE/+6GKUNbQg0bwczz8J7PigHrHkx3GjVWeOESee+y2wzzUNxpoWDPtnQK7Agh5qSBFTDDeg7SHLVMge92wnCC9ESf1MClyrMkh4bEh14eVSGvXLVqPuskeYjt4nYhpw+On1qlFHF5HMIx6T9RqlUV+AwjGcvJGMfrtGUtjyFLCt413846pv4dieHaD3Yu32t1FT36DmMpkMqOBb1YIraRa6VCwMG79LSnj4133CTqr/6NAgBGpitlNha5iB/lgrHtsE9PQdUe1yQTIeSCPGsFd3B4orSO5AglhrqlqisMJinymYRwA8rHrotaWaV9+EiiU/Y3AnEex7Dp7eXZCLNzOtGScWRDN4ggDd9KVngI4tnCTLE2WIU1a3tGLWNZfAoPOjYv4CnHr64uw2KCMVy3WRYEUn2rOWlCjlxdxjiEdZiQixj3a6Gh3oRzlZRVYTxp0jKCu1giGP4f4+6cmxOuw8mMLmjQwLlyYFFeQ6DBO9z2gtZ/5lGuNaggPh0W41Si8LaOjWdPE6ImkdzKxzIyO9iCWS2NcLvPAg4A5lJqVtYCDyMXUf/48puZ6h0VF/+nKsXrcekT2A640uHOraS26GpIgRUk9OVV5lFxxCiGYM+DKAkqSyZT/JRAJDXZ2wzwC6Nj+MXzdMw+G3noN9NgXu2qXaDQY9TPoUaEx4gh8L/FHnfjhCnHfoTfTePw2B/RtgtFcRyHYwvv3QS5xqtWtxdT30lSvRd4BaGw0hntLhg210HU6qXb9I6kgMkEEyWTN1q7xLFoiFgphJy1ZfuVJZ78C726XpOMm2JL+mGCf22jqUssYQBR7a26n6GMU0pMCkF67OdmJKDWLOYzA20gBDR2GqaYTrvWeoIK86eIiCZIQhGxLRcAi7dnyIN7cCr7yyH4QNTHqHacAapCd3IsKCRD/42qMY+7ADvtFB7Hj5eXS078BLr1GAyjrYaIVTzlgCKfG7dmxFJBhAV1YIK0OjsvoU2R+tolf/ZxPx+5Tl5p5/ubJnz6tPwj+RQVVRrNhYHTbicY6twcyLboGFgb3tT3eic9tbGDjQhd49uzHpGYfvPaIqq4obn9qJOzvduH7TVsRdgwjQMydYvoqvyJyiRA3oJicmEOp9DUbixyW/fRNr/uxGw9pd2NWdwAR5MQ+rr/Ej+/Didatx36omPHnZVXBsH0IjXantjKUqPS3+5s3KbXpefBS/+moN3nnobgS5yPwb1qOGriakeYiG6nPP+ooSzt2xG0f7iG6kFFFGvEBnJBBmC5vzrrsJXnqznNQ2XfM1/KTtNHS9s42bc4FeifJZ52LmvDaU2eyY2bYQRU3zIKXF2MgwfzOKljm1VDbucsK/n3m9zYbZCxbCZrejed4CONKL8PRfBPCOQj9WvgQ7Gac+7otpFPVrVuEHHd2wnVKrJr3g2htw/j13wfvuILwfRjDx7hAWrluLq25dr9rlJ84jJCs8SNEuq89onYcK4pXwOt9oly6q0pFIjU44lUcIb/Zpi7DurTeQjmRypHhSma0KQ33d8PC9vKEJJgEUkrWoCOWNpyrlD3bzpECSI6Ccv+S4KDR8sA9i+7KmxbAWC8Qx7Jg/G2Y1q3773mGNQXdIe6lRn9tNdzOirpGLEJ01N9FQc+hQP/xeL4qIro2zT4WBfaWPtIuLRUMhVlZm2OvqFc8z6kA8FmM/Az1hOibHPQj6/URQE6rYR0+g08b7vRNwO0a4OTNOmd6I4OQkIsQDa3EJbDWZsJHNjztHEY1EYCmykl8LWSPBNSwUTvp5ifhhhp2Z2GKvrZchioQv8xl4yFECaw3aU2rpzMV4Jj40obV2eWqbzeV9nvfctT7PeG3MZ92PElg6U4LMWMlb/JtK6lBBpmqZ0uf4+Bz+VN7U79z5j7cJU1tb9pMznzQd75fl/79vGSOU2+8/QDU5FFmyNvEAAAAASUVORK5CYII=) [Events](/app/dashboards#/view/suricata-78289c40-86da-11e8-b59d-21efb914e65c) | [Alerts](/app/dashboards#/view/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c)", - "openLinksInNewTab": false - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "1:d0d32c37-123c-47a7-ad69-2b4d16faa8d1", + "type": "index-pattern" }, - "gridData": { - "h": 4, - "i": "e86b7f30-96da-4f52-9ff0-cefcaadcc914", - "w": 23, - "x": 0, - "y": 0 + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-29186944-4fe9-4b6d-a86b-1f215554bd5b", + "type": "index-pattern" }, - "panelIndex": "e86b7f30-96da-4f52-9ff0-cefcaadcc914", - "type": "visualization", - "version": "8.0.0" - }, - { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 15, - "i": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b", - "w": 23, - "x": 0, - "y": 26 + { + "id": "logs-*", + "name": "2:67c69229-07c2-4215-b5d3-f9ceae074512", + "type": "index-pattern" }, - "panelIndex": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b", - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"967e2051-c2f4-49ef-bc72-d94947e45883\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"cdbf364a-7d6f-499e-9819-0ef05d687969\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Alert - Source Location [Logs Suricata]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"source.geo.location\",\"id\":\"345ad34d-95d3-4e10-9850-cfd6b366fd7e\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], - "title": "Alert - Source Location [Logs Suricata]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "enhancements": {}, - "hiddenLayers": [], - "isLayerTOCOpen": true, - "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 - }, - "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 - }, - "openTOCDetails": [], - "type": "map" - } - }, - { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 15, - "i": "df498f0d-f08c-48e0-9b9f-1e579824a327", - "w": 25, - "x": 23, - "y": 26 + { + "id": "logs-*", + "name": "2:1f9d9e87-9deb-4f53-a2d6-ebf558cd6ee7", + "type": "index-pattern" + }, + { + "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c", + "name": "3:panel_3", + "type": "search" + }, + { + "id": "logs-*", + "name": "7:indexpattern-datasource-layer-c036e878-b4dc-4a98-abc5-1bc666dd109b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7:9f4bd7fa-7c45-4936-b646-ef8abe445ef0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7:2acb37a2-60fb-454d-953a-f10855ca1650", + "type": "index-pattern" }, - "panelIndex": "df498f0d-f08c-48e0-9b9f-1e579824a327", - "embeddableConfig": { - "attributes": { - "description": "", - "layerListJSON": "[{\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"id\":\"20edc2ac-aae0-4f6b-8eae-405d2423b580\",\"label\":null,\"minZoom\":0,\"maxZoom\":24,\"alpha\":1,\"visible\":true,\"style\":{\"type\":\"TILE\"},\"includeInFitToBounds\":true,\"type\":\"EMS_VECTOR_TILE\"},{\"alpha\":0.75,\"id\":\"9df30dd6-f660-4daf-a2b6-3691e4bd6e81\",\"includeInFitToBounds\":true,\"joins\":[],\"label\":\"Alert - Destination Location [Logs Suricata]\",\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"destination.geo.location\",\"id\":\"09c636cb-a239-4636-aaba-abbab2ec3b02\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"point\",\"resolution\":\"MOST_FINE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"isTimeAware\":true,\"properties\":{\"fillColor\":{\"options\":{\"color\":\"Yellow to Red\",\"colorCategory\":\"palette_0\",\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"type\":\"ORDINAL\"},\"type\":\"DYNAMIC\"},\"icon\":{\"options\":{\"value\":\"marker\"},\"type\":\"STATIC\"},\"iconOrientation\":{\"options\":{\"orientation\":0},\"type\":\"STATIC\"},\"iconSize\":{\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3},\"maxSize\":18,\"minSize\":7},\"type\":\"DYNAMIC\"},\"labelBorderColor\":{\"options\":{\"color\":\"#FFFFFF\"},\"type\":\"STATIC\"},\"labelBorderSize\":{\"options\":{\"size\":\"SMALL\"}},\"labelColor\":{\"options\":{\"color\":\"#000000\"},\"type\":\"STATIC\"},\"labelSize\":{\"options\":{\"size\":14},\"type\":\"STATIC\"},\"labelText\":{\"options\":{\"value\":\"\"},\"type\":\"STATIC\"},\"lineColor\":{\"options\":{\"color\":\"#3d3d3d\"},\"type\":\"STATIC\"},\"lineWidth\":{\"options\":{\"size\":1},\"type\":\"STATIC\"},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}}},\"type\":\"VECTOR\"},\"type\":\"GEOJSON_VECTOR\",\"visible\":true}]", - "mapStateJSON": "{\"zoom\":1.78,\"center\":{\"lon\":0,\"lat\":16.40767},\"timeFilters\":{\"from\":\"now-15m\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", - "references": [], - "title": "Alert - Destination Location [Logs Suricata]", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "enhancements": {}, - "hiddenLayers": [], - "isLayerTOCOpen": true, - "mapBuffer": { - "maxLat": 66.51326, - "maxLon": 90, - "minLat": -66.51326, - "minLon": -90 - }, - "mapCenter": { - "lat": 16.40767, - "lon": 0, - "zoom": 1.78 - }, - "openTOCDetails": [], - "type": "map" + { + "id": "logs-*", + "name": "8:indexpattern-datasource-layer-cef42db7-be35-446f-8b05-4df026f4693e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8:da534929-50b7-4725-9932-b3f20668e892", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8:a4fb3d30-c30a-4b37-afca-49170e3f5b68", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b:layer_1_source_index_pattern", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "df498f0d-f08c-48e0-9b9f-1e579824a327:layer_1_source_index_pattern", + "type": "index-pattern" } - } ], - "timeRestore": false, - "title": "[Logs Suricata] Alert Overview", - "version": 1 - }, - "references": [ - { - "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c", - "name": "3:panel_3", - "type": "search" - }, - { - "id": "logs-*", - "name": "4b26e7f7-cfe8-4d5f-8cab-4d793c93c80b:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "df498f0d-f08c-48e0-9b9f-1e579824a327:layer_1_source_index_pattern", - "type": "index-pattern" - }, - { - "type": "search", - "name": "1:search_0", - "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "2:search_0", - "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "7:search_0", - "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "8:search_0", - "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/suricata/kibana/dashboard/suricata-78289c40-86da-11e8-b59d-21efb914e65c.json b/packages/suricata/kibana/dashboard/suricata-78289c40-86da-11e8-b59d-21efb914e65c.json index 6d1b2bd39bb..eea0becd073 100644 --- a/packages/suricata/kibana/dashboard/suricata-78289c40-86da-11e8-b59d-21efb914e65c.json +++ b/packages/suricata/kibana/dashboard/suricata-78289c40-86da-11e8-b59d-21efb914e65c.json @@ -1,919 +1,1619 @@ { - "id": "suricata-78289c40-86da-11e8-b59d-21efb914e65c", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-23T06:37:42.472Z", - "version": "WzU5MCwxXQ==", - "attributes": { - "description": "Overview of the Surcata events dashboard.", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "highlightAll": true, - "query": { - "language": "kuery", - "query": "" - }, - "version": true - } - }, - "optionsJSON": { - "darkTheme": false, - "hidePanelTitles": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Activity Types over Time [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-6y", - "to": "now" - }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "suricata.eve.event_type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { + "attributes": { + "description": "Overview of the Surcata events dashboard.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { "filter": [], "query": { - "language": "kuery", - "query": "" + "language": "kuery", + "query": "" } - } } - } }, - "gridData": { - "h": 10, - "i": "1", - "w": 48, - "x": 0, - "y": 4 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "1", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event Types [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "bottom", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-badb3396-4510-4cfd-bf3e-9c10510c7c8a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a2ab6aae-3dcd-4a7a-91bb-596ea2a9d2d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "974c3496-2ebc-4114-a195-2d18d893db91", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "badb3396-4510-4cfd-bf3e-9c10510c7c8a": { + "columnOrder": [ + "4f8788ec-ac1a-4f38-95b3-ed0573b0a272", + "17169982-ade4-49f5-9095-b430c56f0451", + "48804460-0855-447e-b299-c7b683e906cc" + ], + "columns": { + "17169982-ade4-49f5-9095-b430c56f0451": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "suricata.eve.event_type: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "48804460-0855-447e-b299-c7b683e906cc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "suricata.eve.event_type" + }, + "48804460-0855-447e-b299-c7b683e906cc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "4f8788ec-ac1a-4f38-95b3-ed0573b0a272": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a2ab6aae-3dcd-4a7a-91bb-596ea2a9d2d8", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "974c3496-2ebc-4114-a195-2d18d893db91", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "48804460-0855-447e-b299-c7b683e906cc" + ], + "isHistogram": true, + "layerId": "badb3396-4510-4cfd-bf3e-9c10510c7c8a", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "17169982-ade4-49f5-9095-b430c56f0451", + "xAccessor": "4f8788ec-ac1a-4f38-95b3-ed0573b0a272", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "48804460-0855-447e-b299-c7b683e906cc" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Activity Types over Time [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 10, + "i": "1", + "w": 48, + "x": 0, + "y": 4 + }, + "panelIndex": "1", + "title": "Activity Types over Time [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-736e2330-a095-4ee4-8fa6-f171b22b26d9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a239912a-f085-4c98-ad02-170e8bcaa1a4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c9997602-29ff-4600-866b-ca0815163736", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "736e2330-a095-4ee4-8fa6-f171b22b26d9": { + "columnOrder": [ + "8eecda0b-5a1d-4668-a969-78f615c27edf", + "c4e4245a-7a89-48ec-821e-7fc26c67f4c7", + "5e563253-1039-43ca-95ac-2fea0c63b167" + ], + "columns": { + "5e563253-1039-43ca-95ac-2fea0c63b167": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8eecda0b-5a1d-4668-a969-78f615c27edf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "ECS Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5e563253-1039-43ca-95ac-2fea0c63b167", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "event.type" + }, + "c4e4245a-7a89-48ec-821e-7fc26c67f4c7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Suricata Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5e563253-1039-43ca-95ac-2fea0c63b167", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "suricata.eve.event_type" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a239912a-f085-4c98-ad02-170e8bcaa1a4", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "c9997602-29ff-4600-866b-ca0815163736", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "736e2330-a095-4ee4-8fa6-f171b22b26d9", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "metrics": [ + "5e563253-1039-43ca-95ac-2fea0c63b167" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "8eecda0b-5a1d-4668-a969-78f615c27edf", + "c4e4245a-7a89-48ec-821e-7fc26c67f4c7" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Event Types [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "ECS Event Type", - "field": "event.type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 20 - }, - "schema": "segment", - "type": "terms" + "gridData": { + "h": 14, + "i": "2", + "w": 9, + "x": 0, + "y": 24 }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Suricata Event Type", - "field": "suricata.eve.event_type", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 14, - "i": "2", - "w": 9, - "x": 0, - "y": 24 - }, - "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Network Protocols [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "bottom", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" + "panelIndex": "2", + "title": "Event Types [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0922b5b8-b2bb-411d-a1c9-c3b70a204a29", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3ac18265-ebb1-4c77-8818-717ecdc2bc6c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d365f7e6-bb42-4ffe-9c10-f56d5fd5625a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0922b5b8-b2bb-411d-a1c9-c3b70a204a29": { + "columnOrder": [ + "ae0a5ba1-54d2-4aea-b079-d3bf87f61a13", + "021084de-747e-46ad-aaef-4f00903a5916" + ], + "columns": { + "021084de-747e-46ad-aaef-4f00903a5916": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "ae0a5ba1-54d2-4aea-b079-d3bf87f61a13": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.protocol: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "021084de-747e-46ad-aaef-4f00903a5916", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "network.protocol" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "3ac18265-ebb1-4c77-8818-717ecdc2bc6c", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "d365f7e6-bb42-4ffe-9c10-f56d5fd5625a", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "0922b5b8-b2bb-411d-a1c9-c3b70a204a29", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "bottom", + "legendSize": "auto", + "metrics": [ + "021084de-747e-46ad-aaef-4f00903a5916" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ae0a5ba1-54d2-4aea-b079-d3bf87f61a13" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Top Network Protocols [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "field": "network.protocol", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } - }, - "gridData": { - "h": 14, - "i": "3", - "w": 11, - "x": 19, - "y": 24 - }, - "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Hosts Generating Events [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "labels": { - "show": false - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "circlesRadius": 1, - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "thresholdLine": { - "color": "#E7664C", - "show": false, - "style": "full", - "value": 10, - "width": 1 - }, - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] + "gridData": { + "h": 14, + "i": "3", + "w": 11, + "x": 19, + "y": 24 + }, + "panelIndex": "3", + "title": "Top Network Protocols [Logs Suricata]", + "type": "lens", + "version": "8.7.1" }, - "type": "histogram", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-95182c21-15ca-46e4-8677-0a6900f4b4a5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6e7f72c8-555a-40e4-8058-4291634bf31d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7ade8f7c-5935-48b8-8ec6-fa646d93acf6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "95182c21-15ca-46e4-8677-0a6900f4b4a5": { + "columnOrder": [ + "b919ff81-7a39-4b7f-800a-cffa86050417", + "6543c79e-eaa5-45ac-bf67-1ec48b3d4808", + "97b37d87-545f-49a8-a097-20ca6bcbbc2f" + ], + "columns": { + "6543c79e-eaa5-45ac-bf67-1ec48b3d4808": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "97b37d87-545f-49a8-a097-20ca6bcbbc2f", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "host.name" + }, + "97b37d87-545f-49a8-a097-20ca6bcbbc2f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b919ff81-7a39-4b7f-800a-cffa86050417": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "6e7f72c8-555a-40e4-8058-4291634bf31d", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "7ade8f7c-5935-48b8-8ec6-fa646d93acf6", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "97b37d87-545f-49a8-a097-20ca6bcbbc2f" + ], + "isHistogram": true, + "layerId": "95182c21-15ca-46e4-8677-0a6900f4b4a5", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "splitAccessor": "6543c79e-eaa5-45ac-bf67-1ec48b3d4808", + "xAccessor": "b919ff81-7a39-4b7f-800a-cffa86050417", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "97b37d87-545f-49a8-a097-20ca6bcbbc2f" + } + ] + } + ], + "legend": { + "isVisible": true, + "legendSize": "auto", + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Top Hosts Generating Events [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "scaleMetricValues": false, - "timeRange": { - "from": "now-6y", - "to": "now" + "gridData": { + "h": 10, + "i": "4", + "w": 48, + "x": 0, + "y": 14 + }, + "panelIndex": "4", + "title": "Top Hosts Generating Events [Logs Suricata]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 19, + "i": "5", + "w": 48, + "x": 0, + "y": 38 + }, + "panelIndex": "5", + "panelRefName": "panel_5", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-58e67d93-9711-421b-9203-f12fc156c7e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e1026e0-e9a7-4a76-8053-b69dcd90614a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a92fa015-0d12-491b-adf0-9fae51ba58fd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "58e67d93-9711-421b-9203-f12fc156c7e4": { + "columnOrder": [ + "10ca3cbe-8cee-4960-b530-b6f0b1e332d0", + "f4f28c23-6a87-487e-b1ee-a54dbfcac898" + ], + "columns": { + "10ca3cbe-8cee-4960-b530-b6f0b1e332d0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.transport: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f4f28c23-6a87-487e-b1ee-a54dbfcac898", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "network.transport" + }, + "f4f28c23-6a87-487e-b1ee-a54dbfcac898": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "0e1026e0-e9a7-4a76-8053-b69dcd90614a", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a92fa015-0d12-491b-adf0-9fae51ba58fd", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "58e67d93-9711-421b-9203-f12fc156c7e4", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "bottom", + "legendSize": "auto", + "metrics": [ + "f4f28c23-6a87-487e-b1ee-a54dbfcac898" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "10ca3cbe-8cee-4960-b530-b6f0b1e332d0" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Top Transport Protocols [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsPie" }, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" + "enhancements": {}, + "hidePanelTitles": false }, - { - "enabled": true, - "id": "3", - "params": { - "field": "host.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "group", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } + "gridData": { + "h": 14, + "i": "8", + "w": 10, + "x": 9, + "y": 24 + }, + "panelIndex": "8", + "title": "Top Transport Protocols [Logs Suricata]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {} + }, + "gridData": { + "h": 16, + "i": "9", + "w": 48, + "x": 0, + "y": 57 + }, + "panelIndex": "9", + "panelRefName": "panel_9", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": false, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 18, + "markdown": "![Hello World](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAAyCAYAAAAA9rgCAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAJ17AACdewE8n3fEAAABWWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpMwidZAAAN5UlEQVRoBe1ZeXCU5Rn/7b25s9nEHJAQAhggCIKCThFpFRXFa+yhTtVSndaZUvWPVjqt1bGHY6cdrVNq66C21UpbT7wwxqMjAh4oBCGQC8KRY7Ob3WQ3e9/9Pe/uh2ukrePM7h/oM2S/73ve87l+z/O+6NIkfIFI/wWSVYn6pcAnu8W/tPCXFj7JNPClS59kBv2UOF84Cxs/pYJ8M1jYHS/udIBOV1idF1ZgqWJ1Ov6jpFlKp1PqrVCCF07grLDJeBT+oX5Ex52wVk9DxYy5muwFeRbGn7LCphIx9G26A933noZ0KoFEyAvHe1uUAgoiLRcpiMCMWiVPYGQAvg/vg7lhFpLRIGL+cQxsuBTO95/PyCuKyTMVxqVFDoZtPBSAjivqjJUY/OfXYWlciXl370bVnMUZMXNiO19yF0bg7O6jXicgGJWKw1y3CG3rNsNcZlOonQtk+RJW5i2MwFnLBYcOQGeSZVNIx4eRSiblo6CU/xhmXIr1ktEwQke2Qm+lfPoixMcnEHQMZIQtQOxqWs27wBoMxYKTFHILLdwMmhdSb4RdR7V9FOyZd4G1EsNosUJfvATppI+opVe4HXFnBS4AWGkazbvAUlkJGYvLYKlZhnR0AqnIXpS2fgeRsV5Ibs4AluYL2tby88y/wLJvFcd6GIpsMNpWwFx9BUzl05Dw9SPgOCI9WIicRAJrohiLK5COuVA0/UyEht7m8xwMvvIA3TxBLxfdaz2VDvLyUxALazk2HvAQuHqRDPtgrVvKdBxFMngMrn3blXCFsHLeBdaOglGfB6HDj9Gl52Dyo9+w2rLSsnEYy5sI2uG8WPNEk+ZdYIlfId+RLlrXRUHLVS6OjOyEscSORGBUAdeJNpcPXt4F1tzZ270NejNFSEUodDOSoR7+uVExbw0q5yxVsun0WhLLh6iZOfNbWop1mZbiLDqCBzczD5cTjUMEqDLEJ/ahePpizLhwbVY68YT8C/yxhbk5FW/KBXPQUr4VL7sveUzlad/aM4u2WvwGRg4h5tpNC7dwbIzDo6qmrllykZo0LTW1WiZnXW05bU55apTLy33PRflP8LWB2cODXLPIFcsn9SsLkHOiKmgqb+o3R2pXN7KUt/f9zMlbXecYlFvrLWQZ+E7SaU/1NeXnBHOfcE9Thv23PkaxlgibjEV4IJ+guxlgKa/iJtjE/Jhg0S+KM1gs0BvNPOEk1EEgw2O5aDQhEQnRVeXkIwqiFq3Fak55jwUmMLFnIwxl4s5+SmmhkfthqroUxqJStU0ZG/W61VhzuZ2K+DjSZLzK0+SZSyvVGmo98YocZYiCDSYzDGY5nfDsHfRlqjjKY+I47c7MKIPGmAeH23/BnPgRuxphbbgM827agAg30f3HFUiFBzDz+u2oXrAcQecg+jZeSOw5iJa178M+dxkOv/QgvJ3rmWJWUVEmVlGNsC26HA1nr4G3fw9io50w10odPcn5TUhFAWv9UqWYycE+HHvpXsTcO5Dw96P+4ifQeN63Zc9UZBDdD11LdO+AseIctN3yCkwsUQeevx/+nk1E+wbOGYLeVMGqrQN1qzdj+ooraZQ4+p74McJHH2Ho6NB2mwPWqlraNg3jeH8nDm5YAWM1PU2MGaN2PBtZFNxHA+mQCg2wUCBfWZC74KBU6KDicWa1sVQ8osamjHsRG3MhVsw09MFGRFx/gKmsCpVn3QH/gXuoDHpK0VJ6ElC14DzlUT33t2bPyPSGY0B0YkjNKT/RSQ9jvwP60oWcdzuiPrcSOObpReRgDywto9yhAQkWMuEuKmjFuBobD/gQGWmHztKGhGc/wuOjSmDZu9657XEY6CmG4jPQdM0WzPkhrbbilxxIPxYPpXfJX677yLVBLk/cX7qbbOdg5k2voXjO92CZ1gxn+62I+VwoaVyI6CCFXPoAXXkB21pR3XY2jr3+VxlGS1Wj9sLHMfv2DpQ2LVKblp+IxyFZjBasQoqGCHtGVFv9+bei5dZ2mCrPZbsHRTO+jzl3vQ7b/OWqXYqcpH+YIFmlvsNj1GSWjOGRfyurVi66EfVnXaLY9nnL1DPq92a6qatj2VqW5FX701hxbsxcjrozL0B583wc+P3DKu+aK+pQVNOE4tb5mH7+Dej7++1ovbkDcl3r2/eg0mPF6T9F06rrtdmVNwmWhJxHxCikpOgeYX6DYWWfm8nbnt3PMgwYHjWzUHfGKumoSBTDWyTukR5Irwo5+hVfagK9zlCiXCrqOaKY6RSvX/iX+eBqstJnIfaTvaUScRTZ6mCpv0G5vfq216Fs/ncJfPR1HhJKamcg5B5h3A1AlrK1natWkL5CGsCEHb1KaWkpVli0hB09ql1iMckwkpCSMElnxwmgCoVGD8mRW5HcsEQcexXwiXb1pXOuUA3+fb/D0LZnM6eWjFozIz7LL/vLEJV3Oam6lqUPEtRpnBjMFXakQ2N0MzeqWldi4MUN8O7fCpHfWsI/IrOQCg1RG+eQg0XEsRu6IqC0hZ7Hu7Dw6B6VNcRSmlKUlvktpNdL7KU5rluFXMms1cSM0xB1PosYUVv1qT/namqK2GxbhqGnvgF31ztcmGr7H5QRLmNRNQlLQhPXMhv1KqUEHUcQHP4Xgoy7dHE1TEVl0M2+EFtumw437Kg5cw2cww70HAQOyUWmiVJlSdO1hFPE+QIsZSsYmyupnFlITbyMOO+yFYmC+SJ/x4lyy1VwxLlTeURl6woYSlpY1QWY9sZUN31pXTMar25HzLGTqeMsDPxtOfzDh1RjbvFwfFK+GKkPMzWulb7BaApDo0D3oXG8tflpPPbzW9D+KvDiw0DJnAweHOjqw9NPAE/+6GKUNbQg0bwczz8J7PigHrHkx3GjVWeOESee+y2wzzUNxpoWDPtnQK7Agh5qSBFTDDeg7SHLVMge92wnCC9ESf1MClyrMkh4bEh14eVSGvXLVqPuskeYjt4nYhpw+On1qlFHF5HMIx6T9RqlUV+AwjGcvJGMfrtGUtjyFLCt413846pv4dieHaD3Yu32t1FT36DmMpkMqOBb1YIraRa6VCwMG79LSnj4133CTqr/6NAgBGpitlNha5iB/lgrHtsE9PQdUe1yQTIeSCPGsFd3B4orSO5AglhrqlqisMJinymYRwA8rHrotaWaV9+EiiU/Y3AnEex7Dp7eXZCLNzOtGScWRDN4ggDd9KVngI4tnCTLE2WIU1a3tGLWNZfAoPOjYv4CnHr64uw2KCMVy3WRYEUn2rOWlCjlxdxjiEdZiQixj3a6Gh3oRzlZRVYTxp0jKCu1giGP4f4+6cmxOuw8mMLmjQwLlyYFFeQ6DBO9z2gtZ/5lGuNaggPh0W41Si8LaOjWdPE6ImkdzKxzIyO9iCWS2NcLvPAg4A5lJqVtYCDyMXUf/48puZ6h0VF/+nKsXrcekT2A640uHOraS26GpIgRUk9OVV5lFxxCiGYM+DKAkqSyZT/JRAJDXZ2wzwC6Nj+MXzdMw+G3noN9NgXu2qXaDQY9TPoUaEx4gh8L/FHnfjhCnHfoTfTePw2B/RtgtFcRyHYwvv3QS5xqtWtxdT30lSvRd4BaGw0hntLhg210HU6qXb9I6kgMkEEyWTN1q7xLFoiFgphJy1ZfuVJZ78C726XpOMm2JL+mGCf22jqUssYQBR7a26n6GMU0pMCkF67OdmJKDWLOYzA20gBDR2GqaYTrvWeoIK86eIiCZIQhGxLRcAi7dnyIN7cCr7yyH4QNTHqHacAapCd3IsKCRD/42qMY+7ADvtFB7Hj5eXS078BLr1GAyjrYaIVTzlgCKfG7dmxFJBhAV1YIK0OjsvoU2R+tolf/ZxPx+5Tl5p5/ubJnz6tPwj+RQVVRrNhYHTbicY6twcyLboGFgb3tT3eic9tbGDjQhd49uzHpGYfvPaIqq4obn9qJOzvduH7TVsRdgwjQMydYvoqvyJyiRA3oJicmEOp9DUbixyW/fRNr/uxGw9pd2NWdwAR5MQ+rr/Ej+/Didatx36omPHnZVXBsH0IjXantjKUqPS3+5s3KbXpefBS/+moN3nnobgS5yPwb1qOGriakeYiG6nPP+ooSzt2xG0f7iG6kFFFGvEBnJBBmC5vzrrsJXnqznNQ2XfM1/KTtNHS9s42bc4FeifJZ52LmvDaU2eyY2bYQRU3zIKXF2MgwfzOKljm1VDbucsK/n3m9zYbZCxbCZrejed4CONKL8PRfBPCOQj9WvgQ7Gac+7otpFPVrVuEHHd2wnVKrJr3g2htw/j13wfvuILwfRjDx7hAWrluLq25dr9rlJ84jJCs8SNEuq89onYcK4pXwOt9oly6q0pFIjU44lUcIb/Zpi7DurTeQjmRypHhSma0KQ33d8PC9vKEJJgEUkrWoCOWNpyrlD3bzpECSI6Ccv+S4KDR8sA9i+7KmxbAWC8Qx7Jg/G2Y1q3773mGNQXdIe6lRn9tNdzOirpGLEJ01N9FQc+hQP/xeL4qIro2zT4WBfaWPtIuLRUMhVlZm2OvqFc8z6kA8FmM/Az1hOibHPQj6/URQE6rYR0+g08b7vRNwO0a4OTNOmd6I4OQkIsQDa3EJbDWZsJHNjztHEY1EYCmykl8LWSPBNSwUTvp5ifhhhp2Z2GKvrZchioQv8xl4yFECaw3aU2rpzMV4Jj40obV2eWqbzeV9nvfctT7PeG3MZ92PElg6U4LMWMlb/JtK6lBBpmqZ0uf4+Bz+VN7U79z5j7cJU1tb9pMznzQd75fl/79vGSOU2+8/QDU5FFmyNvEAAAAASUVORK5CYII=) **[Events](/app/dashboards#/view/suricata-78289c40-86da-11e8-b59d-21efb914e65c)** | [Alerts](/app/dashboards#/view/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c)", + "openLinksInNewTab": false + }, + "title": "Navigation [Logs Suricata]", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 4, + "i": "78f64fb8-a6ed-4960-a73b-a8c42c40f799", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "78f64fb8-a6ed-4960-a73b-a8c42c40f799", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-479261a8-06fd-422b-8198-d67996a44dcf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "04032804-93de-4d44-8d3a-e0f3ff5e2439", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9377fcbf-51ac-4bd3-b22f-e3b718f12d40", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "479261a8-06fd-422b-8198-d67996a44dcf": { + "columnOrder": [ + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1", + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X0", + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X1" + ], + "columns": { + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Events", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X1" + ], + "scale": "ratio" + }, + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Events", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Events", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "04032804-93de-4d44-8d3a-e0f3ff5e2439", + "key": "event.kind", + "negate": false, + "params": { + "query": "event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.kind": "event" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9377fcbf-51ac-4bd3-b22f-e3b718f12d40", + "key": "query", + "negate": false, + "type": "custom", + "value": "{\"prefix\":{\"data_stream.dataset\":\"suricata.\"}}" + }, + "query": { + "prefix": { + "data_stream.dataset": "suricata." + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "479261a8-06fd-422b-8198-d67996a44dcf", + "layerType": "data", + "metricAccessor": "1cf3ec6b-b93b-473a-aeb3-ef384fd1e8c1" + } + }, + "title": "Event Count [Logs Suricata] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 4, + "i": "63e14057-b48b-48fe-b3e2-84f7690d60e8", + "w": 24, + "x": 24, + "y": 0 + }, + "panelIndex": "63e14057-b48b-48fe-b3e2-84f7690d60e8", + "title": "Event Count [Logs Suricata]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8b407c5e-b584-44cd-8ffb-d88c2d18acfd": { + "columnOrder": [ + "92417e04-1965-4313-8980-4f7fc9c3dd38", + "9c2c315b-8d6e-427e-81fd-753eacec15fc" + ], + "columns": { + "92417e04-1965-4313-8980-4f7fc9c3dd38": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Country Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c2c315b-8d6e-427e-81fd-753eacec15fc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "source.geo.country_iso_code" + }, + "9c2c315b-8d6e-427e-81fd-753eacec15fc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count ", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "9c2c315b-8d6e-427e-81fd-753eacec15fc", + "isTransposed": false + }, + { + "columnId": "92417e04-1965-4313-8980-4f7fc9c3dd38", + "isTransposed": false + } + ], + "layerId": "8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "50b63880-dc79-4d41-a2e7-d5769a3faa0f", + "w": 9, + "x": 30, + "y": 24 + }, + "panelIndex": "50b63880-dc79-4d41-a2e7-d5769a3faa0f", + "title": "Top Connection Source Countries [Logs Suricata]", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8b407c5e-b584-44cd-8ffb-d88c2d18acfd": { + "columnOrder": [ + "92417e04-1965-4313-8980-4f7fc9c3dd38", + "9c2c315b-8d6e-427e-81fd-753eacec15fc" + ], + "columns": { + "92417e04-1965-4313-8980-4f7fc9c3dd38": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Country Code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9c2c315b-8d6e-427e-81fd-753eacec15fc", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "destination.geo.country_iso_code" + }, + "9c2c315b-8d6e-427e-81fd-753eacec15fc": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count ", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "9c2c315b-8d6e-427e-81fd-753eacec15fc", + "isTransposed": false + }, + { + "columnId": "92417e04-1965-4313-8980-4f7fc9c3dd38", + "isTransposed": false + } + ], + "layerId": "8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "71d6923a-3899-4608-854d-93a0a1308674", + "w": 9, + "x": 39, + "y": 24 + }, + "panelIndex": "71d6923a-3899-4608-854d-93a0a1308674", + "title": "Top Connection Destination Countries [Logs Suricata]", + "type": "lens", + "version": "8.7.1" } - } + ], + "timeRestore": false, + "title": "[Logs Suricata] Events Overview", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T09:41:33.825Z", + "id": "suricata-78289c40-86da-11e8-b59d-21efb914e65c", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "1:indexpattern-datasource-layer-badb3396-4510-4cfd-bf3e-9c10510c7c8a", + "type": "index-pattern" }, - "gridData": { - "h": 10, - "i": "4", - "w": 48, - "x": 0, - "y": 14 + { + "id": "logs-*", + "name": "1:a2ab6aae-3dcd-4a7a-91bb-596ea2a9d2d8", + "type": "index-pattern" }, - "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "1:974c3496-2ebc-4114-a195-2d18d893db91", + "type": "index-pattern" }, - "gridData": { - "h": 19, - "i": "5", - "w": 48, - "x": 0, - "y": 38 + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-736e2330-a095-4ee4-8fa6-f171b22b26d9", + "type": "index-pattern" }, - "panelIndex": "5", - "panelRefName": "panel_5", - "type": "search", - "version": "7.9.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Connection Source Countries [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": false - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Top Connection Source Countries", - "field": "source.geo.country_iso_code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "2:a239912a-f085-4c98-ad02-170e8bcaa1a4", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "6", - "w": 9, - "x": 30, - "y": 24 + { + "id": "logs-*", + "name": "2:c9997602-29ff-4600-866b-ca0815163736", + "type": "index-pattern" }, - "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Connection Destination Countries [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "scale": "linear", - "showLabel": false - }, - "type": "tagcloud", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Top Connection Destination Countries", - "field": "destination.geo.country_iso_code", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-0922b5b8-b2bb-411d-a1c9-c3b70a204a29", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "7", - "w": 9, - "x": 39, - "y": 24 + { + "id": "logs-*", + "name": "3:3ac18265-ebb1-4c77-8818-717ecdc2bc6c", + "type": "index-pattern" }, - "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top Transport Protocols [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "bottom", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "3:d365f7e6-bb42-4ffe-9c10-f56d5fd5625a", + "type": "index-pattern" }, - "gridData": { - "h": 14, - "i": "8", - "w": 10, - "x": 9, - "y": 24 + { + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-95182c21-15ca-46e4-8677-0a6900f4b4a5", + "type": "index-pattern" }, - "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {} + { + "id": "logs-*", + "name": "4:6e7f72c8-555a-40e4-8058-4291634bf31d", + "type": "index-pattern" }, - "gridData": { - "h": 16, - "i": "9", - "w": 48, - "x": 0, - "y": 57 + { + "id": "logs-*", + "name": "4:7ade8f7c-5935-48b8-8ec6-fa646d93acf6", + "type": "index-pattern" }, - "panelIndex": "9", - "panelRefName": "panel_9", - "type": "search", - "version": "7.9.0-SNAPSHOT" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Navigation [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "fontSize": 18, - "markdown": "![Hello World](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADwAAAAyCAYAAAAA9rgCAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JgAAgIQAAPoAAACA6AAAdTAAAOpgAAA6mAAAF3CculE8AAAACXBIWXMAAJ17AACdewE8n3fEAAABWWlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNS40LjAiPgogICA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAgICB4bWxuczp0aWZmPSJodHRwOi8vbnMuYWRvYmUuY29tL3RpZmYvMS4wLyI+CiAgICAgICAgIDx0aWZmOk9yaWVudGF0aW9uPjE8L3RpZmY6T3JpZW50YXRpb24+CiAgICAgIDwvcmRmOkRlc2NyaXB0aW9uPgogICA8L3JkZjpSREY+CjwveDp4bXBtZXRhPgpMwidZAAAN5UlEQVRoBe1ZeXCU5Rn/7b25s9nEHJAQAhggCIKCThFpFRXFa+yhTtVSndaZUvWPVjqt1bGHY6cdrVNq66C21UpbT7wwxqMjAh4oBCGQC8KRY7Ob3WQ3e9/9Pe/uh2ukrePM7h/oM2S/73ve87l+z/O+6NIkfIFI/wWSVYn6pcAnu8W/tPCXFj7JNPClS59kBv2UOF84Cxs/pYJ8M1jYHS/udIBOV1idF1ZgqWJ1Ov6jpFlKp1PqrVCCF07grLDJeBT+oX5Ex52wVk9DxYy5muwFeRbGn7LCphIx9G26A933noZ0KoFEyAvHe1uUAgoiLRcpiMCMWiVPYGQAvg/vg7lhFpLRIGL+cQxsuBTO95/PyCuKyTMVxqVFDoZtPBSAjivqjJUY/OfXYWlciXl370bVnMUZMXNiO19yF0bg7O6jXicgGJWKw1y3CG3rNsNcZlOonQtk+RJW5i2MwFnLBYcOQGeSZVNIx4eRSiblo6CU/xhmXIr1ktEwQke2Qm+lfPoixMcnEHQMZIQtQOxqWs27wBoMxYKTFHILLdwMmhdSb4RdR7V9FOyZd4G1EsNosUJfvATppI+opVe4HXFnBS4AWGkazbvAUlkJGYvLYKlZhnR0AqnIXpS2fgeRsV5Ibs4AluYL2tby88y/wLJvFcd6GIpsMNpWwFx9BUzl05Dw9SPgOCI9WIicRAJrohiLK5COuVA0/UyEht7m8xwMvvIA3TxBLxfdaz2VDvLyUxALazk2HvAQuHqRDPtgrVvKdBxFMngMrn3blXCFsHLeBdaOglGfB6HDj9Gl52Dyo9+w2rLSsnEYy5sI2uG8WPNEk+ZdYIlfId+RLlrXRUHLVS6OjOyEscSORGBUAdeJNpcPXt4F1tzZ270NejNFSEUodDOSoR7+uVExbw0q5yxVsun0WhLLh6iZOfNbWop1mZbiLDqCBzczD5cTjUMEqDLEJ/ahePpizLhwbVY68YT8C/yxhbk5FW/KBXPQUr4VL7sveUzlad/aM4u2WvwGRg4h5tpNC7dwbIzDo6qmrllykZo0LTW1WiZnXW05bU55apTLy33PRflP8LWB2cODXLPIFcsn9SsLkHOiKmgqb+o3R2pXN7KUt/f9zMlbXecYlFvrLWQZ+E7SaU/1NeXnBHOfcE9Thv23PkaxlgibjEV4IJ+guxlgKa/iJtjE/Jhg0S+KM1gs0BvNPOEk1EEgw2O5aDQhEQnRVeXkIwqiFq3Fak55jwUmMLFnIwxl4s5+SmmhkfthqroUxqJStU0ZG/W61VhzuZ2K+DjSZLzK0+SZSyvVGmo98YocZYiCDSYzDGY5nfDsHfRlqjjKY+I47c7MKIPGmAeH23/BnPgRuxphbbgM827agAg30f3HFUiFBzDz+u2oXrAcQecg+jZeSOw5iJa178M+dxkOv/QgvJ3rmWJWUVEmVlGNsC26HA1nr4G3fw9io50w10odPcn5TUhFAWv9UqWYycE+HHvpXsTcO5Dw96P+4ifQeN63Zc9UZBDdD11LdO+AseIctN3yCkwsUQeevx/+nk1E+wbOGYLeVMGqrQN1qzdj+ooraZQ4+p74McJHH2Ho6NB2mwPWqlraNg3jeH8nDm5YAWM1PU2MGaN2PBtZFNxHA+mQCg2wUCBfWZC74KBU6KDicWa1sVQ8osamjHsRG3MhVsw09MFGRFx/gKmsCpVn3QH/gXuoDHpK0VJ6ElC14DzlUT33t2bPyPSGY0B0YkjNKT/RSQ9jvwP60oWcdzuiPrcSOObpReRgDywto9yhAQkWMuEuKmjFuBobD/gQGWmHztKGhGc/wuOjSmDZu9657XEY6CmG4jPQdM0WzPkhrbbilxxIPxYPpXfJX677yLVBLk/cX7qbbOdg5k2voXjO92CZ1gxn+62I+VwoaVyI6CCFXPoAXXkB21pR3XY2jr3+VxlGS1Wj9sLHMfv2DpQ2LVKblp+IxyFZjBasQoqGCHtGVFv9+bei5dZ2mCrPZbsHRTO+jzl3vQ7b/OWqXYqcpH+YIFmlvsNj1GSWjOGRfyurVi66EfVnXaLY9nnL1DPq92a6qatj2VqW5FX701hxbsxcjrozL0B583wc+P3DKu+aK+pQVNOE4tb5mH7+Dej7++1ovbkDcl3r2/eg0mPF6T9F06rrtdmVNwmWhJxHxCikpOgeYX6DYWWfm8nbnt3PMgwYHjWzUHfGKumoSBTDWyTukR5Irwo5+hVfagK9zlCiXCrqOaKY6RSvX/iX+eBqstJnIfaTvaUScRTZ6mCpv0G5vfq216Fs/ncJfPR1HhJKamcg5B5h3A1AlrK1natWkL5CGsCEHb1KaWkpVli0hB09ql1iMckwkpCSMElnxwmgCoVGD8mRW5HcsEQcexXwiXb1pXOuUA3+fb/D0LZnM6eWjFozIz7LL/vLEJV3Oam6lqUPEtRpnBjMFXakQ2N0MzeqWldi4MUN8O7fCpHfWsI/IrOQCg1RG+eQg0XEsRu6IqC0hZ7Hu7Dw6B6VNcRSmlKUlvktpNdL7KU5rluFXMms1cSM0xB1PosYUVv1qT/namqK2GxbhqGnvgF31ztcmGr7H5QRLmNRNQlLQhPXMhv1KqUEHUcQHP4Xgoy7dHE1TEVl0M2+EFtumw437Kg5cw2cww70HAQOyUWmiVJlSdO1hFPE+QIsZSsYmyupnFlITbyMOO+yFYmC+SJ/x4lyy1VwxLlTeURl6woYSlpY1QWY9sZUN31pXTMar25HzLGTqeMsDPxtOfzDh1RjbvFwfFK+GKkPMzWulb7BaApDo0D3oXG8tflpPPbzW9D+KvDiw0DJnAweHOjqw9NPAE/+6GKUNbQg0bwczz8J7PigHrHkx3GjVWeOESee+y2wzzUNxpoWDPtnQK7Agh5qSBFTDDeg7SHLVMge92wnCC9ESf1MClyrMkh4bEh14eVSGvXLVqPuskeYjt4nYhpw+On1qlFHF5HMIx6T9RqlUV+AwjGcvJGMfrtGUtjyFLCt413846pv4dieHaD3Yu32t1FT36DmMpkMqOBb1YIraRa6VCwMG79LSnj4133CTqr/6NAgBGpitlNha5iB/lgrHtsE9PQdUe1yQTIeSCPGsFd3B4orSO5AglhrqlqisMJinymYRwA8rHrotaWaV9+EiiU/Y3AnEex7Dp7eXZCLNzOtGScWRDN4ggDd9KVngI4tnCTLE2WIU1a3tGLWNZfAoPOjYv4CnHr64uw2KCMVy3WRYEUn2rOWlCjlxdxjiEdZiQixj3a6Gh3oRzlZRVYTxp0jKCu1giGP4f4+6cmxOuw8mMLmjQwLlyYFFeQ6DBO9z2gtZ/5lGuNaggPh0W41Si8LaOjWdPE6ImkdzKxzIyO9iCWS2NcLvPAg4A5lJqVtYCDyMXUf/48puZ6h0VF/+nKsXrcekT2A640uHOraS26GpIgRUk9OVV5lFxxCiGYM+DKAkqSyZT/JRAJDXZ2wzwC6Nj+MXzdMw+G3noN9NgXu2qXaDQY9TPoUaEx4gh8L/FHnfjhCnHfoTfTePw2B/RtgtFcRyHYwvv3QS5xqtWtxdT30lSvRd4BaGw0hntLhg210HU6qXb9I6kgMkEEyWTN1q7xLFoiFgphJy1ZfuVJZ78C726XpOMm2JL+mGCf22jqUssYQBR7a26n6GMU0pMCkF67OdmJKDWLOYzA20gBDR2GqaYTrvWeoIK86eIiCZIQhGxLRcAi7dnyIN7cCr7yyH4QNTHqHacAapCd3IsKCRD/42qMY+7ADvtFB7Hj5eXS078BLr1GAyjrYaIVTzlgCKfG7dmxFJBhAV1YIK0OjsvoU2R+tolf/ZxPx+5Tl5p5/ubJnz6tPwj+RQVVRrNhYHTbicY6twcyLboGFgb3tT3eic9tbGDjQhd49uzHpGYfvPaIqq4obn9qJOzvduH7TVsRdgwjQMydYvoqvyJyiRA3oJicmEOp9DUbixyW/fRNr/uxGw9pd2NWdwAR5MQ+rr/Ej+/Didatx36omPHnZVXBsH0IjXantjKUqPS3+5s3KbXpefBS/+moN3nnobgS5yPwb1qOGriakeYiG6nPP+ooSzt2xG0f7iG6kFFFGvEBnJBBmC5vzrrsJXnqznNQ2XfM1/KTtNHS9s42bc4FeifJZ52LmvDaU2eyY2bYQRU3zIKXF2MgwfzOKljm1VDbucsK/n3m9zYbZCxbCZrejed4CONKL8PRfBPCOQj9WvgQ7Gac+7otpFPVrVuEHHd2wnVKrJr3g2htw/j13wfvuILwfRjDx7hAWrluLq25dr9rlJ84jJCs8SNEuq89onYcK4pXwOt9oly6q0pFIjU44lUcIb/Zpi7DurTeQjmRypHhSma0KQ33d8PC9vKEJJgEUkrWoCOWNpyrlD3bzpECSI6Ccv+S4KDR8sA9i+7KmxbAWC8Qx7Jg/G2Y1q3773mGNQXdIe6lRn9tNdzOirpGLEJ01N9FQc+hQP/xeL4qIro2zT4WBfaWPtIuLRUMhVlZm2OvqFc8z6kA8FmM/Az1hOibHPQj6/URQE6rYR0+g08b7vRNwO0a4OTNOmd6I4OQkIsQDa3EJbDWZsJHNjztHEY1EYCmykl8LWSPBNSwUTvp5ifhhhp2Z2GKvrZchioQv8xl4yFECaw3aU2rpzMV4Jj40obV2eWqbzeV9nvfctT7PeG3MZ92PElg6U4LMWMlb/JtK6lBBpmqZ0uf4+Bz+VN7U79z5j7cJU1tb9pMznzQd75fl/79vGSOU2+8/QDU5FFmyNvEAAAAASUVORK5CYII=) [Events](/app/dashboards#/view/suricata-78289c40-86da-11e8-b59d-21efb914e65c) | [Alerts](/app/dashboards#/view/suricata-05268ee0-86d1-11e8-b59d-21efb914e65c)", - "openLinksInNewTab": false - }, - "type": "markdown", - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c", + "name": "5:panel_5", + "type": "search" }, - "gridData": { - "h": 4, - "i": "78f64fb8-a6ed-4960-a73b-a8c42c40f799", - "w": 24, - "x": 0, - "y": 0 + { + "id": "logs-*", + "name": "8:indexpattern-datasource-layer-58e67d93-9711-421b-9203-f12fc156c7e4", + "type": "index-pattern" }, - "panelIndex": "78f64fb8-a6ed-4960-a73b-a8c42c40f799", - "title": "", - "type": "visualization", - "version": "8.0.0" - }, - { - "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Event Count [Logs Suricata]", - "description": "", - "uiState": {}, - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 30, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "type": "metric", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Events" - }, - "schema": "metric", - "type": "count" - } - ], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - } - } + { + "id": "logs-*", + "name": "8:0e1026e0-e9a7-4a76-8053-b69dcd90614a", + "type": "index-pattern" }, - "gridData": { - "h": 4, - "i": "63e14057-b48b-48fe-b3e2-84f7690d60e8", - "w": 24, - "x": 24, - "y": 0 + { + "id": "logs-*", + "name": "8:a92fa015-0d12-491b-adf0-9fae51ba58fd", + "type": "index-pattern" }, - "panelIndex": "63e14057-b48b-48fe-b3e2-84f7690d60e8", - "type": "visualization", - "version": "8.0.0" - } + { + "id": "suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c", + "name": "9:panel_9", + "type": "search" + }, + { + "id": "logs-*", + "name": "63e14057-b48b-48fe-b3e2-84f7690d60e8:indexpattern-datasource-layer-479261a8-06fd-422b-8198-d67996a44dcf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63e14057-b48b-48fe-b3e2-84f7690d60e8:04032804-93de-4d44-8d3a-e0f3ff5e2439", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "63e14057-b48b-48fe-b3e2-84f7690d60e8:9377fcbf-51ac-4bd3-b22f-e3b718f12d40", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "50b63880-dc79-4d41-a2e7-d5769a3faa0f:indexpattern-datasource-layer-8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "71d6923a-3899-4608-854d-93a0a1308674:indexpattern-datasource-layer-8b407c5e-b584-44cd-8ffb-d88c2d18acfd", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Logs Suricata] Events Overview", - "version": 1 - }, - "references": [ - { - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c", - "name": "5:panel_5", - "type": "search" - }, - { - "id": "suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c", - "name": "9:panel_9", - "type": "search" - }, - { - "type": "search", - "name": "1:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "2:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "3:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "4:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "6:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "7:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "8:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - }, - { - "type": "search", - "name": "63e14057-b48b-48fe-b3e2-84f7690d60e8:search_0", - "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c" - } - ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/suricata/kibana/search/suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c.json b/packages/suricata/kibana/search/suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c.json index 8da6c6be5a4..34f0abce58d 100644 --- a/packages/suricata/kibana/search/suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c.json +++ b/packages/suricata/kibana/search/suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c.json @@ -75,7 +75,8 @@ "title": "Events [Logs Suricata]", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T09:21:29.779Z", "id": "suricata-13dd22f0-86cc-11e8-b59d-21efb914e65c", "migrationVersion": { "search": "8.0.0" diff --git a/packages/suricata/kibana/search/suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c.json b/packages/suricata/kibana/search/suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c.json index 2a462afaf88..ccaf7442e09 100644 --- a/packages/suricata/kibana/search/suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c.json +++ b/packages/suricata/kibana/search/suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c.json @@ -74,7 +74,8 @@ "title": "Alerts [Logs Suricata]", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T09:21:29.779Z", "id": "suricata-1c2bcec0-86d1-11e8-b59d-21efb914e65c", "migrationVersion": { "search": "8.0.0" diff --git a/packages/suricata/kibana/search/suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c.json b/packages/suricata/kibana/search/suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c.json index cabd0d72c5c..001116aa324 100644 --- a/packages/suricata/kibana/search/suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c.json +++ b/packages/suricata/kibana/search/suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c.json @@ -73,7 +73,8 @@ "title": "Host Stats [Logs Suricata]", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-06T09:21:29.779Z", "id": "suricata-d57a2db0-86ca-11e8-b59d-21efb914e65c", "migrationVersion": { "search": "8.0.0" diff --git a/packages/suricata/kibana/tags.yml b/packages/suricata/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/suricata/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/suricata/manifest.yml b/packages/suricata/manifest.yml index 920f1cb52d3..202f3da267c 100644 --- a/packages/suricata/manifest.yml +++ b/packages/suricata/manifest.yml @@ -1,7 +1,6 @@ name: suricata title: Suricata -version: "2.9.0" -release: ga +version: "2.16.0" description: Collect logs from Suricata with Elastic Agent. type: integration icons: @@ -9,18 +8,18 @@ icons: title: suricata size: 309x309 type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [network, security, ids_ips] conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - - src: /img/filebeat-suricata-events.png - title: filebeat suricata events + - src: /img/suricata-events.png + title: suricata events dashboard size: 1577x2646 type: image/png - - src: /img/filebeat-suricata-alerts.png - title: filebeat suricata alerts + - src: /img/suricata-alerts.png + title: suricata alerts dashboard size: 1577x1750 type: image/png policy_templates: @@ -33,3 +32,4 @@ policy_templates: description: "Collecting eve logs from Suricata instances (input: logfile)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/symantec_endpoint/_dev/build/build.yml b/packages/symantec_endpoint/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/symantec_endpoint/_dev/build/build.yml +++ b/packages/symantec_endpoint/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/symantec_endpoint/changelog.yml b/packages/symantec_endpoint/changelog.yml index 9b32077e985..160212a75cf 100644 --- a/packages/symantec_endpoint/changelog.yml +++ b/packages/symantec_endpoint/changelog.yml @@ -1,4 +1,27 @@ # newer versions go on top +- version: 2.12.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.11.0" + changes: + - description: Use the ECS syslog fields. Added `log.syslog.appname` and `log.syslog.procid`. Documented `log.syslog.process.{name,pid}` as deprecated. + type: enhancement + link: https://github.com/elastic/integrations/pull/7878 + - description: Change `log.syslog.version` field type from long to keyword to align with ECS. + type: bugfix + link: https://github.com/elastic/integrations/pull/7878 +- version: "2.10.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.9.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "2.8.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-administrative.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-administrative.log-expected.json index 9b42a800456..e3923e36112 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-administrative.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-administrative.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -37,7 +37,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-activity.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-activity.log-expected.json index 6ad82c2dc03..b0306332234 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-activity.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-activity.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-behavior.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-behavior.log-expected.json index 457fc1df3c3..d243355226b 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-behavior.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-behavior.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -101,7 +101,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-packet.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-packet.log-expected.json index 290e4681d14..240fd09b02c 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-packet.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-packet.log-expected.json @@ -6,7 +6,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -94,7 +94,7 @@ "port": 138 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-proactive-detection-sonar.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-proactive-detection-sonar.log-expected.json index efa3baa06d2..61d35a2fc94 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-proactive-detection-sonar.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-proactive-detection-sonar.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-02-16T08:01:33.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Left alone", @@ -82,7 +82,7 @@ { "@timestamp": "2020-05-04T06:57:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Left alone", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-risk.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-risk.log-expected.json index 58985440d42..1f90da6f6a8 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-risk.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-risk.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-09-03T08:12:25.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "All actions failed", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-scan.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-scan.log-expected.json index 6d4f0aedac9..6398767d3c8 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-scan.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-scan.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "started", @@ -60,7 +60,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "completed", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-security.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-security.log-expected.json index 56de571f2bd..e63d79868df 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-security.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-security.log-expected.json @@ -8,7 +8,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -106,7 +106,7 @@ "ip": "1.128.3.4" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -195,7 +195,7 @@ "mac": "2D-FF-88-AA-BB-DC" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -279,7 +279,7 @@ "port": 5985 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -395,7 +395,7 @@ "ip": "216.160.83.61" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -487,7 +487,7 @@ "port": 5112 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-system.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-system.log-expected.json index c99f28c9290..ece4e70ad3e 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-system.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-system.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2019-08-19T07:14:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-traffic.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-traffic.log-expected.json index 25f00fef901..224c4e089bc 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-traffic.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-agent-traffic.log-expected.json @@ -16,7 +16,7 @@ "mac": "AA-BB-CC-DD-EE-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -121,7 +121,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -201,7 +201,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy-rfc3164-sep14-3ru7.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy-rfc3164-sep14-3ru7.log-expected.json index ff638f6b84f..79ee3eefde8 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy-rfc3164-sep14-3ru7.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy-rfc3164-sep14-3ru7.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-06-07T09:09:54.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -15,11 +15,9 @@ }, "log": { "syslog": { + "appname": "SymantecServer", "hostname": "SERVER", - "priority": 54, - "process": { - "name": "SymantecServer" - } + "priority": 54 } }, "message": "Received a new policy with serial number AB13-05/30/2023 23:01:52 031 from Symantec Endpoint Protection Manager.", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy.log-expected.json index 7764cfbde44..8064eeafaf2 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-policy.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-remove-mapped-fields.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-remove-mapped-fields.log-expected.json index b5753c997ef..202906b152d 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-remove-mapped-fields.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-remove-mapped-fields.log-expected.json @@ -16,7 +16,7 @@ "mac": "AA-BB-CC-DD-EE-FF" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -91,7 +91,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc3164.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc3164.log-expected.json index ea813dca385..9d5bb028294 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc3164.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc3164.log-expected.json @@ -15,7 +15,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -47,11 +47,9 @@ }, "log": { "syslog": { + "appname": "SymantecServer", "hostname": "symantec.endpointprotection.english.test", - "priority": 51, - "process": { - "name": "SymantecServer" - } + "priority": 51 } }, "network": { diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc5424.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc5424.log-expected.json index 5746fb2e90c..9a61bd3dba9 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc5424.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-rfc5424.log-expected.json @@ -12,7 +12,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -44,13 +44,14 @@ }, "log": { "syslog": { + "appname": "myproc", "hostname": "192.0.2.1", "priority": 165, "process": { - "name": "myproc", "pid": 8710 }, - "version": 1 + "procid": "8710", + "version": "1" } }, "network": { diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-system.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-system.log-expected.json index 793feb2f13f..6e9725d26d1 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-system.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-system.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -24,7 +24,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -46,7 +46,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -68,7 +68,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-text-log-dump.log-expected.json b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-text-log-dump.log-expected.json index 28ab8be4748..a338dd414b3 100644 --- a/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-text-log-dump.log-expected.json +++ b/packages/symantec_endpoint/data_stream/log/_dev/test/pipeline/test-text-log-dump.log-expected.json @@ -8,7 +8,7 @@ "port": 5112 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/symantec_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/symantec_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml index e39a339de68..6d75ea825d8 100644 --- a/packages/symantec_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/symantec_endpoint/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - grok: description: Parse syslog header. @@ -19,9 +19,9 @@ processors: - '^<%{NONNEGINT:log.syslog.priority:long}>(?:%{SYSLOGTIMESTAMP:timestamp}|%{TIMESTAMP_ISO8601:timestamp})(?: %{SYSLOGFACILITY})?(?: %{SYSLOGHOST:log.syslog.hostname})?(?: %{SYSLOGPROG}:)? %{GREEDYDATA:message}' - '^%{SYSLOG5424LINE}' pattern_definitions: - SYSLOGPROG: '%{PROG:log.syslog.process.name}(?:\[%{POSINT:log.syslog.process.pid:long}\])?' + SYSLOGPROG: '%{PROG:log.syslog.appname}(?:\[%{POSINT:log.syslog.procid}\])?' SYSLOG5424PRI: '<%{NONNEGINT:log.syslog.priority:long}>' - SYSLOG5424BASE: '%{SYSLOG5424PRI}%{NONNEGINT:log.syslog.version:long} +(?:-|%{TIMESTAMP_ISO8601:timestamp}) +(?:-|%{IPORHOST:log.syslog.hostname}) +(?:-|%{SYSLOG5424PRINTASCII:log.syslog.process.name}) +(?:-|%{POSINT:log.syslog.process.pid:long}) +(?:-|%{SYSLOG5424PRINTASCII:log.syslog.message_id}) +(?:-|%{SYSLOG5424SD:log.syslog.structured_data})?' + SYSLOG5424BASE: '%{SYSLOG5424PRI}%{NONNEGINT:log.syslog.version} +(?:-|%{TIMESTAMP_ISO8601:timestamp}) +(?:-|%{IPORHOST:log.syslog.hostname}) +(?:-|%{SYSLOG5424PRINTASCII:log.syslog.appname}) +(?:-|%{POSINT:log.syslog.procid}) +(?:-|%{SYSLOG5424PRINTASCII:log.syslog.message_id}) +(?:-|%{SYSLOG5424SD:log.syslog.structured_data})?' SYSLOG5424LINE: '%{SYSLOG5424BASE} +%{GREEDYDATA:message}' - grok: description: Parse date/severity from log file dump format. @@ -1112,6 +1112,14 @@ processors: - _fingerprint - _temp +- convert: + description: Copy ECS log.syslog.procid into log.syslog.process.pid for backwards-compatability. + field: log.syslog.procid + target_field: log.syslog.process.pid + type: long + ignore_missing: true + ignore_failure: true + on_failure: - set: field: event.kind diff --git a/packages/symantec_endpoint/data_stream/log/fields/agent.yml b/packages/symantec_endpoint/data_stream/log/fields/agent.yml index 7cf602d34ef..49dbf0d0e94 100644 --- a/packages/symantec_endpoint/data_stream/log/fields/agent.yml +++ b/packages/symantec_endpoint/data_stream/log/fields/agent.yml @@ -199,9 +199,6 @@ - name: log.offset type: long description: Offset of the entry in the log file. -- name: log.file.path - type: keyword - description: Path to the log file. - name: log.source.address type: keyword description: Source address from which the log event was read / sent from. diff --git a/packages/symantec_endpoint/data_stream/log/fields/ecs.yml b/packages/symantec_endpoint/data_stream/log/fields/ecs.yml index 48e2d200943..20a9d61362b 100644 --- a/packages/symantec_endpoint/data_stream/log/fields/ecs.yml +++ b/packages/symantec_endpoint/data_stream/log/fields/ecs.yml @@ -64,8 +64,22 @@ external: ecs - name: file.x509.serial_number external: ecs +- name: log.file.path + external: ecs - name: log.level external: ecs +- name: log.syslog.appname + external: ecs +- name: log.syslog.hostname + external: ecs +- name: log.syslog.priority + external: ecs +- name: log.syslog.procid + external: ecs +- name: log.syslog.structured_data + external: ecs +- name: log.syslog.version + external: ecs - name: message external: ecs - name: network.community_id diff --git a/packages/symantec_endpoint/data_stream/log/fields/fields.yml b/packages/symantec_endpoint/data_stream/log/fields/fields.yml index 2c2cef565ae..89393d8d354 100644 --- a/packages/symantec_endpoint/data_stream/log/fields/fields.yml +++ b/packages/symantec_endpoint/data_stream/log/fields/fields.yml @@ -318,16 +318,10 @@ - name: web_domain type: keyword description: The web domain. -- name: log.syslog.hostname - type: keyword - description: Hostname parsed from syslog header. - name: log.syslog.process.name - type: keyword + type: alias + path: log.syslog.appname + description: Deprecated. Use the ECS log.syslog.appname field. - name: log.syslog.process.pid type: long -- name: log.syslog.priority - type: long -- name: log.syslog.version - type: long -- name: log.syslog.structured_data - type: flattened + description: Deprecated. Use the ECS log.syslog.procid field. diff --git a/packages/symantec_endpoint/data_stream/log/sample_event.json b/packages/symantec_endpoint/data_stream/log/sample_event.json index 5ed2ffaa3d4..e6d06f4dc4f 100644 --- a/packages/symantec_endpoint/data_stream/log/sample_event.json +++ b/packages/symantec_endpoint/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "94011a8e-8b26-4bce-a627-d54316798b52", diff --git a/packages/symantec_endpoint/docs/README.md b/packages/symantec_endpoint/docs/README.md index 9f6f541c5db..fe1146f473f 100644 --- a/packages/symantec_endpoint/docs/README.md +++ b/packages/symantec_endpoint/docs/README.md @@ -158,9 +158,9 @@ See vendor documentation: [External Logging settings and log event severity leve | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.dataset | Name of the dataset. | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. | constant_keyword | -| event.start | event.start contains the date when the event started or when the activity was first observed. | date | +| event.start | `event.start` contains the date when the event started or when the activity was first observed. | date | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.sha1 | SHA1 hash. | keyword | | file.name | Name of the file including the extension, without the directory. | keyword | @@ -191,16 +191,18 @@ See vendor documentation: [External Logging settings and log event severity leve | host.os.version | Operating system version as a raw string. | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | input.type | Input type. | keyword | -| log.file.path | Path to the log file. | keyword | +| log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | log.offset | Offset of the entry in the log file. | long | | log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.hostname | Hostname parsed from syslog header. | keyword | -| log.syslog.priority | | long | -| log.syslog.process.name | | keyword | -| log.syslog.process.pid | | long | -| log.syslog.structured_data | | flattened | -| log.syslog.version | | long | +| log.syslog.appname | The device or application that originated the Syslog message, if available. | keyword | +| log.syslog.hostname | The hostname, FQDN, or IP of the machine that originally sent the Syslog message. This is sourced from the hostname field of the syslog header. Depending on the environment, this value may be different from the host that handled the event, especially if the host handling the events is acting as a collector. | keyword | +| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | +| log.syslog.process.name | Deprecated. Use the ECS log.syslog.appname field. | alias | +| log.syslog.process.pid | Deprecated. Use the ECS log.syslog.procid field. | long | +| log.syslog.procid | The process name or ID that originated the Syslog message, if available. | keyword | +| log.syslog.structured_data | Structured data expressed in RFC 5424 messages, if available. These are key-value pairs formed from the structured data portion of the syslog message, as defined in RFC 5424 Section 6.3. | flattened | +| log.syslog.version | The version of the Syslog protocol specification. Only applicable for RFC 5424 messages. | keyword | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | | network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | | network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | @@ -367,7 +369,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "94011a8e-8b26-4bce-a627-d54316798b52", diff --git a/packages/symantec_endpoint/kibana/tags.yml b/packages/symantec_endpoint/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/symantec_endpoint/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/symantec_endpoint/manifest.yml b/packages/symantec_endpoint/manifest.yml index e1c63dc390d..dd382a66238 100644 --- a/packages/symantec_endpoint/manifest.yml +++ b/packages/symantec_endpoint/manifest.yml @@ -1,12 +1,13 @@ name: symantec_endpoint title: Symantec Endpoint Protection -version: "2.8.0" +version: "2.12.0" description: Collect logs from Symantec Endpoint Protection with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" categories: ["security", "edr_xdr"] conditions: - kibana.version: "^7.16.0 || ^8.0.0" + kibana: + version: "^7.16.0 || ^8.0.0" icons: - src: /img/logo.svg title: Symantec @@ -33,3 +34,4 @@ policy_templates: description: Collect Symantec Endpoint Protection logs over UDP. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/synthetics/changelog.yml b/packages/synthetics/changelog.yml index aa91e20e021..847e83c9d23 100644 --- a/packages/synthetics/changelog.yml +++ b/packages/synthetics/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: "1.0.7" + changes: + - description: Add max attempts default value to 2 + type: enhancement + link: https://github.com/elastic/integrations/pull/7653 +- version: "1.0.6" + changes: + - description: Add max attempts field and mappings + type: enhancement + link: https://github.com/elastic/integrations/pull/7626 +- version: "1.0.5" + changes: + - description: Add synthetics cost estimator dashboard + type: enhancement + link: https://github.com/elastic/integrations/pull/6047 +- version: "1.0.4" + changes: + - description: Move processors to kibana + type: enhancement + link: https://github.com/elastic/integrations/pull/7196 +- version: "1.0.3" + changes: + - description: Added field to override monitor.id + type: enhancement + link: https://github.com/elastic/integrations/pull/7163 +- version: "1.0.2" + changes: + - description: Added field for test run ID + type: enhancement + link: https://github.com/elastic/integrations/pull/7156 - version: "1.0.1" changes: - description: Adjust location.id diff --git a/packages/synthetics/data_stream/browser/agent/stream/browser.yml.hbs b/packages/synthetics/data_stream/browser/agent/stream/browser.yml.hbs index 27842617a96..f82e12d491d 100644 --- a/packages/synthetics/data_stream/browser/agent/stream/browser.yml.hbs +++ b/packages/synthetics/data_stream/browser/agent/stream/browser.yml.hbs @@ -50,20 +50,10 @@ filter_journeys.tags: {{filter_journeys.tags}} {{#if ignore_https_errors}} ignore_https_errors: {{ignore_https_errors}} {{/if}} +{{#if max_attempts}} +max_attempts: {{max_attempts}} +{{/if}} +{{#if processors}} processors: - - add_fields: - target: '' - fields: - monitor.fleet_managed: true - {{#if config_id}} - config_id: {{config_id}} - {{/if}} - {{#if run_once}} - run_once: {{run_once}} - {{/if}} - {{#if monitor.project.name}} - monitor.project.name: {{monitor.project.name}} - {{/if}} - {{#if monitor.project.id}} - monitor.project.id: {{monitor.project.id}} - {{/if}} \ No newline at end of file +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/synthetics/data_stream/browser/fields/summary.yml b/packages/synthetics/data_stream/browser/fields/summary.yml index 5a6416977ca..8ee50da76cd 100644 --- a/packages/synthetics/data_stream/browser/fields/summary.yml +++ b/packages/synthetics/data_stream/browser/fields/summary.yml @@ -11,4 +11,24 @@ type: integer description: > The number of endpoints that failed + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. diff --git a/packages/synthetics/data_stream/browser/manifest.yml b/packages/synthetics/data_stream/browser/manifest.yml index cc6ef2b72dd..2467326c39d 100644 --- a/packages/synthetics/data_stream/browser/manifest.yml +++ b/packages/synthetics/data_stream/browser/manifest.yml @@ -151,34 +151,24 @@ streams: multi: false required: false show_user: false - - name: config_id - type: text - title: Config Id - multi: false - required: false - show_user: false - - name: run_once - type: bool - title: Whether the monitor is run once - multi: false - required: false - show_user: true - default: false - name: origin type: text title: Origin of the monitor, ui or project multi: false required: false show_user: false - - name: monitor.project.id - type: text - title: Project id + - name: processors + type: yaml + title: Processors multi: false required: false - show_user: true - - name: monitor.project.name - type: text - title: Project id + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. + - name: max_attempts + type: integer + title: Max attempts multi: false required: false show_user: true + default: 2 \ No newline at end of file diff --git a/packages/synthetics/data_stream/browser_network/fields/summary.yml b/packages/synthetics/data_stream/browser_network/fields/summary.yml index 5a6416977ca..18bf897ffad 100644 --- a/packages/synthetics/data_stream/browser_network/fields/summary.yml +++ b/packages/synthetics/data_stream/browser_network/fields/summary.yml @@ -11,4 +11,23 @@ type: integer description: > The number of endpoints that failed - + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. diff --git a/packages/synthetics/data_stream/browser_screenshot/fields/summary.yml b/packages/synthetics/data_stream/browser_screenshot/fields/summary.yml index 5a6416977ca..34bb24ac038 100644 --- a/packages/synthetics/data_stream/browser_screenshot/fields/summary.yml +++ b/packages/synthetics/data_stream/browser_screenshot/fields/summary.yml @@ -12,3 +12,23 @@ description: > The number of endpoints that failed + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. \ No newline at end of file diff --git a/packages/synthetics/data_stream/http/agent/stream/http.yml.hbs b/packages/synthetics/data_stream/http/agent/stream/http.yml.hbs index da5559f0fab..ca352b30ee3 100644 --- a/packages/synthetics/data_stream/http/agent/stream/http.yml.hbs +++ b/packages/synthetics/data_stream/http/agent/stream/http.yml.hbs @@ -86,20 +86,10 @@ mode: {{mode}} {{/if}} ipv4: {{ipv4}} ipv6: {{ipv6}} +{{#if max_attempts}} +max_attempts: {{max_attempts}} +{{/if}} +{{#if processors}} processors: - - add_fields: - target: '' - fields: - monitor.fleet_managed: true - {{#if config_id}} - config_id: {{config_id}} - {{/if}} - {{#if run_once}} - run_once: {{run_once}} - {{/if}} - {{#if monitor.project.name}} - monitor.project.name: {{monitor.project.name}} - {{/if}} - {{#if monitor.project.id}} - monitor.project.id: {{monitor.project.id}} - {{/if}} +{{processors}} +{{/if}} diff --git a/packages/synthetics/data_stream/http/fields/summary.yml b/packages/synthetics/data_stream/http/fields/summary.yml index 5a6416977ca..34bb24ac038 100644 --- a/packages/synthetics/data_stream/http/fields/summary.yml +++ b/packages/synthetics/data_stream/http/fields/summary.yml @@ -12,3 +12,23 @@ description: > The number of endpoints that failed + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. \ No newline at end of file diff --git a/packages/synthetics/data_stream/http/manifest.yml b/packages/synthetics/data_stream/http/manifest.yml index 2c50a92e5ca..a2d119d900a 100644 --- a/packages/synthetics/data_stream/http/manifest.yml +++ b/packages/synthetics/data_stream/http/manifest.yml @@ -230,37 +230,12 @@ streams: multi: false required: false show_user: false - - name: config_id - type: text - title: Config Id - multi: false - required: false - show_user: false - - name: run_once - type: bool - title: Whether the monitor is run once - multi: false - required: false - show_user: true - default: false - name: origin type: text title: Origin of the monitor, ui or project multi: false required: false show_user: false - - name: monitor.project.id - type: text - title: Project id - multi: false - required: false - show_user: true - - name: monitor.project.name - type: text - title: Project id - multi: false - required: false - show_user: true - name: mode type: text title: Heartbeat mode @@ -280,4 +255,19 @@ streams: multi: false required: false show_user: true - default: true \ No newline at end of file + default: true + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. + - name: max_attempts + type: integer + title: Max attempts + multi: false + required: false + show_user: true + default: 2 \ No newline at end of file diff --git a/packages/synthetics/data_stream/icmp/agent/stream/icmp.yml.hbs b/packages/synthetics/data_stream/icmp/agent/stream/icmp.yml.hbs index d01339efa2f..1c1fe4de1f2 100644 --- a/packages/synthetics/data_stream/icmp/agent/stream/icmp.yml.hbs +++ b/packages/synthetics/data_stream/icmp/agent/stream/icmp.yml.hbs @@ -29,20 +29,10 @@ mode: {{mode}} {{/if}} ipv4: {{ipv4}} ipv6: {{ipv6}} +{{#if max_attempts}} +max_attempts: {{max_attempts}} +{{/if}} +{{#if processors}} processors: - - add_fields: - target: '' - fields: - monitor.fleet_managed: true - {{#if config_id}} - config_id: {{config_id}} - {{/if}} - {{#if run_once}} - run_once: {{run_once}} - {{/if}} - {{#if monitor.project.name}} - monitor.project.name: {{monitor.project.name}} - {{/if}} - {{#if monitor.project.id}} - monitor.project.id: {{monitor.project.id}} - {{/if}} \ No newline at end of file +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/synthetics/data_stream/icmp/fields/summary.yml b/packages/synthetics/data_stream/icmp/fields/summary.yml index 5a6416977ca..34bb24ac038 100644 --- a/packages/synthetics/data_stream/icmp/fields/summary.yml +++ b/packages/synthetics/data_stream/icmp/fields/summary.yml @@ -12,3 +12,23 @@ description: > The number of endpoints that failed + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. \ No newline at end of file diff --git a/packages/synthetics/data_stream/icmp/manifest.yml b/packages/synthetics/data_stream/icmp/manifest.yml index 047c21b45aa..151aa0e4fee 100644 --- a/packages/synthetics/data_stream/icmp/manifest.yml +++ b/packages/synthetics/data_stream/icmp/manifest.yml @@ -105,37 +105,12 @@ streams: multi: false required: false show_user: false - - name: config_id - type: text - title: Config Id - multi: false - required: false - show_user: false - - name: run_once - type: bool - title: Whether the monitor is run once - multi: false - required: false - show_user: true - default: false - name: origin type: text title: Origin of the monitor, ui or project multi: false required: false show_user: false - - name: monitor.project.id - type: text - title: Project id - multi: false - required: false - show_user: true - - name: monitor.project.name - type: text - title: Project id - multi: false - required: false - show_user: true - name: mode type: text title: Heartbeat mode @@ -156,3 +131,18 @@ streams: required: false show_user: true default: true + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. + - name: max_attempts + type: integer + title: Max attempts + multi: false + required: false + show_user: true + default: 2 \ No newline at end of file diff --git a/packages/synthetics/data_stream/tcp/agent/stream/tcp.yml.hbs b/packages/synthetics/data_stream/tcp/agent/stream/tcp.yml.hbs index fefd09a74d9..2b603188964 100644 --- a/packages/synthetics/data_stream/tcp/agent/stream/tcp.yml.hbs +++ b/packages/synthetics/data_stream/tcp/agent/stream/tcp.yml.hbs @@ -56,20 +56,10 @@ mode: {{mode}} {{/if}} ipv4: {{ipv4}} ipv6: {{ipv6}} +{{#if max_attempts}} +max_attempts: {{max_attempts}} +{{/if}} +{{#if processors}} processors: - - add_fields: - target: '' - fields: - monitor.fleet_managed: true - {{#if config_id}} - config_id: {{config_id}} - {{/if}} - {{#if run_once}} - run_once: {{run_once}} - {{/if}} - {{#if monitor.project.name}} - monitor.project.name: {{monitor.project.name}} - {{/if}} - {{#if monitor.project.id}} - monitor.project.id: {{monitor.project.id}} - {{/if}} \ No newline at end of file +{{processors}} +{{/if}} \ No newline at end of file diff --git a/packages/synthetics/data_stream/tcp/fields/summary.yml b/packages/synthetics/data_stream/tcp/fields/summary.yml index 5a6416977ca..34bb24ac038 100644 --- a/packages/synthetics/data_stream/tcp/fields/summary.yml +++ b/packages/synthetics/data_stream/tcp/fields/summary.yml @@ -12,3 +12,23 @@ description: > The number of endpoints that failed + - name: status + type: keyword + description: > + The status of this check as a whole. Either up or down. + - name: attempt + type: short + description: > + When performing a check this number is 1 for the first check, and increments in the event of a retry. + - name: max_attempts + type: short + description: > + The maximum number of checks that may be performed. Note, the actual number may be smaller. + - name: final_attempt + type: boolean + description: > + True if no further checks will be performed in this retry group. + - name: retry_group + type: keyword + description: > + A unique token used to group checks across attempts. \ No newline at end of file diff --git a/packages/synthetics/data_stream/tcp/manifest.yml b/packages/synthetics/data_stream/tcp/manifest.yml index 20da8ae20ca..c162c9e8775 100644 --- a/packages/synthetics/data_stream/tcp/manifest.yml +++ b/packages/synthetics/data_stream/tcp/manifest.yml @@ -159,37 +159,12 @@ streams: multi: false required: false show_user: false - - name: config_id - type: text - title: Config Id - multi: false - required: false - show_user: false - - name: run_once - type: bool - title: Whether the monitor is run once - multi: false - required: false - show_user: true - default: false - name: origin type: text title: Origin of the monitor, ui or project multi: false required: false show_user: false - - name: monitor.project.id - type: text - title: Project id - multi: false - required: false - show_user: true - - name: monitor.project.name - type: text - title: Project id - multi: false - required: false - show_user: true - name: mode type: text title: Heartbeat mode @@ -210,3 +185,18 @@ streams: required: false show_user: true default: true + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. + - name: max_attempts + type: integer + title: Max attempts + multi: false + required: false + show_user: true + default: 2 \ No newline at end of file diff --git a/packages/synthetics/kibana/dashboard/synthetics-e465c570-1561-11ee-9d3b-15ab835418fd.json b/packages/synthetics/kibana/dashboard/synthetics-e465c570-1561-11ee-9d3b-15ab835418fd.json new file mode 100644 index 00000000000..3624930854b --- /dev/null +++ b/packages/synthetics/kibana/dashboard/synthetics-e465c570-1561-11ee-9d3b-15ab835418fd.json @@ -0,0 +1,1181 @@ +{ + "attributes": { + "description": "Approximates billing usage based on synthetics data, letting you drill down on a monitor by monitor basis as well.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "observer.geo.name", + "negate": false, + "type": "exists" + }, + "query": { + "exists": { + "field": "observer.geo.name" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "## How to Estimate Synthetics Usage / Pricing with this Dashboard\n\nThis dashboard can be used to approximate the cost of using the Elastic Synthetics service given your current monitors. Note that it does not use the more precise metrics used by our actual cloud service to determine actual costs. In some uncommon scenarios costs may differ.\n\nThis dashboard does not distinguish monitors running in private locations from those running on the service. If all of your monitors currently run on the service you can ignore this. If your monitors currently run on private locations you can use this tool to estimate the cost of running those same monitors on the cloud.\n\nNote that pricing data should be determined via https://www.elastic.co/pricing/ , and may vary based on your exchange rate and/or contract terms. If, for instance, your rate for browser monitor execution is $0.014 you can multiply the number of browser billing units used by this number to arrive at an estimated cost. Additionally, please note that this dashboard is only useful for estimating execution costs for the synthetics service, but does not include storage, network transfer, and other associated costs.", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 17, + "i": "1a8368df-8290-41b1-94d2-1075420921e9", + "w": 19, + "x": 0, + "y": 0 + }, + "panelIndex": "1a8368df-8290-41b1-94d2-1075420921e9", + "type": "visualization", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "6b4c5a50-e5b3-4286-937e-19180234d9f3", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "71168abb-5031-44c6-a5f3-9a0fa5cb7ef7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "65aa1d2b-0064-4055-a37f-6144a7d1f3c7": { + "columnOrder": [ + "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1", + "90ab8754-84f5-425e-9866-3fc32420bb1d" + ], + "columns": { + "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Estimated Browser Billing Units", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "est_billing_units" + }, + "90ab8754-84f5-425e-9866-3fc32420bb1d": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 150000", + "operationType": "static_value", + "params": { + "value": "150000" + }, + "references": [], + "scale": "ratio" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "summary.down", + "index": "6b4c5a50-e5b3-4286-937e-19180234d9f3", + "key": "summary.down", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "summary.down" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "71168abb-5031-44c6-a5f3-9a0fa5cb7ef7", + "key": "monitor.type", + "negate": false, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "layerType": "data", + "metricAccessor": "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "80dd067e-cdff-4f0e-b031-daddb2c7369e", + "w": 7, + "x": 19, + "y": 0 + }, + "panelIndex": "80dd067e-cdff-4f0e-b031-daddb2c7369e", + "title": "Estimated Billing Units by Type", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-6678cd95-fa07-4ba2-957f-1c05120c4f35", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "25828960-9aed-4a3f-a41f-3f636a7dc357", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6678cd95-fa07-4ba2-957f-1c05120c4f35": { + "columnOrder": [ + "00f6b2f4-fadd-4781-a74a-92d2e478c7b1", + "43a2aed5-cd1b-4cf1-b8fb-4ab75cd70dc8" + ], + "columns": { + "00f6b2f4-fadd-4781-a74a-92d2e478c7b1": { + "dataType": "string", + "isBucketed": true, + "label": "Top 20 values of observer.geo.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "43a2aed5-cd1b-4cf1-b8fb-4ab75cd70dc8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "observer.geo.name" + }, + "43a2aed5-cd1b-4cf1-b8fb-4ab75cd70dc8": { + "dataType": "number", + "isBucketed": false, + "label": "Sum of est_billing_units", + "operationType": "sum", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "est_billing_units" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "25828960-9aed-4a3f-a41f-3f636a7dc357", + "key": "monitor.type", + "negate": false, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "00f6b2f4-fadd-4781-a74a-92d2e478c7b1" + }, + { + "columnId": "43a2aed5-cd1b-4cf1-b8fb-4ab75cd70dc8", + "isTransposed": false + } + ], + "layerId": "6678cd95-fa07-4ba2-957f-1c05120c4f35", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 16, + "i": "3bcd0e7f-4bad-496f-9e8a-1cef8af9cb10", + "w": 12, + "x": 26, + "y": 1 + }, + "panelIndex": "3bcd0e7f-4bad-496f-9e8a-1cef8af9cb10", + "title": "Browser Locations", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "6f557a27-c62b-4f6a-851d-20fc3eed3ae0", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "76438927-6522-4b44-8fba-2c2f6c93a485", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "65aa1d2b-0064-4055-a37f-6144a7d1f3c7": { + "columnOrder": [ + "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1", + "90ab8754-84f5-425e-9866-3fc32420bb1d" + ], + "columns": { + "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Lightweight Locations", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "observer.geo.name" + }, + "90ab8754-84f5-425e-9866-3fc32420bb1d": { + "dataType": "number", + "isBucketed": false, + "isStaticValue": true, + "label": "Static value: 150000", + "operationType": "static_value", + "params": { + "value": "150000" + }, + "references": [], + "scale": "ratio" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "summary.down", + "index": "6f557a27-c62b-4f6a-851d-20fc3eed3ae0", + "key": "summary.down", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "summary.down" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "76438927-6522-4b44-8fba-2c2f6c93a485", + "key": "monitor.type", + "negate": true, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "layerType": "data", + "metricAccessor": "72eb0e95-8f74-4f7f-a226-3cb7f9f9fcc1" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 8, + "i": "60d4a656-5d83-4827-9bc6-89c02f247726", + "w": 7, + "x": 19, + "y": 9 + }, + "panelIndex": "60d4a656-5d83-4827-9bc6-89c02f247726", + "title": "Total Lightweight Locations", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-42ee11c3-ab9a-4b73-a2ba-65c4ad273b2d", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "7e003f05-a106-4350-a1ab-eb70c7dd2b0a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "42ee11c3-ab9a-4b73-a2ba-65c4ad273b2d": { + "columnOrder": [ + "e500b751-5940-4f43-a3ee-5fc4c8347ca8", + "2d7b32d6-d0e6-4db5-a399-6aa4341f7c76" + ], + "columns": { + "2d7b32d6-d0e6-4db5-a399-6aa4341f7c76": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Monitors", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "monitor.name" + }, + "e500b751-5940-4f43-a3ee-5fc4c8347ca8": { + "dataType": "string", + "isBucketed": true, + "label": "Top 20 values of observer.geo.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "2d7b32d6-d0e6-4db5-a399-6aa4341f7c76", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "observer.geo.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "7e003f05-a106-4350-a1ab-eb70c7dd2b0a", + "key": "monitor.type", + "negate": true, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "2d7b32d6-d0e6-4db5-a399-6aa4341f7c76" + }, + { + "columnId": "e500b751-5940-4f43-a3ee-5fc4c8347ca8", + "isTransposed": false + } + ], + "layerId": "42ee11c3-ab9a-4b73-a2ba-65c4ad273b2d", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "504faa9a-3d93-462b-995d-c50e940a247d", + "w": 12, + "x": 26, + "y": 17 + }, + "panelIndex": "504faa9a-3d93-462b-995d-c50e940a247d", + "title": "Lightweight locations", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-unifiedHistogram", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "c07ca82c-d7fc-4a13-acf6-e5aaea3cf836", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "2637b03d-012d-43c8-b7a0-c8a8f7bc85c4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "unifiedHistogram": { + "columnOrder": [ + "f29ec422-c9d7-4267-8ec9-62ab2621da1b", + "date_column", + "count_column" + ], + "columns": { + "count_column": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Billing Units", + "operationType": "sum", + "params": { + "emptyAsNull": true, + "format": { + "id": "number", + "params": { + "decimals": 0 + } + } + }, + "scale": "ratio", + "sourceField": "est_billing_units" + }, + "date_column": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "f29ec422-c9d7-4267-8ec9-62ab2621da1b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Most common monitors", + "operationType": "terms", + "params": { + "accuracyMode": true, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "count_column", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 50 + }, + "scale": "ordinal", + "sourceField": "monitor.name" + } + }, + "incompleteColumns": {} + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "summary.down", + "index": "c07ca82c-d7fc-4a13-acf6-e5aaea3cf836", + "key": "summary.down", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "summary.down" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "2637b03d-012d-43c8-b7a0-c8a8f7bc85c4", + "key": "monitor.type", + "negate": false, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": false + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": false + }, + "layers": [ + { + "accessors": [ + "count_column" + ], + "layerId": "unifiedHistogram", + "layerType": "data", + "seriesType": "bar_stacked", + "splitAccessor": "f29ec422-c9d7-4267-8ec9-62ab2621da1b", + "xAccessor": "date_column" + } + ], + "legend": { + "isVisible": true, + "position": "right", + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": true, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": false + }, + "valueLabels": "hide" + } + }, + "title": "Estimated Monitor Billing History", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "fe658793-8dd0-4c6c-860a-b9f8016fbd2e", + "w": 26, + "x": 0, + "y": 17 + }, + "panelIndex": "fe658793-8dd0-4c6c-860a-b9f8016fbd2e", + "title": "Estimated Browser Monitor Billing History", + "type": "lens", + "version": "8.8.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "indexpattern-datasource-layer-e1869c68-3f80-4b33-b75f-f9668b5bcd94", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "d56bc5ac-37c2-4db8-958e-df713a2544d7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "d3bfc8e4-9bf7-4421-be2b-e2acd639dc62", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "59367fc9-7eff-4a02-ad14-145824e57772", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e1869c68-3f80-4b33-b75f-f9668b5bcd94": { + "columnOrder": [ + "aa589a53-6c45-4f0e-9f18-81dd4aae2e07", + "b75998ac-91fa-436e-8038-a17c90045564", + "113a352d-2e76-4c19-bd0d-295ac23e6131", + "113a352d-2e76-4c19-bd0d-295ac23e6131X0" + ], + "columns": { + "113a352d-2e76-4c19-bd0d-295ac23e6131": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Billing Units", + "operationType": "formula", + "params": { + "formula": "sum(est_billing_units)", + "isFormulaBroken": false + }, + "references": [ + "113a352d-2e76-4c19-bd0d-295ac23e6131X0" + ], + "scale": "ratio" + }, + "113a352d-2e76-4c19-bd0d-295ac23e6131X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Total Billing Units", + "operationType": "sum", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "est_billing_units" + }, + "aa589a53-6c45-4f0e-9f18-81dd4aae2e07": { + "dataType": "string", + "isBucketed": true, + "label": "Top 100 values of monitor.name", + "operationType": "terms", + "params": { + "accuracyMode": true, + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "monitor.name" + }, + "b75998ac-91fa-436e-8038-a17c90045564": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "View", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "fallback": true, + "type": "alphabetical" + }, + "orderDirection": "asc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "synthetics_url" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "summary.down", + "index": "d56bc5ac-37c2-4db8-958e-df713a2544d7", + "key": "summary.down", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "summary.down" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "monitor.type", + "index": "d3bfc8e4-9bf7-4421-be2b-e2acd639dc62", + "key": "monitor.type", + "negate": false, + "params": { + "query": "browser" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "monitor.type": "browser" + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "est_billing_units", + "index": "59367fc9-7eff-4a02-ad14-145824e57772", + "key": "est_billing_units", + "negate": false, + "params": { + "gte": "1", + "lt": "999999999999" + }, + "type": "range", + "value": { + "gte": "1", + "lt": "999999999999" + } + }, + "query": { + "range": { + "est_billing_units": { + "gte": "1", + "lt": "999999999999" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "aa589a53-6c45-4f0e-9f18-81dd4aae2e07" + }, + { + "columnId": "113a352d-2e76-4c19-bd0d-295ac23e6131", + "width": 233.8888888888889 + }, + { + "columnId": "b75998ac-91fa-436e-8038-a17c90045564", + "hidden": false, + "isTransposed": false + } + ], + "layerId": "e1869c68-3f80-4b33-b75f-f9668b5bcd94", + "layerType": "data", + "sorting": { + "columnId": "113a352d-2e76-4c19-bd0d-295ac23e6131", + "direction": "desc" + } + } + }, + "title": "Estimated Monitor Billing History", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 28, + "i": "82239bad-4227-4fa7-8907-bdf529c211a9", + "w": 17, + "x": 0, + "y": 31 + }, + "panelIndex": "82239bad-4227-4fa7-8907-bdf529c211a9", + "title": "Top Monitors (by billed amount)", + "type": "lens", + "version": "8.8.0" + } + ], + "timeRestore": false, + "title": "[Synthetics] Estimated Billing", + "version": 1 + }, + "coreMigrationVersion": "8.7.0", + "created_at": "2023-08-04T15:02:43.944Z", + "id": "synthetics-e465c570-1561-11ee-9d3b-15ab835418fd", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "80dd067e-cdff-4f0e-b031-daddb2c7369e:indexpattern-datasource-layer-65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "80dd067e-cdff-4f0e-b031-daddb2c7369e:6b4c5a50-e5b3-4286-937e-19180234d9f3", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "80dd067e-cdff-4f0e-b031-daddb2c7369e:71168abb-5031-44c6-a5f3-9a0fa5cb7ef7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "3bcd0e7f-4bad-496f-9e8a-1cef8af9cb10:indexpattern-datasource-layer-6678cd95-fa07-4ba2-957f-1c05120c4f35", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "3bcd0e7f-4bad-496f-9e8a-1cef8af9cb10:25828960-9aed-4a3f-a41f-3f636a7dc357", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "60d4a656-5d83-4827-9bc6-89c02f247726:indexpattern-datasource-layer-65aa1d2b-0064-4055-a37f-6144a7d1f3c7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "60d4a656-5d83-4827-9bc6-89c02f247726:6f557a27-c62b-4f6a-851d-20fc3eed3ae0", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "60d4a656-5d83-4827-9bc6-89c02f247726:76438927-6522-4b44-8fba-2c2f6c93a485", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "504faa9a-3d93-462b-995d-c50e940a247d:indexpattern-datasource-layer-42ee11c3-ab9a-4b73-a2ba-65c4ad273b2d", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "504faa9a-3d93-462b-995d-c50e940a247d:7e003f05-a106-4350-a1ab-eb70c7dd2b0a", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "fe658793-8dd0-4c6c-860a-b9f8016fbd2e:indexpattern-datasource-layer-unifiedHistogram", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "fe658793-8dd0-4c6c-860a-b9f8016fbd2e:c07ca82c-d7fc-4a13-acf6-e5aaea3cf836", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "fe658793-8dd0-4c6c-860a-b9f8016fbd2e:2637b03d-012d-43c8-b7a0-c8a8f7bc85c4", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "82239bad-4227-4fa7-8907-bdf529c211a9:indexpattern-datasource-layer-e1869c68-3f80-4b33-b75f-f9668b5bcd94", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "82239bad-4227-4fa7-8907-bdf529c211a9:d56bc5ac-37c2-4db8-958e-df713a2544d7", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "82239bad-4227-4fa7-8907-bdf529c211a9:d3bfc8e4-9bf7-4421-be2b-e2acd639dc62", + "type": "index-pattern" + }, + { + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "name": "82239bad-4227-4fa7-8907-bdf529c211a9:59367fc9-7eff-4a02-ad14-145824e57772", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/synthetics/kibana/index_pattern/7258d186-6430-4b51-bb67-2603cdfb4652.json b/packages/synthetics/kibana/index_pattern/7258d186-6430-4b51-bb67-2603cdfb4652.json new file mode 100644 index 00000000000..8f8553c06b0 --- /dev/null +++ b/packages/synthetics/kibana/index_pattern/7258d186-6430-4b51-bb67-2603cdfb4652.json @@ -0,0 +1,24 @@ +{ + "attributes": { + "fieldAttrs": "{\"est_billing_units\":{\"count\":2},\"monitor.id\":{\"count\":1},\"monitor.name\":{\"count\":1},\"observer.geo.name\":{\"count\":2},\"monitor.duration.us\":{\"count\":1}}", + "fieldFormatMap": "{\"synthetics_url\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/discover\",\"basePath\":\"\"},\"type\":\"a\",\"urlTemplate\":null,\"labelTemplate\":\"View Monitor\",\"width\":null,\"height\":null}},\"synthetics_error_url\":{\"id\":\"url\",\"params\":{\"parsedUrl\":{\"origin\":\"\",\"pathname\":\"/app/discover\",\"basePath\":\"\"},\"type\":\"a\",\"urlTemplate\":\"\",\"labelTemplate\":\"View Error\",\"width\":null,\"height\":null}}}", + "fields": "[]", + "name": "synthetics-dashboard", + "runtimeFieldMap": "{\"est_billing_units\":{\"type\":\"long\",\"script\":{\"source\":\"if (doc['monitor.duration.us'].size() > 0) {\\n long dur = doc['monitor.duration.us'][0];\\n double frac = Math.ceil(((double)(dur) / 1000000) / 60);\\n emit((long)(frac));\\n}\"}},\"synthetics_url\":{\"type\":\"keyword\",\"script\":{\"source\":\"if (doc['monitor.id'].size() > 0) {\\n emit(\\\"/app/synthetics/monitor/\\\" + doc['monitor.id'][0])\\n}\"}},\"synthetics_error_url\":{\"type\":\"keyword\",\"script\":{\"source\":\"if (doc['monitor.id'].size() > 0 && doc['state.status'].size() > 0 && doc['state.status'][0] != \\\"up\\\") {\\n emit(\\\"/app/synthetics/monitor/\\\" + doc['monitor.id'][0] + \\\"/errors/\\\" + doc['state.id'][0])\\n}\"}}}", + "sourceFilters": "[]", + "timeFieldName": "@timestamp", + "title": "synthetics-*", + "typeMeta": "{}" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-06-27T14:15:54.692Z", + "id": "7258d186-6430-4b51-bb67-2603cdfb4652", + "managed": true, + "references": [], + "type": "index-pattern", + "migrationVersion": { + "index-pattern": "8.0.0" + }, + "updated_at": "2023-07-07T18:53:09.336Z", + "version": "WzE3NTksM10=" +} \ No newline at end of file diff --git a/packages/synthetics/manifest.yml b/packages/synthetics/manifest.yml index d711eeeeee7..8792f60ff16 100644 --- a/packages/synthetics/manifest.yml +++ b/packages/synthetics/manifest.yml @@ -2,7 +2,7 @@ format_version: 1.0.0 name: synthetics title: Elastic Synthetics description: Internal Elastic integration for providing access to private locations. -version: 1.0.1 +version: 1.0.7 categories: ["observability"] release: ga type: integration @@ -25,7 +25,7 @@ policy_templates: title: Browser description: Perform an Browser check conditions: - kibana.version: "^8.8.0" + kibana.version: "^8.11.0" icons: - src: /img/uptime-logo-color-64px.svg size: 16x16 diff --git a/packages/sysmon_linux/_dev/build/build.yml b/packages/sysmon_linux/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/sysmon_linux/_dev/build/build.yml +++ b/packages/sysmon_linux/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/sysmon_linux/changelog.yml b/packages/sysmon_linux/changelog.yml index 1fb7f34d8d6..9fec9f85afb 100644 --- a/packages/sysmon_linux/changelog.yml +++ b/packages/sysmon_linux/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.0.0" changes: - description: Release Sysmon for Linux as GA. diff --git a/packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json b/packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json index 4f018e8c0b9..32aac1e04bf 100644 --- a/packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json +++ b/packages/sysmon_linux/data_stream/log/_dev/test/pipeline/test-sysmon.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log", @@ -50,7 +50,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "log", diff --git a/packages/sysmon_linux/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/sysmon_linux/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 03ae8c97192..16b85b8335d 100644 --- a/packages/sysmon_linux/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/sysmon_linux/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -5,7 +5,7 @@ processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - script: description: Remove all empty values from event_data. lang: painless diff --git a/packages/sysmon_linux/data_stream/log/sample_event.json b/packages/sysmon_linux/data_stream/log/sample_event.json index d27a27e8efd..20c18623e52 100644 --- a/packages/sysmon_linux/data_stream/log/sample_event.json +++ b/packages/sysmon_linux/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "af423af4-492e-4074-bae6-f31a40d3fd91", diff --git a/packages/sysmon_linux/docs/README.md b/packages/sysmon_linux/docs/README.md index 3c1e112f4ac..99984bf589d 100644 --- a/packages/sysmon_linux/docs/README.md +++ b/packages/sysmon_linux/docs/README.md @@ -39,7 +39,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "af423af4-492e-4074-bae6-f31a40d3fd91", @@ -144,10 +144,10 @@ An example event for `log` looks as following: | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | diff --git a/packages/sysmon_linux/kibana/tags.yml b/packages/sysmon_linux/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/sysmon_linux/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/sysmon_linux/manifest.yml b/packages/sysmon_linux/manifest.yml index 9fa7cd34d71..692138a553a 100644 --- a/packages/sysmon_linux/manifest.yml +++ b/packages/sysmon_linux/manifest.yml @@ -1,6 +1,6 @@ name: sysmon_linux title: Sysmon for Linux -version: "1.0.0" +version: "1.3.0" description: Collect Sysmon Linux logs with Elastic Agent. type: integration categories: @@ -11,9 +11,10 @@ icons: title: sysmon-linux size: 1000x1000 type: image/svg+xml -format_version: 2.7.0 +format_version: "3.0.0" conditions: - kibana.version: "^8.4.0" + kibana: + version: "^8.4.0" screenshots: - src: /img/kibana-sysmon-linux.png title: kibana sysmon linux @@ -29,3 +30,4 @@ policy_templates: description: Collecting Sysmon for Linux logs owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml index 98ed73a293e..c91b6477086 100644 --- a/packages/system/changelog.yml +++ b/packages/system/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: "1.38.2" + changes: + - description: Validate ClientAddress IP for events 4778 and 4779 + type: bugfix + link: https://github.com/elastic/integrations/pull/7237 +- version: "1.38.1" + changes: + - description: Remove duplicated fields in diskio datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7006 +- version: "1.38.0" + changes: + - description: Add source, destination and network fields for Windows Firewall events + type: enhancement + link: https://github.com/elastic/integrations/pull/6534 +- version: "1.37.1" + changes: + - description: Add metric_type metadata to the process data_stream + type: enhancement + link: https://github.com/elastic/integrations/pull/6493 +- version: "1.37.0" + changes: + - description: Improve `event.action`, `event.category` and `event.outcome` enrichment for auth datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/6966 +- version: "1.36.2" + changes: + - description: Add ecs mapping for error.code to avoid type conflicts + type: bugfix + link: https://github.com/elastic/integrations/pull/6868 +- version: "1.36.1" + changes: + - description: Fix EventIDs for Users Added to Group panel + type: bugfix + link: https://github.com/elastic/integrations/pull/6280 +- version: "1.36.0" + changes: + - description: Revert changes to permissions to reroute events to logs-*-* for syslog datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/6801 - version: "1.35.0" changes: - description: Adds configuration option for preserve_original_event for syslog datastream @@ -123,7 +163,7 @@ changes: - description: Add basic dimension fields for cpu, load and memory type: enhancement - link: https://github.com/elastic/integrations/pull/1234 + link: https://github.com/elastic/integrations/pull/5160 - version: "1.23.1" changes: - description: Mark datasets as ga diff --git a/packages/system/data_stream/application/fields/ecs.yml b/packages/system/data_stream/application/fields/ecs.yml index cfbc8e8c80e..dbaf51f2a7f 100644 --- a/packages/system/data_stream/application/fields/ecs.yml +++ b/packages/system/data_stream/application/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: error.message +- external: ecs + name: error.code - external: ecs name: event.code - external: ecs diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json index bee9bd62b45..3db9ed60fdd 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json @@ -38,6 +38,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -79,6 +82,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -115,6 +122,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -146,6 +157,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -212,6 +226,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -248,6 +266,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -329,6 +351,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -370,6 +395,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -432,6 +461,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -517,6 +550,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -553,6 +590,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -594,6 +634,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -635,6 +678,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -671,6 +718,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -755,6 +806,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -817,6 +872,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -849,6 +908,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -885,6 +948,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -970,6 +1037,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1032,6 +1103,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1064,6 +1139,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -1105,6 +1183,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1141,6 +1223,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1177,6 +1263,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1209,6 +1299,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1240,6 +1334,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1272,6 +1370,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1308,6 +1410,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1393,6 +1499,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1429,6 +1539,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -1470,6 +1583,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1506,6 +1623,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1563,6 +1684,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1595,6 +1720,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1631,6 +1760,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1716,6 +1849,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1805,6 +1942,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -1841,6 +1982,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -1882,6 +2026,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2181,6 +2329,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2218,7 +2370,11 @@ "version": "8.0.0" }, "event": { + "category": [ + "authentication" + ], "kind": "event", + "outcome": "failure", "timezone": "+0000" }, "host": { @@ -2243,6 +2399,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -2284,6 +2443,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2320,6 +2483,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2351,6 +2518,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -2418,6 +2588,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -2459,6 +2632,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2495,6 +2672,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2526,6 +2707,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -2593,6 +2777,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -2634,6 +2821,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2670,6 +2861,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2701,6 +2896,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2737,6 +2936,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2769,6 +2972,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2801,6 +3008,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2858,6 +3069,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -2943,6 +3158,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3005,6 +3224,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3037,6 +3260,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3069,6 +3296,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3105,6 +3336,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3137,6 +3372,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3173,6 +3412,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3258,6 +3501,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3294,6 +3541,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -3335,6 +3585,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3371,6 +3625,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3402,6 +3660,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -3443,6 +3704,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3479,6 +3744,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3510,6 +3779,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -3551,6 +3823,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3587,6 +3863,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3618,6 +3898,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -3659,6 +3942,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3695,6 +3982,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -3726,6 +4017,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -3767,6 +4061,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4014,6 +4312,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4045,6 +4347,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -4086,6 +4391,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4122,6 +4431,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4153,6 +4466,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -4194,6 +4510,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4230,6 +4550,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-off", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, @@ -4314,6 +4638,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json index 29efbed6fdb..14cf2adeb7d 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json @@ -233,6 +233,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -327,6 +330,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, @@ -368,6 +374,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-secure-rhel7.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-secure-rhel7.log-expected.json index 81a77f6f103..8c6a08b71c5 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-secure-rhel7.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-secure-rhel7.log-expected.json @@ -134,7 +134,11 @@ "version": "8.0.0" }, "event": { + "category": [ + "authentication" + ], "kind": "event", + "outcome": "failure", "timezone": "+0000" }, "host": { @@ -186,7 +190,11 @@ "version": "8.0.0" }, "event": { + "category": [ + "authentication" + ], "kind": "event", + "outcome": "failure", "timezone": "+0000" }, "host": { @@ -212,6 +220,9 @@ "version": "8.0.0" }, "event": { + "category": [ + "process" + ], "kind": "event", "timezone": "+0000" }, diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-timestamp.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-timestamp.log-expected.json index c330599fb44..a4f331431b0 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-timestamp.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-timestamp.log-expected.json @@ -6,6 +6,10 @@ "version": "8.0.0" }, "event": { + "action": "logged-on", + "category": [ + "session" + ], "kind": "event", "timezone": "+0000" }, diff --git a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/default.yml b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/default.yml index 35a7e44fb40..a765d7a8f0b 100644 --- a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/default.yml +++ b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/default.yml @@ -32,6 +32,11 @@ processors: description: Leave the unmatched content in message. field: _temp.message target_field: message + - append: + field: event.category + value: process + allow_duplicates: false + if: ctx.system?.auth?.sudo?.command != null - remove: field: _temp - grok: @@ -49,6 +54,46 @@ processors: QUOTE: "['\"]" BOUNDARY: "(? @@ -195,11 +134,15 @@ - name: disk.read.bytes type: long format: bytes + unit: byte + metric_type: gauge description: > The total number of bytes read successfully in a given period of time. - name: disk.write.bytes type: long format: bytes + unit: byte + metric_type: gauge description: >- The total number of bytes write successfully in a given period of time. diff --git a/packages/system/data_stream/diskio/fields/fields.yml b/packages/system/data_stream/diskio/fields/fields.yml index 70913cd16b8..42b4d9ce63e 100644 --- a/packages/system/data_stream/diskio/fields/fields.yml +++ b/packages/system/data_stream/diskio/fields/fields.yml @@ -120,18 +120,3 @@ metric_type: gauge description: | Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%. -- name: host - type: group - fields: - - name: disk.read.bytes - type: scaled_float - unit: byte - metric_type: gauge - description: | - The total number of bytes read successfully in a given period of time. - - name: disk.write.bytes - type: scaled_float - unit: byte - metric_type: gauge - description: | - The total number of bytes write successfully in a given period of time. diff --git a/packages/system/data_stream/network/fields/agent.yml b/packages/system/data_stream/network/fields/agent.yml index c20bbf2c709..da7e7451a61 100644 --- a/packages/system/data_stream/network/fields/agent.yml +++ b/packages/system/data_stream/network/fields/agent.yml @@ -195,3 +195,4 @@ example: "stretch" description: > OS codename, if any. + diff --git a/packages/system/data_stream/process/fields/fields.yml b/packages/system/data_stream/process/fields/fields.yml index f211c8ff9d3..7a6215d2ea7 100644 --- a/packages/system/data_stream/process/fields/fields.yml +++ b/packages/system/data_stream/process/fields/fields.yml @@ -139,76 +139,92 @@ fields: - name: usage.ns type: long + metric_type: counter description: cgroups v2 usage in nanoseconds - name: usage.pct type: float + metric_type: gauge description: cgroups v2 usage - name: usage.norm.pct type: float + metric_type: gauge description: cgroups v2 normalized usage - name: user.ns type: long + metric_type: counter description: cgroups v2 cpu user time in nanoseconds - name: user.pct type: float + metric_type: gauge description: cgroups v2 cpu user time - name: user.norm.pct type: float + metric_type: gauge description: cgroups v2 normalized cpu user time - name: system.ns type: long + metric_type: counter description: cgroups v2 system time in nanoseconds - name: system.pct type: float + metric_type: gauge description: cgroups v2 system time - name: system.norm.pct type: float + metric_type: gauge description: cgroups v2 normalized system time + - name: periods + type: long + metric_type: counter + description: > + Number of period intervals (as specified in cpu.cfs.period.us) that have elapsed. + - name: throttled.periods + type: long + metric_type: counter + description: > + Number of times tasks in a cgroup have been throttled (that is, not allowed to run because they have exhausted all of the available time as specified by their quota). + + - name: throttled.us + type: long + metric_type: counter + description: > + The total time duration (in microseconds) for which tasks in a cgroup have been throttled, as reported by cgroupsv2 + + - name: throttled.ns + type: long + metric_type: counter + description: > + The total time duration (in nanoseconds) for which tasks in a cgroup have been throttled. - name: cfs.period.us type: long + metric_type: gauge description: > Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. - name: cfs.quota.us type: long + metric_type: gauge description: > Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). - name: cfs.shares type: long + metric_type: gauge description: > An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. - name: rt.period.us type: long + metric_type: gauge description: > Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. - name: rt.runtime.us type: long + metric_type: gauge description: > Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. - - name: stats.periods - type: long - description: > - Number of period intervals (as specified in cpu.cfs.period.us) that have elapsed. - - - name: stats.throttled.periods - type: long - description: > - Number of times tasks in a cgroup have been throttled (that is, not allowed to run because they have exhausted all of the available time as specified by their quota). - - - name: stats.throttled.us - type: long - description: > - The total time duration (in microseconds) for which tasks in a cgroup have been throttled, as reported by cgroupsv2 - - - name: stats.throttled.ns - type: long - description: > - The total time duration (in nanoseconds) for which tasks in a cgroup have been throttled. - - name: pressure type: group description: Pressure (resource contention) stats. @@ -219,19 +235,22 @@ fields: - name: 10.pct type: float + metric_type: gauge format: percent description: Pressure over 10 seconds - name: 60.pct type: float + metric_type: gauge format: percent description: Pressure over 60 seconds - name: 300.pct type: float + metric_type: gauge format: percent description: Pressure over 300 seconds - name: total type: long - format: percent + metric_type: counter description: total Some pressure time - name: full type: group @@ -239,18 +258,22 @@ fields: - name: 10.pct type: float + metric_type: gauge format: percent description: Pressure over 10 seconds - name: 60.pct type: float + metric_type: gauge format: percent description: Pressure over 60 seconds - name: 300.pct type: float + metric_type: gauge format: percent description: Pressure over 300 seconds - name: total type: long + metric_type: counter description: total Full pressure time - name: cpuacct type: group @@ -266,36 +289,45 @@ - name: total.ns type: long + metric_type: counter description: > Total CPU time in nanoseconds consumed by all tasks in the cgroup. - name: total.pct type: scaled_float + metric_type: gauge description: > CPU time of the cgroup as a percentage of overall CPU time. - name: total.norm.pct type: scaled_float + metric_type: gauge description: > CPU time of the cgroup as a percentage of overall CPU time, normalized by CPU count. This is functionally an average of time spent across individual CPUs. - name: stats.user.ns type: long + metric_type: counter description: CPU time consumed by tasks in user mode. - name: stats.user.pct type: scaled_float + metric_type: gauge description: time the cgroup spent in user space, as a percentage of total CPU time - name: stats.user.norm.pct type: scaled_float + metric_type: gauge description: time the cgroup spent in user space, as a percentage of total CPU time, normalized by CPU count. - name: stats.system.ns type: long + metric_type: counter description: CPU time consumed by tasks in user (kernel) mode. - name: stats.system.pct type: scaled_float + metric_type: gauge description: Time the cgroup spent in kernel space, as a percentage of total CPU time - name: stats.system.norm.pct type: scaled_float + metric_type: gauge description: Time the cgroup spent in kernel space, as a percentage of total CPU time, normalized by CPU count. - name: percpu type: object @@ -317,38 +349,45 @@ - name: mem.usage.bytes type: long + metric_type: gauge format: bytes description: > Total memory usage by processes in the cgroup (in bytes). - name: mem.usage.max.bytes type: long + metric_type: gauge format: bytes description: > The maximum memory used by processes in the cgroup (in bytes). - name: mem.limit.bytes type: long + metric_type: gauge format: bytes description: > The maximum amount of user memory in bytes (including file cache) that tasks in the cgroup are allowed to use. - name: mem.failures type: long + metric_type: counter description: > The number of times that the memory limit (mem.limit.bytes) was reached. - name: mem.low.bytes type: long format: bytes + metric_type: gauge description: memory low threshhold - name: mem.high.bytes type: long format: bytes + metric_type: gauge description: memory high threshhold - name: mem.max.bytes type: long format: bytes + metric_type: gauge description: memory max threshhold - name: mem.events type: group @@ -356,54 +395,67 @@ fields: - name: low type: long + metric_type: counter description: low threshold - name: high type: long + metric_type: counter description: high threshold - name: max type: long + metric_type: counter description: max threshold - name: oom type: long + metric_type: counter description: oom threshold - name: oom_kill type: long + metric_type: counter description: oom killer threshold - name: fail type: long + metric_type: counter description: failed threshold - name: memsw.usage.bytes type: long format: bytes + metric_type: gauge description: > The sum of current memory usage plus swap space used by processes in the cgroup (in bytes). - name: memsw.usage.max.bytes type: long format: bytes + metric_type: gauge description: > The maximum amount of memory and swap space used by processes in the cgroup (in bytes). - name: memsw.limit.bytes type: long format: bytes + metric_type: gauge description: > The maximum amount for the sum of memory and swap usage that tasks in the cgroup are allowed to use. - name: memsw.low.bytes type: long format: bytes + metric_type: gauge description: memory low threshhold - name: memsw.high.bytes type: long format: bytes + metric_type: gauge description: memory high threshhold - name: memsw.max.bytes type: long format: bytes + metric_type: gauge description: memory max threshhold - name: memsw.failures type: long + metric_type: counter description: > The number of times that the memory plus swap space limit (memsw.limit.bytes) was reached. @@ -413,65 +465,79 @@ fields: - name: low type: long + metric_type: counter description: low threshold - name: high type: long + metric_type: counter description: high threshold - name: max type: long + metric_type: counter description: max threshold - name: oom type: long + metric_type: counter description: oom threshold - name: oom_kill type: long + metric_type: counter description: oom killer threshold - name: fail type: long + metric_type: counter description: failed threshold - name: kmem.usage.bytes type: long format: bytes + metric_type: gauge description: > Total kernel memory usage by processes in the cgroup (in bytes). - name: kmem.usage.max.bytes type: long format: bytes + metric_type: gauge description: > The maximum kernel memory used by processes in the cgroup (in bytes). - name: kmem.limit.bytes type: long format: bytes + metric_type: gauge description: > The maximum amount of kernel memory that tasks in the cgroup are allowed to use. - name: kmem.failures type: long + metric_type: counter description: > The number of times that the memory limit (kmem.limit.bytes) was reached. - name: kmem_tcp.usage.bytes type: long format: bytes + metric_type: gauge description: > Total memory usage for TCP buffers in bytes. - name: kmem_tcp.usage.max.bytes type: long format: bytes + metric_type: gauge description: > The maximum memory used for TCP buffers by processes in the cgroup (in bytes). - name: kmem_tcp.limit.bytes type: long format: bytes + metric_type: gauge description: > The maximum amount of memory for TCP buffers that tasks in the cgroup are allowed to use. - name: kmem_tcp.failures type: long + metric_type: counter description: > The number of times that the memory limit (kmem_tcp.limit.bytes) was reached. @@ -484,88 +550,104 @@ - name: stats.active_anon.bytes type: long format: bytes + metric_type: gauge description: > Anonymous and swap cache on active least-recently-used (LRU) list, including tmpfs (shmem), in bytes. - name: stats.active_file.bytes type: long format: bytes + metric_type: gauge description: File-backed memory on active LRU list, in bytes. - name: stats.cache.bytes type: long format: bytes + metric_type: gauge description: Page cache, including tmpfs (shmem), in bytes. - name: stats.hierarchical_memory_limit.bytes type: long format: bytes + metric_type: gauge description: > Memory limit for the hierarchy that contains the memory cgroup, in bytes. - name: stats.hierarchical_memsw_limit.bytes type: long format: bytes + metric_type: gauge description: > Memory plus swap limit for the hierarchy that contains the memory cgroup, in bytes. - name: stats.inactive_anon.bytes type: long format: bytes + metric_type: gauge description: > Anonymous and swap cache on inactive LRU list, including tmpfs (shmem), in bytes - name: stats.inactive_file.bytes type: long format: bytes + metric_type: gauge description: > File-backed memory on inactive LRU list, in bytes. - name: stats.mapped_file.bytes type: long format: bytes + metric_type: gauge description: > Size of memory-mapped mapped files, including tmpfs (shmem), in bytes. - name: stats.page_faults type: long + metric_type: counter description: > Number of times that a process in the cgroup triggered a page fault. - name: stats.major_page_faults type: long + metric_type: counter description: > Number of times that a process in the cgroup triggered a major fault. "Major" faults happen when the kernel actually has to read the data from disk. - name: stats.pages_in type: long + metric_type: counter description: > Number of pages paged into memory. This is a counter. - name: stats.pages_out type: long + metric_type: counter description: > Number of pages paged out of memory. This is a counter. - name: stats.rss.bytes type: long format: bytes + metric_type: gauge description: > Anonymous and swap cache (includes transparent hugepages), not including tmpfs (shmem), in bytes. - name: stats.rss_huge.bytes type: long format: bytes + metric_type: gauge description: > Number of bytes of anonymous transparent hugepages. - name: stats.swap.bytes type: long format: bytes + metric_type: gauge description: > Swap usage, in bytes. - name: stats.unevictable.bytes type: long format: bytes + metric_type: gauge description: > Memory that cannot be reclaimed, in bytes. @@ -583,12 +665,14 @@ - name: total.bytes type: long + metric_type: counter format: bytes description: > Total number of bytes transferred to and from all block devices by processes in the cgroup. - name: total.ios type: long + metric_type: counter description: > Total number of I/O operations performed on all devices by processes in the cgroup as seen by the throttling policy. @@ -625,18 +709,22 @@ fields: - name: 10.pct type: float + metric_type: gauge format: percent description: Pressure over 10 seconds - name: 60.pct type: float + metric_type: gauge format: percent description: Pressure over 60 seconds - name: 300.pct type: float + metric_type: gauge format: percent description: Pressure over 300 seconds - name: total type: long + metric_type: counter description: total Some pressure time - name: some type: group @@ -644,15 +732,19 @@ fields: - name: 10.pct type: float + metric_type: gauge format: percent description: Pressure over 10 seconds - name: 60.pct type: float + metric_type: gauge format: percent description: Pressure over 60 seconds - name: 300.pct + metric_type: gauge type: float description: Pressure over 300 seconds - name: total type: long + metric_type: counter description: total Some pressure time diff --git a/packages/system/data_stream/process/sample_event.json b/packages/system/data_stream/process/sample_event.json new file mode 100644 index 00000000000..6e3c5750b50 --- /dev/null +++ b/packages/system/data_stream/process/sample_event.json @@ -0,0 +1,112 @@ +{ + "@timestamp": "2023-07-18T12:31:17.738Z", + "agent": { + "ephemeral_id": "8418b67d-d9e9-468d-8925-94f94e4c8308", + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", + "name": "docker-fleet-agent", + "type": "metricbeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "system.process", + "namespace": "ep", + "type": "metrics" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "dataset": "system.process", + "duration": 1537667, + "ingested": "2023-07-18T12:31:18Z", + "module": "system" + }, + "host": { + "architecture": "aarch64", + "containerized": false, + "hostname": "docker-fleet-agent", + "id": "b5cb0e96dbea41d19c3216af1f327d73", + "ip": [ + "172.19.0.7" + ], + "mac": [ + "02-42-AC-13-00-07" + ], + "name": "docker-fleet-agent", + "os": { + "codename": "focal", + "family": "debian", + "kernel": "5.15.49-linuxkit-pr", + "name": "Ubuntu", + "platform": "ubuntu", + "type": "linux", + "version": "20.04.6 LTS (Focal Fossa)" + } + }, + "metricset": { + "name": "process", + "period": 10000 + }, + "process": { + "args": [ + "/usr/bin/tini", + "--", + "/usr/local/bin/docker-entrypoint" + ], + "command_line": "/usr/bin/tini -- /usr/local/bin/docker-entrypoint", + "cpu": { + "start_time": "2023-07-18T12:30:52.000Z" + }, + "executable": "/usr/bin/tini", + "memory": { + "pct": 0.0001 + }, + "name": "tini", + "parent": { + "pid": 0 + }, + "pgid": 1, + "pid": 1, + "state": "sleeping", + "working_directory": "/usr/share/elastic-agent" + }, + "service": { + "type": "system" + }, + "system": { + "process": { + "cmdline": "/usr/bin/tini -- /usr/local/bin/docker-entrypoint", + "cpu": { + "start_time": "2023-07-18T12:30:52.000Z", + "total": { + "value": 10 + } + }, + "fd": { + "limit": { + "hard": 1048576, + "soft": 1048576 + }, + "open": 3 + }, + "memory": { + "rss": { + "bytes": 479232, + "pct": 0.0001 + }, + "share": 413696, + "size": 1982464 + }, + "state": "sleeping" + } + }, + "user": { + "name": "elastic-agent" + } +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json new file mode 100644 index 00000000000..86bafc551fe --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json @@ -0,0 +1,52 @@ +{ + "events": [ + { + "event": { + "code": "5152", + "kind": "event", + "outcome": "failure", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "winlog": { + "activity_id": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "SourceAddress": "10.47.0.122", + "LayerRTID": "13", + "LayerName": "%%14597", + "DestPort": "1947", + "FilterRTID": "122003", + "ProcessId": "0", + "SourcePort": "58231", + "Protocol": "17", + "FilterOrigin": "Stealth", + "Application": "-", + "Direction": "%%14592", + "DestAddress": "255.255.255.255" + }, + "event_id": "5152", + "keywords": [ + "Audit Failure" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 7959006, + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json-expected.json new file mode 100644 index 00000000000..8e9f16a2db2 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5152.json-expected.json @@ -0,0 +1,82 @@ +{ + "expected": [ + { + "@timestamp": "2023-01-17T22:18:03.557Z", + "destination": { + "ip": "255.255.255.255", + "port": 1947 + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "windows-firewall-packet-drop", + "category": [ + "network" + ], + "code": "5152", + "kind": "event", + "outcome": "failure", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "connection", + "info", + "denied" + ] + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "network": { + "community_id": "1:FgoAQGl+ATfnW8e628q6RGGOh/I=", + "direction": "inbound", + "iana_number": "17", + "transport": "udp" + }, + "related": { + "ip": [ + "255.255.255.255", + "10.47.0.122" + ] + }, + "source": { + "ip": "10.47.0.122", + "port": 58231 + }, + "winlog": { + "activity_id": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "Application": "-", + "Direction": "%%14592", + "FilterOrigin": "Stealth", + "FilterRTID": "122003", + "LayerName": "%%14597", + "LayerNameDescription": "Transport", + "LayerRTID": "13", + "ProcessId": "0", + "Protocol": "17" + }, + "event_id": "5152", + "keywords": [ + "Audit Failure" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "7959006", + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json new file mode 100644 index 00000000000..099c3f9d539 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json @@ -0,0 +1,55 @@ +{ + "events": [ + { + "event": { + "code": "5156", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "SourceAddress": "10.47.0.151", + "LayerName": "%%14611", + "DestPort": "389", + "FilterRTID": "67993", + "RemoteMachineID": "S-1-0-0", + "RemoteUserID": "S-1-0-0", + "SourcePort": "49691", + "Direction": "%%14593", + "InterfaceIndex": "14", + "LayerRTID": "48", + "ProcessID": "3032", + "Protocol": "6", + "FilterOrigin": "Unknown", + "DestAddress": "10.47.0.110", + "Application": "\\device\\harddiskvolume3\\windows\\system32\\dsregcmd.exe" + }, + "event_id": "5156", + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 7959006, + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json-expected.json new file mode 100644 index 00000000000..156ec1a042c --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5156.json-expected.json @@ -0,0 +1,90 @@ +{ + "expected": [ + { + "@timestamp": "2023-01-17T22:18:03.557Z", + "destination": { + "ip": "10.47.0.110", + "port": 389 + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "windows-firewall-connection", + "category": [ + "network" + ], + "code": "5156", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "connection", + "info", + "allowed" + ] + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "network": { + "community_id": "1:gtDrYNYd7tTzmbraqir6zvXbxgA=", + "direction": "outbound", + "iana_number": "6", + "transport": "tcp" + }, + "process": { + "executable": "\\device\\harddiskvolume3\\windows\\system32\\dsregcmd.exe", + "name": "dsregcmd.exe" + }, + "related": { + "ip": [ + "10.47.0.110", + "10.47.0.151" + ] + }, + "source": { + "ip": "10.47.0.151", + "port": 49691 + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "Direction": "%%14593", + "FilterOrigin": "Unknown", + "FilterRTID": "67993", + "InterfaceIndex": "14", + "LayerName": "%%14611", + "LayerNameDescription": "Connect", + "LayerRTID": "48", + "ProcessID": "3032", + "Protocol": "6", + "RemoteMachineDescription": "Nobody", + "RemoteMachineID": "S-1-0-0", + "RemoteUserDescription": "Nobody", + "RemoteUserID": "S-1-0-0" + }, + "event_id": "5156", + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "7959006", + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json new file mode 100644 index 00000000000..b74d9c25ab1 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json @@ -0,0 +1,59 @@ +{ + "events": [ + { + "event": { + "code": "5157", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "SourceAddress": "10.47.0.110", + "CurrentProfile": "%%14645", + "LayerName": "%%14610", + "DestPort": "137", + "IsLoopback": "%%1826", + "FilterRTID": "71720", + "RemoteMachineID": "S-1-0-0", + "SourcePort": "137", + "RemoteUserID": "S-1-0-0", + "Direction": "%%14592", + "InterfaceIndex": "14", + "LayerRTID": "44", + "OriginalProfile": "%%14645", + "HasRemoteDynamicKeywordAddress": "%%1826", + "ProcessID": "4", + "Protocol": "17", + "FilterOrigin": "Query User Default", + "DestAddress": "10.47.0.255", + "Application": "System" + }, + "event_id": "5157", + "keywords": [ + "Audit Failure" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 7959006, + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json-expected.json new file mode 100644 index 00000000000..5ec8dfbeed0 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5157.json-expected.json @@ -0,0 +1,94 @@ +{ + "expected": [ + { + "@timestamp": "2023-01-17T22:18:03.557Z", + "destination": { + "ip": "10.47.0.255", + "port": 137 + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "windows-firewall-packet-block", + "category": [ + "network" + ], + "code": "5157", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "connection", + "info", + "denied" + ] + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "network": { + "community_id": "1:bo9Y/YAoD/3+dwRF+CSVGw3OVf8=", + "direction": "inbound", + "iana_number": "17", + "transport": "udp" + }, + "process": { + "executable": "System", + "name": "System" + }, + "related": { + "ip": [ + "10.47.0.255", + "10.47.0.110" + ] + }, + "source": { + "ip": "10.47.0.110", + "port": 137 + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "CurrentProfile": "%%14645", + "Direction": "%%14592", + "FilterOrigin": "Query User Default", + "FilterRTID": "71720", + "HasRemoteDynamicKeywordAddress": "%%1826", + "InterfaceIndex": "14", + "IsLoopback": "%%1826", + "LayerName": "%%14610", + "LayerNameDescription": "Receive/Accept", + "LayerRTID": "44", + "OriginalProfile": "%%14645", + "ProcessID": "4", + "Protocol": "17", + "RemoteMachineDescription": "Nobody", + "RemoteMachineID": "S-1-0-0", + "RemoteUserDescription": "Nobody", + "RemoteUserID": "S-1-0-0" + }, + "event_id": "5157", + "keywords": [ + "Audit Failure" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "7959006", + "time_created": "2023-01-17T22:18:03.5577972Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json new file mode 100644 index 00000000000..d27d18ce37a --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json @@ -0,0 +1,48 @@ +{ + "events": [ + { + "event": { + "code": "5158", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing" + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "SourceAddress": "0.0.0.0", + "LayerName": "%%14608", + "LayerRTID": "36", + "ProcessId": "3868", + "FilterRTID": "0", + "SourcePort": "50431", + "Protocol": "6", + "Application": "\\device\\harddiskvolume3\\program files\\elastic\\agent\\data\\elastic-agent-4ac18b\\components\\filebeat.exe" + }, + "event_id": "5158", + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": 7959002, + "time_created": "2023-01-17T22:18:03.5397904Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json-expected.json new file mode 100644 index 00000000000..dab6c084797 --- /dev/null +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-5158.json-expected.json @@ -0,0 +1,74 @@ +{ + "expected": [ + { + "@timestamp": "2023-01-17T22:18:03.539Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "windows-firewall-bind-local-port", + "category": [ + "network" + ], + "code": "5158", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "info" + ] + }, + "host": { + "name": "COMPUTER1.contoso.com" + }, + "log": { + "level": "information" + }, + "network": { + "iana_number": "6", + "transport": "tcp" + }, + "process": { + "executable": "\\device\\harddiskvolume3\\program files\\elastic\\agent\\data\\elastic-agent-4ac18b\\components\\filebeat.exe", + "name": "filebeat.exe" + }, + "related": { + "ip": [ + "0.0.0.0" + ] + }, + "source": { + "ip": "0.0.0.0", + "port": 50431 + }, + "winlog": { + "activity_id": "{1cd3afa7-265d-0001-54b0-d31c5d26d901}", + "channel": "Security", + "computer_name": "COMPUTER1.contoso.com", + "event_data": { + "FilterRTID": "0", + "LayerName": "%%14608", + "LayerNameDescription": "Resource Assignment", + "LayerRTID": "36", + "ProcessId": "3868", + "Protocol": "6" + }, + "event_id": "5158", + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "process": { + "pid": 924, + "thread": { + "id": 12672 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "7959002", + "time_created": "2023-01-17T22:18:03.5397904Z" + } + } + ] +} \ No newline at end of file diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json b/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json index 23983ce6e85..5e64ecb808a 100644 --- a/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json @@ -35,7 +35,64 @@ "LogonID": "0x60d1ccb", "SessionName": "RDP-Tcp#116", "ClientName": "EQP01777", - "ClientAddress": "10.100.150.17", + "ClientAddress": "LOCAL", + "AccountName": "at_adm" + }, + "event_id": 4779, + "record_id": 5069070, + "computer_name": "DC_TEST2k12.TEST.SAAS", + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "outcome": "success", + "process": { + "pid": 496, + "thread": { + "id": 3852 + } + } + }, + "event": { + "kind": "event", + "code": 4779, + "provider": "Microsoft-Windows-Security-Auditing", + "outcome": "success" + } + }, + { + "@timestamp": "2021-04-15T19:03:22.673Z", + "log": { + "level": "information", + "file": { + "path": "/Users/leehinman/src/beats/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.xml" + } + }, + "ecs": { + "version": "1.8.0" + }, + "host": { + "name": "DC_TEST2k12.TEST.SAAS" + }, + "agent": { + "ephemeral_id": "d9d93a3d-3242-4f55-a4de-4ded8ae26301", + "id": "3cdc1e10-ded0-4f5d-8434-ede1d1120b17", + "name": "Lees-MBP.localdomain", + "type": "filebeat", + "version": "8.0.0" + }, + "winlog": { + "channel": "Security", + "provider_name": "Microsoft-Windows-Security-Auditing", + "keywords": [ + "Audit Success" + ], + "opcode": "Info", + "time_created": "2020-04-03T10:18:01.882Z", + "level": "information", + "event_data": { + "AccountDomain": "TEST", + "LogonID": "0x60d1ccb", + "SessionName": "RDP-Tcp#116", + "ClientName": "EQP01777", + "ClientAddress": "Unknown", "AccountName": "at_adm" }, "event_id": 4779, diff --git a/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json-expected.json b/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json-expected.json index bc3cf06301b..1fa3f18660b 100644 --- a/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json-expected.json +++ b/packages/system/data_stream/security/_dev/test/pipeline/test-security-windows2012-4779.json-expected.json @@ -37,7 +37,7 @@ }, "related": { "ip": [ - "10.100.150.17" + "127.0.0.1" ], "user": [ "at_adm" @@ -45,7 +45,7 @@ }, "source": { "domain": "EQP01777", - "ip": "10.100.150.17" + "ip": "127.0.0.1" }, "user": { "domain": "TEST", @@ -57,7 +57,87 @@ "event_data": { "AccountDomain": "TEST", "AccountName": "at_adm", - "ClientAddress": "10.100.150.17", + "ClientAddress": "127.0.0.1", + "ClientName": "EQP01777", + "LogonID": "0x60d1ccb", + "SessionName": "RDP-Tcp#116" + }, + "event_id": "4779", + "keywords": [ + "Audit Success" + ], + "level": "information", + "logon": { + "id": "0x60d1ccb" + }, + "opcode": "Info", + "outcome": "success", + "process": { + "pid": 496, + "thread": { + "id": 3852 + } + }, + "provider_guid": "{54849625-5478-4994-a5ba-3e3b0328c30d}", + "provider_name": "Microsoft-Windows-Security-Auditing", + "record_id": "5069070", + "time_created": "2020-04-03T10:18:01.882Z" + } + }, + { + "@timestamp": "2020-04-03T10:18:01.882Z", + "agent": { + "ephemeral_id": "d9d93a3d-3242-4f55-a4de-4ded8ae26301", + "id": "3cdc1e10-ded0-4f5d-8434-ede1d1120b17", + "name": "Lees-MBP.localdomain", + "type": "filebeat", + "version": "8.0.0" + }, + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "session-disconnected", + "category": [ + "authentication", + "session" + ], + "code": "4779", + "kind": "event", + "outcome": "success", + "provider": "Microsoft-Windows-Security-Auditing", + "type": [ + "end" + ] + }, + "host": { + "name": "DC_TEST2k12.TEST.SAAS" + }, + "log": { + "file": { + "path": "/Users/leehinman/src/beats/x-pack/winlogbeat/module/security/test/testdata/security-windows2012_4779.xml" + }, + "level": "information" + }, + "related": { + "user": [ + "at_adm" + ] + }, + "source": { + "domain": "EQP01777" + }, + "user": { + "domain": "TEST", + "name": "at_adm" + }, + "winlog": { + "channel": "Security", + "computer_name": "DC_TEST2k12.TEST.SAAS", + "event_data": { + "AccountDomain": "TEST", + "AccountName": "at_adm", + "ClientAddress": "Unknown", "ClientName": "EQP01777", "LogonID": "0x60d1ccb", "SessionName": "RDP-Tcp#116" diff --git a/packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml b/packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml index 12da0566c36..ab06551fb9a 100644 --- a/packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml +++ b/packages/system/data_stream/security/elasticsearch/ingest_pipeline/standard.yml @@ -787,8 +787,38 @@ processors: - info - access action: network-share-object-access-checked + "5152": + category: + - network + type: + - connection + - info + - denied + action: windows-firewall-packet-drop + "5156": + category: + - network + type: + - connection + - info + - allowed + action: windows-firewall-connection + "5157": + category: + - network + type: + - connection + - info + - denied + action: windows-firewall-packet-block + "5158": + category: + - network + type: + - info + action: windows-firewall-bind-local-port source: |- - if (ctx?.event?.code == null || params.get(ctx.event.code) == null) { + if (ctx.event?.code == null || params.get(ctx.event.code) == null) { return; } def hm = new HashMap(params.get(ctx.event.code)); @@ -811,14 +841,14 @@ processors: "10": RemoteInteractive "11": CachedInteractive source: |- - if (ctx?.winlog?.event_data?.LogonType == null) { + if (ctx.winlog?.event_data?.LogonType == null) { return; } def t = params.get(ctx.winlog.event_data.LogonType); if (t == null) { return; } - if (ctx?.winlog?.logon == null ) { + if (ctx.winlog?.logon == null ) { Map map = new HashMap(); ctx.winlog.put("logon", map); } @@ -912,7 +942,7 @@ processors: "0x00000002": Renew "0x00000001": Validate source: |- - if (ctx?.winlog?.event_data?.TicketOptions == null) { + if (ctx.winlog?.event_data?.TicketOptions == null) { return; } Long tOpts = Long.decode(ctx.winlog.event_data.TicketOptions); @@ -944,7 +974,7 @@ processors: "0x18": RC4-HMAC-EXP "0xffffffff": FAIL source: |- - if (ctx?.winlog?.event_data?.TicketEncryptionType == null) { + if (ctx.winlog?.event_data?.TicketEncryptionType == null) { return; } ctx.winlog.event_data.put("TicketEncryptionTypeDescription", @@ -1017,8 +1047,8 @@ processors: "0x43": KRB_AP_ERR_NO_TGT "0x44": KDC_ERR_WRONG_REALM source: |- - if (ctx?.winlog?.event_data?.Status == null || - ctx?.event?.code == null || + if (ctx.winlog?.event_data?.Status == null || + ctx.event?.code == null || !["4768", "4769", "4770", "4771"].contains(ctx.event.code)) { return; } @@ -1039,15 +1069,15 @@ processors: "0x110": Interactive Own Process "0x120": Interactive Share Process source: |- - if (ctx?.winlog?.event_data?.ServiceName != null) { - if (ctx?.service == null) { + if (ctx.winlog?.event_data?.ServiceName != null) { + if (ctx.service == null) { HashMap hm = new HashMap(); ctx.put("service", hm); } ctx.service.put("name", ctx.winlog.event_data.ServiceName); } - if (ctx?.winlog.event_data?.ServiceType != null) { - if (ctx?.service == null) { + if (ctx.winlog.event_data?.ServiceType != null) { + if (ctx.service == null) { HashMap hm = new HashMap(); ctx.put("service", hm); } @@ -1119,7 +1149,7 @@ processors: "0CCE9241-69AE-11D9-BED3-505054503030": ["Other Account Logon Events","Account Logon"] "0CCE9242-69AE-11D9-BED3-505054503030": ["Kerberos Authentication Service","Account Logon"] source: |- - if (ctx?.winlog?.event_data?.SubcategoryGuid == null) { + if (ctx.winlog?.event_data?.SubcategoryGuid == null) { return; } def subCatGuid = ctx.winlog.event_data.SubcategoryGuid.replace("{","").replace("}","").toUpperCase(); @@ -2147,21 +2177,21 @@ processors: f.add(s.substring(last)); return f; } - if (ctx?.winlog?.event_data?.FailureReason != null) { + if (ctx.winlog?.event_data?.FailureReason != null) { def code = ctx.winlog.event_data.FailureReason.replace("%%",""); if (params.descriptions.containsKey(code)) { - if (ctx?.winlog?.logon == null ) { + if (ctx.winlog?.logon == null ) { HashMap hm = new HashMap(); ctx.winlog.put("logon", hm); } - if (ctx?.winlog?.logon?.failure == null) { + if (ctx.winlog?.logon?.failure == null) { HashMap hm = new HashMap(); ctx.winlog.logon.put("failure", hm); } ctx.winlog.logon.failure.put("reason", params.descriptions[code]); } } - if (ctx?.winlog?.event_data?.AuditPolicyChanges != null) { + if (ctx.winlog?.event_data?.AuditPolicyChanges != null) { ArrayList results = new ArrayList(); for (elem in ctx.winlog.event_data.AuditPolicyChanges.splitOnToken(",")) { def code = elem.replace("%%","").trim(); @@ -2173,7 +2203,7 @@ processors: ctx.winlog.event_data.put("AuditPolicyChangesDescription", results); } } - if (ctx?.winlog?.event_data?.AccessList != null) { + if (ctx.winlog?.event_data?.AccessList != null) { ArrayList results = new ArrayList(); for (elem in ctx.winlog.event_data.AccessList.splitOnToken(" ")) { def code = elem.replace("%%","").trim(); @@ -2185,7 +2215,19 @@ processors: ctx.winlog.event_data.put("AccessListDescription", results); } } - if (ctx?.winlog?.event_data?.AccessMask != null) { + if (ctx.winlog?.event_data?.Direction != null) { + def code = ctx.winlog.event_data.Direction.replace("%%","").trim(); + if (params.descriptions.containsKey(code)) { + ctx.winlog.event_data.put("DirectionDescription", params.descriptions[code]); + } + } + if (ctx.winlog?.event_data?.LayerName != null) { + def code = ctx.winlog.event_data.LayerName.replace("%%","").trim(); + if (params.descriptions.containsKey(code)) { + ctx.winlog.event_data.put("LayerNameDescription", params.descriptions[code]); + } + } + if (ctx.winlog?.event_data?.AccessMask != null) { ArrayList results = new ArrayList(); for (elem in split(ctx.winlog.event_data.AccessMask)) { def mask = elem.replace("%%","").trim(); @@ -2249,30 +2291,30 @@ processors: "0xc0000371": "The local account store does not contain secret material for the specified account" "0x0": "Status OK." source: |- - if (ctx?.winlog?.event_data?.Status == null || - ctx?.event?.code == null || + if (ctx.winlog?.event_data?.Status == null || + ctx.event?.code == null || !["4625", "4776"].contains(ctx.event.code)) { return; } if (params.containsKey(ctx.winlog.event_data.Status)) { - if (ctx?.winlog?.logon == null ) { + if (ctx.winlog?.logon == null ) { HashMap hm = new HashMap(); ctx.winlog.put("logon", hm); } - if (ctx?.winlog?.logon?.failure == null) { + if (ctx.winlog?.logon?.failure == null) { HashMap hm = new HashMap(); ctx.winlog.logon.put("failure", hm); } ctx.winlog.logon.failure.put("status", params[ctx.winlog.event_data.Status]); } - if (ctx?.winlog?.event_data?.SubStatus == null || !params.containsKey(ctx.winlog.event_data.SubStatus)) { + if (ctx.winlog?.event_data?.SubStatus == null || !params.containsKey(ctx.winlog.event_data.SubStatus)) { return; } - if (ctx?.winlog?.logon == null ) { + if (ctx.winlog?.logon == null ) { HashMap hm = new HashMap(); ctx.winlog.put("logon", hm); } - if (ctx?.winlog?.logon?.failure == null) { + if (ctx.winlog?.logon?.failure == null) { HashMap hm = new HashMap(); ctx.winlog.logon.put("failure", hm); } @@ -2290,7 +2332,7 @@ processors: "3": "TRUST_TYPE_MIT" "4": "TRUST_TYPE_DCE" source: |- - if (ctx?.winlog?.event_data?.TdoType == null) { + if (ctx.winlog?.event_data?.TdoType == null) { return; } if (!params.containsKey(ctx.winlog.event_data.TdoType)) { @@ -2310,7 +2352,7 @@ processors: "2": "TRUST_DIRECTION_OUTBOUND" "3": "TRUST_DIRECTION_BIDIRECTIONAL" source: |- - if (ctx?.winlog?.event_data?.TdoDirection == null) { + if (ctx.winlog?.event_data?.TdoDirection == null) { return; } if (!params.containsKey(ctx.winlog.event_data.TdoDirection)) { @@ -2337,7 +2379,7 @@ processors: "512": "TRUST_ATTRIBUTE_CROSS_ORGANIZATION_NO_TGT_DELEGATION" "1024": "TRUST_ATTRIBUTE_PIM_TRUST" source: |- - if (ctx?.winlog?.event_data?.TdoAttributes == null) { + if (ctx.winlog?.event_data?.TdoAttributes == null) { return; } if (!params.containsKey(ctx.winlog.event_data.TdoAttributes)) { @@ -2350,21 +2392,21 @@ processors: tag: Add Session Events description: Add Session Events source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4778", "4779"].contains(ctx.event.code)) { return; } //AccountName to user.name and related.user - if (ctx?.winlog?.event_data?.AccountName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.AccountName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2375,8 +2417,8 @@ processors: } //AccountDomain to user.domain - if (ctx?.winlog?.event_data?.AccountDomain != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.AccountDomain != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } @@ -2384,17 +2426,22 @@ processors: } //ClientAddress to source.ip and related.ip - if (ctx?.winlog?.event_data?.ClientAddress != null && - ctx.winlog.event_data.ClientAddress != "-") { - if (ctx?.source == null) { + if (ctx.winlog?.event_data?.ClientAddress != null && + ctx.winlog.event_data.ClientAddress != "-" && + ctx.winlog.event_data.ClientAddress != "Unknown") { + // Correct invalid IP address "LOCAL" + if (ctx.winlog.event_data.ClientAddress == "LOCAL") { + ctx.winlog.event_data.ClientAddress = "127.0.0.1"; + } + if (ctx.source == null) { HashMap hm = new HashMap(); ctx.put("source", hm); } - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.ip == null) { + if (ctx.related?.ip == null) { ArrayList al = new ArrayList(); ctx.related.put("ip", al); } @@ -2405,8 +2452,8 @@ processors: } //ClientName to source.domain - if (ctx?.winlog?.event_data?.ClientName != null) { - if (ctx?.source == null) { + if (ctx.winlog?.event_data?.ClientName != null) { + if (ctx.source == null) { HashMap hm = new HashMap(); ctx.put("source", hm); } @@ -2414,8 +2461,8 @@ processors: } //LogonID to winlog.logon.id - if (ctx?.winlog?.event_data?.LogonID != null) { - if (ctx?.winlog?.logon == null) { + if (ctx.winlog?.event_data?.LogonID != null) { + if (ctx.winlog?.logon == null) { HashMap hm = new HashMap(); ctx.winlog.put("logon", hm); } @@ -2428,27 +2475,27 @@ processors: tag: Copy Target User description: Copy Target User source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4624", "4625", "4634", "4647", "4648", "4768", "4769", "4770", "4771", "4776", "4964"].contains(ctx.event.code)) { return; } - def targetUserId = ctx?.winlog?.event_data?.TargetUserSid; + def targetUserId = ctx.winlog?.event_data?.TargetUserSid; if (targetUserId == null) { - targetUserId = ctx?.winlog?.event_data?.TargetSid; + targetUserId = ctx.winlog?.event_data?.TargetSid; } //TargetUserSid to user.id or user.target.id if (targetUserId != null) { - if (ctx?.user == null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.id == null) { + if (ctx.user?.id == null) { ctx.user.put("id", targetUserId); } else { - if (ctx?.user?.target == null) { + if (ctx.user?.target == null) { HashMap hm = new HashMap(); ctx.user.put("target", hm); } @@ -2457,26 +2504,26 @@ processors: } //TargetUserName to related.user and user.name or user.target.name - if (ctx?.winlog?.event_data?.TargetUserName != null) { + if (ctx.winlog?.event_data?.TargetUserName != null) { def tun = ctx.winlog.event_data.TargetUserName.splitOnToken("@"); - if (ctx?.user == null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.name == null) { + if (ctx.user?.name == null) { ctx.user.put("name", tun[0]); } else { - if (ctx?.user?.target == null) { + if (ctx.user?.target == null) { HashMap hm = new HashMap(); ctx.user.put("target", hm); } ctx.user.target.put("name", tun[0]); } - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2485,15 +2532,15 @@ processors: } } //TargetUserDomain to user.domain or user.target.domain - if (ctx?.winlog?.event_data?.TargetDomainName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.TargetDomainName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.domain == null) { + if (ctx.user?.domain == null) { ctx.user.put("domain", ctx.winlog.event_data.TargetDomainName); } else { - if (ctx?.user?.target == null){ + if (ctx.user?.target == null){ HashMap hm = new HashMap(); ctx.user.put("target", hm); } @@ -2506,29 +2553,29 @@ processors: tag: Copy MemberName to User and User to Group description: Copy MemberName to User and User to Group source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4727", "4728", "4729", "4730", "4731", "4732", "4733", "4734", "4735", "4737", "4744", "4745", "4746", "4747", "4748", "4749", "4750", "4751", "4752", "4753", "4754", "4755", "4756", "4757", "4758", "4759", "4760", "4761", "4762", "4763", "4764", "4799"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.MemberName != null) { + if (ctx.winlog?.event_data?.MemberName != null) { def memberNameParts = ctx.winlog.event_data.MemberName.splitOnToken(","); def memberName = memberNameParts[0].replace("CN=","").replace("cn=",""); - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } - if (ctx?.user == null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.target == null){ + if (ctx.user?.target == null){ HashMap hm = new HashMap(); ctx.user.put("target", hm); } @@ -2541,47 +2588,47 @@ processors: ctx.user.target.put("domain", domain); } } - if (ctx?.winlog?.event_data?.TargetUserSid != null) { - if (ctx?.group == null) { + if (ctx.winlog?.event_data?.TargetUserSid != null) { + if (ctx.group == null) { HashMap hm = new HashMap(); ctx.put("group", hm); } ctx.group.put("id", ctx.winlog.event_data.TargetUserSid); } - if (ctx?.winlog?.event_data?.TargetSid != null) { - if (ctx?.group == null) { + if (ctx.winlog?.event_data?.TargetSid != null) { + if (ctx.group == null) { HashMap hm = new HashMap(); ctx.put("group", hm); } ctx.group.put("id", ctx.winlog.event_data.TargetSid); } - if (ctx?.winlog?.event_data?.TargetUserName != null) { - if (ctx?.group == null) { + if (ctx.winlog?.event_data?.TargetUserName != null) { + if (ctx.group == null) { HashMap hm = new HashMap(); ctx.put("group", hm); } ctx.group.put("name", ctx.winlog.event_data.TargetUserName); } - if (ctx?.winlog?.event_data?.TargetDomainName != null) { - if (ctx?.group == null) { + if (ctx.winlog?.event_data?.TargetDomainName != null) { + if (ctx.group == null) { HashMap hm = new HashMap(); ctx.put("group", hm); } def domain = ctx.winlog.event_data.TargetDomainName.replace("DC=", "").replace("dc=", ""); ctx.group.put("domain", domain); } - if (ctx?.user?.target != null) { - if (ctx?.user?.target?.group == null) { + if (ctx.user?.target != null) { + if (ctx.user?.target?.group == null) { HashMap hm = new HashMap(); ctx.user.target.put("group", hm); } - if (ctx?.group?.id != null) { + if (ctx.group?.id != null) { ctx.user.target.group.put("id", ctx.group.id); } - if (ctx?.group?.name != null) { + if (ctx.group?.name != null) { ctx.user.target.group.put("name", ctx.group.name); } - if (ctx?.group?.domain != null) { + if (ctx.group?.domain != null) { ctx.user.target.group.put("domain", ctx.group.domain); } } @@ -2592,26 +2639,26 @@ processors: tag: Copy Target User to Computer Object description: Copy Target User to Computer Object source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4741", "4742", "4743"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.TargetSid != null) { - if (ctx?.winlog?.computerObject == null) { + if (ctx.winlog?.event_data?.TargetSid != null) { + if (ctx.winlog?.computerObject == null) { HashMap hm = new HashMap(); ctx.winlog.put("computerObject", hm); } ctx.winlog.computerObject.put("id", ctx.winlog.event_data.TargetSid); } - if (ctx?.winlog?.event_data?.TargetUserName != null) { - if (ctx?.winlog?.computerObject == null) { + if (ctx.winlog?.event_data?.TargetUserName != null) { + if (ctx.winlog?.computerObject == null) { HashMap hm = new HashMap(); ctx.winlog.put("computerObject", hm); } ctx.winlog.computerObject.put("name", ctx.winlog.event_data.TargetUserName); } - if (ctx?.winlog?.event_data?.TargetDomainName != null) { - if (ctx?.winlog?.computerObject == null) { + if (ctx.winlog?.event_data?.TargetDomainName != null) { + if (ctx.winlog?.computerObject == null) { HashMap hm = new HashMap(); ctx.winlog.put("computerObject", hm); } @@ -2622,7 +2669,7 @@ processors: field: winlog.logon.id copy_from: winlog.event_data.TargetLogonId ignore_failure: false - if: ctx?.event?.code != null && ["4634", "4647", "4964"].contains(ctx.event.code) + if: ctx.event?.code != null && ["4634", "4647", "4964"].contains(ctx.event.code) - script: lang: painless @@ -2630,7 +2677,7 @@ processors: tag: Copy Subject User from Event Data description: Copy Subject User from Event Data source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4657", "4670", "4672", "4673", "4674", "4688", "4689", "4697", "4698", "4699", "4700", "4701", "4702", "4706", "4707", "4713", "4716", "4717", "4718", "4719", "4720", "4722", "4723", "4724", @@ -2643,23 +2690,23 @@ processors: "4648", "4797", "5140", "5145", "5379", "5380", "5381", "5382"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.SubjectUserSid != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.SubjectUserSid != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } ctx.user.put("id", ctx.winlog.event_data.SubjectUserSid); } - if (ctx?.winlog?.event_data?.SubjectUserName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.SubjectUserName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2668,8 +2715,8 @@ processors: ctx.related.user.add(ctx.winlog.event_data.SubjectUserName); } } - if (ctx?.winlog?.event_data?.SubjectDomainName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.event_data?.SubjectDomainName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } @@ -2682,30 +2729,30 @@ processors: tag: Copy Target User to Target description: Copy Target User to Target source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4670", "4720", "4722", "4723", "4724", "4725", "4726", "4738", "4740", "4767", "4798", "4817", "4907", "4797"].contains(ctx.event.code)) { return; } - if (ctx?.user == null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.target == null) { + if (ctx.user?.target == null) { HashMap hm = new HashMap(); ctx.user.put("target", hm); } - def userId = ctx?.winlog?.event_data?.TargetSid; + def userId = ctx.winlog?.event_data?.TargetSid; if (userId != null && userId != "" && userId != "-") ctx.user.target.id = userId; - def userName = ctx?.winlog?.event_data?.TargetUserName; + def userName = ctx.winlog?.event_data?.TargetUserName; if (userName != null && userName != "" && userName != "-") { ctx.user.target.name = userName; def parts = userName.splitOnToken("@"); if (parts.length > 1) { ctx.user.target.name = parts[0]; } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2713,7 +2760,7 @@ processors: ctx.related.user.add(ctx.user.target.name); } } - def userDomain = ctx?.winlog?.event_data?.TargetDomainName; + def userDomain = ctx.winlog?.event_data?.TargetDomainName; if (userDomain != null && userDomain != "" && userDomain != "-") ctx.user.target.domain = userDomain; if (ctx.user?.target != null && ctx.user.target.size() == 0) ctx.user.remove("target"); @@ -2723,28 +2770,28 @@ processors: tag: Copy Target User to Effective description: Copy Target User to Effective source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4648", "4688"].contains(ctx.event.code)) { return; } - if (ctx?.user == null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.user?.effective == null) { + if (ctx.user?.effective == null) { HashMap hm = new HashMap(); ctx.user.put("effective", hm); } - def userId = ctx?.winlog?.event_data?.TargetUserSid; + def userId = ctx.winlog?.event_data?.TargetUserSid; if (userId != null && userId != "" && userId != "-") ctx.user.effective.id = userId; - def userName = ctx?.winlog?.event_data?.TargetUserName; + def userName = ctx.winlog?.event_data?.TargetUserName; if (userName != null && userName != "" && userName != "-") { ctx.user.effective.name = userName; def parts = userName.splitOnToken("@"); if (parts.length > 1) { ctx.user.effective.name = parts[0]; } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2752,7 +2799,7 @@ processors: ctx.related.user.add(ctx.user.effective.name); } } - def userDomain = ctx?.winlog?.event_data?.TargetDomainName; + def userDomain = ctx.winlog?.event_data?.TargetDomainName; if (userDomain != null && userDomain != "" && userDomain != "-") ctx.user.effective.domain = userDomain; if (ctx.user?.effective != null && ctx.user.effective.size() == 0) ctx.user.remove("effective"); @@ -2762,27 +2809,27 @@ processors: tag: Copy Subject User from user_data description: Copy Subject User from user_data source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["1102"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.user_data?.SubjectUserSid != null) { - if (ctx?.user == null) { + if (ctx.winlog?.user_data?.SubjectUserSid != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } ctx.user.put("id", ctx.winlog.user_data.SubjectUserSid); } - if (ctx?.winlog?.user_data?.SubjectUserName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.user_data?.SubjectUserName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -2791,8 +2838,8 @@ processors: ctx.related.user.add(ctx.winlog.user_data.SubjectUserName); } } - if (ctx?.winlog?.user_data?.SubjectDomainName != null) { - if (ctx?.user == null) { + if (ctx.winlog?.user_data?.SubjectDomainName != null) { + if (ctx.user == null) { HashMap hm = new HashMap(); ctx.put("user", hm); } @@ -2809,7 +2856,7 @@ processors: copy_from: winlog.user_data.SubjectLogonId ignore_failure: true if: |- - ctx?.event?.code != null && + ctx.event?.code != null && ["1102"].contains(ctx.event.code) - script: @@ -2818,7 +2865,7 @@ processors: tag: Rename Common Auth Fields description: Rename Common Auth Fields source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["1100", "1102", "1104", "1105", "1108", "4624", "4648", "4625", "4670", "4673", "4674", "4689", "4697", "4719", "4720", "4722", "4723", "4724", "4725", "4726", "4727", "4728", "4729", "4730", @@ -2830,8 +2877,8 @@ processors: "4904", "4905", "4907", "4912", "5140", "5145"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.ProcessId != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.ProcessId != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } @@ -2843,49 +2890,148 @@ processors: } ctx.winlog.event_data.remove("ProcessId"); } - if (ctx?.winlog?.event_data?.ProcessName != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.ProcessName != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } ctx.process.put("executable", ctx.winlog.event_data.ProcessName); ctx.winlog.event_data.remove("ProcessName"); } - if (ctx?.winlog?.event_data?.IpAddress != null && + if (ctx.winlog?.event_data?.IpAddress != null && ctx.winlog.event_data.IpAddress != "-") { - if (ctx?.source == null) { + if (ctx.source == null) { HashMap hm = new HashMap(); ctx.put("source", hm); } ctx.source.put("ip", ctx.winlog.event_data.IpAddress); ctx.winlog.event_data.remove("IpAddress"); } - if (ctx?.winlog?.event_data?.IpPort != null && ctx.winlog.event_data.IpPort != "-") { - if (ctx?.source == null) { + if (ctx.winlog?.event_data?.IpPort != null && ctx.winlog.event_data.IpPort != "-") { + if (ctx.source == null) { HashMap hm = new HashMap(); ctx.put("source", hm); } ctx.source.put("port", Long.decode(ctx.winlog.event_data.IpPort)); ctx.winlog.event_data.remove("IpPort"); } - if (ctx?.winlog?.event_data?.WorkstationName != null) { - if (ctx?.source == null) { + if (ctx.winlog?.event_data?.WorkstationName != null) { + if (ctx.source == null) { HashMap hm = new HashMap(); ctx.put("source", hm); } ctx.source.put("domain", ctx.winlog.event_data.WorkstationName); ctx.winlog.event_data.remove("WorkstationName"); } - if (ctx?.winlog?.event_data?.ClientAddress != null && - ctx.winlog.event_data.ClientAddress != "-") { - if (ctx?.related == null) { + if (ctx.winlog?.event_data?.ClientAddress != null && + ctx.winlog.event_data.ClientAddress != "-" && + ctx.winlog.event_data.ClientAddress != "Unknown") { + // Correct invalid IP address "LOCAL" + if (ctx.winlog.event_data.ClientAddress == "LOCAL") { + ctx.winlog.event_data.ClientAddress = "127.0.0.1"; + } + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } ctx.related.put("ip", ctx.winlog.event_data.ClientAddress); ctx.winlog.event_data.remove("ClientAddress"); } - if (ctx?.process?.name == null && ctx?.process?.executable != null) { + if (ctx.process?.name == null && ctx.process?.executable != null) { + def parts = ctx.process.executable.splitOnToken("\\"); + ctx.process.put("name", parts[-1]); + } + + - script: + lang: painless + ignore_failure: false + tag: Add Connection Events + description: Add Connection Events + source: |- + if (ctx.event?.code == null || + !["5152", "5156", "5157", "5158"].contains(ctx.event.code)) { + return; + } + + // DestAddress to destination.ip and related.ip + if (ctx.winlog?.event_data?.DestAddress != null && + ctx.winlog.event_data.DestAddress != "-") { + if (ctx.destination == null) { + HashMap hm = new HashMap(); + ctx.put("destination", hm); + } + if (ctx.related == null) { + HashMap hm = new HashMap(); + ctx.put("related", hm); + } + if (ctx.related?.ip == null) { + ArrayList al = new ArrayList(); + ctx.related.put("ip", al); + } + ctx.destination.put("ip", ctx.winlog.event_data.DestAddress); + if (!ctx.related.ip.contains(ctx.winlog.event_data.DestAddress)) { + ctx.related.ip.add(ctx.winlog.event_data.DestAddress); + } + ctx.winlog.event_data.remove("DestAddress"); + } + + // SourceAddress to source.ip and related.ip + if (ctx.winlog?.event_data?.SourceAddress != null && + ctx.winlog.event_data.SourceAddress != "-") { + if (ctx.source == null) { + HashMap hm = new HashMap(); + ctx.put("source", hm); + } + if (ctx.related == null) { + HashMap hm = new HashMap(); + ctx.put("related", hm); + } + if (ctx.related?.ip == null) { + ArrayList al = new ArrayList(); + ctx.related.put("ip", al); + } + ctx.source.put("ip", ctx.winlog.event_data.SourceAddress); + if (!ctx.related.ip.contains(ctx.winlog.event_data.SourceAddress)) { + ctx.related.ip.add(ctx.winlog.event_data.SourceAddress); + } + ctx.winlog.event_data.remove("SourceAddress"); + } + // DestPort to destination.port + if (ctx.winlog?.event_data?.DestPort != null && ctx.winlog.event_data.DestPort != "-") { + if (ctx.destination == null) { + HashMap hm = new HashMap(); + ctx.put("destination", hm); + } + ctx.destination.put("port", Long.decode(ctx.winlog.event_data.DestPort)); + ctx.winlog.event_data.remove("DestPort"); + } + // SourcePort to source.port + if (ctx.winlog?.event_data?.SourcePort != null && ctx.winlog.event_data.SourcePort != "-") { + if (ctx.source == null) { + HashMap hm = new HashMap(); + ctx.put("source", hm); + } + ctx.source.put("port", Long.decode(ctx.winlog.event_data.SourcePort)); + ctx.winlog.event_data.remove("SourcePort"); + } + // Protocol to network.iana_number of type keyword + if (ctx.winlog?.event_data?.Protocol != null && ctx.winlog.event_data.Protocol != "-") { + if (ctx.network == null) { + HashMap hm = new HashMap(); + ctx.put("network", hm); + } + ctx.network.put("iana_number", ctx.winlog.event_data.Protocol); + } + // Application to process.executable and process.name + if (ctx.winlog?.event_data?.Application != null && ctx.winlog?.event_data?.Application != "-") { + if (ctx.process == null) { + HashMap hm = new HashMap(); + ctx.put("process", hm); + } + ctx.process.put("executable", ctx.winlog.event_data.Application); + ctx.winlog.event_data.remove("Application"); + } + if (ctx.process?.name == null && ctx.process?.executable != null) { def parts = ctx.process.executable.splitOnToken("\\"); ctx.process.put("name", parts[-1]); } @@ -2896,12 +3042,12 @@ processors: tag: Process Event 4688 description: Process Event 4688 source: |- - if (ctx?.event?.code == null || + if (ctx.event?.code == null || !["4688"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.NewProcessId != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.NewProcessId != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } @@ -2913,40 +3059,40 @@ processors: } ctx.winlog.event_data.remove("NewProcessId"); } - if (ctx?.winlog?.event_data?.NewProcessName != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.NewProcessName != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } ctx.process.put("executable", ctx.winlog.event_data.NewProcessName); ctx.winlog.event_data.remove("NewProcessName"); } - if (ctx?.winlog?.event_data?.ParentProcessName != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.ParentProcessName != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } - if (ctx?.process?.parent == null) { + if (ctx.process?.parent == null) { HashMap hm = new HashMap(); ctx.process.put("parent", hm); } ctx.process.parent.put("executable", ctx.winlog.event_data.ParentProcessName); ctx.winlog.event_data.remove("ParentProcessName"); } - if (ctx?.process?.name == null && ctx?.process?.executable != null) { + if (ctx.process?.name == null && ctx.process?.executable != null) { def parts = ctx.process.executable.splitOnToken("\\"); ctx.process.put("name", parts[-1]); } - if (ctx?.process?.parent?.name == null && ctx?.process?.parent?.executable != null) { + if (ctx.process?.parent?.name == null && ctx.process?.parent?.executable != null) { def parts = ctx.process.parent.executable.splitOnToken("\\"); ctx.process.parent.put("name", parts[-1]); } - if (ctx?.winlog?.event_data?.ProcessId != null) { - if (ctx?.process == null) { + if (ctx.winlog?.event_data?.ProcessId != null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } - if (ctx?.process?.parent == null) { + if (ctx.process?.parent == null) { HashMap hm = new HashMap(); ctx.process.put("parent", hm); } @@ -2957,7 +3103,7 @@ processors: ctx.process.parent.put("pid", ctx.winlog.event_data.ProcessId); } } - if (ctx?.winlog?.event_data?.CommandLine != null) { + if (ctx.winlog?.event_data?.CommandLine != null) { int start = 0; int end = 0; boolean in_quote = false; @@ -2979,20 +3125,20 @@ processors: al.add(ctx.winlog.event_data.CommandLine.substring(start, end + 1)); } } - if (ctx?.process == null) { + if (ctx.process == null) { HashMap hm = new HashMap(); ctx.put("process", hm); } ctx.process.put("args", al); ctx.process.put("command_line", ctx.winlog.event_data.CommandLine); } - if ((ctx?.winlog?.event_data?.TargetUserName != null) && + if ((ctx.winlog?.event_data?.TargetUserName != null) && (!ctx.winlog.event_data.TargetUserName.equals("-"))) { - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -3006,9 +3152,9 @@ processors: value: '{{winlog.event_data.SubjectUserName}}' allow_duplicates: false if: |- - ctx?.event?.code != null && + ctx.event?.code != null && ["4624", "4648", "4797", "5379", "5380", "5381", "5382"].contains(ctx.event.code) && - ctx?.winlog?.event_data?.SubjectUserName != null && + ctx.winlog?.event_data?.SubjectUserName != null && ctx.winlog.event_data.SubjectUserName != "-" - append: @@ -3016,19 +3162,19 @@ processors: value: '{{winlog.event_data.TargetUserName}}' allow_duplicates: false if: |- - ctx?.event?.code != null && + ctx.event?.code != null && ["4688", "4720", "4722", "4723", "4724", "4725", "4726", "4738", "4740", "4767", "4797", "4798"].contains(ctx.event.code) && - ctx?.winlog?.event_data?.TargetUserName != null && + ctx.winlog?.event_data?.TargetUserName != null && ctx.winlog.event_data.TargetUserName != "-" - split: field: winlog.event_data.PrivilegeList separator: "\\s+" if: |- - ctx?.event?.code != null && + ctx.event?.code != null && ["4672", "4673", "4674", "4741", "4742", "4743"].contains(ctx.event.code) && - ctx?.winlog?.event_data?.PrivilegeList != null + ctx.winlog?.event_data?.PrivilegeList != null - set: field: user.target.name @@ -3045,7 +3191,7 @@ processors: value: '{{winlog.event_data.NewTargetUserName}}' allow_duplicates: false if: |- - ctx?.winlog?.event_data?.NewTargetUserName != null && + ctx.winlog?.event_data?.NewTargetUserName != null && ctx.winlog.event_data.NewTargetUserName != "-" - append: @@ -3053,7 +3199,7 @@ processors: value: '{{winlog.event_data.OldTargetUserName}}' allow_duplicates: false if: |- - ctx?.winlog?.event_data?.OldTargetUserName != null && + ctx.winlog?.event_data?.OldTargetUserName != null && ctx.winlog.event_data.OldTargetUserName != "-" @@ -3344,11 +3490,11 @@ processors: def newDacl = translateACL(dacListMatcher.group(0).replace("(","").replace(")",""), params); ctx.winlog.event_data.put(Sd + "Dacl" + i.toString(), newDacl['grantee'] + " :" + newDacl['type'] + " (" + newDacl['perms'] + ")"); if (["Administrator", "Guest", "KRBTGT"].contains(newDacl['grantee'])) { - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -3368,11 +3514,11 @@ processors: def newSacl = translateACL(sacListMatcher.group(0).replace("(","").replace(")",""), params); ctx.winlog.event_data.put(Sd + "Sacl" + i.toString(), newSacl['grantee'] + " :" + newSacl['type'] + " (" + newSacl['perms'] + ")"); if (["Administrator", "Guest", "KRBTGT"].contains(newSacl['grantee'])) { - if (ctx?.related == null) { + if (ctx.related == null) { HashMap hm = new HashMap(); ctx.put("related", hm); } - if (ctx?.related?.user == null) { + if (ctx.related?.user == null) { ArrayList al = new ArrayList(); ctx.related.put("user", al); } @@ -3393,20 +3539,63 @@ processors: } ctx.winlog.event_data.put("SidListDesc", al); } - - if (ctx?.event?.code == null || + if (ctx.winlog?.event_data?.RemoteMachineID != null) { + ctx.winlog.event_data.put("RemoteMachineDescription", params.AccountSIDDescription[ctx.winlog.event_data.RemoteMachineID]); + } + if (ctx.winlog?.event_data?.RemoteUserID != null) { + ctx.winlog.event_data.put("RemoteUserDescription", params.AccountSIDDescription[ctx.winlog.event_data.RemoteUserID]); + } + if (ctx.event?.code == null || !["4670", "4817", "4907", "4908"].contains(ctx.event.code)) { return; } - if (ctx?.winlog?.event_data?.OldSd != null) { + if (ctx.winlog?.event_data?.OldSd != null) { enrichSDDL(ctx.winlog.event_data.OldSd, "OldSd", params, ctx); } - if (ctx?.winlog?.event_data?.NewSd != null) { + if (ctx.winlog?.event_data?.NewSd != null) { enrichSDDL(ctx.winlog.event_data.NewSd, "NewSd", params, ctx); } - if (ctx?.winlog?.event_data?.SidList != null) { + if (ctx.winlog?.event_data?.SidList != null) { splitSidList(ctx.winlog.event_data.SidList, params, ctx); } + + # + # Populate network.transport from network.iana_number. + # + - script: + if: "ctx.network?.iana_number != null && ctx.network?.transport == null" + lang: painless + params: + "1": icmp + "2": igmp + "4": ipv4 + "6": tcp + "8": egp + "9": igp + "12": pup + "17": udp + "27": rdp + "28": irtp + "33": dccp + "35": idpr + "41": ipv6 + "43": ipv6-route + "44": ipv6-frag + "46": rsvp + "47": gre + "50": esp + "58": ipv6-icmp + "59": ipv6-nonxt + "60": ipv6-opts + source: > + if (ctx.network?.iana_number == null) { + return; + } + def t = params.get(ctx.network.iana_number); + if (t == null) { + return; + } + ctx.network.put("transport", t) - set: field: file.name @@ -3454,6 +3643,17 @@ processors: if (extIdx > -1) { ctx.file.extension = ctx.file.name.substring(extIdx+1); } + - rename: + field: winlog.event_data.DirectionDescription + target_field: network.direction + ignore_missing: true + - lowercase: + field: network.direction + ignore_missing: true + - community_id: + ignore_missing: true + ignore_failure: true + on_failure: - set: field: error.message diff --git a/packages/system/data_stream/security/fields/ecs.yml b/packages/system/data_stream/security/fields/ecs.yml index db2b6257c89..22dcfb54433 100644 --- a/packages/system/data_stream/security/fields/ecs.yml +++ b/packages/system/data_stream/security/fields/ecs.yml @@ -1,3 +1,7 @@ +- external: ecs + name: destination.ip +- external: ecs + name: destination.port - external: ecs name: ecs.version - external: ecs @@ -38,6 +42,14 @@ name: log.level - external: ecs name: message +- external: ecs + name: network.community_id +- external: ecs + name: network.direction +- external: ecs + name: network.iana_number +- external: ecs + name: network.transport - external: ecs name: process.args - external: ecs diff --git a/packages/system/data_stream/security/fields/winlog.yml b/packages/system/data_stream/security/fields/winlog.yml index e2fe861361a..d875c544dff 100644 --- a/packages/system/data_stream/security/fields/winlog.yml +++ b/packages/system/data_stream/security/fields/winlog.yml @@ -85,6 +85,8 @@ type: keyword - name: AuthenticationPackageName type: keyword + - name: Application + type: keyword - name: Binary type: keyword - name: BitlockerUserInputTime @@ -109,6 +111,8 @@ type: keyword - name: ClientProcessId type: keyword + - name: CurrentProfile + type: keyword - name: CommandLine type: keyword - name: Company @@ -125,6 +129,12 @@ type: keyword - name: Description type: keyword + - name: DestAddress + type: keyword + - name: DestPort + type: keyword + - name: Direction + type: keyword - name: Detail type: keyword - name: DeviceName @@ -173,6 +183,10 @@ type: keyword - name: FileVersion type: keyword + - name: FilterOrigin + type: keyword + - name: FilterRTID + type: keyword - name: FinalStatus type: keyword - name: Flags @@ -181,6 +195,8 @@ type: keyword - name: GroupTypeChange type: keyword + - name: HasRemoteDynamicKeywordAddress + type: keyword - name: HandleId type: keyword - name: HomeDirectory @@ -189,6 +205,8 @@ type: keyword - name: Identity type: keyword + - name: InterfaceIndex + type: keyword - name: IdleImplementation type: keyword - name: IdleStateCount @@ -197,6 +215,8 @@ type: keyword - name: IntegrityLevel type: keyword + - name: IsLoopback + type: keyword - name: IpAddress type: keyword - name: IpPort @@ -205,6 +225,12 @@ type: keyword - name: KeyLength type: keyword + - name: LayerName + type: keyword + - name: LayerNameDescription + type: keyword + - name: LayerRTID + type: keyword - name: LastBootGood type: keyword - name: LastShutdownGood @@ -307,6 +333,8 @@ type: keyword - name: OriginalFileName type: keyword + - name: OriginalProfile + type: keyword - name: PackageName type: keyword - name: PasswordLastSet @@ -333,6 +361,10 @@ type: keyword - name: ProcessId type: keyword + - name: ProcessID + type: keyword + - name: Protocol + type: keyword - name: ProcessName type: keyword - name: ProcessPath @@ -359,6 +391,14 @@ type: keyword - name: ResourceAttributes type: keyword + - name: RemoteMachineID + type: keyword + - name: RemoteMachineDescription + type: keyword + - name: RemoteUserID + type: keyword + - name: RemoteUserDescription + type: keyword - name: ReturnCode type: keyword - name: SamAccountName @@ -445,6 +485,10 @@ type: keyword - name: SubStatus type: keyword + - name: SourceAddress + type: keyword + - name: SourcePort + type: keyword - name: TSId type: keyword - name: TargetDomainName diff --git a/packages/system/data_stream/security/sample_event.json b/packages/system/data_stream/security/sample_event.json index 80d8866cd6a..f5e1eeeb399 100644 --- a/packages/system/data_stream/security/sample_event.json +++ b/packages/system/data_stream/security/sample_event.json @@ -1,8 +1,8 @@ { "@timestamp": "2019-11-07T10:37:04.226Z", "agent": { - "ephemeral_id": "a61c3b83-c6fa-42f5-aa89-7dcbcd22df29", - "id": "b757cc21-a0b3-4107-8936-c7b5ce22c9ce", + "ephemeral_id": "7b61ba2a-a1b9-4711-87d0-1b3aad5afb85", + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.8.0" @@ -16,7 +16,7 @@ "version": "8.0.0" }, "elastic_agent": { - "id": "b757cc21-a0b3-4107-8936-c7b5ce22c9ce", + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", "snapshot": false, "version": "8.8.0" }, @@ -27,9 +27,9 @@ "process" ], "code": "1100", - "created": "2023-06-26T19:07:48.567Z", + "created": "2023-07-18T12:31:50.439Z", "dataset": "system.security", - "ingested": "2023-06-26T19:07:49Z", + "ingested": "2023-07-18T12:31:51Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Eventlog' Guid='{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}'/\u003e\u003cEventID\u003e1100\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e103\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x4020000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-11-07T10:37:04.226092500Z'/\u003e\u003cEventRecordID\u003e14257\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1144' ThreadID='4532'/\u003e\u003cChannel\u003eSecurity\u003c/Channel\u003e\u003cComputer\u003eWIN-41OB2LO92CR.wlbeat.local\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cServiceShutdown xmlns='http://manifests.microsoft.com/win/2004/08/windows/eventlog'\u003e\u003c/ServiceShutdown\u003e\u003c/UserData\u003e\u003c/Event\u003e", "outcome": "success", diff --git a/packages/system/data_stream/syslog/manifest.yml b/packages/system/data_stream/syslog/manifest.yml index 5dd7e3f5fac..c5605778f02 100644 --- a/packages/system/data_stream/syslog/manifest.yml +++ b/packages/system/data_stream/syslog/manifest.yml @@ -45,6 +45,3 @@ streams: template_path: log.yml.hbs title: System syslog logs (log) description: Collect System syslog logs using log input -# Ensures agents have permissions to write data to `logs-*-*` -elasticsearch.dynamic_dataset: true -elasticsearch.dynamic_namespace: true diff --git a/packages/system/data_stream/system/fields/ecs.yml b/packages/system/data_stream/system/fields/ecs.yml index 7abb6419d34..182c7f7302e 100644 --- a/packages/system/data_stream/system/fields/ecs.yml +++ b/packages/system/data_stream/system/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: error.message +- external: ecs + name: error.code - external: ecs name: event.action - external: ecs diff --git a/packages/system/docs/README.md b/packages/system/docs/README.md index 04e5514e82a..654dc2dcfa0 100644 --- a/packages/system/docs/README.md +++ b/packages/system/docs/README.md @@ -114,6 +114,7 @@ The Windows `application` data stream provides events from the Windows | data_stream.dataset | Data stream dataset. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | +| error.code | Error code describing the error. | keyword | | error.message | Error message. | match_only_text | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | @@ -303,6 +304,7 @@ event log. | data_stream.dataset | Data stream dataset. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | +| error.code | Error code describing the error. | keyword | | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | @@ -485,8 +487,8 @@ An example event for `security` looks as following: { "@timestamp": "2019-11-07T10:37:04.226Z", "agent": { - "ephemeral_id": "a61c3b83-c6fa-42f5-aa89-7dcbcd22df29", - "id": "b757cc21-a0b3-4107-8936-c7b5ce22c9ce", + "ephemeral_id": "7b61ba2a-a1b9-4711-87d0-1b3aad5afb85", + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.8.0" @@ -500,7 +502,7 @@ An example event for `security` looks as following: "version": "8.0.0" }, "elastic_agent": { - "id": "b757cc21-a0b3-4107-8936-c7b5ce22c9ce", + "id": "a152fcd9-5b11-4ed3-9958-e3a95043132d", "snapshot": false, "version": "8.8.0" }, @@ -511,9 +513,9 @@ An example event for `security` looks as following: "process" ], "code": "1100", - "created": "2023-06-26T19:07:48.567Z", + "created": "2023-07-18T12:31:50.439Z", "dataset": "system.security", - "ingested": "2023-06-26T19:07:49Z", + "ingested": "2023-07-18T12:31:51Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Eventlog' Guid='{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}'/\u003e\u003cEventID\u003e1100\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e103\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x4020000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-11-07T10:37:04.226092500Z'/\u003e\u003cEventRecordID\u003e14257\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1144' ThreadID='4532'/\u003e\u003cChannel\u003eSecurity\u003c/Channel\u003e\u003cComputer\u003eWIN-41OB2LO92CR.wlbeat.local\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cServiceShutdown xmlns='http://manifests.microsoft.com/win/2004/08/windows/eventlog'\u003e\u003c/ServiceShutdown\u003e\u003c/UserData\u003e\u003c/Event\u003e", "outcome": "success", @@ -580,6 +582,8 @@ An example event for `security` looks as following: | data_stream.dataset | Data stream dataset name. | constant_keyword | | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | +| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | +| destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.code | Error code describing the error. | keyword | | error.message | Error message. | match_only_text | @@ -590,7 +594,7 @@ An example event for `security` looks as following: | event.dataset | Event dataset. | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | +| event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -627,6 +631,10 @@ An example event for `security` looks as following: | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | | log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | | message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| network.community_id | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows. Learn more at https://github.com/corelight/community-id-spec. | keyword | +| network.direction | Direction of the network traffic. Recommended values are: \* ingress \* egress \* inbound \* outbound \* internal \* external \* unknown When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | +| network.iana_number | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | keyword | +| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | | process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | | process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | | process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | @@ -701,6 +709,7 @@ An example event for `security` looks as following: | winlog.event_data.AccountExpires | | keyword | | winlog.event_data.AccountName | | keyword | | winlog.event_data.AllowedToDelegateTo | | keyword | +| winlog.event_data.Application | | keyword | | winlog.event_data.AuditPolicyChanges | | keyword | | winlog.event_data.AuditPolicyChangesDescription | | keyword | | winlog.event_data.AuditSourceName | | keyword | @@ -724,13 +733,17 @@ An example event for `security` looks as following: | winlog.event_data.CountOfCredentialsReturned | | keyword | | winlog.event_data.CrashOnAuditFailValue | | keyword | | winlog.event_data.CreationUtcTime | | keyword | +| winlog.event_data.CurrentProfile | | keyword | | winlog.event_data.Description | | keyword | +| winlog.event_data.DestAddress | | keyword | +| winlog.event_data.DestPort | | keyword | | winlog.event_data.Detail | | keyword | | winlog.event_data.DeviceName | | keyword | | winlog.event_data.DeviceNameLength | | keyword | | winlog.event_data.DeviceTime | | keyword | | winlog.event_data.DeviceVersionMajor | | keyword | | winlog.event_data.DeviceVersionMinor | | keyword | +| winlog.event_data.Direction | | keyword | | winlog.event_data.DisplayName | | keyword | | winlog.event_data.DnsHostName | | keyword | | winlog.event_data.DomainBehaviorVersion | | keyword | @@ -749,11 +762,14 @@ An example event for `security` looks as following: | winlog.event_data.FailureNameLength | | keyword | | winlog.event_data.FailureReason | | keyword | | winlog.event_data.FileVersion | | keyword | +| winlog.event_data.FilterOrigin | | keyword | +| winlog.event_data.FilterRTID | | keyword | | winlog.event_data.FinalStatus | | keyword | | winlog.event_data.Flags | | keyword | | winlog.event_data.Group | | keyword | | winlog.event_data.GroupTypeChange | | keyword | | winlog.event_data.HandleId | | keyword | +| winlog.event_data.HasRemoteDynamicKeywordAddress | | keyword | | winlog.event_data.HomeDirectory | | keyword | | winlog.event_data.HomePath | | keyword | | winlog.event_data.Identity | | keyword | @@ -761,12 +777,17 @@ An example event for `security` looks as following: | winlog.event_data.IdleStateCount | | keyword | | winlog.event_data.ImpersonationLevel | | keyword | | winlog.event_data.IntegrityLevel | | keyword | +| winlog.event_data.InterfaceIndex | | keyword | | winlog.event_data.IpAddress | | keyword | | winlog.event_data.IpPort | | keyword | +| winlog.event_data.IsLoopback | | keyword | | winlog.event_data.KerberosPolicyChange | | keyword | | winlog.event_data.KeyLength | | keyword | | winlog.event_data.LastBootGood | | keyword | | winlog.event_data.LastShutdownGood | | keyword | +| winlog.event_data.LayerName | | keyword | +| winlog.event_data.LayerNameDescription | | keyword | +| winlog.event_data.LayerRTID | | keyword | | winlog.event_data.LmPackageName | | keyword | | winlog.event_data.LogonGuid | | keyword | | winlog.event_data.LogonHours | | keyword | @@ -816,6 +837,7 @@ An example event for `security` looks as following: | winlog.event_data.OldTime | | keyword | | winlog.event_data.OldUacValue | | keyword | | winlog.event_data.OriginalFileName | | keyword | +| winlog.event_data.OriginalProfile | | keyword | | winlog.event_data.PackageName | | keyword | | winlog.event_data.ParentProcessName | | keyword | | winlog.event_data.PasswordHistoryLength | | keyword | @@ -828,18 +850,24 @@ An example event for `security` looks as following: | winlog.event_data.PrimaryGroupId | | keyword | | winlog.event_data.PrivilegeList | | keyword | | winlog.event_data.ProcessCreationTime | | keyword | +| winlog.event_data.ProcessID | | keyword | | winlog.event_data.ProcessId | | keyword | | winlog.event_data.ProcessName | | keyword | | winlog.event_data.ProcessPath | | keyword | | winlog.event_data.ProcessPid | | keyword | | winlog.event_data.Product | | keyword | | winlog.event_data.ProfilePath | | keyword | +| winlog.event_data.Protocol | | keyword | | winlog.event_data.PuaCount | | keyword | | winlog.event_data.PuaPolicyId | | keyword | | winlog.event_data.QfeVersion | | keyword | | winlog.event_data.ReadOperation | | keyword | | winlog.event_data.Reason | | keyword | | winlog.event_data.RelativeTargetName | | keyword | +| winlog.event_data.RemoteMachineDescription | | keyword | +| winlog.event_data.RemoteMachineID | | keyword | +| winlog.event_data.RemoteUserDescription | | keyword | +| winlog.event_data.RemoteUserID | | keyword | | winlog.event_data.Resource | | keyword | | winlog.event_data.ResourceAttributes | | keyword | | winlog.event_data.ReturnCode | | keyword | @@ -870,6 +898,8 @@ An example event for `security` looks as following: | winlog.event_data.Signature | | keyword | | winlog.event_data.SignatureStatus | | keyword | | winlog.event_data.Signed | | keyword | +| winlog.event_data.SourceAddress | | keyword | +| winlog.event_data.SourcePort | | keyword | | winlog.event_data.StartTime | | keyword | | winlog.event_data.State | | keyword | | winlog.event_data.Status | | keyword | @@ -1347,13 +1377,13 @@ This data should be available without elevated permissions. | host | A host is defined as a general computing instance. ECS host.\* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes. | group | | | | host.architecture | Operating system architecture. | keyword | | | | host.containerized | If the host is a container. | boolean | | | -| host.disk.read.bytes | The total number of bytes read successfully in a given period of time. | long | | | -| host.disk.write.bytes | The total number of bytes write successfully in a given period of time. | long | | | +| host.disk.read.bytes | The total number of bytes read successfully in a given period of time. | long | byte | gauge | +| host.disk.write.bytes | The total number of bytes write successfully in a given period of time. | long | byte | gauge | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | | | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | | | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | | | host.ip | Host ip addresses. | ip | | | -| host.mac | Host mac addresses. | keyword | | | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | | | host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | | | host.os.build | OS build information. | keyword | | | | host.os.codename | OS codename, if any. | keyword | | | @@ -1864,118 +1894,118 @@ If running as less privileged user, it may not be able to read process data belo | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | | | system.process.cgroup.blkio.id | ID of the cgroup. | keyword | | | | system.process.cgroup.blkio.path | Path to the cgroup relative to the cgroup subsystems mountpoint. | keyword | | | -| system.process.cgroup.blkio.total.bytes | Total number of bytes transferred to and from all block devices by processes in the cgroup. | long | | | -| system.process.cgroup.blkio.total.ios | Total number of I/O operations performed on all devices by processes in the cgroup as seen by the throttling policy. | long | | | +| system.process.cgroup.blkio.total.bytes | Total number of bytes transferred to and from all block devices by processes in the cgroup. | long | | counter | +| system.process.cgroup.blkio.total.ios | Total number of I/O operations performed on all devices by processes in the cgroup as seen by the throttling policy. | long | | counter | | system.process.cgroup.cgroups_version | The version of cgroups reported for the process | long | | | -| system.process.cgroup.cpu.cfs.period.us | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. | long | | | -| system.process.cgroup.cpu.cfs.quota.us | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). | long | | | -| system.process.cgroup.cpu.cfs.shares | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. | long | | | +| system.process.cgroup.cpu.cfs.period.us | Period of time in microseconds for how regularly a cgroup's access to CPU resources should be reallocated. | long | | gauge | +| system.process.cgroup.cpu.cfs.quota.us | Total amount of time in microseconds for which all tasks in a cgroup can run during one period (as defined by cfs.period.us). | long | | gauge | +| system.process.cgroup.cpu.cfs.shares | An integer value that specifies a relative share of CPU time available to the tasks in a cgroup. The value specified in the cpu.shares file must be 2 or higher. | long | | gauge | | system.process.cgroup.cpu.id | ID of the cgroup. | keyword | | | | system.process.cgroup.cpu.path | Path to the cgroup relative to the cgroup subsystem's mountpoint. | keyword | | | -| system.process.cgroup.cpu.pressure.full.10.pct | Pressure over 10 seconds | float | | | -| system.process.cgroup.cpu.pressure.full.300.pct | Pressure over 300 seconds | float | | | -| system.process.cgroup.cpu.pressure.full.60.pct | Pressure over 60 seconds | float | | | -| system.process.cgroup.cpu.pressure.full.total | total Full pressure time | long | | | -| system.process.cgroup.cpu.pressure.some.10.pct | Pressure over 10 seconds | float | | | -| system.process.cgroup.cpu.pressure.some.300.pct | Pressure over 300 seconds | float | | | -| system.process.cgroup.cpu.pressure.some.60.pct | Pressure over 60 seconds | float | | | -| system.process.cgroup.cpu.pressure.some.total | total Some pressure time | long | | | -| system.process.cgroup.cpu.rt.period.us | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. | long | | | -| system.process.cgroup.cpu.rt.runtime.us | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. | long | | | -| system.process.cgroup.cpu.stats.periods | Number of period intervals (as specified in cpu.cfs.period.us) that have elapsed. | long | | | -| system.process.cgroup.cpu.stats.system.norm.pct | cgroups v2 normalized system time | float | | | -| system.process.cgroup.cpu.stats.system.ns | cgroups v2 system time in nanoseconds | long | | | -| system.process.cgroup.cpu.stats.system.pct | cgroups v2 system time | float | | | -| system.process.cgroup.cpu.stats.throttled.ns | The total time duration (in nanoseconds) for which tasks in a cgroup have been throttled. | long | | | -| system.process.cgroup.cpu.stats.throttled.periods | Number of times tasks in a cgroup have been throttled (that is, not allowed to run because they have exhausted all of the available time as specified by their quota). | long | | | -| system.process.cgroup.cpu.stats.throttled.us | The total time duration (in microseconds) for which tasks in a cgroup have been throttled, as reported by cgroupsv2 | long | | | -| system.process.cgroup.cpu.stats.usage.norm.pct | cgroups v2 normalized usage | float | | | -| system.process.cgroup.cpu.stats.usage.ns | cgroups v2 usage in nanoseconds | long | | | -| system.process.cgroup.cpu.stats.usage.pct | cgroups v2 usage | float | | | -| system.process.cgroup.cpu.stats.user.norm.pct | cgroups v2 normalized cpu user time | float | | | -| system.process.cgroup.cpu.stats.user.ns | cgroups v2 cpu user time in nanoseconds | long | | | -| system.process.cgroup.cpu.stats.user.pct | cgroups v2 cpu user time | float | | | +| system.process.cgroup.cpu.pressure.full.10.pct | Pressure over 10 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.full.300.pct | Pressure over 300 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.full.60.pct | Pressure over 60 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.full.total | total Full pressure time | long | | counter | +| system.process.cgroup.cpu.pressure.some.10.pct | Pressure over 10 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.some.300.pct | Pressure over 300 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.some.60.pct | Pressure over 60 seconds | float | | gauge | +| system.process.cgroup.cpu.pressure.some.total | total Some pressure time | long | | counter | +| system.process.cgroup.cpu.rt.period.us | Period of time in microseconds for how regularly a cgroup's access to CPU resources is reallocated. | long | | gauge | +| system.process.cgroup.cpu.rt.runtime.us | Period of time in microseconds for the longest continuous period in which the tasks in a cgroup have access to CPU resources. | long | | gauge | +| system.process.cgroup.cpu.stats.periods | Number of period intervals (as specified in cpu.cfs.period.us) that have elapsed. | long | | counter | +| system.process.cgroup.cpu.stats.system.norm.pct | cgroups v2 normalized system time | float | | gauge | +| system.process.cgroup.cpu.stats.system.ns | cgroups v2 system time in nanoseconds | long | | counter | +| system.process.cgroup.cpu.stats.system.pct | cgroups v2 system time | float | | gauge | +| system.process.cgroup.cpu.stats.throttled.ns | The total time duration (in nanoseconds) for which tasks in a cgroup have been throttled. | long | | counter | +| system.process.cgroup.cpu.stats.throttled.periods | Number of times tasks in a cgroup have been throttled (that is, not allowed to run because they have exhausted all of the available time as specified by their quota). | long | | counter | +| system.process.cgroup.cpu.stats.throttled.us | The total time duration (in microseconds) for which tasks in a cgroup have been throttled, as reported by cgroupsv2 | long | | counter | +| system.process.cgroup.cpu.stats.usage.norm.pct | cgroups v2 normalized usage | float | | gauge | +| system.process.cgroup.cpu.stats.usage.ns | cgroups v2 usage in nanoseconds | long | | counter | +| system.process.cgroup.cpu.stats.usage.pct | cgroups v2 usage | float | | gauge | +| system.process.cgroup.cpu.stats.user.norm.pct | cgroups v2 normalized cpu user time | float | | gauge | +| system.process.cgroup.cpu.stats.user.ns | cgroups v2 cpu user time in nanoseconds | long | | counter | +| system.process.cgroup.cpu.stats.user.pct | cgroups v2 cpu user time | float | | gauge | | system.process.cgroup.cpuacct.id | ID of the cgroup. | keyword | | | | system.process.cgroup.cpuacct.path | Path to the cgroup relative to the cgroup subsystem's mountpoint. | keyword | | | | system.process.cgroup.cpuacct.percpu | CPU time (in nanoseconds) consumed on each CPU by all tasks in this cgroup. | object | | | -| system.process.cgroup.cpuacct.stats.system.norm.pct | Time the cgroup spent in kernel space, as a percentage of total CPU time, normalized by CPU count. | scaled_float | | | -| system.process.cgroup.cpuacct.stats.system.ns | CPU time consumed by tasks in user (kernel) mode. | long | | | -| system.process.cgroup.cpuacct.stats.system.pct | Time the cgroup spent in kernel space, as a percentage of total CPU time | scaled_float | | | -| system.process.cgroup.cpuacct.stats.user.norm.pct | time the cgroup spent in user space, as a percentage of total CPU time, normalized by CPU count. | scaled_float | | | -| system.process.cgroup.cpuacct.stats.user.ns | CPU time consumed by tasks in user mode. | long | | | -| system.process.cgroup.cpuacct.stats.user.pct | time the cgroup spent in user space, as a percentage of total CPU time | scaled_float | | | -| system.process.cgroup.cpuacct.total.norm.pct | CPU time of the cgroup as a percentage of overall CPU time, normalized by CPU count. This is functionally an average of time spent across individual CPUs. | scaled_float | | | -| system.process.cgroup.cpuacct.total.ns | Total CPU time in nanoseconds consumed by all tasks in the cgroup. | long | | | -| system.process.cgroup.cpuacct.total.pct | CPU time of the cgroup as a percentage of overall CPU time. | scaled_float | | | +| system.process.cgroup.cpuacct.stats.system.norm.pct | Time the cgroup spent in kernel space, as a percentage of total CPU time, normalized by CPU count. | scaled_float | | gauge | +| system.process.cgroup.cpuacct.stats.system.ns | CPU time consumed by tasks in user (kernel) mode. | long | | counter | +| system.process.cgroup.cpuacct.stats.system.pct | Time the cgroup spent in kernel space, as a percentage of total CPU time | scaled_float | | gauge | +| system.process.cgroup.cpuacct.stats.user.norm.pct | time the cgroup spent in user space, as a percentage of total CPU time, normalized by CPU count. | scaled_float | | gauge | +| system.process.cgroup.cpuacct.stats.user.ns | CPU time consumed by tasks in user mode. | long | | counter | +| system.process.cgroup.cpuacct.stats.user.pct | time the cgroup spent in user space, as a percentage of total CPU time | scaled_float | | gauge | +| system.process.cgroup.cpuacct.total.norm.pct | CPU time of the cgroup as a percentage of overall CPU time, normalized by CPU count. This is functionally an average of time spent across individual CPUs. | scaled_float | | gauge | +| system.process.cgroup.cpuacct.total.ns | Total CPU time in nanoseconds consumed by all tasks in the cgroup. | long | | counter | +| system.process.cgroup.cpuacct.total.pct | CPU time of the cgroup as a percentage of overall CPU time. | scaled_float | | gauge | | system.process.cgroup.id | The ID common to all cgroups associated with this task. If there isn't a common ID used by all cgroups this field will be absent. | keyword | | | | system.process.cgroup.io.id | ID of the cgroup. | keyword | | | | system.process.cgroup.io.path | Path to the cgroup relative to the cgroup subsystems mountpoint. | keyword | | | -| system.process.cgroup.io.pressure.full.10.pct | Pressure over 10 seconds | float | | | -| system.process.cgroup.io.pressure.full.300.pct | Pressure over 300 seconds | float | | | -| system.process.cgroup.io.pressure.full.60.pct | Pressure over 60 seconds | float | | | -| system.process.cgroup.io.pressure.full.total | total Some pressure time | long | | | -| system.process.cgroup.io.pressure.some.10.pct | Pressure over 10 seconds | float | | | -| system.process.cgroup.io.pressure.some.300.pct | Pressure over 300 seconds | float | | | -| system.process.cgroup.io.pressure.some.60.pct | Pressure over 60 seconds | float | | | -| system.process.cgroup.io.pressure.some.total | total Some pressure time | long | | | +| system.process.cgroup.io.pressure.full.10.pct | Pressure over 10 seconds | float | | gauge | +| system.process.cgroup.io.pressure.full.300.pct | Pressure over 300 seconds | float | | gauge | +| system.process.cgroup.io.pressure.full.60.pct | Pressure over 60 seconds | float | | gauge | +| system.process.cgroup.io.pressure.full.total | total Some pressure time | long | | counter | +| system.process.cgroup.io.pressure.some.10.pct | Pressure over 10 seconds | float | | gauge | +| system.process.cgroup.io.pressure.some.300.pct | Pressure over 300 seconds | float | | gauge | +| system.process.cgroup.io.pressure.some.60.pct | Pressure over 60 seconds | float | | gauge | +| system.process.cgroup.io.pressure.some.total | total Some pressure time | long | | counter | | system.process.cgroup.io.stats.\* | per-device IO usage stats | object | | | | system.process.cgroup.io.stats.\*.\* | | object | | | | system.process.cgroup.io.stats.\*.\*.bytes | per-device IO usage stats | object | | | | system.process.cgroup.io.stats.\*.\*.ios | per-device IO usage stats | object | | | | system.process.cgroup.memory.id | ID of the cgroup. | keyword | | | -| system.process.cgroup.memory.kmem.failures | The number of times that the memory limit (kmem.limit.bytes) was reached. | long | | | -| system.process.cgroup.memory.kmem.limit.bytes | The maximum amount of kernel memory that tasks in the cgroup are allowed to use. | long | | | -| system.process.cgroup.memory.kmem.usage.bytes | Total kernel memory usage by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.kmem.usage.max.bytes | The maximum kernel memory used by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.kmem_tcp.failures | The number of times that the memory limit (kmem_tcp.limit.bytes) was reached. | long | | | -| system.process.cgroup.memory.kmem_tcp.limit.bytes | The maximum amount of memory for TCP buffers that tasks in the cgroup are allowed to use. | long | | | -| system.process.cgroup.memory.kmem_tcp.usage.bytes | Total memory usage for TCP buffers in bytes. | long | | | -| system.process.cgroup.memory.kmem_tcp.usage.max.bytes | The maximum memory used for TCP buffers by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.mem.events.fail | failed threshold | long | | | -| system.process.cgroup.memory.mem.events.high | high threshold | long | | | -| system.process.cgroup.memory.mem.events.low | low threshold | long | | | -| system.process.cgroup.memory.mem.events.max | max threshold | long | | | -| system.process.cgroup.memory.mem.events.oom | oom threshold | long | | | -| system.process.cgroup.memory.mem.events.oom_kill | oom killer threshold | long | | | -| system.process.cgroup.memory.mem.failures | The number of times that the memory limit (mem.limit.bytes) was reached. | long | | | -| system.process.cgroup.memory.mem.high.bytes | memory high threshhold | long | | | -| system.process.cgroup.memory.mem.limit.bytes | The maximum amount of user memory in bytes (including file cache) that tasks in the cgroup are allowed to use. | long | | | -| system.process.cgroup.memory.mem.low.bytes | memory low threshhold | long | | | -| system.process.cgroup.memory.mem.max.bytes | memory max threshhold | long | | | -| system.process.cgroup.memory.mem.usage.bytes | Total memory usage by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.mem.usage.max.bytes | The maximum memory used by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.memsw.events.fail | failed threshold | long | | | -| system.process.cgroup.memory.memsw.events.high | high threshold | long | | | -| system.process.cgroup.memory.memsw.events.low | low threshold | long | | | -| system.process.cgroup.memory.memsw.events.max | max threshold | long | | | -| system.process.cgroup.memory.memsw.events.oom | oom threshold | long | | | -| system.process.cgroup.memory.memsw.events.oom_kill | oom killer threshold | long | | | -| system.process.cgroup.memory.memsw.failures | The number of times that the memory plus swap space limit (memsw.limit.bytes) was reached. | long | | | -| system.process.cgroup.memory.memsw.high.bytes | memory high threshhold | long | | | -| system.process.cgroup.memory.memsw.limit.bytes | The maximum amount for the sum of memory and swap usage that tasks in the cgroup are allowed to use. | long | | | -| system.process.cgroup.memory.memsw.low.bytes | memory low threshhold | long | | | -| system.process.cgroup.memory.memsw.max.bytes | memory max threshhold | long | | | -| system.process.cgroup.memory.memsw.usage.bytes | The sum of current memory usage plus swap space used by processes in the cgroup (in bytes). | long | | | -| system.process.cgroup.memory.memsw.usage.max.bytes | The maximum amount of memory and swap space used by processes in the cgroup (in bytes). | long | | | +| system.process.cgroup.memory.kmem.failures | The number of times that the memory limit (kmem.limit.bytes) was reached. | long | | counter | +| system.process.cgroup.memory.kmem.limit.bytes | The maximum amount of kernel memory that tasks in the cgroup are allowed to use. | long | | gauge | +| system.process.cgroup.memory.kmem.usage.bytes | Total kernel memory usage by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.kmem.usage.max.bytes | The maximum kernel memory used by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.kmem_tcp.failures | The number of times that the memory limit (kmem_tcp.limit.bytes) was reached. | long | | counter | +| system.process.cgroup.memory.kmem_tcp.limit.bytes | The maximum amount of memory for TCP buffers that tasks in the cgroup are allowed to use. | long | | gauge | +| system.process.cgroup.memory.kmem_tcp.usage.bytes | Total memory usage for TCP buffers in bytes. | long | | gauge | +| system.process.cgroup.memory.kmem_tcp.usage.max.bytes | The maximum memory used for TCP buffers by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.mem.events.fail | failed threshold | long | | counter | +| system.process.cgroup.memory.mem.events.high | high threshold | long | | counter | +| system.process.cgroup.memory.mem.events.low | low threshold | long | | counter | +| system.process.cgroup.memory.mem.events.max | max threshold | long | | counter | +| system.process.cgroup.memory.mem.events.oom | oom threshold | long | | counter | +| system.process.cgroup.memory.mem.events.oom_kill | oom killer threshold | long | | counter | +| system.process.cgroup.memory.mem.failures | The number of times that the memory limit (mem.limit.bytes) was reached. | long | | counter | +| system.process.cgroup.memory.mem.high.bytes | memory high threshhold | long | | gauge | +| system.process.cgroup.memory.mem.limit.bytes | The maximum amount of user memory in bytes (including file cache) that tasks in the cgroup are allowed to use. | long | | gauge | +| system.process.cgroup.memory.mem.low.bytes | memory low threshhold | long | | gauge | +| system.process.cgroup.memory.mem.max.bytes | memory max threshhold | long | | gauge | +| system.process.cgroup.memory.mem.usage.bytes | Total memory usage by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.mem.usage.max.bytes | The maximum memory used by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.memsw.events.fail | failed threshold | long | | counter | +| system.process.cgroup.memory.memsw.events.high | high threshold | long | | counter | +| system.process.cgroup.memory.memsw.events.low | low threshold | long | | counter | +| system.process.cgroup.memory.memsw.events.max | max threshold | long | | counter | +| system.process.cgroup.memory.memsw.events.oom | oom threshold | long | | counter | +| system.process.cgroup.memory.memsw.events.oom_kill | oom killer threshold | long | | counter | +| system.process.cgroup.memory.memsw.failures | The number of times that the memory plus swap space limit (memsw.limit.bytes) was reached. | long | | counter | +| system.process.cgroup.memory.memsw.high.bytes | memory high threshhold | long | | gauge | +| system.process.cgroup.memory.memsw.limit.bytes | The maximum amount for the sum of memory and swap usage that tasks in the cgroup are allowed to use. | long | | gauge | +| system.process.cgroup.memory.memsw.low.bytes | memory low threshhold | long | | gauge | +| system.process.cgroup.memory.memsw.max.bytes | memory max threshhold | long | | gauge | +| system.process.cgroup.memory.memsw.usage.bytes | The sum of current memory usage plus swap space used by processes in the cgroup (in bytes). | long | | gauge | +| system.process.cgroup.memory.memsw.usage.max.bytes | The maximum amount of memory and swap space used by processes in the cgroup (in bytes). | long | | gauge | | system.process.cgroup.memory.path | Path to the cgroup relative to the cgroup subsystem's mountpoint. | keyword | | | | system.process.cgroup.memory.stats.\* | detailed memory IO stats | object | | | | system.process.cgroup.memory.stats.\*.bytes | detailed memory IO stats | object | | | -| system.process.cgroup.memory.stats.active_anon.bytes | Anonymous and swap cache on active least-recently-used (LRU) list, including tmpfs (shmem), in bytes. | long | | | -| system.process.cgroup.memory.stats.active_file.bytes | File-backed memory on active LRU list, in bytes. | long | | | -| system.process.cgroup.memory.stats.cache.bytes | Page cache, including tmpfs (shmem), in bytes. | long | | | -| system.process.cgroup.memory.stats.hierarchical_memory_limit.bytes | Memory limit for the hierarchy that contains the memory cgroup, in bytes. | long | | | -| system.process.cgroup.memory.stats.hierarchical_memsw_limit.bytes | Memory plus swap limit for the hierarchy that contains the memory cgroup, in bytes. | long | | | -| system.process.cgroup.memory.stats.inactive_anon.bytes | Anonymous and swap cache on inactive LRU list, including tmpfs (shmem), in bytes | long | | | -| system.process.cgroup.memory.stats.inactive_file.bytes | File-backed memory on inactive LRU list, in bytes. | long | | | -| system.process.cgroup.memory.stats.major_page_faults | Number of times that a process in the cgroup triggered a major fault. "Major" faults happen when the kernel actually has to read the data from disk. | long | | | -| system.process.cgroup.memory.stats.mapped_file.bytes | Size of memory-mapped mapped files, including tmpfs (shmem), in bytes. | long | | | -| system.process.cgroup.memory.stats.page_faults | Number of times that a process in the cgroup triggered a page fault. | long | | | -| system.process.cgroup.memory.stats.pages_in | Number of pages paged into memory. This is a counter. | long | | | -| system.process.cgroup.memory.stats.pages_out | Number of pages paged out of memory. This is a counter. | long | | | -| system.process.cgroup.memory.stats.rss.bytes | Anonymous and swap cache (includes transparent hugepages), not including tmpfs (shmem), in bytes. | long | | | -| system.process.cgroup.memory.stats.rss_huge.bytes | Number of bytes of anonymous transparent hugepages. | long | | | -| system.process.cgroup.memory.stats.swap.bytes | Swap usage, in bytes. | long | | | -| system.process.cgroup.memory.stats.unevictable.bytes | Memory that cannot be reclaimed, in bytes. | long | | | +| system.process.cgroup.memory.stats.active_anon.bytes | Anonymous and swap cache on active least-recently-used (LRU) list, including tmpfs (shmem), in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.active_file.bytes | File-backed memory on active LRU list, in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.cache.bytes | Page cache, including tmpfs (shmem), in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.hierarchical_memory_limit.bytes | Memory limit for the hierarchy that contains the memory cgroup, in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.hierarchical_memsw_limit.bytes | Memory plus swap limit for the hierarchy that contains the memory cgroup, in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.inactive_anon.bytes | Anonymous and swap cache on inactive LRU list, including tmpfs (shmem), in bytes | long | | gauge | +| system.process.cgroup.memory.stats.inactive_file.bytes | File-backed memory on inactive LRU list, in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.major_page_faults | Number of times that a process in the cgroup triggered a major fault. "Major" faults happen when the kernel actually has to read the data from disk. | long | | counter | +| system.process.cgroup.memory.stats.mapped_file.bytes | Size of memory-mapped mapped files, including tmpfs (shmem), in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.page_faults | Number of times that a process in the cgroup triggered a page fault. | long | | counter | +| system.process.cgroup.memory.stats.pages_in | Number of pages paged into memory. This is a counter. | long | | counter | +| system.process.cgroup.memory.stats.pages_out | Number of pages paged out of memory. This is a counter. | long | | counter | +| system.process.cgroup.memory.stats.rss.bytes | Anonymous and swap cache (includes transparent hugepages), not including tmpfs (shmem), in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.rss_huge.bytes | Number of bytes of anonymous transparent hugepages. | long | | gauge | +| system.process.cgroup.memory.stats.swap.bytes | Swap usage, in bytes. | long | | gauge | +| system.process.cgroup.memory.stats.unevictable.bytes | Memory that cannot be reclaimed, in bytes. | long | | gauge | | system.process.cgroup.path | The path to the cgroup relative to the cgroup subsystem's mountpoint. If there isn't a common path used by all cgroups this field will be absent. | keyword | | | | system.process.cmdline | The full command-line used to start the process, including the arguments separated by space. | keyword | | | | system.process.cpu.start_time | The time when the process was started. | date | | | diff --git a/packages/system/kibana/dashboard/system-bb858830-f412-11e9-8405-516218e3d268.json b/packages/system/kibana/dashboard/system-bb858830-f412-11e9-8405-516218e3d268.json index 9146a205bc8..656c57612a9 100644 --- a/packages/system/kibana/dashboard/system-bb858830-f412-11e9-8405-516218e3d268.json +++ b/packages/system/kibana/dashboard/system-bb858830-f412-11e9-8405-516218e3d268.json @@ -3948,7 +3948,7 @@ "dataType": "number", "filter": { "language": "kuery", - "query": "event.code:4731 OR event.code:4727 OR event.code:\"4754\" OR event.code:\"4749\" OR event.code:\"4759\" OR event.code:\"4744\" OR event.code:\"4783\" OR event.code:\"4790\"" + "query": "event.code:4732 OR event.code:4728 OR event.code:\"4756\" OR event.code:\"4751\" OR event.code:\"4761\" OR event.code:\"4746\" OR event.code:\"4785\" OR event.code:\"4787\"" }, "isBucketed": false, "label": "Users Added to Group", diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml index fd67e526032..59ccdaf97d6 100644 --- a/packages/system/manifest.yml +++ b/packages/system/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: system title: System -version: 1.35.0 +version: 1.38.2 license: basic description: Collect system logs and metrics from your servers with Elastic Agent. type: integration diff --git a/packages/system_audit/_dev/build/build.yml b/packages/system_audit/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/system_audit/_dev/build/build.yml +++ b/packages/system_audit/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/system_audit/changelog.yml b/packages/system_audit/changelog.yml index a217d7003c1..6b5d5d9f47c 100644 --- a/packages/system_audit/changelog.yml +++ b/packages/system_audit/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.8.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.7.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.6.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.5.1" + changes: + - description: Fix processor UI handling. + type: bugfix + link: https://github.com/elastic/integrations/pull/7104 +- version: "1.5.0" + changes: + - description: Convert dashboards to Lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6894 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-dpkg.json-expected.json b/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-dpkg.json-expected.json index 2a91d1bf9e9..287696f182e 100644 --- a/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-dpkg.json-expected.json +++ b/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-dpkg.json-expected.json @@ -10,7 +10,7 @@ "version": "8.5.1" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "1fbd99b1-3367-4109-826b-07c8a7e01f6b", diff --git a/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-homebrew.json-expected.json b/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-homebrew.json-expected.json index d18c705b02e..0884942cbc7 100644 --- a/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-homebrew.json-expected.json +++ b/packages/system_audit/data_stream/package/_dev/test/pipeline/test-system-package-homebrew.json-expected.json @@ -10,7 +10,7 @@ "version": "8.7.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "existing_package", diff --git a/packages/system_audit/data_stream/package/_dev/test/system/test-syetem-package-config.yml b/packages/system_audit/data_stream/package/_dev/test/system/test-syetem-package-config.yml deleted file mode 100644 index 09703a06066..00000000000 --- a/packages/system_audit/data_stream/package/_dev/test/system/test-syetem-package-config.yml +++ /dev/null @@ -1,8 +0,0 @@ -service: system_audit -input: audit/system -data_stream: - vars: - datasets: - - package - period: 1m - state_period: 1m diff --git a/packages/system_audit/data_stream/package/_dev/test/system/test-system-package-config.yml b/packages/system_audit/data_stream/package/_dev/test/system/test-system-package-config.yml new file mode 100644 index 00000000000..650012ed828 --- /dev/null +++ b/packages/system_audit/data_stream/package/_dev/test/system/test-system-package-config.yml @@ -0,0 +1,10 @@ +service: system_audit +input: audit/system +data_stream: + vars: + datasets: + - package + period: 1m + state_period: 1m + processors: |- + - add_locale: ~ diff --git a/packages/system_audit/data_stream/package/agent/stream/package.yml.hbs b/packages/system_audit/data_stream/package/agent/stream/package.yml.hbs index a7ccde3067b..6693ee95c43 100644 --- a/packages/system_audit/data_stream/package/agent/stream/package.yml.hbs +++ b/packages/system_audit/data_stream/package/agent/stream/package.yml.hbs @@ -1,7 +1,7 @@ type: audit/system datasets: - - package +- package {{#if period}} period: {{period}} {{/if}} @@ -14,14 +14,14 @@ pipeline: {{pipeline}} {{#if tags}} tags: {{#each tags as |tag|}} - - {{tag}} +- {{tag}} {{/each}} {{/if}} {{#contains "forwarded" tags}} publisher_pipeline.disable_host: true {{/contains}} processors: - - add_host_metadata: ~ +- add_host_metadata: ~ {{#if processors.length}} {{processors}} {{/if}} \ No newline at end of file diff --git a/packages/system_audit/data_stream/package/elasticsearch/ingest_pipeline/default.yml b/packages/system_audit/data_stream/package/elasticsearch/ingest_pipeline/default.yml index 1ab36489d59..ee38fc0f62c 100644 --- a/packages/system_audit/data_stream/package/elasticsearch/ingest_pipeline/default.yml +++ b/packages/system_audit/data_stream/package/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for parsing System Audit - Package logs processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.dataset value: system_audit.package diff --git a/packages/system_audit/data_stream/package/sample_event.json b/packages/system_audit/data_stream/package/sample_event.json index 9d95203fc8c..b5ef88b9d2e 100644 --- a/packages/system_audit/data_stream/package/sample_event.json +++ b/packages/system_audit/data_stream/package/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "027bc354-85a6-40d6-be9d-7eb4533fbd18", diff --git a/packages/system_audit/docs/README.md b/packages/system_audit/docs/README.md index d689aa24725..db66f652bc9 100644 --- a/packages/system_audit/docs/README.md +++ b/packages/system_audit/docs/README.md @@ -130,7 +130,7 @@ An example event for `package` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "027bc354-85a6-40d6-be9d-7eb4533fbd18", diff --git a/packages/system_audit/img/system-audit-overview-dashboard.png b/packages/system_audit/img/system-audit-overview-dashboard.png index 7aad7201542..49f236e263f 100644 Binary files a/packages/system_audit/img/system-audit-overview-dashboard.png and b/packages/system_audit/img/system-audit-overview-dashboard.png differ diff --git a/packages/system_audit/img/system-audit-package-dashboard.png b/packages/system_audit/img/system-audit-package-dashboard.png index 575894259cb..6d6241eda7a 100644 Binary files a/packages/system_audit/img/system-audit-package-dashboard.png and b/packages/system_audit/img/system-audit-package-dashboard.png differ diff --git a/packages/system_audit/kibana/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c.json index 877a3e75cdf..3baec194743 100644 --- a/packages/system_audit/kibana/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c.json +++ b/packages/system_audit/kibana/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c.json @@ -1,7 +1,6 @@ { "attributes": { "description": "System Packages", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -12,8 +11,10 @@ } }, "optionsJSON": { - "darkTheme": false, "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -21,183 +22,1162 @@ "embeddableConfig": { "enhancements": {} }, + "gridData": { + "h": 26, + "i": "7", + "w": 48, + "x": 0, + "y": 25 + }, + "panelIndex": "7", + "panelRefName": "panel_7", + "type": "search", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "**Dashboards**: [System Overview](#/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90) | **[Packages](#/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c)**", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, "gridData": { "h": 4, - "i": "1", + "i": "bf77ed0a-b695-4aad-8c25-9c12d11902f0", "w": 48, "x": 0, "y": 0 }, - "panelIndex": "1", - "panelRefName": "panel_1", + "panelIndex": "bf77ed0a-b695-4aad-8c25-9c12d11902f0", + "title": "Dashboard Links [System Audit]", "type": "visualization", - "version": "7.3.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-896b1e33-da2b-4061-8e10-368b768ef941", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "597bfe15-829e-4ebf-ae71-decd9d475b70", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "896b1e33-da2b-4061-8e10-368b768ef941": { + "columnOrder": [ + "8d834a76-8578-437f-ae51-23bb2169771f", + "8d834a76-8578-437f-ae51-23bb2169771fX0", + "8d834a76-8578-437f-ae51-23bb2169771fX1" + ], + "columns": { + "8d834a76-8578-437f-ae51-23bb2169771f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packages", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(system_audit.package.entity_id), 0)", + "isFormulaBroken": false + }, + "references": [ + "8d834a76-8578-437f-ae51-23bb2169771fX1" + ], + "scale": "ratio" + }, + "8d834a76-8578-437f-ae51-23bb2169771fX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Packages", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "system_audit.package.entity_id" + }, + "8d834a76-8578-437f-ae51-23bb2169771fX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Packages", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "8d834a76-8578-437f-ae51-23bb2169771fX0", + 0 + ], + "location": { + "max": 57, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(system_audit.package.entity_id), 0)", + "type": "function" + } + }, + "references": [ + "8d834a76-8578-437f-ae51-23bb2169771fX0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "597bfe15-829e-4ebf-ae71-decd9d475b70", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "896b1e33-da2b-4061-8e10-368b768ef941", + "layerType": "data", + "metricAccessor": "8d834a76-8578-437f-ae51-23bb2169771f" + } + }, + "title": "Package Count [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "2", + "i": "1d014398-cca8-4861-a331-a84a122dd37e", "w": 6, "x": 0, "y": 4 }, - "panelIndex": "2", - "panelRefName": "panel_2", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "1d014398-cca8-4861-a331-a84a122dd37e", + "title": "Package Count [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5b97e38-c48a-447d-9685-8293736b3335", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fc4ab5bf-f1d0-4e84-b05d-2f5d5292ae8c", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4582710c-1f7e-4e4c-b44b-21ba64241753", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "b5b97e38-c48a-447d-9685-8293736b3335": { + "columnOrder": [ + "bb27d5b3-1392-4f58-b3e7-dea66de93460", + "bb27d5b3-1392-4f58-b3e7-dea66de93460X0", + "bb27d5b3-1392-4f58-b3e7-dea66de93460X1" + ], + "columns": { + "bb27d5b3-1392-4f58-b3e7-dea66de93460": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Changes", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "bb27d5b3-1392-4f58-b3e7-dea66de93460X1" + ], + "scale": "ratio" + }, + "bb27d5b3-1392-4f58-b3e7-dea66de93460X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Changes", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "bb27d5b3-1392-4f58-b3e7-dea66de93460X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Changes", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "bb27d5b3-1392-4f58-b3e7-dea66de93460X0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "bb27d5b3-1392-4f58-b3e7-dea66de93460X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "fc4ab5bf-f1d0-4e84-b05d-2f5d5292ae8c", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4582710c-1f7e-4e4c-b44b-21ba64241753", + "key": "event.action", + "negate": true, + "params": { + "query": "existing_package", + "type": "phrase" + }, + "type": "phrase", + "value": "existing_package" + }, + "query": { + "match": { + "event.action": { + "query": "existing_package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "b5b97e38-c48a-447d-9685-8293736b3335", + "layerType": "data", + "metricAccessor": "bb27d5b3-1392-4f58-b3e7-dea66de93460" + } + }, + "title": "Package Changes [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "3", + "i": "c93bb2ae-0f02-47a7-879f-07a6b881e6e3", "w": 5, "x": 6, "y": 4 }, - "panelIndex": "3", - "panelRefName": "panel_3", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "c93bb2ae-0f02-47a7-879f-07a6b881e6e3", + "title": "Package Changes [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cc8f3862-fcfa-432e-962a-03a1937162e4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a6e96c07-5d2a-48b2-b167-d14a6ad6b29e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b9e99a5a-083c-4add-b75b-77e1d69e506b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cc8f3862-fcfa-432e-962a-03a1937162e4": { + "columnOrder": [ + "bf7f7b93-be31-4ef6-a4ee-35bad9e4cbd0", + "44f97c10-aaec-4a8d-ad2a-44cd66d74df8" + ], + "columns": { + "44f97c10-aaec-4a8d-ad2a-44cd66d74df8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "bf7f7b93-be31-4ef6-a4ee-35bad9e4cbd0": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "event.action: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44f97c10-aaec-4a8d-ad2a-44cd66d74df8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "event.action" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "a6e96c07-5d2a-48b2-b167-d14a6ad6b29e", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b9e99a5a-083c-4add-b75b-77e1d69e506b", + "key": "event.kind", + "negate": false, + "params": { + "query": "event", + "type": "phrase" + }, + "type": "phrase", + "value": "event" + }, + "query": { + "match": { + "event.kind": { + "query": "event", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "cc8f3862-fcfa-432e-962a-03a1937162e4", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "metrics": [ + "44f97c10-aaec-4a8d-ad2a-44cd66d74df8" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "bf7f7b93-be31-4ef6-a4ee-35bad9e4cbd0" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Package Change Actions [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "4", + "i": "d7251977-8255-48a2-b86a-4235f3ddd835", "w": 13, - "x": 24, + "x": 11, "y": 4 }, - "panelIndex": "4", - "panelRefName": "panel_4", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "d7251977-8255-48a2-b86a-4235f3ddd835", + "title": "Package Change Actions [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-9906edbc-ba8f-4a08-bbdd-b3fad57c5fd8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "253f911e-c0bc-4183-af47-0b2681aba328", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9906edbc-ba8f-4a08-bbdd-b3fad57c5fd8": { + "columnOrder": [ + "0bc99a4d-5851-4bb2-8e40-cf7894b910ea", + "1f5a70a5-2b5c-40e7-a154-60549d48c300", + "91f99eb1-58ac-4d7b-8eaa-e90b5f357b14" + ], + "columns": { + "0bc99a4d-5851-4bb2-8e40-cf7894b910ea": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "OS", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "91f99eb1-58ac-4d7b-8eaa-e90b5f357b14", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.name" + }, + "1f5a70a5-2b5c-40e7-a154-60549d48c300": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "host.os.version: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "91f99eb1-58ac-4d7b-8eaa-e90b5f357b14", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "host.os.version" + }, + "91f99eb1-58ac-4d7b-8eaa-e90b5f357b14": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique count of host.id", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.id" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "253f911e-c0bc-4183-af47-0b2681aba328", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "9906edbc-ba8f-4a08-bbdd-b3fad57c5fd8", + "layerType": "data", + "legendDisplay": "show", + "legendMaxLines": 1, + "legendPosition": "right", + "metrics": [ + "91f99eb1-58ac-4d7b-8eaa-e90b5f357b14" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "0bc99a4d-5851-4bb2-8e40-cf7894b910ea", + "1f5a70a5-2b5c-40e7-a154-60549d48c300" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "donut" + } + }, + "title": "Package OS Distribution [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 11, - "i": "5", + "i": "5bda76ee-0477-48d6-905b-47c1b937f034", "w": 13, - "x": 11, + "x": 24, "y": 4 }, - "panelIndex": "5", - "panelRefName": "panel_5", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "5bda76ee-0477-48d6-905b-47c1b937f034", + "title": "Package OS Distribution [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-6453e663-b16e-47c4-8a88-b3cf004300d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "118e1ec1-98c8-4138-b2f0-9e302ddfecc5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "6453e663-b16e-47c4-8a88-b3cf004300d8": { + "columnOrder": [ + "f94dbdfc-c4ca-4f2c-9bb8-c19dc27e826c", + "07bfd13e-565c-4a24-a537-cd20616a5368" + ], + "columns": { + "07bfd13e-565c-4a24-a537-cd20616a5368": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "f94dbdfc-c4ca-4f2c-9bb8-c19dc27e826c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Package name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "07bfd13e-565c-4a24-a537-cd20616a5368", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 25 + }, + "scale": "ordinal", + "sourceField": "system_audit.package.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "118e1ec1-98c8-4138-b2f0-9e302ddfecc5", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": { + "query": "system_audit.package" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "right", + "columnId": "07bfd13e-565c-4a24-a537-cd20616a5368" + }, + { + "alignment": "left", + "columnId": "f94dbdfc-c4ca-4f2c-9bb8-c19dc27e826c" + } + ], + "headerRowHeight": "single", + "layerId": "6453e663-b16e-47c4-8a88-b3cf004300d8", + "layerType": "data", + "paging": { + "enabled": true, + "size": 5 + }, + "rowHeight": "single" + } + }, + "title": "Package Names [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 8, - "i": "6", - "w": 48, - "x": 0, - "y": 15 + "h": 11, + "i": "fa6e00f3-b774-4134-8282-47ab8bbc79c8", + "w": 11, + "x": 37, + "y": 4 }, - "panelIndex": "6", - "panelRefName": "panel_6", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "fa6e00f3-b774-4134-8282-47ab8bbc79c8", + "title": "Package Names [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-0d5bbe79-e717-4f09-8826-a6b72452de9e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4923e269-0e73-4067-ae5a-b6ede668a019", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "0d5bbe79-e717-4f09-8826-a6b72452de9e": { + "columnOrder": [ + "1f7c23d8-e2a6-424f-a509-1bb4ec2acb9f", + "cb77f8cc-d73e-4e42-9dd0-d97e2ef246a7" + ], + "columns": { + "1f7c23d8-e2a6-424f-a509-1bb4ec2acb9f": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": false, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "cb77f8cc-d73e-4e42-9dd0-d97e2ef246a7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "4923e269-0e73-4067-ae5a-b6ede668a019", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "curveType": "LINEAR", + "gridlinesVisibilitySettings": { + "x": false, + "yLeft": false, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": -90 + }, + "layers": [ + { + "accessors": [ + "cb77f8cc-d73e-4e42-9dd0-d97e2ef246a7" + ], + "isHistogram": true, + "layerId": "0d5bbe79-e717-4f09-8826-a6b72452de9e", + "layerType": "data", + "palette": { + "name": "kibana_palette", + "type": "palette" + }, + "seriesType": "bar_stacked", + "simpleView": false, + "xAccessor": "1f7c23d8-e2a6-424f-a509-1bb4ec2acb9f", + "xScaleType": "time", + "yConfig": [ + { + "axisMode": "left", + "forAccessor": "cb77f8cc-d73e-4e42-9dd0-d97e2ef246a7" + } + ] + } + ], + "legend": { + "isVisible": false, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": false + }, + "preferredSeriesType": "bar_stacked", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false, + "yLeftExtent": { + "enforce": true, + "mode": "full" + }, + "yLeftScale": "linear", + "yRightScale": "linear", + "yTitle": "Count" + } + }, + "title": "Package Document Histogram [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { - "h": 26, - "i": "7", + "h": 10, + "i": "6545e047-42b2-4d65-84c3-29d892d6d35d", "w": 48, "x": 0, - "y": 23 - }, - "panelIndex": "7", - "panelRefName": "panel_7", - "type": "search", - "version": "7.3.0" - }, - { - "embeddableConfig": { - "enhancements": {} - }, - "gridData": { - "h": 11, - "i": "8", - "w": 11, - "x": 37, - "y": 4 + "y": 15 }, - "panelIndex": "8", - "panelRefName": "panel_8", - "type": "visualization", - "version": "7.3.0" + "panelIndex": "6545e047-42b2-4d65-84c3-29d892d6d35d", + "title": "Package Document Histogram [System Audit]", + "type": "lens", + "version": "8.7.1" } ], "timeRestore": false, "title": "[System Audit] Package Dashboard", "version": 1 }, - "coreMigrationVersion": "8.5.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T09:51:24.798Z", "id": "system_audit-137c52f0-286a-11e9-9d21-0be348776e6c", "migrationVersion": { - "dashboard": "8.5.0" + "dashboard": "8.7.0" }, "references": [ { - "id": "system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90", - "name": "1:panel_1", - "type": "visualization" + "id": "system_audit-391ef230-2868-11e9-9d21-0be348776e6c", + "name": "7:panel_7", + "type": "search" + }, + { + "id": "logs-*", + "name": "1d014398-cca8-4861-a331-a84a122dd37e:indexpattern-datasource-layer-896b1e33-da2b-4061-8e10-368b768ef941", + "type": "index-pattern" }, { - "id": "system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90", - "name": "2:panel_2", - "type": "visualization" + "id": "logs-*", + "name": "1d014398-cca8-4861-a331-a84a122dd37e:597bfe15-829e-4ebf-ae71-decd9d475b70", + "type": "index-pattern" }, { - "id": "system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519", - "name": "3:panel_3", - "type": "visualization" + "id": "logs-*", + "name": "c93bb2ae-0f02-47a7-879f-07a6b881e6e3:indexpattern-datasource-layer-b5b97e38-c48a-447d-9685-8293736b3335", + "type": "index-pattern" }, { - "id": "system_audit-6ed51940-2868-11e9-9d21-0be348776e6c", - "name": "4:panel_4", - "type": "visualization" + "id": "logs-*", + "name": "c93bb2ae-0f02-47a7-879f-07a6b881e6e3:fc4ab5bf-f1d0-4e84-b05d-2f5d5292ae8c", + "type": "index-pattern" }, { - "id": "system_audit-fe23f530-2868-11e9-9d21-0be348776e6c", - "name": "5:panel_5", - "type": "visualization" + "id": "logs-*", + "name": "c93bb2ae-0f02-47a7-879f-07a6b881e6e3:4582710c-1f7e-4e4c-b44b-21ba64241753", + "type": "index-pattern" }, { - "id": "system_audit-4e7701d0-2869-11e9-9d21-0be348776e6c", - "name": "6:panel_6", - "type": "visualization" + "id": "logs-*", + "name": "d7251977-8255-48a2-b86a-4235f3ddd835:indexpattern-datasource-layer-cc8f3862-fcfa-432e-962a-03a1937162e4", + "type": "index-pattern" }, { - "id": "system_audit-391ef230-2868-11e9-9d21-0be348776e6c", - "name": "7:panel_7", - "type": "search" + "id": "logs-*", + "name": "d7251977-8255-48a2-b86a-4235f3ddd835:a6e96c07-5d2a-48b2-b167-d14a6ad6b29e", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d7251977-8255-48a2-b86a-4235f3ddd835:b9e99a5a-083c-4add-b75b-77e1d69e506b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5bda76ee-0477-48d6-905b-47c1b937f034:indexpattern-datasource-layer-9906edbc-ba8f-4a08-bbdd-b3fad57c5fd8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5bda76ee-0477-48d6-905b-47c1b937f034:253f911e-c0bc-4183-af47-0b2681aba328", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa6e00f3-b774-4134-8282-47ab8bbc79c8:indexpattern-datasource-layer-6453e663-b16e-47c4-8a88-b3cf004300d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa6e00f3-b774-4134-8282-47ab8bbc79c8:118e1ec1-98c8-4138-b2f0-9e302ddfecc5", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6545e047-42b2-4d65-84c3-29d892d6d35d:indexpattern-datasource-layer-0d5bbe79-e717-4f09-8826-a6b72452de9e", + "type": "index-pattern" }, { - "id": "system_audit-8dc55df0-2869-11e9-9d21-0be348776e6c", - "name": "8:panel_8", - "type": "visualization" + "id": "logs-*", + "name": "6545e047-42b2-4d65-84c3-29d892d6d35d:4923e269-0e73-4067-ae5a-b6ede668a019", + "type": "index-pattern" } ], - "type": "dashboard", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjgsMV0=" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/system_audit/kibana/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90.json b/packages/system_audit/kibana/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90.json index 1280b466d2f..47bc5c30c6c 100644 --- a/packages/system_audit/kibana/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90.json +++ b/packages/system_audit/kibana/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90.json @@ -1,37 +1,9 @@ { "attributes": { "description": "Overview of System Audit Information.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": "Package", - "disabled": true, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - } - ], + "filter": [], "query": { "language": "kuery", "query": "" @@ -39,14 +11,148 @@ } }, "optionsJSON": { - "darkTheme": false, "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-cad954e8-6092-402e-87f6-b4aa8e873c4b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b6b94de8-42a0-4508-9793-25d8e54b5e7b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "cad954e8-6092-402e-87f6-b4aa8e873c4b": { + "columnOrder": [ + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1", + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X0", + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X1" + ], + "columns": { + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Packages", + "operationType": "formula", + "params": { + "formula": "defaults(unique_count(system_audit.package.entity_id), 0)", + "isFormulaBroken": false + }, + "references": [ + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X1" + ], + "scale": "ratio" + }, + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Packages", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "system_audit.package.entity_id" + }, + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Packages", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X0", + 0 + ], + "location": { + "max": 57, + "min": 0 + }, + "name": "defaults", + "text": "defaults(unique_count(system_audit.package.entity_id), 0)", + "type": "function" + } + }, + "references": [ + "259bcb2f-bb59-4da2-9a7a-f40702af8ac1X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "b6b94de8-42a0-4508-9793-25d8e54b5e7b", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "cad954e8-6092-402e-87f6-b4aa8e873c4b", + "layerType": "data", + "metricAccessor": "259bcb2f-bb59-4da2-9a7a-f40702af8ac1" + } + }, + "title": "Package Count [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 8, @@ -56,13 +162,176 @@ "y": 4 }, "panelIndex": "1", - "panelRefName": "panel_1", - "type": "visualization", - "version": "8.5.0" + "title": "Package Count [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-e31e57b9-aa23-401c-b274-bdf0adc24975", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "485c28ba-3d0b-4527-912b-66cc76642153", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5acbc0ec-4aa7-43b9-8ad0-3edf38291e98", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e31e57b9-aa23-401c-b274-bdf0adc24975": { + "columnOrder": [ + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1", + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X0", + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X1" + ], + "columns": { + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Changes", + "operationType": "formula", + "params": { + "formula": "defaults(count(), 0)", + "isFormulaBroken": false + }, + "references": [ + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X1" + ], + "scale": "ratio" + }, + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Changes", + "operationType": "count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Changes", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X0", + 0 + ], + "location": { + "max": 20, + "min": 0 + }, + "name": "defaults", + "text": "defaults(count(), 0)", + "type": "function" + } + }, + "references": [ + "8cd791b8-0ee6-474e-900b-4b2bb94da7d1X0" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "485c28ba-3d0b-4527-912b-66cc76642153", + "key": "event.dataset", + "negate": false, + "params": { + "query": "system_audit.package", + "type": "phrase" + }, + "type": "phrase", + "value": "package" + }, + "query": { + "match": { + "event.dataset": { + "query": "system_audit.package", + "type": "phrase" + } + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "5acbc0ec-4aa7-43b9-8ad0-3edf38291e98", + "key": "event.action", + "negate": true, + "params": { + "query": "existing_package", + "type": "phrase" + }, + "type": "phrase", + "value": "existing_package" + }, + "query": { + "match": { + "event.action": { + "query": "existing_package", + "type": "phrase" + } + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#6092C0", + "layerId": "e31e57b9-aa23-401c-b274-bdf0adc24975", + "layerType": "data", + "metricAccessor": "8cd791b8-0ee6-474e-900b-4b2bb94da7d1" + } + }, + "title": "Package Changes [System Audit] (converted)", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 14, @@ -72,59 +341,83 @@ "y": 12 }, "panelIndex": "2", - "panelRefName": "panel_2", - "type": "visualization", - "version": "8.5.0" + "title": "Package Changes [System Audit]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {} + "enhancements": {}, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 12, + "markdown": "**Dashboards**: **[System Overview](#/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90)** | [Packages](#/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c)", + "openLinksInNewTab": false + }, + "type": "markdown", + "uiState": {} + } }, "gridData": { "h": 4, - "i": "3", + "i": "1bf0e900-2d1c-4665-82d4-a65d0148eea0", "w": 48, "x": 0, "y": 0 }, - "panelIndex": "3", - "panelRefName": "panel_3", + "panelIndex": "1bf0e900-2d1c-4665-82d4-a65d0148eea0", + "title": "Dashboard Links [System Audit]", "type": "visualization", - "version": "8.5.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[System Audit] System Audit Overview", "version": 1 }, - "coreMigrationVersion": "8.5.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T09:45:01.566Z", "id": "system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90", "migrationVersion": { - "dashboard": "8.5.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "1:indexpattern-datasource-layer-cad954e8-6092-402e-87f6-b4aa8e873c4b", "type": "index-pattern" }, { - "id": "system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90", - "name": "1:panel_1", - "type": "visualization" + "id": "logs-*", + "name": "1:b6b94de8-42a0-4508-9793-25d8e54b5e7b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "2:indexpattern-datasource-layer-e31e57b9-aa23-401c-b274-bdf0adc24975", + "type": "index-pattern" }, { - "id": "system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519", - "name": "2:panel_2", - "type": "visualization" + "id": "logs-*", + "name": "2:485c28ba-3d0b-4527-912b-66cc76642153", + "type": "index-pattern" }, { - "id": "system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90", - "name": "3:panel_3", - "type": "visualization" + "id": "logs-*", + "name": "2:5acbc0ec-4aa7-43b9-8ad0-3edf38291e98", + "type": "index-pattern" } ], - "type": "dashboard", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMTksMV0=" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/system_audit/kibana/search/system_audit-391ef230-2868-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/search/system_audit-391ef230-2868-11e9-9d21-0be348776e6c.json index 34c82334139..a079cbd3dc4 100644 --- a/packages/system_audit/kibana/search/system_audit-391ef230-2868-11e9-9d21-0be348776e6c.json +++ b/packages/system_audit/kibana/search/system_audit-391ef230-2868-11e9-9d21-0be348776e6c.json @@ -55,7 +55,8 @@ "title": "Package Documents [System Audit]", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T09:29:49.220Z", "id": "system_audit-391ef230-2868-11e9-9d21-0be348776e6c", "migrationVersion": { "search": "8.0.0" @@ -72,7 +73,5 @@ "type": "index-pattern" } ], - "type": "search", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjYsMV0=" + "type": "search" } \ No newline at end of file diff --git a/packages/system_audit/kibana/tags.yml b/packages/system_audit/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/system_audit/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/system_audit/kibana/visualization/system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90.json b/packages/system_audit/kibana/visualization/system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90.json deleted file mode 100644 index b6367875fb9..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Dashboard Links [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [], - "params": { - "fontSize": 12, - "markdown": "**Dashboards**: [System Overview](#/dashboard/system_audit-2be46cb0-27f2-11e9-89af-fd12d59dac90) | [Packages](#/dashboard/system_audit-137c52f0-286a-11e9-9d21-0be348776e6c)", - "openLinksInNewTab": false - }, - "title": "Dashboard Links [System Audit]", - "type": "markdown" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-4ccc5b50-27f6-11e9-89af-fd12d59dac90", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwNTgsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-4e7701d0-2869-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/visualization/system_audit-4e7701d0-2869-11e9-9d21-0be348776e6c.json deleted file mode 100644 index 7f7d6fd74b8..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-4e7701d0-2869-11e9-9d21-0be348776e6c.json +++ /dev/null @@ -1,167 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package Document Histogram [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "drop_partials": false, - "extended_bounds": {}, - "field": "@timestamp", - "interval": "auto", - "min_doc_count": 1, - "useNormalizedEsInterval": true - }, - "schema": "segment", - "type": "date_histogram" - } - ], - "params": { - "addLegend": true, - "addTimeMarker": false, - "addTooltip": true, - "categoryAxes": [ - { - "id": "CategoryAxis-1", - "labels": { - "filter": true, - "show": true, - "truncate": 100 - }, - "position": "bottom", - "scale": { - "type": "linear" - }, - "show": true, - "style": {}, - "title": {}, - "type": "category" - } - ], - "detailedTooltip": true, - "grid": { - "categoryLines": false, - "style": { - "color": "#eee" - } - }, - "isVislibVis": true, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "seriesParams": [ - { - "data": { - "id": "1", - "label": "Count" - }, - "drawLinesBetweenPoints": true, - "mode": "stacked", - "show": "true", - "showCircles": true, - "type": "histogram", - "valueAxis": "ValueAxis-1" - } - ], - "times": [], - "type": "histogram", - "valueAxes": [ - { - "id": "ValueAxis-1", - "labels": { - "filter": false, - "rotate": 0, - "show": true, - "truncate": 100 - }, - "name": "LeftAxis-1", - "position": "left", - "scale": { - "mode": "normal", - "type": "linear" - }, - "show": true, - "style": {}, - "title": { - "text": "Count" - }, - "type": "value" - } - ] - }, - "title": "Package Document Histogram [System Audit]", - "type": "histogram" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-4e7701d0-2869-11e9-9d21-0be348776e6c", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjUsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-6ed51940-2868-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/visualization/system_audit-6ed51940-2868-11e9-9d21-0be348776e6c.json deleted file mode 100644 index bffe30bb28b..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-6ed51940-2868-11e9-9d21-0be348776e6c.json +++ /dev/null @@ -1,131 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package OS Distribution [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "field": "host.id" - }, - "schema": "metric", - "type": "cardinality" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "OS", - "field": "host.os.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "field": "host.os.version", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "title": "Package OS Distribution [System Audit]", - "type": "pie" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-6ed51940-2868-11e9-9d21-0be348776e6c", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjMsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-8dc55df0-2869-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/visualization/system_audit-8dc55df0-2869-11e9-9d21-0be348776e6c.json deleted file mode 100644 index 9a9800327ff..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-8dc55df0-2869-11e9-9d21-0be348776e6c.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package Names [System Audit]", - "uiStateJSON": { - "vis": { - "params": { - "sort": { - "columnIndex": null, - "direction": null - } - } - } - }, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "system_audit.package.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 25 - }, - "schema": "bucket", - "type": "terms" - } - ], - "params": { - "perPage": 5, - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": true, - "showTotal": false, - "sort": { - "columnIndex": null, - "direction": null - }, - "totalFunc": "sum" - }, - "title": "Package Names [System Audit]", - "type": "table" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-8dc55df0-2869-11e9-9d21-0be348776e6c", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjcsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519.json b/packages/system_audit/kibana/visualization/system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519.json deleted file mode 100644 index b3dd79a2b9a..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519.json +++ /dev/null @@ -1,139 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "event.action", - "negate": true, - "params": { - "query": "existing_package", - "type": "phrase" - }, - "type": "phrase", - "value": "existing_package" - }, - "query": { - "match": { - "event.action": { - "query": "existing_package", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package Changes [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Changes" - }, - "schema": "metric", - "type": "count" - } - ], - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "title": "Package Changes [System Audit]", - "type": "metric" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-bdf9c530-27fe-11e9-805f-43bf57dfa519", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjIsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90.json b/packages/system_audit/kibana/visualization/system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90.json deleted file mode 100644 index a6a978a4d0e..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90.json +++ /dev/null @@ -1,109 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package Count [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Packages", - "field": "system_audit.package.entity_id" - }, - "schema": "metric", - "type": "cardinality" - } - ], - "params": { - "addLegend": false, - "addTooltip": true, - "metric": { - "colorSchema": "Green to Red", - "colorsRange": [ - { - "from": 0, - "to": 10000 - } - ], - "invertColors": false, - "labels": { - "show": true - }, - "metricColorMode": "None", - "percentageMode": false, - "style": { - "bgColor": false, - "bgFill": "#000", - "fontSize": 60, - "labelColor": false, - "subText": "" - }, - "useRanges": false - }, - "type": "metric" - }, - "title": "Package Count [System Audit]", - "type": "metric" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-f664fb20-27f3-11e9-89af-fd12d59dac90", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjEsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/kibana/visualization/system_audit-fe23f530-2868-11e9-9d21-0be348776e6c.json b/packages/system_audit/kibana/visualization/system_audit-fe23f530-2868-11e9-9d21-0be348776e6c.json deleted file mode 100644 index c3ff8e2a4f1..00000000000 --- a/packages/system_audit/kibana/visualization/system_audit-fe23f530-2868-11e9-9d21-0be348776e6c.json +++ /dev/null @@ -1,143 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "event.dataset", - "negate": false, - "params": { - "query": "system_audit.package", - "type": "phrase" - }, - "type": "phrase", - "value": "package" - }, - "query": { - "match": { - "event.dataset": { - "query": "system_audit.package", - "type": "phrase" - } - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "event.kind", - "negate": false, - "params": { - "query": "event", - "type": "phrase" - }, - "type": "phrase", - "value": "event" - }, - "query": { - "match": { - "event.kind": { - "query": "event", - "type": "phrase" - } - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "title": "Package Change Actions [System Audit]", - "uiStateJSON": {}, - "version": 1, - "visState": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" - }, - { - "enabled": true, - "id": "2", - "params": { - "field": "event.action", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "params": { - "addLegend": true, - "addTooltip": true, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "title": "Package Change Actions [System Audit]", - "type": "pie" - } - }, - "coreMigrationVersion": "8.5.0", - "id": "system_audit-fe23f530-2868-11e9-9d21-0be348776e6c", - "migrationVersion": { - "visualization": "8.5.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization", - "updated_at": "2023-01-26T16:36:03.951Z", - "version": "WzUwMjQsMV0=" -} \ No newline at end of file diff --git a/packages/system_audit/manifest.yml b/packages/system_audit/manifest.yml index 94166fa5a5d..24202814878 100644 --- a/packages/system_audit/manifest.yml +++ b/packages/system_audit/manifest.yml @@ -1,14 +1,24 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: system_audit title: System Audit description: Collect various logs & metrics from System Audit modules with Elastic Agent. type: integration -version: "1.4.0" +version: "1.8.0" conditions: - kibana.version: '^8.5.0' + kibana: + version: '^8.7.1' categories: - custom - os_system +screenshots: + - src: /img/system-audit-package-dashboard.png + title: Package Dashboard + size: 2546x2888 + type: image/png + - src: /img/system-audit-overview-dashboard.png + title: Overview Dashboard + size: 2546x2496 + type: image/png policy_templates: - name: system_audit title: System Audit @@ -19,3 +29,4 @@ policy_templates: description: Collect various logs & metrics from System Audit modules with Elastic Agent. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/tanium/_dev/build/build.yml b/packages/tanium/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/tanium/_dev/build/build.yml +++ b/packages/tanium/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/tanium/changelog.yml b/packages/tanium/changelog.yml index f1fe45d3f6c..cfe5972e114 100644 --- a/packages/tanium/changelog.yml +++ b/packages/tanium/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.1.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.0.0" changes: - description: Release Tanium as GA. diff --git a/packages/tanium/data_stream/action_history/_dev/test/pipeline/test-action-history.log-expected.json b/packages/tanium/data_stream/action_history/_dev/test/pipeline/test-action-history.log-expected.json index 9cf64d8c60d..3dc35059946 100644 --- a/packages/tanium/data_stream/action_history/_dev/test/pipeline/test-action-history.log-expected.json +++ b/packages/tanium/data_stream/action_history/_dev/test/pipeline/test-action-history.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "DeployClientConfigurationandSupport[Mac](universal)", diff --git a/packages/tanium/data_stream/action_history/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/action_history/elasticsearch/ingest_pipeline/default.yml index 4b526f21ea6..48651759ec7 100644 --- a/packages/tanium/data_stream/action_history/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/action_history/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing action history logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: event diff --git a/packages/tanium/data_stream/action_history/manifest.yml b/packages/tanium/data_stream/action_history/manifest.yml index c5c6a690770..46c4b292844 100644 --- a/packages/tanium/data_stream/action_history/manifest.yml +++ b/packages/tanium/data_stream/action_history/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/action_history/sample_event.json b/packages/tanium/data_stream/action_history/sample_event.json index 2ce108f5b9b..313d1d2b371 100644 --- a/packages/tanium/data_stream/action_history/sample_event.json +++ b/packages/tanium/data_stream/action_history/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", diff --git a/packages/tanium/data_stream/client_status/_dev/test/pipeline/test-client-status.log-expected.json b/packages/tanium/data_stream/client_status/_dev/test/pipeline/test-client-status.log-expected.json index e3f0cb0ec91..96b9e9f693c 100644 --- a/packages/tanium/data_stream/client_status/_dev/test/pipeline/test-client-status.log-expected.json +++ b/packages/tanium/data_stream/client_status/_dev/test/pipeline/test-client-status.log-expected.json @@ -5,7 +5,7 @@ "ip": "67.43.156.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": [ diff --git a/packages/tanium/data_stream/client_status/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/client_status/elasticsearch/ingest_pipeline/default.yml index d05f645c18d..34a3c73df58 100644 --- a/packages/tanium/data_stream/client_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/client_status/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Client Status logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: state diff --git a/packages/tanium/data_stream/client_status/manifest.yml b/packages/tanium/data_stream/client_status/manifest.yml index 29f2f2fb0d3..ae997aa5866 100644 --- a/packages/tanium/data_stream/client_status/manifest.yml +++ b/packages/tanium/data_stream/client_status/manifest.yml @@ -76,7 +76,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -92,7 +92,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -100,7 +100,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/client_status/sample_event.json b/packages/tanium/data_stream/client_status/sample_event.json index 456fb84389a..5168be9097c 100644 --- a/packages/tanium/data_stream/client_status/sample_event.json +++ b/packages/tanium/data_stream/client_status/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", diff --git a/packages/tanium/data_stream/discover/_dev/test/pipeline/test-discover.log-expected.json b/packages/tanium/data_stream/discover/_dev/test/pipeline/test-discover.log-expected.json index 01af6170e8a..565b5452357 100644 --- a/packages/tanium/data_stream/discover/_dev/test/pipeline/test-discover.log-expected.json +++ b/packages/tanium/data_stream/discover/_dev/test/pipeline/test-discover.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-11-18T10:10:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "1", diff --git a/packages/tanium/data_stream/discover/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/discover/elasticsearch/ingest_pipeline/default.yml index 6700c636dde..cb6332cf221 100644 --- a/packages/tanium/data_stream/discover/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/discover/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Discover logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: event diff --git a/packages/tanium/data_stream/discover/manifest.yml b/packages/tanium/data_stream/discover/manifest.yml index e99346e3e48..7c55cec0ce9 100644 --- a/packages/tanium/data_stream/discover/manifest.yml +++ b/packages/tanium/data_stream/discover/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/discover/sample_event.json b/packages/tanium/data_stream/discover/sample_event.json index da542fd065c..dff76bd9fdd 100644 --- a/packages/tanium/data_stream/discover/sample_event.json +++ b/packages/tanium/data_stream/discover/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c43758c9-08d7-42f2-b258-f39e4373d45a", diff --git a/packages/tanium/data_stream/endpoint_config/_dev/test/pipeline/test-endpoint-config.log-expected.json b/packages/tanium/data_stream/endpoint_config/_dev/test/pipeline/test-endpoint-config.log-expected.json index 90f7e952c0b..9ab274e248c 100644 --- a/packages/tanium/data_stream/endpoint_config/_dev/test/pipeline/test-endpoint-config.log-expected.json +++ b/packages/tanium/data_stream/endpoint_config/_dev/test/pipeline/test-endpoint-config.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AUDIT_ACTION_CREATED", @@ -66,7 +66,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "AUDIT_ACTION_CREATED", @@ -130,7 +130,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tanium/data_stream/endpoint_config/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/endpoint_config/elasticsearch/ingest_pipeline/default.yml index a2b6b8e005a..06c1dfe4107 100644 --- a/packages/tanium/data_stream/endpoint_config/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/endpoint_config/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing endpoint config logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: state diff --git a/packages/tanium/data_stream/endpoint_config/manifest.yml b/packages/tanium/data_stream/endpoint_config/manifest.yml index 068ef14cc5a..a76c23e4358 100644 --- a/packages/tanium/data_stream/endpoint_config/manifest.yml +++ b/packages/tanium/data_stream/endpoint_config/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/endpoint_config/sample_event.json b/packages/tanium/data_stream/endpoint_config/sample_event.json index 69bf6837f72..85042b31a15 100644 --- a/packages/tanium/data_stream/endpoint_config/sample_event.json +++ b/packages/tanium/data_stream/endpoint_config/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "7ac2bc6a-9f9b-4289-82db-ee2a0a7e6ef8", diff --git a/packages/tanium/data_stream/reporting/_dev/test/pipeline/test-reporting.log-expected.json b/packages/tanium/data_stream/reporting/_dev/test/pipeline/test-reporting.log-expected.json index 69d4f42d369..389522ebe58 100644 --- a/packages/tanium/data_stream/reporting/_dev/test/pipeline/test-reporting.log-expected.json +++ b/packages/tanium/data_stream/reporting/_dev/test/pipeline/test-reporting.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": [ diff --git a/packages/tanium/data_stream/reporting/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/reporting/elasticsearch/ingest_pipeline/default.yml index 2b766069695..5e0c6acaa23 100644 --- a/packages/tanium/data_stream/reporting/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/reporting/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing reporting logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: event diff --git a/packages/tanium/data_stream/reporting/manifest.yml b/packages/tanium/data_stream/reporting/manifest.yml index db65446fb77..d593416615a 100644 --- a/packages/tanium/data_stream/reporting/manifest.yml +++ b/packages/tanium/data_stream/reporting/manifest.yml @@ -76,7 +76,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -92,7 +92,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -100,7 +100,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/reporting/sample_event.json b/packages/tanium/data_stream/reporting/sample_event.json index cd45ed46f4d..da8a2a03d90 100644 --- a/packages/tanium/data_stream/reporting/sample_event.json +++ b/packages/tanium/data_stream/reporting/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", diff --git a/packages/tanium/data_stream/threat_response/_dev/test/pipeline/test-threat-response.log-expected.json b/packages/tanium/data_stream/threat_response/_dev/test/pipeline/test-threat-response.log-expected.json index a8a08bb0ba2..60852d3f63e 100644 --- a/packages/tanium/data_stream/threat_response/_dev/test/pipeline/test-threat-response.log-expected.json +++ b/packages/tanium/data_stream/threat_response/_dev/test/pipeline/test-threat-response.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -63,7 +63,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -352,7 +352,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -629,7 +629,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -695,7 +695,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -975,7 +975,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1255,7 +1255,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1532,7 +1532,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1809,7 +1809,7 @@ { "@timestamp": "2023-01-18T10:13:28.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2086,7 +2086,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2363,7 +2363,7 @@ { "@timestamp": "2023-01-18T10:45:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2640,7 +2640,7 @@ { "@timestamp": "2023-01-18T10:34:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -2917,7 +2917,7 @@ { "@timestamp": "2023-01-18T10:45:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3194,7 +3194,7 @@ { "@timestamp": "2023-01-18T10:43:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3471,7 +3471,7 @@ { "@timestamp": "2023-01-18T10:44:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -3748,7 +3748,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4026,7 +4026,7 @@ { "@timestamp": "2023-01-18T10:55:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4304,7 +4304,7 @@ { "@timestamp": "2023-01-18T10:58:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4582,7 +4582,7 @@ { "@timestamp": "2023-01-18T10:45:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -4859,7 +4859,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -4920,7 +4920,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -5197,7 +5197,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "update", @@ -5258,7 +5258,7 @@ { "@timestamp": "2023-01-18T10:40:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -5535,7 +5535,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -5596,7 +5596,7 @@ { "@timestamp": "2023-01-18T11:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -5873,7 +5873,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "create", @@ -5934,7 +5934,7 @@ { "@timestamp": "2023-01-18T10:37:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6212,7 +6212,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6490,7 +6490,7 @@ { "@timestamp": "2023-01-18T10:23:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6767,7 +6767,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6833,7 +6833,7 @@ { "@timestamp": "2023-02-01T00:35:37.936Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6890,7 +6890,7 @@ { "@timestamp": "2023-01-31T23:35:33.445Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -6947,7 +6947,7 @@ { "@timestamp": "2023-01-31T23:35:33.060Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7004,7 +7004,7 @@ { "@timestamp": "2023-01-31T23:35:34.657Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7061,7 +7061,7 @@ { "@timestamp": "2023-01-31T23:35:34.285Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7118,7 +7118,7 @@ { "@timestamp": "2023-01-31T23:35:33.975Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7175,7 +7175,7 @@ { "@timestamp": "2023-01-31T23:35:33.958Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7232,7 +7232,7 @@ { "@timestamp": "2023-01-31T23:35:33.759Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7289,7 +7289,7 @@ { "@timestamp": "2023-01-31T23:35:33.570Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7346,7 +7346,7 @@ { "@timestamp": "2023-01-31T23:35:34.812Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -7403,7 +7403,7 @@ { "@timestamp": "2023-01-18T10:37:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tanium/data_stream/threat_response/elasticsearch/ingest_pipeline/default.yml b/packages/tanium/data_stream/threat_response/elasticsearch/ingest_pipeline/default.yml index b08943bbad4..64c1c3c1c3a 100644 --- a/packages/tanium/data_stream/threat_response/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tanium/data_stream/threat_response/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing threat response logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.kind value: event diff --git a/packages/tanium/data_stream/threat_response/manifest.yml b/packages/tanium/data_stream/threat_response/manifest.yml index b6737212b41..599bb72cdef 100644 --- a/packages/tanium/data_stream/threat_response/manifest.yml +++ b/packages/tanium/data_stream/threat_response/manifest.yml @@ -21,7 +21,7 @@ streams: required: false show_user: true default: 1m - description: "Time interval for polling listing of the S3 bucket. NOTE: Interval should be greater than the Tanium scheduler time and supported units are h/m/s." + description: "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s." - name: number_of_workers type: integer title: "[S3] Number of Workers" @@ -37,7 +37,7 @@ streams: required: false show_user: true default: 300s - description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s." - name: api_timeout type: text title: "[SQS] API Timeout" @@ -45,7 +45,7 @@ streams: required: false show_user: true default: 120s - description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s." - name: max_number_of_messages type: integer title: "[SQS] Maximum Concurrent SQS Messages" diff --git a/packages/tanium/data_stream/threat_response/sample_event.json b/packages/tanium/data_stream/threat_response/sample_event.json index 3c770f74949..767ed8b48c8 100644 --- a/packages/tanium/data_stream/threat_response/sample_event.json +++ b/packages/tanium/data_stream/threat_response/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "7ac2bc6a-9f9b-4289-82db-ee2a0a7e6ef8", diff --git a/packages/tanium/docs/README.md b/packages/tanium/docs/README.md index 908dcaf8a0d..4abdd0ccc8a 100644 --- a/packages/tanium/docs/README.md +++ b/packages/tanium/docs/README.md @@ -87,7 +87,7 @@ An example event for `action_history` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", @@ -206,7 +206,7 @@ An example event for `client_status` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", @@ -309,7 +309,7 @@ An example event for `discover` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "c43758c9-08d7-42f2-b258-f39e4373d45a", @@ -429,7 +429,7 @@ An example event for `endpoint_config` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "7ac2bc6a-9f9b-4289-82db-ee2a0a7e6ef8", @@ -551,7 +551,7 @@ An example event for `reporting` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "2cc42030-c8c1-410b-8cef-c2db3ff157ec", @@ -663,7 +663,7 @@ An example event for `threat_response` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "7ac2bc6a-9f9b-4289-82db-ee2a0a7e6ef8", diff --git a/packages/tanium/kibana/tags.yml b/packages/tanium/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/tanium/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/tanium/manifest.yml b/packages/tanium/manifest.yml index 530206a9b19..d1a8c0a0536 100644 --- a/packages/tanium/manifest.yml +++ b/packages/tanium/manifest.yml @@ -1,14 +1,16 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: tanium title: Tanium -version: "1.0.0" +version: "1.4.0" description: This Elastic integration collects logs from Tanium with Elastic Agent. type: integration categories: - security conditions: - kibana.version: ^8.3.0 - elastic.subscription: "basic" + kibana: + version: ^8.3.0 + elastic: + subscription: "basic" screenshots: - src: /img/tanium-action-history-dashboard.png title: Tanium Action History Screenshot @@ -223,3 +225,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/tcp/_dev/build/build.yml b/packages/tcp/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/tcp/_dev/build/build.yml +++ b/packages/tcp/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/tcp/changelog.yml b/packages/tcp/changelog.yml index b7a49ad6f96..459b4770dcb 100644 --- a/packages/tcp/changelog.yml +++ b/packages/tcp/changelog.yml @@ -1,3 +1,23 @@ +- version: 1.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.11.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.10.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/tcp/data_stream/generic/manifest.yml b/packages/tcp/data_stream/generic/manifest.yml index 86e2b106060..b5f84c53c8a 100644 --- a/packages/tcp/data_stream/generic/manifest.yml +++ b/packages/tcp/data_stream/generic/manifest.yml @@ -64,12 +64,12 @@ streams: - name: timeout type: text title: Timeout - description: The number of seconds of inactivity before a remote connection is closed. The default is 300s + description: The duration of inactivity before a remote connection is closed. The default is 300s. Valid time units are ns, us, ms, s, m, h. required: false show_user: false - name: keep_null type: bool - title: Timeout + title: Keep Null Values description: If this option is set to true, fields with null values will be published in the output document. By default, keep_null is set to false. required: false show_user: false diff --git a/packages/tcp/kibana/tags.yml b/packages/tcp/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/tcp/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/tcp/manifest.yml b/packages/tcp/manifest.yml index 445dab18dbd..d01415ff55b 100644 --- a/packages/tcp/manifest.yml +++ b/packages/tcp/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: tcp title: Custom TCP Logs description: Collect raw TCP data from listening TCP port with Elastic Agent. type: integration -version: "1.10.0" +version: "1.14.0" conditions: - kibana.version: "^8.2.1" + kibana: + version: "^8.2.1" categories: - custom - custom_logs @@ -22,3 +23,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/tenable_io/_dev/build/build.yml b/packages/tenable_io/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/tenable_io/_dev/build/build.yml +++ b/packages/tenable_io/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/tenable_io/_dev/build/docs/README.md b/packages/tenable_io/_dev/build/docs/README.md index 9ad32521077..e445551b7e5 100644 --- a/packages/tenable_io/_dev/build/docs/README.md +++ b/packages/tenable_io/_dev/build/docs/README.md @@ -1,14 +1,14 @@ -# Tenable.io +# Tenable Vulnerability Management ## Overview -The [Tenable.io](https://www.tenable.com/products/tenable-io) integration allows users to monitor asset, plugin, and vulnerability activity. It provides the industry's most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. Tenable.io is the user's complete end-to-end vulnerability management solution. +The [Tenable Vulnerability Management](https://www.tenable.com/products/tenable-io) integration allows users to monitor asset, plugin, and vulnerability activity. It provides the industry's most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. Tenable Vulnerability Management is the user's complete end-to-end vulnerability management solution. -Use the Tenable.io integration to collects and parses data from the REST APIs. Then visualize that data in Kibana. +Use the Tenable Vulnerability Management integration to collects and parses data from the REST APIs. Then visualize that data in Kibana. ## Data streams -The Tenable.io integration collects logs for three types of events: Asset, Plugin, and Vulnerability. +The Tenable Vulnerability Management integration collects logs for three types of events: Asset, Plugin, and Vulnerability. **Asset** is used to get details related to assets that belong to the user's organization. See more details in the API documentation [here](https://developer.tenable.com/reference/exports-assets-request-export). @@ -16,13 +16,11 @@ The Tenable.io integration collects logs for three types of events: Asset, Plugi **Vulnerability** is used to retrieve all vulnerabilities on each asset, including the vulnerability state. See more details in the API documentation [here](https://developer.tenable.com/reference/exports-vulns-request-export). -**Scanner** is used to retrieve the current state of scanners, including licensing and activity. See more details in the API documentation [here](https://developer.tenable.com/reference/scanners-list). - **Scan** is used to retrieve details about existing scans, including scan statuses, assigned targets, and more. See more details in the API documentation [here](https://developer.tenable.com/reference/scans-list). ## Compatibility -This module has been tested against `Tenable.io release` [December 6, 2022](https://docs.tenable.com/releasenotes/Content/tenableio/tenableio202212.htm). +This module has been tested against `Tenable Vulnerability Management release` [December 6, 2022](https://docs.tenable.com/releasenotes/Content/tenableio/tenableio202212.htm). ## Requirements @@ -35,14 +33,14 @@ Elasticsearch is needed to store and search data, and Kibana is needed for visua ## Setup -### To collect data from the Tenable.io REST APIs, follow the below steps: +### To collect data from the Tenable Vulnerability Management REST APIs, follow the below steps: - 1. Create a valid user account with appropriate permissions on Tenable.io. - 2. Generate the API keys for the account to access all Tenable.io APIs. + 1. Create a valid user account with appropriate permissions on Tenable Vulnerability Management. + 2. Generate the API keys for the account to access all Tenable Vulnerability Management APIs. **Note:** - - For the Tenable.io asset and vulnerability API, **ADMINISTRATOR [64]** and **Can View** access control is required in created user's access key and secret key. - - For the Tenable.io plugin, **BASIC [16]** user permissions are required in created user's access key and secret key. + - For the Tenable Vulnerability Management asset and vulnerability API, **ADMINISTRATOR [64]** and **Can View** access control is required in created user's access key and secret key. + - For the Tenable Vulnerability Management plugin, **BASIC [16]** user permissions are required in created user's access key and secret key. - For more details related to permissions, refer to the link [here](https://developer.tenable.com/docs/permissions). ## Logs reference @@ -77,16 +75,6 @@ This is the `vulnerability` dataset. {{fields "vulnerability"}} -### scanner - -This is the `scanner` dataset. - -#### Example - -{{event "scanner"}} - -{{fields "scanner"}} - ### scan This is the `scan` dataset. diff --git a/packages/tenable_io/_dev/deploy/docker/files/config.yml b/packages/tenable_io/_dev/deploy/docker/files/config.yml index de1ff2c6cbe..4daba6c5648 100644 --- a/packages/tenable_io/_dev/deploy/docker/files/config.yml +++ b/packages/tenable_io/_dev/deploy/docker/files/config.yml @@ -46,18 +46,6 @@ rules: - status_code: 200 body: | [{"asset":{"fqdn":"example.com","hostname":"89.160.20.112","uuid":"cf165808-6a31-48e1-9cf3-c6c3174df51d","ipv4":"81.2.69.142","operating_system":["Test Demo OS X 10.5.8"],"network_id":"00000000-0000-0000-0000-000000000000","tracked":true},"output":"The observed version of Test is : \n /21.0.1180.90","plugin":{"cve":["CVE-2016-1620","CVE-2016-1614","CVE-2016-1613","CVE-2016-1612","CVE-2016-1618","CVE-2016-1617","CVE-2016-1616","CVE-2016-1615","CVE-2016-1619"],"cvss_base_score": 9.3,"cvss_temporal_score":6.9,"cvss_temporal_vector":{"exploitability":"Unproven","remediation_level":"Official-fix","report_confidence":"Confirmed","raw":"E:U/RL:OF/RC:C"},"cvss_vector":{"access_complexity":"Medium","access_vector":"Network","authentication":"None required","confidentiality_impact":"Complete","integrity_impact":"Complete","availability_impact":"Complete","raw":"AV:N/AC:M/Au:N/C:C/I:C/A:C"},"description":"The version of Test on the remote host is prior to 48.0.2564.82 and is affected by the following vulnerabilities: \n\n - An unspecified vulnerability exists in Test V8 when handling compatible receiver checks hidden behind receptors. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1612)\n - A use-after-free error exists in `PDFium` due to improper invalidation of `IPWL_FocusHandler` and `IPWL_Provider` upon destruction. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1613)\n - An unspecified vulnerability exists in `Blink` that is related to the handling of bitmaps. An attacker can exploit this to access sensitive information. No other details are available. (CVE-2016-1614)\n - An unspecified vulnerability exists in `omnibox` that is related to origin confusion. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1615)\n - An unspecified vulnerability exists that allows an attacker to spoof a displayed URL. No other details are available. (CVE-2016-1616)\n - An unspecified vulnerability exists that is related to history sniffing with HSTS and CSP. No other details are available. (CVE-2016-1617)\n - A flaw exists in `Blink` due to the weak generation of random numbers by the ARC4-based random number generator. An attacker can exploit this to gain access to sensitive information. No other details are available. (CVE-2016-1618)\n - An out-of-bounds read error exists in `PDFium` in file `fx_codec_jpx_opj.cpp` in the `sycc4{22,44}_to_rgb()` functions. An attacker can exploit this to cause a denial of service by crashing the application linked using the library. (CVE-2016-1619)\n - Multiple vulnerabilities exist, the most serious of which allow an attacker to execute arbitrary code via a crafted web page. (CVE-2016-1620)\n - A flaw in `objects.cc` is triggered when handling cleared `WeakCells`, which may allow a context-dependent attacker to have an unspecified impact. No further details have been provided. (CVE-2016-2051)","family":"Web Clients","family_id": 1000020,"has_patch":false,"id":9062,"name":"Test < 48.0.2564.82 Multiple Vulnerabilities","risk_factor":"HIGH","see_also":["http://testreleases.blogspot.com/2016/01/beta-channel-update_20.html"],"solution":"Update the browser to 48.0.2564.82 or later.","synopsis":"The remote host is utilizing a web browser that is affected by multiple vulnerabilities.","vpr":{"score":5.9,"drivers":{"age_of_vuln":{"lower_bound":366,"upper_bound":730},"exploit_code_maturity":"UNPROVEN","cvss_impact_score_predicted":false,"cvss3_impact_score":5.9,"threat_intensity_last28":"VERY_LOW","threat_sources_last28":["No recorded events"],"product_coverage":"LOW"},"updated":"2019-12-31T10:08:58Z"}},"port":{"port":"0","protocol":"TCP"},"scan":{"completed_at":"2018-12-31T20:59:47Z","schedule_uuid":"6f7db010-9cb6-4870-b745-70a2aea2f81ce1b6640fe8a2217b","started_at":"2018-12-31T20:59:47Z","uuid":"0e55ec5d-c7c7-4673-a618-438a84e9d1b78af3a9957a077904"},"severity":"low","severity_id":3,"severity_default_id":3,"severity_modification_type":"NONE","first_found":"2018-12-31T20:59:47Z","last_found":"2018-12-31T20:59:47Z","indexed":"2022-11-30T14:09:12.061Z","state":"OPEN"}] - - path: /scanners - methods: ["GET"] - responses: - - status_code: 200 - body: | - {"scanners": - [ - {"creation_date":1603821746,"group":true,"id":123456,"key":"db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199","last_connect":null,"last_modification_date":1603821746,"license":{"record_id":"001600000ASDA71CCD","type":"vm","activation_code":"7A1F-BT5R-7B5R","agents":-1,"ips":11000,"scanners":-1,"users":-1,"enterprise_pause":false,"expiration_date":1704326399,"evaluation":false,"apps":{"pci":{"mode":"basic"},"was":{"mode":"eval","expiration_date":1659585599,"ui_mode":"NEW"},"consec":{"mode":"eval","expiration_date":1658289599},"lumin":{"mode":"standard","expiration_date":1704326399,"assets":11000,"activation_code":"T8G9-A1EG-ERT4"},"vm":{"assets":11000,"vm_expiration_date":1704326399,"vm_activation_code":"TB7R-QWEG-ASD8","agents":0},"cns":{"mode":"eval","expiration_date":1663473599}},"scanners_used":10,"agents_used":4286},"linked":1,"name":"APAC Cloud Scanners","network_name":"Default","num_scans":0,"owner":"system","owner_id":1258789,"owner_name":"system","owner_uuid":"ab12we5wr-asdf1-etah5-asd8-d5yhf7ew4394","pool":true,"scan_count":0,"shared":1,"source":"service","status":"on","timestamp":1603821746,"type":"local","user_permissions":64,"uuid":"akd78gte-d58g-adsd-34fg-4fde5ugh52dw","supports_remote_logs":false,"supports_webapp":true,"supports_remote_settings":false}, - {"creation_date":1659982715,"distro":"ubuntu1404-x86-64","engine_version":"19.5.1","group":false,"hostname":"Scanner02","id":216324,"ip_addresses":["10.0.1.70"],"key":"ed3a5dfk7djh328deeas5d8gfdp3d2a8c24be99c8dd85g4hejd8se2466bf426e","last_connect":1683307347,"last_modification_date":1683230726,"linked":1,"loaded_plugin_set":"202305041802","name":"Scanner02","network_name":"Default","num_scans":0,"owner":"system","owner_id":1978564,"owner_name":"system","owner_uuid":"1adfj78e-a45d-5eqr-asd5-a58dfjg876dj","platform":"LINUX","pool":false,"scan_count":0,"shared":1,"source":"service","status":"on","timestamp":1683230726,"type":"managed","ui_build":"8","ui_version":"10.5.1","user_permissions":128,"uuid":"d581s325-5bc2-45bf-asd8-6e48a312576c","remote_uuid":"d58dhf87-d87j-dja2-3282-dkjs7dfh26he09jksjdm3dsa2hg8","supports_remote_logs":true,"supports_webapp":false,"supports_remote_settings":true}, - {"creation_date":1603990307,"group":true,"id":183251,"key":"5ae5d8f4g5da4368f4gd5d02c4a7133ffa777dcc010fb8b90f871371254a7594","last_connect":null,"last_modification_date":1603991208,"linked":1,"name":"Contoso Scanner Group","network_name":"Default","num_scans":0,"owner":"system","owner_id":4587863,"owner_name":"system","owner_uuid":"0adefc78-bd61-1af2-2fa1-12ac35cb84f6","pool":true,"scan_count":0,"shared":1,"source":"service","status":"on","timestamp":1603991208,"type":"pool","user_permissions":128,"uuid":"1a56bf7c-e0a1-452c-a89b-1abc568eb45a","supports_remote_logs":false,"supports_webapp":false,"supports_remote_settings":false} - ] - } - path: /scans methods: ["GET"] responses: diff --git a/packages/tenable_io/changelog.yml b/packages/tenable_io/changelog.yml index d8217a82131..8a7c431fd1c 100644 --- a/packages/tenable_io/changelog.yml +++ b/packages/tenable_io/changelog.yml @@ -1,4 +1,50 @@ # newer versions go on top +- version: 2.2.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.1.1" + changes: + - description: Update interval for asset and vulnerability and enable plugin data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7881 +- version: "2.1.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.0.1" + changes: + - description: Update dashboards for 2.0 changes. + type: bugfix + link: https://github.com/elastic/integrations/pull/7696 + - description: Fix timestamp to refer to last seen rather than indexed. + type: bugfix + link: https://github.com/elastic/integrations/pull/7696 + - description: Improve fingerprinting behavior. + type: bugfix + link: https://github.com/elastic/integrations/pull/7696 +- version: "2.0.0" + changes: + - description: Adjust default collection interval and remove Scanner data stream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7689 +- version: "1.3.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.2.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.1.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6906 - version: "1.0.0" changes: - description: Release Tenable.io as GA. diff --git a/packages/tenable_io/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json b/packages/tenable_io/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json index ab5d6b0e5f6..008cd9637f4 100644 --- a/packages/tenable_io/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json +++ b/packages/tenable_io/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json @@ -12,7 +12,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tenable_io/data_stream/asset/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_io/data_stream/asset/elasticsearch/ingest_pipeline/default.yml index ada1346146b..c0017c44bd9 100644 --- a/packages/tenable_io/data_stream/asset/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_io/data_stream/asset/elasticsearch/ingest_pipeline/default.yml @@ -1,9 +1,9 @@ --- -description: Pipeline for processing Tenable.io asset logs. +description: Pipeline for processing Tenable Vulnerability Management asset logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.category value: [host] diff --git a/packages/tenable_io/data_stream/asset/fields/fields.yml b/packages/tenable_io/data_stream/asset/fields/fields.yml index dea8c045e29..fac546e54e8 100644 --- a/packages/tenable_io/data_stream/asset/fields/fields.yml +++ b/packages/tenable_io/data_stream/asset/fields/fields.yml @@ -69,10 +69,10 @@ description: The BIOS UUID of the asset. - name: created_at type: date - description: The time and date when Tenable.io created the asset record. + description: The time and date when Tenable Vulnerability Management created the asset record. - name: deleted_at type: date - description: The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable.io retains the record until the asset ages out of the license count. + description: The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable Vulnerability Management retains the record until the asset ages out of the license count. - name: deleted_by type: keyword description: The user who deleted the asset record. @@ -111,7 +111,7 @@ description: The hostnames that scans have associated with the asset record. - name: id type: keyword - description: The UUID of the asset in Tenable.io. Use this value as the unique key for the asset. + description: The UUID of the asset in Tenable Vulnerability Management. Use this value as the unique key for the asset. - name: installed_software type: keyword description: A list of Common Platform Enumeration (CPE) values that represent software applications a scan identified as present on an asset. This attribute supports the CPE 2.2 format. @@ -126,7 +126,7 @@ description: The time and date of the last credentialed scan run on the asset. - name: last_licensed_scan_date type: date - description: The time and date of the last scan that identified the asset as licensed. Tenable.io categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days. + description: The time and date of the last scan that identified the asset as licensed. Tenable Vulnerability Management categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days. - name: last_scan_id type: keyword description: The UUID of the scan configuration used during the last scan of the asset. diff --git a/packages/tenable_io/data_stream/asset/manifest.yml b/packages/tenable_io/data_stream/asset/manifest.yml index 4df009e262b..87cfe951691 100644 --- a/packages/tenable_io/data_stream/asset/manifest.yml +++ b/packages/tenable_io/data_stream/asset/manifest.yml @@ -1,23 +1,23 @@ -title: Collect Asset logs from Tenable.io +title: Collect Asset data from Tenable Vulnerability Management type: logs streams: - input: httpjson - title: Asset logs - description: Collect asset logs from Tenable.io. + title: Asset data + description: Collect asset data from Tenable Vulnerability Management. template_path: httpjson.yml.hbs vars: - name: interval type: text title: Interval - description: "Duration between requests to the Tenable.io. NOTE: Supported units for this parameter are h/m/s." - default: 5m + description: "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." + default: 1h multi: false required: true show_user: true - name: initial_interval type: text title: Initial Interval - description: "How far back to pull the asset events from Tenable.io. NOTE: Supported units for this parameter are h/m/s." + description: "How far back to pull the asset events from Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." multi: false required: true show_user: true @@ -49,7 +49,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false @@ -86,4 +86,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the data is parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tenable_io/data_stream/asset/sample_event.json b/packages/tenable_io/data_stream/asset/sample_event.json index f91b197e1ce..cf172476815 100644 --- a/packages/tenable_io/data_stream/asset/sample_event.json +++ b/packages/tenable_io/data_stream/asset/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-12-31T22:27:58.599Z", "agent": { - "ephemeral_id": "aaad454b-3662-41fc-a55d-5c164947a6aa", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "cloud": { "availability_zone": "12", @@ -22,21 +22,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "host" ], - "created": "2023-05-23T16:59:30.688Z", + "created": "2023-09-12T08:47:10.442Z", "dataset": "tenable_io.asset", - "ingested": "2023-05-23T16:59:31Z", + "ingested": "2023-09-12T08:47:11Z", "kind": "state", "original": "{\"acr_score\":\"3\",\"agent_names\":[],\"agent_uuid\":\"22\",\"aws_availability_zone\":null,\"aws_ec2_instance_ami_id\":\"12\",\"aws_ec2_instance_group_name\":null,\"aws_ec2_instance_id\":\"12\",\"aws_ec2_instance_state_name\":null,\"aws_ec2_instance_type\":null,\"aws_ec2_name\":null,\"aws_ec2_product_code\":null,\"aws_owner_id\":\"44\",\"aws_region\":null,\"aws_subnet_id\":null,\"aws_vpc_id\":null,\"azure_resource_id\":\"12\",\"azure_vm_id\":\"12\",\"bigfix_asset_id\":null,\"bios_uuid\":\"33\",\"created_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_by\":\"user\",\"exposure_score\":\"721\",\"first_scan_time\":\"2017-12-31T20:40:23.447Z\",\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"fqdns\":[\"example.com\"],\"gcp_instance_id\":\"12\",\"gcp_project_id\":\"12\",\"gcp_zone\":\"12\",\"has_agent\":false,\"has_plugin_results\":true,\"hostnames\":[],\"id\":\"95c2725c-7298-4a44-8a1d-63131ca3f01f\",\"installed_software\":[\"cpe:/a:test:xyz:12.8\",\"cpe:/a:test:abc:7.7.3\",\"cpe:/a:test:pqr:6.9\",\"cpe:/a:test:xyz\"],\"ipv4s\":[\"89.160.20.112\"],\"ipv6s\":[],\"last_authenticated_scan_date\":\"2017-12-31T20:40:44.535Z\",\"last_licensed_scan_date\":\"2018-12-31T22:27:52.869Z\",\"last_scan_id\":\"00283024-afee-44ea-b467-db5a6ed9fd50ab8f7ecb158c480e\",\"last_scan_time\":\"2018-03-31T22:27:52.869Z\",\"last_schedule_id\":\"72284901-7c68-42b2-a0c4-c1e75568849df60557ee0e264228\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"mac_addresses\":[],\"manufacturer_tpm_ids\":[],\"mcafee_epo_agent_guid\":null,\"mcafee_epo_guid\":null,\"netbios_names\":[],\"network_interfaces\":[{\"fqdns\":[\"example.com\"],\"ipv4s\":[\"89.160.20.112\",\"81.2.69.144\"],\"ipv6s\":[\"2a02:cf40::\"],\"mac_addresses\":[\"00-00-5E-00-53-00\",\"00-00-5E-00-53-FF\"],\"name\":\"test.0.1234\"}],\"operating_systems\":[],\"qualys_asset_ids\":[],\"qualys_host_ids\":[],\"servicenow_sysid\":null,\"sources\":[{\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"name\":\"TEST_SCAN\"}],\"ssh_fingerprints\":[],\"symantec_ep_hardware_keys\":[],\"system_types\":[],\"tags\":[{\"added_at\":\"2018-12-31T14:53:13.817Z\",\"added_by\":\"ac2e7ef6-fac9-47bf-9170-617331322885\",\"key\":\"Geographic Area\",\"uuid\":\"47e7f5f6-1013-4401-a705-479bfadc7826\",\"value\":\"APAC\"}],\"terminated_at\":\"2017-12-31T20:40:44.535Z\",\"terminated_by\":\"user\",\"updated_at\":\"2018-12-31T22:27:58.599Z\"}", "type": [ diff --git a/packages/tenable_io/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json b/packages/tenable_io/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json index 6b994a59bb5..934b12bcb55 100644 --- a/packages/tenable_io/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json +++ b/packages/tenable_io/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-07-19T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", @@ -140,7 +140,7 @@ { "@timestamp": "2019-09-30T00:00:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "state", diff --git a/packages/tenable_io/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_io/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml index 82df8e3da24..6c8e27f008e 100644 --- a/packages/tenable_io/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_io/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml @@ -1,9 +1,9 @@ --- -description: Pipeline for processing Tenable.io plugin logs. +description: Pipeline for processing Tenable Vulnerability Management plugin logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.type value: [info] diff --git a/packages/tenable_io/data_stream/plugin/fields/fields.yml b/packages/tenable_io/data_stream/plugin/fields/fields.yml index 0b5f8421b79..0266f507de4 100644 --- a/packages/tenable_io/data_stream/plugin/fields/fields.yml +++ b/packages/tenable_io/data_stream/plugin/fields/fields.yml @@ -217,7 +217,7 @@ description: A value specifying whether Tenable predicted the CVSSv3 impact score for the vulnerability because NVD did not provide one (true) or used the NVD-provided CVSSv3 impact score (false) when calculating the VPR. - name: cvss3_impact_score type: double - description: The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable.io displays a Tenable-predicted score. + description: The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable Vulnerability Management displays a Tenable-predicted score. - name: exploit_code_maturity type: keyword description: The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources (for example, Reversinglabs, Exploit-db, Metasploit, etc.). The possible values ("High", "Functional", "PoC", or "Unproven") parallel the CVSS Exploit Code Maturity categories. @@ -244,7 +244,7 @@ description: The Vulnerability Priority Rating (VPR) for the vulnerability. If a plugin is designed to detect multiple vulnerabilities, the VPR represents the highest value calculated for a vulnerability associated with the plugin. - name: updated type: date - description: The ISO timestamp when Tenable.io last imported the VPR for this vulnerability. Tenable.io imports updated VPR values every time you run a scan. + description: The ISO timestamp when Tenable Vulnerability Management last imported the VPR for this vulnerability. Tenable Vulnerability Management imports updated VPR values every time you run a scan. - name: vuln_publication_date type: date - name: xref diff --git a/packages/tenable_io/data_stream/plugin/manifest.yml b/packages/tenable_io/data_stream/plugin/manifest.yml index 24a894afe1b..9b172cbd510 100644 --- a/packages/tenable_io/data_stream/plugin/manifest.yml +++ b/packages/tenable_io/data_stream/plugin/manifest.yml @@ -1,23 +1,23 @@ -title: Collect Plugin logs from Tenable.io +title: Collect Plugin logs from Tenable Vulnerability Management type: logs streams: - input: httpjson template_path: httpjson.yml.hbs title: Plugin logs - description: Collect plugin logs from Tenable.io. + description: Collect plugin logs from Tenable Vulnerability Management. vars: - name: interval type: text title: Interval - description: "Duration between requests to the Tenable.io. NOTE: Supported units for this parameter are h/m/s." - default: 5m + description: "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." + default: 24h multi: false required: true show_user: true - name: initial_interval type: integer title: Initial Interval - description: "How far back to pull the plugin data from Tenable.io. NOTE: Provide the number of days in positive integer value only. e.g. 5" + description: "How far back to pull the plugin data from Tenable Vulnerability Management. NOTE: Provide the number of days in positive integer value only. e.g. 5" multi: false required: true show_user: true @@ -33,7 +33,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/tenable_io/data_stream/plugin/sample_event.json b/packages/tenable_io/data_stream/plugin/sample_event.json index 34aaf8c0f5f..539379a7ab5 100644 --- a/packages/tenable_io/data_stream/plugin/sample_event.json +++ b/packages/tenable_io/data_stream/plugin/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2018-07-19T00:00:00.000Z", "agent": { - "ephemeral_id": "319b150f-2992-417b-9a99-84fb3f8042a0", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.plugin", @@ -13,18 +13,18 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "created": "2023-05-23T17:00:08.911Z", + "created": "2023-09-12T08:47:48.515Z", "dataset": "tenable_io.plugin", - "ingested": "2023-05-23T17:00:12Z", + "ingested": "2023-09-12T08:47:49Z", "kind": "state", "original": "{\"attributes\":{\"cpe\":[\"p-cpe:/a:fedoraproject:fedora:kernel-source\",\"cpe:/o:fedoraproject:fedora_core:1\",\"p-cpe:/a:fedoraproject:fedora:kernel-BOOT\",\"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo\",\"p-cpe:/a:fedoraproject:fedora:kernel\",\"p-cpe:/a:fedoraproject:fedora:kernel-doc\",\"p-cpe:/a:fedoraproject:fedora:kernel-smp\"],\"cve\":[\"CVE-2003-0984\"],\"cvss3_base_score\":0,\"cvss3_temporal_score\":0,\"cvss_base_score\":4.6,\"cvss_temporal_score\":0,\"cvss_vector\":{\"AccessComplexity\":\"Low\",\"AccessVector\":\"Local-access\",\"Authentication\":\"None required\",\"Availability-Impact\":\"Partial\",\"Confidentiality-Impact\":\"Partial\",\"Integrity-Impact\":\"Partial\",\"raw\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\"},\"default_account\":false,\"description\":\"Various RTC drivers had the potential to leak...\",\"exploit_available\":false,\"exploit_framework_canvas\":false,\"exploit_framework_core\":false,\"exploit_framework_d2_elliot\":false,\"exploit_framework_exploithub\":false,\"exploit_framework_metasploit\":false,\"exploited_by_malware\":false,\"exploited_by_nessus\":false,\"has_patch\":true,\"in_the_news\":false,\"malware\":false,\"patch_publication_date\":\"2004-01-07T00:00:00Z\",\"plugin_modification_date\":\"2018-07-19T00:00:00Z\",\"plugin_publication_date\":\"2004-07-23T00:00:00Z\",\"plugin_type\":\"local\",\"plugin_version\":\"1.17\",\"risk_factor\":\"Medium\",\"see_also\":[\"http://example.com/u?07bc9e7f\"],\"solution\":\"Update the affected packages.\",\"synopsis\":\"The remote Fedora Core host is missing a security update.\",\"unsupported_by_vendor\":false,\"vpr\":{\"drivers\":{\"age_of_vuln\":{\"lower_bound\":366,\"upper_bound\":730},\"cvss3_impact_score\":5.9,\"cvss_impact_score_predicted\":false,\"exploit_code_maturity\":\"UNPROVEN\",\"product_coverage\":\"LOW\",\"threat_intensity_last28\":\"VERY_LOW\",\"threat_recency\":{\"lower_bound\":366,\"upper_bound\":730},\"threat_sources_last28\":[\"No recorded events\"]},\"score\":5.5,\"updated\":\"2018-07-19T00:00:00Z\"},\"xref\":[\"FEDORA:2003-047\"],\"xrefs\":[{\"id\":\"2003-047\",\"type\":\"FEDORA\"}]},\"id\":13670,\"name\":\"Fedora Core 1 : kernel-2.4.22-1.2140.nptl (2003-047)\"}", "type": [ diff --git a/packages/tenable_io/data_stream/scan/_dev/test/pipeline/test-scan.log-expected.json b/packages/tenable_io/data_stream/scan/_dev/test/pipeline/test-scan.log-expected.json index 255a4037dbc..f790b83275b 100644 --- a/packages/tenable_io/data_stream/scan/_dev/test/pipeline/test-scan.log-expected.json +++ b/packages/tenable_io/data_stream/scan/_dev/test/pipeline/test-scan.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -57,7 +57,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tenable_io/data_stream/scan/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_io/data_stream/scan/elasticsearch/ingest_pipeline/default.yml index 31f68a91947..258518b65b7 100755 --- a/packages/tenable_io/data_stream/scan/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_io/data_stream/scan/elasticsearch/ingest_pipeline/default.yml @@ -1,9 +1,9 @@ --- -description: Pipeline for processing Tenable.io scanner logs. +description: Pipeline for processing Tenable Vulnerability Management scanner logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.category value: [configuration] diff --git a/packages/tenable_io/data_stream/scan/fields/fields.yml b/packages/tenable_io/data_stream/scan/fields/fields.yml index aec913187b4..6080557614e 100755 --- a/packages/tenable_io/data_stream/scan/fields/fields.yml +++ b/packages/tenable_io/data_stream/scan/fields/fields.yml @@ -15,10 +15,10 @@ description: The unique ID of the scan. - name: last_modification_date type: date - description: For newly-created scans, the date on which the scan configuration was created. For scans that have been launched at least once, this attribute does not represent the date on which the scan configuration was last modified. Instead, it represents the date on which the scan was last launched, in Unix time format. Tenable.io updates this attribute each time the scan launches. + description: For newly-created scans, the date on which the scan configuration was created. For scans that have been launched at least once, this attribute does not represent the date on which the scan configuration was last modified. Instead, it represents the date on which the scan was last launched, in Unix time format. Tenable Vulnerability Management updates this attribute each time the scan launches. - name: legacy type: boolean - description: A value indicating whether the scan results were created before a change in storage method. If true, Tenable.io stores the results in the old storage method. If false, Tenable.io stores the results in the new storage method. + description: A value indicating whether the scan results were created before a change in storage method. If true, Tenable Vulnerability Management stores the results in the old storage method. If false, Tenable Vulnerability Management stores the results in the new storage method. - name: name type: keyword description: The name of the scan. @@ -30,7 +30,7 @@ description: The unique ID of the user-defined template (policy) on which the scan configuration is based. - name: read type: boolean - description: A value indicating whether the user account associated with the request message has viewed the scan in the Tenable.io user interface. If 1, the user account has viewed the scan results. + description: A value indicating whether the user account associated with the request message has viewed the scan in the Tenable Vulnerability Management user interface. If 1, the user account has viewed the scan results. - name: rrules type: keyword description: The interval at which the scan repeats. The interval is formatted as a string of three values delimited by semi-colons. These values are the frequency (FREQ=ONETIME or DAILY or WEEKLY or MONTHLY or YEARLY), the interval (INTERVAL=1 or 2 or 3 ... x), and the days of the week (BYDAY=SU,MO,TU,WE,TH,FR,SA). For a scan that runs every three weeks on Monday Wednesday and Friday, the string would be FREQ=WEEKLY;INTERVAL=3;BYDAY=MO,WE,FR. If the scan is not scheduled to recur, this attribute is null. For more information, see rrules Format. diff --git a/packages/tenable_io/data_stream/scan/manifest.yml b/packages/tenable_io/data_stream/scan/manifest.yml index 5cd5909e3a0..d7a83389a77 100755 --- a/packages/tenable_io/data_stream/scan/manifest.yml +++ b/packages/tenable_io/data_stream/scan/manifest.yml @@ -1,16 +1,17 @@ -title: Collect Scan logs from Tenable.io +title: Collect Scan logs from Tenable Vulnerability Management type: logs streams: - input: httpjson + enabled: false template_path: httpjson.yml.hbs title: Scan logs - description: Collect Scan logs from Tenable.io. + description: Collect Scan logs from Tenable Vulnerability Management. vars: - name: interval type: text title: Interval - description: "Duration between requests to the Tenable.io. NOTE: Supported units for this parameter are h/m/s." - default: 5m + description: "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." + default: 24h multi: false required: true show_user: true @@ -33,7 +34,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/tenable_io/data_stream/scan/sample_event.json b/packages/tenable_io/data_stream/scan/sample_event.json index d421c6488da..8a0d0cde990 100755 --- a/packages/tenable_io/data_stream/scan/sample_event.json +++ b/packages/tenable_io/data_stream/scan/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-05-23T17:00:49.842Z", + "@timestamp": "2023-09-12T08:48:29.597Z", "agent": { - "ephemeral_id": "8cd5058c-f934-44d2-91c5-29298fe980ec", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.scan", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "configuration" ], - "created": "2023-05-23T17:00:49.842Z", + "created": "2023-09-12T08:48:29.597Z", "dataset": "tenable_io.scan", - "ingested": "2023-05-23T17:00:50Z", + "ingested": "2023-09-12T08:48:30Z", "kind": "state", "original": "{\"control\":true,\"creation_date\":1683282785,\"enabled\":true,\"has_triggers\":false,\"id\":195,\"last_modification_date\":1683283158,\"legacy\":false,\"name\":\"Client Discovery\",\"owner\":\"jdoe@contoso.com\",\"permissions\":128,\"policy_id\":194,\"progress\":100,\"read\":false,\"rrules\":\"FREQ=WEEKLY;INTERVAL=1;BYDAY=FR\",\"schedule_uuid\":\"11c56dea-as5f-65ce-ad45-9978045df65ecade45b6e3a76871\",\"shared\":true,\"starttime\":\"20220708T033000\",\"status\":\"completed\",\"status_times\":{\"initializing\":2623,\"pending\":52799,\"processing\":1853,\"publishing\":300329,\"running\":15759},\"template_uuid\":\"a1efc3b4-cd45-a65d-fbc4-0079ebef4a56cd32a05ec2812bcf\",\"timezone\":\"America/Los_Angeles\",\"total_targets\":21,\"type\":\"remote\",\"user_permissions\":128,\"uuid\":\"a456ef1c-cbd4-ad41-f654-119b766ff61f\",\"wizard_uuid\":\"32cbd657-fe65-a45e-a45f-0079eb89e56a1c23fd5ec2812bcf\"}", "type": [ diff --git a/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log b/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log deleted file mode 100755 index 4d74db538cc..00000000000 --- a/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log +++ /dev/null @@ -1,2 +0,0 @@ -{"creation_date":1675116552,"distro":"ubuntu1404-x86-64","engine_version":"19.5.1","group":false,"hostname":"Scanner01","id":123456,"ip_addresses":["10.0.1.27"],"key":"abc12345asdfgf360d024dffe0825e7bb720836c7fbc5edfab381a2g5j8ekb8ge654","last_connect":1683306752,"last_modification_date":1683240024,"linked":1,"loaded_plugin_set":"202305041959","name":"Scanner01","network_name":"Default","num_scans":0,"owner":"system","owner_id":9876543,"owner_name":"system","owner_uuid":"05f82b52-bd61-1234-abcd-cd952dd169d7","platform":"LINUX","pool":false,"remote_uuid":"7bb2674b-144f-asdf-1234-asdf1234qwerty56ff45dac8ead3","scan_count":0,"shared":1,"source":"service","status":"on","supports_remote_logs":true,"supports_remote_settings":true,"supports_webapp":false,"timestamp":1683240024,"type":"managed","ui_build":"8","ui_version":"10.5.1","user_permissions":128,"uuid":"10cba99e-4321-fdsa-trew-270126abc706"} -{"creation_date":1603821746,"group":true,"id":183026,"key":"db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199","last_connect":null,"last_modification_date":1603821746,"license":{"record_id":"0016000001JHk71AAD","type":"vm","activation_code":"6ZF7-PTXA-HR8R","agents":-1,"ips":11000,"scanners":-1,"users":-1,"enterprise_pause":false,"expiration_date":1704326399,"evaluation":false,"apps":{"pci":{"mode":"basic"},"was":{"mode":"eval","expiration_date":1659585599,"ui_mode":"NEW"},"consec":{"mode":"eval","expiration_date":1658289599},"lumin":{"mode":"standard","expiration_date":1704326399,"assets":11000,"activation_code":"T7FN-VHTJ-68J4"},"vm":{"assets":11000,"vm_expiration_date":1704326399,"vm_activation_code":"6ZF7-PTXA-HR8R","agents":0},"cns":{"mode":"eval","expiration_date":1663473599}},"scanners_used":10,"agents_used":4286},"linked":1,"name":"APAC Cloud Scanners","network_name":"Default","num_scans":0,"owner":"system","owner_id":2121709,"owner_name":"system","owner_uuid":"05f82b52-bd61-4d3f-9b5e-cd952dd169d7","pool":true,"scan_count":0,"shared":1,"source":"service","status":"on","timestamp":1603821746,"type":"local","user_permissions":64,"uuid":"04caef6a-4c36-44ab-ac12-3dcfaefccf82","supports_remote_logs":false,"supports_webapp":true,"supports_remote_settings":false} \ No newline at end of file diff --git a/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log-expected.json b/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log-expected.json deleted file mode 100644 index 66533e2ab59..00000000000 --- a/packages/tenable_io/data_stream/scanner/_dev/test/pipeline/test-scanner.log-expected.json +++ /dev/null @@ -1,180 +0,0 @@ -{ - "expected": [ - { - "ecs": { - "version": "8.8.0" - }, - "event": { - "category": [ - "host" - ], - "kind": "state", - "original": "{\"creation_date\":1675116552,\"distro\":\"ubuntu1404-x86-64\",\"engine_version\":\"19.5.1\",\"group\":false,\"hostname\":\"Scanner01\",\"id\":123456,\"ip_addresses\":[\"10.0.1.27\"],\"key\":\"abc12345asdfgf360d024dffe0825e7bb720836c7fbc5edfab381a2g5j8ekb8ge654\",\"last_connect\":1683306752,\"last_modification_date\":1683240024,\"linked\":1,\"loaded_plugin_set\":\"202305041959\",\"name\":\"Scanner01\",\"network_name\":\"Default\",\"num_scans\":0,\"owner\":\"system\",\"owner_id\":9876543,\"owner_name\":\"system\",\"owner_uuid\":\"05f82b52-bd61-1234-abcd-cd952dd169d7\",\"platform\":\"LINUX\",\"pool\":false,\"remote_uuid\":\"7bb2674b-144f-asdf-1234-asdf1234qwerty56ff45dac8ead3\",\"scan_count\":0,\"shared\":1,\"source\":\"service\",\"status\":\"on\",\"supports_remote_logs\":true,\"supports_remote_settings\":true,\"supports_webapp\":false,\"timestamp\":1683240024,\"type\":\"managed\",\"ui_build\":\"8\",\"ui_version\":\"10.5.1\",\"user_permissions\":128,\"uuid\":\"10cba99e-4321-fdsa-trew-270126abc706\"}", - "type": [ - "info" - ] - }, - "host": { - "hostname": "Scanner01", - "ip": [ - "10.0.1.27" - ], - "name": "Scanner01", - "os": { - "full": "ubuntu1404-x86-64", - "type": "linux" - } - }, - "related": { - "hosts": [ - "Scanner01" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "tenable_io": { - "scanner": { - "creation_date": "2023-01-30T22:09:12.000Z", - "distro": "ubuntu1404-x86-64", - "engine_version": "19.5.1", - "group": false, - "hostname": "Scanner01", - "id": 123456, - "ip_addresses": [ - "10.0.1.27" - ], - "key": "abc12345asdfgf360d024dffe0825e7bb720836c7fbc5edfab381a2g5j8ekb8ge654", - "last_connect": "2023-05-05T17:12:32.000Z", - "last_modification_date": "2023-05-04T22:40:24.000Z", - "linked": true, - "loaded_plugin_set": "202305041959", - "name": "Scanner01", - "network_name": "Default", - "num_scans": 0, - "owner": "system", - "owner_id": 9876543, - "owner_name": "system", - "owner_uuid": "05f82b52-bd61-1234-abcd-cd952dd169d7", - "platform": "LINUX", - "pool": false, - "remote_uuid": "7bb2674b-144f-asdf-1234-asdf1234qwerty56ff45dac8ead3", - "scan_count": 0, - "shared": true, - "source": "service", - "status": "on", - "supports_remote_logs": true, - "supports_remote_settings": true, - "supports_webapp": false, - "timestamp": "2023-05-04T22:40:24.000Z", - "type": "managed", - "ui_build": "8", - "ui_version": "10.5.1", - "user_permissions": 128, - "uuid": "10cba99e-4321-fdsa-trew-270126abc706" - } - } - }, - { - "ecs": { - "version": "8.8.0" - }, - "event": { - "category": [ - "host" - ], - "kind": "state", - "original": "{\"creation_date\":1603821746,\"group\":true,\"id\":183026,\"key\":\"db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199\",\"last_connect\":null,\"last_modification_date\":1603821746,\"license\":{\"record_id\":\"0016000001JHk71AAD\",\"type\":\"vm\",\"activation_code\":\"6ZF7-PTXA-HR8R\",\"agents\":-1,\"ips\":11000,\"scanners\":-1,\"users\":-1,\"enterprise_pause\":false,\"expiration_date\":1704326399,\"evaluation\":false,\"apps\":{\"pci\":{\"mode\":\"basic\"},\"was\":{\"mode\":\"eval\",\"expiration_date\":1659585599,\"ui_mode\":\"NEW\"},\"consec\":{\"mode\":\"eval\",\"expiration_date\":1658289599},\"lumin\":{\"mode\":\"standard\",\"expiration_date\":1704326399,\"assets\":11000,\"activation_code\":\"T7FN-VHTJ-68J4\"},\"vm\":{\"assets\":11000,\"vm_expiration_date\":1704326399,\"vm_activation_code\":\"6ZF7-PTXA-HR8R\",\"agents\":0},\"cns\":{\"mode\":\"eval\",\"expiration_date\":1663473599}},\"scanners_used\":10,\"agents_used\":4286},\"linked\":1,\"name\":\"APAC Cloud Scanners\",\"network_name\":\"Default\",\"num_scans\":0,\"owner\":\"system\",\"owner_id\":2121709,\"owner_name\":\"system\",\"owner_uuid\":\"05f82b52-bd61-4d3f-9b5e-cd952dd169d7\",\"pool\":true,\"scan_count\":0,\"shared\":1,\"source\":\"service\",\"status\":\"on\",\"timestamp\":1603821746,\"type\":\"local\",\"user_permissions\":64,\"uuid\":\"04caef6a-4c36-44ab-ac12-3dcfaefccf82\",\"supports_remote_logs\":false,\"supports_webapp\":true,\"supports_remote_settings\":false}", - "type": [ - "info" - ] - }, - "host": { - "name": "APAC Cloud Scanners" - }, - "related": { - "hosts": [ - "APAC Cloud Scanners" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields" - ], - "tenable_io": { - "scanner": { - "creation_date": "2020-10-27T18:02:26.000Z", - "group": true, - "id": 183026, - "key": "db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199", - "last_modification_date": "2020-10-27T18:02:26.000Z", - "license": { - "activation_code": "6ZF7-PTXA-HR8R", - "agents": -1, - "agents_used": 4286, - "apps": { - "cns": { - "expiration_date": "2022-09-18T03:59:59.000Z", - "mode": "eval" - }, - "consec": { - "expiration_date": "2022-07-20T03:59:59.000Z", - "mode": "eval" - }, - "lumin": { - "activation_code": "T7FN-VHTJ-68J4", - "assets": 11000, - "expiration_date": "2024-01-03T23:59:59.000Z", - "mode": "standard" - }, - "pci": { - "mode": "basic" - }, - "vm": { - "agents": 0, - "assets": 11000, - "vm_activation_code": "6ZF7-PTXA-HR8R", - "vm_expiration_date": 1704326399 - }, - "was": { - "expiration_date": "2022-08-04T03:59:59.000Z", - "mode": "eval", - "ui_mode": "NEW" - } - }, - "enterprise_pause": false, - "evaluation": false, - "expiration_date": "2024-01-03T23:59:59.000Z", - "ips": 11000, - "record_id": "0016000001JHk71AAD", - "scanners": -1, - "scanners_used": 10, - "type": "vm", - "users": -1 - }, - "linked": true, - "name": "APAC Cloud Scanners", - "network_name": "Default", - "num_scans": 0, - "owner": "system", - "owner_id": 2121709, - "owner_name": "system", - "owner_uuid": "05f82b52-bd61-4d3f-9b5e-cd952dd169d7", - "pool": true, - "scan_count": 0, - "shared": true, - "source": "service", - "status": "on", - "supports_remote_logs": false, - "supports_remote_settings": false, - "supports_webapp": true, - "timestamp": "2020-10-27T18:02:26.000Z", - "type": "local", - "user_permissions": 64, - "uuid": "04caef6a-4c36-44ab-ac12-3dcfaefccf82" - } - } - } - ] -} \ No newline at end of file diff --git a/packages/tenable_io/data_stream/scanner/_dev/test/system/test-default-config.yml b/packages/tenable_io/data_stream/scanner/_dev/test/system/test-default-config.yml deleted file mode 100755 index 605aee6927a..00000000000 --- a/packages/tenable_io/data_stream/scanner/_dev/test/system/test-default-config.yml +++ /dev/null @@ -1,10 +0,0 @@ -input: httpjson -service: tenable_io -vars: - hostname: http://{{Hostname}}:{{Port}} - access_key: xxxx - secret_key: xxxx -data_stream: - vars: - preserve_original_event: true - preserve_duplicate_custom_fields: true diff --git a/packages/tenable_io/data_stream/scanner/agent/stream/httpjson.yml.hbs b/packages/tenable_io/data_stream/scanner/agent/stream/httpjson.yml.hbs deleted file mode 100755 index 6d2f16d01fd..00000000000 --- a/packages/tenable_io/data_stream/scanner/agent/stream/httpjson.yml.hbs +++ /dev/null @@ -1,43 +0,0 @@ -config_version: 2 -interval: {{interval}} -{{#if proxy_url}} -request.proxy_url: {{proxy_url}} -{{/if}} -{{#if ssl}} -request.ssl: {{ssl}} -{{/if}} -request.method: GET -request.url: {{hostname}}/scanners -{{#if http_client_timeout}} -request.timeout: {{http_client_timeout}} -{{/if}} -request.transforms: - - delete: - target: header.User-Agent - - set: - # Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header - # NOTE: The "Build" version must be kept in sync with this package's version. - target: header.User-Agent - value: '[[userAgent "Integration/1.0 (Elastic; Tenable.io; Build/0.6.1)"]]' - - set: - target: header.X-ApiKeys - value: 'accessKey={{access_key}}; secretKey={{secret_key}};' -response.split: - target: body.scanners -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#if preserve_duplicate_custom_fields}} - - preserve_duplicate_custom_fields -{{/if}} -{{#each tags as |tag|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/tenable_io/data_stream/scanner/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_io/data_stream/scanner/elasticsearch/ingest_pipeline/default.yml deleted file mode 100644 index 7e24d50a7c6..00000000000 --- a/packages/tenable_io/data_stream/scanner/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,187 +0,0 @@ ---- -description: Pipeline for processing Tenable.io scanner logs. -processors: - - set: - field: ecs.version - value: '8.8.0' - - set: - field: event.category - value: [host] - - set: - field: event.type - value: [info] - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: json - - set: - field: event.kind - value: state - - set: - field: host.hostname - copy_from: json.hostname - ignore_empty_value: true - - set: - field: host.name - copy_from: json.name - ignore_empty_value: true - - set: - field: host.ip - copy_from: json.ip_addresses - ignore_empty_value: true - - remove: - field: host.ip - if: ctx.host?.ip != null && ctx.host.ip[0] == "" - - set: - field: host.os.type - copy_from: json.platform - ignore_empty_value: true - - lowercase: - field: host.os.type - ignore_missing: true - - set: - field: host.os.full - copy_from: json.distro - ignore_empty_value: true - - script: - description: Convert 'json.linked' integer value of '0' or '1' to boolean - lang: painless - source: - if (ctx.json?.linked != null && ctx.json.linked != '') { - if (ctx.json.linked == 0) { - ctx.json.linked = false - } - if (ctx.json.linked == 1) { - ctx.json.linked = true - } - } - - script: - description: Convert 'json.shared' integer value of '0' or '1' to boolean - lang: painless - source: - if (ctx.json?.shared != null && ctx.json.shared != '') { - if (ctx.json.shared == 0) { - ctx.json.shared = false - } - if (ctx.json.shared == 1) { - ctx.json.shared = true - } - } - - date: - field: json.creation_date - target_field: json.creation_date - if: ctx.json?.creation_date != null && ctx.json.creation_date != '' - formats: - - UNIX - - date: - field: json.last_modification_date - target_field: json.last_modification_date - if: ctx.json?.last_modification_date != null && ctx.json.last_modification_date != '' - formats: - - UNIX - - date: - field: json.last_connect - target_field: json.last_connect - if: ctx.json?.last_connect != null && ctx.json.last_connect != '' - formats: - - UNIX - - date: - field: json.license.expiration_date - target_field: json.license.expiration_date - if: ctx.json?.license?.expiration_date != null && ctx.json.license?.expiration_date != '' - formats: - - UNIX - - date: - field: json.license.apps.was.expiration_date - target_field: json.license.apps.was.expiration_date - if: ctx.json?.license?.apps?.was?.expiration_date != null && ctx.json.license.apps.was.expiration_date != '' - formats: - - UNIX - - date: - field: json.license.apps.consec.expiration_date - target_field: json.license.apps.consec.expiration_date - if: ctx.json?.license?.apps?.consec?.expiration_date != null && ctx.json.license.apps.consec.expiration_date != '' - formats: - - UNIX - - date: - field: json.license.apps.lumin.expiration_date - target_field: json.license.apps.lumin.expiration_date - if: ctx.json?.license?.apps?.lumin?.expiration_date != null && ctx.json.license.apps.lumin.expiration_date != '' - formats: - - UNIX - - date: - field: json.license.apps.vm.expiration_date - target_field: json.license.apps.vm.expiration_date - if: ctx.json?.license?.apps?.vm?.expiration_date != null && ctx.json.license.apps.vm.expiration_date != '' - formats: - - UNIX - - date: - field: json.license.apps.cns.expiration_date - target_field: json.license.apps.cns.expiration_date - if: ctx.json?.license?.apps?.cns?.expiration_date != null && ctx.json.license.apps.cns.expiration_date != '' - formats: - - UNIX - - date: - field: json.timestamp - target_field: json.timestamp - if: ctx.json?.timestamp != null && ctx.json.timestamp != '' - formats: - - UNIX - - append: - field: related.hosts - value: - - "{{host.name}}" - if: ctx.host?.name != null && ctx.host.name != "" - allow_duplicates: false - - foreach: - field: host.ip - if: ctx.host?.ip instanceof List - processor: - append: - field: related.ip - if: ctx._ingest?._value != null && ctx._ingest._value != "" - value: '{{{_ingest._value}}}' - allow_duplicates: false - - remove: - if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) - field: - - json.ip_addresses - - json.hostname - - json.name - - json.platform - - json.distro - ignore_missing: true - - remove: - field: event.original - if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) - ignore_missing: true - - rename: - field: json - target_field: tenable_io.scanner - - script: - description: Drops null/empty values recursively. - lang: painless - source: - boolean dropEmptyFields(Object object) { - if (object == null || object == '') { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); -on_failure: - - append: - field: error.message - value: '{{{ _ingest.on_failure_message }}}' - - set: - field: event.kind - value: pipeline_error diff --git a/packages/tenable_io/data_stream/scanner/fields/agent.yml b/packages/tenable_io/data_stream/scanner/fields/agent.yml deleted file mode 100755 index e313ec82874..00000000000 --- a/packages/tenable_io/data_stream/scanner/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/tenable_io/data_stream/scanner/fields/base-fields.yml b/packages/tenable_io/data_stream/scanner/fields/base-fields.yml deleted file mode 100755 index f6dc406f725..00000000000 --- a/packages/tenable_io/data_stream/scanner/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: tenable_io -- name: event.dataset - type: constant_keyword - description: Event dataset - value: tenable_io.scanner -- name: '@timestamp' - type: date - description: Event timestamp. diff --git a/packages/tenable_io/data_stream/scanner/fields/ecs.yml b/packages/tenable_io/data_stream/scanner/fields/ecs.yml deleted file mode 100755 index a9578688660..00000000000 --- a/packages/tenable_io/data_stream/scanner/fields/ecs.yml +++ /dev/null @@ -1,18 +0,0 @@ -- external: ecs - name: ecs.version -- external: ecs - name: event.category -- external: ecs - name: event.created -- external: ecs - name: event.kind -- external: ecs - name: event.type -- external: ecs - name: message -- external: ecs - name: related.hosts -- external: ecs - name: related.ip -- external: ecs - name: tags diff --git a/packages/tenable_io/data_stream/scanner/fields/fields.yml b/packages/tenable_io/data_stream/scanner/fields/fields.yml deleted file mode 100755 index 3e2cee1d7cc..00000000000 --- a/packages/tenable_io/data_stream/scanner/fields/fields.yml +++ /dev/null @@ -1,197 +0,0 @@ -- name: tenable_io.scanner - type: group - fields: - - name: creation_date - type: date - description: The timestamp when the scanner was created. This attribute specifies the original creation date if the scanner was migrated. - - name: distro - type: keyword - description: The scanner operating system distribution. - - name: engine_version - type: keyword - description: The Tenabler scanner engine version - - name: group - type: boolean - description: Indicates whether the scanner belongs to a scanner group ('true') or not ('false'). - - name: hostname - type: keyword - description: The hostname of the scanner. - - name: id - type: long - description: The unique ID of the scanner. - - name: ip_addresses - type: ip - description: A list of IP addresses associated with the scanner. - - name: key - type: keyword - description: The linking key, that is, the alpha-numeric sequence of characters you use to link a scanner to Tenable.io. - - name: last_connect - type: date - description: The timestamp when any of the scanner's tasks have provided its last update. - - name: last_modification_date - type: date - description: The timestamp when the scanner was last modified. - - name: license - type: group - fields: - - name: record_id - type: keyword - description: License identifier for the scanner. - - name: type - type: keyword - description: The license type. - - name: activation_code - type: keyword - description: The activation code for the scanner. - - name: agents - type: long - description: The number of agents the scanner is licensed to use. - - name: ips - type: long - description: The number of hosts the scanner is licensed to use. - - name: scanners - type: long - description: The number of scanners the scanner is licensed to use. - - name: users - type: long - description: The number of users the scanner is licensed to use. - - name: enterprise_pause - type: boolean - - name: expiration_date - type: date - description: The date of expiration for this scanner's license. - - name: evaluation - type: boolean - description: Indicates whether the license is an evaluation license. - - name: apps - type: group - fields: - - name: pci - type: group - fields: - - name: mode - type: keyword - - name: was - type: group - fields: - - name: mode - type: keyword - - name: expiration_date - type: date - - name: ui_mode - type: keyword - - name: consec - type: group - fields: - - name: mode - type: keyword - - name: expiration_date - type: date - - name: lumin - type: group - fields: - - name: mode - type: keyword - - name: expiration_date - type: date - - name: assets - type: long - - name: activation_code - type: keyword - - name: vm - type: group - fields: - - name: agents - type: long - - name: assets - type: long - - name: vm_expiration_date - type: date - - name: vm_activation_code - type: keyword - - name: cns - type: group - fields: - - name: mode - type: keyword - - name: expiration_date - type: date - - name: scanners_used - type: long - - name: agents_used - type: long - - name: linked - type: boolean - description: Specifies whether you disabled (False) or enabled (True) the scanner. - - name: loaded_plugin_set - type: keyword - description: The current plugin set on the scanner. - - name: name - type: keyword - description: The user-defined name of the scanner. - - name: network_name - type: keyword - description: The name of the network object associated with the scanner. - - name: num_scans - type: long - description: The number of scans (tasks) the scanner is currently executing. - - name: owner - type: keyword - description: The owner of the scanner. - - name: owner_id - type: long - description: The ID of the owner of the scanner. - - name: owner_name - type: keyword - description: The username of the owner of the scanner. - - name: owner_uuid - type: keyword - description: The UUID of the owner of the scanner. - - name: platform - type: keyword - description: The platform of the scanner. - - name: pool - type: boolean - description: Indicates whether the scanner is part of a scanner group ('true') or not ('false'). - - name: remote_uuid - type: keyword - description: The UUID of the Nessus installation on the scanner. - - name: scan_count - type: long - description: The number of scans that the scanner is currently running. - - name: shared - type: boolean - description: Indicates whether anyone other than the scanner owner has explicit access to the scanner. - - name: source - type: keyword - description: Always set to service. - - name: status - type: keyword - description: The status of the scanner (on or off). - - name: supports_remote_logs - type: boolean - description: Indicates if the scanner supports remote logging. - - name: supports_remote_settings - type: boolean - description: Indicates if the scanner supports remote settings. - - name: supports_webapp - type: boolean - description: Indicates if the scanner supports web application scanning. - - name: timestamp - type: date - description: Equivalent to the last_modification_date attribute. - - name: type - type: keyword - description: The type of scanner (local, managed, managed_pvs, pool, remote, or webapp). - - name: ui_build - type: keyword - description: The backend build of Nessus that is running on the scanner. - - name: ui_version - type: keyword - description: The backend version of Nessus that is running on the scanner. - - name: uuid - type: keyword - description: The UUID of the scanner. - - name: user_permissions - type: long - description: The permissions you (the current user) have been assigned for the scanner. See Permissions. diff --git a/packages/tenable_io/data_stream/scanner/fields/overridden-ecs.yml b/packages/tenable_io/data_stream/scanner/fields/overridden-ecs.yml deleted file mode 100755 index 230ed31e27c..00000000000 --- a/packages/tenable_io/data_stream/scanner/fields/overridden-ecs.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: event.original - type: keyword - ignore_above: 8191 - description: Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. diff --git a/packages/tenable_io/data_stream/scanner/manifest.yml b/packages/tenable_io/data_stream/scanner/manifest.yml deleted file mode 100755 index 21de6a5073c..00000000000 --- a/packages/tenable_io/data_stream/scanner/manifest.yml +++ /dev/null @@ -1,73 +0,0 @@ -title: Collect Scanner logs from Tenable.io -type: logs -streams: - - input: httpjson - template_path: httpjson.yml.hbs - title: Scanner logs - description: Collect Scanner logs from Tenable.io. - vars: - - name: interval - type: text - title: Interval - description: "Duration between requests to the Tenable.io. NOTE: Supported units for this parameter are h/m/s." - default: 5m - multi: false - required: true - show_user: true - - name: retry_wait_min - type: text - title: Minimum Wait Time - multi: false - required: true - show_user: false - default: 60s - description: The minimum time to wait before a retry is attempted. - - name: retry_max_attempts - type: integer - title: Max Retries - multi: false - required: true - show_user: false - default: 10 - description: The maximum number of retries for the HTTP client. - - name: http_client_timeout - type: text - title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." - multi: false - required: true - show_user: false - default: 30s - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - tenable_io-scanner - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original`. - type: bool - multi: false - default: false - - name: preserve_duplicate_custom_fields - required: true - show_user: false - title: Preserve duplicate custom fields - description: Preserve tenable_io.asset fields that were copied to Elastic Common Schema (ECS) fields. - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tenable_io/data_stream/scanner/sample_event.json b/packages/tenable_io/data_stream/scanner/sample_event.json deleted file mode 100755 index b3136c90865..00000000000 --- a/packages/tenable_io/data_stream/scanner/sample_event.json +++ /dev/null @@ -1,127 +0,0 @@ -{ - "@timestamp": "2023-05-23T17:01:28.893Z", - "agent": { - "ephemeral_id": "e3c42c6e-eaa7-45a1-95bc-60bdca8f29d9", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.9.0" - }, - "data_stream": { - "dataset": "tenable_io.scanner", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.8.0" - }, - "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "host" - ], - "created": "2023-05-23T17:01:28.893Z", - "dataset": "tenable_io.scanner", - "ingested": "2023-05-23T17:01:32Z", - "kind": "state", - "original": "{\"creation_date\":1603821746,\"group\":true,\"id\":123456,\"key\":\"db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199\",\"last_connect\":null,\"last_modification_date\":1603821746,\"license\":{\"activation_code\":\"7A1F-BT5R-7B5R\",\"agents\":-1,\"agents_used\":4286,\"apps\":{\"cns\":{\"expiration_date\":1663473599,\"mode\":\"eval\"},\"consec\":{\"expiration_date\":1658289599,\"mode\":\"eval\"},\"lumin\":{\"activation_code\":\"T8G9-A1EG-ERT4\",\"assets\":11000,\"expiration_date\":1704326399,\"mode\":\"standard\"},\"pci\":{\"mode\":\"basic\"},\"vm\":{\"agents\":0,\"assets\":11000,\"vm_activation_code\":\"TB7R-QWEG-ASD8\",\"vm_expiration_date\":1704326399},\"was\":{\"expiration_date\":1659585599,\"mode\":\"eval\",\"ui_mode\":\"NEW\"}},\"enterprise_pause\":false,\"evaluation\":false,\"expiration_date\":1704326399,\"ips\":11000,\"record_id\":\"001600000ASDA71CCD\",\"scanners\":-1,\"scanners_used\":10,\"type\":\"vm\",\"users\":-1},\"linked\":1,\"name\":\"APAC Cloud Scanners\",\"network_name\":\"Default\",\"num_scans\":0,\"owner\":\"system\",\"owner_id\":1258789,\"owner_name\":\"system\",\"owner_uuid\":\"ab12we5wr-asdf1-etah5-asd8-d5yhf7ew4394\",\"pool\":true,\"scan_count\":0,\"shared\":1,\"source\":\"service\",\"status\":\"on\",\"supports_remote_logs\":false,\"supports_remote_settings\":false,\"supports_webapp\":true,\"timestamp\":1603821746,\"type\":\"local\",\"user_permissions\":64,\"uuid\":\"akd78gte-d58g-adsd-34fg-4fde5ugh52dw\"}", - "type": [ - "info" - ] - }, - "host": { - "name": "APAC Cloud Scanners" - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "APAC Cloud Scanners" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "tenable_io-scanner" - ], - "tenable_io": { - "scanner": { - "creation_date": "2020-10-27T18:02:26.000Z", - "group": true, - "id": 123456, - "key": "db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199", - "last_modification_date": "2020-10-27T18:02:26.000Z", - "license": { - "activation_code": "7A1F-BT5R-7B5R", - "agents": -1, - "agents_used": 4286, - "apps": { - "cns": { - "expiration_date": "2022-09-18T03:59:59.000Z", - "mode": "eval" - }, - "consec": { - "expiration_date": "2022-07-20T03:59:59.000Z", - "mode": "eval" - }, - "lumin": { - "activation_code": "T8G9-A1EG-ERT4", - "assets": 11000, - "expiration_date": "2024-01-03T23:59:59.000Z", - "mode": "standard" - }, - "pci": { - "mode": "basic" - }, - "vm": { - "agents": 0, - "assets": 11000, - "vm_activation_code": "TB7R-QWEG-ASD8", - "vm_expiration_date": 1704326399 - }, - "was": { - "expiration_date": "2022-08-04T03:59:59.000Z", - "mode": "eval", - "ui_mode": "NEW" - } - }, - "enterprise_pause": false, - "evaluation": false, - "expiration_date": "2024-01-03T23:59:59.000Z", - "ips": 11000, - "record_id": "001600000ASDA71CCD", - "scanners": -1, - "scanners_used": 10, - "type": "vm", - "users": -1 - }, - "linked": true, - "name": "APAC Cloud Scanners", - "network_name": "Default", - "num_scans": 0, - "owner": "system", - "owner_id": 1258789, - "owner_name": "system", - "owner_uuid": "ab12we5wr-asdf1-etah5-asd8-d5yhf7ew4394", - "pool": true, - "scan_count": 0, - "shared": true, - "source": "service", - "status": "on", - "supports_remote_logs": false, - "supports_remote_settings": false, - "supports_webapp": true, - "timestamp": "2020-10-27T18:02:26.000Z", - "type": "local", - "user_permissions": 64, - "uuid": "akd78gte-d58g-adsd-34fg-4fde5ugh52dw" - } - } -} \ No newline at end of file diff --git a/packages/tenable_io/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json b/packages/tenable_io/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json index 2777109d53f..012311ff124 100644 --- a/packages/tenable_io/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json +++ b/packages/tenable_io/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json @@ -1,9 +1,9 @@ { "expected": [ { - "@timestamp": "2022-11-30T14:09:12.061Z", + "@timestamp": "2018-12-31T20:59:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tenable_io/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_io/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml index 055f85ca883..0eb03ec9f5a 100644 --- a/packages/tenable_io/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_io/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml @@ -1,9 +1,9 @@ --- -description: Pipeline for processing Tenable.io vulnerability logs. +description: Pipeline for processing Tenable Vulnerability Management vulnerability logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.category value: [vulnerability] @@ -47,9 +47,19 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - date: + field: json.last_found + target_field: tenable_io.vulnerability.last_found + formats: + - ISO8601 + if: ctx.json?.last_found != null && ctx.json.last_found != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' - set: field: '@timestamp' - copy_from: tenable_io.vulnerability.indexed + copy_from: tenable_io.vulnerability.last_found ignore_empty_value: true - rename: field: json.asset.netbios_name @@ -883,16 +893,6 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' - - date: - field: json.last_found - target_field: tenable_io.vulnerability.last_found - formats: - - ISO8601 - if: ctx.json?.last_found != null && ctx.json.last_found != '' - on_failure: - - append: - field: error.message - value: '{{{_ingest.on_failure_message}}}' - rename: field: json.state target_field: tenable_io.vulnerability.state @@ -965,6 +965,16 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - fingerprint: + fields: + - tenable_io.vulnerability.plugin.id + - host.ip + - tenable_io.vulnerability.last_found + - tenable_io.vulnerability.port.value + - tenable_io.vulnerability.plugin.modification_date + target_field: _id + method: MurmurHash3 + ignore_missing: true - remove: field: json ignore_missing: true diff --git a/packages/tenable_io/data_stream/vulnerability/fields/fields.yml b/packages/tenable_io/data_stream/vulnerability/fields/fields.yml index 55cdb4182be..88553ec3310 100644 --- a/packages/tenable_io/data_stream/vulnerability/fields/fields.yml +++ b/packages/tenable_io/data_stream/vulnerability/fields/fields.yml @@ -53,7 +53,7 @@ description: The operating system of the asset where a scan found the vulnerability. - name: tracked type: boolean - description: A value specifying whether Tenable.io tracks the asset in the asset management system. Tenable.io still assigns untracked assets identifiers in scan results, but these identifiers change with each new scan of the asset. This parameter is relevant to PCI-type scans and in certain cases where there is not enough information in a scan to identify the asset. Untracked assets appear in the scan history, but do not appear in workbenches or reports. + description: A value specifying whether Tenable Vulnerability Management tracks the asset in the asset management system. Tenable Vulnerability Management still assigns untracked assets identifiers in scan results, but these identifiers change with each new scan of the asset. This parameter is relevant to PCI-type scans and in certain cases where there is not enough information in a scan to identify the asset. Untracked assets appear in the scan history, but do not appear in workbenches or reports. - name: uuid type: keyword description: The UUID of the asset where a scan found the vulnerability. @@ -62,7 +62,7 @@ description: The ISO date when a scan first detected the vulnerability on the asset. - name: indexed type: date - description: The date and time (in Unix time) when the vulnerability was indexed into Tenable.io. + description: The date and time (in Unix time) when the vulnerability was indexed into Tenable Vulnerability Management. - name: last_fixed type: date description: The ISO date when a scan no longer detects the previously detected vulnerability on the asset. @@ -350,7 +350,7 @@ description: A value specifying whether Tenable predicted the CVSSv3 impact score for the vulnerability because NVD did not provide one (true) or used the NVD-provided CVSSv3 impact score (false) when calculating the VPR. - name: cvss3_impact_score type: double - description: The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable.io displays a Tenable-predicted score. + description: The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable Vulnerability Management displays a Tenable-predicted score. - name: exploit_code_maturity type: keyword description: The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources (for example, Reversinglabs, Exploit-db, Metasploit, etc.). The possible values ('High', 'Functional', 'PoC', or 'Unproven') parallel the CVSS Exploit Code Maturity categories. @@ -377,7 +377,7 @@ description: The Vulnerability Priority Rating (VPR) for the vulnerability. If a plugin is designed to detect multiple vulnerabilities, the VPR represents the highest value calculated for a vulnerability associated with the plugin. - name: updated type: date - description: The ISO timestamp when Tenable.io last imported the VPR for this vulnerability. Tenable.io imports updated VPR values every time you run a scan. + description: The ISO timestamp when Tenable Vulnerability Management last imported the VPR for this vulnerability. Tenable Vulnerability Management imports updated VPR values every time you run a scan. - name: vuln_publication_date type: date description: The publication date of the plugin. @@ -413,7 +413,7 @@ fields: - name: reason type: keyword - description: The text that appears in the Comment field of the recast rule in the Tenable.io user interface. + description: The text that appears in the Comment field of the recast rule in the Tenable Vulnerability Management user interface. - name: rule_uuid type: keyword description: The UUID of the recast rule that applies to the plugin. @@ -449,4 +449,4 @@ description: The severity of the vulnerability as defined using the Common Vulnerability Scoring System (CVSS) base score. Possible values include info, low, medium, high and critical. - name: state type: keyword - description: "The state of the vulnerability as determined by the Tenable.io state service. Possible values include: open, reopen and fixed." + description: "The state of the vulnerability as determined by the Tenable Vulnerability Management state service. Possible values include: open, reopen and fixed." diff --git a/packages/tenable_io/data_stream/vulnerability/manifest.yml b/packages/tenable_io/data_stream/vulnerability/manifest.yml index 652d8257438..96386fcd445 100644 --- a/packages/tenable_io/data_stream/vulnerability/manifest.yml +++ b/packages/tenable_io/data_stream/vulnerability/manifest.yml @@ -1,23 +1,23 @@ -title: Collect Vulnerability logs from Tenable.io +title: Collect Vulnerability logs from Tenable Vulnerability Management type: logs streams: - input: httpjson template_path: httpjson.yml.hbs title: Vulnerability logs - description: Collect vulnerability logs from Tenable.io. + description: Collect vulnerability logs from Tenable Vulnerability Management. vars: - name: interval type: text title: Interval - description: "Duration between requests to the Tenable.io. NOTE: Supported units for this parameter are h/m/s." - default: 5m + description: "Duration between requests to the Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." + default: 1h multi: false required: true show_user: true - name: initial_interval type: text title: Initial Interval - description: "How far back to pull the vulnerability events from Tenable.io. NOTE: Supported units for this parameter are h/m/s." + description: "How far back to pull the vulnerability events from Tenable Vulnerability Management. NOTE: Supported units for this parameter are h/m/s." multi: false required: true show_user: true @@ -49,7 +49,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: "Duration before declaring that the HTTP client connection has timed out. NOTE: Valid time units are ns, us, ms, s, m, h." + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/tenable_io/data_stream/vulnerability/sample_event.json b/packages/tenable_io/data_stream/vulnerability/sample_event.json index c7517c26854..36603d6b168 100644 --- a/packages/tenable_io/data_stream/vulnerability/sample_event.json +++ b/packages/tenable_io/data_stream/vulnerability/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-11-30T14:09:12.061Z", + "@timestamp": "2018-12-31T20:59:47.000Z", "agent": { - "ephemeral_id": "b812a6ca-42f5-495e-aee1-61544bc07417", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.vulnerability", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "vulnerability" ], - "created": "2023-05-23T17:02:05.949Z", + "created": "2023-09-12T08:49:09.473Z", "dataset": "tenable_io.vulnerability", - "ingested": "2023-05-23T17:02:09Z", + "ingested": "2023-09-12T08:49:10Z", "kind": "state", "original": "{\"asset\":{\"fqdn\":\"example.com\",\"hostname\":\"89.160.20.112\",\"ipv4\":\"81.2.69.142\",\"network_id\":\"00000000-0000-0000-0000-000000000000\",\"operating_system\":[\"Test Demo OS X 10.5.8\"],\"tracked\":true,\"uuid\":\"cf165808-6a31-48e1-9cf3-c6c3174df51d\"},\"first_found\":\"2018-12-31T20:59:47Z\",\"indexed\":\"2022-11-30T14:09:12.061Z\",\"last_found\":\"2018-12-31T20:59:47Z\",\"output\":\"The observed version of Test is : \\n /21.0.1180.90\",\"plugin\":{\"cve\":[\"CVE-2016-1620\",\"CVE-2016-1614\",\"CVE-2016-1613\",\"CVE-2016-1612\",\"CVE-2016-1618\",\"CVE-2016-1617\",\"CVE-2016-1616\",\"CVE-2016-1615\",\"CVE-2016-1619\"],\"cvss_base_score\":9.3,\"cvss_temporal_score\":6.9,\"cvss_temporal_vector\":{\"exploitability\":\"Unproven\",\"raw\":\"E:U/RL:OF/RC:C\",\"remediation_level\":\"Official-fix\",\"report_confidence\":\"Confirmed\"},\"cvss_vector\":{\"access_complexity\":\"Medium\",\"access_vector\":\"Network\",\"authentication\":\"None required\",\"availability_impact\":\"Complete\",\"confidentiality_impact\":\"Complete\",\"integrity_impact\":\"Complete\",\"raw\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\"},\"description\":\"The version of Test on the remote host is prior to 48.0.2564.82 and is affected by the following vulnerabilities: \\n\\n - An unspecified vulnerability exists in Test V8 when handling compatible receiver checks hidden behind receptors. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1612)\\n - A use-after-free error exists in `PDFium` due to improper invalidation of `IPWL_FocusHandler` and `IPWL_Provider` upon destruction. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1613)\\n - An unspecified vulnerability exists in `Blink` that is related to the handling of bitmaps. An attacker can exploit this to access sensitive information. No other details are available. (CVE-2016-1614)\\n - An unspecified vulnerability exists in `omnibox` that is related to origin confusion. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1615)\\n - An unspecified vulnerability exists that allows an attacker to spoof a displayed URL. No other details are available. (CVE-2016-1616)\\n - An unspecified vulnerability exists that is related to history sniffing with HSTS and CSP. No other details are available. (CVE-2016-1617)\\n - A flaw exists in `Blink` due to the weak generation of random numbers by the ARC4-based random number generator. An attacker can exploit this to gain access to sensitive information. No other details are available. (CVE-2016-1618)\\n - An out-of-bounds read error exists in `PDFium` in file `fx_codec_jpx_opj.cpp` in the `sycc4{22,44}_to_rgb()` functions. An attacker can exploit this to cause a denial of service by crashing the application linked using the library. (CVE-2016-1619)\\n - Multiple vulnerabilities exist, the most serious of which allow an attacker to execute arbitrary code via a crafted web page. (CVE-2016-1620)\\n - A flaw in `objects.cc` is triggered when handling cleared `WeakCells`, which may allow a context-dependent attacker to have an unspecified impact. No further details have been provided. (CVE-2016-2051)\",\"family\":\"Web Clients\",\"family_id\":1000020,\"has_patch\":false,\"id\":9062,\"name\":\"Test \\u0026lt; 48.0.2564.82 Multiple Vulnerabilities\",\"risk_factor\":\"HIGH\",\"see_also\":[\"http://testreleases.blogspot.com/2016/01/beta-channel-update_20.html\"],\"solution\":\"Update the browser to 48.0.2564.82 or later.\",\"synopsis\":\"The remote host is utilizing a web browser that is affected by multiple vulnerabilities.\",\"vpr\":{\"drivers\":{\"age_of_vuln\":{\"lower_bound\":366,\"upper_bound\":730},\"cvss3_impact_score\":5.9,\"cvss_impact_score_predicted\":false,\"exploit_code_maturity\":\"UNPROVEN\",\"product_coverage\":\"LOW\",\"threat_intensity_last28\":\"VERY_LOW\",\"threat_sources_last28\":[\"No recorded events\"]},\"score\":5.9,\"updated\":\"2019-12-31T10:08:58Z\"}},\"port\":{\"port\":\"0\",\"protocol\":\"TCP\"},\"scan\":{\"completed_at\":\"2018-12-31T20:59:47Z\",\"schedule_uuid\":\"6f7db010-9cb6-4870-b745-70a2aea2f81ce1b6640fe8a2217b\",\"started_at\":\"2018-12-31T20:59:47Z\",\"uuid\":\"0e55ec5d-c7c7-4673-a618-438a84e9d1b78af3a9957a077904\"},\"severity\":\"low\",\"severity_default_id\":3,\"severity_id\":3,\"severity_modification_type\":\"NONE\",\"state\":\"OPEN\"}", "type": [ diff --git a/packages/tenable_io/docs/README.md b/packages/tenable_io/docs/README.md index 2f1ea25896e..d18394e286c 100644 --- a/packages/tenable_io/docs/README.md +++ b/packages/tenable_io/docs/README.md @@ -1,14 +1,14 @@ -# Tenable.io +# Tenable Vulnerability Management ## Overview -The [Tenable.io](https://www.tenable.com/products/tenable-io) integration allows users to monitor asset, plugin, and vulnerability activity. It provides the industry's most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. Tenable.io is the user's complete end-to-end vulnerability management solution. +The [Tenable Vulnerability Management](https://www.tenable.com/products/tenable-io) integration allows users to monitor asset, plugin, and vulnerability activity. It provides the industry's most comprehensive vulnerability coverage with the ability to predict which security issues to remediate first. Tenable Vulnerability Management is the user's complete end-to-end vulnerability management solution. -Use the Tenable.io integration to collects and parses data from the REST APIs. Then visualize that data in Kibana. +Use the Tenable Vulnerability Management integration to collects and parses data from the REST APIs. Then visualize that data in Kibana. ## Data streams -The Tenable.io integration collects logs for three types of events: Asset, Plugin, and Vulnerability. +The Tenable Vulnerability Management integration collects logs for three types of events: Asset, Plugin, and Vulnerability. **Asset** is used to get details related to assets that belong to the user's organization. See more details in the API documentation [here](https://developer.tenable.com/reference/exports-assets-request-export). @@ -16,13 +16,11 @@ The Tenable.io integration collects logs for three types of events: Asset, Plugi **Vulnerability** is used to retrieve all vulnerabilities on each asset, including the vulnerability state. See more details in the API documentation [here](https://developer.tenable.com/reference/exports-vulns-request-export). -**Scanner** is used to retrieve the current state of scanners, including licensing and activity. See more details in the API documentation [here](https://developer.tenable.com/reference/scanners-list). - **Scan** is used to retrieve details about existing scans, including scan statuses, assigned targets, and more. See more details in the API documentation [here](https://developer.tenable.com/reference/scans-list). ## Compatibility -This module has been tested against `Tenable.io release` [December 6, 2022](https://docs.tenable.com/releasenotes/Content/tenableio/tenableio202212.htm). +This module has been tested against `Tenable Vulnerability Management release` [December 6, 2022](https://docs.tenable.com/releasenotes/Content/tenableio/tenableio202212.htm). ## Requirements @@ -35,14 +33,14 @@ Elasticsearch is needed to store and search data, and Kibana is needed for visua ## Setup -### To collect data from the Tenable.io REST APIs, follow the below steps: +### To collect data from the Tenable Vulnerability Management REST APIs, follow the below steps: - 1. Create a valid user account with appropriate permissions on Tenable.io. - 2. Generate the API keys for the account to access all Tenable.io APIs. + 1. Create a valid user account with appropriate permissions on Tenable Vulnerability Management. + 2. Generate the API keys for the account to access all Tenable Vulnerability Management APIs. **Note:** - - For the Tenable.io asset and vulnerability API, **ADMINISTRATOR [64]** and **Can View** access control is required in created user's access key and secret key. - - For the Tenable.io plugin, **BASIC [16]** user permissions are required in created user's access key and secret key. + - For the Tenable Vulnerability Management asset and vulnerability API, **ADMINISTRATOR [64]** and **Can View** access control is required in created user's access key and secret key. + - For the Tenable Vulnerability Management plugin, **BASIC [16]** user permissions are required in created user's access key and secret key. - For more details related to permissions, refer to the link [here](https://developer.tenable.com/docs/permissions). ## Logs reference @@ -59,11 +57,11 @@ An example event for `asset` looks as following: { "@timestamp": "2018-12-31T22:27:58.599Z", "agent": { - "ephemeral_id": "aaad454b-3662-41fc-a55d-5c164947a6aa", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "cloud": { "availability_zone": "12", @@ -80,21 +78,21 @@ An example event for `asset` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "host" ], - "created": "2023-05-23T16:59:30.688Z", + "created": "2023-09-12T08:47:10.442Z", "dataset": "tenable_io.asset", - "ingested": "2023-05-23T16:59:31Z", + "ingested": "2023-09-12T08:47:11Z", "kind": "state", "original": "{\"acr_score\":\"3\",\"agent_names\":[],\"agent_uuid\":\"22\",\"aws_availability_zone\":null,\"aws_ec2_instance_ami_id\":\"12\",\"aws_ec2_instance_group_name\":null,\"aws_ec2_instance_id\":\"12\",\"aws_ec2_instance_state_name\":null,\"aws_ec2_instance_type\":null,\"aws_ec2_name\":null,\"aws_ec2_product_code\":null,\"aws_owner_id\":\"44\",\"aws_region\":null,\"aws_subnet_id\":null,\"aws_vpc_id\":null,\"azure_resource_id\":\"12\",\"azure_vm_id\":\"12\",\"bigfix_asset_id\":null,\"bios_uuid\":\"33\",\"created_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_at\":\"2017-12-31T20:40:44.535Z\",\"deleted_by\":\"user\",\"exposure_score\":\"721\",\"first_scan_time\":\"2017-12-31T20:40:23.447Z\",\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"fqdns\":[\"example.com\"],\"gcp_instance_id\":\"12\",\"gcp_project_id\":\"12\",\"gcp_zone\":\"12\",\"has_agent\":false,\"has_plugin_results\":true,\"hostnames\":[],\"id\":\"95c2725c-7298-4a44-8a1d-63131ca3f01f\",\"installed_software\":[\"cpe:/a:test:xyz:12.8\",\"cpe:/a:test:abc:7.7.3\",\"cpe:/a:test:pqr:6.9\",\"cpe:/a:test:xyz\"],\"ipv4s\":[\"89.160.20.112\"],\"ipv6s\":[],\"last_authenticated_scan_date\":\"2017-12-31T20:40:44.535Z\",\"last_licensed_scan_date\":\"2018-12-31T22:27:52.869Z\",\"last_scan_id\":\"00283024-afee-44ea-b467-db5a6ed9fd50ab8f7ecb158c480e\",\"last_scan_time\":\"2018-03-31T22:27:52.869Z\",\"last_schedule_id\":\"72284901-7c68-42b2-a0c4-c1e75568849df60557ee0e264228\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"mac_addresses\":[],\"manufacturer_tpm_ids\":[],\"mcafee_epo_agent_guid\":null,\"mcafee_epo_guid\":null,\"netbios_names\":[],\"network_interfaces\":[{\"fqdns\":[\"example.com\"],\"ipv4s\":[\"89.160.20.112\",\"81.2.69.144\"],\"ipv6s\":[\"2a02:cf40::\"],\"mac_addresses\":[\"00-00-5E-00-53-00\",\"00-00-5E-00-53-FF\"],\"name\":\"test.0.1234\"}],\"operating_systems\":[],\"qualys_asset_ids\":[],\"qualys_host_ids\":[],\"servicenow_sysid\":null,\"sources\":[{\"first_seen\":\"2017-12-31T20:40:23.447Z\",\"last_seen\":\"2018-12-31T22:27:52.869Z\",\"name\":\"TEST_SCAN\"}],\"ssh_fingerprints\":[],\"symantec_ep_hardware_keys\":[],\"system_types\":[],\"tags\":[{\"added_at\":\"2018-12-31T14:53:13.817Z\",\"added_by\":\"ac2e7ef6-fac9-47bf-9170-617331322885\",\"key\":\"Geographic Area\",\"uuid\":\"47e7f5f6-1013-4401-a705-479bfadc7826\",\"value\":\"APAC\"}],\"terminated_at\":\"2017-12-31T20:40:44.535Z\",\"terminated_by\":\"user\",\"updated_at\":\"2018-12-31T22:27:58.599Z\"}", "type": [ @@ -247,9 +245,9 @@ An example event for `asset` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -296,8 +294,8 @@ An example event for `asset` looks as following: | tenable_io.asset.azure.vm_id | The unique identifier of the Microsoft Azure virtual machine instance. For more information, see "Accessing and Using Azure VM Unique ID" in the Microsoft Azure documentation. | keyword | | tenable_io.asset.bigfix_asset_id | The unique identifiers of the asset in HCL BigFix. | keyword | | tenable_io.asset.bios_uuid | The BIOS UUID of the asset. | keyword | -| tenable_io.asset.created_at | The time and date when Tenable.io created the asset record. | date | -| tenable_io.asset.deleted_at | The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable.io retains the record until the asset ages out of the license count. | date | +| tenable_io.asset.created_at | The time and date when Tenable Vulnerability Management created the asset record. | date | +| tenable_io.asset.deleted_at | The time and date when a user deleted the asset record. When a user deletes an asset record, Tenable Vulnerability Management retains the record until the asset ages out of the license count. | date | | tenable_io.asset.deleted_by | The user who deleted the asset record. | keyword | | tenable_io.asset.exposure_score | The Asset Exposure Score (AES) for the asset. | long | | tenable_io.asset.first_scan_time | The time and date of the first scan run against the asset. | date | @@ -309,12 +307,12 @@ An example event for `asset` looks as following: | tenable_io.asset.has_agent | Specifies whether a Nessus agent scan identified the asset. | boolean | | tenable_io.asset.has_plugin_results | Specifies whether the asset has plugin results associated with it. | boolean | | tenable_io.asset.hostnames | The hostnames that scans have associated with the asset record. | keyword | -| tenable_io.asset.id | The UUID of the asset in Tenable.io. Use this value as the unique key for the asset. | keyword | +| tenable_io.asset.id | The UUID of the asset in Tenable Vulnerability Management. Use this value as the unique key for the asset. | keyword | | tenable_io.asset.installed_software | A list of Common Platform Enumeration (CPE) values that represent software applications a scan identified as present on an asset. This attribute supports the CPE 2.2 format. | keyword | | tenable_io.asset.ipv4s | The IPv4 addresses that scans have associated with the asset record. | ip | | tenable_io.asset.ipv6s | The IPv6 addresses that scans have associated with the asset record. | ip | | tenable_io.asset.last_authenticated_scan_date | The time and date of the last credentialed scan run on the asset. | date | -| tenable_io.asset.last_licensed_scan_date | The time and date of the last scan that identified the asset as licensed. Tenable.io categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days. | date | +| tenable_io.asset.last_licensed_scan_date | The time and date of the last scan that identified the asset as licensed. Tenable Vulnerability Management categorizes an asset as licensed if a scan of that asset has returned results from a non-discovery plugin within the last 90 days. | date | | tenable_io.asset.last_scan_id | The UUID of the scan configuration used during the last scan of the asset. | keyword | | tenable_io.asset.last_scan_time | The time and date of the last scan run against the asset. | date | | tenable_io.asset.last_schedule_id | The schedule_uuid for the last scan of the asset. | keyword | @@ -365,11 +363,11 @@ An example event for `plugin` looks as following: { "@timestamp": "2018-07-19T00:00:00.000Z", "agent": { - "ephemeral_id": "319b150f-2992-417b-9a99-84fb3f8042a0", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.plugin", @@ -377,18 +375,18 @@ An example event for `plugin` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "created": "2023-05-23T17:00:08.911Z", + "created": "2023-09-12T08:47:48.515Z", "dataset": "tenable_io.plugin", - "ingested": "2023-05-23T17:00:12Z", + "ingested": "2023-09-12T08:47:49Z", "kind": "state", "original": "{\"attributes\":{\"cpe\":[\"p-cpe:/a:fedoraproject:fedora:kernel-source\",\"cpe:/o:fedoraproject:fedora_core:1\",\"p-cpe:/a:fedoraproject:fedora:kernel-BOOT\",\"p-cpe:/a:fedoraproject:fedora:kernel-debuginfo\",\"p-cpe:/a:fedoraproject:fedora:kernel\",\"p-cpe:/a:fedoraproject:fedora:kernel-doc\",\"p-cpe:/a:fedoraproject:fedora:kernel-smp\"],\"cve\":[\"CVE-2003-0984\"],\"cvss3_base_score\":0,\"cvss3_temporal_score\":0,\"cvss_base_score\":4.6,\"cvss_temporal_score\":0,\"cvss_vector\":{\"AccessComplexity\":\"Low\",\"AccessVector\":\"Local-access\",\"Authentication\":\"None required\",\"Availability-Impact\":\"Partial\",\"Confidentiality-Impact\":\"Partial\",\"Integrity-Impact\":\"Partial\",\"raw\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\"},\"default_account\":false,\"description\":\"Various RTC drivers had the potential to leak...\",\"exploit_available\":false,\"exploit_framework_canvas\":false,\"exploit_framework_core\":false,\"exploit_framework_d2_elliot\":false,\"exploit_framework_exploithub\":false,\"exploit_framework_metasploit\":false,\"exploited_by_malware\":false,\"exploited_by_nessus\":false,\"has_patch\":true,\"in_the_news\":false,\"malware\":false,\"patch_publication_date\":\"2004-01-07T00:00:00Z\",\"plugin_modification_date\":\"2018-07-19T00:00:00Z\",\"plugin_publication_date\":\"2004-07-23T00:00:00Z\",\"plugin_type\":\"local\",\"plugin_version\":\"1.17\",\"risk_factor\":\"Medium\",\"see_also\":[\"http://example.com/u?07bc9e7f\"],\"solution\":\"Update the affected packages.\",\"synopsis\":\"The remote Fedora Core host is missing a security update.\",\"unsupported_by_vendor\":false,\"vpr\":{\"drivers\":{\"age_of_vuln\":{\"lower_bound\":366,\"upper_bound\":730},\"cvss3_impact_score\":5.9,\"cvss_impact_score_predicted\":false,\"exploit_code_maturity\":\"UNPROVEN\",\"product_coverage\":\"LOW\",\"threat_intensity_last28\":\"VERY_LOW\",\"threat_recency\":{\"lower_bound\":366,\"upper_bound\":730},\"threat_sources_last28\":[\"No recorded events\"]},\"score\":5.5,\"updated\":\"2018-07-19T00:00:00Z\"},\"xref\":[\"FEDORA:2003-047\"],\"xrefs\":[{\"id\":\"2003-047\",\"type\":\"FEDORA\"}]},\"id\":13670,\"name\":\"Fedora Core 1 : kernel-2.4.22-1.2140.nptl (2003-047)\"}", "type": [ @@ -549,9 +547,9 @@ An example event for `plugin` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -635,7 +633,7 @@ An example event for `plugin` looks as following: | tenable_io.plugin.attributes.unsupported_by_vendor | Indicates whether the software found by this plugin is unsupported by the software's vendor (for example, Windows 95 or Firefox 3). | boolean | | tenable_io.plugin.attributes.vpr.drivers.age_of_vuln.lower_bound | The lower bound of the range. For example, for the 0-7 days range, this attribute is "0". For the highest range (more than 730 days), this value is "731". | long | | tenable_io.plugin.attributes.vpr.drivers.age_of_vuln.upper_bound | The upper bound of the range. For example, for the 0-7 days range, this attribute is "7". For the highest range (more than 730 days), this value is "0", which signifies that there is no higher category. | long | -| tenable_io.plugin.attributes.vpr.drivers.cvss3_impact_score | The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable.io displays a Tenable-predicted score. | double | +| tenable_io.plugin.attributes.vpr.drivers.cvss3_impact_score | The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable Vulnerability Management displays a Tenable-predicted score. | double | | tenable_io.plugin.attributes.vpr.drivers.cvss_impact_score_predicted | A value specifying whether Tenable predicted the CVSSv3 impact score for the vulnerability because NVD did not provide one (true) or used the NVD-provided CVSSv3 impact score (false) when calculating the VPR. | boolean | | tenable_io.plugin.attributes.vpr.drivers.exploit_code_maturity | The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources (for example, Reversinglabs, Exploit-db, Metasploit, etc.). The possible values ("High", "Functional", "PoC", or "Unproven") parallel the CVSS Exploit Code Maturity categories. | keyword | | tenable_io.plugin.attributes.vpr.drivers.product_coverage | The relative number of unique products affected by the vulnerability: 'Low', 'Medium', 'High', or 'Very High'. | keyword | @@ -644,7 +642,7 @@ An example event for `plugin` looks as following: | tenable_io.plugin.attributes.vpr.drivers.threat_recency.upper_bound | The upper bound of the range. For example, for the 0-7 days range, this attribute is "7". For the highest range (more than 730 days), this value is "0", which signifies that there is no higher category. | long | | tenable_io.plugin.attributes.vpr.drivers.threat_sources_last28 | A list of all sources (for example, social media channels, the dark web, etc.) where threat events related to this vulnerability occurred. Item type: string. | keyword | | tenable_io.plugin.attributes.vpr.score | The Vulnerability Priority Rating (VPR) for the vulnerability. If a plugin is designed to detect multiple vulnerabilities, the VPR represents the highest value calculated for a vulnerability associated with the plugin. | double | -| tenable_io.plugin.attributes.vpr.updated | The ISO timestamp when Tenable.io last imported the VPR for this vulnerability. Tenable.io imports updated VPR values every time you run a scan. | date | +| tenable_io.plugin.attributes.vpr.updated | The ISO timestamp when Tenable Vulnerability Management last imported the VPR for this vulnerability. Tenable Vulnerability Management imports updated VPR values every time you run a scan. | date | | tenable_io.plugin.attributes.vuln_publication_date | | date | | tenable_io.plugin.attributes.xref | References to third-party information about the vulnerability, exploit, or update associated with the plugin presented as an array of strings. Each reference includes a type, for example, "FEDORA", and an ID, for example, "2003-047". | keyword | | tenable_io.plugin.attributes.xrefs.id | | keyword | @@ -668,13 +666,13 @@ An example event for `vulnerability` looks as following: ```json { - "@timestamp": "2022-11-30T14:09:12.061Z", + "@timestamp": "2018-12-31T20:59:47.000Z", "agent": { - "ephemeral_id": "b812a6ca-42f5-495e-aee1-61544bc07417", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.vulnerability", @@ -682,21 +680,21 @@ An example event for `vulnerability` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "vulnerability" ], - "created": "2023-05-23T17:02:05.949Z", + "created": "2023-09-12T08:49:09.473Z", "dataset": "tenable_io.vulnerability", - "ingested": "2023-05-23T17:02:09Z", + "ingested": "2023-09-12T08:49:10Z", "kind": "state", "original": "{\"asset\":{\"fqdn\":\"example.com\",\"hostname\":\"89.160.20.112\",\"ipv4\":\"81.2.69.142\",\"network_id\":\"00000000-0000-0000-0000-000000000000\",\"operating_system\":[\"Test Demo OS X 10.5.8\"],\"tracked\":true,\"uuid\":\"cf165808-6a31-48e1-9cf3-c6c3174df51d\"},\"first_found\":\"2018-12-31T20:59:47Z\",\"indexed\":\"2022-11-30T14:09:12.061Z\",\"last_found\":\"2018-12-31T20:59:47Z\",\"output\":\"The observed version of Test is : \\n /21.0.1180.90\",\"plugin\":{\"cve\":[\"CVE-2016-1620\",\"CVE-2016-1614\",\"CVE-2016-1613\",\"CVE-2016-1612\",\"CVE-2016-1618\",\"CVE-2016-1617\",\"CVE-2016-1616\",\"CVE-2016-1615\",\"CVE-2016-1619\"],\"cvss_base_score\":9.3,\"cvss_temporal_score\":6.9,\"cvss_temporal_vector\":{\"exploitability\":\"Unproven\",\"raw\":\"E:U/RL:OF/RC:C\",\"remediation_level\":\"Official-fix\",\"report_confidence\":\"Confirmed\"},\"cvss_vector\":{\"access_complexity\":\"Medium\",\"access_vector\":\"Network\",\"authentication\":\"None required\",\"availability_impact\":\"Complete\",\"confidentiality_impact\":\"Complete\",\"integrity_impact\":\"Complete\",\"raw\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\"},\"description\":\"The version of Test on the remote host is prior to 48.0.2564.82 and is affected by the following vulnerabilities: \\n\\n - An unspecified vulnerability exists in Test V8 when handling compatible receiver checks hidden behind receptors. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1612)\\n - A use-after-free error exists in `PDFium` due to improper invalidation of `IPWL_FocusHandler` and `IPWL_Provider` upon destruction. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-1613)\\n - An unspecified vulnerability exists in `Blink` that is related to the handling of bitmaps. An attacker can exploit this to access sensitive information. No other details are available. (CVE-2016-1614)\\n - An unspecified vulnerability exists in `omnibox` that is related to origin confusion. An attacker can exploit this to have an unspecified impact. No other details are available. (CVE-2016-1615)\\n - An unspecified vulnerability exists that allows an attacker to spoof a displayed URL. No other details are available. (CVE-2016-1616)\\n - An unspecified vulnerability exists that is related to history sniffing with HSTS and CSP. No other details are available. (CVE-2016-1617)\\n - A flaw exists in `Blink` due to the weak generation of random numbers by the ARC4-based random number generator. An attacker can exploit this to gain access to sensitive information. No other details are available. (CVE-2016-1618)\\n - An out-of-bounds read error exists in `PDFium` in file `fx_codec_jpx_opj.cpp` in the `sycc4{22,44}_to_rgb()` functions. An attacker can exploit this to cause a denial of service by crashing the application linked using the library. (CVE-2016-1619)\\n - Multiple vulnerabilities exist, the most serious of which allow an attacker to execute arbitrary code via a crafted web page. (CVE-2016-1620)\\n - A flaw in `objects.cc` is triggered when handling cleared `WeakCells`, which may allow a context-dependent attacker to have an unspecified impact. No further details have been provided. (CVE-2016-2051)\",\"family\":\"Web Clients\",\"family_id\":1000020,\"has_patch\":false,\"id\":9062,\"name\":\"Test \\u0026lt; 48.0.2564.82 Multiple Vulnerabilities\",\"risk_factor\":\"HIGH\",\"see_also\":[\"http://testreleases.blogspot.com/2016/01/beta-channel-update_20.html\"],\"solution\":\"Update the browser to 48.0.2564.82 or later.\",\"synopsis\":\"The remote host is utilizing a web browser that is affected by multiple vulnerabilities.\",\"vpr\":{\"drivers\":{\"age_of_vuln\":{\"lower_bound\":366,\"upper_bound\":730},\"cvss3_impact_score\":5.9,\"cvss_impact_score_predicted\":false,\"exploit_code_maturity\":\"UNPROVEN\",\"product_coverage\":\"LOW\",\"threat_intensity_last28\":\"VERY_LOW\",\"threat_sources_last28\":[\"No recorded events\"]},\"score\":5.9,\"updated\":\"2019-12-31T10:08:58Z\"}},\"port\":{\"port\":\"0\",\"protocol\":\"TCP\"},\"scan\":{\"completed_at\":\"2018-12-31T20:59:47Z\",\"schedule_uuid\":\"6f7db010-9cb6-4870-b745-70a2aea2f81ce1b6640fe8a2217b\",\"started_at\":\"2018-12-31T20:59:47Z\",\"uuid\":\"0e55ec5d-c7c7-4673-a618-438a84e9d1b78af3a9957a077904\"},\"severity\":\"low\",\"severity_default_id\":3,\"severity_id\":3,\"severity_modification_type\":\"NONE\",\"state\":\"OPEN\"}", "type": [ @@ -892,9 +890,9 @@ An example event for `vulnerability` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -936,10 +934,10 @@ An example event for `vulnerability` looks as following: | tenable_io.vulnerability.asset.netbios.workgroup | The NETBIOS workgroup of the asset where a scan found the vulnerability. | keyword | | tenable_io.vulnerability.asset.network_id | The ID of the network object associated with scanners that identified the asset. The default network ID is 00000000-0000-0000-0000-000000000000 | keyword | | tenable_io.vulnerability.asset.operating_system | The operating system of the asset where a scan found the vulnerability. | keyword | -| tenable_io.vulnerability.asset.tracked | A value specifying whether Tenable.io tracks the asset in the asset management system. Tenable.io still assigns untracked assets identifiers in scan results, but these identifiers change with each new scan of the asset. This parameter is relevant to PCI-type scans and in certain cases where there is not enough information in a scan to identify the asset. Untracked assets appear in the scan history, but do not appear in workbenches or reports. | boolean | +| tenable_io.vulnerability.asset.tracked | A value specifying whether Tenable Vulnerability Management tracks the asset in the asset management system. Tenable Vulnerability Management still assigns untracked assets identifiers in scan results, but these identifiers change with each new scan of the asset. This parameter is relevant to PCI-type scans and in certain cases where there is not enough information in a scan to identify the asset. Untracked assets appear in the scan history, but do not appear in workbenches or reports. | boolean | | tenable_io.vulnerability.asset.uuid | The UUID of the asset where a scan found the vulnerability. | keyword | | tenable_io.vulnerability.first_found | The ISO date when a scan first detected the vulnerability on the asset. | date | -| tenable_io.vulnerability.indexed | The date and time (in Unix time) when the vulnerability was indexed into Tenable.io. | date | +| tenable_io.vulnerability.indexed | The date and time (in Unix time) when the vulnerability was indexed into Tenable Vulnerability Management. | date | | tenable_io.vulnerability.last_fixed | The ISO date when a scan no longer detects the previously detected vulnerability on the asset. | date | | tenable_io.vulnerability.last_found | The ISO date when a scan last detected the vulnerability on the asset. | date | | tenable_io.vulnerability.output | The text output of the Nessus scanner. | keyword | @@ -1021,7 +1019,7 @@ An example event for `vulnerability` looks as following: | tenable_io.vulnerability.plugin.version | The version of the plugin used to perform the check. | version | | tenable_io.vulnerability.plugin.vpr.drivers.age_of_vuln.lower_bound | The lower bound of the range. For example, for the 0-7 days range, this attribute is "0". For the highest range (more than 730 days), this value is "731". | long | | tenable_io.vulnerability.plugin.vpr.drivers.age_of_vuln.upper_bound | The upper bound of the range. For example, for the 0-7 days range, this attribute is "7". For the highest range (more than 730 days), this value is "0", which signifies that there is no higher category. | long | -| tenable_io.vulnerability.plugin.vpr.drivers.cvss3_impact_score | The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable.io displays a Tenable-predicted score. | double | +| tenable_io.vulnerability.plugin.vpr.drivers.cvss3_impact_score | The NVD-provided CVSSv3 impact score for the vulnerability. If the NVD did not provide a score, Tenable Vulnerability Management displays a Tenable-predicted score. | double | | tenable_io.vulnerability.plugin.vpr.drivers.cvss_impact_score_predicted | A value specifying whether Tenable predicted the CVSSv3 impact score for the vulnerability because NVD did not provide one (true) or used the NVD-provided CVSSv3 impact score (false) when calculating the VPR. | boolean | | tenable_io.vulnerability.plugin.vpr.drivers.exploit_code_maturity | The relative maturity of a possible exploit for the vulnerability based on the existence, sophistication, and prevalence of exploit intelligence from internal and external sources (for example, Reversinglabs, Exploit-db, Metasploit, etc.). The possible values ('High', 'Functional', 'PoC', or 'Unproven') parallel the CVSS Exploit Code Maturity categories. | keyword | | tenable_io.vulnerability.plugin.vpr.drivers.product_coverage | The relative number of unique products affected by the vulnerability: 'Low', 'Medium', 'High', or 'Very High'. | keyword | @@ -1030,7 +1028,7 @@ An example event for `vulnerability` looks as following: | tenable_io.vulnerability.plugin.vpr.drivers.threat_recency.upper_bound | The upper bound of the range. For example, for the 0-7 days range, this attribute is "7". For the highest range (more than 730 days), this value is "0", which signifies that there is no higher category. | long | | tenable_io.vulnerability.plugin.vpr.drivers.threat_sources_last28 | A list of all sources (for example, social media channels, the dark web, etc.) where threat events related to this vulnerability occurred. Item type: string. | keyword | | tenable_io.vulnerability.plugin.vpr.score | The Vulnerability Priority Rating (VPR) for the vulnerability. If a plugin is designed to detect multiple vulnerabilities, the VPR represents the highest value calculated for a vulnerability associated with the plugin. | double | -| tenable_io.vulnerability.plugin.vpr.updated | The ISO timestamp when Tenable.io last imported the VPR for this vulnerability. Tenable.io imports updated VPR values every time you run a scan. | date | +| tenable_io.vulnerability.plugin.vpr.updated | The ISO timestamp when Tenable Vulnerability Management last imported the VPR for this vulnerability. Tenable Vulnerability Management imports updated VPR values every time you run a scan. | date | | tenable_io.vulnerability.plugin.vuln_publication_date | The publication date of the plugin. | date | | tenable_io.vulnerability.plugin.xref.id | | keyword | | tenable_io.vulnerability.plugin.xref.type | | keyword | @@ -1039,7 +1037,7 @@ An example event for `vulnerability` looks as following: | tenable_io.vulnerability.port.protocol | The protocol the scanner used to communicate with the asset. | keyword | | tenable_io.vulnerability.port.service | The service the scanner used to communicate with the asset. | keyword | | tenable_io.vulnerability.port.value | The port the scanner used to communicate with the asset. | long | -| tenable_io.vulnerability.recast.reason | The text that appears in the Comment field of the recast rule in the Tenable.io user interface. | keyword | +| tenable_io.vulnerability.recast.reason | The text that appears in the Comment field of the recast rule in the Tenable Vulnerability Management user interface. | keyword | | tenable_io.vulnerability.recast.rule_uuid | The UUID of the recast rule that applies to the plugin. | keyword | | tenable_io.vulnerability.scan.completed_at | The ISO timestamp when the scan completed. | date | | tenable_io.vulnerability.scan.schedule_uuid | The schedule UUID for the scan that found the vulnerability. | keyword | @@ -1049,7 +1047,7 @@ An example event for `vulnerability` looks as following: | tenable_io.vulnerability.severity.id | The code for the severity assigned when a user recast the risk associated with the vulnerability. Possible values include: 0,1,2,3 and 4. | long | | tenable_io.vulnerability.severity.modification_type | The type of modification a user made to the vulnerability's severity. Possible values include:none, recasted and accepted. | keyword | | tenable_io.vulnerability.severity.value | The severity of the vulnerability as defined using the Common Vulnerability Scoring System (CVSS) base score. Possible values include info, low, medium, high and critical. | keyword | -| tenable_io.vulnerability.state | The state of the vulnerability as determined by the Tenable.io state service. Possible values include: open, reopen and fixed. | keyword | +| tenable_io.vulnerability.state | The state of the vulnerability as determined by the Tenable Vulnerability Management state service. Possible values include: open, reopen and fixed. | keyword | | vulnerability.category | The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) This field must be an array. | keyword | | vulnerability.classification | The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) | keyword | | vulnerability.description | The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) | keyword | @@ -1065,261 +1063,6 @@ An example event for `vulnerability` looks as following: | vulnerability.severity | The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -### scanner - -This is the `scanner` dataset. - -#### Example - -An example event for `scanner` looks as following: - -```json -{ - "@timestamp": "2023-05-23T17:01:28.893Z", - "agent": { - "ephemeral_id": "e3c42c6e-eaa7-45a1-95bc-60bdca8f29d9", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "8.9.0" - }, - "data_stream": { - "dataset": "tenable_io.scanner", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.8.0" - }, - "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" - }, - "event": { - "agent_id_status": "verified", - "category": [ - "host" - ], - "created": "2023-05-23T17:01:28.893Z", - "dataset": "tenable_io.scanner", - "ingested": "2023-05-23T17:01:32Z", - "kind": "state", - "original": "{\"creation_date\":1603821746,\"group\":true,\"id\":123456,\"key\":\"db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199\",\"last_connect\":null,\"last_modification_date\":1603821746,\"license\":{\"activation_code\":\"7A1F-BT5R-7B5R\",\"agents\":-1,\"agents_used\":4286,\"apps\":{\"cns\":{\"expiration_date\":1663473599,\"mode\":\"eval\"},\"consec\":{\"expiration_date\":1658289599,\"mode\":\"eval\"},\"lumin\":{\"activation_code\":\"T8G9-A1EG-ERT4\",\"assets\":11000,\"expiration_date\":1704326399,\"mode\":\"standard\"},\"pci\":{\"mode\":\"basic\"},\"vm\":{\"agents\":0,\"assets\":11000,\"vm_activation_code\":\"TB7R-QWEG-ASD8\",\"vm_expiration_date\":1704326399},\"was\":{\"expiration_date\":1659585599,\"mode\":\"eval\",\"ui_mode\":\"NEW\"}},\"enterprise_pause\":false,\"evaluation\":false,\"expiration_date\":1704326399,\"ips\":11000,\"record_id\":\"001600000ASDA71CCD\",\"scanners\":-1,\"scanners_used\":10,\"type\":\"vm\",\"users\":-1},\"linked\":1,\"name\":\"APAC Cloud Scanners\",\"network_name\":\"Default\",\"num_scans\":0,\"owner\":\"system\",\"owner_id\":1258789,\"owner_name\":\"system\",\"owner_uuid\":\"ab12we5wr-asdf1-etah5-asd8-d5yhf7ew4394\",\"pool\":true,\"scan_count\":0,\"shared\":1,\"source\":\"service\",\"status\":\"on\",\"supports_remote_logs\":false,\"supports_remote_settings\":false,\"supports_webapp\":true,\"timestamp\":1603821746,\"type\":\"local\",\"user_permissions\":64,\"uuid\":\"akd78gte-d58g-adsd-34fg-4fde5ugh52dw\"}", - "type": [ - "info" - ] - }, - "host": { - "name": "APAC Cloud Scanners" - }, - "input": { - "type": "httpjson" - }, - "related": { - "hosts": [ - "APAC Cloud Scanners" - ] - }, - "tags": [ - "preserve_original_event", - "preserve_duplicate_custom_fields", - "forwarded", - "tenable_io-scanner" - ], - "tenable_io": { - "scanner": { - "creation_date": "2020-10-27T18:02:26.000Z", - "group": true, - "id": 123456, - "key": "db8bbcddce265942ec66fc56aa17e6f8239b9d355580b58af96a5eab1f309199", - "last_modification_date": "2020-10-27T18:02:26.000Z", - "license": { - "activation_code": "7A1F-BT5R-7B5R", - "agents": -1, - "agents_used": 4286, - "apps": { - "cns": { - "expiration_date": "2022-09-18T03:59:59.000Z", - "mode": "eval" - }, - "consec": { - "expiration_date": "2022-07-20T03:59:59.000Z", - "mode": "eval" - }, - "lumin": { - "activation_code": "T8G9-A1EG-ERT4", - "assets": 11000, - "expiration_date": "2024-01-03T23:59:59.000Z", - "mode": "standard" - }, - "pci": { - "mode": "basic" - }, - "vm": { - "agents": 0, - "assets": 11000, - "vm_activation_code": "TB7R-QWEG-ASD8", - "vm_expiration_date": 1704326399 - }, - "was": { - "expiration_date": "2022-08-04T03:59:59.000Z", - "mode": "eval", - "ui_mode": "NEW" - } - }, - "enterprise_pause": false, - "evaluation": false, - "expiration_date": "2024-01-03T23:59:59.000Z", - "ips": 11000, - "record_id": "001600000ASDA71CCD", - "scanners": -1, - "scanners_used": 10, - "type": "vm", - "users": -1 - }, - "linked": true, - "name": "APAC Cloud Scanners", - "network_name": "Default", - "num_scans": 0, - "owner": "system", - "owner_id": 1258789, - "owner_name": "system", - "owner_uuid": "ab12we5wr-asdf1-etah5-asd8-d5yhf7ew4394", - "pool": true, - "scan_count": 0, - "shared": true, - "source": "service", - "status": "on", - "supports_remote_logs": false, - "supports_remote_settings": false, - "supports_webapp": true, - "timestamp": "2020-10-27T18:02:26.000Z", - "type": "local", - "user_permissions": 64, - "uuid": "akd78gte-d58g-adsd-34fg-4fde5ugh52dw" - } - } -} -``` - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | -| event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module | constant_keyword | -| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | -| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| tags | List of keywords used to tag each event. | keyword | -| tenable_io.scanner.creation_date | The timestamp when the scanner was created. This attribute specifies the original creation date if the scanner was migrated. | date | -| tenable_io.scanner.distro | The scanner operating system distribution. | keyword | -| tenable_io.scanner.engine_version | The Tenabler scanner engine version | keyword | -| tenable_io.scanner.group | Indicates whether the scanner belongs to a scanner group ('true') or not ('false'). | boolean | -| tenable_io.scanner.hostname | The hostname of the scanner. | keyword | -| tenable_io.scanner.id | The unique ID of the scanner. | long | -| tenable_io.scanner.ip_addresses | A list of IP addresses associated with the scanner. | ip | -| tenable_io.scanner.key | The linking key, that is, the alpha-numeric sequence of characters you use to link a scanner to Tenable.io. | keyword | -| tenable_io.scanner.last_connect | The timestamp when any of the scanner's tasks have provided its last update. | date | -| tenable_io.scanner.last_modification_date | The timestamp when the scanner was last modified. | date | -| tenable_io.scanner.license.activation_code | The activation code for the scanner. | keyword | -| tenable_io.scanner.license.agents | The number of agents the scanner is licensed to use. | long | -| tenable_io.scanner.license.agents_used | | long | -| tenable_io.scanner.license.apps.cns.expiration_date | | date | -| tenable_io.scanner.license.apps.cns.mode | | keyword | -| tenable_io.scanner.license.apps.consec.expiration_date | | date | -| tenable_io.scanner.license.apps.consec.mode | | keyword | -| tenable_io.scanner.license.apps.lumin.activation_code | | keyword | -| tenable_io.scanner.license.apps.lumin.assets | | long | -| tenable_io.scanner.license.apps.lumin.expiration_date | | date | -| tenable_io.scanner.license.apps.lumin.mode | | keyword | -| tenable_io.scanner.license.apps.pci.mode | | keyword | -| tenable_io.scanner.license.apps.vm.agents | | long | -| tenable_io.scanner.license.apps.vm.assets | | long | -| tenable_io.scanner.license.apps.vm.vm_activation_code | | keyword | -| tenable_io.scanner.license.apps.vm.vm_expiration_date | | date | -| tenable_io.scanner.license.apps.was.expiration_date | | date | -| tenable_io.scanner.license.apps.was.mode | | keyword | -| tenable_io.scanner.license.apps.was.ui_mode | | keyword | -| tenable_io.scanner.license.enterprise_pause | | boolean | -| tenable_io.scanner.license.evaluation | Indicates whether the license is an evaluation license. | boolean | -| tenable_io.scanner.license.expiration_date | The date of expiration for this scanner's license. | date | -| tenable_io.scanner.license.ips | The number of hosts the scanner is licensed to use. | long | -| tenable_io.scanner.license.record_id | License identifier for the scanner. | keyword | -| tenable_io.scanner.license.scanners | The number of scanners the scanner is licensed to use. | long | -| tenable_io.scanner.license.scanners_used | | long | -| tenable_io.scanner.license.type | The license type. | keyword | -| tenable_io.scanner.license.users | The number of users the scanner is licensed to use. | long | -| tenable_io.scanner.linked | Specifies whether you disabled (False) or enabled (True) the scanner. | boolean | -| tenable_io.scanner.loaded_plugin_set | The current plugin set on the scanner. | keyword | -| tenable_io.scanner.name | The user-defined name of the scanner. | keyword | -| tenable_io.scanner.network_name | The name of the network object associated with the scanner. | keyword | -| tenable_io.scanner.num_scans | The number of scans (tasks) the scanner is currently executing. | long | -| tenable_io.scanner.owner | The owner of the scanner. | keyword | -| tenable_io.scanner.owner_id | The ID of the owner of the scanner. | long | -| tenable_io.scanner.owner_name | The username of the owner of the scanner. | keyword | -| tenable_io.scanner.owner_uuid | The UUID of the owner of the scanner. | keyword | -| tenable_io.scanner.platform | The platform of the scanner. | keyword | -| tenable_io.scanner.pool | Indicates whether the scanner is part of a scanner group ('true') or not ('false'). | boolean | -| tenable_io.scanner.remote_uuid | The UUID of the Nessus installation on the scanner. | keyword | -| tenable_io.scanner.scan_count | The number of scans that the scanner is currently running. | long | -| tenable_io.scanner.shared | Indicates whether anyone other than the scanner owner has explicit access to the scanner. | boolean | -| tenable_io.scanner.source | Always set to service. | keyword | -| tenable_io.scanner.status | The status of the scanner (on or off). | keyword | -| tenable_io.scanner.supports_remote_logs | Indicates if the scanner supports remote logging. | boolean | -| tenable_io.scanner.supports_remote_settings | Indicates if the scanner supports remote settings. | boolean | -| tenable_io.scanner.supports_webapp | Indicates if the scanner supports web application scanning. | boolean | -| tenable_io.scanner.timestamp | Equivalent to the last_modification_date attribute. | date | -| tenable_io.scanner.type | The type of scanner (local, managed, managed_pvs, pool, remote, or webapp). | keyword | -| tenable_io.scanner.ui_build | The backend build of Nessus that is running on the scanner. | keyword | -| tenable_io.scanner.ui_version | The backend version of Nessus that is running on the scanner. | keyword | -| tenable_io.scanner.user_permissions | The permissions you (the current user) have been assigned for the scanner. See Permissions. | long | -| tenable_io.scanner.uuid | The UUID of the scanner. | keyword | - - ### scan This is the `scan` dataset. @@ -1330,13 +1073,13 @@ An example event for `scan` looks as following: ```json { - "@timestamp": "2023-05-23T17:00:49.842Z", + "@timestamp": "2023-09-12T08:48:29.597Z", "agent": { - "ephemeral_id": "8cd5058c-f934-44d2-91c5-29298fe980ec", - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", + "ephemeral_id": "c972edb3-4f26-46c6-b0b6-97b095789342", + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.9.0" + "version": "8.7.1" }, "data_stream": { "dataset": "tenable_io.scan", @@ -1344,21 +1087,21 @@ An example event for `scan` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "c157ef08-38bb-40dd-bae1-c6bc8c8f02fa", - "snapshot": true, - "version": "8.9.0" + "id": "9e23d05e-ba36-4bf1-a014-a7b4ab4408af", + "snapshot": false, + "version": "8.7.1" }, "event": { "agent_id_status": "verified", "category": [ "configuration" ], - "created": "2023-05-23T17:00:49.842Z", + "created": "2023-09-12T08:48:29.597Z", "dataset": "tenable_io.scan", - "ingested": "2023-05-23T17:00:50Z", + "ingested": "2023-09-12T08:48:30Z", "kind": "state", "original": "{\"control\":true,\"creation_date\":1683282785,\"enabled\":true,\"has_triggers\":false,\"id\":195,\"last_modification_date\":1683283158,\"legacy\":false,\"name\":\"Client Discovery\",\"owner\":\"jdoe@contoso.com\",\"permissions\":128,\"policy_id\":194,\"progress\":100,\"read\":false,\"rrules\":\"FREQ=WEEKLY;INTERVAL=1;BYDAY=FR\",\"schedule_uuid\":\"11c56dea-as5f-65ce-ad45-9978045df65ecade45b6e3a76871\",\"shared\":true,\"starttime\":\"20220708T033000\",\"status\":\"completed\",\"status_times\":{\"initializing\":2623,\"pending\":52799,\"processing\":1853,\"publishing\":300329,\"running\":15759},\"template_uuid\":\"a1efc3b4-cd45-a65d-fbc4-0079ebef4a56cd32a05ec2812bcf\",\"timezone\":\"America/Los_Angeles\",\"total_targets\":21,\"type\":\"remote\",\"user_permissions\":128,\"uuid\":\"a456ef1c-cbd4-ad41-f654-119b766ff61f\",\"wizard_uuid\":\"32cbd657-fe65-a45e-a45f-0079eb89e56a1c23fd5ec2812bcf\"}", "type": [ @@ -1435,9 +1178,9 @@ An example event for `scan` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1469,14 +1212,14 @@ An example event for `scan` looks as following: | tenable_io.scan.enabled | Indicates whether the scan schedule is active (true) or inactive (false). | boolean | | tenable_io.scan.has_triggers | | boolean | | tenable_io.scan.id | The unique ID of the scan. | long | -| tenable_io.scan.last_modification_date | For newly-created scans, the date on which the scan configuration was created. For scans that have been launched at least once, this attribute does not represent the date on which the scan configuration was last modified. Instead, it represents the date on which the scan was last launched, in Unix time format. Tenable.io updates this attribute each time the scan launches. | date | -| tenable_io.scan.legacy | A value indicating whether the scan results were created before a change in storage method. If true, Tenable.io stores the results in the old storage method. If false, Tenable.io stores the results in the new storage method. | boolean | +| tenable_io.scan.last_modification_date | For newly-created scans, the date on which the scan configuration was created. For scans that have been launched at least once, this attribute does not represent the date on which the scan configuration was last modified. Instead, it represents the date on which the scan was last launched, in Unix time format. Tenable Vulnerability Management updates this attribute each time the scan launches. | date | +| tenable_io.scan.legacy | A value indicating whether the scan results were created before a change in storage method. If true, Tenable Vulnerability Management stores the results in the old storage method. If false, Tenable Vulnerability Management stores the results in the new storage method. | boolean | | tenable_io.scan.name | The name of the scan. | keyword | | tenable_io.scan.owner | The owner of the scan. | keyword | | tenable_io.scan.permissions | The requesting user's permissions for the scan. | long | | tenable_io.scan.policy_id | The unique ID of the user-defined template (policy) on which the scan configuration is based. | long | | tenable_io.scan.progress | The progress of the scan ranging from 0 to 100. | long | -| tenable_io.scan.read | A value indicating whether the user account associated with the request message has viewed the scan in the Tenable.io user interface. If 1, the user account has viewed the scan results. | boolean | +| tenable_io.scan.read | A value indicating whether the user account associated with the request message has viewed the scan in the Tenable Vulnerability Management user interface. If 1, the user account has viewed the scan results. | boolean | | tenable_io.scan.rrules | The interval at which the scan repeats. The interval is formatted as a string of three values delimited by semi-colons. These values are the frequency (FREQ=ONETIME or DAILY or WEEKLY or MONTHLY or YEARLY), the interval (INTERVAL=1 or 2 or 3 ... x), and the days of the week (BYDAY=SU,MO,TU,WE,TH,FR,SA). For a scan that runs every three weeks on Monday Wednesday and Friday, the string would be FREQ=WEEKLY;INTERVAL=3;BYDAY=MO,WE,FR. If the scan is not scheduled to recur, this attribute is null. For more information, see rrules Format. | keyword | | tenable_io.scan.schedule_uuid | The UUID for a specific instance in the scan schedule. | keyword | | tenable_io.scan.shared | If true, the scan is shared with users other than the scan owner. The level of sharing is specified in the acls attribute of the scan details. | boolean | diff --git a/packages/tenable_io/img/tenable_io-logo.svg b/packages/tenable_io/img/tenable_io-logo.svg index ea8acdde4c0..bc1116a797c 100644 --- a/packages/tenable_io/img/tenable_io-logo.svg +++ b/packages/tenable_io/img/tenable_io-logo.svg @@ -1,76 +1,104 @@ - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + diff --git a/packages/tenable_io/kibana/dashboard/tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f.json b/packages/tenable_io/kibana/dashboard/tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f.json index fa10811cbb3..8d157592613 100644 --- a/packages/tenable_io/kibana/dashboard/tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f.json +++ b/packages/tenable_io/kibana/dashboard/tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f.json @@ -117,117 +117,145 @@ }, "panelIndex": "a9f9e877-b785-4f63-a8c2-29e595333768", "type": "lens", - "version": "8.6.2" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "tenable_io.scan" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a52e6a46-b7ff-4061-b78c-9a6a8c583a09", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "17987e31-f46d-49f0-9b15-c258bc02b505", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a52e6a46-b7ff-4061-b78c-9a6a8c583a09": { + "columnOrder": [ + "4181ba08-ecbf-44fd-a1e5-2f7cc25a240b", + "36740130-a3e9-4849-8275-d8412e5ecef3" + ], + "columns": { + "36740130-a3e9-4849-8275-d8412e5ecef3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Scan Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "reducedTimeRange": "30d", + "scale": "ratio", + "sourceField": "tenable_io.scan.id" + }, + "4181ba08-ecbf-44fd-a1e5-2f7cc25a240b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "tenable_io.scan.status" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "tenable_io.scan" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ - { - "id": "7465a050-edee-11ed-9e61-4baff7d3be72" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "hide_last_value_indicator": true, - "id": "8743b877-2ed4-4f18-bbc5-8d0ad10ccad1", - "index_pattern_ref_name": "metrics_e6a82bd1-0165-4881-be82-e8edadbf9a14_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "pivot_id": "tenable_io.scan.status", - "pivot_label": "Status", - "pivot_type": "string", - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "default", - "id": "38ac6efd-9ddf-4ad3-9436-92fef4acd52d", - "label": "Scan Count", - "line_width": 1, - "metrics": [ - { - "agg_with": "concat", - "field": "tenable_io.scan.status", - "id": "a761055d-92f8-407c-88fa-8c3d6265b4f4", - "order": "desc", - "order_by": "@timestamp", - "type": "top_hit" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "17987e31-f46d-49f0-9b15-c258bc02b505", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "tenable_io.scan" }, - { - "field": "tenable_io.scan.id", - "id": "9ce89140-edee-11ed-9e61-4baff7d3be72", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "type": "phrase" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "tenable_io.scan" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "last_value", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "table", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "colorMode": "none", + "columnId": "4181ba08-ecbf-44fd-a1e5-2f7cc25a240b" + }, + { + "alignment": "left", + "colorMode": "none", + "columnId": "36740130-a3e9-4849-8275-d8412e5ecef3" + } + ], + "layerId": "a52e6a46-b7ff-4061-b78c-9a6a8c583a09", + "layerType": "data", + "sorting": { + "columnId": "4181ba08-ecbf-44fd-a1e5-2f7cc25a240b" + } + } }, - "title": "", - "type": "metrics", - "uiState": {} - } + "title": "Scans by Status", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -237,156 +265,204 @@ "y": 0 }, "panelIndex": "e6a82bd1-0165-4881-be82-e8edadbf9a14", - "title": "Scans by Status", - "type": "visualization", - "version": "8.6.2" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Progress", - "field": "tenable_io.scan.progress", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bebc03cc-ac4a-44aa-b0ff-deaf1037c9b5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bebc03cc-ac4a-44aa-b0ff-deaf1037c9b5": { + "columnOrder": [ + "d80057df-f94c-4bc5-a320-654fe0ae811f", + "b2e886f3-b678-4654-9555-6ed82e733e5c", + "df6edf4c-9b19-402f-971b-94841e65a661", + "d0c034b0-d02c-4d60-bec0-d55bcef5ddeb", + "e0a8387a-a76d-4bed-a089-116d9c357659" + ], + "columns": { + "b2e886f3-b678-4654-9555-6ed82e733e5c": { + "customLabel": true, + "dataType": "boolean", + "isBucketed": true, + "label": "Enabled", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "tenable_io.scan.enabled" + }, + "d0c034b0-d02c-4d60-bec0-d55bcef5ddeb": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Status", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "tenable_io.scan.status" + }, + "d80057df-f94c-4bc5-a320-654fe0ae811f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Scan Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "tenable_io.scan.name" + }, + "df6edf4c-9b19-402f-971b-94841e65a661": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Total Targets", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "type": "alphabetical" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "tenable_io.scan.total_targets" + }, + "e0a8387a-a76d-4bed-a089-116d9c357659": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "tenable_io.scan.progress: *" + }, + "isBucketed": false, + "label": "Progress", + "operationType": "last_value", + "params": { + "showArrayValues": true, + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "tenable_io.scan.progress" + } + }, + "incompleteColumns": {} + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Scan Name", - "excludeIsRegex": true, - "field": "tenable_io.scan.name", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "\u003cNULL\u003e", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 100 + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "columnId": "e0a8387a-a76d-4bed-a089-116d9c357659" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "customLabel": "Enabled", - "excludeIsRegex": true, - "field": "tenable_io.scan.enabled", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "d80057df-f94c-4bc5-a320-654fe0ae811f" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "4", - "params": { - "customLabel": "Total Targets", - "excludeIsRegex": true, - "field": "tenable_io.scan.total_targets", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "b2e886f3-b678-4654-9555-6ed82e733e5c" }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "5", - "params": { - "customLabel": "Status", - "excludeIsRegex": true, - "field": "tenable_io.scan.status", - "includeIsRegex": true, - "missingBucket": true, - "missingBucketLabel": "\u003cNULL\u003e", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 1 + { + "alignment": "left", + "columnId": "df6edf4c-9b19-402f-971b-94841e65a661" }, - "schema": "bucket", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "count" - }, - "title": "", - "type": "table", - "uiState": { - "vis": { - "params": { - "sort": { - "columnIndex": 0, - "direction": "asc" + { + "alignment": "left", + "columnId": "d0c034b0-d02c-4d60-bec0-d55bcef5ddeb" } - } + ], + "headerRowHeight": "single", + "layerId": "bebc03cc-ac4a-44aa-b0ff-deaf1037c9b5", + "layerType": "data", + "paging": { + "enabled": true, + "size": 10 + }, + "rowHeight": "single" } - } + }, + "title": "Scans by Last Status", + "type": "lens", + "visualizationType": "lnsDatatable" }, - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 0, - "width": 293.6 - } - ], - "sort": { - "columnIndex": 0, - "direction": "asc" - } - } - } + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 17, @@ -396,9 +472,8 @@ "y": 0 }, "panelIndex": "8ee4fd2f-b69e-473d-94d2-a6b9aee769f5", - "title": "Scans by Last Status", - "type": "visualization", - "version": "8.6.2" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -510,18 +585,18 @@ "panelIndex": "f2483fe3-80ce-457f-a509-d75d75b8ff77", "title": "Scans by Enabled Status", "type": "lens", - "version": "8.6.2" + "version": "8.7.1" } ], "timeRestore": false, - "title": "[Logs Tenable IO] Scan", + "title": "[Logs Tenable Vulnerability Management] Scan", "version": 1 }, - "coreMigrationVersion": "8.6.2", - "created_at": "2023-05-08T22:35:43.238Z", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-11T05:38:40.799Z", "id": "tenable_io-0d902a50-edec-11ed-b550-bd5e656b580f", "migrationVersion": { - "dashboard": "8.6.0" + "dashboard": "8.7.0" }, "references": [ { @@ -536,17 +611,17 @@ }, { "id": "logs-*", - "name": "e6a82bd1-0165-4881-be82-e8edadbf9a14:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "e6a82bd1-0165-4881-be82-e8edadbf9a14:indexpattern-datasource-layer-a52e6a46-b7ff-4061-b78c-9a6a8c583a09", "type": "index-pattern" }, { "id": "logs-*", - "name": "e6a82bd1-0165-4881-be82-e8edadbf9a14:metrics_e6a82bd1-0165-4881-be82-e8edadbf9a14_0_index_pattern", + "name": "e6a82bd1-0165-4881-be82-e8edadbf9a14:17987e31-f46d-49f0-9b15-c258bc02b505", "type": "index-pattern" }, { "id": "logs-*", - "name": "8ee4fd2f-b69e-473d-94d2-a6b9aee769f5:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "8ee4fd2f-b69e-473d-94d2-a6b9aee769f5:indexpattern-datasource-layer-bebc03cc-ac4a-44aa-b0ff-deaf1037c9b5", "type": "index-pattern" }, { diff --git a/packages/tenable_io/kibana/dashboard/tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1.json b/packages/tenable_io/kibana/dashboard/tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1.json index 652a9bf36d5..2006a5af6de 100644 --- a/packages/tenable_io/kibana/dashboard/tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1.json +++ b/packages/tenable_io/kibana/dashboard/tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1.json @@ -1,6 +1,6 @@ { "attributes": { - "description": "This dashboard shows plugin logs collected by the Tenable IO integration.", + "description": "This dashboard shows plugin logs collected by the Tenable Vulnerability Management integration.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -135,7 +135,7 @@ "y": 0 }, "panelIndex": "c8f294c5-2d3b-4562-8a0e-c1c8a3abcdf8", - "title": "Total Plugins [Logs Tenable IO]", + "title": "Total Plugins [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -259,7 +259,7 @@ "y": 0 }, "panelIndex": "a2f99371-1e7e-4407-867d-566d28a59db3", - "title": "Total Plugins Exploited by Malware [Logs Tenable IO]", + "title": "Total Plugins Exploited by Malware [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -386,7 +386,7 @@ "y": 15 }, "panelIndex": "5b655c8d-f1f8-4eb1-9157-3c5f107ec099", - "title": "Top 10 Most Common Solutions [Logs Tenable IO]", + "title": "Top 10 Most Common Solutions [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -518,7 +518,7 @@ "y": 15 }, "panelIndex": "b4b6cd6c-1f93-47a6-b6ef-88807356de6d", - "title": "Distribution of Plugins based on Risk Factors [Logs Tenable IO]", + "title": "Distribution of Plugins based on Risk Factors [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -650,7 +650,7 @@ "y": 30 }, "panelIndex": "f2c832e3-c99d-4716-a2a1-8d3a33a8834f", - "title": "Distribution of Plugin Vulnerabilities by Patches [Logs Tenable IO]", + "title": "Distribution of Plugin Vulnerabilities by Patches [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -782,17 +782,17 @@ "y": 30 }, "panelIndex": "84e47932-741f-4852-a222-0eab1321b9b7", - "title": "Top 10 plugins with Highest VPR Score [Logs Tenable IO]", + "title": "Top 10 plugins with Highest VPR Score [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" } ], "timeRestore": false, - "title": "[Logs Tenable IO] Plugin", + "title": "[Logs Tenable Vulnerability Management] Plugin", "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-22T09:32:47.487Z", + "created_at": "2023-07-11T05:38:40.799Z", "id": "tenable_io-4d784610-1ec2-11ed-bad4-551c615a34d1", "migrationVersion": { "dashboard": "8.7.0" diff --git a/packages/tenable_io/kibana/dashboard/tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1.json b/packages/tenable_io/kibana/dashboard/tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1.json index 2b00f4cad8d..c40dfcd2619 100644 --- a/packages/tenable_io/kibana/dashboard/tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1.json +++ b/packages/tenable_io/kibana/dashboard/tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1.json @@ -1,6 +1,6 @@ { "attributes": { - "description": "This dashboard shows vulnerability logs collected by the Tenable IO integration.", + "description": "This dashboard shows vulnerability logs collected by the Tenable Vulnerability Management integration.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -135,7 +135,7 @@ "y": 0 }, "panelIndex": "f71477b9-9f08-4c4e-bfb4-bc6be7d4237c", - "title": "Total Vulnerabilities [Logs Tenable IO]", + "title": "Total Vulnerabilities [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -263,7 +263,7 @@ "y": 0 }, "panelIndex": "6891edc0-34c6-42b6-a7ac-cdeba5ff4eda", - "title": "Total Active Vulnerabilities [Logs Tenable IO]", + "title": "Total Active Vulnerabilities [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -391,7 +391,7 @@ "y": 0 }, "panelIndex": "6e2279dc-0619-437d-8283-49bfff2a3b40", - "title": "Total Fixed Vulnerabilities [Logs Tenable IO]", + "title": "Total Fixed Vulnerabilities [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -523,7 +523,7 @@ "y": 10 }, "panelIndex": "08011b1b-b5e0-4c61-8b32-ea577b76b21a", - "title": "Distribution of Vulnerabilities by Severity [Logs Tenable IO]", + "title": "Distribution of Vulnerabilities by Severity [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -655,7 +655,7 @@ "y": 10 }, "panelIndex": "8ddb2cb4-fc49-4c7e-b404-ee8e0c3643a9", - "title": "Distribution of Plugins by Family [Logs Tenable IO]", + "title": "Distribution of Plugins by Family [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -782,7 +782,7 @@ "y": 25 }, "panelIndex": "afad7b54-841b-4f10-ad54-0eca8a66ea0c", - "title": "Top 10 Plugin Names [Logs Tenable IO]", + "title": "Top 10 Plugin Names [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -914,7 +914,7 @@ "y": 25 }, "panelIndex": "945ef9e7-8d79-47fb-a468-40f5fcca9ebe", - "title": "Distribution of Plugins by Risk Factor [Logs Tenable IO]", + "title": "Distribution of Plugins by Risk Factor [Logs Tenable Vulnerability Management]", "type": "lens", "version": "8.7.1" }, @@ -1048,11 +1048,11 @@ } ], "timeRestore": false, - "title": "[Logs Tenable IO] Vulnerability", + "title": "[Logs Tenable Vulnerability Management] Vulnerability", "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-22T09:30:15.682Z", + "created_at": "2023-07-11T05:38:40.799Z", "id": "tenable_io-84586900-1ed4-11ed-bad4-551c615a34d1", "migrationVersion": { "dashboard": "8.7.0" diff --git a/packages/tenable_io/kibana/dashboard/tenable_io-a5395ac0-eb94-11ed-8b7d-ef1c8f105a1d.json b/packages/tenable_io/kibana/dashboard/tenable_io-a5395ac0-eb94-11ed-8b7d-ef1c8f105a1d.json deleted file mode 100644 index 6112927fa15..00000000000 --- a/packages/tenable_io/kibana/dashboard/tenable_io-a5395ac0-eb94-11ed-8b7d-ef1c8f105a1d.json +++ /dev/null @@ -1,915 +0,0 @@ -{ - "attributes": { - "description": "This dashboard shows scanner logs collected by the Tenable IO integration.", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "tenable_io.scanner" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "tenable_io.scanner" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c74cda3e-e23b-42a1-b8c3-46a88ffc8f5a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c74cda3e-e23b-42a1-b8c3-46a88ffc8f5a": { - "columnOrder": [ - "822eaa68-4060-43d0-b548-6df8c929aab6" - ], - "columns": { - "822eaa68-4060-43d0-b548-6df8c929aab6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Scanners and Scanner Groups", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "822eaa68-4060-43d0-b548-6df8c929aab6", - "layerId": "c74cda3e-e23b-42a1-b8c3-46a88ffc8f5a", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 7, - "i": "295bce54-6f92-4510-9feb-166aced1a3e1", - "w": 12, - "x": 0, - "y": 0 - }, - "panelIndex": "295bce54-6f92-4510-9feb-166aced1a3e1", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-36314a55-ed81-4cf3-ab00-7025b535a564", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a4256ac3-4690-445b-b437-3e45945331ab", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "36314a55-ed81-4cf3-ab00-7025b535a564": { - "columnOrder": [ - "f3464754-327f-4fdb-8ece-956a84676e2c" - ], - "columns": { - "f3464754-327f-4fdb-8ece-956a84676e2c": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Cloud Scanners", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "a4256ac3-4690-445b-b437-3e45945331ab", - "key": "tenable_io.scanner.license.activation_code", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "tenable_io.scanner.license.activation_code" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "f3464754-327f-4fdb-8ece-956a84676e2c", - "layerId": "36314a55-ed81-4cf3-ab00-7025b535a564", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 7, - "i": "2278a440-3202-4e23-a90c-e38fd0603b31", - "w": 12, - "x": 12, - "y": 0 - }, - "panelIndex": "2278a440-3202-4e23-a90c-e38fd0603b31", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-b51d0701-5590-4310-a8c2-5995994a6653", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "a887cf3e-3e9d-4fbb-a502-ef1e76476383", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "78dd656b-6669-4151-992b-d1ef69000666", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "b51d0701-5590-4310-a8c2-5995994a6653": { - "columnOrder": [ - "cf0822f0-fcec-4aa6-ba3f-b56d043f5451" - ], - "columns": { - "cf0822f0-fcec-4aa6-ba3f-b56d043f5451": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Private Scanners", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "a887cf3e-3e9d-4fbb-a502-ef1e76476383", - "key": "tenable_io.scanner.license.activation_code", - "negate": true, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "tenable_io.scanner.license.activation_code" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "78dd656b-6669-4151-992b-d1ef69000666", - "key": "tenable_io.scanner.group", - "negate": false, - "params": { - "query": false - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "tenable_io.scanner.group": false - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "cf0822f0-fcec-4aa6-ba3f-b56d043f5451", - "layerId": "b51d0701-5590-4310-a8c2-5995994a6653", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 7, - "i": "b67c46e1-9333-4892-9a7e-3105eeaedcb9", - "w": 12, - "x": 24, - "y": 0 - }, - "panelIndex": "b67c46e1-9333-4892-9a7e-3105eeaedcb9", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-18bc2c2d-c9de-4d52-a345-84015bc6f613", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "e0dae84e-0fa9-4d6d-bce4-1e93ceb6ca40", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "18bc2c2d-c9de-4d52-a345-84015bc6f613": { - "columnOrder": [ - "9ebdc460-b7ce-4bc3-a241-02a83a6399f9" - ], - "columns": { - "9ebdc460-b7ce-4bc3-a241-02a83a6399f9": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Scanner Groups", - "operationType": "unique_count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "e0dae84e-0fa9-4d6d-bce4-1e93ceb6ca40", - "key": "tenable_io.scanner.type", - "negate": false, - "params": { - "query": "pool" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "tenable_io.scanner.type": "pool" - } - } - } - ], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "9ebdc460-b7ce-4bc3-a241-02a83a6399f9", - "layerId": "18bc2c2d-c9de-4d52-a345-84015bc6f613", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 7, - "i": "f0001641-8ffb-4026-b417-a11d2838099a", - "w": 12, - "x": 36, - "y": 0 - }, - "panelIndex": "f0001641-8ffb-4026-b417-a11d2838099a", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "267960d2-8c26-4e9d-999b-6bacd6dbd9ab": { - "columnOrder": [ - "bff1960d-bac9-4313-98ce-193cb4ebb2b8", - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0" - ], - "columns": { - "bff1960d-bac9-4313-98ce-193cb4ebb2b8": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Online", - "operationType": "formula", - "params": { - "formula": "unique_count(tenable_io.scanner.uuid, kql='tenable_io.scanner.status: on')", - "isFormulaBroken": false - }, - "references": [ - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0" - ], - "scale": "ratio" - }, - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0": { - "customLabel": true, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "tenable_io.scanner.status: on" - }, - "isBucketed": false, - "label": "Part of unique_count(tenable_io.scanner.uuid, kql='tenable_io.scanner.status: on')", - "operationType": "unique_count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "bff1960d-bac9-4313-98ce-193cb4ebb2b8", - "layerId": "267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 8, - "i": "61714e6e-aefc-44ad-bd25-064032c36192", - "w": 8, - "x": 0, - "y": 7 - }, - "panelIndex": "61714e6e-aefc-44ad-bd25-064032c36192", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "267960d2-8c26-4e9d-999b-6bacd6dbd9ab": { - "columnOrder": [ - "bff1960d-bac9-4313-98ce-193cb4ebb2b8", - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0" - ], - "columns": { - "bff1960d-bac9-4313-98ce-193cb4ebb2b8": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Offline", - "operationType": "formula", - "params": { - "formula": "unique_count(tenable_io.scanner.uuid, kql='tenable_io.scanner.status: off')", - "isFormulaBroken": false - }, - "references": [ - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0" - ], - "scale": "ratio" - }, - "bff1960d-bac9-4313-98ce-193cb4ebb2b8X0": { - "customLabel": true, - "dataType": "number", - "filter": { - "language": "kuery", - "query": "tenable_io.scanner.status: off" - }, - "isBucketed": false, - "label": "Part of Online", - "operationType": "unique_count", - "params": { - "emptyAsNull": false - }, - "scale": "ratio", - "sourceField": "tenable_io.scanner.uuid" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "accessor": "bff1960d-bac9-4313-98ce-193cb4ebb2b8", - "layerId": "267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "layerType": "data", - "textAlign": "center", - "titlePosition": "bottom" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsLegacyMetric" - }, - "enhancements": {}, - "hidePanelTitles": true - }, - "gridData": { - "h": 8, - "i": "76f1c1f6-64e8-4188-9f28-82b15a256975", - "w": 8, - "x": 8, - "y": 7 - }, - "panelIndex": "76f1c1f6-64e8-4188-9f28-82b15a256975", - "type": "lens", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "aggregate": "concat", - "customLabel": "Status", - "field": "tenable_io.scanner.status", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Scanner Name", - "excludeIsRegex": true, - "field": "host.name", - "includeIsRegex": true, - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "_key", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 50 - }, - "schema": "bucket", - "type": "terms" - }, - { - "enabled": true, - "id": "3", - "params": { - "aggregate": "concat", - "customLabel": "Active Scans", - "field": "tenable_io.scanner.scan_count", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "4", - "params": { - "aggregate": "concat", - "customLabel": "Engine Version", - "field": "tenable_io.scanner.engine_version", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "5", - "params": { - "aggregate": "concat", - "customLabel": "Last Connected", - "field": "tenable_io.scanner.last_connect", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - }, - { - "enabled": true, - "id": "6", - "params": { - "aggregate": "concat", - "customLabel": "Last Modified", - "field": "tenable_io.scanner.last_modification_date", - "size": 1, - "sortField": "@timestamp", - "sortOrder": "desc" - }, - "schema": "metric", - "type": "top_hits" - } - ], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "tenable_io.scanner" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "tenable_io.scanner" - } - } - } - ], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "autoFitRowToContent": false, - "perPage": 10, - "percentageCol": "", - "showMetricsAtAllLevels": false, - "showPartialRows": false, - "showToolbar": false, - "showTotal": false, - "totalFunc": "sum" - }, - "title": "", - "type": "table", - "uiState": {} - }, - "vis": { - "params": { - "colWidth": [ - { - "colIndex": 0, - "width": 204.83333333333334 - }, - { - "colIndex": 1, - "width": 91.23333333333332 - }, - { - "colIndex": 2, - "width": 116.73333333333335 - } - ] - } - } - }, - "gridData": { - "h": 17, - "i": "bb11ab83-ee68-48dc-b25a-8a56e4f91c0b", - "w": 32, - "x": 16, - "y": 7 - }, - "panelIndex": "bb11ab83-ee68-48dc-b25a-8a56e4f91c0b", - "type": "visualization", - "version": "8.6.2" - }, - { - "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": {} - }, - "description": "", - "id": "", - "params": { - "fontSize": 12, - "markdown": "", - "openLinksInNewTab": false - }, - "title": "", - "type": "markdown", - "uiState": {} - } - }, - "gridData": { - "h": 9, - "i": "8a9a3a30-433d-4373-b28e-fe12a0ca38de", - "w": 16, - "x": 0, - "y": 15 - }, - "panelIndex": "8a9a3a30-433d-4373-b28e-fe12a0ca38de", - "type": "visualization", - "version": "8.6.2" - } - ], - "timeRestore": false, - "title": "[Logs Tenable IO] Scanner", - "version": 1 - }, - "coreMigrationVersion": "8.6.2", - "created_at": "2023-05-06T01:56:13.499Z", - "id": "tenable_io-a5395ac0-eb94-11ed-8b7d-ef1c8f105a1d", - "migrationVersion": { - "dashboard": "8.6.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "295bce54-6f92-4510-9feb-166aced1a3e1:indexpattern-datasource-layer-c74cda3e-e23b-42a1-b8c3-46a88ffc8f5a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "2278a440-3202-4e23-a90c-e38fd0603b31:indexpattern-datasource-layer-36314a55-ed81-4cf3-ab00-7025b535a564", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "2278a440-3202-4e23-a90c-e38fd0603b31:a4256ac3-4690-445b-b437-3e45945331ab", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b67c46e1-9333-4892-9a7e-3105eeaedcb9:indexpattern-datasource-layer-b51d0701-5590-4310-a8c2-5995994a6653", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b67c46e1-9333-4892-9a7e-3105eeaedcb9:a887cf3e-3e9d-4fbb-a502-ef1e76476383", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b67c46e1-9333-4892-9a7e-3105eeaedcb9:78dd656b-6669-4151-992b-d1ef69000666", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f0001641-8ffb-4026-b417-a11d2838099a:indexpattern-datasource-layer-18bc2c2d-c9de-4d52-a345-84015bc6f613", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f0001641-8ffb-4026-b417-a11d2838099a:e0dae84e-0fa9-4d6d-bce4-1e93ceb6ca40", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "61714e6e-aefc-44ad-bd25-064032c36192:indexpattern-datasource-layer-267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "76f1c1f6-64e8-4188-9f28-82b15a256975:indexpattern-datasource-layer-267960d2-8c26-4e9d-999b-6bacd6dbd9ab", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bb11ab83-ee68-48dc-b25a-8a56e4f91c0b:kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "bb11ab83-ee68-48dc-b25a-8a56e4f91c0b:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/tenable_io/kibana/dashboard/tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1.json b/packages/tenable_io/kibana/dashboard/tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1.json index e762f9d0595..5ee56e16a79 100644 --- a/packages/tenable_io/kibana/dashboard/tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1.json +++ b/packages/tenable_io/kibana/dashboard/tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1.json @@ -1,7 +1,6 @@ { "attributes": { - "description": "This dashboard shows asset logs collected by the Tenable IO integration.", - "hits": 0, + "description": "This dashboard shows asset logs collected by the Tenable Vulnerability Management integration.", "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -90,13 +91,12 @@ "titlePosition": "bottom" } }, - "title": "Total Assets [Logs Tenable IO]", + "title": "Total Assets [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" + "hidePanelTitles": true }, "gridData": { "h": 11, @@ -106,9 +106,9 @@ "y": 0 }, "panelIndex": "b3e6ab85-6dd7-43ec-837b-1545f4c17855", - "title": "Total Assets [Logs Tenable IO]", + "title": "Total Assets [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -181,13 +181,12 @@ "titlePosition": "bottom" } }, - "title": "Total Authenticated Assets [Logs Tenable IO]", + "title": "Total Authenticated Assets [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" + "hidePanelTitles": true }, "gridData": { "h": 11, @@ -197,9 +196,9 @@ "y": 0 }, "panelIndex": "e9052334-0d2b-45be-b41a-46b080e50272", - "title": "Total Authenticated Assets [Logs Tenable IO]", + "title": "Total Authenticated Assets [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -272,13 +271,12 @@ "titlePosition": "bottom" } }, - "title": "Total Licensed Assets [Logs Tenable IO]", + "title": "Total Licensed Assets [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, - "hidePanelTitles": true, - "type": "lens" + "hidePanelTitles": true }, "gridData": { "h": 11, @@ -288,9 +286,9 @@ "y": 0 }, "panelIndex": "c707f849-a905-4032-a5e4-e5a0d58b64af", - "title": "Total Licensed Assets [Logs Tenable IO]", + "title": "Total Licensed Assets [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -370,13 +368,12 @@ "layerType": "data" } }, - "title": "Top 10 Installed Softwares [Logs Tenable IO]", + "title": "Top 10 Installed Softwares [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -386,9 +383,9 @@ "y": 11 }, "panelIndex": "4185b204-1eea-4ace-ab61-7d2a1fb3b7c1", - "title": "Top 10 Installed Softwares [Logs Tenable IO]", + "title": "Top 10 Installed Softwares [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -473,8 +470,7 @@ "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -484,9 +480,9 @@ "y": 11 }, "panelIndex": "a6607645-e5d3-4008-b338-96ada54f41b0", - "title": "Top 10 Sources Who Reported Assets [Logs Tenable IO]", + "title": "Top 10 Sources Who Reported Assets [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -571,13 +567,12 @@ "rowHeightLines": 1 } }, - "title": "Top 10 Active Assets with Highest ACR [Logs Tenable IO]", + "title": "Top 10 Active Assets with Highest ACR [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -587,9 +582,9 @@ "y": 26 }, "panelIndex": "54cf9510-7027-4588-8b8f-cf36f78990d2", - "title": "Top 10 Active Assets with Highest ACR [Logs Tenable IO]", + "title": "Top 10 Active Assets with Highest ACR [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -674,13 +669,12 @@ "rowHeightLines": 1 } }, - "title": "Top 10 Active Assets with Highest AES [Logs Tenable IO]", + "title": "Top 10 Active Assets with Highest AES [Logs Tenable Vulnerability Management]", "type": "lens", "visualizationType": "lnsDatatable" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -690,9 +684,9 @@ "y": 26 }, "panelIndex": "68f15968-3875-4005-8d0c-20abacc1377d", - "title": "Top 10 Active Assets with Highest AES [Logs Tenable IO]", + "title": "Top 10 Active Assets with Highest AES [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -785,8 +779,7 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -796,9 +789,9 @@ "y": 41 }, "panelIndex": "3c3e1a67-05ba-4814-9c05-e50117df47db", - "title": "Distribution of Assets by FQDNS [Logs Tenable IO]", + "title": "Distribution of Assets by FQDNS [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -894,8 +887,7 @@ "visualizationType": "lnsXY" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -905,9 +897,9 @@ "y": 41 }, "panelIndex": "ce0870ce-7f36-493f-93fa-bdeee9a286fd", - "title": "Distribution of Assets by Tags [Logs Tenable IO]", + "title": "Distribution of Assets by Tags [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -999,8 +991,7 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1010,9 +1001,9 @@ "y": 56 }, "panelIndex": "c889a431-2c13-4e6e-a148-208aa7ec9046", - "title": "Distribution of Assets by netBIOS [Logs Tenable IO]", + "title": "Distribution of Assets by netBIOS [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1104,8 +1095,7 @@ "visualizationType": "lnsPie" }, "enhancements": {}, - "hidePanelTitles": false, - "type": "lens" + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1115,17 +1105,17 @@ "y": 56 }, "panelIndex": "ce9d7c83-826d-4c85-8b60-78184f101d6c", - "title": "Distribution of Assets by OS [Logs Tenable IO]", + "title": "Distribution of Assets by OS [Logs Tenable Vulnerability Management]", "type": "lens", - "version": "8.7.0" + "version": "8.7.1" } ], "timeRestore": false, - "title": "[Logs Tenable IO] Asset", + "title": "[Logs Tenable Vulnerability Management] Asset", "version": 1 }, "coreMigrationVersion": "8.7.1", - "created_at": "2023-05-18T06:47:45.262Z", + "created_at": "2023-07-11T05:38:40.799Z", "id": "tenable_io-f2dacba0-1e22-11ed-bad4-551c615a34d1", "migrationVersion": { "dashboard": "8.7.0" diff --git a/packages/tenable_io/kibana/tags.yml b/packages/tenable_io/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/tenable_io/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/tenable_io/manifest.yml b/packages/tenable_io/manifest.yml index 01042b85753..1af65d183eb 100644 --- a/packages/tenable_io/manifest.yml +++ b/packages/tenable_io/manifest.yml @@ -1,36 +1,37 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: tenable_io -title: Tenable.io -version: "1.0.0" -description: Collect logs from Tenable.io with Elastic Agent. +title: Tenable Vulnerability Management +version: "2.2.0" +description: Collect logs from Tenable Vulnerability Management with Elastic Agent. type: integration categories: - security conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 screenshots: - src: /img/tenable_io-screenshot.png - title: Tenable.io dashboard screenshot + title: Tenable Vulnerability Management dashboard screenshot size: 600x600 type: image/png icons: - src: /img/tenable_io-logo.svg - title: Tenable.io logo + title: Tenable Vulnerability Management logo size: 32x32 type: image/svg+xml policy_templates: - name: tenable_io - title: Tenable.io - description: Collect logs from Tenable.io. + title: Tenable Vulnerability Management + description: Collect logs from Tenable Vulnerability Management. inputs: - type: httpjson - title: Collect Tenable.io logs via API - description: Collecting Tenable.io logs via API. + title: Collect Tenable Vulnerability Management logs via API + description: Collecting Tenable Vulnerability Management logs via API. vars: - name: hostname type: text title: URL - description: URL for the Tenable.io API (Add https:// before the url). + description: URL for the Tenable Vulnerability Management API (Add https:// before the url). default: https://cloud.tenable.com show_user: true required: true @@ -44,14 +45,14 @@ policy_templates: - name: access_key type: password title: Access Key - description: Access key for the Tenable.io API. + description: Access key for the Tenable Vulnerability Management API. multi: false required: true show_user: true - name: secret_key type: password title: Secret Key - description: Secret key for the Tenable.io API. + description: Secret key for the Tenable Vulnerability Management API. multi: false required: true show_user: true @@ -93,3 +94,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/tenable_sc/_dev/build/build.yml b/packages/tenable_sc/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/tenable_sc/_dev/build/build.yml +++ b/packages/tenable_sc/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/tenable_sc/changelog.yml b/packages/tenable_sc/changelog.yml index 5449515d780..bae7b89f94d 100644 --- a/packages/tenable_sc/changelog.yml +++ b/packages/tenable_sc/changelog.yml @@ -1,4 +1,27 @@ # newer versions go on top +- version: "1.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.14.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7313 +- version: "1.13.0" + changes: + - description: Add `tenable_sc.vulnerability.age` field. + type: enhancement + link: https://github.com/elastic/integrations/pull/7210 + - description: Update User-Agent version sent to API. + type: bugfix + link: https://github.com/elastic/integrations/pull/7210 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json b/packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json index 283ed053b68..d38929e4972 100644 --- a/packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json +++ b/packages/tenable_sc/data_stream/asset/_dev/test/pipeline/test-asset.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -82,7 +82,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -162,7 +162,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -243,7 +243,7 @@ { "@timestamp": "2022-11-15T09:28:32.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/tenable_sc/data_stream/asset/agent/stream/httpjson.yml.hbs b/packages/tenable_sc/data_stream/asset/agent/stream/httpjson.yml.hbs index 15c7395e487..c78e33bda98 100644 --- a/packages/tenable_sc/data_stream/asset/agent/stream/httpjson.yml.hbs +++ b/packages/tenable_sc/data_stream/asset/agent/stream/httpjson.yml.hbs @@ -19,7 +19,7 @@ request.transforms: # Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header # NOTE: The "Build" version must be kept in sync with this package's version. target: header.User-Agent - value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.6.2)"]]' + value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.13.0)"]]' - set: target: body.query.tool value: 'sumip' diff --git a/packages/tenable_sc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_sc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml index 5da7bf99342..f09f699e12a 100644 --- a/packages/tenable_sc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_sc/data_stream/asset/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Tenable.sc asset logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/tenable_sc/data_stream/asset/sample_event.json b/packages/tenable_sc/data_stream/asset/sample_event.json index 8c0c561c8ef..9cd97060aa2 100644 --- a/packages/tenable_sc/data_stream/asset/sample_event.json +++ b/packages/tenable_sc/data_stream/asset/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-01-13T12:38:22.330Z", + "@timestamp": "2023-08-08T15:37:04.663Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "1617d168-7191-4320-9b5c-87e37ab77b0f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.asset", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "host" ], - "created": "2023-01-13T12:38:22.330Z", + "created": "2023-08-08T15:37:04.663Z", "dataset": "tenable_sc.asset", - "ingested": "2023-01-13T12:38:23Z", + "ingested": "2023-08-08T15:37:07Z", "kind": "state", "original": "{\"biosGUID\":\"9e8c4d43-982b-4405-a76c-d56c1d6cf117\",\"dnsName\":\"rnkmigauv2l8zeyf.example\",\"hostUniqueness\":\"repositoryID,ip,dnsName\",\"ip\":\"0.0.228.153\",\"lastAuthRun\":\"\",\"lastUnauthRun\":\"\",\"macAddress\":\"00:00:00:47:05:0d\",\"mcafeeGUID\":\"\",\"netbiosName\":\"UNKNOWN\\\\RNKMIGAUV2L8ZEYF.EXAMPLE\",\"osCPE\":\"cpe:/o:microsoft:windows_10:::x64-home\",\"pluginSet\":\"201901281542\",\"policyName\":\"Basic Agent Scan\",\"repository\":{\"dataFormat\":\"IPv4\",\"description\":\"\",\"id\":\"2\",\"name\":\"Staged-Large\",\"sciID\":\"1\"},\"score\":\"307\",\"severityCritical\":\"6\",\"severityHigh\":\"4\",\"severityInfo\":\"131\",\"severityLow\":\"0\",\"severityMedium\":\"9\",\"total\":\"150\",\"tpmID\":\"\",\"uniqueness\":\"repositoryID,ip,dnsName\",\"uuid\":\"4add65d0-27fc-491c-91ba-3f498a61f49e\"}", "type": [ diff --git a/packages/tenable_sc/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json b/packages/tenable_sc/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json index f37803f932c..95d304f6694 100644 --- a/packages/tenable_sc/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json +++ b/packages/tenable_sc/data_stream/plugin/_dev/test/pipeline/test-plugin.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-27T01:36:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -97,7 +97,7 @@ { "@timestamp": "2021-10-27T01:36:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -244,7 +244,7 @@ { "@timestamp": "2021-10-27T01:36:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", @@ -374,7 +374,7 @@ { "@timestamp": "2021-09-27T01:33:53.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "kind": "event", diff --git a/packages/tenable_sc/data_stream/plugin/agent/stream/httpjson.yml.hbs b/packages/tenable_sc/data_stream/plugin/agent/stream/httpjson.yml.hbs index 8fe7c7c1330..92e560ac401 100644 --- a/packages/tenable_sc/data_stream/plugin/agent/stream/httpjson.yml.hbs +++ b/packages/tenable_sc/data_stream/plugin/agent/stream/httpjson.yml.hbs @@ -19,7 +19,7 @@ request.transforms: # Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header # NOTE: The "Build" version must be kept in sync with this package's version. target: header.User-Agent - value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.6.2)"]]' + value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.13.0)"]]' - set: target: url.params.fields value: id,name,description,family,type,copyright,version,sourceFile,dependencies,requiredPorts,requiredUDPPorts,cpe,srcPort,dstPort,protocol,riskFactor,solution,seeAlso,synopsis,checkType,exploitEase,exploitAvailable,exploitFrameworks,cvssVector,cvssVectorBF,baseScore,temporalScore,cvssV3Vector,cvssV3VectorBF,cvssV3BaseScore,cvssV3TemporalScore,vprScore,vprContext,stigSeverity,pluginPubDate,pluginModDate,patchPubDate,patchModDate,vulnPubDate,modifiedTime,md5,xrefs diff --git a/packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml index 85ceed666e4..77573957223 100644 --- a/packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_sc/data_stream/plugin/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Tenable.sc plugin logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/tenable_sc/data_stream/plugin/sample_event.json b/packages/tenable_sc/data_stream/plugin/sample_event.json index 234244513e5..bfe8dea0323 100644 --- a/packages/tenable_sc/data_stream/plugin/sample_event.json +++ b/packages/tenable_sc/data_stream/plugin/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-09-27T01:33:53.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "90385a6e-35a8-4f5d-bb93-5e1849ef9008", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.plugin", @@ -13,18 +13,18 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "created": "2023-01-13T12:39:03.654Z", + "created": "2023-08-08T15:38:01.812Z", "dataset": "tenable_sc.plugin", - "ingested": "2023-01-13T12:39:04Z", + "ingested": "2023-08-08T15:38:04Z", "kind": "event", "original": "{\"baseScore\":\"7.8\",\"checkType\":\"remote\",\"copyright\":\"This script is Copyright (C) 2003-2020 John Lampe\",\"cpe\":\"\",\"cvssV3BaseScore\":null,\"cvssV3TemporalScore\":null,\"cvssV3Vector\":\"\",\"cvssV3VectorBF\":\"0\",\"cvssVector\":\"AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C\",\"cvssVectorBF\":\"2164920932\",\"dependencies\":\"find_service1.nasl,http_version.nasl,www_fingerprinting_hmap.nasl\",\"description\":\"Microsoft IIS, running Frontpage extensions, is vulnerable to a remote denial of service attack usually called the 'malformed web submission' vulnerability. An attacker, exploiting this vulnerability, will be able to render the service unusable.\\n\\nIf this machine serves a business-critical function, there could be an impact to the business.\",\"dstPort\":null,\"exploitAvailable\":\"false\",\"exploitEase\":\"No known exploits are available\",\"exploitFrameworks\":\"\",\"family\":{\"id\":\"11\",\"name\":\"Web Servers\",\"type\":\"active\"},\"id\":\"10585\",\"md5\":\"38b2147401eb5c3a15af52182682f345\",\"modifiedTime\":\"1632706433\",\"name\":\"Microsoft IIS Frontpage Server Extensions (FPSE) Malformed Form DoS\",\"patchModDate\":\"-1\",\"patchPubDate\":\"-1\",\"pluginModDate\":\"1591963200\",\"pluginPubDate\":\"1058875200\",\"protocol\":\"\",\"requiredPorts\":\"\",\"requiredUDPPorts\":\"\",\"riskFactor\":\"High\",\"seeAlso\":\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2000/ms00-100\",\"solution\":\"Microsoft has released a set of patches for IIS 4.0 and 5.0.\",\"sourceFile\":\"IIS_frontpage_DOS_2.nasl\",\"srcPort\":null,\"stigSeverity\":null,\"synopsis\":\"The remote web server is vulnerable to a denial of service\",\"temporalScore\":\"5.8\",\"type\":\"active\",\"version\":\"1.28\",\"vprContext\":\"[{\\\"id\\\":\\\"age_of_vuln\\\",\\\"name\\\":\\\"Vulnerability Age\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"730 days +\\\"},{\\\"id\\\":\\\"cvssV3_impactScore\\\",\\\"name\\\":\\\"CVSS v3 Impact Score\\\",\\\"type\\\":\\\"number\\\",\\\"value\\\":3.6000000000000001},{\\\"id\\\":\\\"exploit_code_maturity\\\",\\\"name\\\":\\\"Exploit Code Maturity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Unproven\\\"},{\\\"id\\\":\\\"product_coverage\\\",\\\"name\\\":\\\"Product Coverage\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Low\\\"},{\\\"id\\\":\\\"threat_intensity_last_28\\\",\\\"name\\\":\\\"Threat Intensity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very Low\\\"},{\\\"id\\\":\\\"threat_recency\\\",\\\"name\\\":\\\"Threat Recency\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"\\u003e 365 days\\\"},{\\\"id\\\":\\\"threat_sources_last_28\\\",\\\"name\\\":\\\"Threat Sources\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"}]\",\"vprScore\":\"4.4\",\"vulnPubDate\":\"977486400\",\"xrefs\":\"CVE:CVE-2001-0096, BID:2144, MSFT:MS00-100, MSKB:280322\"}", "type": [ diff --git a/packages/tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json b/packages/tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json index dcb5172296a..147a487d176 100644 --- a/packages/tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json +++ b/packages/tenable_sc/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-09-25T16:08:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -47,6 +47,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 721, "check_type": "remote", "custom_hash": "Fuc8qcWC98GkPGCrMlfPwDoJMORaLOCRNvpzE/NzpsA=", "dns": { @@ -127,7 +128,7 @@ { "@timestamp": "2021-09-25T16:08:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -171,6 +172,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 721, "check_type": "remote", "custom_hash": "Fuc8qcWC98GkPGCrMlfPwDoJMORaLOCRNvpzE/NzpsA=", "dns": { @@ -251,7 +253,7 @@ { "@timestamp": "2021-09-25T16:08:45.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -295,6 +297,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 940, "base_score": "0.0", "check_type": "remote", "custom_hash": "qVUXK2YtClsBlXncLYHLhVzynYK4hG2NbT0hY6guQm0=", @@ -439,7 +442,7 @@ { "@timestamp": "2021-10-30T16:12:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -483,6 +486,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 791, "base_score": "7.5", "check_type": "local", "cpe": [ @@ -661,7 +665,7 @@ { "@timestamp": "2021-10-30T16:12:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -705,6 +709,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 224, "base_score": "6.8", "check_type": "local", "cpe": [ diff --git a/packages/tenable_sc/data_stream/vulnerability/agent/stream/httpjson.yml.hbs b/packages/tenable_sc/data_stream/vulnerability/agent/stream/httpjson.yml.hbs index 21e895a6f89..4cb25652cdf 100644 --- a/packages/tenable_sc/data_stream/vulnerability/agent/stream/httpjson.yml.hbs +++ b/packages/tenable_sc/data_stream/vulnerability/agent/stream/httpjson.yml.hbs @@ -19,7 +19,7 @@ request.transforms: # Follow Tenable's format: https://developer.tenable.com/docs/user-agent-header # NOTE: The "Build" version must be kept in sync with this package's version. target: header.User-Agent - value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.6.2)"]]' + value: '[[userAgent "Integration/1.0 (Elastic; Tenable.sc; Build/1.13.0)"]]' - set: target: body.query.tool value: 'vulndetails' diff --git a/packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml b/packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml index 633c731ff61..e770f4c7f32 100644 --- a/packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tenable_sc/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Tenable.sc vulnerability logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -279,6 +279,12 @@ processors: - append: field: error.message value: '{{{_ingest.on_failure_message}}}' + - script: + lang: painless + tag: set_vulnerability_age + if: ctx.tenable_sc?.vulnerability?.first_seen != null && ctx.tenable_sc?.vulnerability?.last_seen != null + source: | + ctx.tenable_sc.vulnerability.age = ChronoUnit.DAYS.between(ZonedDateTime.parse(ctx.tenable_sc.vulnerability.first_seen), ZonedDateTime.parse(ctx.tenable_sc.vulnerability.last_seen)); - set: field: tenable_sc.vulnerability.exploit.is_available value: true diff --git a/packages/tenable_sc/data_stream/vulnerability/fields/fields.yml b/packages/tenable_sc/data_stream/vulnerability/fields/fields.yml index b253162929d..9a0f703af9a 100644 --- a/packages/tenable_sc/data_stream/vulnerability/fields/fields.yml +++ b/packages/tenable_sc/data_stream/vulnerability/fields/fields.yml @@ -5,6 +5,10 @@ type: keyword description: | N/A. + - name: age + type: long + description: | + The time in days between the first and last time the vulnerability was seen. - name: base_score type: keyword description: | diff --git a/packages/tenable_sc/data_stream/vulnerability/sample_event.json b/packages/tenable_sc/data_stream/vulnerability/sample_event.json index 2dda5d3b2d6..7586566787e 100644 --- a/packages/tenable_sc/data_stream/vulnerability/sample_event.json +++ b/packages/tenable_sc/data_stream/vulnerability/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-09-25T16:08:45.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "4ec981c8-77b2-45cc-b184-d912c9662747", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.vulnerability", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-01-13T12:39:40.914Z", + "created": "2023-08-08T15:38:56.843Z", "dataset": "tenable_sc.vulnerability", - "ingested": "2023-01-13T12:39:41Z", + "ingested": "2023-08-08T15:38:59Z", "kind": "event", "original": "{\"acceptRisk\":\"0\",\"baseScore\":\"0.0\",\"bid\":\"\",\"checkType\":\"remote\",\"cpe\":\"\",\"cve\":\"CVE-1999-0524\",\"cvssV3BaseScore\":\"0.0\",\"cvssV3TemporalScore\":\"\",\"cvssV3Vector\":\"AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N\",\"cvssVector\":\"AV:L/AC:L/Au:N/C:N/I:N/A:N\",\"description\":\"The remote host answers to an ICMP timestamp request. This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.\\n\\nTimestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.\",\"dnsName\":\"_gateway.lxd\",\"exploitAvailable\":\"No\",\"exploitEase\":\"\",\"exploitFrameworks\":\"\",\"family\":{\"id\":\"30\",\"name\":\"General\",\"type\":\"active\"},\"firstSeen\":\"1551284872\",\"hasBeenMitigated\":\"0\",\"hostUniqueness\":\"repositoryID,ip,dnsName\",\"ip\":\"10.238.64.1\",\"ips\":\"10.238.64.1\",\"lastSeen\":\"1632586125\",\"macAddress\":\"00:16:3e:a1:12:f7\",\"netbiosName\":\"\",\"operatingSystem\":\"Linux Kernel 2.6\",\"patchPubDate\":\"-1\",\"pluginID\":\"10114\",\"pluginInfo\":\"10114 (0/1) ICMP Timestamp Request Remote Date Disclosure\",\"pluginModDate\":\"1570190400\",\"pluginName\":\"ICMP Timestamp Request Remote Date Disclosure\",\"pluginPubDate\":\"933508800\",\"pluginText\":\"\\u003cplugin_output\\u003eThe remote clock is synchronized with the local clock.\\n\\u003c/plugin_output\\u003e\",\"port\":\"0\",\"protocol\":\"ICMP\",\"recastRisk\":\"0\",\"repository\":{\"dataFormat\":\"IPv4\",\"description\":\"\",\"id\":\"1\",\"name\":\"Live\",\"sciID\":\"1\"},\"riskFactor\":\"None\",\"seeAlso\":\"\",\"severity\":{\"description\":\"Informative\",\"id\":\"0\",\"name\":\"Info\"},\"solution\":\"Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).\",\"stigSeverity\":\"\",\"synopsis\":\"It is possible to determine the exact time set on the remote host.\",\"temporalScore\":\"\",\"uniqueness\":\"repositoryID,ip,dnsName\",\"uuid\":\"\",\"version\":\"1.48\",\"vprContext\":\"[{\\\"id\\\":\\\"age_of_vuln\\\",\\\"name\\\":\\\"Vulnerability Age\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"730 days +\\\"},{\\\"id\\\":\\\"cvssV3_impactScore\\\",\\\"name\\\":\\\"CVSS v3 Impact Score\\\",\\\"type\\\":\\\"number\\\",\\\"value\\\":0},{\\\"id\\\":\\\"exploit_code_maturity\\\",\\\"name\\\":\\\"Exploit Code Maturity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Unproven\\\"},{\\\"id\\\":\\\"product_coverage\\\",\\\"name\\\":\\\"Product Coverage\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very High\\\"},{\\\"id\\\":\\\"threat_intensity_last_28\\\",\\\"name\\\":\\\"Threat Intensity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very Low\\\"},{\\\"id\\\":\\\"threat_recency\\\",\\\"name\\\":\\\"Threat Recency\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"},{\\\"id\\\":\\\"threat_sources_last_28\\\",\\\"name\\\":\\\"Threat Sources\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"}]\",\"vprScore\":\"0.8\",\"vulnPubDate\":\"788961600\",\"xref\":\"CWE #200\"}", "type": [ @@ -71,6 +71,7 @@ "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 940, "base_score": "0.0", "check_type": "remote", "custom_hash": "qVUXK2YtClsBlXncLYHLhVzynYK4hG2NbT0hY6guQm0=", diff --git a/packages/tenable_sc/docs/README.md b/packages/tenable_sc/docs/README.md index 75f5b66d0c4..73bd41d8bde 100644 --- a/packages/tenable_sc/docs/README.md +++ b/packages/tenable_sc/docs/README.md @@ -29,13 +29,13 @@ An example event for `asset` looks as following: ```json { - "@timestamp": "2023-01-13T12:38:22.330Z", + "@timestamp": "2023-08-08T15:37:04.663Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "1617d168-7191-4320-9b5c-87e37ab77b0f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.asset", @@ -43,21 +43,21 @@ An example event for `asset` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "host" ], - "created": "2023-01-13T12:38:22.330Z", + "created": "2023-08-08T15:37:04.663Z", "dataset": "tenable_sc.asset", - "ingested": "2023-01-13T12:38:23Z", + "ingested": "2023-08-08T15:37:07Z", "kind": "state", "original": "{\"biosGUID\":\"9e8c4d43-982b-4405-a76c-d56c1d6cf117\",\"dnsName\":\"rnkmigauv2l8zeyf.example\",\"hostUniqueness\":\"repositoryID,ip,dnsName\",\"ip\":\"0.0.228.153\",\"lastAuthRun\":\"\",\"lastUnauthRun\":\"\",\"macAddress\":\"00:00:00:47:05:0d\",\"mcafeeGUID\":\"\",\"netbiosName\":\"UNKNOWN\\\\RNKMIGAUV2L8ZEYF.EXAMPLE\",\"osCPE\":\"cpe:/o:microsoft:windows_10:::x64-home\",\"pluginSet\":\"201901281542\",\"policyName\":\"Basic Agent Scan\",\"repository\":{\"dataFormat\":\"IPv4\",\"description\":\"\",\"id\":\"2\",\"name\":\"Staged-Large\",\"sciID\":\"1\"},\"score\":\"307\",\"severityCritical\":\"6\",\"severityHigh\":\"4\",\"severityInfo\":\"131\",\"severityLow\":\"0\",\"severityMedium\":\"9\",\"total\":\"150\",\"tpmID\":\"\",\"uniqueness\":\"repositoryID,ip,dnsName\",\"uuid\":\"4add65d0-27fc-491c-91ba-3f498a61f49e\"}", "type": [ @@ -160,9 +160,9 @@ An example event for `asset` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -227,11 +227,11 @@ An example event for `plugin` looks as following: { "@timestamp": "2021-09-27T01:33:53.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "90385a6e-35a8-4f5d-bb93-5e1849ef9008", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.plugin", @@ -239,18 +239,18 @@ An example event for `plugin` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "created": "2023-01-13T12:39:03.654Z", + "created": "2023-08-08T15:38:01.812Z", "dataset": "tenable_sc.plugin", - "ingested": "2023-01-13T12:39:04Z", + "ingested": "2023-08-08T15:38:04Z", "kind": "event", "original": "{\"baseScore\":\"7.8\",\"checkType\":\"remote\",\"copyright\":\"This script is Copyright (C) 2003-2020 John Lampe\",\"cpe\":\"\",\"cvssV3BaseScore\":null,\"cvssV3TemporalScore\":null,\"cvssV3Vector\":\"\",\"cvssV3VectorBF\":\"0\",\"cvssVector\":\"AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C\",\"cvssVectorBF\":\"2164920932\",\"dependencies\":\"find_service1.nasl,http_version.nasl,www_fingerprinting_hmap.nasl\",\"description\":\"Microsoft IIS, running Frontpage extensions, is vulnerable to a remote denial of service attack usually called the 'malformed web submission' vulnerability. An attacker, exploiting this vulnerability, will be able to render the service unusable.\\n\\nIf this machine serves a business-critical function, there could be an impact to the business.\",\"dstPort\":null,\"exploitAvailable\":\"false\",\"exploitEase\":\"No known exploits are available\",\"exploitFrameworks\":\"\",\"family\":{\"id\":\"11\",\"name\":\"Web Servers\",\"type\":\"active\"},\"id\":\"10585\",\"md5\":\"38b2147401eb5c3a15af52182682f345\",\"modifiedTime\":\"1632706433\",\"name\":\"Microsoft IIS Frontpage Server Extensions (FPSE) Malformed Form DoS\",\"patchModDate\":\"-1\",\"patchPubDate\":\"-1\",\"pluginModDate\":\"1591963200\",\"pluginPubDate\":\"1058875200\",\"protocol\":\"\",\"requiredPorts\":\"\",\"requiredUDPPorts\":\"\",\"riskFactor\":\"High\",\"seeAlso\":\"https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2000/ms00-100\",\"solution\":\"Microsoft has released a set of patches for IIS 4.0 and 5.0.\",\"sourceFile\":\"IIS_frontpage_DOS_2.nasl\",\"srcPort\":null,\"stigSeverity\":null,\"synopsis\":\"The remote web server is vulnerable to a denial of service\",\"temporalScore\":\"5.8\",\"type\":\"active\",\"version\":\"1.28\",\"vprContext\":\"[{\\\"id\\\":\\\"age_of_vuln\\\",\\\"name\\\":\\\"Vulnerability Age\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"730 days +\\\"},{\\\"id\\\":\\\"cvssV3_impactScore\\\",\\\"name\\\":\\\"CVSS v3 Impact Score\\\",\\\"type\\\":\\\"number\\\",\\\"value\\\":3.6000000000000001},{\\\"id\\\":\\\"exploit_code_maturity\\\",\\\"name\\\":\\\"Exploit Code Maturity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Unproven\\\"},{\\\"id\\\":\\\"product_coverage\\\",\\\"name\\\":\\\"Product Coverage\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Low\\\"},{\\\"id\\\":\\\"threat_intensity_last_28\\\",\\\"name\\\":\\\"Threat Intensity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very Low\\\"},{\\\"id\\\":\\\"threat_recency\\\",\\\"name\\\":\\\"Threat Recency\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"\\u003e 365 days\\\"},{\\\"id\\\":\\\"threat_sources_last_28\\\",\\\"name\\\":\\\"Threat Sources\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"}]\",\"vprScore\":\"4.4\",\"vulnPubDate\":\"977486400\",\"xrefs\":\"CVE:CVE-2001-0096, BID:2144, MSFT:MS00-100, MSKB:280322\"}", "type": [ @@ -403,9 +403,9 @@ An example event for `plugin` looks as following: | data_stream.namespace | Data stream namespace. | constant_keyword | | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -492,11 +492,11 @@ An example event for `vulnerability` looks as following: { "@timestamp": "2021-09-25T16:08:45.000Z", "agent": { - "ephemeral_id": "88645c33-21f7-47a1-a1e6-b4a53f32ec43", - "id": "94011a8e-8b26-4bce-a627-d54316798b52", + "ephemeral_id": "4ec981c8-77b2-45cc-b184-d912c9662747", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.9.0" }, "data_stream": { "dataset": "tenable_sc.vulnerability", @@ -504,21 +504,21 @@ An example event for `vulnerability` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "94011a8e-8b26-4bce-a627-d54316798b52", - "snapshot": true, - "version": "8.6.0" + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", + "snapshot": false, + "version": "8.9.0" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-01-13T12:39:40.914Z", + "created": "2023-08-08T15:38:56.843Z", "dataset": "tenable_sc.vulnerability", - "ingested": "2023-01-13T12:39:41Z", + "ingested": "2023-08-08T15:38:59Z", "kind": "event", "original": "{\"acceptRisk\":\"0\",\"baseScore\":\"0.0\",\"bid\":\"\",\"checkType\":\"remote\",\"cpe\":\"\",\"cve\":\"CVE-1999-0524\",\"cvssV3BaseScore\":\"0.0\",\"cvssV3TemporalScore\":\"\",\"cvssV3Vector\":\"AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N\",\"cvssVector\":\"AV:L/AC:L/Au:N/C:N/I:N/A:N\",\"description\":\"The remote host answers to an ICMP timestamp request. This allows an attacker to know the date that is set on the targeted machine, which may assist an unauthenticated, remote attacker in defeating time-based authentication protocols.\\n\\nTimestamps returned from machines running Windows Vista / 7 / 2008 / 2008 R2 are deliberately incorrect, but usually within 1000 seconds of the actual system time.\",\"dnsName\":\"_gateway.lxd\",\"exploitAvailable\":\"No\",\"exploitEase\":\"\",\"exploitFrameworks\":\"\",\"family\":{\"id\":\"30\",\"name\":\"General\",\"type\":\"active\"},\"firstSeen\":\"1551284872\",\"hasBeenMitigated\":\"0\",\"hostUniqueness\":\"repositoryID,ip,dnsName\",\"ip\":\"10.238.64.1\",\"ips\":\"10.238.64.1\",\"lastSeen\":\"1632586125\",\"macAddress\":\"00:16:3e:a1:12:f7\",\"netbiosName\":\"\",\"operatingSystem\":\"Linux Kernel 2.6\",\"patchPubDate\":\"-1\",\"pluginID\":\"10114\",\"pluginInfo\":\"10114 (0/1) ICMP Timestamp Request Remote Date Disclosure\",\"pluginModDate\":\"1570190400\",\"pluginName\":\"ICMP Timestamp Request Remote Date Disclosure\",\"pluginPubDate\":\"933508800\",\"pluginText\":\"\\u003cplugin_output\\u003eThe remote clock is synchronized with the local clock.\\n\\u003c/plugin_output\\u003e\",\"port\":\"0\",\"protocol\":\"ICMP\",\"recastRisk\":\"0\",\"repository\":{\"dataFormat\":\"IPv4\",\"description\":\"\",\"id\":\"1\",\"name\":\"Live\",\"sciID\":\"1\"},\"riskFactor\":\"None\",\"seeAlso\":\"\",\"severity\":{\"description\":\"Informative\",\"id\":\"0\",\"name\":\"Info\"},\"solution\":\"Filter out the ICMP timestamp requests (13), and the outgoing ICMP timestamp replies (14).\",\"stigSeverity\":\"\",\"synopsis\":\"It is possible to determine the exact time set on the remote host.\",\"temporalScore\":\"\",\"uniqueness\":\"repositoryID,ip,dnsName\",\"uuid\":\"\",\"version\":\"1.48\",\"vprContext\":\"[{\\\"id\\\":\\\"age_of_vuln\\\",\\\"name\\\":\\\"Vulnerability Age\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"730 days +\\\"},{\\\"id\\\":\\\"cvssV3_impactScore\\\",\\\"name\\\":\\\"CVSS v3 Impact Score\\\",\\\"type\\\":\\\"number\\\",\\\"value\\\":0},{\\\"id\\\":\\\"exploit_code_maturity\\\",\\\"name\\\":\\\"Exploit Code Maturity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Unproven\\\"},{\\\"id\\\":\\\"product_coverage\\\",\\\"name\\\":\\\"Product Coverage\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very High\\\"},{\\\"id\\\":\\\"threat_intensity_last_28\\\",\\\"name\\\":\\\"Threat Intensity\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"Very Low\\\"},{\\\"id\\\":\\\"threat_recency\\\",\\\"name\\\":\\\"Threat Recency\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"},{\\\"id\\\":\\\"threat_sources_last_28\\\",\\\"name\\\":\\\"Threat Sources\\\",\\\"type\\\":\\\"string\\\",\\\"value\\\":\\\"No recorded events\\\"}]\",\"vprScore\":\"0.8\",\"vulnPubDate\":\"788961600\",\"xref\":\"CWE #200\"}", "type": [ @@ -562,6 +562,7 @@ An example event for `vulnerability` looks as following: "tenable_sc": { "vulnerability": { "accept_risk": "0", + "age": 940, "base_score": "0.0", "check_type": "remote", "custom_hash": "qVUXK2YtClsBlXncLYHLhVzynYK4hG2NbT0hY6guQm0=", @@ -728,9 +729,9 @@ An example event for `vulnerability` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -757,6 +758,7 @@ An example event for `vulnerability` looks as following: | related.ip | All of the IPs seen on your event. | ip | | tags | List of keywords used to tag each event. | keyword | | tenable_sc.vulnerability.accept_risk | N/A. | keyword | +| tenable_sc.vulnerability.age | The time in days between the first and last time the vulnerability was seen. | long | | tenable_sc.vulnerability.base_score | Intrinsic and fundamental characteristics of a vulnerability that are constant over time and user environments. | keyword | | tenable_sc.vulnerability.bid | The Bugtraq ID. | keyword | | tenable_sc.vulnerability.check_type | The type of the compliance check that detected the vulnerability. | keyword | diff --git a/packages/tenable_sc/kibana/tags.yml b/packages/tenable_sc/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/tenable_sc/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/tenable_sc/manifest.yml b/packages/tenable_sc/manifest.yml index 6901b2e4de8..6e7a1d713cd 100644 --- a/packages/tenable_sc/manifest.yml +++ b/packages/tenable_sc/manifest.yml @@ -1,15 +1,13 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: tenable_sc title: Tenable.sc # The version must be updated in the pipeline as well. Until elastic/kibana#121310 is implemented we will have to manually sync these. -version: "1.11.0" -license: basic +version: "1.15.0" description: | Collect logs from Tenable.sc with Elastic Agent. type: integration categories: - security -release: ga conditions: kibana.version: ^8.7.1 screenshots: diff --git a/packages/thycotic_ss/_dev/build/build.yml b/packages/thycotic_ss/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/thycotic_ss/_dev/build/build.yml +++ b/packages/thycotic_ss/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/thycotic_ss/changelog.yml b/packages/thycotic_ss/changelog.yml index 50a0a194e6c..494c85abbed 100644 --- a/packages/thycotic_ss/changelog.yml +++ b/packages/thycotic_ss/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.0.0" changes: - description: Release Thyotic Secret Server as GA. diff --git a/packages/thycotic_ss/data_stream/logs/_dev/test/pipeline/test-thycotic-ss.json-expected.json b/packages/thycotic_ss/data_stream/logs/_dev/test/pipeline/test-thycotic-ss.json-expected.json index 740e0cc9371..40b4dac7240 100644 --- a/packages/thycotic_ss/data_stream/logs/_dev/test/pipeline/test-thycotic-ss.json-expected.json +++ b/packages/thycotic_ss/data_stream/logs/_dev/test/pipeline/test-thycotic-ss.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "view", diff --git a/packages/thycotic_ss/data_stream/logs/elasticsearch/ingest_pipeline/default.yml b/packages/thycotic_ss/data_stream/logs/elasticsearch/ingest_pipeline/default.yml index 0afbf9b71cc..92ddc8da116 100644 --- a/packages/thycotic_ss/data_stream/logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/thycotic_ss/data_stream/logs/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline to process Thycotic Secret Server logs processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ######################### ## ECS event fields ## diff --git a/packages/thycotic_ss/data_stream/logs/sample_event.json b/packages/thycotic_ss/data_stream/logs/sample_event.json index 147a8d1855f..df4fea27cf9 100644 --- a/packages/thycotic_ss/data_stream/logs/sample_event.json +++ b/packages/thycotic_ss/data_stream/logs/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "21fd6389-bda5-46dd-9abe-cc77aef72e44", diff --git a/packages/thycotic_ss/docs/README.md b/packages/thycotic_ss/docs/README.md index a71818d8c7d..6f230b8cc47 100644 --- a/packages/thycotic_ss/docs/README.md +++ b/packages/thycotic_ss/docs/README.md @@ -101,7 +101,7 @@ An example event for `logs` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "21fd6389-bda5-46dd-9abe-cc77aef72e44", @@ -195,7 +195,7 @@ The following fields may be used by the package: | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | diff --git a/packages/thycotic_ss/kibana/tags.yml b/packages/thycotic_ss/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/thycotic_ss/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/thycotic_ss/manifest.yml b/packages/thycotic_ss/manifest.yml index e02d257788a..0b03c18a505 100644 --- a/packages/thycotic_ss/manifest.yml +++ b/packages/thycotic_ss/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: thycotic_ss title: "Thycotic Secret Server" -version: "1.0.0" +version: "1.3.0" source: license: "Elastic-2.0" description: "Thycotic Secret Server logs" @@ -9,8 +9,10 @@ type: integration categories: - security conditions: - kibana.version: "^8.5.0" - elastic.subscription: "basic" + kibana: + version: "^8.5.0" + elastic: + subscription: "basic" screenshots: - src: /img/sample-screenshot.png title: Sample screenshot @@ -37,3 +39,4 @@ policy_templates: description: Collecting syslog from Secret Server via file. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_abusech/_dev/build/build.yml b/packages/ti_abusech/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_abusech/_dev/build/build.yml +++ b/packages/ti_abusech/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_abusech/changelog.yml b/packages/ti_abusech/changelog.yml index aadc033b140..1713216f2c5 100644 --- a/packages/ti_abusech/changelog.yml +++ b/packages/ti_abusech/changelog.yml @@ -1,4 +1,49 @@ # newer versions go on top +- version: 1.20.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.19.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.18.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7315 +- version: "1.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.16.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.15.2" + changes: + - description: Change ThreatFox initial interval to integer and note valid values 1-7 + type: bugfix + link: https://github.com/elastic/integrations/pull/7143 +- version: "1.15.1" + changes: + - description: Remove fields with empty string values + type: bugfix + link: https://github.com/elastic/integrations/pull/7103 +- version: "1.15.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 +- version: "1.14.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log b/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log index 0d67f2a7086..c1702d7310f 100644 --- a/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log +++ b/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log @@ -23,3 +23,4 @@ {"md5_hash":"78c9d88d24ed1d982a83216eed1590f6","sha256_hash":"d11edc90f0e879a175abc6e2ce5c94a263aa2a01cd3b6e8b9fdf93a51235ae99","file_type":"dll","file_size":"277504","signature":null,"firstseen":"2021-01-14 06:04:38","urlhaus_download":"https://urlhaus-api.abuse.ch/v1/download/d11edc90f0e879a175abc6e2ce5c94a263aa2a01cd3b6e8b9fdf93a51235ae99/","virustotal":null,"imphash":"68aea345b134d576ccdef7f06db86088","ssdeep":"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG8:X5DpBw/KViMTB1MnEWk0115Jr","tlsh":"6044D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717"} {"md5_hash":"236577d5d83e2a8d08623a7a7f724188","sha256_hash":"8cd28fed7ebdcd79ea2509dca84f0a727ca28d4eaaed5a92cd10b1279ff16afa","file_type":"dll","file_size":"241664","signature":null,"firstseen":"2021-01-14 06:04:26","urlhaus_download":"https://urlhaus-api.abuse.ch/v1/download/8cd28fed7ebdcd79ea2509dca84f0a727ca28d4eaaed5a92cd10b1279ff16afa/","virustotal":null,"imphash":"ed2860c18f5483e3b5388bad75169dc1","ssdeep":"6144:X1G3WVIOY6Bdjehj+qudd96ou/6mv5wdC:X1GmSafShjYdd96z/6cwdC","tlsh":"8D34BE41B28B8B4BD163163C2976D1F8953CFC909761CE693B64B22F0F739D0892E7A5"} {"md5_hash":"ff60107d82dcda7e6726d214528758e7","sha256_hash":"fb25d13188a5d0913bbcf5aeff6c7e3208ad92a7d10ab6bed2735f4d43310a27","file_type":"dll","file_size":"277504","signature":null,"firstseen":"2021-01-14 06:04:20","urlhaus_download":"https://urlhaus-api.abuse.ch/v1/download/fb25d13188a5d0913bbcf5aeff6c7e3208ad92a7d10ab6bed2735f4d43310a27/","virustotal":null,"imphash":"68aea345b134d576ccdef7f06db86088","ssdeep":"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGz:X5DpBw/KViMTB1MnEWk0115JU","tlsh":"9244D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717"} +{"file_size":90117,"file_type":"exe","firstseen":"2023-07-21 08:00:05","imphash":"","md5_hash":"f501a0aafcdd6f67f8956385237b8709","sha256_hash":"a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401","signature":null,"ssdeep":"1536:rTQEs1uI5PRfnDtUZ6FWEP2qZ2tAd3tFNgi4enBw:rMj1XbtLtUtAUb","tlsh":"T1B2939D3172D0C072C46366305574D7A26FBEB83213B9A5CB5B682A396FB07D067783","urlhaus_download":"https://urlhaus-api.abuse.ch/v1/download/a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401/","virustotal":null} diff --git a/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log-expected.json b/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log-expected.json index bf685e8ac4d..8e6f4798f8e 100644 --- a/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log-expected.json +++ b/packages/ti_abusech/data_stream/malware/_dev/test/pipeline/test-malware-ndjson.log-expected.json @@ -1,17 +1,18 @@ { "expected": [ { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"7871286a8f1f68a14b18ae475683f724\",\"sha256_hash\":\"48a6aee18bcfe9058b35b1018832aef1c9efd8f50ac822f49abb484a5e2a4b1f\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:14:05\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/48a6aee18bcfe9058b35b1018832aef1c9efd8f50ac822f49abb484a5e2a4b1f/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG5:X5DpBw/KViMTB1MnEWk0115JW\",\"tlsh\":\"1344D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -46,17 +47,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"7b4c77dc293347b467fb860e34515163\",\"sha256_hash\":\"ec59538e8de8525b1674b3b8fe0c180ac822145350bcce054ad3fc6b95b1b5a4\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:11:41\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/ec59538e8de8525b1674b3b8fe0c180ac822145350bcce054ad3fc6b95b1b5a4/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGY:X5DpBw/KViMTB1MnEWk0115Jr\",\"tlsh\":\"4E44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -101,13 +103,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"373d34874d7bc89fd4cefa6272ee80bf\",\"sha256_hash\":\"b0e914d1bbe19433cc9df64ea1ca07fe77f7b150b511b786e46e007941a62bd7\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:11:22\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/b0e914d1bbe19433cc9df64ea1ca07fe77f7b150b511b786e46e007941a62bd7/\",\"virustotal\":{\"result\":\"25 / 66\",\"percent\":\"37.88\",\"link\":\"https://www.virustotal.com/gui/file/b0e914d1bbe19433cc9df64ea1ca07fe77f7b150b511b786e46e007941a62bd7/detection/f-b0e914d\"},\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGG:X5DpBw/KViMTB1MnEWk0115Jd\",\"tlsh\":\"7544D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -142,17 +148,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"e2e02aae857488dbdbe6631c29abf3f8\",\"sha256_hash\":\"7483e834a73fb6817769596fe4c0fa01d28639f52bbbdc2b8a56c36d466dd7f8\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":null,\"firstseen\":\"2021-01-14 06:11:21\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/7483e834a73fb6817769596fe4c0fa01d28639f52bbbdc2b8a56c36d466dd7f8/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJ9:0h3eZgRQCcw+MN54dEq7kqRtoLZH\",\"tlsh\":\"5554CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -187,17 +194,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"3e988e32b0c3c230d534e286665b89a5\",\"sha256_hash\":\"760e729426fb115b967a41e5a6f2f42d7a52a5cee74ed99065a6dc39bf89f59b\",\"file_type\":\"unknown\",\"file_size\":\"352\",\"signature\":null,\"firstseen\":\"2021-01-14 06:08:02\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/760e729426fb115b967a41e5a6f2f42d7a52a5cee74ed99065a6dc39bf89f59b/\",\"virustotal\":null,\"imphash\":null,\"ssdeep\":\"6:TE6ll8uXi0jIAv6BHvPuA7RKTmOQamsQMGvMQgTYbtsWsQ72hCqPZG/:TTll8uTo5uA7RKtQamsS0QJfsQ7mCR\",\"tlsh\":\"3CE0C002AB26C036500D154C221655B3B871911503CA14E6A6824BEA765D4A3290D190\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -219,7 +227,6 @@ "ssdeep": "6:TE6ll8uXi0jIAv6BHvPuA7RKTmOQamsQMGvMQgTYbtsWsQ72hCqPZG/:TTll8uTo5uA7RKtQamsS0QJfsQ7mCR", "tlsh": "3CE0C002AB26C036500D154C221655B3B871911503CA14E6A6824BEA765D4A3290D190" }, - "pe": {}, "size": 352, "type": "unknown" }, @@ -239,13 +246,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"dcc20d534cdf29eab03d8148bf728857\",\"sha256_hash\":\"86655c0bcf9b21b5efc682f58eb80f42811042ba152358e1bfbbb867315a60ac\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:08:02\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/86655c0bcf9b21b5efc682f58eb80f42811042ba152358e1bfbbb867315a60ac/\",\"virustotal\":{\"result\":\"27 / 69\",\"percent\":\"39.13\",\"link\":\"https://www.virustotal.com/gui/file/86655c0bcf9b21b5efc682f58eb80f42811042ba152358e1bfbbb867315a60ac/detection/f-86655c0\"},\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGI:X5DpBw/KViMTB1MnEWk0115JH\",\"tlsh\":\"0D44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -280,17 +291,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"f6facbf7a90b9e67a6de9f6634eb40ba\",\"sha256_hash\":\"e91c9e11d3ce4f55fabd7196279367482d2fabfa32df81e614b15fc53b4e26be\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:53\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/e91c9e11d3ce4f55fabd7196279367482d2fabfa32df81e614b15fc53b4e26be/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJ1:0h3eZgRQCcw+MN54dEq7kqRtoLZL\",\"tlsh\":\"2554CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -325,17 +337,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"44325fd5bdda2e2cdea07c3a39953bb1\",\"sha256_hash\":\"beedbbcacfc34b5edd8c68e3e4acf364992ebbcd989548e09e38fa03c5659bac\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:41\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/beedbbcacfc34b5edd8c68e3e4acf364992ebbcd989548e09e38fa03c5659bac/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG/:X5DpBw/KViMTB1MnEWk0115Jg\",\"tlsh\":\"A044D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -376,13 +389,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"4c549051950522a3f1b0814aa9b1f6d1\",\"sha256_hash\":\"7cba55da723c0e020267a02e6ffc83e03a83701757fc4ec65ea398618ad881cf\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":\"Heodo\",\"firstseen\":\"2021-01-14 06:07:31\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/7cba55da723c0e020267a02e6ffc83e03a83701757fc4ec65ea398618ad881cf/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG4:X5DpBw/KViMTB1MnEWk0115Jv\",\"tlsh\":\"4544D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -417,17 +434,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"d7333113098d88b6a5dd5b8eb24f9b87\",\"sha256_hash\":\"426be5e085e6bbad8430223dc89d8d3ced497133f8d478fd00005bcbb73399d4\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:07\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/426be5e085e6bbad8430223dc89d8d3ced497133f8d478fd00005bcbb73399d4/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJw:0h3eZgRQCcw+MN54dEq7kqRtoLZW\",\"tlsh\":\"9454CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -462,17 +480,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"c8dbb261c1f450534c3693da2f4b479f\",\"sha256_hash\":\"25093afdaeb3ea000743ab843360a6b64f58c0a1ab950072ba6528056735deb9\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:07\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/25093afdaeb3ea000743ab843360a6b64f58c0a1ab950072ba6528056735deb9/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGe:X5DpBw/KViMTB1MnEWk0115JR\",\"tlsh\":\"F344D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -507,17 +526,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"714953f1d0031a4bb2f0c44afd015931\",\"sha256_hash\":\"b3327a96280365e441057f490df6261c9a2400fd63719eb9a7a0c9db95beecc5\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:06\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/b3327a96280365e441057f490df6261c9a2400fd63719eb9a7a0c9db95beecc5/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGc:X5DpBw/KViMTB1MnEWk0115J7\",\"tlsh\":\"F644D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -552,17 +572,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"20fd22742500d4cec123398afc3d3672\",\"sha256_hash\":\"e92b54904391c171238863b584355197ba4508f73320a8e89afbb5425fc2dc4b\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:07:00\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/e92b54904391c171238863b584355197ba4508f73320a8e89afbb5425fc2dc4b/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGc:X5DpBw/KViMTB1MnEWk0115JP\",\"tlsh\":\"BE44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -597,17 +618,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"aa81ceea053797a6f8c38a0f2f9b80b0\",\"sha256_hash\":\"dd15e74b3cd3a4fdb5f47adefd6f90e27d5a20e01316cc791711f6dce7c0f52e\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:06:36\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/dd15e74b3cd3a4fdb5f47adefd6f90e27d5a20e01316cc791711f6dce7c0f52e/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGf:X5DpBw/KViMTB1MnEWk0115Jo\",\"tlsh\":\"CC44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -648,13 +670,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"a2ce6795664c0fa93b07fa54ba868991\",\"sha256_hash\":\"0fae1eeabc4f5e07bd16f7851aec5ab6032d407c7ff0270f2b6e85c2a3efebd1\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":\"Heodo\",\"firstseen\":\"2021-01-14 06:06:13\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/0fae1eeabc4f5e07bd16f7851aec5ab6032d407c7ff0270f2b6e85c2a3efebd1/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGD:X5DpBw/KViMTB1MnEWk0115JY\",\"tlsh\":\"8C44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -689,17 +715,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"9b9bac158dacb9c2f5511e9c464a7de4\",\"sha256_hash\":\"07a9d84c0b2c8cf1fd90ab409b9399d06920ab4b6efb647b5a3b9bef1045ee7e\",\"file_type\":\"dll\",\"file_size\":\"280064\",\"signature\":null,\"firstseen\":\"2021-01-14 06:05:52\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/07a9d84c0b2c8cf1fd90ab409b9399d06920ab4b6efb647b5a3b9bef1045ee7e/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:WlLMUG2gFWLDFO9vNa11y3NPcJufFFTXNZrjJTKk:W5MT4WNaHy9P1FjbrjlKk\",\"tlsh\":\"6B54CF217A53C826F5E800FCA6E9878914167F346F44A4C773D40F6AA8759E2EF2B317\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -734,17 +761,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"e48e3fa5e0f7b21c1ecf1efc81ff91e8\",\"sha256_hash\":\"708c0193aec6354af6877f314d4b0e3864552bac77258bee9ee5bf886a116df5\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:05:51\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/708c0193aec6354af6877f314d4b0e3864552bac77258bee9ee5bf886a116df5/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGo:X5DpBw/KViMTB1MnEWk0115Jj\",\"tlsh\":\"6644D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -785,13 +813,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"8957f5347633ab4b10c2ae4fb92c8572\",\"sha256_hash\":\"f70a3c016fe791eb30959961f0bcaa08ba7b738491b9ae61cb4a667cd1de8b37\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":\"Heodo\",\"firstseen\":\"2021-01-14 06:05:50\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/f70a3c016fe791eb30959961f0bcaa08ba7b738491b9ae61cb4a667cd1de8b37/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJy:0h3eZgRQCcw+MN54dEq7kqRtoLZM\",\"tlsh\":\"0754CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -826,17 +858,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"09cc76b7077b4d5704e46e864575ff03\",\"sha256_hash\":\"94ca186561b13fa9b1bf15f7e66118debc686b40d2a62a5cf4b3c6ca6ee1c7a1\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:05:36\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/94ca186561b13fa9b1bf15f7e66118debc686b40d2a62a5cf4b3c6ca6ee1c7a1/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG/:X5DpBw/KViMTB1MnEWk0115Js\",\"tlsh\":\"BB44D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -871,17 +904,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"98a1cdf7de4232363f1d1e0f33dbfd99\",\"sha256_hash\":\"909f890dbc5748845cf06d0fb0b73a5c0cb17761f37e9cd4810eea0d0eb8627f\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":null,\"firstseen\":\"2021-01-14 06:05:16\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/909f890dbc5748845cf06d0fb0b73a5c0cb17761f37e9cd4810eea0d0eb8627f/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJQ:0h3eZgRQCcw+MN54dEq7kqRtoLZ+\",\"tlsh\":\"C554CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -922,13 +956,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"8a51830c1662513ba6bd44e2f7849547\",\"sha256_hash\":\"d1fa76346bef5bc8adaa615e109894a7c30f0bef07ab6272409c4056ea8d52aa\",\"file_type\":\"dll\",\"file_size\":\"284672\",\"signature\":\"Heodo\",\"firstseen\":\"2021-01-14 06:05:15\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/d1fa76346bef5bc8adaa615e109894a7c30f0bef07ab6272409c4056ea8d52aa/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:0hlBeZgR9LqvgFcwNAwhGV52n5Dv4JdEqvQykqRqYdBx8pRA7OZJh:0h3eZgRQCcw+MN54dEq7kqRtoLZ/\",\"tlsh\":\"1654CF22E642C926F1E900FCB2A98B4451257E355F40F4D777C40FABA835AE2AF27717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -963,17 +1001,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"ae21d742a8118d6b86674aa5370bd6a7\",\"sha256_hash\":\"3b9698b6c18bcba15ee33378440dd3f42509730e6b1d2d5832c71a74b1920e51\",\"file_type\":\"dll\",\"file_size\":\"280064\",\"signature\":null,\"firstseen\":\"2021-01-14 06:05:12\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/3b9698b6c18bcba15ee33378440dd3f42509730e6b1d2d5832c71a74b1920e51/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:WlLMUG2gFWLDFO9vNa11y3NPcJufFFTXNZrjJTKS:W5MT4WNaHy9P1FjbrjlKS\",\"tlsh\":\"5454CF217A53C826F5E800FCA6E9878925167F346F44A4C373D40F6AA8759E2DF2B317\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -1008,17 +1047,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"78c9d88d24ed1d982a83216eed1590f6\",\"sha256_hash\":\"d11edc90f0e879a175abc6e2ce5c94a263aa2a01cd3b6e8b9fdf93a51235ae99\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:04:38\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/d11edc90f0e879a175abc6e2ce5c94a263aa2a01cd3b6e8b9fdf93a51235ae99/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JG8:X5DpBw/KViMTB1MnEWk0115Jr\",\"tlsh\":\"6044D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -1053,17 +1093,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"236577d5d83e2a8d08623a7a7f724188\",\"sha256_hash\":\"8cd28fed7ebdcd79ea2509dca84f0a727ca28d4eaaed5a92cd10b1279ff16afa\",\"file_type\":\"dll\",\"file_size\":\"241664\",\"signature\":null,\"firstseen\":\"2021-01-14 06:04:26\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/8cd28fed7ebdcd79ea2509dca84f0a727ca28d4eaaed5a92cd10b1279ff16afa/\",\"virustotal\":null,\"imphash\":\"ed2860c18f5483e3b5388bad75169dc1\",\"ssdeep\":\"6144:X1G3WVIOY6Bdjehj+qudd96ou/6mv5wdC:X1GmSafShjYdd96z/6cwdC\",\"tlsh\":\"8D34BE41B28B8B4BD163163C2976D1F8953CFC909761CE693B64B22F0F739D0892E7A5\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -1098,17 +1139,18 @@ } }, { - "abusech": { - "malware": {} - }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"md5_hash\":\"ff60107d82dcda7e6726d214528758e7\",\"sha256_hash\":\"fb25d13188a5d0913bbcf5aeff6c7e3208ad92a7d10ab6bed2735f4d43310a27\",\"file_type\":\"dll\",\"file_size\":\"277504\",\"signature\":null,\"firstseen\":\"2021-01-14 06:04:20\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/fb25d13188a5d0913bbcf5aeff6c7e3208ad92a7d10ab6bed2735f4d43310a27/\",\"virustotal\":null,\"imphash\":\"68aea345b134d576ccdef7f06db86088\",\"ssdeep\":\"6144:+60EDP6uCLfGw/GpxXinM1BCo1PlumGx2mx2tXd0t115JGz:X5DpBw/KViMTB1MnEWk0115JU\",\"tlsh\":\"9244D022AD13DD37E1F400FCA6A58F8561626E381F00A89777D41F8A98356F1BB2B717\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -1141,6 +1183,48 @@ "type": "file" } } + }, + { + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "threat" + ], + "kind": "enrichment", + "original": "{\"file_size\":90117,\"file_type\":\"exe\",\"firstseen\":\"2023-07-21 08:00:05\",\"imphash\":\"\",\"md5_hash\":\"f501a0aafcdd6f67f8956385237b8709\",\"sha256_hash\":\"a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401\",\"signature\":null,\"ssdeep\":\"1536:rTQEs1uI5PRfnDtUZ6FWEP2qZ2tAd3tFNgi4enBw:rMj1XbtLtUtAUb\",\"tlsh\":\"T1B2939D3172D0C072C46366305574D7A26FBEB83213B9A5CB5B682A396FB07D067783\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401/\",\"virustotal\":null}", + "type": [ + "indicator" + ] + }, + "related": { + "hash": [ + "f501a0aafcdd6f67f8956385237b8709", + "a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401", + "1536:rTQEs1uI5PRfnDtUZ6FWEP2qZ2tAd3tFNgi4enBw:rMj1XbtLtUtAUb", + "T1B2939D3172D0C072C46366305574D7A26FBEB83213B9A5CB5B682A396FB07D067783" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "file": { + "hash": { + "md5": "f501a0aafcdd6f67f8956385237b8709", + "sha256": "a385cb241d6c1b03ffe25dbd62beb4d8fe4d38d17b568428079291c256245401", + "ssdeep": "1536:rTQEs1uI5PRfnDtUZ6FWEP2qZ2tAd3tFNgi4enBw:rMj1XbtLtUtAUb", + "tlsh": "T1B2939D3172D0C072C46366305574D7A26FBEB83213B9A5CB5B682A396FB07D067783" + }, + "size": 90117, + "type": "exe" + }, + "first_seen": "2023-07-21T08:00:05.000Z", + "type": "file" + } + } } ] } \ No newline at end of file diff --git a/packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml b/packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml index 897ad39a120..ce08f4cc021 100644 --- a/packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_abusech/data_stream/malware/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -150,6 +150,23 @@ processors: - abusech.malware.firstseen - message ignore_missing: true + - script: + description: Remove null/empty values recursively. + lang: painless + source: |- + boolean drop(Object o) { + if (o == null || o == '') { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); on_failure: - set: field: event.kind diff --git a/packages/ti_abusech/data_stream/malware/manifest.yml b/packages/ti_abusech/data_stream/malware/manifest.yml index e78edee86dd..2243a94028c 100644 --- a/packages/ti_abusech/data_stream/malware/manifest.yml +++ b/packages/ti_abusech/data_stream/malware/manifest.yml @@ -13,6 +13,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -27,6 +28,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_abusech/data_stream/malware/sample_event.json b/packages/ti_abusech/data_stream/malware/sample_event.json index f5e304c4fbf..2c53f202ab8 100644 --- a/packages/ti_abusech/data_stream/malware/sample_event.json +++ b/packages/ti_abusech/data_stream/malware/sample_event.json @@ -1,14 +1,11 @@ { - "@timestamp": "2022-08-06T00:06:27.079Z", - "abusech": { - "malware": {} - }, + "@timestamp": "2023-08-08T18:14:46.428Z", "agent": { - "ephemeral_id": "1760e1ca-6974-4a32-80c6-0e7e58a6d573", - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "ephemeral_id": "307223ed-6fad-46c5-8694-1911ce83f68b", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.0" + "version": "8.9.0" }, "data_stream": { "dataset": "ti_abusech.malware", @@ -16,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-06T00:06:27.079Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:14:46.428Z", "dataset": "ti_abusech.malware", - "ingested": "2022-08-06T00:06:30Z", + "ingested": "2023-08-08T18:14:49Z", "kind": "enrichment", "original": "{\"file_size\":\"1563\",\"file_type\":\"unknown\",\"firstseen\":\"2021-10-05 04:17:02\",\"imphash\":null,\"md5_hash\":\"9cd5a4f0231a47823c4adba7c8ef370f\",\"sha256_hash\":\"7c0852d514df7faf8fdbfa4f358cc235dd1b1a2d843cc65495d03b502e4099f2\",\"signature\":null,\"ssdeep\":\"48:yazkS7neW+mfe4CJjNXcq5Co4Fr1PpsHn:yrmGNt5mbP2n\",\"tlsh\":\"T109314C5E7822CA70B91AD69300C22D8C2F53EAF229E6686C3BDD4C86FA1344208CF1\",\"urlhaus_download\":\"https://urlhaus-api.abuse.ch/v1/download/7c0852d514df7faf8fdbfa4f358cc235dd1b1a2d843cc65495d03b502e4099f2/\",\"virustotal\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" @@ -58,7 +59,6 @@ "ssdeep": "48:yazkS7neW+mfe4CJjNXcq5Co4Fr1PpsHn:yrmGNt5mbP2n", "tlsh": "T109314C5E7822CA70B91AD69300C22D8C2F53EAF229E6686C3BDD4C86FA1344208CF1" }, - "pe": {}, "size": 1563, "type": "unknown" }, diff --git a/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log b/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log index f883f08ed77..ba294345af0 100644 --- a/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log +++ b/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log @@ -8,3 +8,4 @@ {"sha256_hash":"84f983067868de50e5b1553782c056c1f5b5118bb2084473ca4b6908f221cd3b","sha3_384_hash":"138dc28a74d15c1f9797ce732e99097c8c6db4549cb17cb7b20c1c6738a170328e45aea2d4c3b593912f14a97f521c1d","sha1_hash":"00b52e8ca1785d5086703ad8cff1d28fc3354934","md5_hash":"2759c73c986c6a757bf9d25621c5595a","first_seen":"2021-04-06 19:52:32","last_seen":null,"file_name":"Purchase Order.8000.scan.pdf...exe","file_size":752128,"file_type_mime":"application/x-dosexec","file_type":"exe","reporter":"James_inthe_box","origin_country":"FR","anonymous":0,"signature":"SnakeKeylogger","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","tlsh":"23F4AE212684C9C0D93E67B4D43584F003BABD16D631F69F6E887C693EB32D2D63B646","telfhash":null,"ssdeep":"12288:8t11ulRZRLZNh4YeX6f6XmwNShqE73YXy7moh:S11gZpZNmBX06WmAcy7m0","tags":["exe","SnakeKeylogger"],"code_sign":[],"intelligence":{"clamav":null,"downloads":"38","uploads":"1","mail":{"Generic":"low"}}} {"sha256_hash":"0661d87116f44cbd5b5c6bec7fb06c4e5cd5b6ecbc5455d959e65f1ee46c54c8","sha3_384_hash":"ed5d03454121d81adf65a01ba90af81b1a7cea052709c22bb9170508069d17242861f85e5546b2cc3efb07c10926368c","sha1_hash":"a34fd5e57d75d17bc2d84055ca4752e5ee2e92f5","md5_hash":"596b3dbf07a287dcf76860b5e54762c3","first_seen":"2021-04-06 19:47:13","last_seen":null,"file_name":"New Order PO#121012020_____PDF_______.exe","file_size":836096,"file_type_mime":"application/x-dosexec","file_type":"exe","reporter":"James_inthe_box","origin_country":"FR","anonymous":0,"signature":"AgentTesla","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","tlsh":"A505CF712694C9A4FABD53B80434403007F5FE42E232FA9A6FD17C993E72782DA3B655","telfhash":null,"ssdeep":"12288:qRedcNeqimzAEmN03VgdZfBOMx+RVBM7pdWje9ppB5nAZGNY2:ZaNeqikqN0udZfBFUYp55nFN","tags":["AgentTesla","exe"],"code_sign":[],"intelligence":{"clamav":null,"downloads":"40","uploads":"1","mail":{"Generic":"low"}}} {"sha256_hash":"4fccd38f504290cf5c70e7336071a90a064303c7fdf5c17f7c38001768bce115","sha3_384_hash":null,"sha1_hash":"3a83bb68be29e1f18fc9d328d952fd228abfae2a","md5_hash":"e614a69d706913376ab2bb20a703dcf5","first_seen":"2022-08-30 22:36:54","last_seen":null,"file_name":"4fccd38f504290cf5c70e7336071a90a064303c7fdf5c17f7c38001768bce115","file_size":246816,"file_type_mime":"application/x-dosexec","file_type":"exe","reporter":"OSimao","anonymous":0,"signature":"Dridex","imphash":"53654c59ffb323a249342d35a6b65745","tlsh":"T17034B0A0F196C8DAF85765B54C5FE9201012AAAED4B1D51E20EB3B39E8F33531077A4F","telfhash":null,"gimphash":null,"ssdeep":"3072:KWiPOo14wwI606CzpJEPlp+K2b1WvAUQdk5m84D2KQdXtvkDqW0TrHbed2rT2pN8:KWdEj6rapJEPr11AXdQm84Dr0OOPSR4","dhash_icon":"79e4e4ccccc4c4c0","tags":["Dridex","exe","signed"],"code_sign":[{"subject_cn":"\"VERONIKA 2\" OOO","issuer_cn":"Sectigo RSA Code Signing CA","algorithm":"sha256WithRSAEncryption","valid_from":"2019-07-15T00:00:00Z","valid_to":"2020-06-27T23:59:59Z","serial_number":"e573d9c8b403c41bd59ffa0a8efd4168","thumbprint_algorithm":"SHA256","thumbprint":"a9ab2be0ea677c6c6ed67b23cfee0fa44bfb346a4bb720f10a3f02a78b8f5c82","cscb_listed":false,"cscb_reason":""}]} +{"anonymous":1,"code_sign":[],"dhash_icon":null,"file_name":"4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb","file_size":2560,"file_type":"exe","file_type_mime":"application/x-dosexec","first_seen":"2023-07-21 17:06:27","gimphash":null,"imphash":"","intelligence":{"clamav":null,"downloads":"227","mail":null,"uploads":"1"},"last_seen":null,"md5_hash":"4f744666d2a2dc95419208c61e42f163","origin_country":"US","reporter":"anonymous","sha1_hash":"34712624aadd053f43703af860fe90e545bf1f0a","sha256_hash":"4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb","sha3_384_hash":"40753109b922a577de0f9252e89bc80b8eba54c08aba7f6a59e836714a21ffd1b3ec58ff69d902469d4fcff73eabc5ba","signature":null,"ssdeep":"24:ev1GSxthEcf5K1a1I8Q3nB8+gxtkcPnRuV4MPgic:qjBK1GQXGxLRuqS","tags":["exe"],"telfhash":null,"tlsh":"T164511E8783A88896D219037D425BC9387737B3202B9F0B5B7F5C52BF3F0124298A3D50"} diff --git a/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log-expected.json b/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log-expected.json index b3a5a1051b9..6de576f2d27 100644 --- a/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log-expected.json +++ b/packages/ti_abusech/data_stream/malwarebazaar/_dev/test/pipeline/test-malwarebazaar-ndjson.log-expected.json @@ -4,7 +4,6 @@ "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 15, "uploads": 1 @@ -15,13 +14,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"5bce7d528c1363104a93fbb5a7fa9bdd991ce929cc09cc7fb29052a68d4fd24b\",\"sha3_384_hash\":\"3b454eb6421d17d093f19292b64d30bf918cb91e9322d0e2d2512857997f574ea2ca5b005133c16f6c33c7cee9c1bd0e\",\"sha1_hash\":\"a71fd0504821092e003f350080a6bcc5fa6a972e\",\"md5_hash\":\"0af07660056a692b7cb82fa329221ddd\",\"first_seen\":\"2021-04-06 20:34:58\",\"last_seen\":null,\"file_name\":\"SALM0BRU.exe\",\"file_size\":399872,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"exe\",\"reporter\":\"James_inthe_box\",\"origin_country\":\"US\",\"anonymous\":0,\"signature\":null,\"imphash\":\"f34d5f2d4577ed6d9ceec516c1f5a744\",\"tlsh\":\"F9848B24AF932F9BC6CCC1FE50C2D165C9A9F85DD2B1251A73B6CB89FE00544ED2C686\",\"telfhash\":null,\"ssdeep\":\"3072:DsPPK3p+8r5igrL1Tq50cVBDmDJhE9yV4veedHrP6FXK7:D+PL8bronBDmDJ69JeedHriFG\",\"tags\":[\"exe\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"15\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -40,7 +43,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "exe", "hash": { "md5": "0af07660056a692b7cb82fa329221ddd", @@ -63,15 +65,13 @@ }, "provider": "James_inthe_box", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 11, "uploads": 1 @@ -79,13 +79,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"83d0429a2c5f1b611ebc30391eeeb75bebb51212ee1af51dbcf2624b48f9d27f\",\"sha3_384_hash\":\"0a1536add280715320040d5ac5340d3b205d90045ff5c90993b8e909edb9b3e9338b3ffbb3febcaf82584d00d516e8c7\",\"sha1_hash\":\"c454be4eb0892d61a4ad6bac16f97724e73cd795\",\"md5_hash\":\"296aad7075596d21516b30bfbc17fcac\",\"first_seen\":\"2021-04-06 20:32:25\",\"last_seen\":null,\"file_name\":\"PO_NO.ENQUIRY-210604.zip\",\"file_size\":476768,\"file_type_mime\":\"application/zip\",\"file_type\":\"zip\",\"reporter\":\"GovCERT_CH\",\"origin_country\":\"US\",\"anonymous\":0,\"signature\":null,\"imphash\":null,\"tlsh\":\"74A4233B9A6D5CA02B224AA69F37537D13A8406300944EAEFD375CA431583056B9F6FF\",\"telfhash\":null,\"ssdeep\":\"12288:j++y4mulTPaYJSaHwvJblQpLGwYeHU9vPpNGd+Zr:j3HPaMtQxblje01pNHZr\",\"tags\":null,\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"11\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -103,7 +107,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "zip", "hash": { "md5": "296aad7075596d21516b30bfbc17fcac", @@ -115,7 +118,6 @@ }, "mime_type": "application/zip", "name": "PO_NO.ENQUIRY-210604.zip", - "pe": {}, "size": 476768 }, "first_seen": "2021-04-06T20:32:25.000Z", @@ -124,15 +126,13 @@ }, "provider": "GovCERT_CH", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 30, "uploads": 1 @@ -143,13 +143,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"f4910ea08d14eeb634084de47cf590d4dc5e554552f111da20d22ae71d7b425b\",\"sha3_384_hash\":\"ee7586cb085fde3c14c9c1bea4635ccb30b1af2020f64e87a9983e61b05026ec9b35255670a3d9ecaab436c4ba302dcc\",\"sha1_hash\":\"bf103996196df8255881127dee103c22fc12bef3\",\"md5_hash\":\"a4838dd31c672122441bebcbf7e9d277\",\"first_seen\":\"2021-04-06 20:12:29\",\"last_seen\":null,\"file_name\":\"DropDll.dat\",\"file_size\":435926,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"dll\",\"reporter\":\"DmitriyMelikov\",\"origin_country\":\"DE\",\"anonymous\":0,\"signature\":\"Hancitor\",\"imphash\":\"0b5a952a025c2783c3126cdb9bef2844\",\"tlsh\":\"0C947D11BA96C473E572163008399F6A17BE7A900B704BDBE3CC097E4E755C24B36BA7\",\"telfhash\":null,\"ssdeep\":\"12288:L2X/txpFDEVkUNglTovKfoLy+hqK/cEUMMlGOG:RzglgLm/9lGOG\",\"tags\":[\"Hancitor\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"30\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -168,7 +172,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "dll", "hash": { "md5": "a4838dd31c672122441bebcbf7e9d277", @@ -193,7 +196,9 @@ "type": "file" }, "software": { - "alias": "Hancitor" + "alias": [ + "Hancitor" + ] } } }, @@ -201,7 +206,6 @@ "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 27, "uploads": 1 @@ -213,13 +217,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"e45ffc61a85c2f5c0cbe9376ff215cad324bf14f925bf52ec0d2949f7d235a00\",\"sha3_384_hash\":\"788f61cf45bbc8cad5775de18d0d5f42c4e028af0aaa34c570645efc96af8ebc3d7fe330aaf22ef34d35360bbd4a708c\",\"sha1_hash\":\"a68ca1b41cb93fe2879bb3baeb8e19990758f099\",\"md5_hash\":\"8d7c8b55ac49d241fb7f75a27a5ef8d5\",\"first_seen\":\"2021-04-06 20:07:59\",\"last_seen\":null,\"file_name\":\"vabsheche.py\",\"file_size\":11717,\"file_type_mime\":\"text/x-script.python\",\"file_type\":\"unknown\",\"reporter\":\"ArkbirdDevil\",\"origin_country\":\"FR\",\"anonymous\":0,\"signature\":null,\"imphash\":null,\"tlsh\":\"AE3222515C6A881A03B3C66F7992B844FB588303C7116607F6FC86782F79568CAF1BBD\",\"telfhash\":null,\"ssdeep\":\"192:z7X/yHo/yz/yBKiSOINLyhQMYd+LiTfq6LTf3ZoTta3Grj6rg2:z7CIKnNNLwufPfAPq7\",\"tags\":[\"backdoor\",\"python\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"27\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -237,7 +245,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "unknown", "hash": { "md5": "8d7c8b55ac49d241fb7f75a27a5ef8d5", @@ -249,7 +256,6 @@ }, "mime_type": "text/x-script.python", "name": "vabsheche.py", - "pe": {}, "size": 11717 }, "first_seen": "2021-04-06T20:07:59.000Z", @@ -258,15 +264,13 @@ }, "provider": "ArkbirdDevil", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 21, "uploads": 1 @@ -277,13 +281,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"42f5f5474431738f91f612d9765b3fc9b85a547274ea64aa034298ad97ad28f4\",\"sha3_384_hash\":\"752e5d56a166227d06f8cbd40cd3f693f543f9c3f798c673c1430957bb7e149a12d9158138fa449479105f472e70f68f\",\"sha1_hash\":\"e8378aede9f26f09b7d503d79a05d67612be15f6\",\"md5_hash\":\"fe185f106730583156f39233f77f8019\",\"first_seen\":\"2021-04-06 20:00:48\",\"last_seen\":null,\"file_name\":\"42f5f5474431738f91f612d9765b3fc9b85a547274ea64aa034298ad97ad28f4.bin\",\"file_size\":7929856,\"file_type_mime\":\"application/msword\",\"file_type\":\"docx\",\"reporter\":\"ArkbirdDevil\",\"origin_country\":\"FR\",\"anonymous\":0,\"signature\":null,\"imphash\":null,\"tlsh\":\"13863341B085EE2EE2CA41BA0DA9C2BD43B63D131E054F677269B72D3EB76E0E7D4144\",\"telfhash\":null,\"ssdeep\":\"196608:KQaeKLOiBEp+uc+iuYmbMdHmN1Rwyd2jecXeaH1pHE+2:oeIOTp+p+iNJC1ChjhXZ1pHz2\",\"tags\":[\"maldoc\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"21\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -301,7 +309,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "docx", "hash": { "md5": "fe185f106730583156f39233f77f8019", @@ -313,7 +320,6 @@ }, "mime_type": "application/msword", "name": "42f5f5474431738f91f612d9765b3fc9b85a547274ea64aa034298ad97ad28f4.bin", - "pe": {}, "size": 7929856 }, "first_seen": "2021-04-06T20:00:48.000Z", @@ -322,15 +328,13 @@ }, "provider": "ArkbirdDevil", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 30, "uploads": 1 @@ -342,13 +346,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"2d705f0b76f24a18e08163db2f187140ee9f03e43697a9ea0d840c829692d43c\",\"sha3_384_hash\":\"c82132559381b7b3b184b4ce8c7a58c301a46001621f346b637139f5987dee968ae2ef009a17b2388852b2db15a45b58\",\"sha1_hash\":\"b2da45913353bfc66d189455f9ad80ef26968143\",\"md5_hash\":\"70da6872b6b2da9ddc94d14b02302917\",\"first_seen\":\"2021-04-06 19:58:50\",\"last_seen\":null,\"file_name\":\"winlog.wll\",\"file_size\":131584,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"dll\",\"reporter\":\"ArkbirdDevil\",\"origin_country\":\"FR\",\"anonymous\":0,\"signature\":null,\"imphash\":\"6476b7c4dd55eafbdf922a7ba1e2d5f9\",\"tlsh\":\"A2D38C067790C071DAAF013908799E624B7F7D70DDB49D8B77841A8E69342D0AF3AB27\",\"telfhash\":null,\"ssdeep\":\"1536:2NVi7z0r0lJRn6I8+YDgr1fnWG5Ff0+adgBYlCtMiQMX1c0E4JsWjcdonPv870E1:YM7zh8+Cofnp5eRm6riQ6OZoPv870E\",\"tags\":[\"apt\",\"tonto\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"30\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -367,7 +375,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "dll", "hash": { "md5": "70da6872b6b2da9ddc94d14b02302917", @@ -390,15 +397,13 @@ }, "provider": "ArkbirdDevil", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 32, "uploads": 1 @@ -406,13 +411,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"30787f32adc487311d764b19d4504fdeab08c0d385e2fa065bd8d5836c031606\",\"sha3_384_hash\":\"a3ec981ed158fe08cc2cd97303807cfbed147e59ccfd92fcaa9395c5718b4d9b892d6e9fa6337f5976dc1bd042562fe4\",\"sha1_hash\":\"3d613d5678e43faeea1c636185a0b4c3ec80e742\",\"md5_hash\":\"de80e1d7d9f5b1c64ec9f8d4f5063989\",\"first_seen\":\"2021-04-06 19:58:44\",\"last_seen\":null,\"file_name\":\"30787f32adc487311d764b19d4504fdeab08c0d385e2fa065bd8d5836c031606.bin.sample\",\"file_size\":1088000,\"file_type_mime\":\"application/msword\",\"file_type\":\"docx\",\"reporter\":\"DmitriyMelikov\",\"origin_country\":\"DE\",\"anonymous\":0,\"signature\":null,\"imphash\":null,\"tlsh\":\"8635D001BA82C573D5621A35083ADBAA177E7D604F704ADBB3C83B2E5D355C14B32BA7\",\"telfhash\":null,\"ssdeep\":\"24576:WKEiZxl3A4yJJG2dPQQCthXzglgLm/9lGO:WKEGByvGOQQC/XElga/9lGO\",\"tags\":null,\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"32\",\"uploads\":\"1\",\"mail\":null}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -430,7 +439,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "docx", "hash": { "md5": "de80e1d7d9f5b1c64ec9f8d4f5063989", @@ -442,7 +450,6 @@ }, "mime_type": "application/msword", "name": "30787f32adc487311d764b19d4504fdeab08c0d385e2fa065bd8d5836c031606.bin.sample", - "pe": {}, "size": 1088000 }, "first_seen": "2021-04-06T19:58:44.000Z", @@ -451,15 +458,13 @@ }, "provider": "DmitriyMelikov", "type": "file" - }, - "software": {} + } } }, { "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 38, "mail": { @@ -474,13 +479,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"84f983067868de50e5b1553782c056c1f5b5118bb2084473ca4b6908f221cd3b\",\"sha3_384_hash\":\"138dc28a74d15c1f9797ce732e99097c8c6db4549cb17cb7b20c1c6738a170328e45aea2d4c3b593912f14a97f521c1d\",\"sha1_hash\":\"00b52e8ca1785d5086703ad8cff1d28fc3354934\",\"md5_hash\":\"2759c73c986c6a757bf9d25621c5595a\",\"first_seen\":\"2021-04-06 19:52:32\",\"last_seen\":null,\"file_name\":\"Purchase Order.8000.scan.pdf...exe\",\"file_size\":752128,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"exe\",\"reporter\":\"James_inthe_box\",\"origin_country\":\"FR\",\"anonymous\":0,\"signature\":\"SnakeKeylogger\",\"imphash\":\"f34d5f2d4577ed6d9ceec516c1f5a744\",\"tlsh\":\"23F4AE212684C9C0D93E67B4D43584F003BABD16D631F69F6E887C693EB32D2D63B646\",\"telfhash\":null,\"ssdeep\":\"12288:8t11ulRZRLZNh4YeX6f6XmwNShqE73YXy7moh:S11gZpZNmBX06WmAcy7m0\",\"tags\":[\"exe\",\"SnakeKeylogger\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"38\",\"uploads\":\"1\",\"mail\":{\"Generic\":\"low\"}}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -499,7 +508,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "exe", "hash": { "md5": "2759c73c986c6a757bf9d25621c5595a", @@ -524,7 +532,9 @@ "type": "file" }, "software": { - "alias": "SnakeKeylogger" + "alias": [ + "SnakeKeylogger" + ] } } }, @@ -532,7 +542,6 @@ "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 40, "mail": { @@ -547,13 +556,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"0661d87116f44cbd5b5c6bec7fb06c4e5cd5b6ecbc5455d959e65f1ee46c54c8\",\"sha3_384_hash\":\"ed5d03454121d81adf65a01ba90af81b1a7cea052709c22bb9170508069d17242861f85e5546b2cc3efb07c10926368c\",\"sha1_hash\":\"a34fd5e57d75d17bc2d84055ca4752e5ee2e92f5\",\"md5_hash\":\"596b3dbf07a287dcf76860b5e54762c3\",\"first_seen\":\"2021-04-06 19:47:13\",\"last_seen\":null,\"file_name\":\"New Order PO#121012020_____PDF_______.exe\",\"file_size\":836096,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"exe\",\"reporter\":\"James_inthe_box\",\"origin_country\":\"FR\",\"anonymous\":0,\"signature\":\"AgentTesla\",\"imphash\":\"f34d5f2d4577ed6d9ceec516c1f5a744\",\"tlsh\":\"A505CF712694C9A4FABD53B80434403007F5FE42E232FA9A6FD17C993E72782DA3B655\",\"telfhash\":null,\"ssdeep\":\"12288:qRedcNeqimzAEmN03VgdZfBOMx+RVBM7pdWje9ppB5nAZGNY2:ZaNeqikqN0udZfBFUYp55nFN\",\"tags\":[\"AgentTesla\",\"exe\"],\"code_sign\":[],\"intelligence\":{\"clamav\":null,\"downloads\":\"40\",\"uploads\":\"1\",\"mail\":{\"Generic\":\"low\"}}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -572,7 +585,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "exe", "hash": { "md5": "596b3dbf07a287dcf76860b5e54762c3", @@ -597,7 +609,9 @@ "type": "file" }, "software": { - "alias": "AgentTesla" + "alias": [ + "AgentTesla" + ] } } }, @@ -609,7 +623,6 @@ { "algorithm": "sha256WithRSAEncryption", "cscb_listed": false, - "cscb_reason": "", "issuer_cn": "Sectigo RSA Code Signing CA", "serial_number": "e573d9c8b403c41bd59ffa0a8efd4168", "subject_cn": "\"VERONIKA 2\" OOO", @@ -628,13 +641,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"sha256_hash\":\"4fccd38f504290cf5c70e7336071a90a064303c7fdf5c17f7c38001768bce115\",\"sha3_384_hash\":null,\"sha1_hash\":\"3a83bb68be29e1f18fc9d328d952fd228abfae2a\",\"md5_hash\":\"e614a69d706913376ab2bb20a703dcf5\",\"first_seen\":\"2022-08-30 22:36:54\",\"last_seen\":null,\"file_name\":\"4fccd38f504290cf5c70e7336071a90a064303c7fdf5c17f7c38001768bce115\",\"file_size\":246816,\"file_type_mime\":\"application/x-dosexec\",\"file_type\":\"exe\",\"reporter\":\"OSimao\",\"anonymous\":0,\"signature\":\"Dridex\",\"imphash\":\"53654c59ffb323a249342d35a6b65745\",\"tlsh\":\"T17034B0A0F196C8DAF85765B54C5FE9201012AAAED4B1D51E20EB3B39E8F33531077A4F\",\"telfhash\":null,\"gimphash\":null,\"ssdeep\":\"3072:KWiPOo14wwI606CzpJEPlp+K2b1WvAUQdk5m84D2KQdXtvkDqW0TrHbed2rT2pN8:KWdEj6rapJEPr11AXdQm84Dr0OOPSR4\",\"dhash_icon\":\"79e4e4ccccc4c4c0\",\"tags\":[\"Dridex\",\"exe\",\"signed\"],\"code_sign\":[{\"subject_cn\":\"\\\"VERONIKA 2\\\" OOO\",\"issuer_cn\":\"Sectigo RSA Code Signing CA\",\"algorithm\":\"sha256WithRSAEncryption\",\"valid_from\":\"2019-07-15T00:00:00Z\",\"valid_to\":\"2020-06-27T23:59:59Z\",\"serial_number\":\"e573d9c8b403c41bd59ffa0a8efd4168\",\"thumbprint_algorithm\":\"SHA256\",\"thumbprint\":\"a9ab2be0ea677c6c6ed67b23cfee0fa44bfb346a4bb720f10a3f02a78b8f5c82\",\"cscb_listed\":false,\"cscb_reason\":\"\"}]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "hash": [ @@ -653,7 +670,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "exe", "hash": { "md5": "e614a69d706913376ab2bb20a703dcf5", @@ -701,7 +717,73 @@ "type": "file" }, "software": { - "alias": "Dridex" + "alias": [ + "Dridex" + ] + } + } + }, + { + "abusech": { + "malwarebazaar": { + "anonymous": 1, + "intelligence": { + "downloads": 227, + "uploads": 1 + }, + "tags": [ + "exe" + ] + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "threat" + ], + "kind": "enrichment", + "original": "{\"anonymous\":1,\"code_sign\":[],\"dhash_icon\":null,\"file_name\":\"4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb\",\"file_size\":2560,\"file_type\":\"exe\",\"file_type_mime\":\"application/x-dosexec\",\"first_seen\":\"2023-07-21 17:06:27\",\"gimphash\":null,\"imphash\":\"\",\"intelligence\":{\"clamav\":null,\"downloads\":\"227\",\"mail\":null,\"uploads\":\"1\"},\"last_seen\":null,\"md5_hash\":\"4f744666d2a2dc95419208c61e42f163\",\"origin_country\":\"US\",\"reporter\":\"anonymous\",\"sha1_hash\":\"34712624aadd053f43703af860fe90e545bf1f0a\",\"sha256_hash\":\"4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb\",\"sha3_384_hash\":\"40753109b922a577de0f9252e89bc80b8eba54c08aba7f6a59e836714a21ffd1b3ec58ff69d902469d4fcff73eabc5ba\",\"signature\":null,\"ssdeep\":\"24:ev1GSxthEcf5K1a1I8Q3nB8+gxtkcPnRuV4MPgic:qjBK1GQXGxLRuqS\",\"tags\":[\"exe\"],\"telfhash\":null,\"tlsh\":\"T164511E8783A88896D219037D425BC9387737B3202B9F0B5B7F5C52BF3F0124298A3D50\"}", + "type": [ + "indicator" + ] + }, + "related": { + "hash": [ + "34712624aadd053f43703af860fe90e545bf1f0a", + "40753109b922a577de0f9252e89bc80b8eba54c08aba7f6a59e836714a21ffd1b3ec58ff69d902469d4fcff73eabc5ba", + "4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb", + "T164511E8783A88896D219037D425BC9387737B3202B9F0B5B7F5C52BF3F0124298A3D50", + "24:ev1GSxthEcf5K1a1I8Q3nB8+gxtkcPnRuV4MPgic:qjBK1GQXGxLRuqS", + "4f744666d2a2dc95419208c61e42f163" + ] + }, + "tags": [ + "preserve_original_event" + ], + "threat": { + "indicator": { + "file": { + "extension": "exe", + "hash": { + "md5": "4f744666d2a2dc95419208c61e42f163", + "sha1": "34712624aadd053f43703af860fe90e545bf1f0a", + "sha256": "4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb", + "sha384": "40753109b922a577de0f9252e89bc80b8eba54c08aba7f6a59e836714a21ffd1b3ec58ff69d902469d4fcff73eabc5ba", + "ssdeep": "24:ev1GSxthEcf5K1a1I8Q3nB8+gxtkcPnRuV4MPgic:qjBK1GQXGxLRuqS", + "tlsh": "T164511E8783A88896D219037D425BC9387737B3202B9F0B5B7F5C52BF3F0124298A3D50" + }, + "mime_type": "application/x-dosexec", + "name": "4da57027ffe7e32c891334d6834923bc17e4174c53ace4ff69de6410c24d84cb", + "size": 2560 + }, + "first_seen": "2023-07-21T17:06:27.000Z", + "geo": { + "country_iso_code": "US" + }, + "provider": "anonymous", + "type": "file" } } } diff --git a/packages/ti_abusech/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml b/packages/ti_abusech/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml index 0fe55837188..c5aabf15612 100644 --- a/packages/ti_abusech/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_abusech/data_stream/malwarebazaar/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -75,6 +75,10 @@ processors: field: abusech.malwarebazaar.signature target_field: threat.software.alias ignore_missing: true + - set: + field: threat.software.alias + value: ['{{{threat.software.alias}}}'] + if: ctx.threat?.software?.alias instanceof String - rename: field: abusech.malwarebazaar.file_size target_field: threat.indicator.file.size @@ -264,6 +268,23 @@ processors: - abusech.malwarebazaar.last_seen - message ignore_missing: true + - script: + description: Remove null/empty values recursively. + lang: painless + source: |- + boolean drop(Object o) { + if (o == null || o == '') { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); on_failure: - set: field: event.kind diff --git a/packages/ti_abusech/data_stream/malwarebazaar/manifest.yml b/packages/ti_abusech/data_stream/malwarebazaar/manifest.yml index 4ec941f6c5d..3e7240a2d8d 100644 --- a/packages/ti_abusech/data_stream/malwarebazaar/manifest.yml +++ b/packages/ti_abusech/data_stream/malwarebazaar/manifest.yml @@ -13,6 +13,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -27,6 +28,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_abusech/data_stream/malwarebazaar/sample_event.json b/packages/ti_abusech/data_stream/malwarebazaar/sample_event.json index 9896832a5ab..40589d4fec4 100644 --- a/packages/ti_abusech/data_stream/malwarebazaar/sample_event.json +++ b/packages/ti_abusech/data_stream/malwarebazaar/sample_event.json @@ -1,9 +1,8 @@ { - "@timestamp": "2022-08-06T00:08:33.562Z", + "@timestamp": "2023-08-08T18:15:38.506Z", "abusech": { "malwarebazaar": { "anonymous": 0, - "code_sign": [], "intelligence": { "downloads": 11, "uploads": 1 @@ -15,11 +14,11 @@ } }, "agent": { - "ephemeral_id": "7d65c47e-ccda-4f97-9896-6118ffb92a61", - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "ephemeral_id": "7c243d3c-4b26-4228-81c7-9f222533ed9f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.0" + "version": "8.9.0" }, "data_stream": { "dataset": "ti_abusech.malwarebazaar", @@ -27,33 +26,39 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-06T00:08:33.562Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:15:38.506Z", "dataset": "ti_abusech.malwarebazaar", - "ingested": "2022-08-06T00:08:36Z", + "ingested": "2023-08-08T18:15:41Z", "kind": "enrichment", "original": "{\"anonymous\":0,\"code_sign\":[],\"dhash_icon\":null,\"file_name\":\"7a6c03013a2f2ab8b9e8e7e5d226ea89e75da72c1519e.exe\",\"file_size\":432640,\"file_type\":\"exe\",\"file_type_mime\":\"application/x-dosexec\",\"first_seen\":\"2021-10-05 14:02:45\",\"imphash\":\"f34d5f2d4577ed6d9ceec516c1f5a744\",\"intelligence\":{\"clamav\":null,\"downloads\":\"11\",\"mail\":null,\"uploads\":\"1\"},\"last_seen\":null,\"md5_hash\":\"1fc1c2997c8f55ac10496b88e23f5320\",\"origin_country\":\"FR\",\"reporter\":\"abuse_ch\",\"sha1_hash\":\"42c7153680d7402e56fe022d1024aab49a9901a0\",\"sha256_hash\":\"7a6c03013a2f2ab8b9e8e7e5d226ea89e75da72c1519e78fd28b2253ea755c28\",\"sha3_384_hash\":\"d63e73b68973bc73ab559549aeee2141a48b8a3724aabc0d81fb14603c163a098a5a10be9f6d33b888602906c0d89955\",\"signature\":\"RedLineStealer\",\"ssdeep\":\"12288:jhhl1Eo+iEXvpb1C7drqAd1uUaJvzXGyO2F5V3bS1jsTacr:7lL\",\"tags\":[\"exe\",\"RedLineStealer\"],\"telfhash\":null,\"tlsh\":\"T13794242864BFC05994E3EEA12DDCA8FBD99A55E3640C743301B4633B8B52B84DE4F479\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" }, "related": { "hash": [ - "1fc1c2997c8f55ac10496b88e23f5320", + "42c7153680d7402e56fe022d1024aab49a9901a0", + "d63e73b68973bc73ab559549aeee2141a48b8a3724aabc0d81fb14603c163a098a5a10be9f6d33b888602906c0d89955", "7a6c03013a2f2ab8b9e8e7e5d226ea89e75da72c1519e78fd28b2253ea755c28", + "T13794242864BFC05994E3EEA12DDCA8FBD99A55E3640C743301B4633B8B52B84DE4F479", "12288:jhhl1Eo+iEXvpb1C7drqAd1uUaJvzXGyO2F5V3bS1jsTacr:7lL", - "f34d5f2d4577ed6d9ceec516c1f5a744", - "T13794242864BFC05994E3EEA12DDCA8FBD99A55E3640C743301B4633B8B52B84DE4F479" + "1fc1c2997c8f55ac10496b88e23f5320", + "f34d5f2d4577ed6d9ceec516c1f5a744" ] }, "tags": [ @@ -64,7 +69,6 @@ "threat": { "indicator": { "file": { - "elf": {}, "extension": "exe", "hash": { "md5": "1fc1c2997c8f55ac10496b88e23f5320", @@ -89,7 +93,9 @@ "type": "file" }, "software": { - "alias": "RedLineStealer" + "alias": [ + "RedLineStealer" + ] } } } \ No newline at end of file diff --git a/packages/ti_abusech/data_stream/threatfox/_dev/test/pipeline/test-threatfox-ndjson.log-expected.json b/packages/ti_abusech/data_stream/threatfox/_dev/test/pipeline/test-threatfox-ndjson.log-expected.json index 338d6cf942b..e55e10c27b1 100644 --- a/packages/ti_abusech/data_stream/threatfox/_dev/test/pipeline/test-threatfox-ndjson.log-expected.json +++ b/packages/ti_abusech/data_stream/threatfox/_dev/test/pipeline/test-threatfox-ndjson.log-expected.json @@ -13,14 +13,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841508", "kind": "enrichment", "original": "{\"id\":\"841508\",\"ioc\":\"2a02:cf40:1::5:40669\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 11:40:15 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -55,14 +59,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841507", "kind": "enrichment", "original": "{\"id\":\"841507\",\"ioc\":\"http://malaikahlowry33.top\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.hydra\",\"malware_printable\":\"Hydra\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.hydra\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 11:36:10 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"apk\",\"Hydra\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -77,7 +85,6 @@ "url": { "domain": "malaikahlowry33.top", "original": "http://malaikahlowry33.top", - "path": "", "scheme": "http" } }, @@ -100,14 +107,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841506", "kind": "enrichment", "original": "{\"id\":\"841506\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 11:25:24 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -141,14 +152,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841505", "kind": "enrichment", "original": "{\"id\":\"841505\",\"ioc\":\"81.2.69.142:8808\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.asyncrat\",\"malware_printable\":\"AsyncRAT\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat\",\"confidence_level\":75,\"first_seen\":\"2022-08-05 11:10:13 UTC\",\"last_seen\":null,\"reference\":\"https://bazaar.abuse.ch/sample/45e87ee0b025a7e4a783a6786564982e7735c8c50d0b3d84a3d5dd90ce735cfe/\",\"reporter\":\"abuse_ch\",\"tags\":[\"asyncrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -183,14 +198,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841504", "kind": "enrichment", "original": "{\"id\":\"841504\",\"ioc\":\"81.2.69.142:6606\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.asyncrat\",\"malware_printable\":\"AsyncRAT\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat\",\"confidence_level\":75,\"first_seen\":\"2022-08-05 11:10:12 UTC\",\"last_seen\":null,\"reference\":\"https://bazaar.abuse.ch/sample/45e87ee0b025a7e4a783a6786564982e7735c8c50d0b3d84a3d5dd90ce735cfe/\",\"reporter\":\"abuse_ch\",\"tags\":[\"asyncrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -226,14 +245,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841503", "kind": "enrichment", "original": "{\"id\":\"841503\",\"ioc\":\"81.2.69.142:7707\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.asyncrat\",\"malware_printable\":\"AsyncRAT\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 11:05:33 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"asyncrat\",\"RAT\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -267,14 +290,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841502", "kind": "enrichment", "original": "{\"id\":\"841502\",\"ioc\":\"81.2.69.142:38241\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"elf.mirai\",\"malware_printable\":\"Mirai\",\"malware_alias\":\"Katana\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai\",\"confidence_level\":75,\"first_seen\":\"2022-08-05 10:40:07 UTC\",\"last_seen\":null,\"reference\":\"https://bazaar.abuse.ch/sample/2373eac488f89172263c8ea1d996d74d90803c54762cedf5808f05b9d6d341f1/\",\"reporter\":\"abuse_ch\",\"tags\":[\"Mirai\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -312,14 +339,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841501", "kind": "enrichment", "original": "{\"id\":\"841501\",\"ioc\":\"81.2.69.142:5552\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.njrat\",\"malware_printable\":\"NjRAT\",\"malware_alias\":\"Bladabindi\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:35:24 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"njrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -356,14 +387,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841500", "kind": "enrichment", "original": "{\"id\":\"841500\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:28:53 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -403,14 +438,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841499", "kind": "enrichment", "original": "{\"id\":\"841499\",\"ioc\":\"http://72.11.148.153/jquery-3.3.1.min.js\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:28:52 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -456,14 +495,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841498", "kind": "enrichment", "original": "{\"id\":\"841498\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:25:47 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -504,14 +547,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841497", "kind": "enrichment", "original": "{\"id\":\"841497\",\"ioc\":\"http://104.21.75.114/cx\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:25:45 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -556,14 +603,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841496", "kind": "enrichment", "original": "{\"id\":\"841496\",\"ioc\":\"http://172.67.222.204/ca\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:25:44 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -607,14 +658,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841495", "kind": "enrichment", "original": "{\"id\":\"841495\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:24:47 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -654,14 +709,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841494", "kind": "enrichment", "original": "{\"id\":\"841494\",\"ioc\":\"https://62.182.86.225/jquery-3.3.1.min.js\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:24:46 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -707,14 +766,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841493", "kind": "enrichment", "original": "{\"id\":\"841493\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:24:40 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"SERVER4-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -755,14 +818,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841491", "kind": "enrichment", "original": "{\"id\":\"841491\",\"ioc\":\"https://muwokok.com/us\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:24:31 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"Digital Energy Technologies Ltd.\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -807,14 +874,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841492", "kind": "enrichment", "original": "{\"id\":\"841492\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:24:31 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"Digital Energy Technologies Ltd.\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -854,14 +925,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841490", "kind": "enrichment", "original": "{\"id\":\"841490\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:23:31 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -901,14 +976,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841489", "kind": "enrichment", "original": "{\"id\":\"841489\",\"ioc\":\"https://39.105.193.50/jquery-3.3.1.min.js\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:23:30 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -954,14 +1033,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841488", "kind": "enrichment", "original": "{\"id\":\"841488\",\"ioc\":\"http://hasanhaberlerdengelenlerden.co.vu/\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:31 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1003,14 +1086,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841487", "kind": "enrichment", "original": "{\"id\":\"841487\",\"ioc\":\"http://where9smym8nd.com\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:30 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1025,7 +1112,6 @@ "url": { "domain": "where9smym8nd.com", "original": "http://where9smym8nd.com", - "path": "", "scheme": "http" } }, @@ -1052,14 +1138,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841486", "kind": "enrichment", "original": "{\"id\":\"841486\",\"ioc\":\"http://nothingandnothin31.com\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:27 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1074,7 +1164,6 @@ "url": { "domain": "nothingandnothin31.com", "original": "http://nothingandnothin31.com", - "path": "", "scheme": "http" } }, @@ -1101,14 +1190,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841485", "kind": "enrichment", "original": "{\"id\":\"841485\",\"ioc\":\"http://baggshdyfsdp.shop\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:25 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1123,7 +1216,6 @@ "url": { "domain": "baggshdyfsdp.shop", "original": "http://baggshdyfsdp.shop", - "path": "", "scheme": "http" } }, @@ -1150,14 +1242,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841484", "kind": "enrichment", "original": "{\"id\":\"841484\",\"ioc\":\"http://152.228.162.150\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:23 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1172,7 +1268,6 @@ "url": { "domain": "152.228.162.150", "original": "http://152.228.162.150", - "path": "", "scheme": "http" } }, @@ -1199,14 +1294,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841483", "kind": "enrichment", "original": "{\"id\":\"841483\",\"ioc\":\"http://5.161.62.171\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:20 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1221,7 +1320,6 @@ "url": { "domain": "5.161.62.171", "original": "http://5.161.62.171", - "path": "", "scheme": "http" } }, @@ -1248,14 +1346,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841482", "kind": "enrichment", "original": "{\"id\":\"841482\",\"ioc\":\"http://45.83.122.2\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.alien\",\"malware_printable\":\"Alien\",\"malware_alias\":\"AlienBot\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.alien\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:21:02 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"Alien\",\"apk\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1270,7 +1372,6 @@ "url": { "domain": "45.83.122.2", "original": "http://45.83.122.2", - "path": "", "scheme": "http" } }, @@ -1297,14 +1398,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841481", "kind": "enrichment", "original": "{\"id\":\"841481\",\"ioc\":\"http://50.17.77.39:4444/fwlink\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:17:36 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"AMAZON-AES\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1349,14 +1454,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841480", "kind": "enrichment", "original": "{\"id\":\"841480\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:17:19 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1396,14 +1505,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841479", "kind": "enrichment", "original": "{\"id\":\"841479\",\"ioc\":\"http://1.13.248.119/articles/189948/text.php\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:17:18 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1449,14 +1562,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841478", "kind": "enrichment", "original": "{\"id\":\"841478\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:17:07 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1497,14 +1614,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841477", "kind": "enrichment", "original": "{\"id\":\"841477\",\"ioc\":\"http://47.104.88.25/IE9CompatViewList.xml\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:17:06 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1550,14 +1671,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841476", "kind": "enrichment", "original": "{\"id\":\"841476\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:16:58 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"LINODE-AP Linode LLC\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1598,14 +1723,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841475", "kind": "enrichment", "original": "{\"id\":\"841475\",\"ioc\":\"https://45.79.127.214/j.ad\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:16:57 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"LINODE-AP Linode LLC\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1651,14 +1780,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841474", "kind": "enrichment", "original": "{\"id\":\"841474\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:16:14 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"TENCENT-NET-AP-CN Tencent Building Kejizhongyi Avenue\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1699,14 +1832,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841473", "kind": "enrichment", "original": "{\"id\":\"841473\",\"ioc\":\"http://service-akilm85g-1311240945.gz.apigw.tencentcs.com/api/x\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:16:10 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"TENCENT-NET-AP-CN Tencent Building Kejizhongyi Avenue\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1751,14 +1888,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841472", "kind": "enrichment", "original": "{\"id\":\"841472\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:15:47 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1799,14 +1940,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841471", "kind": "enrichment", "original": "{\"id\":\"841471\",\"ioc\":\"https://39.101.184.39/visit.js\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:15:46 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"ALIBABA-CN-NET Hangzhou Alibaba Advertising Co.Ltd.\",\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1852,14 +1997,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841470", "kind": "enrichment", "original": "{\"id\":\"841470\",\"ioc\":\"http://lexdavid22.top\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"apk.hydra\",\"malware_printable\":\"Hydra\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/apk.hydra\",\"confidence_level\":80,\"first_seen\":\"2022-08-05 10:13:36 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"myonium1\",\"tags\":[\"apk\",\"Hydra\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1874,7 +2023,6 @@ "url": { "domain": "lexdavid22.top", "original": "http://lexdavid22.top", - "path": "", "scheme": "http" } }, @@ -1898,14 +2046,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841469", "kind": "enrichment", "original": "{\"id\":\"841469\",\"ioc\":\"81.2.69.142:5552\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.limerat\",\"malware_printable\":\"LimeRAT\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.limerat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:10:26 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"LimeRAT\",\"RAT\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1940,14 +2092,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841468", "kind": "enrichment", "original": "{\"id\":\"841468\",\"ioc\":\"81.2.69.142:7171\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.nanocore\",\"malware_printable\":\"Nanocore RAT\",\"malware_alias\":\"Nancrat,NanoCore\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 10:10:23 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"NanoCore\",\"RAT\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1985,14 +2141,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841467", "kind": "enrichment", "original": "{\"id\":\"841467\",\"ioc\":\"81.2.69.142:21330\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 09:55:22 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2027,14 +2187,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841466", "kind": "enrichment", "original": "{\"id\":\"841466\",\"ioc\":\"81.2.69.142:22027\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.nanocore\",\"malware_printable\":\"Nanocore RAT\",\"malware_alias\":\"Nancrat,NanoCore\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 09:35:25 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"NanoCore\",\"RAT\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2072,14 +2236,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841465", "kind": "enrichment", "original": "{\"id\":\"841465\",\"ioc\":\"81.2.69.142:3398\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.remcos\",\"malware_printable\":\"Remcos\",\"malware_alias\":\"RemcosRAT,Remvio,Socmer\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos\",\"confidence_level\":75,\"first_seen\":\"2022-08-05 09:35:12 UTC\",\"last_seen\":null,\"reference\":\"https://bazaar.abuse.ch/sample/42638e51cd3eff415ce751e700d233596988fd51ffba584b18dd2e78ec07bc2b/\",\"reporter\":\"abuse_ch\",\"tags\":[\"remcos\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2116,14 +2284,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841464", "kind": "enrichment", "original": "{\"id\":\"841464\",\"ioc\":\"ffa22c40ac69750b229654c54919a480b33bc41f68c128f5e3b5967d442728fb\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha256_hash\",\"ioc_type_desc\":\"SHA256 hash of a malware sample (payload)\",\"malware\":\"win.woody\",\"malware_printable\":\"woody\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.woody\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 09:04:23 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/JAMESWT_MHT/status/1555479791821791232\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2161,14 +2333,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841463", "kind": "enrichment", "original": "{\"id\":\"841463\",\"ioc\":\"81.2.69.142:35565\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.njrat\",\"malware_printable\":\"NjRAT\",\"malware_alias\":\"Bladabindi\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 08:30:21 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"njrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2205,14 +2381,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841462", "kind": "enrichment", "original": "{\"id\":\"841462\",\"ioc\":\"http://124.221.206.154:1443/submit.php\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":75,\"first_seen\":\"2022-08-05 07:55:06 UTC\",\"last_seen\":null,\"reference\":\"https://bazaar.abuse.ch/sample/eb94cd39cde6a5270181d6e6788c69a2a90ab2b27f9236c8382e810e4dfead1d/\",\"reporter\":\"abuse_ch\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2259,14 +2439,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841461", "kind": "enrichment", "original": "{\"id\":\"841461\",\"ioc\":\"81.2.69.142:5050\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.njrat\",\"malware_printable\":\"NjRAT\",\"malware_alias\":\"Bladabindi\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 07:35:17 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"njrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2300,14 +2484,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841460", "kind": "enrichment", "original": "{\"id\":\"841460\",\"ioc\":\"c31b17eb7e69da771f0ee2230922622a94e1d27cfea1ff556615e4f27104340a\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha256_hash\",\"ioc_type_desc\":\"SHA256 hash of a malware sample (payload)\",\"malware\":\"osx.xloader\",\"malware_printable\":\"Xloader\",\"malware_alias\":\"Formbook\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/osx.xloader\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 07:04:11 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/JAMESWT_MHT/status/1555445680797270016\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2348,14 +2536,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841459", "kind": "enrichment", "original": "{\"id\":\"841459\",\"ioc\":\"81.2.69.142:14009\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 06:40:18 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2386,14 +2578,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841458", "kind": "enrichment", "original": "{\"id\":\"841458\",\"ioc\":\"http://115.55.81.211:33294/Mozi.m\",\"threat_type\":\"payload_delivery\",\"threat_type_desc\":\"Indicator that identifies a malware distribution server (payload delivery)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that delivers a malware payload\",\"malware\":\"elf.mozi\",\"malware_printable\":\"Mozi\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/elf.mozi\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 06:40:03 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"sicehice\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2433,14 +2629,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841457", "kind": "enrichment", "original": "{\"id\":\"841457\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 06:30:17 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2474,14 +2674,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841456", "kind": "enrichment", "original": "{\"id\":\"841456\",\"ioc\":\"81.2.69.142:46278\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.redline_stealer\",\"malware_printable\":\"RedLine Stealer\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 06:25:18 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"RedLineStealer\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2515,14 +2719,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841455", "kind": "enrichment", "original": "{\"id\":\"841455\",\"ioc\":\"http://213.170.133.189/\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.recordbreaker\",\"malware_printable\":\"RecordBreaker\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.recordbreaker\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 06:20:17 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"abuse_ch\",\"tags\":[\"recordbreaker\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2557,14 +2765,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841454", "kind": "enrichment", "original": "{\"id\":\"841454\",\"ioc\":\"a695ab311e3449cacf5a2611dffac5bd\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"md5_hash\",\"ioc_type_desc\":\"MD5 hash of a malware sample (payload)\",\"malware\":\"win.kutaki\",\"malware_printable\":\"Kutaki\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.kutaki\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 06:16:32 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/pollo290987/status/1555437557298651136\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2599,14 +2811,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841453", "kind": "enrichment", "original": "{\"id\":\"841453\",\"ioc\":\"7768d132668a2eb1a86a04b249fab7e5b0790b6a61927ae6db283950f4cc7d59\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha256_hash\",\"ioc_type_desc\":\"SHA256 hash of a malware sample (payload)\",\"malware\":\"win.isfb\",\"malware_printable\":\"ISFB\",\"malware_alias\":\"Gozi ISFB,IAP,Pandemyia\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 05:25:21 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/StopMalvertisin/status/1555424657037475840\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2646,14 +2862,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841452", "kind": "enrichment", "original": "{\"id\":\"841452\",\"ioc\":\"b92e9e2c758e32857506f9472cc51aec4b499afa6f703f7c40218e4e4258da86\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha256_hash\",\"ioc_type_desc\":\"SHA256 hash of a malware sample (payload)\",\"malware\":\"win.isfb\",\"malware_printable\":\"ISFB\",\"malware_alias\":\"Gozi ISFB,IAP,Pandemyia\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 05:25:19 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/StopMalvertisin/status/1555424657037475840\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2693,14 +2913,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841451", "kind": "enrichment", "original": "{\"id\":\"841451\",\"ioc\":\"0989361dd7c8739827009be27579080b37430dbbb35ac9673b5e33f61505fdff\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha256_hash\",\"ioc_type_desc\":\"SHA256 hash of a malware sample (payload)\",\"malware\":\"win.isfb\",\"malware_printable\":\"ISFB\",\"malware_alias\":\"Gozi ISFB,IAP,Pandemyia\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.isfb\",\"confidence_level\":50,\"first_seen\":\"2022-08-05 05:25:18 UTC\",\"last_seen\":null,\"reference\":\"https://twitter.com/StopMalvertisin/status/1555424657037475840\",\"reporter\":\"Virus_Deck\",\"tags\":null}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2744,14 +2968,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841450", "kind": "enrichment", "original": "{\"id\":\"841450\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:26:51 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"GIR-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2791,14 +3019,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841449", "kind": "enrichment", "original": "{\"id\":\"841449\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:26:30 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2838,14 +3070,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841448", "kind": "enrichment", "original": "{\"id\":\"841448\",\"ioc\":\"https://119.45.94.71/activity\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:26:29 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2890,14 +3126,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841447", "kind": "enrichment", "original": "{\"id\":\"841447\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:25:51 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"GIR-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2938,14 +3178,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841446", "kind": "enrichment", "original": "{\"id\":\"841446\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:25:14 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"MICROSOFT-CORP-MSN-AS-BLOCK\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2986,14 +3230,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841445", "kind": "enrichment", "original": "{\"id\":\"841445\",\"ioc\":\"http://20.239.66.2/match\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:25:13 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"MICROSOFT-CORP-MSN-AS-BLOCK\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3038,14 +3286,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841444", "kind": "enrichment", "original": "{\"id\":\"841444\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:34 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"TENCENT-NET-AP-CN Tencent Building Kejizhongyi Avenue\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3086,14 +3338,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841443", "kind": "enrichment", "original": "{\"id\":\"841443\",\"ioc\":\"https://43.155.60.197/dot.gif\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:33 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"TENCENT-NET-AP-CN Tencent Building Kejizhongyi Avenue\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3138,14 +3394,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841441", "kind": "enrichment", "original": "{\"id\":\"841441\",\"ioc\":\"http://service-da5heloj-1312757872.sh.apigw.tencentcs.com/include/template/isx.php\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:18 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3190,14 +3450,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841442", "kind": "enrichment", "original": "{\"id\":\"841442\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:18 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3237,14 +3501,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841440", "kind": "enrichment", "original": "{\"id\":\"841440\",\"ioc\":\"81.2.69.142:80\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:11 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3284,14 +3552,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841439", "kind": "enrichment", "original": "{\"id\":\"841439\",\"ioc\":\"http://43.138.129.56/cm\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:24:10 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3336,14 +3608,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841438", "kind": "enrichment", "original": "{\"id\":\"841438\",\"ioc\":\"81.2.69.142:443\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"ip:port\",\"ioc_type_desc\":\"ip:port combination that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:23:36 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"STARK-INDUSTRIES-SOLUTIONS-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3384,14 +3660,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841437", "kind": "enrichment", "original": "{\"id\":\"841437\",\"ioc\":\"https://194.87.216.182/push\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:23:35 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"STARK-INDUSTRIES-SOLUTIONS-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3436,14 +3716,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841436", "kind": "enrichment", "original": "{\"id\":\"841436\",\"ioc\":\"https://77.91.102.151/push\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"url\",\"ioc_type_desc\":\"URL that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.cobalt_strike\",\"malware_printable\":\"Cobalt Strike\",\"malware_alias\":\"Agentemis,BEACON,CobaltStrike,cobeacon\",\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 03:23:33 UTC\",\"last_seen\":null,\"reference\":null,\"reporter\":\"drb_ra\",\"tags\":[\"CobaltStrike\",\"STARK-INDUSTRIES-SOLUTIONS-AS\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3487,14 +3771,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "841537", "kind": "enrichment", "original": "{\"id\":\"841537\",\"ioc\":\"wizzy.hopto.org\",\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\u0026control server (C\u0026C)\",\"ioc_type\":\"domain\",\"ioc_type_desc\":\"Domain that is used for botnet Command\u0026control (C\u0026C)\",\"malware\":\"win.asyncrat\",\"malware_printable\":\"AsyncRAT\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat\",\"confidence_level\":100,\"first_seen\":\"2022-08-05 19:43:08 UTC\",\"last_seen\":null,\"reference\":\"https://tria.ge/220805-w57pxsgae2\",\"reporter\":\"AndreGironda\",\"tags\":[\"asyncrat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3530,14 +3818,18 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "id": "839586", "kind": "enrichment", "original": "{\"id\":\"839586\",\"ioc\":\"872ff530d50579ae6bdc7cb4d658324b1d0e7a3e\",\"threat_type\":\"payload\",\"threat_type_desc\":\"Indicator that identifies a malware sample (payload)\",\"ioc_type\":\"sha1_hash\",\"ioc_type_desc\":\"SHA1 hash of a malware sample (payload)\",\"malware\":\"win.vidar\",\"malware_printable\":\"Vidar\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar\",\"confidence_level\":75,\"first_seen\":\"2022-07-25 22:27:09 UTC\",\"last_seen\":null,\"reference\":\"\",\"reporter\":\"crep1x\",\"tags\":[\"Vidar\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3553,7 +3845,6 @@ }, "first_seen": "2022-07-25T22:27:09.000Z", "provider": "crep1x", - "reference": "", "type": "file" }, "software": { diff --git a/packages/ti_abusech/data_stream/threatfox/agent/stream/httpjson.yml.hbs b/packages/ti_abusech/data_stream/threatfox/agent/stream/httpjson.yml.hbs index ab4b5e657bc..4dc4e65436f 100644 --- a/packages/ti_abusech/data_stream/threatfox/agent/stream/httpjson.yml.hbs +++ b/packages/ti_abusech/data_stream/threatfox/agent/stream/httpjson.yml.hbs @@ -28,6 +28,7 @@ request.transforms: target: body.days value: '[[.cursor.days]]' default: '{{initial_interval}}' + value_type: int response.split: target: body.data diff --git a/packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml b/packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml index 0a72643ee94..b89a8d3f212 100644 --- a/packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_abusech/data_stream/threatfox/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -203,6 +203,23 @@ processors: - message - _tmp ignore_missing: true + - script: + description: Remove null/empty values recursively. + lang: painless + source: |- + boolean drop(Object o) { + if (o == null || o == '') { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); on_failure: - set: field: event.kind diff --git a/packages/ti_abusech/data_stream/threatfox/manifest.yml b/packages/ti_abusech/data_stream/threatfox/manifest.yml index 3c02c79cb2f..2ca457d5765 100644 --- a/packages/ti_abusech/data_stream/threatfox/manifest.yml +++ b/packages/ti_abusech/data_stream/threatfox/manifest.yml @@ -13,6 +13,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -27,18 +28,19 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true default: 24h - name: initial_interval - type: text - title: Interval + type: integer + title: Initial Interval multi: false required: true show_user: true - default: "30" - description: How far back to look for indicators the first time the agent is started. Defaults to 30 days, can be any number between 1-90. + default: 7 + description: How far back to look for indicators the first time the agent is started. Defaults to 7 days, can be any number between 1-7. - name: ssl type: yaml title: SSL diff --git a/packages/ti_abusech/data_stream/threatfox/sample_event.json b/packages/ti_abusech/data_stream/threatfox/sample_event.json index e3d764c479d..b8948563fcb 100644 --- a/packages/ti_abusech/data_stream/threatfox/sample_event.json +++ b/packages/ti_abusech/data_stream/threatfox/sample_event.json @@ -1,5 +1,5 @@ { - "@timestamp": "2022-08-06T00:10:26.114Z", + "@timestamp": "2023-08-08T18:16:34.498Z", "abusech": { "threatfox": { "confidence_level": 100, @@ -12,11 +12,11 @@ } }, "agent": { - "ephemeral_id": "c8fde031-e301-47e0-b688-4e36b951789c", - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "ephemeral_id": "988b1377-fd66-4604-9472-2d396c8ad3e5", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.0" + "version": "8.9.0" }, "data_stream": { "dataset": "ti_abusech.threatfox", @@ -24,23 +24,27 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-06T00:10:26.114Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:16:34.498Z", "dataset": "ti_abusech.threatfox", "id": "841537", - "ingested": "2022-08-06T00:10:29Z", + "ingested": "2023-08-08T18:16:37Z", "kind": "enrichment", "original": "{\"confidence_level\":100,\"first_seen\":\"2022-08-05 19:43:08 UTC\",\"id\":\"841537\",\"ioc\":\"wizzy.hopto.org\",\"ioc_type\":\"domain\",\"ioc_type_desc\":\"Domain that is used for botnet Command\\u0026control (C\\u0026C)\",\"last_seen\":null,\"malware\":\"win.asyncrat\",\"malware_alias\":null,\"malware_malpedia\":\"https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat\",\"malware_printable\":\"AsyncRAT\",\"reference\":\"https://tria.ge/220805-w57pxsgae2\",\"reporter\":\"AndreGironda\",\"tags\":[\"asyncrat\"],\"threat_type\":\"botnet_cc\",\"threat_type_desc\":\"Indicator that identifies a botnet command\\u0026control server (C\\u0026C)\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_abusech/data_stream/url/_dev/test/pipeline/test-abusechurl-ndjson.log-expected.json b/packages/ti_abusech/data_stream/url/_dev/test/pipeline/test-abusechurl-ndjson.log-expected.json index ef0f17ca3b1..22f90e19036 100644 --- a/packages/ti_abusech/data_stream/url/_dev/test/pipeline/test-abusechurl-ndjson.log-expected.json +++ b/packages/ti_abusech/data_stream/url/_dev/test/pipeline/test-abusechurl-ndjson.log-expected.json @@ -18,13 +18,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961548\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961548/\",\"url\":\"http://89.160.20.156:34613/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:19:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -66,13 +70,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961546\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961546/\",\"url\":\"http://89.160.20.156:44941/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -114,13 +122,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961547\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961547/\",\"url\":\"http://89.160.20.156:37173/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -162,13 +174,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961545\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961545/\",\"url\":\"http://89.160.20.156:47545/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -210,13 +226,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961544\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961544/\",\"url\":\"http://89.160.20.156:44782/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -258,13 +278,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961543\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961543/\",\"url\":\"http://89.160.20.156:44359/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -306,13 +330,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961540\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961540/\",\"url\":\"http://89.160.20.156:56507/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -354,13 +382,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961541\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961541/\",\"url\":\"http://89.160.20.156:57562/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -402,13 +434,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961542\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961542/\",\"url\":\"http://89.160.20.156:48845/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -450,13 +486,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961539\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961539/\",\"url\":\"http://89.160.20.156:58245/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -498,13 +538,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961538\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961538/\",\"url\":\"http://89.160.20.156:37198/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -546,13 +590,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961537\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961537/\",\"url\":\"http://89.160.20.156:33524/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -594,13 +642,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961531\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961531/\",\"url\":\"http://89.160.20.156:48261/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -642,13 +694,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961532\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961532/\",\"url\":\"http://89.160.20.156:34478/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -690,13 +746,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961533\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961533/\",\"url\":\"http://89.160.20.156:35703/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -738,13 +798,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961534\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961534/\",\"url\":\"http://89.160.20.156:48666/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -786,13 +850,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961535\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961535/\",\"url\":\"http://89.160.20.156:53923/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -834,13 +902,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961536\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961536/\",\"url\":\"http://89.160.20.156:52794/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -882,13 +954,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961530\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961530/\",\"url\":\"http://89.160.20.156:49312/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:34 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -930,13 +1006,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961525\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961525/\",\"url\":\"http://89.160.20.156:38961/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -978,13 +1058,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961526\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961526/\",\"url\":\"http://89.160.20.156:50420/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1026,13 +1110,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961527\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961527/\",\"url\":\"http://89.160.20.156:55007/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1074,13 +1162,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961528\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961528/\",\"url\":\"http://89.160.20.156:51143/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1122,13 +1214,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961529\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961529/\",\"url\":\"http://89.160.20.156:41003/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1169,13 +1265,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961524\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961524/\",\"url\":\"http://89.160.20.156:35739/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:38 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1216,13 +1316,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961523\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961523/\",\"url\":\"http://89.160.20.156:45653/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:36 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1263,13 +1367,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961520\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961520/\",\"url\":\"http://89.160.20.156:41349/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1310,13 +1418,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961521\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961521/\",\"url\":\"http://89.160.20.156:48586/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1357,13 +1469,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961522\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961522/\",\"url\":\"http://89.160.20.156:38111/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1404,13 +1520,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961518\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961518/\",\"url\":\"http://89.160.20.156:34556/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1452,13 +1572,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961519\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961519/\",\"url\":\"http://89.160.20.156:59815/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1501,13 +1625,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961516\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961516/\",\"url\":\"http://89.160.20.156:50587/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1549,13 +1677,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961517\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961517/\",\"url\":\"http://89.160.20.156:48322/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1596,13 +1728,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961515\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961515/\",\"url\":\"http://89.160.20.156:33317/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1643,13 +1779,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961513\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961513/\",\"url\":\"http://89.160.20.156:41516/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1690,13 +1830,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961514\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961514/\",\"url\":\"http://89.160.20.156:57798/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1737,13 +1881,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961509\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961509/\",\"url\":\"http://89.160.20.156:47671/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1784,13 +1932,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961510\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961510/\",\"url\":\"http://89.160.20.156:57690/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1833,13 +1985,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961511\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961511/\",\"url\":\"http://89.160.20.156:50611/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1879,13 +2035,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961512\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961512/\",\"url\":\"http://89.160.20.156:34141/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 21:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1927,13 +2087,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961507\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961507/\",\"url\":\"http://89.160.20.156:44399/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -1975,13 +2139,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961508\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961508/\",\"url\":\"http://89.160.20.156:49120/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2023,13 +2191,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961506\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961506/\",\"url\":\"http://89.160.20.156:51136/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2071,13 +2243,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961504\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961504/\",\"url\":\"http://89.160.20.156:45773/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2119,13 +2295,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961505\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961505/\",\"url\":\"http://89.160.20.156:56528/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2167,13 +2347,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961500\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961500/\",\"url\":\"http://89.160.20.156:44427/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2215,13 +2399,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961501\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961501/\",\"url\":\"http://89.160.20.156:36134/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2263,13 +2451,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961502\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961502/\",\"url\":\"http://89.160.20.156:43973/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2311,13 +2503,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961503\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961503/\",\"url\":\"http://89.160.20.156:41319/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2359,13 +2555,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961496\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961496/\",\"url\":\"http://89.160.20.156:51847/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2407,13 +2607,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961497\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961497/\",\"url\":\"http://89.160.20.156:54469/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2455,13 +2659,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961498\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961498/\",\"url\":\"http://89.160.20.156:34547/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2503,13 +2711,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961499\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961499/\",\"url\":\"http://89.160.20.156:33932/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2550,13 +2762,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961494\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961494/\",\"url\":\"https://univirtek.com/viro/02478080035/blank.jpg\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:51:47 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2595,13 +2811,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961495\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961495/\",\"url\":\"https://univirtek.com/viro/FRRNDR77C25D325O/map.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:51:47 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2640,13 +2860,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961492\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961492/\",\"url\":\"https://ladiesincode.com/ladi/CNNSRG83H04F158R/blank.jpg\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:51:45 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2685,13 +2909,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961493\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961493/\",\"url\":\"https://letonguesc.com/leto/02328510512/logo.css\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:51:45 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2730,13 +2958,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961490\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961490/\",\"url\":\"https://cxminute.com/minu/MLILSN74B21E507L/uk.png\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:51:44 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2775,13 +3007,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961491\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961491/\",\"url\":\"https://cxminute.com/minu/12875710159/blank.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:51:44 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2820,13 +3056,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961489\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961489/\",\"url\":\"https://cxminute.com/minu/CPNLNZ65M20A200N/maps.gif\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:51:41 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2865,13 +3105,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961488\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961488/\",\"url\":\"https://belfetproduction.com/bella/DLPCMN64D02D789E/logo.png\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:51:40 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2910,13 +3154,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961487\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961487/\",\"url\":\"https://belfetproduction.com/bella/01844510469/1x1.jpg\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:51:17 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -2955,13 +3203,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961485\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961485/\",\"url\":\"https://ladiesincode.com/ladi/FRRDNI52M71E522D/logo.css\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:51:16 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3000,13 +3252,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961486\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961486/\",\"url\":\"https://letonguesc.com/leto/CPPMRC65E04H980Q/it.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:51:16 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3045,13 +3301,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961482\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961482/\",\"url\":\"https://univirtek.com/viro/06389650018/it.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:51:15 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3090,13 +3350,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961483\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961483/\",\"url\":\"https://belfetproduction.com/bella/CRSRRT61E15H501H/logo.png\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:51:15 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3135,13 +3399,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961484\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961484/\",\"url\":\"https://cxminute.com/minu/SMPMSM67P05F205U/it.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:51:15 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3180,13 +3448,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961480\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961480/\",\"url\":\"https://univirtek.com/viro/SBNPQL78A24A783E/uk.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:51:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3225,13 +3497,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961481\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961481/\",\"url\":\"https://cxminute.com/minu/15578761007/maps.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:51:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3270,13 +3546,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961478\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961478/\",\"url\":\"https://univirtek.com/viro/03079590133/1x1.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:51:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3315,13 +3595,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961479\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961479/\",\"url\":\"https://ladiesincode.com/ladi/BNCLNR77T56M082U/it.gif\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:51:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3360,13 +3644,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961476\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961476/\",\"url\":\"https://cxminute.com/minu/JNKMTJ64B29L424O/uk.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:45 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3405,13 +3693,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961477\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961477/\",\"url\":\"https://belfetproduction.com/bella/PGNMRA64S22I608Z/en.png\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:50:45 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3450,13 +3742,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961470\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961470/\",\"url\":\"https://cxminute.com/minu/RZKDRD77T23Z229T/logo.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3495,13 +3791,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961471\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961471/\",\"url\":\"https://fhivelifestyle.online/nhbrwvdffsgt/adf/maps.jpg\",\"url_status\":\"offline\",\"host\":\"fhivelifestyle.online\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3540,13 +3840,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961472\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961472/\",\"url\":\"https://belfetproduction.com/bella/05739900487/1x1.css\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3585,13 +3889,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961473\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961473/\",\"url\":\"https://belfetproduction.com/bella/01767180597/map.css\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3630,13 +3938,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961474\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961474/\",\"url\":\"https://belfetproduction.com/bella/BRNGRG55D21F394K/map.css\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3675,13 +3987,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961475\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961475/\",\"url\":\"https://cxminute.com/minu/DLLTZN67L20L157J/1x1.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:43 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3720,13 +4036,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961468\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961468/\",\"url\":\"https://cxminute.com/minu/08035410722/logo.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:38 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3765,13 +4085,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961469\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961469/\",\"url\":\"https://univirtek.com/viro/GRNZEI60M13G346L/en.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:50:38 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3810,13 +4134,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961467\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961467/\",\"url\":\"https://letonguesc.com/leto/03253350239/1x1.png\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:50:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3855,13 +4183,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961464\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961464/\",\"url\":\"https://ladiesincode.com/ladi/10582470158/uk.css\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:50:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3900,13 +4232,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961465\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961465/\",\"url\":\"https://ladiesincode.com/ladi/BTTLNZ68A56D325C/map.css\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:50:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3945,13 +4281,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961466\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961466/\",\"url\":\"https://letonguesc.com/leto/NNTLRT68P28A717L/en.jpg\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:50:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -3990,13 +4330,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961461\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961461/\",\"url\":\"https://univirtek.com/viro/CTTNDR89A19B149W/maps.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4035,13 +4379,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961462\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961462/\",\"url\":\"https://cxminute.com/minu/DRSNTN77B16I197U/logo.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4080,13 +4428,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961463\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961463/\",\"url\":\"https://univirtek.com/viro/02941830735/uk.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4125,13 +4477,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961458\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961458/\",\"url\":\"https://belfetproduction.com/bella/MNSGCM91A04G240K/it.css\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:50:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4170,13 +4526,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961459\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961459/\",\"url\":\"https://ladiesincode.com/ladi/03108100615/it.jpg\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:50:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4215,13 +4575,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961460\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961460/\",\"url\":\"https://cxminute.com/minu/PTACSM56A31F604X/en.png\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:50:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4260,13 +4624,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961455\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961455/\",\"url\":\"https://univirtek.com/viro/00183050368/en.gif\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:39 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4305,13 +4673,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961456\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961456/\",\"url\":\"https://cxminute.com/minu/TSNLSN58H30G912H/uk.gif\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:49:39 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4350,13 +4722,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961457\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961457/\",\"url\":\"https://letonguesc.com/leto/08658331007/blank.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:39 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4395,13 +4771,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961450\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961450/\",\"url\":\"https://cxminute.com/minu/01098910324/blank.png\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:49:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4440,13 +4820,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961451\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961451/\",\"url\":\"https://univirtek.com/viro/02794390233/uk.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4485,13 +4869,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961452\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961452/\",\"url\":\"https://univirtek.com/viro/CSTDNT69D63F754D/en.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4530,13 +4918,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961453\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961453/\",\"url\":\"https://univirtek.com/viro/GSTGNE91B06L219W/1x1.jpg\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4575,13 +4967,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961454\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961454/\",\"url\":\"https://univirtek.com/viro/03610140125/map.jpg\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4620,13 +5016,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961448\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961448/\",\"url\":\"https://belfetproduction.com/bella/CRRLRD74E09A462T/blank.png\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:49:36 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4665,13 +5065,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961449\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961449/\",\"url\":\"https://univirtek.com/viro/RSTFRZ57T05G337C/maps.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:36 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4710,13 +5114,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961447\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961447/\",\"url\":\"https://letonguesc.com/leto/LBRFNC56S10D952D/map.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4755,13 +5163,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961444\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961444/\",\"url\":\"https://univirtek.com/viro/01669890194/it.gif\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:49:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4800,13 +5212,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961445\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961445/\",\"url\":\"https://letonguesc.com/leto/GTNNTN60P12H632S/maps.css\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4845,13 +5261,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961446\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961446/\",\"url\":\"https://cxminute.com/minu/ZHOXBN72B06Z210N/en.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:49:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4890,13 +5310,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961442\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961442/\",\"url\":\"https://letonguesc.com/leto/KHNGGR61S21Z112Y/uk.css\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4935,13 +5359,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961443\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961443/\",\"url\":\"https://ladiesincode.com/ladi/MNRMNL75A12I531F/uk.jpg\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:49:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -4980,13 +5408,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961438\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961438/\",\"url\":\"https://ladiesincode.com/ladi/RBGMNL67A02L675L/uk.css\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5025,13 +5457,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961439\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961439/\",\"url\":\"https://letonguesc.com/leto/RSSPPL67P15G535L/map.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5070,13 +5506,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961440\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961440/\",\"url\":\"https://fhivelifestyle.online/nhbrwvdffsgt/adf/uk.css\",\"url_status\":\"offline\",\"host\":\"fhivelifestyle.online\",\"date_added\":\"2021-01-14 20:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5115,13 +5555,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961441\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961441/\",\"url\":\"https://letonguesc.com/leto/BNTLGU67R11L706R/blank.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5160,13 +5604,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961437\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961437/\",\"url\":\"https://cxminute.com/minu/03713610651/map.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:48:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5205,13 +5653,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961436\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961436/\",\"url\":\"https://univirtek.com/viro/01312580507/uk.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:36 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5250,13 +5702,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961431\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961431/\",\"url\":\"https://cxminute.com/minu/FRNRST34B11F843P/blank.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:48:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5295,13 +5751,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961432\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961432/\",\"url\":\"https://univirtek.com/viro/RCUNDA90D24Z100H/1x1.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5340,13 +5800,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961433\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961433/\",\"url\":\"https://univirtek.com/viro/GTTGRI72H19A952D/map.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5385,13 +5849,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961434\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961434/\",\"url\":\"https://univirtek.com/viro/00385010103/map.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5430,13 +5898,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961435\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961435/\",\"url\":\"https://ladiesincode.com/ladi/04263990162/map.css\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:48:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5475,13 +5947,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961428\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961428/\",\"url\":\"https://univirtek.com/viro/BNNSFN74A13G674O/logo.png\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:34 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5520,13 +5996,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961429\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961429/\",\"url\":\"https://univirtek.com/viro/RZZCRS93B15G224O/it.gif\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:34 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5565,13 +6045,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961430\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961430/\",\"url\":\"https://cxminute.com/minu/01495100032/maps.gif\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:48:34 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5610,13 +6094,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961427\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961427/\",\"url\":\"https://letonguesc.com/leto/CMPDVD69C11G693Z/map.gif\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:48:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5655,13 +6143,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961426\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961426/\",\"url\":\"https://cxminute.com/minu/LLLMRC84B29A944R/it.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:48:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5700,13 +6192,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961421\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961421/\",\"url\":\"https://cxminute.com/minu/PRSSFN72L18C573S/map.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:48:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5745,13 +6241,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961422\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961422/\",\"url\":\"https://ladiesincode.com/ladi/00814870150/1x1.png\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:48:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5790,13 +6290,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961423\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961423/\",\"url\":\"https://ladiesincode.com/ladi/03635540234/it.gif\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:48:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5835,13 +6339,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961424\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961424/\",\"url\":\"https://univirtek.com/viro/PLCSFN62B11D548Q/map.gif\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5880,13 +6388,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961425\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961425/\",\"url\":\"https://univirtek.com/viro/03294650167/maps.jpg\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5925,13 +6437,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961418\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961418/\",\"url\":\"https://univirtek.com/viro/GGLSCR73D17C627Q/blank.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5970,13 +6486,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961419\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961419/\",\"url\":\"https://univirtek.com/viro/CRRLRA68A70H501X/maps.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:48:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6015,13 +6535,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961420\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961420/\",\"url\":\"https://ladiesincode.com/ladi/CRSNLD59R12L840V/blank.jpg\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:48:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6060,13 +6584,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961416\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961416/\",\"url\":\"https://belfetproduction.com/bella/RTTCRL58M29A794D/logo.css\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:47:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6105,13 +6633,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961417\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961417/\",\"url\":\"https://letonguesc.com/leto/04138120169/en.jpg\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:47:35 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6150,13 +6682,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961408\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961408/\",\"url\":\"https://letonguesc.com/leto/SPGMRC73H13A475I/it.jpg\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6195,13 +6731,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961409\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961409/\",\"url\":\"https://letonguesc.com/leto/80007070552/it.png\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6240,13 +6780,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961410\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961410/\",\"url\":\"https://letonguesc.com/leto/02482130271/logo.png\",\"url_status\":\"offline\",\"host\":\"letonguesc.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6285,13 +6829,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961411\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961411/\",\"url\":\"https://univirtek.com/viro/15730201009/uk.gif\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6330,13 +6878,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961412\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961412/\",\"url\":\"https://univirtek.com/viro/01074480250/maps.css\",\"url_status\":\"offline\",\"host\":\"univirtek.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6375,13 +6927,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961413\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961413/\",\"url\":\"https://cxminute.com/minu/SCHRKE77C47G224W/1x1.jpg\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6420,13 +6976,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961414\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961414/\",\"url\":\"https://cxminute.com/minu/04281560377/en.css\",\"url_status\":\"offline\",\"host\":\"cxminute.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6465,13 +7025,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961415\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961415/\",\"url\":\"https://ladiesincode.com/ladi/02613440060/maps.png\",\"url_status\":\"offline\",\"host\":\"ladiesincode.com\",\"date_added\":\"2021-01-14 20:47:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6510,13 +7074,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961406\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961406/\",\"url\":\"https://nowyouknowent.com/werdona/PLLRRT83A05H501O/it.gif\",\"url_status\":\"offline\",\"host\":\"nowyouknowent.com\",\"date_added\":\"2021-01-14 20:47:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6555,13 +7123,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961407\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961407/\",\"url\":\"https://hoagtechhydroponics.com/teco/LGTCDC74T45F205G/logo.png\",\"url_status\":\"offline\",\"host\":\"hoagtechhydroponics.com\",\"date_added\":\"2021-01-14 20:47:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6600,13 +7172,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961404\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961404/\",\"url\":\"https://belfetproduction.com/bella/00160060349/uk.jpg\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:42:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6645,13 +7221,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961405\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961405/\",\"url\":\"https://belfetproduction.com/bella/01288650243/1x1.jpg\",\"url_status\":\"offline\",\"host\":\"belfetproduction.com\",\"date_added\":\"2021-01-14 20:42:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Cryptolaemus1\",\"larted\":\"false\",\"tags\":[\"sLoad\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6692,13 +7272,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961403\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961403/\",\"url\":\"http://89.160.20.156:50611/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:39:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6740,13 +7324,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961402\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961402/\",\"url\":\"http://89.160.20.156:45371/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:14 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6788,13 +7376,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961400\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961400/\",\"url\":\"http://89.160.20.156:50093/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6836,13 +7428,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961401\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961401/\",\"url\":\"http://89.160.20.156:36652/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6884,13 +7480,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961397\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961397/\",\"url\":\"http://89.160.20.156:54182/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6932,13 +7532,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961398\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961398/\",\"url\":\"http://89.160.20.156:46048/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -6980,13 +7584,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961399\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961399/\",\"url\":\"http://89.160.20.156:33953/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:36:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7028,13 +7636,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961393\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961393/\",\"url\":\"http://89.160.20.156:36447/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7076,13 +7688,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961394\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961394/\",\"url\":\"http://89.160.20.156:36828/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7124,13 +7740,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961395\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961395/\",\"url\":\"http://89.160.20.156:55281/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7172,13 +7792,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961396\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961396/\",\"url\":\"http://89.160.20.156:49772/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7220,13 +7844,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961391\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961391/\",\"url\":\"http://89.160.20.156:50229/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7268,13 +7896,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961392\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961392/\",\"url\":\"http://89.160.20.156:39996/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7316,13 +7948,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961387\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961387/\",\"url\":\"http://89.160.20.156:50195/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7364,13 +8000,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961388\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961388/\",\"url\":\"http://89.160.20.156:52447/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7412,13 +8052,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961389\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961389/\",\"url\":\"http://89.160.20.156:56321/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7460,13 +8104,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961390\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961390/\",\"url\":\"http://89.160.20.156:54620/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7508,13 +8156,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961386\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961386/\",\"url\":\"http://89.160.20.156:52064/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:23:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7556,13 +8208,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961385\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961385/\",\"url\":\"http://89.160.20.156:47401/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7604,13 +8260,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961382\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961382/\",\"url\":\"http://89.160.20.156:46527/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7652,13 +8312,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961383\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961383/\",\"url\":\"http://89.160.20.156:38132/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7700,13 +8364,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961384\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961384/\",\"url\":\"http://89.160.20.156:59015/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7748,13 +8416,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961379\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961379/\",\"url\":\"http://89.160.20.156:59454/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7796,13 +8468,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961380\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961380/\",\"url\":\"http://89.160.20.156:37883/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7844,13 +8520,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961381\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961381/\",\"url\":\"http://89.160.20.156:55209/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7892,13 +8572,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961378\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961378/\",\"url\":\"http://89.160.20.156:41062/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:21:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7941,13 +8625,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961377\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961377/\",\"url\":\"http://89.160.20.156:60380/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -7988,13 +8676,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961375\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961375/\",\"url\":\"http://89.160.20.156:54796/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8036,13 +8728,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961376\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961376/\",\"url\":\"http://89.160.20.156:35251/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8084,13 +8780,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961373\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961373/\",\"url\":\"http://89.160.20.156:50562/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8132,13 +8832,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961374\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961374/\",\"url\":\"http://89.160.20.156:33445/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8180,13 +8884,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961370\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961370/\",\"url\":\"http://89.160.20.156:60280/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8228,13 +8936,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961371\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961371/\",\"url\":\"http://89.160.20.156:46386/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8276,13 +8988,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961372\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961372/\",\"url\":\"http://89.160.20.156:60288/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8324,13 +9040,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961368\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961368/\",\"url\":\"http://89.160.20.156:49731/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8372,13 +9092,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961369\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961369/\",\"url\":\"http://89.160.20.156:38837/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8420,13 +9144,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961366\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961366/\",\"url\":\"http://89.160.20.156:37814/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8468,13 +9196,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961367\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961367/\",\"url\":\"http://89.160.20.156:47507/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8517,13 +9249,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961365\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961365/\",\"url\":\"http://89.160.20.156:47140/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:18:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8564,13 +9300,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961363\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961363/\",\"url\":\"http://89.160.20.156:41514/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:11 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8612,13 +9352,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961364\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961364/\",\"url\":\"http://89.160.20.156:58748/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:11 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8660,13 +9404,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961362\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961362/\",\"url\":\"http://89.160.20.156:51183/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8708,13 +9456,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961361\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961361/\",\"url\":\"http://89.160.20.156:42104/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8756,13 +9508,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961354\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961354/\",\"url\":\"http://89.160.20.156:53130/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8804,13 +9560,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961355\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961355/\",\"url\":\"http://89.160.20.156:57768/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8852,13 +9612,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961356\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961356/\",\"url\":\"http://89.160.20.156:34541/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8900,13 +9664,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961357\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961357/\",\"url\":\"http://89.160.20.156:51344/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8948,13 +9716,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961358\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961358/\",\"url\":\"http://89.160.20.156:40084/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -8996,13 +9768,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961359\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961359/\",\"url\":\"http://89.160.20.156:60457/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9044,13 +9820,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961360\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961360/\",\"url\":\"http://89.160.20.156:34906/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9092,13 +9872,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961353\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961353/\",\"url\":\"http://89.160.20.156:59847/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:10:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9140,13 +9924,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961352\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961352/\",\"url\":\"http://89.160.20.156:47873/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:09:00 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9188,13 +9976,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961349\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961349/\",\"url\":\"http://89.160.20.156:48645/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9236,13 +10028,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961350\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961350/\",\"url\":\"http://89.160.20.156:36524/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9284,13 +10080,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961351\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961351/\",\"url\":\"http://89.160.20.156:38726/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9332,13 +10132,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961345\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961345/\",\"url\":\"http://89.160.20.156:41149/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9380,13 +10184,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961346\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961346/\",\"url\":\"http://89.160.20.156:46993/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9428,13 +10236,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961347\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961347/\",\"url\":\"http://89.160.20.156:39190/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9476,13 +10288,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961348\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961348/\",\"url\":\"http://89.160.20.156:48344/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:05:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9525,13 +10341,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961344\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961344/\",\"url\":\"http://89.160.20.156:58427/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:04:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9574,13 +10394,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961343\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961343/\",\"url\":\"http://89.160.20.156:41921/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 20:02:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9622,13 +10446,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961342\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961342/\",\"url\":\"http://89.160.20.156:47140/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:55:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9670,13 +10498,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961341\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961341/\",\"url\":\"http://89.160.20.156:34789/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:52:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9718,13 +10550,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961340\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961340/\",\"url\":\"http://89.160.20.156:37634/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9766,13 +10602,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961339\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961339/\",\"url\":\"http://89.160.20.156:41636/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9814,13 +10654,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961338\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961338/\",\"url\":\"http://89.160.20.156:32907/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9862,13 +10706,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961336\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961336/\",\"url\":\"http://89.160.20.156:57568/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9910,13 +10758,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961337\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961337/\",\"url\":\"http://89.160.20.156:40740/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -9958,13 +10810,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961331\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961331/\",\"url\":\"http://89.160.20.156:35927/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10006,13 +10862,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961332\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961332/\",\"url\":\"http://89.160.20.156:55558/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10054,13 +10914,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961333\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961333/\",\"url\":\"http://89.160.20.156:60558/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10102,13 +10966,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961334\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961334/\",\"url\":\"http://89.160.20.156:59624/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10150,13 +11018,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961335\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961335/\",\"url\":\"http://89.160.20.156:39386/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10198,13 +11070,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961322\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961322/\",\"url\":\"http://89.160.20.156:46289/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10246,13 +11122,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961323\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961323/\",\"url\":\"http://89.160.20.156:34951/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10294,13 +11174,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961324\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961324/\",\"url\":\"http://89.160.20.156:47594/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10342,13 +11226,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961325\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961325/\",\"url\":\"http://89.160.20.156:55792/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10390,13 +11278,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961326\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961326/\",\"url\":\"http://89.160.20.156:35271/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10438,13 +11330,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961327\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961327/\",\"url\":\"http://89.160.20.156:36300/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10486,13 +11382,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961328\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961328/\",\"url\":\"http://89.160.20.156:60680/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10534,13 +11434,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961329\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961329/\",\"url\":\"http://89.160.20.156:51132/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10582,13 +11486,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961330\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961330/\",\"url\":\"http://89.160.20.156:39049/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10630,13 +11538,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961321\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961321/\",\"url\":\"http://89.160.20.156:57455/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:49:12 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10678,13 +11590,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961320\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961320/\",\"url\":\"http://89.160.20.156:32823/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:49:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10726,13 +11642,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961318\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961318/\",\"url\":\"http://89.160.20.156:44103/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10774,13 +11694,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961319\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961319/\",\"url\":\"http://89.160.20.156:36257/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10823,13 +11747,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961317\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961317/\",\"url\":\"http://89.160.20.156:41921/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:45:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10872,13 +11800,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961316\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961316/\",\"url\":\"http://89.160.20.156:50971/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:44:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10919,13 +11851,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961315\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961315/\",\"url\":\"http://89.160.20.156:56339/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -10967,13 +11903,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961314\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961314/\",\"url\":\"http://89.160.20.156:52551/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11015,13 +11955,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961312\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961312/\",\"url\":\"http://89.160.20.156:35942/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11063,13 +12007,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961313\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961313/\",\"url\":\"http://89.160.20.156:39636/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11111,13 +12059,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961310\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961310/\",\"url\":\"http://89.160.20.156:53548/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11159,13 +12111,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961311\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961311/\",\"url\":\"http://89.160.20.156:40967/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11207,13 +12163,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961309\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961309/\",\"url\":\"http://89.160.20.156:49471/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11255,13 +12215,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961302\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961302/\",\"url\":\"http://89.160.20.156:43937/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11303,13 +12267,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961303\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961303/\",\"url\":\"http://89.160.20.156:57992/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11351,13 +12319,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961304\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961304/\",\"url\":\"http://89.160.20.156:43603/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11399,13 +12371,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961305\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961305/\",\"url\":\"http://89.160.20.156:37157/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11447,13 +12423,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961306\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961306/\",\"url\":\"http://89.160.20.156:37229/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11495,13 +12475,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961307\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961307/\",\"url\":\"http://89.160.20.156:49104/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11543,13 +12527,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961308\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961308/\",\"url\":\"http://89.160.20.156:49575/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11591,13 +12579,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961299\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961299/\",\"url\":\"http://89.160.20.156:50000/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11639,13 +12631,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961300\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961300/\",\"url\":\"http://89.160.20.156:36251/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11687,13 +12683,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961301\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961301/\",\"url\":\"http://89.160.20.156:51932/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11735,13 +12735,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961297\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961297/\",\"url\":\"http://89.160.20.156:45660/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11783,13 +12787,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961298\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961298/\",\"url\":\"http://89.160.20.156:42478/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11831,13 +12839,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961296\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961296/\",\"url\":\"http://89.160.20.156:50726/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11880,13 +12892,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961295\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961295/\",\"url\":\"http://89.160.20.156:40256/i\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:33:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11928,13 +12944,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961294\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961294/\",\"url\":\"http://89.160.20.156:50971/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:29:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -11976,13 +12996,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961293\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961293/\",\"url\":\"https://realestatederivatives.com.ng/zx/janomo_hfWUGQvSPn0.bin\",\"url_status\":\"online\",\"host\":\"realestatederivatives.com.ng\",\"date_added\":\"2021-01-14 19:24:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"encrypted\",\"GuLoader\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12022,13 +13046,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961291\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961291/\",\"url\":\"http://89.160.20.156:33946/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12070,13 +13098,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961292\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961292/\",\"url\":\"http://89.160.20.156:39990/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12118,13 +13150,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961288\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961288/\",\"url\":\"http://89.160.20.156:60558/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12166,13 +13202,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961289\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961289/\",\"url\":\"http://89.160.20.156:32989/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12214,13 +13254,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961290\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961290/\",\"url\":\"http://89.160.20.156:52458/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12262,13 +13306,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961286\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961286/\",\"url\":\"http://89.160.20.156:60735/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12310,13 +13358,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961287\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961287/\",\"url\":\"http://89.160.20.156:34755/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12358,13 +13410,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961285\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961285/\",\"url\":\"http://89.160.20.156:39290/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12406,13 +13462,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961279\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961279/\",\"url\":\"http://89.160.20.156:56141/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12454,13 +13514,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961280\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961280/\",\"url\":\"http://89.160.20.156:40247/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12503,13 +13567,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961281\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961281/\",\"url\":\"http://89.160.20.156:36619/i\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12550,13 +13618,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961282\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961282/\",\"url\":\"http://89.160.20.156:43673/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12598,13 +13670,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961283\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961283/\",\"url\":\"http://89.160.20.156:55726/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12646,13 +13722,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961284\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961284/\",\"url\":\"http://89.160.20.156:59668/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12694,13 +13774,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961278\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961278/\",\"url\":\"http://89.160.20.156:34391/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12742,13 +13826,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961277\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961277/\",\"url\":\"http://89.160.20.156:49478/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12790,13 +13878,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961276\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961276/\",\"url\":\"http://89.160.20.156:54670/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12838,13 +13930,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961270\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961270/\",\"url\":\"http://89.160.20.156:59599/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12886,13 +13982,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961271\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961271/\",\"url\":\"http://89.160.20.156:45189/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12934,13 +14034,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961272\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961272/\",\"url\":\"http://89.160.20.156:60805/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -12982,13 +14086,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961273\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961273/\",\"url\":\"http://89.160.20.156:38888/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13030,13 +14138,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961274\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961274/\",\"url\":\"http://89.160.20.156:47869/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13078,13 +14190,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961275\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961275/\",\"url\":\"http://89.160.20.156:57478/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13127,13 +14243,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961269\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961269/\",\"url\":\"http://89.160.20.156:40256/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:10:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13175,13 +14295,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961268\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961268/\",\"url\":\"http://89.160.20.156:49035/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13223,13 +14347,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961266\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961266/\",\"url\":\"http://89.160.20.156:41531/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13271,13 +14399,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961267\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961267/\",\"url\":\"http://89.160.20.156:49596/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13319,13 +14451,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961265\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961265/\",\"url\":\"http://89.160.20.156:43584/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:07:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13367,13 +14503,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961264\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961264/\",\"url\":\"http://89.160.20.156:44976/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13415,13 +14555,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961259\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961259/\",\"url\":\"http://89.160.20.156:51107/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13463,13 +14607,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961260\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961260/\",\"url\":\"http://89.160.20.156:33790/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13511,13 +14659,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961261\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961261/\",\"url\":\"http://89.160.20.156:58919/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13559,13 +14711,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961262\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961262/\",\"url\":\"http://89.160.20.156:40395/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13607,13 +14763,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961263\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961263/\",\"url\":\"http://89.160.20.156:53510/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13655,13 +14815,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961258\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961258/\",\"url\":\"http://89.160.20.156:39115/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:12 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13703,13 +14867,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961257\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961257/\",\"url\":\"http://89.160.20.156:40713/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:11 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13751,13 +14919,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961256\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961256/\",\"url\":\"http://89.160.20.156:54811/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13799,13 +14971,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961255\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961255/\",\"url\":\"http://89.160.20.156:58269/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13847,13 +15023,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961251\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961251/\",\"url\":\"http://89.160.20.156:47985/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13895,13 +15075,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961252\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961252/\",\"url\":\"http://89.160.20.156:38107/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13943,13 +15127,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961253\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961253/\",\"url\":\"http://89.160.20.156:50354/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -13991,13 +15179,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961254\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961254/\",\"url\":\"http://89.160.20.156:44987/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14039,13 +15231,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961249\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961249/\",\"url\":\"http://89.160.20.156:44681/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14087,13 +15283,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961250\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961250/\",\"url\":\"http://89.160.20.156:58391/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14135,13 +15335,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961248\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961248/\",\"url\":\"http://89.160.20.156:48540/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14183,13 +15387,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961246\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961246/\",\"url\":\"http://89.160.20.156:42755/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14231,13 +15439,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961247\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961247/\",\"url\":\"http://89.160.20.156:52688/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14279,13 +15491,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961244\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961244/\",\"url\":\"http://89.160.20.156:33782/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14327,13 +15543,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961245\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961245/\",\"url\":\"http://89.160.20.156:50381/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14375,13 +15595,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961243\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961243/\",\"url\":\"http://89.160.20.156:44219/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14424,13 +15648,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961242\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961242/\",\"url\":\"http://89.160.20.156:36619/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 19:01:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14473,13 +15701,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961241\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961241/\",\"url\":\"http://89.160.20.156:59976/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:56:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14520,13 +15752,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961239\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961239/\",\"url\":\"http://89.160.20.156:48688/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14568,13 +15804,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961240\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961240/\",\"url\":\"http://89.160.20.156:45682/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14616,13 +15856,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961238\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961238/\",\"url\":\"http://89.160.20.156:34922/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14664,13 +15908,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961233\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961233/\",\"url\":\"http://89.160.20.156:37489/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14712,13 +15960,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961234\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961234/\",\"url\":\"http://89.160.20.156:51940/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14760,13 +16012,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961235\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961235/\",\"url\":\"http://89.160.20.156:49599/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14808,13 +16064,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961236\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961236/\",\"url\":\"http://89.160.20.156:53436/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14856,13 +16116,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961237\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961237/\",\"url\":\"http://89.160.20.156:57237/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14904,13 +16168,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961232\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961232/\",\"url\":\"http://89.160.20.156:50907/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -14952,13 +16220,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961231\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961231/\",\"url\":\"http://89.160.20.156:41910/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:14 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15000,13 +16272,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961229\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961229/\",\"url\":\"http://89.160.20.156:57217/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15048,13 +16324,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961230\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961230/\",\"url\":\"http://89.160.20.156:47632/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15096,13 +16376,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961227\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961227/\",\"url\":\"http://89.160.20.156:46654/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15144,13 +16428,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961228\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961228/\",\"url\":\"http://89.160.20.156:59073/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15192,13 +16480,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961221\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961221/\",\"url\":\"http://89.160.20.156:37958/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15240,13 +16532,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961222\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961222/\",\"url\":\"http://89.160.20.156:53943/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15288,13 +16584,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961223\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961223/\",\"url\":\"http://89.160.20.156:40404/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15336,13 +16636,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961224\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961224/\",\"url\":\"http://89.160.20.156:46738/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15384,13 +16688,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961225\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961225/\",\"url\":\"http://89.160.20.156:58234/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15432,13 +16740,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961226\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961226/\",\"url\":\"http://89.160.20.156:36911/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15480,13 +16792,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961220\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961220/\",\"url\":\"http://89.160.20.156:35028/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:49:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15529,13 +16845,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961219\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961219/\",\"url\":\"http://allanabolicsteam.net/nedfr_.exe\",\"url_status\":\"offline\",\"host\":\"allanabolicsteam.net\",\"date_added\":\"2021-01-14 18:47:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"Myrtus0x0\",\"larted\":\"true\",\"tags\":[\"c2\",\"hancitor\",\"payload\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15574,13 +16894,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961217\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961217/\",\"url\":\"https://intranetstc.micromart.com.br/fined.php\",\"url_status\":\"offline\",\"host\":\"intranetstc.micromart.com.br\",\"date_added\":\"2021-01-14 18:47:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"0x49736b\",\"larted\":\"false\",\"tags\":[\"Dridex\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15621,13 +16945,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961218\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961218/\",\"url\":\"http://allanabolicsteam.net/1301s.bin\",\"url_status\":\"online\",\"host\":\"allanabolicsteam.net\",\"date_added\":\"2021-01-14 18:47:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"Myrtus0x0\",\"larted\":\"true\",\"tags\":[\"c2\",\"hancitor\",\"payload\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15668,13 +16996,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961216\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961216/\",\"url\":\"http://89.160.20.156:43741/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:44:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15716,13 +17048,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961215\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961215/\",\"url\":\"http://89.160.20.156:45803/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:41:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"false\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15764,13 +17100,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961214\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961214/\",\"url\":\"http://89.160.20.156:38611/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"false\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15812,13 +17152,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961213\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961213/\",\"url\":\"http://89.160.20.156:35185/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:12 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15860,13 +17204,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961212\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961212/\",\"url\":\"http://89.160.20.156:35054/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15908,13 +17256,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961207\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961207/\",\"url\":\"http://89.160.20.156:60038/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -15956,13 +17308,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961208\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961208/\",\"url\":\"http://89.160.20.156:52253/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16004,13 +17360,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961209\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961209/\",\"url\":\"http://89.160.20.156:43125/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16052,13 +17412,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961210\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961210/\",\"url\":\"http://89.160.20.156:52650/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16100,13 +17464,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961211\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961211/\",\"url\":\"http://89.160.20.156:59273/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16148,13 +17516,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961206\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961206/\",\"url\":\"http://89.160.20.156:40346/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16196,13 +17568,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961204\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961204/\",\"url\":\"http://89.160.20.156:44242/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16244,13 +17620,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961205\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961205/\",\"url\":\"http://89.160.20.156:40624/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16292,13 +17672,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961202\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961202/\",\"url\":\"http://89.160.20.156:41245/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16340,13 +17724,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961203\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961203/\",\"url\":\"http://89.160.20.156:48866/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16388,13 +17776,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961198\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961198/\",\"url\":\"http://89.160.20.156:58258/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16436,13 +17828,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961199\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961199/\",\"url\":\"http://89.160.20.156:34516/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16484,13 +17880,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961200\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961200/\",\"url\":\"http://89.160.20.156:47851/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16532,13 +17932,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961201\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961201/\",\"url\":\"http://89.160.20.156:49226/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16581,13 +17985,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961197\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961197/\",\"url\":\"http://89.160.20.156:36957/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:34:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16629,13 +18037,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961196\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961196/\",\"url\":\"http://89.160.20.156:53089/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:34:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16677,13 +18089,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961193\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961193/\",\"url\":\"http://89.160.20.156:57114/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16725,13 +18141,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961194\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961194/\",\"url\":\"http://89.160.20.156:33163/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16773,13 +18193,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961195\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961195/\",\"url\":\"http://89.160.20.156:48557/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16822,13 +18246,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961192\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961192/\",\"url\":\"http://89.160.20.156:59976/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:31:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16871,13 +18299,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961191\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961191/\",\"url\":\"http://89.160.20.156:48291/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16918,13 +18350,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961190\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961190/\",\"url\":\"http://89.160.20.156:45797/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:21:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -16967,13 +18403,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961186\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961186/\",\"url\":\"http://89.160.20.156:43741/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17015,13 +18455,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961187\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961187/\",\"url\":\"http://89.160.20.156:35446/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17063,13 +18507,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961188\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961188/\",\"url\":\"http://89.160.20.156:35720/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17111,13 +18559,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961189\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961189/\",\"url\":\"http://89.160.20.156:50501/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:21:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17159,13 +18611,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961185\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961185/\",\"url\":\"http://89.160.20.156:55796/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17207,13 +18663,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961183\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961183/\",\"url\":\"http://89.160.20.156:52308/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17255,13 +18715,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961184\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961184/\",\"url\":\"http://89.160.20.156:59154/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17303,13 +18767,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961177\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961177/\",\"url\":\"http://89.160.20.156:57950/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17351,13 +18819,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961178\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961178/\",\"url\":\"http://89.160.20.156:33520/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17399,13 +18871,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961179\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961179/\",\"url\":\"http://89.160.20.156:45525/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17447,13 +18923,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961180\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961180/\",\"url\":\"http://89.160.20.156:38430/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17495,13 +18975,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961181\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961181/\",\"url\":\"http://89.160.20.156:4096/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17543,13 +19027,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961182\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961182/\",\"url\":\"http://89.160.20.156:50631/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17591,13 +19079,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961176\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961176/\",\"url\":\"http://89.160.20.156:37989/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17639,13 +19131,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961175\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961175/\",\"url\":\"http://89.160.20.156:54078/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:20:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17688,13 +19184,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961173\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961173/\",\"url\":\"http://89.160.20.156:34201/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17735,13 +19235,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961174\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961174/\",\"url\":\"http://89.160.20.156:56573/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17784,13 +19288,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961172\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961172/\",\"url\":\"http://89.160.20.156:48291/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:08:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17832,13 +19340,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961170\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961170/\",\"url\":\"http://89.160.20.156:60102/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17880,13 +19392,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961171\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961171/\",\"url\":\"http://89.160.20.156:52225/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17928,13 +19444,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961167\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961167/\",\"url\":\"http://89.160.20.156:56733/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -17976,13 +19496,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961168\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961168/\",\"url\":\"http://89.160.20.156:57042/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18024,13 +19548,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961169\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961169/\",\"url\":\"http://89.160.20.156:38035/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18072,13 +19600,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961165\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961165/\",\"url\":\"http://89.160.20.156:33540/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18120,13 +19652,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961166\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961166/\",\"url\":\"http://89.160.20.156:51947/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18168,13 +19704,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961164\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961164/\",\"url\":\"http://89.160.20.156:36915/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18216,13 +19756,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961163\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961163/\",\"url\":\"http://89.160.20.156:38865/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:05:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18263,13 +19807,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961162\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961162/\",\"url\":\"http://89.160.20.156:55480/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:37 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18310,13 +19858,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961161\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961161/\",\"url\":\"http://89.160.20.156:51996/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:36 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18357,13 +19909,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961160\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961160/\",\"url\":\"http://89.160.20.156:36042/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:34 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18404,13 +19960,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961158\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961158/\",\"url\":\"http://89.160.20.156:34350/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18451,13 +20011,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961159\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961159/\",\"url\":\"http://89.160.20.156:53587/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:33 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18498,13 +20062,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961157\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961157/\",\"url\":\"http://89.160.20.156:53444/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18546,13 +20114,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961155\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961155/\",\"url\":\"http://89.160.20.156:58653/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18593,13 +20165,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961156\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961156/\",\"url\":\"http://89.160.20.156:50579/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18640,13 +20216,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961152\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961152/\",\"url\":\"http://89.160.20.156:3553/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18688,13 +20268,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961153\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961153/\",\"url\":\"http://89.160.20.156:35288/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18735,13 +20319,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961154\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961154/\",\"url\":\"http://89.160.20.156:46429/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18782,13 +20370,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961151\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961151/\",\"url\":\"http://89.160.20.156:44575/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18830,13 +20422,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961149\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961149/\",\"url\":\"http://89.160.20.156:43245/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18877,13 +20473,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961150\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961150/\",\"url\":\"http://89.160.20.156:50444/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18924,13 +20524,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961144\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961144/\",\"url\":\"http://89.160.20.156:51318/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"true\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -18972,13 +20576,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961145\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961145/\",\"url\":\"http://89.160.20.156:46221/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19020,13 +20628,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961146\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961146/\",\"url\":\"http://89.160.20.156:51430/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19068,13 +20680,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961147\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961147/\",\"url\":\"http://89.160.20.156:52028/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19116,13 +20732,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961148\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961148/\",\"url\":\"http://89.160.20.156:48291/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19163,13 +20783,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961143\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961143/\",\"url\":\"http://89.160.20.156:39613/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 18:04:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"Gandylyan1\",\"larted\":\"false\",\"tags\":[\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19212,13 +20836,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961142\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961142/\",\"url\":\"http://89.160.20.156:34201/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:56:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19260,13 +20888,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961141\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961141/\",\"url\":\"http://89.160.20.156:47095/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19308,13 +20940,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961136\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961136/\",\"url\":\"http://89.160.20.156:42004/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19356,13 +20992,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961137\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961137/\",\"url\":\"http://89.160.20.156:52058/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19404,13 +21044,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961138\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961138/\",\"url\":\"http://89.160.20.156:45432/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19452,13 +21096,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961139\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961139/\",\"url\":\"http://89.160.20.156:49891/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19500,13 +21148,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961140\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961140/\",\"url\":\"http://89.160.20.156:34334/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:53:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19548,13 +21200,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961135\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961135/\",\"url\":\"http://89.160.20.156:42886/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19596,13 +21252,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961134\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961134/\",\"url\":\"http://89.160.20.156:47096/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19644,13 +21304,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961132\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961132/\",\"url\":\"http://89.160.20.156:48214/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19692,13 +21356,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961133\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961133/\",\"url\":\"http://89.160.20.156:40478/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19740,13 +21408,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961130\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961130/\",\"url\":\"http://89.160.20.156:37771/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19788,13 +21460,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961131\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961131/\",\"url\":\"http://89.160.20.156:35513/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19836,13 +21512,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961129\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961129/\",\"url\":\"http://89.160.20.156:53382/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:51:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19884,13 +21564,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961128\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961128/\",\"url\":\"http://89.160.20.156:50336/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:17 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19932,13 +21616,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961124\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961124/\",\"url\":\"http://89.160.20.156:34233/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -19980,13 +21668,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961125\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961125/\",\"url\":\"http://89.160.20.156:38392/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20028,13 +21720,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961126\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961126/\",\"url\":\"http://89.160.20.156:52654/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20076,13 +21772,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961127\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961127/\",\"url\":\"http://89.160.20.156:60203/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20124,13 +21824,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961123\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961123/\",\"url\":\"http://89.160.20.156:48091/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20172,13 +21876,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961122\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961122/\",\"url\":\"http://89.160.20.156:40783/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:49:41 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20220,13 +21928,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961121\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961121/\",\"url\":\"http://89.160.20.156:52015/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:49:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20268,13 +21980,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961118\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961118/\",\"url\":\"http://89.160.20.156:42987/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20316,13 +22032,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961119\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961119/\",\"url\":\"http://89.160.20.156:53388/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20364,13 +22084,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961120\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961120/\",\"url\":\"http://89.160.20.156:44124/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20412,13 +22136,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961115\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961115/\",\"url\":\"http://89.160.20.156:33802/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20460,13 +22188,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961116\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961116/\",\"url\":\"http://89.160.20.156:43806/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20508,13 +22240,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961117\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961117/\",\"url\":\"http://89.160.20.156:52278/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20556,13 +22292,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961114\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961114/\",\"url\":\"http://89.160.20.156:41202/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20604,13 +22344,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961113\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961113/\",\"url\":\"http://89.160.20.156:35756/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:36:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20652,13 +22396,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961112\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961112/\",\"url\":\"http://89.160.20.156:40569/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20700,13 +22448,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961111\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961111/\",\"url\":\"http://89.160.20.156:47645/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:36:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20748,13 +22500,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961110\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961110/\",\"url\":\"http://89.160.20.156:40023/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20796,13 +22552,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961109\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961109/\",\"url\":\"http://89.160.20.156:53402/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:34:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20845,13 +22605,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961108\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961108/\",\"url\":\"http://89.160.20.156:36316/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:29:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20894,13 +22658,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961107\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961107/\",\"url\":\"http://89.160.20.156:48105/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:28:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20942,13 +22710,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961103\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961103/\",\"url\":\"http://89.160.20.156:40017/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -20990,13 +22762,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961104\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961104/\",\"url\":\"http://89.160.20.156:41906/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21038,13 +22814,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961105\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961105/\",\"url\":\"http://89.160.20.156:38607/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21086,13 +22866,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961106\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961106/\",\"url\":\"http://89.160.20.156:59331/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21134,13 +22918,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961102\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961102/\",\"url\":\"http://89.160.20.156:53932/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:24 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21182,13 +22970,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961101\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961101/\",\"url\":\"http://89.160.20.156:58385/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21230,13 +23022,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961099\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961099/\",\"url\":\"http://89.160.20.156:57010/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21278,13 +23074,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961100\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961100/\",\"url\":\"http://89.160.20.156:59715/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21326,13 +23126,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961094\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961094/\",\"url\":\"http://89.160.20.156:57052/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21374,13 +23178,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961095\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961095/\",\"url\":\"http://89.160.20.156:60550/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21422,13 +23230,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961096\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961096/\",\"url\":\"http://89.160.20.156:39684/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21470,13 +23282,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961097\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961097/\",\"url\":\"http://89.160.20.156:43593/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21518,13 +23334,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961098\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961098/\",\"url\":\"http://89.160.20.156:36066/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:20:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21566,13 +23386,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961093\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961093/\",\"url\":\"http://89.160.20.156:35006/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21614,13 +23438,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961091\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961091/\",\"url\":\"http://89.160.20.156:38184/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21662,13 +23490,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961092\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961092/\",\"url\":\"http://89.160.20.156:59027/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21710,13 +23542,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961090\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961090/\",\"url\":\"http://89.160.20.156:50639/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21758,13 +23594,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961086\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961086/\",\"url\":\"http://89.160.20.156:33534/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21806,13 +23646,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961087\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961087/\",\"url\":\"http://89.160.20.156:36316/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21854,13 +23698,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961088\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961088/\",\"url\":\"http://89.160.20.156:47120/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21902,13 +23750,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961089\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961089/\",\"url\":\"http://89.160.20.156:46287/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:19:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21951,13 +23803,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961085\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961085/\",\"url\":\"http://89.160.20.156:39536/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:14:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -21999,13 +23855,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961083\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961083/\",\"url\":\"http://89.160.20.156:40689/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22047,13 +23907,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961084\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961084/\",\"url\":\"http://89.160.20.156:51123/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22095,13 +23959,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961082\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961082/\",\"url\":\"http://89.160.20.156:52540/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22143,13 +24011,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961081\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961081/\",\"url\":\"http://89.160.20.156:56964/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22191,13 +24063,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961078\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961078/\",\"url\":\"http://89.160.20.156:57120/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22239,13 +24115,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961079\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961079/\",\"url\":\"http://89.160.20.156:44518/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22287,13 +24167,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961080\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961080/\",\"url\":\"http://89.160.20.156:50389/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22335,13 +24219,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961077\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961077/\",\"url\":\"http://89.160.20.156:34335/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22383,13 +24271,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961069\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961069/\",\"url\":\"http://89.160.20.156:54865/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22431,13 +24323,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961070\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961070/\",\"url\":\"http://89.160.20.156:50773/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22479,13 +24375,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961071\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961071/\",\"url\":\"http://89.160.20.156:52005/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22527,13 +24427,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961072\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961072/\",\"url\":\"http://89.160.20.156:56066/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22575,13 +24479,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961073\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961073/\",\"url\":\"http://89.160.20.156:32915/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22623,13 +24531,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961074\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961074/\",\"url\":\"http://89.160.20.156:43462/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22671,13 +24583,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961075\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961075/\",\"url\":\"http://89.160.20.156:33291/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22719,13 +24635,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961076\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961076/\",\"url\":\"http://89.160.20.156:1440/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22767,13 +24687,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961068\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961068/\",\"url\":\"http://89.160.20.156:55907/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22815,13 +24739,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961066\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961066/\",\"url\":\"http://89.160.20.156:33181/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22863,13 +24791,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961067\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961067/\",\"url\":\"http://89.160.20.156:44691/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22911,13 +24843,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961059\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961059/\",\"url\":\"http://89.160.20.156:55254/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -22959,13 +24895,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961060\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961060/\",\"url\":\"http://89.160.20.156:43010/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23007,13 +24947,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961061\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961061/\",\"url\":\"http://89.160.20.156:37886/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23055,13 +24999,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961062\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961062/\",\"url\":\"http://89.160.20.156:40153/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23103,13 +25051,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961063\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961063/\",\"url\":\"http://89.160.20.156:34305/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23151,13 +25103,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961064\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961064/\",\"url\":\"http://89.160.20.156:35653/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23199,13 +25155,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961065\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961065/\",\"url\":\"http://89.160.20.156:48908/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23247,13 +25207,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961058\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961058/\",\"url\":\"http://89.160.20.156:40035/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:04:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23295,13 +25259,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961055\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961055/\",\"url\":\"http://89.160.20.156:54461/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23343,13 +25311,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961056\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961056/\",\"url\":\"http://89.160.20.156:51991/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23392,13 +25364,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961057\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961057/\",\"url\":\"http://89.160.20.156:41143/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23440,13 +25416,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961054\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961054/\",\"url\":\"http://89.160.20.156:51095/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 17:02:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23487,13 +25467,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961053\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961053/\",\"url\":\"http://89.160.20.156:36558/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23535,13 +25519,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961050\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961050/\",\"url\":\"http://89.160.20.156:47548/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23583,13 +25571,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961051\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961051/\",\"url\":\"http://89.160.20.156:35796/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23631,13 +25623,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961052\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961052/\",\"url\":\"http://89.160.20.156:42765/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23679,13 +25675,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961048\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961048/\",\"url\":\"http://89.160.20.156:37388/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:51:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23727,13 +25727,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961049\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961049/\",\"url\":\"http://89.160.20.156:56849/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:51:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23775,13 +25779,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961047\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961047/\",\"url\":\"http://89.160.20.156:35574/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23823,13 +25831,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961046\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961046/\",\"url\":\"http://89.160.20.156:46947/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23871,13 +25883,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961043\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961043/\",\"url\":\"http://89.160.20.156:34452/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23919,13 +25935,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961044\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961044/\",\"url\":\"http://89.160.20.156:33017/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -23967,13 +25987,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961045\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961045/\",\"url\":\"http://89.160.20.156:55061/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24015,13 +26039,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961040\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961040/\",\"url\":\"http://89.160.20.156:50046/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24063,13 +26091,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961041\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961041/\",\"url\":\"http://89.160.20.156:51960/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24111,13 +26143,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961042\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961042/\",\"url\":\"http://89.160.20.156:42372/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24159,13 +26195,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961039\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961039/\",\"url\":\"http://89.160.20.156:51592/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:49:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24207,13 +26247,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961038\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961038/\",\"url\":\"http://89.160.20.156:35585/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:49:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24255,13 +26299,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961035\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961035/\",\"url\":\"http://89.160.20.156:38398/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:49:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24303,13 +26351,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961036\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961036/\",\"url\":\"http://89.160.20.156:59880/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:49:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24351,13 +26403,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961037\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961037/\",\"url\":\"http://89.160.20.156:39138/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:49:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24400,13 +26456,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961033\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961033/\",\"url\":\"http://89.160.20.156:51095/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:40:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24449,13 +26509,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961034\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961034/\",\"url\":\"http://89.160.20.156:45117/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:40:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24496,13 +26560,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961032\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961032/\",\"url\":\"http://89.160.20.156:50204/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24544,13 +26612,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961029\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961029/\",\"url\":\"http://89.160.20.156:45079/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24592,13 +26664,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961030\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961030/\",\"url\":\"http://89.160.20.156:52238/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24640,13 +26716,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961031\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961031/\",\"url\":\"http://89.160.20.156:40312/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24688,13 +26768,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961026\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961026/\",\"url\":\"http://89.160.20.156:39002/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24736,13 +26820,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961027\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961027/\",\"url\":\"http://89.160.20.156:50773/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24784,13 +26872,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961028\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961028/\",\"url\":\"http://89.160.20.156:50050/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24832,13 +26924,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961024\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961024/\",\"url\":\"http://89.160.20.156:60081/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24880,13 +26976,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961025\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961025/\",\"url\":\"http://89.160.20.156:58177/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24928,13 +27028,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961023\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961023/\",\"url\":\"http://89.160.20.156:38589/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:36:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -24976,13 +27080,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961022\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961022/\",\"url\":\"http://89.160.20.156:39229/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:35:25 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25024,13 +27132,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961021\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961021/\",\"url\":\"http://89.160.20.156:53595/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25072,13 +27184,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961018\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961018/\",\"url\":\"http://89.160.20.156:57279/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25120,13 +27236,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961019\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961019/\",\"url\":\"http://89.160.20.156:49019/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25168,13 +27288,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961020\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961020/\",\"url\":\"http://89.160.20.156:48558/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25216,13 +27340,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961017\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961017/\",\"url\":\"http://89.160.20.156:58913/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:25 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25264,13 +27392,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961016\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961016/\",\"url\":\"http://89.160.20.156:49608/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25313,13 +27445,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961013\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961013/\",\"url\":\"http://89.160.20.156:41143/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25361,13 +27497,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961014\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961014/\",\"url\":\"http://89.160.20.156:42129/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25409,13 +27549,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961015\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961015/\",\"url\":\"http://89.160.20.156:47403/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25457,13 +27601,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961011\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961011/\",\"url\":\"http://89.160.20.156:60187/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25505,13 +27653,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961012\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961012/\",\"url\":\"http://89.160.20.156:46097/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:34:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25554,13 +27706,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961010\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961010/\",\"url\":\"http://89.160.20.156:50771/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:31:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25601,13 +27757,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961009\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961009/\",\"url\":\"https://pastebin.com/raw/00aUJCLx\",\"url_status\":\"offline\",\"host\":\"pastebin.com\",\"date_added\":\"2021-01-14 16:29:03 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"pmelson\",\"larted\":\"false\",\"tags\":[\"ASPXShell\",\"webshell\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25647,13 +27807,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961008\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961008/\",\"url\":\"http://89.160.20.156:45117/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:25:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25695,13 +27859,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961007\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961007/\",\"url\":\"http://89.160.20.156:41485/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:16 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25743,13 +27911,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961006\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961006/\",\"url\":\"http://89.160.20.156:43851/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:15 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25791,13 +27963,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961005\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961005/\",\"url\":\"http://89.160.20.156:37095/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25839,13 +28015,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961004\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961004/\",\"url\":\"http://89.160.20.156:59275/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25887,13 +28067,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961002\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961002/\",\"url\":\"http://89.160.20.156:46131/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25935,13 +28119,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961003\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961003/\",\"url\":\"http://89.160.20.156:40129/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -25983,13 +28171,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961000\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961000/\",\"url\":\"http://89.160.20.156:43924/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26032,13 +28224,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"961001\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/961001/\",\"url\":\"http://89.160.20.156:38851/i\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26079,13 +28275,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960996\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960996/\",\"url\":\"http://89.160.20.156:33008/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26127,13 +28327,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960997\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960997/\",\"url\":\"http://89.160.20.156:60201/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26175,13 +28379,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960998\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960998/\",\"url\":\"http://89.160.20.156:41479/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26223,13 +28431,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960999\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960999/\",\"url\":\"http://89.160.20.156:52003/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:21:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26271,13 +28483,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960995\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960995/\",\"url\":\"http://89.160.20.156:39500/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:16 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26319,13 +28535,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960994\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960994/\",\"url\":\"http://89.160.20.156:36966/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26367,13 +28587,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960991\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960991/\",\"url\":\"http://89.160.20.156:59875/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26415,13 +28639,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960992\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960992/\",\"url\":\"http://89.160.20.156:44123/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26463,13 +28691,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960993\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960993/\",\"url\":\"http://89.160.20.156:45224/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26511,13 +28743,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960990\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960990/\",\"url\":\"http://89.160.20.156:43105/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26559,13 +28795,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960984\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960984/\",\"url\":\"http://89.160.20.156:46011/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26607,13 +28847,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960985\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960985/\",\"url\":\"http://89.160.20.156:51170/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26655,13 +28899,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960986\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960986/\",\"url\":\"http://89.160.20.156:38025/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26703,13 +28951,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960987\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960987/\",\"url\":\"http://89.160.20.156:54132/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26751,13 +29003,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960988\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960988/\",\"url\":\"http://89.160.20.156:57705/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26799,13 +29055,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960989\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960989/\",\"url\":\"http://89.160.20.156:32983/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:20:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26847,13 +29107,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960983\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960983/\",\"url\":\"http://89.160.20.156:47908/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26895,13 +29159,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960982\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960982/\",\"url\":\"http://89.160.20.156:35116/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26943,13 +29211,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960978\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960978/\",\"url\":\"http://89.160.20.156:38070/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -26991,13 +29263,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960979\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960979/\",\"url\":\"http://89.160.20.156:53399/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27039,13 +29315,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960980\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960980/\",\"url\":\"http://89.160.20.156:39529/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27087,13 +29367,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960981\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960981/\",\"url\":\"http://89.160.20.156:33465/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:19:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27135,13 +29419,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960977\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960977/\",\"url\":\"http://89.160.20.156:59085/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:16:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"07ac0n\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27184,13 +29472,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960976\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960976/\",\"url\":\"http://89.160.20.156:33799/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:09:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27231,13 +29523,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960972\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960972/\",\"url\":\"http://89.160.20.156:40430/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27279,13 +29575,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960973\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960973/\",\"url\":\"http://89.160.20.156:43006/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27327,13 +29627,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960974\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960974/\",\"url\":\"http://89.160.20.156:33385/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27375,13 +29679,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960975\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960975/\",\"url\":\"http://89.160.20.156:56649/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27423,13 +29731,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960971\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960971/\",\"url\":\"http://89.160.20.156:55457/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27471,13 +29783,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960968\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960968/\",\"url\":\"http://89.160.20.156:52314/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27519,13 +29835,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960969\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960969/\",\"url\":\"http://89.160.20.156:41985/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27568,13 +29888,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960970\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960970/\",\"url\":\"http://89.160.20.156:53197/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:07:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27615,13 +29939,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960967\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960967/\",\"url\":\"http://89.160.20.156:54472/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27663,13 +29991,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960966\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960966/\",\"url\":\"http://89.160.20.156:38100/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27711,13 +30043,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960964\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960964/\",\"url\":\"http://89.160.20.156:33121/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27759,13 +30095,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960965\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960965/\",\"url\":\"http://89.160.20.156:39363/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27807,13 +30147,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960961\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960961/\",\"url\":\"http://89.160.20.156:42844/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27855,13 +30199,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960962\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960962/\",\"url\":\"http://89.160.20.156:45789/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27903,13 +30251,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960963\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960963/\",\"url\":\"http://89.160.20.156:34080/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:06:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27951,13 +30303,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960960\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960960/\",\"url\":\"http://89.160.20.156:56067/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:11 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -27999,13 +30355,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960959\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960959/\",\"url\":\"http://89.160.20.156:34205/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28047,13 +30407,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960957\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960957/\",\"url\":\"http://89.160.20.156:53239/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28095,13 +30459,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960958\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960958/\",\"url\":\"http://89.160.20.156:53868/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28143,13 +30511,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960955\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960955/\",\"url\":\"http://89.160.20.156:39724/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28191,13 +30563,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960956\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960956/\",\"url\":\"http://89.160.20.156:60804/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28239,13 +30615,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960953\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960953/\",\"url\":\"http://89.160.20.156:51949/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28287,13 +30667,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960954\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960954/\",\"url\":\"http://89.160.20.156:48224/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:05:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28335,13 +30719,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960952\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960952/\",\"url\":\"http://89.160.20.156:37716/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:10 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28383,13 +30771,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960951\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960951/\",\"url\":\"http://89.160.20.156:60524/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28432,13 +30824,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960946\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960946/\",\"url\":\"http://urlfrance.fr/code/dd.txt\",\"url_status\":\"offline\",\"host\":\"urlfrance.fr\",\"date_added\":\"2021-01-14 16:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"Encoded\",\"njRAT\",\"rat\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28479,13 +30875,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960947\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960947/\",\"url\":\"http://89.160.20.156:49988/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28527,13 +30927,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960948\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960948/\",\"url\":\"http://89.160.20.156:42857/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28576,13 +30980,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960949\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960949/\",\"url\":\"http://89.160.20.156:44751/bin.sh\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28624,13 +31032,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960950\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960950/\",\"url\":\"http://89.160.20.156:47719/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 16:04:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28672,13 +31084,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960945\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960945/\",\"url\":\"http://89.160.20.156:38133/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:59:12 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"07ac0n\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28720,13 +31136,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960944\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960944/\",\"url\":\"http://www.sowetoson.com/new/Host_yjwloaz52.bin\",\"url_status\":\"online\",\"host\":\"www.sowetoson.com\",\"date_added\":\"2021-01-14 15:57:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"encrypted\",\"GuLoader\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28766,13 +31186,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960942\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960942/\",\"url\":\"https://www.agamagroup.com.ng/zxc/janomo_uGdNtpvRY170.bin\",\"url_status\":\"online\",\"host\":\"www.agamagroup.com.ng\",\"date_added\":\"2021-01-14 15:57:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"abused_legit_malware\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"encrypted\",\"GuLoader\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28812,13 +31236,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960943\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960943/\",\"url\":\"https://onedrive.live.com/download?cid=8FE9EB3F9398B325\u0026resid=8FE9EB3F9398B325%21126\u0026authkey=AOzL9FiDhEYRkm8\",\"url_status\":\"online\",\"host\":\"onedrive.live.com\",\"date_added\":\"2021-01-14 15:57:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"encrypted\",\"GuLoader\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28858,13 +31286,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960941\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960941/\",\"url\":\"http://89.160.20.156:46462/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28906,13 +31338,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960940\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960940/\",\"url\":\"http://89.160.20.156:39046/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -28954,13 +31390,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960934\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960934/\",\"url\":\"http://89.160.20.156:47418/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29002,13 +31442,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960935\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960935/\",\"url\":\"http://89.160.20.156:42287/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29050,13 +31494,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960936\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960936/\",\"url\":\"http://89.160.20.156:49596/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29098,13 +31546,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960937\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960937/\",\"url\":\"http://89.160.20.156:39815/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29146,13 +31598,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960938\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960938/\",\"url\":\"http://89.160.20.156:36568/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29194,13 +31650,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960939\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960939/\",\"url\":\"http://89.160.20.156:32954/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:52:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29242,13 +31702,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960933\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960933/\",\"url\":\"http://89.160.20.156:57752/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:51:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29290,13 +31754,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960932\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960932/\",\"url\":\"http://89.160.20.156:52221/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:51:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29338,13 +31806,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960931\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960931/\",\"url\":\"http://89.160.20.156:58493/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:40 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29386,13 +31858,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960930\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960930/\",\"url\":\"http://89.160.20.156:57603/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:14 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29434,13 +31910,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960929\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960929/\",\"url\":\"http://89.160.20.156:45439/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:13 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29482,13 +31962,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960928\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960928/\",\"url\":\"http://89.160.20.156:58291/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:08 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29530,13 +32014,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960927\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960927/\",\"url\":\"http://89.160.20.156:52785/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29578,13 +32066,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960924\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960924/\",\"url\":\"http://89.160.20.156:38582/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29626,13 +32118,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960925\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960925/\",\"url\":\"http://89.160.20.156:39503/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29674,13 +32170,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960926\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960926/\",\"url\":\"http://89.160.20.156:53018/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29722,13 +32222,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960923\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960923/\",\"url\":\"http://89.160.20.156:40698/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:50:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29770,13 +32274,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960922\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960922/\",\"url\":\"http://89.160.20.156:50060/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:49:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29818,13 +32326,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960921\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960921/\",\"url\":\"http://89.160.20.156:47874/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:49:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29867,13 +32379,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960919\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960919/\",\"url\":\"http://perezluzwsdycafeyzmn.dns.navy/perdoc/regasm.exe\",\"url_status\":\"online\",\"host\":\"perezluzwsdycafeyzmn.dns.navy\",\"date_added\":\"2021-01-14 15:46:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"exe\",\"Loki\",\"opendir\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29914,13 +32430,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960920\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960920/\",\"url\":\"http://89.160.20.156:33799/bin.sh\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:46:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"arm\",\"elf\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -29962,13 +32482,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960918\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960918/\",\"url\":\"http://kalamikwsdyonlinedws.dns.navy/kaladoc/vbc.exe\",\"url_status\":\"online\",\"host\":\"kalamikwsdyonlinedws.dns.navy\",\"date_added\":\"2021-01-14 15:45:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"AgentTesla\",\"exe\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30008,13 +32532,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960917\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960917/\",\"url\":\"http://89.160.20.156/js/js/lokkk.jpg\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:45:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"abuse_ch\",\"larted\":\"true\",\"tags\":[\"exe\",\"Loki\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30055,13 +32583,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960916\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960916/\",\"url\":\"http://89.160.20.156:33201/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30103,13 +32635,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960914\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960914/\",\"url\":\"http://89.160.20.156:53926/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30151,13 +32687,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960915\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960915/\",\"url\":\"http://89.160.20.156:43917/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30199,13 +32739,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960911\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960911/\",\"url\":\"http://89.160.20.156:42053/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30247,13 +32791,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960912\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960912/\",\"url\":\"http://89.160.20.156:57875/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30295,13 +32843,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960913\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960913/\",\"url\":\"http://89.160.20.156:35523/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30344,13 +32896,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960910\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960910/\",\"url\":\"http://89.160.20.156:47418/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:38:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30391,13 +32947,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960908\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960908/\",\"url\":\"http://89.160.20.156:53007/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30439,13 +32999,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960909\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960909/\",\"url\":\"http://89.160.20.156:38089/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30487,13 +33051,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960904\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960904/\",\"url\":\"http://89.160.20.156:35243/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30535,13 +33103,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960905\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960905/\",\"url\":\"http://89.160.20.156:50589/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30583,13 +33155,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960906\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960906/\",\"url\":\"http://89.160.20.156:42479/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30631,13 +33207,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960907\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960907/\",\"url\":\"http://89.160.20.156:43425/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:37:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30679,13 +33259,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960903\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960903/\",\"url\":\"http://89.160.20.156:35013/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:36:28 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30727,13 +33311,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960902\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960902/\",\"url\":\"http://89.160.20.156:35298/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:11 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30775,13 +33363,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960900\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960900/\",\"url\":\"http://89.160.20.156:54174/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30823,13 +33415,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960901\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960901/\",\"url\":\"http://89.160.20.156:42768/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:09 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30871,13 +33467,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960898\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960898/\",\"url\":\"http://89.160.20.156:59110/Mozi.a\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30919,13 +33519,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960899\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960899/\",\"url\":\"http://89.160.20.156:51476/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -30967,13 +33571,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960897\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960897/\",\"url\":\"http://89.160.20.156:58839/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31015,13 +33623,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960894\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960894/\",\"url\":\"http://89.160.20.156:50249/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31063,13 +33675,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960895\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960895/\",\"url\":\"http://89.160.20.156:46173/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31111,13 +33727,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960896\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960896/\",\"url\":\"http://89.160.20.156:43785/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:35:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31159,13 +33779,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960893\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960893/\",\"url\":\"http://89.160.20.156:46924/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:34:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31207,13 +33831,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960892\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960892/\",\"url\":\"http://89.160.20.156:59734/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:34:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31255,13 +33883,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960889\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960889/\",\"url\":\"http://89.160.20.156:51620/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31303,13 +33935,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960890\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960890/\",\"url\":\"http://89.160.20.156:42585/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31351,13 +33987,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960891\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960891/\",\"url\":\"http://89.160.20.156:57941/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:34:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31400,13 +34040,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960888\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960888/\",\"url\":\"http://89.160.20.156:38308/i\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:32:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"geenensp\",\"larted\":\"true\",\"tags\":[\"32-bit\",\"elf\",\"mips\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31447,13 +34091,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960887\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960887/\",\"url\":\"http://89.160.20.156:55281/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:44 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31495,13 +34143,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960886\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960886/\",\"url\":\"http://89.160.20.156:57662/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:07 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31543,13 +34195,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960885\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960885/\",\"url\":\"http://89.160.20.156:40738/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:06 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31591,13 +34247,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960884\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960884/\",\"url\":\"http://89.160.20.156:59018/Mozi.m\",\"url_status\":\"offline\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:05 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31639,13 +34299,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960880\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960880/\",\"url\":\"http://89.160.20.156:60279/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31687,13 +34351,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960881\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960881/\",\"url\":\"http://89.160.20.156:52738/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31735,13 +34403,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960882\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960882/\",\"url\":\"http://89.160.20.156:37394/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31783,13 +34455,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960883\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960883/\",\"url\":\"http://89.160.20.156:56491/Mozi.m\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:22:04 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -31831,13 +34507,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"960879\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/960879/\",\"url\":\"http://89.160.20.156:46067/Mozi.a\",\"url_status\":\"online\",\"host\":\"89.160.20.156\",\"date_added\":\"2021-01-14 15:20:19 UTC\",\"threat\":\"malware_download\",\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"reporter\":\"lrz_urlhaus\",\"larted\":\"true\",\"tags\":[\"elf\",\"Mozi\"]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" diff --git a/packages/ti_abusech/data_stream/url/elasticsearch/ingest_pipeline/default.yml b/packages/ti_abusech/data_stream/url/elasticsearch/ingest_pipeline/default.yml index b341adc8308..a6fad1ecf48 100644 --- a/packages/ti_abusech/data_stream/url/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_abusech/data_stream/url/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -117,6 +117,23 @@ processors: - abusech.url.host - message ignore_missing: true + - script: + description: Remove null/empty values recursively. + lang: painless + source: |- + boolean drop(Object o) { + if (o == null || o == '') { + return true; + } else if (o instanceof Map) { + ((Map) o).values().removeIf(v -> drop(v)); + return (((Map) o).size() == 0); + } else if (o instanceof List) { + ((List) o).removeIf(v -> drop(v)); + return (((List) o).length == 0); + } + return false; + } + drop(ctx); on_failure: - set: field: event.kind diff --git a/packages/ti_abusech/data_stream/url/manifest.yml b/packages/ti_abusech/data_stream/url/manifest.yml index 689bbf2a44f..75154501f2b 100644 --- a/packages/ti_abusech/data_stream/url/manifest.yml +++ b/packages/ti_abusech/data_stream/url/manifest.yml @@ -13,6 +13,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false diff --git a/packages/ti_abusech/data_stream/url/sample_event.json b/packages/ti_abusech/data_stream/url/sample_event.json index 3773a0e3cb5..232f71b7b42 100644 --- a/packages/ti_abusech/data_stream/url/sample_event.json +++ b/packages/ti_abusech/data_stream/url/sample_event.json @@ -1,5 +1,5 @@ { - "@timestamp": "2022-08-06T00:12:22.693Z", + "@timestamp": "2023-08-08T18:17:29.562Z", "abusech": { "url": { "blacklists": { @@ -13,11 +13,11 @@ } }, "agent": { - "ephemeral_id": "2945b255-2667-4bac-8930-70eb987c8fef", - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "ephemeral_id": "d6e60fca-c7da-4d62-852d-bece09c6efc6", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.0" + "version": "8.9.0" }, "data_stream": { "dataset": "ti_abusech.url", @@ -25,22 +25,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "87d4d8f8-b034-42ba-a5bb-33ff670e619e", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.0" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-06T00:12:22.693Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:17:29.562Z", "dataset": "ti_abusech.url", - "ingested": "2022-08-06T00:12:26Z", + "ingested": "2023-08-08T18:17:32Z", "kind": "enrichment", "original": "{\"blacklists\":{\"spamhaus_dbl\":\"not listed\",\"surbl\":\"not listed\"},\"date_added\":\"2021-10-05 13:57:05 UTC\",\"host\":\"120.85.169.98\",\"id\":\"1656008\",\"larted\":\"true\",\"reporter\":\"tammeto\",\"tags\":null,\"threat\":\"malware_download\",\"url\":\"http://120.85.169.98:55871/mozi.m\",\"url_status\":\"online\",\"urlhaus_reference\":\"https://urlhaus.abuse.ch/url/1656008/\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_abusech/docs/README.md b/packages/ti_abusech/docs/README.md index 727746e2cd4..09b844b33de 100644 --- a/packages/ti_abusech/docs/README.md +++ b/packages/ti_abusech/docs/README.md @@ -45,10 +45,10 @@ The AbuseCH URL data_stream retrieves threat intelligence indicators from the UR | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -124,10 +124,10 @@ The AbuseCH malware data_stream retrieves threat intelligence indicators from th | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -212,10 +212,10 @@ The AbuseCH malwarebazaar data_stream retrieves threat intelligence indicators f | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -303,10 +303,10 @@ The AbuseCH threatfox data_stream retrieves threat intelligence indicators from | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/ti_abusech/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json b/packages/ti_abusech/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json index 13a46f79517..a5ca564d0bf 100644 --- a/packages/ti_abusech/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json +++ b/packages/ti_abusech/kibana/dashboard/ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about URL type indicators from the AbuseCH integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -76,6 +75,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -116,7 +117,7 @@ "panelIndex": "4c3ed6e1-8b4e-4eab-8d84-70ed4f506216", "title": "Files Navigation Textbox [Logs AbuseCH]", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -135,7 +136,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "88a112e1-6da1-49d3-9177-19f98280c200": { "columnOrder": [ @@ -165,12 +166,15 @@ "visualization": { "accessor": "604f1693-15a6-437d-af69-03588db8e471", "layerId": "88a112e1-6da1-49d3-9177-19f98280c200", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -185,7 +189,7 @@ "panelIndex": "c7c6e8dc-b649-434c-9650-8a1564d4d676", "title": "Unique Ports [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -204,7 +208,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a6fa56f8-32fa-405d-8771-dade4fe75d62": { "columnOrder": [ @@ -234,12 +238,15 @@ "visualization": { "accessor": "848c463b-bbc1-4b6a-af3e-76d844eb3cc5", "layerId": "a6fa56f8-32fa-405d-8771-dade4fe75d62", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -254,7 +261,7 @@ "panelIndex": "73a752f9-bde5-4396-8ede-e9e77a37182d", "title": "Unique File Extensions [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -273,7 +280,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c94400ee-a135-4a99-9693-5879d29f7aad": { "columnOrder": [ @@ -303,12 +310,15 @@ "visualization": { "accessor": "2934249f-fce5-4637-87ff-d2596d1b6ec5", "layerId": "c94400ee-a135-4a99-9693-5879d29f7aad", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -323,7 +333,7 @@ "panelIndex": "02f1732b-a981-4fba-8b27-b944f2f3c98c", "title": "Unique Domains [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -342,7 +352,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "72aa700a-49b6-4a2f-b380-24ebe7124ec1": { "columnOrder": [ @@ -360,7 +370,7 @@ "label": "Indicators on Spamhaus DBL", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -376,12 +386,15 @@ "visualization": { "accessor": "0389e125-4ae6-412a-a4af-2fa28f18c412", "layerId": "72aa700a-49b6-4a2f-b380-24ebe7124ec1", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -396,7 +409,7 @@ "panelIndex": "8272f9f8-d835-4e4c-9e63-7cdbfb14d190", "title": "Spamhaus Count [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -415,7 +428,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4fe4b45f-8f52-4794-a386-8e3f6352aa25": { "columnOrder": [ @@ -433,7 +446,7 @@ "label": "Indicators on SURBL", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -449,12 +462,15 @@ "visualization": { "accessor": "e7b09852-9ec8-4a42-a3c7-faf909c1997a", "layerId": "4fe4b45f-8f52-4794-a386-8e3f6352aa25", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -469,7 +485,7 @@ "panelIndex": "7c8e2070-5b71-4eb5-ae52-e95ef5a17ba6", "title": "Surbl Counter [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -488,7 +504,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8f36a8c1-19df-4eba-8fa5-4f259d349375": { "columnOrder": [ @@ -506,7 +522,7 @@ "label": "URL's Online", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -522,12 +538,15 @@ "visualization": { "accessor": "efd6bc64-ffcd-42fe-8218-0795986addc4", "layerId": "8f36a8c1-19df-4eba-8fa5-4f259d349375", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -542,7 +561,7 @@ "panelIndex": "a96389e6-d361-457e-afc1-0dbdb35ee7e0", "title": "URLs Online [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -561,7 +580,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "471ad94f-c181-4ffb-a640-1666974adb33": { "columnOrder": [ @@ -579,7 +598,7 @@ "label": "URL's Offline", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -595,12 +614,15 @@ "visualization": { "accessor": "8cd8034f-16bf-4a7a-b816-950498dc1f90", "layerId": "471ad94f-c181-4ffb-a640-1666974adb33", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -615,7 +637,7 @@ "panelIndex": "b2904153-3afd-41a7-8f5f-01b76b8346ec", "title": "URLs Offline [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -634,7 +656,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0f63318a-a857-4d83-89ce-a94e2242b79e": { "columnOrder": [ @@ -648,7 +670,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "df0791a6-247c-4434-a43a-fdea7577ca34": { "dataType": "string", @@ -683,15 +705,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "df0791a6-247c-4434-a43a-fdea7577ca34" - ], "layerId": "0f63318a-a857-4d83-89ce-a94e2242b79e", "layerType": "data", "legendDisplay": "show", - "metric": "77a48096-02aa-4b7a-8a7b-131fc38988bd", + "legendSize": "auto", + "metrics": [ + "77a48096-02aa-4b7a-8a7b-131fc38988bd" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "df0791a6-247c-4434-a43a-fdea7577ca34" + ] } ], "shape": "donut" @@ -714,7 +739,7 @@ "panelIndex": "ab7ab31c-e76f-4613-b17d-fdd909f17e0d", "title": "Percentage of URL Schema used [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -733,7 +758,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9fa49c4c-5544-472d-afce-e51d6a5687fe": { "columnOrder": [ @@ -765,7 +790,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -782,16 +807,19 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "15e2b5ad-2040-4253-89a6-60f085c66f86", - "15e2b5ad-2040-4253-89a6-60f085c66f86" - ], "layerId": "9fa49c4c-5544-472d-afce-e51d6a5687fe", "layerType": "data", "legendDisplay": "default", - "metric": "b9a631fe-5f49-4db2-a076-bcbf5410aec9", + "legendSize": "auto", + "metrics": [ + "b9a631fe-5f49-4db2-a076-bcbf5410aec9" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "15e2b5ad-2040-4253-89a6-60f085c66f86", + "15e2b5ad-2040-4253-89a6-60f085c66f86" + ] } ], "shape": "treemap" @@ -814,7 +842,7 @@ "panelIndex": "fda93ed1-72f0-4489-80b7-9e69d14f30aa", "title": "Most Popular File Extensions [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -833,7 +861,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "db89074c-e1fe-4091-bdb1-e42a36e82bac": { "columnOrder": [ @@ -848,7 +876,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b284ea2a-a2cd-4d08-bf44-fc73c08b5694": { "customLabel": true, @@ -892,7 +920,9 @@ } ], "layerId": "db89074c-e1fe-4091-bdb1-e42a36e82bac", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -912,17 +942,18 @@ "panelIndex": "8994501a-1550-4cf2-857f-d6b6491ffb62", "title": "Most Popular Domains [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs AbuseCH] URLs", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:34:57.156Z", "id": "ti_abusech-2457fb50-3bc3-11ec-ae8c-7d00429ad420", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1037,7 +1068,7 @@ }, { "id": "ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", - "name": "tag-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", + "name": "tag-ref-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", "type": "tag" } ], diff --git a/packages/ti_abusech/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json b/packages/ti_abusech/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json index 1e9d53052e7..ff2e5306395 100644 --- a/packages/ti_abusech/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json +++ b/packages/ti_abusech/kibana/dashboard/ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about file type indicators from the AbuseCH integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -97,6 +96,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -135,7 +136,7 @@ }, "panelIndex": "09ba3dc0-e2e2-4799-b47f-bb919bf290a1", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -158,7 +159,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "98786f76-dac4-4fc7-9cad-8bfce17bd00d": { "columnOrder": [ @@ -188,11 +189,14 @@ "visualization": { "accessor": "8622e147-406f-4711-8f68-e2425614106e", "layerId": "98786f76-dac4-4fc7-9cad-8bfce17bd00d", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique File Types [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -207,7 +211,7 @@ "panelIndex": "31ea16d1-7591-42a7-b773-6fca00e5db14", "title": "Unique File Types [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -230,7 +234,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b83c382d-fab9-4e60-a632-475e221cc20c": { "columnOrder": [ @@ -260,11 +264,14 @@ "visualization": { "accessor": "eda3c6d9-dacb-4e5e-b977-50104f76e91a", "layerId": "b83c382d-fab9-4e60-a632-475e221cc20c", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique MD5 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -279,7 +286,7 @@ "panelIndex": "4d3e11dc-c4cc-4373-bb83-3d39fe6ffa98", "title": "Unique MD5 [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -302,7 +309,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "85ad73b3-3b76-49f1-ad20-6256b58918f8": { "columnOrder": [ @@ -332,11 +339,14 @@ "visualization": { "accessor": "289bd005-bdd2-4f3b-83b9-ad6ae52a9ed3", "layerId": "85ad73b3-3b76-49f1-ad20-6256b58918f8", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique SHA1 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -351,7 +361,7 @@ "panelIndex": "e9b6f0ad-5e6b-44da-923e-dc0d5ccfdfea", "title": "Unique SHA1 [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -374,7 +384,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "49b7070a-f1d3-46e1-a980-2f6d6d130167": { "columnOrder": [ @@ -404,11 +414,14 @@ "visualization": { "accessor": "b6c5e221-88ff-490e-bd3e-188b3e0dd1f4", "layerId": "49b7070a-f1d3-46e1-a980-2f6d6d130167", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique SHA256 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -423,7 +436,7 @@ "panelIndex": "93e32abe-87e3-469e-b7e9-a7ef7dfa2cce", "title": "Unique SHA256 [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -446,7 +459,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "12768311-834b-48d5-8aad-d17d139c2ae5": { "columnOrder": [ @@ -476,11 +489,14 @@ "visualization": { "accessor": "0255894e-dd88-4eb1-b21b-0cccecb2cd1b", "layerId": "12768311-834b-48d5-8aad-d17d139c2ae5", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique TLSH [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -495,7 +511,7 @@ "panelIndex": "b77edd3f-b171-4e61-b519-169b5aade031", "title": "Unique TLSH [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -518,7 +534,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9070dc46-c06d-4b64-a2c5-7b6d4056a14d": { "columnOrder": [ @@ -548,11 +564,14 @@ "visualization": { "accessor": "f1bdf831-1fd2-4dc8-b1f9-c6e05d93b801", "layerId": "9070dc46-c06d-4b64-a2c5-7b6d4056a14d", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique Imphash [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -567,7 +586,7 @@ "panelIndex": "f9eb44f8-6174-4b12-a8ca-5c542687006b", "title": "Unique Imphash [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -590,7 +609,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e27d5a76-ae51-44fa-b17e-e486bbc01b56": { "columnOrder": [ @@ -620,11 +639,14 @@ "visualization": { "accessor": "b5cdfd94-1e22-4673-8216-59aca2131761", "layerId": "e27d5a76-ae51-44fa-b17e-e486bbc01b56", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique SSDEEP [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -639,7 +661,7 @@ "panelIndex": "c9d59178-9b19-4255-8098-653cb30f3d09", "title": "Unique SSDEEP [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -662,7 +684,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "118b51de-bd55-4ed6-b916-c939ad73b2c3": { "columnOrder": [ @@ -696,7 +718,7 @@ "label": "Countries", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -713,15 +735,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1ada77b6-5741-44ff-a00d-4653fca22f84" - ], "layerId": "118b51de-bd55-4ed6-b916-c939ad73b2c3", "layerType": "data", "legendDisplay": "show", - "metric": "dcc2a7b9-e44b-4681-ba02-bdea442ca9a5", + "legendSize": "auto", + "metrics": [ + "dcc2a7b9-e44b-4681-ba02-bdea442ca9a5" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1ada77b6-5741-44ff-a00d-4653fca22f84" + ] } ], "shape": "pie" @@ -743,7 +768,7 @@ "panelIndex": "6189e979-9121-4247-9942-fa7a3cc3839c", "title": "Top Countries [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -766,7 +791,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "222b3ad0-2e5d-46a0-ae3d-f6a0b15ac2c8": { "columnOrder": [ @@ -798,7 +823,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -815,15 +840,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "06b603cb-c9fb-493a-9ca4-e6502ca12054" - ], "layerId": "222b3ad0-2e5d-46a0-ae3d-f6a0b15ac2c8", "layerType": "data", "legendDisplay": "default", - "metric": "de0e531b-dda7-461f-9783-3ab9267d202e", + "legendSize": "auto", + "metrics": [ + "de0e531b-dda7-461f-9783-3ab9267d202e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "06b603cb-c9fb-493a-9ca4-e6502ca12054" + ] } ], "shape": "treemap" @@ -845,77 +873,143 @@ "panelIndex": "5f1d0cf1-c331-4495-99d5-5e80d023c482", "title": "File Types [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": { - "customLabel": "Based on count" - }, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-57bbc243-2446-489f-8e6d-0ce51e157004", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "57bbc243-2446-489f-8e6d-0ce51e157004": { + "columnOrder": [ + "098d4581-8d35-4db1-9902-f74022d3b75d", + "443ed6a7-aff3-4f30-ad3e-e992809a4a40" + ], + "columns": { + "098d4581-8d35-4db1-9902-f74022d3b75d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Most seen indicator tags", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "443ed6a7-aff3-4f30-ad3e-e992809a4a40", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "abusech.malwarebazaar.tags" + }, + "443ed6a7-aff3-4f30-ad3e-e992809a4a40": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "customLabel": "Most seen indicator tags", - "field": "abusech.malwarebazaar.tags", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + "textBased": { + "layers": {} } - } - }, - "description": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" }, - "scale": "linear", - "showLabel": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "443ed6a7-aff3-4f30-ad3e-e992809a4a40" + ], + "layerId": "57bbc243-2446-489f-8e6d-0ce51e157004", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "098d4581-8d35-4db1-9902-f74022d3b75d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "title": "Most seen indicator tags [Logs AbuseCH]", - "type": "tagcloud", - "uiState": {} - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, - "i": "d1788a2e-c400-4d7b-9251-a8e5a806b6ef", + "i": "1f92363c-a693-4950-81cd-d8da6f5832ea", "w": 20, "x": 7, "y": 27 }, - "panelIndex": "d1788a2e-c400-4d7b-9251-a8e5a806b6ef", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "panelIndex": "1f92363c-a693-4950-81cd-d8da6f5832ea", + "title": "Most seen indicator tags [Logs AbuseCH]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -938,7 +1032,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "06d9ac79-2055-437e-892c-de9ee07fe674": { "columnOrder": [ @@ -972,7 +1066,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -997,7 +1091,9 @@ } ], "layerId": "06d9ac79-2055-437e-892c-de9ee07fe674", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "Most popular file names [Logs AbuseCH]", @@ -1016,17 +1112,18 @@ "panelIndex": "b733385b-14f8-4469-b777-86d0139cc56b", "title": "Most popular file names [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs AbuseCH] Files", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:38:30.112Z", "id": "ti_abusech-6a90c980-3b32-11ec-ae50-2fdf1e96c6a6", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1136,7 +1233,7 @@ }, { "id": "logs-*", - "name": "d1788a2e-c400-4d7b-9251-a8e5a806b6ef:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "1f92363c-a693-4950-81cd-d8da6f5832ea:indexpattern-datasource-layer-57bbc243-2446-489f-8e6d-0ce51e157004", "type": "index-pattern" }, { @@ -1151,7 +1248,7 @@ }, { "id": "ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", - "name": "tag-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", + "name": "tag-ref-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", "type": "tag" } ], diff --git a/packages/ti_abusech/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json b/packages/ti_abusech/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json index d9d3e0e5342..42954ed403d 100644 --- a/packages/ti_abusech/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json +++ b/packages/ti_abusech/kibana/dashboard/ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about indicators ingested from the AbuseCH integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -76,6 +75,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -114,7 +115,7 @@ }, "panelIndex": "555e9e6c-04e9-4022-b6df-bda07dde30c4", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -131,7 +132,7 @@ "meta": { "alias": null, "disabled": false, - "index": "logs-*", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "key": "event.dataset", "negate": false, "params": [ @@ -171,7 +172,7 @@ "meta": { "alias": null, "disabled": false, - "index": "logs-*", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "key": "event.kind", "negate": false, "params": { @@ -259,7 +260,7 @@ }, "panelIndex": "e971fedd-6afd-4d03-93ac-d0c751acc254", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -283,7 +284,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "070f5dbc-7687-4e97-9a57-5542b401c13f": { "columnOrder": [ @@ -297,7 +298,7 @@ "label": "Total Indicators", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -313,11 +314,14 @@ "visualization": { "accessor": "1e352b49-3b83-44a6-98fe-8703d30f2517", "layerId": "070f5dbc-7687-4e97-9a57-5542b401c13f", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Indicators [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {} }, @@ -330,7 +334,7 @@ }, "panelIndex": "d37eb797-f273-43c2-9004-b947891cce55", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -353,7 +357,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df8e3a91-700b-428a-a763-525076e4d3c8": { "columnOrder": [ @@ -383,11 +387,14 @@ "visualization": { "accessor": "e4f78e2f-f0a7-4cc6-96d0-af607ffbf326", "layerId": "df8e3a91-700b-428a-a763-525076e4d3c8", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Datastreams [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -402,7 +409,7 @@ "panelIndex": "6509dcc9-bb9c-4c1f-80e9-612f67ada340", "title": "Total Datastreams [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -425,7 +432,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1e757dc0-2e6d-4bd2-aa38-7da9133ca960": { "columnOrder": [ @@ -439,7 +446,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "66779b74-d127-4249-93e4-b8cd9c39b91f": { "dataType": "string", @@ -490,12 +497,13 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right", "showSingleSeries": false }, "preferredSeriesType": "bar_horizontal", "title": "Empty XY chart", - "valueLabels": "inside", + "valueLabels": "show", "xTitle": "Providers", "yLeftExtent": { "mode": "full" @@ -522,7 +530,7 @@ "panelIndex": "86d83606-4176-44b1-b3f3-011d5b5b4b58", "title": "Total Indicators per Provider [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -545,7 +553,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "682732d8-8691-4c5a-bf89-de8e30d71dfb": { "columnOrder": [ @@ -559,7 +567,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "dd629c44-e7db-438e-8656-340b94fd30d8": { "customLabel": true, @@ -595,17 +603,20 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dd629c44-e7db-438e-8656-340b94fd30d8" - ], "layerId": "682732d8-8691-4c5a-bf89-de8e30d71dfb", "layerType": "data", "legendDisplay": "show", "legendPosition": "right", - "metric": "bad802d8-b23f-4ef4-8dcf-4e92170595a7", + "legendSize": "auto", + "metrics": [ + "bad802d8-b23f-4ef4-8dcf-4e92170595a7" + ], "nestedLegend": false, "numberDisplay": "percent", "percentDecimals": 2, + "primaryGroups": [ + "dd629c44-e7db-438e-8656-340b94fd30d8" + ], "truncateLegend": true } ], @@ -627,7 +638,7 @@ }, "panelIndex": "f654c447-12d2-41a4-9091-06169af11ba5", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -650,7 +661,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c1cee622-e3dd-4d6b-a28a-0fb19dc2c7b7": { "columnOrder": [ @@ -665,7 +676,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4d7ca99c-8a53-4a7f-96db-409251c0e391": { "dataType": "string", @@ -691,6 +702,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "30s" }, "scale": "interval", @@ -732,6 +744,7 @@ "legend": { "isInside": false, "isVisible": true, + "legendSize": "auto", "position": "bottom", "shouldTruncate": false, "showSingleSeries": true @@ -765,17 +778,18 @@ }, "panelIndex": "aab4fac0-d39c-4521-aa9b-0a49d5938e9e", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs AbuseCH] Overview", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:35:16.189Z", "id": "ti_abusech-c0d8d1f0-3b20-11ec-ae50-2fdf1e96c6a6", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -865,7 +879,7 @@ }, { "id": "ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", - "name": "tag-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", + "name": "tag-ref-ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", "type": "tag" } ], diff --git a/packages/ti_abusech/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json b/packages/ti_abusech/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json index 7cf7c3514a8..62835b47fae 100644 --- a/packages/ti_abusech/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json +++ b/packages/ti_abusech/kibana/tag/ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6.json @@ -4,7 +4,8 @@ "description": "", "name": "AbuseCH" }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:34:22.575Z", "id": "ti_abusech-73511520-3b32-11ec-ae50-2fdf1e96c6a6", "migrationVersion": { "tag": "8.0.0" diff --git a/packages/ti_abusech/kibana/tags.yml b/packages/ti_abusech/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_abusech/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_abusech/manifest.yml b/packages/ti_abusech/manifest.yml index 043a2b75d4f..a24a89faff8 100644 --- a/packages/ti_abusech/manifest.yml +++ b/packages/ti_abusech/manifest.yml @@ -1,14 +1,13 @@ name: ti_abusech title: AbuseCH -version: "1.13.0" -release: ga +version: "1.20.0" description: Ingest threat intelligence indicators from URL Haus, Malware Bazaar, and Threat Fox feeds with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/abusech2.svg title: AbuseCH @@ -32,3 +31,4 @@ policy_templates: description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_anomali/_dev/build/build.yml b/packages/ti_anomali/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_anomali/_dev/build/build.yml +++ b/packages/ti_anomali/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_anomali/_dev/build/docs/README.md b/packages/ti_anomali/_dev/build/docs/README.md index d15fa64fe6b..e1865549284 100644 --- a/packages/ti_anomali/_dev/build/docs/README.md +++ b/packages/ti_anomali/_dev/build/docs/README.md @@ -24,6 +24,16 @@ When an IOC expires, Anomali feed contains information about all IOCs that got ` **NOTE:** `IOC Expiration Duration` parameter does not override the expiration provided by the Anomali for their IOCs. So, if Anomali IOC is expired and subsequently such `deleted` IOCs are sent into the feed, they are deleted immediately. `IOC Expiration Duration` parameter only exists to add a fail-safe default expiration in case Anomali IOCs never expire. +### Destination index versioning and deleting older versions +The destination indices created by the transform are versioned with an integer suffix such as `-1`, `-2`. Example index name - `logs-ti_anomali_latest.threatstream-1`. + +Due to schema changes on destination index, the versioning on it could be bumped. For example, in integration version `1.15.1`, the destination index is changed to `logs-ti_anomali_latest.threatstream-2` from `logs-ti_anomali_latest.threatstream-1`. + +Since the transform does not have the functionality to auto-delete the old index, users must to delete this old index manually. This is to ensure duplicates are not present when using wildcard queries such as `logs-ti_anomali_latest.threatstream-*`. Please follow below steps: +1. After upgrading the integration to latest, check the current transform's destination index version by navigating via: `Stack Management -> Transforms -> logs-ti_anomali.latest_ioc-default -> Details`. Check `destination_index` value. +2. Run `GET _cat/indices?v` and check if any older versions exist. Such as `logs-ti_anomali_latest.threatstream-1` +3. Run `DELETE logs-ti_anomali_latest.threatstream-` to delete the old index. + ### ILM Policy To facilitate IOC expiration, source datastream-backed indices `.ds-logs-ti_anomali.threat-*` are allowed to contain duplicates from each polling interval. ILM policy is added to these source indices so it doesn't lead to unbounded growth. This means data in these source indices will be deleted after `5 days` from ingested date. diff --git a/packages/ti_anomali/changelog.yml b/packages/ti_anomali/changelog.yml index 1e24180e271..b1ff94b3d2c 100644 --- a/packages/ti_anomali/changelog.yml +++ b/packages/ti_anomali/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.1" + changes: + - description: Remove dotted YAML keys. + type: bugfix + link: https://github.com/elastic/integrations/pull/7803 +- version: "1.16.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7613 +- version: "1.15.1" + changes: + - description: Fix destination fields mapping. Note - Since transform's destination index version is changed, users must manually delete the old index. See https://docs.elastic.co/integrations/ti_anomali#logs for details on destination index versioning. + type: bugfix + link: https://github.com/elastic/integrations/issues/6514 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.14.1" + changes: + - description: Change sort order field in latest transform + type: bugfix + link: https://github.com/elastic/integrations/pull/7000 - version: "1.14.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json b/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json index ddad3777475..4fb345e9cf4 100644 --- a/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json +++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json @@ -1,5 +1,57 @@ { "events": [ + { + "json": { + "added_at": "2023-06-05T12:35:14.860741", + "classification": "private", + "confidence": 92, + "country": "US", + "date_first": "2020-10-09T18:45:23.000Z", + "date_last": "2020-10-09T18:45:23.000Z", + "detail": "phish-kit-sig-id-43111996,Microsoft", + "detail2": "imported by user 1", + "id": 185029228, + "itype": "phish_url", + "lat": 37.751, + "maltype": "phish-kit-sig-id-43111996", + "resource_uri": "/api/v1/intelligence/22222/", + "severity": "very-high", + "source": "Default Organization", + "source_feed_id": 0, + "srcip": "81.2.69.142", + "state": "active", + "trusted_circle_ids": ",10015,", + "update_id": 376590230, + "url": "https://example.appspot.com/2/https%40securelogin-example.bp.poste.it", + "value_type": "url" + } + }, + { + "json": { + "added_at": "2023-06-05T11:03:34.648208", + "classification": "private", + "confidence": 94, + "country": "IN", + "date_first": "2020-10-09T18:45:28.000Z", + "date_last": "2020-10-09T18:45:28.000Z", + "detail": "32-bit,date_added=2020-10-09T15:44:05,elf,mips", + "detail2": "imported by user 1", + "id": 111111, + "itype": "mal_url", + "lat": 28.6327, + "maltype": "32-bit", + "resource_uri": "/api/v1/intelligence/111111/", + "severity": "very-high", + "source": "Default Organization", + "source_feed_id": 0, + "srcip": "81.2.69.192", + "state": "active", + "trusted_circle_ids": ",10015,", + "update_id": 376590649, + "url": "http://81.2.69.192:34011/bin.sh", + "value_type": "url" + } + }, { "json": { "added_at": "2020-10-08T12:22:11", diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json-expected.json b/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json-expected.json index ff7222720e5..1604ec7631f 100644 --- a/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json-expected.json +++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/pipeline/test-anomali-threatstream.json-expected.json @@ -1,6 +1,144 @@ { "expected": [ { + "@timestamp": "2023-06-05T12:35:14.860Z", + "anomali": { + "threatstream": { + "added_at": "2023-06-05T12:35:14.860Z", + "classification": "private", + "confidence": 92, + "detail2": "imported by user 1", + "id": "185029228", + "itype": "phish_url", + "maltype": "phish-kit-sig-id-43111996", + "resource_uri": "/api/v1/intelligence/22222/", + "severity": "very-high", + "source_feed_id": "0", + "state": "active", + "trusted_circle_ids": [ + "10015" + ], + "update_id": "376590230", + "value_type": "url" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "threat" + ], + "kind": "enrichment", + "severity": 9, + "type": [ + "indicator" + ] + }, + "tags": [ + "preserve_original_event", + "phish-kit-sig-id-43111996", + "Microsoft" + ], + "threat": { + "indicator": { + "confidence": "High", + "first_seen": "2020-10-09T18:45:23.000Z", + "geo": { + "country_iso_code": "US" + }, + "ip": "81.2.69.142", + "last_seen": "2020-10-09T18:45:23.000Z", + "marking": { + "tlp": [ + "AMBER" + ] + }, + "provider": "Default Organization", + "type": "url", + "url": { + "domain": "example.appspot.com", + "extension": "it", + "full": "https://example.appspot.com/2/https%40securelogin-example.bp.poste.it", + "original": "https://example.appspot.com/2/https%40securelogin-example.bp.poste.it", + "path": "/2/https@securelogin-example.bp.poste.it", + "scheme": "https" + } + } + } + }, + { + "@timestamp": "2023-06-05T11:03:34.648Z", + "anomali": { + "threatstream": { + "added_at": "2023-06-05T11:03:34.648Z", + "classification": "private", + "confidence": 94, + "detail2": "imported by user 1", + "id": "111111", + "itype": "mal_url", + "maltype": "32-bit", + "resource_uri": "/api/v1/intelligence/111111/", + "severity": "very-high", + "source_feed_id": "0", + "state": "active", + "trusted_circle_ids": [ + "10015" + ], + "update_id": "376590649", + "value_type": "url" + } + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": [ + "threat" + ], + "kind": "enrichment", + "severity": 9, + "type": [ + "indicator" + ] + }, + "tags": [ + "preserve_original_event", + "32-bit", + "date_added=2020-10-09T15:44:05", + "elf", + "mips" + ], + "threat": { + "indicator": { + "confidence": "High", + "first_seen": "2020-10-09T18:45:28.000Z", + "geo": { + "country_iso_code": "IN" + }, + "ip": "81.2.69.192", + "last_seen": "2020-10-09T18:45:28.000Z", + "marking": { + "tlp": [ + "AMBER" + ] + }, + "provider": "Default Organization", + "type": "url", + "url": { + "domain": "81.2.69.192", + "extension": "sh", + "full": "http://81.2.69.192:34011/bin.sh", + "original": "http://81.2.69.192:34011/bin.sh", + "path": "/bin.sh", + "port": 34011, + "scheme": "http" + } + } + } + }, + { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -22,13 +160,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -65,6 +207,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -87,13 +230,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -127,6 +274,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -150,13 +298,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -191,6 +343,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -213,13 +366,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -245,6 +402,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -268,13 +426,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -309,6 +471,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -332,13 +495,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -373,6 +540,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -396,13 +564,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -436,6 +608,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -456,13 +629,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -488,6 +665,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -510,13 +688,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -550,6 +732,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -573,13 +756,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -614,6 +801,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -635,13 +823,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -669,6 +861,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -691,13 +884,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -724,6 +921,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -747,13 +945,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -787,6 +989,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -808,13 +1011,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -842,6 +1049,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -865,13 +1073,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -898,6 +1110,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -919,13 +1132,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -953,6 +1170,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -975,13 +1193,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1009,6 +1231,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1032,13 +1255,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1065,6 +1292,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1088,13 +1316,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1121,6 +1353,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1144,13 +1377,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1177,6 +1414,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1199,13 +1437,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1232,6 +1474,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1254,13 +1497,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1291,6 +1538,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1312,13 +1560,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1345,6 +1597,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1367,13 +1620,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1407,6 +1664,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1429,13 +1687,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1463,6 +1725,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1486,13 +1749,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1519,6 +1786,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1542,13 +1810,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1576,6 +1848,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1597,13 +1870,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1629,6 +1906,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1650,13 +1928,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1690,6 +1972,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1712,13 +1995,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1752,6 +2039,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1775,13 +2063,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1808,6 +2100,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1831,13 +2124,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1865,6 +2162,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1888,13 +2186,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1921,6 +2223,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1944,13 +2247,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -1977,6 +2284,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -1998,13 +2306,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2031,6 +2343,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2054,13 +2367,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2087,6 +2404,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2110,13 +2428,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2142,6 +2464,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2164,13 +2487,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2197,6 +2524,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2219,13 +2547,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2259,6 +2591,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2280,13 +2613,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2313,6 +2650,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2334,13 +2672,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2367,6 +2709,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2390,13 +2733,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2423,6 +2770,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2446,13 +2794,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2486,6 +2838,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2509,13 +2862,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2543,6 +2900,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2565,13 +2923,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2605,6 +2967,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2626,13 +2989,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2666,6 +3033,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2688,13 +3056,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2722,6 +3094,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2743,13 +3116,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2776,6 +3153,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2798,13 +3176,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2832,6 +3214,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2854,13 +3237,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2887,6 +3274,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2910,13 +3298,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -2950,6 +3342,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -2971,13 +3364,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3004,6 +3401,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3026,13 +3424,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3058,6 +3460,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3080,13 +3483,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3112,6 +3519,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3133,13 +3541,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3173,6 +3585,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3195,13 +3608,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3227,6 +3644,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3249,13 +3667,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3283,6 +3705,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3304,13 +3727,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3338,6 +3765,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3360,13 +3788,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3393,6 +3825,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3415,13 +3848,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3448,6 +3885,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3471,13 +3909,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3511,6 +3953,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3532,13 +3975,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3566,6 +4013,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3588,13 +4036,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3622,6 +4074,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3643,13 +4096,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3677,6 +4134,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3699,13 +4157,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3732,6 +4194,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3755,13 +4218,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3788,6 +4255,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3811,13 +4279,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3845,6 +4317,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3866,13 +4339,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3898,6 +4375,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3920,13 +4398,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -3960,6 +4442,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -3982,13 +4465,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4015,6 +4502,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4036,13 +4524,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4069,6 +4561,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4090,13 +4583,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4123,6 +4620,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4145,13 +4643,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4185,6 +4687,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4206,13 +4709,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4239,6 +4746,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4261,13 +4769,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4294,6 +4806,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4315,13 +4828,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4348,6 +4865,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4371,13 +4889,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4411,6 +4933,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4432,13 +4955,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4466,6 +4993,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4489,13 +5017,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4522,6 +5054,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4544,13 +5077,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4589,6 +5126,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4612,13 +5150,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4652,6 +5194,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4674,13 +5217,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4706,6 +5253,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4727,13 +5275,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4764,6 +5316,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4786,13 +5339,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4826,6 +5383,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4848,13 +5406,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4888,6 +5450,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4911,13 +5474,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -4956,6 +5523,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -4979,13 +5547,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5019,6 +5591,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5041,13 +5614,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5078,6 +5655,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5099,13 +5677,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5138,6 +5720,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5159,13 +5742,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5199,6 +5786,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5221,13 +5809,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5261,6 +5853,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5282,13 +5875,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5322,6 +5919,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5343,13 +5941,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", @@ -5380,6 +5982,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5403,13 +6006,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5444,6 +6051,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5464,13 +6072,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 5, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5492,6 +6104,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5514,13 +6127,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 9, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5542,6 +6159,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "added_at": "2020-10-08T12:22:11.000Z", @@ -5562,13 +6180,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5590,6 +6212,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "classification": "public", @@ -5612,13 +6235,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5640,6 +6267,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "classification": "private", @@ -5661,13 +6289,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -5689,6 +6321,7 @@ } }, { + "@timestamp": "2020-10-08T12:22:11.000Z", "anomali": { "threatstream": { "classification": "private", @@ -5711,13 +6344,17 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "severity": 3, - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event", diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-integrator-http-config.yml b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-integrator-http-config.yml index acf46d4373d..42678ece8b4 100644 --- a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-integrator-http-config.yml +++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-integrator-http-config.yml @@ -9,3 +9,5 @@ data_stream: secret: TheSecret preserve_original_event: true ioc_expiration_duration: "5d" +assert: + hit_count: 1 diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-http-config.yml b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-http-config.yml index 4c608399876..138347a8a33 100644 --- a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-http-config.yml +++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-http-config.yml @@ -8,3 +8,5 @@ data_stream: listen_port: 9080 ioc_expiration_duration: "5d" preserve_original_event: true +assert: + hit_count: 100 diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-https-config.yml b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-https-config.yml index b45b7b44b89..9a355695213 100644 --- a/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-https-config.yml +++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/system/test-webhook-https-config.yml @@ -59,3 +59,5 @@ data_stream: Iqi7is4z2mP8pbcIIlmloogE -----END PRIVATE KEY----- verification_mode: none +assert: + hit_count: 100 diff --git a/packages/ti_anomali/data_stream/threatstream/elasticsearch/ilm/default_poilcy.json b/packages/ti_anomali/data_stream/threatstream/elasticsearch/ilm/default_policy.json similarity index 100% rename from packages/ti_anomali/data_stream/threatstream/elasticsearch/ilm/default_poilcy.json rename to packages/ti_anomali/data_stream/threatstream/elasticsearch/ilm/default_policy.json diff --git a/packages/ti_anomali/data_stream/threatstream/elasticsearch/ingest_pipeline/default.yml b/packages/ti_anomali/data_stream/threatstream/elasticsearch/ingest_pipeline/default.yml index fbc7aafe0b8..d5580a2ceec 100644 --- a/packages/ti_anomali/data_stream/threatstream/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_anomali/data_stream/threatstream/elasticsearch/ingest_pipeline/default.yml @@ -6,22 +6,22 @@ processors: # - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] # # Map itype field to STIX 2.0 Cyber Observable values (threat.indicator.type). # - script: lang: painless - if: "ctx.json.itype != null" + if: "ctx.json?.itype != null" description: > Map itype field to STIX 2.0 Cyber Observable values (threat.indicator.type). params: @@ -151,31 +151,39 @@ processors: ctx.json.deleted_at = ZonedDateTime.parse(added_at, DateTimeFormatter.ISO_LOCAL_DATE_TIME.withZone(ZoneId.of('Z'))).plusDays(90L); } } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' # Map added_at - date: field: json.added_at target_field: json.added_at + tag: date-added_at formats: - ISO8601 + - strict_date_optional_time_nanos if: "ctx.json?.added_at != null" on_failure: - append: field: error.message - value: 'Error parsing added_at field value "{{{ json.added_at }}}": {{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' # Map deleted_at - date: field: json.deleted_at target_field: json.deleted_at + tag: date-deleted_at formats: - ISO8601 + - strict_date_optional_time_nanos if: "ctx.json?.deleted_at != null" on_failure: - append: field: error.message - value: 'Error parsing deleted_at field value "{{{ json.deleted_at }}}": {{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' # # Map first and last seen dates. @@ -183,25 +191,41 @@ processors: - date: field: json.date_first target_field: threat.indicator.first_seen + tag: date-date_first formats: - ISO8601 if: "ctx.json?.date_first != null" on_failure: - append: field: error.message - value: 'Error parsing date_first field value "{{{ json.date_first }}}": {{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.date_last target_field: threat.indicator.last_seen + tag: date-last_seen formats: - ISO8601 if: "ctx.json?.date_last != null" on_failure: - append: field: error.message - value: 'Error parsing date_last field value "{{{ json.date_last }}}": {{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: _temp_.timestamp + copy_from: json.added_at + if: ctx.json?.added_at != null + + - set: + field: _temp_.timestamp + copy_from: json.deleted_at + if: ctx.json?.deleted_at != null && ctx._temp_?.timestamp == null + + - set: + field: "@timestamp" + copy_from: _temp_.timestamp + if: ctx._temp_?.timestamp != null # # Map IP geolocation fields. # @@ -449,6 +473,7 @@ processors: ignore_missing: true - remove: field: + - _temp_ - _conf - json.asn - json.date_first diff --git a/packages/ti_anomali/data_stream/threatstream/sample_event.json b/packages/ti_anomali/data_stream/threatstream/sample_event.json index c9a3ffe88a6..07e95ce3d0d 100644 --- a/packages/ti_anomali/data_stream/threatstream/sample_event.json +++ b/packages/ti_anomali/data_stream/threatstream/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-05-31T11:23:45.408Z", + "@timestamp": "2020-10-08T12:22:11.000Z", "agent": { - "ephemeral_id": "c6d5c470-bc00-4989-8926-eaac7bced0dd", - "id": "5f8289ef-b035-4afb-8a20-b21af809df44", + "ephemeral_id": "784ec3d1-432a-4e36-9fe0-7eb9bb80c36b", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.1" }, "anomali": { "threatstream": { @@ -34,22 +34,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5f8289ef-b035-4afb-8a20-b21af809df44", - "snapshot": true, - "version": "8.8.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_anomali.threatstream", - "ingested": "2023-05-31T11:23:46Z", + "ingested": "2023-08-30T14:59:36Z", "kind": "enrichment", "original": "{\"added_at\":\"2020-10-08T12:22:11\",\"classification\":\"public\",\"confidence\":20,\"country\":\"FR\",\"date_first\":\"2020-10-08T12:21:50\",\"date_last\":\"2020-10-08T12:24:42\",\"detail2\":\"imported by user 184\",\"domain\":\"d4xgfj.example.net\",\"id\":3135167627,\"import_session_id\":1400,\"itype\":\"mal_domain\",\"lat\":-49.1,\"lon\":94.4,\"org\":\"OVH Hosting\",\"resource_uri\":\"/api/v1/intelligence/P46279656657/\",\"severity\":\"high\",\"source\":\"Default Organization\",\"source_feed_id\":3143,\"srcip\":\"89.160.20.156\",\"state\":\"active\",\"trusted_circle_ids\":\"122\",\"update_id\":3786618776,\"value_type\":\"domain\"}", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "http_endpoint" diff --git a/packages/ti_anomali/docs/README.md b/packages/ti_anomali/docs/README.md index 3e087a29849..d6e3726315c 100644 --- a/packages/ti_anomali/docs/README.md +++ b/packages/ti_anomali/docs/README.md @@ -24,6 +24,16 @@ When an IOC expires, Anomali feed contains information about all IOCs that got ` **NOTE:** `IOC Expiration Duration` parameter does not override the expiration provided by the Anomali for their IOCs. So, if Anomali IOC is expired and subsequently such `deleted` IOCs are sent into the feed, they are deleted immediately. `IOC Expiration Duration` parameter only exists to add a fail-safe default expiration in case Anomali IOCs never expire. +### Destination index versioning and deleting older versions +The destination indices created by the transform are versioned with an integer suffix such as `-1`, `-2`. Example index name - `logs-ti_anomali_latest.threatstream-1`. + +Due to schema changes on destination index, the versioning on it could be bumped. For example, in integration version `1.15.1`, the destination index is changed to `logs-ti_anomali_latest.threatstream-2` from `logs-ti_anomali_latest.threatstream-1`. + +Since the transform does not have the functionality to auto-delete the old index, users must to delete this old index manually. This is to ensure duplicates are not present when using wildcard queries such as `logs-ti_anomali_latest.threatstream-*`. Please follow below steps: +1. After upgrading the integration to latest, check the current transform's destination index version by navigating via: `Stack Management -> Transforms -> logs-ti_anomali.latest_ioc-default -> Details`. Check `destination_index` value. +2. Run `GET _cat/indices?v` and check if any older versions exist. Such as `logs-ti_anomali_latest.threatstream-1` +3. Run `DELETE logs-ti_anomali_latest.threatstream-` to delete the old index. + ### ILM Policy To facilitate IOC expiration, source datastream-backed indices `.ds-logs-ti_anomali.threat-*` are allowed to contain duplicates from each polling interval. ILM policy is added to these source indices so it doesn't lead to unbounded growth. This means data in these source indices will be deleted after `5 days` from ingested date. @@ -32,13 +42,13 @@ An example event for `threatstream` looks as following: ```json { - "@timestamp": "2023-05-31T11:23:45.408Z", + "@timestamp": "2020-10-08T12:22:11.000Z", "agent": { - "ephemeral_id": "c6d5c470-bc00-4989-8926-eaac7bced0dd", - "id": "5f8289ef-b035-4afb-8a20-b21af809df44", + "ephemeral_id": "784ec3d1-432a-4e36-9fe0-7eb9bb80c36b", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.1" }, "anomali": { "threatstream": { @@ -67,22 +77,26 @@ An example event for `threatstream` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "5f8289ef-b035-4afb-8a20-b21af809df44", - "snapshot": true, - "version": "8.8.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_anomali.threatstream", - "ingested": "2023-05-31T11:23:46Z", + "ingested": "2023-08-30T14:59:36Z", "kind": "enrichment", "original": "{\"added_at\":\"2020-10-08T12:22:11\",\"classification\":\"public\",\"confidence\":20,\"country\":\"FR\",\"date_first\":\"2020-10-08T12:21:50\",\"date_last\":\"2020-10-08T12:24:42\",\"detail2\":\"imported by user 184\",\"domain\":\"d4xgfj.example.net\",\"id\":3135167627,\"import_session_id\":1400,\"itype\":\"mal_domain\",\"lat\":-49.1,\"lon\":94.4,\"org\":\"OVH Hosting\",\"resource_uri\":\"/api/v1/intelligence/P46279656657/\",\"severity\":\"high\",\"source\":\"Default Organization\",\"source_feed_id\":3143,\"srcip\":\"89.160.20.156\",\"state\":\"active\",\"trusted_circle_ids\":\"122\",\"update_id\":3786618776,\"value_type\":\"domain\"}", "severity": 7, - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "http_endpoint" @@ -168,10 +182,10 @@ An example event for `threatstream` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/base-fields.yml b/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/base-fields.yml deleted file mode 100644 index 378e9e1a156..00000000000 --- a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/base-fields.yml +++ /dev/null @@ -1,28 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset name. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: constant_keyword - description: Event module - value: ti_anomali -- name: event.dataset - type: constant_keyword - description: Event dataset - value: ti_anomali.threatstream -- name: threat.feed.name - type: constant_keyword - description: Display friendly feed name - value: Anomali ThreatStream -- name: threat.feed.dashboard_id - type: constant_keyword - description: Dashboard ID used for Kibana CTI UI - value: ti_anomali-96fe1e60-4261-11ec-b7be-d3026acdf1cf -- name: "@timestamp" - type: date - description: Event timestamp. diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/ecs.yml b/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/ecs.yml deleted file mode 100644 index 77d94bcd253..00000000000 --- a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/ecs.yml +++ /dev/null @@ -1,70 +0,0 @@ -- external: ecs - name: ecs.version -- external: ecs - name: message -- external: ecs - name: tags -- external: ecs - name: error.message -- external: ecs - name: event.severity -- external: ecs - name: event.category -- external: ecs - name: event.ingested -- external: ecs - name: event.kind -- external: ecs - name: event.type -- external: ecs - name: event.created -- external: ecs - name: event.original -- external: ecs - name: threat.indicator.first_seen -- external: ecs - name: threat.indicator.last_seen -- external: ecs - name: threat.indicator.type -- external: ecs - name: threat.indicator.ip -- external: ecs - name: threat.indicator.url.domain -- external: ecs - name: threat.indicator.url.full -- external: ecs - name: threat.indicator.url.extension -- external: ecs - name: threat.indicator.url.original -- external: ecs - name: threat.indicator.url.path -- external: ecs - name: threat.indicator.url.port -- external: ecs - name: threat.indicator.url.scheme -- external: ecs - name: threat.indicator.url.query -- external: ecs - name: threat.indicator.file.hash.md5 -- external: ecs - name: threat.indicator.file.hash.sha1 -- external: ecs - name: threat.indicator.file.hash.sha256 -- external: ecs - name: threat.indicator.file.hash.sha512 -- external: ecs - name: threat.indicator.email.address -- external: ecs - name: threat.indicator.provider -- external: ecs - name: threat.indicator.marking.tlp -- external: ecs - name: threat.indicator.confidence -- external: ecs - name: threat.indicator.as.number -- external: ecs - name: threat.indicator.as.organization.name -- external: ecs - name: threat.indicator.geo.location -- external: ecs - name: threat.indicator.geo.country_iso_code diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/fields.yml b/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/fields.yml index 41222f0cb21..d0a33fa7fea 100644 --- a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/fields.yml +++ b/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/fields.yml @@ -1,6 +1,4 @@ -- name: "@timestamp" - type: date - description: Event timestamp. +# Datastream fields (copied from ti_anomali/data_stream/threatstream/fields/fields.yml) - name: anomali.threatstream type: group description: > @@ -95,3 +93,415 @@ type: keyword description: >- Data type of the indicator. Possible values: ip, domain, url, email, md5. + - name: added_at + type: date + description: >- + Date when IOC was added. + - name: deleted_at + type: date + description: >- + Date when IOC was deleted/expired. +# ECS fields (after build, expanded ECS fields are copied from build/packages/ti_anomali//data_stream/threatstream/fields/ecs.yml) +- description: |- + ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. + When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. + name: ecs.version + type: keyword +- description: |- + For log events the message field contains the log message, optimized for viewing in a log viewer. + For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. + If multiple messages exist, they can be combined into one message. + name: message + type: match_only_text +- description: List of keywords used to tag each event. + name: tags + normalize: + - array + type: keyword +- description: Error message. + name: error.message + type: match_only_text +- description: |- + The numeric severity of the event according to your event source. + What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. + name: event.severity + type: long +- description: |- + This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. + `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. + This field is an array. This will allow proper categorization of some events that fall in multiple categories. + name: event.category + normalize: + - array + type: keyword +- description: |- + Timestamp when an event arrived in the central data store. + This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. + In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. + name: event.ingested + type: date +- description: |- + This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. + `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. + The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. + name: event.kind + type: keyword +- description: |- + This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. + `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. + This field is an array. This will allow proper categorization of some events that fall in multiple event types. + name: event.type + normalize: + - array + type: keyword +- description: |- + event.created contains the date/time when the event was first read by an agent, or by your pipeline. + This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. + In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. + In case the two timestamps are identical, @timestamp should be used. + name: event.created + type: date +- description: |- + Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. + This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. + doc_values: false + index: false + name: event.original + type: keyword +- description: The date and time when intelligence source first reported sighting this indicator. + name: threat.indicator.first_seen + type: date +- description: The date and time when intelligence source last reported sighting this indicator. + name: threat.indicator.last_seen + type: date +- description: Type of indicator as represented by Cyber Observable in STIX 2.0. + name: threat.indicator.type + type: keyword +- description: Identifies a threat indicator as an IP address (irrespective of direction). + name: threat.indicator.ip + type: ip +- description: |- + Domain of the url, such as "www.elastic.co". + In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. + If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. + name: threat.indicator.url.domain + type: keyword +- description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.url.full + type: wildcard +- description: |- + The field contains the file extension from the original request url, excluding the leading dot. + The file extension is only set if it exists, as not every url has a file extension. + The leading period must not be included. For example, the value must be "png", not ".png". + Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + name: threat.indicator.url.extension + type: keyword +- description: |- + Unmodified original url as seen in the event source. + Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. + This field is meant to represent the URL as it was observed, complete or not. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.url.original + type: wildcard +- description: Path of the request, such as "/search". + name: threat.indicator.url.path + type: wildcard +- description: Port of the request, such as 443. + name: threat.indicator.url.port + type: long +- description: |- + Scheme of the request, such as "https". + Note: The `:` is not part of the scheme. + name: threat.indicator.url.scheme + type: keyword +- description: |- + The query field describes the query string of the request, such as "q=elasticsearch". + The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. + name: threat.indicator.url.query + type: keyword +- description: MD5 hash. + name: threat.indicator.file.hash.md5 + type: keyword +- description: SHA1 hash. + name: threat.indicator.file.hash.sha1 + type: keyword +- description: SHA256 hash. + name: threat.indicator.file.hash.sha256 + type: keyword +- description: SHA512 hash. + name: threat.indicator.file.hash.sha512 + type: keyword +- description: Identifies a threat indicator as an email address (irrespective of direction). + name: threat.indicator.email.address + type: keyword +- description: The name of the indicator's provider. + name: threat.indicator.provider + type: keyword +- description: Traffic Light Protocol sharing markings. + name: threat.indicator.marking.tlp + type: keyword +- description: Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields. + name: threat.indicator.confidence + type: keyword +- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + name: threat.indicator.as.number + type: long +- description: Organization name. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.as.organization.name + type: keyword +- description: Longitude and latitude. + name: threat.indicator.geo.location + type: geo_point +- description: Country ISO code. + name: threat.indicator.geo.country_iso_code + type: keyword +# Beats fields (copied from ti_anomali/data_stream/threatstream/fields/beats.yml) +- name: input.type + type: keyword + description: Type of Filebeat input. +- name: log.flags + type: keyword + description: Flags for the log file. +- name: log.offset + type: long + description: Offset of the entry in the log file. +- name: log.file.path + type: keyword + description: Path to the log file. +# Base fields (copied from ti_anomali/data_stream/threatstream/fields/base-fields.yml) +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module + value: ti_anomali +- name: event.dataset + type: constant_keyword + description: Event dataset + value: ti_anomali.threatstream +- name: threat.feed.name + type: constant_keyword + description: Display friendly feed name + value: Anomali ThreatStream +- name: threat.feed.dashboard_id + type: constant_keyword + description: Dashboard ID used for Kibana CTI UI + value: ti_anomali-96fe1e60-4261-11ec-b7be-d3026acdf1cf +- name: "@timestamp" + type: date + description: Event timestamp. +# Agent fields (copied from ti_anomali/data_stream/threatstream/fields/agent.yml) +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/manifest.yml b/packages/ti_anomali/elasticsearch/transform/latest_ioc/manifest.yml index 79f3df8107b..f5296fd0c0a 100644 --- a/packages/ti_anomali/elasticsearch/transform/latest_ioc/manifest.yml +++ b/packages/ti_anomali/elasticsearch/transform/latest_ioc/manifest.yml @@ -2,13 +2,13 @@ start: true destination_index_template: settings: index: - sort.field: - - "@timestamp" - sort.order: - - desc + sort: + field: + - "@timestamp" + order: + - desc mappings: dynamic: true - _meta: {} dynamic_templates: - strings_as_keyword: match_mapping_type: string diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/transform.yml b/packages/ti_anomali/elasticsearch/transform/latest_ioc/transform.yml index 7152608957a..3a4219eb02a 100644 --- a/packages/ti_anomali/elasticsearch/transform/latest_ioc/transform.yml +++ b/packages/ti_anomali/elasticsearch/transform/latest_ioc/transform.yml @@ -9,17 +9,17 @@ source: # us that ability in order to prevent having duplicate IoC data and prevent query # time field type conflicts. dest: - index: "logs-ti_anomali_latest.threatstream-1" + index: "logs-ti_anomali_latest.threatstream-2" latest: unique_key: - event.dataset - anomali.threatstream.id - sort: "event.ingested" + sort: "@timestamp" description: Latest Anomali IoC data frequency: 30s sync: time: - field: event.ingested + field: "@timestamp" delay: 60s retention_policy: time: @@ -28,4 +28,4 @@ retention_policy: _meta: managed: true # Bump this version to delete, reinstall, and restart the transform during package. - fleet_transform_version: 0.1.0 + fleet_transform_version: 0.2.0 diff --git a/packages/ti_anomali/kibana/tags.yml b/packages/ti_anomali/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_anomali/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_anomali/manifest.yml b/packages/ti_anomali/manifest.yml index cd79d00207f..39379bf7abc 100644 --- a/packages/ti_anomali/manifest.yml +++ b/packages/ti_anomali/manifest.yml @@ -1,14 +1,13 @@ name: ti_anomali title: Anomali -version: "1.14.0" -release: ga +version: "1.17.0" description: Ingest threat intelligence indicators from Anomali with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.8.0 + kibana: + version: ^8.8.0 icons: - src: /img/anomali.svg title: Anomali diff --git a/packages/ti_cif3/_dev/build/build.yml b/packages/ti_cif3/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_cif3/_dev/build/build.yml +++ b/packages/ti_cif3/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_cif3/changelog.yml b/packages/ti_cif3/changelog.yml index de7500ce86f..d2f1fc39a7f 100644 --- a/packages/ti_cif3/changelog.yml +++ b/packages/ti_cif3/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.6.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.5.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.4.0" + changes: + - description: Update package-spec to 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7316 +- version: "1.3.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.2.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.1.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.0.0" changes: - description: Release Collective Intelligence Framework as GA. diff --git a/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-no-preserve-ndjson.log-expected.json b/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-no-preserve-ndjson.log-expected.json index 995ff6f68c9..42bd34e0c9c 100644 --- a/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-no-preserve-ndjson.log-expected.json +++ b/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-no-preserve-ndjson.log-expected.json @@ -7,12 +7,16 @@ "uuid": "3fbdd654-b2b0-498c-8e20-ef87bce73672" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "ip": [ diff --git a/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-sample-ndjson.log-expected.json b/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-sample-ndjson.log-expected.json index c7274250cd4..de137760b38 100644 --- a/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-sample-ndjson.log-expected.json +++ b/packages/ti_cif3/data_stream/feed/_dev/test/pipeline/test-cif3-sample-ndjson.log-expected.json @@ -7,13 +7,17 @@ "uuid": "3fbdd654-b2b0-498c-8e20-ef87bce73672" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"indicator\":\"89.160.20.156\",\"itype\":\"ipv4\",\"tlp\":\"white\",\"provider\":\"threatfox.abuse.ch\",\"group\":[\"everyone\"],\"count\":1,\"tags\":[\"agenttesla\",\"botnet\",\"hunter\"],\"confidence\":8.0,\"description\":\"agent tesla\",\"uuid\":\"3fbdd654-b2b0-498c-8e20-ef87bce73672\",\"reference\":\"https://threatfox.abuse.ch/ioc/838651/\",\"rdata\":\"http://208.67.106.111/theme/inc/e26dbe0dcc481e.php\",\"firsttime\":\"2022-07-19T07:40:41.000000Z\",\"lasttime\":\"2022-07-19T08:35:05.971696Z\",\"reporttime\":\"2022-07-19T08:35:05.971696Z\",\"indicator_ipv4\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "related": { "ip": [ diff --git a/packages/ti_cif3/data_stream/feed/elasticsearch/ingest_pipeline/default.yml b/packages/ti_cif3/data_stream/feed/elasticsearch/ingest_pipeline/default.yml index dedb88e8cd9..68017383538 100644 --- a/packages/ti_cif3/data_stream/feed/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_cif3/data_stream/feed/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # diff --git a/packages/ti_cif3/data_stream/feed/fields/ecs.yml b/packages/ti_cif3/data_stream/feed/fields/ecs.yml index 65997a7a30b..ef9d73ddd42 100644 --- a/packages/ti_cif3/data_stream/feed/fields/ecs.yml +++ b/packages/ti_cif3/data_stream/feed/fields/ecs.yml @@ -94,8 +94,6 @@ name: threat.indicator.geo.location - external: ecs name: threat.indicator.geo.country_iso_code -- external: ecs - name: threat.indicator.geo.location - external: ecs name: threat.indicator.geo.region_name - external: ecs diff --git a/packages/ti_cif3/data_stream/feed/manifest.yml b/packages/ti_cif3/data_stream/feed/manifest.yml index 40bcd7042c8..27632206134 100644 --- a/packages/ti_cif3/data_stream/feed/manifest.yml +++ b/packages/ti_cif3/data_stream/feed/manifest.yml @@ -58,7 +58,7 @@ streams: required: true show_user: true default: 60m - description: How frequently to pull the feed. + description: How frequently to pull the feed. Supported units for this parameter are h/m/s. # this doesn't currently work #- name: filters # type: yaml @@ -81,6 +81,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false diff --git a/packages/ti_cif3/data_stream/feed/sample_event.json b/packages/ti_cif3/data_stream/feed/sample_event.json index 1e8de29ceda..c41949f3f76 100755 --- a/packages/ti_cif3/data_stream/feed/sample_event.json +++ b/packages/ti_cif3/data_stream/feed/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-07-25T02:59:05.404Z", + "@timestamp": "2023-08-08T18:44:20.288Z", "agent": { - "ephemeral_id": "6d30ac65-9d55-4014-9a2a-2fbcf8816fff", - "id": "f599fd51-b36d-45b4-a90f-4d63240b8477", + "ephemeral_id": "01cfb0f6-6879-48c3-a90f-2f8c5274de1f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.9.0" }, "cif3": { "itype": "ipv4", @@ -18,22 +18,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "f599fd51-b36d-45b4-a90f-4d63240b8477", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.2" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-07-25T02:59:05.404Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:44:20.288Z", "dataset": "ti_cif3.feed", - "ingested": "2022-07-25T02:59:08Z", + "ingested": "2023-08-08T18:44:23Z", "kind": "enrichment", "original": "{\"application\":\"https\",\"asn\":8075,\"asn_desc\":\"microsoft-corp-msn-as-block\",\"cc\":\"br\",\"city\":\"campinas\",\"confidence\":10,\"count\":1,\"firsttime\":\"2022-07-20T20:25:53.000000Z\",\"group\":[\"everyone\"],\"indicator\":\"20.206.75.106\",\"indicator_ipv4\":\"20.206.75.106\",\"itype\":\"ipv4\",\"lasttime\":\"2022-07-20T20:25:53.000000Z\",\"latitude\":-22.9035,\"location\":[-47.0565,-22.9035],\"longitude\":-47.0565,\"portlist\":\"443\",\"protocol\":\"tcp\",\"provider\":\"sslbl.abuse.ch\",\"reference\":\"https://sslbl.abuse.ch/blacklist/sslipblacklist.csv\",\"region\":\"sao paulo\",\"reporttime\":\"2022-07-21T20:33:26.585967Z\",\"tags\":[\"botnet\"],\"timezone\":\"america/sao_paulo\",\"tlp\":\"white\",\"uuid\":\"ac240898-1443-4d7e-a98a-1daed220c162\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_cif3/docs/README.md b/packages/ti_cif3/docs/README.md index b09efe022db..0164f1b13fa 100644 --- a/packages/ti_cif3/docs/README.md +++ b/packages/ti_cif3/docs/README.md @@ -58,10 +58,10 @@ CIFv3 `confidence` field values (0..10) are converted to ECS confidence (None, L | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -120,13 +120,13 @@ An example event for `feed` looks as following: ```json { - "@timestamp": "2022-07-25T02:59:05.404Z", + "@timestamp": "2023-08-08T18:44:20.288Z", "agent": { - "ephemeral_id": "6d30ac65-9d55-4014-9a2a-2fbcf8816fff", - "id": "f599fd51-b36d-45b4-a90f-4d63240b8477", + "ephemeral_id": "01cfb0f6-6879-48c3-a90f-2f8c5274de1f", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.9.0" }, "cif3": { "itype": "ipv4", @@ -139,22 +139,26 @@ An example event for `feed` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "f599fd51-b36d-45b4-a90f-4d63240b8477", + "id": "0a5c1566-c6fd-4e91-b96d-4083445a000e", "snapshot": false, - "version": "8.3.2" + "version": "8.9.0" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-07-25T02:59:05.404Z", + "category": [ + "threat" + ], + "created": "2023-08-08T18:44:20.288Z", "dataset": "ti_cif3.feed", - "ingested": "2022-07-25T02:59:08Z", + "ingested": "2023-08-08T18:44:23Z", "kind": "enrichment", "original": "{\"application\":\"https\",\"asn\":8075,\"asn_desc\":\"microsoft-corp-msn-as-block\",\"cc\":\"br\",\"city\":\"campinas\",\"confidence\":10,\"count\":1,\"firsttime\":\"2022-07-20T20:25:53.000000Z\",\"group\":[\"everyone\"],\"indicator\":\"20.206.75.106\",\"indicator_ipv4\":\"20.206.75.106\",\"itype\":\"ipv4\",\"lasttime\":\"2022-07-20T20:25:53.000000Z\",\"latitude\":-22.9035,\"location\":[-47.0565,-22.9035],\"longitude\":-47.0565,\"portlist\":\"443\",\"protocol\":\"tcp\",\"provider\":\"sslbl.abuse.ch\",\"reference\":\"https://sslbl.abuse.ch/blacklist/sslipblacklist.csv\",\"region\":\"sao paulo\",\"reporttime\":\"2022-07-21T20:33:26.585967Z\",\"tags\":[\"botnet\"],\"timezone\":\"america/sao_paulo\",\"tlp\":\"white\",\"uuid\":\"ac240898-1443-4d7e-a98a-1daed220c162\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_cif3/kibana/tags.yml b/packages/ti_cif3/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_cif3/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_cif3/manifest.yml b/packages/ti_cif3/manifest.yml index 6e5f246d26e..fc1c2bb0ffb 100644 --- a/packages/ti_cif3/manifest.yml +++ b/packages/ti_cif3/manifest.yml @@ -1,15 +1,15 @@ -format_version: 1.0.0 +format_version: "3.0.0" name: ti_cif3 title: "Collective Intelligence Framework v3" -version: "1.0.0" -license: basic +version: "1.6.0" description: "Ingest threat indicators from a Collective Intelligence Framework v3 instance with Elastic Agent." type: integration categories: - security - threat_intel conditions: - kibana.version: "^8.7.1" + kibana: + version: "^8.7.1" icons: - src: /img/csg_logo_big.svg title: csirtgadgets logo @@ -40,3 +40,4 @@ policy_templates: description: The CIFv3 API read token owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_cybersixgill/_dev/build/build.yml b/packages/ti_cybersixgill/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_cybersixgill/_dev/build/build.yml +++ b/packages/ti_cybersixgill/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_cybersixgill/changelog.yml b/packages/ti_cybersixgill/changelog.yml index 23ca85a212c..ee82da7cf3c 100644 --- a/packages/ti_cybersixgill/changelog.yml +++ b/packages/ti_cybersixgill/changelog.yml @@ -1,4 +1,44 @@ # newer versions go on top +- version: 1.21.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.20.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.19.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7568 +- version: "1.18.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.17.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.16.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 +- version: "1.15.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 +- version: "1.14.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.13.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_cybersixgill/data_stream/threat/_dev/test/pipeline/test-cybersixgill-ndjson.log-expected.json b/packages/ti_cybersixgill/data_stream/threat/_dev/test/pipeline/test-cybersixgill-ndjson.log-expected.json index 69cf8b8d957..8f487ae3fd8 100644 --- a/packages/ti_cybersixgill/data_stream/threat/_dev/test/pipeline/test-cybersixgill-ndjson.log-expected.json +++ b/packages/ti_cybersixgill/data_stream/threat/_dev/test/pipeline/test-cybersixgill-ndjson.log-expected.json @@ -15,10 +15,12 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"confidence\":80,\"created\":\"2021-12-07T09:22:41.485Z\",\"description\":\"Virustotal link that appeared on a dark web site, generally to show malware that is undetected\",\"extensions\":{\"extension-definition--4582f9eb-bad5-46ac-bd26-1b4201d52537\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"positive_rate\":\"none\",\"source_name\":\"VirusTotal\",\"url\":\"https://virustotal.com/#/file/2e7e43be1fc3cbefef8d686ce63ceb30456a4a67d555407fb6797e969972945c\"},{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Test capabilities\",\"mitre_attack_tactic_id\":\"TA0025\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0025/\",\"mitre_attack_technique\":\"Test signature detection for file upload/email filters\",\"mitre_attack_technique_id\":\"T1361\",\"mitre_attack_technique_url\":\"https://attack.mitre.org/techniques/T1361/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--b34d3caa-e4e2-49bd-9b57-f585728320e8\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"en\",\"modified\":\"2021-12-07T09:22:41.485Z\",\"name\":\"31aef6bddfeeb3f519dfe3d5ebe9c2ae;e54ef45c82899dd2b20372cf47958cea94dd80a7;2e7e43be1fc3cbefef8d686ce63ceb30456a4a67d555407fb6797e969972945c\",\"pattern\":\"[file:hashes.MD5 = '31aef6bddfeeb3f519dfe3d5ebe9c2ae' OR file:hashes.'SHA-1' = 'e54ef45c82899dd2b20372cf47958cea94dd80a7' OR file:hashes.'SHA-256' = '2e7e43be1fc3cbefef8d686ce63ceb30456a4a67d555407fb6797e969972945c']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"layna61524\",\"sixgill_confidence\":80,\"sixgill_feedid\":\"darkfeed_002\",\"sixgill_feedname\":\"darkweb_vt_links\",\"sixgill_post_virustotallink\":\"https://virustotal.com/#/file/2e7e43be1fc3cbefef8d686ce63ceb30456a4a67d555407fb6797e969972945c\",\"sixgill_postid\":\"a452593da2f6314c2f2d6c98c6473608e11914e3\",\"sixgill_posttitle\":\"[GET] LAYNA'S LAGNIAPPE - DECEMBER 6, 2021\",\"sixgill_severity\":70,\"sixgill_source\":\"forum_bestblackhat\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T00:03:00Z\"}", "severity": 70, @@ -45,9 +47,15 @@ "type": "file" }, "tactic": { - "id": "TA0025", - "name": "Test capabilities", - "reference": "https://attack.mitre.org/tactics/TA0025/" + "id": [ + "TA0025" + ], + "name": [ + "Test capabilities" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0025/" + ] } } }, @@ -63,10 +71,12 @@ "virustotal": {} }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"confidence\":80,\"created\":\"2021-12-07T18:04:26.451Z\",\"description\":\"Malware available for download from file-sharing sites\",\"extensions\":{\"extension-definition--4582f9eb-bad5-46ac-bd26-1b4201d52537\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Build Capabilities\",\"mitre_attack_tactic_id\":\"TA0024\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0024/\",\"mitre_attack_technique\":\"Obtain/re-use payloads\",\"mitre_attack_technique_id\":\"T1346\",\"mitre_attack_technique_url\":\"https://attack.mitre.org/techniques/T1346/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--ade54b36-752d-4107-a2ed-dd666fa1cb85\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"ru\",\"modified\":\"2021-12-07T18:04:26.451Z\",\"name\":\"https://ru.scribd.com/user/456422024/ForkLog#from_embed\",\"pattern\":\"[url:value = 'https://ru.scribd.com/user/456422024/ForkLog#from_embed']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"CoinProject.info\",\"sixgill_confidence\":80,\"sixgill_feedid\":\"darkfeed_010\",\"sixgill_feedname\":\"malware_download_urls\",\"sixgill_postid\":\"3f8c56e4cf6407ee7608e0f605503cb1e3fcedb9\",\"sixgill_posttitle\":\"Банковский регулятор США напомнил о рисках внедрения криптовалют\",\"sixgill_severity\":70,\"sixgill_source\":\"forum_hyipinvest\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T14:52:00Z\"}", "severity": 70, @@ -93,9 +103,15 @@ } }, "tactic": { - "id": "TA0024", - "name": "Build Capabilities", - "reference": "https://attack.mitre.org/tactics/TA0024/" + "id": [ + "TA0024" + ], + "name": [ + "Build Capabilities" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0024/" + ] } } }, @@ -111,10 +127,12 @@ "virustotal": {} }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"confidence\":70,\"created\":\"2021-12-07T21:24:50.350Z\",\"description\":\"Hash attributed to malware that was discovered in the dark and deep web\",\"extensions\":{\"extension-definition--4582f9eb-bad5-46ac-bd26-1b4201d52537\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Build Capabilities\",\"mitre_attack_tactic_id\":\"TA0024\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0024/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--18f0351d-b61f-4961-ab41-0b10566ee602\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"zh\",\"modified\":\"2021-12-07T21:24:50.350Z\",\"name\":\"1dce6f3ba4a8d355df21a17584c514697ee0c37b51ab5657bc5b3a297b65955f\",\"pattern\":\"[file:hashes.'SHA-256' = '1dce6f3ba4a8d355df21a17584c514697ee0c37b51ab5657bc5b3a297b65955f']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"Admin\",\"sixgill_confidence\":70,\"sixgill_feedid\":\"darkfeed_012\",\"sixgill_feedname\":\"dark_web_hashes\",\"sixgill_post_virustotallink\":\"https://virustotal.com/#/file/1dce6f3ba4a8d355df21a17584c514697ee0c37b51ab5657bc5b3a297b65955f\",\"sixgill_postid\":\"c550f74ba76c0b2c9c46b0577f551ba5ef855813\",\"sixgill_posttitle\":\"海康威视因自身漏洞被黑客利用而遭受攻击\",\"sixgill_severity\":70,\"sixgill_source\":\"blog_hackdig\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T21:23:33Z\"}", "severity": 70, @@ -139,9 +157,15 @@ "type": "file" }, "tactic": { - "id": "TA0024", - "name": "Build Capabilities", - "reference": "https://attack.mitre.org/tactics/TA0024/" + "id": [ + "TA0024" + ], + "name": [ + "Build Capabilities" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0024/" + ] } } }, @@ -157,10 +181,12 @@ "virustotal": {} }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"confidence\":90,\"created\":\"2021-12-07T22:48:59.141Z\",\"description\":\"Shell access to this domain is being sold on dark web markets\",\"extensions\":{\"extension-definition--4582f9eb-bad5-46ac-bd26-1b4201d52537\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Establish \u0026 Maintain Infrastructure\",\"mitre_attack_tactic_id\":\"TA0022\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0022/\",\"mitre_attack_technique\":\"Compromise 3rd party infrastructure to support delivery\",\"mitre_attack_technique_id\":\"T1334\",\"mitre_attack_technique_url\":\"https://attack.mitre.org/techniques/T1334/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--557a6021-b0c0-441a-8fba-e8a734f19ada\",\"indicator_types\":[\"compromised\"],\"lang\":\"en\",\"modified\":\"2021-12-07T22:48:59.141Z\",\"name\":\"sdbpibandung.sch.id\",\"pattern\":\"[domain-name:value = 'sdbpibandung.sch.id']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"enginewo\",\"sixgill_confidence\":90,\"sixgill_feedid\":\"darkfeed_001\",\"sixgill_feedname\":\"compromised_sites\",\"sixgill_postid\":\"955f5379c2828ce483b74a671e498a5f69f9ea36\",\"sixgill_posttitle\":\"Beranda http://sdbpibandung.sch.id\",\"sixgill_severity\":70,\"sixgill_source\":\"market_magbo\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T22:43:29Z\"}", "severity": 70, @@ -183,9 +209,15 @@ } }, "tactic": { - "id": "TA0022", - "name": "Establish \u0026 Maintain Infrastructure", - "reference": "https://attack.mitre.org/tactics/TA0022/" + "id": [ + "TA0022" + ], + "name": [ + "Establish \u0026 Maintain Infrastructure" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0022/" + ] } } } diff --git a/packages/ti_cybersixgill/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/ti_cybersixgill/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index 447dfa89073..28f0136f04d 100644 --- a/packages/ti_cybersixgill/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_cybersixgill/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -3,13 +3,13 @@ description: Initial pipeline for parsing Cybersixgill webhooks processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type value: indicator @@ -182,13 +182,13 @@ processors: ctx.cybersixgill.mitre.description = ref.description; } if (ref?.mitre_attack_tactic != null) { - ctx.threat.tactic.name = ref.mitre_attack_tactic; + ctx.threat.tactic.name = [ref.mitre_attack_tactic]; } if (ref?.mitre_attack_tactic_id != null) { - ctx.threat.tactic.id = ref.mitre_attack_tactic_id; + ctx.threat.tactic.id = [ref.mitre_attack_tactic_id]; } if (ref?.mitre_attack_tactic_url != null) { - ctx.threat.tactic.reference = ref.mitre_attack_tactic_url; + ctx.threat.tactic.reference = [ref.mitre_attack_tactic_url]; } if (ref?.positive_rate != null) { ctx.cybersixgill.virustotal.pr = ref.positive_rate; diff --git a/packages/ti_cybersixgill/data_stream/threat/fields/fields.yml b/packages/ti_cybersixgill/data_stream/threat/fields/fields.yml index 8f92ebcd564..d61ac6c9e9f 100644 --- a/packages/ti_cybersixgill/data_stream/threat/fields/fields.yml +++ b/packages/ti_cybersixgill/data_stream/threat/fields/fields.yml @@ -1,6 +1,5 @@ - name: cybersixgill type: group - release: beta fields: - name: feedname type: keyword diff --git a/packages/ti_cybersixgill/data_stream/threat/manifest.yml b/packages/ti_cybersixgill/data_stream/threat/manifest.yml index 6d7d2f39665..58475a0f7a0 100644 --- a/packages/ti_cybersixgill/data_stream/threat/manifest.yml +++ b/packages/ti_cybersixgill/data_stream/threat/manifest.yml @@ -32,6 +32,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -46,6 +47,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -57,7 +59,7 @@ streams: required: true show_user: false default: 2160h - description: How far back to look for indicators the first time the agent is started. + description: How far back to look for indicators the first time the agent is started. Supported units for this parameter are h/m/s. - name: ssl type: yaml title: SSL diff --git a/packages/ti_cybersixgill/data_stream/threat/sample_event.json b/packages/ti_cybersixgill/data_stream/threat/sample_event.json index 0600dc45c3b..6c1ddd38f54 100644 --- a/packages/ti_cybersixgill/data_stream/threat/sample_event.json +++ b/packages/ti_cybersixgill/data_stream/threat/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-07T13:58:01.596Z", "agent": { - "ephemeral_id": "23a1b4ff-d3ba-4cc1-a31d-65adb7b305fb", - "id": "3f82d126-26ae-4993-a89b-63c5413149e0", + "ephemeral_id": "a7e7cf45-534a-4104-b3c3-9b30d6ebeeb9", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.1" }, "cybersixgill": { "actor": "vaedzy", @@ -25,19 +25,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3f82d126-26ae-4993-a89b-63c5413149e0", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-04-11T08:36:43.266Z", + "category": [ + "threat" + ], + "created": "2023-08-28T14:48:23.885Z", "dataset": "ti_cybersixgill.threat", - "ingested": "2022-04-11T08:36:43Z", + "ingested": "2023-08-28T14:48:24Z", "kind": "enrichment", "original": "{\"confidence\":70,\"created\":\"2021-12-07T13:58:01.596Z\",\"description\":\"Hash attributed to malware that was discovered in the dark and deep web\",\"extensions\":{\"extension-definition--3de9ff00-174d-4d41-87c9-05a27a7e117c\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"positive_rate\":\"medium\",\"source_name\":\"VirusTotal\",\"url\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\"},{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Build Capabilities\",\"mitre_attack_tactic_id\":\"TA0024\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0024/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--302dab0f-64dc-42f5-b99e-702b28c1aaa9\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"en\",\"modified\":\"2021-12-07T13:58:01.596Z\",\"name\":\"4d0f21919d623bd1631ee15ca7429f28;5ce39ef0700b64bd0c71b55caf64ae45d8400965;7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"pattern\":\"[file:hashes.MD5 = '4d0f21919d623bd1631ee15ca7429f28' OR file:hashes.'SHA-1' = '5ce39ef0700b64bd0c71b55caf64ae45d8400965' OR file:hashes.'SHA-256' = '7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"vaedzy\",\"sixgill_confidence\":70,\"sixgill_feedid\":\"darkfeed_012\",\"sixgill_feedname\":\"dark_web_hashes\",\"sixgill_post_virustotallink\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"sixgill_postid\":\"c0c9a0085fb5281cfb40a0ddb62e1d2c6a53eb7a\",\"sixgill_posttitle\":\"[病毒样本] #Trickbot (2021-12-07)\",\"sixgill_severity\":70,\"sixgill_source\":\"forum_kafan\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T02:55:17Z\"}", "severity": 70, @@ -69,9 +71,15 @@ "type": "file" }, "tactic": { - "id": "TA0024", - "name": "Build Capabilities", - "reference": "https://attack.mitre.org/tactics/TA0024/" + "id": [ + "TA0024" + ], + "name": [ + "Build Capabilities" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0024/" + ] } } } \ No newline at end of file diff --git a/packages/ti_cybersixgill/docs/README.md b/packages/ti_cybersixgill/docs/README.md index a36973c3b36..3178e38be9b 100644 --- a/packages/ti_cybersixgill/docs/README.md +++ b/packages/ti_cybersixgill/docs/README.md @@ -42,10 +42,10 @@ The Cybersixgill Darkfeed integration collects threat intelligence from the Dark | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | @@ -102,11 +102,11 @@ An example event for `threat` looks as following: { "@timestamp": "2021-12-07T13:58:01.596Z", "agent": { - "ephemeral_id": "23a1b4ff-d3ba-4cc1-a31d-65adb7b305fb", - "id": "3f82d126-26ae-4993-a89b-63c5413149e0", + "ephemeral_id": "a7e7cf45-534a-4104-b3c3-9b30d6ebeeb9", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.0.0" + "version": "8.9.1" }, "cybersixgill": { "actor": "vaedzy", @@ -126,19 +126,21 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3f82d126-26ae-4993-a89b-63c5413149e0", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.0.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-04-11T08:36:43.266Z", + "category": [ + "threat" + ], + "created": "2023-08-28T14:48:23.885Z", "dataset": "ti_cybersixgill.threat", - "ingested": "2022-04-11T08:36:43Z", + "ingested": "2023-08-28T14:48:24Z", "kind": "enrichment", "original": "{\"confidence\":70,\"created\":\"2021-12-07T13:58:01.596Z\",\"description\":\"Hash attributed to malware that was discovered in the dark and deep web\",\"extensions\":{\"extension-definition--3de9ff00-174d-4d41-87c9-05a27a7e117c\":{\"extension_type\":\"toplevel-property-extension\"}},\"external_references\":[{\"positive_rate\":\"medium\",\"source_name\":\"VirusTotal\",\"url\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\"},{\"description\":\"Mitre attack tactics and technique reference\",\"mitre_attack_tactic\":\"Build Capabilities\",\"mitre_attack_tactic_id\":\"TA0024\",\"mitre_attack_tactic_url\":\"https://attack.mitre.org/tactics/TA0024/\",\"source_name\":\"mitre-attack\"}],\"id\":\"indicator--302dab0f-64dc-42f5-b99e-702b28c1aaa9\",\"indicator_types\":[\"malicious-activity\"],\"lang\":\"en\",\"modified\":\"2021-12-07T13:58:01.596Z\",\"name\":\"4d0f21919d623bd1631ee15ca7429f28;5ce39ef0700b64bd0c71b55caf64ae45d8400965;7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"pattern\":\"[file:hashes.MD5 = '4d0f21919d623bd1631ee15ca7429f28' OR file:hashes.'SHA-1' = '5ce39ef0700b64bd0c71b55caf64ae45d8400965' OR file:hashes.'SHA-256' = '7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d']\",\"pattern_type\":\"stix\",\"sixgill_actor\":\"vaedzy\",\"sixgill_confidence\":70,\"sixgill_feedid\":\"darkfeed_012\",\"sixgill_feedname\":\"dark_web_hashes\",\"sixgill_post_virustotallink\":\"https://virustotal.com/#/file/7bdf8b8594ec269da864ee662334f4da53d4820a3f0f8aa665a0fa096ca8f22d\",\"sixgill_postid\":\"c0c9a0085fb5281cfb40a0ddb62e1d2c6a53eb7a\",\"sixgill_posttitle\":\"[病毒样本] #Trickbot (2021-12-07)\",\"sixgill_severity\":70,\"sixgill_source\":\"forum_kafan\",\"spec_version\":\"2.1\",\"type\":\"indicator\",\"valid_from\":\"2021-12-07T02:55:17Z\"}", "severity": 70, @@ -170,9 +172,15 @@ An example event for `threat` looks as following: "type": "file" }, "tactic": { - "id": "TA0024", - "name": "Build Capabilities", - "reference": "https://attack.mitre.org/tactics/TA0024/" + "id": [ + "TA0024" + ], + "name": [ + "Build Capabilities" + ], + "reference": [ + "https://attack.mitre.org/tactics/TA0024/" + ] } } } diff --git a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738.json b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738.json index deb01c7313f..d92a13f17f6 100644 --- a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738.json +++ b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about file type indicators from the Cybersixgill integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -78,6 +77,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -116,7 +117,7 @@ }, "panelIndex": "09ba3dc0-e2e2-4799-b47f-bb919bf290a1", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -135,7 +136,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "98786f76-dac4-4fc7-9cad-8bfce17bd00d": { "columnOrder": [ @@ -165,12 +166,15 @@ "visualization": { "accessor": "8622e147-406f-4711-8f68-e2425614106e", "layerId": "98786f76-dac4-4fc7-9cad-8bfce17bd00d", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique File Types [Logs AbuseCH]", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -185,7 +189,7 @@ "panelIndex": "31ea16d1-7591-42a7-b773-6fca00e5db14", "title": "Unique File Types [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -208,7 +212,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b83c382d-fab9-4e60-a632-475e221cc20c": { "columnOrder": [ @@ -238,11 +242,14 @@ "visualization": { "accessor": "eda3c6d9-dacb-4e5e-b977-50104f76e91a", "layerId": "b83c382d-fab9-4e60-a632-475e221cc20c", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique MD5 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -257,7 +264,7 @@ "panelIndex": "4d3e11dc-c4cc-4373-bb83-3d39fe6ffa98", "title": "Unique MD5 [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -276,7 +283,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "22fbfeae-5b51-4d9d-b463-0d0dcb36e05d": { "columnOrder": [ @@ -308,7 +315,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -325,15 +332,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "27d0558e-428b-40a7-aea7-4195a095ff3f" - ], "layerId": "22fbfeae-5b51-4d9d-b463-0d0dcb36e05d", "layerType": "data", "legendDisplay": "default", - "metric": "4e91e0ea-9ccc-43cf-b81c-513d9f18ead7", + "legendSize": "auto", + "metrics": [ + "4e91e0ea-9ccc-43cf-b81c-513d9f18ead7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "27d0558e-428b-40a7-aea7-4195a095ff3f" + ] } ], "shape": "donut" @@ -356,7 +366,7 @@ "panelIndex": "c66ad183-f4f0-4605-b35d-85b7038403fd", "title": "Mitre Tactics ID [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -375,7 +385,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9722683d-8451-450c-b62c-8f28e7263f1b": { "columnOrder": [ @@ -389,7 +399,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd": { "dataType": "string", @@ -424,15 +434,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd" - ], "layerId": "9722683d-8451-450c-b62c-8f28e7263f1b", "layerType": "data", "legendDisplay": "default", - "metric": "0ceb1563-e3cd-4a98-a469-737bee1cb9ef", + "legendSize": "auto", + "metrics": [ + "0ceb1563-e3cd-4a98-a469-737bee1cb9ef" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd" + ] } ], "shape": "donut" @@ -455,7 +468,7 @@ "panelIndex": "fcc44298-dfb6-4bd4-a63d-e845ce3eb859", "title": "Mitre Tactics Name [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -478,7 +491,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "85ad73b3-3b76-49f1-ad20-6256b58918f8": { "columnOrder": [ @@ -508,11 +521,14 @@ "visualization": { "accessor": "289bd005-bdd2-4f3b-83b9-ad6ae52a9ed3", "layerId": "85ad73b3-3b76-49f1-ad20-6256b58918f8", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique SHA1 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -527,7 +543,7 @@ "panelIndex": "e9b6f0ad-5e6b-44da-923e-dc0d5ccfdfea", "title": "Unique SHA1 [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -550,7 +566,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "49b7070a-f1d3-46e1-a980-2f6d6d130167": { "columnOrder": [ @@ -580,11 +596,14 @@ "visualization": { "accessor": "b6c5e221-88ff-490e-bd3e-188b3e0dd1f4", "layerId": "49b7070a-f1d3-46e1-a980-2f6d6d130167", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Unique SHA256 [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -599,7 +618,7 @@ "panelIndex": "93e32abe-87e3-469e-b7e9-a7ef7dfa2cce", "title": "Unique SHA256 [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -618,7 +637,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9646600b-883b-40d0-af92-d25f7fb3fcf6": { "columnOrder": [ @@ -633,7 +652,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b21fdfe6-05b1-474f-9748-1923a4c16ebe": { "customLabel": true, @@ -677,7 +696,9 @@ } ], "layerId": "9646600b-883b-40d0-af92-d25f7fb3fcf6", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -697,78 +718,145 @@ "panelIndex": "0638c316-a573-412f-b3c4-f72dde07c6e8", "title": "Top Feeds [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-47467d31-035d-46ff-a9ed-783523f2c423", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "47467d31-035d-46ff-a9ed-783523f2c423": { + "columnOrder": [ + "39fa0863-61e1-4972-8289-0629b8bc2b83", + "f943b105-5dba-4d9a-af11-c0a2527aa993" + ], + "columns": { + "39fa0863-61e1-4972-8289-0629b8bc2b83": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Tags", + "operationType": "terms", + "params": { + "exclude": [ + "forwarded|preserve_original_event|cybersixgill-threat" + ], + "excludeIsRegex": true, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f943b105-5dba-4d9a-af11-c0a2527aa993", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "tags" + }, + "f943b105-5dba-4d9a-af11-c0a2527aa993": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } }, - { - "enabled": true, - "id": "2", - "params": { - "exclude": "forwarded|preserve_original_event|cybersixgill-threat", - "field": "tags", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "index": "logs-*", - "query": { - "language": "kuery", - "query": "" + "textBased": { + "layers": {} } - } - }, - "description": "", - "id": "", - "params": { - "maxFontSize": 72, - "minFontSize": 18, - "orientation": "single", - "palette": { - "name": "default", - "type": "palette" }, - "scale": "linear", - "showLabel": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "f943b105-5dba-4d9a-af11-c0a2527aa993" + ], + "layerId": "47467d31-035d-46ff-a9ed-783523f2c423", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "39fa0863-61e1-4972-8289-0629b8bc2b83" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, "title": "", - "type": "tagcloud", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 19, - "i": "463b3747-56ee-425d-a2ac-a94a44b4995e", + "i": "6866585e-4589-4a7e-9763-3b2493f488e7", "w": 14, "x": 18, "y": 16 }, - "panelIndex": "463b3747-56ee-425d-a2ac-a94a44b4995e", + "panelIndex": "6866585e-4589-4a7e-9763-3b2493f488e7", "title": "File Tags [Logs Cybersixgill]", - "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -787,7 +875,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d9757b54-ffa7-45da-b31b-1387c4a2d26e": { "columnOrder": [ @@ -801,7 +889,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "af192ae4-c012-49db-b768-85d876f2688e": { "dataType": "string", @@ -836,15 +924,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "af192ae4-c012-49db-b768-85d876f2688e" - ], "layerId": "d9757b54-ffa7-45da-b31b-1387c4a2d26e", "layerType": "data", "legendDisplay": "default", - "metric": "5e611ce4-0c5a-4e10-b87e-30c88affa80e", + "legendSize": "auto", + "metrics": [ + "5e611ce4-0c5a-4e10-b87e-30c88affa80e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "af192ae4-c012-49db-b768-85d876f2688e" + ] } ], "shape": "donut" @@ -867,17 +958,18 @@ "panelIndex": "256a7b33-485f-4715-90f3-768bea61d23e", "title": "Confidence Levels [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Cybersixgill] Files", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:51:38.930Z", "id": "ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -967,7 +1059,7 @@ }, { "id": "logs-*", - "name": "463b3747-56ee-425d-a2ac-a94a44b4995e:kibanaSavedObjectMeta.searchSourceJSON.index", + "name": "6866585e-4589-4a7e-9763-3b2493f488e7:indexpattern-datasource-layer-47467d31-035d-46ff-a9ed-783523f2c423", "type": "index-pattern" }, { @@ -982,7 +1074,7 @@ }, { "id": "ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", - "name": "tag-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", + "name": "tag-ref-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", "type": "tag" } ], diff --git a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738.json b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738.json index dd913108d05..5ce1c3db7ca 100644 --- a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738.json +++ b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about URL type indicators from the Cybersixgill Darkfeed integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -78,6 +77,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -118,7 +119,7 @@ "panelIndex": "4c3ed6e1-8b4e-4eab-8d84-70ed4f506216", "title": "Files Navigation Textbox [Logs AbuseCH]", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -137,7 +138,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a6fa56f8-32fa-405d-8771-dade4fe75d62": { "columnOrder": [ @@ -167,12 +168,15 @@ "visualization": { "accessor": "848c463b-bbc1-4b6a-af3e-76d844eb3cc5", "layerId": "a6fa56f8-32fa-405d-8771-dade4fe75d62", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -187,7 +191,7 @@ "panelIndex": "73a752f9-bde5-4396-8ede-e9e77a37182d", "title": "Unique File Extensions [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -206,7 +210,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c94400ee-a135-4a99-9693-5879d29f7aad": { "columnOrder": [ @@ -236,12 +240,15 @@ "visualization": { "accessor": "2934249f-fce5-4637-87ff-d2596d1b6ec5", "layerId": "c94400ee-a135-4a99-9693-5879d29f7aad", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -256,7 +263,7 @@ "panelIndex": "02f1732b-a981-4fba-8b27-b944f2f3c98c", "title": "Unique Domains [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -275,7 +282,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "db89074c-e1fe-4091-bdb1-e42a36e82bac": { "columnOrder": [ @@ -290,7 +297,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "b284ea2a-a2cd-4d08-bf44-fc73c08b5694": { "customLabel": true, @@ -334,7 +341,9 @@ } ], "layerId": "db89074c-e1fe-4091-bdb1-e42a36e82bac", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -354,7 +363,7 @@ "panelIndex": "8994501a-1550-4cf2-857f-d6b6491ffb62", "title": "Most Popular Domains [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -373,7 +382,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0f63318a-a857-4d83-89ce-a94e2242b79e": { "columnOrder": [ @@ -387,7 +396,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "df0791a6-247c-4434-a43a-fdea7577ca34": { "dataType": "string", @@ -422,15 +431,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "df0791a6-247c-4434-a43a-fdea7577ca34" - ], "layerId": "0f63318a-a857-4d83-89ce-a94e2242b79e", "layerType": "data", "legendDisplay": "show", - "metric": "77a48096-02aa-4b7a-8a7b-131fc38988bd", + "legendSize": "auto", + "metrics": [ + "77a48096-02aa-4b7a-8a7b-131fc38988bd" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "df0791a6-247c-4434-a43a-fdea7577ca34" + ] } ], "shape": "donut" @@ -453,7 +465,7 @@ "panelIndex": "ab7ab31c-e76f-4613-b17d-fdd909f17e0d", "title": "Percentage of URL Schema used [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -472,7 +484,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9fa49c4c-5544-472d-afce-e51d6a5687fe": { "columnOrder": [ @@ -504,7 +516,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -521,16 +533,19 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "15e2b5ad-2040-4253-89a6-60f085c66f86", - "15e2b5ad-2040-4253-89a6-60f085c66f86" - ], "layerId": "9fa49c4c-5544-472d-afce-e51d6a5687fe", "layerType": "data", "legendDisplay": "default", - "metric": "b9a631fe-5f49-4db2-a076-bcbf5410aec9", + "legendSize": "auto", + "metrics": [ + "b9a631fe-5f49-4db2-a076-bcbf5410aec9" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "15e2b5ad-2040-4253-89a6-60f085c66f86", + "15e2b5ad-2040-4253-89a6-60f085c66f86" + ] } ], "shape": "treemap" @@ -553,7 +568,7 @@ "panelIndex": "fda93ed1-72f0-4489-80b7-9e69d14f30aa", "title": "Most Popular File Extensions [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -572,7 +587,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "22fbfeae-5b51-4d9d-b463-0d0dcb36e05d": { "columnOrder": [ @@ -604,7 +619,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -621,15 +636,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "27d0558e-428b-40a7-aea7-4195a095ff3f" - ], "layerId": "22fbfeae-5b51-4d9d-b463-0d0dcb36e05d", "layerType": "data", "legendDisplay": "default", - "metric": "4e91e0ea-9ccc-43cf-b81c-513d9f18ead7", + "legendSize": "auto", + "metrics": [ + "4e91e0ea-9ccc-43cf-b81c-513d9f18ead7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "27d0558e-428b-40a7-aea7-4195a095ff3f" + ] } ], "shape": "donut" @@ -652,7 +670,7 @@ "panelIndex": "08fe9c8a-d5d8-4c8f-ab42-b0cfb0390008", "title": "Mitre Tactics ID [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -671,7 +689,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9722683d-8451-450c-b62c-8f28e7263f1b": { "columnOrder": [ @@ -685,7 +703,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd": { "dataType": "string", @@ -720,15 +738,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd" - ], "layerId": "9722683d-8451-450c-b62c-8f28e7263f1b", "layerType": "data", "legendDisplay": "default", - "metric": "0ceb1563-e3cd-4a98-a469-737bee1cb9ef", + "legendSize": "auto", + "metrics": [ + "0ceb1563-e3cd-4a98-a469-737bee1cb9ef" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "4e60dfd6-afe5-47dc-a5a0-3cfdb62f01dd" + ] } ], "shape": "donut" @@ -751,17 +772,18 @@ "panelIndex": "a828d701-6a36-4401-8b35-419b4454c6fc", "title": "Mitre Tactics Name [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Cybersixgill] URLs", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:46:26.520Z", "id": "ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -851,7 +873,7 @@ }, { "id": "ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", - "name": "tag-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", + "name": "tag-ref-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", "type": "tag" } ], diff --git a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738.json b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738.json index c6946a8190f..134f861b7eb 100644 --- a/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738.json +++ b/packages/ti_cybersixgill/kibana/dashboard/ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738.json @@ -1,7 +1,6 @@ { "attributes": { "description": "Dashboard providing statistics about indicators ingested from the Cybersixgill Darkfeed integration", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -57,6 +56,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -95,7 +96,7 @@ }, "panelIndex": "555e9e6c-04e9-4022-b6df-bda07dde30c4", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -113,7 +114,7 @@ "meta": { "alias": null, "disabled": false, - "index": "logs-*", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", "key": "event.dataset", "negate": false, "params": [ @@ -153,7 +154,7 @@ "meta": { "alias": null, "disabled": false, - "index": "logs-*", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", "key": "event.kind", "negate": false, "params": { @@ -242,7 +243,7 @@ "panelIndex": "e971fedd-6afd-4d03-93ac-d0c751acc254", "title": "Feed and Indicator Selector [Logs Cybersixgill]", "type": "visualization", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -266,7 +267,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "070f5dbc-7687-4e97-9a57-5542b401c13f": { "columnOrder": [ @@ -280,7 +281,7 @@ "label": "Total Indicators", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -296,11 +297,14 @@ "visualization": { "accessor": "1e352b49-3b83-44a6-98fe-8703d30f2517", "layerId": "070f5dbc-7687-4e97-9a57-5542b401c13f", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Indicators [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -315,7 +319,7 @@ "panelIndex": "d37eb797-f273-43c2-9004-b947891cce55", "title": "Total Indicators [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -338,7 +342,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1e757dc0-2e6d-4bd2-aa38-7da9133ca960": { "columnOrder": [ @@ -352,7 +356,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "66779b74-d127-4249-93e4-b8cd9c39b91f": { "dataType": "string", @@ -403,12 +407,13 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right", "showSingleSeries": false }, "preferredSeriesType": "bar_horizontal", "title": "Empty XY chart", - "valueLabels": "inside", + "valueLabels": "show", "xTitle": "Providers", "yLeftExtent": { "mode": "full" @@ -435,7 +440,7 @@ "panelIndex": "86d83606-4176-44b1-b3f3-011d5b5b4b58", "title": "Total Indicators per Provider [Logs AbuseCH]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -454,7 +459,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "720e8ef8-eec8-4aff-abe0-c14c0bab64db": { "columnOrder": [ @@ -486,7 +491,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -503,15 +508,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "62778b77-cc47-48e1-8648-02ffd9ed8b72" - ], "layerId": "720e8ef8-eec8-4aff-abe0-c14c0bab64db", "layerType": "data", "legendDisplay": "default", - "metric": "8e35c18d-ceea-4462-b205-daf206f180cc", + "legendSize": "auto", + "metrics": [ + "8e35c18d-ceea-4462-b205-daf206f180cc" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "62778b77-cc47-48e1-8648-02ffd9ed8b72" + ] } ], "shape": "donut" @@ -534,7 +542,7 @@ "panelIndex": "f3141aca-8e35-48a7-9ac8-cc43fa1a47c0", "title": "Mitre Tactics [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -557,7 +565,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "df8e3a91-700b-428a-a763-525076e4d3c8": { "columnOrder": [ @@ -587,11 +595,14 @@ "visualization": { "accessor": "e4f78e2f-f0a7-4cc6-96d0-af607ffbf326", "layerId": "df8e3a91-700b-428a-a763-525076e4d3c8", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "Total Datastreams [Logs AbuseCH]", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -606,7 +617,7 @@ "panelIndex": "6509dcc9-bb9c-4c1f-80e9-612f67ada340", "title": "Total Datastreams [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" }, { "embeddableConfig": { @@ -629,7 +640,7 @@ }, "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c1cee622-e3dd-4d6b-a28a-0fb19dc2c7b7": { "columnOrder": [ @@ -644,7 +655,7 @@ "label": "Count of records", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "4d7ca99c-8a53-4a7f-96db-409251c0e391": { "dataType": "string", @@ -670,6 +681,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "30s" }, "scale": "interval", @@ -711,6 +723,7 @@ "legend": { "isInside": false, "isVisible": true, + "legendSize": "auto", "position": "bottom", "shouldTruncate": false, "showSingleSeries": true @@ -745,17 +758,18 @@ "panelIndex": "aab4fac0-d39c-4521-aa9b-0a49d5938e9e", "title": "Indicators ingested per Datastream [Logs Cybersixgill]", "type": "lens", - "version": "8.0.0-SNAPSHOT" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Cybersixgill] Overview", "version": 1 }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:46:34.989Z", "id": "ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738", "migrationVersion": { - "dashboard": "8.0.0" + "dashboard": "8.7.0" }, "references": [ { @@ -845,7 +859,7 @@ }, { "id": "ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", - "name": "tag-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", + "name": "tag-ref-ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", "type": "tag" } ], diff --git a/packages/ti_cybersixgill/kibana/tag/ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738.json b/packages/ti_cybersixgill/kibana/tag/ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738.json index ecc0f01b437..54f4421a486 100644 --- a/packages/ti_cybersixgill/kibana/tag/ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738.json +++ b/packages/ti_cybersixgill/kibana/tag/ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738.json @@ -4,7 +4,8 @@ "description": "", "name": "Cybersixgill" }, - "coreMigrationVersion": "8.0.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:45:21.934Z", "id": "ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738", "migrationVersion": { "tag": "8.0.0" diff --git a/packages/ti_cybersixgill/kibana/tags.yml b/packages/ti_cybersixgill/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_cybersixgill/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_cybersixgill/manifest.yml b/packages/ti_cybersixgill/manifest.yml index 68680143fb0..93b1a9a4149 100644 --- a/packages/ti_cybersixgill/manifest.yml +++ b/packages/ti_cybersixgill/manifest.yml @@ -1,14 +1,13 @@ name: ti_cybersixgill title: Cybersixgill -version: "1.13.0" -release: ga +version: "1.21.0" description: Ingest threat intelligence indicators from Cybersixgill with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 policy_templates: - name: cybersixgill title: Cybersixgill Threat Intel @@ -19,6 +18,7 @@ policy_templates: description: "Ingest threat intelligence indicators from Cybersixgill Darkfeed with Elastic Agent." owner: github: elastic/security-external-integrations + type: elastic icons: - src: /img/cybersixgill.svg title: Cybersixgill diff --git a/packages/ti_maltiverse/_dev/build/build.yml b/packages/ti_maltiverse/_dev/build/build.yml new file mode 100644 index 00000000000..9da3f46d46b --- /dev/null +++ b/packages/ti_maltiverse/_dev/build/build.yml @@ -0,0 +1,3 @@ +dependencies: + ecs: + reference: git@8.7 diff --git a/packages/ti_maltiverse/_dev/build/docs/README.md b/packages/ti_maltiverse/_dev/build/docs/README.md new file mode 100644 index 00000000000..92c385fc760 --- /dev/null +++ b/packages/ti_maltiverse/_dev/build/docs/README.md @@ -0,0 +1,16 @@ +# Maltiverse Integration + +[Maltiverse](https://maltiverse.com) is a threat intelligence platform. It works as a broker for Threat intelligence sources that are aggregated from more than a hundred different Public, Private and Community sources. Once the data is ingested, the IoC Scoring Algorithm applies a qualitative classification to the IoC that changes. Finally this data can be queried in a Threat Intelligence feed that can be delivered to your Firewalls, SOAR, SIEM, EDR or any other technology. + +This integration fetches Maltiverse Threat Intelligence feeds and add them into Elastic Threat Intelligence. It supports `hostname`, `hash`, `ipv4` and `url` indicators. + +In order to download feed you need to [register](https://maltiverse.com/auth/register) and generate an API key on you profile page. + +## IoCs Expiration +Since we want to retain only valuable information and avoid duplicated data, the Maltiverse Elastic integration forces the indicators to rotate into a custom index called: `logs-ti_maltiverse_latest.indicator`. +**Please, refer to this index in order to set alerts and so on.** + +### How it works +This is possible thanks to a transform rule installed along with the integration. The transform rule parses the data_stream content that is pulled from Maltiverse and only adds new indicators. + +Both, the data_stream and the _latest index have applied expiration through ILM and a retention policy in the transform respectively. diff --git a/packages/ti_maltiverse/_dev/deploy/docker/config.yml b/packages/ti_maltiverse/_dev/deploy/docker/config.yml new file mode 100644 index 00000000000..0daf2aad737 --- /dev/null +++ b/packages/ti_maltiverse/_dev/deploy/docker/config.yml @@ -0,0 +1,124 @@ +rules: + - path: /collection/test/download + methods: [GET] + request_headers: + Accept: "application/json" + Authorization: "Bearer testing_token" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + [ + { + "blacklist": [ + { + "count": 1, + "description": "QakBot", + "first_seen": "2022-11-03 06:23:53", + "labels": [ + "malicious-activity" + ], + "last_seen": "2022-11-05 05:37:57", + "source": "ThreatFox Abuse.ch" + } + ], + "classification": "malicious", + "creation_time": "2022-11-03 06:23:53", + "domain": "autooutletllc.com", + "hostname": "autooutletllc.com", + "is_alive": false, + "is_cnc": true, + "is_distributing_malware": false, + "is_iot_threat": false, + "is_phishing": false, + "last_online_time": "2022-11-05 05:37:57", + "modification_time": "2022-11-05 05:37:57", + "tag": [ + "bb05", + "iso", + "qakbot", + "qbot", + "quakbot", + "tr", + "w19", + "zip", + "oakboat", + "pinkslipbot" + ], + "tld": "com", + "type": "url", + "url": "https://autooutletllc.com/spares.php", + "urlchecksum": "4aa7a29969dc1dffa5cad5af6cb343b9a9b40ea9646fed619d4c8d6472629128" + }, + { + "address": "Internet Cell\nBharat Sanchar Nigam Limited.\n8th Floor,148-B Statesman House\nBarakhamba Road, New Delhi - 110 001", + "as_name": "AS9829 National Internet Backbone", + "asn_cidr": "117.216.16.0/20", + "asn_country_code": "IN", + "asn_date": "2007-08-01 00:00:00", + "asn_registry": "apnic", + "blacklist": [ + { + "count": 1, + "description": "Mirai", + "first_seen": "2022-11-07 00:18:53", + "labels": [ + "malicious-activity" + ], + "last_seen": "2022-11-09 00:06:43", + "source": "ThreatFox Abuse.ch" + }, + { + "count": 1, + "description": "Mail Spammer", + "first_seen": "2022-11-07 00:19:04", + "last_seen": "2022-11-07 00:19:04", + "source": "Barracuda" + } + ], + "cidr": [ + "117.216.0.0/15" + ], + "city": "Thiruvananthapuram", + "classification": "malicious", + "country_code": "IN", + "creation_time": "2022-11-07 00:18:53", + "email": [ + "abuse1@bsnl.co.in", + "hostmaster@bsnl.co.in", + "dnwplg@bsnl.in" + ], + "ip_addr": "117.216.30.56", + "is_cdn": false, + "is_cnc": true, + "is_distributing_malware": false, + "is_hosting": false, + "is_iot_threat": true, + "is_known_attacker": true, + "is_known_scanner": false, + "is_mining_pool": false, + "is_open_proxy": false, + "is_sinkhole": false, + "is_tor_node": false, + "is_vpn_node": false, + "location": { + "lat": 8.5069, + "lon": 76.9569 + }, + "modification_time": "2022-11-09 00:06:43", + "number_of_blacklisted_domains_resolving": 0, + "number_of_domains_resolving": 0, + "number_of_offline_malicious_urls_allocated": 0, + "number_of_online_malicious_urls_allocated": 0, + "number_of_whitelisted_domains_resolving": 0, + "registrant_name": "Broadband Multiplay Project, O/o DGM BB, NOC BSNL Bangalore", + "tag": [ + "mirai", + "port:12996", + "katana" + ], + "type": "ip" + } + ] diff --git a/packages/ti_maltiverse/_dev/deploy/docker/docker-compose.yml b/packages/ti_maltiverse/_dev/deploy/docker/docker-compose.yml new file mode 100644 index 00000000000..197b6fbef34 --- /dev/null +++ b/packages/ti_maltiverse/_dev/deploy/docker/docker-compose.yml @@ -0,0 +1,14 @@ +version: "2.3" +services: + maltiverse: + image: docker.elastic.co/observability/stream:v0.6.1 + ports: + - 8080 + environment: + PORT: "8080" + volumes: + - ./config.yml:/config.yml + command: + - http-server + - --addr=:8080 + - --config=/config.yml diff --git a/packages/ti_maltiverse/changelog.yml b/packages/ti_maltiverse/changelog.yml new file mode 100644 index 00000000000..f6f01d9fbc7 --- /dev/null +++ b/packages/ti_maltiverse/changelog.yml @@ -0,0 +1,20 @@ +- version: "0.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.2.1" + changes: + - description: Remove dotted YAML keys. + type: bugfix + link: https://github.com/elastic/integrations/pull/7804 +- version: "0.2.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7340 +- version: "0.1.0" + changes: + - description: initial implementation + type: enhancement + link: https://github.com/elastic/integrations/pull/6741 diff --git a/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-common-config.yml b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json new file mode 100644 index 00000000000..6bddca44f87 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json @@ -0,0 +1,10 @@ +{ + "events": [ + { + "message": "{\"address\":\"Beijing, China\",\"as_name\":\"AS45090 - Shenzhen Tencent Computer Systems Company Limited\",\"asn_cidr\":\"1.128.0.0/11\",\"asn_country_code\":\"CN\",\"asn_date\":\"2010-06-11 00:00:00\",\"asn_registry\":\"apnic\",\"blacklist\":{\"count\":1,\"description\":\"Cobalt Strike\",\"external_references\":[{\"description\":\"Cobalt Strike\",\"external_id\":\"S0154\",\"source_name\":\"mitre-attack\",\"url\":\"https://attack.mitre.org/software/S0154/\"}],\"first_seen\":\"2023-06-01 18:17:07\",\"labels\":[\"malicious-activity\"],\"last_seen\":\"2023-06-03 16:18:21\",\"source\":\"ThreatFox Abuse.ch\"},\"cidr\":[\"1.128.0.0/11\"],\"city\":\"Beijing\",\"classification\":\"malicious\",\"country_code\":\"CN\",\"creation_time\":\"2023-06-01 18:17:07\",\"email\":[\"ipas@cnnic.cn\",\"clarkcheng@tencent.com\",\"klayliang@tencent.com\"],\"ip_addr\":\"1.128.0.1\",\"is_cdn\":false,\"is_cnc\":true,\"is_distributing_malware\":false,\"is_hosting\":false,\"is_iot_threat\":false,\"is_known_attacker\":false,\"is_known_scanner\":false,\"is_mining_pool\":false,\"is_open_proxy\":false,\"is_sinkhole\":false,\"is_tor_node\":false,\"is_vpn_node\":false,\"location\":{\"lat\":39.904211,\"lon\":116.407395},\"modification_time\":\"2023-06-03 16:18:22\",\"number_of_blacklisted_domains_resolving\":0,\"number_of_domains_resolving\":0,\"number_of_offline_malicious_urls_allocated\":0,\"number_of_online_malicious_urls_allocated\":0,\"number_of_whitelisted_domains_resolving\":0,\"postal_code\":\"100010\",\"registrant_name\":\"Tencent cloud computing (Beijing) Co., Ltd.\\nFloor 6, Yinke Building,38 Haidian St,\\nHaidian District Beijing\",\"tag\":[\"cobaltstrike\",\"cs-watermark-987654321\",\"tencent-net-ap shenzhen tencent computer systems company limited\",\"port:80\",\"agentemis\",\"beacon\",\"cobeacon\"],\"type\":\"ip\"}" + }, + { + "message": "{\"as_name\":\"AS50261 ACE Telecom Kft\",\"blacklist\":{\"count\":1,\"description\":\"2023-05-31 01:28:18\",\"first_seen\":\"2023-05-31 03:21:47\",\"labels\":[\"malicious-activity\"],\"last_seen\":\"2023-05-31 06:23:25\",\"source\":\"URLhaus Abuse.ch\"},\"classification\":\"malicious\",\"creation_time\":\"2023-05-31 02:17:10\",\"domain\":\"1ct-diamond.hu\",\"domain_consonants\":7,\"domain_lenght\":14,\"entropy\":3.6644977792004623,\"hostname\":\"1ct-diamond.hu\",\"is_alive\":true,\"is_cnc\":true,\"is_distributing_malware\":false,\"is_iot_threat\":false,\"is_mining_pool\":false,\"is_phishing\":false,\"is_storing_phishing\":false,\"last_online_time\":\"2023-06-21 06:23:33\",\"modification_time\":\"2023-05-31 07:36:01\",\"number_of_offline_malicious_urls_allocated\":1,\"number_of_online_malicious_urls_allocated\":0,\"resolved_ip\":[{\"ip_addr\":\"81.2.69.142\",\"timestamp\":\"2023-06-21 06:23:33\"}],\"tag\":[\"js\",\"obama265\",\"qakbot\",\"zip\",\"oakboat\",\"pinkslipbot\",\"qbot\",\"quakbot\",\"malware_download\"],\"tld\":\"hu\",\"type\":\"hostname\"}" + } + ] +} \ No newline at end of file diff --git a/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json-expected.json b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json-expected.json new file mode 100644 index 00000000000..258c94265f4 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/_dev/test/pipeline/test-maltiverse-feed-event.json-expected.json @@ -0,0 +1,112 @@ +{ + "expected": [ + { + "@timestamp": "2023-06-03T16:18:21.000Z", + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "threat" + ], + "id": "7m8aIk40YueRMBFqMuLnDKQvxOM=", + "kind": "enrichment", + "original": "{\"address\":\"Beijing, China\",\"as_name\":\"AS45090 - Shenzhen Tencent Computer Systems Company Limited\",\"asn_cidr\":\"1.128.0.0/11\",\"asn_country_code\":\"CN\",\"asn_date\":\"2010-06-11 00:00:00\",\"asn_registry\":\"apnic\",\"blacklist\":{\"count\":1,\"description\":\"Cobalt Strike\",\"external_references\":[{\"description\":\"Cobalt Strike\",\"external_id\":\"S0154\",\"source_name\":\"mitre-attack\",\"url\":\"https://attack.mitre.org/software/S0154/\"}],\"first_seen\":\"2023-06-01 18:17:07\",\"labels\":[\"malicious-activity\"],\"last_seen\":\"2023-06-03 16:18:21\",\"source\":\"ThreatFox Abuse.ch\"},\"cidr\":[\"1.128.0.0/11\"],\"city\":\"Beijing\",\"classification\":\"malicious\",\"country_code\":\"CN\",\"creation_time\":\"2023-06-01 18:17:07\",\"email\":[\"ipas@cnnic.cn\",\"clarkcheng@tencent.com\",\"klayliang@tencent.com\"],\"ip_addr\":\"1.128.0.1\",\"is_cdn\":false,\"is_cnc\":true,\"is_distributing_malware\":false,\"is_hosting\":false,\"is_iot_threat\":false,\"is_known_attacker\":false,\"is_known_scanner\":false,\"is_mining_pool\":false,\"is_open_proxy\":false,\"is_sinkhole\":false,\"is_tor_node\":false,\"is_vpn_node\":false,\"location\":{\"lat\":39.904211,\"lon\":116.407395},\"modification_time\":\"2023-06-03 16:18:22\",\"number_of_blacklisted_domains_resolving\":0,\"number_of_domains_resolving\":0,\"number_of_offline_malicious_urls_allocated\":0,\"number_of_online_malicious_urls_allocated\":0,\"number_of_whitelisted_domains_resolving\":0,\"postal_code\":\"100010\",\"registrant_name\":\"Tencent cloud computing (Beijing) Co., Ltd.\\nFloor 6, Yinke Building,38 Haidian St,\\nHaidian District Beijing\",\"tag\":[\"cobaltstrike\",\"cs-watermark-987654321\",\"tencent-net-ap shenzhen tencent computer systems company limited\",\"port:80\",\"agentemis\",\"beacon\",\"cobeacon\"],\"type\":\"ip\"}", + "severity": 9, + "type": [ + "indicator" + ] + }, + "tags": [ + "preserve_original_event", + "cobaltstrike", + "cs-watermark-987654321", + "tencent-net-ap shenzhen tencent computer systems company limited", + "port:80", + "agentemis", + "beacon", + "cobeacon" + ], + "threat": { + "feed": { + "reference": "https://maltiverse.com/feed/" + }, + "indicator": { + "confidence": "High", + "description": "Cobalt Strike", + "first_seen": "2023-06-01T18:17:07.000Z", + "geo": { + "city_name": "Beijing", + "country_iso_code": "CN", + "location": { + "lat": 39.904211, + "lon": 116.407395 + } + }, + "ip": "1.128.0.1", + "last_seen": "2023-06-03T16:18:21.000Z", + "marking": { + "tlp": "WHITE" + }, + "provider": "ThreatFox Abuse.ch", + "reference": "https://maltiverse.com/ip/1.128.0.1", + "sightings": 1, + "type": "ipv4-addr" + } + } + }, + { + "@timestamp": "2023-05-31T06:23:25.000Z", + "ecs": { + "version": "8.7.0" + }, + "event": { + "category": [ + "threat" + ], + "id": "e6fDkPwyYOPWv2b22gs0kgpKTLM=", + "kind": "enrichment", + "original": "{\"as_name\":\"AS50261 ACE Telecom Kft\",\"blacklist\":{\"count\":1,\"description\":\"2023-05-31 01:28:18\",\"first_seen\":\"2023-05-31 03:21:47\",\"labels\":[\"malicious-activity\"],\"last_seen\":\"2023-05-31 06:23:25\",\"source\":\"URLhaus Abuse.ch\"},\"classification\":\"malicious\",\"creation_time\":\"2023-05-31 02:17:10\",\"domain\":\"1ct-diamond.hu\",\"domain_consonants\":7,\"domain_lenght\":14,\"entropy\":3.6644977792004623,\"hostname\":\"1ct-diamond.hu\",\"is_alive\":true,\"is_cnc\":true,\"is_distributing_malware\":false,\"is_iot_threat\":false,\"is_mining_pool\":false,\"is_phishing\":false,\"is_storing_phishing\":false,\"last_online_time\":\"2023-06-21 06:23:33\",\"modification_time\":\"2023-05-31 07:36:01\",\"number_of_offline_malicious_urls_allocated\":1,\"number_of_online_malicious_urls_allocated\":0,\"resolved_ip\":[{\"ip_addr\":\"81.2.69.142\",\"timestamp\":\"2023-06-21 06:23:33\"}],\"tag\":[\"js\",\"obama265\",\"qakbot\",\"zip\",\"oakboat\",\"pinkslipbot\",\"qbot\",\"quakbot\",\"malware_download\"],\"tld\":\"hu\",\"type\":\"hostname\"}", + "severity": 9, + "type": [ + "indicator" + ] + }, + "tags": [ + "preserve_original_event", + "js", + "obama265", + "qakbot", + "zip", + "oakboat", + "pinkslipbot", + "qbot", + "quakbot", + "malware_download" + ], + "threat": { + "feed": { + "reference": "https://maltiverse.com/feed/" + }, + "indicator": { + "confidence": "High", + "description": "2023-05-31 01:28:18", + "first_seen": "2023-05-31T03:21:47.000Z", + "last_seen": "2023-05-31T06:23:25.000Z", + "marking": { + "tlp": "WHITE" + }, + "provider": "URLhaus Abuse.ch", + "reference": "https://maltiverse.com/hostname/1ct-diamond.hu", + "sightings": 1, + "type": "domain-name", + "url": { + "domain": "1ct-diamond.hu", + "registered_domain": "1ct-diamond.hu", + "top_level_domain": "hu" + } + } + } + } + ] +} \ No newline at end of file diff --git a/packages/ti_maltiverse/data_stream/indicator/_dev/test/system/test-default-config.yml b/packages/ti_maltiverse/data_stream/indicator/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..b1cd222f5ba --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: maltiverse +vars: ~ +data_stream.vars: + api_token: "testing_token" + feed: test + api_hostname: http://{{Hostname}}:{{Port}} + preserve_original_event: true +assert: + hit_count: 3 diff --git a/packages/ti_maltiverse/data_stream/indicator/agent/stream/stream.yml.hbs b/packages/ti_maltiverse/data_stream/indicator/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..3bdc26a0e9b --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/agent/stream/stream.yml.hbs @@ -0,0 +1,32 @@ +config_version: "2" +interval: {{ interval }} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +request.method: "GET" +request.timeout: 50s +request.url: {{ api_hostname }}/collection/{{ feed }}/download +request.transforms: + - set: + target: "header.Authorization" + value: "Bearer {{ api_token }}" +response.split: + target: body.blacklist + keep_parent: true +fields_under_root: true +fields: + feed: {{ feed }} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag i|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ilm/default_policy.json b/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ilm/default_policy.json new file mode 100644 index 00000000000..eb4f660adf4 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ilm/default_policy.json @@ -0,0 +1,23 @@ +{ + "policy": { + "phases": { + "hot": { + "actions": { + "rollover": { + "max_age": "1d", + "max_size": "50gb" + }, + "set_priority": { + "priority": 100 + } + } + }, + "delete": { + "min_age": "2d", + "actions": { + "delete": {} + } + } + } + } +} \ No newline at end of file diff --git a/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml b/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..dddfe2f6f66 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,251 @@ +--- +description: Pipeline for processing Maltiverse Indicators +processors: + - set: + field: ecs.version + value: '8.7.0' + - rename: + field: message + target_field: event.original + ignore_missing: true + - json: + field: event.original + target_field: json + ignore_failure: true + - set: + field: event.kind + value: enrichment + - append: + field: event.category + value: threat + - append: + field: event.type + value: indicator +# Maltiverse specific + - set: + field: threat.indicator.marking.tlp + value: WHITE +# MV to ECS conversion + - date: + field: json.blacklist.last_seen + target_field: "@timestamp" + formats: ["yyyy-MM-dd HH:mm:ss"] +## Convert types Maltiverse to ECS types + - set: + field: threat.indicator.type + value: ipv4-addr + if: 'ctx.json?.type == "ip"' + - set: + field: threat.indicator.type + value: domain-name + if: 'ctx.json?.type == "hostname"' + - set: + field: threat.indicator.type + value: url + if: 'ctx.json?.type == "url"' + - set: + field: threat.indicator.type + value: file + if: 'ctx.json?.type == "sample"' + - foreach: + field: json.tag + ignore_missing: true + processor: + append: + field: tags + value: "{{{ _ingest._value }}}" + if: 'ctx.json?.tag != null' + - set: + field: threat.feed.reference + value: "https://maltiverse.com/feed/{{ feed }}" +## blacklist fields + - date: + field: json.blacklist.first_seen + target_field: threat.indicator.first_seen + formats: ["yyyy-MM-dd HH:mm:ss"] + if: 'ctx.json?.blacklist?.first_seen != null' + - date: + field: json.blacklist.last_seen + target_field: threat.indicator.last_seen + formats: ["yyyy-MM-dd HH:mm:ss"] + if: 'ctx.json?.blacklist?.last_seen != null' + - rename: + field: json.blacklist.count + target_field: threat.indicator.sightings + ignore_missing: true + if: 'ctx.json?.blacklist?.count != null' + - rename: + field: json.blacklist.description + target_field: threat.indicator.description + ignore_missing: true + if: 'ctx.json?.blacklist?.description != null' + - rename: + field: json.blacklist.source + target_field: threat.indicator.provider + ignore_missing: true + if: 'ctx.json?.blacklist?.source != null' +## map classification and confidence to ECS severity + - set: + field: event.severity + value: 6 + if: 'ctx.json?.classification == "suspicious"' + - set: + field: threat.indicator.confidence + value: Medium + if: 'ctx.json?.classification == "suspicious"' + - set: + field: event.severity + value: 9 + if: 'ctx.json?.classification == "malicious"' + - set: + field: threat.indicator.confidence + value: High + if: 'ctx.json?.classification == "malicious"' +## IP specifics + - rename: + field: json.ip_addr + target_field: threat.indicator.ip + ignore_missing: true + if: 'ctx.json?.type == "ip"' + - set: + field: threat.indicator.reference + value: "https://maltiverse.com/ip/{{ threat.indicator.ip }}" + if: 'ctx.json?.type == "ip"' +## TODO: match the AS regex + - rename: + field: json.city + target_field: threat.indicator.geo.city_name + ignore_missing: true + if: 'ctx.json?.type == "ip" && ctx.json?.city != null' + - rename: + field: json.country_code + target_field: threat.indicator.geo.country_iso_code + ignore_missing: true + if: 'ctx.json?.type == "ip" && ctx.json?.country_code != null' + - rename: + field: json.country_code + target_field: threat.indicator.geo.country_iso_code + ignore_missing: true + if: 'ctx.json?.type == "ip" && ctx.json?.country_code != null' + # IP geo fields + - convert: + field: json.location.lat + target_field: threat.indicator.geo.location.lat + type: double + if: "ctx.json?.location?.lat != null && ctx.json?.location?.lon != null" + on_failure: + - append: + field: error.message + value: 'Cannot convert lat field "{{{ json.lat }}}" to double' + - convert: + field: json.location.lon + target_field: threat.indicator.geo.location.lon + type: double + if: "ctx.json?.location?.lat != null && ctx.json?.location?.lon != null" + on_failure: + - append: + field: error.message + value: 'Cannot convert lon field "{{{ json.lon }}}" to double' + +## hostname fields + - rename: + field: json.hostname + target_field: threat.indicator.url.domain + ignore_missing: true + if: 'ctx.json?.type == "hostname"' + - rename: + field: json.domain + target_field: threat.indicator.url.registered_domain + ignore_missing: true + if: 'ctx.json?.type == "hostname"' + - rename: + field: json.tld + target_field: threat.indicator.url.top_level_domain + ignore_missing: true + if: 'ctx.json?.type == "hostname"' + - set: + field: threat.indicator.reference + value: "https://maltiverse.com/hostname/{{ threat.indicator.url.domain }}" + if: 'ctx.json?.type == "hostname"' +## TODO: match the AS regex +## URL fields + - rename: + field: json.url + target_field: threat.indicator.url.full + ignore_missing: true + if: 'ctx.json?.type == "url"' + - rename: + field: json.url + target_field: threat.indicator.url.original + ignore_missing: true + if: 'ctx.json?.type == "url"' + - rename: + field: json.tld + target_field: threat.indicator.url.top_level_domain + ignore_missing: true + if: 'ctx.json?.type == "url" && ctx.json?.tld != null' + - rename: + field: json.domain + target_field: threat.indicator.url.registered_domain + ignore_missing: true + if: 'ctx.json?.type == "url" && ctx.json?.domain != null' + - set: + field: threat.indicator.reference + value: "https://maltiverse.com/url/{{ json.urlchecksum }}" + if: 'ctx.json?.type == "url" && ctx.json?.urlchecksum != null' +## Sample fields + - rename: + field: json.sha256 + target_field: threat.indicator.file.hash.sha256 + ignore_missing: true + if: 'ctx.json?.type == "sample"' + - rename: + field: json.md5 + target_field: threat.indicator.file.hash.md5 + ignore_missing: true + if: 'ctx.json?.type == "sample" && ctx.json?.md5 != null' + - rename: + field: json.sha512 + target_field: threat.indicator.file.hash.sha512 + ignore_missing: true + if: 'ctx.json?.type == "sample" && ctx.json?.sha512 != null' + - rename: + field: json.filetype + target_field: threat.indicator.file.type + ignore_missing: true + if: 'ctx.json?.type == "sample" && ctx.json?.filetype != null' + - rename: + field: json.size + target_field: threat.indicator.file.size + ignore_missing: true + if: 'ctx.json?.type == "sample" && ctx.json?.size != null' + - set: + field: threat.indicator.reference + value: "https://maltiverse.com/sample/{{ threat.indicator.file.hash.sha256 }}" + if: 'ctx.json?.type == "sample"' + + - remove: + field: json + +# Generate an event ID based on the original event + - fingerprint: + target_field: event.id + fields: ["threat.indicator.last_seen", "threat.indicator.first_seen", "threat.indicator.provider"] + - set: + field: _id + value: "{{ event.id }}" + if: 'ctx.event?.id != null' + + - remove: + field: event.original + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" + ignore_failure: true + ignore_missing: true + +on_failure: + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" + - set: + field: event.kind + value: pipeline_error diff --git a/packages/ti_maltiverse/data_stream/indicator/fields/base-fields.yml b/packages/ti_maltiverse/data_stream/indicator/fields/base-fields.yml new file mode 100644 index 00000000000..aeedc0dcce9 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/fields/base-fields.yml @@ -0,0 +1,19 @@ +- name: input.type + type: keyword + description: Input type. +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: labels.is_ioc_transform_source + type: constant_keyword + value: "true" + description: Field indicating if its the transform source for supporting IOC expiration. This field is dropped from destination indices to facilitate easier filtering of indicators. diff --git a/packages/ti_maltiverse/data_stream/indicator/fields/ecs.yml b/packages/ti_maltiverse/data_stream/indicator/fields/ecs.yml new file mode 100644 index 00000000000..92f7f496949 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/fields/ecs.yml @@ -0,0 +1,88 @@ +- external: ecs + name: ecs.version +- external: ecs + name: message +- external: ecs + name: tags +- external: ecs + name: error.message +- external: ecs + name: event.severity +- external: ecs + name: event.category +- external: ecs + name: event.id +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.type +- external: ecs + name: event.created +- external: ecs + name: event.original +- external: ecs + name: threat.indicator.description +- external: ecs + name: threat.feed.reference +- external: ecs + name: threat.indicator.first_seen +- external: ecs + name: threat.indicator.last_seen +- external: ecs + name: threat.indicator.type +- external: ecs + name: threat.indicator.ip +- external: ecs + name: threat.indicator.url.domain +- external: ecs + name: threat.indicator.url.full +- external: ecs + name: threat.indicator.url.extension +- external: ecs + name: threat.indicator.url.original +- external: ecs + name: threat.indicator.url.path +- external: ecs + name: threat.indicator.url.port +- external: ecs + name: threat.indicator.url.scheme +- external: ecs + name: threat.indicator.url.query +- external: ecs + name: threat.indicator.url.registered_domain +- external: ecs + name: threat.indicator.url.top_level_domain +- external: ecs + name: threat.indicator.file.hash.md5 +- external: ecs + name: threat.indicator.file.hash.sha1 +- external: ecs + name: threat.indicator.file.hash.sha256 +- external: ecs + name: threat.indicator.file.hash.sha512 +- external: ecs + name: threat.indicator.email.address +- external: ecs + name: threat.indicator.provider +- external: ecs + name: threat.indicator.marking.tlp +- external: ecs + name: threat.indicator.confidence +- external: ecs + name: threat.indicator.as.number +- external: ecs + name: threat.indicator.as.organization.name +- external: ecs + name: threat.indicator.geo.location +- external: ecs + name: threat.indicator.geo.city_name +- external: ecs + name: threat.indicator.geo.country_iso_code +- external: ecs + name: threat.indicator.sightings +- external: ecs + name: threat.indicator.reference +- external: ecs + name: labels diff --git a/packages/ti_maltiverse/data_stream/indicator/fields/indicator.yml b/packages/ti_maltiverse/data_stream/indicator/fields/indicator.yml new file mode 100644 index 00000000000..e3e388f825d --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/fields/indicator.yml @@ -0,0 +1,124 @@ +- name: feed + type: text + description: Origin of the IoC +- name: address + type: text + description: registered address +- name: as_name + type: text + description: AS registered name +- name: asn_cidr + type: text + description: CIDR associated +- name: asn_country_code + type: text + description: Country code asociated with ASN +- name: asn_date + type: text + description: date when asn registered +- name: asn_registry + type: text + description: ASN registry +- name: blacklist + type: group + description: blacklist for the indicator + fields: + - name: first_seen + type: date + description: first shighting + - name: description + type: text + description: what we saw + - name: source + type: text + description: reporter of the activity + - name: count + type: long + description: number of reports for the indicator +- name: cidr + type: text + description: CIDR associated +- name: city + type: text + description: City +- name: classification + type: text + description: Classification of the threat +- name: country_code + type: text + description: Country code of the threat +- name: creation_time + type: date + description: creation date +- name: email + type: text + description: email address +- name: ip_addr + type: ip + description: IP address +- name: is_cdn + type: boolean + description: boolean description tag +- name: is_cnc + type: boolean + description: boolean description tag +- name: is_distributing_malware + type: boolean + description: boolean description tag +- name: is_hosting + type: boolean + description: boolean description tag +- name: is_iot_threat + type: boolean + description: boolean description tag +- name: is_known_attacker + type: boolean + description: boolean description tag +- name: is_known_scanner + type: boolean + description: boolean description tag +- name: is_mining_pool + type: boolean + description: boolean description tag +- name: is_open_proxy + type: boolean + description: boolean description tag +- name: is_sinkhole + type: boolean + description: boolean description tag +- name: is_tor_node + type: boolean + description: boolean description tag +- name: is_vpn_node + type: boolean + description: boolean description tag +- name: location + type: boolean + description: boolean description tag +- name: modification_time + type: date + description: Last modification date +- name: number_of_blacklisted_domains_resolving + type: long + description: Blacklisted domains resolving associated +- name: number_of_domains_resolving + type: long + description: Domains resolving associated +- name: number_of_offline_malicious_urls_allocated + type: long + description: URLs allocated +- name: number_of_online_malicious_urls_allocated + type: long + description: URLs allocated +- name: number_of_whitelisted_domains_resolving + type: long + description: Whitelisted domains resolving associated +- name: registrant_name + type: text + description: Registrant name +- name: tag + type: text + description: Tags of the threat +- name: type + type: text + description: Type of the threat diff --git a/packages/ti_maltiverse/data_stream/indicator/manifest.yml b/packages/ti_maltiverse/data_stream/indicator/manifest.yml new file mode 100644 index 00000000000..3855b0de795 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/manifest.yml @@ -0,0 +1,65 @@ +title: "Maltiverse indicator" +type: logs +ilm_policy: logs-ti_maltiverse.indicator-default_policy +streams: + - input: httpjson + title: Maltiverse indicator feed + description: Fetches thread intelligence feeds from Maltiverse API + vars: + - name: api_token + type: text + title: API Token + description: Maltiverse API Token + multi: false + required: true + - name: feed + type: text + title: Feed + description: "Maltiverse feed to integrate. For example: VdhZV34B4jHUXfKt_gDi" + required: true + - name: interval + type: text + title: Interval + multi: false + required: true + show_user: true + default: 60m + - name: api_hostname + title: API Hostname + type: text + multi: false + required: true + show_user: false + default: https://api.maltiverse.com + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - ti_maltiverse-indicator + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. diff --git a/packages/ti_maltiverse/data_stream/indicator/sample_event.json b/packages/ti_maltiverse/data_stream/indicator/sample_event.json new file mode 100644 index 00000000000..16bb1b2dfa7 --- /dev/null +++ b/packages/ti_maltiverse/data_stream/indicator/sample_event.json @@ -0,0 +1,81 @@ +{ + "@timestamp": "2022-11-05T05:37:57.000Z", + "agent": { + "ephemeral_id": "eed20094-d98b-452e-a45f-9a63fb365eb4", + "id": "eab68dab-e719-4411-a9d5-3a7358fc3057", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.8.0" + }, + "data_stream": { + "dataset": "ti_maltiverse.indicator", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.7.0" + }, + "elastic_agent": { + "id": "eab68dab-e719-4411-a9d5-3a7358fc3057", + "snapshot": false, + "version": "8.8.0" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "threat" + ], + "created": "2023-07-20T14:02:41.006Z", + "dataset": "ti_maltiverse.indicator", + "id": "NsHdp9tZZtzo6Kzlv6Z1TmPP47U=", + "ingested": "2023-07-20T14:02:42Z", + "kind": "enrichment", + "original": "{\"blacklist\":{\"count\":1,\"description\":\"QakBot\",\"first_seen\":\"2022-11-03 06:23:53\",\"labels\":[\"malicious-activity\"],\"last_seen\":\"2022-11-05 05:37:57\",\"source\":\"ThreatFox Abuse.ch\"},\"classification\":\"malicious\",\"creation_time\":\"2022-11-03 06:23:53\",\"domain\":\"autooutletllc.com\",\"hostname\":\"autooutletllc.com\",\"is_alive\":false,\"is_cnc\":true,\"is_distributing_malware\":false,\"is_iot_threat\":false,\"is_phishing\":false,\"last_online_time\":\"2022-11-05 05:37:57\",\"modification_time\":\"2022-11-05 05:37:57\",\"tag\":[\"bb05\",\"iso\",\"qakbot\",\"qbot\",\"quakbot\",\"tr\",\"w19\",\"zip\",\"oakboat\",\"pinkslipbot\"],\"tld\":\"com\",\"type\":\"url\",\"url\":\"https://autooutletllc.com/spares.php\",\"urlchecksum\":\"4aa7a29969dc1dffa5cad5af6cb343b9a9b40ea9646fed619d4c8d6472629128\"}", + "severity": 9, + "type": [ + "indicator" + ] + }, + "feed": "test", + "input": { + "type": "httpjson" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "ti_maltiverse-indicator", + "bb05", + "iso", + "qakbot", + "qbot", + "quakbot", + "tr", + "w19", + "zip", + "oakboat", + "pinkslipbot" + ], + "threat": { + "feed": { + "reference": "https://maltiverse.com/feed/test" + }, + "indicator": { + "confidence": "High", + "description": "QakBot", + "first_seen": "2022-11-03T06:23:53.000Z", + "last_seen": "2022-11-05T05:37:57.000Z", + "marking": { + "tlp": "WHITE" + }, + "provider": "ThreatFox Abuse.ch", + "reference": "https://maltiverse.com/url/4aa7a29969dc1dffa5cad5af6cb343b9a9b40ea9646fed619d4c8d6472629128", + "sightings": 1, + "type": "url", + "url": { + "full": "https://autooutletllc.com/spares.php", + "registered_domain": "autooutletllc.com", + "top_level_domain": "com" + } + } + } +} \ No newline at end of file diff --git a/packages/ti_maltiverse/docs/README.md b/packages/ti_maltiverse/docs/README.md new file mode 100644 index 00000000000..92c385fc760 --- /dev/null +++ b/packages/ti_maltiverse/docs/README.md @@ -0,0 +1,16 @@ +# Maltiverse Integration + +[Maltiverse](https://maltiverse.com) is a threat intelligence platform. It works as a broker for Threat intelligence sources that are aggregated from more than a hundred different Public, Private and Community sources. Once the data is ingested, the IoC Scoring Algorithm applies a qualitative classification to the IoC that changes. Finally this data can be queried in a Threat Intelligence feed that can be delivered to your Firewalls, SOAR, SIEM, EDR or any other technology. + +This integration fetches Maltiverse Threat Intelligence feeds and add them into Elastic Threat Intelligence. It supports `hostname`, `hash`, `ipv4` and `url` indicators. + +In order to download feed you need to [register](https://maltiverse.com/auth/register) and generate an API key on you profile page. + +## IoCs Expiration +Since we want to retain only valuable information and avoid duplicated data, the Maltiverse Elastic integration forces the indicators to rotate into a custom index called: `logs-ti_maltiverse_latest.indicator`. +**Please, refer to this index in order to set alerts and so on.** + +### How it works +This is possible thanks to a transform rule installed along with the integration. The transform rule parses the data_stream content that is pulled from Maltiverse and only adds new indicators. + +Both, the data_stream and the _latest index have applied expiration through ILM and a retention policy in the transform respectively. diff --git a/packages/ti_maltiverse/elasticsearch/transform/latest/fields/fields.yml b/packages/ti_maltiverse/elasticsearch/transform/latest/fields/fields.yml new file mode 100644 index 00000000000..08b9582390a --- /dev/null +++ b/packages/ti_maltiverse/elasticsearch/transform/latest/fields/fields.yml @@ -0,0 +1,330 @@ +- name: input.type + type: keyword + description: Input type. +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- description: |- + ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. + When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. + name: ecs.version + type: keyword +- description: |- + For log events the message field contains the log message, optimized for viewing in a log viewer. + For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. + If multiple messages exist, they can be combined into one message. + name: message + type: match_only_text +- description: List of keywords used to tag each event. + name: tags + normalize: + - array + type: keyword +- description: Error message. + name: error.message + type: match_only_text +- description: |- + The numeric severity of the event according to your event source. + What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. + The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. + name: event.severity + type: long +- description: |- + This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. + `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. + This field is an array. This will allow proper categorization of some events that fall in multiple categories. + name: event.category + normalize: + - array + type: keyword +- description: Unique ID to describe the event. + name: event.id + type: keyword +- description: |- + Timestamp when an event arrived in the central data store. + This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. + In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. + name: event.ingested + type: date +- description: |- + This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. + `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. + The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. + name: event.kind + type: keyword +- description: |- + This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. + `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. + This field is an array. This will allow proper categorization of some events that fall in multiple event types. + name: event.type + normalize: + - array + type: keyword +- description: |- + event.created contains the date/time when the event was first read by an agent, or by your pipeline. + This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. + In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. + In case the two timestamps are identical, @timestamp should be used. + name: event.created + type: date +- description: |- + Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. + This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. + doc_values: false + index: false + name: event.original + type: keyword +- description: Describes the type of action conducted by the threat. + name: threat.indicator.description + type: keyword +- description: Reference information for the threat feed in a UI friendly format. + name: threat.feed.reference + type: keyword +- description: The date and time when intelligence source first reported sighting this indicator. + name: threat.indicator.first_seen + type: date +- description: The date and time when intelligence source last reported sighting this indicator. + name: threat.indicator.last_seen + type: date +- description: Type of indicator as represented by Cyber Observable in STIX 2.0. + name: threat.indicator.type + type: keyword +- description: Identifies a threat indicator as an IP address (irrespective of direction). + name: threat.indicator.ip + type: ip +- description: |- + Domain of the url, such as "www.elastic.co". + In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. + If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. + name: threat.indicator.url.domain + type: keyword +- description: If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.url.full + type: wildcard +- description: |- + The field contains the file extension from the original request url, excluding the leading dot. + The file extension is only set if it exists, as not every url has a file extension. + The leading period must not be included. For example, the value must be "png", not ".png". + Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). + name: threat.indicator.url.extension + type: keyword +- description: |- + Unmodified original url as seen in the event source. + Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. + This field is meant to represent the URL as it was observed, complete or not. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.url.original + type: wildcard +- description: Path of the request, such as "/search". + name: threat.indicator.url.path + type: wildcard +- description: Port of the request, such as 443. + name: threat.indicator.url.port + type: long +- description: |- + Scheme of the request, such as "https". + Note: The `:` is not part of the scheme. + name: threat.indicator.url.scheme + type: keyword +- description: |- + The query field describes the query string of the request, such as "q=elasticsearch". + The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. + name: threat.indicator.url.query + type: keyword +- description: |- + The highest registered url domain, stripped of the subdomain. + For example, the registered domain for "foo.example.com" is "example.com". + This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". + name: threat.indicator.url.registered_domain + type: keyword +- description: |- + The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com". + This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". + name: threat.indicator.url.top_level_domain + type: keyword +- description: MD5 hash. + name: threat.indicator.file.hash.md5 + type: keyword +- description: SHA1 hash. + name: threat.indicator.file.hash.sha1 + type: keyword +- description: SHA256 hash. + name: threat.indicator.file.hash.sha256 + type: keyword +- description: SHA512 hash. + name: threat.indicator.file.hash.sha512 + type: keyword +- description: Identifies a threat indicator as an email address (irrespective of direction). + name: threat.indicator.email.address + type: keyword +- description: The name of the indicator's provider. + name: threat.indicator.provider + type: keyword +- description: Traffic Light Protocol sharing markings. + name: threat.indicator.marking.tlp + type: keyword +- description: Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields. + name: threat.indicator.confidence + type: keyword +- description: Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. + name: threat.indicator.as.number + type: long +- description: Organization name. + multi_fields: + - name: text + type: match_only_text + name: threat.indicator.as.organization.name + type: keyword +- description: Longitude and latitude. + name: threat.indicator.geo.location + type: geo_point +- description: City name. + name: threat.indicator.geo.city_name + type: keyword +- description: Country ISO code. + name: threat.indicator.geo.country_iso_code + type: keyword +- description: Number of times this indicator was observed conducting threat activity. + name: threat.indicator.sightings + type: long +- description: Reference URL linking to additional information about this indicator. + name: threat.indicator.reference + type: keyword +- name: feed + type: text + description: Origin of the IoC +- name: address + type: text + description: registered address +- name: as_name + type: text + description: AS registered name +- name: asn_cidr + type: text + description: CIDR associated +- name: asn_country_code + type: text + description: Country code asociated with ASN +- name: asn_date + type: text + description: date when asn registered +- name: asn_registry + type: text + description: ASN registry +- name: blacklist + type: group + description: blacklist for the indicator + fields: + - name: first_seen + type: date + description: first shighting + - name: description + type: text + description: what we saw + - name: source + type: text + description: reporter of the activity + - name: count + type: long + description: number of reports for the indicator +- name: cidr + type: text + description: CIDR associated +- name: city + type: text + description: City +- name: classification + type: text + description: Classification of the threat +- name: country_code + type: text + description: Country code of the threat +- name: creation_time + type: date + description: creation date +- name: email + type: text + description: email address +- name: ip_addr + type: ip + description: IP address +- name: is_cdn + type: boolean + description: boolean description tag +- name: is_cnc + type: boolean + description: boolean description tag +- name: is_distributing_malware + type: boolean + description: boolean description tag +- name: is_hosting + type: boolean + description: boolean description tag +- name: is_iot_threat + type: boolean + description: boolean description tag +- name: is_known_attacker + type: boolean + description: boolean description tag +- name: is_known_scanner + type: boolean + description: boolean description tag +- name: is_mining_pool + type: boolean + description: boolean description tag +- name: is_open_proxy + type: boolean + description: boolean description tag +- name: is_sinkhole + type: boolean + description: boolean description tag +- name: is_tor_node + type: boolean + description: boolean description tag +- name: is_vpn_node + type: boolean + description: boolean description tag +- name: location + type: boolean + description: boolean description tag +- name: modification_time + type: date + description: Last modification date +- name: number_of_blacklisted_domains_resolving + type: long + description: Blacklisted domains resolving associated +- name: number_of_domains_resolving + type: long + description: Domains resolving associated +- name: number_of_offline_malicious_urls_allocated + type: long + description: URLs allocated +- name: number_of_online_malicious_urls_allocated + type: long + description: URLs allocated +- name: number_of_whitelisted_domains_resolving + type: long + description: Whitelisted domains resolving associated +- name: registrant_name + type: text + description: Registrant name +- name: tag + type: text + description: Tags of the threat +- name: type + type: text + description: Type of the threat diff --git a/packages/ti_maltiverse/elasticsearch/transform/latest/manifest.yml b/packages/ti_maltiverse/elasticsearch/transform/latest/manifest.yml new file mode 100644 index 00000000000..98a495b240b --- /dev/null +++ b/packages/ti_maltiverse/elasticsearch/transform/latest/manifest.yml @@ -0,0 +1,9 @@ +start: true +destination_index_template: + settings: + index: + sort: + field: + - "@timestamp" + order: + - desc diff --git a/packages/ti_maltiverse/elasticsearch/transform/latest/transform.yml b/packages/ti_maltiverse/elasticsearch/transform/latest/transform.yml new file mode 100644 index 00000000000..9a60399c8a7 --- /dev/null +++ b/packages/ti_maltiverse/elasticsearch/transform/latest/transform.yml @@ -0,0 +1,31 @@ +# Use of "*" to use all namespaces defined. +source: + index: + - "logs-ti_maltiverse.indicator-*" +# The version suffix on the dest.index should be incremented if a breaking change +# is made to the index mapping. You must also bump the fleet_transform_version +# for any change to this transform configuration to take effect. The old destination +# index is not automatically removed. We are dependent on https://github.com/elastic/package-spec/issues/523 to give +# us that ability in order to prevent having duplicate IoC data and prevent query +# time field type conflicts. +dest: + index: "logs-ti_maltiverse_latest.indicator-1" +latest: + unique_key: + - event.dataset + - event.id + sort: "event.ingested" +description: Latest Maltiverse IoC data +frequency: 30s +sync: + time: + field: event.ingested + delay: 60s +retention_policy: + time: + field: event.ingested + max_age: 1d +_meta: + managed: true + # Bump this version to delete, reinstall, and restart the transform during package. + fleet_transform_version: 0.1.0 diff --git a/packages/ti_maltiverse/img/logo-maltiverse.svg b/packages/ti_maltiverse/img/logo-maltiverse.svg new file mode 100644 index 00000000000..79329895c80 --- /dev/null +++ b/packages/ti_maltiverse/img/logo-maltiverse.svg @@ -0,0 +1,20 @@ + + + + + + + + + + + + + diff --git a/packages/ti_maltiverse/kibana/tags.yml b/packages/ti_maltiverse/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_maltiverse/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_maltiverse/manifest.yml b/packages/ti_maltiverse/manifest.yml new file mode 100644 index 00000000000..ed76f33f132 --- /dev/null +++ b/packages/ti_maltiverse/manifest.yml @@ -0,0 +1,25 @@ +name: ti_maltiverse +title: Maltiverse +version: "0.3.0" +description: Ingest threat intelligence indicators from Maltiverse feeds with Elastic Agent +type: integration +format_version: 2.11.0 +categories: ["security", "threat_intel"] +conditions: + kibana: + version: ^8.8.0 +icons: + - src: /img/logo-maltiverse.svg + title: Maltiverse + size: 678x566 + type: image/svg+xml +policy_templates: + - name: ti_maltiverse + title: Maltiverse + description: Ingest threat intelligence indicators from Maltiverse feeds with Elastic Agent + inputs: + - type: httpjson + title: "Collect threat intelligence feeds from Maltiverse API." + description: "Use Maltiverse API to fetch a feed" +owner: + github: elastic/security-external-integrations diff --git a/packages/ti_misp/_dev/build/build.yml b/packages/ti_misp/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_misp/_dev/build/build.yml +++ b/packages/ti_misp/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_misp/_dev/deploy/docker/files/config.yml b/packages/ti_misp/_dev/deploy/docker/files/config.yml index 38da473351f..2a1726b067e 100644 --- a/packages/ti_misp/_dev/deploy/docker/files/config.yml +++ b/packages/ti_misp/_dev/deploy/docker/files/config.yml @@ -503,9 +503,4 @@ rules: request_body: /^{"limit":"10","page":"2","returnFormat":"json","timestamp":"\d+"/ responses: - status_code: 200 - body: |- - { - "response": { - "Attribute": [] - } - } + body: "{\n \"response\": {\n \"Attribute\": []\n }\n} " diff --git a/packages/ti_misp/changelog.yml b/packages/ti_misp/changelog.yml index 5a338123070..a885c323d5e 100644 --- a/packages/ti_misp/changelog.yml +++ b/packages/ti_misp/changelog.yml @@ -1,4 +1,49 @@ # newer versions go on top +- version: 1.23.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.22.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.21.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7570 +- version: "1.20.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.19.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.18.2" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 +- version: "1.18.1" + changes: + - description: Remove renaming the original `message` field to `event.original` + type: bugfix + link: https://github.com/elastic/integrations/pull/6794 +- version: "1.18.0" + changes: + - description: Retain email subjects in misp.attributes. + type: enhancement + link: https://github.com/elastic/integrations/pull/6794 +- version: "1.17.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.16.2" changes: - description: Fix the fingerprint processor in the Attributes Pipeline. diff --git a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-attributes-ndjson.log-expected.json b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-attributes-ndjson.log-expected.json index bf9a41918ba..ff85a3edc64 100644 --- a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-attributes-ndjson.log-expected.json +++ b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-attributes-ndjson.log-expected.json @@ -3,13 +3,17 @@ { "@timestamp": "2021-05-21T09:09:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload installation\",\"comment\":\"Contextual comment for the file md5 attribute\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3631\",\"first_seen\":null,\"id\":\"266258\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621588162\",\"to_ids\":false,\"type\":\"md5\",\"uuid\":\"34c59b06-d35d-4808-919c-4b452f185c52\",\"value\":\"70461da8b94c6ca5d2fda3260c5a8c3b\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"1\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -80,13 +84,17 @@ { "@timestamp": "2021-05-21T09:20:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"Artefact dropped for test 2\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3632\",\"first_seen\":null,\"id\":\"266259\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621588675\",\"to_ids\":true,\"type\":\"md5\",\"uuid\":\"73102a1c-7432-47b7-9644-6f9d46b6887c\",\"value\":\"60461da8b94c6ca5d2fda3260c5a8c3b\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"2\",\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"analysis\":\"2\",\"date\":\"2018-03-26\",\"distribution\":\"3\",\"id\":\"684\",\"info\":\"OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn’t\",\"org_id\":\"1\",\"orgc_id\":\"2\",\"published\":true,\"threat_level_id\":\"3\",\"timestamp\":\"1523865236\",\"uuid\":\"5acdb4d0-b534-4713-9612-4a1d950d210f\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"4\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3632\",\"info\":\"Test event 2 just more atrributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1621588836\",\"uuid\":\"efbca287-edb5-4ad7-b8e4-fe9da514a763\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -157,13 +165,17 @@ { "@timestamp": "2021-05-21T09:20:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Network activity\",\"comment\":\"Conext for domain type attribute event 2\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3632\",\"first_seen\":null,\"id\":\"266260\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621588744\",\"to_ids\":true,\"type\":\"domain\",\"uuid\":\"a52a1b47-a580-4f33-96ba-939cf9146c9b\",\"value\":\"baddom.madeup.local\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"2\",\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"analysis\":\"2\",\"date\":\"2018-03-26\",\"distribution\":\"3\",\"id\":\"684\",\"info\":\"OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn’t\",\"org_id\":\"1\",\"orgc_id\":\"2\",\"published\":true,\"threat_level_id\":\"3\",\"timestamp\":\"1523865236\",\"uuid\":\"5acdb4d0-b534-4713-9612-4a1d950d210f\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"4\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3632\",\"info\":\"Test event 2 just more atrributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1621588836\",\"uuid\":\"efbca287-edb5-4ad7-b8e4-fe9da514a763\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -232,13 +244,17 @@ { "@timestamp": "2021-05-21T09:20:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Network activity\",\"comment\":\"Ip-src attribute context for event2\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3632\",\"first_seen\":null,\"id\":\"266261\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621588800\",\"to_ids\":false,\"type\":\"ip-src\",\"uuid\":\"3dbf224b-7c84-4c4b-9f95-80f28954bd10\",\"value\":\"10.0.0.1\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"2\",\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"analysis\":\"2\",\"date\":\"2018-03-26\",\"distribution\":\"3\",\"id\":\"684\",\"info\":\"OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn’t\",\"org_id\":\"1\",\"orgc_id\":\"2\",\"published\":true,\"threat_level_id\":\"3\",\"timestamp\":\"1523865236\",\"uuid\":\"5acdb4d0-b534-4713-9612-4a1d950d210f\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"4\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3632\",\"info\":\"Test event 2 just more atrributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1621588836\",\"uuid\":\"efbca287-edb5-4ad7-b8e4-fe9da514a763\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -305,13 +321,17 @@ { "@timestamp": "2021-05-21T09:20:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Network activity\",\"comment\":\"ip-dst context for event id 2\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3632\",\"first_seen\":null,\"id\":\"266262\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621588836\",\"to_ids\":true,\"type\":\"ip-dst\",\"uuid\":\"db4bfd36-7374-4f8c-9031-60e56d4bba30\",\"value\":\"192.168.1.50\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"2\",\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"analysis\":\"2\",\"date\":\"2018-03-26\",\"distribution\":\"3\",\"id\":\"684\",\"info\":\"OSINT - Forgot About Default Accounts? No Worries, GoScanSSH Didn’t\",\"org_id\":\"1\",\"orgc_id\":\"2\",\"published\":true,\"threat_level_id\":\"3\",\"timestamp\":\"1523865236\",\"uuid\":\"5acdb4d0-b534-4713-9612-4a1d950d210f\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"4\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3632\",\"info\":\"Test event 2 just more atrributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1621588836\",\"uuid\":\"efbca287-edb5-4ad7-b8e4-fe9da514a763\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -378,13 +398,17 @@ { "@timestamp": "2021-05-21T10:22:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"filename contect for test event 3\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266263\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621589229\",\"to_ids\":false,\"type\":\"filename\",\"uuid\":\"3b322e1a-1dd8-490c-ab96-12e1bc3ee6a3\",\"value\":\"thetestfile.txt\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266267\",\"last_seen\":null,\"object_id\":\"18207\",\"object_relation\":\"fullpath\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621589548\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"ff97cc32-815e-4fc9-9d4b-cab9822027a6\",\"value\":\"\\\\the\\\\fullpath\\\\to the file\\\\filenameofobject.txt\"},\"ObjectReference\":[],\"comment\":\"File object for event 3\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"18207\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621589548\",\"uuid\":\"42a88ad4-6834-46a9-a18b-aff9e078a4ea\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"6\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -484,13 +508,17 @@ { "@timestamp": "2021-05-21T10:22:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"filename contect for test event 3\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266263\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621589229\",\"to_ids\":false,\"type\":\"filename\",\"uuid\":\"3b322e1a-1dd8-490c-ab96-12e1bc3ee6a3\",\"value\":\"thetestfile.txt\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266268\",\"last_seen\":null,\"object_id\":\"18207\",\"object_relation\":\"size-in-bytes\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621589548\",\"to_ids\":false,\"type\":\"size-in-bytes\",\"uuid\":\"e378b4d9-43e1-4c64-bd4e-70fce2b4e581\",\"value\":\"505050\"},\"ObjectReference\":[],\"comment\":\"File object for event 3\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"18207\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621589548\",\"uuid\":\"42a88ad4-6834-46a9-a18b-aff9e078a4ea\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"6\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -590,13 +618,17 @@ { "@timestamp": "2021-05-21T10:22:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"filename contect for test event 3\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266263\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621589229\",\"to_ids\":false,\"type\":\"filename\",\"uuid\":\"3b322e1a-1dd8-490c-ab96-12e1bc3ee6a3\",\"value\":\"thetestfile.txt\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266264\",\"last_seen\":null,\"object_id\":\"18207\",\"object_relation\":\"md5\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621589548\",\"to_ids\":true,\"type\":\"md5\",\"uuid\":\"787b3822-0bec-4278-b34a-5d649e7bce05\",\"value\":\"70461da8b94c6ca5d2fda3260c5a8c3b\"},\"ObjectReference\":[],\"comment\":\"File object for event 3\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"18207\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621589548\",\"uuid\":\"42a88ad4-6834-46a9-a18b-aff9e078a4ea\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"6\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -701,13 +733,17 @@ { "@timestamp": "2021-05-21T10:22:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"filename contect for test event 3\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266263\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621589229\",\"to_ids\":false,\"type\":\"filename\",\"uuid\":\"3b322e1a-1dd8-490c-ab96-12e1bc3ee6a3\",\"value\":\"thetestfile.txt\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266265\",\"last_seen\":null,\"object_id\":\"18207\",\"object_relation\":\"sha256\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621589548\",\"to_ids\":true,\"type\":\"sha256\",\"uuid\":\"657c5f2b-9d68-4ff7-a9ad-ab9e6a6c953e\",\"value\":\"f33c27745f2bd87344be790465ef984a972fd539dc83bd4f61d4242c607ef1ee\"},\"ObjectReference\":[],\"comment\":\"File object for event 3\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"18207\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621589548\",\"uuid\":\"42a88ad4-6834-46a9-a18b-aff9e078a4ea\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"6\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -812,13 +848,17 @@ { "@timestamp": "2021-05-21T10:22:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"filename contect for test event 3\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266263\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1621589229\",\"to_ids\":false,\"type\":\"filename\",\"uuid\":\"3b322e1a-1dd8-490c-ab96-12e1bc3ee6a3\",\"value\":\"thetestfile.txt\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"266266\",\"last_seen\":null,\"object_id\":\"18207\",\"object_relation\":\"filename\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621589548\",\"to_ids\":true,\"type\":\"filename\",\"uuid\":\"6648d129-9200-431b-9b41-263a84f7c9d2\",\"value\":\"filenameofobject.txt\"},\"ObjectReference\":[],\"comment\":\"File object for event 3\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3633\",\"first_seen\":null,\"id\":\"18207\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621589548\",\"uuid\":\"42a88ad4-6834-46a9-a18b-aff9e078a4ea\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"analysis\":\"0\",\"date\":\"2021-05-21\",\"distribution\":\"1\",\"id\":\"3631\",\"info\":\"Test event 1 just atrributes\",\"org_id\":\"1\",\"orgc_id\":\"1\",\"published\":false,\"threat_level_id\":\"1\",\"timestamp\":\"1621588162\",\"uuid\":\"8ca56ae9-3747-4172-93d2-808da1a4eaf3\"}}],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"6\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3633\",\"info\":\"Test event 3 objects and attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592532\",\"uuid\":\"4edb20c7-8175-484d-bdcd-fce6872c1ef3\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -921,13 +961,17 @@ { "@timestamp": "2021-05-21T10:09:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"266269\",\"last_seen\":null,\"object_id\":\"18208\",\"object_relation\":\"text\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621591770\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"25d2f181-26ae-4d6f-b4fd-85b9d1f82e67\",\"value\":\"Free text in the file object\"},\"ObjectReference\":[],\"comment\":\"File object for test event 4 \",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"18208\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621591770\",\"uuid\":\"190c762c-a389-4ecc-8f6e-68f92d42adef\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"3\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3634\",\"info\":\"Test event 4 with object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1621591770\",\"uuid\":\"d98a8418-9f90-4b50-a623-6921ca5b356d\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1009,13 +1053,17 @@ { "@timestamp": "2021-05-21T10:09:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"266270\",\"last_seen\":null,\"object_id\":\"18208\",\"object_relation\":\"sha256\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621591770\",\"to_ids\":true,\"type\":\"sha256\",\"uuid\":\"4e579782-346b-44b3-b72c-1cae8d87cb25\",\"value\":\"567caa7653723f8818ec9eb6f2e27f6d9d8c0aca0c96fc457659340e7bbdc666\"},\"ObjectReference\":[],\"comment\":\"File object for test event 4 \",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"18208\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621591770\",\"uuid\":\"190c762c-a389-4ecc-8f6e-68f92d42adef\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"3\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3634\",\"info\":\"Test event 4 with object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1621591770\",\"uuid\":\"d98a8418-9f90-4b50-a623-6921ca5b356d\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1102,13 +1150,17 @@ { "@timestamp": "2021-05-21T10:09:30.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"266271\",\"last_seen\":null,\"object_id\":\"18208\",\"object_relation\":\"filename\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621591770\",\"to_ids\":true,\"type\":\"filename\",\"uuid\":\"a40343b5-a480-4288-9b0c-7ae074a77140\",\"value\":\"filenameinmispobject.txt\"},\"ObjectReference\":[],\"comment\":\"File object for test event 4 \",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3634\",\"first_seen\":null,\"id\":\"18208\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621591770\",\"uuid\":\"190c762c-a389-4ecc-8f6e-68f92d42adef\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"3\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3634\",\"info\":\"Test event 4 with object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1621591770\",\"uuid\":\"d98a8418-9f90-4b50-a623-6921ca5b356d\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1193,13 +1245,17 @@ { "@timestamp": "2021-05-21T10:19:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"266272\",\"last_seen\":null,\"object_id\":\"18209\",\"object_relation\":\"text\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621592379\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"188a6a15-5704-4e4f-acba-22c55ab08fe8\",\"value\":\"Object 5 free text attribute in object\"},\"ObjectReference\":[],\"comment\":\"event 5 object comment\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"18209\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621592379\",\"uuid\":\"a62cb6fb-fa1c-45ce-abb8-b46da23631d5\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"5\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3635\",\"info\":\"Test event 5 with an object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592379\",\"uuid\":\"8b8786f1-07f2-4bfc-a3f0-e63c22fcc25e\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1281,13 +1337,17 @@ { "@timestamp": "2021-05-21T10:19:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"266275\",\"last_seen\":null,\"object_id\":\"18209\",\"object_relation\":\"entropy\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621592379\",\"to_ids\":false,\"type\":\"float\",\"uuid\":\"2400b103-4a33-4f92-ac04-a558b6c6e252\",\"value\":\"0.53535445\"},\"ObjectReference\":[],\"comment\":\"event 5 object comment\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"18209\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621592379\",\"uuid\":\"a62cb6fb-fa1c-45ce-abb8-b46da23631d5\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"5\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3635\",\"info\":\"Test event 5 with an object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592379\",\"uuid\":\"8b8786f1-07f2-4bfc-a3f0-e63c22fcc25e\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1369,13 +1429,17 @@ { "@timestamp": "2021-05-21T10:19:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"266276\",\"last_seen\":null,\"object_id\":\"18209\",\"object_relation\":\"size-in-bytes\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621592379\",\"to_ids\":false,\"type\":\"size-in-bytes\",\"uuid\":\"e5ea3ec0-cdf4-4d3e-bd66-a7bf384fd3d7\",\"value\":\"55555\"},\"ObjectReference\":[],\"comment\":\"event 5 object comment\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"18209\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621592379\",\"uuid\":\"a62cb6fb-fa1c-45ce-abb8-b46da23631d5\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"5\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3635\",\"info\":\"Test event 5 with an object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592379\",\"uuid\":\"8b8786f1-07f2-4bfc-a3f0-e63c22fcc25e\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1457,13 +1521,17 @@ { "@timestamp": "2021-05-21T10:19:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"266273\",\"last_seen\":null,\"object_id\":\"18209\",\"object_relation\":\"sha256\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621592379\",\"to_ids\":true,\"type\":\"sha256\",\"uuid\":\"803f10bd-9087-4169-8699-277579a92693\",\"value\":\"567caa7653723f8818ec9eb6f2e27f6d9d8c0aca0c96fc457659340e7bbdc665\"},\"ObjectReference\":[],\"comment\":\"event 5 object comment\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"18209\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621592379\",\"uuid\":\"a62cb6fb-fa1c-45ce-abb8-b46da23631d5\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"5\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3635\",\"info\":\"Test event 5 with an object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592379\",\"uuid\":\"8b8786f1-07f2-4bfc-a3f0-e63c22fcc25e\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1550,13 +1618,17 @@ { "@timestamp": "2021-05-21T10:19:39.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":[],\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"266274\",\"last_seen\":null,\"object_id\":\"18209\",\"object_relation\":\"filename\",\"sharing_group_id\":\"0\",\"timestamp\":\"1621592379\",\"to_ids\":true,\"type\":\"filename\",\"uuid\":\"e5c7a9f0-c0e1-4024-9ab8-de8a1b403e4f\",\"value\":\"object5.txt\"},\"ObjectReference\":[],\"comment\":\"event 5 object comment\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3635\",\"first_seen\":null,\"id\":\"18209\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1621592379\",\"uuid\":\"a62cb6fb-fa1c-45ce-abb8-b46da23631d5\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"5\",\"date\":\"2021-05-21\",\"disable_correlation\":false,\"distribution\":\"1\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3635\",\"info\":\"Test event 5 with an object\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1621592379\",\"uuid\":\"8b8786f1-07f2-4bfc-a3f0-e63c22fcc25e\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1641,13 +1713,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266278\",\"last_seen\":null,\"object_id\":\"18210\",\"object_relation\":\"text\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200348\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"955e34a5-a630-42c9-868d-6e3dcb575987\",\"value\":\"Excutable create bad pipe\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18210\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1622200348\",\"uuid\":\"afe43d99-d8b6-47fa-8e7b-3d3ece2f8366\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1747,13 +1823,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266281\",\"last_seen\":null,\"object_id\":\"18211\",\"object_relation\":\"size-in-bytes\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200780\",\"to_ids\":false,\"type\":\"size-in-bytes\",\"uuid\":\"2fa7721b-ad73-4914-b082-8d44233ced98\",\"value\":\"3892\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"Object describing a section of a Portable Executable\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18211\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"pe-section\",\"sharing_group_id\":\"0\",\"template_uuid\":\"198a17d2-a135-4b25-9a32-5aa4e632014a\",\"template_version\":\"3\",\"timestamp\":\"1622200780\",\"uuid\":\"023be568-34d6-4df4-ae88-f4de0dbfcd9d\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1853,13 +1933,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266283\",\"last_seen\":null,\"object_id\":\"18211\",\"object_relation\":\"name\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200780\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"d35c1ff8-a69c-482b-8fb0-1182988d9468\",\"value\":\".data\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"Object describing a section of a Portable Executable\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18211\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"pe-section\",\"sharing_group_id\":\"0\",\"template_uuid\":\"198a17d2-a135-4b25-9a32-5aa4e632014a\",\"template_version\":\"3\",\"timestamp\":\"1622200780\",\"uuid\":\"023be568-34d6-4df4-ae88-f4de0dbfcd9d\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1959,13 +2043,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266284\",\"last_seen\":null,\"object_id\":\"18211\",\"object_relation\":\"text\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200780\",\"to_ids\":false,\"type\":\"text\",\"uuid\":\"dc11971a-a676-4676-b24c-a45a8791e0b0\",\"value\":\"Extracted zip archive data\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"Object describing a section of a Portable Executable\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18211\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"pe-section\",\"sharing_group_id\":\"0\",\"template_uuid\":\"198a17d2-a135-4b25-9a32-5aa4e632014a\",\"template_version\":\"3\",\"timestamp\":\"1622200780\",\"uuid\":\"023be568-34d6-4df4-ae88-f4de0dbfcd9d\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -2065,13 +2153,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Other\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266285\",\"last_seen\":null,\"object_id\":\"18211\",\"object_relation\":\"entropy\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200780\",\"to_ids\":false,\"type\":\"float\",\"uuid\":\"a85c0cbb-25a8-4bc9-b146-3cba1020e5bb\",\"value\":\"7.93280431051\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"Object describing a section of a Portable Executable\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18211\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"pe-section\",\"sharing_group_id\":\"0\",\"template_uuid\":\"198a17d2-a135-4b25-9a32-5aa4e632014a\",\"template_version\":\"3\",\"timestamp\":\"1622200780\",\"uuid\":\"023be568-34d6-4df4-ae88-f4de0dbfcd9d\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -2171,13 +2263,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266279\",\"last_seen\":null,\"object_id\":\"18210\",\"object_relation\":\"md5\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200348\",\"to_ids\":true,\"type\":\"md5\",\"uuid\":\"1c97c043-5de2-41a1-b591-3237174cd290\",\"value\":\"7392463caf95534d56460bc9f360adc1\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18210\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1622200348\",\"uuid\":\"afe43d99-d8b6-47fa-8e7b-3d3ece2f8366\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -2282,13 +2378,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266282\",\"last_seen\":null,\"object_id\":\"18211\",\"object_relation\":\"md5\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200780\",\"to_ids\":true,\"type\":\"md5\",\"uuid\":\"f3b8696e-5390-4383-ace2-6e06bfae497d\",\"value\":\"7295463caf95534d56460bc9f360adc1\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"Object describing a section of a Portable Executable\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18211\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"pe-section\",\"sharing_group_id\":\"0\",\"template_uuid\":\"198a17d2-a135-4b25-9a32-5aa4e632014a\",\"template_version\":\"3\",\"timestamp\":\"1622200780\",\"uuid\":\"023be568-34d6-4df4-ae88-f4de0dbfcd9d\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -2393,13 +2493,17 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Artifacts dropped\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266277\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1622200249\",\"to_ids\":false,\"type\":\"windows-service-name\",\"uuid\":\"3bd56a61-77f0-4885-8d1c-8bd2e39b65fb\",\"value\":\"badmojopipe\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":true,\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"266280\",\"last_seen\":null,\"object_id\":\"18210\",\"object_relation\":\"filename\",\"sharing_group_id\":\"0\",\"timestamp\":\"1622200348\",\"to_ids\":true,\"type\":\"filename\",\"uuid\":\"2dfcb937-e6af-4b5d-ad50-f8eb975990f3\",\"value\":\"badmojopipe.exe\"},\"ObjectReference\":[],\"comment\":\"\",\"deleted\":false,\"description\":\"File object describing a file with meta-information\",\"distribution\":\"5\",\"event_id\":\"3636\",\"first_seen\":null,\"id\":\"18210\",\"last_seen\":null,\"meta-category\":\"file\",\"name\":\"file\",\"sharing_group_id\":\"0\",\"template_uuid\":\"688c46fb-5edb-40a3-8273-1af7923e2215\",\"template_version\":\"22\",\"timestamp\":\"1622200348\",\"uuid\":\"afe43d99-d8b6-47fa-8e7b-3d3ece2f8366\"},\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"Orgc\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"78acad2d-cc2d-4785-94d6-b428a0070488\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"analysis\":\"0\",\"attribute_count\":\"9\",\"date\":\"2021-05-28\",\"disable_correlation\":false,\"distribution\":\"0\",\"event_creator_email\":\"admin@admin.test\",\"extends_uuid\":\"\",\"id\":\"3636\",\"info\":\"Test event 6 with multiple objects and multiple attributes\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"1\",\"proposal_email_lock\":false,\"publish_timestamp\":\"0\",\"published\":false,\"sharing_group_id\":\"0\",\"threat_level_id\":\"1\",\"timestamp\":\"1622200781\",\"uuid\":\"81aea1d1-bb23-4bcd-9b0c-496e9ce028df\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -2500,4 +2604,4 @@ } } ] -} +} \ No newline at end of file diff --git a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-long-ndjson.log-expected.json b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-long-ndjson.log-expected.json index ac88a3a7072..407efc0fbed 100644 --- a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-long-ndjson.log-expected.json +++ b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-long-ndjson.log-expected.json @@ -3,12 +3,16 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -105,12 +109,16 @@ { "@timestamp": "2021-05-28T11:19:41.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -210,4 +218,4 @@ } } ] -} +} \ No newline at end of file diff --git a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json index ab028a8b4ed..27fee944dba 100644 --- a/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json +++ b/packages/ti_misp/data_stream/threat/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json @@ -3,13 +3,17 @@ { "@timestamp": "2017-08-28T14:24:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Payload delivery\",\"comment\":\"- Xchecked via VT: a683494fc0d017fd3b4638f8b84caaaac145cc28bc211bd7361723368b4bb21e\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"5\",\"first_seen\":null,\"id\":\"351\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1503930272\",\"to_ids\":true,\"type\":\"md5\",\"uuid\":\"59a427a0-f6f8-4178-9e7d-dfd702de0b81\",\"value\":\"f2679bdabe46e10edc6352fff3c829bc\"},\"EventReport\":[],\"Galaxy\":[{\"GalaxyCluster\":[{\"authors\":[\"https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml\",\"http://pastebin.com/raw/GHgpWjar\",\"MISP Project\"],\"collection_uuid\":\"10cf658b-5d32-4c4b-bb32-61760a640372\",\"description\":\"It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CrySiS \\\\u003e Dharma Note: ATTENTION! At the moment, your system is not protected. We can fix it and restore files. To restore the system write to this address: bitcoin143@india.com. CrySiS variant\",\"galaxy_id\":\"43\",\"id\":\"6619\",\"local\":false,\"meta\":{\"date\":[\"November 2016\"],\"encryption\":[\"AES + RSA-512\"],\"extensions\":[\".dharma\",\".wallet\",\".zzzzz\",\".cmb\",\".id-BCBEF350.[paymentbtc@firemail.cc].cmb\",\".bip\",\".id-BCBEF350.[Beamsell@qq.com].bip\",\".boost\",\".[Darknes@420blaze.it].waifu\",\".brrr\",\".adobe\",\".tron\",\".AUDIT\",\".cccmn\",\".fire\",\".myjob\",\".[cyberwars@qq.com].war\",\".risk\",\".RISK\",\".bkpx\",\".[newsantaclaus@aol.com].santa\"],\"payment-method\":[\"Bitcoin - Email\"],\"ransomnotes\":[\"all your data has been locked us\\\\nYou want to return?\\\\nwrite email paymentbtc@firemail.cc\",\"All your files have been encrypted!\\\\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail paymentbtc@firemail.cc\\\\nWrite this ID in the title of your message ACBFF130\\\\nIn case of no answer in 24 hours write us to theese e-mails:paymentbtc@firemail.cc\\\\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.\\\\nFree decryption as guarantee\\\\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)\\\\nHow to obtain Bitcoins\\\\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\\\\nhttps://localbitcoins.com/buy_bitcoins\\\\nAlso you can find other places to buy Bitcoins and beginners guide here:\\\\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\\\\nAttention!\\\\nDo not rename encrypted files.\\\\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\\\\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\",\"All your files have been encrypted!\\\\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail Beamsell@qq.com\\\\nWrite this ID in the title of your message BCBEF350\\\\nIn case of no answer in 24 hours write us to theese e-mails:Beamsell@qq.com\\\\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. \\\\nFree decryption as guarantee\\\\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) \\\\nHow to obtain Bitcoins\\\\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. \\\\nhttps://localbitcoins.com/buy_bitcoins \\\\nAlso you can find other places to buy Bitcoins and beginners guide here: \\\\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/ \\\\nAttention!\\\\nDo not rename encrypted files. \\\\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\\\\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\",\"all your data has been locked us\\\\nYou want to return?\\\\nwrite email Beamsell@qq.com\"],\"ransomnotes-filenames\":[\"README.txt\",\"README.jpg\",\"Info.hta\",\"FILES ENCRYPTED.txt\",\"INFO.hta\"],\"ransomnotes-refs\":[\"https://www.bleepstatic.com/images/news/ransomware/d/dharma/cmb/hta-ransom-note.jpg\",\"https://pbs.twimg.com/media/Dmof_FiXsAAAvTN.jpg\",\"https://pbs.twimg.com/media/Dmof_FyXsAEJmgQ.jpg\",\"https://pbs.twimg.com/media/DrWqLWzXgAc4SlG.jpg\",\"https://pbs.twimg.com/media/DuEBIMBW0AANnGW.jpg\"],\"refs\":[\"https://id-ransomware.blogspot.co.il/2016/11/dharma-ransomware.html\",\"https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/\",\"https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/\",\"https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/\",\"https://twitter.com/demonslay335/status/1049313390097813504\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/\",\"https://twitter.com/JakubKroustek/status/1038680437508501504\",\"https://twitter.com/demonslay335/status/1059521042383814657\",\"https://twitter.com/demonslay335/status/1059940414147489792\",\"https://twitter.com/JakubKroustek/status/1060825783197933568\",\"https://twitter.com/JakubKroustek/status/1064061275863425025\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/\",\"https://www.youtube.com/watch?v=qjoYtwLx2TI\",\"https://twitter.com/GrujaRS/status/1072139616910757888\"]},\"source\":\"Various\",\"tag_id\":\"23\",\"tag_name\":\"misp-galaxy:ransomware=\\\"Dharma Ransomware\\\"\",\"type\":\"ransomware\",\"uuid\":\"2b365b2c-4a9a-4b66-804d-3b2d2814fe7b\",\"value\":\"Dharma Ransomware\",\"version\":\"86\"}],\"description\":\"Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml\",\"icon\":\"btc\",\"id\":\"43\",\"name\":\"Ransomware\",\"namespace\":\"misp\",\"type\":\"ransomware\",\"uuid\":\"3f44af2e-1480-4b6b-9aa8-f9bb21341078\",\"version\":\"4\"}],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"982f7c55-684d-4eb9-8736-fb5f668b899d\"},\"Orgc\":{\"id\":\"2\",\"local\":false,\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"Tag\":[{\"colour\":\"#0088cc\",\"exportable\":true,\"hide_tag\":false,\"id\":\"23\",\"local\":0,\"name\":\"misp-galaxy:ransomware=\\\"Dharma Ransomware\\\"\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#004646\",\"exportable\":true,\"hide_tag\":false,\"id\":\"21\",\"local\":0,\"name\":\"type:OSINT\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#ffffff\",\"exportable\":true,\"hide_tag\":false,\"id\":\"2\",\"local\":0,\"name\":\"tlp:white\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#2c4f00\",\"exportable\":true,\"hide_tag\":false,\"id\":\"24\",\"local\":0,\"name\":\"malware_classification:malware-category=\\\"Ransomware\\\"\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#00223b\",\"exportable\":true,\"hide_tag\":false,\"id\":\"3\",\"local\":0,\"name\":\"osint:source-type=\\\"blog - post\\\"\",\"numerical_value\":null,\"user_id\":\"0\"}],\"analysis\":\"2\",\"attribute_count\":\"7\",\"date\":\"2017-08-25\",\"disable_correlation\":false,\"distribution\":\"3\",\"extends_uuid\":\"\",\"id\":\"5\",\"info\":\"OSINT - New Arena Crysis Ransomware Variant Released\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"2\",\"proposal_email_lock\":false,\"publish_timestamp\":\"1603226331\",\"published\":true,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1503930276\",\"uuid\":\"59a3d08d-5dc8-4153-bc7c-456d950d210f\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -84,13 +88,17 @@ { "@timestamp": "2017-08-28T14:24:36.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"id\":\"10794\",\"type\":\"domain|ip\",\"category\":\"Network activity\",\"to_ids\":false,\"uuid\":\"5bf30242-8ef4-4c52-a2d7-0b7b0a016219\",\"event_id\":\"14\",\"distribution\":\"5\",\"timestamp\":\"1542652482\",\"comment\":\"1st stage\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"your-ip.getmyip.com|89.160.20.156\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"EventReport\":[],\"Galaxy\":[{\"GalaxyCluster\":[{\"authors\":[\"https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml\",\"http://pastebin.com/raw/GHgpWjar\",\"MISP Project\"],\"collection_uuid\":\"10cf658b-5d32-4c4b-bb32-61760a640372\",\"description\":\"It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. CrySiS \\\\u003e Dharma Note: ATTENTION! At the moment, your system is not protected. We can fix it and restore files. To restore the system write to this address: bitcoin143@india.com. CrySiS variant\",\"galaxy_id\":\"43\",\"id\":\"6619\",\"local\":false,\"meta\":{\"date\":[\"November 2016\"],\"encryption\":[\"AES + RSA-512\"],\"extensions\":[\".dharma\",\".wallet\",\".zzzzz\",\".cmb\",\".id-BCBEF350.[paymentbtc@firemail.cc].cmb\",\".bip\",\".id-BCBEF350.[Beamsell@qq.com].bip\",\".boost\",\".[Darknes@420blaze.it].waifu\",\".brrr\",\".adobe\",\".tron\",\".AUDIT\",\".cccmn\",\".fire\",\".myjob\",\".[cyberwars@qq.com].war\",\".risk\",\".RISK\",\".bkpx\",\".[newsantaclaus@aol.com].santa\"],\"payment-method\":[\"Bitcoin - Email\"],\"ransomnotes\":[\"all your data has been locked us\\\\nYou want to return?\\\\nwrite email paymentbtc@firemail.cc\",\"All your files have been encrypted!\\\\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail paymentbtc@firemail.cc\\\\nWrite this ID in the title of your message ACBFF130\\\\nIn case of no answer in 24 hours write us to theese e-mails:paymentbtc@firemail.cc\\\\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files.\\\\nFree decryption as guarantee\\\\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.)\\\\nHow to obtain Bitcoins\\\\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price.\\\\nhttps://localbitcoins.com/buy_bitcoins\\\\nAlso you can find other places to buy Bitcoins and beginners guide here:\\\\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/\\\\nAttention!\\\\nDo not rename encrypted files.\\\\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\\\\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\",\"All your files have been encrypted!\\\\nAll your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail Beamsell@qq.com\\\\nWrite this ID in the title of your message BCBEF350\\\\nIn case of no answer in 24 hours write us to theese e-mails:Beamsell@qq.com\\\\nYou have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. \\\\nFree decryption as guarantee\\\\nBefore paying you can send us up to 1 file for free decryption. The total size of files must be less than 1Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) \\\\nHow to obtain Bitcoins\\\\nThe easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. \\\\nhttps://localbitcoins.com/buy_bitcoins \\\\nAlso you can find other places to buy Bitcoins and beginners guide here: \\\\nhttp://www.coindesk.com/information/how-can-i-buy-bitcoins/ \\\\nAttention!\\\\nDo not rename encrypted files. \\\\nDo not try to decrypt your data using third party software, it may cause permanent data loss.\\\\nDecryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.\",\"all your data has been locked us\\\\nYou want to return?\\\\nwrite email Beamsell@qq.com\"],\"ransomnotes-filenames\":[\"README.txt\",\"README.jpg\",\"Info.hta\",\"FILES ENCRYPTED.txt\",\"INFO.hta\"],\"ransomnotes-refs\":[\"https://www.bleepstatic.com/images/news/ransomware/d/dharma/cmb/hta-ransom-note.jpg\",\"https://pbs.twimg.com/media/Dmof_FiXsAAAvTN.jpg\",\"https://pbs.twimg.com/media/Dmof_FyXsAEJmgQ.jpg\",\"https://pbs.twimg.com/media/DrWqLWzXgAc4SlG.jpg\",\"https://pbs.twimg.com/media/DuEBIMBW0AANnGW.jpg\"],\"refs\":[\"https://id-ransomware.blogspot.co.il/2016/11/dharma-ransomware.html\",\"https://www.bleepingcomputer.com/news/security/kaspersky-releases-decryptor-for-the-dharma-ransomware/\",\"https://www.bleepingcomputer.com/news/security/new-cmb-dharma-ransomware-variant-released/\",\"https://www.bleepingcomputer.com/news/security/new-bip-dharma-ransomware-variant-released/\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-october-12th-2018-notpetya-gandcrab-and-more/\",\"https://twitter.com/demonslay335/status/1049313390097813504\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-14th-2018-kraken-dharma-and-matrix/\",\"https://twitter.com/JakubKroustek/status/1038680437508501504\",\"https://twitter.com/demonslay335/status/1059521042383814657\",\"https://twitter.com/demonslay335/status/1059940414147489792\",\"https://twitter.com/JakubKroustek/status/1060825783197933568\",\"https://twitter.com/JakubKroustek/status/1064061275863425025\",\"https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-november-23rd-2018-stop-dharma-and-more/\",\"https://www.youtube.com/watch?v=qjoYtwLx2TI\",\"https://twitter.com/GrujaRS/status/1072139616910757888\"]},\"source\":\"Various\",\"tag_id\":\"23\",\"tag_name\":\"misp-galaxy:ransomware=\\\"Dharma Ransomware\\\"\",\"type\":\"ransomware\",\"uuid\":\"2b365b2c-4a9a-4b66-804d-3b2d2814fe7b\",\"value\":\"Dharma Ransomware\",\"version\":\"86\"}],\"description\":\"Ransomware galaxy based on https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml\",\"icon\":\"btc\",\"id\":\"43\",\"name\":\"Ransomware\",\"namespace\":\"misp\",\"type\":\"ransomware\",\"uuid\":\"3f44af2e-1480-4b6b-9aa8-f9bb21341078\",\"version\":\"4\"}],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"982f7c55-684d-4eb9-8736-fb5f668b899d\"},\"Orgc\":{\"id\":\"2\",\"local\":false,\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"Tag\":[{\"colour\":\"#0088cc\",\"exportable\":true,\"hide_tag\":false,\"id\":\"23\",\"local\":0,\"name\":\"misp-galaxy:ransomware=\\\"Dharma Ransomware\\\"\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#004646\",\"exportable\":true,\"hide_tag\":false,\"id\":\"21\",\"local\":0,\"name\":\"type:OSINT\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#ffffff\",\"exportable\":true,\"hide_tag\":false,\"id\":\"2\",\"local\":0,\"name\":\"tlp:white\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#2c4f00\",\"exportable\":true,\"hide_tag\":false,\"id\":\"24\",\"local\":0,\"name\":\"malware_classification:malware-category=\\\"Ransomware\\\"\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#00223b\",\"exportable\":true,\"hide_tag\":false,\"id\":\"3\",\"local\":0,\"name\":\"osint:source-type=\\\"blog - post\\\"\",\"numerical_value\":null,\"user_id\":\"0\"}],\"analysis\":\"2\",\"attribute_count\":\"7\",\"date\":\"2017-08-25\",\"disable_correlation\":false,\"distribution\":\"3\",\"extends_uuid\":\"\",\"id\":\"5\",\"info\":\"OSINT - New Arena Crysis Ransomware Variant Released\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"2\",\"proposal_email_lock\":false,\"publish_timestamp\":\"1603226331\",\"published\":true,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1503930276\",\"uuid\":\"59a3d08d-5dc8-4153-bc7c-456d950d210f\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -164,13 +172,17 @@ { "@timestamp": "2017-04-28T18:23:44.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"External analysis\",\"comment\":\"Carbon sample - Xchecked via VT: a08b8371ead1919500a4759c2f46553620d5a9d9\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"4\",\"first_seen\":null,\"id\":\"342\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1490878550\",\"to_ids\":false,\"type\":\"link\",\"uuid\":\"58dd0056-6e74-43d5-b58b-494802de0b81\",\"value\":\"https://www.virustotal.com/file/7fa4482bfbca550ce296d8e791b1091d60d733ea8042167fd0eb853530584452/analysis/1486030116/\"},\"EventReport\":[],\"Galaxy\":[{\"GalaxyCluster\":[{\"authors\":[\"Alexandre Dulaunoy\",\"Florian Roth\",\"Timo Steffens\",\"Christophe Vandeplas\",\"Dennis Rand\",\"raw-data\"],\"collection_uuid\":\"0d821b68-9d82-4c6d-86a6-1071a9e0f79f\",\"description\":\"Family of related sophisticated backdoor software - Name comes from Microsoft detection signature – anagram of Ultra (Ultra3) was a name of the fake driver). A macOS version exists but appears incomplete and lacking features...for now!\",\"galaxy_id\":\"36\",\"id\":\"5828\",\"local\":false,\"meta\":{\"refs\":[\"https://www.first.org/resources/papers/tbilisi2014/turla-operations_and_development.pdf\",\"https://objective-see.com/blog/blog_0x25.html#Snake\"],\"synonyms\":[\"Snake\",\"Uroburos\",\"Urouros\"],\"type\":[\"Backdoor\",\"Rootkit\"]},\"source\":\"MISP Project\",\"tag_id\":\"22\",\"tag_name\":\"misp-galaxy:tool=\\\"Turla\\\"\",\"type\":\"tool\",\"uuid\":\"22332d52-c0c2-443c-9ffb-f08c0d23722c\",\"value\":\"Turla\",\"version\":\"138\"}],\"description\":\"Threat actors tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.\",\"icon\":\"optin-monster\",\"id\":\"36\",\"name\":\"Tool\",\"namespace\":\"misp\",\"type\":\"tool\",\"uuid\":\"9b8037f7-bc8f-4de1-a797-37266619bc0b\",\"version\":\"3\"}],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"982f7c55-684d-4eb9-8736-fb5f668b899d\"},\"Orgc\":{\"id\":\"2\",\"local\":false,\"name\":\"CIRCL\",\"uuid\":\"55f6ea5e-2c60-40e5-964f-47a8950d210f\"},\"RelatedEvent\":[{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"982f7c55-684d-4eb9-8736-fb5f668b899d\"},\"Orgc\":{\"id\":\"4\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\"},\"analysis\":\"2\",\"date\":\"2015-01-20\",\"distribution\":\"3\",\"id\":\"369\",\"info\":\"OSINT Analysis of Project Cobra Another extensible framework used by the Uroburos’ actors from Gdata\",\"org_id\":\"1\",\"orgc_id\":\"4\",\"published\":true,\"threat_level_id\":\"1\",\"timestamp\":\"1498163317\",\"uuid\":\"54bf5a6f-ac50-4f71-9cd3-7080950d210b\"}},{\"Event\":{\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"982f7c55-684d-4eb9-8736-fb5f668b899d\"},\"Orgc\":{\"id\":\"4\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\"},\"analysis\":\"2\",\"date\":\"2014-11-20\",\"distribution\":\"3\",\"id\":\"621\",\"info\":\"Turla digging using TotalHash\",\"org_id\":\"1\",\"orgc_id\":\"4\",\"published\":true,\"threat_level_id\":\"2\",\"timestamp\":\"1498163604\",\"uuid\":\"546daad5-425c-4ac4-82c7-e07f950d210b\"}}],\"ShadowAttribute\":[],\"Tag\":[{\"colour\":\"#065100\",\"exportable\":true,\"hide_tag\":false,\"id\":\"22\",\"local\":0,\"name\":\"misp-galaxy:tool=\\\"Turla\\\"\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#ffffff\",\"exportable\":true,\"hide_tag\":false,\"id\":\"2\",\"local\":0,\"name\":\"tlp:white\",\"numerical_value\":null,\"user_id\":\"0\"}],\"analysis\":\"2\",\"attribute_count\":\"100\",\"date\":\"2017-03-30\",\"disable_correlation\":false,\"distribution\":\"3\",\"extends_uuid\":\"\",\"id\":\"4\",\"info\":\"OSINT - Carbon Paper: Peering into Turla’s second stage backdoor\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"2\",\"proposal_email_lock\":false,\"publish_timestamp\":\"1603226330\",\"published\":true,\"sharing_group_id\":\"0\",\"threat_level_id\":\"3\",\"timestamp\":\"1493403824\",\"uuid\":\"58dcfe62-ed84-4e5e-b293-4991950d210f\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -244,13 +256,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"1077\",\"type\":\"sha256\",\"category\":\"External analysis\",\"to_ids\":true,\"uuid\":\"54324042-49fc-4628-a95e-44da950d210b\",\"event_id\":\"2\",\"distribution\":\"5\",\"timestamp\":\"1412579394\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"0a1103bc90725d4665b932f88e81d39eafa5823b0de3ab146e2d4548b7da79a0\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -322,13 +338,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"1084\",\"type\":\"ip-dst\",\"category\":\"Network activity\",\"to_ids\":true,\"uuid\":\"54324081-3308-4f1f-8674-4953950d210b\",\"event_id\":\"2\",\"distribution\":\"5\",\"timestamp\":\"1412579457\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"89.160.20.156\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -396,13 +416,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"1086\",\"type\":\"hostname\",\"category\":\"Network activity\",\"to_ids\":true,\"uuid\":\"543240dc-f068-437a-baa9-48f2950d210b\",\"event_id\":\"2\",\"distribution\":\"5\",\"timestamp\":\"1412579548\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"xenserver.ddns.net\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -472,13 +496,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"1089\",\"type\":\"text\",\"category\":\"External analysis\",\"to_ids\":false,\"uuid\":\"543240f9-64e8-41f2-958f-4e21950d210b\",\"event_id\":\"2\",\"distribution\":\"5\",\"timestamp\":\"1412579577\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"Nitro\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -545,13 +573,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"1090\",\"type\":\"sha1\",\"category\":\"External analysis\",\"to_ids\":true,\"uuid\":\"56c625a7-f31c-460c-9ea1-c652950d210f\",\"event_id\":\"2\",\"distribution\":\"5\",\"timestamp\":\"1455826343\",\"comment\":\"Automatically added (via 7915aabb2e66ff14841e4ef0fbff7486)\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"0ea76f1586c008932d90c991dfdd5042f3aac8ea\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -623,13 +655,17 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"2\",\"orgc_id\":\"2\",\"org_id\":\"1\",\"date\":\"2014-10-03\",\"threat_level_id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"published\":true,\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\",\"attribute_count\":\"29\",\"analysis\":\"2\",\"timestamp\":\"1412579577\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610622316\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"2\",\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\",\"local\":false},\"Attribute\":{\"id\":\"12394\",\"type\":\"domain\",\"category\":\"Network activity\",\"to_ids\":false,\"uuid\":\"572b4ab3-1af0-4d91-9cd5-07a1c0a8ab16\",\"event_id\":\"22\",\"distribution\":\"5\",\"timestamp\":\"1462454963\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"whatsapp.com\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"1\",\"name\":\"type:OSINT\",\"colour\":\"#004646\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"2\",\"name\":\"tlp:green\",\"colour\":\"#339900\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -699,13 +735,17 @@ { "@timestamp": "2018-08-28T13:20:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"158\",\"orgc_id\":\"5\",\"org_id\":\"1\",\"date\":\"2018-01-08\",\"threat_level_id\":\"1\",\"info\":\"Turla: Mosquito Whitepaper\",\"published\":true,\"uuid\":\"5a5395d1-40a0-45fc-b692-334a0a016219\",\"attribute_count\":\"61\",\"analysis\":\"0\",\"timestamp\":\"1535462417\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637953\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\",\"local\":false},\"Attribute\":{\"id\":\"17299\",\"type\":\"url\",\"category\":\"Network activity\",\"to_ids\":false,\"uuid\":\"5a53976c-e7c8-480d-a68a-2fc50a016219\",\"event_id\":\"158\",\"distribution\":\"5\",\"timestamp\":\"1515427692\",\"comment\":\"Fake adobe URL\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"http://get.adobe.com/stats/AbfFcBebD/?q=\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[{\"Event\":{\"id\":\"58\",\"date\":\"2018-08-17\",\"threat_level_id\":\"1\",\"info\":\"Turla Outlook White Paper\",\"published\":true,\"uuid\":\"5b773e07-e694-458b-b99c-27f30a016219\",\"analysis\":\"0\",\"timestamp\":\"1535462383\",\"distribution\":\"3\",\"org_id\":\"1\",\"orgc_id\":\"5\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\"},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\"}}}],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"7\",\"name\":\"misp-galaxy:threat-actor=\\\"Turla Group\\\"\",\"colour\":\"#0088cc\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":true,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"70\",\"name\":\"Turla\",\"colour\":\"#f20f53\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -781,13 +821,17 @@ { "@timestamp": "2018-08-28T13:20:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"158\",\"orgc_id\":\"5\",\"org_id\":\"1\",\"date\":\"2018-01-08\",\"threat_level_id\":\"1\",\"info\":\"Turla: Mosquito Whitepaper\",\"published\":true,\"uuid\":\"5a5395d1-40a0-45fc-b692-334a0a016219\",\"attribute_count\":\"61\",\"analysis\":\"0\",\"timestamp\":\"1535462417\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637953\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\",\"local\":false},\"Attribute\":{\"id\":\"17330\",\"type\":\"uri\",\"category\":\"Network activity\",\"to_ids\":false,\"uuid\":\"5a539ce1-3de0-4e34-8fc4-2fc50a016219\",\"event_id\":\"158\",\"distribution\":\"5\",\"timestamp\":\"1515429089\",\"comment\":\"Win32 backdoor C\u0026C URI\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"/scripts/m/query.php?id=\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[{\"Event\":{\"id\":\"58\",\"date\":\"2018-08-17\",\"threat_level_id\":\"1\",\"info\":\"Turla Outlook White Paper\",\"published\":true,\"uuid\":\"5b773e07-e694-458b-b99c-27f30a016219\",\"analysis\":\"0\",\"timestamp\":\"1535462383\",\"distribution\":\"3\",\"org_id\":\"1\",\"orgc_id\":\"5\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\"},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\"}}}],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"7\",\"name\":\"misp-galaxy:threat-actor=\\\"Turla Group\\\"\",\"colour\":\"#0088cc\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":true,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"70\",\"name\":\"Turla\",\"colour\":\"#f20f53\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -855,13 +899,17 @@ { "@timestamp": "2018-08-28T13:20:17.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"158\",\"orgc_id\":\"5\",\"org_id\":\"1\",\"date\":\"2018-01-08\",\"threat_level_id\":\"1\",\"info\":\"Turla: Mosquito Whitepaper\",\"published\":true,\"uuid\":\"5a5395d1-40a0-45fc-b692-334a0a016219\",\"attribute_count\":\"61\",\"analysis\":\"0\",\"timestamp\":\"1535462417\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637953\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\",\"local\":false},\"Attribute\":{\"id\":\"17322\",\"type\":\"filename|sha1\",\"category\":\"Artifacts dropped\",\"to_ids\":false,\"uuid\":\"5a539ce1-e6a0-426a-942c-2fc50a016219\",\"event_id\":\"158\",\"distribution\":\"5\",\"timestamp\":\"1515429089\",\"comment\":\"JavaScript backdoor\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"google_update_checker.js|c51d288469df9f25e2fb7ac491918b3e579282ea\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[{\"Event\":{\"id\":\"58\",\"date\":\"2018-08-17\",\"threat_level_id\":\"1\",\"info\":\"Turla Outlook White Paper\",\"published\":true,\"uuid\":\"5b773e07-e694-458b-b99c-27f30a016219\",\"analysis\":\"0\",\"timestamp\":\"1535462383\",\"distribution\":\"3\",\"org_id\":\"1\",\"orgc_id\":\"5\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\"},\"Orgc\":{\"id\":\"5\",\"name\":\"ESET\",\"uuid\":\"55f6ea5e-51ac-4344-bc8c-4170950d210f\"}}}],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"7\",\"name\":\"misp-galaxy:threat-actor=\\\"Turla Group\\\"\",\"colour\":\"#0088cc\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":true,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"70\",\"name\":\"Turla\",\"colour\":\"#f20f53\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -935,13 +983,17 @@ { "@timestamp": "2018-01-23T16:09:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"22\",\"orgc_id\":\"4\",\"org_id\":\"1\",\"date\":\"2015-12-08\",\"threat_level_id\":\"3\",\"info\":\"Packrat: Seven Years of a South American Threat Actor\",\"published\":true,\"uuid\":\"56ccdcaf-f7e4-40d8-bca1-51299062e56a\",\"attribute_count\":\"133\",\"analysis\":\"2\",\"timestamp\":\"1516723796\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637901\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"4\",\"name\":\"CUDESO\",\"uuid\":\"56c42374-fdb8-4544-a218-41ffc0a8ab16\",\"local\":false},\"Attribute\":{\"id\":\"12268\",\"type\":\"email-src\",\"category\":\"Payload delivery\",\"to_ids\":true,\"uuid\":\"56ccdcb6-4d6c-4e48-b955-52849062e56a\",\"event_id\":\"22\",\"distribution\":\"5\",\"timestamp\":\"1456266422\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"claudiobonadio88@gmail.com\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1010,13 +1062,17 @@ { "@timestamp": "2018-01-23T16:09:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"22\",\"orgc_id\":\"4\",\"org_id\":\"1\",\"date\":\"2015-12-08\",\"threat_level_id\":\"3\",\"info\":\"Packrat: Seven Years of a South American Threat Actor\",\"published\":true,\"uuid\":\"56ccdcaf-f7e4-40d8-bca1-51299062e56a\",\"attribute_count\":\"133\",\"analysis\":\"2\",\"timestamp\":\"1516723796\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637901\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"4\",\"name\":\"CUDESO\",\"uuid\":\"56c42374-fdb8-4544-a218-41ffc0a8ab16\",\"local\":false},\"Attribute\":{\"id\":\"12298\",\"type\":\"regkey\",\"category\":\"Artifacts dropped\",\"to_ids\":true,\"uuid\":\"56ccdcd6-f4b8-4383-9624-52849062e56a\",\"event_id\":\"22\",\"distribution\":\"5\",\"timestamp\":\"1456266454\",\"comment\":\"\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"HKLM\\\\SOFTWARE\\\\Microsoft\\\\Active\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1085,13 +1141,17 @@ { "@timestamp": "2020-12-13T14:03:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"Event\":{\"id\":\"10\",\"orgc_id\":\"4\",\"org_id\":\"1\",\"date\":\"2020-12-09\",\"threat_level_id\":\"3\",\"info\":\"Recent Qakbot (Qbot) activity\",\"published\":true,\"uuid\":\"5fd0c599-ab6c-4ba1-a69a-df9ec0a8ab16\",\"attribute_count\":\"15\",\"analysis\":\"2\",\"timestamp\":\"1607868196\",\"distribution\":\"3\",\"proposal_email_lock\":false,\"locked\":false,\"publish_timestamp\":\"1610637888\",\"sharing_group_id\":\"0\",\"disable_correlation\":false,\"extends_uuid\":\"\",\"Org\":{\"id\":\"1\",\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\",\"local\":true},\"Orgc\":{\"id\":\"4\",\"name\":\"CUDESO\",\"uuid\":\"56c42374-fdb8-4544-a218-41ffc0a8ab16\",\"local\":false},\"Attribute\":{\"id\":\"10686\",\"type\":\"ip-dst|port\",\"category\":\"Network activity\",\"to_ids\":true,\"uuid\":\"5fd0c620-a844-4ace-9710-a37bc0a8ab16\",\"event_id\":\"10\",\"distribution\":\"5\",\"timestamp\":\"1607517728\",\"comment\":\"On port 2222\",\"sharing_group_id\":\"0\",\"deleted\":false,\"disable_correlation\":false,\"object_id\":\"0\",\"object_relation\":null,\"first_seen\":null,\"last_seen\":null,\"value\":\"89.160.20.156|2222\",\"Galaxy\":[],\"ShadowAttribute\":[]},\"ShadowAttribute\":[],\"RelatedEvent\":[],\"Galaxy\":[],\"Object\":[],\"EventReport\":[],\"Tag\":[{\"id\":\"3\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":false,\"is_custom_galaxy\":false,\"local\":0},{\"id\":\"6\",\"name\":\"misp-galaxy:banker=\\\"Qakbot\\\"\",\"colour\":\"#0088cc\",\"exportable\":true,\"user_id\":\"0\",\"hide_tag\":false,\"numerical_value\":null,\"is_galaxy\":true,\"is_custom_galaxy\":false,\"local\":0}]}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -1159,4 +1219,4 @@ }, null ] -} +} \ No newline at end of file diff --git a/packages/ti_misp/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/ti_misp/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index adfb5291b6e..3a5a5b91dba 100644 --- a/packages/ti_misp/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_misp/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -24,6 +24,13 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' - json: field: event.original target_field: json @@ -81,7 +88,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: if: ctx.misp?.event?.publish_timestamp != null field: misp.event.publish_timestamp @@ -148,7 +155,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: misp.context.attribute.timestamp target_field: misp.context.attribute.timestamp @@ -162,7 +169,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: misp.object.timestamp target_field: misp.object.timestamp @@ -176,7 +183,7 @@ processors: ignore_missing: true - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' ##################### # Threat ECS Fields # diff --git a/packages/ti_misp/data_stream/threat/manifest.yml b/packages/ti_misp/data_stream/threat/manifest.yml index 6e821bc6453..063d60bab64 100644 --- a/packages/ti_misp/data_stream/threat/manifest.yml +++ b/packages/ti_misp/data_stream/threat/manifest.yml @@ -20,15 +20,16 @@ streams: description: The API token used to access the MISP instance. - name: initial_interval type: text - title: Interval + title: Initial interval multi: false required: true show_user: true default: 120h - description: How far back to look for indicators the first time the agent is started. + description: How far back to look for indicators the first time the agent is started. Supported units for this parameter are h/m/s. - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -58,6 +59,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_misp/data_stream/threat/sample_event.json b/packages/ti_misp/data_stream/threat/sample_event.json index 01f3d2ca756..271f4a099fe 100644 --- a/packages/ti_misp/data_stream/threat/sample_event.json +++ b/packages/ti_misp/data_stream/threat/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2014-10-06T07:12:57.000Z", "agent": { - "ephemeral_id": "8b7db8eb-8a30-49a2-83c7-f7e8fa4556ca", - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "ephemeral_id": "24754055-2625-498c-8778-8566dbc8a368", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_misp.threat", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.6.2" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-04-27T23:35:52.939Z", + "category": [ + "threat" + ], + "created": "2023-08-28T15:43:07.992Z", "dataset": "ti_misp.threat", - "ingested": "2023-04-27T23:35:53Z", + "ingested": "2023-08-28T15:43:09Z", "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Network activity\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"22\",\"first_seen\":null,\"id\":\"12394\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1462454963\",\"to_ids\":false,\"type\":\"domain\",\"uuid\":\"572b4ab3-1af0-4d91-9cd5-07a1c0a8ab16\",\"value\":\"whatsapp.com\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\"},\"Orgc\":{\"id\":\"2\",\"local\":false,\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"Tag\":[{\"colour\":\"#004646\",\"exportable\":true,\"hide_tag\":false,\"id\":\"1\",\"is_custom_galaxy\":false,\"is_galaxy\":false,\"local\":0,\"name\":\"type:OSINT\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#339900\",\"exportable\":true,\"hide_tag\":false,\"id\":\"2\",\"is_custom_galaxy\":false,\"is_galaxy\":false,\"local\":0,\"name\":\"tlp:green\",\"numerical_value\":null,\"user_id\":\"0\"}],\"analysis\":\"2\",\"attribute_count\":\"29\",\"date\":\"2014-10-03\",\"disable_correlation\":false,\"distribution\":\"3\",\"extends_uuid\":\"\",\"id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"2\",\"proposal_email_lock\":false,\"publish_timestamp\":\"1610622316\",\"published\":true,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1412579577\",\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" @@ -44,7 +48,7 @@ "id": "12394", "object_id": "0", "sharing_group_id": "0", - "timestamp": "1462454963", + "timestamp": "2016-05-05T13:29:23.000Z", "to_ids": false, "type": "domain", "uuid": "572b4ab3-1af0-4d91-9cd5-07a1c0a8ab16" @@ -61,7 +65,7 @@ "org_id": "1", "orgc_id": "2", "proposal_email_lock": false, - "publish_timestamp": "1610622316", + "publish_timestamp": "2021-01-14T11:05:16.000Z", "published": true, "sharing_group_id": "0", "threat_level_id": 2, diff --git a/packages/ti_misp/data_stream/threat_attributes/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json b/packages/ti_misp/data_stream/threat_attributes/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json index 8215dafc02c..fe390ee9611 100644 --- a/packages/ti_misp/data_stream/threat_attributes/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json +++ b/packages/ti_misp/data_stream/threat_attributes/_dev/test/pipeline/test-misp-sample-ndjson.log-expected.json @@ -3,13 +3,17 @@ { "@timestamp": "2021-04-08T09:52:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"12345\",\"event_id\":\"12345\",\"object_id\":\"12345\",\"object_relation\":\"sensor\",\"category\":\"Internal reference\",\"type\":\"md5\",\"value\":\"127.0.0.1\",\"to_ids\":true,\"uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"timestamp\":\"1617875568\",\"distribution\":\"0\",\"sharing_group_id\":\"1\",\"comment\":\"logged source ip\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":\"1581984000000000\",\"last_seen\":\"1581984000000000\",\"data\":\"string\",\"event_uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"decay_score\":[{\"score\":10.5,\"base_score\":80,\"decayed\":true,\"DecayingModel\":{\"id\":\"12345\",\"name\":\"Phishing model\"}}],\"Event\":{\"id\":\"12345\",\"org_id\":\"12345\",\"distribution\":\"0\",\"info\":\"logged source ip\",\"orgc_id\":\"12345\",\"uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"date\":\"1991-01-15\",\"published\":false,\"analysis\":\"0\",\"attribute_count\":\"321\",\"timestamp\":\"1617875568\",\"sharing_group_id\":\"1\",\"proposal_email_lock\":true,\"locked\":true,\"threat_level_id\":\"1\",\"publish_timestamp\":\"1617875568\",\"sighting_timestamp\":\"1617875568\",\"disable_correlation\":false,\"extends_uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"event_creator_email\":\"user@example.com\"},\"Object\":{\"id\":\"12345\",\"name\":\"ail-leak\",\"meta-category\":\"string\",\"description\":\"string\",\"template_uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"template_version\":\"1\",\"event_id\":\"12345\",\"uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"timestamp\":\"1617875568\",\"distribution\":\"0\",\"sharing_group_id\":\"1\",\"comment\":\"string\",\"deleted\":true,\"first_seen\":\"1581984000000000\",\"last_seen\":\"1581984000000000\",\"Attribute\":[{\"id\":\"12345\",\"event_id\":\"12345\",\"object_id\":\"12345\",\"object_relation\":\"sensor\",\"category\":\"Internal reference\",\"type\":\"md5\",\"value\":\"127.0.0.1\",\"to_ids\":true,\"uuid\":\"c99506a6-1255-4b71-afa5-7b8ba48c3b1b\",\"timestamp\":\"1617875568\",\"distribution\":\"0\",\"sharing_group_id\":\"1\",\"comment\":\"logged source ip\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":\"1581984000000000\",\"last_seen\":\"1581984000000000\"}]},\"Tag\":[{\"id\":\"12345\",\"name\":\"tlp:white\",\"colour\":\"#ffffff\",\"exportable\":true,\"org_id\":\"12345\",\"user_id\":\"12345\",\"hide_tag\":false,\"numerical_value\":\"12345\",\"is_galaxy\":true,\"is_custom_galaxy\":true,\"inherited\":1}]}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -137,13 +141,17 @@ { "@timestamp": "2014-10-03T07:14:05.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"1\",\"event_id\":\"1\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"External analysis\",\"type\":\"link\",\"to_ids\":false,\"uuid\":\"542e4cbd-ee78-4a57-bfb8-1fda950d210b\",\"timestamp\":\"1412320445\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"http://labs.opendns.com/2014/10/02/opendns-and-bash/\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -194,13 +202,17 @@ { "@timestamp": "2014-10-03T07:14:20.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"4\",\"event_id\":\"1\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"External analysis\",\"type\":\"text\",\"to_ids\":false,\"uuid\":\"542e4ccc-b8fc-44af-959d-6ead950d210b\",\"timestamp\":\"1412320460\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"Shellshock\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -244,13 +256,17 @@ { "@timestamp": "2014-10-03T07:14:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"5\",\"event_id\":\"1\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"External analysis\",\"type\":\"comment\",\"to_ids\":false,\"uuid\":\"542e4ce7-6120-41c0-8793-e90e950d210b\",\"timestamp\":\"1412320487\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"Data encoded by David André\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -294,13 +310,17 @@ { "@timestamp": "2014-10-03T07:15:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"6\",\"event_id\":\"1\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"ip-src\",\"to_ids\":true,\"uuid\":\"542e4cfe-21ac-46a7-9d82-06b3950d210b\",\"timestamp\":\"1412320510\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"81.2.69.193\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -345,13 +365,17 @@ { "@timestamp": "2014-10-03T07:15:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"10\",\"event_id\":\"1\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"ip-src\",\"to_ids\":true,\"uuid\":\"542e4cfe-7a98-4c98-a862-06b3950d210b\",\"timestamp\":\"1412320510\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"81.2.69.145\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -396,13 +420,17 @@ { "@timestamp": "2014-11-25T08:43:47.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"35744\",\"event_id\":\"29\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Artifacts dropped\",\"type\":\"filename|sha256\",\"to_ids\":true,\"uuid\":\"54744143-fc88-4508-bf10-458d950d210b\",\"timestamp\":\"1416905027\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"7553d4a5914af58b23a9e0ce6a262cd230ed8bb2c30da3d42d26b295f9144ab7|7553d4a5914af58b23a9e0ce6a262cd230ed8bb2c30da3d42d26b295f9144ab7\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"29\",\"info\":\"Secret Malware in European Union Attack Linked to U.S. and British Intelligence article by the Intercept\",\"orgc_id\":\"2\",\"uuid\":\"54743eaf-e1c0-47a0-b838-49d7950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -452,13 +480,17 @@ { "@timestamp": "2016-02-18T22:39:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"35961\",\"event_id\":\"31\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Artifacts dropped\",\"type\":\"filename|md5\",\"to_ids\":true,\"uuid\":\"56c6482a-ceb8-4402-8480-599f950d210f\",\"timestamp\":\"1455835178\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"Automatically added (via VirusShare_1f36209c1763d31af06a66f866dbb7b6|01764db54541ced228a598fe020b3971f5ef82d7)\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"VirusShare_1f36209c1763d31af06a66f866dbb7b6|1f36209c1763d31af06a66f866dbb7b6\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"31\",\"info\":\"OSINT Regin samples shared by VirusShare\",\"orgc_id\":\"2\",\"uuid\":\"5476c461-5930-4ddb-8d40-d4ad950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -508,13 +540,17 @@ { "@timestamp": "2015-01-30T07:43:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"37412\",\"event_id\":\"44\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Artifacts dropped\",\"type\":\"regkey\",\"to_ids\":true,\"uuid\":\"54cb360e-7f00-4311-aed4-4505950d210b\",\"timestamp\":\"1422603790\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\f0xy\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"44\",\"info\":\"OSINT New 'f0xy' malware is intelligent - employs cunning stealth \u0026 trickery from Websense\",\"orgc_id\":\"2\",\"uuid\":\"54cb3580-cde4-4b39-bf8c-443f950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -561,13 +597,17 @@ { "@timestamp": "2015-03-05T14:28:53.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"40687\",\"event_id\":\"53\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"AS\",\"to_ids\":false,\"uuid\":\"54f86825-c80c-47cf-a795-48c1950d210b\",\"timestamp\":\"1425565733\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"48031\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"53\",\"info\":\"OSINT Analysis of malcious CHM file by OpenDNS\",\"orgc_id\":\"2\",\"uuid\":\"54f8662f-c7f0-4f59-a42a-a9a9950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -614,13 +654,17 @@ { "@timestamp": "2014-10-06T07:10:57.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"1084\",\"event_id\":\"2\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"ip-dst\",\"to_ids\":true,\"uuid\":\"54324081-3308-4f1f-8674-4953950d210b\",\"timestamp\":\"1412579457\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"89.160.20.129\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"orgc_id\":\"2\",\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { @@ -665,13 +709,17 @@ { "@timestamp": "2014-10-28T19:55:46.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"id\":\"24749\",\"event_id\":\"10\",\"object_id\":\"0\",\"object_relation\":null,\"category\":\"Network activity\",\"type\":\"email-dst\",\"to_ids\":true,\"uuid\":\"544ff4c2-914c-482f-aa29-4c43950d210b\",\"timestamp\":\"1414526146\",\"distribution\":\"5\",\"sharing_group_id\":\"0\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"first_seen\":null,\"last_seen\":null,\"value\":\"lisa.cuddy@wind0ws.kz\",\"Event\":{\"org_id\":\"1\",\"distribution\":\"3\",\"id\":\"10\",\"info\":\"OSINT APT28: A Window into Russia’s Cyber Espionage Operations? blog post by FireEye\",\"orgc_id\":\"2\",\"uuid\":\"544fee45-f108-4fa6-ace9-3989950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "misp": { "attribute": { diff --git a/packages/ti_misp/data_stream/threat_attributes/elasticsearch/ingest_pipeline/default.yml b/packages/ti_misp/data_stream/threat_attributes/elasticsearch/ingest_pipeline/default.yml index 0eb639c4d53..a74f23de392 100644 --- a/packages/ti_misp/data_stream/threat_attributes/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_misp/data_stream/threat_attributes/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # @@ -24,6 +24,13 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' + description: 'Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document.' + - remove: + field: message + ignore_missing: true + if: 'ctx.event?.original != null' + description: 'The `message` field is no longer required if the document has an `event.original` field.' - json: field: event.original target_field: misp.attribute @@ -418,7 +425,9 @@ processors: field: - misp.attribute.value ignore_missing: true - if: ctx.threat?.indicator?.type != null + # Special-case email subject as it is potentially useful, but cannot yet be + # put in threat.indicator.email.subject as it is not an ECS field. + if: ctx.threat?.indicator?.type != null && ctx.misp?.attribute?.type != "email-subject" - remove: field: - temp_tags diff --git a/packages/ti_misp/data_stream/threat_attributes/fields/ecs.yml b/packages/ti_misp/data_stream/threat_attributes/fields/ecs.yml index df6ac4bcfa4..b2389c50171 100644 --- a/packages/ti_misp/data_stream/threat_attributes/fields/ecs.yml +++ b/packages/ti_misp/data_stream/threat_attributes/fields/ecs.yml @@ -22,8 +22,6 @@ name: user.email - external: ecs name: user.roles -- name: threat.feed.name - type: keyword - external: ecs name: threat.indicator.first_seen - external: ecs diff --git a/packages/ti_misp/data_stream/threat_attributes/manifest.yml b/packages/ti_misp/data_stream/threat_attributes/manifest.yml index da43e592ec3..48d1b3345e0 100644 --- a/packages/ti_misp/data_stream/threat_attributes/manifest.yml +++ b/packages/ti_misp/data_stream/threat_attributes/manifest.yml @@ -20,15 +20,16 @@ streams: description: The API token used to access the MISP instance. - name: initial_interval type: text - title: Interval + title: Initial interval multi: false required: true show_user: true default: 120h - description: How far back to look for indicators the first time the agent is started. + description: How far back to look for indicators the first time the agent is started. Supported units for this parameter are h/m/s. - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -58,6 +59,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_misp/data_stream/threat_attributes/sample_event.json b/packages/ti_misp/data_stream/threat_attributes/sample_event.json index 09656208da0..1c4056959e9 100644 --- a/packages/ti_misp/data_stream/threat_attributes/sample_event.json +++ b/packages/ti_misp/data_stream/threat_attributes/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2014-10-03T07:14:05.000Z", "agent": { - "ephemeral_id": "9bdbf008-6488-4cf6-8851-35ec7a24f04f", - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "ephemeral_id": "cdecad63-3561-4779-8f29-0f578cdbaf3e", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_misp.threat_attributes", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.6.2" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-04-27T23:36:27.941Z", + "category": [ + "threat" + ], + "created": "2023-08-28T15:44:00.019Z", "dataset": "ti_misp.threat_attributes", - "ingested": "2023-04-27T23:36:31Z", + "ingested": "2023-08-28T15:44:02Z", "kind": "enrichment", "original": "{\"Event\":{\"distribution\":\"3\",\"id\":\"1\",\"info\":\"OSINT ShellShock scanning IPs from OpenDNS\",\"org_id\":\"1\",\"orgc_id\":\"2\",\"uuid\":\"542e4c9c-cadc-4f8f-bb11-6d13950d210b\"},\"category\":\"External analysis\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"1\",\"first_seen\":null,\"id\":\"1\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1412320445\",\"to_ids\":false,\"type\":\"link\",\"uuid\":\"542e4cbd-ee78-4a57-bfb8-1fda950d210b\",\"value\":\"http://labs.opendns.com/2014/10/02/opendns-and-bash/\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_misp/docs/README.md b/packages/ti_misp/docs/README.md index cd5b5925eeb..8af83e05a21 100644 --- a/packages/ti_misp/docs/README.md +++ b/packages/ti_misp/docs/README.md @@ -35,10 +35,10 @@ The filters themselves are based on the [MISP API documentation](https://www.cir | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -178,11 +178,11 @@ An example event for `threat` looks as following: { "@timestamp": "2014-10-06T07:12:57.000Z", "agent": { - "ephemeral_id": "8b7db8eb-8a30-49a2-83c7-f7e8fa4556ca", - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "ephemeral_id": "24754055-2625-498c-8778-8566dbc8a368", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_misp.threat", @@ -190,22 +190,26 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "3a2a2fa1-9d09-4921-b5fa-023b307e92e0", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.6.2" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2023-04-27T23:35:52.939Z", + "category": [ + "threat" + ], + "created": "2023-08-28T15:43:07.992Z", "dataset": "ti_misp.threat", - "ingested": "2023-04-27T23:35:53Z", + "ingested": "2023-08-28T15:43:09Z", "kind": "enrichment", "original": "{\"Event\":{\"Attribute\":{\"Galaxy\":[],\"ShadowAttribute\":[],\"category\":\"Network activity\",\"comment\":\"\",\"deleted\":false,\"disable_correlation\":false,\"distribution\":\"5\",\"event_id\":\"22\",\"first_seen\":null,\"id\":\"12394\",\"last_seen\":null,\"object_id\":\"0\",\"object_relation\":null,\"sharing_group_id\":\"0\",\"timestamp\":\"1462454963\",\"to_ids\":false,\"type\":\"domain\",\"uuid\":\"572b4ab3-1af0-4d91-9cd5-07a1c0a8ab16\",\"value\":\"whatsapp.com\"},\"EventReport\":[],\"Galaxy\":[],\"Object\":[],\"Org\":{\"id\":\"1\",\"local\":true,\"name\":\"ORGNAME\",\"uuid\":\"5877549f-ea76-4b91-91fb-c72ad682b4a5\"},\"Orgc\":{\"id\":\"2\",\"local\":false,\"name\":\"CthulhuSPRL.be\",\"uuid\":\"55f6ea5f-fd34-43b8-ac1d-40cb950d210f\"},\"RelatedEvent\":[],\"ShadowAttribute\":[],\"Tag\":[{\"colour\":\"#004646\",\"exportable\":true,\"hide_tag\":false,\"id\":\"1\",\"is_custom_galaxy\":false,\"is_galaxy\":false,\"local\":0,\"name\":\"type:OSINT\",\"numerical_value\":null,\"user_id\":\"0\"},{\"colour\":\"#339900\",\"exportable\":true,\"hide_tag\":false,\"id\":\"2\",\"is_custom_galaxy\":false,\"is_galaxy\":false,\"local\":0,\"name\":\"tlp:green\",\"numerical_value\":null,\"user_id\":\"0\"}],\"analysis\":\"2\",\"attribute_count\":\"29\",\"date\":\"2014-10-03\",\"disable_correlation\":false,\"distribution\":\"3\",\"extends_uuid\":\"\",\"id\":\"2\",\"info\":\"OSINT New Indicators of Compromise for APT Group Nitro Uncovered blog post by Palo Alto Networks\",\"locked\":false,\"org_id\":\"1\",\"orgc_id\":\"2\",\"proposal_email_lock\":false,\"publish_timestamp\":\"1610622316\",\"published\":true,\"sharing_group_id\":\"0\",\"threat_level_id\":\"2\",\"timestamp\":\"1412579577\",\"uuid\":\"54323f2c-e50c-4268-896c-4867950d210b\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" @@ -221,7 +225,7 @@ An example event for `threat` looks as following: "id": "12394", "object_id": "0", "sharing_group_id": "0", - "timestamp": "1462454963", + "timestamp": "2016-05-05T13:29:23.000Z", "to_ids": false, "type": "domain", "uuid": "572b4ab3-1af0-4d91-9cd5-07a1c0a8ab16" @@ -238,7 +242,7 @@ An example event for `threat` looks as following: "org_id": "1", "orgc_id": "2", "proposal_email_lock": false, - "publish_timestamp": "1610622316", + "publish_timestamp": "2021-01-14T11:05:16.000Z", "published": true, "sharing_group_id": "0", "threat_level_id": 2, @@ -308,10 +312,10 @@ This data stream uses the `/attributes/restSearch` API endpoint which returns mo | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/ti_misp/kibana/tags.yml b/packages/ti_misp/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_misp/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_misp/manifest.yml b/packages/ti_misp/manifest.yml index 1682105616b..0e7e2fb6688 100644 --- a/packages/ti_misp/manifest.yml +++ b/packages/ti_misp/manifest.yml @@ -1,14 +1,13 @@ name: ti_misp title: MISP -version: "1.16.2" -release: ga +version: "1.23.0" description: Ingest threat intelligence indicators from MISP platform with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/misp.svg title: MISP @@ -24,3 +23,4 @@ policy_templates: description: "Ingest threat intelligence indicators from MISP platform with Elastic Agent." owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_otx/_dev/build/build.yml b/packages/ti_otx/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_otx/_dev/build/build.yml +++ b/packages/ti_otx/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_otx/changelog.yml b/packages/ti_otx/changelog.yml index 5861ea4f4c7..cb76d3dd3df 100644 --- a/packages/ti_otx/changelog.yml +++ b/packages/ti_otx/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7574 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.13.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.12.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json b/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json index dac32bcab77..05d85329d79 100644 --- a/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json +++ b/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-no-preserve-ndjson.log-expected.json @@ -2,12 +2,16 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "threat": { @@ -19,12 +23,16 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of a5725af4391d21a232dc6d4ad33d7d915bd190bdac9b1826b73f364dc5c1aa65", @@ -43,12 +51,16 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "threat": { @@ -62,12 +74,16 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "threat": { @@ -79,12 +95,16 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "threat": { @@ -100,12 +120,16 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of df9b37477a83189cd4541674e64ce29bf7bf98338ed0d635276660e0c6419d09" diff --git a/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-sample-ndjson.log-expected.json b/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-sample-ndjson.log-expected.json index c80b6485785..53b19e73f52 100644 --- a/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-sample-ndjson.log-expected.json +++ b/packages/ti_otx/data_stream/threat/_dev/test/pipeline/test-otx-sample-ndjson.log-expected.json @@ -2,13 +2,17 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":1588938}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -23,13 +27,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"90421f8531f963d81cf54245b72cde80\",\"description\":\"MD5 of a5725af4391d21a232dc6d4ad33d7d915bd190bdac9b1826b73f364dc5c1aa65\",\"title\":\"Win32:Hoblig-B\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":9751110}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of a5725af4391d21a232dc6d4ad33d7d915bd190bdac9b1826b73f364dc5c1aa65", @@ -51,13 +59,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"ip.anysrc.net\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"hostname\",\"id\":16782717}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -74,13 +86,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":19901748}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -95,13 +111,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"d8c70ca70fd3555a0828fede6cc1f59e2c320ede80157039b6a2f09c336d5f7a\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":31612067}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -120,13 +140,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"f8e58af3ffefd4037fef246e93a55dc8\",\"description\":\"MD5 of df9b37477a83189cd4541674e64ce29bf7bf98338ed0d635276660e0c6419d09\",\"title\":null,\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":34413770}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of df9b37477a83189cd4541674e64ce29bf7bf98338ed0d635276660e0c6419d09" @@ -147,13 +171,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"1c62f004d0c9b91d3467b1b8106772e667e7e2075470c2ec7982b63573c90c54\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":111154034}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -172,13 +200,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"8d24a14f2600482d0231396b6350cf21773335ec2f0b8919763317fdab78baae\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":151858953}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -199,13 +231,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":311294364}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -220,13 +256,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"c758ec922b173820374e552c2f015ac53cc5d9f99cc92080e608652aaa63695b\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":406540408}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -245,13 +285,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":565556753}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -270,13 +314,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"aeb08b0651bc8a13dcf5e5f6c0d482f8\",\"description\":\"MD5 of 0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6\",\"title\":null,\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":565556755}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 0df586aa0334dcbe047d24ce859d00e537fdb5e0ca41886dab27479b6fc61ba6" @@ -297,13 +345,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"6df5e1a017dff52020c7ff6ad92fdd37494e31769e1be242f6b23d1ea2d60140\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":575672549}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -322,13 +374,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"c72fef3835f65cb380f6920b22c3488554d1af6d298562ccee92284f265c9619\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":575672550}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -347,13 +403,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"e711fcd0f182b214c6ec74011a395f4c853068d59eb7c57f90c4a3e1de64434a\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":995160791}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -372,13 +432,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"d3ec8f4a46b21fb189fc3d58f3d87bf9897653ecdf90b7952dcc71f3b4023b4e\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1011989699}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -397,13 +461,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"70447996722e5c04514d20b7a429d162b46546002fb0c87f512b40f16bac99bb\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1011989701}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -422,13 +490,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"29340643ca2e6677c19e1d3bf351d654\",\"description\":\"MD5 of 113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1472176322}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec", @@ -450,13 +522,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"86c314bc2dc37ba84f7364acd5108c2b\",\"description\":\"MD5 of 9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1472457325}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2", @@ -478,13 +554,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"cb0c1248d3899358a375888bb4e8f3fe\",\"description\":\"MD5 of 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56\",\"title\":\"Trojan:Win32/Occamy.B\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1472457326}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56", @@ -506,13 +586,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"d348f536e214a47655af387408b4fca5\",\"description\":\"MD5 of 3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1472457327}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4", @@ -534,13 +618,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"29ff1903832827e328ad9ec05fdf268eadd6db8b613597cf65f8740c211be413\",\"description\":null,\"title\":\"vad_contains_network_strings\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1546012751}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "vad_contains_network_strings" @@ -561,13 +649,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"b105891f90b2a8730bbadf02b5adeccbba539883bf75dec2ff7a5a97625dd222\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1546012939}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -586,13 +678,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"e4db5405ac7ab517d43722e1ca8d653ea4a32802bc8a5410d032275eedc7b7ee\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1546012967}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -611,13 +707,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"465e7c1e36899284da5c4425dfd687af2496f397fe60c85ea2b4d85dff5a08aa\",\"description\":null,\"title\":\"Win.Malware.TrickbotSystemInfo-6335590-0\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1564141498}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win.Malware.TrickbotSystemInfo-6335590-0" @@ -638,13 +738,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"5051906d6ed1b2ae9c9a9f070ef73c9be8f591d2e41d144649a0dc96e28d0400\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1564141523}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -663,13 +767,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"14b74cb9be8cad8eb5fa8842d00bb692\",\"description\":\"MD5 of 465e7c1e36899284da5c4425dfd687af2496f397fe60c85ea2b4d85dff5a08aa\",\"title\":\"Win.Malware.TrickbotSystemInfo-6335590-0\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1564142109}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 465e7c1e36899284da5c4425dfd687af2496f397fe60c85ea2b4d85dff5a08aa", @@ -691,13 +799,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"a5b59f7d133e354dfc73f40517aab730f322f0ef\",\"description\":\"SHA1 of 465e7c1e36899284da5c4425dfd687af2496f397fe60c85ea2b4d85dff5a08aa\",\"title\":\"Win.Malware.TrickbotSystemInfo-6335590-0\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":1564142964}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "SHA1 of 465e7c1e36899284da5c4425dfd687af2496f397fe60c85ea2b4d85dff5a08aa", @@ -719,13 +831,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"8d3f68b16f0710f858d8c1d2c699260e6f43161a5510abb0e7ba567bd72c965b\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1566067095}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -744,13 +860,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"ff2dcea4963e060a658f4dffbb119529\",\"description\":\"MD5 of 5cb822616d2c9435c9ddd060d6abdbc286ab57cfcf6dc64768c52976029a925b\",\"title\":\"vad_contains_network_strings\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1566999970}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 5cb822616d2c9435c9ddd060d6abdbc286ab57cfcf6dc64768c52976029a925b", @@ -772,13 +892,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"0d73f1a1c4b2f8723fffc83eb3d00f31\",\"description\":\"MD5 of 29ff1903832827e328ad9ec05fdf268eadd6db8b613597cf65f8740c211be413\",\"title\":\"vad_contains_network_strings\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":1569290125}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 29ff1903832827e328ad9ec05fdf268eadd6db8b613597cf65f8740c211be413", @@ -800,13 +924,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":1592876453}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -821,13 +949,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"d35a30264c0698709ad554489004e0077e263d354ced0c54552a0b500f91ecc0\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1597058431}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -846,13 +978,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"5264b455f453820be629a324196131492ff03c80491e823ac06657c9387250dd\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1603343478}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -871,13 +1007,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56\",\"description\":null,\"title\":\"Trojan:Win32/Occamy.B\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260302}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Trojan:Win32/Occamy.B" @@ -898,13 +1038,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260304}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -925,13 +1069,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"b8e463789a076b16a90d1aae73cea9d3880ac0ead1fd16587b8cd79e37a1a3d8\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260305}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -950,13 +1098,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260310}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -977,13 +1129,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260311}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -1004,13 +1160,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"c51024bb119211c335f95e731cfa9a744fcdb645a57d35fb379d01b7dbdd098e\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":1606260316}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1029,13 +1189,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"ad20c6fac565f901c82a21b70f9739037eb54818\",\"description\":\"SHA1 of 9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":1606260341}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "SHA1 of 9b86a50b36aea5cc4cb60573a3660cf799a9ec1f69a3d4572d3dc277361a0ad2", @@ -1057,13 +1221,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"13f11e273f9a4a56557f03821c3bfd591cca6ebc\",\"description\":\"SHA1 of 3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":1606260344}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "SHA1 of 3012f472969327d5f8c9dac63b8ea9c5cb0de002d16c120a6bba4685120f58b4", @@ -1085,13 +1253,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"1581fe76e3c96dc33182daafd09c8cf5c17004e0\",\"description\":\"SHA1 of 113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec\",\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":1606260353}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "SHA1 of 113af75f13547be184822f1268f984b79f35965a1b1f963d23b50a09741b0aec", @@ -1113,13 +1285,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"b72e75e9e901a44b655a5cf89cf0eadcaff46037\",\"description\":\"SHA1 of 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56\",\"title\":\"Trojan:Win32/Occamy.B\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":1606260364}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "SHA1 of 1455091954ecf9ccd6fe60cb8e982d9cfb4b3dc8414443ccfdfc444079829d56", @@ -1141,13 +1317,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"maper.info\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":1634015726}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1164,13 +1344,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":1635374317}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1185,13 +1369,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":1756014820}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1206,13 +1394,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"9af8a93519d22ed04ffb9ccf6861c9df1b77dc5d22e0aeaff4a582dbf8660ba6\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543412}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1233,13 +1425,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"be9fb556a3c7aef0329e768d7f903e7dd42a821abc663e11fb637ce33b007087\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543416}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1260,13 +1456,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"3bfec096c4837d1e6485fe0ae0ea6f1c0b44edc611d4f2204cc9cf73c985cbc2\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543440}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1287,13 +1487,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"dff2e39b2e008ea89a3d6b36dcd9b8c927fb501d60c1ad5a52ed1ffe225da2e2\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543441}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1314,13 +1518,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"6b4d271a48d118843aee3dee4481fa2930732ed7075db3241a8991418f00d92b\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543445}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1341,13 +1549,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"26de4265303491bed1424d85b263481ac153c2b3513f9ee48ffb42c12312ac43\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543456}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1368,13 +1580,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"02f54da6c6f2f87ff7b713d46e058dedac1cedabd693643bb7f6dfe994b2105d\",\"description\":null,\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2114543458}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "xor_0x20_xord_javascript" @@ -1395,13 +1611,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2114754074}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1416,13 +1636,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2114754077}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1437,13 +1661,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2114754078}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1458,13 +1686,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2114754080}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1479,13 +1711,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2117062744}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1500,13 +1736,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"e999b83629355ec7ff3b6fda465ef53ce6992c9327344fbf124f7eb37808389d\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"FileHash-SHA256\",\"id\":2117884668}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1525,13 +1765,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2119746545}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1546,13 +1790,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2129763785}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1567,13 +1815,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2136050161}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1588,13 +1840,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":\"Trickbot\",\"content\":\"\",\"type\":\"IPv4\",\"id\":2136079568}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Trickbot" @@ -1611,13 +1867,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"fotmailz.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2137741373}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1634,13 +1894,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"pori89g5jqo3v8.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2137741468}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1657,13 +1921,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"sebco.co.ke\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2178708355}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1680,13 +1948,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":\"Trickbot\",\"content\":\"\",\"type\":\"IPv4\",\"id\":2180669102}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Trickbot" @@ -1703,13 +1975,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"chishir.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2186034800}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1726,13 +2002,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"kostunivo.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2186034803}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1749,13 +2029,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"mangoclone.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2186034805}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1772,13 +2056,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"onixcellent.com\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"domain\",\"id\":2186034807}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1795,13 +2083,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"fc0efd612ad528795472e99cae5944b68b8e26dc\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":2186034891}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -1822,13 +2114,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"24d4bbc982a6a561f0426a683b9617de1a96a74a\",\"description\":null,\"title\":\"Sf:ShellCode-DZ\\\\ [Trj]\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":2186034903}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Sf:ShellCode-DZ\\ [Trj]" @@ -1849,13 +2145,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"fa98074dc18ad7e2d357b5d168c00a91256d87d1\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":2186034912}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -1876,13 +2176,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"e5dc7c8bfa285b61dda1618f0ade9c256be75d1a\",\"description\":null,\"title\":\"Win64:Malware-gen\",\"content\":\"\",\"type\":\"FileHash-SHA1\",\"id\":2186034924}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Win64:Malware-gen" @@ -1903,13 +2207,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":\"Trickbot\",\"content\":\"\",\"type\":\"IPv4\",\"id\":2189036445}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "title": "Trickbot" @@ -1926,13 +2234,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2189036446}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1947,13 +2259,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"89.160.20.156\",\"description\":null,\"title\":null,\"content\":\"\",\"type\":\"IPv4\",\"id\":2190596263}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -1968,13 +2284,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"indicator\":\"10ec3571596c30b9993b89f12d29d23c\",\"description\":\"MD5 of 9af8a93519d22ed04ffb9ccf6861c9df1b77dc5d22e0aeaff4a582dbf8660ba6\",\"title\":\"xor_0x20_xord_javascript\",\"content\":\"\",\"type\":\"FileHash-MD5\",\"id\":2192837907}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": { "description": "MD5 of 9af8a93519d22ed04ffb9ccf6861c9df1b77dc5d22e0aeaff4a582dbf8660ba6", @@ -1996,13 +2316,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"id\":73,\"indicator\":\"http://www.playboysplus.com\",\"type\":\"URL\",\"title\":null,\"description\":null,\"content\":\"\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -2023,13 +2347,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"id\":74,\"indicator\":\"http://join.playboysplus.com/signup/\",\"type\":\"URL\",\"title\":null,\"description\":null,\"content\":\"\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ @@ -2050,13 +2378,17 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"count\": 1, \"results\": {\"id\":970,\"indicator\":\"http://api.vk.com/method/wall.get?count=1\u0026owner_id=-81972386\",\"type\":\"URL\",\"title\":null,\"description\":null,\"content\":\"\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "otx": {}, "tags": [ diff --git a/packages/ti_otx/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/ti_otx/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index f67dc9d6eb3..5e7664eeeee 100644 --- a/packages/ti_otx/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_otx/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ###################### # General ECS fields # diff --git a/packages/ti_otx/data_stream/threat/manifest.yml b/packages/ti_otx/data_stream/threat/manifest.yml index f1f69af0dc3..58f32c3f46c 100644 --- a/packages/ti_otx/data_stream/threat/manifest.yml +++ b/packages/ti_otx/data_stream/threat/manifest.yml @@ -20,6 +20,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -34,6 +35,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_otx/data_stream/threat/sample_event.json b/packages/ti_otx/data_stream/threat/sample_event.json index a8e71102b58..6bab1fe408a 100644 --- a/packages/ti_otx/data_stream/threat/sample_event.json +++ b/packages/ti_otx/data_stream/threat/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2022-12-21T09:24:01.501Z", + "@timestamp": "2023-08-28T16:47:36.240Z", "agent": { - "ephemeral_id": "32ac7970-c892-46ef-baf2-d8a0ce377748", - "id": "a7d83bcb-0b6d-41f4-8edf-aa29923f67ec", + "ephemeral_id": "86276bd7-10fe-4c14-91e1-7708cc0134b8", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.3" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_otx.threat", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a7d83bcb-0b6d-41f4-8edf-aa29923f67ec", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.3.3" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-12-21T09:24:01.501Z", + "category": [ + "threat" + ], + "created": "2023-08-28T16:47:36.240Z", "dataset": "ti_otx.threat", - "ingested": "2022-12-21T09:24:02Z", + "ingested": "2023-08-28T16:47:39Z", "kind": "enrichment", "original": "{\"count\":40359,\"next\":\"https://otx.alienvault.com/api/v1/indicators/export?types=domain%2CIPv4%2Chostname%2Curl%2CFileHash-SHA256\\u0026modified_since=2020-11-29T01%3A10%3A00+00%3A00\\u0026page=2\",\"previous\":null,\"results\":{\"content\":\"\",\"description\":null,\"id\":1251,\"indicator\":\"info.3000uc.com\",\"title\":null,\"type\":\"hostname\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_otx/docs/README.md b/packages/ti_otx/docs/README.md index 21a8b59026d..b81ea7e4476 100644 --- a/packages/ti_otx/docs/README.md +++ b/packages/ti_otx/docs/README.md @@ -36,10 +36,10 @@ Retrieves all the related indicators over time, related to your pulse subscripti | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -101,13 +101,13 @@ An example event for `threat` looks as following: ```json { - "@timestamp": "2022-12-21T09:24:01.501Z", + "@timestamp": "2023-08-28T16:47:36.240Z", "agent": { - "ephemeral_id": "32ac7970-c892-46ef-baf2-d8a0ce377748", - "id": "a7d83bcb-0b6d-41f4-8edf-aa29923f67ec", + "ephemeral_id": "86276bd7-10fe-4c14-91e1-7708cc0134b8", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.3" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_otx.threat", @@ -115,22 +115,26 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a7d83bcb-0b6d-41f4-8edf-aa29923f67ec", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.3.3" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-12-21T09:24:01.501Z", + "category": [ + "threat" + ], + "created": "2023-08-28T16:47:36.240Z", "dataset": "ti_otx.threat", - "ingested": "2022-12-21T09:24:02Z", + "ingested": "2023-08-28T16:47:39Z", "kind": "enrichment", "original": "{\"count\":40359,\"next\":\"https://otx.alienvault.com/api/v1/indicators/export?types=domain%2CIPv4%2Chostname%2Curl%2CFileHash-SHA256\\u0026modified_since=2020-11-29T01%3A10%3A00+00%3A00\\u0026page=2\",\"previous\":null,\"results\":{\"content\":\"\",\"description\":null,\"id\":1251,\"indicator\":\"info.3000uc.com\",\"title\":null,\"type\":\"hostname\"}}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_otx/kibana/tags.yml b/packages/ti_otx/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_otx/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_otx/manifest.yml b/packages/ti_otx/manifest.yml index e42a41c955c..d8339e78bd9 100644 --- a/packages/ti_otx/manifest.yml +++ b/packages/ti_otx/manifest.yml @@ -1,14 +1,13 @@ name: ti_otx title: AlienVault OTX -version: "1.11.0" -release: ga +version: "1.17.0" description: Ingest threat intelligence indicators from AlienVault Open Threat Exchange (OTX) with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/otx.svg title: Alienvault OTX @@ -24,3 +23,4 @@ policy_templates: description: "Ingest threat intelligence indicators from AlienVault Open Threat Exchange (OTX) with Elastic Agent." owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_rapid7_threat_command/_dev/build/build.yml b/packages/ti_rapid7_threat_command/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_rapid7_threat_command/_dev/build/build.yml +++ b/packages/ti_rapid7_threat_command/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_rapid7_threat_command/changelog.yml b/packages/ti_rapid7_threat_command/changelog.yml index 95be21a5593..5fed57d585b 100644 --- a/packages/ti_rapid7_threat_command/changelog.yml +++ b/packages/ti_rapid7_threat_command/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7575 +- version: "1.6.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.5.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6885 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_rapid7_threat_command/data_stream/alert/_dev/test/pipeline/test-alert-event.json-expected.json b/packages/ti_rapid7_threat_command/data_stream/alert/_dev/test/pipeline/test-alert-event.json-expected.json index e49bffc3b63..9ff24b5588c 100644 --- a/packages/ti_rapid7_threat_command/data_stream/alert/_dev/test/pipeline/test-alert-event.json-expected.json +++ b/packages/ti_rapid7_threat_command/data_stream/alert/_dev/test/pipeline/test-alert-event.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-10-17T11:45:27.029Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "abcd9050d69f4fd6260a0012", @@ -46,7 +46,7 @@ { "@timestamp": "2022-10-18T12:20:32.071Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "634eabcdde6e197a886412ce", @@ -114,7 +114,7 @@ { "@timestamp": "2022-11-01T04:02:09.021Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "634e6b1234e63137869e6e12", diff --git a/packages/ti_rapid7_threat_command/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/ti_rapid7_threat_command/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index 4b352cc5f4b..3427c873e07 100644 --- a/packages/ti_rapid7_threat_command/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_rapid7_threat_command/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: alert diff --git a/packages/ti_rapid7_threat_command/data_stream/alert/sample_event.json b/packages/ti_rapid7_threat_command/data_stream/alert/sample_event.json index 87dace93dbd..1c63c74a721 100644 --- a/packages/ti_rapid7_threat_command/data_stream/alert/sample_event.json +++ b/packages/ti_rapid7_threat_command/data_stream/alert/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-11-02T10:03:56.139Z", "agent": { - "ephemeral_id": "1da637f3-ae1f-45bb-9dca-72a087917374", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "968bf7e6-6f89-4a78-a88d-18ea5f28f56c", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.alert", @@ -13,19 +13,19 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "created": "2023-02-01T09:42:42.976Z", + "created": "2023-08-28T17:00:29.751Z", "dataset": "ti_rapid7_threat_command.alert", "id": "123456789abcdefgh8866123", - "ingested": "2023-02-01T09:42:45Z", + "ingested": "2023-08-28T17:00:32Z", "kind": "alert", "module": "ti_rapid7_threat_command", "original": "{\"Assets\":[{\"Type\":\"Domains\",\"Value\":\"example.com\"}],\"Assignees\":[],\"Closed\":{\"IsClosed\":true},\"Details\":{\"Description\":\"A suspicious domain 'example.com' was found to have characteristics indicating it may be used to carry out phishing attacks. | Recommendations: It is recommended to block the domain in your URL filtering and mail systems. This can prevent phishing emails being received by your employees and access to websites attempting to steal sensitive information. Click “Remediate” in order to initiate the takedown process for this domain.\",\"Images\":[\"1al5s6789z6e2b0m9s8a8q60\"],\"Severity\":\"Low\",\"Source\":{\"NetworkType\":\"ClearWeb\",\"Type\":\"WHOIS servers\",\"URL\":\"http://example.com\"},\"SubType\":\"RegisteredSuspiciousDomain\",\"Tags\":[{\"CreatedBy\":\"ProfilingRule\",\"Name\":\"Phishing Domain - Default Detection Rule\",\"_id\":\"1al3p6789zxcvbnmas8a8q60\"}],\"Title\":\"Suspected Phishing Domain - 'example.com'\",\"Type\":\"Phishing\"},\"FoundDate\":\"2022-11-02T10:03:56.139Z\",\"IsFlagged\":false,\"RelatedIocs\":[\"example.com\"],\"RelatedThreatIDs\":[\"6a4e7t9a111bd0003bcc2a57\"],\"TakedownStatus\":\"NotSent\",\"UpdateDate\":\"2022-11-02T10:03:56.139Z\",\"_id\":\"123456789abcdefgh8866123\"}", diff --git a/packages/ti_rapid7_threat_command/data_stream/ioc/_dev/test/pipeline/test-ioc-event.json-expected.json b/packages/ti_rapid7_threat_command/data_stream/ioc/_dev/test/pipeline/test-ioc-event.json-expected.json index 6c5310dfdc7..fafeadf046f 100644 --- a/packages/ti_rapid7_threat_command/data_stream/ioc/_dev/test/pipeline/test-ioc-event.json-expected.json +++ b/packages/ti_rapid7_threat_command/data_stream/ioc/_dev/test/pipeline/test-ioc-event.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-04-26T00:42:52.707Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -71,7 +71,7 @@ { "@timestamp": "2022-05-02T12:46:58.392Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -141,7 +141,7 @@ { "@timestamp": "2022-05-02T12:46:58.391Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -214,7 +214,7 @@ { "@timestamp": "2022-05-02T12:12:52.797Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -274,7 +274,7 @@ { "@timestamp": "2022-05-02T12:07:13.029Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -345,7 +345,7 @@ { "@timestamp": "2022-05-03T11:42:22.219Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -425,7 +425,7 @@ { "@timestamp": "2022-05-04T18:45:30.843Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/ti_rapid7_threat_command/data_stream/ioc/elasticsearch/ingest_pipeline/default.yml b/packages/ti_rapid7_threat_command/data_stream/ioc/elasticsearch/ingest_pipeline/default.yml index 370cc2f89c1..a629ec5aaa3 100644 --- a/packages/ti_rapid7_threat_command/data_stream/ioc/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_rapid7_threat_command/data_stream/ioc/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.type value: ["indicator"] diff --git a/packages/ti_rapid7_threat_command/data_stream/ioc/fields/fields.yml b/packages/ti_rapid7_threat_command/data_stream/ioc/fields/fields.yml index 5ad5f43cef6..83e94b0b220 100644 --- a/packages/ti_rapid7_threat_command/data_stream/ioc/fields/fields.yml +++ b/packages/ti_rapid7_threat_command/data_stream/ioc/fields/fields.yml @@ -14,7 +14,7 @@ type: date description: IOC last update date in Unix Millisecond Timestamp. - name: provider - type: array + type: keyword description: List of the indicator providers. - name: related type: group diff --git a/packages/ti_rapid7_threat_command/data_stream/ioc/sample_event.json b/packages/ti_rapid7_threat_command/data_stream/ioc/sample_event.json index ec67dcdd8f2..fdcba4e8490 100644 --- a/packages/ti_rapid7_threat_command/data_stream/ioc/sample_event.json +++ b/packages/ti_rapid7_threat_command/data_stream/ioc/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-05-05T10:39:07.851Z", "agent": { - "ephemeral_id": "6dc8114b-1fd0-4282-ad4a-35d8c834f388", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "d889d670-ceaa-40d0-88d9-15f35930eb5d", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.ioc", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-02-01T09:43:14.830Z", + "created": "2023-08-28T17:01:23.866Z", "dataset": "ti_rapid7_threat_command.ioc", - "ingested": "2023-02-01T09:43:15Z", + "ingested": "2023-08-28T17:01:24Z", "kind": "enrichment", "module": "ti_rapid7_threat_command", "original": "{\"firstSeen\":\"2022-05-04T20:11:04.000Z\",\"lastSeen\":\"2022-05-04T20:11:04.000Z\",\"lastUpdateDate\":\"2022-05-05T10:39:07.851Z\",\"relatedCampaigns\":[],\"relatedMalware\":[\"remcos\"],\"relatedThreatActors\":[],\"reportedFeeds\":[{\"confidenceLevel\":2,\"id\":\"5b68306df84f7c8696047fdd\",\"name\":\"Test Feed\"}],\"score\":13.26086956521739,\"severity\":\"Low\",\"status\":\"Active\",\"tags\":[\"Test\"],\"type\":\"IpAddresses\",\"value\":\"89.160.20.112\",\"whitelisted\":false}", diff --git a/packages/ti_rapid7_threat_command/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability-event.json-expected.json b/packages/ti_rapid7_threat_command/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability-event.json-expected.json index 174f085be8f..23009c76e16 100644 --- a/packages/ti_rapid7_threat_command/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability-event.json-expected.json +++ b/packages/ti_rapid7_threat_command/data_stream/vulnerability/_dev/test/pipeline/test-vulnerability-event.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-11-17T02:40:47.077Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -105,7 +105,7 @@ { "@timestamp": "2020-08-24T21:46:48.619Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/ti_rapid7_threat_command/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml b/packages/ti_rapid7_threat_command/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml index 39d31935906..80cb896cd79 100644 --- a/packages/ti_rapid7_threat_command/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_rapid7_threat_command/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml @@ -7,7 +7,7 @@ processors: ignore_missing: true - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: event diff --git a/packages/ti_rapid7_threat_command/data_stream/vulnerability/sample_event.json b/packages/ti_rapid7_threat_command/data_stream/vulnerability/sample_event.json index d559d4dc3e6..66215b6ac67 100644 --- a/packages/ti_rapid7_threat_command/data_stream/vulnerability/sample_event.json +++ b/packages/ti_rapid7_threat_command/data_stream/vulnerability/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-08-24T21:46:48.619Z", "agent": { - "ephemeral_id": "746f88dd-40e1-4ee0-a6ee-6c227edf2ee0", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "37e34f53-3d71-4930-a39b-d4b1b4fbeac9", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.vulnerability", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-02-01T09:43:53.270Z", + "created": "2023-08-28T17:02:12.075Z", "dataset": "ti_rapid7_threat_command.vulnerability", - "ingested": "2023-02-01T09:43:56Z", + "ingested": "2023-08-28T17:02:15Z", "kind": "event", "module": "ti_rapid7_threat_command", "original": "{\"cpe\":[{\"Range\":{\"VersionEndExcluding\":\"\",\"VersionEndIncluding\":\"4.0.0\",\"VersionStartExcluding\":\"\",\"VersionStartIncluding\":\"1.0.0\"},\"Title\":\"Php\",\"Value\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"VendorProduct\":\"php php\"}],\"cveId\":\"CVE-2020-7064\",\"cvssScore\":5.4,\"exploitAvailability\":false,\"firstMentionDate\":\"N/A\",\"intsightsScore\":16,\"lastMentionDate\":\"2020-04-01T04:15:00.000Z\",\"mentionsAmount\":0,\"mentionsPerSource\":{\"ClearWebCyberBlogs\":0,\"CodeRepositories\":0,\"DarkWeb\":0,\"Exploit\":0,\"HackingForum\":0,\"InstantMessage\":0,\"PasteSite\":0,\"SocialMedia\":0},\"publishedDate\":\"2020-04-01T04:15:00.000Z\",\"relatedCampaigns\":[\"SolarWinds\"],\"relatedMalware\":[\"doppeldridex\",\"dridex\"],\"relatedThreatActors\":[\"doppelspider\"],\"severity\":\"Low\",\"updateDate\":\"2020-08-24T21:46:48.619Z\",\"vulnerabilityOrigin\":[\"Qualys\"]}", diff --git a/packages/ti_rapid7_threat_command/docs/README.md b/packages/ti_rapid7_threat_command/docs/README.md index bebba32c927..8d08494a030 100644 --- a/packages/ti_rapid7_threat_command/docs/README.md +++ b/packages/ti_rapid7_threat_command/docs/README.md @@ -215,11 +215,11 @@ An example event for `ioc` looks as following: { "@timestamp": "2022-05-05T10:39:07.851Z", "agent": { - "ephemeral_id": "6dc8114b-1fd0-4282-ad4a-35d8c834f388", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "d889d670-ceaa-40d0-88d9-15f35930eb5d", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.ioc", @@ -227,21 +227,21 @@ An example event for `ioc` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-02-01T09:43:14.830Z", + "created": "2023-08-28T17:01:23.866Z", "dataset": "ti_rapid7_threat_command.ioc", - "ingested": "2023-02-01T09:43:15Z", + "ingested": "2023-08-28T17:01:24Z", "kind": "enrichment", "module": "ti_rapid7_threat_command", "original": "{\"firstSeen\":\"2022-05-04T20:11:04.000Z\",\"lastSeen\":\"2022-05-04T20:11:04.000Z\",\"lastUpdateDate\":\"2022-05-05T10:39:07.851Z\",\"relatedCampaigns\":[],\"relatedMalware\":[\"remcos\"],\"relatedThreatActors\":[],\"reportedFeeds\":[{\"confidenceLevel\":2,\"id\":\"5b68306df84f7c8696047fdd\",\"name\":\"Test Feed\"}],\"score\":13.26086956521739,\"severity\":\"Low\",\"status\":\"Active\",\"tags\":[\"Test\"],\"type\":\"IpAddresses\",\"value\":\"89.160.20.112\",\"whitelisted\":false}", @@ -352,9 +352,9 @@ An example event for `ioc` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | @@ -382,7 +382,7 @@ An example event for `ioc` looks as following: | rapid7.tc.ioc.geolocation | Geographical location of an IP address. | keyword | | rapid7.tc.ioc.last_seen | IOC last seen date in Unix Millisecond Timestamp. | date | | rapid7.tc.ioc.last_update_date | IOC last update date in Unix Millisecond Timestamp. | date | -| rapid7.tc.ioc.provider | List of the indicator providers. | array | +| rapid7.tc.ioc.provider | List of the indicator providers. | keyword | | rapid7.tc.ioc.related.campaigns | List of IOC related campaigns. | keyword | | rapid7.tc.ioc.related.malware | List of IOC related malware families. | keyword | | rapid7.tc.ioc.related.threat_actors | List of IOC related threat actors. | keyword | @@ -453,11 +453,11 @@ An example event for `alert` looks as following: { "@timestamp": "2022-11-02T10:03:56.139Z", "agent": { - "ephemeral_id": "1da637f3-ae1f-45bb-9dca-72a087917374", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "968bf7e6-6f89-4a78-a88d-18ea5f28f56c", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.alert", @@ -465,19 +465,19 @@ An example event for `alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "created": "2023-02-01T09:42:42.976Z", + "created": "2023-08-28T17:00:29.751Z", "dataset": "ti_rapid7_threat_command.alert", "id": "123456789abcdefgh8866123", - "ingested": "2023-02-01T09:42:45Z", + "ingested": "2023-08-28T17:00:32Z", "kind": "alert", "module": "ti_rapid7_threat_command", "original": "{\"Assets\":[{\"Type\":\"Domains\",\"Value\":\"example.com\"}],\"Assignees\":[],\"Closed\":{\"IsClosed\":true},\"Details\":{\"Description\":\"A suspicious domain 'example.com' was found to have characteristics indicating it may be used to carry out phishing attacks. | Recommendations: It is recommended to block the domain in your URL filtering and mail systems. This can prevent phishing emails being received by your employees and access to websites attempting to steal sensitive information. Click “Remediate” in order to initiate the takedown process for this domain.\",\"Images\":[\"1al5s6789z6e2b0m9s8a8q60\"],\"Severity\":\"Low\",\"Source\":{\"NetworkType\":\"ClearWeb\",\"Type\":\"WHOIS servers\",\"URL\":\"http://example.com\"},\"SubType\":\"RegisteredSuspiciousDomain\",\"Tags\":[{\"CreatedBy\":\"ProfilingRule\",\"Name\":\"Phishing Domain - Default Detection Rule\",\"_id\":\"1al3p6789zxcvbnmas8a8q60\"}],\"Title\":\"Suspected Phishing Domain - 'example.com'\",\"Type\":\"Phishing\"},\"FoundDate\":\"2022-11-02T10:03:56.139Z\",\"IsFlagged\":false,\"RelatedIocs\":[\"example.com\"],\"RelatedThreatIDs\":[\"6a4e7t9a111bd0003bcc2a57\"],\"TakedownStatus\":\"NotSent\",\"UpdateDate\":\"2022-11-02T10:03:56.139Z\",\"_id\":\"123456789abcdefgh8866123\"}", @@ -564,10 +564,10 @@ An example event for `alert` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.reference | Reference URL linking to additional information about this event. This URL links to a static definition of this event. Alert events, indicated by `event.kind:alert`, are a common use case for this field. | keyword | @@ -631,11 +631,11 @@ An example event for `vulnerability` looks as following: { "@timestamp": "2020-08-24T21:46:48.619Z", "agent": { - "ephemeral_id": "746f88dd-40e1-4ee0-a6ee-6c227edf2ee0", - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "ephemeral_id": "37e34f53-3d71-4930-a39b-d4b1b4fbeac9", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_rapid7_threat_command.vulnerability", @@ -643,21 +643,21 @@ An example event for `vulnerability` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "11119654-0c23-4f69-bf69-62e3eeb94a21", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.4.0" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", "category": [ "threat" ], - "created": "2023-02-01T09:43:53.270Z", + "created": "2023-08-28T17:02:12.075Z", "dataset": "ti_rapid7_threat_command.vulnerability", - "ingested": "2023-02-01T09:43:56Z", + "ingested": "2023-08-28T17:02:15Z", "kind": "event", "module": "ti_rapid7_threat_command", "original": "{\"cpe\":[{\"Range\":{\"VersionEndExcluding\":\"\",\"VersionEndIncluding\":\"4.0.0\",\"VersionStartExcluding\":\"\",\"VersionStartIncluding\":\"1.0.0\"},\"Title\":\"Php\",\"Value\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"VendorProduct\":\"php php\"}],\"cveId\":\"CVE-2020-7064\",\"cvssScore\":5.4,\"exploitAvailability\":false,\"firstMentionDate\":\"N/A\",\"intsightsScore\":16,\"lastMentionDate\":\"2020-04-01T04:15:00.000Z\",\"mentionsAmount\":0,\"mentionsPerSource\":{\"ClearWebCyberBlogs\":0,\"CodeRepositories\":0,\"DarkWeb\":0,\"Exploit\":0,\"HackingForum\":0,\"InstantMessage\":0,\"PasteSite\":0,\"SocialMedia\":0},\"publishedDate\":\"2020-04-01T04:15:00.000Z\",\"relatedCampaigns\":[\"SolarWinds\"],\"relatedMalware\":[\"doppeldridex\",\"dridex\"],\"relatedThreatActors\":[\"doppelspider\"],\"severity\":\"Low\",\"updateDate\":\"2020-08-24T21:46:48.619Z\",\"vulnerabilityOrigin\":[\"Qualys\"]}", @@ -775,9 +775,9 @@ An example event for `vulnerability` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-0ee0c5f0-7208-11ed-af6f-3913a325a746.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-0ee0c5f0-7208-11ed-af6f-3913a325a746.json index 2f66c301713..fe3877765cc 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-0ee0c5f0-7208-11ed-af6f-3913a325a746.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-0ee0c5f0-7208-11ed-af6f-3913a325a746.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"d5d6a37a-0436-42b6-b7c9-0acd1ecaf10f\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.vulnerability.cpe.vendor_product\",\"title\":\"Vendor \u0026 Product\",\"id\":\"d5d6a37a-0436-42b6-b7c9-0acd1ecaf10f\",\"selectedOptions\":[],\"enhancements\":{}}},\"6c698eb1-3909-4da3-aa7a-acc723d5e95e\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"kibana.alert.ancestors.index.keyword\",\"parentFieldName\":\"kibana.alert.ancestors.index\",\"title\":\"Correlation Indices\",\"id\":\"6c698eb1-3909-4da3-aa7a-acc723d5e95e\",\"enhancements\":{},\"selectedOptions\":[]}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +19,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -61,82 +61,67 @@ "panelIndex": "d9411640-55f6-4a13-9257-807b631b5d68", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "4892667b-bbca-4e6e-ba53-adb5991962e1", + "name": "indexpattern-datasource-layer-e770d262-87ba-4e08-8cbb-1343d04e2e00", + "type": "index-pattern" } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "c6ac1fa0-7207-11ed-90b1-a92c84a224df" - } - ], - "drop_last_bucket": 0, - "id": "886e87a4-fa70-4729-9a67-f831ee104632", - "index_pattern_ref_name": "metrics_75d0b92a-9722-44a6-9db8-cdbb69d837de_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "825f52b8-fd3f-46e3-990c-a50aecf5094e", - "label": "Total Matched Vulnerabilities", - "line_width": 1, - "metrics": [ - { - "id": "8e8cb67c-84b0-4681-ba46-227a030c78bc", - "type": "count" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e770d262-87ba-4e08-8cbb-1343d04e2e00": { + "columnOrder": [ + "4757ee85-213c-4c5b-b21d-c4057a61b2b0" + ], + "columns": { + "4757ee85-213c-4c5b-b21d-c4057a61b2b0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Matched Vulnerabilities", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + } + }, + "textBased": { + "layers": {} } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "e770d262-87ba-4e08-8cbb-1343d04e2e00", + "layerType": "data", + "metricAccessor": "4757ee85-213c-4c5b-b21d-c4057a61b2b0" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 15, @@ -146,9 +131,8 @@ "y": 4 }, "panelIndex": "75d0b92a-9722-44a6-9db8-cdbb69d837de", - "title": "Total Matched Vulnerabilities [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -162,7 +146,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "91c690b0-656c-4a3c-aea9-bdf0649a4d11": { "columnOrder": [ @@ -222,15 +206,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d63e8d20-013e-4428-9962-a560ee4306f1" - ], "layerId": "91c690b0-656c-4a3c-aea9-bdf0649a4d11", "layerType": "data", "legendDisplay": "default", - "metric": "1c5a90f4-594c-4f69-a851-872fe5935164", + "metrics": [ + "1c5a90f4-594c-4f69-a851-872fe5935164" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d63e8d20-013e-4428-9962-a560ee4306f1" + ] } ], "shape": "pie" @@ -253,7 +239,7 @@ "panelIndex": "cae668ef-a17e-47b6-b95c-863d36318b74", "title": "Matched Vulnerabilities with Exploit [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -267,7 +253,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1d8176c8-a41c-4043-b654-d32f050a19db": { "columnOrder": [ @@ -367,7 +353,7 @@ "panelIndex": "9f9ed587-c10e-4651-a3a0-7ce463272bd7", "title": "Matched Vulnerabilities by Severity [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -381,7 +367,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "6428767b-701b-47c0-a810-d9f3c3e2d81c": { "columnOrder": [ @@ -631,22 +617,23 @@ "panelIndex": "40d6e237-64a6-4001-9fd8-b2fd8a8de9a7", "title": "Matched Vulnerabilities by CVSS Score [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] Vulnerability Correlation", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-0ee0c5f0-7208-11ed-af6f-3913a325a746", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "4892667b-bbca-4e6e-ba53-adb5991962e1", - "name": "75d0b92a-9722-44a6-9db8-cdbb69d837de:metrics_75d0b92a-9722-44a6-9db8-cdbb69d837de_0_index_pattern", + "name": "75d0b92a-9722-44a6-9db8-cdbb69d837de:indexpattern-datasource-layer-e770d262-87ba-4e08-8cbb-1343d04e2e00", "type": "index-pattern" }, { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-1abe9f50-591c-11ed-a133-234996671b18.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-1abe9f50-591c-11ed-a133-234996671b18.json index b75c939e943..c2bbca4a091 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-1abe9f50-591c-11ed-a133-234996671b18.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-1abe9f50-591c-11ed-a133-234996671b18.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"8b28b3bd-8516-42f2-929b-92b01e99a9e8\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"tags\",\"title\":\"Tags\",\"id\":\"8b28b3bd-8516-42f2-929b-92b01e99a9e8\",\"enhancements\":{}}},\"a3c54e7b-9be5-4d65-8dc1-8a79189ffe17\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.assignees\",\"title\":\"Assignee\",\"id\":\"a3c54e7b-9be5-4d65-8dc1-8a79189ffe17\",\"enhancements\":{}}},\"2db02354-cb56-4be5-99b4-75746e59d74e\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.is_flagged\",\"title\":\"Flagged Alerts\",\"id\":\"2db02354-cb56-4be5-99b4-75746e59d74e\",\"enhancements\":{},\"selectedOptions\":[]}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -39,6 +38,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,109 +80,94 @@ "panelIndex": "fab08e94-c328-4260-b164-ce466e2052f8", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.alert" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-40fa24ac-8d66-4ffa-a5f3-2b31d587c6bf", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aef883ed-02e6-4b7d-a89e-35c0429c641c", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "40fa24ac-8d66-4ffa-a5f3-2b31d587c6bf": { + "columnOrder": [ + "0347255a-c487-43f8-a609-46b5a3f638f5" + ], + "columns": { + "0347255a-c487-43f8-a609-46b5a3f638f5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Alerts", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.alert" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" + }, + "textBased": { + "layers": {} } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + }, + "filters": [ { - "id": "c77afc20-cf97-11ec-8c02-49b65d195d6f" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "aef883ed-02e6-4b7d-a89e-35c0429c641c", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.alert" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.alert" + } + } } ], - "drop_last_bucket": 0, - "filter": { + "internalReferences": [], + "query": { "language": "kuery", "query": "" }, - "id": "b28c2c2d-5fd0-4f95-aa42-d9349efad53f", - "index_pattern_ref_name": "metrics_99632f77-2095-479e-9961-770ab18be038_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "9097d581-672c-4ef1-998a-1daca02862cf", - "label": "Total Alerts", - "line_width": 1, - "metrics": [ - { - "field": "event.id", - "id": "9c9c790e-cf42-4f14-9d17-d93b8fb79948", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "visualization": { + "layerId": "40fa24ac-8d66-4ffa-a5f3-2b31d587c6bf", + "layerType": "data", + "metricAccessor": "0347255a-c487-43f8-a609-46b5a3f638f5" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -191,110 +177,95 @@ "y": 3 }, "panelIndex": "99632f77-2095-479e-9961-770ab18be038", - "title": "Total Alerts [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.alert" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7f70d133-6ec4-4850-92db-9c49b9420afb", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "98d7a2bd-5ac6-4314-99a2-43d00570f92f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7f70d133-6ec4-4850-92db-9c49b9420afb": { + "columnOrder": [ + "c39e329e-255b-4a45-9ff2-600dde73a2d2" + ], + "columns": { + "c39e329e-255b-4a45-9ff2-600dde73a2d2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Alerts in Last Month", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.alert" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "a6a8c620-cf98-11ec-8c02-49b65d195d6f" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "f5995f99-9c32-41cf-b68b-05c25f5853e4", - "index_pattern_ref_name": "metrics_0fb06665-efb9-4e7f-b2c8-d3996755cbae_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "fd0d396b-5f9b-4292-ab56-e7ac5e01b298", - "label": "Total New Alerts in Last Month", - "line_width": 1, - "metrics": [ - { - "field": "event.id", - "id": "edf6cbf9-bff0-46fb-8efc-d6ab299ddf6e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "98d7a2bd-5ac6-4314-99a2-43d00570f92f", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.alert" + }, + "type": "phrase" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.alert" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "7f70d133-6ec4-4850-92db-9c49b9420afb", + "layerType": "data", + "metricAccessor": "c39e329e-255b-4a45-9ff2-600dde73a2d2" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1M", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -304,111 +275,95 @@ "y": 3 }, "panelIndex": "0fb06665-efb9-4e7f-b2c8-d3996755cbae", - "title": "Total New Alerts in Last Month [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.alert" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-4c863e29-1d9a-4f38-b9b9-00c18d421109", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "08c4bb73-e79a-44a5-affe-d39e9a4476b8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "4c863e29-1d9a-4f38-b9b9-00c18d421109": { + "columnOrder": [ + "547e9817-9c20-4173-ae38-1052374d742d" + ], + "columns": { + "547e9817-9c20-4173-ae38-1052374d742d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Alerts in Last Week", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.alert" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "703d7fe0-cf98-11ec-8c02-49b65d195d6f" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "f478310c-59ec-4c3f-94d7-45a5cc2d5832", - "index_pattern_ref_name": "metrics_2e08af2f-46b7-40d8-a054-327ddad1ffc7_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "2d383eb9-f2a4-4411-846a-13729e0ddb82", - "label": "Total New Alerts in Last Week", - "line_width": 1, - "metrics": [ - { - "field": "event.id", - "id": "4d68210e-1033-46db-bd7b-f86c45520b72", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "08c4bb73-e79a-44a5-affe-d39e9a4476b8", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.alert" + }, + "type": "phrase" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.alert" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "4c863e29-1d9a-4f38-b9b9-00c18d421109", + "layerType": "data", + "metricAccessor": "547e9817-9c20-4173-ae38-1052374d742d" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1w", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -418,111 +373,95 @@ "y": 3 }, "panelIndex": "2e08af2f-46b7-40d8-a054-327ddad1ffc7", - "title": "Total New Alerts in Last Week [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.alert" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c60d28c8-a976-4fff-99b1-69dd48d0c230", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1ada442b-a11d-436d-82a0-1aa4bbd794fa", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c60d28c8-a976-4fff-99b1-69dd48d0c230": { + "columnOrder": [ + "abf3dd9e-69f2-41d5-a9b2-50b47cde1c8c" + ], + "columns": { + "abf3dd9e-69f2-41d5-a9b2-50b47cde1c8c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Alerts in Last Day", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "event.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.alert" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "a6a8c620-cf98-11ec-8c02-49b65d195d6f" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "f5995f99-9c32-41cf-b68b-05c25f5853e4", - "index_pattern_ref_name": "metrics_dfeb4d5a-35af-49e3-b10d-06900494775d_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "fd0d396b-5f9b-4292-ab56-e7ac5e01b298", - "label": "Total New Alerts in Last Day", - "line_width": 1, - "metrics": [ - { - "field": "event.id", - "id": "edf6cbf9-bff0-46fb-8efc-d6ab299ddf6e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "1ada442b-a11d-436d-82a0-1aa4bbd794fa", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.alert" + }, + "type": "phrase" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.alert" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "c60d28c8-a976-4fff-99b1-69dd48d0c230", + "layerType": "data", + "metricAccessor": "abf3dd9e-69f2-41d5-a9b2-50b47cde1c8c" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1d", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -532,9 +471,8 @@ "y": 3 }, "panelIndex": "dfeb4d5a-35af-49e3-b10d-06900494775d", - "title": "Total New Alerts in Last Day [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -553,7 +491,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "92189bed-8862-4f63-81fe-fcad0a0a4605": { "columnOrder": [ @@ -711,7 +649,7 @@ "panelIndex": "55eab9c7-3cc0-4a44-8107-fbecdda86dcc", "title": "Total Alerts by Type in Last Day [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -730,7 +668,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "92189bed-8862-4f63-81fe-fcad0a0a4605": { "columnOrder": [ @@ -884,7 +822,7 @@ "panelIndex": "95483975-6af1-408d-b5ae-6177771466a3", "title": "Total Alerts by Type [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -903,7 +841,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e940c600-912d-470b-950e-7d378b788363": { "columnOrder": [ @@ -982,15 +920,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "f7218b87-24f6-4b04-96f0-b8b44c7467e2" - ], "layerId": "e940c600-912d-470b-950e-7d378b788363", "layerType": "data", "legendDisplay": "default", - "metric": "1b0e7950-8904-4cc5-a759-398f5b3edf9d", + "metrics": [ + "1b0e7950-8904-4cc5-a759-398f5b3edf9d" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "f7218b87-24f6-4b04-96f0-b8b44c7467e2" + ] } ], "palette": { @@ -1017,7 +957,7 @@ "panelIndex": "83d2a144-b99f-4612-b449-651cb3dda050", "title": "Total Alerts by Takedown Status [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1036,7 +976,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "5b5b37cf-7625-482c-a75f-2cef25eae52c": { "columnOrder": [ @@ -1141,7 +1081,7 @@ "panelIndex": "45bc50e6-4f9e-4079-b81e-d9e22e6e20c1", "title": "Top 20 Related IOCs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1160,7 +1100,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d835f8e5-2c86-4333-97bd-74d919a26cd6": { "columnOrder": [ @@ -1240,16 +1180,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dcb482c0-85c7-4e88-b019-3b5406086631" - ], "layerId": "d835f8e5-2c86-4333-97bd-74d919a26cd6", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "69ccbbec-7b0a-4e57-a6e1-538a1002c78f", + "metrics": [ + "69ccbbec-7b0a-4e57-a6e1-538a1002c78f" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "dcb482c0-85c7-4e88-b019-3b5406086631" + ] } ], "palette": { @@ -1276,7 +1218,7 @@ "panelIndex": "92382f4a-7a0e-45f8-8b02-066bcfefcfd6", "title": "Total Alerts by Severity [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1295,7 +1237,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "08f4fe0a-ce5d-4f03-a044-d133aea26a84": { "columnOrder": [ @@ -1374,15 +1316,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "14017250-7398-41fa-9d29-352432a11599" - ], "layerId": "08f4fe0a-ce5d-4f03-a044-d133aea26a84", "layerType": "data", "legendDisplay": "default", - "metric": "f8423684-d48a-4290-aab2-34e140d9408e", + "metrics": [ + "f8423684-d48a-4290-aab2-34e140d9408e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "14017250-7398-41fa-9d29-352432a11599" + ] } ], "palette": { @@ -1409,7 +1353,7 @@ "panelIndex": "13a40884-2c88-4250-9a39-7b9814da8ea8", "title": "Total Alerts by Source Network Type [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1428,7 +1372,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e027a1e6-7bfa-4b4a-a8c8-880433fd19c7": { "columnOrder": [ @@ -1591,7 +1535,7 @@ "panelIndex": "8ae0c677-ce75-44ca-97d0-befc1dd4eabf", "title": "Total Alerts by Type and Subtype [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1611,7 +1555,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "aa44cb43-4074-4722-822b-4b16f657a59e": { "columnOrder": [ @@ -1771,7 +1715,7 @@ "panelIndex": "9a9624eb-de84-4731-9c00-dc9280c23886", "title": "Flagged Alerts [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1791,7 +1735,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "aa44cb43-4074-4722-822b-4b16f657a59e": { "columnOrder": [ @@ -1951,17 +1895,18 @@ "panelIndex": "801b0b7d-6d96-4f6e-990f-dc1da42beb0c", "title": "Closed Alerts [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] Alert Overview", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:41:26.990Z", "id": "ti_rapid7_threat_command-1abe9f50-591c-11ed-a133-234996671b18", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1971,42 +1916,42 @@ }, { "id": "logs-*", - "name": "99632f77-2095-479e-9961-770ab18be038:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "99632f77-2095-479e-9961-770ab18be038:indexpattern-datasource-layer-40fa24ac-8d66-4ffa-a5f3-2b31d587c6bf", "type": "index-pattern" }, { "id": "logs-*", - "name": "99632f77-2095-479e-9961-770ab18be038:metrics_99632f77-2095-479e-9961-770ab18be038_0_index_pattern", + "name": "99632f77-2095-479e-9961-770ab18be038:aef883ed-02e6-4b7d-a89e-35c0429c641c", "type": "index-pattern" }, { "id": "logs-*", - "name": "0fb06665-efb9-4e7f-b2c8-d3996755cbae:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "0fb06665-efb9-4e7f-b2c8-d3996755cbae:indexpattern-datasource-layer-7f70d133-6ec4-4850-92db-9c49b9420afb", "type": "index-pattern" }, { "id": "logs-*", - "name": "0fb06665-efb9-4e7f-b2c8-d3996755cbae:metrics_0fb06665-efb9-4e7f-b2c8-d3996755cbae_0_index_pattern", + "name": "0fb06665-efb9-4e7f-b2c8-d3996755cbae:98d7a2bd-5ac6-4314-99a2-43d00570f92f", "type": "index-pattern" }, { "id": "logs-*", - "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:indexpattern-datasource-layer-4c863e29-1d9a-4f38-b9b9-00c18d421109", "type": "index-pattern" }, { "id": "logs-*", - "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:metrics_2e08af2f-46b7-40d8-a054-327ddad1ffc7_0_index_pattern", + "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:08c4bb73-e79a-44a5-affe-d39e9a4476b8", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:indexpattern-datasource-layer-c60d28c8-a976-4fff-99b1-69dd48d0c230", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:metrics_dfeb4d5a-35af-49e3-b10d-06900494775d_0_index_pattern", + "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:1ada442b-a11d-436d-82a0-1aa4bbd794fa", "type": "index-pattern" }, { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-20735802-0864-485a-8b6f-e138aae5900d.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-20735802-0864-485a-8b6f-e138aae5900d.json index e329da50294..f30915ab059 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-20735802-0864-485a-8b6f-e138aae5900d.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-20735802-0864-485a-8b6f-e138aae5900d.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -54,109 +55,94 @@ "panelIndex": "fdb7ee9b-6ab8-4855-8287-424582f66f81", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.ioc" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-3260128f-a820-43a0-8280-541300572c9d", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "304ae460-2fca-4ca9-8a9f-dfd27673edd6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "3260128f-a820-43a0-8280-541300572c9d": { + "columnOrder": [ + "355e4da7-7485-498d-a59f-68168e25ba84" + ], + "columns": { + "355e4da7-7485-498d-a59f-68168e25ba84": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total IOCs", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "rapid7.tc.ioc.value" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.ioc" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" + }, + "textBased": { + "layers": {} } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + }, + "filters": [ { - "id": "c77afc20-cf97-11ec-8c02-49b65d195d6f" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "304ae460-2fca-4ca9-8a9f-dfd27673edd6", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.ioc" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.ioc" + } + } } ], - "drop_last_bucket": 0, - "filter": { + "internalReferences": [], + "query": { "language": "kuery", "query": "" }, - "id": "b28c2c2d-5fd0-4f95-aa42-d9349efad53f", - "index_pattern_ref_name": "metrics_99632f77-2095-479e-9961-770ab18be038_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "9097d581-672c-4ef1-998a-1daca02862cf", - "label": "Total IOCs", - "line_width": 1, - "metrics": [ - { - "field": "rapid7.tc.ioc.value", - "id": "9c9c790e-cf42-4f14-9d17-d93b8fb79948", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "visualization": { + "layerId": "3260128f-a820-43a0-8280-541300572c9d", + "layerType": "data", + "metricAccessor": "355e4da7-7485-498d-a59f-68168e25ba84" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -166,111 +152,95 @@ "y": 4 }, "panelIndex": "99632f77-2095-479e-9961-770ab18be038", - "title": "Total IOCs [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.ioc" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7cb70370-3bb6-4bde-8763-df54e34a445a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "890fddd8-e271-46f4-abc0-57012b06bcab", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "7cb70370-3bb6-4bde-8763-df54e34a445a": { + "columnOrder": [ + "2fecfe72-a63a-4460-9480-789455549abb" + ], + "columns": { + "2fecfe72-a63a-4460-9480-789455549abb": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New IOCs in Last Week", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "rapid7.tc.ioc.value" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.ioc" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "703d7fe0-cf98-11ec-8c02-49b65d195d6f" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "f478310c-59ec-4c3f-94d7-45a5cc2d5832", - "index_pattern_ref_name": "metrics_2e08af2f-46b7-40d8-a054-327ddad1ffc7_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "2d383eb9-f2a4-4411-846a-13729e0ddb82", - "label": "Total New IOCs in Last Week", - "line_width": 1, - "metrics": [ - { - "field": "rapid7.tc.ioc.value", - "id": "4d68210e-1033-46db-bd7b-f86c45520b72", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "index": "890fddd8-e271-46f4-abc0-57012b06bcab", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.ioc" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.ioc" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "7cb70370-3bb6-4bde-8763-df54e34a445a", + "layerType": "data", + "metricAccessor": "2fecfe72-a63a-4460-9480-789455549abb" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1w", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -280,111 +250,95 @@ "y": 4 }, "panelIndex": "2e08af2f-46b7-40d8-a054-327ddad1ffc7", - "title": "Total New IOCs in Last Week [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.ioc" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-25e74ede-01a1-41c0-8d1c-82f86659847b", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e3902633-d960-4d4d-bbfc-151d3a66e429", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "25e74ede-01a1-41c0-8d1c-82f86659847b": { + "columnOrder": [ + "6cf47c43-74fc-4f85-8d77-4c9715af8021" + ], + "columns": { + "6cf47c43-74fc-4f85-8d77-4c9715af8021": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New IOCs in Last Day", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "rapid7.tc.ioc.value" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.ioc" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "a6a8c620-cf98-11ec-8c02-49b65d195d6f" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "f5995f99-9c32-41cf-b68b-05c25f5853e4", - "index_pattern_ref_name": "metrics_dfeb4d5a-35af-49e3-b10d-06900494775d_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "fd0d396b-5f9b-4292-ab56-e7ac5e01b298", - "label": "Total New IOCs in Last Day", - "line_width": 1, - "metrics": [ - { - "field": "rapid7.tc.ioc.value", - "id": "edf6cbf9-bff0-46fb-8efc-d6ab299ddf6e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "index": "e3902633-d960-4d4d-bbfc-151d3a66e429", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.ioc" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.ioc" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "25e74ede-01a1-41c0-8d1c-82f86659847b", + "layerType": "data", + "metricAccessor": "6cf47c43-74fc-4f85-8d77-4c9715af8021" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1d", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -394,132 +348,121 @@ "y": 4 }, "panelIndex": "dfeb4d5a-35af-49e3-b10d-06900494775d", - "title": "Total New IOCs in Last Day [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "rapid7.tc.ioc.whitelisted", - "negate": false, - "params": { - "query": true + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-14c733ca-25b4-4aa9-b145-2e8ccd73ed52", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "a963a789-dce0-4605-96b1-edd2339372d0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea0a3b73-cd24-4f20-82b7-e8f69f375469", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "14c733ca-25b4-4aa9-b145-2e8ccd73ed52": { + "columnOrder": [ + "5774538b-e91c-4be0-a7f8-09c7035c13ca" + ], + "columns": { + "5774538b-e91c-4be0-a7f8-09c7035c13ca": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Whitelisted IOCs", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "rapid7.tc.ioc.value" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "rapid7.tc.ioc.whitelisted": true - } + "incompleteColumns": {} } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.ioc" - }, - "type": "phrase" + "meta": { + "alias": null, + "disabled": false, + "index": "a963a789-dce0-4605-96b1-edd2339372d0", + "key": "rapid7.tc.ioc.whitelisted", + "negate": false, + "params": { + "query": true }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.ioc" - } + "type": "phrase" + }, + "query": { + "match_phrase": { + "rapid7.tc.ioc.whitelisted": true } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ + }, { - "id": "38db8820-cf99-11ec-8c02-49b65d195d6f" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "ea0a3b73-cd24-4f20-82b7-e8f69f375469", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.ioc" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.ioc" + } + } } ], - "drop_last_bucket": 0, - "filter": { + "internalReferences": [], + "query": { "language": "kuery", "query": "" }, - "id": "0cd29a94-e496-43f1-b763-fc81edf6e695", - "index_pattern_ref_name": "metrics_eb39f5e5-3da7-4a01-b3be-099e7ebb595d_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "76601dc3-5aa0-43c3-8223-3beefd8d0c1c", - "label": "Total Whitelisted IOCs", - "line_width": 1, - "metrics": [ - { - "field": "rapid7.tc.ioc.value", - "id": "2bcd3785-a07c-45f4-985e-034bf7528062", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "visualization": { + "layerId": "14c733ca-25b4-4aa9-b145-2e8ccd73ed52", + "layerType": "data", + "metricAccessor": "5774538b-e91c-4be0-a7f8-09c7035c13ca" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -529,9 +472,8 @@ "y": 4 }, "panelIndex": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d", - "title": "Total Whitelisted IOCs [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -550,7 +492,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "92189bed-8862-4f63-81fe-fcad0a0a4605": { "columnOrder": [ @@ -691,7 +633,7 @@ "panelIndex": "95483975-6af1-408d-b5ae-6177771466a3", "title": "Total IOCs by Type [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -710,7 +652,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "92189bed-8862-4f63-81fe-fcad0a0a4605": { "columnOrder": [ @@ -855,7 +797,7 @@ "panelIndex": "a53fb022-4183-4122-a48d-5653d296be7d", "title": "Total IOCs by Type in Last Day [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -874,7 +816,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d835f8e5-2c86-4333-97bd-74d919a26cd6": { "columnOrder": [ @@ -953,16 +895,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "dcb482c0-85c7-4e88-b019-3b5406086631" - ], "layerId": "d835f8e5-2c86-4333-97bd-74d919a26cd6", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "69ccbbec-7b0a-4e57-a6e1-538a1002c78f", + "metrics": [ + "69ccbbec-7b0a-4e57-a6e1-538a1002c78f" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "dcb482c0-85c7-4e88-b019-3b5406086631" + ] } ], "palette": { @@ -989,7 +933,7 @@ "panelIndex": "92382f4a-7a0e-45f8-8b02-066bcfefcfd6", "title": "Total IOCs by Severity [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1008,7 +952,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4785dc41-2998-4b09-bfdf-ef6f5c4a6e3e": { "columnOrder": [ @@ -1149,7 +1093,7 @@ "panelIndex": "c58d5ecc-a4d7-41af-8505-8a28eea1134f", "title": "Total Indicators per Provider [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1168,7 +1112,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f37d9391-8e17-4165-a84b-2ace448dc3ad": { "columnOrder": [ @@ -1247,16 +1191,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "bd2fb8fa-624d-47eb-8c58-87bbef9dad44" - ], "layerId": "f37d9391-8e17-4165-a84b-2ace448dc3ad", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "abaf9c29-1cca-48b4-ab32-e9fcfe623992", + "metrics": [ + "abaf9c29-1cca-48b4-ab32-e9fcfe623992" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bd2fb8fa-624d-47eb-8c58-87bbef9dad44" + ] } ], "shape": "treemap" @@ -1278,7 +1224,7 @@ "panelIndex": "2d61fd21-1e67-404d-9a8b-842519debbba", "title": "Most Popular File Extensions [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1297,7 +1243,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "03ffe38b-4462-47d2-b700-4709bf30b03b": { "columnOrder": [ @@ -1412,7 +1358,7 @@ "panelIndex": "77adb89e-4722-4579-a9cd-983406deb8f7", "title": "Distribution of IOCs by Confidence Level [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1431,7 +1377,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4b8f4377-1fc8-4c5e-8877-58db5d7cd08b": { "columnOrder": [ @@ -1538,7 +1484,7 @@ "panelIndex": "2558c6e5-50d5-457f-92d6-b2ff9d927f02", "title": "Top 10 IOC Providers [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1557,7 +1503,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "47c6ecc3-dacd-466f-b11e-be757580f44a": { "columnOrder": [ @@ -1643,16 +1589,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "c4c66682-5a78-4c87-b8c0-953d8eeb226c" - ], "layerId": "47c6ecc3-dacd-466f-b11e-be757580f44a", "layerType": "data", "legendDisplay": "default", "legendSize": "auto", - "metric": "94684c97-ca17-4326-bc82-54ae557bb895", + "metrics": [ + "94684c97-ca17-4326-bc82-54ae557bb895" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "c4c66682-5a78-4c87-b8c0-953d8eeb226c" + ] } ], "palettetemplate": { @@ -1679,7 +1627,7 @@ "panelIndex": "16150cbd-7efb-4233-b9f8-ddfc6482ec5c", "title": "Percentage of URL Scheme Used [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1703,7 +1651,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d7678693-f737-4c72-a8ad-ad7fcc0d4c40": { "columnOrder": [ @@ -1830,7 +1778,7 @@ "panelIndex": "ab582c99-6a63-41a9-933e-6fb83204bded", "title": "Top 10 Most Popular Domains [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1854,7 +1802,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8a0b4c7c-4cc8-451f-8894-cb19e9398d17": { "columnOrder": [ @@ -1994,7 +1942,7 @@ "panelIndex": "8b447840-f325-4ef0-a6e4-53dd637ed8a9", "title": "Top 10 Most Popular IPs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2018,7 +1966,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1efc2fc3-c7ea-4dcd-8666-36fa77bf292a": { "columnOrder": [ @@ -2144,7 +2092,7 @@ "panelIndex": "9871f5d8-f257-475f-a6b2-ee00da58de2b", "title": "Top 10 Most Popular Email ID [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -2182,62 +2130,63 @@ "panelIndex": "781640a3-5c61-4537-a42f-418a6d8dba67", "title": "Most IOCs from Country [Logs Rapid7 Threat Command]", "type": "map", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] IOC Overview", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-20735802-0864-485a-8b6f-e138aae5900d", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "99632f77-2095-479e-9961-770ab18be038:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "99632f77-2095-479e-9961-770ab18be038:indexpattern-datasource-layer-3260128f-a820-43a0-8280-541300572c9d", "type": "index-pattern" }, { "id": "logs-*", - "name": "99632f77-2095-479e-9961-770ab18be038:metrics_99632f77-2095-479e-9961-770ab18be038_0_index_pattern", + "name": "99632f77-2095-479e-9961-770ab18be038:304ae460-2fca-4ca9-8a9f-dfd27673edd6", "type": "index-pattern" }, { "id": "logs-*", - "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:indexpattern-datasource-layer-7cb70370-3bb6-4bde-8763-df54e34a445a", "type": "index-pattern" }, { "id": "logs-*", - "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:metrics_2e08af2f-46b7-40d8-a054-327ddad1ffc7_0_index_pattern", + "name": "2e08af2f-46b7-40d8-a054-327ddad1ffc7:890fddd8-e271-46f4-abc0-57012b06bcab", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:indexpattern-datasource-layer-25e74ede-01a1-41c0-8d1c-82f86659847b", "type": "index-pattern" }, { "id": "logs-*", - "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:metrics_dfeb4d5a-35af-49e3-b10d-06900494775d_0_index_pattern", + "name": "dfeb4d5a-35af-49e3-b10d-06900494775d:e3902633-d960-4d4d-bbfc-151d3a66e429", "type": "index-pattern" }, { "id": "logs-*", - "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:indexpattern-datasource-layer-14c733ca-25b4-4aa9-b145-2e8ccd73ed52", "type": "index-pattern" }, { "id": "logs-*", - "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:a963a789-dce0-4605-96b1-edd2339372d0", "type": "index-pattern" }, { "id": "logs-*", - "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:metrics_eb39f5e5-3da7-4a01-b3be-099e7ebb595d_0_index_pattern", + "name": "eb39f5e5-3da7-4a01-b3be-099e7ebb595d:ea0a3b73-cd24-4f20-82b7-e8f69f375469", "type": "index-pattern" }, { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-2388d940-f6b4-11ec-ad26-2fb998639a1e.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-2388d940-f6b4-11ec-ad26-2fb998639a1e.json index 76b343498d1..de0d4dcbe42 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-2388d940-f6b4-11ec-ad26-2fb998639a1e.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-2388d940-f6b4-11ec-ad26-2fb998639a1e.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"1216a485-5794-4a6c-a8e4-1e79dd0a80fd\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"threat.indicator.type\",\"parentFieldName\":\"threat.indicator.type\",\"title\":\"Type\",\"id\":\"1216a485-5794-4a6c-a8e4-1e79dd0a80fd\",\"enhancements\":{}}},\"bf63a651-5701-4626-ac76-4fc4cb1835bb\":{\"order\":5,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"threat.indicator.provider\",\"parentFieldName\":\"threat.indicator.provider\",\"title\":\"Reporting Feeds\",\"id\":\"bf63a651-5701-4626-ac76-4fc4cb1835bb\",\"enhancements\":{}}},\"40cc6531-e5d7-413d-a51c-ee8585abd4ab\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.ioc.tags\",\"parentFieldName\":\"rapid7.tc.ioc.tags\",\"title\":\"Tags\",\"id\":\"40cc6531-e5d7-413d-a51c-ee8585abd4ab\",\"enhancements\":{}}},\"27a5e0e7-8161-49aa-a924-6b741a4b4241\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.ioc.related.malware\",\"parentFieldName\":\"rapid7.tc.ioc.related.malware\",\"title\":\"Malware\",\"id\":\"27a5e0e7-8161-49aa-a924-6b741a4b4241\",\"enhancements\":{}}},\"165e4904-8333-47b1-b9cd-21187df9509f\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.ioc.related.threat_actors\",\"parentFieldName\":\"rapid7.tc.ioc.related.threat_actors\",\"title\":\"Threat Actor\",\"id\":\"165e4904-8333-47b1-b9cd-21187df9509f\",\"enhancements\":{}}},\"70096a75-272d-4a17-a60d-374de2cbbf2b\":{\"order\":6,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"kibana.alert.ancestors.index.keyword\",\"parentFieldName\":\"kibana.alert.ancestors.index\",\"title\":\"Correlation Indices\",\"id\":\"70096a75-272d-4a17-a60d-374de2cbbf2b\",\"enhancements\":{}}},\"6662da66-a1b7-4297-b9b2-91dd82101eba\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"threat.indicator.confidence\",\"title\":\"Severity\",\"id\":\"6662da66-a1b7-4297-b9b2-91dd82101eba\",\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +19,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -60,7 +61,7 @@ "panelIndex": "42f0a07b-9cc0-4faa-8f47-81bd3602b2a2", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -74,7 +75,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "be6cdaa4-d8f6-4545-9832-8b80131085e2": { "columnOrder": [ @@ -444,17 +445,18 @@ "panelIndex": "d6a658da-c4a3-4d6a-846f-99e70a0b9800", "title": "Top 10000 Matched IOCs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] IOC Correlation Details", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-2388d940-f6b4-11ec-ad26-2fb998639a1e", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-24d08610-7227-11ed-af6f-3913a325a746.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-24d08610-7227-11ed-af6f-3913a325a746.json index a8a80faa775..61e0f808392 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-24d08610-7227-11ed-af6f-3913a325a746.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-24d08610-7227-11ed-af6f-3913a325a746.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"ee972398-e931-4b70-afd9-e4451487359b\":{\"order\":0,\"width\":\"large\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.vulnerability.severity\",\"title\":\"Severity\",\"id\":\"ee972398-e931-4b70-afd9-e4451487359b\",\"selectedOptions\":[],\"enhancements\":{}}},\"dd6f910d-e399-401a-9173-23f62801a373\":{\"order\":1,\"width\":\"large\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.vulnerability.exploit_availability\",\"title\":\"Exploit Availability\",\"id\":\"dd6f910d-e399-401a-9173-23f62801a373\",\"selectedOptions\":[],\"singleSelect\":true,\"enhancements\":{}}},\"9867f742-44ac-48f0-9177-56400f5cf85e\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.vulnerability.cpe.vendor_product\",\"title\":\"Vendor \u0026 Product\",\"id\":\"9867f742-44ac-48f0-9177-56400f5cf85e\",\"selectedOptions\":[],\"enhancements\":{}}},\"731c3ce3-b9f2-4c47-9fcc-d041abeafc8f\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"kibana.alert.ancestors.index.keyword\",\"parentFieldName\":\"kibana.alert.ancestors.index\",\"title\":\"Correlation Indices\",\"id\":\"731c3ce3-b9f2-4c47-9fcc-d041abeafc8f\",\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +19,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -61,7 +61,7 @@ "panelIndex": "0c640545-d2c1-4ed8-9556-04cdb3d7831e", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -75,7 +75,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "445a6e88-ca28-4c63-ba90-8402c5b95462": { "columnOrder": [ @@ -554,17 +554,18 @@ "panelIndex": "bd05d513-3c0c-494f-acaf-1b1e0fbd76f9", "title": "Top 10000 Matched Vulnerabilities [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] Vulnerability Correlation Details", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-24d08610-7227-11ed-af6f-3913a325a746", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-7fdae3b0-590a-11ed-abd0-858c1d0aec26.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-7fdae3b0-590a-11ed-abd0-858c1d0aec26.json index 9c51b0b63bf..51c284b0a9b 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-7fdae3b0-590a-11ed-abd0-858c1d0aec26.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-7fdae3b0-590a-11ed-abd0-858c1d0aec26.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"4d5fb1c7-9fcc-4f76-9767-50d74f115d03\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"tags\",\"title\":\"Tags\",\"id\":\"4d5fb1c7-9fcc-4f76-9767-50d74f115d03\",\"enhancements\":{}}},\"cdb64ca5-2f6d-4b64-9b2c-46b10cdc862e\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.assignees\",\"title\":\"Assignee\",\"id\":\"cdb64ca5-2f6d-4b64-9b2c-46b10cdc862e\",\"enhancements\":{}}},\"eacf9b92-04fc-4e5f-b326-071666916dc5\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.details.type\",\"title\":\"Type\",\"id\":\"eacf9b92-04fc-4e5f-b326-071666916dc5\",\"enhancements\":{}}},\"55230720-e140-47ab-896b-5095ceb0764c\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.details.severity\",\"title\":\"Severity\",\"id\":\"55230720-e140-47ab-896b-5095ceb0764c\",\"enhancements\":{}}},\"1eff5461-7863-4cd8-aef3-8690f58ea423\":{\"order\":4,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.is_flagged\",\"title\":\"Flagged Alerts\",\"id\":\"1eff5461-7863-4cd8-aef3-8690f58ea423\",\"enhancements\":{}}},\"93629147-28ea-4e75-b926-b5b13ba1ca79\":{\"order\":5,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"rapid7.tc.alert.is_closed\",\"title\":\"Closed Alerts\",\"id\":\"93629147-28ea-4e75-b926-b5b13ba1ca79\",\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -39,6 +38,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -79,7 +80,7 @@ "panelIndex": "42f0a07b-9cc0-4faa-8f47-81bd3602b2a2", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -93,7 +94,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "8cf5a8b0-e7ba-4baf-b830-2eb82bd3936a": { "columnOrder": [ @@ -405,17 +406,18 @@ "panelIndex": "832cd543-863c-49a2-858d-ec1cf9b06183", "title": "Alert Details [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] Alert Details", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-7fdae3b0-590a-11ed-abd0-858c1d0aec26", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8dea15b0-f3a3-11ec-aff5-576c7e430437.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8dea15b0-f3a3-11ec-aff5-576c7e430437.json index a048e3b4b1b..00b85d493d5 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8dea15b0-f3a3-11ec-aff5-576c7e430437.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8dea15b0-f3a3-11ec-aff5-576c7e430437.json @@ -7,7 +7,6 @@ "panelsJSON": "{\"457c92b5-f246-45a3-ab06-95aafed55ac4\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"threat.indicator.confidence\",\"parentFieldName\":\"threat.indicator.confidence\",\"title\":\"Severity\",\"id\":\"457c92b5-f246-45a3-ab06-95aafed55ac4\",\"selectedOptions\":[],\"enhancements\":{}}},\"30700425-b054-4f83-bda0-6156c86b044d\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"threat.indicator.provider\",\"parentFieldName\":\"threat.indicator.provider\",\"title\":\"Reporting Feeds\",\"id\":\"30700425-b054-4f83-bda0-6156c86b044d\",\"enhancements\":{}}},\"0b00635d-3f08-4b98-9775-6e2a3b90af05\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"kibana.alert.ancestors.index.keyword\",\"parentFieldName\":\"kibana.alert.ancestors.index\",\"title\":\"Correlation Indices\",\"id\":\"0b00635d-3f08-4b98-9775-6e2a3b90af05\",\"enhancements\":{}}}}" }, "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,6 +19,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -60,97 +61,67 @@ "panelIndex": "d34794a0-21e0-47dd-bfcc-877f8bfdc565", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [], - "query": { - "language": "kuery", - "query": "" - } + "attributes": { + "references": [ + { + "id": "c5231120-f6a1-11ec-9af4-21d6785db030", + "name": "indexpattern-datasource-layer-e11752a6-eebe-404b-a456-315d77b0b9d7", + "type": "index-pattern" } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "c77afc20-cf97-11ec-8c02-49b65d195d6f" - } - ], - "bar_color_rules": [ - { - "id": "424bbca0-64a3-11ed-b25e-857bc3cac8f7" + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "e11752a6-eebe-404b-a456-315d77b0b9d7": { + "columnOrder": [ + "34aaa758-d265-4c7c-8b96-f7de3abf9622" + ], + "columns": { + "34aaa758-d265-4c7c-8b96-f7de3abf9622": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Matched IOCs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "filter": { + }, + "filters": [], + "internalReferences": [], + "query": { "language": "kuery", "query": "" }, - "id": "b28c2c2d-5fd0-4f95-aa42-d9349efad53f", - "index_pattern_ref_name": "metrics_40cbe947-035f-42e5-8db4-3405f9af8749_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "color_rules": [ - { - "id": "439c0a60-64a3-11ed-b25e-857bc3cac8f7" - } - ], - "fill": 0.5, - "formatter": "0.[00]a", - "id": "9097d581-672c-4ef1-998a-1daca02862cf", - "label": "Total Matched IOCs", - "line_width": 1, - "metrics": [ - { - "field": "rapid7.tc.ioc.value", - "id": "9c9c790e-cf42-4f14-9d17-d93b8fb79948", - "type": "count" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" - }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" - } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "visualization": { + "layerId": "e11752a6-eebe-404b-a456-315d77b0b9d7", + "layerType": "data", + "metricAccessor": "34aaa758-d265-4c7c-8b96-f7de3abf9622" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 10, @@ -160,9 +131,8 @@ "y": 4 }, "panelIndex": "40cbe947-035f-42e5-8db4-3405f9af8749", - "title": "Total Matched IOCs [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -176,7 +146,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "43108eb7-9a1a-493c-9e27-339ba76c0799": { "columnOrder": [ @@ -314,7 +284,7 @@ "panelIndex": "3768bf14-84ef-45d1-b739-87752328a644", "title": "Total Matched IOCs by Type [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -328,7 +298,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b37b59aa-d3de-438a-bd70-8d7ef7ac79df": { "columnOrder": [ @@ -418,7 +388,7 @@ "panelIndex": "e8c6fb6b-79ac-4132-adbd-94e0a4a2214f", "title": "Top Tags Linked with Matched IOCs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -432,7 +402,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "a5786ba3-62ab-48c3-8d43-d619a584b879": { "columnOrder": [ @@ -520,7 +490,7 @@ "panelIndex": "075fa782-2301-417c-b300-0e058dbac4b5", "title": "Top Threat Actors Linked with Matched IOCs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -534,7 +504,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "99a2acb8-eff6-4731-8ef8-17d2801b30a1": { "columnOrder": [ @@ -622,22 +592,23 @@ "panelIndex": "d7e2a3aa-aaa3-4893-a90c-1af3ef185294", "title": "Top Malwares Linked with Matched IOCs [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] IOC Correlation", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-8dea15b0-f3a3-11ec-aff5-576c7e430437", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "c5231120-f6a1-11ec-9af4-21d6785db030", - "name": "40cbe947-035f-42e5-8db4-3405f9af8749:metrics_40cbe947-035f-42e5-8db4-3405f9af8749_0_index_pattern", + "name": "40cbe947-035f-42e5-8db4-3405f9af8749:indexpattern-datasource-layer-e11752a6-eebe-404b-a456-315d77b0b9d7", "type": "index-pattern" }, { diff --git a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8f985fb0-6988-11ed-8bdb-110ff35bc478.json b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8f985fb0-6988-11ed-8bdb-110ff35bc478.json index 09b7cbca2ce..ec6fea88985 100644 --- a/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8f985fb0-6988-11ed-8bdb-110ff35bc478.json +++ b/packages/ti_rapid7_threat_command/kibana/dashboard/ti_rapid7_threat_command-8f985fb0-6988-11ed-8bdb-110ff35bc478.json @@ -1,7 +1,6 @@ { "attributes": { "description": "", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -14,6 +13,7 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, "syncTooltips": false, "useMargins": true }, @@ -55,105 +55,94 @@ "panelIndex": "3474668b-5a05-45e3-8179-8c57d169ce3f", "title": "Dashboards [Logs Rapid7 Threat Command]", "type": "visualization", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.vulnerability" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a73a8425-0a5f-4819-ba5f-6cbb1b5ad217", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9cc370ec-1d93-45f0-9918-08d18e3e4dc5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a73a8425-0a5f-4819-ba5f-6cbb1b5ad217": { + "columnOrder": [ + "034ed1b0-6376-4a4d-9908-dacfde26bf95" + ], + "columns": { + "034ed1b0-6376-4a4d-9908-dacfde26bf95": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total Vulnerabilities", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "vulnerability.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "id": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0e018f60-698a-11ed-84a1-79e2d0275958" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "b1c62fbe-47ce-4418-8a81-ce331c2ed8a7", - "index_pattern_ref_name": "metrics_1f0770d9-6400-4621-9fce-d0933cd87946_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "e69e8da8-8098-4ebc-a8fa-87f923e6e76c", - "label": "Total Vulnerabilities", - "line_width": 1, - "metrics": [ - { - "field": "vulnerability.id", - "id": "a43744fb-92c0-4194-8c00-752da554bc7e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "9cc370ec-1d93-45f0-9918-08d18e3e4dc5", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.vulnerability" + }, + "type": "phrase" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "a73a8425-0a5f-4819-ba5f-6cbb1b5ad217", + "layerType": "data", + "metricAccessor": "034ed1b0-6376-4a4d-9908-dacfde26bf95" + } }, "title": "", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -163,110 +152,95 @@ "y": 4 }, "panelIndex": "1f0770d9-6400-4621-9fce-d0933cd87946", - "title": "Total Vulnerabilities [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.vulnerability" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-95cbe151-56dc-4127-9f29-3ed75d9098e9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "355d57ea-9373-41e3-8941-81b67e12fbd4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "95cbe151-56dc-4127-9f29-3ed75d9098e9": { + "columnOrder": [ + "04f7f167-9492-4762-88f9-293416208806" + ], + "columns": { + "04f7f167-9492-4762-88f9-293416208806": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Vulnerabilities in Last Month", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "vulnerability.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0e018f60-698a-11ed-84a1-79e2d0275958" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "b1c62fbe-47ce-4418-8a81-ce331c2ed8a7", - "index_pattern_ref_name": "metrics_becdeea6-766f-43a5-9700-68b65ccd98ec_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "e69e8da8-8098-4ebc-a8fa-87f923e6e76c", - "label": "Total New Vulnerabilities in Last Month", - "line_width": 1, - "metrics": [ - { - "field": "vulnerability.id", - "id": "a43744fb-92c0-4194-8c00-752da554bc7e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "index": "355d57ea-9373-41e3-8941-81b67e12fbd4", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.vulnerability" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "95cbe151-56dc-4127-9f29-3ed75d9098e9", + "layerType": "data", + "metricAccessor": "04f7f167-9492-4762-88f9-293416208806" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1M", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -276,110 +250,95 @@ "y": 4 }, "panelIndex": "becdeea6-766f-43a5-9700-68b65ccd98ec", - "title": "Total New Vulnerabilities in Last Month [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.vulnerability" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2fd8bea2-b3f4-41ad-925a-191ef74e5c11", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "419ccbf0-a1dc-42bc-9b58-d18507a6ad53", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2fd8bea2-b3f4-41ad-925a-191ef74e5c11": { + "columnOrder": [ + "2baf114e-2956-4a18-a6c7-6e5eb42e24be" + ], + "columns": { + "2baf114e-2956-4a18-a6c7-6e5eb42e24be": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Vulnerabilities in Last Week", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "vulnerability.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0e018f60-698a-11ed-84a1-79e2d0275958" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "b1c62fbe-47ce-4418-8a81-ce331c2ed8a7", - "index_pattern_ref_name": "metrics_fa3ab9b8-b568-4281-800d-edd7ee08fb3c_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "e69e8da8-8098-4ebc-a8fa-87f923e6e76c", - "label": "Total New Vulnerabilities in Last Week", - "line_width": 1, - "metrics": [ - { - "field": "vulnerability.id", - "id": "a43744fb-92c0-4194-8c00-752da554bc7e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "index": "419ccbf0-a1dc-42bc-9b58-d18507a6ad53", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.vulnerability" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "2fd8bea2-b3f4-41ad-925a-191ef74e5c11", + "layerType": "data", + "metricAccessor": "2baf114e-2956-4a18-a6c7-6e5eb42e24be" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1w", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -389,110 +348,95 @@ "y": 4 }, "panelIndex": "fa3ab9b8-b568-4281-800d-edd7ee08fb3c", - "title": "Total New Vulnerabilities in Last Week [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": true, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "ti_rapid7_threat_command.vulnerability" + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-d48a55db-6454-4bce-b547-fae193865d43", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c8a83ea1-3914-45ab-9ea6-967e61164a2b", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "d48a55db-6454-4bce-b547-fae193865d43": { + "columnOrder": [ + "847d1193-29b6-4ba5-9ca4-6e6ebfa71959" + ], + "columns": { + "847d1193-29b6-4ba5-9ca4-6e6ebfa71959": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total New Vulnerabilities in Last Day", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "vulnerability.id" + } }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" - } + "incompleteColumns": {} } } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "background_color_rules": [ - { - "id": "0e018f60-698a-11ed-84a1-79e2d0275958" + }, + "textBased": { + "layers": {} } - ], - "drop_last_bucket": 0, - "id": "b1c62fbe-47ce-4418-8a81-ce331c2ed8a7", - "index_pattern_ref_name": "metrics_592e307e-ab20-4841-b082-1df9fd6f8771_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "series": [ + }, + "filters": [ { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "0.[00]a", - "id": "e69e8da8-8098-4ebc-a8fa-87f923e6e76c", - "label": "Total New Vulnerabilities in Last Day", - "line_width": 1, - "metrics": [ - { - "field": "vulnerability.id", - "id": "a43744fb-92c0-4194-8c00-752da554bc7e", - "type": "cardinality" - } - ], - "override_index_pattern": 0, - "palette": { - "name": "default", - "type": "palette" + "$state": { + "store": "appState" }, - "point_size": 1, - "separate_axis": 0, - "series_drop_last_bucket": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + "meta": { + "alias": null, + "disabled": false, + "index": "c8a83ea1-3914-45ab-9ea6-967e61164a2b", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "ti_rapid7_threat_command.vulnerability" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "ti_rapid7_threat_command.vulnerability" + } + } } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "metric", - "use_kibana_indexes": true + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layerId": "d48a55db-6454-4bce-b547-fae193865d43", + "layerType": "data", + "metricAccessor": "847d1193-29b6-4ba5-9ca4-6e6ebfa71959" + } }, "title": "", - "type": "metrics", - "uiState": {} + "type": "lens", + "visualizationType": "lnsMetric" }, - "timeRange": { - "from": "now-1d", - "to": "now" - } + "enhancements": {}, + "hidePanelTitles": true }, "gridData": { "h": 9, @@ -502,9 +446,8 @@ "y": 4 }, "panelIndex": "592e307e-ab20-4841-b082-1df9fd6f8771", - "title": "Total New Vulnerabilities in Last Day [Logs Rapid7 Threat Command]", - "type": "visualization", - "version": "8.4.0" + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -523,7 +466,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "eddbe920-e889-421a-a305-a5d1c7319b64": { "columnOrder": [ @@ -605,15 +548,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "bebcb116-724c-4e48-ae11-c2868d4678f7" - ], "layerId": "eddbe920-e889-421a-a305-a5d1c7319b64", "layerType": "data", "legendDisplay": "default", - "metric": "9f90cca4-9692-4e0c-9c38-e86cc3294c59", + "metrics": [ + "9f90cca4-9692-4e0c-9c38-e86cc3294c59" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "bebcb116-724c-4e48-ae11-c2868d4678f7" + ] } ], "palette": { @@ -640,7 +585,7 @@ "panelIndex": "1deac15c-0eec-4e85-b9f7-c082998d711b", "title": "Total Vulnerabilities with Exploit [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -659,7 +604,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "07bc066a-d1d8-44aa-ae8a-ab22fd1d34bf": { "columnOrder": [ @@ -738,15 +683,17 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d146b60e-1b43-4b69-9b72-cf227ada7574" - ], "layerId": "07bc066a-d1d8-44aa-ae8a-ab22fd1d34bf", "layerType": "data", "legendDisplay": "default", - "metric": "ba78296f-715f-429c-8516-0e0428773efe", + "metrics": [ + "ba78296f-715f-429c-8516-0e0428773efe" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d146b60e-1b43-4b69-9b72-cf227ada7574" + ] } ], "shape": "pie" @@ -769,7 +716,7 @@ "panelIndex": "e2f11e3c-467e-4044-896c-58c44c0b0aa4", "title": "Total Vulnerabilities by Severity [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -788,7 +735,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7a86ef80-5f14-4ce8-a6fd-70c8244ebd55": { "columnOrder": [ @@ -899,7 +846,7 @@ "panelIndex": "764098ed-6de4-4e04-bfcd-c4731ce61bd6", "title": "Top Threat Actors Linked with Vulnerability [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -918,7 +865,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7a86ef80-5f14-4ce8-a6fd-70c8244ebd55": { "columnOrder": [ @@ -1030,7 +977,7 @@ "panelIndex": "2ea87cd8-5e92-4dc2-9530-4c8597600b1a", "title": "Top Threat Campaigns Linked with Vulnerability [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1049,7 +996,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7a86ef80-5f14-4ce8-a6fd-70c8244ebd55": { "columnOrder": [ @@ -1161,57 +1108,58 @@ "panelIndex": "9353f9fa-1b9f-4f7e-a51c-be9c1f8da849", "title": "Top Malwares Linked with Vulnerability [Logs Rapid7 Threat Command]", "type": "lens", - "version": "8.4.0" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Rapid7 Threat Command] Vulnerability Overview", "version": 1 }, - "coreMigrationVersion": "8.4.0", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T03:39:34.588Z", "id": "ti_rapid7_threat_command-8f985fb0-6988-11ed-8bdb-110ff35bc478", "migrationVersion": { - "dashboard": "8.4.0" + "dashboard": "8.7.0" }, "references": [ { "id": "logs-*", - "name": "1f0770d9-6400-4621-9fce-d0933cd87946:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "1f0770d9-6400-4621-9fce-d0933cd87946:indexpattern-datasource-layer-a73a8425-0a5f-4819-ba5f-6cbb1b5ad217", "type": "index-pattern" }, { "id": "logs-*", - "name": "1f0770d9-6400-4621-9fce-d0933cd87946:metrics_1f0770d9-6400-4621-9fce-d0933cd87946_0_index_pattern", + "name": "1f0770d9-6400-4621-9fce-d0933cd87946:9cc370ec-1d93-45f0-9918-08d18e3e4dc5", "type": "index-pattern" }, { "id": "logs-*", - "name": "becdeea6-766f-43a5-9700-68b65ccd98ec:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "becdeea6-766f-43a5-9700-68b65ccd98ec:indexpattern-datasource-layer-95cbe151-56dc-4127-9f29-3ed75d9098e9", "type": "index-pattern" }, { "id": "logs-*", - "name": "becdeea6-766f-43a5-9700-68b65ccd98ec:metrics_becdeea6-766f-43a5-9700-68b65ccd98ec_0_index_pattern", + "name": "becdeea6-766f-43a5-9700-68b65ccd98ec:355d57ea-9373-41e3-8941-81b67e12fbd4", "type": "index-pattern" }, { "id": "logs-*", - "name": "fa3ab9b8-b568-4281-800d-edd7ee08fb3c:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "fa3ab9b8-b568-4281-800d-edd7ee08fb3c:indexpattern-datasource-layer-2fd8bea2-b3f4-41ad-925a-191ef74e5c11", "type": "index-pattern" }, { "id": "logs-*", - "name": "fa3ab9b8-b568-4281-800d-edd7ee08fb3c:metrics_fa3ab9b8-b568-4281-800d-edd7ee08fb3c_0_index_pattern", + "name": "fa3ab9b8-b568-4281-800d-edd7ee08fb3c:419ccbf0-a1dc-42bc-9b58-d18507a6ad53", "type": "index-pattern" }, { "id": "logs-*", - "name": "592e307e-ab20-4841-b082-1df9fd6f8771:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "592e307e-ab20-4841-b082-1df9fd6f8771:indexpattern-datasource-layer-d48a55db-6454-4bce-b547-fae193865d43", "type": "index-pattern" }, { "id": "logs-*", - "name": "592e307e-ab20-4841-b082-1df9fd6f8771:metrics_592e307e-ab20-4841-b082-1df9fd6f8771_0_index_pattern", + "name": "592e307e-ab20-4841-b082-1df9fd6f8771:c8a83ea1-3914-45ab-9ea6-967e61164a2b", "type": "index-pattern" }, { diff --git a/packages/ti_rapid7_threat_command/kibana/tags.yml b/packages/ti_rapid7_threat_command/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_rapid7_threat_command/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_rapid7_threat_command/manifest.yml b/packages/ti_rapid7_threat_command/manifest.yml index 12e121ddd3a..4cdf864bbb3 100644 --- a/packages/ti_rapid7_threat_command/manifest.yml +++ b/packages/ti_rapid7_threat_command/manifest.yml @@ -1,10 +1,8 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: ti_rapid7_threat_command title: Rapid7 Threat Command # The version must be updated manually in the transform.yml files and transform APIs mentioned in README. -version: "1.4.0" -release: ga -license: basic +version: "1.8.0" description: Collect threat intelligence from Threat Command API with Elastic Agent. type: integration categories: ["security", "threat_intel"] diff --git a/packages/ti_recordedfuture/_dev/build/build.yml b/packages/ti_recordedfuture/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_recordedfuture/_dev/build/build.yml +++ b/packages/ti_recordedfuture/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_recordedfuture/changelog.yml b/packages/ti_recordedfuture/changelog.yml index bc497f93b04..89263a64b69 100644 --- a/packages/ti_recordedfuture/changelog.yml +++ b/packages/ti_recordedfuture/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.1" + changes: + - description: Replace dotted YAML keys. + type: bugfix + link: https://github.com/elastic/integrations/pull/7801 +- version: "1.15.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7588 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.13.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-domain-default.log-expected.json b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-domain-default.log-expected.json index 711296ae76c..2cf9e994f28 100644 --- a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-domain-default.log-expected.json +++ b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-domain-default.log-expected.json @@ -3,15 +3,19 @@ null, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"xohrikvjhiu.eu\",\"96\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329\"\", \"\"Sources\"\": [\"\"QQA438\"\", \"\"Jv_xrR\"\", \"\"SlNfa3\"\", \"\"KvPSaU\"\"], \"\"Timestamp\"\": \"\"2019-11-16T22:03:55.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter\"\", \"\"Sources\"\": [\"\"QQA438\"\", \"\"KvPSaU\"\"], \"\"Timestamp\"\": \"\"2018-11-12T20:48:08.675Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Referenced by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2018-10-23T00:00:00.000Z\"\", \"\"Name\"\": \"\"relatedNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-03-23T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:12:02.455Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 96.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -109,15 +113,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"wgwuhauaqcrx.com\",\"95\",\"6/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported by DHS AIS\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019).\"\", \"\"Sources\"\": [\"\"UZNze8\"\"], \"\"Timestamp\"\": \"\"2019-07-25T00:46:19.000Z\"\", \"\"Name\"\": \"\"dhsAis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\"\", \"\"Sources\"\": [\"\"ST7rfx\"\"], \"\"Timestamp\"\": \"\"2017-05-17T19:31:06.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021.\"\", \"\"Sources\"\": [\"\"report:Tluf00\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:21:52.311Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-07-09T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-07-06T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:21:52.303Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 95.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -222,15 +230,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"wbmpvebw.com\",\"95\",\"6/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2020-01-04T20:03:37.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021.\"\", \"\"Sources\"\": [\"\"report:Tluf00\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:16:05.008Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-06-30T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-05-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:16:05.007Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 95.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -335,15 +347,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"ckgryagcibbcf.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2021-02-01T20:08:18.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-06-15T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2016-04-11T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:40:44.358Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -435,15 +451,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"jpuityvakjgg.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2021-02-01T20:08:24.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-06-17T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-05-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:46:28.155Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -535,15 +555,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"jexgpprgph.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2018-12-13T18:03:21.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-06-30T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-05-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:40:30.778Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -635,15 +659,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"cascotqhij.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2021-02-01T20:08:16.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-07-27T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2016-04-11T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:34:06.062Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -735,15 +763,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"npcvnorvyhelagx.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported by DHS AIS\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019).\"\", \"\"Sources\"\": [\"\"UZNze8\"\"], \"\"Timestamp\"\": \"\"2019-07-25T01:51:04.000Z\"\", \"\"Name\"\": \"\"dhsAis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\"\", \"\"Sources\"\": [\"\"ST7rfx\"\"], \"\"Timestamp\"\": \"\"2017-05-17T19:31:06.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-04-01T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-07-06T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:45:21.381Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -835,15 +867,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"uxlyihgvfnqcrfcf.com\",\"94\",\"5/45\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790\"\", \"\"Sources\"\": [\"\"SlNfa3\"\"], \"\"Timestamp\"\": \"\"2020-01-04T20:03:36.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\"\", \"\"Sources\"\": [\"\"KVQ2PB\"\"], \"\"Timestamp\"\": \"\"2017-03-08T01:18:17.569Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Operation\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-05-06T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Malware Analysis DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\"\", \"\"Sources\"\": [\"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-05-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareAnalysis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C DNS Name\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\"\", \"\"Sources\"\": [\"\"report:QhR8Qs\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:35:26.677Z\"\", \"\"Name\"\": \"\"recentCncSite\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ diff --git a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-hash-default.log-expected.json b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-hash-default.log-expected.json index 651e332f821..c56d67e7bc6 100644 --- a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-hash-default.log-expected.json +++ b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-hash-default.log-expected.json @@ -3,15 +3,19 @@ null, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2\",\"SHA-256\",\"89\",\"6/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\"\", \"\"Sources\"\": [\"\"NSAcUx\"\", \"\"KCdHcb\"\", \"\"J6UzbO\"\", \"\"Rlso4a\"\", \"\"hkE5DK\"\", \"\"cJMUDF\"\", \"\"TZRwk8\"\", \"\"QMTzEI\"\", \"\"LUhTGd\"\", \"\"J5NRun\"\"], \"\"Timestamp\"\": \"\"2021-12-21T08:40:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\"\", \"\"Sources\"\": [\"\"T1bwMv\"\", \"\"LC-zVm\"\", \"\"QFvaUy\"\", \"\"P_upBR\"\", \"\"T2OA5Q\"\", \"\"K20lXV\"\", \"\"TGgDPZ\"\", \"\"hkIDTa\"\", \"\"LqRZCN\"\", \"\"Vd51cf\"\", \"\"ha2FFj\"\", \"\"UmsU31\"\", \"\"K7wUX2\"\", \"\"P_ivKa\"\", \"\"Qj3TQr\"\", \"\"idn:wordpress.com\"\", \"\"J-mrOR\"\", \"\"QPbAan\"\", \"\"VeioBt\"\", \"\"WlbRkJ\"\", \"\"K7sErA\"\", \"\"TvfQzk\"\", \"\"TP1vbk\"\", \"\"SrKvJ0\"\", \"\"SqCj4s\"\", \"\"VXaDYo\"\", \"\"bk2VX4\"\"], \"\"Timestamp\"\": \"\"2021-12-25T03:23:47.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\"\", \"\"Sources\"\": [\"\"XV7DoD\"\", \"\"Ym7dzt\"\", \"\"LKKAV1\"\", \"\"VeioBt\"\", \"\"Y7TWfI\"\", \"\"KGS-xC\"\"], \"\"Timestamp\"\": \"\"2019-05-28T14:17:41.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\"\", \"\"Sources\"\": [\"\"TvGJYk\"\", \"\"LErKlJ\"\", \"\"QWOrKl\"\", \"\"LKKAV1\"\", \"\"W4ygGi\"\", \"\"PATKM7\"\", \"\"T1bwMv\"\", \"\"TY6igj\"\", \"\"LjkJhE\"\", \"\"kuKt0c\"\", \"\"QAy9GA\"\", \"\"LbYmLr\"\", \"\"K20lXV\"\", \"\"QZe7TG\"\", \"\"idn:droppdf.com\"\", \"\"QAmbRP\"\", \"\"V_o1DL\"\", \"\"TbciDE\"\", \"\"XV7DoD\"\", \"\"P_j5Dw\"\", \"\"QNmgPm\"\", \"\"TGXqeD\"\", \"\"KGS-xC\"\", \"\"L3kVdM\"\", \"\"QMfGAr\"\", \"\"h6VVAH\"\", \"\"doLlw5\"\", \"\"UrsUKT\"\", \"\"JOU\"\", \"\"MIKjae\"\", \"\"P_oIyV\"\", \"\"QJ6TQK\"\", \"\"RfVd0T\"\", \"\"J6UzbO\"\", \"\"Ql9O5c\"\", \"\"USKpXp\"\", \"\"TP1vbk\"\", \"\"SrKvJ0\"\", \"\"Tq2nAb\"\", \"\"P_ov9o\"\", \"\"VXaDYo\"\", \"\"idn:index-of.es\"\"], \"\"Timestamp\"\": \"\"2021-11-27T23:07:37.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Reported by DHS AIS\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018).\"\", \"\"Sources\"\": [\"\"UZNze8\"\"], \"\"Timestamp\"\": \"\"2018-12-20T21:13:36.000Z\"\", \"\"Name\"\": \"\"dhsAis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html\"\", \"\"Sources\"\": [\"\"LErKlJ\"\", \"\"TbciDE\"\", \"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2020-07-11T09:55:23.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -218,15 +222,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71\",\"SHA-256\",\"89\",\"7/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131\"\", \"\"Sources\"\": [\"\"JfqIbv\"\", \"\"Z2mQh2\"\", \"\"PA-rR4\"\", \"\"jjf3_B\"\", \"\"clDYM8\"\", \"\"T5\"\", \"\"rN\"\", \"\"J5NRun\"\"], \"\"Timestamp\"\": \"\"2021-03-12T20:30:37.672Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C\u0026C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a\"\", \"\"Sources\"\": [\"\"XBl0xf\"\", \"\"POs2u-\"\", \"\"Z3TZAQ\"\", \"\"hhY_oz\"\", \"\"idn:citizensudo.com\"\", \"\"VKz42X\"\", \"\"PA-rR4\"\", \"\"POs2tz\"\", \"\"idn:firsthackersnews.com\"\", \"\"KcjdRW\"\", \"\"dCotni\"\", \"\"idn:comodo.com\"\", \"\"gI8s5W\"\", \"\"hibUwt\"\", \"\"rN\"\", \"\"idn:reportcybercrime.com\"\", \"\"idn:eshielder.com\"\", \"\"idn:edsitrend.com\"\"], \"\"Timestamp\"\": \"\"2021-04-15T00:00:00.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Vulnerability\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json\"\", \"\"Sources\"\": [\"\"MIKjae\"\", \"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-12-27T07:36:54.000Z\"\", \"\"Name\"\": \"\"linkedToVuln\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913\"\", \"\"Sources\"\": [\"\"TuWseX\"\", \"\"KBTQ2e\"\", \"\"eP3CYX\"\", \"\"Z3TZAQ\"\", \"\"clDYM8\"\", \"\"rN\"\", \"\"VKz42X\"\", \"\"idn:elemendar.com\"\", \"\"idn:securitysummitperu.com\"\", \"\"PA-rR4\"\", \"\"idn:terabitweb.com\"\", \"\"eTNyK6\"\", \"\"gBQB48\"\", \"\"bMZlEg\"\", \"\"idn:edsitrend.com\"\", \"\"idn:infoblox.com\"\", \"\"UZNze8\"\", \"\"Z2mQh2\"\", \"\"XBl0xf\"\", \"\"dCpZqs\"\", \"\"jmpFm1\"\", \"\"T5\"\", \"\"doLlw5\"\", \"\"gBDK5G\"\", \"\"MIKjae\"\", \"\"idn:firsthackersnews.com\"\", \"\"jjf3_B\"\", \"\"Jv_xrR\"\", \"\"dCotni\"\", \"\"idn:comodo.com\"\", \"\"hibUwt\"\"], \"\"Timestamp\"\": \"\"2020-12-16T04:52:10.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Reported by DHS AIS\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).\"\", \"\"Sources\"\": [\"\"UZNze8\"\"], \"\"Timestamp\"\": \"\"2021-02-03T21:32:08.000Z\"\", \"\"Name\"\": \"\"dhsAis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/\"\", \"\"Sources\"\": [\"\"K16tAG\"\", \"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2020-12-20T15:18:53.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-03-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"analystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -413,15 +421,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"b66db3a06c2955a9cb71a8718970c592\",\"MD5\",\"89\",\"5/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\"\", \"\"Sources\"\": [\"\"TCw6v6\"\", \"\"Z2mQh2\"\", \"\"2d\"\", \"\"cJuZvt\"\", \"\"JYxY8X\"\", \"\"J2_htN\"\", \"\"jXNbON\"\"], \"\"Timestamp\"\": \"\"2021-12-20T04:54:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800\"\", \"\"Sources\"\": [\"\"LUf99I\"\", \"\"MIKjae\"\", \"\"JYxY8X\"\", \"\"Y7TWfI\"\", \"\"KIRe_w\"\"], \"\"Timestamp\"\": \"\"2021-12-15T14:16:01.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Vulnerability\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538\"\", \"\"Sources\"\": [\"\"VQpQDR\"\", \"\"KFu3Rc\"\", \"\"LUf99I\"\", \"\"SGCsBG\"\", \"\"U94lUG\"\", \"\"KFcv42\"\", \"\"QT0CFv\"\", \"\"UHvtcg\"\", \"\"KFUbjU\"\", \"\"KHwUI5\"\", \"\"KKSt8d\"\", \"\"idn:bund.de\"\", \"\"VmIbAC\"\", \"\"QGT0Vy\"\", \"\"ejfM20\"\", \"\"KGlTEd\"\", \"\"QCoXJo\"\", \"\"RXSwU8\"\", \"\"idn:tistory.com\"\", \"\"LpdVul\"\", \"\"K-eKsL\"\", \"\"TKYCSz\"\", \"\"SkABVK\"\", \"\"SdGk_x\"\", \"\"LI6d7O\"\", \"\"LQIfBf\"\", \"\"U6B2hC\"\", \"\"f7_CfD\"\", \"\"LKt0HB\"\", \"\"RHS4v8\"\", \"\"KKmN5m\"\", \"\"YfJqp2\"\", \"\"Jv_xrR\"\", \"\"RJ2_NX\"\", \"\"VZXzSv\"\", \"\"k0QC11\"\", \"\"KFWBRs\"\", \"\"LRk_pt\"\", \"\"Qn2VRQ\"\", \"\"kGHFKP\"\", \"\"ShBO5M\"\", \"\"T-GSBp\"\", \"\"KNdyHF\"\", \"\"QLCTXP\"\", \"\"Z3TZAQ\"\", \"\"Khf99v\"\", \"\"KHZhjO\"\", \"\"SHH61D\"\", \"\"Knx_su\"\", \"\"LL8-pr\"\", \"\"QpmWTf\"\", \"\"KIRe_w\"\", \"\"QIea7F\"\", \"\"SlhG3F\"\", \"\"KIdj8R\"\", \"\"SQqKS8\"\", \"\"Lq6DNq\"\", \"\"QpYsBa\"\", \"\"d-ZMP2\"\", \"\"LOoye8\"\", \"\"QEUmiJ\"\", \"\"ewfPjC\"\", \"\"LBNFpV\"\", \"\"QTpbKE\"\", \"\"Y7TWfI\"\", \"\"KGS-xC\"\", \"\"eifkGz\"\", \"\"au2SGr\"\", \"\"SKw4tT\"\", \"\"KGW5kn\"\", \"\"Q9y5Ki\"\", \"\"KGxw1d\"\", \"\"MIKjae\"\", \"\"LO5p1C\"\", \"\"JYxY8X\"\", \"\"KJsMEF\"\", \"\"QBLBHH\"\", \"\"k7WJ2k\"\"], \"\"Timestamp\"\": \"\"2021-12-22T19:15:08.000Z\"\", \"\"Name\"\": \"\"linkedToVuln\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\"\", \"\"Sources\"\": [\"\"idn:bund.de\"\", \"\"JYxY8X\"\", \"\"Z3TZAQ\"\"], \"\"Timestamp\"\": \"\"2021-12-20T04:54:00.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/\"\", \"\"Sources\"\": [\"\"J2_htN\"\"], \"\"Timestamp\"\": \"\"2021-12-18T00:20:04.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -613,15 +625,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745\",\"SHA-256\",\"89\",\"8/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html\"\", \"\"Sources\"\": [\"\"QS89Bd\"\", \"\"KVP0jz\"\", \"\"T5\"\", \"\"JYxY5G\"\", \"\"WR_Ohh\"\", \"\"Jt4ExJ\"\", \"\"Kzw0Pm\"\", \"\"JQH96m\"\", \"\"2d\"\", \"\"JYxY8X\"\", \"\"rN\"\", \"\"PA-rR4\"\", \"\"VyWQM7\"\", \"\"Lp_esG\"\", \"\"ONMgMx\"\", \"\"4n\"\", \"\"QMTzEI\"\", \"\"83\"\", \"\"K0TN7r\"\"], \"\"Timestamp\"\": \"\"2019-12-20T01:04:11.602Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017.\"\", \"\"Sources\"\": [\"\"report:Tluf00\"\"], \"\"Timestamp\"\": \"\"2021-12-24T20:03:09.087Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461\"\", \"\"Sources\"\": [\"\"LP7dc7\"\", \"\"LRlngp\"\", \"\"Sl8XTb\"\", \"\"QMfGAr\"\", \"\"J-y3tn\"\"], \"\"Timestamp\"\": \"\"2017-06-27T18:13:29.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Vulnerability\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt\"\", \"\"Sources\"\": [\"\"MIKjae\"\"], \"\"Timestamp\"\": \"\"2021-10-10T08:21:25.825Z\"\", \"\"Name\"\": \"\"linkedToVuln\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705\"\", \"\"Sources\"\": [\"\"ThowaF\"\", \"\"KUtKjP\"\", \"\"K84j7t\"\", \"\"MghdWI\"\", \"\"K8rrfe\"\", \"\"QlWPRW\"\", \"\"KFsPRz\"\", \"\"S-Anbb\"\", \"\"KE9dMF\"\"], \"\"Timestamp\"\": \"\"2017-06-28T02:15:44.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"834 sightings on 201 sources including: New Jersey Cybersecurity \u0026amp; Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521\"\", \"\"Sources\"\": [\"\"jbVMcB\"\", \"\"idn:lnkd.in\"\", \"\"idn:avtech24h.com\"\", \"\"K84j7t\"\", \"\"Sl8XTb\"\", \"\"KGRhOC\"\", \"\"NKaUXl\"\", \"\"KIoGAG\"\", \"\"PA-rR4\"\", \"\"LRlngp\"\", \"\"rN\"\", \"\"Jxh46H\"\", \"\"KFL44X\"\", \"\"TbciDE\"\", \"\"KFNVB9\"\", \"\"OJpx5g\"\", \"\"K-CGye\"\", \"\"KK6oqV\"\", \"\"WR_Ohh\"\", \"\"idn:twitter.com\"\", \"\"fgwEcq\"\", \"\"QYsx0D\"\", \"\"KIFtR_\"\", \"\"Lp_esG\"\", \"\"TSFWTw\"\", \"\"KGHzAY\"\", \"\"P_oEH3\"\", \"\"KBTQ2e\"\", \"\"QCGHCy\"\", \"\"JYxY5G\"\", \"\"UQsrUj\"\", \"\"idn:cert.ro\"\", \"\"idn:bluvector.io\"\", \"\"KFUJTL\"\", \"\"TFUkSW\"\", \"\"P0Gs9I\"\", \"\"K8ofB1\"\", \"\"KVnnHP\"\", \"\"TpaXxw\"\", \"\"U5qdTI\"\", \"\"idn:zscaler.com\"\", \"\"L3kVdM\"\", \"\"QMfGAr\"\", \"\"KIk8aS\"\", \"\"Kzw0Pm\"\", \"\"hcELIE\"\", \"\"POs2tz\"\", \"\"KD6Na4\"\", \"\"idn:globalsecuritymag.com\"\", \"\"LDd0sl\"\", \"\"KVP0jz\"\", \"\"Lj8CsQ\"\", \"\"K8rrfe\"\", \"\"LDejRI\"\", \"\"J-y3tn\"\", \"\"WXutod\"\", \"\"idn:infosecurityfactory.nl\"\", \"\"LBlc7C\"\", \"\"idn:bg.org.tr\"\", \"\"QS89Bd\"\", \"\"K9SiDc\"\", \"\"Qe89bv\"\", \"\"TiY1wu\"\", \"\"idn:undernews.fr\"\", \"\"idn:iteefactory.nl\"\", \"\"KFRGd_\"\", \"\"KFVuR_\"\", \"\"4n\"\", \"\"S-Anbb\"\", \"\"KFNZEC\"\", \"\"TSazOG\"\", \"\"K9Skh1\"\", \"\"MghdWI\"\", \"\"idn:securityiscoming.com\"\", \"\"QS89BG\"\", \"\"LVg9nH\"\", \"\"KFiGli\"\", \"\"K9Vq9B\"\", \"\"KLbNtt\"\", \"\"VyWQM7\"\", \"\"NTakwX\"\", \"\"KGoarP\"\", \"\"idn:gelsene.net\"\", \"\"LwURWv\"\", \"\"KGX8VB\"\", \"\"ThoB0I\"\", \"\"TAIz7D\"\", \"\"QBHQ61\"\", \"\"TiY1w7\"\", \"\"idn:kompasiana.com\"\", \"\"idn:t.co\"\", \"\"KfDTG0\"\", \"\"idn:ictsecuritymagazine.com\"\", \"\"Liz5-u\"\", \"\"MIKjae\"\", \"\"JYxY8X\"\", \"\"KUtKjP\"\", \"\"idn:cert.pl\"\", \"\"Lpm4nc\"\", \"\"idn:boozallen.com\"\", \"\"RVFHk_\"\", \"\"KGmazP\"\", \"\"M_7iBk\"\", \"\"TStw1W\"\", \"\"LFcJLk\"\", \"\"K0TN7r\"\", \"\"KVRURg\"\", \"\"UNe62M\"\", \"\"iL8bPu\"\", \"\"K76BjK\"\", \"\"VRixQe\"\", \"\"idn:dfir.pro\"\", \"\"KF-l77\"\", \"\"idn:gixtools.net\"\", \"\"P_oIyV\"\", \"\"KGzicb\"\", \"\"LGryD9\"\", \"\"idn:fb.me\"\", \"\"K5nCn5\"\", \"\"ThKuX0\"\", \"\"SYrUYn\"\", \"\"KFKbZE\"\", \"\"MAe5tQ\"\", \"\"KGm6gS\"\", \"\"W4ygGi\"\", \"\"g9rk5F\"\", \"\"idn:menshaway.blogspot.com\"\", \"\"KFsPRz\"\", \"\"LDm9iS\"\", \"\"RV8KWp\"\", \"\"KTuH6e\"\", \"\"P_uJi3\"\", \"\"KG_Bgt\"\", \"\"QAmbRP\"\", \"\"idn:csirt.cz\"\", \"\"LZYvHh\"\", \"\"L0HtmN\"\", \"\"KWLqO-\"\", \"\"LtUj1D\"\", \"\"QMTzDr\"\", \"\"idn:dy.si\"\", \"\"Lo8Box\"\", \"\"K-4reD\"\", \"\"KFTeBZ\"\", \"\"KKzFno\"\", \"\"QMTzEI\"\", \"\"KFYLd8\"\", \"\"KGABt4\"\", \"\"LIizBt\"\", \"\"idn:herjavecgroup.com\"\", \"\"QAAZRn\"\", \"\"K66Zgw\"\", \"\"KWz-My\"\", \"\"Lb0b3F\"\", \"\"idn:emsisoft.vn\"\", \"\"LodOTm\"\", \"\"KE9dMF\"\", \"\"O-Wf5x\"\", \"\"LG2dQX\"\", \"\"P_-RZy\"\", \"\"LK7o9D\"\", \"\"K60PUk\"\", \"\"KKUqfz\"\", \"\"idn:logrhythm.com\"\", \"\"Jv_xrR\"\", \"\"LP7dc7\"\", \"\"MFNOaz\"\", \"\"TefIES\"\", \"\"KGdGg3\"\", \"\"KHNdvY\"\", \"\"QBTxvB\"\", \"\"idn:swordshield.com\"\", \"\"ThowaF\"\", \"\"idn:binarydefense.com\"\", \"\"idn:indusface.com\"\", \"\"QBtnC2\"\", \"\"QlWPRW\"\", \"\"KHZhjO\"\", \"\"idn:idcloudhost.com\"\", \"\"LRFVsB\"\", \"\"KG2JTH\"\", \"\"KIm1im\"\", \"\"LAfpKN\"\", \"\"BaV\"\", \"\"KGW3VP\"\", \"\"KFcp5q\"\", \"\"LCN_6T\"\", \"\"idn:avastvn.com\"\", \"\"KFTnbG\"\", \"\"TiCWjw\"\", \"\"Lmhpq3\"\", \"\"KGS-xC\"\", \"\"KFVthB\"\", \"\"idn:finyear.com\"\", \"\"KFji4N\"\", \"\"P_7M19\"\", \"\"K-b0DI\"\", \"\"LV1UMS\"\", \"\"idn:safe-cyberdefense.com\"\", \"\"Kjk3fx\"\", \"\"Q1wlJN\"\"], \"\"Timestamp\"\": \"\"2021-04-09T19:17:06.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Reported by DHS AIS\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017).\"\", \"\"Sources\"\": [\"\"UZNze8\"\"], \"\"Timestamp\"\": \"\"2017-06-27T17:18:01.000Z\"\", \"\"Name\"\": \"\"dhsAis\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis.\"\", \"\"Sources\"\": [\"\"TAIz7D\"\", \"\"TbciDE\"\", \"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2020-12-17T22:59:03.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -998,15 +1014,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b\",\"SHA-256\",\"89\",\"5/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\"\", \"\"Sources\"\": [\"\"Rlso4a\"\", \"\"hkE5DK\"\", \"\"TZRwk8\"\", \"\"J5NRun\"\"], \"\"Timestamp\"\": \"\"2021-12-21T08:40:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\"\", \"\"Sources\"\": [\"\"WlbRkJ\"\", \"\"ha2FFj\"\", \"\"K7wUX2\"\", \"\"P_ivKa\"\", \"\"J-mrOR\"\", \"\"P_upBR\"\"], \"\"Timestamp\"\": \"\"2021-12-25T03:23:47.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\"\", \"\"Sources\"\": [\"\"Y7TWfI\"\"], \"\"Timestamp\"\": \"\"2021-10-18T12:09:43.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\"\", \"\"Sources\"\": [\"\"TGXqeD\"\", \"\"W4ygGi\"\", \"\"L3kVdM\"\", \"\"QMfGAr\"\", \"\"kuKt0c\"\", \"\"QAy9GA\"\", \"\"JOU\"\", \"\"MIKjae\"\", \"\"P_oIyV\"\", \"\"QJ6TQK\"\", \"\"idn:droppdf.com\"\", \"\"Ql9O5c\"\", \"\"QAmbRP\"\", \"\"Tq2nAb\"\", \"\"TbciDE\"\", \"\"idn:index-of.es\"\"], \"\"Timestamp\"\": \"\"2021-11-27T23:07:37.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis.\"\", \"\"Sources\"\": [\"\"TbciDE\"\"], \"\"Timestamp\"\": \"\"2019-07-01T00:00:00.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1133,15 +1153,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a\",\"SHA-256\",\"89\",\"5/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf\"\", \"\"Sources\"\": [\"\"T5\"\"], \"\"Timestamp\"\": \"\"2021-03-11T00:00:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401\"\", \"\"Sources\"\": [\"\"KFwzec\"\", \"\"TGgDPZ\"\", \"\"cgGiXI\"\", \"\"LMcjZ7\"\"], \"\"Timestamp\"\": \"\"2021-06-17T23:29:31.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\"\", \"\"Sources\"\": [\"\"TGgDPZ\"\", \"\"UBjcy3\"\"], \"\"Timestamp\"\": \"\"2020-04-20T21:22:47.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\"\", \"\"Sources\"\": [\"\"idn:lumen.com\"\", \"\"POs2u-\"\", \"\"U13S_U\"\", \"\"Jzl3yj\"\", \"\"idn:centurylink.com\"\", \"\"doLlw5\"\", \"\"POs2t2\"\", \"\"idn:cyberswachhtakendra.gov.in\"\", \"\"idn:hackxsecurity.com\"\", \"\"TGgDPZ\"\", \"\"Jv_xrR\"\", \"\"TSFWTv\"\", \"\"LMcjZ7\"\", \"\"UBjcy3\"\", \"\"TbciDE\"\"], \"\"Timestamp\"\": \"\"2020-04-20T21:22:47.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis.\"\", \"\"Sources\"\": [\"\"TAIz7D\"\", \"\"TbciDE\"\", \"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2021-04-04T07:46:20.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1264,15 +1288,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e\",\"SHA-256\",\"89\",\"6/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\"\", \"\"Sources\"\": [\"\"NSAcUx\"\", \"\"J6UzbO\"\", \"\"Rlso4a\"\", \"\"hkE5DK\"\", \"\"cJMUDF\"\", \"\"TZRwk8\"\", \"\"QMTzEI\"\", \"\"LUhTGd\"\", \"\"J5NRun\"\"], \"\"Timestamp\"\": \"\"2021-12-21T08:40:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\"\", \"\"Sources\"\": [\"\"T1bwMv\"\", \"\"LC-zVm\"\", \"\"P_upBR\"\", \"\"T2OA5Q\"\", \"\"K20lXV\"\", \"\"TGgDPZ\"\", \"\"hkIDTa\"\", \"\"LqRZCN\"\", \"\"Vd51cf\"\", \"\"ha2FFj\"\", \"\"UmsU31\"\", \"\"ddafo3\"\", \"\"K7wUX2\"\", \"\"P_ivKa\"\", \"\"idn:wordpress.com\"\", \"\"J-mrOR\"\", \"\"QPbAan\"\", \"\"VeioBt\"\", \"\"WlbRkJ\"\", \"\"TvfQzk\"\", \"\"TP1vbk\"\", \"\"SrKvJ0\"\", \"\"SqCj4s\"\", \"\"VXaDYo\"\"], \"\"Timestamp\"\": \"\"2021-12-25T03:23:47.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Vulnerability\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362.\"\", \"\"Sources\"\": [\"\"Y7TWfI\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:27:12.565Z\"\", \"\"Name\"\": \"\"linkedToVuln\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\"\", \"\"Sources\"\": [\"\"Ym7dzt\"\", \"\"LKKAV1\"\", \"\"OuKV3V\"\", \"\"VeioBt\"\", \"\"Y7TWfI\"\", \"\"KGS-xC\"\", \"\"KFSXln\"\"], \"\"Timestamp\"\": \"\"2019-05-28T14:17:41.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se você jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. Tô rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\"\", \"\"Sources\"\": [\"\"QWOrKl\"\", \"\"LKKAV1\"\", \"\"W4ygGi\"\", \"\"PATKM7\"\", \"\"T1bwMv\"\", \"\"LjkJhE\"\", \"\"kuKt0c\"\", \"\"QAy9GA\"\", \"\"LbYmLr\"\", \"\"K20lXV\"\", \"\"QZe7TG\"\", \"\"idn:droppdf.com\"\", \"\"QAmbRP\"\", \"\"TbciDE\"\", \"\"P_j5Dw\"\", \"\"QNmgPm\"\", \"\"TGXqeD\"\", \"\"POs2u-\"\", \"\"KGS-xC\"\", \"\"L3kVdM\"\", \"\"QMfGAr\"\", \"\"h6VVAH\"\", \"\"doLlw5\"\", \"\"UrsUKT\"\", \"\"JOU\"\", \"\"MIKjae\"\", \"\"P_oIyV\"\", \"\"QJ6TQK\"\", \"\"RfVd0T\"\", \"\"J6UzbO\"\", \"\"POs2tz\"\", \"\"VfsacJ\"\", \"\"Jv_xrR\"\", \"\"Ql9O5c\"\", \"\"USKpXp\"\", \"\"TP1vbk\"\", \"\"SrKvJ0\"\", \"\"Tq2nAb\"\", \"\"KFSXln\"\", \"\"P_ov9o\"\", \"\"VXaDYo\"\", \"\"idn:index-of.es\"\"], \"\"Timestamp\"\": \"\"2021-11-27T23:07:37.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis.\"\", \"\"Sources\"\": [\"\"TbciDE\"\", \"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2021-02-10T09:10:10.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1475,15 +1503,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b\",\"SHA-256\",\"89\",\"3/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf\"\", \"\"Sources\"\": [\"\"Z2mQh2\"\", \"\"2d\"\", \"\"rN\"\", \"\"PA-rR4\"\", \"\"4n\"\"], \"\"Timestamp\"\": \"\"2018-06-28T08:11:36.570Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/\"\", \"\"Sources\"\": [\"\"idn:lnkd.in\"\", \"\"W4ygGi\"\", \"\"S2tpaX\"\", \"\"idn:voicebox.pt\"\", \"\"SIjHV9\"\", \"\"PJHGaq\"\", \"\"PA-rR4\"\", \"\"Z2mQh2\"\", \"\"e_\"\", \"\"idn:gofastbuy.com\"\", \"\"idn:ziftsolutions.com\"\", \"\"POs2u-\"\", \"\"KHpcuE\"\", \"\"QccsRc\"\", \"\"idn:dfir.pro\"\", \"\"idn:nksc.lt\"\", \"\"idn:dy.si\"\", \"\"KZFCph\"\", \"\"rN\"\", \"\"QYsx0D\"\", \"\"idn:logrhythm.com\"\", \"\"Jv_xrR\"\", \"\"idn:safe-cyberdefense.com\"\", \"\"4n\"\", \"\"QS89Bx\"\", \"\"NKaUXl\"\"], \"\"Timestamp\"\": \"\"2017-09-13T00:00:00.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Recorded Future Malware Detonation.\"\", \"\"Sources\"\": [\"\"TAIz7D\"\"], \"\"Timestamp\"\": \"\"2020-10-13T10:46:31.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1588,15 +1620,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce\",\"SHA-256\",\"89\",\"5/14\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\"\", \"\"Sources\"\": [\"\"Rlso4a\"\", \"\"hkE5DK\"\", \"\"TZRwk8\"\", \"\"J5NRun\"\"], \"\"Timestamp\"\": \"\"2021-12-21T08:40:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Linked to Attack Vector\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\"\", \"\"Sources\"\": [\"\"WlbRkJ\"\", \"\"ha2FFj\"\", \"\"K7wUX2\"\", \"\"P_ivKa\"\", \"\"J-mrOR\"\", \"\"P_upBR\"\"], \"\"Timestamp\"\": \"\"2021-12-25T03:23:47.000Z\"\", \"\"Name\"\": \"\"linkedToVector\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\"\", \"\"Sources\"\": [\"\"Y7TWfI\"\"], \"\"Timestamp\"\": \"\"2021-10-18T12:09:43.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Linked to Malware\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \\\"\".mogera\\\"\" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825\"\", \"\"Sources\"\": [\"\"TGXqeD\"\", \"\"W4ygGi\"\", \"\"L3kVdM\"\", \"\"QMfGAr\"\", \"\"QAy9GA\"\", \"\"JOU\"\", \"\"MIKjae\"\", \"\"P_oIyV\"\", \"\"QJ6TQK\"\", \"\"idn:droppdf.com\"\", \"\"Ql9O5c\"\", \"\"QAmbRP\"\", \"\"Tq2nAb\"\", \"\"idn:index-of.es\"\"], \"\"Timestamp\"\": \"\"2019-05-27T21:06:17.000Z\"\", \"\"Name\"\": \"\"linkedToMalware\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce\"\", \"\"Sources\"\": [\"\"doLlw5\"\"], \"\"Timestamp\"\": \"\"2021-03-08T13:00:15.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ diff --git a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-httpjson.log-expected.json b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-httpjson.log-expected.json index 9c003f08816..21c17292a2a 100644 --- a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-httpjson.log-expected.json +++ b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-httpjson.log-expected.json @@ -2,15 +2,19 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"21 sightings on 4 sources: Proofpoint, PasteBin, The Daily Advance, @DGAFeedAlerts. Most recent tweet: New ramnit Dom: xohrikvjhiu[.]eu IP: 13[.]90[.]196[.]81 NS: https://t.co/nTqEOuAW2E https://t.co/QdrtFSplyz. Most recent link (Nov 16, 2019): https://twitter.com/DGAFeedAlerts/statuses/1195824847915491329\\\", \\\"Sources\\\": [\\\"QQA438\\\", \\\"Jv_xrR\\\", \\\"SlNfa3\\\", \\\"KvPSaU\\\"], \\\"Timestamp\\\": \\\"2019-11-16T22:03:55.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"18 sightings on 2 sources: Proofpoint, The Daily Advance. Most recent link (Nov 12, 2018): https://www.proofpoint.com/us/threat-insight/post/sload-and-ramnit-pairing-sustained-campaigns-against-uk-and-italy#.W-nmxyGcuiY.twitter\\\", \\\"Sources\\\": [\\\"QQA438\\\", \\\"KvPSaU\\\"], \\\"Timestamp\\\": \\\"2018-11-12T20:48:08.675Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Referenced by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: Proofpoint Researchers Observe sLoad and Ramnit in Campaigns Against The U.K. and Italy. Most recent link (Oct 23, 2018): https://app.recordedfuture.com/live/sc/4KSWum2M6Lx7\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2018-10-23T00:00:00.000Z\\\", \\\"Name\\\": \\\"relatedNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Mar 23, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-03-23T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:12:02.455Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"xohrikvjhiu.eu\", \"Risk\": \"96\", \"RiskString\": \"5/45\"}", "risk_score": 96.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -108,15 +112,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-216d34d4-67bd-4add-ae6e-4ddec27dcb0e (Jul 25, 2019).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2019-07-25T00:46:19.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\\\", \\\"Sources\\\": [\\\"ST7rfx\\\"], \\\"Timestamp\\\": \\\"2017-05-17T19:31:06.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 19, 2021, and Jul 21, 2021.\\\", \\\"Sources\\\": [\\\"report:Tluf00\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:21:52.311Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 9, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-07-09T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-07-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:21:52.303Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"wgwuhauaqcrx.com\", \"Risk\": \"95\", \"RiskString\": \"6/45\"}", "risk_score": 95.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -221,15 +229,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: wbmpvebw[.]com IP: 209[.]99[.]40[.]220 NS: https://t.co/bH4I7LoMNf https://t.co/KTCPYU87bT. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551578264821760\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2020-01-04T20:03:37.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Feb 18, 2021, and Feb 24, 2021.\\\", \\\"Sources\\\": [\\\"report:Tluf00\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:16:05.008Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-06-30T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-05-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:16:05.007Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"wbmpvebw.com\", \"Risk\": \"95\", \"RiskString\": \"6/45\"}", "risk_score": 95.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -334,15 +346,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: ckgryagcibbcf[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333576053207040\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2021-02-01T20:08:18.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-06-15T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2016-04-11T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:40:44.358Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"ckgryagcibbcf.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -434,15 +450,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jpuityvakjgg[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/nKWfZguQSF https://t.co/czXUwYeuxf. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333600627683330\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2021-02-01T20:08:24.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 17, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-06-17T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/NzhlZjJmMDA1MTMyNGM5NDg3YTQwMzI5YzAzMzY1NTg/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-05-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:46:28.155Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"jpuityvakjgg.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -534,15 +554,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: jexgpprgph[.]com IP: 209[.]99[.]40[.]222 NS: https://t.co/IGcQwMvzjy https://t.co/J2gdsVMl8U. Most recent link (Dec 13, 2018): https://twitter.com/DGAFeedAlerts/statuses/1073277207919947778\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2018-12-13T18:03:21.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 30, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-06-30T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-05-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:40:30.778Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"jexgpprgph.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -634,15 +658,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: cascotqhij[.]com IP: 18[.]235[.]92[.]123 NS: https://t.co/czXUwYeuxf https://t.co/nKWfZguQSF. Most recent link (Feb 1, 2021): https://twitter.com/DGAFeedAlerts/statuses/1356333566758682629\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2021-02-01T20:08:16.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jul 27, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-07-27T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Malwr.com. Most recent link (Apr 11, 2016): https://malwr.com/analysis/YjVjNzlmNjdhMDMyNDY2MjkzY2FkMjQzOWJiNmUyOWI/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2016-04-11T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:34:06.062Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"cascotqhij.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -734,15 +762,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-e26bfe3a-8f67-4f57-9449-3f183fe94c07 (Jul 25, 2019).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2019-07-25T01:51:04.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: MALWARE BREAKDOWN. Most recent link (May 17, 2017): https://malwarebreakdown.com/2017/05/17/seamless-malvertising-campaign-leads-to-rig-ek-at-185-154-53-33-and-drops-ramnit/\\\", \\\"Sources\\\": [\\\"ST7rfx\\\"], \\\"Timestamp\\\": \\\"2017-05-17T19:31:06.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Apr 1, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-04-01T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZmMxNWJlYWU1NTI4NDA1Nzg3YTc5MWViNTA0YTNhYmQ/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-07-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:45:21.381Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"npcvnorvyhelagx.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -834,15 +866,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: uxlyihgvfnqcrfcf[.]com IP: 209[.]99[.]40[.]224 NS: https://t.co/03Dbt4N72t https://t.co/l29AcRDSvE. Most recent link (Jan 4, 2020): https://twitter.com/DGAFeedAlerts/statuses/1213551575332982790\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2020-01-04T20:03:36.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Dynamoos Blog. Most recent link (Mar 8, 2017): http://blog.dynamoo.com/2013/05/something-evil-on-xxx-xx-xxxx.html\\\", \\\"Sources\\\": [\\\"KVQ2PB\\\"], \\\"Timestamp\\\": \\\"2017-03-08T01:18:17.569Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-05-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Malwr.com. Most recent link (May 8, 2017): https://malwr.com/analysis/MDcwMzAxMzhkZGIwNGI5Y2I0ZGMyMDY1NzhlZmUzNGI/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-05-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:35:26.677Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"uxlyihgvfnqcrfcf.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -934,15 +970,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-fd72a0d2-bcbd-43b4-910b-9898e979a562 (Jul 24, 2019).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2019-07-24T23:40:35.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @DGAFeedAlerts. Most recent tweet: New ramnit Dom: bjfwfqviu[.]com IP: 23[.]96[.]57[.]36 NS: https://t.co/nTqEOuAW2E https://t.co/NnqzXB3b3P. Most recent link (Jul 3, 2019): https://twitter.com/DGAFeedAlerts/statuses/1146524855602429953\\\", \\\"Sources\\\": [\\\"SlNfa3\\\"], \\\"Timestamp\\\": \\\"2019-07-03T21:03:21.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Operation\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 6, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-05-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Malware Analysis DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"3 sightings on 1 source: Malwr.com. Most recent link (Jul 6, 2017): https://malwr.com/analysis/ZDQ0ODcwOTZiN2FmNDExNmExYzA3YjUwOTcxYmRlMjE/\\\", \\\"Sources\\\": [\\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-07-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareAnalysis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C DNS Name\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bambenek Consulting C\u0026C Blocklist.\\\", \\\"Sources\\\": [\\\"report:QhR8Qs\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:48:58.905Z\\\", \\\"Name\\\": \\\"recentCncSite\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"bjfwfqviu.com\", \"Risk\": \"94\", \"RiskString\": \"5/45\"}", "risk_score": 94.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1034,15 +1074,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"50 sightings on 10 sources including: Security Bloggers Network, TechTarget Search Security, Bleeping Computer, Guided Collection, Bleepingcomputer Forums. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\\\", \\\"Sources\\\": [\\\"NSAcUx\\\", \\\"KCdHcb\\\", \\\"J6UzbO\\\", \\\"Rlso4a\\\", \\\"hkE5DK\\\", \\\"cJMUDF\\\", \\\"TZRwk8\\\", \\\"QMTzEI\\\", \\\"LUhTGd\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-12-21T08:40:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"32 sightings on 27 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @neonprimetime, @rpsanch. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\\\", \\\"Sources\\\": [\\\"T1bwMv\\\", \\\"LC-zVm\\\", \\\"QFvaUy\\\", \\\"P_upBR\\\", \\\"T2OA5Q\\\", \\\"K20lXV\\\", \\\"TGgDPZ\\\", \\\"hkIDTa\\\", \\\"LqRZCN\\\", \\\"Vd51cf\\\", \\\"ha2FFj\\\", \\\"UmsU31\\\", \\\"K7wUX2\\\", \\\"P_ivKa\\\", \\\"Qj3TQr\\\", \\\"idn:wordpress.com\\\", \\\"J-mrOR\\\", \\\"QPbAan\\\", \\\"VeioBt\\\", \\\"WlbRkJ\\\", \\\"K7sErA\\\", \\\"TvfQzk\\\", \\\"TP1vbk\\\", \\\"SrKvJ0\\\", \\\"SqCj4s\\\", \\\"VXaDYo\\\", \\\"bk2VX4\\\"], \\\"Timestamp\\\": \\\"2021-12-25T03:23:47.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"6 sightings on 6 sources including: Messaging Platforms - Uncategorized, @_mr_touch. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\\\", \\\"Sources\\\": [\\\"XV7DoD\\\", \\\"Ym7dzt\\\", \\\"LKKAV1\\\", \\\"VeioBt\\\", \\\"Y7TWfI\\\", \\\"KGS-xC\\\"], \\\"Timestamp\\\": \\\"2019-05-28T14:17:41.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"119 sightings on 42 sources including: Malware-Traffic-Analysis.net - Blog Entries, Doc Player, GhostBin, Data Breach Today.eu | Updates, Codex - Recent changes en. 43 related malware families including Dardesh, AZORult, Emotet, Ryuk Ransomware, GandCrab. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\\\", \\\"Sources\\\": [\\\"TvGJYk\\\", \\\"LErKlJ\\\", \\\"QWOrKl\\\", \\\"LKKAV1\\\", \\\"W4ygGi\\\", \\\"PATKM7\\\", \\\"T1bwMv\\\", \\\"TY6igj\\\", \\\"LjkJhE\\\", \\\"kuKt0c\\\", \\\"QAy9GA\\\", \\\"LbYmLr\\\", \\\"K20lXV\\\", \\\"QZe7TG\\\", \\\"idn:droppdf.com\\\", \\\"QAmbRP\\\", \\\"V_o1DL\\\", \\\"TbciDE\\\", \\\"XV7DoD\\\", \\\"P_j5Dw\\\", \\\"QNmgPm\\\", \\\"TGXqeD\\\", \\\"KGS-xC\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"h6VVAH\\\", \\\"doLlw5\\\", \\\"UrsUKT\\\", \\\"JOU\\\", \\\"MIKjae\\\", \\\"P_oIyV\\\", \\\"QJ6TQK\\\", \\\"RfVd0T\\\", \\\"J6UzbO\\\", \\\"Ql9O5c\\\", \\\"USKpXp\\\", \\\"TP1vbk\\\", \\\"SrKvJ0\\\", \\\"Tq2nAb\\\", \\\"P_ov9o\\\", \\\"VXaDYo\\\", \\\"idn:index-of.es\\\"], \\\"Timestamp\\\": \\\"2021-11-27T23:07:37.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-12195723-7c56-4c63-b828-fc340dd4050a (Dec 20, 2018).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2018-12-20T21:13:36.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"5 sightings on 3 sources: Malware-Traffic-Analysis.net - Blog Entries, ReversingLabs, PolySwarm. Most recent link (Dec 15, 2018): https://www.malware-traffic-analysis.net/2018/12/14/index.html\\\", \\\"Sources\\\": [\\\"LErKlJ\\\", \\\"TbciDE\\\", \\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2020-07-11T09:55:23.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"38e992eb852ab0c4ac03955fb0dc9bb38e64010fdf9c05331d2b02b6e05689c2\", \"Risk\": \"89\", \"RiskString\": \"6/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1249,15 +1293,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"28 sightings on 8 sources including: Dancho Danchev's Blog, SecureWorks, Talos Intel, Unit 42 Palo Alto Networks, Cisco Japan Blog. Most recent link (Mar 12, 2021): https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group?es_p=13420131\\\", \\\"Sources\\\": [\\\"JfqIbv\\\", \\\"Z2mQh2\\\", \\\"PA-rR4\\\", \\\"jjf3_B\\\", \\\"clDYM8\\\", \\\"T5\\\", \\\"rN\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-03-12T20:30:37.672Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"69 sightings on 18 sources including: Stock market news Company News MarketScreenercom, HackDig Posts, Sesin at, US CERT CISA Alerts, citizensudo.com. 6 related attack vectors including Powershell Attack, Supply Chain Attack, Target Destination Manipulation, Reconnaissance, C\u0026C Server. Most recent link (Apr 15, 2021): https://www.cisa.gov/uscert/ncas/alerts/aa20-352a\\\", \\\"Sources\\\": [\\\"XBl0xf\\\", \\\"POs2u-\\\", \\\"Z3TZAQ\\\", \\\"hhY_oz\\\", \\\"idn:citizensudo.com\\\", \\\"VKz42X\\\", \\\"PA-rR4\\\", \\\"POs2tz\\\", \\\"idn:firsthackersnews.com\\\", \\\"KcjdRW\\\", \\\"dCotni\\\", \\\"idn:comodo.com\\\", \\\"gI8s5W\\\", \\\"hibUwt\\\", \\\"rN\\\", \\\"idn:reportcybercrime.com\\\", \\\"idn:eshielder.com\\\", \\\"idn:edsitrend.com\\\"], \\\"Timestamp\\\": \\\"2021-04-15T00:00:00.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Vulnerability\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"11 sightings on 2 sources: GitHub, Insikt Group. 5 related cyber vulnerabilities: CWE-20, CWE-287, CVE-2020-10148, CVE-2020-1938, CWE-269. Most recent link (Dec 27, 2021): https://github.com/teamt5-it/official-website-v2/blob/master/_site/_next/data/64e2c6f134e73517d6ff737822e83cd75cf633c6/tw/posts/ithome-ghostcat-apache-tomcat-ajp-vulnerability.json\\\", \\\"Sources\\\": [\\\"MIKjae\\\", \\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-12-27T07:36:54.000Z\\\", \\\"Name\\\": \\\"linkedToVuln\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"175 sightings on 31 sources including: 4-traders.com, SentinelLabs, Sesin at, Cisco Japan Blog, McAfee. 8 related malware families including WebShell, Ransomware, Backdoor, Backdoor Shell, SUNBURST. Most recent tweet: Malcode highlighted in 'App_Web_logoimagehandler.ashx.b6031896.dll' (c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71) #SolarWinds #SUNBURST https://t.co/lyvnVHuTb2. Most recent link (Dec 16, 2020): https://twitter.com/_mynameisgeff/statuses/1339070792705830913\\\", \\\"Sources\\\": [\\\"TuWseX\\\", \\\"KBTQ2e\\\", \\\"eP3CYX\\\", \\\"Z3TZAQ\\\", \\\"clDYM8\\\", \\\"rN\\\", \\\"VKz42X\\\", \\\"idn:elemendar.com\\\", \\\"idn:securitysummitperu.com\\\", \\\"PA-rR4\\\", \\\"idn:terabitweb.com\\\", \\\"eTNyK6\\\", \\\"gBQB48\\\", \\\"bMZlEg\\\", \\\"idn:edsitrend.com\\\", \\\"idn:infoblox.com\\\", \\\"UZNze8\\\", \\\"Z2mQh2\\\", \\\"XBl0xf\\\", \\\"dCpZqs\\\", \\\"jmpFm1\\\", \\\"T5\\\", \\\"doLlw5\\\", \\\"gBDK5G\\\", \\\"MIKjae\\\", \\\"idn:firsthackersnews.com\\\", \\\"jjf3_B\\\", \\\"Jv_xrR\\\", \\\"dCotni\\\", \\\"idn:comodo.com\\\", \\\"hibUwt\\\"], \\\"Timestamp\\\": \\\"2020-12-16T04:52:10.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"3 sightings on 1 source: DHS Automated Indicator Sharing. 3 reports including AA20-352A APT Compromise of Govt Agencies, Critical Infrastructure, and Private Sector Organizations, from CISA, Government Facilities Sector, CISA, Government Facilities Sector, NCCIC:STIX_Package-673aacd1-1852-4d44-bd93-0c44940a6358 (Feb 3, 2021).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2021-02-03T21:32:08.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"6 sightings on 2 sources: Sophos Virus and Spyware Threats, PolySwarm. Most recent link (Dec 17, 2020): https://news.sophos.com/fr-fr/2020/12/15/cyberattaque-contre-solarwinds-comment-savoir-si-vous-etes-concerne/\\\", \\\"Sources\\\": [\\\"K16tAG\\\", \\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2020-12-20T15:18:53.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"13 sightings on 1 source: Insikt Group. 4 reports including Researchers Linked Supernova Malware to Spiral Group. Most recent link (Mar 08, 2021): https://app.recordedfuture.com/live/sc/5DIp4RIUiJz6\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-03-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"analystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71\", \"Risk\": \"89\", \"RiskString\": \"7/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1444,15 +1492,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"MD5\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"10 sightings on 7 sources including: ISC Sans Diary Archive, SecureWorks, InfoCON: green, ISC | Latest Headlines, SANS Internet Storm Center. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\\\", \\\"Sources\\\": [\\\"TCw6v6\\\", \\\"Z2mQh2\\\", \\\"2d\\\", \\\"cJuZvt\\\", \\\"JYxY8X\\\", \\\"J2_htN\\\", \\\"jXNbON\\\"], \\\"Timestamp\\\": \\\"2021-12-20T04:54:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"6 sightings on 5 sources: GitHub, SANS Internet Storm Center, Messaging Platforms - Uncategorized, @decalage2, @simonwargniez. 3 related attack vectors: Remote Code Execution, Zero Day Exploit, Cyberattack. Most recent tweet: Great lists of software affected by #Log4Shell / CVE-2021-44228 / Log4J RCE: https://t.co/TpEQXKgMGW by @ncsc_nl https://t.co/FA5i8zR5Z1 by @CISAgov https://t.co/0xVZJvMcpU by @SwitHak https://t.co/788knvztWV https://t.co/WMkXslhgWS #log4j #log4j2. Most recent link (Dec 15, 2021): https://twitter.com/decalage2/statuses/1471121875816353800\\\", \\\"Sources\\\": [\\\"LUf99I\\\", \\\"MIKjae\\\", \\\"JYxY8X\\\", \\\"Y7TWfI\\\", \\\"KIRe_w\\\"], \\\"Timestamp\\\": \\\"2021-12-15T14:16:01.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Vulnerability\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"108 sightings on 78 sources including: bund.de, tistory.com, PasteBin, Sesin at, Messaging Platforms - Uncategorized. 24 related cyber vulnerabilities including CWE-22, CWE-611, CVE-2019-19781, CVE-2020-16898, CWE-20. Most recent tweet: Security advisories, bulletins, and vendor responses related to Log4Shell #Log4Shell #Log4j #cybersecurity #infosec #vendorsecurity https://t.co/Vpwrhdppm7. Most recent link (Dec 22, 2021): https://twitter.com/arrgibbs/statuses/1473733864459841538\\\", \\\"Sources\\\": [\\\"VQpQDR\\\", \\\"KFu3Rc\\\", \\\"LUf99I\\\", \\\"SGCsBG\\\", \\\"U94lUG\\\", \\\"KFcv42\\\", \\\"QT0CFv\\\", \\\"UHvtcg\\\", \\\"KFUbjU\\\", \\\"KHwUI5\\\", \\\"KKSt8d\\\", \\\"idn:bund.de\\\", \\\"VmIbAC\\\", \\\"QGT0Vy\\\", \\\"ejfM20\\\", \\\"KGlTEd\\\", \\\"QCoXJo\\\", \\\"RXSwU8\\\", \\\"idn:tistory.com\\\", \\\"LpdVul\\\", \\\"K-eKsL\\\", \\\"TKYCSz\\\", \\\"SkABVK\\\", \\\"SdGk_x\\\", \\\"LI6d7O\\\", \\\"LQIfBf\\\", \\\"U6B2hC\\\", \\\"f7_CfD\\\", \\\"LKt0HB\\\", \\\"RHS4v8\\\", \\\"KKmN5m\\\", \\\"YfJqp2\\\", \\\"Jv_xrR\\\", \\\"RJ2_NX\\\", \\\"VZXzSv\\\", \\\"k0QC11\\\", \\\"KFWBRs\\\", \\\"LRk_pt\\\", \\\"Qn2VRQ\\\", \\\"kGHFKP\\\", \\\"ShBO5M\\\", \\\"T-GSBp\\\", \\\"KNdyHF\\\", \\\"QLCTXP\\\", \\\"Z3TZAQ\\\", \\\"Khf99v\\\", \\\"KHZhjO\\\", \\\"SHH61D\\\", \\\"Knx_su\\\", \\\"LL8-pr\\\", \\\"QpmWTf\\\", \\\"KIRe_w\\\", \\\"QIea7F\\\", \\\"SlhG3F\\\", \\\"KIdj8R\\\", \\\"SQqKS8\\\", \\\"Lq6DNq\\\", \\\"QpYsBa\\\", \\\"d-ZMP2\\\", \\\"LOoye8\\\", \\\"QEUmiJ\\\", \\\"ewfPjC\\\", \\\"LBNFpV\\\", \\\"QTpbKE\\\", \\\"Y7TWfI\\\", \\\"KGS-xC\\\", \\\"eifkGz\\\", \\\"au2SGr\\\", \\\"SKw4tT\\\", \\\"KGW5kn\\\", \\\"Q9y5Ki\\\", \\\"KGxw1d\\\", \\\"MIKjae\\\", \\\"LO5p1C\\\", \\\"JYxY8X\\\", \\\"KJsMEF\\\", \\\"QBLBHH\\\", \\\"k7WJ2k\\\"], \\\"Timestamp\\\": \\\"2021-12-22T19:15:08.000Z\\\", \\\"Name\\\": \\\"linkedToVuln\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"11 sightings on 3 sources: bund.de, SANS Internet Storm Center, Sesin at. 2 related malware families: Ransomware, Botnet. Most recent link (Dec 20, 2021): https://www.jpcert.or.jp/english/at/2021/at210050.html\\\", \\\"Sources\\\": [\\\"idn:bund.de\\\", \\\"JYxY8X\\\", \\\"Z3TZAQ\\\"], \\\"Timestamp\\\": \\\"2021-12-20T04:54:00.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Naked Security. Most recent link (Dec 18, 2021): https://news.sophos.com/en-us/2021/12/17/log4shell-response-and-mitigation-recommendations/\\\", \\\"Sources\\\": [\\\"J2_htN\\\"], \\\"Timestamp\\\": \\\"2021-12-18T00:20:04.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"b66db3a06c2955a9cb71a8718970c592\", \"Risk\": \"89\", \"RiskString\": \"5/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -1644,15 +1696,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"91 sightings on 19 sources including: Security News Concentrator, Fortinet, Trend Micro, CrowdStrike, FireEye Threat Research Blog. Most recent link (Dec 20, 2019): https://threatvector.cylance.com/en_us/home/threat-spotlight-petya-like-ransomware-is-nasty-wiper.html\\\", \\\"Sources\\\": [\\\"QS89Bd\\\", \\\"KVP0jz\\\", \\\"T5\\\", \\\"JYxY5G\\\", \\\"WR_Ohh\\\", \\\"Jt4ExJ\\\", \\\"Kzw0Pm\\\", \\\"JQH96m\\\", \\\"2d\\\", \\\"JYxY8X\\\", \\\"rN\\\", \\\"PA-rR4\\\", \\\"VyWQM7\\\", \\\"Lp_esG\\\", \\\"ONMgMx\\\", \\\"4n\\\", \\\"QMTzEI\\\", \\\"83\\\", \\\"K0TN7r\\\"], \\\"Timestamp\\\": \\\"2019-12-20T01:04:11.602Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Recorded Future Analyst Community Trending Indicators. Observed between Jul 6, 2017, and Jul 17, 2017.\\\", \\\"Sources\\\": [\\\"report:Tluf00\\\"], \\\"Timestamp\\\": \\\"2021-12-24T20:03:09.087Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"14 sightings on 5 sources including: Assiste.Forum, @arturodicorinto. 2 related attack vectors: ShellCode, Cyberattack. Most recent tweet: They're getting quicker at updating.. #petya #cyberattack https://t.co/px0g9BSpod. Most recent link (Jun 27, 2017): https://twitter.com/SupersizedSam/statuses/879764638845587461\\\", \\\"Sources\\\": [\\\"LP7dc7\\\", \\\"LRlngp\\\", \\\"Sl8XTb\\\", \\\"QMfGAr\\\", \\\"J-y3tn\\\"], \\\"Timestamp\\\": \\\"2017-06-27T18:13:29.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Vulnerability\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: GitHub. 2 related cyber vulnerabilities: CWE-20, CVE-2017-0143. Most recent link (Oct 10, 2021): https://github.com/demisto/content/blob/master/Packs/RecordedFuture/Integrations/RecordedFuture/example_commands.txt\\\", \\\"Sources\\\": [\\\"MIKjae\\\"], \\\"Timestamp\\\": \\\"2021-10-10T08:21:25.825Z\\\", \\\"Name\\\": \\\"linkedToVuln\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"10 sightings on 9 sources including: BitcoinTalk.org, @Noemi_hcke. Most recent tweet: #petya related hashes in #virustotal https://t.co/Cv7Pltjhia https://t.co/P3otYPoxBj #ransomware #malware #sha256. Most recent link (Jun 28, 2017): https://twitter.com/Menardconnect/statuses/879885997831368705\\\", \\\"Sources\\\": [\\\"ThowaF\\\", \\\"KUtKjP\\\", \\\"K84j7t\\\", \\\"MghdWI\\\", \\\"K8rrfe\\\", \\\"QlWPRW\\\", \\\"KFsPRz\\\", \\\"S-Anbb\\\", \\\"KE9dMF\\\"], \\\"Timestamp\\\": \\\"2017-06-28T02:15:44.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"834 sightings on 201 sources including: New Jersey Cybersecurity \u0026amp; Communications Integration Cell, lnkd.in, avtech24h.com, Malwr.com, Talos Intel. 21 related malware families including ICS Malware, PetrWrap, Emotet, Trojan, NotPetya. Most recent tweet: #ransomware 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 f65a7dadff844f2dc44a3bd43e1c0d600b1a6c66f6d02734d8f385872ccab0bc b6e8dc95ec939a1f3b184da559c8010ab3dc773e426e63e5aa7ffc44174d8a9d 9e1609ab7f01b56a9476494d9b3bf5997380d466744b07ec5d9b20e416b10f08. Most recent link (Apr 9, 2021): https://twitter.com/RedBeardIOCs/statuses/1380600677249003521\\\", \\\"Sources\\\": [\\\"jbVMcB\\\", \\\"idn:lnkd.in\\\", \\\"idn:avtech24h.com\\\", \\\"K84j7t\\\", \\\"Sl8XTb\\\", \\\"KGRhOC\\\", \\\"NKaUXl\\\", \\\"KIoGAG\\\", \\\"PA-rR4\\\", \\\"LRlngp\\\", \\\"rN\\\", \\\"Jxh46H\\\", \\\"KFL44X\\\", \\\"TbciDE\\\", \\\"KFNVB9\\\", \\\"OJpx5g\\\", \\\"K-CGye\\\", \\\"KK6oqV\\\", \\\"WR_Ohh\\\", \\\"idn:twitter.com\\\", \\\"fgwEcq\\\", \\\"QYsx0D\\\", \\\"KIFtR_\\\", \\\"Lp_esG\\\", \\\"TSFWTw\\\", \\\"KGHzAY\\\", \\\"P_oEH3\\\", \\\"KBTQ2e\\\", \\\"QCGHCy\\\", \\\"JYxY5G\\\", \\\"UQsrUj\\\", \\\"idn:cert.ro\\\", \\\"idn:bluvector.io\\\", \\\"KFUJTL\\\", \\\"TFUkSW\\\", \\\"P0Gs9I\\\", \\\"K8ofB1\\\", \\\"KVnnHP\\\", \\\"TpaXxw\\\", \\\"U5qdTI\\\", \\\"idn:zscaler.com\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"KIk8aS\\\", \\\"Kzw0Pm\\\", \\\"hcELIE\\\", \\\"POs2tz\\\", \\\"KD6Na4\\\", \\\"idn:globalsecuritymag.com\\\", \\\"LDd0sl\\\", \\\"KVP0jz\\\", \\\"Lj8CsQ\\\", \\\"K8rrfe\\\", \\\"LDejRI\\\", \\\"J-y3tn\\\", \\\"WXutod\\\", \\\"idn:infosecurityfactory.nl\\\", \\\"LBlc7C\\\", \\\"idn:bg.org.tr\\\", \\\"QS89Bd\\\", \\\"K9SiDc\\\", \\\"Qe89bv\\\", \\\"TiY1wu\\\", \\\"idn:undernews.fr\\\", \\\"idn:iteefactory.nl\\\", \\\"KFRGd_\\\", \\\"KFVuR_\\\", \\\"4n\\\", \\\"S-Anbb\\\", \\\"KFNZEC\\\", \\\"TSazOG\\\", \\\"K9Skh1\\\", \\\"MghdWI\\\", \\\"idn:securityiscoming.com\\\", \\\"QS89BG\\\", \\\"LVg9nH\\\", \\\"KFiGli\\\", \\\"K9Vq9B\\\", \\\"KLbNtt\\\", \\\"VyWQM7\\\", \\\"NTakwX\\\", \\\"KGoarP\\\", \\\"idn:gelsene.net\\\", \\\"LwURWv\\\", \\\"KGX8VB\\\", \\\"ThoB0I\\\", \\\"TAIz7D\\\", \\\"QBHQ61\\\", \\\"TiY1w7\\\", \\\"idn:kompasiana.com\\\", \\\"idn:t.co\\\", \\\"KfDTG0\\\", \\\"idn:ictsecuritymagazine.com\\\", \\\"Liz5-u\\\", \\\"MIKjae\\\", \\\"JYxY8X\\\", \\\"KUtKjP\\\", \\\"idn:cert.pl\\\", \\\"Lpm4nc\\\", \\\"idn:boozallen.com\\\", \\\"RVFHk_\\\", \\\"KGmazP\\\", \\\"M_7iBk\\\", \\\"TStw1W\\\", \\\"LFcJLk\\\", \\\"K0TN7r\\\", \\\"KVRURg\\\", \\\"UNe62M\\\", \\\"iL8bPu\\\", \\\"K76BjK\\\", \\\"VRixQe\\\", \\\"idn:dfir.pro\\\", \\\"KF-l77\\\", \\\"idn:gixtools.net\\\", \\\"P_oIyV\\\", \\\"KGzicb\\\", \\\"LGryD9\\\", \\\"idn:fb.me\\\", \\\"K5nCn5\\\", \\\"ThKuX0\\\", \\\"SYrUYn\\\", \\\"KFKbZE\\\", \\\"MAe5tQ\\\", \\\"KGm6gS\\\", \\\"W4ygGi\\\", \\\"g9rk5F\\\", \\\"idn:menshaway.blogspot.com\\\", \\\"KFsPRz\\\", \\\"LDm9iS\\\", \\\"RV8KWp\\\", \\\"KTuH6e\\\", \\\"P_uJi3\\\", \\\"KG_Bgt\\\", \\\"QAmbRP\\\", \\\"idn:csirt.cz\\\", \\\"LZYvHh\\\", \\\"L0HtmN\\\", \\\"KWLqO-\\\", \\\"LtUj1D\\\", \\\"QMTzDr\\\", \\\"idn:dy.si\\\", \\\"Lo8Box\\\", \\\"K-4reD\\\", \\\"KFTeBZ\\\", \\\"KKzFno\\\", \\\"QMTzEI\\\", \\\"KFYLd8\\\", \\\"KGABt4\\\", \\\"LIizBt\\\", \\\"idn:herjavecgroup.com\\\", \\\"QAAZRn\\\", \\\"K66Zgw\\\", \\\"KWz-My\\\", \\\"Lb0b3F\\\", \\\"idn:emsisoft.vn\\\", \\\"LodOTm\\\", \\\"KE9dMF\\\", \\\"O-Wf5x\\\", \\\"LG2dQX\\\", \\\"P_-RZy\\\", \\\"LK7o9D\\\", \\\"K60PUk\\\", \\\"KKUqfz\\\", \\\"idn:logrhythm.com\\\", \\\"Jv_xrR\\\", \\\"LP7dc7\\\", \\\"MFNOaz\\\", \\\"TefIES\\\", \\\"KGdGg3\\\", \\\"KHNdvY\\\", \\\"QBTxvB\\\", \\\"idn:swordshield.com\\\", \\\"ThowaF\\\", \\\"idn:binarydefense.com\\\", \\\"idn:indusface.com\\\", \\\"QBtnC2\\\", \\\"QlWPRW\\\", \\\"KHZhjO\\\", \\\"idn:idcloudhost.com\\\", \\\"LRFVsB\\\", \\\"KG2JTH\\\", \\\"KIm1im\\\", \\\"LAfpKN\\\", \\\"BaV\\\", \\\"KGW3VP\\\", \\\"KFcp5q\\\", \\\"LCN_6T\\\", \\\"idn:avastvn.com\\\", \\\"KFTnbG\\\", \\\"TiCWjw\\\", \\\"Lmhpq3\\\", \\\"KGS-xC\\\", \\\"KFVthB\\\", \\\"idn:finyear.com\\\", \\\"KFji4N\\\", \\\"P_7M19\\\", \\\"K-b0DI\\\", \\\"LV1UMS\\\", \\\"idn:safe-cyberdefense.com\\\", \\\"Kjk3fx\\\", \\\"Q1wlJN\\\"], \\\"Timestamp\\\": \\\"2021-04-09T19:17:06.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Reported by DHS AIS\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DHS Automated Indicator Sharing. 1 report: STIX Package, from Anomali, Inc., Information Technology Sector, NCCIC:STIX_Package-21cebba6-46ed-464e-ad5a-32a8063e1400 (Jun 27, 2017).\\\", \\\"Sources\\\": [\\\"UZNze8\\\"], \\\"Timestamp\\\": \\\"2017-06-27T17:18:01.000Z\\\", \\\"Name\\\": \\\"dhsAis\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Jun 27, 2017): ReversingLabs malware file analysis.\\\", \\\"Sources\\\": [\\\"TAIz7D\\\", \\\"TbciDE\\\", \\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2020-12-17T22:59:03.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745\", \"Risk\": \"89\", \"RiskString\": \"8/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2029,15 +2085,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\\\", \\\"Sources\\\": [\\\"Rlso4a\\\", \\\"hkE5DK\\\", \\\"TZRwk8\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-12-21T08:40:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\\\", \\\"Sources\\\": [\\\"WlbRkJ\\\", \\\"ha2FFj\\\", \\\"K7wUX2\\\", \\\"P_ivKa\\\", \\\"J-mrOR\\\", \\\"P_upBR\\\"], \\\"Timestamp\\\": \\\"2021-12-25T03:23:47.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\\\", \\\"Sources\\\": [\\\"Y7TWfI\\\"], \\\"Timestamp\\\": \\\"2021-10-18T12:09:43.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"47 sightings on 16 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 18 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\\\", \\\"Sources\\\": [\\\"TGXqeD\\\", \\\"W4ygGi\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"kuKt0c\\\", \\\"QAy9GA\\\", \\\"JOU\\\", \\\"MIKjae\\\", \\\"P_oIyV\\\", \\\"QJ6TQK\\\", \\\"idn:droppdf.com\\\", \\\"Ql9O5c\\\", \\\"QAmbRP\\\", \\\"Tq2nAb\\\", \\\"TbciDE\\\", \\\"idn:index-of.es\\\"], \\\"Timestamp\\\": \\\"2021-11-27T23:07:37.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: ReversingLabs. Most recent link (Jul 1, 2019): ReversingLabs malware file analysis.\\\", \\\"Sources\\\": [\\\"TbciDE\\\"], \\\"Timestamp\\\": \\\"2019-07-01T00:00:00.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"ad2ad0249fafe85877bc79a01e1afd1a44d983c064ad8cb5bc694d29d166217b\", \"Risk\": \"89\", \"RiskString\": \"5/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2164,15 +2224,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Trend Micro. Most recent link (Mar 11, 2021): https://documents.trendmicro.com/assets/pdf/Technical_Brief_Uncleanable_and_Unkillable_The_Evolution_of_IoT_Botnets_Through_P2P_Networking.pdf\\\", \\\"Sources\\\": [\\\"T5\\\"], \\\"Timestamp\\\": \\\"2021-03-11T00:00:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"31 sightings on 4 sources: @m0rb, @bad_packets, @InfoSex11, @luc4m. 2 related attack vectors: DDOS, Command Injection. Most recent tweet: 2021-06-17T23:29:30 - Commented: https://t.co/j2a05iXOiI #malware #commandinjection. Most recent link (Jun 17, 2021): https://twitter.com/m0rb/statuses/1405668962462011401\\\", \\\"Sources\\\": [\\\"KFwzec\\\", \\\"TGgDPZ\\\", \\\"cgGiXI\\\", \\\"LMcjZ7\\\"], \\\"Timestamp\\\": \\\"2021-06-17T23:29:31.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"3 sightings on 2 sources: @bad_packets, @swarmdotmarket. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\\\", \\\"Sources\\\": [\\\"TGgDPZ\\\", \\\"UBjcy3\\\"], \\\"Timestamp\\\": \\\"2020-04-20T21:22:47.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"87 sightings on 15 sources including: lumen.com, HackDig Posts, Anquanke News, Daily Dot, centurylink.com. 7 related malware families including Mozi Botnet, Trojan, Qbot, Mirai, DDOS Toolkit. Most recent tweet: New #Mozi #malware targets #IoT devices -- research via @BlackLotusLabs -- Samples here in PolySwarm, free to download: https://t.co/JYkyEPPWmH https://t.co/jioPHPnJj9 #threatintel #botnet #infosec. Most recent link (Apr 20, 2020): https://twitter.com/PolySwarm/statuses/1252347003457073155\\\", \\\"Sources\\\": [\\\"idn:lumen.com\\\", \\\"POs2u-\\\", \\\"U13S_U\\\", \\\"Jzl3yj\\\", \\\"idn:centurylink.com\\\", \\\"doLlw5\\\", \\\"POs2t2\\\", \\\"idn:cyberswachhtakendra.gov.in\\\", \\\"idn:hackxsecurity.com\\\", \\\"TGgDPZ\\\", \\\"Jv_xrR\\\", \\\"TSFWTv\\\", \\\"LMcjZ7\\\", \\\"UBjcy3\\\", \\\"TbciDE\\\"], \\\"Timestamp\\\": \\\"2020-04-20T21:22:47.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"5 sightings on 3 sources: Recorded Future Malware Detonation, ReversingLabs, PolySwarm. Most recent link (Nov 28, 2019): ReversingLabs malware file analysis.\\\", \\\"Sources\\\": [\\\"TAIz7D\\\", \\\"TbciDE\\\", \\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2021-04-04T07:46:20.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"01ba1fb41632594997a41d0c3a911ae5b3034d566ebb991ef76ad76e6f9e283a\", \"Risk\": \"89\", \"RiskString\": \"5/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2295,15 +2359,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"45 sightings on 9 sources including: Security Bloggers Network, Bleeping Computer, Guided Collection, Bleepingcomputer Forums, TheServerSide.com | Updates. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\\\", \\\"Sources\\\": [\\\"NSAcUx\\\", \\\"J6UzbO\\\", \\\"Rlso4a\\\", \\\"hkE5DK\\\", \\\"cJMUDF\\\", \\\"TZRwk8\\\", \\\"QMTzEI\\\", \\\"LUhTGd\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-12-21T08:40:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"29 sightings on 24 sources including: Carder Forum (carder.uk), wordpress.com, AAPKS.com, malwareresearch, @phishingalert, @GelosSnake, @rpsanch, @rce_coder. 7 related attack vectors including Crimeware, Phishing, Remote Code Execution, Malvertising, Click Fraud. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\\\", \\\"Sources\\\": [\\\"T1bwMv\\\", \\\"LC-zVm\\\", \\\"P_upBR\\\", \\\"T2OA5Q\\\", \\\"K20lXV\\\", \\\"TGgDPZ\\\", \\\"hkIDTa\\\", \\\"LqRZCN\\\", \\\"Vd51cf\\\", \\\"ha2FFj\\\", \\\"UmsU31\\\", \\\"ddafo3\\\", \\\"K7wUX2\\\", \\\"P_ivKa\\\", \\\"idn:wordpress.com\\\", \\\"J-mrOR\\\", \\\"QPbAan\\\", \\\"VeioBt\\\", \\\"WlbRkJ\\\", \\\"TvfQzk\\\", \\\"TP1vbk\\\", \\\"SrKvJ0\\\", \\\"SqCj4s\\\", \\\"VXaDYo\\\"], \\\"Timestamp\\\": \\\"2021-12-25T03:23:47.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Vulnerability\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Messaging Platforms - Uncategorized. 2 related cyber vulnerabilities: CVE-2016-6663, CWE-362.\\\", \\\"Sources\\\": [\\\"Y7TWfI\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:27:12.565Z\\\", \\\"Name\\\": \\\"linkedToVuln\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"10 sightings on 7 sources including: SANS Institute Course Selector Results, Messaging Platforms - Uncategorized, @ecstatic_nobel, @Artilllerie. Most recent tweet: Active cred #phishing/malware distribution campaign on 185.186.245.101 with kits targeting @Office365 and @WeTransfer brands. Windows malware submitted to VT here: https://t.co/edCd4sOnAI domains: https://t.co/4GdqctLwkY cc: @malwrhunterteam @JayTHL @SteveD3 @thepacketrat https://t.co/e9d3R7fzIq. Most recent link (May 28, 2019): https://twitter.com/PhishingAi/statuses/1133376801831436289\\\", \\\"Sources\\\": [\\\"Ym7dzt\\\", \\\"LKKAV1\\\", \\\"OuKV3V\\\", \\\"VeioBt\\\", \\\"Y7TWfI\\\", \\\"KGS-xC\\\", \\\"KFSXln\\\"], \\\"Timestamp\\\": \\\"2019-05-28T14:17:41.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"114 sightings on 42 sources including: Doc Player, GhostBin, Codex - Recent changes en, droppdf.com, ReversingLabs. 41 related malware families including Dardesh, AZORult, Emotet, GandCrab, Offensive Security Tools (OST). Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\\\", \\\"Sources\\\": [\\\"QWOrKl\\\", \\\"LKKAV1\\\", \\\"W4ygGi\\\", \\\"PATKM7\\\", \\\"T1bwMv\\\", \\\"LjkJhE\\\", \\\"kuKt0c\\\", \\\"QAy9GA\\\", \\\"LbYmLr\\\", \\\"K20lXV\\\", \\\"QZe7TG\\\", \\\"idn:droppdf.com\\\", \\\"QAmbRP\\\", \\\"TbciDE\\\", \\\"P_j5Dw\\\", \\\"QNmgPm\\\", \\\"TGXqeD\\\", \\\"POs2u-\\\", \\\"KGS-xC\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"h6VVAH\\\", \\\"doLlw5\\\", \\\"UrsUKT\\\", \\\"JOU\\\", \\\"MIKjae\\\", \\\"P_oIyV\\\", \\\"QJ6TQK\\\", \\\"RfVd0T\\\", \\\"J6UzbO\\\", \\\"POs2tz\\\", \\\"VfsacJ\\\", \\\"Jv_xrR\\\", \\\"Ql9O5c\\\", \\\"USKpXp\\\", \\\"TP1vbk\\\", \\\"SrKvJ0\\\", \\\"Tq2nAb\\\", \\\"KFSXln\\\", \\\"P_ov9o\\\", \\\"VXaDYo\\\", \\\"idn:index-of.es\\\"], \\\"Timestamp\\\": \\\"2021-11-27T23:07:37.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: ReversingLabs, PolySwarm. Most recent link (Apr 19, 2018): ReversingLabs malware file analysis.\\\", \\\"Sources\\\": [\\\"TbciDE\\\", \\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2021-02-10T09:10:10.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"fecddb7f3fa478be4687ca542c0ecf232ec35a0c2418c8bfe4875686ec373c1e\", \"Risk\": \"89\", \"RiskString\": \"6/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2506,15 +2574,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"58 sightings on 5 sources: SecureWorks, InfoCON: green, McAfee, Talos Intel, Kaspersky Securelist and Lab. Most recent link (Jun 28, 2018): https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/27000/PD27077/en_US/McAfee_Labs_WannaCry_June24_2018.pdf\\\", \\\"Sources\\\": [\\\"Z2mQh2\\\", \\\"2d\\\", \\\"rN\\\", \\\"PA-rR4\\\", \\\"4n\\\"], \\\"Timestamp\\\": \\\"2018-06-28T08:11:36.570Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1688 sightings on 26 sources including: lnkd.in, Doc Player, Cyber4Sight, voicebox.pt, VKontakte. 2 related malware families: Wcry, Ransomware. Most recent link (Sep 13, 2017): https://malwr.com/analysis/ZmIzN2E3MzQyM2I0NDYwODllOWRhMmQxODg3YzMxZDA/\\\", \\\"Sources\\\": [\\\"idn:lnkd.in\\\", \\\"W4ygGi\\\", \\\"S2tpaX\\\", \\\"idn:voicebox.pt\\\", \\\"SIjHV9\\\", \\\"PJHGaq\\\", \\\"PA-rR4\\\", \\\"Z2mQh2\\\", \\\"e_\\\", \\\"idn:gofastbuy.com\\\", \\\"idn:ziftsolutions.com\\\", \\\"POs2u-\\\", \\\"KHpcuE\\\", \\\"QccsRc\\\", \\\"idn:dfir.pro\\\", \\\"idn:nksc.lt\\\", \\\"idn:dy.si\\\", \\\"KZFCph\\\", \\\"rN\\\", \\\"QYsx0D\\\", \\\"idn:logrhythm.com\\\", \\\"Jv_xrR\\\", \\\"idn:safe-cyberdefense.com\\\", \\\"4n\\\", \\\"QS89Bx\\\", \\\"NKaUXl\\\"], \\\"Timestamp\\\": \\\"2017-09-13T00:00:00.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Recorded Future Malware Detonation.\\\", \\\"Sources\\\": [\\\"TAIz7D\\\"], \\\"Timestamp\\\": \\\"2020-10-13T10:46:31.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b\", \"Risk\": \"89\", \"RiskString\": \"3/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2619,15 +2691,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\\\", \\\"Sources\\\": [\\\"Rlso4a\\\", \\\"hkE5DK\\\", \\\"TZRwk8\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-12-21T08:40:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"6 sightings on 6 sources including: malwareresearch, AAPKS.com, @Shouvik95232310, @santGM. 3 related attack vectors: Phishing, Click Fraud, Typosquatting. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\\\", \\\"Sources\\\": [\\\"WlbRkJ\\\", \\\"ha2FFj\\\", \\\"K7wUX2\\\", \\\"P_ivKa\\\", \\\"J-mrOR\\\", \\\"P_upBR\\\"], \\\"Timestamp\\\": \\\"2021-12-25T03:23:47.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\\\", \\\"Sources\\\": [\\\"Y7TWfI\\\"], \\\"Timestamp\\\": \\\"2021-10-18T12:09:43.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"43 sightings on 14 sources including: Ichunqiu Forum, Doc Player, ArXiv, GitHub, droppdf.com. 19 related malware families including Fakespy, Trojan, Offensive Security Tools (OST), Spyware, Dardesh. Most recent tweet: RT @demonslay335: #STOP #Djvu #Ransomware extension \\\\\\\".mogera\\\\\\\" (v090): https://t.co/wlMcSE2EHj | https://t.co/XAYkOoOReU. Most recent link (May 27, 2019): https://twitter.com/DrolSecurity/statuses/1133117241388621825\\\", \\\"Sources\\\": [\\\"TGXqeD\\\", \\\"W4ygGi\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"QAy9GA\\\", \\\"JOU\\\", \\\"MIKjae\\\", \\\"P_oIyV\\\", \\\"QJ6TQK\\\", \\\"idn:droppdf.com\\\", \\\"Ql9O5c\\\", \\\"QAmbRP\\\", \\\"Tq2nAb\\\", \\\"idn:index-of.es\\\"], \\\"Timestamp\\\": \\\"2019-05-27T21:06:17.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: PolySwarm. Most recent link (Mar 8, 2021): https://polyswarm.network/scan/results/file/85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce\\\", \\\"Sources\\\": [\\\"doLlw5\\\"], \\\"Timestamp\\\": \\\"2021-03-08T13:00:15.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"85aba198a0ba204e8549ea0c8980447249d30dece0d430e3f517315ad10f32ce\", \"Risk\": \"89\", \"RiskString\": \"5/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2752,15 +2828,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"Algorithm\": \"SHA-256\", \"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"16 sightings on 4 sources: Guided Collection, Bleepingcomputer Forums, ISC | All Updates, Malwarebytes Unpacked. Most recent link (Dec 21, 2021): https://www.bleepingcomputer.com/forums/t/765398/gmer-scan-reveals-chinese-letter-characters/#entry5298561\\\", \\\"Sources\\\": [\\\"Rlso4a\\\", \\\"hkE5DK\\\", \\\"TZRwk8\\\", \\\"J5NRun\\\"], \\\"Timestamp\\\": \\\"2021-12-21T08:40:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Linked to Attack Vector\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"7 sightings on 7 sources including: malwareresearch, Malwr.com, AAPKS.com, @Shouvik95232310, @santGM, @aa419. 4 related attack vectors: Phishing, Click Fraud, Typosquatting, Keylogger. Most recent tweet: Many People sending me this type of link and it's a phishing link @stufflistings @trolling_isart @yabhishekhd Thanks @virustotal for checking. Website where I Checked it https://t.co/q0pzRgZFuW If you clicked you should reset your phone. Am I RIGHT @trolling_isart @stufflistings https://t.co/yINsBtAJhr. Most recent link (Dec 25, 2021): https://twitter.com/galaxyshouvik/statuses/1474581610959818752\\\", \\\"Sources\\\": [\\\"WlbRkJ\\\", \\\"ha2FFj\\\", \\\"K7wUX2\\\", \\\"NKaUXl\\\", \\\"P_ivKa\\\", \\\"J-mrOR\\\", \\\"P_upBR\\\"], \\\"Timestamp\\\": \\\"2021-12-25T03:23:47.000Z\\\", \\\"Name\\\": \\\"linkedToVector\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Messaging Platforms - Uncategorized. Most recent link (Oct 18, 2021): https://t.me/An0nymousTeam/1429\\\", \\\"Sources\\\": [\\\"Y7TWfI\\\"], \\\"Timestamp\\\": \\\"2021-10-18T12:09:43.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Linked to Malware\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"54 sightings on 17 sources including: Ichunqiu Forum, Doc Player, Malwr.com, ArXiv, GitHub. 19 related malware families including Fakespy, Dardesh, Djvu Ransomware, SAVEfiles, Trojan. Most recent tweet: @Enfenogo @ThetanArena @KardiaChain @wolffungame Se voc\\u00ea jogar o .exe do instalador no site https://t.co/yxgkgU58Hr, vai encontrar um trojan minerador. Estou sem acreditar. T\\u00f4 rodando o Malware Byte no meu PC pra tentar limpar a merda que eles fizeram. Most recent link (Nov 27, 2021): https://twitter.com/Ronan30451924/statuses/1464732674891960321\\\", \\\"Sources\\\": [\\\"TGXqeD\\\", \\\"W4ygGi\\\", \\\"L3kVdM\\\", \\\"QMfGAr\\\", \\\"NKaUXl\\\", \\\"kuKt0c\\\", \\\"QAy9GA\\\", \\\"JOU\\\", \\\"MIKjae\\\", \\\"P_oIyV\\\", \\\"QJ6TQK\\\", \\\"idn:droppdf.com\\\", \\\"Ql9O5c\\\", \\\"QAmbRP\\\", \\\"Tq2nAb\\\", \\\"TbciDE\\\", \\\"idn:index-of.es\\\"], \\\"Timestamp\\\": \\\"2021-11-27T23:07:37.000Z\\\", \\\"Name\\\": \\\"linkedToMalware\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: ReversingLabs. Most recent link (Aug 13, 2017): ReversingLabs malware file analysis.\\\", \\\"Sources\\\": [\\\"TbciDE\\\"], \\\"Timestamp\\\": \\\"2017-08-13T00:33:27.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"7531fcea7002c8b52a8d023d0f3bb938efb2cbfec91d2433694930b426d84865\", \"Risk\": \"89\", \"RiskString\": \"5/14\"}", "risk_score": 89.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2890,15 +2970,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0\\\", \\\"Sources\\\": [\\\"Jv_xrR\\\"], \\\"Timestamp\\\": \\\"2021-11-08T16:27:15.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged IP\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt\\\", \\\"Sources\\\": [\\\"MIKjae\\\"], \\\"Timestamp\\\": \\\"2021-11-16T00:00:00.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"164 sightings on 4 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"h_iZX8\\\", \\\"report:OtiCOp\\\", \\\"hyihHO\\\"], \\\"Timestamp\\\": \\\"2021-12-29T02:11:16.658Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}, {\\\"Rule\\\": \\\"Actively Communicating C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-29T02:11:16.663Z\\\", \\\"Name\\\": \\\"recentActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.12\", \"Risk\": \"99\", \"RiskString\": \"4/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -2981,15 +3065,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset\\\", \\\"Sources\\\": [\\\"MIKjae\\\"], \\\"Timestamp\\\": \\\"2021-01-01T16:56:57.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021\\\", \\\"Sources\\\": [\\\"iFMVSl\\\", \\\"Ol_aRZ\\\"], \\\"Timestamp\\\": \\\"2021-04-30T04:50:06.000Z\\\", \\\"Name\\\": \\\"multiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021.\\\", \\\"Sources\\\": [\\\"report:SW8xpk\\\"], \\\"Timestamp\\\": \\\"2021-12-28T19:20:46.641Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"9 sightings on 2 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command \u0026 Control host identified on Oct 29, 2021.\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-10-29T08:07:54.495Z\\\", \\\"Name\\\": \\\"intermediateCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recently Active C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-28T19:20:46.639Z\\\", \\\"Name\\\": \\\"intermediateActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"12 sightings on 2 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command \u0026 Control host identified on Dec 24, 2021.\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-12-24T08:07:09.925Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.13\", \"Risk\": \"99\", \"RiskString\": \"6/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3096,15 +3184,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\\\", \\\"Sources\\\": [\\\"k_7zaW\\\", \\\"jqWX2B\\\"], \\\"Timestamp\\\": \\\"2021-11-26T15:01:53.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Linked to Cyber Attack\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815\\\", \\\"Sources\\\": [\\\"k_7zaW\\\"], \\\"Timestamp\\\": \\\"2021-08-15T00:00:00.000Z\\\", \\\"Name\\\": \\\"linkedToCyberAttack\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged IP\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\\\", \\\"Sources\\\": [\\\"jqWX2B\\\"], \\\"Timestamp\\\": \\\"2021-11-26T15:01:53.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021.\\\", \\\"Sources\\\": [\\\"report:aD1qtM\\\", \\\"report:Tluf00\\\"], \\\"Timestamp\\\": \\\"2021-12-28T18:45:41.877Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Recorded Future Command \u0026 Control List. Command \u0026 Control host identified on Jul 5, 2021.\\\", \\\"Sources\\\": [\\\"b5tNVA\\\"], \\\"Timestamp\\\": \\\"2021-07-05T08:04:23.139Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}, {\\\"Rule\\\": \\\"Actively Communicating C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-28T18:45:41.875Z\\\", \\\"Name\\\": \\\"recentActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.14\", \"Risk\": \"99\", \"RiskString\": \"6/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3209,15 +3301,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/\\\", \\\"Sources\\\": [\\\"idn:paloaltonetworks.jp\\\", \\\"JwO7jp\\\", \\\"jjf3_B\\\", \\\"Jv_xrR\\\", \\\"Z7kln2\\\"], \\\"Timestamp\\\": \\\"2021-03-14T00:00:00.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\\\", \\\"Sources\\\": [\\\"jjf3_B\\\"], \\\"Timestamp\\\": \\\"2021-04-09T12:00:00.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229\\\", \\\"Sources\\\": [\\\"UneVVu\\\"], \\\"Timestamp\\\": \\\"2020-08-25T20:01:29.075Z\\\", \\\"Name\\\": \\\"multiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged IP\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\\\", \\\"Sources\\\": [\\\"idn:paloaltonetworks.jp\\\", \\\"JwO7jp\\\", \\\"jjf3_B\\\"], \\\"Timestamp\\\": \\\"2021-04-09T12:00:00.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Positive Malware Verdict\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html\\\", \\\"Sources\\\": [\\\"Z7kln2\\\"], \\\"Timestamp\\\": \\\"2021-01-25T23:59:00.000Z\\\", \\\"Name\\\": \\\"positiveMalwareVerdict\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Spam Source\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021.\\\", \\\"Sources\\\": [\\\"kBCI-b\\\"], \\\"Timestamp\\\": \\\"2021-11-16T01:06:21.965Z\\\", \\\"Name\\\": \\\"spam\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021.\\\", \\\"Sources\\\": [\\\"report:Q1ghC0\\\", \\\"report:OtiCOp\\\"], \\\"Timestamp\\\": \\\"2021-12-28T19:33:55.849Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db\\\", \\\"Sources\\\": [\\\"JwO7jp\\\", \\\"hyihHO\\\", \\\"jjf3_B\\\"], \\\"Timestamp\\\": \\\"2021-10-19T12:21:34.268Z\\\", \\\"Name\\\": \\\"intermediateCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recent Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Talos IP Blacklist.\\\", \\\"Sources\\\": [\\\"report:VW6jeN\\\"], \\\"Timestamp\\\": \\\"2021-12-28T19:33:55.846Z\\\", \\\"Name\\\": \\\"recentMultiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580\\\", \\\"Sources\\\": [\\\"hyihHO\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-12-27T19:00:49.975Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.15\", \"Risk\": \"99\", \"RiskString\": \"10/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3384,15 +3480,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b\\\", \\\"Sources\\\": [\\\"Jv_xrR\\\"], \\\"Timestamp\\\": \\\"2021-12-02T15:58:10.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: Recorded Future Command \u0026 Control List, Abuse.ch: Feodo IP Blocklist. Command \u0026 Control host identified on Dec 1, 2021.\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"report:OtiCOp\\\"], \\\"Timestamp\\\": \\\"2021-12-01T08:06:11.827Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}, {\\\"Rule\\\": \\\"Actively Communicating C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-28T22:05:35.688Z\\\", \\\"Name\\\": \\\"recentActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.12\", \"Risk\": \"99\", \"RiskString\": \"3/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3458,15 +3558,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historical Honeypot Sighting\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96-\u0026gt;22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880\\\", \\\"Sources\\\": [\\\"P_izv4\\\", \\\"OSz1F0\\\"], \\\"Timestamp\\\": \\\"2016-12-14T13:50:41.000Z\\\", \\\"Name\\\": \\\"honeypot\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged IP\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt\\\", \\\"Sources\\\": [\\\"MIKjae\\\"], \\\"Timestamp\\\": \\\"2021-11-08T00:00:00.000Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Spam Source\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021.\\\", \\\"Sources\\\": [\\\"kBCI-b\\\"], \\\"Timestamp\\\": \\\"2021-11-16T03:19:58.721Z\\\", \\\"Name\\\": \\\"spam\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/\\\", \\\"Sources\\\": [\\\"k837l0\\\"], \\\"Timestamp\\\": \\\"2021-12-22T09:45:33.000Z\\\", \\\"Name\\\": \\\"recentLinkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recent Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: University of Science and Technology of China Black IP List.\\\", \\\"Sources\\\": [\\\"report:Q1ghC0\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:21:27.693Z\\\", \\\"Name\\\": \\\"recentMultiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: Recorded Future Command \u0026 Control List, Abuse.ch: Feodo IP Blocklist. Command \u0026 Control host identified on Nov 25, 2021.\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"report:OtiCOp\\\"], \\\"Timestamp\\\": \\\"2021-11-25T08:06:42.384Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}, {\\\"Rule\\\": \\\"Actively Communicating C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:21:27.731Z\\\", \\\"Name\\\": \\\"recentActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.13\", \"Risk\": \"99\", \"RiskString\": \"7/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3586,15 +3690,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021.\\\", \\\"Sources\\\": [\\\"report:aD1qtM\\\", \\\"report:OchJ-t\\\", \\\"report:Tluf00\\\"], \\\"Timestamp\\\": \\\"2021-12-28T18:42:08.925Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: DShield: Recommended Block List.\\\", \\\"Sources\\\": [\\\"report:OchJ-o\\\"], \\\"Timestamp\\\": \\\"2021-12-28T18:42:08.917Z\\\", \\\"Name\\\": \\\"recentMultiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"19 sightings on 2 sources: Recorded Future Command \u0026 Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"dZgcRz\\\"], \\\"Timestamp\\\": \\\"2021-09-01T13:15:00.000Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}, {\\\"Rule\\\": \\\"Actively Communicating C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-28T18:42:08.923Z\\\", \\\"Name\\\": \\\"recentActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.14\", \"Risk\": \"99\", \"RiskString\": \"4/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3677,15 +3785,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historical Open Proxies\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196\\\", \\\"Sources\\\": [\\\"RqhhJr\\\", \\\"KjGS3i\\\", \\\"VU4Qnc\\\", \\\"P7sZbk\\\", \\\"OQ_oQH\\\", \\\"Qk8WdX\\\", \\\"Qk8Wdg\\\", \\\"QqgtXJ\\\", \\\"KhvyCV\\\"], \\\"Timestamp\\\": \\\"2019-06-29T01:18:00.000Z\\\", \\\"Name\\\": \\\"openProxies\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Honeypot Sighting\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26-\u0026gt;22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456\\\", \\\"Sources\\\": [\\\"P_izv4\\\"], \\\"Timestamp\\\": \\\"2017-10-06T18:37:01.000Z\\\", \\\"Name\\\": \\\"honeypot\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/\\\", \\\"Sources\\\": [\\\"TiY1wa\\\", \\\"idn:sentinelone.com\\\", \\\"Jv_xrR\\\"], \\\"Timestamp\\\": \\\"2020-02-26T15:00:17.035Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Multicategory Blocklist\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\\\", \\\"Sources\\\": [\\\"UneVVu\\\"], \\\"Timestamp\\\": \\\"2018-08-17T00:30:42.194Z\\\", \\\"Name\\\": \\\"multiBlacklist\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical SSH/Dictionary Attacker\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\\\", \\\"Sources\\\": [\\\"UneVVu\\\"], \\\"Timestamp\\\": \\\"2018-08-17T00:30:42.194Z\\\", \\\"Name\\\": \\\"sshDictAttacker\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020.\\\", \\\"Sources\\\": [\\\"report:OhgwUx\\\", \\\"report:OtiCOp\\\", \\\"report:SYQe08\\\"], \\\"Timestamp\\\": \\\"2021-12-28T22:05:41.272Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa\\\", \\\"Sources\\\": [\\\"hyihHO\\\"], \\\"Timestamp\\\": \\\"2021-07-15T12:42:04.656Z\\\", \\\"Name\\\": \\\"intermediateCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834\\\", \\\"Sources\\\": [\\\"hyihHO\\\"], \\\"Timestamp\\\": \\\"2021-12-22T04:10:08.558Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.15\", \"Risk\": \"99\", \"RiskString\": \"8/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3832,15 +3944,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"4 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 7, 2021): https://pastebin.com/u8neEVnz\\\", \\\"Sources\\\": [\\\"Jv_xrR\\\"], \\\"Timestamp\\\": \\\"2021-11-07T09:05:40.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 29, 2021, and Dec 10, 2021.\\\", \\\"Sources\\\": [\\\"report:OtiCOp\\\"], \\\"Timestamp\\\": \\\"2021-12-29T02:11:39.014Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent Honeypot Sighting\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Project Honey Pot. Most recent link (Dec 19, 2021): https://www.projecthoneypot.org/ip_77.79.56.210\\\", \\\"Sources\\\": [\\\"OSz1F0\\\"], \\\"Timestamp\\\": \\\"2021-12-19T11:30:02.000Z\\\", \\\"Name\\\": \\\"recentHoneypot\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recent C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"12 sightings on 2 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-11-03T16:57:54.000Z\\\", \\\"Name\\\": \\\"intermediateCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recently Active C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-29T02:11:39.012Z\\\", \\\"Name\\\": \\\"intermediateActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"10 sightings on 2 sources: Recorded Future Command \u0026 Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 77.79.56.210:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 77b34084de82afac57fbe2c6442dbe7d07c53da5ec87eaf2210b852f0d943cd5\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"hyihHO\\\"], \\\"Timestamp\\\": \\\"2021-12-29T02:00:05.439Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.12\", \"Risk\": \"99\", \"RiskString\": \"6/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -3946,15 +4062,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Linked to Intrusion Method\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"34 sightings on 5 sources: Malware News - Malware Analysis, News and Indicators, PasteBin, Segurana Informtica, The Cyber Feed, Kaspersky Securelist and Lab. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Dec 3, 2021): https://pastebin.com/xJ0kmeYQ\\\", \\\"Sources\\\": [\\\"gBDK5G\\\", \\\"Jv_xrR\\\", \\\"VW7VQs\\\", \\\"g162EU\\\", \\\"4n\\\"], \\\"Timestamp\\\": \\\"2021-12-03T16:51:53.000Z\\\", \\\"Name\\\": \\\"linkedIntrusion\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historical Threat Researcher\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"4 sightings on 1 source: Kaspersky Securelist and Lab. Most recent link (Sep 2, 2021): https://securelist.com/qakbot-technical-analysis/103931/\\\", \\\"Sources\\\": [\\\"4n\\\"], \\\"Timestamp\\\": \\\"2021-09-02T10:00:32.000Z\\\", \\\"Name\\\": \\\"threatResearcher\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported as a Defanged IP\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"6 sightings on 3 sources: Malware News - Malware Analysis, News and Indicators, urlscan.io, Kaspersky Securelist and Lab. Most recent link (Dec 1, 2021): https://urlscan.io/result/c5b4e2d5-acf0-4fc5-b7bd-e8afac3e5f5a/\\\", \\\"Sources\\\": [\\\"gBDK5G\\\", \\\"WNRa7q\\\", \\\"4n\\\"], \\\"Timestamp\\\": \\\"2021-12-01T10:54:33.863Z\\\", \\\"Name\\\": \\\"defanged\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Reported in Threat List\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"Previous sightings on 1 source: Abuse.ch: Feodo IP Blocklist. Observed between Nov 19, 2021, and Nov 21, 2021.\\\", \\\"Sources\\\": [\\\"report:OtiCOp\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:17:33.217Z\\\", \\\"Name\\\": \\\"historicalThreatListMembership\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recent C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"234 sightings on 4 sources: Recorded Future Command \u0026 Control List, Polyswarm Sandbox Analysis - Malware C2 Extractions, PasteBin, Joe Security Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\\\", \\\"Sources\\\": [\\\"b5tNVA\\\", \\\"hyihHO\\\", \\\"Jv_xrR\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-11-03T16:57:54.000Z\\\", \\\"Name\\\": \\\"intermediateCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Recently Active C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Suspicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Qakbot. Communication observed on TCP:443. Last observed on Dec 23, 2021.\\\", \\\"Sources\\\": [\\\"report:aEft3k\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:17:33.215Z\\\", \\\"Name\\\": \\\"intermediateActiveCnc\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 2.0}, {\\\"Rule\\\": \\\"Current C\u0026C Server\\\", \\\"CriticalityLabel\\\": \\\"Very Malicious\\\", \\\"EvidenceString\\\": \\\"87 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 24.139.72.117:443 as TA0011 (Command and Control) for QakBot using configuration extraction on sample 7ea5720ac7efeb49873f95870d546632d6c8c187ee6e2fc515acfe974483ee0e\\\", \\\"Sources\\\": [\\\"hyihHO\\\", \\\"h_iZX8\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:00:21.416Z\\\", \\\"Name\\\": \\\"recentCncServer\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 4.0}]}\", \"Name\": \"67.43.156.13\", \"Risk\": \"99\", \"RiskString\": \"7/64\"}", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4085,15 +4205,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/\\\", \\\"Sources\\\": [\\\"Ctq\\\", \\\"idn:fook.news\\\", \\\"idn:urdupresss.com\\\", \\\"POs2u-\\\", \\\"idn:apple.news\\\", \\\"idn:cryptoinfoos.com.ng\\\", \\\"g9rk5F\\\", \\\"idn:thewindowsupdate.com\\\", \\\"idn:nationalcybersecuritynews.today\\\", \\\"gBDK5G\\\", \\\"idn:microsoft.com\\\", \\\"idn:techsecuritenews.com\\\", \\\"idn:mblogs.info\\\", \\\"J6UzbO\\\", \\\"idn:viralamo.com\\\", \\\"idn:sellorbuyhomefast.com\\\", \\\"idn:crazyboy.tech\\\", \\\"idn:times24h.com\\\", \\\"idn:buzzfeeg.com\\\", \\\"idn:dsmenders.com\\\", \\\"WroSbs\\\", \\\"idn:vzonetvgh.com\\\"], \\\"Timestamp\\\": \\\"2021-07-20T00:00:00.000Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-07-10T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentAnalystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://144.34.179.162/a\", \"Risk\": \"87\", \"RiskString\": \"2/24\"}", "risk_score": 87.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4174,15 +4298,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004\\\", \\\"Sources\\\": [\\\"XBl0xf\\\", \\\"c2unu0\\\", \\\"DVW\\\", \\\"NPgRlV\\\", \\\"idn:otcdynamics.com\\\", \\\"idn:norteenlinea.com\\\", \\\"N4OmGX\\\", \\\"idn:snewsonline.com\\\", \\\"idn:nationalcybersecuritynews.today\\\", \\\"dCod5e\\\", \\\"hZ14Az\\\", \\\"idn:securityopenlab.it\\\", \\\"idn:clevertechmx.blogspot.com\\\", \\\"cJzvLR\\\", \\\"eNeV39\\\", \\\"dCotni\\\", \\\"dCo6X1\\\", \\\"jB6Hnn\\\", \\\"idn:telecomkh.info\\\"], \\\"Timestamp\\\": \\\"2021-10-03T12:53:49.605Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Phishing Techniques\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-11-14T00:00:00.000Z\\\", \\\"Name\\\": \\\"phishingSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-11-14T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Active URL on Weaponized Domain\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021.\\\", \\\"Sources\\\": [\\\"report:aRJ1CU\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:08:29.105Z\\\", \\\"Name\\\": \\\"recentWeaponizedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623\", \"Risk\": \"85\", \"RiskString\": \"4/24\"}", "risk_score": 85.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4285,15 +4413,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf\\\", \\\"Sources\\\": [\\\"JNe6Hu\\\", \\\"TQnwKJ\\\", \\\"OfMf0W\\\", \\\"TefIEN\\\", \\\"VyuDZP\\\", \\\"Z7kln5\\\", \\\"bd-Dtt\\\", \\\"kKLjNc\\\", \\\"Y7TWfI\\\", \\\"idn:redpacketsecurity.com\\\", \\\"idn:eccouncil.org\\\", \\\"idn:comparaland.com\\\", \\\"idn:d335luupugsy2.cloudfront.net\\\", \\\"KVRURg\\\"], \\\"Timestamp\\\": \\\"2021-12-22T16:01:42.134Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-12-17T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentAnalystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://3.145.115.94/zambo/groenhuyzen.exe\", \"Risk\": \"79\", \"RiskString\": \"2/24\"}", "risk_score": 79.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4367,15 +4499,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf\\\", \\\"Sources\\\": [\\\"POs2u-\\\", \\\"U13S_U\\\", \\\"idn:mrhacker.co\\\", \\\"Z3TZAQ\\\", \\\"N4OmGX\\\", \\\"UqKvRr\\\", \\\"gBDK5G\\\", \\\"JExgHv\\\", \\\"QxXv_c\\\", \\\"J6UzbO\\\", \\\"eTNyK6\\\", \\\"idn:privacy.com.sg\\\", \\\"e6Ewt_\\\", \\\"idn:reportcybercrime.com\\\"], \\\"Timestamp\\\": \\\"2021-02-06T12:52:09.042Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-12-28T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentMalwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://gxbrowser.net\", \"Risk\": \"79\", \"RiskString\": \"2/24\"}", "risk_score": 79.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4448,15 +4584,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\\\\\\\Attack\\\\\\\\DropperBuild\\\\\\\\x64\\\\\\\\Release\\\\\\\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240\\\", \\\"Sources\\\": [\\\"JwO7jp\\\", \\\"idn:tistory.com\\\", \\\"POs2u-\\\", \\\"U13S_U\\\", \\\"ThoB0I\\\", \\\"idn:airmagnet.technology\\\", \\\"LErKlN\\\", \\\"WuLz1r\\\", \\\"KdwTwF\\\", \\\"VfsacJ\\\", \\\"jjf3_B\\\", \\\"idn:brica.de\\\"], \\\"Timestamp\\\": \\\"2018-09-03T00:40:11.000Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Referenced by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"2 sightings on 1 source: Insikt Group. 2 reports including \\\\\\\"Fractured Block\\u201d Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2018-12-09T00:00:00.000Z\\\", \\\"Name\\\": \\\"relatedNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Active URL on Weaponized Domain\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021.\\\", \\\"Sources\\\": [\\\"report:aRJ1CU\\\"], \\\"Timestamp\\\": \\\"2021-12-29T07:07:42.477Z\\\", \\\"Name\\\": \\\"recentWeaponizedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"https://881.000webhostapp.com/1.txt\", \"Risk\": \"78\", \"RiskString\": \"3/24\"}", "risk_score": 78.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4541,15 +4681,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/\\\", \\\"Sources\\\": [\\\"idn:cybersecdn.com\\\", \\\"fWD1r9\\\", \\\"idn:deepcheck.one\\\", \\\"idn:hackeridiot.com\\\", \\\"Jv_xrR\\\", \\\"ONMgMx\\\", \\\"idn:nationalcybersecuritynews.today\\\"], \\\"Timestamp\\\": \\\"2021-05-27T22:48:00.256Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-06-15T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-04-06T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentAnalystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Recently Active URL on Weaponized Domain\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021.\\\", \\\"Sources\\\": [\\\"report:aRJ1CU\\\"], \\\"Timestamp\\\": \\\"2021-12-29T06:34:00.698Z\\\", \\\"Name\\\": \\\"recentWeaponizedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://comunicador.duckdns.org/catalista/lixo/index.php\", \"Risk\": \"78\", \"RiskString\": \"4/24\"}", "risk_score": 78.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4642,15 +4786,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Recently Active URL on Weaponized Domain\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021.\\\", \\\"Sources\\\": [\\\"report:aRJ1CU\\\"], \\\"Timestamp\\\": \\\"2021-12-28T22:15:49.631Z\\\", \\\"Name\\\": \\\"recentWeaponizedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Recently Detected Phishing Techniques\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\", \\\"eKv4Jm\\\"], \\\"Timestamp\\\": \\\"2021-12-28T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentPhishingSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}, {\\\"Rule\\\": \\\"Recently Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-12-28T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentMalwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"https://www.jeanninecatddns.chickenkiller.com/signin-authflow\", \"Risk\": \"75\", \"RiskString\": \"3/24\"}", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4720,15 +4868,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS\u0026utm_content=20210813\\\", \\\"Sources\\\": [\\\"gBDK5G\\\", \\\"idn:microsoft.com\\\", \\\"idn:sociabble.com\\\", \\\"KBTQ2e\\\", \\\"dCotni\\\", \\\"g9rk5F\\\", \\\"Z7kln5\\\", \\\"idn:cda.ms\\\", \\\"idn:thewindowsupdate.com\\\"], \\\"Timestamp\\\": \\\"2021-08-13T17:03:19.000Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-08-13T00:00:00.000Z\\\", \\\"Name\\\": \\\"malwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-08-12T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentAnalystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://coollab.jp/dir/root/p/09908.js\", \"Risk\": \"75\", \"RiskString\": \"3/24\"}", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4811,15 +4963,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539\\\", \\\"Sources\\\": [\\\"Gzt\\\", \\\"idn:eccouncil.org\\\", \\\"idn:frsecure.com\\\", \\\"J-8-Nr\\\", \\\"Jv_xrR\\\", \\\"g9rk5F\\\", \\\"cUg0pv\\\", \\\"K5LKj8\\\", \\\"fVAueu\\\"], \\\"Timestamp\\\": \\\"2021-01-27T05:14:38.000Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Historically Detected Phishing Techniques\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-05-30T00:00:00.000Z\\\", \\\"Name\\\": \\\"phishingSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Reported by Insikt Group\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc\\\", \\\"Sources\\\": [\\\"VKz42X\\\"], \\\"Timestamp\\\": \\\"2021-01-25T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentAnalystNote\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"https://blog.br0vvnn.io\", \"Risk\": \"75\", \"RiskString\": \"3/24\"}", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -4900,15 +5056,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "{\"EvidenceDetails\": \"{\\\"EvidenceDetails\\\": [{\\\"Rule\\\": \\\"Historically Reported as a Defanged URL\\\", \\\"CriticalityLabel\\\": \\\"Unusual\\\", \\\"EvidenceString\\\": \\\"24 sightings on 10 sources including: lnkd.in, digitalforensicsmagazineblog PH, mediosdemexico.com, Palo Alto Networks, Security Art Work. Most recent link (Mar 4, 2016): https://lnkd.in/egi-nMa\\\", \\\"Sources\\\": [\\\"idn:lnkd.in\\\", \\\"JNe6Gc\\\", \\\"idn:mediosdemexico.com\\\", \\\"JwO7jp\\\", \\\"LCN_6T\\\", \\\"KA0p6S\\\", \\\"LErKlN\\\", \\\"jjf3_B\\\", \\\"KE9Xit\\\", \\\"J4bouj\\\"], \\\"Timestamp\\\": \\\"2016-03-04T14:33:36.543Z\\\", \\\"Name\\\": \\\"defangedURL\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 1.0}, {\\\"Rule\\\": \\\"Recently Detected Malware Distribution\\\", \\\"CriticalityLabel\\\": \\\"Malicious\\\", \\\"EvidenceString\\\": \\\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 27, 2021.\\\", \\\"Sources\\\": [\\\"d3Awkm\\\"], \\\"Timestamp\\\": \\\"2021-12-27T00:00:00.000Z\\\", \\\"Name\\\": \\\"recentMalwareSiteDetected\\\", \\\"MitigationString\\\": \\\"\\\", \\\"Criticality\\\": 3.0}]}\", \"Name\": \"http://init.icloud-analysis.com\", \"Risk\": \"75\", \"RiskString\": \"2/24\"}", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ diff --git a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-ip-default.log-expected.json b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-ip-default.log-expected.json index ad872bf1b35..285c4765777 100644 --- a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-ip-default.log-expected.json +++ b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-ip-default.log-expected.json @@ -3,15 +3,19 @@ null, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"1.128.3.4\",\"99\",\"4/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"7 sightings on 1 source: PasteBin. 3 related intrusion methods: Trojan, Banking Trojan, QakBot. Most recent link (Nov 8, 2021): https://pastebin.com/G1Jvm5T0\"\", \"\"Sources\"\": [\"\"Jv_xrR\"\"], \"\"Timestamp\"\": \"\"2021-11-08T16:27:15.000Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported as a Defanged IP\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: GitHub. Most recent link (Nov 16, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-15-IOCs-for-Matanbuchus-Qakbot-CobaltStrike-and-spambot-activity.txt\"\", \"\"Sources\"\": [\"\"MIKjae\"\"], \"\"Timestamp\"\": \"\"2021-11-16T00:00:00.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"164 sightings on 4 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions, Abuse.ch: Feodo IP Blocklist, Polyswarm Sandbox Analysis - Malware C2 Extractions. Joe Security malware sandbox identified 103.143.8.71:443 as TA0011 (Command and Control) QakBot using configuration extraction on sample 8f97195fc90ce520e75db6785204da0adbda9be5464bb27cd4dcc5b23b547651\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"h_iZX8\"\", \"\"report:OtiCOp\"\", \"\"hyihHO\"\"], \"\"Timestamp\"\": \"\"2021-12-29T02:11:16.658Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}, {\"\"Rule\"\": \"\"Actively Communicating C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Qakbot. Communication observed on TCP:443, TCP:6881, TCP:995. Exfiltration behavior observed. Last observed on Dec 27, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-29T02:11:16.663Z\"\", \"\"Name\"\": \"\"recentActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -94,15 +98,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"2a02:cf40:add:4002:91f2:a9b2:e09a:6fc6\",\"68\",\"5/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historical Brute Force\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as Brute-Force by multiple unique community member submissions. Reported to Recorded Future on Nov 23, 2021.\"\", \"\"Sources\"\": [\"\"kAh9jV\"\"], \"\"Timestamp\"\": \"\"2021-11-24T10:21:58.872Z\"\", \"\"Name\"\": \"\"bruteForce\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent Spam Source\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: AbuseIPDB Spam. 2001:470:1:c84::17 was identified as Web Spam by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021.\"\", \"\"Sources\"\": [\"\"kAiRKZ\"\"], \"\"Timestamp\"\": \"\"2021-12-23T10:18:14.025Z\"\", \"\"Name\"\": \"\"recentSpam\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recent SSH/Dictionary Attacker\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DataPlane SSH Client Connection List.\"\", \"\"Sources\"\": [\"\"report:U8nmOf\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:19:53.133Z\"\", \"\"Name\"\": \"\"recentSshDictAttacker\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recent Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: BlockList.de: Fail2ban Reporting Service.\"\", \"\"Sources\"\": [\"\"report:OhgwUx\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:19:53.133Z\"\", \"\"Name\"\": \"\"recentMultiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recent DDoS\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: AbuseIPDB Community Submissions. 2001:470:1:c84::17 was identified as DDoS Attack by multiple unique community member submissions. Reported to Recorded Future on Dec 21, 2021.\"\", \"\"Sources\"\": [\"\"kAh9jV\"\"], \"\"Timestamp\"\": \"\"2021-12-23T10:18:13.994Z\"\", \"\"Name\"\": \"\"recentDdos\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 68.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -191,15 +199,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"175.16.199.1\",\"99\",\"6/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: GitHub. 2 related intrusion methods: Nanocore, Remote Access Trojan. Most recent link (Jan 1, 2021): https://github.com/GlacierSheep/DomainBlockList/blob/master/trail/static_nanocore_(malware).domainset\"\", \"\"Sources\"\": [\"\"MIKjae\"\"], \"\"Timestamp\"\": \"\"2021-01-01T16:56:57.000Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: Bitdefender IP Reputation, hpHosts Latest Additions. Bitdefender detected suspicious traffic involving 185.19.85.136 associated with Bitdefender threat name Trojan.GenericKD.34300483 on Apr 30, 2021\"\", \"\"Sources\"\": [\"\"iFMVSl\"\", \"\"Ol_aRZ\"\"], \"\"Timestamp\"\": \"\"2021-04-30T04:50:06.000Z\"\", \"\"Name\"\": \"\"multiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 1 source: Recorded Future Fast Flux DNS IP List. Observed between Feb 13, 2021, and Feb 13, 2021.\"\", \"\"Sources\"\": [\"\"report:SW8xpk\"\"], \"\"Timestamp\"\": \"\"2021-12-28T19:20:46.641Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"9 sightings on 2 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command \u0026 Control host identified on Oct 29, 2021.\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"h_iZX8\"\"], \"\"Timestamp\"\": \"\"2021-10-29T08:07:54.495Z\"\", \"\"Name\"\": \"\"intermediateCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recently Active C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Asyncrat. Communication observed on TCP:6060. Last observed on Dec 21, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-28T19:20:46.639Z\"\", \"\"Name\"\": \"\"intermediateActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"12 sightings on 2 sources: Recorded Future Command \u0026 Control List, Joe Security Sandbox Analysis - Malware C2 Extractions. Command \u0026 Control host identified on Dec 24, 2021.\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"h_iZX8\"\"], \"\"Timestamp\"\": \"\"2021-12-24T08:07:09.925Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -306,15 +318,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"216.160.83.57\",\"99\",\"6/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"12 sightings on 2 sources: C2IntelFeeds IPC2s, @drb_ra. 2 related intrusion methods: Cobalt Strike, Offensive Security Tools (OST). Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\"\", \"\"Sources\"\": [\"\"k_7zaW\"\", \"\"jqWX2B\"\"], \"\"Timestamp\"\": \"\"2021-11-26T15:01:53.000Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Linked to Cyber Attack\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: C2IntelFeeds IPC2s. Most recent link (Aug 15, 2021): https://github.com/drb-ra/C2IntelFeeds/blob/master/feeds/IPC2s-30day.csv?q=45.112.206.18_20210815\"\", \"\"Sources\"\": [\"\"k_7zaW\"\"], \"\"Timestamp\"\": \"\"2021-08-15T00:00:00.000Z\"\", \"\"Name\"\": \"\"linkedToCyberAttack\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported as a Defanged IP\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"10 sightings on 1 source: @drb_ra. Most recent tweet: Cobalt Strike server found C2: HTTPS @ 45[.]112[.]206[.]18:443 C2 Server: 45[.]112[.]206[.]13,/IE9CompatViewList[.]xml Country: Hong Kong ASN: HK kwaifong group limited #C2 #cobaltstrike. Most recent link (Nov 26, 2021): https://twitter.com/drb_ra/statuses/1464248045118590978\"\", \"\"Sources\"\": [\"\"jqWX2B\"\"], \"\"Timestamp\"\": \"\"2021-11-26T15:01:53.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 2 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, Recorded Future Analyst Community Trending Indicators. Observed between Jul 8, 2021, and Dec 9, 2021.\"\", \"\"Sources\"\": [\"\"report:aD1qtM\"\", \"\"report:Tluf00\"\"], \"\"Timestamp\"\": \"\"2021-12-28T18:45:41.877Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Recorded Future Command \u0026 Control List. Command \u0026 Control host identified on Jul 5, 2021.\"\", \"\"Sources\"\": [\"\"b5tNVA\"\"], \"\"Timestamp\"\": \"\"2021-07-05T08:04:23.139Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}, {\"\"Rule\"\": \"\"Actively Communicating C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Cobalt Strike Team Servers. Communication observed on TCP:443, TCP:8443. Last observed on Dec 26, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-28T18:45:41.875Z\"\", \"\"Name\"\": \"\"recentActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -419,15 +435,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"216.160.83.61\",\"99\",\"10/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"239 sightings on 5 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks, PasteBin, Cryptolaemus Pastedump. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Mar 14, 2021): https://unit42.paloaltonetworks.jp/attack-chain-overview-emotet-in-december-2020-and-january-2021/\"\", \"\"Sources\"\": [\"\"idn:paloaltonetworks.jp\"\", \"\"JwO7jp\"\", \"\"jjf3_B\"\", \"\"Jv_xrR\"\", \"\"Z7kln2\"\"], \"\"Timestamp\"\": \"\"2021-03-14T00:00:00.000Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Threat Researcher\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\"\", \"\"Sources\"\": [\"\"jjf3_B\"\"], \"\"Timestamp\"\": \"\"2021-04-09T12:00:00.000Z\"\", \"\"Name\"\": \"\"threatResearcher\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"5 sightings on 1 source: AbuseIP Database. Most recent link (Aug 25, 2020): https://www.abuseipdb.com/check/190.55.186.229\"\", \"\"Sources\"\": [\"\"UneVVu\"\"], \"\"Timestamp\"\": \"\"2020-08-25T20:01:29.075Z\"\", \"\"Name\"\": \"\"multiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported as a Defanged IP\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"6 sightings on 3 sources: paloaltonetworks.jp, Palo Alto Networks, Unit 42 Palo Alto Networks. Most recent link (Apr 9, 2021): https://unit42.paloaltonetworks.com/emotet-command-and-control/\"\", \"\"Sources\"\": [\"\"idn:paloaltonetworks.jp\"\", \"\"JwO7jp\"\", \"\"jjf3_B\"\"], \"\"Timestamp\"\": \"\"2021-04-09T12:00:00.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Positive Malware Verdict\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"87 sightings on 1 source: Cryptolaemus Pastedump. Most recent link (Jan 25, 2021): https://paste.cryptolaemus.com/emotet/2021/01/25/emotet-malware-IoCs_01-25-21.html\"\", \"\"Sources\"\": [\"\"Z7kln2\"\"], \"\"Timestamp\"\": \"\"2021-01-25T23:59:00.000Z\"\", \"\"Name\"\": \"\"positiveMalwareVerdict\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Spam Source\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: External Sensor Spam. 190.55.186.229 was historically observed as spam. No longer observed as of Nov 16, 2021.\"\", \"\"Sources\"\": [\"\"kBCI-b\"\"], \"\"Timestamp\"\": \"\"2021-11-16T01:06:21.965Z\"\", \"\"Name\"\": \"\"spam\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 2 sources: University of Science and Technology of China Black IP List, Abuse.ch: Feodo IP Blocklist. Observed between Feb 26, 2021, and Dec 27, 2021.\"\", \"\"Sources\"\": [\"\"report:Q1ghC0\"\", \"\"report:OtiCOp\"\"], \"\"Timestamp\"\": \"\"2021-12-28T19:33:55.849Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"31 sightings on 3 sources: Palo Alto Networks, Polyswarm Sandbox Analysis - Malware C2 Extractions, Unit 42 Palo Alto Networks. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample a88734cd5c38211a4168bc7701516a50e6aef5ef20d2b1a915edae23c1b345db\"\", \"\"Sources\"\": [\"\"JwO7jp\"\", \"\"hyihHO\"\", \"\"jjf3_B\"\"], \"\"Timestamp\"\": \"\"2021-10-19T12:21:34.268Z\"\", \"\"Name\"\": \"\"intermediateCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recent Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Talos IP Blacklist.\"\", \"\"Sources\"\": [\"\"report:VW6jeN\"\"], \"\"Timestamp\"\": \"\"2021-12-28T19:33:55.846Z\"\", \"\"Name\"\": \"\"recentMultiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"5 sightings on 2 sources: Polyswarm Sandbox Analysis - Malware C2 Extractions, Joe Security Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 190.55.186.229:80 as TA0011 (Command and Control) for Emotet using configuration extraction on sample c9709d56b92047cd55fb097feb6cb7a8de6f3edc5ea79a429363938a69aae580\"\", \"\"Sources\"\": [\"\"hyihHO\"\", \"\"h_iZX8\"\"], \"\"Timestamp\"\": \"\"2021-12-27T19:00:49.975Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -594,15 +614,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"81.2.69.143\",\"99\",\"3/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: PasteBin. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 2, 2021): https://pastebin.com/SusxCK2b\"\", \"\"Sources\"\": [\"\"Jv_xrR\"\"], \"\"Timestamp\"\": \"\"2021-12-02T15:58:10.000Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: Recorded Future Command \u0026 Control List, Abuse.ch: Feodo IP Blocklist. Command \u0026 Control host identified on Dec 1, 2021.\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"report:OtiCOp\"\"], \"\"Timestamp\"\": \"\"2021-12-01T08:06:11.827Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}, {\"\"Rule\"\": \"\"Actively Communicating C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Emotet. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 26, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-28T22:05:35.688Z\"\", \"\"Name\"\": \"\"recentActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -668,15 +692,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"81.2.69.144\",\"99\",\"7/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historical Honeypot Sighting\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: Project Honey Pot, @HoneyFog. Most recent tweet: Fog44: 87.120.254.96-\u0026gt;22. Most recent link (Dec 14, 2016): https://twitter.com/HoneyFog/statuses/809032869792378880\"\", \"\"Sources\"\": [\"\"P_izv4\"\", \"\"OSz1F0\"\"], \"\"Timestamp\"\": \"\"2016-12-14T13:50:41.000Z\"\", \"\"Name\"\": \"\"honeypot\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported as a Defanged IP\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: GitHub. Most recent link (Nov 8, 2021): https://github.com/pan-unit42/tweets/blob/master/2021-11-05-TA551-IOCs.txt\"\", \"\"Sources\"\": [\"\"MIKjae\"\"], \"\"Timestamp\"\": \"\"2021-11-08T00:00:00.000Z\"\", \"\"Name\"\": \"\"defanged\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Spam Source\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: External Sensor Spam. 87.120.254.96 was historically observed as spam. No longer observed as of Nov 16, 2021.\"\", \"\"Sources\"\": [\"\"kBCI-b\"\"], \"\"Timestamp\"\": \"\"2021-11-16T03:19:58.721Z\"\", \"\"Name\"\": \"\"spam\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: CloudSEK. 4 related intrusion methods: Trojan, Emotet, Banking Trojan, Botnet. Most recent link (Dec 22, 2021): https://cloudsek.com/emotet-2-0-everything-you-need-to-know-about-the-new-variant-of-thbanking-trojan/\"\", \"\"Sources\"\": [\"\"k837l0\"\"], \"\"Timestamp\"\": \"\"2021-12-22T09:45:33.000Z\"\", \"\"Name\"\": \"\"recentLinkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Recent Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: University of Science and Technology of China Black IP List.\"\", \"\"Sources\"\": [\"\"report:Q1ghC0\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:21:27.693Z\"\", \"\"Name\"\": \"\"recentMultiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: Recorded Future Command \u0026 Control List, Abuse.ch: Feodo IP Blocklist. Command \u0026 Control host identified on Nov 25, 2021.\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"report:OtiCOp\"\"], \"\"Timestamp\"\": \"\"2021-11-25T08:06:42.384Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}, {\"\"Rule\"\": \"\"Actively Communicating C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Bazarloader. Communication observed on TCP:443. Exfiltration behavior observed. Last observed on Dec 25, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:21:27.731Z\"\", \"\"Name\"\": \"\"recentActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -796,15 +824,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"81.2.69.145\",\"99\",\"4/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 3 sources: Cobalt Strike Default Certificate Detected - Shodan / Recorded Future, CINS: CI Army List, Recorded Future Analyst Community Trending Indicators. Observed between Jan 22, 2021, and Sep 25, 2021.\"\", \"\"Sources\"\": [\"\"report:aD1qtM\"\", \"\"report:OchJ-t\"\", \"\"report:Tluf00\"\"], \"\"Timestamp\"\": \"\"2021-12-28T18:42:08.925Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: DShield: Recommended Block List.\"\", \"\"Sources\"\": [\"\"report:OchJ-o\"\"], \"\"Timestamp\"\": \"\"2021-12-28T18:42:08.917Z\"\", \"\"Name\"\": \"\"recentMultiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"19 sightings on 2 sources: Recorded Future Command \u0026 Control List, @TheDFIRReport. Most recent tweet: Here's some newer C2 servers we're tracking: #BazarLoader 64.227.73.80 64.225.71.198 #Covenant 167.71.67.196 45.146.165.76 #PoshC2 193.36.15.192 #Empire 64.227.21.255 #Metasploit 91.221.70.143 Full list available @ https://t.co/QT6o626hsR #ThreatFeed. Most recent link (Sep 1, 2021): https://twitter.com/TheDFIRReport/statuses/1433055791964049412\"\", \"\"Sources\"\": [\"\"b5tNVA\"\", \"\"dZgcRz\"\"], \"\"Timestamp\"\": \"\"2021-09-01T13:15:00.000Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}, {\"\"Rule\"\": \"\"Actively Communicating C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Network Traffic Analysis. Identified as C\u0026C server for 1 malware family: Covenant. Communication observed on TCP:7443. Exfiltration behavior observed. Last observed on Dec 27, 2021.\"\", \"\"Sources\"\": [\"\"report:aEft3k\"\"], \"\"Timestamp\"\": \"\"2021-12-28T18:42:08.923Z\"\", \"\"Name\"\": \"\"recentActiveCnc\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -887,15 +919,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"81.2.69.193\",\"99\",\"8/64\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historical Open Proxies\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2339 sightings on 9 sources including: TBN, BlackHatWorld Forum, Carding Mafia Forum, Inforge Forum Hacker Trucchi Giochi Informatica, ProxyFire - The Best Proxy Software and Forum. Most recent link (Jun 29, 2019): https://Black%20Hat%20World%20Forum%20(Obfuscated)/seo/ssl-proxies-occasional-update.927669/page-44#post-12210196\"\", \"\"Sources\"\": [\"\"RqhhJr\"\", \"\"KjGS3i\"\", \"\"VU4Qnc\"\", \"\"P7sZbk\"\", \"\"OQ_oQH\"\", \"\"Qk8WdX\"\", \"\"Qk8Wdg\"\", \"\"QqgtXJ\"\", \"\"KhvyCV\"\"], \"\"Timestamp\"\": \"\"2019-06-29T01:18:00.000Z\"\", \"\"Name\"\": \"\"openProxies\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Honeypot Sighting\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: @HoneyFog. Most recent tweet: Fog44: 181.112.52.26-\u0026gt;22. I've never seen this IP before. Most recent link (Oct 6, 2017): https://twitter.com/HoneyFog/statuses/916371734928019456\"\", \"\"Sources\"\": [\"\"P_izv4\"\"], \"\"Timestamp\"\": \"\"2017-10-06T18:37:01.000Z\"\", \"\"Name\"\": \"\"honeypot\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Linked to Intrusion Method\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"10 sightings on 3 sources: Manato Kumagai Hatena Blog, sentinelone.com, PasteBin. 6 related intrusion methods including TrickLoader, Trojan, Emotet, Banking Trojan, Trickbot. Most recent link (Feb 26, 2020): https://labs.sentinelone.com/revealing-the-trick-a-deep-dive-into-trickloader-obfuscation/\"\", \"\"Sources\"\": [\"\"TiY1wa\"\", \"\"idn:sentinelone.com\"\", \"\"Jv_xrR\"\"], \"\"Timestamp\"\": \"\"2020-02-26T15:00:17.035Z\"\", \"\"Name\"\": \"\"linkedIntrusion\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical Multicategory Blocklist\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\"\", \"\"Sources\"\": [\"\"UneVVu\"\"], \"\"Timestamp\"\": \"\"2018-08-17T00:30:42.194Z\"\", \"\"Name\"\": \"\"multiBlacklist\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historical SSH/Dictionary Attacker\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"4 sightings on 1 source: AbuseIP Database. Most recent link (Aug 17, 2018): https://www.abuseipdb.com/check/181.112.52.26\"\", \"\"Sources\"\": [\"\"UneVVu\"\"], \"\"Timestamp\"\": \"\"2018-08-17T00:30:42.194Z\"\", \"\"Name\"\": \"\"sshDictAttacker\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Reported in Threat List\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"Previous sightings on 3 sources: BlockList.de: Fail2ban Reporting Service, Abuse.ch: Feodo IP Blocklist, Proxies: SOCKS Open Proxies. Observed between Jun 15, 2019, and Oct 3, 2020.\"\", \"\"Sources\"\": [\"\"report:OhgwUx\"\", \"\"report:OtiCOp\"\", \"\"report:SYQe08\"\"], \"\"Timestamp\"\": \"\"2021-12-28T22:05:41.272Z\"\", \"\"Name\"\": \"\"historicalThreatListMembership\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recent C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Suspicious\"\", \"\"EvidenceString\"\": \"\"3 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample dcc42c0bd075f283c71ac327c845498454dcd9528386df5b296fdf89ba105bfa\"\", \"\"Sources\"\": [\"\"hyihHO\"\"], \"\"Timestamp\"\": \"\"2021-07-15T12:42:04.656Z\"\", \"\"Name\"\": \"\"intermediateCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 2.0}, {\"\"Rule\"\": \"\"Current C\u0026C Server\"\", \"\"CriticalityLabel\"\": \"\"Very Malicious\"\", \"\"EvidenceString\"\": \"\"5 sightings on 1 source: Polyswarm Sandbox Analysis - Malware C2 Extractions. Polyswarm malware sandbox identified 181.112.52.26:449 as TA0011 (Command and Control) for Trickbot using configuration extraction on sample b827a4587bc6162715693c71e432769ec6272c130bb87e14bc683f5bd7caf834\"\", \"\"Sources\"\": [\"\"hyihHO\"\"], \"\"Timestamp\"\": \"\"2021-12-22T04:10:08.558Z\"\", \"\"Name\"\": \"\"recentCncServer\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 4.0}]}\"", "risk_score": 99.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ diff --git a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-url-default.log-expected.json b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-url-default.log-expected.json index f9226525cb2..a5f8b998d30 100644 --- a/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-url-default.log-expected.json +++ b/packages/ti_recordedfuture/data_stream/threat/_dev/test/pipeline/test-url-default.log-expected.json @@ -3,15 +3,19 @@ null, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://144.34.179.162/a\",\"87\",\"2/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"66 sightings on 22 sources including: Ars Technica, fook.news, urdupresss.com, HackDig Posts, apple.news. Most recent link (Jul 20, 2021): https://techsecuritenews.com/solarwinds-pirates-utilisent-nouvelle-faille-zero-day-attaques/\"\", \"\"Sources\"\": [\"\"Ctq\"\", \"\"idn:fook.news\"\", \"\"idn:urdupresss.com\"\", \"\"POs2u-\"\", \"\"idn:apple.news\"\", \"\"idn:cryptoinfoos.com.ng\"\", \"\"g9rk5F\"\", \"\"idn:thewindowsupdate.com\"\", \"\"idn:nationalcybersecuritynews.today\"\", \"\"gBDK5G\"\", \"\"idn:microsoft.com\"\", \"\"idn:techsecuritenews.com\"\", \"\"idn:mblogs.info\"\", \"\"J6UzbO\"\", \"\"idn:viralamo.com\"\", \"\"idn:sellorbuyhomefast.com\"\", \"\"idn:crazyboy.tech\"\", \"\"idn:times24h.com\"\", \"\"idn:buzzfeeg.com\"\", \"\"idn:dsmenders.com\"\", \"\"WroSbs\"\", \"\"idn:vzonetvgh.com\"\"], \"\"Timestamp\"\": \"\"2021-07-20T00:00:00.000Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: SolarWinds Fixes Critical Vulnerability in Serv-U Managed File Transfer and Secure FTP Products. Most recent link (Jul 10, 2021): https://app.recordedfuture.com/live/sc/1GnDrn8zigTd\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-07-10T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 87.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -92,15 +96,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://adminsys.serveftp.com/nensa/fabio/ex/478632215/zer7855/nuns566623\",\"85\",\"4/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"41 sightings on 19 sources including: Stock market news Company News MarketScreenercom, GlobeNewswire | Software, Yahoo!, globenewswirecom, otcdynamics.com. Most recent link (Oct 3, 2021): https://telecomkh.info/?p=4004\"\", \"\"Sources\"\": [\"\"XBl0xf\"\", \"\"c2unu0\"\", \"\"DVW\"\", \"\"NPgRlV\"\", \"\"idn:otcdynamics.com\"\", \"\"idn:norteenlinea.com\"\", \"\"N4OmGX\"\", \"\"idn:snewsonline.com\"\", \"\"idn:nationalcybersecuritynews.today\"\", \"\"dCod5e\"\", \"\"hZ14Az\"\", \"\"idn:securityopenlab.it\"\", \"\"idn:clevertechmx.blogspot.com\"\", \"\"cJzvLR\"\", \"\"eNeV39\"\", \"\"dCotni\"\", \"\"dCo6X1\"\", \"\"jB6Hnn\"\", \"\"idn:telecomkh.info\"\"], \"\"Timestamp\"\": \"\"2021-10-03T12:53:49.605Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Phishing Techniques\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-11-14T00:00:00.000Z\"\", \"\"Name\"\": \"\"phishingSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Distribution\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Nov 14, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-11-14T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Active URL on Weaponized Domain\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: No-IP. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 20, 2021.\"\", \"\"Sources\"\": [\"\"report:aRJ1CU\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:08:29.105Z\"\", \"\"Name\"\": \"\"recentWeaponizedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 85.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -203,15 +211,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://3.145.115.94/zambo/groenhuyzen.exe\",\"79\",\"2/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"17 sightings on 14 sources including: Security Affairs, sensorstechforum.com, Heimdal Security Blog, securitynewspaper, BBS Kafan Card Forum. Most recent link (Dec 22, 2021): https://d335luupugsy2.cloudfront.net/cms%2Ffiles%2F183750%2F1640120040Log4j_-_Explorao_por_grupos_APT.pdf\"\", \"\"Sources\"\": [\"\"JNe6Hu\"\", \"\"TQnwKJ\"\", \"\"OfMf0W\"\", \"\"TefIEN\"\", \"\"VyuDZP\"\", \"\"Z7kln5\"\", \"\"bd-Dtt\"\", \"\"kKLjNc\"\", \"\"Y7TWfI\"\", \"\"idn:redpacketsecurity.com\"\", \"\"idn:eccouncil.org\"\", \"\"idn:comparaland.com\"\", \"\"idn:d335luupugsy2.cloudfront.net\"\", \"\"KVRURg\"\"], \"\"Timestamp\"\": \"\"2021-12-22T16:01:42.134Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: Khonsari Ransomware and Orcus RAT Exploit Log4Shell (CVE-2021-44228), Samples Uploaded on MalwareBazaar. Most recent link (Dec 17, 2021): https://app.recordedfuture.com/live/sc/4SWiMAS816Gj\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-12-17T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 79.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -285,15 +297,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://gxbrowser.net\",\"79\",\"2/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"53 sightings on 14 sources including: HackDig Posts, Anquanke News, mrhacker.co, Sesin at, Check Point Research. Most recent link (Feb 6, 2021): https://cdn.www.gob.pe/uploads/document/file/1580907/Alerta%20integrada%20de%20seguridad%20digital%20N%C2%B0%xxx-xx-xxxx-PECERT%20.pdf\"\", \"\"Sources\"\": [\"\"POs2u-\"\", \"\"U13S_U\"\", \"\"idn:mrhacker.co\"\", \"\"Z3TZAQ\"\", \"\"N4OmGX\"\", \"\"UqKvRr\"\", \"\"gBDK5G\"\", \"\"JExgHv\"\", \"\"QxXv_c\"\", \"\"J6UzbO\"\", \"\"eTNyK6\"\", \"\"idn:privacy.com.sg\"\", \"\"e6Ewt_\"\", \"\"idn:reportcybercrime.com\"\"], \"\"Timestamp\"\": \"\"2021-02-06T12:52:09.042Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Detected Malware Distribution\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-12-28T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentMalwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 79.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -366,15 +382,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"https://881.000webhostapp.com/1.txt\",\"78\",\"3/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"33 sightings on 12 sources including: Palo Alto Networks, tistory.com, HackDig Posts, Anquanke News, airmagnet.technology. Most recent tweet: Continued MR.Dropper's attack. (Targething korean cryptocurrency exchange) #hcapital #ioc MD5 : eb459b47be479b61375d7b3c7c568425 URL : hxxps://881[.]000webhostapp[.]com/1.txt PDB : D:\\\\Attack\\\\DropperBuild\\\\x64\\\\Release\\\\Dropper.pdb https://t.co/FpsinliQqx [Beyond The Binary]. Most recent link (Sep 3, 2018): https://twitter.com/wugeej/statuses/1036413512732426240\"\", \"\"Sources\"\": [\"\"JwO7jp\"\", \"\"idn:tistory.com\"\", \"\"POs2u-\"\", \"\"U13S_U\"\", \"\"ThoB0I\"\", \"\"idn:airmagnet.technology\"\", \"\"LErKlN\"\", \"\"WuLz1r\"\", \"\"KdwTwF\"\", \"\"VfsacJ\"\", \"\"jjf3_B\"\", \"\"idn:brica.de\"\"], \"\"Timestamp\"\": \"\"2018-09-03T00:40:11.000Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Referenced by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"2 sightings on 1 source: Insikt Group. 2 reports including \\\"\"Fractured Block” Campaign Targets Korean Users. Most recent link (Dec 09, 2018): https://app.recordedfuture.com/live/sc/1RuTxKrDf8Qt\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2018-12-09T00:00:00.000Z\"\", \"\"Name\"\": \"\"relatedNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Active URL on Weaponized Domain\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: 000Webhost. Behavior observed: Malware Distribution. Last observed on Oct 16, 2021.\"\", \"\"Sources\"\": [\"\"report:aRJ1CU\"\"], \"\"Timestamp\"\": \"\"2021-12-29T07:07:42.477Z\"\", \"\"Name\"\": \"\"recentWeaponizedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 78.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -459,15 +479,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://comunicador.duckdns.org/catalista/lixo/index.php\",\"78\",\"4/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"38 sightings on 7 sources including: cybersecdn.com, WeLiveSecurity Spain, deepcheck.one, hackeridiot.com, PasteBin. Most recent link (May 27, 2021): https://cybersecdn.com/index.php/2021/05/27/janeleiro-the-time-traveler-a-new-old-banking-trojan-in-brazil/\"\", \"\"Sources\"\": [\"\"idn:cybersecdn.com\"\", \"\"fWD1r9\"\", \"\"idn:deepcheck.one\"\", \"\"idn:hackeridiot.com\"\", \"\"Jv_xrR\"\", \"\"ONMgMx\"\", \"\"idn:nationalcybersecuritynews.today\"\"], \"\"Timestamp\"\": \"\"2021-05-27T22:48:00.256Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Distribution\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Jun 15, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-06-15T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: New Janeleiro Banking Trojan Targets Corporate Users in Brazil. Most recent link (Apr 06, 2021): https://app.recordedfuture.com/live/sc/4wolQHrxLiwd\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-04-06T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Recently Active URL on Weaponized Domain\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: DuckDNS. Behavior observed: Malware Distribution. Last observed on Oct 15, 2021.\"\", \"\"Sources\"\": [\"\"report:aRJ1CU\"\"], \"\"Timestamp\"\": \"\"2021-12-29T06:34:00.698Z\"\", \"\"Name\"\": \"\"recentWeaponizedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 78.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -560,15 +584,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"https://www.jeanninecatddns.chickenkiller.com/signin-authflow\",\"75\",\"3/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Recently Active URL on Weaponized Domain\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Recorded Future Domain Analysis URLs. Service provider: Afraid.org. Behavior observed: Malware Distribution, Phishing Techniques. Last observed on Dec 28, 2021.\"\", \"\"Sources\"\": [\"\"report:aRJ1CU\"\"], \"\"Timestamp\"\": \"\"2021-12-28T22:15:49.631Z\"\", \"\"Name\"\": \"\"recentWeaponizedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Recently Detected Phishing Techniques\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"2 sightings on 2 sources: Bitdefender, Urlscan.io. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\", \"\"eKv4Jm\"\"], \"\"Timestamp\"\": \"\"2021-12-28T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentPhishingSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}, {\"\"Rule\"\": \"\"Recently Detected Malware Distribution\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Dec 28, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-12-28T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentMalwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -638,15 +666,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"http://coollab.jp/dir/root/p/09908.js\",\"75\",\"3/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"24 sightings on 9 sources including: Malware News - Malware Analysis, News and Indicators, microsoft.com, sociabble.com, 4-traders.com, MarketScreener.com | Stock Market News. Most recent link (Aug 13, 2021): https://www.marketscreener.com/quote/stock/MICROSOFT-CORPORATION-4835/news/Microsoft-Attackers-use-Morse-code-other-encryption-methods-in-evasive-phishing-campaign-36161110/?utm_medium=RSS\u0026utm_content=20210813\"\", \"\"Sources\"\": [\"\"gBDK5G\"\", \"\"idn:microsoft.com\"\", \"\"idn:sociabble.com\"\", \"\"KBTQ2e\"\", \"\"dCotni\"\", \"\"g9rk5F\"\", \"\"Z7kln5\"\", \"\"idn:cda.ms\"\", \"\"idn:thewindowsupdate.com\"\"], \"\"Timestamp\"\": \"\"2021-08-13T17:03:19.000Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Malware Distribution\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on Aug 13, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-08-13T00:00:00.000Z\"\", \"\"Name\"\": \"\"malwareSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: Microsoft Warns of Attacks Targeting Microsoft Office 365 Users. Most recent link (Aug 12, 2021): https://app.recordedfuture.com/live/sc/4BBhpn1ApBQR\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-08-12T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -729,15 +761,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"https://blog.br0vvnn.io\",\"75\",\"3/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539\"\", \"\"Sources\"\": [\"\"Gzt\"\", \"\"idn:eccouncil.org\"\", \"\"idn:frsecure.com\"\", \"\"J-8-Nr\"\", \"\"Jv_xrR\"\", \"\"g9rk5F\"\", \"\"cUg0pv\"\", \"\"K5LKj8\"\", \"\"fVAueu\"\"], \"\"Timestamp\"\": \"\"2021-01-27T05:14:38.000Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Phishing Techniques\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-05-30T00:00:00.000Z\"\", \"\"Name\"\": \"\"phishingSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-01-25T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ @@ -818,15 +854,19 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", "kind": "enrichment", "original": "\"example.net/%e3%83%9d%e3%82%b1%e3%83%a2%e3%83%b3-%e3%82%bb%e3%83%b3%e3%82%bf%e3%83%bc-%e6%a8%aa%e6%b5%9c-%e7%a7%bb%e8%bb%a2-%e3%81%aa%e3%81%9c/%e3%81%b5%e3%82%8b%e3%81%95%e3%81%a8-%e7%b4%8d%e7%a8%8e-%e3%83%88%e3%82%a4%e3%83%ac%e3%83%83%e3%83%88-%e3%83%9a%e3%83%bc%e3%83%91%e3%83%bc-%e9%82%84%e5%85%83-%e7%8e%87/%e6%9c%9d%e6%97%a5-%e6%96%b0%e8%81%9e-be-%e3%83%91%e3%82%ba%e3%83%a\",\"75\",\"3/24\",\"{\"\"EvidenceDetails\"\": [{\"\"Rule\"\": \"\"Historically Reported as a Defanged URL\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"23 sightings on 9 sources including: The Official Google Blog, eccouncil.org, frsecure.com, SoyaCincau, PasteBin. Most recent tweet: Actor controlled sites and accounts Research Blog https://blog.br0vvnn[.]io. Most recent link (Jan 27, 2021): https://twitter.com/techn0m4nc3r/statuses/1354296736357953539\"\", \"\"Sources\"\": [\"\"Gzt\"\", \"\"idn:eccouncil.org\"\", \"\"idn:frsecure.com\"\", \"\"J-8-Nr\"\", \"\"Jv_xrR\"\", \"\"g9rk5F\"\", \"\"cUg0pv\"\", \"\"K5LKj8\"\", \"\"fVAueu\"\"], \"\"Timestamp\"\": \"\"2021-01-27T05:14:38.000Z\"\", \"\"Name\"\": \"\"defangedURL\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Historically Detected Phishing Techniques\"\", \"\"CriticalityLabel\"\": \"\"Unusual\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Bitdefender. Detected malicious behavior from an endpoint agent via global telemetry. Last observed on May 30, 2021.\"\", \"\"Sources\"\": [\"\"d3Awkm\"\"], \"\"Timestamp\"\": \"\"2021-05-30T00:00:00.000Z\"\", \"\"Name\"\": \"\"phishingSiteDetected\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 1.0}, {\"\"Rule\"\": \"\"Recently Reported by Insikt Group\"\", \"\"CriticalityLabel\"\": \"\"Malicious\"\", \"\"EvidenceString\"\": \"\"1 sighting on 1 source: Insikt Group. 1 report: Google Warns of Ongoing Attacks Targeting Security Researchers. Most recent link (Jan 25, 2021): https://app.recordedfuture.com/live/sc/5QCqZ2ZH4lwc\"\", \"\"Sources\"\": [\"\"VKz42X\"\"], \"\"Timestamp\"\": \"\"2021-01-25T00:00:00.000Z\"\", \"\"Name\"\": \"\"recentAnalystNote\"\", \"\"MitigationString\"\": \"\"\"\", \"\"Criticality\"\": 3.0}]}\"", "risk_score": 75.0, - "type": "indicator" + "type": [ + "indicator" + ] }, "recordedfuture": { "evidence_details": [ diff --git a/packages/ti_recordedfuture/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/ti_recordedfuture/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index 1d477017728..3ed8cab3932 100644 --- a/packages/ti_recordedfuture/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_recordedfuture/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -6,7 +6,7 @@ processors: # - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.dataset value: "ti_recordedfuture.threat" @@ -15,10 +15,10 @@ processors: value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] - set: field: threat.feed.name value: "Recorded Future" diff --git a/packages/ti_recordedfuture/data_stream/threat/manifest.yml b/packages/ti_recordedfuture/data_stream/threat/manifest.yml index a468152fa56..118a0c24b43 100644 --- a/packages/ti_recordedfuture/data_stream/threat/manifest.yml +++ b/packages/ti_recordedfuture/data_stream/threat/manifest.yml @@ -80,7 +80,7 @@ streams: type: text title: Request timeout for the risklist download. description: > - Must provide enough time for downloading and processing the risklist. Use Go Duration syntax (eg. 5m) + Must provide enough time for downloading and processing the risklist. Valid time units are ns, us, ms, s, m, h. default: "5m" multi: false diff --git a/packages/ti_recordedfuture/data_stream/threat/sample_event.json b/packages/ti_recordedfuture/data_stream/threat/sample_event.json index 33637385675..39b00808d8e 100644 --- a/packages/ti_recordedfuture/data_stream/threat/sample_event.json +++ b/packages/ti_recordedfuture/data_stream/threat/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2023-05-31T11:13:32.635Z", + "@timestamp": "2023-08-29T13:05:30.615Z", "agent": { - "ephemeral_id": "e583bff6-64ed-4587-8eda-0a4f5249d2b4", - "id": "214e2522-a0a5-4ad8-bbc2-412caa5e26c4", + "ephemeral_id": "4d3f7527-f999-48d2-920c-3ec5a0b34414", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_recordedfuture.threat", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "214e2522-a0a5-4ad8-bbc2-412caa5e26c4", - "snapshot": true, - "version": "8.8.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", - "ingested": "2023-05-31T11:13:33Z", + "ingested": "2023-08-29T13:05:31Z", "kind": "enrichment", "risk_score": 87, "timezone": "+00:00", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "log" diff --git a/packages/ti_recordedfuture/docs/README.md b/packages/ti_recordedfuture/docs/README.md index c83d5b5b3ee..b96b398a753 100644 --- a/packages/ti_recordedfuture/docs/README.md +++ b/packages/ti_recordedfuture/docs/README.md @@ -23,13 +23,13 @@ An example event for `threat` looks as following: ```json { - "@timestamp": "2023-05-31T11:13:32.635Z", + "@timestamp": "2023-08-29T13:05:30.615Z", "agent": { - "ephemeral_id": "e583bff6-64ed-4587-8eda-0a4f5249d2b4", - "id": "214e2522-a0a5-4ad8-bbc2-412caa5e26c4", + "ephemeral_id": "4d3f7527-f999-48d2-920c-3ec5a0b34414", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.8.0" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_recordedfuture.threat", @@ -37,22 +37,26 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "214e2522-a0a5-4ad8-bbc2-412caa5e26c4", - "snapshot": true, - "version": "8.8.0" + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", + "snapshot": false, + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", + "category": [ + "threat" + ], "dataset": "ti_recordedfuture.threat", - "ingested": "2023-05-31T11:13:33Z", + "ingested": "2023-08-29T13:05:31Z", "kind": "enrichment", "risk_score": 87, "timezone": "+00:00", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "log" @@ -167,10 +171,10 @@ An example event for `threat` looks as following: | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | diff --git a/packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/manifest.yml b/packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/manifest.yml index 79f3df8107b..f5296fd0c0a 100644 --- a/packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/manifest.yml +++ b/packages/ti_recordedfuture/elasticsearch/transform/latest_ioc/manifest.yml @@ -2,13 +2,13 @@ start: true destination_index_template: settings: index: - sort.field: - - "@timestamp" - sort.order: - - desc + sort: + field: + - "@timestamp" + order: + - desc mappings: dynamic: true - _meta: {} dynamic_templates: - strings_as_keyword: match_mapping_type: string diff --git a/packages/ti_recordedfuture/kibana/tags.yml b/packages/ti_recordedfuture/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_recordedfuture/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_recordedfuture/manifest.yml b/packages/ti_recordedfuture/manifest.yml index 177e5b010b7..a4aa8131f26 100644 --- a/packages/ti_recordedfuture/manifest.yml +++ b/packages/ti_recordedfuture/manifest.yml @@ -1,14 +1,13 @@ name: ti_recordedfuture title: Recorded Future -version: "1.12.0" -release: ga +version: "1.16.0" description: Ingest threat intelligence indicators from Recorded Future risk lists with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: 2.11.0 categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.8.0 + kibana: + version: ^8.8.0 icons: - src: /img/logo.svg title: Recorded Future diff --git a/packages/ti_threatq/_dev/build/build.yml b/packages/ti_threatq/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/ti_threatq/_dev/build/build.yml +++ b/packages/ti_threatq/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/ti_threatq/changelog.yml b/packages/ti_threatq/changelog.yml index 5309c8f4f79..2cc194a96ff 100644 --- a/packages/ti_threatq/changelog.yml +++ b/packages/ti_threatq/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.18.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.17.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.16.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7589 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.14.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.13.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-no-preserve-ndjson.log-expected.json b/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-no-preserve-ndjson.log-expected.json index 9ac505b393f..80fa0615259 100644 --- a/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-no-preserve-ndjson.log-expected.json +++ b/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-no-preserve-ndjson.log-expected.json @@ -3,12 +3,16 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "threat": { "indicator": { @@ -48,12 +52,16 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "threat": { "indicator": { @@ -93,12 +101,16 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", - "type": "indicator" + "type": [ + "indicator" + ] }, "threat": { "indicator": { diff --git a/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-sample-ndjson.log-expected.json b/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-sample-ndjson.log-expected.json index 3d647ea0786..ab67904dc8d 100644 --- a/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-sample-ndjson.log-expected.json +++ b/packages/ti_threatq/data_stream/threat/_dev/test/pipeline/test-threatq-sample-ndjson.log-expected.json @@ -3,13 +3,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1877,\"indicator_id\":336,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1878,\"indicator_id\":336,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"MP\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1879,\"indicator_id\":336,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Saipan\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1880,\"indicator_id\":336,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1881,\"indicator_id\":336,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1882,\"indicator_id\":336,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"1ece659dcec98b1e1141160b55655c96\",\"id\":336,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":336,\"indicator_id\":336,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -52,13 +56,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1883,\"indicator_id\":337,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1884,\"indicator_id\":337,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1885,\"indicator_id\":337,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1886,\"indicator_id\":337,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1887,\"indicator_id\":337,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1888,\"indicator_id\":337,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Sacramento\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"73c98d43519990c841a5d022546fedd4\",\"id\":337,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":337,\"indicator_id\":337,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -101,13 +109,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1889,\"indicator_id\":338,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1890,\"indicator_id\":338,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1891,\"indicator_id\":338,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1892,\"indicator_id\":338,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1893,\"indicator_id\":338,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"New York\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1894,\"indicator_id\":338,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"a9c6773919112627495d87c51fe89b15\",\"id\":338,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":338,\"indicator_id\":338,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -150,13 +162,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:43\",\"id\":184,\"indicator_id\":34,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:35:49\",\"updated_at\":\"2020-10-15 14:35:49\",\"value\":\"4\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:43\",\"id\":185,\"indicator_id\":34,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:35:49\",\"updated_at\":\"2020-10-15 14:35:49\",\"value\":\"3\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:43\",\"id\":186,\"indicator_id\":34,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:35:49\",\"updated_at\":\"2020-10-15 14:35:49\",\"value\":\"Malicious Host\"},{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:43\",\"id\":187,\"indicator_id\":34,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:35:49\",\"updated_at\":\"2020-10-15 14:35:49\",\"value\":\"2\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:41\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:02\",\"hash\":\"56f3cb07a9055f52947bb4c4244f762d\",\"id\":34,\"published_at\":\"2020-09-11 14:35:41\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:43\",\"creator_source_id\":12,\"id\":34,\"indicator_id\":34,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:43\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:35:49\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -193,13 +209,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1901,\"indicator_id\":340,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1902,\"indicator_id\":340,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1903,\"indicator_id\":340,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1904,\"indicator_id\":340,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1905,\"indicator_id\":340,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1906,\"indicator_id\":340,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Sacramento\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"97624a37200db6ba0bcfce8c9c28f527\",\"id\":340,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":340,\"indicator_id\":340,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -242,13 +262,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1907,\"indicator_id\":341,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1908,\"indicator_id\":341,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1909,\"indicator_id\":341,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1910,\"indicator_id\":341,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Houston\"},{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1911,\"indicator_id\":341,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1912,\"indicator_id\":341,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"56a1917632c03f230c5645f432e71495\",\"id\":341,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":341,\"indicator_id\":341,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\",\"provider\":\"testprovider\",\"tlp_name\":\"testtlp\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -294,13 +318,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1913,\"indicator_id\":342,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1914,\"indicator_id\":342,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Fort Lauderdale\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1915,\"indicator_id\":342,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1916,\"indicator_id\":342,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1917,\"indicator_id\":342,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1918,\"indicator_id\":342,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"6de45834c2a81597b59a91ead4fbdf59\",\"id\":342,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":342,\"indicator_id\":342,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -343,13 +371,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1919,\"indicator_id\":343,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1920,\"indicator_id\":343,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Pompano Beach\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1921,\"indicator_id\":343,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1922,\"indicator_id\":343,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1923,\"indicator_id\":343,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1924,\"indicator_id\":343,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"994a4586b27e46db67a59220ab6dd73f\",\"id\":343,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":343,\"indicator_id\":343,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -392,13 +424,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1937,\"indicator_id\":346,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1938,\"indicator_id\":346,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1939,\"indicator_id\":346,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1940,\"indicator_id\":346,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1941,\"indicator_id\":346,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Little Elm\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1942,\"indicator_id\":346,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"40e81e10007099902cf40cfe3a8227dc\",\"id\":346,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":346,\"indicator_id\":346,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" @@ -441,13 +477,17 @@ { "@timestamp": "2020-11-15T00:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "threat", + "category": [ + "threat" + ], "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":7,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1943,\"indicator_id\":347,\"name\":\"AlienVault Threat Level\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"2\"},{\"attribute_id\":4,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1944,\"indicator_id\":347,\"name\":\"Country\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"US\"},{\"attribute_id\":3,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1945,\"indicator_id\":347,\"name\":\"Description\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Malicious Host\"},{\"attribute_id\":6,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1946,\"indicator_id\":347,\"name\":\"AlienVault Revision\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"3\"},{\"attribute_id\":5,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1947,\"indicator_id\":347,\"name\":\"City\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"Dallas\"},{\"attribute_id\":8,\"created_at\":\"2020-09-11 14:35:53\",\"id\":1948,\"indicator_id\":347,\"name\":\"AlienVault Reliability\",\"touched_at\":\"2020-10-15 14:36:00\",\"updated_at\":\"2020-10-15 14:36:00\",\"value\":\"4\"}],\"class\":\"network\",\"created_at\":\"2020-09-11 14:35:51\",\"expired_at\":\"2020-11-15 00:00:02\",\"expires_calculated_at\":\"2020-10-15 14:40:03\",\"hash\":\"418a88a2a1bac6980a7d83e6b2b2a27d\",\"id\":347,\"published_at\":\"2020-09-11 14:35:51\",\"score\":4,\"sources\":[{\"created_at\":\"2020-09-11 14:35:53\",\"creator_source_id\":12,\"id\":347,\"indicator_id\":347,\"indicator_status_id\":2,\"indicator_type_id\":15,\"name\":\"AlienVault OTX\",\"published_at\":\"2020-09-11 14:35:53\",\"reference_id\":1,\"source_expire_days\":\"30\",\"source_id\":12,\"source_score\":1,\"source_type\":\"connectors\",\"updated_at\":\"2020-10-15 14:36:00\"}],\"status\":{\"description\":\"No longer poses a serious threat.\",\"id\":2,\"name\":\"Expired\"},\"status_id\":2,\"touched_at\":\"2021-06-07 19:47:27\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2020-11-15 00:00:02\",\"value\":\"89.160.20.156\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "tags": [ "preserve_original_event" diff --git a/packages/ti_threatq/data_stream/threat/elasticsearch/ingest_pipeline/default.yml b/packages/ti_threatq/data_stream/threat/elasticsearch/ingest_pipeline/default.yml index 6a99eb33ed4..7fb7d700f67 100644 --- a/packages/ti_threatq/data_stream/threat/elasticsearch/ingest_pipeline/default.yml +++ b/packages/ti_threatq/data_stream/threat/elasticsearch/ingest_pipeline/default.yml @@ -6,16 +6,16 @@ processors: #################### - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: enrichment - set: field: event.category - value: threat + value: [threat] - set: field: event.type - value: indicator + value: [indicator] ############### # Parse dates # diff --git a/packages/ti_threatq/data_stream/threat/manifest.yml b/packages/ti_threatq/data_stream/threat/manifest.yml index d6313e00e21..eaa18c5938d 100644 --- a/packages/ti_threatq/data_stream/threat/manifest.yml +++ b/packages/ti_threatq/data_stream/threat/manifest.yml @@ -50,6 +50,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: false @@ -64,6 +65,7 @@ streams: - name: interval type: text title: Interval + description: Interval at which the logs will be pulled. Supported units for this parameter are h/m/s. multi: false required: true show_user: true diff --git a/packages/ti_threatq/data_stream/threat/sample_event.json b/packages/ti_threatq/data_stream/threat/sample_event.json index 65423fe2ab1..c025e08e1c7 100644 --- a/packages/ti_threatq/data_stream/threat/sample_event.json +++ b/packages/ti_threatq/data_stream/threat/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-10-01T18:36:03.000Z", "agent": { - "ephemeral_id": "9d50b50e-cf01-4905-b2ed-3557c6d540db", - "id": "a7be703c-0d78-40ea-8ad7-a02245cca635", + "ephemeral_id": "37eb63bd-5e42-4366-be2e-c82dfceae102", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_threatq.threat", @@ -13,22 +13,26 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a7be703c-0d78-40ea-8ad7-a02245cca635", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.3.2" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-01T16:06:47.804Z", + "category": [ + "threat" + ], + "created": "2023-08-29T13:46:54.929Z", "dataset": "ti_threatq.threat", - "ingested": "2022-08-01T16:06:48Z", + "ingested": "2023-08-29T13:46:57Z", "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":5,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893068,\"indicator_id\":106767,\"name\":\"Contact\",\"touched_at\":\"2021-10-24 18:36:10\",\"updated_at\":\"2021-10-24 18:36:10\",\"value\":\"email:Quetzalcoatl_relays[]protonmail.com url:https://quetzalcoatl-relays.org proof:uri-rsa hoster:frantech.ca\"},{\"attribute_id\":9,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893069,\"indicator_id\":106767,\"name\":\"Router Port\",\"touched_at\":\"2021-10-24 18:36:10\",\"updated_at\":\"2021-10-24 18:36:10\",\"value\":\"9000\"},{\"attribute_id\":6,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893070,\"indicator_id\":106767,\"name\":\"Flags\",\"touched_at\":\"2021-10-02 18:36:08\",\"updated_at\":\"2021-10-02 18:36:08\",\"value\":\"ERDV\"}],\"class\":\"network\",\"created_at\":\"2021-10-01 18:36:03\",\"expires_calculated_at\":\"2021-10-23 18:40:17\",\"hash\":\"69beef49fdbd1f54eef3cab324c7b6cf\",\"id\":106767,\"published_at\":\"2021-10-01 18:36:03\",\"score\":0,\"sources\":[{\"created_at\":\"2021-10-01 18:36:06\",\"creator_source_id\":12,\"id\":3699669,\"indicator_id\":106767,\"indicator_status_id\":1,\"indicator_type_id\":15,\"name\":\"www.dan.me.uk Tor Node List\",\"published_at\":\"2021-10-01 18:36:06\",\"reference_id\":37,\"source_id\":12,\"source_type\":\"connectors\",\"updated_at\":\"2021-10-24 18:36:10\"}],\"status\":{\"description\":\"Poses a threat and is being exported to detection tools.\",\"id\":1,\"name\":\"Active\"},\"status_id\":1,\"touched_at\":\"2021-10-24 18:36:10\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2021-10-01 18:36:03\",\"value\":\"107.189.1.90\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_threatq/docs/README.md b/packages/ti_threatq/docs/README.md index 29ab5d2615d..3fba12b0783 100644 --- a/packages/ti_threatq/docs/README.md +++ b/packages/ti_threatq/docs/README.md @@ -34,10 +34,10 @@ By default the indicators will be collected every 1 minute, and deduplication is | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -106,11 +106,11 @@ An example event for `threat` looks as following: { "@timestamp": "2021-10-01T18:36:03.000Z", "agent": { - "ephemeral_id": "9d50b50e-cf01-4905-b2ed-3557c6d540db", - "id": "a7be703c-0d78-40ea-8ad7-a02245cca635", + "ephemeral_id": "37eb63bd-5e42-4366-be2e-c82dfceae102", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.3.2" + "version": "8.9.1" }, "data_stream": { "dataset": "ti_threatq.threat", @@ -118,22 +118,26 @@ An example event for `threat` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "a7be703c-0d78-40ea-8ad7-a02245cca635", + "id": "5607d6f4-6e45-4c33-a087-2e07de5f0082", "snapshot": false, - "version": "8.3.2" + "version": "8.9.1" }, "event": { "agent_id_status": "verified", - "category": "threat", - "created": "2022-08-01T16:06:47.804Z", + "category": [ + "threat" + ], + "created": "2023-08-29T13:46:54.929Z", "dataset": "ti_threatq.threat", - "ingested": "2022-08-01T16:06:48Z", + "ingested": "2023-08-29T13:46:57Z", "kind": "enrichment", "original": "{\"adversaries\":[],\"attributes\":[{\"attribute_id\":5,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893068,\"indicator_id\":106767,\"name\":\"Contact\",\"touched_at\":\"2021-10-24 18:36:10\",\"updated_at\":\"2021-10-24 18:36:10\",\"value\":\"email:Quetzalcoatl_relays[]protonmail.com url:https://quetzalcoatl-relays.org proof:uri-rsa hoster:frantech.ca\"},{\"attribute_id\":9,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893069,\"indicator_id\":106767,\"name\":\"Router Port\",\"touched_at\":\"2021-10-24 18:36:10\",\"updated_at\":\"2021-10-24 18:36:10\",\"value\":\"9000\"},{\"attribute_id\":6,\"created_at\":\"2021-10-01 18:36:06\",\"id\":4893070,\"indicator_id\":106767,\"name\":\"Flags\",\"touched_at\":\"2021-10-02 18:36:08\",\"updated_at\":\"2021-10-02 18:36:08\",\"value\":\"ERDV\"}],\"class\":\"network\",\"created_at\":\"2021-10-01 18:36:03\",\"expires_calculated_at\":\"2021-10-23 18:40:17\",\"hash\":\"69beef49fdbd1f54eef3cab324c7b6cf\",\"id\":106767,\"published_at\":\"2021-10-01 18:36:03\",\"score\":0,\"sources\":[{\"created_at\":\"2021-10-01 18:36:06\",\"creator_source_id\":12,\"id\":3699669,\"indicator_id\":106767,\"indicator_status_id\":1,\"indicator_type_id\":15,\"name\":\"www.dan.me.uk Tor Node List\",\"published_at\":\"2021-10-01 18:36:06\",\"reference_id\":37,\"source_id\":12,\"source_type\":\"connectors\",\"updated_at\":\"2021-10-24 18:36:10\"}],\"status\":{\"description\":\"Poses a threat and is being exported to detection tools.\",\"id\":1,\"name\":\"Active\"},\"status_id\":1,\"touched_at\":\"2021-10-24 18:36:10\",\"type\":{\"class\":\"network\",\"id\":15,\"name\":\"IP Address\"},\"type_id\":15,\"updated_at\":\"2021-10-01 18:36:03\",\"value\":\"107.189.1.90\"}", - "type": "indicator" + "type": [ + "indicator" + ] }, "input": { "type": "httpjson" diff --git a/packages/ti_threatq/kibana/tags.yml b/packages/ti_threatq/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_threatq/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_threatq/manifest.yml b/packages/ti_threatq/manifest.yml index b8819524d2a..761b34bc690 100644 --- a/packages/ti_threatq/manifest.yml +++ b/packages/ti_threatq/manifest.yml @@ -1,14 +1,13 @@ name: ti_threatq title: ThreatQuotient -version: "1.12.0" -release: ga +version: "1.18.0" description: Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent. type: integration -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: ["security", "threat_intel"] conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 icons: - src: /img/threatq.svg title: ThreatQuotient @@ -24,3 +23,4 @@ policy_templates: description: "Ingest threat intelligence indicators from ThreatQuotient with Elastic Agent." owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/ti_util/changelog.yml b/packages/ti_util/changelog.yml index 38a4d9094a6..308cb563ce6 100644 --- a/packages/ti_util/changelog.yml +++ b/packages/ti_util/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.3" + changes: + - description: Fix the query type for matching 'event.dataset'. + type: bugfix + link: https://github.com/elastic/integrations/pull/7731 +- version: "1.2.2" + changes: + - description: Update to use new Threat Indicator Match rule names. + type: bugfix + link: https://github.com/elastic/integrations/pull/6942 - version: "1.2.1" changes: - description: Update to use security-solution-default. diff --git a/packages/ti_util/kibana/dashboard/ti_util-9eff2529-fff5-4064-b825-fa089f260bfa.json b/packages/ti_util/kibana/dashboard/ti_util-9eff2529-fff5-4064-b825-fa089f260bfa.json index 5ea9cf3704f..2b5073f2f5e 100644 --- a/packages/ti_util/kibana/dashboard/ti_util-9eff2529-fff5-4064-b825-fa089f260bfa.json +++ b/packages/ti_util/kibana/dashboard/ti_util-9eff2529-fff5-4064-b825-fa089f260bfa.json @@ -123,10 +123,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -216,14 +216,39 @@ "index": "c4f72a3f-d887-4210-8a8c-a7580687c5d3", "key": "kibana.alert.rule.name", "negate": false, - "params": { - "query": "Threat Intel Indicator Match" - }, - "type": "phrase" + "params": [ + "Threat Intel IP Address Indicator Match", + "Threat Intel Hash Indicator Match", + "Threat Intel Windows Registry Indicator Match", + "Threat Intel URL Indicator Match" + ], + "type": "phrases" }, "query": { - "match_phrase": { - "kibana.alert.rule.name": "Threat Intel Indicator Match" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel IP Address Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel Hash Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel Windows Registry Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel URL Indicator Match" + } + } + ] } } } @@ -391,10 +416,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -539,10 +564,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -683,10 +708,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -797,14 +822,39 @@ "index": "69de1ad2-e63e-4d3f-bd3a-0531efbf7b2f", "key": "kibana.alert.rule.name", "negate": false, - "params": { - "query": "Threat Intel Indicator Match" - }, - "type": "phrase" + "params": [ + "Threat Intel IP Address Indicator Match", + "Threat Intel Hash Indicator Match", + "Threat Intel Windows Registry Indicator Match", + "Threat Intel URL Indicator Match" + ], + "type": "phrases" }, "query": { - "match_phrase": { - "kibana.alert.rule.name": "Threat Intel Indicator Match" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel IP Address Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel Hash Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel Windows Registry Indicator Match" + } + }, + { + "match_phrase": { + "kibana.alert.rule.name": "Threat Intel URL Indicator Match" + } + } + ] } } } @@ -993,10 +1043,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -1175,10 +1225,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } @@ -1328,10 +1378,10 @@ "params": { "query": "ti_*" }, - "type": "phrase" + "type": "wildcard" }, "query": { - "match_phrase": { + "wildcard": { "event.dataset": "ti_*" } } diff --git a/packages/ti_util/kibana/tags.yml b/packages/ti_util/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/ti_util/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/ti_util/manifest.yml b/packages/ti_util/manifest.yml index 4ffec79664b..74fc5497da4 100644 --- a/packages/ti_util/manifest.yml +++ b/packages/ti_util/manifest.yml @@ -1,13 +1,14 @@ name: ti_util title: "Threat Intelligence Utilities" -version: 1.2.1 +version: "1.4.0" description: Prebuilt Threat Intelligence dashboard for Elastic Security categories: - security - threat_intel conditions: - kibana.version: ^8.4.0 -format_version: 2.7.0 + kibana: + version: ^8.5.0 +format_version: "3.0.0" type: integration screenshots: - src: /img/threat-intel-overview.png @@ -20,4 +21,4 @@ icons: type: image/svg+xml owner: github: elastic/security-external-integrations - + type: elastic diff --git a/packages/tines/_dev/build/build.yml b/packages/tines/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/tines/_dev/build/build.yml +++ b/packages/tines/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/tines/changelog.yml b/packages/tines/changelog.yml index 278feffcff9..8d9ed38b27e 100644 --- a/packages/tines/changelog.yml +++ b/packages/tines/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.4.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.3.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.2.1" + changes: + - description: Remove version attribute from ingest node pipelines. + type: bugfix + link: https://github.com/elastic/integrations/pull/7807 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.1.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.0.0" changes: - description: Release Tines as GA. diff --git a/packages/tines/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml b/packages/tines/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml index 04476d39610..7e8f826ef65 100644 --- a/packages/tines/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tines/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 1 description: Pipeline for Tines Audit Logs processors: - json: diff --git a/packages/tines/data_stream/audit_logs/manifest.yml b/packages/tines/data_stream/audit_logs/manifest.yml index 2994f2d58d7..138f0de775a 100644 --- a/packages/tines/data_stream/audit_logs/manifest.yml +++ b/packages/tines/data_stream/audit_logs/manifest.yml @@ -38,7 +38,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false @@ -60,7 +60,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: Period of historical audit logs to collect when first collection request occurs + description: Period of historical audit logs to collect when first collection request occurs. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/tines/data_stream/time_saved/elasticsearch/ingest_pipeline/default.yml b/packages/tines/data_stream/time_saved/elasticsearch/ingest_pipeline/default.yml index 8b86e5fca24..3876134e885 100644 --- a/packages/tines/data_stream/time_saved/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tines/data_stream/time_saved/elasticsearch/ingest_pipeline/default.yml @@ -1,5 +1,4 @@ --- -version: 1 description: Pipeline for Tines Time Saved data processors: - json: diff --git a/packages/tines/data_stream/time_saved/manifest.yml b/packages/tines/data_stream/time_saved/manifest.yml index 11d32302cf5..f07c42ee091 100644 --- a/packages/tines/data_stream/time_saved/manifest.yml +++ b/packages/tines/data_stream/time_saved/manifest.yml @@ -38,7 +38,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the API. + description: Duration between requests to the API. Supported units for this parameter are h/m/s. multi: false required: true show_user: false @@ -76,7 +76,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: Period of historical audit logs to collect when first collection request occurs + description: Period of historical audit logs to collect when first collection request occurs. Supported units for this parameter are h/m/s. multi: false required: true show_user: false diff --git a/packages/tines/docs/README.md b/packages/tines/docs/README.md index 87da45ce365..5365e19bf33 100644 --- a/packages/tines/docs/README.md +++ b/packages/tines/docs/README.md @@ -74,10 +74,10 @@ All fields ingested to this data stream are stored under `tines.audit_log` as ea | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | @@ -344,10 +344,10 @@ All fields ingested to this data stream are stored under `tines.time_saved` as e | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | diff --git a/packages/tines/kibana/tags.yml b/packages/tines/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/tines/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/tines/manifest.yml b/packages/tines/manifest.yml index 77394783440..a27da5abc3d 100644 --- a/packages/tines/manifest.yml +++ b/packages/tines/manifest.yml @@ -1,15 +1,17 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: tines title: "Tines" -version: "1.0.0" +version: "1.4.0" description: "Tines Logs & Time Saved Reports" type: integration categories: - cloud - security conditions: - kibana.version: "^8.7.1" - elastic.subscription: "basic" + kibana: + version: "^8.7.1" + elastic: + subscription: "basic" screenshots: - src: /img/tines-audit-logs-dashboard.png title: Audit Logs @@ -59,3 +61,4 @@ policy_templates: required: true owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/traefik/changelog.yml b/packages/traefik/changelog.yml index 1b1350d4609..d21108bdca9 100644 --- a/packages/traefik/changelog.yml +++ b/packages/traefik/changelog.yml @@ -1,3 +1,8 @@ +- version: "1.8.1" + changes: + - description: Add null check and ignore_missing check to the rename processor + type: bugfix + link: https://github.com/elastic/integrations/pull/7845 - version: "1.8.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/traefik/data_stream/access/elasticsearch/ingest_pipeline/default.yml b/packages/traefik/data_stream/access/elasticsearch/ingest_pipeline/default.yml index 4b20d4a1d72..e051a1486b2 100644 --- a/packages/traefik/data_stream/access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/traefik/data_stream/access/elasticsearch/ingest_pipeline/default.yml @@ -15,6 +15,7 @@ processors: field: message target_field: event.original ignore_missing: true + if: 'ctx.event?.original == null' - grok: field: event.original patterns: diff --git a/packages/traefik/manifest.yml b/packages/traefik/manifest.yml index 28e29be02a7..52763fbd4b8 100644 --- a/packages/traefik/manifest.yml +++ b/packages/traefik/manifest.yml @@ -1,6 +1,6 @@ name: traefik title: Traefik -version: "1.8.0" +version: "1.8.1" release: ga description: Collect logs and metrics from Traefik servers with Elastic Agent. type: integration diff --git a/packages/trellix_edr_cloud/_dev/build/build.yml b/packages/trellix_edr_cloud/_dev/build/build.yml new file mode 100644 index 00000000000..c1af686e524 --- /dev/null +++ b/packages/trellix_edr_cloud/_dev/build/build.yml @@ -0,0 +1,4 @@ +dependencies: + ecs: + reference: git@v8.9.0 + import_mappings: true diff --git a/packages/trellix_edr_cloud/_dev/build/docs/README.md b/packages/trellix_edr_cloud/_dev/build/docs/README.md new file mode 100644 index 00000000000..f44fb28e0fd --- /dev/null +++ b/packages/trellix_edr_cloud/_dev/build/docs/README.md @@ -0,0 +1,121 @@ +# Trellix EDR Cloud + +This [Trellix EDR Cloud](https://www.trellix.com/en-us/products/edr.html) integration enables your detected threats and suspicious network data to be sent to Elastic Security via Amazon S3. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for threat protection, detection, and incident response. + +The Trellix EDR Cloud integration can be used in two different modes to collect data: +- AWS S3 polling mode: Trellix EDR Cloud writes data to S3, and Elastic Agent polls the S3 bucket by listing its contents and reading new files. +- AWS S3 SQS mode: Trellix EDR Cloud writes data to S3, S3 sends a notification of a new object to SQS, the Elastic Agent receives the notification from SQS, and then reads the S3 object. Multiple agents can be used in this mode. + +## Compatibility + +This module has been tested against the latest (June 05, 2023) Trellix EDR Cloud version. + +## Data streams + +The Trellix EDR Cloud integration collects logs for the following seventeen events: + +| Event Type | +|-----------------| +| API | +| Context Changed | +| DNS Query | +| EPP | +| File | +| Image Loaded | +| Named Pipe | +| Network | +| Process | +| RegKey | +| RegValue | +| Scheduled Task | +| Script Executed | +| Service | +| SysInfo | +| User | +| WMI | + + +**NOTE**: The Trellix EDR Cloud integration collects logs for the above mentioned events, but we have combined all of those in one data stream named `event`. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the S3 bucket and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data from an AWS S3 bucket, follow the below steps: + +1. Considering you already have an AWS S3 bucket setup, to configure it with Trellix EDR Cloud, follow the steps mentioned below: + - Login to your Trellix Admin Account, select Trellix ePO. + - Go to Policy Catalog -> Trellix EDR. + - Create a new policy by filling the required details and click OK. + - After creating a policy, click on edit for the policy you want to edit. + - Go to the Trace, fill in the details of the trace scanner and AWS S3 settings, and click on save. + - Now go to the system tree and click on the system to which you want to assign the policy. + - Go to Actions -> Agent -> Set Policy and Inheritance + - Select the product under policy as MVISION EDR, and select the policy that you want to assign to this system, and click save. + - Policy is assigned to the system, and the system trace logs will be sent to the AWS S3 bucket. +2. The default value of the field `Bucket List Prefix` is event/. + +### To collect data from AWS SQS, follow the below steps: + +1. Assuming you've already set up a connection to push data into the AWS bucket; if not, see the section above. +2. To set up an SQS queue, follow "Step 1: Create an Amazon SQS Queue" mentioned in the [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html). + - While creating an access policy, use the bucket name configured to create a connection for AWS S3 in Trellix EDR Cloud. +3. Configure event notifications for an S3 bucket. Follow this [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html). + - While creating `event notification` select the event type as s3:ObjectCreated:*, destination type SQS Queue, and select the queue name created in Step 2. + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations +2. In "Search for integrations" search bar, type Trellix EDR Cloud +3. Click on the "Trellix EDR Cloud" integration from the search results. +4. Click on the Add Trellix EDR Cloud Integration button to add the integration. +5. While adding the integration, if you want to collect logs via AWS S3, then you have to put the following details: + - access key id + - secret access key + - bucket arn + - collect logs via S3 Bucket toggled on + + or if you want to collect logs via AWS SQS, then you have to put the following details: + - access key id + - secret access key + - queue url + - region + - collect logs via S3 Bucket toggled off + +**NOTE**: There are other input combination options available, please check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html). + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +{{event "event"}} + +{{fields "event"}} diff --git a/packages/trellix_edr_cloud/changelog.yml b/packages/trellix_edr_cloud/changelog.yml new file mode 100644 index 00000000000..e543e61139f --- /dev/null +++ b/packages/trellix_edr_cloud/changelog.yml @@ -0,0 +1,16 @@ +# newer versions go on top +- version: 0.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "0.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "0.1.0" + changes: + - description: Initial release. + type: enhancement + link: https://github.com/elastic/integrations/pull/6697 diff --git a/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..be41bb0d476 --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,4 @@ +fields: + tags: + - preserve_original_event + - preserve_duplicate_custom_fields diff --git a/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log new file mode 100644 index 00000000000..6c251e083ea --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log @@ -0,0 +1 @@ +{"_ver":2107,"_serverId":"5B0539BF-0932-4BEA-BD12-EA52687E58BD","_eventType":"File Deleted","accessType":"connection_opened","_deviceId":"D435435b0-BB33-4625-891E-XXXXXXX","_parentEventId":"1XXXXX-8566-404c-87a3-a4c46017b87d","_eventId":"675XXXX-054c-48e8-9549-468dbb5ae5bc","_time":"2023-04-05T07:05:21.186Z","name":"Write Process Memory","authorName":"Example","data":"AAA9UFgBAAA=","arguments":["0x220a50d0000","0x1000","0x2"],"cmdLine":"\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update","result":"2085503003216","fileModificationDate":"2023-04-04T12:38:42.821Z","fileType":"PE","fileCreationDate":"2023-04-04T12:38:40.984Z","fileMd5":"A7F7A4EEC248E6C1841EC6D5B735357B","fileSha1":"B8F93C2963CF1415A3D1C49668BF56665E3DC334","fileSha256":"F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418","filePath":"C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll","fileSize":5632,"fileAttributes":32,"subsystem":3,"fileMagicBytes":"d0cf11e0a1b11ae1","direction":"outbound","dnsName":"content-autofill.example.com","pipeName":"\\\\.\\pipe\\Sessions\\3\\AppContainerNamedObjects\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929","destAddress":"81.2.69.192","destPort":443,"sourceAddress":"81.2.69.144","sourcePort":52376,"protocol":"tcp","taskName":"example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001","taskDescription":null,"dnsType":65,"dnsClass":1,"targetPid":1964,"pid": "2280","dnsNames":["XXX.YYY.cdn.live.net","ttt-XXX.YYY.net","SSS.YYY.cdn.live.net.XXX.net","aaa.dscd.XXX.net"],"action":"added","serviceName":"WD FILTER","serviceDescription":"Example Antivirus On-Access Malware Protection Mini-Filter Driver","serviceLoadOrderGroup":"FS FilterAnti-Virus","userName":"example user","userDomain":"DESKTOP-66XXX","userSid":"S-1-5-21-1323470238-68471550-93548180-1001","tagId":0,"commands":["%localappdata%\\XXXXXX\\OneDrive\\updater.exe"],"httpUrl":"https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows&osver=0.0.0.1.example.ni_release.220506-1250&appver=0.0.0.1","httpRequestHeaders":"GETsettings/v2.0/compat/appraiser?os=windows&osver=0.0.0.1.amd64fre.ni_release.220506-1250&appver=0.0.0.2600HTTP/1.1\r\nUser-Agent:MSDW\r\n","serviceType":2,"integrityLevel":4,"versionInfoFilename":"example.EXE","versionInfoFileVersion":"0.0.0.1(WinBuild.160101.0800)","versionInfoProductName":"XXXX®Windows®OperatingSystem","versionInfoProductVersion":"0.0.0.1194","versionInfoVendorName":"Example Corporation","serviceStartType":0,"keyName":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\XXXX\\SECURITY","keyValueName":"SECURITY","keyValueType":"REG_BINARY","keyValue":"01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000","keyOldValue":"01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000","certs":[[{"type":"signing","issuerName":"US,\"example,Inc.\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1","publicKeyHash":"47A58D30595525187338F85B7F8235FC919CE3FC"},{"type":"parent","issuerName":"US,example,www.example.com,ROOTCAA","publicKeyHash":"6837E0EBB63BF85F1186FBFE617B088865F44E42"},{"type":"parent","issuerName":"US,DigiCertInc,www.example.com,ROOTCA","publicKeyHash":"ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F"},{"type":"parent","issuerName":"US,DigiCertInc,www.example.com,ROOTCA","publicKeyHash":"45EBA2AFF492CB82312D518BA7A7219DF36DC80F"}]]} diff --git a/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log-expected.json b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log-expected.json new file mode 100644 index 00000000000..189127de0e7 --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log-expected.json @@ -0,0 +1,224 @@ +{ + "expected": [ + { + "@timestamp": "2023-04-05T07:05:21.186Z", + "destination": { + "ip": "81.2.69.192", + "port": 443 + }, + "device": { + "id": "D435435b0-BB33-4625-891E-XXXXXXX" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "added", + "category": [ + "file" + ], + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "kind": "event", + "original": "{\"_ver\":2107,\"_serverId\":\"5B0539BF-0932-4BEA-BD12-EA52687E58BD\",\"_eventType\":\"File Deleted\",\"accessType\":\"connection_opened\",\"_deviceId\":\"D435435b0-BB33-4625-891E-XXXXXXX\",\"_parentEventId\":\"1XXXXX-8566-404c-87a3-a4c46017b87d\",\"_eventId\":\"675XXXX-054c-48e8-9549-468dbb5ae5bc\",\"_time\":\"2023-04-05T07:05:21.186Z\",\"name\":\"Write Process Memory\",\"authorName\":\"Example\",\"data\":\"AAA9UFgBAAA=\",\"arguments\":[\"0x220a50d0000\",\"0x1000\",\"0x2\"],\"cmdLine\":\"\\\"C:\\\\Users\\\\XXXX\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\setup.exe\\\"/update\",\"result\":\"2085503003216\",\"fileModificationDate\":\"2023-04-04T12:38:42.821Z\",\"fileType\":\"PE\",\"fileCreationDate\":\"2023-04-04T12:38:40.984Z\",\"fileMd5\":\"A7F7A4EEC248E6C1841EC6D5B735357B\",\"fileSha1\":\"B8F93C2963CF1415A3D1C49668BF56665E3DC334\",\"fileSha256\":\"F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418\",\"filePath\":\"C:\\\\ProgramFiles\\\\WindowsApps\\\\Deleted\\\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\\\kk-KZ\\\\PPP.Console.XX.YY.dll\",\"fileSize\":5632,\"fileAttributes\":32,\"subsystem\":3,\"fileMagicBytes\":\"d0cf11e0a1b11ae1\",\"direction\":\"outbound\",\"dnsName\":\"content-autofill.example.com\",\"pipeName\":\"\\\\\\\\.\\\\pipe\\\\Sessions\\\\3\\\\AppContainerNamedObjects\\\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929\",\"destAddress\":\"81.2.69.192\",\"destPort\":443,\"sourceAddress\":\"81.2.69.144\",\"sourcePort\":52376,\"protocol\":\"tcp\",\"taskName\":\"example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001\",\"taskDescription\":null,\"dnsType\":65,\"dnsClass\":1,\"targetPid\":1964,\"pid\": \"2280\",\"dnsNames\":[\"XXX.YYY.cdn.live.net\",\"ttt-XXX.YYY.net\",\"SSS.YYY.cdn.live.net.XXX.net\",\"aaa.dscd.XXX.net\"],\"action\":\"added\",\"serviceName\":\"WD FILTER\",\"serviceDescription\":\"Example Antivirus On-Access Malware Protection Mini-Filter Driver\",\"serviceLoadOrderGroup\":\"FS FilterAnti-Virus\",\"userName\":\"example user\",\"userDomain\":\"DESKTOP-66XXX\",\"userSid\":\"S-1-5-21-1323470238-68471550-93548180-1001\",\"tagId\":0,\"commands\":[\"%localappdata%\\\\XXXXXX\\\\OneDrive\\\\updater.exe\"],\"httpUrl\":\"https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1\",\"httpRequestHeaders\":\"GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\\r\\nUser-Agent:MSDW\\r\\n\",\"serviceType\":2,\"integrityLevel\":4,\"versionInfoFilename\":\"example.EXE\",\"versionInfoFileVersion\":\"0.0.0.1(WinBuild.160101.0800)\",\"versionInfoProductName\":\"XXXX®Windows®OperatingSystem\",\"versionInfoProductVersion\":\"0.0.0.1194\",\"versionInfoVendorName\":\"Example Corporation\",\"serviceStartType\":0,\"keyName\":\"HKLM\\\\SYSTEM\\\\CONTROLSET001\\\\SERVICES\\\\XXXX\\\\SECURITY\",\"keyValueName\":\"SECURITY\",\"keyValueType\":\"REG_BINARY\",\"keyValue\":\"01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000\",\"keyOldValue\":\"01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000\",\"certs\":[[{\"type\":\"signing\",\"issuerName\":\"US,\\\"example,Inc.\\\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1\",\"publicKeyHash\":\"47A58D30595525187338F85B7F8235FC919CE3FC\"},{\"type\":\"parent\",\"issuerName\":\"US,example,www.example.com,ROOTCAA\",\"publicKeyHash\":\"6837E0EBB63BF85F1186FBFE617B088865F44E42\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"45EBA2AFF492CB82312D518BA7A7219DF36DC80F\"}]]}", + "type": [ + "deletion" + ] + }, + "file": { + "created": "2023-04-04T12:38:40.984Z", + "hash": { + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418" + }, + "mtime": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "size": 5632, + "type": "PE" + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "command_line": [ + "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "pid": 2280 + }, + "registry": { + "data": { + "type": "REG_BINARY" + } + }, + "related": { + "hash": [ + "A7F7A4EEC248E6C1841EC6D5B735357B", + "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "47A58D30595525187338F85B7F8235FC919CE3FC", + "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "45EBA2AFF492CB82312D518BA7A7219DF36DC80F" + ], + "ip": [ + "81.2.69.192", + "81.2.69.144" + ], + "user": [ + "DESKTOP-66XXX", + "example user", + "S-1-5-21-1323470238-68471550-93548180-1001" + ] + }, + "service": { + "name": "WD FILTER" + }, + "source": { + "ip": "81.2.69.144", + "port": 52376 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "trellix_edr_cloud": { + "event": { + "access_type": "connection_opened", + "action": "added", + "arguments": [ + "0x220a50d0000", + "0x1000", + "0x2" + ], + "author_name": "Example", + "certs": [ + [ + { + "issuer_name": "US,\"example,Inc.\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1", + "public_key_hash": "47A58D30595525187338F85B7F8235FC919CE3FC", + "type": "signing" + }, + { + "issuer_name": "US,example,www.example.com,ROOTCAA", + "public_key_hash": "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "45EBA2AFF492CB82312D518BA7A7219DF36DC80F", + "type": "parent" + } + ] + ], + "cmd_line": "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "commands": [ + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "data": "AAA9UFgBAAA=", + "dest": { + "address": "81.2.69.192", + "port": 443 + }, + "device_id": "D435435b0-BB33-4625-891E-XXXXXXX", + "direction": "outbound", + "dns": { + "class": 1, + "name": "content-autofill.example.com", + "names": [ + "XXX.YYY.cdn.live.net", + "ttt-XXX.YYY.net", + "SSS.YYY.cdn.live.net.XXX.net", + "aaa.dscd.XXX.net" + ], + "type": 65 + }, + "file": { + "attributes": 32, + "creation_date": "2023-04-04T12:38:40.984Z", + "magic_bytes": "d0cf11e0a1b11ae1", + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "modification_date": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "size": 5632, + "type": "PE" + }, + "http": { + "request_headers": "GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\r\nUser-Agent:MSDW\r\n", + "url": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "integrity_level": 4, + "key": { + "name": "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\XXXX\\SECURITY", + "old_value": "01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000", + "val": "01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000" + }, + "name": "Write Process Memory", + "parent_event_id": "1XXXXX-8566-404c-87a3-a4c46017b87d", + "pid": 2280, + "pipe_name": "\\\\.\\pipe\\Sessions\\3\\AppContainerNamedObjects\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929", + "protocol": "tcp", + "result": 2085503003216, + "server_id": "5B0539BF-0932-4BEA-BD12-EA52687E58BD", + "service": { + "description": "Example Antivirus On-Access Malware Protection Mini-Filter Driver", + "load_order_group": "FS FilterAnti-Virus", + "name": "WD FILTER", + "start_type": 0, + "type": 2 + }, + "source": { + "address": "81.2.69.144", + "port": 52376 + }, + "subsystem": 3, + "tag_id": "0", + "target_pid": "1964", + "task": { + "name": "example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001" + }, + "time": "2023-04-05T07:05:21.186Z", + "type": "File Deleted", + "user": { + "domain": "DESKTOP-66XXX", + "name": "example user", + "sid": "S-1-5-21-1323470238-68471550-93548180-1001" + }, + "value": { + "name": "SECURITY", + "type": "REG_BINARY" + }, + "ver": "2107", + "version_info": { + "file": { + "name": "example.EXE", + "version": "0.0.0.1(WinBuild.160101.0800)" + }, + "product": { + "name": "XXXX®Windows®OperatingSystem", + "version": "0.0.0.1194" + }, + "vendor_name": "Example Corporation" + } + } + }, + "url": { + "full": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "user": { + "domain": "DESKTOP-66XXX", + "id": "S-1-5-21-1323470238-68471550-93548180-1001", + "name": "example user" + } + } + ] +} \ No newline at end of file diff --git a/packages/trellix_edr_cloud/data_stream/event/agent/stream/aws-s3.yml.hbs b/packages/trellix_edr_cloud/data_stream/event/agent/stream/aws-s3.yml.hbs new file mode 100644 index 00000000000..1b9d56cfdf0 --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/agent/stream/aws-s3.yml.hbs @@ -0,0 +1,85 @@ +{{#if collect_s3_logs}} +{{#if bucket_arn}} +bucket_arn: {{bucket_arn}} +{{/if}} +{{#if number_of_workers}} +number_of_workers: {{number_of_workers}} +{{/if}} +{{#if interval}} +bucket_list_interval: {{interval}} +{{/if}} +{{#if bucket_list_prefix}} +bucket_list_prefix: {{bucket_list_prefix}} +{{/if}} + +{{else}} + +{{#if queue_url}} +queue_url: {{queue_url}} +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +{{#if visibility_timeout}} +visibility_timeout: {{visibility_timeout}} +{{/if}} +{{#if api_timeout}} +api_timeout: {{api_timeout}} +{{/if}} +{{#if max_number_of_messages}} +max_number_of_messages: {{max_number_of_messages}} +{{/if}} +{{#if file_selectors}} +file_selectors: +{{file_selectors}} +{{/if}} + +{{/if}} + +expand_event_list_from_field: '.[]' +{{#if access_key_id}} +access_key_id: {{access_key_id}} +{{/if}} +{{#if secret_access_key}} +secret_access_key: {{secret_access_key}} +{{/if}} +{{#if session_token}} +session_token: {{session_token}} +{{/if}} +{{#if shared_credential_file}} +shared_credential_file: {{shared_credential_file}} +{{/if}} +{{#if credential_profile_name}} +credential_profile_name: {{credential_profile_name}} +{{/if}} +{{#if role_arn}} +role_arn: {{role_arn}} +{{/if}} +{{#if fips_enabled}} +fips_enabled: {{fips_enabled}} +{{/if}} +{{#if proxy_url}} +proxy_url: {{proxy_url}} +{{/if}} +tags: +{{#if collect_s3_logs}} + - collect_s3_logs +{{else}} + - collect_sqs_logs +{{/if}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if preserve_duplicate_custom_fields}} + - preserve_duplicate_custom_fields +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/trellix_edr_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/trellix_edr_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..ed3245cb9af --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,941 @@ +--- +description: Pipeline for processing Event logs. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: 8.9.0 + - set: + field: event.kind + tag: set_event_kind + value: event + - rename: + field: message + tag: rename_message + target_field: event.original + ignore_missing: true + - json: + field: event.original + tag: json_event_original + target_field: json + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + tag: script_to_set_event_category + description: Script to set event.category for all the event types. + if: ctx.json?._eventType != null + source: >- + def event_category = ctx.json._eventType.toLowerCase(); + ArrayList items = new ArrayList(['process', 'file', 'api', 'network', 'registry','authentication']); + for (def j = 0; j < items.length; j++) { + String key = items[j]; + if (event_category.contains('user')){ + ctx.event.category = [items[5]]; + } else if (event_category.contains('reg')){ + ctx.event.category = [items[4]]; + } else if (event_category.contains('dns')){ + ctx.event.category = [items[3]]; + } else if (event_category.contains(key)){ + ctx.event.category = [key]; + } + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - script: + lang: painless + tag: script_to_set_event_type + description: Script to set event.type for all the event types. + if: ctx.event?.category != null + source: >- + def event_type = ctx.json._eventType.toLowerCase(); + if (!ctx.event.category.contains('registry')){ + ctx.event.type = ['info'] + } + ArrayList items = new ArrayList(['access', 'creat', 'delet', 'modif', 'change']); + ArrayList set_items = new ArrayList(['access', 'creation', 'deletion', 'change', 'change']); + for (def j = 0; j < items.length; j++) { + if (event_type.contains(items[j]) && (!event_type.contains('process created'))){ + ctx.event.type = [set_items[j]]; + } + } + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json._time + tag: date_json_time + target_field: trellix_edr_cloud.event.time + formats: + - ISO8601 + if: ctx.json?._time != null && ctx.json._time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - date: + field: json._time + tag: date_json_time + formats: + - ISO8601 + if: ctx.json?._time != null && ctx.json._time != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.destAddress + tag: convert_json_destAddress + target_field: trellix_edr_cloud.event.dest.address + type: ip + ignore_missing: true + if: ctx.json?.destAddress != '' + on_failure: + - rename: + field: json.destAddress + tag: rename_json_destAddress + target_field: trellix_edr_cloud.event.destination_address + ignore_missing: true + - append: + field: related.ip + tag: append_related_ip + value: '{{{trellix_edr_cloud.event.dest.address}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.dest?.address != null + - set: + field: destination.ip + tag: set_destination_ip + copy_from: trellix_edr_cloud.event.dest.address + ignore_empty_value: true + - convert: + field: json.destPort + tag: convert_json_destPort + target_field: trellix_edr_cloud.event.dest.port + type: long + ignore_missing: true + if: ctx.json?.destPort != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: destination.port + tag: set_destination_port + copy_from: trellix_edr_cloud.event.dest.port + ignore_empty_value: true + - rename: + field: json._deviceId + tag: rename_json_deviceId + target_field: trellix_edr_cloud.event.device_id + ignore_missing: true + - set: + field: device.id + tag: set_device_id + copy_from: trellix_edr_cloud.event.device_id + ignore_empty_value: true + - rename: + field: json.action + tag: rename_json_action + target_field: trellix_edr_cloud.event.action + ignore_missing: true + - set: + field: event.action + tag: set_event_action + copy_from: trellix_edr_cloud.event.action + ignore_empty_value: true + - rename: + field: json._eventId + tag: rename_json_eventId + target_field: trellix_edr_cloud.event.id + ignore_missing: true + - set: + field: event.id + tag: set_event_id + copy_from: trellix_edr_cloud.event.id + ignore_empty_value: true + - date: + field: json.fileCreationDate + tag: date_json_fileCreationDate + target_field: trellix_edr_cloud.event.file.creation_date + formats: + - ISO8601 + if: ctx.json?.fileCreationDate != null && ctx.json.fileCreationDate != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.created + tag: set_file_created + copy_from: trellix_edr_cloud.event.file.creation_date + ignore_empty_value: true + - rename: + field: json.fileMd5 + tag: rename_json_fileMd5 + target_field: trellix_edr_cloud.event.file.md5 + ignore_missing: true + - set: + field: file.hash.md5 + tag: set_file_hash_md5 + copy_from: trellix_edr_cloud.event.file.md5 + ignore_empty_value: true + - append: + field: related.hash + tag: append_related_hash + value: '{{{file.hash.md5}}}' + allow_duplicates: false + if: ctx.file?.hash?.md5 != null + - rename: + field: json.fileSha1 + tag: rename_json_fileSha1 + target_field: trellix_edr_cloud.event.file.sha1 + ignore_missing: true + - set: + field: file.hash.sha1 + tag: set_file_hash_sha1 + copy_from: trellix_edr_cloud.event.file.sha1 + ignore_empty_value: true + - append: + field: related.hash + tag: append_related_hash + value: '{{{file.hash.sha1}}}' + allow_duplicates: false + if: ctx.file?.hash?.sha1 != null + - rename: + field: json.fileSha256 + tag: rename_json_fileSha256 + target_field: trellix_edr_cloud.event.file.sha256 + ignore_missing: true + - set: + field: file.hash.sha256 + tag: set_file_hash_sha256 + copy_from: trellix_edr_cloud.event.file.sha256 + ignore_empty_value: true + - append: + field: related.hash + tag: append_related_hash + value: '{{{file.hash.sha256}}}' + allow_duplicates: false + if: ctx.file?.hash?.sha256 != null + - date: + field: json.fileModificationDate + tag: date_json_fileModificationDate + target_field: trellix_edr_cloud.event.file.modification_date + formats: + - ISO8601 + if: ctx.json?.fileModificationDate != null && ctx.json.fileModificationDate != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.mtime + tag: set_file_mtime + copy_from: trellix_edr_cloud.event.file.modification_date + ignore_empty_value: true + - rename: + field: json.filePath + tag: rename_json_filePath + target_field: trellix_edr_cloud.event.file.path + ignore_missing: true + - set: + field: file.path + tag: set_file_path + copy_from: trellix_edr_cloud.event.file.path + ignore_empty_value: true + - convert: + field: json.fileSize + tag: convert_json_fileSize + target_field: trellix_edr_cloud.event.file.size + type: long + ignore_missing: true + if: ctx.json?.fileSize != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: file.size + tag: set_file_size + copy_from: trellix_edr_cloud.event.file.size + ignore_empty_value: true + - rename: + field: json.fileType + tag: rename_json_fileType + target_field: trellix_edr_cloud.event.file.type + ignore_missing: true + - set: + field: file.type + tag: set_file_type + copy_from: trellix_edr_cloud.event.file.type + ignore_empty_value: true + - rename: + field: json.direction + tag: rename_json_direction + target_field: trellix_edr_cloud.event.direction + ignore_missing: true + - set: + field: network.direction + tag: set_network_direction + copy_from: trellix_edr_cloud.event.direction + ignore_empty_value: true + - rename: + field: json.protocol + tag: rename_json_protocol + target_field: trellix_edr_cloud.event.protocol + ignore_missing: true + - lowercase: + field: trellix_edr_cloud.event.protocol + tag: lowercase_network_protocol + target_field: network.protocol + ignore_missing: true + if: ctx.trellix_edr_cloud?.event?.protocol != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.cmdLine + tag: rename_json_cmdLine + target_field: trellix_edr_cloud.event.cmd_line + ignore_missing: true + - append: + field: process.command_line + tag: append_process_command_line + value: '{{{trellix_edr_cloud.event.cmd_line}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.cmd_line != null + - convert: + field: json.pid + tag: convert_json_pid + target_field: trellix_edr_cloud.event.pid + type: long + ignore_missing: true + if: ctx.json?.pid != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: process.pid + tag: set_process_pid + copy_from: trellix_edr_cloud.event.pid + ignore_empty_value: true + - rename: + field: json.serviceName + tag: rename_json_serviceName + target_field: trellix_edr_cloud.event.service.name + ignore_missing: true + - set: + field: service.name + tag: set_service_name + copy_from: trellix_edr_cloud.event.service.name + ignore_empty_value: true + - convert: + field: json.sourceAddress + tag: convert_json_sourceAddress + target_field: trellix_edr_cloud.event.source.address + type: ip + ignore_missing: true + if: ctx.json?.sourceAddress != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + field: related.ip + tag: append_related_ip + value: '{{{trellix_edr_cloud.event.source.address}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.source?.address != null + - set: + field: source.ip + tag: set_source_ip + copy_from: trellix_edr_cloud.event.source.address + ignore_empty_value: true + - convert: + field: json.sourcePort + tag: convert_json_sourcePort + target_field: trellix_edr_cloud.event.source.port + type: long + ignore_missing: true + if: ctx.json?.sourcePort != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.port + tag: set_source_port + copy_from: trellix_edr_cloud.event.source.port + ignore_empty_value: true + - rename: + field: json.userDomain + tag: rename_json_userDomain + target_field: trellix_edr_cloud.event.user.domain + ignore_missing: true + - set: + field: user.domain + tag: set_user_domain + copy_from: trellix_edr_cloud.event.user.domain + ignore_empty_value: true + - append: + field: related.user + tag: append_related_user + value: '{{{user.domain}}}' + allow_duplicates: false + if: ctx.user?.domain != null + - rename: + field: json.userName + tag: rename_json_userName + target_field: trellix_edr_cloud.event.user.name + ignore_missing: true + - set: + field: user.name + tag: set_user_name + copy_from: trellix_edr_cloud.event.user.name + ignore_empty_value: true + - append: + field: related.user + tag: append_related_user + value: '{{{user.name}}}' + allow_duplicates: false + if: ctx.user?.name != null + - rename: + field: json._eventType + tag: rename_json_eventType + target_field: trellix_edr_cloud.event.type + ignore_missing: true + - rename: + field: json._parentEventId + tag: rename_json_parentEventId + target_field: trellix_edr_cloud.event.parent_event_id + ignore_missing: true + - rename: + field: json._serverId + tag: rename_json_serverId + target_field: trellix_edr_cloud.event.server_id + ignore_missing: true + - convert: + field: json._ver + tag: convert_json_ver + target_field: trellix_edr_cloud.event.ver + type: string + ignore_missing: true + if: ctx.json?._ver != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.accessType + tag: rename_json_accessType + target_field: trellix_edr_cloud.event.access_type + ignore_missing: true + - rename: + field: json.arguments + tag: rename_json_arguments + target_field: trellix_edr_cloud.event.arguments + ignore_missing: true + - rename: + field: json.authorName + tag: rename_json_authorName + target_field: trellix_edr_cloud.event.author_name + ignore_missing: true + - convert: + field: json.bytesReceived + tag: rename_json_bytesReceived + target_field: trellix_edr_cloud.event.bytes_received + type: long + ignore_missing: true + if: ctx.json?.bytesReceived != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: source.bytes + tag: set_source_bytes + copy_from: trellix_edr_cloud.event.bytes_received + ignore_empty_value: true + - foreach: + field: json.certs + if: ctx.json?.certs instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value + ignore_missing: true + processor: + rename: + field: _ingest._value.publicKeyHash + tag: rename_json_certs_publicKeyHash + target_field: _ingest._value.public_key_hash + ignore_missing: true + - foreach: + field: json.certs + if: ctx.json?.certs instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value + ignore_missing: true + processor: + rename: + field: _ingest._value.issuerName + tag: rename_json_certs_issuerName + target_field: _ingest._value.issuer_name + ignore_missing: true + - foreach: + field: json.certs + if: ctx.json?.certs instanceof List + ignore_failure: true + processor: + foreach: + field: _ingest._value + ignore_missing: true + processor: + append: + field: related.hash + tag: append_related_hash + value: '{{{_ingest._value.public_key_hash}}}' + allow_duplicates: false + - rename: + field: json.certs + tag: rename_json_certs_type + target_field: trellix_edr_cloud.event.certs + ignore_missing: true + - rename: + field: json.commands + tag: rename_json_commands + target_field: trellix_edr_cloud.event.commands + ignore_missing: true + - foreach: + field: trellix_edr_cloud.event.commands + if: ctx.trellix_edr_cloud?.event?.commands instanceof List + ignore_failure: true + processor: + append: + field: process.command_line + tag: append_process_command_line + value: '{{{_ingest._value}}}' + allow_duplicates: false + - rename: + field: json.data + tag: rename_json_data + target_field: trellix_edr_cloud.event.data + ignore_missing: true + - convert: + field: json.dnsClass + tag: convert_json_dnsClass + target_field: trellix_edr_cloud.event.dns.class + type: long + ignore_missing: true + if: ctx.json?.dnsClass != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.dnsName + tag: rename_json_dnsName + target_field: trellix_edr_cloud.event.dns.name + ignore_missing: true + - rename: + field: json.dnsNames + tag: rename_json_dnsNames + target_field: trellix_edr_cloud.event.dns.names + ignore_missing: true + - convert: + field: json.dnsType + tag: convert_json_dnsType + target_field: trellix_edr_cloud.event.dns.type + type: long + ignore_missing: true + if: ctx.json?.dnsType != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.evid + tag: rename_json_evid + type: string + target_field: trellix_edr_cloud.event.evid + ignore_missing: true + if: ctx.json?.evid != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.fileAttributes + tag: convert_json_fileAttributes + target_field: trellix_edr_cloud.event.file.attributes + type: long + ignore_missing: true + if: ctx.json?.fileAttributes != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.fileMagicBytes + tag: rename_json_fileMagicBytes + target_field: trellix_edr_cloud.event.file.magic_bytes + ignore_missing: true + - rename: + field: json.fqdn + tag: rename_json_fqdn + target_field: trellix_edr_cloud.event.fqdn + ignore_missing: true + - set: + field: host.name + tag: set_host_name + copy_from: trellix_edr_cloud.event.fqdn + ignore_empty_value: true + - append: + field: related.hosts + tag: append_related_hosts + value: '{{{host.name}}}' + allow_duplicates: false + if: ctx.host?.name != null + - rename: + field: json.httpRequestHeaders + tag: rename_json_httpRequestHeaders + target_field: trellix_edr_cloud.event.http.request_headers + ignore_missing: true + - rename: + field: json.httpResponseHeaders + tag: rename_json_httpResponseHeaders + target_field: trellix_edr_cloud.event.http.response_headers + ignore_missing: true + - rename: + field: json.httpUrl + tag: rename_json_httpUrl + target_field: trellix_edr_cloud.event.http.url + ignore_missing: true + - set: + field: url.full + tag: set_url_full + copy_from: trellix_edr_cloud.event.http.url + ignore_empty_value: true + - convert: + field: json.integrityLevel + tag: convert_json_integrityLevel + target_field: trellix_edr_cloud.event.integrity_level + type: long + ignore_missing: true + if: ctx.json?.integrityLevel != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.keyName + tag: rename_json_keyName + target_field: trellix_edr_cloud.event.key.name + ignore_missing: true + - rename: + field: json.keyOldValue + tag: rename_json_keyOldValue + target_field: trellix_edr_cloud.event.key.old_value + ignore_missing: true + - rename: + field: json.keyValue + tag: rename_json_keyValue + target_field: trellix_edr_cloud.event.key.val + ignore_missing: true + - rename: + field: json.keyValueName + tag: rename_json_keyValueName + target_field: trellix_edr_cloud.event.value.name + ignore_missing: true + - rename: + field: json.keyValueType + tag: rename_json_keyValueType + target_field: trellix_edr_cloud.event.value.type + ignore_missing: true + - set: + field: registry.data.type + tag: set_registry_data_type + copy_from: trellix_edr_cloud.event.value.type + ignore_empty_value: true + - rename: + field: json.moduleName + tag: rename_json_moduleName + target_field: trellix_edr_cloud.event.module_name + ignore_missing: true + - rename: + field: json.name + tag: rename_json_name + target_field: trellix_edr_cloud.event.name + ignore_missing: true + - rename: + field: json.operationName + tag: rename_json_operationName + target_field: trellix_edr_cloud.event.operation_name + ignore_missing: true + - rename: + field: json.pipeName + tag: rename_json_pipeName + target_field: trellix_edr_cloud.event.pipe_name + ignore_missing: true + - convert: + field: json.result + tag: convert_json_result + target_field: trellix_edr_cloud.event.result + type: long + ignore_missing: true + if: ctx.json?.result != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.serviceDescription + tag: rename_json_serviceDescription + target_field: trellix_edr_cloud.event.service.description + ignore_missing: true + - rename: + field: json.serviceLoadOrderGroup + tag: rename_json_serviceLoadOrderGroup + target_field: trellix_edr_cloud.event.service.load_order_group + ignore_missing: true + - convert: + field: json.serviceStartType + tag: convert_json_serviceStartType + target_field: trellix_edr_cloud.event.service.start_type + type: long + ignore_missing: true + if: ctx.json?.serviceStartType != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.serviceType + tag: convert_json_serviceType + target_field: trellix_edr_cloud.event.service.type + type: long + ignore_missing: true + if: ctx.json?.serviceType != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.subsystem + tag: convert_json_subsystem + target_field: trellix_edr_cloud.event.subsystem + type: long + ignore_missing: true + if: ctx.json?.subsystem != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.tagId + tag: convert_json_tagId + target_field: trellix_edr_cloud.event.tag_id + type: string + ignore_missing: true + if: ctx.json?.tagId != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - convert: + field: json.targetPid + tag: convert_json_targetPid + target_field: trellix_edr_cloud.event.target_pid + type: string + ignore_missing: true + if: ctx.json?.targetPid != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.taskDescription + tag: rename_json_taskDescription + target_field: trellix_edr_cloud.event.task.description + ignore_missing: true + - rename: + field: json.taskName + tag: rename_json_taskName + target_field: trellix_edr_cloud.event.task.name + ignore_missing: true + - rename: + field: json.userCid + tag: rename_json_userCid + target_field: trellix_edr_cloud.event.user.cid + ignore_missing: true + - append: + field: related.user + tag: append_related_user + value: '{{{trellix_edr_cloud.event.user.cid}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.user?.cid != null + - rename: + field: json.userGroups + tag: rename_json_userGroups + target_field: trellix_edr_cloud.event.user.groups + ignore_missing: true + - append: + field: related.user + tag: append_related_user + value: '{{{trellix_edr_cloud.event.user.groups}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.user?.groups != null + - rename: + field: json.userNames + tag: rename_json_userNames + target_field: trellix_edr_cloud.event.user.names + ignore_missing: true + - append: + field: related.user + tag: append_related_user + value: '{{{trellix_edr_cloud.event.user.names}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.user?.names != null + - rename: + field: json.userSid + tag: rename_json_userSid + target_field: trellix_edr_cloud.event.user.sid + ignore_missing: true + - append: + field: related.user + tag: append_related_user + value: '{{{trellix_edr_cloud.event.user.sid}}}' + allow_duplicates: false + if: ctx.trellix_edr_cloud?.event?.user?.sid != null + - set: + field: user.id + tag: set_user_id + copy_from: trellix_edr_cloud.event.user.sid + ignore_empty_value: true + - rename: + field: json.versionInfoFileVersion + tag: rename_json_versionInfoFileVersion + target_field: trellix_edr_cloud.event.version_info.file.version + ignore_missing: true + - rename: + field: json.versionInfoFilename + tag: rename_json_versionInfoFilename + target_field: trellix_edr_cloud.event.version_info.file.name + ignore_missing: true + - rename: + field: json.versionInfoProductName + tag: rename_json_versionInfoProductName + target_field: trellix_edr_cloud.event.version_info.product.name + ignore_missing: true + - rename: + field: json.versionInfoProductVersion + tag: rename_json_versionInfoProductVersion + target_field: trellix_edr_cloud.event.version_info.product.version + ignore_missing: true + - rename: + field: json.versionInfoVendorName + tag: rename_json_versionInfoVendorName + target_field: trellix_edr_cloud.event.version_info.vendor_name + ignore_missing: true + - convert: + field: json.wmiLocal + tag: convert_json_wmiLocal + target_field: trellix_edr_cloud.event.wmi.local + type: boolean + ignore_missing: true + if: ctx.json?.wmiLocal != '' + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - rename: + field: json.wmiNS + tag: rename_json_wmiNS + target_field: trellix_edr_cloud.event.wmi.ns + ignore_missing: true + - remove: + field: json + tag: remove_json + ignore_missing: true + - remove: + field: + - trellix_edr_cloud.event.dest.address + - trellix_edr_cloud.event.time + - trellix_edr_cloud.event.dest.port + - trellix_edr_cloud.event.device_id + - trellix_edr_cloud.event.action + - trellix_edr_cloud.event.id + - trellix_edr_cloud.event.file.creation_date + - trellix_edr_cloud.event.file.md5 + - trellix_edr_cloud.event.file.sha1 + - trellix_edr_cloud.event.file.sha256 + - trellix_edr_cloud.event.file.modification_date + - trellix_edr_cloud.event.file.path + - trellix_edr_cloud.event.file.size + - trellix_edr_cloud.event.file.type + - trellix_edr_cloud.event.direction + - trellix_edr_cloud.event.protocol + - trellix_edr_cloud.event.cmd_line + - trellix_edr_cloud.event.pid + - trellix_edr_cloud.event.service.name + - trellix_edr_cloud.event.source.address + - trellix_edr_cloud.event.source.port + - trellix_edr_cloud.event.user.domain + - trellix_edr_cloud.event.user.name + - trellix_edr_cloud.event.bytes_received + - trellix_edr_cloud.event.commands + - trellix_edr_cloud.event.fqdn + - trellix_edr_cloud.event.http.url + - trellix_edr_cloud.event.value.type + - trellix_edr_cloud.event.user.sid + tag: remove_preserve_duplicate_custom_fields + if: ctx.tags == null || !(ctx.tags.contains('preserve_duplicate_custom_fields')) + ignore_missing: true + - remove: + field: event.original + tag: remove_event_original + if: ctx.tags == null || !(ctx.tags.contains('preserve_original_event')) + ignore_missing: true + - script: + lang: painless + tag: script_to_remove_null_values + description: Drops null/empty values recursively. + source: |- + boolean drop(Object object) { + if (object == null || object == '') { + return true; + } else if (object instanceof Map) { + ((Map) object).values().removeIf(v -> drop(v)); + return (((Map) object).size() == 0); + } else if (object instanceof List) { + ((List) object).removeIf(v -> drop(v)); + return (((List) object).length == 0); + } + return false; + } + drop(ctx); + on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + tag: set_event_kind + value: pipeline_error + if: ctx.error?.message != null +on_failure: + - append: + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + field: event.kind + value: pipeline_error diff --git a/packages/trellix_edr_cloud/data_stream/event/fields/base-fields.yml b/packages/trellix_edr_cloud/data_stream/event/fields/base-fields.yml new file mode 100644 index 00000000000..553879522f9 --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: event.module + type: constant_keyword + description: Event module. + value: trellix_edr_cloud +- name: event.dataset + type: constant_keyword + description: Event dataset. + value: trellix_edr_cloud.event +- name: '@timestamp' + type: date + description: Event timestamp. diff --git a/packages/trellix_edr_cloud/data_stream/event/fields/beats.yml b/packages/trellix_edr_cloud/data_stream/event/fields/beats.yml new file mode 100644 index 00000000000..b3701b581cf --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/fields/beats.yml @@ -0,0 +1,9 @@ +- name: input.type + type: keyword + description: Type of filebeat input. +- name: log.offset + type: long + description: Log offset. +- name: tags + type: keyword + description: User defined tags. diff --git a/packages/trellix_edr_cloud/data_stream/event/fields/fields.yml b/packages/trellix_edr_cloud/data_stream/event/fields/fields.yml new file mode 100644 index 00000000000..c74144964dc --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/fields/fields.yml @@ -0,0 +1,206 @@ +- name: trellix_edr_cloud.event + type: group + fields: + - name: access_type + type: keyword + - name: action + type: keyword + - name: arguments + type: keyword + - name: author_name + type: keyword + - name: bytes_received + type: long + - name: certs + type: nested + fields: + - name: issuer_name + type: keyword + - name: public_key_hash + type: keyword + - name: type + type: keyword + - name: cmd_line + type: keyword + - name: commands + type: keyword + - name: data + type: keyword + - name: dest + type: group + fields: + - name: address + type: ip + - name: port + type: long + - name: destination_address + type: keyword + - name: device_id + type: keyword + - name: direction + type: keyword + - name: dns + type: group + fields: + - name: class + type: long + - name: name + type: keyword + - name: names + type: keyword + - name: type + type: long + - name: evid + type: keyword + - name: file + type: group + fields: + - name: attributes + type: long + - name: creation_date + type: date + - name: magic_bytes + type: keyword + - name: md5 + type: keyword + - name: modification_date + type: date + - name: path + type: keyword + - name: sha1 + type: keyword + - name: sha256 + type: keyword + - name: size + type: long + - name: type + type: keyword + - name: fqdn + type: keyword + - name: http + type: group + fields: + - name: request_headers + type: keyword + - name: response_headers + type: keyword + - name: url + type: keyword + - name: id + type: keyword + - name: integrity_level + type: long + - name: key + type: group + fields: + - name: name + type: keyword + - name: old_value + type: keyword + - name: val + type: keyword + - name: module_name + type: keyword + - name: name + type: keyword + - name: operation_name + type: keyword + - name: parent_event_id + type: keyword + - name: pid + type: long + - name: pipe_name + type: keyword + - name: protocol + type: keyword + - name: result + type: long + - name: server_id + type: keyword + - name: service + type: group + fields: + - name: description + type: keyword + - name: load_order_group + type: keyword + - name: name + type: keyword + - name: start_type + type: long + - name: type + type: long + - name: source + type: group + fields: + - name: address + type: ip + - name: port + type: long + - name: subsystem + type: long + - name: tag_id + type: keyword + - name: target_pid + type: keyword + - name: task + type: group + fields: + - name: description + type: keyword + - name: name + type: keyword + - name: time + type: date + - name: user + type: group + fields: + - name: cid + type: keyword + - name: domain + type: keyword + - name: groups + type: keyword + - name: name + type: keyword + - name: names + type: keyword + - name: sid + type: keyword + - name: type + type: keyword + - name: value + type: group + fields: + - name: name + type: keyword + - name: type + type: keyword + - name: ver + type: keyword + - name: version_info + type: group + fields: + - name: file + type: group + fields: + - name: name + type: keyword + - name: version + type: keyword + - name: product + type: group + fields: + - name: name + type: keyword + - name: version + type: keyword + - name: vendor_name + type: keyword + - name: wmi + type: group + fields: + - name: local + type: boolean + - name: ns + type: keyword diff --git a/packages/trellix_edr_cloud/data_stream/event/manifest.yml b/packages/trellix_edr_cloud/data_stream/event/manifest.yml new file mode 100644 index 00000000000..18c2cf9641f --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/manifest.yml @@ -0,0 +1,97 @@ +title: Collect Event logs from Trellix EDR Cloud. +type: logs +streams: + - input: aws-s3 + template_path: aws-s3.yml.hbs + title: Event logs + description: Collect Event logs via AWS S3 input. + vars: + - name: bucket_list_prefix + type: text + title: "[S3] Bucket Prefix" + multi: false + required: false + show_user: true + default: event/ + description: Prefix to apply for the list request to the S3 bucket. + - name: interval + type: text + title: "[S3] Interval" + multi: false + required: false + show_user: true + default: 120s + description: "Time interval for polling listing of the S3 bucket. NOTE: Supported units are h/m/s." + - name: number_of_workers + type: integer + title: "[S3] Number of Workers" + multi: false + required: false + show_user: true + default: 5 + description: Number of workers that will process the S3 objects listed. + - name: visibility_timeout + type: text + title: "[SQS] Visibility Timeout" + multi: false + required: false + show_user: true + default: 300s + description: "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s." + - name: api_timeout + type: text + title: "[SQS] API Timeout" + multi: false + required: false + show_user: true + default: 120s + description: "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. NOTE: Supported units for this parameter are h/m/s." + - name: max_number_of_messages + type: integer + title: "[SQS] Maximum Concurrent SQS Messages" + required: false + show_user: true + default: 5 + description: The maximum number of SQS messages that can be inflight at any time. + - name: file_selectors + type: yaml + title: "[SQS] File Selectors" + multi: false + required: false + show_user: false + default: | + - regex: "event/" + description: If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed. + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - forwarded + - trellix_edr_cloud-event + - name: preserve_original_event + required: false + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original`. + type: bool + multi: false + default: false + - name: preserve_duplicate_custom_fields + required: false + show_user: false + title: Preserve duplicate custom fields + description: Preserve trellix_edr_cloud.event fields that were copied to Elastic Common Schema (ECS) fields. + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/trellix_edr_cloud/data_stream/event/sample_event.json b/packages/trellix_edr_cloud/data_stream/event/sample_event.json new file mode 100644 index 00000000000..a4c3370940f --- /dev/null +++ b/packages/trellix_edr_cloud/data_stream/event/sample_event.json @@ -0,0 +1,220 @@ +{ + "@timestamp": "2023-04-05T07:05:21.186Z", + "destination": { + "ip": "81.2.69.192", + "port": 443 + }, + "device": { + "id": "D435435b0-BB33-4625-891E-XXXXXXX" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "added", + "category": [ + "file" + ], + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "kind": "event", + "original": "{\"_ver\":2107,\"_serverId\":\"5B0539BF-0932-4BEA-BD12-EA52687E58BD\",\"_eventType\":\"File Deleted\",\"accessType\":\"connection_opened\",\"_deviceId\":\"D435435b0-BB33-4625-891E-XXXXXXX\",\"_parentEventId\":\"1XXXXX-8566-404c-87a3-a4c46017b87d\",\"_eventId\":\"675XXXX-054c-48e8-9549-468dbb5ae5bc\",\"_time\":\"2023-04-05T07:05:21.186Z\",\"name\":\"Write Process Memory\",\"authorName\":\"Example\",\"data\":\"AAA9UFgBAAA=\",\"arguments\":[\"0x220a50d0000\",\"0x1000\",\"0x2\"],\"cmdLine\":\"\\\"C:\\\\Users\\\\XXXX\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\setup.exe\\\"/update\",\"result\":\"2085503003216\",\"fileModificationDate\":\"2023-04-04T12:38:42.821Z\",\"fileType\":\"PE\",\"fileCreationDate\":\"2023-04-04T12:38:40.984Z\",\"fileMd5\":\"A7F7A4EEC248E6C1841EC6D5B735357B\",\"fileSha1\":\"B8F93C2963CF1415A3D1C49668BF56665E3DC334\",\"fileSha256\":\"F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418\",\"filePath\":\"C:\\\\ProgramFiles\\\\WindowsApps\\\\Deleted\\\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\\\kk-KZ\\\\PPP.Console.XX.YY.dll\",\"fileSize\":5632,\"fileAttributes\":32,\"subsystem\":3,\"fileMagicBytes\":\"d0cf11e0a1b11ae1\",\"direction\":\"outbound\",\"dnsName\":\"content-autofill.example.com\",\"pipeName\":\"\\\\\\\\.\\\\pipe\\\\Sessions\\\\3\\\\AppContainerNamedObjects\\\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929\",\"destAddress\":\"81.2.69.192\",\"destPort\":443,\"sourceAddress\":\"81.2.69.144\",\"sourcePort\":52376,\"protocol\":\"tcp\",\"taskName\":\"example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001\",\"taskDescription\":null,\"dnsType\":65,\"dnsClass\":1,\"targetPid\":1964,\"pid\": \"2280\",\"dnsNames\":[\"XXX.YYY.cdn.live.net\",\"ttt-XXX.YYY.net\",\"SSS.YYY.cdn.live.net.XXX.net\",\"aaa.dscd.XXX.net\"],\"action\":\"added\",\"serviceName\":\"WD FILTER\",\"serviceDescription\":\"Example Antivirus On-Access Malware Protection Mini-Filter Driver\",\"serviceLoadOrderGroup\":\"FS FilterAnti-Virus\",\"userName\":\"example user\",\"userDomain\":\"DESKTOP-66XXX\",\"userSid\":\"S-1-5-21-1323470238-68471550-93548180-1001\",\"tagId\":0,\"commands\":[\"%localappdata%\\\\XXXXXX\\\\OneDrive\\\\updater.exe\"],\"httpUrl\":\"https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1\",\"httpRequestHeaders\":\"GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\\r\\nUser-Agent:MSDW\\r\\n\",\"serviceType\":2,\"integrityLevel\":4,\"versionInfoFilename\":\"example.EXE\",\"versionInfoFileVersion\":\"0.0.0.1(WinBuild.160101.0800)\",\"versionInfoProductName\":\"XXXX®Windows®OperatingSystem\",\"versionInfoProductVersion\":\"0.0.0.1194\",\"versionInfoVendorName\":\"Example Corporation\",\"serviceStartType\":0,\"keyName\":\"HKLM\\\\SYSTEM\\\\CONTROLSET001\\\\SERVICES\\\\XXXX\\\\SECURITY\",\"keyValueName\":\"SECURITY\",\"keyValueType\":\"REG_BINARY\",\"keyValue\":\"01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000\",\"keyOldValue\":\"01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000\",\"certs\":[[{\"type\":\"signing\",\"issuerName\":\"US,\\\"example,Inc.\\\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1\",\"publicKeyHash\":\"47A58D30595525187338F85B7F8235FC919CE3FC\"},{\"type\":\"parent\",\"issuerName\":\"US,example,www.example.com,ROOTCAA\",\"publicKeyHash\":\"6837E0EBB63BF85F1186FBFE617B088865F44E42\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"45EBA2AFF492CB82312D518BA7A7219DF36DC80F\"}]]}", + "type": [ + "deletion" + ] + }, + "file": { + "created": "2023-04-04T12:38:40.984Z", + "hash": { + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418" + }, + "mtime": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "size": 5632, + "type": "PE" + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "command_line": [ + "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "pid": 2280 + }, + "registry": { + "data": { + "type": "REG_BINARY" + } + }, + "related": { + "hash": [ + "A7F7A4EEC248E6C1841EC6D5B735357B", + "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "47A58D30595525187338F85B7F8235FC919CE3FC", + "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "45EBA2AFF492CB82312D518BA7A7219DF36DC80F" + ], + "ip": [ + "81.2.69.192", + "81.2.69.144" + ], + "user": [ + "DESKTOP-66XXX", + "example user", + "S-1-5-21-1323470238-68471550-93548180-1001" + ] + }, + "service": { + "name": "WD FILTER" + }, + "source": { + "ip": "81.2.69.144", + "port": 52376 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "trellix_edr_cloud": { + "event": { + "access_type": "connection_opened", + "action": "added", + "arguments": [ + "0x220a50d0000", + "0x1000", + "0x2" + ], + "author_name": "Example", + "certs": [ + [ + { + "issuer_name": "US,\"example,Inc.\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1", + "public_key_hash": "47A58D30595525187338F85B7F8235FC919CE3FC", + "type": "signing" + }, + { + "issuer_name": "US,example,www.example.com,ROOTCAA", + "public_key_hash": "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "45EBA2AFF492CB82312D518BA7A7219DF36DC80F", + "type": "parent" + } + ] + ], + "cmd_line": "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "commands": [ + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "data": "AAA9UFgBAAA=", + "dest": { + "address": "81.2.69.192", + "port": 443 + }, + "device_id": "D435435b0-BB33-4625-891E-XXXXXXX", + "direction": "outbound", + "dns": { + "class": 1, + "name": "content-autofill.example.com", + "names": [ + "XXX.YYY.cdn.live.net", + "ttt-XXX.YYY.net", + "SSS.YYY.cdn.live.net.XXX.net", + "aaa.dscd.XXX.net" + ], + "type": 65 + }, + "file": { + "attributes": 32, + "creation_date": "2023-04-04T12:38:40.984Z", + "magic_bytes": "d0cf11e0a1b11ae1", + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "modification_date": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "size": 5632, + "type": "PE" + }, + "http": { + "request_headers": "GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\r\nUser-Agent:MSDW\r\n", + "url": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "integrity_level": 4, + "key": { + "name": "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\XXXX\\SECURITY", + "old_value": "01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000", + "val": "01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000" + }, + "name": "Write Process Memory", + "parent_event_id": "1XXXXX-8566-404c-87a3-a4c46017b87d", + "pid": 2280, + "pipe_name": "\\\\.\\pipe\\Sessions\\3\\AppContainerNamedObjects\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929", + "protocol": "tcp", + "result": 2085503003216, + "server_id": "5B0539BF-0932-4BEA-BD12-EA52687E58BD", + "service": { + "description": "Example Antivirus On-Access Malware Protection Mini-Filter Driver", + "load_order_group": "FS FilterAnti-Virus", + "name": "WD FILTER", + "start_type": 0, + "type": 2 + }, + "source": { + "address": "81.2.69.144", + "port": 52376 + }, + "subsystem": 3, + "tag_id": "0", + "target_pid": "1964", + "task": { + "name": "example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001" + }, + "time": "2023-04-05T07:05:21.186Z", + "type": "File Deleted", + "user": { + "domain": "DESKTOP-66XXX", + "name": "example user", + "sid": "S-1-5-21-1323470238-68471550-93548180-1001" + }, + "value": { + "name": "SECURITY", + "type": "REG_BINARY" + }, + "ver": "2107", + "version_info": { + "file": { + "name": "example.EXE", + "version": "0.0.0.1(WinBuild.160101.0800)" + }, + "product": { + "name": "XXXX®Windows®OperatingSystem", + "version": "0.0.0.1194" + }, + "vendor_name": "Example Corporation" + } + } + }, + "url": { + "full": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "user": { + "domain": "DESKTOP-66XXX", + "id": "S-1-5-21-1323470238-68471550-93548180-1001", + "name": "example user" + } +} \ No newline at end of file diff --git a/packages/trellix_edr_cloud/docs/README.md b/packages/trellix_edr_cloud/docs/README.md new file mode 100644 index 00000000000..015dd1d9f99 --- /dev/null +++ b/packages/trellix_edr_cloud/docs/README.md @@ -0,0 +1,436 @@ +# Trellix EDR Cloud + +This [Trellix EDR Cloud](https://www.trellix.com/en-us/products/edr.html) integration enables your detected threats and suspicious network data to be sent to Elastic Security via Amazon S3. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for threat protection, detection, and incident response. + +The Trellix EDR Cloud integration can be used in two different modes to collect data: +- AWS S3 polling mode: Trellix EDR Cloud writes data to S3, and Elastic Agent polls the S3 bucket by listing its contents and reading new files. +- AWS S3 SQS mode: Trellix EDR Cloud writes data to S3, S3 sends a notification of a new object to SQS, the Elastic Agent receives the notification from SQS, and then reads the S3 object. Multiple agents can be used in this mode. + +## Compatibility + +This module has been tested against the latest (June 05, 2023) Trellix EDR Cloud version. + +## Data streams + +The Trellix EDR Cloud integration collects logs for the following seventeen events: + +| Event Type | +|-----------------| +| API | +| Context Changed | +| DNS Query | +| EPP | +| File | +| Image Loaded | +| Named Pipe | +| Network | +| Process | +| RegKey | +| RegValue | +| Scheduled Task | +| Script Executed | +| Service | +| SysInfo | +| User | +| WMI | + + +**NOTE**: The Trellix EDR Cloud integration collects logs for the above mentioned events, but we have combined all of those in one data stream named `event`. + +## Requirements + +- Elastic Agent must be installed. +- You can install only one Elastic Agent per host. +- Elastic Agent is required to stream data from the S3 bucket and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines. + +### Installing and managing an Elastic Agent: + +You have a few options for installing and managing an Elastic Agent: + +### Install a Fleet-managed Elastic Agent (recommended): + +With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier. + +### Install Elastic Agent in standalone mode (advanced users): + +With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only. + +### Install Elastic Agent in a containerized environment: + +You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes. + +There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +The minimum **kibana.version** required is **8.9.0**. + +## Setup + +### To collect data from an AWS S3 bucket, follow the below steps: + +1. Considering you already have an AWS S3 bucket setup, to configure it with Trellix EDR Cloud, follow the steps mentioned below: + - Login to your Trellix Admin Account, select Trellix ePO. + - Go to Policy Catalog -> Trellix EDR. + - Create a new policy by filling the required details and click OK. + - After creating a policy, click on edit for the policy you want to edit. + - Go to the Trace, fill in the details of the trace scanner and AWS S3 settings, and click on save. + - Now go to the system tree and click on the system to which you want to assign the policy. + - Go to Actions -> Agent -> Set Policy and Inheritance + - Select the product under policy as MVISION EDR, and select the policy that you want to assign to this system, and click save. + - Policy is assigned to the system, and the system trace logs will be sent to the AWS S3 bucket. +2. The default value of the field `Bucket List Prefix` is event/. + +### To collect data from AWS SQS, follow the below steps: + +1. Assuming you've already set up a connection to push data into the AWS bucket; if not, see the section above. +2. To set up an SQS queue, follow "Step 1: Create an Amazon SQS Queue" mentioned in the [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html). + - While creating an access policy, use the bucket name configured to create a connection for AWS S3 in Trellix EDR Cloud. +3. Configure event notifications for an S3 bucket. Follow this [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html). + - While creating `event notification` select the event type as s3:ObjectCreated:*, destination type SQS Queue, and select the queue name created in Step 2. + +### Enabling the integration in Elastic: + +1. In Kibana go to Management > Integrations +2. In "Search for integrations" search bar, type Trellix EDR Cloud +3. Click on the "Trellix EDR Cloud" integration from the search results. +4. Click on the Add Trellix EDR Cloud Integration button to add the integration. +5. While adding the integration, if you want to collect logs via AWS S3, then you have to put the following details: + - access key id + - secret access key + - bucket arn + - collect logs via S3 Bucket toggled on + + or if you want to collect logs via AWS SQS, then you have to put the following details: + - access key id + - secret access key + - queue url + - region + - collect logs via S3 Bucket toggled off + +**NOTE**: There are other input combination options available, please check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html). + +## Logs reference + +### Event + +This is the `Event` dataset. + +#### Example + +An example event for `event` looks as following: + +```json +{ + "@timestamp": "2023-04-05T07:05:21.186Z", + "destination": { + "ip": "81.2.69.192", + "port": 443 + }, + "device": { + "id": "D435435b0-BB33-4625-891E-XXXXXXX" + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "added", + "category": [ + "file" + ], + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "kind": "event", + "original": "{\"_ver\":2107,\"_serverId\":\"5B0539BF-0932-4BEA-BD12-EA52687E58BD\",\"_eventType\":\"File Deleted\",\"accessType\":\"connection_opened\",\"_deviceId\":\"D435435b0-BB33-4625-891E-XXXXXXX\",\"_parentEventId\":\"1XXXXX-8566-404c-87a3-a4c46017b87d\",\"_eventId\":\"675XXXX-054c-48e8-9549-468dbb5ae5bc\",\"_time\":\"2023-04-05T07:05:21.186Z\",\"name\":\"Write Process Memory\",\"authorName\":\"Example\",\"data\":\"AAA9UFgBAAA=\",\"arguments\":[\"0x220a50d0000\",\"0x1000\",\"0x2\"],\"cmdLine\":\"\\\"C:\\\\Users\\\\XXXX\\\\AppData\\\\Local\\\\Microsoft\\\\OneDrive\\\\Update\\\\setup.exe\\\"/update\",\"result\":\"2085503003216\",\"fileModificationDate\":\"2023-04-04T12:38:42.821Z\",\"fileType\":\"PE\",\"fileCreationDate\":\"2023-04-04T12:38:40.984Z\",\"fileMd5\":\"A7F7A4EEC248E6C1841EC6D5B735357B\",\"fileSha1\":\"B8F93C2963CF1415A3D1C49668BF56665E3DC334\",\"fileSha256\":\"F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418\",\"filePath\":\"C:\\\\ProgramFiles\\\\WindowsApps\\\\Deleted\\\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\\\kk-KZ\\\\PPP.Console.XX.YY.dll\",\"fileSize\":5632,\"fileAttributes\":32,\"subsystem\":3,\"fileMagicBytes\":\"d0cf11e0a1b11ae1\",\"direction\":\"outbound\",\"dnsName\":\"content-autofill.example.com\",\"pipeName\":\"\\\\\\\\.\\\\pipe\\\\Sessions\\\\3\\\\AppContainerNamedObjects\\\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929\",\"destAddress\":\"81.2.69.192\",\"destPort\":443,\"sourceAddress\":\"81.2.69.144\",\"sourcePort\":52376,\"protocol\":\"tcp\",\"taskName\":\"example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001\",\"taskDescription\":null,\"dnsType\":65,\"dnsClass\":1,\"targetPid\":1964,\"pid\": \"2280\",\"dnsNames\":[\"XXX.YYY.cdn.live.net\",\"ttt-XXX.YYY.net\",\"SSS.YYY.cdn.live.net.XXX.net\",\"aaa.dscd.XXX.net\"],\"action\":\"added\",\"serviceName\":\"WD FILTER\",\"serviceDescription\":\"Example Antivirus On-Access Malware Protection Mini-Filter Driver\",\"serviceLoadOrderGroup\":\"FS FilterAnti-Virus\",\"userName\":\"example user\",\"userDomain\":\"DESKTOP-66XXX\",\"userSid\":\"S-1-5-21-1323470238-68471550-93548180-1001\",\"tagId\":0,\"commands\":[\"%localappdata%\\\\XXXXXX\\\\OneDrive\\\\updater.exe\"],\"httpUrl\":\"https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1\",\"httpRequestHeaders\":\"GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\\r\\nUser-Agent:MSDW\\r\\n\",\"serviceType\":2,\"integrityLevel\":4,\"versionInfoFilename\":\"example.EXE\",\"versionInfoFileVersion\":\"0.0.0.1(WinBuild.160101.0800)\",\"versionInfoProductName\":\"XXXX®Windows®OperatingSystem\",\"versionInfoProductVersion\":\"0.0.0.1194\",\"versionInfoVendorName\":\"Example Corporation\",\"serviceStartType\":0,\"keyName\":\"HKLM\\\\SYSTEM\\\\CONTROLSET001\\\\SERVICES\\\\XXXX\\\\SECURITY\",\"keyValueName\":\"SECURITY\",\"keyValueType\":\"REG_BINARY\",\"keyValue\":\"01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000\",\"keyOldValue\":\"01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000\",\"certs\":[[{\"type\":\"signing\",\"issuerName\":\"US,\\\"example,Inc.\\\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1\",\"publicKeyHash\":\"47A58D30595525187338F85B7F8235FC919CE3FC\"},{\"type\":\"parent\",\"issuerName\":\"US,example,www.example.com,ROOTCAA\",\"publicKeyHash\":\"6837E0EBB63BF85F1186FBFE617B088865F44E42\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F\"},{\"type\":\"parent\",\"issuerName\":\"US,DigiCertInc,www.example.com,ROOTCA\",\"publicKeyHash\":\"45EBA2AFF492CB82312D518BA7A7219DF36DC80F\"}]]}", + "type": [ + "deletion" + ] + }, + "file": { + "created": "2023-04-04T12:38:40.984Z", + "hash": { + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418" + }, + "mtime": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "size": 5632, + "type": "PE" + }, + "network": { + "direction": "outbound", + "protocol": "tcp" + }, + "process": { + "command_line": [ + "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "pid": 2280 + }, + "registry": { + "data": { + "type": "REG_BINARY" + } + }, + "related": { + "hash": [ + "A7F7A4EEC248E6C1841EC6D5B735357B", + "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "47A58D30595525187338F85B7F8235FC919CE3FC", + "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "45EBA2AFF492CB82312D518BA7A7219DF36DC80F" + ], + "ip": [ + "81.2.69.192", + "81.2.69.144" + ], + "user": [ + "DESKTOP-66XXX", + "example user", + "S-1-5-21-1323470238-68471550-93548180-1001" + ] + }, + "service": { + "name": "WD FILTER" + }, + "source": { + "ip": "81.2.69.144", + "port": 52376 + }, + "tags": [ + "preserve_original_event", + "preserve_duplicate_custom_fields" + ], + "trellix_edr_cloud": { + "event": { + "access_type": "connection_opened", + "action": "added", + "arguments": [ + "0x220a50d0000", + "0x1000", + "0x2" + ], + "author_name": "Example", + "certs": [ + [ + { + "issuer_name": "US,\"example,Inc.\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1", + "public_key_hash": "47A58D30595525187338F85B7F8235FC919CE3FC", + "type": "signing" + }, + { + "issuer_name": "US,example,www.example.com,ROOTCAA", + "public_key_hash": "6837E0EBB63BF85F1186FBFE617B088865F44E42", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F", + "type": "parent" + }, + { + "issuer_name": "US,DigiCertInc,www.example.com,ROOTCA", + "public_key_hash": "45EBA2AFF492CB82312D518BA7A7219DF36DC80F", + "type": "parent" + } + ] + ], + "cmd_line": "\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update", + "commands": [ + "%localappdata%\\XXXXXX\\OneDrive\\updater.exe" + ], + "data": "AAA9UFgBAAA=", + "dest": { + "address": "81.2.69.192", + "port": 443 + }, + "device_id": "D435435b0-BB33-4625-891E-XXXXXXX", + "direction": "outbound", + "dns": { + "class": 1, + "name": "content-autofill.example.com", + "names": [ + "XXX.YYY.cdn.live.net", + "ttt-XXX.YYY.net", + "SSS.YYY.cdn.live.net.XXX.net", + "aaa.dscd.XXX.net" + ], + "type": 65 + }, + "file": { + "attributes": 32, + "creation_date": "2023-04-04T12:38:40.984Z", + "magic_bytes": "d0cf11e0a1b11ae1", + "md5": "A7F7A4EEC248E6C1841EC6D5B735357B", + "modification_date": "2023-04-04T12:38:42.821Z", + "path": "C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll", + "sha1": "B8F93C2963CF1415A3D1C49668BF56665E3DC334", + "sha256": "F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418", + "size": 5632, + "type": "PE" + }, + "http": { + "request_headers": "GETsettings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.amd64fre.ni_release.220506-1250\u0026appver=0.0.0.2600HTTP/1.1\r\nUser-Agent:MSDW\r\n", + "url": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "id": "675XXXX-054c-48e8-9549-468dbb5ae5bc", + "integrity_level": 4, + "key": { + "name": "HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\XXXX\\SECURITY", + "old_value": "01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000", + "val": "01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000" + }, + "name": "Write Process Memory", + "parent_event_id": "1XXXXX-8566-404c-87a3-a4c46017b87d", + "pid": 2280, + "pipe_name": "\\\\.\\pipe\\Sessions\\3\\AppContainerNamedObjects\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929", + "protocol": "tcp", + "result": 2085503003216, + "server_id": "5B0539BF-0932-4BEA-BD12-EA52687E58BD", + "service": { + "description": "Example Antivirus On-Access Malware Protection Mini-Filter Driver", + "load_order_group": "FS FilterAnti-Virus", + "name": "WD FILTER", + "start_type": 0, + "type": 2 + }, + "source": { + "address": "81.2.69.144", + "port": 52376 + }, + "subsystem": 3, + "tag_id": "0", + "target_pid": "1964", + "task": { + "name": "example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001" + }, + "time": "2023-04-05T07:05:21.186Z", + "type": "File Deleted", + "user": { + "domain": "DESKTOP-66XXX", + "name": "example user", + "sid": "S-1-5-21-1323470238-68471550-93548180-1001" + }, + "value": { + "name": "SECURITY", + "type": "REG_BINARY" + }, + "ver": "2107", + "version_info": { + "file": { + "name": "example.EXE", + "version": "0.0.0.1(WinBuild.160101.0800)" + }, + "product": { + "name": "XXXX®Windows®OperatingSystem", + "version": "0.0.0.1194" + }, + "vendor_name": "Example Corporation" + } + } + }, + "url": { + "full": "https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows\u0026osver=0.0.0.1.example.ni_release.220506-1250\u0026appver=0.0.0.1" + }, + "user": { + "domain": "DESKTOP-66XXX", + "id": "S-1-5-21-1323470238-68471550-93548180-1001", + "name": "example user" + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| event.dataset | Event dataset. | constant_keyword | +| event.module | Event module. | constant_keyword | +| input.type | Type of filebeat input. | keyword | +| log.offset | Log offset. | long | +| tags | User defined tags. | keyword | +| trellix_edr_cloud.event.access_type | | keyword | +| trellix_edr_cloud.event.action | | keyword | +| trellix_edr_cloud.event.arguments | | keyword | +| trellix_edr_cloud.event.author_name | | keyword | +| trellix_edr_cloud.event.bytes_received | | long | +| trellix_edr_cloud.event.certs.issuer_name | | keyword | +| trellix_edr_cloud.event.certs.public_key_hash | | keyword | +| trellix_edr_cloud.event.certs.type | | keyword | +| trellix_edr_cloud.event.cmd_line | | keyword | +| trellix_edr_cloud.event.commands | | keyword | +| trellix_edr_cloud.event.data | | keyword | +| trellix_edr_cloud.event.dest.address | | ip | +| trellix_edr_cloud.event.dest.port | | long | +| trellix_edr_cloud.event.destination_address | | keyword | +| trellix_edr_cloud.event.device_id | | keyword | +| trellix_edr_cloud.event.direction | | keyword | +| trellix_edr_cloud.event.dns.class | | long | +| trellix_edr_cloud.event.dns.name | | keyword | +| trellix_edr_cloud.event.dns.names | | keyword | +| trellix_edr_cloud.event.dns.type | | long | +| trellix_edr_cloud.event.evid | | keyword | +| trellix_edr_cloud.event.file.attributes | | long | +| trellix_edr_cloud.event.file.creation_date | | date | +| trellix_edr_cloud.event.file.magic_bytes | | keyword | +| trellix_edr_cloud.event.file.md5 | | keyword | +| trellix_edr_cloud.event.file.modification_date | | date | +| trellix_edr_cloud.event.file.path | | keyword | +| trellix_edr_cloud.event.file.sha1 | | keyword | +| trellix_edr_cloud.event.file.sha256 | | keyword | +| trellix_edr_cloud.event.file.size | | long | +| trellix_edr_cloud.event.file.type | | keyword | +| trellix_edr_cloud.event.fqdn | | keyword | +| trellix_edr_cloud.event.http.request_headers | | keyword | +| trellix_edr_cloud.event.http.response_headers | | keyword | +| trellix_edr_cloud.event.http.url | | keyword | +| trellix_edr_cloud.event.id | | keyword | +| trellix_edr_cloud.event.integrity_level | | long | +| trellix_edr_cloud.event.key.name | | keyword | +| trellix_edr_cloud.event.key.old_value | | keyword | +| trellix_edr_cloud.event.key.val | | keyword | +| trellix_edr_cloud.event.module_name | | keyword | +| trellix_edr_cloud.event.name | | keyword | +| trellix_edr_cloud.event.operation_name | | keyword | +| trellix_edr_cloud.event.parent_event_id | | keyword | +| trellix_edr_cloud.event.pid | | long | +| trellix_edr_cloud.event.pipe_name | | keyword | +| trellix_edr_cloud.event.protocol | | keyword | +| trellix_edr_cloud.event.result | | long | +| trellix_edr_cloud.event.server_id | | keyword | +| trellix_edr_cloud.event.service.description | | keyword | +| trellix_edr_cloud.event.service.load_order_group | | keyword | +| trellix_edr_cloud.event.service.name | | keyword | +| trellix_edr_cloud.event.service.start_type | | long | +| trellix_edr_cloud.event.service.type | | long | +| trellix_edr_cloud.event.source.address | | ip | +| trellix_edr_cloud.event.source.port | | long | +| trellix_edr_cloud.event.subsystem | | long | +| trellix_edr_cloud.event.tag_id | | keyword | +| trellix_edr_cloud.event.target_pid | | keyword | +| trellix_edr_cloud.event.task.description | | keyword | +| trellix_edr_cloud.event.task.name | | keyword | +| trellix_edr_cloud.event.time | | date | +| trellix_edr_cloud.event.type | | keyword | +| trellix_edr_cloud.event.user.cid | | keyword | +| trellix_edr_cloud.event.user.domain | | keyword | +| trellix_edr_cloud.event.user.groups | | keyword | +| trellix_edr_cloud.event.user.name | | keyword | +| trellix_edr_cloud.event.user.names | | keyword | +| trellix_edr_cloud.event.user.sid | | keyword | +| trellix_edr_cloud.event.value.name | | keyword | +| trellix_edr_cloud.event.value.type | | keyword | +| trellix_edr_cloud.event.ver | | keyword | +| trellix_edr_cloud.event.version_info.file.name | | keyword | +| trellix_edr_cloud.event.version_info.file.version | | keyword | +| trellix_edr_cloud.event.version_info.product.name | | keyword | +| trellix_edr_cloud.event.version_info.product.version | | keyword | +| trellix_edr_cloud.event.version_info.vendor_name | | keyword | +| trellix_edr_cloud.event.wmi.local | | boolean | +| trellix_edr_cloud.event.wmi.ns | | keyword | + diff --git a/packages/trellix_edr_cloud/img/trellix-edr-cloud-event-dashboard.png b/packages/trellix_edr_cloud/img/trellix-edr-cloud-event-dashboard.png new file mode 100644 index 00000000000..669b3476d3a Binary files /dev/null and b/packages/trellix_edr_cloud/img/trellix-edr-cloud-event-dashboard.png differ diff --git a/packages/trellix_edr_cloud/img/trellix-edr-cloud-logo.svg b/packages/trellix_edr_cloud/img/trellix-edr-cloud-logo.svg new file mode 100644 index 00000000000..43eb58db407 --- /dev/null +++ b/packages/trellix_edr_cloud/img/trellix-edr-cloud-logo.svg @@ -0,0 +1,44 @@ + +Created with Fabric.js 3.5.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/packages/trellix_edr_cloud/img/trellix-logo.svg b/packages/trellix_edr_cloud/img/trellix-logo.svg new file mode 100644 index 00000000000..43eb58db407 --- /dev/null +++ b/packages/trellix_edr_cloud/img/trellix-logo.svg @@ -0,0 +1,44 @@ + +Created with Fabric.js 3.5.0 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/packages/trellix_edr_cloud/kibana/dashboard/trellix_edr_cloud-eb724520-0e93-11ee-9537-d3109e421092.json b/packages/trellix_edr_cloud/kibana/dashboard/trellix_edr_cloud-eb724520-0e93-11ee-9537-d3109e421092.json new file mode 100644 index 00000000000..43f5b607b67 --- /dev/null +++ b/packages/trellix_edr_cloud/kibana/dashboard/trellix_edr_cloud-eb724520-0e93-11ee-9537-d3109e421092.json @@ -0,0 +1,782 @@ +{ + "attributes": { + "description": "This dashboard shows overview of the Event logs collected by the Trellix EDR Cloud integration.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "data_stream.dataset", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "trellix_edr_cloud.event" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "data_stream.dataset": "trellix_edr_cloud.event" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-bf206711-d3fc-44f9-9606-2462207cc0b7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "bf206711-d3fc-44f9-9606-2462207cc0b7": { + "columnOrder": [ + "b1c00dbf-f236-417a-8d61-9da8e26663f3", + "a24b4a77-be40-4a74-ad94-10cac607498a" + ], + "columns": { + "a24b4a77-be40-4a74-ad94-10cac607498a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "b1c00dbf-f236-417a-8d61-9da8e26663f3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a24b4a77-be40-4a74-ad94-10cac607498a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trellix_edr_cloud.event.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "a24b4a77-be40-4a74-ad94-10cac607498a" + ], + "layerId": "bf206711-d3fc-44f9-9606-2462207cc0b7", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal_stacked", + "showGridlines": false, + "xAccessor": "b1c00dbf-f236-417a-8d61-9da8e26663f3" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false, + "type": "lens" + }, + "gridData": { + "h": 16, + "i": "ea2960ae-316e-4254-a98e-bf92df5be31f", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "ea2960ae-316e-4254-a98e-bf92df5be31f", + "title": "Distribution of Events by Type [Logs Trellix EDR Cloud]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-79769f4f-87a5-4e96-955a-c1b9e90986ae", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "79769f4f-87a5-4e96-955a-c1b9e90986ae": { + "columnOrder": [ + "bcf9f1df-05b7-44c6-816c-e845ba9757a8", + "c0f1d487-c17d-4b06-88c3-30717f8000a5" + ], + "columns": { + "bcf9f1df-05b7-44c6-816c-e845ba9757a8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Action", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c0f1d487-c17d-4b06-88c3-30717f8000a5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.action" + }, + "c0f1d487-c17d-4b06-88c3-30717f8000a5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "c0f1d487-c17d-4b06-88c3-30717f8000a5" + ], + "layerId": "79769f4f-87a5-4e96-955a-c1b9e90986ae", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "bcf9f1df-05b7-44c6-816c-e845ba9757a8" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false, + "type": "lens" + }, + "gridData": { + "h": 15, + "i": "510e4cd2-f26d-46ab-b433-77c34c3b26b2", + "w": 24, + "x": 0, + "y": 16 + }, + "panelIndex": "510e4cd2-f26d-46ab-b433-77c34c3b26b2", + "title": "Distribution of Events over Action [Logs Trellix EDR Cloud]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fc012aaa-9465-4133-ba28-62af03fc2d42", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "fc012aaa-9465-4133-ba28-62af03fc2d42": { + "columnOrder": [ + "d50fddfb-c4a9-462a-8eb1-48bb22c1d149", + "982a4a0a-14a1-4c11-b769-4898a903ce99" + ], + "columns": { + "982a4a0a-14a1-4c11-b769-4898a903ce99": { + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d50fddfb-c4a9-462a-8eb1-48bb22c1d149": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Version Info Vendor Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "982a4a0a-14a1-4c11-b769-4898a903ce99", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "trellix_edr_cloud.event.version_info.vendor_name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "fc012aaa-9465-4133-ba28-62af03fc2d42", + "layerType": "data", + "legendDisplay": "show", + "metrics": [ + "982a4a0a-14a1-4c11-b769-4898a903ce99" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "d50fddfb-c4a9-462a-8eb1-48bb22c1d149" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false, + "type": "lens" + }, + "gridData": { + "h": 15, + "i": "ad803ac2-d265-4c8f-8514-48b2ceae5957", + "w": 24, + "x": 24, + "y": 17 + }, + "panelIndex": "ad803ac2-d265-4c8f-8514-48b2ceae5957", + "title": "Distribution of Events by Vendor Name [Logs Trellix EDR Cloud]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-775e7912-39be-40c9-8e50-b18025f1c968", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "775e7912-39be-40c9-8e50-b18025f1c968": { + "columnOrder": [ + "6a5aba86-fb60-48ea-9125-722fa6d6fcb4", + "19d46073-39e3-4722-9d85-29871693c705", + "325c7d5c-8a1c-4373-a4cb-74c9b768fb4d" + ], + "columns": { + "19d46073-39e3-4722-9d85-29871693c705": { + "customLabel": true, + "dataType": "date", + "isBucketed": true, + "label": "Timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "325c7d5c-8a1c-4373-a4cb-74c9b768fb4d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "6a5aba86-fb60-48ea-9125-722fa6d6fcb4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "325c7d5c-8a1c-4373-a4cb-74c9b768fb4d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trellix_edr_cloud.event.type" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "325c7d5c-8a1c-4373-a4cb-74c9b768fb4d" + ], + "layerId": "775e7912-39be-40c9-8e50-b18025f1c968", + "layerType": "data", + "position": "top", + "seriesType": "line", + "showGridlines": false, + "splitAccessor": "6a5aba86-fb60-48ea-9125-722fa6d6fcb4", + "xAccessor": "19d46073-39e3-4722-9d85-29871693c705" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false, + "type": "lens" + }, + "gridData": { + "h": 16, + "i": "3780e263-4202-4bb1-aef3-b469504d4d1d", + "w": 24, + "x": 0, + "y": 31 + }, + "panelIndex": "3780e263-4202-4bb1-aef3-b469504d4d1d", + "title": "Distribution of Events over Time [Logs Trellix EDR Cloud]", + "type": "lens", + "version": "8.9.0" + }, + { + "embeddableConfig": { + "attributes": { + "description": "", + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-66b5a9f8-65bc-41ec-99c4-044254cc00c5", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "66b5a9f8-65bc-41ec-99c4-044254cc00c5": { + "columnOrder": [ + "f704df78-ece3-427c-ab09-e41bcc25c412", + "d89e9d81-9980-4177-a040-6e32e3a43974", + "8d6b8ba6-adc8-4c6d-a7eb-42949c9c0170", + "7f10f178-4568-441a-94b3-1e91031eeaaa", + "333c0ee1-5886-4b32-beb5-da1891ad62c1" + ], + "columns": { + "333c0ee1-5886-4b32-beb5-da1891ad62c1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "7f10f178-4568-441a-94b3-1e91031eeaaa": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Integrity Level", + "operationType": "range", + "params": { + "includeEmptyRows": true, + "maxBars": "auto", + "ranges": [ + { + "from": 0, + "label": "", + "to": 1000 + } + ], + "type": "histogram" + }, + "scale": "interval", + "sourceField": "trellix_edr_cloud.event.integrity_level" + }, + "8d6b8ba6-adc8-4c6d-a7eb-42949c9c0170": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "333c0ee1-5886-4b32-beb5-da1891ad62c1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.domain" + }, + "d89e9d81-9980-4177-a040-6e32e3a43974": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "333c0ee1-5886-4b32-beb5-da1891ad62c1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "f704df78-ece3-427c-ab09-e41bcc25c412": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "User ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "333c0ee1-5886-4b32-beb5-da1891ad62c1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "user.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "f704df78-ece3-427c-ab09-e41bcc25c412", + "isTransposed": false + }, + { + "columnId": "d89e9d81-9980-4177-a040-6e32e3a43974", + "isTransposed": false + }, + { + "columnId": "8d6b8ba6-adc8-4c6d-a7eb-42949c9c0170", + "isTransposed": false + }, + { + "columnId": "333c0ee1-5886-4b32-beb5-da1891ad62c1", + "isTransposed": false + }, + { + "alignment": "right", + "columnId": "7f10f178-4568-441a-94b3-1e91031eeaaa", + "isTransposed": false + } + ], + "layerId": "66b5a9f8-65bc-41ec-99c4-044254cc00c5", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false, + "type": "lens" + }, + "gridData": { + "h": 16, + "i": "ab3dc1ce-9a8f-4ddc-b4b2-ffb0bee6bb3d", + "w": 24, + "x": 24, + "y": 26 + }, + "panelIndex": "ab3dc1ce-9a8f-4ddc-b4b2-ffb0bee6bb3d", + "title": "Top 10 User with Integrity Level [Logs Trellix EDR Cloud]", + "type": "lens", + "version": "8.9.0" + } + ], + "timeRestore": false, + "title": "[Logs Trellix EDR Cloud] Event", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2023-07-28T12:42:33.206Z", + "id": "trellix_edr_cloud-eb724520-0e93-11ee-9537-d3109e421092", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ea2960ae-316e-4254-a98e-bf92df5be31f:indexpattern-datasource-layer-bf206711-d3fc-44f9-9606-2462207cc0b7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "510e4cd2-f26d-46ab-b433-77c34c3b26b2:indexpattern-datasource-layer-79769f4f-87a5-4e96-955a-c1b9e90986ae", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ad803ac2-d265-4c8f-8514-48b2ceae5957:indexpattern-datasource-layer-fc012aaa-9465-4133-ba28-62af03fc2d42", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3780e263-4202-4bb1-aef3-b469504d4d1d:indexpattern-datasource-layer-775e7912-39be-40c9-8e50-b18025f1c968", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "ab3dc1ce-9a8f-4ddc-b4b2-ffb0bee6bb3d:indexpattern-datasource-layer-66b5a9f8-65bc-41ec-99c4-044254cc00c5", + "type": "index-pattern" + } + ], + "type": "dashboard", + "migrationVersion": { + "dashboard": "8.9.0" + } +} \ No newline at end of file diff --git a/packages/trellix_edr_cloud/kibana/tags.yml b/packages/trellix_edr_cloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/trellix_edr_cloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/trellix_edr_cloud/manifest.yml b/packages/trellix_edr_cloud/manifest.yml new file mode 100644 index 00000000000..f78b7eed2c5 --- /dev/null +++ b/packages/trellix_edr_cloud/manifest.yml @@ -0,0 +1,151 @@ +format_version: "3.0.0" +name: trellix_edr_cloud +title: Trellix EDR Cloud +version: "0.3.0" +description: Collect logs from Trellix EDR Cloud with Elastic Agent. +type: integration +categories: + - cloud + - security +conditions: + kibana: + version: ^8.9.0 + elastic: + subscription: basic +screenshots: + - src: /img/trellix-edr-cloud-event-dashboard.png + title: Trellix EDR Cloud Event Dashboard Screenshot + size: 600x600 + type: image/png +icons: + - src: /img/trellix-logo.svg + title: Sample logo + size: 32x32 + type: image/svg+xml +policy_templates: + - name: Trellix EDR + title: Trellix EDR logs + description: Collect logs using AWS S3 or AWS SQS. + inputs: + - type: aws-s3 + title: Collect Trellix EDR logs via AWS S3 or AWS SQS + description: Collecting logs from Trellix EDR via AWS S3 or AWS SQS. + vars: + - name: collect_s3_logs + required: true + show_user: true + title: Collect logs via S3 Bucket + description: To collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue. + type: bool + multi: false + default: false + - name: bucket_arn + type: text + title: "[S3] Bucket ARN" + multi: false + required: false + show_user: true + description: It is a required parameter for collecting logs via the AWS S3 Bucket. + - name: queue_url + type: text + title: "[SQS] Queue URL" + multi: false + required: false + show_user: true + description: URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS. + - name: access_key_id + type: password + title: Access Key ID + multi: false + required: false + show_user: true + description: First part of access key. This parameter along with the secret_access_key parameter is required if we are not providing shared_credential_file. + - name: secret_access_key + type: password + title: Secret Access Key + multi: false + required: false + show_user: true + description: Second part of access key. This parameter along with the access_key_id parameter is required if we are not providing shared_credential_file. + - name: region + type: text + title: "[SQS] Region" + multi: false + required: false + show_user: true + description: The name of the AWS region of the end point. If this option is given it takes precedence over the region name obtained from the queue_url value. + - name: session_token + type: text + title: Session Token + multi: false + required: false + show_user: true + description: Required when using temporary security credentials. + - name: shared_credential_file + type: text + title: Shared Credential File + multi: false + required: false + show_user: false + description: Directory of the shared credentials file. This parameter is required if we are not providing value for the parameters - secret_access_key and access_key_id. + - name: credential_profile_name + type: text + title: Credential Profile Name + multi: false + required: false + show_user: false + description: Profile name in shared credentials file. + - name: role_arn + type: text + title: Role ARN + multi: false + required: false + show_user: false + description: AWS IAM Role to assume. + - name: fips_enabled + type: bool + title: Enable S3 FIPS + default: false + multi: false + required: false + show_user: false + description: Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint. + - name: proxy_url + type: text + title: Proxy URL + multi: false + required: false + show_user: false + description: URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format. + - name: ssl + type: yaml + title: SSL Configuration + description: i.e. certificate_authorities, supported_protocols, verification_mode etc. + multi: false + required: false + show_user: false + default: | + #certificate_authorities: + # - | + # -----BEGIN CERTIFICATE----- + # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF + # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 + # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB + # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n + # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl + # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t + # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP + # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 + # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O + # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux + # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D + # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw + # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA + # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu + # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 + # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk + # sxSmbIUfc2SGJGCJD4I= + # -----END CERTIFICATE----- +owner: + github: elastic/security-external-integrations + type: elastic diff --git a/packages/trellix_epo_cloud/_dev/build/build.yml b/packages/trellix_epo_cloud/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/trellix_epo_cloud/_dev/build/build.yml +++ b/packages/trellix_epo_cloud/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/trellix_epo_cloud/changelog.yml b/packages/trellix_epo_cloud/changelog.yml index 6101f5ca3ee..7df678068e3 100644 --- a/packages/trellix_epo_cloud/changelog.yml +++ b/packages/trellix_epo_cloud/changelog.yml @@ -1,4 +1,39 @@ # newer versions go on top +- version: 1.5.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.4.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.3.0" + changes: + - description: Add support for HTTP request trace logs. + type: enhancement + link: https://github.com/elastic/integrations/pull/7334 +- version: "1.2.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.1.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.0.2" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 +- version: "1.0.1" + changes: + - description: Work around CEL `now` static global behaviour. + type: bugfix + link: https://github.com/elastic/integrations/pull/7004 - version: "1.0.0" changes: - description: Release Trellix ePO Cloud as GA. diff --git a/packages/trellix_epo_cloud/data_stream/device/_dev/test/pipeline/test-device.log-expected.json b/packages/trellix_epo_cloud/data_stream/device/_dev/test/pipeline/test-device.log-expected.json index bde562987c3..3fc46d88e60 100644 --- a/packages/trellix_epo_cloud/data_stream/device/_dev/test/pipeline/test-device.log-expected.json +++ b/packages/trellix_epo_cloud/data_stream/device/_dev/test/pipeline/test-device.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -118,7 +118,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -209,7 +209,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/trellix_epo_cloud/data_stream/device/agent/stream/input.yml.hbs b/packages/trellix_epo_cloud/data_stream/device/agent/stream/input.yml.hbs index 7be86990460..7789b7d8c24 100644 --- a/packages/trellix_epo_cloud/data_stream/device/agent/stream/input.yml.hbs +++ b/packages/trellix_epo_cloud/data_stream/device/agent/stream/input.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" +{{/if}} {{#if proxy_url}} resource.proxy_url: {{proxy_url}} {{/if}} diff --git a/packages/trellix_epo_cloud/data_stream/device/elasticsearch/ingest_pipeline/default.yml b/packages/trellix_epo_cloud/data_stream/device/elasticsearch/ingest_pipeline/default.yml index 1f4d107ca41..b523315e59b 100644 --- a/packages/trellix_epo_cloud/data_stream/device/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trellix_epo_cloud/data_stream/device/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Device logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: event @@ -24,7 +24,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - rename: @@ -74,7 +74,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.device.attributes.ip_address}}}' @@ -96,7 +96,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - uppercase: field: trellix_epo_cloud.device.attributes.mac_address ignore_missing: true @@ -214,7 +214,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.agentVersion target_field: trellix_epo_cloud.device.attributes.agent.version @@ -229,7 +229,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.cpuType target_field: trellix_epo_cloud.device.attributes.cpu.type @@ -261,7 +261,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.managed target_field: trellix_epo_cloud.device.attributes.managed @@ -284,7 +284,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.name target_field: trellix_epo_cloud.device.attributes.name @@ -299,7 +299,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.nodePath target_field: trellix_epo_cloud.device.attributes.node.path @@ -314,7 +314,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.osBuildNumber tag: 'convert_osBuildNumber_to_long' @@ -325,7 +325,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.parentId tag: 'convert_parentId_to_string' @@ -336,7 +336,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.subnetAddress target_field: trellix_epo_cloud.device.attributes.subnet_address @@ -351,7 +351,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.systemManufacturer target_field: trellix_epo_cloud.device.attributes.system.manufacturer @@ -378,7 +378,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - split: field: json.attributes.tags target_field: trellix_epo_cloud.device.attributes.tags @@ -394,7 +394,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.totalPhysicalMemory tag: 'convert_totalPhysicalMemory_to_long' @@ -405,7 +405,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.relationships.devices.data.id target_field: trellix_epo_cloud.device.relationships.devices.data.id diff --git a/packages/trellix_epo_cloud/data_stream/device/manifest.yml b/packages/trellix_epo_cloud/data_stream/device/manifest.yml index 1d728127864..d15bffc7d03 100644 --- a/packages/trellix_epo_cloud/data_stream/device/manifest.yml +++ b/packages/trellix_epo_cloud/data_stream/device/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trellix ePO Cloud API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trellix ePO Cloud API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false @@ -63,3 +63,12 @@ streams: show_user: false description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: > + The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details. + diff --git a/packages/trellix_epo_cloud/data_stream/device/sample_event.json b/packages/trellix_epo_cloud/data_stream/device/sample_event.json index 1382e649aa5..884654ff1aa 100644 --- a/packages/trellix_epo_cloud/data_stream/device/sample_event.json +++ b/packages/trellix_epo_cloud/data_stream/device/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", diff --git a/packages/trellix_epo_cloud/data_stream/event/_dev/test/pipeline/test-pipeline-event.log-expected.json b/packages/trellix_epo_cloud/data_stream/event/_dev/test/pipeline/test-pipeline-event.log-expected.json index b42fcbff235..bb19d1a0a62 100644 --- a/packages/trellix_epo_cloud/data_stream/event/_dev/test/pipeline/test-pipeline-event.log-expected.json +++ b/packages/trellix_epo_cloud/data_stream/event/_dev/test/pipeline/test-pipeline-event.log-expected.json @@ -13,7 +13,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -136,7 +136,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/trellix_epo_cloud/data_stream/event/agent/stream/input.yml.hbs b/packages/trellix_epo_cloud/data_stream/event/agent/stream/input.yml.hbs index 7a12107d823..8ec84858ee1 100644 --- a/packages/trellix_epo_cloud/data_stream/event/agent/stream/input.yml.hbs +++ b/packages/trellix_epo_cloud/data_stream/event/agent/stream/input.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" +{{/if}} {{#if proxy_url}} resource.proxy_url: {{proxy_url}} {{/if}} @@ -36,7 +39,7 @@ program: | ? state.cursor.last_timestamp.parse_time(time_layout.RFC3339Nano) : - (now - duration(state.initial_interval)) + (now() - duration(state.initial_interval)) ).format(time_layout.RFC3339Nano)] }.format_query()).with({ "Header": { diff --git a/packages/trellix_epo_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/trellix_epo_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml index bd396ae640a..a358658a5c3 100644 --- a/packages/trellix_epo_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trellix_epo_cloud/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Event logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: alert @@ -24,7 +24,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - fingerprint: @@ -44,7 +44,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.attributes.timestamp tag: 'date_timestamp' @@ -55,7 +55,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.targethostname target_field: trellix_epo_cloud.event.attributes.target.hostname @@ -78,7 +78,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.targetipv4 tag: 'convert_targetipv4_to_ip' @@ -89,7 +89,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.target.ipv4}}}' @@ -108,7 +108,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.targetipv6 tag: 'convert_targetipv6_to_ip' @@ -119,7 +119,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.target.ipv6}}}' @@ -140,7 +140,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - uppercase: field: json.attributes.targetmac if: ctx.json?.attributes?.targetmac?.toLowerCase() != 'none' @@ -164,7 +164,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.port copy_from: trellix_epo_cloud.event.attributes.target.port @@ -211,7 +211,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.severity copy_from: trellix_epo_cloud.event.attributes.threat.severity @@ -285,7 +285,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.sourcehostname target_field: trellix_epo_cloud.event.attributes.source.hostname @@ -308,7 +308,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.sourceipv4 tag: convert_sourceipv4_to_ip @@ -319,7 +319,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.source.ipv4}}}' @@ -338,7 +338,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.sourceipv6 tag: convert_sourceipv6_to_ip @@ -349,7 +349,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.source.ipv6}}}' @@ -370,7 +370,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - uppercase: field: json.attributes.sourcemac if: ctx.json?.attributes?.sourcemac?.toLowerCase() != 'none' @@ -444,7 +444,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.analyzeripv4 tag: convert_analyzeripv4_to_ip @@ -455,7 +455,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.analyzer.ipv4}}}' @@ -470,7 +470,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.analyzeripv6 tag: convert_analyzeripv6_to_ip @@ -481,7 +481,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{trellix_epo_cloud.event.attributes.analyzer.ipv6}}}' @@ -497,7 +497,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - uppercase: field: json.attributes.analyzermac if: ctx.json?.attributes?.analyzermac?.toLowerCase() != 'none' @@ -528,7 +528,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.nodepath target_field: trellix_epo_cloud.event.attributes.node.path @@ -543,7 +543,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.sourceprocesssigned target_field: trellix_epo_cloud.event.attributes.source.process.signed @@ -578,7 +578,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.threathandled tag: convert_threathandled_to_boolean @@ -589,7 +589,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.threatname target_field: trellix_epo_cloud.event.attributes.threat.name diff --git a/packages/trellix_epo_cloud/data_stream/event/manifest.yml b/packages/trellix_epo_cloud/data_stream/event/manifest.yml index 96c38663cd0..d543416680e 100644 --- a/packages/trellix_epo_cloud/data_stream/event/manifest.yml +++ b/packages/trellix_epo_cloud/data_stream/event/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the Event logs from Trellix ePO Cloud. The data retention period for events available via this API is 3 days. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the Event logs from Trellix ePO Cloud. The data retention period for events available via this API is 3 days. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trellix ePO Cloud API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trellix ePO Cloud API. Supported units for this parameter are h/m/s. default: 5m multi: false required: true @@ -33,7 +33,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false @@ -71,3 +71,12 @@ streams: show_user: false description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: > + The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details. + diff --git a/packages/trellix_epo_cloud/data_stream/event/sample_event.json b/packages/trellix_epo_cloud/data_stream/event/sample_event.json index 289e4b710b8..d3345d66456 100644 --- a/packages/trellix_epo_cloud/data_stream/event/sample_event.json +++ b/packages/trellix_epo_cloud/data_stream/event/sample_event.json @@ -23,7 +23,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", diff --git a/packages/trellix_epo_cloud/data_stream/group/_dev/test/pipeline/test-group.log-expected.json b/packages/trellix_epo_cloud/data_stream/group/_dev/test/pipeline/test-group.log-expected.json index 59b7f667424..f679681c7a0 100644 --- a/packages/trellix_epo_cloud/data_stream/group/_dev/test/pipeline/test-group.log-expected.json +++ b/packages/trellix_epo_cloud/data_stream/group/_dev/test/pipeline/test-group.log-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/trellix_epo_cloud/data_stream/group/agent/stream/input.yml.hbs b/packages/trellix_epo_cloud/data_stream/group/agent/stream/input.yml.hbs index 85e79b43f66..7eacba6ed1f 100644 --- a/packages/trellix_epo_cloud/data_stream/group/agent/stream/input.yml.hbs +++ b/packages/trellix_epo_cloud/data_stream/group/agent/stream/input.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson" +{{/if}} {{#if proxy_url}} resource.proxy_url: {{proxy_url}} {{/if}} diff --git a/packages/trellix_epo_cloud/data_stream/group/elasticsearch/ingest_pipeline/default.yml b/packages/trellix_epo_cloud/data_stream/group/elasticsearch/ingest_pipeline/default.yml index 6caa66ec44c..c43ee13415c 100644 --- a/packages/trellix_epo_cloud/data_stream/group/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trellix_epo_cloud/data_stream/group/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Group logs. processors: - set: field: ecs.version - value: 8.8.0 + value: 8.9.0 - set: field: event.kind value: event @@ -24,7 +24,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - drop: if: ctx.json?.data != null && ctx.json.data.isEmpty() - rename: @@ -61,7 +61,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.l1ParentId tag: 'convert_parentId_to_string' @@ -72,7 +72,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.attributes.l2ParentId tag: 'convert_parentId_to_string' @@ -83,7 +83,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.attributes.nodePath target_field: trellix_epo_cloud.group.attributes.node.path @@ -110,7 +110,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.relationships.groups.data.id target_field: trellix_epo_cloud.group.relationships.groups.data.id diff --git a/packages/trellix_epo_cloud/data_stream/group/manifest.yml b/packages/trellix_epo_cloud/data_stream/group/manifest.yml index 3a07c3c9edc..92ea29fd717 100644 --- a/packages/trellix_epo_cloud/data_stream/group/manifest.yml +++ b/packages/trellix_epo_cloud/data_stream/group/manifest.yml @@ -9,7 +9,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trellix ePO Cloud API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trellix ePO Cloud API. Supported units for this parameter are h/m/s. default: 1h multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false @@ -63,3 +63,12 @@ streams: show_user: false description: >- Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: > + The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details. + diff --git a/packages/trellix_epo_cloud/data_stream/group/sample_event.json b/packages/trellix_epo_cloud/data_stream/group/sample_event.json index cfad026de13..585f6a049db 100644 --- a/packages/trellix_epo_cloud/data_stream/group/sample_event.json +++ b/packages/trellix_epo_cloud/data_stream/group/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", diff --git a/packages/trellix_epo_cloud/docs/README.md b/packages/trellix_epo_cloud/docs/README.md index ba6ebfa1fd7..0746abc3146 100644 --- a/packages/trellix_epo_cloud/docs/README.md +++ b/packages/trellix_epo_cloud/docs/README.md @@ -73,7 +73,7 @@ An example event for `device` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", @@ -295,7 +295,7 @@ An example event for `event` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", @@ -514,7 +514,7 @@ An example event for `group` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "09aeef39-f21d-41e4-b3a6-c1551488d075", diff --git a/packages/trellix_epo_cloud/kibana/tags.yml b/packages/trellix_epo_cloud/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/trellix_epo_cloud/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/trellix_epo_cloud/manifest.yml b/packages/trellix_epo_cloud/manifest.yml index 51e603fd945..5ac53ffefe0 100644 --- a/packages/trellix_epo_cloud/manifest.yml +++ b/packages/trellix_epo_cloud/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.6.0 +format_version: "3.0.0" name: trellix_epo_cloud title: Trellix ePO Cloud -version: "1.0.0" +version: "1.5.0" source: license: Elastic-2.0 description: Collect logs from Trellix ePO Cloud with Elastic Agent. @@ -9,8 +9,10 @@ type: integration categories: - security conditions: - kibana.version: ^8.7.1 - elastic.subscription: basic + kibana: + version: ^8.7.1 + elastic: + subscription: basic screenshots: - src: /img/trellix-epo-cloud-device-dashboard.png title: Trellix ePO Cloud Device Screenshot @@ -111,3 +113,4 @@ policy_templates: # -----END CERTIFICATE----- owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/trend_micro_vision_one/_dev/build/build.yml b/packages/trend_micro_vision_one/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/trend_micro_vision_one/_dev/build/build.yml +++ b/packages/trend_micro_vision_one/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/trend_micro_vision_one/changelog.yml b/packages/trend_micro_vision_one/changelog.yml index fab8012d592..0906cf010a7 100644 --- a/packages/trend_micro_vision_one/changelog.yml +++ b/packages/trend_micro_vision_one/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.7.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.6.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.5.0" + changes: + - description: Update package to package-spec 2.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/6681 - version: "1.4.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/trend_micro_vision_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json b/packages/trend_micro_vision_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json index 0f6e4bcb646..aed6184cf07 100644 --- a/packages/trend_micro_vision_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json +++ b/packages/trend_micro_vision_one/data_stream/alert/_dev/test/pipeline/test-pipeline-alert.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2030-04-30T00:01:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -115,7 +115,7 @@ { "@timestamp": "2030-04-30T00:01:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "id": "WB-9002-20200427-0002", @@ -235,7 +235,7 @@ { "@timestamp": "2022-07-15T12:46:13.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -504,7 +504,7 @@ { "@timestamp": "2030-04-30T00:01:16.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/trend_micro_vision_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml b/packages/trend_micro_vision_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml index ae43d0ec643..d70bae14ece 100644 --- a/packages/trend_micro_vision_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trend_micro_vision_one/data_stream/alert/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Trend Micro Vision One Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/trend_micro_vision_one/data_stream/alert/manifest.yml b/packages/trend_micro_vision_one/data_stream/alert/manifest.yml index 07230e95c44..0617db87880 100644 --- a/packages/trend_micro_vision_one/data_stream/alert/manifest.yml +++ b/packages/trend_micro_vision_one/data_stream/alert/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the alert from Trend Micro Vision One. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the alert from Trend Micro Vision One. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trend Micro Vision One API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s. default: 5m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/trend_micro_vision_one/data_stream/alert/sample_event.json b/packages/trend_micro_vision_one/data_stream/alert/sample_event.json index 87c0d9c808b..9c37294154b 100644 --- a/packages/trend_micro_vision_one/data_stream/alert/sample_event.json +++ b/packages/trend_micro_vision_one/data_stream/alert/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2030-04-30T00:01:16.000Z", "agent": { - "ephemeral_id": "866cfa51-4f51-436a-8e64-6075e4fc5940", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "e8bb2f2d-dd53-4857-b365-dd14b64f6459", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.alert", @@ -13,22 +13,22 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", "category": [ "email" ], - "created": "2022-12-05T12:05:45.098Z", + "created": "2023-06-30T18:10:12.755Z", "dataset": "trend_micro_vision_one.alert", "id": "WB-9002-20200427-0002", - "ingested": "2022-12-05T12:05:48Z", + "ingested": "2023-06-30T18:10:13Z", "kind": "alert", "original": "{\"alertProvider\":\"SAE\",\"createdDateTime\":\"2020-04-30T00:01:15Z\",\"description\":\"A backdoor was possibly implanted after a user received a possible spear phishing email message.\",\"id\":\"WB-9002-20200427-0002\",\"impactScope\":{\"accountCount\":0,\"desktopCount\":0,\"emailAddressCount\":0,\"entities\":[{\"entityId\":\"5257b401-2fd7-469c-94fa-39a4f11eb925\",\"entityType\":\"host\",\"entityValue\":\"user@email.com\",\"provenance\":[\"Alert\"],\"relatedEntities\":[\"CODERED\\\\\\\\user\"],\"relatedIndicatorIds\":[1]}],\"serverCount\":0},\"indicators\":[{\"field\":\"request url\",\"filterIds\":[\"f862df72-7f5e-4b2b-9f7f-9148e875f908\"],\"id\":1,\"provenance\":[\"Alert\"],\"relatedEntities\":[\"user@example.com\"],\"type\":\"url\",\"value\":\"http://www.example.com/ab001.zip\"}],\"investigationStatus\":\"New\",\"matchedRules\":[{\"id\":\"5f52d1f1-53e7-411a-b74f-745ee81fa30b\",\"matchedFilters\":[{\"id\":\"ccf86fc1-688f-4131-a46f-1d7a6ee2f88e\",\"matchedDateTime\":\"2019-08-02T04:00:01Z\",\"matchedEvents\":[{\"matchedDateTime\":\"2019-08-02T04:00:01Z\",\"type\":\"TELEMETRY_REGISTRY\",\"uuid\":\"fa9ff47c-e1b8-459e-a3d0-a5b104b854a5\"}],\"mitreTechniqueIds\":[\"T1192\"],\"name\":\"(T1192) Spearphishing Link\"}],\"name\":\"Possible SpearPhishing Email\"}],\"model\":\"Possible APT Attack\",\"schemaVersion\":\"1.0\",\"score\":63,\"severity\":\"critical\",\"updatedDateTime\":\"2030-04-30T00:01:16Z\",\"workbenchLink\":\"https://THE_WORKBENCH_URL\"}", "severity": 63, diff --git a/packages/trend_micro_vision_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json b/packages/trend_micro_vision_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json index 26157e1f1b0..a9d5b4959c0 100644 --- a/packages/trend_micro_vision_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json +++ b/packages/trend_micro_vision_one/data_stream/audit/_dev/test/pipeline/test-pipeline-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2022-02-24T07:29:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -24,7 +24,9 @@ "source": { "user": { "name": "Root Account", - "roles": "Master Administrator" + "roles": [ + "Master Administrator" + ] } }, "tags": [ @@ -49,7 +51,7 @@ { "@timestamp": "2022-07-16T04:30:04.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -70,7 +72,9 @@ "source": { "user": { "name": "Root Account", - "roles": "Master Administrator" + "roles": [ + "Master Administrator" + ] } }, "tags": [ diff --git a/packages/trend_micro_vision_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/trend_micro_vision_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index a54e66ad05b..ff71efe4762 100644 --- a/packages/trend_micro_vision_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trend_micro_vision_one/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Trend Micro Vision One Audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -97,10 +97,10 @@ processors: field: json.loggedRole target_field: trend_micro_vision_one.audit.logged_role ignore_missing: true - - set: + - append: field: source.user.roles - copy_from: trend_micro_vision_one.audit.logged_role - ignore_failure: true + value: '{{{trend_micro_vision_one.audit.logged_role}}}' + if: ctx.trend_micro_vision_one?.audit?.logged_role != null - rename: field: json.accessType target_field: trend_micro_vision_one.audit.access_type diff --git a/packages/trend_micro_vision_one/data_stream/audit/manifest.yml b/packages/trend_micro_vision_one/data_stream/audit/manifest.yml index 3376929cdb9..c82b2975dbc 100644 --- a/packages/trend_micro_vision_one/data_stream/audit/manifest.yml +++ b/packages/trend_micro_vision_one/data_stream/audit/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the audit from Trend Micro Vision One. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the audit from Trend Micro Vision One. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trend Micro Vision One API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s. default: 5m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/trend_micro_vision_one/data_stream/audit/sample_event.json b/packages/trend_micro_vision_one/data_stream/audit/sample_event.json index bde926c4f78..8001f349db6 100644 --- a/packages/trend_micro_vision_one/data_stream/audit/sample_event.json +++ b/packages/trend_micro_vision_one/data_stream/audit/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2022-02-24T07:29:48.000Z", "agent": { - "ephemeral_id": "61fc6813-92eb-4a3e-a3fb-a744a758fe1b", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "55517b36-4796-4ee6-b24f-86dfb26ed90c", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.audit", @@ -13,21 +13,21 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", "category": [ "authentication" ], - "created": "2022-12-05T12:07:05.750Z", + "created": "2023-06-30T18:10:57.950Z", "dataset": "trend_micro_vision_one.audit", - "ingested": "2022-12-05T12:07:09Z", + "ingested": "2023-06-30T18:11:00Z", "kind": "event", "original": "{\"accessType\":\"Console\",\"activity\":\"string\",\"category\":\"Logon and Logoff\",\"details\":{\"property1\":\"string\",\"property2\":\"string\"},\"loggedDateTime\":\"2022-02-24T07:29:48Z\",\"loggedRole\":\"Master Administrator\",\"loggedUser\":\"Root Account\",\"result\":\"Unsuccessful\"}", "outcome": "failure", @@ -46,7 +46,9 @@ "source": { "user": { "name": "Root Account", - "roles": "Master Administrator" + "roles": [ + "Master Administrator" + ] } }, "tags": [ diff --git a/packages/trend_micro_vision_one/data_stream/detection/_dev/test/pipeline/test-pipeline-detection.log-expected.json b/packages/trend_micro_vision_one/data_stream/detection/_dev/test/pipeline/test-pipeline-detection.log-expected.json index 6917c318489..5407535723a 100644 --- a/packages/trend_micro_vision_one/data_stream/detection/_dev/test/pipeline/test-pipeline-detection.log-expected.json +++ b/packages/trend_micro_vision_one/data_stream/detection/_dev/test/pipeline/test-pipeline-detection.log-expected.json @@ -10,7 +10,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "clean", @@ -57,7 +57,9 @@ }, "observer": { "hostname": "samplehost", - "mac": "00-11-22-33-44-55" + "mac": [ + "00-11-22-33-44-55" + ] }, "process": { "command_line": "-ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca", @@ -300,7 +302,7 @@ ] }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": [ diff --git a/packages/trend_micro_vision_one/data_stream/detection/elasticsearch/ingest_pipeline/default.yml b/packages/trend_micro_vision_one/data_stream/detection/elasticsearch/ingest_pipeline/default.yml index 0f61860e4c7..81797e3c7c9 100644 --- a/packages/trend_micro_vision_one/data_stream/detection/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trend_micro_vision_one/data_stream/detection/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Trend Micro Vision One Alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -257,10 +257,10 @@ processors: field: json.deviceMacAddress target_field: trend_micro_vision_one.detection.device.mac ignore_missing: true - - set: + - append: field: observer.mac - copy_from: trend_micro_vision_one.detection.device.mac - ignore_failure: true + value: '{{{trend_micro_vision_one.detection.device.mac}}}' + if: ctx.trend_micro_vision_one?.detection?.device?.mac != null - rename: field: json.processCmd target_field: trend_micro_vision_one.detection.process.cmd diff --git a/packages/trend_micro_vision_one/data_stream/detection/manifest.yml b/packages/trend_micro_vision_one/data_stream/detection/manifest.yml index 908ce8903cb..86c0a9a500f 100644 --- a/packages/trend_micro_vision_one/data_stream/detection/manifest.yml +++ b/packages/trend_micro_vision_one/data_stream/detection/manifest.yml @@ -9,7 +9,7 @@ streams: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the detection from Trend Micro Vision One. NOTE:- Supported units for this parameter are h/m/s. + description: How far back to pull the detection from Trend Micro Vision One. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -17,7 +17,7 @@ streams: - name: interval type: text title: Interval - description: Duration between requests to the Trend Micro Vision One API. NOTE:- Supported units for this parameter are h/m/s. + description: Duration between requests to the Trend Micro Vision One API. Supported units for this parameter are h/m/s. default: 5m multi: false required: true @@ -25,7 +25,7 @@ streams: - name: http_client_timeout type: text title: HTTP Client Timeout - description: Duration before declaring that the HTTP client connection has timed out. NOTE:- Valid time units are ns, us, ms, s, m, h. + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: false diff --git a/packages/trend_micro_vision_one/data_stream/detection/sample_event.json b/packages/trend_micro_vision_one/data_stream/detection/sample_event.json index 64727396f44..ca3cb521b8d 100644 --- a/packages/trend_micro_vision_one/data_stream/detection/sample_event.json +++ b/packages/trend_micro_vision_one/data_stream/detection/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-10-15T01:16:32.000Z", "agent": { - "ephemeral_id": "73668026-8712-43d7-a6b9-c2e596ddb5cb", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "02b4e40b-648f-46e8-b99c-b2c1337d678e", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.detection", @@ -20,12 +20,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "action": "clean", @@ -33,10 +33,10 @@ "category": [ "intrusion_detection" ], - "created": "2022-12-05T12:08:22.747Z", + "created": "2023-06-30T18:11:44.982Z", "dataset": "trend_micro_vision_one.detection", "id": "100117", - "ingested": "2022-12-05T12:08:26Z", + "ingested": "2023-06-30T18:11:45Z", "kind": "event", "original": "{\"act\":\"Clean\",\"actResult\":\"Quarantined successfully\",\"app\":\"HTTP\",\"appGroup\":\"HTTP\",\"aptRelated\":\"0\",\"behaviorCat\":\"Grey-Detection\",\"blocking\":\"Web reputation\",\"cat\":50,\"cccaDetection\":\"Yes\",\"cccaDetectionSource\":\"GLOBAL_INTELLIGENCE\",\"cccaRiskLevel\":3,\"clientFlag\":\"dst\",\"cnt\":\"1\",\"component\":[\"PATTERN_VSAPI 17.101.92 2021-09-30 04:23:27-07:00\"],\"compressedFileSize\":\"0\",\"detectionType\":\"File\",\"deviceDirection\":\"outbound\",\"deviceGUID\":\"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\",\"deviceMacAddress\":\"00-00-5E-00-53-23\",\"deviceProcessName\":\"/snap/core/10126/usr/lib/snapd/snapd\",\"dhost\":\"samplehost\",\"domainName\":\"Workgroup\",\"dpt\":53,\"dst\":[\"81.2.69.142\"],\"dstGroup\":\"Default\",\"end\":\"2021-09-30T09:40:04-08:00\",\"endpointGUID\":\"1234-1234-1234\",\"endpointHostName\":\"abc-docker\",\"endpointIp\":[\"81.2.69.142\"],\"endpointMacAddress\":\"00-00-5E-00-53-23\",\"engType\":\"Virus Scan Engine (OS 2003, x64)\",\"engVer\":\"12.500.1004\",\"eventId\":\"100117\",\"eventName\":\"INTEGRITY_MONITORING_EVENT\",\"eventSubName\":\"Attack Discovery\",\"eventTime\":1602724592000,\"eventTimeDT\":\"2021-06-10T01:38:38+00:00\",\"fileHash\":\"3395856ce81f2b7382dee72602f798b642f14140\",\"fileName\":[\"Unconfirmed 145081.crdownload\"],\"fileOperation\":\"Deleted\",\"filePath\":\"/etc/systemd/system\",\"filePathName\":\"/etc/systemd/system/snap-xxxx-1246.xxxx\",\"fileSize\":\"0\",\"firstAct\":\"Clean\",\"firstActResult\":\"Unable to clean file\",\"fullPath\":\"C:\\\\\\\\Users\\\\\\\\user1\\\\\\\\Downloads\\\\\\\\Unconfirmed 145081.crdownload\",\"hostName\":\"samplehost\",\"httpReferer\":\"http://www.example.com/\",\"interestedHost\":\"abc-docker\",\"interestedIp\":[\"81.2.69.192\"],\"interestedMacAddress\":\"00-00-5E-00-53-23\",\"mDevice\":[\"81.2.69.192\"],\"mDeviceGUID\":\"C5B09EDD-C725-907F-29D9-B8C30D18C48F\",\"malName\":\"Eicar_test_1\",\"malType\":\"Virus/Malware\",\"mitreMapping\":[\"T1090 (TA0005)\"],\"mitreVersion\":\"v6\",\"mpname\":\"Cloud One - Workload Security\",\"mpver\":\"Deep Security/20.0.222\",\"objectCmd\":[\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft\\\\\\\\Edge\\\\\\\\Application\\\\\\\\msedge.exe --profile-directory=Default\"],\"objectFileHashMd5\":\"761AEFF7E6B110970285B9C20C9E1DCA\",\"objectFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"objectFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"objectFileName\":\"Unconfirmed 142899.crdownload:SmartScreen\",\"objectFilePath\":\"C:\\\\\\\\Users\\\\\\\\user1\\\\\\\\Downloads\\\\\\\\Unconfirmed 142899.crdownload:SmartScreen\",\"objectName\":\"CloudEndpointService.exe\",\"objectPid\":7660,\"objectSigner\":[\"OS\"],\"parentCmd\":\"C:\\\\\\\\os\\\\\\\\system32\\\\\\\\svchost.exe -k DcomLaunch -p\",\"parentFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"parentFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"parentFilePath\":\"C:\\\\\\\\os\\\\\\\\System32\\\\\\\\svchost.exe\",\"peerHost\":\"samplehost\",\"peerIp\":[\"81.2.69.192\"],\"pname\":\"Apex One\",\"processCmd\":\"-ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca\",\"processFileHashMd5\":\"761AEFF7E6B110970285B9C20C9E1DCA\",\"processFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"processFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"processFilePath\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\os\\\\\\\\Application\\\\\\\\msedge.exe\",\"processName\":\"string\",\"processPid\":0,\"processSigner\":\"OS Publisher\",\"productCode\":\"sao\",\"pver\":\"20.0.0.877\",\"request\":\"https://example.com\",\"requestClientApplication\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\",\"rt\":\"2020-10-15T01:16:32.000Z\",\"rt_utc\":\"2020-10-15T01:16:32.000Z\",\"searchDL\":\"DDL\",\"spt\":58871,\"src\":\"81.2.69.192\",\"srcGroup\":\"Default\",\"tacticId\":[\"TA0005\"],\"tags\":[\"XSAE.F2140\",\"XSAE.F3066\"],\"threatName\":\"Malicious_identified_CnC_querying_on_UDP_detected\",\"uuid\":\"1234-1234-1234\"}", "severity": 50, @@ -79,7 +79,9 @@ }, "observer": { "hostname": "samplehost", - "mac": "00-00-5E-00-53-23" + "mac": [ + "00-00-5E-00-53-23" + ] }, "process": { "command_line": "-ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca", diff --git a/packages/trend_micro_vision_one/docs/README.md b/packages/trend_micro_vision_one/docs/README.md index 4a2b0d41138..4342b80e90b 100644 --- a/packages/trend_micro_vision_one/docs/README.md +++ b/packages/trend_micro_vision_one/docs/README.md @@ -49,11 +49,11 @@ An example event for `alert` looks as following: { "@timestamp": "2030-04-30T00:01:16.000Z", "agent": { - "ephemeral_id": "866cfa51-4f51-436a-8e64-6075e4fc5940", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "e8bb2f2d-dd53-4857-b365-dd14b64f6459", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.alert", @@ -61,22 +61,22 @@ An example event for `alert` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", "category": [ "email" ], - "created": "2022-12-05T12:05:45.098Z", + "created": "2023-06-30T18:10:12.755Z", "dataset": "trend_micro_vision_one.alert", "id": "WB-9002-20200427-0002", - "ingested": "2022-12-05T12:05:48Z", + "ingested": "2023-06-30T18:10:13Z", "kind": "alert", "original": "{\"alertProvider\":\"SAE\",\"createdDateTime\":\"2020-04-30T00:01:15Z\",\"description\":\"A backdoor was possibly implanted after a user received a possible spear phishing email message.\",\"id\":\"WB-9002-20200427-0002\",\"impactScope\":{\"accountCount\":0,\"desktopCount\":0,\"emailAddressCount\":0,\"entities\":[{\"entityId\":\"5257b401-2fd7-469c-94fa-39a4f11eb925\",\"entityType\":\"host\",\"entityValue\":\"user@email.com\",\"provenance\":[\"Alert\"],\"relatedEntities\":[\"CODERED\\\\\\\\user\"],\"relatedIndicatorIds\":[1]}],\"serverCount\":0},\"indicators\":[{\"field\":\"request url\",\"filterIds\":[\"f862df72-7f5e-4b2b-9f7f-9148e875f908\"],\"id\":1,\"provenance\":[\"Alert\"],\"relatedEntities\":[\"user@example.com\"],\"type\":\"url\",\"value\":\"http://www.example.com/ab001.zip\"}],\"investigationStatus\":\"New\",\"matchedRules\":[{\"id\":\"5f52d1f1-53e7-411a-b74f-745ee81fa30b\",\"matchedFilters\":[{\"id\":\"ccf86fc1-688f-4131-a46f-1d7a6ee2f88e\",\"matchedDateTime\":\"2019-08-02T04:00:01Z\",\"matchedEvents\":[{\"matchedDateTime\":\"2019-08-02T04:00:01Z\",\"type\":\"TELEMETRY_REGISTRY\",\"uuid\":\"fa9ff47c-e1b8-459e-a3d0-a5b104b854a5\"}],\"mitreTechniqueIds\":[\"T1192\"],\"name\":\"(T1192) Spearphishing Link\"}],\"name\":\"Possible SpearPhishing Email\"}],\"model\":\"Possible APT Attack\",\"schemaVersion\":\"1.0\",\"score\":63,\"severity\":\"critical\",\"updatedDateTime\":\"2030-04-30T00:01:16Z\",\"workbenchLink\":\"https://THE_WORKBENCH_URL\"}", "severity": 63, @@ -204,10 +204,10 @@ An example event for `alert` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | | event.id | Unique ID to describe the event. | keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | @@ -306,11 +306,11 @@ An example event for `audit` looks as following: { "@timestamp": "2022-02-24T07:29:48.000Z", "agent": { - "ephemeral_id": "61fc6813-92eb-4a3e-a3fb-a744a758fe1b", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "55517b36-4796-4ee6-b24f-86dfb26ed90c", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.audit", @@ -318,21 +318,21 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "agent_id_status": "verified", "category": [ "authentication" ], - "created": "2022-12-05T12:07:05.750Z", + "created": "2023-06-30T18:10:57.950Z", "dataset": "trend_micro_vision_one.audit", - "ingested": "2022-12-05T12:07:09Z", + "ingested": "2023-06-30T18:11:00Z", "kind": "event", "original": "{\"accessType\":\"Console\",\"activity\":\"string\",\"category\":\"Logon and Logoff\",\"details\":{\"property1\":\"string\",\"property2\":\"string\"},\"loggedDateTime\":\"2022-02-24T07:29:48Z\",\"loggedRole\":\"Master Administrator\",\"loggedUser\":\"Root Account\",\"result\":\"Unsuccessful\"}", "outcome": "failure", @@ -351,7 +351,9 @@ An example event for `audit` looks as following: "source": { "user": { "name": "Root Account", - "roles": "Master Administrator" + "roles": [ + "Master Administrator" + ] } }, "tags": [ @@ -400,9 +402,9 @@ An example event for `audit` looks as following: | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -451,11 +453,11 @@ An example event for `detection` looks as following: { "@timestamp": "2020-10-15T01:16:32.000Z", "agent": { - "ephemeral_id": "73668026-8712-43d7-a6b9-c2e596ddb5cb", - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "ephemeral_id": "02b4e40b-648f-46e8-b99c-b2c1337d678e", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.4.0" + "version": "8.8.1" }, "data_stream": { "dataset": "trend_micro_vision_one.detection", @@ -470,12 +472,12 @@ An example event for `detection` looks as following: "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "6d1daf8c-cf74-431d-829c-3dedd9bd2ced", + "id": "bb043b0c-36d1-4054-81ed-2d3f4546a433", "snapshot": false, - "version": "8.4.0" + "version": "8.8.1" }, "event": { "action": "clean", @@ -483,10 +485,10 @@ An example event for `detection` looks as following: "category": [ "intrusion_detection" ], - "created": "2022-12-05T12:08:22.747Z", + "created": "2023-06-30T18:11:44.982Z", "dataset": "trend_micro_vision_one.detection", "id": "100117", - "ingested": "2022-12-05T12:08:26Z", + "ingested": "2023-06-30T18:11:45Z", "kind": "event", "original": "{\"act\":\"Clean\",\"actResult\":\"Quarantined successfully\",\"app\":\"HTTP\",\"appGroup\":\"HTTP\",\"aptRelated\":\"0\",\"behaviorCat\":\"Grey-Detection\",\"blocking\":\"Web reputation\",\"cat\":50,\"cccaDetection\":\"Yes\",\"cccaDetectionSource\":\"GLOBAL_INTELLIGENCE\",\"cccaRiskLevel\":3,\"clientFlag\":\"dst\",\"cnt\":\"1\",\"component\":[\"PATTERN_VSAPI 17.101.92 2021-09-30 04:23:27-07:00\"],\"compressedFileSize\":\"0\",\"detectionType\":\"File\",\"deviceDirection\":\"outbound\",\"deviceGUID\":\"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\",\"deviceMacAddress\":\"00-00-5E-00-53-23\",\"deviceProcessName\":\"/snap/core/10126/usr/lib/snapd/snapd\",\"dhost\":\"samplehost\",\"domainName\":\"Workgroup\",\"dpt\":53,\"dst\":[\"81.2.69.142\"],\"dstGroup\":\"Default\",\"end\":\"2021-09-30T09:40:04-08:00\",\"endpointGUID\":\"1234-1234-1234\",\"endpointHostName\":\"abc-docker\",\"endpointIp\":[\"81.2.69.142\"],\"endpointMacAddress\":\"00-00-5E-00-53-23\",\"engType\":\"Virus Scan Engine (OS 2003, x64)\",\"engVer\":\"12.500.1004\",\"eventId\":\"100117\",\"eventName\":\"INTEGRITY_MONITORING_EVENT\",\"eventSubName\":\"Attack Discovery\",\"eventTime\":1602724592000,\"eventTimeDT\":\"2021-06-10T01:38:38+00:00\",\"fileHash\":\"3395856ce81f2b7382dee72602f798b642f14140\",\"fileName\":[\"Unconfirmed 145081.crdownload\"],\"fileOperation\":\"Deleted\",\"filePath\":\"/etc/systemd/system\",\"filePathName\":\"/etc/systemd/system/snap-xxxx-1246.xxxx\",\"fileSize\":\"0\",\"firstAct\":\"Clean\",\"firstActResult\":\"Unable to clean file\",\"fullPath\":\"C:\\\\\\\\Users\\\\\\\\user1\\\\\\\\Downloads\\\\\\\\Unconfirmed 145081.crdownload\",\"hostName\":\"samplehost\",\"httpReferer\":\"http://www.example.com/\",\"interestedHost\":\"abc-docker\",\"interestedIp\":[\"81.2.69.192\"],\"interestedMacAddress\":\"00-00-5E-00-53-23\",\"mDevice\":[\"81.2.69.192\"],\"mDeviceGUID\":\"C5B09EDD-C725-907F-29D9-B8C30D18C48F\",\"malName\":\"Eicar_test_1\",\"malType\":\"Virus/Malware\",\"mitreMapping\":[\"T1090 (TA0005)\"],\"mitreVersion\":\"v6\",\"mpname\":\"Cloud One - Workload Security\",\"mpver\":\"Deep Security/20.0.222\",\"objectCmd\":[\"C:\\\\\\\\Program Files (x86)\\\\\\\\Microsoft\\\\\\\\Edge\\\\\\\\Application\\\\\\\\msedge.exe --profile-directory=Default\"],\"objectFileHashMd5\":\"761AEFF7E6B110970285B9C20C9E1DCA\",\"objectFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"objectFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"objectFileName\":\"Unconfirmed 142899.crdownload:SmartScreen\",\"objectFilePath\":\"C:\\\\\\\\Users\\\\\\\\user1\\\\\\\\Downloads\\\\\\\\Unconfirmed 142899.crdownload:SmartScreen\",\"objectName\":\"CloudEndpointService.exe\",\"objectPid\":7660,\"objectSigner\":[\"OS\"],\"parentCmd\":\"C:\\\\\\\\os\\\\\\\\system32\\\\\\\\svchost.exe -k DcomLaunch -p\",\"parentFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"parentFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"parentFilePath\":\"C:\\\\\\\\os\\\\\\\\System32\\\\\\\\svchost.exe\",\"peerHost\":\"samplehost\",\"peerIp\":[\"81.2.69.192\"],\"pname\":\"Apex One\",\"processCmd\":\"-ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca\",\"processFileHashMd5\":\"761AEFF7E6B110970285B9C20C9E1DCA\",\"processFileHashSha1\":\"00496B4D53CEFE031B9702B3385C9F4430999932\",\"processFileHashSha256\":\"7778ED68F4646BAA38C4F36B16A1AE393ACECD694948102B5CF0773AB08237D7\",\"processFilePath\":\"C:\\\\\\\\Program Files (x86)\\\\\\\\os\\\\\\\\Application\\\\\\\\msedge.exe\",\"processName\":\"string\",\"processPid\":0,\"processSigner\":\"OS Publisher\",\"productCode\":\"sao\",\"pver\":\"20.0.0.877\",\"request\":\"https://example.com\",\"requestClientApplication\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 12_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\",\"rt\":\"2020-10-15T01:16:32.000Z\",\"rt_utc\":\"2020-10-15T01:16:32.000Z\",\"searchDL\":\"DDL\",\"spt\":58871,\"src\":\"81.2.69.192\",\"srcGroup\":\"Default\",\"tacticId\":[\"TA0005\"],\"tags\":[\"XSAE.F2140\",\"XSAE.F3066\"],\"threatName\":\"Malicious_identified_CnC_querying_on_UDP_detected\",\"uuid\":\"1234-1234-1234\"}", "severity": 50, @@ -529,7 +531,9 @@ An example event for `detection` looks as following: }, "observer": { "hostname": "samplehost", - "mac": "00-00-5E-00-53-23" + "mac": [ + "00-00-5E-00-53-23" + ] }, "process": { "command_line": "-ServerName:App.AppX9yct9q388jvt4h7y0gn06smzkxcsnt8m.mca", @@ -782,9 +786,9 @@ An example event for `detection` looks as following: | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset. | constant_keyword | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module. | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | diff --git a/packages/trend_micro_vision_one/kibana/tags.yml b/packages/trend_micro_vision_one/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/trend_micro_vision_one/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/trend_micro_vision_one/manifest.yml b/packages/trend_micro_vision_one/manifest.yml index 731de544bf6..8cae7b7168c 100644 --- a/packages/trend_micro_vision_one/manifest.yml +++ b/packages/trend_micro_vision_one/manifest.yml @@ -1,9 +1,7 @@ -format_version: 1.0.0 +format_version: 2.11.0 name: trend_micro_vision_one title: Trend Micro Vision One -version: "1.4.0" -release: ga -license: basic +version: "1.8.0" description: Collect logs from Trend Micro Vision One with Elastic Agent. type: integration categories: diff --git a/packages/trendmicro/_dev/build/build.yml b/packages/trendmicro/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/trendmicro/_dev/build/build.yml +++ b/packages/trendmicro/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/trendmicro/changelog.yml b/packages/trendmicro/changelog.yml index d838f19d6f8..712ed1cef5c 100644 --- a/packages/trendmicro/changelog.yml +++ b/packages/trendmicro/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.0.0" changes: - description: Release Trend Micro Deep Security as GA. diff --git a/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json b/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json index 35b40af8091..bc5bd20ae85 100644 --- a/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json +++ b/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json @@ -13,7 +13,7 @@ "product": "Deep Security Manager" }, "extensions": { - "target": "1011144 - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)", + "target": "1011144 - Microsoft Windows - AutoRun registries modified (ATT\u0026CK T1547.001)", "TrendMicroDsTenant": "Primary", "TrendMicroDsTenantId": "0", "message": "Description Omitted", @@ -24,7 +24,7 @@ "event": { "code": "482", "severity": 3, - "original": "<190>2021-10-06T01:29:43-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|482|Integrity Monitoring Rule Updated|3|src=192.168.1.20 suser=System target=1011144 - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001) msg=Description Omitted TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" + "original": "\u003c190\u003e2021-10-06T01:29:43-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|482|Integrity Monitoring Rule Updated|3|src=192.168.1.20 suser=System target=1011144 - Microsoft Windows - AutoRun registries modified (ATT\u0026CK T1547.001) msg=Description Omitted TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" }, "message": "Description Omitted", "observer": { @@ -62,7 +62,7 @@ "event": { "code": "190", "severity": 3, - "original": "<190>2021-10-06T01:34:40-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|190|Alert Started|3|src=192.168.1.20 suser=System msg=Alert: Memory Critical Threshold Exceeded\\nSubject: 192.168.1.20\\nSeverity: Critical TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" + "original": "\u003c190\u003e2021-10-06T01:34:40-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|190|Alert Started|3|src=192.168.1.20 suser=System msg=Alert: Memory Critical Threshold Exceeded\\nSubject: 192.168.1.20\\nSeverity: Critical TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" }, "message": "Alert: Memory Critical Threshold Exceeded\\nSubject: 192.168.1.20\\nSeverity: Critical", "observer": { @@ -101,7 +101,7 @@ "event": { "severity": 8, "code": "740", - "original": "<190>2021-10-09T01:54:56-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|740|Agent/Appliance Error|8|src=192.168.1.20 suser=System target=SMC-NewAPP (192.168.1.61) msg=The Agent/Appliance reported one or more warnings or errors. Details are found in the Agent/Appliance events listed below. TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" + "original": "\u003c190\u003e2021-10-09T01:54:56-07:00 192.168.1.20 CEF:0|Trend Micro|Deep Security Manager|12.0.327|740|Agent/Appliance Error|8|src=192.168.1.20 suser=System target=SMC-NewAPP (192.168.1.61) msg=The Agent/Appliance reported one or more warnings or errors. Details are found in the Agent/Appliance events listed below. TrendMicroDsTenant=Primary TrendMicroDsTenantId=0" }, "message": "The Agent/Appliance reported one or more warnings or errors. Details are found in the Agent/Appliance events listed below.", "observer": { diff --git a/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json-expected.json b/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json-expected.json index f0f4dd4e765..1b3f0a16b31 100644 --- a/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json-expected.json +++ b/packages/trendmicro/data_stream/deep_security/_dev/test/pipeline/test-trendmicro.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-10-06T08:29:43.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -54,7 +54,7 @@ { "@timestamp": "2021-10-06T08:34:40.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -104,7 +104,7 @@ { "@timestamp": "2021-10-09T08:54:56.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/trendmicro/data_stream/deep_security/elasticsearch/ingest_pipeline/default.yml b/packages/trendmicro/data_stream/deep_security/elasticsearch/ingest_pipeline/default.yml index 8dcafce7554..a2e3f205a88 100644 --- a/packages/trendmicro/data_stream/deep_security/elasticsearch/ingest_pipeline/default.yml +++ b/packages/trendmicro/data_stream/deep_security/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ description: Pipeline for trendmicro deep security logs. processors: - set: field: ecs.version - value: "8.8.0" + value: "8.9.0" - set: field: event.category value: [network] diff --git a/packages/trendmicro/data_stream/deep_security/sample_event.json b/packages/trendmicro/data_stream/deep_security/sample_event.json index 68954e6b965..80dafd844da 100644 --- a/packages/trendmicro/data_stream/deep_security/sample_event.json +++ b/packages/trendmicro/data_stream/deep_security/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "b66dfb26-fbfb-425e-b205-5c4651dbee3a", diff --git a/packages/trendmicro/docs/README.md b/packages/trendmicro/docs/README.md index febf7cffc7d..8e96d9548af 100644 --- a/packages/trendmicro/docs/README.md +++ b/packages/trendmicro/docs/README.md @@ -64,10 +64,10 @@ Deep Security logs collect the trendmicro deep security logs. | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | diff --git a/packages/trendmicro/kibana/dashboard/trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c.json b/packages/trendmicro/kibana/dashboard/trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c.json index 9f6100b883e..618f97c6286 100644 --- a/packages/trendmicro/kibana/dashboard/trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c.json +++ b/packages/trendmicro/kibana/dashboard/trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c.json @@ -1,1395 +1,1395 @@ { - "id": "trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2023-02-02T13:46:48.337Z", - "created_at": "2023-02-02T13:46:48.337Z", - "version": "WzE5MTcsMV0=", - "attributes": { - "controlGroupInput": { - "chainingSystem": "HIERARCHICAL", - "controlStyle": "oneLine", - "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", - "panelsJSON": "{\"dc90c1e0-1105-4006-87aa-2d84fdf2224d\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"event.type\",\"title\":\"event.type\",\"id\":\"dc90c1e0-1105-4006-87aa-2d84fdf2224d\",\"enhancements\":{}}},\"c2302e6a-a8ab-4b98-b004-96a12088df42\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.category\",\"title\":\"trendmicro.event.category\",\"id\":\"c2302e6a-a8ab-4b98-b004-96a12088df42\",\"enhancements\":{}}},\"5cb6c3b4-4c04-494a-9757-3da0089120f0\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"rangeSliderControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.signature_id\",\"title\":\"trendmicro.event.signature_id\",\"id\":\"5cb6c3b4-4c04-494a-9757-3da0089120f0\",\"enhancements\":{}}},\"8f323dd7-18da-44e4-b535-3f7cb3584bf2\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.name\",\"title\":\"trendmicro.event.name\",\"id\":\"8f323dd7-18da-44e4-b535-3f7cb3584bf2\",\"enhancements\":{}}}}" - }, - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "key": "data_stream.dataset", - "negate": false, - "params": { - "query": "trendmicro.deep_security" - }, - "type": "phrase" - }, - "query": { - "match_phrase": { - "data_stream.dataset": "trendmicro.deep_security" - } - } - } - ], - "query": { - "language": "kuery", - "query": "" - } - } - }, - "optionsJSON": { - "hidePanelTitles": false, - "syncColors": false, - "syncCursor": true, - "syncTooltips": false, - "useMargins": true - }, - "panelsJSON": [ - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Trend Micro Event Category", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" - }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "id": "trendmicro-8efdcf10-a2fc-11ed-bd5a-0d4c2fb00c2c", + "type": "dashboard", + "namespaces": [ + "default" + ], + "updated_at": "2023-02-02T13:46:48.337Z", + "created_at": "2023-02-02T13:46:48.337Z", + "version": "WzE5MTcsMV0=", + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": "{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}", + "panelsJSON": "{\"dc90c1e0-1105-4006-87aa-2d84fdf2224d\":{\"order\":3,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"event.type\",\"title\":\"event.type\",\"id\":\"dc90c1e0-1105-4006-87aa-2d84fdf2224d\",\"enhancements\":{}}},\"c2302e6a-a8ab-4b98-b004-96a12088df42\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.category\",\"title\":\"trendmicro.event.category\",\"id\":\"c2302e6a-a8ab-4b98-b004-96a12088df42\",\"enhancements\":{}}},\"5cb6c3b4-4c04-494a-9757-3da0089120f0\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"rangeSliderControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.signature_id\",\"title\":\"trendmicro.event.signature_id\",\"id\":\"5cb6c3b4-4c04-494a-9757-3da0089120f0\",\"enhancements\":{}}},\"8f323dd7-18da-44e4-b535-3f7cb3584bf2\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"trendmicro.event.name\",\"title\":\"trendmicro.event.name\",\"id\":\"8f323dd7-18da-44e4-b535-3f7cb3584bf2\",\"enhancements\":{}}}}" + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "data_stream.dataset", + "negate": false, + "params": { + "query": "trendmicro.deep_security" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.category" + "type": "phrase" }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" + "query": { + "match_phrase": { + "data_stream.dataset": "trendmicro.deep_security" + } } - }, - "incompleteColumns": {}, - "sampling": 1 } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" - } ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + "query": { + "language": "kuery", + "query": "" + } + } }, - "gridData": { - "h": 15, - "i": "afb76ed5-df93-4649-a1d8-ee7586c483dd", - "w": 24, - "x": 0, - "y": 0 + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true }, - "panelIndex": "afb76ed5-df93-4649-a1d8-ee7586c483dd", - "title": "Deep Security Logs Count by Trend Micro Top 10 Event Category", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "10d0f1f2-7bbc-413f-acd0-a00bac68f06f", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "10d0f1f2-7bbc-413f-acd0-a00bac68f06f": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Trend Micro Event Category", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Trend Micro Event Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.category" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.category" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "10d0f1f2-7bbc-413f-acd0-a00bac68f06f" - ] - } - ], - "shape": "donut" - } + "gridData": { + "h": 15, + "i": "afb76ed5-df93-4649-a1d8-ee7586c483dd", + "w": 24, + "x": 0, + "y": 0 + }, + "panelIndex": "afb76ed5-df93-4649-a1d8-ee7586c483dd", + "title": "Deep Security Logs Count by Trend Micro Top 10 Event Category", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "813d3531-d392-4310-a30e-255453a47462", - "w": 24, - "x": 24, - "y": 0 - }, - "panelIndex": "813d3531-d392-4310-a30e-255453a47462", - "title": "Deep Security Logs % by Trend Micro Top 10 Event Category", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Trend Micro Signature ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "10d0f1f2-7bbc-413f-acd0-a00bac68f06f", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "10d0f1f2-7bbc-413f-acd0-a00bac68f06f": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Trend Micro Event Category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.category" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.signature_id" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "10d0f1f2-7bbc-413f-acd0-a00bac68f06f" + ] + } + ], + "shape": "donut" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "813d3531-d392-4310-a30e-255453a47462", + "w": 24, + "x": 24, + "y": 0 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } + "panelIndex": "813d3531-d392-4310-a30e-255453a47462", + "title": "Deep Security Logs % by Trend Micro Top 10 Event Category", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2", - "w": 24, - "x": 0, - "y": 15 - }, - "panelIndex": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2", - "title": "Deep Security Logs Count by Trend Micro Top 10 Signature ID", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { - "customLabel": true, - "dataType": "number", - "isBucketed": true, - "label": "Trend Micro Signature ID", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Trend Micro Signature ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.signature_id" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "secondaryFields": [], - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.signature_id" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "% of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" - ] - } - ], - "shape": "donut" - } + "gridData": { + "h": 15, + "i": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2", + "w": 24, + "x": 0, + "y": 15 + }, + "panelIndex": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2", + "title": "Deep Security Logs Count by Trend Micro Top 10 Signature ID", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "f2a5a219-78b4-4901-b93b-aefe163b43c6", - "w": 24, - "x": 24, - "y": 15 - }, - "panelIndex": "f2a5a219-78b4-4901-b93b-aefe163b43c6", - "title": "Deep Security Logs % by Trend Micro Top 10 Signature ID", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "9825dc26-0dc2-49b8-a2db-334e9fec92d4", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "9825dc26-0dc2-49b8-a2db-334e9fec92d4": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Event Type", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f": { + "customLabel": true, + "dataType": "number", + "isBucketed": true, + "label": "Trend Micro Signature ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.signature_id" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "% of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.type" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "469f7b8c-22ce-4e81-92a3-09a25d9dcc8f" + ] + } + ], + "shape": "donut" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "9825dc26-0dc2-49b8-a2db-334e9fec92d4" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "f2a5a219-78b4-4901-b93b-aefe163b43c6", + "w": 24, + "x": 24, + "y": 15 }, - "valueLabels": "hide" - } + "panelIndex": "f2a5a219-78b4-4901-b93b-aefe163b43c6", + "title": "Deep Security Logs % by Trend Micro Top 10 Signature ID", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "624b72c2-28f7-4245-89ad-c05025be1614", - "w": 24, - "x": 0, - "y": 45 - }, - "panelIndex": "624b72c2-28f7-4245-89ad-c05025be1614", - "title": "Deep Security Logs Count by Top 10 Event Type", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "2452aa0a-d551-493b-b053-13846361167e", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "2452aa0a-d551-493b-b053-13846361167e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Trend Micro Event Name", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "9825dc26-0dc2-49b8-a2db-334e9fec92d4", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "9825dc26-0dc2-49b8-a2db-334e9fec92d4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.type" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.name" + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "9825dc26-0dc2-49b8-a2db-334e9fec92d4" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "% of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "2452aa0a-d551-493b-b053-13846361167e" - ] - } - ], - "shape": "donut" - } + "gridData": { + "h": 15, + "i": "624b72c2-28f7-4245-89ad-c05025be1614", + "w": 24, + "x": 0, + "y": 45 + }, + "panelIndex": "624b72c2-28f7-4245-89ad-c05025be1614", + "title": "Deep Security Logs Count by Top 10 Event Type", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "d5723b06-eb47-4af3-8d87-c70575293831", - "w": 24, - "x": 24, - "y": 30 - }, - "panelIndex": "d5723b06-eb47-4af3-8d87-c70575293831", - "title": "Deep Security Logs % by Trend Micro Top 10 Event Name", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "2452aa0a-d551-493b-b053-13846361167e", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "2452aa0a-d551-493b-b053-13846361167e": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Trend Micro Event Name", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "2452aa0a-d551-493b-b053-13846361167e", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "2452aa0a-d551-493b-b053-13846361167e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Trend Micro Event Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.name" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "% of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.name" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "2452aa0a-d551-493b-b053-13846361167e" + ] + } + ], + "shape": "donut" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "columns": [ - { - "columnId": "2452aa0a-d551-493b-b053-13846361167e" - }, - { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - } - ], - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data" - } + "gridData": { + "h": 15, + "i": "d5723b06-eb47-4af3-8d87-c70575293831", + "w": 24, + "x": 24, + "y": 30 + }, + "panelIndex": "d5723b06-eb47-4af3-8d87-c70575293831", + "title": "Deep Security Logs % by Trend Micro Top 10 Event Name", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsDatatable" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "8609ed1c-8415-4912-8ff7-75ca89c9afbc", - "w": 24, - "x": 0, - "y": 30 - }, - "panelIndex": "8609ed1c-8415-4912-8ff7-75ca89c9afbc", - "title": "Deep Security Logs % by Trend Micro Top 10 Event Name (copy)", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "c548b323-aad7-4518-b361-b6d2300d784a": { - "columnOrder": [ - "9825dc26-0dc2-49b8-a2db-334e9fec92d4", - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "columns": { - "9825dc26-0dc2-49b8-a2db-334e9fec92d4": { - "customLabel": true, - "dataType": "string", - "isBucketed": true, - "label": "Event Type", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "2452aa0a-d551-493b-b053-13846361167e", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "2452aa0a-d551-493b-b053-13846361167e": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Trend Micro Event Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.name" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "event.type" + "visualization": { + "columns": [ + { + "columnId": "2452aa0a-d551-493b-b053-13846361167e" + }, + { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + } + ], + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data" + } }, - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "" - }, - "visualization": { - "layers": [ - { - "categoryDisplay": "default", - "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", - "layerType": "data", - "legendDisplay": "default", - "metrics": [ - "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" - ], - "nestedLegend": false, - "numberDisplay": "percent", - "primaryGroups": [ - "9825dc26-0dc2-49b8-a2db-334e9fec92d4" - ] - } - ], - "shape": "donut" - } + "gridData": { + "h": 15, + "i": "8609ed1c-8415-4912-8ff7-75ca89c9afbc", + "w": 24, + "x": 0, + "y": 30 + }, + "panelIndex": "8609ed1c-8415-4912-8ff7-75ca89c9afbc", + "title": "Deep Security Logs % by Trend Micro Top 10 Event Name (copy)", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsPie" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 15, - "i": "6849145b-2219-4b62-a2c1-f6293bf5b6b7", - "w": 24, - "x": 24, - "y": 45 - }, - "panelIndex": "6849145b-2219-4b62-a2c1-f6293bf5b6b7", - "title": "Deep Security Logs % by Top 10 Event Type", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "db75efdc-f99e-44e6-96a4-4a2d509b8e39": { - "columnOrder": [ - "340a534e-abeb-424e-b0e9-7f7fec891092", - "e98b9563-cb2a-412f-9360-b55bbb9001fb", - "0381cb47-eb28-4ae7-9dda-80de21332f97" - ], - "columns": { - "0381cb47-eb28-4ae7-9dda-80de21332f97": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" - }, - "340a534e-abeb-424e-b0e9-7f7fec891092": { - "dataType": "string", - "isBucketed": true, - "label": "Top 10 values of trendmicro.event.category", - "operationType": "terms", - "params": { - "exclude": [], - "excludeIsRegex": false, - "include": [], - "includeIsRegex": false, - "missingBucket": false, - "orderBy": { - "columnId": "0381cb47-eb28-4ae7-9dda-80de21332f97", - "type": "column" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "c548b323-aad7-4518-b361-b6d2300d784a": { + "columnOrder": [ + "9825dc26-0dc2-49b8-a2db-334e9fec92d4", + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "columns": { + "9825dc26-0dc2-49b8-a2db-334e9fec92d4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Event Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a9ca7ee9-fe03-483e-bea1-b8e2462609c6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "event.type" + }, + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } }, - "orderDirection": "desc", - "otherBucket": true, - "parentFormat": { - "id": "terms" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" }, - "size": 10 - }, - "scale": "ordinal", - "sourceField": "trendmicro.event.category" + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "c548b323-aad7-4518-b361-b6d2300d784a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "a9ca7ee9-fe03-483e-bea1-b8e2462609c6" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "9825dc26-0dc2-49b8-a2db-334e9fec92d4" + ] + } + ], + "shape": "donut" + } }, - "e98b9563-cb2a-412f-9360-b55bbb9001fb": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"trendmicro.deep_security\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 15, + "i": "6849145b-2219-4b62-a2c1-f6293bf5b6b7", + "w": 24, + "x": 24, + "y": 45 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "0381cb47-eb28-4ae7-9dda-80de21332f97" - ], - "layerId": "db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "splitAccessor": "340a534e-abeb-424e-b0e9-7f7fec891092", - "xAccessor": "e98b9563-cb2a-412f-9360-b55bbb9001fb" - } - ], - "legend": { - "isVisible": true, - "position": "right" - }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true - }, - "valueLabels": "hide" - } + "panelIndex": "6849145b-2219-4b62-a2c1-f6293bf5b6b7", + "title": "Deep Security Logs % by Top 10 Event Type", + "type": "lens", + "version": "8.6.0" }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false - }, - "gridData": { - "h": 9, - "i": "b0d62dc8-340c-4335-bc6a-162a9d8492b5", - "w": 48, - "x": 0, - "y": 60 - }, - "panelIndex": "b0d62dc8-340c-4335-bc6a-162a9d8492b5", - "title": "Timeline of logs count by Trend Micro Event Category", - "type": "lens", - "version": "8.6.0" - }, - { - "embeddableConfig": { - "attributes": { - "references": [ - { - "id": "logs-*", - "name": "indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "type": "index-pattern" - } - ], - "state": { - "adHocDataViews": {}, - "datasourceStates": { - "formBased": { - "layers": { - "db75efdc-f99e-44e6-96a4-4a2d509b8e39": { - "columnOrder": [ - "e98b9563-cb2a-412f-9360-b55bbb9001fb", - "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582" - ], - "columns": { - "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582": { - "customLabel": true, - "dataType": "number", - "isBucketed": false, - "label": "Count of logs", - "operationType": "count", - "params": { - "emptyAsNull": true - }, - "scale": "ratio", - "sourceField": "___records___" + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "db75efdc-f99e-44e6-96a4-4a2d509b8e39": { + "columnOrder": [ + "340a534e-abeb-424e-b0e9-7f7fec891092", + "e98b9563-cb2a-412f-9360-b55bbb9001fb", + "0381cb47-eb28-4ae7-9dda-80de21332f97" + ], + "columns": { + "0381cb47-eb28-4ae7-9dda-80de21332f97": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "340a534e-abeb-424e-b0e9-7f7fec891092": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of trendmicro.event.category", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0381cb47-eb28-4ae7-9dda-80de21332f97", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "trendmicro.event.category" + }, + "e98b9563-cb2a-412f-9360-b55bbb9001fb": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"trendmicro.deep_security\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "0381cb47-eb28-4ae7-9dda-80de21332f97" + ], + "layerId": "db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "340a534e-abeb-424e-b0e9-7f7fec891092", + "xAccessor": "e98b9563-cb2a-412f-9360-b55bbb9001fb" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } }, - "e98b9563-cb2a-412f-9360-b55bbb9001fb": { - "dataType": "date", - "isBucketed": true, - "label": "@timestamp", - "operationType": "date_histogram", - "params": { - "dropPartials": false, - "includeEmptyRows": true, - "interval": "auto" - }, - "scale": "interval", - "sourceField": "@timestamp" - } - }, - "incompleteColumns": {}, - "sampling": 1 - } - } - }, - "textBased": { - "layers": {} - } - }, - "filters": [], - "internalReferences": [], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"trendmicro.deep_security\" " - }, - "visualization": { - "axisTitlesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "fittingFunction": "None", - "gridlinesVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 9, + "i": "b0d62dc8-340c-4335-bc6a-162a9d8492b5", + "w": 48, + "x": 0, + "y": 60 }, - "labelsOrientation": { - "x": 0, - "yLeft": 0, - "yRight": 0 - }, - "layers": [ - { - "accessors": [ - "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582" - ], - "layerId": "db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "layerType": "data", - "position": "top", - "seriesType": "bar_stacked", - "showGridlines": false, - "xAccessor": "e98b9563-cb2a-412f-9360-b55bbb9001fb" - } - ], - "legend": { - "isVisible": true, - "position": "right" + "panelIndex": "b0d62dc8-340c-4335-bc6a-162a9d8492b5", + "title": "Timeline of logs count by Trend Micro Event Category", + "type": "lens", + "version": "8.6.0" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "db75efdc-f99e-44e6-96a4-4a2d509b8e39": { + "columnOrder": [ + "e98b9563-cb2a-412f-9360-b55bbb9001fb", + "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582" + ], + "columns": { + "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of logs", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "e98b9563-cb2a-412f-9360-b55bbb9001fb": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"trendmicro.deep_security\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "ca9e6197-9ec4-4b01-85e0-1cc0efbaf582" + ], + "layerId": "db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "xAccessor": "e98b9563-cb2a-412f-9360-b55bbb9001fb" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false }, - "preferredSeriesType": "bar_stacked", - "tickLabelsVisibilitySettings": { - "x": true, - "yLeft": true, - "yRight": true + "gridData": { + "h": 9, + "i": "4d910743-c246-4636-b806-db0e707f9814", + "w": 48, + "x": 0, + "y": 69 }, - "valueLabels": "hide" - } - }, - "title": "", - "type": "lens", - "visualizationType": "lnsXY" - }, - "enhancements": {}, - "hidePanelTitles": false + "panelIndex": "4d910743-c246-4636-b806-db0e707f9814", + "title": "Timeline of all logs count", + "type": "lens", + "version": "8.6.0" + } + ], + "timeRestore": false, + "title": "[Trend Micro] Deep Security Logs Overview", + "version": 1 + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "afb76ed5-df93-4649-a1d8-ee7586c483dd:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "813d3531-d392-4310-a30e-255453a47462:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "f2a5a219-78b4-4901-b93b-aefe163b43c6:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "624b72c2-28f7-4245-89ad-c05025be1614:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d5723b06-eb47-4af3-8d87-c70575293831:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8609ed1c-8415-4912-8ff7-75ca89c9afbc:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "6849145b-2219-4b62-a2c1-f6293bf5b6b7:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "b0d62dc8-340c-4335-bc6a-162a9d8492b5:indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "4d910743-c246-4636-b806-db0e707f9814:indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", + "type": "index-pattern" }, - "gridData": { - "h": 9, - "i": "4d910743-c246-4636-b806-db0e707f9814", - "w": 48, - "x": 0, - "y": 69 + { + "id": "logs-*", + "name": "controlGroup_dc90c1e0-1105-4006-87aa-2d84fdf2224d:optionsListDataView", + "type": "index-pattern" }, - "panelIndex": "4d910743-c246-4636-b806-db0e707f9814", - "title": "Timeline of all logs count", - "type": "lens", - "version": "8.6.0" - } + { + "id": "logs-*", + "name": "controlGroup_c2302e6a-a8ab-4b98-b004-96a12088df42:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_5cb6c3b4-4c04-494a-9757-3da0089120f0:rangeSliderDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_8f323dd7-18da-44e4-b535-3f7cb3584bf2:optionsListDataView", + "type": "index-pattern" + } ], - "timeRestore": false, - "title": "[Trend Micro] Deep Security Logs Overview", - "version": 1 - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "afb76ed5-df93-4649-a1d8-ee7586c483dd:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "813d3531-d392-4310-a30e-255453a47462:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "5f13ec5c-aee1-4dde-92df-8cbe0ecaa7e2:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "f2a5a219-78b4-4901-b93b-aefe163b43c6:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "624b72c2-28f7-4245-89ad-c05025be1614:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "d5723b06-eb47-4af3-8d87-c70575293831:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "8609ed1c-8415-4912-8ff7-75ca89c9afbc:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "6849145b-2219-4b62-a2c1-f6293bf5b6b7:indexpattern-datasource-layer-c548b323-aad7-4518-b361-b6d2300d784a", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "b0d62dc8-340c-4335-bc6a-162a9d8492b5:indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "4d910743-c246-4636-b806-db0e707f9814:indexpattern-datasource-layer-db75efdc-f99e-44e6-96a4-4a2d509b8e39", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_dc90c1e0-1105-4006-87aa-2d84fdf2224d:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_c2302e6a-a8ab-4b98-b004-96a12088df42:optionsListDataView", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "controlGroup_5cb6c3b4-4c04-494a-9757-3da0089120f0:rangeSliderDataView", - "type": "index-pattern" + "migrationVersion": { + "dashboard": "8.6.0" }, - { - "id": "logs-*", - "name": "controlGroup_8f323dd7-18da-44e4-b535-3f7cb3584bf2:optionsListDataView", - "type": "index-pattern" - } - ], - "migrationVersion": { - "dashboard": "8.6.0" - }, - "coreMigrationVersion": "8.6.0" + "coreMigrationVersion": "8.6.0" } \ No newline at end of file diff --git a/packages/trendmicro/kibana/tags.yml b/packages/trendmicro/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/trendmicro/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/trendmicro/manifest.yml b/packages/trendmicro/manifest.yml index e7ff4f0e765..56c3b7b828c 100644 --- a/packages/trendmicro/manifest.yml +++ b/packages/trendmicro/manifest.yml @@ -1,15 +1,17 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: trendmicro title: "Trendmicro" -version: "1.0.0" +version: "1.3.0" description: "collect Trendmicro Deep Security events with elastic agent." type: integration categories: - network - security conditions: - kibana.version: "^8.6.0" - elastic.subscription: "basic" + kibana: + version: "^8.6.0" + elastic: + subscription: "basic" screenshots: - src: /img/trend-micro-deep-security-dashboard-screenshot.png title: Trend Micro Deep Security Overview Screenshot @@ -36,3 +38,4 @@ policy_templates: description: "Collecting deep security logs from CEF instances (input: tcp)." owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/tychon/changelog.yml b/packages/tychon/changelog.yml index 88fabe2c0c2..f2c6caef04e 100644 --- a/packages/tychon/changelog.yml +++ b/packages/tychon/changelog.yml @@ -1,4 +1,4 @@ -- version: 0.0.51 +- version: 0.0.54 changes: - description: Fixed incorrect types in field.yml and cleaned up formatting type: enhancement diff --git a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json index e4ec995b69a..4309380a3fd 100644 --- a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json +++ b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json @@ -3,13 +3,15 @@ { "script.type": "powershell", "host.os.build": "22621", - "host.ip": "10.154.5.200", + "host.ip": [ + "10.154.5.200" + ], "host.hostname": "DESKTOP-AF7CIQM", "host.os.name": "Microsoft Windows 11 Pro", "host.hardware.manufacturer": "Dell Inc.", "@timestamp": "2023-08-16T05:22:36Z", "script.start": "2023-08-16T05:22:36Z", - "destination.mac": "00-09-0f-aa-00-02", + "destination.mac": "00-09-0F-AA-00-02", "host.hardware.owner": "james_sudbury@msn.com", "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", "destination.hostname": "Request timed out (700 ms)", @@ -25,7 +27,9 @@ "destination.name": "Request timed out (700 ms)", "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.mac": "60:E3:2B:4B:40:E2", + "host.mac": [ + "60:E3:2B:4B:40:E2" + ], "network.interface": "Ethernet 3", "host.oem.model": "XPS 17 9710", "host.uptime": "594263.4592614", diff --git a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json-expected.json b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json-expected.json index 3fc6eb5eec8..a82189f595f 100644 --- a/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json-expected.json +++ b/packages/tychon/data_stream/tychon_arp/_dev/test/pipeline/test-arp.json-expected.json @@ -1,47 +1,85 @@ { "expected": [ { - "script.type": "powershell", - "host.os.build": "22621", - "host.ip": "10.154.5.200", - "host.hostname": "DESKTOP-AF7CIQM", - "host.os.name": "Microsoft Windows 11 Pro", - "host.hardware.manufacturer": "Dell Inc.", - "@timestamp": "2023-08-16T05:22:36Z", - "script.start": "2023-08-16T05:22:36Z", - "destination.mac": "00-09-0f-aa-00-02", - "host.hardware.owner": "james_sudbury@msn.com", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "destination.hostname": "Request timed out (700 ms)", - "host.os.organization": "", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "HYLCKG3", - "host.ipv4": "10.154.5.200", - "host.os.version": "2009", - "network.direction": "external", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "network.type": "IPv4", - "destination.name": "Request timed out (700 ms)", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.mac": "60:E3:2B:4B:40:E2", - "network.interface": "Ethernet 3", - "host.oem.model": "XPS 17 9710", - "host.uptime": "594263.4592614", + "@timestamp": "2023-09-25T21:55:23.418865635Z", + "destination": { + "hostname": "Request timed out (700 ms)", + "ip": "10.70.4.16", + "mac": "00-09-0F-AA-00-02", + "name": "Request timed out (700 ms)" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "network" + ], + "ingested": "2023-09-25T21:55:23.418865635Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", + "domain": "", + "hardware": { + "bios": { + "name": "Dell Inc.", + "version": "1.20.1" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 141 Stepping 1" + }, + "manufacturer": "Dell Inc.", + "owner": "james_sudbury@msn.com", + "serial_number": "HYLCKG3" + }, + "hostname": "DESKTOP-AF7CIQM", + "id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", + "ip": [ + "10.154.5.200" + ], + "ipv4": [ + "10.154.5.200" + ], + "ipv6": "fe80::c2c9:f4e0:eb65:2c33", + "mac": [ + "60-E3-2B-4B-40-E2" + ], + "oem": { + "manufacturer": "Dell", + "model": "XPS 17 9710" + }, + "os": { + "build": "22621", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 11 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 594263, + "workgroup": "WORKGROUP" + }, "id": "DESKTOP-AF7CIQM#6#10.70.4.15#10.70.4.16", - "script.current_time": "2023-08-16T05:22:37Z", - "script.name": "Get-TychonArpInfo.ps1", - "network.state": "dynamic", - "script.version": "2.3.53.0", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "script.current_duration": "1809.94", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33", - "destination.ip": "10.70.4.16", - "host.hardware.bios.version": "1.20.1", - "host.domain": "", - "host.os.family": "Windows" + "network": { + "direction": "external", + "interface": "Ethernet 3", + "state": "dynamic", + "type": "IPv4" + }, + "script": { + "current_duration": 1809.94, + "current_time": "2023-08-16T05:22:37Z", + "name": "Get-TychonArpInfo.ps1", + "start": "2023-08-16T05:22:36Z", + "type": "powershell", + "version": "2.3.53.0" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml index b3256bbccb0..05580cd8939 100644 --- a/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_arp/elasticsearch/ingest_pipeline/default.yml @@ -22,9 +22,14 @@ processors: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.category - value: arp + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -38,6 +43,16 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.category + value: [network] + - set: + field: event.type + value: [info] - convert: field: script.current_duration type: float @@ -48,4 +63,4 @@ on_failure: value: pipeline_error - append: field: error.message - value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file + value: "{{ _ingest.on_failure_message }}" \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml b/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_arp/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_arp/fields/fields.yml b/packages/tychon/data_stream/tychon_arp/fields/fields.yml index 19998af0b2d..796b93593cd 100644 --- a/packages/tychon/data_stream/tychon_arp/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_arp/fields/fields.yml @@ -1,17 +1,17 @@ - name: destination type: group fields: - - name: hostname - type: keyword - description: The Translated Hostname of the IP in the ARP Table - - name: name - type: keyword + - name: hostname + type: keyword + description: The Translated Hostname of the IP in the ARP Table + - name: name + type: keyword - name: network type: group fields: - - name: interface - type: keyword - description: The interface the ARP Table has associated the destination. - - name: state - type: keyword - description: Current state \ No newline at end of file + - name: interface + type: keyword + description: The interface the ARP Table has associated the destination. + - name: state + type: keyword + description: Current state diff --git a/packages/tychon/data_stream/tychon_arp/manifest.yml b/packages/tychon/data_stream/tychon_arp/manifest.yml index 4c387a8bacc..6e2a2a3ce40 100644 --- a/packages/tychon/data_stream/tychon_arp/manifest.yml +++ b/packages/tychon/data_stream/tychon_arp/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json b/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json index d30a84f187b..6a6227d519b 100644 --- a/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json +++ b/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json @@ -1,53 +1,52 @@ { "events": [ { - "host.cpu.number_of_logical_processors": [ - "1", - "1" + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.cpu.number_of_logical_processors": "1", + "host.os.build": "19045", + "host.ip": [ + "10.1.9.51" ], - "host.os.build": "22000", - "host.ip": "10.1.9.112", - "host.uptime": "663163.9355573", - "host.hostname": "DESKTOP-TIUKL1R", + "host.uptime": "348628.5649737", + "host.hostname": "BOTANYBAYEP1", "host.hardware.manufacturer": "VMware, Inc.", - "@timestamp": "2023-08-16T22:23:24Z", - "script.start": "2023-08-16T22:23:24Z", - "host.os.name": "Microsoft Windows 11 Education N", + "script.start": "2023-09-22T17:04:17Z", + "host.os.name": "Microsoft Windows 10 Pro", "host.cpu.number_of_cores": "1", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.os.organization": "", - "host.hardware.owner": "dcuser", + "host.hardware.owner": "admin", "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", - "host.ipv4": "10.1.9.112", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.ipv4": "10.1.9.51", "host.cpu.manufacturer": "GenuineIntel", "host.hardware.bios.name": "Phoenix Technologies LTD", "host.type": "Workstation", - "host.cpu.virtualization_firmware_enabled": [ - "false", - "false" - ], + "host.cpu.virtualization_firmware_enabled": "true", "host.cpu.name": "Intel(R) Xeon(R) CPU E5-4640 0 @ 2.40GHz", + "host.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "script.type": "powershell", "host.cpu.speed": "2400", - "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "host.mac": "00:0C:29:EF:9A:EB", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": [ + "00:0C:29:93:6A:F3" + ], "host.oem.model": "", "host.cpu.family": "Unknown", - "id": "DESKTOP-TIUKL1R#CPU0#0FABFBFF000206D7", - "script.current_time": "2023-08-16T22:26:30Z", + "id": "BOTANYBAYEP1#CPU0#0FABFBFF000206D7", + "script.current_time": "2023-09-22T17:04:25Z", "script.name": "Get-TychonCpuInfo.ps1", - "script.version": "2.3.58.0", + "script.version": "2.3.141.0", "host.cpu.clockspeed": "2400", "host.oem.manufacturer": "", "host.os.description": "", "host.os.version": "2009", - "script.current_duration": "185267.77", - "host.ipv6": "fe80::40d1:5287:42b9:5645", + "script.current_duration": "8011.80", + "host.ipv6": "", "host.hardware.bios.version": "6.00", "host.domain": "", - "host.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json-expected.json b/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json-expected.json index 3f4ba317142..0c7ea16482a 100644 --- a/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json-expected.json +++ b/packages/tychon/data_stream/tychon_cpu/_dev/test/pipeline/test-cpu.json-expected.json @@ -1,54 +1,90 @@ { "expected": [ { - "host.cpu.number_of_logical_processors": [ - "1", - "1" - ], - "host.os.build": "22000", - "host.ip": "10.1.9.112", - "host.uptime": "663163.9355573", - "host.hostname": "DESKTOP-TIUKL1R", - "host.hardware.manufacturer": "VMware, Inc.", - "@timestamp": "2023-08-16T22:23:24Z", - "script.start": "2023-08-16T22:23:24Z", - "host.os.name": "Microsoft Windows 11 Education N", - "host.cpu.number_of_cores": "1", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "host.os.organization": "", - "host.hardware.owner": "dcuser", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", - "host.ipv4": "10.1.9.112", - "host.cpu.manufacturer": "GenuineIntel", - "host.hardware.bios.name": "Phoenix Technologies LTD", - "host.type": "Workstation", - "host.cpu.virtualization_firmware_enabled": [ - "false", - "false" - ], - "host.cpu.name": "Intel(R) Xeon(R) CPU E5-4640 0 @ 2.40GHz", - "script.type": "powershell", - "host.cpu.speed": "2400", - "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "host.mac": "00:0C:29:EF:9A:EB", - "host.oem.model": "", - "host.cpu.family": "Unknown", - "id": "DESKTOP-TIUKL1R#CPU0#0FABFBFF000206D7", - "script.current_time": "2023-08-16T22:26:30Z", - "script.name": "Get-TychonCpuInfo.ps1", - "script.version": "2.3.58.0", - "host.cpu.clockspeed": "2400", - "host.oem.manufacturer": "", - "host.os.description": "", - "host.os.version": "2009", - "script.current_duration": "185267.77", - "host.ipv6": "fe80::40d1:5287:42b9:5645", - "host.hardware.bios.version": "6.00", - "host.domain": "", - "host.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:23.632476469Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "configuration" + ], + "ingested": "2023-09-25T21:55:23.632476469Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7", + "clockspeed": 2400, + "family": "Unknown", + "manufacturer": "GenuineIntel", + "name": "Intel(R) Xeon(R) CPU E5-4640 0 @ 2.40GHz", + "number_of_cores": "1", + "number_of_logical_processors": "1", + "speed": 2400, + "virtualization_firmware_enabled": "true" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 348628, + "workgroup": "WORKGROUP" + }, + "id": "BOTANYBAYEP1#CPU0#0FABFBFF000206D7", + "script": { + "current_duration": 8011.8, + "current_time": "2023-09-22T17:04:25Z", + "name": "Get-TychonCpuInfo.ps1", + "start": "2023-09-22T17:04:17Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_cpu/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_cpu/elasticsearch/ingest_pipeline/default.yml index 110bf6e21e0..41090539845 100644 --- a/packages/tychon/data_stream/tychon_cpu/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_cpu/elasticsearch/ingest_pipeline/default.yml @@ -16,6 +16,31 @@ processors: field: host.ipv4 separator: "," ignore_missing: true + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true + - split: + field: host.uptime + separator: "\\.+" + target_field: tempuptime + ignore_failure: true + - set: + field: host.uptime + value: "{{tempuptime.0}}" + ignore_failure: true + - remove: + field: tempuptime + ignore_failure: true + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true - set: field: event.kind value: state @@ -24,28 +49,31 @@ processors: value: tychon - set: field: event.category - value: cpu + value: [configuration] + - set: + field: event.type + value: [info] - gsub: field: host.cpu.speed pattern: "[^0-9]" replacement: "" + - convert: + field: host.cpu.speed + type: long + ignore_missing: true - gsub: field: host.cpu.clockspeed pattern: "[^0-9]" replacement: "" + - convert: + field: host.cpu.clockspeed + type: long + ignore_missing: true - split: field: host.uptime separator: "\\.+" target_field: tempuptime ignore_failure: true - - set: - field: host.uptime - value: "{{tempuptime.0}}" - ignore_failure: true - - remove: - field: tempuptime - ignore_failure: true - ignore_missing: true - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_cpu/fields/base-fields.yml b/packages/tychon/data_stream/tychon_cpu/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_cpu/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_cpu/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_cpu/fields/fields.yml b/packages/tychon/data_stream/tychon_cpu/fields/fields.yml index eb728cc9162..d2212239b15 100644 --- a/packages/tychon/data_stream/tychon_cpu/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_cpu/fields/fields.yml @@ -1,18 +1,33 @@ -- name: host.cpu.caption - type: text -- name: host.cpu.clockspeed - type: long -- name: host.cpu.family - type: keyword -- name: host.cpu.manufacturer - type: keyword -- name: host.cpu.name - type: keyword -- name: host.cpu.number_of_cores - type: integer -- name: host.cpu.number_of_logical_processors - type: integer -- name: host.cpu.speed - type: long -- name: host.cpu.virtualization_firmware_enabled - type: boolean +- name: host + type: group + fields: + - name: cpu + type: group + fields: + - name: caption + description: Host Cpu Caption. + type: text + - name: clockspeed + description: Host Cpu Clockspeed. + type: long + - name: family + description: Host Cpu Family. + type: keyword + - name: manufacturer + description: Host Cpu Manufacturer. + type: keyword + - name: name + description: Host Cpu Name. + type: keyword + - name: number_of_cores + description: Host Cpu Number Of Cores. + type: integer + - name: number_of_logical_processors + description: Host Cpu Number Of Logical Processors. + type: integer + - name: speed + description: Host Cpu Speed. + type: long + - name: virtualization_firmware_enabled + description: Host Cpu Virtualization Firmware Enabled. + type: boolean diff --git a/packages/tychon/data_stream/tychon_cpu/manifest.yml b/packages/tychon/data_stream/tychon_cpu/manifest.yml index b4175c56c09..82a7fb19357 100644 --- a/packages/tychon/data_stream/tychon_cpu/manifest.yml +++ b/packages/tychon/data_stream/tychon_cpu/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json b/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json index 926b271cd75..c72268428c3 100644 --- a/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json +++ b/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json @@ -1,51 +1,54 @@ { "events": [ { - "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "host.domain": "", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.cloud.hosted": false, + "host.domain": null, "host.hardware.bios.name": "Phoenix Technologies LTD", "host.hardware.bios.version": "6.00", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.hardware.manufacturer": "VMware, Inc.", - "host.hardware.owner": "dcuser", - "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", - "host.hostname": "DESKTOP-TIUKL1R", - "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "host.ip": "10.1.9.112", - "host.ipv4": "10.1.9.112", - "host.ipv6": "fe80::40d1:5287:42b9:5645", - "host.mac": "00:0C:29:EF:9A:EB", + "host.hardware.owner": "admin", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.hostname": "BOTANYBAYEP1", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.ip": "10.1.9.51", + "host.ipv4": "10.1.9.51", + "host.ipv6": "", + "host.mac": "00:0C:29:93:6A:F3", "host.oem.manufacturer": "", "host.oem.model": "", - "host.os.build": "22000", + "host.os.build": "19045", "host.os.description": "", "host.os.family": "Windows", - "host.os.name": "Microsoft Windows 11 Education N", + "host.os.name": "Microsoft Windows 10 Pro", "host.os.organization": "", - "host.os.version": "10.0.22000", + "host.os.version": "2009", "host.type": "Workstation", - "host.uptime": 145287, + "host.uptime": 312557.8520254, "host.workgroup": "WORKGROUP", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_CVE-2013-3900", - "script.current_duration": "315381.28", - "script.current_time": "2023-06-15T21:58:02Z", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP_CVE-2022-24501", + "script.current_duration": "910425.42", + "script.current_time": "2023-09-22T07:18:16Z", "script.name": "Invoke-CveScan.ps1", - "script.start": "2023-06-15T21:52:47Z", + "script.start": "2023-09-22T07:03:05Z", "script.type": "powershell", - "script.version": "0.1.0", + "script.version": "2.3.141.0", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "vulnerability.classification": "vulnerability", - "vulnerability.iava": "2013-A-0227", - "vulnerability.iava_severity": "CAT II", - "vulnerability.id": "CVE-2013-3900", - "vulnerability.reference": "https://www.scaprepo.com/view.jsp?id=CVE-2013-3900", - "vulnerability.result": "fail", - "vulnerability.scanner.vendor": "TYCHON", - "vulnerability.score.base": "7.60", - "vulnerability.score.version": "2.0", - "vulnerability.severity": "HIGH", - "vulnerability.title": "The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does ", - "vulnerability.version": 1, - "vulnerability.year": "2013" + "vulnerability.due_date": "", + "vulnerability.due_date_reason": "", + "vulnerability.iava": "", + "vulnerability.iava_severity": "", + "vulnerability.id": "CVE-2022-24501", + "vulnerability.reference": "http://www.scaprepo.com/view.jsp?id=CVE-2022-24501", + "vulnerability.result": "pass", + "vulnerability.scanner.vendor": "Tychon, LLC", + "vulnerability.score.base": "6.80", + "vulnerability.severity": "MEDIUM", + "vulnerability.title": "VP9 Video Extensions Remote Code Execution Vulnerability - CVE-2022-24501", + "vulnerability.version": "1", + "vulnerability.year": "2022" } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json-expected.json b/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json-expected.json index e9bc08095a8..aa333a929a1 100644 --- a/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json-expected.json +++ b/packages/tychon/data_stream/tychon_cve/_dev/test/pipeline/test-cve.json-expected.json @@ -1,7 +1,7 @@ { "expected": [ { - "@timestamp": "2023-07-28T18:14:38.394883461Z", + "@timestamp": "2023-09-25T21:55:23.823090043Z", "ecs": { "version": "8.8.0" }, @@ -9,14 +9,20 @@ "category": [ "vulnerability" ], - "ingested": "2023-07-28T18:14:38.394883461Z", + "ingested": "2023-09-25T21:55:23.823090043Z", "kind": "state", "module": "tychon", - "outcome": "failure" + "outcome": "success", + "type": [ + "info" + ] }, "host": { - "biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "domain": "", + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": false + }, + "domain": null, "hardware": { "bios": { "name": "Phoenix Technologies LTD", @@ -26,62 +32,68 @@ "caption": "Intel64 Family 6 Model 45 Stepping 7" }, "manufacturer": "VMware, Inc.", - "owner": "dcuser", - "serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb" + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" }, - "hostname": "DESKTOP-TIUKL1R", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "ip": "10.1.9.112", - "ipv4": "10.1.9.112", - "ipv6": "fe80::40d1:5287:42b9:5645", - "mac": "00-0C-29-EF-9A-EB", + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": "10.1.9.51", + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": "00-0C-29-93-6A-F3", "oem": { "manufacturer": "", "model": "" }, "os": { - "build": "22000", + "build": "19045", "description": "", "family": "Windows", - "name": "Microsoft Windows 11 Education N", + "name": "Microsoft Windows 10 Pro", "organization": "", - "version": "10.0.22000" + "version": "2009" }, "type": "Workstation", - "uptime": 145287, + "uptime": 312557, "workgroup": "WORKGROUP" }, - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_CVE-2013-3900", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP_CVE-2022-24501", "script": { - "current_duration": 315381.28, - "current_time": "2023-06-15T21:58:02Z", + "current_duration": 910425.44, + "current_time": "2023-09-22T07:18:16Z", "name": "Invoke-CveScan.ps1", - "start": "2023-06-15T21:52:47Z", + "start": "2023-09-22T07:03:05Z", "type": "powershell", - "version": "0.1.0" + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" }, "vulnerability": { "category": [ "oval" ], "classification": "cvss", + "due_date": "1970-01-01T00:00:01.000Z", + "due_date_reason": "", "enumeration": "CVE", - "iava": "2013-A-0227", - "iava_severity": "CAT II", - "id": "CVE-2013-3900", - "reference": "https://www.scaprepo.com/view.jsp?id=CVE-2013-3900", - "result": "fail", + "iava": "", + "iava_severity": "", + "id": "CVE-2022-24501", + "reference": "http://www.scaprepo.com/view.jsp?id=CVE-2022-24501", + "result": "pass", "scanner": { "vendor": "tychon" }, "score": { - "base": 7.6, - "version": "2.0" + "base": 6.8 }, - "severity": "HIGH", - "title": "The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does ", + "severity": "MEDIUM", + "title": "VP9 Video Extensions Remote Code Execution Vulnerability - CVE-2022-24501", "version": "1", - "year": 2013 + "year": 2022 } } ] diff --git a/packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml index 16286a38e4d..82680cae7cf 100644 --- a/packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_cve/elasticsearch/ingest_pipeline/default.yml @@ -13,6 +13,15 @@ processors: field: vulnerability.due_date value: "1970-01-01T00:00:01Z" if: ctx.vulnerability.due_date == '' + - date: + field: vulnerability.due_date + target_field: vulnerability.due_date + output_format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX + formats: + - strict_date_optional_time + - epoch_millis + - date + - "MM/dd/yyyy" - set: field: ecs.version value: 8.8.0 @@ -26,6 +35,14 @@ processors: field: host.ipv4 separator: "," ignore_missing: true + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -39,9 +56,16 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true - set: field: event.category - value: vulnerability + value: [vulnerability] + - set: + field: event.type + value: [info] - script: source: | if(ctx.vulnerability?.result == 'fail'){ @@ -51,10 +75,6 @@ processors: }else{ ctx.event.outcome = "unknown" } - - gsub: - field: host.mac - pattern: ":" - replacement: "-" - convert: field: script.current_duration type: float @@ -70,22 +90,13 @@ processors: value: tychon - set: field: vulnerability.category - value: oval + value: [oval] - set: field: vulnerability.classification value: cvss - set: field: vulnerability.enumeration value: CVE - - date: - field: vulnerability.due_date - target_field: vulnerability.due_date - output_format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX - formats: - - strict_date_optional_time - - epoch_millis - - date - - "MM/dd/yyyy" on_failure: - set: field: event.kind diff --git a/packages/tychon/data_stream/tychon_cve/fields/agent.yml b/packages/tychon/data_stream/tychon_cve/fields/agent.yml index 45dccd05b24..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_cve/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_cve/fields/agent.yml @@ -39,7 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword + type: version - name: host title: Host group: 2 @@ -92,7 +92,7 @@ type: keyword - name: version description: Host BIOS Version. - type: version + type: keyword - name: cpu type: group fields: diff --git a/packages/tychon/data_stream/tychon_cve/fields/base-fields.yml b/packages/tychon/data_stream/tychon_cve/fields/base-fields.yml index 44a26fd137a..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_cve/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_cve/fields/base-fields.yml @@ -1,21 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: keyword - description: Event module. -- name: '@timestamp' - description: Event timestamp. - type: date +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_cve/fields/ecs.yml b/packages/tychon/data_stream/tychon_cve/fields/ecs.yml index 003c9bb8e07..70c1f2ac0ed 100644 --- a/packages/tychon/data_stream/tychon_cve/fields/ecs.yml +++ b/packages/tychon/data_stream/tychon_cve/fields/ecs.yml @@ -1,3 +1,5 @@ +- external: ecs + name: '@timestamp' - external: ecs name: agent.ephemeral_id - external: ecs @@ -10,6 +12,12 @@ name: agent.version - external: ecs name: ecs.version +- external: ecs + name: data_stream.dataset +- external: ecs + name: data_stream.namespace +- external: ecs + name: data_stream.type - external: ecs name: event.agent_id_status - external: ecs @@ -32,12 +40,32 @@ name: error.message - external: ecs name: host.architecture +- external: ecs + name: host.domain +- external: ecs + name: host.id +- external: ecs + name: host.ip +- external: ecs + name: host.hostname +- external: ecs + name: host.mac - external: ecs name: host.name +- external: ecs + name: host.uptime +- external: ecs + name: host.type +- external: ecs + name: host.os.family - external: ecs name: host.os.kernel - external: ecs name: host.os.platform +- external: ecs + name: host.os.name +- external: ecs + name: host.os.version - external: ecs name: host.os.type - external: ecs diff --git a/packages/tychon/data_stream/tychon_cve/fields/fields.yml b/packages/tychon/data_stream/tychon_cve/fields/fields.yml index 925eab85d41..ce1ae96d93c 100644 --- a/packages/tychon/data_stream/tychon_cve/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_cve/fields/fields.yml @@ -1,31 +1,207 @@ +- name: elastic + type: group + fields: + - name: service + type: group + fields: + - name: agent + type: group + fields: + - name: status + description: Elastic Service Agent Status. + type: keyword + - name: version + description: Elastic Service Agent Version. + type: version + - name: endpoint + type: group + fields: + - name: behavior_protection + description: Elastic Service Endpoint Behavior Protection. + type: keyword + - name: malware + description: Elastic Service Endpoint Malware. + type: keyword + - name: memory_protection + description: Elastic Service Endpoint Memory Protection. + type: keyword + - name: status + description: Elastic Service Endpoint Status. + type: keyword + - name: version + description: Elastic Service Endpoint Version. + type: version +- name: trellix + type: group + fields: + - name: service + type: group + fields: + - name: accm + type: group + fields: + - name: status + description: Trellix Service Accm Status. + type: keyword + - name: version + description: Trellix Service Accm Version. + type: version + - name: dlp + type: group + fields: + - name: status + description: Trellix Service Dlp Status. + type: keyword + - name: version + description: Trellix Service Dlp Version. + type: version + - name: ens + type: group + fields: + - name: signature_version + description: Trellix Service Ens Signature Version. + type: keyword + - name: status + description: Trellix Service Ens Status. + type: keyword + - name: version + description: Trellix Service Ens Version. + type: version + - name: ma + type: group + fields: + - name: status + description: Trellix Service Ma Status. + type: keyword + - name: version + description: Trellix Service Ma Version. + type: version + - name: pa + type: group + fields: + - name: status + description: Trellix Service Pa Status. + type: keyword + - name: version + description: Trellix Service Pa Version. + type: version + - name: rsd + type: group + fields: + - name: status + description: Trellix Service Rsd Status. + type: keyword + - name: version + description: Trellix Service Rsd Version. + type: version - name: vulnerability type: group fields: - - name: definition - description: National Vulnerability Database Vulnerability Definition. - type: keyword - name: due_date description: Vulnerability Due Date. type: date - format: "strict_date_optional_time||epoch_millis||date||\"MM/dd/yyyy\"" - name: due_date_reason - description: Vulnerability Due Date Reason + description: Vulnerability Due Date Reason. type: keyword - name: iava - description: Information Assurance Vulneraiblity Alert Identifier. + description: Vulnerability Iava. type: keyword - name: iava_severity - description: Information Assurance Vulnerability Alert Severity. + description: Vulnerability Iava Severity. type: keyword - name: result - description: Pass/Fail Outcome of the Common Vulnerabilities and Exposures Scan. + description: Vulnerability Result. type: keyword - name: title - description: Common Vulnerabilities and Exposures Description and Title. + description: Vulnerability Title. type: keyword - name: version - description: Version Number of the Scan. + description: Vulnerability Version. type: keyword - name: year - description: Common Vulnerabilities and Exposures Year. + description: Vulnerability Year. type: integer +- name: windows_defender + type: group + fields: + - name: service + type: group + fields: + - name: antimalware + type: group + fields: + - name: engine_version + description: Windows Defender Service Antimalware Engine Version. + type: keyword + - name: product_version + description: Windows Defender Service Antimalware Product Version. + type: keyword + - name: signature_version + description: Windows Defender Service Antimalware Signature Version. + type: keyword + - name: status + description: Windows Defender Service Antimalware Status. + type: keyword + - name: antispyware + type: group + fields: + - name: signature_version + description: Windows Defender Service Antispyware Signature Version. + type: keyword + - name: status + description: Windows Defender Service Antispyware Status. + type: keyword + - name: full_scan + type: group + fields: + - name: signature_version + description: Windows Defender Service Antivirus Full Scan Signature Version. + type: keyword + - name: quick_scan + type: group + fields: + - name: signature_version + description: Windows Defender Service Antivirus Quick Scan Signature Version. + type: keyword + - name: antivirus + type: group + fields: + - name: status + description: Windows Defender Service Antivirus Status. + type: keyword + - name: behavior_monitor + type: group + fields: + - name: status + description: Windows Defender Service Behavior Monitor Status. + type: keyword + - name: ioav_protection + type: group + fields: + - name: status + description: Windows Defender Service Ioav Protection Status. + type: keyword + - name: nis + type: group + fields: + - name: engine_version + description: Windows Defender Service Nis Engine Version. + type: keyword + - name: signature_version + description: Windows Defender Service Nis Signature Version. + type: keyword + - name: status + description: Windows Defender Service Nis Status. + type: keyword + - name: on_access_protection + type: group + fields: + - name: status + description: Windows Defender Service On Access Protection Status. + type: keyword + - name: real_time_protection + type: group + fields: + - name: status + description: Windows Defender Service Real Time Protection Status. + type: keyword diff --git a/packages/tychon/data_stream/tychon_cve/manifest.yml b/packages/tychon/data_stream/tychon_cve/manifest.yml index 4c1d2258971..b1dc5ee94f8 100644 --- a/packages/tychon/data_stream/tychon_cve/manifest.yml +++ b/packages/tychon/data_stream/tychon_cve/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json b/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json index 248a73419c4..76b6054613a 100644 --- a/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json +++ b/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json @@ -1,53 +1,75 @@ { "events": [ { + "trellix.service.ens.signature_version": "", + "trellix.service.dlp.status": "Unknown", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.workgroup": "WORKGROUP", + "elastic.service.agent.status": "", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.type": "Workstation", + "windows_defender.service.behavior_monitor.status": "Disabled", + "trellix.service.dlp.version": "", + "trellix.service.ma.version": "", + "script.current_duration": "9805.07", + "trellix.service.accm.version": "", + "host.oem.manufacturer": "", + "host.uptime": "352927.1521054", + "host.os.name": "Microsoft Windows 10 Pro", + "windows_defender.service.on_access_protection.status": "Disabled", + "windows_defender.service.antimalware.engine_version": "1.1.23080.2005", + "host.hardware.bios.name": "Phoenix Technologies LTD", + "windows_defender.service.antispyware.signature_version": "1.397.1402.0", + "trellix.service.ma.status": "Unknown", + "host.os.version": "2009", + "trellix.service.ens.version": "", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "elastic.service.endpoint.malware": "detect", + "trellix.service.accm.status": "", + "host.cloud.hosted": "false", "windows_defender.service.antimalware.status": "Enabled", - "windows_defender.service.real_time_protection.status": "Enabled", - "windows_defender.service.antispyware.signature_version": "1.391.1546.0", + "host.hardware.owner": "admin", + "elastic.service.endpoint.memory_protection": "detect", + "script.version": "2.3.141.0", + "host.mac": "00:0C:29:93:6A:F3", + "windows_defender.service.antispyware.status": "Enabled", + "host.ipv6": "", + "windows_defender.service.antivirus.full_scan.signature_version": "", "script.type": "powershell", - "host.os.build": "22000", - "host.ip": "10.1.9.112", - "windows_defender.service.antivirus.quick_scan.signature_version": "1.391.1470.0", - "host.hostname": "DESKTOP-TIUKL1R", + "host.ipv4": "10.1.9.51", + "elastic.service.endpoint.behavior_protection": "detect", + "host.domain": "", + "host.os.organization": "", + "script.start": "2023-09-22T18:15:55Z", + "host.os.family": "Windows", + "script.current_time": "2023-09-22T18:16:05Z", "host.hardware.manufacturer": "VMware, Inc.", - "windows_defender.service.antivirus.status": "Enabled", - "script.start": "2023-06-15T20:13:03Z", - "host.os.name": "Microsoft Windows 11 Education N", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "host.os.organization": "", - "host.hardware.owner": "dcuser", - "windows_defender.service.antispyware.status": "Enabled", - "host.workgroup": "WORKGROUP", - "host.ipv4": "10.1.9.112", - "host.os.version": "10.0.22000", - "windows_defender.service.antivirus.full_scan.signature_version": "", - "host.hardware.bios.name": "Phoenix Technologies LTD", - "host.type": "Workstation", - "windows_defender.service.behavior_monitor.status": "Enabled", - "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "host.mac": "00:0C:29:EF:9A:EB", + "host.hardware.bios.version": "6.00", + "windows_defender.service.antimalware.product_version": "4.18.23080.2006", + "windows_defender.service.antivirus.status": "Enabled", + "host.os.build": "19045", + "windows_defender.service.ioav_protection.status": "Disabled", + "windows_defender.service.nis.engine_version": "1.1.23080.2005", + "elastic.service.endpoint.version": "", "host.oem.model": "", - "host.uptime": "139304", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "windows_defender.service.antimalware.product_version": "4.18.23050.5", - "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", - "windows_defender.service.ioav_protection.status": "Enabled", - "windows_defender.service.on_access_protection.status": "Enabled", + "host.hostname": "BOTANYBAYEP1", + "trellix.service.rsd.status": "", + "windows_defender.service.nis.signature_version": "1.397.1402.0", + "trellix.service.pa.version": "", + "windows_defender.service.antivirus.quick_scan.signature_version": "1.397.1180.0", + "trellix.service.rsd.version": "", + "elastic.service.endpoint.status": "", + "windows_defender.service.nis.status": "Disabled", + "host.ip": "10.1.9.51", + "trellix.service.pa.status": "", + "windows_defender.service.real_time_protection.status": "Disabled", "script.name": "Get-TychonEppSetting.ps1", - "windows_defender.service.antimalware.engine_version": "1.1.23050.3", - "windows_defender.service.nis.engine_version": "1.1.23050.3", - "script.version": "0.1.0", - "host.oem.manufacturer": "", + "trellix.service.ens.status": "", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "elastic.service.agent.version": "", "host.os.description": "", - "script.current_duration": "1129.20", - "host.ipv6": "fe80::40d1:5287:42b9:5645", - "script.current_time": "2023-06-15T20:13:04Z", - "windows_defender.service.nis.signature_version": "1.391.1546.0", - "host.hardware.bios.version": "6.00", - "windows_defender.service.nis.status": "Enabled", - "host.domain": "", - "host.os.family": "Windows" + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-expected.json b/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-expected.json index 00394d42a8a..2000bcf3339 100644 --- a/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-expected.json +++ b/packages/tychon/data_stream/tychon_epp/_dev/test/pipeline/test-epp.json-expected.json @@ -1,20 +1,41 @@ { "expected": [ { - "@timestamp": "2023-07-28T18:14:38.878742881Z", + "@timestamp": "2023-09-25T21:55:24.027955596Z", "ecs": { "version": "8.8.0" }, + "elastic": { + "service": { + "agent": { + "status": "", + "version": "" + }, + "endpoint": { + "behavior_protection": "detect", + "malware": "detect", + "memory_protection": "detect", + "status": "", + "version": "" + } + } + }, "event": { "category": [ - "host" + "configuration" ], - "ingested": "2023-07-28T18:14:38.878742881Z", + "ingested": "2023-09-25T21:55:24.027955596Z", "kind": "state", - "module": "tychon" + "module": "tychon", + "type": [ + "info" + ] }, "host": { - "biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, "domain": "", "hardware": { "bios": { @@ -25,49 +46,83 @@ "caption": "Intel64 Family 6 Model 45 Stepping 7" }, "manufacturer": "VMware, Inc.", - "owner": "dcuser", - "serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb" + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" }, - "hostname": "DESKTOP-TIUKL1R", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "ip": "10.1.9.112", - "ipv4": "10.1.9.112", - "ipv6": "fe80::40d1:5287:42b9:5645", - "mac": "00-0C-29-EF-9A-EB", + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": "10.1.9.51", + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": "00-0C-29-93-6A-F3", "oem": { "manufacturer": "", "model": "" }, "os": { - "build": "22000", + "build": "19045", "description": "", "family": "Windows", - "name": "Microsoft Windows 11 Education N", + "name": "Microsoft Windows 10 Pro", "organization": "", - "version": "10.0.22000" + "version": "2009" }, "type": "Workstation", - "uptime": 139304, + "uptime": 352927, "workgroup": "WORKGROUP" }, - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "script": { - "current_duration": 1129.2, - "current_time": "2023-06-15T20:13:04Z", + "current_duration": 9805.07, + "current_time": "2023-09-22T18:16:05Z", "name": "Get-TychonEppSetting.ps1", - "start": "2023-06-15T20:13:03Z", + "start": "2023-09-22T18:15:55Z", "type": "powershell", - "version": "0.1.0" + "version": "2.3.141.0" + }, + "trellix": { + "service": { + "accm": { + "status": "", + "version": "" + }, + "dlp": { + "status": "Unknown", + "version": "" + }, + "ens": { + "signature_version": "", + "status": "", + "version": "" + }, + "ma": { + "status": "Unknown", + "version": "" + }, + "pa": { + "status": "", + "version": "" + }, + "rsd": { + "status": "", + "version": "" + } + } + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" }, "windows_defender": { "service": { "antimalware": { - "engine_version": "1.1.23050.3", - "product_version": "4.18.23050.5", + "engine_version": "1.1.23080.2005", + "product_version": "4.18.23080.2006", "status": "Enabled" }, "antispyware": { - "signature_version": "1.391.1546.0", + "signature_version": "1.397.1402.0", "status": "Enabled" }, "antivirus": { @@ -75,26 +130,26 @@ "signature_version": "" }, "quick_scan": { - "signature_version": "1.391.1470.0" + "signature_version": "1.397.1180.0" }, "status": "Enabled" }, "behavior_monitor": { - "status": "Enabled" + "status": "Disabled" }, "ioav_protection": { - "status": "Enabled" + "status": "Disabled" }, "nis": { - "engine_version": "1.1.23050.3", - "signature_version": "1.391.1546.0", - "status": "Enabled" + "engine_version": "1.1.23080.2005", + "signature_version": "1.397.1402.0", + "status": "Disabled" }, "on_access_protection": { - "status": "Enabled" + "status": "Disabled" }, "real_time_protection": { - "status": "Enabled" + "status": "Disabled" } } } diff --git a/packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml index 1a31e66f028..0a966f2d258 100644 --- a/packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_epp/elasticsearch/ingest_pipeline/default.yml @@ -20,15 +20,22 @@ processors: value: tychon - set: field: event.category - value: epp + value: [configuration] + - set: + field: event.type + value: [info] - split: field: host.ipv4 separator: "," ignore_missing: true - - set: + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: field: host.uptime - value: "0" - if: ctx.host.uptime == '' + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -46,11 +53,6 @@ processors: field: host.uptime type: long ignore_missing: true - - gsub: - field: host.mac - pattern: ":" - replacement: "-" - ignore_missing: true - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_epp/fields/agent.yml b/packages/tychon/data_stream/tychon_epp/fields/agent.yml index 6dd345cff24..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_epp/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_epp/fields/agent.yml @@ -1,82 +1,45 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' +- name: id + description: TYCHON unique document identifier. + type: keyword +- name: tychon type: group fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id + - name: id + description: TYCHON unique host identifier. type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' +- name: elastic_agent type: group fields: - name: id - level: core + description: Elastic Agent Id. type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended + - name: snapshot + description: Elastic Agent snapshot. + type: boolean + - name: version + description: Elastic Agent Version. type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. +- name: script + type: group + fields: + - name: current_duration + description: Scanner Script Duration. + type: long + - name: current_time + description: Current datetime. + type: date - name: name - level: extended + description: Scanner Script Name. + type: keyword + - name: start + description: Scanner Start datetime. + type: date + - name: type + description: Scanner Script Type. type: keyword - ignore_above: 1024 - description: Container name. + - name: version + description: Scanner Script Version. + type: version - name: host title: Host group: 2 @@ -85,51 +48,15 @@ ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' type: group fields: - - name: id - description: Unique host id. As hostname is not always unique, use values that are meaningful in your environment. - type: keyword - name: biossn description: Host BIOS Serial Number. type: keyword - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: ip - level: core - type: ip - description: Host ip addresses. - name: ipv4 - level: core - type: keyword - description: Host ip v4 addresses. + description: Host IPv4 addresses. + type: ip - name: ipv6 - level: core + description: Host IPv6 addresses. type: keyword - description: Host ip v6 addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: type - description: Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. - type: keyword - - name: uptime - description: Seconds the host has been up. - type: long - name: workgroup description: Host Workgroup Network Name. type: keyword @@ -150,19 +77,10 @@ type: keyword - name: description description: Host OS Description. - type: keyword - - name: family - description: OS family (such as redhat, debian, freebsd, windows). - type: keyword - - name: name - description: Operating system name, without the version. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword - - name: version - description: Operating system version as a raw string. - type: keyword - name: hardware type: group fields: diff --git a/packages/tychon/data_stream/tychon_epp/fields/base-fields.yml b/packages/tychon/data_stream/tychon_epp/fields/base-fields.yml index 44a26fd137a..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_epp/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_epp/fields/base-fields.yml @@ -1,21 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: keyword - description: Event module. -- name: '@timestamp' - description: Event timestamp. - type: date +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_epp/fields/ecs.yml b/packages/tychon/data_stream/tychon_epp/fields/ecs.yml index 05e44a34ee0..a843688df01 100644 --- a/packages/tychon/data_stream/tychon_epp/fields/ecs.yml +++ b/packages/tychon/data_stream/tychon_epp/fields/ecs.yml @@ -1,3 +1,5 @@ +- external: ecs + name: '@timestamp' - external: ecs name: package.description - external: ecs @@ -8,6 +10,12 @@ name: package.type - external: ecs name: package.build_version +- external: ecs + name: data_stream.dataset +- external: ecs + name: data_stream.namespace +- external: ecs + name: data_stream.type - external: ecs name: event.kind - external: ecs @@ -46,6 +54,8 @@ name: host.architecture - external: ecs name: host.name +- external: ecs + name: host.uptime - external: ecs name: host.os.kernel - external: ecs diff --git a/packages/tychon/data_stream/tychon_epp/fields/fields.yml b/packages/tychon/data_stream/tychon_epp/fields/fields.yml index 4b80ceabc31..caa85348b86 100644 --- a/packages/tychon/data_stream/tychon_epp/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_epp/fields/fields.yml @@ -1,27 +1,3 @@ -- name: id - description: TYCHON Unique Idnentifier of the Common Vulnerabilities and Exposures Result for the Endpoint. - type: keyword -- name: script - type: group - fields: - - name: current_duration - description: Current Scanner Script Duration. - type: long - - name: current_time - description: Current Script datetime. - type: date - - name: name - description: Scanner Script Name. - type: keyword - - name: start - description: Scanner Start datetime. - type: date - - name: type - description: Scanner Script Type. - type: keyword - - name: version - description: Scanner Script Version. - type: keyword - name: windows_defender group: 2 type: group @@ -89,21 +65,99 @@ - name: status description: Windows Defender Network Inspection System Status. type: keyword -- name: elastic_agent +- name: elastic + type: group + fields: + - name: service + type: group + fields: + - name: agent + type: group + fields: + - name: status + description: Elastic Service Agent Status. + type: keyword + - name: version + description: Elastic Service Agent Version. + type: version + - name: endpoint + type: group + fields: + - name: behavior_protection + description: Elastic Service Endpoint Behavior Protection. + type: keyword + - name: malware + description: Elastic Service Endpoint Malware. + type: keyword + - name: memory_protection + description: Elastic Service Endpoint Memory Protection. + type: keyword + - name: status + description: Elastic Service Endpoint Status. + type: keyword + - name: version + description: Elastic Service Endpoint Version. + type: version +- name: trellix type: group fields: - - name: id - description: Elastic Agent Id. - type: keyword - - name: snapshot - description: Elastic Agent snapshot. - type: boolean - - name: version - description: Elastic Agent Version. - type: keyword -- name: host.epp.product - description: Epp products installed - type: keyword -- name: host.trellix.product - description: trellix products installed - type: keyword + - name: service + type: group + fields: + - name: accm + type: group + fields: + - name: status + description: Trellix Service Accum Status. + type: keyword + - name: version + description: Trellix Service Accum Version. + type: version + - name: dlp + type: group + fields: + - name: status + description: Trellix Service DLP Status. + type: keyword + - name: version + description: Trellix Service DLP Version. + type: version + - name: ens + type: group + fields: + - name: signature_version + description: Trellix Service ENS Signature Version. + type: keyword + - name: status + description: Trellix Service ENS Signature status. + type: keyword + - name: version + description: Trellix Service ENS Signature Version. + type: version + - name: ma + type: group + fields: + - name: status + description: Trellix Service MA Status. + type: keyword + - name: version + description: Trellix Service MA Version. + type: version + - name: pa + type: group + fields: + - name: status + description: Trellix Service PA Status. + type: keyword + - name: version + description: Trellix Service PA Version. + type: version + - name: rsd + type: group + fields: + - name: status + description: Trellix Service RSD Status. + type: keyword + - name: version + description: Trellix Service RSD Version. + type: version diff --git a/packages/tychon/data_stream/tychon_epp/manifest.yml b/packages/tychon/data_stream/tychon_epp/manifest.yml index 37d37c1eb63..83539270d37 100644 --- a/packages/tychon/data_stream/tychon_epp/manifest.yml +++ b/packages/tychon/data_stream/tychon_epp/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json b/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json index 8c33241ff6e..dd3a2124637 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json +++ b/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json @@ -1,45 +1,53 @@ { "events": [ { + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "process.name": "services.exe", + "script.type": "powershell", "host.os.build": "19045", - "host.ip": "192.168.0.92", - "host.hostname": "DESKTOP-BS6VECN", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-15T15:07:48Z", - "@timestamp": "2023-08-15T15:07:48Z", - "host.os.name": "Microsoft Windows 10 Home", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", + "host.ip": [ + "10.1.9.51" + ], + "process.start": "2023-09-18T16:13:52Z", + "host.hostname": "BOTANYBAYEP1", + "host.hardware.manufacturer": "VMware, Inc.", + "script.start": "2023-09-25T19:02:40Z", + "host.os.name": "Microsoft Windows 10 Pro", + "host.hardware.owner": "admin", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.os.organization": "", - "host.hardware.owner": "liguitarguide@gmail.com", "host.workgroup": "WORKGROUP", - "host.ipv4": "192.168.0.92", + "host.ipv4": "10.1.9.51", "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", + "host.hardware.bios.name": "Phoenix Technologies LTD", "host.type": "Workstation", "process.user.name": "NT AUTHORITY\\SYSTEM", "source.ip": "::", "network.transport": "tcp", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "process.command_line": "", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.mac": "DC:41:A9:A0:1B:A3", - "process.pid": "1116", - "host.oem.model": "XPS 15 9500", - "host.uptime": "1234", - "script.type": "powershell", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": [ + "00-0C-29-93-6A-F3" + ], + "process.pid": 848, + "host.oem.model": "", + "host.uptime": "614921.3194264", + "id": "BOTANYBAYEP1#::#49673#tcp", "process.hash.sha1": "2D79A17A7F226B4A3BC25D47D73570F9A33AAC1A", - "host.hardware.serial_number": "64H3DB3", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", "script.name": "Get-ExposedServiceInfo.ps1", - "script.version": "2.3.48.0", - "host.oem.manufacturer": "Dell", + "script.version": "2.3.141.0", + "host.oem.manufacturer": "", "host.os.description": "", - "script.current_duration": "3967.45", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "script.current_time": "2023-08-15T15:07:52Z", - "host.hardware.bios.version": "1.22.0", - "source.port": "49671", + "script.current_duration": "13538.63", + "host.ipv6": "", + "script.current_time": "2023-09-25T19:02:54Z", + "host.hardware.bios.version": "6.00", + "source.port": 49673, + "process.executable": "services.exe", "host.domain": "", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json-expected.json b/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json-expected.json index a0a33ce7a58..ac12640cb35 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json-expected.json +++ b/packages/tychon/data_stream/tychon_exposedservice/_dev/test/pipeline/test-exposedservice.json-expected.json @@ -1,46 +1,102 @@ { "expected": [ { - "process.name": "services.exe", - "host.os.build": "19045", - "host.ip": "192.168.0.92", - "host.hostname": "DESKTOP-BS6VECN", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-15T15:07:48Z", - "@timestamp": "2023-08-15T15:07:48Z", - "host.os.name": "Microsoft Windows 10 Home", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", - "host.os.organization": "", - "host.hardware.owner": "liguitarguide@gmail.com", - "host.workgroup": "WORKGROUP", - "host.ipv4": "192.168.0.92", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "process.user.name": "NT AUTHORITY\\SYSTEM", - "source.ip": "::", - "network.transport": "tcp", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", - "process.command_line": "", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.mac": "DC:41:A9:A0:1B:A3", - "process.pid": "1116", - "host.oem.model": "XPS 15 9500", - "host.uptime": "1234", - "script.type": "powershell", - "process.hash.sha1": "2D79A17A7F226B4A3BC25D47D73570F9A33AAC1A", - "host.hardware.serial_number": "64H3DB3", - "script.name": "Get-ExposedServiceInfo.ps1", - "script.version": "2.3.48.0", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "script.current_duration": "3967.45", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "script.current_time": "2023-08-15T15:07:52Z", - "host.hardware.bios.version": "1.22.0", - "source.port": "49671", - "host.domain": "", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:24.225040722Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "network" + ], + "ingested": "2023-09-25T21:55:24.225040722Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 614921, + "workgroup": "WORKGROUP" + }, + "id": "BOTANYBAYEP1#::#49673#tcp", + "network": { + "transport": "tcp" + }, + "process": { + "command_line": "", + "executable": "services.exe", + "hash": { + "sha1": "2D79A17A7F226B4A3BC25D47D73570F9A33AAC1A" + }, + "name": "services.exe", + "pid": 848, + "start": "2023-09-18T16:13:52Z", + "user": { + "name": "NT AUTHORITY\\SYSTEM" + } + }, + "script": { + "current_duration": 13538.63, + "current_time": "2023-09-25T19:02:54Z", + "name": "Get-ExposedServiceInfo.ps1", + "start": "2023-09-25T19:02:40Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "service": { + "name": "services.exe" + }, + "source": { + "ip": "::", + "port": 49673 + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_exposedservice/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_exposedservice/elasticsearch/ingest_pipeline/default.yml index 0b1d21bc7e8..3436d4ec7dc 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_exposedservice/elasticsearch/ingest_pipeline/default.yml @@ -13,6 +13,7 @@ processors: field: source.ip value: "0.0.0.0" if: ctx.source.ip == '' + ignore_failure: true - set: field: service.name value: "{{process.name}}" @@ -28,12 +29,14 @@ processors: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.module - value: tychon - - set: - field: event.category - value: exposed service + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -43,14 +46,24 @@ processors: field: host.uptime value: "{{tempuptime.0}}" ignore_failure: true - - set: - field: service.state - value: Running - if: ctx.service.state == '' - remove: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.module + value: tychon + - set: + field: event.category + value: [network] + - set: + field: event.type + value: [info] + - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_exposedservice/fields/agent.yml b/packages/tychon/data_stream/tychon_exposedservice/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_exposedservice/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_exposedservice/fields/base-fields.yml b/packages/tychon/data_stream/tychon_exposedservice/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_exposedservice/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_exposedservice/fields/fields.yml b/packages/tychon/data_stream/tychon_exposedservice/fields/fields.yml index cc0dc08ce10..54b02bbc340 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_exposedservice/fields/fields.yml @@ -1,9 +1,9 @@ - name: service type: group fields: - - name: description - type: keyword - description: The description text on the serivce. - - name: display_name - type: keyword - description: The human readable name of the service \ No newline at end of file + - name: description + description: The description text on the serivce. + type: keyword + - name: display_name + description: The human readable name of the service + type: keyword diff --git a/packages/tychon/data_stream/tychon_exposedservice/manifest.yml b/packages/tychon/data_stream/tychon_exposedservice/manifest.yml index 01937d88bd8..c86415c93f3 100644 --- a/packages/tychon/data_stream/tychon_exposedservice/manifest.yml +++ b/packages/tychon/data_stream/tychon_exposedservice/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json b/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json index 02df63d6e6b..5f452a4b541 100644 --- a/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json +++ b/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json @@ -1,62 +1,64 @@ { "events": [ { - "disk_location_function": "0", - "disk.is_offline": "false", - "disk_location_bus": "0", - "disk_size": "512110190592", - "disk_operational_status": "Online", - "disk.serial_number": "E823_8FA6_BF53_0001_001B_444A_4656_FFFD.", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.os.name": "Microsoft Windows 10 Pro", + "disk.location.device": "0", + "disk.partition_style": "MBR", + "host.hardware.manufacturer": "VMware, Inc.", + "disk.serial_number": "", "host.os.build": "19045", - "host.ip": "192.168.0.60", - "host.hostname": "DESKTOP-BS6VECN", - "disk.firmware_version": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.oem.model": "XPS 15 9500", - "script.start": "2023-08-14T15:50:37Z", - "@timestamp": "2023-08-14T15:50:37Z", - "host.os.name": "Microsoft Windows 10 Home", - "disk_manufacturer": "NVMe", + "host.ip": "10.1.9.51", + "disk.boot_from": "true", + "host.hostname": "BOTANYBAYEP1", + "disk.adapter.serial_number": "", + "disk.location.adapter": "0", + "disk.system": "true", + "script.start": "2023-09-25T19:03:48Z", + "disk.size": "42949672960", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.os.organization": "", - "disk_model": "PC SN730 NVMe WDC 512GB", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", - "disk_location_adapter": "0", - "disk_guid": "ebcd47e8-49b0-4ec8-bfa7-ab9d5d2846d6", - "disk.name": "NVMe PC SN730 NVMe WDC 512GB", + "host.hardware.owner": "admin", + "disk.name": "VMware Virtual disk", "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "64H3DB3", - "disk.is_highly_available": "false", - "host.os.version": "2009", - "disk.is_clustered": "false", - "host.hardware.bios.name": "Dell Inc.", - "disk_NumberOfPartitions": "6", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.ipv4": "10.1.9.51", + "host.oem.model": "", + "disk.is_boot": "true", + "host.hardware.bios.name": "Phoenix Technologies LTD", "host.type": "Workstation", - "host.hardware.bios.version": "1.22.0", - "script.type": "powershell", - "host.os.description": "", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", - "disk_bus_type": "RAID", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.hardware.owner": "liguitarguide@gmail.com", - "disk_system": "true", - "disk_number": "0", - "host.uptime": {}, - "disk_adapter_serialnumber": "", - "disk_partition_style": "GPT", - "disk_boot_from": "true", + "disk.model": "Virtual disk ", + "disk.health_status": "Healthy", + "disk.number": "0", + "script.current_duration": "13711.00", + "disk.offline": "false", + "disk.location.bus": "3", + "disk.location.pci_slot": "160", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": "00:0C:29:93:6A:F3", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.uptime": "614991.6714276", + "id": "ec85d3b7de5e9d8717b7799a134bd829beada75c", + "disk.firmware.version": "2.0 ", + "disk.location.function": "0", + "script.current_time": "2023-09-25T19:04:02Z", + "disk.bus_type": "SAS", + "disk.manufacturer": "VMware ", + "disk.clustered": "false", "script.name": "Get-TychonHardDriveInfo.ps1", - "disk_health_status": "Healthy", - "disk_location_device": "23", - "script.version": "2.3.46.0", - "id": "ebcd47e8-49b0-4ec8-bfa7-ab9d5d2846d6", - "host.oem.manufacturer": "Dell", - "host.ipv4": "192.168.0.60", - "script.current_duration": "4267.97", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "script.current_time": "2023-08-14T15:50:41Z", - "disk_is_boot": "true", + "script.version": "2.3.141.0", + "host.oem.manufacturer": "", + "host.os.description": "", + "host.os.version": "2009", + "disk.operational_status": "Online", + "disk.number_of_partitions": "3", + "host.ipv6": "", + "host.hardware.bios.version": "6.00", + "disk.id": "{1}\\\\BOTANYBAYEP1\\root/Microsoft/Windows/Storage/Providers_v2\\WSP_Disk.ObjectId=\"{c3aa4c8f-3a0e-11ed-91c8-806e6f6e6963}:DI:\\\\?\\scsi#disk\u0026ven_vmware\u0026prod_virtual_disk#5\u00261ec51bf7\u00260\u0026000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\"", + "disk.highly_available": "false", + "script.type": "powershell", "host.domain": "", - "host.mac": "DC:41:A9:A0:1B:A3", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json-expected.json b/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json-expected.json index 7e7aad8eba5..80e03157b46 100644 --- a/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json-expected.json +++ b/packages/tychon/data_stream/tychon_harddrive/_dev/test/pipeline/test-harddrive.json-expected.json @@ -1,63 +1,112 @@ { "expected": [ { - "disk_location_function": "0", - "disk.is_offline": "false", - "disk_location_bus": "0", - "disk_size": "512110190592", - "disk_operational_status": "Online", - "disk.serial_number": "E823_8FA6_BF53_0001_001B_444A_4656_FFFD.", - "host.os.build": "19045", - "host.ip": "192.168.0.60", - "host.hostname": "DESKTOP-BS6VECN", - "disk.firmware_version": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.oem.model": "XPS 15 9500", - "script.start": "2023-08-14T15:50:37Z", - "@timestamp": "2023-08-14T15:50:37Z", - "host.os.name": "Microsoft Windows 10 Home", - "disk_manufacturer": "NVMe", - "host.os.organization": "", - "disk_model": "PC SN730 NVMe WDC 512GB", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", - "disk_location_adapter": "0", - "disk_guid": "ebcd47e8-49b0-4ec8-bfa7-ab9d5d2846d6", - "disk.name": "NVMe PC SN730 NVMe WDC 512GB", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "64H3DB3", - "disk.is_highly_available": "false", - "host.os.version": "2009", - "disk.is_clustered": "false", - "host.hardware.bios.name": "Dell Inc.", - "disk_NumberOfPartitions": "6", - "host.type": "Workstation", - "host.hardware.bios.version": "1.22.0", - "script.type": "powershell", - "host.os.description": "", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", - "disk_bus_type": "RAID", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.hardware.owner": "liguitarguide@gmail.com", - "disk_system": "true", - "disk_number": "0", - "host.uptime": {}, - "disk_adapter_serialnumber": "", - "disk_partition_style": "GPT", - "disk_boot_from": "true", - "script.name": "Get-TychonHardDriveInfo.ps1", - "disk_health_status": "Healthy", - "disk_location_device": "23", - "script.version": "2.3.46.0", - "id": "ebcd47e8-49b0-4ec8-bfa7-ab9d5d2846d6", - "host.oem.manufacturer": "Dell", - "host.ipv4": "192.168.0.60", - "script.current_duration": "4267.97", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "script.current_time": "2023-08-14T15:50:41Z", - "disk_is_boot": "true", - "host.domain": "", - "host.mac": "DC:41:A9:A0:1B:A3", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:24.421648324Z", + "disk": { + "adapter": { + "serial_number": "" + }, + "boot_from": "true", + "bus_type": "SAS", + "clustered": "false", + "firmware": { + "version": "2.0 " + }, + "health_status": "Healthy", + "highly_available": "false", + "id": "{1}\\\\BOTANYBAYEP1\\root/Microsoft/Windows/Storage/Providers_v2\\WSP_Disk.ObjectId=\"{c3aa4c8f-3a0e-11ed-91c8-806e6f6e6963}:DI:\\\\?\\scsi#disk\u0026ven_vmware\u0026prod_virtual_disk#5\u00261ec51bf7\u00260\u0026000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\"", + "is_boot": "true", + "location": { + "adapter": "0", + "bus": "3", + "device": "0", + "function": "0", + "pci_slot": "160" + }, + "manufacturer": "VMware ", + "model": "Virtual disk ", + "name": "VMware Virtual disk", + "number": "0", + "number_of_partitions": "3", + "offline": "false", + "operational_status": "Online", + "partition_style": "MBR", + "serial_number": "", + "size": 42949672960, + "system": "true" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "configuration" + ], + "ingested": "2023-09-25T21:55:24.421648324Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 614991, + "workgroup": "WORKGROUP" + }, + "id": "ec85d3b7de5e9d8717b7799a134bd829beada75c", + "script": { + "current_duration": 13711.0, + "current_time": "2023-09-25T19:04:02Z", + "name": "Get-TychonHardDriveInfo.ps1", + "start": "2023-09-25T19:03:48Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_harddrive/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_harddrive/elasticsearch/ingest_pipeline/default.yml index a0b8abf6fc5..8db5d7fa333 100644 --- a/packages/tychon/data_stream/tychon_harddrive/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_harddrive/elasticsearch/ingest_pipeline/default.yml @@ -15,16 +15,26 @@ processors: - set: field: event.kind value: state + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.module - value: tychon - - set: - field: event.category - value: hard drive + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -38,6 +48,23 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: disk.size + type: long + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.module + value: tychon + - set: + field: event.category + value: [configuration] + - set: + field: event.type + value: [info] - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_harddrive/fields/agent.yml b/packages/tychon/data_stream/tychon_harddrive/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_harddrive/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_harddrive/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_harddrive/fields/base-fields.yml b/packages/tychon/data_stream/tychon_harddrive/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_harddrive/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_harddrive/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_harddrive/fields/fields.yml b/packages/tychon/data_stream/tychon_harddrive/fields/fields.yml index c8de5ee5041..6d5ccd2556b 100644 --- a/packages/tychon/data_stream/tychon_harddrive/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_harddrive/fields/fields.yml @@ -1,84 +1,84 @@ - name: disk type: group fields: - - name: adapter - type: group - fields: - - name: serial_number + - name: id + description: Disk ID + type: keyword + - name: adapter + type: group + fields: + - name: serial_number + type: keyword + description: Disk Adatper Serial Number + - name: boot_from + type: boolean + description: OS booted from this disk + - name: bus_type type: keyword - description: Disk Adatper Serial Number - - name: boot_from - type: boolean - description: OS booted from this disk - - name: bus_type - type: keyword - description: THe Disk Bus Type - - name: clustered - type: boolean - description: Is the Disk Clustered - - name: firmware - type: group - fields: - - name: version + description: THe Disk Bus Type + - name: clustered + type: boolean + description: Is the Disk Clustered + - name: firmware_version type: keyword description: Disk Firmware version - - name: guid - type: keyword - description: Disk UUID - - name: health_status - type: keyword - description: Health status of the disk - - name: highly_available - type: boolean - description: Disk is marked as highly available - - name: is_boot - type: boolean - description: Disk is a boot disk - - name: location - type: group - fields: - - name: adapter - type: integer - description: Zero index adapter location - - name: bus - type: integer - description: Disk Bus Location - - name: device + - name: health_status + type: keyword + description: Health status of the disk + - name: highly_available + type: boolean + description: Disk is marked as highly available + - name: is_boot + type: boolean + description: Disk is a boot disk + - name: location + type: group + fields: + - name: adapter + type: integer + description: Zero index adapter location + - name: pci_slot + type: integer + description: PCI Slot location + - name: bus + type: integer + description: Disk Bus Location + - name: device + type: integer + description: Disk Device Location + - name: function + type: integer + description: Disk Function Location + - name: manufacturer + type: keyword + description: The manufacturer of the Disk + - name: model + type: keyword + description: The model of the disk + - name: name + type: keyword + description: The firendly name of the disk + - name: number type: integer - descirption: Disk Device Location - - name: function + description: The number assigned to the disk + - name: number_of_partitions type: integer - description: Disk Function Location - - name: manufacturer - type: keyword - description: The manufacturer of the Disk - - name: model - type: keyword - description: The model of the disk - - name: name - type: keyword - description: The firendly name of the disk - - name: number - type: integer - description: The number assigned to the disk - - name: number_of_partitions - type: integer - description: Total number of partitions on the drive - - name: offline - type: boolean - description: Is the disk offline - - name: operational_status - type: keyword - description: Operational Status of the disk - - name: partition_style - type: keyword - description: Partition style - - name: serial_number - type: keyword - description: The unique serial number of the drive - - name: size - type: long - description: Total Size of the disk - - name: system - type: boolean - description: Is this a system drive + description: Total number of partitions on the drive + - name: offline + type: boolean + description: Is the disk offline + - name: operational_status + type: keyword + description: Operational Status of the disk + - name: partition_style + type: keyword + description: Partition style + - name: serial_number + type: keyword + description: The unique serial number of the drive + - name: size + type: long + description: Total Size of the disk + - name: system + type: boolean + description: Is this a system drive diff --git a/packages/tychon/data_stream/tychon_harddrive/manifest.yml b/packages/tychon/data_stream/tychon_harddrive/manifest.yml index c030df86e49..21b27d5034f 100644 --- a/packages/tychon/data_stream/tychon_harddrive/manifest.yml +++ b/packages/tychon/data_stream/tychon_harddrive/manifest.yml @@ -3,7 +3,7 @@ type: logs streams: - input: logfile title: Endpoint Harddrive Info - description: TYCHON reports all the physical Hard Drive's on an endpoint + description: TYCHON reports all the physical Hard Drive(s) on an endpoint template_path: stream.yml.hbs vars: - name: paths diff --git a/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json b/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json index ae6ac19c749..dfffaac7c28 100644 --- a/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json +++ b/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json @@ -1,44 +1,48 @@ { "events": [ { + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "script.type": "powershell", "host.os.build": "19045", - "host.ip": "192.168.0.33", - "host.hostname": "DESKTOP-BS6VECN", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-16T15:28:09Z", - "@timestamp": "2023-08-16T15:28:09Z", - "host.os.name": "Microsoft Windows 10 Home", - "friendly_name": "HID-compliant vendor-defined device", - "device_id": "HID\\DELL097D\u0026COL04\\5\u00262E84B32B\u00260\u00260003", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", + "host.ip": "10.1.9.51", + "script.version": "2.3.141.0", + "host.hostname": "BOTANYBAYEP1", + "host.hardware.manufacturer": "VMware, Inc.", + "script.start": "2023-09-25T04:03:37Z", + "host.os.name": "Microsoft Windows 10 Pro", "host.os.organization": "", - "host.hardware.owner": "liguitarguide@gmail.com", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", + "device.name": "Motherboard resources", + "host.hardware.owner": "admin", "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "64H3DB3", - "host.ipv4": "192.168.0.33", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.ipv4": "10.1.9.51", "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", + "host.hardware.bios.name": "Phoenix Technologies LTD", + "device.present": "true", "host.type": "Workstation", - "status": "OK", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.mac": "DC:41:A9:A0:1B:A3", - "host.oem.model": "XPS 15 9500", - "host.uptime": "554367.8797053", - "script.type": "powershell", - "script.current_time": "2023-08-16T15:28:10Z", + "device.id": "ACPI\\PNP0C02\\4", + "device.description": "Motherboard resources", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "device.class": "System", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": "00:0C:29:93:6A:F3", + "device.friendly_name": "Motherboard resources", + "host.oem.model": "", + "host.uptime": "560978.5582333", + "id": "eb657a5e2a6762a1aeebaa530a334081e387d350", + "script.current_time": "2023-09-25T04:03:42Z", "script.name": "Get-TychonHardwareInfo.ps1", - "script.version": "2.3.55.0", - "host.oem.manufacturer": "Dell", + "device.status": "OK", + "host.oem.manufacturer": "", "host.os.description": "", - "script.current_duration": "970.62", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "manufacturer": "(Standard system devices)", - "host.hardware.bios.version": "1.22.0", - "name": "HID-compliant vendor-defined device", + "script.current_duration": "5072.02", + "host.ipv6": "", + "host.hardware.bios.version": "6.00", + "device.manufacturer": "(Standard system devices)", "host.domain": "", - "host.os.family": "Windows", - "present": "true" + "host.cloud.hosted": "false", + "host.os.family": "Windows" } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json-expected.json b/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json-expected.json index 34d6291463e..6eeb5394629 100644 --- a/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json-expected.json +++ b/packages/tychon/data_stream/tychon_hardware/_dev/test/pipeline/test-hardware.json-expected.json @@ -1,44 +1,89 @@ { "expected": [ { - "host.os.build": "19045", - "host.ip": "192.168.0.33", - "host.hostname": "DESKTOP-BS6VECN", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-16T15:28:09Z", - "@timestamp": "2023-08-16T15:28:09Z", - "host.os.name": "Microsoft Windows 10 Home", - "friendly_name": "HID-compliant vendor-defined device", - "device_id": "HID\\DELL097D\u0026COL04\\5\u00262E84B32B\u00260\u00260003", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 165 Stepping 2", - "host.os.organization": "", - "host.hardware.owner": "liguitarguide@gmail.com", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "64H3DB3", - "host.ipv4": "192.168.0.33", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "status": "OK", - "host.id": "1e4f897fb22947a392261a869b2299cb_4C4C4544-0034-4810-8033-B6C04F444233_DESKTOP-BS6VECN_WORKGROUP", - "host.biossn": "4C4C4544-0034-4810-8033-B6C04F444233", - "host.mac": "DC:41:A9:A0:1B:A3", - "host.oem.model": "XPS 15 9500", - "host.uptime": "554367.8797053", - "script.type": "powershell", - "script.current_time": "2023-08-16T15:28:10Z", - "script.name": "Get-TychonHardwareInfo.ps1", - "script.version": "2.3.55.0", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "script.current_duration": "970.62", - "host.ipv6": "fe80::fefc:76f5:552c:886e", - "manufacturer": "(Standard system devices)", - "host.hardware.bios.version": "1.22.0", - "name": "HID-compliant vendor-defined device", - "host.domain": "", - "host.os.family": "Windows", - "present": "true" + "@timestamp": "2023-09-25T21:55:24.604662201Z", + "device": { + "class": "System", + "description": "Motherboard resources", + "friendly_name": "Motherboard resources", + "id": "ACPI\\PNP0C02\\4", + "manufacturer": "(Standard system devices)", + "name": "Motherboard resources", + "present": "true", + "status": "OK" + }, + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "configuration" + ], + "ingested": "2023-09-25T21:55:24.604662201Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 560978, + "workgroup": "WORKGROUP" + }, + "id": "eb657a5e2a6762a1aeebaa530a334081e387d350", + "script": { + "current_duration": 5072.02, + "current_time": "2023-09-25T04:03:42Z", + "name": "Get-TychonHardwareInfo.ps1", + "start": "2023-09-25T04:03:37Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_hardware/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_hardware/elasticsearch/ingest_pipeline/default.yml index 8c6aee9e114..07adaabe93f 100644 --- a/packages/tychon/data_stream/tychon_hardware/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_hardware/elasticsearch/ingest_pipeline/default.yml @@ -21,13 +21,26 @@ processors: - set: field: event.module value: tychon + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.category - value: hardware + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -41,6 +54,16 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.category + value: [configuration] + - set: + field: event.type + value: [info] - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_hardware/fields/agent.yml b/packages/tychon/data_stream/tychon_hardware/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_hardware/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_hardware/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_hardware/fields/base-fields.yml b/packages/tychon/data_stream/tychon_hardware/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_hardware/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_hardware/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_hardware/fields/fields.yml b/packages/tychon/data_stream/tychon_hardware/fields/fields.yml index ff33e64dbab..f8c9a4a7192 100644 --- a/packages/tychon/data_stream/tychon_hardware/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_hardware/fields/fields.yml @@ -1,12 +1,21 @@ -- name: device.class - type: keyword -- name: device.description - type: keyword -- name: device.friendly_name - type: keyword -- name: device.name - type: keyword -- name: device.present - type: boolean -- name: device.status - type: keyword +- name: device + type: group + fields: + - name: class + description: Device Class. + type: keyword + - name: description + description: Device Description. + type: text + - name: friendly_name + description: Device Friendly Name. + type: keyword + - name: name + description: Device Name. + type: keyword + - name: present + description: Device Present. + type: boolean + - name: status + description: Device Status. + type: keyword diff --git a/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json b/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json index 390eb4215c1..14f5c2d6271 100644 --- a/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json +++ b/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json @@ -10,12 +10,12 @@ "host.tpm.compliant": "false", "host.type": "Workstation", "host.virtualization_status": "Virtual Machine", - "host.security.antivirus.name": "McAfee Endpoint Security, Windows Defender", + "host.security.antivirus.name": "McAfee Endpoint Security", "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", - "tychon.version.content": "2.3.70.0", - "script.current_duration": "14549.11", + "tychon.version.content": "2.3.141.0", + "script.current_duration": "7000.24", "host.oem.manufacturer": "", - "host.uptime": "1189443.9672792", + "host.uptime": "618683.1458787", "host.os.name": "Microsoft Windows 10 Pro", "host.tpm.present": "false", "event.deviceguard.secureboot.available": "false", @@ -23,30 +23,31 @@ "host.architecture": "64-bit", "host.os.version": "2009", "host.hostname": "BOTANYBAYEP1", - "id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "host.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "event.deviceguard.systemguardsecurelaunch.running": "false", + "host.cloud.hosted": "false", "tychon.version.agent": "1.7.861.86", "host.hardware.owner": "admin", - "script.version": "2.3.70.0", + "script.version": "2.3.141.0", "event.deviceguard.hypervisorenforcedcodeint.enabled": "false", "host.os.edition": "Pro", "host.workgroup": "WORKGROUP", "host.ipv6": "", "event.deviceguard.smmsecuritymigrations.available": "false", + "script.type": "powershell", "host.domain": "", "host.os.organization": "", - "script.start": "2023-08-22T21:01:25Z", "host.os.family": "Windows", - "script.current_time": "2023-08-22T21:01:39Z", + "script.current_time": "2023-09-25T20:05:29Z", "event.deviceguard.credentialguard.running": "false", "host.hardware.manufacturer": "VMware, Inc.", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.tpm.digest.id": "TPM Digest Not Found", "host.hardware.bios.version": "6.00", - "tychon.id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "host.os.build": "19045", - "host.security.antivirus.status": "OutOfDate, UpToDate", + "host.security.antivirus.status": "OutOfDate", "event.deviceguard.version": "1.0", "host.oem.model": "", "event.deviceguard.usermodecodeintegrity.policyenforcement": "Off", @@ -54,8 +55,8 @@ "tychon.definition.oval": "2023-08-15T20:03:33Z", "host.ipv4": "10.1.9.51", "event.deviceguard.ueficodereadonly.available": "false", - "host.security.antivirus.exists": "True, True", - "script.type": "powershell", + "host.security.antivirus.exists": "true", + "script.start": "2023-09-25T20:05:22Z", "host.os.vendor": "Microsoft Corporation", "host.motherboard.chipset": "Intel Corporation Model 440BX Desktop Reference Platform Version None", "host.motherboard.serial_number": "None", @@ -64,12 +65,12 @@ "host.cpu.count": "2", "host.ip": "10.1.9.51", "event.deviceguard.systemguardsecurelaunch.enabled": "false", - "host.security.antivirus.state": "On, Off", + "host.security.antivirus.state": "On", "script.name": "Get-TychonHostInfo.ps1", "host.mac": "00:0C:29:93:6A:F3", "event.deviceguard.credentialguard.enabled": "false", "host.os.description": "", - "host.id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "host.memory.size": "4294496256" } ] diff --git a/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json-expected.json b/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json-expected.json index ff7ac0a0ae2..75aeb57a048 100644 --- a/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json-expected.json +++ b/packages/tychon/data_stream/tychon_host/_dev/test/pipeline/test-host.json-expected.json @@ -1,76 +1,160 @@ { "expected": [ { - "event.ufi.enabled": "false", - "event.deviceguard.hypervisorenforcedcodeint.running": "false", - "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", - "host.tpm.version": "", - "event.deviceguard.securememoverwrite.available": "false", - "event.deviceguard.virtualizationbasedsecurity.status": "Off", - "host.tpm.compliant": "false", - "host.type": "Workstation", - "host.virtualization_status": "Virtual Machine", - "host.security.antivirus.name": "McAfee Endpoint Security, Windows Defender", - "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", - "tychon.version.content": "2.3.70.0", - "script.current_duration": "14549.11", - "host.oem.manufacturer": "", - "host.uptime": "1189443.9672792", - "host.os.name": "Microsoft Windows 10 Pro", - "host.tpm.present": "false", - "event.deviceguard.secureboot.available": "false", - "host.hardware.bios.name": "Phoenix Technologies LTD", - "host.architecture": "64-bit", - "host.os.version": "2009", - "host.hostname": "BOTANYBAYEP1", - "id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", - "host.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "event.deviceguard.systemguardsecurelaunch.running": "false", - "tychon.version.agent": "1.7.861.86", - "host.hardware.owner": "admin", - "script.version": "2.3.70.0", - "event.deviceguard.hypervisorenforcedcodeint.enabled": "false", - "host.os.edition": "Pro", - "host.workgroup": "WORKGROUP", - "host.ipv6": "", - "event.deviceguard.smmsecuritymigrations.available": "false", - "host.domain": "", - "host.os.organization": "", - "script.start": "2023-08-22T21:01:25Z", - "host.os.family": "Windows", - "script.current_time": "2023-08-22T21:01:39Z", - "event.deviceguard.credentialguard.running": "false", - "host.hardware.manufacturer": "VMware, Inc.", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "host.tpm.digest.id": "TPM Digest Not Found", - "host.hardware.bios.version": "6.00", - "tychon.id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", - "host.os.build": "19045", - "host.security.antivirus.status": "OutOfDate, UpToDate", - "event.deviceguard.version": "1.0", - "host.oem.model": "", - "event.deviceguard.usermodecodeintegrity.policyenforcement": "Off", - "event.deviceguard.dmaprotection.available": "false", - "tychon.definition.oval": "2023-08-15T20:03:33Z", - "host.ipv4": "10.1.9.51", - "event.deviceguard.ueficodereadonly.available": "false", - "host.security.antivirus.exists": "True, True", - "script.type": "powershell", - "host.os.vendor": "Microsoft Corporation", - "host.motherboard.chipset": "Intel Corporation Model 440BX Desktop Reference Platform Version None", - "host.motherboard.serial_number": "None", - "tychon.definition.stig": "2023-08-16T17:18:48Z", - "event.deviceguard.basevirtualizationsupport.available": "false", - "host.cpu.count": "2", - "host.ip": "10.1.9.51", - "event.deviceguard.systemguardsecurelaunch.enabled": "false", - "host.security.antivirus.state": "On, Off", - "script.name": "Get-TychonHostInfo.ps1", - "host.mac": "00:0C:29:93:6A:F3", - "event.deviceguard.credentialguard.enabled": "false", - "host.os.description": "", - "host.id": "e4efc65bcec04f8f860b413e53796ea9_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", - "host.memory.size": "4294496256" + "@timestamp": "2023-09-25T21:55:24.781576644Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "host" + ], + "deviceguard": { + "basevirtualizationsupport": { + "available": "false" + }, + "credentialguard": { + "enabled": "false", + "running": "false" + }, + "dmaprotection": { + "available": "false" + }, + "hypervisorenforcedcodeint": { + "enabled": "false", + "running": "false" + }, + "secureboot": { + "available": "false" + }, + "securememoverwrite": { + "available": "false" + }, + "smmsecuritymigrations": { + "available": "false" + }, + "systemguardsecurelaunch": { + "enabled": "false", + "running": "false" + }, + "ueficodereadonly": { + "available": "false" + }, + "usermodecodeintegrity": { + "policyenforcement": "Off" + }, + "version": "1.0", + "virtualizationbasedsecurity": { + "status": "Off" + } + }, + "ingested": "2023-09-25T21:55:24.781576644Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ], + "ufi": { + "enabled": "false" + } + }, + "host": { + "architecture": "64-bit", + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7", + "count": "2" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "memory": { + "size": 4294496256 + }, + "motherboard": { + "chipset": "Intel Corporation Model 440BX Desktop Reference Platform Version None", + "serial_number": "None" + }, + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "edition": "Pro", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "vendor": "Microsoft Corporation", + "version": "2009" + }, + "security": { + "antivirus": { + "exists": "true", + "name": "McAfee Endpoint Security", + "state": "On", + "status": "OutOfDate" + } + }, + "tpm": { + "compliant": "false", + "digest": { + "id": "TPM Digest Not Found" + }, + "present": "false", + "version": "" + }, + "type": "Workstation", + "uptime": 618683, + "virtualization_status": "Virtual Machine", + "workgroup": "WORKGROUP" + }, + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "script": { + "current_duration": 7000.24, + "current_time": "2023-09-25T20:05:29Z", + "name": "Get-TychonHostInfo.ps1", + "start": "2023-09-25T20:05:22Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "definition": { + "oval": "2023-08-15T20:03:33Z", + "stig": "2023-08-16T17:18:48Z" + }, + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "version": { + "agent": "1.7.861.86", + "content": "2.3.141.0" + } + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_host/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_host/elasticsearch/ingest_pipeline/default.yml index ca901abade7..b26a6b0b418 100644 --- a/packages/tychon/data_stream/tychon_host/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_host/elasticsearch/ingest_pipeline/default.yml @@ -18,13 +18,53 @@ processors: - set: field: event.module value: tychon + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true + - convert: + field: host.memory.size + type: long + ignore_failure: true + - convert: + field: host.uptime + type: string + ignore_missing: true + - split: + field: host.uptime + separator: "\\.+" + target_field: tempuptime + ignore_failure: true + - set: + field: host.uptime + value: "{{tempuptime.0}}" + ignore_failure: true + - remove: + field: tempuptime + ignore_failure: true + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true - set: field: event.category - value: host os + value: [host] + - set: + field: event.type + value: [info] - remove: field: tychon.definition.oval if: ctx.tychon.definition.oval == '' @@ -50,19 +90,6 @@ processors: value: "{{tempav.0}}" - remove: field: tempav - - split: - field: host.uptime - separator: "\\.+" - target_field: tempuptime - ignore_failure: true - - set: - field: host.uptime - value: "{{tempuptime.0}}" - ignore_failure: true - - remove: - field: tempuptime - ignore_failure: true - ignore_missing: true on_failure: - set: field: event.kind diff --git a/packages/tychon/data_stream/tychon_host/fields/agent.yml b/packages/tychon/data_stream/tychon_host/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_host/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_host/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_host/fields/base-fields.yml b/packages/tychon/data_stream/tychon_host/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_host/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_host/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_host/fields/fields.yml b/packages/tychon/data_stream/tychon_host/fields/fields.yml index a18a43e11b5..3730e78b350 100644 --- a/packages/tychon/data_stream/tychon_host/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_host/fields/fields.yml @@ -1,169 +1,185 @@ - name: event type: group fields: - - name: deviceguard - type: group - fields: - - name: basevirtualizationsupport + - name: deviceguard type: group fields: - - name: available - type: boolean - - name: credentialguard + - name: basevirtualizationsupport + type: group + fields: + - name: available + description: Event Device Base Virtualization Support Available. + type: boolean + - name: credentialguard + type: group + fields: + - name: enabled + description: Event Device Credential Guard Enabled. + type: boolean + - name: running + description: Event Device Credential Guard Running. + type: boolean + - name: dmaprotection + type: group + fields: + - name: available + description: Event Device + type: boolean + - name: hypervisorenforcedcodeint + type: group + fields: + - name: enabled + description: Event Device Hypervisor Enforced Code Enabled. + type: boolean + - name: running + description: Event Device Hypervisor Enforced Code running. + type: boolean + - name: secureboot + type: group + fields: + - name: available + description: Event Device Secure Boot Available. + type: boolean + - name: securememoverwrite + type: group + fields: + - name: available + description: Event Device Secure Memory Overwrite Available. + type: boolean + - name: smmsecuritymigrations + type: group + fields: + - name: available + description: Event Device SMM Security Migrations Available. + type: boolean + - name: systemguardsecurelaunch + type: group + fields: + - name: enabled + description: Event Device Guard System Guard Secure Launch Enabled. + type: boolean + - name: running + description: Event Device Guard System Guard Secure Launch Running. + type: boolean + - name: ueficodereadonly + type: group + fields: + - name: available + description: Event Device Guard UEFI Code Readonly Availability. + type: boolean + - name: usermodecodeintegrity + type: group + fields: + - name: policyenforcement + description: Event Device Guard User Mode Code Integrity Policy Enforcement. + type: keyword + - name: version + description: Event Device Guard version. + type: keyword + - name: virtualizationbasedsecurity + type: group + fields: + - name: status + description: Event Device Guard Virtualization Based Security Status. + type: keyword + - name: ufi type: group fields: - - name: enabled - type: boolean - - name: running - type: boolean - - name: dmaprotection - type: group - fields: - - name: available - type: boolean - - name: hypervisorenforcedcodeint - type: group - fields: - - name: enabled - type: boolean - - name: running - type: boolean - - name: secureboot + - name: enabled + description: Event UFI Enabled. + type: boolean +- name: host + type: group + fields: + - name: cpu type: group fields: - - name: available - type: boolean - - name: securememoverwrite + - name: caption + type: text + description: Description of the CPU + - name: count + type: integer + description: Total Number of CPUs on the system + - name: memory type: group fields: - - name: available - type: boolean - - name: smmsecuritymigrations + - name: size + type: long + description: Total RAM Size + - name: motherboard type: group fields: - - name: available - type: boolean - - name: systemguardsecurelaunch + - name: chipset + type: keyword + description: Chipset of the Motherboard + - name: serial_number + type: keyword + description: Serial Number of the Motherboard + - name: os type: group fields: - - name: enabled - type: boolean - - name: running - type: boolean - - name: ueficodereadonly + - name: edition + type: keyword + description: The Edition of the Opearting System + - name: vendor + type: keyword + description: The vendor of the Operating System + - name: security type: group fields: - - name: available - type: boolean - - name: usermodecodeintegrity + - name: antivirus + type: group + fields: + - name: exists + type: boolean + description: Does the OS state that an AV program is installed + - name: name + type: keyword + description: Product name the Operating System states is the AV program installed + - name: state + type: keyword + description: The Operating System state of the AV product + - name: status + type: keyword + description: The Operating System current status of the AV product it says is installed. + - name: tpm type: group fields: - - name: policyenforcement - type: keyword - - name: version + - name: compliant + type: boolean + description: Is the endpoint compliant with TPM security settings + - name: digest + type: group + fields: + - name: id + type: keyword + description: What digest is being used by TPM + - name: present + type: boolean + description: Is TPM module present on the operating system + - name: version + type: keyword + description: What version of TPM is being used + - name: virtualization_status type: keyword - - name: virtualizationbasedsecurity - type: group - fields: - - name: status - type: keyword - - name: ufi - type: group - fields: - - name: enabled - type: boolean -- name: host +- name: tychon type: group fields: - - name: cpu - type: group - fields: - - name: caption - type: keyword - description: Description of the CPU - - name: count - type: integer - description: Total Number of CPUs on the system - - name: memory - type: group - fields: - - name: size - type: long - description: Total RAM Size - - name: motherboard - type: group - fields: - - name: chipset - type: keyword - description: Chipset of the Motherboard - - name: serial_number - type: keyword - description: Serial Number of the Motherboard - - name: os - type: group - fields: - - name: edition - type: keyword - description: The Edition of the Opearting System - - name: vendor - type: keyword - description: The vendor of the Operating System - - name: security - type: group - fields: - - name: antivirus + - name: definition type: group fields: - - name: exists - type: boolean - description: Does the OS state that an AV program is installed - - name: name - type: keyword - description: Product name the Operating System states is the AV program installed - - name: state - type: keyword - description: The Operating System state of the AV product - - name: status - type: keyword - description: The Operating System current status of the AV product it says is installed. - - name: tpm - type: group - fields: - - name: compliant - type: boolean - description: Is the endpoint compliant with TPM security settings - - name: digest + - name: oval + type: date + description: What version of the TYCHON oval defitnions are currently on this endpoint + - name: stig + type: date + description: What version of the Benchmark checks are on this endpoint + - name: version type: group fields: - - name: id - type: keyword - description: What digest is being used by TPM - - name: present - type: boolean - description: Is TPM module present on the operating system - - name: version - type: keyword - description: What version of TPM is being used - - name: host.virtualization_status - type: keyword -- name: tychon - type: group - fields: - - name: definition - type: group - fields: - - name: oval - type: date - description: What version of the TYCHON oval defitnions are currently on this endpoint - - name: stig - type: date - description: What version of the Benchmark checks are on this endpoint - - name: version - type: group - fields: - - name: agent - type: version - description: The TYCHON Agent Version installed on the endpoint - - name: content - type: version - description: The TYCHON Agentless Version installed on the endpoint \ No newline at end of file + - name: agent + type: version + description: The TYCHON Agent Version installed on the endpoint + - name: content + type: version + description: The TYCHON Agentless Version installed on the endpoint diff --git a/packages/tychon/data_stream/tychon_host/manifest.yml b/packages/tychon/data_stream/tychon_host/manifest.yml index fcc9e0e7793..338763ad7f9 100644 --- a/packages/tychon/data_stream/tychon_host/manifest.yml +++ b/packages/tychon/data_stream/tychon_host/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json index f9c2e27ad47..0d6f1310a3c 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json +++ b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json @@ -1,67 +1,76 @@ { "events": [ { - "host.adapter.dhcp.enabled": "true", - "host.adapter.ndis.version": "6.30", - "host.adapter.driver.file_name": "ftvnic.sys", - "host.adapter.driver.date": "2020-04-09", - "host.os.name": "Microsoft Windows 11 Pro", - "script.current_time": "2023-08-13T01:00:03Z", - "script.type": "powershell", - "host.adapter.virtual": "true", - "host.ip": "10.154.5.200,fe80::c2c9:f4e0:eb65:2c33,192.168.56.1,fe80::5bed:2433:ff9d:efdb,172.16.0.1,fe80::e9d4:5969:ce85:2c87", - "host.hostname": "DESKTOP-AF7CIQM", - "host.adapter.ip": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.adapter.driver.version": "2020.4.9.0", - "script.start": "2023-08-13T01:00:02Z", - "host.adapter.subnet_bit": "", - "host.adapter.driver.name": "Driver Date 2020-04-09 Version 2020.4.9.0 NDIS 6.30", - "host.adapter.mtu": "1500", - "host.os.organization": "", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "host.adapter.domain": "", - "host.adapter.vlan.id": "", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "host.adapter.subnet_bit": "24", "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "HYLCKG3", - "host.ipv4": "10.154.5.200,192.168.56.1,172.16.0.1", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", + "host.adapter.domain": "", + "host.adapter.virtual": "false", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.adapter.wifi.authentication": "", "host.type": "Workstation", - "host.adapter.media.connection_state": "Disconnected", - "host.adapter.ip_filter.enabled": "", - "host.adapter.dhcp.server": "", - "host.adapter.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.hardware.owner": "justin.skidmore@tychon.io", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", + "host.oem.model": "", + "host.adapter.wifi.signal_percent": "", + "script.current_duration": "14530.74", "host.adapter.dhcp.lease_obtained": "", - "host.adapter.driver.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.link_speed": "100 Mbps", - "host.adapter.is_win_server": "", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.adapter.driver.provider": "Fortinet", + "host.oem.manufacturer": "", + "host.uptime": "618589.769059", + "host.os.name": "Microsoft Windows 10 Pro", + "host.hardware.bios.name": "Phoenix Technologies LTD", + "host.adapter.ndis.version": "6.50", + "host.adapter.ip": "10.1.9.51", + "host.os.family": "Windows", + "host.adapter.driver.version": "12.17.10.8", + "host.adapter.wifi.cipher": "", + "host.adapter.link_speed": "1 Gbps", + "host.hostname": "BOTANYBAYEP1", + "id": "201f62ea31d32bc635feeda477e602ff4b304bb6", + "host.adapter.wifi.ssid": "", + "host.cloud.hosted": "false", + "host.hardware.owner": "admin", + "script.version": "2.3.141.0", + "host.mac": "00:0C:29:93:6A:F3", + "host.adapter.wifi.channel": "", + "host.adapter.driver.name": "Driver Date 2018-06-12 Version 12.17.10.8 NDIS 6.50", + "host.ipv6": "", + "host.os.version": "2009", + "script.type": "powershell", + "host.domain": "", + "host.os.organization": "", + "host.adapter.driver.file_name": "e1i65x64.sys", + "host.adapter.driver.description": "Intel(R) 82574L Gigabit Network Connection", + "host.adapter.gateway": "10.1.9.1", + "host.adapter.dhcp.enabled": "false", + "host.adapter.wifi.band": "", + "script.current_time": "2023-09-25T20:04:01Z", + "host.hardware.manufacturer": "VMware, Inc.", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", + "host.hardware.bios.version": "6.00", + "host.os.build": "19045", + "host.adapter.mtu": "1500", + "host.adapter.vlan.id": "", + "host.adapter.wins_server": "", + "host.adapter.driver.provider": "Microsoft", + "host.ipv4": "10.1.9.51", "host.adapter.wifi.enabled": "false", - "host.os.build": "22621", - "host.adapter.mac": "00-09-0F-FE-00-01", - "script.name": "Get-TychonNetworkAdapterInfo.ps1", "host.adapter.dhcp.lease_expires": "", - "script.version": "2.3.36.0", - "host.adapter.gateway": "", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "host.domain": "", - "script.current_duration": "1150.99", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33,fe80::5bed:2433:ff9d:efdb,fe80::e9d4:5969:ce85:2c87", - "host.adapter.alias": "Ethernet 2", - "host.hardware.bios.version": "1.20.1", - "host.adapter.subnet": "", + "host.adapter.ip_filter.enabled": "false", + "host.adapter.wifi.radio_type": "", + "host.adapter.description": "Intel(R) 82574L Gigabit Network Connection", + "script.start": "2023-09-25T20:03:46Z", + "host.adapter.driver.date": "2018-06-12", + "host.ip": "10.1.9.51", + "host.adapter.alias": "Ethernet0", + "host.adapter.mac": "00-0C-29-93-6A-F3", "host.adapter.media.type": "802.3", - "host.mac": "60:E3:2B:4B:40:E2,0A:00:27:00:00:08,0A:00:27:00:00:0D", - "host.os.family": "Windows" + "host.adapter.id": "{8CF7047B-04F9-48B6-8928-0593504DBA4D}", + "script.name": "Get-TychonNetworkAdapterInfo.ps1", + "host.adapter.dhcp.server": "", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.adapter.media.connection_state": "Connected", + "host.os.description": "", + "host.adapter.wifi.bssid": "", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json-expected.json b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json-expected.json index c99a8e1d1b4..706baa91834 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json-expected.json +++ b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapter.json-expected.json @@ -1,67 +1,129 @@ { "expected": [ { - "host.adapter.dhcp.enabled": "true", - "host.adapter.ndis.version": "6.30", - "host.adapter.driver.file_name": "ftvnic.sys", - "host.adapter.driver.date": "2020-04-09", - "host.os.name": "Microsoft Windows 11 Pro", - "script.current_time": "2023-08-13T01:00:03Z", - "script.type": "powershell", - "host.adapter.virtual": "true", - "host.ip": "10.154.5.200,fe80::c2c9:f4e0:eb65:2c33,192.168.56.1,fe80::5bed:2433:ff9d:efdb,172.16.0.1,fe80::e9d4:5969:ce85:2c87", - "host.hostname": "DESKTOP-AF7CIQM", - "host.adapter.ip": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.adapter.driver.version": "2020.4.9.0", - "script.start": "2023-08-13T01:00:02Z", - "host.adapter.subnet_bit": "", - "host.adapter.driver.name": "Driver Date 2020-04-09 Version 2020.4.9.0 NDIS 6.30", - "host.adapter.mtu": "1500", - "host.os.organization": "", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "host.adapter.domain": "", - "host.adapter.vlan.id": "", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "HYLCKG3", - "host.ipv4": "10.154.5.200,192.168.56.1,172.16.0.1", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "host.adapter.media.connection_state": "Disconnected", - "host.adapter.ip_filter.enabled": "", - "host.adapter.dhcp.server": "", - "host.adapter.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.hardware.owner": "justin.skidmore@tychon.io", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.adapter.dhcp.lease_obtained": "", - "host.adapter.driver.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.link_speed": "100 Mbps", - "host.adapter.is_win_server": "", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.adapter.driver.provider": "Fortinet", - "host.adapter.wifi.enabled": "false", - "host.os.build": "22621", - "host.adapter.mac": "00-09-0F-FE-00-01", - "script.name": "Get-TychonNetworkAdapterInfo.ps1", - "host.adapter.dhcp.lease_expires": "", - "script.version": "2.3.36.0", - "host.adapter.gateway": "", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "host.domain": "", - "script.current_duration": "1150.99", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33,fe80::5bed:2433:ff9d:efdb,fe80::e9d4:5969:ce85:2c87", - "host.adapter.alias": "Ethernet 2", - "host.hardware.bios.version": "1.20.1", - "host.adapter.subnet": "", - "host.adapter.media.type": "802.3", - "host.mac": "60:E3:2B:4B:40:E2,0A:00:27:00:00:08,0A:00:27:00:00:0D", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:25.005723813Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "configuration" + ], + "ingested": "2023-09-25T21:55:25.005723813Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "adapter": { + "alias": "Ethernet0", + "description": "Intel(R) 82574L Gigabit Network Connection", + "dhcp": { + "enabled": "false" + }, + "domain": "", + "driver": { + "date": "2018-06-12", + "description": "Intel(R) 82574L Gigabit Network Connection", + "file_name": "e1i65x64.sys", + "name": "Driver Date 2018-06-12 Version 12.17.10.8 NDIS 6.50", + "provider": "Microsoft", + "version": "12.17.10.8" + }, + "gateway": "10.1.9.1", + "id": "{8CF7047B-04F9-48B6-8928-0593504DBA4D}", + "ip": "10.1.9.51", + "ip_filter": { + "enabled": "false" + }, + "link_speed": 1, + "mac": "00-0C-29-93-6A-F3", + "media": { + "connection_state": "Connected", + "type": "802.3" + }, + "mtu": "1500", + "ndis": { + "version": "6.50" + }, + "subnet_bit": "24", + "virtual": "false", + "vlan": { + "id": "" + }, + "wifi": { + "authentication": "", + "band": "", + "bssid": "", + "channel": "", + "cipher": "", + "enabled": "false", + "radio_type": "", + "signal_percent": "", + "ssid": "" + }, + "wins_server": "" + }, + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 618589, + "workgroup": "WORKGROUP" + }, + "host.adapter.link_speed": 1073741824, + "id": "201f62ea31d32bc635feeda477e602ff4b304bb6", + "script": { + "current_duration": 14530.74, + "current_time": "2023-09-25T20:04:01Z", + "name": "Get-TychonNetworkAdapterInfo.ps1", + "start": "2023-09-25T20:03:46Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json deleted file mode 100644 index f9c2e27ad47..00000000000 --- a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "events": [ - { - "host.adapter.dhcp.enabled": "true", - "host.adapter.ndis.version": "6.30", - "host.adapter.driver.file_name": "ftvnic.sys", - "host.adapter.driver.date": "2020-04-09", - "host.os.name": "Microsoft Windows 11 Pro", - "script.current_time": "2023-08-13T01:00:03Z", - "script.type": "powershell", - "host.adapter.virtual": "true", - "host.ip": "10.154.5.200,fe80::c2c9:f4e0:eb65:2c33,192.168.56.1,fe80::5bed:2433:ff9d:efdb,172.16.0.1,fe80::e9d4:5969:ce85:2c87", - "host.hostname": "DESKTOP-AF7CIQM", - "host.adapter.ip": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.adapter.driver.version": "2020.4.9.0", - "script.start": "2023-08-13T01:00:02Z", - "host.adapter.subnet_bit": "", - "host.adapter.driver.name": "Driver Date 2020-04-09 Version 2020.4.9.0 NDIS 6.30", - "host.adapter.mtu": "1500", - "host.os.organization": "", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "host.adapter.domain": "", - "host.adapter.vlan.id": "", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "HYLCKG3", - "host.ipv4": "10.154.5.200,192.168.56.1,172.16.0.1", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "host.adapter.media.connection_state": "Disconnected", - "host.adapter.ip_filter.enabled": "", - "host.adapter.dhcp.server": "", - "host.adapter.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.hardware.owner": "justin.skidmore@tychon.io", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.adapter.dhcp.lease_obtained": "", - "host.adapter.driver.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.link_speed": "100 Mbps", - "host.adapter.is_win_server": "", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.adapter.driver.provider": "Fortinet", - "host.adapter.wifi.enabled": "false", - "host.os.build": "22621", - "host.adapter.mac": "00-09-0F-FE-00-01", - "script.name": "Get-TychonNetworkAdapterInfo.ps1", - "host.adapter.dhcp.lease_expires": "", - "script.version": "2.3.36.0", - "host.adapter.gateway": "", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "host.domain": "", - "script.current_duration": "1150.99", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33,fe80::5bed:2433:ff9d:efdb,fe80::e9d4:5969:ce85:2c87", - "host.adapter.alias": "Ethernet 2", - "host.hardware.bios.version": "1.20.1", - "host.adapter.subnet": "", - "host.adapter.media.type": "802.3", - "host.mac": "60:E3:2B:4B:40:E2,0A:00:27:00:00:08,0A:00:27:00:00:0D", - "host.os.family": "Windows" - } - ] -} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json-expected.json b/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json-expected.json deleted file mode 100644 index c99a8e1d1b4..00000000000 --- a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json-expected.json +++ /dev/null @@ -1,67 +0,0 @@ -{ - "expected": [ - { - "host.adapter.dhcp.enabled": "true", - "host.adapter.ndis.version": "6.30", - "host.adapter.driver.file_name": "ftvnic.sys", - "host.adapter.driver.date": "2020-04-09", - "host.os.name": "Microsoft Windows 11 Pro", - "script.current_time": "2023-08-13T01:00:03Z", - "script.type": "powershell", - "host.adapter.virtual": "true", - "host.ip": "10.154.5.200,fe80::c2c9:f4e0:eb65:2c33,192.168.56.1,fe80::5bed:2433:ff9d:efdb,172.16.0.1,fe80::e9d4:5969:ce85:2c87", - "host.hostname": "DESKTOP-AF7CIQM", - "host.adapter.ip": "", - "host.hardware.manufacturer": "Dell Inc.", - "host.adapter.driver.version": "2020.4.9.0", - "script.start": "2023-08-13T01:00:02Z", - "host.adapter.subnet_bit": "", - "host.adapter.driver.name": "Driver Date 2020-04-09 Version 2020.4.9.0 NDIS 6.30", - "host.adapter.mtu": "1500", - "host.os.organization": "", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "host.adapter.domain": "", - "host.adapter.vlan.id": "", - "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "HYLCKG3", - "host.ipv4": "10.154.5.200,192.168.56.1,172.16.0.1", - "host.os.version": "2009", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "host.adapter.media.connection_state": "Disconnected", - "host.adapter.ip_filter.enabled": "", - "host.adapter.dhcp.server": "", - "host.adapter.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.hardware.owner": "justin.skidmore@tychon.io", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.adapter.dhcp.lease_obtained": "", - "host.adapter.driver.description": "Fortinet Virtual Ethernet Adapter (NDIS 6.30)", - "host.adapter.link_speed": "100 Mbps", - "host.adapter.is_win_server": "", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "{F94CD5A5-14EB-4315-91FC-370093413BD2}", - "host.adapter.driver.provider": "Fortinet", - "host.adapter.wifi.enabled": "false", - "host.os.build": "22621", - "host.adapter.mac": "00-09-0F-FE-00-01", - "script.name": "Get-TychonNetworkAdapterInfo.ps1", - "host.adapter.dhcp.lease_expires": "", - "script.version": "2.3.36.0", - "host.adapter.gateway": "", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "host.domain": "", - "script.current_duration": "1150.99", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33,fe80::5bed:2433:ff9d:efdb,fe80::e9d4:5969:ce85:2c87", - "host.adapter.alias": "Ethernet 2", - "host.hardware.bios.version": "1.20.1", - "host.adapter.subnet": "", - "host.adapter.media.type": "802.3", - "host.mac": "60:E3:2B:4B:40:E2,0A:00:27:00:00:08,0A:00:27:00:00:0D", - "host.os.family": "Windows" - } - ] -} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_networkadapter/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_networkadapter/elasticsearch/ingest_pipeline/default.yml index fef46ef0062..88e928c63c3 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_networkadapter/elasticsearch/ingest_pipeline/default.yml @@ -15,16 +15,49 @@ processors: - set: field: event.kind value: state + - set: + field: link_speed + value: "{{host.adapter.link_speed}}" + - set: + field: host.adapter.link_speed + value: 1 + - script: + source: | + if(ctx['link_speed'].contains(' ')){ + String[] link_Speed=ctx['link_speed'].splitOnToken(' '); + ctx.remove('link_speed'); + ctx['host.adapter.link_speed']=Long.parseLong(link_Speed[0]); + if(link_Speed[1]=='Kbps'){ + ctx['host.adapter.link_speed']*=1024 + } + if(link_Speed[1]=='Mbps'){ + ctx['host.adapter.link_speed']*=1048576 + } + if(link_Speed[1]=='Gbps'){ + ctx['host.adapter.link_speed']*=1073741824 + } + } + ignore_failure: true + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.module - value: tychon - - set: - field: event.category - value: network adapter + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -38,9 +71,25 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.module + value: tychon + - set: + field: event.category + value: [configuration] + - set: + field: event.type + value: [info] - remove: field: host.adapter.ip if: ctx.host.adapter.ip == '' + - remove: + field: host.adapter.wins_server + if: ctx.host.adapter.wins_server == '' - remove: field: host.adapter.gateway if: ctx.host.adapter.gateway == '' @@ -56,10 +105,6 @@ processors: - remove: field: host.adapter.driver.date if: ctx.host.adapter.driver.date == '' - - gsub: - field: host.adapter.link_speed - pattern: "[^0-9]" - replacement: "" - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_networkadapter/fields/agent.yml b/packages/tychon/data_stream/tychon_networkadapter/fields/agent.yml index f2a0c59b335..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_networkadapter/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword @@ -107,4 +107,4 @@ type: keyword - name: serial_number description: Host BIOS Serial Number. - type: keyword \ No newline at end of file + type: keyword diff --git a/packages/tychon/data_stream/tychon_networkadapter/fields/base-fields.yml b/packages/tychon/data_stream/tychon_networkadapter/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_networkadapter/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_networkadapter/fields/fields.yml b/packages/tychon/data_stream/tychon_networkadapter/fields/fields.yml index dcc5cc72bc3..d12f09a5243 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_networkadapter/fields/fields.yml @@ -1,135 +1,135 @@ - name: host type: group fields: - - name: adapter - type: group - fields: - - name: alias - type: keyword - description: The Alias given to this adapter - - name: description - type: text - description: The network adatper description - - name: dhcp + - name: adapter type: group fields: - - name: enabled - type: boolean - description: Is DHCP Enabled on this adatper - - name: lease_expires - type: date - description: When does this DHCP lease expire - - name: lease_obtained - type: date - description: When was the DHCP lease obtained - - name: server - type: ip - description: What IP Address was the DHCP IP obtained from. - - name: domain - type: keyword - description: What domain was assigned to this adatper - - name: driver - type: group - fields: - - name: date - type: date - description: Date the driver was installed - - name: description - type: text - description: Description of the driver - - name: file_name - type: keyword - description: Driver File name - - name: name - type: keyword - description: Name of the driver - - name: provider - type: keyword - description: Company that provided the driver - - name: version - type: keyword - description: Version of the driver - - name: gateway - type: ip - description: Gateway IP Address - - name: id - type: keyword - description: ID Of the adapter - - name: ip - type: ip - description: IP Addresses assigned to the adatper - - name: ip_filter - type: group - fields: - - name: enabled - type: boolean - description: Is IP Filtering Enabled - - name: wins_server - type: keyword - description: The WINS Server attached to this adatper - - name: link_speed - type: long - description: Link speed of the adatper - - name: mac - type: keyword - description: Hardware MAC Address - - name: media - type: group - fields: - - name: connection_state - type: keyword - description: Current Connection State - - name: type - type: keyword - description: Current Connection Media Type - - name: mtu - type: integer - description: MTU Size - - name: ndis - type: group - fields: - - name: version - type: keyword - description: NDIS Version - - name: subnet_bit - type: integer - description: Subnet BIT - - name: virtual - type: boolean - description: Is adapter virutal - - name: vlan - type: group - fields: - - name: id - type: keyword - description: The VLAN ID - - name: wifi - type: group - fields: - - name: enabled - type: boolean - description: Is WIFI Enabled - - name: signal_percent - type: integer - description: Signal strenth to connected WIFI Router - - name: ssid - type: keyword - description: The Connected WIFI Router SSID - - name: bssid - type: keyword - description: The Connected WIFI Router Hardware Address - - name: radio_type - type: keyword - description: The radio type of the connected WIFI Router - - name: authentication - type: keyword - description: The Authentication method used to connected to the WIFI Router - - name: cipher - type: keyword - description: The CIPHER used to connected to the WIFI Router - - name: band - type: keyword - description: The band used to connected to the WIFI Router - - name: channel - type: keyword - description: The channel used to connected to the WIFI Router \ No newline at end of file + - name: alias + type: keyword + description: The Alias given to this adapter + - name: description + type: text + description: The network adatper description + - name: dhcp + type: group + fields: + - name: enabled + type: boolean + description: Is DHCP Enabled on this adatper + - name: lease_expires + type: date + description: When does this DHCP lease expire + - name: lease_obtained + type: date + description: When was the DHCP lease obtained + - name: server + type: ip + description: What IP Address was the DHCP IP obtained from. + - name: domain + type: text + description: What domain was assigned to this adatper + - name: driver + type: group + fields: + - name: date + type: date + description: Date the driver was installed + - name: description + type: text + description: Description of the driver + - name: file_name + type: keyword + description: Driver File name + - name: name + type: keyword + description: Name of the driver + - name: provider + type: keyword + description: Company that provided the driver + - name: version + type: keyword + description: Version of the driver + - name: gateway + type: ip + description: Gateway IP Address + - name: id + type: keyword + description: ID Of the adapter + - name: ip + type: ip + description: IP Addresses assigned to the adatper + - name: ip_filter + type: group + fields: + - name: enabled + type: boolean + description: Is IP Filtering Enabled + - name: wins_server + type: ip + description: The WINS Server attached to this adatper + - name: link_speed + type: long + description: Link speed of the adatper + - name: mac + type: keyword + description: Hardware MAC Address + - name: media + type: group + fields: + - name: connection_state + type: keyword + description: Current Connection State + - name: type + type: keyword + description: Current Connection Media Type + - name: mtu + type: integer + description: MTU Size + - name: ndis + type: group + fields: + - name: version + type: keyword + description: NDIS Version + - name: subnet_bit + type: integer + description: Subnet BIT + - name: virtual + type: boolean + description: Is adapter virutal + - name: vlan + type: group + fields: + - name: id + type: keyword + description: The VLAN ID + - name: wifi + type: group + fields: + - name: enabled + type: boolean + description: Is WIFI Enabled + - name: signal_percent + type: integer + description: Signal strenth to connected WIFI Router + - name: ssid + type: keyword + description: The Connected WIFI Router SSID + - name: bssid + type: keyword + description: The Connected WIFI Router Hardware Address + - name: radio_type + type: keyword + description: The radio type of the connected WIFI Router + - name: authentication + type: keyword + description: The Authentication method used to connected to the WIFI Router + - name: cipher + type: keyword + description: The CIPHER used to connected to the WIFI Router + - name: band + type: keyword + description: The band used to connected to the WIFI Router + - name: channel + type: keyword + description: The channel used to connected to the WIFI Router diff --git a/packages/tychon/data_stream/tychon_networkadapter/manifest.yml b/packages/tychon/data_stream/tychon_networkadapter/manifest.yml index f4a01ab6495..29608b8b892 100644 --- a/packages/tychon/data_stream/tychon_networkadapter/manifest.yml +++ b/packages/tychon/data_stream/tychon_networkadapter/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json b/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json new file mode 100644 index 00000000000..6c7ca5a56ab --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json @@ -0,0 +1,52 @@ +{ + "events": [ + { + "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", + "host.domain": "", + "host.hardware.bios.name": "Phoenix Technologies LTD", + "host.hardware.bios.version": "6.00", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", + "host.hardware.manufacturer": "VMware, Inc.", + "host.hardware.owner": "dcuser", + "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", + "host.hostname": "DESKTOP-TIUKL1R", + "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", + "host.ip": "10.1.9.112", + "host.ipv4": "10.1.9.112", + "host.ipv6": "fe80::40d1:5287:42b9:5645", + "host.mac": "00:0C:29:EF:9A:EB", + "host.oem.manufacturer": "", + "host.oem.model": "", + "host.os.build": "22000", + "host.os.description": "", + "host.os.family": "Windows", + "host.os.name": "Microsoft Windows 11 Education N", + "host.os.organization": "", + "host.os.version": "10.0.22000", + "host.type": "Workstation", + "host.uptime": "145287", + "host.workgroup": "WORKGROUP", + "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_CVE-2013-3900", + "script.current_duration": "315381.28", + "script.current_time": "2023-06-15T21:58:02Z", + "script.name": "Invoke-CveScan.ps1", + "script.start": "2023-06-15T21:52:47Z", + "script.type": "powershell", + "script.version": "0.1.0", + "vulnerability.due_date": "", + "vulnerability.classification": "vulnerability", + "vulnerability.iava": "2013-A-0227", + "vulnerability.iava_severity": "CAT II", + "vulnerability.id": "CVE-2013-3900", + "vulnerability.reference": "https://www.scaprepo.com/view.jsp?id=CVE-2013-3900", + "vulnerability.result": "fail", + "vulnerability.scanner.vendor": "TYCHON", + "vulnerability.score.base": "7.60", + "vulnerability.score.version": "2.0", + "vulnerability.severity": "HIGH", + "vulnerability.title": "The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does ", + "vulnerability.version": "1", + "vulnerability.year": "2013" + } + ] +} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json-config.yml b/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json-config.yml similarity index 100% rename from packages/tychon/data_stream/tychon_networkadapter/_dev/test/pipeline/test-networkadapters.json-config.yml rename to packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json-config.yml diff --git a/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json-expected.json b/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json-expected.json new file mode 100644 index 00000000000..4e291b54af3 --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/_dev/test/pipeline/test-patch.json-expected.json @@ -0,0 +1,94 @@ +{ + "expected": [ + { + "@timestamp": "2023-09-25T21:55:25.184645812Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "vulnerability" + ], + "ingested": "2023-09-25T21:55:25.184645812Z", + "kind": "state", + "module": "tychon", + "outcome": "failure", + "type": [ + "info" + ] + }, + "host": { + "biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "dcuser", + "serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb" + }, + "hostname": "DESKTOP-TIUKL1R", + "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", + "ip": "10.1.9.112", + "ipv4": [ + "10.1.9.112" + ], + "ipv6": "fe80::40d1:5287:42b9:5645", + "mac": "00-0C-29-EF-9A-EB", + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "22000", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 11 Education N", + "organization": "", + "version": "10.0.22000" + }, + "type": "Workstation", + "uptime": 145287, + "workgroup": "WORKGROUP" + }, + "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_CVE-2013-3900", + "script": { + "current_duration": 315381.28, + "current_time": "2023-06-15T21:58:02Z", + "name": "Invoke-CveScan.ps1", + "start": "2023-06-15T21:52:47Z", + "type": "powershell", + "version": "0.1.0" + }, + "vulnerability": { + "category": [ + "oval" + ], + "classification": "cvss", + "due_date": "1970-01-01T00:00:01.000Z", + "enumeration": "CVE", + "iava": "2013-A-0227", + "iava_severity": "CAT II", + "id": "CVE-2013-3900", + "reference": "https://www.scaprepo.com/view.jsp?id=CVE-2013-3900", + "result": "fail", + "scanner": { + "vendor": "tychon" + }, + "score": { + "base": 7.6, + "version": "2.0" + }, + "severity": "HIGH", + "title": "The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does ", + "version": "1", + "year": 2013 + } + } + ] +} \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_patch/agent/stream/stream.yml.hbs b/packages/tychon/data_stream/tychon_patch/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..8b177f1461f --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/agent/stream/stream.yml.hbs @@ -0,0 +1,23 @@ +paths: +{{#each paths as |path|}} + - {{path}} +{{/each}} +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- add_locale: ~ +{{#if processors}} +{{processors}} +{{/if}} +json: + keys_under_root: true + expand_keys: true + \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_patch/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_patch/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..3d6d422c24b --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,107 @@ +--- +description: CVE Pipeline for parsing TYCHON Vulnerability Scan Results +processors: + - dot_expander: + field: "*" + - set: + field: "@timestamp" + value: "{{_ingest.timestamp}}" + - set: + field: event.ingested + value: "{{_ingest.timestamp}}" + - set: + field: vulnerability.due_date + value: "1970-01-01T00:00:01Z" + if: ctx.vulnerability.due_date == '' + - date: + field: vulnerability.due_date + target_field: vulnerability.due_date + output_format: yyyy-MM-dd'T'HH:mm:ss.SSSXXX + ignore_failure: true + formats: + - strict_date_optional_time + - epoch_millis + - date + - "MM/dd/yyyy" + - set: + field: ecs.version + value: 8.8.0 + - set: + field: event.kind + value: state + - set: + field: event.module + value: tychon + - split: + field: host.ipv4 + separator: "," + ignore_missing: true + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true + - split: + field: host.uptime + separator: "\\.+" + target_field: tempuptime + ignore_failure: true + - set: + field: host.uptime + value: "{{tempuptime.0}}" + ignore_failure: true + - remove: + field: tempuptime + ignore_failure: true + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.category + value: [vulnerability] + - set: + field: event.type + value: [info] + - script: + source: | + if(ctx.vulnerability?.result == 'fail'){ + ctx.event.outcome = "failure" + }else if(ctx.vulnerability?.result == 'pass'){ + ctx.event.outcome = "success" + }else{ + ctx.event.outcome = "unknown" + } + - convert: + field: script.current_duration + type: float + ignore_missing: true + - convert: + field: vulnerability.score.base + type: float + - convert: + field: vulnerability.year + type: long + - set: + field: vulnerability.scanner.vendor + value: tychon + - set: + field: vulnerability.category + value: [oval] + - set: + field: vulnerability.classification + value: cvss + - set: + field: vulnerability.enumeration + value: CVE +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: '{{{ _ingest.on_failure_message }}}' \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_patch/fields/agent.yml b/packages/tychon/data_stream/tychon_patch/fields/agent.yml new file mode 100644 index 00000000000..efacb477dd9 --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/fields/agent.yml @@ -0,0 +1,110 @@ +- name: id + description: TYCHON unique document identifier. + type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword +- name: elastic_agent + type: group + fields: + - name: id + description: Elastic Agent Id. + type: keyword + - name: snapshot + description: Elastic Agent snapshot. + type: boolean + - name: version + description: Elastic Agent Version. + type: keyword +- name: script + type: group + fields: + - name: current_duration + description: Scanner Script Duration. + type: long + - name: current_time + description: Current datetime. + type: date + - name: name + description: Scanner Script Name. + type: keyword + - name: start + description: Scanner Start datetime. + type: date + - name: type + description: Scanner Script Type. + type: keyword + - name: version + description: Scanner Script Version. + type: version +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: biossn + description: Host BIOS Serial Number. + type: keyword + - name: ipv4 + description: Host IPv4 addresses. + type: ip + - name: ipv6 + description: Host IPv6 addresses. + type: keyword + - name: workgroup + description: Host Workgroup Network Name. + type: keyword + - name: oem + type: group + fields: + - name: manufacturer + description: Host OEM Manufacturer. + type: keyword + - name: model + description: Host OEM Model. + type: keyword + - name: os + type: group + fields: + - name: build + description: Host OS Build. + type: keyword + - name: description + description: Host OS Description. + type: text + - name: organization + description: Host OS Organization. + type: keyword + - name: hardware + type: group + fields: + - name: bios + type: group + fields: + - name: name + description: Host BIOS Name. + type: keyword + - name: version + description: Host BIOS Version. + type: keyword + - name: cpu + type: group + fields: + - name: caption + description: Host CPU Caption. + type: keyword + - name: manufacturer + description: Host BIOS Manufacturer. + type: keyword + - name: owner + description: Host BIOS Owner. + type: keyword + - name: serial_number + description: Host BIOS Serial Number. + type: keyword diff --git a/packages/tychon/data_stream/tychon_patch/fields/base-fields.yml b/packages/tychon/data_stream/tychon_patch/fields/base-fields.yml new file mode 100644 index 00000000000..58d1699586e --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/fields/base-fields.yml @@ -0,0 +1,12 @@ +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_patch/fields/ecs.yml b/packages/tychon/data_stream/tychon_patch/fields/ecs.yml new file mode 100644 index 00000000000..aa33a7964a6 --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/fields/ecs.yml @@ -0,0 +1,76 @@ +- external: ecs + name: '@timestamp' +- external: ecs + name: agent.ephemeral_id +- external: ecs + name: agent.id +- external: ecs + name: agent.name +- external: ecs + name: agent.type +- external: ecs + name: agent.version +- external: ecs + name: ecs.version +- external: ecs + name: event.agent_id_status +- external: ecs + name: data_stream.dataset +- external: ecs + name: data_stream.namespace +- external: ecs + name: data_stream.type +- external: ecs + name: event.category +- external: ecs + name: event.created +- external: ecs + name: event.dataset +- external: ecs + name: event.id +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.outcome +- external: ecs + name: event.timezone +- external: ecs + name: error.message +- external: ecs + name: host.architecture +- external: ecs + name: host.name +- external: ecs + name: host.uptime +- external: ecs + name: host.os.kernel +- external: ecs + name: host.os.platform +- external: ecs + name: host.os.type +- external: ecs + name: log.file.path +- external: ecs + name: tags +- external: ecs + name: vulnerability.category +- external: ecs + name: vulnerability.classification +- external: ecs + name: vulnerability.description +- external: ecs + name: vulnerability.enumeration +- external: ecs + name: vulnerability.id +- external: ecs + name: vulnerability.reference +- external: ecs + name: vulnerability.scanner.vendor +- external: ecs + name: vulnerability.score.base +- external: ecs + name: vulnerability.score.version +- external: ecs + name: vulnerability.severity diff --git a/packages/tychon/data_stream/tychon_patch/fields/fields.yml b/packages/tychon/data_stream/tychon_patch/fields/fields.yml new file mode 100644 index 00000000000..925eab85d41 --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/fields/fields.yml @@ -0,0 +1,31 @@ +- name: vulnerability + type: group + fields: + - name: definition + description: National Vulnerability Database Vulnerability Definition. + type: keyword + - name: due_date + description: Vulnerability Due Date. + type: date + format: "strict_date_optional_time||epoch_millis||date||\"MM/dd/yyyy\"" + - name: due_date_reason + description: Vulnerability Due Date Reason + type: keyword + - name: iava + description: Information Assurance Vulneraiblity Alert Identifier. + type: keyword + - name: iava_severity + description: Information Assurance Vulnerability Alert Severity. + type: keyword + - name: result + description: Pass/Fail Outcome of the Common Vulnerabilities and Exposures Scan. + type: keyword + - name: title + description: Common Vulnerabilities and Exposures Description and Title. + type: keyword + - name: version + description: Version Number of the Scan. + type: keyword + - name: year + description: Common Vulnerabilities and Exposures Year. + type: integer diff --git a/packages/tychon/data_stream/tychon_patch/manifest.yml b/packages/tychon/data_stream/tychon_patch/manifest.yml new file mode 100644 index 00000000000..06cb2a56c52 --- /dev/null +++ b/packages/tychon/data_stream/tychon_patch/manifest.yml @@ -0,0 +1,32 @@ +title: Patches +type: logs +streams: + - input: logfile + title: Patches + description: TYCHON checks for thousands of installed patches and reports them back to Elasticsearch for reporting, trend analysis and response actions. + template_path: stream.yml.hbs + vars: + - name: paths + type: text + title: Patch Results Location + multi: true + required: true + show_user: true + default: + - /var/log/tychoncloud/eventlogs/tychon_patch_info.json + - name: tags + type: text + title: Tags + multi: true + required: true + show_user: false + default: + - tychon-patch + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json b/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json index 9f27761b525..b17da9fa4a8 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json +++ b/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json @@ -1,53 +1,55 @@ { "events": [ { + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "package.description": "", - "script.current_time": "2023-08-10T15:33:47Z", + "script.current_time": "2023-09-25T04:03:27Z", "package.size": "", "host.os.build": "19045", - "host.ip": "10.1.5.100", - "host.hostname": "C-EP-WIN10-6", + "host.ip": "10.1.9.51", + "host.hostname": "BOTANYBAYEP1", "host.hardware.manufacturer": "VMware, Inc.", - "script.start": "2023-08-10T15:33:47Z", - "@timestamp": "2023-08-10T15:33:47Z", + "script.start": "2023-09-25T04:03:20Z", "host.os.name": "Microsoft Windows 10 Pro", - "package.version_release": "4", + "host.hardware.owner": "admin", "package.architecture": "x86", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", "host.os.organization": "", - "host.hardware.owner": "admin", - "package.version": "5.7.4.399", + "package.version": "5.7.6.251", + "script.type": "powershell", "host.workgroup": "WORKGROUP", - "host.ipv4": "10.1.5.100", + "host.ipv4": "10.1.9.51", "host.os.version": "2009", "package.path": "C:\\Program Files\\McAfee\\Agent\\", "host.hardware.bios.name": "Phoenix Technologies LTD", "package.publisher": "McAfee, LLC.", "host.type": "Workstation", "package.id": "McAfeeAgent", - "package.version_build": "399", - "pacakage.uninstall": "\"C:\\Program Files\\McAfee\\Agent\\x86\\FrmInst.exe\" /uninstall", + "package.version_build": "251", + "package.uninstall": "\"C:\\Program Files\\McAfee\\Agent\\x86\\FrmInst.exe\" /uninstall", "package.name": "McAfee Agent", - "host.id": "13ab12ccdbff465c8182dec95e1ffd37_211A4D56-78B2-F579-5B54-DE2DD6A86DBD_C-EP-WIN10-6_WORKGROUP", - "host.biossn": "211A4D56-78B2-F579-5B54-DE2DD6A86DBD", - "host.mac": "00:0C:29:A8:6D:BD", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": "00:0C:29:93:6A:F3", "package.version_major": "5", "host.oem.model": "", - "host.uptime": "12345", - "script.type": "", - "host.hardware.serial_number": "VMware-56 4d 1a 21 b2 78 79 f5-5b 54 de 2d d6 a8 6d bd", - "script.name": "", - "script.version": "", + "host.uptime": "560963.1794915", + "id": "eade7a9d914c1e82ec2cd77223cd949593f05ce7", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "script.name": "Get-TychonSoftwareInventory.ps1", + "package.version_release": "6", + "script.version": "2.3.141.0", "package.version_minor": "7", "host.oem.manufacturer": "", "host.os.description": "", "package.installed": "", - "script.current_duration": "218.61", - "host.ipv6": "fe80::6e2b:7609:dc72:37cc", + "script.current_duration": "6844.84", + "host.ipv6": "", "package.type": "installer", "host.hardware.bios.version": "6.00", - "package.cpe": "cpe:/a:McAfee Agent:5.7.4.399", + "package.cpe": "cpe:/a:McAfee Agent:5.7.6.251", "host.domain": "", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json-expected.json b/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json-expected.json index 110239b310a..a3ce044132b 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json-expected.json +++ b/packages/tychon/data_stream/tychon_softwareinventory/_dev/test/pipeline/test-softwareinventory.json-expected.json @@ -1,54 +1,97 @@ { "expected": [ { - "package.description": "", - "script.current_time": "2023-08-10T15:33:47Z", - "package.size": "", - "host.os.build": "19045", - "host.ip": "10.1.5.100", - "host.hostname": "C-EP-WIN10-6", - "host.hardware.manufacturer": "VMware, Inc.", - "script.start": "2023-08-10T15:33:47Z", - "@timestamp": "2023-08-10T15:33:47Z", - "host.os.name": "Microsoft Windows 10 Pro", - "package.version_release": "4", - "package.architecture": "x86", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "host.os.organization": "", - "host.hardware.owner": "admin", - "package.version": "5.7.4.399", - "host.workgroup": "WORKGROUP", - "host.ipv4": "10.1.5.100", - "host.os.version": "2009", - "package.path": "C:\\Program Files\\McAfee\\Agent\\", - "host.hardware.bios.name": "Phoenix Technologies LTD", - "package.publisher": "McAfee, LLC.", - "host.type": "Workstation", - "package.id": "McAfeeAgent", - "package.version_build": "399", - "pacakage.uninstall": "\"C:\\Program Files\\McAfee\\Agent\\x86\\FrmInst.exe\" /uninstall", - "package.name": "McAfee Agent", - "host.id": "13ab12ccdbff465c8182dec95e1ffd37_211A4D56-78B2-F579-5B54-DE2DD6A86DBD_C-EP-WIN10-6_WORKGROUP", - "host.biossn": "211A4D56-78B2-F579-5B54-DE2DD6A86DBD", - "host.mac": "00:0C:29:A8:6D:BD", - "package.version_major": "5", - "host.oem.model": "", - "host.uptime": "12345", - "script.type": "", - "host.hardware.serial_number": "VMware-56 4d 1a 21 b2 78 79 f5-5b 54 de 2d d6 a8 6d bd", - "script.name": "", - "script.version": "", - "package.version_minor": "7", - "host.oem.manufacturer": "", - "host.os.description": "", - "package.installed": "", - "script.current_duration": "218.61", - "host.ipv6": "fe80::6e2b:7609:dc72:37cc", - "package.type": "installer", - "host.hardware.bios.version": "6.00", - "package.cpe": "cpe:/a:McAfee Agent:5.7.4.399", - "host.domain": "", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:25.376048106Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "package" + ], + "ingested": "2023-09-25T21:55:25.376048106Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 560963, + "workgroup": "WORKGROUP" + }, + "id": "eade7a9d914c1e82ec2cd77223cd949593f05ce7", + "package": { + "architecture": "x86", + "cpe": "cpe:/a:McAfee Agent:5.7.6.251", + "description": "", + "id": "McAfeeAgent", + "installed": "1970-01-01T00:00:01Z", + "name": "McAfee Agent", + "path": "C:\\Program Files\\McAfee\\Agent\\", + "publisher": "McAfee, LLC.", + "size": 0, + "type": "installer", + "uninstall": "\"C:\\Program Files\\McAfee\\Agent\\x86\\FrmInst.exe\" /uninstall", + "version": "5.7.6.251", + "version_build": "251", + "version_major": "5", + "version_minor": "7", + "version_release": "6" + }, + "script": { + "current_duration": 6844.84, + "current_time": "2023-09-25T04:03:27Z", + "name": "Get-TychonSoftwareInventory.ps1", + "start": "2023-09-25T04:03:20Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_softwareinventory/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_softwareinventory/elasticsearch/ingest_pipeline/default.yml index 690f552d220..c5d2be26924 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_softwareinventory/elasticsearch/ingest_pipeline/default.yml @@ -20,14 +20,52 @@ processors: field: package.installed value: "1970-01-01T00:00:01Z" if: ctx.package.installed == '' + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true + - convert: + field: host.uptime + type: string + ignore_missing: true + - split: + field: host.uptime + separator: "\\.+" + target_field: tempuptime + ignore_failure: true + - set: + field: host.uptime + value: "{{tempuptime.0}}" + ignore_failure: true + - remove: + field: tempuptime + ignore_failure: true + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true - gsub: field: package.size pattern: "[^0-9]" replacement: "" + - set: + field: package.size + value: 0 + ignore_failure: true + if: ctx.package.size == '' - gsub: field: package.version_build pattern: "[^0-9]" @@ -64,24 +102,14 @@ processors: value: tychon - set: field: event.category - value: software inventory + value: [package] + - set: + field: event.type + value: [info] - convert: field: script.current_duration type: float ignore_missing: true - - split: - field: host.uptime - separator: "\\.+" - target_field: tempuptime - ignore_failure: true - - set: - field: host.uptime - value: "{{tempuptime.0}}" - ignore_failure: true - - remove: - field: tempuptime - ignore_failure: true - ignore_missing: true on_failure: - set: field: event.kind diff --git a/packages/tychon/data_stream/tychon_softwareinventory/fields/agent.yml b/packages/tychon/data_stream/tychon_softwareinventory/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_softwareinventory/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_softwareinventory/fields/base-fields.yml b/packages/tychon/data_stream/tychon_softwareinventory/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_softwareinventory/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_softwareinventory/fields/fields.yml b/packages/tychon/data_stream/tychon_softwareinventory/fields/fields.yml index fec6c53f2e3..143a9635854 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_softwareinventory/fields/fields.yml @@ -1,16 +1,27 @@ -- name: package.uninstall - type: text -- name: package.cpe - type: keyword -- name: package.id - type: keyword -- name: package.publisher - type: keyword -- name: package.version_build - type: integer -- name: package.version_major - type: integer -- name: package.version_minor - type: integer -- name: package.version_release - type: integer +- name: package + type: group + fields: + - name: cpe + description: Package Cpe. + type: keyword + - name: id + description: Package Id. + type: keyword + - name: publisher + description: Package Publisher. + type: keyword + - name: uninstall + description: Package Uninstall. + type: text + - name: version_build + description: Package Version Build. + type: integer + - name: version_major + description: Package Version Major. + type: integer + - name: version_minor + description: Package Version Minor. + type: integer + - name: version_release + description: Package Version Release. + type: integer diff --git a/packages/tychon/data_stream/tychon_softwareinventory/manifest.yml b/packages/tychon/data_stream/tychon_softwareinventory/manifest.yml index 3d40f20614f..1dda1c00dff 100644 --- a/packages/tychon/data_stream/tychon_softwareinventory/manifest.yml +++ b/packages/tychon/data_stream/tychon_softwareinventory/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json b/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json index f454580e687..c9e2d879869 100644 --- a/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json +++ b/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json @@ -1,59 +1,62 @@ { "events": [ { - "rule.benchmark.profile.id": "xccdf_mil.disa.stig_profile_Disable_Slow_Rules", - "benchmark.name": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml", + "rule.benchmark.profile.id": "none", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "benchmark.name": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark", "rule.weight": "10.0", - "rule.title": "", - "rule.id": "", + "rule.title": "Adobe Reader DC must enable Enhanced Security in a Standalone Application.", + "rule.id": "xccdf_mil.disa.stig_rule_SV-213168r395811_rule", "rule.oval.refid": "", "script.type": "powershell", - "host.os.build": "22000", - "host.ip": "10.1.9.112", - "rule.name": "xccdf_mil.disa.stig_rule_SV-253254r828846_rule", - "script.version": "0.1.0", - "host.hostname": "DESKTOP-TIUKL1R", + "host.os.build": "19045", + "host.ip": "10.1.9.51", + "rule.name": "Adobe Reader DC must enable Enhanced Security in a Standalone Application.", + "script.version": "2.3.141.0", + "host.hostname": "BOTANYBAYEP1", "host.hardware.manufacturer": "VMware, Inc.", - "benchmark.guid": "", - "script.start": "2023-06-15T20:14:11Z", - "host.os.name": "Microsoft Windows 11 Education N", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_oval:mil.disa.stig.windows11:def:253254_B5876182441699AE4B0B035ED3907DA0898FCA4BDE607D5320342F1862DE0379", + "script.start": "2023-09-25T05:03:17Z", + "host.os.name": "Microsoft Windows 10 Pro", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP_xccdf_mil.disa.stig_rule_SV-213168r395811_rule_858A198F20EB96D46BE795A24F17C19D25CEF91AA919E8D19A13A4E6AA65D667", "rule.test_result": "not applicable", "host.os.organization": "", "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", - "benchmark.hash": "B5876182441699AE4B0B035ED3907DA0898FCA4BDE607D5320342F1862DE0379", - "host.hardware.owner": "dcuser", + "benchmark.hash": "858A198F20EB96D46BE795A24F17C19D25CEF91AA919E8D19A13A4E6AA65D667", + "host.hardware.owner": "admin", "host.workgroup": "WORKGROUP", - "host.hardware.serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb", - "host.ipv4": "10.1.9.112", - "host.os.version": "10.0.22000", + "benchmark.id": "xccdf_mil.disa.stig_benchmark_Adobe_Acrobat_Reader_DC_Continuous_Track_STIG", + "host.ipv4": "10.1.9.51", + "host.os.version": "2009", "host.hardware.bios.name": "Phoenix Technologies LTD", "host.type": "Workstation", - "script.name": "Invoke-TychonStigBenchmarkScan.ps1", - "oval.id": "oval:mil.disa.stig.windows11:def:253254", - "rule.finding_id": "", + "rule.vulnerability_id": "SV-79409", + "oval.id": "oval:mil.disa.stig.adobe.reader:def:10", + "rule.finding_id": "V-213168", + "rule.stig_id": "ARDC-CN-000005", "rule.oval.class": "compliance", - "rule.benchmark.title": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml", - "rule.benchmark.guid": "", - "host.id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", + "rule.benchmark.title": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", "oval.class": "compliance", - "host.biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", - "host.mac": "00:0C:29:EF:9A:EB", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": "00:0C:29:93:6A:F3", "oval.refid": "", "rule.severity": "medium", "host.oem.model": "", - "host.uptime": "139370", - "benchmark.version": "1.2", - "script.current_time": "2023-06-15T20:19:35Z", - "benchmark.title": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml", - "rule.oval.id": "oval:mil.disa.stig.windows11:def:253254", - "benchmark.generated_utc": "2023-03-28T17:40:48", + "host.uptime": "564559.6950263", + "benchmark.version": "002.002", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", + "benchmark.title": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark", + "script.name": "Invoke-TychonStigBenchmarkScan.ps1", + "rule.oval.id": "oval:mil.disa.stig.adobe.reader:def:10", + "benchmark.generated_utc": "1664376309000", "host.oem.manufacturer": "", "host.os.description": "", - "script.current_duration": "324194.34", - "host.ipv6": "fe80::40d1:5287:42b9:5645", + "script.current_duration": "10195.83", + "host.ipv6": "", + "script.current_time": "2023-09-25T05:03:27Z", "host.hardware.bios.version": "6.00", "host.domain": "", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json-expected.json b/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json-expected.json index a41fd0f681b..67fd3531118 100644 --- a/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json-expected.json +++ b/packages/tychon/data_stream/tychon_stig/_dev/test/pipeline/test-stig.json-expected.json @@ -1,28 +1,35 @@ { "expected": [ { - "@timestamp": "2023-07-28T18:14:39.219921509Z", + "@timestamp": "2023-09-25T21:55:25.564944350Z", "benchmark": { - "generated_utc": "2023-03-28T17:40:48", - "guid": "", - "hash": "B5876182441699AE4B0B035ED3907DA0898FCA4BDE607D5320342F1862DE0379", - "name": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml", - "title": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml", - "version": "1.2" + "generated_utc": "1664376309000", + "hash": "858A198F20EB96D46BE795A24F17C19D25CEF91AA919E8D19A13A4E6AA65D667", + "id": "xccdf_mil.disa.stig_benchmark_Adobe_Acrobat_Reader_DC_Continuous_Track_STIG", + "name": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark", + "title": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark", + "version": "002.002" }, "ecs": { "version": "8.8.0" }, "event": { "category": [ - "host" + "vulnerability", + "configuration" ], - "ingested": "2023-07-28T18:14:39.219921509Z", + "ingested": "2023-09-25T21:55:25.564944350Z", "kind": "state", - "module": "tychon" + "module": "tychon", + "type": [ + "info" + ] }, "host": { - "biossn": "1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB", + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, "domain": "", "hardware": { "bios": { @@ -33,65 +40,71 @@ "caption": "Intel64 Family 6 Model 45 Stepping 7" }, "manufacturer": "VMware, Inc.", - "owner": "dcuser", - "serial_number": "VMware-56 4d da 1c 0a cf 55 aa-ff 70 b5 c7 ba ef 9a eb" + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" }, - "hostname": "DESKTOP-TIUKL1R", - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP", - "ip": "10.1.9.112", - "ipv4": "10.1.9.112", - "ipv6": "fe80::40d1:5287:42b9:5645", - "mac": "00-0C-29-EF-9A-EB", + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": "10.1.9.51", + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": "00-0C-29-93-6A-F3", "oem": { "manufacturer": "", "model": "" }, "os": { - "build": "22000", + "build": "19045", "description": "", "family": "Windows", - "name": "Microsoft Windows 11 Education N", + "name": "Microsoft Windows 10 Pro", "organization": "", - "version": "10.0.22000" + "version": "2009" }, "type": "Workstation", - "uptime": 139370, + "uptime": 564559, "workgroup": "WORKGROUP" }, - "id": "bd72307d1093421f95713515c770b79a_1CDA4D56-CF0A-AA55-FF70-B5C7BAEF9AEB_DESKTOP-TIUKL1R_WORKGROUP_oval:mil.disa.stig.windows11:def:253254_B5876182441699AE4B0B035ED3907DA0898FCA4BDE607D5320342F1862DE0379", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP_xccdf_mil.disa.stig_rule_SV-213168r395811_rule_858A198F20EB96D46BE795A24F17C19D25CEF91AA919E8D19A13A4E6AA65D667", "oval": { "class": "compliance", - "id": "oval:mil.disa.stig.windows11:def:253254", + "id": "oval:mil.disa.stig.adobe.reader:def:10", "refid": "" }, "rule": { "benchmark": { - "guid": "", "profile": { - "id": "xccdf_mil.disa.stig_profile_Disable_Slow_Rules" + "id": "none" }, - "title": "scap_mil.disa.stig_cref_U_MS_Windows_11_V1R2_STIG_SCAP_1-2_Benchmark-xccdf.xml" + "title": "Adobe Acrobat Reader DC Continuous Track STIG SCAP Benchmark" }, - "finding_id": "", - "id": "", - "name": "xccdf_mil.disa.stig_rule_SV-253254r828846_rule", + "finding_id": "V-213168", + "id": "xccdf_mil.disa.stig_rule_SV-213168r395811_rule", + "name": "Adobe Reader DC must enable Enhanced Security in a Standalone Application.", "oval": { "class": "compliance", - "id": "oval:mil.disa.stig.windows11:def:253254", + "id": "oval:mil.disa.stig.adobe.reader:def:10", "refid": "" }, "result": "not applicable", "severity": "medium", - "title": "", + "stig_id": "ARDC-CN-000005", + "title": "Adobe Reader DC must enable Enhanced Security in a Standalone Application.", + "vulnerability_id": "SV-79409", "weight": 10.0 }, "script": { - "current_duration": 324194.34, - "current_time": "2023-06-15T20:19:35Z", + "current_duration": 10195.83, + "current_time": "2023-09-25T05:03:27Z", "name": "Invoke-TychonStigBenchmarkScan.ps1", - "start": "2023-06-15T20:14:11Z", + "start": "2023-09-25T05:03:17Z", "type": "powershell", - "version": "0.1.0" + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" } } ] diff --git a/packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml index 814b9a47c3f..03b88ca4302 100644 --- a/packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_stig/elasticsearch/ingest_pipeline/default.yml @@ -23,15 +23,14 @@ processors: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.kind - value: state - - set: - field: event.module - value: tychon - - set: - field: event.category - value: stig + - gsub: + field: host.mac + pattern: ":" + replacement: "-" + - convert: + field: host.uptime + type: string + ignore_missing: true - split: field: host.uptime separator: "\\.+" @@ -45,10 +44,22 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true - - gsub: - field: host.mac - pattern: ":" - replacement: "-" + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.kind + value: state + - set: + field: event.module + value: tychon + - set: + field: event.category + value: [vulnerability, configuration] + - set: + field: event.type + value: [info] - convert: field: script.current_duration type: float diff --git a/packages/tychon/data_stream/tychon_stig/fields/agent.yml b/packages/tychon/data_stream/tychon_stig/fields/agent.yml index 6dd345cff24..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_stig/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_stig/fields/agent.yml @@ -1,82 +1,45 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' +- name: id + description: TYCHON unique document identifier. + type: keyword +- name: tychon type: group fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id + - name: id + description: TYCHON unique host identifier. type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' +- name: elastic_agent type: group fields: - name: id - level: core + description: Elastic Agent Id. type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended + - name: snapshot + description: Elastic Agent snapshot. + type: boolean + - name: version + description: Elastic Agent Version. type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. +- name: script + type: group + fields: + - name: current_duration + description: Scanner Script Duration. + type: long + - name: current_time + description: Current datetime. + type: date - name: name - level: extended + description: Scanner Script Name. + type: keyword + - name: start + description: Scanner Start datetime. + type: date + - name: type + description: Scanner Script Type. type: keyword - ignore_above: 1024 - description: Container name. + - name: version + description: Scanner Script Version. + type: version - name: host title: Host group: 2 @@ -85,51 +48,15 @@ ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' type: group fields: - - name: id - description: Unique host id. As hostname is not always unique, use values that are meaningful in your environment. - type: keyword - name: biossn description: Host BIOS Serial Number. type: keyword - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: ip - level: core - type: ip - description: Host ip addresses. - name: ipv4 - level: core - type: keyword - description: Host ip v4 addresses. + description: Host IPv4 addresses. + type: ip - name: ipv6 - level: core + description: Host IPv6 addresses. type: keyword - description: Host ip v6 addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: type - description: Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. - type: keyword - - name: uptime - description: Seconds the host has been up. - type: long - name: workgroup description: Host Workgroup Network Name. type: keyword @@ -150,19 +77,10 @@ type: keyword - name: description description: Host OS Description. - type: keyword - - name: family - description: OS family (such as redhat, debian, freebsd, windows). - type: keyword - - name: name - description: Operating system name, without the version. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword - - name: version - description: Operating system version as a raw string. - type: keyword - name: hardware type: group fields: diff --git a/packages/tychon/data_stream/tychon_stig/fields/base-fields.yml b/packages/tychon/data_stream/tychon_stig/fields/base-fields.yml index 44a26fd137a..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_stig/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_stig/fields/base-fields.yml @@ -1,21 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: event.module - type: keyword - description: Event module. -- name: '@timestamp' - description: Event timestamp. - type: date +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_stig/fields/ecs.yml b/packages/tychon/data_stream/tychon_stig/fields/ecs.yml index 7329d8fd21c..c89e8e943e1 100644 --- a/packages/tychon/data_stream/tychon_stig/fields/ecs.yml +++ b/packages/tychon/data_stream/tychon_stig/fields/ecs.yml @@ -1,3 +1,5 @@ +- external: ecs + name: '@timestamp' - external: ecs name: package.description - external: ecs @@ -8,8 +10,16 @@ name: package.type - external: ecs name: package.build_version +- external: ecs + name: rule.id - external: ecs name: rule.name +- external: ecs + name: data_stream.dataset +- external: ecs + name: data_stream.namespace +- external: ecs + name: data_stream.type - external: ecs name: event.kind - external: ecs @@ -48,6 +58,8 @@ name: host.architecture - external: ecs name: host.name +- external: ecs + name: host.uptime - external: ecs name: host.os.kernel - external: ecs diff --git a/packages/tychon/data_stream/tychon_stig/fields/fields.yml b/packages/tychon/data_stream/tychon_stig/fields/fields.yml index 864e77b3f8f..9b66266c59e 100644 --- a/packages/tychon/data_stream/tychon_stig/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_stig/fields/fields.yml @@ -1,15 +1,15 @@ -- name: id - description: Tychon Unique Stig Id. - type: keyword - name: benchmark type: group fields: + - name: id + description: Benchmark ID. + type: keyword - name: guid description: Benchmark GUID. type: keyword - name: generated_utc description: Benchmark UTC. - type: keyword + type: date - name: hash description: Benchmark SHA256 Hash type: keyword @@ -43,9 +43,6 @@ - name: rule type: group fields: - - name: id - description: Benchmark Rule Identifier. - type: keyword - name: finding_id description: Benchmark Rule Finding Identifier. type: keyword @@ -91,36 +88,3 @@ - name: refid description: Open Vulnerabilities and Assessment Language Reference Identifier. type: keyword -- name: script - type: group - fields: - - name: current_duration - description: Scanner Script Duration. - type: long - - name: current_time - description: Current datetime. - type: date - - name: name - description: Scanner Script Name. - type: keyword - - name: start - description: Scanner Start datetime. - type: date - - name: type - description: Scanner Script Type. - type: keyword - - name: version - description: Scanner Script Version. - type: keyword -- name: elastic_agent - type: group - fields: - - name: id - description: Elastic Agent Id. - type: keyword - - name: snapshot - description: Elastic Agent snapshot. - type: boolean - - name: version - description: Elastic Agent Version. - type: keyword diff --git a/packages/tychon/data_stream/tychon_stig/manifest.yml b/packages/tychon/data_stream/tychon_stig/manifest.yml index cf335ff8247..57e4a736836 100644 --- a/packages/tychon/data_stream/tychon_stig/manifest.yml +++ b/packages/tychon/data_stream/tychon_stig/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json b/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json index e7baf9ee5d6..bcd83cbbc9b 100644 --- a/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json +++ b/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json @@ -1,55 +1,56 @@ { "events": [ { - "volume.purpose": "text|Optional description or designation for volume.", - "volume.file_system": "keyword|Type of file system. ex. NTFS", - "volume.serial_number": "keyword| Volumes serial number. ex. 1975801541", - "volume.size": "long|Total volume size. ex. 2027835879424", + "tychon.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "volume.file_system": "NTFS", + "volume.serial_number": "1591285579", + "volume.size": "52424704", "script.type": "powershell", - "host.os.build": "22621", - "host.ip": "10.154.5.200", - "volume.percent_full": "keyword|Representating percent of the volume storage spaced is used.", - "host.hostname": "DESKTOP-AF7CIQM", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-14T07:32:54Z", - "@timestamp": "2023-08-14T07:32:54Z", - "host.os.name": "Microsoft Windows 11 Pro", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", + "host.os.build": "19045", + "host.ip": "10.1.9.51", + "host.hostname": "BOTANYBAYEP1", + "host.hardware.manufacturer": "VMware, Inc.", + "script.start": "2023-09-25T21:04:42Z", + "host.os.name": "Microsoft Windows 10 Pro", + "host.hardware.owner": "admin", + "host.hardware.cpu.caption": "Intel64 Family 6 Model 45 Stepping 7", + "volume.dos_device_path": "\\Device\\HarddiskVolume1", "host.os.organization": "", - "host.hardware.owner": "justin.skidmore@tychon.io", - "volume.block_size": "int|Block size.", + "volume.block_size": "4096", "host.workgroup": "WORKGROUP", - "host.ipv4": "10.154.5.200", + "host.ipv4": "10.1.9.51", "host.os.version": "2009", - "volume.drive.type": "int|Numeric code used to categorize and identify different types of drives in Windows.", - "host.hardware.bios.name": "Dell Inc.", + "volume.drive.type": "3", + "host.hardware.bios.name": "Phoenix Technologies LTD", "host.type": "Workstation", - "volume.freespace": "long|Amount of free storage space remaining on drive. ex. 1444925468672", - "volume.drive.letter": "keyword|Drive letter.", - "volume.power_management_supported": "bool|Is power management supported on this volume.", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "volume.dirty_bit_set": "bool|File system repair or consistency check has been set.", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.mac": "60:E3:2B:4B:40:E2", - "volume.id": "keyword|Unique volume identifier. ex. /Volume{d61c491d-c29b-476f-ba9d-fa03eb04f5c1}/", - "volume.automount": "bool|Is volume auto-mounted", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "/Volume{d61c491d-c29b-476f-ba9d-fa03eb04f5c1}/", - "host.hardware.serial_number": "HYLCKG3", + "volume.freespace": "18493440", + "volume.drive.letter": "", + "volume.power_management_supported": "false", + "volume.purpose": "", + "host.id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "volume.dirty_bit_set": "false", + "host.biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "host.mac": "00:0C:29:93:6A:F3", + "volume.id": "\\\\?\\Volume{2d47d57f-0000-0000-0000-100000000000}\\", + "volume.automount": "true", + "host.oem.model": "", + "host.uptime": "622244.0713174", + "id": "10aa4446888ff52f03574182167ec9bd7e8e1454", + "host.hardware.serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3", "script.name": "Get-TychonVolumeInfo.ps1", - "script.version": "2.3.44.0", - "host.oem.manufacturer": "Dell", + "script.version": "2.3.141.0", + "volume.page_file_present": "false", + "host.oem.manufacturer": "", "host.os.description": "", - "volume.dos_device_path": "keyword|DOS device name or file.", - "script.current_duration": "444.85", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33", - "script.current_time": "2023-08-14T07:32:54Z", - "host.hardware.bios.version": "1.20.1", - "volume.name": "keyword|Name of the volume if applicable", - "volume.system_volume": "bool|Is a system parition", + "volume.percent_full": "64.72", + "script.current_duration": "6931.80", + "host.ipv6": "", + "script.current_time": "2023-09-25T21:04:49Z", + "host.hardware.bios.version": "6.00", + "volume.name": "\\\\?\\Volume{2d47d57f-0000-0000-0000-100000000000}\\", + "volume.system_volume": "true", "host.domain": "", - "volume.page_file_present": "bool|Has swap or supplemental memory storage.", + "host.cloud.hosted": "false", "host.os.family": "Windows" } ] diff --git a/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json-expected.json b/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json-expected.json index 64398acae3b..7a0f32749d9 100644 --- a/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json-expected.json +++ b/packages/tychon/data_stream/tychon_volume/_dev/test/pipeline/test-volumes.json-expected.json @@ -1,56 +1,100 @@ { "expected": [ { - "volume.purpose": "text|Optional description or designation for volume.", - "volume.file_system": "keyword|Type of file system. ex. NTFS", - "volume.serial_number": "keyword| Volumes serial number. ex. 1975801541", - "volume.size": "long|Total volume size. ex. 2027835879424", - "script.type": "powershell", - "host.os.build": "22621", - "host.ip": "10.154.5.200", - "volume.percent_full": "keyword|Representating percent of the volume storage spaced is used.", - "host.hostname": "DESKTOP-AF7CIQM", - "host.hardware.manufacturer": "Dell Inc.", - "script.start": "2023-08-14T07:32:54Z", - "@timestamp": "2023-08-14T07:32:54Z", - "host.os.name": "Microsoft Windows 11 Pro", - "host.hardware.cpu.caption": "Intel64 Family 6 Model 141 Stepping 1", - "host.os.organization": "", - "host.hardware.owner": "justin.skidmore@tychon.io", - "volume.block_size": "int|Block size.", - "host.workgroup": "WORKGROUP", - "host.ipv4": "10.154.5.200", - "host.os.version": "2009", - "volume.drive.type": "int|Numeric code used to categorize and identify different types of drives in Windows.", - "host.hardware.bios.name": "Dell Inc.", - "host.type": "Workstation", - "volume.freespace": "long|Amount of free storage space remaining on drive. ex. 1444925468672", - "volume.drive.letter": "keyword|Drive letter.", - "volume.power_management_supported": "bool|Is power management supported on this volume.", - "host.id": "47b5d5906f7d4b288a1366b2f6483148_4C4C4544-0059-4C10-8043-C8C04F4B4733_DESKTOP-AF7CIQM_WORKGROUP", - "volume.dirty_bit_set": "bool|File system repair or consistency check has been set.", - "host.biossn": "4C4C4544-0059-4C10-8043-C8C04F4B4733", - "host.mac": "60:E3:2B:4B:40:E2", - "volume.id": "keyword|Unique volume identifier. ex. /Volume{d61c491d-c29b-476f-ba9d-fa03eb04f5c1}/", - "volume.automount": "bool|Is volume auto-mounted", - "host.oem.model": "XPS 17 9710", - "host.uptime": {}, - "id": "/Volume{d61c491d-c29b-476f-ba9d-fa03eb04f5c1}/", - "host.hardware.serial_number": "HYLCKG3", - "script.name": "Get-TychonVolumeInfo.ps1", - "script.version": "2.3.44.0", - "host.oem.manufacturer": "Dell", - "host.os.description": "", - "volume.dos_device_path": "keyword|DOS device name or file.", - "script.current_duration": "444.85", - "host.ipv6": "fe80::c2c9:f4e0:eb65:2c33", - "script.current_time": "2023-08-14T07:32:54Z", - "host.hardware.bios.version": "1.20.1", - "volume.name": "keyword|Name of the volume if applicable", - "volume.system_volume": "bool|Is a system parition", - "host.domain": "", - "volume.page_file_present": "bool|Has swap or supplemental memory storage.", - "host.os.family": "Windows" + "@timestamp": "2023-09-25T21:55:25.744268763Z", + "ecs": { + "version": "8.8.0" + }, + "event": { + "category": [ + "configuration" + ], + "ingested": "2023-09-25T21:55:25.744268763Z", + "kind": "state", + "module": "tychon", + "type": [ + "info" + ] + }, + "host": { + "biossn": "737C4D56-5714-9415-3B54-352BA8936AF3", + "cloud": { + "hosted": "false" + }, + "domain": "", + "hardware": { + "bios": { + "name": "Phoenix Technologies LTD", + "version": "6.00" + }, + "cpu": { + "caption": "Intel64 Family 6 Model 45 Stepping 7" + }, + "manufacturer": "VMware, Inc.", + "owner": "admin", + "serial_number": "VMware-56 4d 7c 73 14 57 15 94-3b 54 35 2b a8 93 6a f3" + }, + "hostname": "BOTANYBAYEP1", + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP", + "ip": [ + "10.1.9.51" + ], + "ipv4": [ + "10.1.9.51" + ], + "ipv6": "", + "mac": [ + "00-0C-29-93-6A-F3" + ], + "oem": { + "manufacturer": "", + "model": "" + }, + "os": { + "build": "19045", + "description": "", + "family": "Windows", + "name": "Microsoft Windows 10 Pro", + "organization": "", + "version": "2009" + }, + "type": "Workstation", + "uptime": 622244, + "workgroup": "WORKGROUP" + }, + "id": "10aa4446888ff52f03574182167ec9bd7e8e1454", + "script": { + "current_duration": 6931.8, + "current_time": "2023-09-25T21:04:49Z", + "name": "Get-TychonVolumeInfo.ps1", + "start": "2023-09-25T21:04:42Z", + "type": "powershell", + "version": "2.3.141.0" + }, + "tychon": { + "id": "c698e42cc0794fd19b2f9157a8a2c88b_737C4D56-5714-9415-3B54-352BA8936AF3_BOTANYBAYEP1_WORKGROUP" + }, + "volume": { + "automount": "true", + "block_size": 4096, + "dirty_bit_set": "false", + "dos_device_path": "\\Device\\HarddiskVolume1", + "drive": { + "letter": "", + "type": "3" + }, + "file_system": "NTFS", + "freespace": 18493440, + "id": "\\\\?\\Volume{2d47d57f-0000-0000-0000-100000000000}\\", + "name": "\\\\?\\Volume{2d47d57f-0000-0000-0000-100000000000}\\", + "page_file_present": "false", + "percent_full": 64.72, + "power_management_supported": "false", + "purpose": "", + "serial_number": "1591285579", + "size": 52424704, + "system_volume": "true" + } } ] } \ No newline at end of file diff --git a/packages/tychon/data_stream/tychon_volume/elasticsearch/ingest_pipeline/default.yml b/packages/tychon/data_stream/tychon_volume/elasticsearch/ingest_pipeline/default.yml index c49230cd122..cf42e4afd48 100644 --- a/packages/tychon/data_stream/tychon_volume/elasticsearch/ingest_pipeline/default.yml +++ b/packages/tychon/data_stream/tychon_volume/elasticsearch/ingest_pipeline/default.yml @@ -18,24 +18,25 @@ processors: - set: field: event.module value: tychon + - split: + field: host.ip + separator: "," + ignore_missing: true - split: field: host.ipv4 separator: "," ignore_missing: true - - set: - field: event.category - value: volumes - - set: - field: volume.percent_full - value: "0" - if: ctx.volume.percent_full == 'NaN' - gsub: - field: volume.percent_full - pattern: "%" - replacement: "" + field: host.mac + pattern: ":" + replacement: "-" + - split: + field: host.mac + separator: "," + ignore_missing: true - convert: - field: script.current_duration - type: float + field: host.uptime + type: string ignore_missing: true - split: field: host.uptime @@ -50,6 +51,36 @@ processors: field: tempuptime ignore_failure: true ignore_missing: true + - convert: + field: volume.block_size + type: long + ignore_missing: true + - convert: + field: volume.freespace + type: long + ignore_missing: true + - convert: + field: volume.percent_full + type: float + ignore_missing: true + - convert: + field: volume.size + type: long + ignore_missing: true + - convert: + field: host.uptime + type: long + ignore_missing: true + - set: + field: event.category + value: [configuration] + - set: + field: event.type + value: [info] + - convert: + field: script.current_duration + type: float + ignore_missing: true on_failure: - set: field: event.kind diff --git a/packages/tychon/data_stream/tychon_volume/fields/agent.yml b/packages/tychon/data_stream/tychon_volume/fields/agent.yml index 2f024c089ab..efacb477dd9 100644 --- a/packages/tychon/data_stream/tychon_volume/fields/agent.yml +++ b/packages/tychon/data_stream/tychon_volume/fields/agent.yml @@ -1,6 +1,12 @@ - name: id description: TYCHON unique document identifier. type: keyword +- name: tychon + type: group + fields: + - name: id + description: TYCHON unique host identifier. + type: keyword - name: elastic_agent type: group fields: @@ -18,7 +24,7 @@ fields: - name: current_duration description: Scanner Script Duration. - type: float + type: long - name: current_time description: Current datetime. type: date @@ -33,13 +39,7 @@ type: keyword - name: version description: Scanner Script Version. - type: keyword -- name: tychon - type: group - fields: - - name: id - description: TYCHON unique host identifier. - type: keyword + type: version - name: host title: Host group: 2 @@ -77,7 +77,7 @@ type: keyword - name: description description: Host OS Description. - type: keyword + type: text - name: organization description: Host OS Organization. type: keyword diff --git a/packages/tychon/data_stream/tychon_volume/fields/base-fields.yml b/packages/tychon/data_stream/tychon_volume/fields/base-fields.yml index b1abf837fb0..58d1699586e 100644 --- a/packages/tychon/data_stream/tychon_volume/fields/base-fields.yml +++ b/packages/tychon/data_stream/tychon_volume/fields/base-fields.yml @@ -1,6 +1,12 @@ -- name: input.type - description: Source file type. - type: keyword -- name: log.offset - description: Source file current offset. - type: long +- name: input + type: group + fields: + - name: type + description: Input Type. + type: keyword +- name: log + type: group + fields: + - name: offset + description: Log Offset. + type: long diff --git a/packages/tychon/data_stream/tychon_volume/fields/fields.yml b/packages/tychon/data_stream/tychon_volume/fields/fields.yml index 1aa277c286f..6fdf076eb63 100644 --- a/packages/tychon/data_stream/tychon_volume/fields/fields.yml +++ b/packages/tychon/data_stream/tychon_volume/fields/fields.yml @@ -1,40 +1,57 @@ - name: volume type: group fields: - - name: automount - type: boolean - - name: block_size - type: long - - name: dirty_bit_set - type: boolean - - name: dos_device_path - type: text - - name: volume - type: group - fields: - - name: letter + - name: automount + description: Volume Automount. + type: boolean + - name: block_size + description: Volume Block Size. + type: long + - name: dirty_bit_set + description: Volume Dirty Bit Set. + type: boolean + - name: dos_device_path + description: Volume Dos Device Path. + type: text + - name: drive + type: group + fields: + - name: letter + description: Volume Drive Letter. + type: keyword + - name: type + description: Volume Drive Type. + type: keyword + - name: file_system + description: Volume File System. type: keyword - - name: type + - name: freespace + description: Volume Freespace. + type: long + - name: id + description: Volume Id. type: keyword - - name: file_system - type: keyword - - name: freespace - type: long - - name: id - type: keyword - - name: name - type: keyword - - name: page_file_present - type: boolean - - name: percent_full - type: float - - name: power_management_supported - type: boolean - - name: purpose - type: keyword - - name: serial_number - type: keyword - - name: size - type: long - - name: system_volume - type: boolean \ No newline at end of file + - name: name + description: Volume Name. + type: keyword + - name: page_file_present + description: Volume Page File Present. + type: boolean + - name: percent_full + description: Volume Percent Full. + type: float + - name: power_management_supported + description: Volume Power Management Supported. + type: boolean + - name: purpose + description: Volume Purpose. + type: keyword + - name: serial_number + description: Volume Serial Number. + type: keyword + - name: size + description: Volume Size. + type: long + - name: system_volume + description: Volume System Volume. + type: boolean diff --git a/packages/tychon/data_stream/tychon_volume/manifest.yml b/packages/tychon/data_stream/tychon_volume/manifest.yml index 16a2eb0985e..2ec9dafba5d 100644 --- a/packages/tychon/data_stream/tychon_volume/manifest.yml +++ b/packages/tychon/data_stream/tychon_volume/manifest.yml @@ -29,5 +29,5 @@ streams: multi: false required: false show_user: false - description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. \ No newline at end of file + description: >- + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/tychon/docs/README.md b/packages/tychon/docs/README.md index 1836d5bd952..87e81503ecc 100644 --- a/packages/tychon/docs/README.md +++ b/packages/tychon/docs/README.md @@ -1,6 +1,6 @@ # TYCHON Agentless -[TYCHON Agentless](https://tychon.io/products/tychon-agentless/) is an integration that lets you collect TYCHON's gold source vulnerability and STIG data from endpoints without heavy resource use or software installation. You can then investigate the TYCHON data using Elastic's analytics, visualizations, and dashboards. [Contact us to learn more.](https://tychon.io/start-a-free-trial/) +[TYCHON Agentless](https://tychon.io/products/tychon-agentless/) is an integration that lets you collect TYCHON's gold source Master Endpoint Record data from endpoints, including vulnerability and STIG results, without heavy resource use or software installation. You can then investigate the TYCHON data using Elastic's analytics, visualizations, and dashboards. [Contact us to learn more.](https://tychon.io/start-a-free-trial/) ## Compatibility @@ -29,7 +29,7 @@ TYCHON scans Endpoint ARP Tables and returns the results. | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | -| destination.hostname | | keyword | +| destination.hostname | The Translated Hostname of the IP in the ARP Table | keyword | | destination.ip | IP address of the destination (IPv4 or IPv6). | ip | | destination.mac | MAC address of the destination. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | destination.name | | keyword | @@ -77,15 +77,15 @@ TYCHON scans Endpoint ARP Tables and returns the results. | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | network.direction | Direction of the network traffic. When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress". When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external". Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | keyword | -| network.interface | | keyword | -| network.state | | keyword | +| network.interface | The interface the ARP Table has associated the destination. | keyword | +| network.state | Current state | keyword | | network.type | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc The field value must be normalized to lowercase for querying. | keyword | | script.current_duration | Scanner Script Duration. | long | -| script.current_time | Current datetime. | long | +| script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | @@ -126,15 +126,15 @@ TYCHON scans for Endpoint CPU's and returns the results. | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | host.architecture | Operating system architecture. | keyword | | host.biossn | Host BIOS Serial Number. | keyword | -| host.cpu.caption | | text | -| host.cpu.clockspeed | | long | -| host.cpu.family | | keyword | -| host.cpu.manufacturer | | keyword | -| host.cpu.name | | keyword | -| host.cpu.number_of_cores | | integer | -| host.cpu.number_of_logical_processors | | integer | -| host.cpu.speed | | long | -| host.cpu.virtualization_firmware_enabled | | boolean | +| host.cpu.caption | Host Cpu Caption. | text | +| host.cpu.clockspeed | Host Cpu Clockspeed. | long | +| host.cpu.family | Host Cpu Family. | keyword | +| host.cpu.manufacturer | Host Cpu Manufacturer. | keyword | +| host.cpu.name | Host Cpu Name. | keyword | +| host.cpu.number_of_cores | Host Cpu Number Of Cores. | integer | +| host.cpu.number_of_logical_processors | Host Cpu Number Of Logical Processors. | integer | +| host.cpu.speed | Host Cpu Speed. | long | +| host.cpu.virtualization_firmware_enabled | Host Cpu Virtualization Firmware Enabled. | boolean | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | | host.hardware.bios.version | Host BIOS Version. | keyword | @@ -165,11 +165,11 @@ TYCHON scans for Endpoint CPU's and returns the results. | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | script.current_duration | Scanner Script Duration. | long | -| script.current_time | Current datetime. | long | +| script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | @@ -187,16 +187,23 @@ TYCHON scans for Endpoint vulenrabilites and returns the results. | Field | Description | Type | |---|---|---| -| @timestamp | Event timestamp. | date | +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | | agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | | agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | | agent.version | Version of the agent. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | +| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| elastic.service.agent.status | Elastic Service Agent Status. | keyword | +| elastic.service.agent.version | Elastic Service Agent Version. | version | +| elastic.service.endpoint.behavior_protection | Elastic Service Endpoint Behavior Protection. | keyword | +| elastic.service.endpoint.malware | Elastic Service Endpoint Malware. | keyword | +| elastic.service.endpoint.memory_protection | Elastic Service Endpoint Memory Protection. | keyword | +| elastic.service.endpoint.status | Elastic Service Endpoint Status. | keyword | +| elastic.service.endpoint.version | Elastic Service Endpoint Version. | version | | elastic_agent.id | Elastic Agent Id. | keyword | | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | | elastic_agent.version | Elastic Agent Version. | keyword | @@ -208,61 +215,99 @@ TYCHON scans for Endpoint vulenrabilites and returns the results. | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | host.architecture | Operating system architecture. | keyword | | host.biossn | Host BIOS Serial Number. | keyword | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | -| host.hardware.bios.version | Host BIOS Version. | version | +| host.hardware.bios.version | Host BIOS Version. | keyword | | host.hardware.cpu.caption | Host CPU Caption. | keyword | | host.hardware.manufacturer | Host BIOS Manufacturer. | keyword | | host.hardware.owner | Host BIOS Owner. | keyword | | host.hardware.serial_number | Host BIOS Serial Number. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | | host.ipv4 | Host IPv4 addresses. | ip | | host.ipv6 | Host IPv6 addresses. | keyword | +| host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | | host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | | host.os.description | Host OS Description. | text | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | host.os.organization | Host OS Organization. | keyword | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | script.current_duration | Scanner Script Duration. | long | -| script.current_time | Current datetime. | long | +| script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | +| trellix.service.accm.status | Trellix Service Accm Status. | keyword | +| trellix.service.accm.version | Trellix Service Accm Version. | version | +| trellix.service.dlp.status | Trellix Service Dlp Status. | keyword | +| trellix.service.dlp.version | Trellix Service Dlp Version. | version | +| trellix.service.ens.signature_version | Trellix Service Ens Signature Version. | keyword | +| trellix.service.ens.status | Trellix Service Ens Status. | keyword | +| trellix.service.ens.version | Trellix Service Ens Version. | version | +| trellix.service.ma.status | Trellix Service Ma Status. | keyword | +| trellix.service.ma.version | Trellix Service Ma Version. | version | +| trellix.service.pa.status | Trellix Service Pa Status. | keyword | +| trellix.service.pa.version | Trellix Service Pa Version. | version | +| trellix.service.rsd.status | Trellix Service Rsd Status. | keyword | +| trellix.service.rsd.version | Trellix Service Rsd Version. | version | | tychon.id | TYCHON unique host identifier. | keyword | | vulnerability.category | The type of system or architecture that the vulnerability affects. These may be platform-specific (for example, Debian or SUSE) or general (for example, Database or Firewall). For example (https://qualysguard.qualys.com/qwebhelp/fo_portal/knowledgebase/vulnerability_categories.htm[Qualys vulnerability categories]) This field must be an array. | keyword | | vulnerability.classification | The classification of the vulnerability scoring system. For example (https://www.first.org/cvss/) | keyword | -| vulnerability.definition | National Vulnerability Database Vulnerability Definition. | keyword | | vulnerability.description | The description of the vulnerability that provides additional context of the vulnerability. For example (https://cve.mitre.org/about/faqs.html#cve_entry_descriptions_created[Common Vulnerabilities and Exposure CVE description]) | keyword | | vulnerability.description.text | Multi-field of `vulnerability.description`. | match_only_text | | vulnerability.due_date | Vulnerability Due Date. | date | -| vulnerability.due_date_reason | Vulnerability Due Date Reason | keyword | +| vulnerability.due_date_reason | Vulnerability Due Date Reason. | keyword | | vulnerability.enumeration | The type of identifier used for this vulnerability. For example (https://cve.mitre.org/about/) | keyword | -| vulnerability.iava | Information Assurance Vulneraiblity Alert Identifier. | keyword | -| vulnerability.iava_severity | Information Assurance Vulnerability Alert Severity. | keyword | +| vulnerability.iava | Vulnerability Iava. | keyword | +| vulnerability.iava_severity | Vulnerability Iava Severity. | keyword | | vulnerability.id | The identification (ID) is the number portion of a vulnerability entry. It includes a unique identification number for the vulnerability. For example (https://cve.mitre.org/about/faqs.html#what_is_cve_id)[Common Vulnerabilities and Exposure CVE ID] | keyword | | vulnerability.reference | A resource that provides additional information, context, and mitigations for the identified vulnerability. | keyword | -| vulnerability.result | Pass/Fail Outcome of the Common Vulnerabilities and Exposures Scan. | keyword | +| vulnerability.result | Vulnerability Result. | keyword | | vulnerability.scanner.vendor | The name of the vulnerability scanner vendor. | keyword | | vulnerability.score.base | Scores can range from 0.0 to 10.0, with 10.0 being the most severe. Base scores cover an assessment for exploitability metrics (attack vector, complexity, privileges, and user interaction), impact metrics (confidentiality, integrity, and availability), and scope. For example (https://www.first.org/cvss/specification-document) | float | | vulnerability.score.version | The National Vulnerability Database (NVD) provides qualitative severity rankings of "Low", "Medium", and "High" for CVSS v2.0 base score ranges in addition to the severity ratings for CVSS v3.0 as they are defined in the CVSS v3.0 specification. CVSS is owned and managed by FIRST.Org, Inc. (FIRST), a US-based non-profit organization, whose mission is to help computer security incident response teams across the world. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | | vulnerability.severity | The severity of the vulnerability can help with metrics and internal prioritization regarding remediation. For example (https://nvd.nist.gov/vuln-metrics/cvss) | keyword | -| vulnerability.title | Common Vulnerabilities and Exposures Description and Title. | keyword | -| vulnerability.version | Version Number of the Scan. | keyword | -| vulnerability.year | Common Vulnerabilities and Exposures Year. | integer | +| vulnerability.title | Vulnerability Title. | keyword | +| vulnerability.version | Vulnerability Version. | keyword | +| vulnerability.year | Vulnerability Year. | integer | +| windows_defender.service.antimalware.engine_version | Windows Defender Service Antimalware Engine Version. | keyword | +| windows_defender.service.antimalware.product_version | Windows Defender Service Antimalware Product Version. | keyword | +| windows_defender.service.antimalware.signature_version | Windows Defender Service Antimalware Signature Version. | keyword | +| windows_defender.service.antimalware.status | Windows Defender Service Antimalware Status. | keyword | +| windows_defender.service.antispyware.signature_version | Windows Defender Service Antispyware Signature Version. | keyword | +| windows_defender.service.antispyware.status | Windows Defender Service Antispyware Status. | keyword | +| windows_defender.service.antivirus.status | Windows Defender Service Antivirus Status. | keyword | +| windows_defender.service.behavior_monitor.status | Windows Defender Service Behavior Monitor Status. | keyword | +| windows_defender.service.full_scan.signature_version | Windows Defender Service Antivirus Full Scan Signature Version. | keyword | +| windows_defender.service.ioav_protection.status | Windows Defender Service Ioav Protection Status. | keyword | +| windows_defender.service.nis.engine_version | Windows Defender Service Nis Engine Version. | keyword | +| windows_defender.service.nis.signature_version | Windows Defender Service Nis Signature Version. | keyword | +| windows_defender.service.nis.status | Windows Defender Service Nis Status. | keyword | +| windows_defender.service.on_access_protection.status | Windows Defender Service On Access Protection Status. | keyword | +| windows_defender.service.quick_scan.signature_version | Windows Defender Service Antivirus Quick Scan Signature Version. | keyword | +| windows_defender.service.real_time_protection.status | Windows Defender Service Real Time Protection Status. | keyword | ### Endpoint Protection Platform @@ -274,28 +319,23 @@ TYCHON scans the Endpoint's Windows Defender and returns protection status and v | Field | Description | Type | |---|---|---| -| @timestamp | Event timestamp. | date | +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | | agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | | agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | | agent.version | Version of the agent. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | +| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| elastic.service.agent.status | Elastic Service Agent Status. | keyword | +| elastic.service.agent.version | Elastic Service Agent Version. | version | +| elastic.service.endpoint.behavior_protection | Elastic Service Endpoint Behavior Protection. | keyword | +| elastic.service.endpoint.malware | Elastic Service Endpoint Malware. | keyword | +| elastic.service.endpoint.memory_protection | Elastic Service Endpoint Memory Protection. | keyword | +| elastic.service.endpoint.status | Elastic Service Endpoint Status. | keyword | +| elastic.service.endpoint.version | Elastic Service Endpoint Version. | version | | elastic_agent.id | Elastic Agent Id. | keyword | | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | | elastic_agent.version | Elastic Agent Version. | keyword | @@ -306,56 +346,58 @@ TYCHON scans the Endpoint's Windows Defender and returns protection status and v | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module. | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | host.architecture | Operating system architecture. | keyword | | host.biossn | Host BIOS Serial Number. | keyword | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.epp.product | Epp products installed | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | | host.hardware.bios.version | Host BIOS Version. | keyword | | host.hardware.cpu.caption | Host CPU Caption. | keyword | | host.hardware.manufacturer | Host BIOS Manufacturer. | keyword | | host.hardware.owner | Host BIOS Owner. | keyword | | host.hardware.serial_number | Host BIOS Serial Number. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. | keyword | -| host.ip | Host ip addresses. | ip | -| host.ipv4 | Host ip v4 addresses. | keyword | -| host.ipv6 | Host ip v6 addresses. | keyword | -| host.mac | Host mac addresses. | keyword | +| host.ipv4 | Host IPv4 addresses. | ip | +| host.ipv6 | Host IPv6 addresses. | keyword | | host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.description | Host OS Description. | text | | host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | | host.os.organization | Host OS Organization. | keyword | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.trellix.product | trellix products installed | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | -| id | TYCHON Unique Idnentifier of the Common Vulnerabilities and Exposures Result for the Endpoint. | keyword | -| input.type | Source file type. | keyword | +| id | TYCHON unique document identifier. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | package.build_version | Additional information about the build version of the installed package. For example use the commit SHA of a non-released package. | keyword | | package.description | Description of the package. | keyword | | package.name | Package name | keyword | | package.reference | Home page or reference URL of the software in this package, if available. | keyword | | package.type | Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. | keyword | -| script.current_duration | Current Scanner Script Duration. | long | -| script.current_time | Current Script datetime. | date | +| script.current_duration | Scanner Script Duration. | long | +| script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | +| trellix.service.accm.status | Trellix Service Accum Status. | keyword | +| trellix.service.accm.version | Trellix Service Accum Version. | version | +| trellix.service.dlp.status | Trellix Service DLP Status. | keyword | +| trellix.service.dlp.version | Trellix Service DLP Version. | version | +| trellix.service.ens.signature_version | Trellix Service ENS Signature Version. | keyword | +| trellix.service.ens.status | Trellix Service ENS Signature status. | keyword | +| trellix.service.ens.version | Trellix Service ENS Signature Version. | version | +| trellix.service.ma.status | Trellix Service MA Status. | keyword | +| trellix.service.ma.version | Trellix Service MA Version. | version | +| trellix.service.pa.status | Trellix Service PA Status. | keyword | +| trellix.service.pa.version | Trellix Service PA Version. | version | +| trellix.service.rsd.status | Trellix Service RSD Status. | keyword | +| trellix.service.rsd.version | Trellix Service RSD Version. | version | +| tychon.id | TYCHON unique host identifier. | keyword | | windows_defender.service.antimalware.engine_version | Windows Defender Antimalware Engine Version. | keyword | | windows_defender.service.antimalware.product_version | Windows Defender Antimalware Product Version. | keyword | | windows_defender.service.antimalware.signature_version | Windows Defender Antimalware Signature Version. | keyword | @@ -423,7 +465,7 @@ The TYCHON script to scan Endpoint Exposed Services and returns information. | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | @@ -436,9 +478,9 @@ The TYCHON script to scan Endpoint Exposed Services and returns information. | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | | process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | | process.command_line.text | Multi-field of `process.command_line`. | match_only_text | @@ -451,14 +493,14 @@ The TYCHON script to scan Endpoint Exposed Services and returns information. | process.start | The time the process started. | date | | process.user.name | Short name or login of the user. | keyword | | process.user.name.text | Multi-field of `process.user.name`. | match_only_text | -| script.current_duration | Scanner Script Duration. | float | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | -| service.description | | keyword | -| service.display_name | | keyword | +| script.version | Scanner Script Version. | version | +| service.description | The description text on the serivce. | keyword | +| service.display_name | The human readable name of the service | keyword | | service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | | service.state | Current state of the service. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip | @@ -485,31 +527,31 @@ The TYCHON script scans an endpoint's Hard Drive Configurations and returns info | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | -| disk.adapter.serial_number | | keyword | -| disk.boot_from | | boolean | -| disk.bus_type | | keyword | -| disk.clustered | | boolean | -| disk.firmware.version | | keyword | -| disk.firmware_version | | keyword | -| disk.guid | | keyword | -| disk.health_status | | keyword | -| disk.highly_available | | boolean | -| disk.is_boot | | boolean | -| disk.location.adapter | | integer | -| disk.location.bus | | integer | -| disk.location.device | | integer | -| disk.location.function | | integer | -| disk.manufacturer | | keyword | -| disk.model | | keyword | -| disk.name | | keyword | -| disk.number | | integer | -| disk.number_of_partitions | | integer | -| disk.offline | | boolean | -| disk.operational_status | | keyword | -| disk.partition_style | | keyword | -| disk.serial_number | | keyword | -| disk.size | | long | -| disk.system | | boolean | +| disk.adapter.serial_number | Disk Adatper Serial Number | keyword | +| disk.boot_from | OS booted from this disk | boolean | +| disk.bus_type | THe Disk Bus Type | keyword | +| disk.clustered | Is the Disk Clustered | boolean | +| disk.firmware_version | Disk Firmware version | keyword | +| disk.health_status | Health status of the disk | keyword | +| disk.highly_available | Disk is marked as highly available | boolean | +| disk.id | Disk ID | keyword | +| disk.is_boot | Disk is a boot disk | boolean | +| disk.location.adapter | Zero index adapter location | integer | +| disk.location.bus | Disk Bus Location | integer | +| disk.location.device | Disk Device Location | integer | +| disk.location.function | Disk Function Location | integer | +| disk.location.pci_slot | PCI Slot location | integer | +| disk.manufacturer | The manufacturer of the Disk | keyword | +| disk.model | The model of the disk | keyword | +| disk.name | The firendly name of the disk | keyword | +| disk.number | The number assigned to the disk | integer | +| disk.number_of_partitions | Total number of partitions on the drive | integer | +| disk.offline | Is the disk offline | boolean | +| disk.operational_status | Operational Status of the disk | keyword | +| disk.partition_style | Partition style | keyword | +| disk.serial_number | The unique serial number of the drive | keyword | +| disk.size | Total Size of the disk | long | +| disk.system | Is this a system drive | boolean | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | elastic_agent.id | Elastic Agent Id. | keyword | | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | @@ -541,7 +583,7 @@ The TYCHON script scans an endpoint's Hard Drive Configurations and returns info | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | @@ -554,15 +596,15 @@ The TYCHON script scans an endpoint's Hard Drive Configurations and returns info | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | -| script.current_duration | Scanner Script Duration. | float | +| log.offset | Log Offset. | long | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | | tychon.id | TYCHON unique host identifier. | keyword | @@ -585,14 +627,14 @@ The TYCHON script scans an endpoint's Hardware Configurations and returns inform | data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | | data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | -| device.class | | keyword | -| device.description | | keyword | -| device.friendly_name | | keyword | +| device.class | Device Class. | keyword | +| device.description | Device Description. | text | +| device.friendly_name | Device Friendly Name. | keyword | | device.id | The unique identifier of a device. The identifier must not change across application sessions but stay fixed for an instance of a (mobile) device. On iOS, this value must be equal to the vendor identifier (https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor). On Android, this value must be equal to the Firebase Installation ID or a globally unique UUID which is persisted across sessions in your application. For GDPR and data protection law reasons this identifier should not carry information that would allow to identify a user. | keyword | | device.manufacturer | The vendor name of the device manufacturer. | keyword | -| device.name | | keyword | -| device.present | | boolean | -| device.status | | keyword | +| device.name | Device Name. | keyword | +| device.present | Device Present. | boolean | +| device.status | Device Status. | keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | elastic_agent.id | Elastic Agent Id. | keyword | | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | @@ -624,7 +666,7 @@ The TYCHON script scans an endpoint's Hardware Configurations and returns inform | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | @@ -637,15 +679,15 @@ The TYCHON script scans an endpoint's Hardware Configurations and returns inform | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | -| script.current_duration | Scanner Script Duration. | float | +| log.offset | Log Offset. | long | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | | tychon.id | TYCHON unique host identifier. | keyword | @@ -668,27 +710,27 @@ The TYCHON script scans an endpoint's OS Configurations and returns information. | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | | elastic_agent.version | Elastic Agent Version. | keyword | | error.message | Error message. | match_only_text | -| event.deviceguard.basevirtualizationsupport.available | | boolean | -| event.deviceguard.credentialguard.enabled | | boolean | -| event.deviceguard.credentialguard.running | | boolean | -| event.deviceguard.dmaprotection.available | | boolean | -| event.deviceguard.hypervisorenforcedcodeint.enabled | | boolean | -| event.deviceguard.hypervisorenforcedcodeint.running | | boolean | -| event.deviceguard.secureboot.available | | boolean | -| event.deviceguard.securememoverwrite.available | | boolean | -| event.deviceguard.smmsecuritymigrations.available | | boolean | -| event.deviceguard.systemguardsecurelaunch.enabled | | boolean | -| event.deviceguard.systemguardsecurelaunch.running | | boolean | -| event.deviceguard.ueficodereadonly.available | | boolean | -| event.deviceguard.usermodecodeintegrity.policyenforcement | | keyword | -| event.deviceguard.version | | keyword | -| event.deviceguard.virtualizationbasedsecurity.status | | keyword | +| event.deviceguard.basevirtualizationsupport.available | Event Device Base Virtualization Support Available. | boolean | +| event.deviceguard.credentialguard.enabled | Event Device Credential Guard Enabled. | boolean | +| event.deviceguard.credentialguard.running | Event Device Credential Guard Running. | boolean | +| event.deviceguard.dmaprotection.available | Event Device | boolean | +| event.deviceguard.hypervisorenforcedcodeint.enabled | Event Device Hypervisor Enforced Code Enabled. | boolean | +| event.deviceguard.hypervisorenforcedcodeint.running | Event Device Hypervisor Enforced Code running. | boolean | +| event.deviceguard.secureboot.available | Event Device Secure Boot Available. | boolean | +| event.deviceguard.securememoverwrite.available | Event Device Secure Memory Overwrite Available. | boolean | +| event.deviceguard.smmsecuritymigrations.available | Event Device SMM Security Migrations Available. | boolean | +| event.deviceguard.systemguardsecurelaunch.enabled | Event Device Guard System Guard Secure Launch Enabled. | boolean | +| event.deviceguard.systemguardsecurelaunch.running | Event Device Guard System Guard Secure Launch Running. | boolean | +| event.deviceguard.ueficodereadonly.available | Event Device Guard UEFI Code Readonly Availability. | boolean | +| event.deviceguard.usermodecodeintegrity.policyenforcement | Event Device Guard User Mode Code Integrity Policy Enforcement. | keyword | +| event.deviceguard.version | Event Device Guard version. | keyword | +| event.deviceguard.virtualizationbasedsecurity.status | Event Device Guard Virtualization Based Security Status. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.ufi.enabled | | boolean | +| event.ufi.enabled | Event UFI Enabled. | boolean | | host.architecture | Operating system architecture. | keyword | | host.biossn | Host BIOS Serial Number. | keyword | -| host.cpu.caption | | keyword | -| host.cpu.count | | integer | +| host.cpu.caption | Description of the CPU | text | +| host.cpu.count | Total Number of CPUs on the system | integer | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | | host.hardware.bios.version | Host BIOS Version. | keyword | @@ -702,46 +744,46 @@ The TYCHON script scans an endpoint's OS Configurations and returns information. | host.ipv4 | Host IPv4 addresses. | ip | | host.ipv6 | Host IPv6 addresses. | keyword | | host.mac | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | keyword | -| host.memory.size | | long | -| host.motherboard.chipset | | keyword | -| host.motherboard.serial_number | | keyword | +| host.memory.size | Total RAM Size | long | +| host.motherboard.chipset | Chipset of the Motherboard | keyword | +| host.motherboard.serial_number | Serial Number of the Motherboard | keyword | | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | -| host.os.edition | | keyword | +| host.os.description | Host OS Description. | text | +| host.os.edition | The Edition of the Opearting System | keyword | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.name | Operating system name, without the version. | keyword | | host.os.name.text | Multi-field of `host.os.name`. | match_only_text | | host.os.organization | Host OS Organization. | keyword | -| host.os.vendor | | keyword | +| host.os.vendor | The vendor of the Operating System | keyword | | host.os.version | Operating system version as a raw string. | keyword | -| host.security.antivirus.exists | | boolean | -| host.security.antivirus.name | | keyword | -| host.security.antivirus.state | | keyword | -| host.security.antivirus.status | | keyword | -| host.tpm.compliant | | boolean | -| host.tpm.digest.id | | keyword | -| host.tpm.present | | boolean | -| host.tpm.version | | keyword | +| host.security.antivirus.exists | Does the OS state that an AV program is installed | boolean | +| host.security.antivirus.name | Product name the Operating System states is the AV program installed | keyword | +| host.security.antivirus.state | The Operating System state of the AV product | keyword | +| host.security.antivirus.status | The Operating System current status of the AV product it says is installed. | keyword | +| host.tpm.compliant | Is the endpoint compliant with TPM security settings | boolean | +| host.tpm.digest.id | What digest is being used by TPM | keyword | +| host.tpm.present | Is TPM module present on the operating system | boolean | +| host.tpm.version | What version of TPM is being used | keyword | | host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | host.uptime | Seconds the host has been up. | long | | host.virtualization_status | | keyword | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | -| log.offset | Source file current offset. | long | -| script.current_duration | Scanner Script Duration. | float | +| input.type | Input Type. | keyword | +| log.offset | Log Offset. | long | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | -| tychon.definition.oval | | date | -| tychon.definition.stig | | date | +| script.version | Scanner Script Version. | version | +| tychon.definition.oval | What version of the TYCHON oval defitnions are currently on this endpoint | date | +| tychon.definition.stig | What version of the Benchmark checks are on this endpoint | date | | tychon.id | TYCHON unique host identifier. | keyword | -| tychon.version.agent | | version | -| tychon.version.content | | version | +| tychon.version.agent | The TYCHON Agent Version installed on the endpoint | version | +| tychon.version.content | The TYCHON Agentless Version installed on the endpoint | version | ### Endpoint Network Adapters Information @@ -764,35 +806,42 @@ The TYCHON script scans an endpoint's Network Adapter Configurations and returns | error.message | Error message. | match_only_text | | event.agent_id_status | Agents are normally responsible for populating the `agent.id` field value. If the system receiving events is capable of validating the value based on authentication information for the client then this field can be used to reflect the outcome of that validation. For example if the agent's connection is authenticated with mTLS and the client cert contains the ID of the agent to which the cert was issued then the `agent.id` value in events can be checked against the certificate. If the values match then `event.agent_id_status: verified` is added to the event, otherwise one of the other allowed values should be used. If no validation is performed then the field should be omitted. The allowed values are: `verified` - The `agent.id` field value matches expected value obtained from auth metadata. `mismatch` - The `agent.id` field value does not match the expected value obtained from auth metadata. `missing` - There was no `agent.id` field in the event to validate. `auth_metadata_missing` - There was no auth metadata or it was missing information about the agent ID. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| host.adapter.alias | | keyword | -| host.adapter.description | | text | -| host.adapter.dhcp.enabled | | boolean | -| host.adapter.dhcp.lease_expires | | date | -| host.adapter.dhcp.lease_obtained | | date | -| host.adapter.dhcp.server | | ip | -| host.adapter.domain | | keyword | -| host.adapter.driver.date | | date | -| host.adapter.driver.description | | text | -| host.adapter.driver.file_name | | keyword | -| host.adapter.driver.name | | keyword | -| host.adapter.driver.provider | | keyword | -| host.adapter.driver.version | | keyword | -| host.adapter.gateway | | ip | -| host.adapter.id | | keyword | -| host.adapter.ip | | ip | -| host.adapter.ip_filter.enabled | | boolean | -| host.adapter.link_speed | | long | -| host.adapter.mac | | keyword | -| host.adapter.media.connection_state | | keyword | -| host.adapter.media.type | | keyword | -| host.adapter.mtu | | integer | -| host.adapter.ndis.version | | keyword | -| host.adapter.subnet_bit | | integer | -| host.adapter.virtual | | boolean | -| host.adapter.vlan.id | | keyword | -| host.adapter.wifi.enabled | | boolean | -| host.adapter.wifi.signal_percent | | integer | -| host.adapter.wins_server | | keyword | +| host.adapter.alias | The Alias given to this adapter | keyword | +| host.adapter.description | The network adatper description | text | +| host.adapter.dhcp.enabled | Is DHCP Enabled on this adatper | boolean | +| host.adapter.dhcp.lease_expires | When does this DHCP lease expire | date | +| host.adapter.dhcp.lease_obtained | When was the DHCP lease obtained | date | +| host.adapter.dhcp.server | What IP Address was the DHCP IP obtained from. | ip | +| host.adapter.domain | What domain was assigned to this adatper | text | +| host.adapter.driver.date | Date the driver was installed | date | +| host.adapter.driver.description | Description of the driver | text | +| host.adapter.driver.file_name | Driver File name | keyword | +| host.adapter.driver.name | Name of the driver | keyword | +| host.adapter.driver.provider | Company that provided the driver | keyword | +| host.adapter.driver.version | Version of the driver | keyword | +| host.adapter.gateway | Gateway IP Address | ip | +| host.adapter.id | ID Of the adapter | keyword | +| host.adapter.ip | IP Addresses assigned to the adatper | ip | +| host.adapter.ip_filter.enabled | Is IP Filtering Enabled | boolean | +| host.adapter.link_speed | Link speed of the adatper | long | +| host.adapter.mac | Hardware MAC Address | keyword | +| host.adapter.media.connection_state | Current Connection State | keyword | +| host.adapter.media.type | Current Connection Media Type | keyword | +| host.adapter.mtu | MTU Size | integer | +| host.adapter.ndis.version | NDIS Version | keyword | +| host.adapter.subnet_bit | Subnet BIT | integer | +| host.adapter.virtual | Is adapter virutal | boolean | +| host.adapter.vlan.id | The VLAN ID | keyword | +| host.adapter.wifi.authentication | The Authentication method used to connected to the WIFI Router | keyword | +| host.adapter.wifi.band | The band used to connected to the WIFI Router | keyword | +| host.adapter.wifi.bssid | The Connected WIFI Router Hardware Address | keyword | +| host.adapter.wifi.channel | The channel used to connected to the WIFI Router | keyword | +| host.adapter.wifi.cipher | The CIPHER used to connected to the WIFI Router | keyword | +| host.adapter.wifi.enabled | Is WIFI Enabled | boolean | +| host.adapter.wifi.radio_type | The radio type of the connected WIFI Router | keyword | +| host.adapter.wifi.signal_percent | Signal strenth to connected WIFI Router | integer | +| host.adapter.wifi.ssid | The Connected WIFI Router SSID | keyword | +| host.adapter.wins_server | The WINS Server attached to this adatper | ip | | host.biossn | Host BIOS Serial Number. | keyword | | host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | @@ -810,7 +859,7 @@ The TYCHON script scans an endpoint's Network Adapter Configurations and returns | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.name | Operating system name, without the version. | keyword | | host.os.name.text | Multi-field of `host.os.name`. | match_only_text | @@ -820,14 +869,14 @@ The TYCHON script scans an endpoint's Network Adapter Configurations and returns | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | -| log.offset | Source file current offset. | long | -| script.current_duration | Scanner Script Duration. | float | +| input.type | Input Type. | keyword | +| log.offset | Log Offset. | long | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tychon.id | TYCHON unique host identifier. | keyword | @@ -880,7 +929,7 @@ The TYCHON script scans an endpoint's Software Inventory and returns information | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | @@ -893,31 +942,31 @@ The TYCHON script scans an endpoint's Software Inventory and returns information | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | package.architecture | Package architecture. | keyword | -| package.cpe | | keyword | +| package.cpe | Package Cpe. | keyword | | package.description | Description of the package. | keyword | -| package.id | | keyword | +| package.id | Package Id. | keyword | | package.installed | Time when package was installed. | date | | package.name | Package name | keyword | | package.path | Path where the package is installed. | keyword | -| package.publisher | | keyword | +| package.publisher | Package Publisher. | keyword | | package.size | Package size in bytes. | long | | package.type | Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. | keyword | -| package.uninstall | | text | +| package.uninstall | Package Uninstall. | text | | package.version | Package version | keyword | -| package.version_build | | integer | -| package.version_major | | integer | -| package.version_minor | | integer | -| package.version_release | | integer | -| script.current_duration | Scanner Script Duration. | float | +| package.version_build | Package Version Build. | integer | +| package.version_major | Package Version Major. | integer | +| package.version_minor | Package Version Minor. | integer | +| package.version_release | Package Version Release. | integer | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | | tychon.id | TYCHON unique host identifier. | keyword | @@ -931,35 +980,24 @@ The TYCHON benchmark script scans an endpoint's Windows configuration for STIG/X | Field | Description | Type | |---|---|---| -| @timestamp | Event timestamp. | date | +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | | agent.ephemeral_id | Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not. | keyword | | agent.id | Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id. | keyword | | agent.name | Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | keyword | | agent.type | Type of the agent. The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | keyword | | agent.version | Version of the agent. | keyword | | benchmark.count | Benchmark Summary Name List Item Count. | long | -| benchmark.generated_utc | Benchmark UTC. | keyword | +| benchmark.generated_utc | Benchmark UTC. | date | | benchmark.guid | Benchmark GUID. | keyword | | benchmark.hash | Benchmark SHA256 Hash | keyword | +| benchmark.id | Benchmark ID. | keyword | | benchmark.list | Benchmark Summary Name List. | keyword | | benchmark.name | Benchmark Name. | keyword | | benchmark.title | Benchmark Title. | keyword | | benchmark.version | Benchmark Version. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | +| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | elastic_agent.id | Elastic Agent Id. | keyword | | elastic_agent.snapshot | Elastic Agent snapshot. | boolean | @@ -971,42 +1009,32 @@ The TYCHON benchmark script scans an endpoint's Windows configuration for STIG/X | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | -| event.module | Event module. | keyword | | event.timezone | This field should be populated when the event's timestamp does not include timezone information already (e.g. default Syslog timestamps). It's optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). | keyword | | host.architecture | Operating system architecture. | keyword | | host.biossn | Host BIOS Serial Number. | keyword | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | host.hardware.bios.name | Host BIOS Name. | keyword | | host.hardware.bios.version | Host BIOS Version. | keyword | | host.hardware.cpu.caption | Host CPU Caption. | keyword | | host.hardware.manufacturer | Host BIOS Manufacturer. | keyword | | host.hardware.owner | Host BIOS Owner. | keyword | | host.hardware.serial_number | Host BIOS Serial Number. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. | keyword | -| host.ip | Host ip addresses. | ip | -| host.ipv4 | Host ip v4 addresses. | keyword | -| host.ipv6 | Host ip v6 addresses. | keyword | -| host.mac | Host mac addresses. | keyword | +| host.ipv4 | Host IPv4 addresses. | ip | +| host.ipv6 | Host IPv6 addresses. | keyword | | host.name | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | keyword | | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.description | Host OS Description. | text | | host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | | host.os.organization | Host OS Organization. | keyword | | host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | host.os.type | Use the `os.type` field to categorize the operating system into one of the broad commercial families. If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like t2.medium. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | -| id | Tychon Unique Stig Id. | keyword | -| input.type | Source file type. | keyword | +| id | TYCHON unique document identifier. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | +| log.offset | Log Offset. | long | | oval.class | Open Vulnerabilities and Assessment Language Class. | keyword | | oval.id | Open Vulnerabilities and Assessment Language Identifier. | keyword | | oval.refid | Open Vulnerabilities and Assessment Language Rule Reference Identifier. | keyword | @@ -1019,7 +1047,7 @@ The TYCHON benchmark script scans an endpoint's Windows configuration for STIG/X | rule.benchmark.profile.id | Benchmark Rule Profile Identifier. | keyword | | rule.benchmark.title | Benchmark Rule Title. | keyword | | rule.finding_id | Benchmark Rule Finding Identifier. | keyword | -| rule.id | Benchmark Rule Identifier. | keyword | +| rule.id | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | keyword | | rule.name | The name of the rule or signature generating the event. | keyword | | rule.oval.class | Open Vulnerabilities and Assessment Language Class. | keyword | | rule.oval.id | Open Vulnerabilities and Assessment Language Identifier. | keyword | @@ -1035,8 +1063,9 @@ The TYCHON benchmark script scans an endpoint's Windows configuration for STIG/X | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | +| tychon.id | TYCHON unique host identifier. | keyword | ### Endpoint Volume Information @@ -1088,7 +1117,7 @@ The TYCHON script scans an endpoint's Volume Configurations and returns informat | host.oem.manufacturer | Host OEM Manufacturer. | keyword | | host.oem.model | Host OEM Model. | keyword | | host.os.build | Host OS Build. | keyword | -| host.os.description | Host OS Description. | keyword | +| host.os.description | Host OS Description. | text | | host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | host.os.kernel | Operating system kernel version as a raw string. | keyword | | host.os.name | Operating system name, without the version. | keyword | @@ -1101,32 +1130,32 @@ The TYCHON script scans an endpoint's Volume Configurations and returns informat | host.uptime | Seconds the host has been up. | long | | host.workgroup | Host Workgroup Network Name. | keyword | | id | TYCHON unique document identifier. | keyword | -| input.type | Source file type. | keyword | +| input.type | Input Type. | keyword | | log.file.path | Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn't read from a log file, do not populate this field. | keyword | -| log.offset | Source file current offset. | long | -| script.current_duration | Scanner Script Duration. | float | +| log.offset | Log Offset. | long | +| script.current_duration | Scanner Script Duration. | long | | script.current_time | Current datetime. | date | | script.name | Scanner Script Name. | keyword | | script.start | Scanner Start datetime. | date | | script.type | Scanner Script Type. | keyword | -| script.version | Scanner Script Version. | keyword | +| script.version | Scanner Script Version. | version | | tags | List of keywords used to tag each event. | keyword | | tychon.id | TYCHON unique host identifier. | keyword | -| volume.automount | | boolean | -| volume.block_size | | long | -| volume.dirty_bit_set | | boolean | -| volume.dos_device_path | | text | -| volume.drive.letter | | keyword | -| volume.drive.type | | keyword | -| volume.file_system | | keyword | -| volume.freespace | | long | -| volume.id | | keyword | -| volume.name | | keyword | -| volume.page_file_present | | boolean | -| volume.percent_full | | float | -| volume.power_management_supported | | boolean | -| volume.purpose | | keyword | -| volume.serial_number | | keyword | -| volume.size | | long | -| volume.system_volume | | boolean | +| volume.automount | Volume Automount. | boolean | +| volume.block_size | Volume Block Size. | long | +| volume.dirty_bit_set | Volume Dirty Bit Set. | boolean | +| volume.dos_device_path | Volume Dos Device Path. | text | +| volume.drive.letter | Volume Drive Letter. | keyword | +| volume.drive.type | Volume Drive Type. | keyword | +| volume.file_system | Volume File System. | keyword | +| volume.freespace | Volume Freespace. | long | +| volume.id | Volume Id. | keyword | +| volume.name | Volume Name. | keyword | +| volume.page_file_present | Volume Page File Present. | boolean | +| volume.percent_full | Volume Percent Full. | float | +| volume.power_management_supported | Volume Power Management Supported. | boolean | +| volume.purpose | Volume Purpose. | keyword | +| volume.serial_number | Volume Serial Number. | keyword | +| volume.size | Volume Size. | long | +| volume.system_volume | Volume System Volume. | boolean | diff --git a/packages/tychon/manifest.yml b/packages/tychon/manifest.yml index 191a8c4fe7c..e6371aadc56 100644 --- a/packages/tychon/manifest.yml +++ b/packages/tychon/manifest.yml @@ -2,7 +2,7 @@ format_version: 2.0.0 name: tychon release: beta title: "TYCHON Agentless" -version: 0.0.51 +version: 0.0.54 source: license: "Elastic-2.0" description: TYCHON Agentless delivers STIG, CVE/IAVA, and Endpoint Protection status without adding new server infrastructure or services to your endpoints. TYCHON datasets fully comply with vulnerability and STIG reporting standards and integrate into Comply-to-Connect for instant zero trust value. diff --git a/packages/udp/_dev/build/build.yml b/packages/udp/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/udp/_dev/build/build.yml +++ b/packages/udp/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/udp/changelog.yml b/packages/udp/changelog.yml index 75bf8e639b3..5dfc9af8b19 100644 --- a/packages/udp/changelog.yml +++ b/packages/udp/changelog.yml @@ -1,3 +1,23 @@ +- version: 1.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.11.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 - version: "1.10.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/udp/data_stream/generic/manifest.yml b/packages/udp/data_stream/generic/manifest.yml index b0260a39c53..ec7f274854d 100644 --- a/packages/udp/data_stream/generic/manifest.yml +++ b/packages/udp/data_stream/generic/manifest.yml @@ -54,12 +54,12 @@ streams: - name: timeout type: text title: Timeout - description: The read and write timeout for socket operations. + description: The read and write timeout for socket operations. Valid time units are ns, us, ms, s, m, h. required: false show_user: false - name: keep_null type: bool - title: Timeout + title: Keep Null Values description: If this option is set to true, fields with null values will be published in the output document. By default, keep_null is set to false. required: false show_user: false diff --git a/packages/udp/kibana/tags.yml b/packages/udp/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/udp/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/udp/manifest.yml b/packages/udp/manifest.yml index 1c11091a1f5..827bd909c60 100644 --- a/packages/udp/manifest.yml +++ b/packages/udp/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: udp title: Custom UDP Logs description: Collect raw UDP data from listening UDP port with Elastic Agent. type: integration -version: "1.10.0" +version: "1.14.0" conditions: - kibana.version: "^8.2.1" + kibana: + version: "^8.2.1" categories: - custom - custom_logs @@ -23,3 +24,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/universal_profiling_agent/changelog.yml b/packages/universal_profiling_agent/changelog.yml index 51637a6bf7e..377e87f11ff 100644 --- a/packages/universal_profiling_agent/changelog.yml +++ b/packages/universal_profiling_agent/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: 8.9.0 + changes: + - description: Promote package for GA + type: enhancement + link: https://github.com/elastic/integrations/pull/7232 - version: 8.8.0-preview changes: - description: Initial draft of the package diff --git a/packages/universal_profiling_agent/manifest.yml b/packages/universal_profiling_agent/manifest.yml index 2f2591bf269..0eb27212f80 100644 --- a/packages/universal_profiling_agent/manifest.yml +++ b/packages/universal_profiling_agent/manifest.yml @@ -1,10 +1,10 @@ name: profiler_agent title: Universal Profiling Agent -version: 8.8.0-preview +version: 8.9.0 categories: ["elastic_stack", "monitoring"] description: Fleet-wide, whole-system, continuous profiling with zero instrumentation. conditions: - kibana.version: ^8.8.0 + kibana.version: ^8.9.0 elastic.subscription: basic format_version: 1.1.0 icons: diff --git a/packages/universal_profiling_symbolizer/agent/input/input.yml.hbs b/packages/universal_profiling_symbolizer/agent/input/input.yml.hbs new file mode 100644 index 00000000000..2775d919b26 --- /dev/null +++ b/packages/universal_profiling_symbolizer/agent/input/input.yml.hbs @@ -0,0 +1,19 @@ +pf-elastic-symbolizer: + host: {{host}} + ssl: + enabled: {{tls_enabled}} + certificate: {{tls_certificate_path}} + key: {{tls_key_path}} + key_passphrase: {{tls_key_passphrase}} + supported_protocols: + {{#each tls_supported_protocols}} + - {{this}} + {{/each}} + cipher_suites: + {{#each tls_cipher_suites}} + - {{this}} + {{/each}} + curve_types: + {{#each tls_curve_types}} + - {{this}} + {{/each}} diff --git a/packages/universal_profiling_symbolizer/changelog.yml b/packages/universal_profiling_symbolizer/changelog.yml index 2da8fc03ac2..90b25422cbd 100644 --- a/packages/universal_profiling_symbolizer/changelog.yml +++ b/packages/universal_profiling_symbolizer/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: 8.9.0-preview + changes: + - description: Add input configuration + type: enhancement + link: https://github.com/elastic/integrations/pull/7241 - version: 8.8.1-preview changes: - description: Bump format version and remove text for hack diff --git a/packages/universal_profiling_symbolizer/manifest.yml b/packages/universal_profiling_symbolizer/manifest.yml index 52cc593bb4d..f954c88a2ce 100644 --- a/packages/universal_profiling_symbolizer/manifest.yml +++ b/packages/universal_profiling_symbolizer/manifest.yml @@ -1,10 +1,10 @@ name: profiler_symbolizer title: Universal Profiling Symbolizer -version: 8.8.1-preview +version: 8.9.0-preview categories: ["elastic_stack", "monitoring"] description: Fleet-wide, whole-system, continuous profiling with zero instrumentation. conditions: - kibana.version: ^8.8.0 + kibana.version: ^8.9.0 elastic.subscription: basic format_version: 2.8.0 icons: @@ -20,11 +20,30 @@ policy_templates: - title: universal_profiling_symbolizer description: Enhance Universal Profiling with additional symbol information type: pf-elastic-symbolizer + template_path: input.yml.hbs vars: - - name: " " + - name: host + type: text + default: localhost:8240 + - name: tls_enabled type: bool - title: " " - description: " " + default: false + - name: tls_certificate_path + type: text + - name: tls_key_path + type: text + - name: tls_key_passphrase + type: text + - name: tls_supported_protocols + type: text + multi: true + default: ["TLSv1.2", "TLSv1.3"] + - name: tls_cipher_suites + type: text + multi: true + - name: tls_curve_types + type: text + multi: true multiple: false type: integration owner: diff --git a/packages/vectra_detect/_dev/build/build.yml b/packages/vectra_detect/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/vectra_detect/_dev/build/build.yml +++ b/packages/vectra_detect/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/vectra_detect/changelog.yml b/packages/vectra_detect/changelog.yml index 6370b0d640e..383fd741416 100644 --- a/packages/vectra_detect/changelog.yml +++ b/packages/vectra_detect/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.3.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.2.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.1.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.0.1" + changes: + - description: Remove confusing error message tag prefix. + type: bugfix + link: https://github.com/elastic/integrations/pull/7105 - version: "1.0.0" changes: - description: Release Vectra Detect as GA. diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-detection.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-detection.log-expected.json index 8a7438361d5..4d864b0b4d7 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-detection.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-detection.log-expected.json @@ -8,7 +8,7 @@ "port": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -197,7 +197,7 @@ "port": 90 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -362,7 +362,7 @@ "port": 44 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -527,7 +527,7 @@ "port": 55 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -689,7 +689,7 @@ "port": 66 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-lockdown.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-lockdown.log-expected.json index 659bd56838e..784a514b2cc 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-lockdown.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-lockdown.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-17T07:33:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unlock", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-scoring.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-scoring.log-expected.json index 03020789e9a..b5cfdc49bb6 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-scoring.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-account-scoring.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-14T00:05:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -116,7 +116,7 @@ { "@timestamp": "2023-03-05T11:05:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -267,7 +267,7 @@ { "@timestamp": "2023-03-05T23:05:11.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -380,7 +380,7 @@ { "@timestamp": "2023-03-05T23:05:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -493,7 +493,7 @@ { "@timestamp": "2023-03-05T11:05:12.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-alert.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-alert.log-expected.json index 8bf791a98d5..c2fe97d0b8d 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-alert.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-alert.log-expected.json @@ -7,7 +7,7 @@ "port": 7680 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -106,7 +106,7 @@ "port": 8082 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -205,7 +205,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -304,7 +304,7 @@ "port": 8082 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -403,7 +403,7 @@ "port": 59177 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -502,7 +502,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json index 911a0f34e9d..01e14270510 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-13T20:11:58.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -108,7 +108,7 @@ { "@timestamp": "2023-02-14T09:12:14.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -191,7 +191,7 @@ { "@timestamp": "2023-02-17T22:00:04.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -284,7 +284,7 @@ { "@timestamp": "2023-02-17T22:00:04.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -377,7 +377,7 @@ { "@timestamp": "2023-02-14T04:42:07.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -470,7 +470,7 @@ { "@timestamp": "2023-02-13T22:00:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -569,7 +569,7 @@ { "@timestamp": "2023-04-26T23:48:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -661,7 +661,7 @@ { "@timestamp": "2023-04-26T23:48:37.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-campaign.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-campaign.log-expected.json index 6ef220928cc..4f09d8b56e8 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-campaign.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-campaign.log-expected.json @@ -19,7 +19,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "ADD", @@ -153,7 +153,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "START", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-health.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-health.log-expected.json index e58e43ba372..c346dd635e3 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-health.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-health.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-14T09:38:10.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-detection.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-detection.log-expected.json index adffd0f2967..ab399d898af 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-detection.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-detection.log-expected.json @@ -20,7 +20,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -246,7 +246,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -416,7 +416,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -586,7 +586,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -757,7 +757,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -900,7 +900,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1047,7 +1047,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1206,7 +1206,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1374,7 +1374,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1531,7 +1531,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1686,7 +1686,7 @@ "port": 389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-lockdown.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-lockdown.log-expected.json index 2496cddff49..6e2d456a7fd 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-lockdown.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-lockdown.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-02-14T08:52:22.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "unlock", diff --git a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-scoring.log-expected.json b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-scoring.log-expected.json index 9277cb025fb..167cc7d6102 100644 --- a/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-scoring.log-expected.json +++ b/packages/vectra_detect/data_stream/log/_dev/test/pipeline/test-host-scoring.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -152,7 +152,7 @@ { "@timestamp": "2023-03-05T11:48:24.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -328,7 +328,7 @@ { "@timestamp": "2023-03-05T18:59:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -477,7 +477,7 @@ { "@timestamp": "2023-03-05T11:48:24.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -653,7 +653,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -802,7 +802,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -951,7 +951,7 @@ { "@timestamp": "2023-03-05T18:59:02.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1100,7 +1100,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1231,7 +1231,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1383,7 +1383,7 @@ { "@timestamp": "2023-04-27T00:12:34.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1555,7 +1555,7 @@ { "@timestamp": "2023-04-26T23:48:35.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1708,7 +1708,7 @@ { "@timestamp": "2023-03-05T10:51:50.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 8ea82fc375a..44c21a21b4d 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for processing Vectra Detect logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: observer.vendor value: Vectra @@ -38,7 +38,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - trim: field: _tmp.message tag: 'trim_message' @@ -46,7 +46,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' if: ctx._tmp?.message != null - json: field: _tmp.message @@ -56,7 +56,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.vectra_timestamp tag: 'date_set_vectra_timestamp_into_timestamp' @@ -66,7 +66,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.vectra_timestamp tag: 'date_rename_vectra_timestamp_to_custom_name' @@ -77,7 +77,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.headend_addr tag: 'convert_headend_addr_to_ip' @@ -88,7 +88,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: observer.ip value: '{{{vectra_detect.log.headend_addr}}}' diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-detection.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-detection.yml index c5f1520dcb7..bbd2798f7a4 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-detection.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-detection.yml @@ -19,7 +19,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.dvchost target_field: vectra_detect.log.dvchost @@ -43,7 +43,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - json: field: json.service_info tag: 'json_to_split_service_info' @@ -51,7 +51,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.service_info target_field: vectra_detect.log.service.info @@ -69,7 +69,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.info if: ctx.vectra_detect?.log?.service?.info != null && ctx.vectra_detect.log.service.info instanceof List @@ -108,7 +108,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: user.id copy_from: vectra_detect.log.account.uid @@ -133,7 +133,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.account_info target_field: vectra_detect.log.account.info @@ -151,7 +151,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.account.info if: ctx.vectra_detect?.log?.account?.info != null && ctx.vectra_detect.log.account.info instanceof List @@ -189,7 +189,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.detection_id tag: 'convert_detection_id_to_string' @@ -200,7 +200,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.id copy_from: vectra_detect.log.detection.id @@ -223,7 +223,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.dd_dst_port tag: 'convert_dd_dst_port_to_long' @@ -234,7 +234,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.port copy_from: vectra_detect.log.dd.dst.port @@ -249,7 +249,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.ip copy_from: vectra_detect.log.dd.dst.ip @@ -281,7 +281,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.dd_bytes_rcvd tag: 'convert_dd_bytes_rcvd_to_long' @@ -292,7 +292,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.category target_field: vectra_detect.log.category @@ -307,7 +307,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.proxied_dst target_field: vectra_detect.log.proxied_dst diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-lockdown.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-lockdown.yml index 9110a22fb9c..59eeae4ebac 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-lockdown.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-lockdown.yml @@ -46,7 +46,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.user target_field: vectra_detect.log.user.name @@ -73,7 +73,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: user.target.id copy_from: vectra_detect.log.account.id @@ -98,7 +98,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: user.domain copy_from: vectra_detect.log.account.domain @@ -131,7 +131,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.user value: '{{{user.name}}}' diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-scoring.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-scoring.yml index 66467e8bcfd..3ef2a04bf2b 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-scoring.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-scoring.yml @@ -28,7 +28,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.account_id tag: 'convert_account_id_to_string' @@ -39,7 +39,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: user.target.id copy_from: vectra_detect.log.account.id @@ -60,7 +60,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: user.domain copy_from: vectra_detect.log.account.domain @@ -102,7 +102,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.quadrant target_field: vectra_detect.log.quadrant @@ -126,7 +126,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.score_decreases tag: 'convert_score_decreases_to_boolean' @@ -137,7 +137,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.privilege tag: 'convert_privilege_to_long' @@ -148,7 +148,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - json: field: json.host_access_history tag: 'json_to_split_host_access_history' @@ -156,7 +156,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.host_access_history target_field: vectra_detect.log.host.access_history @@ -173,7 +173,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.host.access_history if: ctx.vectra_detect?.log?.host?.access_history != null && ctx.vectra_detect.log.host.access_history instanceof List @@ -197,7 +197,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.host.access_history if: ctx.vectra_detect?.log?.host?.access_history != null && ctx.vectra_detect.log.host.access_history instanceof List @@ -222,7 +222,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.service_access_history target_field: vectra_detect.log.service.access_history @@ -239,7 +239,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.access_history if: ctx.vectra_detect?.log?.service?.access_history != null && ctx.vectra_detect.log.service.access_history instanceof List @@ -263,7 +263,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.access_history if: ctx.vectra_detect?.log?.service?.access_history != null && ctx.vectra_detect.log.service.access_history instanceof List diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-alert.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-alert.yml index 8cecde77eaa..c6785fae042 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-alert.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-alert.yml @@ -28,7 +28,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.proto target_field: vectra_detect.log.proto @@ -42,7 +42,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.alert_signature_id tag: 'convert_alert_signature_id_to_string' @@ -53,7 +53,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src_ip tag: 'convert_src_ip_to_ip' @@ -64,7 +64,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip copy_from: vectra_detect.log.src.ip @@ -84,7 +84,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.ip copy_from: vectra_detect.log.dest.ip @@ -109,7 +109,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.severity copy_from: vectra_detect.log.alert.severity @@ -124,7 +124,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.dest_port tag: 'convert_dest_port_to_long' @@ -135,7 +135,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.port copy_from: vectra_detect.log.dest.port @@ -150,7 +150,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.port copy_from: vectra_detect.log.src.port @@ -164,7 +164,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.timestamp tag: 'date_rename_timestamp_to_custom_name' @@ -175,7 +175,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' on_failure: - append: field: error.message diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-audit.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-audit.yml index 6c1727f34e6..35ef3b18b46 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-audit.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-audit.yml @@ -58,7 +58,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip copy_from: vectra_detect.log.source.ip diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-campaign.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-campaign.yml index a1e9e900e44..666c5f9b02c 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-campaign.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-campaign.yml @@ -22,7 +22,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{vectra_detect.log.dest.ip}}}' @@ -54,7 +54,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.id copy_from: vectra_detect.log.campaign.id @@ -85,7 +85,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.ip value: '{{{vectra_detect.log.src.ip}}}' @@ -109,7 +109,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.src_name target_field: vectra_detect.log.src.name @@ -128,7 +128,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.id copy_from: vectra_detect.log.src.hid @@ -143,7 +143,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: field: json.timestamp tag: 'date_rename_timestamp_into_custom' @@ -154,7 +154,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.campaign_name target_field: vectra_detect.log.campaign.name @@ -174,7 +174,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: related.hosts value: '{{{observer.hostname}}}' diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-health.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-health.yml index 82eeff0c258..b1d153f5619 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-health.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-health.yml @@ -30,7 +30,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip copy_from: vectra_detect.log.source.ip diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-detection.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-detection.yml index 8c7c498e919..ce69f09d3e4 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-detection.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-detection.yml @@ -20,7 +20,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.port copy_from: vectra_detect.log.dd.dst.port @@ -35,7 +35,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: destination.ip copy_from: vectra_detect.log.dd.dst.ip @@ -67,7 +67,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.id copy_from: vectra_detect.log.detection.id @@ -95,7 +95,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.host_name target_field: vectra_detect.log.host.name @@ -127,7 +127,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.dd_proto target_field: vectra_detect.log.dd.proto @@ -146,7 +146,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.network.egress.bytes copy_from: vectra_detect.log.bytes.sent @@ -166,7 +166,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.network.ingress.bytes copy_from: vectra_detect.log.bytes.received @@ -197,7 +197,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.protocol target_field: vectra_detect.log.protocol @@ -229,7 +229,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: source.ip copy_from: vectra_detect.log.host.ip @@ -277,7 +277,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.account_name target_field: vectra_detect.log.account.name @@ -315,7 +315,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.normal_servers target_field: vectra_detect.log.normal.servers @@ -334,7 +334,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.d_type_vname target_field: vectra_detect.log.d_type.vname @@ -353,7 +353,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.dd_bytes_rcvd tag: 'convert_dd_bytes_rcvd_to_long' @@ -364,7 +364,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.dos_type target_field: vectra_detect.log.dos_type @@ -379,7 +379,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.networks target_field: vectra_detect.log.networks @@ -511,7 +511,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.matched_user_agent target_field: vectra_detect.log.matched.user_agent @@ -530,7 +530,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.reply_cache_control target_field: vectra_detect.log.reply_cache_control @@ -545,7 +545,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: host.ip value: '{{{vectra_detect.log.ip}}}' @@ -570,7 +570,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.proxied_dst target_field: vectra_detect.log.proxied_dst @@ -582,7 +582,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.service_info target_field: vectra_detect.log.service.info @@ -600,7 +600,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.info if: ctx.vectra_detect?.log?.service?.info != null && ctx.vectra_detect.log.service.info instanceof List @@ -626,7 +626,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.account_info target_field: vectra_detect.log.account.info @@ -644,7 +644,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.account.info if: ctx.vectra_detect?.log?.account?.info != null && ctx.vectra_detect.log.account.info instanceof List @@ -677,7 +677,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.account target_field: vectra_detect.log.account.id diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-lockdown.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-lockdown.yml index 61ac089ec37..f4fb4663c82 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-lockdown.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-lockdown.yml @@ -28,7 +28,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: event.outcome value: success @@ -67,7 +67,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.href target_field: vectra_detect.log.href @@ -83,7 +83,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.host_id tag: 'convert_host_id_to_string' @@ -94,7 +94,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.id copy_from: vectra_detect.log.host.id diff --git a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-scoring.yml b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-scoring.yml index 2c3d290d482..5b83ab95c3a 100644 --- a/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-scoring.yml +++ b/packages/vectra_detect/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-scoring.yml @@ -34,7 +34,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.dvchost target_field: vectra_detect.log.dvchost @@ -55,7 +55,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.host_groups if: ctx.json?.host_groups != null && ctx.json.host_groups instanceof List @@ -105,7 +105,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.host_groups if: ctx.json?.host_groups != null && ctx.json.host_groups instanceof List @@ -119,7 +119,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.host_groups if: ctx.json?.host_groups != null && ctx.json.host_groups instanceof List @@ -133,7 +133,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.host_groups if: ctx.json?.host_groups != null && ctx.json.host_groups instanceof List @@ -157,7 +157,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: json.host_groups if: ctx.json?.host_groups != null && ctx.json.host_groups instanceof List @@ -184,7 +184,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - set: field: host.id copy_from: vectra_detect.log.host.id @@ -204,7 +204,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - append: field: host.ip value: '{{{vectra_detect.log.host.ip}}}' @@ -264,7 +264,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.quadrant target_field: vectra_detect.log.quadrant @@ -288,7 +288,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.score_decreases tag: 'convert_score_decreases_to_boolean' @@ -299,7 +299,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.src_key_asset tag: 'convert_src_key_asset_to_boolean' @@ -310,7 +310,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.dst_key_asset tag: 'convert_dst_key_asset_to_boolean' @@ -321,7 +321,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - convert: field: json.certainty tag: 'convert_certainty_to_long' @@ -332,7 +332,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.sensor target_field: vectra_detect.log.sensor @@ -348,7 +348,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.detection_profile target_field: vectra_detect.log.detection.profile @@ -364,7 +364,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.account_access_history target_field: vectra_detect.log.account.access_history @@ -381,7 +381,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.account.access_history if: ctx.vectra_detect?.log?.account?.access_history != null && ctx.vectra_detect.log.account.access_history instanceof List @@ -405,7 +405,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.account.access_history if: ctx.vectra_detect?.log?.account?.access_history != null && ctx.vectra_detect.log.account.access_history instanceof List @@ -439,7 +439,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: field: json.service_access_history target_field: vectra_detect.log.service.access_history @@ -456,7 +456,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.access_history if: ctx.vectra_detect?.log?.service?.access_history != null && ctx.vectra_detect.log.service.access_history instanceof List @@ -480,7 +480,7 @@ processors: on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag fail-{{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - foreach: field: vectra_detect.log.service.access_history if: ctx.vectra_detect?.log?.service?.access_history != null && ctx.vectra_detect.log.service.access_history instanceof List diff --git a/packages/vectra_detect/data_stream/log/sample_event.json b/packages/vectra_detect/data_stream/log/sample_event.json index a19da914233..ffe2d1ef1d2 100644 --- a/packages/vectra_detect/data_stream/log/sample_event.json +++ b/packages/vectra_detect/data_stream/log/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "0634707b-5b23-4d44-a21b-078537ad123e", diff --git a/packages/vectra_detect/docs/README.md b/packages/vectra_detect/docs/README.md index 872c8d210ac..3b7113d9be2 100644 --- a/packages/vectra_detect/docs/README.md +++ b/packages/vectra_detect/docs/README.md @@ -62,7 +62,7 @@ An example event for `log` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "0634707b-5b23-4d44-a21b-078537ad123e", diff --git a/packages/vectra_detect/kibana/tags.yml b/packages/vectra_detect/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/vectra_detect/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/vectra_detect/manifest.yml b/packages/vectra_detect/manifest.yml index ccf191f2666..cc58a384ede 100644 --- a/packages/vectra_detect/manifest.yml +++ b/packages/vectra_detect/manifest.yml @@ -1,15 +1,17 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: vectra_detect title: Vectra Detect -version: "1.0.0" +version: "1.3.0" source: license: Elastic-2.0 description: Collect logs from Vectra Detect with Elastic Agent. type: integration categories: ["security", "network_security"] conditions: - kibana.version: ^8.3.0 - elastic.subscription: basic + kibana: + version: ^8.3.0 + elastic: + subscription: basic screenshots: - src: /img/account-detection-dashboard.png title: Account Detection Dashboard @@ -69,3 +71,4 @@ policy_templates: description: Collecting logs from Vectra Detect instances via udp input. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/websphere_application_server/_dev/build/docs/README.md b/packages/websphere_application_server/_dev/build/docs/README.md index 44d2c8c29bb..671b27aaba0 100644 --- a/packages/websphere_application_server/_dev/build/docs/README.md +++ b/packages/websphere_application_server/_dev/build/docs/README.md @@ -11,6 +11,14 @@ This integration uses Prometheus to collect above metrics. To open Prometheus endpoint read following [instructions](https://www.ibm.com/docs/en/was/9.0.5?topic=mosh-displaying-pmi-metrics-in-prometheus-format-metrics-app). +## Compatibility + +This integration has been tested against WebSphere Application Server traditional version `9.0.5.11`. + +### Troubleshooting + +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``JDBC``, ``Servlet``, ``Session Manager`` and ``ThreadPool`` data stream's indices. + ## JDBC This data stream collects JDBC (Java Database Connectivity) related metrics. diff --git a/packages/websphere_application_server/changelog.yml b/packages/websphere_application_server/changelog.yml index 448acfa518b..283c278817d 100644 --- a/packages/websphere_application_server/changelog.yml +++ b/packages/websphere_application_server/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: "0.9.0" + changes: + - description: Update dashboards, visualizations and screenshots. + type: enhancement + link: https://github.com/elastic/integrations/pull/7510 +- version: "0.8.1" + changes: + - description: Resolve the conflict in host.ip field. + type: bugfix + link: https://github.com/elastic/integrations/pull/7507 +- version: "0.8.0" + changes: + - description: Add compatibility section and update the title. + type: enhancement + link: https://github.com/elastic/integrations/pull/7505 - version: "0.7.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/websphere_application_server/data_stream/jdbc/fields/ecs.yml b/packages/websphere_application_server/data_stream/jdbc/fields/ecs.yml index 392e2eb7c5a..7bf8e76ce5b 100644 --- a/packages/websphere_application_server/data_stream/jdbc/fields/ecs.yml +++ b/packages/websphere_application_server/data_stream/jdbc/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: ecs.version +- external: ecs + name: host.ip - external: ecs name: server.address - external: ecs diff --git a/packages/websphere_application_server/data_stream/servlet/fields/ecs.yml b/packages/websphere_application_server/data_stream/servlet/fields/ecs.yml index 95994b26bcb..ffd8ccfb54d 100644 --- a/packages/websphere_application_server/data_stream/servlet/fields/ecs.yml +++ b/packages/websphere_application_server/data_stream/servlet/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: ecs.version +- external: ecs + name: host.ip - external: ecs name: server.address - external: ecs diff --git a/packages/websphere_application_server/data_stream/session_manager/fields/ecs.yml b/packages/websphere_application_server/data_stream/session_manager/fields/ecs.yml index 392e2eb7c5a..7bf8e76ce5b 100644 --- a/packages/websphere_application_server/data_stream/session_manager/fields/ecs.yml +++ b/packages/websphere_application_server/data_stream/session_manager/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: ecs.version +- external: ecs + name: host.ip - external: ecs name: server.address - external: ecs diff --git a/packages/websphere_application_server/data_stream/threadpool/fields/ecs.yml b/packages/websphere_application_server/data_stream/threadpool/fields/ecs.yml index 392e2eb7c5a..7bf8e76ce5b 100644 --- a/packages/websphere_application_server/data_stream/threadpool/fields/ecs.yml +++ b/packages/websphere_application_server/data_stream/threadpool/fields/ecs.yml @@ -1,5 +1,7 @@ - external: ecs name: ecs.version +- external: ecs + name: host.ip - external: ecs name: server.address - external: ecs diff --git a/packages/websphere_application_server/docs/README.md b/packages/websphere_application_server/docs/README.md index f18e4b652a3..64f4be2b0fd 100644 --- a/packages/websphere_application_server/docs/README.md +++ b/packages/websphere_application_server/docs/README.md @@ -11,6 +11,14 @@ This integration uses Prometheus to collect above metrics. To open Prometheus endpoint read following [instructions](https://www.ibm.com/docs/en/was/9.0.5?topic=mosh-displaying-pmi-metrics-in-prometheus-format-metrics-app). +## Compatibility + +This integration has been tested against WebSphere Application Server traditional version `9.0.5.11`. + +### Troubleshooting + +If host.ip is shown conflicted under ``metrics-*`` data view, then this issue can be solved by [reindexing](https://www.elastic.co/guide/en/elasticsearch/reference/current/use-a-data-stream.html#reindex-with-a-data-stream) the ``JDBC``, ``Servlet``, ``Session Manager`` and ``ThreadPool`` data stream's indices. + ## JDBC This data stream collects JDBC (Java Database Connectivity) related metrics. @@ -128,6 +136,7 @@ An example event for `jdbc` looks as following: | event.kind | Event kind | constant_keyword | | event.module | Event module | constant_keyword | | event.type | Event type | constant_keyword | +| host.ip | Host ip addresses. | ip | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | @@ -253,6 +262,7 @@ An example event for `servlet` looks as following: | event.kind | Event kind | constant_keyword | | event.module | Event module | constant_keyword | | event.type | Event type | constant_keyword | +| host.ip | Host ip addresses. | ip | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | @@ -403,6 +413,7 @@ An example event for `session_manager` looks as following: | event.kind | Event kind | constant_keyword | | event.module | Event module | constant_keyword | | event.type | Event type | constant_keyword | +| host.ip | Host ip addresses. | ip | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | @@ -540,6 +551,7 @@ An example event for `threadpool` looks as following: | event.kind | Event kind | constant_keyword | | event.module | Event module | constant_keyword | | event.type | Event type | constant_keyword | +| host.ip | Host ip addresses. | ip | | server.address | Some event server addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | | service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | diff --git a/packages/websphere_application_server/img/websphere_application_server-jdbc-dashboard-screenshot.png b/packages/websphere_application_server/img/websphere_application_server-jdbc-dashboard-screenshot.png index b6dea4a0b3a..7b8009adc98 100644 Binary files a/packages/websphere_application_server/img/websphere_application_server-jdbc-dashboard-screenshot.png and b/packages/websphere_application_server/img/websphere_application_server-jdbc-dashboard-screenshot.png differ diff --git a/packages/websphere_application_server/img/websphere_application_server-servlet-dashboard-screenshot.png b/packages/websphere_application_server/img/websphere_application_server-servlet-dashboard-screenshot.png index a405e0f00d2..f410000c1a5 100644 Binary files a/packages/websphere_application_server/img/websphere_application_server-servlet-dashboard-screenshot.png and b/packages/websphere_application_server/img/websphere_application_server-servlet-dashboard-screenshot.png differ diff --git a/packages/websphere_application_server/img/websphere_application_server-session_manager-dashboard-screenshot.png b/packages/websphere_application_server/img/websphere_application_server-session_manager-dashboard-screenshot.png index 11a79e56c32..1c409618f7b 100644 Binary files a/packages/websphere_application_server/img/websphere_application_server-session_manager-dashboard-screenshot.png and b/packages/websphere_application_server/img/websphere_application_server-session_manager-dashboard-screenshot.png differ diff --git a/packages/websphere_application_server/img/websphere_application_server-threadpool-dashboard-screenshot.png b/packages/websphere_application_server/img/websphere_application_server-threadpool-dashboard-screenshot.png index c543881802c..2bb1157e7db 100644 Binary files a/packages/websphere_application_server/img/websphere_application_server-threadpool-dashboard-screenshot.png and b/packages/websphere_application_server/img/websphere_application_server-threadpool-dashboard-screenshot.png differ diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-0828ba40-c07b-11ec-8552-f3dc1a6b95f9.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-0828ba40-c07b-11ec-8552-f3dc1a6b95f9.json index 8fb6d47c2b5..0ef67642c19 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-0828ba40-c07b-11ec-8552-f3dc1a6b95f9.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-0828ba40-c07b-11ec-8552-f3dc1a6b95f9.json @@ -19,7 +19,7 @@ "label": "Persistent Stores Data Read", "operationType": "last_value", "params": { - "showArrayValues": true, + "showArrayValues": false, "sortField": "@timestamp" }, "scale": "ratio", @@ -32,6 +32,7 @@ "label": "Timestamp", "operationType": "date_histogram", "params": { + "dropPartials": false, "includeEmptyRows": true, "interval": "auto" }, @@ -46,11 +47,11 @@ "params": { "missingBucket": false, "orderBy": { - "fallback": true, - "type": "alphabetical" + "columnId": "1dc49faf-ed90-489c-94cc-b145a28cba19", + "type": "column" }, - "orderDirection": "asc", - "otherBucket": true, + "orderDirection": "desc", + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -84,46 +85,7 @@ } } }, - "filters": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "c7353feb-f346-4786-b0b3-27ed0efff424", - "key": "websphere_application_server.session_manager.persistent_stores.data_read", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "websphere_application_server.session_manager.persistent_stores.data_read" - } - } - }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "cdf11d4d-86e4-43a0-86a7-18792dcb355f", - "key": "websphere_application_server.session_manager.persistent_stores.data_written", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "websphere_application_server.session_manager.persistent_stores.data_written" - } - } - } - ], + "filters": [], "query": { "language": "kuery", "query": "" @@ -187,7 +149,8 @@ }, "yRightExtent": { "mode": "full" - } + }, + "yTitle": "Count" } }, "title": "Persistent Store Data Read and Written [Metrics WebSphere Application Server]", @@ -199,25 +162,10 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-79027b05-459f-4773-823b-238f4e0b907a", "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "c7353feb-f346-4786-b0b3-27ed0efff424", - "type": "index-pattern" - }, - { - "id": "metrics-*", - "name": "cdf11d4d-86e4-43a0-86a7-18792dcb355f", - "type": "index-pattern" } ], "type": "lens" diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-37972440-b49d-11ec-9a7c-ef3101c300f1.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-37972440-b49d-11ec-9a7c-ef3101c300f1.json index 70b6cdc4383..b2e4f8ff282 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-37972440-b49d-11ec-9a7c-ef3101c300f1.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-37972440-b49d-11ec-9a7c-ef3101c300f1.json @@ -19,11 +19,11 @@ "params": { "missingBucket": false, "orderBy": { - "fallback": false, - "type": "alphabetical" + "columnId": "9915f27a-f0d1-4aa3-ac79-eff63ea4b7a9", + "type": "column" }, - "orderDirection": "asc", - "otherBucket": true, + "orderDirection": "desc", + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -35,9 +35,16 @@ "9915f27a-f0d1-4aa3-ac79-eff63ea4b7a9": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.total.operations_calls: *" + }, "isBucketed": false, "label": "Total operations calls", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.total.operations_calls" }, @@ -124,11 +131,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-5cb0751e-cee8-41d7-a221-1c89264c3c7e", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-3b877140-b49d-11ec-9a7c-ef3101c300f1.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-3b877140-b49d-11ec-9a7c-ef3101c300f1.json index 1144df4021b..bdc9ebc7ee5 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-3b877140-b49d-11ec-9a7c-ef3101c300f1.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-3b877140-b49d-11ec-9a7c-ef3101c300f1.json @@ -17,27 +17,48 @@ "00acb34f-ae34-439a-9cb7-45a09bb69e15": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.closed: *" + }, "isBucketed": false, "label": "Closed Connections", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.closed" }, "03351030-51ad-4c19-9e9e-9a550b2e23e4": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.allocated: *" + }, "isBucketed": false, "label": "Allocated Connections", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.allocated" }, "25cdb2ff-2d42-4703-9419-2375ef16c439": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.created: *" + }, "isBucketed": false, "label": "Created Connections", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.created" }, @@ -61,11 +82,11 @@ "params": { "missingBucket": false, "orderBy": { - "fallback": false, - "type": "alphabetical" + "columnId": "03351030-51ad-4c19-9e9e-9a550b2e23e4", + "type": "column" }, - "orderDirection": "asc", - "otherBucket": true, + "orderDirection": "desc", + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -77,9 +98,16 @@ "e7bed513-0fe1-460d-affc-4186777ff41a": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.returned: *" + }, "isBucketed": false, "label": "Returned Connections", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.returned" } @@ -92,7 +120,7 @@ "filters": [], "query": { "language": "kuery", - "query": "websphere_application_server.jdbc.connection.created \u003e 0" + "query": "websphere_application_server.jdbc.connection.created \u003e 0 or websphere_application_server.jdbc.connection.closed \u003e 0 or websphere_application_server.jdbc.connection.allocated \u003e 0 or websphere_application_server.jdbc.connection.returned \u003e 0" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -145,7 +173,8 @@ }, "yRightExtent": { "mode": "full" - } + }, + "yTitle": "Count" } }, "title": "Number of Created, Closed, Allocated and Returned Connections [Metrics WebSphere Application Server]", @@ -157,11 +186,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-6a787cb2-6500-4f46-bcc0-56ba379b2ec1", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-3fe9e100-b49d-11ec-9a7c-ef3101c300f1.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-3fe9e100-b49d-11ec-9a7c-ef3101c300f1.json index cb4f847400c..87955f1810a 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-3fe9e100-b49d-11ec-9a7c-ef3101c300f1.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-3fe9e100-b49d-11ec-9a7c-ef3101c300f1.json @@ -26,9 +26,16 @@ "a2c8801f-9e82-4502-a4db-8290bf4b4b7e": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.free: *" + }, "isBucketed": false, "label": "Free Connections", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.free" }, @@ -44,7 +51,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -115,7 +122,7 @@ } } }, - "title": "Number of Free and Timed Out Connections [Metrics WebSphere Application Server]", + "title": "Number of Free Connections [Metrics WebSphere Application Server]", "visualizationType": "lnsXY" }, "coreMigrationVersion": "8.3.0", @@ -124,11 +131,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-093d1982-684a-40db-bed9-9426559b90ee", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-426d3360-bae6-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-426d3360-bae6-11ec-b244-51e5cddeab04.json index 2bfe44bfab3..64882b5679f 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-426d3360-bae6-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-426d3360-bae6-11ec-b244-51e5cddeab04.json @@ -24,7 +24,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -34,10 +34,18 @@ "sourceField": "websphere_application_server.threadpool.name" }, "91f4b685-d7b8-469f-b496-143f0f130cfe": { + "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.threads.cleared: *" + }, "isBucketed": false, - "label": "Median of websphere_application_server.threadpool.threads.cleared", - "operationType": "median", + "label": "Cleared Threads", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.threads.cleared" }, @@ -124,11 +132,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-c135b7c4-fd05-4a15-84d3-a959e24b077b", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-43d23d70-baed-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-43d23d70-baed-11ec-b244-51e5cddeab04.json index 1915b256487..5d48d3e5fd2 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-43d23d70-baed-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-43d23d70-baed-11ec-b244-51e5cddeab04.json @@ -27,9 +27,16 @@ "816bda95-3cd2-410e-b17c-8ba494196cf4": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.threads.stopped.declared: *" + }, "isBucketed": false, "label": "Declared Stopped Threads", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.threads.stopped.declared" }, @@ -45,7 +52,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -125,11 +132,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-5b4f04cc-fca5-4e2e-b12e-a08d6a89d693", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-443e1ff0-b49d-11ec-9a7c-ef3101c300f1.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-443e1ff0-b49d-11ec-9a7c-ef3101c300f1.json index e61b1547172..6029eae8b57 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-443e1ff0-b49d-11ec-9a7c-ef3101c300f1.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-443e1ff0-b49d-11ec-9a7c-ef3101c300f1.json @@ -23,7 +23,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -47,9 +47,16 @@ "fe52b8cf-86bc-4b20-a7c0-d3398ccdc4ea": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.jdbc.connection.total.in_use: *" + }, "isBucketed": false, "label": "Total Connections In Use", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.jdbc.connection.total.in_use" } @@ -124,11 +131,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-f73c674c-32f9-437c-9556-c02eef1a0871", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-86426870-baec-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-86426870-baec-11ec-b244-51e5cddeab04.json index 66d0aa8f485..aa1949c749b 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-86426870-baec-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-86426870-baec-11ec-b244-51e5cddeab04.json @@ -15,9 +15,16 @@ "2b1baf93-2b7f-430d-9048-f11cb2bfb65e": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.threads.active: *" + }, "isBucketed": false, "label": "Active Threads", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.threads.active" }, @@ -45,7 +52,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -125,11 +132,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-1decd051-dbf6-4a80-aa20-85278fedc2d4", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-888801c0-bae3-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-888801c0-bae3-11ec-b244-51e5cddeab04.json index 5bfb75349d9..3a8e6a62013 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-888801c0-bae3-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-888801c0-bae3-11ec-b244-51e5cddeab04.json @@ -16,18 +16,32 @@ "4c4a2a46-6244-4e6b-8926-c1c60b6b9df4": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.total.created: *" + }, "isBucketed": false, "label": "Threads Created", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.total.created" }, "b093e53a-a7e7-4b74-af63-b3da68cf3989": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.total.destroyed: *" + }, "isBucketed": false, "label": "Threads Destroyed", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.total.destroyed" }, @@ -43,7 +57,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -73,7 +87,7 @@ "filters": [], "query": { "language": "kuery", - "query": "websphere_application_server.threadpool.total.created : * and websphere_application_server.threadpool.total.destroyed : * " + "query": "websphere_application_server.threadpool.total.created : * or websphere_application_server.threadpool.total.destroyed : * " }, "visualization": { "axisTitlesVisibilitySettings": { @@ -124,7 +138,8 @@ }, "yRightExtent": { "mode": "full" - } + }, + "yTitle": "Thread Count" } }, "title": "Number of Threads Created and Destroyed [Metrics WebSphere Application Server]", @@ -136,11 +151,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-5c2223d3-b3ba-45a2-848f-2a5e4ab9264c", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-8ce6ed80-b59d-11ec-888d-b1230de080fd.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-8ce6ed80-b59d-11ec-888d-b1230de080fd.json index 42adb54593f..a6723809043 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-8ce6ed80-b59d-11ec-888d-b1230de080fd.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-8ce6ed80-b59d-11ec-888d-b1230de080fd.json @@ -17,9 +17,16 @@ "146c0baa-3fa2-4ae9-aa73-a4d7669d55c1": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.servlet.requests.processed: *" + }, "isBucketed": false, "label": "Requests Processed", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.servlet.requests.processed" }, @@ -31,11 +38,11 @@ "params": { "missingBucket": false, "orderBy": { - "fallback": false, - "type": "alphabetical" + "columnId": "146c0baa-3fa2-4ae9-aa73-a4d7669d55c1", + "type": "column" }, - "orderDirection": "asc", - "otherBucket": true, + "orderDirection": "desc", + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -51,7 +58,7 @@ "label": "Responses Processed", "operationType": "formula", "params": { - "formula": "median(websphere_application_server.servlet.responses.processed)", + "formula": "last_value(websphere_application_server.servlet.responses.processed)", "isFormulaBroken": false }, "references": [ @@ -62,9 +69,16 @@ "302ef164-d49c-4a57-9a96-888917e2c880X0": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.servlet.responses.processed: *" + }, "isBucketed": false, "label": "Part of Responses Processed", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.servlet.responses.processed" }, @@ -89,7 +103,7 @@ "filters": [], "query": { "language": "kuery", - "query": "websphere_application_server.servlet.requests.processed \u003e 0 and websphere_application_server.servlet.responses.processed \u003e 0" + "query": "websphere_application_server.servlet.requests.processed \u003e 0 or websphere_application_server.servlet.responses.processed \u003e 0" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -135,12 +149,14 @@ "yRight": true }, "valueLabels": "hide", + "valuesInLegend": false, "yLeftExtent": { "mode": "full" }, "yRightExtent": { "mode": "full" - } + }, + "yTitle": "Count" } }, "title": "Number of Processed Requests and Responses [Metrics WebSphere Application Server]", @@ -152,11 +168,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-6bff5182-8367-4e11-8b9a-69bfe903149c", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-b8c2dff0-baec-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-b8c2dff0-baec-11ec-b244-51e5cddeab04.json index b25b80f3be5..b43bcf48694 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-b8c2dff0-baec-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-b8c2dff0-baec-11ec-b244-51e5cddeab04.json @@ -15,9 +15,16 @@ "1b4e544c-2c46-4a4c-bff2-5f16ff6d9270": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.threads.total: *" + }, "isBucketed": false, "label": "Total Threads", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.threads.total" }, @@ -33,7 +40,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -125,11 +132,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-8d78bbff-634f-4aff-9c25-d3f211b564eb", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-d2cf3ac0-baeb-11ec-b244-51e5cddeab04.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-d2cf3ac0-baeb-11ec-b244-51e5cddeab04.json index 398c3695135..6937bfae131 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-d2cf3ac0-baeb-11ec-b244-51e5cddeab04.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-d2cf3ac0-baeb-11ec-b244-51e5cddeab04.json @@ -25,7 +25,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -47,7 +47,7 @@ "type": "column" }, "orderDirection": "desc", - "otherBucket": true, + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -59,9 +59,16 @@ "83043110-a317-4821-8372-79219d3eae1e": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.threadpool.threads.total: *" + }, "isBucketed": false, "label": "Total Threads", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.threadpool.threads.total" } @@ -94,7 +101,11 @@ "layerId": "407fa94b-9ce9-4ac2-9ca6-1c43dea9bbd0", "layerType": "data", "rowHeight": "single", - "rowHeightLines": 1 + "rowHeightLines": 1, + "sorting": { + "columnId": "83043110-a317-4821-8372-79219d3eae1e", + "direction": "desc" + } } }, "title": "Thread Pool Size [Metrics WebSphere Application Server]", @@ -106,11 +117,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-407fa94b-9ce9-4ac2-9ca6-1c43dea9bbd0", diff --git a/packages/websphere_application_server/kibana/lens/websphere_application_server-e6d7d480-b59d-11ec-888d-b1230de080fd.json b/packages/websphere_application_server/kibana/lens/websphere_application_server-e6d7d480-b59d-11ec-888d-b1230de080fd.json index 8d5af9d8e4e..795411c54e6 100644 --- a/packages/websphere_application_server/kibana/lens/websphere_application_server-e6d7d480-b59d-11ec-888d-b1230de080fd.json +++ b/packages/websphere_application_server/kibana/lens/websphere_application_server-e6d7d480-b59d-11ec-888d-b1230de080fd.json @@ -28,16 +28,16 @@ "72a036b6-01af-4812-9bcf-f43429e39eb7": { "dataType": "string", "isBucketed": true, - "label": "Top values of websphere_application_server.servlet.appname", + "label": "Top values of websphere_application_server.servlet.app_name", "operationType": "terms", "params": { "missingBucket": false, "orderBy": { - "fallback": false, - "type": "alphabetical" + "columnId": "990fce2d-1026-4d37-85ed-088d392b41f9", + "type": "column" }, - "orderDirection": "asc", - "otherBucket": true, + "orderDirection": "desc", + "otherBucket": false, "parentFormat": { "id": "terms" }, @@ -49,18 +49,32 @@ "990fce2d-1026-4d37-85ed-088d392b41f9": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.servlet.loaded: *" + }, "isBucketed": false, "label": "Loaded Servlets", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.servlet.loaded" }, "d2e271e9-cc11-46df-aae0-121042e38bfa": { "customLabel": true, "dataType": "number", + "filter": { + "language": "kuery", + "query": "websphere_application_server.servlet.reloaded: *" + }, "isBucketed": false, "label": "Reloaded Servlets", - "operationType": "median", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, "scale": "ratio", "sourceField": "websphere_application_server.servlet.reloaded" } @@ -73,7 +87,7 @@ "filters": [], "query": { "language": "kuery", - "query": "websphere_application_server.servlet.loaded \u003e 0 and websphere_application_server.servlet.reloaded \u003e 0" + "query": "websphere_application_server.servlet.loaded \u003e 0 or websphere_application_server.servlet.reloaded \u003e 0" }, "visualization": { "axisTitlesVisibilitySettings": { @@ -124,7 +138,8 @@ }, "yRightExtent": { "mode": "full" - } + }, + "yTitle": "Count" } }, "title": "Number of Loaded and Reloaded Servlets [Metrics WebSphere Application Server]", @@ -136,11 +151,6 @@ "lens": "8.3.0" }, "references": [ - { - "id": "metrics-*", - "name": "indexpattern-datasource-current-indexpattern", - "type": "index-pattern" - }, { "id": "metrics-*", "name": "indexpattern-datasource-layer-96a84b63-1fad-48c6-b0de-179dcbfcd741", diff --git a/packages/websphere_application_server/manifest.yml b/packages/websphere_application_server/manifest.yml index 5a3e807e7f8..a0080fe0961 100644 --- a/packages/websphere_application_server/manifest.yml +++ b/packages/websphere_application_server/manifest.yml @@ -1,7 +1,7 @@ format_version: 1.0.0 name: websphere_application_server title: WebSphere Application Server -version: "0.7.0" +version: "0.9.0" license: basic description: Collects metrics from IBM WebSphere Application Server with Elastic Agent. type: integration @@ -99,7 +99,7 @@ policy_templates: multi: false required: false show_user: false - title: Metrics using prometheus + title: Collect WebSphere Application Server metrics description: Collecting metrics from WebSphere Application Server using prometheus. owner: github: elastic/obs-infraobs-integrations diff --git a/packages/windows/_dev/build/docs/README.md b/packages/windows/_dev/build/docs/README.md index 05f5e30c276..e2e9ffaf049 100644 --- a/packages/windows/_dev/build/docs/README.md +++ b/packages/windows/_dev/build/docs/README.md @@ -82,6 +82,42 @@ the events from Windows. The filter shown below is equivalent to ## Logs reference +### AppLocker/EXE and DLL + +The Windows `applocker_exe_and_dll` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/EXE and DLL` event log. + +{{event "applocker_exe_and_dll"}} + +{{fields "applocker_exe_and_dll"}} + +### AppLocker/MSI and Script + +The Windows `applocker_msi_and_script` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/MSI and Script` event log. + +{{event "applocker_msi_and_script"}} + +{{fields "applocker_msi_and_script"}} + +### AppLocker/Packaged app-Deployment + +The Windows `applocker_packaged_app_deployment` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/Packaged app-Deployment` event log. + +{{event "applocker_packaged_app_deployment"}} + +{{fields "applocker_packaged_app_deployment"}} + +### AppLocker/Packaged app-Execution + +The Windows `applocker_packaged_app_execution` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/Packaged app-Execution` event log. + +{{event "applocker_packaged_app_execution"}} + +{{fields "applocker_packaged_app_execution"}} + ### Forwarded The Windows `forwarded` data stream provides events from the Windows diff --git a/packages/windows/_dev/deploy/docker/files/config.yml b/packages/windows/_dev/deploy/docker/files/config.yml index aa311b5ba94..d73b0c670d9 100644 --- a/packages/windows/_dev/deploy/docker/files/config.yml +++ b/packages/windows/_dev/deploy/docker/files/config.yml @@ -175,3 +175,179 @@ rules: "splunk_server": "69819b6ce1bd" } } + - path: /services/search/jobs/export + user: test + password: test + methods: + - post + query_params: + index_earliest: "{index_earliest:[0-9]+}" + index_latest: "{index_latest:[0-9]+}" + output_mode: json + search: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" | streamstats max(_indextime) AS max_indextime' + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + { + "preview": false, + "offset": 194, + "lastrow": true, + "result": { + "_bkt": "main~0~1212176D-89E1-485D-89E6-3ADC276CCA38", + "_cd": "0:315", + "_indextime": "1622471463", + "_raw": "800303000x8000000000000000154247Microsoft-Windows-AppLocker/EXE and DLLTOPSYLL.local3EXE{00000000-0000-0000-0000-000000000000}1-1-S-1-5-21-1133191089-1850170202-1535859923-20031927116101%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE3211D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F572O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.010x14fcb794C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe", + "_serial": "194", + "_si": [ + "69819b6ce1bd", + "main" + ], + "_sourcetype": "XmlWinEventLog:Security", + "_time": "2021-05-25 13:11:45.000 UTC", + "host": "VAGRANT", + "index": "main", + "linecount": "1", + "max_indextime": "1622471606", + "source": "WinEventLog:Security", + "sourcetype": "XmlWinEventLog:Security", + "splunk_server": "69819b6ce1bd" + } + } + - path: /services/search/jobs/export + user: test + password: test + methods: + - post + query_params: + index_earliest: "{index_earliest:[0-9]+}" + index_latest: "{index_latest:[0-9]+}" + output_mode: json + search: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script" | streamstats max(_indextime) AS max_indextime' + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + { + "preview": false, + "offset": 194, + "lastrow": true, + "result": { + "_bkt": "main~0~1212176D-89E1-485D-89E6-3ADC276CCA38", + "_cd": "0:315", + "_indextime": "1622471463", + "_raw": "800603000x4000000000000000239Microsoft-Windows-AppLocker/MSI and Scriptel33t-b00k-16SCRIPT{00000000-0000-0000-0000-000000000000}1-1-S-1-5-21-2707992022-4034939591-3454028951-100125192124%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM132D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B0165O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.000x4c18f117C:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1", + "_serial": "194", + "_si": [ + "69819b6ce1bd", + "main" + ], + "_sourcetype": "XmlWinEventLog:Security", + "_time": "2021-05-25 13:11:45.000 UTC", + "host": "VAGRANT", + "index": "main", + "linecount": "1", + "max_indextime": "1622471606", + "source": "WinEventLog:Security", + "sourcetype": "XmlWinEventLog:Security", + "splunk_server": "69819b6ce1bd" + } + } + - path: /services/search/jobs/export + user: test + password: test + methods: + - post + query_params: + index_earliest: "{index_earliest:[0-9]+}" + index_latest: "{index_latest:[0-9]+}" + output_mode: json + search: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/Packaged app-Deployment" | streamstats max(_indextime) AS max_indextime' + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + { + "preview": false, + "offset": 194, + "lastrow": true, + "result": { + "_bkt": "main~0~1212176D-89E1-485D-89E6-3ADC276CCA38", + "_cd": "0:315", + "_indextime": "1622471463", + "_raw": "802304000x10000000000000006269Microsoft-Windows-AppLocker/Packaged app-DeploymentWIN1012009LL.local4APPX{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}39(Default Rule) All signed packaged apps81yamsS-1-5-21-1133191089-1850170202-1535859923-200319458418Microsoft.BingNews118CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00", + "_serial": "194", + "_si": [ + "69819b6ce1bd", + "main" + ], + "_sourcetype": "XmlWinEventLog:Security", + "_time": "2021-05-25 13:11:45.000 UTC", + "host": "VAGRANT", + "index": "main", + "linecount": "1", + "max_indextime": "1622471606", + "source": "WinEventLog:Security", + "sourcetype": "XmlWinEventLog:Security", + "splunk_server": "69819b6ce1bd" + } + } + - path: /services/search/jobs/export + user: test + password: test + methods: + - post + query_params: + index_earliest: "{index_earliest:[0-9]+}" + index_latest: "{index_latest:[0-9]+}" + output_mode: json + search: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/Packaged app-Execution" | streamstats max(_indextime) AS max_indextime' + request_headers: + Content-Type: + - "application/x-www-form-urlencoded" + responses: + - status_code: 200 + headers: + Content-Type: + - "application/json" + body: |- + { + "preview": false, + "offset": 194, + "lastrow": true, + "result": { + "_bkt": "main~0~1212176D-89E1-485D-89E6-3ADC276CCA38", + "_cd": "0:315", + "_indextime": "1622471463", + "_raw": "802004000x20000000000000002986Microsoft-Windows-AppLocker/Packaged app-Executionel33t-b00k-14APPX{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}39(Default Rule) All signed packaged apps81D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\\\"*\\\\*\\\\*\\\",0}))))S-1-5-21-2707992022-4034939591-3454028951-10014186415MICROSOFT.TODOS116CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\MICROSOFT.TODOS\\\\APPX\\\\2.100.61791.00", + "_serial": "194", + "_si": [ + "69819b6ce1bd", + "main" + ], + "_sourcetype": "XmlWinEventLog:Security", + "_time": "2021-05-25 13:11:45.000 UTC", + "host": "VAGRANT", + "index": "main", + "linecount": "1", + "max_indextime": "1622471606", + "source": "WinEventLog:Security", + "sourcetype": "XmlWinEventLog:Security", + "splunk_server": "69819b6ce1bd" + } + } diff --git a/packages/windows/changelog.yml b/packages/windows/changelog.yml index 154501056ef..ed1848b7bc6 100644 --- a/packages/windows/changelog.yml +++ b/packages/windows/changelog.yml @@ -1,4 +1,84 @@ # newer versions go on top +- version: "1.37.0" + changes: + - description: Add refresh_wildcard_counters option to windows perfmon datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7897 +- version: "1.36.0" + changes: + - description: Enable time series data streams for the service metrics dataset. This dramatically reduces storage for metrics and is expected to progressively improve query [performance](https://www.elastic.co/blog/70-percent-storage-savings-for-metrics-with-elastic-observability). For more details, see https://www.elastic.co/guide/en/elasticsearch/reference/current/tsds.html. + type: enhancement + link: https://github.com/elastic/integrations/pull/7206 +- version: "1.35.0" + changes: + - description: Reconcile forwarded event pipelines with their non-forwarded equivalents. + type: enhancement + link: https://github.com/elastic/integrations/pull/7374 +- version: "1.34.1" + changes: + - description: Add metric_type mapping for the fields of `service` datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7200 +- version: "1.34.0" + changes: + - description: Add dimension fields for service datastream to support TSDB. + type: enhancement + link: https://github.com/elastic/integrations/pull/7172 +- version: "1.33.0" + changes: + - description: Retain `event_data.Details` in sysmon_operational datastream. + type: enhancement + link: https://github.com/elastic/integrations/pull/7396 +- version: "1.32.0" + changes: + - description: Add Windows AppLocker Packaged app-Execution data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/7446 +- version: "1.31.0" + changes: + - description: Add Windows AppLocker Packaged app-Deployment data stream + type: enhancement + link: https://github.com/elastic/integrations/pull/7393 +- version: "1.30.0" + changes: + - description: Add Windows AppLocker MSI and Script data stream, update AppLocker Dashboard. + type: enhancement + link: https://github.com/elastic/integrations/pull/7279 +- version: "1.29.0" + changes: + - description: Align to more ECS fields, remove [beta] tag, add dashboard + type: enhancement + link: https://github.com/elastic/integrations/pull/7229 +- version: "1.28.1" + changes: + - description: Improve regular expression search efficiency to allow parsing large events. + type: bugfix + link: https://github.com/elastic/integrations/pull/7192 +- version: "1.28.0" + changes: + - description: Add support for Sysmon event ID 29 file hashes + type: enhancement + link: https://github.com/elastic/integrations/pull/7015 +- version: "1.27.0" + changes: + - description: Adding initial Windows AppLocker data stream [beta] + type: enhancement + link: https://github.com/elastic/integrations/pull/6977 +- version: "1.26.0" + changes: + - description: Set `event.action` to sysmon name in sysmon_operational. + type: enhancement + link: https://github.com/elastic/integrations/pull/6882 +- version: "1.25.0" + changes: + - description: Add support for sysmon 15.0/event 29. + type: enhancement + link: https://github.com/elastic/integrations/pull/6761 +- version: "1.24.1" + changes: + - description: Add ECS error.code mapping. + type: bugfix + link: https://github.com/elastic/integrations/issues/6766 - version: "1.24.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. @@ -91,7 +171,7 @@ link: https://github.com/elastic/integrations/pull/3707 - version: "1.13.0" changes: - - description: Added Processors for service datatstream. + - description: Added Processors for service datastream. type: enhancement link: https://github.com/elastic/integrations/pull/3618 - version: "1.12.4" diff --git a/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json new file mode 100644 index 00000000000..9fcf561f860 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json @@ -0,0 +1,61 @@ +{ + "events": [ + { + "@timestamp": "2023-07-20T15:05:03.8826518Z", + "event": { + "code": 8003, + "kind": "event", + "provider": "Microsoft-Windows-AppLocker" + }, + "host": { + "name": "TOPSYLL.local" + }, + "log": { + "level": "Warning" + }, + "message": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.", + "winlog": { + "channel": "Microsoft-Windows-AppLocker/EXE and DLL", + "computer_name": "TOPSYLL.local", + "user_data": { + "PolicyNameLength": 3, + "PolicyName": "EXE", + "RuleId": "00000000-0000-0000-0000-000000000000", + "RuleNameLength": 1, + "RuleName": "-", + "RuleSddlLength": 1, + "RuleSddl": "-", + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "TargetProcessId": 27116, + "FilePathLength": 101, + "FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE", + "FileHashLength": 32, + "FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5", + "FqbnLength": 72, + "Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01", + "TargetLogonId": "0x14FCB7", + "FullFilePathLength": 94, + "FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe" + }, + "event_id": "8003", + "level": "Warning", + "opcode": "Info\u0000", + "process": { + "pid": 33848, + "thread": { + "id": 12040 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": 154247, + "time_created": "2023-07-20T15:05:03.8826518Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "name": "topsy" + }, + "version": 0 + } + } + ] +} diff --git a/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json-expected.json b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json-expected.json new file mode 100644 index 00000000000..dba1208d5bc --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/pipeline/test-events-applocker-exe-8003.json-expected.json @@ -0,0 +1,87 @@ +{ + "expected": [ + { + "@timestamp": "2023-07-20T15:05:03.882Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "category": "process", + "code": "8003", + "kind": "event", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5" + }, + "name": "git.exe", + "pe": { + "file_version": "2.35.5.01", + "original_file_name": "GIT.EXE", + "product": "GIT" + }, + "x509": { + "subject": { + "country": "DE", + "organization": "JOHANNES SCHINDELIN", + "state_or_province": "NORDRHEIN-WESTFALEN" + } + } + }, + "host": { + "name": "TOPSYLL.local" + }, + "log": { + "level": "Warning" + }, + "message": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE was allowed to run but would have been prevented from running if the AppLocker policy were enforced.", + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "name": "topsy" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/EXE and DLL", + "computer_name": "TOPSYLL.local", + "event_id": "8003", + "level": "Warning", + "opcode": "Info\u0000", + "process": { + "pid": 33848, + "thread": { + "id": 12040 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "154247", + "time_created": "2023-07-20T15:05:03.8826518Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE", + "FilePathLength": 101, + "Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01", + "FqbnLength": 72, + "FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe", + "FullFilePathLength": 94, + "PolicyName": "EXE", + "PolicyNameLength": 3, + "RuleId": "00000000-0000-0000-0000-000000000000", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x14FCB7", + "TargetProcessId": 27116, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "version": 0 + } + } + ] +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/system/test-default-config.yml b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..4456a4f2583 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: splunk-mock +vars: + url: http://{{Hostname}}:{{Port}} + username: test + password: test + enable_request_tracer: true +data_stream: + vars: + preserve_original_event: true diff --git a/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/httpjson.yml.hbs b/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..bf9a16da897 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/httpjson.yml.hbs @@ -0,0 +1,104 @@ +config_version: "2" +interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +{{#unless token}} +{{#if username}} +{{#if password}} +auth.basic.user: {{username}} +auth.basic.password: {{password}} +{{/if}} +{{/if}} +{{/unless}} +cursor: + index_earliest: + value: '[[.last_event.result.max_indextime]]' +request.url: {{url}}/services/search/jobs/export +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +request.method: POST +request.transforms: + - set: + target: url.params.search + value: |- + {{search}} | streamstats max(_indextime) AS max_indextime + - set: + target: url.params.output_mode + value: "json" + - set: + target: url.params.index_earliest + value: '[[ .cursor.index_earliest ]]' + default: '[[(now (parseDuration "-{{interval}}")).Unix]]' + - set: + target: url.params.index_latest + value: '[[(now).Unix]]' + - set: + target: header.Content-Type + value: application/x-www-form-urlencoded +{{#unless username}} +{{#unless password}} +{{#if token}} + - set: + target: header.Authorization + value: {{token}} +{{/if}} +{{/unless}} +{{/unless}} +response.decode_as: application/x-ndjson +{{#if tags.length}} +tags: +{{else if preserve_original_event}} +tags: +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- decode_json_fields: + fields: message + target: json + add_error_key: true +- drop_event: + when: + not: + has_fields: ['json.result'] +- fingerprint: + fields: + - json.result._cd + - json.result._indextime + - json.result._raw + - json.result._time + - json.result.host + - json.result.source + target_field: "@metadata._id" +- drop_fields: + fields: message +- rename: + fields: + - from: json.result._raw + to: event.original + - from: json.result.host + to: host.name + - from: json.result.source + to: event.provider + ignore_missing: true + fail_on_error: false +- drop_fields: + fields: json +- decode_xml_wineventlog: + field: event.original + target_field: winlog + ignore_missing: true + ignore_failure: true + map_ecs_fields: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs b/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs new file mode 100644 index 00000000000..ca6ae1d2189 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/agent/stream/winlog.yml.hbs @@ -0,0 +1,31 @@ +name: Microsoft-Windows-AppLocker/EXE and DLL +condition: ${host.platform} == 'windows' +{{#if event_id}} +event_id: {{event_id}} +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +{{#if language}} +language: {{language}} +{{/if}} +{{#if tags.length}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +{{#if preserve_original_event}} +include_xml: true +{{/if}} +processors: +- translate_sid: + field: winlog.event_data.MemberSid + account_name_target: winlog.event_data._MemberUserName + domain_target: winlog.event_data._MemberDomain + account_type_target: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..8320a63503d --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,175 @@ +--- +description: Pipeline for Microsoft-Windows-AppLocker/EXE and DLL events +processors: + ## ECS and Event fields. + + - set: + field: ecs.version + value: '8.0.0' + - set: + field: log.level + copy_from: winlog.level + ignore_empty_value: true + ignore_failure: true + if: ctx.winlog?.level != "" + - date: + field: winlog.time_created + tag: "time_created_date" + formats: + - ISO8601 + if: ctx.winlog?.time_created != null + on_failure: + - remove: + field: winlog.time_created + ignore_failure: true + - append: + field: error.message + value: "fail-{{{ _ingest.on_failure_processor_tag }}}" + - fail: + message: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" + + - set: + field: event.kind + value: event + - set: + field: event.code + value: '{{winlog.event_id}}' + - set: + field: event.category + value: process + - set: + field: event.type + value: start + - convert: + field: winlog.record_id + type: string + ignore_failure: true + ignore_missing: true + + ## User fields. + + - set: + field: user.id + copy_from: winlog.user.identifier + ignore_failure: true + ignore_empty_value: true + - split: + field: winlog.event_data.User + target_field: "_temp.user_parts" + separator: '\\' + if: ctx.winlog?.event_data?.User != null + - set: + field: user.domain + value: "{{_temp.user_parts.0}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - set: + field: user.name + value: "{{_temp.user_parts.1}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - rename: + field: winlog.user.name + target_field: user.name + ignore_failure: true + ignore_missing: true + if: ctx.user?.name == null + + ## User data fields. + - convert: + field: winlog.user_data.FileHashLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FileHashLength + ignore_failure: true + - convert: + field: winlog.user_data.FilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.FqbnLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FqbnLength + ignore_failure: true + - convert: + field: winlog.user_data.FullFilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FullFilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.PolicyNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.PolicyNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleSddlLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleSddlLength + ignore_failure: true + - convert: + field: winlog.user_data.TargetProcessId + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.TargetProcessId + ignore_failure: true + + ## Fully Qualified Binary Name (FQBN) / File Fields + - grok: + field: winlog.user_data.Fqbn + ignore_missing: true + patterns: + - "^O=(?.*),%{SPACE}L=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + - "^O=(?.*),%{SPACE}L=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + - "^O=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + if: ctx.winlog?.user_data?.Fqbn != "-" + + - grok: + field: winlog.user_data.FullFilePath + ignore_missing: true + patterns: + - '(?([^\\]*$))' + if: ctx.winlog?.user_data?.FullFilePath != "-" + + - set: + field: file.hash.sha256 + copy_from: winlog.user_data.FileHash + ignore_empty_value: true + if: ctx.winlog?.user_data?.FileHash != "-" + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/agent.yml b/packages/windows/data_stream/applocker_exe_and_dll/fields/agent.yml similarity index 100% rename from packages/ti_anomali/elasticsearch/transform/latest_ioc/fields/agent.yml rename to packages/windows/data_stream/applocker_exe_and_dll/fields/agent.yml diff --git a/packages/windows/data_stream/applocker_exe_and_dll/fields/base-fields.yml b/packages/windows/data_stream/applocker_exe_and_dll/fields/base-fields.yml new file mode 100644 index 00000000000..390cecc5439 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/fields/base-fields.yml @@ -0,0 +1,34 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: windows +- name: event.dataset + type: constant_keyword + description: Event dataset + value: windows.applocker_exe_and_dll +- name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + ignore_above: 1024 + type: keyword diff --git a/packages/windows/data_stream/applocker_exe_and_dll/fields/beats.yml b/packages/windows/data_stream/applocker_exe_and_dll/fields/beats.yml new file mode 100644 index 00000000000..3c48f1f224f --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/fields/beats.yml @@ -0,0 +1,3 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. diff --git a/packages/windows/data_stream/applocker_exe_and_dll/fields/ecs.yml b/packages/windows/data_stream/applocker_exe_and_dll/fields/ecs.yml new file mode 100644 index 00000000000..932c9ea6556 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/fields/ecs.yml @@ -0,0 +1,96 @@ +- external: ecs + name: destination.user.domain +- external: ecs + name: destination.user.id +- external: ecs + name: destination.user.name +- external: ecs + name: ecs.version +- external: ecs + name: error.code +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.code +- external: ecs + name: event.created +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.outcome +- external: ecs + name: event.provider +- external: ecs + name: event.sequence +- external: ecs + name: event.type +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.name +- external: ecs + name: file.path +- exernal: ecs + name: file.pe.file_version +- exernal: ecs + name: file.pe.original_file_name +- exernal: ecs + name: file.pe.product +- external: ecs + name: file.x509.subject.country +- external: ecs + name: file.x509.subject.locality +- external: ecs + name: file.x509.subject.organization +- external: ecs + name: file.x509.subject.state_or_province +- external: ecs + name: host.name +- external: ecs + name: log.level +- external: ecs + name: message +- external: ecs + name: process.args +- external: ecs + name: process.args_count +- external: ecs + name: process.command_line +- external: ecs + name: process.entity_id +- external: ecs + name: process.executable +- external: ecs + name: process.name +- external: ecs + name: process.pid +- external: ecs + name: process.title +- external: ecs + name: related.hash +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: source.user.domain +- external: ecs + name: source.user.id +- external: ecs + name: source.user.name +- external: ecs + name: user.domain +- external: ecs + name: user.id +- external: ecs + name: user.name diff --git a/packages/windows/data_stream/applocker_exe_and_dll/fields/winlog.yml b/packages/windows/data_stream/applocker_exe_and_dll/fields/winlog.yml new file mode 100644 index 00000000000..e1e69045581 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/fields/winlog.yml @@ -0,0 +1,412 @@ +- name: winlog + type: group + description: > + All fields specific to the Windows Event Log are defined here. + + fields: + - name: api + required: true + type: keyword + description: > + The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. + + The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. + + - name: activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. + + - name: computer_name + type: keyword + required: true + description: > + The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. + + - name: event_data + type: object + object_type: keyword + required: false + description: > + The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. + + - name: event_data + type: group + description: > + This is a non-exhaustive list of parameters that are used in Windows events. By having these fields defined in the template they can be used in dashboards and machine-learning jobs. + + fields: + - name: AuthenticationPackageName + type: keyword + - name: Binary + type: keyword + - name: BitlockerUserInputTime + type: keyword + - name: BootMode + type: keyword + - name: BootType + type: keyword + - name: BuildVersion + type: keyword + - name: Company + type: keyword + - name: CorruptionActionState + type: keyword + - name: CreationUtcTime + type: keyword + - name: Description + type: keyword + - name: Detail + type: keyword + - name: DeviceName + type: keyword + - name: DeviceNameLength + type: keyword + - name: DeviceTime + type: keyword + - name: DeviceVersionMajor + type: keyword + - name: DeviceVersionMinor + type: keyword + - name: DriveName + type: keyword + - name: DriverName + type: keyword + - name: DriverNameLength + type: keyword + - name: DwordVal + type: keyword + - name: EntryCount + type: keyword + - name: ExtraInfo + type: keyword + - name: FailureName + type: keyword + - name: FailureNameLength + type: keyword + - name: FileVersion + type: keyword + - name: FinalStatus + type: keyword + - name: Group + type: keyword + - name: IdleImplementation + type: keyword + - name: IdleStateCount + type: keyword + - name: ImpersonationLevel + type: keyword + - name: IntegrityLevel + type: keyword + - name: IpAddress + type: keyword + - name: IpPort + type: keyword + - name: KeyLength + type: keyword + - name: LastBootGood + type: keyword + - name: LastShutdownGood + type: keyword + - name: LmPackageName + type: keyword + - name: LogonGuid + type: keyword + - name: LogonId + type: keyword + - name: LogonProcessName + type: keyword + - name: LogonType + type: keyword + - name: MajorVersion + type: keyword + - name: MaximumPerformancePercent + type: keyword + - name: MemberName + type: keyword + - name: MemberSid + type: keyword + - name: MinimumPerformancePercent + type: keyword + - name: MinimumThrottlePercent + type: keyword + - name: MinorVersion + type: keyword + - name: NewProcessId + type: keyword + - name: NewProcessName + type: keyword + - name: NewSchemeGuid + type: keyword + - name: NewTime + type: keyword + - name: NominalFrequency + type: keyword + - name: Number + type: keyword + - name: OldSchemeGuid + type: keyword + - name: OldTime + type: keyword + - name: OriginalFileName + type: keyword + - name: Path + type: keyword + - name: PerformanceImplementation + type: keyword + - name: PreviousCreationUtcTime + type: keyword + - name: PreviousTime + type: keyword + - name: PrivilegeList + type: keyword + - name: ProcessId + type: keyword + - name: ProcessName + type: keyword + - name: ProcessPath + type: keyword + - name: ProcessPid + type: keyword + - name: Product + type: keyword + - name: PuaCount + type: keyword + - name: PuaPolicyId + type: keyword + - name: QfeVersion + type: keyword + - name: Reason + type: keyword + - name: SchemaVersion + type: keyword + - name: ScriptBlockText + type: keyword + - name: ServiceName + type: keyword + - name: ServiceVersion + type: keyword + - name: ShutdownActionType + type: keyword + - name: ShutdownEventCode + type: keyword + - name: ShutdownReason + type: keyword + - name: Signature + type: keyword + - name: SignatureStatus + type: keyword + - name: Signed + type: keyword + - name: StartTime + type: keyword + - name: State + type: keyword + - name: Status + type: keyword + - name: StopTime + type: keyword + - name: SubjectDomainName + type: keyword + - name: SubjectLogonId + type: keyword + - name: SubjectUserName + type: keyword + - name: SubjectUserSid + type: keyword + - name: TSId + type: keyword + - name: TargetDomainName + type: keyword + - name: TargetInfo + type: keyword + - name: TargetLogonGuid + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetServerName + type: keyword + - name: TargetUserName + type: keyword + - name: TargetUserSid + type: keyword + - name: TerminalSessionId + type: keyword + - name: TokenElevationType + type: keyword + - name: TransmittedServices + type: keyword + - name: UserSid + type: keyword + - name: Version + type: keyword + - name: Workstation + type: keyword + - name: param1 + type: keyword + - name: param2 + type: keyword + - name: param3 + type: keyword + - name: param4 + type: keyword + - name: param5 + type: keyword + - name: param6 + type: keyword + - name: param7 + type: keyword + - name: param8 + type: keyword + - name: event_id + type: keyword + required: true + description: > + The event identifier. The value is specific to the source of the event. + + - name: keywords + type: keyword + required: false + description: > + The keywords are used to classify an event. + + - name: channel + type: keyword + required: true + description: > + The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. + + - name: record_id + type: keyword + required: true + description: > + The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. + + - name: related_activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. + + - name: opcode + type: keyword + required: false + description: > + The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. + + - name: provider_guid + type: keyword + required: false + description: > + A globally unique identifier that identifies the provider that logged the event. + + - name: process.pid + type: long + required: false + description: > + The process_id of the Client Server Runtime Process. + + - name: provider_name + type: keyword + required: true + description: > + The source of the event log record (the application or service that logged the record). + + - name: task + type: keyword + required: false + description: > + The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. + + - name: level + type: keyword + description: > + The level assigned to the event such as Information, Warning, or Critical. + + - name: process.thread.id + type: long + required: false + - name: time_created + type: date + description: The time the event was created. + - name: user_data + type: object + object_type: keyword + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + - name: user_data + type: group + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + fields: + - name: FilePath + type: keyword + - name: FileHashLength + type: long + - name: RuleNameLength + type: long + - name: FullFilePath + type: keyword + - name: FilePathLength + type: long + - name: xml_name + type: keyword + - name: RuleSddl + type: keyword + - name: Fqbn + type: keyword + - name: PolicyName + type: keyword + - name: RuleName + type: keyword + - name: RuleSddlLength + type: long + - name: FqbnLength + type: long + - name: FullFilePathLength + type: long + - name: RuleId + type: keyword + - name: PolicyNameLength + type: long + - name: TargetUser + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetProcessId + type: long + - name: FileHash + type: keyword + - name: user.identifier + type: keyword + required: false + example: S-1-5-21-3541430928-2051711210-1391384369-1001 + description: > + The Windows security identifier (SID) of the account associated with this event. + + If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. + + - name: user.name + type: keyword + description: > + Name of the user associated with this event. + + - name: user.domain + type: keyword + required: false + description: > + The domain that the account associated with this event is a member of. + + - name: user.type + type: keyword + required: false + description: > + The type of account associated with this event. + + - name: version + type: long + required: false + description: The version number of the event's definition. diff --git a/packages/windows/data_stream/applocker_exe_and_dll/manifest.yml b/packages/windows/data_stream/applocker_exe_and_dll/manifest.yml new file mode 100644 index 00000000000..2d73527383f --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/manifest.yml @@ -0,0 +1,98 @@ +type: logs +title: 'Windows AppLocker/EXE and DLL logs' +streams: + - input: winlog + enabled: false + template_path: winlog.yml.hbs + title: AppLocker/EXE and DLL + description: 'Microsoft-Windows-AppLocker/EXE and DLL channel' + vars: + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: >- + Preserves a raw copy of the original XML event, added to the field `event.original` + type: bool + multi: false + default: false + - name: event_id + type: text + title: Event ID + description: >- + A list of included and excluded (blocked) event IDs. The value is a comma-separated list. The accepted values are single event IDs to include (e.g. 4624), a range of event IDs to include (e.g. 4700-4800), and single event IDs to exclude (e.g. -4735). Limit 22 clauses, lower in some situations. See integration documentation for more details. + required: false + show_user: false + default: + - name: ignore_older + type: text + title: Ignore events older than + default: 72h + required: false + show_user: false + description: >- + If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + - name: language + type: text + title: Language ID + description: >- + The language ID the events will be rendered in. The language will be forced regardless of the system language. A complete list of language IDs can be found https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c[here]. It defaults to `0`, which indicates to use the system language. E.g.: 0x0409 for en-US + required: false + show_user: false + default: 0 + - name: tags + type: text + title: Tags + multi: true + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - input: httpjson + title: Windows AppLocker EXE and DLL Events via Splunk Enterprise REST API + description: Collect AppLocker EXE and DLL Events via Splunk Enterprise REST API + enabled: false + template_path: httpjson.yml.hbs + vars: + - name: interval + type: text + title: Interval to query Splunk Enterprise REST API + description: Go Duration syntax (eg. 10s) + show_user: true + required: true + default: 10s + - name: search + type: text + title: Splunk search string + show_user: false + required: true + default: "search sourcetype=\"XmlWinEventLog:Microsoft-Windows-AppLocker/EXE and DLL\"" + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/windows/data_stream/applocker_exe_and_dll/sample_event.json b/packages/windows/data_stream/applocker_exe_and_dll/sample_event.json new file mode 100644 index 00000000000..daf711a5cc7 --- /dev/null +++ b/packages/windows/data_stream/applocker_exe_and_dll/sample_event.json @@ -0,0 +1,112 @@ +{ + "@timestamp": "2023-07-20T15:05:03.882Z", + "agent": { + "ephemeral_id": "2c907e31-12db-485b-ab67-ef05e8aa1e3d", + "id": "51fe65df-a759-4054-ae29-e8242662fb48", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_exe_and_dll", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "51fe65df-a759-4054-ae29-e8242662fb48", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8003", + "created": "2023-08-03T13:42:19.028Z", + "dataset": "windows.applocker_exe_and_dll", + "ingested": "2023-08-03T13:42:22Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}' /\u003e\u003cEventID\u003e8003\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e3\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-07-20T15:05:03.8826518Z' /\u003e\u003cEventRecordID\u003e154247\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID='33848' ThreadID='12040' /\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/EXE and DLL\u003c/Channel\u003e\u003cComputer\u003eTOPSYLL.local\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1133191089-1850170202-1535859923-200319' /\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e3\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eEXE\u003c/PolicyName\u003e\u003cRuleId\u003e{00000000-0000-0000-0000-000000000000}\u003c/RuleId\u003e\u003cRuleNameLength\u003e1\u003c/RuleNameLength\u003e\u003cRuleName\u003e-\u003c/RuleName\u003e\u003cRuleSddlLength\u003e1\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003e-\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-1133191089-1850170202-1535859923-200319\u003c/TargetUser\u003e\u003cTargetProcessId\u003e27116\u003c/TargetProcessId\u003e\u003cFilePathLength\u003e101\u003c/FilePathLength\u003e\u003cFilePath\u003e%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE\u003c/FilePath\u003e\u003cFileHashLength\u003e32\u003c/FileHashLength\u003e\u003cFileHash\u003e11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5\u003c/FileHash\u003e\u003cFqbnLength\u003e72\u003c/FqbnLength\u003e\u003cFqbn\u003eO=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01\u003c/Fqbn\u003e\u003cTargetLogonId\u003e0x14fcb7\u003c/TargetLogonId\u003e\u003cFullFilePathLength\u003e94\u003c/FullFilePathLength\u003e\u003cFullFilePath\u003eC:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe\u003c/FullFilePath\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5" + }, + "name": "git.exe", + "pe": { + "file_version": "2.35.5.01", + "original_file_name": "GIT.EXE", + "product": "GIT" + }, + "x509": { + "subject": { + "country": "DE", + "organization": "JOHANNES SCHINDELIN", + "state_or_province": "NORDRHEIN-WESTFALEN" + } + } + }, + "host": { + "name": "TOPSYLL.local" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "warning" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/EXE and DLL", + "computer_name": "TOPSYLL.local", + "event_id": "8003", + "level": "warning", + "opcode": "Info", + "process": { + "pid": 33848, + "thread": { + "id": 12040 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "154247", + "task": "None", + "time_created": "2023-07-20T15:05:03.882Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE", + "FilePathLength": 101, + "Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01", + "FqbnLength": 72, + "FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe", + "FullFilePathLength": 94, + "PolicyName": "EXE", + "PolicyNameLength": 3, + "RuleId": "{00000000-0000-0000-0000-000000000000}", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x14fcb7", + "TargetProcessId": 27116, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "xml_name": "RuleAndFileData" + } + } +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json new file mode 100644 index 00000000000..0add36aad4e --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json @@ -0,0 +1,61 @@ +{ + "events": [ + { + "@timestamp": "2023-08-04T21:26:32.7572144Z", + "event": { + "code": 8006, + "kind": "event", + "provider": "Microsoft-Windows-AppLocker" + }, + "host": { + "name": "el33t-b00k-1" + }, + "log": { + "level": "Warning\u0000" + }, + "message": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.\u0000", + "winlog": { + "channel": "Microsoft-Windows-AppLocker/MSI and Script", + "computer_name": "el33t-b00k-1", + "user_data": { + "PolicyNameLength": 6, + "PolicyName": "SCRIPT", + "RuleId": "00000000-0000-0000-0000-000000000000", + "RuleNameLength": 1, + "RuleName": "-", + "RuleSddlLength": 1, + "RuleSddl": "-", + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "TargetProcessId": 25192, + "FilePathLength": 124, + "FilePath": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1", + "FileHashLength": 32, + "FileHash": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01", + "FqbnLength": 65, + "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00", + "TargetLogonId": "0x4C18F", + "FullFilePathLength": 117, + "FullFilePath": "C:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1" + }, + "event_id": "8006", + "level": "Warning\u0000", + "opcode": "Info\u0000\u0000", + "process": { + "pid": 25192, + "thread": { + "id": 7740 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": 239, + "time_created": "2023-08-04T21:26:32.7572144Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "name": "nicpe" + }, + "version": 0 + } + } + ] +} diff --git a/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json-expected.json b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json-expected.json new file mode 100644 index 00000000000..704b72e0358 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/pipeline/test-events-applocker-msi-and-script-8006.json-expected.json @@ -0,0 +1,88 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-04T21:26:32.757Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": "process", + "code": "8006", + "kind": "event", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01" + }, + "name": "PSScriptAnalyzer.psm1", + "pe": { + "file_version": "0.0.0.00", + "original_file_name": "", + "product": "" + }, + "x509": { + "subject": { + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "log": { + "level": "Warning\u0000" + }, + "message": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1 was allowed to run but would have been prevented from running if the AppLocker policy were enforced.\u0000", + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "name": "nicpe" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/MSI and Script", + "computer_name": "el33t-b00k-1", + "event_id": "8006", + "level": "Warning\u0000", + "opcode": "Info\u0000\u0000", + "process": { + "pid": 25192, + "thread": { + "id": 7740 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "239", + "time_created": "2023-08-04T21:26:32.7572144Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "FileHash": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1", + "FilePathLength": 124, + "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00", + "FqbnLength": 65, + "FullFilePath": "C:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1", + "FullFilePathLength": 117, + "PolicyName": "SCRIPT", + "PolicyNameLength": 6, + "RuleId": "00000000-0000-0000-0000-000000000000", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x4C18F", + "TargetProcessId": 25192, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "version": 0 + } + } + ] +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_msi_and_script/_dev/test/system/test-default-config.yml b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..4456a4f2583 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: splunk-mock +vars: + url: http://{{Hostname}}:{{Port}} + username: test + password: test + enable_request_tracer: true +data_stream: + vars: + preserve_original_event: true diff --git a/packages/windows/data_stream/applocker_msi_and_script/agent/stream/httpjson.yml.hbs b/packages/windows/data_stream/applocker_msi_and_script/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..bf9a16da897 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/agent/stream/httpjson.yml.hbs @@ -0,0 +1,104 @@ +config_version: "2" +interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +{{#unless token}} +{{#if username}} +{{#if password}} +auth.basic.user: {{username}} +auth.basic.password: {{password}} +{{/if}} +{{/if}} +{{/unless}} +cursor: + index_earliest: + value: '[[.last_event.result.max_indextime]]' +request.url: {{url}}/services/search/jobs/export +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +request.method: POST +request.transforms: + - set: + target: url.params.search + value: |- + {{search}} | streamstats max(_indextime) AS max_indextime + - set: + target: url.params.output_mode + value: "json" + - set: + target: url.params.index_earliest + value: '[[ .cursor.index_earliest ]]' + default: '[[(now (parseDuration "-{{interval}}")).Unix]]' + - set: + target: url.params.index_latest + value: '[[(now).Unix]]' + - set: + target: header.Content-Type + value: application/x-www-form-urlencoded +{{#unless username}} +{{#unless password}} +{{#if token}} + - set: + target: header.Authorization + value: {{token}} +{{/if}} +{{/unless}} +{{/unless}} +response.decode_as: application/x-ndjson +{{#if tags.length}} +tags: +{{else if preserve_original_event}} +tags: +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- decode_json_fields: + fields: message + target: json + add_error_key: true +- drop_event: + when: + not: + has_fields: ['json.result'] +- fingerprint: + fields: + - json.result._cd + - json.result._indextime + - json.result._raw + - json.result._time + - json.result.host + - json.result.source + target_field: "@metadata._id" +- drop_fields: + fields: message +- rename: + fields: + - from: json.result._raw + to: event.original + - from: json.result.host + to: host.name + - from: json.result.source + to: event.provider + ignore_missing: true + fail_on_error: false +- drop_fields: + fields: json +- decode_xml_wineventlog: + field: event.original + target_field: winlog + ignore_missing: true + ignore_failure: true + map_ecs_fields: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_msi_and_script/agent/stream/winlog.yml.hbs b/packages/windows/data_stream/applocker_msi_and_script/agent/stream/winlog.yml.hbs new file mode 100644 index 00000000000..567e69697bf --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/agent/stream/winlog.yml.hbs @@ -0,0 +1,31 @@ +name: Microsoft-Windows-AppLocker/MSI and Script +condition: ${host.platform} == 'windows' +{{#if event_id}} +event_id: {{event_id}} +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +{{#if language}} +language: {{language}} +{{/if}} +{{#if tags.length}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +{{#if preserve_original_event}} +include_xml: true +{{/if}} +processors: +- translate_sid: + field: winlog.event_data.MemberSid + account_name_target: winlog.event_data._MemberUserName + domain_target: winlog.event_data._MemberDomain + account_type_target: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_msi_and_script/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/applocker_msi_and_script/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..e7fc171684e --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,175 @@ +--- +description: Pipeline for Microsoft-Windows-AppLocker/MSI and Script events +processors: + ## ECS and Event fields. + + - set: + field: ecs.version + value: '8.9.0' + - set: + field: log.level + copy_from: winlog.level + ignore_empty_value: true + ignore_failure: true + if: ctx.winlog?.level != "" + - date: + field: winlog.time_created + tag: "time_created_date" + formats: + - ISO8601 + if: ctx.winlog?.time_created != null + on_failure: + - remove: + field: winlog.time_created + ignore_failure: true + - append: + field: error.message + value: "fail-{{{ _ingest.on_failure_processor_tag }}}" + - fail: + message: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" + + - set: + field: event.kind + value: event + - set: + field: event.code + value: '{{winlog.event_id}}' + - set: + field: event.category + value: process + - set: + field: event.type + value: start + - convert: + field: winlog.record_id + type: string + ignore_failure: true + ignore_missing: true + + ## User fields. + + - set: + field: user.id + copy_from: winlog.user.identifier + ignore_failure: true + ignore_empty_value: true + - split: + field: winlog.event_data.User + target_field: "_temp.user_parts" + separator: '\\' + if: ctx.winlog?.event_data?.User != null + - set: + field: user.domain + value: "{{_temp.user_parts.0}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - set: + field: user.name + value: "{{_temp.user_parts.1}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - rename: + field: winlog.user.name + target_field: user.name + ignore_failure: true + ignore_missing: true + if: ctx.user?.name == null + + ## User data fields. + - convert: + field: winlog.user_data.FileHashLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FileHashLength + ignore_failure: true + - convert: + field: winlog.user_data.FilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.FqbnLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FqbnLength + ignore_failure: true + - convert: + field: winlog.user_data.FullFilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FullFilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.PolicyNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.PolicyNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleSddlLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleSddlLength + ignore_failure: true + - convert: + field: winlog.user_data.TargetProcessId + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.TargetProcessId + ignore_failure: true + + ## Fully Qualified Binary Name (FQBN) / File Fields + - grok: + field: winlog.user_data.Fqbn + ignore_missing: true + patterns: + - "^O=(?.*),%{SPACE}L=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + - "^O=(?.*),%{SPACE}L=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + - "^O=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?[^\\\\]*)\\\\(?.*)$" + if: ctx.winlog?.user_data?.Fqbn != "-" + + - grok: + field: winlog.user_data.FullFilePath + ignore_missing: true + patterns: + - '(?([^\\]*$))' + if: ctx.winlog?.user_data?.FullFilePath != "-" + + - set: + field: file.hash.sha256 + copy_from: winlog.user_data.FileHash + ignore_empty_value: true + if: ctx.winlog?.user_data?.FileHash != "-" + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "{{ _ingest.on_failure_message }}" diff --git a/packages/windows/data_stream/applocker_msi_and_script/fields/agent.yml b/packages/windows/data_stream/applocker_msi_and_script/fields/agent.yml new file mode 100644 index 00000000000..da4e652c53b --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/fields/agent.yml @@ -0,0 +1,198 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/windows/data_stream/applocker_msi_and_script/fields/base-fields.yml b/packages/windows/data_stream/applocker_msi_and_script/fields/base-fields.yml new file mode 100644 index 00000000000..ee8796919fd --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/fields/base-fields.yml @@ -0,0 +1,34 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: windows +- name: event.dataset + type: constant_keyword + description: Event dataset + value: windows.applocker_msi_and_script +- name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + ignore_above: 1024 + type: keyword diff --git a/packages/windows/data_stream/applocker_msi_and_script/fields/beats.yml b/packages/windows/data_stream/applocker_msi_and_script/fields/beats.yml new file mode 100644 index 00000000000..3c48f1f224f --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/fields/beats.yml @@ -0,0 +1,3 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. diff --git a/packages/windows/data_stream/applocker_msi_and_script/fields/ecs.yml b/packages/windows/data_stream/applocker_msi_and_script/fields/ecs.yml new file mode 100644 index 00000000000..932c9ea6556 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/fields/ecs.yml @@ -0,0 +1,96 @@ +- external: ecs + name: destination.user.domain +- external: ecs + name: destination.user.id +- external: ecs + name: destination.user.name +- external: ecs + name: ecs.version +- external: ecs + name: error.code +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.code +- external: ecs + name: event.created +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.outcome +- external: ecs + name: event.provider +- external: ecs + name: event.sequence +- external: ecs + name: event.type +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.name +- external: ecs + name: file.path +- exernal: ecs + name: file.pe.file_version +- exernal: ecs + name: file.pe.original_file_name +- exernal: ecs + name: file.pe.product +- external: ecs + name: file.x509.subject.country +- external: ecs + name: file.x509.subject.locality +- external: ecs + name: file.x509.subject.organization +- external: ecs + name: file.x509.subject.state_or_province +- external: ecs + name: host.name +- external: ecs + name: log.level +- external: ecs + name: message +- external: ecs + name: process.args +- external: ecs + name: process.args_count +- external: ecs + name: process.command_line +- external: ecs + name: process.entity_id +- external: ecs + name: process.executable +- external: ecs + name: process.name +- external: ecs + name: process.pid +- external: ecs + name: process.title +- external: ecs + name: related.hash +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: source.user.domain +- external: ecs + name: source.user.id +- external: ecs + name: source.user.name +- external: ecs + name: user.domain +- external: ecs + name: user.id +- external: ecs + name: user.name diff --git a/packages/windows/data_stream/applocker_msi_and_script/fields/winlog.yml b/packages/windows/data_stream/applocker_msi_and_script/fields/winlog.yml new file mode 100644 index 00000000000..e1e69045581 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/fields/winlog.yml @@ -0,0 +1,412 @@ +- name: winlog + type: group + description: > + All fields specific to the Windows Event Log are defined here. + + fields: + - name: api + required: true + type: keyword + description: > + The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. + + The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. + + - name: activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. + + - name: computer_name + type: keyword + required: true + description: > + The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. + + - name: event_data + type: object + object_type: keyword + required: false + description: > + The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. + + - name: event_data + type: group + description: > + This is a non-exhaustive list of parameters that are used in Windows events. By having these fields defined in the template they can be used in dashboards and machine-learning jobs. + + fields: + - name: AuthenticationPackageName + type: keyword + - name: Binary + type: keyword + - name: BitlockerUserInputTime + type: keyword + - name: BootMode + type: keyword + - name: BootType + type: keyword + - name: BuildVersion + type: keyword + - name: Company + type: keyword + - name: CorruptionActionState + type: keyword + - name: CreationUtcTime + type: keyword + - name: Description + type: keyword + - name: Detail + type: keyword + - name: DeviceName + type: keyword + - name: DeviceNameLength + type: keyword + - name: DeviceTime + type: keyword + - name: DeviceVersionMajor + type: keyword + - name: DeviceVersionMinor + type: keyword + - name: DriveName + type: keyword + - name: DriverName + type: keyword + - name: DriverNameLength + type: keyword + - name: DwordVal + type: keyword + - name: EntryCount + type: keyword + - name: ExtraInfo + type: keyword + - name: FailureName + type: keyword + - name: FailureNameLength + type: keyword + - name: FileVersion + type: keyword + - name: FinalStatus + type: keyword + - name: Group + type: keyword + - name: IdleImplementation + type: keyword + - name: IdleStateCount + type: keyword + - name: ImpersonationLevel + type: keyword + - name: IntegrityLevel + type: keyword + - name: IpAddress + type: keyword + - name: IpPort + type: keyword + - name: KeyLength + type: keyword + - name: LastBootGood + type: keyword + - name: LastShutdownGood + type: keyword + - name: LmPackageName + type: keyword + - name: LogonGuid + type: keyword + - name: LogonId + type: keyword + - name: LogonProcessName + type: keyword + - name: LogonType + type: keyword + - name: MajorVersion + type: keyword + - name: MaximumPerformancePercent + type: keyword + - name: MemberName + type: keyword + - name: MemberSid + type: keyword + - name: MinimumPerformancePercent + type: keyword + - name: MinimumThrottlePercent + type: keyword + - name: MinorVersion + type: keyword + - name: NewProcessId + type: keyword + - name: NewProcessName + type: keyword + - name: NewSchemeGuid + type: keyword + - name: NewTime + type: keyword + - name: NominalFrequency + type: keyword + - name: Number + type: keyword + - name: OldSchemeGuid + type: keyword + - name: OldTime + type: keyword + - name: OriginalFileName + type: keyword + - name: Path + type: keyword + - name: PerformanceImplementation + type: keyword + - name: PreviousCreationUtcTime + type: keyword + - name: PreviousTime + type: keyword + - name: PrivilegeList + type: keyword + - name: ProcessId + type: keyword + - name: ProcessName + type: keyword + - name: ProcessPath + type: keyword + - name: ProcessPid + type: keyword + - name: Product + type: keyword + - name: PuaCount + type: keyword + - name: PuaPolicyId + type: keyword + - name: QfeVersion + type: keyword + - name: Reason + type: keyword + - name: SchemaVersion + type: keyword + - name: ScriptBlockText + type: keyword + - name: ServiceName + type: keyword + - name: ServiceVersion + type: keyword + - name: ShutdownActionType + type: keyword + - name: ShutdownEventCode + type: keyword + - name: ShutdownReason + type: keyword + - name: Signature + type: keyword + - name: SignatureStatus + type: keyword + - name: Signed + type: keyword + - name: StartTime + type: keyword + - name: State + type: keyword + - name: Status + type: keyword + - name: StopTime + type: keyword + - name: SubjectDomainName + type: keyword + - name: SubjectLogonId + type: keyword + - name: SubjectUserName + type: keyword + - name: SubjectUserSid + type: keyword + - name: TSId + type: keyword + - name: TargetDomainName + type: keyword + - name: TargetInfo + type: keyword + - name: TargetLogonGuid + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetServerName + type: keyword + - name: TargetUserName + type: keyword + - name: TargetUserSid + type: keyword + - name: TerminalSessionId + type: keyword + - name: TokenElevationType + type: keyword + - name: TransmittedServices + type: keyword + - name: UserSid + type: keyword + - name: Version + type: keyword + - name: Workstation + type: keyword + - name: param1 + type: keyword + - name: param2 + type: keyword + - name: param3 + type: keyword + - name: param4 + type: keyword + - name: param5 + type: keyword + - name: param6 + type: keyword + - name: param7 + type: keyword + - name: param8 + type: keyword + - name: event_id + type: keyword + required: true + description: > + The event identifier. The value is specific to the source of the event. + + - name: keywords + type: keyword + required: false + description: > + The keywords are used to classify an event. + + - name: channel + type: keyword + required: true + description: > + The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. + + - name: record_id + type: keyword + required: true + description: > + The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. + + - name: related_activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. + + - name: opcode + type: keyword + required: false + description: > + The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. + + - name: provider_guid + type: keyword + required: false + description: > + A globally unique identifier that identifies the provider that logged the event. + + - name: process.pid + type: long + required: false + description: > + The process_id of the Client Server Runtime Process. + + - name: provider_name + type: keyword + required: true + description: > + The source of the event log record (the application or service that logged the record). + + - name: task + type: keyword + required: false + description: > + The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. + + - name: level + type: keyword + description: > + The level assigned to the event such as Information, Warning, or Critical. + + - name: process.thread.id + type: long + required: false + - name: time_created + type: date + description: The time the event was created. + - name: user_data + type: object + object_type: keyword + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + - name: user_data + type: group + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + fields: + - name: FilePath + type: keyword + - name: FileHashLength + type: long + - name: RuleNameLength + type: long + - name: FullFilePath + type: keyword + - name: FilePathLength + type: long + - name: xml_name + type: keyword + - name: RuleSddl + type: keyword + - name: Fqbn + type: keyword + - name: PolicyName + type: keyword + - name: RuleName + type: keyword + - name: RuleSddlLength + type: long + - name: FqbnLength + type: long + - name: FullFilePathLength + type: long + - name: RuleId + type: keyword + - name: PolicyNameLength + type: long + - name: TargetUser + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetProcessId + type: long + - name: FileHash + type: keyword + - name: user.identifier + type: keyword + required: false + example: S-1-5-21-3541430928-2051711210-1391384369-1001 + description: > + The Windows security identifier (SID) of the account associated with this event. + + If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. + + - name: user.name + type: keyword + description: > + Name of the user associated with this event. + + - name: user.domain + type: keyword + required: false + description: > + The domain that the account associated with this event is a member of. + + - name: user.type + type: keyword + required: false + description: > + The type of account associated with this event. + + - name: version + type: long + required: false + description: The version number of the event's definition. diff --git a/packages/windows/data_stream/applocker_msi_and_script/manifest.yml b/packages/windows/data_stream/applocker_msi_and_script/manifest.yml new file mode 100644 index 00000000000..a9a4eef9013 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/manifest.yml @@ -0,0 +1,98 @@ +type: logs +title: 'Windows AppLocker/MSI and Script logs' +streams: + - input: winlog + enabled: false + template_path: winlog.yml.hbs + title: AppLocker/MSI and Script + description: 'Microsoft-Windows-AppLocker/MSI and Script channel' + vars: + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: >- + Preserves a raw copy of the original XML event, added to the field `event.original` + type: bool + multi: false + default: false + - name: event_id + type: text + title: Event ID + description: >- + A list of included and excluded (blocked) event IDs. The value is a comma-separated list. The accepted values are single event IDs to include (e.g. 4624), a range of event IDs to include (e.g. 4700-4800), and single event IDs to exclude (e.g. -4735). Limit 22 clauses, lower in some situations. See integration documentation for more details. + required: false + show_user: false + default: + - name: ignore_older + type: text + title: Ignore events older than + default: 72h + required: false + show_user: false + description: >- + If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + - name: language + type: text + title: Language ID + description: >- + The language ID the events will be rendered in. The language will be forced regardless of the system language. A complete list of language IDs can be found https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c[here]. It defaults to `0`, which indicates to use the system language. E.g.: 0x0409 for en-US + required: false + show_user: false + default: 0 + - name: tags + type: text + title: Tags + multi: true + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - input: httpjson + title: Windows AppLocker MSI and Script Events via Splunk Enterprise REST API + description: Collect AppLocker MSI and Script Events via Splunk Enterprise REST API + enabled: false + template_path: httpjson.yml.hbs + vars: + - name: interval + type: text + title: Interval to query Splunk Enterprise REST API + description: Go Duration syntax (eg. 10s) + show_user: true + required: true + default: 10s + - name: search + type: text + title: Splunk search string + show_user: false + required: true + default: "search sourcetype=\"XmlWinEventLog:Microsoft-Windows-AppLocker/MSI and Script\"" + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/windows/data_stream/applocker_msi_and_script/sample_event.json b/packages/windows/data_stream/applocker_msi_and_script/sample_event.json new file mode 100644 index 00000000000..2cd091038e3 --- /dev/null +++ b/packages/windows/data_stream/applocker_msi_and_script/sample_event.json @@ -0,0 +1,114 @@ +{ + "@timestamp": "2023-08-04T21:26:32.757Z", + "agent": { + "ephemeral_id": "17b8f200-259d-4f9f-898e-ccfd2f82705a", + "id": "15b01abd-cefe-4ddd-8359-617acef7bf30", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_msi_and_script", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "15b01abd-cefe-4ddd-8359-617acef7bf30", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8006", + "created": "2023-08-05T12:31:30.395Z", + "dataset": "windows.applocker_msi_and_script", + "ingested": "2023-08-05T12:31:34Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}' /\u003e\u003cEventID\u003e8006\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e3\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x4000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-04T21:26:32.7572144Z' /\u003e\u003cEventRecordID\u003e239\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{f64315e2-bea0-0000-6d01-d5f6a0bed901}' /\u003e\u003cExecution ProcessID='25192' ThreadID='7740' /\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/MSI and Script\u003c/Channel\u003e\u003cComputer\u003eel33t-b00k-1\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-2707992022-4034939591-3454028951-1001' /\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e6\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eSCRIPT\u003c/PolicyName\u003e\u003cRuleId\u003e{00000000-0000-0000-0000-000000000000}\u003c/RuleId\u003e\u003cRuleNameLength\u003e1\u003c/RuleNameLength\u003e\u003cRuleName\u003e-\u003c/RuleName\u003e\u003cRuleSddlLength\u003e1\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003e-\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-2707992022-4034939591-3454028951-1001\u003c/TargetUser\u003e\u003cTargetProcessId\u003e25192\u003c/TargetProcessId\u003e\u003cFilePathLength\u003e124\u003c/FilePathLength\u003e\u003cFilePath\u003e%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1\u003c/FilePath\u003e\u003cFileHashLength\u003e32\u003c/FileHashLength\u003e\u003cFileHash\u003eD2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01\u003c/FileHash\u003e\u003cFqbnLength\u003e65\u003c/FqbnLength\u003e\u003cFqbn\u003eO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00\u003c/Fqbn\u003e\u003cTargetLogonId\u003e0x4c18f\u003c/TargetLogonId\u003e\u003cFullFilePathLength\u003e117\u003c/FullFilePathLength\u003e\u003cFullFilePath\u003eC:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1\u003c/FullFilePath\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01" + }, + "name": "PSScriptAnalyzer.psm1", + "pe": { + "file_version": "0.0.0.00", + "original_file_name": "", + "product": "" + }, + "x509": { + "subject": { + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "warning" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "winlog": { + "activity_id": "{f64315e2-bea0-0000-6d01-d5f6a0bed901}", + "channel": "Microsoft-Windows-AppLocker/MSI and Script", + "computer_name": "el33t-b00k-1", + "event_id": "8006", + "level": "warning", + "opcode": "Info", + "process": { + "pid": 25192, + "thread": { + "id": 7740 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "239", + "task": "None", + "time_created": "2023-08-04T21:26:32.757Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "FileHash": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1", + "FilePathLength": 124, + "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00", + "FqbnLength": 65, + "FullFilePath": "C:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1", + "FullFilePathLength": 117, + "PolicyName": "SCRIPT", + "PolicyNameLength": 6, + "RuleId": "{00000000-0000-0000-0000-000000000000}", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x4c18f", + "TargetProcessId": 25192, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "xml_name": "RuleAndFileData" + } + } +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json new file mode 100644 index 00000000000..3f06043d6a6 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json @@ -0,0 +1,57 @@ +{ + "events": [ + { + "@timestamp": "2023-08-15T14:12:32.6801945Z", + "event": { + "code": 8023, + "kind": "event", + "provider": "Microsoft-Windows-AppLocker" + }, + "host": { + "name": "WIN1012009LL.local" + }, + "log": { + "level": "Information" + }, + "message": "Microsoft.BingNews was allowed to be installed.", + "winlog": { + "activity_id": "eac4f4ed-cf73-0001-a741-c5ea73cfd901", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment", + "computer_name": "WIN1012009LL.local", + "user_data": { + "PolicyNameLength": "4", + "PolicyName": "APPX", + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleNameLength": "39", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleSddlLength": "81", + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026\u0026 ((APPID://FQBN) \u003e= ({\"*\\*\\*\",0}))))", + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "TargetProcessId": "4584", + "PackageLength": "18", + "Package": "Microsoft.BingNews", + "FqbnLength": "118", + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00" + }, + "event_id": "8023", + "level": "Information", + "opcode": "Info", + "process": { + "pid": 4584, + "thread": { + "id": 26688 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": 6269, + "time_created": "2023-08-15T14:12:32.6801945Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "name": "Topsy" + }, + "version": 0 + } + } + ] +} diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json-expected.json b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json-expected.json new file mode 100644 index 00000000000..cff21427ddb --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-deployment.json-expected.json @@ -0,0 +1,81 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-15T14:12:32.680Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": "process", + "code": "8023", + "kind": "event", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "4.55.62231.00", + "original_file_name": "APPX", + "product": "MICROSOFT.BINGNEWS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "WIN1012009LL.local" + }, + "log": { + "level": "Information" + }, + "message": "Microsoft.BingNews was allowed to be installed.", + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "name": "Topsy" + }, + "winlog": { + "activity_id": "eac4f4ed-cf73-0001-a741-c5ea73cfd901", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment", + "computer_name": "WIN1012009LL.local", + "event_id": "8023", + "level": "Information", + "opcode": "Info", + "process": { + "pid": 4584, + "thread": { + "id": 26688 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "6269", + "time_created": "2023-08-15T14:12:32.6801945Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00", + "FqbnLength": 118, + "Package": "Microsoft.BingNews", + "PackageLength": "18", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026\u0026 ((APPID://FQBN) \u003e= ({\"*\\*\\*\",0}))))", + "RuleSddlLength": 81, + "TargetProcessId": 4584, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "version": 0 + } + } + ] +} diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/system/test-default-config.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..4456a4f2583 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: splunk-mock +vars: + url: http://{{Hostname}}:{{Port}} + username: test + password: test + enable_request_tracer: true +data_stream: + vars: + preserve_original_event: true diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/httpjson.yml.hbs b/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..bf9a16da897 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/httpjson.yml.hbs @@ -0,0 +1,104 @@ +config_version: "2" +interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +{{#unless token}} +{{#if username}} +{{#if password}} +auth.basic.user: {{username}} +auth.basic.password: {{password}} +{{/if}} +{{/if}} +{{/unless}} +cursor: + index_earliest: + value: '[[.last_event.result.max_indextime]]' +request.url: {{url}}/services/search/jobs/export +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +request.method: POST +request.transforms: + - set: + target: url.params.search + value: |- + {{search}} | streamstats max(_indextime) AS max_indextime + - set: + target: url.params.output_mode + value: "json" + - set: + target: url.params.index_earliest + value: '[[ .cursor.index_earliest ]]' + default: '[[(now (parseDuration "-{{interval}}")).Unix]]' + - set: + target: url.params.index_latest + value: '[[(now).Unix]]' + - set: + target: header.Content-Type + value: application/x-www-form-urlencoded +{{#unless username}} +{{#unless password}} +{{#if token}} + - set: + target: header.Authorization + value: {{token}} +{{/if}} +{{/unless}} +{{/unless}} +response.decode_as: application/x-ndjson +{{#if tags.length}} +tags: +{{else if preserve_original_event}} +tags: +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- decode_json_fields: + fields: message + target: json + add_error_key: true +- drop_event: + when: + not: + has_fields: ['json.result'] +- fingerprint: + fields: + - json.result._cd + - json.result._indextime + - json.result._raw + - json.result._time + - json.result.host + - json.result.source + target_field: "@metadata._id" +- drop_fields: + fields: message +- rename: + fields: + - from: json.result._raw + to: event.original + - from: json.result.host + to: host.name + - from: json.result.source + to: event.provider + ignore_missing: true + fail_on_error: false +- drop_fields: + fields: json +- decode_xml_wineventlog: + field: event.original + target_field: winlog + ignore_missing: true + ignore_failure: true + map_ecs_fields: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/winlog.yml.hbs b/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/winlog.yml.hbs new file mode 100644 index 00000000000..f3b0ac75788 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/agent/stream/winlog.yml.hbs @@ -0,0 +1,31 @@ +name: Microsoft-Windows-AppLocker/Packaged app-Deployment +condition: ${host.platform} == 'windows' +{{#if event_id}} +event_id: {{event_id}} +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +{{#if language}} +language: {{language}} +{{/if}} +{{#if tags.length}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +{{#if preserve_original_event}} +include_xml: true +{{/if}} +processors: +- translate_sid: + field: winlog.event_data.MemberSid + account_name_target: winlog.event_data._MemberUserName + domain_target: winlog.event_data._MemberDomain + account_type_target: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..684cd53d01d --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,174 @@ +--- +description: Pipeline for Microsoft-Windows-AppLocker/Packaged app-Deployment events +processors: + ## ECS and Event fields. + + - set: + field: ecs.version + value: '8.9.0' + - set: + field: log.level + copy_from: winlog.level + ignore_empty_value: true + ignore_failure: true + if: ctx.winlog?.level != "" + - date: + field: winlog.time_created + tag: "time_created_date" + formats: + - ISO8601 + if: ctx.winlog?.time_created != null + on_failure: + - remove: + field: winlog.time_created + ignore_failure: true + - append: + field: error.message + value: "fail-{{{ _ingest.on_failure_processor_tag }}}" + - fail: + message: "Processor {{{ _ingest.on_failure_processor_type }}} with tag {{{ _ingest.on_failure_processor_tag }}} in pipeline {{{ _ingest.on_failure_pipeline }}} failed with message: {{{ _ingest.on_failure_message }}}" + + - set: + field: event.kind + value: event + - set: + field: event.code + value: "{{{winlog.event_id}}}" + - set: + field: event.category + value: process + - set: + field: event.type + value: start + - convert: + field: winlog.record_id + type: string + ignore_failure: true + ignore_missing: true + + ## User fields. + - set: + field: user.id + copy_from: winlog.user.identifier + ignore_failure: true + ignore_empty_value: true + - split: + field: winlog.event_data.User + target_field: "_temp.user_parts" + separator: '\\' + if: ctx.winlog?.event_data?.User != null + - set: + field: user.domain + value: "{{{_temp.user_parts.0}}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - set: + field: user.name + value: "{{{_temp.user_parts.1}}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - rename: + field: winlog.user.name + target_field: user.name + ignore_failure: true + ignore_missing: true + if: ctx.user?.name == null + + ## User data fields. + - convert: + field: winlog.user_data.FileHashLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FileHashLength + ignore_failure: true + - convert: + field: winlog.user_data.FilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.FqbnLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FqbnLength + ignore_failure: true + - convert: + field: winlog.user_data.FullFilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FullFilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.PolicyNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.PolicyNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleSddlLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleSddlLength + ignore_failure: true + - convert: + field: winlog.user_data.TargetProcessId + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.TargetProcessId + ignore_failure: true + + ## Fully Qualified Binary Name (FQBN) / File Fields + - grok: + field: winlog.user_data.Fqbn + ignore_missing: true + patterns: + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}L=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}L=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + if: ctx.winlog?.user_data?.Fqbn != "-" + + - grok: + field: winlog.user_data.FullFilePath + ignore_missing: true + patterns: + - '(?([^\\]*$))' + if: ctx.winlog?.user_data?.FullFilePath != "-" + + - set: + field: file.hash.sha256 + copy_from: winlog.user_data.FileHash + ignore_empty_value: true + if: ctx.winlog?.user_data?.FileHash != "-" + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/fields/agent.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/agent.yml new file mode 100644 index 00000000000..da4e652c53b --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/agent.yml @@ -0,0 +1,198 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/fields/base-fields.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/base-fields.yml new file mode 100644 index 00000000000..04de0d27b52 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/base-fields.yml @@ -0,0 +1,34 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: windows +- name: event.dataset + type: constant_keyword + description: Event dataset + value: windows.applocker_packaged_app_deployment +- name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + ignore_above: 1024 + type: keyword diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/fields/beats.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/beats.yml new file mode 100644 index 00000000000..3c48f1f224f --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/beats.yml @@ -0,0 +1,3 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/fields/ecs.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/ecs.yml new file mode 100644 index 00000000000..a691dcddd24 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/ecs.yml @@ -0,0 +1,98 @@ +- external: ecs + name: destination.user.domain +- external: ecs + name: destination.user.id +- external: ecs + name: destination.user.name +- external: ecs + name: ecs.version +- external: ecs + name: error.code +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.code +- external: ecs + name: event.created +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.outcome +- external: ecs + name: event.provider +- external: ecs + name: event.sequence +- external: ecs + name: event.type +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.name +- external: ecs + name: file.path +- exernal: ecs + name: file.pe.file_version +- exernal: ecs + name: file.pe.original_file_name +- exernal: ecs + name: file.pe.product +- external: ecs + name: file.x509.subject.common_name +- external: ecs + name: file.x509.subject.country +- external: ecs + name: file.x509.subject.locality +- external: ecs + name: file.x509.subject.organization +- external: ecs + name: file.x509.subject.state_or_province +- external: ecs + name: host.name +- external: ecs + name: log.level +- external: ecs + name: message +- external: ecs + name: process.args +- external: ecs + name: process.args_count +- external: ecs + name: process.command_line +- external: ecs + name: process.entity_id +- external: ecs + name: process.executable +- external: ecs + name: process.name +- external: ecs + name: process.pid +- external: ecs + name: process.title +- external: ecs + name: related.hash +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: source.user.domain +- external: ecs + name: source.user.id +- external: ecs + name: source.user.name +- external: ecs + name: user.domain +- external: ecs + name: user.id +- external: ecs + name: user.name diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/fields/winlog.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/winlog.yml new file mode 100644 index 00000000000..805875a5f5f --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/fields/winlog.yml @@ -0,0 +1,416 @@ +- name: winlog + type: group + description: > + All fields specific to the Windows Event Log are defined here. + + fields: + - name: api + required: true + type: keyword + description: > + The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. + + The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. + + - name: activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. + + - name: computer_name + type: keyword + required: true + description: > + The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. + + - name: event_data + type: object + object_type: keyword + required: false + description: > + The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. + + - name: event_data + type: group + description: > + This is a non-exhaustive list of parameters that are used in Windows events. By having these fields defined in the template they can be used in dashboards and machine-learning jobs. + + fields: + - name: AuthenticationPackageName + type: keyword + - name: Binary + type: keyword + - name: BitlockerUserInputTime + type: keyword + - name: BootMode + type: keyword + - name: BootType + type: keyword + - name: BuildVersion + type: keyword + - name: Company + type: keyword + - name: CorruptionActionState + type: keyword + - name: CreationUtcTime + type: keyword + - name: Description + type: keyword + - name: Detail + type: keyword + - name: DeviceName + type: keyword + - name: DeviceNameLength + type: keyword + - name: DeviceTime + type: keyword + - name: DeviceVersionMajor + type: keyword + - name: DeviceVersionMinor + type: keyword + - name: DriveName + type: keyword + - name: DriverName + type: keyword + - name: DriverNameLength + type: keyword + - name: DwordVal + type: keyword + - name: EntryCount + type: keyword + - name: ExtraInfo + type: keyword + - name: FailureName + type: keyword + - name: FailureNameLength + type: keyword + - name: FileVersion + type: keyword + - name: FinalStatus + type: keyword + - name: Group + type: keyword + - name: IdleImplementation + type: keyword + - name: IdleStateCount + type: keyword + - name: ImpersonationLevel + type: keyword + - name: IntegrityLevel + type: keyword + - name: IpAddress + type: keyword + - name: IpPort + type: keyword + - name: KeyLength + type: keyword + - name: LastBootGood + type: keyword + - name: LastShutdownGood + type: keyword + - name: LmPackageName + type: keyword + - name: LogonGuid + type: keyword + - name: LogonId + type: keyword + - name: LogonProcessName + type: keyword + - name: LogonType + type: keyword + - name: MajorVersion + type: keyword + - name: MaximumPerformancePercent + type: keyword + - name: MemberName + type: keyword + - name: MemberSid + type: keyword + - name: MinimumPerformancePercent + type: keyword + - name: MinimumThrottlePercent + type: keyword + - name: MinorVersion + type: keyword + - name: NewProcessId + type: keyword + - name: NewProcessName + type: keyword + - name: NewSchemeGuid + type: keyword + - name: NewTime + type: keyword + - name: NominalFrequency + type: keyword + - name: Number + type: keyword + - name: OldSchemeGuid + type: keyword + - name: OldTime + type: keyword + - name: OriginalFileName + type: keyword + - name: Path + type: keyword + - name: PerformanceImplementation + type: keyword + - name: PreviousCreationUtcTime + type: keyword + - name: PreviousTime + type: keyword + - name: PrivilegeList + type: keyword + - name: ProcessId + type: keyword + - name: ProcessName + type: keyword + - name: ProcessPath + type: keyword + - name: ProcessPid + type: keyword + - name: Product + type: keyword + - name: PuaCount + type: keyword + - name: PuaPolicyId + type: keyword + - name: QfeVersion + type: keyword + - name: Reason + type: keyword + - name: SchemaVersion + type: keyword + - name: ScriptBlockText + type: keyword + - name: ServiceName + type: keyword + - name: ServiceVersion + type: keyword + - name: ShutdownActionType + type: keyword + - name: ShutdownEventCode + type: keyword + - name: ShutdownReason + type: keyword + - name: Signature + type: keyword + - name: SignatureStatus + type: keyword + - name: Signed + type: keyword + - name: StartTime + type: keyword + - name: State + type: keyword + - name: Status + type: keyword + - name: StopTime + type: keyword + - name: SubjectDomainName + type: keyword + - name: SubjectLogonId + type: keyword + - name: SubjectUserName + type: keyword + - name: SubjectUserSid + type: keyword + - name: TSId + type: keyword + - name: TargetDomainName + type: keyword + - name: TargetInfo + type: keyword + - name: TargetLogonGuid + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetServerName + type: keyword + - name: TargetUserName + type: keyword + - name: TargetUserSid + type: keyword + - name: TerminalSessionId + type: keyword + - name: TokenElevationType + type: keyword + - name: TransmittedServices + type: keyword + - name: UserSid + type: keyword + - name: Version + type: keyword + - name: Workstation + type: keyword + - name: param1 + type: keyword + - name: param2 + type: keyword + - name: param3 + type: keyword + - name: param4 + type: keyword + - name: param5 + type: keyword + - name: param6 + type: keyword + - name: param7 + type: keyword + - name: param8 + type: keyword + - name: event_id + type: keyword + required: true + description: > + The event identifier. The value is specific to the source of the event. + + - name: keywords + type: keyword + required: false + description: > + The keywords are used to classify an event. + + - name: channel + type: keyword + required: true + description: > + The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. + + - name: record_id + type: keyword + required: true + description: > + The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. + + - name: related_activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. + + - name: opcode + type: keyword + required: false + description: > + The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. + + - name: provider_guid + type: keyword + required: false + description: > + A globally unique identifier that identifies the provider that logged the event. + + - name: process.pid + type: long + required: false + description: > + The process_id of the Client Server Runtime Process. + + - name: provider_name + type: keyword + required: true + description: > + The source of the event log record (the application or service that logged the record). + + - name: task + type: keyword + required: false + description: > + The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. + + - name: level + type: keyword + description: > + The level assigned to the event such as Information, Warning, or Critical. + + - name: process.thread.id + type: long + required: false + - name: time_created + type: date + description: The time the event was created. + - name: user_data + type: object + object_type: keyword + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + - name: user_data + type: group + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + fields: + - name: FilePath + type: keyword + - name: FileHashLength + type: long + - name: RuleNameLength + type: long + - name: FullFilePath + type: keyword + - name: FilePathLength + type: long + - name: xml_name + type: keyword + - name: RuleSddl + type: keyword + - name: Fqbn + type: keyword + - name: PolicyName + type: keyword + - name: RuleName + type: keyword + - name: RuleSddlLength + type: long + - name: FqbnLength + type: long + - name: FullFilePathLength + type: long + - name: RuleId + type: keyword + - name: PolicyNameLength + type: long + - name: TargetUser + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetProcessId + type: long + - name: FileHash + type: keyword + - name: Package + type: keyword + - name: PackageLength + type: keyword + - name: user.identifier + type: keyword + required: false + example: S-1-5-21-3541430928-2051711210-1391384369-1001 + description: > + The Windows security identifier (SID) of the account associated with this event. + + If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. + + - name: user.name + type: keyword + description: > + Name of the user associated with this event. + + - name: user.domain + type: keyword + required: false + description: > + The domain that the account associated with this event is a member of. + + - name: user.type + type: keyword + required: false + description: > + The type of account associated with this event. + + - name: version + type: long + required: false + description: The version number of the event's definition. diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/manifest.yml b/packages/windows/data_stream/applocker_packaged_app_deployment/manifest.yml new file mode 100644 index 00000000000..fc67f6c6fc9 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/manifest.yml @@ -0,0 +1,99 @@ +type: logs +title: 'Windows AppLocker/Packaged app-Deployment logs' +streams: + - input: winlog + enabled: false + template_path: winlog.yml.hbs + title: Packaged app-Deployment + description: 'Microsoft-Windows-AppLocker/Packaged app-Deployment channel' + vars: + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: >- + Preserves a raw copy of the original XML event, added to the field `event.original` + type: bool + multi: false + default: false + - name: event_id + type: text + title: Event ID + description: >- + A list of included and excluded (blocked) event IDs. The value is a comma-separated list. The accepted values are single event IDs to include (e.g. 4624), a range of event IDs to include (e.g. 4700-4800), and single event IDs to exclude (e.g. -4735). Limit 22 clauses, lower in some situations. See integration documentation for more details. + required: false + show_user: false + default: + - name: ignore_older + type: text + title: Ignore events older than + default: 72h + required: false + show_user: false + description: >- + If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + - name: language + type: text + title: Language ID + description: >- + The language ID the events will be rendered in. The language will be forced regardless of the system language. A complete list of language IDs can be found https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c[here]. It defaults to `0`, which indicates to use the system language. E.g.: 0x0409 for en-US + required: false + show_user: false + default: 0 + - name: tags + type: text + title: Tags + multi: true + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - input: httpjson + title: Windows AppLocker/Packaged app-Deployment Events via Splunk Enterprise REST API + description: Collect AppLocker Packaged app-Deployment Events via Splunk Enterprise REST API + enabled: false + template_path: httpjson.yml.hbs + vars: + - name: interval + type: text + title: Interval to query Splunk Enterprise REST API + description: Go Duration syntax (eg. 10s) + show_user: true + required: true + default: 10s + - name: search + type: text + title: Splunk search string + show_user: false + required: true + default: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/Packaged app-Deployment"' + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/windows/data_stream/applocker_packaged_app_deployment/sample_event.json b/packages/windows/data_stream/applocker_packaged_app_deployment/sample_event.json new file mode 100644 index 00000000000..25af8f55f9e --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_deployment/sample_event.json @@ -0,0 +1,106 @@ +{ + "@timestamp": "2023-08-15T14:12:32.680Z", + "agent": { + "ephemeral_id": "03a46cd5-bd39-49b3-b8cf-493dcd361920", + "id": "4c6333d2-c654-4cac-be07-248d79340ee5", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_packaged_app_deployment", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c6333d2-c654-4cac-be07-248d79340ee5", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8023", + "created": "2023-08-15T22:51:13.753Z", + "dataset": "windows.applocker_packaged_app_deployment", + "ingested": "2023-08-15T22:51:17Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}'/\u003e\u003cEventID\u003e8023\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x1000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-15T14:12:32.6801945Z'/\u003e\u003cEventRecordID\u003e6269\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{eac4f4ed-cf73-0001-a741-c5ea73cfd901}'/\u003e\u003cExecution ProcessID='4584' ThreadID='26688'/\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/Packaged app-Deployment\u003c/Channel\u003e\u003cComputer\u003eWIN1012009LL.local\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1133191089-1850170202-1535859923-200319'/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e4\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eAPPX\u003c/PolicyName\u003e\u003cRuleId\u003e{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}\u003c/RuleId\u003e\u003cRuleNameLength\u003e39\u003c/RuleNameLength\u003e\u003cRuleName\u003e(Default Rule) All signed packaged apps\u003c/RuleName\u003e\u003cRuleSddlLength\u003e81\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003eyams\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-1133191089-1850170202-1535859923-200319\u003c/TargetUser\u003e\u003cTargetProcessId\u003e4584\u003c/TargetProcessId\u003e\u003cPackageLength\u003e18\u003c/PackageLength\u003e\u003cPackage\u003eMicrosoft.BingNews\u003c/Package\u003e\u003cFqbnLength\u003e118\u003c/FqbnLength\u003e\u003cFqbn\u003eCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00\u003c/Fqbn\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "4.55.62231.00", + "original_file_name": "APPX", + "product": "MICROSOFT.BINGNEWS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "WIN1012009LL.local" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "information" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "winlog": { + "activity_id": "{eac4f4ed-cf73-0001-a741-c5ea73cfd901}", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment", + "computer_name": "WIN1012009LL.local", + "event_id": "8023", + "level": "information", + "opcode": "Info", + "process": { + "pid": 4584, + "thread": { + "id": 26688 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "6269", + "task": "None", + "time_created": "2023-08-15T14:12:32.680Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00", + "FqbnLength": 118, + "Package": "Microsoft.BingNews", + "PackageLength": "18", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "yams", + "RuleSddlLength": 81, + "TargetProcessId": 4584, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "xml_name": "RuleAndFileData" + } + } +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json new file mode 100644 index 00000000000..fa81d402bc3 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json @@ -0,0 +1,57 @@ +{ + "events": [ + { + "@timestamp": "2023-08-13T13:53:33.7067781Z", + "event": { + "code": "8020", + "kind": "event", + "provider": "Microsoft-Windows-AppLocker" + }, + "host": { + "name": "el33t-b00k-1" + }, + "log": { + "level": "Information" + }, + "message": "MICROSOFT.TODOS was allowed to run.", + "winlog": { + "activity_id": "", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", + "computer_name": "el33t-b00k-1", + "user_data": { + "PolicyNameLength": "4", + "PolicyName": "APPX", + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleNameLength": "39", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleSddlLength": "81", + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) && ((APPID://FQBN) >= ({\"*\\*\\*\",0}))))", + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "TargetProcessId": "41864", + "PackageLength": "15", + "Package": "MICROSOFT.TODOS", + "FqbnLength": "116", + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00" + }, + "event_id": "8020", + "level": "Information", + "opcode": "Info", + "process": { + "pid": 1672, + "thread": { + "id": 8384 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "2986", + "time_created": "2023-08-13T13:53:33.7067781Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "name": "Topsy" + }, + "version": 0 + } + } + ] +} diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json-expected.json b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json-expected.json new file mode 100644 index 00000000000..c34ffc9331e --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/pipeline/test-events-microsoft-windows-applocker-packaged-app-execution.json-expected.json @@ -0,0 +1,81 @@ +{ + "expected": [ + { + "@timestamp": "2023-08-13T13:53:33.706Z", + "ecs": { + "version": "8.9.0" + }, + "event": { + "category": "process", + "code": "8020", + "kind": "event", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "2.100.61791.00", + "original_file_name": "APPX", + "product": "MICROSOFT.TODOS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "log": { + "level": "Information" + }, + "message": "MICROSOFT.TODOS was allowed to run.", + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "name": "Topsy" + }, + "winlog": { + "activity_id": "", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", + "computer_name": "el33t-b00k-1", + "event_id": "8020", + "level": "Information", + "opcode": "Info", + "process": { + "pid": 1672, + "thread": { + "id": 8384 + } + }, + "provider_guid": "cbda4dbf-8d5d-4f69-9578-be14aa540d22", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "2986", + "time_created": "2023-08-13T13:53:33.7067781Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00", + "FqbnLength": 116, + "Package": "MICROSOFT.TODOS", + "PackageLength": "15", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026\u0026 ((APPID://FQBN) \u003e= ({\"*\\*\\*\",0}))))", + "RuleSddlLength": 81, + "TargetProcessId": 41864, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "version": 0 + } + } + ] +} \ No newline at end of file diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/system/test-default-config.yml b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..4456a4f2583 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/_dev/test/system/test-default-config.yml @@ -0,0 +1,10 @@ +input: httpjson +service: splunk-mock +vars: + url: http://{{Hostname}}:{{Port}} + username: test + password: test + enable_request_tracer: true +data_stream: + vars: + preserve_original_event: true diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/httpjson.yml.hbs b/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/httpjson.yml.hbs new file mode 100644 index 00000000000..bf9a16da897 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/httpjson.yml.hbs @@ -0,0 +1,104 @@ +config_version: "2" +interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} +{{#unless token}} +{{#if username}} +{{#if password}} +auth.basic.user: {{username}} +auth.basic.password: {{password}} +{{/if}} +{{/if}} +{{/unless}} +cursor: + index_earliest: + value: '[[.last_event.result.max_indextime]]' +request.url: {{url}}/services/search/jobs/export +{{#if ssl}} +request.ssl: {{ssl}} +{{/if}} +request.method: POST +request.transforms: + - set: + target: url.params.search + value: |- + {{search}} | streamstats max(_indextime) AS max_indextime + - set: + target: url.params.output_mode + value: "json" + - set: + target: url.params.index_earliest + value: '[[ .cursor.index_earliest ]]' + default: '[[(now (parseDuration "-{{interval}}")).Unix]]' + - set: + target: url.params.index_latest + value: '[[(now).Unix]]' + - set: + target: header.Content-Type + value: application/x-www-form-urlencoded +{{#unless username}} +{{#unless password}} +{{#if token}} + - set: + target: header.Authorization + value: {{token}} +{{/if}} +{{/unless}} +{{/unless}} +response.decode_as: application/x-ndjson +{{#if tags.length}} +tags: +{{else if preserve_original_event}} +tags: +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +processors: +- decode_json_fields: + fields: message + target: json + add_error_key: true +- drop_event: + when: + not: + has_fields: ['json.result'] +- fingerprint: + fields: + - json.result._cd + - json.result._indextime + - json.result._raw + - json.result._time + - json.result.host + - json.result.source + target_field: "@metadata._id" +- drop_fields: + fields: message +- rename: + fields: + - from: json.result._raw + to: event.original + - from: json.result.host + to: host.name + - from: json.result.source + to: event.provider + ignore_missing: true + fail_on_error: false +- drop_fields: + fields: json +- decode_xml_wineventlog: + field: event.original + target_field: winlog + ignore_missing: true + ignore_failure: true + map_ecs_fields: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/winlog.yml.hbs b/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/winlog.yml.hbs new file mode 100644 index 00000000000..59793979f37 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/agent/stream/winlog.yml.hbs @@ -0,0 +1,31 @@ +name: Microsoft-Windows-AppLocker/Packaged app-Execution +condition: ${host.platform} == 'windows' +{{#if event_id}} +event_id: {{event_id}} +{{/if}} +{{#if ignore_older}} +ignore_older: {{ignore_older}} +{{/if}} +{{#if language}} +language: {{language}} +{{/if}} +{{#if tags.length}} +tags: +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{/if}} +{{#if preserve_original_event}} +include_xml: true +{{/if}} +processors: +- translate_sid: + field: winlog.event_data.MemberSid + account_name_target: winlog.event_data._MemberUserName + domain_target: winlog.event_data._MemberDomain + account_type_target: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true +{{#if processors.length}} +{{processors}} +{{/if}} diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/applocker_packaged_app_execution/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..1366576a6bc --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,174 @@ +--- +description: Pipeline for Microsoft-Windows-AppLocker/Packaged app-Execution events +processors: + ## ECS and Event fields. + + - set: + field: ecs.version + value: '8.9.0' + - set: + field: log.level + copy_from: winlog.level + ignore_empty_value: true + ignore_failure: true + if: ctx.winlog?.level != "" + - date: + field: winlog.time_created + tag: "time_created_date" + formats: + - ISO8601 + if: ctx.winlog?.time_created != null + on_failure: + - remove: + field: winlog.time_created + ignore_failure: true + - append: + field: error.message + value: "fail-{{{ _ingest.on_failure_processor_tag }}}" + - fail: + message: "Processor {{{ _ingest.on_failure_processor_type }}} with tag {{{ _ingest.on_failure_processor_tag }}} in pipeline {{{ _ingest.on_failure_pipeline }}} failed with message: {{{ _ingest.on_failure_message }}}" + + - set: + field: event.kind + value: event + - set: + field: event.code + value: "{{{winlog.event_id}}}" + - set: + field: event.category + value: process + - set: + field: event.type + value: start + - convert: + field: winlog.record_id + type: string + ignore_failure: true + ignore_missing: true + + ## User fields. + - set: + field: user.id + copy_from: winlog.user.identifier + ignore_failure: true + ignore_empty_value: true + - split: + field: winlog.event_data.User + target_field: "_temp.user_parts" + separator: '\\' + if: ctx.winlog?.event_data?.User != null + - set: + field: user.domain + value: "{{{_temp.user_parts.0}}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - set: + field: user.name + value: "{{{_temp.user_parts.1}}}" + ignore_failure: true + ignore_empty_value: true + if: ctx._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + - rename: + field: winlog.user.name + target_field: user.name + ignore_failure: true + ignore_missing: true + if: ctx.user?.name == null + + ## User data fields. + - convert: + field: winlog.user_data.FileHashLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FileHashLength + ignore_failure: true + - convert: + field: winlog.user_data.FilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.FqbnLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FqbnLength + ignore_failure: true + - convert: + field: winlog.user_data.FullFilePathLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.FullFilePathLength + ignore_failure: true + - convert: + field: winlog.user_data.PolicyNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.PolicyNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleNameLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleNameLength + ignore_failure: true + - convert: + field: winlog.user_data.RuleSddlLength + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.RuleSddlLength + ignore_failure: true + - convert: + field: winlog.user_data.TargetProcessId + type: long + ignore_missing: true + on_failure: + - remove: + field: winlog.user_data.TargetProcessId + ignore_failure: true + + ## Fully Qualified Binary Name (FQBN) / File Fields + - grok: + field: winlog.user_data.Fqbn + ignore_missing: true + patterns: + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}L=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}L=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + - '^CN=(?.*),%{SPACE}O=(?.*),%{SPACE}S=(?.*),%{SPACE}C=(?[^\\]*)\\(?[^\\]*)\\(?[^\\]*)\\(?.*)$' + if: ctx.winlog?.user_data?.Fqbn != "-" + + - grok: + field: winlog.user_data.FullFilePath + ignore_missing: true + patterns: + - '(?([^\\]*$))' + if: ctx.winlog?.user_data?.FullFilePath != "-" + + - set: + field: file.hash.sha256 + copy_from: winlog.user_data.FileHash + ignore_empty_value: true + if: ctx.winlog?.user_data?.FileHash != "-" + +on_failure: + - set: + field: event.kind + value: pipeline_error + - append: + field: error.message + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/fields/agent.yml b/packages/windows/data_stream/applocker_packaged_app_execution/fields/agent.yml new file mode 100644 index 00000000000..da4e652c53b --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/fields/agent.yml @@ -0,0 +1,198 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/fields/base-fields.yml b/packages/windows/data_stream/applocker_packaged_app_execution/fields/base-fields.yml new file mode 100644 index 00000000000..f9de120ffcf --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/fields/base-fields.yml @@ -0,0 +1,34 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset name. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: dataset.type + type: constant_keyword + description: Dataset type. +- name: dataset.name + type: constant_keyword + description: Dataset name. +- name: dataset.namespace + type: constant_keyword + description: Dataset namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: windows +- name: event.dataset + type: constant_keyword + description: Event dataset + value: windows.applocker_packaged_app_execution +- name: tags + description: List of keywords used to tag each event. + example: '["production", "env2"]' + ignore_above: 1024 + type: keyword diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/fields/beats.yml b/packages/windows/data_stream/applocker_packaged_app_execution/fields/beats.yml new file mode 100644 index 00000000000..3c48f1f224f --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/fields/beats.yml @@ -0,0 +1,3 @@ +- name: input.type + type: keyword + description: Type of Filebeat input. diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/fields/ecs.yml b/packages/windows/data_stream/applocker_packaged_app_execution/fields/ecs.yml new file mode 100644 index 00000000000..a691dcddd24 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/fields/ecs.yml @@ -0,0 +1,98 @@ +- external: ecs + name: destination.user.domain +- external: ecs + name: destination.user.id +- external: ecs + name: destination.user.name +- external: ecs + name: ecs.version +- external: ecs + name: error.code +- external: ecs + name: event.action +- external: ecs + name: event.category +- external: ecs + name: event.code +- external: ecs + name: event.created +- external: ecs + name: event.ingested +- external: ecs + name: event.kind +- external: ecs + name: event.outcome +- external: ecs + name: event.provider +- external: ecs + name: event.sequence +- external: ecs + name: event.type +- external: ecs + name: file.directory +- external: ecs + name: file.extension +- external: ecs + name: file.hash.sha256 +- external: ecs + name: file.name +- external: ecs + name: file.path +- exernal: ecs + name: file.pe.file_version +- exernal: ecs + name: file.pe.original_file_name +- exernal: ecs + name: file.pe.product +- external: ecs + name: file.x509.subject.common_name +- external: ecs + name: file.x509.subject.country +- external: ecs + name: file.x509.subject.locality +- external: ecs + name: file.x509.subject.organization +- external: ecs + name: file.x509.subject.state_or_province +- external: ecs + name: host.name +- external: ecs + name: log.level +- external: ecs + name: message +- external: ecs + name: process.args +- external: ecs + name: process.args_count +- external: ecs + name: process.command_line +- external: ecs + name: process.entity_id +- external: ecs + name: process.executable +- external: ecs + name: process.name +- external: ecs + name: process.pid +- external: ecs + name: process.title +- external: ecs + name: related.hash +- external: ecs + name: related.hosts +- external: ecs + name: related.ip +- external: ecs + name: related.user +- external: ecs + name: source.user.domain +- external: ecs + name: source.user.id +- external: ecs + name: source.user.name +- external: ecs + name: user.domain +- external: ecs + name: user.id +- external: ecs + name: user.name diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/fields/winlog.yml b/packages/windows/data_stream/applocker_packaged_app_execution/fields/winlog.yml new file mode 100644 index 00000000000..805875a5f5f --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/fields/winlog.yml @@ -0,0 +1,416 @@ +- name: winlog + type: group + description: > + All fields specific to the Windows Event Log are defined here. + + fields: + - name: api + required: true + type: keyword + description: > + The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. + + The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. + + - name: activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. + + - name: computer_name + type: keyword + required: true + description: > + The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. + + - name: event_data + type: object + object_type: keyword + required: false + description: > + The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. + + - name: event_data + type: group + description: > + This is a non-exhaustive list of parameters that are used in Windows events. By having these fields defined in the template they can be used in dashboards and machine-learning jobs. + + fields: + - name: AuthenticationPackageName + type: keyword + - name: Binary + type: keyword + - name: BitlockerUserInputTime + type: keyword + - name: BootMode + type: keyword + - name: BootType + type: keyword + - name: BuildVersion + type: keyword + - name: Company + type: keyword + - name: CorruptionActionState + type: keyword + - name: CreationUtcTime + type: keyword + - name: Description + type: keyword + - name: Detail + type: keyword + - name: DeviceName + type: keyword + - name: DeviceNameLength + type: keyword + - name: DeviceTime + type: keyword + - name: DeviceVersionMajor + type: keyword + - name: DeviceVersionMinor + type: keyword + - name: DriveName + type: keyword + - name: DriverName + type: keyword + - name: DriverNameLength + type: keyword + - name: DwordVal + type: keyword + - name: EntryCount + type: keyword + - name: ExtraInfo + type: keyword + - name: FailureName + type: keyword + - name: FailureNameLength + type: keyword + - name: FileVersion + type: keyword + - name: FinalStatus + type: keyword + - name: Group + type: keyword + - name: IdleImplementation + type: keyword + - name: IdleStateCount + type: keyword + - name: ImpersonationLevel + type: keyword + - name: IntegrityLevel + type: keyword + - name: IpAddress + type: keyword + - name: IpPort + type: keyword + - name: KeyLength + type: keyword + - name: LastBootGood + type: keyword + - name: LastShutdownGood + type: keyword + - name: LmPackageName + type: keyword + - name: LogonGuid + type: keyword + - name: LogonId + type: keyword + - name: LogonProcessName + type: keyword + - name: LogonType + type: keyword + - name: MajorVersion + type: keyword + - name: MaximumPerformancePercent + type: keyword + - name: MemberName + type: keyword + - name: MemberSid + type: keyword + - name: MinimumPerformancePercent + type: keyword + - name: MinimumThrottlePercent + type: keyword + - name: MinorVersion + type: keyword + - name: NewProcessId + type: keyword + - name: NewProcessName + type: keyword + - name: NewSchemeGuid + type: keyword + - name: NewTime + type: keyword + - name: NominalFrequency + type: keyword + - name: Number + type: keyword + - name: OldSchemeGuid + type: keyword + - name: OldTime + type: keyword + - name: OriginalFileName + type: keyword + - name: Path + type: keyword + - name: PerformanceImplementation + type: keyword + - name: PreviousCreationUtcTime + type: keyword + - name: PreviousTime + type: keyword + - name: PrivilegeList + type: keyword + - name: ProcessId + type: keyword + - name: ProcessName + type: keyword + - name: ProcessPath + type: keyword + - name: ProcessPid + type: keyword + - name: Product + type: keyword + - name: PuaCount + type: keyword + - name: PuaPolicyId + type: keyword + - name: QfeVersion + type: keyword + - name: Reason + type: keyword + - name: SchemaVersion + type: keyword + - name: ScriptBlockText + type: keyword + - name: ServiceName + type: keyword + - name: ServiceVersion + type: keyword + - name: ShutdownActionType + type: keyword + - name: ShutdownEventCode + type: keyword + - name: ShutdownReason + type: keyword + - name: Signature + type: keyword + - name: SignatureStatus + type: keyword + - name: Signed + type: keyword + - name: StartTime + type: keyword + - name: State + type: keyword + - name: Status + type: keyword + - name: StopTime + type: keyword + - name: SubjectDomainName + type: keyword + - name: SubjectLogonId + type: keyword + - name: SubjectUserName + type: keyword + - name: SubjectUserSid + type: keyword + - name: TSId + type: keyword + - name: TargetDomainName + type: keyword + - name: TargetInfo + type: keyword + - name: TargetLogonGuid + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetServerName + type: keyword + - name: TargetUserName + type: keyword + - name: TargetUserSid + type: keyword + - name: TerminalSessionId + type: keyword + - name: TokenElevationType + type: keyword + - name: TransmittedServices + type: keyword + - name: UserSid + type: keyword + - name: Version + type: keyword + - name: Workstation + type: keyword + - name: param1 + type: keyword + - name: param2 + type: keyword + - name: param3 + type: keyword + - name: param4 + type: keyword + - name: param5 + type: keyword + - name: param6 + type: keyword + - name: param7 + type: keyword + - name: param8 + type: keyword + - name: event_id + type: keyword + required: true + description: > + The event identifier. The value is specific to the source of the event. + + - name: keywords + type: keyword + required: false + description: > + The keywords are used to classify an event. + + - name: channel + type: keyword + required: true + description: > + The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. + + - name: record_id + type: keyword + required: true + description: > + The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. + + - name: related_activity_id + type: keyword + required: false + description: > + A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. + + - name: opcode + type: keyword + required: false + description: > + The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. + + - name: provider_guid + type: keyword + required: false + description: > + A globally unique identifier that identifies the provider that logged the event. + + - name: process.pid + type: long + required: false + description: > + The process_id of the Client Server Runtime Process. + + - name: provider_name + type: keyword + required: true + description: > + The source of the event log record (the application or service that logged the record). + + - name: task + type: keyword + required: false + description: > + The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. + + - name: level + type: keyword + description: > + The level assigned to the event such as Information, Warning, or Critical. + + - name: process.thread.id + type: long + required: false + - name: time_created + type: date + description: The time the event was created. + - name: user_data + type: object + object_type: keyword + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + - name: user_data + type: group + description: > + The event specific data. This field is mutually exclusive with `event_data`. + + fields: + - name: FilePath + type: keyword + - name: FileHashLength + type: long + - name: RuleNameLength + type: long + - name: FullFilePath + type: keyword + - name: FilePathLength + type: long + - name: xml_name + type: keyword + - name: RuleSddl + type: keyword + - name: Fqbn + type: keyword + - name: PolicyName + type: keyword + - name: RuleName + type: keyword + - name: RuleSddlLength + type: long + - name: FqbnLength + type: long + - name: FullFilePathLength + type: long + - name: RuleId + type: keyword + - name: PolicyNameLength + type: long + - name: TargetUser + type: keyword + - name: TargetLogonId + type: keyword + - name: TargetProcessId + type: long + - name: FileHash + type: keyword + - name: Package + type: keyword + - name: PackageLength + type: keyword + - name: user.identifier + type: keyword + required: false + example: S-1-5-21-3541430928-2051711210-1391384369-1001 + description: > + The Windows security identifier (SID) of the account associated with this event. + + If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. + + - name: user.name + type: keyword + description: > + Name of the user associated with this event. + + - name: user.domain + type: keyword + required: false + description: > + The domain that the account associated with this event is a member of. + + - name: user.type + type: keyword + required: false + description: > + The type of account associated with this event. + + - name: version + type: long + required: false + description: The version number of the event's definition. diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/manifest.yml b/packages/windows/data_stream/applocker_packaged_app_execution/manifest.yml new file mode 100644 index 00000000000..af81e4e892c --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/manifest.yml @@ -0,0 +1,99 @@ +type: logs +title: 'Windows AppLocker/Packaged app-Execution logs' +streams: + - input: winlog + enabled: false + template_path: winlog.yml.hbs + title: Packaged app-Execution + description: 'Microsoft-Windows-AppLocker/Packaged app-Execution channel' + vars: + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: >- + Preserves a raw copy of the original XML event, added to the field `event.original` + type: bool + multi: false + default: false + - name: event_id + type: text + title: Event ID + description: >- + A list of included and excluded (blocked) event IDs. The value is a comma-separated list. The accepted values are single event IDs to include (e.g. 4624), a range of event IDs to include (e.g. 4700-4800), and single event IDs to exclude (e.g. -4735). Limit 22 clauses, lower in some situations. See integration documentation for more details. + required: false + show_user: false + default: + - name: ignore_older + type: text + title: Ignore events older than + default: 72h + required: false + show_user: false + description: >- + If this option is specified, events that are older than the specified amount of time are ignored. Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". + - name: language + type: text + title: Language ID + description: >- + The language ID the events will be rendered in. The language will be forced regardless of the system language. A complete list of language IDs can be found https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-lcid/a9eac961-e77d-41a6-90a5-ce1a8b0cdb9c[here]. It defaults to `0`, which indicates to use the system language. E.g.: 0x0409 for en-US + required: false + show_user: false + default: 0 + - name: tags + type: text + title: Tags + multi: true + show_user: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + + - input: httpjson + title: Windows AppLocker/Packaged app-Execution Events via Splunk Enterprise REST API + description: Collect AppLocker Packaged app-Execution Events via Splunk Enterprise REST API + enabled: false + template_path: httpjson.yml.hbs + vars: + - name: interval + type: text + title: Interval to query Splunk Enterprise REST API + description: Go Duration syntax (eg. 10s) + show_user: true + required: true + default: 10s + - name: search + type: text + title: Splunk search string + show_user: false + required: true + default: 'search sourcetype="XmlWinEventLog:Microsoft-Windows-AppLocker/Packaged app-Execution"' + - name: tags + type: text + title: Tags + multi: true + show_user: false + default: + - forwarded + - name: preserve_original_event + required: true + show_user: true + title: Preserve original event + description: Preserves a raw copy of the original event, added to the field `event.original` + type: bool + multi: false + default: false + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + diff --git a/packages/windows/data_stream/applocker_packaged_app_execution/sample_event.json b/packages/windows/data_stream/applocker_packaged_app_execution/sample_event.json new file mode 100644 index 00000000000..601a895ce87 --- /dev/null +++ b/packages/windows/data_stream/applocker_packaged_app_execution/sample_event.json @@ -0,0 +1,105 @@ +{ + "@timestamp": "2023-08-13T13:53:33.706Z", + "agent": { + "ephemeral_id": "b26295a5-6dd5-4ff4-9102-98ebdf4f097c", + "id": "a2f04e82-dbc6-4eae-b003-e7cd21a975ef", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_packaged_app_execution", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "a2f04e82-dbc6-4eae-b003-e7cd21a975ef", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8020", + "created": "2023-08-17T14:13:22.965Z", + "dataset": "windows.applocker_packaged_app_execution", + "ingested": "2023-08-17T14:13:26Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}'/\u003e\u003cEventID\u003e8020\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x2000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-13T13:53:33.7067781Z'/\u003e\u003cEventRecordID\u003e2986\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1672' ThreadID='8384'/\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/Packaged app-Execution\u003c/Channel\u003e\u003cComputer\u003eel33t-b00k-1\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-2707992022-4034939591-3454028951-1001'/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e4\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eAPPX\u003c/PolicyName\u003e\u003cRuleId\u003e{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}\u003c/RuleId\u003e\u003cRuleNameLength\u003e39\u003c/RuleNameLength\u003e\u003cRuleName\u003e(Default Rule) All signed packaged apps\u003c/RuleName\u003e\u003cRuleSddlLength\u003e81\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003eD:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026amp;\u0026amp; ((APPID://FQBN) \u0026gt;= ({\"*\\*\\*\",0}))))\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-2707992022-4034939591-3454028951-1001\u003c/TargetUser\u003e\u003cTargetProcessId\u003e41864\u003c/TargetProcessId\u003e\u003cPackageLength\u003e15\u003c/PackageLength\u003e\u003cPackage\u003eMICROSOFT.TODOS\u003c/Package\u003e\u003cFqbnLength\u003e116\u003c/FqbnLength\u003e\u003cFqbn\u003eCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00\u003c/Fqbn\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "2.100.61791.00", + "original_file_name": "APPX", + "product": "MICROSOFT.TODOS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "information" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", + "computer_name": "el33t-b00k-1", + "event_id": "8020", + "level": "information", + "opcode": "Info", + "process": { + "pid": 1672, + "thread": { + "id": 8384 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "2986", + "task": "None", + "time_created": "2023-08-13T13:53:33.706Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00", + "FqbnLength": 116, + "Package": "MICROSOFT.TODOS", + "PackageLength": "15", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026\u0026 ((APPID://FQBN) \u003e= ({\"*\\*\\*\",0}))))", + "RuleSddlLength": 81, + "TargetProcessId": 41864, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "xml_name": "RuleAndFileData" + } + } +} \ No newline at end of file diff --git a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json index 4e38e4806f8..e0d4ad99ac5 100644 --- a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json +++ b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json @@ -173,6 +173,49 @@ "host": { "name": "vagrant" } + }, + { + "@timestamp": "2023-06-01T05:27:01.247Z", + "event": { + "action": "Executing Pipeline", + "code": "4103", + "kind": "event", + "provider": "Microsoft-Windows-PowerShell" + }, + "host": { + "name": "host.contoso.com" + }, + "log": { + "level": "information" + }, + "message": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"\n\n\nContext:\n Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = b0c2607f-a734-4f24-8f75-fb6e7b79d116\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 860aba3e-ecbc-48d8-beaa-b5c19b845dfb\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7213\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell\n\n\nUser Data:", + "winlog": { + "activity_id": "{a5ce6d2b-8964-4ec4-b0a3-1e749f8aa4ad}", + "channel": "Microsoft-Windows-PowerShell/Operational", + "computer_name": "host.contoso.com", + "event_data": { + "ContextInfo": " Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = 1c251f62-545d-4d71-901e-b3445e459c2c\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 9f8ee3e6-561c-4875-a882-a352509348b8\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7216833\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell", + "Payload": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"" + }, + "event_id": "4103", + "level": "information", + "opcode": "To be used when operation is just executing a method", + "process": { + "pid": 2349, + "thread": { + "id": 32444 + } + }, + "provider_guid": "{92a98569-96ac-46a7-af87-1eba79f456ee}", + "provider_name": "Microsoft-Windows-PowerShell", + "record_id": 5663677, + "task": "Executing Pipeline", + "time_created": "2023-06-01T05:27:01.2479769Z", + "user": { + "identifier": "S-1-5-5" + }, + "version": 1 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json-expected.json b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json-expected.json index 5862c546abd..152e310e03e 100644 --- a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json-expected.json +++ b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-events.json-expected.json @@ -279,6 +279,127 @@ }, "version": 1 } + }, + { + "@timestamp": "2023-06-01T05:27:01.247Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "Executing Pipeline", + "category": "process", + "code": "4103", + "kind": "event", + "provider": "Microsoft-Windows-PowerShell", + "sequence": 7216833, + "type": "info" + }, + "host": { + "name": "host.contoso.com", + "os": { + "family": "windows", + "type": "windows" + } + }, + "log": { + "level": "information" + }, + "message": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"\n\n\nContext:\n Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = b0c2607f-a734-4f24-8f75-fb6e7b79d116\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 860aba3e-ecbc-48d8-beaa-b5c19b845dfb\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7213\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell\n\n\nUser Data:", + "powershell": { + "command": { + "invocation_details": [ + { + "related_command": "Get-ItemProperty", + "type": "CommandInvocation", + "value": "\"Get-ItemProperty\"" + }, + { + "name": "\"Path\"", + "related_command": "Get-ItemProperty", + "type": "ParameterBinding", + "value": "\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"" + }, + { + "name": "\"Name\"", + "related_command": "Get-ItemProperty", + "type": "ParameterBinding", + "value": "\"Authentication Packages\"" + }, + { + "related_command": "Select-Object", + "type": "CommandInvocation", + "value": "\"Select-Object\"" + }, + { + "name": "\"ExpandProperty\"", + "related_command": "Select-Object", + "type": "ParameterBinding", + "value": "\"Authentication Packages\"" + }, + { + "name": "\"InputObject\"", + "related_command": "Select-Object", + "type": "ParameterBinding", + "value": "\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"" + } + ], + "name": "Get-ItemProperty", + "type": "Cmdlet" + }, + "engine": { + "version": "5.1.17763.3770" + }, + "id": "Microsoft.PowerShell", + "pipeline_id": "2", + "process": { + "executable_version": "7.0.5000.0" + }, + "runspace_id": "9f8ee3e6-561c-4875-a882-a352509348b8" + }, + "process": { + "args": [ + "C:\\Program", + "Files\\Microsoft", + "Monitoring", + "Agent\\Agent\\MonitoringHost.exe", + "-Embedding" + ], + "args_count": 5, + "command_line": "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding", + "entity_id": "1c251f62-545d-4d71-901e-b3445e459c2c", + "title": "OpsMgr PowerShell Host" + }, + "related": { + "user": [ + "SYSTEM" + ] + }, + "user": { + "domain": "CONTOSO", + "id": "S-1-5-5", + "name": "SYSTEM" + }, + "winlog": { + "activity_id": "{a5ce6d2b-8964-4ec4-b0a3-1e749f8aa4ad}", + "channel": "Microsoft-Windows-PowerShell/Operational", + "computer_name": "host.contoso.com", + "event_id": "4103", + "opcode": "To be used when operation is just executing a method", + "process": { + "pid": 2349, + "thread": { + "id": 32444 + } + }, + "provider_guid": "{92a98569-96ac-46a7-af87-1eba79f456ee}", + "provider_name": "Microsoft-Windows-PowerShell", + "record_id": "5663677", + "task": "Executing Pipeline", + "user": { + "identifier": "S-1-5-5" + }, + "version": 1 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json index 4e38e4806f8..e0d4ad99ac5 100644 --- a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json +++ b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json @@ -173,6 +173,49 @@ "host": { "name": "vagrant" } + }, + { + "@timestamp": "2023-06-01T05:27:01.247Z", + "event": { + "action": "Executing Pipeline", + "code": "4103", + "kind": "event", + "provider": "Microsoft-Windows-PowerShell" + }, + "host": { + "name": "host.contoso.com" + }, + "log": { + "level": "information" + }, + "message": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"\n\n\nContext:\n Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = b0c2607f-a734-4f24-8f75-fb6e7b79d116\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 860aba3e-ecbc-48d8-beaa-b5c19b845dfb\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7213\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell\n\n\nUser Data:", + "winlog": { + "activity_id": "{a5ce6d2b-8964-4ec4-b0a3-1e749f8aa4ad}", + "channel": "Microsoft-Windows-PowerShell/Operational", + "computer_name": "host.contoso.com", + "event_data": { + "ContextInfo": " Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = 1c251f62-545d-4d71-901e-b3445e459c2c\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 9f8ee3e6-561c-4875-a882-a352509348b8\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7216833\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell", + "Payload": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"" + }, + "event_id": "4103", + "level": "information", + "opcode": "To be used when operation is just executing a method", + "process": { + "pid": 2349, + "thread": { + "id": 32444 + } + }, + "provider_guid": "{92a98569-96ac-46a7-af87-1eba79f456ee}", + "provider_name": "Microsoft-Windows-PowerShell", + "record_id": 5663677, + "task": "Executing Pipeline", + "time_created": "2023-06-01T05:27:01.2479769Z", + "user": { + "identifier": "S-1-5-5" + }, + "version": 1 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json-expected.json b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json-expected.json index 5862c546abd..152e310e03e 100644 --- a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json-expected.json +++ b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-powershell-operational-events.json-expected.json @@ -279,6 +279,127 @@ }, "version": 1 } + }, + { + "@timestamp": "2023-06-01T05:27:01.247Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "Executing Pipeline", + "category": "process", + "code": "4103", + "kind": "event", + "provider": "Microsoft-Windows-PowerShell", + "sequence": 7216833, + "type": "info" + }, + "host": { + "name": "host.contoso.com", + "os": { + "family": "windows", + "type": "windows" + } + }, + "log": { + "level": "information" + }, + "message": "CommandInvocation(Get-ItemProperty): \"Get-ItemProperty\"\nParameterBinding(Get-ItemProperty): name=\"Path\"; value=\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"\nParameterBinding(Get-ItemProperty): name=\"Name\"; value=\"Authentication Packages\"\nCommandInvocation(Select-Object): \"Select-Object\"\nParameterBinding(Select-Object): name=\"ExpandProperty\"; value=\"Authentication Packages\"\nParameterBinding(Select-Object): name=\"InputObject\"; value=\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"\n\n\nContext:\n Severity = Informational\n Host Name = OpsMgr PowerShell Host\n Host Version = 7.0.5000.0\n Host ID = b0c2607f-a734-4f24-8f75-fb6e7b79d116\n Host Application = C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding\n Engine Version = 5.1.17763.3770\n Runspace ID = 860aba3e-ecbc-48d8-beaa-b5c19b845dfb\n Pipeline ID = 2\n Command Name = Get-ItemProperty\n Command Type = Cmdlet\n Script Name = \n Command Path = \n Sequence Number = 7213\n User = CONTOSO\\SYSTEM\n Connected User = \n Shell ID = Microsoft.PowerShell\n\n\nUser Data:", + "powershell": { + "command": { + "invocation_details": [ + { + "related_command": "Get-ItemProperty", + "type": "CommandInvocation", + "value": "\"Get-ItemProperty\"" + }, + { + "name": "\"Path\"", + "related_command": "Get-ItemProperty", + "type": "ParameterBinding", + "value": "\"hklm:\\SYSTEM\\CurrentControlSet\\Control\\Lsa\"" + }, + { + "name": "\"Name\"", + "related_command": "Get-ItemProperty", + "type": "ParameterBinding", + "value": "\"Authentication Packages\"" + }, + { + "related_command": "Select-Object", + "type": "CommandInvocation", + "value": "\"Select-Object\"" + }, + { + "name": "\"ExpandProperty\"", + "related_command": "Select-Object", + "type": "ParameterBinding", + "value": "\"Authentication Packages\"" + }, + { + "name": "\"InputObject\"", + "related_command": "Select-Object", + "type": "ParameterBinding", + "value": "\"@{Authentication Packages=System.String[]; PSPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa; PSParentPath=Microsoft.PowerShell.Core\\Registry::HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control; PSChildName=Lsa; PSDrive=HKLM; PSProvider=Microsoft.PowerShell.Core\\Registry}\"" + } + ], + "name": "Get-ItemProperty", + "type": "Cmdlet" + }, + "engine": { + "version": "5.1.17763.3770" + }, + "id": "Microsoft.PowerShell", + "pipeline_id": "2", + "process": { + "executable_version": "7.0.5000.0" + }, + "runspace_id": "9f8ee3e6-561c-4875-a882-a352509348b8" + }, + "process": { + "args": [ + "C:\\Program", + "Files\\Microsoft", + "Monitoring", + "Agent\\Agent\\MonitoringHost.exe", + "-Embedding" + ], + "args_count": 5, + "command_line": "C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe -Embedding", + "entity_id": "1c251f62-545d-4d71-901e-b3445e459c2c", + "title": "OpsMgr PowerShell Host" + }, + "related": { + "user": [ + "SYSTEM" + ] + }, + "user": { + "domain": "CONTOSO", + "id": "S-1-5-5", + "name": "SYSTEM" + }, + "winlog": { + "activity_id": "{a5ce6d2b-8964-4ec4-b0a3-1e749f8aa4ad}", + "channel": "Microsoft-Windows-PowerShell/Operational", + "computer_name": "host.contoso.com", + "event_id": "4103", + "opcode": "To be used when operation is just executing a method", + "process": { + "pid": 2349, + "thread": { + "id": 32444 + } + }, + "provider_guid": "{92a98569-96ac-46a7-af87-1eba79f456ee}", + "provider_name": "Microsoft-Windows-PowerShell", + "record_id": "5663677", + "task": "Executing Pipeline", + "user": { + "identifier": "S-1-5-5" + }, + "version": 1 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-sysmon-operational-events.json-expected.json b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-sysmon-operational-events.json-expected.json index c5445128c16..06de8c2a253 100644 --- a/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-sysmon-operational-events.json-expected.json +++ b/packages/windows/data_stream/forwarded/_dev/test/pipeline/test-sysmon-operational-events.json-expected.json @@ -49,6 +49,7 @@ "version": "7.14.1" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -80,7 +81,6 @@ "protocol": "dns" }, "process": { - "entity_id": "{00000000-0000-0000-0000-000000000000}", "executable": "\u003cunknown process\u003e", "pid": 6968 }, @@ -159,6 +159,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -260,6 +261,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -336,6 +338,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -447,6 +450,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -552,6 +556,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -628,6 +633,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -659,7 +665,7 @@ "registry": { "data": { "strings": [ - "0x00000004" + "4" ], "type": "SZ_DWORD" }, @@ -675,6 +681,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "DWORD (0x00000004)", "EventType": "SetValue" }, "event_id": "13", @@ -700,6 +707,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -806,6 +814,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -914,6 +923,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1009,6 +1019,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1114,6 +1125,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1207,6 +1219,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1314,6 +1327,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1457,6 +1471,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1561,6 +1576,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1661,6 +1677,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1767,6 +1784,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1860,6 +1878,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1965,6 +1984,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2040,6 +2060,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -2069,6 +2090,12 @@ "pid": 4320 }, "registry": { + "data": { + "strings": [ + "Binary Data" + ], + "type": "REG_BINARY" + }, "hive": "HKU", "key": "S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", "path": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", @@ -2081,6 +2108,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -2131,6 +2159,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2232,6 +2261,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2308,6 +2338,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -2355,6 +2386,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "QWORD (0x00000000-0x00000005)", "EventType": "SetValue" }, "event_id": "13", @@ -2380,6 +2412,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -2409,6 +2442,12 @@ "pid": 4320 }, "registry": { + "data": { + "strings": [ + "Binary Data" + ], + "type": "REG_BINARY" + }, "hive": "HKU", "key": "S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\ertrqvg.rkr", "path": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\ertrqvg.rkr", @@ -2421,6 +2460,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -2498,6 +2538,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2604,6 +2645,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2755,6 +2797,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2899,6 +2942,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3053,6 +3097,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3173,6 +3218,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3328,6 +3374,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3488,6 +3535,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3588,6 +3636,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3729,6 +3778,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3832,6 +3882,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3974,6 +4025,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4072,6 +4124,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4168,6 +4221,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4303,6 +4357,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4428,6 +4483,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4508,6 +4564,7 @@ "version": "8.0.0" }, "event": { + "action": "ServiceConfigurationChange", "category": [ "configuration" ], @@ -4582,6 +4639,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4713,6 +4771,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4859,6 +4918,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5009,6 +5069,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5115,6 +5176,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5261,6 +5323,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5411,6 +5474,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5495,6 +5559,7 @@ "version": "8.0.0" }, "event": { + "action": "Sysmon service state changed", "category": [ "process" ], @@ -5571,6 +5636,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5663,6 +5729,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5737,6 +5804,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -5880,6 +5948,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6018,6 +6087,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6101,6 +6171,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -6272,6 +6343,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6385,6 +6457,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6534,6 +6607,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6646,6 +6720,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6772,6 +6847,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6878,6 +6954,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6975,6 +7052,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7058,6 +7136,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7137,6 +7216,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7208,6 +7288,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -7330,6 +7411,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7444,6 +7526,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7541,6 +7624,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7616,6 +7700,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -7738,6 +7823,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7822,6 +7908,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -7931,6 +8018,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8014,6 +8102,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8099,6 +8188,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8184,6 +8274,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8295,6 +8386,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8437,6 +8529,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8525,6 +8618,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8626,6 +8720,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8713,6 +8808,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8828,6 +8924,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8907,6 +9004,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8992,6 +9090,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9075,6 +9174,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9157,6 +9257,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9239,6 +9340,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9323,6 +9425,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9406,6 +9509,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9491,6 +9595,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9576,6 +9681,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9692,6 +9798,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9789,6 +9896,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9929,6 +10037,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10084,6 +10193,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10239,6 +10349,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10389,6 +10500,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10503,6 +10615,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10615,6 +10728,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10711,6 +10825,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10852,6 +10967,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11009,6 +11125,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11156,6 +11273,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11237,6 +11355,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -11317,6 +11436,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -11373,6 +11493,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -11429,6 +11550,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11495,6 +11617,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11561,6 +11684,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11627,6 +11751,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11700,6 +11825,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -11756,6 +11882,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11847,6 +11974,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11994,6 +12122,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12101,6 +12230,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12248,6 +12378,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12392,6 +12523,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12520,6 +12652,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12669,6 +12802,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12800,6 +12934,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12892,6 +13027,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13032,6 +13168,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13152,6 +13289,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13243,6 +13381,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13383,6 +13522,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13534,6 +13674,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13664,6 +13805,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13805,6 +13947,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13937,6 +14080,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14071,6 +14215,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14228,6 +14373,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14374,6 +14520,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14518,6 +14665,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14667,6 +14815,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14817,6 +14966,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14926,6 +15076,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15073,6 +15224,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15175,6 +15327,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15287,6 +15440,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15388,6 +15542,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15489,6 +15644,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15589,6 +15745,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15691,6 +15848,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15787,6 +15945,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15892,6 +16051,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15993,6 +16153,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16105,6 +16266,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16207,6 +16369,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16308,6 +16471,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16409,6 +16573,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16557,6 +16722,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16678,6 +16844,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16788,6 +16955,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16929,6 +17097,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17030,6 +17199,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17129,6 +17299,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17276,6 +17447,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17379,6 +17551,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17479,6 +17652,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17624,6 +17798,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17777,6 +17952,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17881,6 +18057,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18028,6 +18205,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18178,6 +18356,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18330,6 +18509,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18475,6 +18655,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18621,6 +18802,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18981,6 +19163,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19164,6 +19347,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19269,6 +19453,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19373,6 +19558,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19458,6 +19644,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19554,6 +19741,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19702,6 +19890,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19855,6 +20044,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19962,6 +20152,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20104,6 +20295,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20261,6 +20453,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20410,6 +20603,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20541,6 +20735,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20655,6 +20850,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20763,6 +20959,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20905,6 +21102,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21026,6 +21224,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21177,6 +21376,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21280,6 +21480,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21380,6 +21581,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21477,6 +21679,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21560,6 +21763,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21636,6 +21840,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21712,6 +21917,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21812,6 +22018,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21910,6 +22117,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21985,6 +22193,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -22088,6 +22297,7 @@ "version": "8.0.0" }, "event": { + "action": "ProcessTampering (Process image change)", "category": [ "process" ], @@ -22146,6 +22356,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -22226,6 +22437,7 @@ "version": "8.0.0" }, "event": { + "action": "Image loaded", "category": [ "process" ], @@ -22323,6 +22535,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -22352,6 +22565,12 @@ "pid": 4320 }, "registry": { + "data": { + "strings": [ + "Binary Data" + ], + "type": "REG_BINARY" + }, "hive": "HKU", "key": "S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", "path": "HKU\\S-1-5-21-1067164964-2079179834-2367582738-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA", @@ -22364,6 +22583,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -22389,6 +22609,7 @@ "version": "8.0.0" }, "event": { + "action": "ClipboardChange (New content in the clipboard)", "code": "24", "created": "2021-02-25T15:04:48.607Z", "kind": "event", @@ -22460,6 +22681,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -22581,6 +22803,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -22663,6 +22886,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDeleteDetected (File Delete logged)", "category": [ "file" ], @@ -22743,6 +22967,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDeleteDetected (File Delete logged)", "category": [ "file" ], diff --git a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml index df1380df92d..e9afc6de1e5 100644 --- a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml +++ b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell.yml @@ -46,6 +46,7 @@ processors: value: "fail-{{{ _ingest.on_failure_processor_tag }}}" - fail: message: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" + - set: field: event.kind value: event @@ -125,6 +126,29 @@ processors: ignore_failure: true allow_duplicates: false if: ctx?.user?.name != null + # Get user details from the translate_sid processor enrichment + # if they are available and we don't already have them. + - rename: + field: winlog.event_data._MemberUserName + target_field: user.name + ignore_failure: true + ignore_missing: true + - rename: + field: winlog.event_data._MemberDomain + target_field: user.domain + ignore_failure: true + ignore_missing: true + - append: + value: '{{{winlog.event_data._MemberAccountType}}}' + field: user.roles + ignore_failure: true + allow_duplicates: false + if: ctx.winlog?.event_data?._MemberAccountType != null + - remove: + field: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true + if: ctx.user?.roles != null && ctx.winlog?.event_data?._MemberAccountType != null && ctx.user.roles.contains(ctx.winlog.event_data._MemberAccountType) ## PowerShell fields. @@ -237,7 +261,7 @@ processors: field: param3 source: |- def parseRawDetail(String raw) { - Pattern detailRegex = /^(.+)\((.+)\)\:\s*(.+)?$/; + Pattern detailRegex = /^([^:(]+)\(([^)]+)\)\:\s*(.+)?$/; Pattern parameterBindingRegex = /name\=(.+);\s*value\=(.+)$/; def matcher = detailRegex.matcher(raw); diff --git a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml index 7f70f6baef7..c2d3784f20a 100644 --- a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml +++ b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/powershell_operational.yml @@ -48,6 +48,7 @@ processors: value: "fail-{{{ _ingest.on_failure_processor_tag }}}" - fail: message: "Processor {{ _ingest.on_failure_processor_type }} with tag {{ _ingest.on_failure_processor_tag }} in pipeline {{ _ingest.on_failure_pipeline }} failed with message: {{ _ingest.on_failure_message }}" + - set: field: event.kind value: event @@ -179,6 +180,29 @@ processors: ignore_failure: true ignore_empty_value: true if: ctx?.source?.user != null + # Get user details from the translate_sid processor enrichment + # if they are available and we don't already have them. + - rename: + field: winlog.event_data._MemberUserName + target_field: user.name + ignore_failure: true + ignore_missing: true + - rename: + field: winlog.event_data._MemberDomain + target_field: user.domain + ignore_failure: true + ignore_missing: true + - append: + value: '{{{winlog.event_data._MemberAccountType}}}' + field: user.roles + ignore_failure: true + allow_duplicates: false + if: ctx.winlog?.event_data?._MemberAccountType != null + - remove: + field: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true + if: ctx.user?.roles != null && ctx.winlog?.event_data?._MemberAccountType != null && ctx.user.roles.contains(ctx.winlog.event_data._MemberAccountType) ## PowerShell fields. @@ -289,7 +313,7 @@ processors: field: Payload source: |- def parseRawDetail(String raw) { - Pattern detailRegex = /^(.+)\((.+)\)\:\s*(.+)?$/; + Pattern detailRegex = /^([^(]+)\(([^)]+)\)\:\s*(.+)?$/; Pattern parameterBindingRegex = /name\=(.+);\s*value\=(.+)$/; def matcher = detailRegex.matcher(raw); diff --git a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml index 36656fef4e8..3abe5fa22b5 100644 --- a/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml +++ b/packages/windows/data_stream/forwarded/elasticsearch/ingest_pipeline/sysmon_operational.yml @@ -6,6 +6,10 @@ processors: - set: field: ecs.version value: '8.0.0' + - script: + description: Remove all empty values from event_data. + lang: painless + source: ctx.winlog?.event_data?.entrySet().removeIf(entry -> [null, "", "-", "{00000000-0000-0000-0000-000000000000}"].contains(entry.getValue())) - rename: field: winlog.level target_field: log.level @@ -44,7 +48,7 @@ processors: value: '{{winlog.event_id}}' - script: - description: Set event category and type for all event types. + description: Set event action, category and type for all event types. lang: painless params: "1": @@ -52,11 +56,13 @@ processors: - process type: - start + action: 'Process creation' "2": category: - file type: - change + action: 'A process changed a file creation time' "3": category: - network @@ -64,74 +70,118 @@ processors: - start - connection - protocol + action: 'Network connection' "4": category: - process type: - change + action: 'Sysmon service state changed' "5": category: - process type: - end + action: 'Process terminated' "6": category: - driver type: - start + action: 'Driver loaded' "7": category: - process type: - change + action: 'Image loaded' + "8": + category: + - process + type: + - change + action: 'CreateRemoteThread' + "9": + category: + - process + type: + - access + action: 'RawAccessRead' "10": category: - process type: - access + action: 'ProcessAccess' "11": category: - file type: - creation + action: 'FileCreate' "12": category: - configuration - registry type: - change + action: 'RegistryEvent (Object create and delete)' "13": category: - configuration - registry type: - change + action: 'RegistryEvent (Value Set)' "14": category: - configuration - registry type: - change + action: 'RegistryEvent (Key and Value Rename)' "15": category: - file type: - access + action: 'FileCreateStreamHash' "16": category: - configuration type: - change + action: 'ServiceConfigurationChange' "17": category: - file type: - creation + action: 'PipeEvent (Pipe Created)' "18": category: - file type: - access + action: 'PipeEvent (Pipe Connected)' + "19": + category: + - process + type: + - creation + action: 'WmiEvent (WmiEventFilter activity detected)' + "20": + category: + - process + type: + - creation + action: 'WmiEvent (WmiEventConsumer activity detected)' + "21": + category: + - process + type: + - access + action: 'WmiEvent (WmiEventConsumerToFilter activity detected)' "22": category: - network @@ -139,27 +189,58 @@ processors: - connection - protocol - info + action: 'DNSEvent (DNS query)' "23": category: - file type: - deletion + action: 'FileDelete (File Delete archived)' "24": type: - change + action: 'ClipboardChange (New content in the clipboard)' "25": category: - process type: - change + action: 'ProcessTampering (Process image change)' "26": category: - file type: - deletion - tag: Set ECS categorization fields + action: 'FileDeleteDetected (File Delete logged)' + "27": + category: + - file + type: + - creation + - denied + action: 'FileBlockExecutable' + "28": + category: + - file + type: + - deletion + - denied + action: 'FileBlockShredding' + "29": + category: + - file + type: + - creation + action: 'FileExecutableDetected' + "255": + category: + - process + type: + - error + action: 'Error' + tag: Add ECS categorization fields source: |- - if (ctx?.event?.code == null || params.get(ctx.event.code) == null) { + if (ctx.event?.code == null || params.get(ctx.event.code) == null) { return; } def hm = new HashMap(params[ctx.event.code]); @@ -507,7 +588,7 @@ processors: target_field: file.hash if: |- ctx?._temp?.hashes != null && - ["6", "7", "15"].contains(ctx.event.code) + ["6", "7", "15", "29"].contains(ctx.event.code) - rename: field: file.hash.imphash target_field: file.pe.imphash @@ -772,15 +853,20 @@ processors: if (answer.startsWith("type:")) { def parts = /\s+/.split(answer); - if (parts.length != 3) { + if (parts.length < 2) { throw new Exception("unexpected QueryResult format"); } - - answers.add([ - "type": params[parts[1]], - "data": parts[2] - ]); - relatedHosts.add(parts[2]); + if (parts.length == 3) { + answers.add([ + "type": params[parts[1]], + "data": parts[2] + ]); + relatedHosts.add(parts[2]); + } else { + answers.add([ + "type": params[parts[1]] + ]); + } } else { answer = answer.replace("::ffff:", ""); ips.add(answer); @@ -857,6 +943,7 @@ processors: field: related.ip value: "{{_ingest._value}}" allow_duplicates: false + ignore_failure: true - community_id: ignore_failure: true ignore_missing: false @@ -885,6 +972,29 @@ processors: ignore_failure: true ignore_empty_value: true if: ctx?._temp?.user_parts != null && ctx._temp.user_parts.size() == 2 + # Get user details from the translate_sid processor enrichment + # if they are available and we don't already have them. + - rename: + field: winlog.event_data._MemberUserName + target_field: user.name + ignore_failure: true + ignore_missing: true + - rename: + field: winlog.event_data._MemberDomain + target_field: user.domain + ignore_failure: true + ignore_missing: true + - append: + value: '{{{winlog.event_data._MemberAccountType}}}' + field: user.roles + ignore_failure: true + allow_duplicates: false + if: ctx.winlog?.event_data?._MemberAccountType != null + - remove: + field: winlog.event_data._MemberAccountType + ignore_missing: true + ignore_failure: true + if: ctx.user?.roles != null && ctx.winlog?.event_data?._MemberAccountType != null && ctx.user.roles.contains(ctx.winlog.event_data._MemberAccountType) ## Sysmon fields @@ -1162,8 +1272,9 @@ processors: HKU: "HKU" source: |- ctx.registry = new HashMap(); - Pattern qwordRegex = /(?i)QWORD \(((0x\d{8})-(0x\d{8}))\)/; - Pattern dwordRegex = /(?i)DWORD \((0x\d{8})\)/; + Pattern qwordRegex = /(?i)QWORD \(((0x[0-9A-F]{8})-(0x[0-9A-F]{8}))\)/; + Pattern dwordRegex = /(?i)DWORD \((0x[0-9A-F]{8})\)/; + Pattern binDataRegex = /Binary Data/; def path = ctx.winlog.event_data.TargetObject; ctx.registry.path = path; @@ -1192,26 +1303,52 @@ processors: if (!Double.isNaN(parsedHighByte) && !Double.isNaN(parsedLowByte)) { dataType = "SZ_QWORD"; dataValue = Long.toString(((parsedHighByte << 8) + parsedLowByte)); + ctx.registry.data = [ + "strings": [dataValue], + "type": dataType + ]; } - } else { - matcher = dwordRegex.matcher(data); - if (matcher.matches()) { - def parsedValue = Long.parseLong(matcher.group(1).substring(prefixLen), 16); - if (!Double.isNaN(parsedValue)) { - dataType = "SZ_DWORD"; - dataValue = matcher.group(1); - } + return; + } + + matcher = dwordRegex.matcher(data); + if (matcher.matches()) { + def parsedValue = Long.parseLong(matcher.group(1).substring(prefixLen), 16); + if (!Double.isNaN(parsedValue)) { + dataType = "SZ_DWORD"; + dataValue = Long.toString(parsedValue); + ctx.registry.data = [ + "strings": [dataValue], + "type": dataType + ]; } + return; } - if (dataType != "") { + matcher = binDataRegex.matcher(data); + if (matcher.matches()) { + // Data type could be REG_BINARY or REG_MULTI_SZ ctx.registry.data = [ - "strings": [dataValue], - "type": dataType + "strings": [data], + "type": "REG_BINARY" ]; + return; } + + // REG_SZ or REG_EXPAND_SZ + ctx.registry.data = [ + "strings": [data], + "type": "REG_SZ" + ]; } + +## Conformity + - rename: + field: winlog.event_data.TargetProcessGuid + target_field: winlog.event_data.TargetProcessGUID + if: ctx.winlog?.event_data?.TargetProcessGuid != null + ## Cleanup - remove: @@ -1240,7 +1377,6 @@ processors: - winlog.event_data.Hash - winlog.event_data.Hashes - winlog.event_data.TargetObject - - winlog.event_data.Details - winlog.time_created - winlog.level ignore_failure: true diff --git a/packages/windows/data_stream/forwarded/fields/ecs.yml b/packages/windows/data_stream/forwarded/fields/ecs.yml index 39b88dd3642..0647023c979 100644 --- a/packages/windows/data_stream/forwarded/fields/ecs.yml +++ b/packages/windows/data_stream/forwarded/fields/ecs.yml @@ -48,6 +48,8 @@ name: dns.type - external: ecs name: ecs.version +- external: ecs + name: error.code - external: ecs name: event.action - external: ecs diff --git a/packages/windows/data_stream/forwarded/fields/winlog.yml b/packages/windows/data_stream/forwarded/fields/winlog.yml index aca96865745..67057be60df 100644 --- a/packages/windows/data_stream/forwarded/fields/winlog.yml +++ b/packages/windows/data_stream/forwarded/fields/winlog.yml @@ -140,7 +140,7 @@ type: keyword - name: Description type: keyword - - name: Detail + - name: Details type: keyword - name: DeviceName type: keyword diff --git a/packages/windows/data_stream/forwarded/sample_event.json b/packages/windows/data_stream/forwarded/sample_event.json index 7b6e8731155..264c5958e2a 100644 --- a/packages/windows/data_stream/forwarded/sample_event.json +++ b/packages/windows/data_stream/forwarded/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-05-13T09:04:04.755Z", "agent": { - "ephemeral_id": "5c17ad81-b99e-42f1-93f6-bbbe10bbb567", - "id": "3456d621-8d2b-4347-9f0d-c80061df73d7", + "ephemeral_id": "5c46babe-1a9f-4a01-b7f9-1417240e1072", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.7.1" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.forwarded", @@ -16,17 +16,17 @@ "version": "8.0.0" }, "elastic_agent": { - "id": "3456d621-8d2b-4347-9f0d-c80061df73d7", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "8.7.1" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": "process", "code": "4105", - "created": "2023-05-12T02:24:42.259Z", + "created": "2023-08-14T00:34:51.349Z", "dataset": "windows.forwarded", - "ingested": "2023-05-12T02:24:43Z", + "ingested": "2023-08-14T00:34:52Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4105\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e102\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T09:04:04.755232500Z'/\u003e\u003cEventRecordID\u003e790\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{dd68516a-2930-0000-5962-68dd3029d601}'/\u003e\u003cExecution ProcessID='4204' ThreadID='1476'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ScriptBlockId'\u003ef4a378ab-b74f-41a7-a5ef-6dd55562fdb9\u003c/Data\u003e\u003cData Name='RunspaceId'\u003e9c031e5c-8d5a-4b91-a12e-b3624970b623\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-PowerShell", diff --git a/packages/windows/data_stream/perfmon/agent/stream/stream.yml.hbs b/packages/windows/data_stream/perfmon/agent/stream/stream.yml.hbs index a28ac619f74..e9bc00e6f3c 100644 --- a/packages/windows/data_stream/perfmon/agent/stream/stream.yml.hbs +++ b/packages/windows/data_stream/perfmon/agent/stream/stream.yml.hbs @@ -2,6 +2,7 @@ metricsets: ["perfmon"] condition: ${host.platform} == 'windows' perfmon.group_measurements_by_instance: {{perfmon.group_measurements_by_instance}} perfmon.ignore_non_existent_counters: {{perfmon.ignore_non_existent_counters}} +perfmon.refresh_wildcard_counters: {{perfmon.refresh_wildcard_counters}} perfmon.queries: {{perfmon.queries}} period: {{period}} {{#if processors}} diff --git a/packages/windows/data_stream/perfmon/manifest.yml b/packages/windows/data_stream/perfmon/manifest.yml index 11e27ef8039..356f0ee3376 100644 --- a/packages/windows/data_stream/perfmon/manifest.yml +++ b/packages/windows/data_stream/perfmon/manifest.yml @@ -19,6 +19,14 @@ streams: show_user: true default: false description: Enabling this option will make sure to ignore any errors caused by counters that do not exist + - name: perfmon.refresh_wildcard_counters + type: bool + title: Perfmon Refresh Wildcard Counters + multi: false + required: false + show_user: true + default: false + description: Enabling this option will cause the counter list to be retrieved after each fetch, rather than once at start time. - name: perfmon.queries type: yaml title: Perfmon Queries diff --git a/packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml index c6371ba0ee8..e9afc6de1e5 100644 --- a/packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml +++ b/packages/windows/data_stream/powershell/elasticsearch/ingest_pipeline/default.yml @@ -462,4 +462,4 @@ on_failure: value: pipeline_error - append: field: error.message - value: "{{ _ingest.on_failure_message }}" + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/windows/data_stream/powershell/fields/ecs.yml b/packages/windows/data_stream/powershell/fields/ecs.yml index 3491fdf3de5..71edd751565 100644 --- a/packages/windows/data_stream/powershell/fields/ecs.yml +++ b/packages/windows/data_stream/powershell/fields/ecs.yml @@ -6,6 +6,8 @@ name: destination.user.name - external: ecs name: ecs.version +- external: ecs + name: error.code - external: ecs name: event.action - external: ecs diff --git a/packages/windows/data_stream/powershell/sample_event.json b/packages/windows/data_stream/powershell/sample_event.json index 45e597cfcc4..9c6e17b648b 100644 --- a/packages/windows/data_stream/powershell/sample_event.json +++ b/packages/windows/data_stream/powershell/sample_event.json @@ -1,12 +1,11 @@ { "@timestamp": "2020-05-13T13:21:43.183Z", "agent": { - "ephemeral_id": "9c05a45c-02bf-4437-9447-8591244dbdca", - "hostname": "docker-fleet-agent", - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "ephemeral_id": "bd1da8d2-a190-4089-9031-a8e5278277fd", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.powershell", @@ -17,17 +16,17 @@ "version": "8.0.0" }, "elastic_agent": { - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "7.17.0" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": "process", "code": "600", - "created": "2022-03-31T08:41:12.816Z", + "created": "2023-08-14T00:35:36.340Z", "dataset": "windows.powershell", - "ingested": "2022-03-31T08:41:16Z", + "ingested": "2023-08-14T00:35:39Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T13:21:43.183180900Z'/\u003e\u003cEventRecordID\u003e1089\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eCertificate\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Certificate\n\tNewProviderState=Started\n\n\tSequenceNumber=35\n\n\tHostName=Windows PowerShell ISE Host\n\tHostVersion=5.1.17763.1007\n\tHostId=86edc16f-6943-469e-8bd8-ef1857080206\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe C:\\Users\\vagrant\\Desktop\\lateral.ps1\n\tEngineVersion=5.1.17763.1007\n\tRunspaceId=9d21da0b-e402-40e1-92ff-98c5ab1137a9\n\tPipelineId=15\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T13:25:04.656426900Z'/\u003e\u003cEventRecordID\u003e1266\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eRegistry\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.17763.1007\n\tHostId=44b8d66c-f5a2-4abb-ac7d-6db73990a6d3\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-06-04T07:25:04.857430200Z'/\u003e\u003cEventRecordID\u003e18640\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eCertificate\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Certificate\n\tNewProviderState=Started\n\n\tSequenceNumber=8\n\n\tHostName=ConsoleHost\n\tHostVersion=2.0\n\tHostId=99a16837-7392-463d-afe5-5f3ed24bd358\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "PowerShell", diff --git a/packages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml index 637ed8bd94a..c2d3784f20a 100644 --- a/packages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml +++ b/packages/windows/data_stream/powershell_operational/elasticsearch/ingest_pipeline/default.yml @@ -521,4 +521,4 @@ on_failure: value: pipeline_error - append: field: error.message - value: "{{ _ingest.on_failure_message }}" + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/windows/data_stream/powershell_operational/fields/ecs.yml b/packages/windows/data_stream/powershell_operational/fields/ecs.yml index 3491fdf3de5..71edd751565 100644 --- a/packages/windows/data_stream/powershell_operational/fields/ecs.yml +++ b/packages/windows/data_stream/powershell_operational/fields/ecs.yml @@ -6,6 +6,8 @@ name: destination.user.name - external: ecs name: ecs.version +- external: ecs + name: error.code - external: ecs name: event.action - external: ecs diff --git a/packages/windows/data_stream/powershell_operational/sample_event.json b/packages/windows/data_stream/powershell_operational/sample_event.json index 51586bda915..dfb774c434a 100644 --- a/packages/windows/data_stream/powershell_operational/sample_event.json +++ b/packages/windows/data_stream/powershell_operational/sample_event.json @@ -1,12 +1,11 @@ { "@timestamp": "2020-05-13T09:04:04.755Z", "agent": { - "ephemeral_id": "d531ecae-45f4-4f96-a334-2c851a45469a", - "hostname": "docker-fleet-agent", - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "ephemeral_id": "2d7b986c-9bc7-4121-aebd-5ca44de66797", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.powershell_operational", @@ -17,17 +16,17 @@ "version": "8.0.0" }, "elastic_agent": { - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "7.17.0" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": "process", "code": "4105", - "created": "2022-03-31T08:41:48.560Z", + "created": "2023-08-14T00:36:22.656Z", "dataset": "windows.powershell_operational", - "ingested": "2022-03-31T08:41:49Z", + "ingested": "2023-08-14T00:36:23Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4105\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e102\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T09:04:04.755232500Z'/\u003e\u003cEventRecordID\u003e790\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{dd68516a-2930-0000-5962-68dd3029d601}'/\u003e\u003cExecution ProcessID='4204' ThreadID='1476'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ScriptBlockId'\u003ef4a378ab-b74f-41a7-a5ef-6dd55562fdb9\u003c/Data\u003e\u003cData Name='RunspaceId'\u003e9c031e5c-8d5a-4b91-a12e-b3624970b623\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-PowerShell", diff --git a/packages/windows/data_stream/service/fields/agent.yml b/packages/windows/data_stream/service/fields/agent.yml index da4e652c53b..93773a936e2 100644 --- a/packages/windows/data_stream/service/fields/agent.yml +++ b/packages/windows/data_stream/service/fields/agent.yml @@ -8,6 +8,7 @@ - name: account.id level: extended type: keyword + dimension: true ignore_above: 1024 description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. @@ -16,12 +17,14 @@ - name: availability_zone level: extended type: keyword + dimension: true ignore_above: 1024 description: Availability zone in which this host is running. example: us-east-1c - name: instance.id level: extended type: keyword + dimension: true ignore_above: 1024 description: Instance ID of the host machine. example: i-1234567890abcdef0 @@ -39,12 +42,14 @@ - name: provider level: extended type: keyword + dimension: true ignore_above: 1024 description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. example: aws - name: region level: extended type: keyword + dimension: true ignore_above: 1024 description: Region in which this host is running. example: us-east-1 @@ -65,6 +70,7 @@ - name: id level: core type: keyword + dimension: true ignore_above: 1024 description: Unique container id. - name: image.name @@ -133,6 +139,7 @@ - name: name level: core type: keyword + dimension: true ignore_above: 1024 description: 'Name of the host. @@ -196,3 +203,11 @@ description: > OS codename, if any. +- name: agent + title: Agent + type: group + fields: + - name: id + type: keyword + ignore_above: 1024 + dimension: true \ No newline at end of file diff --git a/packages/windows/data_stream/service/fields/fields.yml b/packages/windows/data_stream/service/fields/fields.yml index 7618a693c4c..0aea2b152f0 100644 --- a/packages/windows/data_stream/service/fields/fields.yml +++ b/packages/windows/data_stream/service/fields/fields.yml @@ -3,6 +3,7 @@ fields: - name: id type: keyword + dimension: true description: | A unique ID for the service. It is a hash of the machine's GUID and the service name. - name: name @@ -27,6 +28,8 @@ Fully qualified path to the file that implements the service, including arguments. - name: state type: keyword + #Reason to add as dimension field: There is no associated pid in more than one state, and multiple instances of the same service can be instantiated at a given time. + dimension: true description: | The actual state of the service. The possible values are `Continuing`, `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`. - name: exit_code @@ -35,10 +38,13 @@ For `Stopped` services this is the error code that service reports when starting to stopping. This will be the generic Windows service error code unless the service provides a service-specific error code. - name: pid type: long + #Reason to add as dimension field: Uniquely identify the running process, is important when service restarts and continues with the same service id. + dimension: true description: | For `Running` services this is the associated process PID. - name: uptime.ms type: long format: duration + metric_type: gauge description: | - The service's uptime specified in milliseconds. + The service's uptime specified in milliseconds. \ No newline at end of file diff --git a/packages/windows/data_stream/service/manifest.yml b/packages/windows/data_stream/service/manifest.yml index 4af56cc354e..ae9605419fe 100644 --- a/packages/windows/data_stream/service/manifest.yml +++ b/packages/windows/data_stream/service/manifest.yml @@ -19,3 +19,5 @@ streams: description: Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/metricbeat/current/filtering-and-enhancing-data.html) for details. title: Windows service metrics description: Collect Windows service metrics +elasticsearch: + index_mode: "time_series" \ No newline at end of file diff --git a/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json b/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json index 207e5f17c52..0ef9ecef575 100644 --- a/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json +++ b/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json @@ -9528,6 +9528,50 @@ }, "version": 5 } + }, + { + "event": { + "code": "29", + "kind": "event", + "provider": "Microsoft-Windows-Sysmon" + }, + "host": { + "name": "SEC-TRACE-WinSRV22-Y01" + }, + "log": { + "level": "information" + }, + "winlog": { + "channel": "Microsoft-Windows-Sysmon/Operational", + "computer_name": "SEC-TRACE-WinSRV22-Y01", + "event_data": { + "Hashes": "SHA1=D48757B74EFF02255F74614F35AA27ABBE3F72C7,MD5=32365E3E64D28CC94756AC9A09B67F06,SHA256=09043C51719D4BF6405C9A7A292BB9BB3BCC782F639B708DDCC4EEDB5E5C9CE9,IMPHASH=1F2627FC453DC35031A9502372BD3549", + "Image": "C:\\Windows\\system32\\curl.exe", + "ProcessGuid": "{2f280947-3586-649e-5901-000000000e00}", + "ProcessId": "3828", + "RuleName": "-", + "TargetFilename": "C:\\Users\\auruser\\Desktop\\32365e3e64d28cc94756ac9a09b67f06.bin", + "User": "SEC-TRACE-WINSR\\auruser", + "UtcTime": "2023-06-30 01:53:13.076" + }, + "event_id": "29", + "level": "information", + "opcode": "Info", + "process": { + "pid": 2824, + "thread": { + "id": 1380 + } + }, + "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", + "provider_name": "Microsoft-Windows-Sysmon", + "record_id": 679378, + "time_created": "2023-06-30T01:53:13.0787986Z", + "user": { + "identifier": "S-1-5-18" + }, + "version": 5 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json b/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json index b5eac5993bd..a672f464344 100644 --- a/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json +++ b/packages/windows/data_stream/sysmon_operational/_dev/test/pipeline/test-events.json-expected.json @@ -31,6 +31,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -126,6 +127,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -196,6 +198,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -301,6 +304,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -400,6 +404,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -470,6 +475,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -511,6 +517,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "DWORD (0x00000004)", "EventType": "SetValue" }, "event_id": "13", @@ -536,6 +543,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -636,6 +644,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -738,6 +747,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -827,6 +837,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -926,6 +937,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1013,6 +1025,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1114,6 +1127,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1251,6 +1265,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1349,6 +1364,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1443,6 +1459,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1543,6 +1560,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1630,6 +1648,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1729,6 +1748,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1798,6 +1818,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -1839,6 +1860,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -1889,6 +1911,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -1984,6 +2007,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2054,6 +2078,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -2095,6 +2120,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "QWORD (0x00000000-0x00000005)", "EventType": "SetValue" }, "event_id": "13", @@ -2120,6 +2146,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -2161,6 +2188,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -2238,6 +2266,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2338,6 +2367,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2483,6 +2513,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2621,6 +2652,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2769,6 +2801,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -2883,6 +2916,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3032,6 +3066,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3186,6 +3221,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3280,6 +3316,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3415,6 +3452,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3512,6 +3550,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3648,6 +3687,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3740,6 +3780,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3830,6 +3871,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -3959,6 +4001,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4078,6 +4121,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4152,6 +4196,7 @@ "version": "8.0.0" }, "event": { + "action": "ServiceConfigurationChange", "category": [ "configuration" ], @@ -4220,6 +4265,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4345,6 +4391,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4485,6 +4532,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4629,6 +4677,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4729,6 +4778,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -4869,6 +4919,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5013,6 +5064,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5091,6 +5143,7 @@ "version": "8.0.0" }, "event": { + "action": "Sysmon service state changed", "category": [ "process" ], @@ -5161,6 +5214,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5247,6 +5301,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5315,6 +5370,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -5452,6 +5508,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5584,6 +5641,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5661,6 +5719,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -5828,6 +5887,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -5935,6 +5995,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6078,6 +6139,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6184,6 +6246,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6304,6 +6367,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6404,6 +6468,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6495,6 +6560,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6572,6 +6638,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6645,6 +6712,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6710,6 +6778,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -6826,6 +6895,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -6934,6 +7004,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7025,6 +7096,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7094,6 +7166,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -7210,6 +7283,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7288,6 +7362,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -7391,6 +7466,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -7468,6 +7544,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -7547,6 +7624,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -7626,6 +7704,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -7731,6 +7810,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7867,6 +7947,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -7949,6 +8030,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8044,6 +8126,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8125,6 +8208,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8234,6 +8318,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -8307,6 +8392,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8386,6 +8472,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8463,6 +8550,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8539,6 +8627,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8615,6 +8704,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8693,6 +8783,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8770,6 +8861,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8851,6 +8943,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -8932,6 +9025,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -9042,6 +9136,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9133,6 +9228,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9267,6 +9363,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9416,6 +9513,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9565,6 +9663,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9709,6 +9808,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9817,6 +9917,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -9923,6 +10024,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10013,6 +10115,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10148,6 +10251,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10299,6 +10403,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10440,6 +10545,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -10515,6 +10621,7 @@ "version": "8.0.0" }, "event": { + "action": "Network connection", "category": [ "network" ], @@ -10589,6 +10696,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -10639,6 +10747,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -10689,6 +10798,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -10749,6 +10859,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -10809,6 +10920,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -10869,6 +10981,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -10936,6 +11049,7 @@ "version": "8.0.0" }, "event": { + "action": "Process terminated", "category": [ "process" ], @@ -10986,6 +11100,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -11071,6 +11186,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11212,6 +11328,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11313,6 +11430,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11454,6 +11572,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11592,6 +11711,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11714,6 +11834,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11857,6 +11978,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -11982,6 +12104,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12068,6 +12191,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12202,6 +12326,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12316,6 +12441,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12401,6 +12527,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12535,6 +12662,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12680,6 +12808,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12804,6 +12933,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -12939,6 +13069,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13065,6 +13196,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13193,6 +13325,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13344,6 +13477,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13484,6 +13618,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13622,6 +13757,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13765,6 +13901,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -13909,6 +14046,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14012,6 +14150,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14153,6 +14292,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14249,6 +14389,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14355,6 +14496,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14450,6 +14592,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14545,6 +14688,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14639,6 +14783,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14735,6 +14880,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14825,6 +14971,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -14924,6 +15071,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15019,6 +15167,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15125,6 +15274,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15221,6 +15371,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15316,6 +15467,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15411,6 +15563,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15553,6 +15706,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15668,6 +15822,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15772,6 +15927,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -15907,6 +16063,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16002,6 +16159,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16095,6 +16253,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16236,6 +16395,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16333,6 +16493,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16427,6 +16588,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16566,6 +16728,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16713,6 +16876,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16811,6 +16975,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -16952,6 +17117,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17096,6 +17262,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17242,6 +17409,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17381,6 +17549,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17521,6 +17690,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -17875,6 +18045,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18052,6 +18223,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18151,6 +18323,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18249,6 +18422,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18328,6 +18502,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18418,6 +18593,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18560,6 +18736,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18707,6 +18884,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18808,6 +18986,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -18944,6 +19123,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19095,6 +19275,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19238,6 +19419,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19363,6 +19545,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19471,6 +19654,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19573,6 +19757,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19709,6 +19894,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19824,6 +20010,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -19969,6 +20156,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20066,6 +20254,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20160,6 +20349,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20251,6 +20441,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20328,6 +20519,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20398,6 +20590,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20468,6 +20661,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20562,6 +20756,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20654,6 +20849,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -20723,6 +20919,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -20820,6 +21017,7 @@ "version": "8.0.0" }, "event": { + "action": "ProcessTampering (Process image change)", "category": [ "process" ], @@ -20874,6 +21072,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDelete (File Delete archived)", "category": [ "file" ], @@ -20948,6 +21147,7 @@ "version": "8.0.0" }, "event": { + "action": "Image loaded", "category": [ "process" ], @@ -21039,6 +21239,7 @@ "version": "8.0.0" }, "event": { + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21080,6 +21281,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -21105,6 +21307,7 @@ "version": "8.0.0" }, "event": { + "action": "ClipboardChange (New content in the clipboard)", "code": "24", "created": "2021-02-25T15:04:48.607Z", "kind": "event", @@ -21172,6 +21375,7 @@ "version": "8.0.0" }, "event": { + "action": "A process changed a file creation time", "category": [ "file" ], @@ -21287,6 +21491,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -21363,6 +21568,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDeleteDetected (File Delete logged)", "category": [ "file" ], @@ -21437,6 +21643,7 @@ "version": "8.0.0" }, "event": { + "action": "FileDeleteDetected (File Delete logged)", "category": [ "file" ], @@ -21511,7 +21718,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21565,6 +21772,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "QWORD (0x00000000-0x1234fabd)", "EventType": "SetValue" }, "event_id": "13", @@ -21594,7 +21802,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21648,6 +21856,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "abcd", "EventType": "SetValue" }, "event_id": "13", @@ -21677,7 +21886,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21731,6 +21940,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "DWORD (0x12349abc)", "EventType": "SetValue" }, "event_id": "13", @@ -21760,7 +21970,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21814,6 +22024,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -21843,7 +22054,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21897,6 +22108,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "Binary Data", "EventType": "SetValue" }, "event_id": "13", @@ -21926,7 +22138,7 @@ "version": "8.0.0" }, "event": { - "action": "Registry value set (rule: RegistryEvent)", + "action": "RegistryEvent (Value Set)", "category": [ "configuration", "registry" @@ -21980,6 +22192,7 @@ "channel": "Microsoft-Windows-Sysmon/Operational", "computer_name": "vagrant", "event_data": { + "Details": "*.dll expanded", "EventType": "SetValue" }, "event_id": "13", @@ -22009,6 +22222,7 @@ "version": "8.0.0" }, "event": { + "action": "Process creation", "category": [ "process" ], @@ -22110,7 +22324,7 @@ "version": "8.0.0" }, "event": { - "action": "Process Create (rule: ProcessCreate)", + "action": "Process creation", "agent_id_status": "verified", "category": [ "process" @@ -22180,7 +22394,7 @@ "version": "8.0.0" }, "event": { - "action": "Process accessed (rule: ProcessAccess)", + "action": "ProcessAccess", "agent_id_status": "verified", "category": [ "process" @@ -22239,6 +22453,7 @@ "version": "8.0.0" }, "event": { + "action": "CreateRemoteThread", "category": [ "process" ], @@ -22301,6 +22516,7 @@ "version": "8.0.0" }, "event": { + "action": "RawAccessRead", "category": [ "process" ], @@ -22358,6 +22574,7 @@ "version": "8.0.0" }, "event": { + "action": "WmiEvent (WmiEventFilter activity detected)", "category": [ "process" ], @@ -22419,6 +22636,7 @@ "version": "8.0.0" }, "event": { + "action": "WmiEvent (WmiEventConsumer activity detected)", "category": [ "process" ], @@ -22486,6 +22704,7 @@ "code": "DriverCommunication" }, "event": { + "action": "Error", "category": [ "process" ], @@ -22541,6 +22760,7 @@ "version": "8.0.0" }, "event": { + "action": "FileBlockExecutable", "category": [ "file" ], @@ -22614,6 +22834,7 @@ "version": "8.0.0" }, "event": { + "action": "FileBlockExecutable", "category": [ "file" ], @@ -22687,6 +22908,7 @@ "version": "8.0.0" }, "event": { + "action": "FileBlockShredding", "category": [ "file" ], @@ -22792,6 +23014,7 @@ "version": "8.0.0" }, "event": { + "action": "DNSEvent (DNS query)", "category": [ "network" ], @@ -22860,6 +23083,86 @@ }, "version": 5 } + }, + { + "@timestamp": "2023-06-30T01:53:13.076Z", + "ecs": { + "version": "8.0.0" + }, + "event": { + "action": "FileExecutableDetected", + "category": [ + "file" + ], + "code": "29", + "created": "2023-06-30T01:53:13.078Z", + "kind": "event", + "provider": "Microsoft-Windows-Sysmon", + "type": [ + "creation" + ] + }, + "file": { + "directory": "C:\\Users\\auruser\\Desktop", + "extension": "bin", + "hash": { + "md5": "32365e3e64d28cc94756ac9a09b67f06", + "sha1": "d48757b74eff02255f74614f35aa27abbe3f72c7", + "sha256": "09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9" + }, + "name": "32365e3e64d28cc94756ac9a09b67f06.bin", + "path": "C:\\Users\\auruser\\Desktop\\32365e3e64d28cc94756ac9a09b67f06.bin", + "pe": { + "imphash": "1f2627fc453dc35031a9502372bd3549" + } + }, + "host": { + "name": "SEC-TRACE-WinSRV22-Y01" + }, + "log": { + "level": "information" + }, + "process": { + "entity_id": "{2f280947-3586-649e-5901-000000000e00}", + "executable": "C:\\Windows\\system32\\curl.exe", + "name": "curl.exe", + "pid": 3828 + }, + "related": { + "hash": [ + "09043c51719d4bf6405c9a7a292bb9bb3bcc782f639b708ddcc4eedb5e5c9ce9", + "d48757b74eff02255f74614f35aa27abbe3f72c7", + "32365e3e64d28cc94756ac9a09b67f06", + "1f2627fc453dc35031a9502372bd3549" + ], + "user": [ + "auruser" + ] + }, + "user": { + "domain": "SEC-TRACE-WINSR", + "id": "S-1-5-18", + "name": "auruser" + }, + "winlog": { + "channel": "Microsoft-Windows-Sysmon/Operational", + "computer_name": "SEC-TRACE-WinSRV22-Y01", + "event_id": "29", + "opcode": "Info", + "process": { + "pid": 2824, + "thread": { + "id": 1380 + } + }, + "provider_guid": "{5770385f-c22a-43e0-bf4c-06f5698ffbd9}", + "provider_name": "Microsoft-Windows-Sysmon", + "record_id": "679378", + "user": { + "identifier": "S-1-5-18" + }, + "version": 5 + } } ] } \ No newline at end of file diff --git a/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml b/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml index f9e1381b272..3abe5fa22b5 100644 --- a/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml +++ b/packages/windows/data_stream/sysmon_operational/elasticsearch/ingest_pipeline/default.yml @@ -48,7 +48,7 @@ processors: value: '{{winlog.event_id}}' - script: - description: Set event category and type for all event types. + description: Set event action, category and type for all event types. lang: painless params: "1": @@ -56,11 +56,13 @@ processors: - process type: - start + action: 'Process creation' "2": category: - file type: - change + action: 'A process changed a file creation time' "3": category: - network @@ -68,99 +70,118 @@ processors: - start - connection - protocol + action: 'Network connection' "4": category: - process type: - change + action: 'Sysmon service state changed' "5": category: - process type: - end + action: 'Process terminated' "6": category: - driver type: - start + action: 'Driver loaded' "7": category: - process type: - change + action: 'Image loaded' "8": category: - process type: - change + action: 'CreateRemoteThread' "9": category: - process type: - access + action: 'RawAccessRead' "10": category: - process type: - access + action: 'ProcessAccess' "11": category: - file type: - creation + action: 'FileCreate' "12": category: - configuration - registry type: - change + action: 'RegistryEvent (Object create and delete)' "13": category: - configuration - registry type: - change + action: 'RegistryEvent (Value Set)' "14": category: - configuration - registry type: - change + action: 'RegistryEvent (Key and Value Rename)' "15": category: - file type: - access + action: 'FileCreateStreamHash' "16": category: - configuration type: - change + action: 'ServiceConfigurationChange' "17": category: - file type: - creation + action: 'PipeEvent (Pipe Created)' "18": category: - file type: - access + action: 'PipeEvent (Pipe Connected)' "19": category: - process type: - creation + action: 'WmiEvent (WmiEventFilter activity detected)' "20": category: - process type: - creation + action: 'WmiEvent (WmiEventConsumer activity detected)' "21": category: - process type: - access + action: 'WmiEvent (WmiEventConsumerToFilter activity detected)' "22": category: - network @@ -168,44 +189,58 @@ processors: - connection - protocol - info + action: 'DNSEvent (DNS query)' "23": category: - file type: - deletion + action: 'FileDelete (File Delete archived)' "24": type: - change + action: 'ClipboardChange (New content in the clipboard)' "25": category: - process type: - change + action: 'ProcessTampering (Process image change)' "26": category: - file type: - deletion + action: 'FileDeleteDetected (File Delete logged)' "27": category: - file type: - creation - denied + action: 'FileBlockExecutable' "28": category: - file type: - deletion - denied + action: 'FileBlockShredding' + "29": + category: + - file + type: + - creation + action: 'FileExecutableDetected' "255": category: - process type: - error + action: 'Error' tag: Add ECS categorization fields source: |- - if (ctx?.event?.code == null || params.get(ctx.event.code) == null) { + if (ctx.event?.code == null || params.get(ctx.event.code) == null) { return; } def hm = new HashMap(params[ctx.event.code]); @@ -221,26 +256,29 @@ processors: target_field: error.code ignore_failure: true ignore_missing: true - if: ctx.event.code == "255" + if: ctx.event.code == "255" && ctx.winlog?.event_data?.ID != null && ctx.winlog?.event_data?.ID != "" - rename: field: winlog.event_data.RuleName target_field: rule.name ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.RuleName != null && ctx?.winlog?.event_data?.RuleName != "" && ctx?.winlog?.event_data?.RuleName != "-" + - rename: field: winlog.event_data.Type target_field: message ignore_missing: true ignore_failure: true - if: ctx.event.code == "25" + if: ctx.event.code == "25" && ctx?.winlog?.event_data?.Type != null && ctx?.winlog?.event_data?.Type != "" - rename: field: winlog.event_data.Hash target_field: winlog.event_data.Hashes ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Hash != null && ctx?.winlog?.event_data?.Hash != "" - kv: field: winlog.event_data.Hashes target_field: _temp.hashes @@ -302,86 +340,101 @@ processors: target_field: process.entity_id ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.ProcessGuid != null && ctx?.winlog?.event_data?.ProcessGuid != "" - convert: field: winlog.event_data.ProcessId target_field: process.pid type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.ProcessId != null && ctx?.winlog?.event_data?.ProcessId != "" - rename: field: winlog.event_data.Image target_field: process.executable ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Image != null && ctx?.winlog?.event_data?.Image != "" - rename: field: winlog.event_data.SourceProcessGuid target_field: process.entity_id ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.SourceProcessGuid != null && ctx?.winlog?.event_data?.SourceProcessGuid != "" - rename: field: winlog.event_data.SourceProcessGUID target_field: process.entity_id ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.SourceProcessGUID != null && ctx?.winlog?.event_data?.SourceProcessGUID != "" - convert: field: winlog.event_data.SourceProcessId target_field: process.pid type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.SourceProcessId != null && ctx?.winlog?.event_data?.SourceProcessId != "" - convert: field: winlog.event_data.SourceThreadId target_field: process.thread.id type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.SourceThreadId != null && ctx?.winlog?.event_data?.SourceThreadId != "" - rename: field: winlog.event_data.SourceImage target_field: process.executable ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.SourceImage != null && ctx?.winlog?.event_data?.SourceImage != "" - rename: field: winlog.event_data.Destination target_field: process.executable ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Destination != null && ctx?.winlog?.event_data?.Destination != "" - rename: field: winlog.event_data.CommandLine target_field: process.command_line ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.CommandLine != null && ctx?.winlog?.event_data?.CommandLine != "" - rename: field: winlog.event_data.CurrentDirectory target_field: process.working_directory ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.CurrentDirectory != null && ctx?.winlog?.event_data?.CurrentDirectory != "" - rename: field: winlog.event_data.ParentProcessGuid target_field: process.parent.entity_id ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.ParentProcessGuid != null && ctx?.winlog?.event_data?.ParentProcessGuid != "" - convert: field: winlog.event_data.ParentProcessId target_field: process.parent.pid type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.ParentProcessId != null && ctx?.winlog?.event_data?.ParentProcessId != "" - rename: field: winlog.event_data.ParentImage target_field: process.parent.executable ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.ParentImage != null && ctx?.winlog?.event_data?.ParentImage != "" - rename: field: winlog.event_data.ParentCommandLine target_field: process.parent.command_line ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.ParentCommandLine != null && ctx?.winlog?.event_data?.ParentCommandLine != "" - rename: field: winlog.event_data.OriginalFileName target_field: process.pe.original_file_name ignore_missing: true ignore_failure: true - if: ctx.event.code != "7" + if: ctx.event.code != "7" && ctx?.winlog?.event_data?.OriginalFileName != null && ctx?.winlog?.event_data?.OriginalFileName != "" - set: field: process.pe.company copy_from: winlog.event_data.Company @@ -535,7 +588,7 @@ processors: target_field: file.hash if: |- ctx?._temp?.hashes != null && - ["6", "7", "15"].contains(ctx.event.code) + ["6", "7", "15", "29"].contains(ctx.event.code) - rename: field: file.hash.imphash target_field: file.pe.imphash @@ -546,21 +599,25 @@ processors: target_field: file.path ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.TargetFilename != null && ctx?.winlog?.event_data?.TargetFilename != "" - rename: field: winlog.event_data.Device target_field: file.path ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Device != null && ctx?.winlog?.event_data?.Device != "" - rename: field: winlog.event_data.PipeName target_field: file.name ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.PipeName != null && ctx?.winlog?.event_data?.PipeName != "" - rename: field: winlog.event_data.ImageLoaded target_field: file.path ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.ImageLoaded != null && ctx?.winlog?.event_data?.ImageLoaded != "" - set: field: file.code_signature.subject_name copy_from: winlog.event_data.Signature @@ -576,7 +633,7 @@ processors: target_field: file.pe.original_file_name ignore_missing: true ignore_failure: true - if: ctx.event.code == "7" + if: ctx.event.code == "7" && ctx?.winlog?.event_data?.OriginalFileName != null && ctx?.winlog?.event_data?.OriginalFileName != "" - set: field: file.pe.company copy_from: winlog.event_data.Company @@ -604,11 +661,11 @@ processors: - set: field: file.code_signature.signed value: true - if: ctx?.winlog?.event_data?.Signed == true + if: ctx?.winlog?.event_data?.Signed != null && ctx.winlog.event_data.Signed == true - set: field: file.code_signature.valid value: true - if: ctx?.winlog?.event_data?.SignatureStatus == "Valid" + if: ctx?.winlog?.event_data?.SignatureStatus != null && ctx?.winlog?.event_data?.SignatureStatus == "Valid" - script: description: Adds file information. @@ -637,18 +694,19 @@ processors: target_field: network.transport ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Protocol != null && ctx?.winlog?.event_data?.Protocol != "" - rename: field: winlog.event_data.DestinationPortName target_field: network.protocol ignore_missing: true ignore_failure: true - if: ctx.event.code != "22" + if: ctx.event.code != "22" && ctx?.winlog?.event_data?.DestinationPortName != null && ctx?.winlog?.event_data?.DestinationPortName != "" - rename: field: winlog.event_data.SourcePortName target_field: network.protocol ignore_missing: true ignore_failure: true - if: ctx.event.code != "22" + if: ctx.event.code != "22" && ctx?.winlog?.event_data?.SourcePortName != null && ctx?.winlog?.event_data?.SourcePortName != "" - set: field: network.protocol value: dns @@ -659,61 +717,68 @@ processors: type: ip ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.SourceIp != null && ctx?.winlog?.event_data?.SourceIp != "" - rename: field: winlog.event_data.SourceHostname target_field: source.domain ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.SourceHostname != null && ctx?.winlog?.event_data?.SourceHostname != "" - convert: field: winlog.event_data.SourcePort target_field: source.port type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.SourcePort != null && ctx?.winlog?.event_data?.SourcePort != "" - convert: field: winlog.event_data.DestinationIp target_field: destination.ip type: ip ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.DestinationIp != null && ctx?.winlog?.event_data?.DestinationIp != "" - rename: field: winlog.event_data.DestinationHostname target_field: destination.domain ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.DestinationHostname != null && ctx?.winlog?.event_data?.DestinationHostname != "" - convert: field: winlog.event_data.DestinationPort target_field: destination.port type: long ignore_failure: true ignore_missing: true + if: ctx?.winlog?.event_data?.DestinationPort != null && ctx?.winlog?.event_data?.DestinationPort != "" - rename: field: winlog.event_data.QueryName target_field: dns.question.name ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.QueryName != null && ctx?.winlog?.event_data?.QueryName != "" - set: field: network.direction value: egress - if: ctx?.winlog?.event_data?.Initiated == "true" + if: ctx?.winlog?.event_data?.Initiated != null && ctx?.winlog?.event_data?.Initiated == "true" - set: field: network.direction value: ingress - if: ctx?.winlog?.event_data?.Initiated == "false" + if: ctx?.winlog?.event_data?.Initiated != null && ctx?.winlog?.event_data?.Initiated == "false" - set: field: network.type value: ipv4 - if: ctx?.winlog?.event_data?.SourceIsIpv6 == "false" + if: ctx?.winlog?.event_data?.SourceIsIpv6 != null && ctx?.winlog?.event_data?.SourceIsIpv6 == "false" - set: field: network.type value: ipv6 - if: ctx?.winlog?.event_data?.SourceIsIpv6 == "true" + if: ctx?.winlog?.event_data?.SourceIsIpv6 != null && ctx?.winlog?.event_data?.SourceIsIpv6 == "true" - script: description: | Splits the QueryResults field that contains the DNS responses. Example: "type: 5 f2.taboola.map.fastly.net;::ffff:151.101.66.2;::ffff:151.101.130.2;::ffff:151.101.194.2;::ffff:151.101.2.2;" lang: painless - if: ctx?.winlog?.event_data?.QueryResults != null + if: ctx?.winlog?.event_data?.QueryResults != null && ctx?.winlog?.event_data?.QueryResults != "" params: "1": "A" "2": "NS" @@ -938,6 +1003,7 @@ processors: target_field: sysmon.dns.status ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.QueryStatus != null && ctx?.winlog?.event_data?.QueryStatus != "" - script: description: Translate DNS Query status. lang: painless @@ -1151,12 +1217,14 @@ processors: type: boolean ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.Archived != null && ctx?.winlog?.event_data?.Archived != "" - convert: field: winlog.event_data.IsExecutable target_field: sysmon.file.is_executable type: boolean ignore_missing: true ignore_failure: true + if: ctx?.winlog?.event_data?.IsExecutable != null && ctx?.winlog?.event_data?.IsExecutable != "" ## Related fields @@ -1185,7 +1253,8 @@ processors: description: Set registry fields. lang: painless if: |- - ctx?.winlog?.event_data?.TargetObject != null && ["12", "13", "14"].contains(ctx.event.code) + ctx?.winlog?.event_data?.TargetObject != null && ctx?.winlog?.event_data?.TargetObject != "" && + ["12", "13", "14"].contains(ctx.event.code) params: HKEY_CLASSES_ROOT: "HKCR" HKCR: "HKCR" @@ -1308,11 +1377,14 @@ processors: - winlog.event_data.Hash - winlog.event_data.Hashes - winlog.event_data.TargetObject - - winlog.event_data.Details - winlog.time_created - winlog.level ignore_failure: true ignore_missing: true + - script: + description: Remove all empty values from event_data. + lang: painless + source: ctx?.winlog?.event_data?.entrySet().removeIf(entry -> entry.getValue() == null || entry.getValue().equals("") || entry.getValue().equals("-")); - remove: description: Remove empty event data. field: winlog.event_data @@ -1326,4 +1398,4 @@ on_failure: value: pipeline_error - append: field: error.message - value: "{{ _ingest.on_failure_message }}" + value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/windows/data_stream/sysmon_operational/fields/winlog.yml b/packages/windows/data_stream/sysmon_operational/fields/winlog.yml index 8f023d1b935..8830c114d00 100644 --- a/packages/windows/data_stream/sysmon_operational/fields/winlog.yml +++ b/packages/windows/data_stream/sysmon_operational/fields/winlog.yml @@ -63,7 +63,7 @@ type: keyword - name: Description type: keyword - - name: Detail + - name: Details type: keyword - name: DeviceName type: keyword diff --git a/packages/windows/data_stream/sysmon_operational/sample_event.json b/packages/windows/data_stream/sysmon_operational/sample_event.json index 28be60c7b1a..56ac34df2e0 100644 --- a/packages/windows/data_stream/sysmon_operational/sample_event.json +++ b/packages/windows/data_stream/sysmon_operational/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-07-18T03:34:01.261Z", "agent": { - "ephemeral_id": "69741349-7f7f-48bd-88c9-9e10a682f135", - "id": "c3c8f438-e38f-457a-8051-8a016f0370c6", + "ephemeral_id": "1ce461bb-6b53-430b-b223-9fdb09f0360c", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.sysmon_operational", @@ -41,11 +41,12 @@ "version": "8.0.0" }, "elastic_agent": { - "id": "c3c8f438-e38f-457a-8051-8a016f0370c6", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "8.6.2" + "version": "8.8.2" }, "event": { + "action": "DNSEvent (DNS query)", "agent_id_status": "verified", "category": [ "network" @@ -53,7 +54,7 @@ "code": "22", "created": "2019-07-18T03:34:02.025Z", "dataset": "windows.sysmon_operational", - "ingested": "2023-04-23T22:45:37Z", + "ingested": "2023-08-14T00:37:09Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025237700Z'/\u003e\u003cEventRecordID\u003e67\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.261\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:204.79.197.203;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", diff --git a/packages/windows/docs/README.md b/packages/windows/docs/README.md index d31b42054f9..3b8383a5f83 100644 --- a/packages/windows/docs/README.md +++ b/packages/windows/docs/README.md @@ -82,6 +82,1509 @@ the events from Windows. The filter shown below is equivalent to ## Logs reference +### AppLocker/EXE and DLL + +The Windows `applocker_exe_and_dll` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/EXE and DLL` event log. + +An example event for `applocker_exe_and_dll` looks as following: + +```json +{ + "@timestamp": "2023-07-20T15:05:03.882Z", + "agent": { + "ephemeral_id": "2c907e31-12db-485b-ab67-ef05e8aa1e3d", + "id": "51fe65df-a759-4054-ae29-e8242662fb48", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_exe_and_dll", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "51fe65df-a759-4054-ae29-e8242662fb48", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8003", + "created": "2023-08-03T13:42:19.028Z", + "dataset": "windows.applocker_exe_and_dll", + "ingested": "2023-08-03T13:42:22Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}' /\u003e\u003cEventID\u003e8003\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e3\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-07-20T15:05:03.8826518Z' /\u003e\u003cEventRecordID\u003e154247\u003c/EventRecordID\u003e\u003cCorrelation /\u003e\u003cExecution ProcessID='33848' ThreadID='12040' /\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/EXE and DLL\u003c/Channel\u003e\u003cComputer\u003eTOPSYLL.local\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1133191089-1850170202-1535859923-200319' /\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e3\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eEXE\u003c/PolicyName\u003e\u003cRuleId\u003e{00000000-0000-0000-0000-000000000000}\u003c/RuleId\u003e\u003cRuleNameLength\u003e1\u003c/RuleNameLength\u003e\u003cRuleName\u003e-\u003c/RuleName\u003e\u003cRuleSddlLength\u003e1\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003e-\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-1133191089-1850170202-1535859923-200319\u003c/TargetUser\u003e\u003cTargetProcessId\u003e27116\u003c/TargetProcessId\u003e\u003cFilePathLength\u003e101\u003c/FilePathLength\u003e\u003cFilePath\u003e%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE\u003c/FilePath\u003e\u003cFileHashLength\u003e32\u003c/FileHashLength\u003e\u003cFileHash\u003e11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5\u003c/FileHash\u003e\u003cFqbnLength\u003e72\u003c/FqbnLength\u003e\u003cFqbn\u003eO=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01\u003c/Fqbn\u003e\u003cTargetLogonId\u003e0x14fcb7\u003c/TargetLogonId\u003e\u003cFullFilePathLength\u003e94\u003c/FullFilePathLength\u003e\u003cFullFilePath\u003eC:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe\u003c/FullFilePath\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5" + }, + "name": "git.exe", + "pe": { + "file_version": "2.35.5.01", + "original_file_name": "GIT.EXE", + "product": "GIT" + }, + "x509": { + "subject": { + "country": "DE", + "organization": "JOHANNES SCHINDELIN", + "state_or_province": "NORDRHEIN-WESTFALEN" + } + } + }, + "host": { + "name": "TOPSYLL.local" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "warning" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/EXE and DLL", + "computer_name": "TOPSYLL.local", + "event_id": "8003", + "level": "warning", + "opcode": "Info", + "process": { + "pid": 33848, + "thread": { + "id": 12040 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "154247", + "task": "None", + "time_created": "2023-07-20T15:05:03.882Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "FileHash": "11D3940DE41D28E044CE45AB76A6D824E617D99B62C5FB44E37BE5CD7B0545F5", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\TOPSY\\APPDATA\\LOCAL\\GITHUBDESKTOP\\APP-3.1.2\\RESOURCES\\APP\\GIT\\MINGW64\\BIN\\GIT.EXE", + "FilePathLength": 101, + "Fqbn": "O=JOHANNES SCHINDELIN, S=NORDRHEIN-WESTFALEN, C=DE\\GIT\\GIT.EXE\\2.35.5.01", + "FqbnLength": 72, + "FullFilePath": "C:\\Users\\TOPSY\\AppData\\Local\\GitHubDesktop\\app-3.1.2\\resources\\app\\git\\mingw64\\bin\\git.exe", + "FullFilePathLength": 94, + "PolicyName": "EXE", + "PolicyNameLength": 3, + "RuleId": "{00000000-0000-0000-0000-000000000000}", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x14fcb7", + "TargetProcessId": 27116, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "xml_name": "RuleAndFileData" + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| destination.user.id | Unique identifier of the user. | keyword | +| destination.user.name | Short name or login of the user. | keyword | +| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.pe.file_version | | | +| file.pe.original_file_name | | | +| file.pe.product | | | +| file.x509.subject.country | List of country (C) code | keyword | +| file.x509.subject.locality | List of locality names (L) | keyword | +| file.x509.subject.organization | List of organizations (O) of subject. | keyword | +| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.pid | Process id. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| source.user.id | Unique identifier of the user. | keyword | +| source.user.name | Short name or login of the user. | keyword | +| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| winlog.activity_id | A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. | keyword | +| winlog.api | The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. | keyword | +| winlog.channel | The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. | keyword | +| winlog.computer_name | The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. | keyword | +| winlog.event_data | The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. | object | +| winlog.event_data.AuthenticationPackageName | | keyword | +| winlog.event_data.Binary | | keyword | +| winlog.event_data.BitlockerUserInputTime | | keyword | +| winlog.event_data.BootMode | | keyword | +| winlog.event_data.BootType | | keyword | +| winlog.event_data.BuildVersion | | keyword | +| winlog.event_data.Company | | keyword | +| winlog.event_data.CorruptionActionState | | keyword | +| winlog.event_data.CreationUtcTime | | keyword | +| winlog.event_data.Description | | keyword | +| winlog.event_data.Detail | | keyword | +| winlog.event_data.DeviceName | | keyword | +| winlog.event_data.DeviceNameLength | | keyword | +| winlog.event_data.DeviceTime | | keyword | +| winlog.event_data.DeviceVersionMajor | | keyword | +| winlog.event_data.DeviceVersionMinor | | keyword | +| winlog.event_data.DriveName | | keyword | +| winlog.event_data.DriverName | | keyword | +| winlog.event_data.DriverNameLength | | keyword | +| winlog.event_data.DwordVal | | keyword | +| winlog.event_data.EntryCount | | keyword | +| winlog.event_data.ExtraInfo | | keyword | +| winlog.event_data.FailureName | | keyword | +| winlog.event_data.FailureNameLength | | keyword | +| winlog.event_data.FileVersion | | keyword | +| winlog.event_data.FinalStatus | | keyword | +| winlog.event_data.Group | | keyword | +| winlog.event_data.IdleImplementation | | keyword | +| winlog.event_data.IdleStateCount | | keyword | +| winlog.event_data.ImpersonationLevel | | keyword | +| winlog.event_data.IntegrityLevel | | keyword | +| winlog.event_data.IpAddress | | keyword | +| winlog.event_data.IpPort | | keyword | +| winlog.event_data.KeyLength | | keyword | +| winlog.event_data.LastBootGood | | keyword | +| winlog.event_data.LastShutdownGood | | keyword | +| winlog.event_data.LmPackageName | | keyword | +| winlog.event_data.LogonGuid | | keyword | +| winlog.event_data.LogonId | | keyword | +| winlog.event_data.LogonProcessName | | keyword | +| winlog.event_data.LogonType | | keyword | +| winlog.event_data.MajorVersion | | keyword | +| winlog.event_data.MaximumPerformancePercent | | keyword | +| winlog.event_data.MemberName | | keyword | +| winlog.event_data.MemberSid | | keyword | +| winlog.event_data.MinimumPerformancePercent | | keyword | +| winlog.event_data.MinimumThrottlePercent | | keyword | +| winlog.event_data.MinorVersion | | keyword | +| winlog.event_data.NewProcessId | | keyword | +| winlog.event_data.NewProcessName | | keyword | +| winlog.event_data.NewSchemeGuid | | keyword | +| winlog.event_data.NewTime | | keyword | +| winlog.event_data.NominalFrequency | | keyword | +| winlog.event_data.Number | | keyword | +| winlog.event_data.OldSchemeGuid | | keyword | +| winlog.event_data.OldTime | | keyword | +| winlog.event_data.OriginalFileName | | keyword | +| winlog.event_data.Path | | keyword | +| winlog.event_data.PerformanceImplementation | | keyword | +| winlog.event_data.PreviousCreationUtcTime | | keyword | +| winlog.event_data.PreviousTime | | keyword | +| winlog.event_data.PrivilegeList | | keyword | +| winlog.event_data.ProcessId | | keyword | +| winlog.event_data.ProcessName | | keyword | +| winlog.event_data.ProcessPath | | keyword | +| winlog.event_data.ProcessPid | | keyword | +| winlog.event_data.Product | | keyword | +| winlog.event_data.PuaCount | | keyword | +| winlog.event_data.PuaPolicyId | | keyword | +| winlog.event_data.QfeVersion | | keyword | +| winlog.event_data.Reason | | keyword | +| winlog.event_data.SchemaVersion | | keyword | +| winlog.event_data.ScriptBlockText | | keyword | +| winlog.event_data.ServiceName | | keyword | +| winlog.event_data.ServiceVersion | | keyword | +| winlog.event_data.ShutdownActionType | | keyword | +| winlog.event_data.ShutdownEventCode | | keyword | +| winlog.event_data.ShutdownReason | | keyword | +| winlog.event_data.Signature | | keyword | +| winlog.event_data.SignatureStatus | | keyword | +| winlog.event_data.Signed | | keyword | +| winlog.event_data.StartTime | | keyword | +| winlog.event_data.State | | keyword | +| winlog.event_data.Status | | keyword | +| winlog.event_data.StopTime | | keyword | +| winlog.event_data.SubjectDomainName | | keyword | +| winlog.event_data.SubjectLogonId | | keyword | +| winlog.event_data.SubjectUserName | | keyword | +| winlog.event_data.SubjectUserSid | | keyword | +| winlog.event_data.TSId | | keyword | +| winlog.event_data.TargetDomainName | | keyword | +| winlog.event_data.TargetInfo | | keyword | +| winlog.event_data.TargetLogonGuid | | keyword | +| winlog.event_data.TargetLogonId | | keyword | +| winlog.event_data.TargetServerName | | keyword | +| winlog.event_data.TargetUserName | | keyword | +| winlog.event_data.TargetUserSid | | keyword | +| winlog.event_data.TerminalSessionId | | keyword | +| winlog.event_data.TokenElevationType | | keyword | +| winlog.event_data.TransmittedServices | | keyword | +| winlog.event_data.UserSid | | keyword | +| winlog.event_data.Version | | keyword | +| winlog.event_data.Workstation | | keyword | +| winlog.event_data.param1 | | keyword | +| winlog.event_data.param2 | | keyword | +| winlog.event_data.param3 | | keyword | +| winlog.event_data.param4 | | keyword | +| winlog.event_data.param5 | | keyword | +| winlog.event_data.param6 | | keyword | +| winlog.event_data.param7 | | keyword | +| winlog.event_data.param8 | | keyword | +| winlog.event_id | The event identifier. The value is specific to the source of the event. | keyword | +| winlog.keywords | The keywords are used to classify an event. | keyword | +| winlog.level | The level assigned to the event such as Information, Warning, or Critical. | keyword | +| winlog.opcode | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | keyword | +| winlog.process.pid | The process_id of the Client Server Runtime Process. | long | +| winlog.process.thread.id | | long | +| winlog.provider_guid | A globally unique identifier that identifies the provider that logged the event. | keyword | +| winlog.provider_name | The source of the event log record (the application or service that logged the record). | keyword | +| winlog.record_id | The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. | keyword | +| winlog.related_activity_id | A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. | keyword | +| winlog.task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. | keyword | +| winlog.time_created | The time the event was created. | date | +| winlog.user.domain | The domain that the account associated with this event is a member of. | keyword | +| winlog.user.identifier | The Windows security identifier (SID) of the account associated with this event. If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. | keyword | +| winlog.user.name | Name of the user associated with this event. | keyword | +| winlog.user.type | The type of account associated with this event. | keyword | +| winlog.user_data | The event specific data. This field is mutually exclusive with `event_data`. | object | +| winlog.user_data.FileHash | | keyword | +| winlog.user_data.FileHashLength | | long | +| winlog.user_data.FilePath | | keyword | +| winlog.user_data.FilePathLength | | long | +| winlog.user_data.Fqbn | | keyword | +| winlog.user_data.FqbnLength | | long | +| winlog.user_data.FullFilePath | | keyword | +| winlog.user_data.FullFilePathLength | | long | +| winlog.user_data.PolicyName | | keyword | +| winlog.user_data.PolicyNameLength | | long | +| winlog.user_data.RuleId | | keyword | +| winlog.user_data.RuleName | | keyword | +| winlog.user_data.RuleNameLength | | long | +| winlog.user_data.RuleSddl | | keyword | +| winlog.user_data.RuleSddlLength | | long | +| winlog.user_data.TargetLogonId | | keyword | +| winlog.user_data.TargetProcessId | | long | +| winlog.user_data.TargetUser | | keyword | +| winlog.user_data.xml_name | | keyword | +| winlog.version | The version number of the event's definition. | long | + + +### AppLocker/MSI and Script + +The Windows `applocker_msi_and_script` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/MSI and Script` event log. + +An example event for `applocker_msi_and_script` looks as following: + +```json +{ + "@timestamp": "2023-08-04T21:26:32.757Z", + "agent": { + "ephemeral_id": "17b8f200-259d-4f9f-898e-ccfd2f82705a", + "id": "15b01abd-cefe-4ddd-8359-617acef7bf30", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_msi_and_script", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.0.0" + }, + "elastic_agent": { + "id": "15b01abd-cefe-4ddd-8359-617acef7bf30", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8006", + "created": "2023-08-05T12:31:30.395Z", + "dataset": "windows.applocker_msi_and_script", + "ingested": "2023-08-05T12:31:34Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}' /\u003e\u003cEventID\u003e8006\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e3\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x4000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-04T21:26:32.7572144Z' /\u003e\u003cEventRecordID\u003e239\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{f64315e2-bea0-0000-6d01-d5f6a0bed901}' /\u003e\u003cExecution ProcessID='25192' ThreadID='7740' /\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/MSI and Script\u003c/Channel\u003e\u003cComputer\u003eel33t-b00k-1\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-2707992022-4034939591-3454028951-1001' /\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e6\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eSCRIPT\u003c/PolicyName\u003e\u003cRuleId\u003e{00000000-0000-0000-0000-000000000000}\u003c/RuleId\u003e\u003cRuleNameLength\u003e1\u003c/RuleNameLength\u003e\u003cRuleName\u003e-\u003c/RuleName\u003e\u003cRuleSddlLength\u003e1\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003e-\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-2707992022-4034939591-3454028951-1001\u003c/TargetUser\u003e\u003cTargetProcessId\u003e25192\u003c/TargetProcessId\u003e\u003cFilePathLength\u003e124\u003c/FilePathLength\u003e\u003cFilePath\u003e%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1\u003c/FilePath\u003e\u003cFileHashLength\u003e32\u003c/FileHashLength\u003e\u003cFileHash\u003eD2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01\u003c/FileHash\u003e\u003cFqbnLength\u003e65\u003c/FqbnLength\u003e\u003cFqbn\u003eO=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00\u003c/Fqbn\u003e\u003cTargetLogonId\u003e0x4c18f\u003c/TargetLogonId\u003e\u003cFullFilePathLength\u003e117\u003c/FullFilePathLength\u003e\u003cFullFilePath\u003eC:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1\u003c/FullFilePath\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "hash": { + "sha256": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01" + }, + "name": "PSScriptAnalyzer.psm1", + "pe": { + "file_version": "0.0.0.00", + "original_file_name": "", + "product": "" + }, + "x509": { + "subject": { + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "warning" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "winlog": { + "activity_id": "{f64315e2-bea0-0000-6d01-d5f6a0bed901}", + "channel": "Microsoft-Windows-AppLocker/MSI and Script", + "computer_name": "el33t-b00k-1", + "event_id": "8006", + "level": "warning", + "opcode": "Info", + "process": { + "pid": 25192, + "thread": { + "id": 7740 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "239", + "task": "None", + "time_created": "2023-08-04T21:26:32.757Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "FileHash": "D2A09AC074F8D326B4DCC8B8BE5BC003C41CCB6EB5FC35E13B73F834F2946B01", + "FileHashLength": 32, + "FilePath": "%OSDRIVE%\\USERS\\NICPE\\.VSCODE\\EXTENSIONS\\MS-VSCODE.POWERSHELL-2023.6.0\\MODULES\\PSSCRIPTANALYZER\\1.21.0\\PSSCRIPTANALYZER.PSM1", + "FilePathLength": 124, + "Fqbn": "O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\\\\\0.0.0.00", + "FqbnLength": 65, + "FullFilePath": "C:\\Users\\nicpe\\.vscode\\extensions\\ms-vscode.powershell-2023.6.0\\modules\\PSScriptAnalyzer\\1.21.0\\PSScriptAnalyzer.psm1", + "FullFilePathLength": 117, + "PolicyName": "SCRIPT", + "PolicyNameLength": 6, + "RuleId": "{00000000-0000-0000-0000-000000000000}", + "RuleName": "-", + "RuleNameLength": 1, + "RuleSddl": "-", + "RuleSddlLength": 1, + "TargetLogonId": "0x4c18f", + "TargetProcessId": 25192, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "xml_name": "RuleAndFileData" + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| destination.user.id | Unique identifier of the user. | keyword | +| destination.user.name | Short name or login of the user. | keyword | +| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.pe.file_version | | | +| file.pe.original_file_name | | | +| file.pe.product | | | +| file.x509.subject.country | List of country (C) code | keyword | +| file.x509.subject.locality | List of locality names (L) | keyword | +| file.x509.subject.organization | List of organizations (O) of subject. | keyword | +| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.pid | Process id. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| source.user.id | Unique identifier of the user. | keyword | +| source.user.name | Short name or login of the user. | keyword | +| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| winlog.activity_id | A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. | keyword | +| winlog.api | The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. | keyword | +| winlog.channel | The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. | keyword | +| winlog.computer_name | The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. | keyword | +| winlog.event_data | The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. | object | +| winlog.event_data.AuthenticationPackageName | | keyword | +| winlog.event_data.Binary | | keyword | +| winlog.event_data.BitlockerUserInputTime | | keyword | +| winlog.event_data.BootMode | | keyword | +| winlog.event_data.BootType | | keyword | +| winlog.event_data.BuildVersion | | keyword | +| winlog.event_data.Company | | keyword | +| winlog.event_data.CorruptionActionState | | keyword | +| winlog.event_data.CreationUtcTime | | keyword | +| winlog.event_data.Description | | keyword | +| winlog.event_data.Detail | | keyword | +| winlog.event_data.DeviceName | | keyword | +| winlog.event_data.DeviceNameLength | | keyword | +| winlog.event_data.DeviceTime | | keyword | +| winlog.event_data.DeviceVersionMajor | | keyword | +| winlog.event_data.DeviceVersionMinor | | keyword | +| winlog.event_data.DriveName | | keyword | +| winlog.event_data.DriverName | | keyword | +| winlog.event_data.DriverNameLength | | keyword | +| winlog.event_data.DwordVal | | keyword | +| winlog.event_data.EntryCount | | keyword | +| winlog.event_data.ExtraInfo | | keyword | +| winlog.event_data.FailureName | | keyword | +| winlog.event_data.FailureNameLength | | keyword | +| winlog.event_data.FileVersion | | keyword | +| winlog.event_data.FinalStatus | | keyword | +| winlog.event_data.Group | | keyword | +| winlog.event_data.IdleImplementation | | keyword | +| winlog.event_data.IdleStateCount | | keyword | +| winlog.event_data.ImpersonationLevel | | keyword | +| winlog.event_data.IntegrityLevel | | keyword | +| winlog.event_data.IpAddress | | keyword | +| winlog.event_data.IpPort | | keyword | +| winlog.event_data.KeyLength | | keyword | +| winlog.event_data.LastBootGood | | keyword | +| winlog.event_data.LastShutdownGood | | keyword | +| winlog.event_data.LmPackageName | | keyword | +| winlog.event_data.LogonGuid | | keyword | +| winlog.event_data.LogonId | | keyword | +| winlog.event_data.LogonProcessName | | keyword | +| winlog.event_data.LogonType | | keyword | +| winlog.event_data.MajorVersion | | keyword | +| winlog.event_data.MaximumPerformancePercent | | keyword | +| winlog.event_data.MemberName | | keyword | +| winlog.event_data.MemberSid | | keyword | +| winlog.event_data.MinimumPerformancePercent | | keyword | +| winlog.event_data.MinimumThrottlePercent | | keyword | +| winlog.event_data.MinorVersion | | keyword | +| winlog.event_data.NewProcessId | | keyword | +| winlog.event_data.NewProcessName | | keyword | +| winlog.event_data.NewSchemeGuid | | keyword | +| winlog.event_data.NewTime | | keyword | +| winlog.event_data.NominalFrequency | | keyword | +| winlog.event_data.Number | | keyword | +| winlog.event_data.OldSchemeGuid | | keyword | +| winlog.event_data.OldTime | | keyword | +| winlog.event_data.OriginalFileName | | keyword | +| winlog.event_data.Path | | keyword | +| winlog.event_data.PerformanceImplementation | | keyword | +| winlog.event_data.PreviousCreationUtcTime | | keyword | +| winlog.event_data.PreviousTime | | keyword | +| winlog.event_data.PrivilegeList | | keyword | +| winlog.event_data.ProcessId | | keyword | +| winlog.event_data.ProcessName | | keyword | +| winlog.event_data.ProcessPath | | keyword | +| winlog.event_data.ProcessPid | | keyword | +| winlog.event_data.Product | | keyword | +| winlog.event_data.PuaCount | | keyword | +| winlog.event_data.PuaPolicyId | | keyword | +| winlog.event_data.QfeVersion | | keyword | +| winlog.event_data.Reason | | keyword | +| winlog.event_data.SchemaVersion | | keyword | +| winlog.event_data.ScriptBlockText | | keyword | +| winlog.event_data.ServiceName | | keyword | +| winlog.event_data.ServiceVersion | | keyword | +| winlog.event_data.ShutdownActionType | | keyword | +| winlog.event_data.ShutdownEventCode | | keyword | +| winlog.event_data.ShutdownReason | | keyword | +| winlog.event_data.Signature | | keyword | +| winlog.event_data.SignatureStatus | | keyword | +| winlog.event_data.Signed | | keyword | +| winlog.event_data.StartTime | | keyword | +| winlog.event_data.State | | keyword | +| winlog.event_data.Status | | keyword | +| winlog.event_data.StopTime | | keyword | +| winlog.event_data.SubjectDomainName | | keyword | +| winlog.event_data.SubjectLogonId | | keyword | +| winlog.event_data.SubjectUserName | | keyword | +| winlog.event_data.SubjectUserSid | | keyword | +| winlog.event_data.TSId | | keyword | +| winlog.event_data.TargetDomainName | | keyword | +| winlog.event_data.TargetInfo | | keyword | +| winlog.event_data.TargetLogonGuid | | keyword | +| winlog.event_data.TargetLogonId | | keyword | +| winlog.event_data.TargetServerName | | keyword | +| winlog.event_data.TargetUserName | | keyword | +| winlog.event_data.TargetUserSid | | keyword | +| winlog.event_data.TerminalSessionId | | keyword | +| winlog.event_data.TokenElevationType | | keyword | +| winlog.event_data.TransmittedServices | | keyword | +| winlog.event_data.UserSid | | keyword | +| winlog.event_data.Version | | keyword | +| winlog.event_data.Workstation | | keyword | +| winlog.event_data.param1 | | keyword | +| winlog.event_data.param2 | | keyword | +| winlog.event_data.param3 | | keyword | +| winlog.event_data.param4 | | keyword | +| winlog.event_data.param5 | | keyword | +| winlog.event_data.param6 | | keyword | +| winlog.event_data.param7 | | keyword | +| winlog.event_data.param8 | | keyword | +| winlog.event_id | The event identifier. The value is specific to the source of the event. | keyword | +| winlog.keywords | The keywords are used to classify an event. | keyword | +| winlog.level | The level assigned to the event such as Information, Warning, or Critical. | keyword | +| winlog.opcode | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | keyword | +| winlog.process.pid | The process_id of the Client Server Runtime Process. | long | +| winlog.process.thread.id | | long | +| winlog.provider_guid | A globally unique identifier that identifies the provider that logged the event. | keyword | +| winlog.provider_name | The source of the event log record (the application or service that logged the record). | keyword | +| winlog.record_id | The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. | keyword | +| winlog.related_activity_id | A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. | keyword | +| winlog.task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. | keyword | +| winlog.time_created | The time the event was created. | date | +| winlog.user.domain | The domain that the account associated with this event is a member of. | keyword | +| winlog.user.identifier | The Windows security identifier (SID) of the account associated with this event. If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. | keyword | +| winlog.user.name | Name of the user associated with this event. | keyword | +| winlog.user.type | The type of account associated with this event. | keyword | +| winlog.user_data | The event specific data. This field is mutually exclusive with `event_data`. | object | +| winlog.user_data.FileHash | | keyword | +| winlog.user_data.FileHashLength | | long | +| winlog.user_data.FilePath | | keyword | +| winlog.user_data.FilePathLength | | long | +| winlog.user_data.Fqbn | | keyword | +| winlog.user_data.FqbnLength | | long | +| winlog.user_data.FullFilePath | | keyword | +| winlog.user_data.FullFilePathLength | | long | +| winlog.user_data.PolicyName | | keyword | +| winlog.user_data.PolicyNameLength | | long | +| winlog.user_data.RuleId | | keyword | +| winlog.user_data.RuleName | | keyword | +| winlog.user_data.RuleNameLength | | long | +| winlog.user_data.RuleSddl | | keyword | +| winlog.user_data.RuleSddlLength | | long | +| winlog.user_data.TargetLogonId | | keyword | +| winlog.user_data.TargetProcessId | | long | +| winlog.user_data.TargetUser | | keyword | +| winlog.user_data.xml_name | | keyword | +| winlog.version | The version number of the event's definition. | long | + + +### AppLocker/Packaged app-Deployment + +The Windows `applocker_packaged_app_deployment` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/Packaged app-Deployment` event log. + +An example event for `applocker_packaged_app_deployment` looks as following: + +```json +{ + "@timestamp": "2023-08-15T14:12:32.680Z", + "agent": { + "ephemeral_id": "03a46cd5-bd39-49b3-b8cf-493dcd361920", + "id": "4c6333d2-c654-4cac-be07-248d79340ee5", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_packaged_app_deployment", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "4c6333d2-c654-4cac-be07-248d79340ee5", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8023", + "created": "2023-08-15T22:51:13.753Z", + "dataset": "windows.applocker_packaged_app_deployment", + "ingested": "2023-08-15T22:51:17Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}'/\u003e\u003cEventID\u003e8023\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x1000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-15T14:12:32.6801945Z'/\u003e\u003cEventRecordID\u003e6269\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{eac4f4ed-cf73-0001-a741-c5ea73cfd901}'/\u003e\u003cExecution ProcessID='4584' ThreadID='26688'/\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/Packaged app-Deployment\u003c/Channel\u003e\u003cComputer\u003eWIN1012009LL.local\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1133191089-1850170202-1535859923-200319'/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e4\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eAPPX\u003c/PolicyName\u003e\u003cRuleId\u003e{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}\u003c/RuleId\u003e\u003cRuleNameLength\u003e39\u003c/RuleNameLength\u003e\u003cRuleName\u003e(Default Rule) All signed packaged apps\u003c/RuleName\u003e\u003cRuleSddlLength\u003e81\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003eyams\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-1133191089-1850170202-1535859923-200319\u003c/TargetUser\u003e\u003cTargetProcessId\u003e4584\u003c/TargetProcessId\u003e\u003cPackageLength\u003e18\u003c/PackageLength\u003e\u003cPackage\u003eMicrosoft.BingNews\u003c/Package\u003e\u003cFqbnLength\u003e118\u003c/FqbnLength\u003e\u003cFqbn\u003eCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00\u003c/Fqbn\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "4.55.62231.00", + "original_file_name": "APPX", + "product": "MICROSOFT.BINGNEWS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "WIN1012009LL.local" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "information" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "winlog": { + "activity_id": "{eac4f4ed-cf73-0001-a741-c5ea73cfd901}", + "channel": "Microsoft-Windows-AppLocker/Packaged app-Deployment", + "computer_name": "WIN1012009LL.local", + "event_id": "8023", + "level": "information", + "opcode": "Info", + "process": { + "pid": 4584, + "thread": { + "id": 26688 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "6269", + "task": "None", + "time_created": "2023-08-15T14:12:32.680Z", + "user": { + "identifier": "S-1-5-21-1133191089-1850170202-1535859923-200319" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.BINGNEWS\\APPX\\4.55.62231.00", + "FqbnLength": 118, + "Package": "Microsoft.BingNews", + "PackageLength": "18", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "yams", + "RuleSddlLength": 81, + "TargetProcessId": 4584, + "TargetUser": "S-1-5-21-1133191089-1850170202-1535859923-200319", + "xml_name": "RuleAndFileData" + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| destination.user.id | Unique identifier of the user. | keyword | +| destination.user.name | Short name or login of the user. | keyword | +| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.pe.file_version | | | +| file.pe.original_file_name | | | +| file.pe.product | | | +| file.x509.subject.common_name | List of common names (CN) of subject. | keyword | +| file.x509.subject.country | List of country (C) code | keyword | +| file.x509.subject.locality | List of locality names (L) | keyword | +| file.x509.subject.organization | List of organizations (O) of subject. | keyword | +| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.pid | Process id. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| source.user.id | Unique identifier of the user. | keyword | +| source.user.name | Short name or login of the user. | keyword | +| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| winlog.activity_id | A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. | keyword | +| winlog.api | The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. | keyword | +| winlog.channel | The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. | keyword | +| winlog.computer_name | The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. | keyword | +| winlog.event_data | The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. | object | +| winlog.event_data.AuthenticationPackageName | | keyword | +| winlog.event_data.Binary | | keyword | +| winlog.event_data.BitlockerUserInputTime | | keyword | +| winlog.event_data.BootMode | | keyword | +| winlog.event_data.BootType | | keyword | +| winlog.event_data.BuildVersion | | keyword | +| winlog.event_data.Company | | keyword | +| winlog.event_data.CorruptionActionState | | keyword | +| winlog.event_data.CreationUtcTime | | keyword | +| winlog.event_data.Description | | keyword | +| winlog.event_data.Detail | | keyword | +| winlog.event_data.DeviceName | | keyword | +| winlog.event_data.DeviceNameLength | | keyword | +| winlog.event_data.DeviceTime | | keyword | +| winlog.event_data.DeviceVersionMajor | | keyword | +| winlog.event_data.DeviceVersionMinor | | keyword | +| winlog.event_data.DriveName | | keyword | +| winlog.event_data.DriverName | | keyword | +| winlog.event_data.DriverNameLength | | keyword | +| winlog.event_data.DwordVal | | keyword | +| winlog.event_data.EntryCount | | keyword | +| winlog.event_data.ExtraInfo | | keyword | +| winlog.event_data.FailureName | | keyword | +| winlog.event_data.FailureNameLength | | keyword | +| winlog.event_data.FileVersion | | keyword | +| winlog.event_data.FinalStatus | | keyword | +| winlog.event_data.Group | | keyword | +| winlog.event_data.IdleImplementation | | keyword | +| winlog.event_data.IdleStateCount | | keyword | +| winlog.event_data.ImpersonationLevel | | keyword | +| winlog.event_data.IntegrityLevel | | keyword | +| winlog.event_data.IpAddress | | keyword | +| winlog.event_data.IpPort | | keyword | +| winlog.event_data.KeyLength | | keyword | +| winlog.event_data.LastBootGood | | keyword | +| winlog.event_data.LastShutdownGood | | keyword | +| winlog.event_data.LmPackageName | | keyword | +| winlog.event_data.LogonGuid | | keyword | +| winlog.event_data.LogonId | | keyword | +| winlog.event_data.LogonProcessName | | keyword | +| winlog.event_data.LogonType | | keyword | +| winlog.event_data.MajorVersion | | keyword | +| winlog.event_data.MaximumPerformancePercent | | keyword | +| winlog.event_data.MemberName | | keyword | +| winlog.event_data.MemberSid | | keyword | +| winlog.event_data.MinimumPerformancePercent | | keyword | +| winlog.event_data.MinimumThrottlePercent | | keyword | +| winlog.event_data.MinorVersion | | keyword | +| winlog.event_data.NewProcessId | | keyword | +| winlog.event_data.NewProcessName | | keyword | +| winlog.event_data.NewSchemeGuid | | keyword | +| winlog.event_data.NewTime | | keyword | +| winlog.event_data.NominalFrequency | | keyword | +| winlog.event_data.Number | | keyword | +| winlog.event_data.OldSchemeGuid | | keyword | +| winlog.event_data.OldTime | | keyword | +| winlog.event_data.OriginalFileName | | keyword | +| winlog.event_data.Path | | keyword | +| winlog.event_data.PerformanceImplementation | | keyword | +| winlog.event_data.PreviousCreationUtcTime | | keyword | +| winlog.event_data.PreviousTime | | keyword | +| winlog.event_data.PrivilegeList | | keyword | +| winlog.event_data.ProcessId | | keyword | +| winlog.event_data.ProcessName | | keyword | +| winlog.event_data.ProcessPath | | keyword | +| winlog.event_data.ProcessPid | | keyword | +| winlog.event_data.Product | | keyword | +| winlog.event_data.PuaCount | | keyword | +| winlog.event_data.PuaPolicyId | | keyword | +| winlog.event_data.QfeVersion | | keyword | +| winlog.event_data.Reason | | keyword | +| winlog.event_data.SchemaVersion | | keyword | +| winlog.event_data.ScriptBlockText | | keyword | +| winlog.event_data.ServiceName | | keyword | +| winlog.event_data.ServiceVersion | | keyword | +| winlog.event_data.ShutdownActionType | | keyword | +| winlog.event_data.ShutdownEventCode | | keyword | +| winlog.event_data.ShutdownReason | | keyword | +| winlog.event_data.Signature | | keyword | +| winlog.event_data.SignatureStatus | | keyword | +| winlog.event_data.Signed | | keyword | +| winlog.event_data.StartTime | | keyword | +| winlog.event_data.State | | keyword | +| winlog.event_data.Status | | keyword | +| winlog.event_data.StopTime | | keyword | +| winlog.event_data.SubjectDomainName | | keyword | +| winlog.event_data.SubjectLogonId | | keyword | +| winlog.event_data.SubjectUserName | | keyword | +| winlog.event_data.SubjectUserSid | | keyword | +| winlog.event_data.TSId | | keyword | +| winlog.event_data.TargetDomainName | | keyword | +| winlog.event_data.TargetInfo | | keyword | +| winlog.event_data.TargetLogonGuid | | keyword | +| winlog.event_data.TargetLogonId | | keyword | +| winlog.event_data.TargetServerName | | keyword | +| winlog.event_data.TargetUserName | | keyword | +| winlog.event_data.TargetUserSid | | keyword | +| winlog.event_data.TerminalSessionId | | keyword | +| winlog.event_data.TokenElevationType | | keyword | +| winlog.event_data.TransmittedServices | | keyword | +| winlog.event_data.UserSid | | keyword | +| winlog.event_data.Version | | keyword | +| winlog.event_data.Workstation | | keyword | +| winlog.event_data.param1 | | keyword | +| winlog.event_data.param2 | | keyword | +| winlog.event_data.param3 | | keyword | +| winlog.event_data.param4 | | keyword | +| winlog.event_data.param5 | | keyword | +| winlog.event_data.param6 | | keyword | +| winlog.event_data.param7 | | keyword | +| winlog.event_data.param8 | | keyword | +| winlog.event_id | The event identifier. The value is specific to the source of the event. | keyword | +| winlog.keywords | The keywords are used to classify an event. | keyword | +| winlog.level | The level assigned to the event such as Information, Warning, or Critical. | keyword | +| winlog.opcode | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | keyword | +| winlog.process.pid | The process_id of the Client Server Runtime Process. | long | +| winlog.process.thread.id | | long | +| winlog.provider_guid | A globally unique identifier that identifies the provider that logged the event. | keyword | +| winlog.provider_name | The source of the event log record (the application or service that logged the record). | keyword | +| winlog.record_id | The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. | keyword | +| winlog.related_activity_id | A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. | keyword | +| winlog.task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. | keyword | +| winlog.time_created | The time the event was created. | date | +| winlog.user.domain | The domain that the account associated with this event is a member of. | keyword | +| winlog.user.identifier | The Windows security identifier (SID) of the account associated with this event. If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. | keyword | +| winlog.user.name | Name of the user associated with this event. | keyword | +| winlog.user.type | The type of account associated with this event. | keyword | +| winlog.user_data | The event specific data. This field is mutually exclusive with `event_data`. | object | +| winlog.user_data.FileHash | | keyword | +| winlog.user_data.FileHashLength | | long | +| winlog.user_data.FilePath | | keyword | +| winlog.user_data.FilePathLength | | long | +| winlog.user_data.Fqbn | | keyword | +| winlog.user_data.FqbnLength | | long | +| winlog.user_data.FullFilePath | | keyword | +| winlog.user_data.FullFilePathLength | | long | +| winlog.user_data.Package | | keyword | +| winlog.user_data.PackageLength | | keyword | +| winlog.user_data.PolicyName | | keyword | +| winlog.user_data.PolicyNameLength | | long | +| winlog.user_data.RuleId | | keyword | +| winlog.user_data.RuleName | | keyword | +| winlog.user_data.RuleNameLength | | long | +| winlog.user_data.RuleSddl | | keyword | +| winlog.user_data.RuleSddlLength | | long | +| winlog.user_data.TargetLogonId | | keyword | +| winlog.user_data.TargetProcessId | | long | +| winlog.user_data.TargetUser | | keyword | +| winlog.user_data.xml_name | | keyword | +| winlog.version | The version number of the event's definition. | long | + + +### AppLocker/Packaged app-Execution + +The Windows `applocker_packaged_app_execution` data stream provides events from the Windows +`Microsoft-Windows-AppLocker/Packaged app-Execution` event log. + +An example event for `applocker_packaged_app_execution` looks as following: + +```json +{ + "@timestamp": "2023-08-13T13:53:33.706Z", + "agent": { + "ephemeral_id": "b26295a5-6dd5-4ff4-9102-98ebdf4f097c", + "id": "a2f04e82-dbc6-4eae-b003-e7cd21a975ef", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "windows.applocker_packaged_app_execution", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "a2f04e82-dbc6-4eae-b003-e7cd21a975ef", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "None", + "agent_id_status": "verified", + "category": "process", + "code": "8020", + "created": "2023-08-17T14:13:22.965Z", + "dataset": "windows.applocker_packaged_app_execution", + "ingested": "2023-08-17T14:13:26Z", + "kind": "event", + "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-AppLocker' Guid='{cbda4dbf-8d5d-4f69-9578-be14aa540d22}'/\u003e\u003cEventID\u003e8020\u003c/EventID\u003e\u003cVersion\u003e0\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e0\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x2000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2023-08-13T13:53:33.7067781Z'/\u003e\u003cEventRecordID\u003e2986\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='1672' ThreadID='8384'/\u003e\u003cChannel\u003eMicrosoft-Windows-AppLocker/Packaged app-Execution\u003c/Channel\u003e\u003cComputer\u003eel33t-b00k-1\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-2707992022-4034939591-3454028951-1001'/\u003e\u003c/System\u003e\u003cUserData\u003e\u003cRuleAndFileData xmlns='http://schemas.microsoft.com/schemas/event/Microsoft.Windows/1.0.0.0'\u003e\u003cPolicyNameLength\u003e4\u003c/PolicyNameLength\u003e\u003cPolicyName\u003eAPPX\u003c/PolicyName\u003e\u003cRuleId\u003e{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}\u003c/RuleId\u003e\u003cRuleNameLength\u003e39\u003c/RuleNameLength\u003e\u003cRuleName\u003e(Default Rule) All signed packaged apps\u003c/RuleName\u003e\u003cRuleSddlLength\u003e81\u003c/RuleSddlLength\u003e\u003cRuleSddl\u003eD:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026amp;\u0026amp; ((APPID://FQBN) \u0026gt;= ({\"*\\*\\*\",0}))))\u003c/RuleSddl\u003e\u003cTargetUser\u003eS-1-5-21-2707992022-4034939591-3454028951-1001\u003c/TargetUser\u003e\u003cTargetProcessId\u003e41864\u003c/TargetProcessId\u003e\u003cPackageLength\u003e15\u003c/PackageLength\u003e\u003cPackage\u003eMICROSOFT.TODOS\u003c/Package\u003e\u003cFqbnLength\u003e116\u003c/FqbnLength\u003e\u003cFqbn\u003eCN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00\u003c/Fqbn\u003e\u003c/RuleAndFileData\u003e\u003c/UserData\u003e\u003c/Event\u003e", + "provider": "Microsoft-Windows-AppLocker", + "type": "start" + }, + "file": { + "pe": { + "file_version": "2.100.61791.00", + "original_file_name": "APPX", + "product": "MICROSOFT.TODOS" + }, + "x509": { + "subject": { + "common_name": "MICROSOFT CORPORATION", + "country": "US", + "locality": "REDMOND", + "organization": "MICROSOFT CORPORATION", + "state_or_province": "WASHINGTON" + } + } + }, + "host": { + "name": "el33t-b00k-1" + }, + "input": { + "type": "httpjson" + }, + "log": { + "level": "information" + }, + "tags": [ + "forwarded", + "preserve_original_event" + ], + "user": { + "id": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "winlog": { + "channel": "Microsoft-Windows-AppLocker/Packaged app-Execution", + "computer_name": "el33t-b00k-1", + "event_id": "8020", + "level": "information", + "opcode": "Info", + "process": { + "pid": 1672, + "thread": { + "id": 8384 + } + }, + "provider_guid": "{cbda4dbf-8d5d-4f69-9578-be14aa540d22}", + "provider_name": "Microsoft-Windows-AppLocker", + "record_id": "2986", + "task": "None", + "time_created": "2023-08-13T13:53:33.706Z", + "user": { + "identifier": "S-1-5-21-2707992022-4034939591-3454028951-1001" + }, + "user_data": { + "Fqbn": "CN=MICROSOFT CORPORATION, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\\MICROSOFT.TODOS\\APPX\\2.100.61791.00", + "FqbnLength": 116, + "Package": "MICROSOFT.TODOS", + "PackageLength": "15", + "PolicyName": "APPX", + "PolicyNameLength": 4, + "RuleId": "{a9e18c21-ff8f-43cf-b9fc-db40eed693ba}", + "RuleName": "(Default Rule) All signed packaged apps", + "RuleNameLength": 39, + "RuleSddl": "D:(XA;;FX;;;S-1-1-0;((Exists APPID://FQBN) \u0026\u0026 ((APPID://FQBN) \u003e= ({\"*\\*\\*\",0}))))", + "RuleSddlLength": 81, + "TargetProcessId": 41864, + "TargetUser": "S-1-5-21-2707992022-4034939591-3454028951-1001", + "xml_name": "RuleAndFileData" + } + } +} +``` + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset name. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| dataset.name | Dataset name. | constant_keyword | +| dataset.namespace | Dataset namespace. | constant_keyword | +| dataset.type | Dataset type. | constant_keyword | +| destination.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| destination.user.id | Unique identifier of the user. | keyword | +| destination.user.name | Short name or login of the user. | keyword | +| destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | +| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | +| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.dataset | Event dataset | constant_keyword | +| event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.module | Event module | constant_keyword | +| event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | +| event.provider | Source of the event. Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | keyword | +| event.sequence | Sequence number of the event. The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | long | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| file.directory | Directory where the file is located. It should include the drive letter, when appropriate. | keyword | +| file.extension | File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | +| file.hash.sha256 | SHA256 hash. | keyword | +| file.name | Name of the file including the extension, without the directory. | keyword | +| file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | +| file.path.text | Multi-field of `file.path`. | match_only_text | +| file.pe.file_version | | | +| file.pe.original_file_name | | | +| file.pe.product | | | +| file.x509.subject.common_name | List of common names (CN) of subject. | keyword | +| file.x509.subject.country | List of country (C) code | keyword | +| file.x509.subject.locality | List of locality names (L) | keyword | +| file.x509.subject.organization | List of organizations (O) of subject. | keyword | +| file.x509.subject.state_or_province | List of state or province names (ST, S, or P) | keyword | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| input.type | Type of Filebeat input. | keyword | +| log.level | Original log level of the log event. If the source of the event provides a log level or textual severity, this is the one that goes in `log.level`. If your source doesn't specify one, you may put your event transport's severity here (e.g. Syslog severity). Some examples are `warn`, `err`, `i`, `informational`. | keyword | +| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | +| process.args | Array of process arguments, starting with the absolute path to the executable. May be filtered to protect sensitive information. | keyword | +| process.args_count | Length of the process.args array. This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | long | +| process.command_line | Full command line that started the process, including the absolute path to the executable, and all arguments. Some arguments may be filtered to protect sensitive information. | wildcard | +| process.command_line.text | Multi-field of `process.command_line`. | match_only_text | +| process.entity_id | Unique identifier for the process. The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process. Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | keyword | +| process.executable | Absolute path to the process executable. | keyword | +| process.executable.text | Multi-field of `process.executable`. | match_only_text | +| process.name | Process name. Sometimes called program name or similar. | keyword | +| process.name.text | Multi-field of `process.name`. | match_only_text | +| process.pid | Process id. | long | +| process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword | +| process.title.text | Multi-field of `process.title`. | match_only_text | +| related.hash | All the hashes seen on your event. Populating this field, then using it to search for hashes can help in situations where you're unsure what the hash algorithm is (and therefore which key name to search). | keyword | +| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | +| related.ip | All of the IPs seen on your event. | ip | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| source.user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| source.user.id | Unique identifier of the user. | keyword | +| source.user.name | Short name or login of the user. | keyword | +| source.user.name.text | Multi-field of `source.user.name`. | match_only_text | +| tags | List of keywords used to tag each event. | keyword | +| user.domain | Name of the directory the user is a member of. For example, an LDAP or Active Directory domain name. | keyword | +| user.id | Unique identifier of the user. | keyword | +| user.name | Short name or login of the user. | keyword | +| user.name.text | Multi-field of `user.name`. | match_only_text | +| winlog.activity_id | A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity. | keyword | +| winlog.api | The event log API type used to read the record. The possible values are "wineventlog" for the Windows Event Log API or "eventlogging" for the Event Logging API. The Event Logging API was designed for Windows Server 2003 or Windows 2000 operating systems. In Windows Vista, the event logging infrastructure was redesigned. On Windows Vista or later operating systems, the Windows Event Log API is used. Winlogbeat automatically detects which API to use for reading event logs. | keyword | +| winlog.channel | The name of the channel from which this record was read. This value is one of the names from the `event_logs` collection in the configuration. | keyword | +| winlog.computer_name | The name of the computer that generated the record. When using Windows event forwarding, this name can differ from `agent.hostname`. | keyword | +| winlog.event_data | The event-specific data. This field is mutually exclusive with `user_data`. If you are capturing event data on versions prior to Windows Vista, the parameters in `event_data` are named `param1`, `param2`, and so on, because event log parameters are unnamed in earlier versions of Windows. | object | +| winlog.event_data.AuthenticationPackageName | | keyword | +| winlog.event_data.Binary | | keyword | +| winlog.event_data.BitlockerUserInputTime | | keyword | +| winlog.event_data.BootMode | | keyword | +| winlog.event_data.BootType | | keyword | +| winlog.event_data.BuildVersion | | keyword | +| winlog.event_data.Company | | keyword | +| winlog.event_data.CorruptionActionState | | keyword | +| winlog.event_data.CreationUtcTime | | keyword | +| winlog.event_data.Description | | keyword | +| winlog.event_data.Detail | | keyword | +| winlog.event_data.DeviceName | | keyword | +| winlog.event_data.DeviceNameLength | | keyword | +| winlog.event_data.DeviceTime | | keyword | +| winlog.event_data.DeviceVersionMajor | | keyword | +| winlog.event_data.DeviceVersionMinor | | keyword | +| winlog.event_data.DriveName | | keyword | +| winlog.event_data.DriverName | | keyword | +| winlog.event_data.DriverNameLength | | keyword | +| winlog.event_data.DwordVal | | keyword | +| winlog.event_data.EntryCount | | keyword | +| winlog.event_data.ExtraInfo | | keyword | +| winlog.event_data.FailureName | | keyword | +| winlog.event_data.FailureNameLength | | keyword | +| winlog.event_data.FileVersion | | keyword | +| winlog.event_data.FinalStatus | | keyword | +| winlog.event_data.Group | | keyword | +| winlog.event_data.IdleImplementation | | keyword | +| winlog.event_data.IdleStateCount | | keyword | +| winlog.event_data.ImpersonationLevel | | keyword | +| winlog.event_data.IntegrityLevel | | keyword | +| winlog.event_data.IpAddress | | keyword | +| winlog.event_data.IpPort | | keyword | +| winlog.event_data.KeyLength | | keyword | +| winlog.event_data.LastBootGood | | keyword | +| winlog.event_data.LastShutdownGood | | keyword | +| winlog.event_data.LmPackageName | | keyword | +| winlog.event_data.LogonGuid | | keyword | +| winlog.event_data.LogonId | | keyword | +| winlog.event_data.LogonProcessName | | keyword | +| winlog.event_data.LogonType | | keyword | +| winlog.event_data.MajorVersion | | keyword | +| winlog.event_data.MaximumPerformancePercent | | keyword | +| winlog.event_data.MemberName | | keyword | +| winlog.event_data.MemberSid | | keyword | +| winlog.event_data.MinimumPerformancePercent | | keyword | +| winlog.event_data.MinimumThrottlePercent | | keyword | +| winlog.event_data.MinorVersion | | keyword | +| winlog.event_data.NewProcessId | | keyword | +| winlog.event_data.NewProcessName | | keyword | +| winlog.event_data.NewSchemeGuid | | keyword | +| winlog.event_data.NewTime | | keyword | +| winlog.event_data.NominalFrequency | | keyword | +| winlog.event_data.Number | | keyword | +| winlog.event_data.OldSchemeGuid | | keyword | +| winlog.event_data.OldTime | | keyword | +| winlog.event_data.OriginalFileName | | keyword | +| winlog.event_data.Path | | keyword | +| winlog.event_data.PerformanceImplementation | | keyword | +| winlog.event_data.PreviousCreationUtcTime | | keyword | +| winlog.event_data.PreviousTime | | keyword | +| winlog.event_data.PrivilegeList | | keyword | +| winlog.event_data.ProcessId | | keyword | +| winlog.event_data.ProcessName | | keyword | +| winlog.event_data.ProcessPath | | keyword | +| winlog.event_data.ProcessPid | | keyword | +| winlog.event_data.Product | | keyword | +| winlog.event_data.PuaCount | | keyword | +| winlog.event_data.PuaPolicyId | | keyword | +| winlog.event_data.QfeVersion | | keyword | +| winlog.event_data.Reason | | keyword | +| winlog.event_data.SchemaVersion | | keyword | +| winlog.event_data.ScriptBlockText | | keyword | +| winlog.event_data.ServiceName | | keyword | +| winlog.event_data.ServiceVersion | | keyword | +| winlog.event_data.ShutdownActionType | | keyword | +| winlog.event_data.ShutdownEventCode | | keyword | +| winlog.event_data.ShutdownReason | | keyword | +| winlog.event_data.Signature | | keyword | +| winlog.event_data.SignatureStatus | | keyword | +| winlog.event_data.Signed | | keyword | +| winlog.event_data.StartTime | | keyword | +| winlog.event_data.State | | keyword | +| winlog.event_data.Status | | keyword | +| winlog.event_data.StopTime | | keyword | +| winlog.event_data.SubjectDomainName | | keyword | +| winlog.event_data.SubjectLogonId | | keyword | +| winlog.event_data.SubjectUserName | | keyword | +| winlog.event_data.SubjectUserSid | | keyword | +| winlog.event_data.TSId | | keyword | +| winlog.event_data.TargetDomainName | | keyword | +| winlog.event_data.TargetInfo | | keyword | +| winlog.event_data.TargetLogonGuid | | keyword | +| winlog.event_data.TargetLogonId | | keyword | +| winlog.event_data.TargetServerName | | keyword | +| winlog.event_data.TargetUserName | | keyword | +| winlog.event_data.TargetUserSid | | keyword | +| winlog.event_data.TerminalSessionId | | keyword | +| winlog.event_data.TokenElevationType | | keyword | +| winlog.event_data.TransmittedServices | | keyword | +| winlog.event_data.UserSid | | keyword | +| winlog.event_data.Version | | keyword | +| winlog.event_data.Workstation | | keyword | +| winlog.event_data.param1 | | keyword | +| winlog.event_data.param2 | | keyword | +| winlog.event_data.param3 | | keyword | +| winlog.event_data.param4 | | keyword | +| winlog.event_data.param5 | | keyword | +| winlog.event_data.param6 | | keyword | +| winlog.event_data.param7 | | keyword | +| winlog.event_data.param8 | | keyword | +| winlog.event_id | The event identifier. The value is specific to the source of the event. | keyword | +| winlog.keywords | The keywords are used to classify an event. | keyword | +| winlog.level | The level assigned to the event such as Information, Warning, or Critical. | keyword | +| winlog.opcode | The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. | keyword | +| winlog.process.pid | The process_id of the Client Server Runtime Process. | long | +| winlog.process.thread.id | | long | +| winlog.provider_guid | A globally unique identifier that identifies the provider that logged the event. | keyword | +| winlog.provider_name | The source of the event log record (the application or service that logged the record). | keyword | +| winlog.record_id | The record ID of the event log record. The first record written to an event log is record number 1, and other records are numbered sequentially. If the record number reaches the maximum value (2^32^ for the Event Logging API and 2^64^ for the Windows Event Log API), the next record number will be 0. | keyword | +| winlog.related_activity_id | A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their `activity_id` identifier. | keyword | +| winlog.task | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. The category used by the Event Logging API (on pre Windows Vista operating systems) is written to this field. | keyword | +| winlog.time_created | The time the event was created. | date | +| winlog.user.domain | The domain that the account associated with this event is a member of. | keyword | +| winlog.user.identifier | The Windows security identifier (SID) of the account associated with this event. If Winlogbeat cannot resolve the SID to a name, then the `user.name`, `user.domain`, and `user.type` fields will be omitted from the event. If you discover Winlogbeat not resolving SIDs, review the log for clues as to what the problem may be. | keyword | +| winlog.user.name | Name of the user associated with this event. | keyword | +| winlog.user.type | The type of account associated with this event. | keyword | +| winlog.user_data | The event specific data. This field is mutually exclusive with `event_data`. | object | +| winlog.user_data.FileHash | | keyword | +| winlog.user_data.FileHashLength | | long | +| winlog.user_data.FilePath | | keyword | +| winlog.user_data.FilePathLength | | long | +| winlog.user_data.Fqbn | | keyword | +| winlog.user_data.FqbnLength | | long | +| winlog.user_data.FullFilePath | | keyword | +| winlog.user_data.FullFilePathLength | | long | +| winlog.user_data.Package | | keyword | +| winlog.user_data.PackageLength | | keyword | +| winlog.user_data.PolicyName | | keyword | +| winlog.user_data.PolicyNameLength | | long | +| winlog.user_data.RuleId | | keyword | +| winlog.user_data.RuleName | | keyword | +| winlog.user_data.RuleNameLength | | long | +| winlog.user_data.RuleSddl | | keyword | +| winlog.user_data.RuleSddlLength | | long | +| winlog.user_data.TargetLogonId | | keyword | +| winlog.user_data.TargetProcessId | | long | +| winlog.user_data.TargetUser | | keyword | +| winlog.user_data.xml_name | | keyword | +| winlog.version | The version number of the event's definition. | long | + + ### Forwarded The Windows `forwarded` data stream provides events from the Windows @@ -99,12 +1602,11 @@ An example event for `powershell` looks as following: { "@timestamp": "2020-05-13T13:21:43.183Z", "agent": { - "ephemeral_id": "9c05a45c-02bf-4437-9447-8591244dbdca", - "hostname": "docker-fleet-agent", - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "ephemeral_id": "bd1da8d2-a190-4089-9031-a8e5278277fd", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.powershell", @@ -115,17 +1617,17 @@ An example event for `powershell` looks as following: "version": "8.0.0" }, "elastic_agent": { - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "7.17.0" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": "process", "code": "600", - "created": "2022-03-31T08:41:12.816Z", + "created": "2023-08-14T00:35:36.340Z", "dataset": "windows.powershell", - "ingested": "2022-03-31T08:41:16Z", + "ingested": "2023-08-14T00:35:39Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T13:21:43.183180900Z'/\u003e\u003cEventRecordID\u003e1089\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eCertificate\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Certificate\n\tNewProviderState=Started\n\n\tSequenceNumber=35\n\n\tHostName=Windows PowerShell ISE Host\n\tHostVersion=5.1.17763.1007\n\tHostId=86edc16f-6943-469e-8bd8-ef1857080206\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe C:\\Users\\vagrant\\Desktop\\lateral.ps1\n\tEngineVersion=5.1.17763.1007\n\tRunspaceId=9d21da0b-e402-40e1-92ff-98c5ab1137a9\n\tPipelineId=15\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T13:25:04.656426900Z'/\u003e\u003cEventRecordID\u003e1266\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eRegistry\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Registry\n\tNewProviderState=Started\n\n\tSequenceNumber=1\n\n\tHostName=ConsoleHost\n\tHostVersion=5.1.17763.1007\n\tHostId=44b8d66c-f5a2-4abb-ac7d-6db73990a6d3\n\tHostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -noexit -command 'C:\\Gopath\\src\\github.com\\elastic\\beats'\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e\n\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='PowerShell'/\u003e\u003cEventID Qualifiers='0'\u003e600\u003c/EventID\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e6\u003c/Task\u003e\u003cKeywords\u003e0x80000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-06-04T07:25:04.857430200Z'/\u003e\u003cEventRecordID\u003e18640\u003c/EventRecordID\u003e\u003cChannel\u003eWindows PowerShell\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData\u003eCertificate\u003c/Data\u003e\u003cData\u003eStarted\u003c/Data\u003e\u003cData\u003e\tProviderName=Certificate\n\tNewProviderState=Started\n\n\tSequenceNumber=8\n\n\tHostName=ConsoleHost\n\tHostVersion=2.0\n\tHostId=99a16837-7392-463d-afe5-5f3ed24bd358\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine=\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "PowerShell", @@ -211,6 +1713,7 @@ An example event for `powershell` looks as following: | destination.user.name | Short name or login of the user. | keyword | | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | @@ -442,12 +1945,11 @@ An example event for `powershell_operational` looks as following: { "@timestamp": "2020-05-13T09:04:04.755Z", "agent": { - "ephemeral_id": "d531ecae-45f4-4f96-a334-2c851a45469a", - "hostname": "docker-fleet-agent", - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "ephemeral_id": "2d7b986c-9bc7-4121-aebd-5ca44de66797", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "7.17.0" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.powershell_operational", @@ -458,17 +1960,17 @@ An example event for `powershell_operational` looks as following: "version": "8.0.0" }, "elastic_agent": { - "id": "0d57cbc7-6410-455a-840c-08fd44507a26", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "7.17.0" + "version": "8.8.2" }, "event": { "agent_id_status": "verified", "category": "process", "code": "4105", - "created": "2022-03-31T08:41:48.560Z", + "created": "2023-08-14T00:36:22.656Z", "dataset": "windows.powershell_operational", - "ingested": "2022-03-31T08:41:49Z", + "ingested": "2023-08-14T00:36:23Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-PowerShell' Guid='{a0c1853b-5c40-4b15-8766-3cf1c58f985a}'/\u003e\u003cEventID\u003e4105\u003c/EventID\u003e\u003cVersion\u003e1\u003c/Version\u003e\u003cLevel\u003e5\u003c/Level\u003e\u003cTask\u003e102\u003c/Task\u003e\u003cOpcode\u003e15\u003c/Opcode\u003e\u003cKeywords\u003e0x0\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2020-05-13T09:04:04.755232500Z'/\u003e\u003cEventRecordID\u003e790\u003c/EventRecordID\u003e\u003cCorrelation ActivityID='{dd68516a-2930-0000-5962-68dd3029d601}'/\u003e\u003cExecution ProcessID='4204' ThreadID='1476'/\u003e\u003cChannel\u003eMicrosoft-Windows-PowerShell/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-21-1350058589-2282154016-2764056528-1000'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='ScriptBlockId'\u003ef4a378ab-b74f-41a7-a5ef-6dd55562fdb9\u003c/Data\u003e\u003cData Name='RunspaceId'\u003e9c031e5c-8d5a-4b91-a12e-b3624970b623\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-PowerShell", @@ -547,6 +2049,7 @@ An example event for `powershell_operational` looks as following: | destination.user.name | Short name or login of the user. | keyword | | destination.user.name.text | Multi-field of `destination.user.name`. | match_only_text | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error.code | Error code describing the error. | keyword | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | @@ -778,11 +2281,11 @@ An example event for `sysmon_operational` looks as following: { "@timestamp": "2019-07-18T03:34:01.261Z", "agent": { - "ephemeral_id": "69741349-7f7f-48bd-88c9-9e10a682f135", - "id": "c3c8f438-e38f-457a-8051-8a016f0370c6", + "ephemeral_id": "1ce461bb-6b53-430b-b223-9fdb09f0360c", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.2" + "version": "8.8.2" }, "data_stream": { "dataset": "windows.sysmon_operational", @@ -818,11 +2321,12 @@ An example event for `sysmon_operational` looks as following: "version": "8.0.0" }, "elastic_agent": { - "id": "c3c8f438-e38f-457a-8051-8a016f0370c6", + "id": "f4424cce-fef8-4bb7-98cc-0511c45605f4", "snapshot": false, - "version": "8.6.2" + "version": "8.8.2" }, "event": { + "action": "DNSEvent (DNS query)", "agent_id_status": "verified", "category": [ "network" @@ -830,7 +2334,7 @@ An example event for `sysmon_operational` looks as following: "code": "22", "created": "2019-07-18T03:34:02.025Z", "dataset": "windows.sysmon_operational", - "ingested": "2023-04-23T22:45:37Z", + "ingested": "2023-08-14T00:37:09Z", "kind": "event", "original": "\u003cEvent xmlns='http://schemas.microsoft.com/win/2004/08/events/event'\u003e\u003cSystem\u003e\u003cProvider Name='Microsoft-Windows-Sysmon' Guid='{5770385f-c22a-43e0-bf4c-06f5698ffbd9}'/\u003e\u003cEventID\u003e22\u003c/EventID\u003e\u003cVersion\u003e5\u003c/Version\u003e\u003cLevel\u003e4\u003c/Level\u003e\u003cTask\u003e22\u003c/Task\u003e\u003cOpcode\u003e0\u003c/Opcode\u003e\u003cKeywords\u003e0x8000000000000000\u003c/Keywords\u003e\u003cTimeCreated SystemTime='2019-07-18T03:34:02.025237700Z'/\u003e\u003cEventRecordID\u003e67\u003c/EventRecordID\u003e\u003cCorrelation/\u003e\u003cExecution ProcessID='2828' ThreadID='1684'/\u003e\u003cChannel\u003eMicrosoft-Windows-Sysmon/Operational\u003c/Channel\u003e\u003cComputer\u003evagrant-2016\u003c/Computer\u003e\u003cSecurity UserID='S-1-5-18'/\u003e\u003c/System\u003e\u003cEventData\u003e\u003cData Name='RuleName'\u003e\u003c/Data\u003e\u003cData Name='UtcTime'\u003e2019-07-18 03:34:01.261\u003c/Data\u003e\u003cData Name='ProcessGuid'\u003e{fa4a0de6-e8a9-5d2f-0000-001053699900}\u003c/Data\u003e\u003cData Name='ProcessId'\u003e2736\u003c/Data\u003e\u003cData Name='QueryName'\u003ewww.msn.com\u003c/Data\u003e\u003cData Name='QueryStatus'\u003e0\u003c/Data\u003e\u003cData Name='QueryResults'\u003etype: 5 www-msn-com.a-0003.a-msedge.net;type: 5 a-0003.a-msedge.net;::ffff:204.79.197.203;\u003c/Data\u003e\u003cData Name='Image'\u003eC:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\u003c/Data\u003e\u003c/EventData\u003e\u003c/Event\u003e", "provider": "Microsoft-Windows-Sysmon", @@ -1093,7 +2597,7 @@ An example event for `sysmon_operational` looks as following: | winlog.event_data.CorruptionActionState | | keyword | | winlog.event_data.CreationUtcTime | | keyword | | winlog.event_data.Description | | keyword | -| winlog.event_data.Detail | | keyword | +| winlog.event_data.Details | | keyword | | winlog.event_data.DeviceName | | keyword | | winlog.event_data.DeviceNameLength | | keyword | | winlog.event_data.DeviceTime | | keyword | @@ -1237,54 +2741,55 @@ The Windows `service` data stream provides service details. **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| windows.service.display_name | The display name of the service. | keyword | -| windows.service.exit_code | For `Stopped` services this is the error code that service reports when starting to stopping. This will be the generic Windows service error code unless the service provides a service-specific error code. | keyword | -| windows.service.id | A unique ID for the service. It is a hash of the machine's GUID and the service name. | keyword | -| windows.service.name | The service name. | keyword | -| windows.service.path_name | Fully qualified path to the file that implements the service, including arguments. | keyword | -| windows.service.pid | For `Running` services this is the associated process PID. | long | -| windows.service.start_name | Account name under which a service runs. | keyword | -| windows.service.start_type | The startup type of the service. The possible values are `Automatic`, `Boot`, `Disabled`, `Manual`, and `System`. | keyword | -| windows.service.state | The actual state of the service. The possible values are `Continuing`, `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`. | keyword | -| windows.service.uptime.ms | The service's uptime specified in milliseconds. | long | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| agent.id | | keyword | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| windows.service.display_name | The display name of the service. | keyword | | +| windows.service.exit_code | For `Stopped` services this is the error code that service reports when starting to stopping. This will be the generic Windows service error code unless the service provides a service-specific error code. | keyword | | +| windows.service.id | A unique ID for the service. It is a hash of the machine's GUID and the service name. | keyword | | +| windows.service.name | The service name. | keyword | | +| windows.service.path_name | Fully qualified path to the file that implements the service, including arguments. | keyword | | +| windows.service.pid | For `Running` services this is the associated process PID. | long | | +| windows.service.start_name | Account name under which a service runs. | keyword | | +| windows.service.start_type | The startup type of the service. The possible values are `Automatic`, `Boot`, `Disabled`, `Manual`, and `System`. | keyword | | +| windows.service.state | The actual state of the service. The possible values are `Continuing`, `Pausing`, `Paused`, `Running`, `Starting`, `Stopping`, and `Stopped`. | keyword | | +| windows.service.uptime.ms | The service's uptime specified in milliseconds. | long | gauge | ### Perfmon diff --git a/packages/windows/img/applocker-windows-audit-and-blocked.png b/packages/windows/img/applocker-windows-audit-and-blocked.png new file mode 100644 index 00000000000..45fd104063e Binary files /dev/null and b/packages/windows/img/applocker-windows-audit-and-blocked.png differ diff --git a/packages/windows/kibana/dashboard/windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d.json b/packages/windows/kibana/dashboard/windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d.json new file mode 100644 index 00000000000..5559f5b7dcd --- /dev/null +++ b/packages/windows/kibana/dashboard/windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d.json @@ -0,0 +1,2617 @@ +{ + "attributes": { + "description": "This dashboard is used for observing Windows AppLocker events by combining audited and blocked events together.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Audited Applications", + "disabled": true, + "field": "event.code", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "8003", + "8006", + "8021", + "8022", + "8023", + "8024", + "8027" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "8003" + } + }, + { + "match_phrase": { + "event.code": "8006" + } + }, + { + "match_phrase": { + "event.code": "8021" + } + }, + { + "match_phrase": { + "event.code": "8022" + } + }, + { + "match_phrase": { + "event.code": "8023" + } + }, + { + "match_phrase": { + "event.code": "8024" + } + }, + { + "match_phrase": { + "event.code": "8027" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Blocked Applications", + "disabled": true, + "field": "event.code", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "8004", + "8007" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "8004" + } + }, + { + "match_phrase": { + "event.code": "8007" + } + } + ] + } + } + }, + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": "Allowed Applications", + "disabled": true, + "field": "event.code", + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "key": "event.code", + "negate": false, + "params": [ + "8002", + "8005", + "8020", + "8027", + "8037", + "8039" + ], + "type": "phrases" + }, + "query": { + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "event.code": "8002" + } + }, + { + "match_phrase": { + "event.code": "8005" + } + }, + { + "match_phrase": { + "event.code": "8020" + } + }, + { + "match_phrase": { + "event.code": "8027" + } + }, + { + "match_phrase": { + "event.code": "8037" + } + }, + { + "match_phrase": { + "event.code": "8039" + } + } + ] + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": false + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7": { + "columnOrder": [ + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4" + ], + "columns": { + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\"" + }, + "visualization": { + "layerId": "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "layerType": "data", + "metricAccessor": "ae2dbf4a-708b-4a3f-97f6-100289a3dea4", + "palette": { + "name": "cool", + "params": { + "continuity": "above", + "maxSteps": 5, + "name": "cool", + "progression": "fixed", + "rangeMax": null, + "rangeMin": 0, + "rangeType": "number", + "reverse": false, + "steps": 3, + "stops": [ + { + "color": "#ccd9ea", + "stop": 0 + }, + { + "color": "#98b5d5", + "stop": 2 + }, + { + "color": "#6092c0", + "stop": 4 + } + ] + }, + "type": "palette" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "237e1e12-7a84-4c62-bfe6-303fd6d99667", + "w": 6, + "x": 0, + "y": 0 + }, + "panelIndex": "237e1e12-7a84-4c62-bfe6-303fd6d99667", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7": { + "columnOrder": [ + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4", + "4432cd19-49a8-47ae-9906-d7ee1ad44b08" + ], + "columns": { + "4432cd19-49a8-47ae-9906-d7ee1ad44b08": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Signed Applications", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "winlog.user_data.Fqbn" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\"" + }, + "visualization": { + "color": "#54B399", + "layerId": "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "layerType": "data", + "metricAccessor": "ae2dbf4a-708b-4a3f-97f6-100289a3dea4", + "secondaryMetricAccessor": "4432cd19-49a8-47ae-9906-d7ee1ad44b08" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "cb4b0cdb-9b4f-4b4d-9481-8cd766926590", + "w": 6, + "x": 6, + "y": 0 + }, + "panelIndex": "cb4b0cdb-9b4f-4b4d-9481-8cd766926590", + "title": "", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 17, + "markdown": "## Blocked Apps", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 7, + "i": "6c5cee73-5337-4f09-b76f-e62be90a9130", + "w": 18, + "x": 12, + "y": 0 + }, + "panelIndex": "6c5cee73-5337-4f09-b76f-e62be90a9130", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "params": { + "fontSize": 17, + "markdown": "## Audited Apps", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 7, + "i": "5a6268f4-5f37-4c60-9353-cfa30f623dc4", + "w": 18, + "x": 30, + "y": 0 + }, + "panelIndex": "5a6268f4-5f37-4c60-9353-cfa30f623dc4", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7": { + "columnOrder": [ + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4", + "4432cd19-49a8-47ae-9906-d7ee1ad44b08" + ], + "columns": { + "4432cd19-49a8-47ae-9906-d7ee1ad44b08": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "ae2dbf4a-708b-4a3f-97f6-100289a3dea4": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "" + }, + "isBucketed": false, + "label": "Un-Signed Applications (Hashes)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "file.hash.sha256" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and winlog.user_data.Fqbn : \"-\"" + }, + "visualization": { + "color": "#DA8B45", + "layerId": "1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "layerType": "data", + "metricAccessor": "ae2dbf4a-708b-4a3f-97f6-100289a3dea4", + "secondaryMetricAccessor": "4432cd19-49a8-47ae-9906-d7ee1ad44b08" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "0cc6ad32-9b3a-49ea-80d2-2669c5de9dad", + "w": 12, + "x": 0, + "y": 7 + }, + "panelIndex": "0cc6ad32-9b3a-49ea-80d2-2669c5de9dad", + "title": "", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Blocked Un-Signed Applications (Hashes)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "file.hash.sha256" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8004\" or \"8007\") and winlog.user_data.Fqbn : \"-\"" + }, + "visualization": { + "color": "#E7664C", + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "metricAccessor": "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "secondaryMetricAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "5a1e344a-3eaf-4b85-9768-6d3e80aaeadd", + "w": 9, + "x": 12, + "y": 7 + }, + "panelIndex": "5a1e344a-3eaf-4b85-9768-6d3e80aaeadd", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Blocked Signed Applications (FQBN)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "file.hash.sha256" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8004\" or \"8007\") and not winlog.user_data.Fqbn : \"-\"" + }, + "visualization": { + "color": "#E57D68", + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "metricAccessor": "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "secondaryMetricAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "d4f4905e-9b44-4a43-b569-bcfaf2a8a76b", + "w": 9, + "x": 21, + "y": 7 + }, + "panelIndex": "d4f4905e-9b44-4a43-b569-bcfaf2a8a76b", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Audited Un-Signed Applications (Hashes)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "file.hash.sha256" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name: \"Microsoft-Windows-AppLocker\" and event.code: (\"8003\" or \"8006\" or \"8021\" or \"8022\" or \"8023\" or \"8024\" or \"8027\") and winlog.user_data.Fqbn : \"-\"" + }, + "visualization": { + "color": "#DA8B45", + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "metricAccessor": "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "secondaryMetricAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "9088ac60-da00-47de-9c8e-b7dba3f10022", + "w": 9, + "x": 30, + "y": 7 + }, + "panelIndex": "9088ac60-da00-47de-9c8e-b7dba3f10022", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "1d4fd8cb-2e11-481b-b660-e7aed1ed181d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Audited Signed Applications (FQBN)", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "file.hash.sha256" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8003\" or \"8006\" or \"8021\" or \"8022\" or \"8023\" or \"8024\" or \"8027\") and not winlog.user_data.Fqbn : \"-\"" + }, + "visualization": { + "color": "#D6BF57", + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "metricAccessor": "1d4fd8cb-2e11-481b-b660-e7aed1ed181d", + "secondaryMetricAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 7, + "i": "76f2968e-99a3-4fcb-a27f-b3226c027706", + "w": 9, + "x": 39, + "y": 7 + }, + "panelIndex": "76f2968e-99a3-4fcb-a27f-b3226c027706", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dc341b56-3c94-4928-bfd8-b68969d99e41", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dc341b56-3c94-4928-bfd8-b68969d99e41": { + "columnOrder": [ + "a9e661a1-588e-4b05-a04f-b34ed098a996", + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43" + ], + "columns": { + "a9e661a1-588e-4b05-a04f-b34ed098a996": { + "dataType": "string", + "isBucketed": true, + "label": "Top 5 values of winlog.user_data.PolicyName", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6c1f7b3-fedc-404c-b372-a04c6dc08a43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "winlog.user_data.PolicyName" + }, + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" " + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "emptySizeRatio": 0.7, + "layerId": "dc341b56-3c94-4928-bfd8-b68969d99e41", + "layerType": "data", + "legendDisplay": "hide", + "metrics": [ + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 0, + "primaryGroups": [ + "a9e661a1-588e-4b05-a04f-b34ed098a996" + ] + } + ], + "shape": "donut" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 19, + "i": "3a416904-9fb4-4429-ad20-2e339a698ff1", + "w": 12, + "x": 0, + "y": 14 + }, + "panelIndex": "3a416904-9fb4-4429-ad20-2e339a698ff1", + "title": "Policy Name", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "e8578036-36a9-434d-915f-962f02126a2b", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "e8578036-36a9-434d-915f-962f02126a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8004\" or \"8007\")" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "seriesType": "line", + "xAccessor": "e8578036-36a9-434d-915f-962f02126a2b", + "yConfig": [ + { + "color": "#bd0000", + "forAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "8bb16ed4-fe5e-4266-88c6-b3bb066b7d56", + "w": 18, + "x": 12, + "y": 14 + }, + "panelIndex": "8bb16ed4-fe5e-4266-88c6-b3bb066b7d56", + "title": "Blocked Application Executions by Unique Hosts Over Time", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "e8578036-36a9-434d-915f-962f02126a2b", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "e8578036-36a9-434d-915f-962f02126a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8003\" or \"8006\" or \"8021\" or \"8022\" or \"8023\" or \"8024\" or \"8027\") " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "seriesType": "line", + "xAccessor": "e8578036-36a9-434d-915f-962f02126a2b", + "yConfig": [ + { + "color": "#baae06", + "forAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "aa2ad1a9-6a58-459c-ac23-98581a02a7aa", + "w": 18, + "x": 30, + "y": 14 + }, + "panelIndex": "aa2ad1a9-6a58-459c-ac23-98581a02a7aa", + "title": "Audited Application Executions by Unique Hosts Over Time", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e", + "e8578036-36a9-434d-915f-962f02126a2b", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 50 values of user.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6b08403-4888-476e-97de-017ce38bf41c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Executions Blocked", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "e8578036-36a9-434d-915f-962f02126a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8004\" or \"8007\")" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "seriesType": "line", + "splitAccessor": "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e", + "xAccessor": "e8578036-36a9-434d-915f-962f02126a2b", + "yConfig": [ + { + "color": "#bd0000", + "forAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "line", + "showCurrentTimeMarker": false, + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "valuesInLegend": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "aae794a2-6173-4e71-b867-1c10efd9cfe0", + "w": 18, + "x": 12, + "y": 28 + }, + "panelIndex": "aae794a2-6173-4e71-b867-1c10efd9cfe0", + "title": "Blocked Application Executions by User Over Time", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "a41fb0c2-ca80-4fd9-901d-b08a41b931c9": { + "columnOrder": [ + "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e", + "e8578036-36a9-434d-915f-962f02126a2b", + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "columns": { + "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e": { + "dataType": "string", + "isBucketed": true, + "label": "Top 50 values of user.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6b08403-4888-476e-97de-017ce38bf41c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "b6b08403-4888-476e-97de-017ce38bf41c": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Executions Audited", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.name" + }, + "e8578036-36a9-434d-915f-962f02126a2b": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and event.code: (\"8003\" or \"8006\" or \"8021\" or \"8022\" or \"8023\" or \"8024\" or \"8027\") " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6b08403-4888-476e-97de-017ce38bf41c" + ], + "layerId": "a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "layerType": "data", + "seriesType": "line", + "splitAccessor": "b35ff6e6-5ca4-4771-b6f1-ca0d17dd5d2e", + "xAccessor": "e8578036-36a9-434d-915f-962f02126a2b", + "yConfig": [ + { + "color": "#bd0000", + "forAccessor": "b6b08403-4888-476e-97de-017ce38bf41c" + } + ] + } + ], + "legend": { + "isInside": false, + "isVisible": true, + "position": "left" + }, + "preferredSeriesType": "line", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 14, + "i": "c16de6c7-5a85-44b8-8689-6dfa81602068", + "w": 18, + "x": 30, + "y": 28 + }, + "panelIndex": "c16de6c7-5a85-44b8-8689-6dfa81602068", + "title": "Audited Application Executions by User Over Time", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-dc341b56-3c94-4928-bfd8-b68969d99e41", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "dc341b56-3c94-4928-bfd8-b68969d99e41": { + "columnOrder": [ + "a9e661a1-588e-4b05-a04f-b34ed098a996", + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43" + ], + "columns": { + "a9e661a1-588e-4b05-a04f-b34ed098a996": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of Rule Names", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "b6c1f7b3-fedc-404c-b372-a04c6dc08a43", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "winlog.user_data.RuleName" + }, + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" and not winlog.user_data.RuleName : \"-\"" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "b6c1f7b3-fedc-404c-b372-a04c6dc08a43" + ], + "layerId": "dc341b56-3c94-4928-bfd8-b68969d99e41", + "layerType": "data", + "seriesType": "bar_horizontal", + "xAccessor": "a9e661a1-588e-4b05-a04f-b34ed098a996", + "yConfig": [ + { + "color": "#9170b8", + "forAccessor": "b6c1f7b3-fedc-404c-b372-a04c6dc08a43" + } + ] + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "tickLabelsVisibilitySettings": { + "x": false, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 9, + "i": "fa8d5001-3a7a-46f7-b328-bb7373d48f0e", + "w": 12, + "x": 0, + "y": 33 + }, + "panelIndex": "fa8d5001-3a7a-46f7-b328-bb7373d48f0e", + "title": "Top Rule Names", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5b81f9ca-f395-4a2c-80a1-4c0967f560ba": { + "columnOrder": [ + "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5", + "cc5c2555-9367-48e2-8ba9-e72bd3808413", + "44a43798-070d-4c15-bc9e-0cd914580237" + ], + "columns": { + "44a43798-070d-4c15-bc9e-0cd914580237": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 25 values of event.code", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44a43798-070d-4c15-bc9e-0cd914580237", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 25 + }, + "scale": "ordinal", + "sourceField": "event.code" + }, + "cc5c2555-9367-48e2-8ba9-e72bd3808413": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": -90, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "44a43798-070d-4c15-bc9e-0cd914580237" + ], + "layerId": "5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5", + "xAccessor": "cc5c2555-9367-48e2-8ba9-e72bd3808413", + "yConfig": [] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0badf624-0fc8-425d-b0f9-e2610d327ff8", + "w": 24, + "x": 0, + "y": 42 + }, + "panelIndex": "0badf624-0fc8-425d-b0f9-e2610d327ff8", + "title": "Events Over Time by Event Type", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "5b81f9ca-f395-4a2c-80a1-4c0967f560ba": { + "columnOrder": [ + "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5", + "cc5c2555-9367-48e2-8ba9-e72bd3808413", + "44a43798-070d-4c15-bc9e-0cd914580237" + ], + "columns": { + "44a43798-070d-4c15-bc9e-0cd914580237": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5": { + "dataType": "string", + "isBucketed": true, + "label": "Top 25 values of user.name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "44a43798-070d-4c15-bc9e-0cd914580237", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 25 + }, + "scale": "ordinal", + "sourceField": "user.name" + }, + "cc5c2555-9367-48e2-8ba9-e72bd3808413": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": false, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "winlog.provider_name : \"Microsoft-Windows-AppLocker\" " + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": -90, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "44a43798-070d-4c15-bc9e-0cd914580237" + ], + "layerId": "5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "layerType": "data", + "position": "top", + "seriesType": "bar_stacked", + "showGridlines": false, + "splitAccessor": "8f7278c4-2a7a-4d89-9f0d-e62a73f529a5", + "xAccessor": "cc5c2555-9367-48e2-8ba9-e72bd3808413", + "yConfig": [] + } + ], + "legend": { + "isVisible": true, + "position": "bottom" + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "318ba902-dda2-4338-8ab1-de7d7dee9cf0", + "w": 24, + "x": 24, + "y": 42 + }, + "panelIndex": "318ba902-dda2-4338-8ab1-de7d7dee9cf0", + "title": "Events Over Time by User", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "712001e2-a1c9-4e83-bff5-46b0db4a0419": { + "columnOrder": [ + "704bbba5-c070-40aa-8196-52248047c7c3", + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "columns": { + "704bbba5-c070-40aa-8196-52248047c7c3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top 10 Organizations based on Publisher", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "file.x509.subject.organization" + }, + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "712001e2-a1c9-4e83-bff5-46b0db4a0419", + "layerType": "data", + "legendDisplay": "hide", + "metrics": [ + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "nestedLegend": false, + "numberDisplay": "value", + "percentDecimals": 1, + "primaryGroups": [ + "704bbba5-c070-40aa-8196-52248047c7c3" + ] + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "treemap" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "7bdcf792-c2c5-49e7-abd2-5dea57f6cd95", + "w": 24, + "x": 0, + "y": 57 + }, + "panelIndex": "7bdcf792-c2c5-49e7-abd2-5dea57f6cd95", + "title": "Top Organizations based on FQBN by Application Execution Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "712001e2-a1c9-4e83-bff5-46b0db4a0419": { + "columnOrder": [ + "704bbba5-c070-40aa-8196-52248047c7c3", + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "columns": { + "704bbba5-c070-40aa-8196-52248047c7c3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top 10 File Product Names", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "file.pe.product" + }, + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "layerId": "712001e2-a1c9-4e83-bff5-46b0db4a0419", + "layerType": "data", + "legendDisplay": "hide", + "metrics": [ + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "nestedLegend": false, + "numberDisplay": "value", + "percentDecimals": 1, + "primaryGroups": [ + "704bbba5-c070-40aa-8196-52248047c7c3" + ] + } + ], + "palette": { + "name": "default", + "type": "palette" + }, + "shape": "treemap" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "487dbe2e-2325-4532-bdb8-bf7885b3eb8e", + "w": 24, + "x": 24, + "y": 57 + }, + "panelIndex": "487dbe2e-2325-4532-bdb8-bf7885b3eb8e", + "title": "Top Product Names based on FQBN by Application Execution Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "712001e2-a1c9-4e83-bff5-46b0db4a0419": { + "columnOrder": [ + "704bbba5-c070-40aa-8196-52248047c7c3", + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "columns": { + "704bbba5-c070-40aa-8196-52248047c7c3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Top File Names", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 15 + }, + "scale": "ordinal", + "sourceField": "file.name" + }, + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique Hosts", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "host.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "704bbba5-c070-40aa-8196-52248047c7c3" + }, + { + "columnId": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + } + ], + "layerId": "712001e2-a1c9-4e83-bff5-46b0db4a0419", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "85de9f9b-f5ca-4934-bd4b-60b9e5bd4d4f", + "w": 24, + "x": 0, + "y": 72 + }, + "panelIndex": "85de9f9b-f5ca-4934-bd4b-60b9e5bd4d4f", + "title": "Top File Names by Application Execution Count", + "type": "lens", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 10, + "markdown": "### Windows AppLocker Event Codes\n\n|Event ID|Level|Event message|Description|\n|--|--|--|--|\n|8000|Error|Application Identity Policy conversion failed. Status *\u003c%1\u003e*|Indicates that the policy was not applied correctly to the computer. The status message is provided for troubleshooting purposes.|\n|8001|Information|The AppLocker policy was applied successfully to this computer.|Indicates that the AppLocker policy was successfully applied to the computer.|\n|8002|Information|*\u003cFile name\u003e * was allowed to run.|Specifies that the .exe or .dll file is allowed by an AppLocker rule.|\n|8003|Warning|*\u003cFile name\u003e * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.|Applied only when the **Audit only** enforcement mode is enabled. Specifies that the .exe or .dll file would be blocked if the **Enforce rules** enforcement mode were enabled.|\n|8004|Error|*\u003cFile name\u003e * was not allowed to run.|Access to _\u003cfile name\u003e_ is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The .exe or .dll file cannot run.|\n|8005|Information|*\u003cFile name\u003e * was allowed to run.|Specifies that the script or .msi file is allowed by an AppLocker rule.|\n|8006|Warning|*\u003cFile name\u003e * was allowed to run but would have been prevented from running if the AppLocker policy were enforced.|Applied only when the **Audit only** enforcement mode is enabled. Specifies that the script or .msi file would be blocked if the **Enforce rules** enforcement mode were enabled.|\n|8007|Error|*\u003cFile name\u003e * was not allowed to run.|Access to _\u003cfile name\u003e_ is restricted by the administrator. Applied only when the **Enforce rules** enforcement mode is set either directly or indirectly through Group Policy inheritance. The script or .msi file cannot run.|\n|8008|Error|AppLocker disabled on the SKU.|Added in Windows Server 2012 and Windows 8.|\n|8020|Information|Packaged app allowed.|Added in Windows Server 2012 and Windows 8.|\n|8021|Information|Packaged app audited.|Added in Windows Server 2012 and Windows 8.|\n|8022|Information|Packaged app audited.|Added in Windows Server 2012 and Windows 8.|\n|8023|Information|Packaged app audited.|Added in Windows Server 2012 and Windows 8.|\n|8024|Information|Packaged app audited.|Added in Windows Server 2012 and Windows 8.|\n|8025|Warning|Packaged app installation disabled.|Added in Windows Server 2012 and Windows 8.|\n|8027|Warning|Packaged app allowed.|Added in Windows Server 2012 and Windows 8.|\n|8028|Warning|* was allowed to run but would have been prevented if the Config CI policy was enforced.|Added in Windows Server 2016 and Windows 10.|\n|8029|Error|* was prevented from running due to Config CI policy.|Added in Windows Server 2016 and Windows 10.|\n|8030|Information|ManagedInstaller check SUCCEEDED during Appid verification of *|Added in Windows Server 2016 and Windows 10.|\n|8031|Information|SmartlockerFilter detected file * being written by process *|Added in Windows Server 2016 and Windows 10.|\n|8032|Error|ManagedInstaller check FAILED during Appid verification of *|Added in Windows Server 2016 and Windows 10.|\n|8033|Warning|ManagedInstaller check FAILED during Appid verification of * . Allowed to run due to Audit AppLocker Policy.|Added in Windows Server 2016 and Windows 10.|\n|8034|Information|ManagedInstaller Script check FAILED during Appid verification of *|Added in Windows Server 2016 and Windows 10.|\n|8035|Error|ManagedInstaller Script check SUCCEEDED during Appid verification of *|Added in Windows Server 2016 and Windows 10.|\n|8036|Error|* was prevented from running due to Config CI policy|Added in Windows Server 2016 and Windows 10.|\n|8037|Information|* passed Config CI policy and was allowed to run|Added in Windows Server 2016 and Windows 10.|\n|8038|Information|Publisher info: Subject: * Issuer: * Signature index * (* total)|Added in Windows Server 2016 and Windows 10.|\n|8039|Warning|* passed Config CI policy and was allowed to run|Added in Windows Server 2016 and Windows 10.|\n|8040|Error|Package family name * version * was prevented from installing or updating due to Config CI policy|Added in Windows Server 2016 and Windows 10.|\n\n[Link to Documentation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker)", + "openLinksInNewTab": true + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 50, + "i": "557cee8b-3715-470d-8556-8394712f695a", + "w": 48, + "x": 0, + "y": 87 + }, + "panelIndex": "557cee8b-3715-470d-8556-8394712f695a", + "type": "visualization", + "version": "8.7.1" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "712001e2-a1c9-4e83-bff5-46b0db4a0419": { + "columnOrder": [ + "704bbba5-c070-40aa-8196-52248047c7c3", + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + ], + "columns": { + "704bbba5-c070-40aa-8196-52248047c7c3": { + "dataType": "string", + "isBucketed": true, + "label": "Top 10 values of file.x509.subject.country", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "file.x509.subject.country" + }, + "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "emsField": "iso2", + "emsLayerId": "world_countries", + "layerId": "712001e2-a1c9-4e83-bff5-46b0db4a0419", + "regionAccessor": "704bbba5-c070-40aa-8196-52248047c7c3", + "valueAccessor": "c1e860f2-b7b1-442f-8cf7-c90cb9bdce6a" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsChoropleth" + }, + "enhancements": {}, + "hidePanelTitles": false + }, + "gridData": { + "h": 15, + "i": "0e5983ed-29cc-4a73-ba69-f888da5a23b3", + "w": 24, + "x": 24, + "y": 72 + }, + "panelIndex": "0e5983ed-29cc-4a73-ba69-f888da5a23b3", + "title": "File Publisher Countries based on FQBN by Application Execution Count", + "type": "lens", + "version": "8.7.1" + } + ], + "timeRestore": false, + "title": "[Windows AppLocker] Audited and Blocked Applications", + "version": 1 + }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-08-06T00:43:57.366Z", + "id": "windows-b28aaad0-2f2d-11ee-acdc-45d0efa0889d", + "migrationVersion": { + "dashboard": "8.7.0" + }, + "references": [ + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "237e1e12-7a84-4c62-bfe6-303fd6d99667:indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "cb4b0cdb-9b4f-4b4d-9481-8cd766926590:indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0cc6ad32-9b3a-49ea-80d2-2669c5de9dad:indexpattern-datasource-layer-1ba1f39a-5a90-4ab5-ad2d-a8a4762395e7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "5a1e344a-3eaf-4b85-9768-6d3e80aaeadd:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "d4f4905e-9b44-4a43-b569-bcfaf2a8a76b:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9088ac60-da00-47de-9c8e-b7dba3f10022:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "76f2968e-99a3-4fcb-a27f-b3226c027706:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "3a416904-9fb4-4429-ad20-2e339a698ff1:indexpattern-datasource-layer-dc341b56-3c94-4928-bfd8-b68969d99e41", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "8bb16ed4-fe5e-4266-88c6-b3bb066b7d56:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aa2ad1a9-6a58-459c-ac23-98581a02a7aa:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "aae794a2-6173-4e71-b867-1c10efd9cfe0:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "c16de6c7-5a85-44b8-8689-6dfa81602068:indexpattern-datasource-layer-a41fb0c2-ca80-4fd9-901d-b08a41b931c9", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "fa8d5001-3a7a-46f7-b328-bb7373d48f0e:indexpattern-datasource-layer-dc341b56-3c94-4928-bfd8-b68969d99e41", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0badf624-0fc8-425d-b0f9-e2610d327ff8:indexpattern-datasource-layer-5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "318ba902-dda2-4338-8ab1-de7d7dee9cf0:indexpattern-datasource-layer-5b81f9ca-f395-4a2c-80a1-4c0967f560ba", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "7bdcf792-c2c5-49e7-abd2-5dea57f6cd95:indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "487dbe2e-2325-4532-bdb8-bf7885b3eb8e:indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "85de9f9b-f5ca-4934-bd4b-60b9e5bd4d4f:indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0e5983ed-29cc-4a73-ba69-f888da5a23b3:indexpattern-datasource-layer-712001e2-a1c9-4e83-bff5-46b0db4a0419", + "type": "index-pattern" + } + ], + "type": "dashboard" +} \ No newline at end of file diff --git a/packages/windows/manifest.yml b/packages/windows/manifest.yml index 31f12cc8a6d..ee0aba85b18 100644 --- a/packages/windows/manifest.yml +++ b/packages/windows/manifest.yml @@ -1,6 +1,6 @@ name: windows title: Windows -version: 1.24.0 +version: 1.37.0 description: Collect logs and metrics from Windows OS and services with Elastic Agent. type: integration categories: @@ -15,12 +15,16 @@ format_version: 1.0.0 license: basic release: ga conditions: - kibana.version: "^8.7.1" + kibana.version: "^8.8.0" screenshots: - src: /img/metricbeat-windows-service.png title: metricbeat windows service size: 3142x1834 type: image/png + - src: /img/applocker-windows-audit-and-blocked.png + title: applocker audited and blocked events + size: 3040x2960 + type: image/png policy_templates: - name: windows title: Windows logs and metrics diff --git a/packages/winlog/_dev/build/build.yml b/packages/winlog/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/winlog/_dev/build/build.yml +++ b/packages/winlog/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/winlog/changelog.yml b/packages/winlog/changelog.yml index 10db20f5e7f..359b2b72be6 100644 --- a/packages/winlog/changelog.yml +++ b/packages/winlog/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.19.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.18.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.17.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.16.0" changes: - description: Update package to ECS 8.8.0. diff --git a/packages/winlog/docs/README.md b/packages/winlog/docs/README.md index ae78ea8bc32..b6140e9af90 100644 --- a/packages/winlog/docs/README.md +++ b/packages/winlog/docs/README.md @@ -73,7 +73,7 @@ the events from Windows. The filter shown below is equivalent to | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.code | Error code describing the error. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | keyword | | event.module | Event module | constant_keyword | | host.architecture | Operating system architecture. | keyword | diff --git a/packages/winlog/kibana/tags.yml b/packages/winlog/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/winlog/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/winlog/manifest.yml b/packages/winlog/manifest.yml index 818515e49da..c9e8f244294 100644 --- a/packages/winlog/manifest.yml +++ b/packages/winlog/manifest.yml @@ -1,11 +1,12 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: winlog title: Custom Windows Event Logs description: Collect and parse logs from any Windows event log channel with Elastic Agent. type: integration -version: "1.16.0" +version: "1.19.0" conditions: - kibana.version: '^8.7.1' + kibana: + version: '^8.7.1' categories: - custom - os_system @@ -89,3 +90,4 @@ icons: type: "image/svg+xml" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/zeek/_dev/build/build.yml b/packages/zeek/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/zeek/_dev/build/build.yml +++ b/packages/zeek/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/zeek/changelog.yml b/packages/zeek/changelog.yml index 03c99344efa..5a8e2983274 100644 --- a/packages/zeek/changelog.yml +++ b/packages/zeek/changelog.yml @@ -1,4 +1,55 @@ # newer versions go on top +- version: 2.16.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.14.1" + changes: + - description: Fix template snippet escaping. + type: bugfix + link: https://github.com/elastic/integrations/pull/7640 + - description: Fix `event.type` for error in sip data stream. + type: bugfix + link: https://github.com/elastic/integrations/pull/7640 +- version: "2.14.0" + changes: + - description: Update package-spec to 2.10.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7603 +- version: "2.13.0" + changes: + - description: Add support for HTTP request tracing. + type: enhancement + link: https://github.com/elastic/integrations/pull/7336 +- version: "2.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "2.11.2" + changes: + - description: Add missing processors support for dhcp and smb_mapping logs. + type: bugfix + link: https://github.com/elastic/integrations/pull/7154 + - description: Fix documentation link for processors. + type: bugfix + link: https://github.com/elastic/integrations/pull/7154 +- version: "2.11.1" + changes: + - description: Fix handling of zeek HTTP host when the URI contains a domain. + type: bugfix + link: https://github.com/elastic/integrations/pull/6959 +- version: "2.11.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6888 - version: "2.10.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json b/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json index a969bce59af..00b7e779357 100644 --- a/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json +++ b/packages/zeek/data_stream/capture_loss/_dev/test/pipeline/test-capture-loss.log-expected.json @@ -3,13 +3,15 @@ { "@timestamp": "2019-09-10T16:19:28.465Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1568132368.465338,\"ts_delta\":32.282249,\"peer\":\"bro\",\"gaps\":0,\"acks\":206,\"percent_lost\":0.0}", - "type": "info" + "type": [ + "info" + ] }, "tags": [ "preserve_original_event" @@ -27,13 +29,15 @@ { "@timestamp": "2021-03-30T00:04:00.941Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1617062640.941952,\"ts_delta\":900.0005369186401,\"peer\":\"zeek\",\"gaps\":58475,\"acks\":65665,\"percent_lost\":89.05048351481003}", - "type": "info" + "type": [ + "info" + ] }, "tags": [ "preserve_original_event" @@ -51,13 +55,15 @@ { "@timestamp": "2021-03-30T00:19:00.942Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1617063540.942231,\"ts_delta\":900.0002789497376,\"peer\":\"zeek\",\"gaps\":54754,\"acks\":61818,\"percent_lost\":88.5729075673752}", - "type": "info" + "type": [ + "info" + ] }, "tags": [ "preserve_original_event" @@ -75,13 +81,15 @@ { "@timestamp": "2021-03-30T00:34:00.942Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1617064440.942597,\"ts_delta\":900.0003659725189,\"peer\":\"zeek\",\"gaps\":51022,\"acks\":57974,\"percent_lost\":88.00841756649533}", - "type": "info" + "type": [ + "info" + ] }, "tags": [ "preserve_original_event" @@ -99,13 +107,15 @@ { "@timestamp": "2021-03-30T00:49:00.942Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1617065340.942651,\"ts_delta\":900.0000541210175,\"peer\":\"zeek\",\"gaps\":55105,\"acks\":62497,\"percent_lost\":88.17223226714883}", - "type": "info" + "type": [ + "info" + ] }, "tags": [ "preserve_original_event" @@ -123,13 +133,15 @@ { "@timestamp": "2019-09-10T16:19:28.465Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", "kind": "metric", "original": "{\"ts\":1568132368.465338,\"ts_delta\":32.282249,\"peer\":\"bro\",\"gaps\":0,\"acks\":206,\"percent_lost\":0.0}", - "type": "info" + "type": [ + "info" + ] }, "host": { "name": "Lees-MBP.localdomain" diff --git a/packages/zeek/data_stream/capture_loss/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/capture_loss/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/capture_loss/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/capture_loss/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml index 540ac35d8ba..b31ff43692c 100644 --- a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/default.yml @@ -23,7 +23,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - date: field: zeek.capture_loss.ts formats: @@ -34,7 +34,7 @@ processors: value: metric - set: field: event.type - value: info + value: [info] - convert: field: zeek.percent_lost type: long @@ -45,7 +45,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/capture_loss/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/capture_loss/manifest.yml b/packages/zeek/data_stream/capture_loss/manifest.yml index db5171babd1..e0a672baae8 100644 --- a/packages/zeek/data_stream/capture_loss/manifest.yml +++ b/packages/zeek/data_stream/capture_loss/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek capture_loss.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/capture_loss/sample_event.json b/packages/zeek/data_stream/capture_loss/sample_event.json index de7c975d2b7..95b18c05440 100644 --- a/packages/zeek/data_stream/capture_loss/sample_event.json +++ b/packages/zeek/data_stream/capture_loss/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2019-09-10T16:19:28.465Z", "agent": { - "ephemeral_id": "8c254185-7ed2-4b0a-af78-e371166897c9", - "id": "df514182-bb0b-40b5-96d1-14197e409254", + "ephemeral_id": "03b335bd-a3a4-46d6-9e28-409e912b33a1", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.1.0" + "version": "8.7.1" }, "data_stream": { "dataset": "zeek.capture_loss", @@ -13,31 +13,37 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "df514182-bb0b-40b5-96d1-14197e409254", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", "snapshot": false, - "version": "8.1.0" + "version": "8.7.1" }, "event": { "agent_id_status": "verified", - "created": "2022-11-23T07:59:28.651Z", + "created": "2023-09-03T22:00:07.863Z", "dataset": "zeek.capture_loss", - "ingested": "2022-11-23T07:59:32Z", + "ingested": "2023-09-03T22:00:08Z", "kind": "metric", - "type": "info" + "original": "{\"ts\":1568132368.465338,\"ts_delta\":32.282249,\"peer\":\"bro\",\"gaps\":0,\"acks\":206,\"percent_lost\":0.0}", + "type": [ + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" }, "input": { - "type": "log" + "type": "httpjson" }, "log": { "file": { - "path": "/tmp/service_logs/capture_loss.log" - }, - "offset": 0 + "path": "/usr/local/var/log/httpd/access_log" + } }, "tags": [ + "preserve_original_event", "forwarded", "zeek-capture-loss" ], diff --git a/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json b/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json index 48264b66b07..4d0bf5879f5 100644 --- a/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json +++ b/packages/zeek/data_stream/connection/_dev/test/pipeline/test-conn.log-expected.json @@ -10,10 +10,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 76967000, "id": "CAcJw21BbVedgFnYH3", @@ -91,10 +93,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 76967000, "id": "CAcJw21BbVedgFnYH4", @@ -172,10 +176,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 76967000, "id": "CAcJw21BbVedgFnYH5", @@ -269,10 +275,12 @@ "packets": 0 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "Cc6NJ3GRlfjE44I3h", "kind": "event", @@ -349,10 +357,12 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "CCicIg43lOtCQOxXnb", "kind": "event", @@ -427,10 +437,12 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 103708982, "id": "C52mXBCPJ4pPGkhr1", @@ -506,10 +518,12 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 104128838, "id": "CTzCky2CyLT5JJvHck", @@ -585,10 +599,12 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 104333878, "id": "CIkS28PDxqQnN49m2", @@ -646,10 +662,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 26802063, "id": "CezEGe4jeLNkayV976", @@ -708,10 +726,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 25056124, "id": "CKSr3w18mmW6t7bXC4", @@ -770,10 +790,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 3319979, "id": "CGUiHy4kLIF2ml95eg", @@ -832,10 +854,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 1111984, "id": "CAOZZi4Qrio7gUVgVc", @@ -894,10 +918,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 908852, "id": "Chx5fs3xQ5ALB72i4e", @@ -956,10 +982,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "C3pPjh1YRYcVDiZD3", "kind": "event", @@ -1016,10 +1044,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "ChUxTmYLG37oO5qUb", "kind": "event", @@ -1076,10 +1106,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "CpeAOT3B11CTXJgzw2", "kind": "event", @@ -1154,10 +1186,12 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "duration": 76967000, "id": "CAcJw21BbVedgFnYH5", @@ -1242,10 +1276,12 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "C2KP1V3alRLoxl4JB9", "kind": "event", diff --git a/packages/zeek/data_stream/connection/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/connection/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/connection/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/connection/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml index 2b770f9c4f0..888adb3a884 100644 --- a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/default.yml @@ -24,13 +24,13 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event - set: field: event.category - value: network + value: [network] - dot_expander: path: zeek.connection field: id.orig_p @@ -111,26 +111,26 @@ processors: field: source.port target_field: zeek.connection.icmp.type ignore_missing: true - if: 'ctx?.network?.transport == "icmp"' + if: 'ctx.network?.transport == "icmp"' - rename: field: destination.port target_field: zeek.connection.icmp.code ignore_missing: true - if: 'ctx?.network?.transport == "icmp"' + if: 'ctx.network?.transport == "icmp"' - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - community_id: - if: 'ctx?.network?.transport != "icmp"' + if: 'ctx.network?.transport != "icmp"' - community_id: icmp_type: zeek.connection.icmp.type icmp_code: zeek.connection.icmp.code - if: 'ctx?.network?.transport == "icmp"' + if: 'ctx.network?.transport == "icmp"' - date: field: zeek.connection.ts formats: @@ -151,23 +151,23 @@ processors: field: tags value: - local_orig - if: ctx?.zeek?.connection?.local_orig != null + if: ctx.zeek?.connection?.local_orig != null allow_duplicates: false - append: field: tags value: - local_resp - if: ctx?.zeek?.connection?.local_resp != null + if: ctx.zeek?.connection?.local_resp != null allow_duplicates: false - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.ip != null + value: "{{{source.ip}}}" + if: ctx.source?.ip != null allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - script: source: ctx.network.packets = ctx.source.packets + ctx.destination.packets @@ -177,8 +177,8 @@ processors: ignore_failure: true - script: source: |- - if (ctx?.zeek?.connection?.local_orig == null || - ctx?.zeek?.connection?.local_resp == null) { + if (ctx.zeek?.connection?.local_orig == null || + ctx.zeek?.connection?.local_resp == null) { return; } if (ctx.zeek.connection.local_orig == true && @@ -204,11 +204,11 @@ processors: - geoip: field: destination.ip target_field: destination.geo - if: ctx?.destination?.ip != null + if: ctx.destination?.ip != null - geoip: field: source.ip target_field: source.geo - if: ctx?.source?.ip != null + if: ctx.source?.ip != null - geoip: database_file: GeoLite2-ASN.mmdb field: source.ip @@ -311,7 +311,7 @@ processors: - connection - info source: >- - if (ctx?.zeek?.connection?.state == null) { + if (ctx.zeek?.connection?.state == null) { return; } if (params.containsKey(ctx.zeek.connection.state)) { @@ -330,7 +330,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/connection/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/connection/manifest.yml b/packages/zeek/data_stream/connection/manifest.yml index 088dc55b555..d55276dcedb 100644 --- a/packages/zeek/data_stream/connection/manifest.yml +++ b/packages/zeek/data_stream/connection/manifest.yml @@ -38,7 +38,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. - input: httpjson title: Zeek connection logs via Splunk Enterprise REST API @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/connection/sample_event.json b/packages/zeek/data_stream/connection/sample_event.json new file mode 100644 index 00000000000..81787f0c186 --- /dev/null +++ b/packages/zeek/data_stream/connection/sample_event.json @@ -0,0 +1,98 @@ +{ + "@timestamp": "2019-01-11T06:33:37.857Z", + "agent": { + "ephemeral_id": "b97a38d1-a197-41e9-a586-1e0ee73ea0d7", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.connection", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "8.8.8.8", + "bytes": 206, + "ip": "8.8.8.8", + "packets": 1, + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:01:30.181Z", + "dataset": "zeek.connection", + "duration": 76967000, + "id": "CAcJw21BbVedgFnYH5", + "ingested": "2023-09-03T22:01:31Z", + "kind": "event", + "original": "{\"ts\":1547188417.857497,\"uid\":\"CAcJw21BbVedgFnYH5\",\"id.orig_h\":\"4.4.2.2\",\"id.orig_p\":38334,\"id.resp_h\":\"8.8.8.8\",\"id.resp_p\":53,\"proto\":\"udp\",\"service\":\"dns\",\"duration\":0.076967,\"orig_bytes\":75,\"resp_bytes\":178,\"conn_state\":\"SF\",\"local_orig\":false,\"local_resp\":false,\"missed_bytes\":0,\"history\":\"Dd\",\"orig_pkts\":1,\"orig_ip_bytes\":103,\"resp_pkts\":1,\"resp_ip_bytes\":206,\"tunnel_parents\":[]}", + "type": [ + "connection", + "start", + "end" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/httpd/access_log" + } + }, + "network": { + "bytes": 309, + "community_id": "1:hWC6cnCoeyQehzquxJQU6Y3Wm3g=", + "direction": "external", + "packets": 2, + "protocol": "dns", + "transport": "udp" + }, + "related": { + "ip": [ + "4.4.2.2", + "8.8.8.8" + ] + }, + "source": { + "address": "4.4.2.2", + "bytes": 103, + "ip": "4.4.2.2", + "packets": 1, + "port": 38334 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-connection", + "local_orig", + "local_resp" + ], + "zeek": { + "connection": { + "history": "Dd", + "local_orig": false, + "local_resp": false, + "missed_bytes": 0, + "state": "SF", + "state_message": "Normal establishment and termination." + }, + "session_id": "CAcJw21BbVedgFnYH5" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json b/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json index 73fe8655030..3aae028e8fb 100644 --- a/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json +++ b/packages/zeek/data_stream/dce_rpc/_dev/test/pipeline/test-dce-rpc.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BrowserrQueryOtherDomains", @@ -62,7 +62,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "BrowserrQueryOtherDomains", diff --git a/packages/zeek/data_stream/dce_rpc/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/dce_rpc/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/dce_rpc/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/dce_rpc/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml index 3a63468544f..c9f0331a84a 100644 --- a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,11 +88,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.dce_rpc.ts formats: @@ -102,8 +102,8 @@ processors: field: zeek.dce_rpc.ts - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.ip != null + value: "{{{source.ip}}}" + if: ctx.source?.ip != null allow_duplicates: false - geoip: field: source.ip @@ -126,8 +126,8 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - geoip: field: destination.ip @@ -151,7 +151,7 @@ processors: - set: field: event.action copy_from: zeek.dce_rpc.operation - if: "ctx?.zeek?.dce_rpc?.operation != null" + if: "ctx.zeek?.dce_rpc?.operation != null" - community_id: target_field: network.community_id - remove: @@ -160,7 +160,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/dce_rpc/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/dce_rpc/manifest.yml b/packages/zeek/data_stream/dce_rpc/manifest.yml index 5db353cc78c..14188ff377e 100644 --- a/packages/zeek/data_stream/dce_rpc/manifest.yml +++ b/packages/zeek/data_stream/dce_rpc/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek dce_rpc.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/dce_rpc/sample_event.json b/packages/zeek/data_stream/dce_rpc/sample_event.json new file mode 100644 index 00000000000..c96f6c74a25 --- /dev/null +++ b/packages/zeek/data_stream/dce_rpc/sample_event.json @@ -0,0 +1,87 @@ +{ + "@timestamp": "2013-02-26T22:05:32.298Z", + "agent": { + "ephemeral_id": "c71e7e33-f338-4c49-aff0-996fa88653bb", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.dce_rpc", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "172.16.128.202", + "ip": "172.16.128.202", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "BrowserrQueryOtherDomains", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:02:56.380Z", + "dataset": "zeek.dce_rpc", + "id": "CsNHVHa1lzFtvJzT8", + "ingested": "2023-09-03T22:03:00Z", + "kind": "event", + "original": "{\"ts\":1361916332.298338,\"uid\":\"CsNHVHa1lzFtvJzT8\",\"id.orig_h\":\"172.16.133.6\",\"id.orig_p\":1728,\"id.resp_h\":\"172.16.128.202\",\"id.resp_p\":445,\"rtt\":0.09211,\"named_pipe\":\"\\u005cPIPE\\u005cbrowser\",\"endpoint\":\"browser\",\"operation\":\"BrowserrQueryOtherDomains\"}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dce_rpc.log" + } + }, + "network": { + "community_id": "1:SJNAD5vtzZuhQjGtfaI8svTnyuw=", + "protocol": "dce_rpc", + "transport": "tcp" + }, + "related": { + "ip": [ + "172.16.133.6", + "172.16.128.202" + ] + }, + "source": { + "address": "172.16.133.6", + "ip": "172.16.133.6", + "port": 1728 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-dce-rpc" + ], + "zeek": { + "dce_rpc": { + "endpoint": "browser", + "named_pipe": "\\PIPE\\browser", + "operation": "BrowserrQueryOtherDomains", + "rtt": 0.09211 + }, + "session_id": "CsNHVHa1lzFtvJzT8" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json b/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json index 8c94993847c..36cdca5575f 100644 --- a/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json +++ b/packages/zeek/data_stream/dhcp/_dev/test/pipeline/test-dhcp.log-expected.json @@ -11,7 +11,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -91,7 +91,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -165,7 +165,7 @@ "port": 67 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/dhcp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/dhcp/agent/stream/httpjson.yml.hbs index a12f9a58758..88463f835c6 100644 --- a/packages/zeek/data_stream/dhcp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/dhcp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml index caef140cc3f..f30c67ac9cd 100644 --- a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/default.yml @@ -23,7 +23,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -120,15 +120,15 @@ processors: - set: field: network.name copy_from: zeek.dhcp.domain - if: ctx?.zeek?.dhcp?.domain != null + if: ctx.zeek?.dhcp?.domain != null - set: field: source.port value: 68 - if: ctx?.source?.port == null + if: ctx.source?.port == null - set: field: destination.port value: 67 - if: ctx?.destination?.port == null + if: ctx.destination?.port == null - set: field: source.address copy_from: zeek.dhcp.address.client @@ -166,19 +166,19 @@ processors: if: ctx.zeek.session_id != null - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/dhcp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/dhcp/manifest.yml b/packages/zeek/data_stream/dhcp/manifest.yml index 78f6d098b1e..1db1df4550d 100644 --- a/packages/zeek/data_stream/dhcp/manifest.yml +++ b/packages/zeek/data_stream/dhcp/manifest.yml @@ -20,6 +20,15 @@ streams: default: - forwarded - zeek-dhcp + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: log.yml.hbs title: Zeek dhcp.log description: Collect Zeek dhcp logs @@ -50,3 +59,12 @@ streams: default: - forwarded - zeek-dhcp + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + diff --git a/packages/zeek/data_stream/dhcp/sample_event.json b/packages/zeek/data_stream/dhcp/sample_event.json new file mode 100644 index 00000000000..7768d477aa6 --- /dev/null +++ b/packages/zeek/data_stream/dhcp/sample_event.json @@ -0,0 +1,111 @@ +{ + "@timestamp": "2016-10-16T08:11:38.771Z", + "agent": { + "ephemeral_id": "a88799dc-da51-47fd-b79a-016371a2bf6f", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "client": { + "address": "192.168.199.132" + }, + "data_stream": { + "dataset": "zeek.dhcp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.199.254", + "ip": "192.168.199.254", + "port": 67 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:04:22.449Z", + "dataset": "zeek.dhcp", + "id": [ + "CmWOt6VWaNGqXYcH6", + "CLObLo4YHn0u23Tp8a" + ], + "ingested": "2023-09-03T22:04:26Z", + "kind": "event", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dhcp.log" + } + }, + "network": { + "community_id": "1:HsGjbon+HsK9xnMq+1A32BR9C4Y=", + "name": "localdomain", + "protocol": "dhcp", + "transport": "udp" + }, + "related": { + "ip": [ + "192.168.199.132", + "192.168.199.254" + ] + }, + "server": { + "address": "192.168.199.254" + }, + "source": { + "address": "192.168.199.132", + "ip": "192.168.199.132", + "port": 68 + }, + "tags": [ + "forwarded", + "zeek-dhcp" + ], + "zeek": { + "dhcp": { + "address": { + "assigned": "192.168.199.132", + "client": "192.168.199.132", + "mac": "00:0c:29:03:df:ad", + "requested": "192.168.199.132", + "server": "192.168.199.254" + }, + "client_fqdn": "DESKTOP-2AEFM7G", + "domain": "localdomain", + "duration": 0.000161, + "hostname": "DESKTOP-2AEFM7G", + "lease_time": 1800, + "msg": { + "types": [ + "REQUEST", + "ACK" + ] + } + }, + "session_id": [ + "CmWOt6VWaNGqXYcH6", + "CLObLo4YHn0u23Tp8a" + ] + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json b/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json index 2c13a1b8022..d9f95e9f745 100644 --- a/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json +++ b/packages/zeek/data_stream/dnp3/_dev/test/pipeline/test-dnp3.log-expected.json @@ -8,7 +8,7 @@ "port": 20000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", @@ -60,7 +60,7 @@ "port": 20000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "read", diff --git a/packages/zeek/data_stream/dnp3/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/dnp3/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/dnp3/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/dnp3/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml index dd9a903974b..c7c6871374e 100644 --- a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,11 +88,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.dnp3.fc_request target_field: zeek.dnp3.function.request @@ -115,11 +115,11 @@ processors: - set: field: event.action copy_from: zeek.dnp3.function.request - if: "ctx?.zeek?.dnp3?.function?.request != null" + if: "ctx.zeek?.dnp3?.function?.request != null" - set: field: event.action copy_from: zeek.dnp3.function.reply - if: "ctx?.zeek?.dnp3?.function?.reply != null" + if: "ctx.zeek?.dnp3?.function?.reply != null" - lowercase: field: event.action ignore_missing: true @@ -163,13 +163,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.ip != null + value: "{{{source.ip}}}" + if: ctx.source?.ip != null allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - community_id: target_field: network.community_id @@ -179,7 +179,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/dnp3/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/dnp3/manifest.yml b/packages/zeek/data_stream/dnp3/manifest.yml index 58fc30a9267..271a3e56815 100644 --- a/packages/zeek/data_stream/dnp3/manifest.yml +++ b/packages/zeek/data_stream/dnp3/manifest.yml @@ -34,7 +34,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek dnp3.log @@ -81,4 +81,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/dnp3/sample_event.json b/packages/zeek/data_stream/dnp3/sample_event.json new file mode 100644 index 00000000000..bc141c625ea --- /dev/null +++ b/packages/zeek/data_stream/dnp3/sample_event.json @@ -0,0 +1,85 @@ +{ + "@timestamp": "2008-11-26T20:05:08.705Z", + "agent": { + "ephemeral_id": "cdbb81a1-e260-48fe-bd86-c37fc7c644b3", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.dnp3", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 20000 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "read", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:05:51.541Z", + "dataset": "zeek.dnp3", + "id": "CQV6tj1w1t4WzQpHoe", + "ingested": "2023-09-03T22:05:55Z", + "kind": "event", + "original": "{\"ts\":1227729908.705944,\"uid\":\"CQV6tj1w1t4WzQpHoe\",\"id.orig_h\":\"127.0.0.1\",\"id.orig_p\":42942,\"id.resp_h\":\"127.0.0.1\",\"id.resp_p\":20000,\"fc_request\":\"READ\"}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dhcp.log" + } + }, + "network": { + "community_id": "1:E57Z1w3RrSdR+fi6rSZblbQVhzY=", + "protocol": "dnp3", + "transport": "tcp" + }, + "related": { + "ip": [ + "127.0.0.1" + ] + }, + "source": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 42942 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-dnp3" + ], + "zeek": { + "dnp3": { + "function": { + "request": "READ" + } + }, + "session_id": "CQV6tj1w1t4WzQpHoe" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json b/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json index 4197c22f04b..6132798e9ad 100644 --- a/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/zeek/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json @@ -42,7 +42,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -125,7 +125,7 @@ "type": "query" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -201,7 +201,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -297,7 +297,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -395,7 +395,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -534,7 +534,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -650,7 +650,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -734,7 +734,7 @@ "type": "answer" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/dns/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/dns/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/dns/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/dns/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index 85548839561..0320c6fb175 100644 --- a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -97,52 +97,52 @@ processors: - append: field: dns.header_flags value: AA - if: ctx?.zeek?.dns?.AA == true + if: ctx.zeek?.dns?.AA == true - append: field: dns.header_flags value: TC - if: ctx?.zeek?.dns?.TC == true + if: ctx.zeek?.dns?.TC == true - append: field: dns.header_flags value: RD - if: ctx?.zeek?.dns?.RD == true + if: ctx.zeek?.dns?.RD == true - append: field: dns.header_flags value: RA - if: ctx?.zeek?.dns?.RA == true + if: ctx.zeek?.dns?.RA == true - set: field: dns.question.class value: IN - if: ctx?.zeek?.dns?.qclass == 1 + if: ctx.zeek?.dns?.qclass == 1 - set: field: dns.question.class value: CH - if: ctx?.zeek?.dns?.qclass == 3 + if: ctx.zeek?.dns?.qclass == 3 - set: field: dns.question.class value: HS - if: ctx?.zeek?.dns?.qclass == 4 + if: ctx.zeek?.dns?.qclass == 4 - set: field: dns.question.class value: NONE - if: ctx?.zeek?.dns?.qclass == 254 + if: ctx.zeek?.dns?.qclass == 254 - set: field: dns.question.class value: ANY - if: ctx?.zeek?.dns?.qclass == 255 + if: ctx.zeek?.dns?.qclass == 255 - set: field: dns.type value: answer - if: ctx?.zeek?.dns?.rcode_name != null + if: ctx.zeek?.dns?.rcode_name != null - set: field: dns.type value: query - if: ctx?.dns?.type == null + if: ctx.dns?.type == null - script: lang: painless source: >- ctx.event.duration = ctx.zeek.dns.rtt * 1000000000L; - if: "ctx?.zeek?.dns?.rtt != null" + if: "ctx.zeek?.dns?.rtt != null" - script: lang: painless source: >- @@ -158,11 +158,11 @@ processors: "ttl": (int)ttls[i] ]) } - if (ctx?.dns == null) { + if (ctx.dns == null) { ctx.dns = new HashMap(); } ctx.dns.answers = lst; - if: "ctx?.zeek?.dns?.answers != null && ctx?.zeek?.dns?.TTLs != null" + if: "ctx.zeek?.dns?.answers != null && ctx.zeek?.dns?.TTLs != null" - foreach: field: dns.answers processor: @@ -172,7 +172,7 @@ processors: type: ip ignore_failure: true ignore_missing: true - if: 'ctx?.dns?.answers != null && !ctx?.dns?.answers.isEmpty()' + if: 'ctx.dns?.answers != null && !ctx.dns?.answers.isEmpty()' - script: lang: painless source: >- @@ -185,15 +185,15 @@ processors: } } ctx.dns.resolved_ip = iplist; - if: 'ctx?.dns?.answers != null && !ctx?.dns?.answers.isEmpty()' + if: 'ctx.dns?.answers != null && !ctx.dns?.answers.isEmpty()' - set: field: event.outcome value: success - if: ctx?.dns?.rcode == 0 + if: ctx.dns?.rcode == 0 - set: field: event.outcome value: success - if: ctx?.event?.outcome == null + if: ctx.event?.outcome == null - convert: field: zeek.dns.trans_id type: string @@ -273,19 +273,19 @@ processors: target_field: network.community_id - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.address != null + value: "{{{source.ip}}}" + if: ctx.source?.address != null allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - rename: field: message target_field: event.original ignore_missing: true - if: ctx?.event?.original == null + if: ctx.event?.original == null - remove: field: - zeek.dns.Z @@ -295,7 +295,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/dns/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/dns/manifest.yml b/packages/zeek/data_stream/dns/manifest.yml index d655e5a773a..3a14f3c39dc 100644 --- a/packages/zeek/data_stream/dns/manifest.yml +++ b/packages/zeek/data_stream/dns/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek dns.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/dns/sample_event.json b/packages/zeek/data_stream/dns/sample_event.json new file mode 100644 index 00000000000..1ee6a5bd916 --- /dev/null +++ b/packages/zeek/data_stream/dns/sample_event.json @@ -0,0 +1,113 @@ +{ + "@timestamp": "2019-08-29T16:23:50.734Z", + "agent": { + "ephemeral_id": "9e627c0e-1167-43e6-8305-c3fe0118599a", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.dns", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "224.0.0.251", + "ip": "224.0.0.251", + "port": 5353 + }, + "dns": { + "answers": [ + { + "data": "bravia-4k-gb-5c89f865c9d569ab338815b35e3acc56._googlecast._tcp.local", + "ttl": 120 + } + ], + "header_flags": [ + "AA" + ], + "id": "0", + "resolved_ip": [], + "response_code": "NOERROR", + "type": "answer" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:07:16.749Z", + "dataset": "zeek.dns", + "id": "CdiVAw7jJw6gsX5H", + "ingested": "2023-09-03T22:07:20Z", + "kind": "event", + "original": "{\"ts\":1567095830.734329,\"uid\":\"CdiVAw7jJw6gsX5H\",\"id.orig_h\":\"192.168.86.237\",\"id.orig_p\":5353,\"id.resp_h\":\"224.0.0.251\",\"id.resp_p\":5353,\"proto\":\"udp\",\"trans_id\":0,\"query\":\"_googlecast._tcp.local\",\"rcode\":0,\"rcode_name\":\"NOERROR\",\"AA\":true,\"TC\":false,\"RD\":false,\"RA\":false,\"Z\":0,\"answers\":[\"bravia-4k-gb-5c89f865c9d569ab338815b35e3acc56._googlecast._tcp.local\"],\"TTLs\":[120.0],\"rejected\":false}", + "outcome": "success", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dns.log" + } + }, + "network": { + "community_id": "1:QIR5YXlirWwWA18ZyY/RnvQoaic=", + "protocol": "dns", + "transport": "udp" + }, + "related": { + "ip": [ + "192.168.86.237", + "224.0.0.251" + ] + }, + "source": { + "address": "192.168.86.237", + "ip": "192.168.86.237", + "port": 5353 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-dns" + ], + "zeek": { + "dns": { + "AA": true, + "RA": false, + "RD": false, + "TC": false, + "TTLs": [ + 120 + ], + "answers": [ + "bravia-4k-gb-5c89f865c9d569ab338815b35e3acc56._googlecast._tcp.local" + ], + "query": "_googlecast._tcp.local", + "rcode": 0, + "rcode_name": "NOERROR", + "rejected": false, + "trans_id": "0" + }, + "session_id": "CdiVAw7jJw6gsX5H" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json b/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json index f53edf35edb..9c7a05044b3 100644 --- a/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json +++ b/packages/zeek/data_stream/dpd/_dev/test/pipeline/test-dpd.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -57,7 +57,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/dpd/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/dpd/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/dpd/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/dpd/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml index 1e7537c990f..ed40d4807e6 100644 --- a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -83,11 +83,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.dpd.ts formats: @@ -137,13 +137,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -153,7 +153,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/dpd/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/dpd/manifest.yml b/packages/zeek/data_stream/dpd/manifest.yml index 7f39a5fbc1b..ffd4aa02109 100644 --- a/packages/zeek/data_stream/dpd/manifest.yml +++ b/packages/zeek/data_stream/dpd/manifest.yml @@ -26,7 +26,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek dpd.log @@ -65,4 +65,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/dpd/sample_event.json b/packages/zeek/data_stream/dpd/sample_event.json new file mode 100644 index 00000000000..e50a77139fb --- /dev/null +++ b/packages/zeek/data_stream/dpd/sample_event.json @@ -0,0 +1,80 @@ +{ + "@timestamp": "2017-10-09T16:45:00.423Z", + "agent": { + "ephemeral_id": "9eba59d5-b5c3-48ba-9b53-f09157785523", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.dpd", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.10.10", + "ip": "192.168.10.10", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:08:39.774Z", + "dataset": "zeek.dpd", + "id": "CRrT7S1ccw9H6hzCR", + "ingested": "2023-09-03T22:08:43Z", + "kind": "event", + "type": [ + "connection", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dpd.log" + } + }, + "network": { + "community_id": "1:b+Szw+ia464igf5e+MwW1WUzw9Y=", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.10.31", + "192.168.10.10" + ] + }, + "source": { + "address": "192.168.10.31", + "ip": "192.168.10.31", + "port": 49285 + }, + "tags": [ + "forwarded", + "zeek-dpd" + ], + "zeek": { + "dpd": { + "analyzer": "DCE_RPC", + "failure_reason": "Binpac exception: binpac exception: \u0026enforce violation : DCE_RPC_Header:rpc_vers" + }, + "session_id": "CRrT7S1ccw9H6hzCR" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json b/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json index 6db592ccab3..6f91ff2d309 100644 --- a/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json +++ b/packages/zeek/data_stream/files/_dev/test/pipeline/test-files.log-expected.json @@ -6,7 +6,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -78,7 +78,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -150,7 +150,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -222,7 +222,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -298,7 +298,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -374,7 +374,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -450,7 +450,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -522,7 +522,7 @@ "ip": "10.156.0.2" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -598,7 +598,7 @@ "ip": "10.178.98.102" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/files/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/files/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/files/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/files/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml index 24c1cd702ac..6ab0371ad5c 100644 --- a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: file @@ -40,7 +40,7 @@ processors: - set: field: file.mime_type copy_from: zeek.files.mime_type - if: ctx?.zeek?.files?.mime_type != null + if: ctx.zeek?.files?.mime_type != null - rename: field: zeek.files.filename target_field: file.name @@ -52,15 +52,15 @@ processors: - set: field: file.hash.md5 copy_from: zeek.files.md5 - if: ctx?.zeek?.files?.md5 != null + if: ctx.zeek?.files?.md5 != null - set: field: file.hash.sha1 copy_from: zeek.files.sha1 - if: ctx?.zeek?.files?.sha1 != null + if: ctx.zeek?.files?.sha1 != null - set: field: file.hash.sha256 copy_from: zeek.files.sha256 - if: ctx?.zeek?.files?.sha256 != null + if: ctx.zeek?.files?.sha256 != null - date: field: zeek.files.ts formats: @@ -82,7 +82,7 @@ processors: processor: append: field: related.ip - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" ignore_missing: true - script: lang: painless @@ -91,13 +91,13 @@ processors: - set: field: server.ip copy_from: zeek.files.tx_host - if: "ctx?.zeek?.files?.tx_host != null" + if: "ctx.zeek?.files?.tx_host != null" - foreach: field: zeek.files.rx_hosts processor: append: field: related.ip - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" ignore_missing: true - script: lang: painless @@ -105,22 +105,22 @@ processors: ignore_failure: true - set: field: client.ip - value: "{{zeek.files.rx_host}}" - if: "ctx?.zeek?.files?.rx_host != null" + value: "{{{zeek.files.rx_host}}}" + if: "ctx.zeek?.files?.rx_host != null" - append: field: related.hash - value: "{{file.hash.md5}}" - if: "ctx?.file?.hash?.md5 != null" + value: "{{{file.hash.md5}}}" + if: "ctx.file?.hash?.md5 != null" allow_duplicates: false - append: field: related.hash - value: "{{file.hash.sha1}}" - if: "ctx?.file?.hash?.sha1 != null" + value: "{{{file.hash.sha1}}}" + if: "ctx.file?.hash?.sha1 != null" allow_duplicates: false - append: field: related.hash - value: "{{file.hash.sha256}}" - if: "ctx?.file?.hash?.sha256 != null" + value: "{{{file.hash.sha256}}}" + if: "ctx.file?.hash?.sha256 != null" allow_duplicates: false - remove: field: @@ -128,7 +128,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/files/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/files/manifest.yml b/packages/zeek/data_stream/files/manifest.yml index b87633f6516..2ec5a1b2a51 100644 --- a/packages/zeek/data_stream/files/manifest.yml +++ b/packages/zeek/data_stream/files/manifest.yml @@ -34,7 +34,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek files.log @@ -81,4 +81,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/files/sample_event.json b/packages/zeek/data_stream/files/sample_event.json new file mode 100644 index 00000000000..9c6fd63b68d --- /dev/null +++ b/packages/zeek/data_stream/files/sample_event.json @@ -0,0 +1,105 @@ +{ + "@timestamp": "2019-01-17T01:33:21.566Z", + "agent": { + "ephemeral_id": "50a7535e-d016-4c2b-8231-428580a41ca3", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "client": { + "ip": "10.178.98.102" + }, + "data_stream": { + "dataset": "zeek.files", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "file" + ], + "created": "2023-09-03T22:09:59.891Z", + "dataset": "zeek.files", + "id": "C6sjVo23iNApLnlAt6", + "ingested": "2023-09-03T22:10:03Z", + "kind": "event", + "original": "{\"ts\":1547688801.566262,\"fuid\":\"F9ip9a3MDAq3XLBOn2\",\"tx_hosts\":[\"17.134.127.250\"],\"rx_hosts\":[\"10.178.98.102\"],\"conn_uids\":[\"C6sjVo23iNApLnlAt6\"],\"source\":\"SSL\",\"depth\":0,\"analyzers\":[\"X509\",\"MD5\",\"SHA1\"],\"mime_type\":\"application/pkix-cert\",\"duration\":0.0,\"local_orig\":false,\"is_orig\":false,\"seen_bytes\":1092,\"missing_bytes\":0,\"overflow_bytes\":0,\"timedout\":false,\"md5\":\"48f0e38385112eeca5fc9ffd402eaecd\",\"sha1\":\"8e8321ca08b08e3726fe1d82996884eeb5f0d655\"}", + "type": [ + "info" + ] + }, + "file": { + "hash": { + "md5": "48f0e38385112eeca5fc9ffd402eaecd", + "sha1": "8e8321ca08b08e3726fe1d82996884eeb5f0d655" + }, + "mime_type": "application/pkix-cert" + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dhcp.log" + } + }, + "related": { + "hash": [ + "48f0e38385112eeca5fc9ffd402eaecd", + "8e8321ca08b08e3726fe1d82996884eeb5f0d655" + ], + "ip": [ + "17.134.127.250", + "10.178.98.102" + ] + }, + "server": { + "ip": "17.134.127.250" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-files" + ], + "zeek": { + "files": { + "analyzers": [ + "X509", + "MD5", + "SHA1" + ], + "depth": 0, + "duration": 0, + "fuid": "F9ip9a3MDAq3XLBOn2", + "is_orig": false, + "local_orig": false, + "md5": "48f0e38385112eeca5fc9ffd402eaecd", + "mime_type": "application/pkix-cert", + "missing_bytes": 0, + "overflow_bytes": 0, + "rx_host": "10.178.98.102", + "seen_bytes": 1092, + "session_ids": [ + "C6sjVo23iNApLnlAt6" + ], + "sha1": "8e8321ca08b08e3726fe1d82996884eeb5f0d655", + "source": "SSL", + "timedout": false, + "tx_host": "17.134.127.250" + }, + "session_id": "C6sjVo23iNApLnlAt6" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json b/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json index c1449a82184..260868c96ea 100644 --- a/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json +++ b/packages/zeek/data_stream/ftp/_dev/test/pipeline/test-ftp.log-expected.json @@ -8,7 +8,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "EPSV", @@ -77,7 +77,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "RETR", @@ -144,7 +144,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "STOR", @@ -208,7 +208,7 @@ "port": 21 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "STOR", diff --git a/packages/zeek/data_stream/ftp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ftp/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ftp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ftp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml index 2ade0f7da0c..d544d986d10 100644 --- a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,19 +88,19 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: user.name copy_from: zeek.ftp.user - if: ctx?.zeek?.ftp?.user != null + if: ctx.zeek?.ftp?.user != null - set: field: event.action copy_from: zeek.ftp.command - if: ctx?.zeek?.ftp?.command != null + if: ctx.zeek?.ftp?.command != null - rename: field: zeek.ftp.file_size target_field: file.size @@ -165,18 +165,18 @@ processors: path: zeek.ftp - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - geoip: field: destination.ip @@ -224,7 +224,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ftp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ftp/manifest.yml b/packages/zeek/data_stream/ftp/manifest.yml index d3f67f3067c..7b2569a863b 100644 --- a/packages/zeek/data_stream/ftp/manifest.yml +++ b/packages/zeek/data_stream/ftp/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek ftp.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ftp/sample_event.json b/packages/zeek/data_stream/ftp/sample_event.json new file mode 100644 index 00000000000..abb9394d39c --- /dev/null +++ b/packages/zeek/data_stream/ftp/sample_event.json @@ -0,0 +1,97 @@ +{ + "@timestamp": "2007-08-17T19:31:57.579Z", + "agent": { + "ephemeral_id": "5718a64f-4ab6-4811-8a00-04c344498c31", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.ftp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.231", + "ip": "192.168.1.231", + "port": 21 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "STOR", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:11:20.012Z", + "dataset": "zeek.ftp", + "id": "CpQoCn3o28tke89zv9", + "ingested": "2023-09-03T22:11:23Z", + "kind": "event", + "original": "{\"ts\":1187379117.579203,\"uid\":\"CpQoCn3o28tke89zv9\",\"id.orig_h\":\"192.168.1.182\",\"id.orig_p\":62014,\"id.resp_h\":\"192.168.1.231\",\"id.resp_p\":21,\"user\":\"ftp\",\"password\":\"ftp\",\"command\":\"STOR\",\"arg\":\"ftp://192.168.1.231/uploads/README\",\"reply_code\":226,\"reply_msg\":\"Transfer complete.\"}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/dhcp.log" + } + }, + "network": { + "community_id": "1:Szmpl33Czo3dQvU2V4/SrHfmBC0=", + "protocol": "ftp", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.1.182", + "192.168.1.231" + ], + "user": [ + "ftp" + ] + }, + "source": { + "address": "192.168.1.182", + "ip": "192.168.1.182", + "port": 62014 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ftp" + ], + "user": { + "name": "ftp" + }, + "zeek": { + "ftp": { + "arg": "ftp://192.168.1.231/uploads/README", + "command": "STOR", + "password": "ftp", + "reply": { + "code": 226, + "msg": "Transfer complete." + }, + "user": "ftp" + }, + "session_id": "CpQoCn3o28tke89zv9" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log index 66987bdf520..90a047fe203 100644 --- a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log +++ b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log @@ -7,3 +7,6 @@ {"ts":1617081366.285075,"uid":"C7DWRE1zsvxUK9RyW1","id.orig_h":"10.156.0.2","id.orig_p":42292,"id.resp_h":"89.160.20.156","id.resp_p":80,"trans_depth":1,"version":"1.0","request_body_len":0,"response_body_len":503,"status_code":200,"status_msg":"OK","tags":[],"resp_fuids":["FQhm6z1cISaOxMzzR6"],"resp_mime_types":["application/ocsp-response"]} {"preview":false,"offset":0,"result":{"_bkt":"main~0~0758E7C3-1D0C-4B2B-8CF0-682BFEA86CDC","_cd":"0:12","_indextime":"1608752616","_raw":"{\"ts\":1547707019.757479,\"uid\":\"CMnIaR2V8VXyu7EPs\",\"id.orig_h\":\"10.20.8.197\",\"id.orig_p\":35684,\"id.resp_h\":\"89.160.20.156\",\"id.resp_p\":80,\"trans_depth\":1,\"method\":\"GET\",\"host\":\"httpbin.org\",\"uri\":\"/ip\",\"version\":\"1.1\",\"user_agent\":\"curl/7.58.0\",\"request_body_len\":0,\"response_body_len\":32,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"FwGPlr1GcKUWWdkXoi\"],\"resp_mime_types\":[\"text/json\"]}","_serial":"0","_si":["b590508aafed","main"],"_sourcetype":"access_log-too_small","_time":"2020-12-23 19:43:35.000 UTC","host":"Lees-MBP.localdomain","index":"main","linecount":"1","my_max":"1608759317","source":"/usr/local/var/log/zeek/http.log","sourcetype":"access_log-too_small","splunk_server":"b590508aafed"}} {"ts":1641910768.499966,"uid":"CZVlyH3mlEGvfFfTJh","id.orig_h":"10.156.0.2","id.orig_p":52962,"id.resp_h":"10.156.0.3","id.resp_p":7000,"trans_depth":1,"method":"GET","uri":"/info?txtAirPlay&txtRAOP RTSP/1.","request_body_len":0,"response_body_len":0,"tags":[]} +{"ts":1641910768.499966,"uid":"CZVlyH3mlEGvfFfTJh","id.orig_h":"10.156.0.2","id.orig_p":52962,"id.resp_h":"10.156.0.3","id.resp_p":7000,"trans_depth":1,"method":"GET","uri":"http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/","request_body_len":0,"response_body_len":0,"tags":[],"host":"msedge.b.tlw.d2.delivery.mp.microsoft.com"} +{"ts":1641910768.499966,"uid":"CZVlyH3mlEGvfFfTJh","id.orig_h":"10.156.0.2","id.orig_p":52962,"id.resp_h":"10.156.0.3","id.resp_p":7000,"trans_depth":1,"method":"GET","uri":"http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/","request_body_len":0,"response_body_len":0,"tags":[]} +{"ts":1547687130.172944,"uid":"CCNp8v1SNzY7v9d1Ih","id.orig_h":"10.178.98.102","id.orig_p":62995,"id.resp_h":"89.160.20.156","username":"user","id.resp_p":80,"trans_depth":1,"method":"GET","host":"ocsp.apple.com","uri":"http://msedge.b.tlu.di.delivery.mp.microsoft.com/filestreamingservice/ocsp04-aaica02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFNqvF+Za6oA4ceFRLsAWwEInjUhJBBQx6napI3Sl39T97qDBpp7GEQ4R7AIIUP1IOZZ86ns=","version":"1.1","user_agent":"com.apple.trustd/2.0","request_body_len":0,"response_body_len":3735,"status_code":200,"status_msg":"OK","tags":[],"resp_fuids":["F5zuip1tSwASjNAHy7"],"resp_mime_types":["application/ocsp-response"]} diff --git a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json index f477eb8cbfd..e58f0e5d4cf 100644 --- a/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json +++ b/packages/zeek/data_stream/http/_dev/test/pipeline/test-http.log-expected.json @@ -26,7 +26,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GET", @@ -138,7 +138,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GET", @@ -244,7 +244,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -335,7 +335,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -426,7 +426,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -517,7 +517,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -608,7 +608,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -699,7 +699,7 @@ "port": 80 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GET", @@ -795,7 +795,7 @@ "port": 7000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "GET", @@ -855,6 +855,262 @@ }, "session_id": "CZVlyH3mlEGvfFfTJh" } + }, + { + "@timestamp": "2022-01-11T14:19:28.499Z", + "destination": { + "address": "10.156.0.3", + "ip": "10.156.0.3", + "port": 7000 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "GET", + "category": [ + "network", + "web" + ], + "created": "2020-04-28T11:07:58.223Z", + "id": "CZVlyH3mlEGvfFfTJh", + "kind": "event", + "original": "{\"ts\":1641910768.499966,\"uid\":\"CZVlyH3mlEGvfFfTJh\",\"id.orig_h\":\"10.156.0.2\",\"id.orig_p\":52962,\"id.resp_h\":\"10.156.0.3\",\"id.resp_p\":7000,\"trans_depth\":1,\"method\":\"GET\",\"uri\":\"http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/\",\"request_body_len\":0,\"response_body_len\":0,\"tags\":[],\"host\":\"msedge.b.tlw.d2.delivery.mp.microsoft.com\"}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "http": { + "request": { + "body": { + "bytes": 0 + }, + "method": "GET" + }, + "response": { + "body": { + "bytes": 0 + } + } + }, + "network": { + "community_id": "1:ESPdH8qlmXczJqgAbgU4svlyQpk=", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.156.0.2", + "10.156.0.3" + ] + }, + "source": { + "address": "10.156.0.2", + "ip": "10.156.0.2", + "port": 52962 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "msedge.b.tlw.d2.delivery.mp.microsoft.com", + "original": "http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/", + "path": "/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/", + "scheme": "http" + }, + "zeek": { + "http": { + "tags": [], + "trans_depth": 1 + }, + "session_id": "CZVlyH3mlEGvfFfTJh" + } + }, + { + "@timestamp": "2022-01-11T14:19:28.499Z", + "destination": { + "address": "10.156.0.3", + "ip": "10.156.0.3", + "port": 7000 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "GET", + "category": [ + "network", + "web" + ], + "created": "2020-04-28T11:07:58.223Z", + "id": "CZVlyH3mlEGvfFfTJh", + "kind": "event", + "original": "{\"ts\":1641910768.499966,\"uid\":\"CZVlyH3mlEGvfFfTJh\",\"id.orig_h\":\"10.156.0.2\",\"id.orig_p\":52962,\"id.resp_h\":\"10.156.0.3\",\"id.resp_p\":7000,\"trans_depth\":1,\"method\":\"GET\",\"uri\":\"http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/\",\"request_body_len\":0,\"response_body_len\":0,\"tags\":[]}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "http": { + "request": { + "body": { + "bytes": 0 + }, + "method": "GET" + }, + "response": { + "body": { + "bytes": 0 + } + } + }, + "network": { + "community_id": "1:ESPdH8qlmXczJqgAbgU4svlyQpk=", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.156.0.2", + "10.156.0.3" + ] + }, + "source": { + "address": "10.156.0.2", + "ip": "10.156.0.2", + "port": 52962 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "msedge.b.tlw.d2.delivery.mp.microsoft.com", + "original": "http://msedge.b.tlw.d2.delivery.mp.microsoft.com/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/", + "path": "/filestreamingservice/files/48327492874837349827394-ajsdbasdbisuabdiqsnakjndaks-7634287634872368462/", + "scheme": "http" + }, + "zeek": { + "http": { + "tags": [], + "trans_depth": 1 + }, + "session_id": "CZVlyH3mlEGvfFfTJh" + } + }, + { + "@timestamp": "2019-01-17T01:05:30.172Z", + "destination": { + "address": "89.160.20.156", + "as": { + "number": 29518, + "organization": { + "name": "Bredband2 AB" + } + }, + "geo": { + "city_name": "Linköping", + "continent_name": "Europe", + "country_iso_code": "SE", + "country_name": "Sweden", + "location": { + "lat": 58.4167, + "lon": 15.6167 + }, + "region_iso_code": "SE-E", + "region_name": "Östergötland County" + }, + "ip": "89.160.20.156", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "event": { + "action": "GET", + "category": [ + "network", + "web" + ], + "created": "2020-04-28T11:07:58.223Z", + "id": "CCNp8v1SNzY7v9d1Ih", + "kind": "event", + "original": "{\"ts\":1547687130.172944,\"uid\":\"CCNp8v1SNzY7v9d1Ih\",\"id.orig_h\":\"10.178.98.102\",\"id.orig_p\":62995,\"id.resp_h\":\"89.160.20.156\",\"username\":\"user\",\"id.resp_p\":80,\"trans_depth\":1,\"method\":\"GET\",\"host\":\"ocsp.apple.com\",\"uri\":\"http://msedge.b.tlu.di.delivery.mp.microsoft.com/filestreamingservice/ocsp04-aaica02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFNqvF+Za6oA4ceFRLsAWwEInjUhJBBQx6napI3Sl39T97qDBpp7GEQ4R7AIIUP1IOZZ86ns=\",\"version\":\"1.1\",\"user_agent\":\"com.apple.trustd/2.0\",\"request_body_len\":0,\"response_body_len\":3735,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"F5zuip1tSwASjNAHy7\"],\"resp_mime_types\":[\"application/ocsp-response\"]}", + "outcome": "success", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "http": { + "request": { + "body": { + "bytes": 0 + }, + "method": "GET" + }, + "response": { + "body": { + "bytes": 3735 + }, + "status_code": 200 + }, + "version": "1.1" + }, + "network": { + "community_id": "1:TXs3dhUTv+gqBJnP8SIFZaOWpyM=", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.178.98.102", + "89.160.20.156" + ], + "user": [ + "user" + ] + }, + "source": { + "address": "10.178.98.102", + "ip": "10.178.98.102", + "port": 62995 + }, + "tags": [ + "preserve_original_event" + ], + "url": { + "domain": "msedge.b.tlu.di.delivery.mp.microsoft.com", + "original": "http://msedge.b.tlu.di.delivery.mp.microsoft.com/filestreamingservice/ocsp04-aaica02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFNqvF+Za6oA4ceFRLsAWwEInjUhJBBQx6napI3Sl39T97qDBpp7GEQ4R7AIIUP1IOZZ86ns=", + "path": "/filestreamingservice/ocsp04-aaica02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFNqvF+Za6oA4ceFRLsAWwEInjUhJBBQx6napI3Sl39T97qDBpp7GEQ4R7AIIUP1IOZZ86ns=", + "scheme": "http", + "username": "user" + }, + "user": { + "name": "user" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "com.apple.trustd/2.0" + }, + "zeek": { + "http": { + "host": "ocsp.apple.com", + "resp_fuids": [ + "F5zuip1tSwASjNAHy7" + ], + "resp_mime_types": [ + "application/ocsp-response" + ], + "status_msg": "OK", + "tags": [], + "trans_depth": 1 + }, + "session_id": "CCNp8v1SNzY7v9d1Ih" + } } ] } \ No newline at end of file diff --git a/packages/zeek/data_stream/http/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/http/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/http/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/http/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml index 7254e4884d5..369b95fd617 100644 --- a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,11 +88,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.http.method target_field: http.request.method @@ -118,7 +118,7 @@ processors: target_field: http.response.body.bytes ignore_missing: true - uri_parts: - if: ctx?.zeek?.http?.uri != null + if: ctx.zeek?.http?.uri != null field: zeek.http.uri on_failure: - set: @@ -134,15 +134,20 @@ processors: - remove: field: url.domain ignore_missing: true - if: "ctx?.url?.domain == null || ctx?.url?.domain.isEmpty()" + if: "ctx.url?.domain == null || ctx.url?.domain.isEmpty()" - remove: field: url.scheme ignore_missing: true - if: "ctx?.url?.scheme == null || ctx?.url?.scheme.isEmpty()" + if: "ctx.url?.scheme == null || ctx.url?.scheme.isEmpty()" - rename: field: zeek.http.host target_field: url.domain ignore_missing: true + if: ctx.zeek?.http?.host != null && ctx.url?.domain == null + - remove: + field: zeek.http.host + ignore_missing: true + if: ctx.zeek?.http?.host == ctx.url?.domain - rename: field: zeek.http.username target_field: url.username @@ -158,11 +163,11 @@ processors: - set: field: event.action copy_from: http.request.method - if: ctx?.http?.request?.method != null + if: ctx.http?.request?.method != null - set: field: user.name copy_from: url.username - if: ctx?.url?.username != null + if: ctx.url?.username != null - date: field: zeek.http.ts formats: @@ -214,25 +219,25 @@ processors: - set: field: event.outcome value: success - if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code < 400" + if: "ctx.http?.response?.status_code != null && ctx.http.response.status_code < 400" - set: field: event.outcome value: failure - if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400" + if: "ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 400" - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{url.username}}" - if: "ctx?.url?.username != null" + value: "{{{url.username}}}" + if: "ctx.url?.username != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -242,7 +247,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/http/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/http/fields/ecs.yml b/packages/zeek/data_stream/http/fields/ecs.yml index 1174cd9a853..8aeefcc33e8 100644 --- a/packages/zeek/data_stream/http/fields/ecs.yml +++ b/packages/zeek/data_stream/http/fields/ecs.yml @@ -102,6 +102,8 @@ name: url.path - external: ecs name: url.port +- external: ecs + name: url.scheme - external: ecs name: url.username - external: ecs diff --git a/packages/zeek/data_stream/http/fields/fields.yml b/packages/zeek/data_stream/http/fields/fields.yml index f264ff0db99..4c9598e6333 100644 --- a/packages/zeek/data_stream/http/fields/fields.yml +++ b/packages/zeek/data_stream/http/fields/fields.yml @@ -9,6 +9,10 @@ type: keyword description: | Status message returned by the server. + - name: host + type: keyword + description: | + The Zeek host if it differs from the domain extracted from the Zeek URI. - name: info_code type: integer description: | diff --git a/packages/zeek/data_stream/http/manifest.yml b/packages/zeek/data_stream/http/manifest.yml index 5e5e0e36fa1..88c7d0cbd2f 100644 --- a/packages/zeek/data_stream/http/manifest.yml +++ b/packages/zeek/data_stream/http/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek http.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/http/sample_event.json b/packages/zeek/data_stream/http/sample_event.json new file mode 100644 index 00000000000..16ad8f02e11 --- /dev/null +++ b/packages/zeek/data_stream/http/sample_event.json @@ -0,0 +1,121 @@ +{ + "@timestamp": "2019-01-17T06:36:59.757Z", + "agent": { + "ephemeral_id": "4338289b-ba2c-4cb3-811a-e8a204542c11", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.http", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "34.206.130.40", + "ip": "34.206.130.40", + "port": 80 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "GET", + "agent_id_status": "verified", + "category": [ + "network", + "web" + ], + "created": "2023-09-03T22:12:42.364Z", + "dataset": "zeek.http", + "id": "CMnIaR2V8VXyu7EPs", + "ingested": "2023-09-03T22:12:46Z", + "kind": "event", + "original": "{\"ts\":1547707019.757479,\"uid\":\"CMnIaR2V8VXyu7EPs\",\"id.orig_h\":\"10.20.8.197\",\"id.orig_p\":35684,\"id.resp_h\":\"34.206.130.40\",\"id.resp_p\":80,\"trans_depth\":1,\"method\":\"GET\",\"host\":\"httpbin.org\",\"uri\":\"/ip\",\"version\":\"1.1\",\"user_agent\":\"curl/7.58.0\",\"request_body_len\":0,\"response_body_len\":32,\"status_code\":200,\"status_msg\":\"OK\",\"tags\":[],\"resp_fuids\":[\"FwGPlr1GcKUWWdkXoi\"],\"resp_mime_types\":[\"text/json\"]}", + "outcome": "success", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "http": { + "request": { + "body": { + "bytes": 0 + }, + "method": "GET" + }, + "response": { + "body": { + "bytes": 32 + }, + "status_code": 200 + }, + "version": "1.1" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/http.log" + } + }, + "network": { + "community_id": "1:Ol0Btm49e1mxnu/BXm1GM8w5ixY=", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.20.8.197", + "34.206.130.40" + ] + }, + "source": { + "address": "10.20.8.197", + "ip": "10.20.8.197", + "port": 35684 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-http" + ], + "url": { + "domain": "httpbin.org", + "original": "/ip", + "path": "/ip" + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "curl", + "original": "curl/7.58.0", + "version": "7.58.0" + }, + "zeek": { + "http": { + "resp_fuids": [ + "FwGPlr1GcKUWWdkXoi" + ], + "resp_mime_types": [ + "text/json" + ], + "status_msg": "OK", + "tags": [], + "trans_depth": 1 + }, + "session_id": "CMnIaR2V8VXyu7EPs" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json b/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json index d42419e7af8..42fdefebe30 100644 --- a/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json +++ b/packages/zeek/data_stream/intel/_dev/test/pipeline/test-intel.log-expected.json @@ -26,7 +26,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -123,7 +123,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -228,7 +228,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -312,7 +312,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/intel/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/intel/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/intel/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/intel/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml index 777dc0a029a..a7813b57563 100644 --- a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: enrichment - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: threat @@ -76,11 +76,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - dot_expander: path: zeek.intel field: seen.indicator @@ -187,13 +187,13 @@ processors: ignore_missing: true - append: field: "related.ip" - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: "related.ip" - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -201,7 +201,7 @@ processors: field: message target_field: event.original ignore_missing: true - if: ctx?.event?.original == null + if: ctx.event?.original == null # Add threat indicators. - convert: @@ -291,7 +291,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/intel/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/intel/manifest.yml b/packages/zeek/data_stream/intel/manifest.yml index de479c71e76..419e2d30700 100644 --- a/packages/zeek/data_stream/intel/manifest.yml +++ b/packages/zeek/data_stream/intel/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek intel.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/intel/sample_event.json b/packages/zeek/data_stream/intel/sample_event.json new file mode 100644 index 00000000000..ad4920efaa9 --- /dev/null +++ b/packages/zeek/data_stream/intel/sample_event.json @@ -0,0 +1,93 @@ +{ + "@timestamp": "2019-11-06T09:03:00.989Z", + "agent": { + "ephemeral_id": "738ec419-e868-49b9-805c-eba5e48a9686", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.intel", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "198.41.0.4", + "ip": "198.41.0.4", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "threat" + ], + "created": "2023-09-03T22:14:05.254Z", + "dataset": "zeek.intel", + "id": "Ctefoj1tgOPt4D0EK2", + "ingested": "2023-09-03T22:14:09Z", + "kind": "enrichment", + "original": "{\"ts\":1573030980.989353,\"uid\":\"Ctefoj1tgOPt4D0EK2\",\"id.orig_h\":\"192.168.1.1\",\"id.orig_p\":37598,\"id.resp_h\":\"198.41.0.4\",\"id.resp_p\":53,\"seen.indicator\":\"198.41.0.4\",\"seen.indicator_type\":\"Intel::ADDR\",\"seen.where\":\"Conn::IN_RESP\",\"seen.node\":\"worker-1-2\",\"matched\":[\"Intel::ADDR\"],\"sources\":[\"ETPRO Rep: AbusedTLD Score: 127\"]}", + "type": [ + "indicator" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/intel.log" + } + }, + "related": { + "ip": [ + "192.168.1.1", + "198.41.0.4" + ] + }, + "source": { + "address": "192.168.1.1", + "ip": "192.168.1.1", + "port": 37598 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-intel" + ], + "threat": { + "indicator": { + "ip": "198.41.0.4", + "type": "ipv4-addr" + } + }, + "zeek": { + "intel": { + "matched": [ + "Intel::ADDR" + ], + "seen": { + "indicator": "198.41.0.4", + "indicator_type": "Intel::ADDR", + "node": "worker-1-2", + "where": "Conn::IN_RESP" + }, + "sources": [ + "ETPRO Rep: AbusedTLD Score: 127" + ] + }, + "session_id": "Ctefoj1tgOPt4D0EK2" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json b/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json index 4aa368e2306..8d3c7966a2e 100644 --- a/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json +++ b/packages/zeek/data_stream/irc/_dev/test/pipeline/test-irc.log-expected.json @@ -26,7 +26,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "USER", @@ -97,7 +97,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NICK", @@ -174,7 +174,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "JOIN", @@ -252,7 +252,7 @@ "port": 8000 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "JOIN", diff --git a/packages/zeek/data_stream/irc/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/irc/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/irc/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/irc/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml index 8226f908c88..ff1156ebeff 100644 --- a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,11 +88,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.irc.dcc_file_name target_field: file.name @@ -112,7 +112,7 @@ processors: - set: field: event.action copy_from: zeek.irc.command - if: ctx?.zeek?.irc?.command != null + if: ctx.zeek?.irc?.command != null - date: field: zeek.irc.ts formats: @@ -122,18 +122,18 @@ processors: field: zeek.irc.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - geoip: field: destination.ip @@ -181,7 +181,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/irc/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/irc/manifest.yml b/packages/zeek/data_stream/irc/manifest.yml index dd8a3894675..3254c5e23d5 100644 --- a/packages/zeek/data_stream/irc/manifest.yml +++ b/packages/zeek/data_stream/irc/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek irc.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/irc/sample_event.json b/packages/zeek/data_stream/irc/sample_event.json new file mode 100644 index 00000000000..0a4536a902e --- /dev/null +++ b/packages/zeek/data_stream/irc/sample_event.json @@ -0,0 +1,99 @@ +{ + "@timestamp": "2013-12-20T15:44:10.706Z", + "agent": { + "ephemeral_id": "8dcf1461-d2e4-42cb-b790-eadaba6d5951", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.irc", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "38.229.70.20", + "as": { + "number": 174, + "organization": { + "name": "Cogent Communications" + } + }, + "ip": "38.229.70.20", + "port": 8000 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "JOIN", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:15:30.328Z", + "dataset": "zeek.irc", + "id": "CNJBX5FQdL62VUUP1", + "ingested": "2023-09-03T22:15:34Z", + "kind": "event", + "original": "{\"ts\":1387554250.706387,\"uid\":\"CNJBX5FQdL62VUUP1\",\"id.orig_h\":\"10.180.156.249\",\"id.orig_p\":45921,\"id.resp_h\":\"38.229.70.20\",\"id.resp_p\":8000,\"nick\":\"molochtest\",\"user\":\"xxxxx\",\"command\":\"JOIN\",\"value\":\"#moloch-fpc\",\"addl\":\" with channel key: \\u0027-\\u0027\"}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/irc.log" + } + }, + "network": { + "community_id": "1:YdkGov/c+KLtmg7Cf5DLDB4+YdQ=", + "protocol": "irc", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.180.156.249", + "38.229.70.20" + ], + "user": [ + "xxxxx" + ] + }, + "source": { + "address": "10.180.156.249", + "ip": "10.180.156.249", + "port": 45921 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-irc" + ], + "user": { + "name": "xxxxx" + }, + "zeek": { + "irc": { + "addl": " with channel key: '-'", + "command": "JOIN", + "nick": "molochtest", + "value": "#moloch-fpc" + }, + "session_id": "CNJBX5FQdL62VUUP1" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json b/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json index 7b6dc2f6b5c..d16cb8ae56d 100644 --- a/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json +++ b/packages/zeek/data_stream/kerberos/_dev/test/pipeline/test-kerberos.log-expected.json @@ -11,7 +11,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TGS", @@ -59,22 +59,42 @@ "client": { "x509": { "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, "server": { "x509": { "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } } @@ -118,7 +138,7 @@ "port": 88 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "TGS", @@ -174,22 +194,42 @@ "client": { "x509": { "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, "server": { "x509": { "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } } diff --git a/packages/zeek/data_stream/kerberos/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/kerberos/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/kerberos/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/kerberos/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml index d5dfda7a5fd..3dc9bece0f6 100644 --- a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: ["network", "authentication"] @@ -88,23 +88,23 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: client.address copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: server.address copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: event.action copy_from: zeek.kerberos.request_type - if: ctx?.zeek?.kerberos?.request_type != null + if: ctx.zeek?.kerberos?.request_type != null - rename: field: zeek.kerberos.till target_field: zeek.kerberos.valid.until @@ -181,7 +181,7 @@ processors: field: zeek.kerberos.client pattern: "%{user.name}/%{user.domain}" ignore_missing: true - if: ctx?.zeek?.kerberos?.client.contains('/') + if: ctx.zeek?.kerberos?.client.contains('/') - date: field: zeek.kerberos.ts formats: @@ -209,11 +209,11 @@ processors: - set: field: event.outcome value: success - if: "ctx?.zeek?.kerberos?.success == true" + if: "ctx.zeek?.kerberos?.success == true" - set: field: event.outcome value: failure - if: "ctx?.zeek?.kerberos?.success == false" + if: "ctx.zeek?.kerberos?.success == false" - geoip: field: destination.ip target_field: destination.geo @@ -256,18 +256,18 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - gsub: field: zeek.kerberos.cert.client.subject @@ -280,30 +280,30 @@ processors: value_split: "=" target_field: zeek.kerberos.cert.client.kv_sub ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.C - target_field: tls.client.x509.subject.country - ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.CN - target_field: tls.client.x509.subject.common_name - ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.L - target_field: tls.client.x509.subject.locality - ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.O - target_field: tls.client.x509.subject.organization - ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.OU - target_field: tls.client.x509.subject.organizational_unit - ignore_missing: true - - rename: - field: zeek.kerberos.cert.client.kv_sub.ST - target_field: tls.client.x509.subject.state_or_province - ignore_missing: true + - set: + field: tls.client.x509.subject.country + value: ['{{{zeek.kerberos.cert.client.kv_sub.C}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.C instanceof String + - set: + field: tls.client.x509.subject.common_name + value: ['{{{zeek.kerberos.cert.client.kv_sub.CN}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.CN instanceof String + - set: + field: tls.client.x509.subject.locality + value: ['{{{zeek.kerberos.cert.client.kv_sub.L}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.L instanceof String + - set: + field: tls.client.x509.subject.organization + value: ['{{{zeek.kerberos.cert.client.kv_sub.O}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.O instanceof String + - set: + field: tls.client.x509.subject.organizational_unit + value: ['{{{zeek.kerberos.cert.client.kv_sub.OU}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.OU instanceof String + - set: + field: tls.client.x509.subject.state_or_province + value: ['{{{zeek.kerberos.cert.client.kv_sub.ST}}}'] + if: ctx.zeek?.kerberos?.cert?.client?.kv_sub?.ST instanceof String - remove: field: zeek.kerberos.cert.client.kv_sub ignore_missing: true @@ -318,30 +318,30 @@ processors: value_split: "=" target_field: zeek.kerberos.cert.server.kv_sub ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.C - target_field: tls.server.x509.subject.country - ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.CN - target_field: tls.server.x509.subject.common_name - ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.L - target_field: tls.server.x509.subject.locality - ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.O - target_field: tls.server.x509.subject.organization - ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.OU - target_field: tls.server.x509.subject.organizational_unit - ignore_missing: true - - rename: - field: zeek.kerberos.cert.server.kv_sub.ST - target_field: tls.server.x509.subject.state_or_province - ignore_missing: true + - set: + field: tls.server.x509.subject.country + value: ['{{{zeek.kerberos.cert.server.kv_sub.C}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.C instanceof String + - set: + field: tls.server.x509.subject.common_name + value: ['{{{zeek.kerberos.cert.server.kv_sub.CN}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.CN instanceof String + - set: + field: tls.server.x509.subject.locality + value: ['{{{zeek.kerberos.cert.server.kv_sub.L}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.L instanceof String + - set: + field: tls.server.x509.subject.organization + value: ['{{{zeek.kerberos.cert.server.kv_sub.O}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.O instanceof String + - set: + field: tls.server.x509.subject.organizational_unit + value: ['{{{zeek.kerberos.cert.server.kv_sub.OU}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.OU instanceof String + - set: + field: tls.server.x509.subject.state_or_province + value: ['{{{zeek.kerberos.cert.server.kv_sub.ST}}}'] + if: ctx.zeek?.kerberos?.cert?.server?.kv_sub?.ST instanceof String - remove: field: zeek.kerberos.cert.server.kv_sub ignore_missing: true @@ -355,7 +355,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/kerberos/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/kerberos/manifest.yml b/packages/zeek/data_stream/kerberos/manifest.yml index 20b96a58013..8dfc3eeffd7 100644 --- a/packages/zeek/data_stream/kerberos/manifest.yml +++ b/packages/zeek/data_stream/kerberos/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek kerberos.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/kerberos/sample_event.json b/packages/zeek/data_stream/kerberos/sample_event.json new file mode 100644 index 00000000000..80825122085 --- /dev/null +++ b/packages/zeek/data_stream/kerberos/sample_event.json @@ -0,0 +1,160 @@ +{ + "@timestamp": "2017-10-09T16:13:19.590Z", + "agent": { + "ephemeral_id": "d2369829-5917-4316-8a78-24273bafa837", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "client": { + "address": "192.168.10.31" + }, + "data_stream": { + "dataset": "zeek.kerberos", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.10.10", + "ip": "192.168.10.10", + "port": 88 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "TGS", + "agent_id_status": "verified", + "category": [ + "network", + "authentication" + ], + "created": "2023-09-03T22:16:52.409Z", + "dataset": "zeek.kerberos", + "id": "C56Flhb4WQBNkfMOl", + "ingested": "2023-09-03T22:16:56Z", + "kind": "event", + "original": "{\"ts\":1507565599.590346,\"uid\":\"C56Flhb4WQBNkfMOl\",\"id.orig_h\":\"192.168.10.31\",\"id.orig_p\":49242,\"id.resp_h\":\"192.168.10.10\",\"id.resp_p\":88,\"request_type\":\"TGS\",\"client\":\"RonHD/CONTOSO.LOCAL\",\"service\":\"HOST/admin-pc\",\"success\":true,\"till\":2136422885.0,\"cipher\":\"aes256-cts-hmac-sha1-96\",\"forwardable\":true,\"renewable\":true,\"cert.client_subject\":\"CN=*.gcp.cloud.es.io,O=Elasticsearch\\u005c, Inc.,L=Mountain View,ST=California,C=US\",\"cert.server_subject\":\"CN=*.gcp.cloud.es.io,O=Elasticsearch\\u005c, Inc.,L=Mountain View,ST=California,C=US\"}", + "outcome": "success", + "type": [ + "connection", + "protocol", + "access" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/kerberos.log" + } + }, + "network": { + "community_id": "1:DW/lSsosl8gZ8pqO9kKMm7cZheQ=", + "protocol": "kerberos", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.10.31", + "192.168.10.10" + ], + "user": [ + "RonHD" + ] + }, + "server": { + "address": "192.168.10.10" + }, + "source": { + "address": "192.168.10.31", + "ip": "192.168.10.31", + "port": 49242 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-kerberos" + ], + "tls": { + "client": { + "x509": { + "subject": { + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] + } + } + }, + "server": { + "x509": { + "subject": { + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] + } + } + } + }, + "user": { + "domain": "CONTOSO.LOCAL", + "name": "RonHD" + }, + "zeek": { + "kerberos": { + "cert": { + "client": { + "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US" + }, + "server": { + "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US" + } + }, + "cipher": "aes256-cts-hmac-sha1-96", + "client": "RonHD/CONTOSO.LOCAL", + "forwardable": true, + "renewable": true, + "request_type": "TGS", + "service": "HOST/admin-pc", + "success": true, + "valid": { + "until": "2037-09-13T02:48:05.000Z" + } + }, + "session_id": "C56Flhb4WQBNkfMOl" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known-certs.log-expected.json b/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known-certs.log-expected.json index 1d2fa900fca..43cefb43d14 100644 --- a/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known-certs.log-expected.json +++ b/packages/zeek/data_stream/known_certs/_dev/test/pipeline/test-known-certs.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-12-31T15:15:53.690Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -18,7 +18,9 @@ ] }, "host": { - "ip": "192.168.4.1" + "ip": [ + "192.168.4.1" + ] }, "network": { "type": "ipv4" @@ -29,7 +31,9 @@ ] }, "server": { - "ip": "192.168.4.1", + "ip": [ + "192.168.4.1" + ], "port": 443 }, "tags": [ @@ -41,12 +45,16 @@ "subject": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US", "x509": { "issuer": { - "common_name": "UBNT Router UI", + "common_name": [ + "UBNT Router UI" + ], "distinguished_name": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US" }, "serial_number": "98D0AD47D748CDD6", "subject": { - "common_name": "UBNT Router UI", + "common_name": [ + "UBNT Router UI" + ], "distinguished_name": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US" } } diff --git a/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml index 2c2f617ed42..493308ce130 100644 --- a/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_certs/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: target_field: json - drop: description: Drop if no timestamp (invalid json) - if: 'ctx?.json?.ts == null' + if: 'ctx.json?.ts == null' # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -49,13 +49,17 @@ processors: if: ctx.host?.ip.contains(':') - append: field: related.ip - value: "{{host.ip}}" - if: ctx?.host?.ip != null + value: "{{{host.ip}}}" + if: ctx.host?.ip != null allow_duplicates: false - geoip: field: host.ip target_field: host.geo ignore_missing: true + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - set: field: server copy_from: host @@ -99,6 +103,10 @@ processors: - 'CN=%{CN:tls.server.x509.subject.common_name}' pattern_definitions: CN: '[^,]+' + - set: + field: tls.server.x509.subject.common_name + value: ['{{{tls.server.x509.subject.common_name}}}'] + if: ctx.tls?.server?.x509?.subject?.common_name instanceof String - grok: field: tls.server.x509.issuer.distinguished_name ignore_missing: true @@ -106,6 +114,10 @@ processors: - 'CN=%{CN:tls.server.x509.issuer.common_name}' pattern_definitions: CN: '[^,]+' + - set: + field: tls.server.x509.issuer.common_name + value: ['{{{tls.server.x509.issuer.common_name}}}'] + if: ctx.tls?.server?.x509?.issuer?.common_name instanceof String - set: field: tls.server.issuer copy_from: tls.server.x509.issuer.distinguished_name @@ -120,7 +132,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/known_certs/manifest.yml b/packages/zeek/data_stream/known_certs/manifest.yml index 19a7c17b2db..bbd70195e07 100644 --- a/packages/zeek/data_stream/known_certs/manifest.yml +++ b/packages/zeek/data_stream/known_certs/manifest.yml @@ -38,4 +38,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/known_certs/sample_event.json b/packages/zeek/data_stream/known_certs/sample_event.json new file mode 100644 index 00000000000..750e4878a6c --- /dev/null +++ b/packages/zeek/data_stream/known_certs/sample_event.json @@ -0,0 +1,90 @@ +{ + "@timestamp": "2020-12-31T15:15:53.690Z", + "agent": { + "ephemeral_id": "c21cc458-5601-46e5-a313-919c8fc9cabb", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.known_certs", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network", + "file" + ], + "created": "2023-09-03T22:17:39.147Z", + "dataset": "zeek.known_certs", + "ingested": "2023-09-03T22:17:40Z", + "kind": "event", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "192.168.4.1" + ] + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/known_certs.log" + }, + "offset": 0 + }, + "network": { + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.4.1" + ] + }, + "server": { + "ip": [ + "192.168.4.1" + ], + "port": 443 + }, + "tags": [ + "forwarded", + "zeek-known_certs" + ], + "tls": { + "server": { + "issuer": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US", + "subject": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US", + "x509": { + "issuer": { + "common_name": [ + "UBNT Router UI" + ], + "distinguished_name": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US" + }, + "serial_number": "98D0AD47D748CDD6", + "subject": { + "common_name": [ + "UBNT Router UI" + ], + "distinguished_name": "L=San Jose,ST=CA,O=Ubiquiti Networks,CN=UBNT Router UI,C=US" + } + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known-hosts.log-expected.json b/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known-hosts.log-expected.json index f7c10cd240c..43a543e21a6 100644 --- a/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known-hosts.log-expected.json +++ b/packages/zeek/data_stream/known_hosts/_dev/test/pipeline/test-known-hosts.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T01:19:26.260Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -18,7 +18,9 @@ ] }, "host": { - "ip": "192.168.4.25" + "ip": [ + "192.168.4.25" + ] }, "network": { "type": "ipv4" @@ -35,7 +37,7 @@ { "@timestamp": "2021-01-03T01:19:27.353Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -50,7 +52,9 @@ ] }, "host": { - "ip": "192.168.4.29" + "ip": [ + "192.168.4.29" + ] }, "network": { "type": "ipv4" @@ -67,7 +71,7 @@ { "@timestamp": "2021-01-03T01:19:32.488Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -82,7 +86,9 @@ ] }, "host": { - "ip": "192.168.4.43" + "ip": [ + "192.168.4.43" + ] }, "network": { "type": "ipv4" @@ -99,7 +105,7 @@ { "@timestamp": "2021-01-03T01:19:58.792Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -114,7 +120,9 @@ ] }, "host": { - "ip": "192.168.4.142" + "ip": [ + "192.168.4.142" + ] }, "network": { "type": "ipv4" @@ -131,7 +139,7 @@ { "@timestamp": "2021-01-03T12:17:22.496Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -146,7 +154,9 @@ ] }, "host": { - "ip": "192.168.4.115" + "ip": [ + "192.168.4.115" + ] }, "network": { "type": "ipv4" diff --git a/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml index cb3f87d1b5f..6ed4d1bcd57 100644 --- a/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_hosts/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: target_field: json - drop: description: Drop if no timestamp (invalid json) - if: 'ctx?.json?.ts == null' + if: 'ctx.json?.ts == null' # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -49,20 +49,24 @@ processors: if: ctx.host?.ip.contains(':') - append: field: related.ip - value: "{{host.ip}}" - if: ctx?.host?.ip != null + value: "{{{host.ip}}}" + if: ctx.host?.ip != null allow_duplicates: false - geoip: field: host.ip target_field: host.geo ignore_missing: true + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - remove: field: - json ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/known_hosts/manifest.yml b/packages/zeek/data_stream/known_hosts/manifest.yml index af25548e320..e5a9dd570e3 100644 --- a/packages/zeek/data_stream/known_hosts/manifest.yml +++ b/packages/zeek/data_stream/known_hosts/manifest.yml @@ -38,4 +38,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/known_hosts/sample_event.json b/packages/zeek/data_stream/known_hosts/sample_event.json new file mode 100644 index 00000000000..6d87c4bbd93 --- /dev/null +++ b/packages/zeek/data_stream/known_hosts/sample_event.json @@ -0,0 +1,63 @@ +{ + "@timestamp": "2021-01-03T01:19:26.260Z", + "agent": { + "ephemeral_id": "c21cc458-5601-46e5-a313-919c8fc9cabb", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.known_hosts", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network", + "host" + ], + "created": "2023-09-03T22:18:23.220Z", + "dataset": "zeek.known_hosts", + "ingested": "2023-09-03T22:18:24Z", + "kind": "event", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "192.168.4.25" + ] + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/known_hosts.log" + }, + "offset": 0 + }, + "network": { + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.4.25" + ] + }, + "tags": [ + "forwarded", + "zeek-known_hosts" + ] +} \ No newline at end of file diff --git a/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known-services.log-expected.json b/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known-services.log-expected.json index 8060f4548ed..243cfb1a43b 100644 --- a/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known-services.log-expected.json +++ b/packages/zeek/data_stream/known_services/_dev/test/pipeline/test-known-services.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T01:19:36.242Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -17,7 +17,9 @@ ] }, "host": { - "ip": "192.168.4.1" + "ip": [ + "192.168.4.1" + ] }, "network": { "application": [ @@ -32,7 +34,9 @@ ] }, "server": { - "ip": "192.168.4.1", + "ip": [ + "192.168.4.1" + ], "port": 53 }, "tags": [ diff --git a/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml index 27e39860ad9..375ba8a2851 100644 --- a/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/known_services/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: target_field: json - drop: description: Drop if no timestamp (invalid json) - if: 'ctx?.json?.ts == null' + if: 'ctx.json?.ts == null' # Sets event.created from the @timestamp field generated by filebeat before being overwritten further down - set: @@ -17,7 +17,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -48,13 +48,17 @@ processors: if: ctx.host?.ip.contains(':') - append: field: related.ip - value: "{{host.ip}}" - if: ctx?.host?.ip != null + value: "{{{host.ip}}}" + if: ctx.host?.ip != null allow_duplicates: false - geoip: field: host.ip target_field: host.geo ignore_missing: true + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - set: field: server copy_from: host @@ -93,7 +97,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/known_services/manifest.yml b/packages/zeek/data_stream/known_services/manifest.yml index 4b5ebb150d2..d28b4a1ff08 100644 --- a/packages/zeek/data_stream/known_services/manifest.yml +++ b/packages/zeek/data_stream/known_services/manifest.yml @@ -38,4 +38,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/known_services/sample_event.json b/packages/zeek/data_stream/known_services/sample_event.json new file mode 100644 index 00000000000..6af7f750f6d --- /dev/null +++ b/packages/zeek/data_stream/known_services/sample_event.json @@ -0,0 +1,72 @@ +{ + "@timestamp": "2021-01-03T01:19:36.242Z", + "agent": { + "ephemeral_id": "c21cc458-5601-46e5-a313-919c8fc9cabb", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.known_services", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:19:07.287Z", + "dataset": "zeek.known_services", + "ingested": "2023-09-03T22:19:08Z", + "kind": "event", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "192.168.4.1" + ] + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/known_services.log" + }, + "offset": 0 + }, + "network": { + "application": [ + "DNS" + ], + "transport": "udp", + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.4.1" + ] + }, + "server": { + "ip": [ + "192.168.4.1" + ], + "port": 53 + }, + "tags": [ + "forwarded", + "zeek-known_services" + ] +} \ No newline at end of file diff --git a/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json b/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json index 2954bccc892..32b4140bc2e 100644 --- a/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json +++ b/packages/zeek/data_stream/modbus/_dev/test/pipeline/test-modbus.log-expected.json @@ -8,7 +8,7 @@ "port": 502 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "READ_COILS", @@ -59,7 +59,7 @@ "port": 502 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "READ_COILS", diff --git a/packages/zeek/data_stream/modbus/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/modbus/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/modbus/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/modbus/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml index 853c1accdac..13e84150ce8 100644 --- a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -81,7 +81,7 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - rename: field: zeek.modbus.func target_field: zeek.modbus.function @@ -89,23 +89,23 @@ processors: - set: field: event.action copy_from: zeek.modbus.function - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: event.outcome value: failure - if: ctx?.zeek?.modbus?.exception != null + if: ctx.zeek?.modbus?.exception != null - set: field: event.outcome value: success - if: ctx?.event?.outcome == null + if: ctx.event?.outcome == null - date: field: zeek.modbus.ts formats: @@ -115,13 +115,13 @@ processors: field: zeek.modbus.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - geoip: field: destination.ip @@ -171,7 +171,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/modbus/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/modbus/manifest.yml b/packages/zeek/data_stream/modbus/manifest.yml index ab505158c15..3a4daf0d20a 100644 --- a/packages/zeek/data_stream/modbus/manifest.yml +++ b/packages/zeek/data_stream/modbus/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek modbus.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/modbus/sample_event.json b/packages/zeek/data_stream/modbus/sample_event.json new file mode 100644 index 00000000000..8ecb8004d92 --- /dev/null +++ b/packages/zeek/data_stream/modbus/sample_event.json @@ -0,0 +1,84 @@ +{ + "@timestamp": "2012-11-12T11:04:25.222Z", + "agent": { + "ephemeral_id": "f159ee90-e892-409a-a1a5-af75779c5044", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.modbus", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.164", + "ip": "192.168.1.164", + "port": 502 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "READ_COILS", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:20:31.793Z", + "dataset": "zeek.modbus", + "id": "CpIIXl4DFGswmjH2bl", + "ingested": "2023-09-03T22:20:32Z", + "kind": "event", + "original": "{\"ts\":1352718265.222457,\"uid\":\"CpIIXl4DFGswmjH2bl\",\"id.orig_h\":\"192.168.1.10\",\"id.orig_p\":64342,\"id.resp_h\":\"192.168.1.164\",\"id.resp_p\":502,\"func\":\"READ_COILS\"}", + "outcome": "success", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/modbus.log" + } + }, + "network": { + "community_id": "1:jEXbR2FqHyMgLJgyYyFQN3yxbpc=", + "protocol": "modbus", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.1.10", + "192.168.1.164" + ] + }, + "source": { + "address": "192.168.1.10", + "ip": "192.168.1.10", + "port": 64342 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-modbus" + ], + "zeek": { + "modbus": { + "function": "READ_COILS" + }, + "session_id": "CpIIXl4DFGswmjH2bl" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json b/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json index dbeff1e4603..1cb4df8d606 100644 --- a/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json +++ b/packages/zeek/data_stream/mysql/_dev/test/pipeline/test-mysql.log-expected.json @@ -8,7 +8,7 @@ "port": 3306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "query", @@ -63,7 +63,7 @@ "port": 3306 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "query", diff --git a/packages/zeek/data_stream/mysql/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/mysql/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/mysql/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/mysql/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml index ea8af90691c..46707c7a435 100644 --- a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -88,23 +88,23 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: event.action copy_from: zeek.mysql.cmd - if: ctx?.zeek?.mysql?.cmd != null + if: ctx.zeek?.mysql?.cmd != null - set: field: event.outcome value: success - if: ctx?.zeek?.mysql?.success == true + if: ctx.zeek?.mysql?.success == true - set: field: event.outcome value: failure - if: ctx?.event?.outcome == null + if: ctx.event?.outcome == null - date: field: zeek.mysql.ts formats: @@ -114,13 +114,13 @@ processors: field: zeek.mysql.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - geoip: field: destination.ip @@ -165,27 +165,27 @@ processors: - append: field: event.type value: access - if: "ctx?.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'connect' || ctx.zeek.mysql.cmd == 'connect_out')" + if: "ctx.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'connect' || ctx.zeek.mysql.cmd == 'connect_out')" - append: field: event.type value: change - if: "ctx?.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'init_db' || ctx.zeek.mysql.cmd == 'change_user' || ctx.zeek.mysql.cmd == 'set_option' || ctx.zeek.mysql.cmd == 'drop_db' || ctx.zeek.mysql.cmd == 'create_db' || ctx.zeek.mysql.cmd == 'process_kill' || ctx.zeek.mysql.cmd == 'delayed_insert')" + if: "ctx.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'init_db' || ctx.zeek.mysql.cmd == 'change_user' || ctx.zeek.mysql.cmd == 'set_option' || ctx.zeek.mysql.cmd == 'drop_db' || ctx.zeek.mysql.cmd == 'create_db' || ctx.zeek.mysql.cmd == 'process_kill' || ctx.zeek.mysql.cmd == 'delayed_insert')" - append: field: event.type value: info - if: "ctx?.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd != 'init_db' && ctx.zeek.mysql.cmd != 'change_user' && ctx.zeek.mysql.cmd != 'set_option' && ctx.zeek.mysql.cmd != 'drop_db' && ctx.zeek.mysql.cmd != 'create_db' && ctx.zeek.mysql.cmd != 'process_kill' && ctx.zeek.mysql.cmd != 'delayed_insert' && ctx.zeek.mysql.cmd != 'connect' && ctx.zeek.mysql.cmd != 'connect_out'" + if: "ctx.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd != 'init_db' && ctx.zeek.mysql.cmd != 'change_user' && ctx.zeek.mysql.cmd != 'set_option' && ctx.zeek.mysql.cmd != 'drop_db' && ctx.zeek.mysql.cmd != 'create_db' && ctx.zeek.mysql.cmd != 'process_kill' && ctx.zeek.mysql.cmd != 'delayed_insert' && ctx.zeek.mysql.cmd != 'connect' && ctx.zeek.mysql.cmd != 'connect_out'" - append: field: event.type value: start - if: "ctx?.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd == 'connect'" + if: "ctx.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd == 'connect'" - append: field: event.type value: end - if: "ctx?.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd == 'connect_out'" + if: "ctx.zeek?.mysql?.cmd != null && ctx.zeek.mysql.cmd == 'connect_out'" - append: field: event.category value: session - if: "ctx?.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'connect' || ctx.zeek.mysql.cmd == 'connect_out')" + if: "ctx.zeek?.mysql?.cmd != null && (ctx.zeek.mysql.cmd == 'connect' || ctx.zeek.mysql.cmd == 'connect_out')" - community_id: target_field: network.community_id - remove: @@ -194,7 +194,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/mysql/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/mysql/manifest.yml b/packages/zeek/data_stream/mysql/manifest.yml index 1d8e9acee69..4f9f814e918 100644 --- a/packages/zeek/data_stream/mysql/manifest.yml +++ b/packages/zeek/data_stream/mysql/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek mysql.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/mysql/sample_event.json b/packages/zeek/data_stream/mysql/sample_event.json new file mode 100644 index 00000000000..cf9de939dbb --- /dev/null +++ b/packages/zeek/data_stream/mysql/sample_event.json @@ -0,0 +1,88 @@ +{ + "@timestamp": "2008-07-17T07:51:27.437Z", + "agent": { + "ephemeral_id": "b877f95e-2096-4ded-a613-21e18857b2d1", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.mysql", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.0.254", + "ip": "192.168.0.254", + "port": 3306 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "query", + "agent_id_status": "verified", + "category": [ + "network", + "database" + ], + "created": "2023-09-03T22:21:56.016Z", + "dataset": "zeek.mysql", + "id": "C5Hol527kLMUw36hj3", + "ingested": "2023-09-03T22:21:59Z", + "kind": "event", + "original": "{\"ts\":1216281087.437392,\"uid\":\"C5Hol527kLMUw36hj3\",\"id.orig_h\":\"192.168.0.254\",\"id.orig_p\":56162,\"id.resp_h\":\"192.168.0.254\",\"id.resp_p\":3306,\"cmd\":\"query\",\"arg\":\"select count(*) from foo\",\"success\":true,\"rows\":1}", + "outcome": "success", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/mysql.log" + } + }, + "network": { + "community_id": "1:0HUQbshhYbATQXDHv/ysOs0DlZA=", + "protocol": "mysql", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.0.254" + ] + }, + "source": { + "address": "192.168.0.254", + "ip": "192.168.0.254", + "port": 56162 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-mysql" + ], + "zeek": { + "mysql": { + "arg": "select count(*) from foo", + "cmd": "query", + "rows": 1, + "success": true + }, + "session_id": "C5Hol527kLMUw36hj3" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json b/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json index 1fc47d43c58..8bb1c21b150 100644 --- a/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json +++ b/packages/zeek/data_stream/notice/_dev/test/pipeline/test-notice.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2011-11-04T19:44:35.879Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -72,7 +72,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -137,7 +137,7 @@ { "@timestamp": "2021-03-30T09:49:00.958Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -194,7 +194,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -270,7 +270,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/notice/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/notice/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/notice/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/notice/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml index fb55d08895a..600e1a52192 100644 --- a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: alert - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: intrusion_detection @@ -77,29 +77,29 @@ processors: field: zeek.notice.src target_field: source.address ignore_missing: true - if: ctx?.source?.address == null + if: ctx.source?.address == null - remove: field: zeek.notice.src ignore_missing: true - if: ctx?.zeek?.notice?.src == ctx?.source?.address + if: ctx.zeek?.notice?.src == ctx.source?.address - rename: field: zeek.notice.dst target_field: destination.address ignore_missing: true - if: ctx?.destination?.address == null + if: ctx.destination?.address == null - remove: field: zeek.notice.dst ignore_missing: true - if: ctx?.zeek?.notice?.dst == ctx?.destination?.address + if: ctx.zeek?.notice?.dst == ctx.destination?.address - rename: field: zeek.notice.p target_field: destination.port ignore_missing: true - if: ctx?.destination?.port == null + if: ctx.destination?.port == null - remove: field: zeek.notice.p ignore_missing: true - if: ctx?.zeek?.notice?.p == ctx?.destination?.port + if: ctx.zeek?.notice?.p == ctx.destination?.port - rename: field: zeek.notice.conn target_field: zeek.notice.connnection_id @@ -167,27 +167,27 @@ processors: - set: field: file.size copy_from: zeek.notice.file.total_bytes - if: ctx?.zeek?.notice?.file?.total_bytes != null + if: ctx.zeek?.notice?.file?.total_bytes != null - set: field: file.mime_type copy_from: zeek.notice.file.mime_type - if: ctx?.zeek?.notice?.file?.mime_type != null + if: ctx.zeek?.notice?.file?.mime_type != null - set: field: rule.name copy_from: zeek.notice.note - if: ctx?.zeek?.notice?.note != null + if: ctx.zeek?.notice?.note != null - set: field: rule.description copy_from: zeek.notice.msg - if: ctx?.zeek?.notice?.msg != null + if: ctx.zeek?.notice?.msg != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.notice.ts formats: @@ -237,22 +237,22 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: event.type value: allowed - if: "ctx?.zeek?.notice?.dropped == false" + if: "ctx.zeek?.notice?.dropped == false" - append: field: event.type value: denied - if: "ctx?.zeek?.notice?.dropped == true" + if: "ctx.zeek?.notice?.dropped == true" - community_id: target_field: network.community_id - remove: @@ -263,7 +263,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/notice/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/notice/manifest.yml b/packages/zeek/data_stream/notice/manifest.yml index 59afd2ab57e..af356b0800f 100644 --- a/packages/zeek/data_stream/notice/manifest.yml +++ b/packages/zeek/data_stream/notice/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek notice.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/notice/sample_event.json b/packages/zeek/data_stream/notice/sample_event.json new file mode 100644 index 00000000000..e85e3d0c16b --- /dev/null +++ b/packages/zeek/data_stream/notice/sample_event.json @@ -0,0 +1,85 @@ +{ + "@timestamp": "2019-02-28T22:36:28.426Z", + "agent": { + "ephemeral_id": "53c3c815-81d1-4cf0-9531-a8bc34a9bf72", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.notice", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "207.154.238.205", + "ip": "207.154.238.205" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "intrusion_detection" + ], + "created": "2023-09-03T22:23:22.143Z", + "dataset": "zeek.notice", + "ingested": "2023-09-03T22:23:26Z", + "kind": "alert", + "original": "{\"ts\":1551393388.426472,\"note\":\"Scan::Port_Scan\",\"msg\":\"8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s\",\"sub\":\"remote\",\"src\":\"8.42.77.171\",\"dst\":\"207.154.238.205\",\"peer_descr\":\"bro\",\"actions\":[\"Notice::ACTION_LOG\"],\"suppress_for\":3600.0,\"dropped\":false}", + "type": [ + "info", + "allowed" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/notice.log" + } + }, + "related": { + "ip": [ + "8.42.77.171", + "207.154.238.205" + ] + }, + "rule": { + "description": "8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s", + "name": "Scan::Port_Scan" + }, + "source": { + "address": "8.42.77.171", + "ip": "8.42.77.171" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-notice" + ], + "zeek": { + "notice": { + "actions": [ + "Notice::ACTION_LOG" + ], + "dropped": false, + "msg": "8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s", + "note": "Scan::Port_Scan", + "peer_descr": "bro", + "sub": "remote", + "suppress_for": 3600 + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json b/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json index a52324fba77..5ae1622b3dd 100644 --- a/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json +++ b/packages/zeek/data_stream/ntlm/_dev/test/pipeline/test-ntlm.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -74,7 +74,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ntlm/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ntlm/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ntlm/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ntlm/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml index b0f909bd520..8cbc80c11dd 100644 --- a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -100,11 +100,11 @@ processors: - set: field: user.name copy_from: zeek.ntlm.username - if: ctx?.zeek?.ntlm?.username != null + if: ctx.zeek?.ntlm?.username != null - set: field: user.domain copy_from: zeek.ntlm.domain - if: ctx?.zeek?.ntlm?.domain != null + if: ctx.zeek?.ntlm?.domain != null - set: field: event.id copy_from: zeek.session_id @@ -112,19 +112,19 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: event.outcome value: success - if: ctx?.zeek?.ntlm?.success == true + if: ctx.zeek?.ntlm?.success == true - set: field: event.outcome value: failure - if: ctx?.zeek?.ntlm?.success == false + if: ctx.zeek?.ntlm?.success == false - date: field: zeek.ntlm.ts formats: @@ -134,18 +134,18 @@ processors: field: zeek.ntlm.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - geoip: field: destination.ip @@ -197,7 +197,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ntlm/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ntlm/manifest.yml b/packages/zeek/data_stream/ntlm/manifest.yml index d56238fb0c9..4e19d77302b 100644 --- a/packages/zeek/data_stream/ntlm/manifest.yml +++ b/packages/zeek/data_stream/ntlm/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek ntlm.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ntlm/sample_event.json b/packages/zeek/data_stream/ntlm/sample_event.json new file mode 100644 index 00000000000..f90578b0efc --- /dev/null +++ b/packages/zeek/data_stream/ntlm/sample_event.json @@ -0,0 +1,99 @@ +{ + "@timestamp": "2017-10-25T19:18:37.814Z", + "agent": { + "ephemeral_id": "bfd7cee8-0f7b-4a6b-b876-bd6232411657", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.ntlm", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.10.31", + "ip": "192.168.10.31", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network", + "authentication" + ], + "created": "2023-09-03T22:24:49.513Z", + "dataset": "zeek.ntlm", + "id": "CHphiNUKDC20fsy09", + "ingested": "2023-09-03T22:24:53Z", + "kind": "event", + "original": "{\"ts\":1508959117.814467,\"uid\":\"CHphiNUKDC20fsy09\",\"id.orig_h\":\"192.168.10.50\",\"id.orig_p\":46785,\"id.resp_h\":\"192.168.10.31\",\"id.resp_p\":445,\"username\":\"JeffV\",\"hostname\":\"ybaARon55QykXrgu\",\"domainname\":\"contoso.local\",\"server_nb_computer_name\":\"VICTIM-PC\",\"server_dns_computer_name\":\"Victim-PC.contoso.local\",\"server_tree_name\":\"contoso.local\"}", + "type": [ + "connection", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/ntlm.log" + } + }, + "network": { + "community_id": "1:zxnXAE/Cme5fQhh6sJLs7GItc08=", + "protocol": "ntlm", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.10.50", + "192.168.10.31" + ], + "user": [ + "JeffV" + ] + }, + "source": { + "address": "192.168.10.50", + "ip": "192.168.10.50", + "port": 46785 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ntlm" + ], + "user": { + "domain": "contoso.local", + "name": "JeffV" + }, + "zeek": { + "ntlm": { + "domain": "contoso.local", + "hostname": "ybaARon55QykXrgu", + "server": { + "name": { + "dns": "Victim-PC.contoso.local", + "netbios": "VICTIM-PC", + "tree": "contoso.local" + } + }, + "username": "JeffV" + }, + "session_id": "CHphiNUKDC20fsy09" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json b/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json index 784aa8403e8..49fb2bf6ecd 100644 --- a/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json +++ b/packages/zeek/data_stream/ntp/_dev/test/pipeline/test-ntp.log-expected.json @@ -26,10 +26,12 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "CqlPpF1AQVLMPgGiL5", "kind": "event", @@ -122,10 +124,12 @@ "port": 123 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "CqlPpF1AQVLMPgGiL5", "kind": "event", diff --git a/packages/zeek/data_stream/ntp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ntp/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ntp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ntp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml index 87fc5ad858c..a44b8669759 100644 --- a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/default.yml @@ -24,13 +24,13 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event - set: field: event.category - value: network + value: [network] - append: field: event.type value: @@ -77,11 +77,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: network.transport value: udp @@ -129,13 +129,13 @@ processors: if: ctx.zeek.session_id != null - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.ip != null + value: "{{{source.ip}}}" + if: ctx.source?.ip != null allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - geoip: field: destination.ip @@ -184,7 +184,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ntp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ntp/manifest.yml b/packages/zeek/data_stream/ntp/manifest.yml index f450b993be3..0fc8958ad84 100644 --- a/packages/zeek/data_stream/ntp/manifest.yml +++ b/packages/zeek/data_stream/ntp/manifest.yml @@ -38,7 +38,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. - input: httpjson title: Zeek ntp logs via Splunk Enterprise REST API @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ntp/sample_event.json b/packages/zeek/data_stream/ntp/sample_event.json new file mode 100644 index 00000000000..e8442db665d --- /dev/null +++ b/packages/zeek/data_stream/ntp/sample_event.json @@ -0,0 +1,96 @@ +{ + "@timestamp": "2020-10-08T00:29:07.977Z", + "agent": { + "ephemeral_id": "714c8749-4327-4e23-8492-927399fbe4fd", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.ntp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "208.79.89.249", + "ip": "208.79.89.249", + "port": 123 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:26:15.481Z", + "dataset": "zeek.ntp", + "id": "CqlPpF1AQVLMPgGiL5", + "ingested": "2023-09-03T22:26:19Z", + "kind": "event", + "original": "{\"ts\":1602116947.977,\"uid\":\"CqlPpF1AQVLMPgGiL5\",\"id.orig_h\":\"130.118.205.62\",\"id.orig_p\":38461,\"id.resp_h\":\"208.79.89.249\",\"id.resp_p\":123,\"version\":4,\"mode\":3,\"stratum\":0,\"poll\":1,\"precision\":1,\"root_delay\":0,\"root_disp\":0,\"ref_id\":\"\\\\x00\\\\x00\\\\x00\\\\x00\",\"ref_time\":0,\"org_time\":0,\"rec_time\":0,\"xmt_time\":1602116947.215,\"num_exts\":0}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/ntp.log" + } + }, + "network": { + "community_id": "1:IDiKR+C1G8mk7LQhFpp+4p1tHrk=", + "protocol": "ntp", + "transport": "udp", + "type": "ipv4" + }, + "related": { + "ip": [ + "130.118.205.62", + "208.79.89.249" + ] + }, + "source": { + "address": "130.118.205.62", + "ip": "130.118.205.62", + "port": 38461 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ntp" + ], + "zeek": { + "ntp": { + "mode": 3, + "num_exts": 0, + "org_time": "1970-01-01T00:00:00.000Z", + "poll": 1, + "precision": 1, + "rec_time": "1970-01-01T00:00:00.000Z", + "ref_id": "\\x00\\x00\\x00\\x00", + "ref_time": "1970-01-01T00:00:00.000Z", + "root_delay": 0, + "root_disp": 0, + "stratum": 0, + "version": 4, + "xmt_time": "2020-10-08T00:29:07.215Z" + }, + "session_id": "CqlPpF1AQVLMPgGiL5" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json b/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json index 952f52b3368..7fd2cca7fd2 100644 --- a/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json +++ b/packages/zeek/data_stream/ocsp/_dev/test/pipeline/test-ocsp.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2011-06-10T13:27:01.847Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -41,7 +41,7 @@ { "@timestamp": "2011-06-08T19:46:56.100Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -76,7 +76,7 @@ { "@timestamp": "2011-06-08T19:46:56.100Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/ocsp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ocsp/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ocsp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ocsp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml index 668828714ac..a0968292ecf 100644 --- a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: network.transport value: tcp @@ -100,17 +100,17 @@ processors: if: ctx.zeek.ocsp.update?.next != null - append: field: related.hash - value: "{{zeek.ocsp.issuerNameHash}}" - if: "ctx?.zeek?.ocsp?.issuerNameHash != null" + value: "{{{zeek.ocsp.issuerNameHash}}}" + if: "ctx.zeek?.ocsp?.issuerNameHash != null" allow_duplicates: false - append: field: related.hash - value: "{{zeek.ocsp.issuerKeyHash}}" - if: "ctx?.zeek?.ocsp?.issuerKeyHash != null" + value: "{{{zeek.ocsp.issuerKeyHash}}}" + if: "ctx.zeek?.ocsp?.issuerKeyHash != null" allow_duplicates: false - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ocsp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ocsp/manifest.yml b/packages/zeek/data_stream/ocsp/manifest.yml index 6cca1eabd2e..dffa848350a 100644 --- a/packages/zeek/data_stream/ocsp/manifest.yml +++ b/packages/zeek/data_stream/ocsp/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek ocsp.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ocsp/sample_event.json b/packages/zeek/data_stream/ocsp/sample_event.json new file mode 100644 index 00000000000..ae62cc56f15 --- /dev/null +++ b/packages/zeek/data_stream/ocsp/sample_event.json @@ -0,0 +1,68 @@ +{ + "@timestamp": "2011-06-08T19:46:56.100Z", + "agent": { + "ephemeral_id": "cf50673d-9b8c-4748-8b74-73d63c68fdb9", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.ocsp", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-09-03T22:27:41.540Z", + "dataset": "zeek.ocsp", + "ingested": "2023-09-03T22:27:45Z", + "kind": "event", + "original": "{\"ts\":1307562416.100084,\"id\":\"FdZBFMEYgAErVhoC8\",\"hashAlgorithm\":\"sha1\",\"issuerNameHash\":\"6C2BC55AAF8D96BF60ADF81D023F23B48A0059C2\",\"issuerKeyHash\":\"A5EF0B11CEC04103A34A659048B21CE0572D7D47\",\"serialNumber\":\"30119E6EF41BDBA3FEFE711DBE8F6191\",\"certStatus\":\"good\",\"thisUpdate\":1307549998.0,\"nextUpdate\":1308154798.0}" + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/oscp.log" + } + }, + "network": { + "transport": "tcp" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ocsp" + ], + "zeek": { + "ocsp": { + "file_id": "FdZBFMEYgAErVhoC8", + "hash": { + "algorithm": "sha1", + "issuer": { + "key": "A5EF0B11CEC04103A34A659048B21CE0572D7D47", + "name": "6C2BC55AAF8D96BF60ADF81D023F23B48A0059C2" + } + }, + "serial_number": "30119E6EF41BDBA3FEFE711DBE8F6191", + "status": "good", + "update": { + "next": "2011-06-15T16:19:58.000Z", + "this": "2011-06-08T16:19:58.000Z" + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json b/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json index 4ae549eb33e..9174aac75d8 100644 --- a/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json +++ b/packages/zeek/data_stream/pe/_dev/test/pipeline/test-pe.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2017-10-09T16:13:19.578Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -49,7 +49,7 @@ { "@timestamp": "2017-10-09T16:13:19.578Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/pe/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/pe/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/pe/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/pe/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml index 71f6a638508..aa56a960fd4 100644 --- a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: file @@ -53,7 +53,7 @@ processors: if: ctx.zeek.pe.compile_time != null - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/pe/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/pe/manifest.yml b/packages/zeek/data_stream/pe/manifest.yml index 529d8abb401..51253dc906d 100644 --- a/packages/zeek/data_stream/pe/manifest.yml +++ b/packages/zeek/data_stream/pe/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek pe.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/pe/sample_event.json b/packages/zeek/data_stream/pe/sample_event.json new file mode 100644 index 00000000000..1262436c9bd --- /dev/null +++ b/packages/zeek/data_stream/pe/sample_event.json @@ -0,0 +1,79 @@ +{ + "@timestamp": "2017-10-09T16:13:19.578Z", + "agent": { + "ephemeral_id": "4b3ea0f7-24ce-481f-9d13-68410a01c685", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.pe", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "file" + ], + "created": "2023-09-03T22:29:05.666Z", + "dataset": "zeek.pe", + "ingested": "2023-09-03T22:29:09Z", + "kind": "event", + "original": "{\"ts\":1507565599.578328,\"id\":\"FtIFnm3ZqI1s96P74l\",\"machine\":\"I386\",\"compile_ts\":1467139314.0,\"os\":\"Windows XP\",\"subsystem\":\"WINDOWS_CUI\",\"is_exe\":true,\"is_64bit\":false,\"uses_aslr\":true,\"uses_dep\":true,\"uses_code_integrity\":false,\"uses_seh\":true,\"has_import_table\":true,\"has_export_table\":false,\"has_cert_table\":true,\"has_debug_data\":false,\"section_names\":[\".text\",\".rdata\",\".data\",\".rsrc\",\".reloc\"]}", + "type": [ + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/pe.log" + } + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-pe" + ], + "zeek": { + "pe": { + "compile_time": "2016-06-28T18:41:54.000Z", + "has_cert_table": true, + "has_debug_data": false, + "has_export_table": false, + "has_import_table": true, + "id": "FtIFnm3ZqI1s96P74l", + "is_64bit": false, + "is_exe": true, + "machine": "I386", + "os": "Windows XP", + "section_names": [ + ".text", + ".rdata", + ".data", + ".rsrc", + ".reloc" + ], + "subsystem": "WINDOWS_CUI", + "uses_aslr": true, + "uses_code_integrity": false, + "uses_dep": true, + "uses_seh": true + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json b/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json index 23e13f65f01..1414dc9f806 100644 --- a/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json +++ b/packages/zeek/data_stream/radius/_dev/test/pipeline/test-radius.log-expected.json @@ -8,7 +8,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -67,7 +67,7 @@ "port": 1812 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/radius/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/radius/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/radius/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/radius/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml index ded27a4bd69..2b9a28a4f8a 100644 --- a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -84,23 +84,23 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: user.name copy_from: zeek.radius.username - if: ctx?.zeek?.radius?.username != null + if: ctx.zeek?.radius?.username != null - set: field: event.outcome copy_from: zeek.radius.result - if: ctx?.zeek?.radius?.result != null + if: ctx.zeek?.radius?.result != null - date: field: zeek.radius.ts formats: @@ -110,13 +110,13 @@ processors: field: zeek.radius.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - geoip: field: destination.ip @@ -160,8 +160,8 @@ processors: ignore_missing: true - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -171,7 +171,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/radius/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/radius/manifest.yml b/packages/zeek/data_stream/radius/manifest.yml index b703d8bfce3..eb04ca4ce0a 100644 --- a/packages/zeek/data_stream/radius/manifest.yml +++ b/packages/zeek/data_stream/radius/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek radius.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/radius/sample_event.json b/packages/zeek/data_stream/radius/sample_event.json new file mode 100644 index 00000000000..8e99c96ca63 --- /dev/null +++ b/packages/zeek/data_stream/radius/sample_event.json @@ -0,0 +1,92 @@ +{ + "@timestamp": "2008-08-01T22:52:17.916Z", + "agent": { + "ephemeral_id": "a2b06ca0-1e63-4e83-b34b-b4ac3c6eb425", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.radius", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "10.0.0.100", + "ip": "10.0.0.100", + "port": 1812 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network", + "authentication" + ], + "created": "2023-09-03T22:30:30.746Z", + "dataset": "zeek.radius", + "id": "CRe9VD3flCDWbPmpIh", + "ingested": "2023-09-03T22:30:34Z", + "kind": "event", + "original": "{\"ts\":1217631137.916736,\"uid\":\"CRe9VD3flCDWbPmpIh\",\"id.orig_h\":\"10.0.0.1\",\"id.orig_p\":1645,\"id.resp_h\":\"10.0.0.100\",\"id.resp_p\":1812,\"username\":\"John.McGuirk\",\"mac\":\"00:14:22:e9:54:5e\",\"result\":\"success\"}", + "outcome": "success", + "type": [ + "connection", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/radius.log" + } + }, + "network": { + "community_id": "1:3SdDgWXPnheV2oGfVmxQjfwtr8E=", + "protocol": "radius", + "transport": "udp" + }, + "related": { + "ip": [ + "10.0.0.1", + "10.0.0.100" + ], + "user": [ + "John.McGuirk" + ] + }, + "source": { + "address": "10.0.0.1", + "ip": "10.0.0.1", + "port": 1645 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-radius" + ], + "user": { + "name": "John.McGuirk" + }, + "zeek": { + "radius": { + "mac": "00:14:22:e9:54:5e", + "result": "success", + "username": "John.McGuirk" + }, + "session_id": "CRe9VD3flCDWbPmpIh" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json b/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json index e7f347a46ac..ed4d376e363 100644 --- a/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json +++ b/packages/zeek/data_stream/rdp/_dev/test/pipeline/test-rdp.log-expected.json @@ -8,7 +8,7 @@ "port": 3389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -65,7 +65,7 @@ "port": 3389 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/rdp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/rdp/agent/stream/httpjson.yml.hbs index 27d1775b514..5b6f50fb8fa 100644 --- a/packages/zeek/data_stream/rdp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/rdp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml index 09d532f1764..8327bc7186c 100644 --- a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -85,11 +85,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.rdp.client_build target_field: zeek.rdp.client.build @@ -188,13 +188,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -204,7 +204,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/rdp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/rdp/manifest.yml b/packages/zeek/data_stream/rdp/manifest.yml index 02303490edd..655c35785dd 100644 --- a/packages/zeek/data_stream/rdp/manifest.yml +++ b/packages/zeek/data_stream/rdp/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek rdp.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/rdp/sample_event.json b/packages/zeek/data_stream/rdp/sample_event.json new file mode 100644 index 00000000000..1a82f01dc67 --- /dev/null +++ b/packages/zeek/data_stream/rdp/sample_event.json @@ -0,0 +1,90 @@ +{ + "@timestamp": "2019-09-10T16:18:59.668Z", + "agent": { + "ephemeral_id": "e61d9b9c-0eb8-42d9-8712-87cd426a6f53", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.rdp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.131.131", + "ip": "192.168.131.131", + "port": 3389 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:31:57.037Z", + "dataset": "zeek.rdp", + "id": "C2PcYV7D3ntaHm056", + "ingested": "2023-09-03T22:32:00Z", + "kind": "event", + "original": "{\"ts\":1568132339.668952,\"uid\":\"C2PcYV7D3ntaHm056\",\"id.orig_h\":\"192.168.131.1\",\"id.orig_p\":33872,\"id.resp_h\":\"192.168.131.131\",\"id.resp_p\":3389,\"result\":\"encrypted\",\"security_protocol\":\"HYBRID\",\"cert_count\":0,\"ssl\":true}", + "type": [ + "protocol", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/rdp.log" + } + }, + "network": { + "community_id": "1:PsQu6lSZioPVi0A5K7UaeGsVqS0=", + "protocol": "rdp", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.131.1", + "192.168.131.131" + ] + }, + "source": { + "address": "192.168.131.1", + "ip": "192.168.131.1", + "port": 33872 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-rdp" + ], + "tls": { + "established": true + }, + "zeek": { + "rdp": { + "cert": { + "count": 0 + }, + "result": "encrypted", + "security_protocol": "HYBRID", + "ssl": true + }, + "session_id": "C2PcYV7D3ntaHm056" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json b/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json index d71e8d08a79..d0cf60d3234 100644 --- a/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json +++ b/packages/zeek/data_stream/rfb/_dev/test/pipeline/test-rfb.log-expected.json @@ -8,7 +8,7 @@ "port": 5900 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -74,7 +74,7 @@ "port": 5900 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/rfb/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/rfb/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/rfb/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/rfb/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml index e606b27aa86..8480414c0e3 100644 --- a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -85,11 +85,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.rfb.client_major_version target_field: zeek.rfb.version.client.major @@ -123,13 +123,13 @@ processors: field: zeek.rfb.ts - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - geoip: field: destination.ip @@ -179,7 +179,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/rfb/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/rfb/manifest.yml b/packages/zeek/data_stream/rfb/manifest.yml index b5513bb69d9..13cb27abda1 100644 --- a/packages/zeek/data_stream/rfb/manifest.yml +++ b/packages/zeek/data_stream/rfb/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek rfb.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/rfb/sample_event.json b/packages/zeek/data_stream/rfb/sample_event.json new file mode 100644 index 00000000000..e2db81748fc --- /dev/null +++ b/packages/zeek/data_stream/rfb/sample_event.json @@ -0,0 +1,99 @@ +{ + "@timestamp": "2012-02-07T16:35:34.517Z", + "agent": { + "ephemeral_id": "5fc13010-f06a-46e5-acba-6dfb69102664", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.rfb", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.10", + "ip": "192.168.1.10", + "port": 5900 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:33:24.069Z", + "dataset": "zeek.rfb", + "id": "CXoIzM3wH3fUwXtKN1", + "ingested": "2023-09-03T22:33:27Z", + "kind": "event", + "original": "{\"ts\":1328632534.517208,\"uid\":\"CXoIzM3wH3fUwXtKN1\",\"id.orig_h\":\"192.168.1.123\",\"id.orig_p\":58102,\"id.resp_h\":\"192.168.1.10\",\"id.resp_p\":5900,\"client_major_version\":\"003\",\"client_minor_version\":\"008\",\"server_major_version\":\"003\",\"server_minor_version\":\"008\",\"authentication_method\":\"VNC\",\"auth\":true,\"share_flag\":false,\"desktop_name\":\"\\u00a0\",\"width\":800,\"height\":600}", + "type": [ + "connection", + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/rfb.log" + } + }, + "network": { + "community_id": "1:AtPVA5phuztnwqMfO/2142WXVdY=", + "protocol": "rfb", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.1.123", + "192.168.1.10" + ] + }, + "source": { + "address": "192.168.1.123", + "ip": "192.168.1.123", + "port": 58102 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-rfb" + ], + "zeek": { + "rfb": { + "auth": { + "method": "VNC", + "success": true + }, + "desktop_name": " ", + "height": 600, + "share_flag": false, + "version": { + "client": { + "major": "003", + "minor": "008" + }, + "server": { + "major": "003", + "minor": "008" + } + }, + "width": 800 + }, + "session_id": "CXoIzM3wH3fUwXtKN1" + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json b/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json index 20f8e8b86b3..b8e2435cdb6 100644 --- a/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json +++ b/packages/zeek/data_stream/signature/_dev/test/pipeline/test-signature.log-expected.json @@ -26,10 +26,12 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { - "category": "network", + "category": [ + "network" + ], "created": "2020-04-28T11:07:58.223Z", "id": "CbjAXE4CBxJ8W7VoJg", "kind": "alert", diff --git a/packages/zeek/data_stream/signature/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/signature/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/signature/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/signature/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml index a50aaac66ff..dfdfb7fda2b 100644 --- a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/default.yml @@ -24,13 +24,13 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: alert - set: field: event.category - value: network + value: [network] - rename: field: zeek.signature.src_addr target_field: source.address @@ -62,11 +62,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.signature.ts formats: @@ -86,13 +86,13 @@ processors: if: ctx.source?.ip.contains(':') - append: field: related.ip - value: "{{source.ip}}" - if: ctx?.source?.ip != null + value: "{{{source.ip}}}" + if: ctx.source?.ip != null allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: ctx?.destination?.ip != null + value: "{{{destination.ip}}}" + if: ctx.destination?.ip != null allow_duplicates: false - geoip: field: destination.ip @@ -140,7 +140,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/signature/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/signature/manifest.yml b/packages/zeek/data_stream/signature/manifest.yml index bd9ca42ed43..b029bd8237f 100644 --- a/packages/zeek/data_stream/signature/manifest.yml +++ b/packages/zeek/data_stream/signature/manifest.yml @@ -38,7 +38,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. - input: httpjson title: Zeek signature logs via Splunk Enterprise REST API @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/signature/sample_event.json b/packages/zeek/data_stream/signature/sample_event.json new file mode 100644 index 00000000000..fd426d71e71 --- /dev/null +++ b/packages/zeek/data_stream/signature/sample_event.json @@ -0,0 +1,81 @@ +{ + "@timestamp": "2021-01-28T16:53:29.869Z", + "agent": { + "ephemeral_id": "4f1481a1-013e-4e2a-8835-9c7d6a519ac5", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.signature", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "160.218.27.63", + "ip": "160.218.27.63", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:34:49.633Z", + "dataset": "zeek.signature", + "id": "CbjAXE4CBxJ8W7VoJg", + "ingested": "2023-09-03T22:34:53Z", + "kind": "alert", + "original": "{\"ts\":1611852809.869245,\"uid\":\"CbjAXE4CBxJ8W7VoJg\",\"src_addr\":\"124.51.137.154\",\"src_port\":51617,\"dst_addr\":\"160.218.27.63\",\"dst_port\":445,\"note\":\"Signatures::Sensitive_Signature\",\"sig_id\":\"my-second-sig\",\"event_msg\":\"124.51.137.154:TCP traffic\",\"sub_msg\":\"\"}" + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/signature.log" + } + }, + "network": { + "type": "ipv4" + }, + "related": { + "ip": [ + "124.51.137.154", + "160.218.27.63" + ] + }, + "rule": { + "description": "124.51.137.154:TCP traffic", + "id": "my-second-sig" + }, + "source": { + "address": "124.51.137.154", + "ip": "124.51.137.154", + "port": 51617 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-signature" + ], + "zeek": { + "session_id": "CbjAXE4CBxJ8W7VoJg", + "signature": { + "note": "Signatures::Sensitive_Signature", + "sub_msg": "" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json b/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json index bb9976dfbc1..1d784a4ddb9 100644 --- a/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json +++ b/packages/zeek/data_stream/sip/_dev/test/pipeline/test-sip.log-expected.json @@ -26,7 +26,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REGISTER", @@ -40,8 +40,7 @@ "outcome": "failure", "type": [ "connection", - "protocol", - "error" + "protocol" ] }, "network": { @@ -126,7 +125,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "INVITE", @@ -245,7 +244,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REGISTER", @@ -343,7 +342,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OPTIONS", @@ -432,7 +431,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "OPTIONS", @@ -539,7 +538,7 @@ "port": 5060 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "REGISTER", diff --git a/packages/zeek/data_stream/sip/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/sip/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/sip/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/sip/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml index 586336c1d03..a7038ab4624 100644 --- a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -85,11 +85,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.sip.trans_depth target_field: zeek.sip.transaction_depth @@ -141,11 +141,11 @@ processors: - set: field: event.action copy_from: zeek.sip.sequence.method - if: ctx?.zeek?.sip?.sequence?.method != null + if: ctx.zeek?.sip?.sequence?.method != null - set: field: url.full copy_from: zeek.sip.uri - if: ctx?.zeek?.sip?.uri != null + if: ctx.zeek?.sip?.uri != null - date: field: zeek.sip.ts formats: @@ -203,26 +203,22 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - - append: - field: event.type - value: error - if: "ctx?.zeek?.sip?.status?.code != null && ctx.zeek.sip.status.code >= 400" - set: field: event.outcome value: failure - if: "ctx?.zeek?.sip?.status?.code != null && ctx.zeek.sip.status.code >= 400" + if: "ctx.zeek?.sip?.status?.code != null && ctx.zeek.sip.status.code >= 400" - set: field: event.outcome value: success - if: "ctx?.zeek?.sip?.status?.code != null && ctx.zeek.sip.status.code < 400" + if: "ctx.zeek?.sip?.status?.code != null && ctx.zeek.sip.status.code < 400" - community_id: target_field: network.community_id - remove: @@ -231,7 +227,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/sip/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/sip/manifest.yml b/packages/zeek/data_stream/sip/manifest.yml index d922c5d29ce..5a1fe1f6b63 100644 --- a/packages/zeek/data_stream/sip/manifest.yml +++ b/packages/zeek/data_stream/sip/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek sip.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/sip/sample_event.json b/packages/zeek/data_stream/sip/sample_event.json new file mode 100644 index 00000000000..434eca99149 --- /dev/null +++ b/packages/zeek/data_stream/sip/sample_event.json @@ -0,0 +1,114 @@ +{ + "@timestamp": "2005-01-14T17:58:07.022Z", + "agent": { + "ephemeral_id": "af1b1242-fd01-41b3-8f34-c1bce9519893", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.sip", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "200.57.7.195", + "ip": "200.57.7.195", + "port": 5060 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "REGISTER", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:36:09.257Z", + "dataset": "zeek.sip", + "id": "CJZDWgixtwqXctWEg", + "ingested": "2023-09-03T22:36:13Z", + "kind": "event", + "original": "{\"ts\":1105725487.022577,\"uid\":\"CJZDWgixtwqXctWEg\",\"id.orig_h\":\"200.57.7.205\",\"id.orig_p\":5061,\"id.resp_h\":\"200.57.7.195\",\"id.resp_p\":5060,\"trans_depth\":0,\"method\":\"REGISTER\",\"uri\":\"sip:Verso.com\",\"request_from\":\"Ivan \u003csip:Ivan@Verso.com\u003e\",\"request_to\":\"Ivan \u003csip:Ivan@Verso.com\u003e\",\"response_from\":\"\\u0022Ivan\\u0022 \u003csip:Ivan@Verso.com\u003e\",\"response_to\":\"\\u0022Ivan\\u0022 \u003csip:Ivan@Verso.com\u003e\",\"call_id\":\"46E1C3CB36304F84A020CF6DD3F96461@Verso.com\",\"seq\":\"37764 REGISTER\",\"request_path\":[\"SIP/2.0/UDP 200.57.7.205:5061;rport\"],\"response_path\":[\"SIP/2.0/UDP 200.57.7.205:5061;received=200.57.7.205;rport=5061\"],\"user_agent\":\"Verso Softphone release 1104w\",\"status_code\":200,\"status_msg\":\"OK\",\"request_body_len\":0,\"response_body_len\":0}", + "outcome": "success", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/sip.log" + } + }, + "network": { + "community_id": "1:0hvHF/bh5wFKg7nfRXxsno4F198=", + "protocol": "sip", + "transport": "udp" + }, + "related": { + "ip": [ + "200.57.7.205", + "200.57.7.195" + ] + }, + "source": { + "address": "200.57.7.205", + "ip": "200.57.7.205", + "port": 5061 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-sip" + ], + "url": { + "full": "sip:Verso.com" + }, + "zeek": { + "session_id": "CJZDWgixtwqXctWEg", + "sip": { + "call_id": "46E1C3CB36304F84A020CF6DD3F96461@Verso.com", + "request": { + "body_length": 0, + "from": "Ivan \u003csip:Ivan@Verso.com\u003e", + "path": [ + "SIP/2.0/UDP 200.57.7.205:5061;rport" + ], + "to": "Ivan \u003csip:Ivan@Verso.com\u003e" + }, + "response": { + "body_length": 0, + "from": "\"Ivan\" \u003csip:Ivan@Verso.com\u003e", + "path": [ + "SIP/2.0/UDP 200.57.7.205:5061;received=200.57.7.205;rport=5061" + ], + "to": "\"Ivan\" \u003csip:Ivan@Verso.com\u003e" + }, + "sequence": { + "method": "REGISTER", + "number": "37764" + }, + "status": { + "code": 200, + "msg": "OK" + }, + "transaction_depth": 0, + "uri": "sip:Verso.com", + "user_agent": "Verso Softphone release 1104w" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json b/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json index 7ca282e4124..1aac51797e5 100644 --- a/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json +++ b/packages/zeek/data_stream/smb_cmd/_dev/test/pipeline/test-smb-cmd.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NT_CREATE_ANDX", @@ -74,7 +74,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "NT_CREATE_ANDX", diff --git a/packages/zeek/data_stream/smb_cmd/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/smb_cmd/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/smb_cmd/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/smb_cmd/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml index c4031aeb2f6..a56448f459b 100644 --- a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -115,7 +115,7 @@ processors: - zeek.smb_cmd.referenced_file.id.orig_h - zeek.smb_cmd.referenced_file.id.resp_h ignore_missing: true - if: ctx?.zeek?.smb_cmd?.referenced_file?.action == null + if: ctx.zeek?.smb_cmd?.referenced_file?.action == null - dot_expander: path: zeek.smb_cmd field: id.orig_p @@ -155,15 +155,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.smb_cmd.referenced_file.uid target_field: zeek.smb_cmd.file.uid @@ -191,11 +191,11 @@ processors: - set: field: event.action copy_from: zeek.smb_cmd.command - if: ctx?.zeek?.smb_cmd?.command != null + if: ctx.zeek?.smb_cmd?.command != null - set: field: user.name copy_from: zeek.smb_cmd.username - if: ctx?.zeek?.smb_cmd?.username != null + if: ctx.zeek?.smb_cmd?.username != null - date: field: zeek.smb_cmd.ts formats: @@ -248,31 +248,31 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - append: field: event.type value: error - if: "ctx?.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() != 'success'" + if: "ctx.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() != 'success'" - set: field: event.outcome value: success - if: "ctx?.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() == 'success'" + if: "ctx.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() == 'success'" - set: field: event.outcome value: failure - if: "ctx?.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() != 'success'" + if: "ctx.zeek?.smb_cmd?.status != null && ctx.zeek.smb_cmd.status.toLowerCase() != 'success'" - community_id: target_field: network.community_id - remove: @@ -281,7 +281,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/smb_cmd/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/smb_cmd/manifest.yml b/packages/zeek/data_stream/smb_cmd/manifest.yml index 835b2e365ed..53cbe1b43bd 100644 --- a/packages/zeek/data_stream/smb_cmd/manifest.yml +++ b/packages/zeek/data_stream/smb_cmd/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek smb_cmd.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/smb_cmd/sample_event.json b/packages/zeek/data_stream/smb_cmd/sample_event.json new file mode 100644 index 00000000000..4465b4ebab1 --- /dev/null +++ b/packages/zeek/data_stream/smb_cmd/sample_event.json @@ -0,0 +1,99 @@ +{ + "@timestamp": "2013-02-26T22:05:32.020Z", + "agent": { + "ephemeral_id": "83b6373a-db3f-4a41-9fa5-4692c6dfbb9b", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.smb_cmd", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "172.16.128.202", + "ip": "172.16.128.202", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "NT_CREATE_ANDX", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:37:37.597Z", + "dataset": "zeek.smb_cmd", + "id": "CbT8mpAXseu6Pt4R7", + "ingested": "2023-09-03T22:37:41Z", + "kind": "event", + "original": "{\"ts\":1361916332.020006,\"uid\":\"CbT8mpAXseu6Pt4R7\",\"id.orig_h\":\"172.16.133.6\",\"id.orig_p\":1728,\"id.resp_h\":\"172.16.128.202\",\"id.resp_p\":445,\"command\":\"NT_CREATE_ANDX\",\"argument\":\"\\u005cbrowser\",\"status\":\"SUCCESS\",\"rtt\":0.091141,\"version\":\"SMB1\",\"tree\":\"\\u005c\\u005cJSRVR20\\u005cIPC$\",\"tree_service\":\"IPC\",\"referenced_file.ts\":1361916332.020006,\"referenced_file.uid\":\"CbT8mpAXseu6Pt4R7\",\"referenced_file.id.orig_h\":\"172.16.133.6\",\"referenced_file.id.orig_p\":1728,\"referenced_file.id.resp_h\":\"172.16.128.202\",\"referenced_file.id.resp_p\":445,\"referenced_file.action\":\"SMB::FILE_OPEN\",\"referenced_file.name\":\"\\u005cbrowser\",\"referenced_file.size\":0}", + "outcome": "success", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/smb_cmd.log" + } + }, + "network": { + "community_id": "1:SJNAD5vtzZuhQjGtfaI8svTnyuw=", + "protocol": "smb", + "transport": "tcp" + }, + "related": { + "ip": [ + "172.16.133.6", + "172.16.128.202" + ] + }, + "source": { + "address": "172.16.133.6", + "ip": "172.16.133.6", + "port": 1728 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-smb-cmd" + ], + "zeek": { + "session_id": "CbT8mpAXseu6Pt4R7", + "smb_cmd": { + "argument": "\\browser", + "command": "NT_CREATE_ANDX", + "file": { + "action": "SMB::FILE_OPEN", + "host": { + "rx": "172.16.128.202", + "tx": "172.16.133.6" + }, + "name": "\\browser", + "uid": "CbT8mpAXseu6Pt4R7" + }, + "rtt": 0.091141, + "status": "SUCCESS", + "tree": "\\\\JSRVR20\\IPC$", + "tree_service": "IPC", + "version": "SMB1" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json b/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json index 355817196e6..866ac09ab06 100644 --- a/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json +++ b/packages/zeek/data_stream/smb_files/_dev/test/pipeline/test-smb-files.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SMB::FILE_OPEN", @@ -32,7 +32,7 @@ "ctime": "2017-10-09T16:13:19.607Z", "mtime": "2017-10-09T16:13:19.607Z", "name": "PSEXESVC.exe", - "path": "\\\\\\\\admin-pc\\\\ADMIN$\\PSEXESVC.exe", + "path": "\\\\admin-pc\\ADMIN$\\PSEXESVC.exe", "size": 0 }, "network": { @@ -78,7 +78,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "SMB::FILE_OPEN", @@ -102,7 +102,7 @@ "ctime": "2017-10-09T16:13:19.607Z", "mtime": "2017-10-09T16:13:19.607Z", "name": "PSEXESVC.exe", - "path": "\\\\\\\\admin-pc\\\\ADMIN$\\PSEXESVC.exe", + "path": "\\\\admin-pc\\ADMIN$\\PSEXESVC.exe", "size": 0 }, "host": { diff --git a/packages/zeek/data_stream/smb_files/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/smb_files/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/smb_files/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/smb_files/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml index 4c5bcb09cdf..fea89b658d9 100644 --- a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -84,27 +84,27 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: event.action copy_from: zeek.smb_files.action - if: ctx?.zeek?.smb_files?.action != null + if: ctx.zeek?.smb_files?.action != null - set: field: file.name copy_from: zeek.smb_files.name - if: ctx?.zeek?.smb_files?.name != null + if: ctx.zeek?.smb_files?.name != null - set: field: file.size copy_from: zeek.smb_files.size - if: ctx?.zeek?.smb_files?.size != null + if: ctx.zeek?.smb_files?.size != null - date: field: zeek.smb_files.ts formats: @@ -133,8 +133,8 @@ processors: if: ctx.zeek.smb_files.times?.accessed != null - set: field: file.accessed - value: "{{zeek.smb_files.times.accessed}}" - if: "ctx?.zeek?.smb_files?.times?.accessed != null" + value: "{{{zeek.smb_files.times.accessed}}}" + if: "ctx.zeek?.smb_files?.times?.accessed != null" - date: field: zeek.smb_files.times.changed target_field: zeek.smb_files.times.changed @@ -144,8 +144,8 @@ processors: if: ctx.zeek.smb_files.times?.accessed != null - set: field: file.ctime - value: "{{zeek.smb_files.times.changed}}" - if: "ctx?.zeek?.smb_files?.times?.changed != null" + value: "{{{zeek.smb_files.times.changed}}}" + if: "ctx.zeek?.smb_files?.times?.changed != null" - date: field: zeek.smb_files.times.created target_field: zeek.smb_files.times.created @@ -155,8 +155,8 @@ processors: if: ctx.zeek.smb_files.times?.accessed != null - set: field: file.created - value: "{{zeek.smb_files.times.created}}" - if: "ctx?.zeek?.smb_files?.times?.created != null" + value: "{{{zeek.smb_files.times.created}}}" + if: "ctx.zeek?.smb_files?.times?.created != null" - date: field: zeek.smb_files.times.modified target_field: zeek.smb_files.times.modified @@ -166,8 +166,8 @@ processors: if: ctx.zeek.smb_files.times?.accessed != null - set: field: file.mtime - value: "{{zeek.smb_files.times.modified}}" - if: "ctx?.zeek?.smb_files?.times?.modified != null" + value: "{{{zeek.smb_files.times.modified}}}" + if: "ctx.zeek?.smb_files?.times?.modified != null" - geoip: field: destination.ip target_field: destination.geo @@ -210,35 +210,35 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - set: field: file.path - value: "{{zeek.smb_files.path}}\\{{zeek.smb_files.name}}" - if: "ctx?.zeek?.smb_files?.path != null && ctx?.zeek?.smb_files?.name != null" + value: "{{{zeek.smb_files.path}}}\\{{{zeek.smb_files.name}}}" + if: "ctx.zeek?.smb_files?.path != null && ctx.zeek?.smb_files?.name != null" - append: field: event.type value: deletion - if: "ctx?.zeek?.smb_files?.action == 'SMB::FILE_DELETE'" + if: "ctx.zeek?.smb_files?.action == 'SMB::FILE_DELETE'" - append: field: event.type value: change - if: "ctx?.zeek?.smb_files?.action == 'SMB::FILE_RENAME' || ctx?.zeek?.smb_files?.action == 'SMB::FILE_SET_ATTRIBUTE'" + if: "ctx.zeek?.smb_files?.action == 'SMB::FILE_RENAME' || ctx.zeek?.smb_files?.action == 'SMB::FILE_SET_ATTRIBUTE'" - append: field: event.type value: info - if: "ctx?.zeek?.smb_files?.action != null && ctx.zeek.smb_files != 'SMB::FILE_DELETE' && ctx.zeek.smb_files != 'SMB::FILE_RENAME' && ctx.zeek.smb_files != 'SMB::FILE_SET_ATTRIBUTE'" + if: "ctx.zeek?.smb_files?.action != null && ctx.zeek.smb_files != 'SMB::FILE_DELETE' && ctx.zeek.smb_files != 'SMB::FILE_RENAME' && ctx.zeek.smb_files != 'SMB::FILE_SET_ATTRIBUTE'" - community_id: target_field: network.community_id - remove: @@ -247,7 +247,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/smb_files/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/smb_files/manifest.yml b/packages/zeek/data_stream/smb_files/manifest.yml index a8906ac4d09..95dd29bb2bb 100644 --- a/packages/zeek/data_stream/smb_files/manifest.yml +++ b/packages/zeek/data_stream/smb_files/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek smb_files.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/smb_files/sample_event.json b/packages/zeek/data_stream/smb_files/sample_event.json new file mode 100644 index 00000000000..17cc409f2c8 --- /dev/null +++ b/packages/zeek/data_stream/smb_files/sample_event.json @@ -0,0 +1,103 @@ +{ + "@timestamp": "2017-10-09T16:13:19.576Z", + "agent": { + "ephemeral_id": "dec4dd7f-801d-4809-a58d-c21f894af209", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.smb_files", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.10.30", + "ip": "192.168.10.30", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "SMB::FILE_OPEN", + "agent_id_status": "verified", + "category": [ + "network", + "file" + ], + "created": "2023-09-03T22:39:05.679Z", + "dataset": "zeek.smb_files", + "id": "C9YAaEzWLL62yWMn5", + "ingested": "2023-09-03T22:39:09Z", + "kind": "event", + "original": "{\"ts\":1507565599.576942,\"uid\":\"C9YAaEzWLL62yWMn5\",\"id.orig_h\":\"192.168.10.31\",\"id.orig_p\":49239,\"id.resp_h\":\"192.168.10.30\",\"id.resp_p\":445,\"action\":\"SMB::FILE_OPEN\",\"path\":\"\\u005c\\u005cadmin-pc\\u005cADMIN$\",\"name\":\"PSEXESVC.exe\",\"size\":0,\"times.modified\":1507565599.607777,\"times.accessed\":1507565599.607777,\"times.created\":1507565599.607777,\"times.changed\":1507565599.607777}", + "type": [ + "connection", + "protocol", + "info" + ] + }, + "file": { + "accessed": "2017-10-09T16:13:19.607Z", + "created": "2017-10-09T16:13:19.607Z", + "ctime": "2017-10-09T16:13:19.607Z", + "mtime": "2017-10-09T16:13:19.607Z", + "name": "PSEXESVC.exe", + "path": "\\\\admin-pc\\ADMIN$\\PSEXESVC.exe", + "size": 0 + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/smb_file.log" + } + }, + "network": { + "community_id": "1:k308wDxRMx/FIEzeh+YwD86zgoA=", + "protocol": "smb", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.10.31", + "192.168.10.30" + ] + }, + "source": { + "address": "192.168.10.31", + "ip": "192.168.10.31", + "port": 49239 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-smb-files" + ], + "zeek": { + "session_id": "C9YAaEzWLL62yWMn5", + "smb_files": { + "action": "SMB::FILE_OPEN", + "name": "PSEXESVC.exe", + "path": "\\\\admin-pc\\ADMIN$", + "size": 0, + "times": { + "accessed": "2017-10-09T16:13:19.607Z", + "changed": "2017-10-09T16:13:19.607Z", + "created": "2017-10-09T16:13:19.607Z", + "modified": "2017-10-09T16:13:19.607Z" + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json b/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json index 00eaadda3a8..35db8aea023 100644 --- a/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json +++ b/packages/zeek/data_stream/smb_mapping/_dev/test/pipeline/test-smb-mapping.log-expected.json @@ -8,7 +8,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -58,7 +58,7 @@ "port": 445 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/smb_mapping/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/smb_mapping/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/smb_mapping/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/smb_mapping/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml index b6a0bd630cf..49583584211 100644 --- a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -81,15 +81,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.smb_mapping.ts formats: @@ -139,13 +139,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -155,7 +155,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/smb_mapping/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/smb_mapping/manifest.yml b/packages/zeek/data_stream/smb_mapping/manifest.yml index 8f43d7dba22..10fa060050f 100644 --- a/packages/zeek/data_stream/smb_mapping/manifest.yml +++ b/packages/zeek/data_stream/smb_mapping/manifest.yml @@ -20,6 +20,15 @@ streams: default: - forwarded - zeek.smb_mapping + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + template_path: log.yml.hbs title: Zeek smb_mapping.log description: Collect Zeek smb_mapping logs @@ -49,3 +58,12 @@ streams: show_user: false default: - forwarded + - name: processors + type: yaml + title: Processors + multi: false + required: false + show_user: false + description: > + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. + diff --git a/packages/zeek/data_stream/smb_mapping/sample_event.json b/packages/zeek/data_stream/smb_mapping/sample_event.json new file mode 100644 index 00000000000..d0a86c6204f --- /dev/null +++ b/packages/zeek/data_stream/smb_mapping/sample_event.json @@ -0,0 +1,80 @@ +{ + "@timestamp": "2017-10-09T16:13:19.576Z", + "agent": { + "ephemeral_id": "2bfa090e-86da-436c-9b43-fdf4eb584711", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.smb_mapping", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.10.30", + "ip": "192.168.10.30", + "port": 445 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:40:29.805Z", + "dataset": "zeek.smb_mapping", + "id": "C9YAaEzWLL62yWMn5", + "ingested": "2023-09-03T22:40:33Z", + "kind": "event", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/smb_file.log" + } + }, + "network": { + "community_id": "1:k308wDxRMx/FIEzeh+YwD86zgoA=", + "protocol": "smb", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.10.31", + "192.168.10.30" + ] + }, + "source": { + "address": "192.168.10.31", + "ip": "192.168.10.31", + "port": 49239 + }, + "tags": [ + "forwarded" + ], + "zeek": { + "session_id": "C9YAaEzWLL62yWMn5", + "smb_mapping": { + "path": "\\\\admin-pc\\ADMIN$", + "share_type": "DISK" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json b/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json index 946f20153a3..ce978682b34 100644 --- a/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json +++ b/packages/zeek/data_stream/smtp/_dev/test/pipeline/test-smtp.log-expected.json @@ -8,7 +8,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ "port": 25 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/smtp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/smtp/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/smtp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/smtp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml index 2a65e219985..ce329fa80ee 100644 --- a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -81,15 +81,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.smtp.trans_depth target_field: zeek.smtp.transaction_depth @@ -106,7 +106,7 @@ processors: field: zeek.smtp.tls target_field: tls.established type: boolean - if: ctx?.zeek?.smtp?.tls != null + if: ctx.zeek?.smtp?.tls != null - date: field: zeek.smtp.ts formats: @@ -162,13 +162,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -176,14 +176,14 @@ processors: field: - zeek.smtp.fuids ignore_missing: true - if: 'ctx?.zeek?.smtp?.fuids == null || ctx?.zeek?.smtp?.isEmpty()' + if: 'ctx.zeek?.smtp?.fuids == null || ctx.zeek?.smtp?.isEmpty()' - remove: field: - zeek.smtp.id ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/smtp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/smtp/manifest.yml b/packages/zeek/data_stream/smtp/manifest.yml index d9f7afcd411..658a6da0ded 100644 --- a/packages/zeek/data_stream/smtp/manifest.yml +++ b/packages/zeek/data_stream/smtp/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek smtp.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/smtp/sample_event.json b/packages/zeek/data_stream/smtp/sample_event.json new file mode 100644 index 00000000000..fd044b73f1e --- /dev/null +++ b/packages/zeek/data_stream/smtp/sample_event.json @@ -0,0 +1,93 @@ +{ + "@timestamp": "2018-12-03T22:59:47.381Z", + "agent": { + "ephemeral_id": "14f9e1e9-512c-47f5-b72f-25539a2925bf", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.smtp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.9", + "ip": "192.168.1.9", + "port": 25 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:41:56.047Z", + "dataset": "zeek.smtp", + "id": "CWWzPB3RjqhFf528c", + "ingested": "2023-09-03T22:41:59Z", + "kind": "event", + "original": "{\"ts\":1543877987.381899,\"uid\":\"CWWzPB3RjqhFf528c\",\"id.orig_h\":\"192.168.1.10\",\"id.orig_p\":33782,\"id.resp_h\":\"192.168.1.9\",\"id.resp_p\":25,\"trans_depth\":1,\"helo\":\"EXAMPLE.COM\",\"last_reply\":\"220 2.0.0 SMTP server ready\",\"path\":[\"192.168.1.9\"],\"tls\":true,\"fuids\":[],\"is_webmail\":false}", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/smtp.log" + } + }, + "network": { + "community_id": "1:38H0puTqOoHT/5r2bKFUVSXifQw=", + "protocol": "smtp", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.1.10", + "192.168.1.9" + ] + }, + "source": { + "address": "192.168.1.10", + "ip": "192.168.1.10", + "port": 33782 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-smtp" + ], + "tls": { + "established": true + }, + "zeek": { + "session_id": "CWWzPB3RjqhFf528c", + "smtp": { + "fuids": [], + "helo": "EXAMPLE.COM", + "is_webmail": false, + "last_reply": "220 2.0.0 SMTP server ready", + "path": [ + "192.168.1.9" + ], + "tls": true, + "transaction_depth": 1 + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json b/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json index 015f638babd..145be57a399 100644 --- a/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json +++ b/packages/zeek/data_stream/snmp/_dev/test/pipeline/test-snmp.log-expected.json @@ -8,7 +8,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -68,7 +68,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -145,7 +145,7 @@ "port": 161 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/snmp/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/snmp/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/snmp/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/snmp/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml index 73e905a29d7..a370adfa54a 100644 --- a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -81,15 +81,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.snmp.get_requests target_field: zeek.snmp.get.requests @@ -162,13 +162,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -178,7 +178,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/snmp/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/snmp/manifest.yml b/packages/zeek/data_stream/snmp/manifest.yml index 8fadc2cfd4b..1b6d5157097 100644 --- a/packages/zeek/data_stream/snmp/manifest.yml +++ b/packages/zeek/data_stream/snmp/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek snmp.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/snmp/sample_event.json b/packages/zeek/data_stream/snmp/sample_event.json new file mode 100644 index 00000000000..a7e9b2652a9 --- /dev/null +++ b/packages/zeek/data_stream/snmp/sample_event.json @@ -0,0 +1,93 @@ +{ + "@timestamp": "2018-12-03T22:59:08.916Z", + "agent": { + "ephemeral_id": "70535934-b340-43d6-ab6a-4e497e5d1ca4", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.snmp", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.1", + "ip": "192.168.1.1", + "port": 161 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:43:22.920Z", + "dataset": "zeek.snmp", + "id": "CnKW1B4w9fpRa6Nkf2", + "ingested": "2023-09-03T22:43:26Z", + "kind": "event", + "original": "{\"ts\":1543877948.916584,\"uid\":\"CnKW1B4w9fpRa6Nkf2\",\"id.orig_h\":\"192.168.1.2\",\"id.orig_p\":59696,\"id.resp_h\":\"192.168.1.1\",\"id.resp_p\":161,\"duration\":7.849924,\"version\":\"2c\",\"community\":\"public\",\"get_requests\":0,\"get_bulk_requests\":0,\"get_responses\":8,\"set_requests\":0,\"up_since\":1543631204.766508}", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/snmp.log" + } + }, + "network": { + "community_id": "1:X15ey/8/tEH+tlelK6P+GfgwBPc=", + "protocol": "snmp", + "transport": "udp" + }, + "related": { + "ip": [ + "192.168.1.2", + "192.168.1.1" + ] + }, + "source": { + "address": "192.168.1.2", + "ip": "192.168.1.2", + "port": 59696 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-snmp" + ], + "zeek": { + "session_id": "CnKW1B4w9fpRa6Nkf2", + "snmp": { + "community": "public", + "duration": 7.849924, + "get": { + "bulk_requests": 0, + "requests": 0, + "responses": 8 + }, + "set": { + "requests": 0 + }, + "up_since": "2018-12-01T02:26:44.766Z", + "version": "2c" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json b/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json index 736a34e75f9..b2f4905a669 100644 --- a/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json +++ b/packages/zeek/data_stream/socks/_dev/test/pipeline/test-socks.log-expected.json @@ -8,7 +8,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -66,7 +66,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/socks/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/socks/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/socks/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/socks/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml index 31aeb7d4847..d59ca3fe241 100644 --- a/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/socks/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -85,15 +85,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.socks.request.name target_field: zeek.socks.request.host @@ -109,7 +109,7 @@ processors: - set: field: user.name copy_from: zeek.socks.user - if: ctx?.zeek?.socks?.user != null + if: ctx.zeek?.socks?.user != null - date: field: zeek.socks.ts formats: @@ -162,31 +162,31 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.user - value: "{{user.name}}" - if: "ctx?.user?.name != null" + value: "{{{user.name}}}" + if: "ctx.user?.name != null" allow_duplicates: false - append: field: event.type value: error - if: "ctx?.zeek?.socks?.status != null && ctx.zeek.socks.status != 'succeeded'" + if: "ctx.zeek?.socks?.status != null && ctx.zeek.socks.status != 'succeeded'" - set: field: event.outcome value: success - if: "ctx?.zeek?.socks?.status != null && ctx.zeek.socks.status == 'succeeded'" + if: "ctx.zeek?.socks?.status != null && ctx.zeek.socks.status == 'succeeded'" - set: field: event.outcome value: failure - if: "ctx?.zeek?.socks?.status != null && ctx.zeek.socks.status != 'succeeded'" + if: "ctx.zeek?.socks?.status != null && ctx.zeek.socks.status != 'succeeded'" - community_id: target_field: network.community_id - remove: @@ -195,7 +195,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/socks/manifest.yml b/packages/zeek/data_stream/socks/manifest.yml index 5e001fd7a38..8de1b964e24 100644 --- a/packages/zeek/data_stream/socks/manifest.yml +++ b/packages/zeek/data_stream/socks/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek socks.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/socks/sample_event.json b/packages/zeek/data_stream/socks/sample_event.json new file mode 100644 index 00000000000..bde4b7aa8b0 --- /dev/null +++ b/packages/zeek/data_stream/socks/sample_event.json @@ -0,0 +1,91 @@ +{ + "@timestamp": "2019-08-22T21:08:13.094Z", + "agent": { + "ephemeral_id": "6c8b8d11-7929-4a29-a2f2-d1537f536562", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.socks", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 8080 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:44:54.132Z", + "dataset": "zeek.socks", + "id": "Cmz4Cb4qCw1hGqYw1c", + "ingested": "2023-09-03T22:44:58Z", + "kind": "event", + "original": "{\"ts\":1566508093.09494,\"uid\":\"Cmz4Cb4qCw1hGqYw1c\",\"id.orig_h\":\"127.0.0.1\",\"id.orig_p\":35368,\"id.resp_h\":\"127.0.0.1\",\"id.resp_p\":8080,\"version\":5,\"status\":\"succeeded\",\"request.name\":\"www.google.com\",\"request_p\":443,\"bound.host\":\"0.0.0.0\",\"bound_p\":0}", + "outcome": "success", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/socks.log" + } + }, + "network": { + "community_id": "1:1Hp/o0hOC62lAwrV+a0ZKDE3rrs=", + "protocol": "socks", + "transport": "tcp" + }, + "related": { + "ip": [ + "127.0.0.1" + ] + }, + "source": { + "address": "127.0.0.1", + "ip": "127.0.0.1", + "port": 35368 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-socks" + ], + "zeek": { + "session_id": "Cmz4Cb4qCw1hGqYw1c", + "socks": { + "bound": { + "host": "0.0.0.0", + "port": 0 + }, + "request": { + "host": "www.google.com", + "port": 443 + }, + "status": "succeeded", + "version": 5 + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json b/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json index 6acaa46bc3c..5bfcbf0f5da 100644 --- a/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json +++ b/packages/zeek/data_stream/software/_dev/test/pipeline/test-software.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-01-03T00:16:22.694Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -18,7 +18,9 @@ ] }, "host": { - "ip": "192.168.4.25" + "ip": [ + "192.168.4.25" + ] }, "network": { "type": "ipv4" diff --git a/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml index 204ec697cfb..4e4a25a8446 100644 --- a/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/software/elasticsearch/ingest_pipeline/default.yml @@ -21,7 +21,7 @@ processors: copy_from: "@timestamp" - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: event.kind value: event @@ -53,13 +53,17 @@ processors: if: ctx.host?.ip.contains(':') - append: field: related.ip - value: "{{host.ip}}" - if: ctx?.host?.ip != null + value: "{{{host.ip}}}" + if: ctx.host?.ip != null allow_duplicates: false - geoip: field: host.ip target_field: host.geo ignore_missing: true + - set: + field: host.ip + value: ['{{{host.ip}}}'] + if: ctx.host?.ip instanceof String - rename: field: zeek.software.software_type target_field: zeek.software.type @@ -93,7 +97,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/software/manifest.yml b/packages/zeek/data_stream/software/manifest.yml index d12de67c7c9..48aad0662d6 100644 --- a/packages/zeek/data_stream/software/manifest.yml +++ b/packages/zeek/data_stream/software/manifest.yml @@ -38,4 +38,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/software/sample_event.json b/packages/zeek/data_stream/software/sample_event.json new file mode 100644 index 00000000000..0187c588df3 --- /dev/null +++ b/packages/zeek/data_stream/software/sample_event.json @@ -0,0 +1,77 @@ +{ + "@timestamp": "2021-01-03T00:16:22.694Z", + "agent": { + "ephemeral_id": "7d00f52a-a56f-4097-9220-8345ff905c20", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.software", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network", + "file" + ], + "created": "2023-09-03T22:45:42.754Z", + "dataset": "zeek.software", + "ingested": "2023-09-03T22:45:43Z", + "kind": "event", + "type": [ + "info" + ] + }, + "host": { + "ip": [ + "192.168.4.25" + ] + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/software.log" + }, + "offset": 0 + }, + "network": { + "type": "ipv4" + }, + "related": { + "ip": [ + "192.168.4.25" + ] + }, + "tags": [ + "forwarded", + "zeek-software" + ], + "zeek": { + "software": { + "name": "Windows-Update-Agent", + "type": "HTTP::BROWSER", + "version": { + "additional": "Client", + "full": "Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.0", + "major": 10, + "minor": 0, + "minor2": 10011, + "minor3": 16384 + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json b/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json index f054ea7a4e0..56d54ed0f66 100644 --- a/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json +++ b/packages/zeek/data_stream/ssh/_dev/test/pipeline/test-ssh.log-expected.json @@ -8,7 +8,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -72,7 +72,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -143,7 +143,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -214,7 +214,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -285,7 +285,7 @@ "port": 22 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/ssh/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ssh/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ssh/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ssh/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml index 0026bfb8edc..9d4129de9c8 100644 --- a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -81,15 +81,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.ssh.auth_attempts target_field: zeek.ssh.auth.attempts @@ -167,22 +167,22 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - set: field: event.outcome value: failure - if: "ctx?.zeek?.ssh?.auth?.success != null && ctx.zeek.ssh.auth.success == false" + if: "ctx.zeek?.ssh?.auth?.success != null && ctx.zeek.ssh.auth.success == false" - set: field: event.outcome value: success - if: "ctx?.zeek?.ssh?.auth?.success != null && ctx.zeek.ssh.auth.success == true" + if: "ctx.zeek?.ssh?.auth?.success != null && ctx.zeek.ssh.auth.success == true" - community_id: target_field: network.community_id - remove: @@ -191,7 +191,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ssh/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ssh/manifest.yml b/packages/zeek/data_stream/ssh/manifest.yml index be5e501a70e..0bd19d055db 100644 --- a/packages/zeek/data_stream/ssh/manifest.yml +++ b/packages/zeek/data_stream/ssh/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek ssh.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ssh/sample_event.json b/packages/zeek/data_stream/ssh/sample_event.json new file mode 100644 index 00000000000..0363de3c76f --- /dev/null +++ b/packages/zeek/data_stream/ssh/sample_event.json @@ -0,0 +1,97 @@ +{ + "@timestamp": "2019-07-07T19:25:32.904Z", + "agent": { + "ephemeral_id": "93df2adb-d61c-480d-b2f7-e68e312b192d", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.ssh", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.1", + "ip": "192.168.1.1", + "port": 22 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:47:12.466Z", + "dataset": "zeek.ssh", + "id": "CajWfz1b3qnnWT0BU9", + "ingested": "2023-09-03T22:47:16Z", + "kind": "event", + "original": "{\"ts\":1562527532.904291,\"uid\":\"CajWfz1b3qnnWT0BU9\",\"id.orig_h\":\"192.168.1.2\",\"id.orig_p\":48380,\"id.resp_h\":\"192.168.1.1\",\"id.resp_p\":22,\"version\":2,\"auth_success\":false,\"auth_attempts\":2,\"client\":\"SSH-2.0-OpenSSH_7.9p1 Ubuntu-10\",\"server\":\"SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1\",\"cipher_alg\":\"chacha20-poly1305@openssh.com\",\"mac_alg\":\"umac-64-etm@openssh.com\",\"compression_alg\":\"none\",\"kex_alg\":\"curve25519-sha256@libssh.org\",\"host_key_alg\":\"ecdsa-sha2-nistp256\",\"host_key\":\"86:71:ac:9c:35:1c:28:29:05:81:48:ec:66:67:de:bd\"}", + "outcome": "failure", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/ssh.log" + } + }, + "network": { + "community_id": "1:42tg9bemt74qgrdvJOy2n5Veg4A=", + "protocol": "ssh", + "transport": "tcp" + }, + "related": { + "ip": [ + "192.168.1.2", + "192.168.1.1" + ] + }, + "source": { + "address": "192.168.1.2", + "ip": "192.168.1.2", + "port": 48380 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ssh" + ], + "zeek": { + "session_id": "CajWfz1b3qnnWT0BU9", + "ssh": { + "algorithm": { + "cipher": "chacha20-poly1305@openssh.com", + "compression": "none", + "host_key": "ecdsa-sha2-nistp256", + "key_exchange": "curve25519-sha256@libssh.org", + "mac": "umac-64-etm@openssh.com" + }, + "auth": { + "attempts": 2, + "success": false + }, + "client": "SSH-2.0-OpenSSH_7.9p1 Ubuntu-10", + "host_key": "86:71:ac:9c:35:1c:28:29:05:81:48:ec:66:67:de:bd", + "server": "SSH-2.0-OpenSSH_6.6.1p1 Debian-4~bpo70+1", + "version": 2 + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json b/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json index 8a37b4421f4..5cafc35cdd6 100644 --- a/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json +++ b/packages/zeek/data_stream/ssl/_dev/test/pipeline/test-ssl.log-expected.json @@ -29,7 +29,7 @@ "port": 9243 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -75,16 +75,32 @@ "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US", "x509": { "issuer": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "organization": "DigiCert Inc" + "common_name": [ + "DigiCert SHA2 Secure Server CA" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ] }, "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, @@ -154,7 +170,7 @@ "port": 9243 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -200,16 +216,32 @@ "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US", "x509": { "issuer": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "organization": "DigiCert Inc" + "common_name": [ + "DigiCert SHA2 Secure Server CA" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ] }, "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, @@ -279,7 +311,7 @@ "port": 9243 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -325,16 +357,32 @@ "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US", "x509": { "issuer": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "organization": "DigiCert Inc" + "common_name": [ + "DigiCert SHA2 Secure Server CA" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ] }, "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, @@ -386,7 +434,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -444,18 +492,38 @@ "subject": "CN=foo,OU=foo@bar,O=org,L=locality,C=LO", "x509": { "issuer": { - "common_name": "CA", - "country": "HI", - "locality": "foo", - "organization": "Example Corp", - "organizational_unit": "CA@example.com" + "common_name": [ + "CA" + ], + "country": [ + "HI" + ], + "locality": [ + "foo" + ], + "organization": [ + "Example Corp" + ], + "organizational_unit": [ + "CA@example.com" + ] }, "subject": { - "common_name": "foo", - "country": "LO", - "locality": "locality", - "organization": "org", - "organizational_unit": "foo@bar" + "common_name": [ + "foo" + ], + "country": [ + "LO" + ], + "locality": [ + "locality" + ], + "organization": [ + "org" + ], + "organizational_unit": [ + "foo@bar" + ] } } }, @@ -523,7 +591,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -587,7 +655,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -667,7 +735,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -747,7 +815,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -845,7 +913,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -919,7 +987,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1017,7 +1085,7 @@ "port": 9243 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1063,16 +1131,32 @@ "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US", "x509": { "issuer": { - "common_name": "DigiCert SHA2 Secure Server CA", - "country": "US", - "organization": "DigiCert Inc" + "common_name": [ + "DigiCert SHA2 Secure Server CA" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ] }, "subject": { - "common_name": "*.gcp.cloud.es.io", - "country": "US", - "locality": "Mountain View", - "organization": "Elasticsearch Inc.", - "state_or_province": "California" + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] } } }, @@ -1124,7 +1208,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -1190,18 +1274,38 @@ "subject": "CN=foo,OU=foo@bar,O=org,L=locality,C=LO", "x509": { "issuer": { - "common_name": "CA", - "country": "HI", - "locality": "foo", - "organization": "Example Corp", - "organizational_unit": "CA@example.com" + "common_name": [ + "CA" + ], + "country": [ + "HI" + ], + "locality": [ + "foo" + ], + "organization": [ + "Example Corp" + ], + "organizational_unit": [ + "CA@example.com" + ] }, "subject": { - "common_name": "foo", - "country": "LO", - "locality": "locality", - "organization": "org", - "organizational_unit": "foo@bar" + "common_name": [ + "foo" + ], + "country": [ + "LO" + ], + "locality": [ + "locality" + ], + "organization": [ + "org" + ], + "organizational_unit": [ + "foo@bar" + ] } } }, diff --git a/packages/zeek/data_stream/ssl/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/ssl/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/ssl/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/ssl/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml index 205e010422d..15b3fadee07 100644 --- a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -78,23 +78,23 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: client.address copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - set: field: server.address copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.ssl.server_name target_field: zeek.ssl.server.name @@ -211,10 +211,6 @@ processors: field: zeek.ssl.issuer target_field: tls.server.issuer ignore_missing: true - - rename: - field: zeek.ssl.server.issuer.C - target_field: zeek.ssl.server.issuer.country - ignore_missing: true - rename: field: zeek.ssl.resp_certificate_sha1 target_field: tls.server.hash.sha1 @@ -222,50 +218,56 @@ processors: - uppercase: field: tls.server.hash.sha1 ignore_missing: true + - set: field: tls.server.x509.issuer.country - value: "{{zeek.ssl.server.issuer.country}}" - ignore_empty_value: true + value: ["{{{zeek.ssl.server.issuer.C}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.C instanceof String + - rename: + field: zeek.ssl.server.issuer.C + target_field: zeek.ssl.server.issuer.country + ignore_missing: true + - set: + field: tls.server.x509.issuer.common_name + value: ["{{{zeek.ssl.server.issuer.CN}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.CN instanceof String - rename: field: zeek.ssl.server.issuer.CN target_field: zeek.ssl.server.issuer.common_name ignore_missing: true - set: - field: tls.server.x509.issuer.common_name - value: "{{zeek.ssl.server.issuer.common_name}}" - ignore_empty_value: true + field: tls.server.x509.issuer.locality + value: ["{{{zeek.ssl.server.issuer.L}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.L instanceof String - rename: field: zeek.ssl.server.issuer.L target_field: zeek.ssl.server.issuer.locality ignore_missing: true - set: - field: tls.server.x509.issuer.locality - value: "{{zeek.ssl.server.issuer.locality}}" - ignore_empty_value: true + field: tls.server.x509.issuer.organization + value: ["{{{zeek.ssl.server.issuer.O}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.O instanceof String - rename: field: zeek.ssl.server.issuer.O target_field: zeek.ssl.server.issuer.organization ignore_missing: true - set: - field: tls.server.x509.issuer.organization - value: "{{zeek.ssl.server.issuer.organization}}" - ignore_empty_value: true + field: tls.server.x509.issuer.organizational_unit + value: ["{{{zeek.ssl.server.issuer.OU}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.OU instanceof String - rename: field: zeek.ssl.server.issuer.OU target_field: zeek.ssl.server.issuer.organizational_unit ignore_missing: true - set: - field: tls.server.x509.issuer.organizational_unit - value: "{{zeek.ssl.server.issuer.organizational_unit}}" - ignore_empty_value: true + field: tls.server.x509.issuer.state_or_province + value: ["{{{zeek.ssl.server.issuer.ST}}}"] + if: ctx.zeek?.ssl?.server?.issuer?.ST instanceof String - rename: field: zeek.ssl.server.issuer.ST target_field: zeek.ssl.server.issuer.state ignore_missing: true - - set: - field: tls.server.x509.issuer.state_or_province - value: "{{zeek.ssl.server.issuer.state}}" - ignore_empty_value: true + - gsub: field: zeek.ssl.subject pattern: \\, @@ -281,54 +283,56 @@ processors: field: zeek.ssl.subject target_field: tls.server.subject ignore_missing: true + + - set: + field: tls.server.x509.subject.country + value: ["{{{zeek.ssl.server.subject.C}}}"] + if: ctx.zeek?.ssl?.server?.subject?.C instanceof String - rename: field: zeek.ssl.server.subject.C target_field: zeek.ssl.server.subject.country ignore_missing: true - set: - field: tls.server.x509.subject.country - value: "{{zeek.ssl.server.subject.country}}" - ignore_empty_value: true + field: tls.server.x509.subject.common_name + value: ["{{{zeek.ssl.server.subject.CN}}}"] + if: ctx.zeek?.ssl?.server?.subject?.CN instanceof String - rename: field: zeek.ssl.server.subject.CN target_field: zeek.ssl.server.subject.common_name ignore_missing: true - set: - field: tls.server.x509.subject.common_name - value: "{{zeek.ssl.server.subject.common_name}}" - ignore_empty_value: true + field: tls.server.x509.subject.locality + value: ["{{{zeek.ssl.server.subject.L}}}"] + if: ctx.zeek?.ssl?.server?.subject?.L instanceof String - rename: field: zeek.ssl.server.subject.L target_field: zeek.ssl.server.subject.locality ignore_missing: true - set: - field: tls.server.x509.subject.locality - value: "{{zeek.ssl.server.subject.locality}}" - ignore_empty_value: true + field: tls.server.x509.subject.organization + value: ["{{{zeek.ssl.server.subject.O}}}"] + if: ctx.zeek?.ssl?.server?.subject?.O instanceof String - rename: field: zeek.ssl.server.subject.O target_field: zeek.ssl.server.subject.organization ignore_missing: true - set: - field: tls.server.x509.subject.organization - value: "{{zeek.ssl.server.subject.organization}}" - ignore_empty_value: true + field: tls.server.x509.subject.organizational_unit + value: ["{{{zeek.ssl.server.subject.OU}}}"] + if: ctx.zeek?.ssl?.server?.subject?.OU instanceof String - rename: field: zeek.ssl.server.subject.OU target_field: zeek.ssl.server.subject.organizational_unit ignore_missing: true - set: - field: tls.server.x509.subject.organizational_unit - value: "{{zeek.ssl.server.subject.organizational_unit}}" - ignore_empty_value: true + field: tls.server.x509.subject.state_or_province + value: ["{{{zeek.ssl.server.subject.ST}}}"] + if: ctx.zeek?.ssl?.server?.subject?.ST instanceof String - rename: field: zeek.ssl.server.subject.ST target_field: zeek.ssl.server.subject.state ignore_missing: true - - set: - field: tls.server.x509.subject.state_or_province - value: "{{zeek.ssl.server.subject.state}}" - ignore_empty_value: true + - gsub: field: zeek.ssl.client_issuer pattern: \\, @@ -344,54 +348,56 @@ processors: field: zeek.ssl.client_issuer target_field: tls.client.issuer ignore_missing: true + + - set: + field: tls.client.x509.issuer.country + value: ["{{{zeek.ssl.client.issuer.C}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.C instanceof String - rename: field: zeek.ssl.client.issuer.C target_field: zeek.ssl.client.issuer.country ignore_missing: true - set: - field: tls.client.x509.issuer.country - value: "{{zeek.ssl.client.issuer.country}}" - ignore_empty_value: true + field: tls.client.x509.issuer.common_name + value: ["{{{zeek.ssl.client.issuer.CN}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.CN instanceof String - rename: field: zeek.ssl.client.issuer.CN target_field: zeek.ssl.client.issuer.common_name ignore_missing: true - set: - field: tls.client.x509.issuer.common_name - value: "{{zeek.ssl.client.issuer.common_name}}" - ignore_empty_value: true + field: tls.client.x509.issuer.locality + value: ["{{{zeek.ssl.client.issuer.L}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.L instanceof String - rename: field: zeek.ssl.client.issuer.L target_field: zeek.ssl.client.issuer.locality ignore_missing: true - set: - field: tls.client.x509.issuer.locality - value: "{{zeek.ssl.client.issuer.locality}}" - ignore_empty_value: true + field: tls.client.x509.issuer.organization + value: ["{{{zeek.ssl.client.issuer.O}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.O instanceof String - rename: field: zeek.ssl.client.issuer.O target_field: zeek.ssl.client.issuer.organization ignore_missing: true - set: - field: tls.client.x509.issuer.organization - value: "{{zeek.ssl.client.issuer.organization}}" - ignore_empty_value: true + field: tls.client.x509.issuer.organizational_unit + value: ["{{{zeek.ssl.client.issuer.OU}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.OU instanceof String - rename: - field: zeek.ssl.client.issuer.OU - target_field: zeek.ssl.client.issuer.organizational_unit + field: zeek.ssl.client.subject.OU + target_field: zeek.ssl.client.subject.organizational_unit ignore_missing: true - set: - field: tls.client.x509.issuer.organizational_unit - value: "{{zeek.ssl.client.issuer.organizational_unit}}" - ignore_empty_value: true + field: tls.client.x509.issuer.state_or_province + value: ["{{{zeek.ssl.client.issuer.ST}}}"] + if: ctx.zeek?.ssl?.client?.issuer?.ST instanceof String - rename: field: zeek.ssl.client.issuer.ST target_field: zeek.ssl.client.issuer.state ignore_missing: true - - set: - field: tls.client.x509.issuer.state_or_province - value: "{{zeek.ssl.client.issuer.state}}" - ignore_empty_value: true + - gsub: field: zeek.ssl.client_subject pattern: \\, @@ -406,61 +412,63 @@ processors: - remove: field: zeek.ssl.client_subject ignore_missing: true + + - set: + field: tls.client.x509.subject.country + value: [ "{{{zeek.ssl.client.subject.C}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.C instanceof String - rename: field: zeek.ssl.client.subject.C target_field: zeek.ssl.client.subject.country ignore_missing: true - set: - field: tls.client.x509.subject.country - value: "{{zeek.ssl.client.subject.country}}" - ignore_empty_value: true + field: tls.client.x509.subject.common_name + value: [ "{{{zeek.ssl.client.subject.CN}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.CN instanceof String - rename: field: zeek.ssl.client.subject.CN target_field: zeek.ssl.client.subject.common_name ignore_missing: true - set: - field: tls.client.x509.subject.common_name - value: "{{zeek.ssl.client.subject.common_name}}" - ignore_empty_value: true + field: tls.client.x509.subject.locality + value: [ "{{{zeek.ssl.client.subject.L}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.L instanceof String - rename: field: zeek.ssl.client.subject.L target_field: zeek.ssl.client.subject.locality ignore_missing: true - set: - field: tls.client.x509.subject.locality - value: "{{zeek.ssl.client.subject.locality}}" - ignore_empty_value: true + field: tls.client.x509.subject.organization + value: [ "{{{zeek.ssl.client.subject.O}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.O instanceof String - rename: field: zeek.ssl.client.subject.O target_field: zeek.ssl.client.subject.organization ignore_missing: true - set: - field: tls.client.x509.subject.organization - value: "{{zeek.ssl.client.subject.organization}}" - ignore_empty_value: true + field: tls.client.x509.subject.organizational_unit + value: [ "{{{zeek.ssl.client.subject.OU}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.OU instanceof String - rename: field: zeek.ssl.client.subject.OU target_field: zeek.ssl.client.subject.organizational_unit ignore_missing: true - set: - field: tls.client.x509.subject.organizational_unit - value: "{{zeek.ssl.client.subject.organizational_unit}}" - ignore_empty_value: true + field: tls.client.x509.subject.state_or_province + value: [ "{{{zeek.ssl.client.subject.ST}}}" ] + if: ctx.zeek?.ssl?.client?.subject?.ST instanceof String - rename: field: zeek.ssl.client.subject.ST target_field: zeek.ssl.client.subject.state ignore_missing: true - - set: - field: tls.client.x509.subject.state_or_province - value: "{{zeek.ssl.client.subject.state}}" - ignore_empty_value: true + - set: field: tls.cipher - value: "{{zeek.ssl.cipher}}" + value: "{{{zeek.ssl.cipher}}}" if: ctx.zeek?.ssl?.cipher != null - set: field: tls.curve - value: "{{zeek.ssl.curve}}" + value: "{{{zeek.ssl.curve}}}" if: ctx.zeek?.ssl?.curve != null - convert: target_field: tls.established @@ -496,22 +504,22 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - append: field: related.hash - value: "{{tls.server.ja3s}}" - if: "ctx?.tls?.server?.ja3s != null" + value: "{{{tls.server.ja3s}}}" + if: "ctx.tls?.server?.ja3s != null" - append: field: related.hash - value: "{{tls.client.ja3}}" - if: "ctx?.tls?.client?.ja3 != null" + value: "{{{tls.client.ja3}}}" + if: "ctx.tls?.client?.ja3 != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -519,14 +527,14 @@ processors: field: - zeek.ssl.client ignore_missing: true - if: 'ctx?.zeek?.ssl?.client == null || ctx?.zeek?.ssl?.client.isEmpty()' + if: 'ctx.zeek?.ssl?.client == null || ctx.zeek?.ssl?.client.isEmpty()' - remove: field: - zeek.ssl.id ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/ssl/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/ssl/manifest.yml b/packages/zeek/data_stream/ssl/manifest.yml index 93ba40223c9..3d074f487aa 100644 --- a/packages/zeek/data_stream/ssl/manifest.yml +++ b/packages/zeek/data_stream/ssl/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek ssl.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/ssl/sample_event.json b/packages/zeek/data_stream/ssl/sample_event.json new file mode 100644 index 00000000000..f727ee51d5f --- /dev/null +++ b/packages/zeek/data_stream/ssl/sample_event.json @@ -0,0 +1,156 @@ +{ + "@timestamp": "2019-01-17T01:32:16.805Z", + "agent": { + "ephemeral_id": "3ad07a5e-51ab-49ad-a4c4-e0f00ab483e8", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "client": { + "address": "10.178.98.102" + }, + "data_stream": { + "dataset": "zeek.ssl", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "35.199.178.4", + "ip": "35.199.178.4", + "port": 9243 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:48:45.543Z", + "dataset": "zeek.ssl", + "id": "CfGBt82PzCXzHa0iek", + "ingested": "2023-09-03T22:48:49Z", + "kind": "event", + "original": "{\"ts\":1547688736.805527,\"uid\":\"CfGBt82PzCXzHa0iek\",\"id.orig_h\":\"10.178.98.102\",\"id.orig_p\":63197,\"id.resp_h\":\"35.199.178.4\",\"id.resp_p\":9243,\"version\":\"TLSv12\",\"cipher\":\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"curve\":\"secp256r1\",\"server_name\":\"dd625ffb4fc54735b281862aa1cd6cd4.us-west1.gcp.cloud.es.io\",\"resumed\":false,\"established\":true,\"cert_chain_fuids\":[\"FiFLYv3UjeWyv2gcW\",\"FvSsiB1Xi816EMagI9\",\"FWpPS4mjGaAhTRXLf\"],\"client_cert_chain_fuids\":[],\"subject\":\"CN=*.gcp.cloud.es.io,O=Elasticsearch\\u005c, Inc.,L=Mountain View,ST=California,C=US\",\"issuer\":\"CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US\",\"validation_status\":\"ok\"}", + "type": [ + "connection", + "protocol" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/ssl.log" + } + }, + "network": { + "community_id": "1:uvtDP+7asGjibinsGcMqvj9yAoc=", + "transport": "tcp" + }, + "related": { + "ip": [ + "10.178.98.102", + "35.199.178.4" + ] + }, + "server": { + "address": "35.199.178.4" + }, + "source": { + "address": "10.178.98.102", + "ip": "10.178.98.102", + "port": 63197 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-ssl" + ], + "tls": { + "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "curve": "secp256r1", + "established": true, + "resumed": false, + "server": { + "issuer": "CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US", + "subject": "CN=*.gcp.cloud.es.io,O=Elasticsearch Inc.,L=Mountain View,ST=California,C=US", + "x509": { + "issuer": { + "common_name": [ + "DigiCert SHA2 Secure Server CA" + ], + "country": [ + "US" + ], + "organization": [ + "DigiCert Inc" + ] + }, + "subject": { + "common_name": [ + "*.gcp.cloud.es.io" + ], + "country": [ + "US" + ], + "locality": [ + "Mountain View" + ], + "organization": [ + "Elasticsearch Inc." + ], + "state_or_province": [ + "California" + ] + } + } + }, + "version": "1.2", + "version_protocol": "tls" + }, + "zeek": { + "session_id": "CfGBt82PzCXzHa0iek", + "ssl": { + "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", + "curve": "secp256r1", + "established": true, + "resumed": false, + "server": { + "cert_chain_fuids": [ + "FiFLYv3UjeWyv2gcW", + "FvSsiB1Xi816EMagI9", + "FWpPS4mjGaAhTRXLf" + ], + "issuer": { + "common_name": "DigiCert SHA2 Secure Server CA", + "country": "US", + "organization": "DigiCert Inc" + }, + "name": "dd625ffb4fc54735b281862aa1cd6cd4.us-west1.gcp.cloud.es.io", + "subject": { + "common_name": "*.gcp.cloud.es.io", + "country": "US", + "locality": "Mountain View", + "organization": "Elasticsearch Inc.", + "state": "California" + } + }, + "validation": { + "status": "ok" + }, + "version": "TLSv12" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json b/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json index 1dee789bd6e..ef8868fd15e 100644 --- a/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json +++ b/packages/zeek/data_stream/stats/_dev/test/pipeline/test-stats.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2016-10-16T08:17:58.714Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -65,7 +65,7 @@ { "@timestamp": "2016-10-16T08:17:58.714Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/stats/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/stats/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/stats/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/stats/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml index 78466f49c26..cacd5aabe49 100644 --- a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: zeek.stats.mem target_field: zeek.stats.memory @@ -135,7 +135,7 @@ processors: value: metric - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/stats/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/stats/manifest.yml b/packages/zeek/data_stream/stats/manifest.yml index 665b9b9781f..320bb1c7270 100644 --- a/packages/zeek/data_stream/stats/manifest.yml +++ b/packages/zeek/data_stream/stats/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek stats.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/stats/sample_event.json b/packages/zeek/data_stream/stats/sample_event.json new file mode 100644 index 00000000000..dd7c2ce0ac2 --- /dev/null +++ b/packages/zeek/data_stream/stats/sample_event.json @@ -0,0 +1,95 @@ +{ + "@timestamp": "2016-10-16T08:17:58.714Z", + "agent": { + "ephemeral_id": "cd4c70bf-a9c6-46d6-9fe4-0743ae739b49", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.stats", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-09-03T22:50:17.621Z", + "dataset": "zeek.stats", + "ingested": "2023-09-03T22:50:21Z", + "kind": "metric", + "original": "{\"ts\":1476605878.714844,\"peer\":\"bro\",\"mem\":94,\"pkts_proc\":296,\"bytes_recv\":39674,\"events_proc\":723,\"events_queued\":728,\"active_tcp_conns\":1,\"active_udp_conns\":3,\"active_icmp_conns\":0,\"tcp_conns\":6,\"udp_conns\":36,\"icmp_conns\":2,\"timers\":797,\"active_timers\":38,\"files\":0,\"active_files\":0,\"dns_requests\":0,\"active_dns_requests\":0,\"reassem_tcp_size\":0,\"reassem_file_size\":0,\"reassem_frag_size\":0,\"reassem_unknown_size\":0}" + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/stats.log" + } + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-stats" + ], + "zeek": { + "stats": { + "bytes": { + "received": 39674 + }, + "connections": { + "icmp": { + "active": 0, + "count": 2 + }, + "tcp": { + "active": 1, + "count": 6 + }, + "udp": { + "active": 3, + "count": 36 + } + }, + "dns_requests": { + "active": 0, + "count": 0 + }, + "events": { + "processed": 723, + "queued": 728 + }, + "files": { + "active": 0, + "count": 0 + }, + "memory": 94, + "packets": { + "processed": 296 + }, + "peer": "bro", + "reassembly_size": { + "file": 0, + "frag": 0, + "tcp": 0, + "unknown": 0 + }, + "timers": { + "active": 38, + "count": 797 + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json b/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json index 1c5c04b2cf8..e6005b8a579 100644 --- a/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json +++ b/packages/zeek/data_stream/syslog/_dev/test/pipeline/test-syslog.log-expected.json @@ -8,7 +8,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -64,7 +64,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -120,7 +120,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -176,7 +176,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -232,7 +232,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -288,7 +288,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -344,7 +344,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -400,7 +400,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -456,7 +456,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -512,7 +512,7 @@ "port": 514 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", diff --git a/packages/zeek/data_stream/syslog/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/syslog/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/syslog/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/syslog/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml index e19158d6c84..db535c74642 100644 --- a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - set: field: network.protocol value: syslog @@ -69,15 +69,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.syslog.proto target_field: network.transport @@ -93,11 +93,11 @@ processors: - set: field: log.syslog.facility.name copy_from: zeek.syslog.facility - if: ctx?.zeek?.syslog?.facility != null + if: ctx.zeek?.syslog?.facility != null - set: field: log.syslog.severity.name copy_from: zeek.syslog.severity - if: ctx?.zeek?.syslog?.severity != null + if: ctx.zeek?.syslog?.severity != null - date: field: zeek.syslog.ts formats: @@ -147,19 +147,19 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/syslog/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/syslog/manifest.yml b/packages/zeek/data_stream/syslog/manifest.yml index ac982fd6b3f..b6e8a998524 100644 --- a/packages/zeek/data_stream/syslog/manifest.yml +++ b/packages/zeek/data_stream/syslog/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek syslog.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/syslog/sample_event.json b/packages/zeek/data_stream/syslog/sample_event.json new file mode 100644 index 00000000000..33906246c68 --- /dev/null +++ b/packages/zeek/data_stream/syslog/sample_event.json @@ -0,0 +1,83 @@ +{ + "@timestamp": "2018-03-24T17:15:47.733Z", + "agent": { + "ephemeral_id": "8b39e5c6-1f3d-45e2-a4ec-78640e99889f", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.syslog", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "10.47.2.153", + "ip": "10.47.2.153", + "port": 514 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-09-03T22:51:07.248Z", + "dataset": "zeek.syslog", + "id": "CWdgwHv7Hax2fhQQ2", + "ingested": "2023-09-03T22:51:08Z", + "kind": "event" + }, + "input": { + "type": "log" + }, + "log": { + "file": { + "path": "/tmp/service_logs/syslog.log" + }, + "offset": 0, + "syslog": { + "facility": { + "name": "LOCAL0" + }, + "severity": { + "name": "INFO" + } + } + }, + "message": "1 2018-03-24T08:59:37-07:00 PC-helen.jerry.land EvntSLog - - - @cee: {\"source\": \"PC-helen.jerry.land\", \"msg\": \"The Multimedia Class Scheduler service entered the stopped state.\", \"nteventlogtype\": \"System\", \"sourceproc\": \"Service Control Manager\", \"id\": \"7036\", \"categoryid\": \"0\", \"category\": \"0\", \"keywordid\": \"0x8080000000000000\", \"user\": \"N\\\\A\", \"param1\": \"Multimedia Class Scheduler\", \"param2\": \"stopped\", \"catname\": \"\", \"keyword\": \"Classic\", \"level\": \"Information\"}", + "network": { + "community_id": "1:QlVp8tW6D1oAzAlVVEw4syQYfDU=", + "protocol": "syslog", + "transport": "udp" + }, + "related": { + "ip": [ + "10.47.22.82", + "10.47.2.153" + ] + }, + "source": { + "address": "10.47.22.82", + "ip": "10.47.22.82", + "port": 62695 + }, + "tags": [ + "forwarded", + "zeek-syslog" + ], + "zeek": { + "session_id": "CWdgwHv7Hax2fhQQ2", + "syslog": { + "facility": "LOCAL0", + "id": {}, + "msg": "1 2018-03-24T08:59:37-07:00 PC-helen.jerry.land EvntSLog - - - @cee: {\"source\": \"PC-helen.jerry.land\", \"msg\": \"The Multimedia Class Scheduler service entered the stopped state.\", \"nteventlogtype\": \"System\", \"sourceproc\": \"Service Control Manager\", \"id\": \"7036\", \"categoryid\": \"0\", \"category\": \"0\", \"keywordid\": \"0x8080000000000000\", \"user\": \"N\\\\A\", \"param1\": \"Multimedia Class Scheduler\", \"param2\": \"stopped\", \"catname\": \"\", \"keyword\": \"Classic\", \"level\": \"Information\"}", + "severity": "INFO" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json b/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json index 05bc3cdc7ad..cd28daace0e 100644 --- a/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json +++ b/packages/zeek/data_stream/traceroute/_dev/test/pipeline/test-traceroute.log-expected.json @@ -25,7 +25,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -81,7 +81,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/traceroute/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/traceroute/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/traceroute/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/traceroute/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml index 364c0d266dd..4604ce6386e 100644 --- a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -48,11 +48,11 @@ processors: - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - date: field: zeek.traceroute.ts formats: @@ -102,22 +102,22 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - remove: field: - zeek.traceroute ignore_missing: true - if: 'ctx?.zeek?.traceroute == null || ctx?.zeek?.traceroute.isEmpty()' + if: 'ctx.zeek?.traceroute == null || ctx.zeek?.traceroute.isEmpty()' - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/traceroute/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/traceroute/manifest.yml b/packages/zeek/data_stream/traceroute/manifest.yml index 15b6db76853..4596f86a28d 100644 --- a/packages/zeek/data_stream/traceroute/manifest.yml +++ b/packages/zeek/data_stream/traceroute/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek traceroute.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/traceroute/sample_event.json b/packages/zeek/data_stream/traceroute/sample_event.json new file mode 100644 index 00000000000..68378b9b4f0 --- /dev/null +++ b/packages/zeek/data_stream/traceroute/sample_event.json @@ -0,0 +1,71 @@ +{ + "@timestamp": "2013-02-26T22:02:38.650Z", + "agent": { + "ephemeral_id": "570096c2-7aff-4350-b959-8a882c507b3b", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.traceroute", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "8.8.8.8", + "ip": "8.8.8.8" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:52:34.024Z", + "dataset": "zeek.traceroute", + "ingested": "2023-09-03T22:52:37Z", + "kind": "event", + "original": "{\"ts\":1361916158.650605,\"src\":\"192.168.1.1\",\"dst\":\"8.8.8.8\",\"proto\":\"udp\"}", + "type": [ + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/traceroute.log" + } + }, + "network": { + "transport": "udp" + }, + "related": { + "ip": [ + "192.168.1.1", + "8.8.8.8" + ] + }, + "source": { + "address": "192.168.1.1", + "ip": "192.168.1.1" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-traceroute" + ], + "zeek": {} +} \ No newline at end of file diff --git a/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json b/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json index 345954dfbe9..1a36a29593b 100644 --- a/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json +++ b/packages/zeek/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json @@ -26,7 +26,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Tunnel::DISCOVER", @@ -104,7 +104,7 @@ "port": 8080 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "Tunnel::DISCOVER", diff --git a/packages/zeek/data_stream/tunnel/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/tunnel/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/tunnel/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/tunnel/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml index 547618abeca..48e8ea4e0ad 100644 --- a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -72,15 +72,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.tunnel.tunnel_type target_field: zeek.tunnel.type @@ -88,7 +88,7 @@ processors: - set: field: event.action copy_from: zeek.tunnel.action - if: ctx?.zeek?.tunnel?.action != null + if: ctx.zeek?.tunnel?.action != null - date: field: zeek.tunnel.ts formats: @@ -138,13 +138,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - community_id: target_field: network.community_id @@ -154,7 +154,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/tunnel/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/tunnel/manifest.yml b/packages/zeek/data_stream/tunnel/manifest.yml index 01956ef6809..acd48394c1b 100644 --- a/packages/zeek/data_stream/tunnel/manifest.yml +++ b/packages/zeek/data_stream/tunnel/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek tunnel.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/tunnel/sample_event.json b/packages/zeek/data_stream/tunnel/sample_event.json new file mode 100644 index 00000000000..9a520202163 --- /dev/null +++ b/packages/zeek/data_stream/tunnel/sample_event.json @@ -0,0 +1,88 @@ +{ + "@timestamp": "2018-12-10T01:34:26.743Z", + "agent": { + "ephemeral_id": "d611ee0f-b3be-4c22-beb1-eedab6b7c2fc", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.tunnel", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "132.16.110.133", + "as": { + "number": 721, + "organization": { + "name": "DoD Network Information Center" + } + }, + "ip": "132.16.110.133", + "port": 8080 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "action": "Tunnel::DISCOVER", + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:54:03.984Z", + "dataset": "zeek.tunnel", + "ingested": "2023-09-03T22:54:07Z", + "kind": "event", + "original": "{\"ts\":1544405666.743509,\"id.orig_h\":\"132.16.146.79\",\"id.orig_p\":0,\"id.resp_h\":\"132.16.110.133\",\"id.resp_p\":8080,\"tunnel_type\":\"Tunnel::HTTP\",\"action\":\"Tunnel::DISCOVER\"}", + "type": [ + "connection" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/tunnel.log" + } + }, + "related": { + "ip": [ + "132.16.146.79", + "132.16.110.133" + ] + }, + "source": { + "address": "132.16.146.79", + "as": { + "number": 721, + "organization": { + "name": "DoD Network Information Center" + } + }, + "ip": "132.16.146.79", + "port": 0 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-tunnel" + ], + "zeek": { + "tunnel": { + "action": "Tunnel::DISCOVER", + "type": "Tunnel::HTTP" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json b/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json index 8c4ae212ae4..9e5a0e2f4d0 100644 --- a/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json +++ b/packages/zeek/data_stream/weird/_dev/test/pipeline/test-weird.log-expected.json @@ -8,7 +8,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -48,7 +48,7 @@ { "@timestamp": "2020-01-28T16:00:59.342Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -80,7 +80,7 @@ "port": 53 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zeek/data_stream/weird/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/weird/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/weird/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/weird/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml index 86b93051ee3..7c3896dc916 100644 --- a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.category value: network @@ -72,15 +72,15 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - set: field: source.ip copy_from: source.address - if: ctx?.source?.address != null + if: ctx.source?.address != null - set: field: destination.ip copy_from: destination.address - if: ctx?.destination?.address != null + if: ctx.destination?.address != null - rename: field: zeek.weird.addl target_field: zeek.weird.additional_info @@ -88,7 +88,7 @@ processors: - set: field: rule.name copy_from: zeek.weird.name - if: ctx?.weird?.name != null + if: ctx.weird?.name != null - date: field: zeek.weird.ts formats: @@ -138,13 +138,13 @@ processors: ignore_missing: true - append: field: related.ip - value: "{{source.ip}}" - if: "ctx?.source?.ip != null" + value: "{{{source.ip}}}" + if: "ctx.source?.ip != null" allow_duplicates: false - append: field: related.ip - value: "{{destination.ip}}" - if: "ctx?.destination?.ip != null" + value: "{{{destination.ip}}}" + if: "ctx.destination?.ip != null" allow_duplicates: false - remove: field: @@ -152,7 +152,7 @@ processors: ignore_missing: true - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/weird/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/weird/manifest.yml b/packages/zeek/data_stream/weird/manifest.yml index d2619e9ebe8..cd278a982c5 100644 --- a/packages/zeek/data_stream/weird/manifest.yml +++ b/packages/zeek/data_stream/weird/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek weird.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/weird/sample_event.json b/packages/zeek/data_stream/weird/sample_event.json new file mode 100644 index 00000000000..418f5167506 --- /dev/null +++ b/packages/zeek/data_stream/weird/sample_event.json @@ -0,0 +1,78 @@ +{ + "@timestamp": "2018-12-03T22:59:59.993Z", + "agent": { + "ephemeral_id": "5dfba74d-879e-4a58-a13c-7fdf9f30c53f", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.weird", + "namespace": "ep", + "type": "logs" + }, + "destination": { + "address": "192.168.1.2", + "ip": "192.168.1.2", + "port": 53 + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "network" + ], + "created": "2023-09-03T22:55:37.108Z", + "dataset": "zeek.weird", + "id": "C1ralPp062bkwWt4e", + "ingested": "2023-09-03T22:55:40Z", + "kind": "event", + "original": "{\"ts\":1543877999.99354,\"uid\":\"C1ralPp062bkwWt4e\",\"id.orig_h\":\"192.168.1.1\",\"id.orig_p\":64521,\"id.resp_h\":\"192.168.1.2\",\"id.resp_p\":53,\"name\":\"dns_unmatched_reply\",\"notice\":false,\"peer\":\"worker-6\"}", + "type": [ + "info" + ] + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/weird.log" + } + }, + "related": { + "ip": [ + "192.168.1.1", + "192.168.1.2" + ] + }, + "source": { + "address": "192.168.1.1", + "ip": "192.168.1.1", + "port": 64521 + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-weird" + ], + "zeek": { + "session_id": "C1ralPp062bkwWt4e", + "weird": { + "name": "dns_unmatched_reply", + "notice": false, + "peer": "worker-6" + } + } +} \ No newline at end of file diff --git a/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json b/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json index 7d566c0ea5f..3d0209ff2f8 100644 --- a/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json +++ b/packages/zeek/data_stream/x509/_dev/test/pipeline/test-x509.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2018-12-03T20:00:00.143Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -91,12 +91,24 @@ "www.maps.live.com.au" ], "issuer": { - "common_name": "Microsoft IT TLS CA 5", - "country": "US", - "locality": "Redmond", - "organization": "Microsoft Corporation", - "organizational_unit": "Microsoft IT", - "state_or_province": "Washington" + "common_name": [ + "Microsoft IT TLS CA 5" + ], + "country": [ + "US" + ], + "locality": [ + "Redmond" + ], + "organization": [ + "Microsoft Corporation" + ], + "organizational_unit": [ + "Microsoft IT" + ], + "state_or_province": [ + "Washington" + ] }, "not_after": "2019-07-10T17:47:08.000Z", "not_before": "2017-07-20T17:47:08.000Z", @@ -106,7 +118,9 @@ "serial_number": "2D00003299D7071DB7D1708A42000000003299", "signature_algorithm": "SHA256-RSA", "subject": { - "common_name": "www.bing.com" + "common_name": [ + "www.bing.com" + ] }, "version_number": "3" } @@ -225,7 +239,7 @@ { "@timestamp": "2018-12-03T20:00:00.143Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2020-04-28T11:07:58.223Z", @@ -313,12 +327,24 @@ "www.maps.live.com.au" ], "issuer": { - "common_name": "Microsoft IT TLS CA 5", - "country": "US", - "locality": "Redmond", - "organization": "Microsoft Corporation", - "organizational_unit": "Microsoft IT", - "state_or_province": "Washington" + "common_name": [ + "Microsoft IT TLS CA 5" + ], + "country": [ + "US" + ], + "locality": [ + "Redmond" + ], + "organization": [ + "Microsoft Corporation" + ], + "organizational_unit": [ + "Microsoft IT" + ], + "state_or_province": [ + "Washington" + ] }, "not_after": "2019-07-10T17:47:08.000Z", "not_before": "2017-07-20T17:47:08.000Z", @@ -328,7 +354,9 @@ "serial_number": "2D00003299D7071DB7D1708A42000000003299", "signature_algorithm": "SHA256-RSA", "subject": { - "common_name": "www.bing.com" + "common_name": [ + "www.bing.com" + ] }, "version_number": "3" } diff --git a/packages/zeek/data_stream/x509/agent/stream/httpjson.yml.hbs b/packages/zeek/data_stream/x509/agent/stream/httpjson.yml.hbs index 33f251e7d6a..96a27b8f2cc 100644 --- a/packages/zeek/data_stream/x509/agent/stream/httpjson.yml.hbs +++ b/packages/zeek/data_stream/x509/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: 2 interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} {{#unless token}} {{#if username}} {{#if password}} diff --git a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml index 6cb1ce07e93..6fcf8aeb9da 100644 --- a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/default.yml @@ -26,7 +26,7 @@ processors: value: event - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - append: field: event.type value: info @@ -93,7 +93,7 @@ processors: - set: field: event.id copy_from: zeek.session_id - if: ctx?.zeek?.session_id != null + if: ctx.zeek?.session_id != null - rename: field: zeek.x509.certificate.not_valid_before target_field: zeek.x509.certificate.valid.from @@ -155,11 +155,11 @@ processors: field: zeek.x509.ts - set: field: event.id - value: "{{zeek.session_id}}" + value: "{{{zeek.session_id}}}" if: ctx.zeek.session_id != null - set: field: file.x509.signature_algorithm - value: "{{zeek.x509.certificate.signature_algorithm}}" + value: "{{{zeek.x509.certificate.signature_algorithm}}}" ignore_empty_value: true - script: lang: painless @@ -182,10 +182,10 @@ processors: if (algo != null) { ctx.file.x509.signature_algorithm = algo; } - if: ctx?.file?.x509?.signature_algorithm != null + if: ctx.file?.x509?.signature_algorithm != null - set: field: file.x509.public_key_algorithm - value: "{{zeek.x509.certificate.key.algorithm}}" + value: "{{{zeek.x509.certificate.key.algorithm}}}" ignore_empty_value: true - convert: field: zeek.x509.certificate.key.length @@ -205,14 +205,14 @@ processors: path: zeek.x509 - set: field: file.x509.serial_number - value: "{{zeek.x509.certificate.serial}}" + value: "{{{zeek.x509.certificate.serial}}}" ignore_empty_value: true - dot_expander: field: certificate.version path: zeek.x509 - set: field: file.x509.version_number - value: "{{zeek.x509.certificate.version}}" + value: "{{{zeek.x509.certificate.version}}}" ignore_empty_value: true - dot_expander: field: san.dns @@ -223,7 +223,7 @@ processors: processor: append: field: file.x509.alternative_names - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" - dot_expander: field: san.uri path: zeek.x509 @@ -233,7 +233,7 @@ processors: processor: append: field: file.x509.alternative_names - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" - dot_expander: field: san.email path: zeek.x509 @@ -243,7 +243,7 @@ processors: processor: append: field: file.x509.alternative_names - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" - dot_expander: field: san.ip path: zeek.x509 @@ -253,7 +253,7 @@ processors: processor: append: field: file.x509.alternative_names - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" - dot_expander: field: san.other_fields path: zeek.x509 @@ -263,7 +263,7 @@ processors: processor: append: field: file.x509.alternative_names - value: "{{_ingest._value}}" + value: "{{{_ingest._value}}}" - date: field: zeek.x509.certificate.valid.from target_field: zeek.x509.certificate.valid.from @@ -273,7 +273,7 @@ processors: if: ctx.zeek.x509.certificate?.valid?.from != null - set: field: file.x509.not_before - value: "{{zeek.x509.certificate.valid.from}}" + value: "{{{zeek.x509.certificate.valid.from}}}" ignore_empty_value: true - date: field: zeek.x509.certificate.valid.until @@ -284,7 +284,7 @@ processors: if: ctx.zeek.x509.certificate?.valid?.until != null - set: field: file.x509.not_after - value: "{{zeek.x509.certificate.valid.until}}" + value: "{{{zeek.x509.certificate.valid.until}}}" ignore_empty_value: true - gsub: field: zeek.x509.certificate.iss @@ -300,54 +300,56 @@ processors: - remove: field: zeek.x509.certificate.iss ignore_missing: true + + - set: + field: file.x509.issuer.country + value: ["{{{zeek.x509.certificate.issuer.C}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.C instanceof String - rename: field: zeek.x509.certificate.issuer.C target_field: zeek.x509.certificate.issuer.country ignore_missing: true - set: - field: file.x509.issuer.country - value: "{{zeek.x509.certificate.issuer.country}}" - ignore_empty_value: true + field: file.x509.issuer.common_name + value: ["{{{zeek.x509.certificate.issuer.CN}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.CN instanceof String - rename: field: zeek.x509.certificate.issuer.CN target_field: zeek.x509.certificate.issuer.common_name ignore_missing: true - set: - field: file.x509.issuer.common_name - value: "{{zeek.x509.certificate.issuer.common_name}}" - ignore_empty_value: true + field: file.x509.issuer.locality + value: ["{{{zeek.x509.certificate.issuer.L}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.L instanceof String - rename: field: zeek.x509.certificate.issuer.L target_field: zeek.x509.certificate.issuer.locality ignore_missing: true - set: - field: file.x509.issuer.locality - value: "{{zeek.x509.certificate.issuer.locality}}" - ignore_empty_value: true + field: file.x509.issuer.organization + value: ["{{{zeek.x509.certificate.issuer.O}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.O instanceof String - rename: field: zeek.x509.certificate.issuer.O target_field: zeek.x509.certificate.issuer.organization ignore_missing: true - set: - field: file.x509.issuer.organization - value: "{{zeek.x509.certificate.issuer.organization}}" - ignore_empty_value: true + field: file.x509.issuer.organizational_unit + value: ["{{{zeek.x509.certificate.issuer.OU}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.OU instanceof String - rename: field: zeek.x509.certificate.issuer.OU target_field: zeek.x509.certificate.issuer.organizational_unit ignore_missing: true - set: - field: file.x509.issuer.organizational_unit - value: "{{zeek.x509.certificate.issuer.organizational_unit}}" - ignore_empty_value: true + field: file.x509.issuer.state_or_province + value: ["{{{zeek.x509.certificate.issuer.ST}}}"] + if: ctx.zeek?.x509?.certificate?.issuer?.ST instanceof String - rename: field: zeek.x509.certificate.issuer.ST target_field: zeek.x509.certificate.issuer.state ignore_missing: true - - set: - field: file.x509.issuer.state_or_province - value: "{{zeek.x509.certificate.issuer.state}}" - ignore_empty_value: true + - gsub: field: zeek.x509.certificate.sub pattern: \\, @@ -362,57 +364,59 @@ processors: - remove: field: zeek.x509.certificate.sub ignore_missing: true + + - set: + field: file.x509.subject.country + value: ["{{{zeek.x509.certificate.subject.C}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.C instanceof String - rename: field: zeek.x509.certificate.subject.C target_field: zeek.x509.certificate.subject.country ignore_missing: true - set: - field: file.x509.subject.country - value: "{{zeek.x509.certificate.subject.country}}" - ignore_empty_value: true + field: file.x509.subject.common_name + value: ["{{{zeek.x509.certificate.subject.CN}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.CN instanceof String - rename: field: zeek.x509.certificate.subject.CN target_field: zeek.x509.certificate.subject.common_name ignore_missing: true - set: - field: file.x509.subject.common_name - value: "{{zeek.x509.certificate.subject.common_name}}" - ignore_empty_value: true + field: file.x509.subject.locality + value: ["{{{zeek.x509.certificate.subject.L}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.L instanceof String - rename: field: zeek.x509.certificate.subject.L target_field: zeek.x509.certificate.subject.locality ignore_missing: true - set: - field: file.x509.subject.locality - value: "{{zeek.x509.certificate.subject.locality}}" - ignore_empty_value: true + field: file.x509.subject.organization + value: ["{{{zeek.x509.certificate.subject.O}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.O instanceof String - rename: field: zeek.x509.certificate.subject.O target_field: zeek.x509.certificate.subject.organization ignore_missing: true - set: - field: file.x509.subject.organization - value: "{{zeek.x509.certificate.subject.organization}}" - ignore_empty_value: true + field: file.x509.subject.organizational_unit + value: ["{{{zeek.x509.certificate.subject.OU}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.OU instanceof String - rename: field: zeek.x509.certificate.subject.OU target_field: zeek.x509.certificate.subject.organizational_unit ignore_missing: true - set: - field: file.x509.subject.organizational_unit - value: "{{zeek.x509.certificate.subject.organizational_unit}}" - ignore_empty_value: true + field: file.x509.subject.state_or_province + value: ["{{{zeek.x509.certificate.subject.ST}}}"] + if: ctx.zeek?.x509?.certificate?.subject?.ST instanceof String - rename: field: zeek.x509.certificate.subject.ST target_field: zeek.x509.certificate.subject.state ignore_missing: true - - set: - field: file.x509.subject.state_or_province - value: "{{zeek.x509.certificate.subject.state}}" - ignore_empty_value: true + - remove: field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" + if: "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))" ignore_failure: true ignore_missing: true on_failure: diff --git a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/third-party.yml b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/third-party.yml index f0efef2daf7..e7e7e2a3288 100644 --- a/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/third-party.yml +++ b/packages/zeek/data_stream/x509/elasticsearch/ingest_pipeline/third-party.yml @@ -37,6 +37,6 @@ on_failure: field: error.message value: >- error in third party api pipeline: - error in [{{_ingest.on_failure_processor_type}}] processor{{#_ingest.on_failure_processor_tag}} - with tag [{{_ingest.on_failure_processor_tag }}]{{/_ingest.on_failure_processor_tag}} - {{ _ingest.on_failure_message }} + error in [{{{_ingest.on_failure_processor_type}}}] processor{{{#_ingest.on_failure_processor_tag}}} + with tag [{{{_ingest.on_failure_processor_tag }}}]{{{/_ingest.on_failure_processor_tag}}} + {{{ _ingest.on_failure_message }}} diff --git a/packages/zeek/data_stream/x509/manifest.yml b/packages/zeek/data_stream/x509/manifest.yml index ae5b23ca7ee..5700301ec32 100644 --- a/packages/zeek/data_stream/x509/manifest.yml +++ b/packages/zeek/data_stream/x509/manifest.yml @@ -35,7 +35,7 @@ streams: required: false show_user: false description: > - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. template_path: log.yml.hbs title: Zeek x509.log @@ -82,4 +82,4 @@ streams: required: false show_user: false description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. + Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details. diff --git a/packages/zeek/data_stream/x509/sample_event.json b/packages/zeek/data_stream/x509/sample_event.json new file mode 100644 index 00000000000..318774608d5 --- /dev/null +++ b/packages/zeek/data_stream/x509/sample_event.json @@ -0,0 +1,269 @@ +{ + "@timestamp": "2018-12-03T20:00:00.143Z", + "agent": { + "ephemeral_id": "63091ee9-ce6c-4321-b2be-3bc406bfe4c1", + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "name": "docker-fleet-agent", + "type": "filebeat", + "version": "8.7.1" + }, + "data_stream": { + "dataset": "zeek.x509", + "namespace": "ep", + "type": "logs" + }, + "ecs": { + "version": "8.9.0" + }, + "elastic_agent": { + "id": "9fb69190-14e5-47fd-bf29-410175dcf8e3", + "snapshot": false, + "version": "8.7.1" + }, + "event": { + "agent_id_status": "verified", + "created": "2023-09-03T22:57:08.737Z", + "dataset": "zeek.x509", + "id": "FxZ6gZ3YR6vFlIocq3", + "ingested": "2023-09-03T22:57:12Z", + "kind": "event", + "original": "{\"ts\":1543867200.143484,\"id\":\"FxZ6gZ3YR6vFlIocq3\",\"certificate.version\":3,\"certificate.serial\":\"2D00003299D7071DB7D1708A42000000003299\",\"certificate.subject\":\"CN=www.bing.com\",\"certificate.issuer\":\"CN=Microsoft IT TLS CA 5,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US\",\"certificate.not_valid_before\":1500572828.0,\"certificate.not_valid_after\":1562780828.0,\"certificate.key_alg\":\"rsaEncryption\",\"certificate.sig_alg\":\"sha256WithRSAEncryption\",\"certificate.key_type\":\"rsa\",\"certificate.key_length\":2048,\"certificate.exponent\":\"65537\",\"san.dns\":[\"www.bing.com\",\"dict.bing.com.cn\",\"*.platform.bing.com\",\"*.bing.com\",\"bing.com\",\"ieonline.microsoft.com\",\"*.windowssearch.com\",\"cn.ieonline.microsoft.com\",\"*.origin.bing.com\",\"*.mm.bing.net\",\"*.api.bing.com\",\"ecn.dev.virtualearth.net\",\"*.cn.bing.net\",\"*.cn.bing.com\",\"ssl-api.bing.com\",\"ssl-api.bing.net\",\"*.api.bing.net\",\"*.bingapis.com\",\"bingsandbox.com\",\"feedback.microsoft.com\",\"insertmedia.bing.office.net\",\"r.bat.bing.com\",\"*.r.bat.bing.com\",\"*.dict.bing.com.cn\",\"*.dict.bing.com\",\"*.ssl.bing.com\",\"*.appex.bing.com\",\"*.platform.cn.bing.com\",\"wp.m.bing.com\",\"*.m.bing.com\",\"global.bing.com\",\"windowssearch.com\",\"search.msn.com\",\"*.bingsandbox.com\",\"*.api.tiles.ditu.live.com\",\"*.ditu.live.com\",\"*.t0.tiles.ditu.live.com\",\"*.t1.tiles.ditu.live.com\",\"*.t2.tiles.ditu.live.com\",\"*.t3.tiles.ditu.live.com\",\"*.tiles.ditu.live.com\",\"3d.live.com\",\"api.search.live.com\",\"beta.search.live.com\",\"cnweb.search.live.com\",\"dev.live.com\",\"ditu.live.com\",\"farecast.live.com\",\"image.live.com\",\"images.live.com\",\"local.live.com.au\",\"localsearch.live.com\",\"ls4d.search.live.com\",\"mail.live.com\",\"mapindia.live.com\",\"local.live.com\",\"maps.live.com\",\"maps.live.com.au\",\"mindia.live.com\",\"news.live.com\",\"origin.cnweb.search.live.com\",\"preview.local.live.com\",\"search.live.com\",\"test.maps.live.com\",\"video.live.com\",\"videos.live.com\",\"virtualearth.live.com\",\"wap.live.com\",\"webmaster.live.com\",\"webmasters.live.com\",\"www.local.live.com.au\",\"www.maps.live.com.au\"]}", + "type": [ + "info" + ] + }, + "file": { + "x509": { + "alternative_names": [ + "www.bing.com", + "dict.bing.com.cn", + "*.platform.bing.com", + "*.bing.com", + "bing.com", + "ieonline.microsoft.com", + "*.windowssearch.com", + "cn.ieonline.microsoft.com", + "*.origin.bing.com", + "*.mm.bing.net", + "*.api.bing.com", + "ecn.dev.virtualearth.net", + "*.cn.bing.net", + "*.cn.bing.com", + "ssl-api.bing.com", + "ssl-api.bing.net", + "*.api.bing.net", + "*.bingapis.com", + "bingsandbox.com", + "feedback.microsoft.com", + "insertmedia.bing.office.net", + "r.bat.bing.com", + "*.r.bat.bing.com", + "*.dict.bing.com.cn", + "*.dict.bing.com", + "*.ssl.bing.com", + "*.appex.bing.com", + "*.platform.cn.bing.com", + "wp.m.bing.com", + "*.m.bing.com", + "global.bing.com", + "windowssearch.com", + "search.msn.com", + "*.bingsandbox.com", + "*.api.tiles.ditu.live.com", + "*.ditu.live.com", + "*.t0.tiles.ditu.live.com", + "*.t1.tiles.ditu.live.com", + "*.t2.tiles.ditu.live.com", + "*.t3.tiles.ditu.live.com", + "*.tiles.ditu.live.com", + "3d.live.com", + "api.search.live.com", + "beta.search.live.com", + "cnweb.search.live.com", + "dev.live.com", + "ditu.live.com", + "farecast.live.com", + "image.live.com", + "images.live.com", + "local.live.com.au", + "localsearch.live.com", + "ls4d.search.live.com", + "mail.live.com", + "mapindia.live.com", + "local.live.com", + "maps.live.com", + "maps.live.com.au", + "mindia.live.com", + "news.live.com", + "origin.cnweb.search.live.com", + "preview.local.live.com", + "search.live.com", + "test.maps.live.com", + "video.live.com", + "videos.live.com", + "virtualearth.live.com", + "wap.live.com", + "webmaster.live.com", + "webmasters.live.com", + "www.local.live.com.au", + "www.maps.live.com.au" + ], + "issuer": { + "common_name": [ + "Microsoft IT TLS CA 5" + ], + "country": [ + "US" + ], + "locality": [ + "Redmond" + ], + "organization": [ + "Microsoft Corporation" + ], + "organizational_unit": [ + "Microsoft IT" + ], + "state_or_province": [ + "Washington" + ] + }, + "not_after": "2019-07-10T17:47:08.000Z", + "not_before": "2017-07-20T17:47:08.000Z", + "public_key_algorithm": "rsaEncryption", + "public_key_exponent": 65537, + "public_key_size": 2048, + "serial_number": "2D00003299D7071DB7D1708A42000000003299", + "signature_algorithm": "SHA256-RSA", + "subject": { + "common_name": [ + "www.bing.com" + ] + }, + "version_number": "3" + } + }, + "host": { + "name": "Lees-MBP.localdomain" + }, + "input": { + "type": "httpjson" + }, + "log": { + "file": { + "path": "/usr/local/var/log/zeek/x509.log" + } + }, + "tags": [ + "preserve_original_event", + "forwarded", + "zeek-x509" + ], + "zeek": { + "session_id": "FxZ6gZ3YR6vFlIocq3", + "x509": { + "certificate": { + "exponent": "65537", + "issuer": { + "common_name": "Microsoft IT TLS CA 5", + "country": "US", + "locality": "Redmond", + "organization": "Microsoft Corporation", + "organizational_unit": "Microsoft IT", + "state": "Washington" + }, + "key": { + "algorithm": "rsaEncryption", + "length": 2048, + "type": "rsa" + }, + "serial": "2D00003299D7071DB7D1708A42000000003299", + "signature_algorithm": "sha256WithRSAEncryption", + "subject": { + "common_name": "www.bing.com" + }, + "valid": { + "from": "2017-07-20T17:47:08.000Z", + "until": "2019-07-10T17:47:08.000Z" + }, + "version": 3 + }, + "san": { + "dns": [ + "www.bing.com", + "dict.bing.com.cn", + "*.platform.bing.com", + "*.bing.com", + "bing.com", + "ieonline.microsoft.com", + "*.windowssearch.com", + "cn.ieonline.microsoft.com", + "*.origin.bing.com", + "*.mm.bing.net", + "*.api.bing.com", + "ecn.dev.virtualearth.net", + "*.cn.bing.net", + "*.cn.bing.com", + "ssl-api.bing.com", + "ssl-api.bing.net", + "*.api.bing.net", + "*.bingapis.com", + "bingsandbox.com", + "feedback.microsoft.com", + "insertmedia.bing.office.net", + "r.bat.bing.com", + "*.r.bat.bing.com", + "*.dict.bing.com.cn", + "*.dict.bing.com", + "*.ssl.bing.com", + "*.appex.bing.com", + "*.platform.cn.bing.com", + "wp.m.bing.com", + "*.m.bing.com", + "global.bing.com", + "windowssearch.com", + "search.msn.com", + "*.bingsandbox.com", + "*.api.tiles.ditu.live.com", + "*.ditu.live.com", + "*.t0.tiles.ditu.live.com", + "*.t1.tiles.ditu.live.com", + "*.t2.tiles.ditu.live.com", + "*.t3.tiles.ditu.live.com", + "*.tiles.ditu.live.com", + "3d.live.com", + "api.search.live.com", + "beta.search.live.com", + "cnweb.search.live.com", + "dev.live.com", + "ditu.live.com", + "farecast.live.com", + "image.live.com", + "images.live.com", + "local.live.com.au", + "localsearch.live.com", + "ls4d.search.live.com", + "mail.live.com", + "mapindia.live.com", + "local.live.com", + "maps.live.com", + "maps.live.com.au", + "mindia.live.com", + "news.live.com", + "origin.cnweb.search.live.com", + "preview.local.live.com", + "search.live.com", + "test.maps.live.com", + "video.live.com", + "videos.live.com", + "virtualearth.live.com", + "wap.live.com", + "webmaster.live.com", + "webmasters.live.com", + "www.local.live.com.au", + "www.maps.live.com.au" + ] + } + } + } +} \ No newline at end of file diff --git a/packages/zeek/docs/README.md b/packages/zeek/docs/README.md index d23c4f1434a..e854ffafadd 100644 --- a/packages/zeek/docs/README.md +++ b/packages/zeek/docs/README.md @@ -47,10 +47,10 @@ which contains packet loss rate data. | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -129,12 +129,12 @@ contains TCP/UDP/ICMP connection data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -241,11 +241,11 @@ contains Distributed Computing Environment/RPC data. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -329,11 +329,11 @@ DHCP lease data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -434,11 +434,11 @@ requests and replies. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -548,12 +548,12 @@ activity. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | @@ -664,11 +664,11 @@ protocol detection failures. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -746,11 +746,11 @@ file analysis results. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.hash.md5 | MD5 hash. | keyword | @@ -856,11 +856,11 @@ activity. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | @@ -976,11 +976,11 @@ HTTP requests and replies. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1036,6 +1036,7 @@ HTTP requests and replies. | url.password | Password of the request. | keyword | | url.path | Path of the request, such as "/search". | wildcard | | url.port | Port of the request, such as 443. | long | +| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | | url.username | Username of the request. | keyword | | user.name | Short name or login of the user. | keyword | | user.name.text | Multi-field of `user.name`. | match_only_text | @@ -1054,6 +1055,7 @@ HTTP requests and replies. | user_agent.version | Version of the user agent. | keyword | | zeek.http.captured_password | Determines if the password will be captured for this request. | boolean | | zeek.http.client_header_names | The vector of HTTP header names sent by the client. No header values are included here, just the header names. | keyword | +| zeek.http.host | The Zeek host if it differs from the domain extracted from the Zeek URI. | keyword | | zeek.http.info_code | Last seen 1xx informational reply code returned by the server. | integer | | zeek.http.info_msg | Last seen 1xx informational reply message returned by the server. | keyword | | zeek.http.orig_filenames | An ordered vector of filenames from the originator. | keyword | @@ -1116,10 +1118,10 @@ intelligence data matches. | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1254,11 +1256,11 @@ commands and responses. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | @@ -1364,11 +1366,11 @@ contains kerberos data. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1479,10 +1481,10 @@ The `known_certs` dataset captures information about SSL/TLS certificates seen o | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -1563,10 +1565,10 @@ The `known_hosts` dataset simply records a timestamp and an IP address when Zeek | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -1630,10 +1632,10 @@ The `known_services` dataset records a timestamp, IP, port number, protocol, and | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -1726,11 +1728,11 @@ modbus commands and responses. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1824,11 +1826,11 @@ MySQL data. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -1923,11 +1925,11 @@ Zeek notices. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.mime_type | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | keyword | @@ -2046,12 +2048,12 @@ NTP data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -2160,11 +2162,11 @@ LAN Manager(NTLM) data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2252,10 +2254,10 @@ Online Certificate Status Protocol (OCSP) data. | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | | file.path.text | Multi-field of `file.path`. | match_only_text | @@ -2325,10 +2327,10 @@ portable executable data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -2416,11 +2418,11 @@ RADIUS authentication attempts. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2522,11 +2524,11 @@ data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -2633,11 +2635,11 @@ Remote Framebuffer (RFB) data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -2739,12 +2741,12 @@ Zeek signature matches. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | -| event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | +| event.duration | Duration of the event in nanoseconds. If `event.start` and `event.end` are known this value should be the difference between the end and start time. | long | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -2849,11 +2851,11 @@ data. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -2967,11 +2969,11 @@ contains SMB commands. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -3081,11 +3083,11 @@ contains SMB file data. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.accessed | Last time the file was accessed. Note that not all filesystems keep track of access time. | date | @@ -3194,11 +3196,11 @@ which contains SMB trees. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.path | Full path to the file, including the file name. It should include the drive letter, when appropriate. | keyword | @@ -3293,11 +3295,11 @@ SMTP transactions.. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -3410,11 +3412,11 @@ SNMP messages. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -3511,11 +3513,11 @@ SOCKS proxy requests. | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -3601,10 +3603,10 @@ The `software` dataset collects details on applications operated by the hosts it | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -3692,11 +3694,11 @@ connection data. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | @@ -3799,11 +3801,11 @@ SSL/TLS handshake info. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -3949,10 +3951,10 @@ memory/event/packet/lag statistics. | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -4046,11 +4048,11 @@ syslog messages. | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | host.architecture | Operating system architecture. | keyword | | host.containerized | If the host is a container. | boolean | @@ -4143,10 +4145,10 @@ contains traceroute detections. | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -4233,11 +4235,11 @@ tunneling protocol events. | error.message | Error message. | match_only_text | | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -4324,11 +4326,11 @@ unexpected network-level activity. | destination.port | Port of the destination. | long | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | host.architecture | Operating system architecture. | keyword | @@ -4405,11 +4407,11 @@ X.509 certificate info. | data_stream.type | Data stream type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | | file.x509.alternative_names | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | keyword | diff --git a/packages/zeek/kibana/dashboard/zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c.json b/packages/zeek/kibana/dashboard/zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c.json index d90574a1283..88978c5fb6b 100644 --- a/packages/zeek/kibana/dashboard/zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c.json +++ b/packages/zeek/kibana/dashboard/zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c.json @@ -1,14 +1,6 @@ { - "id": "zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c", - "type": "dashboard", - "namespaces": [ - "default" - ], - "updated_at": "2022-11-23T07:48:08.211Z", - "version": "WzU4MywxXQ==", "attributes": { "description": "Overview of Zeek", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [], @@ -20,81 +12,124 @@ }, "optionsJSON": { "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Network Transport [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2e1ab952-8a43-45ab-966a-9de397e1c043", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "2e1ab952-8a43-45ab-966a-9de397e1c043": { + "columnOrder": [ + "92bc57dc-f42d-4ced-98b6-4b9abb3aee6b", + "22f952a9-023c-4b01-8346-a67afa26cdc5" + ], + "columns": { + "22f952a9-023c-4b01-8346-a67afa26cdc5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "92bc57dc-f42d-4ced-98b6-4b9abb3aee6b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.transport: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "22f952a9-023c-4b01-8346-a67afa26cdc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.transport" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "2e1ab952-8a43-45ab-966a-9de397e1c043", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "22f952a9-023c-4b01-8346-a67afa26cdc5" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "92bc57dc-f42d-4ced-98b6-4b9abb3aee6b" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "network.transport", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Network Transport [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -104,81 +139,122 @@ "y": 20 }, "panelIndex": "2", - "type": "visualization", - "version": "8.0.0" + "title": "Network Transport [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Network Protocols [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-46519e1c-148c-4c8f-8b08-67654b2e42de", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "46519e1c-148c-4c8f-8b08-67654b2e42de": { + "columnOrder": [ + "487998c1-ebec-40b1-9b7c-7191a9d3829b", + "9f550284-0a86-49bf-ad17-0f0a509d1d5e" + ], + "columns": { + "487998c1-ebec-40b1-9b7c-7191a9d3829b": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.protocol: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "9f550284-0a86-49bf-ad17-0f0a509d1d5e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.protocol" + }, + "9f550284-0a86-49bf-ad17-0f0a509d1d5e": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "46519e1c-148c-4c8f-8b08-67654b2e42de", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "9f550284-0a86-49bf-ad17-0f0a509d1d5e" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "487998c1-ebec-40b1-9b7c-7191a9d3829b" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "network.protocol", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Network Protocols [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -188,81 +264,122 @@ "y": 20 }, "panelIndex": "3", - "type": "visualization", - "version": "8.0.0" + "title": "Network Protocols [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Network Traffic Direction [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-8234ab97-91e6-49ec-b76e-35e4db3a32e4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "8234ab97-91e6-49ec-b76e-35e4db3a32e4": { + "columnOrder": [ + "ba9442c7-c0e9-46a2-8e76-927203aafbda", + "cdb1ded4-8c04-48a8-9a24-23853c3a81fa" + ], + "columns": { + "ba9442c7-c0e9-46a2-8e76-927203aafbda": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "network.direction: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "cdb1ded4-8c04-48a8-9a24-23853c3a81fa", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "network.direction" + }, + "cdb1ded4-8c04-48a8-9a24-23853c3a81fa": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "8234ab97-91e6-49ec-b76e-35e4db3a32e4", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "cdb1ded4-8c04-48a8-9a24-23853c3a81fa" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "ba9442c7-c0e9-46a2-8e76-927203aafbda" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "network.direction", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 5 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Network Traffic Direction [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -272,81 +389,122 @@ "y": 20 }, "panelIndex": "4", - "type": "visualization", - "version": "8.0.0" + "title": "Network Traffic Direction [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top DNS Domains [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-92f058e3-9875-4656-9ed4-b45d139431ea", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "92f058e3-9875-4656-9ed4-b45d139431ea": { + "columnOrder": [ + "171eacda-2c87-41a9-8f91-5098b58f7b3c", + "7dfde926-5c82-4bba-bec6-a29be57b255b" + ], + "columns": { + "171eacda-2c87-41a9-8f91-5098b58f7b3c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "zeek.dns.query: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "7dfde926-5c82-4bba-bec6-a29be57b255b", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "zeek.dns.query" + }, + "7dfde926-5c82-4bba-bec6-a29be57b255b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "92f058e3-9875-4656-9ed4-b45d139431ea", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "7dfde926-5c82-4bba-bec6-a29be57b255b" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "171eacda-2c87-41a9-8f91-5098b58f7b3c" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "zeek.dns.query", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Top DNS Domains [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -356,96 +514,122 @@ "y": 32 }, "panelIndex": "5", - "type": "visualization", - "version": "8.0.0" + "title": "Top DNS Domains [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top URL Domains [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "buckets": [ - { - "accessor": 0, - "aggType": "terms", - "format": { - "id": "terms", - "params": { - "id": "string", - "missingBucketLabel": "Missing", - "otherBucketLabel": "Other" - } - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1d801bdb-1b16-465d-885c-d464988b97de", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "1d801bdb-1b16-465d-885c-d464988b97de": { + "columnOrder": [ + "341b689d-8363-4946-be03-0435ab95f776", + "0527b5fb-2558-4271-a796-2dc9fce49d82" + ], + "columns": { + "0527b5fb-2558-4271-a796-2dc9fce49d82": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "341b689d-8363-4946-be03-0435ab95f776": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "url.domain: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0527b5fb-2558-4271-a796-2dc9fce49d82", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "url.domain" + } + }, + "incompleteColumns": {} + } } - ], - "metric": { - "accessor": 1, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true - }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "1d801bdb-1b16-465d-885c-d464988b97de", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "0527b5fb-2558-4271-a796-2dc9fce49d82" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "341b689d-8363-4946-be03-0435ab95f776" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "url.domain", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Top URL Domains [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -455,81 +639,122 @@ "y": 32 }, "panelIndex": "6", - "type": "visualization", - "version": "8.0.0" + "title": "Top URL Domains [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Top SSL Servers [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "addLegend": true, - "addTooltip": true, - "dimensions": { - "metric": { - "accessor": 0, - "aggType": "count", - "format": { - "id": "number" - }, - "params": {} + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ffee3da2-76d4-4313-b6b0-2d76fad9a9fa", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "ffee3da2-76d4-4313-b6b0-2d76fad9a9fa": { + "columnOrder": [ + "d0058208-3452-4563-9a34-591dfd02dfe6", + "5e294a58-e1ee-44fb-a708-699093b1f180" + ], + "columns": { + "5e294a58-e1ee-44fb-a708-699093b1f180": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "d0058208-3452-4563-9a34-591dfd02dfe6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "zeek.ssl.server.name: Descending", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "5e294a58-e1ee-44fb-a708-699093b1f180", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "zeek.ssl.server.name" + } + }, + "incompleteColumns": {} + } + } + }, + "textBased": { + "layers": {} } }, - "distinctColors": true, - "isDonut": true, - "labels": { - "last_level": true, - "show": false, - "truncate": 100, - "values": true + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" }, - "legendPosition": "right", - "palette": { - "name": "kibana_palette", - "type": "palette" - }, - "type": "pie" - }, - "type": "pie", - "data": { - "aggs": [ - { - "enabled": true, - "id": "1", - "params": {}, - "schema": "metric", - "type": "count" + "visualization": { + "layers": [ + { + "categoryDisplay": "hide", + "emptySizeRatio": 0.3, + "layerId": "ffee3da2-76d4-4313-b6b0-2d76fad9a9fa", + "layerType": "data", + "legendDisplay": "hide", + "legendMaxLines": 1, + "legendPosition": "right", + "legendSize": "auto", + "metrics": [ + "5e294a58-e1ee-44fb-a708-699093b1f180" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "percentDecimals": 2, + "primaryGroups": [ + "d0058208-3452-4563-9a34-591dfd02dfe6" + ], + "secondaryGroups": [], + "showValuesInLegend": true, + "truncateLegend": true + } + ], + "palette": { + "name": "kibana_palette", + "type": "palette" }, - { - "enabled": true, - "id": "2", - "params": { - "field": "zeek.ssl.server.name", - "missingBucket": false, - "missingBucketLabel": "Missing", - "order": "desc", - "orderBy": "1", - "otherBucket": false, - "otherBucketLabel": "Other", - "size": 10 - }, - "schema": "segment", - "type": "terms" - } - ], - "searchSource": { - "filter": [], - "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", - "query": { - "language": "kuery", - "query": "(data_stream.dataset:zeek.capture_loss OR data_stream.dataset:zeek.connection OR data_stream.dataset:zeek.dce_rpc OR data_stream.dataset:zeek.dhcp OR data_stream.dataset:zeek.dnp3 OR data_stream.dataset:zeek.dns OR data_stream.dataset:zeek.dpd OR data_stream.dataset:zeek.files OR data_stream.dataset:zeek.ftp OR data_stream.dataset:zeek.http OR data_stream.dataset:zeek.intel OR data_stream.dataset:zeek.irc OR data_stream.dataset:zeek.kerberos OR data_stream.dataset:zeek.modbus OR data_stream.dataset:zeek.mysql OR data_stream.dataset:zeek.notice OR data_stream.dataset:zeek.ntlm OR data_stream.dataset:zeek.ocsp OR data_stream.dataset:zeek.pe OR data_stream.dataset:zeek.radius OR data_stream.dataset:zeek.rdp OR data_stream.dataset:zeek.rfb OR data_stream.dataset:zeek.sip OR data_stream.dataset:zeek.smb_cmd OR data_stream.dataset:zeek.smb_files OR data_stream.dataset:zeek.smb_mapping OR data_stream.dataset:zeek.smtp OR data_stream.dataset:zeek.snmp OR data_stream.dataset:zeek.socks OR data_stream.dataset:zeek.ssh OR data_stream.dataset:zeek.ssl OR data_stream.dataset:zeek.stats OR data_stream.dataset:zeek.syslog OR data_stream.dataset:zeek.traceroute OR data_stream.dataset:zeek.tunnel OR data_stream.dataset:zeek.weird OR data_stream.dataset:zeek.x509)" - } + "shape": "donut" } - } - } + }, + "title": "Top SSL Servers [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 12, @@ -539,58 +764,151 @@ "y": 32 }, "panelIndex": "7", - "type": "visualization", - "version": "8.0.0" + "title": "Top SSL Servers [Logs Zeek]", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "savedVis": { - "title": "Number of Sessions Overtime [Logs Zeek]", - "description": "", - "uiState": {}, - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "drop_last_bucket": 1, - "id": "61ca57f0-469d-11e7-af02-69e470af7417", - "index_pattern": "logs-*", - "interval": "auto", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "number", - "id": "61ca57f1-469d-11e7-af02-69e470af7417", - "line_width": 1, - "metrics": [ - { - "id": "61ca57f2-469d-11e7-af02-69e470af7417", - "type": "count" + "attributes": { + "references": [], + "state": { + "adHocDataViews": { + "tsvb_ad_hoc_logs-*/@timestamp": { + "allowNoIndex": false, + "fieldAttrs": {}, + "fieldFormats": {}, + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "logs-*", + "runtimeFieldMap": {}, + "sourceFilters": [], + "timeFieldName": "@timestamp", + "title": "logs-*" + } + }, + "datasourceStates": { + "formBased": { + "layers": { + "05b39879-d60a-4a75-8fe7-d9dc1c30734b": { + "columnOrder": [ + "3ada3c2e-c51d-4506-9aca-a14bd87d3b52", + "d5c9d2d0-8c4a-411f-acb2-e0dd2ac30d15" + ], + "columns": { + "3ada3c2e-c51d-4506-9aca-a14bd87d3b52": { + "dataType": "date", + "isBucketed": true, + "label": "@timestamp", + "operationType": "date_histogram", + "params": { + "dropPartials": true, + "includeEmptyRows": true, + "interval": "auto" + }, + "scale": "interval", + "sourceField": "@timestamp" + }, + "d5c9d2d0-8c4a-411f-acb2-e0dd2ac30d15": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "incompleteColumns": {} } - ], - "point_size": 1, - "separate_axis": 0, - "split_color_mode": "gradient", - "split_mode": "everything", - "stacked": "none" + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [], + "internalReferences": [ + { + "id": "tsvb_ad_hoc_logs-*/@timestamp", + "name": "indexpattern-datasource-layer-05b39879-d60a-4a75-8fe7-d9dc1c30734b", + "type": "index-pattern" } ], - "show_grid": 1, - "show_legend": 1, - "time_field": "@timestamp", - "type": "timeseries", - "use_kibana_indexes": false + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "axisTitlesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "fillOpacity": 0.5, + "fittingFunction": "None", + "gridlinesVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "labelsOrientation": { + "x": 0, + "yLeft": 0, + "yRight": 0 + }, + "layers": [ + { + "accessors": [ + "d5c9d2d0-8c4a-411f-acb2-e0dd2ac30d15" + ], + "layerId": "05b39879-d60a-4a75-8fe7-d9dc1c30734b", + "layerType": "data", + "palette": { + "name": "default", + "type": "palette" + }, + "seriesType": "area", + "xAccessor": "3ada3c2e-c51d-4506-9aca-a14bd87d3b52", + "yConfig": [ + { + "axisMode": "left", + "color": "#68BC00", + "forAccessor": "d5c9d2d0-8c4a-411f-acb2-e0dd2ac30d15" + } + ] + } + ], + "legend": { + "isVisible": true, + "maxLines": 1, + "position": "right", + "shouldTruncate": true, + "showSingleSeries": true + }, + "preferredSeriesType": "bar_stacked", + "tickLabelsVisibilitySettings": { + "x": true, + "yLeft": true, + "yRight": true + }, + "valueLabels": "hide", + "yLeftExtent": { + "mode": "full" + }, + "yLeftScale": "linear", + "yRightExtent": { + "mode": "full" + }, + "yRightScale": "linear" + } }, - "type": "metrics", - "data": { - "aggs": [], - "searchSource": {} - } - } + "title": "Number of Sessions Overtime [Logs Zeek]", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} }, "gridData": { "h": 12, @@ -600,20 +918,10 @@ "y": 44 }, "panelIndex": "8", - "type": "visualization", - "version": "8.0.0" + "type": "lens", + "version": "8.7.1" }, { - "version": "8.1.0", - "type": "map", - "gridData": { - "h": 20, - "i": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb", - "w": 48, - "x": 0, - "y": 0 - }, - "panelIndex": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb", "embeddableConfig": { "attributes": { "description": "", @@ -637,54 +945,66 @@ "lon": 10.89865, "zoom": 1.78 }, - "openTOCDetails": [], - "type": "map" - } + "openTOCDetails": [] + }, + "gridData": { + "h": 20, + "i": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb", + "type": "map", + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Zeek] Overview", "version": 1 }, + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-10T06:41:29.370Z", + "id": "zeek-7cbb5410-3700-11e9-aa6d-ff445a78330c", + "migrationVersion": { + "dashboard": "8.7.0" + }, "references": [ { "id": "logs-*", - "name": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb:layer_1_source_index_pattern", + "name": "2:indexpattern-datasource-layer-2e1ab952-8a43-45ab-966a-9de397e1c043", "type": "index-pattern" }, { - "type": "index-pattern", - "name": "2:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "3:indexpattern-datasource-layer-46519e1c-148c-4c8f-8b08-67654b2e42de", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "3:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "4:indexpattern-datasource-layer-8234ab97-91e6-49ec-b76e-35e4db3a32e4", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "4:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "5:indexpattern-datasource-layer-92f058e3-9875-4656-9ed4-b45d139431ea", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "5:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "6:indexpattern-datasource-layer-1d801bdb-1b16-465d-885c-d464988b97de", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "6:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "7:indexpattern-datasource-layer-ffee3da2-76d4-4313-b6b0-2d76fad9a9fa", + "type": "index-pattern" }, { - "type": "index-pattern", - "name": "7:kibanaSavedObjectMeta.searchSourceJSON.index", - "id": "logs-*" + "id": "logs-*", + "name": "4e6959b3-e0d0-40dc-aca0-b40adcd088bb:layer_1_source_index_pattern", + "type": "index-pattern" } ], - "migrationVersion": { - "dashboard": "8.1.0" - }, - "coreMigrationVersion": "8.1.0" + "type": "dashboard" } \ No newline at end of file diff --git a/packages/zeek/kibana/tags.yml b/packages/zeek/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zeek/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zeek/manifest.yml b/packages/zeek/manifest.yml index dd646aa72b9..5652f9c7bb6 100644 --- a/packages/zeek/manifest.yml +++ b/packages/zeek/manifest.yml @@ -1,7 +1,6 @@ name: zeek title: Zeek -version: "2.10.0" -release: ga +version: "2.16.0" description: Collect logs from Zeek with Elastic Agent. type: integration icons: @@ -9,11 +8,11 @@ icons: title: zeek size: 214x203 type: image/svg+xml -format_version: 1.0.0 -license: basic +format_version: "3.0.0" categories: [network, security] conditions: - kibana.version: ^8.1.0 + kibana: + version: ^8.7.1 screenshots: - src: /img/kibana-zeek.png title: kibana zeek @@ -98,5 +97,13 @@ policy_templates: # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk # sxSmbIUfc2SGJGCJD4I= # -----END CERTIFICATE----- + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/zerofox/_dev/build/build.yml b/packages/zerofox/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/zerofox/_dev/build/build.yml +++ b/packages/zerofox/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/zerofox/changelog.yml b/packages/zerofox/changelog.yml index 38421eb54ab..6115d8016f1 100644 --- a/packages/zerofox/changelog.yml +++ b/packages/zerofox/changelog.yml @@ -1,4 +1,29 @@ # newer versions go on top +- version: 1.17.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.16.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.15.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.14.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.13.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.12.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json b/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json index 7ed789221b7..4795d83cc95 100644 --- a/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json +++ b/packages/zerofox/data_stream/alerts/_dev/test/pipeline/test-alert.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-04-29T18:56:51.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2017-01-10T11:00:00.000Z", @@ -60,7 +60,7 @@ { "@timestamp": "2021-05-06T13:50:48.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2021-05-06T13:29:27.000Z", @@ -126,7 +126,7 @@ { "@timestamp": "2021-05-05T19:22:00.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "created": "2014-08-09T16:00:16.000Z", diff --git a/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 9ba1fa716d7..b6aaf23b14e 100644 --- a/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zerofox/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -4,7 +4,7 @@ processors: ## ECS version. - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' ## Event JSON decoding. - rename: diff --git a/packages/zerofox/docs/README.md b/packages/zerofox/docs/README.md index 2f2bbe13890..0c15bdf9bbc 100644 --- a/packages/zerofox/docs/README.md +++ b/packages/zerofox/docs/README.md @@ -36,11 +36,11 @@ Contains alert data received from the ZeroFox Cloud Platform | dataset.type | Dataset type. | constant_keyword | | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | error.message | Error message. | match_only_text | -| event.created | event.created contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from @timestamp in that @timestamp typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, @timestamp should be used. | date | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.severity | The numeric severity of the event according to your event source. What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source. The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | long | diff --git a/packages/zerofox/kibana/tags.yml b/packages/zerofox/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zerofox/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zerofox/manifest.yml b/packages/zerofox/manifest.yml index c2e4a969d60..19dc41c12fd 100644 --- a/packages/zerofox/manifest.yml +++ b/packages/zerofox/manifest.yml @@ -1,9 +1,9 @@ name: zerofox title: ZeroFox -version: "1.12.0" +version: "1.17.0" description: Collect logs from ZeroFox with Elastic Agent. type: integration -format_version: 2.7.0 +format_version: "3.0.0" icons: - src: /img/logo.svg title: logo ZeroFox @@ -12,7 +12,8 @@ icons: categories: - security conditions: - kibana.version: ^8.7.1 + kibana: + version: ^8.7.1 policy_templates: - name: zerofox title: ZeroFox Alerts @@ -23,7 +24,7 @@ policy_templates: - name: http_client_timeout type: text title: Http Client Timeout - description: Duration of the time limit on HTTP requests. + description: Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h. multi: false required: true show_user: true @@ -52,7 +53,7 @@ policy_templates: - name: initial_interval type: text title: Initial Interval - description: How far back to pull the initial alerts + description: How far back to pull the initial alerts. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -60,7 +61,7 @@ policy_templates: - name: interval type: text title: Periodic Polling Interval - description: How often to poll the ZeroFox API for new alerts + description: How often to poll the ZeroFox API for new alerts. Supported units for this parameter are h/m/s. multi: false required: true show_user: true @@ -69,3 +70,4 @@ policy_templates: description: "Collecting alert logs (input: httpjson)" owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/zeronetworks/_dev/build/build.yml b/packages/zeronetworks/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/zeronetworks/_dev/build/build.yml +++ b/packages/zeronetworks/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/zeronetworks/changelog.yml b/packages/zeronetworks/changelog.yml index d2f35482b1a..7d8de699cdb 100644 --- a/packages/zeronetworks/changelog.yml +++ b/packages/zeronetworks/changelog.yml @@ -1,4 +1,34 @@ # newer versions go on top +- version: 1.6.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.5.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.4.0" + changes: + - description: Add support for HTTP request trace logging. + type: enhancement + link: https://github.com/elastic/integrations/pull/7337 +- version: "1.3.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.2.0" + changes: + - description: Document duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6992 +- version: "1.1.0" + changes: + - description: Document valid duration units. + type: enhancement + link: https://github.com/elastic/integrations/pull/6706 - version: "1.0.0" changes: - description: Release Zero Networks as GA. diff --git a/packages/zeronetworks/data_stream/audit/agent/stream/httpjson.yml.hbs b/packages/zeronetworks/data_stream/audit/agent/stream/httpjson.yml.hbs index 78ded510afc..188710db0d3 100644 --- a/packages/zeronetworks/data_stream/audit/agent/stream/httpjson.yml.hbs +++ b/packages/zeronetworks/data_stream/audit/agent/stream/httpjson.yml.hbs @@ -1,5 +1,8 @@ config_version: "2" interval: {{interval}} +{{#if enable_request_tracer}} +request.tracer.filename: "../../logs/httpjson/http-request-trace-*.ndjson" +{{/if}} request.method: "GET" request.url: {{api_url}}/audit {{#if ssl}} diff --git a/packages/zeronetworks/data_stream/audit/manifest.yml b/packages/zeronetworks/data_stream/audit/manifest.yml index 024af8f74f4..6a68fbcb780 100644 --- a/packages/zeronetworks/data_stream/audit/manifest.yml +++ b/packages/zeronetworks/data_stream/audit/manifest.yml @@ -19,7 +19,7 @@ streams: multi: false required: true show_user: true - description: Interval at which the logs will be pulled. The value must be between 5m and 1h. + description: Interval at which the logs will be pulled. The value must be between 5m and 1h. Supported units for this parameter are h/m/s. default: 5m - name: initial_interval type: text @@ -27,7 +27,7 @@ streams: multi: false required: true show_user: false - description: Initial interval at which the logs will be pulled. Defaults to 7 days (168 hours). + description: Initial interval at which the logs will be pulled. Defaults to 7 days (168 hours). Supported units for this parameter are h/m/s. default: 168h - name: limit type: integer diff --git a/packages/zeronetworks/kibana/tags.yml b/packages/zeronetworks/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zeronetworks/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zeronetworks/manifest.yml b/packages/zeronetworks/manifest.yml index 97b478cd33d..cf213ad9313 100644 --- a/packages/zeronetworks/manifest.yml +++ b/packages/zeronetworks/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: zeronetworks title: "Zero Networks" -version: "1.0.0" +version: "1.6.0" source: license: "Elastic-2.0" description: "Zero Networks Logs integration" @@ -9,8 +9,10 @@ type: integration categories: - security conditions: - kibana.version: "^8.6.2" - elastic.subscription: "basic" + kibana: + version: "^8.6.2" + elastic: + subscription: "basic" screenshots: - src: /img/screenshot.png title: Screenshot @@ -54,9 +56,18 @@ policy_templates: - name: http_client_timeout type: text title: HTTP Client Timeout + description: Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h. multi: false required: false show_user: true default: 60s + - name: enable_request_tracer + type: bool + title: Enable request tracing + multi: false + required: false + show_user: false + description: The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details. owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/zookeeper/changelog.yml b/packages/zookeeper/changelog.yml index e3a83d4da15..d49128482dc 100644 --- a/packages/zookeeper/changelog.yml +++ b/packages/zookeeper/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.8.0" + changes: + - description: Added metric_type mapping for connection datastream + type: enhancement + link: https://github.com/elastic/integrations/pull/7765 - version: "1.7.0" changes: - description: Rename ownership from obs-service-integrations to obs-infraobs-integrations diff --git a/packages/zookeeper/data_stream/connection/fields/fields.yml b/packages/zookeeper/data_stream/connection/fields/fields.yml index 37c01d28ee3..0bad97957a3 100644 --- a/packages/zookeeper/data_stream/connection/fields/fields.yml +++ b/packages/zookeeper/data_stream/connection/fields/fields.yml @@ -7,13 +7,16 @@ Interest ops - name: queued type: long + metric_type: gauge description: | Queued connections - name: received type: long + metric_type: counter description: | Received connections - name: sent type: long + metric_type: counter description: | Connections sent diff --git a/packages/zookeeper/docs/README.md b/packages/zookeeper/docs/README.md index e3b24fb8bd3..3ed7eec578a 100644 --- a/packages/zookeeper/docs/README.md +++ b/packages/zookeeper/docs/README.md @@ -60,53 +60,53 @@ An example event for `connection` looks as following: **Exported fields** -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.port | Port of the client. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.name.text | Multi-field of `host.os.name`. | text | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | -| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | -| zookeeper.connection.interest_ops | Interest ops | long | -| zookeeper.connection.queued | Queued connections | long | -| zookeeper.connection.received | Received connections | long | -| zookeeper.connection.sent | Connections sent | long | +| Field | Description | Type | Metric Type | +|---|---|---|---| +| @timestamp | Event timestamp. | date | | +| client.ip | IP address of the client (IPv4 or IPv6). | ip | | +| client.port | Port of the client. | long | | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | | +| cloud.image.id | Image ID for the cloud instance. | keyword | | +| cloud.instance.id | Instance ID of the host machine. | keyword | | +| cloud.instance.name | Instance name of the host machine. | keyword | | +| cloud.machine.type | Machine type of the host machine. | keyword | | +| cloud.project.id | Name of the project in Google Cloud. | keyword | | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | | +| cloud.region | Region in which this host is running. | keyword | | +| container.id | Unique container id. | keyword | | +| container.image.name | Name of the image the container was built on. | keyword | | +| container.labels | Image labels. | object | | +| container.name | Container name. | keyword | | +| data_stream.dataset | Data stream dataset. | constant_keyword | | +| data_stream.namespace | Data stream namespace. | constant_keyword | | +| data_stream.type | Data stream type. | constant_keyword | | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | | +| event.dataset | Event dataset | constant_keyword | | +| event.module | Event module | constant_keyword | | +| host.architecture | Operating system architecture. | keyword | | +| host.containerized | If the host is a container. | boolean | | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | | +| host.ip | Host ip addresses. | ip | | +| host.mac | Host mac addresses. | keyword | | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | | +| host.os.build | OS build information. | keyword | | +| host.os.codename | OS codename, if any. | keyword | | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | | +| host.os.name | Operating system name, without the version. | keyword | | +| host.os.name.text | Multi-field of `host.os.name`. | text | | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | | +| host.os.version | Operating system version as a raw string. | keyword | | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | | +| service.address | Address where data about this service was collected from. This should be a URI, network address (ipv4:port or [ipv6]:port) or a resource path (sockets). | keyword | | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | | +| zookeeper.connection.interest_ops | Interest ops | long | | +| zookeeper.connection.queued | Queued connections | long | gauge | +| zookeeper.connection.received | Received connections | long | counter | +| zookeeper.connection.sent | Connections sent | long | counter | ### mntr diff --git a/packages/zookeeper/manifest.yml b/packages/zookeeper/manifest.yml index 4df49c072e6..648c46f5387 100644 --- a/packages/zookeeper/manifest.yml +++ b/packages/zookeeper/manifest.yml @@ -1,6 +1,6 @@ name: zookeeper title: ZooKeeper Metrics -version: "1.7.0" +version: "1.8.0" description: Collect metrics from ZooKeeper service with Elastic Agent. type: integration icons: diff --git a/packages/zoom/_dev/build/build.yml b/packages/zoom/_dev/build/build.yml index 074278e5b1f..c8eeec8cacf 100644 --- a/packages/zoom/_dev/build/build.yml +++ b/packages/zoom/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 diff --git a/packages/zoom/changelog.yml b/packages/zoom/changelog.yml index 072a79abe82..765dc9b4075 100644 --- a/packages/zoom/changelog.yml +++ b/packages/zoom/changelog.yml @@ -1,4 +1,19 @@ # newer versions go on top +- version: 1.16.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.15.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.14.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 - version: "1.13.0" changes: - description: Update package to pkg-spec 2.9.0 and fix setting of event.type creation. diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json index 0f34ab49b17..fee331d7876 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-account.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account.created", @@ -49,7 +49,7 @@ { "@timestamp": "2019-07-01T17:03:04.527Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account.updated", @@ -103,7 +103,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "account.disassociated", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json index 7242ebca4b6..a2cde334e25 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-channel.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.created", @@ -44,7 +44,7 @@ { "@timestamp": "2020-02-10T21:59:05.584Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.updated", @@ -82,7 +82,7 @@ { "@timestamp": "2020-02-10T21:59:05.584Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.deleted", @@ -120,7 +120,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.member_invited", @@ -160,7 +160,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.member_joined", @@ -198,7 +198,7 @@ { "@timestamp": "2020-02-10T21:39:50.388Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_channel.member_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json index 94207578e3e..97800509e4f 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-chat-message.json-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2020-02-11T22:02:11.930Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_message.sent", @@ -45,7 +45,7 @@ { "@timestamp": "2020-02-11T23:00:08.594Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_message.updated", @@ -87,7 +87,7 @@ { "@timestamp": "2020-02-11T23:00:08.594Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "chat_message.updated", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json index 180c5fd8d12..a96e7539dff 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-meeting.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.alert", @@ -41,7 +41,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.created", @@ -84,7 +84,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.updated", @@ -141,7 +141,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.deleted", @@ -184,7 +184,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.started", @@ -223,7 +223,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.ended", @@ -263,7 +263,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.registration_created", @@ -313,7 +313,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.registration_approved", @@ -363,7 +363,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.registration_cancelled", @@ -409,7 +409,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.sharing_started", @@ -461,7 +461,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.sharing_ended", @@ -514,7 +514,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.participant_jbh_waiting", @@ -556,7 +556,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.participant_jbh_joined", @@ -598,7 +598,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.participant_joined", @@ -644,7 +644,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "meeting.participant_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json index 33721a4104c..bf5e28d688b 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-phone.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.caller_ringing", @@ -49,7 +49,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.caller_connected", @@ -97,7 +97,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.caller_ringing", @@ -148,7 +148,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.callee_answered", @@ -196,7 +196,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.callee_missed", @@ -240,7 +240,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.callee_ended", @@ -288,7 +288,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.caller_ended", @@ -336,7 +336,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.callee_rejected", @@ -383,7 +383,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.voicemail_received", @@ -429,7 +429,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.caller_call_log_completed", @@ -453,7 +453,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "phone.callee_call_log_completed", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json index 8ece342709b..49f8d2938d7 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-recording.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.started", @@ -46,7 +46,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.paused", @@ -89,7 +89,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.resumed", @@ -132,7 +132,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.stopped", @@ -177,7 +177,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.completed", @@ -224,7 +224,7 @@ { "@timestamp": "2019-12-04T23:00:57.395Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.renamed", @@ -269,7 +269,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.trashed", @@ -314,7 +314,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.deleted", @@ -359,7 +359,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.recovered", @@ -404,7 +404,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.transcript_completed", @@ -449,7 +449,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.registration_created", @@ -498,7 +498,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.registration_approved", @@ -547,7 +547,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "recording.registration_denied", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json index 86d8737b2a2..062f0f5bbd7 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-user.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.created", @@ -48,7 +48,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.invitation_accepted", @@ -87,7 +87,7 @@ { "@timestamp": "2019-07-19T18:10:54.861Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.updated", @@ -135,7 +135,7 @@ { "@timestamp": "2019-07-19T21:47:06.929Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.settings_updated", @@ -192,7 +192,7 @@ { "@timestamp": "2020-06-29T17:32:19.427Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.settings_updated", @@ -244,7 +244,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.deactivated", @@ -292,7 +292,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.activated", @@ -340,7 +340,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.disassociated", @@ -388,7 +388,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.deleted", @@ -436,7 +436,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.presence_status_updated", @@ -474,7 +474,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.personal_notes_updated", @@ -519,7 +519,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.signed_in", @@ -558,7 +558,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "user.signed_out", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json index e70e9d55378..976564decd1 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-webinar.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.created", @@ -45,7 +45,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.updated", @@ -99,7 +99,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.deleted", @@ -142,7 +142,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.started", @@ -183,7 +183,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.ended", @@ -224,7 +224,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.alert", @@ -260,7 +260,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.sharing_started", @@ -313,7 +313,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.sharing_started", @@ -366,7 +366,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.registration_created", @@ -417,7 +417,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.registration_approved", @@ -470,7 +470,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.registration_denied", @@ -521,7 +521,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.registration_cancelled", @@ -571,7 +571,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.participant_joined", @@ -619,7 +619,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "webinar.participant_left", diff --git a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json index 51598254a24..e87f9a8a560 100644 --- a/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json +++ b/packages/zoom/data_stream/webhook/_dev/test/pipeline/test-zoomroom.json-expected.json @@ -2,7 +2,7 @@ "expected": [ { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "zoomroom.alert", @@ -30,7 +30,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "zoomroom.delayed_alert", @@ -58,7 +58,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "zoomroom.checked_in", @@ -90,7 +90,7 @@ }, { "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "zoomroom.checked_in", diff --git a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml index 2fb562235d0..81509565a46 100644 --- a/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zoom/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml @@ -9,7 +9,7 @@ processors: value: Webhook - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - script: description: Drops null/empty values recursively lang: painless diff --git a/packages/zoom/data_stream/webhook/sample_event.json b/packages/zoom/data_stream/webhook/sample_event.json index 13a44e5a24a..5c2e4ff445a 100644 --- a/packages/zoom/data_stream/webhook/sample_event.json +++ b/packages/zoom/data_stream/webhook/sample_event.json @@ -13,7 +13,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "a2a6d6ce-cd38-4a30-8877-bf698b0d346b", diff --git a/packages/zoom/docs/README.md b/packages/zoom/docs/README.md index 6811657fbb4..e19ef860ff7 100644 --- a/packages/zoom/docs/README.md +++ b/packages/zoom/docs/README.md @@ -47,7 +47,7 @@ This integration is compatible with the Zoom Platform API as of September 2020. | event.dataset | Event dataset | constant_keyword | | event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | -| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | | event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | | event.outcome | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event. Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective. Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer. Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | keyword | diff --git a/packages/zoom/kibana/tags.yml b/packages/zoom/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zoom/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zoom/manifest.yml b/packages/zoom/manifest.yml index 48925da0c7b..9ba142c39f3 100644 --- a/packages/zoom/manifest.yml +++ b/packages/zoom/manifest.yml @@ -1,12 +1,13 @@ name: zoom title: Zoom -version: "1.13.0" +version: "1.16.0" description: Collect logs from Zoom with Elastic Agent. type: integration -format_version: 2.9.0 +format_version: "3.0.0" categories: ["security", "productivity_security"] conditions: - kibana.version: ^8.9.0 + kibana: + version: ^8.9.0 policy_templates: - name: zoom title: Zoom logs @@ -17,6 +18,7 @@ policy_templates: description: "Collecting logs from Zoom instances via Webhook" owner: github: elastic/security-external-integrations + type: elastic icons: - src: /img/zoom_blue.svg title: Zoom diff --git a/packages/zscaler_zia/_dev/build/build.yml b/packages/zscaler_zia/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/zscaler_zia/_dev/build/build.yml +++ b/packages/zscaler_zia/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/zscaler_zia/_dev/build/docs/README.md b/packages/zscaler_zia/_dev/build/docs/README.md index a30cbfe9f5e..7bdc0c6c628 100644 --- a/packages/zscaler_zia/_dev/build/docs/README.md +++ b/packages/zscaler_zia/_dev/build/docs/README.md @@ -34,19 +34,19 @@ The log message is expected to be in JSON format. The data is mapped to ECS fiel 2. Configure the Zscaler Cloud NSS Feeds to send logs to the Elastic Agent that is running this integration. Provide API URL to send logs to the Elastic Agent. To configure Zscaler Cloud NSS Feeds follow the following steps. - In the ZIA Admin Portal, add a Cloud NSS Feed. - Log in to the ZIA Admin Portal using your admin account. - - Add a Cloud NSS Feed. See to [Add Cloud NSS Feed](https://help.zscaler.com/zia/adding-cloud-nss-feeds). - - In the ZIA Admin Portal, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds. - - Give Feed Name, change status to Enabled. - - Select NSS Type. - - Change SIEM Type to other. - - Add an API URL. - - Default ports: - - **DNS**: 9556 - - **Firewall**: 9557 - - **Tunnel**: 9558 - - **Web**: 9559 - - Select JSON as feed output type. - - Add same custom header along with its value on both the side for additional security. + - Add a Cloud NSS Feed. See to [Add Cloud NSS Feed](https://help.zscaler.com/zia/adding-cloud-nss-feeds). + - In the ZIA Admin Portal, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds. + - Give Feed Name, change status to Enabled. + - Select NSS Type. + - Change SIEM Type to other. + - Add an API URL. + - Default ports: + - **DNS**: 9556 + - **Firewall**: 9557 + - **Tunnel**: 9558 + - **Web**: 9559 + - Select JSON as feed output type. + - Add same custom header along with its value on both the side for additional security. ![Cloud NSS Feeds setup image](../img/cloud_nss_feeds.png?raw=true) 3. Repeat step 2 for each log type. @@ -66,12 +66,12 @@ This package has been tested against `Zscaler Internet Access version 6.1` See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/about-alerts) -Zscaler response format (v1): +Zscaler response format (v1): ``` <%d{syslogid}>%s{Monthname} %2d{Dayofmonth} %02d{Hour}:%02d{Minutes}:%02d{Seconds} [%s{Deviceip}] ZscalerNSS: %s{Eventinfo}\n ``` -Sample Response: +Sample Response: ``` <114>Dec 10 14:04:28 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes ``` @@ -83,12 +83,12 @@ Sample Response: See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-dns-logs) -Zscaler response format (v1): +Zscaler response format (v1): ``` \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-dns", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","location":"TestLoc%20DB","reqaction":"REQ_ALLOW","resaction":"Some Response Action","reqrulelabel":"Access%20Blocked","resrulelabel":"None","dns_reqtype":"Some type","dns_req":"example.com","dns_resp":"Some response string","srv_dport":"8080","durationms":"123456","clt_sip":"81.2.69.193","srv_dip":"81.2.69.144","category":"Professional Services","deviceowner":"Owner77","devicehostname":"Machine9000"}} ``` @@ -100,12 +100,12 @@ Sample Response: See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs) -Zscaler response format (v1): +Zscaler response format (v1): ``` \{ "sourcetype" : "zscalernss-fw", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","locationname":"%s{elocation}","cdport":"%d{cdport}","csport":"%d{csport}","sdport":"%d{sdport}","ssport":"%d{ssport}","csip":"%s{csip}","cdip":"%s{cdip}","ssip":"%s{ssip}","sdip":"%s{sdip}","tsip":"%s{tsip}","tunsport":"%d{tsport}","tuntype":"%s{ttype}","action":"%s{action}","dnat":"%s{dnat}","stateful":"%s{stateful}","aggregate":"%s{aggregate}","nwsvc":"%s{nwsvc}","nwapp":"%s{nwapp}","proto":"%s{ipproto}","ipcat":"%s{ipcat}","destcountry":"%s{destcountry}","avgduration":"%d{avgduration}","rulelabel":"%s{erulelabel}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","duration":"%d{duration}","durationms":"%d{durationms}","numsessions":"%d{numsessions}","ipsrulelabel":"%s{ipsrulelabel}","threatcat":"%s{threatcat}","threatname":"%s{ethreatname}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-fw", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","locationname":"TestLoc%20DB","cdport":443,"csport":55018,"sdport":443,"ssport":0,"csip":"0.0.0.0","cdip":"0.0.0.0","ssip":"0.0.0.0","sdip":"0.0.0.0","tsip":"0.0.0.0","tunsport":0,"tuntype":"ZscalerClientConnector","action":"Drop","dnat":"No","stateful":"Yes","aggregate":"No","nwsvc":"HTTPS","nwapp":"http","proto":"TCP","ipcat":"Test Name","destcountry":"Ireland","avgduration":486,"rulelabel":"Access%20Blocked","inbytes":19052,"outbytes":1734,"duration":0,"durationms":486,"numsessions":1,"ipsrulelabel":"None","threatcat":"None","threatname":"None","deviceowner":"admin77","devicehostname":"Machine9000"}} ``` @@ -135,26 +135,26 @@ Zscaler response format (v1): \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","sourceportstart":"%d{srcportstart}","destinationportstart":"%d{destportstart}","srcipstart":"%s{srcipstart}","srcipend":"%s{srcipend}","destinationipstart":"%s{destipstart}","destinationipend":"%s{destipend}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","lifebytes":"%d{lifebytes}","spi":"%d{spi}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","protocol":"%s{protocol}","tunnelprotocol":"%s{tunnelprotocol}","policydirection":"%s{policydirection}","recordid":"%d{recordid}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-tunnel", "event" : {"datetime":"Thu Dec 30 11:40:27 2021","Recordtype":"IPSec Phase1","tunneltype":"IPSEC IKEV 2","user":"81.2.69.145","location":"some-location","sourceip":"81.2.69.145","destinationip":"81.2.69.143","sourceport":"500","destinationport":"500","lifetime":"0","ikeversion":"2","spi_in":"00000000000000000000","spi_out":"11111111111111111111","algo":"AES-CBS","authentication":"HMAC-SHA1-96","authtype":"PSK","recordid":"1111111111111111111"}} ``` ### Web Log -- Default port (NSS Feed): _9014_ +- Default port (NSS Feed): _9014_ - Default port (Cloud NSS Feed): _9559_ -- Add characters **"** and **\\** in **feed escape character** while configuring Web Log. +- Add characters **"** and **\\** in **feed escape character** while configuring Web Log. -![Escape feed setup image](../img/escape_feed.png?raw=true) +![Escape feed setup image](../img/escape_feed.png?raw=true) See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-web-logs) -Zscaler response format (v2): +Zscaler response format (v2): ``` \{ "sourcetype" : "zscalernss-web", "event" :\{"time":"%s{time}","login":"%s{login}","proto":"%s{proto}","eurl":"%s{eurl}","action":"%s{action}","appname":"%s{appname}","appclass":"%s{appclass}","reqsize":"%d{reqsize}","respsize":"%d{respsize}","stime":"%d{stime}","ctime":"%d{ctime}","urlclass":"%s{urlclass}","urlsupercat":"%s{urlsupercat}","urlcat":"%s{urlcat}","malwarecat":"%s{malwarecat}","threatname":"%s{threatname}","riskscore":"%d{riskscore}","dlpeng":"%s{dlpeng}","dlpdict":"%s{dlpdict}","location":"%s{location}","dept":"%s{dept}","cip":"%s{cip}","sip":"%s{sip}","reqmethod":"%s{reqmethod}","respcode":"%s{respcode}","eua":"%s{eua}","ereferer":"%s{ereferer}","ruletype":"%s{ruletype}","rulelabel":"%s{rulelabel}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-web", "event" :{"time":"Fri Dec 17 07:04:57 2021","login":"test@example.com","proto":"HTTP_PROXY","eurl":"browser.events.data.msn.com:443","action":"Blocked","appname":"General Browsing","appclass":"General Browsing","reqsize":"600","respsize":"65","stime":"0","ctime":"0","urlclass":"Business Use","urlsupercat":"Information Technology","urlcat":"Web Search","malwarecat":"None","threatname":"None","riskscore":"0","dlpeng":"None","dlpdict":"None","location":"Test DB","dept":"Unknown","cip":"81.2.69.193","sip":"81.2.69.145","reqmethod":"CONNECT","respcode":"200","eua":"Windows%20Microsoft%20Windows%2010%20Pro%20ZTunnel%2F1.0","ereferer":"None","ruletype":"FwFilter","rulelabel":"Zscaler Proxy Traffic","contenttype":"Other","unscannabletype":"None","deviceowner":"administrator1","devicehostname":"TestMachine35"}} ``` diff --git a/packages/zscaler_zia/changelog.yml b/packages/zscaler_zia/changelog.yml index 1ab5952b486..7ff56bb80e4 100644 --- a/packages/zscaler_zia/changelog.yml +++ b/packages/zscaler_zia/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 2.14.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "2.13.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "2.12.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "2.11.1" + changes: + - description: Update the mapping for user.name and host.name fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/6820 - version: "2.11.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json b/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json index b697452f450..afa101d7163 100644 --- a/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json +++ b/packages/zscaler_zia/data_stream/alerts/_dev/test/pipeline/test-alerts.log-expected.json @@ -8,7 +8,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c114\u003eDec 31 12:01:04 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes" @@ -41,7 +41,7 @@ "port": 9012 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c114\u003eDec 31 13:02:05 [81.2.69.193] ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes" @@ -74,7 +74,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "original": "\u003c114\u003eDec 31 14:03:06 [81.2.69.193] Hey, that's a new type of alert. Isn't it?" diff --git a/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml index 111d5b4ece3..18c213a1da7 100644 --- a/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler alert logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zia/data_stream/alerts/sample_event.json b/packages/zscaler_zia/data_stream/alerts/sample_event.json index 5ede66f62d6..fcc1bc1d63b 100644 --- a/packages/zscaler_zia/data_stream/alerts/sample_event.json +++ b/packages/zscaler_zia/data_stream/alerts/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2023-12-10T13:40:32.000Z", "agent": { - "ephemeral_id": "19a4d9cc-161f-44b9-803e-3d5f3f7668d7", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "e4a7f41b-987e-4a14-8d6b-bcf7ba154ea7", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.alerts", @@ -18,24 +18,24 @@ "port": 9012 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", "dataset": "zscaler_zia.alerts", - "ingested": "2023-02-24T09:40:42Z" + "ingested": "2023-07-18T08:24:35Z" }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.29.0.7:55310" + "address": "172.19.0.4:38924" }, "syslog": { "priority": 114 diff --git a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http-endpoint.log-expected.json b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http-endpoint.log-expected.json index 600b6ca21f2..65b0d6345ae 100644 --- a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http-endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns-http-endpoint.log-expected.json @@ -16,7 +16,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -35,6 +35,9 @@ "related": { "ip": [ "0.0.0.0" + ], + "user": [ + "Unknown" ] }, "source": { @@ -44,7 +47,9 @@ "preserve_original_event" ], "user": { - "email": "Unknown" + "name": [ + "Unknown" + ] }, "zscaler_zia": { "dns": { diff --git a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json index 796eced7caf..65c19e868d1 100644 --- a/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json +++ b/packages/zscaler_zia/data_stream/dns/_dev/test/pipeline/test-dns.log-expected.json @@ -34,7 +34,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -47,6 +47,9 @@ "info" ] }, + "host": { + "hostname": "Machine9000" + }, "network": { "protocol": "dns" }, @@ -88,7 +91,9 @@ ], "user": { "email": "some_user@example.com", - "name": "Owner77" + "name": [ + "Owner77" + ] }, "zscaler_zia": { "dns": { diff --git a/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml index e43585f1054..ce773c6832f 100644 --- a/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/dns/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler dns logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -196,18 +196,30 @@ processors: - urldecode: field: json.user target_field: user.email + if: ctx.json?.user != null && ctx.json.user.contains('@') ignore_missing: true ignore_failure: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - append: - field: related.user - value: '{{{user.name}}}' - if: ctx.user?.name != null + field: user.name + value: '{{{json.user}}}' + if: ctx.user?.email == null + allow_duplicates: false + ignore_failure: true + - append: + field: user.name + value: '{{{json.deviceowner}}}' + if: ctx.json?.deviceowner != null allow_duplicates: false ignore_failure: true + - foreach: + field: user.name + if: ctx.user?.name instanceof List + processor: + append: + field: related.user + value: '{{{_ingest._value}}}' + allow_duplicates: false + ignore_missing: true - urldecode: field: json.department target_field: zscaler_zia.dns.department @@ -255,6 +267,10 @@ processors: field: json.devicehostname target_field: zscaler_zia.dns.hostname ignore_missing: true + - set: + field: host.hostname + value: '{{{zscaler_zia.dns.hostname}}}' + ignore_empty_value: true - append: field: related.hosts value: '{{{zscaler_zia.dns.hostname}}}' @@ -274,6 +290,7 @@ processors: - json.reqrulelabel - json.resrulelabel - json.durationms + - json.deviceowner ignore_missing: true - script: description: Adds all the remaining fields in fields under zscaler_zia.dns. diff --git a/packages/zscaler_zia/data_stream/dns/sample_event.json b/packages/zscaler_zia/data_stream/dns/sample_event.json index bf5a10c3eee..c22289b65d5 100644 --- a/packages/zscaler_zia/data_stream/dns/sample_event.json +++ b/packages/zscaler_zia/data_stream/dns/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-17T07:27:54.000Z", "agent": { - "ephemeral_id": "f4bda282-f29f-4110-ae6f-3e625eb7e71b", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "e30c8a88-1875-427c-8f63-7458e6461def", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.dns", @@ -44,12 +44,12 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", @@ -58,18 +58,21 @@ ], "dataset": "zscaler_zia.dns", "duration": 123456000000, - "ingested": "2023-02-24T09:42:00Z", + "ingested": "2023-07-18T08:26:24Z", "kind": "event", "type": [ "info" ] }, + "host": { + "hostname": "Machine9000" + }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.29.0.7:53784" + "address": "172.19.0.4:35098" } }, "network": { @@ -114,7 +117,9 @@ ], "user": { "email": "some_user@example.com", - "name": "Owner77" + "name": [ + "Owner77" + ] }, "zscaler_zia": { "dns": { diff --git a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http-endpoint.log-expected.json b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http-endpoint.log-expected.json index d385405851b..8b5aecbaab3 100644 --- a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http-endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall-http-endpoint.log-expected.json @@ -8,7 +8,7 @@ "port": 456 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "outofrange", @@ -30,6 +30,9 @@ "related": { "ip": [ "0.0.0.0" + ], + "user": [ + "Unknown" ] }, "rule": { @@ -46,7 +49,9 @@ "preserve_original_event" ], "user": { - "email": "Unknown" + "name": [ + "Unknown" + ] }, "zscaler_zia": { "firewall": { diff --git a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json index f037be39267..2e3fc581c68 100644 --- a/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json +++ b/packages/zscaler_zia/data_stream/firewall/_dev/test/pipeline/test-firewall.log-expected.json @@ -11,7 +11,7 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "drop", @@ -61,7 +61,9 @@ ], "user": { "email": "some_user@example.com", - "name": "admin77" + "name": [ + "admin77" + ] }, "zscaler_zia": { "firewall": { @@ -78,6 +80,7 @@ "milliseconds": 4861, "seconds": 4 }, + "hostname": "Machine9000", "ip_category": "Test Name", "location": { "name": "TestLoc DB" diff --git a/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml index 5b58c64648d..1d751483997 100644 --- a/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler firewall logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -90,12 +90,16 @@ processors: value: '{{{_ingest.on_failure_message}}}' - rename: field: json.devicehostname - target_field: host.hostname + target_field: zscaler_zia.firewall.hostname ignore_missing: true + - set: + field: host.hostname + value: '{{{zscaler_zia.firewall.hostname}}}' + ignore_empty_value: true - append: field: related.hosts - value: '{{{host.hostname}}}' - if: ctx.host?.hostname != null + value: '{{{zscaler_zia.firewall.hostname}}}' + if: ctx.zscaler_zia?.firewall?.hostname != null allow_duplicates: false ignore_failure: true - rename: @@ -149,18 +153,30 @@ processors: - urldecode: field: json.user target_field: user.email + if: ctx.json?.user != null && ctx.json.user.contains('@') ignore_missing: true ignore_failure: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - append: - field: related.user - value: '{{{user.name}}}' - if: ctx.user?.name != null + field: user.name + value: '{{{json.user}}}' + if: ctx.user?.email == null allow_duplicates: false ignore_failure: true + - append: + field: user.name + value: '{{{json.deviceowner}}}' + if: ctx.json?.deviceowner != null + allow_duplicates: false + ignore_failure: true + - foreach: + field: user.name + if: ctx.user?.name instanceof List + processor: + append: + field: related.user + value: '{{{_ingest._value}}}' + allow_duplicates: false + ignore_missing: true - urldecode: field: json.department target_field: zscaler_zia.firewall.department @@ -423,6 +439,7 @@ processors: - json.duration - json.durationms - json.numsessions + - json.deviceowner ignore_missing: true - script: description: Adds all the remaining fields in fields under zscaler_zia.firewall. diff --git a/packages/zscaler_zia/data_stream/firewall/fields/fields.yml b/packages/zscaler_zia/data_stream/firewall/fields/fields.yml index 82e7ecbdfdf..3eda4cd3b66 100644 --- a/packages/zscaler_zia/data_stream/firewall/fields/fields.yml +++ b/packages/zscaler_zia/data_stream/firewall/fields/fields.yml @@ -5,6 +5,8 @@ type: keyword description: | Department of the user. + - name: hostname + type: keyword - name: location type: group fields: diff --git a/packages/zscaler_zia/data_stream/firewall/sample_event.json b/packages/zscaler_zia/data_stream/firewall/sample_event.json index d1a2926e939..f2122dc1a34 100644 --- a/packages/zscaler_zia/data_stream/firewall/sample_event.json +++ b/packages/zscaler_zia/data_stream/firewall/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-17T07:27:54.000Z", "agent": { - "ephemeral_id": "83dc07a4-89ea-45b3-b7aa-f72b7e84f8b8", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "d9fc2c4d-8f15-450a-a1a0-5c36e91986b7", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.firewall", @@ -21,12 +21,12 @@ "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "action": "drop", @@ -36,7 +36,7 @@ ], "dataset": "zscaler_zia.firewall", "duration": 486000000, - "ingested": "2023-02-24T09:43:15Z", + "ingested": "2023-07-18T08:28:12Z", "kind": "event", "type": [ "info" @@ -50,7 +50,7 @@ }, "log": { "source": { - "address": "172.29.0.7:46908" + "address": "172.19.0.4:49160" } }, "network": { @@ -87,7 +87,9 @@ ], "user": { "email": "some_user@example.com", - "name": "admin77" + "name": [ + "admin77" + ] }, "zscaler_zia": { "firewall": { @@ -104,6 +106,7 @@ "milliseconds": 486, "seconds": 0 }, + "hostname": "Machine9000", "ip_category": "Test Name", "location": { "name": "TestLoc DB" diff --git a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http-endpoint.log-expected.json b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http-endpoint.log-expected.json index f00d639b170..f3f8c88124b 100644 --- a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http-endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel-http-endpoint.log-expected.json @@ -7,7 +7,7 @@ "ip": "0.0.0.0" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json index 3cb2e1bd865..2f30a70fa42 100644 --- a/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json +++ b/packages/zscaler_zia/data_stream/tunnel/_dev/test/pipeline/test-tunnel.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -26,9 +26,6 @@ "ip": [ "81.2.69.143", "81.2.69.145" - ], - "user": [ - "81.2.69.145" ] }, "source": { @@ -38,9 +35,6 @@ "tags": [ "preserve_original_event" ], - "user": { - "name": "81.2.69.145" - }, "zscaler_zia": { "tunnel": { "action": { @@ -87,7 +81,8 @@ } }, "spi": "123456789", - "type": "IPSEC IKEV 1" + "type": "IPSEC IKEV 1", + "user_ip": "81.2.69.145" } } }, @@ -98,7 +93,7 @@ "port": 500 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -118,9 +113,6 @@ "ip": [ "81.2.69.143", "81.2.69.145" - ], - "user": [ - "81.2.69.145" ] }, "source": { @@ -130,9 +122,6 @@ "tags": [ "preserve_original_event" ], - "user": { - "name": "81.2.69.145" - }, "zscaler_zia": { "tunnel": { "action": { @@ -156,7 +145,8 @@ }, "spi_in": "00000000000000000000", "spi_out": "11111111111111111111", - "type": "IPSEC IKEV 2" + "type": "IPSEC IKEV 2", + "user_ip": "81.2.69.145" } } }, @@ -166,7 +156,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "IPsec tunnel is up", @@ -188,9 +178,6 @@ "ip": [ "81.2.69.143", "81.2.69.145" - ], - "user": [ - "81.2.69.145" ] }, "source": { @@ -200,9 +187,6 @@ "tags": [ "preserve_original_event" ], - "user": { - "name": "81.2.69.145" - }, "zscaler_zia": { "tunnel": { "action": { @@ -211,7 +195,8 @@ "location": { "name": "some-location" }, - "type": "IPSec IKEv2" + "type": "IPSec IKEv2", + "user_ip": "81.2.69.145" } } } diff --git a/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml index b8a9f7fdab3..2bff08c613e 100644 --- a/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler tunnel logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -147,13 +147,29 @@ processors: value: '{{{_ingest.on_failure_message}}}' - urldecode: field: json.user - target_field: user.name ignore_missing: true ignore_failure: true + - convert: + field: json.user + target_field: zscaler_zia.tunnel.user_ip + type: ip + if: ctx.json?.user != '' + ignore_missing: true + on_failure: + - set: + field: user.name + value: '{{{json.user}}}' + ignore_empty_value: true + - append: + field: related.ip + value: '{{{zscaler_zia.tunnel.user_ip}}}' + if: ctx.user?.name == null + allow_duplicates: false + ignore_failure: true - append: field: related.user value: '{{{user.name}}}' - if: ctx.user?.name != null + if: ctx.zscaler_zia?.tunnel?.user_ip == null allow_duplicates: false ignore_failure: true - convert: diff --git a/packages/zscaler_zia/data_stream/tunnel/fields/fields.yml b/packages/zscaler_zia/data_stream/tunnel/fields/fields.yml index 819d87ae7a7..83acd7f91f7 100644 --- a/packages/zscaler_zia/data_stream/tunnel/fields/fields.yml +++ b/packages/zscaler_zia/data_stream/tunnel/fields/fields.yml @@ -104,6 +104,8 @@ type: keyword description: | Tunnel type. + - name: user_ip + type: ip - name: vendor.name type: keyword description: |- diff --git a/packages/zscaler_zia/data_stream/tunnel/sample_event.json b/packages/zscaler_zia/data_stream/tunnel/sample_event.json index 4eb65e753f6..00a9479ca84 100644 --- a/packages/zscaler_zia/data_stream/tunnel/sample_event.json +++ b/packages/zscaler_zia/data_stream/tunnel/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2021-12-30T11:20:12.000Z", "agent": { - "ephemeral_id": "acd73b21-110d-4a61-a22c-0b5a38e01cd4", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "0ecfdc6b-3c0e-48ea-9b55-f8b3c7e4f13c", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.tunnel", @@ -16,12 +16,12 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", @@ -30,7 +30,7 @@ ], "dataset": "zscaler_zia.tunnel", "id": "1111111111111111111", - "ingested": "2023-02-24T09:44:32Z", + "ingested": "2023-07-18T08:29:58Z", "kind": "event", "type": [ "info" @@ -41,7 +41,7 @@ }, "log": { "source": { - "address": "172.29.0.7:46832" + "address": "172.19.0.4:45548" } }, "network": { @@ -51,9 +51,6 @@ "ip": [ "81.2.69.143", "81.2.69.145" - ], - "user": [ - "81.2.69.145" ] }, "source": { @@ -64,9 +61,6 @@ "forwarded", "zscaler_zia-tunnel" ], - "user": { - "name": "81.2.69.145" - }, "zscaler_zia": { "tunnel": { "action": { @@ -113,7 +107,8 @@ } }, "spi": "123456789", - "type": "IPSEC IKEV 1" + "type": "IPSEC IKEV 1", + "user_ip": "81.2.69.145" } } } \ No newline at end of file diff --git a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http-endpoint.log-expected.json b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http-endpoint.log-expected.json index aeca58d3a3d..ca1ff1b6668 100644 --- a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http-endpoint.log-expected.json +++ b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web-http-endpoint.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -20,6 +20,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -44,8 +47,8 @@ "81.2.69.145" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -55,9 +58,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -73,7 +73,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -129,7 +132,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -143,6 +146,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -165,8 +171,8 @@ "81.2.69.145" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -176,9 +182,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -194,7 +197,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { diff --git a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json index 5e3061c34cc..14626d6d72d 100644 --- a/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json +++ b/packages/zscaler_zia/data_stream/web/_dev/test/pipeline/test-web.log-expected.json @@ -6,7 +6,7 @@ "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -20,6 +20,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -44,8 +47,8 @@ "81.2.69.145" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -55,9 +58,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -73,7 +73,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -129,7 +132,7 @@ "ip": "89.160.20.156" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -143,6 +146,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 218, @@ -167,8 +173,8 @@ "89.160.20.156" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -178,9 +184,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -196,7 +199,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -247,7 +253,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -261,6 +267,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -285,8 +294,8 @@ "89.160.20.112" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -296,9 +305,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -314,7 +320,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -370,7 +379,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -384,6 +393,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 555, @@ -408,8 +420,8 @@ "81.2.69.144" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -419,9 +431,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -437,7 +446,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -493,7 +505,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -507,6 +519,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 297, @@ -531,8 +546,8 @@ "81.2.69.143" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -542,9 +557,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -561,7 +573,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -612,7 +627,7 @@ "ip": "89.160.20.112" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "allowed", @@ -626,6 +641,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 555, @@ -650,8 +668,8 @@ "89.160.20.112" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -661,9 +679,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -680,7 +695,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -736,7 +754,7 @@ "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "action": "blocked", @@ -750,6 +768,9 @@ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 297, @@ -773,8 +794,8 @@ "81.2.69.143" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -784,9 +805,6 @@ "source": { "nat": { "ip": "81.2.69.193" - }, - "user": { - "name": "administrator1" } }, "tags": [ @@ -803,7 +821,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { diff --git a/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml index bf5ed549eb9..396a5ae8881 100644 --- a/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler web logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original @@ -112,16 +112,6 @@ processors: if: ctx.destination?.ip != null allow_duplicates: false ignore_failure: true - - rename: - field: json.deviceowner - target_field: source.user.name - ignore_missing: true - - append: - field: related.user - value: '{{{source.user.name}}}' - if: ctx.source?.user?.name != null - allow_duplicates: false - ignore_failure: true - convert: field: json.reqsize target_field: http.request.bytes @@ -238,10 +228,20 @@ processors: field: user.email pattern: '%{user.name}@%{user.domain}' - append: - if: ctx.user?.name != null && ctx.user.name != "" - field: related.user - value: '{{{user.name}}}' + field: user.name + value: '{{{json.deviceowner}}}' + if: ctx.json?.deviceowner != null allow_duplicates: false + ignore_failure: true + - foreach: + field: user.name + if: ctx.user?.name instanceof List + processor: + append: + field: related.user + value: '{{{_ingest._value}}}' + allow_duplicates: false + ignore_missing: true - rename: field: json.action target_field: event.action @@ -334,6 +334,15 @@ processors: field: json.devicehostname target_field: zscaler_zia.web.device.hostname ignore_missing: true + - lowercase: + field: zscaler_zia.web.device.hostname + target_field: host.name + ignore_missing: true + if: ctx.zscaler_zia?.web?.device?.hostname != '' + on_failure: + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' - append: field: related.hosts value: '{{{zscaler_zia.web.device.hostname}}}' @@ -365,6 +374,45 @@ processors: field: json.ehost target_field: zscaler_zia.web.encoded_host ignore_missing: true + - set: + field: destination.domain + value: '{{{zscaler_zia.web.encoded_host}}}' + ignore_empty_value: true + - set: + field: file.hash.md5 + value: '{{{json.bamd5}}}' + ignore_empty_value: true + - append: + field: related.hash + value: '{{{file.hash.md5}}}' + if: ctx.file?.hash?.md5 != null + allow_duplicates: false + ignore_failure: true + - set: + field: file.name + value: '{{{json.filename}}}' + ignore_empty_value: true + - set: + field: file.extension + value: '{{{json.filesubtype}}}' + ignore_empty_value: true + - convert: + field: json.clt_sport + target_field: client.port + type: long + ignore_missing: true + on_failure: + - remove: + field: json.clt_sport + - append: + field: error.message + value: '{{{_ingest.on_failure_message}}}' + - append: + field: related.hosts + value: '{{{destination.domain}}}' + if: ctx.destination?.domain != null + allow_duplicates: false + ignore_failure: true - rename: field: json.fileclass target_field: zscaler_zia.web.file.class @@ -373,6 +421,10 @@ processors: field: json.filetype target_field: zscaler_zia.web.file.type ignore_missing: true + - set: + field: file.type + value: '{{{zscaler_zia.web.file.type}}}' + ignore_empty_value: true - rename: field: json.malwareclass target_field: zscaler_zia.web.malware.class @@ -385,6 +437,22 @@ processors: field: json.recordid target_field: zscaler_zia.web.record.id ignore_missing: true + - rename: + field: json.upload_fileclass + target_field: zscaler_zia.web.upload.file.class + ignore_missing: true + - rename: + field: json.upload_filetype + target_field: zscaler_zia.web.upload.file.type + ignore_missing: true + - rename: + field: json.upload_filename + target_field: zscaler_zia.web.upload.file.name + ignore_missing: true + - rename: + field: json.upload_filesubtype + target_field: zscaler_zia.web.upload.file.sub_type + ignore_missing: true - convert: field: json.totalsize target_field: zscaler_zia.web.total.size @@ -413,6 +481,8 @@ processors: - json.riskscore - json.cintip - json.totalsize + - json.deviceowner + - json.clt_sport ignore_missing: true - script: description: Adds all the remaining fields in fields under zscaler_zia.web. diff --git a/packages/zscaler_zia/data_stream/web/fields/fields.yml b/packages/zscaler_zia/data_stream/web/fields/fields.yml index d85e5a570e6..eb7fa333e03 100644 --- a/packages/zscaler_zia/data_stream/web/fields/fields.yml +++ b/packages/zscaler_zia/data_stream/web/fields/fields.yml @@ -89,6 +89,20 @@ type: keyword description: | Unscannable file type. + - name: upload + type: group + fields: + - name: file + type: group + fields: + - name: class + type: keyword + - name: name + type: keyword + - name: sub_type + type: keyword + - name: type + type: keyword - name: url type: group fields: diff --git a/packages/zscaler_zia/data_stream/web/sample_event.json b/packages/zscaler_zia/data_stream/web/sample_event.json index d77818c0a7c..0909bba81e1 100644 --- a/packages/zscaler_zia/data_stream/web/sample_event.json +++ b/packages/zscaler_zia/data_stream/web/sample_event.json @@ -1,11 +1,11 @@ { - "@timestamp": "2021-12-31T08:08:08.000Z", + "@timestamp": "2021-12-17T07:04:57.000Z", "agent": { - "ephemeral_id": "444ca1f4-28b9-45cb-8287-ba44516c521b", - "id": "08fc14c0-5a92-4649-93f3-68fb5d6c5fbc", + "ephemeral_id": "89530246-8643-41b5-b53b-82c3a1641b4b", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.1" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.web", @@ -13,15 +13,15 @@ "type": "logs" }, "destination": { - "ip": "1.128.3.4" + "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "08fc14c0-5a92-4649-93f3-68fb5d6c5fbc", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.1" + "version": "8.3.0" }, "event": { "action": "blocked", @@ -30,13 +30,16 @@ "web" ], "dataset": "zscaler_zia.web", - "ingested": "2023-03-15T21:02:55Z", + "ingested": "2023-07-18T08:31:39Z", "kind": "event", "risk_score": 0, "type": [ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -50,7 +53,12 @@ } }, "input": { - "type": "http_endpoint" + "type": "tcp" + }, + "log": { + "source": { + "address": "172.19.0.4:36484" + } }, "network": { "protocol": "http_proxy" @@ -60,11 +68,12 @@ "TestMachine35" ], "ip": [ - "1.128.3.4" + "81.2.69.193", + "81.2.69.145" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -73,10 +82,7 @@ }, "source": { "nat": { - "ip": "1.128.3.4" - }, - "user": { - "name": "administrator1" + "ip": "81.2.69.193" } }, "tags": [ @@ -93,7 +99,10 @@ "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { diff --git a/packages/zscaler_zia/docs/README.md b/packages/zscaler_zia/docs/README.md index 1420fcab414..2d6a9c8e09c 100644 --- a/packages/zscaler_zia/docs/README.md +++ b/packages/zscaler_zia/docs/README.md @@ -34,19 +34,19 @@ The log message is expected to be in JSON format. The data is mapped to ECS fiel 2. Configure the Zscaler Cloud NSS Feeds to send logs to the Elastic Agent that is running this integration. Provide API URL to send logs to the Elastic Agent. To configure Zscaler Cloud NSS Feeds follow the following steps. - In the ZIA Admin Portal, add a Cloud NSS Feed. - Log in to the ZIA Admin Portal using your admin account. - - Add a Cloud NSS Feed. See to [Add Cloud NSS Feed](https://help.zscaler.com/zia/adding-cloud-nss-feeds). - - In the ZIA Admin Portal, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds. - - Give Feed Name, change status to Enabled. - - Select NSS Type. - - Change SIEM Type to other. - - Add an API URL. - - Default ports: - - **DNS**: 9556 - - **Firewall**: 9557 - - **Tunnel**: 9558 - - **Web**: 9559 - - Select JSON as feed output type. - - Add same custom header along with its value on both the side for additional security. + - Add a Cloud NSS Feed. See to [Add Cloud NSS Feed](https://help.zscaler.com/zia/adding-cloud-nss-feeds). + - In the ZIA Admin Portal, go to Administration > Nanolog Streaming Service > Cloud NSS Feeds. + - Give Feed Name, change status to Enabled. + - Select NSS Type. + - Change SIEM Type to other. + - Add an API URL. + - Default ports: + - **DNS**: 9556 + - **Firewall**: 9557 + - **Tunnel**: 9558 + - **Web**: 9559 + - Select JSON as feed output type. + - Add same custom header along with its value on both the side for additional security. ![Cloud NSS Feeds setup image](../img/cloud_nss_feeds.png?raw=true) 3. Repeat step 2 for each log type. @@ -66,12 +66,12 @@ This package has been tested against `Zscaler Internet Access version 6.1` See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/about-alerts) -Zscaler response format (v1): +Zscaler response format (v1): ``` <%d{syslogid}>%s{Monthname} %2d{Dayofmonth} %02d{Hour}:%02d{Minutes}:%02d{Seconds} [%s{Deviceip}] ZscalerNSS: %s{Eventinfo}\n ``` -Sample Response: +Sample Response: ``` <114>Dec 10 14:04:28 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes ``` @@ -83,12 +83,12 @@ Sample Response: See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-dns-logs) -Zscaler response format (v1): +Zscaler response format (v1): ``` \{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-dns", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","location":"TestLoc%20DB","reqaction":"REQ_ALLOW","resaction":"Some Response Action","reqrulelabel":"Access%20Blocked","resrulelabel":"None","dns_reqtype":"Some type","dns_req":"example.com","dns_resp":"Some response string","srv_dport":"8080","durationms":"123456","clt_sip":"81.2.69.193","srv_dip":"81.2.69.144","category":"Professional Services","deviceowner":"Owner77","devicehostname":"Machine9000"}} ``` @@ -100,12 +100,12 @@ Sample Response: See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs) -Zscaler response format (v1): +Zscaler response format (v1): ``` \{ "sourcetype" : "zscalernss-fw", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","locationname":"%s{elocation}","cdport":"%d{cdport}","csport":"%d{csport}","sdport":"%d{sdport}","ssport":"%d{ssport}","csip":"%s{csip}","cdip":"%s{cdip}","ssip":"%s{ssip}","sdip":"%s{sdip}","tsip":"%s{tsip}","tunsport":"%d{tsport}","tuntype":"%s{ttype}","action":"%s{action}","dnat":"%s{dnat}","stateful":"%s{stateful}","aggregate":"%s{aggregate}","nwsvc":"%s{nwsvc}","nwapp":"%s{nwapp}","proto":"%s{ipproto}","ipcat":"%s{ipcat}","destcountry":"%s{destcountry}","avgduration":"%d{avgduration}","rulelabel":"%s{erulelabel}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","duration":"%d{duration}","durationms":"%d{durationms}","numsessions":"%d{numsessions}","ipsrulelabel":"%s{ipsrulelabel}","threatcat":"%s{threatcat}","threatname":"%s{ethreatname}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-fw", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","locationname":"TestLoc%20DB","cdport":443,"csport":55018,"sdport":443,"ssport":0,"csip":"0.0.0.0","cdip":"0.0.0.0","ssip":"0.0.0.0","sdip":"0.0.0.0","tsip":"0.0.0.0","tunsport":0,"tuntype":"ZscalerClientConnector","action":"Drop","dnat":"No","stateful":"Yes","aggregate":"No","nwsvc":"HTTPS","nwapp":"http","proto":"TCP","ipcat":"Test Name","destcountry":"Ireland","avgduration":486,"rulelabel":"Access%20Blocked","inbytes":19052,"outbytes":1734,"duration":0,"durationms":486,"numsessions":1,"ipsrulelabel":"None","threatcat":"None","threatname":"None","deviceowner":"admin77","devicehostname":"Machine9000"}} ``` @@ -135,26 +135,26 @@ Zscaler response format (v1): \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","sourceportstart":"%d{srcportstart}","destinationportstart":"%d{destportstart}","srcipstart":"%s{srcipstart}","srcipend":"%s{srcipend}","destinationipstart":"%s{destipstart}","destinationipend":"%s{destipend}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","lifebytes":"%d{lifebytes}","spi":"%d{spi}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","protocol":"%s{protocol}","tunnelprotocol":"%s{tunnelprotocol}","policydirection":"%s{policydirection}","recordid":"%d{recordid}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-tunnel", "event" : {"datetime":"Thu Dec 30 11:40:27 2021","Recordtype":"IPSec Phase1","tunneltype":"IPSEC IKEV 2","user":"81.2.69.145","location":"some-location","sourceip":"81.2.69.145","destinationip":"81.2.69.143","sourceport":"500","destinationport":"500","lifetime":"0","ikeversion":"2","spi_in":"00000000000000000000","spi_out":"11111111111111111111","algo":"AES-CBS","authentication":"HMAC-SHA1-96","authtype":"PSK","recordid":"1111111111111111111"}} ``` ### Web Log -- Default port (NSS Feed): _9014_ +- Default port (NSS Feed): _9014_ - Default port (Cloud NSS Feed): _9559_ -- Add characters **"** and **\\** in **feed escape character** while configuring Web Log. +- Add characters **"** and **\\** in **feed escape character** while configuring Web Log. -![Escape feed setup image](../img/escape_feed.png?raw=true) +![Escape feed setup image](../img/escape_feed.png?raw=true) See: [Zscaler Vendor documentation](https://help.zscaler.com/zia/nss-feed-output-format-web-logs) -Zscaler response format (v2): +Zscaler response format (v2): ``` \{ "sourcetype" : "zscalernss-web", "event" :\{"time":"%s{time}","login":"%s{login}","proto":"%s{proto}","eurl":"%s{eurl}","action":"%s{action}","appname":"%s{appname}","appclass":"%s{appclass}","reqsize":"%d{reqsize}","respsize":"%d{respsize}","stime":"%d{stime}","ctime":"%d{ctime}","urlclass":"%s{urlclass}","urlsupercat":"%s{urlsupercat}","urlcat":"%s{urlcat}","malwarecat":"%s{malwarecat}","threatname":"%s{threatname}","riskscore":"%d{riskscore}","dlpeng":"%s{dlpeng}","dlpdict":"%s{dlpdict}","location":"%s{location}","dept":"%s{dept}","cip":"%s{cip}","sip":"%s{sip}","reqmethod":"%s{reqmethod}","respcode":"%s{respcode}","eua":"%s{eua}","ereferer":"%s{ereferer}","ruletype":"%s{ruletype}","rulelabel":"%s{rulelabel}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} ``` -Sample Response: +Sample Response: ```json { "sourcetype" : "zscalernss-web", "event" :{"time":"Fri Dec 17 07:04:57 2021","login":"test@example.com","proto":"HTTP_PROXY","eurl":"browser.events.data.msn.com:443","action":"Blocked","appname":"General Browsing","appclass":"General Browsing","reqsize":"600","respsize":"65","stime":"0","ctime":"0","urlclass":"Business Use","urlsupercat":"Information Technology","urlcat":"Web Search","malwarecat":"None","threatname":"None","riskscore":"0","dlpeng":"None","dlpdict":"None","location":"Test DB","dept":"Unknown","cip":"81.2.69.193","sip":"81.2.69.145","reqmethod":"CONNECT","respcode":"200","eua":"Windows%20Microsoft%20Windows%2010%20Pro%20ZTunnel%2F1.0","ereferer":"None","ruletype":"FwFilter","rulelabel":"Zscaler Proxy Traffic","contenttype":"Other","unscannabletype":"None","deviceowner":"administrator1","devicehostname":"TestMachine35"}} ``` @@ -177,11 +177,11 @@ An example event for `alerts` looks as following: { "@timestamp": "2023-12-10T13:40:32.000Z", "agent": { - "ephemeral_id": "19a4d9cc-161f-44b9-803e-3d5f3f7668d7", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "e4a7f41b-987e-4a14-8d6b-bcf7ba154ea7", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.alerts", @@ -194,24 +194,24 @@ An example event for `alerts` looks as following: "port": 9012 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", "dataset": "zscaler_zia.alerts", - "ingested": "2023-02-24T09:40:42Z" + "ingested": "2023-07-18T08:24:35Z" }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.29.0.7:55310" + "address": "172.19.0.4:38924" }, "syslog": { "priority": 114 @@ -266,11 +266,11 @@ An example event for `dns` looks as following: { "@timestamp": "2021-12-17T07:27:54.000Z", "agent": { - "ephemeral_id": "f4bda282-f29f-4110-ae6f-3e625eb7e71b", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "e30c8a88-1875-427c-8f63-7458e6461def", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.dns", @@ -309,12 +309,12 @@ An example event for `dns` looks as following: } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", @@ -323,18 +323,21 @@ An example event for `dns` looks as following: ], "dataset": "zscaler_zia.dns", "duration": 123456000000, - "ingested": "2023-02-24T09:42:00Z", + "ingested": "2023-07-18T08:26:24Z", "kind": "event", "type": [ "info" ] }, + "host": { + "hostname": "Machine9000" + }, "input": { "type": "tcp" }, "log": { "source": { - "address": "172.29.0.7:53784" + "address": "172.19.0.4:35098" } }, "network": { @@ -379,7 +382,9 @@ An example event for `dns` looks as following: ], "user": { "email": "some_user@example.com", - "name": "Owner77" + "name": [ + "Owner77" + ] }, "zscaler_zia": { "dns": { @@ -446,11 +451,11 @@ An example event for `firewall` looks as following: { "@timestamp": "2021-12-17T07:27:54.000Z", "agent": { - "ephemeral_id": "83dc07a4-89ea-45b3-b7aa-f72b7e84f8b8", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "d9fc2c4d-8f15-450a-a1a0-5c36e91986b7", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.firewall", @@ -466,12 +471,12 @@ An example event for `firewall` looks as following: "port": 443 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "action": "drop", @@ -481,7 +486,7 @@ An example event for `firewall` looks as following: ], "dataset": "zscaler_zia.firewall", "duration": 486000000, - "ingested": "2023-02-24T09:43:15Z", + "ingested": "2023-07-18T08:28:12Z", "kind": "event", "type": [ "info" @@ -495,7 +500,7 @@ An example event for `firewall` looks as following: }, "log": { "source": { - "address": "172.29.0.7:46908" + "address": "172.19.0.4:49160" } }, "network": { @@ -532,7 +537,9 @@ An example event for `firewall` looks as following: ], "user": { "email": "some_user@example.com", - "name": "admin77" + "name": [ + "admin77" + ] }, "zscaler_zia": { "firewall": { @@ -549,6 +556,7 @@ An example event for `firewall` looks as following: "milliseconds": 486, "seconds": 0 }, + "hostname": "Machine9000", "ip_category": "Test Name", "location": { "name": "TestLoc DB" @@ -599,6 +607,7 @@ An example event for `firewall` looks as following: | zscaler_zia.firewall.duration.avg | Average session duration, in milliseconds, if the sessions were aggregated. | long | | zscaler_zia.firewall.duration.milliseconds | Session or request duration in milliseconds. | long | | zscaler_zia.firewall.duration.seconds | Average session duration, in milliseconds, if the sessions were aggregated. | long | +| zscaler_zia.firewall.hostname | | keyword | | zscaler_zia.firewall.ip_category | URL category that corresponds to the server IP address. | keyword | | zscaler_zia.firewall.location.name | Name of the location from which the session was initiated. | keyword | | zscaler_zia.firewall.nat | Indicates if the destination NAT policy was applied. | keyword | @@ -625,11 +634,11 @@ An example event for `tunnel` looks as following: { "@timestamp": "2021-12-30T11:20:12.000Z", "agent": { - "ephemeral_id": "acd73b21-110d-4a61-a22c-0b5a38e01cd4", - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "ephemeral_id": "0ecfdc6b-3c0e-48ea-9b55-f8b3c7e4f13c", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.0" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.tunnel", @@ -640,12 +649,12 @@ An example event for `tunnel` looks as following: "ip": "81.2.69.143" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "fc4affb9-ab52-48ec-b9ce-f65f4390f0b9", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.0" + "version": "8.3.0" }, "event": { "agent_id_status": "verified", @@ -654,7 +663,7 @@ An example event for `tunnel` looks as following: ], "dataset": "zscaler_zia.tunnel", "id": "1111111111111111111", - "ingested": "2023-02-24T09:44:32Z", + "ingested": "2023-07-18T08:29:58Z", "kind": "event", "type": [ "info" @@ -665,7 +674,7 @@ An example event for `tunnel` looks as following: }, "log": { "source": { - "address": "172.29.0.7:46832" + "address": "172.19.0.4:45548" } }, "network": { @@ -675,9 +684,6 @@ An example event for `tunnel` looks as following: "ip": [ "81.2.69.143", "81.2.69.145" - ], - "user": [ - "81.2.69.145" ] }, "source": { @@ -688,9 +694,6 @@ An example event for `tunnel` looks as following: "forwarded", "zscaler_zia-tunnel" ], - "user": { - "name": "81.2.69.145" - }, "zscaler_zia": { "tunnel": { "action": { @@ -737,7 +740,8 @@ An example event for `tunnel` looks as following: } }, "spi": "123456789", - "type": "IPSEC IKEV 1" + "type": "IPSEC IKEV 1", + "user_ip": "81.2.69.145" } } } @@ -779,6 +783,7 @@ An example event for `tunnel` looks as following: | zscaler_zia.tunnel.spi_in | Initiator cookie. | keyword | | zscaler_zia.tunnel.spi_out | Responder cookie. | keyword | | zscaler_zia.tunnel.type | Tunnel type. | keyword | +| zscaler_zia.tunnel.user_ip | | ip | | zscaler_zia.tunnel.vendor.name | Vendor name of the edge device. | keyword | @@ -792,13 +797,13 @@ An example event for `web` looks as following: ```json { - "@timestamp": "2021-12-31T08:08:08.000Z", + "@timestamp": "2021-12-17T07:04:57.000Z", "agent": { - "ephemeral_id": "444ca1f4-28b9-45cb-8287-ba44516c521b", - "id": "08fc14c0-5a92-4649-93f3-68fb5d6c5fbc", + "ephemeral_id": "89530246-8643-41b5-b53b-82c3a1641b4b", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "name": "docker-fleet-agent", "type": "filebeat", - "version": "8.6.1" + "version": "8.3.0" }, "data_stream": { "dataset": "zscaler_zia.web", @@ -806,15 +811,15 @@ An example event for `web` looks as following: "type": "logs" }, "destination": { - "ip": "1.128.3.4" + "ip": "81.2.69.145" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { - "id": "08fc14c0-5a92-4649-93f3-68fb5d6c5fbc", + "id": "466c628a-fcec-40ab-aca6-5bb7fa40064b", "snapshot": false, - "version": "8.6.1" + "version": "8.3.0" }, "event": { "action": "blocked", @@ -823,13 +828,16 @@ An example event for `web` looks as following: "web" ], "dataset": "zscaler_zia.web", - "ingested": "2023-03-15T21:02:55Z", + "ingested": "2023-07-18T08:31:39Z", "kind": "event", "risk_score": 0, "type": [ "info" ] }, + "host": { + "name": "testmachine35" + }, "http": { "request": { "bytes": 600, @@ -843,7 +851,12 @@ An example event for `web` looks as following: } }, "input": { - "type": "http_endpoint" + "type": "tcp" + }, + "log": { + "source": { + "address": "172.19.0.4:36484" + } }, "network": { "protocol": "http_proxy" @@ -853,11 +866,12 @@ An example event for `web` looks as following: "TestMachine35" ], "ip": [ - "1.128.3.4" + "81.2.69.193", + "81.2.69.145" ], "user": [ - "administrator1", - "test" + "test", + "administrator1" ] }, "rule": { @@ -866,10 +880,7 @@ An example event for `web` looks as following: }, "source": { "nat": { - "ip": "1.128.3.4" - }, - "user": { - "name": "administrator1" + "ip": "81.2.69.193" } }, "tags": [ @@ -886,7 +897,10 @@ An example event for `web` looks as following: "user": { "domain": "example.com", "email": "test@example.com", - "name": "test" + "name": [ + "test", + "administrator1" + ] }, "user_agent": { "device": { @@ -971,6 +985,10 @@ An example event for `web` looks as following: | zscaler_zia.web.threat.name | The name of the threat that was detected in the transaction, if any. | keyword | | zscaler_zia.web.total.size | Total size, in bytes, of the HTTP transaction; sum of the total request size and total response size. | long | | zscaler_zia.web.unscannable.type | Unscannable file type. | keyword | +| zscaler_zia.web.upload.file.class | | keyword | +| zscaler_zia.web.upload.file.name | | keyword | +| zscaler_zia.web.upload.file.sub_type | | keyword | +| zscaler_zia.web.upload.file.type | | keyword | | zscaler_zia.web.url.category.sub | Category of the destination URL. | keyword | | zscaler_zia.web.url.category.super | Super category of the destination URL. | keyword | | zscaler_zia.web.url.class | Class of the destination URL. | keyword | diff --git a/packages/zscaler_zia/kibana/tags.yml b/packages/zscaler_zia/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zscaler_zia/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zscaler_zia/manifest.yml b/packages/zscaler_zia/manifest.yml index 150a9a21fd6..2c57e0f7fdb 100644 --- a/packages/zscaler_zia/manifest.yml +++ b/packages/zscaler_zia/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: zscaler_zia title: Zscaler Internet Access -version: "2.11.0" +version: "2.14.0" description: Collect logs from Zscaler Internet Access (ZIA) with Elastic Agent. type: integration categories: @@ -10,8 +10,10 @@ categories: source: license: "Elastic-2.0" conditions: - kibana.version: ^8.3.0 - elastic.subscription: "basic" + kibana: + version: ^8.3.0 + elastic: + subscription: "basic" screenshots: - src: /img/zscaler-zia-screenshot.png title: Zscaler ZIA web log dashboard screenshot @@ -123,3 +125,4 @@ policy_templates: show_user: false owner: github: elastic/security-external-integrations + type: elastic diff --git a/packages/zscaler_zpa/_dev/build/build.yml b/packages/zscaler_zpa/_dev/build/build.yml index 84034dcea1e..c1af686e524 100644 --- a/packages/zscaler_zpa/_dev/build/build.yml +++ b/packages/zscaler_zpa/_dev/build/build.yml @@ -1,4 +1,4 @@ dependencies: ecs: - reference: git@v8.8.0 + reference: git@v8.9.0 import_mappings: true diff --git a/packages/zscaler_zpa/changelog.yml b/packages/zscaler_zpa/changelog.yml index 82723cb5a56..d045bb752a7 100644 --- a/packages/zscaler_zpa/changelog.yml +++ b/packages/zscaler_zpa/changelog.yml @@ -1,4 +1,24 @@ # newer versions go on top +- version: 1.13.0 + changes: + - description: "The format_version in the package manifest changed from 2.11.0 to 3.0.0. Removed dotted YAML keys from package manifest. Added 'owner.type: elastic' to package manifest." + type: enhancement + link: https://github.com/elastic/integrations/pull/7883 +- version: "1.12.0" + changes: + - description: Add tags.yml file so that integration's dashboards and saved searches are tagged with "Security Solution" and displayed in the Security Solution UI. + type: enhancement + link: https://github.com/elastic/integrations/pull/7789 +- version: "1.11.0" + changes: + - description: Update package to ECS 8.9.0. + type: enhancement + link: https://github.com/elastic/integrations/pull/7111 +- version: "1.10.0" + changes: + - description: Convert visualizations to lens. + type: enhancement + link: https://github.com/elastic/integrations/pull/6924 - version: "1.9.0" changes: - description: Ensure event.kind is correctly set for pipeline errors. diff --git a/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json b/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json index dcc3df9d9e6..75acb324126 100644 --- a/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json +++ b/packages/zscaler_zpa/data_stream/app_connector_status/_dev/test/pipeline/test-app-connector-status.log-expected.json @@ -8,7 +8,7 @@ } }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml index e7f7d7565ce..78c3179febf 100644 --- a/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/app_connector_status/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler app connector status logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/app_connector_status/sample_event.json b/packages/zscaler_zpa/data_stream/app_connector_status/sample_event.json index 385b7648a17..d6bbf6da881 100644 --- a/packages/zscaler_zpa/data_stream/app_connector_status/sample_event.json +++ b/packages/zscaler_zpa/data_stream/app_connector_status/sample_event.json @@ -19,7 +19,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json b/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json index aeffc745a57..08cf27d22d5 100644 --- a/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json +++ b/packages/zscaler_zpa/data_stream/audit/_dev/test/pipeline/test-audit.log-expected.json @@ -3,7 +3,7 @@ { "@timestamp": "2021-11-17T04:29:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -67,7 +67,7 @@ { "@timestamp": "2021-11-17T04:29:38.000Z", "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml index f51ea146360..db8e98842e1 100644 --- a/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/audit/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler audit logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/audit/sample_event.json b/packages/zscaler_zpa/data_stream/audit/sample_event.json index 3ea5470a000..03779a6373f 100644 --- a/packages/zscaler_zpa/data_stream/audit/sample_event.json +++ b/packages/zscaler_zpa/data_stream/audit/sample_event.json @@ -14,7 +14,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json b/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json index c1b23ac9ce4..71ff121ec6a 100644 --- a/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json +++ b/packages/zscaler_zpa/data_stream/browser_access/_dev/test/pipeline/test-browser-access.log-expected.json @@ -19,7 +19,7 @@ "port": 60006 }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml index d9fc0445246..56137898b74 100644 --- a/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/browser_access/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler browser access logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/browser_access/sample_event.json b/packages/zscaler_zpa/data_stream/browser_access/sample_event.json index 4ff53d75308..a28c0d13fef 100644 --- a/packages/zscaler_zpa/data_stream/browser_access/sample_event.json +++ b/packages/zscaler_zpa/data_stream/browser_access/sample_event.json @@ -30,7 +30,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json b/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json index 016f3ee4cc8..b0e1634636c 100644 --- a/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json +++ b/packages/zscaler_zpa/data_stream/user_activity/_dev/test/pipeline/test-user-activity.log-expected.json @@ -13,7 +13,7 @@ "ip": "81.2.69.193" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml index fbbc1051040..7eedfafc8c8 100644 --- a/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/user_activity/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler user activity logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/user_activity/sample_event.json b/packages/zscaler_zpa/data_stream/user_activity/sample_event.json index 09a62422263..42feb878689 100644 --- a/packages/zscaler_zpa/data_stream/user_activity/sample_event.json +++ b/packages/zscaler_zpa/data_stream/user_activity/sample_event.json @@ -24,7 +24,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json b/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json index a1f3258bcbf..ac4ac06054a 100644 --- a/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json +++ b/packages/zscaler_zpa/data_stream/user_status/_dev/test/pipeline/test-user-status.log-expected.json @@ -13,7 +13,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ @@ -123,7 +123,7 @@ "ip": "81.2.69.144" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "event": { "category": [ diff --git a/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml index d0368adf3a3..a7eed8c381e 100644 --- a/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml +++ b/packages/zscaler_zpa/data_stream/user_status/elasticsearch/ingest_pipeline/default.yml @@ -3,7 +3,7 @@ description: Pipeline for Zscaler user status logs. processors: - set: field: ecs.version - value: '8.8.0' + value: '8.9.0' - rename: field: message target_field: event.original diff --git a/packages/zscaler_zpa/data_stream/user_status/sample_event.json b/packages/zscaler_zpa/data_stream/user_status/sample_event.json index c7eeaa49c26..7efa2daf179 100644 --- a/packages/zscaler_zpa/data_stream/user_status/sample_event.json +++ b/packages/zscaler_zpa/data_stream/user_status/sample_event.json @@ -24,7 +24,7 @@ "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/docs/README.md b/packages/zscaler_zpa/docs/README.md index e3c9dbd4fc5..d6ae1143ab2 100644 --- a/packages/zscaler_zpa/docs/README.md +++ b/packages/zscaler_zpa/docs/README.md @@ -181,7 +181,7 @@ An example event for `app_connector_status` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", @@ -347,7 +347,7 @@ An example event for `audit` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", @@ -503,7 +503,7 @@ An example event for `browser_access` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", @@ -731,7 +731,7 @@ An example event for `user_activity` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", @@ -940,7 +940,7 @@ An example event for `user_status` looks as following: "type": "logs" }, "ecs": { - "version": "8.8.0" + "version": "8.9.0" }, "elastic_agent": { "id": "8b86614c-cda7-40f1-9823-ea2294fa4abf", diff --git a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2.json b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2.json index 0660c902ad9..7d9c8a11a42 100644 --- a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2.json +++ b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows Browser Access Logs collected by the Zscaler ZPA integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "cdda45ef-7a1f-46e6-82f5-b5b98d330527": { "columnOrder": [ @@ -90,7 +91,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -107,15 +108,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "7db7ef17-e874-4258-b032-bed5d1ca4d5f" - ], "layerId": "cdda45ef-7a1f-46e6-82f5-b5b98d330527", "layerType": "data", "legendDisplay": "default", - "metric": "d41f24af-68d7-4d59-9bb3-a09ddd968736", + "legendSize": "auto", + "metrics": [ + "d41f24af-68d7-4d59-9bb3-a09ddd968736" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "7db7ef17-e874-4258-b032-bed5d1ca4d5f" + ] } ], "shape": "pie" @@ -138,7 +142,7 @@ "panelIndex": "f069080b-5169-4c41-b661-304e5c5dfa2d", "title": "Distribution of Browser Access by Exporter [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -157,7 +161,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d25f382e-b54c-4dc5-803a-2fd115dd0c50": { "columnOrder": [ @@ -191,7 +195,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -208,15 +212,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "22a93c56-da24-4135-9329-3b95ceb3da3f" - ], "layerId": "d25f382e-b54c-4dc5-803a-2fd115dd0c50", "layerType": "data", "legendDisplay": "default", - "metric": "b7c7cc2c-2d63-44bd-9505-70a3d0232be0", + "legendSize": "auto", + "metrics": [ + "b7c7cc2c-2d63-44bd-9505-70a3d0232be0" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "22a93c56-da24-4135-9329-3b95ceb3da3f" + ] } ], "shape": "pie" @@ -239,7 +246,7 @@ "panelIndex": "7140a23f-4aa7-43fc-a99a-bba55d790c4f", "title": "Distribution of Browser Access by Browser [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -258,7 +265,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "9559af19-50aa-43e3-aef6-6ddd99985176": { "columnOrder": [ @@ -293,7 +300,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "67671e08-8621-4da6-af65-d1a9b6f66dad": { "customLabel": true, @@ -329,16 +336,19 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "1392dce2-163a-4359-8f11-3cd3395efc4b", - "67671e08-8621-4da6-af65-d1a9b6f66dad" - ], "layerId": "9559af19-50aa-43e3-aef6-6ddd99985176", "layerType": "data", "legendDisplay": "default", - "metric": "63992bdc-dc89-4c9b-bfa4-e8ab33adfbc7", + "legendSize": "auto", + "metrics": [ + "63992bdc-dc89-4c9b-bfa4-e8ab33adfbc7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "1392dce2-163a-4359-8f11-3cd3395efc4b", + "67671e08-8621-4da6-af65-d1a9b6f66dad" + ] } ], "shape": "pie" @@ -361,13 +371,13 @@ "panelIndex": "8e452830-b278-4562-b994-fd6070cd6378", "title": "Distribution of OS across User [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"44962ab1-9a18-493c-a7c4-4408f7df2ca7\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternId\":\"logs-*\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", + "layerListJSON": "[{\"alpha\":1,\"id\":\"44962ab1-9a18-493c-a7c4-4408f7df2ca7\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{\"type\":\"TILE\"},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", "mapStateJSON": "{\"zoom\":0.77,\"center\":{\"lon\":84.58721,\"lat\":30.6405},\"timeFilters\":{\"from\":\"now-5y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "[Zscaler][ZPA] Browser Access Events by Region", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" @@ -399,17 +409,18 @@ "panelIndex": "3faea99d-8970-4c4b-8c11-16737fb1f643", "title": "Browser Access Events by Region [Logs Zscaler ZPA]", "type": "map", - "version": "7.16.2" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Zscaler ZPA] Browser Access Logs", "version": 1 }, - "coreMigrationVersion": "7.16.2", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:57:29.062Z", "id": "zscaler_zpa-34f0b8a0-3a71-11ed-9e41-155bc0d23bc2", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2.json b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2.json index 2438b391593..778cfe4441b 100644 --- a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2.json +++ b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows User Activity and Status Logs collected by the Zscaler ZPA integration.\n", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -49,6 +48,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -74,7 +75,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "b057dead-b005-4462-b395-d27f7ac78327": { "columnOrder": [ @@ -88,7 +89,7 @@ "label": "Total Users", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -104,7 +105,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -126,12 +127,15 @@ "visualization": { "accessor": "083be347-4383-4ce2-b466-6a93dfce867d", "layerId": "b057dead-b005-4462-b395-d27f7ac78327", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -146,7 +150,7 @@ "panelIndex": "02c9d04f-388e-4aeb-bf53-dc3c4201ac89", "title": "Total Users [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -170,7 +174,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f6c8b136-deb3-4b5d-ba28-8335cad05127": { "columnOrder": [ @@ -185,7 +189,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "efb3640b-c682-4e3c-8c3c-f81ada82c369": { "customLabel": true, @@ -220,7 +224,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -243,15 +247,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "efb3640b-c682-4e3c-8c3c-f81ada82c369" - ], "layerId": "f6c8b136-deb3-4b5d-ba28-8335cad05127", "layerType": "data", "legendDisplay": "default", - "metric": "90e9028c-ca65-4690-897a-377431ca211e", + "legendSize": "auto", + "metrics": [ + "90e9028c-ca65-4690-897a-377431ca211e" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "efb3640b-c682-4e3c-8c3c-f81ada82c369" + ] } ], "shape": "pie" @@ -274,7 +281,7 @@ "panelIndex": "46efd498-aa94-46cf-943e-bcc12e74928c", "title": "Distribution of Users by Connection Status [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -298,7 +305,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "5bbce317-b56b-4695-bac0-7340665c9ff8": { "columnOrder": [ @@ -332,7 +339,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -348,7 +355,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -371,15 +378,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "29ae9a72-ef14-4376-97cb-2c67d9554218" - ], "layerId": "5bbce317-b56b-4695-bac0-7340665c9ff8", "layerType": "data", "legendDisplay": "default", - "metric": "716118c4-a649-408e-8c7f-a481ab09bc92", + "legendSize": "auto", + "metrics": [ + "716118c4-a649-408e-8c7f-a481ab09bc92" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "29ae9a72-ef14-4376-97cb-2c67d9554218" + ] } ], "shape": "pie" @@ -402,7 +412,7 @@ "panelIndex": "54c63d27-7daf-4370-b7ad-dccc6c5efc46", "title": "Distribution of User by Session Status [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -426,7 +436,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "abf9ee3a-3e3e-495a-9f66-ed7b29420d77": { "columnOrder": [ @@ -441,7 +451,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "e9f66119-f56b-41e4-aabf-bdb9361d0826": { "customLabel": true, @@ -476,7 +486,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -499,15 +509,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "e9f66119-f56b-41e4-aabf-bdb9361d0826" - ], "layerId": "abf9ee3a-3e3e-495a-9f66-ed7b29420d77", "layerType": "data", "legendDisplay": "default", - "metric": "e9175e89-5e1e-4f11-8812-56093624bdf7", + "legendSize": "auto", + "metrics": [ + "e9175e89-5e1e-4f11-8812-56093624bdf7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "e9f66119-f56b-41e4-aabf-bdb9361d0826" + ] } ], "shape": "pie" @@ -530,7 +543,7 @@ "panelIndex": "fc4e5d4a-ef17-4fc4-90dd-8a9869aba15c", "title": "Distribution of User by Client Type [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -554,7 +567,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "798e7ae8-6819-4df4-ab28-7cdb722c8ca5": { "columnOrder": [ @@ -569,7 +582,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "6bdd00fb-4b03-4f8e-834c-b120a71ae15e": { "customLabel": true, @@ -604,7 +617,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -655,6 +668,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_horizontal_stacked", @@ -689,7 +703,7 @@ "panelIndex": "e21be368-485f-48b0-8772-405c6ec54236", "title": "Top Countries with Users [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -718,7 +732,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c5fb4b55-b45b-4508-937f-a05012968d5e": { "columnOrder": [ @@ -752,7 +766,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -768,7 +782,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -789,7 +803,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "zscaler_zpa.user_activity.connection.status", "negate": false, "params": { @@ -818,7 +832,9 @@ } ], "layerId": "c5fb4b55-b45b-4508-937f-a05012968d5e", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -838,7 +854,7 @@ "panelIndex": "b0663650-c22b-4880-bae3-0461951511e8", "title": "Top 10 Active Users [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -862,7 +878,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "c78bfb28-6660-4968-ac9b-8b811d72e376": { "columnOrder": [ @@ -878,7 +894,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "9bcf224f-51d7-4b58-baa7-4505e4cdc0ab": { "customLabel": true, @@ -932,7 +948,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -967,7 +983,9 @@ } ], "layerId": "c78bfb28-6660-4968-ac9b-8b811d72e376", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -987,7 +1005,7 @@ "panelIndex": "266bf198-31ab-4470-b83c-c36dddf97817", "title": "Distribution of Users per Application (Top 10) [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -1011,7 +1029,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "f19c6fb4-8fae-40a3-adb3-ae6c447bb275": { "columnOrder": [ @@ -1026,7 +1044,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "ced296a3-39da-4192-bf4c-5304b0924cb1": { "customLabel": true, @@ -1061,7 +1079,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -1092,7 +1110,9 @@ } ], "layerId": "f19c6fb4-8fae-40a3-adb3-ae6c447bb275", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1112,174 +1132,268 @@ "panelIndex": "ae90d135-6ca3-4af3-8222-dea614e5e746", "title": "Top 10 AppGroups [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { - "enhancements": {}, - "hidePanelTitles": false, - "savedVis": { - "data": { - "aggs": [], - "searchSource": { - "filter": [ - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "zscaler_zpa.user_activity.connector_zen_setup_time", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "zscaler_zpa.user_activity.connector_zen_setup_time" - } + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-61d39368-0943-4997-b7e0-1a7b5b3dfc01", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e6888867-04e8-4d32-a1c4-a73603fe19e1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0a5dc661-381e-4c9b-ad56-bb5a32482fa7", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "731b0880-93fa-46ee-9ce4-5ec88c8af12f", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "61d39368-0943-4997-b7e0-1a7b5b3dfc01": { + "columnOrder": [ + "1e6343ff-1121-4ec5-9f63-27a6479b00ef", + "470d72f2-1e84-40a6-9285-8f12ebb65f7d", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX3", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX2", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX1", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX0" + ], + "columns": { + "1e6343ff-1121-4ec5-9f63-27a6479b00ef": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "Client IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderAgg": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": {}, + "scale": "ratio", + "sourceField": "___records___" + }, + "orderBy": { + "type": "custom" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "client.ip" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7d": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Application Setup Time (in microseconds)", + "operationType": "formula", + "params": { + "formula": "average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "isFormulaBroken": false + }, + "references": [ + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX3" + ], + "scale": "ratio" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "zscaler_zpa.user_activity.server_setup_time" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "zscaler_zpa.user_activity.connection.setup_time" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "operationType": "average", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "zscaler_zpa.user_activity.connector_zen_setup_time" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX3": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + { + "args": [ + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX0", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX1" + ], + "name": "add", + "type": "function" + }, + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX2" + ], + "location": { + "max": 173, + "min": 0 + }, + "name": "add", + "text": "average(zscaler_zpa.user_activity.server_setup_time) + average(zscaler_zpa.user_activity.connection.setup_time) + average(zscaler_zpa.user_activity.connector_zen_setup_time)", + "type": "function" + } + }, + "references": [ + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX0", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX1", + "470d72f2-1e84-40a6-9285-8f12ebb65f7dX2" + ], + "scale": "ratio" + } + }, + "incompleteColumns": {} } + } + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "zscaler_zpa.user_activity.connection.setup_time", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "zscaler_zpa.user_activity.connection.setup_time" - } + "meta": { + "alias": null, + "disabled": false, + "index": "e6888867-04e8-4d32-a1c4-a73603fe19e1", + "key": "zscaler_zpa.user_activity.connector_zen_setup_time", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "zscaler_zpa.user_activity.connector_zen_setup_time" } + } + }, + { + "$state": { + "store": "appState" }, - { - "$state": { - "store": "appState" - }, - "meta": { - "alias": null, - "disabled": false, - "index": "logs-*", - "key": "zscaler_zpa.user_activity.server_setup_time", - "negate": false, - "type": "exists", - "value": "exists" - }, - "query": { - "exists": { - "field": "zscaler_zpa.user_activity.server_setup_time" - } + "meta": { + "alias": null, + "disabled": false, + "index": "0a5dc661-381e-4c9b-ad56-bb5a32482fa7", + "key": "zscaler_zpa.user_activity.connection.setup_time", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "zscaler_zpa.user_activity.connection.setup_time" } } - ], - "query": { - "language": "kuery", - "query": "data_stream.dataset : \"zscaler_zpa.user_activity\"" - } - } - }, - "description": "", - "params": { - "axis_formatter": "number", - "axis_position": "left", - "axis_scale": "normal", - "bar_color_rules": [ + }, { - "id": "4ac99360-4dd5-11ec-9c7f-599fe68d9667" + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "index": "731b0880-93fa-46ee-9ce4-5ec88c8af12f", + "key": "zscaler_zpa.user_activity.server_setup_time", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "zscaler_zpa.user_activity.server_setup_time" + } + } } ], - "drop_last_bucket": 0, - "id": "81cebc93-9e11-4079-9241-baa103cd5db6", - "index_pattern_ref_name": "metrics_f2485352-f2fd-4321-a629-5763dfd34dbb_0_index_pattern", - "interval": "", - "isModelInvalid": false, - "max_lines_legend": 1, - "pivot_id": "client.ip", - "pivot_label": "Client IP", - "pivot_type": "string", - "series": [ - { - "axis_position": "right", - "chart_type": "line", - "color": "#68BC00", - "fill": 0.5, - "formatter": "default", - "hidden": false, - "id": "a5e34d80-4dd6-11ec-9c7f-599fe68d9667", - "label": "Application Setup Time (in microseconds)", - "line_width": 1, - "metrics": [ - { - "field": "zscaler_zpa.user_activity.server_setup_time", - "id": "1c4724b0-4dfa-11ec-9c7f-599fe68d9667", - "type": "avg" - }, - { - "field": "zscaler_zpa.user_activity.connection.setup_time", - "id": "5adf7740-4dfa-11ec-9c7f-599fe68d9667", - "type": "avg" - }, - { - "field": "zscaler_zpa.user_activity.connector_zen_setup_time", - "id": "6f1124c0-4dfa-11ec-9c7f-599fe68d9667", - "type": "avg" - }, - { - "id": "7956fef0-4dfa-11ec-9c7f-599fe68d9667", - "script": "params.a + params.b + params.c", - "type": "math", - "variables": [ - { - "field": "1c4724b0-4dfa-11ec-9c7f-599fe68d9667", - "id": "7ad8bcf0-4dfa-11ec-9c7f-599fe68d9667", - "name": "a" - }, - { - "field": "5adf7740-4dfa-11ec-9c7f-599fe68d9667", - "id": "80181f30-4dfa-11ec-9c7f-599fe68d9667", - "name": "b" - }, - { - "field": "6f1124c0-4dfa-11ec-9c7f-599fe68d9667", - "id": "81c5f640-4dfa-11ec-9c7f-599fe68d9667", - "name": "c" - } - ] - } - ], - "palette": { - "name": "default", - "type": "palette" + "internalReferences": [], + "query": { + "language": "kuery", + "query": "data_stream.dataset : \"zscaler_zpa.user_activity\"" + }, + "visualization": { + "columns": [ + { + "alignment": "left", + "colorMode": "none", + "columnId": "1e6343ff-1121-4ec5-9f63-27a6479b00ef" }, - "point_size": 1, - "separate_axis": 0, - "split_mode": "everything", - "stacked": "none", - "time_range_mode": "entire_time_range" + { + "alignment": "left", + "colorMode": "none", + "columnId": "470d72f2-1e84-40a6-9285-8f12ebb65f7d" + } + ], + "layerId": "61d39368-0943-4997-b7e0-1a7b5b3dfc01", + "layerType": "data", + "sorting": { + "columnId": "1e6343ff-1121-4ec5-9f63-27a6479b00ef" } - ], - "show_grid": 1, - "show_legend": 1, - "time_field": "", - "time_range_mode": "entire_time_range", - "tooltip_mode": "show_all", - "truncate_legend": 1, - "type": "table", - "use_kibana_indexes": true + } }, "title": "[Zscaler][ZPA] Slowest Applications", - "type": "metrics", - "uiState": {} - } + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {}, + "hidePanelTitles": false }, "gridData": { "h": 15, @@ -1289,9 +1403,9 @@ "y": 65 }, "panelIndex": "f2485352-f2fd-4321-a629-5763dfd34dbb", - "title": "Slowest Applications [Logs Zscaler ZPA]", - "type": "visualization", - "version": "7.16.2" + "title": "[Zscaler][ZPA] Slowest Applications", + "type": "lens", + "version": "8.7.1" }, { "embeddableConfig": { @@ -1320,7 +1434,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "fbf1c4c1-78da-42df-b707-53b37efd5309": { "columnOrder": [ @@ -1370,7 +1484,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-0", + "index": "filter-index-pattern-0", "key": "data_stream.dataset", "negate": false, "params": { @@ -1391,7 +1505,7 @@ "meta": { "alias": null, "disabled": false, - "indexRefName": "filter-index-pattern-1", + "index": "filter-index-pattern-1", "key": "zscaler_zpa.user_activity.server_setup_time", "negate": false, "type": "exists" @@ -1419,7 +1533,9 @@ } ], "layerId": "fbf1c4c1-78da-42df-b707-53b37efd5309", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -1439,13 +1555,13 @@ "panelIndex": "b9cc9ecc-bfcd-437f-9f5d-2d00d7bc72df", "title": "Slowest Connector Server [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"31d17945-828a-4b1e-9d63-5ff628cae1b3\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternId\":\"logs-*\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", + "layerListJSON": "[{\"alpha\":1,\"id\":\"31d17945-828a-4b1e-9d63-5ff628cae1b3\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{\"type\":\"TILE\"},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", "mapStateJSON": "{\"zoom\":1.06,\"center\":{\"lon\":-2.31842,\"lat\":-20.26942},\"timeFilters\":{\"from\":\"now-15y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "[Zscaler][ZPA] Users by region", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" @@ -1477,17 +1593,18 @@ "panelIndex": "15fb12a8-4756-45a9-96d7-9cb7e721e5b2", "title": "Users by region [Logs Zscaler ZPA]", "type": "map", - "version": "7.16.2" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Zscaler ZPA] User Activity and Status Logs", "version": 1 }, - "coreMigrationVersion": "7.16.2", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:59:37.334Z", "id": "zscaler_zpa-3b709f70-3a98-11ed-9e41-155bc0d23bc2", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { @@ -1622,22 +1739,22 @@ }, { "id": "logs-*", - "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:indexpattern-datasource-layer-61d39368-0943-4997-b7e0-1a7b5b3dfc01", "type": "index-pattern" }, { "id": "logs-*", - "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:kibanaSavedObjectMeta.searchSourceJSON.filter[1].meta.index", + "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:e6888867-04e8-4d32-a1c4-a73603fe19e1", "type": "index-pattern" }, { "id": "logs-*", - "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:kibanaSavedObjectMeta.searchSourceJSON.filter[2].meta.index", + "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:0a5dc661-381e-4c9b-ad56-bb5a32482fa7", "type": "index-pattern" }, { "id": "logs-*", - "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:metrics_f2485352-f2fd-4321-a629-5763dfd34dbb_0_index_pattern", + "name": "f2485352-f2fd-4321-a629-5763dfd34dbb:731b0880-93fa-46ee-9ce4-5ec88c8af12f", "type": "index-pattern" }, { diff --git a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2.json b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2.json index 549bb6b2c8e..9cd4101c36a 100644 --- a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2.json +++ b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows App Connector Status Logs collected by the Zscaler ZPA integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "71315a2c-1062-4780-b763-c2b372d80193": { "columnOrder": [ @@ -70,7 +71,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } } } @@ -85,12 +86,15 @@ "visualization": { "accessor": "302faced-3e0e-4499-88da-15fc6fbc2818", "layerId": "71315a2c-1062-4780-b763-c2b372d80193", - "layerType": "data" + "layerType": "data", + "size": "xl", + "textAlign": "center", + "titlePosition": "bottom" } }, "title": "", "type": "lens", - "visualizationType": "lnsMetric" + "visualizationType": "lnsLegacyMetric" }, "enhancements": {}, "hidePanelTitles": false @@ -105,7 +109,7 @@ "panelIndex": "18145f05-d996-46b0-a824-ea77aa25064a", "title": "Total App Connectors [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -124,7 +128,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "877447c2-e230-4017-8615-7e8f2c35fbad": { "columnOrder": [ @@ -139,7 +143,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "3113d320-32bd-40f4-9f86-745409a0a9df": { "customLabel": true, @@ -181,7 +185,9 @@ } ], "layerId": "877447c2-e230-4017-8615-7e8f2c35fbad", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -201,7 +207,7 @@ "panelIndex": "cd828278-e5b5-40a7-8191-dbfca4b7cff5", "title": "Top 10 ZEN with Frequent Usage [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -220,7 +226,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "1943d23c-54c2-4a13-83fa-3df1b0ccd9d4": { "columnOrder": [ @@ -254,7 +260,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -277,7 +283,9 @@ } ], "layerId": "1943d23c-54c2-4a13-83fa-3df1b0ccd9d4", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -297,7 +305,7 @@ "panelIndex": "1d31f0ac-7353-41b7-8057-56a4a2a6716b", "title": "Top 10 Connectors by Name [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -316,7 +324,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4168c43c-28f9-4ffa-a1d2-a5989c490d72": { "columnOrder": [ @@ -359,6 +367,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -408,6 +417,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -442,7 +452,7 @@ "panelIndex": "cef662eb-f8b5-4998-a4b6-a9877b731e27", "title": "CPU Utilization by Connector Over Time [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -461,7 +471,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "4168c43c-28f9-4ffa-a1d2-a5989c490d72": { "columnOrder": [ @@ -504,6 +514,7 @@ "label": "@timestamp", "operationType": "date_histogram", "params": { + "includeEmptyRows": true, "interval": "auto" }, "scale": "interval", @@ -553,6 +564,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "line", @@ -587,7 +599,7 @@ "panelIndex": "02d9645a-7b0a-44da-b915-58c901ea0d3c", "title": "Memory Utilization by Connector Over Time [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -606,7 +618,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "963d92b1-a9e0-4c39-842e-e202f72e0110": { "columnOrder": [ @@ -640,7 +652,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -685,6 +697,7 @@ ], "legend": { "isVisible": true, + "legendSize": "auto", "position": "right" }, "preferredSeriesType": "bar_horizontal_stacked", @@ -719,7 +732,7 @@ "panelIndex": "72ba98f0-08f1-486f-8150-53fad9b25fff", "title": "Distribution of App Connector Status by Session Type [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -738,7 +751,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "93b89030-71b2-419d-92c4-6023f99b1503": { "columnOrder": [ @@ -813,7 +826,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "aa3ba0e8-495f-466e-a7c9-b79202245a09": { "customLabel": true, @@ -869,7 +882,9 @@ } ], "layerId": "93b89030-71b2-419d-92c4-6023f99b1503", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -889,7 +904,7 @@ "panelIndex": "ff9ec9f6-5a8b-46c3-91bb-c930c6ddd44d", "title": "Distribution of App Connector by Session Type, Session Status, OS Platform [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -908,7 +923,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "e92e1e53-f00a-4def-b2fb-50882e25d4e6": { "columnOrder": [ @@ -923,7 +938,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "c1e1a7cb-c9a1-48ff-b690-dfe52500e56c": { "customLabel": true, @@ -967,7 +982,9 @@ } ], "layerId": "e92e1e53-f00a-4def-b2fb-50882e25d4e6", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -987,13 +1004,13 @@ "panelIndex": "d5bee67f-b12a-46ee-bc91-e57386cc89f2", "title": "Top 10 Connector Name [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"3099042d-0154-49b6-8c0c-f492730c5835\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternId\":\"logs-*\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", + "layerListJSON": "[{\"alpha\":1,\"id\":\"3099042d-0154-49b6-8c0c-f492730c5835\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{\"type\":\"TILE\"},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", "mapStateJSON": "{\"zoom\":0.15,\"center\":{\"lon\":-130.09157,\"lat\":0},\"timeFilters\":{\"from\":\"now-50y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "[Zscaler][ZPA] App Connectors by region", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" @@ -1025,13 +1042,13 @@ "panelIndex": "797f632e-80e5-446f-b760-ad2682841a99", "title": "App Connectors by Region [Logs Zscaler ZPA]", "type": "map", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { "attributes": { "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"72f12276-ca0b-455c-a518-bf4493c7d673\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"field\":\"zscaler_zpa.app_connector_status.connector.group\",\"type\":\"cardinality\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternId\":\"logs-*\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", + "layerListJSON": "[{\"alpha\":1,\"id\":\"72f12276-ca0b-455c-a518-bf4493c7d673\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\",\"lightModeDefault\":\"road_map\"},\"style\":{\"type\":\"TILE\"},\"type\":\"EMS_VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"0a3d538b-2454-4860-aa46-46f706c738b1\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"observer.geo.location\",\"id\":\"aab6b218-afd7-47cf-825f-a39f7b57b1fe\",\"metrics\":[{\"field\":\"zscaler_zpa.app_connector_status.connector.group\",\"type\":\"cardinality\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\",\"indexPatternRefName\":\"layer_1_source_index_pattern\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", "mapStateJSON": "{\"zoom\":0.69,\"center\":{\"lon\":-81.88323,\"lat\":20.96631},\"timeFilters\":{\"from\":\"now-15y\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[],\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"disableInteractive\":false,\"disableTooltipControl\":false,\"hideToolbarOverlay\":false,\"hideLayerControl\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"browserLocation\":{\"zoom\":2},\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"}}", "title": "[Zscaler][ZPA] Connector Groups by region", "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" @@ -1042,14 +1059,14 @@ "isLayerTOCOpen": true, "mapBuffer": { "maxLat": 85.05113, - "maxLon": 180, + "maxLon": 360, "minLat": -85.05113, - "minLon": -360 + "minLon": -720 }, "mapCenter": { - "lat": 20.96631, - "lon": -81.88323, - "zoom": 0.69 + "lat": 0, + "lon": -130.09157, + "zoom": 0.15 }, "openTOCDetails": [] }, @@ -1063,17 +1080,18 @@ "panelIndex": "11b27822-2f89-47bf-9fc0-18bd209bedcf", "title": "Connector Groups by Region [Logs Zscaler ZPA]", "type": "map", - "version": "7.16.2" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Zscaler ZPA] App Connector Status Logs", "version": 1 }, - "coreMigrationVersion": "7.16.2", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:57:37.284Z", "id": "zscaler_zpa-893ef040-3a88-11ed-9e41-155bc0d23bc2", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2.json b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2.json index 7118d963ba1..2d83fb2ed26 100644 --- a/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2.json +++ b/packages/zscaler_zpa/kibana/dashboard/zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2.json @@ -1,7 +1,6 @@ { "attributes": { "description": "This dashboard shows Audit Logs collected by the Zscaler ZPA integration.", - "hits": 0, "kibanaSavedObjectMeta": { "searchSourceJSON": { "filter": [ @@ -36,6 +35,8 @@ "optionsJSON": { "hidePanelTitles": false, "syncColors": false, + "syncCursor": true, + "syncTooltips": false, "useMargins": true }, "panelsJSON": [ @@ -56,7 +57,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "d955d548-c620-418f-addf-a6ed1dfe5510": { "columnOrder": [ @@ -71,7 +72,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "8a4481ce-ba25-410c-bfb3-ec3e0798ad8a": { "customLabel": true, @@ -113,7 +114,9 @@ } ], "layerId": "d955d548-c620-418f-addf-a6ed1dfe5510", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -133,7 +136,7 @@ "panelIndex": "ba73376e-4182-4b89-9c8a-aff2bc566165", "title": "Top Users with Most Activities [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -152,7 +155,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "0337d250-104e-40b7-9daa-e6fe700c426b": { "columnOrder": [ @@ -167,7 +170,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "d880e7d2-1014-46df-b6f5-a6d0f5807f35": { "customLabel": true, @@ -203,15 +206,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "d880e7d2-1014-46df-b6f5-a6d0f5807f35" - ], "layerId": "0337d250-104e-40b7-9daa-e6fe700c426b", "layerType": "data", "legendDisplay": "default", - "metric": "7b144756-b7cc-4296-9dd8-2e61838a85e7", + "legendSize": "auto", + "metrics": [ + "7b144756-b7cc-4296-9dd8-2e61838a85e7" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "d880e7d2-1014-46df-b6f5-a6d0f5807f35" + ] } ], "shape": "pie" @@ -234,7 +240,7 @@ "panelIndex": "95dd5419-2d75-4e1a-87c7-ae41953a894d", "title": "Distribution of Audit Events by type of Operation [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -253,7 +259,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "417a4f1a-6348-4b45-9a8e-9e9d63671574": { "columnOrder": [ @@ -287,7 +293,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" } }, "incompleteColumns": {} @@ -304,15 +310,18 @@ "layers": [ { "categoryDisplay": "default", - "groups": [ - "5ed9edc5-85af-4406-a23a-366e90928f45" - ], "layerId": "417a4f1a-6348-4b45-9a8e-9e9d63671574", "layerType": "data", "legendDisplay": "default", - "metric": "c88a9fab-24ce-4bf1-a726-bf6ad4134b81", + "legendSize": "auto", + "metrics": [ + "c88a9fab-24ce-4bf1-a726-bf6ad4134b81" + ], "nestedLegend": false, - "numberDisplay": "percent" + "numberDisplay": "percent", + "primaryGroups": [ + "5ed9edc5-85af-4406-a23a-366e90928f45" + ] } ], "shape": "pie" @@ -335,7 +344,7 @@ "panelIndex": "4a6702e2-adf1-4535-bbd2-baff2ccc73ce", "title": "Distribution of Audit Events by Object Type [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -354,7 +363,7 @@ ], "state": { "datasourceStates": { - "indexpattern": { + "formBased": { "layers": { "7412c367-8e4a-4f2c-8f51-a4c51534c7a0": { "columnOrder": [ @@ -369,7 +378,7 @@ "label": "Count", "operationType": "count", "scale": "ratio", - "sourceField": "Records" + "sourceField": "___records___" }, "e99e9844-c523-4416-ae9a-ca2f5dbe362e": { "customLabel": true, @@ -411,7 +420,9 @@ } ], "layerId": "7412c367-8e4a-4f2c-8f51-a4c51534c7a0", - "layerType": "data" + "layerType": "data", + "rowHeight": "single", + "rowHeightLines": 1 } }, "title": "", @@ -431,7 +442,7 @@ "panelIndex": "3e9e7c4d-bdfc-494e-ba7b-9480a70a88fd", "title": "Top 10 Objects on which most operations are performed [Logs Zscaler ZPA]", "type": "lens", - "version": "7.16.2" + "version": "8.7.1" }, { "embeddableConfig": { @@ -449,17 +460,18 @@ "panelRefName": "panel_f34abe48-e680-4f67-a089-9338c05898e7", "title": "Audit Operations Details [Logs Zscaler ZPA]", "type": "search", - "version": "7.16.2" + "version": "8.7.1" } ], "timeRestore": false, "title": "[Logs Zscaler ZPA] Audit Logs", "version": 1 }, - "coreMigrationVersion": "7.16.2", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:57:45.166Z", "id": "zscaler_zpa-a0742450-3a89-11ed-9e41-155bc0d23bc2", "migrationVersion": { - "dashboard": "7.16.0" + "dashboard": "8.7.0" }, "references": [ { diff --git a/packages/zscaler_zpa/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zpa/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json index a751c35d59c..c7d33f8554f 100644 --- a/packages/zscaler_zpa/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json +++ b/packages/zscaler_zpa/kibana/search/zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53.json @@ -28,10 +28,11 @@ ], "title": "[Zscaler][ZPA] Audit Operations Details" }, - "coreMigrationVersion": "7.16.2", + "coreMigrationVersion": "8.7.1", + "created_at": "2023-07-12T04:56:41.308Z", "id": "zscaler_zpa-d9d5e800-537b-11ec-9527-b704eaaa5c53", "migrationVersion": { - "search": "7.9.3" + "search": "8.0.0" }, "references": [ { diff --git a/packages/zscaler_zpa/kibana/tags.yml b/packages/zscaler_zpa/kibana/tags.yml new file mode 100644 index 00000000000..47f20a8f551 --- /dev/null +++ b/packages/zscaler_zpa/kibana/tags.yml @@ -0,0 +1,4 @@ +- text: Security Solution + asset_types: + - dashboard + - search diff --git a/packages/zscaler_zpa/manifest.yml b/packages/zscaler_zpa/manifest.yml index 1b8ac6b91ee..9490232ef4b 100644 --- a/packages/zscaler_zpa/manifest.yml +++ b/packages/zscaler_zpa/manifest.yml @@ -1,7 +1,7 @@ -format_version: 2.7.0 +format_version: "3.0.0" name: zscaler_zpa title: Zscaler Private Access -version: "1.9.0" +version: "1.13.0" source: license: Elastic-2.0 description: Collect logs from Zscaler Private Access (ZPA) with Elastic Agent. @@ -11,8 +11,10 @@ categories: - network - vpn_security conditions: - kibana.version: ^7.16.2 || ^8.0.0 - elastic.subscription: basic + kibana: + version: ^8.7.1 + elastic: + subscription: basic screenshots: - src: /img/zscaler-zpa-screenshot.png title: Zscaler ZPA app connector status dashboard screenshot @@ -71,3 +73,4 @@ policy_templates: description: Collecting Zscaler Private Access logs via TCP input. owner: github: elastic/security-external-integrations + type: elastic